diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000..09e6018f85
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.mdx text eol=lf
diff --git a/.github/.probe/writer.txt b/.github/.probe/writer.txt
new file mode 100644
index 0000000000..31a0b6ebc8
--- /dev/null
+++ b/.github/.probe/writer.txt
@@ -0,0 +1,16 @@
+You are helpful senior technical writer.
+Your role is to automatically assist with GitHub issues.
+
+Before jumping on the task or replying, you first should analyze the user request or issue details thoroughly.
+
+When responding:
+1. Be concise but thorough in your responses.
+2. If the issue description is unclear, ask clarifying questions.
+3. Request any additional information you might need to better assist
+4. Provide helpful information related to the query
+5. Try to provide an elegant and concise solution.
+6. If there are multiple different solutions or next steps, convey it in the response
+7. If solution is clear, you can jump to implementation right away, if not, you can ask user a clarification question, by calling attempt_completion tool, with required details.
+
+When writing content:
+Don’t use title case. Following sentence case conventions, like in Google and GitHub style guides.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..f6faee6938
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/scripts/sync-versions-updater.py b/.github/scripts/sync-versions-updater.py
new file mode 100644
index 0000000000..96c3d4b62e
--- /dev/null
+++ b/.github/scripts/sync-versions-updater.py
@@ -0,0 +1,312 @@
+#!/usr/bin/env python3
+
+import argparse
+import json
+import re
+import sys
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+VERSION_TAG = re.compile(r"^v(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$")
+PINNED_VERSION = r"v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?"
+USER_AGENT = "tyk-version-updater/1.0"
+
+
+COMPONENTS = {
+    "dashboard": {
+        "repo": "tykio/tyk-dashboard",
+        "allow_prerelease": False,
+    },
+    "gateway_ee": {
+        "repo": "tykio/tyk-gateway-ee",
+        "allow_prerelease": False,
+    },
+    "pump": {
+        "repo": "tykio/tyk-pump-docker-pub",
+        "allow_prerelease": False,
+    },
+    "portal": {
+        "repo": "tykio/portal",
+        "allow_prerelease": False,
+    },
+    "ai_studio": {
+        "repo": "tykio/tyk-ai-studio",
+        "allow_prerelease": True,
+    },
+    "microgateway": {
+        "repo": "tykio/tyk-microgateway",
+        "allow_prerelease": True,
+    },
+}
+
+
+def fetch_json(url: str) -> dict:
+    req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
+    with urllib.request.urlopen(req, timeout=30) as response:
+        return json.load(response)
+
+
+def prerelease_sort_key(prerelease: str) -> tuple:
+    parts = []
+    for part in prerelease.split("."):
+        number_match = re.search(r"\d+", part)
+        prefix = part[: number_match.start()] if number_match else part
+        number = int(number_match.group()) if number_match else -1
+        suffix = part[number_match.end() :] if number_match else ""
+        parts.append((prefix, number, suffix))
+    return tuple(parts)
+
+
+def tag_sort_key(tag: str) -> tuple:
+    match = VERSION_TAG.match(tag)
+    if not match:
+        raise ValueError(f"Invalid version tag: {tag}")
+
+    major, minor, patch, prerelease = match.groups()
+    base = tuple(int(part) for part in (major, minor, patch))
+    if prerelease is None:
+        return (*base, 1, ())
+    return (*base, 0, prerelease_sort_key(prerelease))
+
+
+def latest_tag(image_repo: str, allow_prerelease: bool) -> str:
+    namespace, repo = image_repo.split("/", 1)
+    url = (
+        f"https://hub.docker.com/v2/namespaces/{namespace}/repositories/"
+        f"{repo}/tags?page_size=100"
+    )
+    version_tags = []
+
+    # Docker Hub orders tags by last push, so the newest release is always on
+    # the first page; scanning further pages would only matter if 100+ tags
+    # were pushed after it.
+    payload = fetch_json(url)
+    for result in payload.get("results", []):
+        name = result.get("name", "")
+        match = VERSION_TAG.match(name)
+        if not match:
+            continue
+        prerelease = match.group(4)
+        if prerelease and not allow_prerelease:
+            continue
+        if prerelease and not prerelease.startswith("rc"):
+            continue
+        version_tags.append((tag_sort_key(name), name))
+
+    if not version_tags:
+        release_type = "version" if allow_prerelease else "stable version"
+        raise RuntimeError(f"No {release_type} tags found for {image_repo}")
+
+    version_tags.sort()
+    return version_tags[-1][1]
+
+
+def replace_pattern(
+    text: str,
+    pattern: str,
+    replacement: str,
+    path: Path,
+    label: str,
+    expected_count: int = 1,
+) -> str:
+    updated_text, count = re.subn(pattern, replacement, text, flags=re.MULTILINE)
+    if count != expected_count:
+        raise RuntimeError(
+            f"{path}: expected {expected_count} replacement(s) for {label}, got {count}"
+        )
+    return updated_text
+
+
+def render_file(path: Path, replacements: list[tuple[str, str, str]]) -> str:
+    original = path.read_text()
+    updated = original
+    for pattern, replacement, label in replacements:
+        updated = replace_pattern(updated, pattern, replacement, path, label)
+    return updated
+
+
+def render_replacements(
+    replacements: dict[Path, list[tuple[str, str, str]]],
+) -> dict[Path, str]:
+    return {
+        path: render_file(path, file_replacements)
+        for path, file_replacements in replacements.items()
+    }
+
+
+def build_replacements(versions: dict[str, str]) -> dict[Path, list[tuple[str, str, str]]]:
+    return {
+        REPO_ROOT / "docker/self-managed/.env.example": [
+            (r"^(DASHBOARD_VERSION=).+$", rf"\g<1>{versions['dashboard']}", "dashboard env"),
+            (r"^(GATEWAY_VERSION=).+$", rf"\g<1>{versions['gateway_ee']}", "gateway env"),
+            (r"^(PUMP_VERSION=).+$", rf"\g<1>{versions['pump']}", "pump env"),
+            (r"^(PORTAL_VERSION=).+$", rf"\g<1>{versions['portal']}", "portal env"),
+        ],
+        REPO_ROOT / "docker/hybrid/.env.example": [
+            (r"^(GATEWAY_VERSION=).+$", rf"\g<1>{versions['gateway_ee']}", "gateway env"),
+            (r"^(PUMP_VERSION=).+$", rf"\g<1>{versions['pump']}", "pump env"),
+        ],
+        REPO_ROOT / "docker/self-managed/docker-compose.yml": [
+            (
+                r"(tykio/tyk-dashboard:\$\{DASHBOARD_VERSION:-)[^}]+(\})",
+                rf"\g<1>{versions['dashboard']}\2",
+                "dashboard fallback",
+            ),
+            (
+                r"(tykio/tyk-gateway-ee:\$\{GATEWAY_VERSION:-)[^}]+(\})",
+                rf"\g<1>{versions['gateway_ee']}\2",
+                "gateway fallback",
+            ),
+            (
+                r"(tykio/tyk-pump-docker-pub:\$\{PUMP_VERSION:-)[^}]+(\})",
+                rf"\g<1>{versions['pump']}\2",
+                "pump fallback",
+            ),
+            (
+                r"(tykio/portal:\$\{PORTAL_VERSION:-)[^}]+(\})",
+                rf"\g<1>{versions['portal']}\2",
+                "portal fallback",
+            ),
+        ],
+        REPO_ROOT / "docker/hybrid/docker-compose.yml": [
+            (
+                r"(tykio/tyk-gateway-ee:\$\{GATEWAY_VERSION:-)[^}]+(\})",
+                rf"\g<1>{versions['gateway_ee']}\2",
+                "gateway fallback",
+            ),
+            (
+                r"(tykio/tyk-pump-docker-pub:\$\{PUMP_VERSION:-)[^}]+(\})",
+                rf"\g<1>{versions['pump']}\2",
+                "pump fallback",
+            ),
+        ],
+        REPO_ROOT / "docker/self-managed/README.md": [
+            (r"^(DASHBOARD_VERSION=).+$", rf"\g<1>{versions['dashboard']}", "dashboard readme"),
+            (r"^(GATEWAY_VERSION=).+$", rf"\g<1>{versions['gateway_ee']}", "gateway readme"),
+            (r"^(PUMP_VERSION=).+$", rf"\g<1>{versions['pump']}", "pump readme"),
+            (r"^(PORTAL_VERSION=).+$", rf"\g<1>{versions['portal']}", "portal readme"),
+            (
+                r"(tykio/portal:\$\{PORTAL_VERSION:-)[^}]+(\})",
+                rf"\g<1>{versions['portal']}\2",
+                "portal image example",
+            ),
+        ],
+        REPO_ROOT / "docker/hybrid/README.md": [
+            (r"^(GATEWAY_VERSION=).+$", rf"\g<1>{versions['gateway_ee']}", "gateway readme"),
+            (r"^(PUMP_VERSION=).+$", rf"\g<1>{versions['pump']}", "pump readme"),
+        ],
+        REPO_ROOT / "docker/ai-studio/.env.example": [
+            (r"^(AI_STUDIO_VERSION=).+$", rf"\g<1>{versions['ai_studio']}", "ai studio env"),
+            (
+                r"^(MICROGATEWAY_VERSION=).+$",
+                rf"\g<1>{versions['microgateway']}",
+                "microgateway env",
+            ),
+        ],
+        REPO_ROOT / "docker/ai-studio/docker-compose.yml": [
+            (
+                r"(tykio/tyk-ai-studio:\$\{AI_STUDIO_VERSION:-)[^}]+(\})",
+                rf"\g<1>{versions['ai_studio']}\2",
+                "ai studio fallback",
+            ),
+            (
+                r"(tykio/tyk-microgateway:\$\{MICROGATEWAY_VERSION:-)[^}]+(\})",
+                rf"\g<1>{versions['microgateway']}\2",
+                "microgateway fallback",
+            ),
+        ],
+        REPO_ROOT / "kubernetes/helm-self-managed/values.yaml": [
+            (
+                rf"(repository: tykio/tyk-gateway-ee\s+tag: ){PINNED_VERSION}",
+                rf"\g<1>{versions['gateway_ee']}",
+                "gateway tag",
+            ),
+            (
+                rf"(repository: tykio/tyk-dashboard\s+tag: ){PINNED_VERSION}",
+                rf"\g<1>{versions['dashboard']}",
+                "dashboard tag",
+            ),
+            (
+                rf"(repository: tykio/tyk-pump-docker-pub\s+tag: ){PINNED_VERSION}",
+                rf"\g<1>{versions['pump']}",
+                "pump tag",
+            ),
+            (
+                rf"(repository: tykio/portal\s+tag: ){PINNED_VERSION}",
+                rf"\g<1>{versions['portal']}",
+                "portal tag",
+            ),
+        ],
+        REPO_ROOT / "kubernetes/helm-hybrid/values.yaml": [
+            (
+                rf"(repository: tykio/tyk-gateway-ee\s+tag: ){PINNED_VERSION}",
+                rf"\g<1>{versions['gateway_ee']}",
+                "gateway tag",
+            ),
+            (
+                rf"(repository: tykio/tyk-pump-docker-pub\s+tag: ){PINNED_VERSION}",
+                rf"\g<1>{versions['pump']}",
+                "pump tag",
+            ),
+        ],
+    }
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        description="Update pinned Tyk component versions across the repo."
+    )
+    parser.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Print the resolved versions without modifying files.",
+    )
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+
+    try:
+        versions = {
+            name: latest_tag(component["repo"], component["allow_prerelease"])
+            for name, component in COMPONENTS.items()
+        }
+        replacements = build_replacements(versions)
+        rendered_files = render_replacements(replacements)
+    except (RuntimeError, urllib.error.URLError) as exc:
+        print(f"Failed to prepare version updates: {exc}", file=sys.stderr)
+        return 1
+
+    print("Resolved latest Tyk component image tags:")
+    for name, component in sorted(COMPONENTS.items()):
+        suffix = " (RCs allowed)" if component["allow_prerelease"] else ""
+        print(f"  {name}: {versions[name]}{suffix}")
+
+    if args.dry_run:
+        print()
+        print("Validated replacement targets. No files changed.")
+        return 0
+
+    changed_files = []
+    for path, rendered in rendered_files.items():
+        if rendered != path.read_text():
+            path.write_text(rendered)
+            changed_files.append(path)
+
+    print()
+    if changed_files:
+        print("Updated files:")
+        for path in changed_files:
+            print(f"  {path.relative_to(REPO_ROOT)}")
+    else:
+        print("No files changed.")
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/.github/workflows/autoupdate.yaml b/.github/workflows/autoupdate.yaml
new file mode 100644
index 0000000000..408072bbbe
--- /dev/null
+++ b/.github/workflows/autoupdate.yaml
@@ -0,0 +1,30 @@
+# autoupdate is a GitHub Action that auto-updates pull requests branches whenever changes land on their destination branch.
+name: autoupdate
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  autoupdate:
+    name: autoupdate
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.PROBE_APP_ID }}
+          private-key: ${{ secrets.PROBE_APP_PRIVATE_KEY }}
+          owner: TykTechnologies
+
+      - uses: docker://chinthakagodawita/autoupdate-action:v1@sha256:53d7013ad4689b703d2715d4b17d4901bb0a385e495e0b481f37adbe9b3cc3fc
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          # Only monitor PRs that are not currently in the draft state.
+          PR_READY_STATE: "ready_for_review"
+          MERGE_CONFLICT_ACTION: "ignore"  # Possible option to prevent retrying failed merges
diff --git a/.github/workflows/check-external-links.yml b/.github/workflows/check-external-links.yml
new file mode 100644
index 0000000000..6c5014495c
--- /dev/null
+++ b/.github/workflows/check-external-links.yml
@@ -0,0 +1,24 @@
+name: Check External Links
+
+on:
+  schedule:
+    - cron: '0 9 * * 1'  # Every Monday at 09:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  external-links:
+    name: Check External URLs
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+
+    - name: Check external links
+      uses: lycheeverse/lychee-action@v2
+      with:
+        args: --config lychee.toml '**/*.md' '**/*.mdx'
+        fail: false
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index a3988f5b21..eb5243e5bf 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -1,35 +1,96 @@
 name: Deploy Documentation
 
 on:
-  workflow_dispatch:  # Manual trigger only
+  workflow_dispatch:
     inputs:
       subfolder:
-        description: 'Subfolder for documentation (e.g., docs3, docsv3, docs)'
+        description: 'Subfolder for documentation (leave empty for root deployment)'
         required: false
-        default: 'docs3'
+        default: ''
         type: string
+      triggering_pr_number:
+        description: 'PR number that triggered this deployment'
+        required: false
+        default: ''
+        type: string
+      triggering_pr_title:
+        description: 'PR title that triggered this deployment'
+        required: false
+        default: ''
+        type: string
+      triggering_commit_sha:
+        description: 'Commit SHA that triggered this deployment'
+        required: false
+        default: ''
+        type: string
+      triggering_branch:
+        description: 'Branch that triggered this deployment'
+        required: false
+        default: ''
+        type: string
+      original_pr_number:
+        description: 'Original PR number (if different from triggering PR)'
+        required: false
+        default: ''
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+# Ensure only latest deployment runs
+concurrency:
+  group: docs-deployment
+  cancel-in-progress: true
 
 jobs:
   merge-docs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.PROBE_APP_ID }}
+          private-key: ${{ secrets.PROBE_APP_PRIVATE_KEY }}
+          owner: TykTechnologies
+
+      - name: Log deployment trigger information
+        run: |
+          echo "🚀 Starting documentation deployment"
+          echo "📋 Trigger Information:"
+          echo "  - Branch: ${{ inputs.triggering_branch || 'N/A' }}"
+          echo "  - Commit: ${{ inputs.triggering_commit_sha || 'N/A' }}"
+          if [ -n "${{ inputs.triggering_pr_number }}" ]; then
+            echo "  - PR: #${{ inputs.triggering_pr_number }} - ${{ inputs.triggering_pr_title }}"
+            if [ -n "${{ inputs.original_pr_number }}" ] && [ "${{ inputs.original_pr_number }}" != "${{ inputs.triggering_pr_number }}" ]; then
+              echo "  - Original PR: #${{ inputs.original_pr_number }} (cherry-picked)"
+            fi
+          else
+            echo "  - PR: N/A (direct push)"
+          fi
+          echo "  - Timestamp: $(date)"
+          echo "  - Workflow Run: ${{ github.run_id }}"
+          echo "  - Subfolder: ${{ inputs.subfolder || '(root deployment)' }}"
+
       - name: Checkout production branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: production
-          token: ${{ secrets.ORG_GH_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 0  # Fetch all history for all branches
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: '3.9'
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
+          python -m pip install --upgrade 'pip>=23.0,<25'
           # Add any additional dependencies if needed
+          pip install 'pyyaml>=6.0,<7' 'ruamel.yaml>=0.18,<0.19'
 
       - name: Read branches config
         id: config
@@ -43,77 +104,69 @@ jobs:
 
       - name: Cleanup old version folders and assets
         run: |
-          echo "🧹 Cleaning up old version folders and assets..."
-          
-          # Get current version folders from config
-          current_folders=$(python3 -c "import json; config=json.load(open('branches-config.json')); folders=[v.get('folder','') for v in config.get('versions',[]) if v.get('folder','')]; print(' '.join(folders))")
-          
-          echo "📋 Current version folders: $current_folders"
-          
-          # Define asset types that will be regenerated
-          asset_types=(
-            "style.css"
-            "images"
-            "img" 
-            "logo"
-            "favicon.ico"
-            "favicon.png"
-            "snippets"
+          echo "🧹 Cleaning up all content except essential files..."
+          
+          # Define folders to keep (whitelist)
+          keep_folders=(
+            ".github"
+            ".git" 
+            ".devcontainer"
+            "scripts"
+            ".vale"
+            ".probe"
           )
           
-          # Remove old assets (they'll be regenerated from current versions)
-          echo "🎨 Cleaning up old assets..."
-          for asset in "${asset_types[@]}"; do
-            if [ -e "$asset" ]; then
-              echo "🗑️  Removing old asset: $asset"
-              rm -rf "$asset"
-            fi
-          done
-          
-          # Remove old docs.json (will be regenerated)
-          if [ -f "docs.json" ]; then
-            echo "🗑️  Removing old docs.json"
-            rm -f "docs.json"
-          fi
+          # Define files to keep (whitelist)
+          keep_files=(
+            "branches-config.json"
+            ".gitignore" 
+            "README.md"
+            ".vale.ini"
+          )
           
-          # Also clean up the subfolder if it exists (using input parameter)
-          SUBFOLDER="${{ inputs.subfolder || 'docs3' }}"
-          if [ -n "$SUBFOLDER" ] && [ -d "$SUBFOLDER" ]; then
-            echo "🗑️  Removing old $SUBFOLDER subfolder"
-            rm -rf "$SUBFOLDER"
-          fi
+          echo "📋 Folders to keep: ${keep_folders[*]}"
+          echo "📋 Files to keep: ${keep_files[*]}"
           
-          # Remove old version folders that aren't in the current config
-          # Look for directories that look like version folders (numeric or version-like names)
+          # Remove all directories except the ones we want to keep
+          echo "🗑️  Removing old directories..."
           for dir in */; do
             if [ -d "$dir" ]; then
               dir_name=${dir%/}  # Remove trailing slash
-          
-              # Skip non-version directories
-              if [[ "$dir_name" =~ ^\..*$ ]] || [ "$dir_name" = ".github" ]; then
-                continue
-              fi
-          
-              # Check if this folder is in current config
-              is_current=false
-              for current in $current_folders; do
-                if [ "$dir_name" = "$current" ]; then
-                  is_current=true
+              
+              should_keep=false
+              for keep_folder in "${keep_folders[@]}"; do
+                if [ "$dir_name" = "$keep_folder" ]; then
+                  should_keep=true
                   break
                 fi
               done
+              
+              if [ "$should_keep" = false ]; then
+                echo "🗑️  Removing directory: $dir_name/"
+                rm -rf "$dir"
+              else
+                echo "📁 Keeping essential directory: $dir_name/"
+              fi
+            fi
+          done
           
-              # If it's not in current config and looks like a version folder, remove it
-              if [ "$is_current" = false ]; then
-                # Only remove if it looks like a version folder (contains numbers/dots or common version patterns)
-                if [[ "$dir_name" =~ ^[0-9]+\.[0-9]+$ ]] || [[ "$dir_name" =~ ^v[0-9] ]] || [[ "$dir_name" =~ ^[0-9] ]]; then
-                  echo "🗑️  Removing old version folder: $dir_name"
-                  rm -rf "$dir"
-                else
-                  echo "📁 Keeping non-version directory: $dir_name"
+          # Remove all files except the ones we want to keep
+          echo "🗑️  Removing old files..."
+          for file in *; do
+            if [ -f "$file" ]; then
+              should_keep=false
+              for keep_file in "${keep_files[@]}"; do
+                if [ "$file" = "$keep_file" ]; then
+                  should_keep=true
+                  break
                 fi
+              done
+              
+              if [ "$should_keep" = false ]; then
+                echo "🗑️  Removing file: $file"
+                rm -f "$file"
               else
-                echo "📁 Keeping current version folder: $dir_name (will be refreshed)"
+                echo "📄 Keeping essential file: $file"
               fi
             fi
           done
@@ -129,7 +182,7 @@ jobs:
           echo "🔄 Starting branch cloning and organization..."
           
           # Read the branches config and extract branch information
-          branches=$(python3 -c "import json; config=json.load(open('branches-config.json')); [print(f\"{v.get('folder','')}:{v.get('branch','main')}\") for v in config.get('versions',[]) if v.get('folder','')]")
+          branches=$(python3 -c "import json; config=json.load(open('branches-config.json')); [print(f\"{v.get('sourceFolder','')}:{v.get('branch','main')}\") for v in config.get('versions',[]) if v.get('sourceFolder','')]")
           
           echo "📋 Branches to process:"
           echo "$branches"
@@ -160,8 +213,18 @@ jobs:
               mkdir -p "$folder"
               echo "📁 Moving contents from $temp_dir to $folder..."
           
-              # Copy all files except .git directory
-              find "$temp_dir" -mindepth 1 -maxdepth 1 ! -name '.git' -exec cp -r {} "$folder/" \;
+              # Copy documentation content only, excluding development/build files
+              # Excluded: .git, scripts/, branches-config.json, .github/, README.md, .gitignore, .devcontainer/, .probe
+              find "$temp_dir" -mindepth 1 -maxdepth 1 \
+                ! -name '.git' \
+                ! -name 'scripts' \
+                ! -name 'branches-config.json' \
+                ! -name '.github' \
+                ! -name 'README.md' \
+                ! -name '.gitignore' \
+                ! -name '.devcontainer' \
+                ! -name '.probe' \
+                -exec cp -r {} "$folder/" \;
           
               # Clean up temp directory
               rm -rf "$temp_dir"
@@ -180,19 +243,21 @@ jobs:
         run: |
           echo "🔄 Running documentation merger..."
           
-          # Get subfolder from input (with fallback)
-          SUBFOLDER="${{ inputs.subfolder || 'docs3' }}"
-          echo "📁 Using subfolder: $SUBFOLDER"
+          # Get subfolder from input (no fallback - empty means root deployment)
+          SUBFOLDER="${{ inputs.subfolder }}"
+          echo "📁 Using subfolder: '$SUBFOLDER'"
           
           # Run the merge script with branches config
           if [ -n "$SUBFOLDER" ]; then
-            python3 merge_docs_configs.py \
+            echo "📁 Deploying to subfolder: $SUBFOLDER"
+            python3 scripts/merge_docs_configs.py \
               --branches-config branches-config.json \
               --base-dir . \
               --subfolder "$SUBFOLDER" \
               --output docs.json
           else
-            python3 merge_docs_configs.py \
+            echo "📁 Deploying to root (no subfolder)"
+            python3 scripts/merge_docs_configs.py \
               --branches-config branches-config.json \
               --base-dir . \
               --output docs.json
@@ -205,7 +270,7 @@ jobs:
           echo "🧹 Cleaning up temporary cloned version folders..."
           
           # Get current version folders from config
-          current_folders=$(python3 -c "import json; config=json.load(open('branches-config.json')); folders=[v.get('folder','') for v in config.get('versions',[]) if v.get('folder','')]; print(' '.join(folders))")
+          current_folders=$(python3 -c "import json; config=json.load(open('branches-config.json')); folders=[v.get('sourceFolder','') for v in config.get('versions',[]) if v.get('sourceFolder','')]; print(' '.join(folders))")
           
           echo "📋 Removing cloned folders: $current_folders"
           
@@ -219,6 +284,12 @@ jobs:
           
           echo "✅ Cleanup of cloned folders completed!"
 
+      - name: Add canonical URLs to MDX files
+        run: |
+          echo "🧩 Running canonical URL update script..."
+          python3 scripts/add-canonical-urls/index.py || { echo "❌ Canonical script failed"; exit 1; }
+          echo "✅ Canonical URL update completed."
+
       - name: Verify output
         run: |
           echo "📋 Checking generated files..."
@@ -237,10 +308,41 @@ jobs:
           echo "📁 Generated file structure:"
           find . -name "*.mdx" -o -name "*.md" -o -name "*.json" -o -name "*.css" -o -name "*.png" | head -20
 
+      - name: Close previous deployment PRs
+        run: |
+          echo "🔍 Finding and closing previous deployment PRs..."
+          
+          # Find PRs that match BOTH criteria:
+          # 1. Have the "auto-deployment" label
+          # 2. Branch starts with "docs-merge-"
+          DEPLOYMENT_PRS=$(gh pr list \
+            --state open \
+            --label "auto-deployment" \
+            --json number,headRefName,labels \
+            --jq '.[] | select(.headRefName | startswith("docs-merge-")) | .number')
+          
+          if [ -n "$DEPLOYMENT_PRS" ]; then
+            echo "📋 Found deployment PRs to close: $DEPLOYMENT_PRS"
+            
+            for pr_number in $DEPLOYMENT_PRS; do
+              echo "❌ Closing deployment PR #$pr_number"
+              gh pr close "$pr_number" \
+                --comment "🤖 Superseded by newer deployment (Run #${{ github.run_number }})" \
+                || echo "⚠️ Failed to close PR #$pr_number (may already be closed)"
+            done
+            
+            echo "✅ Closed all previous deployment PRs"
+          else
+            echo "✅ No deployment PRs found to close"
+          fi
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        id: create-pr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:
-          token: ${{ secrets.ORG_GH_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           branch: docs-merge-${{ github.run_number }}
           base: production
           title: "🤖 Auto-merge documentation from branches"
@@ -249,9 +351,16 @@ jobs:
             
             This PR contains automatically merged documentation from multiple branches.
             
-            **Generated from:** `branches-config.json`  
-            **Timestamp:** ${{ github.event.head_commit.timestamp }}  
-            **Run ID:** ${{ github.run_id }}
+            **Triggered by:**
+            - **Branch:** ${{ inputs.triggering_branch || 'N/A' }}
+            - **Commit:** ${{ inputs.triggering_commit_sha || 'N/A' }}
+            - **PR:** ${{ inputs.triggering_pr_number && format('#{0} - {1}', inputs.triggering_pr_number, inputs.triggering_pr_title) || 'N/A (direct push)' }}${{ inputs.original_pr_number && inputs.original_pr_number != inputs.triggering_pr_number && format(' (cherry-pick of #{0})', inputs.original_pr_number) || '' }}
+            
+            **Deployment Details:**
+            - **Generated from:** `branches-config.json`  
+            - **Run ID:** ${{ github.run_id }}
+            - **Subfolder:** `${{ inputs.subfolder || '(root deployment)' }}`
+            - **Timestamp:** $(date)
             
             ### Changes Include:
             - ✅ Merged documentation from multiple branches
@@ -259,12 +368,15 @@ jobs:
             - ✅ Updated assets and content structure
             - ✅ Cleaned up outdated version folders
             
-            ### Subfolder Used:
-            `${{ inputs.subfolder || 'docs3' }}`
-            
             ---
             
-            Please review the changes and merge when ready.
+            🚦 **This PR will be processed by merge queue to ensure proper validation and ordering.**
+            
+            Previous deployment PRs have been automatically closed to prevent conflicts.
+          labels: |
+            documentation
+            auto-deployment
+            automated
           commit-message: |
             🤖 Auto-merge documentation from branches
             
@@ -279,10 +391,34 @@ jobs:
           author: ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>
           committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 
+      - name: Enable auto-merge on deployment PR
+        if: steps.create-pr.outputs.pull-request-number
+        run: |
+          PR_NUMBER="${{ steps.create-pr.outputs.pull-request-number }}"
+          echo "� Enabling auto-merge on deployment PR #$PR_NUMBER..."
+          
+          gh pr merge --squash --auto "$PR_NUMBER"
+          
+          echo "✅ Auto-merge enabled on PR #$PR_NUMBER"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
       - name: Create deployment summary
         run: |
           echo "## 📚 Documentation Deployment Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### 🚀 Trigger Information" >> $GITHUB_STEP_SUMMARY
+          echo "- **Branch:** ${{ inputs.triggering_branch || 'N/A' }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Commit:** ${{ inputs.triggering_commit_sha || 'N/A' }}" >> $GITHUB_STEP_SUMMARY
+          if [ -n "${{ inputs.triggering_pr_number }}" ]; then
+            echo "- **PR:** #${{ inputs.triggering_pr_number }} - ${{ inputs.triggering_pr_title }}" >> $GITHUB_STEP_SUMMARY
+            if [ -n "${{ inputs.original_pr_number }}" ] && [ "${{ inputs.original_pr_number }}" != "${{ inputs.triggering_pr_number }}" ]; then
+              echo "- **Original PR:** #${{ inputs.original_pr_number }} (cherry-picked)" >> $GITHUB_STEP_SUMMARY
+            fi
+          else
+            echo "- **PR:** N/A (direct push)" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
           echo "### ✅ Successfully merged documentation" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Generated files:**" >> $GITHUB_STEP_SUMMARY
@@ -294,4 +430,4 @@ jobs:
           fi
           
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Timestamp:** $(date)" >> $GITHUB_STEP_SUMMARY
\ No newline at end of file
+          echo "**Timestamp:** $(date)" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/eod-report-generator.yaml b/.github/workflows/eod-report-generator.yaml
new file mode 100644
index 0000000000..f63ad5b663
--- /dev/null
+++ b/.github/workflows/eod-report-generator.yaml
@@ -0,0 +1,47 @@
+name: EOD Report Generator
+
+on:
+  workflow_dispatch:
+    inputs:
+      MAIN_REVIEWER:
+        description: "The GitHub user ID of the primary reviewer whose approval is required for the PR."
+        required: true
+        default: "sharadregoti"
+      START_DATE:
+        description: "The start date of report (e.g., 2025-02-21T00:00:00.000Z)."
+        required: true
+      END_DATE:
+        description: "The end date of report. Defaults to the current date (e.g., 2025-02-25T00:00:00.000Z)."
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  run-script:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        with:
+          node-version: '20' # Change to your required version
+
+      - name: Install dependencies
+        run: |
+          cd scripts/eod-report-generator
+          npm ci --ignore-scripts
+
+      - name: Run script
+        run: |
+          cd scripts/eod-report-generator
+          node index.js
+        env:
+          MAIN_REVIEWER: ${{ inputs.MAIN_REVIEWER }}
+          START_DATE: ${{ inputs.START_DATE }}
+          END_DATE: ${{ inputs.END_DATE }}
+          GITHUB_TOKEN: ${{ secrets.TYK_SCRIPTS_TOKEN }}  # GitHub Token for API calls
+          ANTHROPIC_KEY: ${{ secrets.ANTHROPIC_KEY }} # Org key already available
diff --git a/.github/workflows/mirror-pr-to-build-deploy.yml b/.github/workflows/mirror-pr-to-build-deploy.yml
index 39e8b21702..b3337b42a4 100644
--- a/.github/workflows/mirror-pr-to-build-deploy.yml
+++ b/.github/workflows/mirror-pr-to-build-deploy.yml
@@ -5,16 +5,28 @@ on:
     types: [opened, synchronize, closed]
     branches: [main]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   mirror-pr:
     runs-on: ubuntu-latest
     if: github.event.action != 'closed'
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.PROBE_APP_ID }}
+          private-key: ${{ secrets.PROBE_APP_PRIVATE_KEY }}
+          owner: TykTechnologies
+
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 0
-          token: ${{ secrets.ORG_GH_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Setup GitHub CLI
         run: gh --version
@@ -23,13 +35,33 @@ jobs:
         run: |
           # Check if mirror PR already exists
           MIRROR_PR=$(gh pr list --base production --head ${{ github.head_ref }} --json number --jq '.[0].number // empty')
-          
+
           if [ -z "$MIRROR_PR" ]; then
             # Create new mirror PR
             echo "Creating new mirror PR..."
-          
-            # Create PR body content
-            PR_BODY="**🔗 Auto-generated mirror PR for Mintlify preview**
+
+            # Write PR body to file; template passed via env var to keep YAML valid
+            printf '%s\n' "$PR_TEMPLATE" "$PR_BODY" > pr_body.txt
+
+            # Escape the title properly to handle special characters and spaces
+            ESCAPED_TITLE=$(printf '%s' "🔄 Preview: ${{ github.event.pull_request.title }}" | sed 's/"/\\"/g')
+
+            gh pr create \
+              --base production \
+              --head "${{ github.head_ref }}" \
+              --title "$ESCAPED_TITLE" \
+              --body-file pr_body.txt \
+              --draft
+
+            echo "✅ Mirror PR created successfully"
+          else
+            echo "🔄 Mirror PR #$MIRROR_PR already exists and will be auto-updated"
+          fi
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PR_TEMPLATE: |
+            **🔗 Auto-generated mirror PR for Mintlify preview**
 
             **Original PR:** #${{ github.event.number }}
             **Author:** @${{ github.event.pull_request.user.login }}
@@ -46,55 +78,30 @@ jobs:
             - Make all comments and reviews on the original PR #${{ github.event.number }}
 
             ## Changes
-            ${{ github.event.pull_request.body }}"
-          
-            gh pr create \
-              --base production \
-              --head ${{ github.head_ref }} \
-              --title "🔄 Preview: ${{ github.event.pull_request.title }}" \
-              --body "$PR_BODY"
-          
-            echo "✅ Mirror PR created successfully"
-          
-            # Get the mirror PR number that was just created
-            MIRROR_PR=$(gh pr list --base production --head ${{ github.head_ref }} --json number --jq '.[0].number // empty')
-          
-            # Comment on the original PR with link to mirror PR
-            if [ -n "$MIRROR_PR" ]; then
-              COMMENT_BODY="🔗 **Preview Link Available**
-
-              This PR has an auto-generated mirror for Mintlify preview:
-              👉 **[View Preview PR #$MIRROR_PR](https://github.com/${{ github.repository }}/pull/$MIRROR_PR)**
-
-              The Mintlify preview link will appear on the mirror PR once it's processed.
-
-              ---
-              *This is an automated comment. All discussion should happen on this PR, not the mirror PR.*"
-          
-              gh pr comment ${{ github.event.number }} --body "$COMMENT_BODY"
-              echo "✅ Comment added to original PR with mirror PR link"
-            fi
-          else
-            echo "🔄 Mirror PR #$MIRROR_PR already exists and will be auto-updated"
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.ORG_GH_TOKEN }}
 
   cleanup-mirror-pr:
     runs-on: ubuntu-latest
     if: github.event.action == 'closed'
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.PROBE_APP_ID }}
+          private-key: ${{ secrets.PROBE_APP_PRIVATE_KEY }}
+          owner: TykTechnologies
+
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 0
-          token: ${{ secrets.ORG_GH_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Handle mirror PR when original is closed
         run: |
           # Find the mirror PR
           MIRROR_PR=$(gh pr list --base production --head ${{ github.head_ref }} --json number --jq '.[0].number // empty')
-          
+
           if [ -n "$MIRROR_PR" ]; then
             if [ "${{ github.event.pull_request.merged }}" = "true" ]; then
               echo "Original PR was merged, closing mirror PR #$MIRROR_PR (no need to merge)..."
@@ -109,4 +116,4 @@ jobs:
             echo "No mirror PR found for branch ${{ github.head_ref }}"
           fi
         env:
-          GH_TOKEN: ${{ secrets.ORG_GH_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/pr_agent.yaml b/.github/workflows/pr_agent.yaml
new file mode 100644
index 0000000000..9c621dfb60
--- /dev/null
+++ b/.github/workflows/pr_agent.yaml
@@ -0,0 +1,26 @@
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+  issue_comment:
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  pr_agent_job:
+    runs-on: ubuntu-latest
+    name: Run pr agent on every pull request, respond to user comments
+    if: ${{ !github.event.pull_request.draft }}
+    steps:
+      - name: PR Agent action step
+        id: pragent
+        uses: Codium-ai/pr-agent@d82f7d3e696cd00822694aaa3096265d3889f3f1  # main
+        env:
+          OPENAI_KEY: ${{ secrets.OPENAI_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/probe-writer.yaml.disabled b/.github/workflows/probe-writer.yaml.disabled
new file mode 100644
index 0000000000..71cdb86c95
--- /dev/null
+++ b/.github/workflows/probe-writer.yaml.disabled
@@ -0,0 +1,24 @@
+name: Probe Writer handler
+
+on:
+  issue_comment:
+    types: [created]
+
+# Define permissions needed for the workflow
+permissions:
+  issues: write
+  pull-requests: write
+  contents: write
+
+jobs:
+  trigger_probe_implement:
+    uses: buger/probe/.github/workflows/probe.yml@88434b11a7543f6506d60c4e2dd6325d8be80142  # main
+    with:
+      command_prefix: "/writer" # Or '/ai', '/ask', etc.
+      allow_edit: true
+      prompt: .github/.probe/writer.txt
+    secrets:
+      ANTHROPIC_API_KEY: ${{ secrets.PROBE_ANTHROPIC_API_KEY }}
+      ANTHROPIC_API_URL: ${{ secrets.PROBE_ANTHROPIC_URL }}
+      APP_ID: ${{ secrets.PROBE_APP_ID }}
+      APP_PRIVATE_KEY: ${{ secrets.PROBE_APP_PRIVATE_KEY }}
\ No newline at end of file
diff --git a/.github/workflows/probe.yaml.disabled b/.github/workflows/probe.yaml.disabled
new file mode 100644
index 0000000000..5866f2da84
--- /dev/null
+++ b/.github/workflows/probe.yaml.disabled
@@ -0,0 +1,37 @@
+name: Probe handler
+
+on:
+  pull_request:
+    types: [opened] #[opened , labeled]
+  issue_comment:
+    types: [created]          
+  issues:
+    types: [opened] #[opened, labeled]  
+    
+# Define permissions needed for the workflow
+permissions:
+  issues: write
+  pull-requests: write
+  contents: read
+
+jobs:
+  trigger_probe_chat:
+    # Uncomment if you want to run on on specific lables, in this example `probe`
+    # if: |
+    #   (github.event_name == 'pull_request' && github.event.action == 'opened') || 
+    #   (github.event_name == 'issues' && github.event.action == 'opened') || 
+    #   (github.event_name == 'issue_comment' && github.event.action == 'created') || 
+    #   ((github.event_name == 'pull_request' || github.event_name == 'issues') && 
+    #    github.event.action == 'labeled' && github.event.label.name == 'probe')
+    # Use the reusable workflow from your repository (replace <your-org/repo> and <ref>)
+    uses: buger/probe/.github/workflows/probe.yml@88434b11a7543f6506d60c4e2dd6325d8be80142  # main
+    # Pass required inputs
+    with:
+      command_prefix: "/probe" # Or '/ai', '/ask', etc.
+      # Optionally override the default npx command if the secret isn't set
+      # default_probe_chat_command: 'node path/to/custom/script.js'
+    # Pass ALL secrets from this repository to the reusable workflow
+    # This includes GITHUB_TOKEN, PROBE_CHAT_COMMAND (if set), ANTHROPIC_API_KEY, etc.
+    secrets:
+      ANTHROPIC_API_KEY: ${{ secrets.PROBE_ANTHROPIC_API_KEY }}
+      ANTHROPIC_API_URL: ${{ secrets.PROBE_ANTHROPIC_URL }}
diff --git a/.github/workflows/release-bot.yaml b/.github/workflows/release-bot.yaml
new file mode 100644
index 0000000000..e3c997d1f8
--- /dev/null
+++ b/.github/workflows/release-bot.yaml
@@ -0,0 +1,214 @@
+name: Cherry-pick to Release Branch
+
+on:
+  issue_comment:
+    types: [created]
+  workflow_call:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  cherry_pick:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.PROBE_APP_ID }}
+          private-key: ${{ secrets.PROBE_APP_PRIVATE_KEY }}
+          owner: TykTechnologies
+
+      - name: Check for release command
+        id: check_command
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { issue, comment } = context.payload;
+            if (!issue || !issue.pull_request || !comment || !comment.body.startsWith('/release to ')) {
+              core.setOutput('release_valid', 'false');
+              return;
+            }
+            const releaseBranch = comment.body.split('/release to ')[1].trim();
+            core.setOutput('release_valid', 'true');
+            core.setOutput('release_branch', releaseBranch);
+            core.setOutput('pr_number', issue.number);
+
+      - name: Check admin permissions
+        if: steps.check_command.outputs.release_valid == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const username = context.payload.comment.user.login;
+            const authorAssociation = context.payload.comment.author_association;
+            
+            // Quick check: Repository owner always allowed
+            if (authorAssociation === 'OWNER') {
+              console.log(`✅ User ${username} is repository owner`);
+              return;
+            }
+            
+            // Check for admin permission
+            try {
+              const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: username
+              });
+              
+              if (permission.permission !== 'admin') {
+                core.setFailed(`❌ Only repository admins can use /release command. User ${username} has: ${permission.permission}`);
+                return;
+              }
+              
+              console.log(`✅ User ${username} has admin permissions`);
+            } catch (error) {
+              core.setFailed(`❌ Permission check failed: ${error.message}`);
+            }
+
+      - name: Install GitHub CLI (for act/local testing)
+        if: steps.check_command.outputs.release_valid == 'true'
+        run: |
+          if ! command -v gh &>/dev/null; then
+            GH_VERSION="2.62.0"
+            curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.deb" -o /tmp/gh.deb
+            sudo dpkg -i /tmp/gh.deb
+            rm /tmp/gh.deb
+          fi
+
+      - name: Checkout repository
+        if: steps.check_command.outputs.release_valid == 'true'
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Set default branch variable
+        if: steps.check_command.outputs.release_valid == 'true'
+        run: echo "DEFAULT_BRANCH=${{ github.event.repository.default_branch }}" >> $GITHUB_ENV
+
+      - name: Skip jobs if not a valid release command
+        if: steps.check_command.outputs.release_valid == 'false'
+        run: echo "Skipping cherry-pick as the release command is not valid."
+        continue-on-error: true
+
+      - name: Setup Git
+        if: steps.check_command.outputs.release_valid == 'true'
+        run: |
+          git config --global user.email "bot@tyk.io"
+          git config --global user.name "Tyk Bot"
+
+      - name: Get PR base and merge SHAs
+        id: pr_details
+        if: steps.check_command.outputs.release_valid == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER=${{ steps.check_command.outputs.pr_number }}
+          MERGE_COMMIT=$(gh pr view "$PR_NUMBER" --json mergeCommit --jq '.mergeCommit.oid // empty')
+          BASE_SHA=$(gh pr view "$PR_NUMBER" --json baseRefOid --jq '.baseRefOid // empty')
+          echo "MERGE_COMMIT=$MERGE_COMMIT" >> $GITHUB_ENV
+          echo "BASE_SHA=$BASE_SHA" >> $GITHUB_ENV
+          echo "MERGE_COMMIT=$MERGE_COMMIT" >> $GITHUB_OUTPUT
+          echo "BASE_SHA=$BASE_SHA" >> $GITHUB_OUTPUT
+
+      - name: Cherry-pick PR into release branch
+        id: cherry_pick
+        if: steps.check_command.outputs.release_valid == 'true'
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          GITHUB_REPO: ${{ github.repository }}
+          GITHUB_BRANCH: ${{ steps.check_command.outputs.release_branch }}
+        run: |
+          export FOLDER=$(basename "$GITHUB_REPO")
+          rm -rf $FOLDER
+          git clone https://x-access-token:$GITHUB_TOKEN@github.com/$GITHUB_REPO
+          cd $FOLDER
+
+          git checkout $GITHUB_BRANCH
+          git pull
+
+          NEW_BRANCH=merge/$GITHUB_BRANCH/$MERGE_COMMIT
+          git branch -D $NEW_BRANCH 2>/dev/null || true
+          REMOTE_EXISTS=$(git ls-remote --heads origin $NEW_BRANCH | wc -l)
+          [ "$REMOTE_EXISTS" -gt 0 ] && git push origin --delete $NEW_BRANCH || true
+
+          git checkout -b $NEW_BRANCH
+
+          MERGE_FAILED=0
+          git cherry-pick -x $BASE_SHA..$MERGE_COMMIT || MERGE_FAILED=$?
+
+          if [ "$MERGE_FAILED" -ne 0 ]; then
+            git add .
+            git commit -m "Cherry-pick conflicts for $MERGE_COMMIT" || true
+          fi
+
+          git diff --quiet origin/$GITHUB_BRANCH HEAD && {
+            echo "No changes to cherry-pick"
+            echo "PR_URL=" >> $GITHUB_OUTPUT
+            echo "MERGE_FAILED=0" >> $GITHUB_OUTPUT
+            exit 0
+          }
+
+          git push origin $NEW_BRANCH --force
+
+          TITLE=$(git log --format=%s -n 1 $MERGE_COMMIT)
+          BODY=$(git log --format=%B -n 1 $MERGE_COMMIT)
+
+          PR_URL=$(gh pr create \
+            --title "Merging to $GITHUB_BRANCH: $TITLE" \
+            --body "$BODY" \
+            --repo $GITHUB_REPO \
+            --base $GITHUB_BRANCH \
+            --head $NEW_BRANCH \
+            $( [ "$MERGE_FAILED" -ne 0 ] && echo "--draft" ))
+
+          echo "PR_URL=$PR_URL" >> $GITHUB_OUTPUT
+          echo "MERGE_FAILED=$MERGE_FAILED" >> $GITHUB_OUTPUT
+
+          if [ "$MERGE_FAILED" -eq 0 ]; then
+            if [[ "$PR_URL" =~ /pull/([0-9]+) ]]; then
+              PR_NUMBER="${BASH_REMATCH[1]}"
+              gh pr merge --squash "$PR_NUMBER" --auto --subject "Merging to $GITHUB_BRANCH: $TITLE" --body "$BODY" || echo "Auto-merge failed"
+            fi
+          fi
+
+      - name: Comment back on original PR
+        if: steps.check_command.outputs.release_valid == 'true' && always()
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const prUrl = '${{ steps.cherry_pick.outputs.PR_URL }}';
+            const mergeFailed = '${{ steps.cherry_pick.outputs.MERGE_FAILED }}' === '1';
+            let body;
+
+            if ('${{ job.status }}' === 'success') {
+              if (mergeFailed) {
+                body = `⚠️ Cherry-pick completed with conflicts. A draft PR was created: ${prUrl}`;
+              } else if (prUrl) {
+                body = `✅ Cherry-pick successful. A PR was created and auto-merged (if allowed): ${prUrl}`;
+              } else {
+                body = `ℹ️ Cherry-pick skipped: no changes needed in target branch.`;
+              }
+            } else {
+              let failedReason = 'Unknown error';
+              if ('${{ steps.pr_details.outcome }}' === 'failure') {
+                failedReason = 'Failed to get PR details (e.g., GitHub API timeout)';
+              } else if ('${{ steps.cherry_pick.outcome }}' === 'failure') {
+                failedReason = 'Failed during git cherry-pick or PR creation';
+              }
+              
+              body = `❌ Cherry-pick failed. Reason: **${failedReason}**. Please check the [workflow logs](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}).`;
+            }
+
+            github.rest.issues.createComment({
+              issue_number: ${{ steps.check_command.outputs.pr_number }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: body
+            });
diff --git a/.github/workflows/release-to-branches-with-label.yml b/.github/workflows/release-to-branches-with-label.yml
new file mode 100644
index 0000000000..0c36652924
--- /dev/null
+++ b/.github/workflows/release-to-branches-with-label.yml
@@ -0,0 +1,131 @@
+name: On Pull Request Merged to Master
+
+on:
+  pull_request:
+    # Only trigger on pull requests targeting main/master
+    branches:
+      - master
+      - main
+    types:
+      - closed
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to process (for manual testing)'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  run-on-pr-merged:
+    runs-on: ubuntu-latest
+
+    # For pull_request events: only run if the PR was actually merged
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true }}
+
+    steps:
+      - name: Add a comment to the merged PR (only if labeler is in the org)
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          github-token: ${{ secrets.ORG_GH_TOKEN }}
+          script: |
+            // 1. The label format: e.g., "release-1", "release-1.0"
+            const labelRegex = /^release-[0-9]+(\.[0-9]+)?$/;
+
+            // 2. Get PR info — from event payload or workflow_dispatch input
+            let pullRequestNumber, labelsOnPR;
+            if (context.eventName === 'workflow_dispatch') {
+              const prNum = parseInt(context.payload.inputs.pr_number);
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: prNum
+              });
+              pullRequestNumber = prNum;
+              labelsOnPR = pr.labels || [];
+            } else {
+              pullRequestNumber = context.payload.pull_request.number;
+              labelsOnPR = context.payload.pull_request.labels || [];
+            }
+
+            console.log("PR number:", pullRequestNumber);
+            console.log("Labels on the Pull Request:", labelsOnPR.map(label => label.name));
+
+            // 3. Get all timeline events to see who labeled the PR
+            const { data: prEvents } = await github.rest.issues.listEvents({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pullRequestNumber
+            });
+
+            // 4. Filter down to "labeled" events
+            const labeledEvents = prEvents.filter(ev => ev.event === 'labeled');
+            console.log("Labeled Events:", labeledEvents.map(event => ({
+                label: event.label?.name,
+                user: event.actor?.login,
+                timestamp: event.created_at
+            })));
+
+            // 5. Build a map: labelName -> last user who added it
+            //    (We reverse to get the *most recent* labeler, if a label was added multiple times)
+            const labelToLastLabeler = {};
+            for (const event of labeledEvents.reverse()) {
+              const labelName = event.label?.name;
+              const userName = event.actor?.login;
+              if (labelName && userName && !labelToLastLabeler[labelName]) {
+                labelToLastLabeler[labelName] = userName;
+              }
+            }
+
+            // 6. For each label on the PR, check if it matches "release-.."
+            //    If yes, we see who labeled it last and check their membership
+            for (const label of labelsOnPR) {
+              if (labelRegex.test(label.name)) {
+                const userWhoAddedLabel = labelToLastLabeler[label.name];
+
+                // If there's no recorded user (edge case), skip
+                if (!userWhoAddedLabel) {
+                    console.log(`User not found for label: ${label.name}`);
+                    continue;
+                }
+
+                // 7. Check if the user is in the org
+                let isMember = false;
+                try {
+                  await github.rest.orgs.checkMembershipForUser({
+                    org: 'TykTechnologies',
+                    username: userWhoAddedLabel
+                  });
+                  // If this call succeeds, they're a member
+                  isMember = true;
+                  console.log(`User '${userWhoAddedLabel}' is a member of the organization 'TykTechnologies'.`);
+                } catch (error) {
+                  // If 404, user is not a member. Anything else is an unexpected error.
+                  if (error.status === 404) {
+                    console.log(`User '${userWhoAddedLabel}' is NOT a member of the organization 'TykTechnologies'.`);
+                  } else {
+                    console.error(`An error occurred while checking membership for user '${userWhoAddedLabel}':`, error);
+                    throw error;
+                  }
+                }
+
+                // 8. Comment only if user is in the org
+                if (isMember) {
+                  console.log(`Creating comment for label '${label.name}' on PR #${pullRequestNumber} by user '${userWhoAddedLabel}'.`);
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: pullRequestNumber,
+                    body: `/release to ${label.name}`
+                  });
+                } else {
+                  console.log(`No comment created for label '${label.name}' on PR #${pullRequestNumber} because the user '${userWhoAddedLabel}' is not a member of the organization 'TykTechnologies'.`);
+                }
+              } else {
+                console.log(`Label '${label.name}' does not match the expected format.`);
+              }
+            }
diff --git a/.github/workflows/site-content-analysis.yml b/.github/workflows/site-content-analysis.yml
new file mode 100644
index 0000000000..e7f98a6932
--- /dev/null
+++ b/.github/workflows/site-content-analysis.yml
@@ -0,0 +1,165 @@
+name: Site Content Analysis
+
+on:
+  workflow_dispatch:
+    inputs:
+      wait_time:
+        description: 'Wait time per page (seconds)'
+        required: false
+        default: '3'
+        type: string
+      timeout:
+        description: 'Timeout per page (seconds)'
+        required: false
+        default: '30'
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  analyze-site-content:
+    runs-on: ubuntu-latest
+    
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        ref: production
+    
+    - name: Set up Python
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      with:
+        python-version: '3.9'
+    
+    - name: Install system dependencies
+      run: |
+        sudo apt-get update
+        # Install essential packages for headless Chrome
+        sudo apt-get install -y \
+          ca-certificates \
+          fonts-liberation \
+          libnss3 \
+          lsb-release \
+          xdg-utils \
+          wget \
+          gnupg
+        
+        # Install Chrome dependencies (with fallbacks for different Ubuntu versions)
+        sudo apt-get install -y \
+          libatk1.0-0 \
+          libatk-bridge2.0-0 \
+          libcups2 \
+          libdrm2 \
+          libgtk-3-0 \
+          libgtk-4-1 \
+          libxcomposite1 \
+          libxdamage1 \
+          libxrandr2 \
+          libgbm1 \
+          libxss1 \
+          libasound2 || \
+        sudo apt-get install -y \
+          libatk1.0-0 \
+          libatk-bridge2.0-0 \
+          libcups2 \
+          libdrm2 \
+          libgtk-3-0 \
+          libxcomposite1 \
+          libxdamage1 \
+          libxrandr2 \
+          libgbm1 \
+          libxss1 \
+          libasound2t64
+    
+    - name: Install Python dependencies
+      run: |
+        python -m pip install --upgrade 'pip>=23.0,<25'
+        pip install --no-deps 'pyppeteer>=2.0.0,<3' 'beautifulsoup4>=4.12.0,<5'
+    
+    - name: Download Chromium for Pyppeteer
+      run: |
+        python -c "import asyncio; from pyppeteer import launch; asyncio.get_event_loop().run_until_complete(launch())"
+    
+    - name: Run site content analysis
+      run: |
+        python scripts/browser_site_analyzer.py \
+          --base-url https://tyk.mintlify.app \
+          --docs-json docs.json \
+          --output-dir site_analysis_output \
+          --report-file site_analysis_report.json \
+          --wait-time ${{ github.event.inputs.wait_time || '3' }} \
+          --timeout ${{ github.event.inputs.timeout || '30' }}
+    
+    - name: Create summary comment
+      if: always()
+      run: |
+        echo "## 🔍 Site Content Analysis Results" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "**Analysis completed for:** https://tyk.mintlify.app" >> $GITHUB_STEP_SUMMARY
+        echo "**Wait time:** ${{ github.event.inputs.wait_time || '3' }} seconds" >> $GITHUB_STEP_SUMMARY
+        echo "**Timeout:** ${{ github.event.inputs.timeout || '30' }} seconds" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        
+        if [ -f site_analysis_report.json ]; then
+          echo "### Summary Statistics" >> $GITHUB_STEP_SUMMARY
+          echo '```json' >> $GITHUB_STEP_SUMMARY
+          python -c "
+        import json
+        with open('site_analysis_report.json', 'r') as f:
+            data = json.load(f)
+            summary = data['summary']
+            print(f'Total pages analyzed: {summary[\"total_pages_analyzed\"]}')
+            print(f'Pages with sufficient content: {summary[\"pages_with_sufficient_content\"]}')
+            print(f'Pages with empty/insufficient content: {summary[\"pages_with_empty_content\"]}')
+            print(f'Browser failures: {summary[\"browser_failures\"]}')
+        " >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          
+          # Show problematic pages if any
+          python -c "
+        import json
+        with open('site_analysis_report.json', 'r') as f:
+            data = json.load(f)
+            if data['empty_pages']:
+                print('### ❌ Pages with Content Issues')
+                for page in data['empty_pages'][:10]:  # Show first 10
+                    print(f'- **{page[\"url\"]}**: {page[\"issues\"][0] if page[\"issues\"] else \"Unknown issue\"}')
+                if len(data['empty_pages']) > 10:
+                    print(f'- ... and {len(data[\"empty_pages\"]) - 10} more pages')
+        " >> $GITHUB_STEP_SUMMARY
+        else
+          echo "❌ Analysis failed - no report generated" >> $GITHUB_STEP_SUMMARY
+        fi
+        
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "📄 **All analysis results are displayed above**" >> $GITHUB_STEP_SUMMARY
+
+    - name: Fail job if critical issues found
+      if: always()
+      run: |
+        if [ -f site_analysis_report.json ]; then
+          python -c "
+        import json, sys
+        with open('site_analysis_report.json', 'r') as f:
+            data = json.load(f)
+            summary = data['summary']
+            total = summary['total_pages_analyzed']
+            empty = summary['pages_with_empty_content']
+            
+            if total > 0:
+                empty_percentage = (empty / total) * 100
+                print(f'Empty content percentage: {empty_percentage:.1f}%')
+                
+                # Fail if more than 20% of pages have empty content
+                if empty_percentage > 20:
+                    print(f'❌ CRITICAL: {empty_percentage:.1f}% of pages have empty content (threshold: 20%)')
+                    sys.exit(1)
+                else:
+                    print(f'✅ Content quality acceptable: {empty_percentage:.1f}% empty pages')
+            else:
+                print('❌ CRITICAL: No pages were analyzed')
+                sys.exit(1)
+        "
+        fi
diff --git a/.github/workflows/sync-versions-to-tyk-install.yml b/.github/workflows/sync-versions-to-tyk-install.yml
new file mode 100644
index 0000000000..eeaa52012d
--- /dev/null
+++ b/.github/workflows/sync-versions-to-tyk-install.yml
@@ -0,0 +1,95 @@
+name: Sync Component Versions to tyk-install
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'developer-support/release-notes/overview.mdx'
+  workflow_dispatch:
+
+jobs:
+  sync-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout tyk-docs
+        uses: actions/checkout@v7
+
+      - name: Checkout tyk-install
+        uses: actions/checkout@v7
+        with:
+          repository: TykTechnologies/tyk-install
+          token: ${{ secrets.ORG_GH_TOKEN }}
+          path: tyk-install
+
+      - name: Run version updater
+        id: updater
+        run: |
+          mkdir -p tyk-install/scripts
+          cp .github/scripts/sync-versions-updater.py tyk-install/scripts/updater.py
+
+          python3 tyk-install/scripts/updater.py | tee updater-output.txt
+
+          rm -rf tyk-install/scripts
+
+          {
+            echo 'RESOLVED_VERSIONS<<EOF'
+            cat updater-output.txt
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create or update PR in tyk-install
+        run: |
+          cd tyk-install
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          BRANCH="chore/sync-component-versions"
+
+          # Reset the branch to the current main tip on every run so there is
+          # never more than one open PR for this sync: a rerun updates the
+          # existing branch/PR in place instead of creating a new one.
+          EXISTING_PR=$(gh pr list --repo TykTechnologies/tyk-install --head "$BRANCH" --state open --json number --jq '.[0].number')
+
+          git checkout -b "$BRANCH"
+
+          # Stage whatever updater.py actually touched instead of a hardcoded
+          # file list, so this step can't drift out of sync with the script.
+          git add -A
+
+          if git diff --cached --quiet; then
+            echo "No version changes detected - files are already up to date."
+            exit 0
+          fi
+
+          git commit -m "chore: sync component versions"
+          git push origin "$BRANCH" --force
+
+          PR_BODY=$(cat <<'BODY'
+          ## Summary
+
+          Auto-generated by the [Sync Component Versions](https://github.com/TykTechnologies/tyk-docs/actions/workflows/sync-versions-to-tyk-install.yml) workflow in tyk-docs.
+
+          Updates the pinned Tyk component versions across the self-managed, hybrid, and AI Studio Docker/Helm assets, resolved directly from the latest Docker Hub tags.
+
+          **Resolved versions:**
+          \`\`\`
+          ${{ steps.updater.outputs.RESOLVED_VERSIONS }}
+          \`\`\`
+          BODY
+          )
+
+          if [ -n "$EXISTING_PR" ]; then
+            echo "Updated existing PR #$EXISTING_PR with the latest versions."
+            gh pr comment "$EXISTING_PR" --repo TykTechnologies/tyk-install --body "$PR_BODY"
+            gh pr edit "$EXISTING_PR" --repo TykTechnologies/tyk-install --add-reviewer MohammedELKheir
+          else
+            gh pr create \
+              --repo TykTechnologies/tyk-install \
+              --title "chore: sync component versions" \
+              --body "$PR_BODY" \
+              --base main \
+              --head "$BRANCH"
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.ORG_GH_TOKEN }}
diff --git a/.github/workflows/trigger-docs-deploy.yml b/.github/workflows/trigger-docs-deploy.yml
new file mode 100644
index 0000000000..3e0bc26b33
--- /dev/null
+++ b/.github/workflows/trigger-docs-deploy.yml
@@ -0,0 +1,152 @@
+name: Trigger Documentation Deployment
+
+on:
+  push:
+    branches:
+      - main
+      - 'release-*'
+
+permissions:
+  contents: read
+  actions: write
+
+jobs:
+  trigger-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.PROBE_APP_ID }}
+          private-key: ${{ secrets.PROBE_APP_PRIVATE_KEY }}
+          owner: TykTechnologies
+
+      - name: Find the actual merged PR
+        id: get-pr
+        run: |
+          COMMIT_SHA="${{ github.sha }}"
+          COMMIT_MESSAGE="${{ github.event.head_commit.message }}"
+          echo "Looking for PR that was merged with commit: $COMMIT_SHA"
+          echo "Commit message: $COMMIT_MESSAGE"
+          
+          # Search for PRs that were merged with this exact commit SHA
+          echo "Searching for merged PR with commit SHA: $COMMIT_SHA"
+          
+          # Use a temporary file to avoid shell parsing issues
+          curl -s \
+            -H "Authorization: token ${{ steps.app-token.outputs.token }}" \
+            -H "Accept: application/vnd.github.v3+json" \
+            "https://api.github.com/repos/${{ github.repository }}/pulls?state=closed&sort=updated&direction=desc&per_page=50" > /tmp/prs.json
+          
+          # Find PR with matching merge commit SHA
+          ACTUAL_PR_NUMBER=$(jq -r --arg commit "$COMMIT_SHA" '.[] | select(.merge_commit_sha == $commit) | .number' /tmp/prs.json | head -1)
+          
+          if [ -n "$ACTUAL_PR_NUMBER" ] && [ "$ACTUAL_PR_NUMBER" != "null" ]; then
+            # Get PR details
+            ACTUAL_PR_TITLE=$(jq -r --arg commit "$COMMIT_SHA" '.[] | select(.merge_commit_sha == $commit) | .title' /tmp/prs.json | head -1)
+            PR_AUTHOR=$(jq -r --arg commit "$COMMIT_SHA" '.[] | select(.merge_commit_sha == $commit) | .user.login' /tmp/prs.json | head -1)
+            
+            echo "Found actual merged PR: #$ACTUAL_PR_NUMBER - $ACTUAL_PR_TITLE by $PR_AUTHOR"
+            echo "pr_number=$ACTUAL_PR_NUMBER" >> $GITHUB_OUTPUT
+            echo "pr_title=$ACTUAL_PR_TITLE" >> $GITHUB_OUTPUT
+            echo "pr_author=$PR_AUTHOR" >> $GITHUB_OUTPUT
+            echo "has_pr=true" >> $GITHUB_OUTPUT
+            
+            # Also try to extract original PR from commit message for context
+            ORIGINAL_PR=$(echo "$COMMIT_MESSAGE" | grep -oE '#[0-9]+' | head -1 | sed 's/#//')
+            if [ -n "$ORIGINAL_PR" ] && [ "$ORIGINAL_PR" != "$ACTUAL_PR_NUMBER" ]; then
+              echo "Found original PR reference in commit: #$ORIGINAL_PR"
+              echo "original_pr_number=$ORIGINAL_PR" >> $GITHUB_OUTPUT
+              echo "has_original_pr=true" >> $GITHUB_OUTPUT
+            else
+              echo "has_original_pr=false" >> $GITHUB_OUTPUT
+            fi
+          else
+            echo "No merged PR found via API, falling back to commit message parsing..."
+            
+            # Fallback to original method
+            PR_NUMBER=$(echo "$COMMIT_MESSAGE" | grep -oE '#[0-9]+' | head -1 | sed 's/#//')
+            
+            if [ -n "$PR_NUMBER" ]; then
+              echo "Found PR number in commit message: #$PR_NUMBER"
+              echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+              echo "has_pr=true" >> $GITHUB_OUTPUT
+              
+              # Extract PR title (everything before the PR number reference)
+              PR_TITLE=$(echo "$COMMIT_MESSAGE" | sed 's/ (#[0-9]\+).*//' | head -1)
+              echo "pr_title=$PR_TITLE" >> $GITHUB_OUTPUT
+              echo "has_original_pr=false" >> $GITHUB_OUTPUT
+            else
+              echo "No PR number found in commit message (direct push)"
+              echo "has_pr=false" >> $GITHUB_OUTPUT
+              echo "has_original_pr=false" >> $GITHUB_OUTPUT
+            fi
+          fi
+          
+          # Clean up temp file
+          rm -f /tmp/prs.json
+
+      - name: Trigger production deployment
+        run: |
+          # Prepare the dispatch payload
+          if [ "${{ steps.get-pr.outputs.has_pr }}" = "true" ]; then
+            if [ "${{ steps.get-pr.outputs.has_original_pr }}" = "true" ]; then
+              # Include both actual PR and original PR
+              PAYLOAD=$(jq -n \
+                --arg ref "production" \
+                --arg pr_number "${{ steps.get-pr.outputs.pr_number }}" \
+                --arg pr_title "${{ steps.get-pr.outputs.pr_title }}" \
+                --arg original_pr_number "${{ steps.get-pr.outputs.original_pr_number }}" \
+                --arg commit_sha "${{ github.sha }}" \
+                --arg branch "${{ github.ref_name }}" \
+                '{
+                  ref: $ref,
+                  inputs: {
+                    triggering_pr_number: $pr_number,
+                    triggering_pr_title: $pr_title,
+                    original_pr_number: $original_pr_number,
+                    triggering_commit_sha: $commit_sha,
+                    triggering_branch: $branch
+                  }
+                }')
+              echo "Triggering deployment with PR #${{ steps.get-pr.outputs.pr_number }} (original: #${{ steps.get-pr.outputs.original_pr_number }})"
+            else
+              # Only actual PR
+              PAYLOAD=$(jq -n \
+                --arg ref "production" \
+                --arg pr_number "${{ steps.get-pr.outputs.pr_number }}" \
+                --arg pr_title "${{ steps.get-pr.outputs.pr_title }}" \
+                --arg commit_sha "${{ github.sha }}" \
+                --arg branch "${{ github.ref_name }}" \
+                '{
+                  ref: $ref,
+                  inputs: {
+                    triggering_pr_number: $pr_number,
+                    triggering_pr_title: $pr_title,
+                    triggering_commit_sha: $commit_sha,
+                    triggering_branch: $branch
+                  }
+                }')
+              echo "Triggering deployment with PR #${{ steps.get-pr.outputs.pr_number }}"
+            fi
+          else
+            PAYLOAD=$(jq -n \
+              --arg ref "production" \
+              --arg commit_sha "${{ github.sha }}" \
+              --arg branch "${{ github.ref_name }}" \
+              '{
+                ref: $ref,
+                inputs: {
+                  triggering_commit_sha: $commit_sha,
+                  triggering_branch: $branch
+                }
+              }')
+            echo "Triggering deployment (direct push, no PR)"
+          fi
+          
+          curl -X POST \
+            -H "Authorization: token ${{ steps.app-token.outputs.token }}" \
+            -H "Accept: application/vnd.github.v3+json" \
+            https://api.github.com/repos/${{ github.repository }}/actions/workflows/deploy-docs.yml/dispatches \
+            -d "$PAYLOAD"
diff --git a/.github/workflows/validate-docs.yml b/.github/workflows/validate-docs.yml
new file mode 100644
index 0000000000..4cea719516
--- /dev/null
+++ b/.github/workflows/validate-docs.yml
@@ -0,0 +1,73 @@
+name: Validate Documentation
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      
+    - name: Set up Python
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      with:
+        python-version: '3.9'
+        
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade 'pip>=23.0,<25'
+        pip install 'requests>=2.31.0,<3'
+        pip install 'pyyaml>=6.0,<7'
+
+    - name: Validate documentation
+      run: |
+        echo "🔍 Running documentation validation..."
+        python scripts/validate_mintlify_docs.py . --validate-redirects --verbose
+
+    - name: Check anchor fragments
+      run: |
+        echo "⚓ Checking internal anchor fragments..."
+        python scripts/validate_mintlify_docs.py . --check-anchors --links-only
+
+    - name: Check for links that redirect
+      run: |
+        echo "↪️  Checking for internal links that hit a 3xx redirect..."
+        python scripts/validate_mintlify_docs.py . --check-redirecting-links --links-only
+
+    - name: Check for insecure first-party links
+      run: |
+        echo "🔒 Checking for insecure http:// links to tyk.io..."
+        python scripts/validate_mintlify_docs.py . --check-insecure-links --links-only
+
+    - name: Check for multiple H1 tags
+      run: |
+        echo "🔠 Checking for pages with multiple H1 tags..."
+        python scripts/validate_mintlify_docs.py . --check-multiple-h1 --links-only
+
+    - name: Check for relative markdown links
+      run: |
+        echo "Checking for relative markdown links (must start with /)..."
+        RELATIVE_LINKS=$(grep -rEn --include="*.md" --include="*.mdx" '\]\([^/\)\s#][^)]*\)' . \
+          | grep -vE '\]\((https?://|mailto:|ftp://|\{|<mailto)' \
+          | grep -v '{/\*' \
+          | grep -v '`\[' \
+          | grep -v "'\[" \
+          || true)
+        if [ -n "$RELATIVE_LINKS" ]; then
+          echo "Found relative markdown links that should use absolute paths (starting with /):"
+          echo "$RELATIVE_LINKS"
+          exit 1
+        fi
+        echo "All internal markdown links use absolute paths."
+
+    - name: Validation complete
+      if: success()
+      run: |
+        echo "✅ Documentation validation passed!"
+        echo "All links, images, navigation, redirects, and anchors are valid."
diff --git a/.github/workflows/visor.yaml b/.github/workflows/visor.yaml
new file mode 100644
index 0000000000..c66eb6e3ea
--- /dev/null
+++ b/.github/workflows/visor.yaml
@@ -0,0 +1,28 @@
+name: Visor PR Review
+
+on:
+  pull_request:
+    branches:
+      - main
+    types: [opened, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+
+jobs:
+  visor:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        
+      - name: Run Visor
+        uses: probelabs/visor@02e893ad11b66319b0fca1a43622038171c1a159
+        with:
+          app-id: ${{ secrets.PROBE_APP_ID }}
+          private-key: ${{ secrets.PROBE_APP_PRIVATE_KEY }}
+          installation-id: ${{ secrets.PROBE_APP_INSTALLATION_ID }}
+        env:
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index bcd218f54c..f058cba317 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 ### Node template
 # Logs
-logs
+/logs
 *.log
 npm-debug.log*
 yarn-debug.log*
@@ -130,3 +130,4 @@ dist
 .yarn/install-state.gz
 .pnp.*
 
+.DS_Store
diff --git a/.mintignore b/.mintignore
new file mode 100644
index 0000000000..530bbf0be9
--- /dev/null
+++ b/.mintignore
@@ -0,0 +1,8 @@
+# Wide-match rule: a bare filename here (no leading slash, no path prefix)
+# excludes every file with that exact name at ANY depth in the tree - root
+# level and nested copies (e.g. per-version folders on production) alike.
+# Only add filenames here that should NEVER be published docs content,
+# anywhere in the repo, under any name-cased variant.
+CLAUDE.md
+README.md
+readme.md
diff --git a/.vale.ini b/.vale.ini
new file mode 100644
index 0000000000..4e78ffcd19
--- /dev/null
+++ b/.vale.ini
@@ -0,0 +1,10 @@
+MinAlertLevel = suggestion
+
+Packages = MDX, Google, write-good
+
+
+# Define your vocabulary
+Vocab = mintlify-poc
+
+[*]
+BasedOnStyles = Vale, Google, write-good, mintlify-poc
diff --git a/.vale/styles/Vocab/mintlify-poc/accept.txt b/.vale/styles/Vocab/mintlify-poc/accept.txt
new file mode 100644
index 0000000000..3ff09cff99
--- /dev/null
+++ b/.vale/styles/Vocab/mintlify-poc/accept.txt
@@ -0,0 +1,45 @@
+Tyk
+Tyk's
+Coprocess
+OTel
+API's
+CVEs
+JWTs
+proxying
+keyspace
+Distroless
+brotli
+mutex
+Subgraph
+subgraph
+Subgraphs
+subgraphs
+supergraph
+supergraphs
+build_id
+build_ids
+enums
+allOf
+anyOf
+oneOf
+allowedIPs
+dataplanes
+commonName
+datasource
+upstreams
+Typename
+Fieldname
+mdcb
+failover
+orgs
+misconfigured
+Hashicorp
+Sarama
+detailed_tracing
+reconnections
+rawResponse
+ruc
+sqlite
+wget
+Tyk Classic APIs
+Tyk OAS APIs
diff --git a/.visor.yaml b/.visor.yaml
new file mode 100644
index 0000000000..8162d832df
--- /dev/null
+++ b/.visor.yaml
@@ -0,0 +1,19 @@
+extends: default
+
+checks:
+  technical-accuracy:
+    type: ai
+    schema: code-review
+    group: review
+    on: [pr_opened, pr_updated]
+    prompt: |
+      You are a Tyk Technical Documentation Reviewer.
+      Your job is to review documentation changes for technical accuracy, security, and completeness.
+      
+      When reviewing these documentation changes:
+      1. Verify that the described behavior matches how the Tyk Gateway actually works.
+      2. Check that any code examples, JSON configurations, or API definitions are syntactically correct and use valid Tyk fields.
+      3. Flag any security implications (e.g., documenting insecure configurations like plain text passwords, overly permissive CORS, or path traversal risks).
+      4. Ensure that new features are documented with their correct default values and constraints.
+      
+      If a documentation change describes a technical mechanism, analyze it for potential edge cases or security issues that users should be warned about.
\ No newline at end of file
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000000..2c1830194b
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,92 @@
+# Rules for AI Assistant
+
+## Auto-generated files
+
+The following files and directories are auto-generated from source code in other repositories. **DO NOT EDIT THEM DIRECTLY IN THIS REPOSITORY.**
+
+If you need to make changes to the content of these files, you must create a pull request against the appropriate source code repository.
+
+### Swagger API Documentation
+
+All files under `swagger/` are auto-generated from source code repositories and must not be edited directly.
+
+### Environment Variable and Configuration Pages
+
+The following pages are auto-generated:
+
+- `tyk-oss-gateway/configuration.mdx`
+- `tyk-dashboard/configuration.mdx`
+- `tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables.mdx`
+- `tyk-multi-data-centre/mdcb-configuration-options.mdx`
+- `tyk-configuration-reference/tyk-identity-broker-configuration.mdx`
+
+The above pages can be edited, but they reference snippets which are imported from other files. These imported snippets cannot be edited directly:
+
+- `snippets/gateway-config.mdx`
+- `snippets/dashboard-config.mdx`
+- `snippets/pump-config.mdx`
+- `snippets/mdcb-config.mdx`
+- `snippets/env-type-mapping.mdx`
+
+### Tyk OAS API Reference
+
+The Tyk OAS API reference page at `api-management/gateway-config-tyk-oas.mdx` imports `x-tyk-gateway` content from `/snippets/x-tyk-gateway.mdx`, which is auto-generated and must not be edited directly.
+
+### Tyk Operator CRD Reference
+
+The Tyk Operator CRD reference page at `product-stack/tyk-operator/crd-reference.mdx` imports its field content from `/snippets/operator-crd-reference.mdx`, which is auto-generated from the Tyk Operator CRD schemas and must not be edited directly. To change a field description, edit the Go doc-comments in the `tyk-operator-internal` repository.
+
+---
+
+## Context
+
+This repository contains technical documentation for Tyk products. The primary audience is developers integrating with or operating Tyk. Documentation is increasingly consumed by AI agents as well as humans, so accuracy and consistency of terminology are essential. Ambiguous or inconsistent language creates errors downstream.
+
+---
+
+## Writing Style Rules
+
+Apply these rules to all content in this repository.
+
+### Product Names
+
+- Tyk product names are always capitalised: Tyk Gateway, Tyk Dashboard, Tyk Pump, Tyk Operator, Tyk Portal, Tyk MDCB.
+- Use the full product name (for example, Tyk Dashboard) rather than the short form (Dashboard) to avoid confusion with generic terms.
+- When a word is used generically and does not refer to the Tyk component, do not capitalise it. For example: "a gateway" (generic), "Tyk Gateway" (the product).
+- Avoid repeating the full product name in close proximity. Once established as the subject, use "it", "its", or a descriptive shorthand (such as "registered APIs" instead of "APIs registered on Tyk Gateway") to avoid awkward repetition.
+
+### Language
+
+- No em-dashes (—) or en-dashes (–). Use a hyphen or restructure the sentence instead. Em-dashes and en-dashes are associated with AI-generated content and should be avoided.
+- Do not use "like" to mean "such as" or "for example". Use those words explicitly.
+- Use "such as" or "for example" when introducing examples.
+- Use American English spelling for general terminology: "behavior" not "behaviour", "authorization" not "authorisation", "color" not "colour", and so on.
+- Exception: Tyk-specific proper nouns that use British spelling must retain that spelling and be capitalised to signal they are intentional. Examples: Organisation, Synchroniser. Do not correct these to American English.
+
+### Lists
+
+- End each bullet with a full stop if the bullet is a complete sentence.
+- Do not add a full stop if the bullet is a fragment, a label, or a value (such as a field name, filename, or short noun phrase).
+
+### Headings
+
+- All headings use Title Case (capitalise all major words).
+- This applies to `##`, `###`, and any bold text used as a heading substitute.
+
+### API Definition Types
+
+- Always use the full names "Tyk OAS APIs" and "Tyk Classic APIs". Never shorten to "OAS APIs" or "Classic APIs" alone. "OAS" in isolation could be confused with the OpenAPI Specification standard, which is a distinct concept.
+- When content covers both Tyk OAS and Tyk Classic API definitions, always present Tyk OAS first.
+- Tyk Classic is the legacy approach. Do not state this explicitly, but structure content to guide users towards Tyk OAS.
+- Write as if Tyk OAS is the default. Introduce Tyk Classic behaviour with "If using Tyk Classic, ..." rather than labelling both options symmetrically.
+
+### Structure
+
+- Progressive disclosure: introduce the concept before Tyk-specific terminology or configuration detail.
+- Link to dedicated pages for detail rather than expanding inline.
+- Aim for short pages. If a page is growing large, consider whether a concept deserves its own page.
+
+### Diagrams
+
+- When suggesting diagrams, include a comment block with instructions for the designer covering: purpose, structure, key visual elements, and design notes.
+- Use `{/* ... */}` comment syntax in MDX files for diagram placeholders.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000000..b21e9833ca
--- /dev/null
+++ b/README.md
@@ -0,0 +1,8 @@
+!["Tyk Docs"](/img/logos/tyk-docs-logo-dark.svg)
+
+# Tyk Documentation
+
+This repository is the source of the official [Tyk Documentation website](https://tyk.io/docs/).
+
+## How to Contribute
+We welcome contributions! If you'd like to report an issue or contribute to the documentation, please check out our [contribution guide](https://tyk.io/docs/developer-support/contribution-guides).
\ No newline at end of file
diff --git a/advanced-configuration/other-protocols.mdx b/advanced-configuration/other-protocols.mdx
new file mode 100644
index 0000000000..62cfb5a1ea
--- /dev/null
+++ b/advanced-configuration/other-protocols.mdx
@@ -0,0 +1,30 @@
+---
+title: "Advanced Communication Protocols"
+description: "Learn how to configure advanced communication protocols in Tyk, including TCP, gRPC, and WebSockets"
+keywords: "gRPC, SSE, Websocket, Other Protocol"
+sidebarTitle: "Overview"
+---
+
+## Overview
+
+Tyk API Gateway is primarily designed to handle HTTP/HTTPS traffic, but it also provides robust support for several other protocols to accommodate modern API architectures and communication patterns. This flexibility allows developers to leverage Tyk's security, monitoring, and management capabilities across a wider range of API technologies.
+
+### Use Cases
+
+These advanced protocol capabilities enhance Tyk's usefulness beyond traditional REST APIs:
+
+-   **Real-time Applications**: WebSockets enable bidirectional communication for chat applications, collaborative tools, and live dashboards.
+-   **Microservices Communication**: gRPC support facilitates efficient inter-service communication with strong typing and performance benefits.
+-   **Event-Driven Architectures**: SSE enables efficient server-push notifications without the overhead of maintaining WebSocket connections.
+
+## Supported Protocols
+
+Tyk currently supports the following protocols other than HTTP/HTTPS:
+
+1. **[TCP Proxy](/key-concepts/tcp-proxy)**
+
+2. **[gRPC](/key-concepts/grpc-proxy)**
+
+3. **[Server-Sent Events (SSE)](/advanced-configuration/sse-proxy)**
+
+4. **[WebSockets](/advanced-configuration/websockets)**
\ No newline at end of file
diff --git a/advanced-configuration/sse-proxy.mdx b/advanced-configuration/sse-proxy.mdx
new file mode 100644
index 0000000000..bde424253f
--- /dev/null
+++ b/advanced-configuration/sse-proxy.mdx
@@ -0,0 +1,53 @@
+---
+title: "Server Sent Events Proxy"
+description: "Learn how to use Tyk as a simple Server-Sent Events (SSE) Proxy"
+keywords: "SSE Proxy, Other Protocol"
+sidebarTitle: "Server Side Events"
+---
+
+[Server-Sent Events](https://en.wikipedia.org/wiki/Server-sent_events) (SSE) is a server push technology enabling a subscribed client to receive automatic updates from a server via a long running HTTP connection. 
+Unlike WebSockets, SSE is a one-way communication of server to clients (WebSockets is a bidirectional communication between server and client). 
+As such, if you only need clients to receive data from a server, and don't require them sending messagess back, SSE could be a simpler way to make that happen. An online stock quotes, or notifications and feeds are good examples for applications that use SSE.
+
+## Using Tyk as a server-sent events (SSE) Proxy
+
+Tyk Gateway supports SSE proxying over HTTP, and can sit in the middle between the client and the SSE server and support the server sending updates to the client.
+
+### Setup
+- Enable SSE support on the Gateway: Set `http_server_options.enable_websockets` to `true` in your Tyk Gateway config file.
+- To maintain an open connection between the API consumer and the Tyk Gateway, set `http_server_options.read_timeout` and `http_server_options.write_timeout` to appropriately high values (in milliseconds). For example, you could try setting both to `2000`, but this is for you to determine in your environment.
+
+<Note>
+`flush_interval` does not need to be configured for SSE APIs. The Gateway automatically handles immediate flushing for `text/event-stream` responses.
+</Note>
+
+### Example using Tyk as an SSE proxy
+
+For this we will need:
+
+* An SSE server.  For this example we will use [Golang HTML 5 SSE example](https://github.com/kljensen/golang-html5-sse-example)
+* An instance of the Tyk Gateway and optionally the Tyk Dashboard
+
+**Steps for Configuration:**
+* Ensure the Gateway configurations detailed in the Setup section are set.
+* Run the SSE server as per the example instructions. By default this runs on port `8000`.
+```
+go run ./server.go
+```
+* Publish an API with the following configuration:
+    1. Set an appropriate listen path, e.g. `"listen_path": "/sse"`
+    2. Strip the listen path, e.g. `"strip_listen_path": true,`
+    3. Set the target url as the SSE server, e.g. the example SSE server:`"target_url": "http://host.docker.internal:8000"`
+    4. Click Save, and wait for the Gateway to reload the API before testing it
+* To test the protected SSE service via the API in the Tyk Gateway run:
+```bash 
+curl http://localhost:8080/sse/events/
+```
+You should see a stream of updates from the server. In this example, you will see:
+
+```bash
+Message: 20 - the time is 2013-03-08 21:08:01.260967 -0500 EST
+Message: 21 - the time is 2013-03-08 21:08:06.262034 -0500 EST
+Message: 22 - the time is 2013-03-08 21:08:11.262608 -0500 EST
+```
+
diff --git a/advanced-configuration/transform-traffic/looping.mdx b/advanced-configuration/transform-traffic/looping.mdx
new file mode 100644
index 0000000000..4f1bb82563
--- /dev/null
+++ b/advanced-configuration/transform-traffic/looping.mdx
@@ -0,0 +1,308 @@
+---
+title: "Internal Routing"
+description: "Learn how to route requests to other endpoints or APIs within Tyk Gateway without network calls, using the tyk:// URL scheme in a URL rewrite target"
+keywords: "internal routing, looping, tyk:// scheme, URL rewrite, self-referential routing, internal API"
+sidebarTitle: "Internal Routing"
+---
+
+Internal routing redirects a matched request to a different endpoint or API hosted on the same Tyk Gateway instance, without making an outbound network call. Tyk dispatches the request directly to the target API's middleware chain in memory, so the request is processed a second time without any network overhead.
+
+Internal routing is configured through the **URL rewrite** middleware. See [Path Modification](/transform-traffic/url-rewriting) for how to configure rewrite rules.
+
+## How It Works
+
+When the URL rewrite middleware produces a target beginning with `tyk://`, Tyk resolves the target to an API definition and dispatches the request directly to that API's middleware chain. Listen path matching is bypassed entirely - the request does not re-enter the HTTP router.
+
+**What is re-evaluated on each loop:**
+- The target API's full middleware chain, including endpoint-level middleware for the matched path.
+
+**What is not re-evaluated:**
+- **Listen path matching** is bypassed; the target API is resolved by identifier, not by URL.
+- **Original query parameters** are dropped; only query parameters explicitly included in the rewrite target survive into the loop.
+- **Authentication** depends on the auth method in use and the method used to address the target. See [Authentication on Looped Requests](#authentication-on-looped-requests).
+- **Rate limits and quotas** are skipped by default. See [Rate Limits and Quotas](#rate-limits-and-quotas).
+
+
+## Addressing the Target
+
+A `tyk://` URL takes one of two forms depending on whether the destination is within the same API or on a different API.
+
+### Same API
+
+```
+tyk://self/<path>
+```
+
+The hostname `self` resolves to the same API definition handling the current request. Use this when the routing logic and the destination endpoint are in the same API definition.
+
+For example, a rewrite target of `tyk://self/internal/transform` routes to the `/internal/transform` endpoint on the same API, running it through that endpoint's configured middleware.
+
+### Different API
+
+```
+tyk://<identifier>/<path>
+```
+
+Tyk resolves the identifier against each registered API in the following order:
+
+1. The API ID (`info.id`) - exact match
+2. The API's database ID (`info.dbId`) - exact match
+3. The API's display name (`info.name`), slugified: non-alphanumeric characters are replaced with `-`, match is case-insensitive
+
+For example, an API named `"Books Backend"` can be addressed as `tyk://books-backend/endpoint` or `tyk://Books-Backend/endpoint`. Using the API ID directly, such as `tyk://4e3c8b9f2a1d4f67b8e3c1a2f5d9e0c7/endpoint`, is more robust in automated environments where the API name may change.
+
+<Warning>
+The listen path is not a valid identifier. If the identifier does not match any registered API, Tyk returns `HTTP 500` with the error `"Can't detect loop target"`.
+</Warning>
+
+If using Tyk Classic, the API ID is [`api_id`](/api-management/gateway-config-tyk-classic#param-api-id), the database ID is [`id`](/api-management/gateway-config-tyk-classic#param-id), and the display name is [`name`](/api-management/gateway-config-tyk-classic#param-name), all in the root of the API definition. In Tyk Classic, API names can include category tags in the form `#tag`; these are stripped before name matching, so an API named `"Books Backend #catalog"` can be addressed as `tyk://books-backend/endpoint`.
+
+## Loop Behavior
+
+### Authentication on Looped Requests
+
+Authentication behavior on a looped request depends on the auth method in use and whether the loop targets the same API or a different one. This should be considered carefully when designing an internal routing chain.
+
+**Same API (`tyk://self/...`)**
+
+When looping to an endpoint in the same API, the behavior depends on the API's auth method as follows:
+
+- **[Auth Token](/api-management/authentication/bearer-token)**: the auth check is only performed on the original request.
+- **[Basic Auth](/api-management/authentication/basic-authentication) and [Certificate Auth](/api-management/authentication/certificate-auth)**: the auth check is run on each loop, but succeeds because Tyk forwards the original request headers into the loop, so the credential is still present and unchanged.
+- **[JWT](/basic-config-and-security/security/authentication-authorization/json-web-tokens), [OAuth 2.0](/api-management/authentication/oauth-2), [HMAC](/basic-config-and-security/security/authentication-authorization/hmac-signatures)**: the auth check is run on every loop and must succeed.
+
+For example, an API using JWT authentication that rewrites to `tyk://self/internal-endpoint` will validate the JWT again on the looped request. The token must still be present and valid.
+
+**Different API (`tyk://<identifier>/...`)**
+
+Each API definition is an independent security boundary. Tyk runs the target API's full authentication middleware chain as it would for any other incoming request, validating the request fresh against the target API's own credentials.
+
+The request must carry credentials that are valid for the target API. If those credentials differ from the ones used on the first hop, for example when the target API uses a different API key or a different header, add the required credential to the request with a [request header transformation](/api-management/traffic-transformation/request-headers) before the rewrite target is reached.
+
+<Note>
+APIs secured with [Certificate Auth](/api-management/authentication/certificate-auth) cannot be used as targets for internal looping. The internal transport used for different-API routing does not carry TLS connection state, so when the request is presented to the target API there is no client certificate to validate and Tyk will reject the request with `HTTP 403`.
+</Note>
+
+### Rate Limits and Quotas
+
+The Gateway's Session contains details of access and usage permissions, such as rate limits and quotas, for the requesting client. Tyk's standard rate limiting middleware increments the counters for each API request and applies limits to prevent overuse.
+
+A loop represents an internal leg of a single external client request: if Tyk incremented the counters and applied limits at each hop, a single request would be double-counted and clients could be charged multiple times for one request.
+
+By default, rate limit and quota increments and checks are performed only on the original API, not in the looped requests.
+
+**Same API (`tyk://self/...`)**
+
+Authentication is not re-run on a self-loop, so the originating Session is used throughout the entire chain. There is one set of rate limit and quota counters, decremented once on the original request. All subsequent loop legs within the same API skip rate limit and quota checks by default.
+
+**Different API (`tyk://<identifier>/...`)**
+
+If the target API [performs authentication](#authentication-on-looped-requests) it loads its own Session from Redis during authentication. That Session may carry rate limit and quota counters independent of the originating API. These are skipped by default for looped requests.
+
+**Checking Rate Limits on Looped APIs**
+
+An [optional control](#loop-controls) can be configured when looping that will run the rate limiting middleware in the target API. If this is enabled for a loop to the same API, this will lead to double counting and is not recommended. If it is enabled for a loop to a different API, the counters in the target API's Session will be incremented and checked against the limits configured for that API.
+
+Rate limit and quota deductions happen in memory during middleware processing. The updated Session is written back to Redis only after the full request chain - including all loop legs - has completed.
+
+### Loop Depth
+
+To guard against infinite loops, Tyk enforces a configurable maximum of five loops per request. When this limit is exceeded, Tyk returns `HTTP 500`:
+
+```
+Loop level too deep. Found more than 5 loops in single request
+```
+
+
+## Loop Controls
+
+The behavior of a looped request can be modified by appending control parameters to the `tyk://` URL. These parameters are consumed by Tyk and stripped before the looped request is dispatched, so they do not reach the target upstream.
+
+| Parameter | Description |
+| :--- | :--- |
+| `check_limits=true` | Enforce rate limits and quotas on the looped request. For same API loops, this double-counts the request against the client's allowance and is not recommended. For different API loops, limits are enforced against the target API's own session. |
+| `method=<VERB>` | Override the HTTP method of the looped request, for example `method=POST`. |
+| `loop_limit=<n>` | Set the maximum number of loops permitted in this request chain. Default is `5`. Can only be set in the original loop - subsequent loops in the same request chain cannot change it. |
+
+For example, to loop to the Books Backend API enforcing its rate limits, use the rewrite target `tyk://books-backend/fiction/9780?check_limits=true`.
+
+## Internal-Only APIs
+
+An API or an individual endpoint can be restricted so it is only accessible via internal routing, not from external HTTP requests.
+
+### API-Level
+
+Mark an entire API as internal to exclude it from the HTTP router. External requests return `HTTP 404`. The API is only reachable via `tyk://`.
+
+**Tyk OAS** - set `internal: true` in the `info.state` section of the Tyk Vendor Extension:
+
+```json
+"x-tyk-api-gateway": {
+  "info": {
+    "state": {
+      "active": true,
+      "internal": true
+    }
+  }
+}
+```
+
+If using Tyk Classic, set `"internal": true` at the root of the API definition.
+
+### Endpoint-Level
+
+Mark individual endpoints as internal to allow the rest of the API to remain externally accessible while restricting specific paths to loop context only. External requests to a marked endpoint are rejected with `HTTP 403`.
+
+**Tyk OAS** - add `internal` to the operation in the `middleware.operations` section:
+
+```json
+"operations": {
+  "getContract": {
+    "internal": {
+      "enabled": true
+    }
+  }
+}
+```
+
+If using Tyk Classic, add entries to `extended_paths.internal`:
+
+```json
+"extended_paths": {
+  "internal": [
+    {
+      "path": "/contract",
+      "method": "GET"
+    }
+  ]
+}
+```
+
+## Worked Example
+
+This example demonstrates three internal routing capabilities together: authentication on a looped API, rate limit enforcement via loop controls, and routing to a different upstream service.
+
+Acme Publishing's Books API serves free previews to all clients without authentication. Clients with a download subscription can retrieve the full book by adding `?download=true` and providing a valid access token. Download requests are routed internally to a separate Download API that validates the subscriber's token, enforces their download allowance, and proxies to a dedicated download service.
+
+The setup uses two APIs:
+
+- **Books API** (external, keyless, listen path `/books`, upstream `http://books-service`): Receives all client requests. Default requests are rewritten to the upstream's `preview` path. Requests with `?download=true` are looped internally to the Download API with rate limit enforcement enabled.
+- **Download API** (internal, auth token required, upstream `http://download-service`): Validates the subscriber's access token, enforces their download allowance, and proxies to the download service. Unreachable directly from outside Tyk Gateway.
+
+
+{/* DIAGRAM PLACEHOLDER: Book Download Example */}
+{/*
+  Diagram: Book Download Pipeline
+
+  Purpose: Show two request paths through the Books API - one that loops internally
+  to the Download API for authenticated download, one that proxies directly to the
+  upstream preview path. The key insight is that the same external URL serves two
+  different processing paths based on a query parameter, with the download path
+  enforcing authentication and rate limiting through an internal-only API.
+
+  Structure: Two parallel vertical flows, sharing the same Books API entry point.
+
+  Left flow (default preview):
+  1. Client: GET /books/fiction/9780
+  2. Books API (rounded rectangle)
+  3. URL rewrite: no advanced trigger fires
+  4. Arrow to books-service/preview/fiction/9780 (upstream, grey rectangle)
+  5. Book preview response returned to client
+
+  Right flow (authenticated download):
+  1. Client: GET /books/fiction/9780?download=true + Authorization header
+  2. Books API (same entry box as left flow)
+  3. URL rewrite: advanced trigger fires (download=true); ?download=true dropped
+  4. Dashed arrow labelled "tyk://download-api/fiction/9780?check_limits=true (internal loop)"
+  5. Download API (dashed border, labelled "internal only - HTTP 404 externally"):
+     - Auth token validation shown as a sub-box (HTTP 401 exit if invalid)
+     - Rate limit enforcement shown as a sub-box (check_limits=true)
+  6. Arrow to download-service/fiction/9780 (separate upstream box, distinct from books-service)
+  7. Full book response returned to client
+
+  Key visual elements:
+  - The Download API box must use a dashed border and "internal only" label to
+    reinforce it is not reachable externally
+  - The tyk:// arrow must be labelled as an in-memory dispatch with "?download=true
+    dropped" annotated at the departure point to show the query param is stripped
+  - The two sub-boxes inside the Download API (auth check, rate limit check) are
+    important - they are what justifies having a separate internal API
+  - The two upstream boxes (books-service, download-service) must be visually
+    distinct to show the loop routes to a different backend entirely
+  - Show the HTTP 401 exit path from the auth check sub-box
+
+  Design notes:
+  - Keep the two flows visually parallel so the contrast is obvious at a glance
+  - The decision point (advanced trigger fires / does not fire) should be clearly
+    labelled on the Books API box, not a separate diamond node
+  - Colour scheme suggestion: grey for the default preview flow, blue for the
+    download flow, red for the HTTP 401 rejection exit
+*/}
+
+
+**Tyk OAS Configuration**
+
+Books API - the `GET /{category}/{id}` endpoint with URL rewrite:
+
+```json
+"operations": {
+  "getBook": {
+    "urlRewrite": {
+      "enabled": true,
+      "pattern": "/([^/]+)/([^/]+)",
+      "rewriteTo": "preview/$1/$2",
+      "triggers": [
+        {
+          "condition": "any",
+          "rewriteTo": "tyk://download-api/$1/$2?check_limits=true",
+          "rules": [
+            { "in": "query", "name": "download", "pattern": "true", "negate": false }
+          ]
+        }
+      ]
+    }
+  }
+}
+```
+
+Download API - marked internal at the API level, with auth token authentication and a separate upstream:
+
+```json
+"x-tyk-api-gateway": {
+  "info": {
+    "name": "Download API",
+    "state": { "active": true, "internal": true }
+  },
+  "server": {
+    "authentication": {
+      "enabled": true,
+      "securitySchemes": {
+        "authToken": {
+          "enabled": true
+        }
+      }
+    }
+  },
+  "upstream": { "url": "http://download-service" }
+}
+```
+
+The `securitySchemes` key `authToken` must match a scheme defined in the OpenAPI `components.securitySchemes` section of the Download API's OAS document. See [Auth Token](/api-management/authentication/bearer-token) for full authentication configuration detail.
+
+If using Tyk Classic, mark the Download API internal with `"internal": true` at the root of its API definition. The URL rewrite on the Books API is configured in `extended_paths.url_rewrites` using the same trigger structure described in [Path Modification](/transform-traffic/url-rewriting).
+
+**Outcomes**
+
+| Request | Processed by | Response |
+| :--- | :--- | :--- |
+| `GET /books/fiction/9780` | Books API → `books-service/preview/fiction/9780` | Book preview |
+| `GET /books/fiction/9780?download=true` with valid token | Books API → Download API → `download-service/fiction/9780` | Full book |
+| `GET /books/fiction/9780?download=true` with missing or invalid token | Books API → Download API → rejected | `HTTP 401` |
+
+For the default request, no advanced trigger fires. The basic trigger captures `fiction` as `$1` and `9780` as `$2`, and the request is proxied to `books-service/preview/fiction/9780`.
+
+For the download request with a valid token, the advanced trigger fires on `download=true` and rewrites to `tyk://download-api/fiction/9780?check_limits=true`. The `?download=true` query parameter is dropped at the loop boundary. It is not included in the rewrite target and does not reach the Download API. The loop control parameter `check_limits=true` is consumed by Tyk and stripped before dispatch. The Download API validates the token, decrements the subscriber's download allowance against their Session, and proxies to `download-service/fiction/9780`.
+
+For the download request with a missing or invalid token, the Download API's authentication middleware rejects the request with `HTTP 401` before it reaches the upstream.
+
+A direct external request to the Download API's listen path returns `HTTP 404`. It is excluded from the HTTP router entirely.
diff --git a/advanced-configuration/transform-traffic/soap-rest.mdx b/advanced-configuration/transform-traffic/soap-rest.mdx
new file mode 100644
index 0000000000..0e292f6b8f
--- /dev/null
+++ b/advanced-configuration/transform-traffic/soap-rest.mdx
@@ -0,0 +1,194 @@
+---
+title: "Transformation Use Case: SOAP To REST"
+description: "How to transform SOAP API to REST API in Tyk"
+keywords: "Traffic Transformation, SOAP, REST, SOAP to REST"
+sidebarTitle: "SOAP To REST"
+---
+
+You can transform an existing SOAP service to a JSON REST service. This can be done from the Tyk Dashboard with no coding involved and should take around 10 minutes to perform the transform.
+
+We also have a video which walks you through the SOAP to REST transform.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/jeNXLzpKCaA" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+## Prerequisites
+
+An existing SOAP service and the WSDL definition. For this example, we will use:
+
+- Upstream Target - [https://www.dataaccess.com/webservicesserver/numberconversion.wso](https://www.dataaccess.com/webservicesserver/numberconversion.wso)
+- The WSDL definition from - [https://www.dataaccess.com/webservicesserver/numberconversion.wso?WSDL](https://www.dataaccess.com/webservicesserver/numberconversion.wso?WSDL)
+- Postman Client (or other endpoint testing tool)
+
+## Steps for Configuration
+
+1. **Import the WSDL API**
+
+    1. Select APIs from the System Management menu
+
+        <img src="/img/2.10/apis_menu.png" alt="APIs Menu" />
+
+    2. Click Import API
+
+        <img src="/img/2.10/import_api_button.png" alt="Import API" />
+
+    3. Select **From WSDL** from the Import an API Definition window
+    4. In the **Upstream Target** field, enter `https://www.dataaccess.com/webservicesserver/numberconversion.wso` as listed in the Prerequisites.
+    5. Paste the WSDL definition from the link in Prerequisites
+    6. Click **Generate API**. You should now have an API named `NumberConversion` in your API list
+
+        <img src="/img/2.10/numberservice_api.png" alt="NumberService API" />
+
+2. **Add the transforms to an Endpoint**
+
+    1. From the API list, select Edit from the Actions menu for the `NumberConversion` API
+    2. Select the **Endpoint Designer** tab. You should see 2 POST endpoints that were imported. We will apply the transforms to the `NumberToWords` endpoint.
+
+        <img src="/img/2.10/numberservice_endpoints.png" alt="Endpoints" />
+
+    3. Expand the `NumberToWords` endpoint. The following plugins should have been added as part of the import process.
+
+        - URL rewrite
+        - Track endpoint
+
+        
+
+    <Note>
+    To make the URL a little friendlier, we're going to amend the Relative Path to just `/NumberToWords`. Update your API after doing this.
+    </Note>
+
+
+    4. Add the following plugins from the **Plugins** drop-down list:
+
+        - Body transform
+        - Modify headers
+
+3. **Modify the Body Transform Plugin**
+
+    **Set up the Request**
+
+    We use the `{{.FieldName}}` Golang template syntax to access the JSON request. For this template we will use `{{.numberToConvert}}`.
+
+    1. Expand the Body transform plugin. From the Request tab, copy the following into the Template section:
+
+    ```xml
+    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://www.dataaccess.com/webservicesserver/">
+    <soapenv:Header/>
+    <soapenv:Body>
+        <web:NumberToDollars>
+            <web:dNum>{{.numberToConvert}}</web:dNum>
+        </web:NumberToDollars>
+    </soapenv:Body>
+    </soapenv:Envelope>
+    ```
+
+    2. In the Input field, enter the following:
+
+    ```json
+    {
+        "numberToConvert": 35
+    }
+    ```
+    
+
+    <Note>
+    The '35' integer can be any number you want to convert
+    </Note>
+
+
+    3. Click **Test**. You should get the following in the Output field:
+
+    ```xml
+    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://www.dataaccess.com/webservicesserver/">
+    <soapenv:Header/>
+    <soapenv:Body>
+        <web:NumberToDollars>
+            <web:dNum>35</web:dNum>
+        </web:NumberToDollars>
+    </soapenv:Body>
+    </soapenv:Envelope>
+    ```
+
+    **Set up the Response**
+
+    Again, for the response, we will be using the `{{.FieldName}}` syntax as the following `{{.Envelope.Body.NumberToDollarsResponse.NumberToDollarsResult}}`
+
+    1. For the Input Type, select XML
+
+    <img src="/img/2.10/body_trans_response_input.png" alt="Response Input Type" />
+
+    2. In the Template section enter:
+
+    ```yaml
+    {
+        "convertedNumber": "{{.Envelope.Body.NumberToDollarsResponse.NumberToDollarsResult}}"
+    }
+    ```
+    3. Enter the following into the input field:
+
+    ```xml
+    <soap12:Envelope xmlns:soap12="http://www.w3.org/2003/05/soap-envelope">
+    <soap12:Body>
+        <NumberToDollarsResponse xmlns="http://www.dataaccess.com/webservicesserver/">
+        <NumberToDollarsResult>thirty five dollars</NumberToDollarsResult>
+        </NumberToDollarsResponse>
+    </soap12:Body>
+    </soap12:Envelope>
+    ```
+    4. Click Test. You should get the following in the Output field:
+
+    ```json
+    {
+        "convertedNumber": "thirty five dollars"
+    }
+    ```
+
+5. **Change the Content-Type Header**
+
+    We now need to change the `content-type` header to allow the SOAP service to receive the payload in XML. We do this by using the **Modify header** plugin
+
+    1. Expand the Modify Header plugin
+    2. From the **Request** tab enter the following in the **Add this header** section
+    
+        - Header Name: `content-type`
+        - Header Value: `text/xml`
+
+    3. Click Add 
+
+        <img src="/img/2.10/add_header_type.png" alt="Modify Header Request" />
+
+    4. From the **Response** tab enter the following in the **Add this header** section
+    
+        - Header Name: `content-type`
+        - Header Value: `application/json`
+
+        <img src="/img/2.10/modify-header-response.png" alt="Modify Header Response" />
+
+    5. Click **Add**
+    6. Click **Update**
+
+    <img src="/img/2.10/update_number_conversion.png" alt="Update API" />
+
+## Testing the Endpoint
+
+You now need to test the endpoint. We are going to use Postman.
+
+
+<Note>
+We have not set up any Authentication for this API, it has defaulted to `Open (Keyless)`.
+</Note>
+
+
+
+1. Copy the URL for your NumberConversion API with the NumberToWords endpoint - `https://tyk-url/numberconversion/NumberToWords/`
+2. Paste it as a POST URL in the Postman URL Request field
+3. Enter the following as a raw Body request
+
+```json
+{
+    "numberToConvert": 35
+}
+```
+Your Postman request should look similar to below (apart from the URL used)
+
+<img src="/img/2.10/postman_soap_rest.png" alt="Postman" />
+
diff --git a/advanced-configuration/websockets.mdx b/advanced-configuration/websockets.mdx
new file mode 100644
index 0000000000..c0d66daedd
--- /dev/null
+++ b/advanced-configuration/websockets.mdx
@@ -0,0 +1,58 @@
+---
+title: "Websockets"
+description: "Learn how to configure and use WebSockets with Tyk"
+keywords: "websockets, Other Protocol"
+sidebarTitle: "WebSockets"
+---
+
+As from Tyk gateway v2.2, Tyk supports transparent WebSocket connection upgrades. To enable this feature, set the `enable_websockets` value to `true` in your `tyk.conf` file.
+
+WebSocket proxying is transparent, Tyk will not modify the frames that are sent between client and host, and rate limits are on a per-connection, not per-frame basis.
+
+The WebSocket upgrade is the last middleware to fire in a Tyk request cycle, and so can make use of HA capabilities such as circuit breakers and enforced timeouts.
+
+Tyk needs to decrypt the inbound and re-encrypt the outbound for the copy operations to work, Tyk does not just pass through the WebSocket. When the target is on default SSL port you must explicitly specify the target url for the API:
+
+```{.copyWrapper}
+https://target:443/
+```
+
+## WebSocket Example
+
+We are going to set up Tyk with a WebSocket proxy. Set up Tyk using our Docker [guide](/tyk-self-managed/install/docker).
+
+We will be using the [Postman WebSocket Echo Service](https://blog.postman.com/introducing-postman-websocket-echo-service/) to test the connection.
+
+**Steps for Configuration**
+
+1. **Setup the API in Tyk**
+
+    Create a new API in Tyk. For this demo we are going to select Open (Keyless) as the **Authentication mode**.
+
+    Set the **Target URL** to `wss://ws.postman-echo.com/raw`
+
+2. **Test the Connection**
+
+    1. From Postman, select **File > New > WebSocket Request** (or from **Workspace > New > WebSocket Request** if using the web based version).
+
+    <img src="/img/dashboard/system-management/postman-websocket-request.png" alt="Postman WebSocket Request" />
+
+    2. Enter your Tyk API URL in the **Enter server URL** field (minus the protocol).
+    3. Enter some text in the **New Message** field and click **Send**.
+    4. You will see a successful connection.
+
+    <img src="/img/dashboard/system-management/postman-websocket-test.png" alt="Postman WebSocket Connection Result" />
+
+
+
+    <Note>
+    If your API uses an Authentication mode other than Open (Keyless), add the details in the Header tab.
+    </Note>
+
+
+An example Header configuration for using an Authentication Token with an API:
+
+<img src="/img/dashboard/system-management/websocket-auth-token.png" alt="Postman WebSocket Connection Result with Authorization token" />
+
+See the [Access an API](/api-management/gateway-config-managing-classic#access-an-api) tutorial for details on adding an Authentication Token to your APIs.
+
diff --git a/ai-management/ai-studio/admin-apps.mdx b/ai-management/ai-studio/admin-apps.mdx
new file mode 100644
index 0000000000..bb6ce56d63
--- /dev/null
+++ b/ai-management/ai-studio/admin-apps.mdx
@@ -0,0 +1,57 @@
+---
+title: "Manage Apps in Tyk AI Studio"
+description: "How to manage user-created applications in Tyk AI Studio as a Studio Administrator."
+keywords: "AI Studio, AI Management, Apps, Admin"
+sidebarTitle: "App Management"
+---
+
+As a Studio Administrator, you are responsible for managing user-created applications (Apps) that interact with Large Language Models (LLMs) and other resources through the Tyk AI Gateway. This page provides an overview of the App lifecycle and the administrative actions you can perform.
+
+## App Lifecycle
+
+The lifecycle of an App in Tyk AI Studio follows several distinct stages, from creation to deactivation. As an administrator, you play a key role in this process, particularly in the review and activation stages.
+
+### 1. Creation
+An AI Developer creates an [App](/ai-management/ai-studio/ai-portal-app), defining its name, description, and selecting the necessary resources such as LLMs, Tools, and Data Sources. At this stage, the App's credentials are created but are inactive.
+
+### 2. Review
+Once an App is created, it appears in the Apps list in the Admin section. As an administrator, you should review the App's configuration to ensure it complies with your organization's policies. This includes checking the selected LLMs, Data Sources, and Tools for appropriateness and security.
+
+### 3. Activation / Rejection
+After reviewing the App, you can either activate or reject it.
+- **Activation:** By toggling the "Active" switch for the App's credentials, you approve the App. It can now be used to make authenticated requests to the [AI Gateway](/ai-management/ai-studio/proxy).
+- **Rejection:** If the App does not meet your organization's standards, you can leave its credentials inactive. It's recommended to communicate with the user who created the App to explain why it was not approved.
+
+### 4. Monitoring
+Once an App is active, you should monitor its usage and performance. The App Details view provides insights into token usage, costs, and detailed request/response logs. This allows you to track resource consumption and identify any unusual activity.
+
+### 5. Deactivation
+If an App is no longer needed, is misbehaving, or violates policies, you can deactivate it at any time by toggling its credentials to "Inactive". This immediately revokes its access to the AI Gateway.
+
+## Managing Apps
+
+The **Apps View** in the AI Studio dashboard is your central hub for managing all user-created applications.
+
+### Viewing App Details
+From the Apps list, you can click on any App to see its detailed view. This view provides a comprehensive overview of the App, including:
+- **App Information:** Name, description, owner, and associated LLMs, Data Sources, and Tools.
+- **Credential Information:** The App's Key ID and its active status.
+- **Token Usage and Cost:** A graph displaying token consumption and associated costs over time.
+- **Proxy Logs:** Detailed logs of inbound and outbound requests, essential for troubleshooting and auditing.
+
+### Editing Apps and Approving Credentials
+In the App Edit View, you can:
+- Modify the App's name and description.
+- Change the associated LLMs, Data Sources, and Tools.
+- **Approve or reject the App** by toggling the **Active** switch for its credentials. This is a critical governance control.
+
+### Privacy Level Validation
+The system enforces data governance by validating the privacy levels of resources. When a user creates or an admin updates an App, the privacy levels of the selected Data Sources cannot be higher than the privacy levels of the selected LLMs.
+
+Privacy levels are categorized from low to high:
+- **Public**
+- **Internal**
+- **Confidential**
+- **Restricted (PII)**
+
+If a user attempts to associate a "Restricted" Data Source with an LLM that only has an "Internal" privacy level, the system will prevent this and display an error. This ensures that sensitive data is not inadvertently exposed to less secure models. As an admin, you should be aware of this when reviewing and approving Apps.
diff --git a/ai-management/ai-studio/ai-cli-app.mdx b/ai-management/ai-studio/ai-cli-app.mdx
new file mode 100644
index 0000000000..937afc355c
--- /dev/null
+++ b/ai-management/ai-studio/ai-cli-app.mdx
@@ -0,0 +1,126 @@
+---
+title: "Tutorial: Create an AI CLI App with NodeJS and Tyk AI Studio"
+description: "Learn how to use your Tyk AI Studio App credentials to build a simple command-line interface (CLI) application with NodeJS."
+keywords: "AI Studio, Tutorial, App, NodeJS, CLI"
+sidebarTitle: "Tutorial: AI CLI App"
+---
+
+In this tutorial, you will learn how to use the credentials from an App you've created in Tyk AI Studio to build a simple command-line interface (CLI) application with NodeJS.
+
+This application will take a text prompt from you, send it to an LLM via the Tyk AI Gateway, and print the response.
+
+## Prerequisites
+
+Before you begin, you will need:
+- **An approved App in Tyk AI Studio:** You should have already created an App and had it approved by a Studio Administrator. 
+
+    If you haven't, please follow the guide on [App Management for Consumers](/ai-management/ai-studio/ai-portal-app).
+- **Your App's Secret:** You will need these to authenticate your application.
+- **Node.js and npm installed:** This tutorial uses NodeJS. You can download it from [nodejs.org](https://nodejs.org/).
+- **An LLM configured in AI Studio:** Your App must be configured to use at least one LLM. This tutorial will use OpenAI LLM models.
+
+## Instructions
+
+### Step 1: Set up your NodeJS project
+
+First, create a new folder for your project and initialize a new NodeJS project within it.
+
+```bash
+mkdir tyk-ai-cli-app
+cd tyk-ai-cli-app
+npm init -y
+npm install ai @ai-sdk/openai
+```
+
+### Step 2: Create the CLI application file
+
+Create a new file named `index.js` in your project folder. This is where you will write the code for your CLI application.
+
+```bash
+touch index.js
+```
+
+### Step 3: Write the application code
+
+Open `index.js` in your favorite code editor and add the following code. Be sure to replace the placeholder values with your actual App credentials and AI Gateway endpoint.
+
+```javascript Expandable
+import readline from "node:readline";
+import { generateText } from "ai";
+import { createOpenAI } from "@ai-sdk/openai";
+
+// ---- CONFIG ----
+const apiKey = "YOUR_API_KEY";
+const baseURL = "YOUR_TYK_AI_STUDIO_GATEWAY_URL"; 
+
+// Create OpenAI-compatible client
+const openai = createOpenAI({
+  apiKey,
+  baseURL
+});
+
+// CLI interface
+const rl = readline.createInterface({
+  input: process.stdin,
+  output: process.stdout,
+  prompt: "You> "
+});
+
+console.log("LLM CLI started. Type a prompt and press enter.\n");
+rl.prompt();
+
+rl.on("line", async (line) => {
+  const prompt = line.trim();
+
+  if (!prompt) {
+    rl.prompt();
+    return;
+  }
+
+  try {
+    const { text } = await generateText({
+      model: openai("gpt-4o-mini"),
+      prompt
+    });
+
+    console.log("\nLLM>", text, "\n");
+  } catch (err) {
+    console.error("Error:", err.message);
+  }
+
+  rl.prompt();
+});
+```
+
+### Step 4: Run your CLI App
+
+Now you can run your application from your terminal.
+
+```bash
+node index.js
+```
+
+Example:
+
+```
+LLM CLI started. Type a prompt and press enter.
+
+You> explain kubernetes in simple terms
+
+LLM> Kubernetes is a system that helps run and manage containers...
+```
+
+Congratulations! You have successfully used your Tyk AI Studio App credentials to build a working AI-powered CLI application.
+
+## Frequently Asked Questions
+
+<AccordionGroup>
+<Accordion title="I'm getting a 401 Unauthorized error. What's wrong?">
+A 401 error means your request is not properly authenticated. Check the following:
+-   Make sure your App has been approved by an administrator and its credentials are active.
+-   Double-check that you have correctly copied your Secret into the `index.js` file.
+</Accordion>
+<Accordion title="Can I use a different LLM?">
+Yes, you can use any LLM that you have configured in your App.
+</Accordion>
+</AccordionGroup>
diff --git a/ai-management/ai-studio/ai-portal-app.mdx b/ai-management/ai-studio/ai-portal-app.mdx
new file mode 100644
index 0000000000..62bf4e74e3
--- /dev/null
+++ b/ai-management/ai-studio/ai-portal-app.mdx
@@ -0,0 +1,68 @@
+---
+title: "Create an App in Tyk AI Studio"
+description: "How to create and manage your applications in Tyk AI Studio as an AI Developer."
+keywords: "AI Studio, AI Management, Apps, AI Builder, AI Developer"
+sidebarTitle: "Create App"
+---
+
+As an AI Developer, you can create and manage applications (Apps) to interact with the AI services offered through Tyk AI Studio. An App bundles the resources you need (like specific LLMs, Tools, or Data Sources) and provides you with credentials to make authenticated API requests.
+
+## Prerequisites
+
+Before creating an App, ensure that an LLM provider is already configured and activated in the proxy. If not, a Studio Administrator must first [create and enable an LLM provider](/ai-management/ai-studio/llm-management#how-to-create-a-llm-provider).
+
+## Creating an App
+
+To create a new App, follow these steps:
+
+1.  Go to the **AI Portal** tab, navigate to the **Apps** section in the side navigation.
+2.  Click the **+ ADD APP** button.
+3.  Fill in the required details for your App:
+    *   **Name:** A descriptive name for your application.
+    *   **Description:** A brief summary of what your application does.
+    *   **LLMs:** Select the Large Language Models you want and click the **add** button to include them in your App configuration.
+    *   **Data Sources:** If your application needs to use Retrieval-Augmented Generation (RAG), select the required Data Sources.
+    *   **Tools:** Select any Tools (external APIs) your application needs to use.
+4.  Click **Create App**.
+
+    <img src="/img/ai-management/ai-portal-create-app.png" alt="AI Portal Create App" />
+
+Your App will be created, and you will be taken to the App Details view.
+
+<Note>
+**App Approval:** After you create an App, its credentials are not yet active. A Studio Administrator needs to review and approve your App before you can use it. 
+
+For more information on the approval process, see the [Admin App Management documentation](/ai-management/ai-studio/admin-apps).
+</Note>
+
+## Getting Your Credentials
+
+Once your App has been approved by an administrator, you can retrieve the credentials needed to make API requests.
+
+From the App Details view, you will find your **Credential Information**:
+- **Key ID:** This is the public identifier for your credentials.
+- **Secret:** This is your secret API key. Treat it like a password and do not expose it in client-side code.
+
+    <img src="/img/ai-management/ai-portal-app-secret.png" alt="AI Portal View App Credentials" />
+
+You will use this Secret to authenticate your requests to the Tyk AI Gateway.
+
+## Getting LLM Access Details
+
+In addition to your credentials, you can also find the **LLM Access Details** in the **App Details** view.
+
+<img src="/img/ai-management/ai-portal-app-llm-access.png" alt="AI Portal View LLM Access Details" />
+
+## Monitoring Your App
+
+The App Details view also allows you to monitor the usage and performance of your application.
+
+- **Token Usage and Cost:** A graph shows you how many tokens your App is consuming and the associated costs, which can be filtered by date.
+- **App Interaction:** You can see number of interactions over time, which can help you understand usage patterns.
+
+## Next Steps
+
+Now that you know how to create an App and get your credentials, you're ready to start building!
+
+Follow our tutorial to learn how to use your App's API key in a simple command-line application:
+- **[Tutorial: Create an AI CLI App](/ai-management/ai-studio/ai-cli-app)**
diff --git a/ai-management/ai-studio/ai-portal.mdx b/ai-management/ai-studio/ai-portal.mdx
new file mode 100644
index 0000000000..a067b88b08
--- /dev/null
+++ b/ai-management/ai-studio/ai-portal.mdx
@@ -0,0 +1,198 @@
+---
+title: "AI Portal in Tyk AI Studio"
+description: "How AI Portal works?"
+keywords: "AI Studio, AI Management, AI Portal"
+sidebarTitle: "AI Portal"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+The Tyk AI Studio's AI Portal provides a user-friendly web interface where end users can interact with configured AI capabilities. It serves as the primary access point for users to engage with Chat Experiences, view documentation, and manage their account settings.
+
+## Purpose
+
+The main goals of the AI Portal are:
+
+*   **Unified User Experience:** Offer a cohesive interface for accessing all AI capabilities configured within Tyk AI Studio.
+*   **Self-Service Access:** Enable users to independently access and utilize AI features without administrator intervention.
+*   **Contextual Documentation:** Provide integrated documentation and guidance for available AI services.
+*   **Account Management:** Allow users to manage their own profile settings and view usage information.
+*   **Secure Access Control:** Enforce permissions based on teams and organizational policies.
+
+## Key Features
+
+*   **Chat Interface:** Access to all [Chat Experiences](/ai-management/ai-studio/chat-interface) the user has permission to use, with a clean, intuitive UI for conversational interactions.
+*   **Resource Catalogues:** Browse and subscribe to available LLMs, Data Sources, and [Tools](/ai-management/ai-studio/tools) through dedicated catalogue interfaces.
+*   **Application Management:** Create and manage [Apps](/ai-management/ai-studio/admin-apps) that integrate LLMs, tools, and data sources for API access.
+*   **Documentation Hub:** Integrated documentation for available AI services, tools, and data sources.
+*   **User Profile Management:** Self-service capabilities for updating profile information and preferences.
+*   **History & Favorites:** Access to past chat sessions and ability to bookmark favorite conversations.
+*   **Responsive Design:** Optimized for both desktop and mobile devices for consistent access across platforms.
+*   **Customizable Themes:** Support for light/dark mode and potentially organization-specific branding.
+*   **Notifications:** System alerts and updates relevant to the user's AI interactions.
+
+## Using the AI Portal
+
+Users access the AI Portal through a web browser at the configured URL for their Tyk AI Studio installation.
+
+1.  **Authentication:** Users log in using their credentials (username/password, SSO, or other configured authentication methods).
+2.  **Home Dashboard:** Upon login, users see a dashboard with available Chat Experiences and recent activity.
+3.  **Resource Discovery:** Users can browse catalogues of available LLMs, Data Sources, and Tools to which they have access.
+4.  **Application Creation:** Users can create Apps by selecting and subscribing to the LLMs, tools, and data sources they need.
+5.  **Chat Selection:** Users can select from available Chat Experiences to start or continue conversations.
+6.  **Documentation Access:** Users can browse integrated documentation to learn about available capabilities.
+7.  **Profile Management:** Users can update their profile settings, preferences, and view usage statistics.
+
+    <img src="/img/ai-management/ai-portal-dashboard.png" alt="AI Portal Dashboard" />
+
+## Configuration (Admin)
+
+Administrators configure the AI Portal through the Tyk AI Studio admin interface:
+
+*   **Portal Branding:** Customize logos, colors, and themes to match organizational branding.
+*   **Available Features:** Enable or disable specific portal features (chat, documentation, etc.).
+*   **Authentication Methods:** Configure login options (local accounts, SSO integration, etc.).
+*   **Default Settings:** Set system-wide defaults for user experiences.
+*   **Access Control:** Manage which teams can access the portal and specific features within it.
+*   **Custom Content:** Add organization-specific documentation, welcome messages, or announcements.
+
+    <img src="/img/ai-management/ai-portal-configuration.png" alt="Portal Configuration" />
+
+## API Access
+
+While the AI Portal primarily provides a web-based user interface, it is built on top of the same APIs that power the rest of Tyk AI Studio. Developers can access these APIs directly for custom integrations:
+
+*   **Authentication API:** `/api/v1/auth/...` endpoints for managing user sessions.
+*   **Chat API:** `/api/v1/chat/...` endpoints for programmatic access to chat functionality.
+*   **User Profile API:** `/api/v1/users/...` endpoints for managing user information.
+*   **Datasource API:** `/datasource/{dsSlug}` endpoints for querying configured data sources, generating embeddings, and metadata filtering.
+
+### Datasource API
+
+The Datasource API provides direct access to configured vector stores for semantic search, vector-based search, metadata filtering, and embedding generation.
+
+#### Text Search
+
+Perform semantic search using a natural language query. The query text is automatically converted to an embedding vector.
+
+*   **Endpoint:** `POST /datasource/{dsSlug}`
+*   **Authentication:** Bearer token required
+*   **Request Format:**
+    ```json
+    {
+      "query": "your search query here",
+      "n": 5  // optional, number of results to return (default: 3)
+    }
+    ```
+*   **Response Format:**
+    ```json
+    {
+      "documents": [
+        {
+          "PageContent": "text content of the document chunk",
+          "Metadata": {
+            "source": "filename.pdf",
+            "page": 42
+          },
+          "Score": 0.92
+        }
+      ]
+    }
+    ```
+
+#### Vector Search
+
+Perform similarity search using a pre-computed embedding vector. Useful when you have already generated embeddings or want to use a custom embedding strategy.
+
+*   **Endpoint:** `POST /datasource/{dsSlug}/vector`
+*   **Authentication:** Bearer token required
+*   **Request Format:**
+    ```json
+    {
+      "embedding": [0.1, 0.2, 0.3, ...],
+      "n": 10,                    // optional, max results (default: 10)
+      "similarity_threshold": 0.7  // optional, minimum score filter (default: 0.0)
+    }
+    ```
+*   **Response Format:**
+    ```json
+    {
+      "documents": [
+        {
+          "PageContent": "text content of the document chunk",
+          "Metadata": {
+            "source": "filename.pdf",
+            "page": 42
+          },
+          "Score": 0.92
+        }
+      ]
+    }
+    ```
+
+#### Metadata Query
+
+Query documents using metadata filters only (no vector similarity search). Supports pagination.
+
+*   **Endpoint:** `POST /datasource/{dsSlug}/metadata`
+*   **Authentication:** Bearer token required
+*   **Request Format:**
+    ```json
+    {
+      "filter": {
+        "source": "filename.pdf",
+        "category": "technical"
+      },
+      "filter_mode": "AND",  // optional, "AND" or "OR" (default: "AND")
+      "limit": 10,           // optional, max results (default: 10, max: 100)
+      "offset": 0            // optional, pagination offset (default: 0)
+    }
+    ```
+*   **Response Format:**
+    ```json
+    {
+      "documents": [
+        {
+          "PageContent": "text content of the document chunk",
+          "Metadata": {
+            "source": "filename.pdf",
+            "category": "technical"
+          },
+          "Score": 0.0
+        }
+      ],
+      "total_count": 42
+    }
+    ```
+
+#### Generate Embeddings
+
+Generate embedding vectors for text chunks without storing them. The datasource must have an embedder configured.
+
+*   **Endpoint:** `POST /datasource/{dsSlug}/embeddings`
+*   **Authentication:** Bearer token required
+*   **Request Format:**
+    ```json
+    {
+      "texts": ["first text chunk", "second text chunk"]  // max 100 items
+    }
+    ```
+*   **Response Format:**
+    ```json
+    {
+      "vectors": [
+        [0.1, 0.2, 0.3, ...],
+        [0.4, 0.5, 0.6, ...]
+      ]
+    }
+    ```
+
+**Important Note:** Datasource endpoints do not accept a trailing slash. Use `/datasource/{dsSlug}` not `/datasource/{dsSlug}/`.
+
+This API-first approach ensures that all functionality available through the AI Portal can also be accessed programmatically for custom applications or integrations.
+
+The AI Portal serves as the primary touchpoint for end users interacting with AI capabilities managed by Tyk AI Studio, providing a secure, intuitive, and feature-rich experience.
diff --git a/ai-management/ai-studio/ai-studio-env.mdx b/ai-management/ai-studio/ai-studio-env.mdx
new file mode 100644
index 0000000000..f4fbf56044
--- /dev/null
+++ b/ai-management/ai-studio/ai-studio-env.mdx
@@ -0,0 +1,47 @@
+---
+title: "Tyk AI Studio Environment Variables"
+description: "Environment variables and configuration options for Tyk AI Studio."
+order: 1
+sidebarTitle: "AI Studio"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+import AIStudioConfig from '/snippets/ai-studio-config.mdx';
+import EnvTypeMapping from '/snippets/env-type-mapping.mdx';
+
+This page details the environment variables that can be used to configure Tyk AI Studio.
+
+## Configuration
+
+Tyk AI Studio is configured primarily using environment variables.
+
+### Configuration Precedence
+
+The application loads configuration in the following order of precedence (highest to lowest):
+
+1.  **Shell Environment Variables**: Variables set in the OS/Shell (e.g., `export SERVER_PORT=9090`) always override everything else.
+2.  **`.env` File**: Variables loaded from the file specified by the `-env` flag.
+    *   *Note:* The application checks if a variable is already set in the environment before loading it from the file, ensuring shell variables are preserved.
+
+### Command Line Flags
+
+You can specify a `.env` file using the `-env` flag when starting the binary:
+
+```bash
+./ai-studio -env /path/to/my.env
+```
+
+### Supported Formats
+
+Only the `.env` format (key=value pairs) is supported via the `-env` flag.
+
+<EnvTypeMapping/>
+
+## Variables
+
+<AIStudioConfig/>
diff --git a/ai-management/ai-studio/ai-studio-swagger.mdx b/ai-management/ai-studio/ai-studio-swagger.mdx
new file mode 100644
index 0000000000..e045b269ca
--- /dev/null
+++ b/ai-management/ai-studio/ai-studio-swagger.mdx
@@ -0,0 +1,18 @@
+---
+title: "Tyk AI Studio API"
+description: "Tyk AI Studio API"
+keywords: "OpenAPI Spec for AI Studio, Tyk AI Studio OAS, Tyk AI Portal REST"
+sidebarTitle: "Overview"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+This is the API for the AI Studio user and group management system.
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+<ButtonLeft href="https://raw.githubusercontent.com/TykTechnologies/tyk-docs/refs/heads/production/swagger/nightly/ai-studio-swagger.yml" color="green" content="Download Swagger" />
diff --git a/ai-management/ai-studio/ai-studio-user.mdx b/ai-management/ai-studio/ai-studio-user.mdx
new file mode 100644
index 0000000000..eb48206b42
--- /dev/null
+++ b/ai-management/ai-studio/ai-studio-user.mdx
@@ -0,0 +1,53 @@
+---
+title: "AI Studio User Personas"
+description: "Overview of the user personas in Tyk AI Studio: Technical and Non-technical users."
+keywords: "AI Studio, Developer, Consumer, Playground, API Keys, Business User, Chat"
+sidebarTitle: "Overview"
+---
+
+Tyk AI Studio caters to two primary user personas, each with different needs and workflows: the **Technical User** (AI Developer/Consumer) and the **Non-technical User** (Business User).
+
+An administrator can configure what each user can access. During user onboarding, an admin can assign permissions to view the AI Portal, the Chat interface, or both, tailoring the experience to the user's role.
+
+## Technical User (AI Developer)
+
+The **Technical User**, also known as the AI Developer or AI Consumer, is the primary user of the capabilities exposed by Tyk AI Studio. This persona builds end-user applications, chatbots, and internal tools that leverage the LLMs and data sources configured by the Admin. The rest of this page is written for this technical user.
+
+### Lifecycle
+
+The workflow for a Technical User typically follows this path:
+
+1.  **Discover**: Browsing the [AI Portal](/ai-management/ai-studio/ai-portal) to see available models, tools, and data sources they have access to.
+2.  **Experiment**: Using the **Model Playground** (Chat Interface) to test prompts, compare model responses, and validate RAG retrieval relevance.
+3.  **Build**: Creating **Apps**, generating [API Keys](/ai-management/ai-studio/user-management#core-concepts), and integrating the AI capabilities into their code via the Tyk AI Gateway.
+4.  **Optimize**: Analyzing app-specific metrics (latency, token usage) to refine prompts and improve performance.
+
+### Core Features
+
+#### Model Playground
+An interactive sandbox environment for rapid experimentation.
+*   **Prompt Testing**: Iteratively refine system prompts and user messages.
+*   **Model Comparison**: Switch between different models (e.g., GPT-4 vs. Claude 3) to compare quality and latency.
+*   **Tool Testing**: Verify that [Tools](/ai-management/ai-studio/tools) (e.g., "Get Weather") are correctly invoked by the model.
+
+#### API Management
+Self-service management of credentials for applications.
+*   **API Keys**: Generate and revoke long-lived API keys for application access.
+*   **SDK Integration**: Use standard OpenAI-compatible SDKs, pointing the base URL to Tyk AI Studio.
+
+#### Prompt Library
+A repository for saving and sharing effective prompts.
+*   **Versioning**: Track changes to prompts over time.
+*   **Templates**: Use parameterized prompts to standardize interactions across applications.
+
+#### App Analytics
+Granular visibility into application performance.
+*   **Usage Metrics**: View token consumption, request count, and error rates for specific apps.
+*   **Latency Tracking**: Monitor the end-to-end response time of LLM interactions.
+*   **Debug Traces**: Inspect individual request/response pairs to diagnose issues with model outputs or tool execution.
+
+## Non-technical User (Business User)
+
+The **Non-technical User**, such as product managers or sales staff, can leverage the power of LLMs without any coding. Administrators can configure a powerful, ready-to-use LLM chat interface complete with all the necessary tools and data sources.
+
+This allows business users to directly query the system and get answers to their questions, for example, "Summarise customer feedback for product X in the last quarter" or "What are the key features of our competitor Y?". They can do this without needing to create an application or manage API keys, making AI accessible to everyone in the organization.
\ No newline at end of file
diff --git a/ai-management/ai-studio/ai-studio.mdx b/ai-management/ai-studio/ai-studio.mdx
new file mode 100644
index 0000000000..4539794b09
--- /dev/null
+++ b/ai-management/ai-studio/ai-studio.mdx
@@ -0,0 +1,479 @@
+---
+title: "AI Studio (Control Plane) Component"
+description: "Overview of the AI Studio component in Tyk AI Studio's architecture, its features, and its role in the hub-and-spoke design"
+keywords: "AI Studio, AI Management, Edge Gateway"
+sidebarTitle: "AI Studio"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+AI Studio is the **central management hub** of the Tyk AI platform. It is the brain of the system — where administrators configure LLM providers, manage users, monitor usage, and extend the platform with plugins. When deployed in a hub-and-spoke topology, it also acts as the **control plane** that governs all connected Edge Gateways.
+
+## High-Level Architecture
+
+```mermaid
+graph TB
+    subgraph AI_Studio["AI Studio (Control Plane)"]
+        direction TB
+        UI["🖥️ Admin Web UI"]
+        API["🔌 REST API"]
+        PROXY["⚡ Embedded Gateway"]
+        GRPC["📡 gRPC Control Server (Port 50051 — control mode only)"]
+        DB[(&quot;🗄️ Database SQLite / PostgreSQL&quot;)]
+
+        UI --> API
+        API --> DB
+        PROXY --> DB
+        GRPC --> DB
+    end
+
+    ADMIN["👤 Admin User"] --> UI
+    DEVUSER["👤 Developer / App"] --> PROXY
+    EDGE["🌐 Edge Gateways"] <-->|gRPC Streaming| GRPC
+
+```
+
+AI Studio runs as a **single binary** that starts multiple servers:
+
+| Server | Port | Purpose |
+|---|---|---|
+| REST API + Admin UI | `8080` | Web interface and programmatic management |
+| Embedded Gateway | `9090` | Proxies LLM requests directly (standalone mode) |
+| gRPC Control Server | `50051` | Hub-and-spoke control plane (only in `control` mode) |
+
+<Note>
+The gRPC Control Server only starts when `GATEWAY_MODE=control` is set. In `standalone` mode (the default), AI Studio handles everything locally without Edge Gateways.
+</Note>
+
+## Core Features
+
+AI Studio provides the following capabilities out of the box:
+
+| Feature | Description |
+|---|---|
+| **LLM Management** | Configure and manage connections to LLM providers |
+| **Application Management** | Create apps with credentials, budgets, and LLM access |
+| **User Management & RBAC** | Users, groups, roles, and access control |
+| **Analytics & Monitoring** | Token usage, cost tracking, and dashboards |
+| **Plugin System** | Extend AI Studio with UI, Agent, and Gateway plugins |
+| **Secrets Management** | Secure storage and reference for API keys |
+| **Embedded Gateway** | Built-in LLM proxy (standalone mode) |
+| **Edge Gateway Management** | Register, monitor, and reload Edge Gateways (control mode) |
+| **Plugin Marketplace** | Discover and install community plugins |
+| **Documentation Server** | Built-in docs site served at port 8989 |
+
+### Configuration Management
+
+Configuration Management is the heart of AI Studio. It is where administrators define **what LLMs are available**, **how they are accessed**, and **what rules govern their use**.
+
+#### LLM Provider Configuration
+
+AI Studio supports multiple LLM vendors through a unified configuration model:
+
+{/* ```mermaid
+graph TD
+    ADMIN["Admin"] -->|Configure| LLM_CONFIG["LLM Configuration"]
+    LLM_CONFIG --> VENDOR["Vendor\n(openai / anthropic / vertex\ngoogle_ai / huggingface / ollama)"]
+    LLM_CONFIG --> APIKEY["API Key / Credentials\n(stored securely or via $SECRET/name)"]
+    LLM_CONFIG --> MODELS["Allowed Models\n(e.g. gpt-4, claude-3-opus)"]
+    LLM_CONFIG --> BUDGET["Monthly Budget\n(optional spending cap)"]
+    LLM_CONFIG --> PRIVACY["Privacy Score\n(0=Public → 100=Restricted/PII)"]
+    LLM_CONFIG --> FILTERS["Content Filters\n(associated filter plugins)"]
+    LLM_CONFIG --> NAMESPACE["Namespace\n(CE: default / ENT: custom)"]
+```
+
+Each LLM configuration gets a **slug** (auto-generated from its name) used in proxy endpoints:
+
+```
+/llm/call/{llmSlug}/...      ← Unified (streaming + non-streaming)
+/llm/rest/{llmSlug}/...      ← REST only
+/llm/stream/{llmSlug}/...    ← Streaming only
+``` */}
+
+##### Supported Vendors:
+
+| Vendor | Key | Notes |
+|---|---|---|
+| OpenAI | `openai` | GPT-4, GPT-3.5, etc. |
+| Anthropic | `anthropic` | Claude models |
+| Google Vertex AI | `vertex` | Gemini via gcloud |
+| Google AI | `google_ai` | Gemini via API key |
+| Hugging Face | `huggingface` | Open-source models |
+| Ollama | `ollama` | Self-hosted models |
+
+#### Model Pricing
+
+To enable cost tracking, administrators define per-token prices for each model:
+
+{/* TODO: Add correct diagram and more text */}
+{/* ```mermaid
+graph LR
+    MODEL_PRICE["Model Price Record"] --> VENDOR_FIELD["Vendor"]
+    MODEL_PRICE --> MODEL_NAME["Model Name\n(e.g. gpt-4-turbo)"]
+    MODEL_PRICE --> INPUT_PRICE["Input Token Price\n(CPIT)"]
+    MODEL_PRICE --> OUTPUT_PRICE["Output Token Price\n(CPT)"]
+    MODEL_PRICE --> CACHE_WRITE["Cache Write Token Price"]
+    MODEL_PRICE --> CACHE_READ["Cache Read Token Price"]
+    MODEL_PRICE --> CURRENCY["Currency\n(e.g. USD)"]
+``` */}
+
+The Analytics Engine uses these prices to calculate the cost of every LLM interaction automatically.
+
+#### Application (App) Management
+
+Applications are the **access credentials** that developers and systems use to interact with LLMs through the proxy:
+
+{/* TODO: Add correct diagram and more text */}
+
+{/* ```mermaid
+graph TD
+    APP["Application"] --> CRED["API Credentials\n(token for proxy auth)"]
+    APP --> LLM_ACCESS["LLM Access\n(which LLMs this app can use)"]
+    APP --> APP_BUDGET["Monthly Budget\n(per-app spending cap)"]
+    APP --> TOOLS["Tool Access\n(which tools are available)"]
+    APP --> DATASOURCES["Data Source Access\n(RAG sources)"]
+    APP --> OWNER["Owner User"]
+    APP --> NAMESPACE["Namespace\n(CE: default / ENT: custom)"]
+``` */}
+
+#### Secrets Management
+
+API keys and sensitive values can be stored securely and referenced by name:
+
+```
+$SECRET/MyOpenAIKey   ← Reference in LLM config instead of raw key
+```
+
+This prevents sensitive credentials from being exposed in configuration exports or logs.
+
+#### Content Filters
+
+Filters are rules attached to LLMs that can block or modify requests/responses. They are implemented as plugins with the `pre_auth`, `auth`, or `post_auth` hook types and are associated with specific LLM configurations.
+
+### User Management & RBAC
+
+AI Studio uses a **group-based access control** model. Access to resources is granted through group membership, not individual user permissions.
+
+{/* #### Role Hierarchy
+
+```mermaid
+graph TD
+    SA["👑 Super Admin\n(User ID=1)\nFull system access\nManages all admins"] --> A["🔧 Admin\n(IsAdmin=true)\nManages users & groups\nCannot modify other admins"]
+    A --> D["💻 Developer\n(ShowPortal=true)\nAccess to Portal UI\nCan create Apps"]
+    D --> CU["💬 Chat User\n(Default)\nAccess to Chat UI only"]
+``` */}
+
+| Role | `IsAdmin` | `ShowPortal` | Capabilities |
+|---|---|---|---|
+| **Super Admin** | ✅ (ID=1) | ✅ | Full access, manages admins, SSO config, audit logs |
+| **Admin** | ✅ | ✅ | Manages users, groups, LLMs, plugins |
+| **Developer** | ❌ | ✅ | Portal access, creates apps, uses tools |
+| **Chat User** | ❌ | ❌ | Chat interface access only |
+
+{/* #### Authentication Methods
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant AI_Studio
+    participant DB
+
+    Note over User, DB: Session-based (UI Login)
+    User->>AI_Studio: POST /auth/login (email + password)
+    AI_Studio->>DB: Validate credentials
+    DB-->>AI_Studio: User record
+    AI_Studio-->>User: Session cookie
+
+    Note over User, DB: API Key (Programmatic Access)
+    User->>AI_Studio: GET /llm/call/... (Authorization: Bearer <api_key>)
+    AI_Studio->>DB: Validate API key → find user
+    DB-->>AI_Studio: User + entitlements
+    AI_Studio-->>User: LLM response
+```
+
+#### Group-Based Access Control
+
+```mermaid
+graph LR
+    USER["User"] -->|member of| GROUP["Group\n(e.g. 'Data Science Team')"]
+    GROUP -->|has access to| LLM_CAT["LLM Catalogue\n(set of LLM configs)"]
+    GROUP -->|has access to| DATA_CAT["Data Catalogue\n(set of data sources)"]
+    GROUP -->|has access to| TOOL_CAT["Tool Catalogue\n(set of tools)"]
+    GROUP -->|has access to| CHAT_EXP["Chat Experiences"]
+```
+
+**Access Control Flow (API Request):**
+
+```mermaid
+graph LR
+    subgraph Edge["Edge Gateway"]
+        EP["Edge Plugin"] -->|"SendToControl()"| QUEUE["Local Queue\n(SQLite)"]
+        QUEUE -->|batch gRPC| CTRL_SERVER
+    end
+
+    subgraph Control["AI Studio"]
+        CTRL_SERVER["gRPC Control Server\nSendPluginControlBatch()"] --> ROUTE["Route by Plugin ID"]
+        ROUTE --> CP["Control Plane Plugin\nAcceptEdgePayload()"]
+    end
+```
+
+> **CE vs Enterprise:** In Community Edition, all users are in a single "Default" group with access to all resources. In Enterprise Edition, you can create unlimited groups with fine-grained catalogue assignments.
+
+--- */}
+
+### Analytics & Monitoring
+
+AI Studio automatically collects and stores analytics data for every LLM interaction that flows through the system.
+
+#### Data Collection Flow
+
+```mermaid
+sequenceDiagram
+    participant App
+    participant Proxy as Embedded Proxy / Edge Gateway
+    participant Analytics as Analytics Engine
+    participant DB
+
+    App->>Proxy: LLM Request
+    Proxy->>LLM: Forward to provider
+    LLM-->>Proxy: Response (with token counts)
+    Proxy->>Analytics: Record async (non-blocking)
+    Analytics->>DB: Batch write LLMChatRecord
+    Proxy-->>App: Return response
+```
+
+#### What Gets Recorded
+
+Every LLM interaction records:
+
+| Field | Description |
+|---|---|
+| `timestamp` | When the request occurred |
+| `user_id` | Which user made the request |
+| `app_id` | Which application was used |
+| `llm_id` | Which LLM configuration was targeted |
+| `vendor` | LLM provider (openai, anthropic, etc.) |
+| `model_name` | Specific model used (e.g. gpt-4-turbo) |
+| `prompt_tokens` | Input token count |
+| `response_tokens` | Output token count |
+| `total_tokens` | Combined token count |
+| `cost` | Calculated cost (using model pricing) |
+| `latency_ms` | Request duration in milliseconds |
+| `interaction_type` | `chat` or `proxy` |
+| `cache_write_tokens` | Tokens written to cache (Anthropic) |
+| `cache_read_tokens` | Tokens read from cache (Anthropic) |
+
+{/* #### Dashboard & Reporting
+
+```mermaid
+graph TD
+    subgraph Dashboard["Admin Dashboard"]
+        CONV["📊 Conversations\n- Unique users/day\n- Chat interactions/day"]
+        COST["💰 Cost Analysis\n- Cost by currency over time\n- Cost per vendor & model"]
+        MODELS["🤖 Model Usage\n- Most used LLM models\n- Token usage trends"]
+        TOOLS["🔧 Tool Usage\n- Tool call statistics\n- Operations over time"]
+        BUDGET["📈 Budget Tracking\n- LLM budget usage\n- App budget usage\n- % of limit consumed"]
+    end
+```
+
+**Available Analytics API Endpoints:**
+
+| Endpoint | Description |
+|---|---|
+| `GET /analytics/chat-records-per-day` | Daily chat volume |
+| `GET /analytics/cost-analysis` | Cost over time by currency |
+| `GET /analytics/most-used-llm-models` | Top models by usage |
+| `GET /analytics/token-usage-per-user` | Token breakdown per user |
+| `GET /analytics/token-usage-per-app` | Token breakdown per app |
+| `GET /analytics/vendor-usage` | Usage by LLM vendor |
+| `GET /analytics/model-usage` | Usage by specific model |
+| `GET /analytics/total-cost-per-vendor-and-model` | Cost breakdown |
+| `GET /analytics/budget-usage` | Budget consumption status |
+| `GET /analytics/app-interactions-over-time` | App activity trends |
+
+#### Budget Enforcement
+
+```mermaid
+flowchart LR
+    REQ["Incoming Request"] --> CHECK_BUDGET{"Budget\nConfigured?"}
+    CHECK_BUDGET -->|No| ALLOW["Allow Request"]
+    CHECK_BUDGET -->|Yes| CALC["Calculate Current\nMonthly Spend"]
+    CALC --> COMPARE{"Spend ≥ Budget?"}
+    COMPARE -->|No| ALLOW
+    COMPARE -->|Yes| BLOCK["429 Too Many Requests\n(Budget Exceeded)"]
+```
+
+> **CE vs Enterprise:** Community Edition tracks costs but does **not** enforce budget limits. Budget enforcement (blocking requests when over budget + email alerts at 80%/100%) is an **Enterprise Edition** feature.
+
+--- */}
+
+### Plugin System
+
+The Plugin System is AI Studio's extensibility layer. Plugins run as **isolated processes** communicating over gRPC, providing security and fault tolerance. All plugins use a **Unified Plugin SDK** that works in both AI Studio and Edge Gateway contexts.
+
+{/* #### Plugin Types
+
+```mermaid
+graph TD
+    PLUGINS["Plugin System"] --> GATEWAY["🔌 Gateway Plugins\n(run on Edge Gateway / Embedded Proxy)"]
+    PLUGINS --> STUDIO["🖥️ AI Studio Plugins\n(run on AI Studio control plane)"]
+
+    GATEWAY --> PRE_AUTH["pre_auth\nRun before authentication"]
+    GATEWAY --> AUTH["auth\nCustom authentication logic"]
+    GATEWAY --> POST_AUTH["post_auth\nRun after authentication"]
+    GATEWAY --> ON_RESP["on_response\nTransform LLM responses"]
+    GATEWAY --> DATA_COLL["data_collection\nCollect analytics/metrics"]
+    GATEWAY --> CUSTOM_EP["custom_endpoint\nCustom HTTP endpoints"]
+
+    STUDIO --> STUDIO_UI["studio_ui\nExtend Admin UI with custom pages"]
+    STUDIO --> PORTAL_UI["portal_ui\nExtend Portal/Chat UI"]
+    STUDIO --> AGENT["agent\nConversational AI agents"]
+    STUDIO --> OBJ_HOOKS["object_hooks\nCRUD lifecycle hooks\n(before/after create/update/delete)"]
+    STUDIO --> RES_PROV["resource_provider\nCustom resource types for Apps"]
+```
+
+#### Plugin Lifecycle
+
+```mermaid
+sequenceDiagram
+    participant Admin
+    participant AI_Studio
+    participant PluginManager
+    participant PluginProcess
+
+    Admin->>AI_Studio: Register plugin\n(command path or OCI reference)
+    AI_Studio->>PluginManager: LoadPlugin(id)
+    PluginManager->>PluginProcess: Start subprocess (go-plugin / gRPC)
+    PluginProcess-->>PluginManager: GetManifest() → capabilities
+    PluginManager->>AI_Studio: Update hook_types from manifest
+    Note over AI_Studio: Plugin is now active
+
+    Note over PluginProcess: On LLM request...
+    AI_Studio->>PluginProcess: Execute hook (pre_auth / post_auth / etc.)
+    PluginProcess-->>AI_Studio: PluginResponse (allow/block/modify)
+``` */}
+
+#### Plugin Distribution
+
+Plugins can be distributed in three ways:
+
+| Method | Description | Example |
+|---|---|---|
+| **Local Binary** | Path to executable on disk | `/usr/local/bin/my-plugin` |
+| **Remote Binary** | URL to download | `https://example.com/plugin` |
+| **OCI Artifact** | Container registry reference | `oci://ghcr.io/org/plugin:v1.0.0` |
+
+#### Plugin Marketplace
+
+AI Studio includes a built-in marketplace for discovering and installing community plugins:
+
+{/* ```mermaid
+graph LR
+    MARKET_INDEX["Marketplace Index\n(GitHub / custom URL)"] -->|hourly sync| LOCAL_CACHE["Local Plugin Cache\n(marketplace_plugins table)"]
+    LOCAL_CACHE --> BROWSE["Browse & Search\n(by category, publisher, maturity)"]
+    BROWSE --> INSTALL["One-click Install\n(creates Plugin record + downloads OCI)"]
+    INSTALL --> LOAD["Auto-load & fetch manifest"]
+``` */}
+
+> **CE vs Enterprise:** Community Edition supports one official Tyk marketplace. Enterprise Edition supports multiple custom marketplace sources with full management UI.
+
+{/* #### Edge-to-Control Plugin Communication
+
+In hub-and-spoke deployments, plugins running on Edge Gateways can send data back to plugins running on AI Studio:
+
+```mermaid
+graph LR
+    subgraph Edge["Edge Gateway"]
+        EP["Edge Plugin"] -->|"SendToControl()"| QUEUE["Local Queue\n(SQLite)"]
+        QUEUE -->|batch gRPC| CTRL_SERVER
+    end
+
+    subgraph Control["AI Studio"]
+        CTRL_SERVER["gRPC Control Server\nSendPluginControlBatch()"] --> ROUTE["Route by Plugin ID"]
+        ROUTE --> CP["Control Plane Plugin\nAcceptEdgePayload()"]
+    end
+```
+
+This enables use cases like: aggregating analytics from multiple edges, centralising audit data, or streaming events from distributed deployments back to a single dashboard. */}
+
+## How Configuration Synchronization Works?
+
+Tyk AI Studio uses a checksum-based system to track configuration synchronization between the control plane and edge gateways.
+
+### How It Works
+
+1. **Checksum Generation:** When configuration changes occur on the control plane, a SHA-256 checksum is computed from the serialized configuration snapshot
+2. **Heartbeat Reporting:** Edge gateways report their loaded configuration checksum in each heartbeat
+3. **Status Comparison:** The control plane compares reported checksums to determine sync status
+4. **UI Notifications:** The admin UI displays sync status and notifies administrators when edges are out of sync
+5. **On configuration change**, an admin pushes a reload signal. This can target all gateways or a specific namespace. Each gateway then pulls the latest snapshot.
+6. **Namespaces** control what gets loaded onto each gateway. LLMs, Apps, Filters, and Plugins can all be namespaced.
+7. **If the hub is unreachable**, gateways continue operating from their last-known snapshot stored in a local database (SQLite or PostgreSQL).
+
+### What Gets Synced to Gateways
+
+| Synced (part of config snapshot) | NOT synced (Studio-only) |
+|---|---|
+| LLM Configurations | Tools |
+| Apps | Data Sources |
+| Filters | Chat configurations |
+| Plugins | User management |
+| Model Prices | |
+| Model Routers (Enterprise) | |
+
+> **Note:** Apps are included in the sync but are **not** part of the checksum calculation because they change frequently. Credentials are **not** pulled until a gateway actually needs them — this is a pull-on-miss caching strategy that ensures the admin retains ongoing control over access tokens.
+
+### Sync Status Values
+
+| Status | Description | UI Indicator |
+|--------|-------------|--------------|
+| **In Sync** | Edge has the current configuration | Green chip |
+| **Pending** | Edge needs a configuration update | Yellow chip |
+| **Stale** | Edge has been out of sync for >15 minutes | Orange chip |
+| **Unknown** | Edge hasn't reported a checksum yet | Gray chip |
+
+### Pushing Configuration
+
+Configuration changes are pushed to edge gateways on-demand (not automatically) to ensure administrators maintain control over when changes are deployed.
+
+#### Push Configuration Modal
+
+Click the **Push Configuration** button to open the push modal. You can choose to:
+
+1. **Push to All Namespaces:** Sends configuration to all connected edge gateways
+2. **Push to Specific Namespace:** Sends configuration only to edges in a selected namespace (Enterprise)
+
+#### Push Process
+
+When you push configuration:
+
+1. The control plane generates a new configuration snapshot for the target namespace(s)
+2. Edge gateways receive a reload signal via gRPC
+3. Each edge fetches the new configuration and applies it
+4. Edges report the new checksum in their next heartbeat
+5. The sync status updates to reflect the new state
+
+{/* 
+### Analytics Flow
+
+Both the Edge Gateway and AI Studio record analytics for all client interactions. In the Edge Gateway, analytics are batched and sent back to AI Studio every few seconds (configurable).
+
+> **Important:** Analytics must be **explicitly enabled** in the Edge Gateway configuration for data to appear in Studio dashboards. This is a common stumbling block — see the [Analytics](/ai-management/ai-studio/analytics) docs for configuration details.
+
+### Distributed Budget Control
+
+Since Edge Gateways can be horizontally scaled, budget tracking faces a split-brain problem. The solution:
+
+1. All gateways send analytics batches back to AI Studio, giving Studio a complete view of token spend across the estate.
+2. AI Studio sends a periodic **budget pulse** containing the total spend for each access token.
+3. Gateways update their local spend counter if Studio's number is higher than what they have locally.
+
+This provides **eventually-accurate** budget control across a multi-gateway environment. See [Budget Control](/ai-management/ai-studio/budgeting) for details.
+ */}
+## Configuration Reference
+
+To know more about configuring AI Studio, see the [Configuration Reference](/ai-management/ai-studio/ai-studio-env) for detailed documentation on all environment variables.
\ No newline at end of file
diff --git a/ai-management/ai-studio/analytics.mdx b/ai-management/ai-studio/analytics.mdx
new file mode 100644
index 0000000000..d1c237b5da
--- /dev/null
+++ b/ai-management/ai-studio/analytics.mdx
@@ -0,0 +1,135 @@
+---
+title: "Analytics & Monitoring in Tyk AI Studio"
+description: "How to configure analytics in Tyk AI Studio?"
+keywords: "AI Studio, AI Management, Analytics, Monitoring"
+sidebarTitle: "Analytics & Monitoring"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio incorporates an Analytics System designed to collect, aggregate, and provide insights into the usage, cost, and performance of the platform's core components, particularly LLMs, Tools, and Chat interactions.
+
+## Purpose
+
+The Analytics System serves several key purposes:
+
+*   **Cost Tracking:** Monitor spending associated with different LLM providers and models.
+*   **Usage Monitoring:** Understand how users and applications are interacting with LLMs and Tools.
+*   **Performance Analysis:** Track metrics like latency and token counts for LLM requests.
+*   **Auditing & Debugging:** Provide detailed logs of interactions for troubleshooting and security analysis.
+*   **Reporting:** Offer data points for dashboards and reports for administrators and potentially end-users.
+
+## Data Collection
+
+The primary point of data collection is the **[Proxy & API Gateway](/ai-management/ai-studio/proxy)**. As requests flow through the proxy:
+
+1.  **Request Details:** Information about the incoming request is captured (e.g., user ID, application ID, requested LLM/route, timestamp).
+2.  **LLM Interaction:** Details about the interaction with the backend LLM are recorded (e.g., model used, prompt tokens, completion tokens, latency).
+3.  **Cost Calculation:** Using data from the [Model Pricing System](/ai-management/ai-studio/ai-studio#model-pricing), the cost of the interaction is calculated based on token counts.
+4.  **Tool Usage:** If the interaction involved [Tools](/ai-management/ai-studio/tools), relevant details might be logged (e.g., which tool was called, success/failure).
+5.  **Chat Context:** For interactions originating from the [Chat Interface](/ai-management/ai-studio/chat-interface), metadata about the chat session might be included.
+
+## Edge Gateway Analytics Configuration
+
+> **Important:** Analytics must be **explicitly enabled** in the Edge Gateway configuration for data to appear in AI Studio dashboards. This is a common stumbling block when first deploying edge gateways.
+
+When enabled, the Edge Gateway batches analytics records and sends them back to AI Studio every few seconds (this interval is configurable). Without this configuration, AI Studio will have no visibility into gateway traffic.
+
+Ensure your Edge Gateway environment includes the appropriate analytics configuration. The default quickstart and packaged deployments enable this, but custom deployments may not.
+
+The analytics subsystem in the Edge Gateway also supports plugins, offering multiple ways to handle data:
+- Each data class (Analytics, Logs, Budgets) can have its own processor
+- Processors can either override or work in parallel with the default batch system
+
+## Architecture
+
+*   **Asynchronous Ingestion:** To minimize impact on request latency, analytics data is typically collected by the Proxy and sent asynchronously to a dedicated analytics database or processing pipeline.
+*   **Data Storage:** Analytics records are stored in the application's relational database (PostgreSQL or SQLite, configured via environment variables). The same database used for other application data stores analytics records.
+*   **API Endpoints:** Tyk AI Studio exposes internal API endpoints that allow the Admin UI (and potentially other authorized services) to query the aggregated analytics data.
+
+## Key Metrics Tracked (Examples)
+
+*   **Per LLM Request:**
+    *   Timestamp
+    *   User ID / API Key ID
+    *   LLM Configuration ID / Route ID
+    *   Model Name
+    *   Prompt Tokens
+    *   Completion Tokens
+    *   Total Tokens
+    *   Calculated Cost
+    *   Latency (ms)
+    *   Success/Error Status
+*   **Per Tool Call (if applicable):**
+    *   Timestamp
+    *   Tool ID
+    *   Success/Error Status
+    *   Latency (ms)
+*   **Aggregated Metrics:**
+    *   Total cost per user/application/LLM over time.
+    *   Total requests per user/application/LLM over time.
+    *   Average latency per LLM.
+    *   Most frequently used models/tools.
+
+## Monitoring & Dashboards (Admin)
+
+Administrators typically access analytics data via dashboards within the Tyk AI Studio UI.
+
+*   **Overview:** High-level summaries of cost, usage, and requests.
+*   **Filtering & Grouping:** Ability to filter data by time range, user, application, LLM configuration, etc.
+*   **Visualizations:** Charts and graphs showing trends in cost, token usage, request volume, and latency.
+*   **Detailed Logs:** Access to raw or near-raw event logs for specific interactions (useful for debugging).
+
+    <img src="/img/ai-management/analytics-dashboard.png" alt="Analytics Dashboard" />
+
+### Per-LLM Attribution
+
+From v2.1.0, proxy logs are attributed to the specific LLM configuration (`llm_id`) rather than the vendor string. Two LLM entries that share a vendor, for example a personal Anthropic key and a work Anthropic key, no longer cross-pollinate in the LLM detail page. Logs recorded before the upgrade have `llm_id = 0` and do not appear in per-LLM detail views.
+
+### Compliance Dashboard
+
+From v2.1.0, the Compliance dashboard (`/admin/compliance`) surfaces [Compliance Events](/ai-management/ai-studio/compliance-events) emitted by filter scripts alongside the existing blocked-request data:
+
+*   **Summary Cards:** Critical Events and Warning Events counts over the selected window, with trend arrows and configurable escalation thresholds.
+*   **Policy Violations:** the summary splits **Blocked** (4xx proxy logs) from **Flagged** (warning and critical events that passed through), and the timeline chart merges both streams.
+*   **Filter Events Tab:** severity totals with a stacked timeline chart, severity and event-type filters, expandable rows showing raw event metadata, and CSV export.
+*   **App Risk:** per-app risk scores are weighted by event severity, and the drill-down interleaves blocked requests with compliance events.
+
+## Prometheus and OpenTelemetry Metrics
+
+From v2.1.0, both Tyk AI Studio and the Edge Gateway expose operational metrics on a Prometheus-compatible `/metrics` endpoint, with OpenTelemetry trace correlation through the analytics pipeline.
+
+Metrics are enabled by default. To configure them:
+
+| Component | Environment variable | Default |
+|---|---|---|
+| AI Studio (control plane) | `METRICS_ENABLED` (set to `false` or `0` to disable) | enabled |
+| AI Studio (control plane) | `METRICS_PATH` | `/metrics` |
+| Edge Gateway | `ENABLE_METRICS` | `true` |
+
+The endpoint exposes the following metrics:
+
+| Metric | Type | Description |
+|---|---|---|
+| `aistudio_llm_requests_total` | Counter | LLM requests processed |
+| `aistudio_llm_tokens_total` | Counter | Tokens consumed |
+| `aistudio_llm_cost_total` | Counter | Calculated cost |
+| `aistudio_tool_calls_total` | Counter | Tool invocations |
+| `aistudio_policy_blocks_total` | Counter | Requests blocked by policy |
+| `aistudio_compliance_events_total` | Counter | [Compliance events](/ai-management/ai-studio/compliance-events) recorded, labeled by `filter_scope`, `severity`, and `event_type` |
+| `aistudio_llm_request_duration_seconds` | Histogram | LLM request latency |
+| `aistudio_tool_execution_duration_seconds` | Histogram | Tool execution latency |
+| `aistudio_llm_inflight_requests` | Gauge | Requests currently in flight |
+
+Point your Prometheus scrape configuration (or an OpenTelemetry Collector with a Prometheus receiver) at the `/metrics` path of each component you want to monitor.
+
+## Integration with Other Systems
+
+*   **[Budget Control](/ai-management/ai-studio/budgeting):** Analytics data (specifically cost) is likely used by the Budget Control system to track spending against defined limits.
+*   **[Model Pricing](/ai-management/ai-studio/ai-studio#model-pricing):** The pricing definitions are crucial for calculating the cost metric within the analytics system.
+
+By providing detailed analytics, Tyk AI Studio enables organizations to effectively manage costs, understand usage patterns, and ensure the optimal performance of their AI interactions.
\ No newline at end of file
diff --git a/ai-management/ai-studio/architecture.mdx b/ai-management/ai-studio/architecture.mdx
new file mode 100644
index 0000000000..08910180d5
--- /dev/null
+++ b/ai-management/ai-studio/architecture.mdx
@@ -0,0 +1,98 @@
+---
+title: "Tyk AI Studio Architecture"
+description: "Overview of Tyk AI Studio's architecture, components, and design principles"
+keywords: "AI Studio, AI Management, Configuration, LLMs, Edge Gateway"
+sidebarTitle: "Overview"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio uses a **hub-and-spoke** architecture that supports both standalone and distributed enterprise deployments. This design separates the control plane (configuration management) from the data plane (request processing), ensuring scalable, resilient AI gateway deployment.
+
+## Architecture Diagram
+
+```mermaid
+graph TB
+    subgraph "Control Plane"
+        Control[AI Studio<br/>Control Mode]
+        ControlDB[(PostgreSQL)]
+        Control --> ControlDB
+    end
+    
+    subgraph "Edge Gateways"
+        Edge1[Edge Gateway 1]
+        Edge2[Edge Gateway 2]
+        EdgeN[Edge Gateway N]
+    end
+    
+    Control -.->|Config Sync| Edge1
+    Control -.->|Config Sync| Edge2
+    Control -.->|Config Sync| EdgeN
+    
+    Users1[Users Region 1] --> Edge1
+    Users2[Users Region 2] --> Edge2
+    UsersN[Users Region N] --> EdgeN
+    
+    Edge1 --> Providers[AI Providers]
+    Edge2 --> Providers
+    EdgeN --> Providers
+    
+    style Control fill:#4A90E2
+    style Edge1 fill:#7ED321
+    style Edge2 fill:#7ED321
+    style EdgeN fill:#7ED321
+```
+
+### Community vs Enterprise Edition
+
+The architecture remains identical in both Community and Enterprise Editions. The only difference is the feature set enabled at build time.
+
+## Core Components
+
+Tyk AI Studio consists of two main components:
+
+### AI Studio (Control Plane)
+
+AI Studio is the central management hub that provides:
+
+- **Configuration Management**: LLMs, applications, policies, users
+- **Policy Enforcement**: Rate limits, budgets, access controls
+- **Analytics & Monitoring**: Usage tracking, cost analysis, performance metrics
+- **User Management**: Authentication, authorization, RBAC
+- **gRPC API**: Configuration distribution to edge gateways
+
+It serves **three audiences** through three distinct sections:
+1. **Administration**: Admins configure LLMs, tools, data sources, filters, plugins, users, groups, and budgets.
+2. **AI Portal**: A self-service developer portal. LLM users browse available LLMs, MCP Servers, and Data Sources, then request access by creating an App. 
+3. **Chat**: A managed chat interface for LLM users.
+
+**AI Studio also runs these services:**
+
+| Service | Description |
+|---------|-------------|
+| **Embedded Gateway** | A lightweight AI Gateway for testing LLM proxying. No filters, no middleware, no plugins — just basic proxying to verify an LLM works as expected. Also used by the Chat interface. |
+| **API-based Tool Access** | Each Tool defined via OpenAPI spec is also available as a REST API endpoint for developers to call directly. |
+| **MCP Tool Access** | An MCP-compliant interface (shim) for tools generated from OpenAPI specs. Provides MCP-API compatibility without a separate MCP proxy. |
+| **Datasource API** | A unified REST endpoint for performing vector searches against registered data sources. |
+
+To know more about the AI Studio component, see the [AI Studio Documentation](/ai-management/ai-studio/ai-studio).
+
+### Edge Gateway (Data Plane)
+
+The Edge Gateway operates as an independent, dedicated AI proxy. It processes AI requests, enforces policies, and reports analytics to the control plane. It is optimized for high performance and resilience in production.
+
+- **Process Requests**: Handle AI API calls locally
+- **Cache Configuration**: Store synced config in local SQLite
+- **Enforce Policies**: Apply rate limits, budgets, filters
+- **Report Analytics**: Send usage data back to control
+- **Operate Independently**: Continue working if control plane is unreachable
+
+The Edge Gateway provides the full middleware pipeline: authentication, filters, plugins, analytics, and budget enforcement.
+
+**Key difference from the embedded gateway:** The embedded gateway in AI Studio is "gateway-lite" for testing and chat. The Edge Gateway is the production data plane with the full feature set.
+
+To know more about the Edge Gateway, see the [Edge Gateway Architecture](/ai-management/ai-studio/proxy) documentation.
\ No newline at end of file
diff --git a/ai-management/ai-studio/budgeting.mdx b/ai-management/ai-studio/budgeting.mdx
new file mode 100644
index 0000000000..e2ca87121b
--- /dev/null
+++ b/ai-management/ai-studio/budgeting.mdx
@@ -0,0 +1,82 @@
+---
+title: "Budget Control in Tyk AI Studio"
+description: "How to configure budgets in Tyk AI Studio?"
+keywords: "AI Studio, AI Management, Budget Control"
+sidebarTitle: "Budget Control"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio provides a Budget Control system to help organizations manage and limit spending on Large Language Model (LLM) usage.
+
+## Purpose
+
+The primary goals of the Budget Control system are:
+
+*   **Prevent Overspending:** Set hard limits on costs associated with LLM API calls.
+*   **Cost Allocation:** Track and enforce spending limits at different granularities (e.g., per organization, per specific LLM configuration).
+*   **Predictability:** Provide better predictability for monthly AI operational costs.
+
+## Scope & Configuration
+
+Budgets are typically configured by administrators and applied at specific levels:
+
+*   **Organization Level:** A global budget limit for all LLM usage within the organization.
+*   **LLM Configuration Level:** A specific budget limit tied to a particular LLM setup (e.g., a dedicated budget for a high-cost `gpt-4` configuration).
+*   **(Potentially) Application/User Level:** Granular budgets might be assignable to specific applications or teams (depending on implementation specifics).
+
+**Configuration Parameters:**
+
+*   **Limit Amount:** The maximum monetary value allowed (e.g., $500).
+*   **Currency:** The currency the budget is defined in (e.g., USD).
+*   **Time Period:** The reset interval for the budget, typically monthly (e.g., resets on the 1st of each month).
+*   **Scope:** Which entity the budget applies to (Organization, specific LLM Configuration ID, etc.).
+
+Administrators configure these budgets via the Tyk AI Studio UI or API.
+
+    <img src="/img/ai-management/budget-config-ui.png" alt="Budget Config UI" />
+
+## Enforcement
+
+> **Note:** Budget *enforcement* (blocking requests when limits are exceeded) is an **Enterprise Edition** feature. In Community Edition, budgets are tracked and recorded for reporting purposes, but requests are not blocked when limits are exceeded.
+
+Budget enforcement primarily occurs at the **[Proxy & API Gateway](/ai-management/ai-studio/proxy)**:
+
+1.  **Request Received:** The Proxy receives a request destined for an LLM.
+2.  **Cost Estimation:** Before forwarding the request, the Proxy might estimate the potential maximum cost (or rely on post-request cost calculation).
+3.  **Budget Check:** The Proxy checks the current spending against all applicable budgets (e.g., the specific LLM config budget AND the overall organization budget) for the current time period.
+4.  **Allow or Deny (Enterprise Edition):**
+    *   If the current spending plus the estimated/actual cost of the request does *not* exceed the limit(s), the request is allowed to proceed.
+    *   If the request *would* cause a budget limit to be exceeded, the request is blocked with HTTP 403, and an error is returned to the caller.
+
+## Distributed Budget Control (Multi-Gateway)
+
+When running multiple Edge Gateways in a hub-and-spoke architecture, budget tracking faces a split-brain challenge — each gateway only has local visibility into its own spend. Tyk AI Studio solves this with a **budget pulse** mechanism:
+
+1. **Analytics batching:** All Edge Gateways send analytics records (including cost data) back to AI Studio in regular batches. This gives AI Studio a **complete view** of token spend across the entire estate.
+
+2. **Budget pulse:** AI Studio periodically sends a budget pulse to each gateway containing the **total spend** for each access token across all gateways.
+
+3. **Local update:** Each gateway updates its local spend counter if Studio's reported number is higher than what it has locally.
+
+This provides **eventually-accurate** budget control. There may be a slight overrun window under very high concurrent load across multiple gateways, but the system converges quickly and prevents sustained overspending.
+
+> **Note:** Budget *enforcement* (blocking requests at the limit) is an Enterprise Edition feature. In Community Edition, budgets are tracked and visible in dashboards but requests are not blocked.
+
+## Integration with Other Systems
+
+*   **[Analytics & Monitoring](/ai-management/ai-studio/analytics):** The Analytics system provides the cost data used to track spending against budgets. The current spent amount for a budget period is derived from aggregated analytics data.
+*   **[Model Pricing](/ai-management/ai-studio/ai-studio#model-pricing):** The pricing definitions are essential for the Analytics system to calculate costs accurately, which in turn feeds the Budget Control system.
+*   **[Notification System](/ai-management/ai-studio/notifications):** Budgets trigger notifications when spending reaches defined thresholds. The system supports alerts at **50%**, **80%**, **90%**, and **100%** of the budget limit. Administrators receive notifications when these thresholds are crossed.
+
+## Benefits
+
+*   **Financial Control:** Prevents unexpected high bills from LLM usage.
+*   **Resource Management:** Ensures fair distribution of AI resources according to allocated budgets.
+*   **Accountability:** Tracks spending against specific configurations or organizational units.
+
+Budget Control is a critical feature for organizations looking to adopt AI technologies responsibly and manage their operational costs effectively.
diff --git a/ai-management/ai-studio/call-settings.mdx b/ai-management/ai-studio/call-settings.mdx
new file mode 100644
index 0000000000..ffb803e35d
--- /dev/null
+++ b/ai-management/ai-studio/call-settings.mdx
@@ -0,0 +1,58 @@
+---
+title: "Manage LLM Call Settings in Tyk AI Studio"
+description: "How to configure default call settings for Large Language Models (LLMs) in Tyk AI Studio, including parameters like temperature, max tokens, and more."
+keywords: "AI Studio, AI Management, LLMs, Large Language Models, LLM Call Settings"
+sidebarTitle: "LLM Call Settings"
+---
+
+## Availability
+
+| Edition | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Model call settings let you configure how Large Language Models handle prompts. These settings control parameters like response length, temperature (creativity level), and other options that shape the output when a prompt is sent to the LLM.
+
+```mermaid
+graph LR
+    A[User Prompt] --> B[AI Studio]
+    B --> C{LLM Call Settings}
+    C -->|Temperature, Max Tokens, etc.| D[LLM Provider]
+    D --> E[Generated Response]
+```
+
+### Use cases
+
+- **Chats**: These settings control how the LLM responds in conversational interfaces within the Chat Room feature, allowing administrators to fine-tune the user experience.
+- **Middleware Function Calls**: The settings guide LLM behavior in automated backend processes where the LLM is used for tasks such as data generation or content analysis.
+
+## LLM Call Settings Details
+
+The **LLM Call Settings** section allows administrators to configure default runtime parameters for Large Language Models (LLMs) used in chat interactions and middleware system function calls. These settings provide control over how the LLM processes inputs and generates outputs. 
+
+It is important to note that these settings are not utilized in the AI Gateway proxy (Tyk Edge Gateway). Applications created in the AI portal by end users for accessing LLMs provide their own model configurations (like temperature and max tokens) in the API payload when making requests to the AI Gateway.
+
+The Call Settings configured by the admin are specifically used for the built-in Chat Interface (accessed via the AI Portal) and for internal middleware system function calls (such as tool calling and RAG).
+
+## Configuration
+
+The **Edit/Create LLM Call Settings View** enables administrators to configure or update call-time options for a specific Large Language Model (LLM). Below is an explanation of each field and its purpose:
+
+- **Model Name**: The name of the language model (e.g., `gpt-5.2`, `claude-opus-4-5-20251101`).
+- **Temperature**: Controls randomness: `0` is deterministic, `1` is very random. Range: `0` to `1`.
+- **Max Tokens**: The maximum number of tokens to generate in the response. Must be at least `1`.
+- **Top P**: Controls diversity via nucleus sampling: `0.5` means half of all likelihood-weighted options are considered. Range: `0` to `1`.
+- **Top K**: Controls diversity by limiting to `k` most likely tokens. `0` means no limit.
+- **Min Length**: The minimum number of tokens to generate in the response.
+- **Max Length**: The maximum number of overall tokens.
+- **Repetition Penalty**: Penalizes repetition: `1.0` means no penalty, `>1.0` discourages repetition. Typically between `1.0` and `1.5`.
+- **System Prompt**: A long-form text prompt that sets the context or behavior for the language model.
+
+## How to Create LLM Call Settings
+
+1. Navigate to the **LLM Call Settings** section in the AI Studio dashboard.
+2. Click the green **+ ADD LLM CALL SETTING** button located at the top-right of the view.
+3. Fill in the required fields such as **Model Name** and configure the desired parameters like **Temperature** and **Max Tokens**.
+4. Click **Create LLM Call Settings** to save the configuration.
+
+    <img src="/img/ai-management/ai-portal-llm-call-setting.png" alt="Create LLM Call Settings UI" />
diff --git a/ai-management/ai-studio/catalogs.mdx b/ai-management/ai-studio/catalogs.mdx
new file mode 100644
index 0000000000..3e0e03c704
--- /dev/null
+++ b/ai-management/ai-studio/catalogs.mdx
@@ -0,0 +1,115 @@
+---
+title: "Catalogs in Tyk AI Studio"
+description: "How to manage catalogs in AI Studio?"
+keywords: "AI Studio, AI Management, Catalogs"
+sidebarTitle: "Catalogs"
+---
+
+## Availability
+
+| Edition | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Catalogs in Tyk AI Studio are collections of AI resources ([LLM providers](/ai-management/ai-studio/llm-management), [Data sources](/ai-management/ai-studio/datasources-rag), and [Tools](/ai-management/ai-studio/tools)) that you can assign to specific [Teams](/ai-management/ai-studio/teams) to easily manage access. They act as the bridge between the raw AI capabilities and the users who need to consume them.
+
+```mermaid
+graph TD
+    LLM[LLM Provider] -->|Added to| LLMCat[LLM Catalog]
+    Data[Data Source] -->|Added to| DataCat[Data Catalog]
+    Tool[Tool] -->|Added to| ToolCat[Tool Catalog]
+    
+    LLMCat -->|Assigned to| Team[Team]
+    DataCat -->|Assigned to| Team
+    ToolCat -->|Assigned to| Team
+    
+    Team -->|Grants access to| User[User]
+```
+
+### Use cases
+- **Resource Grouping**: Group all OpenAI models into an "OpenAI Models" catalog and all Anthropic models into an "Anthropic Models" catalog to manage vendor access easily.
+- **Environment Separation**: Create a "Production Data" catalog and a "Staging Data" catalog, ensuring that only the production Team has access to the production data sources.
+- **Tool Bundling**: Bundle specific tools (like web search and calculators) into a "Research Tools" catalog for your data science Team.
+
+### Community vs Enterprise Edition
+In the **Community Edition**, catalog management is automated. There are three built-in **"Default" Catalogs** (one for LLMs, one for Data Sources, and one for Tools). Any new resource you create is automatically added to its respective default catalog, and these catalogs are permanently linked to the "Default" Team.
+
+In the **Enterprise Edition**, you can create custom Catalogs, group specific resources together, and assign them to different Teams to enforce strict resource isolation and Role-Based Access Control (RBAC). The "Default" catalogs still exist and cannot be deleted.
+
+## What is a Catalog?
+
+A Catalog is a logical grouping of a specific type of AI resource. There are three types of catalogs in Tyk AI Studio:
+1. **LLM Catalogs**: Collections of LLM providers (e.g., OpenAI, Anthropic, local models).
+2. **Data Catalogs**: Collections of data sources (e.g., vector databases, knowledge bases).
+3. **Tool Catalogs**: Collections of tools (e.g., web scrapers, calculators, custom APIs).
+
+Catalogs do not grant access on their own. To make the resources within a catalog available to [Users](/ai-management/ai-studio/users), the catalog must be assigned to a [Team](/ai-management/ai-studio/teams).
+
+## Configuration
+When configuring a Catalog, the options vary slightly depending on the type:
+
+### LLM Catalog
+- **Catalog Name**: A descriptive name for the collection.
+- **LLMs in this Catalog**: A list where you can add or remove specific LLM providers.
+
+### Data Catalog
+- **Catalog Name**: A descriptive name for the collection.
+- **Short Description**: A brief summary of the data sources included.
+- **Long Description**: Detailed information about the catalog's contents.
+- **Icon**: A visual identifier for the catalog.
+- **Data Sources**: A list where you can add or remove specific data sources.
+- **Tags**: Labels to help categorize and filter the catalog.
+
+### Tool Catalog
+- **Name**: A descriptive name for the collection.
+- **Short Description**: A brief summary of the tools included.
+- **Long Description**: Detailed information about the catalog's capabilities.
+- **Icon**: A visual identifier for the catalog.
+- **Tools**: A list where you can add or remove specific tools.
+- **Tags**: Labels to help categorize and filter the catalog.
+
+## How to Create an LLM Catalog
+Catalogs are collections of LLM providers that you can assign to specific user groups to manage access easily.
+
+To create a new LLM Catalog in Tyk AI Studio:
+1. Navigate to the **Catalogs** section in the AI Studio dashboard.
+2. Select the **LLM** tab.
+3. Click on the **Add Catalog** button.
+4. Fill in the **Catalog Name** (Required).
+5. Under **LLMs in this Catalog**, click **Add LLM** to select the specific LLM providers you want to include.
+6. Click **Save** to create the catalog.
+7. Once created, navigate to the [Teams](/ai-management/ai-studio/teams) section to assign this catalog to a Team.
+
+    <img src="/img/ai-management/ai-admin-llm-catalog.png" alt="Add LLM Catalog Form" />
+
+## How to Create a Data Source Catalog
+Catalogs are collections of data sources that you can assign to specific user groups to manage access easily.
+
+To create a new Data Catalog in Tyk AI Studio:
+1. Navigate to the **Catalogs** section in the AI Studio dashboard.
+2. Select the **Data** tab.
+3. Click on the **Add Catalog** button.
+4. Fill in the **Catalog Name** (Required) and **Short Description** (Required).
+5. (Optional) Provide a **Long Description** and an **Icon**.
+6. Under **Data Sources**, click **Add Data Source** to select the specific data sources you want to include.
+7. Under **Tags**, click **Add Tag** to label and categorize the catalog.
+8. Click **Save** to create the catalog.
+9. Once created, navigate to the [Teams](/ai-management/ai-studio/teams) section to assign this catalog to a Team.
+
+    <img src="/img/ai-management/ai-admin-data-source-catalog.png" alt="Add Data Catalog Form" />
+
+## How to Create a Tool Catalog
+Catalogs are collections of tools that you can assign to specific user groups to manage access easily.
+
+To create a new Tool Catalog in Tyk AI Studio:
+1. Navigate to the **Catalogs** section in the AI Studio dashboard.
+2. Select the **Tools** tab.
+3. Click on the **Add Catalog** button.
+4. Fill in the **Name** (Required).
+5. (Optional) Provide a **Short Description**, **Long Description**, and an **Icon**.
+6. Under **Tools**, click **Add Tool** to select the specific tools you want to include.
+7. Under **Tags**, click **Add Tag** to label and categorize the catalog.
+8. Click **Save** to create the catalog.
+9. Once created, navigate to the [Teams](/ai-management/ai-studio/teams) section to assign this catalog to a Team.
+
+    <img src="/img/ai-management/ai-admin-tool-catalog.png" alt="Add Tool Catalog Form" />
\ No newline at end of file
diff --git a/ai-management/ai-studio/chat-interface.mdx b/ai-management/ai-studio/chat-interface.mdx
new file mode 100644
index 0000000000..ef871d1e30
--- /dev/null
+++ b/ai-management/ai-studio/chat-interface.mdx
@@ -0,0 +1,68 @@
+---
+title: "Chat Interface"
+description: "How AI Studios Chat Interface works?"
+keywords: "AI Studio, AI Management, Chat Interface"
+sidebarTitle: "Chat Interface"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+## Chat Interface
+
+Tyk AI Studio's Chat Interface provides a secure and interactive environment for users to engage with Large Language Models (LLMs), leveraging integrated tools and data sources. It serves as the primary front-end for conversational AI interactions within the platform.
+
+## Purpose
+
+The main goals of the Chat Interface are:
+
+*   **User-Friendly Interaction:** Offer an intuitive web-based chat experience for users of all technical levels.
+*   **Unified Access:** Provide a single point of access to various configured LLMs, Tools, and Data Sources.
+*   **Context Management:** Maintain conversation history and manage context, including system prompts and retrieved data (RAG).
+*   **Secure & Governed:** Enforce access controls based on teams and apply configured Filters.
+
+## Key Features
+
+*   **Chat Sessions:** Each conversation happens within a session, preserving history and context.
+*   **Streaming Responses:** LLM responses are streamed back to the user for a more interactive feel.
+*   **Tool Integration:** Seamlessly uses configured [Tools](/ai-management/ai-studio/tools) when the LLM determines they are necessary to fulfill a user's request. The available tools depend on the Chat Experience configuration and the user's team permissions.
+*   **Data Source (RAG) Integration:** Can automatically query configured [Data Sources](/ai-management/ai-studio/datasources-rag) to retrieve relevant information (Retrieval-Augmented Generation) to enhance LLM responses. The available data sources depend on the Chat Experience configuration and the user's team permissions.
+*   **System Prompts:** Administrators can define specific system prompts for different Chat Experiences to guide the LLM's persona, tone, and behavior.
+*   **History:** Users can view their past chat sessions.
+*   **Export to PDF:** From v2.1.0, users can export a chat conversation to PDF using the print button, available in both the standard chat view and agent chats.
+*   **File Upload (Context):** Users might be able to upload files directly within a chat to provide temporary context for the LLM (depending on configuration).
+*   **Access Control:** Users only see and can interact with Chat Experiences assigned to their [Teams](/ai-management/ai-studio/user-management).
+
+## Using the Chat Interface
+
+Users access the Chat Interface through the Tyk AI Studio web UI.
+
+1.  **Select Chat Experience:** Users choose from a list of available Chat Experiences (pre-configured chat environments) they have access to.
+2.  **Interact:** Users type their prompts or questions.
+3.  **Receive Responses:** The LLM processes the request, potentially using tools or data sources behind the scenes, and streams the response back.
+
+<img src="/img/ai-management/chat-interface-ui.png" alt="Chat UI" />
+
+## Configuration (Admin)
+
+Administrators configure the available "Chat Experiences" (formerly known as Chat Rooms) via the UI or API. Configuration involves:
+
+*   **Naming:** Giving the Chat Experience a descriptive name.
+*   **Assigning LLM:** Linking to a specific [LLM Configuration](/ai-management/ai-studio/llm-management).
+*   **Enabling Tools:** Selecting which [Tool Catalogues](/ai-management/ai-studio/tools) are available.
+*   **Enabling Data Sources:** Selecting which [Data Source Catalogues](/ai-management/ai-studio/datasources-rag) are available.
+*   **Setting System Prompt:** Defining the guiding prompt for the LLM.
+*   **Applying Filters:** Associating specific [Filters](/ai-management/ai-studio/filters) for governance.
+*   **Assigning Teams:** Determining which [Teams](/ai-management/ai-studio/user-management) can access this Chat Experience.
+*   **Enabling/Disabling Features:** Toggling features like file uploads or direct tool usage.
+
+<img src="/img/ai-management/chat-experience-config.png" alt="Chat Config" />
+
+## API Access
+
+Beyond the UI, Tyk AI Studio provides APIs (`/api/v1/chat/...`) for programmatic interaction with the chat system, allowing developers to build custom applications or integrations that leverage the configured Chat Experiences.
+
+This comprehensive system provides a powerful yet controlled way for users to interact with AI capabilities managed by Tyk AI Studio.
diff --git a/ai-management/ai-studio/chats.mdx b/ai-management/ai-studio/chats.mdx
new file mode 100644
index 0000000000..985d4a6a6a
--- /dev/null
+++ b/ai-management/ai-studio/chats.mdx
@@ -0,0 +1,41 @@
+---
+title: "Manage Chats in Tyk AI Studio"
+description: "Chats are customized interfaces that allow users to have one-on-one conversations with specific LLM providers, tools, and data source based on their needs. Access is tailored to the user's group, ensuring relevant and secure interactions."
+keywords: "AI Studio, AI Management, Chats, Chat Interface, LLMs"
+sidebarTitle: "Chats"
+---
+
+## Availability
+
+| Edition | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Chats are customized interfaces that allow users to have one-on-one conversations with specific LLM providers, tools, and data based on their needs. Access is tailored to the user's group, ensuring relevant and secure interactions.
+
+This page covers the administrator's perspective on configuring and managing Chat Rooms. For the user's perspective on interacting with these chats, see the [Chat Interface](/ai-management/ai-studio/chat-interface) documentation.
+
+## Configuration
+
+The **Add/Edit Chat View** enables administrators to configure a new or existing chat room. Below is an explanation of each field and its purpose:
+
+- **Name**: The name of the chat room.
+- **Description**: A description for this chat room.
+- **LLM Settings**: Select the model call settings. These control parameters like temperature and max tokens. For more details, see [LLM Call Settings](/ai-management/ai-studio/call-settings).
+- **LLM**: The specific language model powering the chat (e.g., Anthropic Claude, OpenAI GPT).
+- **Groups**: Access control determining which user groups can see and use the chat.
+- **Filters**: Governance policies applied to the chat interactions.
+- **System Prompt**: The guiding instructions for the LLM's persona and behavior.
+- **Enable Tool Support**: Toggles tool usage for the chat room.
+- **Default Tools**: Select default tools that will be available in this chat room. These tools will be automatically accessible to the AI when responding to user queries. For more details, see [Tools](/ai-management/ai-studio/tools).
+- **RAG Results or Source to Include for Model**: Configures vector database integration for context.
+- **Default Data Source**: Setting a default data source will automatically include this vector database in all conversations in this chat room, allowing the model to reference its contents when generating responses. For more details, see [Data Sources (RAG)](/ai-management/ai-studio/datasources-rag).
+
+## How to Create a Chat Room
+
+1. Navigate to the **Chats** section in the AI Studio dashboard.
+2. Click the green **+ ADD CHAT** button.
+3. Fill in the required fields such as **Name** and configure the desired parameters like **LLM** and **System Prompt**.
+4. Click **Create Chat** to save the configuration.
+
+    <img src="/img/ai-management/chat-experience-config.png" alt="Chat Configuration UI" />
diff --git a/ai-management/ai-studio/compliance-events.mdx b/ai-management/ai-studio/compliance-events.mdx
new file mode 100644
index 0000000000..0a365434a2
--- /dev/null
+++ b/ai-management/ai-studio/compliance-events.mdx
@@ -0,0 +1,279 @@
+---
+title: "Compliance Events in Tyk AI Studio"
+description: "How filter scripts emit structured compliance events in Tyk AI Studio, and how to query and monitor them via the API, dashboard, and Prometheus metrics."
+keywords: "AI Studio, AI Management, Compliance Events, Governance, Filters, PII Redaction, Audit, Compliance Dashboard"
+sidebarTitle: "Compliance Events"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Available from Tyk AI Studio v2.1.0.
+
+Compliance Events are structured audit records that filter scripts can emit to flag governance-relevant activity, such as PII redactions, content rewrites, policy violations, or silent failures, without affecting whether the request is blocked or allowed. They flow through the same analytics pipeline as proxy logs and chat records, are stored centrally on the control plane, and surface in the Compliance dashboard for review, drill-down, and CSV export.
+
+This page is the end-to-end reference. For filter script syntax, see [Filters](/ai-management/ai-studio/filters#compliance-event-reporting).
+
+## Why Compliance Events
+
+Before v2.1, the only thing the compliance dashboard could count was 4xx proxy logs, that is, requests the gateway blocked. That misses the most common governance activity in practice: a filter quietly redacts an email address, rewrites a passage of text, or flags something suspicious while still allowing the request through. Those interventions are exactly what compliance teams need visibility into, and they previously left no trace beyond a debug log line.
+
+Compliance events fix that. Any filter script can attach a list of structured events to its output. The platform persists them, propagates them from edge gateways back to the control plane, exposes them via API and dashboard, and counts them in Prometheus, all without changing the filter's block/allow decision.
+
+## Event Schema
+
+A compliance event has the following shape (`ComplianceEventOutput` in the script API):
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `event_type` | string | Yes | Free-form type. Suggested conventions: `pii_redacted`, `content_rewritten`, `policy_violation`, `harmful_content_detected`, `silent_failure`. |
+| `severity` | string | No | `info`, `warning`, or `critical`. Defaults to `info` if omitted or invalid. |
+| `description` | string | No | Human-readable description of what happened, shown in the dashboard event row. |
+| `metadata` | map | No | Arbitrary key-value data. Stored as JSON. Conventions: `matched_pattern` (string of the trigger), `redacted_types` (array of category names). |
+
+**Validation:**
+
+- Events without an `event_type` are silently skipped. This avoids polluting the table with empty records when a script branch builds the event partially.
+- `severity` values outside `info|warning|critical` are coerced to `info`.
+- `event_type` on the API query side is limited to 100 characters; any longer is a 400.
+- `severity` on the API query side is validated against the same whitelist; an invalid value is a 400.
+- All API queries use GORM parameterized queries, so SQL injection attempts in `event_type` or `severity` are treated as literal string matches and return empty results.
+
+### Server-Side Enrichment
+
+Scripts only declare the four fields above. The platform enriches each event at recording time with context from the filter execution site:
+
+| Enriched field | Source |
+|---|---|
+| `app_id` | App that owns the request (proxy paths). `0` for chat-session paths, where `user_id` is the principal. |
+| `user_id` | Authenticated user (chat-session paths). |
+| `llm_id` | LLM in scope for the request. |
+| `vendor` | LLM vendor string (for example `openai`, `anthropic`, `bedrock`). |
+| `model_name` | Model being called. |
+| `filter_name` | Name of the filter that emitted the event. |
+| `filter_scope` | Where the script ran (see below). |
+| `timestamp` | Wall-clock time at recording. |
+
+### Filter Scopes
+
+`filter_scope` identifies which of the six filter execution sites recorded the event:
+
+| Scope | Site |
+|---|---|
+| `proxy_request` | LLM proxy request filters (before reaching the LLM). |
+| `proxy_response` | LLM proxy response filters (REST and streaming). |
+| `chat_request` | Chat-session message filters (before RAG search and LLM). |
+| `chat_response` | Chat-session response filters (regular and streaming). |
+| `file_reference` | File content filters (before RAG indexing). |
+| `tool_response` | Tool response filters (after tool execution). |
+
+You can filter on `filter_scope` indirectly via the dashboard drill-down, or by joining `compliance_events.filter_name` against your filter catalog.
+
+## Emitting Events from a Filter Script
+
+In a Tengo filter script, set `compliance_events` on the output object:
+
+```tengo
+tyk := import("tyk")
+
+modified_payload := tyk.redact_pattern(
+    input,
+    "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}",
+    "[EMAIL_REDACTED]"
+)
+
+output := {
+    block: false,
+    payload: modified_payload,
+    message: "",
+    compliance_events: [
+        {
+            event_type: "pii_redacted",
+            severity: "info",
+            description: "Email addresses redacted from request",
+            metadata: { "redacted_types": ["email"] }
+        }
+    ]
+}
+```
+
+See [Filters](/ai-management/ai-studio/filters#compliance-event-reporting) for conditional emission, response-filter examples, and metadata conventions.
+
+### Behavior
+
+- Recording is **asynchronous**. Events are queued and written by the analytics pipeline, so filter latency is unaffected.
+- Compliance events **never** affect the block/allow decision. Setting `block: false` with critical events is legitimate (the filter chose to redact rather than block); setting `block: true` with no events is also legitimate.
+- The list can be empty or omitted. Most filters won't emit events on every invocation; typically only when a condition fires.
+- Events are recorded **per filter, per invocation**. A single request can produce multiple events from multiple filters.
+
+## Edge Gateways
+
+In a hub-spoke deployment, filter scripts run on the [Edge Gateway](/ai-management/ai-studio/proxy), but compliance events live on the control plane. The propagation path is:
+
+1. Filter script on the edge sets `compliance_events` in its output.
+2. The Edge Gateway's analytics handler (`MicrogatewaAnalyticsHandler.RecordComplianceEvents`) queues the events to the pulse plugin's local buffer, which survives a gateway restart.
+3. On the next analytics pulse (every 30 seconds by default), events are batched into the gRPC `AnalyticsPulse` message as `ComplianceEventProto` entries.
+4. The control server's `SendAnalyticsPulse` handler reconstructs the compliance event from each entry, preserving `LLMID`, `AppID`, `UserID`, severity, type, description, metadata, vendor, and model name, and persists it.
+
+This means there is no functional difference between an event recorded by the embedded gateway and one recorded by an Edge Gateway: both end up in the same table with the same enrichment.
+
+If you need to verify that edge events are arriving, check the `aistudio_compliance_events_total` counter on the control-plane `/metrics` endpoint and group by source.
+
+## Querying Compliance Events
+
+### Admin API
+
+```
+GET /api/v1/compliance/events
+```
+
+Admin-only (requires the v1 route group's auth middleware and an admin role).
+
+**Query parameters:**
+
+| Param | Type | Description |
+|---|---|---|
+| `start_date` | ISO8601 date | Lower bound (inclusive) on `timestamp`. |
+| `end_date` | ISO8601 date | Upper bound (inclusive) on `timestamp`. |
+| `app_id` | uint | Filter by app. |
+| `event_type` | string (max 100 chars) | Exact match on `event_type`. |
+| `severity` | `info` / `warning` / `critical` | Whitelist; other values return 400. |
+| `limit` | int | Page size (default and max are deployment-dependent). |
+| `offset` | int | Page offset. |
+
+**Example:**
+
+```bash
+curl -H "Authorization: Bearer $ADMIN_TOKEN" \
+  "https://studio.example.com/api/v1/compliance/events?start_date=2026-05-01&end_date=2026-05-14&severity=critical&limit=50"
+```
+
+**Response shape:**
+
+```json
+{
+  "events": [
+    {
+      "id": 1234,
+      "app_id": 42,
+      "user_id": 0,
+      "llm_id": 7,
+      "filter_name": "PII Detector",
+      "filter_scope": "proxy_request",
+      "event_type": "pii_redacted",
+      "severity": "info",
+      "description": "Email addresses redacted from request",
+      "metadata": "{\"redacted_types\":[\"email\"]}",
+      "vendor": "openai",
+      "model_name": "gpt-4",
+      "timestamp": "2026-05-14T09:23:17Z"
+    }
+  ],
+  "total": 1
+}
+```
+
+`metadata` is returned as a JSON-encoded string (the storage shape). Parse it client-side.
+
+### SQL
+
+The underlying table is `compliance_events`. Useful indexes:
+
+- `(app_id, timestamp)`: composite, for per-app time-bounded queries.
+- `user_id`, `llm_id`, `filter_name`, `event_type`, `severity`: single-column, for filtering.
+- `timestamp`: for retention sweeps.
+
+Example:
+
+```sql
+SELECT filter_name, event_type, COUNT(*) AS n
+FROM compliance_events
+WHERE timestamp >= NOW() - INTERVAL '7 days'
+  AND severity IN ('warning', 'critical')
+GROUP BY filter_name, event_type
+ORDER BY n DESC;
+```
+
+## Dashboard Surfaces
+
+The Compliance dashboard (`/admin/compliance`) was extended in v2.1 to surface compliance events alongside the existing blocked-request data.
+
+### Summary Cards
+
+Two new cards next to the blocked-request total:
+
+- **Critical Events**: count over the selected window, with trend arrow. Escalates the card style above `COMPLIANCE_EVENTS_CRITICAL_ESCALATE_AT` (default 1, since a single critical event already warrants attention).
+- **Warning Events**: count over the selected window, with trend arrow. Escalates above `COMPLIANCE_EVENTS_WARNING_ESCALATE_AT` (default 20, since warnings are advisory and need to accumulate before they matter).
+
+### Policy Violations Tab
+
+The summary is split into three counters:
+
+- **Blocked**: 4xx proxy logs (existing).
+- **Flagged**: warning and critical compliance events that passed through (new).
+- **Affected Apps**: distinct apps appearing in either source.
+
+The timeline chart merges both streams. The per-app violation list unions events into the aggregation, so apps that only ever flag (and never block) appear in the drill-down.
+
+### Filter Events Tab
+
+A dedicated tab for compliance events with:
+
+- Severity totals (info / warning / critical) with a stacked timeline chart.
+- Severity and event-type filters (the event-type dropdown is populated from observed values in the window).
+- Pagination over the event list.
+- Expandable rows showing the raw `metadata` JSON.
+- CSV export wired to `GET /compliance/events`.
+
+### App Risk Modal
+
+Per-app risk score now includes event counts, with `warningEventWeight = 1` and `criticalEventWeight = 3`, so a single critical event contributes the same to the score as three warning events. Recent Violations interleaves blocked requests and compliance events sorted by timestamp, with severity-aware row rendering.
+
+## Metrics
+
+A Prometheus / OpenTelemetry counter is exposed on the `/metrics` endpoint:
+
+```
+aistudio_compliance_events_total{filter_scope, severity, event_type}
+```
+
+Use this to alert on critical-event bursts, or to watch for a sudden drop in expected redaction activity (which can indicate a misconfigured filter). Combine with `aistudio_llm_requests_total` to get a per-request rate.
+
+See [Analytics & Monitoring](/ai-management/ai-studio/analytics#prometheus-and-opentelemetry-metrics) for the full metric catalog.
+
+## Suggested Event-Type Conventions
+
+`event_type` is free-form, but consistency across filters makes dashboards and queries much more useful. Conventions used by the bundled filter scripts:
+
+| Event type | When to emit |
+|---|---|
+| `pii_redacted` | Filter replaced PII patterns with placeholders. Set `metadata.redacted_types` to an array of categories (`["email", "ssn", "phone"]`). |
+| `content_rewritten` | Filter transformed user or LLM content in a way the user can't see (for example system-prompt augmentation, anonymization). |
+| `sensitive_content_detected` | Filter found content matching a sensitive pattern. Pair with `block: true` for hard blocks; pair with `block: false` to record the detection without blocking. |
+| `harmful_content_detected` | Response filter detected harmful output. Set `metadata.matched_pattern` to the trigger. |
+| `policy_violation` | Filter detected a policy breach that may or may not be blocked. |
+| `silent_failure` | Filter encountered an error path it chose to swallow (for example an unreachable classifier service, falling back to allow). Use `severity: warning` so it shows up in the dashboard without paging anyone. |
+
+For `metadata` keys, prefer:
+
+- `matched_pattern` (string): the substring or regex match that fired the event.
+- `redacted_types` (array of strings): categories of PII or content removed.
+
+These keys are what the bundled filter scripts and the dashboard expect.
+
+## Migration Notes
+
+- **Schema**: v2.1 GORM auto-migration creates the `compliance_events` table on first startup. No manual step required.
+- **Filter scripts** written for v2.0 are forward-compatible. The `compliance_events` field is optional and ignored if absent.
+- **Bundled filter library**: the ship-with scripts (PII redaction, content blocking, response guardrails) were updated in v2.1 to emit compliance events with the conventions above. Re-import them from the marketplace, or copy from the updated templates in the admin UI, if you want them out of the box.
+- **Custom analytics handlers**: the `AnalyticsHandler` interface now takes `context.Context` on its recording methods, including the new `RecordComplianceEvents`. Custom implementations need to update their signatures; `RecordComplianceEvents` can be a no-op if you do not consume compliance events.
+
+## See Also
+
+- [Filters](/ai-management/ai-studio/filters#compliance-event-reporting): script-level syntax and examples.
+- [Analytics & Monitoring](/ai-management/ai-studio/analytics): the surrounding analytics pipeline and the full metric catalog.
+- [Edge Gateway](/ai-management/ai-studio/proxy): hub-spoke architecture and the analytics pulse that carries edge events to control.
+- [Tyk AI Studio release notes](/developer-support/release-notes/ai-studio): the `AnalyticsHandler` context change and related v2.1.0 SDK updates.
diff --git a/ai-management/ai-studio/configuration.mdx b/ai-management/ai-studio/configuration.mdx
new file mode 100644
index 0000000000..cc98cbe034
--- /dev/null
+++ b/ai-management/ai-studio/configuration.mdx
@@ -0,0 +1,92 @@
+---
+title: "Getting Started with Tyk AI Studio"
+description: "In this guide, we will walk through the initial configuration steps after deploying Tyk AI Studio, including logging in, connecting an LLM provider, and starting your first chat."
+keywords: "AI Studio, AI Management, Configuration"
+sidebarTitle: "Getting Started"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+<Note>
+This guide assumes you are logged in as a **Studio Administrator** with full permissions to configure the system.
+</Note>
+
+## 1. Login to the AI Studio
+
+After completing the [installation process](/ai-management/ai-studio/quickstart) and registering your first user:
+
+1.  **Access the UI:** Open your web browser and navigate to your configured `SITE_URL`
+2.  **Admin Login:** Log in using the administrator account you created during registration:
+
+    <img src="/img/ai-management/login-screen.png" alt="Login Screen" />
+
+    <Note>
+    **Reminder**: If you haven't completed the initial registration yet, go back to your [installation guide](/ai-management/ai-studio/quickstart#first-user-registration) and follow the "First User Registration" section.
+    </Note>
+
+
+## 2. Configure Your First LLM
+
+One of the most common initial steps is connecting Tyk AI Studio to an LLM provider.
+
+1.  **Navigate to LLM Management:** In the admin UI sidebar, select **LLM Management > LLM Providers**.
+2.  **Add LLM Configuration:** Click the button to add a new LLM Configuration.
+4.  **Enter Details:**
+    *   **Configuration Name:** Give it a recognizable name (e.g., `OpenAI-GPT-4o`).
+    *   **Description:** Optionally, add a description for this configuration.
+    *   **Select Vendor:** Choose the LLM provider you want to connect (e.g., OpenAI, Anthropic, Azure OpenAI).
+    *   **Select Default Model:** Specify the exact model identifier(s) provided by the vendor (e.g., `gpt-4o`, `gpt-4-turbo`).
+    *   Add API Key in the **Access Details** section:
+        <Note>
+        Do *not* paste your API key directly here. Instead, use [Secrets Management](/ai-management/ai-studio/secrets).
+        </Note>
+        *   If you haven't already, go to the **Secrets** section in the admin UI and create a new secret:
+            *   **Variable Name:** `OPENAI_API_KEY` (or similar)
+            *   **Secret Value:** Paste your actual OpenAI API key here.
+            *   Save the secret.
+        *   Return to the LLM Configuration screen.
+        *   In the API Key field, enter the secret reference: `$SECRET/OPENAI_API_KEY` (using the exact Variable Name you created).
+    *   **Other Parameters:** Configure any other provider-specific settings (e.g., Base URL for Azure/custom endpoints, default temperature, etc.).
+5.  **Save:** Save the LLM configuration.
+
+    <img src="/img/ai-management/initial-configuration-llm-config-ui.png" alt="LLM Config UI" />
+
+After adding and saving an LLM vendor, it is added to the default Catalog, making it available to [users](/ai-management/ai-studio/user-management) who have access to the default Catalog.
+
+For more details, see the [LLM Management](/ai-management/ai-studio/llm-management) documentation.
+
+## 3. Create Chat Experience
+
+1. Navigate to the **Chats > Chats** section in the admin UI.
+2. Click to create a new Chat Experience.
+    - **Name:** Give your chat a descriptive name (e.g., `OpenAPI GPT4o`).
+    - **LLM Call settings:** Select the [LLM Call settings](/ai-management/ai-studio/call-settings) you want to use for this chat (e.g., `gpt-4o`). If the specific model settings are not available, you can create one in the [LLM model settings](/ai-management/ai-studio/call-settings#how-to-create-llm-call-settings) page. We have added defaults for the popular ones.
+    - **Select LLM vendor:** Select the LLM configuration you created in the previous step.
+    - **Select Group**: Assign this chat to a specific Group or select "Default" to make it available to all users.
+3. Save the new Chat Experience.
+
+    <img src="/img/ai-management/chat-experience-config.png" alt="Chat Config" />
+
+## 4. Use the Chat Interface
+
+1. Navigate to the **Chat** tab at the top of the UI.
+2. **Select Chat Experience:** Choose the `OpenAPI GPT4o` experience you just created from the list of available chats.
+3. **Interact:** Type a question or prompt in the chat box.
+4. **Receive Responses:** The LLM will process your request and stream the response back to you in the chat window.
+
+    <img src="/img/ai-management/chat-interface-ui.png" alt="Chat UI" />
+
+You have now successfully configured an LLM and used it to answer a question through the Tyk AI Studio Chat Interface.
+
+## Next Steps
+
+With the initial configuration complete, you can now:
+
+*   Explore [User Management](/ai-management/ai-studio/user-management) to create users and groups.
+*   Set up [Tools](/ai-management/ai-studio/tools) for external API integration.
+*   Configure [Data Sources](/ai-management/ai-studio/datasources-rag) for RAG.
+*   Define [Filters](/ai-management/ai-studio/filters) for custom request/response logic.
diff --git a/ai-management/ai-studio/core-concepts.mdx b/ai-management/ai-studio/core-concepts.mdx
new file mode 100644
index 0000000000..1d1368b714
--- /dev/null
+++ b/ai-management/ai-studio/core-concepts.mdx
@@ -0,0 +1,94 @@
+---
+title: "What is AI Studio?"
+description: "Introduction to Tyk AI Studio, comprehensive AI management platform"
+keywords: "AI Studio, AI Management, Introduction"
+sidebarTitle: "Core Concepts"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio is a comprehensive platform that enables organizations to manage, govern, and deploy AI applications with enterprise-grade security, control, and observability. Before diving into installation and configuration, let's understand what AI Studio offers and its core concepts.
+
+## Key Components & Philosophy
+
+Tyk AI Studio is designed as a secure, observable, and extensible gateway for interacting with Large Language Models (LLMs) and other AI services. Key architectural pillars include:
+
+*   **[AI Gateway](/ai-management/ai-studio/proxy):** The central gateway managing all interactions between your applications and various LLM providers. It enforces policies, logs activity, and handles vendor abstraction. The gateway exists in two forms:
+    *   **Embedded Gateway** (in AI Studio): A lightweight \"gateway-lite\" for testing LLM configurations, powering the Chat interface, and proxying tool/datasource requests. No filters, no middleware, no plugins.
+    *   **[Edge Gateway](/ai-management/ai-studio/proxy)** (standalone binary): The full-featured data plane with the complete middleware pipeline — authentication, filters, plugins, analytics, budget enforcement, tool calling (REST + MCP), and datasource querying. Deployed at edge locations in a hub-and-spoke architecture.
+*   **[Model Router](/ai-management/ai-studio/model-router) (Enterprise):** Intelligent request routing across multiple LLM vendors based on model name patterns, with support for load balancing, failover, and model name translation.
+*   **[Chat](/ai-management/ai-studio/chat-interface):** Provides a secure and interactive environment for users to engage with LLMs, leveraging integrated tools and data sources.
+*   **[User Management & RBAC](/ai-management/ai-studio/user-management):** Securely manages users, teams, and permissions. Access to resources like LLMs, Tools, and Data Sources is controlled via team memberships.
+*   **[AI Portal](/ai-management/ai-studio/ai-portal):** Empowers developers with a curated catalog of AI tools and services for faster innovation.
+*   **Policy Enforcement ([Filters](/ai-management/ai-studio/filters)):** Intercept and modify LLM requests/responses using custom scripts to enforce specific rules or data transformations.
+*   **Configuration over Code:** Many aspects like LLM parameters, Filters, and [Budgets](/ai-management/ai-studio/budgeting) are configured through the UI/API rather than requiring code changes.
+*   **Security First:** Features like [Secrets Management](/ai-management/ai-studio/secrets), [SSO integration](/ai-management/ai-studio/sso), and fine-grained access control are integral to the platform.
+*   **Observability:** Includes systems for [Analytics & Monitoring](/ai-management/ai-studio/analytics) and [Notifications](/ai-management/ai-studio/notifications) to track usage, costs, and system events.
+
+## Core Entities
+
+Understanding these entities is crucial:
+
+### User
+Represents an individual interacting with Tyk AI Studio, managed within the [User Management system](/ai-management/ai-studio/user-management#core-concepts).
+
+### Team
+Teams are the central access control mechanism for organizing users and managing their access to LLMs, data sources, and tools via Catalogs. See also [Teams](/ai-management/ai-studio/teams).
+
+### App
+An App serves as the primary interface or bridge between an end-user and a Large Language Model (LLM). It acts as a managed API endpoint that wraps around an LLM provider (like OpenAI, Anthropic, or Mistral) to provide governance, security, and tracking. It encapsulates the LLMs, tools, and data sources needed for specific AI use cases and provides RESTful access via credentials.
+
+### API Key
+Credentials generated by Users to allow applications or scripts programmatic access to Tyk AI Studio APIs (like the Proxy), inheriting the User's permissions. See also [User Management](/ai-management/ai-studio/user-management#core-concepts).
+
+### LLM Configuration
+Represents a specific LLM provider and model setup (e.g., OpenAI GPT-4, Anthropic Claude 3), including parameters and potentially associated [pricing](/ai-management/ai-studio/llm-management) and [budgets](/ai-management/ai-studio/budgeting).
+
+### Tool
+Definitions of external APIs (via OpenAPI spec) that can be invoked by LLMs during chat sessions to perform actions or retrieve external data. See also [Tools](/ai-management/ai-studio/tools).
+
+### Data Source
+Connections to vector databases or other data repositories used for Retrieval-Augmented Generation (RAG) within chat sessions. See also [Data Sources](/ai-management/ai-studio/datasources-rag).
+
+### Catalogue
+Collections that group related [Tools](/ai-management/ai-studio/tools) or [Data Sources](/ai-management/ai-studio/datasources-rag) for easier management and assignment to Teams for access control.
+
+### Secret
+Securely stored credentials (API keys, tokens) referenced indirectly (e.g., `$SECRET/MY_KEY`) in configurations like LLMs, Tools, or Data Sources. See also [Secrets Management](/ai-management/ai-studio/secrets).
+
+### Filter
+Custom logic (using Tengo scripts) associated with specific execution points (e.g., pre/post LLM request) to intercept and modify requests/responses. See also [Filters](/ai-management/ai-studio/filters).
+
+### Chat / Chat Room
+Customized interfaces configured by admins that combine specific LLMs, tools, data sources, and system prompts for user interactions. See also [Chats](/ai-management/ai-studio/chats).
+
+### LLM Call Settings
+Default runtime parameters (e.g., temperature, max tokens, top P) for LLMs used in chat interactions and middleware function calls. See also [LLM Call Settings](/ai-management/ai-studio/call-settings).
+
+### Model Price
+Defines the cost per million tokens (input, output, cache) for using different language models, essential for analytics and budget enforcement. See also [Model Prices](/ai-management/ai-studio/model-prices).
+
+### Plugin
+The extensibility system using a Unified Plugin SDK to add custom capabilities like Edge Gateway middleware, UI extensions, Agent plugins, and Object Hooks. See also [Plugins](/ai-management/ai-studio/plugins/overview).
+
+### Budget
+Defines hard limits on costs (amount, currency, period) applied at the organization or LLM configuration level. See also [Budget Control](/ai-management/ai-studio/budgeting).
+
+
+For a detailed view of how these components fit together, including the hub-and-spoke architecture and proxy modes, see the [Architecture Overview](/ai-management/ai-studio/architecture).
+
+## Getting Started
+
+Now that you understand the core concepts, you're ready to begin your AI Studio journey:
+
+1. **[Choose your installation method](/ai-management/ai-studio/quickstart)**: Docker/Packages (recommended) or Kubernetes
+2. **[Complete first-time setup](/ai-management/ai-studio/configuration)**: Register your admin user and configure your first LLM
+3. **Explore the platform**: Start with the chat interface and gradually explore advanced features
+
+    <Note>
+    **Ready to start?** Head to the [Installation Guide](/ai-management/ai-studio/quickstart) to get AI Studio up and running in minutes.
+    </Note>
diff --git a/ai-management/ai-studio/datasources-rag.mdx b/ai-management/ai-studio/datasources-rag.mdx
new file mode 100644
index 0000000000..ae1e8d0f2a
--- /dev/null
+++ b/ai-management/ai-studio/datasources-rag.mdx
@@ -0,0 +1,286 @@
+---
+title: "Manage Data Sources in Tyk AI Studio"
+description: "Learn how to configure and manage Data Sources in Tyk AI Studio to enable Retrieval-Augmented Generation (RAG), connecting LLMs to external knowledge bases and vector stores."
+keywords: "AI Studio, AI Management, Datasources, RAG"
+sidebarTitle: "Data Sources & RAG"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio's Data Source system connects the platform to external knowledge bases, primarily vector stores, enabling **Retrieval-Augmented Generation (RAG)**. This allows Large Language Models (LLMs) to access and utilize specific information from your documents, grounding their responses in factual data.
+
+## Purpose
+
+The primary goal is to enhance LLM interactions by:
+
+*   **Providing Context:** Injecting relevant information retrieved from configured data sources directly into the LLM prompt.
+*   **Improving Accuracy:** Reducing hallucinations and grounding LLM responses in specific, verifiable data.
+*   **Accessing Private Knowledge:** Allowing LLMs to leverage internal documentation, knowledge bases, or other proprietary information.
+
+## Core Concepts
+
+*   **Data Source:** A configuration in Tyk AI Studio that defines a connection to a specific knowledge base (typically a vector store) and the associated embedding service used to populate it.
+*   **Vector Store Abstraction:** Tyk AI Studio provides a unified interface to interact with various vector database types. Supported stores: **Pinecone**, **PGVector**, **Chroma**, **Redis**, **Qdrant**, and **Weaviate**. Administrators configure the connection details for their chosen store.
+*   **Embedding Service:** Text needs to be converted into numerical vector embeddings before being stored and searched. Administrators configure the embedding service (e.g., OpenAI `text-embedding-ada-002`, a local Sentence Transformer model via an API endpoint) and its credentials (using [Secrets Management](/ai-management/ai-studio/secrets)).
+*   **File Processing:** Administrators upload documents (e.g., PDF, TXT, DOCX) to a Data Source configuration. Tyk AI Studio automatically:
+    *   Chunks the documents into smaller, manageable pieces.
+    *   Uses the configured Embedding Service to convert each chunk into a vector embedding.
+    *   Stores the text chunk and its corresponding embedding in the configured Vector Store.
+*   **RAG (Retrieval-Augmented Generation):** The core process where:
+    1.  A user's query in the [Chat Interface](/ai-management/ai-studio/chat-interface) is embedded using the same embedding service.
+    2.  This query embedding is used to search the relevant vector store(s) for the most similar text chunks (based on vector similarity).
+    3.  The retrieved text chunks are added as context to the prompt sent to the LLM.
+    4.  The LLM uses this context to generate a more informed and relevant response.
+*   **Data Source Catalogues:** Similar to Tools, Data Sources are grouped into Catalogues for easier management and assignment to teams.
+*   **Privacy Levels:** Each Data Source has a privacy level. It can only be used in RAG if its level is less than or equal to the privacy level of the [LLM Configuration](/ai-management/ai-studio/llm-management) being used, ensuring data governance.
+
+    Privacy levels define how data is protected by controlling LLM access based on its sensitivity:
+    - **Public (0)** – Safe to share (e.g., blogs, press releases).
+    - **Internal (25)** – Company-only info (e.g., reports, policies).
+    - **Confidential (50)** – Sensitive business data (e.g., financials, strategies).
+    - **Restricted/PII (100)** – Personal data (e.g., names, emails, customer info).
+
+    *Note: Privacy levels are stored as integer scores in the system. The values shown in parentheses are the typical score mappings.*
+
+## Availability
+
+Data Sources are available on both **AI Studio** (embedded gateway) and **Edge Gateway**. Datasource configurations including vector store connection strings, API keys, and embedder credentials are synced to edge gateways via the hub-spoke configuration system with encryption in transit. Datasources support namespace filtering for enterprise multi-tenant deployments. All four proxy endpoints (search, vector search, metadata query, and embedding generation) are functional on edge gateways.
+
+## How RAG Works in the Chat Interface
+
+When RAG is enabled for a Chat Experience:
+
+1.  User sends a prompt.
+2.  Tyk AI Studio embeds the user's prompt using the configured embedding service for the relevant Data Source(s).
+3.  Tyk AI Studio searches the configured Vector Store(s) using the prompt embedding to find relevant text chunks.
+4.  The retrieved chunks are formatted and added to the context window of the LLM prompt.
+5.  The combined prompt (original query + retrieved context) is sent to the LLM.
+6.  The LLM generates a response based on both the query and the provided context.
+7.  The response is streamed back to the user.
+
+{/* ## Advanced Data Source Management (Plugin Service API)
+
+Plugins can perform advanced data source operations through the Service API for managing vector store data programmatically:
+
+### Delete Documents by Metadata
+
+Remove specific chunks from vector stores using metadata filters:
+
+```go
+// Delete all chunks for a specific file
+metadata := map[string]string{"file_path": "src/main.go"}
+count, err := ai_studio_sdk.DeleteDocumentsByMetadata(ctx, datasourceID, metadata, "AND", false)
+```
+
+**Features:**
+- AND/OR filter modes for multiple conditions
+- Dry-run mode to preview deletions without actually removing data
+- Works with Chroma, PGVector, Pinecone, Weaviate
+
+**Use cases:**
+- Clean up orphaned chunks when files are deleted
+- Remove outdated documentation chunks
+- Selective data cleanup based on metadata tags
+
+### Query by Metadata Only
+
+Find documents using metadata without vector similarity search:
+
+```go
+// Find all chunks from a specific source
+metadata := map[string]string{"source": "github", "repo": "myrepo"}
+results, totalCount, err := ai_studio_sdk.QueryByMetadataOnly(ctx, datasourceID, metadata, "AND", 10, 0)
+```
+
+**Features:**
+- Pagination with limit and offset parameters
+- AND/OR filter modes for complex queries
+- Returns total count for pagination UI
+
+**Use cases:**
+- List all chunks from a specific source
+- Find documents by file path or document ID
+- Audit what data is stored in the vector store
+
+### Namespace Management
+
+List and manage vector store namespaces/collections:
+
+```go
+// List all namespaces with document counts
+namespaces, err := ai_studio_sdk.ListNamespaces(ctx, datasourceID)
+for _, ns := range namespaces {
+    fmt.Printf("Namespace: %s, Documents: %d\n", ns.Name, ns.DocumentCount)
+}
+
+// Delete entire namespace (requires confirmation for safety)
+err := ai_studio_sdk.DeleteNamespace(ctx, datasourceID, "old-namespace", true)
+```
+
+**Features:**
+- List all namespaces/collections in a vector store
+- Get document counts per namespace
+- Bulk deletion with safety confirmation requirement
+
+**Use cases:**
+- Manage multi-tenant vector stores
+- Clean up entire repositories when projects are deleted
+- Monitor storage usage across namespaces
+
+**Vector Store Support:**
+- ✅ Full support: Chroma, PGVector, Pinecone, Weaviate
+- ⚠️ Limited: Redis (basic operations only)
+- ⚠️ Partial: Qdrant (namespace management only) */}
+
+## Creating & Managing Data Sources (Admin)
+
+Administrators configure Data Sources via the UI or API:
+
+1.  **Define Data Source:** Provide a name, description, and privacy level.
+2.  **Configure Vector Store:**
+    *   Select the database type (e.g., `pinecone`).
+    *   Provide connection details (e.g., endpoint/connection string, namespace/index name).
+    *   Reference a [Secret](/ai-management/ai-studio/secrets) containing the API key/credentials.
+3.  **Configure Embedding Service:**
+    *   Select the vendor/type (e.g., `openai`, `local`).
+    *   Specify the model name (if applicable).
+    *   Provide the service URL (if applicable, for local models).
+    *   Reference a [Secret](/ai-management/ai-studio/secrets) containing the API key (if applicable).
+4.  **Upload Files:** Upload documents to be chunked, embedded, and indexed into the vector store.
+
+    <img src="/img/ai-management/data-sources-config.png" alt="Datasource Config" />
+
+## Organizing & Assigning Data Sources (Admin)
+
+*   **Create Catalogues:** Group related Data Sources into Catalogues (e.g., "Product Docs", "Support KB").
+*   **Assign to Teams:** Assign Data Source Catalogues to specific [teams](/ai-management/ai-studio/user-management).
+
+    <img src="/img/ai-management/data-sources-catalog-config.png" alt="Catalogue Config" />
+
+## Using Data Sources (User)
+
+Data Sources are primarily used implicitly via RAG within the [Chat Interface](/ai-management/ai-studio/chat-interface).
+
+A Data Source will be used for RAG if:
+
+1.  The specific Chat Experience configuration includes the relevant Data Source Catalogue.
+2.  The user belongs to a Team that has been assigned that Data Source Catalogue.
+3.  The Data Source's privacy level is compatible with the LLM being used.
+
+## Programmatic Access via API
+
+Tyk AI Studio provides a direct API endpoint for querying configured Data Sources programmatically:
+
+### Datasource API Endpoint
+
+*   **Endpoint:** `/datasource/{dsSlug}` (where `{dsSlug}` is the datasource identifier)
+*   **Method:** POST
+*   **Authentication:** Bearer token required in the Authorization header
+
+### Request Format
+
+```json
+{
+  "query": "your semantic search query here",
+  "n": 5  // optional, number of results to return (default: 3)
+}
+```
+
+### Response Format
+
+```json
+{
+  "documents": [
+    {
+      "content": "text content of the document chunk",
+      "metadata": {
+        "source": "filename.pdf",
+        "page": 42
+      }
+    },
+    // additional results...
+  ]
+}
+```
+
+### Example Usage
+
+#### cURL
+
+```bash
+curl -X POST "https://your-tyk-instance/datasource/product-docs" \
+  -H "Authorization: Bearer YOUR_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"query": "How do I configure authentication?", "n": 3}'
+```
+
+#### Python
+
+```python
+import requests
+
+url = "https://your-tyk-instance/datasource/product-docs"
+headers = {
+    "Authorization": "Bearer YOUR_TOKEN",
+    "Content-Type": "application/json"
+}
+payload = {
+    "query": "How do I configure authentication?",
+    "n": 3
+}
+
+response = requests.post(url, json=payload, headers=headers)
+results = response.json()
+
+for doc in results["documents"]:
+    print(f"Content: {doc['content']}")
+    print(f"Source: {doc['metadata']['source']}")
+    print("---")
+```
+
+#### JavaScript
+
+```javascript
+async function queryDatasource() {
+  const response = await fetch('https://your-tyk-instance/datasource/product-docs', {
+    method: 'POST',
+    headers: {
+      'Authorization': 'Bearer YOUR_TOKEN',
+      'Content-Type': 'application/json'
+    },
+    body: JSON.stringify({
+      query: 'How do I configure authentication?',
+      n: 3
+    })
+  });
+  
+  const data = await response.json();
+  
+  data.documents.forEach(doc => {
+    console.log(`Content: ${doc.content}`);
+    console.log(`Source: ${doc.metadata.source}`);
+    console.log('---');
+  });
+}
+```
+
+### Common Issues and Troubleshooting
+
+1. **Trailing Slash Error:** The endpoint does not accept a trailing slash. Use `/datasource/{dsSlug}` and not `/datasource/{dsSlug}/`.
+
+2. **Authentication Errors:** Ensure your Bearer token is valid and has not expired. The token must have permissions to access the specified datasource.
+
+3. **404 Not Found:** Verify that the datasource slug is correct and that the datasource exists and is properly configured.
+
+4. **403 Forbidden:** Check that your user account has been granted access to the datasource catalogue containing this datasource.
+
+5. **Empty Results:** If you receive an empty documents array, try:
+   - Reformulating your query to better match the content
+   - Increasing the value of `n` to get more results
+   - Verifying that the datasource has been properly populated with documents
+
+This API endpoint allows developers to build custom applications that leverage the semantic search capabilities of configured vector stores without needing to implement the full RAG pipeline.
diff --git a/ai-management/ai-studio/deployment-k8s.mdx b/ai-management/ai-studio/deployment-k8s.mdx
new file mode 100644
index 0000000000..d0e2157674
--- /dev/null
+++ b/ai-management/ai-studio/deployment-k8s.mdx
@@ -0,0 +1,512 @@
+---
+title: "Install Tyk AI Studio on Kubernetes"
+description: "Installation guide for the Tyk AI Studio on Kubernetes"
+keywords: "AI Studio, AI Management, Installation, Kubernetes, Helm"
+sidebarTitle: "Kubernetes"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+<Note>
+This guide focuses on the Enterprise Edition of Tyk AI Studio. For the Community Edition, please refer to the [Tyk AI Studio GitHub repository](https://github.com/TykTechnologies/ai-studio/blob/main/docs/site/docs/deployment-helm-k8s.md). The Community Edition uses different Docker images (`tykio/tyk-ai-studio` and `tykio/tyk-microgateway`) and does not require a license key.
+</Note>
+
+This guide explains how to deploy Tyk AI Studio (control plane), an Edge Gateway (data plane), and PostgreSQL on Kubernetes using Helm. AI Studio manages configuration centrally and the Edge Gateway processes AI requests, receiving configuration via gRPC.
+
+## Prerequisites
+
+- Kubernetes 1.16+
+- Helm 3.0+
+- `kubectl` configured with access to your cluster
+- A Tyk AI License key (contact support@tyk.io or your account manager to obtain)
+- For production with TLS: cert-manager installed in your cluster
+
+<Note>
+Running on Podman, containerd, or another container runtime? See [Container Runtimes](/deployment-and-operations/container-runtimes).
+</Note>
+
+## Generate Secrets
+
+Before installing, generate three secret keys to secure communication and encrypt data:
+
+```bash
+# Secret key for encryption (used for secrets management and SSO)
+openssl rand -hex 16
+# Example output: a35b3f7b0fb4dd3a048ba4fc6e9fe0a8
+
+# Encryption key for Edge Gateway communication (must be exactly 32 hex chars)
+openssl rand -hex 16
+# Example output: 822d3d1e0e2d849263e45fc7bb842364
+
+# gRPC auth token (for hub-spoke communication)
+openssl rand -hex 16
+# Example output: 9f2c4a6b8d0e1f3a5c7d9e1b3a5c7d9e
+```
+
+Save these values — you will substitute them into the values file below.
+
+---
+
+## Option 1: Testing / Quickstart
+
+For local development or test clusters. Uses NodePort services, internal PostgreSQL, and no ingress.
+
+### 1. Add the Helm Chart
+
+```bash
+cd /path/to/tyk-ai-studio/helm
+helm dependency update .
+```
+
+### 2. Create `values-testing.yaml`
+
+Replace the placeholder secrets with your generated values. The `grpcAuthToken` / `edgeAuthToken` and `microgatewayEncryptionKey` / `encryptionKey` pairs **must match**.
+
+```yaml Expandable
+midsommar:
+  image:
+    repository: tykio/tyk-ai-studio-ent
+    tag: v2.0.0
+  service:
+    type: NodePort
+    ports:
+      - name: http
+        port: 8080
+        targetPort: 8080
+        nodePort: 32580
+      - name: gateway
+        port: 9090
+        targetPort: 9090
+        nodePort: 32590
+      - name: grpc
+        port: 50051
+        targetPort: 50051
+
+config:
+  allowRegistrations: "true"
+  siteUrl: "http://localhost:32580"                       # Update post-install if not localhost
+  fromEmail: "noreply@localhost"
+  devMode: "true"                                       # Required for login over plain HTTP
+  databaseType: "postgres"
+  tykAiSecretKey: "CHANGE-ME-first-secret"
+  tykAiLicense: "your-license-key"
+  ociCacheDir: "./data/cache/plugins"
+  ociRequireSignature: "false"
+  gatewayMode: "control"
+  grpcPort: "50051"
+  grpcHost: "0.0.0.0"
+  grpcTlsInsecure: "true"
+  grpcAuthToken: "CHANGE-ME-third-secret"
+  microgatewayEncryptionKey: "CHANGE-ME-second-secret"
+  # proxyUrl auto-resolves to the Edge Gateway k8s service — no need to set it
+
+database:
+  internal: true
+  user: "tyk"
+  password: "your-db-password"
+  name: "tyk_ai_studio"
+
+postgres:
+  persistence:
+    enabled: true
+    size: 1Gi
+
+microgateway:
+  enabled: true
+  image:
+    repository: tykio/tyk-microgateway-ent
+    tag: v2.0.0
+  service:
+    type: NodePort
+    port: 8080
+    nodePort: 32591
+  config:
+    edgeId: "edge-1"
+    edgeNamespace: "default"
+  secrets:
+    edgeAuthToken: "CHANGE-ME-third-secret"             # Must match config.grpcAuthToken
+    encryptionKey: "CHANGE-ME-second-secret"             # Must match config.microgatewayEncryptionKey
+    tykAiLicense: "your-license-key"
+```
+
+### 3. Install
+
+```bash
+helm install midsommar . -f values-testing.yaml
+```
+
+### 4. Set External Gateway URL
+
+The Edge Gateway's internal service URL is used for routing by default, but the portal needs to display the correct external URL for tools and datasources. After install, patch the config with your cluster's node IP:
+
+```bash
+# Get the node IP and set the gateway URL
+NODE_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
+GATEWAY_URL="http://${NODE_IP}:32591"
+
+# Patch the configmap with correct URLs and restart AI Studio
+STUDIO_URL="http://${NODE_IP}:32580"
+kubectl patch configmap midsommar-config -p \
+  "{\"data\":{\"SITE_URL\":\"${STUDIO_URL}\",\"TOOL_DISPLAY_URL\":\"${GATEWAY_URL}\",\"DATASOURCE_DISPLAY_URL\":\"${GATEWAY_URL}\"}}"
+kubectl rollout restart deployment midsommar
+```
+
+<Note>
+**Tip:** If you know your cluster's external IP or hostname upfront, you can skip this step by setting `config.toolDisplayUrl` and `config.datasourceDisplayUrl` in your values file instead.
+</Note>
+
+### 5. Verify
+
+```bash
+# Check all pods are running
+kubectl get pods
+
+# Check AI Studio health (via NodePort)
+curl -s http://${NODE_IP}:32580/health
+
+# Check Edge Gateway health (via NodePort)
+curl -s http://${NODE_IP}:32591/health
+```
+
+### Access Points
+
+| Port | URL | Purpose |
+|------|-----|---------|
+| 32580 | `http://<node-ip>:32580` | AI Studio UI + REST API |
+| 32590 | `http://<node-ip>:32590` | Embedded AI Gateway |
+| 32591 | `http://<node-ip>:32591` | Edge Gateway |
+
+---
+
+## Option 2: Production with TLS
+
+For production deployments with Ingress, TLS via cert-manager, and an external database.
+
+### 1. Create `values-production.yaml`
+
+Replace all placeholder values with your actual configuration.
+
+```yaml Expandable
+midsommar:
+  image:
+    repository: tykio/tyk-ai-studio-ent
+    tag: v2.0.0
+  ingress:
+    enabled: true
+    certificateEnabled: true
+    className: nginx
+    certManager:
+      issuer: letsencrypt-prod
+    hosts:
+      - host: studio.yourdomain.com
+        paths:
+          - path: /
+            pathType: Prefix
+            port: 8080
+    tls:
+      - secretName: studio-tls-secret
+        hosts:
+          - studio.yourdomain.com
+  service:
+    ports:
+      - name: http
+        port: 8080
+        targetPort: 8080
+      - name: gateway
+        port: 9090
+        targetPort: 9090
+      - name: grpc
+        port: 50051
+        targetPort: 50051
+
+config:
+  allowRegistrations: "true"
+  siteUrl: "https://studio.yourdomain.com"
+  fromEmail: "noreply@yourdomain.com"
+  devMode: "false"
+  databaseType: "postgres"
+  tykAiSecretKey: "CHANGE-ME-first-secret"
+  tykAiLicense: "your-license-key"
+  ociCacheDir: "./data/cache/plugins"
+  ociRequireSignature: "false"
+  gatewayMode: "control"
+  grpcPort: "50051"
+  grpcHost: "0.0.0.0"
+  grpcTlsInsecure: "true"                               # Set to "false" with TLS certs
+  grpcAuthToken: "CHANGE-ME-third-secret"
+  microgatewayEncryptionKey: "CHANGE-ME-second-secret"
+  # proxyUrl, toolDisplayUrl, datasourceDisplayUrl auto-resolve from Edge Gateway ingress config
+
+database:
+  internal: false
+  url: "postgres://user:password@your-db-host:5432/tyk_ai_studio?sslmode=require"
+
+microgateway:
+  enabled: true
+  image:
+    repository: tykio/tyk-microgateway-ent
+    tag: v2.0.0
+  ingress:
+    enabled: true
+    certificateEnabled: true
+    className: nginx
+    certManager:
+      issuer: letsencrypt-prod
+    hosts:
+      - host: gateway.yourdomain.com
+        paths:
+          - path: /
+            pathType: Prefix
+    tls:
+      - secretName: gateway-tls-secret
+        hosts:
+          - gateway.yourdomain.com
+  config:
+    edgeId: "edge-1"
+    edgeNamespace: "default"
+    allowInsecure: "false"
+    tlsEnabled: "false"                                  # gRPC client TLS to AI Studio
+  secrets:
+    edgeAuthToken: "CHANGE-ME-third-secret"
+    encryptionKey: "CHANGE-ME-second-secret"
+    tykAiLicense: "your-license-key"
+```
+
+### 2. Install
+
+```bash
+helm dependency update .
+helm install midsommar . -f values-production.yaml
+```
+
+### 3. Verify
+
+```bash
+kubectl get pods
+kubectl get ingress
+curl -s https://studio.yourdomain.com/health
+curl -s https://gateway.yourdomain.com/health
+```
+
+---
+
+## After Deployment
+
+### First User Registration
+
+After deployment, you need to create your first admin user:
+
+1. **Access the application**: Navigate to your configured `SITE_URL` (e.g., `https://studio.yourdomain.com`)
+2. **Register with admin email**: Use the EXACT email address you set in the `ADMIN_EMAIL` environment variable in your configuration.
+3. **Complete registration**: The first user who registers with the admin email will automatically become the administrator.
+
+<Note>
+**Important**: The first user registration must use the same email address specified in the `ADMIN_EMAIL` environment variable. This user will have full administrative privileges.
+</Note>
+
+### Add Your API Keys
+
+AI Studio pre-populates OpenAI and Anthropic LLM configurations on first startup with placeholder secrets (`OPENAI_KEY` and `ANTHROPIC_KEY`). To start using them:
+
+1. Open AI Studio at the `siteUrl` you configured and log in with your admin account
+2. Navigate to **Governance → Secrets** in the sidebar
+3. Click on **`OPENAI_KEY`** and edit it to add your OpenAI API key
+4. Click on **`ANTHROPIC_KEY`** and edit it to add your Anthropic API key
+
+### Push Configuration to the Edge Gateway
+
+1. Navigate to **AI Portal → Edge Gateways** in the sidebar
+2. Verify your edge gateway (`edge-1`) shows as **Connected**
+3. Click **Push Configuration** to sync the latest settings to the Edge Gateway
+
+Once the sync status shows **Synced**, the Edge Gateway is ready to proxy LLM requests.
+
+For further setup (additional LLMs, users, applications), see the **[Initial Configuration](/ai-management/ai-studio/configuration)** guide.
+
+---
+
+## Shared Secrets Reference
+
+These values **must match** between AI Studio and Edge Gateway configuration:
+
+| AI Studio Config | Edge Gateway Config | Purpose |
+|---|---|---|
+| `config.grpcAuthToken` | `microgateway.secrets.edgeAuthToken` | Authenticates the gRPC connection |
+| `config.microgatewayEncryptionKey` | `microgateway.secrets.encryptionKey` | Encrypts synced configuration data |
+| `config.tykAiLicense` | `microgateway.secrets.tykAiLicense` | Enterprise license |
+
+## Port Reference
+
+| Port | Component | Purpose |
+|------|-----------|---------|
+| 8080 | AI Studio | Admin UI + REST API |
+| 9090 | AI Studio | Embedded AI Gateway |
+| 50051 | AI Studio | gRPC control server (internal) |
+| 8080 | Edge Gateway | Edge AI Gateway |
+| 5432 | PostgreSQL | Database |
+
+---
+
+## Advanced Configuration
+
+### Message Queue (NATS)
+
+For distributed deployments with message persistence, add NATS configuration to your values file:
+
+```yaml
+config:
+  queueType: "nats"
+  natsUrl: "nats://nats-server:4222"
+  natsStorageType: "file"
+  natsRetentionPolicy: "interest"
+  natsMaxAge: "4h"
+  natsTlsEnabled: true
+  natsCredentialsFile: "/etc/nats/user.creds"
+```
+
+### Optional Components
+
+#### Reranker Service
+
+Improves RAG result relevance:
+
+```yaml
+reranker:
+  enabled: true
+  image:
+    repository: tykio/reranker_cpu
+    tag: latest
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+```
+
+#### Transformer Server
+
+Handles embedding generation:
+
+```yaml
+transformer-server:
+  enabled: true
+  image:
+    repository: tykio/transformer_server_cpu
+    tag: latest
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+```
+
+### Scaling Edge Gateways
+
+To deploy multiple edge gateways for different regions, override `edgeId` and `edgeNamespace` per instance. You can either deploy separate Helm releases or create additional Kubernetes Deployments with unique values:
+
+```yaml
+microgateway:
+  config:
+    edgeId: "edge-eu-west-1"
+    edgeNamespace: "eu-west"
+```
+
+Each edge instance registers independently with AI Studio and receives only the configuration assigned to its namespace.
+
+### Database Options
+
+**Internal PostgreSQL** (testing/small deployments):
+
+```yaml
+database:
+  internal: true
+  user: "tyk"
+  password: "secure-password"
+  name: "tyk_ai_studio"
+
+postgres:
+  persistence:
+    enabled: true
+    size: 10Gi
+    storageClass: "standard"
+```
+
+**External Database** (production):
+
+```yaml
+database:
+  internal: false
+  url: "postgres://user:password@your-db-host:5432/tyk_ai_studio?sslmode=require"
+```
+
+---
+
+## Maintenance
+
+### Upgrading
+
+```bash
+helm upgrade midsommar . -f your-values.yaml
+```
+
+### Uninstalling
+
+```bash
+helm uninstall midsommar
+```
+
+### Viewing Logs
+
+```bash
+# AI Studio logs
+kubectl logs -l app.kubernetes.io/name=midsommar
+
+# Edge Gateway logs
+kubectl logs -l app=microgateway
+
+# Database logs (internal postgres)
+kubectl logs -l app=postgres
+```
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="Check pod and ingress status">
+
+```bash
+kubectl get pods
+kubectl get ingress
+kubectl describe pod <pod-name>
+````
+
+</Accordion>
+
+<Accordion title="Common Issues">
+
+* **Database connection failures**: Check credentials and network access
+* **Ingress not working**: Verify DNS records and TLS configuration
+* **Login fails on HTTP**: Set `devMode: "true"` — session cookies require this when not using HTTPS
+* **Marketplace page is empty**: Set `ociCacheDir: "./data/cache/plugins"` in your config values — the marketplace service will not start without it
+* **Plugin signature verification**: Docker images use distroless bases without cosign. Set `ociRequireSignature: "false"` to disable signature verification
+
+</Accordion>
+
+<Accordion title="Edge Gateway cannot connect to AI Studio">
+
+* Verify the Edge Gateway pod logs:
+
+```bash
+kubectl logs -l app=microgateway
+```
+
+* Check that `CONTROL_ENDPOINT` resolves to the AI Studio service (default: `midsommar:50051`)
+* Verify `edgeAuthToken` matches `grpcAuthToken` exactly
+* Verify `encryptionKey` matches `microgatewayEncryptionKey` exactly
+* Check that `GATEWAY_MODE=control` is set in AI Studio config
+
+</Accordion>
+
+</AccordionGroup>
\ No newline at end of file
diff --git a/ai-management/ai-studio/edge-gateway-env.mdx b/ai-management/ai-studio/edge-gateway-env.mdx
new file mode 100644
index 0000000000..d5a1c442df
--- /dev/null
+++ b/ai-management/ai-studio/edge-gateway-env.mdx
@@ -0,0 +1,42 @@
+---
+title: "Tyk Edge Gateway Environment Variables"
+description: "Environment variables and configuration options for Tyk Edge Gateway."
+order: 2
+sidebarTitle: "Edge Gateway"
+---
+
+import EdgeGatewayConfig from '/snippets/edge-gateway-config.mdx';
+import EnvTypeMapping from '/snippets/env-type-mapping.mdx';
+
+This page details the environment variables that can be used to configure the Tyk Edge Gateway.
+
+## Configuration
+
+Tyk Edge Gateway (Edge Gateway) is configured primarily using environment variables.
+
+### Configuration Precedence
+
+The application loads configuration in the following order of precedence (highest to lowest):
+
+1.  **Shell Environment Variables**: Variables set in the OS/Shell (e.g., `export PORT=9090`) always override everything else.
+2.  **`.env` File**: Variables loaded from the file specified by the `-env` flag.
+    *   *Note:* The application checks if a variable is already set in the environment before loading it from the file, ensuring shell variables are preserved.
+
+### Command Line Flags
+
+You can specify a `.env` file using the `-env` flag when starting the binary:
+
+```bash
+./microgateway -env /path/to/prod.env
+```
+
+### Supported Formats
+
+*   **Main Configuration**: Only the `.env` format (key=value pairs) is supported via the `-env` flag.
+*   **Plugin Configuration**: Supports JSON and YAML files for plugin definitions, specified via the `PLUGINS_CONFIG_PATH` environment variable.
+
+<EnvTypeMapping/>
+
+## Variables
+
+<EdgeGatewayConfig/>
\ No newline at end of file
diff --git a/ai-management/ai-studio/filters.mdx b/ai-management/ai-studio/filters.mdx
new file mode 100644
index 0000000000..8cf3f62405
--- /dev/null
+++ b/ai-management/ai-studio/filters.mdx
@@ -0,0 +1,1063 @@
+---
+title: "Filters and Middleware"
+description: "How to use Filters and Middleware in Tyk AI Studio?"
+keywords: "AI Studio, AI Management, Filters, Middleware"
+sidebarTitle: "Filters & Policies"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+The **Filters List View** allows administrators to manage filters and middleware applied to prompts or data sent to Large Language Models (LLMs) via the AI Gateway or Chat Rooms. Filters and middleware ensure data governance, compliance, and security by processing or controlling the flow of information. Below is an enhanced description with the distinction between **Filters** and **Middleware**:
+
+---
+
+#### **Filters: Unified Blocking and Modification**
+
+Filters in Midsommar provide comprehensive request/response processing with both **blocking** and **modification** capabilities:
+
+1. **Blocking Filters**:
+   - **Purpose**: Governance controls that deny requests based on content analysis.
+   - **Behavior**:
+     - Analyze message content, metadata, and context.
+     - Block requests that violate policies or contain restricted content.
+     - Example: Block prompts containing PII, sensitive keywords, or unauthorized patterns.
+
+2. **Modification Filters**:
+   - **Purpose**: Transform message content before it reaches the LLM or after tool responses.
+   - **Behavior**:
+     - Redact sensitive information (emails, phone numbers, SSNs).
+     - Enhance system prompts with safety instructions.
+     - Normalize or transform content across vendors.
+     - Example: Automatically redact PII while allowing the request to proceed.
+
+3. **Combined Approach**:
+   - Filters can both inspect AND modify in a single script.
+   - Example: Redact emails from user messages, but block if SSN is detected.
+
+**Key Capabilities**:
+- ✅ **Request Filters**: Modify/block requests before reaching LLM
+  - LLM Proxy Requests (before reaching LLM)
+  - Chat Session Messages (before RAG search and LLM)
+  - File Content (before RAG indexing)
+  - Tool Responses (after tool execution)
+- ✅ **Response Filters**: Block LLM responses based on content
+  - LLM Proxy Responses (REST and streaming)
+  - Chat Session Responses (regular and streaming)
+
+---
+
+#### **Table Overview**
+
+1. **Name**:
+   - The name of the filter or middleware (e.g., `Anonymize PII (LLM)`, `Fixed PII Filter`).
+
+2. **Description**:
+   - A brief summary of the filter or middleware's functionality (e.g., "Uses Regex to remove obvious PII").
+
+3. **Actions**:
+   - A menu (three-dot icon) that allows administrators to:
+     - Edit the filter or middleware.
+     - Delete the filter or middleware.
+
+---
+
+#### **Features**
+
+1. **Add Filter Button**:
+   - A green button labeled **+ ADD FILTER**, located in the top-right corner. Clicking this button opens a form to create a new filter or middleware.
+
+2. **Pagination Dropdown**:
+   - Located at the bottom-left corner, this control allows administrators to adjust the number of entries displayed per page.
+
+---
+
+#### **Examples of Filters and Middleware**
+
+- **Filters**:
+  - **PII Detector**: A regex-based filter that blocks prompts containing sensitive PII.
+  - **JIRA Field Analysis**: Ensures no PII is included in data retrieved from JIRA fields before passing to the LLM.
+
+- **Middleware**:
+  - **Anonymize PII (LLM)**: Uses an LLM to anonymize sensitive data before sending it downstream.
+  - **NER Service Filter**: A Named Entity Recognition (NER) microservice that modifies outputs to remove identified entities.
+
+---
+
+#### **Use Cases**
+
+1. **Prompt Validation with Filters**:
+   - Ensures that only compliant and secure prompts are sent to LLMs.
+   - Example: Blocking a prompt with sensitive data that should not be processed by an unapproved vendor.
+
+2. **Data Preprocessing with Middleware**:
+   - Prepares data from tools or external sources for safe interaction with LLMs by modifying or anonymizing content.
+   - Example: Removing sensitive ticket details from a JIRA query before sending to an LLM.
+
+3. **Organizational Security**:
+   - Both filters and middleware ensure sensitive information is protected and handled in line with organizational governance policies.
+
+4. **Enhanced Tool Interactions**:
+   - Middleware supports tools by transforming their outputs, enabling richer and safer LLM interactions.
+
+---
+
+#### **Key Benefits**
+
+1. **Improved Data Governance**:
+   - Filters and middleware work together to enforce strict controls over data flow, protecting sensitive information.
+
+2. **Flexibility**:
+   - Middleware allows for data transformation, enhancing interoperability between tools and LLMs.
+   - Filters ensure compliance without altering user-provided prompts.
+
+3. **Compliance and Security**:
+   - Prevent unauthorized or sensitive data from reaching unapproved vendors, ensuring regulatory compliance.
+
+This detailed structure for **Filters and Middleware** provides organizations with robust governance tools to secure and optimize data workflows in the Tyk AI Studio.
+
+### Filter Edit View (and example Filter)
+
+The **Filter Edit View** enables administrators to create or modify filters using the **Tengo scripting language**. Filters serve as governance tools that analyze input data (e.g., prompts or files) and decide whether the content is permitted to pass to the upstream LLM. In this example, the filter uses regular expressions (regex) to detect Personally Identifiable Information (PII) and blocks the prompt if any matches are found.
+
+---
+
+#### **Form Sections and Fields**
+
+1. **Name** *(Required)*:
+   - Specifies the name of the filter (e.g., `PII Detector`).
+
+2. **Description** *(Optional)*:
+   - A brief summary of the filter's purpose and functionality (e.g., "Simple Regex-based PII detector to prevent the wrong data being sent to LLMs").
+
+3. **Script** *(Required)*:
+   - A **Tengo script** that defines the logic of the filter. The script evaluates input data and determines whether the filter approves or blocks it.
+   - The example script detects PII using a collection of regex patterns and blocks the data if a match is found.
+
+---
+
+#### **New Unified Script API**
+
+Modern filters use a unified API that provides rich context and supports both blocking and modification:
+
+**Input Object:**
+```javascript
+input := {
+    raw_input: "...",      // Full JSON request payload
+    messages: [            // Normalized message array with roles
+        {role: "system", content: "You are helpful"},
+        {role: "user", content: "Hello"}
+    ],
+    vendor_name: "openai", // LLM vendor (openai, anthropic, google_ai, etc.)
+    model_name: "gpt-4",   // Model being called
+    is_chat: false,        // Context: chat session (true) or proxy (false)
+    context: {             // Additional metadata
+        llm_id: 123,
+        app_id: 456,
+        user_id: 789
+    }
+}
+```
+
+**Output Object:**
+```javascript
+output := {
+    block: false,           // Set true to block the request
+    payload: "",            // Modified JSON payload (or empty for no change)
+    messages: [],           // Alternative: modified message array
+    message: ""             // Optional reason/log message
+}
+```
+
+---
+
+#### **Example Script 1: Blocking Filter (PII Detection)**
+
+This script blocks requests containing PII patterns:
+
+```tengo
+text := import("text")
+
+// Check all user messages for email addresses
+should_block := false
+block_reason := ""
+
+for msg in input.messages {
+    if msg.role == "user" {
+        if text.contains(msg.content, "@") {
+            should_block = true
+            block_reason = "Email addresses not allowed"
+            break
+        }
+    }
+}
+
+output := {
+    block: should_block,
+    payload: input.raw_input,
+    message: block_reason
+}
+```
+
+---
+
+#### **Example Script 2: Modification Filter (Email Redaction)**
+
+This script redacts emails while allowing the request to proceed:
+
+```tengo
+tyk := import("tyk")
+
+// Use helper to redact email addresses across all messages
+modified_payload := tyk.redact_pattern(
+    input,
+    "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}",
+    "[EMAIL_REDACTED]"
+)
+
+output := {
+    block: false,
+    payload: modified_payload,
+    message: "Emails redacted"
+}
+```
+
+---
+
+#### **Example Script 3: Advanced Modification (Messages Array)**
+
+This script shows complex message modification using the messages array approach:
+
+```tengo
+text := import("text")
+
+// Modify messages based on role
+modified := []
+
+for msg in input.messages {
+    new_msg := {
+        role: msg.role,
+        content: msg.content
+    }
+
+    // Add safety prefix to system prompts
+    if msg.role == "system" {
+        new_msg.content = "[SAFETY MODE] " + msg.content
+    }
+
+    // Redact emails from user messages
+    if msg.role == "user" {
+        new_msg.content = text.replace(msg.content, "@", "[AT]", -1)
+    }
+
+    modified = append(modified, new_msg)
+}
+
+output := {
+    block: false,
+    messages: modified,  // System handles vendor-specific JSON reconstruction
+    message: "Content modified"
+}
+```
+
+---
+
+#### **Example Script 4: Combined Blocking + Modification**
+
+This script redacts emails but blocks if SSN is detected:
+
+```tengo
+text := import("text")
+tyk := import("tyk")
+
+// First check for SSN (hard block)
+ssn_pattern := "\\d{3}-\\d{2}-\\d{4}"
+has_ssn := false
+
+for msg in input.messages {
+    if text.re_match(ssn_pattern, msg.content) {
+        has_ssn = true
+        break
+    }
+}
+
+if has_ssn {
+    output := {
+        block: true,
+        payload: "",
+        message: "Blocked: SSN detected"
+    }
+} else {
+    // No SSN - redact emails and continue
+    modified_payload := tyk.redact_pattern(
+        input,
+        "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}",
+        "[EMAIL]"
+    )
+
+    output := {
+        block: false,
+        payload: modified_payload,
+        message: "Emails redacted"
+    }
+}
+```
+
+---
+
+#### **Available Helper Functions**
+
+The `midsommar` module provides helper functions for common message modification tasks:
+
+1. **`redact_pattern(input, pattern, replacement)`**:
+   - Redacts a regex pattern from all messages (system, user, assistant)
+   - Parameters:
+     - `input` - The input object provided to your script
+     - `pattern` - Regular expression pattern (string)
+     - `replacement` - Replacement string
+   - Returns: Modified payload as string
+   - Example: `tyk.redact_pattern(input, "\\d{3}-\\d{2}-\\d{4}", "[SSN]")`
+
+**Vendor-Agnostic**: Helper functions automatically handle differences between OpenAI, Anthropic, Google AI, and other vendor formats.
+
+---
+
+#### **Message Modification Approaches**
+
+**Approach 1: Helper Functions** (Simple, recommended for pattern-based redaction)
+```tengo
+tyk := import("tyk")
+modified := tyk.redact_pattern(input, "@\\S+", "[EMAIL]")
+output := {block: false, payload: modified, message: ""}
+```
+
+**Approach 2: Messages Array** (Flexible, recommended for complex logic)
+```tengo
+modified := []
+for msg in input.messages {
+    new_msg := {role: msg.role, content: msg.content}
+    if msg.role == "user" {
+        // Apply custom modification logic
+        new_msg.content = transform(msg.content)
+    }
+    modified = append(modified, new_msg)
+}
+output := {block: false, messages: modified, message: ""}
+```
+
+---
+
+#### **Accessing Message Context**
+
+Scripts can access rich contextual information:
+
+```tengo
+// Access vendor and model information
+if input.vendor_name == "anthropic" {
+    // Anthropic-specific logic
+}
+
+// Count messages by role
+user_count := 0
+for msg in input.messages {
+    if msg.role == "user" {
+        user_count = user_count + 1
+    }
+}
+
+// Check if this is a chat session or proxy request
+if input.is_chat {
+    // Chat-specific logic
+}
+
+// Access metadata
+app_id := input.context.app_id
+user_id := input.context.user_id
+```
+
+---
+
+#### **Action Buttons**
+1. **Update Filter / Create Filter**:
+   - Saves the filter configuration, making it active for future data processing.
+
+2. **Back to Filters**:
+   - Returns to the Filters List View without saving changes.
+
+---
+
+#### **Purpose and Benefits**
+
+1. **Data Governance**:
+   - Enforces strict control over what data can be sent to LLMs, ensuring compliance with privacy regulations.
+
+2. **Flexibility**:
+   - Filters can be tailored to specific organizational needs using custom scripts.
+
+3. **Security**:
+   - Prevents sensitive or unauthorized data from leaking to unapproved vendors or external systems.
+
+This **Filter Edit View** provides a robust and customizable interface for creating scripts to enforce data governance and security in the Tyk AI Studio.
+
+### Example Middleware for Tools
+
+Middleware filters in the Tyk AI Studio modify data coming from tools before passing it to the LLM. These filters are applied to sanitize, anonymize, or enhance the data to ensure it complies with organizational standards and privacy regulations. Below is an example of a middleware filter that sanitizes Personally Identifiable Information (PII), specifically email addresses, from the tool's output.
+
+---
+
+#### **Middleware Script: Email Redaction Example**
+
+```tengo
+// Import the 'text' module for regular expression operations
+text := import("text")
+
+// Define regular expression patterns for various PII
+email_pattern := `[\w\.-]+@[\w\.-]+\.\w+`
+
+// Define the function to sanitize PII in the input string
+filter := func(input) {
+    // Replace email addresses
+    input = text.re_replace(email_pattern, input, "[REDACTED EMAIL]")
+
+    return input
+}
+
+// Process the input payload
+result := filter(payload)
+```
+
+---
+
+#### **Explanation of the Script**
+
+1. **Module Import**:
+   - The `text` module is imported to enable regular expression operations (`text.re_replace`).
+
+2. **Regex Pattern**:
+   - A regex pattern is defined to detect email addresses:
+     - Example pattern: `[\w\.-]+@[\w\.-]+\.\w+`
+     - This pattern matches standard email formats.
+
+3. **Filter Function**:
+   - The `filter` function accepts an input string (e.g., tool output) and:
+     - Uses `text.re_replace` to identify email addresses.
+     - Replaces detected email addresses with `[REDACTED EMAIL]`.
+
+4. **Return Processed Output**:
+   - The sanitized output is returned, ensuring that sensitive information like email addresses is redacted before reaching the LLM.
+
+---
+
+#### **Use Case for Middleware**
+
+**Tool Example**:
+Imagine a tool, such as `Support Ticket Viewer`, which retrieves user tickets from a system. These tickets often contain email addresses. Middleware ensures that no sensitive email information is included in the output sent to the LLM.
+
+- **Input Payload Example**:
+   ```text
+   User email: john.doe@example.com has reported an issue with their account.
+   ```
+
+- **Sanitized Output**:
+   ```text
+   User email: [REDACTED EMAIL] has reported an issue with their account.
+   ```
+
+---
+
+#### **Benefits of Middleware**
+
+1. **Data Privacy**:
+   - Protects sensitive user information by ensuring it is sanitized before being sent to external systems.
+
+2. **Compliance**:
+   - Ensures organizational adherence to privacy laws like GDPR or HIPAA.
+
+3. **Enhanced Security**:
+   - Prevents accidental sharing of PII with external vendors or LLMs.
+
+---
+
+## Available Tengo Modules
+
+Filters have access to powerful standard library modules:
+
+### **text** - String Operations
+```tengo
+text := import("text")
+
+// Common functions:
+text.contains(str, substr)           // Check if substring exists
+text.replace(str, old, new, n)       // Replace occurrences
+text.to_upper(str)                   // Convert to uppercase
+text.to_lower(str)                   // Convert to lowercase
+text.split(str, sep)                 // Split string
+text.trim_space(str)                 // Remove whitespace
+text.re_match(pattern, str)          // Regex match
+text.re_replace(pattern, str, repl)  // Regex replace
+```
+
+### **json** - JSON Operations
+```tengo
+json := import("json")
+
+parsed := json.decode(json_string)   // Parse JSON
+encoded := json.encode(object)       // Encode to JSON
+```
+
+### **fmt** - Formatting and Printing
+```tengo
+fmt := import("fmt")
+
+fmt.println("Debug:", variable)      // Print for debugging
+formatted := fmt.sprintf("Value: %v", val)  // Format strings
+```
+
+### **tyk** - Extended Capabilities (Enterprise)
+```tengo
+tyk := import("tyk")
+
+// Redact regex patterns from all messages (vendor-agnostic)
+modified := tyk.redact_pattern(input, pattern, replacement)
+// Returns: Modified payload as string
+
+// Make HTTP requests from within filters
+result := tyk.makeHTTPRequest(method, url, headers, body)
+// Returns: {status: 200, response: "..."}
+
+// Call other LLMs for analysis/enrichment
+response := tyk.llm(llm_id, settings_object, prompt)
+// Parameters:
+//   - llm_id: ID of the managed LLM to use
+//   - settings_object: Map with model settings (model_name, temperature, max_tokens, etc.)
+//   - prompt: The prompt text to send
+// Returns: LLM response as string
+```
+
+**Example - Use LLM for PII Detection:**
+```tengo
+tyk := import("tyk")
+
+// Get user message
+user_msg := ""
+for msg in input.messages {
+    if msg.role == "user" {
+        user_msg = msg.content
+        break
+    }
+}
+
+// Use another LLM to detect PII
+// Define settings for the LLM call
+settings := {
+    model_name: "gpt-3.5-turbo",
+    temperature: 0.0,
+    max_tokens: 10,
+    system_prompt: "You are a PII detection assistant. Answer only 'yes' or 'no'."
+}
+
+pii_check_prompt := "Does this text contain PII?: " + user_msg
+pii_result := tyk.llm(1, settings, pii_check_prompt)
+
+output := {
+    block: pii_result == "yes",
+    payload: input.raw_input,
+    message: pii_result == "yes" ? "PII detected by LLM" : ""
+}
+```
+
+**Example - Call External Service:**
+```tengo
+tyk := import("tyk")
+json := import("json")
+
+// Get user message
+user_msg := ""
+for msg in input.messages {
+    if msg.role == "user" {
+        user_msg = msg.content
+    }
+}
+
+// Call external PII detection API
+headers := {
+    "Content-Type": "application/json",
+    "Authorization": "Bearer YOUR_TOKEN"
+}
+body := json.encode({text: user_msg})
+
+result := tyk.makeHTTPRequest("POST", "https://pii-api.example.com/detect", headers, body)
+
+// Parse response
+response := json.decode(result.response)
+has_pii := response.has_pii
+
+output := {
+    block: has_pii,
+    payload: input.raw_input,
+    message: has_pii ? "External PII service detected sensitive data" : ""
+}
+```
+
+---
+
+## Compliance Event Reporting
+
+Available from Tyk AI Studio v2.1.0 (Enterprise edition).
+
+Filter scripts can emit structured [Compliance Events](/ai-management/ai-studio/compliance-events) to record governance-relevant activity, such as PII redactions, content rewrites, or guardrail triggers, without affecting the block/allow decision. Events flow through the analytics pipeline into the Compliance dashboard, where they appear in the Filter Events tab with severity filters, drill-down, and CSV export.
+
+To emit events, set the optional `compliance_events` field on the script output:
+
+```tengo
+tyk := import("tyk")
+
+modified_payload := tyk.redact_pattern(
+    input,
+    "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}",
+    "[EMAIL_REDACTED]"
+)
+
+output := {
+    block: false,
+    payload: modified_payload,
+    message: "",
+    compliance_events: [
+        {
+            event_type: "pii_redacted",
+            severity: "info",
+            description: "Email addresses redacted from request",
+            metadata: { "redacted_types": ["email"] }
+        }
+    ]
+}
+```
+
+Each event accepts:
+
+| Field | Required | Description |
+|---|---|---|
+| `event_type` | Yes | Free-form type, for example `pii_redacted`, `content_rewritten`, `policy_violation`, `silent_failure`. Events without an `event_type` are skipped. |
+| `severity` | No | `info`, `warning`, or `critical`. Defaults to `info`. |
+| `description` | No | Human-readable description shown in the dashboard. |
+| `metadata` | No | Arbitrary key-value data. Use `matched_pattern` (string) and `redacted_types` (array) for consistency with the bundled scripts. |
+
+**Conditional Emission.** Most filters should only emit events when a condition actually fires. Build the list dynamically:
+
+```tengo
+events := []
+if redaction_count > 0 {
+    events = append(events, {
+        event_type: "pii_redacted",
+        severity: "info",
+        description: fmt.sprintf("%d PII values redacted", redaction_count),
+        metadata: { "redacted_types": redacted_types }
+    })
+}
+
+output := {
+    block: false,
+    payload: modified_payload,
+    message: "",
+    compliance_events: events
+}
+```
+
+Key behaviors:
+
+- Recording is asynchronous, so filter latency is unaffected.
+- Events never change the block/allow decision. Redact-and-allow with a `critical` event is a legitimate pattern.
+- Events work in every filter scope: proxy request/response, chat request/response, file reference, and tool response filters.
+- On Edge Gateways, events are batched and forwarded to the control plane on the analytics pulse.
+
+The platform enriches each event with the app, user, LLM, vendor, model, filter name, and filter scope at recording time. For the event schema, querying via API, dashboard surfaces, and suggested event-type conventions, see [Compliance Events](/ai-management/ai-studio/compliance-events).
+
+---
+
+## Tool Response Filters
+
+Filters can also be applied to tool responses (e.g., API calls, database queries). Tool responses are **plain strings**, not JSON-structured messages, so they require simpler handling.
+
+### **Example 1: Block Tool Responses Containing Errors**
+
+```tengo
+text := import("text")
+
+// Access tool response from messages array
+tool_output := ""
+if len(input.messages) > 0 {
+    tool_output = input.messages[0].content
+}
+
+// Block if response indicates an error
+should_block := text.contains(tool_output, "error") || text.contains(tool_output, "failed")
+
+output := {
+    block: should_block,
+    payload: input.raw_input,
+    message: should_block ? "Tool returned error response" : ""
+}
+```
+
+### **Example 2: Redact PII from Tool Responses**
+
+```tengo
+text := import("text")
+
+// Tool responses are plain strings - use direct string manipulation
+modified := input.raw_input
+
+// Get tool content
+if len(input.messages) > 0 {
+    content := input.messages[0].content
+
+    // Redact email addresses
+    modified = text.re_replace("[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}", content, "[EMAIL]")
+
+    // Redact phone numbers
+    modified = text.re_replace("\\(?\\d{3}\\)?[\\s.-]?\\d{3}[\\s.-]?\\d{4}", modified, "[PHONE]")
+}
+
+output := {
+    block: false,
+    payload: modified,
+    message: "PII redacted from tool response"
+}
+```
+
+### **Example 3: Filter Based on Tool Name**
+
+```tengo
+// Access tool metadata from context
+tool_name := ""
+if input.context && input.context.tool_name {
+    tool_name = input.context.tool_name
+}
+
+// Only allow specific tools to return data
+allowed_tools := ["weather_api", "stock_prices"]
+is_allowed := false
+
+for allowed in allowed_tools {
+    if tool_name == allowed {
+        is_allowed = true
+        break
+    }
+}
+
+output := {
+    block: !is_allowed,
+    payload: input.raw_input,
+    message: is_allowed ? "" : "Tool '" + tool_name + "' is not allowed"
+}
+```
+
+**Note**: The `tyk.redact_pattern()` helper is designed for LLM message structures (JSON format) and will not work with tool responses. For tool responses, use direct string manipulation with the `text` module as shown above.
+
+---
+
+---
+
+## Filter Execution Order in Chat Sessions
+
+When a user sends a message in a chat session, filters are executed at multiple points in the pipeline:
+
+### **1. User Message Filters** (Before RAG)
+**When**: After preprocessing, before RAG vector search
+**Purpose**: Redact PII from user messages before they're used for vector similarity search
+**Context**: `input.messages[0].role == "user"`
+
+```tengo
+text := import("text")
+
+// Redact before RAG search
+modified := text.replace(input.messages[0].content, "@", "[EMAIL]", -1)
+
+output := {
+    block: false,
+    payload: modified,
+    message: ""
+}
+```
+
+**Impact**: The filtered/modified message is used for:
+- ✅ RAG vector similarity search
+- ✅ Subsequent LLM processing
+- ✅ Chat history storage
+
+### **2. File Content Filters** (Before RAG)
+**When**: When files are attached to messages
+**Purpose**: Filter sensitive content from uploaded files before indexing
+**Context**: `input.context.file_ref` contains the file reference
+
+### **3. Tool Response Filters** (After Tool Execution)
+**When**: After a tool returns data, before sending to LLM
+**Purpose**: Filter sensitive data from external API responses
+**Context**: `input.messages[0].role == "tool"`, `input.context.tool_name` available
+
+---
+
+## Best Practices
+
+1. **Always define `output`** - Scripts must set the output variable
+2. **Use `tyk.redact_pattern` for LLM messages** - Handles vendor differences automatically
+3. **Use `text` module for tool responses** - Direct string manipulation
+4. **Use messages array for complex LLM modifications** - Gives you full control
+5. **Provide clear block messages** - Help users understand policy violations
+6. **Test across vendors** - OpenAI, Anthropic, and Google AI have different formats
+7. **Check message roles** - Different logic for system, user, assistant, and tool messages
+8. **Handle edge cases** - Empty arrays, missing fields, etc.
+9. **Consider RAG impact** - Filters run before RAG, so redactions affect vector search
+
+---
+
+## Migration from Legacy API
+
+**Old API** (still supported for backward compatibility):
+```tengo
+filter := func(payload) {
+    // Returns true/false for blocking only
+    return true
+}
+result := filter(payload)
+```
+
+**New Unified API** (recommended):
+```tengo
+// Rich input with messages, vendor info, context
+output := {
+    block: false,       // Blocking capability
+    payload: "",        // Modification capability
+    messages: [],       // Alternative modification approach
+    message: ""         // Optional message
+}
+```
+
+---
+
+## Response Filters
+
+**Response Filters** enable administrators to block LLM responses based on content analysis, providing governance controls on what LLMs can say to end users.
+
+### Key Characteristics
+
+1. **Block-Only**: Response filters can only block responses, not modify them
+2. **Works on LLM Responses**: Applied to LLM responses only (not tool responses)
+3. **Streaming Support**: Execute per-chunk during streaming with access to accumulated buffer
+4. **Script-Controlled**: Filter scripts decide when to evaluate based on buffer length
+
+### Configuration
+
+Enable response filtering by checking **"Is this a Response Filter?"** when creating or editing a filter in the admin UI.
+
+### Script API for Response Filters
+
+Response filters use the same `ScriptInput`/`ScriptOutput` structure as request filters, with additional response-specific fields:
+
+**Input Object (Non-Streaming):**
+```tengo
+input := {
+    raw_input: "The LLM's complete response text",
+    is_response: true,
+    is_chunk: false,
+    vendor_name: "openai",
+    model_name: "gpt-4",
+    is_chat: true,  // or false for proxy
+    context: {
+        llm_id: 123,
+        session_id: "abc-123",  // Only in chat context
+        user_id: 789,
+        chat_id: 456,
+        status_code: 200
+    }
+}
+```
+
+**Input Object (Streaming):**
+```tengo
+input := {
+    raw_input: "current chunk text",
+    is_response: true,
+    is_chunk: true,
+    chunk_index: 5,
+    current_buffer: "accumulated response text so far",
+    vendor_name: "openai",
+    model_name: "gpt-4",
+    is_chat: false,
+    context: {
+        llm_id: 123,
+        app_id: 456
+    }
+}
+```
+
+**Output Object:**
+```tengo
+output := {
+    block: false,   // Set true to block/interrupt response
+    message: ""     // Block reason (shown to user)
+}
+```
+
+**Note**: The `payload` and `messages` fields in output are **ignored** for response filters.
+
+### Example 1: Block Refund Promises (Works for Streaming and Non-Streaming)
+
+```tengo
+text := import("text")
+
+// Get response text - use buffer for streaming
+response_text := input.is_chunk ? input.current_buffer : input.raw_input
+
+// Default output
+output := {
+    block: false,
+    message: ""
+}
+
+// For streaming: only evaluate once we have enough context
+if !input.is_chunk || len(response_text) >= 100 {
+    // Check for forbidden patterns
+    forbidden := ["will refund", "issue a refund", "provide a refund", "get a refund"]
+    should_block := false
+
+    for pattern in forbidden {
+        if text.contains(text.to_lower(response_text), pattern) {
+            should_block = true
+            break
+        }
+    }
+
+    output = {
+        block: should_block,
+        message: should_block ? "Response blocked: Cannot promise refunds to customers" : ""
+    }
+}
+```
+
+### Example 2: Block Harmful Content (Streaming with Buffer Check)
+
+```tengo
+text := import("text")
+
+// Get response text (streaming-aware)
+response_text := input.is_chunk ? input.current_buffer : input.raw_input
+
+// Default output
+output := {
+    block: false,
+    message: ""
+}
+
+// For streaming: script controls when to evaluate based on buffer length
+// Wait until we have enough context before checking
+if !input.is_chunk || len(response_text) >= 150 {
+    // Check for harmful instruction patterns
+    harmful := [
+        "instructions for making",
+        "how to build a weapon",
+        "steps to create explosives"
+    ]
+
+    is_harmful := false
+    for pattern in harmful {
+        if text.contains(text.to_lower(response_text), pattern) {
+            is_harmful = true
+            break
+        }
+    }
+
+    output = {
+        block: is_harmful,
+        message: is_harmful ? "Response blocked: Potentially harmful content detected" : ""
+    }
+}
+```
+
+### Example 3: Combined with LLM Analysis
+
+Use another LLM to analyze the response for policy violations:
+
+```tengo
+tyk := import("tyk")
+text := import("text")
+
+// Get response text
+response_text := input.is_chunk ? input.current_buffer : input.raw_input
+
+// Default output
+output := {
+    block: false,
+    message: ""
+}
+
+// For streaming: only evaluate once buffer is large enough
+if !input.is_chunk || len(response_text) >= 200 {
+    // Use fast LLM to check for policy violations
+    settings := {
+        model_name: "gpt-3.5-turbo",
+        temperature: 0.0,
+        max_tokens: 5,
+        system_prompt: "You are a content policy checker. Answer only 'yes' or 'no'."
+    }
+
+    check_prompt := "Does this response promise a refund or commit to a specific action?: " + response_text
+    result := tyk.llm(1, settings, check_prompt)
+
+    should_block := text.contains(text.to_lower(result), "yes")
+
+    output = {
+        block: should_block,
+        message: should_block ? "Response blocked: LLM policy violation detected" : ""
+    }
+}
+```
+
+### Response Filter Execution
+
+**Proxy (REST)**:
+- Executes after response hooks (if any)
+- Full response available in `input.raw_input`
+- If blocked: Error returned to client instead of response
+
+**Proxy (Streaming)**:
+- Executes on every chunk
+- Access to both `raw_input` (current chunk) and `current_buffer` (accumulated text)
+- If blocked: Streaming stops, error sent to client
+
+**Chat (Non-Streaming)**:
+- Executes before adding to chat history
+- If blocked: Error published to queue instead of response
+
+**Chat (Streaming)**:
+- Executes on every chunk before publishing to queue
+- If blocked: Error published, streaming callback returns error to stop further chunks
+
+### Best Practices for Response Filters
+
+1. **Buffer Management** (Streaming): Script controls evaluation timing based on `len(current_buffer)`
+2. **Performance**: Keep filter logic lightweight (executes per-chunk in streaming)
+3. **Clear Messages**: Provide helpful block messages for users
+4. **Fail Open**: Filters fail open on script errors (response allowed through)
+5. **LLM-Only**: Response filters only work on LLM responses, not tool responses
+6. **Block-Only**: Cannot modify responses, only block them
+
+### When to Use Response Filters vs Request Filters
+
+**Use Request Filters When:**
+- Preventing sensitive data from reaching the LLM
+- Redacting PII before LLM processing
+- Enforcing input policies
+
+**Use Response Filters When:**
+- Preventing LLMs from making commitments (refunds, promises)
+- Blocking harmful or inappropriate LLM outputs
+- Enforcing corporate communication policies
+- Detecting policy violations in LLM responses
+
+---
+
+This unified filter system demonstrates how flexible and powerful Midsommar's scripting capabilities are, enabling administrators to enforce strict data governance policies while supporting advanced LLM and tool integration workflows with both blocking and modification capabilities.
diff --git a/ai-management/ai-studio/installation/linux.mdx b/ai-management/ai-studio/installation/linux.mdx
new file mode 100644
index 0000000000..03aeacef2f
--- /dev/null
+++ b/ai-management/ai-studio/installation/linux.mdx
@@ -0,0 +1,531 @@
+---
+title: "Install Tyk AI Studio on Linux"
+description: "Installation guide for the Tyk AI Studio on Linux"
+keywords: "AI Studio, AI Management, Installation, Linux, DEB, RPM"
+sidebarTitle: "Linux"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+<Note>
+This guide focuses on the Enterprise Edition of Tyk AI Studio. For the Community Edition, please refer to the [Tyk AI Studio GitHub repository](https://github.com/TykTechnologies/ai-studio/blob/main/docs/site/docs/deployment-packages.md).
+
+The Community Edition uses different packages (`tyk-ai-studio` and `tyk-microgateway`) and does not require a license key.
+</Note>
+
+This guide covers installing Tyk AI Studio and the Edge Gateway on Linux servers using DEB or RPM packages. This is suitable for bare-metal servers, virtual machines, and cloud instances. In this architecture, AI Studio acts as the **control plane** (hub) and the Edge Gateway acts as the **data plane** (spoke), receiving configuration via gRPC.
+
+## Prerequisites
+
+- **OS**: Ubuntu/Debian (DEB) or RHEL 7-9/CentOS 7-9/Amazon Linux 2/2023 (RPM)
+- **Architecture**: amd64 (x86_64), arm64 (aarch64), or s390x
+
+  <Note>
+  RPM packages are published for EL 7, 8, 9 and Amazon Linux 2/2023. If you are running a different RPM-based distribution (e.g. CentOS Stream 10, Fedora), you can edit the repo file to use the closest supported version:
+  ```bash
+  # Example: use el/9 packages on CentOS Stream 10
+  sudo sed -i 's/el\/10/el\/9/g' /etc/yum.repos.d/tyk_*.repo
+  sudo yum clean all
+  ```
+  </Note>
+
+- **PostgreSQL 14+** (for AI Studio production use; SQLite is the default for development)
+- **systemd** (for service management)
+- **cosign** (for plugin signature verification in the Marketplace, [install instructions](https://docs.sigstore.dev/cosign/system_config/installation/))
+- Root or sudo access
+- A Tyk AI License key (contact support@tyk.io or your account manager to obtain)
+
+## Generate Secrets
+
+Before configuring, generate the required secret keys:
+
+```bash
+# Secret key for encryption (used for secrets management and SSO)
+openssl rand -hex 16
+
+# Encryption key for edge gateway communication (must be exactly 32 hex chars)
+openssl rand -hex 16
+
+# gRPC auth token (for hub-spoke communication)
+openssl rand -hex 16
+```
+
+Save these values, you will need them for both the AI Studio and Edge Gateway configuration.
+
+## Part 1: Install AI Studio
+
+### Add Package Repository
+
+**Debian / Ubuntu (DEB):**
+
+```bash
+curl -s https://packagecloud.io/install/repositories/tyk/tyk-ee-unstable/script.deb.sh | sudo bash
+```
+
+**RHEL / CentOS / Amazon Linux (RPM):**
+
+```bash
+curl -s https://packagecloud.io/install/repositories/tyk/tyk-ee-unstable/script.rpm.sh | sudo bash
+```
+
+### Install the Package
+
+**DEB:**
+
+```bash
+sudo apt-get install tyk-ai-studio-ee
+```
+
+**RPM:**
+
+```bash
+sudo yum install tyk-ai-studio-ee
+```
+
+The package installs:
+
+| Path | Description |
+|------|-------------|
+| `/opt/tyk-ai-studio/tyk-ai-studio` | Application binary |
+| `/opt/tyk-ai-studio/tyk-ai-studio.conf.example` | Example configuration |
+| `/etc/default/tyk-ai-studio` | Environment configuration (systemd) |
+| `/lib/systemd/system/tyk-ai-studio.service` | Systemd service unit |
+
+The installer automatically creates a `tyk` user and group to run the service.
+
+### Configure AI Studio
+
+Edit the environment configuration file:
+
+```bash
+# Debian/Ubuntu
+sudo vi /etc/default/tyk-ai-studio
+
+# RHEL/CentOS (symlinked automatically by the installer)
+sudo vi /etc/sysconfig/tyk-ai-studio
+```
+
+At minimum, set these values:
+
+```env Expandable
+# Security — REQUIRED: replace with your generated secrets
+TYK_AI_SECRET_KEY=your-generated-secret-key
+MICROGATEWAY_ENCRYPTION_KEY=your-generated-encryption-key
+
+# Site URL — set to your server's hostname/IP
+SITE_URL=http://your-server:8080
+
+# Admin email
+ADMIN_EMAIL=admin@example.com
+
+# Database — SQLite is default, use PostgreSQL for production
+DATABASE_TYPE=postgres
+DATABASE_URL=postgresql://user:password@localhost:5432/tyk_ai_studio?sslmode=require
+
+# Enterprise Edition — REQUIRED for EE installs
+TYK_AI_LICENSE=your-license-key
+
+# Plugin Marketplace — set this to enable the marketplace.
+# Without it, the Marketplace page will be empty.
+AI_STUDIO_OCI_CACHE_DIR=/opt/tyk-ai-studio/cache/plugins
+
+# If NOT using HTTPS, enable dev mode to allow login over plain HTTP
+# Without this, session cookies will be rejected by the browser
+DEVMODE=true
+
+# Hub-Spoke: Control Plane Mode
+GATEWAY_MODE=control
+GRPC_PORT=50051
+GRPC_HOST=0.0.0.0
+GRPC_TLS_INSECURE=true
+GRPC_AUTH_TOKEN=your-generated-grpc-token
+
+# Proxy URL — point to the Edge Gateway so AI requests are routed through it
+PROXY_URL=http://your-edge-gateway-host:9091
+
+# Portal display URLs — set these to your Edge Gateway's address so that
+# the portal shows the correct endpoint URLs for tools and datasources
+TOOL_DISPLAY_URL=http://your-edge-gateway-host:9091
+DATASOURCE_DISPLAY_URL=http://your-edge-gateway-host:9091
+```
+
+<Note>
+**Note:** `DEVMODE=true` disables secure cookie flags so that login works over HTTP. For production deployments with HTTPS, remove this setting.
+</Note>
+
+### Start AI Studio
+
+```bash
+sudo systemctl enable --now tyk-ai-studio
+```
+
+### Verify
+
+```bash
+sudo systemctl status tyk-ai-studio
+curl -s http://localhost:8080/health
+```
+
+View logs:
+
+```bash
+sudo journalctl -u tyk-ai-studio -f
+```
+
+## Part 2: Install Edge Gateway
+
+The Edge Gateway is the data plane component for hub-spoke deployments. It connects to AI Studio via gRPC to receive configuration and processes AI requests locally.
+
+Skip this section if you're using AI Studio in standalone mode with its embedded gateway.
+
+### Add Package Repository
+
+If you haven't already added the Enterprise repository in Part 1, add it now:
+
+**Debian / Ubuntu (DEB):**
+
+```bash
+curl -s https://packagecloud.io/install/repositories/tyk/tyk-ee-unstable/script.deb.sh | sudo bash
+```
+
+**RHEL / CentOS / Amazon Linux (RPM):**
+
+```bash
+curl -s https://packagecloud.io/install/repositories/tyk/tyk-ee-unstable/script.rpm.sh | sudo bash
+```
+
+### Install the Package
+
+**DEB:**
+
+```bash
+sudo apt-get install tyk-microgateway-ee
+```
+
+**RPM:**
+
+```bash
+sudo yum install tyk-microgateway-ee
+```
+
+The package installs:
+
+| Path | Description |
+|------|-------------|
+| `/opt/tyk-microgateway/tyk-microgateway` | Server binary |
+| `/opt/tyk-microgateway/mgw` | CLI tool |
+| `/opt/tyk-microgateway/data/` | Data directory (SQLite database) |
+| `/opt/tyk-microgateway/examples/analytics-pulse-config.yaml` | Analytics pulse example config |
+| `/etc/default/tyk-microgateway` | Environment configuration (systemd) |
+| `/lib/systemd/system/tyk-microgateway.service` | Systemd service unit |
+
+### Configure Edge Gateway
+
+<Note>
+**Important:** If you are installing the Edge Gateway on the **same machine** as AI Studio, you **must** change the `PORT` to something other than `8080` (e.g. `9091`) to avoid a port conflict. AI Studio already listens on port 8080.
+</Note>
+
+Edit the environment configuration file:
+
+```bash
+# Debian/Ubuntu
+sudo vi /etc/default/tyk-microgateway
+
+# RHEL/CentOS (symlinked automatically by the installer)
+sudo vi /etc/sysconfig/tyk-microgateway
+```
+
+At minimum, set these values:
+
+```env Expandable
+# Server port — change if running on the same host as AI Studio
+PORT=9091
+
+# Hub-Spoke: Edge Mode
+GATEWAY_MODE=edge
+CONTROL_ENDPOINT=your-studio-host:50051
+EDGE_ID=edge-1
+EDGE_NAMESPACE=default
+
+# Security — MUST MATCH AI Studio values
+EDGE_AUTH_TOKEN=must-match-studio-GRPC_AUTH_TOKEN
+ENCRYPTION_KEY=must-match-studio-MICROGATEWAY_ENCRYPTION_KEY
+
+# TLS — disable for initial setup, enable for production
+EDGE_ALLOW_INSECURE=true
+EDGE_TLS_ENABLED=false
+
+# Enterprise Edition — REQUIRED for EE installs
+TYK_AI_LICENSE=your-license-key
+```
+
+### Configure Analytics Pulse
+
+To send analytics data from the Edge Gateway back to the AI Studio control plane, configure the analytics pulse plugin.
+
+Copy the example config:
+
+```bash
+sudo cp /opt/tyk-microgateway/examples/analytics-pulse-config.yaml /opt/tyk-microgateway/analytics-pulse-config.yaml
+sudo chown tyk:tyk /opt/tyk-microgateway/analytics-pulse-config.yaml
+```
+
+The default configuration is:
+
+```yaml Expandable
+version: "1.0"
+
+data_collection_plugins:
+  - name: "analytics_pulse"
+    enabled: true
+    hook_types: ["analytics", "budget", "proxy_log"]
+    replace_database: false
+    priority: 100
+    config:
+      interval_seconds: 10
+      max_batch_size: 1000
+      max_buffer_size: 10000
+      compression_enabled: true
+      include_proxy_summaries: true
+      include_request_response_data: true
+      edge_retention_hours: 24
+      excluded_vendors: ["mock", "test"]
+      timeout_seconds: 30
+      max_retries: 3
+      retry_interval_secs: 5
+```
+
+Then enable it in `/etc/default/tyk-microgateway`:
+
+```env
+PLUGINS_CONFIG_PATH=/opt/tyk-microgateway/analytics-pulse-config.yaml
+```
+
+### Start Edge Gateway
+
+```bash
+sudo systemctl enable --now tyk-microgateway
+```
+
+### Verify
+
+```bash
+sudo systemctl status tyk-microgateway
+curl -s http://localhost:9091/health
+```
+
+View logs:
+
+```bash
+sudo journalctl -u tyk-microgateway -f
+```
+
+Check the AI Studio logs for a successful edge gateway connection:
+
+```bash
+sudo journalctl -u tyk-ai-studio | grep -i "edge\|grpc"
+```
+## Database Setup
+
+### PostgreSQL for AI Studio
+
+AI Studio defaults to SQLite, which is fine for development. For production, use PostgreSQL:
+
+```bash
+# Install PostgreSQL (Ubuntu/Debian)
+sudo apt-get install postgresql
+
+# Create database and user
+sudo -u postgres psql -c "CREATE USER tyk WITH PASSWORD 'your-db-password';"
+sudo -u postgres psql -c "CREATE DATABASE tyk_ai_studio OWNER tyk;"
+```
+
+Then set in `/etc/default/tyk-ai-studio`:
+
+```env
+DATABASE_TYPE=postgres
+DATABASE_URL=postgresql://tyk:your-db-password@localhost:5432/tyk_ai_studio?sslmode=require
+```
+
+### SQLite for Edge Gateway
+
+The Edge Gateway uses SQLite by default, stored at `/opt/tyk-microgateway/data/microgateway.db`. No additional setup is required.
+
+
+## First User Registration
+
+After starting the service, you need to create your first admin user:
+
+1. **Access the application**: Open your browser and navigate to `http://your-server:8080`
+2. **Register with admin email**: Use the EXACT email address you set in the `ADMIN_EMAIL` environment variable
+3. **Complete registration**: The first user who registers with the admin email will automatically become the administrator
+
+<Note>
+**Important**: The first user registration must use the same email address specified in the `ADMIN_EMAIL` environment variable. This user will have full administrative privileges.
+</Note>
+
+## Shared Secrets Reference
+
+When running AI Studio with an Edge Gateway, these values **must match**:
+
+| AI Studio Variable | Edge Gateway Variable | Purpose |
+|---|---|---|
+| `GRPC_AUTH_TOKEN` | `EDGE_AUTH_TOKEN` | Authenticates the gRPC connection |
+| `MICROGATEWAY_ENCRYPTION_KEY` | `ENCRYPTION_KEY` | Encrypts synced configuration data |
+| `TYK_AI_LICENSE` | `TYK_AI_LICENSE` | Enterprise license |
+
+## Firewall Configuration
+
+Open the following ports based on your deployment:
+
+| Port | Component | Required |
+|------|-----------|----------|
+| 8080 | AI Studio (API + UI) | Always |
+| 9090 | AI Studio (embedded gateway) | Standalone mode |
+| 50051 | AI Studio (gRPC control server) | Hub-spoke mode |
+| 9091 | Edge Gateway (proxy API) | Hub-spoke mode (on edge gateway host) |
+
+Example using `ufw`:
+
+```bash
+# AI Studio host
+sudo ufw allow 8080/tcp
+sudo ufw allow 9090/tcp
+sudo ufw allow 50051/tcp   # Only if using hub-spoke mode
+
+# Edge Gateway host (if separate machine)
+sudo ufw allow 9091/tcp
+```
+
+Example using `firewalld`:
+
+```bash
+# AI Studio host
+sudo firewall-cmd --permanent --add-port=8080/tcp
+sudo firewall-cmd --permanent --add-port=9090/tcp
+sudo firewall-cmd --permanent --add-port=50051/tcp
+sudo firewall-cmd --reload
+```
+
+## TLS Configuration (Production)
+
+For production deployments, enable TLS on the gRPC connection between AI Studio and the Edge Gateway.
+
+**AI Studio** (`/etc/default/tyk-ai-studio`):
+
+```env
+GRPC_TLS_INSECURE=false
+GRPC_TLS_CERT_PATH=/etc/tyk-ai-studio/tls/server-cert.pem
+GRPC_TLS_KEY_PATH=/etc/tyk-ai-studio/tls/server-key.pem
+```
+
+**Edge Gateway** (`/etc/default/tyk-microgateway`):
+
+```env
+EDGE_TLS_ENABLED=true
+EDGE_ALLOW_INSECURE=false
+# If using a private CA:
+# EDGE_TLS_CA_PATH=/etc/tyk-microgateway/tls/ca-cert.pem
+```
+
+## Upgrading
+
+**DEB:**
+
+```bash
+sudo apt-get update
+
+sudo apt-get upgrade tyk-ai-studio-ee
+sudo apt-get upgrade tyk-microgateway-ee  # if installed
+```
+
+**RPM:**
+
+```bash
+sudo yum update tyk-ai-studio-ee
+sudo yum update tyk-microgateway-ee  # if installed
+```
+
+<Note>
+**Note:** Package upgrades will **not** overwrite your configuration in `/etc/default/`. The services are automatically restarted after upgrade.
+</Note>
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="Service fails to start">
+
+```bash
+sudo journalctl -u tyk-ai-studio --no-pager -n 50
+````
+
+**Common causes:**
+
+* Missing or invalid `TYK_AI_SECRET_KEY`
+* Database connection failure (check `DATABASE_URL`)
+* Port already in use
+
+</Accordion>
+
+<Accordion title="Permission errors">
+
+The services run as the `tyk` user. Ensure data directories are owned correctly:
+
+```bash
+sudo chown -R tyk:tyk /opt/tyk-ai-studio/
+sudo chown -R tyk:tyk /opt/tyk-microgateway/
+```
+
+</Accordion>
+
+<Accordion title="SELinux issues (RHEL/CentOS)">
+
+If SELinux is enforcing and blocking the service:
+
+```bash
+sudo setsebool -P httpd_can_network_connect 1
+
+# Or check audit log for specific denials:
+sudo ausearch -m avc -ts recent
+```
+
+</Accordion>
+
+<Accordion title="Marketplace page is empty">
+
+The Plugin Marketplace requires `AI_STUDIO_OCI_CACHE_DIR` to be set. Without it, the marketplace service does not start and no plugins will appear.
+
+Add this to `/etc/default/tyk-ai-studio`:
+
+```env
+AI_STUDIO_OCI_CACHE_DIR=/opt/tyk-ai-studio/cache/plugins
+```
+
+Restart the service after making this change:
+
+```bash
+sudo systemctl restart tyk-ai-studio
+```
+
+</Accordion>
+
+<Accordion title="Edge Gateway cannot connect to AI Studio">
+
+* Verify `CONTROL_ENDPOINT` points to the correct AI Studio host and gRPC port
+* Verify `EDGE_AUTH_TOKEN` matches `GRPC_AUTH_TOKEN` exactly
+* Verify `ENCRYPTION_KEY` matches `MICROGATEWAY_ENCRYPTION_KEY` exactly
+* Check firewall rules allow traffic on the gRPC port (default `50051`)
+* Check AI Studio logs:
+
+```bash
+sudo journalctl -u tyk-ai-studio | grep grpc
+```
+
+</Accordion>
+
+</AccordionGroup>
diff --git a/ai-management/ai-studio/installation/nats.mdx b/ai-management/ai-studio/installation/nats.mdx
new file mode 100644
index 0000000000..80d6aebe4b
--- /dev/null
+++ b/ai-management/ai-studio/installation/nats.mdx
@@ -0,0 +1,370 @@
+---
+title: "NATS JetStream Configuration for Tyk AI Studio"
+description: "How to configure NATS JetStream as the message queue backend for Tyk AI Studio?"
+keywords: "AI Studio, AI Management, Installation, Setup"
+sidebarTitle: "NATS JetStream"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+This guide covers configuring Tyk AI Studio to use NATS JetStream as the message queue backend for distributed deployments and high availability scenarios.
+
+## Overview
+
+Tyk AI Studio supports two queue implementations:
+- **In-Memory Queue** (default): For single-instance deployments
+- **NATS JetStream Queue**: For distributed, persistent message handling
+
+NATS JetStream provides:
+- **Persistent Message Storage**: Messages survive server restarts
+- **Distributed Architecture**: Scale across multiple instances
+- **Automatic Reconnection**: Handle network disruptions gracefully
+- **Message Deduplication**: Ensure exactly-once delivery
+- **Authentication & Security**: Multiple authentication methods including JWT and TLS
+
+## Configuration Options
+
+Tyk AI Studio can be configured to use NATS JetStream by setting the appropriate environment variables.
+
+### Basic Configuration
+
+#### Enable NATS Queue
+
+Set the queue type to NATS in your environment configuration:
+
+```bash
+QUEUE_TYPE=nats
+NATS_URL=nats://your-nats-server:4222
+```
+
+#### NATS Server Configuration
+
+```bash
+# NATS Connection
+NATS_URL=nats://localhost:4222              # NATS server URL
+
+# JetStream Settings  
+NATS_STORAGE_TYPE=file                      # Use persistent storage (file|memory)
+NATS_RETENTION_POLICY=interest              # Delete messages when consumed (interest|limits|workqueue)
+NATS_MAX_AGE=2h                             # Maximum message age
+NATS_MAX_BYTES=104857600                    # Max stream size (100MB)
+NATS_DURABLE_CONSUMER=true                  # Use durable consumers for restart recovery
+
+# Performance Tuning
+NATS_ACK_WAIT=30s                           # Acknowledgment timeout
+NATS_MAX_DELIVER=3                          # Maximum delivery attempts
+NATS_FETCH_TIMEOUT=5s                       # Message fetch timeout
+NATS_RETRY_INTERVAL=1s                      # Retry interval for failed operations
+NATS_MAX_RETRIES=3                          # Maximum retry attempts
+```
+
+
+### Advanced Configuration
+
+#### Custom Stream Configuration
+
+For advanced use cases, configure streams directly in NATS:
+
+```bash
+# Create custom stream for chat messages
+nats stream add CHAT_CUSTOM \
+  --subjects "chat.sessions.*.chat_response" \
+  --storage file \
+  --retention interest \
+  --max-age 4h \
+  --max-bytes 500MB
+```
+
+#### High Availability Setup
+
+For production HA deployments:
+
+```bash
+# Connect to NATS cluster
+NATS_URL=nats://nats-1:4222,nats-2:4222,nats-3:4222
+
+# Enable clustering support
+NATS_DURABLE_CONSUMER=true
+NATS_MAX_DELIVER=5
+```
+
+This configuration ensures message delivery even if individual NATS servers fail.
+
+## Authentication Methods
+
+### 1. No Authentication (Development Only)
+
+```bash
+NATS_URL=nats://localhost:4222
+```
+
+**Use Case**: Local development, testing environments
+**Security**: None - suitable only for development
+
+### 2. Username/Password Authentication
+
+```bash
+NATS_URL=nats://localhost:4222
+NATS_USERNAME=chat_service
+NATS_PASSWORD=secure_password_123
+```
+
+**Use Case**: Simple deployments with basic security
+**Security**: Basic authentication with shared credentials
+
+### 3. Token-Based Authentication
+
+```bash
+NATS_URL=nats://localhost:4222
+NATS_TOKEN=your-secret-token-here
+```
+
+**Use Case**: Simple token-based access control
+**Security**: Shared secret token authentication
+
+### 4. JWT/User Credentials Authentication (Recommended)
+
+```bash
+NATS_URL=nats://localhost:4222
+NATS_CREDENTIALS_FILE=/etc/nats/user.creds
+```
+
+**Use Case**: Production deployments requiring fine-grained access control
+**Security**: JWT-based authentication with user credentials
+**Benefits**:
+- Decentralized authentication
+- Subject-level permissions
+- Automatic token renewal
+- Audit trails
+
+#### Creating User Credentials
+
+1. Generate user credentials with NATS CLI:
+```bash
+# Create account
+nsc add account TykAIStudio
+
+# Create user for chat service
+nsc add user chat_service --account TykAIStudio
+
+# Generate credentials file
+nsc generate creds --account TykAIStudio --name chat_service > /etc/nats/user.creds
+```
+
+2. Configure permissions in account settings:
+```bash
+nsc edit user chat_service --allow-pub "chat.>" --allow-sub "chat.>"
+```
+
+### 5. NKey Authentication
+
+```bash
+NATS_URL=nats://localhost:4222
+NATS_NKEY_FILE=/etc/nats/user.nkey
+```
+
+**Use Case**: Cryptographic authentication without JWT overhead
+**Security**: Ed25519 key-based authentication
+
+#### Creating NKey
+
+```bash
+# Generate NKey
+nsc add user chat_service_nkey --account TykAIStudio --allow-pub "chat.>" --allow-sub "chat.>"
+nk -gen user > /etc/nats/user.nkey
+```
+
+### 6. TLS Configuration
+
+#### Basic TLS (Server Authentication)
+
+```bash
+NATS_URL=nats://your-secure-nats:4222
+NATS_TLS_ENABLED=true
+```
+
+#### Mutual TLS (Client + Server Authentication)
+
+```bash
+NATS_URL=nats://your-secure-nats:4222
+NATS_TLS_ENABLED=true
+NATS_TLS_CERT_FILE=/etc/ssl/certs/client-cert.pem
+NATS_TLS_KEY_FILE=/etc/ssl/private/client-key.pem
+NATS_TLS_CA_FILE=/etc/ssl/certs/ca-cert.pem
+```
+
+#### TLS Development Mode (Skip Verification)
+
+```bash
+NATS_URL=nats://localhost:4222
+NATS_TLS_ENABLED=true
+NATS_TLS_SKIP_VERIFY=true  # Only for development!
+```
+
+### 7. Combined Authentication (Production Recommended)
+
+```bash
+# TLS + JWT Authentication
+NATS_URL=nats://secure-nats.production:4222
+NATS_TLS_ENABLED=true
+NATS_CREDENTIALS_FILE=/etc/nats/production-user.creds
+NATS_TLS_CA_FILE=/etc/ssl/certs/nats-ca.pem
+
+# Additional security settings
+NATS_TLS_SKIP_VERIFY=false
+NATS_MAX_DELIVER=3
+NATS_ACK_WAIT=30s
+```
+
+## Docker/Kubernetes Configuration
+
+### Docker Compose
+
+```yaml
+version: '3.8'
+services:
+  nats:
+    image: nats:latest
+    command: 
+      - "--jetstream"
+      - "--store_dir=/data"
+    ports:
+      - "4222:4222"
+    volumes:
+      - nats_data:/data
+      
+  midsommar:
+    image: tyk/midsommar:latest
+    environment:
+      QUEUE_TYPE: "nats"
+      NATS_URL: "nats://nats:4222"
+      NATS_STORAGE_TYPE: "file"
+      NATS_RETENTION_POLICY: "interest"
+    depends_on:
+      - nats
+      
+volumes:
+  nats_data:
+```
+
+### Kubernetes ConfigMap
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nats-config
+data:
+  QUEUE_TYPE: "nats"
+  NATS_URL: "nats://nats-cluster:4222"
+  NATS_STORAGE_TYPE: "file"
+  NATS_RETENTION_POLICY: "interest"
+  NATS_MAX_AGE: "2h"
+  NATS_DURABLE_CONSUMER: "true"
+```
+
+### Kubernetes Secrets (for Authentication)
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nats-auth
+type: Opaque
+data:
+  credentials: <base64-encoded-creds-file>
+  username: <base64-encoded-username>
+  password: <base64-encoded-password>
+```
+
+## Migration from In-Memory
+
+To migrate from in-memory to NATS queue:
+
+1. **Deploy NATS Server**: Set up NATS with JetStream enabled
+2. **Configure Authentication**: Set up appropriate auth method
+3. **Update Configuration**: Change `QUEUE_TYPE=nats`
+4. **Restart Application**: Deploy updated configuration
+5. **Verify Operation**: Check logs for successful NATS connection
+
+The migration is seamless as the queue interface abstracts the implementation details.
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="Connection Status">
+
+Monitor NATS connection status in application logs:
+
+```bash
+kubectl logs -f deployment/midsommar | grep NATS
+```
+
+Expected log messages:
+
+```
+INFO NATS authentication configured with credentials file file=/etc/nats/user.creds
+INFO NATS reconnected session_id=abc123 url=nats://nats:4222
+```
+
+</Accordion>
+
+<Accordion title="Common Issues">
+
+1. **Connection Failures**
+
+```bash
+ERROR failed to connect to NATS: nats: no servers available for connection
+```
+
+**Solution**: Check NATS server is running and URL is correct
+
+2. **Authentication Failures**
+
+```bash
+ERROR failed to connect to NATS: nats: Authorization Violation
+```
+
+**Solution**: Verify credentials file exists and has correct permissions
+
+3. **TLS Certificate Issues**
+
+```bash
+ERROR failed to configure NATS authentication: failed to load TLS client certificate
+```
+
+**Solution**: Check certificate files exist and have correct permissions
+
+4. **Permission Errors**
+
+```bash
+ERROR failed to create stream: insufficient permissions
+```
+
+**Solution**: Ensure user has pub/sub permissions for `chat.>` subjects
+
+</Accordion>
+
+<Accordion title="Performance Tuning">
+
+For high-throughput deployments:
+
+```bash
+# Increase buffer sizes
+QUEUE_BUFFER_SIZE=1000
+
+# Optimize NATS settings
+NATS_MAX_BYTES=1048576000          # 1GB max stream size
+NATS_MAX_AGE=24h                   # Longer retention
+NATS_FETCH_TIMEOUT=10s             # Longer fetch timeout
+NATS_ACK_WAIT=60s                  # Longer ack timeout
+```
+
+</Accordion>
+
+</AccordionGroup>
\ No newline at end of file
diff --git a/ai-management/ai-studio/installation/overview.mdx b/ai-management/ai-studio/installation/overview.mdx
new file mode 100644
index 0000000000..a78b6113f0
--- /dev/null
+++ b/ai-management/ai-studio/installation/overview.mdx
@@ -0,0 +1,141 @@
+---
+title: "Installation Options for Tyk AI Studio"
+description: "Explore the different installation options for Tyk AI Studio, including Docker, Kubernetes, and Linux."
+keywords: "AI Studio, AI Management, Installation, Setup"
+sidebarTitle: "Overview"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+## Deployment Models
+
+Tyk AI Studio supports two deployment modes:
+
+### Standalone
+
+Standalone mode operates as a single AI Studio instance with embedded gateway functionality. It is suitable for development, testing, and small teams.
+
+```mermaid
+graph LR
+    Users[Users] --> Studio[AI Studio<br/>Standalone]
+    Studio --> DB[(SQLite)]
+    Studio --> Providers[AI Providers]
+    
+    style Studio fill:#4A90E2
+```
+
+**Characteristics**:
+- Single instance deployment
+- Built-in gateway functionality
+- SQLite database (or PostgreSQL)
+- No external dependencies
+
+### Hub and Spoke (Control + Edge)
+
+Control Plane with Edge Gateways uses AI Studio as the central control plane managing edge gateways for distributed request processing. This approach uses lightweight Edge Gateways instances that connect to the control plane.
+
+It is suitable for production, enterprise, and multi-region deployments.
+
+```mermaid
+graph TB
+    subgraph "Control Plane"
+        Control[AI Studio<br/>Control Mode]
+        ControlDB[(PostgreSQL)]
+        Control --> ControlDB
+    end
+    
+    subgraph "Edge Gateways"
+        Edge1[Edge Gateway 1]
+        Edge2[Edge Gateway 2]
+        EdgeN[Edge Gateway N]
+    end
+    
+    Control -.->|Config Sync| Edge1
+    Control -.->|Config Sync| Edge2
+    Control -.->|Config Sync| EdgeN
+    
+    Users1[Users Region 1] --> Edge1
+    Users2[Users Region 2] --> Edge2
+    UsersN[Users Region N] --> EdgeN
+    
+    Edge1 --> Providers[AI Providers]
+    Edge2 --> Providers
+    EdgeN --> Providers
+    
+    style Control fill:#4A90E2
+    style Edge1 fill:#7ED321
+    style Edge2 fill:#7ED321
+    style EdgeN fill:#7ED321
+```
+
+**Characteristics**:
+- Centralized configuration management
+- Distributed request processing
+- Regional edge deployments
+- High availability and fault tolerance
+- Namespace-based multi-tenancy
+
+## Choosing Your Deployment
+
+| Scenario | Recommended Mode | Why |
+|----------|-----------------|-----|
+| Local development | Standalone | Simple, fast setup |
+| Single office/location | Standalone | No distribution needed |
+| Multiple regions | Hub-and-Spoke | Low latency for users |
+| High availability | Hub-and-Spoke | Fault tolerance |
+| Multi-tenant SaaS | Hub-and-Spoke | Namespace isolation |
+| Compliance (data locality) | Hub-and-Spoke | Regional data processing |
+
+## Requirements
+
+**Tyk AI Studio** and **Edge Gateway** requires a persistent datastore for its operations. By default, SQLite is used, while PostgreSQL is recommended for production deployments.
+
+
+### Required Components
+
+| Component | AI Studio (Hub) | Edge Gateway (Edge) |
+|-----------|----------------|---------------------|
+| **SQLite** | ✅ **Supported** (default) | ✅ **Supported** (default) |
+| **PostgreSQL** | ✅ **Supported** | ✅ **Supported** |
+
+
+### Optional Components
+
+**Tyk AI Studio** uses a message queue for chat interface. By default, an in-memory queue is used, which is suitable for development and single-instance deployments. 
+
+For production and multi-instance deployments, you can configure AI Studio to use [NATS JetStream](/ai-management/ai-studio/installation/nats) as the message queue backend.
+
+## Recommended Installation: Docker
+
+For development, testing, and proof of concept purposes, we recommend using our Docker installation, which allows you to quickly spin up AI Studio on your local machine.
+
+<ResponsiveGrid>
+
+<Card href="/ai-management/ai-studio/quickstart" img="/img/docker.png">
+
+Install with Docker
+</Card>
+
+</ResponsiveGrid>
+
+## Alternative Installation Methods
+
+<ResponsiveGrid>
+
+<Card href="/ai-management/ai-studio/deployment-k8s" img="/img/k8s.png">
+
+Install on Kubernetes
+</Card>
+
+<Card href="/ai-management/ai-studio/installation/linux" img="/img/linux-icon.svg">
+
+Install on Linux
+</Card>
+
+</ResponsiveGrid>
diff --git a/ai-management/ai-studio/llm-management.mdx b/ai-management/ai-studio/llm-management.mdx
new file mode 100644
index 0000000000..2f8c3b4751
--- /dev/null
+++ b/ai-management/ai-studio/llm-management.mdx
@@ -0,0 +1,73 @@
+---
+title: "LLM Management"
+description: "How to manage Large Language Models (LLMs) in Tyk AI Studio, including configuration, pricing, and budgeting."
+keywords: "AI Studio, AI Management, LLM Management"
+sidebarTitle: "LLMs"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio provides a centralized system for managing Large Language Model (LLM) providers, models, associated costs, and usage budgets. This allows administrators to control which models are available, how they are used, and track associated expenses.
+
+### Use cases
+
+- **Centralized AI Access Control:** Manage all your organization's LLM connections (OpenAI, Anthropic, etc.) in one place, controlling which teams and applications can access specific models.
+- **Cost Management and Budgeting:** Set monthly spending limits globally per LLM or per application to prevent unexpected AI costs and track usage against budgets.
+- **Data Privacy Enforcement:** Assign privacy levels to LLMs to ensure sensitive data is only processed by approved, secure models, preventing data leaks to public LLMs.
+
+## LLM Provider
+
+The LLM Management system acts as the core registry for all AI models accessible through Tyk AI Studio. It bridges the gap between external AI providers and internal consumers (Applications and Chat).
+
+Key components of an LLM entity include:
+- **Basic Info:** Name, descriptions, vendor, and active status.
+- **Connection:** API credentials, endpoints, and the default model to use.
+- **Access & Security:** Privacy scores, allowed model regex patterns, and namespace restrictions.
+- **Budgeting:** Monthly spending limits and budget cycle start dates.
+- **Extensibility:** Support for attaching plugins that execute in the AI Gateway during the request lifecycle.
+
+The LLM entity is closely related to [Model Prices](/ai-management/ai-studio/model-prices) (which define the cost of using the LLM) and [Model Routers](/ai-management/ai-studio/model-router) (which can route requests across multiple LLMs).
+
+## Configuration
+
+Administrators can configure connections to different LLM providers through the UI or API. The configuration includes:
+
+- **Vendor Selection:** Choose from supported vendors such as `openai`, `anthropic`, `bedrock` (AWS Bedrock, available from v2.1.0), `vertex` (Google Vertex AI), `google_ai`, `huggingface`, `ollama`.
+- **Authentication:** Securely provide API keys or credentials.
+- **Model Restrictions:** Use regex patterns (e.g., `gpt-4.*`) to whitelist specific models from a vendor.
+- **Privacy Levels:** Define how data is protected by controlling LLM access based on its sensitivity (0 lowest - 100 highest).
+- **Budget Control:** Set a `MonthlyBudget` to limit total spending across all applications using this LLM configuration.
+- **Body Logging Control:** From v2.1.0, enable **Disable Request/Response Body Logging** (`dont_log_bodies`) to clear request and response bodies before they are stored in proxy logs, chat logs, and analytics events. Use this for privacy or compliance-sensitive providers. It applies on both the embedded gateway and Edge Gateways, and defaults to off.
+- **Plugins:** Attach plugins that execute in the AI Gateway when a request flows through the REST endpoint.
+
+## How to Create a LLM Provider
+
+You can create and manage LLM providers through the Tyk AI Studio Admin UI.
+
+1. **Navigate:** Go to the LLM providers section in the Admin UI. This view lists all configured LLMs, showing their Name, Short Description, Vendor, Privacy Level, and whether they are Proxied.
+2. **Add New LLM:** Click "Add LLM provider".
+3. **Fill in the LLM Details:**
+   - **Name:** A user-friendly name for this configuration (Required).
+   - **Short/Long Description:** Provide descriptions for the LLM.
+   - **Vendor:** Select the LLM vendor (e.g., OpenAI, Anthropic).
+   - **Default Model:** Specify the default model to use for this LLM (e.g., `gpt-4`, `claude-2`).
+   - **Monthly Budget:** Set a monthly budget limit (leave empty for no limit) and a Budget Start Date.
+   - **Privacy levels:** Set a privacy level (0 lowest - 100 highest). LLMs with lower privacy levels can't access higher-level data sources and tools.
+   - **Allowed Models:** Add regex patterns to whitelist specific models (e.g., `gpt-4.*` for all GPT-4 models).
+   - In the **Access Details** section,
+      - **API Endpoint:** Provide the endpoint URL (required if enabling an LLM for the AI Gateway, even for providers with default URLs).
+      - **API Key:** Securely provide the necessary authentication credentials.
+      - For **AWS Bedrock** (from v2.1.0), the form instead shows labelled credential fields: **AWS Access Key ID**, **AWS Secret Access Key**, and **AWS Session Token** (optional). These are stored in the LLM's `metadata` map rather than `APIKey`. Use `$SECRET/NAME` references in these fields to keep credentials encrypted at rest via the [Secrets](/ai-management/ai-studio/secrets) manager.
+   - In the **Portal Display Information** section,
+      - **Logo URL:** Configure the logo used in the Portal UI for end-users.
+      - **Enabled in proxy:** Needs to be set to active to use this LLM in proxy. For example, it is required to create an app that uses this LLM.
+      - **Disable Request/Response Body Logging:** From v2.1.0, when enabled, request and response bodies are not stored in proxy logs, chat logs, or analytics events for this LLM.
+   - **Plugins:** Select plugins to attach to this LLM. They execute in the order selected during the request lifecycle.
+   - **Available Namespaces:** Select which edge namespaces this configuration should be available to (leave empty for global availability).
+4. **Save:** Save the configuration to make the LLM provider available.
+
+    <img src="/img/ai-management/llm-provider-config.png" alt="LLM Provider Config" />
\ No newline at end of file
diff --git a/ai-management/ai-studio/manage-edge-gateway.mdx b/ai-management/ai-studio/manage-edge-gateway.mdx
new file mode 100644
index 0000000000..11c4e01bbe
--- /dev/null
+++ b/ai-management/ai-studio/manage-edge-gateway.mdx
@@ -0,0 +1,93 @@
+---
+title: "Manage Edge Gateway for Tyk AI Studio"
+description: "Understand how to manage and monitor Edge Gateways in Tyk AI Studio, including configuration synchronization and admin actions."
+keywords: "AI Studio, AI Management, Edge Gateway, Configuration Sync"
+sidebarTitle: "Manage Edge Gateway"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+## What is Edge Gateway Management?
+
+In a hub-and-spoke architecture, Tyk AI Studio acts as the central control plane (Hub), while distributed gateway proxy instances act as Edge Gateways (Spokes). Edge Gateway management provides administrators with the tools to monitor the health, connection status, and configuration synchronization of these distributed instances from a single interface.
+
+This centralized management ensures that all edge instances are running the correct policies, routing rules, and configurations, while allowing data processing to remain local to the edge.
+
+For more details on the data plane architecture and request processing, see the [Edge Gateway (Data Plane) Component](/ai-management/ai-studio/proxy) documentation.
+
+## How it works
+
+Tyk AI Studio uses a robust, checksum-based synchronization system to manage configurations across all connected Edge Gateways.
+
+```mermaid
+sequenceDiagram
+    participant Admin as "Admin (UI)"
+    participant CP as "Control Plane (Hub)"
+    participant Edge as "Edge Gateway (Spoke)"
+
+    Admin->>CP: Modifies Configuration (e.g., LLM, Filter)
+    CP->>CP: Generates new SHA-256 Checksum
+    Edge->>CP: Sends Heartbeat (with old checksum)
+    CP-->>Edge: Acknowledges (Status: Out of Sync)
+    Admin->>CP: Clicks "Push Configuration"
+    CP->>Edge: Sends gRPC Reload Signal
+    Edge->>CP: Fetches New Configuration Snapshot
+    Edge->>Edge: Updates Local SQLite & Reloads Cache
+    Edge->>CP: Sends Heartbeat (with new checksum)
+    CP-->>Admin: Updates UI Status to "In Sync"
+```
+
+1. **Checksum Generation:** Whenever a configuration change occurs on the control plane (e.g., updating an LLM configuration, modifying a filter, or changing a tool), a SHA-256 checksum is computed from the serialized configuration snapshot.
+2. **Heartbeat Reporting:** Edge gateways periodically send heartbeats to the control plane via gRPC. Each heartbeat includes the checksum of the configuration currently loaded on that edge.
+3. **Status Comparison:** The control plane compares the reported checksum against the expected checksum for that edge's namespace to determine its synchronization status.
+4. **Pull-on-miss for Credentials:** To balance performance and security, access tokens are not pushed in the initial snapshot. Instead, edges use a pull-on-miss strategy: they request validation for unknown tokens on-demand and cache them locally. This allows admins to revoke access instantly without waiting for a full configuration push.
+
+## Edge Gateway Properties
+
+When viewing the Edge Gateways list (**Admin > Edge Gateways**), administrators can monitor several key properties for each instance:
+
+| Property | Description |
+|--------|-------------|
+| **Edge ID** | A unique identifier for the edge gateway instance. |
+| **Namespace** | The isolated environment the edge belongs to (Enterprise feature). |
+| **Connection** | The current network status based on heartbeats (`Connected`, `Disconnected`, or `Stale`). |
+| **Config Sync** | Indicates if the edge has the latest configuration (`In Sync`, `Pending`, `Stale`, or `Unknown`). |
+| **Version** | The software version and build hash of the running Edge Gateway. |
+| **Last Heartbeat** | The time elapsed since the control plane last received a heartbeat from this edge. |
+
+Clicking on an individual Edge Gateway reveals additional details, such as the exact loaded and expected configuration checksums, session IDs, and custom metadata reported by the edge (e.g., region or environment).
+
+## Admin Actions
+
+Administrators have full control over the lifecycle and configuration of Edge Gateways through the AI Studio UI.
+
+### Pushing Configuration
+
+Configuration changes are not applied automatically. Administrators must explicitly push configurations to ensure they maintain control over deployment rollouts. 
+
+When you click the **Push Configuration** button:
+1. You can select the target scope: **All Namespaces** or a **Specific Namespace**.
+2. The control plane generates a new configuration snapshot.
+3. A reload signal is sent to the targeted edge gateways via gRPC.
+4. The edges fetch the new configuration, update their local SQLite databases, and reload their in-memory caches.
+5. The sync status updates automatically as edges report their new checksums in subsequent heartbeats.
+
+### Removing Edge Gateways
+
+If an edge gateway is decommissioned or needs to be reset, administrators can remove it from the control plane:
+1. Open the three-dot menu (⋮) on the edge row or navigate to its detail view.
+2. Select **Remove Entry**.
+3. Confirm the removal.
+
+> **Note:** This action only removes the entry from the control plane database. If the edge gateway process is still running, it will automatically re-register on its next connection attempt.
+
+## Troubleshooting Synchronization
+
+If an Edge Gateway shows a `Pending` or `Stale` sync status, or if a checksum mismatch persists:
+- **Check Connectivity:** Ensure the edge gateway is running and firewall rules allow gRPC traffic (default port 50051) to the control plane.
+- **Wait for Heartbeat:** After a push, it may take a few seconds for the heartbeat cycle to complete and the UI to update.
+- **Review Logs:** Check the edge gateway logs for configuration load errors or permission issues preventing it from fetching the latest snapshot.
diff --git a/ai-management/ai-studio/model-prices.mdx b/ai-management/ai-studio/model-prices.mdx
new file mode 100644
index 0000000000..92a565a763
--- /dev/null
+++ b/ai-management/ai-studio/model-prices.mdx
@@ -0,0 +1,76 @@
+---
+title: "Model Prices Management in Tyk AI Studio"
+description: "How to manage Large Language Model (LLM) pricing in Tyk AI Studio, including setting costs for input/output tokens and cache usage."
+keywords: "AI Studio, AI Management, Model Price"
+sidebarTitle: "Model Prices"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Model Prices define the cost per million tokens for using different language models. This helps track usage costs, allowing you to manage and optimize expenses when interacting with different models.
+
+```mermaid
+graph LR
+    A[LLM Request] --> B[Edge Gateway]
+    B --> C[LLM Vendor API]
+    C -->|Response + Token Usage| B
+    B --> D{Model Price Lookup}
+    D -->|Find Price by Model & Vendor| E[(Database: model_prices)]
+    E -->|Return Price Info| D
+    D --> F[Calculate Total Cost]
+    F -->|Save Cost & Tokens| G[(Database: llm_chat_records)]
+    G --> H[Analytics & Budgeting]
+```
+
+
+### Use cases
+
+- **AI Gateway Tracking:** Ensures that token-based costs for API calls through the AI Gateway are accurately logged and monitored.
+- **Chat Room Cost Analysis:** Tracks and evaluates expenses associated with user interactions in the Chat Room feature.
+- **Budget Enforcement:** Provides the underlying cost data needed to enforce monthly budgets set on LLMs and Applications.
+
+## Model Prices
+
+The Model Prices system allows administrators to define the cost structure for specific Large Language Models (LLMs). The pricing information configured here is used by the Analytics system for cost tracking and billing purposes.
+
+Key components of a Model Price entity include:
+- **Model Identification:** The exact name of the model (e.g., `claude-3.5-sonnet-20240620`) and the vendor providing it.
+- **Token Costs:** The price charged per million input tokens and output tokens.
+- **Cache Costs:** Optional pricing for tokens written to or read from the LLM's prompt cache.
+- **Currency:** The currency in which the model's pricing is defined (e.g., USD).
+
+The Model Price entity is closely related to [LLM Management](/ai-management/ai-studio/llm-management), as the pricing defined here applies to the models configured in the LLM settings.
+
+## Configuration
+
+Administrators can configure pricing for specific models through the UI or API. The configuration includes:
+
+- **Model Name:** Must match the exact name used in client API calls or the LLM settings in the portal for correct mapping.
+- **Vendor:** Selectable from pre-configured vendors in the portal.
+- **Cost per Million Input Tokens:** The price charged per million input tokens sent to the LLM.
+- **Cost per Million Output Tokens:** The price charged per million output tokens generated by the LLM.
+- **Cost per Million Cache Write Tokens:** The price charged per million tokens written to the prompt cache (defaults to input token pricing if not set).
+- **Cost per Million Cache Read Tokens:** The price charged per million cached tokens read (typically much lower than input costs).
+- **Currency:** The currency in which the pricing is defined.
+
+## How to Create the Entity
+
+You can create and manage Model Prices through the Tyk AI Studio Admin UI.
+
+1. **Navigate:** Go to the Model Prices section in the Admin UI. This view lists all configured model prices, showing the Model Name, Vendor, Cost per Input Token, Cost per Output Token, Cost per Cache Write Token, Cost per Cache Read Token, and Currency.
+2. **Add New Model Price:** Click the "+ ADD MODEL PRICE" button.
+3. **Fill in the Model Price Details:**
+   - **Model Name:** The exact name of the model this price configuration applies to (Required).
+   - **Vendor:** Select the name of the LLM provider (e.g., Anthropic, OpenAI).
+   - **Cost per Million Input Tokens:** The price charged per million input tokens sent to the LLM (Required).
+   - **Cost per Million Output Tokens:** The price charged per million output tokens generated by the LLM (Required).
+   - **Cost per Million Cache Write Tokens:** The price charged per million tokens written to the prompt cache (Optional).
+   - **Cost per Million Cache Read Tokens:** The price charged per million cached tokens read (Optional).
+   - **Currency:** The currency in which the pricing is defined (e.g., USD) (Required).
+4. **Save:** Click "Update Model Price" or "Create Model Price" to save the configuration.
+
+   <img src="/img/ai-management/llm-model-price-config.png" alt="Model Price Config" />
\ No newline at end of file
diff --git a/ai-management/ai-studio/model-router.mdx b/ai-management/ai-studio/model-router.mdx
new file mode 100644
index 0000000000..aced14522e
--- /dev/null
+++ b/ai-management/ai-studio/model-router.mdx
@@ -0,0 +1,154 @@
+---
+title: "Tyk AI Studio Model Router"
+description: "Overview of Tyk AI Studio's model routing capabilities"
+keywords: "AI Studio, AI Management, Model Routing"
+sidebarTitle: "Model Router"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+The **Model Router** is an Enterprise feature that provides intelligent request routing across multiple LLM vendors based on model name patterns. It enables organizations to create unified API endpoints that automatically route requests to the appropriate backend LLM based on configurable rules.
+
+### Use cases
+
+- **Multi-Vendor Failover:** Create a pool with multiple vendors for the same model pattern. If one vendor is unavailable or disabled, requests automatically go to other active vendors.
+- **Cost Optimization:** Route requests to different vendors based on cost. Use weights to prefer cheaper providers while maintaining access to premium ones.
+- **Model Abstraction:** Allow clients to request generic model names (e.g., `large-model`, `fast-model`) and map them to specific vendor models using model mappings.
+- **A/B Testing:** Use weighted routing to gradually shift traffic between model versions or vendors.
+
+## Model Router
+
+The Model Router acts as a unified endpoint that routes to multiple LLM vendors. It is exposed at `/router/{slug}/v1/chat/completions` and provides an OpenAI-compatible interface.
+
+Key components of a Model Router entity include:
+
+### Router
+
+A **Router** is the top-level entity that defines a routing endpoint. Each router:
+
+- Has a unique **slug** that becomes part of the API endpoint URL
+- Can be **active** or **inactive**
+- Contains one or more **pools** for routing logic
+- Supports **namespaces** for multi-tenant deployments
+
+Routers are exposed at `/router/{slug}/v1/chat/completions` and provide an OpenAI-compatible interface.
+
+### Pool
+
+A **Pool** groups vendors that handle specific model patterns. Each pool:
+
+- Has a **model pattern** using glob syntax (e.g., `claude-*`, `gpt-4*`, `*`)
+- Defines a **selection algorithm** for choosing among vendors
+- Has a **priority** value (higher priority pools are checked first)
+- Contains one or more **vendors**
+
+When a request arrives, pools are checked in priority order. The first pool whose pattern matches the requested model name handles the request.
+
+### Vendor
+
+A **Vendor** represents an LLM configuration within a pool. Each vendor:
+
+- References an existing [LLM configuration](/ai-management/ai-studio/llm-management)
+- Has a **weight** for weighted load balancing
+- Can be **active** or **inactive**
+- Contains optional **model mappings** for name translation
+
+### Model Mapping
+
+**Model Mappings** allow translating the requested model name to a different name when sending to a specific vendor. This is configured at the vendor level, enabling different translations for each backend.
+
+For example, if you want to route `gpt-4` requests to both OpenAI and Anthropic:
+- OpenAI vendor: No mapping needed (uses `gpt-4` as-is)
+- Anthropic vendor: Map `gpt-4` → `claude-3-opus-20240229`
+
+The Model Router entity is closely related to [LLM Management](/ai-management/ai-studio/llm-management), as the vendors within a pool reference the configured LLMs.
+
+### Selection Algorithms
+
+#### Round Robin
+
+The `round_robin` algorithm distributes requests evenly across active vendors in a pool. Each request goes to the next vendor in sequence.
+
+#### Weighted
+
+The `weighted` algorithm distributes requests based on vendor weights. A vendor with weight 3 receives three times as many requests as a vendor with weight 1.
+
+## Configuration
+
+Administrators can configure Model Routers through the UI or API. The configuration includes:
+
+- **Basic Information:** Name, Slug (used in the URL), Description, Active status, and Available Namespaces.
+- **Model Pools:** Define the routing logic based on model patterns.
+  - **Model Pattern:** Glob pattern to match (e.g., `claude-*`).
+  - **Selection Algorithm:** Choose `round_robin` or `weighted`.
+  - **Priority:** Higher values are checked first.
+- **Vendors:** Add vendors to a pool, referencing configured LLMs.
+  - **Weight:** Relative weight for load balancing.
+  - **Model Mappings:** Translate the requested model name to a target model name.
+
+## How to Create a Model Router
+
+You can create and manage Model Routers through the Tyk AI Studio Admin UI.
+
+1. **Navigate:** Go to the Model Routers section in the Admin UI.
+2. **Add New Router:** Click "Create Model Router".
+3. **Fill in the Basic Information:**
+   - **Name:** Human-readable name for the router (Required).
+   - **Slug:** URL-safe identifier used in the endpoint path `/router/{slug}/v1/chat/completions` (Required).
+   - **Description:** Optional description for the router.
+   - **Active:** Enable or disable the router.
+   - **Available Namespaces:** Select which edge namespaces this configuration should be available to (leave empty for global availability).
+4. **Add Model Pools:**
+   - Click "Add Pool" to define routing logic.
+   - **Name:** Pool identifier.
+   - **Model Pattern:** Glob pattern to match (e.g., `claude-*`).
+   - **Selection Algorithm:** Choose `round_robin` or `weighted`.
+   - **Priority:** Set the priority (higher values are checked first).
+5. **Add Vendors to Pools:**
+   - For each pool, click "Add Vendor".
+   - **LLM:** Select from your configured LLMs.
+   - **Weight:** Set the relative weight for load balancing.
+   - **Active:** Enable or disable this vendor.
+6. **Add Model Mappings (Optional):**
+   - **Source Model:** The model name in the incoming request.
+   - **Target Model:** The model name to send to this vendor.
+7. **Save:** Click "Create" to save the router.
+
+{/* *TODO: Add product screenshots of the Model Router list view and the Create Model Router form.* */}
+
+## Using the Model Router
+
+Once a router is active, you can send OpenAI-compatible requests to its endpoint:
+
+```bash
+curl -X POST "https://your-host/router/{slug}/v1/chat/completions" \
+  -H "Authorization: Bearer YOUR_APP_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "model": "claude-3-sonnet-20240229",
+    "messages": [
+      {"role": "user", "content": "Hello!"}
+    ]
+  }'
+```
+
+The router will:
+1. Match the model name against pool patterns (in priority order)
+2. Select a vendor using the pool's selection algorithm
+3. Apply any model mappings for the selected vendor
+4. Forward the request to the vendor's LLM endpoint
+5. Return the response to the client
+
+## Current Limitations
+
+- **AI Portal integration:** Model Routers are not yet integrated with the AI Portal. Users cannot browse or subscribe to routers through the portal interface. Routers are currently managed exclusively through the Admin UI and API.
+
+## Enterprise Feature
+
+Model Router is an Enterprise Edition feature. Attempting to use Model Router endpoints without an Enterprise license will return a `402 Payment Required` error.
+
+To enable Model Router functionality, ensure your deployment has a valid Enterprise license configured.
\ No newline at end of file
diff --git a/ai-management/ai-studio/notifications.mdx b/ai-management/ai-studio/notifications.mdx
new file mode 100644
index 0000000000..585fdb94ae
--- /dev/null
+++ b/ai-management/ai-studio/notifications.mdx
@@ -0,0 +1,101 @@
+---
+title: "Notification in Tyk AI Studio"
+description: "How to configure notifications in Tyk AI Studio?"
+keywords: "AI Studio, AI Management, Notifications"
+sidebarTitle: "Notifications"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio includes a centralized Notification System responsible for generating and delivering alerts and messages to users and administrators based on specific system events.
+
+## Purpose
+
+The Notification System aims to:
+
+*   **Inform Stakeholders:** Keep users and administrators aware of important events or required actions.
+*   **Enable Proactive Management:** Alert administrators to potential issues or thresholds being reached (e.g., budget limits).
+*   **Improve User Experience:** Provide timely feedback on asynchronous processes or user-related events.
+
+## Key Features
+
+*   **Event-Driven:** Notifications are triggered by specific occurrences within the Tyk AI Studio platform.
+*   **Configurable Channels:** Supports multiple delivery methods, primarily:
+    *   **Email:** Sending notifications to registered user email addresses.
+    *   **In-App Notifications:** Displaying messages directly within the Tyk AI Studio UI.
+*   **User Preferences:** Allows users (and potentially administrators) to configure which notifications they wish to receive and via which channels (where applicable).
+*   **Centralized Logic:** Provides a single system for managing notification templates and delivery rules.
+
+## Common Notification Triggers
+
+Examples of events that might trigger notifications include:
+
+*   **[Budget Control](/ai-management/ai-studio/budgeting):**
+    *   Approaching spending limit threshold (e.g., 80% of budget).
+    *   Reaching or exceeding spending limit.
+*   **[User Management](/ai-management/ai-studio/user-management):**
+    *   New user registration/invitation.
+    *   Password reset request.
+    *   Changes in user roles or team memberships.
+*   **System Health & Errors:**
+    *   Significant system errors or failures.
+    *   Service degradation alerts.
+*   **Security Events:**
+    *   Suspicious login activity (if monitored).
+    *   Changes to critical security settings.
+
+## Configuration
+
+### SMTP Configuration (Email Notifications)
+
+To enable email notifications, configure the following environment variables:
+
+| Variable | Description | Required |
+|----------|-------------|----------|
+| `SMTP_SERVER` | SMTP server hostname (e.g., `smtp.gmail.com`) | Yes |
+| `SMTP_PORT` | SMTP server port (e.g., `587` for TLS, `465` for SSL) | Yes |
+| `SMTP_USER` | SMTP authentication username | Yes |
+| `SMTP_PASS` | SMTP authentication password | Yes |
+| `FROM_EMAIL` | Sender email address for outgoing notifications | Yes |
+
+**Example `.env` configuration:**
+
+```bash
+SMTP_SERVER=smtp.gmail.com
+SMTP_PORT=587
+SMTP_USER=your-email@gmail.com
+SMTP_PASS=your-app-password
+FROM_EMAIL=noreply@your-domain.com
+```
+
+> **Note:** If SMTP is not configured, email notifications will be skipped silently, but in-app notifications will still work.
+
+### System-Level Settings (Admin)
+
+Administrators configure core notification settings:
+*   SMTP server details (via environment variables above)
+*   Default notification templates
+*   Enabling/disabling specific system-wide notification types
+
+### User-Level Settings
+
+Users can manage their notification preferences in their profile settings:
+*   Opt-in/opt-out of specific notification categories
+*   Choose preferred delivery channels (e.g., receive budget alerts via email)
+
+    <img src="/img/ai-management/notification-preferences.png" alt="Notification Prefs UI" />
+
+## Integration
+
+The Notification System integrates with various other Tyk AI Studio components that generate relevant events, including:
+
+*   Budget Control System
+*   User Management System
+*   Analytics System (potentially for performance alerts)
+*   Proxy/Gateway (for error or security event alerts)
+
+This system ensures timely communication, helping users and administrators stay informed about the status and activity within the Tyk AI Studio platform.
diff --git a/ai-management/ai-studio/overview.mdx b/ai-management/ai-studio/overview.mdx
new file mode 100644
index 0000000000..a26ea798d4
--- /dev/null
+++ b/ai-management/ai-studio/overview.mdx
@@ -0,0 +1,153 @@
+---
+title: "Tyk AI Studio"
+description: "AI Management for Platform Teams with Tyk AI Studio, a comprehensive platform for managing and deploying AI LLMs and chats"
+keywords: "AI Management, Platform Teams, Tyk AI Studio"
+sidebarTitle: "Overview"
+---
+
+import AIStudioCards from '/snippets/AIStudioCards.mdx';
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+Tyk AI Studio is a comprehensive platform that enables platform teams to manage and deploy AI applications with enterprise-grade governance, security, and control.
+
+## Key Features
+
+<AIStudioCards/>
+
+Tyk AI Studio enables platform teams to:
+- Centralise access credentials to AI vendors, including commercial and in-house offerings
+- Log and measure AI usage across the organization
+- Build and release Chatbots for internal collaboration
+- Ingest data into a knowledge corpus with siloed access settings
+- Create AI functions as a service for common automations
+- Script complex multi-modal assistants that intelligently select which AI vendor, model, and data set to use
+- Implement role-based access control to democratise LLM access while maintaining security
+
+
+## Licensing and Editions
+
+Tyk AI Studio is available in two editions: **Community Edition** (open source) and **Enterprise Edition**.
+
+### Community Edition
+The Community Edition is free and open source.
+
+**How to get it:**
+No license is required. You can get started immediately using Docker Compose:
+```bash
+git clone https://github.com/TykTechnologies/ai-studio.git
+cd ai-studio/quickstart
+docker compose -f ./ce/compose.yaml up -d
+```
+
+### Enterprise Edition
+The Enterprise Edition includes advanced features designed for production deployments. It is ideal for organizations requiring cost control, governance, compliance, and enterprise SSO integration.
+
+**How to get it:**
+A valid license key is required. 
+
+Contact support@tyk.io or your account manager to request an AI Studio Enterprise license. Once you have a license, refer our [Installation Guide](/ai-management/ai-studio/installation/overview) for instructions on how to install and configure the Enterprise Edition.
+
+### Feature Comparison
+
+The following table compares the features available in the Community and Enterprise editions of Tyk AI Studio:
+
+| Feature | Community Edition | Enterprise Edition |
+|---------|------------------|-------------------|
+| **LLM Proxy Gateway** | ✅ | ✅ |
+| **Chat Interface** | ✅ | ✅ |
+| **Tool Integration** | ✅ | ✅ |
+| **User Management & RBAC** | ✅ | ✅ |
+| **Hub-and-Spoke Deployment** | ✅ | ✅ |
+| **Cost Tracking & Analytics** | ✅ | ✅ |
+| **Plugin System** ([Learn more](/ai-management/ai-studio/plugins/overview)) | ✅ | ✅ |
+| **Budget Management** | ❌ | ✅ |
+| **Budget Enforcement** | ❌ | ✅ |
+| **Budget Alerts** | ❌ | ✅ |
+| **Advanced SSO (SAML, OIDC)** | ❌ | ✅ |
+| **Advanced RBAC** | ❌ | ✅ |
+| **Audit Logging** | ❌ | ✅ |
+| **Priority Support** | ❌ | ✅ |
+
+## Enterprise AI Challenges
+
+Organizations implementing AI face several key challenges:
+
+* **Shadow AI**: Unauthorized tools running without governance or oversight
+* **Data privacy and compliance**: Meeting regulatory requirements while enabling innovation
+* **Security and access control**: Implementing proper authentication and authorization
+* **Cost management**: Controlling expenses from unmonitored AI usage
+
+## Integrate AI with Confidence
+
+Tyk AI Studio helps organizations harness AI's potential while ensuring proper governance, security, compliance, and control. Purpose-built for enterprises, this AI gateway and management solution enables seamless governance that overcomes the risks and challenges of AI adoption.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/J2BY7NYRk7U" title="Tyk AI Studio" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+## Solution Components
+
+Tyk AI Studio provides a comprehensive suite of capabilities to manage, govern, and interact with AI across your organization:
+
+### Centralized AI management
+
+Unify and control AI usage across your organization:
+- Govern AI with role-based access control, rate limiting and audit logging
+- Monitor usage, costs, budgets, and performance in real time
+- Manage how LLMs are accessed and used, with an AI gateway as a single point of control
+- Ensure compliance with global privacy regulations through customizable data flow management
+
+### AI Gateway
+
+Seamlessly connect to AI tools and models:
+- Proxy to large language models (LLMs) and integrate custom data models and tools
+- Use the [AI Gateway](/ai-management/ai-studio/proxy) to enable secure, scalable access to AI services across teams
+- Track usage statistics, cost breakdowns, and tool utilization to optimize resources
+
+### AI Portal
+
+Empower developers with a curated AI service catalog:
+- Simplify access to AI tools and services through a unified portal
+- Enable seamless integration with internal systems and external workflows
+- Accelerate innovation by providing developers with the tools they need to build faster
+
+### AI Chat
+
+Bring AI-powered collaboration to every user:
+- Deliver intuitive chat interfaces for direct interaction with AI tools and data sources
+- Enable teams to access AI-driven insights through a unified, secure chat experience
+- Foster collaboration and innovation across your organization
+## Benefits
+
+Tyk AI Studio empowers organizations to adopt AI securely and efficiently, delivering:
+
+- **Centralized governance and control:** Consistency at the core of your business for enhanced security, compliance, troubleshooting and auditing
+- **Strengthened security:** Peace of mind from strict access controls, secure interactions and region-specific compliance
+- **Simplified workflows:** Reduced complexity and enhanced efficiency supporting developers and less technical users to work with multiple LLMs and tools
+- **Trusted data privacy:** Rigorous compliance with data protection standards, reducing risk of reputational, operational and financial damage
+- **Seamless integration:** Enhanced workflows in customer support, development, and marketing with trusted AI tools
+- **Cost optimization:** Control over expenses and accountability, enabling smarter budgets
+
+## Use Cases
+
+Proxying LLM traffic through the AI Gateway delivers control, visibility, and scalability across various scenarios:
+
+- **Interact with your APIs:** Connect your API management to enable API interaction for wider teams
+- **Banking and financial services:** Ensure only anonymized customer data is sent to LLMs, tracking usage by department to manage costs
+- **Software development:** Leverage AI for code suggestions and issue tracking in Jira
+- **Data governance:** Audit and secure AI interactions to meet regulatory standards
+- **Healthcare:** Route LLM traffic through an AI gateway to comply with HIPAA, protecting patient data while enabling AI-driven insights
+- **E-commerce:** Integrate LLMs with product catalogs, allowing employees to query inventory or sales data through a chat interface
+
+## MCP servers in AI Studio
+
+AI Studio provides comprehensive [MCP (Model Context Protocol) capabilities](/ai-management/mcps/overview#mcp-for-enterprise-use) including:
+
+- **Remote MCP catalogues and server support** – Expose internal APIs and tools to AI assistants securely without requiring local installations
+- **Secure local MCP server deployment** – Deploy MCP servers within controlled environments, integrated with Tyk AI Gateway for monitoring and governance  
+- **Ready-to-use MCP integrations** – Including API to MCP conversion, Dashboard API access, and searchable documentation access
+
+For more details about Model Context Protocol (MCP) integration, please visit the [Tyk MCPs overview](/ai-management/mcps/overview) page.
+
+<br />
+<ButtonLeft href="https://tyk.io/ai-demo" color="green" content="Request a demo" />
+
+
diff --git a/ai-management/ai-studio/plugins/best-practices.mdx b/ai-management/ai-studio/plugins/best-practices.mdx
new file mode 100644
index 0000000000..029ca164f4
--- /dev/null
+++ b/ai-management/ai-studio/plugins/best-practices.mdx
@@ -0,0 +1,881 @@
+---
+title: "Tyk AI Studio Plugin Best Practices"
+description: "Production-ready patterns, performance optimization, and security guidelines for Tyk AI Studio plugins using the Unified Plugin SDK."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "Best Practices"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph TD
+    A[Best Practices] --> B[Security]
+    A --> C[Performance]
+    A --> D[Production Readiness]
+```
+
+Production-ready patterns, performance optimization, and security guidelines for Tyk AI Studio plugins using the **Unified Plugin SDK**.
+
+## Architecture
+
+### Single Responsibility
+
+Each plugin should have a clear, focused purpose:
+
+```go
+// Good: Focused on one concern
+type RateLimiterPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+// Avoid: Doing too many unrelated things
+type EverythingPlugin struct {
+    plugin_sdk.BasePlugin
+    // rate limiting + auth + logging + analytics + ...
+}
+```
+
+**When to combine capabilities**:
+- ✅ UI + PostAuth for rate limiting dashboard
+- ✅ PostAuth + Response for request/response correlation
+- ✅ Object Hooks + UI for approval workflows
+- ❌ Unrelated features that could be separate plugins
+
+### BasePlugin Usage
+
+Always use `BasePlugin` for consistent lifecycle management:
+
+```go Expandable
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+    config *Config
+    client *http.Client
+}
+
+func NewMyPlugin() *MyPlugin {
+    return &MyPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "my-plugin",
+            "1.0.0",
+            "Clear description of what it does",
+        ),
+    }
+}
+```
+
+### Configuration Management
+
+Parse configuration in `Initialize()`, validate early:
+
+```go Expandable
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    // Extract broker ID for Service API
+    if brokerIDStr, ok := config["_service_broker_id"]; ok {
+        var brokerID uint32
+        fmt.Sscanf(brokerIDStr, "%d", &brokerID)
+        ai_studio_sdk.SetServiceBrokerID(brokerID)
+    }
+
+    // Validate required configuration
+    apiKey, ok := config["api_key"]
+    if !ok || apiKey == "" {
+        return fmt.Errorf("api_key is required")
+    }
+
+    // Parse optional configuration with defaults
+    timeout := 30
+    if timeoutStr, ok := config["timeout"]; ok {
+        if t, err := strconv.Atoi(timeoutStr); err == nil {
+            timeout = t
+        }
+    }
+
+    // Initialize resources
+    p.config = &Config{
+        APIKey:  apiKey,
+        Timeout: time.Duration(timeout) * time.Second,
+    }
+
+    p.client = &http.Client{
+        Timeout: p.config.Timeout,
+    }
+
+    ctx.Services.Logger().Info("Plugin initialized",
+        "timeout", timeout,
+    )
+
+    return nil
+}
+```
+
+## Error Handling
+
+### Fail Fast, Fail Clearly
+
+Return errors early with descriptive messages:
+
+```go Expandable
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Validate input
+    if req.Method != "POST" {
+        return &pb.PluginResponse{
+            Block:        true,
+            ErrorMessage: "Only POST requests are allowed",
+        }, nil
+    }
+
+    // Check external dependency
+    status, err := p.checkExternalService(ctx)
+    if err != nil {
+        ctx.Services.Logger().Error("External service check failed",
+            "error", err,
+            "app_id", ctx.AppID,
+        )
+        return &pb.PluginResponse{
+            Block:        true,
+            ErrorMessage: "Service temporarily unavailable",
+        }, nil
+    }
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+### Log Errors with Context
+
+Always include relevant context in error logs:
+
+```go
+ctx.Services.Logger().Error("Failed to validate request",
+    "error", err,
+    "app_id", ctx.AppID,
+    "user_id", ctx.UserID,
+    "path", req.Path,
+    "method", req.Method,
+)
+```
+
+### Graceful Degradation
+
+Don't fail hard if non-critical operations fail:
+
+```go
+// Bad: Plugin fails if KV write fails
+err := ctx.Services.KV().Write(ctx, "cache", data)
+if err != nil {
+    return nil, err // Blocks entire request!
+}
+
+// Good: Log and continue
+err := ctx.Services.KV().Write(ctx, "cache", data)
+if err != nil {
+    ctx.Services.Logger().Warn("Failed to cache data", "error", err)
+    // Continue processing
+}
+```
+
+## Performance
+
+### Minimize Blocking Operations
+
+Avoid blocking in request path:
+
+```go Expandable
+// Bad: Synchronous external call in request path
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // This blocks the request!
+    result, err := p.callSlowExternalAPI(req.Body)
+    return &pb.PluginResponse{Modified: false}, nil
+}
+
+// Good: Async processing for non-critical operations
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Fire and forget for analytics
+    go func() {
+        p.trackRequest(req)
+    }()
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+### Use Connection Pooling
+
+Reuse HTTP clients and database connections. The SDK provides a `DefaultHTTPClient()` with sensible defaults (30s timeout, connection pooling, TLS handshake timeout):
+
+```go
+func NewMyPlugin() *MyPlugin {
+    return &MyPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin("my-plugin", "1.0.0", "desc"),
+        // Use the SDK default client with connection pooling
+        httpClient: plugin_sdk.DefaultHTTPClient(),
+    }
+}
+```
+
+You can also configure your own client if you need different settings:
+
+```go
+httpClient: &http.Client{
+    Timeout: 10 * time.Second,
+    Transport: &http.Transport{
+        MaxIdleConns:        100,
+        MaxIdleConnsPerHost: 10,
+        IdleConnTimeout:     90 * time.Second,
+    },
+}
+```
+
+**Important**: Always use `http.NewRequestWithContext(ctx, ...)` to respect context cancellation and timeouts. Never use the default `http.Client{}` with zero timeout in production plugins.
+
+### Cache Frequently Accessed Data
+
+Use KV storage or in-memory caching:
+
+```go Expandable
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+    cache     sync.Map // In-memory cache
+    cacheTime time.Duration
+}
+
+func (p *MyPlugin) getConfig(ctx plugin_sdk.Context, appID uint32) (*AppConfig, error) {
+    // Check memory cache first
+    key := fmt.Sprintf("config:%d", appID)
+    if val, ok := p.cache.Load(key); ok {
+        cached := val.(*cachedConfig)
+        if time.Since(cached.timestamp) < p.cacheTime {
+            return cached.config, nil
+        }
+    }
+
+    // Check KV storage
+    data, err := ctx.Services.KV().Read(ctx, key)
+    if err == nil {
+        var config AppConfig
+        json.Unmarshal(data, &config)
+
+        // Update memory cache
+        p.cache.Store(key, &cachedConfig{
+            config:    &config,
+            timestamp: time.Now(),
+        })
+
+        return &config, nil
+    }
+
+    // Fetch from Service API (slowest)
+    app, err := ctx.Services.Studio().GetApp(ctx, appID)
+    // ... cache and return
+}
+```
+
+### Batch Operations
+
+Batch external calls when possible:
+
+```go
+// Bad: N+1 queries
+for _, appID := range appIDs {
+    app, _ := ctx.Services.Studio().GetApp(ctx, appID)
+    // process app
+}
+
+// Good: Batch fetch
+apps, _ := ctx.Services.Studio().ListApps(ctx, 1, 100)
+```
+
+## Security
+
+### Input Validation
+
+Always validate and sanitize inputs:
+
+```go Expandable
+func (p *MyPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    // Validate object JSON
+    var llm LLM
+    if err := json.Unmarshal([]byte(req.ObjectJson), &llm); err != nil {
+        return &pb.ObjectHookResponse{
+            AllowOperation:  false,
+            RejectionReason: "Invalid LLM configuration",
+        }, nil
+    }
+
+    // Validate required fields
+    if llm.Name == "" {
+        return &pb.ObjectHookResponse{
+            AllowOperation:  false,
+            RejectionReason: "LLM name is required",
+        }, nil
+    }
+
+    // Validate URL format
+    if llm.APIEndpoint != "" {
+        u, err := url.Parse(llm.APIEndpoint)
+        if err != nil || (u.Scheme != "https" && u.Scheme != "http") {
+            return &pb.ObjectHookResponse{
+                AllowOperation:  false,
+                RejectionReason: "Invalid API endpoint URL",
+            }, nil
+        }
+    }
+
+    return &pb.ObjectHookResponse{AllowOperation: true}, nil
+}
+```
+
+### Least Privilege Permissions
+
+Only request permissions you actually need:
+
+```json Expandable
+// Bad: Requesting everything
+{
+  "permissions": {
+    "services": [
+      "llms.read", "llms.write", "llms.proxy",
+      "tools.read", "tools.write", "tools.execute",
+      "apps.read", "apps.write",
+      "analytics.read", "kv.readwrite"
+    ]
+  }
+}
+
+// Good: Only what's needed
+{
+  "permissions": {
+    "services": [
+      "llms.read",      // Read LLM configs
+      "kv.readwrite"    // Store plugin state
+    ]
+  }
+}
+```
+
+### Secrets Management
+
+Never hardcode secrets, use configuration:
+
+```go
+// Bad: Hardcoded secrets
+apiKey := "sk-1234567890abcdef"
+
+// Good: From configuration
+apiKey, ok := config["api_key"]
+if !ok {
+    return fmt.Errorf("api_key configuration required")
+}
+
+// Better: From environment or secrets manager
+apiKey := os.Getenv("PLUGIN_API_KEY")
+```
+
+### Sanitize Logs
+
+Don't log sensitive data:
+
+```go
+// Bad: Logging sensitive data
+ctx.Services.Logger().Info("Request received",
+    "headers", req.Headers, // May contain auth tokens!
+    "body", req.Body,       // May contain PII!
+)
+
+// Good: Log only safe metadata
+ctx.Services.Logger().Info("Request received",
+    "app_id", ctx.AppID,
+    "method", req.Method,
+    "path", req.Path,
+    "content_length", len(req.Body),
+)
+```
+
+## Observability
+
+### Structured Logging
+
+Use key-value pairs for searchable logs:
+
+```go Expandable
+// Good structured logging
+ctx.Services.Logger().Info("Request processed",
+    "app_id", ctx.AppID,
+    "user_id", ctx.UserID,
+    "duration_ms", time.Since(startTime).Milliseconds(),
+    "status", "success",
+)
+
+ctx.Services.Logger().Error("External API call failed",
+    "error", err,
+    "endpoint", endpoint,
+    "status_code", statusCode,
+    "retry_count", retryCount,
+)
+```
+
+### Request Tracing
+
+Include request IDs for correlation:
+
+```go Expandable
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    requestID := generateRequestID()
+
+    // Add to request for downstream
+    if req.Headers == nil {
+        req.Headers = make(map[string]string)
+    }
+    req.Headers["X-Request-ID"] = requestID
+
+    ctx.Services.Logger().Info("Processing request",
+        "request_id", requestID,
+        "app_id", ctx.AppID,
+    )
+
+    // Use request ID in all logs for this request
+    defer func() {
+        ctx.Services.Logger().Info("Request completed",
+            "request_id", requestID,
+            "duration_ms", time.Since(startTime).Milliseconds(),
+        )
+    }()
+
+    return &pb.PluginResponse{
+        Modified: true,
+        Request:  req,
+    }, nil
+}
+```
+
+### Metrics Collection
+
+Track plugin performance:
+
+```go Expandable
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+    stats struct {
+        sync.RWMutex
+        requestCount   int64
+        errorCount     int64
+        totalDuration  time.Duration
+    }
+}
+
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    startTime := time.Now()
+    defer func() {
+        duration := time.Since(startTime)
+
+        p.stats.Lock()
+        p.stats.requestCount++
+        p.stats.totalDuration += duration
+        p.stats.Unlock()
+
+        if duration > 100*time.Millisecond {
+            ctx.Services.Logger().Warn("Slow plugin execution",
+                "duration_ms", duration.Milliseconds(),
+            )
+        }
+    }()
+
+    // ... plugin logic
+}
+
+// Expose metrics via RPC (for UI plugins)
+func (p *MyPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    if method == "get_metrics" {
+        p.stats.RLock()
+        defer p.stats.RUnlock()
+
+        return json.Marshal(map[string]interface{}{
+            "request_count":   p.stats.requestCount,
+            "error_count":     p.stats.errorCount,
+            "avg_duration_ms": p.stats.totalDuration.Milliseconds() / p.stats.requestCount,
+        })
+    }
+    return nil, fmt.Errorf("unknown method")
+}
+```
+
+## Testing
+
+### Unit Tests
+
+Test plugin logic in isolation:
+
+```go Expandable
+func TestValidation(t *testing.T) {
+    plugin := NewValidatorPlugin()
+
+    tests := []struct {
+        name        string
+        llm         LLM
+        shouldAllow bool
+        reason      string
+    }{
+        {
+            name:        "valid HTTPS endpoint",
+            llm:         LLM{APIEndpoint: "https://api.example.com"},
+            shouldAllow: true,
+        },
+        {
+            name:        "HTTP endpoint blocked",
+            llm:         LLM{APIEndpoint: "http://api.example.com"},
+            shouldAllow: false,
+            reason:      "API endpoint must use HTTPS",
+        },
+    }
+
+    for _, tt := range tests {
+        t.Run(tt.name, func(t *testing.T) {
+            llmJSON, _ := json.Marshal(tt.llm)
+            req := &pb.ObjectHookRequest{
+                ObjectType: "llm",
+                ObjectJson: string(llmJSON),
+            }
+
+            resp, err := plugin.HandleObjectHook(mockContext(), req)
+            assert.NoError(t, err)
+            assert.Equal(t, tt.shouldAllow, resp.AllowOperation)
+            if !tt.shouldAllow {
+                assert.Contains(t, resp.RejectionReason, tt.reason)
+            }
+        })
+    }
+}
+```
+
+### Integration Tests
+
+Test with Service API:
+
+```go Expandable
+func TestServiceAPIIntegration(t *testing.T) {
+    // Requires test environment
+    if os.Getenv("INTEGRATION_TEST") == "" {
+        t.Skip("Skipping integration test")
+    }
+
+    plugin := NewMyPlugin()
+    ctx := testContext()
+
+    // Test KV operations
+    err := ctx.Services.KV().Write(ctx, "test-key", []byte("value"))
+    assert.NoError(t, err)
+
+    data, err := ctx.Services.KV().Read(ctx, "test-key")
+    assert.NoError(t, err)
+    assert.Equal(t, "value", string(data))
+}
+```
+
+## Object Hooks Best Practices
+
+### Hook Priority
+
+Use priority to control execution order:
+
+- **0-10**: Critical validation (security, compliance)
+- **11-50**: Business logic validation
+- **51-100**: Enrichment and metadata
+
+```go
+func (p *SecurityPlugin) GetObjectHookRegistrations() ([]*pb.ObjectHookRegistration, error) {
+    return []*pb.ObjectHookRegistration{
+        {
+            ObjectType: "llm",
+            HookTypes:  []string{"before_create", "before_update"},
+            Priority:   5, // Run early for security checks
+        },
+    }, nil
+}
+```
+
+### Before vs After Hooks
+
+**Use `before_*` hooks for**:
+- Validation that can block operations
+- Required field checks
+- Security policy enforcement
+- Approval workflows
+
+**Use `after_*` hooks for**:
+- Notifications
+- Audit logging
+- External system sync
+- Non-blocking enrichment
+
+### Metadata Storage
+
+Use PluginMetadata for tracking:
+
+```go
+return &pb.ObjectHookResponse{
+    AllowOperation: true,
+    PluginMetadata: map[string]string{
+        "validated_by":  "security-plugin",
+        "validated_at":  time.Now().Format(time.RFC3339),
+        "security_scan": "passed",
+        "risk_score":    "low",
+    },
+}, nil
+```
+
+## Multi-Capability Patterns
+
+### Shared State
+
+Share data structures between capabilities:
+
+```go Expandable
+type RateLimiterPlugin struct {
+    plugin_sdk.BasePlugin
+    limits sync.Map // app_id -> limit config
+}
+
+// PostAuth uses limits
+func (p *RateLimiterPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    limit, _ := p.limits.Load(ctx.AppID)
+    // Check limit
+}
+
+// UI reads limits
+func (p *RateLimiterPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    if method == "get_limits" {
+        var limits []LimitInfo
+        p.limits.Range(func(key, value interface{}) bool {
+            limits = append(limits, LimitInfo{
+                AppID: key.(uint32),
+                Limit: value.(int),
+            })
+            return true
+        })
+        return json.Marshal(limits)
+    }
+}
+```
+
+### State Persistence
+
+Use KV storage for durable state:
+
+```go Expandable
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    // Load state from KV on startup
+    data, err := ctx.Services.KV().Read(ctx, "plugin_state")
+    if err == nil {
+        json.Unmarshal(data, &p.state)
+    }
+    return nil
+}
+
+func (p *MyPlugin) Shutdown(ctx plugin_sdk.Context) error {
+    // Save state to KV on shutdown
+    data, _ := json.Marshal(p.state)
+    ctx.Services.KV().Write(ctx, "plugin_state", data)
+    return nil
+}
+```
+
+## Deployment
+
+### Version Management
+
+Use semantic versioning:
+
+```go
+plugin_sdk.NewBasePlugin(
+    "my-plugin",
+    "1.2.3", // MAJOR.MINOR.PATCH
+    "Description",
+)
+```
+
+- **MAJOR**: Breaking changes (incompatible API changes)
+- **MINOR**: New features (backward-compatible)
+- **PATCH**: Bug fixes (backward-compatible)
+
+### Resource Cleanup
+
+Always clean up in `Shutdown()`:
+
+```go Expandable
+func (p *MyPlugin) Shutdown(ctx plugin_sdk.Context) error {
+    // Close database connections
+    if p.db != nil {
+        p.db.Close()
+    }
+
+    // Close HTTP clients
+    if p.httpClient != nil {
+        p.httpClient.CloseIdleConnections()
+    }
+
+    // Flush any pending operations
+    p.flushPendingData(ctx)
+
+    ctx.Services.Logger().Info("Plugin shutdown complete")
+    return nil
+}
+```
+
+### Health Checks
+
+Implement health check methods:
+
+```go Expandable
+func (p *MyPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    if method == "health" {
+        status := map[string]interface{}{
+            "status": "healthy",
+            "uptime": time.Since(p.startTime).Seconds(),
+        }
+
+        // Check external dependencies
+        if err := p.checkDependencies(); err != nil {
+            status["status"] = "unhealthy"
+            status["error"] = err.Error()
+        }
+
+        return json.Marshal(status)
+    }
+    // ... other methods
+}
+```
+
+## Common Pitfalls
+
+### AUTH Plugins: App Linking Requirement
+
+The most common AUTH plugin pitfall is **not linking credentials to App objects**. A valid credential alone is insufficient—the system needs the App context for access control.
+
+**Why This Matters:**
+
+Apps provide the access control context that governs what authenticated requests can do:
+- Policy enforcement (rate limits, quotas)
+- Tool and datasource permissions
+- LLM access restrictions
+- Budget controls
+
+**Required Interface Methods:**
+
+AUTH plugins must implement all three methods of the `AuthHandler` interface:
+
+```go
+type AuthHandler interface {
+    HandleAuth(ctx Context, req *pb.AuthRequest) (*pb.AuthResponse, error)
+    GetAppByCredential(ctx Context, credential string) (*pb.App, error)      // Often forgotten!
+    GetUserByCredential(ctx Context, credential string) (*pb.User, error)
+}
+```
+
+**Common Mistakes:**
+
+```go Expandable
+// BAD: Only validates token, doesn't return App ID
+func (p *MyPlugin) HandleAuth(ctx plugin_sdk.Context, req *pb.AuthRequest) (*pb.AuthResponse, error) {
+    if isValidToken(req.Credential) {
+        return &pb.AuthResponse{
+            Authenticated: true,
+            // Missing AppId and UserId! Request will fail.
+        }, nil
+    }
+    return &pb.AuthResponse{Authenticated: false}, nil
+}
+
+// GOOD: Returns both App ID and User ID
+func (p *MyPlugin) HandleAuth(ctx plugin_sdk.Context, req *pb.AuthRequest) (*pb.AuthResponse, error) {
+    tokenConfig, valid := p.lookupToken(req.Credential)
+    if !valid {
+        return &pb.AuthResponse{Authenticated: false, ErrorMessage: "Invalid token"}, nil
+    }
+    return &pb.AuthResponse{
+        Authenticated: true,
+        AppId:         tokenConfig.AppID,   // Links to access control
+        UserId:        tokenConfig.UserID,  // Links to identity
+    }, nil
+}
+```
+
+**Validation Checklist:**
+
+- [ ] `HandleAuth` returns a valid `AppId` that exists in the database
+- [ ] `HandleAuth` returns a valid `UserId` that exists in the database
+- [ ] `GetAppByCredential` fetches the complete App object via Service API
+- [ ] `GetUserByCredential` fetches the complete User object via Service API
+- [ ] The App has the required permissions for the tools/LLMs the user needs
+
+See [Plugin SDK Reference - AuthHandler](/ai-management/ai-studio/plugins/sdk#2-authhandler) for complete documentation.
+
+### 1. Modifying Shared Data Without Locking
+
+```go Expandable
+// Bad: Race condition
+type MyPlugin struct {
+    counter int // Not thread-safe!
+}
+
+// Good: Use sync primitives
+type MyPlugin struct {
+    mu      sync.Mutex
+    counter int
+}
+
+func (p *MyPlugin) increment() {
+    p.mu.Lock()
+    defer p.mu.Unlock()
+    p.counter++
+}
+```
+
+### 2. Blocking in Defer
+
+```go
+// Bad: Blocking operations in defer
+defer func() {
+    p.sendAnalytics(data) // Blocks shutdown!
+}()
+
+// Good: Use timeouts
+defer func() {
+    ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+    defer cancel()
+    p.sendAnalyticsWithContext(ctx, data)
+}()
+```
+
+### 3. Not Handling Context Cancellation
+
+```go
+// Good: Respect context cancellation
+func (p *MyPlugin) longRunningOperation(ctx context.Context) error {
+    for {
+        select {
+        case <-ctx.Done():
+            return ctx.Err()
+        default:
+            // Do work
+        }
+    }
+}
+```
+
+### 4. Excessive Logging
+
+```go
+// Bad: Log spam
+for _, item := range items {
+    ctx.Services.Logger().Debug("Processing item", "item", item)
+}
+
+// Good: Batch logging
+ctx.Services.Logger().Info("Processing items",
+    "count", len(items),
+    "batch_id", batchID,
+)
+```
diff --git a/ai-management/ai-studio/plugins/custom-endpoints.mdx b/ai-management/ai-studio/plugins/custom-endpoints.mdx
new file mode 100644
index 0000000000..cc431f0a0d
--- /dev/null
+++ b/ai-management/ai-studio/plugins/custom-endpoints.mdx
@@ -0,0 +1,607 @@
+---
+title: "Tyk AI Studio Custom Endpoint Plugins"
+description: "Learn how to register and serve arbitrary HTTP endpoints on the Edge Gateway using Custom Endpoint plugins for use cases like OAuth providers and webhooks."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "Custom Endpoint"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph LR
+    A[Client] -->|HTTP Request| B[Edge Gateway]
+    B -->|gRPC| C[Plugin Custom Endpoint]
+    C -->|HTTP Response| B
+    B -->|HTTP Response| A
+```
+
+Custom Endpoint plugins allow you to **register and serve arbitrary HTTP endpoints** on the Edge Gateway under the `/plugins/{slug}/` URL namespace. This gives plugins full control over request handling, enabling use cases like OAuth identity providers, MCP proxy servers, webhook receivers, and custom protocol-specific APIs.
+
+## Overview
+
+Custom Endpoints provide plugins with the ability to:
+
+- **Serve custom HTTP APIs** alongside the standard LLM/Tool/Datasource proxy endpoints
+- **Handle arbitrary URL paths** with pre-split path segments for easy routing
+- **Stream responses** via Server-Sent Events (SSE) for protocols like MCP Streamable HTTP
+- **Authenticate requests** using the gateway's existing token system, with full App context (including metadata)
+- **Support any HTTP method** (GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD)
+
+### Working Example
+
+See [`examples/plugins/gateway/custom-echo-endpoint/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/custom-echo-endpoint) for a complete, working example that combines **CustomEndpointHandler** + **UIProvider** + **ConfigProvider**. It echoes request metadata and serves content configurable via the Studio admin UI.
+
+### URL Pattern
+
+All custom endpoints are mounted under:
+
+```
+/plugins/{slug}/{path...}
+```
+
+Where `{slug}` is declared in the plugin's configuration (the `slug` key in the config map), and `{path...}` is the sub-path handled by the plugin.
+
+### How It Works
+
+```
+```mermaid
+sequenceDiagram
+    participant Client as HTTP Client
+    participant Gateway as Edge Gateway (Gin Router)
+    participant Plugin as Plugin Process
+
+    Client->>Gateway: POST /plugins/my-mcp/mcp
+    Note over Gateway: 1. Match /plugins/*path catch-all route<br/>2. Parse slug + relative path<br/>3. Look up EndpointRoute<br/>4. Validate auth & fetch App<br/>5. Build EndpointRequest
+    Gateway->>Plugin: gRPC HandleEndpointRequest()
+    Note over Plugin: CustomEndpointHandler<br/>Full control over response<br/>Access to App metadata
+    Plugin-->>Gateway: EndpointResponse
+    Gateway-->>Client: HTTP Response
+```
+
+## Implementing Custom Endpoints
+
+### Step 1: Implement CustomEndpointHandler Interface
+
+```go
+type CustomEndpointHandler interface {
+    Plugin
+    GetEndpointRegistrations() ([]*pb.EndpointRegistration, error)
+    HandleEndpointRequest(ctx Context, req *pb.EndpointRequest) (*pb.EndpointResponse, error)
+    HandleEndpointRequestStream(ctx Context, req *pb.EndpointRequest, stream grpc.ServerStreamingServer[pb.EndpointResponseChunk]) error
+}
+```
+
+### Step 2: Register Your Endpoints
+
+Declare which paths and HTTP methods your plugin handles:
+
+```go
+func (p *MyPlugin) GetEndpointRegistrations() ([]*pb.EndpointRegistration, error) {
+    return []*pb.EndpointRegistration{
+        {
+            Path:           "/*",                            // Catch-all wildcard
+            Methods:        []string{"GET", "POST", "DELETE"},
+            Description:    "MCP Streamable HTTP endpoint",
+            RequireAuth:    true,                            // Gateway enforces auth
+            StreamResponse: true,                            // Use streaming RPC
+        },
+    }, nil
+}
+```
+
+**Registration Options:**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `path` | string | Relative path under the plugin slug. Use `/*` for catch-all. |
+| `methods` | []string | HTTP methods to handle. Valid: GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD. |
+| `description` | string | Human-readable description of the endpoint. |
+| `require_auth` | bool | If true, gateway validates the token and passes the full `App` object to the plugin. |
+| `stream_response` | bool | If true, gateway uses `HandleEndpointRequestStream` (SSE). Otherwise uses `HandleEndpointRequest`. |
+| `metadata` | map[string]string | Plugin-defined metadata. |
+
+### Step 3: Handle Requests
+
+#### Unary (Non-Streaming) Endpoints
+
+For standard request/response:
+
+```go
+func (p *MyPlugin) HandleEndpointRequest(ctx plugin_sdk.Context, req *pb.EndpointRequest) (*pb.EndpointResponse, error) {
+    // Route based on path segments
+    segments := req.PathSegments
+
+    switch {
+    case len(segments) == 0:
+        return p.handleRoot(req)
+    case segments[0] == ".well-known" && len(segments) >= 2:
+        return p.handleWellKnown(segments[1], req)
+    case segments[0] == "users" && len(segments) >= 2:
+        return p.handleUser(segments[1], req)
+    default:
+        return &pb.EndpointResponse{
+            StatusCode: 404,
+            Headers:    map[string]string{"Content-Type": "application/json"},
+            Body:       []byte(`{"error": "not found"}`),
+        }, nil
+    }
+}
+```
+
+#### Streaming (SSE) Endpoints
+
+For Server-Sent Events or MCP Streamable HTTP:
+
+```go
+func (p *MyPlugin) HandleEndpointRequestStream(
+    ctx plugin_sdk.Context,
+    req *pb.EndpointRequest,
+    stream grpc.ServerStreamingServer[pb.EndpointResponseChunk],
+) error {
+    // Send headers first
+    stream.Send(&pb.EndpointResponseChunk{
+        Type:       pb.EndpointResponseChunk_HEADERS,
+        StatusCode: 200,
+        Headers: map[string]string{
+            "Content-Type":  "text/event-stream",
+            "Cache-Control": "no-cache",
+            "Connection":    "keep-alive",
+        },
+    })
+
+    // Send SSE data chunks — each is flushed immediately to the HTTP client
+    for i := 0; i < 5; i++ {
+        data := fmt.Sprintf("data: {\"count\": %d}\n\n", i)
+        stream.Send(&pb.EndpointResponseChunk{
+            Type: pb.EndpointResponseChunk_BODY,
+            Data: []byte(data),
+        })
+        time.Sleep(1 * time.Second)
+    }
+
+    // Signal stream completion
+    stream.Send(&pb.EndpointResponseChunk{
+        Type: pb.EndpointResponseChunk_DONE,
+    })
+
+    return nil
+}
+```
+
+**Chunk Protocol:** HEADERS → BODY* → DONE
+
+| Chunk Type | When | Fields Used |
+|------------|------|-------------|
+| `HEADERS` | First chunk | `status_code`, `headers` |
+| `BODY` | Zero or more times | `data` (raw bytes flushed to client) |
+| `DONE` | Final chunk | — |
+| `ERROR` | On failure | `error_message` |
+
+### Step 4: Configure the Plugin Slug and Register
+
+The plugin slug (used in the URL path) must be set explicitly in the plugin's config map. The slug determines the URL namespace: `/plugins/{slug}/...`.
+
+#### Manifest
+
+Declare `custom_endpoint` in the manifest's capabilities:
+
+```json
+{
+  "id": "com.example.my-plugin",
+  "name": "My Custom Endpoint",
+  "version": "1.0.0",
+  "capabilities": {
+    "hooks": ["custom_endpoint"],
+    "primary_hook": "custom_endpoint"
+  }
+}
+```
+
+If the plugin also provides a Studio UI, include `"studio_ui"` in hooks:
+
+```json
+"hooks": ["custom_endpoint", "studio_ui"]
+```
+
+#### Registration via AI Studio
+
+Register the plugin in AI Studio (Admin > Plugins) with:
+
+| Field | Value |
+|-------|-------|
+| **Hook type** | `custom_endpoint` |
+| **Hook types** | `["custom_endpoint"]` (add `"studio_ui"` if plugin has UI) |
+| **Config** | Must include `"slug"` key — e.g., `{"slug": "my-mcp"}` |
+
+The `slug` in the config determines the URL path on the gateway. For example, `{"slug": "my-mcp"}` makes endpoints available at `http://gateway:8081/plugins/my-mcp/...`.
+
+**Important:** The `slug` must be set in the config map. Without it, endpoints will not be registered and you'll see a warning in the gateway logs:
+```
+Plugin has endpoint registrations but no 'slug' in config
+```
+
+#### Building and Deploying
+
+```bash
+# Build the plugin
+cd examples/plugins/gateway/custom-echo-endpoint
+go build -o custom-echo-endpoint
+
+# Register with file:// for local development
+# Command: file:///path/to/custom-echo-endpoint
+# Config: {"slug": "custom-echo-endpoint", "custom_content": "Hello World"}
+```
+
+#### Gateway Loading
+
+Custom endpoint plugins are loaded automatically at gateway startup via the pre-warming system. The gateway:
+1. Queries all active plugins with `custom_endpoint` hook type
+2. Loads each plugin (starts the binary, initializes via gRPC)
+3. Calls `GetEndpointRegistrations()` to discover endpoints
+4. Registers routes using the `slug` from config
+
+After a control plane config sync, routes are refreshed automatically.
+
+## EndpointRequest Fields
+
+When a request arrives, the plugin receives a rich `EndpointRequest`:
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `method` | string | HTTP method (GET, POST, etc.) |
+| `path` | string | Full request path (`/plugins/my-mcp/users/123`) |
+| `relative_path` | string | Path relative to plugin mount (`/users/123`) |
+| `path_segments` | []string | Pre-split segments: `["users", "123"]` |
+| `headers` | map[string]string | Request headers |
+| `body` | bytes | Request body |
+| `query_string` | string | Raw query string (`foo=bar&baz=1`) |
+| `remote_addr` | string | Client IP address |
+| `host` | string | Request Host header |
+| `protocol` | string | `"http"` (future: `"websocket"`, `"sse"`) |
+| `context` | PluginContext | Request ID, metadata |
+| `authenticated` | bool | Whether request was authenticated |
+| `app` | App | Full App object (when authenticated) |
+| `scopes` | []string | Token scopes (when authenticated) |
+
+### Path Segments
+
+The `path_segments` field pre-splits the relative path for easy pattern matching:
+
+| Request URL | `relative_path` | `path_segments` |
+|-------------|-----------------|-----------------|
+| `/plugins/my-mcp/` | `/` | `[]` |
+| `/plugins/my-mcp/mcp` | `/mcp` | `["mcp"]` |
+| `/plugins/my-mcp/users/123/profile` | `/users/123/profile` | `["users", "123", "profile"]` |
+| `/plugins/my-mcp/.well-known/openid-configuration` | `/.well-known/openid-configuration` | `[".well-known", "openid-configuration"]` |
+
+## Authentication and App Context
+
+When `require_auth: true`, the gateway:
+
+1. Extracts the token from `Authorization: Bearer <token>` header or `?token=` query param
+2. Validates the token via the gateway's auth provider
+3. Fetches the **full App object** linked to the token
+4. Populates `EndpointRequest` with `authenticated=true`, `app`, and `scopes`
+
+The `App` object includes:
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `id` | uint32 | App ID |
+| `name` | string | App name |
+| `description` | string | App description |
+| `owner_email` | string | Owner email address |
+| `is_active` | bool | Whether app is active |
+| `monthly_budget` | double | Monthly budget limit |
+| `rate_limit` | int32 | Rate limit (requests per minute) |
+| `metadata` | map[string]string | Custom key-value metadata |
+
+### Access Control via App Metadata
+
+The recommended pattern for per-app access control is to store ACL rules in App metadata, which admins configure per-app:
+
+```go
+func (p *MyPlugin) HandleEndpointRequest(ctx plugin_sdk.Context, req *pb.EndpointRequest) (*pb.EndpointResponse, error) {
+    if !req.Authenticated || req.App == nil {
+        return &pb.EndpointResponse{StatusCode: 401, Body: []byte("Unauthorized")}, nil
+    }
+
+    // Check custom ACL in App metadata
+    if req.App.Metadata["mcp_access"] != "allowed" {
+        return &pb.EndpointResponse{StatusCode: 403, Body: []byte("Forbidden")}, nil
+    }
+
+    // Check allowed operations
+    allowedOps := req.App.Metadata["allowed_operations"]
+    if allowedOps != "" && !strings.Contains(allowedOps, req.Method) {
+        return &pb.EndpointResponse{StatusCode: 405, Body: []byte("Method not allowed for this app")}, nil
+    }
+
+    // Access granted — handle request
+    return p.processRequest(req)
+}
+```
+
+## Route Matching
+
+The gateway matches routes in this order:
+
+1. **Exact match** — `GET:/plugins/my-oauth/.well-known/openid-configuration`
+2. **Wildcard catch-all** — `GET:/plugins/my-oauth/*`
+
+**Recommended:** Register a single `/*` catch-all and handle routing internally using `path_segments`. This is the simplest and most flexible approach.
+
+A plugin can also register multiple specific paths:
+
+```go
+func (p *MyPlugin) GetEndpointRegistrations() ([]*pb.EndpointRegistration, error) {
+    return []*pb.EndpointRegistration{
+        {
+            Path:        "/.well-known/openid-configuration",
+            Methods:     []string{"GET"},
+            Description: "OpenID Connect discovery",
+        },
+        {
+            Path:        "/token",
+            Methods:     []string{"POST"},
+            Description: "Token endpoint",
+            RequireAuth: false,
+        },
+        {
+            Path:        "/userinfo",
+            Methods:     []string{"GET"},
+            Description: "UserInfo endpoint",
+            RequireAuth: true,
+        },
+    }, nil
+}
+```
+
+## MCP Streamable HTTP Support
+
+Custom endpoints are designed to support MCP (Model Context Protocol) Streamable HTTP out of the box.
+
+### MCP Protocol Summary
+
+MCP Streamable HTTP uses a single endpoint with:
+- **POST**: Client sends JSON-RPC messages; server responds with `application/json` or `text/event-stream`
+- **GET**: Client opens an inbound SSE stream for server-initiated messages
+- **DELETE**: Client terminates the session
+- Session tracking via `Mcp-Session-Id` header
+
+### MCP Proxy Plugin Pattern
+
+```go
+type MCPProxyPlugin struct {
+    plugin_sdk.BasePlugin
+    sessions sync.Map // sessionID → session state
+}
+
+func (p *MCPProxyPlugin) GetEndpointRegistrations() ([]*pb.EndpointRegistration, error) {
+    return []*pb.EndpointRegistration{
+        {
+            Path:           "/*",
+            Methods:        []string{"POST", "GET", "DELETE"},
+            Description:    "MCP Streamable HTTP proxy",
+            RequireAuth:    true,
+            StreamResponse: true, // Use streaming for all requests
+        },
+    }, nil
+}
+
+func (p *MCPProxyPlugin) HandleEndpointRequestStream(
+    ctx plugin_sdk.Context,
+    req *pb.EndpointRequest,
+    stream grpc.ServerStreamingServer[pb.EndpointResponseChunk],
+) error {
+    switch req.Method {
+    case "POST":
+        return p.handleMCPPost(ctx, req, stream)
+    case "GET":
+        return p.handleMCPGet(ctx, req, stream)
+    case "DELETE":
+        return p.handleMCPDelete(ctx, req, stream)
+    default:
+        stream.Send(&pb.EndpointResponseChunk{
+            Type:       pb.EndpointResponseChunk_HEADERS,
+            StatusCode: 405,
+        })
+        stream.Send(&pb.EndpointResponseChunk{Type: pb.EndpointResponseChunk_DONE})
+        return nil
+    }
+}
+
+func (p *MCPProxyPlugin) handleMCPPost(ctx plugin_sdk.Context, req *pb.EndpointRequest, stream grpc.ServerStreamingServer[pb.EndpointResponseChunk]) error {
+    // Parse JSON-RPC request
+    var rpcReq map[string]interface{}
+    json.Unmarshal(req.Body, &rpcReq)
+
+    // Check if client accepts SSE
+    acceptsSSE := strings.Contains(req.Headers["Accept"], "text/event-stream")
+
+    if acceptsSSE {
+        // Stream response as SSE
+        stream.Send(&pb.EndpointResponseChunk{
+            Type:       pb.EndpointResponseChunk_HEADERS,
+            StatusCode: 200,
+            Headers: map[string]string{
+                "Content-Type":  "text/event-stream",
+                "Cache-Control": "no-cache",
+            },
+        })
+
+        // Send SSE events...
+        for _, event := range p.processRPCRequest(rpcReq) {
+            data := fmt.Sprintf("data: %s\n\n", event)
+            stream.Send(&pb.EndpointResponseChunk{
+                Type: pb.EndpointResponseChunk_BODY,
+                Data: []byte(data),
+            })
+        }
+    } else {
+        // Single JSON response
+        result := p.processRPCRequestSync(rpcReq)
+        body, _ := json.Marshal(result)
+        stream.Send(&pb.EndpointResponseChunk{
+            Type:       pb.EndpointResponseChunk_HEADERS,
+            StatusCode: 200,
+            Headers:    map[string]string{"Content-Type": "application/json"},
+        })
+        stream.Send(&pb.EndpointResponseChunk{
+            Type: pb.EndpointResponseChunk_BODY,
+            Data: body,
+        })
+    }
+
+    stream.Send(&pb.EndpointResponseChunk{Type: pb.EndpointResponseChunk_DONE})
+    return nil
+}
+```
+
+The gateway is a transparent pipe — all MCP protocol logic (JSON-RPC, sessions, resumability) lives in the plugin.
+
+## Complete Example: Webhook Receiver
+
+```go
+package main
+
+import (
+    "crypto/hmac"
+    "crypto/sha256"
+    "encoding/hex"
+    "encoding/json"
+    "fmt"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+)
+
+type WebhookPlugin struct {
+    plugin_sdk.BasePlugin
+    secret string
+}
+
+func NewWebhookPlugin() *WebhookPlugin {
+    return &WebhookPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin("webhook-receiver", "1.0.0", "Receives and validates webhooks"),
+    }
+}
+
+func (p *WebhookPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    p.secret = config["webhook_secret"]
+    if p.secret == "" {
+        return fmt.Errorf("webhook_secret is required")
+    }
+    ctx.Services.Logger().Info("Webhook receiver initialized")
+    return nil
+}
+
+func (p *WebhookPlugin) GetEndpointRegistrations() ([]*pb.EndpointRegistration, error) {
+    return []*pb.EndpointRegistration{
+        {
+            Path:        "/*",
+            Methods:     []string{"POST"},
+            Description: "Webhook receiver endpoint",
+            RequireAuth: false, // Webhooks use their own auth (HMAC signature)
+        },
+    }, nil
+}
+
+func (p *WebhookPlugin) HandleEndpointRequest(ctx plugin_sdk.Context, req *pb.EndpointRequest) (*pb.EndpointResponse, error) {
+    // Validate HMAC signature
+    signature := req.Headers["X-Webhook-Signature"]
+    if !p.validateSignature(req.Body, signature) {
+        return &pb.EndpointResponse{
+            StatusCode: 401,
+            Headers:    map[string]string{"Content-Type": "application/json"},
+            Body:       []byte(`{"error": "invalid signature"}`),
+        }, nil
+    }
+
+    // Route by path segments
+    segments := req.PathSegments
+    if len(segments) == 0 {
+        return &pb.EndpointResponse{StatusCode: 400, Body: []byte(`{"error": "missing event type"}`)}, nil
+    }
+
+    eventType := segments[0]
+    ctx.Services.Logger().Info("Webhook received", "event", eventType, "body_size", len(req.Body))
+
+    // Process webhook
+    switch eventType {
+    case "payment":
+        return p.handlePaymentWebhook(ctx, req)
+    case "user":
+        return p.handleUserWebhook(ctx, req)
+    default:
+        return &pb.EndpointResponse{
+            StatusCode: 200,
+            Headers:    map[string]string{"Content-Type": "application/json"},
+            Body:       []byte(`{"status": "acknowledged"}`),
+        }, nil
+    }
+}
+
+func (p *WebhookPlugin) HandleEndpointRequestStream(ctx plugin_sdk.Context, req *pb.EndpointRequest, stream pb.PluginService_HandleEndpointRequestStreamServer) error {
+    return fmt.Errorf("streaming not supported for webhooks")
+}
+
+func (p *WebhookPlugin) validateSignature(body []byte, signature string) bool {
+    mac := hmac.New(sha256.New, []byte(p.secret))
+    mac.Write(body)
+    expected := hex.EncodeToString(mac.Sum(nil))
+    return hmac.Equal([]byte(expected), []byte(signature))
+}
+
+func main() {
+    plugin_sdk.Serve(NewWebhookPlugin())
+}
+```
+
+## Lifecycle Management
+
+Custom endpoint routes are managed automatically across all plugin lifecycle events:
+
+| Event | Route Behavior |
+|-------|----------------|
+| **Plugin loaded** | Endpoints registered after `Initialize()` |
+| **Plugin unloaded** | All routes for this plugin removed |
+| **Plugin reloaded** | Routes cleared then re-registered |
+| **Plugin deactivated** | Plugin unloaded, routes removed |
+| **Plugin deleted** | Plugin unloaded, routes removed |
+| **Gateway shutdown** | All routes cleared |
+| **Health check failure** | Plugin auto-restarted, routes re-registered |
+| **Control plane sync** | Routes refreshed to match new config |
+
+## Error Handling
+
+| Scenario | HTTP Status |
+|----------|-------------|
+| No route match | 404 Not Found |
+| Plugin not loaded / unhealthy | 503 Service Unavailable |
+| Plugin returns error via gRPC | 502 Bad Gateway |
+| gRPC timeout (60s unary / configurable stream) | 504 Gateway Timeout |
+| Auth required but missing/invalid | 401 Unauthorized |
+| Streaming error after headers sent | Connection closed, error logged |
+
+## Configuration
+
+### Streaming Timeout
+
+The streaming endpoint timeout is configurable via environment variable:
+
+| Environment Variable | Default | Description |
+|---------------------|---------|-------------|
+| `PLUGIN_ENDPOINT_STREAM_TIMEOUT` | `5m` | Maximum duration for streaming endpoint responses (SSE) |
+| `PLUGIN_ENDPOINT_MAX_BODY_SIZE` | `1048576` (1MB) | Maximum request body size for custom plugin endpoints |
+
+For long-running streaming connections (e.g., MCP proxy, real-time data feeds), increase the timeout:
+
+```bash
+PLUGIN_ENDPOINT_STREAM_TIMEOUT=30m
+```
+
+The upstream server should send periodic data to keep the connection alive within the timeout window.
diff --git a/ai-management/ai-studio/plugins/deployment.mdx b/ai-management/ai-studio/plugins/deployment.mdx
new file mode 100644
index 0000000000..75de68ecb2
--- /dev/null
+++ b/ai-management/ai-studio/plugins/deployment.mdx
@@ -0,0 +1,583 @@
+---
+title: "Tyk AI Studio Plugin Deployment Options"
+description: "Explore the three plugin deployment methods supported by Tyk AI Studio: local filesystem, remote gRPC, and OCI registry."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "Deployment Options"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph TD
+    A[Deployment Methods] --> B[Local File]
+    A --> C[Remote gRPC]
+    A --> D[OCI Registry]
+```
+
+
+Tyk AI Studio supports three plugin deployment methods: local filesystem (`file://`), remote gRPC (`grpc://`), and OCI registry (`oci://`). Choose the deployment method based on your environment and requirements.
+
+## Deployment Methods Comparison
+
+| Method | Use Case | Pros | Cons |
+|--------|----------|------|------|
+| `file://` | Development, testing | Fast, simple, easy debugging | Not suitable for production, requires filesystem access |
+| `grpc://` | Production, distributed systems | Remote deployment, scalable | Requires network setup, more complex |
+| `oci://` | Production, containerized | Version control, registry management | Requires OCI registry, packaging overhead |
+
+## file:// - Local Filesystem
+
+Deploy plugins from the local filesystem.
+
+> **Safety settings:** By default, local filesystem plugin loading has safety restrictions that prevent loading from arbitrary paths. For development, you may need to adjust these settings in your configuration to allow local path loading and absolute paths. See the Security Considerations section below for details on `ALLOW_INTERNAL_NETWORK_ACCESS` and `PLUGIN_COMMAND_ALLOWLIST`.
+
+### Building Your Plugin
+
+```bash
+# Build for current platform
+go build -o my-plugin main.go
+
+# Build for Linux (Docker/K8s deployment)
+GOOS=linux GOARCH=amd64 go build -o my-plugin-linux main.go
+
+# Make executable
+chmod +x my-plugin
+```
+
+### Creating Plugin via API
+
+```bash
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "My Plugin",
+    "slug": "my-plugin",
+    "command": "file:///absolute/path/to/my-plugin",
+    "hook_type": "pre_auth",
+    "plugin_type": "gateway",
+    "is_active": true
+  }'
+```
+
+**Important**: Use absolute paths with `file://`:
+
+```bash
+✅ file:///usr/local/bin/my-plugin
+✅ file:///home/user/plugins/my-plugin
+❌ file://./my-plugin  # Relative paths not supported
+❌ /usr/local/bin/my-plugin  # Missing file:// prefix
+```
+
+### Docker Deployment
+
+When deploying with Docker, mount plugins into the container:
+
+```yaml
+# docker-compose.yml
+services:
+  ai-studio:
+    image: tykio/ai-studio:latest
+    volumes:
+      - ./plugins:/plugins
+    environment:
+      - ALLOW_INTERNAL_NETWORK_ACCESS=true  # For development only
+```
+
+Then register with container path:
+
+```bash
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -d '{"command": "file:///plugins/my-plugin", ...}'
+```
+
+### Kubernetes Deployment
+
+Mount plugins via ConfigMap or PersistentVolume:
+
+```yaml Expandable
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plugins
+binaryData:
+  my-plugin: <base64-encoded-binary>
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ai-studio
+spec:
+  template:
+    spec:
+      containers:
+      - name: ai-studio
+        image: tykio/ai-studio:latest
+        volumeMounts:
+        - name: plugins
+          mountPath: /plugins
+      volumes:
+      - name: plugins
+        configMap:
+          name: plugins
+          defaultMode: 0755
+```
+
+## grpc:// - Remote gRPC
+
+Deploy plugins as remote gRPC services.
+
+### Running Plugin as gRPC Server
+
+Your plugin already implements gRPC via go-plugin. To run it as a remote service, you need a gRPC wrapper:
+
+```go Expandable
+package main
+
+import (
+    "log"
+    "net"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/ai_studio_sdk"
+    "google.golang.org/grpc"
+)
+
+func main() {
+    // Create gRPC server
+    lis, err := net.Listen("tcp", ":50051")
+    if err != nil {
+        log.Fatalf("Failed to listen: %v", err)
+    }
+
+    grpcServer := grpc.NewServer()
+
+    // Register your plugin
+    plugin := &MyPlugin{}
+    ai_studio_sdk.RegisterPluginServer(grpcServer, plugin)
+
+    log.Printf("Plugin gRPC server listening on :50051")
+    if err := grpcServer.Serve(lis); err != nil {
+        log.Fatalf("Failed to serve: %v", err)
+    }
+}
+```
+
+### Deploying with Docker
+
+```dockerfile
+FROM golang:1.21-alpine AS builder
+WORKDIR /build
+COPY . .
+RUN go build -o plugin-server main.go
+
+FROM alpine:latest
+COPY --from=builder /build/plugin-server /usr/local/bin/
+EXPOSE 50051
+CMD ["/usr/local/bin/plugin-server"]
+```
+
+```bash
+# Build and run
+docker build -t my-plugin-server .
+docker run -d -p 50051:50051 my-plugin-server
+```
+
+### Register Remote Plugin
+
+```bash
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{
+    "name": "My Remote Plugin",
+    "slug": "my-remote-plugin",
+    "command": "grpc://plugin-server:50051",
+    "hook_type": "pre_auth",
+    "plugin_type": "gateway",
+    "is_active": true
+  }'
+```
+
+### Network Configuration
+
+#### Internal Network Access
+
+By default, plugins cannot access internal networks. For development:
+
+```bash
+export ALLOW_INTERNAL_NETWORK_ACCESS=true
+```
+
+For production, use allowlist:
+
+```bash
+export PLUGIN_COMMAND_ALLOWLIST="grpc://10.0.0.0/8,grpc://172.16.0.0/12"
+```
+
+#### Load Balancing
+
+Use Kubernetes services for load balancing:
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-plugin
+spec:
+  selector:
+    app: my-plugin
+  ports:
+  - port: 50051
+    targetPort: 50051
+  type: ClusterIP
+```
+
+Register with service DNS:
+
+```bash
+"command": "grpc://my-plugin.default.svc.cluster.local:50051"
+```
+
+## oci:// - OCI Registry
+
+Deploy plugins as OCI artifacts in container registries.
+
+### Prerequisites
+
+- Docker or Podman
+- OCI-compatible registry (Docker Hub, GHCR, ECR, GCR, Harbor, etc.)
+- Registry credentials configured
+
+### Packaging Plugin as OCI Artifact
+
+Create a simple OCI image:
+
+```dockerfile
+FROM scratch
+COPY my-plugin /plugin
+ENTRYPOINT ["/plugin"]
+```
+
+Build and push:
+
+```bash
+# Build plugin binary
+go build -o my-plugin main.go
+
+# Build OCI image
+docker build -t registry.example.com/plugins/my-plugin:v1.0.0 .
+
+# Push to registry
+docker push registry.example.com/plugins/my-plugin:v1.0.0
+```
+
+### Registering OCI Plugin
+
+```bash
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{
+    "name": "My OCI Plugin",
+    "slug": "my-oci-plugin",
+    "command": "oci://registry.example.com/plugins/my-plugin:v1.0.0",
+    "oci_reference": "registry.example.com/plugins/my-plugin:v1.0.0",
+    "hook_type": "pre_auth",
+    "plugin_type": "gateway",
+    "is_active": true
+  }'
+```
+
+### Registry Authentication
+
+OCI registry authentication is configured via environment variables using the pattern:
+
+```
+OCI_PLUGINS_REGISTRY_<REGISTRY_NAME>_<FIELD>=<value>
+```
+
+Where `<REGISTRY_NAME>` is the registry hostname with dots replaced by underscores (e.g., `docker.tyk.io` → `DOCKER_TYK_IO`).
+
+#### Authentication Methods
+
+**Entitlement Token** (Cloudsmith and similar registries):
+
+```bash
+# Entitlement token — sent as Basic auth (username: "token", password: entitlement)
+OCI_PLUGINS_REGISTRY_DOCKER_TYK_IO_ENTITLEMENT=your-entitlement-token
+
+# Custom username for entitlement (default: "token")
+OCI_PLUGINS_REGISTRY_DOCKER_TYK_IO_ENTITLEMENTUSERNAME=custom-user
+```
+
+**Username + Password**:
+
+```bash
+OCI_PLUGINS_REGISTRY_GHCR_IO_USERNAME=github-user
+OCI_PLUGINS_REGISTRY_GHCR_IO_PASSWORDENV=GITHUB_TOKEN  # reads from this env var
+```
+
+**OAuth2/Bearer Token**:
+
+```bash
+OCI_PLUGINS_REGISTRY_REGISTRY_EXAMPLE_COM_TOKEN=your-access-token
+# Or read from env var:
+OCI_PLUGINS_REGISTRY_REGISTRY_EXAMPLE_COM_TOKENENV=MY_REGISTRY_TOKEN
+```
+
+#### AI Studio vs Edge Gateway
+
+Both runtimes use the same `OCI_PLUGINS_REGISTRY_*` environment variables for auth. The difference is in how OCI support is enabled:
+
+| Setting | AI Studio | Edge Gateway |
+|---------|-----------|-------------|
+| **Enable OCI** | `AI_STUDIO_OCI_CACHE_DIR=/path` | `OCI_PLUGINS_CACHE_DIR=/path` (default: `/var/lib/microgateway/plugins`) |
+| **Require signatures** | `AI_STUDIO_OCI_REQUIRE_SIGNATURE=true` | `OCI_PLUGINS_REQUIRE_SIGNATURE=true` |
+| **Registry auth** | `OCI_PLUGINS_REGISTRY_*` (shared) | `OCI_PLUGINS_REGISTRY_*` (shared) |
+
+**Important**: `AI_STUDIO_OCI_CACHE_DIR` must be set for OCI plugin support to be enabled in AI Studio. Without it, OCI plugins cannot be installed or loaded, and registry auth configuration is ignored.
+
+#### Signature Verification
+
+When signature verification is enabled (Enterprise Edition), the `cosign` tool verifies plugin signatures against the registry. Cosign uses the standard Docker credential store (`~/.docker/config.json`) for registry authentication — it does **not** use the `OCI_PLUGINS_REGISTRY_*` environment variables.
+
+To configure cosign auth in containerized environments:
+
+```bash
+# Create Docker config with registry credentials
+mkdir -p ~/.docker
+echo '{"auths":{"docker.tyk.io":{"auth":"'$(echo -n 'token:YOUR_ENTITLEMENT' | base64)'"}}}' > ~/.docker/config.json
+```
+
+For Kubernetes, mount a Docker config secret:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: oci-registry-creds
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: <base64-encoded-docker-config>
+```
+
+Configure public keys for signature verification:
+
+```bash
+# Public key for verifying plugin signatures
+OCI_PLUGINS_PUBLIC_KEY_1=/path/to/cosign.pub
+```
+
+#### Cloudsmith-Specific Notes
+
+When using Cloudsmith with a custom Docker domain (e.g., `docker.tyk.io`):
+
+- **Entitlement auth** is the recommended method for programmatic access
+- Entitlements bypass the Docker token exchange, which avoids scope issues with Cloudsmith's namespace-level scope requirements
+- Each Cloudsmith repository has its own entitlement tokens — use repository-level entitlements
+- The `ENTITLEMENT` auth type sends Basic auth directly on every request, which Cloudsmith supports natively
+
+### Version Management
+
+Use tags for version management:
+
+```bash
+# Development
+oci://registry.example.com/plugins/my-plugin:latest
+
+# Staging
+oci://registry.example.com/plugins/my-plugin:v1.2.3-rc.1
+
+# Production
+oci://registry.example.com/plugins/my-plugin:v1.2.3
+
+# Immutable digest
+oci://registry.example.com/plugins/my-plugin@sha256:abc123...
+```
+
+### Caching
+
+OCI plugins are pulled and cached locally:
+
+```bash
+# AI Studio
+AI_STUDIO_OCI_CACHE_DIR=/var/cache/ai-studio/plugins
+
+# Edge Gateway (defaults to /var/lib/microgateway/plugins)
+OCI_PLUGINS_CACHE_DIR=/var/cache/microgateway/plugins
+```
+
+## Security Considerations
+
+### Command Validation
+
+The platform validates plugin commands for security:
+
+1. **Absolute Paths**: `file://` commands must use absolute paths
+2. **Internal Network Block**: By default, `grpc://` commands cannot target internal IPs (10.x.x.x, 172.16-31.x.x, 192.168.x.x, 127.x.x.x, localhost)
+3. **Allowlist**: Configure allowed commands via `PLUGIN_COMMAND_ALLOWLIST`
+
+Example warnings:
+
+```
+⚠️  PLUGIN SECURITY WARNING: Plugin command uses absolute path outside standard directories.
+⚠️  PLUGIN SECURITY WARNING: Plugin command targets internal network address
+```
+
+### Production Security
+
+For production deployments:
+
+1. **Disable Internal Network Access**:
+   ```bash
+   export ALLOW_INTERNAL_NETWORK_ACCESS=false
+   export PLUGIN_BLOCK_INTERNAL_URLS=true
+   ```
+
+2. **Use Allowlist**:
+   ```bash
+   export PLUGIN_COMMAND_ALLOWLIST="/usr/local/plugins/*,grpc://plugins.prod.svc/*"
+   ```
+
+3. **Use OCI with Signed Images**:
+   - Sign images with Cosign or Notary
+   - Verify signatures before deployment
+   - Use content trust
+
+4. **Principle of Least Privilege**:
+   - Run plugins with minimal permissions
+   - Use read-only filesystems where possible
+   - Implement network policies in Kubernetes
+
+## Troubleshooting
+
+
+<AccordionGroup>
+
+<Accordion title="Plugin Not Loading">
+
+**Symptoms**: Plugin shows as inactive, errors in logs
+
+**Solutions**:
+- Verify plugin binary has execute permissions (`chmod +x`)
+- Check absolute path is correct for `file://`
+- Verify network connectivity for `grpc://`
+- Check registry authentication for `oci://`
+- Review plugin logs for initialization errors
+
+</Accordion>
+
+<Accordion title="Permission Denied">
+
+**Symptoms**: "Permission denied" error when loading plugin
+
+**Solutions**:
+
+```bash
+# Check file permissions
+ls -la /path/to/plugin
+
+# Make executable
+chmod +x /path/to/plugin
+
+# Check SELinux context (if applicable)
+chcon -t container_file_t /path/to/plugin
+````
+
+</Accordion>
+
+<Accordion title="Network Connection Errors">
+
+**Symptoms**: "connection refused", "no route to host" for `grpc://`
+
+**Solutions**:
+
+* Verify plugin server is running: `telnet plugin-host 50051`
+* Check firewall rules
+* Verify Kubernetes service is created
+* Check DNS resolution
+* Enable internal network access if needed (development only)
+
+</Accordion>
+
+<Accordion title="OCI Pull Failures">
+
+**Symptoms**: "Failed to pull image", "authentication required"
+
+**Solutions**:
+
+* Verify registry URL is correct
+* Check credentials are configured
+* Test manual pull: `docker pull registry.example.com/plugins/my-plugin:v1.0.0`
+* Check registry permissions
+* Verify image exists with correct tag
+
+</Accordion>
+
+<Accordion title="Plugin Crashes on Start">
+
+**Symptoms**: Plugin loads but immediately crashes
+
+**Solutions**:
+
+* Check plugin logs for panics
+* Verify Go version compatibility
+* Check for missing dependencies
+* Test plugin standalone: `./my-plugin`
+* Review initialization code for errors
+
+</Accordion>
+
+</AccordionGroup>
+
+## Best Practices
+
+### Development Workflow
+
+1. **Local Development**: Use `file://` for fast iteration
+2. **Reload Loop**: Use `POST /api/v1/plugins/{id}/reload` to test changes instantly
+3. **Testing**: Deploy to staging with `grpc://` or `oci://`
+4. **Production**: Use `oci://` with versioned tags
+
+**See [Plugin Development Workflow](/ai-management/ai-studio/plugins/development-workflow)** for detailed setup, helper scripts, and the fastest development loop.
+
+### Version Management
+
+1. Use semantic versioning
+2. Tag releases in Git and OCI registry
+3. Never reuse tags (immutable releases)
+4. Document breaking changes
+
+### Deployment Pipeline
+
+```bash Expandable
+# 1. Build
+go build -o plugin main.go
+
+# 2. Test locally
+./plugin  # Verify it runs
+
+# 3. Package
+docker build -t registry.example.com/plugins/my-plugin:v1.2.3 .
+
+# 4. Push
+docker push registry.example.com/plugins/my-plugin:v1.2.3
+
+# 5. Deploy to staging
+curl -X POST .../plugins -d '{"command": "oci://registry.../my-plugin:v1.2.3-rc.1", ...}'
+
+# 6. Test in staging
+# Run integration tests
+
+# 7. Deploy to production
+curl -X POST .../plugins -d '{"command": "oci://registry.../my-plugin:v1.2.3", ...}'
+```
+
+### Monitoring
+
+- Monitor plugin health via `/api/v1/plugins/{id}/health`
+- Track plugin performance metrics
+- Set up alerts for plugin failures
+- Log all plugin operations
+
diff --git a/ai-management/ai-studio/plugins/development-workflow.mdx b/ai-management/ai-studio/plugins/development-workflow.mdx
new file mode 100644
index 0000000000..66e9400edd
--- /dev/null
+++ b/ai-management/ai-studio/plugins/development-workflow.mdx
@@ -0,0 +1,453 @@
+---
+title: "Tyk AI Studio Plugin Development Workflow"
+description: "A guide to develop and test Tyk AI Studio plugins locally using file:// paths and the reload API for instant iteration."
+keywords: "AI Studio, AI Management"
+sidebarTitle: "Development Workflow"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+This page covers the fastest way to develop and test plugins locally. The key insight: **use `file://` paths and the reload API for instant iteration without reinstalling the plugin**.
+
+## Quick Start: 5-Minute Setup
+
+### 1. Create Your Plugin
+
+```bash
+mkdir my-plugin && cd my-plugin
+go mod init my-plugin
+```
+
+Create `main.go`:
+
+```go Expandable
+package main
+
+import (
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+)
+
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+func NewMyPlugin() *MyPlugin {
+    return &MyPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin("my-plugin", "1.0.0", "My test plugin"),
+    }
+}
+
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    ctx.Services.Logger().Info("Plugin initialized!")
+    return nil
+}
+
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    ctx.Services.Logger().Info("Request intercepted", "path", req.Request.Path)
+    return &pb.PluginResponse{Modified: false}, nil
+}
+
+func main() {
+    plugin_sdk.Serve(NewMyPlugin())
+}
+```
+
+### 2. Build and Get Absolute Path
+
+```bash
+go build -o my-plugin .
+PLUGIN_PATH="$(pwd)/my-plugin"
+echo $PLUGIN_PATH  # e.g., /Users/you/projects/my-plugin/my-plugin
+```
+
+### 3. Register Plugin Once
+
+```bash Expandable
+# Get your auth token (login first)
+TOKEN="your-auth-token"
+
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "My Plugin",
+    "slug": "my-plugin",
+    "command": "file://'$PLUGIN_PATH'",
+    "hook_type": "post_auth",
+    "plugin_type": "gateway",
+    "is_active": true
+  }'
+```
+
+**Save the plugin ID from the response!**
+
+### 4. Development Loop
+
+Now you can iterate without reinstalling:
+
+```bash
+# Make changes to main.go, then:
+go build -o my-plugin . && curl -X POST http://localhost:3000/api/v1/plugins/{PLUGIN_ID}/reload \
+  -H "Authorization: Bearer $TOKEN"
+```
+
+That's it! Your changes are live instantly.
+
+---
+
+## The Development Loop Explained
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                    PLUGIN DEVELOPMENT LOOP                      │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                 │
+│   1. Edit Code                                                  │
+│      └── main.go, manifest.json, etc.                           │ 
+│                           ↓                                     │
+│   2. Build                                                      │
+│      └── go build -o my-plugin .                                │
+│                           ↓                                     │
+│   3. Reload (ONE command!)                                      │
+│      └── curl -X POST .../plugins/{id}/reload                   │
+│                           ↓                                     │
+│   4. Test                                                       │
+│      └── Make requests, check logs, verify behavior             │
+│                           ↓                                     │
+│   5. Repeat from Step 1                                         │
+│                                                                 │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+### When Do You Need to Reinstall?
+
+You **only** need to update the plugin registration (not just reload) when:
+
+| Change | Reload Sufficient? | Action Needed |
+|--------|-------------------|---------------|
+| Code logic changes | ✅ Yes | Just rebuild + reload |
+| Adding new log statements | ✅ Yes | Just rebuild + reload |
+| Configuration handling changes | ✅ Yes | Just rebuild + reload |
+| Adding new capabilities (interfaces) | ✅ Yes | Just rebuild + reload |
+| **Manifest permission changes** | ❌ No | Update plugin or recreate |
+| **Hook type changes** | ❌ No | Update plugin `hook_type` field |
+| **Plugin type changes** | ❌ No | Recreate plugin |
+
+
+## Development Environment Setup
+
+### Option 1: Local AI Studio (Recommended for Speed)
+
+Run AI Studio locally for fastest iteration:
+
+```bash
+# Start AI Studio
+make start-dev
+
+# Set environment for plugin development
+export ALLOW_INTERNAL_NETWORK_ACCESS=true
+```
+
+### Option 2: Docker Compose
+
+Mount your plugin directory:
+
+```yaml
+# docker-compose.override.yml
+services:
+  ai-studio:
+    volumes:
+      - ./my-plugins:/plugins
+    environment:
+      - ALLOW_INTERNAL_NETWORK_ACCESS=true
+```
+
+Then use container paths:
+```bash
+"command": "file:///plugins/my-plugin"
+```
+
+### Option 3: Remote AI Studio
+
+For remote instances, use `grpc://` deployment during development:
+
+```bash
+# Run plugin as gRPC server locally
+go run main.go --grpc-server :50051
+
+# Register with remote instance
+"command": "grpc://your-local-ip:50051"
+```
+
+---
+
+## Helper Scripts
+
+### `dev.sh` - One-Command Development
+
+Create this script in your plugin directory:
+
+```bash Expandable
+#!/bin/bash
+# dev.sh - Build and reload plugin in one command
+
+PLUGIN_ID="${PLUGIN_ID:-your-plugin-id}"
+API_URL="${API_URL:-http://localhost:3000}"
+TOKEN="${TOKEN:-your-token}"
+
+echo "Building..."
+go build -o my-plugin . || exit 1
+
+echo "Reloading plugin $PLUGIN_ID..."
+curl -s -X POST "$API_URL/api/v1/plugins/$PLUGIN_ID/reload" \
+  -H "Authorization: Bearer $TOKEN" | jq .
+
+echo "Done! Check logs with: tail -f /path/to/ai-studio.log | grep my-plugin"
+```
+
+Usage:
+```bash
+chmod +x dev.sh
+export PLUGIN_ID=123 TOKEN=xxx
+./dev.sh
+```
+
+### `watch.sh` - Auto-Rebuild on Save
+
+```bash Expandable
+#!/bin/bash
+# watch.sh - Watch for changes and auto-reload
+
+PLUGIN_ID="${PLUGIN_ID:-your-plugin-id}"
+API_URL="${API_URL:-http://localhost:3000}"
+TOKEN="${TOKEN:-your-token}"
+
+echo "Watching for changes... (Ctrl+C to stop)"
+
+# Using fswatch (macOS: brew install fswatch)
+fswatch -o *.go | while read; do
+  echo "Change detected, rebuilding..."
+  go build -o my-plugin . && \
+  curl -s -X POST "$API_URL/api/v1/plugins/$PLUGIN_ID/reload" \
+    -H "Authorization: Bearer $TOKEN" > /dev/null && \
+  echo "✓ Reloaded at $(date +%H:%M:%S)"
+done
+```
+
+
+## Project Structure Recommendations
+
+```
+my-plugin/
+├── main.go              # Plugin entry point
+├── plugin.go            # Core plugin logic
+├── config.go            # Configuration handling
+├── manifest.json        # Plugin manifest (embed with //go:embed)
+├── config.schema.json   # Config JSON schema (embed)
+├── dev.sh               # Development helper script
+├── Makefile             # Build targets
+└── ui/                  # UI assets (if UI plugin)
+    ├── index.html
+    └── bundle.js
+```
+
+### Makefile Example
+
+```makefile Expandable
+PLUGIN_ID ?= your-plugin-id
+API_URL ?= http://localhost:3000
+TOKEN ?= your-token
+
+.PHONY: build reload dev clean
+
+build:
+	go build -o my-plugin .
+
+reload:
+	curl -s -X POST $(API_URL)/api/v1/plugins/$(PLUGIN_ID)/reload \
+		-H "Authorization: Bearer $(TOKEN)"
+
+dev: build reload
+	@echo "Plugin reloaded!"
+
+clean:
+	rm -f my-plugin
+
+# First-time setup
+install: build
+	curl -X POST $(API_URL)/api/v1/plugins \
+		-H "Authorization: Bearer $(TOKEN)" \
+		-H "Content-Type: application/json" \
+		-d '{"name":"My Plugin","slug":"my-plugin","command":"file://$(PWD)/my-plugin","hook_type":"post_auth","plugin_type":"gateway","is_active":true}'
+```
+
+Usage:
+```bash
+make dev  # Build and reload in one command
+```
+
+## Debugging Tips
+
+<AccordionGroup>
+
+<Accordion title="View Plugin Logs">
+
+Plugin logs go to AI Studio's log output:
+
+```bash
+# If running locally
+tail -f /path/to/logs | grep "my-plugin"
+
+# Docker
+docker logs -f ai-studio 2>&1 | grep "my-plugin"
+
+# Filter by plugin name
+... | grep "\[my-plugin\]"
+````
+
+</Accordion>
+
+<Accordion title="Add Debug Logging">
+
+```go Expandable
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Debug logging - shows in AI Studio logs
+    ctx.Services.Logger().Debug("Request details",
+        "method", req.Request.Method,
+        "path", req.Request.Path,
+        "headers", req.Request.Headers,
+        "body_length", len(req.Request.Body),
+    )
+
+    // Add more detailed logging during development
+    ctx.Services.Logger().Info("Processing request",
+        "app_id", ctx.AppID,
+        "user_id", ctx.UserID,
+        "runtime", ctx.Runtime,
+    )
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+</Accordion>
+
+<Accordion title="Check Plugin Status">
+
+```bash
+# Get plugin status
+curl http://localhost:3000/api/v1/plugins/$PLUGIN_ID/status \
+  -H "Authorization: Bearer $TOKEN" | jq .
+
+# List all loaded plugins
+curl http://localhost:3000/api/v1/plugins/loaded \
+  -H "Authorization: Bearer $TOKEN" | jq .
+```
+
+</Accordion>
+
+<Accordion title="Test Plugin Standalone">
+
+Before registering, test your plugin runs:
+
+```bash
+# This should start and wait for gRPC connection
+./my-plugin
+
+# If it crashes immediately, check for:
+# - Missing dependencies
+# - Invalid manifest
+# - Initialization errors
+```
+
+</Accordion>
+
+</AccordionGroup>
+
+## Common Issues and Resolution
+
+<AccordionGroup>
+
+<Accordion title="Plugin Not Loading After Reload">
+
+**Symptoms**: Reload returns success but changes aren't reflected
+
+**Solutions**:
+
+```bash
+# 1. Verify build succeeded
+go build -o my-plugin . && echo "Build OK"
+
+# 2. Check the binary was actually updated
+ls -la my-plugin
+
+# 3. Verify reload endpoint returned success
+curl -X POST .../reload -H "..." | jq .status
+
+# 4. Check AI Studio logs for errors
+tail -100 /path/to/logs | grep -i error
+````
+
+</Accordion>
+
+<Accordion title='"Permission Denied" on Reload'>
+
+**Symptoms**: Reload fails with permission error
+
+**Solutions**:
+
+```bash
+# Make binary executable
+chmod +x my-plugin
+
+# Check file ownership (Docker)
+ls -la my-plugin
+# May need: chown 1000:1000 my-plugin (for Docker user)
+```
+
+</Accordion>
+
+<Accordion title="Changes Not Taking Effect">
+
+**Symptoms**: Old behavior persists after reload
+
+**Solutions**:
+
+```bash
+# 1. Verify you're building to the right path
+which my-plugin  # vs ./my-plugin
+
+# 2. Check plugin command points to your binary
+curl http://localhost:3000/api/v1/plugins/$PLUGIN_ID | jq .command
+
+# 3. Force deactivate and reactivate
+curl -X PATCH .../plugins/$PLUGIN_ID -d '{"is_active": false}'
+curl -X PATCH .../plugins/$PLUGIN_ID -d '{"is_active": true, "load_immediately": true}'
+```
+
+</Accordion>
+
+<Accordion title="Manifest Changes Not Applied">
+
+**Symptoms**: New UI components or permissions not appearing
+
+**Solutions**:
+
+```bash
+# Manifest requires explicit re-parsing after reload
+curl -X POST http://localhost:3000/api/v1/plugins/$PLUGIN_ID/manifest/parse \
+  -H "Authorization: Bearer $TOKEN"
+
+# Or update the plugin entirely
+curl -X PATCH http://localhost:3000/api/v1/plugins/$PLUGIN_ID \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{"manifest": {...}}'
+```
+
+</Accordion>
+
+</AccordionGroup>
diff --git a/ai-management/ai-studio/plugins/edge-gateway.mdx b/ai-management/ai-studio/plugins/edge-gateway.mdx
new file mode 100644
index 0000000000..042f324c29
--- /dev/null
+++ b/ai-management/ai-studio/plugins/edge-gateway.mdx
@@ -0,0 +1,901 @@
+---
+title: "Tyk AI Studio Edge Gateway Plugins"
+description: "Learn how to use Edge Gateway plugins to provide middleware hooks in the LLM proxy request/response pipeline for custom authentication, transformation, and data collection."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "Edge Gateway"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph LR
+    A[Request] --> B[PreAuth]
+    B --> C[Auth]
+    C --> D[PostAuth]
+    D --> E[Upstream LLM]
+    E --> F[Response Hook]
+    F --> G[Client]
+```
+
+Edge Gateway plugins provide middleware hooks in the LLM proxy request/response pipeline using the **Unified Plugin SDK**. Use them for custom authentication, request/response transformation, content filtering, and data collection to external systems.
+
+All Edge Gateway plugins now use `pkg/plugin_sdk`, which automatically detects the Gateway runtime and provides access to universal services (KV storage, logging) and Gateway-specific services (app management, budget status).
+
+## Plugin Capabilities
+
+Edge Gateway plugins implement one or more of these capability interfaces:
+
+### 1. PreAuthHandler
+
+**Interface**: `PreAuthHandler`
+**Method**: `HandlePreAuth(ctx Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error)`
+
+Executes **before** authentication. Use for:
+- Request validation and early rejection
+- Request enrichment with metadata
+- Header modification
+- Logging and auditing
+
+**Working Example**: [`examples/plugins/gateway/request_enricher/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/request_enricher)
+
+### 2. AuthHandler
+
+**Interface**: `AuthHandler`
+**Method**: `HandleAuth(ctx Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error)`
+
+**Replaces** default token authentication. Use for:
+- Custom authentication schemes (OAuth, JWT, API keys)
+- Integration with external identity providers
+- Multi-factor authentication
+- Custom authorization logic
+
+**Note**: Unified SDK provides credential validation via `ctx.Services.Gateway().ValidateCredential()`
+
+### 3. PostAuthHandler
+
+**Interface**: `PostAuthHandler`
+**Method**: `HandlePostAuth(ctx Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error)`
+
+Executes **after** authentication. Most common capability for gateway plugins. Use for:
+- Enriching requests with user-specific data
+- Per-user request transformation
+- Access control enforcement
+- Usage quota checks
+
+**Working Example**: [`examples/plugins/gateway/request_enricher/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/request_enricher)
+
+### 4. ResponseHandler
+
+**Interface**: `ResponseHandler`
+**Methods**:
+- `OnBeforeWriteHeaders(ctx Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error)`
+- `OnBeforeWrite(ctx Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error)`
+
+Modifies LLM responses before returning to client. Two-phase processing:
+- **OnBeforeWriteHeaders**: Modify response headers
+- **OnBeforeWrite**: Modify response body
+
+Use for:
+- Response filtering and content moderation
+- Response transformation and formatting
+- Injecting additional metadata
+- Response validation
+
+**Working Example**: [`examples/plugins/gateway/response_modifier/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/response_modifier)
+
+### 5. DataCollector
+
+**Interface**: `DataCollector`
+**Methods**:
+- `HandleProxyLog(ctx Context, log *pb.ProxyLogData) error`
+- `HandleAnalytics(ctx Context, analytics *pb.AnalyticsData) error`
+- `HandleBudgetUsage(ctx Context, usage *pb.BudgetUsageData) error`
+
+Intercepts data before database storage. Use for:
+- Exporting proxy logs to external systems
+- Sending analytics to data warehouses
+- Custom budget tracking
+- Real-time monitoring and alerting
+
+**Working Examples**:
+- [`examples/plugins/data-collectors/file-analytics-collector/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/data-collectors/file-analytics-collector) (unified SDK)
+- [`examples/plugins/data-collectors/file-budget-collector/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/data-collectors/file-budget-collector) (unified SDK)
+- [`examples/plugins/data-collectors/file-proxy-collector/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/data-collectors/file-proxy-collector) (unified SDK)
+- [`examples/plugins/gateway/legacy-collectors/elasticsearch_collector/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/legacy-collectors/elasticsearch_collector)
+
+### 6. CustomEndpointHandler
+
+**Interface**: `CustomEndpointHandler`
+**Methods**:
+- `GetEndpointRegistrations() ([]*pb.EndpointRegistration, error)`
+- `HandleEndpointRequest(ctx Context, req *pb.EndpointRequest) (*pb.EndpointResponse, error)`
+- `HandleEndpointRequestStream(ctx Context, req *pb.EndpointRequest, stream grpc.ServerStreamingServer[pb.EndpointResponseChunk]) error`
+
+Registers and serves custom HTTP endpoints under `/plugins/{slug}/`. Plugins have full control over the response. Use for:
+- Custom APIs (OAuth endpoints, webhooks, health checks)
+- MCP Streamable HTTP proxy servers
+- Protocol-specific proxies
+- Any endpoint that doesn't fit the LLM/Tool/Datasource model
+
+Supports both unary responses and streaming (SSE) via the `stream_response` flag on endpoint registrations.
+
+**Full Guide**: [Custom Endpoints Guide](/ai-management/ai-studio/plugins/custom-endpoints)
+
+## Quick Start
+
+### 1. Project Setup
+
+```bash
+# Create plugin directory
+mkdir my-gateway-plugin && cd my-gateway-plugin
+
+# Initialize Go module
+go mod init github.com/myorg/my-gateway-plugin
+
+# Add unified SDK dependency
+go get github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk
+```
+
+### 2. Implement Plugin Structure
+
+Use the unified SDK with `BasePlugin` convenience struct:
+
+```go Expandable
+package main
+
+import (
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+)
+
+type MyGatewayPlugin struct {
+    plugin_sdk.BasePlugin
+    apiKey string
+}
+
+func NewMyGatewayPlugin() *MyGatewayPlugin {
+    return &MyGatewayPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "my-gateway-plugin",
+            "1.0.0",
+            "Custom gateway middleware",
+        ),
+    }
+}
+
+// Initialize is called when plugin starts
+func (p *MyGatewayPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    // Parse configuration
+    p.apiKey = config["api_key"]
+
+    ctx.Services.Logger().Info("Plugin initialized",
+        "runtime", ctx.Runtime,
+    )
+
+    return nil
+}
+
+// Shutdown performs cleanup
+func (p *MyGatewayPlugin) Shutdown() error {
+    return nil
+}
+
+func main() {
+    plugin_sdk.Serve(NewMyGatewayPlugin())
+}
+```
+
+### 3. Implement Capability Interfaces
+
+Implement one or more capability interfaces based on your needs:
+
+#### PostAuthHandler (Most Common)
+
+```go Expandable
+// Implement PostAuthHandler interface
+func (p *MyGatewayPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Log request
+    ctx.Services.Logger().Info("Processing request",
+        "app_id", ctx.AppID,
+        "user_id", ctx.UserID,
+        "path", req.Path,
+    )
+
+    // Enrich request with custom header
+    if req.Headers == nil {
+        req.Headers = make(map[string]string)
+    }
+    req.Headers["X-Custom-Header"] = "gateway-plugin"
+    req.Headers["X-App-ID"] = fmt.Sprintf("%d", ctx.AppID)
+
+    return &pb.PluginResponse{
+        Modified: true,
+        Request:  req,
+    }, nil
+}
+```
+
+#### PreAuthHandler
+
+```go Expandable
+// Implement PreAuthHandler interface
+func (p *MyGatewayPlugin) HandlePreAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Validate request early
+    if req.Method != "POST" {
+        return &pb.PluginResponse{
+            Block:        true,
+            ErrorMessage: "Only POST requests allowed",
+        }, nil
+    }
+
+    // Check budget before processing
+    if ctx.Runtime == plugin_sdk.RuntimeGateway {
+        status, err := ctx.Services.Gateway().GetBudgetStatus(ctx, ctx.AppID)
+        if err == nil {
+            budgetResp := status.(*gwmgmt.GetBudgetStatusResponse)
+            if budgetResp.RemainingBudget <= 0 {
+                return &pb.PluginResponse{
+                    Block:        true,
+                    ErrorMessage: "Budget exceeded",
+                }, nil
+            }
+        }
+    }
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+#### ResponseHandler
+
+```go Expandable
+// Implement ResponseHandler interface
+func (p *MyGatewayPlugin) OnBeforeWriteHeaders(ctx plugin_sdk.Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error) {
+    // Add custom response headers
+    if req.Headers == nil {
+        req.Headers = make(map[string]string)
+    }
+    req.Headers["X-Processed-By"] = "gateway-plugin"
+    req.Headers["X-Request-ID"] = req.RequestId
+
+    return &pb.ResponseWriteResponse{
+        Modified: true,
+        Headers:  req.Headers,
+    }, nil
+}
+
+func (p *MyGatewayPlugin) OnBeforeWrite(ctx plugin_sdk.Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error) {
+    // Modify response body if needed
+    modifiedBody := transformResponse(req.Body)
+
+    return &pb.ResponseWriteResponse{
+        Modified: true,
+        Body:     modifiedBody,
+    }, nil
+}
+```
+
+#### DataCollector
+
+```go Expandable
+// Implement DataCollector interface
+func (p *MyGatewayPlugin) HandleProxyLog(ctx plugin_sdk.Context, log *pb.ProxyLogData) error {
+    // Export to external system
+    ctx.Services.Logger().Debug("Proxy log received",
+        "app_id", log.AppId,
+        "vendor", log.Vendor,
+        "status", log.ResponseCode,
+    )
+
+    return p.sendToElasticsearch(ctx, log)
+}
+
+func (p *MyGatewayPlugin) HandleAnalytics(ctx plugin_sdk.Context, analytics *pb.AnalyticsData) error {
+    // Process analytics
+    ctx.Services.Logger().Debug("Analytics received",
+        "llm_id", analytics.LlmId,
+        "tokens", analytics.TotalTokens,
+        "cost", analytics.Cost,
+    )
+
+    return p.sendAnalytics(ctx, analytics)
+}
+
+func (p *MyGatewayPlugin) HandleBudgetUsage(ctx plugin_sdk.Context, usage *pb.BudgetUsageData) error {
+    // Track budget usage
+    ctx.Services.Logger().Debug("Budget usage",
+        "app_id", usage.AppId,
+        "cost", usage.Cost,
+    )
+
+    return p.trackBudget(ctx, usage)
+}
+```
+
+### 4. Build Plugin
+
+```bash
+# Build for current platform
+go build -o my-plugin main.go
+
+# Build for Linux (if deploying to Docker/K8s)
+GOOS=linux GOARCH=amd64 go build -o my-plugin-linux main.go
+```
+
+### 5. Deploy Plugin
+
+Create plugin in AI Studio dashboard or via API:
+
+```bash
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -H "Authorization: Bearer YOUR_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "My Plugin",
+    "slug": "my-plugin",
+    "description": "Custom plugin",
+    "command": "file:///path/to/my-plugin",
+    "hook_type": "pre_auth",
+    "is_active": true,
+    "plugin_type": "gateway"
+  }'
+```
+
+### 6. Attach to LLM
+
+Associate the plugin with an LLM to activate it:
+
+```bash
+curl -X PUT http://localhost:3000/api/v1/llms/1/plugins \
+  -H "Authorization: Bearer YOUR_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "plugin_ids": [1, 2, 3]
+  }'
+```
+
+## Configuration Schema
+
+Provide JSON Schema for plugin configuration using the `ConfigSchemaProvider` interface:
+
+```go
+//go:embed config.schema.json
+var configSchema []byte
+
+func (p *MyPlugin) GetConfigSchema() ([]byte, error) {
+    return configSchema, nil
+}
+```
+
+Example `config.schema.json`:
+
+```json Expandable
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "api_key": {
+      "type": "string",
+      "description": "API key for external service",
+      "minLength": 1
+    },
+    "endpoint": {
+      "type": "string",
+      "format": "uri",
+      "description": "External service endpoint",
+      "default": "https://api.example.com"
+    },
+    "batch_size": {
+      "type": "integer",
+      "description": "Batch size for data collection",
+      "minimum": 1,
+      "maximum": 1000,
+      "default": 100
+    }
+  },
+  "required": ["api_key"]
+}
+```
+
+Configuration values are passed to `Initialize()` and can be updated via the API.
+
+## Complete Examples
+
+### Example 1: Custom Authentication Plugin
+
+This example uses the **Unified SDK** for consistency with other gateway plugins like `llm-firewall` and `llm-cache`.
+
+```go Expandable
+package main
+
+import (
+    "strings"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+)
+
+type CustomAuthPlugin struct {
+    plugin_sdk.BasePlugin
+    validToken string
+}
+
+func NewCustomAuthPlugin() *CustomAuthPlugin {
+    return &CustomAuthPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "custom-auth",
+            "1.0.0",
+            "Custom token authentication plugin",
+        ),
+    }
+}
+
+func (p *CustomAuthPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    // Parse configuration
+    if token, ok := config["valid_token"]; ok && token != "" {
+        p.validToken = token
+    } else {
+        p.validToken = "default-token"
+    }
+
+    ctx.Services.Logger().Info("CustomAuthPlugin initialized",
+        "runtime", ctx.Runtime,
+    )
+
+    return nil
+}
+
+func (p *CustomAuthPlugin) Shutdown(ctx plugin_sdk.Context) error {
+    return nil
+}
+
+// HandleAuth implements the AuthHandler interface
+func (p *CustomAuthPlugin) HandleAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Extract token from Authorization header
+    authHeader := ""
+    if req.Request != nil && req.Request.Headers != nil {
+        authHeader = req.Request.Headers["Authorization"]
+    }
+
+    token := strings.TrimPrefix(authHeader, "Bearer ")
+
+    if token == p.validToken {
+        ctx.Services.Logger().Info("Authentication successful",
+            "request_id", ctx.RequestID,
+        )
+
+        return &pb.PluginResponse{
+            Modified: true,
+            Credential: &pb.Credential{
+                UserID:   "plugin-user",
+                Username: "Plugin User",
+                Claims: map[string]string{
+                    "source": "custom-auth-plugin",
+                },
+            },
+        }, nil
+    }
+
+    ctx.Services.Logger().Warn("Authentication failed",
+        "request_id", ctx.RequestID,
+        "token_provided", token != "",
+    )
+
+    return &pb.PluginResponse{
+        Block:        true,
+        StatusCode:   401,
+        ErrorMessage: "Invalid token",
+        Headers: map[string]string{
+            "WWW-Authenticate": "Bearer",
+        },
+    }, nil
+}
+
+func main() {
+    plugin := NewCustomAuthPlugin()
+    plugin_sdk.Serve(plugin)
+}
+```
+
+**Working Example**: See [`plugins/llm-firewall/`](https://github.com/TykTechnologies/ai-studio-community-plugins/tree/main/plugins/llm-firewall) for a production-ready content filtering plugin using this pattern.
+
+### Example 2: Elasticsearch Data Collector
+
+```go Expandable
+package main
+
+import (
+    "bytes"
+    "context"
+    "encoding/json"
+    "fmt"
+    "net/http"
+    "time"
+
+    "github.com/TykTechnologies/midsommar/microgateway/plugins/sdk"
+)
+
+type ElasticsearchCollector struct {
+    esURL  string
+    client *http.Client
+}
+
+func (p *ElasticsearchCollector) Initialize(config map[string]interface{}) error {
+    if url, ok := config["elasticsearch_url"].(string); ok {
+        p.esURL = url
+    } else {
+        p.esURL = "http://localhost:9200"
+    }
+
+    p.client = &http.Client{Timeout: 10 * time.Second}
+    return nil
+}
+
+func (p *ElasticsearchCollector) GetHookType() sdk.HookType {
+    return sdk.HookTypeDataCollection
+}
+
+func (p *ElasticsearchCollector) GetName() string {
+    return "elasticsearch-collector"
+}
+
+func (p *ElasticsearchCollector) GetVersion() string {
+    return "1.0.0"
+}
+
+func (p *ElasticsearchCollector) Shutdown() error {
+    return nil
+}
+
+func (p *ElasticsearchCollector) HandleProxyLog(ctx context.Context,
+    req *sdk.ProxyLogData,
+    pluginCtx *sdk.PluginContext) (*sdk.DataCollectionResponse, error) {
+
+    doc := map[string]interface{}{
+        "@timestamp":    req.Timestamp.Format(time.RFC3339),
+        "app_id":        req.AppID,
+        "user_id":       req.UserID,
+        "vendor":        req.Vendor,
+        "request_body":  string(req.RequestBody),
+        "response_body": string(req.ResponseBody),
+        "response_code": req.ResponseCode,
+        "request_id":    req.RequestID,
+    }
+
+    indexName := fmt.Sprintf("microgateway-proxy-logs-%s",
+        req.Timestamp.Format("2006.01.02"))
+
+    if err := p.indexDocument(ctx, indexName, doc); err != nil {
+        return &sdk.DataCollectionResponse{
+            Success:      false,
+            Handled:      false,
+            ErrorMessage: err.Error(),
+        }, nil
+    }
+
+    return &sdk.DataCollectionResponse{
+        Success: true,
+        Handled: true, // Don't store in database
+    }, nil
+}
+
+func (p *ElasticsearchCollector) HandleAnalytics(ctx context.Context,
+    req *sdk.AnalyticsData,
+    pluginCtx *sdk.PluginContext) (*sdk.DataCollectionResponse, error) {
+
+    doc := map[string]interface{}{
+        "@timestamp":      req.Timestamp.Format(time.RFC3339),
+        "llm_id":         req.LLMID,
+        "model_name":     req.ModelName,
+        "vendor":         req.Vendor,
+        "prompt_tokens":  req.PromptTokens,
+        "response_tokens": req.ResponseTokens,
+        "total_tokens":   req.TotalTokens,
+        "cost":           req.Cost,
+        "request_id":     req.RequestID,
+    }
+
+    indexName := fmt.Sprintf("microgateway-analytics-%s",
+        req.Timestamp.Format("2006.01.02"))
+
+    if err := p.indexDocument(ctx, indexName, doc); err != nil {
+        return &sdk.DataCollectionResponse{
+            Success:      false,
+            Handled:      false,
+            ErrorMessage: err.Error(),
+        }, nil
+    }
+
+    return &sdk.DataCollectionResponse{
+        Success: true,
+        Handled: true,
+    }, nil
+}
+
+func (p *ElasticsearchCollector) HandleBudgetUsage(ctx context.Context,
+    req *sdk.BudgetUsageData,
+    pluginCtx *sdk.PluginContext) (*sdk.DataCollectionResponse, error) {
+
+    doc := map[string]interface{}{
+        "@timestamp":      req.Timestamp.Format(time.RFC3339),
+        "app_id":         req.AppID,
+        "llm_id":         req.LLMID,
+        "tokens_used":    req.TokensUsed,
+        "cost":           req.Cost,
+        "requests_count": req.RequestsCount,
+        "period_start":   req.PeriodStart.Format(time.RFC3339),
+        "period_end":     req.PeriodEnd.Format(time.RFC3339),
+    }
+
+    indexName := fmt.Sprintf("microgateway-budget-%s",
+        req.Timestamp.Format("2006.01.02"))
+
+    if err := p.indexDocument(ctx, indexName, doc); err != nil {
+        return &sdk.DataCollectionResponse{
+            Success:      false,
+            Handled:      false,
+            ErrorMessage: err.Error(),
+        }, nil
+    }
+
+    return &sdk.DataCollectionResponse{
+        Success: true,
+        Handled: true,
+    }, nil
+}
+
+func (p *ElasticsearchCollector) indexDocument(ctx context.Context,
+    indexName string, doc map[string]interface{}) error {
+
+    jsonDoc, err := json.Marshal(doc)
+    if err != nil {
+        return err
+    }
+
+    url := fmt.Sprintf("%s/%s/_doc", p.esURL, indexName)
+    req, err := http.NewRequestWithContext(ctx, "POST", url,
+        bytes.NewBuffer(jsonDoc))
+    if err != nil {
+        return err
+    }
+
+    req.Header.Set("Content-Type", "application/json")
+
+    resp, err := p.client.Do(req)
+    if err != nil {
+        return err
+    }
+    defer resp.Body.Close()
+
+    if resp.StatusCode >= 400 {
+        return fmt.Errorf("elasticsearch returned status %d", resp.StatusCode)
+    }
+
+    return nil
+}
+
+func main() {
+    plugin := &ElasticsearchCollector{}
+    sdk.ServePlugin(plugin)
+}
+```
+
+## Plugin Context
+
+The `PluginContext` provides contextual information about the request:
+
+```go
+type PluginContext struct {
+    RequestID    string                 // Unique request ID
+    LLMID        uint                   // LLM being called
+    LLMSlug      string                 // LLM slug identifier
+    Vendor       string                 // LLM vendor (openai, anthropic, etc.)
+    AppID        uint                   // App making the request
+    UserID       uint                   // User making the request
+    Metadata     map[string]interface{} // Additional metadata
+    TraceContext map[string]string      // Distributed tracing headers
+}
+```
+
+Use this context for logging, tracing, and per-request customization.
+
+## Testing Your Plugin
+
+### Unit Testing
+
+```go Expandable
+func TestProcessPreAuth(t *testing.T) {
+    plugin := &MyPlugin{}
+    plugin.Initialize(map[string]interface{}{
+        "setting": "value",
+    })
+
+    req := &sdk.PluginRequest{
+        Method: "POST",
+        Path:   "/v1/chat/completions",
+        Body:   []byte(`{"messages": []}`),
+    }
+
+    ctx := &sdk.PluginContext{
+        RequestID: "test-123",
+        LLMID:     1,
+    }
+
+    resp, err := plugin.ProcessPreAuth(context.Background(), req, ctx)
+    if err != nil {
+        t.Fatalf("unexpected error: %v", err)
+    }
+
+    if !resp.Modified {
+        t.Error("expected response to be modified")
+    }
+}
+```
+
+### Integration Testing
+
+Use `file://` deployment to test with real LLM requests:
+
+```bash Expandable
+# Build plugin
+go build -o my-plugin main.go
+
+# Create plugin in AI Studio
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{
+    "command": "file:///full/path/to/my-plugin",
+    ...
+  }'
+
+# Test LLM request
+curl -X POST http://localhost:3000/api/v1/llms/1/proxy/v1/chat/completions \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{"messages": [{"role": "user", "content": "test"}]}'
+```
+
+## Best Practices
+
+### Performance
+
+- Keep plugin logic lightweight and fast
+- Use timeouts for external API calls
+- Implement connection pooling for external services
+- Cache frequently accessed data
+- Return early for requests that don't need processing
+
+### Error Handling
+
+- Log errors with context (request ID, LLM ID, etc.)
+- Return descriptive error messages
+- Don't panic - return errors properly
+- Implement graceful degradation
+
+### Security
+
+- Validate all configuration inputs
+- Sanitize user-provided data
+- Use secure connections for external services
+- Don't log sensitive data (tokens, PII)
+- Implement rate limiting for external calls
+
+### Configuration
+
+- Provide sensible defaults
+- Use JSON Schema for validation
+- Document all configuration options
+- Support configuration updates without restart
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="Plugin Not Loading">
+
+- Check plugin command path is absolute with `file://`
+- Verify plugin binary has execute permissions
+- Check logs for initialization errors
+- Ensure plugin implements all required interfaces
+
+</Accordion>
+
+<Accordion title="Plugin Crashes">
+
+- Check plugin logs for panics
+- Verify external service connectivity
+- Test with minimal configuration
+- Use defensive error handling
+
+</Accordion>
+
+<Accordion title="Performance Issues">
+
+- Profile plugin with Go profiler
+- Check for blocking operations
+- Monitor external service latency
+- Review resource usage (CPU, memory)
+
+</Accordion>
+
+</AccordionGroup>
+
+## Gateway Services
+
+Gateway plugins have access to Gateway-specific services via `ctx.Services.Gateway()`:
+
+```go
+if ctx.Runtime == plugin_sdk.RuntimeGateway {
+    // Get app configuration
+    app, err := ctx.Services.Gateway().GetApp(ctx, ctx.AppID)
+
+    // Check budget status
+    status, err := ctx.Services.Gateway().GetBudgetStatus(ctx, ctx.AppID)
+
+    // Validate credentials
+    valid, err := ctx.Services.Gateway().ValidateCredential(ctx, token)
+
+    // Get LLM configuration
+    llm, err := ctx.Services.Gateway().GetLLM(ctx, llmID)
+}
+```
+
+See [Service API Reference](/ai-management/ai-studio/plugins/service-api) for complete Gateway Services documentation.
+
+## Sending Data to Control Plane
+
+Gateway plugins can send data back to AI Studio (the control plane) using the `SendToControl` API. This is useful for:
+- Aggregating statistics from edge instances
+- Synchronizing state across the hub-and-spoke architecture
+- Sending alerts or notifications to central plugins
+
+```go Expandable
+import "github.com/TykTechnologies/midsommar/v2/microgateway/plugins/sdk"
+
+func (p *MyPlugin) HandlePostAuth(ctx sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Send JSON data to control plane
+    stats := map[string]interface{}{
+        "requests": p.requestCount.Load(),
+        "errors":   p.errorCount.Load(),
+    }
+
+    pendingCount, err := sdk.SendToControlJSON(ctx, stats, "", map[string]string{
+        "metric_type": "gateway_stats",
+    })
+    if err != nil {
+        ctx.Services.Logger().Warn("Failed to queue stats", "error", err)
+    }
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+The control plane plugin receives this data via the `EdgePayloadReceiver` interface.
+
+See [Edge-to-Control Communication](/ai-management/ai-studio/plugins/edge-to-control) for complete documentation.
+
+## Working with Both Runtimes
+
+Plugins using the unified SDK can work in both Gateway and Studio:
+
+```go Expandable
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Universal services (always available)
+    ctx.Services.Logger().Info("Processing request")
+    data, _ := ctx.Services.KV().Read(ctx, "config")
+
+    // Runtime-specific logic
+    if ctx.Runtime == plugin_sdk.RuntimeGateway {
+        // Gateway-specific code
+        app, _ := ctx.Services.Gateway().GetApp(ctx, ctx.AppID)
+    } else if ctx.Runtime == plugin_sdk.RuntimeStudio {
+        // Studio-specific code
+        llms, _ := ctx.Services.Studio().ListLLMs(ctx, 1, 10)
+    }
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
diff --git a/ai-management/ai-studio/plugins/edge-to-control.mdx b/ai-management/ai-studio/plugins/edge-to-control.mdx
new file mode 100644
index 0000000000..f588534400
--- /dev/null
+++ b/ai-management/ai-studio/plugins/edge-to-control.mdx
@@ -0,0 +1,542 @@
+---
+title: "Tyk AI Studio Plugin Edge to Control Communication"
+description: "Understand the Edge-to-Control communication system that allows plugins running on Edge Gateway instances to send data back to plugins on the AI Studio control plane."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "Edge to Control Communication"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+This page covers the **Edge-to-Control** communication system that allows plugins running on Edge Gateway (edge) instances to send data back to plugins running on AI Studio (control plane).
+
+## Overview
+
+In the hub-and-spoke architecture:
+- **AI Studio** is the control plane (hub)
+- **Edge Gateway** instances are edge nodes (spokes)
+
+Edge plugins may need to send data back to the control plane for:
+- Cache statistics aggregation
+- Shared state synchronization
+- Audit log centralization
+- Custom analytics collection
+- Alert and notification routing
+
+The Edge-to-Control system provides a reliable, batched mechanism for this communication.
+
+## Architecture
+
+```mermaid
+flowchart TD
+    subgraph ControlPlane ["AI Studio (Control Plane)"]
+        direction LR
+        ControlServer["Control Server<br/>(gRPC)"] --- PluginManager["Plugin Manager"]
+        PluginManager --- StudioPlugin["Studio Plugin<br/>EdgePayloadReceiver"]
+    end
+    
+    subgraph Edge ["Edge Gateway"]
+        direction LR
+        SimpleClient["Simple Client<br/>(heartbeat)"] --- PayloadQueue["Payload Queue<br/>(SQLite)"]
+        EdgePlugin["Edge Plugin<br/>SendToControl()"] --> PayloadQueue
+    end
+    
+    ControlServer -->|"gRPC (SendPluginControlBatch)"| SimpleClient
+```
+
+### Data Flow
+
+1. **Edge Plugin** calls `SendToControl()` or `SendToControlJSON()`
+2. Payload is **queued** to SQLite database (survives gateway restarts)
+3. During **heartbeat** (every 30s), pending payloads are batched
+4. Batch is sent via **gRPC** `SendPluginControlBatch` RPC
+5. Control Server **routes** each payload to the target plugin
+6. Studio plugin's `AcceptEdgePayload()` is called with the data
+
+## Edge Plugin: Sending Data
+
+### SDK Functions
+
+The Edge Gateway SDK provides two functions for sending data to the control plane:
+
+#### SendToControl
+
+Send raw byte payloads:
+
+```go Expandable
+import "github.com/TykTechnologies/midsommar/v2/microgateway/plugins/sdk"
+
+func (p *MyPlugin) HandlePostAuth(ctx context.Context, req *sdk.EnrichedRequest) (*sdk.PluginResponse, error) {
+    // Send raw bytes to control plane
+    pendingCount, err := sdk.SendToControl(
+        ctx,
+        []byte(`{"event": "request_processed", "count": 1}`), // payload (max 1MB)
+        "req-12345",                                           // correlation ID (optional)
+        map[string]string{                                     // metadata (optional)
+            "source": "edge-us-west-1",
+            "type":   "analytics",
+        },
+    )
+    if err != nil {
+        p.logger.Error("Failed to queue payload", "error", err)
+    }
+
+    p.logger.Info("Payload queued", "pending_count", pendingCount)
+    return &sdk.PluginResponse{Modified: false}, nil
+}
+```
+
+#### SendToControlJSON
+
+Convenience function for JSON payloads:
+
+```go Expandable
+import "github.com/TykTechnologies/midsommar/v2/microgateway/plugins/sdk"
+
+type CacheStats struct {
+    Hits   int64   `json:"hits"`
+    Misses int64   `json:"misses"`
+    Size   int64   `json:"size_bytes"`
+}
+
+func (p *MyPlugin) sendCacheStats(ctx context.Context) error {
+    stats := CacheStats{
+        Hits:   p.cacheHits.Load(),
+        Misses: p.cacheMisses.Load(),
+        Size:   p.cacheSize.Load(),
+    }
+
+    pendingCount, err := sdk.SendToControlJSON(
+        ctx,
+        stats,                    // automatically marshaled to JSON
+        "",                       // no correlation ID
+        map[string]string{
+            "metric_type": "cache",
+        },
+    )
+    if err != nil {
+        return fmt.Errorf("failed to queue stats: %w", err)
+    }
+
+    p.logger.Debug("Cache stats queued", "pending", pendingCount)
+    return nil
+}
+```
+
+### Function Signatures
+
+```go Expandable
+// SendToControl queues a raw payload for delivery to the control plane plugin
+func SendToControl(
+    ctx context.Context,
+    payload []byte,              // Raw payload data (max 1MB)
+    correlationID string,        // Optional tracking ID
+    metadata map[string]string,  // Optional key-value metadata
+) (pendingCount int64, err error)
+
+// SendToControlJSON marshals value to JSON and queues for delivery
+func SendToControlJSON(
+    ctx context.Context,
+    value interface{},           // Any JSON-serializable value
+    correlationID string,        // Optional tracking ID
+    metadata map[string]string,  // Optional key-value metadata
+) (pendingCount int64, err error)
+```
+
+### Payload Limits
+
+| Limit | Value |
+|-------|-------|
+| Maximum payload size | 1 MB |
+| Maximum metadata entries | 50 |
+| Maximum metadata key length | 256 bytes |
+| Maximum metadata value length | 4096 bytes |
+| Maximum correlation ID length | 256 bytes |
+
+### Queue Behavior
+
+- **Persistence**: Payloads are stored in SQLite and survive gateway restarts
+- **Batching**: Payloads are batched during heartbeat (default: every 30s)
+- **Batch size**: Up to 100 payloads per batch
+- **Retention**: Successfully sent payloads are deleted; failed payloads are retried
+- **Cleanup**: Payloads older than 24 hours are automatically cleaned up
+
+### Example: Complete Edge Plugin
+
+```go Expandable
+package main
+
+import (
+    "context"
+    "sync/atomic"
+    "time"
+
+    "github.com/TykTechnologies/midsommar/v2/microgateway/plugins/sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+)
+
+type CachePlugin struct {
+    sdk.BasePlugin
+    hits   atomic.Int64
+    misses atomic.Int64
+}
+
+func NewCachePlugin() *CachePlugin {
+    return &CachePlugin{
+        BasePlugin: sdk.NewBasePlugin(
+            "llm-cache",
+            "1.0.0",
+            "LLM response caching with stats reporting",
+        ),
+    }
+}
+
+func (p *CachePlugin) Initialize(ctx sdk.Context, config map[string]string) error {
+    // Start background stats reporter
+    go p.reportStats(ctx)
+    return nil
+}
+
+func (p *CachePlugin) HandlePostAuth(ctx sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Check cache
+    cacheKey := p.computeCacheKey(req)
+    if cached, found := p.lookupCache(cacheKey); found {
+        p.hits.Add(1)
+        return &pb.PluginResponse{
+            Block:        true,
+            ResponseBody: cached,
+            StatusCode:   200,
+        }, nil
+    }
+
+    p.misses.Add(1)
+    return &pb.PluginResponse{Modified: false}, nil
+}
+
+func (p *CachePlugin) reportStats(ctx context.Context) {
+    ticker := time.NewTicker(5 * time.Minute)
+    defer ticker.Stop()
+
+    for {
+        select {
+        case <-ctx.Done():
+            return
+        case <-ticker.C:
+            stats := map[string]interface{}{
+                "hits":      p.hits.Load(),
+                "misses":    p.misses.Load(),
+                "hit_rate":  p.calculateHitRate(),
+                "timestamp": time.Now().Unix(),
+            }
+
+            _, err := sdk.SendToControlJSON(ctx, stats, "", map[string]string{
+                "metric_type": "cache_stats",
+                "interval":    "5m",
+            })
+            if err != nil {
+                p.logger.Warn("Failed to send stats", "error", err)
+            }
+        }
+    }
+}
+
+func main() {
+    sdk.Serve(NewCachePlugin())
+}
+```
+
+## Control Plane Plugin: Receiving Data
+
+### EdgePayloadReceiver Interface
+
+AI Studio plugins implement `EdgePayloadReceiver` to receive payloads from edge instances:
+
+```go
+// EdgePayloadReceiver handles payloads sent from edge (Edge Gateway) instances
+type EdgePayloadReceiver interface {
+    Plugin
+
+    // AcceptEdgePayload is called when a payload arrives from an edge instance.
+    // Returns:
+    //   - handled: true if this plugin processed the payload
+    //   - error: non-nil if processing failed
+    AcceptEdgePayload(ctx Context, payload *EdgePayload) (handled bool, err error)
+}
+```
+
+### EdgePayload Structure
+
+```go
+type EdgePayload struct {
+    Payload           []byte            // Raw payload data from edge plugin
+    EdgeID            string            // Edge instance identifier
+    EdgeNamespace     string            // Namespace of the edge instance
+    CorrelationID     string            // Correlation ID for tracking
+    Metadata          map[string]string // Key-value metadata
+    EdgeTimestamp     int64             // Unix timestamp when generated at edge
+    ReceivedTimestamp int64             // Unix timestamp when received at control
+}
+```
+
+### Example: Complete Control Plane Plugin
+
+```go Expandable
+package main
+
+import (
+    "encoding/json"
+    "fmt"
+    "sync"
+    "time"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+)
+
+type CacheStatsAggregator struct {
+    plugin_sdk.BasePlugin
+
+    mu    sync.RWMutex
+    stats map[string]*EdgeStats // keyed by edge ID
+}
+
+type EdgeStats struct {
+    EdgeID     string
+    Hits       int64
+    Misses     int64
+    LastUpdate time.Time
+}
+
+type IncomingStats struct {
+    Hits      int64 `json:"hits"`
+    Misses    int64 `json:"misses"`
+    HitRate   float64 `json:"hit_rate"`
+    Timestamp int64 `json:"timestamp"`
+}
+
+func NewCacheStatsAggregator() *CacheStatsAggregator {
+    return &CacheStatsAggregator{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "cache-stats-aggregator",
+            "1.0.0",
+            "Aggregates cache statistics from edge instances",
+        ),
+        stats: make(map[string]*EdgeStats),
+    }
+}
+
+func (p *CacheStatsAggregator) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    ctx.Services.Logger().Info("Cache stats aggregator initialized")
+    return nil
+}
+
+// Implement EdgePayloadReceiver interface
+func (p *CacheStatsAggregator) AcceptEdgePayload(ctx plugin_sdk.Context, payload *plugin_sdk.EdgePayload) (bool, error) {
+    // Check if this payload is for us
+    metricType, ok := payload.Metadata["metric_type"]
+    if !ok || metricType != "cache_stats" {
+        // Not our payload, return handled=false so other plugins can process it
+        return false, nil
+    }
+
+    // Parse the payload
+    var stats IncomingStats
+    if err := json.Unmarshal(payload.Payload, &stats); err != nil {
+        ctx.Services.Logger().Error("Failed to parse stats payload",
+            "edge_id", payload.EdgeID,
+            "error", err,
+        )
+        return true, fmt.Errorf("invalid payload format: %w", err)
+    }
+
+    // Store the stats
+    p.mu.Lock()
+    p.stats[payload.EdgeID] = &EdgeStats{
+        EdgeID:     payload.EdgeID,
+        Hits:       stats.Hits,
+        Misses:     stats.Misses,
+        LastUpdate: time.Unix(payload.EdgeTimestamp, 0),
+    }
+    p.mu.Unlock()
+
+    ctx.Services.Logger().Info("Received cache stats from edge",
+        "edge_id", payload.EdgeID,
+        "namespace", payload.EdgeNamespace,
+        "hits", stats.Hits,
+        "misses", stats.Misses,
+        "hit_rate", stats.HitRate,
+    )
+
+    // Optionally persist to KV storage
+    key := fmt.Sprintf("edge-stats:%s", payload.EdgeID)
+    data, _ := json.Marshal(p.stats[payload.EdgeID])
+    ctx.Services.KV().Write(ctx, key, data)
+
+    return true, nil
+}
+
+// GetAggregatedStats returns combined stats from all edges
+func (p *CacheStatsAggregator) GetAggregatedStats() map[string]interface{} {
+    p.mu.RLock()
+    defer p.mu.RUnlock()
+
+    var totalHits, totalMisses int64
+    edgeCount := len(p.stats)
+
+    for _, s := range p.stats {
+        totalHits += s.Hits
+        totalMisses += s.Misses
+    }
+
+    hitRate := float64(0)
+    if totalHits+totalMisses > 0 {
+        hitRate = float64(totalHits) / float64(totalHits+totalMisses) * 100
+    }
+
+    return map[string]interface{}{
+        "edge_count":   edgeCount,
+        "total_hits":   totalHits,
+        "total_misses": totalMisses,
+        "hit_rate":     hitRate,
+    }
+}
+
+func main() {
+    plugin_sdk.Serve(NewCacheStatsAggregator())
+}
+```
+
+## Plugin ID Matching
+
+The control plane routes payloads based on **plugin ID**. When an edge plugin sends a payload, it's associated with that plugin's numeric ID. The control plane then delivers it to the AI Studio plugin with the **same ID**.
+
+### Configuration
+
+1. **Create AI Studio plugin** (control plane receiver)
+2. **Note the plugin ID** (e.g., `42`)
+3. **Deploy Edge Gateway plugin** with the same ID configuration
+4. Edge payloads from plugin 42 will be routed to AI Studio plugin 42
+
+### Example Setup
+
+```yaml Expandable
+# AI Studio plugin (plugin_id: 42)
+plugins:
+  - id: 42
+    name: "Cache Stats Aggregator"
+    command: "file:///plugins/cache-stats-aggregator"
+    hook_type: "post_auth"
+    plugin_type: "studio"
+
+# Edge Gateway config
+plugins_config:
+  plugins:
+    - id: 42
+      name: "LLM Cache"
+      command: "file:///plugins/llm-cache"
+      hook_type: "post_auth"
+```
+
+## Error Handling
+
+### Edge Plugin Errors
+
+```go Expandable
+pendingCount, err := sdk.SendToControl(ctx, payload, "", nil)
+if err != nil {
+    switch {
+    case errors.Is(err, sdk.ErrPayloadTooLarge):
+        // Payload exceeds 1MB limit
+        p.logger.Error("Payload too large, dropping")
+    case errors.Is(err, sdk.ErrQueueFull):
+        // Queue has too many pending payloads
+        p.logger.Warn("Queue full, payload dropped")
+    default:
+        // Other error (e.g., serialization failed)
+        p.logger.Error("Failed to queue payload", "error", err)
+    }
+}
+```
+
+### Control Plane Plugin Errors
+
+```go Expandable
+func (p *MyPlugin) AcceptEdgePayload(ctx plugin_sdk.Context, payload *plugin_sdk.EdgePayload) (bool, error) {
+    // Return handled=false if this isn't your payload
+    if !p.isMyPayload(payload) {
+        return false, nil
+    }
+
+    // Return error for processing failures
+    if err := p.processPayload(payload); err != nil {
+        ctx.Services.Logger().Error("Failed to process payload",
+            "edge_id", payload.EdgeID,
+            "correlation_id", payload.CorrelationID,
+            "error", err,
+        )
+        // Return handled=true with error - payload won't be retried
+        return true, err
+    }
+
+    return true, nil
+}
+```
+
+## Best Practices
+
+### Edge Plugins
+
+1. **Batch locally first**: Aggregate data before sending to reduce payload count
+2. **Use correlation IDs**: For request/response matching or debugging
+3. **Include metadata**: Add context like metric type, source, timestamp
+4. **Handle errors gracefully**: Queue failures shouldn't crash your plugin
+5. **Monitor pending count**: High pending counts may indicate connectivity issues
+
+### Control Plane Plugins
+
+1. **Check metadata first**: Return `handled=false` quickly for irrelevant payloads
+2. **Validate payloads**: Don't trust edge data - validate before processing
+3. **Use KV for persistence**: Store aggregated data for dashboard/API access
+4. **Log with context**: Include edge ID and correlation ID in logs
+5. **Handle duplicates**: Network issues may cause duplicate deliveries
+
+### Performance
+
+1. **Keep payloads small**: Smaller payloads = faster transmission
+2. **Aggregate at edges**: Send summaries, not individual events
+3. **Use appropriate intervals**: Balance freshness vs. overhead
+4. **Monitor queue depth**: Alert on growing queues
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="Payloads Not Arriving">
+
+1. **Check edge connectivity**: Verify edge can reach control plane  
+2. **Check plugin IDs**: Edge and control plugins must have matching IDs  
+3. **Check logs**: Look for errors in both edge and control logs  
+4. **Verify plugin loaded**: Ensure control plane plugin is active  
+
+</Accordion>
+
+<Accordion title="High Latency">
+
+1. **Check batch interval**: Default is 30s heartbeat  
+2. **Check payload size**: Large payloads take longer to transmit  
+3. **Check network**: Latency between edge and control  
+4. **Check queue depth**: High pending count = backlog  
+
+</Accordion>
+
+<Accordion title="Payloads Being Dropped">
+
+1. **Check payload size**: Must be under 1MB  
+2. **Check queue capacity**: Queue may be full  
+3. **Check retention**: Payloads older than 24h are cleaned up  
+4. **Check errors**: Processing errors may cause drops  
+
+</Accordion>
+
+</AccordionGroup>
diff --git a/ai-management/ai-studio/plugins/examples.mdx b/ai-management/ai-studio/plugins/examples.mdx
new file mode 100644
index 0000000000..7d896c0a0d
--- /dev/null
+++ b/ai-management/ai-studio/plugins/examples.mdx
@@ -0,0 +1,689 @@
+---
+title: "Tyk AI Studio Example Plugins"
+description: "A comprehensive reference of working plugin examples in the Tyk AI Studio repository, demonstrating real-world patterns for different plugin capabilities."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "Example Plugins"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph TD
+    A[Examples] --> B[Community Plugins]
+    A --> C[Enterprise Plugins]
+```
+
+Comprehensive reference of working plugin examples in the Tyk AI Studio repository. All examples use the **Unified Plugin SDK** (`pkg/plugin_sdk`) and demonstrate real-world patterns for different plugin capabilities.
+
+## Production-Ready Plugins
+
+The following plugins in `community/plugins/` and `enterprise/plugins/` are **production-tested** and serve as the best reference implementations:
+
+### Community Plugins
+
+#### LLM Cache
+
+**Path**: [`plugins/llm-cache/`](https://github.com/TykTechnologies/ai-studio-community-plugins/tree/main/plugins/llm-cache)
+
+**Capabilities**: PostAuth, Response, StreamComplete, UI, RPC, EdgePayloadReceiver, SessionAware, Config
+
+**Description**: Semantic caching for LLM responses using request hash matching. Reduces costs and latency by returning cached responses for similar prompts.
+
+**Key Features**:
+- Request hashing for cache key generation
+- Streaming response caching
+- Edge-to-control cache synchronization
+- WebComponent UI for cache management
+- KV storage for cache state
+- Session-aware broker connection warmup
+
+**Why Use This Example**:
+- **Best example of multi-capability plugin** - Shows how to combine 8 different capabilities
+- **Edge-to-control pattern** - Demonstrates hub-and-spoke communication
+- **SessionAware warmup** - Critical pattern for Service API access
+
+**Complexity**: Advanced
+
+---
+
+#### LLM Firewall
+
+**Path**: [`plugins/llm-firewall/`](https://github.com/TykTechnologies/ai-studio-community-plugins/tree/main/plugins/llm-firewall)
+
+**Capabilities**: PreAuth, PostAuth, Config
+
+**Description**: Content filtering for LLM prompts using configurable phrase/pattern matching. Blocks requests containing disallowed content.
+
+**Key Features**:
+- Regex and literal phrase matching
+- Per-model rule configuration
+- Multi-vendor content extraction (OpenAI, Anthropic, Google AI, Vertex)
+- Configurable block messages
+- Case-sensitive/insensitive matching
+
+**Why Use This Example**:
+- **Best example of content filtering** - Clean implementation of request inspection
+- **Multi-vendor support** - Shows how to handle different LLM formats
+- **Configuration-driven rules** - JSON schema for rule management
+
+**Complexity**: Intermediate
+
+---
+
+#### GitHub RAG Ingest
+
+**Path**: [`plugins/github-rag-ingest/`](https://github.com/TykTechnologies/ai-studio-community-plugins/tree/main/plugins/github-rag-ingest)
+
+**Capabilities**: UI, RPC, Scheduler, SessionAware
+
+**Description**: Scheduled ingestion of GitHub repository content for RAG (Retrieval-Augmented Generation). Indexes code, docs, and issues.
+
+**Key Features**:
+- Cron-based scheduled execution
+- GitHub API integration
+- Custom UI for ingest configuration
+- RPC methods for manual triggers
+- Session-aware initialization
+
+**Why Use This Example**:
+- **Best example of scheduled data ingestion** - Complete Scheduler implementation
+- **UI + backend integration** - Shows RPC pattern for UI communication
+- **External API integration** - GitHub API usage patterns
+
+**Complexity**: Advanced
+
+---
+
+### Enterprise Plugins
+
+> **Note**: Enterprise plugins require a valid license.
+
+#### LLM Load Balancer
+
+**Capabilities**: PostAuth, Response, UI
+
+**Description**: Intelligent request distribution across multiple LLM backends with health checking and failover.
+
+**Complexity**: Advanced
+
+---
+
+#### Advanced LLM Cache
+
+**Capabilities**: PostAuth, Response, UI
+
+**Description**: Extended caching with semantic similarity matching, cache invalidation policies, and advanced analytics. Extends the community LLM Cache.
+
+**Complexity**: Advanced
+
+---
+
+## Example Plugins
+
+The following examples in `examples/plugins/` demonstrate specific patterns and are useful for learning:
+
+## AI Studio Plugins
+
+### Echo Agent
+
+**Path**: [`examples/plugins/studio/echo-agent/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/echo-agent)
+
+**Capabilities**: Agent
+
+> **Experimental**: Agent plugins are currently experimental. See [Agent Plugins Guide](/ai-management/ai-studio/plugins/studio-agent) for full documentation.
+
+**Description**: Simple conversational agent that wraps LLM responses with custom prefix/suffix formatting. Demonstrates basic agent implementation with streaming responses and LLM integration.
+
+**Architecture**: Agent plugins follow the **Plugin → Agent Object → App Object** pattern:
+- **Plugin**: Implements `HandleAgentMessage` for conversations (long-running gRPC)
+- **Agent Object**: Binds the plugin to an App with configuration and group access
+- **App Object**: Provides LLM access, tools, datasources, and budget control
+
+**Key Features**:
+- Streaming server-side responses via gRPC
+- LLM integration via `ai_studio_sdk.CallLLM()`
+- Per-agent configuration (prefix, suffix, metadata)
+- Fallback echo mode when no LLM available
+- JSON schema configuration
+- SessionAware warmup for Service API connection
+
+**Use Cases**:
+- Learning agent plugin basics
+- Response formatting and wrapping
+- Custom agent configuration
+- Reference implementation for agent architecture
+
+**Complexity**: Beginner
+
+---
+
+### LLM Validator
+
+**Path**: [`examples/plugins/studio/llm-validator/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/llm-validator)
+
+**Capabilities**: Object Hooks (before_create, before_update)
+
+**Description**: Validates LLM configurations before they're saved to the database. Enforces HTTPS endpoints, blocks specific vendors, validates privacy scores, and requires descriptions.
+
+**Key Features**:
+- Object hook registration for LLM objects
+- `before_create` and `before_update` hooks
+- Configurable validation rules
+- Block operations with rejection reasons
+- Add validation metadata to approved objects
+- Priority ordering (runs early in chain)
+
+**Use Cases**:
+- Enforcing security policies (HTTPS-only endpoints)
+- Vendor compliance and blocking
+- Privacy score validation
+- Required field enforcement
+
+**Complexity**: Intermediate
+
+---
+
+### LLM Rate Limiter (Multi-Phase)
+
+**Path**: [`examples/plugins/studio/llm-rate-limiter-multiphase/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/llm-rate-limiter-multiphase)
+
+**Capabilities**: PostAuth, Response, UI Provider
+
+**Description**: Comprehensive example showing a **multi-capability plugin** that implements rate limiting across the entire request/response lifecycle with a custom UI dashboard.
+
+**Key Features**:
+- **PostAuth**: Check rate limits before proxying to LLM
+- **Response**: Update counters after successful response
+- **UI Provider**: Custom dashboard showing rate limit status
+- KV storage for rate limit state
+- Per-app and per-user rate limiting
+- WebComponent-based UI
+- Custom RPC methods for UI interaction
+
+**Use Cases**:
+- Advanced rate limiting beyond built-in budget controls
+- Multi-phase request processing
+- Building plugins with custom UIs
+- Stateful plugin logic with KV storage
+
+**Complexity**: Advanced
+
+---
+
+### Hook Test Plugin
+
+**Path**: [`examples/plugins/studio/hook-test-plugin/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/hook-test-plugin)
+
+**Capabilities**: Object Hooks (all types)
+
+**Description**: Comprehensive testing plugin demonstrating all object hook types (before/after create/update/delete) for all supported objects (llm, datasource, tool, user).
+
+**Key Features**:
+- Registers hooks for all 4 object types
+- Demonstrates all 6 hook types per object
+- Shows blocking vs non-blocking hooks
+- Metadata enrichment patterns
+- Priority ordering examples
+- Extensive logging for debugging
+
+**Use Cases**:
+- Learning object hook patterns
+- Testing hook behavior
+- Understanding hook execution order
+- Reference implementation for all hooks
+
+**Complexity**: Intermediate
+
+---
+
+### Service API Test
+
+**Path**: [`examples/plugins/studio/service-api-test/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/service-api-test)
+
+**Capabilities**: PostAuth (for testing purposes)
+
+**Description**: Comprehensive test plugin demonstrating all Studio Service API operations including LLMs, Tools, Apps, Datasources, Filters, Tags, and Plugins management.
+
+**Key Features**:
+- Complete Studio Services API coverage
+- CRUD operations for all object types
+- Broker ID initialization
+- Error handling patterns
+- Service API authentication
+
+**Use Cases**:
+- Learning Service API usage
+- Testing Service API operations
+- Reference for API method signatures
+- Understanding broker connection setup
+
+**Complexity**: Advanced
+
+---
+
+### Custom Auth UI
+
+**Path**: [`examples/plugins/studio/custom-auth-ui/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/custom-auth-ui)
+
+**Capabilities**: UI Provider, Auth
+
+**Description**: UI plugin with custom authentication extension. Shows how to add custom pages, sidebars, and authentication flows to the AI Studio dashboard.
+
+**Key Features**:
+- Custom sidebar integration
+- Route registration
+- WebComponent implementation
+- Asset serving (JS/CSS bundles)
+- Custom authentication integration
+
+**Use Cases**:
+- Extending dashboard UI
+- Custom authentication flows
+- Adding new admin pages
+- WebComponent integration
+
+**Complexity**: Advanced
+
+---
+
+### Portal Feedback
+
+**Path**: [`examples/plugins/studio/portal-feedback/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/portal-feedback)
+
+**Capabilities**: UI Provider, Portal UI Provider
+
+**Description**: Example plugin demonstrating portal UI with user feedback form. Shows how to build pages visible to end-users in the AI Portal alongside an admin dashboard for managing submissions.
+
+**Key Features**:
+- Portal sidebar integration with group-based visibility
+- Portal RPC with authenticated user context (`HandlePortalRPC`)
+- Admin RPC for management operations (`HandleRPC`)
+- Separate WebComponents for portal and admin UIs
+- `waitForAPIAndLoad()` pattern for API injection timing
+- Shared asset serving between admin and portal contexts
+
+**Use Cases**:
+- Learning portal UI plugin development
+- User-facing forms and data collection
+- Dual admin/portal plugin architecture
+- Portal RPC with user context
+
+**Complexity**: Beginner
+
+---
+
+## Gateway Plugins
+
+### Custom Echo Endpoint
+
+**Path**: [`examples/plugins/gateway/custom-echo-endpoint/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/custom-echo-endpoint)
+
+**Capabilities**: CustomEndpointHandler, UIProvider, ConfigProvider
+
+**Description**: Demonstrates custom HTTP endpoints on the gateway combined with a Studio admin UI. Registers a catch-all endpoint at `/plugins/custom-echo-endpoint/` that echoes request metadata and user-configured content.
+
+**Key Features**:
+- CustomEndpointHandler with `/*` catch-all registration
+- Full request metadata echo (method, path, headers, query, body, path_segments)
+- Studio UI (WebComponent) for editing custom content
+- Config persistence via `ai_studio_sdk.UpdatePluginConfig()`
+- Config sync from Studio → Gateway via gRPC ConfigurationSnapshot
+- Manifest with `custom_endpoint` + `studio_ui` hooks
+
+**Use Cases**:
+- Learning custom endpoint basics
+- Understanding the config sync flow (Studio UI → DB → Gateway)
+- Combining CustomEndpointHandler with UIProvider
+- Reference implementation for custom endpoints
+
+**Complexity**: Beginner
+
+---
+
+### Request Enricher
+
+**Path**: [`examples/plugins/gateway/request_enricher/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/request_enricher)
+
+**Capabilities**: PostAuth
+
+**Description**: Enriches authenticated requests with additional metadata and instructions before proxying to LLM. Most common gateway plugin pattern.
+
+**Key Features**:
+- PostAuth hook implementation
+- Header injection
+- Request body modification
+- Configurable enrichment via plugin config
+- Context-aware enrichment (app_id, user_id)
+
+**Use Cases**:
+- Adding custom headers
+- Injecting additional instructions
+- Request metadata enrichment
+- Per-app request modification
+
+**Complexity**: Beginner
+
+---
+
+### Response Modifier
+
+**Path**: [`examples/plugins/gateway/response_modifier/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/response_modifier)
+
+**Capabilities**: Response (OnBeforeWriteHeaders, OnBeforeWrite)
+
+**Description**: Modifies LLM responses before returning to client. Demonstrates two-phase response processing (headers then body).
+
+**Key Features**:
+- Header modification (OnBeforeWriteHeaders)
+- Body transformation (OnBeforeWrite)
+- Response filtering
+- Content injection
+- Streaming response handling
+
+**Use Cases**:
+- Content filtering and moderation
+- Response formatting
+- Adding custom response headers
+- Injecting metadata into responses
+
+**Complexity**: Intermediate
+
+---
+
+### Message Modifier
+
+**Path**: [`examples/plugins/gateway/message_modifier/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/message_modifier)
+
+**Capabilities**: PostAuth
+
+**Description**: Similar to request enricher but focuses on modifying the message content specifically for chat/completion requests.
+
+**Key Features**:
+- Message content transformation
+- Chat-specific request handling
+- System message injection
+- Context-aware modifications
+
+**Use Cases**:
+- Chat message preprocessing
+- System prompt injection
+- Message format standardization
+
+**Complexity**: Beginner
+
+---
+
+### Elasticsearch Collector
+
+**Path**: [`examples/plugins/gateway/legacy-collectors/elasticsearch_collector/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/legacy-collectors/elasticsearch_collector)
+
+**Capabilities**: DataCollector
+
+**Description**: Exports proxy logs, analytics, and budget data to Elasticsearch for external analysis and monitoring.
+
+**Key Features**:
+- HandleProxyLog implementation
+- HandleAnalytics implementation
+- HandleBudgetUsage implementation
+- Elasticsearch bulk API integration
+- Async export with error handling
+- Configurable index names
+
+**Use Cases**:
+- Exporting logs to data warehouses
+- Real-time analytics pipelines
+- External monitoring systems
+- Custom dashboards (Kibana, Grafana)
+
+**Complexity**: Advanced
+
+---
+
+### Gateway Service Test
+
+**Path**: [`examples/plugins/gateway/gateway-service-test/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/gateway-service-test)
+
+**Capabilities**: PostAuth (for testing purposes)
+
+**Description**: Demonstrates all Gateway-specific Service API operations including app management, LLM info, budget status, and credential validation.
+
+**Key Features**:
+- GetApp, ListApps
+- GetLLM, ListLLMs
+- GetBudgetStatus
+- GetModelPrice
+- ValidateCredential
+- Runtime detection (Gateway vs Studio)
+
+**Use Cases**:
+- Learning Gateway Services API
+- Budget-aware request handling
+- App configuration access
+- Testing Gateway-specific features
+
+**Complexity**: Intermediate
+
+---
+
+### Custom Echo Endpoint
+
+**Path**: [`examples/plugins/gateway/custom-echo-endpoint/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway/custom-echo-endpoint)
+
+**Capabilities**: CustomEndpoint, UI, Config
+
+**Description**: Serves a custom HTTP endpoint on the gateway that echoes back request metadata alongside user-configured custom content. Includes a Studio admin UI for editing the content.
+
+**Key Features**:
+- Custom endpoint registration (catch-all `/*`)
+- Request metadata echo (method, path, headers, query, body)
+- Configurable custom content via Studio UI
+- Config persistence via `UpdatePluginConfig` Service API
+- Config sync from Studio to gateway via gRPC
+- WebComponent-based admin UI
+
+**Use Cases**:
+- Learning custom endpoint development
+- Understanding Studio-to-gateway config flow
+- Multi-capability plugin patterns (CustomEndpoint + UI + Config)
+- MCP/webhook plugin starting point
+
+**Complexity**: Beginner
+
+---
+
+### File Data Collectors (Unified SDK)
+
+**Path**: [`examples/plugins/data-collectors/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/data-collectors)
+
+**Capabilities**: DataCollector
+
+**Examples**:
+- `file-proxy-collector/` - Exports proxy logs to JSONL files
+- `file-analytics-collector/` - Exports analytics to CSV or JSONL files
+- `file-budget-collector/` - Exports budget data to CSV or JSONL files with optional aggregation
+
+**Description**: Simple file-based data collectors for testing and local development. Write telemetry data (proxy logs, analytics, budget usage) to files instead of or in addition to the database.
+
+**Features**:
+- Multiple output formats (CSV, JSONL)
+- Daily log rotation
+- Optional aggregate summaries (budget collector)
+- Configurable output directories
+- Environment variable support
+- Replace or supplement database storage
+
+**Use Cases**:
+- Local development and debugging
+- Understanding DataCollector interface
+- Simple log export without external dependencies
+- Custom analytics pipelines
+- Reduced database load in high-throughput scenarios
+- Backup and archival of telemetry data
+
+**Configuration Example**:
+```yaml
+data_collection_plugins:
+  - name: "analytics-files"
+    path: "./examples/plugins/unified/data-collectors/file-analytics-collector/file_analytics_collector"
+    enabled: true
+    priority: 200
+    replace_database: false
+    hook_types:
+      - "analytics"
+    config:
+      output_directory: "./data/collected/analytics"
+      enabled: "true"
+      format: "jsonl"  # or "csv"
+```
+
+**Complexity**: Beginner
+
+**Migration Status**: ✅ Migrated to unified SDK. Old examples remain available at [`examples/plugins/gateway/file_*_collector/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/gateway) for reference.
+
+---
+
+## Example Organization
+
+### By Capability
+
+| Capability | Examples |
+|------------|----------|
+| **Agent** | echo-agent |
+| **Object Hooks** | llm-validator, hook-test-plugin |
+| **PreAuth** | **llm-firewall** ★ |
+| **PostAuth** | **llm-cache** ★, **llm-firewall** ★, request_enricher, message_modifier, service-api-test, gateway-service-test |
+| **Response** | **llm-cache** ★, response_modifier, llm-rate-limiter-multiphase |
+| **DataCollector** | elasticsearch_collector, file-analytics-collector, file-budget-collector, file-proxy-collector |
+| **UI Provider** | **llm-cache** ★, **llm-firewall** ★, llm-rate-limiter-multiphase, custom-auth-ui, portal-feedback |
+| **Portal UI** | portal-feedback |
+| **Scheduler** | **github-rag-ingest** ★ |
+| **EdgePayloadReceiver** | **llm-cache** ★ |
+| **Custom Endpoints** | custom-echo-endpoint |
+| **Multi-Capability** | **llm-cache** ★ (8 capabilities), llm-rate-limiter-multiphase (PostAuth + Response + UI), custom-echo-endpoint (CustomEndpoint + UI + Config) |
+
+★ = Production-ready community/enterprise plugins (recommended as reference)
+
+### By Runtime
+
+| Runtime | Examples |
+|---------|----------|
+| **Studio Only** | echo-agent, llm-validator, hook-test-plugin, llm-rate-limiter-multiphase, custom-auth-ui, portal-feedback, service-api-test |
+| **Gateway Only** | request_enricher, response_modifier, message_modifier, elasticsearch_collector, gateway-service-test, file-analytics-collector, file-budget-collector, file-proxy-collector |
+| **Both** | custom-echo-endpoint (UI in Studio + CustomEndpoint on Gateway) |
+
+### By Complexity
+
+| Level | Examples |
+|-------|----------|
+| **Beginner** | echo-agent, portal-feedback, request_enricher, message_modifier, custom-echo-endpoint, file-analytics-collector, file-budget-collector, file-proxy-collector |
+| **Intermediate** | llm-validator, hook-test-plugin, response_modifier, gateway-service-test |
+| **Advanced** | llm-rate-limiter-multiphase, service-api-test, elasticsearch_collector, custom-auth-ui |
+
+## Running Examples
+
+### Build an Example
+
+```bash
+cd examples/plugins/studio/echo-agent
+go build -o echo-agent server/main.go
+```
+
+### Deploy to AI Studio
+
+```bash
+# Create plugin
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{
+    "name": "Echo Agent",
+    "slug": "echo-agent",
+    "command": "file:///path/to/echo-agent",
+    "hook_type": "agent",
+    "plugin_type": "agent",
+    "is_active": true
+  }'
+```
+
+### Deploy to Gateway
+
+Configure in gateway config:
+
+```yaml
+plugins:
+  - name: request-enricher
+    command: file:///path/to/request-enricher
+    enabled: true
+```
+
+## Common Patterns
+
+### 1. Basic Plugin Structure
+
+All examples follow this pattern:
+
+```go Expandable
+import "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+func NewMyPlugin() *MyPlugin {
+    return &MyPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin("name", "version", "desc"),
+    }
+}
+
+func main() {
+    plugin_sdk.Serve(NewMyPlugin())
+}
+```
+
+### 2. Configuration Handling
+
+```go
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    // Parse plugin-specific config
+    p.apiKey = config["api_key"]
+
+    // Extract broker ID for Service API access (Studio plugins)
+    if brokerIDStr, ok := config["_service_broker_id"]; ok {
+        var brokerID uint32
+        fmt.Sscanf(brokerIDStr, "%d", &brokerID)
+        ai_studio_sdk.SetServiceBrokerID(brokerID)
+    }
+
+    return nil
+}
+```
+
+### 3. Universal Services
+
+```go
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Logging
+    ctx.Services.Logger().Info("Processing", "app_id", ctx.AppID)
+
+    // KV storage
+    data, _ := ctx.Services.KV().Read(ctx, "key")
+    ctx.Services.KV().Write(ctx, "key", []byte("value"))
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+### 4. Runtime Detection
+
+```go
+if ctx.Runtime == plugin_sdk.RuntimeStudio {
+    // Studio-specific code
+    llms, _ := ctx.Services.Studio().ListLLMs(ctx, 1, 10)
+} else if ctx.Runtime == plugin_sdk.RuntimeGateway {
+    // Gateway-specific code
+    app, _ := ctx.Services.Gateway().GetApp(ctx, ctx.AppID)
+}
+```
+
diff --git a/ai-management/ai-studio/plugins/manifests.mdx b/ai-management/ai-studio/plugins/manifests.mdx
new file mode 100644
index 0000000000..9e5ba007b7
--- /dev/null
+++ b/ai-management/ai-studio/plugins/manifests.mdx
@@ -0,0 +1,746 @@
+---
+title: "Tyk AI Studio Plugin Manifests"
+description: "How to define plugin manifests for Tyk AI Studio plugins?"
+keywords: "AI Studio, AI Management, Plugin Manifests, Plugin Development"
+sidebarTitle: "Manifests"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph TD
+    A[Plugin Manifest] --> B[Metadata]
+    A --> C[Capabilities]
+    A --> D[Permissions]
+    A --> E[UI Integration]
+```
+
+
+Plugin manifests define plugin metadata, capabilities, permissions, and UI integration. Understanding manifests is essential for building secure, well-integrated plugins.
+
+## Manifest Structure
+
+### Edge Gateway Plugins
+
+Edge Gateway plugins don't use JSON manifests. Configuration is provided via the API when creating the plugin:
+
+```json
+{
+  "name": "Custom Auth Plugin",
+  "slug": "custom-auth",
+  "description": "Custom authentication logic",
+  "command": "file:///path/to/plugin",
+  "hook_type": "auth",
+  "plugin_type": "gateway",
+  "config": {
+    "valid_token": "secret123"
+  },
+  "is_active": true
+}
+```
+
+Hook types for Edge Gateway plugins:
+- `pre_auth` - Before authentication
+- `auth` - Custom authentication
+- `post_auth` - After authentication
+- `on_response` - Response modification
+- `data_collection` - Data export
+
+### AI Studio UI Plugins
+
+Complete manifest structure for UI plugins:
+
+```json Expandable
+{
+  "id": "com.example.plugin",
+  "name": "My Plugin",
+  "version": "1.0.0",
+  "description": "Plugin description",
+  "plugin_type": "ai_studio",
+  "permissions": {
+    "services": [
+      "llms.read",
+      "llms.write",
+      "llms.proxy",
+      "tools.read",
+      "tools.execute",
+      "tools.write",
+      "datasources.read",
+      "datasources.query",
+      "apps.read",
+      "apps.write",
+      "plugins.read",
+      "analytics.read",
+      "kv.read",
+      "kv.readwrite"
+    ]
+  },
+  "ui": {
+    "slots": [
+      {
+        "slot": "sidebar.section",
+        "label": "My Plugin",
+        "icon": "/assets/icon.svg",
+        "items": [
+          {
+            "type": "route",
+            "path": "/admin/my-plugin",
+            "title": "Dashboard",
+            "mount": {
+              "kind": "webc",
+              "tag": "my-plugin-dashboard",
+              "entry": "/ui/webc/dashboard.js",
+              "props": {
+                "apiBase": "/plugin/com.example.plugin/rpc"
+              }
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "rpc": {
+    "basePath": "/plugin/com.example.plugin/rpc"
+  },
+  "assets": [
+    "/assets/icon.svg",
+    "/ui/webc/dashboard.js"
+  ],
+  "compat": {
+    "app": ">=2.6 <3.0",
+    "api": ["ui-v1", "kv-v1", "rpc-v1"]
+  },
+  "security": {
+    "csp": "script-src 'self'; object-src 'none'"
+  }
+}
+```
+
+### AI Studio Agent Plugins
+
+Agent plugin manifests are simpler (no UI):
+
+```json Expandable
+{
+  "id": "com.example.agent",
+  "name": "My Agent",
+  "version": "1.0.0",
+  "description": "Custom conversational agent",
+  "plugin_type": "agent",
+  "permissions": {
+    "services": [
+      "llms.proxy",
+      "tools.execute",
+      "datasources.query",
+      "kv.readwrite"
+    ]
+  },
+  "ui": {
+    "slots": []
+  }
+}
+```
+
+### Object Hooks Plugins
+
+Object hooks plugins intercept CRUD operations on platform objects. These plugins use the unified SDK and register hooks programmatically, so the manifest doesn't need special hook configuration.
+
+#### Basic Object Hooks Manifest
+
+```json Expandable
+{
+  "id": "com.example.validator",
+  "name": "LLM Validator",
+  "version": "1.0.0",
+  "description": "Validates LLM configurations before saving",
+  "plugin_type": "ai_studio",
+  "permissions": {
+    "services": [
+      "llms.read",
+      "kv.readwrite"
+    ]
+  },
+  "ui": {
+    "slots": []
+  }
+}
+```
+
+**Note**: Object hooks are registered via the `GetObjectHookRegistrations()` method in the plugin code, not in the manifest. The plugin_type is `"ai_studio"` since object hooks are Studio-only.
+
+#### Hook Registration (Code, Not Manifest)
+
+Object hooks are registered programmatically:
+
+```go Expandable
+func (p *ValidatorPlugin) GetObjectHookRegistrations() ([]*pb.ObjectHookRegistration, error) {
+    return []*pb.ObjectHookRegistration{
+        {
+            ObjectType: "llm",               // llm, datasource, tool, user
+            HookTypes:  []string{            // before_create, after_create, etc.
+                "before_create",
+                "before_update",
+            },
+            Priority: 10,                    // Lower runs first
+        },
+        {
+            ObjectType: "datasource",
+            HookTypes:  []string{"before_create"},
+            Priority:   5,                   // Runs before priority 10
+        },
+    }, nil
+}
+```
+
+**Supported Objects**:
+- `llm` - LLM provider configurations
+- `datasource` - Data source connections
+- `tool` - External tool definitions
+- `user` - User accounts
+
+**Supported Hook Types** (per object):
+- `before_create` - Before object creation (can block)
+- `after_create` - After object creation (notification only)
+- `before_update` - Before object update (can block)
+- `after_update` - After object update (notification only)
+- `before_delete` - Before object deletion (can block)
+- `after_delete` - After object deletion (notification only)
+
+**Priority**: Lower numbers run first (e.g., priority 5 runs before priority 10). Use priority to control hook execution order when multiple plugins register hooks for the same object/event.
+
+#### Multi-Capability with Hooks
+
+Object hooks plugins can combine hooks with UI:
+
+```json Expandable
+{
+  "id": "com.example.approval-system",
+  "name": "Approval System",
+  "version": "1.0.0",
+  "description": "Requires approval for datasource creation",
+  "plugin_type": "ai_studio",
+  "permissions": {
+    "services": [
+      "datasources.read",
+      "kv.readwrite"
+    ]
+  },
+  "ui": {
+    "slots": [
+      {
+        "slot": "sidebar.section",
+        "label": "Approvals",
+        "items": [
+          {
+            "type": "route",
+            "path": "/admin/approvals",
+            "title": "Pending Approvals",
+            "mount": {
+              "kind": "webc",
+              "tag": "approval-dashboard",
+              "entry": "/ui/webc/approvals.js"
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "rpc": {
+    "basePath": "/plugin/com.example.approval-system/rpc"
+  }
+}
+```
+
+This plugin would:
+1. Register `before_create` hooks for datasources (via code)
+2. Block creation and add to pending approvals
+3. Provide UI dashboard to approve/reject
+4. Use RPC methods for approval actions
+
+See `examples/plugins/studio/llm-validator/` and `examples/plugins/studio/hook-test-plugin/` for complete examples.
+
+### Resource Provider Plugins
+
+Resource Provider plugins register custom resource types that integrate into the App creation flow. Declare resource types in the manifest's `resource_types` section:
+
+```json Expandable
+{
+  "id": "com.example.mcp-registry",
+  "name": "MCP Registry",
+  "version": "1.0.0",
+  "description": "Manages MCP server resources",
+  "capabilities": {
+    "hooks": ["resource_provider", "studio_ui"]
+  },
+  "resource_types": [
+    {
+      "slug": "mcp_servers",
+      "name": "MCP Servers",
+      "description": "Model Context Protocol servers",
+      "icon": "Hub",
+      "has_privacy_score": true,
+      "supports_submissions": true,
+      "form_component": {
+        "tag": "mcp-server-selector",
+        "entry_point": "ui/webc/mcp-selector.js"
+      }
+    }
+  ],
+  "permissions": {
+    "services": ["apps.read", "kv.readwrite"]
+  }
+}
+```
+
+Resource types declared in the manifest are automatically registered when the plugin loads. The plugin also implements `ResourceProvider` methods programmatically for runtime behavior.
+
+| Field | Required | Description |
+|-------|:---:|-------------|
+| `slug` | Yes | Machine-readable identifier, unique per plugin |
+| `name` | Yes | Display name shown in the App form |
+| `has_privacy_score` | No | Whether instances carry privacy scores (default: `false`) |
+| `supports_submissions` | No | Whether community users can submit instances (default: `false`) |
+| `form_component` | No | Custom Web Component for the App form selector |
+
+See [Resource Provider Plugins](/ai-management/ai-studio/plugins/resource-types) for the full guide.
+
+## Service Scopes Reference
+
+### LLM Scopes
+
+| Scope | Description | Operations |
+|-------|-------------|------------|
+| `llms.read` | Read LLM configurations | List LLMs, Get LLM details, Get LLM counts |
+| `llms.write` | Create/update LLMs | Create LLM, Update LLM, Delete LLM |
+| `llms.proxy` | Call LLMs via proxy | CallLLM (streaming/non-streaming) |
+
+### Tool Scopes
+
+| Scope | Description | Operations |
+|-------|-------------|------------|
+| `tools.read` | Read tool configurations | List Tools, Get Tool details |
+| `tools.execute` | Execute tools | ExecuteTool with operation and parameters |
+| `tools.write` | Create/update tools | Create Tool, Update Tool, Delete Tool |
+| `tools.operations` | Manage tool operations | Add/remove operations |
+
+### Datasource Scopes
+
+| Scope | Description | Operations |
+|-------|-------------|------------|
+| `datasources.read` | Read datasource configurations | List Datasources, Get Datasource details |
+| `datasources.query` | Query datasources | QueryDatasource with SQL/query DSL |
+| `datasources.write` | Create/update datasources | Create, Update, Delete Datasources |
+
+### App Scopes
+
+| Scope | Description | Operations |
+|-------|-------------|------------|
+| `apps.read` | Read app configurations | List Apps, Get App details |
+| `apps.write` | Create/update apps | Create App, Update App, Delete App |
+
+### Plugin Scopes
+
+| Scope | Description | Operations |
+|-------|-------------|------------|
+| `plugins.read` | Read plugin configurations | List Plugins, Get Plugin details, Get counts |
+| `plugins.write` | Create/update plugins | Create Plugin, Update Plugin |
+
+### KV Storage Scopes
+
+| Scope | Description | Operations |
+|-------|-------------|------------|
+| `kv.read` | Read plugin KV storage | ReadPluginKV, ListPluginKVKeys |
+| `kv.readwrite` | Read/write plugin KV storage | Read + WritePluginKV, DeletePluginKV |
+
+### Analytics Scopes
+
+| Scope | Description | Operations |
+|-------|-------------|------------|
+| `analytics.read` | Read analytics data | GetUsageStats, GetCostAnalytics |
+| `analytics.write` | Write analytics data | RecordCustomMetric |
+
+## UI Slot System
+
+### Available Slots
+
+#### sidebar.section
+
+Add a collapsible section to the sidebar with nested items:
+
+```json Expandable
+{
+  "slot": "sidebar.section",
+  "label": "My Plugin",
+  "icon": "/assets/icon.svg",
+  "items": [
+    {
+      "type": "route",
+      "path": "/admin/my-plugin/dashboard",
+      "title": "Dashboard",
+      "mount": { }
+    },
+    {
+      "type": "route",
+      "path": "/admin/my-plugin/settings",
+      "title": "Settings",
+      "mount": { }
+    }
+  ]
+}
+```
+
+#### sidebar.link
+
+Add a single link to the sidebar:
+
+```json
+{
+  "slot": "sidebar.link",
+  "label": "Quick Action",
+  "icon": "/assets/icon.svg",
+  "path": "/admin/quick-action"
+}
+```
+
+#### settings.section
+
+Add a section to the Settings page:
+
+```json
+{
+  "slot": "settings.section",
+  "label": "Plugin Settings",
+  "path": "/admin/settings/plugin",
+  "mount": {
+    "kind": "webc",
+    "tag": "plugin-settings",
+    "entry": "/ui/webc/settings.js"
+  }
+}
+```
+
+#### app.detail.tab
+
+Add a tab to App detail pages:
+
+```json
+{
+  "slot": "app.detail.tab",
+  "label": "Custom View",
+  "mount": {
+    "kind": "webc",
+    "tag": "app-custom-view",
+    "entry": "/ui/webc/app-view.js",
+    "props": {
+      "appId": "{{app.id}}"
+    }
+  }
+}
+```
+
+#### llm.detail.tab
+
+Add a tab to LLM detail pages:
+
+```json
+{
+  "slot": "llm.detail.tab",
+  "label": "Analytics",
+  "mount": {
+    "kind": "webc",
+    "tag": "llm-analytics",
+    "entry": "/ui/webc/llm-analytics.js",
+    "props": {
+      "llmId": "{{llm.id}}"
+    }
+  }
+}
+```
+
+### Mount Configuration
+
+#### WebComponent Mount
+
+```json
+{
+  "kind": "webc",
+  "tag": "my-component",
+  "entry": "/ui/webc/component.js",
+  "props": {
+    "apiBase": "/plugin/com.example/rpc",
+    "theme": "dark"
+  }
+}
+```
+
+- `kind`: Must be `"webc"` for WebComponents
+- `tag`: Custom element tag name
+- `entry`: Path to JavaScript file (relative to plugin)
+- `props`: Properties passed to the component
+
+## Permission Validation
+
+Permissions are validated when plugins call the Service API:
+
+```go
+// This call requires "llms.read" scope
+llmsResp, err := ai_studio_sdk.ListLLMs(ctx, 1, 10)
+if err != nil {
+    // Error: insufficient permissions
+    log.Printf("Permission denied: %v", err)
+}
+```
+
+If your plugin doesn't declare the required scope in its manifest, Service API calls will fail with permission errors.
+
+## Configuration Schema
+
+Plugins can provide JSON Schema for their configuration:
+
+```go Expandable
+func (p *MyPlugin) GetConfigSchema() ([]byte, error) {
+    schema := map[string]interface{}{
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "type":    "object",
+        "title":   "My Plugin Configuration",
+        "properties": map[string]interface{}{
+            "api_key": map[string]interface{}{
+                "type":        "string",
+                "description": "API key for external service",
+                "minLength":   1,
+            },
+            "endpoint": map[string]interface{}{
+                "type":        "string",
+                "format":      "uri",
+                "description": "Service endpoint URL",
+                "default":     "https://api.example.com",
+            },
+            "rate_limit": map[string]interface{}{
+                "type":        "integer",
+                "description": "Requests per minute",
+                "minimum":     1,
+                "maximum":     1000,
+                "default":     100,
+            },
+            "enabled": map[string]interface{}{
+                "type":        "boolean",
+                "description": "Enable plugin",
+                "default":     true,
+            },
+        },
+        "required": []string{"api_key"},
+    }
+
+    return json.Marshal(schema)
+}
+```
+
+The platform uses this schema to:
+- Validate configuration on save
+- Generate UI forms
+- Provide inline documentation
+- Set default values
+
+## Security Best Practices
+
+### Principle of Least Privilege
+
+Only request scopes your plugin actually needs:
+
+```json
+{
+  "permissions": {
+    "services": [
+      "llms.read",      // ✅ Need to list LLMs
+      "kv.readwrite"    // ✅ Need to store settings
+      // ❌ Don't add "llms.write" if not creating LLMs
+      // ❌ Don't add "llms.proxy" if not calling LLMs
+    ]
+  }
+}
+```
+
+### Content Security Policy
+
+Define CSP headers for UI plugins:
+
+```json
+{
+  "security": {
+    "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.example.com; object-src 'none'; frame-ancestors 'none'"
+  }
+}
+```
+
+### Input Validation
+
+Always validate inputs in RPC methods:
+
+```go Expandable
+func (p *MyPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    // Validate method
+    allowedMethods := map[string]bool{
+        "get_data":    true,
+        "save_config": true,
+    }
+
+    if !allowedMethods[method] {
+        return nil, fmt.Errorf("invalid method: %s", method)
+    }
+
+    // Validate payload
+    var data map[string]interface{}
+    if err := json.Unmarshal(payload, &data); err != nil {
+        return nil, fmt.Errorf("invalid payload: %w", err)
+    }
+
+    // Additional validation...
+    return p.processMethod(method, data)
+}
+```
+
+### Secrets Management
+
+Never hardcode secrets in manifests or code:
+
+```go
+// ❌ Bad: Hardcoded secret
+func (p *MyPlugin) OnInitialize(...) error {
+    p.apiKey = "secret123"  // Don't do this!
+}
+
+// ✅ Good: Configuration from secure storage
+func (p *MyPlugin) OnInitialize(...) error {
+    // Read from config (stored securely by platform)
+    config, _ := ai_studio_sdk.ReadPluginKV(ctx, "config")
+    var cfg Config
+    json.Unmarshal(config, &cfg)
+    p.apiKey = cfg.APIKey
+}
+```
+
+## Versioning and Compatibility
+
+### Semantic Versioning
+
+Use semantic versioning for plugin versions:
+
+```json
+{
+  "version": "1.2.3"  // MAJOR.MINOR.PATCH
+}
+```
+
+- MAJOR: Breaking changes
+- MINOR: New features, backward compatible
+- PATCH: Bug fixes, backward compatible
+
+### Compatibility Declaration
+
+Declare platform compatibility:
+
+```json
+{
+  "compat": {
+    "app": ">=2.6 <3.0",
+    "api": ["ui-v1", "kv-v1", "rpc-v1"]
+  }
+}
+```
+
+## Testing Manifests
+
+### Validation
+
+Validate your manifest before deployment:
+
+```bash
+# Check JSON syntax
+cat plugin.manifest.json | jq .
+
+# Validate required fields
+jq '.id, .name, .version, .plugin_type' plugin.manifest.json
+```
+
+### Common Errors
+
+| Error | Cause | Solution |
+|-------|-------|----------|
+| "Invalid plugin_type" | Wrong plugin type | Use `"ai_studio"` or `"agent"` |
+| "Missing required field" | Missing manifest field | Add `id`, `name`, `version` |
+| "Invalid scope" | Unknown service scope | Check scope name spelling |
+| "Duplicate UI slot" | Slot registered twice | Remove duplicate slot |
+| "Asset not found" | Missing embedded file | Verify `//go:embed` directive |
+
+## Complete Examples
+
+### Minimal UI Plugin
+
+```json Expandable
+{
+  "id": "com.example.minimal",
+  "name": "Minimal Plugin",
+  "version": "1.0.0",
+  "plugin_type": "ai_studio",
+  "permissions": {
+    "services": ["kv.readwrite"]
+  },
+  "ui": {
+    "slots": [
+      {
+        "slot": "sidebar.link",
+        "label": "Minimal",
+        "path": "/admin/minimal"
+      }
+    ]
+  }
+}
+```
+
+### Full-Featured UI Plugin
+
+See [plugins-studio-ui.md](/ai-management/ai-studio/plugins/studio-ui) for complete rate-limiting-ui example.
+
+### Minimal Agent Plugin
+
+```json
+{
+  "id": "com.example.simple-agent",
+  "name": "Simple Agent",
+  "version": "1.0.0",
+  "plugin_type": "agent",
+  "permissions": {
+    "services": ["llms.proxy"]
+  },
+  "ui": {
+    "slots": []
+  }
+}
+```
+
+### Advanced Agent Plugin
+
+```json Expandable
+{
+  "id": "com.example.rag-agent",
+  "name": "RAG Agent",
+  "version": "1.0.0",
+  "description": "Agent with retrieval-augmented generation",
+  "plugin_type": "agent",
+  "permissions": {
+    "services": [
+      "llms.proxy",
+      "datasources.query",
+      "tools.execute",
+      "kv.readwrite",
+      "analytics.read"
+    ]
+  },
+  "ui": {
+    "slots": []
+  }
+}
+```
diff --git a/ai-management/ai-studio/plugins/object-hooks.mdx b/ai-management/ai-studio/plugins/object-hooks.mdx
new file mode 100644
index 0000000000..37332b9979
--- /dev/null
+++ b/ai-management/ai-studio/plugins/object-hooks.mdx
@@ -0,0 +1,625 @@
+---
+title: "Object Hooks Plugin in Tyk AI Studio"
+description: "Learn how to use Object Hooks plugins in Tyk AI Studio to intercept and modify requests and responses for specific AI providers and models."
+keywords: "AI Studio, AI Management, Plugins, Object Hooks"
+sidebarTitle: "Object Hooks"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+## Object Hooks Plugin Guide
+
+
+```mermaid
+graph TD
+    A[CRUD Operation] --> B{Object Hook}
+    B -->|Pre-Hook| C[Validate/Enrich]
+    B -->|Post-Hook| D[Audit/Sync]
+```
+
+
+Object Hooks are a powerful plugin capability that allows you to **intercept and control CRUD operations** on AI Studio objects before they are saved to the database. This enables validation, enrichment, policy enforcement, and integration with external systems.
+
+## Overview
+
+Object Hooks provide plugins with the ability to:
+
+- **Validate** objects before creation or modification
+- **Reject** operations that don't meet requirements
+- **Enrich** objects with additional data
+- **Enforce policies** (security, compliance, naming conventions)
+- **Integrate** with external systems (ticketing, approval workflows)
+- **Audit** changes with custom metadata
+- **Transform** data before it reaches the database
+
+### Supported Objects
+
+Object Hooks work with four core AI Studio object types:
+
+| Object Type | Description | Common Use Cases |
+|-------------|-------------|------------------|
+| **llm** | LLM Providers | Validate endpoints, enforce HTTPS, check privacy scores |
+| **datasource** | Data Sources | Validate connections, enforce security policies |
+| **tool** | External Tools | Validate OpenAPI specs, check endpoints |
+| **user** | Users | Enforce naming conventions, integrate with LDAP/AD |
+
+### Hook Types
+
+Each object type supports six hook types that fire at different points in the lifecycle:
+
+| Hook Type | When It Fires | Can Block? | Can Modify Object? | Common Use Cases |
+|-----------|---------------|------------|-------------------|------------------|
+| **before_create** | Before object creation | Yes | Yes | Validation, default values, policy enforcement |
+| **after_create** | After object creation | No | No | Notifications, external system sync, audit logging |
+| **before_update** | Before object update | Yes | Yes | Change validation, approval workflows |
+| **after_update** | After object update | No | No | Change notifications, audit trails |
+| **before_delete** | Before object deletion | Yes | No | Prevent deletion, cleanup checks |
+| **after_delete** | After object deletion | No | No | Cleanup external resources, notifications |
+
+**Important Notes:**
+- `before_*` hooks can block operations by setting `AllowOperation: false`
+- `after_*` hooks are informational only and cannot block operations
+- Only `before_create` and `before_update` can modify the object itself
+- All hooks can add plugin metadata that is stored with the object
+
+## Implementing Object Hooks
+
+### Step 1: Implement ObjectHookHandler Interface
+
+```go
+type ObjectHookHandler interface {
+    GetObjectHookRegistrations() ([]*pb.ObjectHookRegistration, error)
+    HandleObjectHook(ctx Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error)
+}
+```
+
+### Step 2: Register Your Hooks
+
+Declare which object types and hook types your plugin handles:
+
+```go Expandable
+func (p *MyPlugin) GetObjectHookRegistrations() ([]*pb.ObjectHookRegistration, error) {
+    return []*pb.ObjectHookRegistration{
+        {
+            ObjectType: "llm",
+            HookTypes:  []string{"before_create", "before_update"},
+            Priority:   10, // Lower numbers run first
+        },
+        {
+            ObjectType: "datasource",
+            HookTypes:  []string{"before_create"},
+            Priority:   20,
+        },
+    }, nil
+}
+```
+
+**Priority Ordering:**
+- Lower priority numbers execute **first** (e.g., priority 10 runs before priority 50)
+- Use priorities to control execution order when multiple plugins handle the same hook
+- Common priority ranges:
+  - `1-10`: Critical validation that should run first
+  - `11-49`: Standard validation and policy enforcement
+  - `50-89`: Enrichment and transformation
+  - `90-99`: Logging and audit (should run last)
+
+### Step 3: Handle Hook Invocations
+
+Process the hook request and return a response:
+
+```go Expandable
+func (p *MyPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    // Parse the object
+    var obj MyObjectType
+    if err := json.Unmarshal([]byte(req.ObjectJson), &obj); err != nil {
+        return &pb.ObjectHookResponse{
+            AllowOperation:  false,
+            RejectionReason: fmt.Sprintf("Invalid object data: %v", err),
+        }, nil
+    }
+
+    // Perform validation/processing
+    if err := validateObject(&obj); err != nil {
+        return &pb.ObjectHookResponse{
+            AllowOperation:  false,
+            RejectionReason: err.Error(),
+            Message:         fmt.Sprintf("Validation failed: %v", err),
+        }, nil
+    }
+
+    // Allow operation with metadata
+    return &pb.ObjectHookResponse{
+        AllowOperation: true,
+        PluginMetadata: map[string]string{
+            "validated_by": "my-plugin",
+            "validated_at": time.Now().Format(time.RFC3339),
+        },
+        Message: "Validation passed",
+    }, nil
+}
+```
+
+## Hook Request Structure
+
+The `ObjectHookRequest` provides context about the operation:
+
+```go
+type ObjectHookRequest struct {
+    ObjectType   string                 // "llm", "datasource", "tool", or "user"
+    ObjectID     uint32                 // Object ID (0 for create operations)
+    ObjectJson   string                 // JSON representation of the object
+    HookType     string                 // e.g., "before_create", "after_update"
+    OperationId  string                 // Unique operation identifier
+    UserId       uint32                 // User performing the operation
+    PreviousJson string                 // Previous state (for updates only)
+    Metadata     map[string]string      // Additional context
+}
+```
+
+**Key Fields:**
+- `ObjectJson`: The object being created/updated/deleted (JSON string)
+- `PreviousJson`: Previous object state for update operations (compare before/after)
+- `ObjectID`: 0 for create operations, actual ID for update/delete
+- `OperationId`: Unique ID for correlating logs and debugging
+
+## Hook Response Structure
+
+Your plugin returns an `ObjectHookResponse`:
+
+```go
+type ObjectHookResponse struct {
+    AllowOperation  bool              // true = allow, false = block (before_* only)
+    RejectionReason string            // Error message when blocking
+    Modified        bool              // true if ModifiedObjectJson is provided
+    ModifiedObjectJson string         // Modified object (before_create/before_update only)
+    PluginMetadata  map[string]string // Metadata to store with object
+    Message         string            // User-friendly message
+}
+```
+
+**Response Patterns:**
+
+### 1. Allow Without Changes
+```go
+return &pb.ObjectHookResponse{
+    AllowOperation: true,
+    Modified:       false,
+}, nil
+```
+
+### 2. Allow With Metadata
+```go
+return &pb.ObjectHookResponse{
+    AllowOperation: true,
+    PluginMetadata: map[string]string{
+        "validated": "true",
+        "validator_version": "1.0",
+    },
+    Message: "Validation passed",
+}, nil
+```
+
+### 3. Block Operation
+```go
+return &pb.ObjectHookResponse{
+    AllowOperation:  false,
+    RejectionReason: "API endpoint must use HTTPS",
+    Message:         "Security policy violation",
+}, nil
+```
+
+### 4. Modify Object (before_create/before_update only)
+```go Expandable
+// Modify the object
+obj.Name = strings.ToUpper(obj.Name)
+obj.Metadata["enriched"] = "true"
+
+// Marshal back to JSON
+modifiedJSON, _ := json.Marshal(obj)
+
+return &pb.ObjectHookResponse{
+    AllowOperation:     true,
+    Modified:           true,
+    ModifiedObjectJson: string(modifiedJSON),
+    PluginMetadata: map[string]string{
+        "enriched_by": "my-plugin",
+    },
+}, nil
+```
+
+## Complete Example: LLM Validator
+
+This example validates LLM objects to enforce security and quality policies:
+
+```go Expandable
+package main
+
+import (
+    "encoding/json"
+    "fmt"
+    "strings"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+)
+
+type LLMValidatorPlugin struct {
+    plugin_sdk.BasePlugin
+    config *Config
+}
+
+type Config struct {
+    RequireHTTPS       bool     `json:"require_https"`
+    BlockedVendors     []string `json:"blocked_vendors"`
+    MinPrivacyScore    int      `json:"min_privacy_score"`
+    RequireDescription bool     `json:"require_description"`
+}
+
+type LLM struct {
+    ID               uint     `json:"id"`
+    Name             string   `json:"name"`
+    APIEndpoint      string   `json:"api_endpoint"`
+    Vendor           string   `json:"vendor"`
+    PrivacyScore     int      `json:"privacy_score"`
+    ShortDescription string   `json:"short_description"`
+}
+
+func NewLLMValidatorPlugin() *LLMValidatorPlugin {
+    return &LLMValidatorPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "llm-validator",
+            "1.0.0",
+            "Validates LLM configurations",
+        ),
+        config: &Config{
+            RequireHTTPS:       true,
+            BlockedVendors:     []string{},
+            MinPrivacyScore:    0,
+            RequireDescription: true,
+        },
+    }
+}
+
+func (p *LLMValidatorPlugin) Init(ctx plugin_sdk.Context, config map[string]string) error {
+    if configJSON, ok := config["config"]; ok {
+        if err := json.Unmarshal([]byte(configJSON), p.config); err != nil {
+            return fmt.Errorf("failed to parse config: %w", err)
+        }
+    }
+    return nil
+}
+
+// Register hooks for LLM objects
+func (p *LLMValidatorPlugin) GetObjectHookRegistrations() ([]*pb.ObjectHookRegistration, error) {
+    return []*pb.ObjectHookRegistration{
+        {
+            ObjectType: "llm",
+            HookTypes:  []string{"before_create", "before_update"},
+            Priority:   10, // Run early
+        },
+    }, nil
+}
+
+// Handle hook invocations
+func (p *LLMValidatorPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    // Only handle LLM objects
+    if req.ObjectType != "llm" {
+        return &pb.ObjectHookResponse{AllowOperation: true}, nil
+    }
+
+    // Parse LLM object
+    var llm LLM
+    if err := json.Unmarshal([]byte(req.ObjectJson), &llm); err != nil {
+        return &pb.ObjectHookResponse{
+            AllowOperation:  false,
+            RejectionReason: fmt.Sprintf("Invalid LLM data: %v", err),
+        }, nil
+    }
+
+    // Run validations
+    if err := p.validateLLM(&llm); err != nil {
+        return &pb.ObjectHookResponse{
+            AllowOperation:  false,
+            RejectionReason: err.Error(),
+            Message:         fmt.Sprintf("LLM validation failed: %v", err),
+        }, nil
+    }
+
+    // Add validation metadata
+    return &pb.ObjectHookResponse{
+        AllowOperation: true,
+        PluginMetadata: map[string]string{
+            "validated_by": "llm-validator",
+            "validation_rules": fmt.Sprintf("https=%v,privacy>=%d",
+                p.config.RequireHTTPS, p.config.MinPrivacyScore),
+        },
+        Message: fmt.Sprintf("LLM '%s' validated successfully", llm.Name),
+    }, nil
+}
+
+func (p *LLMValidatorPlugin) validateLLM(llm *LLM) error {
+    // Check HTTPS requirement
+    if p.config.RequireHTTPS && llm.APIEndpoint != "" {
+        if !strings.HasPrefix(strings.ToLower(llm.APIEndpoint), "https://") {
+            return fmt.Errorf("API endpoint must use HTTPS (got: %s)", llm.APIEndpoint)
+        }
+    }
+
+    // Check blocked vendors
+    for _, blocked := range p.config.BlockedVendors {
+        if strings.EqualFold(llm.Vendor, blocked) {
+            return fmt.Errorf("vendor '%s' is blocked by policy", llm.Vendor)
+        }
+    }
+
+    // Check minimum privacy score
+    if llm.PrivacyScore < p.config.MinPrivacyScore {
+        return fmt.Errorf("privacy score %d is below minimum %d",
+            llm.PrivacyScore, p.config.MinPrivacyScore)
+    }
+
+    // Check description requirement
+    if p.config.RequireDescription && strings.TrimSpace(llm.ShortDescription) == "" {
+        return fmt.Errorf("short description is required")
+    }
+
+    return nil
+}
+
+func main() {
+    plugin_sdk.Serve(NewLLMValidatorPlugin())
+}
+```
+
+## Use Case Examples
+
+### 1. Enforce HTTPS for LLM Endpoints
+
+```go Expandable
+func (p *SecurityPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    if req.ObjectType == "llm" && strings.HasPrefix(req.HookType, "before_") {
+        var llm LLM
+        json.Unmarshal([]byte(req.ObjectJson), &llm)
+
+        if llm.APIEndpoint != "" && !strings.HasPrefix(llm.APIEndpoint, "https://") {
+            return &pb.ObjectHookResponse{
+                AllowOperation:  false,
+                RejectionReason: "API endpoint must use HTTPS for security",
+            }, nil
+        }
+    }
+    return &pb.ObjectHookResponse{AllowOperation: true}, nil
+}
+```
+
+### 2. Auto-Enrich Objects with Defaults
+
+```go Expandable
+func (p *EnrichmentPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    if req.ObjectType == "user" && req.HookType == "before_create" {
+        var user User
+        json.Unmarshal([]byte(req.ObjectJson), &user)
+
+        // Add default role if not specified
+        if user.Role == "" {
+            user.Role = "viewer"
+        }
+
+        // Add organization metadata
+        if user.Metadata == nil {
+            user.Metadata = make(map[string]interface{})
+        }
+        user.Metadata["created_by"] = "auto-provisioning"
+
+        modifiedJSON, _ := json.Marshal(user)
+        return &pb.ObjectHookResponse{
+            AllowOperation:     true,
+            Modified:           true,
+            ModifiedObjectJson: string(modifiedJSON),
+        }, nil
+    }
+    return &pb.ObjectHookResponse{AllowOperation: true}, nil
+}
+```
+
+### 3. Integration with External Approval System
+
+```go Expandable
+func (p *ApprovalPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    // Require approval for datasource creation
+    if req.ObjectType == "datasource" && req.HookType == "before_create" {
+        // Check if operation has approval metadata
+        approvalID, hasApproval := req.Metadata["approval_id"]
+
+        if !hasApproval {
+            return &pb.ObjectHookResponse{
+                AllowOperation:  false,
+                RejectionReason: "Datasource creation requires manager approval. Please submit a request.",
+            }, nil
+        }
+
+        // Verify approval with external system
+        if !p.verifyApproval(ctx, approvalID) {
+            return &pb.ObjectHookResponse{
+                AllowOperation:  false,
+                RejectionReason: "Invalid or expired approval",
+            }, nil
+        }
+    }
+    return &pb.ObjectHookResponse{AllowOperation: true}, nil
+}
+```
+
+### 4. Audit Trail with Change Tracking
+
+```go Expandable
+func (p *AuditPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    if req.HookType == "before_update" {
+        // Compare old and new
+        changes := p.detectChanges(req.PreviousJson, req.ObjectJson)
+
+        // Log to external system
+        p.logAudit(ctx, AuditEntry{
+            ObjectType:  req.ObjectType,
+            ObjectID:    req.ObjectID,
+            UserID:      req.UserId,
+            Changes:     changes,
+            Timestamp:   time.Now(),
+        })
+    }
+
+    return &pb.ObjectHookResponse{
+        AllowOperation: true,
+        PluginMetadata: map[string]string{
+            "audit_logged": "true",
+            "audit_id":     generateAuditID(),
+        },
+    }, nil
+}
+```
+
+### 5. Prevent Deletion of Active Resources
+
+```go Expandable
+func (p *ProtectionPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    if req.HookType == "before_delete" {
+        // Check if LLM is actively being used
+        if req.ObjectType == "llm" {
+            activeApps, err := p.getActiveApps(ctx, req.ObjectID)
+            if err != nil {
+                ctx.Services.Logger().Error("Failed to check active apps", "error", err)
+            }
+
+            if len(activeApps) > 0 {
+                return &pb.ObjectHookResponse{
+                    AllowOperation:  false,
+                    RejectionReason: fmt.Sprintf("Cannot delete LLM: in use by %d application(s)", len(activeApps)),
+                }, nil
+            }
+        }
+    }
+    return &pb.ObjectHookResponse{AllowOperation: true}, nil
+}
+```
+
+## Best Practices
+
+### Validation
+- **Fail fast**: Perform quick checks first to avoid expensive operations
+- **Clear messages**: Provide specific, actionable error messages
+- **Log verbosely**: Use `ctx.Services.Logger()` for debugging
+- **Handle errors**: Always check JSON unmarshaling errors
+
+### Performance
+- **Keep hooks lightweight**: Hooks run synchronously in the request path
+- **Cache lookups**: Use KV storage for repeated validations
+- **Timeout external calls**: Use context timeouts for external APIs
+- **Async for after_ hooks**: Use goroutines for non-critical after_ hook work
+
+### Security
+- **Validate all inputs**: Never trust object data
+- **Check permissions**: Use `req.UserId` to enforce RBAC
+- **Sanitize output**: Don't leak sensitive data in error messages
+- **Audit changes**: Log all modifications for compliance
+
+### Metadata
+- **Use consistent keys**: Establish naming conventions (e.g., `plugin_name:key`)
+- **Version your metadata**: Include plugin version for debugging
+- **Don't overload**: Keep metadata concise, use external storage for large data
+- **Document schema**: Document what metadata your plugin adds
+
+### Error Handling
+- **Block vs. log**: Use `AllowOperation: false` sparingly
+- **Helpful messages**: User sees `Message` field, make it clear
+- **Differentiate errors**: Use `RejectionReason` for why it failed
+- **Return nil error**: Return `(response, nil)` unless plugin crashes
+
+## Debugging Object Hooks
+
+### Enable Verbose Logging
+
+```go
+func (p *MyPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    ctx.Services.Logger().Info("Hook invoked",
+        "object_type", req.ObjectType,
+        "hook_type", req.HookType,
+        "object_id", req.ObjectID,
+        "operation_id", req.OperationId,
+    )
+
+    // Your logic here
+}
+```
+
+### Test with hook-test-plugin
+
+The `hook-test-plugin` example provides a comprehensive testing UI:
+
+```bash
+cd examples/plugins/studio/hook-test-plugin
+go build
+# Install and configure via AI Studio UI
+```
+
+Features:
+- Test all 24 hook combinations (4 objects × 6 hook types)
+- Configure behavior per hook (allow/reject/modify/metadata)
+- View real-time hook invocations
+- Automated test runner
+
+### Common Issues
+
+**Issue: Hook not firing**
+- Check `GetObjectHookRegistrations()` returns correct object types
+- Verify plugin is installed and enabled in AI Studio
+- Check plugin logs for initialization errors
+
+**Issue: Changes not persisting**
+- Only `before_create` and `before_update` can modify objects
+- Must set `Modified: true` and provide `ModifiedObjectJson`
+- Verify JSON marshaling succeeds
+
+**Issue: Operation blocked unexpectedly**
+- Check all registered plugins for the same hook
+- Lower priority plugins run first
+- Review plugin logs for rejection reasons
+
+## Manifest Configuration
+
+Object hooks must be declared in your plugin manifest:
+
+```json
+{
+  "name": "llm-validator",
+  "version": "1.0.0",
+  "description": "Validates LLM configurations",
+  "capabilities": ["object_hooks"],
+  "object_hooks": {
+    "llm": ["before_create", "before_update"],
+    "datasource": ["before_create"]
+  }
+}
+```
+
+See [Plugin Manifests Guide](/ai-management/ai-studio/plugins/manifests) for complete manifest documentation.
+
+## Complete Working Examples
+
+### LLM Validator
+[`examples/plugins/studio/llm-validator/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/llm-validator)
+- Validates LLM endpoints (HTTPS enforcement)
+- Blocks based on vendor or privacy score
+- Requires description field
+- Adds validation metadata
+
+### Hook Test Plugin
+[`examples/plugins/studio/hook-test-plugin/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/hook-test-plugin)
+- Comprehensive testing of all 24 hook combinations
+- Configurable behavior per hook type
+- Web UI for testing and configuration
+- Automated test runner
+
diff --git a/ai-management/ai-studio/plugins/overview.mdx b/ai-management/ai-studio/plugins/overview.mdx
new file mode 100644
index 0000000000..3bcb3f3b19
--- /dev/null
+++ b/ai-management/ai-studio/plugins/overview.mdx
@@ -0,0 +1,225 @@
+---
+title: "Tyk AI Studio Plugin Overview"
+description: "An overview of Tyk AI Studio's plugin system, featuring the Unified Plugin SDK, plugin capabilities, architecture, and deployment options."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "Overview"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio's plugin system enables powerful extensibility across the entire platform through a **Unified Plugin SDK**. Built on [HashiCorp's go-plugin](https://github.com/hashicorp/go-plugin) framework, plugins run as isolated processes with gRPC communication, providing security and fault tolerance.
+
+## Unified Plugin SDK
+
+All plugins now use a single SDK (`pkg/plugin_sdk`) that works seamlessly in both AI Studio and Edge Gateway contexts. The SDK automatically detects the runtime environment and provides appropriate capabilities.
+
+### Key Features
+
+- **Single Import**: One SDK works everywhere
+- **10 Plugin Capabilities**: Mix and match to build exactly what you need
+- **Runtime Detection**: Automatic AI Studio vs Edge Gateway detection
+- **Service API Access**: Built-in KV storage, logging, and management APIs
+- **Type-Safe**: Clean Go interfaces, no manual proto handling
+
+## Plugin Capabilities
+
+Plugins implement one or more of these 12 capabilities:
+
+| Capability | Where It Works | Purpose | Common Use Cases |
+|------------|----------------|---------|------------------|
+| **Pre-Auth** | Studio + Gateway | Process before authentication | IP filtering, request validation |
+| **Auth** | Studio + Gateway | Custom authentication | OAuth, API keys, JWT validation |
+| **Post-Auth** | Studio + Gateway | Process after authentication | Request enrichment, policy enforcement |
+| **Response** | Studio + Gateway | Modify responses | Content filtering, header injection |
+| **Data Collection** | Studio + Gateway | Collect telemetry | Export to Elasticsearch, ClickHouse |
+| **Custom Endpoints** | Gateway | Serve custom HTTP endpoints | MCP proxy, OAuth provider, webhooks |
+| **Object Hooks** | Studio only | Intercept CRUD operations | Validation, approval workflows |
+| **Agent** | Studio only | Conversational AI | Chat-based agents, LLM wrapping |
+| **UI Provider** | Studio only | Dashboard extensions | Custom dashboards, admin tools |
+| **Portal UI** | Studio only | Portal extensions | User-facing forms, pages, dashboards |
+| **Config Provider** | Studio + Gateway | Provide JSON Schema config | Dynamic configuration |
+| **Manifest Provider** | Gateway only | Plugin manifest | Gateway-only plugins |
+
+### Multi-Capability Plugins
+
+A single plugin can implement multiple capabilities. For example, a rate limiter might:
+- Implement **Post-Auth** to check limits before request
+- Implement **Response** to update counters after response
+- Implement **UI Provider** to show rate limit dashboard
+
+## Plugin Types Overview
+
+While all plugins use the unified SDK, they generally fall into three categories based on their primary use case:
+
+### 1. Edge Gateway Plugins
+
+Edge Gateway plugins provide middleware hooks in the LLM proxy request/response pipeline using the unified SDK.
+
+
+[Learn more →](/ai-management/ai-studio/plugins/edge-gateway)
+
+### 2. AI Studio UI Plugins
+
+AI Studio UI plugins extend the dashboard with custom WebComponents, adding new pages, sidebars, and interactive features to the admin interface. These also use the unified SDK and can combine UI capabilities with middleware hooks.
+
+[Learn more →](/ai-management/ai-studio/plugins/studio-ui)
+
+### 3. AI Studio Agent Plugins
+
+> **Experimental Feature**: Agent plugins are currently experimental. The API and behavior may change in future releases.
+
+Agent plugins enable conversational AI experiences in the Chat Interface using the unified SDK. These plugins can wrap LLMs, add custom logic, integrate external services, and create sophisticated multi-turn conversations.
+
+[Learn more →](/ai-management/ai-studio/plugins/studio-agent)
+
+### 4. Object Hooks Plugins
+
+**Object Hooks** are a powerful AI Studio-only capability that allows plugins to intercept and control CRUD operations on key objects before they reach the database. This is particularly useful for validation, approval workflows, and policy enforcement.
+
+[Learn more →](/ai-management/ai-studio/plugins/object-hooks)
+
+## Plugin Architecture
+
+### Monolithic Plugin Architecture
+
+A single plugin binary can run in **both** AI Studio and the Edge Gateway, so long as the requisite interfaces are implemented and the requirements are clear in the manifest file. This means one plugin can provide UI extensions in Studio, middleware hooks in the gateway, and even use the event bus to communicate between its Studio and gateway components in near-real-time.
+
+### Scheduled Tasks
+
+Studio plugins can register **scheduled tasks** — periodic calls from the host to the plugin on a configurable interval. This enables long-running background jobs such as analytics analysis, compliance checks, log scanning, or data synchronization.
+
+### Process Isolation
+
+Plugins run as separate processes, communicating with the main platform via gRPC. This provides:
+
+- **Security**: Plugin crashes don't affect the main platform
+- **Language Flexibility**: While the gRPC protocol theoretically supports any language, **only Go plugins have been tested** in production. If you plan to write plugins in another language, expect to do additional integration work.
+- **Resource Management**: Plugins can be restarted independently
+- **Version Independence**: Update plugins without platform restarts
+
+Plugins can also run as standalone gRPC services in a sidecar or elsewhere on the network, rather than as local sub-processes. See [Plugin Deployment](/ai-management/ai-studio/plugins/deployment) for details.
+
+### Communication Flow
+
+```mermaid
+graph TD
+    Host["AI Studio Host<br/>(Main Process)"]
+    
+    Host -- "go-plugin<br/>gRPC" --> Edge["Edge Gateway<br/>Plugin Process<br/>- Pre/Post Auth<br/>- Data Collection<br/>- Request Filter"]
+    Host -- "go-plugin<br/>gRPC" --> UI["UI Plugin<br/>Process<br/>- WebComponents<br/>- Service API<br/>- RPC Methods"]
+    Host -- "go-plugin<br/>gRPC" --> Agent["Agent Plugin<br/>Process<br/>- HandleMessage<br/>- LLM Calls<br/>- Tool Execute"]
+```
+
+### Service API (AI Studio Plugins Only)
+
+AI Studio UI and Agent plugins can access the Service API via a reverse gRPC broker connection:
+
+```mermaid
+graph LR
+    Plugin["Plugin Process<br/>Plugin Service<br/>(Host→Plugin)<br/>- HandleMessage<br/>- GetAsset<br/>- Call (RPC)"]
+    Host["AI Studio Host<br/>Service API<br/>(Plugin→Host)<br/>- CallLLM<br/>- ExecuteTool<br/>- QueryDatasource"]
+    
+    Plugin <-->|"Broker<br/>Pattern"| Host
+```
+
+The Service API provides 100+ gRPC operations for managing LLMs, apps, tools, datasources, analytics, and more. Access is controlled via permission scopes declared in the plugin manifest.
+
+[Learn more about Service API →](/ai-management/ai-studio/plugins/service-api)
+
+## Deployment Options
+
+Plugins support three deployment methods:
+
+### file://
+
+Local filesystem plugins for development and testing:
+
+```
+file:///path/to/plugin-binary
+```
+
+### grpc://
+
+Remote gRPC plugins running as network services:
+
+```
+grpc://plugin-host:50051
+```
+
+### oci://
+
+Container registry plugins (OCI artifacts):
+
+```
+oci://registry.example.com/plugins/my-plugin:v1.0.0
+```
+
+[Learn more about deployment →](/ai-management/ai-studio/plugins/deployment)
+
+## Permissions and Scopes
+
+AI Studio plugins declare required permissions in their manifest:
+
+```json
+{
+  "permissions": {
+    "services": [
+      "llms.proxy",      // Call LLMs via proxy
+      "llms.read",       // List and read LLM configs
+      "tools.execute",   // Execute tools
+      "datasources.query", // Query datasources
+      "kv.readwrite",    // Key-value storage
+      "analytics.read"   // Read analytics data
+    ]
+  }
+}
+```
+
+Permissions are validated when plugins call the Service API. The platform enforces least-privilege access based on declared scopes.
+
+[Learn more about manifests →](/ai-management/ai-studio/plugins/manifests)
+
+## Getting Started
+
+### Choose Your Plugin Type
+
+1. **Need to intercept/modify LLM requests?** → Edge Gateway Plugin
+2. **Building dashboard UI features?** → AI Studio UI Plugin
+3. **Creating conversational AI experiences?** → AI Studio Agent Plugin
+
+### Development Workflow
+
+1. Choose your plugin type
+2. Read the specific plugin guide
+3. Review example plugins in `examples/plugins/` and `community/plugins/`
+4. Use the SDK to implement required interfaces
+5. Build and test with `file://` deployment (see [Development Workflow Guide](/ai-management/ai-studio/plugins/development-workflow) for fast iteration)
+6. Deploy with `grpc://` or `oci://` for production
+
+**Pro tip**: Use the reload API (`POST /api/v1/plugins/{id}/reload`) to test changes instantly without reinstalling. See the [Development Workflow Guide](/ai-management/ai-studio/plugins/development-workflow) for the fastest iteration loop.
+
+### SDK Installation
+
+All plugins use the unified SDK:
+
+```bash
+go get github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk
+```
+
+```go
+import "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+func main() {
+    plugin_sdk.Serve(NewMyPlugin())
+}
+```
+
+**Note**: If you have existing plugins using the old SDKs (`microgateway/plugins/sdk` or `pkg/ai_studio_sdk`), see the Migration Guide for upgrade instructions.
+
diff --git a/ai-management/ai-studio/plugins/portal-ui.mdx b/ai-management/ai-studio/plugins/portal-ui.mdx
new file mode 100644
index 0000000000..e87e887bf4
--- /dev/null
+++ b/ai-management/ai-studio/plugins/portal-ui.mdx
@@ -0,0 +1,557 @@
+---
+title: "AI Portal UI Plugins"
+description: "Learn how to extend the AI Portal with custom user-facing pages, forms, and dashboards using Portal UI plugins."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "AI Portal UI"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Portal UI plugins extend the **AI Portal** (end-user facing) with custom pages, forms, and interactive features. Unlike [Admin UI plugins](/ai-management/ai-studio/plugins/studio-ui) which are only visible to administrators, Portal UI plugins are accessible to all authenticated portal users and support group-based visibility filtering.
+
+## Overview
+
+Portal UI plugins enable you to:
+
+- **Add Portal Pages**: Register new routes in the portal navigation
+- **Extend Portal Sidebar**: Add sections and links to the portal drawer
+- **Serve WebComponents**: Use any frontend framework (same asset serving as admin UI)
+- **Handle Portal RPC**: Define backend endpoints that receive authenticated user context
+- **Control Visibility**: Restrict portal pages to specific user groups
+- **Combine with Admin UI**: A single plugin can have both admin and portal interfaces
+
+### Use Cases
+
+- Support ticket systems for end users
+- Custom resource browsers or dashboards
+- User feedback and survey forms
+- Forum or community features
+- Self-service configuration pages
+- Data submission and approval workflows
+
+## Architecture
+
+Portal UI plugins use a **separate security scope** from admin UI plugins. This is enforced at every level:
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                        Plugin Binary                            │
+│                                                                 │
+│  UIProvider (admin)              PortalUIProvider (portal)      │
+│  ├── GetAsset()    ◄── shared   ├── HandlePortalRPC()           │
+│  ├── GetManifest() ◄── shared   │   receives PortalUserContext  │
+│  └── HandleRPC()                │   (user_id, email, groups)    │
+│      ▲                          │                               │
+│      │                          ▼                               │
+│  Admin RPC                   Portal RPC                         │
+│  POST /api/v1/plugins/       POST /common/plugins/              │
+│       {id}/rpc/{method}           {id}/portal-rpc/{method}      │
+│  (admin only)                (any authenticated user)           │
+│                                                                 │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+**Key security boundaries:**
+
+| Aspect | Admin UI | Portal UI |
+|--------|----------|-----------|
+| **API prefix** | `/api/v1/plugins/` | `/common/plugins/` |
+| **Auth required** | Admin only | Any authenticated user |
+| **RPC handler** | `HandleRPC()` | `HandlePortalRPC()` |
+| **User context** | None (admin implied) | `PortalUserContext` with user ID, email, groups |
+| **gRPC method** | `Call` | `PortalCall` |
+| **Hook type** | `studio_ui` | `portal_ui` |
+| **Visibility** | All admins | Filterable by user group |
+
+
+## Quick Start
+
+### 1. Project Structure
+
+```
+my-portal-plugin/
+├── main.go              # Plugin entry point
+├── manifest.json        # Plugin manifest (embedded)
+├── ui/
+│   ├── portal-page.js   # Portal-facing WebComponent
+│   └── admin-page.js    # Admin-facing WebComponent (optional)
+└── go.mod
+```
+
+### 2. Create Manifest
+
+The manifest declares both admin (`ui`) and portal (`portal`) UI sections. The `portal` section uses `PortalUISlot` which includes a `groups` field for visibility filtering.
+
+```json Expandable
+{
+  "id": "com.example.my-portal-plugin",
+  "version": "1.0.0",
+  "name": "My Portal Plugin",
+  "capabilities": {
+    "hooks": ["studio_ui", "portal_ui"]
+  },
+  "permissions": {
+    "ui": ["sidebar.register", "route.register"],
+    "portal_ui": ["sidebar.register", "route.register"],
+    "kv": ["read", "write"],
+    "rpc": ["call"]
+  },
+  "ui": {
+    "slots": [
+      {
+        "slot": "sidebar.section",
+        "label": "Plugin Admin",
+        "icon": "settings",
+        "items": [
+          {
+            "type": "route",
+            "path": "/admin/my-plugin",
+            "title": "Manage",
+            "mount": {
+              "kind": "webc",
+              "tag": "my-plugin-admin",
+              "entry": "/ui/admin-page.js"
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "portal": {
+    "slots": [
+      {
+        "slot": "portal_sidebar.section",
+        "label": "My Feature",
+        "icon": "star",
+        "groups": [],
+        "items": [
+          {
+            "type": "route",
+            "path": "/portal/plugins/my-feature",
+            "title": "My Feature",
+            "mount": {
+              "kind": "webc",
+              "tag": "my-plugin-portal",
+              "entry": "/ui/portal-page.js"
+            }
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+### Group-Based Visibility
+
+The `groups` field on portal slots controls which users can see the page:
+
+| `groups` value | Visibility |
+|---|---|
+| `[]` (empty array) | All portal users |
+| `["engineering", "support"]` | Users in at least one of these groups |
+| `["admin-team"]` | Only users in the "admin-team" group |
+
+The filtering happens server-side — the portal UI registry and sidebar menu endpoints only return entries the authenticated user is allowed to see.
+
+### 3. Implement the Plugin
+
+A portal UI plugin must implement **both** `UIProvider` (for assets and manifest) and `PortalUIProvider` (for portal RPC):
+
+```go Expandable
+package main
+
+import (
+    "embed"
+    "encoding/json"
+    "fmt"
+    "strings"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+)
+
+//go:embed manifest.json
+var manifestFile []byte
+
+//go:embed ui/*
+var uiAssets embed.FS
+
+type MyPortalPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+func NewMyPortalPlugin() *MyPortalPlugin {
+    return &MyPortalPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "my-portal-plugin",
+            "1.0.0",
+            "Plugin with portal UI",
+        ),
+    }
+}
+
+func (p *MyPortalPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    ctx.Services.Logger().Info("Portal plugin initialized")
+    return nil
+}
+
+// --- UIProvider (required for asset serving and manifest) ---
+
+func (p *MyPortalPlugin) GetAsset(assetPath string) ([]byte, string, error) {
+    path := strings.TrimPrefix(assetPath, "/")
+    content, err := uiAssets.ReadFile(path)
+    if err != nil {
+        return nil, "", fmt.Errorf("asset not found: %s", path)
+    }
+
+    mimeType := "application/octet-stream"
+    if strings.HasSuffix(path, ".js") {
+        mimeType = "application/javascript"
+    } else if strings.HasSuffix(path, ".css") {
+        mimeType = "text/css"
+    }
+
+    return content, mimeType, nil
+}
+
+func (p *MyPortalPlugin) ListAssets(pathPrefix string) ([]*pb.AssetInfo, error) {
+    return nil, nil
+}
+
+func (p *MyPortalPlugin) GetManifest() ([]byte, error) {
+    return manifestFile, nil
+}
+
+// HandleRPC processes admin RPC calls (admin-only)
+func (p *MyPortalPlugin) HandleRPC(method string, payload []byte) ([]byte, error) {
+    switch method {
+    case "admin_get_data":
+        // Admin-only operations
+        return json.Marshal(map[string]interface{}{"status": "ok"})
+    default:
+        return nil, fmt.Errorf("unknown admin method: %s", method)
+    }
+}
+
+// --- PortalUIProvider (required for portal RPC) ---
+
+// HandlePortalRPC processes portal RPC calls (any authenticated user)
+func (p *MyPortalPlugin) HandlePortalRPC(
+    method string,
+    payload []byte,
+    userCtx *plugin_sdk.PortalUserContext,
+) ([]byte, error) {
+    switch method {
+    case "get_user_data":
+        // userCtx provides authenticated user info
+        return json.Marshal(map[string]interface{}{
+            "user_id": userCtx.UserID,
+            "email":   userCtx.Email,
+            "groups":  userCtx.Groups,
+        })
+    case "submit_form":
+        // Process user form submission
+        return p.handleFormSubmission(payload, userCtx)
+    default:
+        return nil, fmt.Errorf("unknown portal method: %s", method)
+    }
+}
+
+func main() {
+    plugin_sdk.Serve(NewMyPortalPlugin())
+}
+```
+
+### 4. Create Portal WebComponent
+
+Portal WebComponents receive a `portalPluginAPI` object (injected by the portal plugin loader) for making RPC calls:
+
+```javascript Expandable
+class MyPortalPage extends HTMLElement {
+  constructor() {
+    super();
+    this.attachShadow({ mode: 'open' });
+  }
+
+  connectedCallback() {
+    this.render();
+    this.waitForAPIAndLoad();
+  }
+
+  // Wait for portalPluginAPI injection by the React wrapper
+  waitForAPIAndLoad(attempts = 0) {
+    if (this.portalPluginAPI) {
+      this.loadData();
+      return;
+    }
+    if (attempts < 20) {
+      setTimeout(() => this.waitForAPIAndLoad(attempts + 1), 100);
+    }
+  }
+
+  render() {
+    this.shadowRoot.innerHTML = `
+      <style>
+        :host { display: block; padding: 24px; }
+      </style>
+      <h2>My Portal Page</h2>
+      <div id="content">Loading...</div>
+      <button id="submit">Submit</button>
+    `;
+
+    this.shadowRoot.getElementById('submit')
+      .addEventListener('click', () => this.handleSubmit());
+  }
+
+  async loadData() {
+    try {
+      const result = await this.portalPluginAPI.call('get_user_data', {});
+      this.shadowRoot.getElementById('content').textContent =
+        `Hello ${result.email}!`;
+    } catch (err) {
+      console.error('Failed to load data:', err);
+    }
+  }
+
+  async handleSubmit() {
+    try {
+      const result = await this.portalPluginAPI.call('submit_form', {
+        title: 'My submission',
+        data: { key: 'value' }
+      });
+      console.log('Submitted:', result);
+    } catch (err) {
+      console.error('Submit failed:', err);
+    }
+  }
+}
+
+customElements.define('my-plugin-portal', MyPortalPage);
+```
+
+**Key difference from admin WebComponents:**
+- Admin components receive `this.pluginAPI` (routes to `HandleRPC`)
+- Portal components receive `this.portalPluginAPI` (routes to `HandlePortalRPC`)
+
+### 5. Create Admin WebComponent (Optional)
+
+If your plugin also has an admin interface, create a separate WebComponent that uses `this.pluginAPI`:
+
+```javascript Expandable
+class MyPluginAdmin extends HTMLElement {
+  connectedCallback() {
+    this.render();
+    this.waitForAPIAndLoad();
+  }
+
+  waitForAPIAndLoad(attempts = 0) {
+    if (this.pluginAPI) {
+      this.loadData();
+      return;
+    }
+    if (attempts < 20) {
+      setTimeout(() => this.waitForAPIAndLoad(attempts + 1), 100);
+    }
+  }
+
+  async loadData() {
+    // Uses admin RPC (HandleRPC) - only accessible to admins
+    const result = await this.pluginAPI.call('admin_get_data', {});
+  }
+}
+
+customElements.define('my-plugin-admin', MyPluginAdmin);
+```
+
+## PortalUserContext
+
+Every portal RPC call includes a `PortalUserContext` with the authenticated user's information:
+
+```go
+type PortalUserContext struct {
+    UserID   uint32            // Database user ID
+    Email    string            // User email address
+    Name     string            // Display name
+    IsAdmin  bool              // Whether user has admin role
+    Groups   []string          // Group names the user belongs to
+    Metadata map[string]string // Additional user metadata
+}
+```
+
+Use this context for:
+- **Authorization**: Check if the user has permission for the requested operation
+- **Data scoping**: Return only data belonging to the calling user
+- **Audit logging**: Record who performed each action
+- **Group-based features**: Enable features based on group membership
+
+```go Expandable
+func (p *MyPlugin) HandlePortalRPC(
+    method string,
+    payload []byte,
+    userCtx *plugin_sdk.PortalUserContext,
+) ([]byte, error) {
+    // Only allow members of "premium" group
+    isPremium := false
+    for _, g := range userCtx.Groups {
+        if g == "premium" {
+            isPremium = true
+            break
+        }
+    }
+    if !isPremium {
+        return json.Marshal(map[string]interface{}{
+            "error": "This feature requires premium access",
+        })
+    }
+
+    // ... handle request
+}
+```
+
+## Manifest Reference
+
+### Portal Slots
+
+The `portal` section in the manifest is parallel to the `ui` section:
+
+```json Expandable
+{
+  "portal": {
+    "slots": [
+      {
+        "slot": "portal_sidebar.section",
+        "label": "Section Label",
+        "icon": "icon-name",
+        "groups": ["group1", "group2"],
+        "items": [
+          {
+            "type": "route",
+            "path": "/portal/plugins/my-feature/page1",
+            "title": "Page Title",
+            "mount": {
+              "kind": "webc",
+              "tag": "my-component-tag",
+              "entry": "/ui/my-component.js"
+            }
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `slot` | string | Yes | Slot identifier. Currently supports `portal_sidebar.section` |
+| `label` | string | Yes | Display label in the sidebar |
+| `icon` | string | No | Icon name for the sidebar entry |
+| `groups` | string[] | No | Allowed user groups. Empty = all portal users |
+| `items` | array | Yes | Routes/components to register |
+| `items[].type` | string | Yes | Must be `"route"` |
+| `items[].path` | string | Yes | Route path (should start with `/portal/plugins/`) |
+| `items[].title` | string | Yes | Page title |
+| `items[].mount.kind` | string | Yes | Mount type: `"webc"` or `"iframe"` |
+| `items[].mount.tag` | string | Yes | Custom element tag name |
+| `items[].mount.entry` | string | Yes | JavaScript entry point path |
+
+### Capabilities and Permissions
+
+Portal UI plugins must declare both hook types and permissions:
+
+```json
+{
+  "capabilities": {
+    "hooks": ["studio_ui", "portal_ui"]
+  },
+  "permissions": {
+    "ui": ["sidebar.register", "route.register"],
+    "portal_ui": ["sidebar.register", "route.register"]
+  }
+}
+```
+
+- `studio_ui` in hooks enables admin UI + asset serving
+- `portal_ui` in hooks enables portal RPC handling
+- Both are required for a plugin with portal UI (assets are served via `UIProvider`)
+
+### Route Path Convention
+
+Portal plugin routes should follow the pattern `/portal/plugins/{plugin-name}/{page}` to avoid conflicts with built-in portal routes:
+
+```
+/portal/plugins/feedback              # Single-page plugin
+/portal/plugins/support/tickets       # Multi-page plugin
+/portal/plugins/support/new-ticket    # Multi-page plugin
+```
+
+## API Endpoints
+
+Portal plugin API endpoints are under `/common/` (authenticated, no admin required):
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/common/plugins/portal-ui-registry` | GET | Get portal UI components (filtered by user groups) |
+| `/common/plugins/portal-sidebar-menu` | GET | Get portal sidebar items (filtered by user groups) |
+| `/common/plugins/:id/portal-rpc/:method` | POST | Call portal RPC method on plugin |
+| `/common/plugins/assets/:id/*filepath` | GET | Serve plugin static assets |
+
+### Portal RPC Call Flow
+
+```
+Portal UI (WebComponent)
+    │  this.portalPluginAPI.call('method', payload)
+    ▼
+pubClient.post('/common/plugins/{id}/portal-rpc/{method}', payload)
+    │  (AuthMiddleware - any authenticated user)
+    ▼
+callPortalPluginRPC handler
+    │  1. Validate plugin active + loaded + supports portal_ui
+    │  2. Build PortalUserContext from authenticated user
+    ▼
+AIStudioPluginManager.CallPluginPortalRPC()
+    │  gRPC PortalCall with user context
+    ▼
+Plugin's HandlePortalRPC(method, payload, userCtx)
+    │  Plugin processes request with user info
+    ▼
+JSON response → WebComponent
+```
+
+## Example: Portal Feedback Plugin
+
+A complete working example is available at [`examples/plugins/studio/portal-feedback/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/portal-feedback).
+
+This plugin demonstrates:
+- Portal form for users to submit feedback (`HandlePortalRPC`)
+- Admin dashboard to view all submissions (`HandleRPC`)
+- Shared asset serving between admin and portal UIs
+- Group-based visibility (set to `[]` for all users)
+- `waitForAPIAndLoad()` pattern for WebComponent API injection timing
+
+## Best Practices
+
+### Security
+
+1. **Never trust portal input** - Always validate and sanitize data in `HandlePortalRPC`
+2. **Scope data to users** - Use `userCtx.UserID` to ensure users only see their own data
+3. **Keep admin operations in HandleRPC** - Destructive operations (delete, admin overrides) should stay in the admin-only `HandleRPC` method
+4. **Check groups in RPC handlers** - Even though sidebar visibility is filtered, users could call the RPC endpoint directly. Validate group membership in `HandlePortalRPC` for sensitive operations
+
+### Performance
+
+1. **Use KV storage for persistence** - In-memory data is lost on plugin restart
+2. **Cache frequently accessed data** - Use `sync.Map` or similar for hot data
+3. **Keep portal pages lightweight** - Portal users expect fast page loads
+
+### WebComponent Patterns
+
+1. **Wait for API injection** - Use the `waitForAPIAndLoad()` pattern instead of calling the API in `connectedCallback()` directly
+2. **Handle errors gracefully** - Show user-friendly messages, not stack traces
+3. **Use Shadow DOM** - Prevents style conflicts with the host application
+4. **Escape user content** - Always escape HTML in dynamic content to prevent XSS
+
diff --git a/ai-management/ai-studio/plugins/resource-types.mdx b/ai-management/ai-studio/plugins/resource-types.mdx
new file mode 100644
index 0000000000..fb9e89daf5
--- /dev/null
+++ b/ai-management/ai-studio/plugins/resource-types.mdx
@@ -0,0 +1,461 @@
+---
+title: "Tyk AI Studio Resource Provider Plugins"
+description: "Learn how to register custom resource types that integrate into the App creation flow, participate in privacy scoring, and work with group-based access control."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "Resource Provider"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph LR
+    A[Plugin] -->|Registers| B[Custom Resource Type]
+    B --> C[App Creation Flow]
+    B --> D[Access Control]
+```
+
+Resource Provider plugins allow you to **register custom resource types** that integrate into the App creation flow, participate in privacy scoring, and work with the group-based access control model. This enables plugins to extend the platform's governance model with new kinds of resources beyond the built-in LLMs, Datasources, and Tools.
+
+## Overview
+
+By default, Apps in AI Studio bundle three built-in resource types: LLMs, Datasources, and Tools. The Resource Provider capability lets plugins register additional resource types that:
+
+- **Appear in the Create App form** as selectable resources (via a plugin-provided Web Component or a platform-rendered multi-select)
+- **Participate in privacy scoring** with the generalized rule: no resource privacy score may exceed the maximum LLM privacy score in the app
+- **Integrate with group-based access control** so admins can assign resource instances to groups, and users only see resources available to their groups
+- **Support the community submission workflow** so end-users can submit new resource instances for admin review
+- **Propagate to gateways** via the config snapshot, so gateway plugins can access resource associations at runtime
+
+### Use Cases
+
+- **MCP Server Registry**: Register MCP servers as a resource type, let users bundle them into Apps
+- **Vector Store Catalog**: Expose vector databases with privacy scores for RAG pipelines
+- **API Connectors**: Custom API integrations that need governance and access control
+- **Knowledge Bases**: Document collections with sensitivity classifications
+
+### How It Works
+
+```
+Plugin declares resource types via manifest or GetResourceTypeRegistrations()
+    |
+Platform registers types in DB, shows them in the App Form
+    |
+Admin assigns instances to Groups (direct mapping, no catalogues)
+    |
+User creates App -> selects resources from their accessible instances
+    |
+Platform validates privacy scores + calls plugin's ValidateResourceSelection()
+    |
+Associations stored in app_plugin_resources join table
+    |
+Config snapshot includes associations for gateway access
+```
+
+## Implementing a Resource Provider
+
+### 1. Implement the ResourceProvider Interface
+
+```go Expandable
+import "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+// GetResourceTypeRegistrations declares the resource types this plugin provides.
+// Called once after Initialize() and again on plugin reload.
+func (p *MyPlugin) GetResourceTypeRegistrations() ([]*plugin_sdk.ResourceTypeRegistration, error) {
+    return []*plugin_sdk.ResourceTypeRegistration{
+        {
+            Slug:            "mcp_servers",
+            Name:            "MCP Servers",
+            Description:     "Model Context Protocol servers for tool access",
+            Icon:            "Hub",
+            HasPrivacyScore: true,
+            SupportsSubmissions: true,
+            // FormComponent: nil means the platform renders a standard multi-select
+        },
+    }, nil
+}
+
+// ListResourceInstances returns all instances for the App form selector.
+func (p *MyPlugin) ListResourceInstances(ctx plugin_sdk.Context, slug string) ([]*plugin_sdk.ResourceInstance, error) {
+    // Load from plugin KV, external API, or any storage
+    servers, err := p.loadServers(ctx)
+    if err != nil {
+        return nil, err
+    }
+
+    var instances []*plugin_sdk.ResourceInstance
+    for _, s := range servers {
+        instances = append(instances, &plugin_sdk.ResourceInstance{
+            ID:           s.ID,
+            Name:         s.Name,
+            Description:  s.Description,
+            PrivacyScore: s.PrivacyScore,
+            IsActive:     s.IsActive,
+        })
+    }
+    return instances, nil
+}
+
+// GetResourceInstance retrieves a single instance by ID.
+func (p *MyPlugin) GetResourceInstance(ctx plugin_sdk.Context, slug, instanceID string) (*plugin_sdk.ResourceInstance, error) {
+    server, err := p.loadServer(ctx, instanceID)
+    if err != nil {
+        return nil, err
+    }
+    return &plugin_sdk.ResourceInstance{
+        ID:           server.ID,
+        Name:         server.Name,
+        PrivacyScore: server.PrivacyScore,
+        IsActive:     server.IsActive,
+    }, nil
+}
+
+// ValidateResourceSelection is called during app create/update.
+// Use this for cross-instance validation (e.g., "max 3 servers per app").
+func (p *MyPlugin) ValidateResourceSelection(ctx plugin_sdk.Context, slug string, instanceIDs []string, appID uint32) error {
+    if len(instanceIDs) > 5 {
+        return fmt.Errorf("maximum 5 MCP servers per app")
+    }
+    return nil
+}
+
+// CreateResourceInstance is called when a community submission is approved.
+func (p *MyPlugin) CreateResourceInstance(ctx plugin_sdk.Context, slug string, payload []byte) (*plugin_sdk.ResourceInstance, error) {
+    var req CreateServerRequest
+    if err := json.Unmarshal(payload, &req); err != nil {
+        return nil, err
+    }
+
+    server := p.createServer(ctx, req)
+    return &plugin_sdk.ResourceInstance{
+        ID:   server.ID,
+        Name: server.Name,
+    }, nil
+}
+```
+
+### 2. Declare in the Manifest
+
+Add the `resource_types` section to your plugin manifest:
+
+```json Expandable
+{
+  "id": "com.example.mcp-registry",
+  "name": "MCP Registry",
+  "version": "1.0.0",
+  "capabilities": {
+    "hooks": ["resource_provider", "studio_ui"]
+  },
+  "resource_types": [
+    {
+      "slug": "mcp_servers",
+      "name": "MCP Servers",
+      "description": "Model Context Protocol servers for tool access",
+      "icon": "Hub",
+      "has_privacy_score": true,
+      "supports_submissions": true
+    }
+  ]
+}
+```
+
+Resource types declared in the manifest are automatically registered when the plugin loads. The `GetResourceTypeRegistrations()` method provides a runtime fallback and can return additional types not in the manifest.
+
+### 3. Serve the Plugin
+
+```go
+func main() {
+    plugin_sdk.Serve(NewMyPlugin())
+}
+```
+
+## ResourceProvider Interface Reference
+
+| Method | When Called | Purpose |
+|--------|-----------|---------|
+| `GetResourceTypeRegistrations()` | Plugin load/reload | Declare resource types |
+| `ListResourceInstances(ctx, slug)` | App form load, Group form load | List available instances |
+| `GetResourceInstance(ctx, slug, id)` | Config snapshot build | Get instance details for gateway |
+| `ValidateResourceSelection(ctx, slug, ids, appID)` | App create/update | Custom validation logic |
+| `CreateResourceInstance(ctx, slug, payload)` | Submission approval | Create instance from approved submission |
+
+## SDK Types
+
+### ResourceTypeRegistration
+
+```go
+type ResourceTypeRegistration struct {
+    Slug                string                 // Machine-readable ID (unique per plugin)
+    Name                string                 // Display name in the UI
+    Description         string                 // Help text
+    Icon                string                 // Material icon name or asset path
+    HasPrivacyScore     bool                   // Whether instances carry privacy scores
+    SupportsSubmissions bool                   // Whether community submissions are supported
+    FormComponent       *ResourceFormComponent // Custom Web Component (nil = standard multi-select)
+}
+```
+
+### ResourceInstance
+
+```go
+type ResourceInstance struct {
+    ID           string // Plugin-assigned unique identifier
+    Name         string // Display name
+    Description  string // Optional description
+    PrivacyScore int    // 0-100 (only meaningful if type has HasPrivacyScore)
+    Metadata     []byte // Opaque JSON included in config snapshots
+    IsActive     bool   // Whether instance is currently usable
+}
+```
+
+> **Security**: Do not store secrets, credentials, or PII in the `Metadata` field. Metadata is propagated to all gateways via config snapshots, cached in database join tables, and may appear in logs or be accessible to other plugins with access to the app configuration.
+
+### ResourceFormComponent
+
+```go
+type ResourceFormComponent struct {
+    Tag        string // Web Component custom element tag (e.g., "mcp-server-selector")
+    EntryPoint string // JS asset path relative to plugin root (e.g., "ui/webc/selector.js")
+}
+```
+
+## Privacy Scoring
+
+When `HasPrivacyScore` is `true`, each resource instance carries a privacy score (0-100). The platform enforces a generalized rule during app creation and updates:
+
+> **No resource privacy score may exceed the maximum LLM privacy score in the app.**
+
+This applies to both built-in datasources and plugin resources. For example:
+
+| Resource | Privacy Score | Result |
+|----------|:---:|--------|
+| LLM "GPT-4 Enterprise" | 80 | Max LLM score = 80 |
+| Datasource "Internal DB" | 60 | OK `(60 <= 80)` |
+| Plugin resource "MCP Server A" | 70 | OK `(70 <= 80)` |
+| Plugin resource "MCP Server B" | 90 | **Rejected** (90 > 80) |
+
+The plugin sets privacy scores on instances via the `PrivacyScore` field in `ResourceInstance`. Admins review and approve these scores through the submission workflow.
+
+## Access Control
+
+Plugin resource instances use **direct group mapping** instead of the catalogue pattern used by built-in types. This is simpler and sufficient since plugins organize their own resources.
+
+### Access Chain
+
+```
+User -> Group -> Plugin Resource Instance (direct)
+```
+
+Compare with built-in types:
+```
+User -> Group -> Catalogue -> LLM/Datasource/Tool
+```
+
+### Admin Workflow
+
+1. Admin navigates to **Teams** (Groups) in the admin UI
+2. Opens a group and scrolls to the **Plugin Resources** section
+3. For each registered resource type, selects which instances this group can access
+4. Saves the group
+
+### User Experience
+
+When a user creates an App, they only see resource instances accessible via their group memberships. Admins bypass this filter and see all instances.
+
+## Custom Form Components
+
+For richer selection UX, plugins can provide a **Web Component** instead of the platform's standard multi-select. Declare it in the `FormComponent` field:
+
+```go
+FormComponent: &plugin_sdk.ResourceFormComponent{
+    Tag:        "mcp-server-selector",
+    EntryPoint: "ui/webc/mcp-selector.js",
+},
+```
+
+The platform loads your Web Component JS from plugin assets and renders it in the App form. The contract:
+
+### Injected Properties
+
+| Property | Type | Description |
+|----------|------|-------------|
+| `data-selected-ids` | JSON `string[]` | Currently selected instance IDs |
+| `data-app-id` | `string` | App ID (empty on create) |
+| `data-mode` | `"create"` or `"edit"` | Form mode |
+| `pluginAPI.call(method, payload)` | function | Make RPC calls to your plugin backend |
+| `pluginAPI.listInstances()` | function | List available instances |
+
+### Events to Dispatch
+
+| Event | Detail | Description |
+|-------|--------|-------------|
+| `selection-change` | `{ selectedIds: string[] }` | Dispatch when user changes selection |
+
+### Example Web Component
+
+```javascript Expandable
+class MCPServerSelector extends HTMLElement {
+  connectedCallback() {
+    this.render();
+
+    // Listen for attribute changes from the platform
+    const observer = new MutationObserver(() => this.render());
+    observer.observe(this, { attributes: true });
+  }
+
+  async render() {
+    const selectedIds = JSON.parse(this.getAttribute('data-selected-ids') || '[]');
+    const instances = await this.pluginAPI.listInstances();
+
+    this.innerHTML = `
+      <div class="mcp-selector">
+        ${instances.data.map(inst => `
+          <label>
+            <input type="checkbox" value="${inst.id}"
+              ${selectedIds.includes(inst.id) ? 'checked' : ''}>
+            ${inst.name} (Privacy: ${inst.privacy_score})
+          </label>
+        `).join('')}
+      </div>
+    `;
+
+    this.querySelectorAll('input').forEach(input => {
+      input.addEventListener('change', () => {
+        const selected = [...this.querySelectorAll('input:checked')]
+          .map(el => el.value);
+        this.dispatchEvent(new CustomEvent('selection-change', {
+          detail: { selectedIds: selected }
+        }));
+      });
+    });
+  }
+}
+
+customElements.define('mcp-server-selector', MCPServerSelector);
+```
+
+## Gateway Integration
+
+Plugin resource associations are included in the config snapshot sent to gateways. Each `AppConfig` includes a `plugin_resources` field:
+
+```protobuf
+message PluginResourceAssociation {
+    uint32 plugin_id = 1;
+    string resource_type_slug = 2;
+    repeated string instance_ids = 3;
+    repeated ResourceInstanceSnapshot instances = 4;
+}
+```
+
+Gateway plugins can access these associations from the app's config to make routing or authorization decisions. For example, an MCP proxy plugin could check if the requesting app has access to a specific MCP server by examining the `plugin_resources` field.
+
+## Community Submissions
+
+When `SupportsSubmissions` is `true`, community users can submit new resource instances through the existing submission workflow:
+
+1. User fills out a submission form with `resource_type: "plugin"` and a `plugin_resource_type_id`
+2. The `resource_payload` contains plugin-defined JSON describing the new instance
+3. Admin reviews the submission (including a suggested privacy score)
+4. On approval, the platform calls the plugin's `CreateResourceInstance()` with the payload
+5. The plugin creates the instance and returns its ID
+6. The instance becomes available for selection in the App form
+
+## Manifest Reference
+
+```json Expandable
+{
+  "resource_types": [
+    {
+      "slug": "string (required)",
+      "name": "string (required)",
+      "description": "string",
+      "icon": "string",
+      "has_privacy_score": false,
+      "supports_submissions": false,
+      "form_component": {
+        "tag": "string (custom element tag)",
+        "entry_point": "string (JS asset path)"
+      }
+    }
+  ]
+}
+```
+
+| Field | Required | Default | Description |
+|-------|:---:|:---:|-------------|
+| `slug` | Yes | - | Machine-readable identifier, unique per plugin |
+| `name` | Yes | - | Human-readable display name |
+| `description` | No | `""` | Description shown in the App form |
+| `icon` | No | `""` | Material icon name or plugin asset path |
+| `has_privacy_score` | No | `false` | Whether instances carry privacy scores |
+| `supports_submissions` | No | `false` | Whether community submissions are enabled |
+| `form_component` | No | `null` | Custom Web Component for the App form (null = standard multi-select) |
+
+## API Endpoints
+
+These endpoints are available for frontend integration:
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/api/v1/plugin-resource-types` | List all active registered resource types |
+| `GET` | `/api/v1/apps/:id/plugin-resources` | Get plugin resources for an app |
+| `GET` | `/api/v1/groups/:id/plugin-resources` | Get plugin resource access for a group |
+| `PUT` | `/api/v1/groups/:id/plugin-resources` | Set plugin resource access for a group (admin) |
+
+### Set Group Plugin Resources
+
+```bash
+curl -X PUT /api/v1/groups/5/plugin-resources \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{
+    "resources": [
+      {
+        "plugin_id": 1,
+        "resource_type_slug": "mcp_servers",
+        "instance_ids": ["server-1", "server-2"]
+      }
+    ]
+  }'
+```
+
+## Combining with Other Capabilities
+
+Resource Provider plugins often combine with other capabilities for a complete solution:
+
+| Combination | Purpose |
+|------------|---------|
+| ResourceProvider + UIProvider | Admin UI for managing resource instances |
+| ResourceProvider + PortalUIProvider | Portal self-service for resource browsing |
+| ResourceProvider + CustomEndpointHandler | Gateway proxy for resource access (e.g., MCP proxy) |
+| ResourceProvider + EdgePayloadReceiver | Aggregate analytics from gateway resource usage |
+| ResourceProvider + ConfigProvider | Admin-configurable plugin settings |
+
+### Example: Complete MCP Registry Plugin
+
+```go Expandable
+type MCPRegistryPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+// ResourceProvider - register MCP servers as a resource type
+func (p *MCPRegistryPlugin) GetResourceTypeRegistrations() ([]*plugin_sdk.ResourceTypeRegistration, error) { ... }
+func (p *MCPRegistryPlugin) ListResourceInstances(ctx plugin_sdk.Context, slug string) ([]*plugin_sdk.ResourceInstance, error) { ... }
+func (p *MCPRegistryPlugin) GetResourceInstance(ctx plugin_sdk.Context, slug, id string) (*plugin_sdk.ResourceInstance, error) { ... }
+func (p *MCPRegistryPlugin) ValidateResourceSelection(ctx plugin_sdk.Context, slug string, ids []string, appID uint32) error { ... }
+func (p *MCPRegistryPlugin) CreateResourceInstance(ctx plugin_sdk.Context, slug string, payload []byte) (*plugin_sdk.ResourceInstance, error) { ... }
+
+// UIProvider - admin UI for server management
+func (p *MCPRegistryPlugin) GetAsset(path string) ([]byte, string, error) { ... }
+func (p *MCPRegistryPlugin) GetManifest() ([]byte, error) { ... }
+func (p *MCPRegistryPlugin) HandleRPC(method string, payload []byte) ([]byte, error) { ... }
+
+// CustomEndpointHandler - gateway proxy for MCP requests
+func (p *MCPRegistryPlugin) GetEndpointRegistrations() ([]*pb.EndpointRegistration, error) { ... }
+func (p *MCPRegistryPlugin) HandleEndpointRequest(ctx plugin_sdk.Context, req *pb.EndpointRequest) (*pb.EndpointResponse, error) { ... }
+```
diff --git a/ai-management/ai-studio/plugins/sdk.mdx b/ai-management/ai-studio/plugins/sdk.mdx
new file mode 100644
index 0000000000..4217f6d003
--- /dev/null
+++ b/ai-management/ai-studio/plugins/sdk.mdx
@@ -0,0 +1,1044 @@
+---
+title: "Tyk AI Studio Plugin SDK"
+description: "Comprehensive guide to the Tyk AI Studio Plugin SDK, including capabilities, interfaces, and development patterns for building plugins that run in both AI Studio and Edge Gateway contexts."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "SDK Reference"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph TD
+    A[Unified Plugin SDK] --> B[BasePlugin]
+    A --> C[Capabilities Interfaces]
+    A --> D[Service API Client]
+```
+
+Tyk AI Studio provides a **Unified Plugin SDK** that works seamlessly in both AI Studio and Edge Gateway contexts with a single API. This guide covers the core SDK concepts, capabilities, and patterns.
+
+## Unified SDK Overview
+
+The Unified SDK (`pkg/plugin_sdk`) is the modern, recommended approach for all plugin development. It provides:
+
+- **Single Import**: One SDK works in both AI Studio and Edge Gateway
+- **Automatic Runtime Detection**: SDK detects the execution environment
+- **Capability-Based Design**: Implement only what you need
+- **Type-Safe**: Clean Go types, no manual proto handling
+- **Service Access**: Built-in KV storage, logging, events, and management APIs
+- **Context-Rich**: Access to app, user, LLM metadata in every call
+
+### Installation
+
+```bash
+go get github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk
+```
+
+### Basic Plugin Structure
+
+```go Expandable
+import "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+    // Plugin-specific fields
+}
+
+func NewMyPlugin() *MyPlugin {
+    return &MyPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "my-plugin",
+            "1.0.0",
+            "My plugin description",
+        ),
+    }
+}
+
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    // Initialize plugin
+    return nil
+}
+
+func main() {
+    plugin_sdk.Serve(NewMyPlugin())
+}
+```
+
+## Plugin Capabilities
+
+Plugins implement one or more capability interfaces. The SDK supports 15 distinct capabilities:
+
+| Capability | Interface | Where It Works | Purpose |
+|------------|-----------|----------------|---------|
+| **Pre-Auth** | `PreAuthHandler` | Studio + Gateway | Process requests before authentication |
+| **Auth** | `AuthHandler` | Studio + Gateway | Custom authentication with credential lookup |
+| **Post-Auth** | `PostAuthHandler` | Studio + Gateway | Process requests after authentication (most common) |
+| **Response** | `ResponseHandler` | Studio + Gateway | Modify response headers and body |
+| **Data Collection** | `DataCollector` | Studio + Gateway | Collect telemetry (analytics, budgets, proxy logs) |
+| **[Custom Endpoints](/ai-management/ai-studio/plugins/custom-endpoints)** | `CustomEndpointHandler` | Gateway | Serve custom HTTP endpoints under `/plugins/{slug}/` |
+| **UI Provider** | `UIProvider` | Studio only | Serve admin web UI assets |
+| **[Portal UI](/ai-management/ai-studio/plugins/portal-ui)** | `PortalUIProvider` | Studio only | Portal-facing pages and forms with user context |
+| **Config Provider** | `ConfigProvider` | Studio + Gateway | Provide JSON Schema configuration |
+| **Manifest Provider** | `ManifestProvider` | Gateway only | Provide plugin manifest (gateway-only plugins) |
+| **Agent** | `AgentPlugin` | Studio only | Conversational AI agent with streaming |
+| **Object Hooks** | `ObjectHookHandler` | Studio only | Intercept CRUD operations on objects |
+| **Scheduler** | `SchedulerPlugin` | Studio only | Execute tasks on cron-based schedules |
+| **Edge Payload** | `EdgePayloadReceiver` | Studio only | Receive data from edge (gateway) plugins |
+| **[Resource Provider](/ai-management/ai-studio/plugins/resource-types)** | `ResourceProvider` | Studio only | Register custom resource types for Apps with privacy scoring |
+
+### Multi-Capability Plugins
+
+A single plugin can implement multiple capabilities. For example, a rate limiter might implement:
+- `PostAuthHandler` - Check limits before request
+- `ResponseHandler` - Update counters after response
+- `UIProvider` - Provide management UI
+
+```go Expandable
+type RateLimiter struct {
+    plugin_sdk.BasePlugin
+}
+
+// Implement PostAuthHandler
+func (p *RateLimiter) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Check rate limits
+}
+
+// Implement ResponseHandler
+func (p *RateLimiter) OnBeforeWriteHeaders(ctx plugin_sdk.Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error) {
+    // Update counters
+}
+
+// Implement UIProvider
+func (p *RateLimiter) GetAsset(path string) ([]byte, string, error) {
+    // Serve UI assets
+}
+```
+
+## Core Interfaces
+
+### 1. PreAuthHandler
+
+Process requests **before** authentication. Useful for IP filtering, request validation, etc.
+
+```go
+type PreAuthHandler interface {
+    HandlePreAuth(ctx Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error)
+}
+```
+
+**Example:**
+```go
+func (p *MyPlugin) HandlePreAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Block requests from specific IPs
+    if isBlockedIP(req.ClientIp) {
+        return &pb.PluginResponse{
+            Block:        true,
+            ErrorMessage: "IP blocked",
+        }, nil
+    }
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+### 2. AuthHandler
+
+Custom authentication with credential lookup. This interface requires **three methods** to fully integrate with the access control system.
+
+```go
+type AuthHandler interface {
+    Plugin
+    HandleAuth(ctx Context, req *pb.AuthRequest) (*pb.AuthResponse, error)
+    GetAppByCredential(ctx Context, credential string) (*pb.App, error)
+    GetUserByCredential(ctx Context, credential string) (*pb.User, error)
+}
+```
+
+#### Why App Linking Is Critical
+
+**A valid credential alone is not enough.** The system requires an associated App object because Apps provide the access control context:
+
+- **Policy enforcement** - Rate limits, usage quotas, and restrictions
+- **Tool/Datasource permissions** - Which tools and datasources the credential can access
+- **LLM restrictions** - Which LLMs the credential is allowed to use
+- **Budget controls** - Cost tracking and spending limits
+
+Without a valid App association, authenticated requests will fail even if the credential itself is valid.
+
+#### Authentication Flow
+
+1. **`HandleAuth()`** - Validates the credential and returns an App ID and User ID
+2. **`GetAppByCredential()`** - System calls this to fetch the full App object for access control
+3. **`GetUserByCredential()`** - System calls this to fetch the User object for identity context
+
+#### Example Implementation
+
+```go Expandable
+type MyAuthPlugin struct {
+    plugin_sdk.BasePlugin
+    tokenStore map[string]*TokenConfig // Maps tokens to app/user IDs
+}
+
+// HandleAuth validates the credential and returns App/User IDs
+func (p *MyAuthPlugin) HandleAuth(ctx plugin_sdk.Context, req *pb.AuthRequest) (*pb.AuthResponse, error) {
+    // Extract token from request
+    token := req.Credential
+    if token == "" {
+        return &pb.AuthResponse{
+            Authenticated: false,
+            ErrorMessage:  "No credential provided",
+        }, nil
+    }
+
+    // Validate token and look up associated IDs
+    tokenConfig, valid := p.tokenStore[token]
+    if !valid {
+        return &pb.AuthResponse{
+            Authenticated: false,
+            ErrorMessage:  "Invalid token",
+        }, nil
+    }
+
+    // CRITICAL: Return the App ID - this links the credential to access control
+    return &pb.AuthResponse{
+        Authenticated: true,
+        AppId:         tokenConfig.AppID,   // Must be a valid App in the database
+        UserId:        tokenConfig.UserID,
+    }, nil
+}
+
+// GetAppByCredential fetches the App object for access control enforcement
+func (p *MyAuthPlugin) GetAppByCredential(ctx plugin_sdk.Context, credential string) (*pb.App, error) {
+    tokenConfig, ok := p.tokenStore[credential]
+    if !ok {
+        return nil, fmt.Errorf("unknown credential")
+    }
+
+    // Fetch the App from the Service API
+    if ctx.Runtime == plugin_sdk.RuntimeGateway {
+        return ctx.Services.Gateway().GetApp(ctx, tokenConfig.AppID)
+    }
+    return ctx.Services.Studio().GetApp(ctx, tokenConfig.AppID)
+}
+
+// GetUserByCredential fetches the User object for identity context
+func (p *MyAuthPlugin) GetUserByCredential(ctx plugin_sdk.Context, credential string) (*pb.User, error) {
+    tokenConfig, ok := p.tokenStore[credential]
+    if !ok {
+        return nil, fmt.Errorf("unknown credential")
+    }
+
+    // Fetch the User from the Service API
+    if ctx.Runtime == plugin_sdk.RuntimeGateway {
+        return ctx.Services.Gateway().GetUser(ctx, tokenConfig.UserID)
+    }
+    return ctx.Services.Studio().GetUser(ctx, tokenConfig.UserID)
+}
+```
+
+#### Common Pitfalls
+
+| Pitfall | Symptom | Solution |
+|---------|---------|----------|
+| Not returning App ID | Requests fail with "no app context" | Always return a valid `AppId` in `AuthResponse` |
+| App doesn't exist | 500 errors after auth success | Verify App exists in database before returning its ID |
+| Not implementing `GetAppByCredential` | Compile error or runtime panic | Implement all three interface methods |
+| Using wrong App ID | Permission denied for tools/LLMs | Ensure the App has the required permissions configured |
+
+See the working example at `examples/plugins/studio/custom-auth-ui/` for a complete implementation.
+
+### 3. PostAuthHandler
+
+Process requests **after** authentication. Most common capability for request enrichment, policy enforcement, etc.
+
+```go
+type PostAuthHandler interface {
+    HandlePostAuth(ctx Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error)
+}
+```
+
+**Example:**
+```go Expandable
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    ctx.Services.Logger().Info("Processing request",
+        "app_id", ctx.AppID,
+        "user_id", ctx.UserID,
+    )
+
+    // Add custom header
+    req.Headers["X-Custom-Header"] = "value"
+
+    return &pb.PluginResponse{
+        Modified: true,
+        Request:  req,
+    }, nil
+}
+```
+
+### 4. ResponseHandler
+
+Modify response headers and body. Two methods allow phased processing:
+
+```go
+type ResponseHandler interface {
+    OnBeforeWriteHeaders(ctx Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error)
+    OnBeforeWrite(ctx Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error)
+}
+```
+
+**Example:**
+```go Expandable
+func (p *MyPlugin) OnBeforeWriteHeaders(ctx plugin_sdk.Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error) {
+    // Add tracking header
+    if req.Headers == nil {
+        req.Headers = make(map[string]string)
+    }
+    req.Headers["X-Request-Id"] = generateRequestID()
+
+    return &pb.ResponseWriteResponse{
+        Modified: true,
+        Headers:  req.Headers,
+    }, nil
+}
+
+func (p *MyPlugin) OnBeforeWrite(ctx plugin_sdk.Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error) {
+    // Modify response body
+    modifiedBody := transformResponse(req.Body)
+
+    return &pb.ResponseWriteResponse{
+        Modified: true,
+        Body:     modifiedBody,
+    }, nil
+}
+```
+
+### 5. DataCollector
+
+Collect telemetry data (analytics, budgets, proxy logs).
+
+```go
+type DataCollector interface {
+    HandleProxyLog(ctx Context, log *pb.ProxyLogData) error
+    HandleAnalytics(ctx Context, analytics *pb.AnalyticsData) error
+    HandleBudgetUsage(ctx Context, usage *pb.BudgetUsageData) error
+}
+```
+
+**Example:**
+```go Expandable
+func (p *MyPlugin) HandleAnalytics(ctx plugin_sdk.Context, analytics *pb.AnalyticsData) error {
+    // Export analytics to external system
+    return exportToElasticsearch(analytics)
+}
+
+func (p *MyPlugin) HandleBudgetUsage(ctx plugin_sdk.Context, usage *pb.BudgetUsageData) error {
+    // Track budget usage
+    return trackBudget(usage)
+}
+
+func (p *MyPlugin) HandleProxyLog(ctx plugin_sdk.Context, log *pb.ProxyLogData) error {
+    // Log proxy requests
+    return logToFile(log)
+}
+```
+
+### 6. AgentPlugin
+
+Conversational AI agent with streaming support. See [Agent Plugins Guide](/ai-management/ai-studio/plugins/studio-agent) for details.
+
+```go
+type AgentPlugin interface {
+    HandleAgentMessage(req *pb.AgentMessageRequest, stream pb.PluginService_HandleAgentMessageServer) error
+}
+```
+
+### 7. ObjectHookHandler
+
+Intercept CRUD operations on AI Studio objects (LLMs, Datasources, Tools, Users). See [Object Hooks Guide](/ai-management/ai-studio/plugins/object-hooks) for complete details.
+
+```go
+type ObjectHookHandler interface {
+    GetObjectHookRegistrations() ([]*pb.ObjectHookRegistration, error)
+    HandleObjectHook(ctx Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error)
+}
+```
+
+### 8. UIProvider
+
+Serve web UI assets for AI Studio plugins. See [UI Plugins Guide](/ai-management/ai-studio/plugins/studio-ui) for details.
+
+```go
+type UIProvider interface {
+    GetAsset(path string) ([]byte, string, error)
+    ListAssets() ([]string, error)
+    GetManifest() ([]byte, error)
+    HandleRPC(method string, payload []byte) ([]byte, error)
+}
+```
+
+### 9. ConfigProvider
+
+Provide JSON Schema for plugin configuration.
+
+```go
+type ConfigProvider interface {
+    GetConfigSchema() ([]byte, error)
+}
+```
+
+**Example:**
+```go Expandable
+func (p *MyPlugin) GetConfigSchema() ([]byte, error) {
+    schema := map[string]interface{}{
+        "type": "object",
+        "properties": map[string]interface{}{
+            "api_key": map[string]interface{}{
+                "type":        "string",
+                "description": "API key for external service",
+            },
+            "rate_limit": map[string]interface{}{
+                "type":        "integer",
+                "description": "Requests per minute",
+                "default":     100,
+            },
+        },
+        "required": []string{"api_key"},
+    }
+    return json.Marshal(schema)
+}
+```
+
+### 10. ManifestProvider
+
+Provide plugin manifest for gateway-only plugins (no UI).
+
+```go
+type ManifestProvider interface {
+    GetManifest() ([]byte, error)
+}
+```
+
+### 11. SchedulerPlugin
+
+Execute tasks on cron-based schedules.
+
+```go
+type SchedulerPlugin interface {
+    ExecuteScheduledTask(ctx Context, schedule *Schedule) error
+}
+
+type Schedule struct {
+    ID             string                 // Unique identifier from manifest
+    Name           string                 // Human-readable name
+    Cron           string                 // Cron expression (e.g., "0 * * * *")
+    Timezone       string                 // Timezone for cron evaluation
+    Enabled        bool                   // Whether schedule is currently enabled
+    TimeoutSeconds int                    // Maximum execution time
+    Config         map[string]interface{} // Schedule-specific configuration
+}
+```
+
+**Example:**
+```go
+func (p *MyPlugin) ExecuteScheduledTask(ctx plugin_sdk.Context, schedule *plugin_sdk.Schedule) error {
+    ctx.Services.Logger().Info("Running scheduled task",
+        "schedule_id", schedule.ID,
+        "schedule_name", schedule.Name,
+    )
+
+    // Perform scheduled work
+    return p.runCleanup(ctx)
+}
+```
+
+### 12. EdgePayloadReceiver
+
+Receive data from edge (Edge Gateway) plugins. This enables the hub-and-spoke communication pattern where edge plugins can send data back to the control plane. See [Edge-to-Control Communication](/ai-management/ai-studio/plugins/edge-to-control) for complete details.
+
+```go
+type EdgePayloadReceiver interface {
+    AcceptEdgePayload(ctx Context, payload *EdgePayload) (handled bool, err error)
+}
+
+type EdgePayload struct {
+    Payload           []byte            // Raw payload data from edge plugin
+    EdgeID            string            // Edge instance identifier
+    EdgeNamespace     string            // Namespace of the edge instance
+    CorrelationID     string            // Correlation ID for tracking
+    Metadata          map[string]string // Key-value metadata
+    EdgeTimestamp     int64             // Unix timestamp when generated at edge
+    ReceivedTimestamp int64             // Unix timestamp when received at control
+}
+```
+
+**Example:**
+```go Expandable
+func (p *MyPlugin) AcceptEdgePayload(ctx plugin_sdk.Context, payload *plugin_sdk.EdgePayload) (bool, error) {
+    // Check if this payload is for us
+    if payload.Metadata["type"] != "my-plugin-data" {
+        return false, nil // Not our payload
+    }
+
+    ctx.Services.Logger().Info("Received edge payload",
+        "edge_id", payload.EdgeID,
+        "correlation_id", payload.CorrelationID,
+    )
+
+    // Process the payload
+    if err := p.processEdgeData(payload.Payload); err != nil {
+        return true, err
+    }
+
+    return true, nil
+}
+```
+
+## Context and Services
+
+Every handler receives a `Context` that provides access to runtime information and services.
+
+### Context Fields
+
+```go
+type Context struct {
+    Runtime    Runtime                    // RuntimeStudio or RuntimeGateway
+    AppID      uint32                     // Current application ID
+    UserID     uint32                     // Current user ID (if authenticated)
+    SessionID  string                     // Chat session ID (if applicable)
+    LLM        *pb.LLM                    // LLM configuration (if applicable)
+    Services   Services                   // Service broker
+}
+```
+
+### Runtime Detection
+
+Plugins can adapt behavior based on runtime:
+
+```go
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    if ctx.Runtime == plugin_sdk.RuntimeStudio {
+        // Studio-specific logic
+        ctx.Services.Logger().Info("Running in AI Studio")
+    } else {
+        // Gateway-specific logic
+        ctx.Services.Logger().Info("Running in Microgateway")
+    }
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+### Service Broker
+
+The context provides access to services through `ctx.Services`:
+
+#### Universal Services (Both Runtimes)
+
+**KV Storage:**
+```go
+// Write data
+err := ctx.Services.KV().Write(ctx, "key", []byte("value"))
+
+// Read data
+data, err := ctx.Services.KV().Read(ctx, "key")
+
+// Delete data
+err := ctx.Services.KV().Delete(ctx, "key")
+
+// List keys
+keys, err := ctx.Services.KV().List(ctx, "prefix")
+```
+
+**Note on KV Storage:**
+- **Studio**: PostgreSQL-backed, shared across hosts, durable
+- **Gateway**: Local database, per-instance, ephemeral
+
+**Logging:**
+```go
+ctx.Services.Logger().Info("Message", "key", "value")
+ctx.Services.Logger().Warn("Warning", "error", err)
+ctx.Services.Logger().Error("Error", "details", details)
+ctx.Services.Logger().Debug("Debug info", "data", data)
+```
+
+**Events:**
+```go Expandable
+// Publish an event (flows up from edge to control)
+err := ctx.Services.Events().Publish(ctx, "cache.invalidate", payload, plugin_sdk.DirUp)
+
+// Subscribe to events on a specific topic
+subscriptionID, err := ctx.Services.Events().Subscribe("cache.invalidate", func(ev plugin_sdk.Event) {
+    // Handle event
+})
+
+// Subscribe to all events
+subscriptionID, err := ctx.Services.Events().SubscribeAll(func(ev plugin_sdk.Event) {
+    // Handle any event
+})
+
+// Unsubscribe when done
+err := ctx.Services.Events().Unsubscribe(subscriptionID)
+```
+
+**Note on Events:**
+- Events enable real-time communication between plugins and across the hub-spoke architecture
+- Direction controls routing: `DirLocal` (stays local), `DirUp` (edge→control), `DirDown` (control→edge)
+- See [Service API Reference](/ai-management/ai-studio/plugins/service-api#event-service) for complete documentation
+
+#### Runtime-Specific Services
+
+**Gateway Services** (`ctx.Services.Gateway()`):
+```go Expandable
+if ctx.Runtime == plugin_sdk.RuntimeGateway {
+    // Get app
+    app, err := ctx.Services.Gateway().GetApp(ctx, appID)
+
+    // List apps
+    apps, err := ctx.Services.Gateway().ListApps(ctx)
+
+    // Get LLM
+    llm, err := ctx.Services.Gateway().GetLLM(ctx, llmID)
+
+    // Get budget status
+    status, err := ctx.Services.Gateway().GetBudgetStatus(ctx, appID)
+
+    // Validate credential
+    valid, err := ctx.Services.Gateway().ValidateCredential(ctx, token)
+}
+```
+
+**Studio Services** (`ctx.Services.Studio()`):
+```go Expandable
+if ctx.Runtime == plugin_sdk.RuntimeStudio {
+    // Get app
+    app, err := ctx.Services.Studio().GetApp(ctx, appID)
+
+    // List apps (basic)
+    apps, err := ctx.Services.Studio().ListApps(ctx, page, limit)
+
+    // List apps with filtering (by owner, namespace, active status)
+    apps, err := ctx.Services.Studio().ListAppsWithFilters(ctx, page, limit, &plugin_sdk.ListAppsOptions{
+        UserID: &ownerID,
+        Namespace: "production",
+    })
+
+    // Update app with metadata (full replacement)
+    err := ctx.Services.Studio().UpdateAppWithMetadata(ctx, appID, metadata)
+
+    // Patch a single metadata key (atomic, safe for concurrent use)
+    metadataJSON, err := ctx.Services.Studio().PatchAppMetadata(ctx, appID, "tier", `"premium"`, false)
+
+    // List LLMs
+    llms, err := ctx.Services.Studio().ListLLMs(ctx, page, limit)
+
+    // List tools
+    tools, err := ctx.Services.Studio().ListTools(ctx, page, limit)
+
+    // Call LLM
+    stream, err := ctx.Services.Studio().CallLLM(ctx, llmID, model, messages, temp, maxTokens, tools, stream)
+}
+```
+
+## Initialization Pattern
+
+Plugins should extract the service broker ID during initialization for Service API access:
+
+```go Expandable
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    // Extract broker ID for Service API access
+    brokerIDStr := ""
+    if id, ok := config["_service_broker_id"]; ok {
+        brokerIDStr = id
+    } else if id, ok := config["service_broker_id"]; ok {
+        brokerIDStr = id
+    }
+
+    if brokerIDStr != "" {
+        var brokerID uint32
+        fmt.Sscanf(brokerIDStr, "%d", &brokerID)
+        ai_studio_sdk.SetServiceBrokerID(brokerID)
+    }
+
+    // Parse plugin-specific config
+    p.apiKey = config["api_key"]
+
+    return nil
+}
+```
+
+## BasePlugin Convenience Struct
+
+The SDK provides `BasePlugin` to reduce boilerplate:
+
+```go Expandable
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+    apiKey string
+}
+
+func NewMyPlugin() *MyPlugin {
+    return &MyPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "my-plugin",
+            "1.0.0",
+            "My plugin description",
+        ),
+    }
+}
+```
+
+`BasePlugin` provides default implementations for common methods, which you can override as needed.
+
+## Error Handling
+
+### Blocking Requests
+
+Return a response with `Block: true`:
+
+```go
+return &pb.PluginResponse{
+    Block:        true,
+    ErrorMessage: "Request blocked: invalid input",
+}, nil
+```
+
+### Non-Blocking Errors
+
+Log the error and continue:
+
+```go
+if err != nil {
+    ctx.Services.Logger().Error("Failed to process", "error", err)
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+### Agent Errors
+
+Send ERROR chunks for streaming agents:
+
+```go
+return stream.Send(&pb.AgentMessageChunk{
+    Type:    pb.AgentMessageChunk_ERROR,
+    Content: "Failed to process request",
+    IsFinal: true,
+})
+```
+
+## Complete Example: Multi-Capability Plugin
+
+```go Expandable
+package main
+
+import (
+    "encoding/json"
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk/pb"
+)
+
+type RequestLogger struct {
+    plugin_sdk.BasePlugin
+}
+
+func NewRequestLogger() *RequestLogger {
+    return &RequestLogger{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "request-logger",
+            "1.0.0",
+            "Logs requests and responses",
+        ),
+    }
+}
+
+// PostAuthHandler: Log incoming requests
+func (p *RequestLogger) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    ctx.Services.Logger().Info("Incoming request",
+        "app_id", ctx.AppID,
+        "user_id", ctx.UserID,
+        "path", req.Path,
+        "method", req.Method,
+    )
+
+    // Store request metadata in KV
+    metadata := map[string]interface{}{
+        "timestamp": time.Now().Unix(),
+        "path":      req.Path,
+        "method":    req.Method,
+    }
+    data, _ := json.Marshal(metadata)
+    ctx.Services.KV().Write(ctx, fmt.Sprintf("req:%s", req.RequestId), data)
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+
+// ResponseHandler: Log responses
+func (p *RequestLogger) OnBeforeWriteHeaders(ctx plugin_sdk.Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error) {
+    ctx.Services.Logger().Info("Outgoing response",
+        "app_id", ctx.AppID,
+        "status_code", req.StatusCode,
+        "request_id", req.RequestId,
+    )
+
+    return &pb.ResponseWriteResponse{Modified: false}, nil
+}
+
+// ConfigProvider: Provide config schema
+func (p *RequestLogger) GetConfigSchema() ([]byte, error) {
+    schema := map[string]interface{}{
+        "type": "object",
+        "properties": map[string]interface{}{
+            "log_level": map[string]interface{}{
+                "type":    "string",
+                "enum":    []string{"debug", "info", "warn", "error"},
+                "default": "info",
+            },
+        },
+    }
+    return json.Marshal(schema)
+}
+
+func main() {
+    plugin_sdk.Serve(NewRequestLogger())
+}
+```
+
+## Testing Plugins
+
+### Unit Testing
+
+```go Expandable
+func TestPluginLogic(t *testing.T) {
+    plugin := NewRequestLogger()
+
+    ctx := plugin_sdk.Context{
+        Runtime: plugin_sdk.RuntimeStudio,
+        AppID:   1,
+    }
+
+    req := &pb.EnrichedRequest{
+        Path:   "/api/v1/chat",
+        Method: "POST",
+    }
+
+    resp, err := plugin.HandlePostAuth(ctx, req)
+    if err != nil {
+        t.Fatalf("HandlePostAuth failed: %v", err)
+    }
+
+    if resp.Block {
+        t.Error("Expected request to not be blocked")
+    }
+}
+```
+
+### Integration Testing
+
+See working examples in [`examples/plugins/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins) for integration test patterns.
+
+## Best Practices
+
+### Configuration
+- Validate configuration in `Initialize()`
+- Extract broker ID for Service API access
+- Set sensible defaults
+- Return errors for invalid config
+
+### Service API Usage
+- Always check runtime before calling runtime-specific services
+- Use context timeouts for external calls
+- Cache frequently accessed data in KV storage
+- Handle service errors gracefully
+- Use Events for cross-plugin and edge-to-control communication
+- Unsubscribe from events in `Shutdown()` to prevent leaks
+
+### Performance
+- Minimize Service API calls in request path
+- Use KV storage for caching
+- Avoid blocking operations in handlers
+- Use goroutines for async work (clean up in Shutdown)
+
+### Resource Management
+- Clean up resources in `Shutdown()` method
+- Close connections and file handles
+- Cancel background goroutines
+- Clear caches
+
+### Security
+- Validate all inputs
+- Sanitize log output (no secrets)
+- Use secure defaults
+- Follow least privilege principle
+
+## Session-Based Broker Pattern
+
+Plugins running in AI Studio use a **session-based broker pattern** for Service API access. Understanding this pattern is critical for plugins that need to call host APIs (like `ai_studio_sdk.CreateLLM()`, `ai_studio_sdk.ListApps()`, etc.).
+
+### How It Works
+
+1. **Plugin loads**: The host creates a long-lived gRPC broker connection
+2. **Session opens**: The host calls `OpenSession` on the plugin, providing the broker ID
+3. **OnSessionReady callback**: For plugins implementing `SessionAware`, this signals the broker is ready
+4. **Service API available**: The plugin can now dial the broker and call host APIs
+
+### The SessionAware Interface
+
+Plugins that need early access to Service APIs should implement `SessionAware`:
+
+```go
+type SessionAware interface {
+    OnSessionReady(ctx Context)    // Called when broker connection is established
+    OnSessionClosing(ctx Context)  // Called before session closes
+}
+```
+
+### Connection Warmup Pattern (Critical!)
+
+**Important**: The go-plugin broker only accepts **ONE connection per broker ID**. If your plugin uses both the Event Service and the Management Service API, whichever dials first will succeed, and the connection must be shared.
+
+The SDK handles this automatically, but you should **warm up the connection early** in `OnSessionReady` to ensure it's established before any RPC calls come in:
+
+```go Expandable
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+    services plugin_sdk.ServiceBroker
+}
+
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    p.services = ctx.Services
+    return nil
+}
+
+// OnSessionReady implements plugin_sdk.SessionAware
+// This is called when the session-based broker connection is established.
+func (p *MyPlugin) OnSessionReady(ctx plugin_sdk.Context) {
+    log.Printf("Session ready - warming up service API connection...")
+
+    // Eagerly establish the broker connection by making a simple API call.
+    // This "warms up" the connection so subsequent RPC calls don't need to dial.
+    if ai_studio_sdk.IsInitialized() {
+        // Make a lightweight API call to establish the connection
+        _, err := ai_studio_sdk.GetPluginsCount(context.Background())
+        if err != nil {
+            log.Printf("Service API warmup failed: %v", err)
+        } else {
+            log.Printf("Service API connection established successfully")
+        }
+    }
+}
+
+// OnSessionClosing implements plugin_sdk.SessionAware
+func (p *MyPlugin) OnSessionClosing(ctx plugin_sdk.Context) {
+    log.Printf("Session closing - cleaning up resources")
+}
+```
+
+### Why Warmup Is Important
+
+Without warmup, you may encounter "timeout waiting for connection info" errors when your plugin tries to use the Service API during an RPC call. This happens because:
+
+1. The broker connection is time-sensitive
+2. Dialing late (during RPC) may fail if the broker has timed out
+3. Event subscriptions and Service API calls share the same connection
+
+### Complete Example: Plugin with Service API and Events
+
+```go Expandable
+package main
+
+import (
+    "context"
+    "log"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/ai_studio_sdk"
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+)
+
+type MyServicePlugin struct {
+    plugin_sdk.BasePlugin
+    services      plugin_sdk.ServiceBroker
+    eventSubID    string
+}
+
+func NewMyServicePlugin() *MyServicePlugin {
+    return &MyServicePlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin("my-service-plugin", "1.0.0", "Plugin using Service API"),
+    }
+}
+
+func (p *MyServicePlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    p.services = ctx.Services
+    log.Printf("Initialized in %s runtime", ctx.Runtime)
+    return nil
+}
+
+// OnSessionReady - warm up connections and set up subscriptions
+func (p *MyServicePlugin) OnSessionReady(ctx plugin_sdk.Context) {
+    log.Printf("Session ready")
+
+    // 1. Warm up Service API connection
+    if ai_studio_sdk.IsInitialized() {
+        _, err := ai_studio_sdk.GetPluginsCount(context.Background())
+        if err != nil {
+            log.Printf("Service API warmup failed: %v", err)
+        } else {
+            log.Printf("Service API connection ready")
+        }
+    }
+
+    // 2. Set up event subscriptions (uses same connection)
+    if p.services != nil {
+        events := p.services.Events()
+        if events != nil {
+            subID, err := events.Subscribe("config.updated", p.handleConfigUpdate)
+            if err != nil {
+                log.Printf("Failed to subscribe to events: %v", err)
+            } else {
+                p.eventSubID = subID
+                log.Printf("Subscribed to config.updated events")
+            }
+        }
+    }
+}
+
+func (p *MyServicePlugin) handleConfigUpdate(ev plugin_sdk.Event) {
+    log.Printf("Received config update: %s", ev.Topic)
+    // Handle the event...
+}
+
+func (p *MyServicePlugin) OnSessionClosing(ctx plugin_sdk.Context) {
+    // Clean up event subscription
+    if p.eventSubID != "" && p.services != nil {
+        p.services.Events().Unsubscribe(p.eventSubID)
+    }
+}
+
+// HandleRPC - called from UI, Service API is already warmed up
+func (p *MyServicePlugin) HandleRPC(method string, payload []byte) ([]byte, error) {
+    // Service API calls will work because connection was warmed up in OnSessionReady
+    llms, err := ai_studio_sdk.ListLLMs(context.Background(), 1, 10)
+    if err != nil {
+        return nil, err
+    }
+    // Process llms...
+    return []byte(`{"success": true}`), nil
+}
+
+func main() {
+    plugin_sdk.Serve(NewMyServicePlugin())
+}
+```
+
+### Troubleshooting Connection Issues
+
+**Error: "timeout waiting for connection info"**
+- Plugin is trying to dial the broker too late
+- Solution: Implement `SessionAware` and warm up the connection in `OnSessionReady`
+
+**Error: "service broker ID not set"**
+- The broker ID wasn't extracted from config
+- Solution: The SDK handles this automatically via `OpenSession`, but verify your plugin isn't overriding the broker setup
+
+**Error: "SDK not initialized"**
+- `ai_studio_sdk.Initialize()` wasn't called or failed
+- Solution: Check logs for initialization errors during plugin startup
diff --git a/ai-management/ai-studio/plugins/service-api.mdx b/ai-management/ai-studio/plugins/service-api.mdx
new file mode 100644
index 0000000000..3fae689c7c
--- /dev/null
+++ b/ai-management/ai-studio/plugins/service-api.mdx
@@ -0,0 +1,2103 @@
+---
+title: "Tyk AI Studio Service API Reference"
+description: "A comprehensive reference for the Tyk AI Studio Service API, providing management capabilities for plugins to interact with the platform, including KV storage, logging, and management APIs."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "Service API Reference"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph TD
+    A[Plugin] -->|gRPC| B[Service API]
+    B --> C[KV Storage]
+    B --> D[Logging]
+    B --> E[Management APIs]
+```
+
+The Service API provides rich management capabilities for plugins to interact with the platform. Access is available through the **Unified Plugin SDK** via the `Context.Services` interface.
+
+## Overview
+
+Service API access is available to all plugins using the unified SDK (`pkg/plugin_sdk`), with different capabilities depending on the runtime:
+
+### Universal Services (Both Runtimes)
+- **KV Storage**: Key-value storage (PostgreSQL in Studio, local DB in Gateway)
+- **Logger**: Structured logging
+
+### Runtime-Specific Services
+- **Gateway Services**: App management, LLM info, budget status, credential validation
+- **Studio Services**: Full management API (LLMs, tools, apps, filters, tags, CallLLM)
+
+## Access Pattern
+
+All services are accessed through the `Context.Services` interface provided to your plugin handlers:
+
+```go Expandable
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Universal services
+    ctx.Services.Logger().Info("Processing request", "app_id", ctx.AppID)
+    data, err := ctx.Services.KV().Read(ctx, "my-key")
+
+    // Runtime-specific services
+    if ctx.Runtime == plugin_sdk.RuntimeStudio {
+        llms, err := ctx.Services.Studio().ListLLMs(ctx, 1, 10)
+    } else if ctx.Runtime == plugin_sdk.RuntimeGateway {
+        app, err := ctx.Services.Gateway().GetApp(ctx, ctx.AppID)
+    }
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+## Initialization and Connection Warmup
+
+For Service API access in AI Studio, plugins use a **session-based broker pattern**. The SDK handles most of the setup automatically, but there's a critical pattern you must follow for reliable Service API access.
+
+### The Connection Warmup Pattern
+
+**Critical**: The go-plugin broker only accepts **ONE connection per broker ID**. If your plugin uses both the Event Service and the Management Service API, whichever service dials first will succeed, and the connection is shared between them.
+
+To ensure reliable Service API access, implement `SessionAware` and **warm up the connection in `OnSessionReady`**:
+
+```go Expandable
+import (
+    "context"
+    "log"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/ai_studio_sdk"
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+)
+
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+    services plugin_sdk.ServiceBroker
+}
+
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    p.services = ctx.Services
+    return nil
+}
+
+// OnSessionReady implements plugin_sdk.SessionAware
+// CRITICAL: Warm up the Service API connection here!
+func (p *MyPlugin) OnSessionReady(ctx plugin_sdk.Context) {
+    log.Printf("Session ready - warming up service API connection...")
+
+    // Eagerly establish the broker connection by making a lightweight API call.
+    // This ensures the connection is ready before any RPC calls come in.
+    if ai_studio_sdk.IsInitialized() {
+        _, err := ai_studio_sdk.GetPluginsCount(context.Background())
+        if err != nil {
+            log.Printf("Service API warmup failed: %v", err)
+        } else {
+            log.Printf("Service API connection established successfully")
+        }
+    }
+}
+
+func (p *MyPlugin) OnSessionClosing(ctx plugin_sdk.Context) {
+    log.Printf("Session closing")
+}
+```
+
+### Why Warmup Is Required
+
+Without the warmup pattern, you may encounter **"timeout waiting for connection info"** errors when your plugin tries to use the Service API during an RPC call. This happens because:
+
+1. The broker connection is time-sensitive and must be established early
+2. Dialing late (during an RPC call from the UI) may fail if timing is off
+3. Event subscriptions and Service API calls share the same underlying connection
+
+### Legacy Pattern (Still Supported)
+
+The older pattern of extracting the broker ID manually during `Initialize` still works but is not recommended:
+
+```go Expandable
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    // Extract broker ID for Service API access (automatic with SessionAware)
+    brokerIDStr := ""
+    if id, ok := config["_service_broker_id"]; ok {
+        brokerIDStr = id
+    } else if id, ok := config["service_broker_id"]; ok {
+        brokerIDStr = id
+    }
+
+    if brokerIDStr != "" {
+        var brokerID uint32
+        fmt.Sscanf(brokerIDStr, "%d", &brokerID)
+        ai_studio_sdk.SetServiceBrokerID(brokerID)
+    }
+
+    return nil
+}
+```
+
+**Note**: The SDK now handles broker ID extraction automatically via `OpenSession`. You only need to implement `SessionAware` and warm up the connection.
+
+## Universal Services
+
+These services are available in both Studio and Gateway runtimes.
+
+### KV Storage
+
+Key-value storage for plugin data:
+- **Studio**: PostgreSQL-backed, shared across hosts, durable
+- **Gateway**: Local database, per-instance, ephemeral
+
+#### Write Data
+
+```go
+err := ctx.Services.KV().Write(ctx, "my-key", []byte("value"))
+```
+
+Returns error if write fails.
+
+Example:
+```go
+settings := map[string]interface{}{
+    "enabled": true,
+    "rate_limit": 100,
+}
+
+data, _ := json.Marshal(settings)
+err := ctx.Services.KV().Write(ctx, "settings", data)
+if err != nil {
+    ctx.Services.Logger().Error("Failed to write settings", "error", err)
+}
+```
+
+#### Read Data
+
+```go
+data, err := ctx.Services.KV().Read(ctx, "my-key")
+```
+
+Returns error if key doesn't exist.
+
+Example:
+```go
+data, err := ctx.Services.KV().Read(ctx, "settings")
+if err != nil {
+    ctx.Services.Logger().Warn("Settings not found", "error", err)
+    // Use defaults
+}
+
+var settings map[string]interface{}
+json.Unmarshal(data, &settings)
+```
+
+#### Delete Data
+
+```go
+err := ctx.Services.KV().Delete(ctx, "my-key")
+```
+
+Example:
+```go
+err := ctx.Services.KV().Delete(ctx, "cache:user:123")
+if err != nil {
+    ctx.Services.Logger().Error("Failed to delete cache", "error", err)
+}
+```
+
+#### List Keys
+
+```go
+keys, err := ctx.Services.KV().List(ctx, "prefix")
+```
+
+Example:
+```go
+keys, err := ctx.Services.KV().List(ctx, "cache:")
+if err != nil {
+    return err
+}
+
+for _, key := range keys {
+    ctx.Services.Logger().Debug("Found key", "key", key)
+}
+```
+
+### Logger
+
+Structured logging with key-value pairs:
+
+```go
+ctx.Services.Logger().Info("Message", "key", "value")
+ctx.Services.Logger().Warn("Warning", "error", err)
+ctx.Services.Logger().Error("Error", "details", details)
+ctx.Services.Logger().Debug("Debug info", "data", data)
+```
+
+Example:
+```go Expandable
+func (p *MyPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    ctx.Services.Logger().Info("Request received",
+        "app_id", ctx.AppID,
+        "user_id", ctx.UserID,
+        "path", req.Path,
+        "method", req.Method,
+    )
+
+    // Process request...
+
+    ctx.Services.Logger().Info("Request processed",
+        "app_id", ctx.AppID,
+        "duration_ms", time.Since(startTime).Milliseconds(),
+    )
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+### Event Service
+
+The Event Service enables plugins to publish and subscribe to events using the Event Bridge system. This allows plugins to communicate across the distributed architecture (edge ↔ control) using a pub/sub pattern.
+
+**Key Features:**
+- Publish events to the local event bus
+- Subscribe to events by topic or all events
+- Events can flow across the hub-spoke architecture based on direction
+- Automatic cleanup of subscriptions when plugin disconnects
+
+#### Event Directions
+
+Events have a direction that controls routing:
+
+| Direction | Constant | Description |
+|-----------|----------|-------------|
+| Local | `plugin_sdk.DirLocal` | Stays on local bus only, never forwarded |
+| Up | `plugin_sdk.DirUp` | Flows from edge (Edge Gateway) to control (AI Studio) |
+| Down | `plugin_sdk.DirDown` | Flows from control (AI Studio) to edge(s) |
+
+#### Publish Event
+
+Publish an event with a JSON-serializable payload:
+
+```go
+err := ctx.Services.Events().Publish(ctx, "my.topic", payload, plugin_sdk.DirUp)
+```
+
+Example:
+```go Expandable
+// Publish a cache hit event to the local bus only
+cacheEvent := map[string]interface{}{
+    "key":       "user:123",
+    "hit":       true,
+    "timestamp": time.Now().Unix(),
+}
+err := ctx.Services.Events().Publish(ctx, "cache.hit", cacheEvent, plugin_sdk.DirLocal)
+if err != nil {
+    ctx.Services.Logger().Error("Failed to publish cache event", "error", err)
+}
+
+// Publish metrics from edge to control
+metrics := map[string]interface{}{
+    "requests_per_second": 1500,
+    "avg_latency_ms":      25,
+    "error_rate":          0.02,
+}
+err = ctx.Services.Events().Publish(ctx, "metrics.report", metrics, plugin_sdk.DirUp)
+```
+
+#### Publish Raw Event
+
+Publish an event with pre-serialized JSON payload (avoids double-serialization):
+
+```go
+err := ctx.Services.Events().PublishRaw(ctx, "my.topic", jsonBytes, plugin_sdk.DirUp)
+```
+
+Example:
+```go
+// When you already have JSON bytes
+jsonPayload := []byte(`{"status": "ready", "version": "1.0.0"}`)
+err := ctx.Services.Events().PublishRaw(ctx, "plugin.status", jsonPayload, plugin_sdk.DirLocal)
+```
+
+#### Subscribe to Events
+
+Subscribe to events on a specific topic:
+
+```go
+subscriptionID, err := ctx.Services.Events().Subscribe("my.topic", func(ev plugin_sdk.Event) {
+    // Handle event
+    fmt.Printf("Received: %s from %s\n", ev.Topic, ev.Origin)
+})
+```
+
+Example:
+```go Expandable
+// Subscribe to configuration updates
+subID, err := ctx.Services.Events().Subscribe("config.updated", func(ev plugin_sdk.Event) {
+    ctx.Services.Logger().Info("Configuration updated",
+        "event_id", ev.ID,
+        "origin", ev.Origin,
+    )
+
+    // Parse payload
+    var config map[string]interface{}
+    if err := json.Unmarshal(ev.Payload, &config); err != nil {
+        ctx.Services.Logger().Error("Failed to parse config", "error", err)
+        return
+    }
+
+    // Apply new configuration
+    p.applyConfig(config)
+})
+if err != nil {
+    ctx.Services.Logger().Error("Failed to subscribe", "error", err)
+}
+
+// Store subscription ID to unsubscribe later
+p.configSubID = subID
+```
+
+#### Subscribe to All Events
+
+Subscribe to all events regardless of topic:
+
+```go
+subscriptionID, err := ctx.Services.Events().SubscribeAll(func(ev plugin_sdk.Event) {
+    // Handle all events
+})
+```
+
+Example:
+```go
+// Monitor all events for debugging
+subID, err := ctx.Services.Events().SubscribeAll(func(ev plugin_sdk.Event) {
+    ctx.Services.Logger().Debug("Event observed",
+        "id", ev.ID,
+        "topic", ev.Topic,
+        "origin", ev.Origin,
+        "direction", ev.Dir,
+    )
+})
+```
+
+#### Unsubscribe
+
+Remove a subscription:
+
+```go
+err := ctx.Services.Events().Unsubscribe(subscriptionID)
+```
+
+Example:
+```go
+// Clean up subscription in Shutdown
+func (p *MyPlugin) Shutdown(ctx plugin_sdk.Context) error {
+    if p.configSubID != "" {
+        if err := ctx.Services.Events().Unsubscribe(p.configSubID); err != nil {
+            ctx.Services.Logger().Warn("Failed to unsubscribe", "error", err)
+        }
+    }
+    return nil
+}
+```
+
+**Note:** Subscriptions are automatically cleaned up when the plugin process terminates, but it's good practice to explicitly unsubscribe in `Shutdown()`.
+
+#### Event Structure
+
+Events have the following fields:
+
+```go
+type Event struct {
+    ID      string           // UUID for deduplication and tracing
+    Topic   string           // Logical topic name (e.g., "config.update")
+    Origin  string           // Node/plugin that created the event
+    Dir     Direction        // Routing direction
+    Payload json.RawMessage  // JSON payload
+}
+```
+
+#### Complete Example: Event-Driven Cache Invalidation
+
+```go Expandable
+package main
+
+import (
+    "encoding/json"
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+)
+
+type CachePlugin struct {
+    plugin_sdk.BasePlugin
+    cache           map[string][]byte
+    invalidationSub string
+}
+
+func (p *CachePlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    p.cache = make(map[string][]byte)
+
+    // Subscribe to cache invalidation events from control
+    subID, err := ctx.Services.Events().Subscribe("cache.invalidate", func(ev plugin_sdk.Event) {
+        var req struct {
+            Keys []string `json:"keys"`
+        }
+        if err := json.Unmarshal(ev.Payload, &req); err != nil {
+            return
+        }
+
+        for _, key := range req.Keys {
+            delete(p.cache, key)
+        }
+
+        ctx.Services.Logger().Info("Cache invalidated",
+            "keys", len(req.Keys),
+            "origin", ev.Origin,
+        )
+    })
+    if err != nil {
+        return err
+    }
+    p.invalidationSub = subID
+
+    return nil
+}
+
+func (p *CachePlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    cacheKey := req.Path
+
+    // Check cache
+    if data, ok := p.cache[cacheKey]; ok {
+        // Publish cache hit event (local only for metrics)
+        ctx.Services.Events().Publish(ctx, "cache.hit", map[string]interface{}{
+            "key": cacheKey,
+        }, plugin_sdk.DirLocal)
+
+        // Return cached response...
+    }
+
+    // Cache miss - continue to upstream
+    return &pb.PluginResponse{Modified: false}, nil
+}
+
+func (p *CachePlugin) Shutdown(ctx plugin_sdk.Context) error {
+    if p.invalidationSub != "" {
+        ctx.Services.Events().Unsubscribe(p.invalidationSub)
+    }
+    return nil
+}
+```
+
+#### Event Service Best Practices
+
+1. **Use Appropriate Directions**:
+   - `DirLocal` for metrics and debugging within a single node
+   - `DirUp` for edge plugins sending data to control
+   - `DirDown` for control pushing updates to edges
+
+2. **Handle Payload Parsing Errors**: Always validate and handle JSON unmarshaling errors in event handlers.
+
+3. **Avoid Blocking in Handlers**: Event handlers should be fast. For heavy processing, spawn a goroutine or queue work.
+
+4. **Clean Up Subscriptions**: Unsubscribe in `Shutdown()` for explicit cleanup.
+
+5. **Use Meaningful Topics**: Use dot-separated topic names for clarity (e.g., `cache.invalidate`, `config.updated`, `metrics.report`).
+
+6. **Include Context in Payloads**: Add timestamps, correlation IDs, or source info to payloads for debugging.
+
+### System CRUD Events
+
+AI Studio emits built-in system events when core objects are created, updated, or deleted. These events are published to the local event bus (control-plane only) and can be subscribed to by any plugin.
+
+#### Available System Events
+
+| Topic | Object Type | Action | Description |
+|-------|-------------|--------|-------------|
+| `system.llm.created` | LLM | created | Emitted when an LLM is created |
+| `system.llm.updated` | LLM | updated | Emitted when an LLM is updated |
+| `system.llm.deleted` | LLM | deleted | Emitted when an LLM is deleted |
+| `system.app.created` | App | created | Emitted when an App is created |
+| `system.app.updated` | App | updated | Emitted when an App is updated |
+| `system.app.deleted` | App | deleted | Emitted when an App is deleted |
+| `system.app.approved` | App | approved | Emitted when an App's credential is activated |
+| `system.datasource.created` | Datasource | created | Emitted when a Datasource is created |
+| `system.datasource.updated` | Datasource | updated | Emitted when a Datasource is updated |
+| `system.datasource.deleted` | Datasource | deleted | Emitted when a Datasource is deleted |
+| `system.user.created` | User | created | Emitted when a User is created |
+| `system.user.updated` | User | updated | Emitted when a User is updated |
+| `system.user.deleted` | User | deleted | Emitted when a User is deleted |
+| `system.group.created` | Group | created | Emitted when a Group is created |
+| `system.group.updated` | Group | updated | Emitted when a Group is updated |
+| `system.group.deleted` | Group | deleted | Emitted when a Group is deleted |
+| `system.tool.created` | Tool | created | Emitted when a Tool is created |
+| `system.tool.updated` | Tool | updated | Emitted when a Tool is updated |
+| `system.tool.deleted` | Tool | deleted | Emitted when a Tool is deleted |
+
+#### Event Payload Structure
+
+All system CRUD events use a consistent payload structure:
+
+```go
+type ObjectEventPayload struct {
+    ObjectType string      `json:"object_type"`  // "llm", "app", "datasource", "user", "group", "tool"
+    Action     string      `json:"action"`       // "created", "updated", "deleted", "approved"
+    ObjectID   uint        `json:"object_id"`    // ID of the affected object
+    UserID     uint        `json:"user_id"`      // User who performed the action (0 if system/unknown)
+    Timestamp  time.Time   `json:"timestamp"`    // When the event occurred
+    Object     interface{} `json:"object"`       // The full object (for create/update, nil for delete)
+}
+```
+
+#### Subscribing to System Events
+
+```go Expandable
+// Subscribe to all App events using wildcard
+subID, err := ctx.Services.Events().Subscribe("system.app.*", func(ev plugin_sdk.Event) {
+    var payload struct {
+        ObjectType string      `json:"object_type"`
+        Action     string      `json:"action"`
+        ObjectID   uint        `json:"object_id"`
+        UserID     uint        `json:"user_id"`
+        Timestamp  time.Time   `json:"timestamp"`
+        Object     interface{} `json:"object"`
+    }
+
+    if err := json.Unmarshal(ev.Payload, &payload); err != nil {
+        ctx.Services.Logger().Error("Failed to parse event payload", "error", err)
+        return
+    }
+
+    ctx.Services.Logger().Info("App event received",
+        "action", payload.Action,
+        "object_id", payload.ObjectID,
+        "user_id", payload.UserID,
+    )
+})
+
+// Or subscribe to a specific event
+subID, err := ctx.Services.Events().Subscribe("system.user.created", func(ev plugin_sdk.Event) {
+    // Handle new user creation
+})
+```
+
+#### Example: Audit Log Plugin
+
+```go Expandable
+package main
+
+import (
+    "encoding/json"
+    "time"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+)
+
+type AuditLogPlugin struct {
+    plugin_sdk.BasePlugin
+    subscriptions []string
+}
+
+func (p *AuditLogPlugin) OnSessionReady(ctx plugin_sdk.Context) {
+    // Subscribe to all system events
+    topics := []string{
+        "system.llm.created", "system.llm.updated", "system.llm.deleted",
+        "system.app.created", "system.app.updated", "system.app.deleted", "system.app.approved",
+        "system.datasource.created", "system.datasource.updated", "system.datasource.deleted",
+        "system.user.created", "system.user.updated", "system.user.deleted",
+        "system.group.created", "system.group.updated", "system.group.deleted",
+        "system.tool.created", "system.tool.updated", "system.tool.deleted",
+    }
+
+    for _, topic := range topics {
+        subID, err := ctx.Services.Events().Subscribe(topic, func(ev plugin_sdk.Event) {
+            p.logAuditEvent(ctx, ev)
+        })
+        if err != nil {
+            ctx.Services.Logger().Error("Failed to subscribe to event", "topic", topic, "error", err)
+            continue
+        }
+        p.subscriptions = append(p.subscriptions, subID)
+    }
+}
+
+func (p *AuditLogPlugin) logAuditEvent(ctx plugin_sdk.Context, ev plugin_sdk.Event) {
+    var payload struct {
+        ObjectType string    `json:"object_type"`
+        Action     string    `json:"action"`
+        ObjectID   uint      `json:"object_id"`
+        UserID     uint      `json:"user_id"`
+        Timestamp  time.Time `json:"timestamp"`
+    }
+
+    if err := json.Unmarshal(ev.Payload, &payload); err != nil {
+        return
+    }
+
+    // Log to external audit system, KV storage, etc.
+    ctx.Services.Logger().Info("AUDIT",
+        "object_type", payload.ObjectType,
+        "action", payload.Action,
+        "object_id", payload.ObjectID,
+        "user_id", payload.UserID,
+        "timestamp", payload.Timestamp,
+    )
+}
+
+func (p *AuditLogPlugin) OnSessionClosing(ctx plugin_sdk.Context) {
+    for _, subID := range p.subscriptions {
+        ctx.Services.Events().Unsubscribe(subID)
+    }
+}
+```
+
+**Note**: System events are published with `DirLocal` direction, meaning they stay on the control plane and are not forwarded to edge instances.
+
+## Studio Services
+
+Available when `ctx.Runtime == plugin_sdk.RuntimeStudio`.
+
+### LLM Operations
+
+Requires: `llms.read`, `llms.write`, or `llms.proxy` scope
+
+#### List LLMs
+
+```go
+llms, err := ctx.Services.Studio().ListLLMs(ctx, page, limit)
+```
+
+**Alternative** (direct SDK call):
+```go
+llmsResp, err := ai_studio_sdk.ListLLMs(ctx, 1, 10)
+```
+
+Example:
+```go Expandable
+if ctx.Runtime == plugin_sdk.RuntimeStudio {
+    llms, err := ctx.Services.Studio().ListLLMs(ctx, 1, 10)
+    if err != nil {
+        return err
+    }
+
+    // Type assert the response
+    llmsResp := llms.(*studiomgmt.ListLLMsResponse)
+    for _, llm := range llmsResp.Llms {
+        ctx.Services.Logger().Info("LLM found",
+            "name", llm.Name,
+            "vendor", llm.Vendor,
+            "model", llm.DefaultModel,
+        )
+    }
+}
+```
+
+#### Get LLM
+
+```go
+llm, err := ctx.Services.Studio().GetLLM(ctx, llmID)
+```
+
+**Alternative** (direct SDK call):
+```go
+llm, err := ai_studio_sdk.GetLLM(ctx, 1)
+```
+
+### Call LLM (Streaming)
+
+Requires: `llms.proxy` scope
+
+```go
+func CallLLM(
+    ctx context.Context,
+    llmID uint32,
+    model string,
+    messages []*mgmtpb.LLMMessage,
+    temperature float64,
+    maxTokens int32,
+    tools []*mgmtpb.LLMTool,
+    stream bool,
+) (mgmtpb.AIStudioManagementService_CallLLMClient, error)
+```
+
+Example:
+```go Expandable
+messages := []*mgmtpb.LLMMessage{
+    {Role: "user", Content: "What is the capital of France?"},
+}
+
+llmStream, err := ai_studio_sdk.CallLLM(ctx, 1, "gpt-4", messages, 0.7, 1000, nil, false)
+if err != nil {
+    return err
+}
+
+var response string
+for {
+    resp, err := llmStream.Recv()
+    if err == io.EOF {
+        break
+    }
+    if err != nil {
+        return err
+    }
+
+    response += resp.Content
+
+    if resp.Done {
+        break
+    }
+}
+
+log.Printf("LLM response: %s", response)
+```
+
+### Call LLM (Simple)
+
+Convenience method for simple calls:
+
+```go
+func CallLLMSimple(ctx context.Context, llmID uint32, model string, userMessage string) (string, error)
+```
+
+Example:
+```go
+response, err := ai_studio_sdk.CallLLMSimple(ctx, 1, "gpt-4", "Hello, world!")
+if err != nil {
+    return err
+}
+
+log.Printf("Response: %s", response)
+```
+
+### Get LLMs Count
+
+```go
+func GetLLMsCount(ctx context.Context) (int64, error)
+```
+
+Example:
+```go
+count, err := ai_studio_sdk.GetLLMsCount(ctx)
+if err != nil {
+    return err
+}
+
+log.Printf("Total LLMs: %d", count)
+```
+
+**Note**: For complete Studio Services documentation including Tools, Apps, Plugins, Datasources, and Filters, see the examples in the working plugins at `examples/plugins/studio/service-api-test/`.
+
+## Gateway Services
+
+Available when `ctx.Runtime == plugin_sdk.RuntimeGateway`.
+
+Gateway Services provide read-only access to essential gateway information.
+
+### Get App
+
+```go
+app, err := ctx.Services.Gateway().GetApp(ctx, appID)
+```
+
+Returns app configuration. Type assert to `*gwmgmt.GetAppResponse`.
+
+Example:
+```go
+if ctx.Runtime == plugin_sdk.RuntimeGateway {
+    app, err := ctx.Services.Gateway().GetApp(ctx, ctx.AppID)
+    if err != nil {
+        ctx.Services.Logger().Error("Failed to get app", "error", err)
+        return &pb.PluginResponse{Modified: false}, nil
+    }
+
+    appResp := app.(*gwmgmt.GetAppResponse)
+    ctx.Services.Logger().Info("Processing request for app",
+        "app_name", appResp.Name,
+        "llm_count", len(appResp.Llms),
+    )
+}
+```
+
+### List Apps
+
+```go
+apps, err := ctx.Services.Gateway().ListApps(ctx)
+```
+
+Returns all apps accessible to the gateway. Type assert to `*gwmgmt.ListAppsResponse`.
+
+### Get LLM
+
+```go
+llm, err := ctx.Services.Gateway().GetLLM(ctx, llmID)
+```
+
+Returns LLM configuration. Type assert to `*gwmgmt.GetLLMResponse`.
+
+### List LLMs
+
+```go
+llms, err := ctx.Services.Gateway().ListLLMs(ctx)
+```
+
+Returns all LLMs configured for the gateway. Type assert to `*gwmgmt.ListLLMsResponse`.
+
+### Get Budget Status
+
+```go
+status, err := ctx.Services.Gateway().GetBudgetStatus(ctx, appID)
+```
+
+Returns current budget status for an app. Type assert to `*gwmgmt.GetBudgetStatusResponse`.
+
+Example:
+```go Expandable
+if ctx.Runtime == plugin_sdk.RuntimeGateway {
+    status, err := ctx.Services.Gateway().GetBudgetStatus(ctx, ctx.AppID)
+    if err != nil {
+        ctx.Services.Logger().Error("Failed to get budget", "error", err)
+        return &pb.PluginResponse{Modified: false}, nil
+    }
+
+    budgetResp := status.(*gwmgmt.GetBudgetStatusResponse)
+    if budgetResp.RemainingBudget <= 0 {
+        return &pb.PluginResponse{
+            Block:        true,
+            ErrorMessage: "Budget exceeded",
+        }, nil
+    }
+}
+```
+
+### Get Model Price
+
+```go
+price, err := ctx.Services.Gateway().GetModelPrice(ctx, vendor, model)
+```
+
+Returns pricing information for a model. Type assert to `*gwmgmt.GetModelPriceResponse`.
+
+### Validate Credential
+
+```go
+valid, err := ctx.Services.Gateway().ValidateCredential(ctx, token)
+```
+
+Validates a credential token. Type assert to `*gwmgmt.ValidateCredentialResponse`.
+
+Example:
+```go
+if ctx.Runtime == plugin_sdk.RuntimeGateway {
+    valid, err := ctx.Services.Gateway().ValidateCredential(ctx, req.Headers["Authorization"])
+    if err != nil || !valid.(*gwmgmt.ValidateCredentialResponse).Valid {
+        return &pb.PluginResponse{
+            Block:        true,
+            ErrorMessage: "Invalid credentials",
+        }, nil
+    }
+}
+```
+
+## Tool Operations (Studio Only)
+
+Requires: `tools.read`, `tools.write`, or `tools.execute` scope
+
+### List Tools
+
+```go
+func ListTools(ctx context.Context, page, limit int32) (*mgmtpb.ListToolsResponse, error)
+```
+
+Example:
+```go
+toolsResp, err := ai_studio_sdk.ListTools(ctx, 1, 50)
+if err != nil {
+    return err
+}
+
+for _, tool := range toolsResp.Tools {
+    log.Printf("Tool: %s (%s) - %s", tool.Name, tool.Slug, tool.Description)
+    for _, op := range tool.Operations {
+        log.Printf("  Operation: %s", op)
+    }
+}
+```
+
+### Get Tool by ID
+
+```go
+func GetTool(ctx context.Context, toolID uint32) (*mgmtpb.Tool, error)
+```
+
+Example:
+```go
+tool, err := ai_studio_sdk.GetTool(ctx, 1)
+if err != nil {
+    return err
+}
+
+log.Printf("Tool: %s - Type: %s", tool.Name, tool.ToolType)
+```
+
+### Execute Tool
+
+Requires: `tools.execute` scope
+
+```go
+func ExecuteTool(
+    ctx context.Context,
+    toolID uint32,
+    operationID string,
+    parameters map[string]interface{},
+) (*mgmtpb.ExecuteToolResponse, error)
+```
+
+Example:
+```go
+params := map[string]interface{}{
+    "url": "https://api.example.com/users",
+    "method": "GET",
+}
+
+result, err := ai_studio_sdk.ExecuteTool(ctx, 1, "http_request", params)
+if err != nil {
+    return err
+}
+
+log.Printf("Tool result: %s", result.Data)
+```
+
+## Plugin Operations
+
+Requires: `plugins.read` or `plugins.write` scope
+
+### List Plugins
+
+```go
+func ListPlugins(ctx context.Context, page, limit int32) (*mgmtpb.ListPluginsResponse, error)
+```
+
+Example:
+```go
+pluginsResp, err := ai_studio_sdk.ListPlugins(ctx, 1, 10)
+if err != nil {
+    return err
+}
+
+for _, plugin := range pluginsResp.Plugins {
+    log.Printf("Plugin: %s - Type: %s, Active: %t",
+        plugin.Name, plugin.PluginType, plugin.IsActive)
+}
+```
+
+### Get Plugin by ID
+
+```go
+func GetPlugin(ctx context.Context, pluginID uint32) (*mgmtpb.Plugin, error)
+```
+
+Example:
+```go
+plugin, err := ai_studio_sdk.GetPlugin(ctx, 1)
+if err != nil {
+    return err
+}
+
+log.Printf("Plugin: %s - Hook: %s", plugin.Name, plugin.HookType)
+```
+
+### Get Plugins Count
+
+```go
+func GetPluginsCount(ctx context.Context) (int64, error)
+```
+
+Example:
+```go
+count, err := ai_studio_sdk.GetPluginsCount(ctx)
+if err != nil {
+    return err
+}
+
+log.Printf("Total plugins: %d", count)
+```
+
+## App Operations
+
+Requires: `apps.read` or `apps.write` scope
+
+### List Apps
+
+```go
+func ListApps(ctx context.Context, page, limit int32) (*mgmtpb.ListAppsResponse, error)
+```
+
+Example:
+```go
+appsResp, err := ai_studio_sdk.ListApps(ctx, 1, 10)
+if err != nil {
+    return err
+}
+
+for _, app := range appsResp.Apps {
+    log.Printf("App: %s - LLMs: %d, Tools: %d",
+        app.Name, len(app.Llms), len(app.Tools))
+}
+```
+
+### List Apps with Filters
+
+```go
+func ListAppsWithFilters(ctx context.Context, page, limit int32, opts *ListAppsOptions) (*mgmtpb.ListAppsResponse, error)
+```
+
+`ListAppsOptions` supports filtering by:
+- `IsActive *bool` — Filter by active/inactive status
+- `Namespace string` — Filter by namespace (empty = all namespaces)
+- `UserID *uint32` — Filter by owner user ID
+
+Example — list only the current user's apps:
+```go
+userID := uint32(ctx.UserID)
+appsResp, err := ai_studio_sdk.ListAppsWithFilters(ctx, 1, 10, &ai_studio_sdk.ListAppsOptions{
+    UserID: &userID,
+})
+if err != nil {
+    return err
+}
+
+for _, app := range appsResp.Apps {
+    log.Printf("My app: %s (namespace: %s)", app.Name, app.Namespace)
+}
+```
+
+Example — list active apps in a namespace:
+```go
+active := true
+appsResp, err := ai_studio_sdk.ListAppsWithFilters(ctx, 1, 20, &ai_studio_sdk.ListAppsOptions{
+    IsActive:  &active,
+    Namespace: "production",
+})
+```
+
+The original `ListApps(ctx, page, limit)` function is still available for backward compatibility and returns all apps without filtering.
+
+### Get App by ID
+
+```go
+func GetApp(ctx context.Context, appID uint32) (*mgmtpb.App, error)
+```
+
+Example:
+```go
+app, err := ai_studio_sdk.GetApp(ctx, 1)
+if err != nil {
+    return err
+}
+
+log.Printf("App: %s - Description: %s", app.Name, app.Description)
+```
+
+### Patch App Metadata
+
+```go
+func PatchAppMetadata(ctx context.Context, appID uint32, key, value string, deleteKey bool) (*mgmtpb.PatchAppMetadataResponse, error)
+```
+
+Atomically updates a single metadata key on an app without requiring a full app update. This is safer than `UpdateAppWithMetadata` for concurrent modifications since it uses database-level transactions with row locking.
+
+**Set a metadata key** (value must be JSON-encoded):
+```go
+resp, err := ai_studio_sdk.PatchAppMetadata(ctx, appID, "cache_enabled", `true`, false)
+if err != nil {
+    return err
+}
+log.Printf("Updated metadata: %s", resp.Metadata) // Full metadata JSON
+```
+
+**Set complex values:**
+```go
+// String value
+ai_studio_sdk.PatchAppMetadata(ctx, appID, "tier", `"premium"`, false)
+
+// Numeric value
+ai_studio_sdk.PatchAppMetadata(ctx, appID, "max_requests", `1000`, false)
+
+// Object value
+ai_studio_sdk.PatchAppMetadata(ctx, appID, "settings", `{"timeout": 30, "retries": 3}`, false)
+```
+
+**Delete a metadata key:**
+```go
+resp, err := ai_studio_sdk.PatchAppMetadata(ctx, appID, "deprecated_field", "", true)
+```
+
+**Via the plugin_sdk interface:**
+```go
+// Returns the full metadata JSON string after the operation
+metadataJSON, err := ctx.Services.Studio().PatchAppMetadata(ctx, appID, "tier", `"premium"`, false)
+```
+
+Requires: `apps.write` scope.
+
+## KV Storage Operations
+
+Requires: `kv.read` or `kv.readwrite` scope
+
+### Write Data
+
+```go
+func WritePluginKV(ctx context.Context, key string, value []byte, expireAt *time.Time) (bool, error)
+```
+
+Returns `true` if created, `false` if updated. Pass `nil` for `expireAt` for no expiration.
+
+Example:
+```go Expandable
+settings := map[string]interface{}{
+    "enabled": true,
+    "rate_limit": 100,
+}
+
+data, _ := json.Marshal(settings)
+created, err := ai_studio_sdk.WritePluginKV(ctx, "settings", data, nil)
+if err != nil {
+    return err
+}
+
+if created {
+    log.Println("Settings created")
+} else {
+    log.Println("Settings updated")
+}
+```
+
+### Write Data with TTL
+
+```go
+func WritePluginKVWithTTL(ctx context.Context, key string, value []byte, ttl time.Duration) (bool, error)
+```
+
+Convenience function that writes data with a relative time-to-live. The entry is automatically expired and cleaned up after the TTL elapses.
+
+Example:
+```go
+// Cache a response for 1 hour
+data, _ := json.Marshal(cachedResponse)
+created, err := ai_studio_sdk.WritePluginKVWithTTL(ctx, "cache:response:123", data, 1*time.Hour)
+if err != nil {
+    return err
+}
+```
+
+Expired keys are automatically cleaned up by the platform. Reads on expired keys return a not-found error.
+
+### Read Data
+
+```go
+func ReadPluginKV(ctx context.Context, key string) ([]byte, error)
+```
+
+Example:
+```go
+data, err := ai_studio_sdk.ReadPluginKV(ctx, "settings")
+if err != nil {
+    return err
+}
+
+var settings map[string]interface{}
+json.Unmarshal(data, &settings)
+
+log.Printf("Settings: %+v", settings)
+```
+
+### Delete Data
+
+```go
+func DeletePluginKV(ctx context.Context, key string) error
+```
+
+Example:
+```go
+err := ai_studio_sdk.DeletePluginKV(ctx, "settings")
+if err != nil {
+    log.Printf("Failed to delete: %v", err)
+}
+```
+
+### List Keys
+
+```go
+func ListPluginKVKeys(ctx context.Context, prefix string) ([]string, error)
+```
+
+Example:
+```go
+keys, err := ai_studio_sdk.ListPluginKVKeys(ctx, "config:")
+if err != nil {
+    return err
+}
+
+for _, key := range keys {
+    log.Printf("Key: %s", key)
+}
+```
+
+## Data Types
+
+### LLMMessage
+
+```go
+type LLMMessage struct {
+    Role    string  // "user", "assistant", "system"
+    Content string  // Message content
+}
+```
+
+### LLMTool (for tool calling)
+
+```go
+type LLMTool struct {
+    Type     string  // "function"
+    Function *LLMToolFunction
+}
+
+type LLMToolFunction struct {
+    Name        string
+    Description string
+    Parameters  map[string]interface{}  // JSON Schema
+}
+```
+
+### Tool
+
+```go
+type Tool struct {
+    Id              uint32
+    Name            string
+    Slug            string
+    Description     string
+    ToolType        string  // "rest", "graphql", "grpc", etc.
+    Operations      []string
+    IsActive        bool
+    PrivacyScore    int32
+}
+```
+
+### Plugin
+
+```go
+type Plugin struct {
+    Id         uint32
+    Name       string
+    Slug       string
+    PluginType string  // "gateway", "ai_studio", "agent"
+    HookType   string  // Hook type
+    IsActive   bool
+    Command    string  // file://, grpc://, oci://
+}
+```
+
+### App
+
+```go
+type App struct {
+    Id          uint32
+    Name        string
+    Description string
+    Llms        []*LLM
+    Tools       []*Tool
+    Datasources []*Datasource
+}
+```
+
+## Error Handling
+
+Service API calls return standard Go errors:
+
+```go
+llmsResp, err := ai_studio_sdk.ListLLMs(ctx, 1, 10)
+if err != nil {
+    log.Printf("Failed to list LLMs: %v", err)
+    return err
+}
+```
+
+Common error types:
+- Permission denied: Missing required scope
+- Not found: Resource doesn't exist
+- Invalid argument: Bad request parameters
+- Unavailable: Service not ready
+
+## Rate Limiting
+
+Service API calls are subject to rate limiting:
+
+- Default: 1000 requests/minute per plugin
+- Configurable via platform settings
+- Implement exponential backoff for retries
+
+Example retry logic:
+
+```go Expandable
+func callWithRetry(ctx context.Context, fn func() error) error {
+    maxRetries := 3
+    backoff := time.Second
+
+    for i := 0; i < maxRetries; i++ {
+        err := fn()
+        if err == nil {
+            return nil
+        }
+
+        if i < maxRetries-1 {
+            time.Sleep(backoff)
+            backoff *= 2
+        }
+    }
+
+    return fmt.Errorf("max retries exceeded")
+}
+```
+
+## Context and Timeouts
+
+Always use contexts with timeouts:
+
+```go
+ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+defer cancel()
+
+llmsResp, err := ai_studio_sdk.ListLLMs(ctx, 1, 10)
+```
+
+## Best Practices
+
+1. **Check SDK Initialization**:
+   ```go
+   if !ai_studio_sdk.IsInitialized() {
+       return fmt.Errorf("SDK not initialized")
+   }
+   ```
+
+2. **Handle Pagination**:
+   ```go Expandable
+   page := int32(1)
+   limit := int32(100)
+
+   for {
+       resp, err := ai_studio_sdk.ListTools(ctx, page, limit)
+       if err != nil {
+           return err
+       }
+
+       // Process tools...
+
+       if len(resp.Tools) < int(limit) {
+           break  // Last page
+       }
+
+       page++
+   }
+   ```
+
+3. **Cache Results**:
+   ```go
+   // Cache LLM list for 5 minutes
+   var cachedLLMs []*mgmtpb.LLM
+   var cacheTime time.Time
+
+   if time.Since(cacheTime) > 5*time.Minute {
+       resp, _ := ai_studio_sdk.ListLLMs(ctx, 1, 100)
+       cachedLLMs = resp.Llms
+       cacheTime = time.Now()
+   }
+   ```
+
+4. **Error Logging**:
+   ```go
+   llmsResp, err := ai_studio_sdk.ListLLMs(ctx, 1, 10)
+   if err != nil {
+       log.Printf("[Plugin %d] Failed to list LLMs: %v", p.pluginID, err)
+       return err
+   }
+   ```
+
+## Scope Requirements Summary
+
+| Operation | Required Scope |
+|-----------|----------------|
+| ListLLMs, GetLLM | `llms.read` |
+| CallLLM | `llms.proxy` |
+| CreateLLM, UpdateLLM | `llms.write` |
+| ListTools, GetTool | `tools.read` |
+| ExecuteTool | `tools.execute` |
+| CreateTool, UpdateTool | `tools.write` |
+| ListApps, ListAppsWithFilters, GetApp | `apps.read` |
+| CreateApp, UpdateApp, PatchAppMetadata | `apps.write` |
+| ListPlugins, GetPlugin | `plugins.read` |
+| ReadPluginKV, ListPluginKVKeys | `kv.read` |
+| WritePluginKV, DeletePluginKV | `kv.readwrite` |
+| ListDatasources, GetDatasource | `datasources.read` |
+| CreateDatasource, UpdateDatasource, DeleteDatasource | `datasources.write` |
+| GenerateEmbedding, StoreDocuments, ProcessAndStoreDocuments | `datasources.embeddings` |
+| QueryDatasource, QueryDatasourceByVector | `datasources.query` |
+| CreateSchedule, GetSchedule, ListSchedules, UpdateSchedule, DeleteSchedule | `scheduler.manage` |
+
+## RAG & Embedding Services
+
+AI Studio provides comprehensive RAG (Retrieval-Augmented Generation) capabilities through the Service API, enabling plugins to build custom document ingestion and semantic search workflows.
+
+### Overview
+
+The RAG Service APIs allow plugins to:
+- Generate embeddings using configured embedders (OpenAI, Ollama, Vertex, etc.)
+- Store pre-computed embeddings with custom chunking strategies
+- Query vector stores with semantic search
+- Build complex ingestion plugins (GitHub, Confluence, custom document processors)
+
+**Key Benefit**: Plugins have **full control** over chunking, embedding generation, and storage - no forced workflows.
+
+### Core RAG APIs
+
+#### GenerateEmbedding
+
+Generate embeddings for text chunks without storing them.
+
+```go Expandable
+resp, err := ai_studio_sdk.GenerateEmbedding(ctx, datasourceID, []string{
+    "First chunk of text",
+    "Second chunk of text",
+    "Third chunk of text",
+})
+
+if err != nil || !resp.Success {
+    return err
+}
+
+// resp.Vectors contains the embedding vectors
+for i, vector := range resp.Vectors {
+    fmt.Printf("Chunk %d embedding dimensions: %d\n", i, len(vector.Values))
+}
+```
+
+**Required Scope**: `datasources.embeddings`
+
+**Use Case**: Custom chunking workflows where you generate embeddings first, then decide what to store.
+
+#### StoreDocuments
+
+Store pre-computed embeddings in the vector store without regenerating them.
+
+```go Expandable
+documents := make([]*mgmtpb.DocumentWithEmbedding, len(chunks))
+for i, chunk := range chunks {
+    documents[i] = &mgmtpb.DocumentWithEmbedding{
+        Content:   chunk,
+        Embedding: preComputedEmbeddings[i],
+        Metadata: map[string]string{
+            "source":      "github",
+            "repo":        "my-repo",
+            "file":        "README.md",
+            "chunk_index": fmt.Sprintf("%d", i),
+        },
+    }
+}
+
+resp, err := ai_studio_sdk.StoreDocuments(ctx, datasourceID, documents)
+if err != nil || !resp.Success {
+    return err
+}
+
+fmt.Printf("Stored %d documents\n", resp.StoredCount)
+```
+
+**Required Scope**: `datasources.embeddings`
+
+**Use Case**: Complete control over embeddings - use custom models, external services, or cached embeddings.
+
+**Supported Vector Stores**:
+- ✅ Pinecone
+- ✅ PGVector
+- ✅ Chroma (v0.2.5+)
+- ✅ Weaviate
+- ⚠️ Qdrant (requires SDK installation)
+- ⚠️ Redis (requires RediSearch configuration)
+
+#### ProcessAndStoreDocuments
+
+Convenience method that generates embeddings and stores in one step.
+
+```go Expandable
+chunks := make([]*mgmtpb.DocumentChunk, len(texts))
+for i, text := range texts {
+    chunks[i] = &mgmtpb.DocumentChunk{
+        Content: text,
+        Metadata: map[string]string{
+            "source": "api",
+            "index":  fmt.Sprintf("%d", i),
+        },
+    }
+}
+
+resp, err := ai_studio_sdk.ProcessAndStoreDocuments(ctx, datasourceID, chunks)
+if err != nil || !resp.Success {
+    return err
+}
+
+fmt.Printf("Processed %d documents\n", resp.ProcessedCount)
+```
+
+**Required Scope**: `datasources.embeddings`
+
+**Use Case**: Simplified workflow when you don't need to inspect or cache embeddings.
+
+#### QueryDatasource
+
+Semantic search using a text query (embedding generated automatically).
+
+```go Expandable
+resp, err := ai_studio_sdk.QueryDatasource(ctx, datasourceID,
+    "How do I configure RAG in AI Studio?",
+    10,   // maxResults
+    0.75, // similarityThreshold
+)
+
+if err != nil || !resp.Success {
+    return err
+}
+
+for _, result := range resp.Results {
+    fmt.Printf("Score: %.2f | Content: %s\n",
+        result.SimilarityScore,
+        result.Content)
+    // Access metadata
+    for k, v := range result.Metadata {
+        fmt.Printf("  %s: %s\n", k, v)
+    }
+}
+```
+
+**Required Scope**: `datasources.query`
+
+**Use Case**: Standard semantic search - plugin provides text, system handles embedding.
+
+#### QueryDatasourceByVector
+
+Semantic search using a pre-computed embedding vector.
+
+```go Expandable
+// Generate query embedding
+queryResp, _ := ai_studio_sdk.GenerateEmbedding(ctx, datasourceID, []string{"search query"})
+queryVector := queryResp.Vectors[0].Values
+
+// Search with the pre-computed vector
+resp, err := ai_studio_sdk.QueryDatasourceByVector(ctx, datasourceID,
+    queryVector,
+    10,   // maxResults
+    0.75, // similarityThreshold
+)
+
+for _, result := range resp.Results {
+    fmt.Printf("Match: %s (score: %.2f)\n", result.Content, result.SimilarityScore)
+}
+```
+
+**Required Scope**: `datasources.query`
+
+**Use Case**: Advanced workflows with custom query embeddings or hybrid search strategies.
+
+**Supported Vector Stores**:
+- ✅ Pinecone
+- ✅ PGVector
+- ✅ Chroma
+- ✅ Weaviate
+- ⚠️ Qdrant (requires SDK)
+- ⚠️ Redis (requires RediSearch)
+
+### Complete Custom Ingestion Example
+
+Building a GitHub repository documentation ingestion plugin:
+
+```go Expandable
+func (p *GitHubDocsPlugin) IngestRepository(ctx plugin_sdk.Context, repo string, datasourceID uint32) error {
+    // Step 1: Fetch markdown files from GitHub
+    files, err := p.fetchMarkdownFiles(repo)
+    if err != nil {
+        return err
+    }
+
+    // Step 2: Custom chunking strategy (semantic chunking by headers)
+    var allChunks []string
+    var allMetadata []map[string]string
+
+    for _, file := range files {
+        chunks := p.semanticChunker(file.Content) // Your custom logic
+        for i, chunk := range chunks {
+            allChunks = append(allChunks, chunk)
+            allMetadata = append(allMetadata, map[string]string{
+                "source":      "github",
+                "repo":        repo,
+                "file":        file.Path,
+                "chunk_index": fmt.Sprintf("%d", i),
+                "updated_at":  file.UpdatedAt,
+            })
+        }
+    }
+
+    // Step 3: Generate embeddings for all chunks
+    embResp, err := ai_studio_sdk.GenerateEmbedding(ctx, datasourceID, allChunks)
+    if err != nil || !embResp.Success {
+        return fmt.Errorf("embedding generation failed: %v", err)
+    }
+
+    // Step 4: Store with pre-computed embeddings
+    documents := make([]*mgmtpb.DocumentWithEmbedding, len(allChunks))
+    for i := range allChunks {
+        documents[i] = &mgmtpb.DocumentWithEmbedding{
+            Content:   allChunks[i],
+            Embedding: embResp.Vectors[i].Values,
+            Metadata:  allMetadata[i],
+        }
+    }
+
+    storeResp, err := ai_studio_sdk.StoreDocuments(ctx, datasourceID, documents)
+    if err != nil || !storeResp.Success {
+        return fmt.Errorf("storage failed: %v", err)
+    }
+
+    ctx.Services.Logger().Info("Successfully ingested repository",
+        "repo", repo,
+        "chunks", storeResp.StoredCount)
+
+    return nil
+}
+```
+
+### Datasource Configuration
+
+For RAG APIs to work, datasources must be configured with:
+
+**Embedder Configuration**:
+- `EmbedVendor`: Embedder provider (`"openai"`, `"ollama"`, `"vertex"`, `"googleai"`)
+- `EmbedModel`: Model name (e.g., `"text-embedding-3-small"` for OpenAI, `"nomic-embed-text"` for Ollama)
+- `EmbedAPIKey`: API key if required by embedder
+- `EmbedUrl`: Embedder endpoint URL
+
+**Vector Store Configuration**:
+- `DBSourceType`: Vector store type (`"pinecone"`, `"chroma"`, `"pgvector"`, `"qdrant"`, `"redis"`, `"weaviate"`)
+- `DBConnString`: Connection URL for vector store
+- `DBConnAPIKey`: API key if required
+- `DBName`: Collection/namespace/table name
+
+**Important**: `EmbedModel` must be the actual model name (e.g., `"text-embedding-3-small"`), NOT the vendor name!
+
+### RAG Workflow Patterns
+
+#### Pattern 1: Separate Generate & Store (Full Control)
+
+```go
+// Generate embeddings
+embeddings, _ := ai_studio_sdk.GenerateEmbedding(ctx, dsID, customChunks)
+
+// Store with pre-computed embeddings (no re-embedding!)
+ai_studio_sdk.StoreDocuments(ctx, dsID, documentsWithEmbeddings)
+```
+
+**Best for**: Custom chunking algorithms, caching embeddings, using external embedding services.
+
+#### Pattern 2: Process & Store (Convenience)
+
+```go
+// Generate and store in one step
+ai_studio_sdk.ProcessAndStoreDocuments(ctx, dsID, chunks)
+```
+
+**Best for**: Simple ingestion when you don't need to inspect or cache embeddings.
+
+#### Pattern 3: Hybrid Search
+
+```go
+// Generate embeddings for multiple query variants
+variants := []string{"original query", "rephrased query", "expanded query"}
+embeddings, _ := ai_studio_sdk.GenerateEmbedding(ctx, dsID, variants)
+
+// Search with each variant and merge results
+allResults := []Result{}
+for _, emb := range embeddings.Vectors {
+    results, _ := ai_studio_sdk.QueryDatasourceByVector(ctx, dsID, emb.Values, 5, 0.7)
+    allResults = append(allResults, results.Results...)
+}
+
+// Deduplicate and rank
+finalResults := deduplicateAndRank(allResults)
+```
+
+**Best for**: Advanced search strategies, query expansion, multi-vector search.
+
+### Datasource Management APIs
+
+For managing datasources programmatically:
+
+```go Expandable
+// List all datasources
+datasources, err := ai_studio_sdk.ListDatasources(ctx, 1, 100, nil, "")
+
+// Get specific datasource
+ds, err := ai_studio_sdk.GetDatasource(ctx, datasourceID)
+
+// Create datasource with full configuration
+ds, err := ai_studio_sdk.CreateDatasourceWithEmbedder(ctx,
+    "My RAG Datasource",
+    "Short description",
+    "Long description",
+    "",                      // URL
+    "http://localhost:8000", // Chroma connection
+    "chroma",                // Vector store type
+    "",                      // DB API key
+    "my-collection",         // Collection name
+    "openai",                // Embedder vendor
+    "https://api.openai.com/v1/embeddings", // Embedder URL
+    "sk-...",                // Embed API key
+    "text-embedding-3-small", // Embed model
+    5, 1, true,
+)
+
+// Update datasource
+ds, err := ai_studio_sdk.UpdateDatasource(ctx, datasourceID, name, ...)
+
+// Delete datasource
+err := ai_studio_sdk.DeleteDatasource(ctx, datasourceID)
+
+// Search datasources
+results, err := ai_studio_sdk.SearchDatasources(ctx, "query")
+```
+
+**Required Scopes**: `datasources.read` (list/get/search), `datasources.write` (create/update/delete)
+
+### Error Handling
+
+```go Expandable
+resp, err := ai_studio_sdk.GenerateEmbedding(ctx, dsID, chunks)
+if err != nil {
+    // gRPC communication error
+    return fmt.Errorf("gRPC error: %w", err)
+}
+
+if !resp.Success {
+    // Server-side validation or processing error
+    ctx.Services.Logger().Error("Embedding generation failed",
+        "error", resp.ErrorMessage,
+        "datasource_id", dsID)
+    return fmt.Errorf("embedding failed: %s", resp.ErrorMessage)
+}
+
+// Success - use resp.Vectors
+```
+
+**Common Errors**:
+- `"datasource does not have embedder configured"` - Set EmbedVendor/EmbedModel/EmbedAPIKey
+- `"datasource does not have vector store configured"` - Set DBSourceType/DBConnString/DBName
+- `"failed to generate embeddings with openai/openai"` - EmbedModel should be model name, not vendor!
+- `"vector store connection failed"` - Ensure vector store is running and accessible
+
+### Advanced Datasource Operations
+
+These operations provide fine-grained control over vector store data through metadata filtering and namespace management.
+
+#### Delete Documents by Metadata
+
+Delete specific documents from vector stores using metadata filters:
+
+```go Expandable
+// Delete all chunks for a specific file
+count, err := ai_studio_sdk.DeleteDocumentsByMetadata(
+    ctx,
+    datasourceID,
+    map[string]string{"file_path": "old-file.md"},
+    "AND",  // filter mode: "AND" or "OR"
+    false,  // dry_run: set true to preview without deleting
+)
+
+// Example with OR mode (delete documents matching any condition)
+count, err := ai_studio_sdk.DeleteDocumentsByMetadata(
+    ctx,
+    datasourceID,
+    map[string]string{
+        "status": "archived",
+        "expired": "true",
+    },
+    "OR",   // Matches documents with status=archived OR expired=true
+    false,
+)
+```
+
+**Parameters:**
+- `metadataFilter`: map of metadata key-value pairs to match
+- `filterMode`: `"AND"` (all conditions must match) or `"OR"` (any condition matches)
+- `dryRun`: if `true`, returns count without deleting
+
+**Returns:** Number of documents deleted (or would be deleted if dry-run)
+
+**Scope Required**: `datasources.write`
+
+#### Query by Metadata Only
+
+Query documents using only metadata filters (no vector similarity):
+
+```go Expandable
+results, totalCount, err := ai_studio_sdk.QueryByMetadataOnly(
+    ctx,
+    datasourceID,
+    map[string]string{"source": "internal-docs"},
+    "AND",
+    10,  // limit
+    0,   // offset
+)
+
+// Process results
+for _, result := range results {
+    fmt.Printf("Content: %s\nMetadata: %v\n", result.Content, result.Metadata)
+}
+fmt.Printf("Total matching documents: %d\n", totalCount)
+```
+
+**Parameters:**
+- `metadataFilter`: metadata key-value pairs to match
+- `filterMode`: `"AND"` or `"OR"`
+- `limit`: max results per page (1-100, default: 10)
+- `offset`: pagination offset
+
+**Returns:** Array of results and total count (for pagination)
+
+**Scope Required**: `datasources.query`
+
+#### List Namespaces
+
+List all namespaces/collections in a vector store:
+
+```go
+namespaces, err := ai_studio_sdk.ListNamespaces(ctx, datasourceID)
+for _, ns := range namespaces {
+    fmt.Printf("Namespace: %s, Documents: %d\n", ns.Name, ns.DocumentCount)
+}
+```
+
+**Returns:** Array of namespace info with document counts
+
+**Scope Required**: `datasources.read`
+
+**Note:** Document count may be `-1` if not supported by the vector store.
+
+#### Delete Namespace
+
+Delete an entire namespace/collection (bulk operation):
+
+```go
+// Requires confirm=true for safety
+err := ai_studio_sdk.DeleteNamespace(ctx, datasourceID, "old-namespace", true)
+```
+
+**Parameters:**
+- `namespace`: namespace/collection name to delete
+- `confirm`: must be `true` to proceed (safety check)
+
+**Scope Required**: `datasources.write`
+
+**Warning:** This is a destructive operation that deletes all documents in the namespace. Use with caution.
+
+**Supported Vector Stores:**
+- ✅ Full support: Chroma, PGVector, Pinecone, Weaviate
+- ⚠️ Limited: Redis (delete/query by metadata not fully supported)
+- ⚠️ Partial: Qdrant (namespace management only)
+
+## Schedule Management
+
+**Scope Required**: `scheduler.manage`
+**Available in**: AI Studio only
+
+Plugins can programmatically manage their scheduled tasks using the Schedule Management API. This complements manifest-based schedule declarations.
+
+### Overview
+
+Schedules can be created in two ways:
+1. **Manifest Schedules**: Declared in `plugin.manifest.json`, auto-registered when plugin loads
+2. **API Schedules**: Created programmatically via SDK during `Initialize()` or at runtime
+
+Both types execute via the `ExecuteScheduledTask()` capability method.
+
+### CreateSchedule
+
+Create a new schedule for your plugin:
+
+```go
+schedule, err := ai_studio_sdk.CreateSchedule(
+    ctx,
+    "hourly-sync",              // Schedule ID (unique per plugin)
+    "Hourly Data Sync",         // Human-readable name
+    "0 * * * *",                // Cron expression (5-field format)
+    "UTC",                      // Timezone
+    120,                        // Timeout in seconds
+    map[string]interface{}{     // Config passed to ExecuteScheduledTask
+        "batch_size": 100,
+    },
+    true,                       // Enabled
+)
+```
+
+**Returns**: `*mgmtpb.ScheduleInfo` with schedule details
+**Errors**: `AlreadyExists` if schedule_id already exists for this plugin
+
+### GetSchedule
+
+Retrieve schedule details by manifest schedule ID:
+
+```go
+schedule, err := ai_studio_sdk.GetSchedule(ctx, "hourly-sync")
+```
+
+**Returns**: `*mgmtpb.ScheduleInfo`
+**Errors**: `NotFound` if schedule doesn't exist
+
+### ListSchedules
+
+Get all schedules for your plugin:
+
+```go
+schedules, err := ai_studio_sdk.ListSchedules(ctx)
+```
+
+**Returns**: `[]*mgmtpb.ScheduleInfo` array
+
+### UpdateSchedule
+
+Update schedule fields (all fields optional):
+
+```go
+enabled := false
+timeout := int32(180)
+
+schedule, err := ai_studio_sdk.UpdateSchedule(ctx, "hourly-sync", ai_studio_sdk.UpdateScheduleOptions{
+    Name:           stringPtr("Updated Sync Task"),
+    CronExpr:       stringPtr("30 * * * *"),  // Every hour at :30
+    Timezone:       stringPtr("America/New_York"),
+    TimeoutSeconds: &timeout,
+    Enabled:        &enabled,
+    Config: map[string]interface{}{
+        "batch_size": 200,
+    },
+})
+```
+
+**Returns**: `*mgmtpb.ScheduleInfo` with updated schedule
+**Errors**: `NotFound` if schedule doesn't exist
+
+### DeleteSchedule
+
+Remove a schedule:
+
+```go
+err := ai_studio_sdk.DeleteSchedule(ctx, "hourly-sync")
+```
+
+**Errors**: `NotFound` if schedule doesn't exist
+
+### Complete Example
+
+```go Expandable
+package main
+
+import (
+    "context"
+    "github.com/TykTechnologies/midsommar/v2/pkg/ai_studio_sdk"
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+)
+
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+// Initialize creates API-managed schedules
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    if ctx.Runtime != plugin_sdk.RuntimeStudio {
+        return nil
+    }
+
+    apiCtx := context.Background()
+
+    // Check if schedule exists (idempotent)
+    if _, err := ai_studio_sdk.GetSchedule(apiCtx, "data-refresh"); err != nil {
+        // Create new schedule
+        _, err := ai_studio_sdk.CreateSchedule(
+            apiCtx,
+            "data-refresh",
+            "Refresh External Data",
+            "*/15 * * * *",  // Every 15 minutes
+            "UTC",
+            300,  // 5 minute timeout
+            map[string]interface{}{
+                "api_endpoint": "https://api.example.com/data",
+            },
+            true,
+        )
+        if err != nil {
+            return fmt.Errorf("failed to create schedule: %w", err)
+        }
+    }
+
+    return nil
+}
+
+// ExecuteScheduledTask handles all scheduled executions
+func (p *MyPlugin) ExecuteScheduledTask(ctx plugin_sdk.Context, schedule *plugin_sdk.Schedule) error {
+    switch schedule.ID {
+    case "data-refresh":
+        return p.refreshData(ctx, schedule)
+    default:
+        return fmt.Errorf("unknown schedule: %s", schedule.ID)
+    }
+}
+
+func (p *MyPlugin) refreshData(ctx plugin_sdk.Context, schedule *plugin_sdk.Schedule) error {
+    // Access config from schedule
+    endpoint := schedule.Config["api_endpoint"].(string)
+
+    // Perform sync logic...
+    ctx.Services.Logger().Info("Refreshing data", "endpoint", endpoint)
+
+    return nil
+}
+```
+
+### Manifest vs API Schedules
+
+**Use Manifest When**:
+- Schedule is core to plugin functionality
+- Configuration is static
+- Want schedules registered automatically
+
+**Use API When**:
+- Schedules are dynamic (based on external data)
+- Need runtime modification
+- Want conditional schedule creation
+- Building schedule management UI
+
+**Example**: Plugin manifest declares one immutable daily report, creates hourly syncs via API based on configured data sources.
+
+## Best Practices Summary
+
+1. **Connection Warmup**: Implement `SessionAware` and warm up Service API in `OnSessionReady` - this is critical for reliable API access
+2. **Runtime Detection**: Always check `ctx.Runtime` before calling runtime-specific services
+3. **Type Assertions**: Gateway and Studio services return `interface{}`, type assert to correct response types
+4. **Error Handling**: Always check errors from Service API calls
+5. **Logging**: Use `ctx.Services.Logger()` for consistent structured logging
+6. **KV Storage**: Understand storage differences between Studio (durable) and Gateway (ephemeral)
+7. **Shared Connections**: Event Service and Management Service API share the same broker connection - one warmup establishes both
+8. **Context Timeouts**: Use context timeouts for external calls
+9. **Caching**: Cache frequently accessed data in KV storage to reduce API calls
+
+## Complete Examples
+
+For complete working examples of Service API usage:
+- **Studio**: `examples/plugins/studio/service-api-test/` - Comprehensive Studio Services testing
+- **Gateway**: `examples/plugins/gateway/gateway-service-test/` - Gateway Services examples
+- **Rate Limiter**: `examples/plugins/studio/llm-rate-limiter-multiphase/` - Multi-capability plugin with KV storage
+- **Scheduler**: `examples/plugins/studio/scheduler-demo/` - Scheduled tasks with manifest and API patterns
diff --git a/ai-management/ai-studio/plugins/studio-agent.mdx b/ai-management/ai-studio/plugins/studio-agent.mdx
new file mode 100644
index 0000000000..1b81a6d40b
--- /dev/null
+++ b/ai-management/ai-studio/plugins/studio-agent.mdx
@@ -0,0 +1,1206 @@
+---
+title: "AI Studio Agent Plugins"
+description: "Learn how to build conversational AI experiences in the Chat Interface using Agent plugins, which can wrap LLMs, add custom logic, and integrate external services."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "AI Studio Agent"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+> **Experimental Feature**: Agent plugins are currently experimental. The API and behavior may change in future releases.
+
+```mermaid
+graph TD
+    A[Chat Interface] --> B[Agent Plugin]
+    B --> C[LLM]
+    B --> D[Custom Logic/Tools]
+```
+
+AI Studio Agent plugins enable conversational AI experiences in the Chat Interface using the **Unified Plugin SDK**. Build custom agents that wrap LLMs, add specialized logic, integrate external services, and create sophisticated multi-turn conversations with streaming responses.
+
+Agent plugins use the same `pkg/plugin_sdk` as other plugin types, automatically detecting the Studio runtime and providing access to Studio Services (LLM calls, tool execution, datasource queries).
+
+## Architecture Overview
+
+Agent plugins follow a **three-tier binding model**:
+
+```mermaid
+flowchart LR
+    subgraph "AGENT ARCHITECTURE"
+        direction LR
+        Plugin["Plugin<br/>(gRPC)<br/><br/>Implements<br/>HandleAgentMessage<br/>for conversations"]
+        Agent["Agent Object<br/>(AgentConfig)<br/><br/>Binds plugin<br/>to an App with:<br/>- Name & slug<br/>- Config<br/>- Group access<br/>- Active state"]
+        App["App Object<br/><br/>Provides<br/>- LLM access<br/>- Tools<br/>- Datasources<br/>- Credentials<br/>- Budget control"]
+        
+        Plugin --> Agent
+        Agent --> App
+    end
+```
+
+### Key Concepts
+
+| Component | Purpose |
+|-----------|---------|
+| **Plugin** | Long-running gRPC plugin implementing `AgentPlugin` interface |
+| **Agent Object** | Configuration binding a plugin to an App, with access controls |
+| **App Object** | Resource container providing LLMs, tools, datasources, and credentials |
+
+**Important points:**
+
+1. **Plugins are reusable**: A single plugin can power multiple Agent Objects
+2. **Apps provide resources**: The App determines which LLMs the agent can call
+3. **Access via Groups**: Users access agents based on group membership
+4. **Budget enforcement**: LLM calls are routed through the proxy, enforcing budgets
+5. **Portal integration**: Active agents appear in the **Chat** section of the AI Portal alongside managed chats
+
+## Overview
+
+Agent plugins enable you to:
+
+- **Stream Responses**: Real-time server-streaming for interactive conversations
+- **Call LLMs**: Access managed LLMs via Context Services or direct SDK calls
+- **Execute Tools**: Run registered tools and integrate external services
+- **Query Datasources**: Access configured datasources for RAG and context
+- **Maintain Context**: Access full conversation history
+- **Custom Configuration**: Per-agent config with JSON schema validation
+- **Universal Services**: KV storage and logging via Context.Services
+
+## Unified SDK Integration
+
+Agent plugins use the **Unified Plugin SDK** (`pkg/plugin_sdk`), just like all other plugin types. Key patterns:
+
+### Import and Structure
+
+```go
+import "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+
+type MyAgentPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+func NewMyAgentPlugin() *MyAgentPlugin {
+    return &MyAgentPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "my-agent", "1.0.0", "Description",
+        ),
+    }
+}
+```
+
+### Lifecycle Methods
+
+```go Expandable
+// Initialize - called when plugin starts
+func (p *MyAgentPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    // Extract broker ID for Service API calls
+    if brokerIDStr, ok := config["_service_broker_id"]; ok {
+        var brokerID uint32
+        fmt.Sscanf(brokerIDStr, "%d", &brokerID)
+        ai_studio_sdk.SetServiceBrokerID(brokerID)
+    }
+    return nil
+}
+
+// Shutdown - called when plugin stops
+func (p *MyAgentPlugin) Shutdown(ctx plugin_sdk.Context) error {
+    return nil
+}
+```
+
+### Agent Capability
+
+Implement the `AgentPlugin` capability:
+
+```go Expandable
+// HandleAgentMessage processes incoming messages and streams responses
+func (p *MyAgentPlugin) HandleAgentMessage(
+    req *pb.AgentMessageRequest,
+    stream pb.PluginService_HandleAgentMessageServer) error {
+
+    // Stream chunks to user
+    stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_CONTENT,
+        Content: "Hello!",
+        IsFinal: false,
+    })
+
+    stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_DONE,
+        IsFinal: true,
+    })
+
+    return nil
+}
+```
+
+### Serving the Plugin
+
+```go
+func main() {
+    plugin_sdk.Serve(NewMyAgentPlugin())
+}
+```
+
+### Service API Access
+
+Agent plugins can call LLMs, execute tools, and query datasources via the `ai_studio_sdk` helper functions (requires broker ID):
+
+```go
+// Call LLM
+llmStream, err := ai_studio_sdk.CallLLM(
+    ctx, llmID, model, messages, temperature, maxTokens, tools, stream,
+)
+
+// Execute tool
+result, err := ai_studio_sdk.ExecuteTool(ctx, toolID, operation, params)
+
+// Query datasource
+result, err := ai_studio_sdk.QueryDatasource(ctx, dsID, query)
+```
+
+## Quick Start
+
+### 1. Project Structure
+
+```
+my-agent-plugin/
+├── server/
+│   ├── main.go                # Plugin server
+│   ├── plugin.manifest.json   # Plugin manifest
+│   └── config.schema.json     # Configuration schema
+└── go.mod
+```
+
+### 2. Create Manifest
+
+[server/plugin.manifest.json](https://github.com/TykTechnologies/ai-studio/blob/main/examples/plugins/studio/echo-agent/server/plugin.manifest.json):
+
+```json Expandable
+{
+  "id": "com.example.my-agent",
+  "name": "My Agent",
+  "version": "1.0.0",
+  "plugin_type": "agent",
+  "description": "Custom conversational agent",
+  "permissions": {
+    "services": [
+      "llms.proxy",
+      "tools.execute",
+      "datasources.query"
+    ]
+  },
+  "ui": {
+    "slots": []
+  }
+}
+```
+
+### 3. Implement Agent Plugin
+
+[server/main.go](https://github.com/TykTechnologies/ai-studio/blob/main/examples/plugins/studio/echo-agent/server/main.go):
+
+```go Expandable
+package main
+
+import (
+    _ "embed"
+    "fmt"
+    "io"
+    "log"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/ai_studio_sdk"
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+    mgmt "github.com/TykTechnologies/midsommar/v2/proto/ai_studio_management"
+)
+
+//go:embed plugin.manifest.json
+var manifestFile []byte
+
+//go:embed config.schema.json
+var configSchemaFile []byte
+
+type MyAgent struct {
+    plugin_sdk.BasePlugin
+}
+
+func NewMyAgent() *MyAgent {
+    return &MyAgent{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "my-agent",
+            "1.0.0",
+            "Custom conversational agent",
+        ),
+    }
+}
+
+// Initialize is called when plugin starts
+func (p *MyAgent) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    log.Printf("My Agent initializing")
+
+    // Extract broker ID for Service API access
+    brokerIDStr := ""
+    if id, ok := config["_service_broker_id"]; ok {
+        brokerIDStr = id
+    } else if id, ok := config["service_broker_id"]; ok {
+        brokerIDStr = id
+    }
+
+    if brokerIDStr != "" {
+        var brokerID uint32
+        fmt.Sscanf(brokerIDStr, "%d", &brokerID)
+        ai_studio_sdk.SetServiceBrokerID(brokerID)
+        log.Printf("My Agent: Set broker ID %d for Service API", brokerID)
+    }
+
+    return nil
+}
+
+// Shutdown is called when plugin stops
+func (p *MyAgent) Shutdown(ctx plugin_sdk.Context) error {
+    log.Printf("My Agent shutting down")
+    return nil
+}
+
+// GetManifest returns the plugin manifest
+func (p *MyAgent) GetManifest() ([]byte, error) {
+    return manifestFile, nil
+}
+
+// GetConfigSchema returns the configuration schema
+func (p *MyAgent) GetConfigSchema() ([]byte, error) {
+    return configSchemaFile, nil
+}
+
+// HandleAgentMessage processes incoming messages and streams responses
+func (p *MyAgent) HandleAgentMessage(
+    req *pb.AgentMessageRequest,
+    stream pb.PluginService_HandleAgentMessageServer) error {
+
+    log.Printf("Received message: %s", req.UserMessage)
+
+    // Select LLM (use first available or configured default)
+    var selectedLLM *pb.AgentLLMInfo
+    if len(req.AvailableLlms) > 0 {
+        selectedLLM = req.AvailableLlms[0]
+    }
+
+    if selectedLLM == nil {
+        return stream.Send(&pb.AgentMessageChunk{
+            Type:    pb.AgentMessageChunk_ERROR,
+            Content: "No LLM available",
+            IsFinal: true,
+        })
+    }
+
+    // Build messages from history + current message
+    messages := buildMessages(req.History, req.UserMessage)
+
+    // Call LLM via SDK
+    llmStream, err := ai_studio_sdk.CallLLM(
+        stream.Context(),
+        selectedLLM.Id,
+        selectedLLM.DefaultModel,
+        messages,
+        0.7,  // temperature
+        1000, // max tokens
+        nil,  // tools
+        false, // non-streaming
+    )
+    if err != nil {
+        return stream.Send(&pb.AgentMessageChunk{
+            Type:    pb.AgentMessageChunk_ERROR,
+            Content: fmt.Sprintf("Failed to call LLM: %v", err),
+            IsFinal: true,
+        })
+    }
+
+    // Receive and forward response
+    var llmContent string
+    for {
+        resp, err := llmStream.Recv()
+        if err == io.EOF {
+            break
+        }
+        if err != nil {
+            return stream.Send(&pb.AgentMessageChunk{
+                Type:    pb.AgentMessageChunk_ERROR,
+                Content: fmt.Sprintf("Error receiving response: %v", err),
+                IsFinal: true,
+            })
+        }
+
+        if !resp.Success {
+            return stream.Send(&pb.AgentMessageChunk{
+                Type:    pb.AgentMessageChunk_ERROR,
+                Content: fmt.Sprintf("LLM error: %s", resp.ErrorMessage),
+                IsFinal: true,
+            })
+        }
+
+        llmContent += resp.Content
+
+        if resp.Done {
+            break
+        }
+    }
+
+    // Send content chunk
+    if err := stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_CONTENT,
+        Content: llmContent,
+        IsFinal: false,
+    }); err != nil {
+        return err
+    }
+
+    // Send done chunk
+    return stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_DONE,
+        Content: "completed",
+        IsFinal: true,
+    })
+}
+
+func buildMessages(history []*pb.AgentConversationMessage, userMessage string) []*mgmt.LLMMessage {
+    messages := make([]*mgmt.LLMMessage, 0, len(history)+1)
+
+    // Add history
+    for _, msg := range history {
+        messages = append(messages, &mgmt.LLMMessage{
+            Role:    msg.Role,
+            Content: msg.Content,
+        })
+    }
+
+    // Add current message
+    messages = append(messages, &mgmt.LLMMessage{
+        Role:    "user",
+        Content: userMessage,
+    })
+
+    return messages
+}
+
+func main() {
+    log.Printf("Starting My Agent")
+    plugin_sdk.Serve(NewMyAgent())
+}
+```
+
+### 4. Build and Deploy
+
+```bash Expandable
+# Build plugin
+go build -o my-agent main.go
+
+# Create plugin in AI Studio
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{
+    "name": "My Agent",
+    "slug": "my-agent",
+    "command": "file:///path/to/my-agent",
+    "hook_type": "agent",
+    "plugin_type": "agent",
+    "is_active": true
+  }'
+```
+
+### 5. Create Agent Object
+
+Create an Agent Object that binds the plugin to an App:
+
+**Prerequisites:**
+- An active plugin with `hook_type: agent`
+- An App with at least one LLM assigned, active credential, and optionally tools and datasources
+
+```bash Expandable
+curl -X POST http://localhost:3000/api/v1/agents \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "My Custom Agent",
+    "description": "An agent that helps with specific tasks",
+    "plugin_id": 1,
+    "app_id": 1,
+    "config": {
+      "system_prompt": "You are a helpful assistant",
+      "temperature": 0.7
+    },
+    "group_ids": [1, 2],
+    "is_active": true
+  }'
+```
+
+**Agent Object Fields:**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `name` | `string` | Display name for the agent |
+| `description` | `string` | Description shown to users |
+| `plugin_id` | `uint` | ID of the agent plugin to use |
+| `app_id` | `uint` | ID of the App providing resources |
+| `config` | `object` | Plugin-specific configuration (passed as `ConfigJson`) |
+| `group_ids` | `[]uint` | Groups that can access this agent (empty = public) |
+| `is_active` | `bool` | Whether the agent is available to users |
+| `namespace` | `string` | Optional namespace for multi-tenant deployments |
+
+### 6. Use in Chat Interface
+
+Active agents appear in the **Chat** section of the AI Portal alongside managed chats. Users see agents they have access to based on group membership.
+
+**SSE Communication Flow:**
+
+1. **Establish SSE connection**:
+   ```
+   GET /api/agents/{id}/stream?token=...
+   ```
+
+2. **Receive session info** (first message):
+   ```json
+   {
+     "session_id": "agent-1-123",
+     "agent_id": 1,
+     "agent_name": "My Agent",
+     "available_llms": 3,
+     "available_tools": 2,
+     "available_datasources": 1
+   }
+   ```
+
+3. **Send messages** via POST:
+   ```bash
+   curl -X POST "http://localhost:3000/api/agents/1/message?session_id=agent-1-123" \
+     -H "Authorization: Bearer $TOKEN" \
+     -H "Content-Type: application/json" \
+     -d '{
+       "message": "Hello, can you help me?",
+       "history": []
+     }'
+   ```
+
+4. **Receive streaming response** via SSE:
+   ```
+   event: content
+   data: {"type":"CONTENT","content":"Hello! How can I help?","is_final":false}
+
+   event: done
+   data: {"type":"DONE","content":"completed","is_final":true}
+   ```
+
+## Agent Message Request
+
+The `AgentMessageRequest` provides rich context for your agent:
+
+```go
+type AgentMessageRequest struct {
+    SessionId            string                       // Unique session ID
+    UserMessage          string                       // Current user message
+    AvailableTools       []*AgentToolInfo             // Tools agent can use
+    AvailableDatasources []*AgentDatasourceInfo       // Datasources available
+    AvailableLlms        []*AgentLLMInfo              // LLMs available
+    ConfigJson           string                       // Agent configuration (JSON)
+    History              []*AgentConversationMessage  // Conversation history
+    Context              *PluginContext               // Request context
+}
+```
+
+### Available Tools
+
+```go
+for _, tool := range req.AvailableTools {
+    log.Printf("Tool: %s (%s) - %s", tool.Name, tool.Slug, tool.Description)
+}
+```
+
+### Available Datasources
+
+```go
+for _, ds := range req.AvailableDatasources {
+    log.Printf("Datasource: %s (%s) - %s", ds.Name, ds.DbSourceType, ds.Description)
+}
+```
+
+### Available LLMs
+
+```go
+for _, llm := range req.AvailableLlms {
+    log.Printf("LLM: %s - %s %s", llm.Name, llm.Vendor, llm.DefaultModel)
+}
+```
+
+### Configuration
+
+Parse custom configuration from JSON:
+
+```go
+type Config struct {
+    SystemPrompt string  `json:"system_prompt"`
+    Temperature  float64 `json:"temperature"`
+    MaxTokens    int     `json:"max_tokens"`
+}
+
+var config Config
+if req.ConfigJson != "" {
+    if err := json.Unmarshal([]byte(req.ConfigJson), &config); err == nil {
+        log.Printf("Using config: system_prompt=%s, temp=%.2f",
+            config.SystemPrompt, config.Temperature)
+    }
+}
+```
+
+### Conversation History
+
+```go
+log.Printf("Conversation has %d messages", len(req.History))
+for i, msg := range req.History {
+    log.Printf("  [%d] %s: %s", i, msg.Role, msg.Content)
+}
+```
+
+## Streaming Responses
+
+Agent plugins use server-streaming gRPC to send real-time responses:
+
+### Chunk Types
+
+```go
+const (
+    CONTENT     = "CONTENT"      // Response content
+    TOOL_CALL   = "TOOL_CALL"    // Tool is being called
+    TOOL_RESULT = "TOOL_RESULT"  // Tool result
+    THINKING    = "THINKING"     // Agent reasoning
+    ERROR       = "ERROR"        // Error occurred
+    DONE        = "DONE"         // Response complete
+)
+```
+
+### Send Content
+
+```go
+stream.Send(&pb.AgentMessageChunk{
+    Type:    pb.AgentMessageChunk_CONTENT,
+    Content: "Here is my response...",
+    IsFinal: false,
+})
+```
+
+### Send Thinking
+
+```go
+stream.Send(&pb.AgentMessageChunk{
+    Type:    pb.AgentMessageChunk_THINKING,
+    Content: "Analyzing the question...",
+    IsFinal: false,
+})
+```
+
+### Send Tool Call
+
+```go
+metadata := map[string]interface{}{
+    "tool_name":  "weather_api",
+    "operation":  "get_forecast",
+    "parameters": map[string]string{"city": "San Francisco"},
+}
+metadataJSON, _ := json.Marshal(metadata)
+
+stream.Send(&pb.AgentMessageChunk{
+    Type:         pb.AgentMessageChunk_TOOL_CALL,
+    Content:      "Calling weather API...",
+    MetadataJson: string(metadataJSON),
+    IsFinal:      false,
+})
+```
+
+### Send Error
+
+```go
+stream.Send(&pb.AgentMessageChunk{
+    Type:    pb.AgentMessageChunk_ERROR,
+    Content: "Failed to process request: invalid input",
+    IsFinal: true,
+})
+```
+
+### Send Done
+
+```go
+stream.Send(&pb.AgentMessageChunk{
+    Type:    pb.AgentMessageChunk_DONE,
+    Content: "completed",
+    IsFinal: true, // Always set IsFinal=true for DONE
+})
+```
+
+## Complete Example: Echo Agent
+
+A simple agent that wraps LLM responses with custom formatting:
+
+```go Expandable
+package main
+
+import (
+    _ "embed"
+    "encoding/json"
+    "fmt"
+    "io"
+    "log"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/ai_studio_sdk"
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+    mgmt "github.com/TykTechnologies/midsommar/v2/proto/ai_studio_management"
+)
+
+//go:embed plugin.manifest.json
+var manifestFile []byte
+
+//go:embed config.schema.json
+var configSchemaFile []byte
+
+type EchoAgentPlugin struct {
+    plugin_sdk.BasePlugin
+    prefix          string
+    suffix          string
+    includeMetadata bool
+}
+
+type Config struct {
+    Prefix          string `json:"prefix"`
+    Suffix          string `json:"suffix"`
+    IncludeMetadata bool   `json:"include_metadata"`
+}
+
+func NewEchoAgentPlugin() *EchoAgentPlugin {
+    return &EchoAgentPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "echo-agent",
+            "1.0.0",
+            "Wraps LLM responses with prefix/suffix",
+        ),
+        prefix:          "<<",
+        suffix:          ">>",
+        includeMetadata: false,
+    }
+}
+
+func (p *EchoAgentPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    log.Printf("EchoAgent: Initialize called")
+
+    // Extract broker ID for Service API access
+    brokerIDStr := ""
+    if id, ok := config["_service_broker_id"]; ok {
+        brokerIDStr = id
+    } else if id, ok := config["service_broker_id"]; ok {
+        brokerIDStr = id
+    }
+
+    if brokerIDStr != "" {
+        var brokerID uint32
+        fmt.Sscanf(brokerIDStr, "%d", &brokerID)
+        ai_studio_sdk.SetServiceBrokerID(brokerID)
+        log.Printf("EchoAgent: Set broker ID %d for Service API", brokerID)
+    }
+
+    log.Println("✅ EchoAgent: Initialized successfully")
+    return nil
+}
+
+func (p *EchoAgentPlugin) Shutdown(ctx plugin_sdk.Context) error {
+    log.Println("EchoAgent: Shutdown called")
+    return nil
+}
+
+func (p *EchoAgentPlugin) GetManifest() ([]byte, error) {
+    return manifestFile, nil
+}
+
+func (p *EchoAgentPlugin) GetConfigSchema() ([]byte, error) {
+    return configSchemaFile, nil
+}
+
+func (p *EchoAgentPlugin) HandleAgentMessage(
+    req *pb.AgentMessageRequest,
+    stream pb.PluginService_HandleAgentMessageServer) error {
+
+    log.Printf("EchoAgent: Received message: %s", req.UserMessage)
+
+    // Parse config from request if present
+    if req.ConfigJson != "" {
+        var config Config
+        if err := json.Unmarshal([]byte(req.ConfigJson), &config); err == nil {
+            if config.Prefix != "" {
+                p.prefix = config.Prefix
+            }
+            if config.Suffix != "" {
+                p.suffix = config.Suffix
+            }
+            p.includeMetadata = config.IncludeMetadata
+            log.Printf("EchoAgent: Using custom config - prefix: %s, suffix: %s",
+                p.prefix, p.suffix)
+        }
+    }
+
+    // Select LLM to use
+    var selectedLLM *pb.AgentLLMInfo
+    if len(req.AvailableLlms) > 0 {
+        selectedLLM = req.AvailableLlms[0]
+    }
+
+    // Fall back to echo mode if no LLM available
+    if selectedLLM == nil {
+        log.Println("EchoAgent: No LLM available, using echo mode")
+        return p.echoMode(req.UserMessage, stream)
+    }
+
+    log.Printf("EchoAgent: Using LLM: %s (ID: %d, Vendor: %s, Model: %s)",
+        selectedLLM.Name, selectedLLM.Id, selectedLLM.Vendor, selectedLLM.DefaultModel)
+
+    // Call LLM via SDK
+    return p.callLLM(req, selectedLLM, stream)
+}
+
+// echoMode is the fallback mode that just echoes the message
+func (p *EchoAgentPlugin) echoMode(userMessage string, stream pb.PluginService_HandleAgentMessageServer) error {
+    wrappedContent := fmt.Sprintf("%s %s %s", p.prefix, userMessage, p.suffix)
+    log.Printf("EchoAgent: Sending wrapped echo response: %s", wrappedContent)
+
+    // Send content chunk
+    if err := stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_CONTENT,
+        Content: wrappedContent,
+        IsFinal: false,
+    }); err != nil {
+        return err
+    }
+
+    // Send done chunk
+    return stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_DONE,
+        Content: "completed",
+        IsFinal: true,
+    })
+}
+
+// callLLM calls the LLM via SDK and streams back the wrapped response
+func (p *EchoAgentPlugin) callLLM(
+    req *pb.AgentMessageRequest,
+    llm *pb.AgentLLMInfo,
+    stream pb.PluginService_HandleAgentMessageServer) error {
+
+    ctx := stream.Context()
+
+    // Build LLM messages from history + current message
+    messages := []*mgmt.LLMMessage{}
+
+    // Add history
+    for _, histMsg := range req.History {
+        messages = append(messages, &mgmt.LLMMessage{
+            Role:    histMsg.Role,
+            Content: histMsg.Content,
+        })
+    }
+
+    // Add current user message
+    messages = append(messages, &mgmt.LLMMessage{
+        Role:    "user",
+        Content: req.UserMessage,
+    })
+
+    log.Printf("EchoAgent: Calling LLM %d with %d messages via SDK", llm.Id, len(messages))
+
+    // Use SDK's CallLLM helper
+    llmStream, err := ai_studio_sdk.CallLLM(
+        ctx,
+        llm.Id,
+        llm.DefaultModel,
+        messages,
+        0.7,  // temperature
+        1000, // max tokens
+        nil,  // no tools
+        false, // non-streaming
+    )
+    if err != nil {
+        log.Printf("EchoAgent: Failed to call LLM via SDK: %v", err)
+        return stream.Send(&pb.AgentMessageChunk{
+            Type:    pb.AgentMessageChunk_ERROR,
+            Content: fmt.Sprintf("Failed to call LLM: %v", err),
+            IsFinal: true,
+        })
+    }
+
+    // Receive response from LLM
+    var llmContent string
+    for {
+        resp, err := llmStream.Recv()
+        if err == io.EOF {
+            break
+        }
+        if err != nil {
+            log.Printf("EchoAgent: Error receiving from LLM: %v", err)
+            return stream.Send(&pb.AgentMessageChunk{
+                Type:    pb.AgentMessageChunk_ERROR,
+                Content: fmt.Sprintf("Error receiving LLM response: %v", err),
+                IsFinal: true,
+            })
+        }
+
+        if !resp.Success {
+            log.Printf("EchoAgent: LLM returned error: %s", resp.ErrorMessage)
+            return stream.Send(&pb.AgentMessageChunk{
+                Type:    pb.AgentMessageChunk_ERROR,
+                Content: fmt.Sprintf("LLM error: %s", resp.ErrorMessage),
+                IsFinal: true,
+            })
+        }
+
+        llmContent += resp.Content
+
+        if resp.Done {
+            break
+        }
+    }
+
+    log.Printf("EchoAgent: Received LLM response (%d chars)", len(llmContent))
+
+    // Wrap LLM response with prefix/suffix
+    wrappedContent := fmt.Sprintf("%s %s %s", p.prefix, llmContent, p.suffix)
+
+    // Send wrapped content
+    if err := stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_CONTENT,
+        Content: wrappedContent,
+        IsFinal: false,
+    }); err != nil {
+        return err
+    }
+
+    // Optionally include metadata
+    if p.includeMetadata {
+        metadata := map[string]interface{}{
+            "llm_id":    llm.Id,
+            "llm_name":  llm.Name,
+            "llm_model": llm.DefaultModel,
+            "tokens":    len(llmContent),
+        }
+        metadataJSON, _ := json.Marshal(metadata)
+
+        stream.Send(&pb.AgentMessageChunk{
+            Type:         pb.AgentMessageChunk_CONTENT,
+            Content:      fmt.Sprintf("\n\n---\nMetadata: %s", string(metadataJSON)),
+            MetadataJson: string(metadataJSON),
+            IsFinal:      false,
+        })
+    }
+
+    // Send done chunk
+    return stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_DONE,
+        Content: "completed",
+        IsFinal: true,
+    })
+}
+
+func main() {
+    log.Printf("🤖 Starting Echo Agent Plugin")
+    plugin_sdk.Serve(NewEchoAgentPlugin())
+}
+```
+
+### Configuration Schema
+
+[config.schema.json](https://github.com/TykTechnologies/ai-studio/blob/main/examples/plugins/studio/echo-agent/server/config.schema.json):
+
+```json Expandable
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "title": "Echo Agent Configuration",
+  "properties": {
+    "prefix": {
+      "type": "string",
+      "description": "Prefix to add before LLM response",
+      "default": "<<"
+    },
+    "suffix": {
+      "type": "string",
+      "description": "Suffix to add after LLM response",
+      "default": ">>"
+    },
+    "include_metadata": {
+      "type": "boolean",
+      "description": "Include metadata in response",
+      "default": false
+    }
+  }
+}
+```
+
+## Advanced Patterns
+
+### Multi-Step Reasoning
+
+```go Expandable
+func (p *MyAgent) HandleAgentMessage(
+    req *pb.AgentMessageRequest,
+    stream pb.PluginService_HandleAgentMessageServer) error {
+
+    // Step 1: Think
+    stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_THINKING,
+        Content: "Analyzing the question...",
+        IsFinal: false,
+    })
+
+    // Step 2: Search datasource
+    stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_TOOL_CALL,
+        Content: "Searching knowledge base...",
+        IsFinal: false,
+    })
+
+    searchResults := p.searchKnowledgeBase(req.UserMessage)
+
+    stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_TOOL_RESULT,
+        Content: fmt.Sprintf("Found %d results", len(searchResults)),
+        IsFinal: false,
+    })
+
+    // Step 3: Generate response with context
+    stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_THINKING,
+        Content: "Generating response with retrieved context...",
+        IsFinal: false,
+    })
+
+    // Build prompt with context
+    contextualPrompt := buildPromptWithContext(req.UserMessage, searchResults)
+
+    // Call LLM
+    response := p.callLLMWithContext(contextualPrompt)
+
+    // Step 4: Send final response
+    stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_CONTENT,
+        Content: response,
+        IsFinal: false,
+    })
+
+    return stream.Send(&pb.AgentMessageChunk{
+        Type:    pb.AgentMessageChunk_DONE,
+        Content: "completed",
+        IsFinal: true,
+    })
+}
+```
+
+### Tool Integration
+
+```go Expandable
+func (p *MyAgent) executeTool(ctx context.Context, toolID uint32, operation string, params map[string]interface{}) (string, error) {
+    // Execute tool via SDK
+    result, err := ai_studio_sdk.ExecuteTool(ctx, toolID, operation, params)
+    if err != nil {
+        return "", err
+    }
+
+    return result.Data, nil
+}
+
+func (p *MyAgent) HandleAgentMessage(
+    req *pb.AgentMessageRequest,
+    stream pb.PluginService_HandleAgentMessageServer) error {
+
+    // Check if user wants to search
+    if strings.Contains(strings.ToLower(req.UserMessage), "search") {
+        // Find search tool
+        var searchTool *pb.AgentToolInfo
+        for _, tool := range req.AvailableTools {
+            if tool.Slug == "web-search" {
+                searchTool = tool
+                break
+            }
+        }
+
+        if searchTool != nil {
+            stream.Send(&pb.AgentMessageChunk{
+                Type:    pb.AgentMessageChunk_TOOL_CALL,
+                Content: "Searching the web...",
+                IsFinal: false,
+            })
+
+            result, err := p.executeTool(stream.Context(), searchTool.Id, "search", map[string]interface{}{
+                "query": extractSearchQuery(req.UserMessage),
+            })
+
+            if err == nil {
+                stream.Send(&pb.AgentMessageChunk{
+                    Type:    pb.AgentMessageChunk_TOOL_RESULT,
+                    Content: fmt.Sprintf("Search results: %s", result),
+                    IsFinal: false,
+                })
+            }
+        }
+    }
+
+    // Continue with LLM call...
+    return p.callLLM(req, stream)
+}
+```
+
+## Best Practices
+
+### Performance
+
+- Use non-blocking I/O for external calls
+- Stream responses as they arrive
+- Set appropriate timeouts
+- Cache frequently accessed data
+- Minimize LLM calls where possible
+
+### Error Handling
+
+- Always send ERROR chunk on failures
+- Set `IsFinal=true` for ERROR chunks
+- Provide descriptive error messages
+- Log errors with context (session ID, plugin ID)
+- Implement graceful fallbacks
+
+### User Experience
+
+- Send THINKING chunks for long operations
+- Stream content as it's generated
+- Provide progress updates
+- Use metadata for rich responses
+- Always send DONE chunk
+
+### Security
+
+- Validate all inputs
+- Sanitize user messages
+- Don't expose sensitive data in responses
+- Use permission scopes appropriately
+- Log security-relevant events
+
+## API Reference
+
+### Agent Management (Admin Only)
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/api/v1/agents` | GET | List all accessible agents |
+| `/api/v1/agents` | POST | Create new agent config |
+| `/api/v1/agents/{id}` | GET | Get agent details |
+| `/api/v1/agents/{id}` | PUT | Update agent config |
+| `/api/v1/agents/{id}` | DELETE | Delete agent config |
+| `/api/v1/agents/{id}/activate` | POST | Activate agent |
+| `/api/v1/agents/{id}/deactivate` | POST | Deactivate agent |
+
+### Agent Communication (Users)
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/api/agents/{id}/stream` | GET | Establish SSE connection |
+| `/api/agents/{id}/message` | POST | Send message to active session |
+
+### SessionAware Pattern (Recommended)
+
+Agent plugins should implement the `SessionAware` interface to warm up the Service API connection:
+
+```go
+// OnSessionReady is called when the session broker is ready
+func (p *MyAgentPlugin) OnSessionReady(ctx plugin_sdk.Context) {
+    // Warm up Service API connection
+    if ai_studio_sdk.IsInitialized() {
+        _, _ = ai_studio_sdk.GetPluginsCount(context.Background())
+    }
+}
+
+// OnSessionClosing is called when the session is closing
+func (p *MyAgentPlugin) OnSessionClosing(ctx plugin_sdk.Context) {
+    // Clean up session resources
+}
+```
+
+### Service Broker ID
+
+For LLM calls via the Service API, always set the service broker ID from the request:
+
+```go
+func (p *MyAgentPlugin) HandleAgentMessage(req *pb.AgentMessageRequest, stream pb.PluginService_HandleAgentMessageServer) error {
+    // Critical: Set service broker ID for LLM calls
+    if req.ServiceBrokerId != 0 {
+        ai_studio_sdk.SetServiceBrokerID(req.ServiceBrokerId)
+    }
+    // ... rest of handler
+}
+```
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="Agent Not Appearing in Chat">
+
+- Check `plugin_type` is `"agent"`
+- Verify agent configuration is created for an app
+- Ensure plugin is active (`is_active: true`)
+- Check logs for initialization errors
+
+</Accordion>
+
+<Accordion title="LLM Calls Failing">
+
+- Verify `llms.proxy` permission in manifest
+- Check SDK is initialized
+- Ensure LLMs are available in app configuration
+- Review LLM provider credentials
+
+</Accordion>
+
+<Accordion title="Streaming Not Working">
+
+- Ensure you're sending chunks sequentially
+- Always set `IsFinal=true` for final chunk
+- Send DONE chunk at the end
+- Check for errors in `stream.Send()`
+
+</Accordion>
+
+<Accordion title="Context Not Available">
+
+- Verify plugin context is passed correctly
+- Check broker ID is set for service API calls
+- Ensure session ID is provided
+- Review plugin initialization
+
+</Accordion>
+
+</AccordionGroup>
+
+## Working Example
+
+See the **Echo Agent** example in the repository:
+
+**Path**: [`examples/plugins/studio/echo-agent/`](https://github.com/TykTechnologies/ai-studio/tree/main/examples/plugins/studio/echo-agent)
+
+The Echo Agent demonstrates:
+- Basic `HandleAgentMessage` implementation
+- LLM selection from available LLMs
+- Calling LLMs via `ai_studio_sdk.CallLLM()`
+- Streaming responses back to users
+- Configuration handling via JSON schema
+- Session warmup with `OnSessionReady`
+
+## Limitations (Experimental)
+
+- No built-in conversation persistence (agents must manage their own state if needed)
+- Tool execution must be implemented by the agent
+- No automatic retry on LLM failures
+- Single concurrent conversation per session
diff --git a/ai-management/ai-studio/plugins/studio-ui.mdx b/ai-management/ai-studio/plugins/studio-ui.mdx
new file mode 100644
index 0000000000..f03cfc5ab6
--- /dev/null
+++ b/ai-management/ai-studio/plugins/studio-ui.mdx
@@ -0,0 +1,1054 @@
+---
+title: "AI Studio UI Plugins"
+description: "How to build AI Studio UI plugins to extend the admin dashboard with custom interfaces, dashboards, and management tools using the Unified Plugin SDK."
+keywords: "AI Studio, AI Management, Plugin SDK"
+sidebarTitle: "AI Studio UI"
+---
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+```mermaid
+graph LR
+    A[Admin Dashboard] -->|Loads| B[WebComponent]
+    B -->|RPC| C[Plugin Backend]
+```
+
+AI Studio UI plugins extend the **admin dashboard** with custom interfaces using WebComponents. Build rich admin panels, custom dashboards, monitoring tools, and specialized management interfaces that integrate seamlessly with the AI Studio platform using the **Unified Plugin SDK**.
+
+> **Looking for portal (end-user) pages?** See the [AI Portal UI Plugins Guide](/ai-management/ai-studio/plugins/portal-ui) for building pages visible to portal users, not just admins.
+
+## Overview
+
+UI plugins enable you to:
+
+- **Add Custom Pages**: Register new routes in the dashboard
+- **Extend Sidebar**: Add sections, links, and navigation
+- **Serve WebComponents**: Use any frontend framework (React, Vue, Lit, etc.)
+- **Call Service APIs**: Access LLMs, tools, datasources, analytics, and more
+- **Store Plugin Data**: Use built-in key-value storage
+- **Define RPC Methods**: Create custom backend endpoints
+- **Multi-Capability**: Combine UI with middleware hooks (PostAuth, Response, Object Hooks, etc.)
+
+## Unified SDK Integration
+
+UI plugins use the **Unified Plugin SDK** (`pkg/plugin_sdk`) and can combine UI capabilities with other plugin capabilities like PostAuth, Response, or Object Hooks.
+
+### Key Features
+
+- **BasePlugin**: Convenience struct for lifecycle management
+- **UIProvider**: Capability for serving UI assets and RPC methods
+- **Context Services**: Access KV storage, logging, and Studio Services
+- **Multi-Capability**: Implement multiple interfaces in one plugin
+- **Broker Connection**: Automatic Service API access for UI interactions
+
+### Example: Multi-Capability Plugin
+
+A single plugin can provide both UI and middleware functionality:
+
+```go Expandable
+import "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+
+type MyUIPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+// Implement UIProvider capability
+func (p *MyUIPlugin) GetAsset(assetPath string) ([]byte, string, error) {
+    // Serve UI assets
+}
+
+func (p *MyUIPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    // Handle RPC calls from UI
+}
+
+// Implement PostAuthHandler capability (optional)
+func (p *MyUIPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Process requests
+}
+
+// Implement ObjectHooks capability (optional)
+func (p *MyUIPlugin) GetObjectHookRegistrations() ([]*pb.ObjectHookRegistration, error) {
+    // Register hooks
+}
+```
+
+**Example**: `examples/plugins/studio/llm-rate-limiter-multiphase/` combines UIProvider + PostAuth + Response in one plugin.
+
+##Quick Start
+
+### 1. Project Structure
+
+```
+my-ui-plugin/
+├── server/
+│   ├── main.go              # Plugin server
+│   ├── plugin.manifest.json # Plugin manifest
+│   └── config.schema.json   # Configuration schema
+├── ui/
+│   ├── webc/
+│   │   └── dashboard.js     # WebComponent
+│   └── assets/
+│       └── icon.svg         # Static assets
+└── go.mod
+```
+
+### 2. Create Manifest
+
+[server/manifest.json](https://github.com/TykTechnologies/ai-studio/blob/main/examples/plugins/studio/custom-auth-ui/server/manifest.json):
+
+```json Expandable
+{
+  "id": "com.example.my-plugin",
+  "name": "My Plugin",
+  "version": "1.0.0",
+  "plugin_type": "ai_studio",
+  "permissions": {
+    "services": [
+      "llms.read",
+      "apps.read",
+      "kv.readwrite"
+    ]
+  },
+  "ui": {
+    "slots": [
+      {
+        "slot": "sidebar.section",
+        "label": "My Plugin",
+        "icon": "/assets/icon.svg",
+        "items": [
+          {
+            "type": "route",
+            "path": "/admin/my-plugin",
+            "title": "Dashboard",
+            "mount": {
+              "kind": "webc",
+              "tag": "my-plugin-dashboard",
+              "entry": "/ui/webc/dashboard.js",
+              "props": {
+                "apiBase": "/plugin/com.example.my-plugin/rpc"
+              }
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "rpc": {
+    "basePath": "/plugin/com.example.my-plugin/rpc"
+  }
+}
+```
+
+### 3. Implement Plugin Server
+
+[server/main.go](https://github.com/TykTechnologies/ai-studio/blob/main/examples/plugins/studio/custom-auth-ui/server/main.go):
+
+```go Expandable
+package main
+
+import (
+    "context"
+    "embed"
+    "encoding/json"
+    "fmt"
+    "log"
+
+    "github.com/TykTechnologies/midsommar/v2/pkg/ai_studio_sdk"
+    "github.com/TykTechnologies/midsommar/v2/pkg/plugin_sdk"
+    pb "github.com/TykTechnologies/midsommar/v2/proto"
+)
+
+//go:embed ui assets plugin.manifest.json
+var embeddedAssets embed.FS
+
+type MyPlugin struct {
+    plugin_sdk.BasePlugin
+}
+
+func NewMyPlugin() *MyPlugin {
+    return &MyPlugin{
+        BasePlugin: plugin_sdk.NewBasePlugin(
+            "my-ui-plugin",
+            "1.0.0",
+            "Custom UI plugin with dashboard",
+        ),
+    }
+}
+
+// Initialize is called when plugin starts
+func (p *MyPlugin) Initialize(ctx plugin_sdk.Context, config map[string]string) error {
+    log.Printf("My Plugin initializing")
+
+    // Extract broker ID for Service API access
+    brokerIDStr := ""
+    if id, ok := config["_service_broker_id"]; ok {
+        brokerIDStr = id
+    } else if id, ok := config["service_broker_id"]; ok {
+        brokerIDStr = id
+    }
+
+    if brokerIDStr != "" {
+        var brokerID uint32
+        fmt.Sscanf(brokerIDStr, "%d", &brokerID)
+        ai_studio_sdk.SetServiceBrokerID(brokerID)
+        log.Printf("Set broker ID %d for Service API", brokerID)
+    }
+
+    return nil
+}
+
+// Shutdown is called when plugin stops
+func (p *MyPlugin) Shutdown(ctx plugin_sdk.Context) error {
+    log.Printf("My Plugin shutting down")
+    return nil
+}
+
+// GetAsset serves static files
+func (p *MyPlugin) GetAsset(assetPath string) ([]byte, string, error) {
+    if assetPath[0] == '/' {
+        assetPath = assetPath[1:]
+    }
+
+    content, err := embeddedAssets.ReadFile(assetPath)
+    if err != nil {
+        return nil, "", err
+    }
+
+    mimeType := detectMimeType(assetPath)
+    return content, mimeType, nil
+}
+
+// GetManifest returns the plugin manifest
+func (p *MyPlugin) GetManifest() ([]byte, error) {
+    return embeddedAssets.ReadFile("plugin.manifest.json")
+}
+
+// HandleCall processes RPC methods
+func (p *MyPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    ctx := context.Background()
+
+    switch method {
+    case "get_data":
+        return p.getData(ctx)
+    case "save_settings":
+        return p.saveSettings(ctx, payload)
+    default:
+        return nil, fmt.Errorf("unknown method: %s", method)
+    }
+}
+
+// RPC method implementation
+func (p *MyPlugin) getData(ctx context.Context) ([]byte, error) {
+    // Call service API to get LLMs
+    llmsResp, err := ai_studio_sdk.ListLLMs(ctx, 1, 10)
+    if err != nil {
+        return nil, err
+    }
+
+    // Return data as JSON
+    return json.Marshal(map[string]interface{}{
+        "llms": llmsResp.Llms,
+        "total": llmsResp.TotalCount,
+    })
+}
+
+func (p *MyPlugin) saveSettings(ctx context.Context, payload []byte) ([]byte, error) {
+    // Store settings in KV storage
+    _, err := ai_studio_sdk.WritePluginKV(ctx, "settings", payload)
+    if err != nil {
+        return nil, err
+    }
+
+    return json.Marshal(map[string]string{
+        "status": "saved",
+    })
+}
+
+// GetConfigSchema returns configuration schema
+func (p *MyPlugin) GetConfigSchema() ([]byte, error) {
+    schema := map[string]interface{}{
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "type": "object",
+        "properties": map[string]interface{}{
+            "api_key": map[string]interface{}{
+                "type": "string",
+                "description": "API key for external service",
+            },
+        },
+    }
+    return json.Marshal(schema)
+}
+
+func detectMimeType(path string) string {
+    if strings.HasSuffix(path, ".js") {
+        return "application/javascript"
+    } else if strings.HasSuffix(path, ".css") {
+        return "text/css"
+    } else if strings.HasSuffix(path, ".svg") {
+        return "image/svg+xml"
+    }
+    return "application/octet-stream"
+}
+
+func main() {
+    log.Printf("Starting My Plugin")
+    plugin_sdk.Serve(NewMyPlugin())
+}
+```
+
+### 4. Create WebComponent
+
+`ui/webc/dashboard.js`:
+
+```javascript Expandable
+class MyPluginDashboard extends HTMLElement {
+    connectedCallback() {
+        this.innerHTML = `
+            <div class="plugin-dashboard">
+                <h1>My Plugin Dashboard</h1>
+                <div id="content">Loading...</div>
+                <button id="refresh">Refresh</button>
+            </div>
+        `;
+
+        this.loadData();
+
+        this.querySelector('#refresh').addEventListener('click', () => {
+            this.loadData();
+        });
+    }
+
+    async loadData() {
+        try {
+            const apiBase = this.getAttribute('apiBase') || '/plugin/com.example.my-plugin/rpc';
+
+            const response = await fetch(`${apiBase}/get_data`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Authorization': `Bearer ${this.getAuthToken()}`,
+                },
+                body: JSON.stringify({}),
+            });
+
+            const data = await response.json();
+
+            this.querySelector('#content').innerHTML = `
+                <p>Found ${data.total} LLMs</p>
+                <ul>
+                    ${data.llms.map(llm => `<li>${llm.name} (${llm.vendor})</li>`).join('')}
+                </ul>
+            `;
+        } catch (error) {
+            console.error('Failed to load data:', error);
+            this.querySelector('#content').innerHTML = `<p>Error: ${error.message}</p>`;
+        }
+    }
+
+    getAuthToken() {
+        // Get token from localStorage or session
+        return localStorage.getItem('auth_token') || '';
+    }
+}
+
+customElements.define('my-plugin-dashboard', MyPluginDashboard);
+```
+
+### 5. Build and Deploy
+
+```bash Expandable
+# Build plugin
+cd server
+go build -o my-plugin
+
+# Create plugin in AI Studio
+curl -X POST http://localhost:3000/api/v1/plugins \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{
+    "name": "My Plugin",
+    "slug": "my-plugin",
+    "command": "file:///path/to/my-plugin",
+    "hook_type": "studio_ui",
+    "plugin_type": "ai_studio",
+    "is_active": true,
+    "load_immediately": true
+  }'
+```
+
+## Manifest Structure
+
+### Top-Level Fields
+
+```json
+{
+  "id": "com.example.plugin",           // Unique identifier (reverse domain)
+  "name": "Plugin Name",                // Display name
+  "version": "1.0.0",                   // Semantic version
+  "plugin_type": "ai_studio",           // Must be "ai_studio"
+  "description": "Plugin description",  // Optional
+  "permissions": { },                   // Permission scopes
+  "ui": { },                            // UI configuration
+  "rpc": { },                           // RPC configuration
+  "assets": [],                         // Static asset list
+  "compat": { }                         // Compatibility info
+}
+```
+
+### Permissions
+
+```json Expandable
+{
+  "permissions": {
+    "services": [
+      "llms.read",           // List and read LLM configurations
+      "llms.proxy",          // Call LLMs via proxy
+      "llms.write",          // Create/update LLMs
+      "tools.read",          // List and read tools
+      "tools.execute",       // Execute tools
+      "tools.write",         // Create/update tools
+      "datasources.read",    // List and read datasources
+      "datasources.query",   // Query datasources
+      "apps.read",           // List and read apps
+      "apps.write",          // Create/update apps
+      "plugins.read",        // List and read plugins
+      "analytics.read",      // Read analytics data
+      "kv.read",             // Read KV storage
+      "kv.readwrite"         // Read/write KV storage
+    ]
+  }
+}
+```
+
+### UI Configuration
+
+```json Expandable
+{
+  "ui": {
+    "slots": [
+      {
+        "slot": "sidebar.section",        // UI slot name
+        "label": "My Plugin",             // Section label
+        "icon": "/assets/icon.svg",       // Icon path
+        "items": [
+          {
+            "type": "route",              // Route type
+            "path": "/admin/my-plugin",   // URL path
+            "title": "Dashboard",         // Page title
+            "mount": {
+              "kind": "webc",             // WebComponent
+              "tag": "my-dashboard",      // Custom element tag
+              "entry": "/ui/webc/dashboard.js",  // JS file
+              "props": {                  // Props passed to component
+                "apiBase": "/plugin/com.example/rpc"
+              }
+            }
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+### Available UI Slots
+
+- `sidebar.section`: Add sidebar section with nested items
+- `sidebar.link`: Add individual sidebar link
+- `settings.section`: Add settings page section
+- `app.detail.tab`: Add tab to app detail page
+- `llm.detail.tab`: Add tab to LLM detail page
+
+### RPC Configuration
+
+```json
+{
+  "rpc": {
+    "basePath": "/plugin/com.example/rpc"
+  }
+}
+```
+
+RPC calls are automatically routed to your plugin's `HandleCall()` method.
+
+## Service API Access
+
+The Service API provides 100+ gRPC operations accessible via the SDK:
+
+### LLM Operations
+
+```go
+// List LLMs
+llmsResp, err := ai_studio_sdk.ListLLMs(ctx, page, limit)
+
+// Get LLM by ID
+llm, err := ai_studio_sdk.GetLLM(ctx, llmID)
+
+// Call LLM via proxy (streaming)
+stream, err := ai_studio_sdk.CallLLM(ctx, llmID, model, messages,
+    temperature, maxTokens, tools, true)
+
+// Simple non-streaming LLM call
+response, err := ai_studio_sdk.CallLLMSimple(ctx, llmID, model,
+    "Hello, world!")
+```
+
+### Tool Operations
+
+```go
+// List tools
+toolsResp, err := ai_studio_sdk.ListTools(ctx, page, limit)
+
+// Get tool by ID
+tool, err := ai_studio_sdk.GetTool(ctx, toolID)
+
+// Execute tool
+result, err := ai_studio_sdk.ExecuteTool(ctx, toolID, operationID, params)
+```
+
+### Plugin Operations
+
+```go
+// List plugins
+pluginsResp, err := ai_studio_sdk.ListPlugins(ctx, page, limit)
+
+// Get plugin by ID
+plugin, err := ai_studio_sdk.GetPlugin(ctx, pluginID)
+
+// Get counts
+pluginsCount, err := ai_studio_sdk.GetPluginsCount(ctx)
+llmsCount, err := ai_studio_sdk.GetLLMsCount(ctx)
+```
+
+### KV Storage Operations
+
+```go
+// Write data
+created, err := ai_studio_sdk.WritePluginKV(ctx, key, data)
+
+// Read data
+data, err := ai_studio_sdk.ReadPluginKV(ctx, key)
+
+// Delete data
+err := ai_studio_sdk.DeletePluginKV(ctx, key)
+
+// List keys
+keys, err := ai_studio_sdk.ListPluginKVKeys(ctx, prefix)
+```
+
+### App Operations
+
+```go
+// List apps
+appsResp, err := ai_studio_sdk.ListApps(ctx, page, limit)
+
+// Get app by ID
+app, err := ai_studio_sdk.GetApp(ctx, appID)
+```
+
+### Analytics Operations
+
+```go
+// Get usage statistics
+usage, err := ai_studio_sdk.GetUsageStats(ctx, startTime, endTime, filters)
+
+// Get cost analytics
+costs, err := ai_studio_sdk.GetCostAnalytics(ctx, startTime, endTime)
+```
+
+## Multi-Capability Patterns
+
+UI plugins using the unified SDK can implement multiple capabilities in a single plugin, combining dashboard UI with request/response processing, object validation, or other hooks.
+
+### Combining UI + PostAuth
+
+Create a plugin that both displays data and processes requests:
+
+```go Expandable
+type RateLimiterPlugin struct {
+    plugin_sdk.BasePlugin
+    limits map[uint32]int // app_id -> limit
+}
+
+// UIProvider capability - serve dashboard
+func (p *RateLimiterPlugin) GetAsset(assetPath string) ([]byte, string, error) {
+    return embeddedAssets.ReadFile(assetPath)
+}
+
+func (p *RateLimiterPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    switch method {
+    case "get_limits":
+        return json.Marshal(p.limits)
+    case "set_limit":
+        var req struct {
+            AppID uint32 `json:"app_id"`
+            Limit int    `json:"limit"`
+        }
+        json.Unmarshal(payload, &req)
+        p.limits[req.AppID] = req.Limit
+        return json.Marshal(map[string]string{"status": "ok"})
+    }
+    return nil, fmt.Errorf("unknown method")
+}
+
+// PostAuthHandler capability - enforce limits
+func (p *RateLimiterPlugin) HandlePostAuth(ctx plugin_sdk.Context, req *pb.EnrichedRequest) (*pb.PluginResponse, error) {
+    // Check rate limit from state
+    limit, exists := p.limits[ctx.AppID]
+    if !exists {
+        limit = 100 // default
+    }
+
+    // Check current count from KV
+    key := fmt.Sprintf("rate:%d", ctx.AppID)
+    data, _ := ctx.Services.KV().Read(ctx, key)
+    count := 0
+    if data != nil {
+        json.Unmarshal(data, &count)
+    }
+
+    if count >= limit {
+        return &pb.PluginResponse{
+            Block:        true,
+            ErrorMessage: "Rate limit exceeded",
+        }, nil
+    }
+
+    // Increment counter
+    count++
+    countData, _ := json.Marshal(count)
+    ctx.Services.KV().Write(ctx, key, countData)
+
+    return &pb.PluginResponse{Modified: false}, nil
+}
+```
+
+### Combining UI + Object Hooks
+
+Create a plugin that validates objects and provides an approval dashboard:
+
+```go Expandable
+type ApprovalPlugin struct {
+    plugin_sdk.BasePlugin
+    pendingApprovals []PendingApproval
+}
+
+type PendingApproval struct {
+    ID         string
+    ObjectType string
+    ObjectJSON string
+    Status     string
+}
+
+// UIProvider - approval dashboard
+func (p *ApprovalPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    switch method {
+    case "list_pending":
+        return json.Marshal(p.pendingApprovals)
+    case "approve":
+        var req struct{ ID string }
+        json.Unmarshal(payload, &req)
+        // Approve and remove from pending
+        return json.Marshal(map[string]string{"status": "approved"})
+    case "reject":
+        var req struct{ ID string }
+        json.Unmarshal(payload, &req)
+        // Reject and remove from pending
+        return json.Marshal(map[string]string{"status": "rejected"})
+    }
+    return nil, fmt.Errorf("unknown method")
+}
+
+// ObjectHooks capability - require approval
+func (p *ApprovalPlugin) GetObjectHookRegistrations() ([]*pb.ObjectHookRegistration, error) {
+    return []*pb.ObjectHookRegistration{
+        {
+            ObjectType: "datasource",
+            HookTypes:  []string{"before_create"},
+            Priority:   10,
+        },
+    }, nil
+}
+
+func (p *ApprovalPlugin) HandleObjectHook(ctx plugin_sdk.Context, req *pb.ObjectHookRequest) (*pb.ObjectHookResponse, error) {
+    // Add to pending approvals
+    approval := PendingApproval{
+        ID:         generateID(),
+        ObjectType: req.ObjectType,
+        ObjectJSON: req.ObjectJson,
+        Status:     "pending",
+    }
+    p.pendingApprovals = append(p.pendingApprovals, approval)
+
+    // Store in KV for persistence
+    data, _ := json.Marshal(p.pendingApprovals)
+    ctx.Services.KV().Write(ctx, "pending_approvals", data)
+
+    // Block operation until manual approval
+    return &pb.ObjectHookResponse{
+        AllowOperation:  false,
+        RejectionReason: "Pending manual approval",
+    }, nil
+}
+```
+
+### Combining UI + Response
+
+Monitor and modify responses with a dashboard:
+
+```go Expandable
+type ResponseMonitorPlugin struct {
+    plugin_sdk.BasePlugin
+    stats ResponseStats
+}
+
+// UIProvider - monitoring dashboard
+func (p *ResponseMonitorPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    if method == "get_stats" {
+        return json.Marshal(p.stats)
+    }
+    return nil, fmt.Errorf("unknown method")
+}
+
+// ResponseHandler capability - track responses
+func (p *ResponseMonitorPlugin) OnBeforeWrite(ctx plugin_sdk.Context, req *pb.ResponseWriteRequest) (*pb.ResponseWriteResponse, error) {
+    // Track response statistics
+    p.stats.TotalResponses++
+    p.stats.TotalTokens += req.Tokens
+
+    // Store in KV
+    data, _ := json.Marshal(p.stats)
+    ctx.Services.KV().Write(ctx, "response_stats", data)
+
+    return &pb.ResponseWriteResponse{Modified: false}, nil
+}
+```
+
+### Benefits of Multi-Capability Plugins
+
+1. **Unified State**: Share data structures between UI and middleware
+2. **Single Deployment**: One plugin provides multiple features
+3. **Consistent Configuration**: Single manifest, config, and initialization
+4. **Simplified Management**: Deploy, update, and monitor as one unit
+5. **Rich Dashboards**: Display real-time data from middleware hooks
+
+### Working Example
+
+See `examples/plugins/studio/llm-rate-limiter-multiphase/` for a complete multi-capability plugin that implements:
+- **PostAuth**: Check rate limits before requests
+- **Response**: Update counters after responses
+- **UI Provider**: Dashboard showing rate limit status
+
+## Complete Example: Rate Limiting Dashboard
+
+Here's a complete example showing all features:
+
+### Manifest
+
+```json Expandable
+{
+  "id": "com.tyk.rate-limiting-ui",
+  "version": "1.0.0",
+  "name": "Rate Limiting UI",
+  "description": "Enhanced UI for rate limiting configuration",
+  "permissions": {
+    "services": [
+      "plugins.read",
+      "llms.read",
+      "tools.read",
+      "kv.readwrite"
+    ]
+  },
+  "ui": {
+    "slots": [
+      {
+        "slot": "sidebar.section",
+        "label": "Rate Limiting",
+        "icon": "/assets/rate-limit.svg",
+        "items": [
+          {
+            "type": "route",
+            "path": "/admin/rate-limiting/dashboard",
+            "title": "Rate Limiting Dashboard",
+            "mount": {
+              "kind": "webc",
+              "tag": "rate-limiting-dashboard",
+              "entry": "/ui/webc/dashboard.js"
+            }
+          },
+          {
+            "type": "route",
+            "path": "/admin/rate-limiting/settings",
+            "title": "Global Settings",
+            "mount": {
+              "kind": "webc",
+              "tag": "rate-limiting-settings",
+              "entry": "/ui/webc/settings.js"
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "rpc": {
+    "basePath": "/plugin/com.tyk.rate-limiting-ui/rpc"
+  }
+}
+```
+
+### RPC Methods
+
+```go Expandable
+func (p *RateLimitingUIPlugin) HandleCall(method string, payload []byte) ([]byte, error) {
+    ctx := context.Background()
+
+    switch method {
+    case "get_statistics":
+        return p.getStatistics(ctx)
+    case "get_rate_limits":
+        return p.getRateLimits(ctx)
+    case "set_rate_limit":
+        return p.setRateLimit(ctx, payload)
+    case "get_available_tools":
+        return p.getAvailableTools(ctx)
+    default:
+        return nil, fmt.Errorf("unknown method: %s", method)
+    }
+}
+
+func (p *RateLimitingUIPlugin) getStatistics(ctx context.Context) ([]byte, error) {
+    // Get real plugin and LLM counts
+    pluginsCount, err := ai_studio_sdk.GetPluginsCount(ctx)
+    if err != nil {
+        return nil, err
+    }
+
+    llmsCount, err := ai_studio_sdk.GetLLMsCount(ctx)
+    if err != nil {
+        return nil, err
+    }
+
+    stats := map[string]interface{}{
+        "total_plugins": pluginsCount,
+        "total_llms":    llmsCount,
+        "blocked_requests": 142,
+        "success_rate": 0.991,
+    }
+
+    return json.Marshal(stats)
+}
+
+func (p *RateLimitingUIPlugin) getAvailableTools(ctx context.Context) ([]byte, error) {
+    // List tools using service API
+    toolsResp, err := ai_studio_sdk.ListTools(ctx, 1, 50)
+    if err != nil {
+        return nil, err
+    }
+
+    // Convert to UI format
+    tools := make([]map[string]interface{}, len(toolsResp.Tools))
+    for i, tool := range toolsResp.Tools {
+        tools[i] = map[string]interface{}{
+            "id":          tool.Id,
+            "name":        tool.Name,
+            "slug":        tool.Slug,
+            "description": tool.Description,
+            "type":        tool.ToolType,
+        }
+    }
+
+    return json.Marshal(map[string]interface{}{
+        "tools": tools,
+        "total": toolsResp.TotalCount,
+    })
+}
+
+func (p *RateLimitingUIPlugin) setRateLimit(ctx context.Context, payload []byte) ([]byte, error) {
+    var config map[string]interface{}
+    if err := json.Unmarshal(payload, &config); err != nil {
+        return nil, err
+    }
+
+    // Store in KV storage
+    _, err := ai_studio_sdk.WritePluginKV(ctx, "rate_limits", payload)
+    if err != nil {
+        return nil, err
+    }
+
+    return json.Marshal(map[string]string{
+        "status": "updated",
+    })
+}
+```
+
+## Frontend Frameworks
+
+### React
+
+```javascript Expandable
+import React, { useState, useEffect } from 'react';
+import ReactDOM from 'react-dom/client';
+
+function RateLimitingDashboard({ apiBase }) {
+    const [stats, setStats] = useState(null);
+
+    useEffect(() => {
+        fetchStats();
+    }, []);
+
+    async function fetchStats() {
+        const response = await fetch(`${apiBase}/get_statistics`, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${getAuthToken()}`,
+            },
+        });
+        const data = await response.json();
+        setStats(data);
+    }
+
+    if (!stats) return <div>Loading...</div>;
+
+    return (
+        <div className="dashboard">
+            <h1>Rate Limiting Dashboard</h1>
+            <div className="stats">
+                <div>Plugins: {stats.total_plugins}</div>
+                <div>LLMs: {stats.total_llms}</div>
+                <div>Blocked: {stats.blocked_requests}</div>
+            </div>
+        </div>
+    );
+}
+
+class RateLimitingDashboardElement extends HTMLElement {
+    connectedCallback() {
+        const apiBase = this.getAttribute('apiBase');
+        const root = ReactDOM.createRoot(this);
+        root.render(<RateLimitingDashboard apiBase={apiBase} />);
+    }
+}
+
+customElements.define('rate-limiting-dashboard', RateLimitingDashboardElement);
+```
+
+### Vue
+
+```javascript Expandable
+import { createApp } from 'vue';
+
+const DashboardApp = {
+    data() {
+        return {
+            stats: null,
+        };
+    },
+    mounted() {
+        this.fetchStats();
+    },
+    methods: {
+        async fetchStats() {
+            const response = await fetch(`${this.apiBase}/get_statistics`, {
+                method: 'POST',
+            });
+            this.stats = await response.json();
+        },
+    },
+    template: `
+        <div class="dashboard">
+            <h1>Rate Limiting Dashboard</h1>
+            <div v-if="stats">
+                <div>Plugins: {{ stats.total_plugins }}</div>
+                <div>LLMs: {{ stats.total_llms }}</div>
+            </div>
+        </div>
+    `,
+};
+
+class RateLimitingDashboardElement extends HTMLElement {
+    connectedCallback() {
+        const apiBase = this.getAttribute('apiBase');
+        createApp(DashboardApp, { apiBase }).mount(this);
+    }
+}
+
+customElements.define('rate-limiting-dashboard', RateLimitingDashboardElement);
+```
+
+## Best Practices
+
+### Security
+
+- Always validate inputs in RPC methods
+- Use HTTPS for production deployments
+- Sanitize HTML in WebComponents
+- Don't expose sensitive data in frontend
+- Use CSP headers in manifest
+
+### Performance
+
+- Lazy-load heavy components
+- Cache frequently accessed data
+- Use KV storage for plugin state
+- Minimize Service API calls
+- Bundle and minify assets
+
+### User Experience
+
+- Show loading states
+- Handle errors gracefully
+- Provide feedback for actions
+- Use consistent UI patterns
+- Support dark mode if platform does
+
+### Development
+
+- Use TypeScript for type safety
+- Add proper error handling
+- Log important operations
+- Test with different data scenarios
+- Document RPC methods
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="Plugin Not Loading">
+
+- Check manifest syntax (valid JSON)
+- Verify `plugin_type` is `"ai_studio"`
+- Ensure `load_immediately` is `true` in plugin registration
+- Check logs for initialization errors
+
+</Accordion>
+
+<Accordion title="WebComponent Not Rendering">
+
+- Verify asset path is correct (leading `/`)
+- Check browser console for JS errors
+- Ensure custom element is defined
+- Verify mime types are correct
+
+</Accordion>
+
+<Accordion title="Service API Calls Failing">
+
+- Check permission scopes in manifest
+- Verify SDK is initialized (`ai_studio_sdk.IsInitialized()`)
+- Check context has valid authentication
+- Review service API error messages
+
+</Accordion>
+
+<Accordion title="Assets Not Serving">
+
+- Ensure assets are embedded (`//go:embed`)
+- Check `GetAsset()` normalizes paths correctly
+- Verify mime type detection
+- Check asset paths in manifest match filesystem
+
+</Accordion>
+
+</AccordionGroup>
diff --git a/ai-management/ai-studio/proxy.mdx b/ai-management/ai-studio/proxy.mdx
new file mode 100644
index 0000000000..406a8a0f62
--- /dev/null
+++ b/ai-management/ai-studio/proxy.mdx
@@ -0,0 +1,120 @@
+---
+title: "Edge Gateway (Data Plane) Component"
+description: "Explore Edge Gateway component of Tyk AI Studio, including architecture, configuration synchronization, and management"
+keywords: "AI Studio, AI Management, Edge Gateway"
+sidebarTitle: "Edge Gateway"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+The Edge Gateway operates as an independent, dedicated AI proxy. It processes AI requests, enforces policies, and reports analytics to the control plane. It is optimized for high performance and resilience in production.
+
+The Edge Gateway operates as an independent, dedicated AI proxy. It processes AI requests, enforces policies, and reports analytics to the control plane. It is optimized for high performance and resilience in production.
+
+> **Note:** The Edge Gateway is sometimes referred to as the Microgateway in configuration files. However, **Edge Gateway** is the preferred terminology.
+
+*   **Unified Access Point:** Provides a single, consistent endpoint for applications to interact with various LLMs.
+*   **Security Enforcement:** Handles authentication, authorization, and applies security policies.
+*   **Policy Management:** Enforces rules related to budget limits, model access, and applies custom [Filters](/ai-management/ai-studio/filters).
+*   **Observability:** Logs detailed analytics data for each request, feeding the [Analytics & Monitoring](/ai-management/ai-studio/analytics) system.
+*   **Vendor Abstraction:** Hides the complexities of different LLM provider APIs, especially through the OpenAI-compatible endpoint.
+
+## Edge Gateway Variants
+
+There are two Edge Gateway variants:
+
+| Variant | Where it runs | Capabilities | Use case |
+|---------|---------------|-------------|----------|
+| **Embedded Gateway** | Inside AI Studio | LLM proxying, tool calling (REST + MCP), datasource querying. No filters, no middleware, no plugins. | Testing LLM configurations, powering the Chat interface |
+| **Edge Gateway** | Standalone binary, deployed at edge | Full middleware pipeline: authentication, filters, plugins, analytics, budget enforcement, tool calling (REST + MCP), datasource querying | Production data plane in hub-and-spoke deployments |
+
+Both variants rely on the core proxy library and access control mechanisms. The embedded gateway is lightweight, while the Edge Gateway offers the full feature set. Tools, datasources, and OAuth state are synced to edge gateways through the hub-spoke configuration system.
+
+## Core Features
+
+1.  **Request Routing:** Incoming requests include an `llmSlug` in their path (e.g., `/llm/call/{llmSlug}/...`). The Proxy uses this slug (auto-generated from the LLM configuration name) to identify the target [LLM Configuration](/ai-management/ai-studio/llm-management) and route the request accordingly.
+
+2.  **Authentication & Authorization:**
+    *   Validates the API key provided by the client application.
+    *   Identifies the associated Application and User.
+    *   Checks if the Application/team has permission to access the requested LLM Configuration based on [RBAC rules](/ai-management/ai-studio/user-management).
+
+3.  **Policy Enforcement:** Before forwarding the request to the backend LLM, the Proxy enforces policies defined in the LLM Configuration or globally:
+    *   **Budget Checks:** Verifies if the estimated cost exceeds the configured [Budgets](/ai-management/ai-studio/llm-management) for the App or LLM.
+    *   **Model Access:** Ensures the requested model is allowed for the specific LLM configuration.
+    *   **Filters:** Applies configured request [Filters](/ai-management/ai-studio/filters) to modify the incoming request payload.
+
+4.  **Analytics Logging:** After receiving the response from the backend LLM (and potentially applying response Filters), the Proxy logs detailed information about the interaction (user, app, model, tokens used, cost, latency, etc.) to the [Analytics](/ai-management/ai-studio/analytics) database.
+
+
+## Proxy Modes
+
+The Edge Gateway (and embedded gateway) offer two ways to proxy LLM traffic:
+
+| Mode | Endpoint | Description | Tradeoff |
+|------|----------|-------------|----------|
+| **SDK-Compatible** (Unified) | `/llm/call/{slug}/...` | Pass-through to the vendor's native API format. No request manipulation beyond analytics/budget tracking. | Full feature access, resilient to vendor API changes. Best for users working directly with a vendor's SDK. |
+| **OpenAI-Compatible** | `/llm/call/{slug}/v1/chat/completions` | Accepts only OpenAI-format input and translates to the upstream vendor's API format. | Maximum client-side compatibility (one format for all vendors), but reduced feature access for vendor-specific capabilities. |
+
+Both modes support streaming and non-streaming responses.
+
+There are also two **legacy endpoints** (`/llm/rest/{slug}/...` and `/llm/stream/{slug}/...`) from before the unified endpoint existed. While not actively used by end-users, the underlying code is still used internally by the proxy to handle each response style.
+
+### LLM Slug
+
+The `{llmSlug}` in the endpoint path is automatically generated from the LLM configuration name when you create it. For example, an LLM named "My OpenAI Config" would have a slug like `my-openai-config`.
+
+## Model Router
+
+The Edge Gateway also includes a **Model Router** component that enables intelligent routing of requests across multiple LLM providers based on cost, performance, or availability. This allows you to build resilient AI applications that automatically failover or load balance between different models.
+
+For more information on configuring and using this feature, see the [Model Router documentation](/ai-management/ai-studio/model-router).
+
+## Configuration Reference
+
+To know more about configuring Edge Gateways, see the [Configuration Reference](/ai-management/ai-studio/edge-gateway-env) for detailed documentation on all environment variables.
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="Edge Shows &quot;Disconnected&quot;">
+
+- Check network connectivity between the edge and control plane
+- Verify the edge gateway is running and healthy
+- Check edge gateway logs for connection errors
+- Ensure firewall rules allow gRPC traffic (default port 50051)
+
+</Accordion>
+
+<Accordion title="Edge Shows &quot;Pending&quot; After Push">
+
+- Wait a few seconds for the heartbeat cycle to complete
+- Check if the edge is connected (not disconnected)
+- Verify the edge gateway logs for configuration load errors
+- Check if the edge has sufficient permissions to fetch configuration
+
+</Accordion>
+
+<Accordion title="Checksum Mismatch Persists">
+
+- Try pushing configuration again
+- Check for configuration validation errors in edge logs
+- Verify the edge and control plane are running compatible versions
+- Check for database replication lag if using PostgreSQL replication
+
+</Accordion>
+
+<Accordion title="Sync Status Banner Doesn’t Disappear">
+
+- Verify all edges have successfully loaded the new configuration
+- Check for any disconnected edges that can't receive updates
+- Refresh the page to ensure the latest status is displayed
+
+</Accordion>
+
+</AccordionGroup>
diff --git a/ai-management/ai-studio/quickstart.mdx b/ai-management/ai-studio/quickstart.mdx
new file mode 100644
index 0000000000..3f4bad9470
--- /dev/null
+++ b/ai-management/ai-studio/quickstart.mdx
@@ -0,0 +1,455 @@
+---
+title: "Install Tyk AI Studio on Docker"
+description: "Installation guide for the Tyk AI Studio on Docker"
+keywords: "AI Studio, AI Management, Installation, Docker, Docker Compose"
+sidebarTitle: "Docker"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+<Note>
+This guide focuses on the Enterprise Edition of Tyk AI Studio. For the Community Edition, please refer to the [Tyk AI Studio GitHub repository](https://github.com/TykTechnologies/ai-studio/blob/main/docs/site/docs/deployment-docker.md). 
+
+The Community Edition uses different Docker images (`tykio/tyk-ai-studio` and `tykio/tyk-microgateway`) and does not require a license key.
+</Note>
+
+This guide covers deploying Tyk AI Studio with a Edge Gateway using Docker Compose. In this architecture, AI Studio acts as the **control plane** (hub) and the Edge Gateway acts as the **data plane** (spoke), receiving configuration via gRPC.
+
+## Prerequisites
+
+- [Docker Engine](https://docs.docker.com/engine/install/) 20.10+ and Docker Compose v2
+- At least 4 GB RAM available
+- A Tyk AI License key (contact support@tyk.io or your account manager to obtain)
+
+<Note>
+Running on Podman, containerd, or another container runtime? See [Container Runtimes](/deployment-and-operations/container-runtimes).
+</Note>
+
+## Generate Secrets
+
+Before starting, generate the required secret keys. These will be used in the configuration files to secure communication and encrypt data:
+
+```bash
+# Secret key for encryption (used for secrets management and SSO)
+openssl rand -hex 16
+# Example output: a35b3f7b0fb4dd3a048ba4fc6e9fe0a8
+
+# Encryption key for Edge Gateway communication (must be exactly 32 hex chars)
+openssl rand -hex 16
+# Example output: 822d3d1e0e2d849263e45fc7bb842364
+
+# gRPC auth token (for hub-spoke communication)
+openssl rand -hex 16
+# Example output: 9f2c4a6b8d0e1f3a5c7d9e1b3a5c7d9e
+```
+
+Save these values — you will need them for both the AI Studio and Edge Gateway configuration files.
+
+## Instructions
+
+### 1. Create Directory Structure
+
+Create a new directory for your project and set up the required folders:
+
+```bash
+mkdir -p tyk-ai-studio/confs
+mkdir -p tyk-ai-studio/studio-data
+mkdir -p tyk-ai-studio/mgw-data
+mkdir -p tyk-ai-studio/mgw-plugins
+cd tyk-ai-studio
+```
+
+### 2. Create `compose.yaml`
+
+Create a `compose.yaml` file with the following content. This configuration sets up AI Studio, the Edge Gateway, and a PostgreSQL database.
+
+```yaml Expandable
+networks:
+  tyk-network:
+
+services:
+  tyk-ai-studio:
+    image: tykio/tyk-ai-studio-ent:v2.0.0
+    networks:
+      - tyk-network
+    volumes:
+      - ./confs/studio.env:/opt/tyk-ai-studio/.env
+      - ./studio-data:/opt/tyk-ai-studio/data
+    env_file:
+      - ./confs/studio.env
+    depends_on:
+      postgres:
+        condition: service_healthy
+    ports:
+      - "8080:8080"   # Admin UI + REST API
+      - "9090:9090"   # Embedded AI Gateway
+    restart: always
+
+  microgateway:
+    image: tykio/tyk-microgateway-ent:v2.0.0
+    networks:
+      - tyk-network
+    volumes:
+      - ./confs/microgateway.env:/opt/tyk-microgateway/.env
+      - ./confs/analytics-pulse.yaml:/opt/tyk-microgateway/analytics-pulse.yaml
+      - ./mgw-data:/opt/tyk-microgateway/data
+      - ./mgw-plugins:/var/lib/microgateway
+    env_file:
+      - ./confs/microgateway.env
+    depends_on:
+      tyk-ai-studio:
+        condition: service_started
+    ports:
+      - "9091:8080"   # AI Gateway (external 9091 -> internal 8080)
+    restart: always
+
+  postgres:
+    image: postgres:16
+    networks:
+      - tyk-network
+    environment:
+      POSTGRES_USER: tyk
+      POSTGRES_PASSWORD: your-db-password
+      POSTGRES_DB: tyk_ai_studio
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U tyk -d tyk_ai_studio"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: always
+
+volumes:
+  pgdata:
+```
+
+### 3. Create `confs/studio.env`
+
+Create the AI Studio configuration file. Replace the `CHANGE-ME` values with the secrets you generated earlier, and add your Tyk AI License key.
+
+```env Expandable
+# =============================================================================
+# Core Settings
+# =============================================================================
+DEVMODE=true  # Set to false when using HTTPS; required for login over plain HTTP
+ALLOW_REGISTRATIONS=true
+SITE_URL=http://localhost:8080
+ADMIN_EMAIL=admin@example.com
+FROM_EMAIL=noreply@example.com
+
+# =============================================================================
+# Database
+# =============================================================================
+DATABASE_TYPE=postgres
+DATABASE_URL=postgresql://tyk:your-db-password@postgres:5432/tyk_ai_studio?sslmode=disable
+
+# =============================================================================
+# Security — CHANGE THESE (use values from "Generate Secrets" above)
+# =============================================================================
+TYK_AI_SECRET_KEY=CHANGE-ME-generate-with-openssl-rand-hex-16
+MICROGATEWAY_ENCRYPTION_KEY=CHANGE-ME-generate-with-openssl-rand-hex-16
+
+# =============================================================================
+# Hub-Spoke: Control Plane Mode
+# =============================================================================
+GATEWAY_MODE=control
+GRPC_PORT=50051
+GRPC_HOST=0.0.0.0
+GRPC_TLS_INSECURE=true
+GRPC_AUTH_TOKEN=CHANGE-ME-generate-with-openssl-rand-hex-16
+
+# =============================================================================
+# Proxy — Point to external Edge Gateway URL
+# =============================================================================
+PROXY_URL=http://localhost:9091
+TOOL_DISPLAY_URL=http://localhost:9091
+DATASOURCE_DISPLAY_URL=http://localhost:9091
+
+# =============================================================================
+# Logging
+# =============================================================================
+LOG_LEVEL=info
+
+# =============================================================================
+# Enterprise Edition — REQUIRED for EE images, must be set before first start
+# =============================================================================
+TYK_AI_LICENSE=your-license-key
+
+# =============================================================================
+# Plugin Marketplace (Optional — enables browsing and installing plugins)
+# =============================================================================
+# AI_STUDIO_OCI_CACHE_DIR must be set to enable the marketplace.
+# Without it, the Marketplace page will be empty.
+AI_STUDIO_OCI_CACHE_DIR=./data/cache/plugins
+AI_STUDIO_OCI_REQUIRE_SIGNATURE=false  # cosign not available in distroless images
+
+# =============================================================================
+# SMTP (Optional — required for email invites/notifications)
+# =============================================================================
+# SMTP_SERVER=smtp.example.com
+# SMTP_PORT=587
+# SMTP_USER=apikey
+# SMTP_PASS=your-smtp-password
+```
+
+### 4. Create `confs/microgateway.env`
+
+Create the Edge Gateway configuration file. Ensure the security tokens match the ones used in `studio.env`.
+
+```env Expandable
+# =============================================================================
+# Server Configuration
+# =============================================================================
+PORT=8080
+HOST=0.0.0.0
+READ_TIMEOUT=300s
+WRITE_TIMEOUT=300s
+SHUTDOWN_TIMEOUT=30s
+
+# =============================================================================
+# Database (SQLite — default for edge deployments)
+# =============================================================================
+DATABASE_TYPE=sqlite
+DATABASE_DSN=file:./data/edge.db?cache=shared&mode=rwc
+DB_AUTO_MIGRATE=true
+
+# =============================================================================
+# Hub-Spoke: Edge Mode
+# =============================================================================
+GATEWAY_MODE=edge
+CONTROL_ENDPOINT=tyk-ai-studio:50051
+EDGE_ID=edge-1
+EDGE_NAMESPACE=default
+EDGE_HEARTBEAT_INTERVAL=30s
+EDGE_ALLOW_INSECURE=true
+EDGE_TLS_ENABLED=false
+
+# =============================================================================
+# Security — MUST MATCH AI Studio values
+# =============================================================================
+EDGE_AUTH_TOKEN=CHANGE-ME-must-match-studio-GRPC_AUTH_TOKEN
+ENCRYPTION_KEY=CHANGE-ME-must-match-studio-MICROGATEWAY_ENCRYPTION_KEY
+
+# =============================================================================
+# Gateway
+# =============================================================================
+GATEWAY_TIMEOUT=300s
+GATEWAY_ENABLE_FILTERS=true
+GATEWAY_ENABLE_ANALYTICS=true
+
+# =============================================================================
+# Analytics
+# =============================================================================
+ANALYTICS_ENABLED=true
+ANALYTICS_BUFFER_SIZE=1000
+ANALYTICS_FLUSH_INTERVAL=10s
+ANALYTICS_RETENTION_DAYS=90
+
+# =============================================================================
+# Analytics Pulse Plugin (sends data to control plane)
+# =============================================================================
+PLUGINS_CONFIG_PATH=/opt/tyk-microgateway/analytics-pulse.yaml
+
+# =============================================================================
+# Cache
+# =============================================================================
+CACHE_ENABLED=true
+CACHE_TTL=1h
+
+# =============================================================================
+# Logging
+# =============================================================================
+LOG_LEVEL=info
+
+# =============================================================================
+# OCI Plugin Support
+# =============================================================================
+OCI_PLUGINS_CACHE_DIR=/var/lib/microgateway/plugins
+OCI_PLUGINS_REQUIRE_SIGNATURE=false  # cosign not available in distroless images
+
+# =============================================================================
+# Enterprise Edition — REQUIRED for EE images, must be set before first start
+# =============================================================================
+TYK_AI_LICENSE=your-license-key
+```
+
+### 5. Create `confs/analytics-pulse.yaml`
+
+This configures the Edge Gateway to send analytics data back to the AI Studio control plane:
+
+```yaml Expandable
+version: "1.0"
+
+data_collection_plugins:
+  - name: "analytics_pulse"
+    enabled: true
+    hook_types: ["analytics", "budget", "proxy_log"]
+    replace_database: false
+    priority: 100
+    config:
+      interval_seconds: 10
+      max_batch_size: 1000
+      max_buffer_size: 10000
+      compression_enabled: true
+      include_proxy_summaries: true
+      include_request_response_data: true
+      edge_retention_hours: 24
+      excluded_vendors: ["mock", "test"]
+      timeout_seconds: 30
+      max_retries: 3
+      retry_interval_secs: 5
+```
+
+### 6. Start Services
+
+<Note>
+**Important:** Make sure all configuration files (`studio.env`, `microgateway.env`, `analytics-pulse.yaml`) exist before running `docker compose up`. If a file-mounted volume target does not exist, Docker will create it as a directory, causing errors.
+</Note>
+
+Start the services using Docker Compose:
+
+```bash
+docker compose up -d
+```
+
+### 7. Verify
+
+Check that all services are running correctly:
+
+```bash
+# Check all services are running
+docker compose ps
+
+# Check AI Studio is responding
+curl -s http://localhost:8080/health
+
+# Check Edge Gateway is responding
+curl -s http://localhost:9091/health
+
+# Check AI Studio logs for successful edge connection
+docker compose logs tyk-ai-studio | grep -i "edge\|grpc"
+```
+
+### Accessing the Portal
+
+Once the services are running, you can access the different components:
+
+- **AI Studio UI**: `http://localhost:8080`
+- **Embedded Gateway**: `http://localhost:9090`
+- **Edge Gateway**: `http://localhost:9091`
+
+## First User Registration
+
+After starting the service, you need to create your first admin user:
+
+1. **Access the application**: Open your browser and navigate to `http://localhost:8080`
+2. **Register with admin email**: Use the EXACT email address you set in the `ADMIN_EMAIL` environment variable in `studio.env`.
+3. **Complete registration**: The first user who registers with the admin email will automatically become the administrator.
+
+<Note>
+**Important**: The first user registration must use the same email address specified in the `ADMIN_EMAIL` environment variable. This user will have full administrative privileges.
+</Note>
+
+## Shared Secrets Reference
+
+These values **must match** between the AI Studio and Edge Gateway configuration files:
+
+| AI Studio Variable | Edge Gateway Variable | Purpose |
+|---|---|---|
+| `GRPC_AUTH_TOKEN` | `EDGE_AUTH_TOKEN` | Authenticates the gRPC connection |
+| `MICROGATEWAY_ENCRYPTION_KEY` | `ENCRYPTION_KEY` | Encrypts synced configuration data |
+| `TYK_AI_LICENSE` | `TYK_AI_LICENSE` | Enterprise license |
+
+## Port Reference
+
+| Port | Component | Purpose |
+|------|-----------|---------|
+| 8080 | AI Studio | Admin UI + REST API |
+| 9090 | AI Studio | Embedded AI Gateway |
+| 50051 | AI Studio | gRPC control server (internal) |
+| 9091 | Edge Gateway | Edge AI Gateway (mapped from internal 8080) |
+| 5432 | PostgreSQL | Database |
+
+## Using an External Database
+
+To use an existing PostgreSQL instance instead of the bundled container, remove the `postgres` service and `pgdata` volume from `compose.yaml`, then update `studio.env`:
+
+```env
+DATABASE_TYPE=postgres
+DATABASE_URL=postgresql://user:password@your-db-host:5432/tyk_ai_studio?sslmode=require
+```
+
+## Upgrading
+
+To upgrade to a newer version:
+
+```bash
+docker compose pull
+docker compose up -d
+```
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="Services fail to start">
+
+Check the logs for specific services:
+
+```bash
+docker compose logs <service-name>
+````
+
+</Accordion>
+
+<Accordion title="Edge Gateway cannot connect to AI Studio">
+
+* Verify `CONTROL_ENDPOINT` in `microgateway.env` matches the AI Studio service name and gRPC port (e.g., `tyk-ai-studio:50051`)
+* Verify `EDGE_AUTH_TOKEN` matches `GRPC_AUTH_TOKEN`
+* Verify `ENCRYPTION_KEY` matches `MICROGATEWAY_ENCRYPTION_KEY`
+* Check that `GATEWAY_MODE=control` is set in `studio.env`
+
+</Accordion>
+
+<Accordion title="Database connection errors">
+
+* Ensure the `postgres` container is healthy: `docker compose ps`
+* Verify `DATABASE_URL` credentials match the `POSTGRES_USER` / `POSTGRES_PASSWORD` in `compose.yaml`
+* For external databases, verify network connectivity and SSL mode
+
+</Accordion>
+
+<Accordion title="Marketplace page is empty">
+
+The Plugin Marketplace requires `AI_STUDIO_OCI_CACHE_DIR` to be set. Without it, the marketplace service does not start and no plugins will appear. Add this to your `studio.env`:
+
+```env
+AI_STUDIO_OCI_CACHE_DIR=./data/cache/plugins
+```
+
+Restart AI Studio after making this change.
+
+The marketplace is enabled by default (`MARKETPLACE_ENABLED=true`), but it will not function without the OCI cache directory configured.
+
+</Accordion>
+
+<Accordion title="Port conflicts">
+
+If ports **8080, 9090, or 9091** are already in use, change the **left-hand side** of the port mapping in `compose.yaml`:
+
+```yaml
+ports:
+  - "8585:8080"   # Map to 8585 instead of 8080
+```
+
+Then update `SITE_URL` in `studio.env` accordingly.
+
+</Accordion>
+
+</AccordionGroup>
diff --git a/ai-management/ai-studio/secrets.mdx b/ai-management/ai-studio/secrets.mdx
new file mode 100644
index 0000000000..90a54eacba
--- /dev/null
+++ b/ai-management/ai-studio/secrets.mdx
@@ -0,0 +1,73 @@
+---
+title: "Manage Secrets in Tyk AI Studio"
+description: "How to configure secret management in Tyk AI Studio?"
+keywords: "AI Studio, AI Management, Secret Management"
+sidebarTitle: "Secrets Management"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio provides a secure mechanism for storing and managing sensitive information, such as API keys, passwords, authentication tokens, or other credentials required by various platform configurations.
+
+## Purpose
+
+The Secrets Management system aims to:
+
+*   **Prevent Exposure:** Avoid hardcoding sensitive values directly in configuration files or UI fields.
+*   **Centralize Management:** Provide a single place to manage and update credentials.
+*   **Enhance Security:** Store sensitive data encrypted at rest.
+
+## Core Concepts
+
+*   **Secret:** A named key-value pair where the 'key' is the **Variable Name** used for reference, and the 'value' is the actual sensitive data (e.g., an API key string).
+
+*   **Encryption:**
+    *   Secret values are **encrypted at rest** within Tyk AI Studio's storage.
+    *   The encryption and decryption process relies on a key derived from the **`TYK_AI_SECRET_KEY` environment variable** set when running the Tyk AI Studio instance.
+    *   **CRITICAL:** The `TYK_AI_SECRET_KEY` must be kept confidential and managed securely. Loss of this key will render existing secrets unusable. Changing the key will require re-entering all secrets.
+
+*   **Reference Syntax:** Secrets are referenced within configuration fields (like API key fields in LLM or Tool setups) using a specific syntax:
+    ```
+    $SECRET/VariableName
+    ```
+    Replace `VariableName` with the exact name given to the secret when it was created (e.g., `$SECRET/OPENAI_API_KEY`, `$SECRET/JIRA_AUTH_TOKEN`).
+
+*   **Runtime Resolution:** When a configuration uses a field containing a secret reference (e.g., `$SECRET/MY_KEY`):
+    1.  The configuration itself stores the `$SECRET/MY_KEY` string, *not* the actual secret value.
+    2.  Only when the system needs the actual value at runtime (e.g., the [Proxy](/ai-management/ai-studio/proxy) preparing a request for an LLM, or a [Tool](/ai-management/ai-studio/tools) calling its external API), Tyk AI Studio retrieves the encrypted secret value, decrypts it using the `TYK_AI_SECRET_KEY`, and injects the plain text value into the operation.
+    3.  The decrypted value is typically used immediately and not persisted further.
+
+## Creating & Managing Secrets (Admin)
+
+Administrators manage secrets via the Tyk AI Studio UI or API:
+
+1.  Navigate to the Secrets management section.
+2.  Create a new secret by providing:
+    *   **Variable Name:** A unique identifier (letters, numbers, underscores) used in the `$SECRET/VariableName` reference.
+    *   **Secret Value:** The actual sensitive string (e.g., `sk-abc123xyz...`).
+3.  Save the secret. It is immediately encrypted and stored.
+
+    <img src="/img/ai-management/secrets-management-ui.png" alt="Secrets UI" />
+
+Secrets can be updated or deleted as needed. Updating a secret value will automatically apply the new value wherever the `$SECRET/VariableName` reference is used, without needing to modify the configurations themselves.
+
+## Usage Examples
+
+Secrets are commonly used in:
+
+*   **[LLM Configurations](/ai-management/ai-studio/llm-management):** Storing API keys for providers like OpenAI, Anthropic, Google Vertex AI, etc.
+    *   *Example:* In the API Key field for an OpenAI configuration: `$SECRET/OPENAI_API_KEY`
+*   **[Tool Configurations](/ai-management/ai-studio/tools):** Storing API keys, authentication tokens (Bearer, Basic Auth), or other credentials needed to interact with the external API the tool represents.
+    *   *Example:* In a field for a custom header for a JIRA tool: `Authorization: Basic $SECRET/JIRA_BASIC_AUTH_TOKEN`
+*   **[Data Source Configurations](/ai-management/ai-studio/datasources-rag):** Storing API keys or connection credentials for vector databases (e.g., Pinecone, Milvus) or embedding service providers.
+    *   *Example:* In the API Key field for a Pinecone vector store: `$SECRET/PINECONE_API_KEY`
+
+## Security Considerations
+
+*   **Protect `TYK_AI_SECRET_KEY`:** This is the master key for secrets. Treat it with the same level of security as database passwords or root credentials. Use environment variable management best practices.
+*   **Principle of Least Privilege:** Grant administrative access (which includes secrets management) only to trusted users.
+*   **Regular Rotation:** Consider policies for regularly rotating sensitive credentials by updating the Secret Value in Tyk AI Studio.
diff --git a/ai-management/ai-studio/sso.mdx b/ai-management/ai-studio/sso.mdx
new file mode 100644
index 0000000000..db04005730
--- /dev/null
+++ b/ai-management/ai-studio/sso.mdx
@@ -0,0 +1,77 @@
+---
+title: "SSO Integration"
+description: "How to configure SSO in Tyk AI Studio?"
+keywords: "AI Studio, AI Management, Single Sign On"
+sidebarTitle: "SSO Integration"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio supports Single Sign-On (SSO) integration, allowing users to authenticate using their existing credentials from external Identity Providers (IdPs). This simplifies login, enhances security, and centralizes user management.
+
+## Purpose
+
+The SSO integration aims to:
+
+*   Allow users to log in to Tyk AI Studio using their familiar corporate or social identity credentials.
+*   Eliminate the need for separate Tyk AI Studio-specific passwords.
+*   Improve security by leveraging the organization's existing IdP infrastructure and policies (e.g., MFA).
+*   Streamline user provisioning and de-provisioning (depending on IdP capabilities and configuration).
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/vn2ZfY9couw" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+
+## Technology: Tyk Identity Broker (TIB)
+
+Tyk AI Studio leverages the embedded **Tyk Identity Broker (TIB)** component to handle SSO integrations. TIB acts as a bridge between Tyk AI Studio (the Service Provider or SP) and various external Identity Providers (IdPs).
+
+## Supported Protocols & Providers
+
+TIB enables Tyk AI Studio to integrate with IdPs supporting standard protocols, including:
+
+*   **OpenID Connect (OIDC):** Commonly used by providers like Google, Microsoft Entra ID (Azure AD), Okta, Auth0.
+*   **SAML 2.0:** Widely used in enterprise environments (e.g., Okta, Ping Identity, ADFS).
+*   **LDAP:** For integration with traditional directory services like Active Directory.
+*   **Social Logins:** Providers like GitHub, GitLab, etc. (often via OIDC).
+
+## Configuration (Admin)
+
+Administrators configure SSO providers within the Tyk AI Studio administration interface (likely via TIB's configuration settings exposed through Tyk AI Studio):
+
+1.  **Select Protocol:** Choose the appropriate protocol (OIDC, SAML, etc.).
+2.  **Provider Details:** Enter the specific configuration details required by the chosen protocol and IdP.
+    *   **OIDC Example:** Client ID, Client Secret, Issuer URL, Discovery Endpoint.
+    *   **SAML Example:** IdP SSO URL, IdP Issuer/Entity ID, IdP Public Certificate, SP Entity ID (Tyk AI Studio's identifier).
+3.  **Profile Mapping:** Configure how attributes received from the IdP (e.g., email, name, group memberships) map to Tyk AI Studio user profiles.
+    *   Identify which IdP attribute contains the unique user identifier (e.g., `email`, `sub`, `preferred_username`).
+    *   Map IdP attributes to Tyk AI Studio user fields (e.g., `given_name` -> First Name, `family_name` -> Last Name).
+4.  **Group Mapping (Optional but Recommended):** Configure rules to automatically assign users to Tyk AI Studio [Groups](/ai-management/ai-studio/user-management) based on group information received from the IdP.
+    *   *Example:* If the IdP sends a `groups` claim containing "Tyk AI Studio Admins", map this to automatically add the user to the "Administrators" group in Tyk AI Studio.
+5.  **Enable Provider:** Activate the configured IdP for user login.
+
+    <img src="/img/ai-management/sso-config-ui.png" alt="SSO Config UI" />
+
+## Login Flow
+
+When SSO is enabled:
+
+1.  User navigates to the Tyk AI Studio login page.
+2.  User clicks a button like "Login with [Your IdP Name]" (e.g., "Login with Google", "Login with Okta").
+3.  User is redirected to the external IdP's login page.
+4.  User authenticates with the IdP (using their corporate password, MFA, etc.).
+5.  Upon successful authentication, the IdP redirects the user back to Tyk AI Studio (via TIB) with an authentication assertion (e.g., OIDC ID token, SAML response).
+6.  TIB validates the assertion and extracts user profile information.
+7.  Tyk AI Studio finds an existing user matching the unique identifier or provisions a new user account based on the received profile information (Just-In-Time Provisioning).
+8.  Group memberships may be updated based on configured mapping rules.
+9.  The user is logged into Tyk AI Studio.
+
+## Benefits
+
+*   **Improved User Experience:** One less password to remember.
+*   **Enhanced Security:** Leverages established IdP security policies.
+*   **Centralized Control:** User access can often be managed centrally via the IdP.
+*   **Simplified Onboarding/Offboarding:** User access to Tyk AI Studio can be tied to their status in the central IdP.
diff --git a/ai-management/ai-studio/studio-admin.mdx b/ai-management/ai-studio/studio-admin.mdx
new file mode 100644
index 0000000000..c8697f1a15
--- /dev/null
+++ b/ai-management/ai-studio/studio-admin.mdx
@@ -0,0 +1,40 @@
+---
+title: "AI Studio Administrator"
+description: "Overview of the AI Studio Administrator persona in Tyk AI Studio"
+keywords: "AI Studio, Admin, Governance, Cost Management, Security"
+sidebarTitle: "Overview"
+---
+
+The **AI Studio Administrator** is the primary manager of the Tyk AI Studio installation. This persona is responsible for the operational integrity, security, and financial governance of the AI platform. They ensure that AI resources are available, secure, and used within budget.
+
+## Lifecycle
+
+The typical lifecycle of an AI Studio Administrator involves four key stages:
+
+1.  **Configure**: Setting up the fundamental infrastructure, including connecting to [LLM Providers](/ai-management/ai-studio/llm-management) (e.g., OpenAI, Anthropic) and configuring [Vector Databases](/ai-management/ai-studio/datasources-rag) for RAG.
+2.  **Govern**: Establishing global guardrails, such as [Policies](/ai-management/ai-studio/filters) for PII masking, rate limiting, and role-based access control (RBAC).
+3.  **Onboard**: Creating [Teams](/ai-management/ai-studio/teams) and [Users](/ai-management/ai-studio/user-management), assigning roles, and allocating resource quotas.
+4.  **Monitor**: Continuously tracking organization-wide token usage, enforcing [Budgets](/ai-management/ai-studio/budgeting), and auditing security alerts via the [Dashboard](/ai-management/ai-studio/analytics).
+
+## Core Features
+
+### Provider Management
+Centralized management of LLM credentials and configurations. Admins can add, update, or deprecate models from providers like OpenAI, Anthropic, or Mistral without requiring changes to consumer applications.
+*   **Key Capability**: Unified API key management (stored as [Secrets](/ai-management/ai-studio/secrets)) to prevent credential sprawl.
+
+### Policy & Security
+Enforcement of global security and compliance rules.
+*   **PII Detection**: Automatically redact sensitive information (credit cards, emails) from prompts before they reach the LLM.
+*   **RBAC**: Granular control over which teams can access specific models or tools.
+*   **Rate Limiting**: Protect upstream provider quotas by limiting requests per user or app.
+
+### Cost Management
+Comprehensive financial controls to prevent "bill shock."
+*   **Budgets**: Set monthly spending limits at the Organization, Team, or App level.
+*   **Alerts**: Receive notifications when spending approaches defined thresholds (e.g., 80% of budget).
+*   **Chargeback Reporting**: Detailed analytics to attribute costs to specific teams or projects.
+
+### Audit Logs
+Full traceability of system access and configuration changes.
+*   **Access Logs**: Track who accessed which model and when.
+*   **Configuration History**: Audit trail of changes to policies, budgets, and provider settings.
diff --git a/ai-management/ai-studio/teams.mdx b/ai-management/ai-studio/teams.mdx
new file mode 100644
index 0000000000..22d2182a0e
--- /dev/null
+++ b/ai-management/ai-studio/teams.mdx
@@ -0,0 +1,62 @@
+---
+title: "Manage Teams in Tyk AI Studio"
+description: "Understand how to use Teams in Tyk AI Studio to organize users and manage role-based access control (RBAC) for LLM providers, data sources, and tools."
+keywords: "AI Studio, AI Management, Teams"
+sidebarTitle: "Teams"
+---
+
+## Availability
+
+| Edition | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+Teams in Tyk AI Studio help you organize [Users](/ai-management/ai-studio/users) and easily manage their access to [LLM providers](/ai-management/ai-studio/llm-management), [data sources](/ai-management/ai-studio/datasources-rag), and [tools](/ai-management/ai-studio/tools). By linking Teams to specific [Catalogs](/ai-management/ai-studio/catalogs), you ensure users access only the AI resources relevant to their role.
+
+```mermaid
+graph LR
+    User1[User: Alice] --> TeamA[Team: Developers]
+    User2[User: Bob] --> TeamA
+    User3[User: Charlie] --> TeamB[Team: Support]
+    
+    TeamA -->|Access| LLMCat[LLM Catalog: GPT-4]
+    TeamA -->|Access| ToolCat[Tool Catalog: Code Search]
+    
+    TeamB -->|Access| LLMCat2[LLM Catalog: Claude]
+    TeamB -->|Access| DataCat[Data Catalog: KB Articles]
+```
+
+### Use cases
+- **Role-Based Access Control**: Group developers into an "Engineering" Team and grant them access to advanced LLM models and coding tools, while grouping support staff into a "Support" Team with access to customer knowledge bases.
+- **Resource Isolation**: Ensure that sensitive data sources (like HR documents) are only accessible to the "HR" Team by linking the specific data [Catalog](/ai-management/ai-studio/catalogs) only to that Team.
+- **Simplified Onboarding**: When a new employee joins, simply add them to the relevant Team to automatically grant them access to all the necessary AI tools and models for their department.
+
+### Community vs Enterprise Edition
+In the **Community Edition**, the Teams feature is not available for custom configuration. Instead, there is a single, built-in **"Default" Team**. All users are automatically assigned to this Default Team, and it is permanently linked to the default catalogs.
+
+In the **Enterprise Edition**, you have full access to create, manage, and delete custom Teams, allowing for granular Role-Based Access Control (RBAC) across your organization. Note that even in the Enterprise Edition, the "Default" Team cannot be deleted.
+
+## What is a Team?
+
+A Team acts as the central access control mechanism in Tyk AI Studio. Instead of assigning permissions to individual [Users](/ai-management/ai-studio/users), administrators assign [Catalogs](/ai-management/ai-studio/catalogs) (LLM providers, Data sources, and Tools) to a Team. Users are then added as members of the Team.
+
+This architecture simplifies permission management, as a user's access rights are dynamically inherited from their Team memberships. A user can belong to multiple Teams, and a Team can have multiple Catalogs of different types.
+
+## Configuration
+When configuring a Team, the following options are available:
+- **Team Name**: A descriptive name for the Team (e.g., "Solutions Architects", "Marketing").
+- **Manage Team Members**: An interface to search and add existing users to the Team, or remove current members.
+- **Add Catalogs**: Sections to link the Team to specific catalogs:
+  - **LLM providers catalogs**: Grants access to specific AI models.
+  - **Data sources catalogs**: Grants access to specific datasets or knowledge bases.
+  - **Tools catalogs**: Grants access to specific tools (e.g., web search, calculators).
+
+## How to Create a Team
+To create a new Team in Tyk AI Studio:
+1. Navigate to the **Teams** section in the AI Studio dashboard.
+2. Click on the **Create team** button.
+3. Enter a descriptive **Team name**.
+4. In the **Manage team members** section, search for existing [Users](/ai-management/ai-studio/users) and add them to the Team.
+5. In the **Add catalogs** section, select one or more [Catalogs](/ai-management/ai-studio/catalogs) (LLM providers, Data sources, or Tools) to make them available to this Team.
+6. Click **Save** to create the Team and apply the access rules.
+
+  <img src="/img/ai-management/ai-admin-team.png" alt="Create Team Form" />
\ No newline at end of file
diff --git a/ai-management/ai-studio/telemetry.mdx b/ai-management/ai-studio/telemetry.mdx
new file mode 100644
index 0000000000..50e78755d2
--- /dev/null
+++ b/ai-management/ai-studio/telemetry.mdx
@@ -0,0 +1,41 @@
+---
+title: "Telemetry for Tyk AI Studio"
+description: "How to configure telemetry in Tyk AI Studio?"
+keywords: "AI Studio, AI Management, Telemetry"
+sidebarTitle: "Telemetry"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio collects anonymized usage statistics to help improve the product and understand how features are being used.
+
+## What Data is Collected
+
+The telemetry system collects aggregate statistics every hour such as:
+
+- **User counts** by type (admin, developer, chat users)
+- **LLM model counts** and token usage
+- **Application counts** and proxy usage
+- **Chat counts** and interaction statistics
+- **team counts**
+
+**No personal data, content, or sensitive information is collected.**
+
+## Privacy & Security
+
+All data is **anonymized** before transmission to ensure user privacy. The system does **not collect any personally identifiable information (PII)**, and **no chat content, prompts, or responses** are ever transmitted. 
+
+Additionally, **API keys and credentials are never included** in telemetry data. To further protect privacy, instance identifiers are **hashed and rotated daily**. All telemetry data is securely transmitted over **HTTPS** to `https://telemetry.tyk.technology`.
+
+## Disabling Telemetry
+
+Telemetry is **enabled by default** but can be disabled by setting the following environment variable:
+
+```bash
+TELEMETRY_ENABLED=false
+```
+
diff --git a/ai-management/ai-studio/tools.mdx b/ai-management/ai-studio/tools.mdx
new file mode 100644
index 0000000000..9597747abf
--- /dev/null
+++ b/ai-management/ai-studio/tools.mdx
@@ -0,0 +1,95 @@
+---
+title: "Manage Tools in Tyk AI Studio"
+description: "Discover how to extend LLM capabilities in Tyk AI Studio by integrating external APIs and services using the Tool System and OpenAPI specifications."
+keywords: "AI Studio, AI Management, Tools"
+sidebarTitle: "Tools & Extensibility"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio's Tool System allows Large Language Models (LLMs) to interact with external APIs and services, dramatically extending their capabilities beyond simple text generation. This enables LLMs to perform actions, retrieve real-time data, and integrate with other systems.
+
+## Purpose
+
+Tools bridge the gap between conversational AI and external functionalities. By defining tools, you allow LLMs interacting via the [Chat Interface](/ai-management/ai-studio/chat-interface) or API to:
+
+*   Access real-time information (e.g., weather, stock prices, database records).
+*   Interact with other software (e.g., search JIRA tickets, update CRM records, trigger webhooks).
+*   Perform complex calculations or data manipulations using specialized services.
+
+## Core Concepts
+
+*   **Tool Definition:** A Tool in Tyk AI Studio is essentially a wrapper around an external API. Its structure and available operations are defined using an **OpenAPI Specification (OAS)** (v3.x, JSON or YAML).
+*   **Allowed Operations:** From the provided OAS, administrators select the specific `operationIds` that the LLM is permitted to invoke. This provides granular control over which parts of an API are exposed.
+*   **Authentication:** Tools often require authentication to access the target API. Tyk AI Studio handles this securely by integrating with [Secrets Management](/ai-management/ai-studio/secrets). You configure the authentication method (e.g., Bearer Token, Basic Auth) defined in the OAS and reference a stored Secret containing the actual credentials.
+*   **Privacy Levels:** Each Tool is assigned a privacy level. This level is compared against the privacy level of the [LLM Configuration](/ai-management/ai-studio/llm-management) being used. A Tool can only be used if its privacy level is less than or equal to the LLM's level, preventing sensitive tools from being used with potentially less secure or external LLMs.
+
+    Privacy levels define how data is protected by controlling LLM access based on its sensitivity:
+    - **Public (0)** – Safe to share (e.g., blogs, press releases).
+    - **Internal (25)** – Company-only info (e.g., reports, policies).
+    - **Confidential (50)** – Sensitive business data (e.g., financials, strategies).
+    - **Restricted/PII (100)** – Personal data (e.g., names, emails, customer info).
+
+    *Note: Privacy levels are stored as integer scores in the system. The values shown in parentheses are the typical score mappings.*
+*   **Tool Catalogues:** Tools are grouped into logical collections called Catalogues. This simplifies management and access control.
+*   **Filters:** Optional [Filters](/ai-management/ai-studio/filters) can be applied to tool interactions to pre-process requests sent to the tool or post-process responses received from it (e.g., for data sanitization).
+*   **Documentation:** Administrators can provide additional natural language documentation or instructions specifically for the LLM, guiding it on how and when to use the tool effectively.
+*   **Dependencies:** Tools can declare dependencies on other tools, although the exact usage pattern might vary.
+
+## Availability
+
+Tools are available on both **AI Studio** (embedded gateway) and **Edge Gateway** (edge gateways). Tool configurations, OpenAPI specs, auth credentials, and app access associations are synced to edge gateways via the hub-spoke configuration system. Tools support namespace filtering for enterprise multi-tenant deployments.
+
+Tools are accessible in three ways:
+
+1. **Chat Interface** — LLMs invoke tools automatically during conversations (the primary use case).
+2. **REST API** — Each tool is also available as a direct REST API endpoint for developers to call programmatically, independent of LLM interactions.
+3. **[MCP Interface](/ai-management/mcps/overview)** — An MCP-compliant shim wraps the OpenAPI-generated tools, providing an MCP-API compatible interface. This works with tools that require authentication and provides MCP compatibility without a separate MCP proxy server.
+## How it Works
+
+When a user interacts with an LLM via the [Chat Interface](/ai-management/ai-studio/chat-interface):
+
+1.  The LLM receives the user prompt and the definitions of available tools (based on team permissions and Chat Experience configuration).
+2.  If the LLM determines that using one or more tools is necessary to answer the prompt, it generates a request to invoke the specific tool operation(s) with the required parameters.
+3.  Tyk AI Studio intercepts this request.
+4.  It validates the request, checks permissions, and retrieves necessary secrets for authentication.
+5.  Tyk AI Studio applies any configured request Filters.
+6.  It calls the external API defined by the Tool.
+7.  It receives the response from the external API.
+8.  Tyk AI Studio applies any configured response Filters.
+9.  It sends the tool's response back to the LLM.
+10. The LLM uses the tool's response to formulate its final answer to the user.
+
+## Creating & Managing Tools (Admin)
+
+Administrators define and manage Tools via the UI or API:
+
+1.  **Define Tool:** Provide a name, description, and privacy level.
+2.  **Upload OpenAPI Spec:** Provide the OAS document (JSON/YAML).
+3.  **Select Operations:** Choose the specific `operationIds` the LLM can use.
+4.  **Configure Authentication:** Select the OAS security scheme and link to a stored [Secret](/ai-management/ai-studio/secrets) for credentials.
+5.  **Add Documentation:** Provide natural language instructions for the LLM.
+6.  **Assign Filters (Optional):** Add request/response filters.
+
+    <img src="/img/ai-management/tool-configuration.png" alt="Tool Config" />
+
+## Organizing & Assigning Tools (Admin)
+
+*   **Create Catalogues:** Group related tools into Tool Catalogues (e.g., "CRM Tools", "Search Tools").
+*   **Assign to Teams:** Assign Tool Catalogues to specific [teams](/ai-management/ai-studio/user-management). This grants users in those groups *potential* access to the tools within the catalogue.
+
+    <img src="/img/ai-management/tool-catalog-config.png" alt="Catalogue Config" />
+
+## Using Tools (User)
+
+Tools become available to end-users within the [Chat Interface](/ai-management/ai-studio/chat-interface) if:
+
+1.  The specific Chat Experience configuration includes the relevant Tool Catalogue.
+2.  The user belongs to a Team that has been assigned that Tool Catalogue.
+3.  The Tool's privacy level is compatible with the LLM being used in the Chat Experience.
+
+The LLM will then automatically decide when to use these available tools based on the conversation.
diff --git a/ai-management/ai-studio/user-management.mdx b/ai-management/ai-studio/user-management.mdx
new file mode 100644
index 0000000000..d49dbdfe12
--- /dev/null
+++ b/ai-management/ai-studio/user-management.mdx
@@ -0,0 +1,89 @@
+---
+title: "User Management & RBAC"
+description: "How to configure user management in Tyk AI Studio?"
+keywords: "AI Studio, AI Management, User Management, RBAC"
+sidebarTitle: "Overview"
+---
+
+## Availability
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Tyk AI Studio includes a comprehensive system for managing users, their authentication methods, and controlling their access to platform resources using Teams and Role-Based Access Control (RBAC).
+
+## Purpose
+
+The User Management & RBAC system provides administrators with the tools to:
+
+*   Manage the lifecycle of user accounts.
+*   Define how users authenticate (UI sessions, API keys).
+*   Organize users into logical teams.
+*   Grant fine-grained access to Tyk AI Studio resources (LLMs, Tools, Data Sources, Chat Experiences) based on team membership.
+*   Assign platform-level permissions using roles.
+
+## Core Concepts
+
+*   **User:** Represents an individual interacting with Tyk AI Studio. Users are typically identified by an email address or username and can be created manually by administrators, via invitation, self-registration (if enabled), or provisioned through [SSO Integration](/ai-management/ai-studio/sso).
+*   **Authentication:** The process of verifying a user's identity.
+    *   **Session-based:** For users logging into the Tyk AI Studio UI (using username/password or SSO).
+    *   **API Key:** For applications or scripts interacting with Tyk AI Studio APIs (like the [Proxy](/ai-management/ai-studio/proxy)).
+*   **API Key:** A unique, long-lived token generated by a user. Applications use this key (typically in an `Authorization: Bearer <key>` header) to authenticate requests on behalf of the user who generated it.
+*   **[Team](/ai-management/ai-studio/teams):** A collection of users. Teams are the primary mechanism for assigning access rights to resources. A user can belong to multiple teams.
+*   **Resource:** Any entity within Tyk AI Studio whose access needs to be controlled. This includes:
+    *   [LLM Configurations](/ai-management/ai-studio/llm-management)
+    *   Tool Catalogues (collections of [Tools](/ai-management/ai-studio/tools))
+    *   Data Source Catalogues (collections of [Data Sources](/ai-management/ai-studio/datasources-rag))
+    *   Chat Experiences (configurations for the [Chat Interface](/ai-management/ai-studio/chat-interface))
+*   **Role:** Defines a set of broad, platform-level permissions. Common roles include:
+    *   **Admin:** Full access to configure and manage the Tyk AI Studio platform.
+    *   **Standard User:** Access to use assigned resources (e.g., chat, query LLMs) but limited or no administrative capabilities.
+*   **RBAC (Role-Based Access Control):** Tyk AI Studio's access control model. Access is granted primarily by assigning resource access to **Teams**, and then adding **Users** to those Teams. **Roles** provide overarching platform permissions.
+*   **User Entitlements:** The complete set of permissions a specific user has at any given time. This is calculated based on their assigned Role and the combined permissions granted through all the Teams they belong to. Systems like the Proxy check these entitlements before allowing an action.
+
+## User Lifecycle Management (Admin)
+
+Administrators manage users via the UI or API:
+
+*   **Creation:** Create user accounts manually, send invitations, or manage users provisioned via SSO.
+*   **Team Assignment:** Add or remove users from various Teams.
+*   **Role Assignment:** Assign a primary Role (e.g., Admin, Standard) to each user.
+*   **Status Management:** Activate or deactivate user accounts.
+*   **API Key Management:** Admins may have visibility into user API keys (though users typically generate their own).
+
+    <img src="/img/ai-management/user-management-ui.png" alt="User Management UI" />
+
+## Team Management (Admin)
+
+Teams are central to managing permissions:
+
+*   **Creation/Deletion:** Create and manage teams (e.g., "Developers", "Sales Team", "Product Docs Users").
+*   **User Assignment:** Add/remove users from teams.
+*   **Resource Assignment:** Grant access to specific LLM Configurations, Tool Catalogues, or Data Source Catalogues *to the team*. Any user in that team inherits this access.
+
+    <img src="/img/ai-management/group-management-ui.png" alt="Group Management UI" />
+
+## Authentication Methods
+
+*   **UI Login:** Users access the web interface by logging in with their credentials (username/password) or via a configured [SSO Provider](/ai-management/ai-studio/sso). This establishes a browser session.
+*   **API Key Authentication:**
+    1.  A user generates an API Key via their profile settings in the UI.
+    2.  The user securely provides this key to their application or script.
+    3.  The application includes the key in the `Authorization` header for requests to Tyk AI Studio APIs:
+        ```
+        Authorization: Bearer <your-ai-sudio-api-key>
+        ```
+    4.  Tyk AI Studio validates the key and associates the request with the user who generated it.
+
+## Access Control Flow Example (API Request)
+
+When an application makes a request to the [Proxy](/ai-management/ai-studio/proxy) using an API Key:
+
+1.  **Key Validation:** Tyk AI Studio validates the API Key.
+2.  **User Identification:** The system identifies the User associated with the key.
+3.  **Team Membership:** The system determines all Teams the User belongs to.
+4.  **Resource Check:** The request targets a specific resource (e.g., an LLM Configuration via its `routeId`).
+5.  **Permission Verification:** Tyk AI Studio checks if *any* of the user's Teams have been granted access to the requested resource.
+6.  **Entitlement Check:** Additional checks based on the user's Role and specific entitlements might occur (e.g., budget checks, model restrictions).
+7.  **Access Granted/Denied:** If all checks pass, the request proceeds; otherwise, it's denied (e.g., 401 Unauthorized or 403 Forbidden).
diff --git a/ai-management/ai-studio/users.mdx b/ai-management/ai-studio/users.mdx
new file mode 100644
index 0000000000..74a3eee8c2
--- /dev/null
+++ b/ai-management/ai-studio/users.mdx
@@ -0,0 +1,76 @@
+---
+title: "Manage Users in Tyk AI Studio"
+description: "Learn how to create and manage Users in Tyk AI Studio, including configuring roles, access permissions, and API keys for administrators, developers, and end-users."
+keywords: "AI Studio, AI Management, Users"
+sidebarTitle: "Users"
+---
+
+## Availability
+
+| Edition | Deployment Type |
+| :------------- | :---------------------- |
+| [Community](/ai-management/ai-studio/overview#community-edition) & [Enterprise](/ai-management/ai-studio/overview#enterprise-edition) | Self-Managed, Hybrid |
+
+Users in Tyk AI Studio represent individuals who interact with the platform. They can be administrators managing the system or consumers accessing the AI portal and chat interfaces.
+
+```mermaid
+graph TD
+    User[User] -->|Belongs to| Team[Team]
+    Team -->|Grants access to| LLMCatalog[LLM Catalog]
+    Team -->|Grants access to| DataCatalog[Data Catalog]
+    Team -->|Grants access to| ToolCatalog[Tool Catalog]
+    User -->|Has Role| Admin[Admin User]
+    User -->|Has Access| Portal[AI Portal]
+    User -->|Has Access| Chat[AI Chat]
+```
+
+### Use cases
+- **Administrative Management**: Super admins can create user accounts for other administrators to help manage AI Studio configurations, [Teams](/ai-management/ai-studio/teams), and [Catalogs](/ai-management/ai-studio/catalogs).
+- **Developer Access**: Developers can be granted access to the [AI Portal](/ai-management/ai-studio/ai-portal) to consume LLM APIs using their generated API keys.
+- **End-User Chat**: Non-technical users can be given access to the [AI Chat](/ai-management/ai-studio/chat-interface) interface to interact with approved LLMs and data sources safely.
+
+### Community vs Enterprise Edition
+In the **Community Edition**, basic user management is available, and all users are automatically assigned to a single, built-in "Default" [Team](/ai-management/ai-studio/teams). 
+In the **Enterprise Edition**, you can create multiple Teams, assign users to specific Teams for granular access control, and configure Single Sign-On (SSO) provisioning.
+
+## What is a User?
+
+A User in Tyk AI Studio is the fundamental identity for authentication and authorization. Each user has basic information (Name, Email, Password) and specific access flags. 
+
+Users do not directly get assigned to AI resources (like LLMs or Data Sources). Instead, their access is governed by the [Teams](/ai-management/ai-studio/teams) they belong to. When a user is added to a Team, they inherit access to all the [Catalogs](/ai-management/ai-studio/catalogs) associated with that Team.
+
+### Default Roles and the Initial User
+When setting up Tyk AI Studio, the very first user created is automatically granted the **Super Admin** role. This initial user is critical because they bypass standard authorization checks and are the only one who can configure SSO, set up the initial LLM providers, and create other administrative users.
+
+The available roles and access flags for users include:
+- **Super Admin**: Full access to all system configurations, including SSO and initial setup.
+- **Admin User**: Can manage AI Studio configurations, Teams, and Catalogs.
+- **Developer**: Typically granted access to the AI Portal to generate API keys and integrate with LLMs.
+- **End User**: Typically granted access only to the AI Chat interface.
+
+### API Key Generation
+Every user in Tyk AI Studio can generate an **API Key**. 
+
+**What is this API Key used for?**
+This API key is specifically used for programmatic access to the Tyk [AI Studio management APIs](/ai-management/ai-studio/ai-studio-swagger) (the Admin API) and the AI Portal.
+
+## Configuration
+When configuring a User, the following options are available:
+- **Name**: The full name of the user.
+- **Email**: The user's email address, used for login.
+- **Password**: The user's password for authentication.
+- **Admin User**: Grants the user administrative privileges to manage AI Studio.
+- **Show Portal**: Grants the user access to the AI Portal interface.
+- **Show Chat**: Grants the user access to the AI Chat interface.
+- **Email Verified**: Indicates if the user's email has been verified.
+
+## How to Create a User
+To create a new User in Tyk AI Studio:
+1. Navigate to the **Users** section in the AI Studio dashboard.
+2. Click on the **Add User** button.
+3. Fill in the required basic information: **Name**, **Email**, and **Password**.
+4. Configure the user's permissions by toggling the appropriate switches (e.g., **Admin User**, **Show Portal**, **Show Chat**).
+5. Click **Add User** to create the user.
+6. (Optional) After creation, you can view the user's details to generate or copy their API Key, or assign them to specific [Teams](/ai-management/ai-studio/teams).
+
+    <img src="/img/ai-management/ai-admin-user.png" alt="Create User Form" />
\ No newline at end of file
diff --git a/ai-management/mcp-gateway/core-concepts.mdx b/ai-management/mcp-gateway/core-concepts.mdx
new file mode 100644
index 0000000000..e732aa2ab5
--- /dev/null
+++ b/ai-management/mcp-gateway/core-concepts.mdx
@@ -0,0 +1,400 @@
+---
+title: "MCP Gateway: Core Concepts"
+description: "The technical foundation for working with Tyk's MCP Gateway: what MCP is, the gateway's role in the protocol flow, the session lifecycle, the proxy definition, middleware levels, and the policy model for per-consumer access control and rate limiting."
+keywords: "MCP, Model Context Protocol, MCP Gateway, MCP proxy, JSON-RPC, SSE, Server-Sent Events, Streamable HTTP, Tyk OAS, middleware, policies, mcp_primitives, mcp_access_rights, json_rpc_methods, x-tyk-api-gateway, initialize, tools/call, resources/read, prompts/get, MCP primitives"
+sidebarTitle: "Core Concepts"
+---
+
+
+This page covers the technical foundation for working with Tyk's MCP Gateway: the gateway's role in the protocol flow, the MCP protocol concepts it builds on, the session lifecycle, the proxy definition, middleware levels, and the policy model for per-consumer access control and rate limiting.
+
+## The gateway role
+
+Without a gateway, AI agents connect directly to MCP servers over HTTP. Each server is responsible for its own authentication, access control, and rate limiting, or has none at all. There is no central point to see which agents are calling which tools, no consistent way to revoke access, and no protection against a slow or unavailable server. For the full picture of why this creates operational risk at scale, see [MCP Gateway overview](/ai-management/mcp-gateway/overview).
+
+Tyk sits between MCP clients and your upstream MCP servers. Unlike a generic reverse proxy that treats all traffic as an opaque HTTP stream, Tyk understands the MCP protocol. It parses the JSON-RPC request body on every `POST /mcp` to identify the method being called and the specific primitive being accessed. This is what makes primitive-level control possible.
+
+Because Tyk knows that a particular request is a `tools/call` for `get_current_weather` (not just a `POST` to `/mcp`), it can:
+
+- Rate limit that tool independently, without affecting other tools on the same server
+- Block access to a specific resource URI without restricting the entire resources category
+- Enforce a timeout on a slow tool without affecting fast tools
+- Strip that tool from `tools/list` responses for consumers whose policy does not permit it
+- Record the exact tool name in analytics so you can see precisely which primitives agents are calling
+
+The fundamental difference from a REST proxy is how operations are identified. REST APIs use URL paths and HTTP methods: Tyk routes `GET /weather` differently from `GET /weather/forecast`. MCP routes all traffic through a single endpoint and identifies the operation from the request body:
+
+```text
+REST API (Tyk OAS):
+  GET  /weather             → weather current conditions
+  GET  /weather/forecast    → weather forecast
+
+MCP proxy (Tyk MCP):
+  POST /mcp  { "method": "tools/call", "params": { "name": "get-weather" } }
+  POST /mcp  { "method": "tools/call", "params": { "name": "get-forecast" } }
+```
+
+MCP proxies share the same authentication mechanisms, policy engine, and analytics infrastructure as your REST and GraphQL APIs. The body inspection is the only difference in how operations are identified and matched.
+
+<Note>
+MCP definitions are supported in Tyk OAS format only. They are not available as Tyk Classic API definitions.
+</Note>
+
+### Transport
+
+MCP uses **Streamable HTTP** as its transport. The MCP specification defines a single endpoint path (`/mcp`) that supports two HTTP methods with distinct roles. Tyk proxies both.
+
+**`POST /mcp`**: JSON-RPC messages. Clients send JSON-RPC 2.0 messages to `POST /mcp`. The upstream MCP server can respond with:
+
+- **`200 application/json`**: a single JSON-RPC response, for operations that complete immediately.
+- **`200 text/event-stream`**: a Server-Sent Events stream carrying multiple JSON-RPC messages, used when the server streams results or sends progress notifications.
+- **`202 Accepted`**: an acknowledgement for JSON-RPC notifications that do not expect a response body.
+
+Tyk executes the middleware chain against the incoming `POST` request (authenticating, applying rate limits, checking allowlists) and then proxies it to the upstream. Tyk preserves the response content type and streams SSE responses through to the client without buffering or transforming the body.
+
+**`GET /mcp`**: Server-Sent Events. Clients open a persistent `GET /mcp` connection to receive server-initiated messages. The upstream MCP server uses this channel to push progress notifications, resource update notifications, and server-to-client requests such as `sampling/createMessage`. Tyk proxies the SSE stream transparently, maintaining the long-lived connection for the duration of the session.
+
+### Protocol headers
+
+MCP defines several protocol-specific headers that Tyk passes through unchanged in both directions:
+
+| Header | Direction | Purpose |
+|---|---|---|
+| `MCP-Protocol-Version` | Client → Server | Required. Specifies the MCP protocol revision (for example, `2025-11-25`). |
+| `Mcp-Session-Id` | Server → Client, then Client → Server | Session identifier. Returned by the server after initialization; clients echo it on subsequent requests. |
+| `Last-Event-ID` | Client → Server | SSE resume token sent when reconnecting to a `GET /mcp` stream. |
+| `Origin` | Client → Server | Used by servers for origin-based security validation. |
+
+The client and upstream MCP server handle version negotiation and session management. Tyk does not modify any MCP protocol headers.
+
+---
+
+## What is MCP?
+
+<Tip>
+New to MCP? The [MCP introduction](https://modelcontextprotocol.io/introduction) is a good starting point before reading further.
+</Tip>
+
+The Model Context Protocol (MCP) is an open standard that defines how AI applications connect to external tools, data sources, and services. It uses a client-server model: an **MCP client** (an AI agent, LLM orchestration framework, or application) connects to an **MCP server** that exposes capabilities, and the two communicate using JSON-RPC 2.0 messages carried over HTTP.
+
+**Tyk supports the `2025-11-25` revision of the MCP specification.**
+
+### Primitives
+
+MCP servers expose three types of capability, collectively called **primitives**.
+
+| Primitive | Description | Discovery method | Invocation method |
+|---|---|---|---|
+| **Tool** | A callable function that takes structured arguments and returns a result. Used for actions and computed queries. | `tools/list` | `tools/call` |
+| **Resource** | A readable data source identified by a URI. Used for documents, files, and live data feeds. | `resources/list` | `resources/read` |
+| **Prompt** | A reusable prompt template the server exposes for common tasks. | `prompts/list` | `prompts/get` |
+
+Each primitive has a name (or URI for resources) that uniquely identifies it within the server:
+
+- A `tools/call` request names the tool in `params.name`
+- A `resources/read` request names the resource URI in `params.uri`
+- A `prompts/get` request names the prompt in `params.name`
+
+This name is what Tyk uses to apply primitive-level middleware and policy controls.
+
+### Client-side primitives
+
+MCP also defines primitives that run in the opposite direction: capabilities that servers can request from clients rather than expose themselves.
+
+| Primitive | Description | Method |
+|---|---|---|
+| **Sampling** | Server requests the client to perform LLM inference on its behalf and return the result. | `sampling/createMessage` |
+| **Roots** | Server requests the list of filesystem roots (directories or URIs) the client is willing to share. | `roots/list` |
+| **Elicitation** | Server requests structured input from the user, mediated through the client. | `elicitation/create` |
+
+<Note>
+Tyk passes client-side primitive messages through to the upstream and back. Primitive-level middleware configuration (rate limits, access control, timeouts) applies to server-side primitives only.
+</Note>
+
+### The request format
+
+Every MCP operation is a JSON-RPC 2.0 message sent to `POST /mcp`. Each message carries a `method` field that identifies the operation and, for invocation requests, a `params` object that names the specific primitive being accessed.
+
+A typical tool call looks like this:
+
+```json
+{
+  "jsonrpc": "2.0",
+  "id": 1,
+  "method": "tools/call",
+  "params": {
+    "name": "get_current_weather",
+    "arguments": { "location": "London" }
+  }
+}
+```
+
+The `method` field identifies the category of operation: `tools/call` in this example. The `params.name` field identifies the specific tool. Tyk reads both fields on every incoming `POST /mcp` request to determine which middleware to execute before forwarding to the upstream.
+
+### JSON-RPC methods
+
+The MCP specification defines a fixed set of JSON-RPC method names, grouped into four categories.
+
+| Method | Category | Description |
+|---|---|---|
+| `initialize` | Session | Opens the session and negotiates capabilities. |
+| `notifications/initialized` | Session | Client confirms session is ready. |
+| `tools/list` | Tools | Returns the list of tools the server exposes. |
+| `tools/call` | Tools | Invokes a named tool with the supplied arguments. |
+| `resources/list` | Resources | Returns the list of resources the server exposes. |
+| `resources/read` | Resources | Reads the content of a named resource URI. |
+| `prompts/list` | Prompts | Returns the list of prompt templates the server exposes. |
+| `prompts/get` | Prompts | Retrieves a named prompt template, optionally with arguments. |
+| `sampling/createMessage` | Sampling | Requests the client to perform LLM sampling on behalf of the server. |
+| `notifications/tools/list_changed` | Notifications | Server-initiated notification that the tool list has changed. |
+
+Tyk can apply rate limits, access control, and middleware at the method level (for example, capping all `tools/call` requests) and at the primitive level (for example, rate limiting a specific named tool). The distinction matters: method-level controls apply to every invocation of that method regardless of which primitive is named; primitive-level controls apply only when that specific tool, resource, or prompt is requested.
+
+---
+
+## Session lifecycle
+
+MCP is a stateful protocol. When a client sends an `initialize` request, the upstream server responds with an `Mcp-Session-Id` header. The client includes this identifier on all subsequent requests, allowing the server to associate them with the established session context. Tyk passes the header through unmodified and does not maintain session state itself.
+
+A typical session proceeds through four phases.
+
+1. **Handshake**: the client and server negotiate capabilities and establish a session identifier.
+2. **Discovery**: the client queries the server's available tools, resources, and prompts.
+3. **Invocation**: the client calls primitives; Tyk applies rate limiting, access control, and observability on each request.
+4. **Session close**: the client terminates the session; the session identifier is invalidated.
+
+### Handshake
+
+Tyk authenticates the `initialize` request before proxying it to the upstream. The upstream responds with an `Mcp-Session-Id` header that Tyk passes through to the client unchanged. The client confirms readiness with a `notifications/initialized` message, and the session is established.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant C as MCP Client
+    participant T as Tyk Gateway
+    participant U as Upstream MCP Server
+
+    rect rgb(240, 236, 255)
+        Note over C,U: Handshake
+        C->>T: POST /mcp — initialize
+        Note over T: Authenticate request
+        T->>U: initialize (proxied unchanged)
+        U-->>T: 200 OK · Mcp-Session-Id: abc123
+        T-->>C: 200 OK · Mcp-Session-Id: abc123 (passed through)
+        C->>T: POST /mcp — notifications/initialized · Mcp-Session-Id: abc123
+        T->>U: notifications/initialized (proxied)
+        U-->>T: 202 Accepted
+        T-->>C: 202 Accepted
+    end
+```
+
+### Discovery
+
+Once the session is open, the client calls `tools/list` (and optionally `resources/list` and `prompts/list`) to learn what the server exposes. Tyk intercepts the upstream's response and strips any primitives the consumer is not permitted to see, based on the policy attached to their key. The client receives a filtered view of the server's capabilities.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant C as MCP Client
+    participant T as Tyk Gateway
+    participant U as Upstream MCP Server
+
+    rect rgb(235, 248, 255)
+        Note over C,U: Discovery
+        C->>T: POST /mcp — tools/list · Mcp-Session-Id: abc123
+        T->>U: tools/list (proxied)
+        U-->>T: Full tool list
+        Note over T: Filters to permitted tools only
+        T-->>C: Filtered tool list (scoped to consumer entitlements)
+    end
+```
+
+### Invocation
+
+Each primitive call passes through Tyk's full middleware chain. Rate limiting, access control, and observability all fire on every `tools/call` request. If scope enforcement is configured, Tyk validates the inbound token's scopes against the primitive's requirements before proxying. If token exchange is configured, Tyk exchanges the inbound token for a backend-scoped token — the inbound SSO token never reaches the upstream MCP server. If the consumer's policy permits the named tool and rate limits allow the request, Tyk proxies it to the upstream and returns the response. This phase repeats for every tool, resource, or prompt the client invokes.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant C as MCP Client
+    participant T as Tyk Gateway
+    participant U as Upstream MCP Server
+
+    rect rgb(235, 255, 244)
+        Note over C,U: Invocation (repeats per primitive call)
+        C->>T: POST /mcp — tools/call · Mcp-Session-Id: abc123
+        Note over T: Rate limiting · access control · observability
+        T->>U: tools/call (proxied)
+        U-->>T: Tool response
+        T-->>C: Tool response
+    end
+```
+
+### Session close
+
+When the client has finished, it sends `DELETE /mcp` with the `Mcp-Session-Id` header. Tyk proxies the request to the upstream, which terminates the session. After session close, the `Mcp-Session-Id` is invalid; a new `initialize` request is required to open a new session.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant C as MCP Client
+    participant T as Tyk Gateway
+    participant U as Upstream MCP Server
+
+    rect rgb(255, 240, 240)
+        Note over C,U: Session close
+        C->>T: DELETE /mcp · Mcp-Session-Id: abc123
+        T->>U: DELETE /mcp (proxied)
+        U-->>T: 200 OK
+        T-->>C: 200 OK
+        Note over C,U: Session closed
+    end
+```
+
+If the `GET /mcp` SSE connection drops, the client can reconnect by opening a new `GET /mcp` request with the `Last-Event-ID` header set to the ID of the last event received. Tyk passes this through to the upstream, which resumes the stream from that point.
+
+---
+
+## The proxy definition
+
+The **MCP proxy definition** is the configuration object that describes the proxy. It is a Tyk OAS API definition, an OpenAPI 3.0 document extended with `x-tyk-api-gateway`, and it is both the single source of truth for everything about the proxy and its registry entry: the listen path, the upstream URL, authentication, middleware, and versioning.
+
+The `x-tyk-api-gateway` extension has four top-level sections:
+
+| Section | What it configures |
+|---|---|
+| `info` | API name, active state, and internal identifier |
+| `server` | Client-facing settings: listen path, authentication, IP access control, custom domain |
+| `upstream` | Upstream MCP server: target URL, load balancing, upstream rate limits, mTLS |
+| `middleware` | Request processing: global, per-method, and per-primitive middleware |
+
+A minimal MCP proxy definition looks like this:
+
+```json
+{
+  "openapi": "3.0.3",
+  "info": { "title": "Weather MCP proxy", "version": "2025-11-25" },
+  "paths": {
+    "/mcp": {
+      "post": { "operationId": "mcpTransportPost", "responses": { "200": { "description": "JSON-RPC response" } } },
+      "get":  { "operationId": "mcpSSEGet",         "responses": { "200": { "description": "SSE stream" } } }
+    }
+  },
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "Weather MCP proxy",
+      "state": { "active": true }
+    },
+    "server": {
+      "listenPath": { "value": "/weather/", "strip": true },
+      "authentication": { "enabled": true }
+    },
+    "upstream": {
+      "url": "https://weather-mcp.example.com"
+    }
+  }
+}
+```
+
+Clients connect to Tyk at `https://my-gateway.example.com/weather/mcp`. Tyk authenticates the request, applies any configured middleware, and proxies it to `https://weather-mcp.example.com/mcp`. Tyk serves both the `POST` and `GET` transport endpoints under the same listen path.
+
+You manage MCP proxy definitions through the [Tyk Gateway API](/ai-management/mcp-gateway/mcp-api-extensions) (at `/tyk/mcps`) or the [Tyk Dashboard](/ai-management/mcp-gateway/managing-proxies). For the full definition structure and field reference, see [MCP OAS definitions](/ai-management/mcp-gateway/mcp-proxy-definitions).
+
+### Tool naming and discovery
+
+Every tool, resource, and prompt on an MCP server has a **name** (or URI for resources) that uniquely identifies it within that server. Understanding how names are assigned, and how Tyk uses them, is a prerequisite for configuring primitive-level middleware, blocking specific tools, or writing policies with allowlists and blocklists.
+
+**In MCP Proxy pass-through mode** (Tyk proxying an existing MCP server), tool names come from the upstream server verbatim. Tyk does not modify or namespace them. If the upstream server exposes a tool named `get-weather`, that is the name Tyk uses for middleware matching, policy rules, and analytics.
+
+**In HTTP-to-MCP translation mode** (Tyk converting a REST API into MCP tools via [AI Studio](/ai-management/ai-studio/overview)), tool names are derived from the `operationId` field of each OpenAPI operation. An operation with `operationId: getWeatherForecast` becomes a tool named `getWeatherForecast`. If your OpenAPI spec does not set `operationId` on every operation, Tyk cannot create a stable tool name. Adding `operationId` values to every exposed operation is a prerequisite for this mode.
+
+**Discovery filtering** applies at the `tools/list`, `resources/list`, and `prompts/list` level. When a client requests the list of available primitives, Tyk intercepts the upstream's response and removes any entries that the consumer's policy does not permit. The client only sees and can only call the primitives its key is authorized to access.
+
+**Name collisions**: When proxying multiple MCP servers behind a single gateway, or when combining proxy pass-through and HTTP-to-MCP translation, tool names from different upstream servers may collide. Each MCP proxy definition is a separate Tyk API with its own listen path, so collisions are isolated per proxy: a tool named `search` on one proxy does not conflict with `search` on another. However, if you are using a single proxy to aggregate multiple upstream MCP servers (via the `mcp-registry` plugin), ensure that upstream tool names do not overlap, or use the plugin's namespacing configuration to prefix tool names per upstream.
+
+---
+
+## Middleware
+
+Tyk applies middleware to MCP traffic at three levels, all configured in the `x-tyk-api-gateway.middleware` section of the proxy definition. The levels are evaluated in order from broadest to most specific.
+
+### Global middleware
+
+Global middleware applies to every request that reaches the proxy, before any method-level or primitive-level processing. Use it for server-wide concerns: CORS configuration, traffic logging, header injection into upstream requests, or custom plugins that should run on all traffic.
+
+### Operation middleware
+
+Operation middleware applies to all requests for a specific JSON-RPC method, regardless of which primitive is called. Configure it in `middleware.operations`, keyed by the JSON-RPC method name with its HTTP method suffix (for example, `tools/callPOST`). Use it for method-wide policies, such as a rate limit that applies to all `tools/call` requests without distinguishing between individual tools.
+
+```json
+{
+  "middleware": {
+    "operations": {
+      "tools/callPOST": {
+        "rateLimit": { "enabled": true, "rate": 500, "per": 60 }
+      }
+    }
+  }
+}
+```
+
+This rate limit applies to every `tools/call` request, regardless of which tool is named in `params`.
+
+### Primitive middleware
+
+Primitive middleware applies to a specific tool, resource, or prompt. Configure it in one of three maps (`middleware.mcpTools`, `middleware.mcpResources`, or `middleware.mcpPrompts`), keyed by the primitive's identifier: the tool name, resource URI (or URI pattern), or prompt name. In addition to the standard middleware capabilities, two OAuth 2.0 features operate at this level: `scopeCheck` validates the inbound token's scopes against the primitive's `security:` requirements, and `exchange` replaces the `Authorization` header with a backend-scoped token before the request reaches the upstream (see [Token exchange](/api-management/authentication/token-exchange)).
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "execute-query": {
+        "allow": { "enabled": true },
+        "rateLimit": { "enabled": true, "rate": 10, "per": 60 }
+      }
+    }
+  }
+}
+```
+
+This configuration allowlists the `execute-query` tool and applies a rate limit of 10 requests per minute, independently of any other tools on the same proxy.
+
+When both operation-level and primitive-level middleware are configured, both apply. A `tools/call` request to `execute-query` must pass the operation-level limit (500/min for all tool calls) and the primitive-level limit (10/min for this tool). Access control follows the same pattern: allowlisting specific tools in `mcpTools` puts the entire tools category into allowlist mode, blocking any tool not explicitly listed.
+
+Tyk evaluates the three primitive categories (tools, resources, and prompts) independently. Allowlisting a tool has no effect on whether resources or prompts are accessible.
+
+See [MCP middleware](/ai-management/mcp-gateway/mcp-middleware) for the full list of available capabilities: access control, request and response transformation, traffic management (rate limiting, timeouts, circuit breakers), virtual endpoints, and observability controls.
+
+---
+
+## Policies
+
+A **Tyk security policy** is a reusable template of access rights and usage limits that you apply to one or more API keys. You define a policy once and issue keys that inherit its rules automatically, rather than configuring each key individually. When you update the policy, every key bound to it picks up the change.
+
+Policies give you per-consumer control at every level of the MCP protocol:
+
+- **Proxy access**: control which MCP proxies a consumer key can reach
+- **JSON-RPC method access**: restrict which protocol operations a consumer can use (for example, allow `tools/call` but block `sampling/createMessage`)
+- **Primitive access**: define per-consumer allowlists and blocklists for individual tools, resources, and prompts, using regular expressions to match by name
+- **Per-primitive rate limits**: set independent rate limits on specific primitives, so a consumer exhausting their quota on one tool does not affect their access to others
+- **Quotas**: cap total call volume over a renewal period
+
+Primitive access control is enforced at two points in the MCP protocol.
+
+**At invocation time**: Tyk checks `tools/call`, `resources/read`, and `prompts/get` requests against the consumer's permitted primitives. Blocked calls return a JSON-RPC error before the request reaches the upstream.
+
+**At discovery time**: Tyk intercepts `tools/list`, `resources/list`, and `prompts/list` responses from the upstream and strips out any primitives the consumer cannot see. Each consumer receives a filtered view of the server's capabilities from the moment they connect.
+
+### Policies versus middleware
+
+Both middleware and policies can enforce limits on MCP primitives, but they operate on different subjects.
+
+**Middleware** applies to all traffic through the proxy: a primitive rate limit in `mcpTools` caps the call rate for a tool across every caller combined. It protects the upstream from overload.
+
+**Policies** apply per consumer. A primitive rate limit in a policy caps the call rate for one specific key, with each consumer's counters tracked independently. This is how you enforce different entitlements for different consumers: a standard tier with read-only access and lower limits, a premium tier with access to sensitive tools and higher quotas.
+
+The two work together: middleware sets the ceiling for all traffic, policies determine what each consumer is entitled to within that ceiling.
+
+Tyk also supports scope-based access control via the `oauth2` scheme's `scopeCheck` feature. This is complementary to policy-based access control: policies control which primitives a consumer key can reach; scope check validates that the inbound token carries the required OAuth scopes for each primitive. The two can be combined — a consumer must both hold a key permitted by policy and present a token with the required scopes. See [OAuth 2.0 (External IdP)](/api-management/authentication/oauth2-authentication) for configuration details.
+
+See [MCP proxy policies](/ai-management/mcp-gateway/policies) for the full configuration reference, Dashboard UI walkthrough, and API examples.
diff --git a/ai-management/mcp-gateway/faq.mdx b/ai-management/mcp-gateway/faq.mdx
new file mode 100644
index 0000000000..ff74dedf34
--- /dev/null
+++ b/ai-management/mcp-gateway/faq.mdx
@@ -0,0 +1,373 @@
+---
+title: "MCP Gateway: FAQ"
+description: "Answers to frequently asked questions about Tyk's MCP Gateway: how it works, what it protects against, how authentication and sessions behave, what you can observe, and how to govern AI agent traffic at scale."
+keywords: "MCP, Model Context Protocol, MCP Gateway FAQ, MCP security, MCP authentication, MCP sessions, MCP rate limiting, AI agent governance, prompt injection, MCP tools, MCP SSE"
+sidebarTitle: "FAQ"
+---
+
+This FAQ answers common questions about Tyk's MCP Gateway: how it works, how it secures AI agent traffic, and how to govern MCP access at scale. Questions are grouped by topic so you can jump directly to the area you need.
+
+---
+
+## The basics
+
+### Do I need to modify my MCP server to use Tyk?
+
+No. Tyk sits in front of your existing MCP server as a reverse proxy. Your upstream server does not need to know about Tyk; it receives standard MCP requests over HTTP and responds normally. All authentication, access control, rate limiting, and observability are applied at the gateway layer.
+
+### Does Tyk work with both local and remote MCP servers?
+
+Tyk is designed for **remote MCP servers**: servers reachable over HTTP or HTTPS from the gateway. If your MCP server currently runs locally over stdio (the standard desktop configuration), you will need to either deploy it as an HTTP service or use one of the available stdio-to-HTTP bridge tools to expose it as a remote endpoint before Tyk can proxy it.
+
+### Which transport methods does Tyk support?
+
+Tyk supports the Streamable HTTP transport defined in the MCP specification (version 2025-11-25):
+
+- **`POST /mcp`**: for JSON-RPC messages from client to server. Tyk applies the middleware chain and proxies the request, streaming SSE responses through if the upstream returns them.
+- **`GET /mcp`**: for long-lived Server-Sent Events connections carrying server-initiated messages. Tyk maintains the connection and passes events through transparently.
+
+The older HTTP+SSE transport (two separate endpoints: a POST endpoint and a `/sse` endpoint) used by earlier MCP versions is not supported. Check that your upstream server implements Streamable HTTP.
+
+### What MCP protocol versions does Tyk support?
+
+Tyk passes the `MCP-Protocol-Version` header through to the upstream unchanged; version negotiation is handled between the client and the upstream MCP server. The current MCP specification version is `2025-11-25`. See [MCP OAS definition](/ai-management/mcp-gateway/mcp-proxy-definitions) for details on configuring the proxy definition.
+
+### Can Tyk proxy multiple MCP servers?
+
+Yes. Each remote MCP server gets its own **MCP proxy definition** in Tyk, with its own listen path, upstream URL, authentication configuration, and middleware. An AI agent that needs to reach GitHub's MCP server and an internal database tools server connects to two separate Tyk endpoints, each governed independently. There is no limit on the number of MCP proxies you can create.
+
+---
+
+## The Dashboard
+
+### What can I configure for an MCP proxy in the Dashboard?
+
+The MCP Designer has two tabs.
+
+The **Settings** tab covers core proxy configuration (name, upstream server URL, gateway assignment) and proxy-level middleware that applies to all traffic through the proxy:
+
+| Middleware | What it does |
+|---|---|
+| CORS | Cross-origin resource sharing headers for browser-based clients |
+| Transform Request Headers | Add, remove, or modify headers on every upstream request |
+| Transform Response Headers | Add, remove, or modify headers on every response |
+| Context Variables | Make Tyk request metadata available in transforms and plugins |
+| Traffic Logs | Configure analytics capture behavior |
+| Plugin Config / Bundle | Configure custom plugin drivers and bundle sources |
+
+The **Primitives** tab lists the tools, resources, and prompts defined for this proxy and lets you manage per-primitive middleware (access control, rate limits, timeouts, circuit breakers, and more) without editing the definition directly.
+
+### What requires editing the proxy definition directly?
+
+The Primitives tab covers most per-primitive middleware. A few options require the definition editor (**Actions → View MCP Proxy Definition**) or the Dashboard API:
+
+- **Transform request body**: advanced request body transformation via Go template
+- **`middleware.operations`**: method-level middleware applying to all calls of a specific JSON-RPC method (for example, all `tools/call` requests)
+- **Policy ACL fields** (`mcp_access_rights`, `json_rpc_methods_access_rights`): per-consumer primitive and method access control configured via the Dashboard API
+
+<Note>
+`urlRewrite`, `transformRequestMethod`, and `mockResponse` are accepted by the configuration schema but have no effect on MCP primitives. See [MCP middleware](/ai-management/mcp-gateway/mcp-middleware) for the full capability reference.
+</Note>
+
+### How do I add middleware to a specific tool, resource, or prompt?
+
+Open the proxy and click the **Primitives** tab. Click **Add Primitive**, select the type (Tool, Resource, or Prompt), and enter the name exactly as the upstream MCP server advertises it.
+
+Click the primitive in the list to open its detail view, then click **Add Middleware**. Available middleware includes Allow, Block, Rate Limit, Circuit Breaker, Request Size Limit, Ignore Authentication, Transform Request/Response Headers, Virtual Endpoint, Track Endpoint, Do Not Track Endpoint, and Post Plugins.
+
+Each middleware option maps directly to the corresponding field in `x-tyk-api-gateway.middleware.mcpTools`, `mcpResources`, or `mcpPrompts` in the proxy definition.
+
+### How do I set a rate limit that applies to all consumers of a proxy?
+
+Use the Primitives tab. Add the tool as a primitive, click it, and add **Rate Limit** middleware. This rate limit applies in aggregate, across all keys calling that tool on this proxy combined. It protects the upstream from overload regardless of which consumer is calling.
+
+For per-consumer rate limits that apply independently per API key, use the `mcp_primitives` field in a security policy. See [MCP proxy policies](/ai-management/mcp-gateway/policies).
+
+---
+
+## Security
+
+### Research shows that most public MCP servers have no authentication. How does Tyk address this?
+
+This is one of the most documented problems with the current MCP ecosystem. Studies in 2025 found that a significant proportion of publicly accessible MCP servers had no authentication at all, exposing their full tool catalogues to anyone who could reach the endpoint.
+
+Tyk adds authentication in front of your upstream server without requiring any changes to it. All authentication methods Tyk supports for REST APIs (Bearer tokens, API keys, JWT, OAuth 2.0, and mutual TLS) apply identically to MCP. Your upstream server never needs to validate credentials; Tyk does it before the request gets there.
+
+
+### How do I stop an AI agent from calling destructive tools?
+
+Use the **Primitives** tab on the MCP Designer. Add each tool you want to permit as a primitive (type: Tool), then add **Allow** middleware to it. Once any tool has an Allow rule, Tyk switches the entire tools category into allowlist mode; any tool not explicitly listed is blocked with a JSON-RPC error before the request reaches the upstream.
+
+Alternatively, configure the allowlist directly in the proxy definition using `"allow": { "enabled": true }` entries in `x-tyk-api-gateway.middleware.mcpTools`.
+
+This means new tools added to the upstream MCP server are **not automatically accessible** through the gateway. You must explicitly add them to the allowlist. This is the recommended default posture: deny by default, permit explicitly.
+
+See [MCP middleware: access control](/ai-management/mcp-gateway/mcp-middleware#access-control) and [How to block an MCP tool](/ai-management/mcp-gateway/how-to-block-tool).
+
+### Over-permissioning is a known MCP problem. How does Tyk help?
+
+Over-permissioning (agents having access to more tools and data than they need) compounds in the absence of a central control point. When every agent connects directly to every MCP server, there is no practical way to enforce least-privilege access at scale.
+
+Tyk makes over-permissioning addressable through three mechanisms:
+
+1. **Per-proxy tool allowlists**: configure which tools are accessible through each proxy, regardless of what the upstream server exposes. Applies to all consumers of that proxy.
+2. **Security policies: proxy access**: issue API keys against policies that grant access only to the specific MCP proxies a given agent needs. An agent that needs GitHub MCP does not automatically have access to your internal database MCP server.
+3. **Security policies: primitive ACLs**: use `mcp_access_rights` in the policy access rights entry to restrict which specific tools, resources, and prompts an individual consumer can invoke, without affecting other consumers of the same proxy. This lets you grant two agents access to the same MCP proxy while giving each a different subset of its tools.
+
+### What happens if an agent's API key is compromised?
+
+Revoke the key from the Tyk Dashboard under **Keys**. Access to every MCP proxy that key was permitted to reach is cut off immediately on the next request, with no grace period and no upstream credential rotation required. The upstream MCP server is unaffected; only requests carrying the revoked Tyk key are blocked.
+
+If the key was scoped to specific MCP proxies via a policy, other agents on the same policy are not affected.
+
+---
+
+## Authentication and OAuth
+
+### What authentication methods can AI agents use?
+
+Any authentication method Tyk supports for REST APIs also applies to MCP: Bearer tokens (API keys), JWT, OAuth 2.0 (with external token introspection), and mutual TLS. The inbound authentication method is configured per proxy in the `server.authentication` section of the API definition.
+
+For most deployments, Bearer token authentication using Tyk-issued API keys is the simplest starting point. For organizations with an existing OAuth 2.1 identity provider, JWT authentication allows agents to present tokens issued by your IdP directly.
+
+### Does Tyk support the MCP OAuth 2.1 specification?
+
+Yes. The MCP specification (version 2025-11-25) bases its authorization model on OAuth 2.1 and recommends that MCP servers expose **Protected Resource Metadata** (RFC 9728) so clients can discover authorization servers automatically.
+
+Tyk implements this end-to-end:
+
+- The `/.well-known/oauth-protected-resource` endpoint is served natively by Tyk when PRM is enabled, with no upstream changes required.
+- On authentication failure, Tyk includes a `WWW-Authenticate: Bearer resource_metadata=...` header pointing to the PRM document.
+- OAuth 2.1-aware MCP clients follow this header, discover the authorization server, obtain a token, and retry, without any pre-configuration.
+- On the upstream side, Tyk can acquire and inject OAuth tokens using the client credentials flow (Enterprise Edition), so upstream MCP servers that require OAuth tokens receive them automatically.
+
+See [MCP Gateway: OAuth 2.1 authentication](/ai-management/mcp-gateway/oauth-2-1) for the complete guide.
+
+### What is Protected Resource Metadata and do I need to configure it?
+
+PRM is the machine-readable discovery document at `/.well-known/oauth-protected-resource`. It tells OAuth clients which authorization server to use and which scopes the API supports. The MCP specification recommends all MCP servers expose it.
+
+You do not strictly need it if you are issuing Tyk API keys manually and configuring agents with the key directly. PRM becomes valuable when:
+
+- You have many AI agents that should self-configure their auth without manual setup.
+- You are using an OAuth 2.1 identity provider and want agents to obtain tokens automatically.
+- You need to comply with the MCP specification's authorization recommendations.
+
+Configure it by adding a `protectedResourceMetadata` block to the proxy's `server.authentication` section. See [MCP Gateway: OAuth 2.1 authentication (configuring PRM)](/ai-management/mcp-gateway/oauth-2-1#configuring-prm).
+
+### Our upstream MCP servers each require different credentials. How do we manage that?
+
+Configure the upstream authentication independently per proxy. Tyk supports three patterns:
+
+- **Static token injection**: inject a fixed Bearer token (such as a GitHub PAT) into every proxied request via global `transformRequestHeaders` middleware.
+- **OAuth client credentials**: have Tyk obtain and refresh an OAuth token from the upstream's authorization server using configured client credentials (Enterprise Edition).
+- **Basic authentication**: inject HTTP basic auth credentials via `upstream.authentication.basicAuth`.
+
+In every case, the agent presents a Tyk credential and Tyk presents the correct vendor credential to the upstream. Agents never need to know about or hold vendor-specific credentials.
+
+---
+
+## Sessions and connections
+
+### MCP is described as stateful. How does Tyk handle sessions?
+
+The MCP protocol establishes sessions identified by an `Mcp-Session-Id` header. After initialisation, clients include this identifier on every subsequent request so the server can associate them with established session state.
+
+Tyk passes the `Mcp-Session-Id` header through unchanged in both directions. It does not maintain session state itself; session management is an upstream concern. If your upstream MCP server is load-balanced across multiple instances, configure session-aware routing (sticky sessions) in Tyk's upstream load-balancing settings to ensure requests from the same session consistently reach the same instance.
+
+### What happens if the SSE connection drops?
+
+Tyk passes through the `Last-Event-ID` header when a client reconnects to the `GET /mcp` SSE stream. The upstream MCP server uses this to resume the stream from the last delivered event. Tyk maintains the long-lived connection for the duration of the session and re-establishes it transparently if it drops at the gateway layer.
+
+### Does Tyk buffer SSE responses?
+
+No. Tyk streams SSE responses through to the client without buffering the body. This preserves the real-time nature of server-sent events and avoids memory pressure on long-running tool calls that produce incremental output.
+
+---
+
+## Access control
+
+### What happens when a vendor adds new tools to their MCP server?
+
+If you are using a tool allowlist (any tool with `"allow": { "enabled": true }`), new tools added to the upstream server are **blocked by default**; they do not appear on the allowlist, so Tyk rejects calls to them before they reach the upstream. You must explicitly add new tools to the allowlist to make them accessible.
+
+This is intentional. It prevents new upstream tools from becoming automatically accessible to AI agents without review, which is especially important for third-party MCP servers where you do not control the tool catalogue.
+
+If you have not configured any allowlist rules, all tools are accessible by default and new upstream tools become reachable immediately.
+
+### Can I block specific MCP protocol operations for a consumer without affecting others?
+
+Yes. Use `json_rpc_methods_access_rights` in the policy access rights entry for the MCP proxy. This controls which JSON-RPC protocol methods (such as `tools/call`, `tools/list`, `resources/read`, or `sampling/createMessage`) the consumer's key is allowed to use.
+
+To restrict a consumer to tool listing and tool calls only, blocking server-initiated sampling requests:
+
+```json
+"json_rpc_methods_access_rights": {
+  "allowed": ["tools/call", "tools/list"]
+}
+```
+
+A non-empty `allowed` list acts as an explicit allowlist; only the listed methods are accessible. Use `blocked` to exclude specific methods while leaving all others accessible. This applies per consumer key; other keys with different policies are unaffected. Configure this field via the Dashboard API; it is not available in the Dashboard UI policy editor. See [MCP proxy policies](/ai-management/mcp-gateway/policies#access-rights-entry).
+
+### Can I give different agents access to different tools on the same MCP server?
+
+Yes, and there are two approaches depending on how different the access needs to be.
+
+**Separate proxy definitions** work well when agents have clearly distinct roles: for example, a read-only agent and a write-access agent. Create two proxies targeting the same upstream, each with a different tool allowlist. This is straightforward to reason about and administer.
+
+**Policy-level primitive ACLs** (`mcp_access_rights`) work well when you have many agents with overlapping but slightly different access needs and creating a separate proxy per agent is not practical. Set `mcp_access_rights` in the policy's access rights entry for the MCP proxy to control exactly which tools, resources, and prompts that policy's consumers can invoke. Each consumer key gets its own enforced view of the proxy's primitive catalogue.
+
+```json
+"mcp_access_rights": {
+  "tools": { "allowed": ["search", "get_document"] },
+  "resources": { "blocked": ["internal://.*"] }
+}
+```
+
+The two approaches compose: a proxy-level allowlist controls what any consumer can ever call; policy ACLs then further restrict what specific consumers can call within that set. Configure `mcp_access_rights` via the Dashboard API. See [MCP proxy policies](/ai-management/mcp-gateway/policies) for details.
+
+---
+
+## Traffic management
+
+### Does adding Tyk as a gateway add latency?
+
+Tyk adds a small amount of latency for the middleware chain evaluation, typically 1–5 ms for standard middleware. For most MCP use cases, where tool calls themselves involve network round-trips and computation, this overhead is not significant.
+
+The latency that matters is introduced by optional middleware you choose to add: content safety plugins (which involve additional API calls to external services like Bedrock Guardrails) and circuit breakers (which introduce an evaluation step). Each of these is a trade-off you control.
+
+Co-locating your Tyk Gateway with your upstream MCP servers in the same network reduces the baseline overhead further.
+
+### How does rate limiting work for MCP traffic?
+
+Tyk applies rate limits at five levels. All active limits are evaluated on every request; whichever is exhausted first blocks the call.
+
+| Level | Scope | Configured in |
+|---|---|---|
+| 1. API-level | All consumers, shared ceiling | MCP proxy API definition |
+| 2. Policy global | Per consumer key, all APIs in the policy | Policy `rate` / `per` |
+| 3. Per MCP proxy | Per consumer key, this proxy only | Per-API limits in policy access rights |
+| 4. JSON-RPC method | Per consumer key, per protocol method (e.g. `tools/call`) | `json_rpc_methods` in policy access rights |
+| 5. MCP primitive | Per consumer key, per named tool/resource/prompt | `mcp_primitives` in policy access rights |
+
+Levels 1–3 apply to all traffic aggregated at their scope. Level 4 counts every invocation of a given JSON-RPC method regardless of which primitive is named; a `tools/call` counter covers all tool calls combined. Level 5 counts invocations of one specific named primitive.
+
+Levels 4 and 5 apply concurrently. A call to `get_report` increments both the `tools/call` method counter (level 4, if set) and the `get_report` primitive counter (level 5, if set). Either reaching its limit blocks the call.
+
+There is also a **middleware-level primitive rate limit** (configured in the API definition's `mcpTools`/`mcpResources`/`mcpPrompts` maps) that applies to all consumers of a proxy, not just one key. The key distinction: middleware rate limits protect the upstream from aggregate overload; policy rate limits enforce per-consumer entitlements.
+
+See [MCP proxy policies](/ai-management/mcp-gateway/policies) and [MCP middleware: traffic management](/ai-management/mcp-gateway/mcp-middleware#traffic-management).
+
+### Can I set different rate limits on the same tool for different consumers?
+
+Yes. Use `mcp_primitives` in the policy access rights entry to set per-primitive rate limits that apply only to keys bound to that policy. Two consumers on different policies can have completely different limits on the same tool, and their counters are tracked independently.
+
+A standard tier policy might allow 10 calls per minute to an expensive `generate_report` tool, while a premium tier policy allows 100:
+
+```json
+"mcp_primitives": [
+  {
+    "type": "tool",
+    "name": "generate_report",
+    "limit": { "rate": 100, "per": 60 }
+  }
+]
+```
+
+This is the key difference between policy-level primitive limits and middleware-level primitive limits. Middleware limits are shared across all consumers; they protect the upstream from aggregate overload. Policy primitive limits are per-consumer; they enforce individual entitlements. Both can be active simultaneously. See [MCP proxy policies](/ai-management/mcp-gateway/policies) for the full configuration reference.
+
+### What happens when an upstream MCP server is slow or unavailable?
+
+Configure a circuit breaker on the tools that call the problematic server. Tyk monitors the failure rate and temporarily stops forwarding requests to that tool when the error rate exceeds a threshold, giving the upstream time to recover. During the open circuit period, Tyk returns a JSON-RPC error to the agent immediately rather than timing out.
+
+Combine this with per-tool timeouts so that a slow upstream response does not stall the entire MCP session. See [MCP middleware: circuit breakers and timeouts](/ai-management/mcp-gateway/mcp-middleware#traffic-management).
+
+---
+
+## Observability
+
+### What can I see in analytics for MCP traffic?
+
+Tyk records analytics at two levels: proxy level and primitive level.
+
+**Proxy-level charts** (in the Tyk Dashboard under **Monitoring → Activity by MCP**) show total request volume, error counts, and HTTP error code distribution across all your MCP proxies. Use these to compare traffic and error rates between proxies.
+
+**Primitive-level charts** on the same page break the data down by individual tool, resource, or prompt: call volumes over time, most frequently called primitives, highest error rates, and slowest average latency. These charts let you identify which specific tools agents are using most, which are failing, and which are your performance bottlenecks, without needing external tooling.
+
+All MCP analytics appear alongside your REST and GraphQL API data, giving a unified view of the entire API estate. See [MCP observability](/ai-management/mcp-gateway/mcp-observability).
+
+### How do I see which AI agents are calling which tools?
+
+Issue a separate API key per agent (or per agent team). Keys can have an alias set at creation time that identifies the agent. Analytics are reported per key, so filtering by key shows total call volume per agent against each MCP proxy. This is why per-agent key issuance is recommended over shared keys.
+
+### What MCP-specific information appears in access logs?
+
+When structured access logging is enabled, Tyk adds four MCP-specific fields to every log record for an MCP request:
+
+| Field | Description |
+|---|---|
+| `mcp_method` | JSON-RPC method invoked, for example `tools/call` |
+| `mcp_primitive_type` | Primitive category: `tool`, `resource`, or `prompt` |
+| `mcp_primitive_name` | Name of the specific primitive invoked |
+| `mcp_error_code` | Gateway-mapped JSON-RPC error code, present only on gateway errors |
+
+These fields let you filter and aggregate MCP traffic in your log management tooling using the same access log pipeline you use for REST APIs. See [MCP access logs](/ai-management/mcp-gateway/mcp-access-logs).
+
+### Does Tyk export OpenTelemetry metrics for MCP traffic?
+
+Yes. When OpenTelemetry is enabled on the gateway, Tyk emits four MCP-specific metric instruments:
+
+| Instrument | Type | What it measures |
+|---|---|---|
+| `tyk.mcp.requests.total` | Counter | Total requests, with dimensions for method, primitive type, tool name, error code, and API |
+| `tyk.mcp.method.distribution` | Counter | Request counts broken down by JSON-RPC method |
+| `tyk.mcp.upstream.duration` | Histogram | Upstream response time per tool |
+| `tyk.mcp.request.duration` | Histogram | End-to-end request duration including gateway overhead |
+
+These metrics can be scraped by Prometheus and used to build dashboards in Grafana or your preferred metrics platform. See [MCP metrics](/ai-management/mcp-gateway/mcp-metrics) for the full dimension reference and PromQL examples, and [How to build a Grafana dashboard for MCP traffic](/ai-management/mcp-gateway/how-to-grafana-mcp-dashboard) for a step-by-step guide.
+
+### Can I exclude high-frequency health-check tools from analytics noise?
+
+Yes. Open the proxy, click the **Primitives** tab, add the tool as a primitive, and add **Do Not Track Endpoint** middleware to it. Alternatively, add `"doNotTrackEndpoint": { "enabled": true }` to the tool's entry in `x-tyk-api-gateway.middleware.mcpTools` directly. Either way, calls to that tool are excluded from analytics logs and dashboards. See [MCP middleware: observability](/ai-management/mcp-gateway/mcp-middleware#observability).
+
+---
+
+## Governance and enterprise
+
+### We have developers connecting AI agents directly to MCP servers without oversight. How do we regain control?
+
+This is the **shadow IT** problem specific to AI agents. Because MCP servers are just HTTP endpoints, developers can point any MCP client at them directly using vendor-issued credentials.
+
+The practical approach is to make the Tyk gateway the approved, supported path and deprecate direct connections:
+
+1. Deploy Tyk proxies for every MCP server your organization uses or permits.
+2. Establish a policy that AI agents must connect via the gateway.
+3. Issue Tyk API keys to authorised agents and revoke or rotate the direct vendor credentials.
+4. Use Tyk analytics to verify that direct connections have dropped to zero.
+
+The governance case for this (central visibility, credential management, access control, audit trail) is covered in [How to proxy a remote MCP server through Tyk](/ai-management/mcp-gateway/how-to-proxy-remote-mcp).
+
+### How do I apply consistent policies across all MCP servers in my organization?
+
+Create Tyk security policies that span multiple MCP proxies. A single policy can grant access to many proxies and apply a consistent rate limit and quota across all of them. Issuing a key against that policy gives the agent access to every permitted proxy under the same controls.
+
+For tool-level restrictions that apply to all consumers, each proxy has its own middleware configuration. Changes to the allowlist or rate limits on a proxy take effect immediately for all keys permitted to reach that proxy; you do not need to update each key individually.
+
+For restrictions that vary by consumer tier, use the policy's MCP-specific access rights fields. Set `mcp_primitives` to enforce different rate limits per primitive for different consumer tiers. Set `mcp_access_rights` to give each tier access to a different subset of tools, resources, and prompts on the same proxy. Because policies are reusable, updating a policy's primitive limits or ACLs applies immediately to every key bound to that policy.
+
+### Does Tyk provide an MCP service registry?
+
+Yes. The Tyk Dashboard's MCP section functions as a central service registry for all MCP servers in your organization. Each MCP proxy is a registry entry; it records the upstream server address, listen path, available tools and resources, and the access policies that govern it.
+
+Teams have a single authoritative source of truth for what MCP capabilities are available, who can access them, and under what conditions. New MCP servers are onboarded by registering a proxy in the Dashboard; until registered, they are not accessible through the gateway. This directly addresses the ungoverned proliferation problem; MCP servers cannot appear outside oversight if the gateway is the required path for agent access.
+
+Discovery filtering scopes the registry view per consumer: when an agent calls `tools/list`, Tyk returns only the primitives its policy permits. Each agent sees a registry filtered to its own entitlements from the moment it connects.
+
+See [Managing MCP proxies](/ai-management/mcp-gateway/managing-proxies) for the full management interface.
+
+### Do we need a separate Tyk instance for MCP or can it share infrastructure with our REST APIs?
+
+MCP proxies are managed through the same Tyk Gateway and Dashboard instance as your REST and GraphQL APIs. They use the same configuration model, the same policy engine, and produce analytics in the same Dashboard. No separate infrastructure is required.
+
+The only constraint is that MCP OAS definitions require Tyk OAS format. They cannot be created as Tyk Classic API definitions.
+
diff --git a/ai-management/mcp-gateway/how-to-block-tool.mdx b/ai-management/mcp-gateway/how-to-block-tool.mdx
new file mode 100644
index 0000000000..9481991780
--- /dev/null
+++ b/ai-management/mcp-gateway/how-to-block-tool.mdx
@@ -0,0 +1,105 @@
+---
+title: "How to block an MCP tool for all consumers"
+description: "Prevent a specific MCP tool from being called through a proxy, regardless of consumer policy. The blocked tool remains on the upstream server but is never reachable through the gateway."
+keywords: "MCP, Model Context Protocol, block tool, blocklist, MCP middleware, MCP Inspector, Tyk Dashboard, access control"
+sidebarTitle: "Block an MCP Tool"
+---
+
+MCP servers often expose more tools than you want to make available through the gateway. Some tools are administrative, irreversible, or simply not ready for agent access. Rather than deploying a separate server with a reduced tool set, or remembering to exclude the tool from every consumer policy, you can block individual tools at the proxy layer.
+
+A blocked tool is rejected by Tyk before the request reaches the upstream, and filtered out of `tools/list` responses so agents cannot discover it exists. No consumer key or policy can override a definition-level block: if the tool is blocked, it is invisible and uncallable for everyone.
+
+This guide blocks the `delete_user` tool on the Mock MCP Server, then uses MCP Inspector to verify that calling it returns an error while all other tools continue to work.
+
+---
+
+## Before you begin
+
+- The Mock MCP Server running on `http://localhost:7878`. Set up in the [quickstart](/ai-management/mcp-gateway/quickstart).
+- An MCP proxy named **Mock MCP Server** with authentication enabled. See [How to secure an MCP proxy](/ai-management/mcp-gateway/how-to-proxy-remote-mcp).
+- [Node.js](https://nodejs.org/) 18 or later (to run [MCP Inspector](https://github.com/modelcontextprotocol/inspector))
+
+---
+
+## Instructions
+
+### Step 1: Block the tool
+
+1. In the Tyk Dashboard sidebar, click **MCP**. Find **Mock MCP Server** in the list and click **Edit** to open the proxy designer.
+
+2. Click the **Primitives** tab.
+
+    ![Primitives tab on the Mock MCP Server proxy](/img/ai-management/mcp-how-to-circuitbreaker-primitives.png)
+
+3. Click **Add Primitive**. Set **Type** to **Tool** and enter `delete_user` as the name. Click **Add Primitive**.
+
+    ![Add delete_user as a tool primitive](/img/ai-management/mcp-hot-too-block-add-primitive.png)
+
+4. Click `delete_user` to open the middleware panel.
+
+5. Click **Add Middleware**.
+
+6. Select **Block List**.
+
+7. Click **Add Middleware**.
+
+    ![Block middleware selected for delete_user](/img/ai-management/mcp-how-to-block-primitive-middleware.png)
+
+8. Click **Save MCP Proxy**.
+
+---
+
+### Step 2: Verify with MCP Inspector
+
+1. Start MCP Inspector:
+
+    ```bash
+    npx @modelcontextprotocol/inspector
+    ```
+
+2. Open the URL printed in your terminal.
+
+3. Set **Transport Type** to `Streamable HTTP`.
+
+4. Set **URL** to your MCP endpoint (find it under **MCP Proxy URL** in the proxy designer, then append `/mcp`).
+
+5. Add a header: `Authorization` = `Bearer {your-api-key}`.
+
+6. Click **Connect**.
+
+7. Click the **Tools** tab. Notice that `delete_user` no longer appears in the tool list. Tyk filters blocked tools out of `tools/list` responses, so agents cannot discover them at all.
+
+    {/* TODO: Add screenshot of MCP Inspector Tools tab showing the tool list without delete_user */}
+
+8. To confirm the block is enforced at the call layer, enter `delete_user` manually in the tool name field, provide any value for **user_id**, and click **Run**.
+
+    Tyk blocks the request before it reaches the upstream. The response panel shows:
+
+    ```json
+    {
+      "jsonrpc": "2.0",
+      "error": {
+        "code": -32002,
+        "message": "Requested endpoint is forbidden",
+        "data": {
+          "http_code": 403
+        }
+      },
+      "id": 6
+    }
+    ```
+
+9. Select any other tool (`get_users`, `get_posts`, `get_products`) and click **Run**. Those calls succeed normally. Only `delete_user` is blocked.
+
+---
+
+## Block vs. RBAC: when to use each
+
+Both `block` and RBAC allowlists restrict which tools a consumer can call, but they operate at different layers and serve different purposes.
+
+**Use `block`** when a tool should never be reachable through this proxy, for anyone. The restriction is set in the proxy definition and cannot be overridden by a policy. It is the right choice for tools that are dangerous, irreversible, or not yet ready for agent access: `delete_user`, `drop_table`, `send_email`.
+
+**Use RBAC** when different consumers should have different access to the same set of tools. A read-only agent sees only read tools; an admin agent sees all tools. The restriction is set in a security policy and scoped per consumer. See [How to implement RBAC for an MCP proxy](/ai-management/mcp-gateway/how-to-mcp-rbac).
+
+The two can be combined: block the tools that no one should ever reach, then use RBAC to scope what each consumer can see within what remains.
+
diff --git a/ai-management/mcp-gateway/how-to-grafana-mcp-dashboard.mdx b/ai-management/mcp-gateway/how-to-grafana-mcp-dashboard.mdx
new file mode 100644
index 0000000000..e02dd9f924
--- /dev/null
+++ b/ai-management/mcp-gateway/how-to-grafana-mcp-dashboard.mdx
@@ -0,0 +1,201 @@
+---
+title: "How to build a Grafana dashboard for MCP traffic"
+sidebarTitle: "Monitor MCP Traffic in Grafana"
+description: "Build a Grafana dashboard to monitor MCP tool call volumes, error rates, and latency using Tyk Gateway's OpenTelemetry metrics."
+keywords: "mcp, grafana, prometheus, opentelemetry, metrics, dashboard, monitoring, latency, errors, tools"
+---
+
+Without instrumentation, MCP traffic is opaque: you know requests are flowing, but not which tools agents are calling, which are slow, or where failures are concentrated. This guide builds a [Grafana](https://grafana.com/) dashboard for MCP traffic using Tyk Gateway's [OpenTelemetry](https://opentelemetry.io/) metrics. By the end, you will have three panels covering request volume by JSON-RPC method, error rate, and top tools by call volume.
+
+---
+
+## Prerequisites
+
+### 1. Enable OTel metrics on the gateway
+
+Tyk exports metrics via OTLP (not a [Prometheus](https://prometheus.io/) scrape endpoint directly). The recommended setup uses an OpenTelemetry Collector to receive OTLP from Tyk and expose a Prometheus scrape endpoint.
+
+Add the following to your `tyk.conf`:
+
+```json
+"opentelemetry": {
+  "enabled": true,
+  "exporter": "grpc",
+  "endpoint": "localhost:4317"
+}
+```
+
+Then run an OTel Collector configured to receive OTLP on `:4317` and export to Prometheus on `:8889`. See [OpenTelemetry in Tyk](/api-management/traces) for full configuration options.
+
+### 2. Enable traffic logs on the MCP proxy
+
+Tyk Gateway only records metrics for APIs that have traffic logging enabled. In the Dashboard, open your MCP proxy definition, navigate to **Advanced Options**, and enable **Traffic Logs**. Without this, no requests are recorded and all panels will be empty.
+
+### 3. Configure the MCP metric instruments
+
+The metric instruments are configured in `tyk.conf`, under `opentelemetry.metrics`. Add the following to your gateway config:
+
+```json
+"opentelemetry": {
+  "enabled": true,
+  "exporter": "grpc",
+  "endpoint": "localhost:4317",
+  "metrics": {
+    "enabled": true,
+    "api_metrics": [
+      {
+        "name": "tyk.mcp.requests.total",
+        "type": "counter",
+        "description": "MCP request count by method, tool, API, and session",
+        "dimensions": [
+          { "source": "metadata", "key": "mcp_method",         "label": "mcp_method",     "default": "" },
+          { "source": "metadata", "key": "mcp_primitive_type", "label": "primitive_type", "default": "" },
+          { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name",      "default": "" },
+          { "source": "metadata", "key": "mcp_error_code",     "label": "error_code",     "default": "" },
+          { "source": "metadata", "key": "api_id",             "label": "api_id" },
+          { "source": "session",  "key": "alias",              "label": "session",        "default": "unknown" }
+        ]
+      },
+      {
+        "name": "tyk.mcp.upstream.duration",
+        "type": "histogram",
+        "description": "Upstream MCP server latency per tool and API",
+        "histogram_source": "upstream",
+        "histogram_buckets": [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10],
+        "dimensions": [
+          { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name", "default": "" },
+          { "source": "metadata", "key": "api_id",             "label": "api_id" }
+        ]
+      },
+      {
+        "name": "tyk.mcp.request.duration",
+        "type": "histogram",
+        "description": "End-to-end MCP request latency per tool and API",
+        "histogram_source": "total",
+        "histogram_buckets": [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10],
+        "dimensions": [
+          { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name",  "default": "" },
+          { "source": "metadata", "key": "mcp_method",         "label": "mcp_method", "default": "" },
+          { "source": "metadata", "key": "api_id",             "label": "api_id" }
+        ]
+      },
+      {
+        "name": "tyk.mcp.method.distribution",
+        "type": "counter",
+        "description": "Distribution of MCP method types for session efficiency analysis",
+        "dimensions": [
+          { "source": "metadata", "key": "mcp_method", "label": "mcp_method", "default": "" },
+          { "source": "metadata", "key": "api_id",     "label": "api_id" }
+        ]
+      }
+    ]
+  }
+}
+```
+
+Restart the gateway after making this change. See [MCP metrics](/ai-management/mcp-gateway/mcp-metrics) for the full reference on each instrument and additional use cases.
+
+---
+
+<Note>
+OTel metric names are translated when Prometheus scrapes them: dots become underscores, counter instruments get a `_total` suffix, and histogram instruments with a seconds unit get a `_seconds` suffix. So `tyk.mcp.requests.total` becomes `tyk_mcp_requests_total` in PromQL, and `tyk.mcp.upstream.duration` becomes `tyk_mcp_upstream_duration_seconds_bucket`, `tyk_mcp_upstream_duration_seconds_sum`, and `tyk_mcp_upstream_duration_seconds_count`.
+</Note>
+
+---
+
+## Instructions
+
+### Step 1: Create the dashboard
+
+1. In Grafana, go to **Connections → Data Sources → Add new data source**, select **Prometheus**, set the URL to your Prometheus server (e.g. `http://prometheus:9090`), and click **Save & test**.
+
+2. Go to **Dashboards → New → New dashboard**.
+
+    ![Grafana new dashboard](/img/ai-management/grafana-new-dashboard.png)
+
+3. Open **Dashboard settings → Variables → Add variable**.
+
+    ![Grafana dashboard settings](/img/ai-management/grafana-dashboard-settings.png)
+
+4. Set the following fields and click **Save**:
+
+    | Field | Value |
+    |---|---|
+    | **Variable type** | Datasource |
+    | **Name** | `datasource` |
+    | **Plugin type** | Prometheus |
+
+    ![Grafana data source variable](/img/ai-management/grafana-data-source-variable.png)
+
+### Step 2: Generate traffic
+
+1. Make a few tool calls through your MCP proxy to populate the metrics.
+
+   If you need a quick way to generate traffic, use MCP Inspector with the Mock MCP Server; the full setup is covered in [How to secure an MCP proxy](/ai-management/mcp-gateway/how-to-proxy-remote-mcp). Once you have traffic flowing, come back here to build the dashboard.
+
+### Step 3: Request rate by method
+
+1. Click **Add → Visualization** and select **Time series**. Set the title to `MCP request rate by method`.
+
+2. Set the PromQL query to:
+
+    ```promql
+    sum by (mcp_method) (rate(tyk_mcp_requests_total[$__rate_interval]))
+    ```
+
+3. Set the **Legend** to `{{mcp_method}}` and click **Apply**.
+
+    {/* TODO: Screenshot — Grafana Time series panel showing MCP request rate by method, with multiple series coloured by mcp_method (e.g. tools/call, initialize, tools/list) */}
+
+<Note>
+`$__rate_interval` is a Grafana built-in variable that automatically selects an appropriate rate interval based on the dashboard time range and scrape interval. It produces more accurate rate calculations than a hardcoded interval such as `[5m]` and is the recommended choice for rate and histogram queries.
+</Note>
+
+### Step 4: Error rate
+
+1. Click **Add → Visualization** and select **Stat**. Set the title to `MCP error rate`.
+
+2. Set the PromQL query to:
+
+    ```promql
+    sum(rate(tyk_mcp_requests_total{error_code!=""}[$__rate_interval]))
+    /
+    sum(rate(tyk_mcp_requests_total[$__rate_interval]))
+    * 100
+    ```
+
+3. Set the **Unit** to `Percent (0-100)`.
+
+4. Configure thresholds and click **Apply**:
+
+    | Value | Color |
+    |---|---|
+    | 0 | Green |
+    | 1 | Orange |
+    | 5 | Red |
+
+    {/* TODO: Screenshot — Grafana Stat panel showing MCP error rate as a percentage, with green/orange/red threshold colouring */}
+
+### Step 5: Top tools by call volume
+
+1. Click **Add → Visualization** and select **Bar chart**. Set the title to `Top tools by call volume`.
+
+2. Set the PromQL query to:
+
+    ```promql
+    topk(10, sum by (tool_name) (increase(tyk_mcp_requests_total{mcp_method="tools/call"}[$__range])))
+    ```
+
+3. Set the **Legend** to `{{tool_name}}` and click **Apply**.
+
+    {/* TODO: Screenshot — Grafana Bar chart panel showing top 10 tools by call volume, with tool names on the x-axis */}
+
+<Note>
+If the panel shows tool names but all counts are zero immediately after generating traffic, this is normal. The `increase()` function requires at least two Prometheus scrapes to return a non-zero result. Wait for the second OTel export cycle (up to two minutes) and refresh the dashboard.
+</Note>
+
+![Grafana MCP dashboard](/img/ai-management/grafana.png)
+
+## Next steps
+
+The [MCP metrics](/ai-management/mcp-gateway/mcp-metrics) reference covers additional instruments you can add to this dashboard, including P95 upstream latency per tool, end-to-end latency, error classification by code, and per-session usage.
diff --git a/ai-management/mcp-gateway/how-to-mcp-rbac.mdx b/ai-management/mcp-gateway/how-to-mcp-rbac.mdx
new file mode 100644
index 0000000000..f7c3211a7c
--- /dev/null
+++ b/ai-management/mcp-gateway/how-to-mcp-rbac.mdx
@@ -0,0 +1,147 @@
+---
+title: "How to implement role-based access control for an MCP proxy"
+description: "Use Tyk policies to give different AI agents different tool access on the same MCP proxy, without creating separate proxy definitions."
+keywords: "MCP, Model Context Protocol, RBAC, role-based access control, mcp_access_rights, MCP policies, tool allowlist, MCP Inspector, AI agent, Tyk Dashboard"
+sidebarTitle: "MCP RBAC"
+---
+
+After [securing your MCP proxy](/ai-management/mcp-gateway/how-to-proxy-remote-mcp), the next step is controlling what each consumer can do. Role-based access control (RBAC) in Tyk MCP lets you give different agents different views of the same proxy, without creating separate proxy definitions. A policy bound to a key determines which tools that agent can invoke.
+
+This guide creates two roles on the Mock MCP Server:
+
+- **Reader**: can only call `get_users`, `get_posts`, `get_products`, and `get_analytics`
+- **Admin**: can call all 15 tools
+
+You'll create a policy for each role, issue role-specific keys, then use [MCP Inspector](https://github.com/modelcontextprotocol/inspector) to verify that each key sees exactly the tools it is permitted to access.
+
+---
+
+## Two approaches to tool-level access control
+
+Tyk supports two complementary mechanisms for controlling what an AI agent can do on an MCP proxy.
+
+**Policy-based access control** (this guide) — Tyk policies define an explicit allowlist of tools a consumer is permitted to invoke, and apply platform-level controls to each tool: rate limits, quotas, and throttling. A policy is bound to a key at issuance time and enforced at the gateway, regardless of what the agent's bearer token claims. This works with any authentication method, requires no changes to your identity provider, and lets the platform team manage access centrally without touching the IdP.
+
+**Scope-based access control** — when you use the [oauth2 security scheme](/api-management/authentication/oauth2-authentication), you can declare required scopes on individual tools in the API definition. Tyk validates those scopes against the inbound token's `scope` claim at runtime, delegating fine-grained access decisions to your IdP. This approach is well suited to environments where access rules change frequently, or where the IdP is already the source of truth for permissions.
+
+The two mechanisms are complementary and can be combined. Policies enforce platform-level controls — which tools a consumer can reach, and at what rate — while scope check validates what the IdP has actually granted in the token at runtime. Together they give you both platform governance and identity-driven authorization.
+
+This guide covers policy-based access control only.
+
+---
+
+## How it works
+
+Tyk policies control consumer access at two levels relevant to this guide:
+
+**Primitive access**: restricts which specific tools a consumer can invoke. When a key's policy includes an allowed list for tools, Tyk enforces it on both `tools/call` (blocking disallowed tool invocations) and `tools/list` (filtering the response so the agent only sees tools it can use). The upstream server is never reached for blocked calls.
+
+**Proxy access**: determines which MCP proxies the key can reach at all.
+
+Both keys in this guide point at the same proxy URL. The difference in behavior comes entirely from the policies applied to each key.
+
+For the complete policy reference, see [MCP policies](/ai-management/mcp-gateway/policies).
+
+---
+
+## Before you begin
+
+- The Mock MCP Server running on `http://localhost:7878`. Set up in the [quickstart](/ai-management/mcp-gateway/quickstart).
+- An MCP proxy named **Mock MCP Server** with authentication enabled. See [How to secure an MCP proxy](/ai-management/mcp-gateway/how-to-proxy-remote-mcp).
+- [Node.js](https://nodejs.org/) 18 or later (to run [MCP Inspector](https://github.com/modelcontextprotocol/inspector))
+- A Dashboard user account with policy management permissions
+
+---
+
+## Instructions
+
+### Step 1: Create the Reader policy
+
+1. In the Tyk Dashboard sidebar, click **Policies**, then click **Add Policy**.
+
+2. On the **Access Rights** tab, find **Mock MCP Server** in the API list and click it to add it.
+
+    ![Select Mock MCP Server from the API list](/img/ai-management/tyk-how-to-rbac-select-api.png)
+
+3. Scroll to **Primitive based access** within the Mock MCP Server panel and add each permitted tool:
+
+    - Click **Add**, enter `get_users`, set **Type** to **Tool**, and set the status to **Allowed**. Click **Add**.
+    - Repeat for `get_posts`, `get_products`, and `get_analytics`.
+
+    ![Primitive based access configuration](/img/ai-management/mcp-how-to-rbac-primitive.png)
+
+    Once you add any tool with **Allowed** status, Tyk treats the list as an explicit allowlist: any tool not in the list is blocked for keys on this policy.
+
+4. Click the **Configurations** tab and set:
+    - **Policy Name**: `Reader`
+    - **Policy State**: **Active**
+
+5. Click **Create Policy**.
+
+    ![Reader policy configuration](/img/ai-management/mcp-how-to-rbac-reader.png)
+
+### Step 2: Create the Admin policy
+
+The Admin policy grants unrestricted tool access. Omitting the **Primitive based access** entries means all tools are accessible.
+
+1. Click **Add Policy**.
+
+2. On the **Access Rights** tab, add **Mock MCP Server**.
+
+3. Click the **Configurations** tab and set:
+    - **Policy Name**: `Admin`
+    - **Policy State**: **Active**
+
+4. Click **Create Policy**.
+
+    {/* TODO: Screenshot — Admin policy Configurations tab showing Policy Name "Admin" and Active state */}
+
+### Step 3: Issue role-specific keys
+
+1. In the Dashboard sidebar, click **Keys**, then **Add Key**.
+
+2. Under **Access rights**, click **Apply Policy** and select **Reader**.
+
+    ![Apply Reader policy to key](/img/ai-management/mcp-how-to-rbac-keys.png)
+
+3. Click the **Configurations** tab and set an **Alias** such as `reader-agent`.
+
+    ![Set alias and create key](/img/ai-management/mcp-how-to-rbac-set-alias.png)
+
+4. Click **Create Key** and copy the key.
+
+5. Repeat steps 1–4 to issue a second key, selecting **Admin** as the policy and `admin-agent` as the alias.
+
+### Step 4: Verify in MCP Inspector
+
+1. Start MCP Inspector:
+
+    ```bash
+    npx @modelcontextprotocol/inspector
+    ```
+
+2. Open the URL printed in your terminal.
+
+#### Test the Reader key
+
+3. Set **Transport Type** to `Streamable HTTP`.
+
+4. Set **URL** to your MCP endpoint (find it under **MCP Proxy URL** in the proxy designer, then append `/mcp`).
+
+5. Add a header: `Authorization` = `Bearer {reader-api-key}` and click **Connect**.
+
+6. Click the **Tools** tab. You will see exactly four tools: `get_users`, `get_posts`, `get_products`, and `get_analytics`. Tyk has filtered the `tools/list` response based on the Reader policy's allowed list.
+
+7. Select `get_users` and click **Run**. It succeeds.
+
+    {/* TODO: Screenshot — MCP Inspector Tools tab showing only the 4 allowed tools for the Reader key */}
+
+#### Test the Admin key
+
+8. Click **Disconnect**. Replace the key in the `Authorization` header with your Admin key and click **Connect**.
+
+9. Click the **Tools** tab. All 15 Mock MCP Server tools appear. The Admin policy applies no tool restrictions.
+
+    {/* TODO: Screenshot — MCP Inspector Tools tab showing all 15 tools for the Admin key */}
+
+Both keys connect to the same proxy at the same URL. The difference in tool availability is driven entirely by the policy.
diff --git a/ai-management/mcp-gateway/how-to-proxy-remote-mcp.mdx b/ai-management/mcp-gateway/how-to-proxy-remote-mcp.mdx
new file mode 100644
index 0000000000..ffe27e55cc
--- /dev/null
+++ b/ai-management/mcp-gateway/how-to-proxy-remote-mcp.mdx
@@ -0,0 +1,80 @@
+---
+title: "How to secure an MCP proxy"
+description: "Secure a remote MCP Server so only authorised agents can connect. This guide uses the Tyk Mock MCP Server and takes around ten minutes."
+keywords: "MCP, Model Context Protocol, MCP proxy, API key authentication, MCP security, bearer token, Tyk Dashboard, MCP Inspector"
+sidebarTitle: "Secure MCP Proxy"
+---
+
+After completing the [quickstart](/ai-management/mcp-gateway/quickstart), you have a working MCP proxy, but it accepts connections from any client. This guide secures your remote MCP server so that only agents with a valid key can reach it.
+
+---
+
+## Before you begin
+
+- A Tyk Gateway (v5.13 or later) connected to your Tyk Dashboard
+- The Mock MCP Server running on `http://localhost:7878`. See the [quickstart](/ai-management/mcp-gateway/quickstart).
+- An MCP proxy named **Mock MCP Server** already created. Also covered in the quickstart.
+- [Node.js](https://nodejs.org/) 18 or later (to run [MCP Inspector](https://github.com/modelcontextprotocol/inspector))
+- A Dashboard user account with MCP write permissions
+
+---
+
+## Instructions
+
+### Step 1: Enable authentication
+
+1. In the Tyk Dashboard sidebar, click **MCP**, then click **Edit** next to **Mock MCP Server**.
+
+2. In the designer, click the **Authentication** switch.
+
+3. Select **Auth Token** as the authentication method.
+
+4. Set the token location to **use header value** and leave the header name as `Authorization`.
+
+    ![Auth token header configuration](/img/ai-management/mcp-how-to-secure-add-header.png)
+
+5. Click **Save MCP Proxy**.
+
+    The proxy now requires a bearer token on every request. Clients that connect without a valid key receive a `401 Unauthorized` response.
+
+### Step 2: Issue an API key
+
+1. In the Dashboard sidebar, click **Keys**, then click **Add Key**.
+
+2. Under **Access rights**, click **Choose API** and select **Mock MCP Server**.
+
+3. Click **Create Key**. Copy the key shown — you cannot retrieve it after navigating away.
+
+    ![API key created](/img/ai-management/mcp-how-to-secure-add-key.png)
+
+### Step 3: Verify with MCP Inspector
+
+1. Start MCP Inspector:
+
+    ```bash
+    npx @modelcontextprotocol/inspector
+    ```
+
+2. Open the URL printed in your terminal.
+
+3. Set **Transport Type** to `Streamable HTTP`.
+
+4. Set **URL** to your MCP endpoint (find it under **MCP Proxy URL** in the proxy designer, then append `/mcp`).
+
+5. Click **Connect** without adding an `Authorization` header. The connection fails with a `401 Unauthorized` error, confirming authentication is enforced.
+
+    {/* TODO: Screenshot — MCP Inspector showing the 401 Unauthorized error response when connecting without a key */}
+
+6. Add a header: `Authorization` = `Bearer {your-api-key}` and click **Connect** again.
+
+    ![MCP Inspector connected with API key](/img/ai-management/mcp-how-to-secure-mcp-inspector.png)
+
+7. Click the **Tools** tab. All 15 Mock MCP Server tools appear.
+
+---
+
+## Limitations and alternatives
+
+API key authentication via a bearer token header is a straightforward way to secure an MCP proxy, but it has limitations: keys are long-lived, there is no built-in token expiry or rotation, and clients must manage the key securely.
+
+For more demanding scenarios, Tyk supports a range of [client authentication methods](/api-management/client-authentication), including JWT, mutual TLS, and OAuth 2.1. For MCP specifically, Tyk extends OAuth 2.1 with Protected Resource Metadata so MCP-aware clients can discover authentication requirements automatically. See [MCP Gateway: OAuth 2.1 authentication](/ai-management/mcp-gateway/oauth-2-1).
diff --git a/ai-management/mcp-gateway/how-to-rate-limit-tools-per-consumer.mdx b/ai-management/mcp-gateway/how-to-rate-limit-tools-per-consumer.mdx
new file mode 100644
index 0000000000..b5a68786f6
--- /dev/null
+++ b/ai-management/mcp-gateway/how-to-rate-limit-tools-per-consumer.mdx
@@ -0,0 +1,121 @@
+---
+title: "How to rate limit individual MCP tools per consumer"
+description: "Apply per-tool rate limits to an MCP proxy so different consumers have different call budgets on the same tool, without creating separate proxy definitions."
+keywords: "MCP, Model Context Protocol, per-tool rate limiting, mcp_primitives, security policy, AI agent, MCP Inspector, Tyk Dashboard"
+sidebarTitle: "Rate Limit an MCP Tool"
+---
+
+Not all MCP tools cost the same. A tool that runs a complex query costs far more than one returning cached data. When multiple agents share the same proxy, a single blanket rate limit either over-restricts lightweight tools or under-protects expensive ones.
+
+Tyk lets you set rate limits on individual tools, per consumer. Each agent key tracks its own independent counter: one agent exhausting their budget on a tool does not affect another agent's counter for the same tool.
+
+This guide rate limits the `get_analytics` tool on the Mock MCP Server to 3 calls per minute for a specific consumer policy, then uses MCP Inspector to verify the limit is enforced.
+
+---
+
+## Before you begin
+
+- The Mock MCP Server running on `http://localhost:7878`. Set up in the [quickstart](/ai-management/mcp-gateway/quickstart).
+- An MCP proxy named **Mock MCP Server** with authentication enabled. See [How to secure an MCP proxy](/ai-management/mcp-gateway/how-to-proxy-remote-mcp).
+- [Node.js](https://nodejs.org/) 18 or later (to run [MCP Inspector](https://github.com/modelcontextprotocol/inspector))
+- A Dashboard user account with policy management permissions
+
+---
+
+## Instructions
+
+### Step 1: Create a policy with a per-tool rate limit
+
+1. In the Tyk Dashboard sidebar, click **Policies**, then click **Add Policy**.
+
+2. On the **Access Rights** tab, find **Mock MCP Server** in the API list and click it to add it.
+
+3. Expand the Mock MCP Server access rights block and scroll to **Set Usage Limits by MCP Primitives/Methods**.
+
+4. Click **Add Rate Limit** and configure the limit:
+   - Set **Rate** to `3`
+   - Set **Per** to `60` seconds
+   - Click **Add**, enter `get_analytics`, and set **Type** to **Tool**
+
+    ![Add get_analytics as a tool primitive](/img/ai-management/mcp-how-to-rate-limit-tool.png)
+
+5. Click **Add** to confirm the primitive.
+
+6. Click the **Configurations** tab and set:
+   - **Policy Name**: `Limited Agent`
+   - **Policy State**: **Active**
+
+7. Click **Create Policy**.
+
+    ![Create the Limited Agent policy](/img/ai-management/mcp-how-to-limited-agent.png)
+
+---
+
+### Step 2: Issue a key
+
+1. In the Dashboard sidebar, click **Keys**, then **Add Key**.
+
+2. Under **Access rights**, click **Apply Policy** and select **Limited Agent**.
+
+3. Click the **Configurations** tab and set an **Alias** such as `limited-agent` to identify this key in analytics.
+
+4. Click **Create Key** and copy the key.
+
+---
+
+### Step 3: Verify with MCP Inspector
+
+1. Start MCP Inspector:
+
+    ```bash
+    npx @modelcontextprotocol/inspector
+    ```
+
+2. Open the URL printed in your terminal.
+
+3. Set **Transport Type** to `Streamable HTTP`.
+
+4. Set **URL** to your MCP endpoint (find it under **MCP Proxy URL** in the proxy designer, then append `/mcp`).
+
+5. Add a header: `Authorization` = `Bearer {your-api-key}`.
+
+6. Click **Connect**.
+
+7. Click the **Tools** tab and select **get_analytics**.
+
+8. The tool requires a **metric** parameter. Enter `users` (or any of `posts`, `orders`, `revenue`).
+
+9. Click **Run** three times in quick succession. Each call succeeds. The response panel shows the analytics data from the Mock MCP Server.
+
+10. Click **Run** a fourth time. Tyk has exhausted the 3 calls per minute budget for this consumer and blocks the request. The response panel shows:
+
+    {/* TODO: Add screenshot of the rate limit error response in MCP Inspector */}
+
+    **MCP error -32001: Streamable HTTP error: Error POSTing to endpoint:**
+
+    ```json
+    {
+      "jsonrpc": "2.0",
+      "error": {
+        "code": -32003,
+        "message": "Rate Limit Exceeded",
+        "data": {
+          "http_code": 429
+        }
+      },
+      "id": 7
+    }
+    ```
+
+11. Click any other tool (`get_users`, `get_posts`, `get_products`) and click **Run**. Those calls succeed normally. Only the `get_analytics` counter is exhausted.
+
+---
+
+## How per-consumer and shared limits compose
+
+The rate limit configured in this guide applies per consumer key: each key on the **Limited Agent** policy has its own independent counter for `get_analytics`. A second key on the same policy has its own separate 3 calls per minute budget.
+
+You can also apply a shared ceiling across all consumers at the API definition level using the **Primitives** tab on the proxy. A shared limit protects the upstream from aggregate overload, regardless of individual consumer budgets. Both limits are enforced simultaneously: whichever is exhausted first blocks the call.
+
+For the full picture of how rate limits compose across the middleware and policy layers, see [MCP proxy policies](/ai-management/mcp-gateway/policies).
+
diff --git a/ai-management/mcp-gateway/managing-proxies.mdx b/ai-management/mcp-gateway/managing-proxies.mdx
new file mode 100644
index 0000000000..ab3595d469
--- /dev/null
+++ b/ai-management/mcp-gateway/managing-proxies.mdx
@@ -0,0 +1,195 @@
+---
+title: "Managing MCP proxies using the Dashboard"
+description: "How to create, view, edit, and delete MCP proxies using the Tyk Dashboard UI, covering the proxy list, the creation wizard, the Settings and Primitives tabs, proxy-level middleware, per-primitive middleware, the full definition editor, and permissions."
+keywords: "MCP, Model Context Protocol, MCP proxy, create MCP, update MCP, delete MCP, Tyk Dashboard, MCP wizard, listen path, permissions, MCP middleware, primitives tab, settings tab"
+sidebarTitle: "Manage MCP Proxies"
+---
+
+The **MCP** section of the Tyk Dashboard is the central registry of all MCP servers in your organization. Each proxy entry records the upstream server address, the listen path clients use to connect, the tools and resources the server exposes, and the access policies that govern it. Teams have a single authoritative place to see what MCP capabilities are available, onboard new servers, and control who can access them.
+
+The section gives you a searchable catalog of all registered proxies, a guided creation wizard for onboarding new servers, and the MCP Designer with two tabs: **Settings** for proxy-level configuration and middleware, and **Primitives** for managing per-primitive middleware on individual tools, resources, and prompts.
+
+For scripted or automated management, use the Dashboard API or Gateway API. See [MCP API extensions](/ai-management/mcp-gateway/mcp-api-extensions) for the full endpoint reference.
+
+<Note>
+MCP OAS definitions use the Tyk OAS format. They are not available as Tyk Classic API definitions. For the full definition structure, see [MCP OAS definition](/ai-management/mcp-gateway/mcp-proxy-definitions).
+</Note>
+
+---
+
+## Permissions
+
+Access to MCP proxy management is controlled by the `mcp` permission on the user's role.
+
+| Permission level | What the user can do |
+|---|---|
+| **Write** | Create, view, edit, and delete MCP proxies. Full access to all UI actions. |
+| **Read** | View the proxy list and MCP Designer. Access the definition viewer. Cannot create, edit, save, or delete. |
+| **Deny** | No access. The **MCP** sidebar item is not visible. |
+
+Permissions are assigned in the Dashboard under **User Management → Users**. For organization-wide access control, configure permissions on user groups rather than individual users.
+
+![MCP permission setting in the Dashboard](/img/ai-management/mcp-permission.png)
+
+---
+
+## The MCP proxies list
+
+The list page shows every MCP proxy managed by this Dashboard instance. Clicking a row opens the MCP Designer.
+
+The search input at the top filters proxies by name in real time. Clear the input to return to the full list.
+
+The **Add MCP Proxy** button opens the creation wizard.
+
+![MCP proxy list](/img/ai-management/mcp-proxy-list.png)
+
+---
+
+## Create an MCP proxy
+
+The creation wizard collects the minimum information needed to define a working MCP proxy. It has three steps.
+
+### Step 1: Basic information
+
+| Field | Required | What it sets |
+|---|---|---|
+| **Name** | Yes | Display name for the proxy. Also used to identify it in policy and key configuration. Maps to `x-tyk-api-gateway.info.name`. |
+| **Description** | No | Free-text description for team reference. Maps to `info.description`. |
+
+The name must be unique across all MCP proxies in this Dashboard instance.
+
+Click **Continue** to proceed.
+
+![Create MCP proxy, step 1: basic information](/img/ai-management/create-mcp-stage-1.png)
+
+### Step 2: Register server
+
+| Field | Required | What it sets |
+|---|---|---|
+| **Server URL** | Yes | The base URL of the upstream MCP server. Tyk forwards all MCP traffic to this address. Maps to `x-tyk-api-gateway.upstream.url`. |
+
+Enter the full URL of your upstream MCP server, for example `https://weather-mcp.example.com`. This is the server Tyk proxies to, not the URL clients use to connect to Tyk.
+
+Click **Continue** to proceed.
+
+![Create MCP proxy, step 2: register server](/img/ai-management/create-mcp-proxy-stage-2.png)
+
+### Step 3: Connect gateways
+
+Select the gateway instances to deploy this proxy to. You can click **Skip for now** to save the proxy without deploying it; it will exist in the Dashboard but will not serve traffic until you return and assign a gateway.
+
+Click **Finish** to save. The Dashboard displays "MCP proxy successfully created" and returns you to the proxy list.
+
+<Note>
+The wizard creates the proxy with bearer token authentication enabled and a listen path derived from the proxy name. For most deployments you'll want to open the MCP Designer to configure authentication, add per-primitive middleware, or set up OAuth discovery. See the [Settings tab](#settings-tab) and [Primitives tab](#primitives-tab) below.
+</Note>
+
+---
+
+## The MCP Designer
+
+Clicking a proxy in the list opens the MCP Designer. The MCP Designer has two tabs.
+
+![MCP Designer tabs](/img/ai-management/mcp-designer-tabs.png)
+
+### Settings tab
+
+The **Settings** tab covers two areas: core proxy configuration and proxy-level middleware.
+
+**Core configuration**: name, upstream server URL, and gateway assignment. To edit these fields, make your changes and click **Save MCP Proxy**. The Dashboard triggers a gateway reload automatically.
+
+**Authentication**: the authentication method applied to all inbound requests. Select a method from the **Authentication type** dropdown. See [Authentication](/api-management/client-authentication) for all supported methods and configuration options.
+
+**Proxy-level middleware**: middleware that applies to all requests through this proxy, regardless of which primitive is invoked. The following options are available in the Settings tab:
+
+| Middleware | What it does |
+|---|---|
+| **CORS** | Configures cross-origin resource sharing headers for browser-based MCP clients. |
+| **Transform Request Headers** | Adds, removes, or modifies HTTP headers on every request forwarded to the upstream. |
+| **Transform Response Headers** | Adds, removes, or modifies HTTP headers on every response returned to clients. |
+| **Context Variables** | Enables Tyk context variables (request metadata such as IP, key ID, and path) for use in header transforms and plugins. |
+| **Traffic Logs** | Configures how request and response data is captured in analytics. |
+| **Plugin Config / Bundle** | Configures custom plugin drivers and bundle sources for gateway-side plugin execution. |
+
+These options map to `x-tyk-api-gateway.middleware.global` in the proxy definition. For full configuration details, see [MCP middleware: proxy level](/ai-management/mcp-gateway/mcp-middleware#dashboard-settings-tab-proxy-level).
+
+### Primitives tab
+
+The **Primitives** tab lists every tool, resource, and prompt you have manually registered for this proxy. Each entry shows the primitive's name, its type (Tool, Resource, or Prompt), and the number of middleware rules applied to it. Use the type filter and search input to narrow the list.
+
+**Adding a primitive**
+
+Click **Add Primitive** to open the add primitive modal. Select the type (Tool, Resource, or Prompt) and enter the primitive name: this must match the name the upstream MCP server uses when advertising that primitive. Names cannot contain whitespace and must be unique within their type.
+
+Adding a primitive creates an entry in `x-tyk-api-gateway.middleware.mcpTools`, `mcpResources`, or `mcpPrompts` (depending on type) in the proxy definition.
+
+**Adding middleware to a primitive**
+
+Click a primitive to open its detail view, then click **Add Middleware**. The following middleware is available for primitives:
+
+| Category | Middleware |
+|---|---|
+| Security & Validation | Allow, Block, Ignore Authentication, Request Size Limit |
+| Traffic management | Rate Limit, Circuit Breaker |
+| Transformation | Transform Request Headers, Transform Response Headers, Virtual Endpoint |
+| Analytics | Track Endpoint, Do Not Track Endpoint |
+
+Each middleware option maps to the corresponding configuration block inside the primitive's entry in the proxy definition. See [MCP middleware](/ai-management/mcp-gateway/mcp-middleware) for what each option does and how it is configured.
+
+---
+
+## Editing the full definition
+
+The Dashboard UI covers most proxy configuration. To access advanced options not yet exposed in the UI — such as upstream OAuth, per-primitive token exchange overrides, and traffic management — edit the proxy's MCP OAS definition directly.
+
+Open the editor via **Actions → View MCP Proxy Definition** on the MCP Designer.
+
+![View MCP Proxy Definition](/img/ai-management/view-mcp-proxy-definition.png)
+
+The MCP OAS definition is an OpenAPI 3.0.3 document with an `x-tyk-api-gateway` vendor extension containing all Tyk-specific configuration. The key sections are:
+
+| Section | What it configures |
+|---|---|
+| `x-tyk-api-gateway.server.authentication` | Authentication method (bearer token, JWT, OAuth, mTLS) and settings. |
+| `x-tyk-api-gateway.server.authentication.securitySchemes[name].oauth2.protectedResourceMetadata` | PRM for OAuth 2.1 discovery: the `/.well-known/oauth-protected-resource` endpoint. |
+| `x-tyk-api-gateway.upstream` | Upstream URL, load balancing, upstream authentication, and mTLS. |
+| `x-tyk-api-gateway.middleware.mcpTools` | Per-tool middleware: access control, rate limits, timeouts, circuit breakers, request transformation. |
+| `x-tyk-api-gateway.middleware.mcpResources` | Per-resource middleware: same options as tools, keyed by resource URI or URI pattern. |
+| `x-tyk-api-gateway.middleware.mcpPrompts` | Per-prompt middleware: same options as tools, keyed by prompt name. |
+| `x-tyk-api-gateway.middleware.operations` | Method-level middleware applying to all calls of a given JSON-RPC method. |
+| `x-tyk-api-gateway.middleware.global` | API-wide middleware applying to all requests. |
+
+After editing, click **Save MCP Proxy** to save and redeploy. Changes are applied to all connected gateways automatically.
+
+### Common edits after initial setup
+
+**Configuring authentication**: The proxy is created with bearer token authentication enabled. To switch to a different method, open the Settings tab and select from the **Authentication type** dropdown. To use the external IdP integration — including scope check, PRM, and token exchange — select **OAuth 2.0**. See [Authentication](/api-management/client-authentication) for all supported methods.
+
+**Enabling PRM for OAuth discovery**: Open the Settings tab, select **OAuth 2.0** as the authentication type, and enable the **Protected Resource Metadata** toggle. Set the resource URL and add at least one authorization server URL. See [OAuth 2.0 authentication](/api-management/authentication/oauth2-authentication) for full configuration details.
+
+**Restricting which tools clients can call**: Use the Primitives tab: add the tool as a primitive, then add **Allow** middleware to it. Once any tool in the proxy has an Allow rule, all unlisted tools are blocked. For definition-based configuration, see [MCP middleware: access control](/ai-management/mcp-gateway/mcp-middleware#access-control).
+
+**Applying rate limits to a specific tool**: Use the Primitives tab: open the tool primitive and add **Rate Limit** middleware. For definition-based configuration, see [MCP middleware: traffic management](/ai-management/mcp-gateway/mcp-middleware#traffic-management).
+
+**Configuring upstream OAuth**: Add an `authentication.oauth.clientCredentials` block to `x-tyk-api-gateway.upstream` to have Tyk obtain and forward OAuth tokens to your upstream MCP server. See [MCP Gateway: OAuth 2.1 authentication](/ai-management/mcp-gateway/oauth-2-1#upstream-oauth).
+
+**Adding CORS or global header transforms**: Configure these in the Settings tab under the middleware section. Changes apply to all requests through the proxy.
+
+For a complete explanation of every field in the definition, see [MCP OAS definition](/ai-management/mcp-gateway/mcp-proxy-definitions).
+
+---
+
+## Delete an MCP proxy
+
+1. In the sidebar, click **MCP**.
+2. Open the proxy you want to delete.
+3. Click **Actions → Delete MCP Proxy** and confirm.
+
+{/* TODO: Screenshot — Actions menu open on an MCP proxy showing the "Delete MCP Proxy" option */}
+
+Deletion removes the proxy definition from the Dashboard and undeploys it from all connected gateways. Associated API keys and policies are not removed automatically; remove the access right from any keys scoped to this proxy, or delete those keys separately.
+
+<Note>
+Deleting an MCP proxy also removes it from any versioning hierarchy it belongs to. If the deleted proxy was a versioned child, the version entry is removed from the base proxy's definition.
+</Note>
+
diff --git a/ai-management/mcp-gateway/mcp-access-logs.mdx b/ai-management/mcp-gateway/mcp-access-logs.mdx
new file mode 100644
index 0000000000..a75470dc2a
--- /dev/null
+++ b/ai-management/mcp-gateway/mcp-access-logs.mdx
@@ -0,0 +1,129 @@
+---
+title: "MCP Gateway Access Logs"
+sidebarTitle: "Access Logs"
+description: "MCP-specific fields available in Tyk Gateway structured access logs, including JSON-RPC method, primitive type, primitive name, and error code."
+keywords: "mcp, access logs, observability, logging, mcp_method, mcp_primitive_name, json-rpc"
+---
+
+When Tyk Gateway processes an MCP request, it adds four MCP-specific fields to the structured access log record for that request. These fields let you filter, aggregate, and analyze MCP traffic in your log management tooling using the same access log pipeline you use for REST APIs.
+
+For an overview of all MCP observability signals, see [MCP observability](/ai-management/mcp-gateway/mcp-observability).
+
+## Prerequisites
+
+Access logging must be enabled in your Tyk Gateway configuration. Set `access_logs.enabled` to `true` in `tyk.conf`:
+
+```json
+{
+  "access_logs": {
+    "enabled": true
+  }
+}
+```
+
+## MCP fields
+
+The following fields are added to access log records for MCP requests. Each field is only included when it has a non-empty value; fields are omitted from the record entirely when not applicable, keeping log volume low on lifecycle calls such as `initialize` and `ping`.
+
+| Field | Type | Description |
+|---|---|---|
+| `api_type` | string | API protocol type. Always `mcp` for MCP requests. |
+| `mcp_method` | string | JSON-RPC method invoked, for example `tools/call` or `resources/read`. Present on all MCP requests. |
+| `mcp_primitive_type` | string | MCP primitive category: `tool`, `resource`, or `prompt`. Present only when a primitive was matched. |
+| `mcp_primitive_name` | string | Name of the specific tool, resource, or prompt invoked, for example `get_current_weather`. Present only when a primitive was matched. |
+| `mcp_error_code` | integer | Gateway-mapped JSON-RPC error code. Present only when the request failed at the gateway layer. |
+
+The `mcp_error_code` field reflects errors that occur within the gateway: authentication failures, rate limit rejections, and upstream errors. It does not capture error codes from within the upstream MCP server's JSON-RPC response body.
+
+| Error code | Meaning |
+|---|---|
+| `-32001` | Authentication required |
+| `-32002` | Access denied |
+| `-32003` | Rate limit exceeded |
+| `-32004` | Upstream error (502/503/504) |
+| `-32600` | Invalid request (400) |
+| `-32603` | Internal error (500) |
+
+## Configuring which fields to include
+
+By default, when access logging is enabled, all available fields are included in each log record. To restrict the fields logged, set a `template` array in `access_logs`:
+
+```json
+{
+  "access_logs": {
+    "enabled": true,
+    "template": [
+      "client_ip",
+      "api_id",
+      "api_name",
+      "api_type",
+      "method",
+      "path",
+      "status",
+      "latency_total",
+      "mcp_method",
+      "mcp_primitive_type",
+      "mcp_primitive_name",
+      "mcp_error_code"
+    ]
+  }
+}
+```
+
+When a `template` is configured, only the listed fields appear in each log record. Fields in the template that have no value for a given request are omitted.
+
+## Example log records
+
+A successful `tools/call` request produces a record similar to the following:
+
+```json
+{
+  "api_id": "my-weather-mcp",
+  "api_name": "Weather MCP Proxy",
+  "api_type": "mcp",
+  "client_ip": "10.0.0.42",
+  "latency_total": 312,
+  "method": "POST",
+  "mcp_method": "tools/call",
+  "mcp_primitive_name": "get_current_weather",
+  "mcp_primitive_type": "tool",
+  "path": "/mcp",
+  "prefix": "access-log",
+  "status": 200
+}
+```
+
+A request that fails at the gateway due to a missing or invalid key produces a record with `mcp_error_code` set and no primitive fields (the primitive was never reached):
+
+```json
+{
+  "api_id": "my-weather-mcp",
+  "api_type": "mcp",
+  "client_ip": "10.0.0.42",
+  "latency_total": 4,
+  "method": "POST",
+  "mcp_error_code": -32001,
+  "mcp_method": "tools/call",
+  "path": "/mcp",
+  "prefix": "access-log",
+  "status": 401
+}
+```
+
+An `initialize` lifecycle call produces a record with `mcp_method` set but no primitive fields:
+
+```json
+{
+  "api_id": "my-weather-mcp",
+  "api_type": "mcp",
+  "client_ip": "10.0.0.42",
+  "latency_total": 18,
+  "method": "POST",
+  "mcp_method": "initialize",
+  "path": "/mcp",
+  "prefix": "access-log",
+  "status": 200
+}
+```
+
+
diff --git a/ai-management/mcp-gateway/mcp-analytics.mdx b/ai-management/mcp-gateway/mcp-analytics.mdx
new file mode 100644
index 0000000000..1a6c7ac1ed
--- /dev/null
+++ b/ai-management/mcp-gateway/mcp-analytics.mdx
@@ -0,0 +1,84 @@
+---
+title: "MCP Analytics"
+sidebarTitle: "MCP Analytics"
+description: "Using Tyk Dashboard's Activity by MCP page to monitor traffic and errors across your MCP proxies and their tools, resources, and prompts."
+keywords: "mcp, analytics, dashboard, activity by mcp, primitives, tools, resources, prompts"
+---
+
+MCP analytics gives you visibility into how your MCP proxies and their primitives are being used, directly in Tyk Dashboard. Analytics are organized at two levels: **proxy-level charts** compare traffic and errors across your MCP proxies, giving you a fleet-wide view; **primitive-level charts** break the data down by individual tool, resource, or prompt, showing exactly what agents are calling and where failures are concentrated. Use the filter bar to scope the view to a specific proxy, primitive type, or time window.
+
+This page is populated by [Tyk Pump](/api-management/tyk-pump#dashboard-analytics-pumps), through one of two paths depending on your deployment topology. In a combined control and data plane, the `mongo-mcp-aggregate`/`sql-mcp-aggregate` pump types feed this page directly; see the [Mongo MCP Aggregate Pump](/api-management/dashboard-analytics/control-plane-pumps#mongo-mcp-aggregate-pump) and [SQL MCP Aggregate Pump](/api-management/dashboard-analytics/control-plane-pumps#sql-mcp-aggregate-pump) sections of Control Plane Pumps for installation and configuration. In a distributed deployment with Tyk MDCB, the Hybrid Pump has its own dedicated path; see [MCP Proxy Traffic](/api-management/dashboard-analytics/data-plane-pump#mcp-proxy-traffic) for how to configure it. Either way, the `mongo-mcp`/`sql-mcp` pumps store MCP traffic logs for your own downstream querying, but don't feed this page.
+
+<Note>
+To access the MCP analytics page, your Tyk Dashboard user account must have both `analytics` and `mcp` permissions.
+</Note>
+
+## Navigating to MCP Analytics
+
+In the Tyk Dashboard, go to **Monitoring** in the sidebar and select **Activity by MCP**.
+
+![Activity by MCP](/img/ai-management/activity-by-mcp.png)
+
+## Filters
+
+The filter bar at the top of the page applies to all charts simultaneously. Changing a filter refreshes every chart on the page.
+
+![Filters](/img/ai-management/filters.png)
+
+| Filter | Description |
+|---|---|
+| **MCP Proxy** | Restricts all charts to a single MCP proxy. Defaults to all proxies. |
+| **Primitive Type** | Filters by primitive type: **Tools**, **Resources**, or **Prompts**. |
+| **Primitive Name** | Filters by a specific primitive name within the selected type. The field is searchable. |
+| **Resolution** | Sets the time bucket for chart data: **Hourly**, **Daily**, or **Monthly**. |
+| **Date range** | Sets the time window for all chart data, in `dd/MM/yyyy` format. |
+
+When **Primitive Type** is changed, the **Primitive Name** filter resets to show all primitives of the new type.
+
+## Proxy-Level Charts
+
+The charts in this section aggregate activity at the proxy level. Use them to compare traffic and error rates across your MCP proxies and identify which ones need attention.
+
+### Activity per MCP
+
+A line chart showing hit count over time, with one line per MCP proxy. Use this chart to compare traffic volumes across proxies and identify usage trends. A proxy with disproportionately high traffic is a good candidate for tighter rate limits; a sudden spike may indicate a misbehaving client.
+
+![Activity per MCP](/img/ai-management/activity-per-mcp.png)
+
+### Errors by MCP
+
+A stacked bar chart showing error count over time, with bars stacked by MCP proxy. Use this chart to identify which proxies are generating errors and whether spikes correlate with specific time periods. Persistent errors on one proxy suggest a configuration or upstream issue; a brief, time-bounded burst may indicate a client retry loop or a transient upstream outage.
+
+![Errors by MCP](/img/ai-management/errors-per-mcp.png)
+
+## Primitive-Level Charts
+
+The charts in this section break down activity to the individual primitive level: tools, resources, and prompts. Use them to move from knowing that a proxy has a problem to knowing exactly which tool, resource, or prompt is the cause.
+
+### Most Used Primitives
+
+A horizontal stacked bar chart showing total hits ranked by primitive, highest first. Use this chart to identify which tools, resources, or prompts agents call most frequently. High-volume tools are the best candidates for per-tool rate limits and circuit breaker configuration.
+
+![Most Used Primitives](/img/ai-management/most-used-primitive.png)
+
+### Most Failing Primitives
+
+A horizontal stacked bar chart showing total errors ranked by primitive. Use this chart to pinpoint which primitives have the highest failure rates and may require investigation or circuit breaker configuration.
+
+![Most Failing Primitives](/img/ai-management/most-failing-primitive.png)
+
+### Slowest Primitives
+
+A horizontal stacked bar chart showing average latency in seconds, ranked by primitive. Use this chart to identify performance bottlenecks in your upstream MCP server. Consistently slow tools are good candidates for per-tool timeouts, which prevent a single slow tool from stalling an entire agent session.
+
+![Slowest Primitives](/img/ai-management/slowest-primitive.png)
+
+### Error Status Codes by Primitive
+
+A stacked bar chart breaking down HTTP error status codes by primitive. Use this chart to diagnose the type of errors occurring at the primitive level and determine whether failures are originating at the gateway or the upstream MCP server.
+
+![Error Status Codes by Primitive](/img/ai-management/error-status-code-by-primitive.png)
+
+<Note>
+Analytics data is only recorded for MCP proxies that have analytics recording enabled. If charts show no data for a proxy, verify that analytics recording is configured correctly for that proxy.
+</Note>
diff --git a/ai-management/mcp-gateway/mcp-api-extensions.mdx b/ai-management/mcp-gateway/mcp-api-extensions.mdx
new file mode 100644
index 0000000000..90a8d51271
--- /dev/null
+++ b/ai-management/mcp-gateway/mcp-api-extensions.mdx
@@ -0,0 +1,742 @@
+---
+title: "MCP API extensions"
+description: "Reference for the MCP proxy management endpoints added to the Tyk Gateway API and Tyk Dashboard API. Covers all CRUD operations, versioning parameters, response shapes, validation behavior, and the differences between the two APIs."
+keywords: "MCP, Model Context Protocol, Gateway API, Dashboard API, tyk-apis, MCP proxy, REST API reference, x-tyk-authorization, API extensions"
+sidebarTitle: "Gateway & Dashboard API Reference"
+---
+
+Tyk extends both the Tyk Gateway API and the Tyk Dashboard API with a dedicated set of endpoints for managing MCP OAS definitions. These endpoints are separate from the standard OAS API endpoints. MCP proxies are stored and managed through their own resource paths and are excluded from the standard `/tyk/apis` and `/api/apis` listings. This page documents every endpoint in both APIs: their parameters, request and response shapes, validation behaviour, and the differences between the two interfaces.
+
+<Note>
+For the full OpenAPI specifications of the Gateway API and Dashboard API, see [Tyk APIs](/tyk-apis).
+</Note>
+
+---
+
+## Tyk Gateway API extensions
+
+The Tyk Gateway API is the admin interface exposed directly by Tyk Gateway. MCP management endpoints are accessible at `/tyk/mcps` and require the gateway's admin secret in the `X-Tyk-Authorization` header.
+
+Changes made via the Gateway API take effect only after a gateway reload. The MCP endpoints write the proxy definition to disk and return immediately; they do not trigger an automatic reload.
+
+**Authentication**: `X-Tyk-Authorization: {gateway-secret}`
+**Base URL**: `{gateway-host}` (typically `http://localhost:8080`)
+
+---
+
+### List MCP proxies
+
+Returns all MCP OAS definitions loaded on this gateway instance. Standard Tyk OAS APIs are excluded from this response.
+
+| Property | Value |
+|---|---|
+| Method | `GET` |
+| URL | `/tyk/mcps` |
+| Auth | `X-Tyk-Authorization` |
+| Request body | None |
+| Query parameters | None |
+
+**Response**: `200 OK`
+
+```json
+[
+  {
+    "openapi": "3.0.3",
+    "info": { "title": "Weather MCP proxy", "version": "2025-11-25" },
+    "paths": { ... },
+    "x-tyk-api-gateway": { ... }
+  }
+]
+```
+
+An empty array is returned if no MCP proxies are configured.
+
+---
+
+### Get an MCP proxy
+
+Returns the full Tyk OAS API definition for a single MCP proxy.
+
+| Property | Value |
+|---|---|
+| Method | `GET` |
+| URL | `/tyk/mcps/{apiID}` |
+| Auth | `X-Tyk-Authorization` |
+| Request body | None |
+| Query parameters | None |
+
+**Path parameters**
+
+| Parameter | Description |
+|---|---|
+| `apiID` | The API ID of the MCP proxy to retrieve. |
+
+**Response headers**
+
+| Header | Description |
+|---|---|
+| `X-Tyk-Base-API-ID` | Present only when the retrieved proxy is a versioned child. Contains the API ID of the base (parent) proxy. |
+
+**Response**: `200 OK`
+
+```json
+{
+  "openapi": "3.0.3",
+  "info": { "title": "Weather MCP proxy", "version": "2025-11-25" },
+  "paths": { ... },
+  "x-tyk-api-gateway": {
+    "info": { "id": "weather-mcp-api", "name": "Weather MCP proxy", "state": { "active": true } },
+    "server": { "listenPath": { "value": "/weather-mcp/", "strip": true } },
+    "upstream": { "url": "https://weather-mcp.example.com" }
+  }
+}
+```
+
+**Error responses**
+
+| Status | Condition |
+|---|---|
+| `400 Bad Request` | The `apiID` value fails path component validation (for example, contains path traversal sequences). |
+| `404 Not Found` | No API exists with the given ID, or the API exists but is not an MCP proxy. |
+
+---
+
+### Create an MCP proxy
+
+Creates a new MCP proxy from a Tyk OAS API definition. The request body must be a valid OpenAPI 3.0.3 document containing an `x-tyk-api-gateway` extension.
+
+| Property | Value |
+|---|---|
+| Method | `POST` |
+| URL | `/tyk/mcps` |
+| Auth | `X-Tyk-Authorization` |
+| Content-Type | `application/json` |
+| Request body | Tyk OAS MCP definition |
+
+**Query parameters**
+
+| Parameter | Required | Description |
+|---|---|---|
+| `base_api_id` | No | The API ID of an existing MCP proxy to create this definition as a version of. If provided, `version_name` is also required. |
+| `version_name` | No | The version identifier for the new proxy (for example, `v2`). Required when `base_api_id` is specified. |
+| `set_default` | No | Set to `true` to make the new version the default version of the base proxy. Only applies when `base_api_id` is specified. |
+
+**Request body**: Minimum viable MCP proxy definition
+
+```json
+{
+  "openapi": "3.0.3",
+  "info": { "title": "Weather MCP proxy", "version": "2025-11-25" },
+  "paths": {
+    "/mcp": {
+      "post": { "operationId": "mcpTransportPost", "responses": { "200": { "description": "JSON-RPC response" } } },
+      "get":  { "operationId": "mcpSSEGet",         "responses": { "200": { "description": "SSE stream" } } }
+    }
+  },
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "Weather MCP proxy",
+      "state": { "active": true }
+    },
+    "server": {
+      "listenPath": { "value": "/weather-mcp/", "strip": true },
+      "authentication": { "enabled": true }
+    },
+    "upstream": {
+      "url": "https://weather-mcp.example.com"
+    }
+  }
+}
+```
+
+If no `id` is provided in `x-tyk-api-gateway.info`, the gateway generates one.
+
+**Response**: `200 OK`
+
+```json
+{
+  "key": "weather-mcp-api",
+  "status": "ok",
+  "action": "added"
+}
+```
+
+**Error responses**
+
+| Status | Condition |
+|---|---|
+| `400 Bad Request` | Request body is not valid JSON, `x-tyk-api-gateway` extension is missing, the definition fails MCP schema validation, or OAS structure validation fails. |
+| `422 Unprocessable Entity` | Versioning parameters are invalid: for example, `base_api_id` refers to an API that does not exist or is not an MCP proxy. |
+
+---
+
+### Update an MCP proxy
+
+Replaces the definition of an existing MCP proxy in full. Partial updates are not supported; provide the complete Tyk OAS API definition in the request body.
+
+| Property | Value |
+|---|---|
+| Method | `PUT` |
+| URL | `/tyk/mcps/{apiID}` |
+| Auth | `X-Tyk-Authorization` |
+| Content-Type | `application/json` |
+| Request body | Complete Tyk OAS MCP definition |
+
+The `x-tyk-api-gateway.info.id` field in the request body must match the `{apiID}` path parameter. A mismatch returns `400 Bad Request`.
+
+**Response**: `200 OK`
+
+```json
+{
+  "key": "weather-mcp-api",
+  "status": "ok",
+  "action": "modified"
+}
+```
+
+**Error responses**
+
+| Status | Condition |
+|---|---|
+| `400 Bad Request` | Invalid API ID, malformed request body, API ID mismatch between URL and body, the API is not an MCP proxy, or validation fails. |
+| `404 Not Found` | No API exists with the given ID. |
+
+---
+
+### Delete an MCP proxy
+
+Removes an MCP proxy definition from the gateway.
+
+| Property | Value |
+|---|---|
+| Method | `DELETE` |
+| URL | `/tyk/mcps/{apiID}` |
+| Auth | `X-Tyk-Authorization` |
+| Request body | None |
+
+If the deleted proxy is a versioned child, its entry is removed from the base proxy's version map. If it is a base proxy with existing versions, those children remain but lose their parent reference.
+
+**Response**: `200 OK`
+
+```json
+{
+  "key": "weather-mcp-api",
+  "status": "ok",
+  "action": "deleted"
+}
+```
+
+**Error responses**
+
+| Status | Condition |
+|---|---|
+| `400 Bad Request` | Invalid API ID, or the API exists but is not an MCP proxy. |
+| `404 Not Found` | No API exists with the given ID. |
+| `500 Internal Server Error` | The definition files could not be deleted from disk. |
+
+---
+
+### Hot reload
+
+Changes made via the Gateway API are written to disk but are not applied to live traffic until the gateway reloads. After any create, update, or delete operation, issue a reload:
+
+```bash
+# Reload all gateway instances in the group
+GET /tyk/reload/group
+
+# Reload this gateway instance only
+GET /tyk/reload
+```
+
+Both endpoints require the `X-Tyk-Authorization` header.
+
+---
+
+## Tyk Dashboard API extensions
+
+The Tyk Dashboard API is the management interface exposed by Tyk Dashboard. It proxies operations to connected gateway instances and triggers reloads automatically, so you don't need to issue a manual reload after Dashboard API operations.
+
+The Dashboard API accepts both JSON and YAML request bodies for create and update operations.
+
+**Authentication**: Dashboard user API key (retrieved from your user profile in the Dashboard)
+**Base URL**: `{dashboard-host}` (typically `http://localhost:3000`)
+
+---
+
+### List MCP proxies
+
+Returns all MCP proxies managed by this Dashboard instance, with pagination metadata.
+
+| Property | Value |
+|---|---|
+| Method | `GET` |
+| URL | `/api/mcps` |
+| Auth | `Authorization: {dashboard-api-key}` |
+| Request body | None |
+| Query parameters | None |
+
+**Response**: `200 OK`
+
+```json
+{
+  "mcps": [
+    {
+      "openapi": "3.0.3",
+      "info": { "title": "Weather MCP proxy", ... },
+      "x-tyk-api-gateway": { ... }
+    }
+  ],
+  "pages": 1
+}
+```
+
+The `pages` field contains the total number of pages available.
+
+---
+
+### Get an MCP proxy
+
+Returns the full Tyk OAS API definition for a single MCP proxy.
+
+| Property | Value |
+|---|---|
+| Method | `GET` |
+| URL | `/api/mcps/{apiId}` |
+| Auth | `Authorization: {dashboard-api-key}` |
+| Request body | None |
+
+**Response**: `200 OK`
+
+Returns the full Tyk OAS API definition. See [Get an MCP proxy: Gateway API](#get-an-mcp-proxy) for the response shape.
+
+**Error responses**
+
+| Status | Condition |
+|---|---|
+| `400 Bad Request` | The API exists but is not an MCP proxy. |
+| `404 Not Found` | No API exists with the given ID. |
+
+---
+
+### Create an MCP proxy
+
+Creates a new MCP proxy from a Tyk OAS API definition. The Dashboard API accepts both JSON and YAML.
+
+| Property | Value |
+|---|---|
+| Method | `POST` |
+| URL | `/api/mcps` |
+| Auth | `Authorization: {dashboard-api-key}` |
+| Content-Type | `application/json` or `application/x-yaml` |
+| Request body | Tyk OAS MCP definition |
+
+**Query parameters**
+
+| Parameter | Required | Description |
+|---|---|---|
+| `base_api_id` | No | The API ID of an existing MCP proxy to create this definition as a version of. The base API must exist and must itself be an MCP proxy. |
+
+**Example request**
+
+```bash
+curl -X POST ${DASH_URL}/api/mcps \
+  -H "Authorization: ${DASH_KEY}" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "openapi": "3.0.3",
+    "info": { "title": "Weather MCP proxy", "version": "2025-11-25" },
+    "paths": {
+      "/mcp": {
+        "post": { "operationId": "mcpTransportPost", "responses": { "200": { "description": "JSON-RPC response" } } },
+        "get":  { "operationId": "mcpSSEGet",         "responses": { "200": { "description": "SSE stream" } } }
+      }
+    },
+    "x-tyk-api-gateway": {
+      "info": { "name": "Weather MCP proxy", "state": { "active": true } },
+      "server": {
+        "listenPath": { "value": "/weather-mcp/", "strip": true },
+        "authentication": { "enabled": true }
+      },
+      "upstream": { "url": "https://weather-mcp.example.com" }
+    }
+  }'
+```
+
+**Response**: `200 OK`
+
+```json
+{
+  "Status": "OK",
+  "Message": "API created",
+  "Meta": "weather-mcp-api-id"
+}
+```
+
+The Dashboard triggers a gateway reload automatically. The proxy is active as soon as the response is returned.
+
+**Error responses**
+
+| Status | Condition |
+|---|---|
+| `400 Bad Request` | Validation failed, `base_api_id` refers to a non-existent or non-MCP proxy, or the definition is structurally invalid. |
+| `500 Internal Server Error` | An internal processing error occurred. |
+
+---
+
+### Update an MCP proxy
+
+Replaces the definition of an existing MCP proxy in full.
+
+| Property | Value |
+|---|---|
+| Method | `PUT` |
+| URL | `/api/mcps/{apiId}` |
+| Auth | `Authorization: {dashboard-api-key}` |
+| Content-Type | `application/json` or `application/x-yaml` |
+| Request body | Complete Tyk OAS MCP definition |
+
+**Example request**
+
+```bash
+curl -X PUT ${DASH_URL}/api/mcps/{apiID} \
+  -H "Authorization: ${DASH_KEY}" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "openapi": "3.0.3",
+    "info": { "title": "Weather MCP proxy", "version": "2025-11-25" },
+    "paths": { ... },
+    "x-tyk-api-gateway": {
+      "info": { "id": "{apiID}", "name": "Weather MCP proxy", "state": { "active": true } },
+      "server": {
+        "listenPath": { "value": "/weather-mcp/", "strip": true },
+        "authentication": { "enabled": true }
+      },
+      "upstream": { "url": "https://weather-mcp-v2.example.com" }
+    }
+  }'
+```
+
+**Response**: `200 OK`
+
+```json
+{
+  "Status": "OK",
+  "Message": "API updated",
+  "Meta": "{apiID}"
+}
+```
+
+The Dashboard triggers a gateway reload automatically.
+
+**Error responses**
+
+| Status | Condition |
+|---|---|
+| `400 Bad Request` | The API is not an MCP proxy, or validation fails. |
+| `404 Not Found` | No API exists with the given ID. |
+
+---
+
+### Delete an MCP proxy
+
+Removes an MCP proxy and triggers a gateway reload.
+
+| Property | Value |
+|---|---|
+| Method | `DELETE` |
+| URL | `/api/mcps/{apiId}` |
+| Auth | `Authorization: {dashboard-api-key}` |
+| Request body | None |
+
+**Example request**
+
+```bash
+curl -X DELETE ${DASH_URL}/api/mcps/{apiID} \
+  -H "Authorization: ${DASH_KEY}"
+```
+
+**Response**: `200 OK`
+
+```json
+{
+  "Status": "OK",
+  "Message": "API deleted",
+  "Meta": "{apiID}"
+}
+```
+
+The Dashboard triggers a gateway reload automatically.
+
+**Error responses**
+
+| Status | Condition |
+|---|---|
+| `400 Bad Request` | The API exists but is not an MCP proxy. |
+| `404 Not Found` | No API exists with the given ID. |
+
+---
+
+### List versions of an MCP proxy
+
+Returns all versioned children of a base MCP proxy.
+
+| Property | Value |
+|---|---|
+| Method | `GET` |
+| URL | `/api/mcps/{apiId}/versions` |
+| Auth | `Authorization: {dashboard-api-key}` |
+| Request body | None |
+
+The `{apiId}` must refer to a base proxy, not a versioned child. Calling this endpoint on a child proxy returns `422 Unprocessable Entity`.
+
+**Response**: `200 OK`
+
+```json
+{
+  "apis": [
+    { "apiId": "weather-mcp-v2", "name": "Weather MCP proxy v2" }
+  ],
+  "pages": 1
+}
+```
+
+**Error responses**
+
+| Status | Condition |
+|---|---|
+| `400 Bad Request` | The API exists but is not an MCP proxy. |
+| `422 Unprocessable Entity` | The API does not exist, is not in OAS format, or is itself a versioned child rather than a base proxy. |
+
+---
+
+### Get the MCP definition schema
+
+Returns the JSON Schema that Tyk uses to validate MCP OAS definitions. Use this to validate definitions client-side before submitting them to the API.
+
+| Property | Value |
+|---|---|
+| Method | `GET` |
+| URL | `/api/schemas/apidefs/mcp` |
+| Auth | `Authorization: {dashboard-api-key}` |
+| Request body | None |
+
+**Query parameters**
+
+| Parameter | Required | Description |
+|---|---|---|
+| `mcpVersion` | No | OAS version to return the schema for. Accepts `3.0` or `3.1`. Defaults to `3.0`. |
+| `pretty` | No | Set to `true` to return the schema with indented formatting. |
+
+**Response**: `200 OK`
+
+Returns a JSON Schema document describing the valid structure of a Tyk OAS MCP definition.
+
+---
+
+## Policy API extensions
+
+MCP policies are managed through the standard Tyk policy endpoints; there are no dedicated MCP policy routes. The existing endpoints accept and validate MCP-specific fields inside each `access_rights` entry. Tyk validates that these fields are only used on policies whose access rights target MCP proxies.
+
+For a conceptual explanation of what the policy fields do and how to configure access tiers, see [MCP proxy policies](/ai-management/mcp-gateway/policies).
+
+---
+
+### Gateway API
+
+**Authentication**: `X-Tyk-Authorization: {gateway-secret}`
+
+| Operation | Method | URL |
+|---|---|---|
+| List policies | `GET` | `/policies` |
+| Get a policy | `GET` | `/policies/{polID}` |
+| Create a policy | `POST` | `/policies` |
+| Update a policy | `PUT` | `/policies/{polID}` |
+| Delete a policy | `DELETE` | `/policies/{polID}` |
+
+**Success responses**
+
+| Operation | Status | Body |
+|---|---|---|
+| List / Get | `200 OK` | Policy object or array |
+| Create | `200 OK` | `{"key": "{polID}", "status": "ok", "action": "added"}` |
+| Update | `200 OK` | `{"key": "{polID}", "status": "ok", "action": "modified"}` |
+| Delete | `200 OK` | `{"key": "{polID}", "status": "ok", "action": "deleted"}` |
+
+---
+
+### Dashboard API
+
+**Authentication**: `Authorization: {dashboard-api-key}`
+
+| Operation | Method | URL |
+|---|---|---|
+| List policies | `GET` | `/api/portal/policies` |
+| Get a policy | `GET` | `/api/portal/policies/{polID}` |
+| Create a policy | `POST` | `/api/portal/policies` |
+| Update a policy | `PUT` | `/api/portal/policies/{polID}` |
+| Delete a policy | `DELETE` | `/api/portal/policies/{polID}` |
+
+The Dashboard API triggers a gateway reload automatically on create, update, and delete. The Gateway API requires a manual reload via `/tyk/reload` or `/tyk/reload/group`.
+
+---
+
+### MCP-specific fields in access rights
+
+The MCP-specific fields sit inside each entry in the `access_rights` object, alongside the standard `limit` and `versions` fields.
+
+| Field | Type | Description |
+|---|---|---|
+| `mcp_primitives` | array | Per-primitive rate limits. Each entry targets one named tool, resource, or prompt. |
+| `mcp_access_rights` | object | Primitive-level allow/block lists for tools, resources, and prompts. Values support Go regular expressions. |
+| `json_rpc_methods` | array | Per-method rate limits. Each entry targets one JSON-RPC method name such as `tools/call`. |
+| `json_rpc_methods_access_rights` | object | Method-level allow/block list. Controls which JSON-RPC protocol methods the consumer may use. |
+
+#### `mcp_primitives` entry
+
+| Field | Type | Description |
+|---|---|---|
+| `type` | string | Primitive type: `tool`, `resource`, or `prompt`. |
+| `name` | string | Name of the primitive as exposed by the MCP server. Case-sensitive. |
+| `limit.rate` | integer | Maximum calls allowed per time window. |
+| `limit.per` | integer | Time window in seconds. |
+
+#### `mcp_access_rights` object
+
+| Field | Type | Description |
+|---|---|---|
+| `tools.allowed` | array of strings | Allowlist of tool names. If non-empty, only listed tools are accessible. |
+| `tools.blocked` | array of strings | Tools to block. Applied after `allowed`. |
+| `resources.allowed` | array of strings | Allowlist of resource URIs. |
+| `resources.blocked` | array of strings | Resource URIs to block. |
+| `prompts.allowed` | array of strings | Allowlist of prompt names. |
+| `prompts.blocked` | array of strings | Prompt names to block. |
+
+#### `json_rpc_methods` entry
+
+| Field | Type | Description |
+|---|---|---|
+| `name` | string | The JSON-RPC method name, for example `tools/call` or `resources/read`. |
+| `limit.rate` | integer | Maximum calls using this method per time window. |
+| `limit.per` | integer | Time window in seconds. |
+
+#### `json_rpc_methods_access_rights` object
+
+| Field | Type | Description |
+|---|---|---|
+| `allowed` | array of strings | If non-empty, only these methods are permitted. |
+| `blocked` | array of strings | Methods to block. Applied after `allowed`. |
+
+---
+
+### Example policy request
+
+The following creates a policy that restricts a consumer to read-only JSON-RPC methods, limits them to two specific tools, and applies a per-primitive rate limit:
+
+```json
+{
+  "name": "Weather Agent — Standard Tier",
+  "state": "active",
+  "rate": 1000,
+  "per": 60,
+  "quota_max": 50000,
+  "quota_renewal_rate": 86400,
+  "access_rights": {
+    "{mcp-proxy-api-id}": {
+      "api_id": "{mcp-proxy-api-id}",
+      "api_name": "Weather MCP Proxy",
+      "versions": ["Default"],
+      "limit": { "rate": 200, "per": 60 },
+      "json_rpc_methods_access_rights": {
+        "allowed": ["tools/call", "tools/list", "resources/list", "resources/read"]
+      },
+      "mcp_access_rights": {
+        "tools": { "allowed": ["get_forecast", "search_weather"] },
+        "resources": { "blocked": ["internal://.*"] },
+        "prompts": {}
+      },
+      "json_rpc_methods": [
+        { "name": "tools/call", "limit": { "rate": 100, "per": 60 } }
+      ],
+      "mcp_primitives": [
+        { "type": "tool", "name": "get_forecast", "limit": { "rate": 20, "per": 60 } },
+        { "type": "resource", "name": "weather://current", "limit": { "rate": 10, "per": 60 } }
+      ]
+    }
+  }
+}
+```
+
+---
+
+### Policy validation for MCP
+
+When a policy is created or updated, Tyk validates the MCP-specific fields:
+
+- **MCP fields on non-MCP APIs**: if `mcp_primitives`, `mcp_access_rights`, `json_rpc_methods`, or `json_rpc_methods_access_rights` are set against an API ID that is not an MCP proxy, the request is rejected with `400 Bad Request`.
+- **REST fields on MCP proxies**: fields specific to REST APIs (`allowed_urls`, `endpoints`, `field_access_rights`) are rejected when set against an MCP proxy ID.
+- **Primitive type values**: the `type` field in each `mcp_primitives` entry must be `tool`, `resource`, or `prompt`. Any other value is rejected.
+
+---
+
+## MCP proxy isolation
+
+MCP proxies are managed separately from standard Tyk OAS APIs throughout the API surface:
+
+- `GET /tyk/apis` and `GET /api/apis` do not include MCP proxies in their responses.
+- `GET /tyk/mcps` and `GET /api/mcps` only return MCP proxies; standard OAS APIs do not appear.
+- Create and update operations on `/tyk/mcps` or `/api/mcps` reject definitions that are not valid MCP proxies.
+- Get and delete operations on `/tyk/mcps/{id}` or `/api/mcps/{id}` return `404` or `400` if the API ID refers to a non-MCP definition.
+
+This separation ensures that MCP proxy configuration and standard API configuration cannot be accidentally cross-applied.
+
+---
+
+## Validation
+
+Both APIs apply the same validation rules when creating or updating an MCP proxy.
+
+### Required structure
+
+Every MCP proxy definition must be a valid OpenAPI 3.0.3 document containing an `x-tyk-api-gateway` vendor extension at the root level. Definitions without this extension are rejected with `400 Bad Request`.
+
+### MCP schema validation
+
+The definition is validated against Tyk's MCP JSON schema. This schema enforces the structure of the `x-tyk-api-gateway` extension for MCP proxies (including the `mcpTools`, `mcpResources`, and `mcpPrompts` middleware maps) before any further processing.
+
+### Authentication metadata
+
+If `x-tyk-api-gateway.server.authentication.securitySchemes[name].oauth2.protectedResourceMetadata` is present and enabled, Tyk validates the PRM configuration. For MCP proxies specifically, at least one entry in `authorizationServers` is required.
+
+### Middleware restrictions
+
+Some middleware options are silently ignored when configured on MCP primitives (entries in `mcpTools`, `mcpResources`, or `mcpPrompts`). The schema accepts these fields for forward compatibility, but Tyk does not apply them at runtime:
+
+| Middleware | Reason |
+|---|---|
+| `transformRequestMethod` | Changing the HTTP method is not applicable to MCP's fixed POST/GET transport. |
+| `transformResponseBody` | MCP responses must be returned unmodified to preserve JSON-RPC 2.0 protocol compliance. |
+| `urlRewrite` | URL rewriting conflicts with MCP's single-endpoint transport (`/mcp`). |
+| `cache` | Cache keys are derived from the URL path, which is identical for all MCP requests (`/mcp`). |
+| `mockResponse` | Mock responses are incompatible with MCP's streaming JSON-RPC transport. |
+
+Global middleware settings that are also not supported for MCP OAS definitions:
+
+| Setting | Reason |
+|---|---|
+| `server.batchProcessing` | Batch HTTP processing is incompatible with the MCP transport model. |
+| `middleware.global.cache` | Caching is not supported for MCP APIs. Neither global nor per-primitive `cache` middleware has any effect on MCP traffic. |
+
+---
+
+## Gateway API vs Dashboard API
+
+| Aspect | Gateway API (`/tyk/mcps`) | Dashboard API (`/api/mcps`) |
+|---|---|---|
+| **Authentication** | `X-Tyk-Authorization: {secret}` header | `Authorization: {api-key}` header |
+| **Content types accepted** | `application/json` | `application/json`, `application/x-yaml` |
+| **List response format** | JSON array of OAS definitions | `{"mcps": [...], "pages": N}` |
+| **Reload on change** | Manual: must call `/tyk/reload` or `/tyk/reload/group` | Automatic |
+| **Versioning parameters** | `base_api_id`, `version_name`, `set_default` | `base_api_id` |
+| **Version listing** | Not available | `GET /api/mcps/{apiId}/versions` |
+| **Schema endpoint** | Not available | `GET /api/schemas/apidefs/mcp` |
+| **Multi-gateway propagation** | Applies to this gateway instance only | Propagates to all connected gateways |
diff --git a/ai-management/mcp-gateway/mcp-metrics.mdx b/ai-management/mcp-gateway/mcp-metrics.mdx
new file mode 100644
index 0000000000..de22fedacf
--- /dev/null
+++ b/ai-management/mcp-gateway/mcp-metrics.mdx
@@ -0,0 +1,251 @@
+---
+title: "MCP Gateway Metrics"
+sidebarTitle: "Metrics"
+description: "Monitor MCP proxy traffic with OpenTelemetry custom metrics. Includes MCP-specific dimensions and worked examples for common monitoring use cases."
+keywords: "mcp, metrics, opentelemetry, dimensions, tools, primitives, latency, errors"
+---
+
+When Tyk Gateway proxies MCP traffic, it makes four MCP-specific fields available as `metadata` dimension sources in custom OTel metric instruments. Use these dimensions to monitor tool call volumes, track latency per primitive, classify gateway errors, and correlate usage to individual sessions, all through the same observability infrastructure you use for your REST APIs.
+
+For an overview of all MCP observability signals, see [MCP observability](/ai-management/mcp-gateway/mcp-observability).
+
+## MCP fields reference
+
+The following fields are derived from the JSON-RPC payload and available as `metadata` dimension sources in custom metrics.
+
+| Field | Description | Example values |
+|---|---|---|
+| `mcp_method` | JSON-RPC method invoked | `tools/call`, `initialize`, `resources/read`, `prompts/get` |
+| `mcp_primitive_type` | MCP primitive category | `tool`, `resource`, `prompt` |
+| `mcp_primitive_name` | Name of the specific tool, resource, or prompt | `get_current_weather`, `search_documents` |
+| `mcp_error_code` | Gateway-mapped JSON-RPC error code; empty string on success | `-32001` (auth required), `-32002` (access denied), `-32003` (rate limit exceeded), `-32004` (upstream error) |
+
+All four fields are populated only for MCP APIs. For non-MCP requests they are empty strings, so existing metric instruments are unaffected.
+
+<Note>
+`mcp_error_code` reflects errors mapped by the gateway layer (authentication failures, rate limit rejections, and upstream errors), not error codes in the upstream MCP server's JSON-RPC response body. See [MCP access logs](/ai-management/mcp-gateway/mcp-access-logs) for the full list of gateway error codes.
+</Note>
+
+## Use cases
+
+The examples below use Tyk's [custom metrics](/api-management/metrics/custom-metrics) system. Each instrument is a JSON object in the `opentelemetry.metrics.api_metrics` array in `tyk.conf`.
+
+### MCP traffic volume by method
+
+Track how many requests each JSON-RPC method receives across all MCP APIs. This shows the distribution of `tools/call`, `initialize`, `resources/read`, and other operations.
+
+```json
+{
+  "name": "tyk.mcp.requests.by_method",
+  "type": "counter",
+  "description": "Request count broken down by MCP JSON-RPC method",
+  "dimensions": [
+    { "source": "metadata", "key": "mcp_method",  "label": "mcp_method",  "default": "" },
+    { "source": "metadata", "key": "api_id",       "label": "api_id" }
+  ]
+}
+```
+
+### Top tools by call volume
+
+Identify the most frequently invoked tools, useful for cost attribution and optimization. Add `api_id` to compare usage across multiple MCP backends.
+
+```json
+{
+  "name": "tyk.mcp.tool_calls.total",
+  "type": "counter",
+  "description": "MCP tool invocations by tool name and primitive type",
+  "dimensions": [
+    { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name",      "default": "" },
+    { "source": "metadata", "key": "mcp_primitive_type", "label": "primitive_type", "default": "" },
+    { "source": "metadata", "key": "api_id",             "label": "api_id" }
+  ],
+  "filters": { "methods": ["POST"] }
+}
+```
+
+### Tool execution latency: upstream
+
+Measure how long the upstream MCP server takes to respond per tool. Use this to identify slow tools and performance regressions; this measurement excludes gateway overhead.
+
+```json
+{
+  "name": "tyk.mcp.upstream.duration",
+  "type": "histogram",
+  "description": "Upstream latency per MCP tool",
+  "histogram_source": "upstream",
+  "histogram_buckets": [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10],
+  "dimensions": [
+    { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name", "default": "" },
+    { "source": "metadata", "key": "api_id",             "label": "api_id" }
+  ],
+  "filters": { "methods": ["POST"] }
+}
+```
+
+### Total request duration with MCP labels
+
+Measure end-to-end latency (client → gateway → upstream → client) with MCP labels attached. Compare this with upstream latency to quantify gateway overhead.
+
+```json
+{
+  "name": "tyk.mcp.request.duration",
+  "type": "histogram",
+  "description": "End-to-end latency per MCP tool",
+  "histogram_source": "total",
+  "histogram_buckets": [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10],
+  "dimensions": [
+    { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name",   "default": "" },
+    { "source": "metadata", "key": "mcp_method",         "label": "mcp_method",  "default": "" },
+    { "source": "metadata", "key": "api_id",             "label": "api_id" }
+  ]
+}
+```
+
+<Note>
+The `histogram_source` field accepts three values: `"upstream"` (upstream server latency only), `"total"` (end-to-end including gateway), and `"gateway"` (gateway processing time only, excluding upstream). Use `"gateway"` to isolate gateway overhead.
+</Note>
+
+### JSON-RPC error classification
+
+Count MCP errors by their gateway-mapped JSON-RPC error code. Unlike HTTP errors, MCP errors are typically returned with HTTP 200; `mcp_error_code` is the only reliable way to detect gateway-layer failures.
+
+```json
+{
+  "name": "tyk.mcp.errors.by_code",
+  "type": "counter",
+  "description": "MCP JSON-RPC errors by error code and tool",
+  "dimensions": [
+    { "source": "metadata", "key": "mcp_error_code",     "label": "error_code", "default": "" },
+    { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name",  "default": "" },
+    { "source": "metadata", "key": "api_id",             "label": "api_id" }
+  ],
+  "filters": { "methods": ["POST"] }
+}
+```
+
+<Note>
+Filter this instrument in your metrics backend to exclude the empty `error_code` value (successful requests), or add a `status_codes` filter if your upstream signals errors via HTTP status.
+</Note>
+
+### Per-session tool usage
+
+Correlate tool call volume to individual MCP sessions using the authenticated session alias. Use this to identify heavy users, debug specific sessions, or allocate costs to teams.
+
+```json
+{
+  "name": "tyk.mcp.tool_calls.by_session",
+  "type": "counter",
+  "description": "Tool calls per session and tool",
+  "dimensions": [
+    { "source": "session",  "key": "alias",              "label": "session",    "default": "unknown" },
+    { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name",  "default": "" },
+    { "source": "metadata", "key": "api_id",             "label": "api_id" }
+  ],
+  "filters": { "methods": ["POST"] }
+}
+```
+
+<Note>
+`alias` is the human-readable key alias set on the API key or OAuth token. If your sessions are identified differently (for example, via a JWT claim), use the `context` source with the appropriate `jwt_claims_<name>` key instead.
+</Note>
+
+### Multi-API MCP backend comparison
+
+Compare performance across multiple MCP backends by including `api_id` alongside tool dimensions. Use this to determine whether the same tool performs differently on different upstream MCP servers.
+
+```json
+{
+  "name": "tyk.mcp.backend.upstream.duration",
+  "type": "histogram",
+  "description": "Upstream latency per tool broken down by MCP backend",
+  "histogram_source": "upstream",
+  "histogram_buckets": [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5],
+  "dimensions": [
+    { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name", "default": "" },
+    { "source": "metadata", "key": "api_id",             "label": "api_id" }
+  ]
+}
+```
+
+### Session efficiency
+
+Measure the ratio of productive `tools/call` operations to session lifecycle calls (`initialize`). A low ratio may indicate clients that open sessions but make few tool calls, useful for detecting misconfigured AI clients or idle connections.
+
+```json
+{
+  "name": "tyk.mcp.method.distribution",
+  "type": "counter",
+  "description": "Distribution of MCP method types for session efficiency analysis",
+  "dimensions": [
+    { "source": "metadata", "key": "mcp_method", "label": "mcp_method", "default": "" },
+    { "source": "metadata", "key": "api_id",     "label": "api_id" }
+  ]
+}
+```
+
+To compute efficiency, query your metrics backend for the ratio of `tools/call` to `initialize` counts:
+
+```promql
+# PromQL: ratio of tool calls to session initializations per API
+sum by (api_id) (rate(tyk_mcp_method_distribution_total{mcp_method="tools/call"}[5m]))
+/
+sum by (api_id) (rate(tyk_mcp_method_distribution_total{mcp_method="initialize"}[5m]))
+```
+
+## Complete configuration example
+
+Add the following to `tyk.conf`. This covers all the instruments needed for the [Grafana](https://grafana.com/) dashboard panels:
+
+```json
+{
+  "opentelemetry": {
+    "metrics": {
+      "enabled": true,
+      "api_metrics": [
+        {
+          "name": "tyk.mcp.requests.total",
+          "type": "counter",
+          "description": "MCP request count by method, tool, API, and session",
+          "dimensions": [
+            { "source": "metadata", "key": "mcp_method",         "label": "mcp_method",      "default": "" },
+            { "source": "metadata", "key": "mcp_primitive_type", "label": "primitive_type",  "default": "" },
+            { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name",       "default": "" },
+            { "source": "metadata", "key": "mcp_error_code",     "label": "error_code",      "default": "" },
+            { "source": "metadata", "key": "api_id",             "label": "api_id" },
+            { "source": "session",  "key": "alias",              "label": "session",         "default": "unknown" }
+          ]
+        },
+        {
+          "name": "tyk.mcp.upstream.duration",
+          "type": "histogram",
+          "description": "Upstream MCP server latency per tool and API",
+          "histogram_source": "upstream",
+          "histogram_buckets": [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10],
+          "dimensions": [
+            { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name", "default": "" },
+            { "source": "metadata", "key": "api_id",             "label": "api_id" }
+          ]
+        },
+        {
+          "name": "tyk.mcp.request.duration",
+          "type": "histogram",
+          "description": "End-to-end MCP request latency per tool and API",
+          "histogram_source": "total",
+          "histogram_buckets": [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10],
+          "dimensions": [
+            { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name",  "default": "" },
+            { "source": "metadata", "key": "mcp_method",         "label": "mcp_method", "default": "" },
+            { "source": "metadata", "key": "api_id",             "label": "api_id" }
+          ]
+        }
+      ]
+    }
+  }
+}
+```
+
+<Note>
+The `tyk.mcp.requests.total` counter uses 6 dimensions. Keep the total dimension count at 10 or fewer per instrument to stay on the OTel SDK fast path. See [Performance Considerations](/api-management/logs/access-logs#performance-considerations) for guidance.
+</Note>
+
diff --git a/ai-management/mcp-gateway/mcp-middleware.mdx b/ai-management/mcp-gateway/mcp-middleware.mdx
new file mode 100644
index 0000000000..e1e983d897
--- /dev/null
+++ b/ai-management/mcp-gateway/mcp-middleware.mdx
@@ -0,0 +1,566 @@
+---
+title: "MCP middleware"
+description: "Apply per-primitive middleware to MCP tools, resources, and prompts in Tyk Gateway. Covers access control, traffic management, request transformation, circuit breakers, timeouts, and observability for MCP traffic."
+keywords: "MCP, Model Context Protocol, MCP middleware, MCP tools, MCP resources, MCP prompts, allowlist, rate limiting, circuit breaker, virtual endpoint, JSON-RPC, Tyk OAS"
+sidebarTitle: "MCP Middleware"
+---
+
+Tyk lets you apply middleware to individual MCP primitives (specific tools, resources, and prompts), giving you the same granular control over AI agent traffic that you have over conventional API endpoints. You can rate limit an expensive tool, block a sensitive prompt, set a circuit breaker on an unreliable resource, or apply a custom plugin to inspect tool call arguments before they reach the upstream. This page describes each middleware capability available for MCP proxies, when to use it, and how to configure it.
+
+> For an explanation of how middleware fits into the overall MCP API definition structure (the three levels, their evaluation order, and how they interact), see [MCP definitions](/ai-management/mcp-gateway/mcp-proxy-definitions).
+
+---
+
+## Configuration paths
+
+Middleware can be configured in three ways, depending on the level at which it applies and whether you are using the Dashboard UI or editing the definition directly.
+
+### Dashboard: Settings tab (proxy level)
+
+The **Settings** tab on the MCP Designer exposes middleware that applies to all requests through the proxy, regardless of which primitive is invoked. These options map to `x-tyk-api-gateway.middleware.global` in the definition:
+
+| Middleware | Maps to |
+|---|---|
+| CORS | `middleware.global.cors` |
+| Transform Request Headers | `middleware.global.transformRequestHeaders` |
+| Transform Response Headers | `middleware.global.transformResponseHeaders` |
+| Context Variables | `middleware.global.contextVariables` |
+| Traffic Logs | `middleware.global.trafficLogs` |
+| Plugin Config / Bundle | `middleware.global.pluginConfig` |
+
+### Dashboard: Primitives tab (primitive level)
+
+The **Primitives** tab lets you add middleware to individual tools, resources, and prompts. Click a primitive and then **Add Middleware**. These options map to the primitive's entry in `mcpTools`, `mcpResources`, or `mcpPrompts`. See [Managing MCP proxies using the Dashboard](/ai-management/mcp-gateway/managing-proxies#primitives-tab) for the full UI walkthrough.
+
+| Middleware | Maps to |
+|---|---|
+| Allow, Block | `allow`, `block` |
+| Ignore Authentication | `ignoreAuthentication` |
+| Rate Limit | `rateLimit` |
+| Request Size Limit | `requestSizeLimit` |
+| Circuit Breaker | `circuitBreaker` |
+| Transform Request Headers | `transformRequestHeaders` |
+| Transform Response Headers | `transformResponseHeaders` |
+| Virtual Endpoint | `virtualEndpoint` |
+| Scope check | `scopeCheck` |
+| Token exchange | `exchange` |
+| Track Endpoint, Do Not Track Endpoint | `trackEndpoint`, `doNotTrackEndpoint` |
+| Post Plugins | `postPlugins` |
+
+### MCP definition (all levels)
+
+All middleware options (including those not exposed in the Dashboard) can be configured by editing the proxy definition directly. Open the definition editor via **Actions → View MCP Proxy Definition** in the Dashboard, or submit the definition via the API. The following options are only available this way:
+
+- `transformRequestBody`: Request body transformation (supported)
+- `urlRewrite`, `transformRequestMethod`: Accepted by the schema but silently ignored at runtime; they have no effect on MCP primitives. See the warnings in the [request transformation](#request-transformation) section below.
+- `middleware.operations`: Method-level middleware applying to all calls of a given JSON-RPC method (for example, all `tools/call` requests), evaluated before primitive-level middleware
+
+<Note>
+Caching and mock responses are not supported for MCP primitives.
+</Note>
+
+The sections below document every option with definition examples. All definition examples apply to the `mcpTools`, `mcpResources`, or `mcpPrompts` maps unless otherwise noted.
+
+---
+
+## How primitive middleware is resolved
+
+Middleware for MCP primitives is configured in `x-tyk-api-gateway.middleware` inside one of three maps:
+
+- `mcpTools`: Keyed by tool name (the `params.name` value in a `tools/call` request)
+- `mcpResources`: Keyed by resource URI or URI wildcard pattern (the `params.uri` value in a `resources/read` request)
+- `mcpPrompts`: Keyed by prompt name (the `params.name` value in a `prompts/get` request)
+
+When Tyk receives a `tools/call`, `resources/read`, or `prompts/get` request, it extracts the primitive identifier from the JSON-RPC body, finds the matching entry in the relevant map, and executes the configured middleware before proxying to the upstream.
+
+The `middleware.operations` map applies middleware at the JSON-RPC method level rather than the individual primitive level. Method-level middleware evaluates before primitive-level middleware.
+
+---
+
+## Access control
+
+Access control middleware determines which primitives a client is allowed to invoke. It is the most commonly configured middleware for MCP proxies, because MCP servers typically expose more capabilities than you want to make available through the gateway.
+
+### allow
+
+The `allow` middleware adds a primitive to an explicit allowlist. When any primitive within a category has `allow` enabled, Tyk switches that entire category into **allowlist mode**: only the explicitly listed primitives are accessible, and all others are rejected with a JSON-RPC error.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "get-weather": {
+        "allow": { "enabled": true }
+      },
+      "get-forecast": {
+        "allow": { "enabled": true }
+      }
+    }
+  }
+}
+```
+
+In this example, only `get-weather` and `get-forecast` are accessible. A request to any other tool name returns an error without reaching the upstream. Resources and prompts are unaffected; the three categories are evaluated independently, so allowlisting tools does not restrict resource or prompt access.
+
+Allowlist mode is the recommended approach when you have a known set of primitives to expose. It ensures that new tools added to the upstream MCP server are not automatically accessible through the gateway; you must explicitly add them to the allowlist.
+
+### block
+
+The `block` middleware explicitly denies access to a primitive. Tyk returns a JSON-RPC error without forwarding the request to the upstream. Use `block` when all primitives should be accessible by default except a specific subset.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "admin-reset": {
+        "block": { "enabled": true }
+      }
+    }
+  }
+}
+```
+
+If no `allow` rules exist in the category, all primitives are accessible by default. Block rules apply on top of this open default. If `allow` rules are also present, block rules take precedence.
+
+### ignoreAuthentication
+
+The `ignoreAuthentication` middleware exempts a primitive from the API's authentication checks, allowing unauthenticated access to that specific primitive while the rest of the API remains protected.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "server-status": {
+        "ignoreAuthentication": { "enabled": true }
+      }
+    }
+  }
+}
+```
+
+Use this for primitives that need to be publicly accessible (health checks, capability discovery, or public reference data) without requiring a separate unauthenticated API definition.
+
+### scopeCheck
+
+The `scopeCheck` middleware enforces OAuth 2.0 scope requirements for a specific primitive. When enabled, Tyk extracts the scopes from the inbound token and checks them against the `security:` declarations for that primitive. Requests where the token does not carry the required scopes are rejected with a `403 Forbidden` and an RFC 6750 `WWW-Authenticate` header describing the missing scopes.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "read-customer": {
+        "scopeCheck": { "enabled": true }
+      }
+    }
+  }
+}
+```
+
+Scope enforcement for the primitive is governed by two things working together:
+
+- The `security:` field on the primitive in the [Tyk vendor extension](/api-management/gateway-config-tyk-oas) — this names which scopes the token must carry. MCP primitives have no OAS path entry, so `security:` is declared in `x-tyk-api-gateway.middleware.mcpTools` (or `mcpResources` / `mcpPrompts`) alongside the other per-primitive middleware:
+
+  ```json
+  {
+    "middleware": {
+      "mcpTools": {
+        "read-customer": {
+          "security": [{ "idpAuth": ["tools:read"] }],
+          "scopeCheck": { "enabled": true }
+        }
+      }
+    }
+  }
+  ```
+
+- The API-level `oauth2.scopeCheck` configuration — `claimNames`, `scopeSource`, and `separator` control how Tyk reads scopes out of the inbound token.
+
+Setting `enabled: true` activates scope enforcement for this primitive only. Other primitives are unaffected unless they also declare `scopeCheck: { "enabled": true }`. Omitting the block or setting `enabled: false` means this primitive's own `security:` declaration does not contribute to scope enforcement. The API-level root `security:` array may still apply depending on `scopeSource` — when `scopeSource` is `"union"` (the default) or `"global"`, root security requirements are enforced regardless.
+
+`scopeCheck` requires the `oauth2` security scheme to be configured on the API. It has no effect when `externalOAuthServer` or other authentication schemes are in use. For scheme setup and scope configuration details, see [OAuth 2.0 (External IdP)](/api-management/authentication/oauth2-authentication).
+
+---
+
+## Upstream authentication
+
+### exchange
+
+The `exchange` middleware overrides the token exchange provider's defaults for a specific primitive. When active, Tyk requests a new exchange token scoped to this primitive's `audience` and `scopes`, rather than using the API-level provider's `defaultTarget`.
+
+Token exchange is Enterprise Edition only and requires a provider to be configured at the API level under `oauth2.tokenExchange.providers`. For provider setup and caching options, see [Token exchange](/api-management/authentication/token-exchange).
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "write-record": {
+        "exchange": {
+          "enabled": true,
+          "audience": "https://storage.example.com",
+          "scopes": ["storage.write"]
+        }
+      }
+    }
+  }
+}
+```
+
+- **`enabled`**: Must be explicitly `true` to activate the per-primitive override. Omitting this field or setting it to `false` leaves the API-level provider's `defaultTarget` in effect for this primitive.
+- **`audience`**: The resource or audience parameter sent to the token endpoint, overriding `provider.defaultTarget` for this primitive.
+- **`scopes`**: The scopes to request in the exchange. When omitted or empty while `enabled` is `true`, Tyk uses the scopes listed in the primitive's `security:` field in the [Tyk vendor extension](/api-management/gateway-config-tyk-oas) — the same field used by `scopeCheck` — as the scopes to request from the token endpoint. This avoids repeating the scope list in two places.
+
+When no `exchange` block is present on a primitive, the provider's `defaultTarget` and `scopes` apply uniformly to all primitives.
+
+---
+
+## Traffic management
+
+Traffic management middleware protects your upstream MCP server from overload and controls the quality of service for individual primitives.
+
+### rateLimit
+
+The `rateLimit` middleware applies a rate limit to a specific primitive, counted separately from any method-level or MCP server-level rate limits. Use it when different tools have meaningfully different costs: for example, a resource-intensive tool should have a tighter limit than one that reads static metadata.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "execute-query": {
+        "rateLimit": {
+          "enabled": true,
+          "rate": 10,
+          "per": 60
+        }
+      },
+      "list-tables": {
+        "rateLimit": {
+          "enabled": true,
+          "rate": 200,
+          "per": 60
+        }
+      }
+    }
+  }
+}
+```
+
+The `rate` field is the maximum number of requests allowed in the time window specified by `per` (in seconds, or as a shorthand string such as `"1m"` or `"30s"`). Primitive-level rate limits are additive with method-level limits; a request must pass both.
+
+Rate limits configured in `mcpTools`, `mcpResources`, and `mcpPrompts` apply to all consumers of the proxy; they are shared ceilings. For per-consumer primitive rate limits that track each consumer key independently, use the `mcp_primitives` field in a security policy. Both can be active simultaneously: the middleware limit protects the upstream from aggregate overload; the policy limit enforces each consumer's individual entitlement. See [MCP proxy policies](/ai-management/mcp-gateway/policies).
+
+### requestSizeLimit
+
+The `requestSizeLimit` middleware restricts the maximum size of the JSON-RPC request body for a specific primitive. Use it for tools that accept large argument payloads, where oversized requests could cause performance problems upstream.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "process-document": {
+        "requestSizeLimit": {
+          "enabled": true,
+          "value": 65536
+        }
+      }
+    }
+  }
+}
+```
+
+The `value` field is in bytes. Requests that exceed the limit are rejected before reaching the upstream.
+
+### circuitBreaker
+
+The `circuitBreaker` middleware monitors the failure rate for a specific primitive and temporarily stops forwarding requests when the error rate exceeds a threshold. This protects the upstream from cascading failures and gives it time to recover.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "search-index": {
+        "circuitBreaker": {
+          "enabled": true,
+          "threshold": 0.5,
+          "sampleSize": 20,
+          "coolDownPeriod": 30,
+          "halfOpenStateEnabled": true
+        }
+      }
+    }
+  }
+}
+```
+
+- **`threshold`**: The ratio of failed requests (0.0 to 1.0) that trips the breaker. `0.5` means the breaker trips when more than 50% of recent requests fail.
+- **`sampleSize`**: The number of requests in the evaluation window. The threshold is checked after each window.
+- **`coolDownPeriod`**: Seconds to wait with the breaker open before attempting recovery.
+- **`halfOpenStateEnabled`**: When `true`, allows a small number of probe requests through during the cool-down period to test whether the upstream has recovered, rather than waiting for the full period to elapse before reopening.
+
+Circuit breakers are most valuable for tools that call external services or perform expensive operations where failure is likely to persist, rather than being transient.
+
+### cache
+
+<Warning>
+The `cache` field is not supported for MCP primitives. Setting it has no effect. See the capability matrix at the end of this page.
+</Warning>
+
+The `cache` field is accepted in the configuration schema but does not activate caching for MCP primitives. Any `cache` configuration you set on an entry in `mcpTools`, `mcpResources`, or `mcpPrompts` is silently ignored at runtime. The limitation is architectural: Tyk's cache middleware derives cache keys from the HTTP URL path, which is the same for every MCP request (`/mcp`). It does not inspect the JSON-RPC request body, so it cannot distinguish a `resources/read` call for `weather://current` from a `tools/call` to `get_forecast`; they resolve to the same cache key. Caching MCP traffic meaningfully would require cache key derivation from the JSON-RPC method and primitive identifier, which is not currently implemented.
+
+---
+
+## Request transformation
+
+Request transformation middleware modifies requests before they reach the upstream MCP server. You can add or remove headers, rewrite the upstream URL, or replace the request body.
+
+### transformRequestHeaders
+
+The `transformRequestHeaders` middleware adds, removes, or modifies HTTP headers on the request forwarded to the upstream.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "query-database": {
+        "transformRequestHeaders": {
+          "enabled": true,
+          "add": [
+            { "name": "X-Caller-Id", "value": "$tyk_context.request_id" },
+            { "name": "X-Tool-Name", "value": "query-database" }
+          ],
+          "remove": ["X-Internal-Debug"]
+        }
+      }
+    }
+  }
+}
+```
+
+Use this to inject authentication credentials your upstream expects, add tracing identifiers, or strip headers that should not reach the upstream.
+
+### transformRequestBody
+
+The `transformRequestBody` middleware transforms the JSON-RPC request body before it is forwarded to the upstream, using a Go template. This allows you to reshape the request, for example to translate between different argument schemas or to inject values from the gateway context.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "search": {
+        "transformRequestBody": {
+          "enabled": true,
+          "format": "json",
+          "body": "<base64-encoded Go template>"
+        }
+      }
+    }
+  }
+}
+```
+
+The template receives the full JSON-RPC request as input and must produce a valid JSON-RPC 2.0 request as output to maintain protocol compliance with the upstream.
+
+### urlRewrite
+
+<Warning>
+The `urlRewrite` field is not supported for MCP primitives. Setting it has no effect. The field is accepted by the configuration schema for forward compatibility but is silently ignored at runtime. URL rewriting is incompatible with MCP's single-endpoint transport; all traffic flows through `/mcp` regardless of which primitive is invoked.
+</Warning>
+
+### transformRequestMethod
+
+<Warning>
+The `transformRequestMethod` field is not supported for MCP primitives. Setting it has no effect. The field is accepted by the configuration schema for forward compatibility but is silently ignored at runtime. MCP always uses `POST` for JSON-RPC messages and `GET` for SSE streams; the HTTP method cannot be changed at the primitive level.
+</Warning>
+
+---
+
+## Response transformation
+
+### transformResponseHeaders
+
+The `transformResponseHeaders` middleware adds, removes, or modifies HTTP headers on the response returned to the client.
+
+```json
+{
+  "middleware": {
+    "mcpResources": {
+      "public://data/*": {
+        "transformResponseHeaders": {
+          "enabled": true,
+          "add": [
+            { "name": "Cache-Control", "value": "public, max-age=300" }
+          ]
+        }
+      }
+    }
+  }
+}
+```
+
+<Note>
+Response body transformation (`transformResponseBody`) is not available for MCP primitives. MCP responses are JSON-RPC 2.0 messages and must be returned to the client unmodified to maintain protocol compliance. Response body transformation remains available for entries in `middleware.operations` if you need to transform at the method level, but the same protocol compliance constraint applies, so use with care.
+</Note>
+
+---
+
+## Testing and development
+
+### mockResponse
+
+<Warning>
+The `mockResponse` field is not supported for MCP primitives. Setting it has no effect. Mock responses require Tyk to construct a complete HTTP response body before it reaches the client, which is incompatible with the streaming JSON-RPC transport MCP uses. See the capability matrix at the end of this page.
+</Warning>
+
+The `mockResponse` field is accepted in the configuration schema but does not intercept or replace responses for MCP primitives.
+
+### virtualEndpoint
+
+The `virtualEndpoint` middleware executes a JavaScript function in place of the upstream proxy. Use it to implement simple primitives directly in the gateway, for example a tool that aggregates data from a Tyk context variable, performs a simple calculation, or returns a dynamically constructed response without needing a dedicated upstream service.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "echo": {
+        "virtualEndpoint": {
+          "enabled": true,
+          "functionName": "echoTool",
+          "body": "<base64-encoded JavaScript>",
+          "proxyOnError": false
+        }
+      }
+    }
+  }
+}
+```
+
+The JavaScript function receives the request object and must return a response object in JSON-RPC 2.0 format. Set `proxyOnError` to `true` to fall back to the upstream if the virtual endpoint function throws an error.
+
+---
+
+## Observability
+
+### trackEndpoint and doNotTrackEndpoint
+
+By default, Tyk records analytics for all requests. These two middleware options let you override tracking behavior at the primitive level.
+
+`trackEndpoint` enables detailed analytics for a primitive that might otherwise be excluded:
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "execute-query": {
+        "trackEndpoint": { "enabled": true }
+      }
+    }
+  }
+}
+```
+
+`doNotTrackEndpoint` excludes a primitive from analytics logs and dashboards. Use this for high-volume or sensitive primitives where capturing every request creates noise or a compliance concern:
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "health-check": {
+        "doNotTrackEndpoint": { "enabled": true }
+      }
+    }
+  }
+}
+```
+
+---
+
+## Plugins
+
+### postPlugins
+
+The `postPlugins` field executes one or more custom plugin functions after the main middleware chain completes, immediately before the request is proxied to the upstream. Use custom plugins when the built-in middleware capabilities are insufficient, for example to validate request arguments against an external schema, to enrich the request with data from a third-party service, or to implement custom access control logic.
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "execute-query": {
+        "postPlugins": [
+          {
+            "enabled": true,
+            "functionName": "validateQuerySchema",
+            "path": "/opt/tyk/plugins/query-validator.so"
+          }
+        ]
+      }
+    }
+  }
+}
+```
+
+Plugins are loaded from the path specified or from a bundle configured in the global `pluginConfig` section. See [Custom plugins](/api-management/plugins/overview) for the full plugin development guide.
+
+---
+
+## Resource URI matching
+
+Resources in the `mcpResources` map are matched against the `params.uri` value in incoming `resources/read` requests. Tyk resolves the match in this order:
+
+1. **Exact match**: If the request URI matches a key exactly, that entry's middleware is applied.
+2. **Wildcard match**: If no exact match is found, Tyk checks for entries containing `*`. When multiple patterns match, the longest prefix wins.
+3. **No match**: If neither an exact nor wildcard match is found, the request is handled by the default middleware chain (all primitives are accessible unless the category is in allowlist mode).
+
+For example, given these entries:
+
+```json
+{
+  "mcpResources": {
+    "file:///config/database.json": {
+      "cache": { "enabled": true, "timeout": 3600 }
+    },
+    "file:///config/*": {
+      "cache": { "enabled": true, "timeout": 300 }
+    },
+    "file:///*": {
+      "allow": { "enabled": true }
+    }
+  }
+}
+```
+
+A request for `file:///config/database.json` matches the exact entry and gets a 1-hour cache. A request for `file:///config/settings.json` matches the `file:///config/*` pattern and gets a 5-minute cache. A request for `file:///logs/app.log` matches the `file:///*` fallback and is allowed but not cached.
+
+---
+
+## Middleware capability reference
+
+The following table summarises every middleware capability available for MCP proxies and where it can be configured.
+
+| Middleware | Field | Dashboard: Settings tab | Dashboard: Primitives tab | Definition |
+|---|---|---|---|---|
+| Allowlist | `allow` | — | Yes | Yes |
+| Blocklist | `block` | — | Yes | Yes |
+| Ignore authentication | `ignoreAuthentication` | — | Yes | Yes |
+| Scope check | `scopeCheck` | — | Yes | Yes |
+| Token exchange (per-primitive) | `exchange` | — | Yes | Yes |
+| Rate limiting | `rateLimit` | — | Yes | Yes |
+| Request size limit | `requestSizeLimit` | — | Yes | Yes |
+| Circuit breaker | `circuitBreaker` | — | Yes | Yes |
+| Cache | `cache` | — | — | No, disabled for protocol compliance |
+| Transform request headers (global) | `middleware.global.transformRequestHeaders` | Yes | — | Yes |
+| Transform request headers (primitive) | `transformRequestHeaders` | — | Yes | Yes |
+| Transform request body | `transformRequestBody` | — | — | Yes |
+| URL rewrite | `urlRewrite` | — | — | No, silently ignored for protocol compliance |
+| Transform request method | `transformRequestMethod` | — | — | No, silently ignored for protocol compliance |
+| Transform response headers (global) | `middleware.global.transformResponseHeaders` | Yes | — | Yes |
+| Transform response headers (primitive) | `transformResponseHeaders` | — | Yes | Yes |
+| Transform response body | `transformResponseBody` | — | — | No, disabled for protocol compliance |
+| Mock response | `mockResponse` | — | — | No, disabled for protocol compliance |
+| Virtual endpoint | `virtualEndpoint` | — | Yes | Yes |
+| Track endpoint | `trackEndpoint` | — | Yes | Yes |
+| Do not track | `doNotTrackEndpoint` | — | Yes | Yes |
+| Post plugins | `postPlugins` | — | Yes | Yes |
+| CORS | `middleware.global.cors` | Yes | — | Yes |
+| Context variables | `middleware.global.contextVariables` | Yes | — | Yes |
+| Traffic logs | `middleware.global.trafficLogs` | Yes | — | Yes |
+| Plugin config / bundle | `middleware.global.pluginConfig` | Yes | — | Yes |
+
diff --git a/ai-management/mcp-gateway/mcp-observability.mdx b/ai-management/mcp-gateway/mcp-observability.mdx
new file mode 100644
index 0000000000..82057d0810
--- /dev/null
+++ b/ai-management/mcp-gateway/mcp-observability.mdx
@@ -0,0 +1,42 @@
+---
+title: "MCP Gateway Observability Overview"
+sidebarTitle: "Overview"
+description: "An overview of the observability signals Tyk Gateway emits for MCP traffic: metrics dimensions, structured access log fields, and the Dashboard analytics page."
+keywords: "mcp, observability, opentelemetry, metrics, access logs, analytics, monitoring"
+---
+
+Tyk Gateway emits two categories of observability signal for MCP traffic: custom metrics dimensions and structured access log fields. Both signals are enriched with the same set of MCP-specific fields, letting you monitor tool call volumes, track latency per primitive, classify errors, and correlate usage across sessions, through the same observability infrastructure you use for your REST APIs.
+
+## Prerequisites
+
+OpenTelemetry must be enabled on your Tyk Gateway. See [OpenTelemetry configuration](/api-management/traces) for setup instructions.
+
+## MCP fields
+
+The following fields are derived from the JSON-RPC payload on each MCP request. They appear across both signal types.
+
+| Field | Description | Example values |
+|---|---|---|
+| `mcp_method` | JSON-RPC method invoked | `tools/call`, `initialize`, `resources/read`, `prompts/get` |
+| `mcp_primitive_type` | MCP primitive category | `tool`, `resource`, `prompt` |
+| `mcp_primitive_name` | Name of the specific tool, resource, or prompt | `get_current_weather`, `search_documents` |
+| `mcp_error_code` | Gateway-mapped JSON-RPC error code on failure; absent or empty on success | `-32001`, `-32002`, `-32003` |
+
+All four fields are populated only for MCP requests. For non-MCP requests the fields are empty or absent, so existing metric instruments and log templates are unaffected.
+
+## Observability Signals
+
+| Signal | What it covers | Doc |
+|---|---|---|
+| **Metrics** | Custom OTel metric instruments with MCP dimensions for counters and histograms | [MCP metrics](/ai-management/mcp-gateway/mcp-metrics) |
+| **Access logs** | Structured per-request log records with MCP fields included when non-empty | [MCP access logs](/ai-management/mcp-gateway/mcp-access-logs) |
+
+<Note>
+Distributed tracing is not currently implemented for MCP traffic. The `TRACING_ENABLED` configuration flag exists in the gateway but does not generate spans for MCP requests. Use the metrics and access log signals above to correlate and diagnose MCP traffic.
+</Note>
+
+## Dashboard Analytics
+
+Alongside these OpenTelemetry signals, Tyk Dashboard has a dedicated **Activity by MCP** analytics page, covering proxy-level and primitive-level traffic and error charts. See [MCP Analytics](/ai-management/mcp-gateway/mcp-analytics).
+
+
diff --git a/ai-management/mcp-gateway/mcp-proxy-definitions.mdx b/ai-management/mcp-gateway/mcp-proxy-definitions.mdx
new file mode 100644
index 0000000000..dc7c63141b
--- /dev/null
+++ b/ai-management/mcp-gateway/mcp-proxy-definitions.mdx
@@ -0,0 +1,507 @@
+---
+title: "MCP OAS definition"
+description: "How Tyk represents MCP servers as OpenAPI definitions: the OpenAPI specification structure, MCP primitives and JSON-RPC methods, and the x-tyk-api-gateway extensions that configure gateway behavior for MCP traffic."
+keywords: "MCP, Model Context Protocol, MCP API definition, x-tyk-api-gateway, JSON-RPC, primitives, tools, resources, prompts, operations, Tyk OAS, Streamable HTTP"
+sidebarTitle: "MCP Proxy Definition"
+---
+
+An MCP proxy definition is the configuration object that tells Tyk how to proxy an MCP server. It is built on the **[Tyk OAS API definition](/api-management/gateway-config-tyk-oas)** format (an OpenAPI 3.0 document extended with the `x-tyk-api-gateway` vendor extension) and adds the MCP-specific structures that allow Tyk to inspect JSON-RPC traffic and apply middleware at the method and primitive level. This page explains the structure of an MCP API definition, how MCP concepts (primitives, methods, operations) map to it, and which parts of the extension are specific to MCP.
+
+> If you are not familiar with Tyk OAS API definitions, read [Tyk OAS](/api-management/gateway-config-tyk-oas) first. This page focuses on the MCP-specific aspects and assumes knowledge of the base format.
+
+---
+
+## Structure overview
+
+An MCP API definition has two parts that work together:
+
+- **The OpenAPI specification**: Describes the MCP server's transport endpoints and, optionally, each JSON-RPC method as a documented operation. Tyk uses this to understand the API's shape and to present it in the Developer Portal.
+- **The `x-tyk-api-gateway` extension**: Contains all gateway configuration: the listen path, upstream URL, authentication, and the middleware maps that govern individual tools, resources, and prompts.
+
+The two parts share the same file or API object:
+
+```json
+{
+  "openapi": "3.0.3",
+  "info": {
+    "title": "Weather MCP proxy",
+    "version": "2025-11-25"
+  },
+  "paths": { ... },
+  "x-tyk-api-gateway": {
+    "info": { ... },
+    "server": { ... },
+    "upstream": { ... },
+    "middleware": { ... }
+  }
+}
+```
+
+The sections below explain each part and the MCP-specific patterns within them.
+
+---
+
+## MCP concepts in the definition
+
+Three core MCP concepts shape how you write an MCP API definition: primitives, JSON-RPC methods, and transport endpoints. Understanding them before reading the definition structure makes the configuration decisions much clearer.
+
+### Primitives
+
+Primitives are the capabilities an MCP server exposes. The MCP specification defines three categories:
+
+- **Tools**: Actions an AI agent can invoke. Each tool has a name, an input schema, and returns a result. For example, a `get-weather` tool that accepts a location and returns a forecast.
+- **Resources**: Data an AI agent can read. Each resource is identified by a URI (for example, `weather://stations/london`). Resources support URI wildcard patterns for template-based access (for example, `weather://stations/*`).
+- **Prompts**: Pre-written instruction templates that shape LLM behavior. Each prompt has a name and accepts arguments that customise the generated content.
+
+Primitives are the level at which Tyk applies fine-grained middleware. You can rate limit a specific tool, cache a specific resource, or block a specific prompt, independently of every other primitive on the same server. In the `x-tyk-api-gateway` extension, each primitive category has its own middleware map: `mcpTools`, `mcpResources`, and `mcpPrompts`.
+
+### JSON-RPC methods
+
+MCP clients communicate with servers by sending JSON-RPC 2.0 requests. Every request carries a `method` field that identifies the operation:
+
+```json
+{
+  "jsonrpc": "2.0",
+  "id": 1,
+  "method": "tools/call",
+  "params": {
+    "name": "get-weather",
+    "arguments": { "location": "London" }
+  }
+}
+```
+
+Methods are organised into namespaces that correspond to MCP capabilities:
+
+| Namespace | Methods | Purpose |
+|---|---|---|
+| Lifecycle | `initialize`, `ping` | Session establishment and health checks |
+| Tools | `tools/list`, `tools/call` | Tool discovery and invocation |
+| Resources | `resources/list`, `resources/read`, `resources/templates/list`, `resources/subscribe`, `resources/unsubscribe` | Resource discovery, reading, and subscriptions |
+| Prompts | `prompts/list`, `prompts/get` | Prompt discovery and retrieval |
+| Completions | `completion/complete` | Argument autocompletion |
+| Logging | `logging/setLevel` | Server log level control |
+
+In the `x-tyk-api-gateway` extension, you can configure middleware at the method level (applying a rule to every `tools/call` request regardless of which tool is named) using the `middleware.operations` map.
+
+### Transport endpoints
+
+All MCP traffic flows through a single path (`/mcp`) that supports two HTTP methods:
+
+- **`POST /mcp`**: Clients send JSON-RPC messages. The server responds with either a single JSON object or a Server-Sent Events stream.
+- **`GET /mcp`**: Clients open a persistent SSE connection for server-initiated messages.
+
+These two transport endpoints are the only real HTTP endpoints your MCP server needs to expose. In the OpenAPI specification portion of the definition, they are documented as `POST /mcp` and `GET /mcp`. Tyk proxies both.
+
+---
+
+## The OpenAPI specification portion
+
+The OpenAPI specification in an MCP API definition documents the server's HTTP interface. For MCP, this has a standard structure that you can treat as a template.
+
+### Transport paths
+
+At minimum, the `paths` object documents the two transport endpoints:
+
+```json
+{
+  "paths": {
+    "/mcp": {
+      "post": {
+        "summary": "Send a JSON-RPC message",
+        "operationId": "mcpTransportPost",
+        "parameters": [
+          {
+            "name": "MCP-Protocol-Version",
+            "in": "header",
+            "required": true,
+            "schema": { "type": "string", "example": "2025-11-25" }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": { "$ref": "#/components/schemas/JSONRPCRequest" }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "JSON-RPC response or SSE stream",
+            "content": {
+              "application/json": { "schema": { "$ref": "#/components/schemas/JSONRPCResponse" } },
+              "text/event-stream": { "schema": { "type": "string" } }
+            }
+          },
+          "202": { "description": "Accepted (notification, no response body)" }
+        }
+      },
+      "get": {
+        "summary": "Open an SSE stream",
+        "operationId": "mcpSSEGet",
+        "responses": {
+          "200": {
+            "description": "Server-sent events stream",
+            "content": {
+              "text/event-stream": { "schema": { "type": "string" } }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+The `operationId` values (`mcpTransportPost`, `mcpSSEGet`) are referenced internally by Tyk for the transport endpoints. These values are fixed; do not change them.
+
+### Method paths
+
+In addition to the transport paths, you can document each JSON-RPC method as a separate path. This is optional for gateway operation but makes the API browsable in the Tyk Developer Portal:
+
+```json
+{
+  "paths": {
+    "/mcp/tools/call": {
+      "post": {
+        "summary": "Invoke a tool",
+        "operationId": "tools/callPOST",
+        "x-mcp-method": "tools/call",
+        ...
+      }
+    },
+    "/mcp/resources/read": {
+      "post": {
+        "summary": "Read a resource",
+        "operationId": "resources/readPOST",
+        "x-mcp-method": "resources/read",
+        ...
+      }
+    }
+  }
+}
+```
+
+These paths are a documentation and governance interface. They present each JSON-RPC method as a distinct, typed operation, making MCP proxies discoverable alongside REST and GraphQL APIs in your Developer Portal. The path structure (`/mcp/{namespace}/{action}`) and the `operationId` convention (`{method}POST`) are what tie the OpenAPI spec to the `middleware.operations` map in the `x-tyk-api-gateway` extension.
+
+<Note>
+The method paths do not correspond to real HTTP endpoints. All traffic still flows through `POST /mcp`. The method paths exist solely for documentation, schema validation, and middleware configuration purposes.
+</Note>
+
+---
+
+## The x-tyk-api-gateway extension
+
+The `x-tyk-api-gateway` extension contains all gateway configuration. For MCP proxies, it has the same four top-level sections as any Tyk OAS API definition, with MCP-specific content in the `middleware` section.
+
+### info, server, and upstream
+
+The `info`, `server`, and `upstream` sections work identically to a standard Tyk OAS API definition. They configure the API's identity, its client-facing interface, and its upstream connectivity:
+
+```json
+{
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "Weather MCP proxy",
+      "state": { "active": true }
+    },
+    "server": {
+      "listenPath": { "value": "/weather/", "strip": true },
+      "authentication": {
+        "enabled": true,
+        "securitySchemes": {
+          "bearerAuth": { "enabled": true }
+        }
+      }
+    },
+    "upstream": {
+      "url": "https://weather-mcp.example.com"
+    }
+  }
+}
+```
+
+There are no MCP-specific fields in these three sections. You configure authentication, TLS, load balancing, upstream rate limits, and all other standard gateway capabilities exactly as you would for a REST API. See [Tyk OAS](/api-management/gateway-config-tyk-oas) for the full field reference for these sections.
+
+The example above uses `bearerAuth` as the security scheme — a simple bearer token check. For full OAuth 2.1 compliance (token validation, scope enforcement, Protected Resource Metadata, and token exchange), use the `oauth2` scheme instead. See [MCP OAuth 2.1](/ai-management/mcp-gateway/oauth-2-1).
+
+### The middleware section
+
+The `middleware` section is where MCP OAS definitions diverge from standard Tyk OAS API definitions. It contains the same `global` block for API-wide middleware, but adds two new concepts: an `operations` map keyed by JSON-RPC method, and three primitive maps: `mcpTools`, `mcpResources`, and `mcpPrompts`.
+
+```json
+{
+  "middleware": {
+    "global": { ... },
+    "operations": { ... },
+    "mcpTools": { ... },
+    "mcpResources": { ... },
+    "mcpPrompts": { ... }
+  }
+}
+```
+
+Each is explained below.
+
+#### global
+
+Global middleware applies to every request on the API. It is configured identically to a standard Tyk OAS API (CORS, traffic logs, header transformations, custom plugins, and so on). There is nothing MCP-specific here.
+
+#### operations: method-level middleware
+
+The `operations` map lets you configure middleware that applies to every invocation of a JSON-RPC method, regardless of which specific primitive is targeted. It is keyed by the operation ID of the method path in the OpenAPI spec, which follows the convention `{json-rpc-method}{HTTP-method}`:
+
+| JSON-RPC method | Operation ID key |
+|---|---|
+| `tools/call` | `tools/callPOST` |
+| `tools/list` | `tools/listPOST` |
+| `resources/read` | `resources/readPOST` |
+| `resources/list` | `resources/listPOST` |
+| `prompts/get` | `prompts/getPOST` |
+| `prompts/list` | `prompts/listPOST` |
+| `initialize` | `initializePOST` |
+
+For example, to rate limit all tool calls at the method level:
+
+```json
+{
+  "middleware": {
+    "operations": {
+      "tools/callPOST": {
+        "rateLimit": {
+          "enabled": true,
+          "rate": 500,
+          "per": 60
+        }
+      }
+    }
+  }
+}
+```
+
+This rate limit applies to every `tools/call` request, whatever tool name appears in `params.name`. Method-level middleware evaluates before primitive-level middleware.
+
+#### mcpTools: per-tool middleware
+
+The `mcpTools` map configures middleware for individual tools. Each key is the tool name as it appears in the `params.name` field of a `tools/call` request:
+
+```json
+{
+  "middleware": {
+    "mcpTools": {
+      "get-weather": {
+        "allow": { "enabled": true },
+        "rateLimit": { "enabled": true, "rate": 100, "per": 60 }
+      },
+      "execute-query": {
+        "allow": { "enabled": true },
+        "requestSizeLimit": { "enabled": true, "value": 8192 }
+      }
+    }
+  }
+}
+```
+
+When any tool in `mcpTools` has `allow` enabled, the entire tools category enters allowlist mode: only the explicitly listed tools are accessible, and all other tool names are rejected. Tools, resources, and prompts are evaluated independently; allowlisting tools does not affect access to resources or prompts.
+
+#### mcpResources: per-resource middleware
+
+The `mcpResources` map configures middleware for individual resources or URI patterns. Each key is matched against the `params.uri` field of a `resources/read` request. Keys can be exact URIs or wildcard patterns using `*`:
+
+```json
+{
+  "middleware": {
+    "mcpResources": {
+      "weather://stations/london": {
+        "allow": { "enabled": true },
+        "cache": { "enabled": true, "timeout": 300 }
+      },
+      "weather://stations/*": {
+        "allow": { "enabled": true },
+        "cache": { "enabled": true, "timeout": 60 }
+      }
+    }
+  }
+}
+```
+
+Tyk resolves matches in priority order: exact matches take precedence over wildcard matches. When multiple wildcard patterns match, the longest matching prefix wins.
+
+#### mcpPrompts: per-prompt middleware
+
+The `mcpPrompts` map configures middleware for individual prompts. Each key is the prompt name as it appears in the `params.name` field of a `prompts/get` request:
+
+```json
+{
+  "middleware": {
+    "mcpPrompts": {
+      "weather-summary": {
+        "allow": { "enabled": true }
+      },
+      "weather-alert": {
+        "allow": { "enabled": true },
+        "transformRequestHeaders": {
+          "enabled": true,
+          "add": [{ "name": "X-Prompt-Tier", "value": "premium" }]
+        }
+      }
+    }
+  }
+}
+```
+
+---
+
+## Middleware precedence
+
+When a request arrives, Tyk evaluates middleware in this order:
+
+1. **Global middleware**: Applies to all requests on the API.
+2. **Operation middleware** (`operations`): Applies to all requests for the matched JSON-RPC method.
+3. **Primitive middleware** (`mcpTools`, `mcpResources`, or `mcpPrompts`): Applies to the specific named tool, resource, or prompt. Scope check (`scopeCheck`) and token exchange (`exchange`) run at this level — scope check validates the inbound token's scopes against the primitive's `security:` requirements, and token exchange replaces the `Authorization` header before the request reaches the upstream.
+4. **Upstream proxy**: The modified request is forwarded to the upstream MCP server.
+
+All three middleware levels can be active simultaneously. A `tools/call` request to `execute-query` must pass global middleware, then the `tools/callPOST` operation middleware, then the `execute-query` primitive middleware, in that order. If any level rejects the request, processing stops and Tyk returns a JSON-RPC error to the client.
+
+All three middleware levels apply to all consumers of the proxy. For per-consumer control (different rate limits or tool access for different API keys), use security policies. Policies introduce a five-level rate limit hierarchy (including per-consumer primitive rate limits) and primitive allow/block lists that are evaluated independently for each consumer key. See [MCP proxy policies](/ai-management/mcp-gateway/policies) for details.
+
+---
+
+## A complete example
+
+The following definition configures a weather MCP proxy with bearer token authentication, method-level and tool-level rate limiting, resource caching, and a prompt allowlist.
+
+```json
+{
+  "openapi": "3.0.3",
+  "info": {
+    "title": "Weather MCP proxy",
+    "version": "2025-11-25"
+  },
+  "paths": {
+    "/mcp": {
+      "post": {
+        "operationId": "mcpTransportPost",
+        "summary": "Send a JSON-RPC message",
+        "parameters": [
+          {
+            "name": "MCP-Protocol-Version",
+            "in": "header",
+            "required": true,
+            "schema": { "type": "string" }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": { "application/json": { "schema": { "type": "object" } } }
+        },
+        "responses": {
+          "200": { "description": "JSON-RPC response or SSE stream" }
+        }
+      },
+      "get": {
+        "operationId": "mcpSSEGet",
+        "summary": "Open an SSE stream",
+        "responses": {
+          "200": { "description": "Server-sent events stream" }
+        }
+      }
+    }
+  },
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "Weather MCP proxy",
+      "state": { "active": true }
+    },
+    "server": {
+      "listenPath": { "value": "/weather/", "strip": true },
+      "authentication": {
+        "enabled": true,
+        "securitySchemes": {
+          "bearerAuth": { "enabled": true }
+        }
+      }
+    },
+    "upstream": {
+      "url": "https://weather-mcp.example.com"
+    },
+    "middleware": {
+      "global": {
+        "trafficLogs": { "enabled": true }
+      },
+      "operations": {
+        "tools/callPOST": {
+          "rateLimit": { "enabled": true, "rate": 500, "per": 60 }
+        }
+      },
+      "mcpTools": {
+        "get-weather": {
+          "allow": { "enabled": true },
+          "rateLimit": { "enabled": true, "rate": 100, "per": 60 }
+        },
+        "get-forecast": {
+          "allow": { "enabled": true },
+          "rateLimit": { "enabled": true, "rate": 50, "per": 60 }
+        }
+      },
+      "mcpResources": {
+        "weather://stations/*": {
+          "allow": { "enabled": true }
+        }
+      },
+      "mcpPrompts": {
+        "weather-summary": {
+          "allow": { "enabled": true }
+        }
+      }
+    }
+  }
+}
+```
+
+What this definition does:
+
+- The API listens on `/weather/` and proxies to `https://weather-mcp.example.com`. Clients connect to `{gateway_host}/weather/mcp`.
+- Bearer token authentication is required on all requests.
+- All `tools/call` requests are rate limited to 500 per minute at the method level.
+- Only two tools are accessible (`get-weather` and `get-forecast`). Any other tool name is rejected. Each tool has its own tighter rate limit.
+- Resources matching `weather://stations/*` are accessible.
+- Only the `weather-summary` prompt is accessible.
+- Traffic logs are enabled for all requests.
+
+This example uses `bearerAuth` for simplicity. For full OAuth 2.1 compliance — including token validation against an external IdP, per-primitive scope enforcement, Protected Resource Metadata, and RFC 8693 token exchange — replace `bearerAuth` with the `oauth2` scheme. See [MCP OAuth 2.1](/ai-management/mcp-gateway/oauth-2-1) for a complete worked example.
+
+---
+
+## Supported MCP spec features
+
+The following table documents which MCP protocol capabilities Tyk currently implements and how each maps to the proxy definition.
+
+| Capability | MCP spec version introduced | Tyk support | Notes |
+|---|---|---|---|
+| **Tools** (`tools/list`, `tools/call`) | Pre-2025-03-26 | ✅ Full | Per-tool middleware via `mcpTools`. Tool-level access control, rate limiting, timeouts, circuit breakers. |
+| **Resources** (`resources/list`, `resources/read`) | Pre-2025-03-26 | ✅ Full | Per-resource middleware via `mcpResources`. URI wildcard patterns supported. |
+| **Prompts** (`prompts/list`, `prompts/get`) | Pre-2025-03-26 | ✅ Full | Per-prompt middleware via `mcpPrompts`. |
+| **Streamable HTTP transport** (`POST /mcp`) | 2025-03-26 | ✅ Full | Primary transport. JSON-RPC messages with single-response or SSE-streaming responses. |
+| **SSE transport** (`GET /mcp`) | Pre-2025-03-26 | ✅ Full | Server-initiated messages. Tyk maintains the long-lived SSE connection. |
+| **Sampling** (`sampling/createMessage`) | Pre-2025-03-26 | ✅ Pass-through | Tyk proxies sampling messages. Method-level middleware via `operations` applies; primitive-level middleware does not (sampling is client-side). |
+| **Roots** (`roots/list`) | Pre-2025-03-26 | ✅ Pass-through | Tyk proxies roots messages unchanged. |
+| **Elicitation** (`elicitation/create`) | 2025-03-26 | ✅ Pass-through | Tyk proxies elicitation messages unchanged. |
+| **Protected Resource Metadata (PRM)** | 2025-03-26 | ✅ Full | Tyk serves `/.well-known/oauth-protected-resource` automatically. Configured under `authentication.securitySchemes[name].oauth2.protectedResourceMetadata` from Tyk 5.14.0. See [OAuth 2.1 authentication](/ai-management/mcp-gateway/oauth-2-1). |
+| **stdio transport** | Pre-2025-03-26 | ❌ Not supported | Tyk is a network-based gateway. Use a stdio-to-HTTP bridge for local MCP servers. |
+
+**MCP specification version:** Tyk implements the `2025-11-25` revision of the MCP specification.
+
+---
+
+## Summary
+
+| Concept | Where it lives in the definition |
+|---|---|
+| MCP primitives (tools, resources, prompts) | `middleware.mcpTools`, `middleware.mcpResources`, `middleware.mcpPrompts` |
+| JSON-RPC method middleware | `middleware.operations`: keyed by `{method}POST` |
+| API-wide middleware | `middleware.global` |
+| Transport endpoints (`POST /mcp`, `GET /mcp`) | `paths./mcp.post`, `paths./mcp.get` in the OpenAPI spec |
+| Listen path, authentication, upstream URL | `x-tyk-api-gateway.server`, `x-tyk-api-gateway.upstream` |
+
diff --git a/ai-management/mcp-gateway/oauth-2-1.mdx b/ai-management/mcp-gateway/oauth-2-1.mdx
new file mode 100644
index 0000000000..252e4ab97d
--- /dev/null
+++ b/ai-management/mcp-gateway/oauth-2-1.mdx
@@ -0,0 +1,520 @@
+---
+title: "MCP Gateway: OAuth 2.1 Authentication"
+description: "How Tyk Gateway implements the OAuth 2.1 authorization model defined by the MCP specification: Protected Resource Metadata discovery, inbound Bearer token authentication via the oauth2 security scheme, RFC 8693 token exchange, and upstream OAuth for accessing OAuth-protected MCP servers."
+keywords: "MCP, Model Context Protocol, OAuth 2.1, Protected Resource Metadata, PRM, RFC 9728, bearer token, client credentials, upstream authentication, well-known, authorization server, MCP authentication"
+sidebarTitle: "OAuth 2.1 Authentication"
+---
+
+This page explains how Tyk Gateway implements the OAuth 2.1 authorization model defined by the MCP specification. It covers inbound Bearer token authentication via the `oauth2` security scheme, Protected Resource Metadata (PRM) discovery, RFC 8693 token exchange, and upstream OAuth. After reading this page you'll be able to configure end-to-end OAuth 2.1 for any MCP proxy.
+
+---
+
+## MCP Auth Model
+
+MCP authorization operates on two distinct planes.
+
+**Inbound authorization** governs how MCP clients (AI agents, LLM frameworks, and applications) authenticate to Tyk Gateway. Tyk validates the credential on every request before it reaches your upstream MCP server. All [authentication methods](/api-management/client-authentication) supported by Tyk apply here: Bearer tokens, API keys, JWT, and mutual TLS.
+
+<Note>
+For OAuth 2.1 compliance, configure the `oauth2` security scheme. It publishes the Protected Resource Metadata discovery document, enforces per-operation scopes, and enables RFC 8693 token exchange — all from a single scheme declaration. See [OAuth 2.0 (External IdP)](/api-management/authentication/oauth2-authentication).
+</Note>
+
+**Upstream authorization** governs how Tyk authenticates to your upstream MCP server when that server requires an OAuth token. Tyk obtains the token from the authorization server using the client credentials flow and injects it into every proxied request. Your upstream receives a properly authorized request without any involvement from the original caller.
+
+The two planes are configured independently — Bearer tokens on the inbound side can be combined with client credentials on the upstream side.
+
+---
+
+## Protected Resource Metadata
+
+**Protected Resource Metadata (PRM)** is the standardized discovery mechanism defined in [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728). It gives OAuth clients a machine-readable document describing a protected resource: which authorization servers can issue tokens for it, and which OAuth scopes it supports.
+
+The MCP specification recommends that every MCP server expose a PRM document so that clients can discover the correct authorization server before making their first request. Without it, clients must be pre-configured with authorization server URLs — an approach that becomes fragile as deployments grow and authorization infrastructure changes.
+
+Tyk serves the PRM document natively. When PRM is enabled on an [MCP OAS definition](/ai-management/mcp-gateway/mcp-proxy-definitions), Tyk intercepts GET requests to the well-known path and serves the metadata document. The endpoint is unauthenticated by design — clients need it before they have a token.
+
+### The discovery flow
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant C as MCP Client
+    participant T as Tyk Gateway
+    participant A as Authorization Server
+    participant U as Upstream MCP Server
+
+    C->>T: POST /mcp (no token)
+    T-->>C: 401 Unauthorized
+    Note over T,C: WWW-Authenticate: Bearer resource_metadata=https://gateway.example.com/weather-mcp/.well-known/oauth-protected-resource
+
+    C->>T: GET /.well-known/oauth-protected-resource
+    T-->>C: 200 OK — PRM document
+    Note over T,C: resource · authorization_servers: [auth.example.com] · scopes_supported
+
+    C->>A: POST /oauth/token (client credentials grant)
+    A-->>C: 200 OK · access_token · token_type: Bearer
+
+    C->>T: POST /mcp · Authorization: Bearer access_token
+    Note over T: Validate Bearer token · apply middleware
+    T->>U: POST /mcp · Authorization: Bearer upstream-token
+    U-->>T: Response
+    T-->>C: Response
+    Note over C,U: Request authorised and proxied
+```
+
+The `WWW-Authenticate` header Tyk sends on authentication failure is a standard Bearer challenge extended with the `resource_metadata` parameter defined in RFC 9728. Any OAuth 2.1-compliant client library handles this automatically.
+
+### Configuring PRM
+
+PRM is configured within the `oauth2` security scheme block in the Tyk Vendor Extension. The scheme name (`idpAuth` in the example below) must match the scheme declared with `type: oauth2` in the OAS `components.securitySchemes` section — see [OAuth 2.0 (External IdP)](/api-management/authentication/oauth2-authentication) for the full scheme setup.
+
+```json
+{
+  "x-tyk-api-gateway": {
+    "server": {
+      "authentication": {
+        "enabled": true,
+        "securitySchemes": {
+          "idpAuth": {
+            "enabled": true,
+            "protectedResourceMetadata": {
+              "enabled": true,
+              "resource": "https://gateway.example.com/weather-mcp/",
+              "authorizationServers": ["https://auth.example.com"],
+              "autoDeriveScopes": true
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+| Field | Required | Description |
+|---|---|---|
+| `enabled` | Yes | Activates the PRM endpoint. When `true`, Tyk serves the metadata document and includes the `WWW-Authenticate: Bearer resource_metadata=...` header on authentication failures. |
+| `resource` | Yes | The resource identifier for this API, typically the URL at which Tyk exposes the MCP proxy. Accepts `$tyk_context.*` variables for dynamic values. |
+| `authorizationServers` | Yes | One or more authorization server URLs that can issue tokens for this resource. Tyk validates that at least one entry is present for Tyk OAS API definitions. |
+| `wellKnownPath` | No | Overrides the default well-known path. Defaults to `.well-known/oauth-protected-resource`. Relative to the API's listen path. |
+| `autoDeriveScopes` | No | When `true` (default), the `scopes_supported` field in the PRM document is populated from the `flows.scopes` catalog in your OAS `components.securitySchemes` declaration and every `security:` array on the API. When `false`, only the `flows.scopes` catalog is used. |
+
+The PRM endpoint is served at `{listen-path}/{wellKnownPath}`. With the default path and a listen path of `/weather-mcp/`, the endpoint is available at `/weather-mcp/.well-known/oauth-protected-resource`.
+
+<Note>
+If you have an existing PRM configuration at `authentication.protectedResourceMetadata`, Tyk Dashboard migrates it automatically to `authentication.securitySchemes[name].protectedResourceMetadata` on startup. No manual action is required. APIs that already have a scheme-level PRM block are not modified.
+</Note>
+
+---
+
+## Scope enforcement
+
+Scope enforcement checks that the bearer token carries the scopes required by the matched operation or MCP primitive — translating what the authorization server granted into access decisions at the gateway.
+
+Configure it under `scopeCheck` in the `oauth2` scheme block:
+
+```json
+{
+  "x-tyk-api-gateway": {
+    "server": {
+      "authentication": {
+        "securitySchemes": {
+          "idpAuth": {
+            "enabled": true,
+            "scopeCheck": {
+              "enabled": true,
+              "claimNames": ["scope", "scp"],
+              "separator": " ",
+              "scopeSource": "union"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+The required scopes for each operation come from the `security:` array in your OAS definition. For MCP primitives, which have no OAS path entry, declare scopes in the Tyk Vendor Extension under `middleware.mcpTools`, `middleware.mcpResources`, or `middleware.mcpPrompts`:
+
+```json
+{
+  "x-tyk-api-gateway": {
+    "middleware": {
+      "mcpTools": {
+        "create-report": {
+          "security": [{ "idpAuth": ["tools:write"] }]
+        }
+      }
+    }
+  }
+}
+```
+
+| Field | Required | Description |
+|---|---|---|
+| `enabled` | Yes | Activates scope enforcement for this scheme. |
+| `claimNames` | No | JWT claim names to read scopes from. Defaults to `["scope", "scp"]`. All listed claims present on the token are merged into a single scope set. |
+| `separator` | No | Character used to split string-valued scope claims. Defaults to `" "` (space). Set to `","` for comma-separated IdPs. |
+| `scopeSource` | No | Which `security:` declarations drive enforcement: `"union"` (default) merges root and per-operation alternatives; `"operation"` applies only the matched operation's declaration; `"global"` applies only the root-level declaration. |
+
+When a request fails scope enforcement, Tyk returns `403 Forbidden` with `WWW-Authenticate: Bearer error="insufficient_scope"`. Scope enforcement runs after JWT signature validation — if the token is invalid, the request is rejected at the JWT auth step before scope check is reached.
+
+For per-operation and per-primitive exemptions (`scopeCheck.enabled: false` on individual operations or MCP primitives) and the full field reference, see [OAuth 2.0 (External IdP)](/api-management/authentication/oauth2-authentication#scope-enforcement).
+
+---
+
+## Upstream OAuth
+
+When the upstream MCP server requires OAuth, Tyk handles token acquisition transparently. It acts as an OAuth client — obtaining a token from the upstream's authorization server using the client credentials flow and attaching it to every proxied request. The original MCP client never needs to supply upstream credentials.
+
+Tyk caches acquired tokens and refreshes them before they expire, so the upstream sees a consistent stream of valid credentials without a token request on every MCP call.
+
+<Note>
+Upstream OAuth is available in Tyk Enterprise Edition only.
+</Note>
+
+### Client credentials flow
+
+Client credentials is the OAuth flow for machine-to-machine communication — no user is involved, Tyk acts as the client. OAuth 2.1 retains this flow specifically for server-to-server scenarios.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant C as MCP Client
+    participant T as Tyk Gateway
+    participant A as Authorization Server
+    participant U as Upstream MCP Server
+
+    C->>T: POST /mcp · Authorization: Bearer inbound-token
+    Note over T: Validate inbound token · check token cache
+
+    alt Token not cached or expired
+        T->>A: POST /oauth/token
+        Note over T,A: grant_type: client_credentials · client_id · client_secret · scopes
+        A-->>T: 200 OK · access_token · expires_in: 3600
+        Note over T: Cache upstream token
+    else Token cached
+        Note over T: Use cached upstream token
+    end
+
+    T->>U: POST /mcp · Authorization: Bearer upstream-token
+    U-->>T: Response
+    T-->>C: Response
+    Note over C,U: Request processed upstream
+```
+
+### Configuring upstream OAuth
+
+Upstream OAuth is configured in the `upstream.authentication` section of the API definition:
+
+```json
+{
+  "x-tyk-api-gateway": {
+    "upstream": {
+      "url": "https://weather-mcp.example.com",
+      "authentication": {
+        "enabled": true,
+        "oauth": {
+          "enabled": true,
+          "allowedAuthorizeTypes": ["clientCredentials"],
+          "clientCredentials": {
+            "clientId": "tyk-gateway-client",
+            "clientSecret": "your-client-secret",
+            "tokenUrl": "https://auth.example.com/oauth/token",
+            "scopes": ["mcp:read", "mcp:write"]
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+| Field | Required | Description |
+|---|---|---|
+| `clientId` | Yes | The OAuth client ID issued by the authorization server for this gateway instance. |
+| `clientSecret` | Yes | The client secret associated with the client ID. |
+| `tokenUrl` | Yes | The token endpoint of the upstream's authorization server. |
+| `scopes` | No | The scopes to request when obtaining the token. The authorization server grants only the scopes it recognises and the client is permitted. |
+| `extraMetadata` | No | Keys to extract from the token response and pass to the upstream as additional context. |
+
+---
+
+## Token exchange
+
+The [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#access-token-privilege-restriction) requires that an MCP server **MUST NOT** pass through the token it received from the MCP client when making requests to upstream APIs. The upstream token must be a separate token issued by the upstream authorization server.
+
+**Token exchange** ([RFC 8693](https://www.rfc-editor.org/rfc/rfc8693)) is how Tyk satisfies this requirement while preserving the caller's identity. Tyk presents the validated inbound token to an authorization server and receives a backend-scoped token in return. The inbound agent token never reaches the upstream.
+
+This matters for MCP because:
+
+- **Spec compliance** — The MCP spec explicitly forbids passing through the inbound token. Token exchange satisfies this requirement while maintaining a traceable delegation chain.
+- **Audience compliance** — MCP servers must validate that tokens were issued specifically for them as the intended audience ([RFC 8707](https://www.rfc-editor.org/rfc/rfc8707.html)). Token exchange produces a token audienced to the upstream service without requiring clients to request multiple tokens.
+- **Separation of trust** — The AI agent's credential stays scoped to the gateway trust domain; the upstream receives a narrowly-scoped credential appropriate to its own.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant C as MCP Client
+    participant T as Tyk Gateway
+    participant I as Authorization Server
+    participant U as Upstream MCP Server
+
+    C->>T: POST /mcp · Authorization: Bearer agent-token
+    Note over T: Validate inbound token · enforce scopes
+
+    T->>I: POST /token (RFC 8693 exchange)
+    Note over T,I: subject_token=agent-token · audience=upstream-service
+    I-->>T: 200 OK · access_token (upstream-scoped)
+
+    T->>U: POST /mcp · Authorization: Bearer upstream-token
+    U-->>T: Response
+    T-->>C: Response
+    Note over C,U: Inbound token never forwarded to upstream
+```
+
+Token exchange is Enterprise Edition only and is configured within the `oauth2` security scheme. For full configuration details — including provider setup, caching, and per-primitive overrides — see [Token exchange](/api-management/authentication/token-exchange).
+
+<Note>
+Do not configure `upstream.authentication.oauth` alongside token exchange. They serve the same purpose — authenticating Tyk to the upstream — and configuring both produces a conflict. Use token exchange when you want to propagate a delegated credential derived from the inbound token. Use `upstream.authentication.oauth` when Tyk should authenticate with its own static client credentials independent of who the original caller was.
+</Note>
+
+---
+
+## Composing features
+
+Each feature on this page is independent. The example below uses all of them, but you can enable any subset depending on your requirements.
+
+**JWT authentication** validates the inbound token's signature. In Tyk 5.14.0 this is required alongside the `oauth2` scheme because the `oauth2` scheme reads token claims but does not verify the signature itself. It is the baseline for everything else.
+
+**PRM** enables dynamic discovery — clients that arrive without a token learn where to obtain one. Enable it if your MCP clients are OAuth 2.1-compliant and should discover the authorization server automatically. Omit it if your clients are pre-configured with the authorization server URL.
+
+**Scope enforcement** (`scopeCheck`) checks that the token carries the scopes required by the matched operation or MCP primitive. Use it when the IdP owns access decisions — the authorization server grants specific scopes and Tyk enforces them at the gateway. If you prefer Tyk's policy engine to control primitive access (a platform-owned model where keys are issued with policy-level permissions), omit `scopeCheck` and rely on policies instead. The two approaches are mutually exclusive per primitive: using both creates conflicting ownership of access decisions.
+
+**Token exchange** replaces the inbound agent token with an upstream-scoped token before forwarding. The MCP specification requires that the upstream never receives the original token — token exchange is how you satisfy that requirement while preserving the delegation chain. If you are using [Upstream OAuth](#upstream-oauth) with static client credentials instead, token exchange can be omitted.
+
+**PRM and scope enforcement are particularly complementary.** PRM advertises which scopes clients need to request; `scopeCheck` enforces at runtime that the presented token actually carries them. When `autoDeriveScopes` is enabled, both are driven by the same `security:` declarations in your OAS definition — so the scopes a client is told to request and the scopes Tyk enforces are derived from the same source and can't drift out of sync. Enabling PRM without `scopeCheck` means scopes are advertised but not enforced at the gateway. Enabling `scopeCheck` without PRM means enforcement works, but clients need to know the required scopes upfront rather than discovering them dynamically.
+
+Common configurations:
+
+| Goal | Features to enable |
+|---|---|
+| Validate tokens; use Tyk policies for primitive access | JWT auth |
+| Add client-side discovery | JWT auth + PRM |
+| Add IdP-owned scope enforcement | JWT auth + PRM + scopeCheck |
+| Full MCP spec compliance with delegated upstream identity | JWT auth + PRM + scopeCheck + token exchange |
+
+---
+
+## The complete OAuth 2.1 flow
+
+The end-to-end flow has two phases. The authorization server appears in both — first when the MCP client obtains its agent token, then when Tyk exchanges it for an upstream-scoped token.
+
+**Phase 1 — Discovery**
+
+1. The MCP client makes a request to the MCP endpoint without a token.
+2. Tyk returns `401 Unauthorized` with a `WWW-Authenticate` header pointing to the PRM well-known URL.
+3. The client fetches the PRM document and learns which authorization server to use and which scopes are supported.
+4. The client authenticates to the authorization server (authorization code flow, device flow, etc.) and receives an agent-scoped access token.
+
+**Phase 2 — Authenticated request**
+
+5. The client sends the request with `Authorization: Bearer <agent-token>`.
+6. Tyk validates the token signature (JWT auth) and enforces scopes (`oauth2` scheme).
+7. Tyk POSTs an RFC 8693 token exchange to the authorization server, presenting the agent token as `subject_token` and requesting a token audienced to the upstream MCP server.
+8. The authorization server returns an upstream-scoped access token.
+9. Tyk replaces the `Authorization` header with the exchanged token and forwards the request to the upstream MCP server.
+10. The upstream responds; Tyk returns the response to the client.
+
+The agent's original token never reaches the upstream MCP server. The MCP client and the upstream each receive a token issued specifically for their trust boundary.
+
+---
+
+## A complete configuration example
+
+The following configuration for a weather MCP proxy enables all four features — PRM discovery, JWT signature validation, scope enforcement, and RFC 8693 token exchange:
+
+```json expandable
+{
+  "openapi": "3.0.3",
+  "info": { "title": "Weather MCP proxy", "version": "2025-11-25" },
+  "components": {
+    "securitySchemes": {
+      "jwtAuth": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "JWT"
+      },
+      "idpAuth": {
+        "type": "oauth2",
+        "flows": {
+          "authorizationCode": {
+            "authorizationUrl": "https://auth.example.com/authorize",
+            "tokenUrl": "https://auth.example.com/token",
+            "scopes": {
+              "tools:read": "Read access to MCP tools",
+              "tools:write": "Write access to MCP tools"
+            }
+          }
+        }
+      }
+    }
+  },
+  "security": [
+    { "jwtAuth": [], "idpAuth": ["tools:read"] }
+  ],
+  "paths": {
+    "/mcp": {
+      "post": { "operationId": "mcpTransportPost", "responses": { "200": { "description": "JSON-RPC response" } } },
+      "get":  { "operationId": "mcpSSEGet",         "responses": { "200": { "description": "SSE stream" } } }
+    }
+  },
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "Weather MCP proxy",
+      "state": { "active": true }
+    },
+    "server": {
+      "listenPath": { "value": "/weather-mcp/", "strip": true },
+      "authentication": {
+        "enabled": true,
+        "securitySchemes": {
+          "jwtAuth": {
+            "enabled": true,
+            "signingMethod": "rsa",
+            "jwksURIs": [{ "url": "https://auth.example.com/.well-known/jwks.json" }],
+            "identityBaseField": "sub"
+          },
+          "idpAuth": {
+            "enabled": true,
+            "scopeCheck": {
+              "enabled": true,
+              "claimNames": ["scope", "scp"],
+              "separator": " ",
+              "scopeSource": "union"
+            },
+            "protectedResourceMetadata": {
+              "enabled": true,
+              "resource": "https://gateway.example.com/weather-mcp/",
+              "authorizationServers": ["https://auth.example.com"],
+              "autoDeriveScopes": true
+            },
+            "tokenExchange": {
+              "enabled": true,
+              "providers": [
+                {
+                  "name": "idp-prod",
+                  "issuers": ["https://auth.example.com"],
+                  "tokenEndpoint": "https://auth.example.com/token",
+                  "clientAuth": {
+                    "method": "client_secret_basic",
+                    "clientId": "tyk-gateway",
+                    "clientSecret": "env://EXCHANGE_CLIENT_SECRET"
+                  },
+                  "defaultTarget": {
+                    "audience": "https://weather-mcp.example.com",
+                    "scopes": ["mcp:read", "mcp:write"]
+                  }
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "upstream": {
+      "url": "https://weather-mcp.example.com"
+    }
+  }
+}
+```
+
+In this configuration:
+- MCP clients that arrive without a token receive a `401` with a `WWW-Authenticate` header pointing to the PRM document.
+- Clients that follow the discovery flow obtain a token from `https://auth.example.com` using the `authorizationCode` flow and present it as a Bearer token.
+- Tyk validates the token signature via the `jwtAuth` scheme (JWKS endpoint), then `scopeCheck` enforces that the token carries `tools:read` before the request proceeds.
+- Tyk exchanges the validated agent token for an upstream-scoped token audienced to `https://weather-mcp.example.com`. The original agent token never reaches the upstream MCP server.
+
+<Note>
+In Tyk 5.14.0, the `oauth2` scheme does not validate JWT signatures itself. The `jwtAuth` scheme in this example handles signature validation — configure JWT authentication on the API alongside the `oauth2` scheme so that inbound tokens are verified before scope enforcement runs.
+</Note>
+
+For the static client credentials variant — where Tyk authenticates to the upstream with its own credentials independent of the inbound token — see [Upstream OAuth](#upstream-oauth).
+
+---
+
+## Per-primitive configuration
+
+The complete example above configures each feature at the API level, applying uniformly to all primitives. Both scope enforcement and token exchange support per-primitive overrides when individual tools need different access requirements or different upstream credentials.
+
+### Multiple exchange providers
+
+The `providers` array accepts multiple entries. Tyk selects the matching provider at request time by comparing the inbound token's `iss` claim against each provider's `issuers` list. This lets you handle tokens from different authorization servers — for example, your own IdP and a partner's — routing each to the appropriate token endpoint and default target:
+
+```json
+"tokenExchange": {
+  "enabled": true,
+  "providers": [
+    {
+      "name": "idp-prod",
+      "issuers": ["https://auth.example.com"],
+      "tokenEndpoint": "https://auth.example.com/token",
+      "clientAuth": {
+        "method": "client_secret_basic",
+        "clientId": "tyk-gateway",
+        "clientSecret": "env://EXCHANGE_CLIENT_SECRET"
+      },
+      "defaultTarget": {
+        "audience": "https://weather-mcp.example.com",
+        "scopes": ["mcp:read", "mcp:write"]
+      }
+    },
+    {
+      "name": "partner-idp",
+      "issuers": ["https://auth.partner.example"],
+      "tokenEndpoint": "https://auth.partner.example/token",
+      "clientAuth": {
+        "method": "client_secret_post",
+        "clientId": "tyk-gateway-partner",
+        "clientSecret": "env://PARTNER_EXCHANGE_SECRET"
+      },
+      "defaultTarget": {
+        "audience": "https://weather-mcp.example.com",
+        "scopes": ["mcp:read"]
+      }
+    }
+  ]
+}
+```
+
+If no provider matches the inbound token's issuer, the exchange step fails and Tyk returns an error before the request reaches the upstream.
+
+### Per-primitive scope and exchange overrides
+
+The `defaultTarget` in each provider applies uniformly to every primitive. When individual tools need a different audience, a narrower set of scopes, or stricter scope enforcement than the API-level default, configure overrides directly on the primitive in the `middleware.mcpTools` map:
+
+```json
+"middleware": {
+  "mcpTools": {
+    "get-forecast": {
+      "security": [{ "idpAuth": ["tools:read"] }],
+      "scopeCheck": { "enabled": true }
+    },
+    "delete-station": {
+      "security": [{ "idpAuth": ["tools:write", "admin:stations"] }],
+      "scopeCheck": { "enabled": true },
+      "exchange": {
+        "enabled": true,
+        "audience": "https://station-admin.example.com",
+        "scopes": ["admin:stations"]
+      }
+    }
+  }
+}
+```
+
+- `get-forecast` requires `tools:read`. Scope enforcement rejects tokens that don't carry that claim. The exchange uses the provider's `defaultTarget` audience and scopes unchanged.
+- `delete-station` requires both `tools:write` and `admin:stations`. The `exchange` override requests a token audienced specifically to `https://station-admin.example.com` — a narrower credential than the standard weather MCP token — carrying only the `admin:stations` scope.
+
+For the full `scopeCheck` and `exchange` field reference, see [MCP middleware](/ai-management/mcp-gateway/mcp-middleware).
diff --git a/ai-management/mcp-gateway/overview.mdx b/ai-management/mcp-gateway/overview.mdx
new file mode 100644
index 0000000000..752f84e2f4
--- /dev/null
+++ b/ai-management/mcp-gateway/overview.mdx
@@ -0,0 +1,159 @@
+---
+title: "MCP Gateway"
+description: "Tyk Gateway proxies and governs remote MCP servers, applying authentication, rate limiting, access control, key management, and observability to AI agent traffic at the gateway level."
+keywords: "MCP, Model Context Protocol, MCP Gateway, AI agent, remote MCP server, JSON-RPC, authentication, rate limiting, observability, policy enforcement"
+sidebarTitle: "Overview"
+---
+
+![MCP Gateway](/img/ai-management/mcp-gateway-header.png)
+
+The Model Context Protocol (MCP) is the open standard for connecting AI applications to external tools, data sources, and workflows.
+
+As MCP servers move into shared cloud infrastructure, they face the same operational challenges REST APIs faced a decade ago: who can call what, how often, with what credentials, and with what visibility.
+
+Tyk Gateway addresses these challenges natively, sitting between MCP clients and your remote MCP servers to enforce authentication, access policies, rate limits, and traffic governance on every JSON-RPC request.
+
+---
+
+## What is MCP?
+
+MCP uses a client-server model: an **MCP client** (an AI agent or framework) connects to an **MCP server** that exposes tools, resources, and prompts through JSON-RPC 2.0 messages over HTTP.
+
+For the full protocol reference, see [MCP Gateway: Core Concepts](/ai-management/mcp-gateway/core-concepts) or the [MCP specification](https://modelcontextprotocol.io/specification/2025-11-25).
+
+---
+
+## The problem with ungoverned MCP
+
+Remote MCP servers are HTTP services. Like any HTTP service, they need authentication, rate limiting, access control, and observability to be operated reliably at scale. Without a gateway layer, each individual server must address these concerns on its own (if at all), leading to:
+
+**Inconsistent security.** Each MCP server implements its own authentication, or none at all. No central place exists to enforce who can access which tools, rotate credentials, or revoke access.
+
+**No visibility.** No standard way exists to see which AI agents are calling which tools, how often, and whether calls are succeeding. Troubleshooting failures or planning capacity requires digging into individual server logs.
+
+**Ungoverned proliferation.** MCP servers can appear across teams without oversight. No registry exists of what is available, no approval process, and no way to apply organization-wide policies consistently.
+
+**Fragile direct connections.** AI agents connecting directly to MCP servers have no protection if a server is slow or unavailable. Rate limits, circuit breakers, and timeouts must be rebuilt on every server independently.
+
+---
+
+## Where Tyk fits
+
+Tyk Gateway sits in front of your remote MCP servers and proxies all MCP traffic through a centrally managed gateway layer. AI clients connect to Tyk at a configured listen path; Tyk authenticates the request, applies the configured middleware chain, and forwards the request to the upstream MCP server. The Tyk Dashboard serves as the registry layer, the central catalog of every MCP server in your organization, with the access policies and observability that govern how each one is used.
+
+![Where Tyk MCP Gateway fits](/img/ai-management/where-tyk-mcp-gateway-fits.png)
+
+Tyk understands the MCP protocol. It parses JSON-RPC 2.0 request bodies to identify the method being called and the specific tool, resource, or prompt being accessed. This means you can apply policies at the level of individual MCP primitives (rate limiting a particular tool, blocking access to a specific resource, or caching a prompt response) rather than treating all MCP traffic as an opaque HTTP stream.
+
+Tyk handles both MCP transport methods:
+
+- **`POST /mcp`**: JSON-RPC messages from client to server. Tyk applies the middleware chain and proxies the request, streaming SSE responses through if the upstream returns them.
+- **`GET /mcp`**: Long-lived SSE connections for server-initiated messages. Tyk maintains the connection and passes events through transparently.
+
+---
+
+## How Tyk represents MCP proxies
+
+Tyk models each remote MCP server as a **[Tyk OAS API definition](/ai-management/mcp-gateway/mcp-proxy-definitions)**, an OpenAPI 3.0 document extended with the `x-tyk-api-gateway` vendor extension. This is the same format used for REST APIs, so MCP proxies share the same configuration model, tooling, and management APIs as the rest of your Tyk estate.
+
+The MCP proxy definition configures:
+
+- The **listen path**: the URL prefix where Tyk exposes the MCP proxy to clients
+- The **upstream URL**: the address of your remote MCP server
+- **Authentication**: which method to use and how to validate credentials
+- **Middleware**: per-primitive access control, rate limits, caching, transformations, and more
+
+You create and manage MCP proxy definitions through the Tyk Dashboard or the Gateway API. No changes to your upstream MCP server are required.
+
+<Note>
+MCP proxy definitions require Tyk OAS format. Tyk Classic API definitions do not support MCP.
+</Note>
+
+---
+
+## What Tyk MCP Gateway provides
+
+### Authentication and key management
+
+Tyk authenticates every MCP request before it reaches your upstream server. All authentication methods supported for REST APIs work identically for MCP: bearer tokens, API keys, JWT, OAuth 2.0, and mTLS. You issue and manage API keys through the Tyk Dashboard or API, and every key is associated with a security policy that defines what it can access and at what rate.
+
+This means your MCP servers don't need to implement their own authentication. Tyk handles credential verification, token validation, and key lifecycle centrally: rotation, expiration, and revocation.
+
+The [MCP specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization) mandates OAuth 2.1 as the authorization framework and requires MCP servers to implement **Protected Resource Metadata** (PRM), a discovery document that tells OAuth-aware clients which authorization server to use and which scopes the resource supports. Tyk implements PRM natively: it serves the `/.well-known/oauth-protected-resource` endpoint automatically and returns the correct `WWW-Authenticate` challenge on unauthenticated requests, so compliant MCP clients can self-configure without any pre-configuration. See [OAuth 2.1 authentication](/ai-management/mcp-gateway/oauth-2-1) for the full implementation details.
+
+### Access control and policy enforcement
+
+Security policies give you granular, per-consumer control over what MCP consumers can see and access, and how often. Rather than configuring each key individually, you define a policy once and issue keys that inherit its rules automatically.
+
+For MCP proxies, policies go significantly further than the rate limits and quotas available for standard REST APIs. A policy can control which proxies a consumer key can reach, which JSON-RPC methods it is permitted to use, which individual tools, resources, and prompts it can invoke or discover, and what rate limits and quotas apply at each level, independently for each consumer.
+
+This is what makes it practical to serve many different AI agents from a single MCP proxy. A read-only analyst agent and a privileged administrator agent can share the same upstream server but operate within completely different entitlements, each enforced at the gateway without any changes to the upstream.
+
+Tyk also filters discovery responses per consumer. When an agent calls `tools/list`, `resources/list`, or `prompts/list`, Tyk intercepts the upstream response and returns only the primitives that consumer is permitted to see. **Each agent's view of the server's capabilities is scoped to its own entitlements from the moment it connects.**
+
+### Service registry
+
+The Tyk Dashboard's MCP section serves as a central registry of all MCP servers in your organization. Each MCP proxy is a registry entry that records the upstream server's address, its listen path, the tools and resources it exposes, and the access policies that govern it.
+
+This gives teams a single authoritative source of truth for what MCP capabilities are available, who can access them, and under what conditions. When a new MCP server is onboarded, registering it as a proxy in the Dashboard makes it discoverable to authorized agents and invisible to everyone else, without changes to the upstream server or the agents themselves.
+
+See [Managing MCP proxies](/ai-management/mcp-gateway/managing-proxies).
+
+### Traffic management
+
+Tyk applies the same traffic management capabilities to MCP traffic that it provides for REST and GraphQL:
+
+- **Rate limiting** at every level of granularity: across all consumers on a proxy, per consumer key, per JSON-RPC method, and down to the individual named tool, resource, or prompt. Limits at each level are tracked independently, so a consumer exhausting their budget on one tool does not affect their access to others.
+- **Throttling** to queue requests that exceed the rate limit rather than rejecting them immediately.
+- **Timeouts** per primitive, so a slow tool response does not stall the entire MCP session.
+- **Circuit breakers** that detect failure patterns on individual tools and temporarily stop forwarding requests, giving the upstream time to recover.
+- **Request size limits** to protect against oversized argument payloads on tools that accept large inputs.
+- **Upstream rate limits** that protect your MCP server from being overwhelmed regardless of how many consumers are configured.
+
+### Analytics
+
+Tyk records analytics for every MCP request and exposes them in the Tyk Dashboard under **Monitoring → Activity by MCP**. Analytics are captured at two levels.
+
+**Proxy-level charts** show total request volume, error counts, and HTTP error code distribution across all your MCP proxies. Use these to compare traffic and error rates between proxies and identify trends over time.
+
+**Primitive-level charts** break the data down by individual tool, resource, or prompt: call volumes over time, most frequently called primitives, highest error rates, and slowest average latency. These charts show exactly which tools AI agents are calling, which are failing, and which are your performance bottlenecks, without any additional instrumentation.
+
+Both levels of data appear alongside your REST and GraphQL API analytics, giving you a unified view of your entire API estate. See [MCP observability](/ai-management/mcp-gateway/mcp-observability).
+
+### Observability
+
+Beyond the Dashboard analytics page, Tyk emits MCP-specific observability signals that integrate with your existing monitoring infrastructure.
+
+**Structured access logs** include four MCP-specific fields on every logged request: the JSON-RPC method invoked (`mcp_method`), the primitive type (`mcp_primitive_type`), the primitive name (`mcp_primitive_name`), and a gateway-mapped error code when the request fails at the gateway layer (`mcp_error_code`). These fields let you filter and aggregate MCP traffic in your log management tooling using the same pipeline you use for REST APIs. See [MCP access logs](/ai-management/mcp-gateway/mcp-access-logs).
+
+**OpenTelemetry metrics**: when OTel is enabled on the gateway, Tyk emits four MCP-specific metric instruments covering request counts (with dimensions for method, primitive type, tool name, and error code), method distribution, upstream latency per tool, and end-to-end request latency. These metrics can be scraped by [Prometheus](https://prometheus.io/) and used to build dashboards in [Grafana](https://grafana.com/) or your preferred metrics platform. See [MCP metrics](/ai-management/mcp-gateway/mcp-metrics) and [How to build a Grafana dashboard for MCP traffic](/ai-management/mcp-gateway/how-to-grafana-mcp-dashboard).
+
+---
+
+## Requirements and limitations
+
+### Requirements
+
+| Requirement | Detail |
+|---|---|
+| Tyk Gateway version | v5.13 or later |
+| API definition format | Tyk OAS only. Tyk Classic API definitions do not support MCP. |
+| API definition extension | The `x-tyk-api-gateway` vendor extension is required in every MCP proxy definition. |
+
+### Supported transports
+
+Tyk MCP Gateway supports the **Streamable HTTP** transport defined in the MCP `2025-11-25` specification:
+
+- **`POST /mcp`**: JSON-RPC messages from client to server, with optional SSE streaming responses.
+- **`GET /mcp`**: Long-lived SSE connection for server-initiated messages.
+
+The **stdio** transport is not supported. Tyk is a network-based API gateway; stdio is designed for local, in-process MCP servers. If your upstream MCP server uses stdio, a stdio-to-HTTP bridge (such as the one provided by the MCP SDK) is required between it and Tyk.
+
+### HTTP-to-MCP translation
+
+When using Tyk to convert an existing REST API into MCP tools (via [AI Studio](/ai-management/ai-studio/overview)), only **OpenAPI REST APIs** are supported as the source. GraphQL APIs cannot be converted to MCP tools.
+
+### MCP specification version
+
+Tyk supports the MCP **`2025-11-25`** specification. For the full protocol reference, see the [MCP specification](https://modelcontextprotocol.io/specification/2025-11-25).
+
diff --git a/ai-management/mcp-gateway/policies.mdx b/ai-management/mcp-gateway/policies.mdx
new file mode 100644
index 0000000000..d7a8d043b6
--- /dev/null
+++ b/ai-management/mcp-gateway/policies.mdx
@@ -0,0 +1,217 @@
+---
+title: "MCP Gateway Policies"
+description: "How Tyk security policies govern MCP proxy access: which proxies a consumer can reach, which tools and resources they can invoke, and what rate limits and quotas apply, all configured in one place and applied consistently across every key."
+keywords: "MCP, Model Context Protocol, MCP policies, access control, rate limiting, mcp_primitives, mcp_access_rights, json_rpc_methods_access_rights, security policy, MCP proxy"
+sidebarTitle: "MCP Policies"
+---
+
+A Tyk security policy defines the access rules and usage limits for a consumer. For MCP proxies, policies go beyond the standard rate limit and quota controls available for REST APIs. They let you control access and apply rate limits at the level of individual tools, resources, and prompts, and restrict which JSON-RPC protocol methods a consumer can use at all. This page explains what MCP policies control, how to configure them, and how Tyk merges multiple policies applied to the same key.
+
+---
+
+## What policies are for
+
+A policy is a reusable template applied to one or more API keys. Rather than configuring limits and access rights on each key individually, you define them once in a policy and issue keys that inherit those rules automatically. When you update the policy, every key bound to it picks up the change.
+
+For MCP proxies, policies serve three purposes:
+
+**Controlling access**: a policy determines which MCP proxies a consumer key can reach. Without an entry in the policy's access rights, the consumer receives `403 Forbidden` regardless of what key they present.
+
+**Governing MCP capabilities**: beyond proxy-level access, policies let you restrict which JSON-RPC methods a consumer can use and which specific tools, resources, and prompts they can invoke. This lets you give different consumers different views of the same MCP proxy without creating separate proxy definitions.
+
+**Enforcing usage limits**: policies apply rate limits and quotas at multiple levels: across the whole policy, per MCP proxy, per JSON-RPC method, and per named primitive. Each consumer key tracks its own independent counters.
+
+---
+
+## What MCP policies control
+
+### Access control
+
+Tyk evaluates access control at three levels, in order:
+
+**Proxy access**: the policy's access rights list determines which MCP proxies the key can reach. A key can only call a proxy listed in its access rights.
+
+**JSON-RPC method access** (`json_rpc_methods_access_rights`): controls which protocol-level operations the consumer may use. For example, you can allow `tools/call` and `tools/list` while blocking `sampling/createMessage`. Use an `allowed` list to restrict to specific methods, or a `blocked` list to exclude specific methods while permitting all others.
+
+**Primitive access** (`mcp_access_rights`): controls which specific tools, resources, and prompts the consumer can invoke. Each primitive type (tools, resources, prompts) has its own `allowed` and `blocked` list. Values are Go regular expressions, so `"internal_.*"` matches any tool whose name starts with `internal_`. A non-empty `allowed` list acts as an explicit allowlist; `blocked` entries are excluded from whatever is otherwise permitted.
+
+### Rate limiting
+
+Rate limits can be applied at four levels within a policy entry for an MCP proxy:
+
+**Policy global**: the top-level `rate` and `per` fields on the policy apply across all APIs the key accesses.
+
+**Per MCP proxy**: the `limit` field inside an access rights entry applies a rate limit specific to calls to that proxy, independent of the consumer's overall policy rate.
+
+**Per JSON-RPC method** (`json_rpc_methods`): sets a rate limit for calls using a specific method name, such as `tools/call`. The counter applies across all tools invoked via that method.
+
+**Per primitive** (`mcp_primitives`): sets a rate limit scoped to a specific named tool, resource, or prompt. A consumer who exhausts their limit on `generate_report` is blocked from calling that tool while remaining free to call others.
+
+All applicable limits are checked independently on every call. Whichever is exhausted first blocks the request.
+
+### Quotas
+
+A quota sets a maximum total number of calls over a renewal period (daily, weekly, or monthly). A consumer who exhausts their quota receives `429 Too Many Requests` until the period resets. Quotas are configured at the policy level using `quota_max` and `quota_renewal_rate`. See [Quotas](/api-management/request-quotas) for details.
+
+---
+
+## Configuring MCP policies
+
+### Using the Tyk Dashboard
+
+1. In the Tyk Dashboard sidebar, click **Policies** then **Add Policy**.
+
+    ![MCP policy list](/img/ai-management/mcp-policy-list.png)
+
+2. On the **Access Rights** tab, find your MCP proxy in the list and click it to add it to the policy.
+3. Expand the proxy's access rights block. You will see sections for primitive rate limits and access control.
+4. To configure **primitive rate limits**, click **Add Rate Limit**. Set the **Rate** and **Per** (in seconds) values, then click **Add Primitive** to associate a named tool, resource, or prompt with that limit. Add multiple primitives to the same group if they share a limit; create separate groups for different limits.
+5. To configure **access control** for methods and primitives, use the access control tabs within the access rights block. Add tool, resource, prompt, or method names and toggle them between allowed and blocked.
+6. On the **Configurations** tab, set the policy name, key expiry, and global rate limit.
+7. Click **Create Policy**.
+
+### Using the Dashboard API
+
+Create or update a policy via `POST /api/portal/policies` (create) or `PUT /api/portal/policies/{policy-id}` (update). The MCP-specific fields sit inside the `access_rights` entry for each MCP proxy.
+
+The following example creates a policy that grants access to a weather MCP proxy, restricts the consumer to read-only methods, limits them to specific tools, and applies per-primitive rate limits:
+
+```json expandable
+{
+  "name": "Weather Agent — Standard Tier",
+  "state": "active",
+  "rate": 1000,
+  "per": 60,
+  "quota_max": 50000,
+  "quota_renewal_rate": 86400,
+  "access_rights": {
+    "{mcp-proxy-api-id}": {
+      "api_id": "{mcp-proxy-api-id}",
+      "api_name": "Weather MCP Proxy",
+      "versions": ["Default"],
+      "limit": {
+        "rate": 200,
+        "per": 60
+      },
+      "json_rpc_methods_access_rights": {
+        "allowed": ["tools/call", "tools/list", "resources/list", "resources/read"]
+      },
+      "mcp_access_rights": {
+        "tools": {
+          "allowed": ["get_forecast", "search_weather"]
+        },
+        "resources": {
+          "blocked": ["internal://.*"]
+        },
+        "prompts": {}
+      },
+      "json_rpc_methods": [
+        {
+          "name": "tools/call",
+          "limit": { "rate": 100, "per": 60 }
+        }
+      ],
+      "mcp_primitives": [
+        {
+          "type": "tool",
+          "name": "get_forecast",
+          "limit": { "rate": 20, "per": 60 }
+        },
+        {
+          "type": "resource",
+          "name": "weather://current",
+          "limit": { "rate": 10, "per": 60 }
+        }
+      ]
+    }
+  }
+}
+```
+
+See [Policies](/api-management/policies) for more details.
+
+---
+
+## Policy schema for MCP
+
+The MCP-specific fields appear inside each entry in the `access_rights` object, alongside the standard `limit` and `versions` fields.
+
+### Access rights entry
+
+| Field | Type | Description |
+|---|---|---|
+| `api_id` | string | The ID of the MCP proxy this entry applies to. |
+| `api_name` | string | Display name of the proxy. |
+| `versions` | array | Always `["Default"]` for MCP proxies. |
+| `limit` | object | Per-proxy rate limit for this consumer. Contains `rate` (integer) and `per` (seconds). |
+| `mcp_access_rights` | object | Primitive-level allow/block lists. See below. |
+| `json_rpc_methods_access_rights` | object | Method-level allow/block list. Contains `allowed` (array of strings) and `blocked` (array of strings). |
+| `mcp_primitives` | array | Per-primitive rate limits. Each entry targets one named tool, resource, or prompt. See below. |
+| `json_rpc_methods` | array | Per-method rate limits. Each entry targets one JSON-RPC method name. See below. |
+
+### `mcp_access_rights` object
+
+Controls which primitives the consumer can invoke. Each of the three sub-objects follows the same structure.
+
+| Field | Type | Description |
+|---|---|---|
+| `tools.allowed` | array of strings | Explicit allowlist of tool names. If non-empty, only listed tools are accessible. Supports Go regular expressions. |
+| `tools.blocked` | array of strings | Tools to block. Applied after `allowed`. Supports Go regular expressions. |
+| `resources.allowed` | array of strings | Explicit allowlist of resource URIs. |
+| `resources.blocked` | array of strings | Resource URIs to block. |
+| `prompts.allowed` | array of strings | Explicit allowlist of prompt names. |
+| `prompts.blocked` | array of strings | Prompt names to block. |
+
+Leave a sub-object empty (`{}`) to apply no restrictions for that primitive type.
+
+### `mcp_primitives` array
+
+Each entry defines a rate limit for one named primitive.
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `type` | string | Yes | Primitive type. Accepted values: `tool`, `resource`, `prompt`. |
+| `name` | string | Yes | Name of the primitive as exposed by the MCP server. Case-sensitive. |
+| `limit.rate` | integer | Yes | Maximum calls allowed per time window. Set to `0` for unlimited. |
+| `limit.per` | integer | Yes | Time window in seconds. Set to `0` for unlimited. |
+
+Entries are matched by `type` and `name` together. A tool named `weather` and a resource named `weather` are independent entries with independent counters.
+
+### `json_rpc_methods` array
+
+Each entry defines a rate limit for one JSON-RPC method.
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `name` | string | Yes | The JSON-RPC method name, for example `tools/call` or `resources/read`. |
+| `limit.rate` | integer | Yes | Maximum calls using this method per time window. |
+| `limit.per` | integer | Yes | Time window in seconds. |
+
+### Top-level policy fields
+
+| Field | Type | Description |
+|---|---|---|
+| `rate` | integer | Global rate limit across all APIs in the policy. |
+| `per` | integer | Time window for the global rate limit, in seconds. |
+| `quota_max` | integer | Maximum total calls in the quota period. Set to `-1` for unlimited. |
+| `quota_renewal_rate` | integer | Quota renewal period in seconds. Common values: `86400` (daily), `604800` (weekly). |
+| `key_expires_in` | integer | Key lifetime in seconds from creation. Set to `0` for no expiry. |
+
+---
+
+## When multiple policies apply
+
+A consumer key can have multiple policies applied to it. Tyk merges MCP-specific fields as follows:
+
+- **Rate limits**: the most permissive limit wins. If two policies define a limit for the same primitive, the higher `rate` value is used.
+- **`mcp_access_rights` and `json_rpc_methods_access_rights`**: `allowed` lists are merged by union (the consumer gains access to the combined set). `blocked` lists are also unioned, so a primitive blocked in any policy remains blocked.
+- **Proxy access**: the consumer gains access to the union of all proxies listed across all their policies.
+
+---
+
+## Applying a policy to a consumer
+
+A policy takes effect when it is applied to an access key. In the Tyk Dashboard, go to **Keys**, click **Add Key**, select the policy from the **Apply Policy** dropdown, and generate the key. Issue the key to the consumer; they include it in the `Authorization` header of every MCP request.
+
+See [Policies](/api-management/policies) for full details.
+
diff --git a/ai-management/mcp-gateway/quickstart.mdx b/ai-management/mcp-gateway/quickstart.mdx
new file mode 100644
index 0000000000..f14045c2a7
--- /dev/null
+++ b/ai-management/mcp-gateway/quickstart.mdx
@@ -0,0 +1,168 @@
+---
+title: "MCP Gateway quickstart"
+description: "Create your first MCP proxy in Tyk Dashboard in under five minutes. Connect to the Mock MCP Server and verify your proxy is routing traffic correctly, with no authentication required."
+keywords: "MCP, Model Context Protocol, MCP Gateway, quickstart, MCP proxy, JSON-RPC, Tyk Dashboard, MCP Inspector"
+sidebarTitle: "Quickstart"
+---
+
+This guide gets you from zero to a working MCP proxy in minutes. An MCP proxy sits between an AI agent and a remote MCP server, routing requests, giving you visibility over every tool call, and letting you apply governance policies without touching the upstream server.
+
+You'll create a proxy to the [Tyk Mock MCP Server](https://github.com/TykTechnologies/tyk-mock-mcp-server), connect to it with [MCP Inspector](https://github.com/modelcontextprotocol/inspector), and verify that tool calls are routing correctly through Tyk.
+
+---
+
+## Before you begin
+
+- A running Tyk Gateway (v5.13 or later) connected to your Tyk Dashboard. See [Self-managed](/getting-started/quick-start)
+- A Dashboard user account with MCP write permissions
+- Go 1.22 or later, or Docker (to run the Mock MCP Server)
+- Node.js 18 or later (to run MCP Inspector). If you don't have it, download it from [nodejs.org](https://nodejs.org/en/download).
+
+---
+
+## Instructions
+
+### Step 1: Start the Mock MCP Server
+
+The Mock MCP Server is the upstream your proxy will route traffic to. It exposes 15 tools across six categories (users, posts, products, analytics, utilities, and streaming) and requires no configuration or credentials.
+
+1. Start the Mock MCP Server using Go or Docker:
+
+    <Tabs>
+    <Tab title="Go">
+    ```bash
+    git clone https://github.com/TykTechnologies/tyk-mock-mcp-server.git
+    cd tyk-mock-mcp-server
+    go build -o tyk-mock-mcp-server .
+    ./tyk-mock-mcp-server
+    ```
+    </Tab>
+    <Tab title="Docker">
+    ```bash
+    docker run -p 7878:7878 ghcr.io/tyktechnologies/tyk-mock-mcp-server:latest
+    ```
+    </Tab>
+    </Tabs>
+
+2. Confirm the server is running on `http://localhost:7878`. Leave it running.
+
+<Note>
+Your Tyk Gateway must be able to reach `localhost:7878`. If your gateway runs in Docker or on a remote host, replace `localhost` with the appropriate hostname or IP address.
+</Note>
+
+---
+
+### Step 2: Create the MCP proxy
+
+1. In the Tyk Dashboard sidebar, click **MCP**, then click **Add MCP Proxy**.
+
+    ![Create MCP proxy](/img/ai-management/mcp-create-mcp.png)
+
+    This opens the three-step creation wizard.
+
+2. **Name your proxy.** Enter `Mock MCP Server`. Tyk derives the listen path from the name automatically. Click **Continue**.
+
+    ![Name your MCP proxy](/img/ai-management/mcp-quickstart-name-server.png)
+
+3. **Set the upstream URL.** Enter `http://localhost:7878/mcp`. Click **Continue**.
+
+    ![Set the upstream URL](/img/ai-management/mcp-quickstart-server-url.png)
+
+4. **Connect gateways.** Select your gateway instances, or leave blank to deploy to all gateways. Click **Finish**, then click **Save MCP Proxy**.
+
+    ![Deploy to gateways](/img/ai-management/mcp-quickstart-deploy-gateways.png)
+
+    The Dashboard displays "MCP proxy successfully created".
+
+---
+
+### Step 3: Find your MCP endpoint
+
+1. Click **Edit** to open the proxy designer.
+
+2. Find the **MCP Proxy URL** at the top of the page and append `/mcp` to get your MCP endpoint.
+
+    ![MCP Proxy URL](/img/ai-management/mcp-quickstart-proxy-url.png)
+
+    For example, if the Dashboard shows `https://my-gateway.example.com/mock-mcp-server`, your MCP endpoint is:
+
+    ```
+    https://my-gateway.example.com/mock-mcp-server/mcp
+    ```
+
+3. Note this URL down; you'll enter it into MCP Inspector in the next step.
+
+---
+
+### Step 4: Connect with MCP Inspector
+
+MCP Inspector is a browser-based tool for testing MCP servers. It handles the session handshake, lists available tools, and lets you call them interactively.
+
+1. Start MCP Inspector:
+
+    ```bash
+    npx @modelcontextprotocol/inspector
+    ```
+
+    MCP Inspector downloads automatically on first run.
+
+2. Open the URL printed in your terminal.
+
+3. Set **Transport Type** to `Streamable HTTP`.
+
+4. Set **URL** to your MCP endpoint from Step 3.
+
+5. Click **Connect**.
+
+    ![MCP Inspector connect](/img/ai-management/mcp-quickstart-mcp-inspector-connect.png)
+
+---
+
+### Step 5: Call a tool
+
+1. Click the **Tools** tab. You'll see all 15 Mock MCP Server tools listed: Tyk has proxied the `tools/list` response from the upstream.
+
+    {/* TODO: Add screenshot of MCP Inspector Tools tab showing the 15 tools listed */}
+
+2. Select **get_users** and click **Run**. The Mock MCP Server responds with a sample user list.
+
+    {/* TODO: Add screenshot of the get_users tool response in MCP Inspector */}
+
+The request travelled from MCP Inspector → Tyk Gateway → Mock MCP Server → back through Tyk → MCP Inspector. Your proxy is working.
+
+---
+
+### Step 6: View the call in analytics
+
+1. In the Tyk Dashboard sidebar, go to **Monitoring** → **Activity by MCP**.
+
+2. Check that the `tools/call` request appears under **Primitives Traffic** and **Most Used Primitives**, with `get_users` listed as the invoked tool. The `initialize` handshake from MCP Inspector appears separately with no primitive name, as expected for a session lifecycle call.
+
+    {/* TODO: Add screenshot of the Activity by MCP analytics page showing the get_users call recorded under Primitives Traffic */}
+
+<Note>
+Analytics data is written by Tyk Pump asynchronously. Allow a few seconds after making a call before checking the analytics page. If no data appears, verify that analytics recording is enabled and that Tyk Pump is running and connected to your storage backend.
+</Note>
+
+---
+
+## Troubleshooting
+
+**Connection refused in MCP Inspector**: Check that your Tyk Gateway is running and that the MCP endpoint URL is correct. Confirm the Mock MCP Server is running on port `7878`.
+
+**No tools listed**: The proxy connected but the upstream is not reachable. Confirm the Mock MCP Server is running. If your gateway runs in Docker, replace `localhost` in the upstream URL with `host.docker.internal`.
+
+---
+
+## What's next
+
+You have a working MCP proxy routing traffic to the Mock MCP Server. The next step is to secure it, adding authentication so only authorized agents can connect.
+
+**[How to secure an MCP proxy →](/ai-management/mcp-gateway/how-to-proxy-remote-mcp)**
+
+After that, the series continues with:
+
+- **Restrict tool access**: Configure a tool allowlist so agents can only call the tools you have approved. See [Block an MCP Tool](/ai-management/mcp-gateway/how-to-block-tool).
+- **Create access tiers**: Use policies to define different levels of access for different agents. See [MCP proxy policies](/ai-management/mcp-gateway/policies).
+- **Set up token exchange**: Use RFC 8693 token exchange so the inbound agent token is replaced with a backend-scoped token before reaching the upstream MCP server. See [Token exchange](/api-management/authentication/token-exchange).
+- **Understand the concepts**: See [MCP Gateway: Core Concepts](/ai-management/mcp-gateway/core-concepts) for the mental model behind sessions, middleware levels, and policies.
diff --git a/ai-management/mcps/api-to-mcp.mdx b/ai-management/mcps/api-to-mcp.mdx
new file mode 100644
index 0000000000..c9f311ed2e
--- /dev/null
+++ b/ai-management/mcps/api-to-mcp.mdx
@@ -0,0 +1,238 @@
+---
+title: "Natural-language interaction with your APIs (API to MCP)"
+description: "Enable AI assistants to safely and dynamically interact with your existing APIs using Tyk's API to MCP tooling."
+keywords: "AI MCP, API-to-MCP, Tyk AI MCP"
+sidebarTitle: "API to MCP"
+---
+
+## Overview
+
+**API to MCP** enables AI assistants to safely and dynamically interact with your existing APIs. It allows non-technical users to access API functionality through natural language, while developers retain full control over what endpoints are exposed and how they are accessed.
+
+This allows AI tools to interpret, invoke, and structure API operations without requiring any backend modifications.
+
+**Use this tool to:**
+- Expose your APIs for AI interaction
+- Allow AI assistants to understand and call API operations
+- Configure basic access controls (e.g., filtering operations and setting headers) to manage how AI tools interact with your APIs
+
+If you're looking for quick setup, [jump to Quick Start](#quick-start). For deeper understanding, see [How It Works](#how-it-works) and [Use Cases](#use-cases).
+
+```mermaid
+graph LR
+    A["Your OpenAPI"] --> B["Tyk API-to-MCP Tool"]
+    B --> C["Tyk MCP Server"]
+    D["AI Assistant"] <--> C
+    C <--> E["Your API"]
+    
+    style A fill:#ffffff,stroke:#D1D1E0,stroke-width:1px,font-size:18px
+    style B fill:#d5f5e3,stroke:#D1D1E0,stroke-width:1px,font-size:18px
+    style C fill:#d5f5e3,stroke:#D1D1E0,stroke-width:1px,font-size:18px
+    style D fill:#eeeeee,stroke:#D1D1E0,stroke-width:1px,font-size:18px
+    style E fill:#ffffff,stroke:#D1D1E0,stroke-width:1px,font-size:18px
+    
+    linkStyle default stroke-width:2px
+```
+
+## Key Features
+- **Dynamic OpenAPI Loading:** Load specifications from local files or HTTP/HTTPS URLs
+- **OpenAPI Overlay Support:** Apply overlays to customize specifications
+- **Flexible Operation Filtering:** Include/exclude specific operations using glob patterns
+- **Comprehensive Parameter Handling:** Preserves formats and includes metadata
+- **Built-in Access Control & Security:** Control which endpoints are exposed, enforce authentication (API keys, OAuth, etc.), and add custom headers to all API requests, for secure AI access
+- **Authentication Support:** Handles API keys, OAuth tokens, and other security schemes
+- **MCP Extensions:** Support for custom x-mcp extensions to override tool names and descriptions
+- **Multiple Integration Options:** Works with Claude Desktop, Cursor, Vercel AI SDK, and other MCP-compatible environments
+
+Check the [complete features list](https://github.com/TykTechnologies/api-to-mcp#features) is available in Tyk's *api-to-mcp* GitHub repository.
+
+## Quick Start
+<a id="quick-start"></a>
+
+To get started quickly, the primary way to use it is by configuring your AI assistant to run it directly as an MCP tool.
+
+### Requirements
+- [Node.js v18+](https://nodejs.org/en/download) installed
+- An accessible OpenAPI specification, e.g. `https://petstore3.swagger.io/api/v3/openapi.json` (could be a local file as well)
+- Claude Desktop (which we show in this example) or other MCP-compatible AI assistant that supports connecting to external MCP-compatible tool servers (e.g. Cursor, Vercel AI SDK, Cline extension in VS Code etc.)
+
+### Configure your AI Assistant
+
+To connect the tool with Claude Desktop or other MCP-compatible assistants, you need to register it as an MCP server. Most AI assistance share similar MCP server definition. This is the definition for *api-to-mcp* with petstore as the OpenAPI:
+
+```json
+{
+  "mcpServers": {
+    "api-tools": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@tyk-technologies/api-to-mcp@latest",
+        "--spec",
+        "https://petstore3.swagger.io/api/v3/openapi.json"
+      ],
+      "enabled": true
+    }
+  }
+}
+```
+
+**Step 1.**
+To enable the tool, paste the above configuration into your AI assistant’s MCP config file
+
+- **Claude Desktop**: For MacOS, you need to update `~/Library/Application Support/Claude/claude_desktop_config.json`. See the [Claude Desktop setup instructions](https://github.com/TykTechnologies/api-to-mcp?tab=readme-ov-file#setting-up-in-claude-desktop) for Windows OS and more customization options.
+- **Cursor**: See the [Cursor setup guide](https://github.com/TykTechnologies/api-to-mcp#cursor) for instruction on setting it with Cursor.
+
+**Step 2.**
+Once connected, ask the AI to perform an operation (e.g., "List all pets" or "Create a new user").
+
+## How It Works
+
+### User flow in API to MCP user flow
+
+1.  **Input**: Your OpenAPI specification (required) and optional overlays
+2.  **Processing**: The API to MCP tool loads the spec, applies any overlays, and transforms API operations into MCP tools
+3.  **Runtime**: The MCP server exposes these tools to AI assistants, which are now discoverable to the AI assistant
+4.  **Execution Flow**: When you ask the AI assistant a question, it calls the tool (via the MCP server), which translates the request, forwards it to your API, and returns a formatted response.
+
+
+```mermaid
+flowchart LR
+    subgraph "Input"
+        A["OpenAPI Specification"]
+        B["Optional Overlays"]
+    end
+
+    subgraph "API to MCP Tool"
+        C["1. Load & Parse<br />OpenAPI Spec"]
+        D["2. Apply Overlays<br />(if provided)"]
+        E["3. Transform API Operations<br />into MCP Tools"]
+        F["MCP Server"]
+    end
+
+    subgraph "Runtime"
+        G["4. AI Assistant<br />Discovers Tools"]
+        H["AI Assistant<br />Calls Tools"]
+        I["Your API"]
+    end
+
+    A -->|YAML/JSON| C
+    B -->|Optional| D
+    C --> D
+    D --> E
+    E -->|Register Tools| F
+    F -->|Expose Tools| G
+    G --> H
+    H -->|Request| F
+    F -->|Translate & Forward| I
+    I -->|Response| F
+    F -->|Format & Return| H
+
+    classDef input fill:#f9f,stroke:#333,stroke-width:2px,font-size:18px;
+    classDef tool fill:#bbf,stroke:#333,stroke-width:2px,font-size:18px;
+    classDef runtime fill:#bfb,stroke:#333,stroke-width:2px,font-size:18px;
+    
+    class A,B input;
+    class C,D,E,F tool;
+    class G,H,I runtime;
+
+linkStyle default stroke-width:2px
+```
+
+### Request lifecycle: how an AI assistant invokes an API tool
+
+The following diagram illustrates the flow of a request through the system at runtime:
+
+```mermaid
+sequenceDiagram
+    participant AI as "AI Client"
+    participant MCP as "MCP Server"
+    participant Tool as "Tool Handler"
+    participant API as "API Client"
+    participant Target as "Target API"
+
+    AI->>MCP: Invoke Tool
+    MCP->>Tool: Execute Tool Handler
+    Tool->>Tool: Extract Parameters
+    Tool->>Tool: Validate Input
+    Tool->>API: executeApiCall()
+    API->>API: Apply Security
+    API->>API: Construct Request
+    API->>Target: Make HTTP Request
+    Target-->>API: HTTP Response
+
+    alt Successful Response
+        API-->>Tool: Success Response
+        Tool->>MCP: Format MCP Result
+        MCP-->>AI: Tool Execution Success
+    else Error Response
+        API-->>Tool: Error Response
+        Tool->>MCP: Map to MCP Error
+        MCP-->>AI: Tool Execution Error
+    end
+
+```
+
+API to MCP  can be found in [api-to-mcp GitHub repository](https://github.com/TykTechnologies/api-to-mcp)
+
+## Use cases
+<a id="use-cases"></a>
+
+Use **API to MCP** when you need to:
+
+- **Connect AI Assistants to Existing APIs** - Let AI tools understand and call your existing API operations using natural language — no code changes needed, just [configuration](https://github.com/TykTechnologies/api-to-mcp/#configuration).
+
+- **Create a Unified Interface for AI Systems** - Standardize how APIs are accessed by AI across your organization with a consistent protocol (MCP).
+
+- **Control API Access for AI** - Filter which operations are available to AI, apply authentication, and monitor usage securely.
+
+- **Improve API Discoverability** - Enable AI systems to automatically list available endpoints, input parameters, and expected responses.
+
+- **Test APIs Using AI** - Use AI assistants to generate test inputs, invoke endpoints, and validate responses in a conversational way. Natural-language test generation and feedback.
+
+- **Auto-docs & validation** - Use AI to test, describe, or troubleshoot APIs in a conversational way. Natural-language test generation and feedback.
+
+- **Workflow Automation** - Connect APIs and AI logic in real time to automate workflows and streamline processes.
+
+---
+
+## Best Practices
+
+- **Start small**: Only expose safe, limited endpoints
+- **Use filters**: allow list or block list endpoints as needed
+- **Secure your APIs**: Pass tokens, headers, or keys securely
+- **Track usage**: Monitor tool access and patterns
+- **Version specs**: Maintain OpenAPI version control
+- **Use env vars**: Don't hardcode secrets in CLI or config
+- **Validate safely**: Test in staging before going live
+
+---
+
+## Customize your own version of the api-to-mcp tool
+
+If you'd like to share your MCP with a predefined OpenAPI spec and configuration, you can customize this tool to fit your needs. Useful for sharing pre-configured setups with others.
+
+By creating a customized version, others can use the tool with minimal configuration --- no need to manually specify specs or overlays.
+
+Refer to the [customization and publishing guide](https://github.com/TykTechnologies/api-to-mcp?tab=readme-ov-file#customizing-and-publishing-your-own-version) in the *api-to-mcp* repository for step-by-step instructions.
+
+---
+
+## FAQs
+
+**Does this work with GraphQL?**
+Not currently — OpenAPI REST APIs only.
+
+**How do I secure my API requests?**
+Use `--headers`, environment variables. Check the [configuration section](https://github.com/TykTechnologies/api-to-mcp/tree/main#configuration) for more details.
+
+**Can I hide or rename tools?**
+Yes — use `x-mcp` extensions and filters.
+
+**What AI tools are supported?**
+Any tool that supports MCP: Claude, Cursor, VS Code, and more.
+
+
+## Summary
+
+API to MCP transforms OpenAPI specs into AI-compatible tools using the MCP standard. It enables your AI stack to dynamically understand, test, and invoke your existing APIs securely — without modifying your existing backend.
diff --git a/ai-management/mcps/dashboard-api-to-mcp.mdx b/ai-management/mcps/dashboard-api-to-mcp.mdx
new file mode 100644
index 0000000000..80edaada0b
--- /dev/null
+++ b/ai-management/mcps/dashboard-api-to-mcp.mdx
@@ -0,0 +1,105 @@
+---
+title: "Natural-language interaction with Tyk Dashboard (API to MCP)"
+description: "Talk to Tyk Dashboard like a person using AI tools"
+keywords: "AI MCP, Dashboard API-to-MCP, Tyk Dashboard API MCP, Dashboard API, Talk to Tyk Dashboard, AI Management"
+sidebarTitle: "Dashboard API to MCP"
+---
+
+## Overview
+
+Use `tyk-dashboard-mcp` to expose your **Tyk Dashboard API** to AI assistants like Claude, Cursor, or VS Code extensions — enabling natural-language interaction with your Tyk Dashboard.
+
+This tool is a preconfigured fork of [api-to-mcp GitHub repository](https://github.com/TykTechnologies/api-to-mcp), designed specifically for the *Tyk Dashboard* API. It comes bundled with a predefined OpenAPI spec and overlays, so you don’t need to configure much manually.
+
+Explore the core functionality in the [API to MCP guide](/ai-management/mcps/api-to-mcp).
+
+
+## Use Cases
+
+Once connected, you, with your AI assistants, can perform helpful actions on your Tyk Dashboard using natural language. For example:
+- **Explore your API landscape** - List APIs, describe endpoints in plain English, review policies
+- **Query Dashboard settings for audits or support tasks** - List users and keys
+- **Automate admin tasks** - Create or update API definitions (e.g., OAS-based APIs) through AI-driven flows, reducing manual clicks (please note that we haven't documented this just yet)
+- **Power AI developer tools** - Use this as a backend for developer assistants like Claude, Cursor, or VS Code extensions to guide devs while on boarding and using Tyk Dashboard on daily basis. Ideal for internal use cases like AI-driven dashboards, documentation bots, or dev portals powered by LLMs.
+- **Build internal chatbots** - Create internal tools that let team members ask questions like "What APIs are active?" or "What's the global rate limit defined API X?"
+
+
+## Setup Instructions
+
+**Step 1.** Use the following MCP server config for Claude Desktop, Cursor, Cline or any other MCP-compatible tool:
+
+```json
+{
+  "mcpServers": {
+    "tyk-dashboard-api": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@tyk-technologies/tyk-dashboard-mcp",
+        "--targetUrl",
+        "https://your-dashboard-domain.com",
+        "--headers",
+        "{\"Authorization\":\"{dashboard-API-key}\"}"
+      ],
+      "enabled": true
+    }
+  }
+}
+```
+
+Refer to your assistant’s docs for where to place this config — e.g.
+- `claude_desktop_config.json` for [Claude configuration](https://modelcontextprotocol.io/quickstart/user#2-add-the-filesystem-mcp-server)
+- `.cursor-config.json` for [Cursor configuration](https://docs.cursor.com/context/model-context-protocol#configuring-mcp-servers)
+- `cline_mcp_settings.json` for [Cline configuration](https://docs.roocode.com/features/mcp/using-mcp-in-roo#configuring-mcp-servers) (as a VS Code extension).
+
+**Step 2.**
+Once connected, ask your AI assistant to perform an operation (e.g., "List all apis" or "Create a new user").
+
+## Examples
+
+Here you can see the response of asking the *Cline* in VS Code:
+
+1. Task: *Show me the Tyk dashboard api endpoint to create apis*
+
+<img src="/img/ai-mcp/ask-dashboard-howto-create-apis-screenshot.png" alt="Screenshot of the response to request of AI to create a new user" />
+
+<br />
+
+2. Task: *Please create a new user in tyk dashboard*
+
+<img src="/img/ai-mcp/ask-dashboard-to-create-user-screenshot.png" alt="Screenshot of the response to request of AI to create a new user" />
+
+## Tips
+
+- You don’t need to manually define an OpenAPI spec — this tool includes the official Tyk Dashboard OpenAPI spec.
+- You can fork or extend the tool if you want to include additional internal APIs alongside the dashboard.
+- It's an open source and you can find it in [tyk-dashboard-mcp GitHub repository](https://github.com/TykTechnologies/tyk-dashboard-mcp)
+
+## FAQs
+
+**How is this different from `api-to-mcp`?**
+`tyk-dashboard-mcp` is a customised version which is preconfigured for the Tyk Dashboard API. No need to specify your own spec.
+
+**Does this expose all dashboard functionality?**
+Only the operations defined in the OpenAPI spec. You can customize the access list to show/hide more. In the following MCP server config the `--whitelist` to only allow access to getAPIs operation and to only allow to create Tyk OAS definitions:
+
+```json
+{
+  "mcpServers": {
+    "tyk-dashboard-api": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@tyk-technologies/tyk-dashboard-mcp",
+        "--targetUrl",
+        "https://your-dashboard-domain.com",
+        "--headers",
+        "{\"Authorization\":\"{dashboard-API-key}\"}",
+        "--whitelist",
+        "getApis*,POST:/api/apis/oas",
+      ],
+      "enabled": true
+    }
+  }
+}
+```
diff --git a/ai-management/mcps/overview.mdx b/ai-management/mcps/overview.mdx
new file mode 100644
index 0000000000..43cac4d77e
--- /dev/null
+++ b/ai-management/mcps/overview.mdx
@@ -0,0 +1,53 @@
+---
+title: "Tyk MCP Servers"
+description: "A comprehensive guide to Model Context Protocol (MCP) servers in Tyk and how they extend AI capabilities."
+keywords: "AI MCP, MCPs in Tyk, Model Context Protocol"
+sidebarTitle: "Overview"
+---
+
+## MCP capabilities
+
+[Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) servers help AI systems securely interact with external services and tools. They establish structured, governed connections that integrate seamlessly with your Tyk environment.
+
+## What are MCPs?
+
+Model Context Protocol (MCP) servers extend AI systems by exposing external services, tools, and resources in a standardised way. They act as bridges between AI applications and external systems, securely managing authentication, access, and execution.
+
+With Tyk MCP Servers, your AI agents can:
+
+- Access external data sources and APIs
+- Execute specialised tools and functions
+- Interact with system resources
+- Retrieve contextual information
+
+MCPs use a defined protocol to connect AI agents with external systems, expanding AI capabilities while maintaining governance and control.
+
+## Why standardisation matters
+
+The MCP specification standardises how AI agents discover and interact with external capabilities. This helps:
+
+- **Simplify integration** across diverse systems
+- **Enhance security** through consistent architecture
+- **Promote interoperability** with different vendor solutions
+- **Improve governance** when managing AI systems at scale
+
+## MCP for Enterprise use
+<a id="mcp-for-enterprise-use"></a>
+
+Tyk extends the MCP model for enterprise deployments with the following capabilities:
+
+- **Remote MCP catalogues and server support** – Expose internal APIs and tools to AI assistants securely without requiring local installations.
+- **Secure local MCP server deployment** – Deploy MCP servers within controlled environments, integrated with Tyk AI Gateway for monitoring and governance.
+- **Standardised protocols** – Maintain interoperability standards for seamless integration into existing workflows.
+
+These features enable enterprises to scale AI integrations securely while ensuring compliance and operational control.
+
+## Ready-to-use MCP options
+
+Tyk offers several ready-to-use MCP integrations:
+
+- **[API to MCP](/ai-management/mcps/api-to-mcp)** – Convert existing APIs (via OpenAPI/Swagger specs) into MCP-accessible tools.
+- **[Dashboard API to MCP](/ai-management/mcps/dashboard-api-to-mcp)** – Expose the Tyk Dashboard API for management and monitoring.
+- **[Tyk Docs MCP](/ai-management/mcps/tyk-docs-mcp)** – Provide AI access to searchable Tyk documentation.
+
+For more information on implementing MCPs, [contact the Tyk team](https://tyk.io/contact/) do discuss your specific use cases.
diff --git a/ai-management/mcps/tyk-docs-mcp.mdx b/ai-management/mcps/tyk-docs-mcp.mdx
new file mode 100644
index 0000000000..76c4f2162f
--- /dev/null
+++ b/ai-management/mcps/tyk-docs-mcp.mdx
@@ -0,0 +1,93 @@
+---
+title: "Natural-language interaction with Tyk Docs (MCP)"
+description: "Talk to Tyk documentation like a person using AI tools. Use Docs MCP to enable AI assistants to search and retrieve information from Tyk documentation."
+keywords: "AI MCP, Tyk Docs, AI Documentation Search, Talk to Tyk Docs"
+sidebarTitle: "Tyk Docs MCP"
+---
+
+## Overview
+
+Tyk Docs [MCP](https://modelcontextprotocol.io/introduction) exposes the Tyk documentation to AI assistants. Instead of searching manually, users can ask natural-language questions and get answers backed by Tyk docs. The tool makes AI-assisted support, troubleshooting, and documentation exploration fast and reliable.
+
+
+Here you can see the AI assistant chooses to use Tyk Docs MCP (*Cline* in VS Code) while answering the query *How do I set a rate limit for a Tyk API?*:
+
+<img src="/img/ai-mcp/tyk-docs-mcp-q1-screenshot.png" alt="Screenshot of the response to request of AI to create a new user" />
+
+
+<img src="/img/ai-mcp/tyk-docs-mcp-q2-screenshot.png" alt="Screenshot of the response to request of AI to create a new user" />
+
+
+## Key Features
+
+- **Semantic search** — finds the most relevant content, not just keyword matches
+- **Contextual results** — includes sections around your result for better understanding
+- **Product filters** — limit results by product (Gateway, Dashboard, etc.)
+- **Includes links** — jump straight into the relevant section of the docs
+- **Answer snippets** — shows concise answers when possible
+- **Always up to date** — syncs with the latest Tyk documentation
+
+
+## Use Cases
+<a id="use-cases"></a>
+
+Let AI do the digging — here’s how teams use Tyk Docs MCP:
+
+- **First-line support** - *How do I set a rate limit for a Tyk API?*
+  <br />AI can help answer questions about Tyk products, features, and usage cases.
+
+- **Feature implementation help** - *How do I enable JWT authentication in Tyk Gateway?*
+  <br />AI can help developers use Tyk's features by providing ad hoc step-by-step instructions and examples.
+
+- **Troubleshooting guidance** - *I'm seeing 'Auth field missing' error. What does that mean?*
+  <br />AI can help identify issues and provide guidance on how to resolve them.
+
+- **Fast API reference** - *What fields are in the /apis response?*
+  <br />AI can help developers quickly find the information they need to implement Tyk's features.
+
+- **Discover what’s possible** - *What analytics tools does Tyk include?*
+  <br />AI can help developers discover new ways to use Tyk's features and capabilities.
+ 
+
+## Quick Start
+
+To get started, connect your AI assistant to the Tyk Docs MCP server, which is hosted remotely at `https://tyk.io/docs/mcp`.
+
+### Requirements
+- [Node.js v18+](https://nodejs.org/en/download) installed (needed to run `npx`)
+- Internet access to reach `tyk.io`
+- An MCP-compatible AI assistant, such as Claude Code, Claude Desktop, Cursor, VS Code, or Codex
+
+### Configure your AI Assistant
+
+**Step 1.**
+The easiest way to connect is the [`add-mcp`](https://github.com/neon-solutions/add-mcp) CLI. It detects the AI assistants installed on your machine and adds the server to whichever ones you choose:
+
+```bash
+npx add-mcp https://tyk.io/docs/mcp
+```
+
+You can also click **Add MCP** in the menu at the top of any Tyk Docs page to get the same command, pre-filled for that page.
+
+<img src="/img/page-options.png" alt="Mintlify Context Menu Options" />
+
+If your assistant supports remote HTTP MCP servers but isn't detected automatically, add the server to its MCP configuration manually instead:
+
+```json
+{
+  "mcpServers": {
+    "tyk-docs": {
+      "type": "http",
+      "url": "https://tyk.io/docs/mcp"
+    }
+  }
+}
+```
+
+**Step 2.**
+Once connected, ask the AI to perform an operation as suggested in the [use cases above](#use-cases).
+
+
+## How It Works Under the Hood
+
+Tyk Docs MCP is Mintlify's built-in MCP server for the Tyk Documentation site. It indexes the live, published documentation, so results always reflect the current content, with no local package to install or keep up to date. Aside from a `submit_feedback` tool, which lets a connected assistant report a documentation issue such as an incorrect, outdated, or confusing page directly to the Tyk docs team, the server is read-only.
diff --git a/ai-management/overview.mdx b/ai-management/overview.mdx
new file mode 100644
index 0000000000..8332c5835c
--- /dev/null
+++ b/ai-management/overview.mdx
@@ -0,0 +1,102 @@
+---
+title: "AI management"
+description: "An overview of Tyk's AI management solutions, including AI Studio for governance and deployment, and Model Context Protocol (MCP) servers for secure AI integrations."
+keywords: "Tyk AI management, AI Studio, Tyk MCP Servers"
+sidebarTitle: "Overview"
+---
+
+As artificial intelligence becomes increasingly integrated into enterprise systems, organizations need structured, secure, and governed approaches to manage AI capabilities effectively. Tyk's AI management solutions are designed to help enterprises integrate, control, and scale AI applications while maintaining compliance and security.
+
+## Secure AI for the enterprise
+
+Tyk's AI management solutions address key challenges in AI governance, security, and integration. They enable organizations to deploy AI capabilities while maintaining oversight, managing risks, and meeting enterprise standards.
+
+## AI integration architecture and its importance
+
+Integrating AI into existing systems requires a structured architecture that connects models, APIs, and specialised tools securely and efficiently.
+
+A managed AI integration architecture provides:
+
+- **Standardisation** to ensure interoperability across AI components
+- **Security** across AI workflows and data interactions
+- **Governance** to monitor and control AI usage and data
+- **Scalability** for enterprise-wide deployment and increasing complexity
+- **Interoperability** across vendors and services
+
+Without a structured approach, organizations risk fragmented solutions, security gaps, and unmanaged AI usage ("shadow AI"). By integrating AI into existing systems, enterprises can achieve a more secure and efficient approach to AI management.
+
+## Tyk’s AI management capabilities
+
+Tyk provides three key solutions for AI management:
+
+### [AI Studio](/ai-management/ai-studio/overview)
+
+Tyk AI Studio is a platform for managing and deploying AI applications securely and at scale. It provides:
+
+- **Centralised governance** with role-based access control and compliance tracking
+- **Cost management** through usage monitoring and budgeting tools
+- **Security features** including unified access controls and credential management
+- **Developer enablement** via curated AI service catalogues
+- **Collaboration tools** through intuitive AI interfaces
+
+AI Studio supports enterprises in reducing unauthorised AI usage by providing central management across all AI interactions.
+
+[Explore AI Studio](/ai-management/ai-studio/overview)
+
+### [MCP Gateway](/ai-management/mcp-gateway/overview)
+
+Tyk MCP Gateway puts Tyk's API governance layer directly in front of remote MCP servers — from GitHub Copilot and Slack to internal tools built by your own teams. It provides:
+
+- **Authentication and key management** with full OAuth 2.1 compliance, including Protected Resource Metadata discovery so MCP clients can self-configure
+- **Access control** at the individual tool, resource, and prompt level — allowlist exactly which MCP primitives each agent can call
+- **Traffic management** including per-tool rate limiting, timeouts, circuit breakers, and request size limits to protect upstream MCP servers
+- **Unified credential management** — agents authenticate to Tyk once; Tyk handles per-vendor upstream credentials centrally
+- **Observability** with per-tool analytics surfaced alongside the rest of your API traffic in the Tyk Dashboard
+
+MCP Gateway addresses a practical governance gap: as AI agents begin calling remote MCP servers, direct connections bypass every organisational control. Routing through Tyk makes every agent connection managed, auditable, and policy-enforced.
+
+[Explore MCP Gateway](/ai-management/mcp-gateway/overview)
+
+### [Tyk MCP Servers](/ai-management/mcps/overview)
+
+The [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) provides a standardised method for AI components to interact with external resources.
+
+With MCPs, organizations can:
+
+- **Integrate securely** with external AI providers and services
+- **Build custom tools** for AI assistants and workflows
+- **Access resources** such as files, APIs, and databases
+- **Enhance AI workflows** with contextual information
+
+MCPs help expand AI system functionality by enabling secure, standardised interactions between services.
+
+[Explore Tyk MCP Servers](/ai-management/mcps/overview)
+
+### How they work together
+
+Tyk's three AI management capabilities are complementary:
+
+- **AI Studio** offers governance, monitoring, and development tooling for managing AI applications and LLM access.
+- **MCP Gateway** governs AI agent traffic to remote MCP servers — applying authentication, access control, and observability at the gateway layer.
+- **Tyk MCP Servers** provide secure, standardised connections from AI systems to external services and APIs.
+
+Together, they create a flexible, governed framework for managing AI applications and agent traffic at scale.
+
+## Next steps
+
+To start using Tyk's AI management capabilities:
+
+1. Explore the [AI Studio documentation](/ai-management/ai-studio/overview)
+2. Learn how [MCP Gateway](/ai-management/mcp-gateway/overview) governs AI agent traffic to remote MCP servers
+3. Review [Tyk MCP Servers](/ai-management/mcps/overview) and how they extend AI systems
+4. [Request a demo](https://tyk.io/ai-demo/) to see the platform in action.
+
+## Key outcomes
+
+Tyk's AI management solutions are designed to:
+
+- **Reduce risk** through centralised access and monitoring
+- **Improve efficiency** across AI development workflows
+- **Enhance cost control** with usage and budgeting insights
+- **Support compliance** with data protection and security standards
+- **Enable scalable architectures** based on open protocols
diff --git a/api-management/access-control/overview.mdx b/api-management/access-control/overview.mdx
new file mode 100644
index 0000000000..7147b5cee7
--- /dev/null
+++ b/api-management/access-control/overview.mdx
@@ -0,0 +1,92 @@
+---
+title: "Access Control Overview"
+description: "Understand how Tyk manages API access, limits consumption, and scales using Sessions, Keys, and Policies."
+keywords: "Access Control, Sessions, Keys, Policies, Rate Limits, Quotas, Plans, Products"
+sidebarTitle: "Overview"
+---
+
+## Introduction
+
+When managing APIs, one of the most critical tasks is controlling what access your API clients have to your services. You need to ensure that clients can only access the APIs, paths, and HTTP methods they are authorized for, while also enforcing consumption limits like rate limits and quotas to protect your upstream services.
+
+In Tyk, access control is built on three core concepts: **Sessions**, **Keys**, and **Policies**. Understanding how these three elements interact is the key to managing API access securely and at scale.
+
+## The Foundation: Session
+
+At the heart of Tyk's access control is the **Session**. 
+
+Every authenticated client connection in Tyk is represented by a Session, which is typically stored in the Data Plane's Redis database. This object is the ultimate source of truth for a client's current state. It contains:
+- **Access Rights:** Which APIs, versions, paths, and methods the client is allowed to access.
+- **Consumption Limits:** The client's rate limit (requests per second) and quota (requests per month/week/etc.).
+- **Current Usage:** Real-time tracking of how much of their quota they have consumed.
+- **Metadata:** Custom data associated with the client that can be used for routing, transformations, or analytics.
+
+When a request arrives, Tyk evaluates the Session to determine if the request should be allowed through to your upstream service.
+
+## Identifying the Client: Keys and Authentication
+
+If the Session dictates *what* a client can do, how does Tyk know *who* the client is? This is where **Keys** and Authentication come in.
+
+A "Key" is simply the mechanism used to resolve the Session. While Tyk supports many different authentication methods, they all fall into one of three categories based on how the Session is created:
+
+### 1. Pre-Registered Sessions
+
+For most authentication methods, the client must be pre-registered with Tyk. A Session is created and stored in Redis at the time of registration. When a request arrives, Tyk uses the provided credentials as a lookup key to retrieve this existing session.
+
+This category includes:
+- [**Auth Tokens**](/api-management/authentication/bearer-token): The token itself is the lookup key.
+- [**Basic Authentication**](/api-management/authentication/basic-authentication): The username acts as the lookup key.
+- [**HMAC Signatures**](/basic-config-and-security/security/authentication-authorization/hmac-signatures) The Key ID provided in the request is the lookup key.
+- [**Certificate Auth**](/api-management/authentication/certificate-auth) A hash of the client's TLS certificate acts as the lookup key.
+
+### 2. Dynamically Generated Sessions
+
+For [**JWT Auth**](/api-management/authentication/jwt-authorization), Tyk does not require a pre-existing Session in its database prior to the first request. Instead, Tyk validates the token and dynamically generates the Session on the fly based on the token's claims. This Session is then persisted to Redis, with the [identity](/api-management/authentication/jwt-authorization#identifying-the-session-owner) as the lookup key.
+
+Regardless of the authentication method you choose, the end result is always a Session that Tyk uses to enforce access control.
+
+### 3. OAuth 2.0: Client-Delegated Sessions
+
+For [**OAuth 2.0**](/api-management/authentication/oauth-2), the process is a hybrid. You first register an **OAuth Client** and assign it a Policy. When the client successfully completes an OAuth flow (such as Client Credentials or Authorization Code), Tyk dynamically generates an access token and a corresponding Session based on the Client's Policy. This Session is then persisted to Redis, and for subsequent API requests, the access token acts as a standard lookup key.
+
+### Multiple Authentication
+
+When more than one method is required to authenticate the client request, the Session that Gateway should use to determine access rights and to control and track usage is determined according to [these rules](/basic-config-and-security/security/authentication-authorization/multiple-auth#understanding-authentication-modes).
+
+## Managing at Scale: Policies
+
+While you could configure access rights and limits directly on individual Sessions, this becomes unmanageable at scale. If you have 10,000 clients and you want to grant them access to a newly published API, updating 10,000 individual Sessions in Redis is not practical.
+
+This is where **Policies** come in. A Policy is a templated set of rules that defines access rights and consumption limits. 
+
+Instead of writing these rules directly into the Session, the Session simply references a **Policy ID**. When a client makes a request, Tyk loads the Session, sees the Policy ID, and applies the rules defined in that Policy. If you need to update access for all 10,000 clients, you simply update the Policy once, and the changes take effect whenever a Key using that Policy is presented.
+
+### Partitioned Policies vs. Monolithic Policies
+
+Tyk supports two approaches to policies:
+- **Monolithic Policies:** A single policy that defines both access rights and consumption limits.
+- **Partitioned Policies:** Multiple policies applied to a single session, where one policy might define access rights (e.g., "Product A") and another might define consumption limits (e.g., "Gold Plan").
+
+**We strongly encourage the use of Partitioned Policies.** They offer much greater flexibility and reusability. 
+
+If you are using the **Tyk Developer Portal**, you will see this concept in action. The Portal uses the terminology [**Products**](/portal/api-products) (policies that define API access rights) and [**Plans**](/portal/api-plans) (policies that define rate limits and quotas). Under the hood, these are simply partitioned policies working together to control the client's session.
+
+<Note>
+    There is currently a limitation when using the Dashboard UI to configure partitioned policies that an API must be selected even when the **Enforce Access Rights** option is not selected. The policy that is created will not grant access to that API, so any API can be selected.
+</Note>
+
+## Turning Access On and Off
+
+Managing the lifecycle of client access is straightforward with Tyk:
+
+- **Key Revocation:** You can instantly revoke a client's access by deleting their Session from Redis.
+- **Key Expiry:** Sessions can be configured with a Time-To-Live (TTL), after which they automatically expire and are removed.
+- **Policy Disabling:** You can disable a Policy, which will immediately block access for all clients whose sessions rely on that Policy.
+
+## Next Steps
+
+Now that you understand the core concepts, you can dive deeper into how to implement them:
+
+- [Understanding Sessions](/api-management/access-control/sessions-and-keys/understanding-sessions)
+- [Managing Session Lifecycle](/api-management/access-control/sessions-and-keys/session-lifecycle)
+- [Creating and Managing Policies](/api-management/access-control/policies/managing-policies)
\ No newline at end of file
diff --git a/api-management/access-control/policies/applying-policies.mdx b/api-management/access-control/policies/applying-policies.mdx
new file mode 100644
index 0000000000..48ad421422
--- /dev/null
+++ b/api-management/access-control/policies/applying-policies.mdx
@@ -0,0 +1,191 @@
+---
+title: "Applying Policies"
+description: "Learn how Tyk links Policies to Sessions, how they are dynamically applied during a request, and the permitted combinations of different Policy types."
+keywords: "Policies, Apply Policies, Dynamic Application, Partitioned Policies, Monolithic Policies"
+sidebarTitle: "Applying Policies"
+---
+
+## Introduction
+
+Once you have created a Policy, the next step is to apply it to your clients' Sessions. This page explains exactly how Policies are linked to Sessions under the hood, how the Tyk Gateway dynamically applies them during a request, and the rules for combining different types of policies.
+
+## Policy IDs
+
+Policy objects have two separate identifiers:
+
+- **Policy ID (`id`)**: this is the identifier that should be used in all operations via the Gateway API, Dashboard API, in the Session's `apply_policies` array, and in the API definition's scope-to-policy mapping. This can be set by the user (though is not currently manually configurable in the Dashboard UI).
+- **Database ID (`_id`)**: this is the internal reference for the Policy within Tyk Dashboard's database and cannot be modified by the user.
+
+Prior to Tyk Developer Portal v1.17.1 the Portal would incorrectly use `_id`, so the Dashboard API expected this in its Policy management endpoints. From Tyk 5.12.0 onwards there is full support for the `id` across the Tyk Dashboard API and users are recommended to use this exclusively.
+
+To mitigate against the risk of unexpected side effects, from Tyk 5.13.0 onwards the Policy ID can only contain the following characters: `a-z`, `A-Z`, `0-9`, `.`, `_`, `-`, `~`. If you need to bypass this restriction due to existing non-compliant Policy IDs, you can set the `allow_unsafe_policy_ids` configuration flag in your [Gateway](/tyk-oss-gateway/configuration#allow_unsafe_policy_ids) and [Dashboard](/tyk-dashboard/configuration#allow_unsafe_policy_ids) configuration.
+
+## Linking Policies to Sessions
+
+At the data level, a Policy is linked to a Session via the Session object's configuration. 
+
+When you inspect a [Session object](/api-management/access-control/sessions-and-keys/understanding-sessions), you will see two fields related to policies:
+- `apply_policies`: An array of strings containing the IDs of the Policies linked to this Session. This is the recommended way to link one or more policies.
+- `apply_policy_id` *(deprecated)*: A single string that can contain a Policy ID. This is a legacy field from older versions of Tyk that only supported a single Policy per session and is now only provided as a fallback that is checked if the `apply_policies` array is empty.
+
+You can manage the association of Policies with Sessions from various touchpoints depending on your Tyk deployment:
+
+- **Developer Portal:** When [managing access requests](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/approve-requests), Tyk will automatically manage the linking of Policies relating to API Products and Plans to the client's Session. 
+- **Dashboard UI:** When creating or editing a "Key" (Session) in the Dashboard, you can select one or more Policies from the **Apply Policies** dropdown.
+- **Tyk Operator:** Use the `pol_id` from the `SecurityPolicy` CRD's status when creating the Session.
+- **Dashboard API:** When creating or updating a Session via the API, you append the Policy IDs to the `apply_policies` array in the Session object.
+- **Gateway API (Open Source):** When creating or updating a Session via the API, you append the Policy IDs to the `apply_policies` array in the Session object.
+- **OAuth Clients:** When creating an OAuth Client (via the Dashboard or API), you must associate it with a Policy. Whenever Tyk issues an OAuth access token for that client, it dynamically generates a Session based on that Policy and links the token to it.
+
+## Dynamic Application During a Request
+
+A common misconception is that when you link a Policy to a Session, Tyk permanently copies the Policy's rules into the Session object in the database. **This is not the case.**
+
+Instead, Tyk applies Policies **dynamically in memory** during the lifecycle of a request. Here is exactly what happens when a client makes a request:
+
+1. **Session Retrieval:** The Gateway extracts the client's [Key](/api-management/access-control/overview#identifying-the-client-keys-and-authentication) from the request and uses this to retrieve their Session object from the local cache or the Redis database.
+2. **Session Cloning:** The Gateway creates a temporary, in-memory clone of the Session object.
+3. **Policy Lookup:** The Gateway reads the `apply_policies` array from the cloned Session and retrieves the corresponding Policy definitions from its internal store.
+4. **Dynamic Overlay:** The Gateway iterates through the linked Policies and overlays their rules (rate limits, quotas, access rights, etc.) onto the cloned Session object. 
+5. **Request Processing:** The Gateway uses this fully populated, temporary Session object to authorize and rate-limit the current request.
+6. **Session Persistence:** After the request completes, if the client consumes quota, the Gateway updates the quota counters in the temporary Session before it is saved back to Redis to persist the values. See the [Request Quotas](/api-management/request-quotas#how-tyk-implements-quotas) section for more details. (Note: Rate limit counters are tracked in separate Redis keys and do not modify the Session object).
+
+Because this process happens dynamically on every request, any changes you make to a Policy are immediately reflected across all linked Sessions without requiring you to update the Sessions themselves.
+
+### Worked Example: Dynamic Application Flow
+
+Consider a scenario where a user has a base "Standard Tier" Policy and has just purchased a "Premium Reporting Add-on" Policy. Both Policy IDs are stored in their Session's apply_policies array.
+
+```mermaid
+sequenceDiagram
+    participant Client
+    participant Gateway
+    participant Redis as "Redis (Session Store)"
+    participant PolicyStore as Policy Store
+    participant Upstream as Upstream Service
+
+    Client->>Gateway: Request with Auth Token
+    Gateway->>Redis: Fetch Session
+    Redis-->>Gateway: Session {apply_policies: ["standard_tier", "premium_addon"]}
+    Gateway->>Gateway: Clone Session (In-Memory)
+    Gateway->>PolicyStore: Fetch Policies
+    PolicyStore-->>Gateway: Policy Definitions
+    Gateway->>Gateway: Overlay "standard_tier" rules onto Clone
+    Gateway->>Gateway: Overlay "premium_addon" rules onto Clone
+    Gateway->>Gateway: Validate Request against Cloned Session
+    alt Request Allowed
+        Gateway->>Upstream: Request is proxied
+        Upstream->>Gateway: 200 OK
+        Gateway-->>Client: 200 OK
+    else Rate Limit Exceeded
+        Gateway-->>Client: 429 Too Many Requests
+    end
+```
+
+## Applying a Single Policy
+
+When a single Policy is linked to a Session, the Gateway dynamically overlays the Policy's configuration onto the Session during a request. 
+
+**Which fields are updated?**
+A Policy can update or replace the following sections of a Session:
+- **Global Limits:** Rate limits (`rate`, `per`), quotas (`quota_max`, `quota_renewal_rate`), and GraphQL complexity (`max_query_depth`).
+- **Access Rights:** The APIs the client can access, including allowed endpoints, restricted GraphQL types, and granular API-level rate limits and quotas.
+- **Metadata and Tags:** Custom key-value pairs and tags used for analytics.
+- **Security Settings:** HMAC and HTTP Signature validation flags.
+- **Session Lifecycle:** Expiry settings and post-expiry actions.
+
+**What happens to existing Session values?**
+If the Session object already has values configured in fields that are contained in the Policy, the Gateway handles them in three different ways:
+1. **Overwritten:** Global limits (rate, quota, complexity), Access Rights, and Session Lifecycle settings are completely overwritten by the Policy. The Gateway explicitly clears these values from the Session before applying the Policy.
+2. **Merged:** Metadata and Tags are merged. The Policy's tags are appended to the Session's existing tags, and metadata keys are combined.
+3. **Preserved:** If the Policy does not define a specific section (for example, it declares no Access Rights), the Session's original values for that section are preserved.
+
+## Applying Multiple Policies
+
+Tyk allows you to link multiple Policies to a single Session, applying each Policy in turn to result in a final Session state that will be used for the request. This is where the concept of **Partitioned Policies** becomes powerful.
+
+### Partitioned Policies
+
+Instead of creating *monolithic* policies that define everything, you can create partial or *partitioned* policies that only update specific sections of a Session. 
+
+To declare a Policy as partitioned, you configure the `partitions` object within the Policy definition. This object contains boolean flags that explicitly enable specific segments of the Policy:
+
+```json
+{
+    "partitions": {
+        "acl": false,
+        "rate_limit": true,
+        "quota": true,
+        "complexity": false,
+        "per_api": false
+    }
+}
+```
+
+- **ACL (`acl`):** Only applies Access Rights (allowed APIs and endpoints).
+- **Rate Limit (`rate_limit`):** Only applies rate limits and throttling settings.
+- **Quota (`quota`):** Only applies quota maximums and renewal rates.
+- **Complexity (`complexity`):** Only applies GraphQL query depth limits.
+- **Per-API (`per_api`):** A special type of Policy where limits are tracked individually for each API rather than globally.
+
+#### Multiple Partitions on a Single Policy
+
+It is entirely possible (and common) for a single Policy to have **multiple partitions enabled simultaneously**. For example, you could create a Policy with both `rate_limit: true` and `quota: true` to handle all limits, while leaving `acl` disabled so access rights are inherited from elsewhere.
+
+### How Multiple Policies are Merged
+
+When multiple policies update the same section of a Session, Tyk merges them to be the **most permissive**:
+- **Rate Limits:** Tyk calculates the duration between requests (`per / rate`). The Policy that allows the highest request rate (shortest duration between requests) wins.
+- **Quotas and Complexity:** Tyk takes the largest `quota_max`, `quota_renewal_rate`, and `max_query_depth` across all applied policies.
+- **Access Rights (ACLs):** Tyk takes the **union** of all allowed URLs and methods. If Policy A allows `GET /users` and Policy B allows `POST /reports`, the Session can access both.
+- **GraphQL Restrictions:** Tyk takes the **union** of restricted types. A field is restricted if any applied policy restricts it.
+
+<Note>
+    Because `quota_renewal_rate` is the duration in seconds before the quota resets, taking the maximum value results in the most infrequent renewal period so be careful when combining Policies that set different quota limits. The resultant quota parameters may be taken from different policies so the effective quota may not match any of the applied policies.
+</Note>
+
+
+{/* TODO: Diagram — Layered "stack" diagram showing how multiple policies merge into an effective session. Bottom layer: Base Session object. Middle layer: Monolithic Policy ("Standard Tier") applying global rate limits and access rights. Top layers: Multiple Partitioned Policies ("Reporting Add-on", "Premium Support") side-by-side. Arrows show Gateway merging downward to produce "Effective Session". Callouts: "Access Rights: Union (Combined)" and "Rate Limits: Most Permissive (Maximum)". */}
+
+
+### Permitted Combinations
+
+While you can mix and match most policies, the Tyk Gateway enforces strict validation rules to prevent unpredictable behavior. The following table outlines the permitted combinations when applying multiple policies to a single Session:
+
+| Policy Combination | Status | Description |
+| :--- | :--- | :--- |
+| **Multiple Monolithic** | ✅ Allowed | You can apply as many monolithic policies as you need. |
+| **Multiple Partitioned** | ✅ Allowed | You can combine multiple partitioned policies to build modular access tiers. |
+| **Monolithic + Partitioned** | ✅ Allowed | You can apply a base monolithic policy and overlay specific partitioned policies. |
+| **Monolithic + Per-API** | ✅ Allowed | You can apply a base monolithic policy and overlay per-API limits. |
+| **Partitioned + Per-API** | ❌ **Not Allowed** | The Gateway will reject this combination and log an error. You cannot mix standard partitioned policies with `per_api` policies on the same Session. |
+
+**Why is Partitioned + Per-API restricted?**
+
+A `per_api` Policy is intended for the declared limits to be scoped strictly to individual APIs. A standard partitioned Policy (such as a `rate_limit` partition) applies its limits across all APIs that the Session is permitted access to. 
+
+If you were able to mix them, the merging logic would become ambiguous: should the global rate limit partition override the per-API limit, or vice versa? To prevent unpredictable access control and limit enforcement, the Gateway explicitly rejects this combination and will log an error (ErrMixedPartitionAndPerAPIPolicies). Furthermore, a single Policy cannot have both the per_api flag and any other partition flag enabled simultaneously.
+
+
+## Managing Session Lifecycle with Policies
+
+Policies are often used to manage the lifecycle of a Session, including its expiration and active state. These settings are handled **globally**, completely independent of the partition logic. This means that any Policy (monolithic or partitioned) can set session lifecycle rules.
+
+**Validity period (`key_expires_in`)**
+The length of time that the session is considered *valid* (before it "expires") is evaluated **when a session is first created** (for example, via the Gateway API or when dynamically generating a session for a JWT). It is not dynamically overlaid during a request. If multiple policies define a validity period, the Gateway uses the value from the **last Policy** in the `apply_policies` array that has `key_expires_in > 0`. The validity period is added to the current time when the session is created and set as the `expires` timestamp in the Session object in Redis.
+
+**Post-Expiry Actions**
+
+Unlike the expiry time, post-expiry settings (`post_expiry_action` and `post_expiry_grace_period`) are evaluated **dynamically in memory** on every request. If multiple policies define these fields, the **last Policy** in the `apply_policies` array will be used. This allows you to change the retention Policy for expired sessions after creation.
+
+**Temporarily Disabling a Session (is_inactive)**
+
+You can easily [disable a session](/api-management/access-control/sessions-and-keys/session-lifecycle#temporarily-revoking-access-to-a-key) temporarily by linking it to a Policy that has `is_inactive: true`. 
+
+When multiple policies are applied, the Gateway evaluates the `is_inactive` flag dynamically on every request using a **logical OR** operation. If **any** of the linked policies has `is_inactive: true`, the session is immediately treated as inactive and the request will be rejected.
+
+This makes it incredibly easy to implement a "kill switch" Policy. You can create a single monolithic Policy with `is_inactive: true` and simply append its ID to the `apply_policies` array of any session you want to be able to suspend, without modifying other Policies.
+
+<Note>
+If a Session has **any** policies linked to it, the Gateway ignores the Session's own `is_inactive` flag. You cannot disable a session by setting `is_inactive: true` directly on the Session object if it has policies applied; you **must** use a policy to disable it.
+</Note>
\ No newline at end of file
diff --git a/api-management/access-control/policies/managing-policies.mdx b/api-management/access-control/policies/managing-policies.mdx
new file mode 100644
index 0000000000..fcf988c242
--- /dev/null
+++ b/api-management/access-control/policies/managing-policies.mdx
@@ -0,0 +1,104 @@
+---
+title: "Managing Policies"
+description: "Learn how to create, apply, update, and delete Tyk Policies."
+keywords: "Policies, Manage Policies, Create Policy, Apply Policy, Delete Policy"
+sidebarTitle: "Managing Policies"
+---
+
+## Introduction
+
+Once you understand how Policies work and how they are dynamically applied to Sessions, the next step is learning how to manage their lifecycle. This page covers how to create, apply, update, and delete Policies across the Tyk ecosystem.
+
+## Creating Policies
+
+You can create Policies using several different methods depending on your workflow:
+
+- **Dashboard UI:** You can create Policies interactively via the Tyk Dashboard by navigating to **System Management > Policies** and clicking **Add Policy**.
+- **Dashboard API:** You can create a Policy by sending a request to the [`POST /api/portal/policies/`](https://tyk.io/docs/api-reference/policies/create-policy-definition) endpoint with the Policy object as the payload.
+- **Developer Portal:** If you are using the Tyk Developer Portal, you use [API Products](/portal/api-products) to configure access to APIs and [API Plans](/portal/api-plans) to set rate and quota limits. These map onto [partitioned policies](/api-management/access-control/policies/applying-policies#partitioned-policies) within the Dashboard that are then linked to the Session created when access credentials are issued to a [Developer App](/portal/developer-app).
+- **Gateway API (Open Source):** If you are using Tyk Open Source, you can create policies by sending a request to the Gateway's [`POST /tyk/policies/`](https://tyk.io/docs/api-reference/policies/create-a-policy) endpoint, or by adding the Policy to the [Policies file](/api-management/access-control/policies/managing-policies#configuring-tyk-open-source-to-use-file-based-policies).
+
+### Configuring Tyk Open Source to use file-based Policies
+
+When using Tyk Open Source Gateway, you can load Policies via the `POST /tyk/policies/` endpoint, or you can store Policies in a file that Gateway will then load.
+
+For the Gateway to expect file-based Policies you will need to add the `policies` section to your configuration file as follows:
+
+```json
+"policies": {
+  "policy_source": "file",
+  "policy_record_name": "./policies/policies.json"
+},
+```
+
+The `policies.json` file should contain a single JSON object that contains a set of policy objects. The key for each object will be used as the Policy ID.
+
+For example:
+
+```json expandable
+{
+  "default": {
+      "rate": 1000,
+      "per": 1,
+      "quota_max": 100,
+      "quota_renewal_rate": 60,
+      "access_rights": {
+        "41433797848f41a558c1573d3e55a410": {
+          "api_name": "My API",
+          "api_id": "41433797848f41a558c1573d3e55a410",
+          "versions": [
+            "Default"
+          ]
+        }
+      },
+      "org_id": "54de205930c55e15bd000001",
+      "hmac_enabled": false
+  }
+}
+```
+
+In this example we have only defined a single policy called `default`.
+
+## Associating Policies with Client Requests
+
+As explained in detail [here](/api-management/access-control/policies/applying-policies) Policies can be associated with client requests by:
+
+- registering the [Policy ID](/api-management/access-control/policies/applying-policies#policy-ids) with the client Session
+- or, for APIs secured using JWT Authentication, with [**scope-to-policy mapping**](/api-management/authentication/jwt-authorization#identifying-the-tyk-policies-to-be-applied) that will be presented in the JWT's claims.
+- or, for APIs secured using Tyk's OAuth 2.0 Authentication method, with the [client app](/api-management/authentication/oauth-2#manage-client-access-policies)
+
+## Updating Policies
+
+Updating a Policy is straightforward and follows the same methods as creation:
+
+- **Dashboard UI:** Navigate to **System Management > Policies**, select the Policy, and modify its settings.
+- **Dashboard API:** Send a request to `PUT /api/portal/policies/{policy_id}` with the updated Policy object as the payload.
+- **Gateway API (Open Source):** Send a request to `PUT /tyk/policies/{policy_id}` or manually edit the policy file on disk.
+- **Developer Portal:** When you make changes to your API Products and Plans, Tyk will automatically make any necessary adjustments to the underlying Policies.
+
+### How Updates Propagate to Gateways
+
+Because Policies are applied dynamically during a request, any updates you make to a Policy are immediately reflected across all existing Sessions linked to it. You do not need to update the individual Sessions.
+
+However, the mechanism Tyk uses to synchronize the updated Policy to the Gateways depends on your deployment:
+
+- **Single Data Plane:** When you update a Policy, the Dashboard publishes a notification to your Redis cluster. The Gateways instantly receive this notification and perform a "hot reload", pulling the updated Policies directly from the Dashboard's internal API.
+- **Multiple Data Planes:** In distributed deployments, the Data Plane Gateways poll the Control Plane via MDCB. When a Policy is updated, the Control Plane publishes a notification. MDCB receives this and flags a reload. The Data Plane Gateways, which continuously poll MDCB, detect the reload flag, pull the updated Policies from MDCB via RPC, load them into memory, and save a backup to the Data Plane Redis.
+- **Open Source:** If you update a Policy via the Gateway API or by editing files on disk, the Gateway **does not** automatically reload. You must explicitly call the Gateway's `/tyk/reload/` endpoint to force it to read the updated Policies into memory.
+
+## Deleting Policies
+
+You can delete a Policy via the Dashboard UI, the Dashboard API, or the Gateway API (for OSS users).
+
+When you delete a Policy, Tyk removes it from the database (or disk) and notifies all connected Gateways to clear it from their memory. However, **Tyk does not automatically clean up existing Sessions** that have the deleted Policy linked to them. The deleted Policy's ID remains orphaned in their `apply_policies` array.
+
+### Implications of Deletion
+
+The Gateway handles these orphaned Policy IDs dynamically during request processing:
+
+- **Single Policy:** If the deleted Policy was the only Policy linked to a Session, the Gateway will reject all requests for that Session and logs a `key has no valid policies to be applied` error.
+- **Multiple Policies:** If the Session has multiple Policies linked, the Gateway simply ignores the missing Policy (logging a `policy not found` warning) and continues to apply the remaining valid Policies. As long as the remaining Policies grant valid access rights, the request is allowed.
+- **All Policies Missing:** If a Session has multiple Policies and all of them have been deleted, the Gateway rejects the request.
+
+Before deleting a Policy, we strongly recommend identifying and migrating any active Sessions that rely exclusively on it to prevent unintended access disruptions.
+```
\ No newline at end of file
diff --git a/api-management/access-control/sessions-and-keys/access-rights.mdx b/api-management/access-control/sessions-and-keys/access-rights.mdx
new file mode 100644
index 0000000000..77070dbf37
--- /dev/null
+++ b/api-management/access-control/sessions-and-keys/access-rights.mdx
@@ -0,0 +1,94 @@
+---
+title: "Access Rights"
+description: "Learn how to configure granular access rights, allow lists, and API-level limits within a Tyk Session."
+keywords: "Access Rights, Granular Access, Allowed URLs, Allow List, API Limits, Session State"
+sidebarTitle: "Access Rights"
+---
+
+## Introduction
+
+While a Session dictates the overall limits and lifecycle for a client, the `access_rights` map is the engine that drives exactly *what* that client is allowed to do. 
+
+The `access_rights` map links the Session to specific APIs and defines the boundaries of access within those APIs. This includes restricting access to specific endpoints (paths and HTTP methods), and even overriding the global session limits for a particular API.
+
+<Note>
+While you can configure `access_rights` directly on a Session object, it is highly recommended to manage these settings via [Policies](/api-management/access-control/policies/applying-policies) for easier management at scale.
+</Note>
+
+## The Access Rights Map
+
+Under the hood, `access_rights` is a map where the key is the **API ID**, and the value is an **Access Definition** object. 
+
+If an API ID is not present in this map, the Session has absolutely no access to that API. If it is present, Tyk evaluates the rules defined in the Access Definition.
+
+### Basic API Access
+
+At its simplest, an Access Definition grants access to an API identified by its unique ID:
+
+- `api_id`: The internal ID of the API.
+- `api_name`: A human-readable name for the API.
+
+### Granular Endpoint Access
+
+By default, granting access to an API allows the client to access all paths and HTTP methods (endpoints) within that API. You can restrict this using the `allowed_urls` allow list.
+
+- `allowed_urls`: A list of objects that define specific endpoints the client can access. If this list is empty, all endpoints are allowed. If it contains even one entry, Tyk operates in a "default deny" mode, and the request must match an entry in this allow list to proceed.
+
+Each entry in the `allowed_urls` allow list contains:
+- `url`: A regular expression pattern matching the allowed path (e.g., `/users/.*`).
+- `methods`: A list of allowed HTTP methods for that path (e.g., `["GET", "POST"]`).
+
+*Example: Allowing read-only access to the `/users` endpoint:*
+
+```json
+"allowed_urls": [
+  {
+    "url": "/users/.*",
+    "methods": ["GET"]
+  }
+]
+```
+
+### API-Level Limits and Quotas
+
+Sometimes, you want a client to have different rate limits or quotas for different APIs. For example, a client might be allowed 100 requests per second globally, but only 10 requests per second to a computationally expensive "Reports" API.
+
+You can override the Session's **global limits** (the rate limit and quota controls declared at the root of the session object) for a specific API using the `limit` object within the Access Definition.
+
+- `limit`: An object containing rate limit and quota settings that apply *only* to this API. If these fields are set, they take precedence over the global Session limits when the client accesses this specific API:
+    - `rate` and `per`: The API-specific rate limit.
+    - `throttle_interval` and `throttle_retry_limit`: The API-specific throttling configuration.
+    - `quota_max` and `quota_renewal_rate`: The API-specific quota configuration.
+
+### Endpoint-Level Rate Limits
+
+For even finer control, you can define rate limits for specific paths and methods within an API using the `endpoints` list.
+
+- `endpoints`: A list of objects that define rate limits for specific paths.
+    - `path`: The exact path (e.g., `/reports`).
+    - `methods`: A list of methods and their associated limits.
+        - `name`: The HTTP method (e.g., `GET`).
+        - `limit`: The rate limit configuration (`rate` and `per`) for this specific path and method.
+
+### Protocol-Specific Controls
+
+The Access Definition also contains fields for securing specific types of APIs:
+
+**GraphQL**
+- `restricted_types` and `allowed_types`: Controls which GraphQL types the client can query.
+- `field_access_rights`: Granular control over specific fields within GraphQL types.
+- `disable_introspection`: Prevents the client from running introspection queries.
+
+**JSON-RPC and MCP**
+- `json_rpc_methods` and `json_rpc_methods_access_rights`: Controls access to specific JSON-RPC methods.
+- `mcp_primitives` and `mcp_access_rights`: Controls access to specific Model Context Protocol (MCP) primitives.
+
+### Tyk Classic API Controls
+
+If you are using Tyk Classic APIs, you can also restrict access to specific API versions:
+
+- `versions`: A list of strings representing the allowed versions (e.g., ["Default", "v2"]). The client's request must target one of these versions.
+
+<Note>
+This field is ignored for Tyk OAS APIs, which are inherently unversioned from the Session's perspective, as each has its own unique API ID.
+</Note>
\ No newline at end of file
diff --git a/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx b/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx
new file mode 100644
index 0000000000..12de485e61
--- /dev/null
+++ b/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx
@@ -0,0 +1,212 @@
+---
+title: "API Token Generation via Tyk Identity Broker"
+description: "Learn how to use Tyk Identity Broker (TIB) to authenticate users against external identity providers and issue API tokens for API access."
+keywords: "Tyk Identity Broker, TIB, OAuth, API Tokens, LDAP, Social Provider, Authentication, Access Keys"
+sidebarTitle: "Issue Access Tokens via TIB"
+---
+
+## Introduction
+
+[Tyk Identity Broker](/tyk-identity-broker/overview) (TIB) can act as a bridge between external identity providers (such as Okta, GitHub, or Entra ID) and Tyk Gateway to issue API tokens for client applications (such as Single Page Applications or mobile apps). 
+
+<Note>
+This is distinct from using TIB to log into the [Tyk Dashboard](/tyk-identity-broker/dashboard-sso) or [Developer Portal](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+</Note>
+
+Depending on how your API is secured, TIB supports two distinct flows for issuing tokens:
+1. **Standard API Tokens (Auth Tokens)**
+2. **OAuth 2.0 Tokens (Tyk as OAuth Provider)**
+
+## Issuing Standard API Tokens (Auth Tokens)
+
+When your API is secured with standard [Auth Token](/api-management/authentication/bearer-token) authentication you can use TIB to authenticate the user against an identity provider before directly generating a Tyk Session and associated Key (auth token), attaching a specific policy to it.
+
+### Prerequisites
+
+- An API configured to use [Auth Token authentication](/api-management/authentication/bearer-token).
+- A [Tyk policy](/api-management/policies) to attach to generated tokens; this becomes the `MatchedPolicyID`.
+- A [TIB service account](/tyk-identity-broker/dashboard-sso#tib-service-account) - a dedicated Tyk Dashboard user whose API key is used as `DashboardCredential`.
+
+This flow uses the `GenerateTemporaryAuthToken` [action](/tyk-identity-broker/overview#actions) and works with both embedded and [standalone](/tyk-identity-broker/standalone-tib) TIB. It is configured in the TIB profile as follows:
+
+```json expandable
+{
+  "ActionType": "GenerateTemporaryAuthToken",
+  "ID": "{profile-id}",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}",
+    "DisableOneTokenPerAPI": false,
+    "TokenAuth": {
+        "BaseAPIID": "{API-ID-TO-GRANT-ACCESS-TO}",
+        "Expires": 3600
+    }
+  },
+  "MatchedPolicyID": "{POLICY-ID}",
+  "OrgID": "{tyk-org-id}",
+  "ProviderConfig": { ... },
+  "ProviderName": "{provider-name}",
+  "Type": "passthrough"
+}
+```
+
+| Parameter | Required | Description |
+|---|---|---|
+| `ActionType` | Required | Must be `GenerateTemporaryAuthToken`. |
+| `ID` | Required | Unique identifier for this profile. Forms part of the TIB authentication URL; see [Profile](/tyk-identity-broker/overview#profile). |
+| `IdentityHandlerConfig.DashboardCredential` | Required | The [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard API key. Although the token grants access to Tyk Gateway, TIB creates it by calling the Tyk Dashboard API (`POST /api/keys`). |
+| `IdentityHandlerConfig.TokenAuth.BaseAPIID` | Required | The ID of the API to which the generated token grants access. |
+| `IdentityHandlerConfig.TokenAuth.Expires` | Optional | Token expiry in seconds. Defaults to `3600`. |
+| `IdentityHandlerConfig.DisableOneTokenPerAPI` | Optional | Set to `true` to allow multiple active tokens per user. Defaults to `false`. See [Controlling Concurrent Sessions](#controlling-concurrent-sessions). |
+| `MatchedPolicyID` | Required | The ID of the policy to apply to the generated session. |
+| `OrgID` | Required | The Tyk Organisation ID. |
+| `ProviderConfig` | Required | IdP-specific connection settings. See the [Identity Provider guides](/tyk-identity-broker/overview#what-would-you-like-to-do). |
+| `ProviderName` | Required | The authentication method. Can be `SocialProvider`, `ADProvider`, `SAMLProvider`, or `ProxyProvider`. |
+| `Type` | Required | Determined by provider: `redirect` for Social/SAML, `passthrough` for LDAP/Proxy. |
+
+## Issuing OAuth Tokens
+
+When your API is secured with [Tyk's built-in OAuth 2.0 authorization server](/api-management/authentication/oauth-2) you can use TIB as the [identity server](/api-management/authentication/oauth-2#integration-with-identity-server), authenticating the user against an external IdP and then handling the authorization code exchange with Tyk Dashboard on their behalf.
+
+<Note>
+[This flow](/tyk-identity-broker/overview#api-token-generation) requires Tyk Gateway's built-in OAuth 2.0 authorization server. It does not apply if you are using an external OAuth authorization server such as Auth0 or Okta.
+</Note>
+
+
+### Prerequisites
+
+- An API configured to use [Tyk's OAuth 2.0 authentication method](/api-management/authentication/oauth-2#configuring-your-api-proxy).
+- An OAuth client app [registered](/api-management/authentication/oauth-2#client-app-registration) for the target API in Tyk Dashboard.
+- A [TIB service account](/tyk-identity-broker/dashboard-sso#tib-service-account) - a dedicated Tyk Dashboard user whose API key is used as `DashboardCredential`.
+- TIB must be running as a [standalone instance](/tyk-identity-broker/standalone-tib), as this flow requires TIB to communicate directly with Tyk Gateway.
+
+This flow uses the `GenerateOAuthTokenForClient` [action](/tyk-identity-broker/overview#actions). Requests for tokens go via the base API's listen path (`{listen_path}/tyk/oauth/authorize-client/`), so TIB needs to know the listen path and ID of this API to make the correct API calls on your behalf. It is configured in the TIB profile as follows:
+
+```json expandable
+{
+  "ActionType": "GenerateOAuthTokenForClient",
+  "ID": "{profile-id}",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}",
+    "DisableOneTokenPerAPI": false,
+    "OAuth": {
+      "APIListenPath": "{API-LISTEN-PATH}",
+      "BaseAPIID": "{BASE-API-ID}",
+      "ClientId": "{TYK-OAUTH-CLIENT-ID}",
+      "RedirectURI": "http://{APP-DOMAIN}:{PORT}/{AUTH-SUCCESS-PATH}",
+      "ResponseType": "token",
+      "Secret": "{TYK-OAUTH-CLIENT-SECRET}"
+    }
+  },
+  "MatchedPolicyID": "{policy-id}",
+  "OrgID": "{tyk-org-id}",
+  "ProviderConfig": { ... },
+  "ProviderName": "SocialProvider",
+  "Type": "redirect"
+}
+```
+
+| Parameter | Required | Description |
+|---|---|---|
+| `ActionType` | Required | Must be `GenerateOAuthTokenForClient`. |
+| `ID` | Required | Unique identifier for this profile. Forms part of the TIB authentication URL; see [Profile](/tyk-identity-broker/overview#profile). |
+| `IdentityHandlerConfig.DashboardCredential` | Required | The [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard API key, used to invalidate previous tokens on re-authentication. |
+| `IdentityHandlerConfig.DisableOneTokenPerAPI` | Optional | Set to `true` to allow multiple active tokens per user. Defaults to `false`. See [Controlling Concurrent Sessions](#controlling-concurrent-sessions). |
+| `IdentityHandlerConfig.OAuth.APIListenPath` | Required | The listen path of the API; TIB uses this to call the OAuth authorize endpoint (`{listen_path}/tyk/oauth/authorize-client/`). |
+| `IdentityHandlerConfig.OAuth.BaseAPIID` | Required | The ID of the API secured with Tyk's built-in OAuth 2.0 authorization server. |
+| `IdentityHandlerConfig.OAuth.ClientId` | Required | The client ID of the Tyk OAuth client registered for this API. |
+| `IdentityHandlerConfig.OAuth.RedirectURI` | Required | The redirect URI registered for the Tyk OAuth client. The token is returned to the client as a URL fragment at this address. |
+| `IdentityHandlerConfig.OAuth.ResponseType` | Required | `token` or `authorization_code`. Use `token` for SPAs and mobile apps. |
+| `IdentityHandlerConfig.OAuth.Secret` | Required | The client secret of the Tyk OAuth client. |
+| `IdentityHandlerConfig.OAuth.NoRedirect` | Optional | Set to `true` to return the token as JSON in the response body instead of redirecting. Useful for non-browser clients. Defaults to `false`. |
+| `MatchedPolicyID` | Required | The ID of the policy to apply to the generated OAuth token. |
+| `OrgID` | Required | The Tyk Organisation ID. |
+| `ProviderConfig` | Required | IdP-specific connection settings. See the [Identity Provider guides](/tyk-identity-broker/overview#what-would-you-like-to-do). |
+| `ProviderName` | Required | The authentication method. Can be `SocialProvider`, `ADProvider`, `SAMLProvider`, or `ProxyProvider`. |
+| `Type` | Required | Determined by provider: `redirect` for Social/SAML, `passthrough` for LDAP/Proxy. |
+
+## Handling the Token Response
+
+When TIB successfully authorizes the user and generates the token, it delivers it back to the client application as follows:
+
+- **For `redirect` provider types** (such as Social providers or SAML): TIB redirects the user back to the application's `RedirectURI` with the token or auth code appended as a URL fragment (for example, `http://app-domain/callback#access_token=...`). The client app decodes and uses it as needed.
+- **For `passthrough` provider types** (such as LDAP): TIB returns the token directly in the response or redirect, depending on the configuration.
+
+## Controlling Concurrent Sessions
+
+When a user authenticates, TIB checks a Redis cache to see whether a token has already been issued for that user and invalidates it before generating a new one. This means re-authentication automatically revokes the previous token, which is useful if a token is compromised.
+
+Set `"DisableOneTokenPerAPI": true` to skip this check and allow multiple active tokens per user. This is useful when users need concurrent sessions across multiple devices or applications. The trade-off is that old tokens accumulate until they expire via the policy TTL, rather than being revoked on re-authentication.
+
+## Worked Examples
+
+### GitHub (OAuth Token via Social Provider)
+
+The following video demonstrates this flow end-to-end:
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/gqUaDM4aJTw" title="Issuing OAuth 2.0 tokens via Tyk Identity Broker" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+1. Register a GitHub OAuth Application
+
+    - In GitHub, go to **Settings > Developer settings > OAuth Apps** and create a new OAuth app.
+    - Set the **Authorization callback URL** to: `http://{tib-host}/auth/{profile-id}/github/callback`
+    - Note the **Client ID** and **Client Secret**.
+
+2. Register an OAuth Client in Tyk Dashboard
+
+    Before TIB can request a token on the user's behalf, you need an OAuth client registered in Tyk Dashboard for the target API. See [Client App Registration](/api-management/authentication/oauth-2#client-app-registration) for details.
+
+3. IdP-Specific Profile Configuration
+
+    Configure the TIB profile for the [OAuth token flow](#issuing-oauth-tokens) setting `ProviderName` to `SocialProvider` and `Type` to `redirect`. The GitHub-specific settings go in `ProviderConfig`:
+
+```json expandable
+    {
+      "ProviderName": "SocialProvider",
+      "Type": "redirect",
+      "ProviderConfig": {
+        "CallbackBaseURL": "http://{tib-host}",
+        "FailureRedirect": "http://{app-domain}/login?fail=true",
+        "UseProviders": [
+          {
+            "Name": "github",
+            "Key": "{github-client-id}",
+            "Secret": "{github-client-secret}"
+          }
+        ]
+      }
+    }
+```
+
+
+### OAuth Token via LDAP
+
+This example authenticates the user against LDAP before issuing the OAuth token. It is useful for internal APIs that require valid OAuth tokens but where user identity is managed in an LDAP directory such as Active Directory, rather than a web-based IdP.
+
+Because LDAP is a passthrough flow, users submit their credentials via a form `POST` directly to TIB; no browser redirect to an external IdP is involved. See [Login Page](/api-management/single-sign-on-ldap#login-page) for how to create the login form.
+
+1. Register an OAuth Client in Tyk Dashboard
+
+    As with the GitHub example, you need an OAuth client registered in Tyk Dashboard for the target API. See [Client App Registration](/api-management/authentication/oauth-2#client-app-registration) for details.
+
+2. IdP-Specific Profile Configuration
+
+    Configure the TIB profile for the [OAuth token flow](#issuing-oauth-tokens) setting `ProviderName` to `ADProvider` and `Type` to `passthrough`. The LDAP-specific settings go in `ProviderConfig`:
+
+```json expandable
+{
+  "ProviderName": "ADProvider",
+  "Type": "passthrough",
+  "ProviderConfig": {
+    "LDAPServer": "{ldap-server}",
+    "LDAPPort": "389",
+    "LDAPUserDN": "cn=*USERNAME*,dc=example,dc=com",
+    "LDAPAttributes": [],
+    "FailureRedirect": "http://{app-domain}/failure",
+    "GetAuthFromBAHeader": true
+  }
+}
+```
+
+The key difference from the generic template is `Type: "passthrough"` and the LDAP-specific `ProviderConfig`. Set `GetAuthFromBAHeader: true` if your login form submits credentials via HTTP Basic Auth. Set `LDAPUserDN` to match your LDAP directory structure, keeping `*USERNAME*` as a literal placeholder; TIB replaces it with the submitted username at runtime.
+
+See the [LDAP field reference](/api-management/single-sign-on-ldap#tib-profile) for all available `ProviderConfig` options.
diff --git a/api-management/access-control/sessions-and-keys/key-hashing.mdx b/api-management/access-control/sessions-and-keys/key-hashing.mdx
new file mode 100644
index 0000000000..6c1b83647f
--- /dev/null
+++ b/api-management/access-control/sessions-and-keys/key-hashing.mdx
@@ -0,0 +1,117 @@
+---
+title: "Key Hashing"
+description: "Understand how Tyk secures your API keys using hashing, the available algorithms, and the implications for key management."
+keywords: "Key Hashing, Security, Hash Algorithms, Murmur, SHA256, Redis"
+sidebarTitle: "Key Hashing"
+---
+
+## Introduction
+
+When a client authenticates, Tyk uses a specific identifier (the "Key") to look up their Session in the Redis database. Depending on your authentication method, this Key might be an Auth Token, a Basic Auth username, an HMAC Key ID, or a JWT identity claim.
+
+To enhance security and protect these identifiers in the event that your Redis database is compromised, Tyk supports **Key Hashing**. 
+
+When hashing is in use, Tyk never stores the plaintext Key in Redis. Instead, it runs the Key through a one-way hashing function and stores the resulting hash as the lookup key in Redis. When a client makes a request, Tyk extracts their identifier, hashes it on the fly, and compares it to the hash stored in Redis. The [algorithm](/api-management/access-control/sessions-and-keys/key-hashing#hashing-algorithms) used to perform the hashing is configurable, with both cryptographic and non-cryptographic options.
+
+<Note>
+Key Hashing applies universally at the storage layer. If enabled, the lookup identifier for **every** authentication method is hashed.
+</Note>
+
+### Enabling Key Hashing
+
+Hashing is enabled in the [Gateway](/tyk-oss-gateway/configuration#hash_keys) and [Dashboard](/tyk-dashboard/configuration#hash_keys) configuration using the common setting `hash_keys` (or the equivalent environment variables).
+
+<Note>
+This **must** be enabled in both the Gateway and Dashboard (if used).
+</Note>
+
+<Warning>
+Switching between hashed and non-hashed configuration means that any existing keys can no longer be used, as the Gateway and Dashboard will not be able to correctly validate them. Every existing API client will lose access immediately.
+</Warning>
+
+## Hashing Algorithms
+
+Tyk offers several hashing algorithms, allowing you to choose the right balance between performance and security for your environment.
+
+You can configure the algorithm using the [`hash_key_function`](/tyk-oss-gateway/configuration#hash_key_function) setting in your `tyk.conf` (or the equivalent environment variable). The available options are:
+
+- `murmur32` (Default): A fast, non-cryptographic hash function. It provides excellent performance and basic obfuscation, but is not cryptographically secure.
+- `murmur64` and `murmur128`: Longer variants of the Murmur hash, providing a larger hash space to prevent collisions while maintaining high performance. These are also not cryptographically secure.
+- `sha256`: A cryptographically secure hashing algorithm. This provides the highest level of security but is computationally more expensive and will slightly reduce Gateway performance.
+
+<Note>
+For identifiers that are not standard Tyk tokens, such as Basic Auth usernames, Tyk will always use murmur32 for the lookup hash, regardless of this setting.
+</Note>
+
+
+## Implications of Key Hashing
+
+Enabling key hashing fundamentally changes how you interact with keys via the Tyk APIs and Dashboard. Because hashing is a one-way operation, **Tyk cannot reverse the hash to reveal the original key**.
+
+If you enable key hashing, you must design your workflows around the following constraints:
+
+### 1. Plaintext Keys are Returned Only Once
+
+When you create a new key via the Gateway API or the Dashboard, Tyk will return the plaintext key in the response payload **exactly once**. It is your responsibility to securely transmit this key to the client and store it if necessary. If the client loses the key, it cannot be recovered from Tyk; a new key must be generated.
+
+### 2. Listing Keys Returns Hashes
+
+By default, if key hashing is in use, then requests to the [Gateway API](https://tyk.io/docs/api-reference/keys/list-keys) or [Dashboard API](https://tyk.io/docs/api-reference/keys/list-all-the-keys) to retrieve a list of keys will be rejected - this functionality is disabled for security reasons.
+
+You must explicitly enable these endpoints by setting `enable_hashed_keys_listing: true` in the [Gateway](/tyk-oss-gateway/configuration#enable_hashed_keys_listing) and [Dashboard](/tyk-dashboard/configuration#enable_hashed_keys_listing) configurations respectively.
+
+### 3. Analytics Using Hashed Keys
+
+All analytics records, logs, and quota tracking will use the hashed version of the key. If you need to correlate analytics data with a specific client, you should use the Session's `alias` or `meta_data` [fields](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context), rather than relying on the key itself.
+
+### 4. Managing Keys by Hash
+
+If you need to retrieve, update, or delete the Session relating to a specific key, you can always do so using the plaintext key (Tyk will hash it on the fly).
+
+If you want to be able to use the key's hashed value instead, then you must set the appropriate configuration as follows:
+
+- **Gateway API**:
+    - Append the `?hashed=true` query parameter to your API calls when passing a hash instead of a plaintext key.
+- **Dashboard**: 
+    - You must *also* append the `?hashed=true` query parameter to your API calls.
+    - You must explicitly set [`enable_update_key_by_hash: true`](/tyk-dashboard/configuration#enable_update_key_by_hash) and [`enable_delete_key_by_hash: true`](/tyk-dashboard/configuration#enable_delete_key_by_hash) in your tyk_analytics.conf to allow modification of keys via their hash.
+
+
+## Migrating Hashing Algorithms
+
+If you decide to change your `hash_key_function` (for example, upgrading from murmur32 to sha256 for better security), Tyk provides a seamless migration path.
+
+It is of course not possible to convert a one-way hashed key to another hashing algorithm, but you do not need to invalidate all your existing keys. Instead, you can use the [`hash_key_function_fallback array`](/tyk-oss-gateway/configuration#hash_key_function_fallback) in your Gateway configuration. 
+
+When a request arrives, Tyk will first attempt to hash the incoming key using your current hashing algorithm (declared in `hash_key_function`). If the resulting hash is not found in Redis, Tyk will then try hashing the key using the algorithms listed in your fallback array. 
+
+For example, given this configuration in `tyk.conf`:
+
+```json
+"hash_key_function": "sha256",
+"hash_key_function_fallback": ["murmur32"]
+```
+
+In this scenario, all new keys will be hashed using sha256, but existing keys hashed with murmur32 will continue to work perfectly. This gives you the opportunity to gradually retire the older keys as they expire.
+
+## Configuration Summary
+
+To ensure key hashing works correctly, your Gateway and Dashboard configurations must be kept in sync.
+
+**Gateway (`tyk.conf` or equivalent environment variable)**
+
+- `hash_keys`: Set to `true` to enable hashing.
+- `hash_key_function`: The algorithm for standard keys (e.g., `murmur64`, `sha256`).
+- `hash_key_function_fallback`: An array of legacy algorithms to support existing keys during a migration.
+- `enable_hashed_keys_listing`: Set to true to allow the `GET /tyk/keys` endpoint to return hashes.
+
+**Dashboard (`tyk_analytics.conf` or equivalent environment variables)**
+
+- `hash_keys`: Must match the Gateway setting (`true`).
+- `enable_hashed_keys_listing`: Must match the Gateway setting (`true`).
+- `enable_update_key_by_hash`: Set to `true` to allow sessions to be updated using the key hash as reference.
+- `enable_delete_key_by_hash`: Set to `true` to allow sessions to be deleted using the key hash as reference.
+
+<Note>
+The Dashboard calls the Gateway API to obtain the list of keys, so it is important to set `enable_hashed_keys_listing: true` in both components.
+</Note>
\ No newline at end of file
diff --git a/api-management/access-control/sessions-and-keys/session-lifecycle.mdx b/api-management/access-control/sessions-and-keys/session-lifecycle.mdx
new file mode 100644
index 0000000000..4fcd205fbc
--- /dev/null
+++ b/api-management/access-control/sessions-and-keys/session-lifecycle.mdx
@@ -0,0 +1,136 @@
+---
+title: "Session Lifecycle"
+description: "Understand how Tyk manages the lifecycle of Sessions, including expiration, retention, and deletion from Redis."
+keywords: "Session Lifecycle, Session Expiry, Redis TTL, Post Expiry Action, Session Lifetime"
+sidebarTitle: "Session Lifecycle"
+---
+
+## Introduction
+
+When we talk about the "Key Lifecycle" in Tyk, we are actually referring to the lifecycle of the **Session** stored in Redis. The Key is simply the identifier used to look up that Session.
+
+Keeping an expired Session in Redis for a period of time can be useful for various reasons:
+- **Graceful Renewal & Better UX:** Enables the Gateway to return specific `Token Expired` errors rather than generic `Invalid Token` responses, allowing client applications to trigger silent refresh flows without forcing users to log in again.
+- **Audit & Troubleshooting:** Preserves session data post-expiration to aid in compliance and debugging, making it easier to trace requests and correlate logs for issues occurring near the expiration time.
+- **Asynchronous Analytics & Billing:** Ensures background workers can accurately attribute final requests to the correct user or organization, preventing data loss in asynchronous analytics and billing processes.
+- **Quota Preservation Across Renewals:** Retains quota data for users with long-term limits but short-lived access tokens, allowing renewed tokens to link to existing quota buckets without accidentally resetting usage.
+- **Security & Fraud Detection:** Provides context for security systems to monitor replay attacks, identifying if an expired token is suddenly flooded with requests rather than just logging generic errors.
+
+Managing the Session lifecycle is crucial for security (ensuring access is revoked when it should be) and operational efficiency (ensuring your Redis database doesn't fill up with stale data).
+
+## Expiration vs. Deletion
+
+To understand Tyk's lifecycle controls, you must understand the difference between a Session expiring and a Session being deleted:
+
+1. **Expiration (expires)**: This is a Unix timestamp stored inside the Session. When a request arrives, Tyk checks if the current time is past this timestamp. If it is, Tyk rejects the request. The Session is "expired" and access is denied, even if the data still exists in Redis.
+2. **Deletion (Redis TTL)**: This is the physical removal of the Session data from your Redis database. Tyk calculates a Time-To-Live (TTL) and passes it to Redis. When the TTL reaches zero, Redis automatically deletes the data.
+
+The lifecycle controls dictate how Tyk calculates that Redis TTL.
+
+## Preferred Controls (Tyk 5.13.0+)
+
+Starting in Tyk 5.13.0, Tyk introduced explicit controls that separate the concept of expiration from deletion. This allows you to deny access at a specific time, but retain the Session data in Redis for auditing, analytics, or delayed cleanup.
+
+### 1. Set the Expiration
+
+- `expires`: A Unix timestamp indicating exactly when the Session becomes invalid. If set to `0` or `-1`, the Session never expires.
+
+### 2. Define the Post-Expiry Action
+
+- `post_expiry_action`: Defines what happens to the data in Redis after the expires timestamp is reached.
+    - `delete`: The Redis TTL is set to match the `expires` timestamp. The moment the Session expires, Redis physically deletes it.
+    - `retain`: The Session is kept in Redis after it expires. You must also configure a [grace period](/api-management/access-control/sessions-and-keys/session-lifecycle#3-configure-the-grace-period).
+
+### 3. Configure the Grace Period
+
+- `post_expiry_grace_period`: If the action is `retain`, this defines how long (in seconds) the Session is kept in Redis after expiration. 
+    - A value of `-1` means the Session is retained in Redis forever (no TTL is set).
+    - If the value is `0` then the [legacy controls](/api-management/access-control/sessions-and-keys/session-lifecycle#legacy-controls) will be applied to the Session
+
+For example, if `expires` is tomorrow, and `post_expiry_grace_period` is 86400 (24 hours), the Session will be denied access tomorrow, but the Session data will remain in Redis for one additional day before being physically deleted.
+
+## Legacy Controls
+
+If you are using an older version of Tyk (or if you do not configure `post_expiry_action` and `post_expiry_grace_period`), Tyk falls back to the legacy controls.
+
+The Tyk Vendor Extension (`x-tyk-api-gateway`) in the API definition contains an option to set a [`customKeyLifetime`](/api-management/gateway-config-tyk-oas#customkeylifetime) for all keys (Sessions) created that grant access to the API:
+
+```yaml
+x-tyk-api-gateway:
+    authentication:
+        customKeyLifetime:
+            enabled: true,
+            value: 30d,
+            respectValidity: true
+```
+
+| Parameter | Description |
+|:----------|:------------|
+| `enabled` | Set a custom lifetime for Sessions granting access to the API |
+| `value`   | Human readable duration for the custom lifetime (d, m, s) |
+| `respectValidity` | If the custom lifetime is shorter than the Session `expiry` then retain the Session until it expires and then delete |
+
+If the lifetime (`value`) is set to `0s` then sessions will be assigned a TTL of -1 and will not be automatically deleted from Redis.
+
+<Note>
+If `respectValidity` is set to `false` and the `value` is lower than the value assigned for Session `expiry` then the Session will be deleted before it becomes invalid.
+</Note> 
+
+If using Tyk Classic APIs, the equivalent fields are `session_lifetime` (for `value`) and `session_lifetime_respects_key_expiration` (for `respectValidity`). 
+
+
+## Gateway Level Settings
+In some environments, administrators need to enforce a strict maximum lifetime for all sessions across the entire Gateway, regardless of what individual users or policies configure.
+
+You can enforce this behaviour in your `tyk.conf` file (or by using the equivalent environment variables):
+
+- [`global_session_lifetime`](/tyk-oss-gateway/configuration#global_session_lifetime): The maximum allowed lifetime (in seconds) for any Session in Redis. If set to `0` then sessions will be assigned a TTL of -1 and will not be automatically deleted from Redis.
+- [`force_global_session_lifetime`](/tyk-oss-gateway/configuration#force_global_session_lifetime): When set to `true`, the global lifetime will be enforced, taking precedence over all other lifecycle controls (`post_expiry_action`, `customKeyLifetime`, and `expires`). The Redis TTL for every Session will be strictly set to the `global_session_lifetime`.
+- [`session_lifetime_respects_key_expiration`](/tyk-oss-gateway/configuration#session_lifetime_respects_key_expiration): as for the per-API [respect validity](/api-management/access-control/sessions-and-keys/session-lifecycle#legacy-controls) configuration, this will ensure that Sessions are not deleted before they have expired; if this is set to `true` then the per-API setting is ignored.
+
+<Note>
+    If the Global Session Lifetime is enforced, this will be applied to all Sessions, even those with no expiry.
+</Note>
+
+## Summary of Session Lifetime Calculation
+
+With the ongoing support for [legacy controls](/api-management/access-control/sessions-and-keys/session-lifecycle#legacy-controls) it is possible to get confused how best to configure session lifetime to manage your Redis storage. We recommend using the more intuitive post-expiry action and grace period controls.
+
+This table summarises the effect of different combinations of controls.
+
+| `force_global_session_lifetime` | `post_expiry_action` | `post_expiry_grace_period` | `session_lifetime_respects_key_expiration` | Assigned lifetime |
+|:--------:|:--------:|:--------:|:--------:|:---------|
+| `true`   | n/a      | n/a      | n/a      | `global_session_lifetime` |
+| `false`  | `delete` | n/a      | n/a      | `expiry` |
+| `false`  | `retain` | `>0`     | n/a      | `expires+post_expiry_grace_period` |
+| `false`  | `retain` | `-1`     | n/a      | infinite (do not delete) |
+| `false`  | `retain` | `0`      | `true`   | later of `customKeyLifetime.value` or `expires` |
+| `false`  | `retain` | `0`      | `false`  | `customKeyLifetime.value` |
+
+<Warning>
+If using the Legacy Mode and `customKeyLifetime` is set to `0s` (or unset) then sessions will be assigned a TTL of `-1` and will not be automatically deleted from Redis.
+
+Likewise, if using the Global Override, if `global_session_lifetime` is set to `0` (or unset) then sessions will be assigned a TTL of `-1` and will not be automatically deleted from Redis.
+</Warning>
+
+## Temporarily revoking access to a key
+
+If you need to revoke access immediately without waiting for expiration or deletion, you can use the `is_inactive` flag:
+
+- `is_inactive`: A boolean flag on the Session. When set to `true`, Tyk rejects requests using this Session as if it has expired. Setting this back to `false` will reactivate the Session. The Session data remains in Redis until its TTL expires. This is useful for temporarily suspending a user.
+
+## OAuth 2.0 Token Lifecycle
+
+If you are using OAuth 2.0, it is important to understand how OAuth tokens interact with Tyk's session lifecycle controls.
+
+When Tyk generates an OAuth **access token**, it creates a standard Session object. The initial expiration time of this session is controlled by the global [`oauth_token_expire`](/tyk-oss-gateway/configuration#oauth_token_expire) Gateway configuration. Once this timestamp is reached, the access token's session is subject to the standard session lifecycle controls described [above](/api-management/access-control/sessions-and-keys/session-lifecycle#preferred-controls-tyk-5-13-0-), which determine its physical retention in Redis.
+
+Conversely, **refresh tokens** are not Session objects. They do not use these session lifecycle controls and are physically deleted from Redis exactly when their [`oauth_refresh_token_expire`](/tyk-oss-gateway/configuration#oauth_refresh_token_expire) TTL is reached.
+
+<Note>
+**The `oauth_token_expired_retain_period` setting**
+
+You may notice the global Gateway configuration option [`oauth_token_expired_retain_period`](/tyk-oss-gateway/configuration#oauth_token_expired_retain_period). This setting **does not** control the Redis TTL or the retention of the actual Session data. Instead, it controls a background cleanup job that removes expired tokens from an internal tracking list used by the OAuth client.
+</Note>
+
+For more detailed information on configuring OAuth token expiration, see the [OAuth 2.0 Token Expiration and Retention](/api-management/authentication/oauth-2#token-expiration-and-retention) documentation.
\ No newline at end of file
diff --git a/api-management/access-control/sessions-and-keys/session-metadata.mdx b/api-management/access-control/sessions-and-keys/session-metadata.mdx
new file mode 100644
index 0000000000..329e6ed1c3
--- /dev/null
+++ b/api-management/access-control/sessions-and-keys/session-metadata.mdx
@@ -0,0 +1,56 @@
+---
+title: "Session Metadata"
+description: "Understand what session metadata is, how it can be used, and where it can be modified and accessed."
+keywords: "Session, Metadata, Context Variables, Identity Propagation, Dynamic Routing"
+sidebarTitle: "Session Metadata"
+---
+
+## Introduction
+
+While standard Session fields handle access rights, rate limits, and quotas, Tyk also provides a flexible key-value store attached directly to the Session object known as Session Metadata (`meta_data`).
+
+<Note>
+**Key vs. Session**
+
+While Tyk's APIs and UI often refer to adding metadata to a "Key", the metadata is actually stored on the underlying **Session**. The Key is simply the credential or identifier used by the client to look up this Session.
+</Note>
+
+Metadata allows you to store custom, user-specific, or application-specific context. This data persists with the Session and is loaded into memory whenever the Key is used to authenticate a request, making it instantly available during the request lifecycle.
+
+## Use Cases
+
+Metadata is primarily used to make user-specific data available to Tyk middleware when handling a request without requiring additional database lookups. Common use cases include:
+
+- **Identity Propagation:** Storing a `user_id`, `tenant_id`, or `account_id` in the Session metadata and injecting it into upstream headers so your backend service knows exactly who is making the request.
+- **Dynamic Routing:** Using metadata values in [URL Rewrites](/transform-traffic/url-rewriting) to route users to specific backend shards, geographic regions, or pricing tiers.
+- **Custom Plugin Logic:** Passing custom attributes (like user roles, subscription levels, or feature flags) to [custom plugins](/api-management/plugins/overview) to make dynamic authorization or transformation decisions.
+
+## Where it can be modified
+
+Session metadata can be set or updated in several locations:
+
+- **Session creation and update:** You can directly update the `meta_data` field (a JSON object) in the Session object when creating or updating a Session
+    - via the Dashboard API
+    - via the Gateway API
+    - via the Dashboard UI
+- **Applying Policies** Sessions can inherit metadata from [Policies](/api-management/policies).
+- **Dynamic plugins:** Custom plugins (JSVM, Coprocess/gRPC) can dynamically modify the metadata during the request lifecycle. If a plugin modifies the metadata, Tyk automatically saves the updated Session back to the Redis store.
+- **OAuth flow:** When generating an OAuth token, any `meta_data` configured on the OAuth Client is automatically copied into the generated Session's `meta_data`.
+
+## Where it can be accessed
+
+Metadata stored in the Session can be accessed dynamically during the request lifecycle in several ways:
+
+- **Middleware:** Some middleware have access to Session metadata using the `$tyk_meta.KEY_NAME` variable syntax. This is evaluated in the same way as [request context variables](/api-management/traffic-transformation/request-context-variables), with the Gateway replacing this reference with the corresponding value from the Session metadata in the following middleware:
+    - [URL Rewrite](/transform-traffic/url-rewriting#the-rewrite-target)
+    - [Request Header Transform](/api-management/traffic-transformation/request-headers#injecting-dynamic-data-into-headers)
+    - [Response Header Transform](/api-management/traffic-transformation/response-headers#injecting-dynamic-data-into-headers)
+    - [Request Body Transform](/api-management/traffic-transformation/request-body#data-accessible-to-the-middleware)
+    - [Response Body Transform](/api-management/traffic-transformation/response-body#data-accessible-to-the-middleware)
+    - [Rate Limiting](/api-management/rate-limit#how-custom-rate-limiting-works)
+    - [Signed Auth Token](/api-management/authentication/bearer-token#auth-token-with-signature)
+    - GraphQL & Persisted Queries
+- **Go Templates:** In Body Transform and Response Body Transform middleware, if EnableSession is true, metadata is injected into the template context and can be accessed using `{{ ._tyk_meta.KEY_NAME }}`.
+- **JSVM Plugins & Virtual Endpoints:** The session object is passed as a JSON argument to your JavaScript functions. Metadata is accessible via session.meta_data.
+- **Custom Go Plugins:** Go plugins can extract the session state from the request context (post-authentication) and directly read from or write to the MetaData map.
+- **Coprocess Plugins (gRPC, Python, etc.):** The session object is passed within the Coprocess request object, and metadata is accessible via Session.Metadata.
diff --git a/api-management/access-control/sessions-and-keys/understanding-sessions.mdx b/api-management/access-control/sessions-and-keys/understanding-sessions.mdx
new file mode 100644
index 0000000000..a9a2c7f246
--- /dev/null
+++ b/api-management/access-control/sessions-and-keys/understanding-sessions.mdx
@@ -0,0 +1,126 @@
+---
+title: "Understanding Sessions"
+description: "Understand the Tyk Session, its purpose, and how it controls API access, limits, and client metadata."
+keywords: "Session, Access Rights, Quotas, Rate Limits, Metadata, Session Lifecycle"
+sidebarTitle: "Understanding Sessions"
+---
+
+## Introduction
+
+A **Session** is the core concept Tyk uses to manage client access. Whenever a client makes a request to a protected API, Tyk resolves their authentication credentials (the "Key") into a Session.
+
+This Session acts as the ultimate source of truth for that specific client's connection, dictating what they can access, how much they can consume, and carrying any custom metadata associated with them.
+
+## Purpose and Usage
+
+The primary purposes of a Session are:
+1. **Access Control:** Defining exactly which APIs, versions, and paths the client is authorized to access.
+2. **Traffic Management**: Enforcing session-level rate limits (requests per second) to prevent individual "noisy neighbor" clients from monopolizing resources, which complements your global [API-level protections](/api-management/rate-limit#api-level-rate-limiting).
+3. **Tiered Access (Service Plans)**: Enforcing quotas (requests over a longer period) and custom rate limits to offer different levels of service to your clients (e.g., Free vs. Paid tiers) and support API monetization.
+4. **State Tracking:** Keeping track of real-time quota usage and session expiration.
+5. **Context Propagation:** Storing custom metadata and tags that can be injected into headers, used for routing, or sent to analytics.
+
+When a request arrives, Tyk retrieves the Session and evaluates its fields to determine if the request should be allowed, throttled, or rejected. All Sessions are stored in your Tyk Data Plane's Redis database, ensuring that rate limits and quotas are tracked accurately across all your Gateway nodes.
+
+## Configuration Options
+
+A Session contains several categories of configuration options. While you can configure these directly on individual sessions, it is highly recommended to manage them via [**Policies**](/api-management/policies).
+
+### Access Control
+
+This field determines what the client is allowed to access:
+
+- `access_rights`: A map defining the specific APIs the client can access. The key is the API ID, and the value contains detailed [access control](/api-management/access-control/sessions-and-keys/access-rights) rules, such as granular path/method restrictions.
+
+### Rate Limits
+
+Rate limits control the velocity of requests (e.g., 10 requests per second):
+
+- `rate`: The number of requests allowed.
+- `per`: The time window in seconds for the rate limit.
+- `throttle_interval`: The time in seconds to [hold requests before retrying](/api-management/request-throttling) if the client exceeds the rate limit.
+- `throttle_retry_limit`: The number of times a throttled request will be retried before being rejected with an `HTTP 429` response.
+- `smoothing`: Configuration for [rate limit smoothing](/api-management/rate-limit#rate-limit-smoothing) (dynamic adjustment of rate limits to mitigate against traffic spikes).
+
+These settings will be applied to all requests made using the Session except where [API](/api-management/access-control/sessions-and-keys/access-rights#api-level-limits-and-quotas) or [endpoint-level](/api-management/access-control/sessions-and-keys/access-rights#endpoint-level-rate-limits) limits have been configured in the access rights.
+
+### Quotas
+
+Quotas control the total volume of requests over a longer period (e.g., 1000 requests per month):
+
+- `quota_max`: The maximum number of requests allowed in the quota period.
+- `quota_renewal_rate`: The time in seconds between quota resets (e.g., 2592000 for 30 days).
+
+The real-time status of the session's quota is tracked in these system-managed state fields:
+
+- `quota_renews`: A Unix timestamp indicating when the quota will reset.
+- `quota_remaining`: The number of requests left in the current quota.
+
+These settings will be applied to all requests made using the Session except where [API-level quotas](/api-management/access-control/sessions-and-keys/access-rights#api-level-limits-and-quotas) have been configured in the access rights.
+
+### Authentication Data
+
+Depending on the authentication method used, the Session may store credentials or validation data:
+
+- `basic_auth_data`: An object containing the `password` and `hash` type (e.g., bcrypt) used for Basic Authentication.
+- `certificate`: The hash of the client's TLS certificate used for Certificate Auth.
+- `hmac_enabled` and `hmac_string`: Flags and secrets used to validate HMAC signatures.
+- `enable_http_signature_validation`: A boolean flag to enable HTTP Signature validation for this specific session.
+- `rsa_certificate_id`: The ID of the RSA certificate (stored in Tyk Certificate Store) used to validate HTTP Signatures when `enable_http_signature_validation` is enabled.
+- `jwt_data`: An object containing the `secret` used to validate JWT signatures.
+- `oauth_client_id` and `oauth_keys`: When a Session is generated via an OAuth flow, Tyk stores the ID of the originating OAuth Client here. This links the dynamically generated Session back to the client application that requested it.
+- `mtls_static_certificate_bindings`: A list of static certificate signatures bound to this session, used when static mTLS is layered on top of another authentication method.
+
+### GraphQL Complexity Limit
+
+If the session grants access to a GraphQL API, you can enforce specific security limits:
+
+- `max_query_depth`: The maximum allowed depth for GraphQL queries, preventing deeply nested queries from overloading your upstream services.
+
+### Analytics & Monitoring
+
+These fields control how Tyk tracks and reports on this specific session:
+
+- `enable_detailed_recording`: A boolean flag to enable detailed analytics recording specifically for this session. When enabled, Tyk logs the raw HTTP request and response payloads.
+- `monitor`: Configuration for the [quota monitor](/api-management/gateway-events#monitoring-quota-consumption), which Tyk uses to fire webhook events when a session's quota usage reaches those specific thresholds.
+
+### Metadata and Context
+
+These fields store custom information about the client:
+
+- `meta_data`: A key-value map for storing custom data. This data can be injected into headers sent to your upstream API or used in transform middleware. For more details see the [session metadata](/api-management/access-control/sessions-and-keys/session-metadata) section.
+- `tags`: A list of strings used to categorize the session (often used for analytics filtering).
+- `alias`: A human-readable name or identifier for the session.
+
+### Session Lifecycle
+
+<Note>
+While Tyk's APIs and UI often refer to "Key Expiry", it is actually the Session that has a lifecycle. The Key is just the identifier used to look up the session.
+</Note>
+
+These fields control how long the session remains valid and when it is permanently deleted from Redis. 
+
+- `expires`: A Unix timestamp indicating when the session will become invalid (expire). If set to `0` or `-1`, the session never expires.
+- `is_inactive`: A boolean flag to temporarily disable the session without deleting it.
+
+**Preferred Controls (Tyk 5.13.0+)**
+Starting in Tyk 5.13.0, you can explicitly control what happens to a session *after* it expires using these fields:
+- `post_expiry_action`: Defines the behavior when the session expires. Can be set to `retain` or `delete`.
+- `post_expiry_grace_period`: If the action is `retain`, this is the time (in seconds) the session is kept in Redis after expiration before being deleted. A value of `-1` means retain forever.
+
+**Legacy Controls**
+If you are using an older version of Tyk, or if you do not configure the preferred controls above, Tyk falls back to the legacy lifetime settings:
+- `session_lifetime`: The maximum duration (in seconds) the session is allowed to exist in Redis, regardless of its `expires` value.
+
+## Policies
+
+Instead of configuring access rights and limits directly on the session, you can link the session to one or more [Policies](/api-management/policies). This is the recommended approach for managing access at scale.
+
+- `apply_policies`: A list of policy IDs to apply to this session. Where multiple policies are listed, they will be combined (e.g., a "Plan" policy for rate limits and a "Product" policy for access rights). Fields set from a Policy will override any configured directly in the Session.
+
+
+## Next Steps
+
+- Learn how to manage the [Session Lifecycle](/api-management/access-control/sessions-and-keys/session-lifecycle) to control how long a key will be valid.
+- Discover how to use [Policies](/api-management/policies) to manage Sessions at scale.
+```
\ No newline at end of file
diff --git a/api-management/air-gapped-deployment.mdx b/api-management/air-gapped-deployment.mdx
new file mode 100644
index 0000000000..b9b7ac981c
--- /dev/null
+++ b/api-management/air-gapped-deployment.mdx
@@ -0,0 +1,184 @@
+---
+title: "How to install Tyk in Air-Gapped Deployments"
+description: "Learn how to deploy Tyk in air-gapped or network-restricted environments using private container registries and local package mirrors"
+sidebarTitle: "Air-Gapped Deployments"
+---
+
+## Overview
+
+In some environments, direct access to public container registries and package repositories is restricted. This guide provides instructions for deploying Tyk in such air-gapped or network-restricted environments.
+
+There are two main deployment scenarios covered:
+
+- **Kubernetes (Helm)** — Mirroring container images and packaging Helm charts for offline installation.
+- **Bare Metal / VMs (Linux packages)** — Creating a local mirror of Tyk's PackageCloud repositories for `apt` or `yum` based installations.
+
+## Kubernetes: Image Mirroring and Helm Chart Packaging
+
+### Step 1: Identify Required Container Images
+
+Use `helm template` on an internet-connected machine to extract all container images referenced by the Tyk chart you plan to deploy.
+
+First, add the Tyk Helm repository:
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+```
+
+Then render the chart templates and extract the image references. The example below uses `tyk-stack` (Tyk Self-Managed). Replace it with the chart that matches your deployment (e.g. `tyk-oss`, `tyk-data-plane`, `tyk-control-plane`):
+
+```bash
+helm template tyk tyk-helm/tyk-stack | yq e '..|.image? | select(.)' - | sort -u
+```
+
+<Note>
+Enable optional components with `--set` flags so their images are included in the output. For example, add `--set global.components.devPortal=true` for the Developer Portal or `--set global.components.operator=true` for the Tyk Operator.
+</Note>
+
+Typical output includes images such as:
+
+```text
+busybox:1.32
+curlimages/curl:8.8.0
+tykio/portal:v1.16.0
+tykio/tyk-dashboard:v5.8.9
+tykio/tyk-gateway-ee:v5.8.9
+tykio/tyk-k8s-bootstrap-post:v2.2.0
+tykio/tyk-k8s-bootstrap-pre-delete:v2.2.0
+tykio/tyk-k8s-bootstrap-pre-install:v2.2.0
+tykio/tyk-operator:v1.2.0
+tykio/tyk-pump-docker-pub:v1.12.0
+zalbiraw/alpine-curl-jq
+```
+
+### Step 2: Pull, Re-tag, and Push Images to Your Private Registry
+
+On an internet-connected machine, pull each image, re-tag it for your private registry, and push it:
+
+```bash
+PRIVATE_REGISTRY="my-private-registry.com"
+
+# Example for the Gateway image
+docker pull docker.tyk.io/tyk-gateway/tyk-gateway:v5.8
+docker tag  docker.tyk.io/tyk-gateway/tyk-gateway:v5.8 ${PRIVATE_REGISTRY}/tyk-gateway/tyk-gateway:v5.8
+docker push ${PRIVATE_REGISTRY}/tyk-gateway/tyk-gateway:v5.8
+```
+
+Alternatively, you can use `docker save` and `docker load` to transfer images via archive files if your air-gapped environment does not have a private registry:
+
+```bash
+# Save all images to a tar archive on the connected machine
+docker save -o tyk-images.tar \
+  docker.tyk.io/tyk-gateway/tyk-gateway:v5.8 \
+  tykio/tyk-dashboard:v5.8 \
+  docker.tyk.io/tyk-pump/tyk-pump:v1.13
+
+# Transfer tyk-images.tar to the air-gapped environment, then load
+docker load -i tyk-images.tar
+```
+
+### Step 3: Package Helm Charts for Offline Use
+
+On the internet-connected machine, pull and package the chart as a `.tgz` archive:
+
+```bash
+# Pull the chart archive
+helm pull tyk-helm/tyk-stack --version <chart-version>
+
+# This creates a file like tyk-stack-<chart-version>.tgz in the current directory
+```
+
+Transfer the `.tgz` file to the air-gapped environment. You can then install directly from the archive:
+
+```bash
+helm install tyk ./tyk-stack-<chart-version>.tgz -f values.yaml
+```
+
+### Step 4: Configure Helm Charts to Use the Private Registry
+
+Set `global.imageRegistry` in your `values.yaml` to point all image pulls at your private registry:
+
+```yaml
+global:
+  imageRegistry: "my-private-registry.com/"
+```
+
+This prefix is prepended to every image repository defined in the chart, so all components (Gateway, Dashboard, Pump, bootstrap jobs, etc.) will pull from your private registry.
+
+If your private registry requires authentication, create an image pull secret and reference it:
+
+```bash
+kubectl create secret docker-registry tyk-registry-secret \
+  --docker-server=my-private-registry.com \
+  --docker-username=<user> \
+  --docker-password=<password> \
+  -n tyk
+```
+
+Then in your `values.yaml`:
+
+```yaml
+global:
+  imageRegistry: "my-private-registry.com/"
+  imagePullSecrets:
+    - name: tyk-registry-secret
+```
+
+### Alternative: Container Runtime (CRI) Mirror Configuration
+
+Instead of changing Helm values, you can configure your container runtime (Docker, containerd, CRI-O) to transparently redirect pull requests from public registries to your private registry. This is done at the Kubernetes node level and avoids any changes to your Helm configuration.
+
+Refer to your container runtime's documentation for mirror configuration instructions.
+
+## Bare Metal / VMs: Linux Package Mirror
+
+For installations on bare metal servers or VMs that use Linux packages (`deb` or `rpm`), you can create a local mirror of the Tyk repositories hosted on [PackageCloud](https://packagecloud.io/tyk/).
+
+### Required Tyk Packages
+
+A standard Tyk Self-Managed deployment requires these packages:
+
+| Package | Description |
+| :--- | :--- |
+| `tyk-gateway` | API Gateway |
+| `tyk-dashboard` | Management Dashboard |
+| `tyk-pump` | Analytics Pump |
+
+Optional packages depending on your deployment:
+
+| Package | Description |
+| :--- | :--- |
+| `tyk-identity-broker` | SSO / Identity Broker |
+| `tyk-sync` | Git-based API definition sync |
+| `tyk-mdcb` | Multi Data Center Bridge (from `tyk-mdcb-stable` repo) |
+
+### Option A: Mirroring Repositories
+
+Use a tool like `debmirror` (Debian/Ubuntu) or `reposync` (RHEL/CentOS) to create a local mirror of the Tyk repositories from PackageCloud. This allows you to maintain an up-to-date mirror that can be easily accessed by multiple machines in the air-gapped environment. 
+
+### Option B: Direct Package Download
+
+If mirroring the full repository is not practical, you can download individual `.deb` or `.rpm` packages directly from PackageCloud and transfer them manually.
+
+<Tabs>
+  <Tab title="Debian / Ubuntu">
+  ```bash
+  # On the connected machine, download the .deb files
+  # Visit https://packagecloud.io/tyk/tyk-gateway to find package URLs, or use:
+  apt-get download tyk-gateway tyk-dashboard tyk-pump
+
+  # Transfer the .deb files, then install on the air-gapped machine
+  sudo dpkg -i tyk-gateway_*.deb tyk-dashboard_*.deb tyk-pump_*.deb
+  ```
+  </Tab>
+  <Tab title="RHEL / CentOS">
+  ```bash
+  # On the connected machine, download the .rpm files
+  yumdownloader tyk-gateway tyk-dashboard tyk-pump
+
+  # Transfer the .rpm files, then install on the air-gapped machine
+  sudo rpm -ivh tyk-gateway-*.rpm tyk-dashboard-*.rpm tyk-pump-*.rpm
+  ```
+  </Tab>
+</Tabs>
diff --git a/api-management/api-sharding.mdx b/api-management/api-sharding.mdx
new file mode 100644
index 0000000000..09cb62f536
--- /dev/null
+++ b/api-management/api-sharding.mdx
@@ -0,0 +1,145 @@
+---
+title: "Gateway and API Sharding"
+description: "Learn how to segment a Tyk cluster into zones using node and segment tags, so that specific Gateways selectively load specific APIs"
+keywords: "API Sharding, Gateway Sharding, Segmentation, Node Tags, Segment Tags, Zones, Multi Data Center, GDPR, DMZ"
+sidebarTitle: "Gateway & API Sharding"
+---
+
+## What is API Sharding ?
+
+It is possible to use tags in various Tyk objects to change the behavior of a Tyk cluster or to modify the data that is sent to the analytics engine. Tags are free-form strings that can be embedded in Gateway configurations, API definitions, Policies and Individual Keys.
+
+Tags are used in two ways: To segment a cluster into various "zones" of API management, and secondly, to push more data into the analytics records to make reporting and tracking easier.
+
+### API Sharding
+
+API Sharding is what we are calling our approach to segmenting a Tyk cluster (or data centers) into different zones. An example of this in action would be to imagine you have separate VPCs that deal with different classes of services, lets say: Health, Banking and Pharma.
+
+You don't need the nodes that handle all the traffic for your Pharma APIs to load up the definitions for the other zones' services, this could allow someone to send unexpected traffic through (it may not go anywhere).
+
+Alternatively, you could use segmentation to have separate API definitions for multiple data centers. In this way you could shard your API definitions across those DC's and not worry about having to reconfigure them if there is a failover event.
+
+### Using Sharding to handle API life-cycle with multiple data centers
+
+You can use sharding to very quickly publish an API from a `development` system to `staging` or `live`, simply by changing the tags that are applied to an API definition.
+
+With Tyk Community Edition and Tyk Pro, these clusters must all share the same Redis DB.
+
+If you are an Enterprise user, then you can go a step further and use the [Tyk Multi Data Center Bridge](/api-management/mdcb#managing-geographically-distributed-gateways-to-minimize-latency-and-protect-data-sovereignty) to have full multi-DC, multi-zone cluster segmentation, and manage APIs in different segments across different database back-ends.
+
+### Analytics and Reporting
+
+In order to use tags in analytics, there are two places where you can add a `"tags":[]` section: a Policy Definition, and a Session object for a token.
+
+Policy tags completely replace key tags, these tags are then fed into the analytics system and can be filtered in the dashboard.
+
+### Node Tags
+
+If your API is segmented, node tags will be appended to the analytics data, this will allow you to filter out all traffic going through a specific node or node cluster.
+
+
+<Note>
+If you set `use_db_app_options.node_is_segmented` to `true` for multiple gateway nodes, you should ensure that `management_node` is set to `false`. This is to ensure visibility for the management node across all APIs.
+</Note>
+
+
+
+`management_node` is available from v2.3.4 and onwards.
+
+See [Tyk Gateway Configuration Options](/tyk-oss-gateway/configuration) for more details on node tags.
+
+
+## Gateway Sharding
+
+With Tyk, it is easy to enable a sharded configuration, you can deploy Gateways which selectively load APIs.  This unlocks abilities to run Gateways in multiple zones, all connected to the same Control Plane.  This allows for GDPR deployments, development/test Gateways, or even DMZ/NON-DMZ Gateways.
+
+Couple this functionality with the Tyk [Multi Data Center Bridge](/api-management/mdcb#managing-geographically-distributed-gateways-to-minimize-latency-and-protect-data-sovereignty) to achieve a global, multi-cloud deployment.
+
+### Configure a Gateway as a shard
+
+Setting up a Gateway to be a shard, or a zone, is very easy. All you do is tell the node in the tyk.conf file what tags to respect and that it is segmented:
+
+```{.copyWrapper}
+...
+"db_app_conf_options": {
+  "node_is_segmented": true,
+  "tags": ["qa", "uat"]
+},
+	...
+```
+
+Tags are always treated as OR conditions, so this node will pick up all APIs that are marked as `qa` or `uat`.
+
+
+
+
+<Note>
+In order to expose more details about the Gateway to the Dashboard, you can now configure the [edge_endpoints](/tyk-dashboard/configuration#edge_endpoints) section in the tyk-analytics.conf, and the Dashboard UI will pick that up and present you a list of Gateways you can chose from when creating an API.
+</Note>
+
+### Tag an API for a shard using the Dashboard
+
+From the API Designer, select the **Advanced Options** tab:
+
+<img src="/img/2.10/advanced_options_designer.png" alt="Advanced options tab" />
+
+Scroll down to the **Segment Tags** options:
+
+<img src="/img/2.10/segment_tags.png" alt="Segment tags section" />
+
+Set the tag name you want to apply, and click **Add**.
+
+When you save the API, the tags will become immediately active. If any Gateways are configured to only load tagged API Definitions then this configuration will only be loaded by the relevant Gateway.
+
+### Tag an API for a shard using Tyk Operator
+
+Add the tag names to the tags mapping field within an API Definition as shown in the example below:
+
+```yaml {linenos=table,hl_lines=["8-9"],linenostart=1}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  tags:
+    - edge
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+
+### Exposed Gateway tags to Dashboard UI
+
+From version 3.2.2 of the Tyk Dashboard, if [edge_endpoints](/tyk-dashboard/configuration#edge_endpoints) are being configured in tyk-analytics.conf, your Dashboard will automatically pick that list up for you, and display it in the UI when you create your API.
+
+<img src="/img/dashboard/system-management/list-gateways.png" alt="List of available Gateways" />
+
+Once you select one or more Gateways, the *Segment Tags* section will be automatically prefilled with the tag values from the `edge_endpoints` configuration.
+
+<img src="/img/dashboard/system-management/list-segment-tags.png" alt="List of segment tags" />
+
+Also, for every Gateway selected, there will be an API URL presented at the top of the page, within the *Core Settings* tab.
+
+<img src="/img/dashboard/system-management/list-api-urls.png" alt="List of API URLs" />
+
+### Target an API Definition via JSON
+
+In your API definition, add a tags section to the root of the API Definition:
+
+```{.copyWrapper}
+"tags": ["private-gw"]
+```
+
+This will also set the tags for the API and when API requests are made through this Gateway, these tags will be transferred in to the analytics data set.
+
+### API Tagging with On-Premises
+
+API Sharding with Self-Managed is very flexible, but it behaves a little differently to sharding with Tyk Cloud Hybrid & Tyk Global Self-Managed deployments. The key difference is that with the latter, you can have federated Gateway deployments with **their own redis databases**.  However with Tyk Self-Managed the zoning is limited to tags only, and must share a single Redis database.
+
+To isolate Self-Managed Gateway installations across data centers you will need to use Tyk Multi Data Center Bridge component. This system powers the functionality of Tyk Cloud & Tyk Cloud Hybrid in our cloud and is available to our enterprise customers as an add-on.
diff --git a/api-management/api-versioning.mdx b/api-management/api-versioning.mdx
new file mode 100644
index 0000000000..d051694dab
--- /dev/null
+++ b/api-management/api-versioning.mdx
@@ -0,0 +1,739 @@
+---
+title: "API Versioning"
+description: "Learn how to create and manage multiple versions of an API in Tyk"
+keywords: "API versioning, version, Tyk Classic, Tyk OAS, API, versioning"
+sidebarTitle: "API Versioning"
+---
+
+## Introduction
+
+API versioning is a crucial practice in API development and management that allows you to evolve your API over time while maintaining backward compatibility for existing clients. As your API grows and changes, versioning provides a structured way to introduce new features, modify existing functionality, or deprecate outdated elements without breaking integrations for users who rely on previous versions.
+
+API versioning is important for several reasons:
+- **Flexibility**: It allows you to improve and expand your API without disrupting existing users.
+- **Stability**: Clients can continue using a specific version of the API, ensuring their applications remain functional.
+- **Transition management**: You can gradually phase out older versions while giving clients time to migrate to newer ones.
+- **Documentation**: Each version can have its own documentation, making it easier for developers to understand the specific capabilities and limitations of the version they're using.
+
+---
+
+## When to use API versioning
+
+There are many occasions when you might use versioning with your APIs, here are just a few examples.
+
+### Adding new features
+
+Imagine you're running an e-commerce API, and you want to introduce a new recommendation engine. Instead of modifying the existing endpoint and potentially breaking current integrations, you could create a new version of the API that includes this feature. This allows you to roll out the enhancement to interested clients while others continue using the previous version without disruption.
+
+### Changing response formats
+
+Let's say you have a weather API that currently returns temperatures in Fahrenheit. You decide to switch to Celsius for international standardization. By creating a new API version with this change, you can transition to the new format without affecting existing users who expect Fahrenheit readings. This gives clients time to adapt their applications to handle the new response format.
+
+### Deprecating outdated functionality
+
+If your financial API includes a legacy payment processing method that you plan to phase out, versioning allows you to create a new version without this feature. You can then encourage users to migrate to the new version over time, eventually deprecating the old version containing the outdated functionality.
+
+### Optimizing performance
+
+You might discover a more efficient way to structure your API requests and responses. By introducing these optimizations in a new version, you can offer improved performance to clients who are ready to upgrade, while maintaining the existing version for those who aren't prepared to make changes yet.
+
+## Sunsetting API versions
+
+API sunsetting is the process of phasing out or retiring an older version of an API or an entire API. It's a planned, gradual approach to ending support for an API or API version. To aid with the automation of this process, all Tyk API versions can be configured with an optional expiry date `expiration` (`expires` for Tyk Classic APIs), after which the API will no longer be available. If this is left blank then the API version will never expire. This is configured in standard ISO 8601 format.
+
+When sunsetting API versions, you may have endpoints that become deprecated between versions. It can be more user friendly to retain those endpoints but return a helpful error, instead of just returning `HTTP 404 Not Found`.
+
+This is easy to do with Tyk. You could, for example, include the deprecated endpoint in the new version of the API and configure the [mock response](/api-management/traffic-transformation/mock-response#mock-response) middleware to provide your clients with relevant information and instruction. Alternatively, you could return a `HTTP 302 Found` header and redirect the user to the new endpoint.
+
+---
+
+## How API versioning works with Tyk
+
+API versioning is supported for all APIs that can be deployed on Tyk, both Tyk OAS APIs (for REST and Streaming services) and Tyk Classic APIs (used for GraphQL and TCP services). There are differences in the approach and options available when using the two API formats:
+
+- With Tyk OAS APIs you're essentially creating distinct iterations of your API, each with its own API definition file, allowing almost complete differentiation of configuration between your API versions.
+- With Tyk Classic APIs all versions of an API are configured from a single API definition. This means that they share many features with only a subset available to be configured differently between versions.
+
+For more details, see [this comparison](#comparison-between-tyk-oas-and-tyk-classic-api-versioning).
+
+Some key concepts that are important to understand when versioning your APIs are:
+
+- [Version identifiers](/api-management/api-versioning#version-identifiers)
+- [Default version](/api-management/api-versioning#default-version)
+- [Base and child versions](/api-management/api-versioning#base-and-child-apis)
+- [Controlling access to versions](/api-management/api-versioning#controlling-access-to-versioned-apis)
+
+### Version Identifiers
+
+The version identifier is the method by which the API client specifies which version of an API it is addressing with each request. Tyk supports multiple [locations](/api-management/api-versioning#version-identifier-location) within the request where this identifier can be placed. Typically the value assigned in the version identifier will be matched to the list of versions defined for the API and, assuming that the client is [authorized to access](/api-management/api-versioning#controlling-access-to-versioned-apis) that version, Tyk will apply the version specific processing to the request.
+
+#### Version identifier location
+
+Tyk supports three different locations where the client can indicate which version of an API they wish to invoke with their request:
+
+- [Request URL (path)](/api-management/api-versioning#request-url-path)
+- [Query parameter](/api-management/api-versioning#query-parameter)
+- [Request header](/api-management/api-versioning#request-header)
+
+When choosing a version identifier location, consider your API design philosophy, infrastructure requirements, client needs, caching strategy, and backward compatibility concerns. Whichever method you choose, aim for consistency across your API portfolio to provide a uniform experience for your API consumers.
+
+##### Request URL (path)
+
+Including the version identifier in the path (for example `/my-api/v1/users`) is a widely used approach recognized in many API designs. The version identifier is clearly visible in the request and, with the unique URL, can simplify documentation of the different versions. Tyk can support the version identifier as the **first URL fragment** after the listen path, such that the request will take the form `<listenPath>/<versionIdentifier>/<endpointPath>`.
+
+##### Query parameter
+
+Defining a query parameter that must be provided with the request (for example `/my-api/users?version=v1`) is easy to implement and understand. The version identifier is clearly visible in the request and can be easily omitted to target a default version. Many analytics tools can parse query parameters, making this a very analytics-friendly approach to versioning.
+
+##### Request header
+
+Defining a specific header that must be provided with the request (for example `x-api-version:v1`) keeps the URL *clean*, which can be aesthetically pleasing and easier to read. It works well with RESTful design principles, treating the version as metadata about the request and allows for flexibility and the ability to make changes to the versioning scheme without modifying the URL structure. Headers are less visible to users than the request path and parameters, providing some security advantage. Be aware that other proxies or caches might not consider headers for routing, which could bring issues with this method.
+
+#### Stripping version identifier
+
+Typically Tyk will pass all request headers and parameters to the upstream service when proxying the request. For a versioned API, the version identifier (which may be in the form of a header, path parameter or URL fragment) will be included in this scope and passed to the upstream.
+
+The upstream (target) URL will be constructed by combining the configured `upstream.url` (`target_url` for Tyk Classic APIs) with the full request path unless configured otherwise (for example, by using the [strip listen path](/api-management/gateway-config-tyk-oas#listenpath) feature).
+
+If the version identifier is in the request URL then it will be included in the upstream (target) URL. If you don't want to include this identifier, then you can set `stripVersioningData` (`strip_versioning_data` for Tyk Classic APIs) and Tyk will remove it prior to proxying the request.
+
+#### Version identifier pattern
+
+When using the [Request URL](/api-management/api-versioning#request-url-path) for the versioning identifier, if Tyk is configured to strip the versioning identifier then the first URL fragment after the `listenPath` (`listen_path` for Tyk Classic APIs) will be deleted prior to creating the proxy URL. If the request does not include a versioning identifier and Tyk is configured to [fallback to default](/api-management/api-versioning#fallback-to-default), this may lead to undesired behaviour as the first URL fragment of the endpoint will be deleted.
+
+In Tyk 5.5.0 we implemented a new configuration option `urlVersioningPattern` (`url_versioning_pattern` for Tyk Classic APIs) to the API definition where you can set a regex that Tyk will use to determine whether the first URL fragment after the `listenPath` is a version identifier. If the first URL fragment does not match the regex, it will not be stripped and the unaltered URL will be used to create the upstream URL.
+
+### Default version
+
+When multiple versions are defined for an API, one must be declared as the **default version**. If a request is made to the API without providing the version identifier, then this will automatically be treated as a request to the *default* version. This has been implemented to support future versioning of an originally unversioned API, as you can continue to support legacy clients with the default version.
+
+Tyk makes it easy for you to specify - and change - the *default* version for your APIs.
+
+#### Fallback to default
+
+The standard behaviour of Tyk, if an invalid version is requested in the version identifier, is to reject the request returning `HTTP 404 This API version does not seem to exist`. Optionally, Tyk can be configured to redirect these requests to the *default* version by configuring the `fallbackToDefault` option in the API definition (`fallback_to_default` for Tyk Classic APIs).
+
+
+### Base and child APIs
+
+Tyk OAS introduces the concept of a **base API**, which acts as a *parent* that routes requests to the different *child* versions of the API. The base API stores the information required for Tyk Gateway to locate and route requests to the appropriate *child* APIs.
+
+The *child* APIs do not have any reference back to the *parent* and so can operate completely independently if required. Typically, and we recommend, the *child* versions should be configured as Internal APIs that are not directly reachable by clients outside Tyk.
+
+The base API is a working version of the API and is usually the only one configured as an *External API*, so that client requests are handled (and routed) according to the configuration set in the base API (via the version identifier included in the header, url or query parameter).
+
+You can configure a Tyk OAS API as a *base API* by adding the `versioning` object to the `info` section in the Tyk Vendor Extension. This is where you will configure all the settings for the versioned API. The *child* APIs do not contain this information.
+
+Note that any version (*child* or *base*) can be set as the [default version](/api-management/api-versioning#default-version).
+
+<Note>
+  **Note**
+
+  Tyk Classic APIs do not have the base and child concept because all versions share an API definition.
+</Note>
+
+#### Reassigning the Base API
+
+<Note>
+  Available in the Tyk Dashboard from Tyk 5.12.0
+</Note>
+
+You can promote a child API to become the base API, replacing the original base API. The promoted API will become the source of truth for versioning and will be used to route requests that use the versioning identifier. This allows you to delete the original base API without *orphaning* all the child APIs, which was the behavior prior to this version.
+
+It is important to remember that the base API must be configured as an *External API* so that client requests can be handled and routed to the appropriate child API. Typically, you should configure the new base API as *External* and the previous base API, if it is to be retained, as *Internal* so that it no longer handles traffic directly.
+
+Note also that the new base API's listen path will now be used by the Gateway to route traffic so you must ensure this is correct. If you aim to keep the same listen path for traffic (so as not to impact clients) you must remember to update the listen paths for both the original and new base APIs to avoid duplication.
+
+You can reassign the base API using both
+
+- the [Dashboard API](/api-management/api-versioning#changing-the-base-version)
+- the Dashboard application's [API Designer](/api-management/api-versioning#change-the-base-api)
+
+### Controlling access to versioned APIs
+
+Tyk's access control model supports very granular permissions to versioned APIs using the [`access_rights`](/api-management/access-control/sessions-and-keys/access-rights) assigned when a Key is authenticated.
+
+This means that you could restrict client access to only the [base API](/api-management/api-versioning#base-and-child-apis), while allowing developers to create and test new versions independently. These will only be added to the "routing table" in the base API when the API owner is ready and access keys could then be updated to grant access to the new version(s).
+
+Note that an access key will only have access to the `default` version if it explicitly has access to that version (e.g. if `v2` is set as default, a key must have access to `v2` to be able to [fallback to the default](/api-management/api-versioning#fallback-to-default) if the versioning identifier is not correctly provided in the request.
+
+When using Tyk OAS APIs each version of the API has a unique [API Id](/api-management/gateway-config-tyk-oas#info), so you simply need to identify the specific versions in the `access_rights` list in the key in the same way that you would add multiple different APIs to a single key.
+
+
+<Note>
+Creating a new version of a Tyk OAS API will not affect its API Id, so any access keys that grant access to the API will continue to do so, however they will not automatically be granted access to the new version (which will have a new API Id).
+</Note>
+
+
+When using Tyk Classic APIs you can explicitly grant access to specific versions of an API by specifying only those versions in the `versions` list in the key within the single entry for the API in the `access_rights` list.
+
+### Comparison between Tyk OAS and Tyk Classic API versioning
+
+As explained, there are differences between the way that versioning works for Tyk OAS and Tyk Classic APIs.
+
+These are largely due to the fact that a separate API definition is generated for each version of a Tyk OAS API, with one designated as the [base](/api-management/api-versioning#base-and-child-apis) version (which should be exposed on Tyk Gateway with the other (child) versions set to [internal](/advanced-configuration/transform-traffic/looping#internal-only-apis) visibility) whereas all versions of a Tyk Classic API are described by a single API definition.
+
+The Tyk Classic approach limits the range of features that can differ between versions.
+
+This table gives an indication of some of the features that can be configured per-version (✅) or only per-API (❌️) for Tyk OAS and Tyk Classic APIs.
+
+| Feature | Configurable in Tyk OAS versioning | Configurable in Tyk Classic versioning |
+| :--------- | :------------------------------------ | :---------------------------------------- |
+| Client-Gateway security                | ✅ | ❌️ |
+| Request authentication method          | ✅ | ❌️ |
+| API-level header transform             | ✅ | ✅ |
+| API-level request size limit           | ✅ | ✅ |
+| API-level rate limiting                | ✅ | ❌️ |
+| API-level caching                      | ✅ | ❌️ |
+| Endpoints (method and path)            | ✅ | ✅ |
+| Per-endpoint middleware                | ✅ | ✅ |
+| Context and config data for middleware | ✅ | ❌️ |
+| Custom plugin bundle                   | ✅ | ❌️ |
+| Upstream target URL                    | ✅ | ✅ |
+| Gateway-Upstream security              | ✅ | ❌️ |
+| Traffic log config                     | ✅ | ❌️ |
+| API segment tags                       | ✅ | ❌️ |
+
+---
+
+## Configuring API versioning in the API definition
+
+You can configure a Tyk OAS API as a [base API](/api-management/api-versioning#base-and-child-apis) by adding the `info.versioning` [object](/api-management/gateway-config-tyk-oas#versioning) to the [Tyk Vendor Extension](/api-management/gateway-config-tyk-oas#tyk-vendor-extension).
+
+Some notes on this:
+
+- if the *base* version is to be used as the *default* then you can use the value `self` as the identifier in the `default` field
+- in the `versions` field you must provide a list of key-value pairs containing details of the *child* versions:
+  - `id`: the unique API Id (`x-tyk-api-gateway.info.id`) assigned to the API (either automatically by Tyk or user-defined during API creation)
+  - `name`: an identifier for this version of the API, for example `v2`
+
+The *child API* does not require any modification to its API definition. The important thing is that its API Id must be added to the `versions` list in the *base API* definition. We strongly recommend, however, that you configure `info.state.internal` to `true` for all child APIs so that they can only be accessed via the *base API*.
+
+
+<Note>
+  **Note**
+
+  If you are using Tyk Classic APIs, please see [this section](/api-management/api-versioning#versioning-with-tyk-classic-apis).
+</Note>
+
+
+### Example Tyk OAS Base API
+
+In the following example, we configure a *base API*:
+
+```json {hl_lines=["11-27"],linenos=true, linenostart=1}
+{
+  "info": {
+    "title": "example-base-api",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "paths": {},
+  "components": {},
+  "x-tyk-api-gateway": {
+    "info": {
+      "versioning": {
+        "default": "v1",
+        "enabled": true,
+        "key": "x-api-version",
+        "location": "header",
+        "name": "v1",
+        "versions": [
+          {
+            "id": "<child-api-id>",
+            "name": "v2"
+          }
+        ],
+        "fallbackToDefault": true,
+        "stripVersioningData": false,
+        "urlVersioningPattern": ""
+      },
+      "expiration": "2030-01-01 00:00",
+      "name": "example-base-api",
+      "state": {
+        "active": true,
+        "internal": false
+      }
+    },
+    "server": {
+      "listenPath": {
+        "strip": true,
+        "value": "/example-base-api/"
+      }
+    },
+    "upstream": {
+      "url": "http://httpbin.org/"
+    }
+  }
+}
+```
+
+This API definition will configure Tyk Gateway to expect the `x-api-version` header to be provided and will invoke a version of the API as follows:
+- if the header key has the value `v1` then the base API will be processed
+- if it is `v2` then the request will be forwarded internally to the API with API Id `<child-api-id>`
+- if any other value is provided in the header, then the `default` version will be used (in this instance, the base API) because `fallbackToDefault` has been configured
+- if the header is not provided, then the request will be handled by the `default` version (in this instance the base API)
+
+This API version will automatically expire on the 1st January 2030 and stop accepting requests.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out API versioning - though it requires a valid API Id to be used in place of `<child-api-id>`.
+
+---
+
+## API versioning in the Tyk Dashboard API Designer
+
+You can use the API Designer in the Tyk Dashboard to manage versions for your APIs.
+
+<Note>
+  **Note**
+
+  If you are using Tyk Classic APIs, please see [this section](/api-management/api-versioning#tyk-classic-api-versioning-in-the-api-designer).
+</Note>
+
+### Configure versioning
+
+From Tyk 5.10, you can pre-configure the [versioning metadata](#how-api-versioning-works-with-tyk) for an API before you've created the first [child API](/api-management/api-versioning#base-and-child-apis).
+
+1. Choose the API for which you want to create a new version (this can be an unversioned or versioned API) and go to the **Versions** tab
+
+    <img src="/img/dashboard/api-designer/tyk-oas-version-empty.png" alt="An unversioned Tyk OAS API in the API Designer" />
+
+2. Select **Edit** and you can pre-fill the following metadata:
+
+    - [Version identifier location](/api-management/api-versioning#version-identifier-location)
+    - Version identifier name (or [pattern](/api-management/api-versioning#version-identifier-pattern) for URL versioning)
+    - Version name for the base API
+    - [Stripping identifier from upstream request](/api-management/api-versioning#stripping-version-identifier)
+    - [Default fallback behaviour](/api-management/api-versioning#fallback-to-default)
+
+3. Click **Save API** 
+
+### Create a new child version
+
+You can easily add a new version in the Tyk Dashboard's API Designer by following these steps.
+
+1. Choose the API for which you want to create a new version (this can be an unversioned or versioned API) and go to the **Versions** tab
+
+2. Select **Add New Version** to open the version creation wizard.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-version-create-new.png" alt="Creating a new version of a Tyk OAS API using the version creation wizard" />
+
+    Choose whether to start from an existing API configuration or to start from a blank API template. If there's already at least one child version, you can select which version (child or base) you wish to use as the template for your new API.
+
+3. If you have not already [configured](/api-management/api-versioning#configure-versioning) the versioning for this API you will prompted to complete this information.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-version-modal-configure-identifier.png" alt="Configuring the version identifier from the version creation wizard" />
+
+    If you've already done this, then you'll just need to provide a unique identifier name for your new child API and choose whether to make the new version the default choice.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-version-modal-identifier-configured.png" alt="Configuring the version identifier from the version creation wizard" />
+
+
+4. The final step is to choose whether to publish your new version straight away or to keep it in draft until you've completed configuring it. You can also optionally choose to make the API externally accessible, which will allow direct calls to the child API not just via the base API.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-version-modal-set-status.png" alt="Configuring the version identifier from the version creation wizard" />
+
+5. Select **Create Version** to complete the wizard. Your new API will be created and you can now adjust the configuration as required.
+
+
+### Working with versioned APIs
+
+When you have a versioned API the *base API* will appear in the **Created APIs** list, with an expansion icon that you can select to reveal the versions.
+
+<img src="/img/dashboard/api-designer/tyk-oas-version-list.png" alt="Versioned API shows in the Created APIs list" />
+
+Note that the *base* and *default* versions are highlighted with appropriate labels. You can reach the API Designer for each version in the usual way, by selecting the API name in the list (or from the **Actions** menu for the API).
+
+#### Switch between API versions
+
+When you are in the API Designer for a versioned API, you can switch between versions using the drop-down next to the API name.
+
+<img src="/img/dashboard/api-designer/tyk-oas-switch-version.png" alt="Choose between API versions in the API designer" />
+
+#### Manage Version Metadata
+
+You can manage all versions of your API from the **Versions** tab
+
+<img src="/img/dashboard/api-designer/tyk-oas-version-manage.png" alt="Manage the different versions of your API" />
+
+- You can see the versioning metadata
+  - enter **Edit** mode to make changes
+  - note that the common metadata can only be edited from the base API.
+- You can see a list of all versions for the API and, from the **Actions** menu:
+  - go directly to that version
+  - delete that version
+  - set the *default* version
+
+#### Change the Base API
+
+<Note>
+  Available in the Tyk Dashboard from Tyk 5.12.0
+</Note>
+
+You can promote any child API version to become the base API. This will reassign the routing table from the existing base API, converting it into a child API. Be careful to remember to check the listen path for the new base API and that you have the correct exposure (external or internal) for each version.
+
+You can perform this action from the **Versions** tab of the current base API:
+
+<img src="/img/dashboard/api-designer/tyk-oas-version-change-base.png" alt="Promote a child API version to become the base API" />
+
+- Open the three-dot menu for the child version that you want to promote
+- Select **Make Base API**
+- Be sure to check the listen path and visibility of the new and previous base API versions
+
+## API versioning with the Tyk Dashboard and Gateway APIs
+
+If you are not using the Dashboard's [API Designer](/api-management/api-versioning#api-versioning-in-the-tyk-dashboard-api-designer), you can use the Tyk Dashboard API to manage your APIs, including creating and linking base and child versions and, from Tyk 5.12.0, promoting a child API to become the base version.
+
+If you are not using Tyk Dashboard, you can use the Tyk Gateway API to create base and child APIs.
+
+You can either:
+- manually [configure the version metadata](/api-management/api-versioning#configuring-api-versioning-in-the-api-definition) using the `info.versioning` section of the Tyk Vendor Extension before [importing the API definition](/api-management/gateway-config-managing-oas#loading-the-api-definition-into-tyk) via the Dashboard or Gateway API
+- let Tyk manage the configuration of version metadata, as explained in the following sections
+
+<Note>
+  **Note**
+
+  If you are using Tyk Classic APIs, please see [this section](/api-management/api-versioning#versioning-with-tyk-classic-apis).
+</Note>
+
+### Creating Base Version
+
+Typically an existing API is used as the base version. You do not need to do anything to this, as Tyk will manage the updates to that API definition when the first child version is created.
+
+From **Tyk 5.10.0** you can optionally pre-configure the version metadata in the Tyk Vendor Extension of an unversioned API before creating any child versions, leaving `versioning.enabled=false` so that it is ignored, for example:
+
+```yaml
+x-tyk-api-gateway:
+  info:
+    versioning:
+      enabled: false
+      default: v1
+      fallbackToDefault: true
+      key: x-api-version
+      location: url
+      name: v1
+      stripVersioningData: true
+```
+
+All of the `info.versioning` settings will be ignored while `info.versioning.enabled` is set to `false`.
+
+### Creating Child Versions
+
+When you want to create a child version for an existing API using the control API, you simply provide additional query parameters when creating the child API, to link it to the base API.
+
+These parameters are common to the `POST /api/apis/oas` and `POST /tyk/apis/oas` endpoints:
+
+| Parameter               | Description |
+| :---------------------- | :---------- |
+| `base_api_id`           | The API ID of the *base API* to which the new API will be linked as a child. |
+| `base_api_version_name` | The version name (e.g. `v1`) that should be used to call the *base API*. If this has been [pre-configured](/api-management/api-versioning#creating-base-version) or this is not the first child API then it can be omitted. If provided, this will overwrite any existing base API version name. |
+| `new_version_name`      | The version name (e.g. `v2`) that will be used to route to this new child API. |
+| `set_default`           | Set this to `true` to make the new child API the [default version](/api-management/api-versioning#default-version). |
+
+These options are also available when [updating an existing API definition](/api-management/gateway-config-managing-oas#updating-an-api) using the `PATCH /api/apis/oas` or `PATCH /tyk/apis/oas` endpoints.
+
+#### Configuring the Versioning Identifier
+
+When using the control API to create the first new child version, if you have not already [pre-configured](/api-management/api-versioning#creating-base-version) the versioning identifier in the base API, the folowing settings will be used:
+
+- versioning identifier location: header
+- versioning identifier key: `x-tyk-version`
+
+If you need to change these, you should do so within the `info.versioning` section of the API definition for the base API as explained [previously](/api-management/api-versioning#configuring-api-versioning-in-the-api-definition).
+
+### Changing the Base Version
+
+<Note>
+  Available in the Tyk Dashboard API from Tyk 5.12.0
+</Note>
+
+If you have a base API routing to one or more child APIs, you can promote a child version to become the base API. During this process, the base API will be linked as a child of the new base API. You simply make a call to the `PATCH /api/apis/oas/{current-base-api-id}/{next-base-api-id}` endpoint in the Tyk Dashboard API.
+
+| Property     | Description                                               |
+| :----------- | :-------------------------------------------------------- |
+| Resource URL | `/api/apis/oas/{current-base-api-id}/{next-base-api-id}`  |
+| Method       | `PATCH`                                                   |
+| Type         | None                                                      |
+| Body         | None                                                      |
+| Parameters   | Path: `{current-base-api-id}` `{next-base-api-id}`        |
+
+- you need to specify which APIs to change - and do so using the API ID value from the `info.id` field in their respective Tyk Vendor Extensions.
+- if [API ownership](/platform-management/api-ownership) is in use, the user calling this endpoint must have *write* access to both APIs.
+- this request will return `HTTP 400 Bad Request` if the `next-base-api-id` is not currently a child version of `current-base-api-id`
+
+Note that there is no equivalent endpoint in the Tyk Gateway API.
+
+### Deleting the Base Version
+
+<Note>
+  Available in the Tyk Dashboard API from Tyk 5.12.0
+</Note>
+
+Deleting a base API is no different from any other Tyk OAS API, except that it contains all the routing information for the linked child APIs. Typically if you delete the base API all the child APIs will be left "orphaned". If they are only exposed internally, no traffic can be routed to them.
+
+In Tyk 5.12.0 we added the facility to [promote a child API]() to become the base API - useful if you want to maintain the versioned API while deleting the original base version.
+
+We also added a new optional `purge` parameter to the [delete API](https://tyk.io/docs/api-reference/oas-apis/delete-oas-api) endpoint in the Tyk Dashboard API which will delete all child APIs linked to the API being deleted, allowing you to remove all versions of an API with one command.
+
+
+## Versioning with Tyk Classic APIs
+
+All configuration for versioning of Tyk Classic APIs is documented [here](/api-management/gateway-config-tyk-classic#tyk-classic-api-versioning).
+
+For details on how to create a Tyk Classic API, check out [this guide](/api-management/gateway-config-managing-classic).
+
+
+### Example versioned Tyk Classic API
+
+Here's an example of the minimal configuration that would need to be added to the API definition for a Tyk Classic API with two versions (`v1` and `v2`):
+
+```json  {linenos=true, linenostart=1}
+{
+  "version_data": {
+    "not_versioned": false,
+    "default_version": "v1",
+    "versions": {
+      "v1": {
+        "name": "v1",
+        "expires": "",
+        "paths": {
+          "ignored": [],
+          "white_list": [],
+          "black_list": []
+        },
+        "use_extended_paths": true,
+        "extended_paths": {
+          "ignored": [],
+          "white_list": [],
+          "black_list": [],
+          "transform": [],
+          "transform_response": [],
+          "transform_jq": [],
+          "transform_jq_response": [],
+          "transform_headers": [],
+          "transform_response_headers": [],
+          "hard_timeouts": [],
+          "circuit_breakers": [],
+          "url_rewrites": [],
+          "virtual": [],
+          "size_limits": [],
+          "method_transforms": [],
+          "track_endpoints": [],
+          "do_not_track_endpoints": [],
+          "validate_json": [],
+          "internal": [],
+          "persist_graphql": []
+        },
+        "global_headers": {},
+        "global_headers_remove": [],
+        "global_headers_disabled": false,
+        "global_response_headers": {},
+        "global_response_headers_remove": [],
+        "global_response_headers_disabled": false,
+        "ignore_endpoint_case": false,
+        "global_size_limit": 0,
+        "override_target": ""
+      },
+      "v2": {
+        "name": "v2",
+        "expires": "",
+        "paths": {
+          "ignored": [],
+          "white_list": [],
+          "black_list": []
+        },
+        "use_extended_paths": true,
+        "extended_paths": {
+          "ignored": [],
+          "white_list": [],
+          "black_list": [],
+          "transform": [],
+          "transform_response": [],
+          "transform_jq": [],
+          "transform_jq_response": [],
+          "transform_headers": [],
+          "transform_response_headers": [],
+          "hard_timeouts": [],
+          "circuit_breakers": [],
+          "url_rewrites": [],
+          "virtual": [],
+          "size_limits": [],
+          "method_transforms": [],
+          "track_endpoints": [],
+          "do_not_track_endpoints": [],
+          "validate_json": [],
+          "internal": [],
+          "persist_graphql": []
+        },
+        "global_headers": {},
+        "global_headers_remove": [],
+        "global_headers_disabled": false,
+        "global_response_headers": {},
+        "global_response_headers_remove": [],
+        "global_response_headers_disabled": false,
+        "ignore_endpoint_case": false,
+        "global_size_limit": 0,
+        "override_target": "http://httpbin.org/ip"
+      }
+    }
+  },
+  "definition": {
+    "location": "header",
+    "key": "x-api-version",
+    "strip_versioning_data": false,
+    "fallback_to_default": true,
+    "url_versioning_pattern": ""
+  }
+}
+```
+
+In this example, there are two versions of the API
+- the version identifier is expected in a request header `x-api-version`
+- the versions are named `v1` and `v2`
+- the only difference between `v1` and `v2` is that `v2` will proxy the request to a different upstream via the configured `override_target`
+- the default version (`default_version`) is `v1`
+- if the request header contains an invalid version named (e.g. `v3`), it will be directed to the default (`fallback_to_default:true`)
+
+### Tyk Classic API versioning in the API Designer
+
+You can use the API Designer in the Tyk Dashboard to add and manage versions for your Tyk Classic APIs.
+
+#### Create a versioned API
+
+1. **Enable versioning**
+
+    In the API Designer, navigate to the **Versions** tab.
+
+    <img src="/img/dashboard/endpoint-designer/tyk-classic-version-no-versioning.png" alt="Enabling versioning for a Tyk Classic API" />
+
+    Deselect the **Do not use versioning** checkbox to enable versioning and display the options.
+
+2. **Configure the versioning identifier**
+
+    Choose from the drop-down where the version identifier will be located and, if applicable, provide the key name (for query parameter or request header locations).
+
+    <img src="/img/dashboard/endpoint-designer/tyk-classic-version-start.png" alt="Configuring the versioning identifier" />
+
+3. **Add a new version**
+
+    You will see the existing (`Default`) version of your API in the **Versions List**. You can add a new version by providing a version name (which will be the value your clients will need to provide in the version location when calling the API).
+
+    You can optionally configure an **Override target host** that will replace the target path that was set in the base configuration for the version. Note that this is not compatible with Service Discovery or Load Balanced settings.
+
+    Select **Add** to create this new version for your API.
+
+    <img src="/img/dashboard/endpoint-designer/tyk-classic-version-add.png" alt="Adding a new version to your API" />
+
+4. **Set the default version**
+
+    You can choose any of your API versions to act as the [default](/api-management/api-versioning#default-version).
+
+    <img src="/img/dashboard/endpoint-designer/tyk-classic-version-set-default.png" alt="Choosing the default version for your API" />
+
+    Select **Update** to save the changes to your API.
+
+#### Switch between versions of a Tyk Classic API
+
+When you are in the API Designer for a versioned Tyk Classic API, you can switch between versions from the **Edit Version** dropdown in the **Endpoint Designer** tab.
+
+<img src="/img/dashboard/endpoint-designer/tyk-classic-version-endpoint.png" alt="Choosing the API version for which to configure endpoint middleware" />
+
+Remember to select **Update** to save the changes to your API.
+
+### Configuring Tyk Classic API versioning in Tyk Operator
+<a id="tyk-operator"></a>
+
+When using Tyk Operator, you can configure versioning for a Tyk Classic API within `spec.definition` and `spec.version_data`.
+
+In the following example:
+
+- the version identifier is a header with the name `x-api-version` (comments demonstrate how to configure the alternative version identifier locations)
+- the API has one version with the name `v1`
+- the default version is set to `v1`
+- an allow list, block list and ignore authentication middleware have been configured for version `v1`
+- an alternative upstream URL (`override_target`) is configured for `v1` to send requests to `http://test.org`
+
+```yaml {linenos=table,hl_lines=["14-17", "25-27", "29-82"], linenostart=1}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: versioned-api
+spec:
+  name: Versioned API
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://version-api.example.com
+    listen_path: /version-api
+    strip_listen_path: true
+  definition:
+  # Tyk should find version data in Header
+    location: header
+    key: x-api-version
+
+  # Tyk should find version data in First URL Element
+    #location: url
+
+  # Tyk should find version data in URL/Form Parameter
+    #location: url-param
+    #key: api-version
+  version_data:
+    default_version: v1
+    not_versioned: false
+    versions:
+      v1:
+        name: v1
+        expires: ""
+        override_target: "http://test.org"
+        use_extended_paths: true
+        extended_paths:
+          ignored:
+            - path: /v1/ignored/noregex
+              method_actions:
+                GET:
+                  action: no_action
+                  code: 200
+                  data: ""
+                  headers:
+                    x-tyk-override-test: tyk-override
+                    x-tyk-override-test-2: tyk-override-2
+          white_list:
+            - path: v1/allowed/allowlist/literal
+              method_actions:
+                GET:
+                  action: no_action
+                  code: 200
+                  data: ""
+                  headers:
+                    x-tyk-override-test: tyk-override
+                    x-tyk-override-test-2: tyk-override-2
+            - path: v1/allowed/allowlist/reply/{id}
+              method_actions:
+                GET:
+                  action: reply
+                  code: 200
+                  data: flump
+                  headers:
+                    x-tyk-override-test: tyk-override
+                    x-tyk-override-test-2: tyk-override-2
+            - path: v1/allowed/allowlist/{id}
+              method_actions:
+                GET:
+                  action: no_action
+                  code: 200
+                  data: ""
+                  headers:
+                    x-tyk-override-test: tyk-override
+                    x-tyk-override-test-2: tyk-override-2
+          black_list:
+            - path: v1/disallowed/blocklist/literal
+              method_actions:
+                GET:
+                  action: no_action
+                  code: 200
+                  data: ""
+                  headers:
+                    x-tyk-override-test: tyk-override
+                    x-tyk-override-test-2: tyk-override-2
+```
diff --git a/api-management/authentication/basic-authentication.mdx b/api-management/authentication/basic-authentication.mdx
new file mode 100644
index 0000000000..874552f171
--- /dev/null
+++ b/api-management/authentication/basic-authentication.mdx
@@ -0,0 +1,194 @@
+---
+title: "Basic Authentication"
+description: "How to configure basic authentication in Tyk?"
+keywords: "Authentication, Authorization, Tyk Authentication, Tyk Authorization, Secure APIs, Basic Authentication"
+sidebarTitle: "Basic Authentication"
+---
+
+## What is Basic Authentication?
+
+Basic Authentication is a straightforward authentication method where the user's credentials (username and password) are  sent to the server, usually in a standard HTTP header.
+
+## How does Basic Authentication Work?
+
+The user credentials are combined and encoded in this form:
+
+```
+Basic base64Encode(username:password)
+```
+
+A real request could look something like:
+
+```
+GET /api/widgets/12345 HTTP/1.1
+Host: localhost:8080
+Authorization: Basic am9obkBzbWl0aC5jb206MTIzNDU2Nw==
+Cache-Control: no-cache
+```
+
+In this example the username is `john@smith.com` and the password is `1234567` (see [base64encode.org](https://www.base64encode.org))
+
+### The Problem with Basic Authentication
+
+With Basic Authentication, the authentication credentials are transferred from client to server as encoded plain text. This is not a particularly secure way to transfer the credentials as it is highly susceptible to intercept; as the security of user authentication is usually of critical importance to API owners, Tyk recommends that Basic Authentication should only ever be used in conjunction with additional measures, such as [mTLS](/api-management/implement-tls#secure-hosted-apis-with-mtls).
+
+## Configuring your API to use Basic Authentication
+
+The OpenAPI Specification indicates the use of [Basic Authentication](https://swagger.io/docs/specification/v3_0/authentication/basic-authentication/) in the `components.securitySchemes` object using the `type: http` and `scheme: basic`:
+
+```yaml
+components:
+  securitySchemes:
+    myAuthScheme:
+      type: http
+      scheme: basic
+
+security:
+  - myAuthScheme: []
+```
+
+With this configuration provided by the OpenAPI description, all that is left to be configured in the Tyk Vendor Extension is to enable authentication, to select this security scheme and to indicate where Tyk should look for the credentials. Usually the credentials will be provided in the `Authorization` header, but Tyk is configurable, via the Tyk Vendor Extension, to support custom header keys and credential passing via query parameter or cookie.
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        myAuthScheme:
+          enabled: true
+          header:
+            enabled: true
+            name: Authorization
+```
+
+Note that URL query parameter keys and cookie names are case sensitive, whereas header names are case insensitive.
+
+You can optionally [strip the user credentials](/api-management/client-authentication#managing-authorization-data) from the request prior to proxying to the upstream using the `authentication.stripAuthorizationData` field (Tyk Classic: `strip_auth_data`).
+
+### Multiple User Credential Locations
+
+The OpenAPI Specification's `securitySchemes` mechanism allows only one location for the user credentials, but in some scenarios an API might need to support multiple potential locations to support different clients.
+
+The Tyk Vendor Extension supports this by allowing configuration of alternative locations in the basic auth entry in `server.authentication.securitySchemes`. Building on the previous example, we can add optional query and cookie locations as follows:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        myAuthScheme:
+          enabled: true
+          header:
+            enabled: true
+            name: Authorization
+          query:
+            enabled: true
+            name: query-auth
+          cookie:
+            enabled: true
+            name: cookie-auth
+```
+
+### Extract Credentials from the Request Payload
+
+In some cases, for example when dealing with SOAP, user credentials can be passed within the request body rather in the standard Basic Authentication format. You can configure Tyk to handle this situation by extracting the username and password from the body using regular expression matching (regexps).
+
+You must instruct Tyk to check the request body by adding the `extractCredentialsFromBody` field to the basic auth entry in `server.authentication.securitySchemes`, for example:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        myAuthScheme:
+          enabled: true
+        extractCredentialsFromBody:
+          enabled: true
+          userRegexp: '<User>(.*)</User>'
+          passwordRegexp: '<Password>(.*)</Password>'          
+```
+
+Note that each regexp should contain only one match group, which must point to the actual values of the user credentials.
+
+### Caching User Credentials
+
+The default behaviour of Tyk's Basic Authentication middleware is to cache user credentials, improving the performance of the authentication step when a client makes frequent requests on behalf of the same user.
+
+When a request is received, it presents credentials which are checked against the users registered in Tyk. When a match occurs and the request is authorized, the matching credentials are stored in a cache with a configurable refresh period. When future requests are received, Tyk will check the presented credentials against those in the cache first, before checking the full list of registered users.
+
+The cache will refresh after `cacheTTL` seconds (Tyk Classic: `basic_auth.cache_ttl`).
+
+If you do not want to cache user credentials, you can turn this off using `disableCaching` in the basic auth entry in `server.authentication.securitySchemes` (Tyk Classic: `basic_auth.disable_caching`).
+
+### Using Tyk Classic APIs
+
+As noted in the Tyk Classic API [documentation](/api-management/gateway-config-tyk-classic#configuring-authentication-for-tyk-classic-apis), you can select Basic Authentication using the `use_basic_auth` option. This will default to expect the user credentials in the `Authorization` header.
+
+
+## Using Tyk Dashboard to Configure Basic Authentication
+
+Using the Tyk Dashboard, you can configure the Basic Authentication method from the Server section in the API Designer by enabling **Authentication** and selecting **Basic Authentication** from the drop-down:
+
+<img src="/img/api-management/security/basic-auth-api-setup.png" alt="Target Details: Basic Auth" />
+
+- select the location(s) where Tyk should look for the token
+- provide the key name for each location (we prefill the default `Authorization` for the *header* location, but you can replace this if required)
+- optionally select [strip authorization data](/api-management/client-authentication#managing-authorization-data) to remove the auth token locations from the request prior to proxying to the upstream
+- optionally configure the [basic authentication cache](/api-management/authentication/basic-authentication#caching-user-credentials)
+- optionally configure [extraction of credentials from the request body](#extract-credentials-from-the-request-payload)
+
+## Registering Basic Authentication User Credentials with Tyk
+
+When using Basic Authentication, the API key used to access the API is not generated by the Tyk system, instead you need to create and register the credentials of your users with Tyk. Tyk will compare the credentials provided in the request against the list of users you have created.
+
+The way that this is implemented is through the creation of a key that grants access to the API (as you would for an API protected by [auth token](/api-management/authentication/bearer-token)), however for this key you will provide a username and password.
+
+When calling the API, users would never use the key itself as a token, instead their client must provide the Basic Auth credentials formed from the registered username and password, as [described previously](#how-does-basic-authentication-work).
+
+
+### Using Tyk Dashboard UI
+
+You can use the Tyk Dashboard to register a user's Basic Authentication credentials that can then be used to access your API.
+
+Navigate to the **Keys** screen and select **Add Key**.
+
+Follow the instructions in the [access key guide](/api-management/gateway-config-managing-classic#access-an-api) and you'll notice that, when you select the Basic Auth protected API, a new **Authentication** tab appears:
+
+Note that the **Authentication** tab will also be displayed if you create a key from a policy that grants access to a Basic Auth protected API.
+
+Complete the user's credentials on this tab and create the key as normal. The key that is created in Tyk Dashboard is not in itself an access token (that is, it cannot be used directly to gain access to the API) but is used by Tyk to validate the credentials provided in the request and to determine the appropriate authorization, including expiry of authorization.
+
+### Using the Tyk Dashboard API
+
+You can register user credentials using the `POST /api/apis/keys/basic/{username}` endpoint in the [Tyk Dashboard API](/tyk-dashboard-api). The request payload is a [Session Object](/api-management/access-control/sessions-and-keys/understanding-sessions).
+
+- the user's *username* is provided as a path parameter
+- the user's *password* is provided as `basic_auth_data.password` within the request payload
+
+You use the `POST` method to create a new user and `PUT` to update an existing entry.
+
+
+<Note>
+Be careful to ensure that the `org_id` is set correctly and consistently so that the Basic Authentication user is created in the correct organization.
+</Note>
+
+
+### Using the Tyk Gateway API
+
+You can register user credentials using the `POST /tyk/keys/{username}` endpoint in the [Tyk Dashboard API](/tyk-dashboard-api). The request payload is a [Session Object](/api-management/access-control/sessions-and-keys/understanding-sessions).
+
+- the user's *username* is provided as a path parameter
+- the user's *password* is provided as `basic_auth_data.password` within the request payload
+
+You use the `POST` method to create a new user and `PUT` to update an existing entry.
+
+
+<Note>
+Be careful to ensure that the `org_id` is set correctly and consistently so that the Basic Authentication user is created in the correct organization.
+</Note>
+
+
+
diff --git a/api-management/authentication/bearer-token.mdx b/api-management/authentication/bearer-token.mdx
new file mode 100644
index 0000000000..fb6a5acaf6
--- /dev/null
+++ b/api-management/authentication/bearer-token.mdx
@@ -0,0 +1,198 @@
+---
+title: "Authentication Token"
+description: "How to use Authentication Tokens to Secure APIs"
+keywords: "Authentication, Authorization, Tyk Authentication, Tyk Authorization, Secure APIs, Bearer Tokens, Auth Token, Authentication Token, API Key"
+sidebarTitle: "Auth Token"
+---
+
+## Introduction
+
+[IETF RFC6750](https://datatracker.ietf.org/doc/html/rfc6750) opens with:
+> Any party in possession of a bearer token (a "bearer") can use it to get access to the associated resources (without demonstrating possession of a cryptographic key).  To prevent misuse, bearer tokens need to be protected from disclosure in storage and in transport.
+
+The bearer token is a cryptic string, usually generated by the server. When the client makes a request to consume an API on the server, it must send this token in a header, typically as: `Authorization: Bearer <token>`. When the server receives the token, it checks its validity and authentcates that the "bearer" of the token is the entity to which the token was issued.
+
+The [OpenAPI Specification](https://swagger.io/docs/specification/v3_0/authentication/api-keys/) defines an API Key as:
+> a token that a client provides when making API calls. API keys are supposed to be a secret that only the client and server know ... API key-based authentication is only considered secure if used together with other security mechanisms such as HTTPS/SSL.
+
+Bearer Token, API Key, Authentication Token... from the perspective of Tyk these are different names for the same thing: a "token" string that can be used to access an API secured using Tyk's **Auth Token** authentication method.
+
+### An Overview of the Auth Token method
+
+Tyk's "Auth Token" authentication method is a flexible mechanism that functions like a Bearer Token but is defined as an 'API Key' according to OpenAPI 3.0 standards.
+
+- Tyk Gateway issues Auth Tokens (called **Keys** in the Tyk Dashboard App)
+- For each token, a session state object is created with the Redis key containing the token string
+  - this session object contains details of the access rights and consumption limits to be applied to the client presenting the token
+- The client can present the token in a header, query parameter or cookie
+  - the location is configurable within the API definition
+- The `Bearer` identifier is optional when using a header for the token
+- When the token is presented, it is used as a simple key lookup against the Redis keys and validated if a matching session object is found
+- From Tyk 5.12.0 the token can be [bound to a client certificate](/api-management/authentication/bearer-token#client-certificate-token-binding) to provide an extra layer of authentication security
+  - when this is in use, Tyk validates that the certificate presented with the token matches that bound to the session
+
+## Configuring your API to use Auth Token
+
+The OpenAPI Specification indicates the use of Auth Tokens (API Keys) in the `components.securitySchemes` object using `type: apiKey`. It also includes specification of the location (`in`) and key (`name`) that are to be used when providing the token to the API, for example:
+
+```yaml
+components:
+  securitySchemes:
+    myAuthScheme:
+      type: apiKey
+      in: header
+      name: Authorization
+      
+security:
+  - myAuthScheme: []
+```
+
+With this configuration provided by the OpenAPI description, all that is left to be configured in the Tyk Vendor Extension is to enable authentication and to select this security scheme.
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        myAuthScheme:
+          enabled: true
+```
+
+Note that URL query parameter keys and cookie names are case sensitive, whereas header names are case insensitive.
+
+You can optionally [strip the auth token](/api-management/client-authentication#managing-authorization-data) from the request prior to proxying to the upstream using the `authentication.stripAuthorizationData` field  (Tyk Classic: `strip_auth_data`).
+
+## Multiple Auth Token Locations
+
+The OpenAPI Specification's `securitySchemes` mechanism allows only one location for the auth token, but in some scenarios an API might need to support multiple potential locations to support different clients.
+
+The Tyk Vendor Extension supports this by allowing configuration of alternative locations in the auth token entry in `server.authentication.securitySchemes`. Building on the previous example, we can add optional query and cookie locations as follows:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        myAuthScheme:
+          enabled: true
+          query:
+            enabled: true
+            name: query-auth
+          cookie:
+            enabled: true
+            name: cookie-auth
+```
+
+## Client Certificate - Token Binding
+
+In **Tyk 5.12.0** we introduced an option when combining the Auth Token method with [static mTLS](/api-management/implement-tls#using-a-static-client-certificate-allow-list) to form a binding association between the Auth Token issued to a client and their client certificate.
+
+This works as follows:
+
+1. The client certificate must first be registered with the Tyk Certificate Store and added to the statically declared *allow list* in the API definition, the act of doing this enforces the mTLS handshake for requests to the API.
+2. When the Auth Token is issued by Tyk, the certificate is bound to the session object that is created in Redis (the certificateID is stored in the [`mtls_static_certificate_bindings`](/api-management/access-control/sessions-and-keys/understanding-sessions#authentication-data) field in the Session)
+3. When a request is made by the client, they must provide a certificate to satisfy the mTLS handshake. This certificate is then checked against the allow list in the API definition and then the binding in the session object. If it is not present in the allow list or not in the bound certificates list, authentication will fail and the request will be rejected.
+
+Multiple client certificates can be bound to a token, for additional flexibility. Proactive maintenance of the list of bound certificates supports seamless rotation of certificates, as the new certificate can be registered and bound prior to the client switching to use it.
+
+This feature is fully backward-compatible. Existing tokens that do not have certificate bindings will continue to work as before, as the binding check is simply skipped. No additional configuration is required in the Tyk Gateway configuration nor in the API Definition.
+
+<Note>
+  Policies do not currently support certificate-token binding. This will be added in a future release.
+</Note>
+
+
+## Dynamic mTLS with Auth Token
+The Auth Token method can support [Dynamic mTLS](/api-management/implement-tls#using-a-dynamic-client-certificate-allow-list) where the client can provide a TLS certificate in lieu of a standard Auth Token. This can be configured for an API using the [enableClientCertificate](/api-management/gateway-config-tyk-oas#token)  option (Tyk Classic: `auth.use_certificate`).
+
+You can use your own identity provider to generate access tokens, then import them to Tyk via `POST /tyk/keys/{keyID}` in the Tyk Gateway API. This lets Tyk manage access control, quotas, and rate limiting for you.
+
+## Legacy Options
+
+### Dynamic mTLS with Auth Token
+
+<Note>
+  *Dynamic mTLS* became a standalone authentication method in Tyk 5.12.0 and is now more accurately called [Certificate Authentication](/api-management/authentication/certificate-auth)
+</Note>
+
+Prior to Tyk 5.12.0, [Dynamic mTLS](/api-management/implement-tls#using-a-dynamic-client-certificate-allow-list) was configured via the Auth Token method by setting the `enableClientCertificate` flag (Tyk Classic: `auth_configs.authToken.use_certificate`).
+
+```json
+server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        authToken:
+          enabled: true
+          enableClientCertificate: true
+```
+
+This was later changed to Certificate Authentication, as explained [here](/api-management/implement-tls#legacy-dynamic-mtls-mode).
+
+### Auth Token with Signature
+
+If you are migrating from platforms like Mashery, which use request signing, you can enable signature validation alongside auth token by configuring the additional [signatureValidation](/api-management/gateway-config-tyk-oas#token) field (Tyk Classic: `auth.signature`).
+
+You can configure:
+
+- the location of the signature
+- the algorithm used to create the signature (`MasherySHA256` or `MasheryMD5`)
+- secret used during signature (which can be retrieved from the [Session metadata](/api-management/access-control/sessions-and-keys/session-metadata))
+- an allowable clock skew
+
+## Using Tyk Dashboard to Configure Auth Token
+
+Using the Tyk Dashboard, you can configure the Auth Token authentication method from the Server section in the API Designer by enabling **Authentication** and selecting **Auth Token** from the drop-down:
+
+<img src="/img/api-management/security/auth-token-method.png" alt="Configuring the Auth Token method" />
+
+- select the location(s) where Tyk should look for the token
+- provide the key name for each location (we prefill the default `Authorization` for the *header* location, but you can replace this if required)
+- select **Strip authorization data** to remove the auth token locations from the request prior to proxying to the upstream, as described [here](/api-management/client-authentication#managing-authorization-data)
+
+Note that the [auth token + signature](/api-management/authentication/bearer-token#auth-token-with-signature) option is not available in the Tyk Dashboard API Designer.
+
+### Binding a Client Certificate to a Token
+
+Certificates are bound to tokens when the tokens are issued or when the session object is subsequently updated.
+
+When an API secured by Auth Token and mTLS is selected in the **Access Rights** tab of the **API Security > Keys** screen, an additional tab will be displayed: **Authentication**.
+
+<img src="/img/api-management/security/auth-token-mtls-add-key.png" alt="Creating an API Key for an API secured with Auth Token and mTLS" />
+
+On the **Authentication** tab there is an option to bind certificates to the token:
+
+<img src="/img/api-management/security/auth-token-mtls-bind-cert1.png" alt="Optionally bind a client certificate to the API Key" />
+
+If you select this option, you can then select the client certificate to bind to the new token. You can choose from the existing client certificates in the Tyk Certificate Store or, if required, you can upload new certificates (in PEM format). Tyk will register these within the Tyk Certificate Store so that they are available for use.
+
+Select **Attach Certificate**.
+
+<img src="/img/api-management/security/auth-token-mtls-bind-cert2.png" alt="Uploading a client certificate to bind to the API Key" />
+
+The certificate will be added to a list of bound certificates.
+
+<img src="/img/api-management/security/auth-token-mtls-bind-cert3.png" alt="The new cert is shown in the list of bound certificates" />
+
+You can optionally add more certificates, or proceed to issue the key by selecting **Create Key**.
+
+You can add and remove certificate bindings for existing tokens from the **Update Key** screen:
+
+<img src="/img/api-management/security/auth-token-mtls-update-key.png" alt="The new cert is shown in the list of bound certificates" />
+
+<Note>
+
+    **Note**
+
+    Binding a certificate to an Auth Token does not automatically add that certificate to the static allow list for the API(s) that the token is authorised to access. When a request is made using the token, the presented client certificate will be checked against the allow list after the mTLS handshake has completed and before the binding is checked. Authentication will fail if the certificate is not in the allow list.
+</Note>
+
+
+## Using Tyk Classic APIs
+
+As noted in the Tyk Classic API [documentation](/api-management/gateway-config-tyk-classic#configuring-authentication-for-tyk-classic-apis), a new Tyk Classic API will use the auth (bearer) token method by default with the token expected in the `Authorization` header, so configuration is slightly different as there is no need to `enable` this method. You should configure the `auth` object for any non-default settings, such as a different token location or Dynamic mTLS.
+
+
+
diff --git a/api-management/authentication/certificate-auth.mdx b/api-management/authentication/certificate-auth.mdx
new file mode 100644
index 0000000000..39da59c008
--- /dev/null
+++ b/api-management/authentication/certificate-auth.mdx
@@ -0,0 +1,95 @@
+---
+title: "Certificate Authentication"
+description: "Authenticate using just an mTLS client certificate"
+keywords: "Authentication, Tyk Authentication, Mutual TLS, mTLS, Client mTLS, certificate"
+sidebarTitle: "Certificate Authentication"
+---
+
+## What is Certificate Authentication?
+
+Certificate Authentication is a client authentication method introduced in Tyk 5.12.0 that replaces the legacy [Dynamic mTLS](/api-management/implement-tls#using-a-dynamic-client-certificate-allow-list) feature. This method provides enhanced security and flexibility for API authentication using client certificates.
+
+### Evolution from Dynamic mTLS
+
+Certificate Authentication has evolved from Dynamic mTLS through the enforcement of the mutual TLS handshake and the disallowing of authentication using a token. Only the registered client certificate can now be used to authenticate with the Gateway.
+
+This change was introduced because Dynamic mTLS treated the certificate as optional and did not enforce the mTLS handshake. Mutual TLS was not enforced if only the token was presented in the request, reducing the security of the Dynamic mTLS authentication method. 
+
+For more details, see [the problem with Dynamic mTLS](/api-management/implement-tls#legacy-dynamic-mtls-mode).
+
+If you are currently using Dynamic mTLS, no change is required to your API definition to use Certificate Authentication.
+
+When using Tyk OAS APIs, the legacy configuration (`x-tyk-api-gateway.server.authentication.securitySchemes.authToken.enableClientCertificate`) is still supported (though marked as deprecated in favor of a new, cleaner configuration).
+
+When using Tyk Classic APIs, there is no change to the configuration in the API definition (`auth_configs.authToken.useCertificate`).
+
+<Note>
+    The legacy mode (where the token can be used to authenticate with Tyk) is available via the Gateway configuration option `allow_unsafe_dynamic_mtls_token`.
+</Note>
+
+## How does Certificate Authentication work?
+
+Certificate Authentication uses X.509 [client certificates](/api-management/certificates#digital-certificates) to authenticate API requests. It relies upon a one-to-one mapping between API clients and client certificates.
+
+When a client makes a request:
+
+1. The client presents their certificate during the mTLS handshake
+3. If the client is successfully authenticated, Tyk checks the client certificate against a list of authorized certificates (the "dynamic allow list")
+4. If a match is found, authorization proceeds as usual, based on the content of the linked session and any policies applied to it
+
+Each client certificate must be [pre-registered](/api-management/authentication/certificate-auth#registering-certificate-authentication-user-credentials) with the [Tyk Certificate Store](/api-management/certificates#tyk-certificate-store) and a [Session](/api-management/access-control/sessions-and-keys/understanding-sessions) created for each in the temporal storage (Redis) to create the dynamic allow list. This list is dynamic because certificate-linked session objects (and hence clients) can be added to or removed from the list without making any change to the API definition. This is in contrast to the [static allow list](/api-management/implement-tls#using-a-static-client-certificate-allow-list) approach where the list of authorized certificates is stored in the API definition.
+
+
+## Configuring your API to use Certificate Authentication
+
+<Note>
+    The Gateway must be configured to use TLS for the [hosted API interface](/api-management/implement-tls#tyk-gateway-as-a-tls-server-inbound-connections).
+</Note>
+
+Certificate Auth is configured within the Tyk Vendor Extension by adding the `certificateAuth` object within the `server.authentication` section and enabling authentication.
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      certificateAuth:
+        enabled: true
+```
+
+There are no additional configuration options for this authentication method. The client must present their certificate in the usual manner for the mTLS handshake, for example:
+
+```bash
+    curl --cert client_cert.pem --key client_key.pem https://my-gateway/my-api/
+```
+
+Note that the `HTTPS` protocol must be used.
+
+### Using Tyk Classic
+
+As noted in the Tyk Classic API [documentation](/api-management/gateway-config-tyk-classic#configuring-authentication-for-tyk-classic-apis), you can select Certificate Authentication using the `auth_configs.authToken.useCertificate` option. 
+
+
+## Using Tyk Dashboard to Configure Certificate Authentication
+
+Using the Tyk Dashboard, you can configure the Certificate Auth method from the Server section in the API Designer by enabling **Authentication** and selecting **Certificate Authentication** from the drop-down:
+
+<img src="/img/dashboard/api-designer/certificate-auth.png" alt="Selecting Certificate Authentication in the Tyk OAS API Designer" />
+
+## Registering Certificate Authentication User Credentials
+
+The *dynamic allow list* comprises session state objects in the Gateway's temporal storage (typically Redis) that reference the client certificates that should be accepted.
+
+1. First you must [register](/api-management/certificates#tyk-certificate-store-api) the client certificate with the Tyk Certificate Store and note the certificate ID that is assigned.
+
+2. Next you *create a key*, providing the certificate ID in the `certificate` field of the session object payload.
+    - Tyk Gateway API: `POST /tyk/keys/create`
+    - Tyk Dashboard API: `POST /api/keys/create`
+
+3. Tyk will create a session object with the Redis key containing the certificate ID, which forms part of the dynamic allow list.
+    - The Redis key is formed from a combination of the Organization ID and Certificate ID
+    - Deleting this object (key) will remove the certificate from the allow list, restricting access to any client presenting that certificate
+
+From the Tyk Dashboard UI, if you [create a key](/getting-started/using-tyk-dashboard#api-security) that grants access to an API secured with a dynamic allow list, the **Authentication** tab will be displayed, where you can select the client certificate from the Tyk Certificate Store.
+
+<img src="/img/dashboard/api-designer/certificate-auth-register-cert.png" alt="Associating a client certificate with an API for Certificate Authentication" />
\ No newline at end of file
diff --git a/api-management/authentication/custom-auth.mdx b/api-management/authentication/custom-auth.mdx
new file mode 100644
index 0000000000..0d2055fcd0
--- /dev/null
+++ b/api-management/authentication/custom-auth.mdx
@@ -0,0 +1,19 @@
+---
+title: "Custom Authentication"
+description: "How to implement custom authentication in Tyk using Go plugins, Python CoProcess, and JSVM plugins."
+keywords: "Authentication, Authorization, Tyk Authentication, Tyk Authorization, Go Plugins, Python CoProcess, JSVM Plugin"
+sidebarTitle: "Custom Authentication"
+---
+
+## Go Plugins
+
+Go Plugin Authentication allows you to implement custom authentication logic using the Go programming language. This method is useful for scenarios where you need to implement specialized authentication mechanisms that are not natively supported by Tyk.
+To learn more about using Tyk Golang Plugins, go [here](/api-management/plugins/golang)
+
+## Use Python CoProcess and JSVM Plugin Authentication
+
+Tyk allows for custom authentication logic using Python and JavaScript Virtual Machine (JSVM) plugins. This method is useful for implementing unique authentication mechanisms that are tailored to your specific requirements.
+
+* See [Custom Authentication with a Python plugin](/api-management/plugins/rich-plugins#custom-authentication-plugin-tutorial) for a detailed example of a custom Python plugin.
+* See [JavaScript Middleware](/api-management/plugins/javascript#) for more details on using JavaScript Middleware. 
+
diff --git a/api-management/authentication/jwt-authorization.mdx b/api-management/authentication/jwt-authorization.mdx
new file mode 100644
index 0000000000..9f1f37e576
--- /dev/null
+++ b/api-management/authentication/jwt-authorization.mdx
@@ -0,0 +1,346 @@
+---
+title: "JWT Authorization"
+description: "Tyk Gateway's JWT Authorization process extracts user identity and applies security policies based on JWT claims for API access control."
+keywords: "Authentication, Authorization, JWT, JSON Web Tokens, Claims, Validation"
+sidebarTitle: "Authorization"
+---
+
+## Availability 
+
+| Component   | Editions |
+| :------------- | :------------------------- |
+| Tyk Gateway | Community and Enterprise |
+
+## Introduction
+
+[JSON Web Tokens (JWT)](https://www.jwt.io/introduction) are a popular method for client authentication and authorization that can be used to secure access to your APIs via Tyk's [JWT Auth](/basic-config-and-security/security/authentication-authorization/json-web-tokens) method.
+
+After the JWT signature has been [validated](/basic-config-and-security/security/authentication-authorization/json-web-tokens), Tyk uses the **claims** within the token to determine which security policies (access rights, rate limits and quotas) should be applied to the request.
+
+From Tyk 5.10, Tyk can perform optional [validation](/api-management/authentication/jwt-claim-validation) of these claims.
+
+In this page, we explain how Tyk performs JWT authorization, including how it identifies the user and the policies to be applied.
+
+## JWT Authorization Flow
+
+When a request with a JWT arrives at Tyk Gateway, after the authentication (signature and claim validation) step, Tyk performs the following steps to authorize the request:
+
+1. **Identity Extraction**: The user identity is extracted from the token according to this order of precedence:
+   - The `kid` header (unless `skipKid` is enabled)
+   - A custom claim (specified in `subjectClaims`)
+   - The standard `sub` claim (fallback)
+
+2. **Policy Resolution**: Tyk determines which [Policy](/api-management/policies) to apply to the request:
+   - From scope-to-policy mapping
+   - From default policies
+
+3. **Update Session**: The [Session](/api-management/access-control/sessions-and-keys/understanding-sessions) is updated with the identity and policies.
+
+In the following sections, we provide a detailed explanation of each of these steps.
+
+## Identifying the Session Owner
+
+A unique identity is stored in the Session to associate it with the authenticated user. This identifier is extracted from the JWT by checking the following fields in order of precedence:
+
+1. The standard Key ID header (`kid`) in the JWT (unless the `skipKid` option is enabled)
+2. The subject identity claim identified by the value(s) stored in `subjectClaims` (which allows API administrators to designate any JWT claim as the identity source (e.g., user_id, email, etc.).
+
+    When multiple values are provided in the `subjectClaims` array, Tyk processes them as follows:
+
+    1. Tyk tries each claim **in the exact order they appear** in the array
+    2. For each claim, Tyk checks if:
+        - The claim exists in the token
+        - The claim value is a string and is not empty
+    3. Tyk uses the **first valid, non-empty value** it finds and stops processing further claims
+    4. If none of the claims yield a valid identity, Tyk proceeds to the next stage (the `sub` claim)
+
+    
+
+    <Note>
+    Prior to Tyk 5.10, the subject identity claim was retrieved from `identityBaseField`; see [using multiple identity providers](#using-multiple-identity-providers) for details and for the Tyk Classic API alternative.
+    </Note>
+
+
+3. The `sub` [registered claim](/api-management/authentication/jwt-claim-validation#registered-vs-custom-claims).
+
+**Example**
+
+In this example, `skipKid` has been set to `true`, so Tyk checks the `subjectClaims` and determines that the value in the custom claim `user_id` within the JWT should be used as the identity for the session object.
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          skipKid: true
+          subjectClaims: [user_id]
+```
+
+
+<Note>
+Session objects can be cached to improve performance, so the identity extraction is only performed on the first request with a JWT, or when the cache is refreshed.
+</Note>
+
+
+## Identifying the Tyk Policies to be applied
+
+[Policies](/api-management/policies) are applied (or mapped) to the Session to configure authorization for the request. Policies must be [registered](/api-management/access-control/policies/managing-policies#creating-policies) with Tyk, such that they have been allocated a unique [*Policy Id*](/api-management/access-control/policies/applying-policies#policy-ids).
+
+Tyk supports three different types of policy mapping, which are applied in this priority order:
+
+1. Direct policy mapping
+2. Scope policy mapping
+3. Default policy mapping
+
+### Direct policies
+
+You can optionally specify policies to be applied to the session via the *policy claim* in the JWT. This is a [Private](https://datatracker.ietf.org/doc/html/rfc7519#section-4.3) Claim (not a registered claim) and can be anything you want, but typically we recommend the use of `pol`. You must instruct Tyk where to look for the policy claim by configuring the `basePolicyClaims` field in the API definition.
+
+Note that we typically refer to Private Claims as Custom Claims.
+
+In this example, Tyk has been configured to check the `pol` claim in the JWT to find the *Policy Ids* for the policies to be applied to the session object:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          basePolicyClaims: [pol]
+```
+
+In the JWT, you should then provide the list of Tyk policy IDs as an array of values in that claim, for example you might declare:
+
+```
+  "pol": ["685a8af28c24bdac0dc21c28", "685bd90b8c24bd4b6d79443d"]
+```
+
+
+<Note>
+Prior to Tyk 5.10, the base policy claim was retrieved from `policyFieldName`; see [using multiple identity providers](#using-multiple-identity-providers) for details and for the Tyk Classic API alternative.
+</Note>
+
+
+### Default policies
+
+A *default policy* is a fallback option if no specific policies are identified from the JWT claims and prevents a session from being created with no authorization to interact with APIs on the Gateway.
+You **must** configure one or more default policies unless using [scope policies](/api-management/authentication/jwt-authorization#scope-policies).
+
+<Note>
+Prior to **Tyk 5.11.0** a default policy was required even when using scope policies.
+</Note>
+
+Default policies are configured using the `defaultPolicies` field in the API definition, which accepts a list of policy IDs.
+
+<Note>
+The Gateway will return `HTTP 403 Forbidden` if no default policies are configured (prior to Tyk 5.11 or if scope policies are not in use), if the referenced policies don’t exist, or if policies are invalid or incorrectly formatted.
+</Note>
+
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          defaultPolicies:
+            - 685a8af28c24bdac0dc21c28
+            - 685bd90b8c24bd4b6d79443d
+```
+
+### Scope policies
+
+Directly mapping policies to APIs relies on the sharing of Tyk Policy IDs with the IdP (so that they can be included in the JWT) and may not provide the required flexibility.
+
+Tyk supports a more advanced approach where policies are applied based on scopes declared in the JWT. This keeps separation between the IdP and Tyk-specific concepts, and supports much more flexible configuration.
+
+Within the JWT, you identify a Private Claim that will hold the authorization (or access) scopes for the API. You then provide, within that claim, a list of *scopes*. In your API definition, you configure the `scopes.claims` to instruct Tyk where to look for the scopes and then you declare a mapping of scopes to policies within the `scopes.scopeToPolicyMapping` object.
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          scopes:
+            scopeToPolicyMapping:
+              - scope: read: users
+                policyId: 685bd90b8c24bd4b6d79443d
+              - scope: write: users
+                policyId: 685a8af28c24bdac0dc21c28
+            claims: [accessScopes]
+```
+
+In this example, Tyk will check the `accessScopes` claim within the incoming JWT and apply the appropriate policy if that claim contains the value `read: users` or `write: users`. If neither scope is declared in the claim, or the claim is missing, the default policy will be applied.
+
+
+<Note>
+Prior to Tyk 5.10, the authorization scopes claim was retrieved from `scopes.claimName`; see [using multiple identity providers](#using-multiple-identity-providers) for details and for the Tyk Classic API alternative.
+</Note>
+
+
+#### Declaring Multiple Scopes
+
+You can declare multiple scopes by setting the value of the **authorization scopes claim** in one of the following ways:
+
+* **String with space-delimited list of values (standard format)**
+
+  ```json
+  "accessScopes": "read: users write: users"
+  ```
+
+* **Array of strings**
+
+  ```json
+  "accessScopes": ["read: users", "write: users"]
+  ```
+
+* **String with space-delimited list inside a nested key**
+
+  ```json
+  "accessScopes": { "access": "read: users write: users" }
+  ```
+
+* **Array of strings inside a nested key**
+
+  ```json
+  "accessScopes": { "access": ["read: users", "write: users"] }
+  ```
+
+**Important:**
+
+* If your scopes are defined inside a nested key, use **dot notation** for the `scopes.claims` value.
+
+  * For **examples 1 and 2**, set `scopes.claims` to:
+
+    ```
+    accessScopes
+    ```
+  * For **examples 3 and 4**, set `scopes.claims` to:
+
+    ```
+    accessScopes.access
+    ```
+
+**Example JWT fragment:**
+If this JWT is provided to an API configured as described above, Tyk will apply both policies to the session object.
+
+```json
+{
+  "sub": "1234567890",
+  "name": "Alice Smith",
+  "accessScopes": ["read: users", "write: users"]
+}
+```
+
+### Combining policies
+
+Where multiple policies are mapped to a session (for example, if several scopes are declared in the JWT claim, or if you set multiple *default policies*), Tyk will apply all the matching policies to the request, combining their access rights and using the most permissive rate limits and quotas. It's important when creating those policies to ensure that they do not conflict with each other.
+
+Policies are combined as follows:
+
+1. Apply direct-mapped policies declared via `basePolicyClaims`
+2. Apply scope-mapped policies declared in `scopeToPolicyMapping` based upon scopes in the JWT
+3. If no policies have been applied in steps 1 or 2, apply the default policies from `defaultPolicies`
+
+When multiple policies are combined, the following logic is applied:
+
+- **access rights** A user gets access to an endpoint if ANY of the applied policies grant access
+- **consumption limits** Tyk uses the most permissive values (highest quota, highest throughput )
+- **other settings** The most permissive settings from any policy are applied
+
+### Policy Best Practices
+
+When creating multiple policies that might be applied to the same JWT, we recommend using [partitioned policies](/api-management/access-control/policies/applying-policies#partitioned-policies) - policies that control specific aspects of API access rather than trying to configure everything in a single policy.
+
+For example:
+
+- Create one policy that grants read-only access to specific endpoints
+- Create another policy that grants write access to different endpoints
+- Create a third policy that sets specific rate limits
+
+To ensure these policies work correctly when combined:
+
+- Set `per_api` to `true` in each policy. This ensures that the policy's settings only apply to the specific APIs listed in that policy, not to all APIs globally.
+- Avoid listing the same `API ID` in multiple policies with conflicting settings. Instead, create distinct policies with complementary settings that can be safely combined.
+
+
+## Session Updates
+
+After authenticating the token and extracting the necessary identity and policy information, Tyk creates or updates a session object that controls access to the API.
+
+The following [session attributes](/api-management/access-control/sessions-and-keys/understanding-sessions#configuration-options) are modified based on the Policies:
+
+1. **Access Rights**: Determines which API endpoints the token can access
+2. **Rate Limits**: Controls how many requests per second/minute the token can make
+3. **Quotas**: Sets the maximum number of requests allowed in a time period
+4. **Metadata**: Custom metadata from the policies is added to the session
+5. **Tags**: Policy tags are added to the session
+
+In addition to updating the session, Tyk extracts claims from the JWT and makes them available as context variables for use in other [middleware](/api-management/traffic-transformation).
+
+
+<Note>
+When a JWT's claims change (for example, by configuring different scopes or policies), Tyk updates the session with the new policies on the subsequent request made with the token.
+</Note>
+
+
+## Advanced Configuration
+
+### Using Multiple Identity Providers
+
+When using multiple Identity Providers (IdPs), you may need to check different claim locations for the same information. Tyk supports definition of **multiple claim locations** for subject identity and policy IDs.
+
+* **Before Tyk 5.10 (and for Tyk Classic APIs):**
+
+  * The Gateway could only check **single claims** for:
+
+    * Subject identity
+    * Base policy
+    * Scope-to-policy mapping
+  * This setup didn’t support multiple IdPs using different claim names (e.g **Keycloak** uses `scope` and **Okta** uses `scp`)
+
+* **From Tyk 5.10 onwards (Tyk OAS APIs):**
+
+  * You can configure **multiple claim names** for:
+
+    * Subject identity
+    * Base policy
+    * Scope-to-policy mapping
+  * This allows Tyk to locate data across various tokens and IdPs more flexibly.
+
+**Configuration summary:**
+
+| API Configuration Type | Tyk Version | Subject Identity Locator  | Base Policy Locator     | Scope-to-Policy Mapping Locator |
+| :---------------------- | :----------- | :------------------------- | :----------------------- | :------------------------------- |
+| Tyk OAS                | pre-5.10    | `identityBaseField`       | `policyFieldName`       | `scopes.claimName`              |
+| Tyk OAS                | 5.10+       | `subjectClaims`           | `basePolicyClaims`      | `scopes.claims`                 |
+| Tyk Classic            | all         | `jwt_identity_base_field` | `jwt_policy_field_name` | `jwt_scope_claim_name`          |
+
+**Example configuration:**
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          # Legacy single field (still supported)
+          identityBaseField: "sub"
+          
+          # New multi-location support (Tyk 5.10+)
+          subjectClaims:
+            - "sub"
+            - "username"
+            - "user_id"
+```
+
+#### Backward Compatibility
+
+The new configuration is fully backward compatible:
+
+- Existing `identityBaseField`, `policyFieldName`, and `scopes.claimName` settings continue to work
+- If both old and new fields are specified, the new fields take precedence
+- When using only new fields, the first element in each array is used to set the corresponding legacy field for backward compatibility
+
diff --git a/api-management/authentication/jwt-claim-validation.mdx b/api-management/authentication/jwt-claim-validation.mdx
new file mode 100644
index 0000000000..f575ffbd05
--- /dev/null
+++ b/api-management/authentication/jwt-claim-validation.mdx
@@ -0,0 +1,813 @@
+---
+title: "JWT Claim Validation"
+description: "Tyk Gateway's JWT Claim Validation enables fine-grained access control by validating registered and custom claims in JSON Web Tokens."
+keywords: "Authentication, JWT, JSON Web Tokens, Claims, Validation"
+sidebarTitle: "Claim Validation"
+---
+
+## Availability
+
+| Component   | Editions |
+| :------------- | :------------------------- |
+| Tyk Gateway | Community and Enterprise |
+
+## Introduction
+
+A JSON Web Token consists of three parts separated by dots: `header.payload.signature`. The payload contains the claims, a set of key-value pairs that carry information about the token and its subject.
+
+Tyk can validate these claims to ensure that incoming JWTs meet your security requirements before granting access to your APIs.
+
+By validating JWT claims, you can enforce fine-grained access control policies, ensure tokens originate from trusted sources, and verify that users have the appropriate permissions for your APIs.
+
+
+<Note>
+**Viewing JWT Claims**
+
+To inspect the claims in a JWT, use online tools like [jwt.io](https://jwt.io) for quick debugging
+</Note>
+
+
+{/* ## Quick Start */}
+
+## JWT Claims Fundamentals
+
+### Registered vs Custom Claims
+
+JWT claims can be categorized into two types:
+
+- **Registered Claims**:
+
+    Registered Claims are standardized by the JWT specification ([RFC 7519](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1)) and have predefined meanings.
+
+    These claims are further grouped into:
+
+    - **Temporal Claims:** time-based validation
+    - **Identity Claims:** content-based validation
+
+    | Claim | Name            | Purpose                                  | Type     |
+    | ----- | --------------- | ---------------------------------------- | -------- |
+    | `iss` | Issuer          | Identifies who issued the token          | Identity |
+    | `aud` | Audience        | Identifies who the token is intended for | Identity |
+    | `sub` | Subject         | Identifies the subject of the token      | Identity |
+    | `exp` | Expiration Time | When the token expires                   | Temporal |
+    | `iat` | Issued At       | When the token was issued                | Temporal |
+    | `nbf` | Not Before      | When the token becomes valid             | Temporal |
+    | `jti` | JWT ID          | Unique identifier for the token          | Identity |
+
+- **Custom Claims**:
+
+  Custom Claims, referred to as Private Claims in the [JWT Specification](https://datatracker.ietf.org/doc/html/rfc7519#section-4.3), are application-specific and can contain any information relevant to your use case, such as user roles, permissions, department, or metadata.
+
+**Example JWT Payload with Both Registered and Custom Claims**:
+
+```json
+{
+  // Registered claims
+  "iss": "https://auth.company.com",
+  "aud": "api.company.com", 
+  "sub": "user123",
+  "exp": 1735689600,
+  "iat": 1735603200,
+
+  // Custom claims
+  "department": "engineering",
+  "role": "admin"
+}
+```
+
+### Supported Claims and API Types
+
+| Claim Category        | Sub-Category                              | Tyk OAS APIs | Tyk Classic APIs | Version |
+| :--------------------- | :----------------------------------------- | :------------------------- | :----------------------------- | :------------------ |
+| **Registered Claims** | **Temporal** (`exp`, `iat`, `nbf`)        | ✅ Yes                     | ✅ Yes                         | All versions       |
+| **Registered Claims** | **Identity** (`iss`, `aud`, `sub`, `jti`) | ✅ Yes                     | ❌ Yes                         | 5.10+       |
+| **Custom Claims**     | —                                         | ✅ Yes                     | ❌ No                         | 5.10+       |
+
+### How Tyk Processes JWT Claims
+
+After [verifying](/basic-config-and-security/security/authentication-authorization/json-web-tokens) that the token hasn't been tampered with, Tyk processes claims in this order:
+
+1. **Claims Extraction**: All claims from the JWT payload are extracted and stored in [context variables](/api-management/traffic-transformation/request-context-variables) with the format `jwt_claims_CLAIMNAME`. For example, a claim named `role` becomes accessible as `jwt_claims_role`.
+
+2. **Claims Validation**:
+   - [Registered Claims Validation](#registered-claims-validation): Checks standard claims against your configuration
+   - [Custom Claims Validation](#custom-claims-validation): Applies your business rules to custom claims
+   - [Authorization](/api-management/authentication/jwt-authorization): Uses validated claims to determine API access and apply policies
+
+If any validation step fails, Tyk rejects the request with a specific error message indicating which claim validation failed and why.
+
+## Registered Claims Validation
+
+[Registered Claims](#registered-vs-custom-claims) are grouped into:
+- **Temporal claims** (time-based validation): Supported in both Tyk Classic APIs and OAS APIs
+- **Identity claims** (content-based validation): Available only in Tyk OAS APIs
+
+### Temporal Claims
+
+Temporal claims define the validity period of a JWT. Tyk automatically validates these claims when present in the token.
+
+- **Expiration Time (exp)**: the `exp` claim specifies when the token expires (as a Unix timestamp). Tyk rejects tokens where the current time is after the expiration time.
+- **Issued At (iat)**: the `iat` claim specifies when the token was issued. Tyk rejects tokens that claim to be issued in the future.
+- **Not Before (nbf)**: the `nbf` claim specifies the earliest time the token can be used. Tyk rejects tokens before this time.
+
+#### Clock Skew Configuration
+
+Due to the nature of distributed systems, you may encounter clock skew between your Identity Provider and Tyk servers. You can configure tolerance for timing differences:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          issuedAtValidationSkew: 5      # Allow tokens issued up to 5 seconds in the future
+          notBeforeValidationSkew: 2     # Allow tokens to be valid 2 seconds early
+          expiresAtValidationSkew: 2     # Allow tokens to be valid 2 seconds past expiration
+```
+
+- `expiresAtValidationSkew` allows recently expired tokens to be considered valid
+- `issuedAtValidationSkew` allows tokens claiming future issuance to be valid
+- `notBeforeValidationSkew` allows tokens to be valid before their `nbf` time
+
+
+
+    <Note>
+    Temporal claim validation and the associated clock skew controls were supported by Tyk before 5.10.0 and also for [Tyk Classic APIs](/api-management/gateway-config-tyk-classic#configuring-authentication-for-tyk-classic-apis)
+    </Note>
+
+
+### Identity Claims
+
+Identity claims provide information about the token's origin and intended use. Unlike temporal claims, these require explicit configuration to enable validation.
+
+#### Issuer Validation (iss)
+
+Validates that a trusted Identity Provider issued the token:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          allowedIssuers:
+            - "https://auth.company.com"
+            - "https://auth.partner.com"
+```
+
+Tyk accepts tokens if the `iss` claim matches any configured issuer. If `allowedIssuers` is empty, no issuer validation is performed.
+
+#### Audience Validation (aud)
+
+Validates that the token is intended for your API:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          allowedAudiences:
+            - "api.company.com"
+            - "mobile-app"
+```
+
+The `aud` claim can be a string or an array. Tyk accepts tokens if any audience value matches any configured audience. If `allowedAudiences` is empty, no audience validation is performed.
+
+#### Subject Validation (sub)
+
+Validates the token subject against allowed values:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          allowedSubjects:
+            - "user"
+            - "service-account"
+            - "admin"
+```
+
+Useful for restricting API access to specific types of subjects or known entities. If `allowedSubjects` is empty, no subject validation is performed.
+
+#### JWT ID Validation (jti)
+
+Validates that the token contains a unique identifier:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          jtiValidation:
+            enabled: true
+```
+
+When enabled, Tyk requires the `jti` claim to be present. This is useful for token tracking and revocation scenarios. Note that Tyk does not perform any validation on the content of the claim, only that it is present.
+
+### Configuration Examples
+
+Basic registered claims validation:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          allowedIssuers: ["https://auth.company.com"]
+          allowedAudiences: ["api.company.com"]
+          jtiValidation:
+            enabled: true
+          expiresAtValidationSkew: 5
+```
+
+Multi-IdP configuration:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          allowedIssuers:
+            - "https://auth0.company.com"
+            - "https://keycloak.company.com"
+          allowedAudiences:
+            - "api.company.com"
+            - "mobile.company.com"
+          subjectClaims: ["sub", "username"]
+```
+
+In this example, we expect one Identity Provider to present the subject in the `sub` claim, and the other to present it in the `username` claim.
+
+## Custom Claims Validation
+
+Custom claims validation allows you to enforce business-specific rules on JWT tokens beyond the standard registered claims.
+
+**Use Cases**:
+
+- **Role-based access control**: Validate that users have required roles (for example, `admin`, `editor`, `viewer`)
+- **Department restrictions**: Ensure users belong to authorized departments
+- **Feature flags**: Check if users have access to specific features or API endpoints
+- **Geographic restrictions**: Validate user location or region-based access
+- **Subscription tiers**: Enforce access based on user subscription levels
+
+### Validation Types
+
+The custom claims validation supports three distinct validation types. These validation types can be applied to any custom claim in your JWT tokens, providing flexible control over your authorization logic.
+
+#### Required
+
+Required type validation ensures that a specific claim exists in the JWT token, regardless of its value.
+
+**Use Cases:**
+
+- Ensuring user metadata is present (even if empty)
+- Validating that required organizational fields exist
+- Confirming compliance with token structure requirements
+
+**Behavior:**
+
+- ✅ **Passes** if the claim exists with any non-null value (including empty strings, arrays, or objects)
+- ❌ **Fails** if the claim is missing or explicitly set to `null`
+
+**Example Configuration:**
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            department:
+              type: required
+            user_metadata:
+              type: required
+```
+
+#### Exact Match
+
+Exact match type validation verifies that a claim's value exactly matches one of the specified allowed values.
+
+**Use Cases:**
+
+- Role validation (e.g., `admin`, `editor`, `viewer`)
+- Environment-specific access (e.g., `production`, `staging`, `development`)
+- Subscription tier validation (e.g., `premium`, `standard`, `basic`)
+- Boolean flag validation (`true`, `false`)
+
+**Behavior:**
+
+- ✅ Passes if the claim value exactly matches any value in the allowedValues array
+- ❌ Fails if the claim value doesn't match any allowed value, if the claim is missing, or if allowedValues is empty
+- Case-sensitive for string comparisons
+- Type-sensitive (string "true" ≠ boolean true)
+
+**Example Configuration:**
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            role:
+              type: exact_match
+              allowedValues:
+              - admin
+              - editor
+              - viewer
+            subscription_tier:
+              type: exact_match
+              allowedValues:
+              - premium
+              - standard
+```
+
+#### Contains
+
+The Contains type validation checks whether a claim's value contains or includes one of the specified values. This validation type works differently depending on the data type of the claim and is particularly useful for array-based permissions and substring matching.
+
+**Use Cases:**
+
+- Permission arrays (`["read: users", "write: posts", "admin: system"]`)
+- Tag-based access control
+- Partial string matching for departments or locations
+- Multi-value scope validation
+
+**Behavior by Data Type:**
+
+Arrays:
+- ✅ Passes if the array contains any of the specified values
+- ❌ Fails if none of the specified values are found in the array
+
+Strings:
+- ✅ Passes if the string contains any of the specified substrings
+- ❌ Fails if none of the specified substrings are found
+
+Other Types:
+- Converts to a string and performs substring matching
+
+Example Configuration:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            permissions:
+              type: contains
+              allowedValues:
+              - admin: system
+              - write:api
+            department_code:
+              type: contains
+              allowedValues:
+              - ENG
+              - SALES
+```
+
+With this configuration, a token might contain these claims:
+
+```json
+{
+  "permissions": ["read: users", "write: posts", "admin: system"],
+  "department_code": "ENG-BACKEND",
+}
+```
+
+In this example:
+- `permissions` validation passes because the array contains `"admin: system"`
+- `department_code` validation passes because the string contains `"ENG"`
+
+### Data Type Support
+
+The framework is designed to handle the diverse data types commonly found in JWT tokens. The validation behavior adapts intelligently based on the actual data type of each claim, ensuring robust and predictable validation across different token structures.
+
+#### Supported Data Types
+
+##### String Values
+
+String claims are the most common type in JWT tokens and support all three validation types with intuitive behavior.
+
+**Validation behavior**
+
+- **Required**: Passes if the string exists (including empty strings `""`)
+- **Exact Match**: Performs case-sensitive string comparison
+- **Contains**: Checks if the string contains any of the specified substrings
+
+**Example**
+
+Claims:
+
+```json
+{
+  "department": "Engineering",
+  "user_id": "user123",
+  "email": "john.doe@company.com"
+}
+```
+
+Validation configuration:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            department:
+              type: exact_match
+              allowedValues:
+              - Engineering
+              - Sales
+              - Marketing
+            email:
+              type: contains
+              allowedValues:
+              - "@company.com"
+              - "@partner.com"
+```
+
+##### Numeric Values
+
+Numeric claims (integers and floating-point numbers) are validated with type-aware comparison logic.
+
+**Validation behavior**
+
+- **Required**: Passes if the number exists (including `0`)
+- **Exact Match**: Performs numeric equality comparison (`42` matches `42.0`)
+- **Contains**: Converts to a string and performs substring matching
+
+**Example**
+
+Claims:
+
+```json
+{
+  "user_level": 5,
+  "account_balance": 1250.75,
+  "login_count": 0
+}
+```
+
+Validation configuration:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            user_level:
+              type: exact_match
+              allowedValues:
+              - 1
+              - 2
+              - 3
+              - 4
+              - 5
+            account_balance:
+              type: required
+```
+
+##### Boolean Values
+
+Boolean claims are commonly used for feature flags and permission toggles.
+
+**Validation Behavior**
+
+- **Required**: Passes if the boolean exists (`true` or `false`)
+- **Exact Match**: Performs strict boolean comparison
+- **Contains**: Converts to string (`"true"` or `"false"`) and performs substring matching
+
+**Example**
+
+Claims:
+
+```json
+{
+  "is_admin": true,
+  "email_verified": false,
+  "beta_features": true
+}
+```
+
+Validation configuration:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            is_admin:
+              type: exact_match
+              allowedValues:
+              - true
+            email_verified:
+              type: required
+```
+
+##### Array Values
+
+Arrays are particularly powerful for permission systems and multi-value attributes.
+
+**Validation behavior**
+
+- **Required**: Passes if the array exists (including empty arrays `[]`)
+- **Exact Match**: Checks if the entire array exactly matches one of the allowed arrays
+- **Contains**: Checks if the array contains any of the specified values (most common use case)
+
+**Example**
+
+Claims:
+
+```json
+{
+  "roles": ["user", "editor"],
+  "permissions": ["read: posts", "write: posts", "delete: own"],
+  "departments": ["engineering", "product"],
+  "tags": []
+}
+```
+
+Validation configuration:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            permissions:
+              type: contains
+              allowedValues:
+              - write: posts
+              - admin: system
+            roles:
+              type: contains
+              allowedValues:
+              - admin
+              - editor
+              - moderator
+            tags:
+              type: required
+```
+
+##### Object Values
+
+Complex object claims can be validated, though typically you'll want to validate specific nested properties using [dot notation](#nested-claims).
+
+**Validation Behavior**
+
+- **Required**: Passes if the object exists (including empty objects `{}`)
+- **Exact Match**: Performs deep object comparison (rarely used)
+- **Contains**: Converts to a JSON string and performs substring matching
+
+**Example**
+
+Claims:
+
+```json
+{
+  "user_metadata": {
+    "department": "Engineering",
+    "level": 5,
+    "location": "US"
+  },
+  "preferences": {}
+}
+```
+
+Configuration:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            user_metadata:
+              type: required
+            preferences:
+              type: required
+```
+
+##### Type Coercion and Edge Cases
+
+**Null and Undefined Values**
+
+- null values: Always fail validation (treated as missing)
+- undefined/missing claims: Fail all validation types except when validation is not configured
+
+**Mixed-Type Arrays**
+
+Arrays containing different data types are supported. The `contains` validation will attempt to match values using appropriate type comparison,
+
+```json
+{
+  "mixed_permissions": ["read", 42, true, "admin"]
+}
+```
+
+**Type Mismatches**
+
+When the expected value type doesn't match the claim type, Tyk performs intelligent conversion:
+
+- Numbers to strings: `42` becomes `"42"`
+- Booleans to strings: `true` becomes "`true"`
+- Objects/arrays to strings: Converted to JSON representation
+
+##### Best Practices
+
+- Be Explicit About Types: When configuring `allowedValues`, use the same data type as expected in the token
+- Use Arrays for Multi-Value Validation: Prefer array-based claims for permissions and roles
+- Consider Empty Values: Remember that empty strings, arrays, and objects pass `required` validation
+- Test Type Coercion: Verify behavior when token types don't match expected types
+
+### Nested Claims
+
+JSON Web Tokens often contain complex, hierarchical data structures with nested objects and arrays. Tyk's custom claims validation framework supports validating nested claim structures using dot notation syntax.
+
+**Basic Syntax:**
+
+- `user.name` - Access the `name` property within the `user` object
+- `permissions.0.resource` - Access the `resource` property of the first element in the `permissions` array
+
+
+
+    <Note>
+    **Dot Notation** 
+
+    Tyk uses [gjson](https://github.com/tidwall/gjson) to parse dot notation paths.
+    </Note>
+
+
+#### Nested Object Validation
+
+The most common use case for dot notation is validating properties within nested objects, such as user metadata, organizational information, or configuration settings.
+
+**Example Token**
+
+```json
+{
+  "user": {
+    "name": "John Doe",
+    "email": "john.doe@company.com",
+    "profile": {
+      "department": "Engineering",
+      "level": "senior",
+      "location": {
+        "country": "US",
+        "region": "West"
+      }
+    }
+  }
+}
+```
+
+You could set the following configuration to validate the requester's department and level:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            user.profile.department:
+              type: exact_match
+              allowedValues:
+                - Engineering
+                - Sales
+                - Marketing
+            user.profile.level:
+              type: contains
+              allowedValues:
+                - senior
+                - lead
+                - principal
+```
+
+
+#### Nested Array Validation
+
+Arrays are commonly used in JWT claims to represent lists of permissions, roles, or other multi-value attributes. Tyk supports validating specific elements within arrays using dot notation with numeric indices.
+
+**Example Token**
+
+```json
+{
+  "permissions": [
+    {
+      "resource": "users",
+      "actions": ["read", "write"]
+    },
+    {
+      "resource": "reports",
+      "actions": ["read"]
+    }
+  ]
+}
+```
+
+You can validate specific array elements:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            "permissions.0.resource":
+              type: exact_match
+              allowedValues: ["users"]
+            "permissions.1.actions.0":
+              type: exact_match
+              allowedValues: ["read"]
+```
+
+
+<Note>
+**Dot Notation** 
+
+When a nested path doesn't exist (e.g., `user.profile.level` but `profile` doesn't exist) or when an array index is out of bounds (e.g., `permissions.999.resource`), the claim is treated as missing. This will cause validation to fail for blocking rules or generate a warning for non-blocking rules.
+</Note>
+
+
+#### Recommendations
+
+Test your nested claim validation rules with representative JWT tokens to ensure they behave as expected. Use online tools like [gjson.dev](https://gjson.dev/) to experiment with dot notation paths and verify they correctly access the desired values.
+
+### Non-blocking Validation
+
+Non-blocking validation allows JWT claims to fail validation with a warning logged, while still permitting the request to proceed.
+
+This behavior allows you to:
+
+- Monitor how new validation rules would affect traffic without disrupting users
+- Gradually roll out stricter validation requirements
+- Debug validation issues in production environments
+
+#### How Non-blocking Validation Works
+
+When configured, a validation rule can be set to "non-blocking" mode, which means:
+
+1. If validation passes, the request proceeds normally
+2. If validation fails, instead of rejecting the request:
+   - A warning is logged to the Tyk Gateway log file at the `WARN` log level
+   - The validation process continues to evaluate other custom claims
+   - The request is allowed to proceed to the upstream API
+
+#### Configuring Non-Blocking Mode
+
+Non-blocking mode can be configured for any custom claim validation rule with the addition of the boolean `nonBlocking` flag, for example:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          customClaimValidation:
+            user.profile.department:
+              type: exact_match
+              allowedValues:
+                - Engineering
+                - Sales
+                - Marketing
+            user.preferences.notifications:
+              type: required
+              nonBlocking: true
+```
+
+The `nonBlocking` flag in the validation rule for `user.preferences.notifications` means that if this claim is missing from the received token, the token will not fail validation, but a warning will be logged.
+
+## FAQ
+
+<AccordionGroup>
+
+<Accordion title='Can I restrict which issuers tokens are accepted?'>
+Yes, you can configure `AllowedIssuers` to specify which iss (issuer) claim values are accepted. Tokens from other issuers will be rejected.
+</Accordion>
+
+<Accordion title='How can I validate custom claims in the JWT?'>
+Use the `CustomClaimValidation` configuration to validate specific claims with different validation types (Required, ExactMatch, or Contains).
+</Accordion>
+
+</AccordionGroup>
\ No newline at end of file
diff --git a/api-management/authentication/jwt-quick-start.mdx b/api-management/authentication/jwt-quick-start.mdx
new file mode 100644
index 0000000000..5afd1473ad
--- /dev/null
+++ b/api-management/authentication/jwt-quick-start.mdx
@@ -0,0 +1,95 @@
+---
+title: "JWT Quick Start: Securing APIs with Auth0 or Keycloak"
+description: "Learn how to secure your Tyk OAS APIs using JWT authentication with Auth0 or Keycloak as identity providers."
+keywords: "Authentication, JWT, JSON Web Tokens, Quick Start"
+sidebarTitle: "Quick Start"
+---
+
+In this tutorial, we'll secure a Tyk OAS API using JWT authentication with either Auth0 or Keycloak as the identity provider.
+
+<Note>
+If you want to try out JWT Auth without linking up to a third-party IdP then you can skip step 1 and provide the base64 encoded public key for your JWT (in the `source` field rather than configuring `jwksURIs`) in step 3. You'll need to generate a JWT for the request, but otherwise everything stays the same. 
+
+Now back to the tutorial...
+</Note>
+
+We'll start by configuring the identity provider, then set up JWT validation in Tyk, create a security policy, configure the API to use the policy, and finally test the secured API with a valid token.
+
+### Prerequisites
+
+- A Tyk installation (Cloud or Self-Managed) with Tyk Dashboard license
+- An Auth0 account or Keycloak installation
+- An existing Tyk OAS API (see [this tutorial](/api-management/gateway-config-managing-oas#using-tyk-dashboard-api-designer-to-create-an-api))
+- Postman, cURL, or another API testing tool
+
+### Step-by-Step Guide
+
+1. **Configure Your Identity Provider to obtain your JWKS URI**
+
+    The first step is to configure your Identity Provider (IdP) to issue JWTs and provide a JWKS URI that Tyk can use to validate the tokens. Below are instructions for both Auth0 and Keycloak.
+
+    <Tabs>
+    <Tab title="Auth0 Setup">
+
+    1. Log in to your Auth0 dashboard
+    2. Navigate to Applications > APIs and click Create API
+    3. Enter a name and identifier (audience) for your API
+    4. Note your Auth0 domain (e.g. `your-tenant.auth0.com`)
+    5. Your JWKS URI will be: `https://your-tenant.auth0.com/.well-known/jwks.json`
+
+    </Tab>
+
+    <Tab title="Keycloak Setup">
+
+    1. Log in to your Keycloak admin console
+    2. Create or select a realm (e.g. `tyk-demo`)
+    3. Navigate to Clients and create a new client with:
+          - Client ID: `tyk-api-client`
+          - Client Protocol: `openid-connect`
+          - Access Type: `confidential`
+    4. After saving, go to the Installation tab and select "OIDC JSON" format
+    5. Your JWKS URI will be: `http://your-keycloak-host/realms/tyk-demo/protocol/openid-connect/certs`
+
+    </Tab>
+
+    </Tabs>
+
+2. **Create a Security Policy**
+
+    1. In the Tyk Dashboard, navigate to **Policies**
+    2. Click **Add Policy**
+    3. Configure the policy:
+          - Name: `JWT Auth Policy`
+          - APIs: Select your Tyk OAS API
+          - Access Rights: Configure appropriate paths and methods
+          - Authentication: Select JWT
+          - JWT Scope Claim Name: Enter the JWT claim that contains scopes (e.g. `scope` or `permissions`)
+          - Required Scopes: Add any required scopes for access (optional)
+    4. Click Create to save your policy
+
+3. **Configure JWT Authentication in Tyk OAS API**
+
+    1. Navigate to APIs and select your API
+    2. Click **Edit**
+    3. Enable **Authentication** in the **Server** section, select **JSON Web Token (JWT)** as the authentication method
+    4. Configure the JWT settings:
+          - Token Signing Method: Select `RSA Public Key`
+          - Subject identity claim: Set to `sub`
+          - JWKS Endpoint: Enter your JWKS URI for your IdP obtained in step 1
+          - Policy claim: Set to `pol`
+          - Default policy: Select `JWT Auth Policy` (the policy you created previously)
+          - Clock Skew (optional): Set to accommodate time differences (e.g. `10`)
+          - Authentication Token Location: `header`
+          - Header Name: `Authorization`
+          - Strip Authorization Data: `Enabled`
+    5. Click **Save API**
+
+4. **Test your API**
+
+    1. Obtain a JWT from your IdP
+    2. Make a request to your API providing the JWT as a Bearer token in the `Authorization` header; Tyk will validate the JWT using the JWKS that it retrieves from your JWKS URI
+    3. Observe that the request is successful
+
+    ```bash
+        curl -X GET {API URL}  -H "Accept: application/json" -H "Authorization: Bearer {token}"
+    ```
\ No newline at end of file
diff --git a/api-management/authentication/jwt-signature-validation.mdx b/api-management/authentication/jwt-signature-validation.mdx
new file mode 100644
index 0000000000..4267493d8a
--- /dev/null
+++ b/api-management/authentication/jwt-signature-validation.mdx
@@ -0,0 +1,301 @@
+---
+title: JWT Signature Validation
+description: How to validate JWT signatures in Tyk API Gateway.
+keywords: ["Authentication", "JWT", "JSON Web Tokens", "Signature", "Validation"]
+sidebarTitle: "Signature Validation"
+---
+
+## Availability
+
+| Component   | Editions                 |
+| ----------- | ------------------------ |
+| Tyk Gateway | Community and Enterprise |
+
+## Introduction
+
+A JSON Web Token consists of three parts separated by dots: `header.payload.signature`. The signature verifies that the sender of the JWT is who it claims to be and that the message wasn't altered along the way.
+
+Tyk can validate the signature of incoming JWTs to ensure that they meet your security requirements before granting access to your APIs.
+
+## JWT Signature Fundamentals
+
+The JWT signature serves three main purposes:
+
+1. **Integrity:**
+   If anyone modifies the header or payload, the signature will no longer match.
+
+2. **Authenticity:**
+   Confirms that the token was issued by a trusted source.
+
+3. **Security:**
+   Prevents malicious users from forging tokens or altering claims.
+
+### How JWT Signatures Are Created
+
+The JWT signature is created by taking the encoded header, the encoded payload, a secret, and the algorithm specified in the header.
+
+**Example**:
+
+```
+HMACSHA256(
+  base64UrlEncode(header) + "." + base64UrlEncode(payload),
+  secret
+)
+```
+
+Or, for asymmetric algorithms like RSA or ECDSA:
+
+```
+RSASHA256(
+  base64UrlEncode(header) + "." + base64UrlEncode(payload),
+  private_key
+)
+```
+
+### Verification Process
+
+When Tyk receives a JWT, it performs the following steps to validate the signature:
+
+1. It extracts the header and payload.
+2. Recomputes the signature using its own secret/public key.
+3. Compares it with the token’s signature.
+   * If they match, the token is valid.
+   * If not, the token is rejected.
+
+## Supported Algorithms for Signature Validation
+
+| Method    | Cryptographic Style | Secret Type   | Supported Algorithms                                 |
+| --------- | ------------------- | ------------- | ---------------------------------------------------- |
+| **HMAC**  | Symmetric           | Shared secret | `HS256`, `HS384`, `HS512`                            |
+| **RSA**   | Asymmetric          | Public key    | `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512` |
+| **ECDSA** | Asymmetric          | Public key    | `ES256`, `ES384`, `ES512`                            |
+
+## Configuration Options
+
+Tyk supports two approaches to supplying the key or secret used to validate incoming JWTs:
+
+- **[Identity Provider](#identity-providers) (IdP)**: Tyk fetches public keys from a JWKS endpoint exposed by the IdP. The IdP can be configured centrally in the Identity Provider Registry, or directly in the API definition.
+- **[Local Keys](#local-keys)**: The key or secret is supplied directly in the API definition, either as a hard-coded value or as a reference to an external secret store.
+
+### Identity Providers
+
+An Identity Provider (IdP) issues JWTs and exposes a JWKS endpoint where Tyk fetches the public keys needed to validate token signatures. The IdP can be configured centrally in the [Identity Provider Registry](/api-management/client-idp-registry), or directly in the API definition.
+
+#### Feature Compatibility Summary
+
+| Feature                                            | Tyk Classic APIs | Tyk OAS APIs | Available From      |
+| -------------------------------------------------- | ---------------- | ------------ | ------------------- |
+| Identity Provider Registry (recommended)           | ✅               | ✅           | 5.14.0 (Enterprise) |
+| Single JWKS endpoint in API definition             | ✅               | ✅           | All versions        |
+| Multiple JWKS endpoints in API definition          | ❌               | ✅           | 5.9.0               |
+
+#### Identity Provider Registry
+
+The [Identity Provider Registry](/api-management/client-idp-registry) is a centralized store for IdP configuration (JWKS endpoints, scope claim names, and [scope-to-policy mappings](/api-management/authentication/jwt-authorization#scope-policies)) managed independently of API definitions in the Tyk Dashboard. Available from **Tyk 5.14.0** (Enterprise), it is the recommended approach when using Dynamic Client Registration or when multiple systems need to manage IdP configuration for the same API.
+
+Adopting the registry is a non-breaking change: existing API definitions are unaffected.
+
+#### Configuring IdPs in the API Definition
+
+If you are not using the Identity Provider Registry, JWKS endpoints can be configured directly in the API definition.
+
+**Multiple JWKS Endpoints**
+
+From **Tyk 5.9.0** onwards, Tyk OAS APIs can validate against multiple JWKS endpoints, allowing different IdPs to issue JWTs for the same API.
+
+Multiple JWKS endpoints can be configured in the `<jwtAuthScheme>.jwksURIs` array. Tyk retrieves the JSON Web Key Sets from each endpoint and uses them to attempt to validate the received JWT.
+
+For example, the following fragment configures the JWT authentication middleware to retrieve the JWKS from both Auth0 and Keycloak when validating the signature of incoming JWTs:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          jwksURIs:
+            - url: https://your-tenant.auth0.com/.well-known/jwks.json
+            - url: http://your-keycloak-host/realms/tyk-demo/protocol/openid-connect/certs
+```
+
+<Note>
+Multiple JWKS endpoints and the `jwksURIs` array are not supported by Tyk Classic APIs.
+</Note>
+
+**Single JWKS Endpoint**
+
+If using Tyk Classic APIs, or Tyk OAS APIs on versions before 5.9.0, a single JWKS endpoint can be configured in `server.authentication.securitySchemes.<jwtAuthScheme>.source` (in Tyk Classic, this is [jwt_source](/api-management/gateway-config-tyk-classic#configuring-authentication-for-tyk-classic-apis)). This field accepts the base64-encoded full URI (including the protocol) of the JWKS endpoint.
+
+For example, the following Tyk OAS fragment configures the JWT authentication middleware to retrieve the JWKS from `https://your-tenant.auth0.com/.well-known/jwks.json`:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          source: aHR0cHM6Ly95b3VyLXRlbmFudC5hdXRoMC5jb20vLndlbGwta25vd24vandrcy5qc29u
+```
+
+<Note>
+The `<jwtAuthScheme>.source` URIs must be base64 encoded in the API definition.
+
+If both `<jwtAuthScheme>.source` and `<jwtAuthScheme>.jwksURIs` are configured, the latter will take precedence.
+</Note>
+
+### Local Keys
+
+The key or secret used to validate JWTs can be supplied directly in the API definition via `server.authentication.securitySchemes.<jwtAuthScheme>.source` (in Tyk Classic, this is [jwt_source](/api-management/gateway-config-tyk-classic#configuring-authentication-for-tyk-classic-apis)). The value must be base64 encoded.
+
+This approach supports both symmetric (HMAC shared secret) and asymmetric (RSA/ECDSA public key) algorithms.
+
+Rather than hard-coding the value, the recommended approach is to store the key or secret in an [external secret store](/tyk-configuration-reference/kv-store) such as Consul or Vault, and place a KV reference in `source` instead. The reference is base64 encoded in the same way as a hard-coded value.
+
+For example, the following fragment hard-codes the secret `mysecret`:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          source: bXlzZWNyZXQ=  # base64("mysecret")
+```
+
+The following fragment uses a Consul KV reference instead, keeping the secret out of the API definition:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          source: Y29uc3VsOi8vc2VjcmV0cy9qd3Qtc2VjcmV0  # base64("consul://secrets/jwt-secret")
+```
+
+Refer to the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#jwt) reference for details.
+
+## JWKS Caching
+
+Tyk caches public keys fetched from Identity Providers to reduce the performance impact of contacting external services during request handling.
+
+### Feature Compatibility Summary
+
+| Feature                        | Tyk Classic | Tyk OAS | Available From |
+| ------------------------------ | ----------- | ------- | -------------- |
+| Configurable cache timeout     | ✅          | ✅      | Tyk 5.12.0+    |
+| Per-IdP cache timeout          | ❌          | ✅      | Tyk 5.10.0+    |
+| Pre-fetch on API load          | ❌          | ✅      | Tyk 5.10.0+    |
+| Cache management API           | ✅          | ✅      | Tyk 5.10.0+    |
+
+### Configuration Options
+
+#### Gateway-Level Configuration
+
+Unless otherwise configured, all cached keys expire after 240 seconds, after which the cache is refreshed when a new request is received.
+
+From **Tyk 5.12.0**, this default timeout is configurable in the Gateway config file (`tyk.conf`) or the equivalent environment variable:
+
+```json
+{
+  "jwks": {
+    "cache": {
+      "timeout": 90
+    }
+  }
+}
+```
+
+The [`timeout`](/tyk-oss-gateway/configuration#jwks-cache-timeout) is given in seconds. This setting applies to all IdPs, including those configured via the [Identity Provider Registry](/api-management/client-idp-registry).
+
+#### API-Level Configuration
+
+From **Tyk 5.10**, Tyk OAS APIs support a per-IdP cache timeout on each IdP configured via `jwksURIs`. If set, this overrides the gateway-level timeout for that IdP.
+
+For example, the following fragment assigns a 300 second cache timeout to Auth0 and 180 seconds to Keycloak:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        jwtAuth:
+          jwksURIs:
+            - url: https://your-tenant.auth0.com/.well-known/jwks.json
+              cacheTimeout: "300s"
+            - url: http://your-keycloak-host/realms/tyk-demo/protocol/openid-connect/certs
+              cacheTimeout: "3m"
+```
+
+| Field          | Type   | Description           | Default  | Supported Formats              |
+| -------------- | ------ | --------------------- | -------- | ------------------------------ |
+| `url`          | string | JWKS endpoint URL     | Required | Full URI including protocol    |
+| `cacheTimeout` | string | Cache validity period | 240s     | `"300s"`, `"5m"`, `"1h"`, etc. |
+
+For more details, refer to the [Tyk OAS API definition reference](/api-management/gateway-config-tyk-oas#jwk).
+
+<Note>
+Tyk Classic APIs do not support per-IdP cache timeouts and use the gateway-level timeout (from Tyk 5.12.0) or the default of 240 seconds.
+</Note>
+
+<Warning>
+Per-IdP `cacheTimeout` applies only to IdPs [configured directly in the API definition](#configuring-idps-in-the-api-definition) via `jwksURIs`. IdPs configured in the [Identity Provider Registry](/api-management/client-idp-registry) always use the gateway-level `jwks.cache.timeout` and cannot currently be tuned per IdP. Per-IdP cache timeout configuration is planned for a future release.
+</Warning>
+
+### Cache Management
+
+Tyk Gateway and Tyk Dashboard APIs expose endpoints to manage JWKS caches programmatically for both Tyk OAS and Tyk Classic APIs:
+
+| Endpoint                  | Method   | Description                              | Availability |
+| ------------------------- | -------- | ---------------------------------------- | ------------ |
+| `/tyk/cache/jwks`         | `DELETE` | Invalidate JWKS caches for all APIs      | Tyk 5.10.0+  |
+| `/tyk/cache/jwks/{apiID}` | `DELETE` | Invalidate JWKS cache for a specific API | Tyk 5.10.0+  |
+| `/api/cache/jwks/{apiID}` | `DELETE` | Invalidate JWKS cache for a specific API on all connected Gateways | Tyk 5.11.0+  |
+
+<Note>
+The Dashboard API endpoint is restricted to users with `admin` privileges and can only be used to flush the cache for APIs in the user's [Organisation](/tyk-dashboard-api#organisations-apis-and-users).
+</Note>
+
+**Example usage:**
+```bash
+# Flush all JWKS caches
+curl -X DELETE http://your-gateway:8080/tyk/cache/jwks \
+  -H "x-tyk-authorization: your-gateway-secret"
+
+# Flush JWKS cache for specific API
+curl -X DELETE http://your-gateway:8080/tyk/cache/jwks/your-api-id \
+  -H "x-tyk-authorization: your-gateway-secret"
+
+# Flush JWKS cache for specific API on all connected Gateways
+curl -X DELETE http://your-dashboard:8080/api/cache/jwks/your-api-id \
+  -H "authorization: your-dashboard-secret"
+```
+
+## FAQ
+
+<AccordionGroup>
+<Accordion title='Can I use different signing methods for different APIs?'>
+Yes, each API definition can have its own JWT configuration with different signing methods and keys.
+</Accordion>
+
+<Accordion title='How do I handle JWTs signed with different keys (e.g., from different issuers)?'>
+The recommended approach is to use the [Identity Provider Registry](/api-management/client-idp-registry) (Enterprise, from Tyk 5.14.0), which natively supports multiple IdPs per API. If you are not using the registry, Tyk OAS APIs from Tyk 5.9.0 support multiple JWKS endpoints via the `jwksURIs` array.
+</Accordion>
+
+<Accordion title='What happens if the JWKS endpoint is temporarily unavailable?'>
+Tyk caches public keys fetched from IdPs, so a temporary outage does not immediately affect API availability. The cache timeout defaults to 240 seconds and is configurable via the gateway-level `jwks.cache.timeout` setting. For IdPs configured directly in a Tyk OAS API definition via `jwksURIs`, a per-IdP `cacheTimeout` can also be set on each entry.
+</Accordion>
+
+<Accordion title='Can I use JWKS endpoints with symmetric cryptography (HMAC)?'>
+No, JWKS endpoints are designed for asymmetric cryptography (RSA and ECDSA), where public keys are used for signature verification. Symmetric cryptography (HMAC) requires a shared secret, which cannot be retrieved from a JWKS endpoint.
+</Accordion>
+
+<Accordion title='How often does Tyk refresh the JWKS cache?'>
+By default, cached keys expire after 240 seconds. This can be changed gateway-wide using the `jwks.cache.timeout` setting in the Gateway config. For Tyk OAS APIs with IdPs configured directly in the API definition via `jwksURIs`, a per-IdP `cacheTimeout` can override the gateway-level setting. IdPs configured via the Identity Provider Registry always use the gateway-level timeout and cannot currently be tuned per IdP.
+</Accordion>
+
+<Accordion title='Is JWKS Pre-fetching configurable?'>
+The JWKS (JSON Web Key Set) pre-fetching functionality in Tyk Gateway is automatic and not configurable in terms of enabling/disabling it. When you configure JWKS URLs in your API definition, Tyk automatically pre-fetches the keys when the API loads.
+</Accordion>
+
+</AccordionGroup>
diff --git a/api-management/authentication/jwt-split-token.mdx b/api-management/authentication/jwt-split-token.mdx
new file mode 100644
index 0000000000..0208196316
--- /dev/null
+++ b/api-management/authentication/jwt-split-token.mdx
@@ -0,0 +1,210 @@
+---
+title: JWT Split Token
+description: Learn how to implement JWT Split Token flow in Tyk to enhance security by separating JWT components and storing sensitive data server-side.
+keywords: ["Authentication", "JWT", "JSON Web Tokens", "Split Token", "Security"]
+sidebarTitle: "Split Token"
+---
+
+## Availability 
+
+| Component   | Editions |
+| :------------- | :------------------------- |
+| Tyk Gateway | Community and Enterprise |
+
+## Introduction
+
+Split Token Flow addresses a fundamental security concern with JWT tokens: when a JWT is stored on a client device (browser, mobile app, etc.), all of its contents can be easily decoded since JWTs are only base64-encoded, not encrypted. This means sensitive information in the payload is potentially exposed.
+
+The JWT consists of three parts:
+
+<img src="/img/2.10/split_token2.png" alt="Split Token Example" />
+
+In the above example you can see that they are:
+
+- Header: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9`
+- Payload: `eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJlbWFpbCI6ImhlbGxvQHdvcmxkLmNvbSJ9`
+- Signature: `EwIaRgq4go4R2M2z7AADywZ2ToxG4gDMoG4SQ1X3GJ0`
+
+The Split Token approach provides a solution by:
+
+1. Separating the JWT into its three component parts: header, payload, and signature
+2. Storing only the signature on the client side (which by itself is meaningless)
+3. Keeping the header and payload securely on the server side (in Tyk)
+4. Reconstructing the complete JWT when needed for authentication
+
+This approach combines the benefits of JWTs (rich claims, stateless validation) with the security of opaque tokens (no information disclosure).
+
+### When to Use Split Token Flow
+
+Consider using Split Token Flow when:
+
+- Your JWT payload contains sensitive information that shouldn't be exposed to clients
+- You want to prevent token inspection by malicious actors
+- You need the flexibility of JWT while maintaining higher security
+- You're implementing systems that must meet strict security compliance requirements
+
+## How Split Token Flow Works
+
+Here's how the process works with Tyk Gateway:
+
+```mermaid
+sequenceDiagram
+    participant Client
+    participant Tyk as Tyk Gateway
+    participant Redis as Tyk Redis
+    participant Auth as Authorization Server
+
+    %% Token Issuance Flow
+    rect rgb(240, 240, 255)
+        note over Client, Auth: Token Issuance
+        Client->>Tyk: Request token from /token endpoint
+        Tyk->>Auth: Forward request to Auth Server
+        Auth->>Tyk: Return complete JWT (header.payload.signature)
+        Tyk->>Tyk: Split JWT into components
+        Tyk->>Redis: Store header & payload using signature as key
+        Tyk->>Client: Return only signature as "opaque" token
+    end
+
+    %% Token Usage Flow
+    rect rgb(245, 255, 245)
+        note over Client, Auth: Token Usage
+        Client->>Tyk: API request with signature as Bearer token
+        Tyk->>Redis: Look up header & payload using signature
+        Redis->>Tyk: Return stored header & payload
+        Tyk->>Tyk: Reconstruct complete JWT
+        Tyk->>Tyk: Validate JWT
+        Tyk->>Auth: Forward request with complete JWT
+        Auth->>Tyk: Response
+        Tyk->>Client: Return response to client
+    end
+```
+
+1. **Token Issuance**:
+
+    - A `/token` endpoint is configured on Tyk from which the client should request the access token
+    - Tyk requests an access token from an authorization server (e.g., Keycloak) on behalf of the client
+    - The authorization server returns a complete JWT
+    - Tyk intercepts this response through a [Virtual Endpoint](/api-management/traffic-transformation/virtual-endpoints)
+    - Tyk splits the JWT into its components and stores the header and payload in its Redis database
+    - Only the signature portion is returned to the client as an "opaque" token
+
+2. **Token Usage**:
+
+    - The client makes API requests using only the signature as their access token
+    - Tyk receives the request and looks up the stored header and payload using the signature
+    - Tyk reconstructs the complete JWT and validates it
+    - If valid, Tyk forwards the request to the upstream API with the full JWT
+
+3. **Security Benefits**:
+
+    - The client never possesses the complete JWT, only a meaningless signature
+    - Token contents cannot be inspected by client-side code or malicious actors
+    - Token validation still occurs using standard JWT verification
+
+
+## Implementing Split Token Flow
+
+1. **Create a Virtual Endpoint for Token Issuance**
+
+    First, create a virtual endpoint in Tyk that will:
+
+    - Receive authentication requests from clients
+    - Forward these requests to your authorization server
+    - Split the returned JWT
+    - Store the header and payload in Tyk's storage
+    - Return only the signature to the client
+    - Here's a simplified implementation:
+
+    ```javascript
+    function splitTokenHandler(request, session, config) {
+        // 1. Forward the client's credentials to the authorization server
+        var authServerResponse = forwardToAuthServer(request);
+        
+        if (authServerResponse.Code !== 200) {
+            return TykJsResponse({
+                Body: authServerResponse.Body,
+                Code: authServerResponse.Code
+            }, session.meta_data);
+        }
+        
+        // 2. Extract the JWT from the response
+        var responseBody = JSON.parse(authServerResponse.Body);
+        var fullJWT = responseBody.access_token;
+        
+        // 3. Split the JWT into its components
+        var jwtParts = fullJWT.split(".");
+        var header = jwtParts[0];
+        var payload = jwtParts[1];
+        var signature = jwtParts[2];
+        
+        // 4. Store the complete JWT in Tyk's Redis database using the signature as the key
+        // This function would use Tyk's storage API to save the data
+        storeJWTComponents(signature, header, payload, fullJWT);
+        
+        // 5. Modify the response to return only the signature
+        responseBody.access_token = signature;
+        
+        return TykJsResponse({
+            Body: JSON.stringify(responseBody),
+            Code: 200
+        }, session.meta_data);
+    }
+    ```
+
+    Note that this example includes some level of abstraction for clarity and so is not a full implementation.
+
+2. **Configure Custom Pre-Auth Plugin**
+
+    Next, create a custom pre-auth plugin that reconstructs the JWT before it reaches the standard Tyk JWT Auth middleware:
+
+    ```javascript
+    function reconstructJWT(request, session, config) {
+        // 1. Extract the signature from the Authorization header
+        var authHeader = request.Headers["Authorization"];
+        var signature = authHeader.replace("Bearer ", "");
+        
+        // 2. Retrieve the stored JWT components using the signature
+        var storedJWT = retrieveJWTComponents(signature);
+        
+        if (!storedJWT) {
+            return TykJsResponse({
+                Body: "Invalid token",
+                Code: 401
+            }, session.meta_data);
+        }
+        
+        // 3. Replace the Authorization header with the full JWT
+        request.SetHeaders["Authorization"] = "Bearer " + storedJWT.fullJWT;
+        
+        return request;
+    }
+    ```
+
+3. **Test the Implementation**
+
+    To test your Split Token Flow:
+
+    Request a token from your Tyk virtual endpoint:
+
+    ```bash
+    curl -X POST https://your-tyk-gateway/token \
+      -d "grant_type=client_credentials&client_id=your-client-id&client_secret=your-client-secret"
+    ```
+
+    You'll receive a response with only the signature as the access token, for example:
+
+    ```json
+    {
+      "access_token": "EwIaRgq4go4R2M2z7AADywZ2ToxG4gDMoG4SQ1X3GJ0",
+      "token_type": "bearer",
+      "expires_in": 3600
+    }
+    ```
+
+    Use this token to access your JWT Auth protected API where you have configured the custom pre-auth plugin and JWT Auth:
+
+    ```bash
+    curl https://your-tyk-gateway/protected-api \
+      -H "Authorization: Bearer EwIaRgq4go4R2M2z7AADywZ2ToxG4gDMoG4SQ1X3GJ0"
+    ```
+
diff --git a/api-management/authentication/oauth-2.mdx b/api-management/authentication/oauth-2.mdx
new file mode 100644
index 0000000000..a95131ebad
--- /dev/null
+++ b/api-management/authentication/oauth-2.mdx
@@ -0,0 +1,764 @@
+---
+title: "Tyk OAuth 2.0 Authorization Server"
+description: "Learn how to use Tyk Gateway as a built-in OAuth 2.0 authorization server to issue and manage access tokens for APIs deployed on Tyk."
+keywords: "Authentication, Authorization, Tyk Authentication, Tyk Authorization, Secure APIs, OAuth 2.0"
+sidebarTitle: "Tyk OAuth 2.0"
+---
+
+## OAuth 2.0 without an external Authorization Server
+
+Tyk can act as an OAuth 2.0 *authorization server*, performing token generation and management for *clients* accessing APIs deployed on Tyk. There are many great resources on the Internet that will help you to understand the OAuth 2.0 Authorization Framework, which we won't attempt to duplicate here. We will provide a basic introduction to the [concepts and terminology](#oauth-20-core-concepts) before we dive into the details of using Tyk as your *auth server*.
+
+Tyk offers some great features when used as the *authorization server* including:
+
+- **Fine-Grained Access Control:** Manage access using Tyk's built-in access controls, including versioning and named API IDs
+- **Usage Analytics:** Leverage Tyk's analytics capabilities to monitor OAuth 2.0 usage effectively, grouping data by Client Id
+- **Multi-API Access**: Enable access to multiple APIs using a single OAuth token; configure one API for OAuth 2.0 token issuance and the other APIs with the [Auth Token](/api-management/authentication/bearer-token) method, linking them through a common policy
+
+*Tyk as OAuth authorization server* supports the following *grant types*:
+
+- [Authorization Code Grant](#using-the-authorization-code-grant): the *client* is redirected to an *identity server* where the *user* must approve access before an *access token* will be issued
+- [Client Credentials Grant](#using-the-client-credentials-grant): used for machine-to-machine access, authentication is performed using only the *client Id* and *client secret*
+- [Resource Owner Password Grant](#using-the-resource-owner-password-grant) (a.k.a. Password Grant): only for use where the *client* is highly trusted, as the *client* must provide the *Resource Owner*'s own credentials during authentication
+
+
+
+    <Note>
+    **Tyk does not recommend the use of Resource Owner Password Grant**. This method is considered unsafe and is prohibited in the [OAuth 2.0 Security Best Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-13#section-3.4") but is supported for use with legacy clients.
+    </Note>
+
+
+To make use of this, you'll need to:
+
+- understand how to integrate your *client* (and, for Authorization Code grant, your *identity server*) according to the OAuth grant type
+- [register a client app](#client-app-registration) for each client that needs to access the API
+- [configure your API proxy](#configuring-your-api-proxy) to use the *Tyk OAuth 2.0* authentication method
+
+{/* TODO: This video probably needs to be re-recorded with Tyk OAS, so not publishing for now: */}
+<iframe width="560" height="315" src="https://www.youtube.com/embed/C4CUDTIHynk" title="Using OAuth2.0 To Authenticate Your APIs" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+
+## OAuth 2.0 Core Concepts
+
+**OAuth 2.0** (Open Authorization 2.0) is a widely adopted authorization protocol that allows third-party applications to access user resources securely, without needing to expose sensitive credentials such as user passwords. It is an industry-standard framework that enables a delegated approach to securing access to APIs and services. The [IETF OAuth 2.0 specification](https://datatracker.ietf.org/doc/html/rfc6749) outlines the standard for OAuth 2.0.
+
+> "The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf." — [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749)
+
+OAuth 2.0 provides a mechanism for **client applications** to request limited access to resources hosted by a **resource server**, on behalf of a **resource owner** (typically a user), without exposing the resource owner's credentials. This allows secure sharing of data between applications—for example, allowing a calendar app to access a user's contacts to automatically find available time slots for meetings.
+
+OAuth 2.0 has many variations and flows suited for different use cases, this section will provide an overview of the core principles, terminology, and key concepts, specifically focusing on how you can implement OAuth 2.0 with Tyk.
+
+### Terminology
+
+- **Protected Resource**: The service or data that is protected by OAuth (e.g. an API endpoint) and requires authorization to access.
+- **Resource Owner**: The **user** or system that owns the *Protected Resource* and has the ability to grant or deny access to it.
+- **Client**: The application or system that seeks access to the *Protected Resource*. It acts on behalf of the *Resource Owner*.
+- **Access Token**: A short-lived piece of data that grants the *Client* access to the *Protected Resource*. The token proves that the *Client* has been authorized by the *Resource Owner*.
+- **Authorization Server**: The server that issues *Access Tokens* to the *Client* after validating the *Client*'s identity and obtaining consent from the *Resource Owner*.
+- **Client Application**: The application that requests authorization from the *Authorization Server*. This application must first be registered with the *Authorization Server* to obtain credentials (*Client Id* and *Client Secret*).
+- **Resource Server**: The server that hosts the *Protected Resource*. It receives access requests from *Clients*, which must include a valid *Access Token*.
+- **Identity Server**: A server that authenticates the *Resource Owner*, offering the facility to log in and authorize *Client* access to *Protected Resources*.
+- **Scope**: Defines the specific permissions or access levels being requested by the *Client* (e.g. read, write, delete).
+- **Grant Type**: The method by which the *Client* obtains an *Access Token*, based on the OAuth flow being used (e.g. Authorization Code, Client Credentials, Resource Owner Password Credentials).
+
+### Access Tokens
+
+In OAuth 2.0, **access tokens** are used to represent the authorization granted to the *client* by the *resource owner*. These tokens are typically small, opaque data objects that are passed along with each API request to authenticate the *client*. While the OAuth 2.0 specification does not mandate a specific format, **JSON Web Tokens (JWTs)** are commonly used as they can encode metadata, such as the *user*'s identity, permissions, and token expiry time.
+
+Tokens usually come with an expiration date to limit the time they are valid and minimize the risk of abuse. *Access tokens* can often be refreshed via a **refresh token** if they expire, allowing for long-lived access without requiring the *user* (*resource owner*) to reauthorize the *application* (*client*).
+
+### Client Application
+
+For a *client* to request an *Access Token* from the *Authorization Server*, it must first authenticate itself. This ensures that the *Resource Owner* can confidently delegate access to the requested resources.
+
+To do this, the *client* is registered with the *Authorization Server* as a **Client Application**, which requires the following elements:
+
+- **Client Id**: A unique, public identifier for the *client application* (e.g., a username or application name).
+- **Client Secret**: A confidential string (like a password) that is shared between the *client* and the *Authorization Server*. The *client secret* is never exposed to the *Resource Owner*.
+- **Redirect URI**: The URL to which the *client* will be redirected after the authorization process is complete (either granted or denied).
+
+The *client* sends the *client Id* and *client secret* during the authorization request to prove its identity and authenticate its request for an *access token*. Depending on the OAuth *grant type* being used (e.g. Authorization Code Flow, Client Credentials Flow), the *Authorization Server* will authenticate the *client* and, if successful, issue an *Access Token*.
+
+
+## Manage Client Access Policies
+ 
+The *access tokens* issued to clients by *Tyk Authorization Server* are lookup keys to [Sessions](/api-management/access-control/sessions-and-keys/understanding-sessions) and are usually associated with [Policies](/api-management/policies) at the point of creation. These allow the application of quotas, rate limits and access rights in the normal manner.
+
+Policies can be assigned to *client apps* and will be applied to all access tokens issued for that *client app*.
+
+
+## Client App Registration
+
+For all grant types, the first common step is the registration of the *client* with Tyk Dashboard by creation of a *Client App*. This will allocate a *client Id* and *client secret* that must be provided in future authentication requests by the *client*.
+
+### Using the Tyk Dashboard UI
+
+1. *Client apps* are registered per-API, so the first step is to [configure Tyk OAuth 2.0](#configuring-your-api-proxy) as the security method to be used for the API. With this done, you can navigate to the OAuth Client management screen for the API from the **Actions** menu on the **Created APIs** screen:
+
+<img src="/img/api-management/security/create-oauth-from-api-list.png" alt="Accessing the list of OAuth Clients for an API" />
+
+2. You will now be prompted to register a *client app* that will be granted access to the API configuring:
+
+- redirect URI
+- [optional] [security policies](#manage-client-access-policies) to be applied to access tokens generated for the client
+- [optional] [metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context) to be added to the access tokens
+
+<img src="/img/api-management/security/fill-out-client-details-oauth.png" alt="Add New OAuth Client" />
+
+**Note**: when using *Authorization Code grant* the *redirect uri* configured for the *client app* must be the same as that configured in the API definition.
+
+Select the **Create** button to register the *client app*.
+
+3. In the OAuth Client management screen, you will see a list of *client apps* registered with the API (as identified by their *client Id*). By clicking on the list item, or from the **Actions** menu's **Edit** option you will be taken to the *Edit Client app* screen, where you can see the *client secret* and make any modifications you need. There is also the option to [revoke tokens](#revoking-access-tokens) that have been issued for this *client app*.
+
+<img src="/img/api-management/security/client-secret-oauth.png" alt="View client Id and client secret" />
+
+### Using the Tyk Dashboard API
+
+The Tyk Dashboard API contains several endpoints that are provided to manage *client apps*. *Client apps* are registered per-API, so each takes as an input the *API Id* for the API:
+
+| Action | Endpoint | Reference |
+| :--- | :--- | :--- |
+| Register a new client app | `POST /api/apis/oauth/{{api-id}}` | [link](https://tyk.io/docs/api-reference/oauth/create-a-new-oauth20-client) |
+| Get a list of registered client apps | `GET /api/apis/oauth/{{api-id}}` | [link](https://tyk.io/docs/api-reference/oauth/list-oauth-clients) |
+| Get the details of a client app | `GET /api/apis/oauth/{{api-id}}/{{client_id}}` | [link](https://tyk.io/docs/api-reference/oauth/get-single-oauth-client-details) |
+| Delete a client app | `DELETE /api/apis/oauth/{{api-id}}/{{client_id}}` | [link](https://tyk.io/docs/api-reference/oauth/delete-oauth-client) |
+
+
+## Using the Authorization Code Grant
+
+When using Tyk as the Authorization Server with the Authorization Code grant, the following steps are followed after [registering the Client App](#client-app-registration):
+
+<img src="/img/diagrams/diagram_docs_authorization-code-grant-type@2x.png" alt="Authorization grant type flow" />
+
+**Explanatory notes:**
+
+(1) *client* makes a request to the [authorization endpoint](#authorization-request) on the *Auth Server*
+
+(2) The *Auth Server* notes the request parameters and returns `HTTP 307 Temporary Redirect`, redirecting the user to an *Identity Server* 
+
+(5) the *user* must log in on the *Identity Server* and authorize the *client*
+
+(6) when the *user* successfully authenticates and authorizes the request, the *Identity Server* must request an [Authorization Code](#authorization-code-request) from the *Auth Server*
+
+(8) The *Identity Server* provides the *Authorization Code* to the *client*
+
+(9) The *client* exchanges the *Authorization Code* for an [Access Token](#exchange-the-authorization-code-for-an-access-token) from the *Auth Server*
+
+(10) The *client* uses the *Access Token* to authenticate with the protected API using the [Auth Token](/api-management/authentication/bearer-token) method
+
+### Integration with Identity Server
+
+Whilst Tyk can provide the *authorization server* functionality, issuing and managing access and authorization tokens, the *identity server* functions (authenticating users (resource owners) and allowing them to authorize client access) must be performed by a separate Identity Provider (IdP).
+
+The identity server will need access to the Tyk Dashboard API to [obtain an Authorization Code](/api-management/authentication/oauth-2#oauth2-0-authorization-code).
+
+[Tyk Identity Broker (TIB)](/tyk-identity-broker/overview) can fulfill this role, authenticating users against an external IdP and handling the authorization code exchange with Tyk Dashboard on their behalf. See [Issue API Access Tokens via TIB](/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib) for details.
+
+### Authorization Request
+
+The authorization endpoint for an API proxy on Tyk is a special endpoint automatically added to the proxy definition, accessible from `POST /<listen-path>/oauth/authorize`
+
+The following parameters are required in a request to this endpoint:
+
+| Parameter       | Value                      |
+| :--------------- | :-------------------------- |
+| `response_type` | `code`                     |
+| `client_id`     | client Id                  |
+| `redirect_uri`  | Redirect URI (URL encoded) |
+
+For example:
+
+```bash
+curl -X POST https://tyk.cloud.tyk.io/my-api/oauth/authorize/ \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "response_type=code&client_id=my-client-id&redirect_uri=http%3A%2F%2Fidentityserver.com%2Fclient-redirect-uri"
+```
+
+This command, issued by the *client* is the first step of requesting access to the `/my-api` proxy deployed on a Tyk Gateway at `https://tyk.cloud.tyk.io`.
+
+If the *client Id* (`my-client-id`) is valid, the response will be `HTTP 307 Temporary Redirect` with the redirect URI (`http://identityserver.com/client-redirect-uri`) in the `location` header.
+
+### Authorization Code Request
+
+The *Identity Server* requests an *Authorization Code* from the *Authentication Server*. Tyk's *authorization code* endpoint is hosted in the [Tyk Dashboard API](/api-management/authentication/oauth-2#oauth2-0-authorization-code), accessible from `POST /api/apis/{api_id}/authorize-client`. The same `redirect_uri` as provided in the original request must be provided alongside the `client_id` as a security feature to verify the client identity.
+
+This endpoint is protected using the Dashboard API secret assigned to the *Identity Server*, which must be provided in the `Authorization` header.
+
+The following parameters are required in a `POST` request to this endpoint:
+
+| Parameter       | Value                      |
+| :--------------- | :-------------------------- |
+| `response_type` | `code`                     |
+| `client_id`     | client Id                  |
+| `redirect_uri`  | Redirect URI (URL encoded) |
+
+For example:
+
+```bash
+curl -X POST \
+  https://admin.cloud.tyk.io/api/apis/oauth/{my-api-id}/authorize-client/ \
+  -H "Authorization: <dashboard-secret>" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "response_type=code&client_id=my-client-id&redirect_uri=http%3A%2F%2Fidentityserver.com%2Fclient-redirect-uri"
+```
+
+This command, issued by the *identity server* requests an *authorization code* from the Tyk Dashboard at `https://admin.cloud.tyk.io` to access the proxy with API Id `my-api-id`.
+
+If the *client Id* (`my-client-id`) is valid and `redirect_uri` matches the one provided in the initial request, an *authorization code* will be provided in the response payload, for example:
+
+```json
+{
+  "code": "EaG1MK7LS8GbbwCAUwDo6Q",
+  "redirect_to": "http://example.com/client-redirect-uri?code=EaG1MK7LS8GbbwCAUwDo6Q"
+}
+```
+
+### Exchange the Authorization Code for an Access Token
+
+Once the *client* has the *authorization code*, it can exchange this for an *access token*, which is used to access the protected API. The token exchange endpoint for an API proxy on Tyk is a special endpoint automatically added to the proxy definition, accessible from `POST /<listen-path>/oauth/token`.
+
+This endpoint is protected using [Basic Authentication](/api-management/authentication/basic-authentication) where the username is the *client Id* and the password is the *client secret*.
+
+The following parameters are required in the request:
+
+| Parameter       | Value                      |
+| :--------------- | :-------------------------- |
+| `grant_type`    | `authorization_code`       |
+| `client_id`     | client Id                  |
+| `code`          | Authorization Code         |
+| `redirect_uri`  | Redirect URI (URL encoded) |
+
+For example:
+
+```bash
+curl -X POST \
+  https://tyk.cloud.tyk.io/my-api/oauth/token/ \
+  -H "Authorization: Basic bXktY2xpZW50LWlkOm15LWNsaWVudC1zZWNyZXQ=" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=authorization_code&client_id=my-client-id&code=EaG1MK7LS8GbbwCAUwDo6Q&redirect_uri=http%3A%2F%2Fidentityserver.com%2Fclient-redirect-uri"
+```
+
+This command, issued by the *client* is the final step to obtain an access token for the `/my-api` proxy deployed on a Tyk Gateway at `https://tyk.cloud.tyk.io`. The basic auth key is the base64 encoded representation of `my-client-id:my-client-secret` The `client_id` and `redirect_uri` match those provided in the initial [authorization request](#authorization-request). The `code` is the *authorization code* provided to the *identity server* in the [authorization code request](#authorization-code-request).
+
+The response payload contains:
+- `access_token`: the token which can be used by the *client* to access the protected API
+- `expires_in`: the expiration date/time of the access token
+- `token_type`: set to `bearer` indicating that the access token should be provided in an [Auth Token](/api-management/authentication/bearer-token) request to the protected API
+- `refresh_token`: [optional] a special token that can be used in the [Refresh Token](#using-refresh-tokens) flow
+
+For example:
+
+```json
+{
+  "access_token": "580defdbe1d21e0001c67e5c2a0a6c98ba8b4a059dc5825388501573",
+  "expires_in": 3600,
+  "refresh_token": "NWQzNGVhMTItMDE4Ny00MDFkLTljOWItNGE4NzI1ZGI1NGU2",
+  "token_type": "bearer"
+}
+```
+
+
+
+## Using the Client Credentials Grant
+When using Tyk as the *authorization server* with the Client Credentials grant, the *client* accesses resources on behalf of itself rather than on behalf of a *user*, so there is no user login/authorization step (as seen with [Authorization Code grant](#using-the-authorization-code-grant)). This flow is ideal for server-to-server interactions.
+
+After [registering the Client App](#client-app-registration), the *client* simply requests an access token directly from the authorization server:
+
+<img src="/img/diagrams/diagram_docs_client-credentials-grant-type@2x.png" alt="Client Credentials grant type flow" />
+
+### Access Token Request
+
+The *client* obtains an access token for an API proxy on Tyk from a special endpoint automatically added to the proxy definition, accessible from `POST /<listen-path>/oauth/token`.
+
+This endpoint is protected using Basic Authentication where the username is the client Id and the password is the client secret.
+
+The following parameters are required in the request:
+
+| Parameter       | Value                      |
+| :--------------- | :-------------------------- |
+| `grant_type`    | `client_credentials`       |
+| `client_id`     | client Id                  |
+| `secret`        | client secret              |
+
+For example:
+
+```bash
+curl -X POST \
+  https://tyk.cloud.tyk.io/my-api/oauth/token/ \
+  -H "Authorization: Basic bXktY2xpZW50LWlkOm15LWNsaWVudC1zZWNyZXQ=" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=client_credentials&client_id=my-client-id&client_secret=my-client-secret"
+```
+
+This command, issued by the *client* will obtain an access token for the `/my-api` proxy deployed on a Tyk Gateway at `https://tyk.cloud.tyk.io`. The basic auth key is the base64 encoded representation of `my-client-id:my-client-secret` The `client_id` and `client_secret` match those allocated by Tyk (the auth server) for the *client app*.
+
+The response payload contains:
+- `access_token`: the token which can be used by the *client* to access the protected API
+- `expires_in`: the expiration date/time of the access token
+- `token_type`: set to `bearer` indicating that the access token should be provided in an [Auth Token](/api-management/authentication/bearer-token) request to the protected API
+
+For example:
+
+```json
+{
+  "access_token": "580defdbe1d21e0001c67e5c2a0a6c98ba8b4a059dc5825388501573",
+  "expires_in": 3600,
+  "token_type": "bearer"
+}
+```
+
+
+<Note>
+Note that Client Credentials grant does not produce a *refresh token*.
+</Note>
+
+
+
+
+## Using the Resource Owner Password Grant
+When using Tyk as the *authorization server* with the Resource Owner Password grant, the *client* provides the *user's* credentials when requesting an access token. There is no user login/authorization step (as seen with [Authorization Code grant](#using-the-authorization-code-grant)). **This flow is not recommended and is provided only for integration with legacy clients.**
+
+After [registering the Client App](#client-app-registration), the *client* simply requests an access token directly from the authorization server:
+
+<img src="/img/diagrams/diagram_docs_username-_-password-grant-type@2x.png" alt="Username and password grant sequence" />
+
+### Access Token Request
+
+The *client* obtains an access token for an API proxy on Tyk from a special endpoint automatically added to the proxy definition, accessible from `POST /<listen-path>/oauth/token`.
+
+This endpoint is protected using [Basic Authentication](/api-management/authentication/basic-authentication) where the username is the client Id and the password is the client secret.
+
+The following parameters are required in the request:
+
+| Parameter       | Value                                                  |
+| :--------------- | :------------------------------------------------------ |
+| `grant_type`    | `password`                                             |
+| `client_id`     | client Id                                              |
+| `username`      | resource owner's username (`resource-owner-username`)  |
+| `password`      | resource owner's password  (`resource-owner-password`) |
+
+For example:
+
+```bash
+curl -X POST \
+  https://tyk.cloud.tyk.io/my-api/oauth/token/ \
+  -H "Authorization: Basic bXktY2xpZW50LWlkOm15LWNsaWVudC1zZWNyZXQ=" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=password&client_id=my-client-id&username=resource-owner-username&password=resource-owner-password"
+```
+
+This command, issued by the *client* will obtain an access token for the `/my-api` proxy deployed on a Tyk Gateway at `https://tyk.cloud.tyk.io`. The basic auth key is the base64 encoded representation of `my-client-id:my-client-secret` The `client_id` and `client_secret` match those allocated by Tyk (the auth server) for the *client app*.
+
+The response payload contains:
+- `access_token`: the token which can be used by the *client* to access the protected API
+- `expires_in`: the expiration date/time of the access token
+- `token_type`: set to `bearer` indicating that the access token should be provided in an [Auth Token](/api-management/authentication/bearer-token) request to the protected API
+- `refresh_token`: [optional] a special token that can be used in the [Refresh Token](#using-refresh-tokens) flow
+
+For example:
+
+```json
+{
+  "access_token": "580defdbe1d21e0001c67e5c2a0a6c98ba8b4a059dc5825388501573",
+  "expires_in": 3600,
+  "refresh_token": "YjdhOWFmZTAtNmExZi00ZTVlLWIwZTUtOGFhNmIwMWI3MzJj",
+  "token_type": "bearer"
+}
+```
+
+
+## Configuring your API Proxy
+
+As explained [previously](/api-management/client-authentication#how-does-tyk-implement-authentication-and-authorization), the AuthN/Z methods to be used to secure an API proxy are configured in the API definition. This permits granular application of the most appropriate method to each API deployed on Tyk Gateway.
+
+When using Tyk as the Authorization Server, the API configuration can be applied using the Tyk Dashboard's API Designer UI, or by direct modification of the API definition. We will provide examples here when using Tyk OAS APIs. If you are using Tyk Classic APIs, the process is very similar, though there are differences in the location and specific labelling of options.
+
+### Using the Tyk API Designer
+
+1. Client Authentication is configured on the **Settings** screen within the API Designer, within the **Server** section. Ensure that you are in **Edit** mode, click on the button to **Enable** *Authentication* and then select **Tyk OAuth 2.0** from the drop down options:
+
+<img src="/img/dashboard/system-management/oauth-auth-mode-new.png" alt="Set Authentication Mode" />
+
+2. Select the OAuth Grant Type that you wish to use for the API, if appropriate you can also select the *Refresh Token* grant so that the Auth Server (Tyk) will generate both access and refresh tokens.
+
+3. Provide the requested configuration options depending on the selected Grant Type. Note that for *Authorization Code Grant*, **Redirect URL** should be the login page for your Identity Server and must be matched by the `redirect_uri` provided in the *client app* (and in the client's authentication request). The [Notifications](#oauth-token-notifications) configuration can be provided for *Authorization Code* and *Password* grants.
+
+4. Select **Save API** to apply the new settings.
+
+### Using the API Definition
+
+The OpenAPI Specification indicates the use of [OAuth 2.0 authentication](https://swagger.io/docs/specification/v3_0/authentication/oauth2/) in the `components.securitySchemes` object using the `type: oauth2`. Tyk supports the [authorizationCode](/api-management/authentication/oauth-2#using-the-authorization-code-grant), [clientCredentials](#using-the-client-credentials-grant) and [password](#using-the-resource-owner-password-grant) flows and implements Relative Endpoint URLs for the `authorizationUrl`, `tokenUrl` and `refreshUrl`.
+
+```yaml
+components:
+  securitySchemes:
+    myAuthScheme:
+      type: oauth2
+      flows:
+        authorizationCode:
+          authorizationUrl: ...
+          tokenUrl: ...
+          scopes: ...
+
+security:
+  - myAuthScheme: []
+```
+
+With this configuration provided by the OpenAPI description, in the Tyk Vendor Extension we need to enable authentication, to select this security scheme and to indicate where Tyk should look for the OAuth token. Usually the token will be provided in the `Authorization` header, but Tyk is configurable, via the Tyk Vendor Extension, to support custom header keys and credential passing via query parameter or cooke.
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        myAuthScheme:
+          enabled: true
+          header:
+            enabled: true
+            name: Authorization
+```
+
+Note that URL query parameter keys and cookie names are case sensitive, whereas header names are case insensitive.
+
+You can optionally [strip the user credentials](/api-management/client-authentication#managing-authorization-data) from the request prior to proxying to the upstream using the `authentication.stripAuthorizationData` field (Tyk Classic: `strip_auth_data`).
+
+With the OAuth method selected, you'll need to configure Tyk to handle the specific configuration of OAuth grants that you will support. All of the OAuth specific configuration is performed within the [authentication.securitySchemes.oauth](/api-management/gateway-config-tyk-oas#oauth) object in the Tyk Vendor Extension.
+
+For example:
+
+```json {hl_lines=["7-11", "14-24", "35-55"],linenos=true, linenostart=1}
+{
+  "info": {
+    "title": "My OAuth API",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "security": [
+    {
+      "oauth": []
+    }
+  ],
+  "paths": {},
+  "components": {
+    "securitySchemes": {
+      "oauth": {
+        "type": "oauth2",
+        "flows": {
+          "authorizationCode": {
+            "authorizationUrl": "/oauth/authorize",
+            "scopes": {},
+            "tokenUrl": "/oauth/token"
+          }
+        }
+      }
+    }
+  },
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "My OAuth API",
+      "state": {
+        "active": true,
+      }
+    },
+    "server": {
+      "authentication": {
+        "enabled": true,
+        "securitySchemes": {
+          "oauth": {
+            "enabled": true,
+            "allowedAuthorizeTypes": [
+              "code"
+            ],
+            "authLoginRedirect": "http://<identity-server>/client-redirect-uri",
+            "header": {
+              "enabled": true,
+              "name": "Authorization"
+            },
+            "notifications": {
+              "onKeyChangeUrl": "http://notifyme.com",
+              "sharedSecret": "oauth-shared-secret"
+            },
+            "refreshToken": true
+          }
+        }
+      },
+      "listenPath": {
+        "strip": true,
+        "value": "/my-oauth-api/"
+      }
+    },
+    "upstream": {
+      "url": "http://httpbin.org/"
+    }
+  }
+}
+```
+
+In this example:
+
+- Client authentication has been enabled (line 44)
+- The OpenAPI description declares the `oauth` security scheme that expects **Authorization Code** flow. Note that the `authorization URL` and `token URL` are declared relative to the API proxy listen path
+- Authorization requests (made to `POST /my-oauth-api/oauth/authorize`) will be redirected to `http://<identity-server>/client-redirect-uri` where the *Resource Owner* should be prompted to authorize the request
+- [Notifications](#oauth-token-notifications) of token issuance will be sent to `http://notifyme.com` with the `X-Tyk-Shared-Secret` header set to `oauth-shared-secret`
+
+The *auth server* (Tyk) will issue an *access token* and *refresh token* in exchange for a valid *authorization code*. Once the client has a valid access token, it will be expected in the `Authorization` header of the request.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk and, with correctly configured and integrated *identity server* can be used to try out OAuth Client Authentication using Tyk as the Authorization Server.
+
+### Using Tyk Classic APIs
+
+As noted in the Tyk Classic API [documentation](/api-management/gateway-config-tyk-classic#configuring-authentication-for-tyk-classic-apis), you can select the Tyk as OAuth Server method using the `use_oauth2` option.
+
+## Managing OAuth Tokens
+
+### Using Refresh Tokens
+
+The Refresh Token flow is used to obtain a new *access token* when the current token has expired or is about to expire. This allows clients to maintain a valid *access token* without requiring the user to go through the authentication and authorization process again.
+
+*Refresh tokens* are single use and, when used, automatically invalidate the access token with which they were issued. This prevents accidental duplication of access tokens granting authorized access to a resource (API).
+
+A *refresh token* can be issued by the *auth server* alongside the *access token* at the last stage of the OAuth flow for:
+- Authentication Code grant
+- Resource Owner Password grant
+
+You configure whether Tyk should issue a refresh token within the [API proxy definition](#configuring-your-api-proxy).
+
+#### Refreshing an Access Token
+
+If you have correctly configured your API, then Tyk will provide a *refresh token* with the *access token*. The *client* can subsequently exchange the *refresh token* for a new *access token* without having to re-authenticate, with another call to the `POST /<listen-path>/oauth/token` endpoint as follows:
+
+<img src="/img/diagrams/diagram_docs_refresh-token-grant-type@2x.png" alt="Refresh Token flow" />
+
+This endpoint is protected using Basic Authentication where the username is the *client Id* and the password is the *client secret*.
+
+The following data is required in the request payload:
+
+| Parameter       | Value                                                     |
+| :--------------- | :--------------------------------------------------------- |
+| `grant_type`    | `refresh_token`                                           |
+| `client_id`     | client Id                                                 |
+| `client_secret` | client secret                                             |
+| `refresh_token` | The refresh token provided with the original access token |
+
+For example:
+
+```bash
+curl -X POST \
+  https://tyk.cloud.tyk.io/my-api/oauth/token/ \
+  -H "Authorization: Basic bXktY2xpZW50LWlkOm15LWNsaWVudC1zZWNyZXQ=" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=refresh_token&client_id=my-client-id&client_secret=my-client-secret&refresh_token=YjdhOWFmZTAtNmExZi00ZTVlLWIwZTUtOGFhNmIwMWI3MzJj"
+```
+
+This command, issued by the *client* will obtain a new access token for the `/my-api` proxy deployed on a Tyk Gateway at `https://tyk.cloud.tyk.io`. The basic auth key is the base64 encoded representation of `my-client-id:my-client-secret` The `client_id` and `client_secret` match those allocated by Tyk (the auth server) for the *client app*. The `refresh_token` is a valid *refresh token* previously issued to the *client*.
+
+The response payload contains:
+- `access_token`: a new *access token* which can be used by the *client* to access the protected API
+- `expires_in`: the expiration date/time of the access token
+- `token_type`: set to `bearer` indicating that the access token should be provided in an [Auth Token](/api-management/authentication/bearer-token) request to the protected API
+- `refresh_token`: a new *refresh token* that can be used later to refresh the new *access token*
+
+For example:
+
+```json
+{
+  "access_token": "580defdbe1d21e0001c67e5c2a0a6c98ba8b4a059dc5825388501573",
+  "expires_in": 3600,
+  "refresh_token": "NWQzNGVhMTItMDE4Ny00MDFkLTljOWItNGE4NzI1ZGI1NGU2",
+  "token_type": "bearer"
+}
+```
+
+### Revoking Access Tokens
+
+OAuth access tokens have built in expiry, but if you need to [revoke](https://tools.ietf.org/html/rfc7009) a client's access to the API before this time, then you can use the option on the [OAuth Client management screen](#using-the-tyk-dashboard-ui) screen in Tyk Dashboard UI or the Tyk Dashboard API to do so. 
+
+Using the **Tyk Dashboard API** you can revoke specific tokens (both access and refresh) or all tokens issued for a specific *client app* as follows:
+
+- [retrieve a list of all tokens for a client app](https://tyk.io/docs/api-reference/oauth/list-oauth-client-tokens)
+- [revoke a single token](/api-management/authentication/oauth-2#revoke-a-single-oauth-client-token)
+- [revoke all tokens for a client app](/api-management/authentication/oauth-2#revoke-all-oauth-client-tokens)
+
+These endpoints are protected using the Dashboard API secret assigned to the user managing the tokens, which must be provided in the `Authorization` header.
+
+In this example, we issue a request to the `/revoke` endpoint of the *auth server* via the Tyk Dashboard API to invalidate a specific *access token*:
+
+```bash
+curl -X POST \
+  https://admin.cloud.tyk.io/api/apis/oauth/{CLIENT_ID}/revoke/ \
+  -H "Authorization: <dashboard-secret>" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "token=580defdbe1d21e0001c67e5c2a0a6c98ba8b4a059dc5825388501573&token_type_hint=access_token&client_id=my-client-id&client_secret=my-client-secret"
+```
+
+Note that the `token_type_hint` must be set to `access_token` or `refresh_token` to match the type of `token` to be revoked.
+
+### Token Expiration and Retention
+
+Tyk provides several global Gateway configuration options (in `tyk.conf`) that control the expiration and retention of OAuth 2.0 tokens:
+
+- [`oauth_token_expire`](/tyk-oss-gateway/configuration#oauth_token_expire): Overrides the default expiration time (in seconds) for newly generated access tokens. This value sets the logical `expires` timestamp in the access token's [Session](/api-management/access-control/sessions-and-keys/understanding-sessions).
+- [`oauth_refresh_token_expire`](/tyk-oss-gateway/configuration#oauth_refresh_token_expire): Overrides the default expiration time (in seconds) for newly generated refresh tokens. If not set, it defaults to 14 days (1,209,600 seconds). When this TTL expires, the refresh token is physically deleted from Redis.
+- [`oauth_token_expired_retain_period`](/tyk-oss-gateway/configuration#oauth_token_expired_retain_period): Controls a background cleanup job that removes expired tokens from an internal tracking list (a Redis sorted set used to track all tokens issued to a specific OAuth Client). It does **not** control the Redis TTL or the retention of the actual Session data.
+
+#### Interaction with Session Lifecycle Controls
+
+Because OAuth access tokens are stored as standard Session objects, their physical retention in Redis is governed by Tyk's standard session lifecycle controls, not by the `oauth_token_expired_retain_period`.
+
+The `oauth_token_expire` setting defines the initial `expires` timestamp for the Session relating to the access token. Once that timestamp is reached, the [session lifecycle controls](/api-management/access-control/sessions-and-keys/session-lifecycle#summary-of-session-lifetime-calculation) determine how long the expired session data is retained in Redis.
+
+Refresh tokens, however, are not Session objects. They do not use the session lifecycle controls and are physically deleted from Redis exactly when their `oauth_refresh_token_expire` TTL is reached.
+
+For more details on how to control the physical retention of access token session data, see the [Session Lifecycle](/api-management/access-control/sessions-and-keys/session-lifecycle) documentation.
+
+
+### OAuth Token Notifications
+
+When operating as an OAuth authorization server, Tyk can generate an event whenever it issues an *access token*. You can configure a dedicated webhook that will be triggered to notify the Resource Owner service of the occurrence of the event.
+
+OAuth token notifications can only be configured when using **Authorization Code** or **Resource Owner Password Credentials** grants, not when using *Client Credentials* grant because this flow is primarily used for server-to-server communication, where the client acts on its own behalf without user-specific authorization changes.
+
+You can configure the URL that the webhook will issue a `POST` request and a "shared secret" value that will be provided in a header (`X-Tyk-Shared-Secret`) used to secure the communication to the target application. The OAuth token notification webhook does not support any other authentication method.
+
+The body of the webhook request will have this content:
+
+```json
+{
+  "auth_code": "",
+  "new_oauth_token": "",
+  "refresh_token": "",
+  "old_refresh_token": "",
+  "notification_type": ""
+}
+```
+
+where
+- `auth_code` is the Authorization Code that has been issued
+- `new_oauth_token` is the Access Token that has been issued
+- `refresh_token` is the Refresh Token that has been issued
+- `old_refresh_token` is the Refresh Token that has been consumed when refreshing an access token
+- `notification_type` will indicate the cause of the event:
+  - `new`: a new access token has been issued
+  - `refresh`: a token has been refreshed and a new refresh token has been issued
+
+#### Configuring Notifications in the Tyk API Designer
+
+Client Authentication is configured on the **Settings** screen within the Tyk OAS API Designer, within the **Server** section. Ensuring that you are in **Edit** mode, go to the *Authentication* section where you should have selected  **Tyk OAuth 2.0** from the drop down options.
+
+Here you will see the *Notifications* section where you can configure:
+
+- Notifications URL
+- Notifications Shared Secret
+
+Remember to select **Save API** to apply these settings to your API.
+
+#### Configuring Notifications in the Tyk OAS API Definition
+
+The example given [above](#using-the-api-definition) includes the configuration necessary to issue notifications for token issuance (see lines 48-51 in the example).
+
+## Managing OAuth Tokens via the Tyk Dashboard API
+
+In addition to the OAuth client management endpoints in the [Tyk Dashboard API](/tyk-dashboard-api), the following endpoints are available to manage OAuth tokens and obtain authorization codes.
+
+### Revoke a Single OAuth Client Token
+
+| **Property** | **Description**                                |
+| :------------ | :---------------------------------------------- |
+| Resource URL | `/api/apis/oauth/{oauthClientId}/revoke`       |
+| Method       | POST                                           |
+| Type         | JSON                                           |
+| Body         | Client Object                             |
+| Param        | None                                           |
+
+
+**Sample Request**
+
+```http
+POST /api/apis/oauth/411f0800957c4a3e81fe181141dbc22a/revoke
+Host: localhost
+Authorization 64c8e662f6924c4f55e94a873d75e44d
+Body: {
+  "token": "eyJvcmciOiI1ZTIwOTFjNGQ0YWVmY2U2MGMwNGZiOTIiLCJpZCI6IjIyODQ1NmFjNmJlMjRiMzI5MTIyOTdlODQ5NTc4NjJhIiwiaCI6Im11cm11cjY0In0=",
+  "token_type_hint": "access_token"
+}
+```
+**Sample Response**
+
+```json
+{
+  "Status": "OK",
+  "Message": "token revoked successfully",
+  "Meta": null
+}
+```
+### Revoke all OAuth Client Tokens
+
+| **Property** | **Description**                                |
+| :------------ | :---------------------------------------------- |
+| Resource URL | `/api/apis/oauth/{oauthClientId}/revoke_all`   |
+| Method       | POST                                           |
+| Type         | JSON                                           |
+| Body         | Client Object                                  |
+| Param        | None                                           |
+
+**Sample Request**
+
+```http
+POST /api/apis/oauth/411f0800957c4a3e81fe181141dbc22a/revoke_all
+Host: localhost
+Authorization: 64c8e662f6924c4f55e94a873d75e44d
+Body: {
+  "client_secret":"MzUyNDliNzItMDhlNy00MzM3LTk1NWUtMWQyODMyMjkwZTc0"
+}
+```
+
+**Sample Response**
+
+```json
+{
+  "Status": "OK",
+  "Message": "tokens revoked successfully",
+  "Meta": null
+}
+```
+
+### OAuth2.0 Authorization Code
+
+This endpoint is used in the [Authorization Code Grant](/api-management/authentication/oauth-2#using-the-authorization-code-grant) flow, generating an authorization code that can be used by the client to request an access token.
+
+| **Property** | **Description**                                |
+| :------------ | :---------------------------------------------- |
+| Resource URL | `/api/apis/oauth/{{api_id}}/authorize-client/` |
+| Method       | POST                                           |
+| Type         | Form-Encoded                                   |
+| Body         | Fields (see below)                             |
+
+* `api_id`: Unlike the other requests on this page, this must be the `api_id` value and **NOT** the API's `id` value. 
+* `response_type`: Should be provided by requesting client as part of authorization request, this should be either `code` or `token` depending on the methods you have specified for the API.
+* `client_id`: Should be provided by requesting client as part of authorization request. The Client ID that is making the request.
+* `redirect_uri`: Should be provided by requesting client as part of authorization request. Must match with the record stored with Tyk.
+* `key_rules`: A string representation of a Session Object (form-encoded). *This should be provided by your application in order to apply any quotas or rules to the key.*
+
+Note that in the following example, the `policy_id` isn't included in the request as these are optional. OAuth2.0 Flow also supports callbacks which can be added to the `key_rules` in the payload in requests that don't include the `policy_id`.
+
+
+**Sample Request**
+
+```curl
+curl -vX POST -H "Authorization: {{API Access Credentials}}" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d 'response_type=code&client_id={{client_id}}&redirect_uri=http%3A%2F%2Foauth.com%2Fredirect&key_rules=%7B+++++%22allowance%22%3A+999%2C+++++%22rate%22%3A+1000%2C+++++%22per%22%3A+60%2C+++++%22expires%22%3A+0%2C+++++%22quota_max%22%3A+-1%2C+++++%22quota_renews%22%3A+1406121006%2C+++++%22quota_remaining%22%3A+0%2C+++++%22quota_renewal_rate%22%3A+60%2C+++++%22access_rights%22%3A+%7B+++++++++%22528a67c1ac9940964f9a41ae79235fcc%22%3A+%7B+++++++++++++%22api_name%22%3A+%22{{api_name}}%22%2C+++++++++++++%22api_id%22%3A+%{{api_id}}%22%2C+++++++++++++%22versions%22%3A+%5B+++++++++++++++++%22Default%22+++++++++++++%5D+++++++++%7D+++++%7D%2C+++++%22org_id%22%3A+%22{{org_id}}%22+%7D'
+http://{{dashboard-hostname}}/api/apis/oauth/{{api_id}}/authorize-client
+```
+
+**Sample Response**
+
+```
+{
+  "code": "MWY0ZDRkMzktOTYwNi00NDRiLTk2YmQtOWQxOGQ3Mjc5Yzdk",
+  "redirect_to": "http://localhost:3000/oauth-redirect/?code=MWY0ZDRkMzktOTYwNi00NDRiLTk2YmQtOWQxOGQ3Mjc5Yzdk"
+}
+```
+
diff --git a/api-management/authentication/oauth2-authentication.mdx b/api-management/authentication/oauth2-authentication.mdx
new file mode 100644
index 0000000000..85e3dde901
--- /dev/null
+++ b/api-management/authentication/oauth2-authentication.mdx
@@ -0,0 +1,225 @@
+---
+title: "OAuth 2.0 with an External IdP"
+description: "Use the oauth2 security scheme to validate tokens issued by an external OAuth 2.0 provider, enforce per-operation scopes, and publish Protected Resource Metadata."
+keywords: "OAuth 2.0, external IdP, scope enforcement, Protected Resource Metadata, token exchange, MCP, oauth2 scheme"
+sidebarTitle: "OAuth 2.0 (External IdP)"
+---
+
+## Introduction
+
+The `oauth2` security scheme lets Tyk Gateway validate bearer tokens issued by an external OAuth 2.0 or OIDC provider. The scheme integrates scope enforcement, Protected Resource Metadata (PRM) publishing, and RFC 8693 token exchange into a single API-level declaration driven by your OpenAPI description.
+
+## How it fits with other OAuth options
+
+Tyk offers three distinct OAuth-related client authentication mechanisms:
+
+- **Tyk OAuth 2.0**: Tyk Gateway acts as the authorization server, issuing and managing tokens itself. See [Tyk OAuth 2.0](/api-management/authentication/oauth-2).
+- **`oauth2` security scheme** (this page): Tyk enforces scopes and can publish a PRM document for tokens issued by an external IdP.
+- **External OAuth (deprecated)**: A previous mechanism for external IdP integration, deprecated in Tyk 5.7.0. If you are using the `externalOAuthServer` block, the `oauth2` scheme is its replacement. Migration requires manual reconfiguration; there is no automatic migration for `externalOAuthServer` configs.
+
+## Configure the oauth2 scheme
+
+The `oauth2` scheme is declared in two places: the standard OAS `components.securitySchemes` section, and the Tyk Vendor Extension (`x-tyk-api-gateway`).
+
+### OAS security scheme declaration
+
+In `components.securitySchemes`, declare the scheme with `type: oauth2` and define the OAuth 2.0 flows your IdP supports. The scopes declared in `flows` serve as the documented catalog for your API and are used to populate the PRM document's `scopes_supported` field.
+
+```yaml
+components:
+  securitySchemes:
+    idpAuth:
+      type: oauth2
+      flows:
+        authorizationCode:
+          authorizationUrl: https://idp.example.com/realms/demo/protocol/openid-connect/auth
+          tokenUrl: https://idp.example.com/realms/demo/protocol/openid-connect/token
+          scopes:
+            api:read: Read access to API resources
+            api:write: Write access to API resources
+```
+
+The scheme name (`idpAuth` in this example) is used throughout the document to reference this scheme in `security:` arrays and in the Tyk Vendor Extension.
+
+### Tyk Vendor Extension
+
+Enable the scheme in the `x-tyk-api-gateway` extension using the matching scheme name:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        idpAuth:
+          enabled: true
+          header:
+            enabled: true
+            name: Authorization
+```
+
+With `enabled: true` and the `header` block configured, Tyk reads the bearer token from the specified header. To add scope enforcement, PRM, or token exchange, extend the block as described in the sections below.
+
+To read the token from a different header, cookie, or query parameter, add the matching `header`, `cookie`, or `query` block. For example, to read from a custom header:
+
+```yaml
+securitySchemes:
+  idpAuth:
+    enabled: true
+    header:
+      enabled: true
+      name: X-Auth-Token
+```
+
+### Apply the scheme to operations
+
+Reference the scheme in the OAS `security:` array to require it for all operations on the API, or on individual operations:
+
+```yaml
+# Root-level: applies to all operations
+security:
+  - idpAuth: []
+
+# Per-operation: require specific scopes on this operation
+paths:
+  /reports:
+    get:
+      security:
+        - idpAuth: [api:read]
+```
+
+When scopes are listed alongside the scheme name (for example `[api:read]`), they become the required scopes for that operation when scope enforcement is enabled.
+
+### Apply the scheme to MCP primitives
+
+MCP primitives (tools, resources, and prompts) have no OAS path entries of their own, so their security requirements are declared in the Tyk Vendor Extension rather than under `paths`. The structure mirrors the OAS `security:` array exactly:
+
+```yaml
+x-tyk-api-gateway:
+  middleware:
+    mcpTools:
+      get-report:
+        security:
+          - idpAuth: [api:read]
+    mcpResources:
+      customer-data:
+        security:
+          - idpAuth: [data:read]
+    mcpPrompts:
+      summarise:
+        security:
+          - idpAuth: []
+```
+
+The scope enforcement engine reads these the same way as per-operation `security:` declarations, subject to the same `scopeSource` rules. The root-level `security:` array still applies as a fallback when a primitive carries no `security` entry of its own.
+
+---
+
+## Scope enforcement
+
+Scope enforcement checks that the inbound token carries the scopes required by the matched operation's `security:` declaration. Configure it under `scopeCheck` in the scheme block:
+
+<Note>
+Scope enforcement reads claims from the inbound bearer token at request time. The `oauth2` scheme does not validate the token's JWT signature itself in Tyk 5.14.0. JWT authentication must be configured on the API so that the inbound token is verified before scope check runs. Without a JWT auth method configured, Tyk's auth chain will reject the request before scope enforcement is reached.
+</Note>
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        idpAuth:
+          enabled: true
+          scopeCheck:
+            enabled: true
+            claimNames: ["scope", "scp"]
+            separator: " "
+            scopeSource: "union"
+```
+
+When a request fails scope enforcement, Tyk returns `403 Forbidden` with a `WWW-Authenticate` challenge containing `error="insufficient_scope"`.
+
+### Scope check fields
+
+| Field | Type | Default | Description |
+|---|---|---|---|
+| `enabled` | boolean | `false` | Enables scope enforcement for this scheme. |
+| `claimNames` | array of strings | `["scope", "scp"]` | JWT claim names to read scopes from. Tyk reads all listed claims present on the token and merges the results into a single scope set. |
+| `separator` | string | `" "` (space) | Character used to split string-valued scope claims. Set to `","` for comma-separated IdPs. |
+| `scopeSource` | string | `"union"` | Which `security:` declarations drive the required scope set. See below. |
+
+### Scope source modes
+
+`scopeSource` controls which `security:` declarations Tyk enforces against:
+
+- **`union`** (default): Merges per-operation and root `security:` alternatives. A request passes if it satisfies any one alternative from the combined set.
+- **`operation`**: Only the matched operation's `security:` array applies. The root `security:` array is ignored.
+- **`global`**: Only the root `security:` array applies, uniformly across every operation on this API.
+
+### Per-operation and per-MCP-primitive overrides
+
+You can exempt individual operations or MCP primitives from scope enforcement by setting `enabled: false` on the operation or primitive:
+
+```yaml
+x-tyk-api-gateway:
+  middleware:
+    operations:
+      getHealthCheck:
+        scopeCheck:
+          enabled: false
+    mcpTools:
+      ping:
+        scopeCheck:
+          enabled: false
+```
+
+This is useful where a specific operation enforces scopes upstream, or where a health-check endpoint should be reachable without a fully-scoped token.
+
+---
+
+## Protected Resource Metadata
+
+Protected Resource Metadata (PRM) is a discovery document defined in [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728) that tells OAuth 2.0 clients where to obtain a token and which scopes the resource accepts. Tyk publishes this document from the `oauth2` scheme configuration, serving it at a well-known path on the API.
+
+Configure PRM under `protectedResourceMetadata` in the scheme block:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securitySchemes:
+        idpAuth:
+          enabled: true
+          protectedResourceMetadata:
+            enabled: true
+            resource: https://api.example.com/
+            authorizationServers:
+              - https://idp.example.com/realms/demo
+            wellKnownPath: .well-known/oauth-protected-resource
+            autoDeriveScopes: true
+```
+
+Tyk serves the PRM document at `{listenPath}/{wellKnownPath}`. The default well-known path is `.well-known/oauth-protected-resource`.
+
+### PRM fields
+
+| Field | Type | Default | Description |
+|---|---|---|---|
+| `enabled` | boolean | `false` | Enables PRM document publishing. |
+| `resource` | string | - | Canonical identifier for this resource. Surfaced as `resource` in the PRM document. Accepts Tyk context variables. |
+| `authorizationServers` | array of strings | - | Issuer URLs published in the PRM document. Clients use these to discover where to obtain a token. |
+| `wellKnownPath` | string | `.well-known/oauth-protected-resource` | Path at which the PRM document is served, relative to the API listen path. |
+| `autoDeriveScopes` | boolean | `true` | When `true`, the `scopes_supported` field is populated from both the `flows.scopes` catalog and every `security:` array on the API. When `false`, only the `flows.scopes` catalog is used. |
+
+### Migration
+
+Prior to Tyk 5.14.0, Protected Resource Metadata was configured at the root-level `authentication.protectedResourceMetadata` block. It is now configured under the `oauth2` security scheme at `authentication.securitySchemes[name].protectedResourceMetadata`.
+
+When Tyk Dashboard starts, it automatically migrates existing configurations across all OAS API definitions. No manual action is required. The migration is non-destructive: it skips any API where the new block already exists. If both locations are present, the scheme-level block takes precedence.
+
+
+## Token exchange
+
+Token exchange (RFC 8693) is a client authentication feature that replaces the inbound token with a backend-scoped token before forwarding the request upstream. It is configured within the `oauth2` scheme but operates in the upstream authentication phase, after scope enforcement and before the reverse proxy.
+
+Token exchange is Enterprise Edition only. For full configuration details, see [Token exchange](/api-management/authentication/token-exchange).
diff --git a/api-management/authentication/token-exchange.mdx b/api-management/authentication/token-exchange.mdx
new file mode 100644
index 0000000000..39cb2ab88e
--- /dev/null
+++ b/api-management/authentication/token-exchange.mdx
@@ -0,0 +1,193 @@
+---
+title: "Token Exchange"
+description: "Configure RFC 8693 token exchange to replace the inbound token with a backend-scoped token before forwarding requests upstream."
+keywords: "token exchange, RFC 8693, client authentication, OAuth 2.0, MCP, enterprise"
+sidebarTitle: "Token Exchange"
+---
+
+## Availability
+
+| Feature | Editions |
+|:---|:---|
+| Token exchange | Enterprise |
+
+*Available from Tyk 5.14.0*
+
+## Introduction
+
+Token exchange ([RFC 8693](https://www.rfc-editor.org/rfc/rfc8693)) is a client authentication feature that replaces the inbound bearer token with a backend-scoped token before forwarding a request to the upstream service. Tyk Gateway presents itself as a confidential client to an external authorization server, exchanges the inbound token for one audienced to the upstream, and injects the result into the `Authorization` header. The inbound token never reaches the upstream service.
+
+This approach addresses two common problems in multi-service architectures and MCP Gateway deployments:
+
+- **Token audience mismatch**: An SSO or agent token issued for Tyk is not accepted by the upstream service, which expects a token carrying its own audience claim.
+- **Audit trail continuity**: The raw inbound token is not forwarded to the upstream. The upstream receives a token scoped to its own audience, issued after the exchange, which keeps the token chain auditable at the authorization server level.
+
+Token exchange runs in the middleware chain after scope enforcement and before the reverse proxy.
+
+<Note>
+In open source deployments, token exchange does not execute at runtime. The inbound token is forwarded to the upstream unchanged, and an error is logged.
+</Note>
+
+---
+
+## How it works
+
+When a request arrives at a Tyk API with token exchange enabled:
+
+1. Tyk validates the inbound bearer token using the configured `oauth2` security scheme.
+2. If scope enforcement is enabled, Tyk checks the token's scopes against the operation's `security:` requirements.
+3. Tyk reads the `iss` claim from the validated token and matches it against the `issuers` list on each configured provider.
+4. Tyk POSTs an RFC 8693 exchange request to the matched provider's `tokenEndpoint`, presenting the inbound token as `subject_token`.
+5. The authorization server returns a new access token. Tyk replaces the `Authorization` header with the exchanged token.
+6. Tyk forwards the modified request upstream.
+
+If no configured provider's `issuers` list matches the inbound token's `iss` claim, Tyk returns `403 Forbidden` with `error="no_matching_provider"`.
+
+---
+
+## Configure token exchange
+
+Token exchange is configured under `tokenExchange` within the `oauth2` security scheme in your Tyk OAS API definition. The `oauth2` scheme must be enabled on the API; see [OAuth 2.0 (External IdP)](/api-management/authentication/oauth2-authentication). You must configure at least one provider.
+
+<Note>
+Token exchange reads the `iss` claim from the inbound bearer token at request time. The `oauth2` scheme does not validate the token's JWT signature itself in Tyk 5.14.0. JWT authentication must be configured on the API so that the inbound token is verified before the exchange middleware runs. Without a JWT auth method configured, Tyk's auth chain will reject the request before token exchange is reached.
+</Note>
+
+### Minimal example
+
+```yaml expandable
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        idpAuth:
+          enabled: true
+          tokenExchange:
+            enabled: true
+            providers:
+              - name: keycloak-prod
+                issuers:
+                  - https://idp.example.com/realms/demo
+                tokenEndpoint: https://idp.example.com/realms/demo/protocol/openid-connect/token
+                clientAuth:
+                  method: client_secret_basic
+                  clientId: tyk-gateway
+                  clientSecret: env://EXCHANGE_CLIENT_SECRET
+                defaultTarget:
+                  audience: https://api.internal.example.com
+                  scopes:
+                    - api:read
+                    - api:write
+```
+
+String fields in the API definition accept `env://`, `secrets://`, `vault://`, and `consul://` prefixes so sensitive values are not stored directly in the definition.
+
+### Provider fields
+
+Each entry in `providers` matches inbound tokens by `iss` claim and routes exchange requests to the corresponding token endpoint. Provider names must be unique, and issuer values must not overlap across providers.
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `name` | string | Yes | Operator-assigned identifier used in log output. Must be unique across providers. |
+| `issuers` | array of strings | Yes | Inbound token `iss` values routed to this provider. Must not overlap with issuers declared on other providers. |
+| `tokenEndpoint` | string | Yes | Authorization server token endpoint. Must accept `grant_type=urn:ietf:params:oauth:grant-type:token-exchange`. |
+| `clientAuth.method` | string | No | How Tyk authenticates to the token endpoint: `client_secret_basic` (default) sends credentials in the `Authorization` header; `client_secret_post` sends them in the request body. |
+| `clientAuth.clientId` | string | Yes | Client ID Tyk presents to the authorization server. |
+| `clientAuth.clientSecret` | string | No | Client secret. Accepts `env://`, `secrets://`, `vault://`, `consul://` prefixes. |
+| `defaultTarget.audience` | string | No | Default audience requested for the exchanged token. Applied when no per-operation override is set. |
+| `defaultTarget.scopes` | array of strings | No | Default scopes requested. Applied when no per-operation override is set. |
+| `timeout` | duration string | No | Per-call timeout for requests to `tokenEndpoint`. Accepts values such as `"5s"` or `"500ms"`. Defaults to `"15s"`. |
+| `customParams` | map | No | Additional form parameters appended to the exchange request. Standard RFC 8693 keys (`grant_type`, `subject_token`, `audience`, and others) are reserved and cannot be overridden. |
+
+### Caching
+
+Tyk can cache exchanged tokens in Redis to avoid a round-trip to the authorization server on every request. Configure caching under `cache` within a provider:
+
+```yaml
+providers:
+  - name: keycloak-prod
+    ...
+    cache:
+      enabled: true
+      mode: derived
+      maxTimeout: 5m
+      safetyMargin: 30s
+```
+
+| Field | Type | Default | Description |
+|---|---|---|---|
+| `enabled` | boolean | `false` | Enables Redis-backed caching for this provider's exchanged tokens. |
+| `mode` | string | `"derived"` | How the cache TTL is computed. `"derived"`: TTL is `min(expiresIn, inboundRemaining, maxTimeout) − safetyMargin`, where `expiresIn` is the exchanged token's lifetime, `inboundRemaining` is the inbound token's remaining life, and `maxTimeout` is an optional operator ceiling. `"static"`: TTL is `min(timeout, expiresIn) − safetyMargin`; the exchanged token's expiry still acts as an upper bound even in fixed-TTL mode. |
+| `maxTimeout` | duration string | - | Optional operator ceiling on the cache TTL in `"derived"` mode (for example, `"5m"`). Has no effect in `"static"` mode. |
+| `timeout` | duration string | - | Fixed cache TTL in `"static"` mode (for example, `"2m"`). Still clamped by the exchanged token's expiry. |
+| `safetyMargin` | duration string | `"30s"` | Duration subtracted from the computed TTL to avoid serving near-expired tokens. Applies in both modes. |
+
+---
+
+## Per-operation override
+
+The `defaultTarget` on a provider applies to all requests routed to that provider. To request a different audience or scope set for a specific operation, add an `exchange` block under the matching operation in `middleware.operations`:
+
+```yaml
+x-tyk-api-gateway:
+  middleware:
+    operations:
+      getInternalReport:
+        exchange:
+          enabled: true
+          audience: https://reporting.internal.example.com
+          scopes:
+            - reports:read
+```
+
+| Field | Type | Description |
+|---|---|---|
+| `enabled` | boolean | Activates this per-operation override. When `false` or absent, the provider's `defaultTarget` is used. |
+| `audience` | string | Audience requested for this operation's exchanged token. |
+| `scopes` | array of strings | Explicit scope list for this operation. When empty and `enabled` is `true`, scopes are inferred from the operation's `security:` declaration; see [Scope inference](#scope-inference). |
+
+---
+
+## Per-MCP-primitive override
+
+For MCP Gateway deployments, you can override the exchange target per primitive using `middleware.mcpTools`, `middleware.mcpResources`, or `middleware.mcpPrompts`:
+
+```yaml
+x-tyk-api-gateway:
+  middleware:
+    mcpTools:
+      create-report:
+        exchange:
+          enabled: true
+          audience: https://reporting.internal.example.com
+          scopes:
+            - reports:write
+```
+
+The `exchange` block on a primitive has the same fields as the per-operation block. This lets you route different primitives to different downstream audiences within a single provider. For example, read tools to a read-only service and write tools to an elevated-privilege service.
+
+---
+
+## Scope inference
+
+When a per-operation or per-primitive `exchange` block has `enabled: true` but `scopes` is empty, Tyk infers the scope list from the operation's or primitive's `security:` declaration. The scopes required by the operation's security requirements are sent as the requested scope to the authorization server, aligning the exchanged token's scope with what the upstream is expected to require (RFC 8693 §4.5.5).
+
+If you prefer explicit control over the requested scopes, set `scopes` to a non-empty list.
+
+
+---
+
+## Known limitations
+
+The following limitations apply in Tyk 5.14.0:
+
+- **Azure Entra On-Behalf-Of**: Entra's On-Behalf-Of (OBO) flow does not conform to RFC 8693. Azure Entra is not supported in this release.
+
+---
+
+## Token exchange and upstream auth
+
+<Note>
+Do not configure `upstream.authentication.oauth` alongside token exchange. Token exchange replaces the `Authorization` header with the exchanged token before the reverse proxy; it is the upstream credential. The `upstream.authentication` block is for a separate scenario where Tyk authenticates to the upstream using its own static credentials, independent of any inbound token. Configuring both will produce a conflict.
+</Note>
diff --git a/api-management/automations.mdx b/api-management/automations.mdx
new file mode 100644
index 0000000000..9835504d67
--- /dev/null
+++ b/api-management/automations.mdx
@@ -0,0 +1,66 @@
+---
+title: "Tyk Automations Tools"
+description: "Tyk Tools that help with automating deployment and API Management operations"
+keywords: "Tyk API Management, Tyk Sync, Tyk Operator, Github, Kubernetes, Automations"
+sidebarTitle: "Overview"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+
+## Introduction
+
+Managing APIs across multiple environments can quickly become complex. Updating and overseeing multiple configurations, security policies, and deployments requires a significant amount of effort without the right tools. Tyk’s suite of automation tools simplifies this process by enabling automated control over API management tasks, helping teams ensure reliability, reduce manual errors, and maintain consistency across deployments.
+
+In this page, we’ll walk through the primary tools for automating API management with Tyk, including:
+
+* **Tyk Operator for Kubernetes**: Automate API deployments within Kubernetes environments.
+* **Tyk Sync**: Sync configurations across environments for consistent API management.
+
+## Prerequisites
+
+Before diving into lifecycle automations with Tyk, ensure you have the following:
+
+- **A Tyk installation** (Self-Managed or Cloud)
+  - If you don't have Tyk installed, follow our [installation guide](/tyk-self-managed/install)
+  - For Tyk Cloud, sign up [here](https://tyk.io/sign-up/)
+  - Tyk Operator license key. Starting from Tyk Operator v1.0, a valid license key is required.
+
+- **Access to a Kubernetes cluster v1.19+** (for Tyk Operator sections)
+  - If you're new to Kubernetes, check out the official [Kubernetes documentation](https://kubernetes.io/docs/setup/)
+
+- **Helm 3+** (for installing Tyk Operator)
+  - If you don't have Helm installed, follow the [official Helm installation guide](https://helm.sh/docs/intro/install/)
+  - Verify your installation by running `helm version` in your terminal
+
+- **Tyk Dashboard v3+ access** (for Tyk Sync setup)
+  - Learn how to set up the Tyk Dashboard [here](/api-management/dashboard-configuration)
+
+- **Basic knowledge of Kubernetes, YAML** (important for Tyk Operator and Tyk Sync)
+  - For Kubernetes, visit the [official tutorials](https://kubernetes.io/docs/tutorials/)
+  - For YAML, check out this [YAML tutorial](https://yaml.org/spec/1.2/spec.html)
+
+If you're missing any of these prerequisites, please follow the provided links to set up the necessary components before proceeding with the lifecycle automation steps.
+
+## Automation Tools
+
+<ResponsiveGrid>
+
+
+<Card href="/api-management/automations/sync" img="/img/GitHub-Mark-64px.png">
+**Read time: 10 mins**
+
+Synchronize Tyk Environment With GitHub using Tyk Sync.
+</Card>
+
+<Card href="/api-management/automations/operator" img="/img/k8s.png">
+**Read time: 10 mins**
+
+API Management in Kubernetes using Tyk Operator.
+</Card>
+
+
+</ResponsiveGrid>
+
+## Conclusion
+
+With Tyk’s automation tools, you now have a set of options for streamlining API management, from handling deployments within Kubernetes to establishing consistency across multiple environments. By integrating these tools, you can simplify complex API workflows, maintain secure configurations, and save time through reduced manual intervention.
\ No newline at end of file
diff --git a/api-management/automations/operator.mdx b/api-management/automations/operator.mdx
new file mode 100644
index 0000000000..e45016d4a8
--- /dev/null
+++ b/api-management/automations/operator.mdx
@@ -0,0 +1,987 @@
+---
+title: "Tyk Operator - API Management in Kubernetes"
+description: "Kubernetes native API management using Tyk Operator"
+keywords: "Tyk API Management, Tyk Sync, Tyk Operator, Github, Kubernetes, Automations"
+sidebarTitle: "Overview"
+---
+
+## Introduction
+
+Using Tyk Operator within Kubernetes allows you to manage API lifecycles declaratively. This section provides instructions for setting up and configuring the Tyk Operator to automate API creation, updates, and security in Kubernetes clusters, ensuring your APIs align with Kubernetes management practices.
+
+
+## What is Tyk Operator?
+If you’re using Kubernetes, or if you’re building an API that operates within a Kubernetes environment, the Tyk Operator is a powerful tool for automating the API lifecycle.
+
+Tyk Operator is a native Kubernetes operator, allowing you to define and manage APIs as code. This means you can deploy, update, and secure APIs using the same declarative configuration approach Kubernetes uses for other application components. 
+
+<img src="/img/operator/tyk-operator.svg" alt="Tyk Operator" width="600" />
+
+## Key Concepts
+
+### GitOps With Tyk
+With Tyk Operator, you can configure your APIs using Kubernetes native manifest files. You can use the manifest files in a GitOps workflow as the single source of truth for API deployment.
+
+
+<Note>
+If you use Tyk Operator to manage your APIs, you should set up RBAC such that human users cannot have the "write" permission on the API definition endpoints using Tyk Dashboard.
+</Note>
+
+
+#### What is GitOps?
+“GitOps” refers to the operating model of using Git as the “single source of truth” to drive continuous delivery for infrastructure and software through automated CI/CD workflow.
+
+#### Tyk Operator in your GitOps workflow
+You can install Argo CD, Flux CD or the GitOps tool of your choice in a cluster, and connect it to the Git repository where you version control your API manifests. The tool can synchronise changes from Git to your cluster. The API manifest updates in cluster would be detected by Tyk Operator, which has a Kubernetes controller to automatically reconcile the API configurations on your Tyk Gateway or Tyk Dashboard. 
+
+**Kubernetes-Native Developer Experience** 
+API Developers enjoy a smoother Continuous Integration process as they can develop, test, and deploy the microservices. API configurations together use familiar development toolings and pipeline.
+
+**Reliability** 
+With declarative API configurations, you have a single source of truth to recover after any system failures, reducing the meantime to recovery from hours to minutes.
+
+#### Single Source of Truth for API Configurations
+Tyk Operator will reconcile any divergence between the Kubernetes desired state and the actual state in [Tyk Gateway](/tyk-oss-gateway) or [Tyk Dashboard](/api-management/dashboard-configuration). Therefore, you should maintain the API definition manifests in Kubernetes as the single source of truth for your system. If you update your API configurations using Tyk Dashboard, those changes would be reverted by Tyk Operator eventually.
+
+To learn more about Gitops with Tyk, refer the following blog posts:
+- [GitOps-enabled API management in Kubernetes](https://tyk.io/blog/gitops-enabled-api-management-in-kubernetes/)
+- [A practical guide using Tyk Operator, ArgoCD, and Kustomize](https://tyk.io/blog/a-practical-guide-using-tyk-operator-argocd-and-kustomize/)
+
+### Custom Resources in Tyk
+
+In Kubernetes, a [Custom Resource (CR)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) is an extension of the Kubernetes API that allows you to introduce custom objects in your cluster. Custom Resources enable you to define and manage custom configurations and settings specific to your applications, making Kubernetes highly extensible. These custom objects are defined using Custom Resource Definitions (CRDs), which specify the schema and structure of the resource.
+
+Tyk Operator manages multiple custom resources to help users create and maintain their API configurations:
+
+**TykOasApiDefinition**: Available from Tyk Operator v1.0. It represents a [Tyk OAS API configuration](/api-management/gateway-config-tyk-oas). Tyk OAS API is based on the OpenAPI specification (OAS) and is the recommended format for standard HTTP APIs.
+
+**ApiDefinition**: Available on all versions of Tyk Operator. It represents a [Tyk Classic API configuration](/api-management/gateway-config-tyk-classic). Tyk Classic API is the traditional format used for defining all APIs in Tyk, and now the recommended format for non-HTTP APIs such as TCP, GraphQL, and Universal Data Graph (UDG). Tyk Operator supports the major features of Tyk Classic API and the feature support details can be tracked [here](/api-management/automations/operator#apidefinition-crd).
+
+**TykStreamsApiDefinition**: Available from Tyk Operator v1.1. It represents an [Async API configuration](/api-management/event-driven-apis#configuration-options) which is based on [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas). Tyk Operator supports all [Tyk Streams](/api-management/event-driven-apis#) features as they become available on the Gateway.
+
+**SecurityPolicy**: Available on all versions of Tyk Operator. It represents a [Tyk Security Policy configuration](/tyk-stack/tyk-operator/create-an-api#security-policy-example). Security Policies in Tyk provide a way to define and enforce security controls, including authentication, authorization, and rate limiting for APIs managed in Tyk. Tyk Operator supports essential features of Security Policies, allowing users to centrally manage access control and security enforcement for all APIs across clusters.
+
+**TykMcpProxyDefinition**: Available from Tyk Operator v1.4.0. It represents a [Model Context Protocol (MCP) proxy](/product-stack/tyk-operator/mcp-proxy) managed by Tyk. The Operator reads the MCP OAS document from a referenced `ConfigMap` and reconciles it with Tyk.
+
+These custom resources enable users to leverage Kubernetes' declarative configuration management to define, modify, and version their APIs, seamlessly integrating with other Kubernetes-based workflows and tools.
+
+#### Custom Resources for API and Policy Configuration
+
+The following custom resources can be used to configure APIs and policies at [Tyk Gateway](/tyk-oss-gateway) or [Tyk Dashboard](/api-management/dashboard-configuration).
+
+| Kind               | Group       | Version   | Description                                                                                       |
+| :-------------------- | :------------- | :----------- | :--------------------------------------------------------------------------------------------------- |
+| TykOasApiDefinition| tyk.tyk.io  | v1alpha1  | Defines configuration of [Tyk OAS API Definition object](/api-management/gateway-config-tyk-oas)                                 |
+| ApiDefinition      | tyk.tyk.io  | v1alpha1  | Defines configuration of [Tyk Classic API Definition object](/api-management/gateway-config-tyk-classic)                                 |
+| TykStreamsApiDefinition| tyk.tyk.io  | v1alpha1  | Defines configuration of [Tyk Streams](/api-management/event-driven-apis#configuration-options)                                 |
+| SecurityPolicy     | tyk.tyk.io  | v1alpha1  | Defines configuration of [security policies](/api-management/policies). Operator supports linking ApiDefinition custom resources in SecurityPolicy's access list so that API IDs do not need to be hardcoded in the resource manifest.        |
+| TykMcpProxyDefinition | tyk.tyk.io | v1alpha1 | Defines a [Model Context Protocol (MCP) proxy](/product-stack/tyk-operator/mcp-proxy) sourced from a referenced `ConfigMap`. Available from Tyk Operator v1.4.0. |
+| SubGraph           | tyk.tyk.io  | v1alpha1  | Defines a [GraphQL federation subgraph](/api-management/graphql#subgraphs-and-supergraphs).                                           |
+| SuperGraph         | tyk.tyk.io  | v1alpha1  | Defines a [GraphQL federation supergraph](/api-management/graphql#subgraphs-and-supergraphs).                                        |
+| OperatorContext    | tyk.tyk.io  | v1alpha1  | Manages the context in which the Tyk Operator operates, affecting its overall behavior and environment. See [Operator Context](/api-management/automations/operator#multi-tenancy-in-tyk) for details. |
+
+#### Tyk Classic Developer Portal
+
+The following custom resources can be used to configure [Tyk Classic Developer Portal](/tyk-developer-portal/tyk-portal-classic).
+
+| Kind               | Group       | Version   | Description                                                                                       |
+| :-------------------- | :------------- | :----------- | :--------------------------------------------------------------------------------------------------- |
+| APIDescription     | tyk.tyk.io  | v1alpha1  | Configures [Portal Documentation](/tyk-apis/tyk-portal-api/portal-documentation). |
+| PortalAPICatalogue | tyk.tyk.io  | v1alpha1  | Configures [Portal API Catalogue](/getting-started/key-concepts/api-catalogue). |
+| PortalConfig       | tyk.tyk.io  | v1alpha1  | Configures [Portal Configuration](/tyk-apis/tyk-portal-api/portal-configuration). |
+
+
+### Reconciliation With Tyk Operator 
+
+#### High Availability and Leader Election
+Tyk Operator supports an active-passive model for High Availability (HA) using Kubernetes leader election. When leader election is enabled (which is the default behavior in the Tyk Operator Helm chart), only one Operator pod (the leader) actively reconciles Custom Resource Definitions (CRDs) at any given time. The remaining replicas stay on standby and will only take over the reconciliation process if the active leader pod becomes unavailable. 
+
+#### Controllers & Operators
+In Kubernetes, [controllers](https://kubernetes.io/docs/concepts/architecture/controller/) watch one or more Kubernetes resources, which can be built-in types like *Deployments* or custom resources like *ApiDefinition* - in this case, we refer to Controller as Operator. The purpose of a controller is to match the desired state by using Kubernetes APIs and external APIs.
+
+> A [Kubernetes operator](https://www.redhat.com/en/topics/containers/what-is-a-kubernetes-operator) is an application-specific controller that extends the functionality of the Kubernetes API to create, configure, and manage instances of complex applications on behalf of a Kubernetes user.
+
+#### Desired State vs Observed State
+Let’s start with the *Desired State*. It is defined through Kubernetes Manifests, most likely YAML or JSON, to describe what you want your system to be in. Controllers will watch the resources and try to match the actual state (the observed state) with the desired state for Kubernetes Objects. For example, you may want to create a Deployment that is intended to run three replicas. So, you can define this desired state in the manifests, and Controllers will perform necessary operations to make it happen.
+
+How about *Observed State*? Although the details of the observed state may change controller by controller, usually controllers update the status field of Kubernetes objects to store the observed state. For example, in Tyk Operator, we update the status to include *api_id*, so that Tyk Operator can understand that the object was successfully created on Tyk.
+
+#### Reconciliation
+Reconciliation is a special design paradigm used in Kubernetes controllers. Tyk Operator also uses the same paradigm, which is responsible for keeping our Kubernetes objects in sync with the underlying external APIs - which is Tyk in our case. 
+
+**When would reconciliation happen?**
+<br />
+Before diving into Tyk Operator reconciliation, let's briefly mention some technical details about how and when reconciliation happens. Reconciliation only happens when certain events happen on your cluster or objects. Therefore, Reconciliation will **NOT** be triggered when there is an update or modification on Tyk’s side. It only watches certain Kubernetes events and is triggered based on them. Usually, the reconciliation happens when you modify a Kubernetes object or when the cache used by the controller expires - side note, controllers, in general, use cached objects to reduce the load in the Kube API server. Typically, caches expire in ~10 hours or so but the expiration time might change based on Operator configurations.
+
+So, in order to trigger Reconciliation, you can either
+- modify an object, which will trigger reconciliation over this modified object or,
+- restart Tyk Operator pod, which will trigger reconciliation over each of the objects watched by Tyk Operator.
+
+**What happens during Reconciliation?**
+<br />
+Tyk Operator will compare desired state of the Kubernetes object with the observed state in Tyk. If there is a drift, Tyk Operator will update the actual state on Tyk with the desired state. In the reconciliation, Tyk Operator mainly controls three operations; DELETE, CREATE, and UPDATE.
+
+- **CREATE** - an object is created in Kubernetes but not exists in Tyk
+- **UPDATE** - an object is in different in Kubernetes and Tyk (we compare that by hash)
+- **DELETE** - an object is deleted in Kubernetes but exists in Tyk
+
+**Drift Detection**
+<br />
+If human operators or any other system delete or modify API Definition from Tyk Gateway or Dashboard, Tyk Operator will restore the desired state back to Tyk during reconciliation. This is called Drift Detection. It can protect your systems from unauthorized or accidental modifications. It is a best practice to limit user access rights on production environment to read-only in order to prevent accidental updates through API Manager directly.
+
+
+### CRD Versioning
+
+Tyk follows standard practices for naming and versioning custom resources as outlined by the Kubernetes Custom Resource Definition [versioning guidelines](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning/). Although we are currently on the `v1alpha1` version, no breaking changes will be introduced to existing Custom Resources without a version bump. This means that any significant changes or updates that could impact existing resources will result in a new version (e.g., `v1beta1` or `v1`) and Operator will continue supporting all CRD versions for a reasonable time before deprecating an older version. This ensures a smooth transition and compatibility, allowing you to upgrade without disrupting your current configurations and workflows.
+
+For more details on Kubernetes CRD versioning practices, refer to the Kubernetes Custom Resource Definition [Versioning documentation](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning/).
+
+
+### Operator User
+Tyk Operator is a Kubernetes Controller that manages Tyk Custom Resources (CRs) such as API Definitions and Security Policies. Developers define these resources as [Custom Resource (CRs)](#custom-resources-in-tyk), and Tyk Operator ensures that the desired state is reconciled with the Tyk Gateway or Dashboard. This involves creating, updating, or deleting API configurations until the target state matches the desired state.
+
+For the Tyk Dashboard, Tyk Operator functions as a system user, bound by Organization and RBAC rules.
+
+During start up, Tyk Operator looks for these keys from `tyk-operator-conf` secret or from the environment variables (listed in the table below).
+
+| Key or Environment Variable | Description  |
+|:-----|:-------------|
+| `TYK_MODE` | "ce" for OSS or "pro" for licensed users |
+| `TYK_URL` | URL of Tyk Gateway or Dashboard API |
+| `TYK_ORG` | Organization ID of Operator user |
+| `TYK_AUTH` | API key of Operator user |
+
+These would be the default credentials Tyk Operator uses to connect to Tyk.
+
+
+### Multi-tenancy in Tyk
+
+Tyk Dashboard is multi-tenant capable, which means you can use a single Tyk Dashboard instance to host separate [organizations](/dashboard-admin-api#organizations) for each team or department. Each organization is a completely isolated unit with its own:
+
+- API Definitions
+- API Keys
+- Users
+- Developers
+- Domain
+- Tyk Classic Portal
+
+This structure is ideal for businesses with a complex hierarchy, where distinct departments operate independently but within the same overall infrastructure.
+
+<img src="/img/operator/tyk-organisations.svg" alt="Multi-tenancy in Tyk Dashboard" width="600" />
+
+#### Define OperatorContext for Multi-Tenant API Management
+
+The `OperatorContext` in Tyk Operator allows you to create isolated management environments by defining specific access parameters for different teams or departments within a shared Tyk Operator instance. It helps you specify:
+
+- The Tyk Dashboard with which the Operator interacts
+- The organization under which API management occurs
+- The user identity utilized for requests
+- The environment in which the Operator operates
+
+By setting different `OperatorContext` configurations, you can define unique access and management contexts for different teams. These contexts can then be referenced directly in your `ApiDefinition`, `TykOasApiDefinition` or `SecurityPolicy` custom resource definitions (CRDs) using the `contextRef` field, enabling precise control over API configurations.
+
+#### Example Scenarios Using OperatorContext
+
+1. **No OperatorContext Defined**
+   - If no `OperatorContext` is defined, Tyk Operator defaults to using credentials from the `tyk-operator-conf` secret or from environment variables. This means all API management actions are performed under the system’s default user credentials, with no specific contextual isolation.
+
+2. **OperatorContext Defined but Not Referenced**
+   - When an `OperatorContext` is defined but not referenced in an API configuration, Tyk Operator continues to use the default credentials from `tyk-operator-conf`. The specified `OperatorContext` is ignored, resulting in API operations being managed under default credentials.
+
+3. **OperatorContext Defined and Referenced**
+   - If a specific `OperatorContext` is both defined and referenced in an API or policy, Tyk Operator utilizes the credentials and parameters from the referenced `OperatorContext` to perform API operations. This allows each API or policy to be managed with isolated configurations, enabling team-based or department-specific API management within the same Kubernetes cluster.
+
+Using `OperatorContext` offers flexibility for multi-tenancy, helping organizations manage and isolate API configurations based on their specific team or departmental needs.
+
+<img src="/img/operator/tyk-operator-context.svg" alt="Multi-tenancy in Kubernetes Tyk Operator" width="600" />
+
+### TLS Certificates
+
+Tyk Operator is designed to offer a seamless Kubernetes-native experience by managing TLS certificates stored within Kubernetes for your API needs. Traditionally, to use a certificate (e.g., as a client certificate, domain certificate, or certificate for accessing an upstream service), you would need to manually upload the certificate to Tyk and then reference it using a 'Certificate ID' in your API definitions. This process can become cumbersome, especially in a Kubernetes environment where certificates are often managed as secrets and may rotate frequently.
+
+To address this challenge, Tyk Operator allows you to directly reference certificates stored as Kubernetes secrets within your custom resource definitions (CRDs). This reduces operational overhead, minimizes the risk of API downtime due to certificate mismatches, and provides a more intuitive experience for API developers.
+
+#### Benefits of Managing Certificates with Tyk Operator
+- **Reduced operational overhead**: Automates the process of updating certificates when they rotate.
+- **Minimized risk of API downtime**: Ensures that APIs continue to function smoothly, even when certificates are updated.
+- **Improved developer experience**: Removes the need for API developers to manage certificate IDs manually.
+
+#### Examples
+
+| Certificate Type | Supported in ApiDefinition | Supported in TykOasApiDefinition | Supported in TykStreamsApiDefinition |
+| :------------------ | :------------- | :--------- | :--------- |
+| Client certifates | ✅ [Client mTLS](/api-management/implement-tls#using-a-static-client-certificate-allow-list) | ✅ [Client mTLS](/api-management/implement-tls#using-a-static-client-certificate-allow-list) | Certificate ID can be set in the API Definition but configuring certificates from Secrets in CRD is not supported. |
+| Custom domain certificates | ✅ [TLS and SSL](/api-management/implement-tls#configure-server-certificates-for-api-custom-domains) | ✅ [TLS and SSL](/api-management/implement-tls#configure-server-certificates-for-api-custom-domains) | Certificate ID can be set in the API Definition but configuring certificates from Secrets in CRD is not supported. |
+| Public keys pinning | ✅ [Certificate pinning](/api-management/upstream-authentication/mtls#using-tyk-operator-to-configure-mtls-for-tyk-classic-apis) | ✅ [Certificate pinning](/api-management/upstream-authentication/mtls#certificate-pinning) | Certificate ID can be set in the API Definition but configuring certificates from Secrets in CRD is not supported. |
+| Upstream mTLS | ✅ [Upstream mTLS via Operator](/api-management/upstream-authentication/mtls#using-tyk-operator-to-configure-mtls-for-tyk-classic-apis) | ✅ [Upstream mTLS via Operator](/api-management/upstream-authentication/mtls#using-tyk-operator-to-configure-mtls) | Certificate ID can be set in the API Definition but configuring certificates from Secrets in CRD is not supported. |
+
+## What Features Are Supported By Tyk Operator?
+
+### APIDefinition CRD
+Tyk stores API configurations as JSON objects called API Definitions. If you are using Tyk Dashboard to manage Tyk, then these are stored in either Postgres or MongoDB, as specified in the database settings. On the other hand, if you are using Tyk OSS, these configurations are stored as files in the /apps directory of the Gateway which is located at the default path /opt/tyk-gateway.
+
+An API definition includes various settings and middleware that control how incoming requests are processed.
+
+#### API Types
+Tyk supports various API types, including HTTP, HTTPS, TCP, TLS, and GraphQL. It also includes Universal Data Graph versions for unified data access and federation, allowing seamless querying across multiple services.
+
+| Type                           | Support | Supported From | Comments                     |
+| :-------------------------------- | :--------- | :---------------- | :------------------------------ |
+| HTTP                           | ✅      | v0.1           | Standard HTTP proxy for API requests. |
+| HTTPS                          | ✅      | v0.4           | Secure HTTP proxy using SSL/TLS encryption. |
+| TCP                            | ✅      | v0.1           | Handles raw TCP traffic, useful for non-HTTP APIs. |
+| TLS                            | ✅      | v0.1           | Handles encrypted TLS traffic for secure communication. |
+| GraphQL - Proxy                | ✅      | v0.1           | Proxy for GraphQL APIs, routing queries to the appropriate service. |
+| Universal Data Graph v1        | ✅      | v0.1           | Supports Universal Data Graph v1 for unified data access. |
+| Universal Data Graph v2        | ✅      | v0.12          | Supports the newer Universal Data Graph v2 for more advanced data handling. |
+| GraphQL - Federation           | ✅      | v0.12          | Supports GraphQL Federation for querying multiple services as one API. |
+
+#### Management of APIs
+Tyk offers flexible API management features such as setting active/inactive status, categorizing and naming APIs, versioning, and defining ownership within teams or organizations for streamlined administration.
+
+| Type                           | Support | Supported From | Comments                     |
+| :-------------------------------- | :--------- | :---------------- | :------------------------------ |
+| API Name                       | ✅      | v0.1           | Assign and manage names for your APIs. |
+| API Status (inactive/active)   | ✅      | v0.2           | Toggle API status between active and inactive. |
+| API Categories                 | ✅      | v0.1           | Categorize APIs for easier management. |
+| API ID                         | ✅      | v0.1           | Assign unique IDs to APIs for tracking and management. |
+| API Ownership                  | ✅      | v0.12          | Define ownership of APIs within teams or organizations. Available for Tyk Classic APIs from v0.12. Currently not supported for Tyk OAS APIs (planned for v1.5.0). |
+| API Versioning                 | ✅      | v0.1           | Enable version control for APIs. |
+
+#### Traffic Routing
+Tyk enables traffic routing through path-based or host-based proxies and allows redirection to specific target URLs, providing control over how requests are directed to backend services.
+
+| Type                        | Supported | Supported From | Comments                     |
+| :--------------------------- | :--------- | :-------------- | :---------------------------- |
+| Path-Based Proxy            | ✅        | v0.1           | Route traffic based on URL path. |
+| Host-Based Proxy            | ✅        | v0.1           | Route traffic based on the request host. |
+| Target URL                  | ✅        | v0.1           | Redirect traffic to a specific target URL. |
+
+#### Client to Gateway Authentication and Authorization
+Tyk provides multiple authentication options for client-to-gateway interactions, including keyless access, JWT, client mTLS, IP allow/block lists, and custom authentication plugins for enhanced security.
+
+| Type                          | Supported | Supported From | Comments                                        |
+| :----------------------------- | :--------- | :-------------- | :----------------------------------------------- |
+| Keyless                       | ✅        | v0.1           | No authentication required, open access.        |
+| Auth Token                    | ✅        | v0.1           | Requires an authentication token (Bearer token).|
+| JWT                           | ✅️        | v0.5           | Uses JSON Web Tokens for secure authentication. |
+| OpenID Connect                | ❌        | -              | Recommended to use JWT for OIDC authentication. |
+| OAuth2                        | ❌        | -              | OAuth2 not supported, JWT is recommended.       |
+| Client mTLS                   | ✅        | v0.11          | Supports static client mutual TLS authentication. |
+| HMAC                          | ❌        | -              | HMAC authentication is not implemented.         |
+| Basic Authentication          | ✅        | v0.12          | Only supports enabling with default metadata.   |
+| Custom Authentication Plugin (Go)   | ✅        | v0.11          | Custom authentication plugin written in Go.     |
+| Custom Authentication Plugin (gRPC) | ✅        | v0.1           | Custom authentication plugin using gRPC.        |
+| Multiple Authentication       | ✅        | v0.14          | Chain multiple authentication methods.          |
+| IP Allowlist                  | ✅        | v0.5           | Allows access only from specific IP addresses.  |
+| IP Blocklist                  | ✅        | v0.5           | Blocks access from specific IP addresses.       |
+
+#### Gateway to Upstream Authentication
+Tyk supports secure upstream connections through mutual TLS, certificate pinning, and public key verification to ensure data integrity between the gateway and backend services. For full details, please see the [Upstream Authentication](/api-management/upstream-authentication) section.
+
+| Type                                            | Supported | Supported From |
+| :------------------------------------------------- | :----------- | :---------------- |
+| Mutual TLS for upstream connectioons            | ✅        | v0.9           | Mutual TLS authentication for upstream connections. |
+| Public Key Certificate Pinning                  | ✅        | v0.9           | Ensures that the upstream certificate matches a known key. |
+| Upstream Request Signing using HMAC             | ✅        | v1.2.0         | Attach an encrypted signature to requests to verify the gateway as the sender. |
+
+#### API-level (Global) Features
+Tyk offers global features for APIs, such as detailed traffic logging, CORS management, rate limiting, header transformations, and analytics plugins, with support for tagging, load balancing, and dynamic variables.
+
+| Feature                              | Supported | Supported From | Comments                                                               |
+| :-------------------------------------- | :----------- | :---------------- | :------------------------------------------------------------------------ |
+| Detailed recording (in Log Browser)  | ✅        | v0.4.0         | Records detailed API traffic logs for analysis. |
+| Config Data                          | ✅        | v0.8.2         | Stores additional configuration data for APIs. |
+| Context Variables                    | ✅        | v0.1           | Enables dynamic context-based variables in APIs. |
+| Cross Origin Resource Sharing (CORS) | ✅        | v0.2           | Manages CORS settings for cross-domain requests. |
+| Service Discovery                    | ⚠️         | -              | Service discovery is untested in this version. |
+| Segment Tags                         | ✅        | v0.1           | Tags APIs for segmentation across environments. |
+| Internal API (not exposed by Gateway)| ✅        | v0.6.0         | Internal APIs are not exposed via the Gateway. |
+| Global (API-level) Header Transform  | ✅        | v0.1.0         | Transforms request and response headers at the API level. |
+| Global (API-level) Rate Limit        | ✅        | v0.10          | Sets rate limits globally for APIs. |
+| Custom Plugins                       | ✅        | v0.1           | Supports the use of custom plugins for API processing. |
+| Analytics Plugin                     | ✅        | v0.16.0        | Integrates analytics plugins for API monitoring. |
+| Batch Requests                       | ❌        | -              | Batch requests are not supported. |
+| Custom Analytics Tags (Tag Headers)  | ✅        | v0.10.0        | Custom tags for API analytics data. |
+| Expire Analytics After               | ❌        | -              | Not supported in this version. |
+| Do not track Analytics (per API)     | ✅        | v0.1.0         | Disable analytics tracking on specific APIs. |
+| Webhooks                             | ❌        | -              | Webhook support is not available. |
+| Looping                              | ✅        | v0.6           | Enables internal looping of API requests. |
+| Round Robin Load Balancing           | ✅        | -              | Supports round-robin load balancing across upstream servers. See [Load Balancing](/tyk-stack/tyk-operator/create-an-api#load-balancing). |
+
+#### Endpoint-level Features
+For specific API endpoints, Tyk includes features like caching, circuit breaking, request validation, URL rewriting, and response transformations, allowing for precise control over request processing and response handling at an endpoint level.
+
+| Endpoint Middleware               | Supported | Supported From | Comments                                       |
+| :----------------------------------- | :----------- | :---------------- | :------------------------------------------------ |
+| Allow list                        | ✅️        | v0.8.2         | Allows requests only from approved sources.    |
+| Block list                        | ✅️        | v0.8.2         | Blocks requests from disapproved sources.      |
+| Cache                             | ✅        | v0.1           | Caches responses to reduce latency.            |
+| Advance Cache                     | ✅        | v0.1           | Provides advanced caching capabilities.        |
+| Circuit Breaker                   | ✅        | v0.5           | Prevents service overload by breaking circuits. |
+| Track Endpoint                    | ✅        | v0.1           | Tracks API endpoint usage for analysis.        |
+| Do Not Track Endpoint             | ✅        | v0.1           | Disables tracking for specific endpoints.      |
+| Enforced Timeouts                 | ✅        | v0.1           | Ensures timeouts for long-running requests.    |
+| Ignore Authentication             | ✅        | v0.8.2         | Bypasses authentication for selected endpoints.|
+| Internal Endpoint                 | ✅        | v0.1           | Restricts access to internal services.         |
+| URL Rewrite                       | ✅️        | v0.1           | Modifies request URLs before processing.       |
+| Validate Request                  | ✅        | v0.8.2         | Validates incoming requests before forwarding. |
+| Rate Limit                        | ❌        | -              | Rate limiting is not supported per endpoint.   |
+| Request Size Limit                | ✅️        | v0.1           | Limits the size of requests to prevent overload.|
+| Request Method Transform          | ✅        | v0.5           | Modifies HTTP methods for incoming requests.   |
+| Request Header Transform          | ✅        | v0.1           | Transforms request headers.                    |
+| Request Body Transform            | ✅        | v0.1           | Transforms request bodies for processing.      |
+| Request Body JQ Transform         | ⚠️         | v0.1           | Requires JQ support on the Gateway Docker image.|
+| Response Header Transform         | ✅        | v0.1           | Transforms response headers.                   |
+| Response Body Transform           | ✅        | v0.1           | Transforms response bodies.                    |
+| Response Body JQ Transform        | ⚠️         | v0.1           | Requires JQ support on the Gateway Docker image.|
+| Mock Response                     | ✅        | v0.1           | Simulates API responses for testing.           |
+| Virtual Endpoint                  | ✅        | v0.1           | Allows creation of dynamic virtual endpoints.  |
+| Per-Endpoint Plugin               | ❌        | -              | Plugin support per endpoint is not available.  |
+| Persist Graphql                   | ❌        | -              | Not supported in this version.                 |
+
+
+### TykOasAPIDefinition CRD
+The TykOasApiDefinition Custom Resource Definition (CRD) manages [Tyk OAS API Definition objects](/api-management/gateway-config-tyk-oas) within a Kubernetes environment. This CRD enables the integration and management of Tyk API definitions using Kubernetes-native tools, simplifying the process of deploying and managing OAS APIs on the Tyk Dashboard.
+
+#### TykOasApiDefinition Features
+
+`TykOasApiDefinition` can support all features of the Tyk OAS API definition. You just need to provide the Tyk OAS API definition via a ConfigMap. In addition to managing the CRUD (Create, Read, Update, Delete) of Tyk OAS API resources, the Tyk Operator helps you better manage resources through object linking to Ingress, Security Policies, and certificates stored as Kubernetes secrets. See below for a list of Operator features and examples:
+
+| Features | Support | Supported From | Comments | Example |
+| :---------- | :--------- | :----------------- | :---------- | :-------- |
+| API Category | ✅      | v1.0 | - | [Manage API Categories](#api-categories) |
+| API Version | ✅      | v1.0 | - | [Manage API versioning](#api-versioning) |
+| API Ownership via OperatorContext | ❌      | - | Currently not supported for Tyk OAS APIs (planned for v1.5.0). | - |
+| Client Certificates | ✅      | v1.0 | - | [Manage TLS certificate](#tls-certificates) |
+| Custom Domain Certificates | ✅      | v1.0 | - | [Manage TLS certificate](#tls-certificates) |
+| Public keys pinning | ✅      | v1.0 | - | [Manage TLS certificate](#tls-certificates) |
+| Upstream mTLS | ✅      | v1.0 | - | [Manage TLS certificate](#tls-certificates) |
+| Kubernetes Ingress | ✅      | v1.0 | - | [Kubernetes Ingress Controller](/product-stack/tyk-operator/tyk-ingress-controller) |
+| Link with SecurityPolicy | ✅      | v1.0 | - | [Protect an API](/tyk-stack/tyk-operator/create-an-api#add-a-security-policy-to-your-api) |
+
+### TykStreamsApiDefinition CRD
+The TykStreamsApiDefinition Custom Resource Definition (CRD) manages [Async API configuration](/api-management/event-driven-apis#configuration-options) within a Kubernetes environment.
+
+#### TykStreamsApiDefinition Features
+
+`TykStreamsApiDefinition` can support all features of [Tyk Streams](/api-management/event-driven-apis#). You just need to provide the Tyk Streams API definition via a ConfigMap. In addition to managing the CRUD (Create, Read, Update, Delete) of Tyk Streams API resources, the Tyk Operator helps you better manage resources through object linking to Security Policies. See below for a list of Operator features and examples:
+
+| Features | Support | Supported From | Comments | Example |
+| :---------- | :--------- | :----------------- | :---------- | :-------- |
+| Link with SecurityPolicy | ✅      | v1.0 | - | [Protect an API](/tyk-stack/tyk-operator/create-an-api#add-a-security-policy-to-your-api) |
+
+### Version Compatability
+Ensuring compatibility between different versions is crucial for maintaining stable and efficient operations. This document provides a comprehensive compatibility matrix for Tyk Operator with various versions of Tyk and Kubernetes. By understanding these compatibility details, you can make informed decisions about which versions to deploy in your environment, ensuring that you leverage the latest features and maintain backward compatibility where necessary.
+
+#### Compatibility with Tyk
+Tyk Operator can work with all version of Tyk beyond Tyk 3.x+. Since Tyk is backward compatible, you can safely use the
+latest version of Tyk Operator to work with any version of Tyk.
+However, if you're using a feature that was not yet available on an earlier version of Tyk, e.g. Defining a Subgraph with Tyk 3.x, you'll see error in Tyk Operator controller manager logs.
+
+See [Release notes](/developer-support/release-notes/operator) to check for each Tyk Operator release,
+which version of Tyk it is tested against.
+
+| Tyk Version          | 3.2 | 4.0 | 4.1 | 4.2 | 4.3 | 5.0 | 5.2 | 5.3 | 5.4 | 5.5 | 5.6 | 5.7 |
+| :-------------------- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
+| Tyk Operator v0.13   | Y   |     |     |     | Y   |     |     |     |     |     |     |     |
+| Tyk Operator v0.14   | Y   | Y   |     |     | Y   | Y   |     |     |     |     |     |     |
+| Tyk Operator v0.14.1 | Y   | Y   |     |     | Y   | Y   |     |     |     |     |     |     |
+| Tyk Operator v0.15.0 | Y   | Y   |     |     | Y   | Y   |     |     |     |     |     |     |
+| Tyk Operator v0.15.1 | Y   | Y   |     |     | Y   | Y   |     |     |     |     |     |     |
+| Tyk Operator v0.16.0 | Y   | Y   |     |     | Y   | Y   | Y   |     |     |     |     |     |
+| Tyk Operator v0.17.0 | Y   | Y   |     |     | Y   | Y   | Y   | Y   |     |     |     |     |
+| Tyk Operator v0.17.1 | Y   | Y   |     |     |     | Y   | Y   | Y   |     |     |     |     |
+| Tyk Operator v0.18.0 | Y   | Y   |     |     |     | Y   | Y   | Y   |  Y  |     |     |     |
+| Tyk Operator v1.0.0  | Y   | Y   |     |     |     | Y   |     | Y   |     | Y   | Y   |     |
+| Tyk Operator v1.1.0  | Y   | Y   |     |     |     | Y   |     | Y   |     | Y   | Y   | Y   |
+
+#### Compatibility with Kubernetes Version
+
+See [Release notes](https://github.com/TykTechnologies/tyk-operator/releases) to check for each Tyk Operator release,
+which version of Kubernetes it is tested against.
+
+| Kubernetes Version   | 1.19 | 1.20 | 1.21 | 1.22 | 1.23 | 1.24 | 1.25 | 1.26 | 1.27 | 1.28 | 1.29 | 1.30 |
+| :-------------------- | :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- |
+| Tyk Operator v0.13   | Y    | Y    | Y    | Y    | Y    | Y    | Y    |      |      |      |      |      |
+| Tyk Operator v0.14   | Y    | Y    | Y    | Y    | Y    | Y    | Y    |      |      |      |      |      |
+| Tyk Operator v0.14.1 |      | Y    | Y    | Y    | Y    | Y    | Y    | Y    |      |      |      |      |
+| Tyk Operator v0.15.0 |      | Y    | Y    | Y    | Y    | Y    | Y    | Y    |      |      |      |      |
+| Tyk Operator v0.15.1 |      | Y    | Y    | Y    | Y    | Y    | Y    | Y    |      |      |      |      |
+| Tyk Operator v0.16.0 |      | Y    | Y    | Y    | Y    | Y    | Y    | Y    |      |      |      |      |
+| Tyk Operator v0.17.0 |      |      |      |      |      |      | Y    | Y    | Y    | Y    | Y    |      |
+| Tyk Operator v0.17.1 |      |      |      |      |      |      | Y    | Y    | Y    | Y    | Y    |      |
+| Tyk Operator v0.18.0 |      |      |      |      |      |      | Y    | Y    | Y    | Y    | Y    |      |
+| Tyk Operator v1.0.0  |      |      |      |      |      |      | Y    | Y    | Y    | Y    | Y    | Y    |
+| Tyk Operator v1.1.0  |      |      |      |      |      |      | Y    | Y    | Y    | Y    | Y    | Y    |
+
+
+### Security Policy CRD
+The SecurityPolicy custom resource defines configuration of [Tyk Policies](/api-management/policies).
+
+Here are the supported features:
+
+| Features                       | Support   | Supported From | Example |
+| :-------------------------------- | :----------- | :---------------- | :--------- |
+| API Access                     | ✅        | v0.1           | [API Access](/tyk-stack/tyk-operator/create-an-api#define-the-security-policy-manifest)        |
+| Rate Limit, Throttling, Quotas | ✅        | v0.1           | [Rate Limit, Throttling, Quotas](/tyk-stack/tyk-operator/create-an-api#define-the-security-policy-manifest)        |
+| Meta Data & Tags               | ✅        | v0.1           | [Tags and Meta-data](/tyk-stack/tyk-operator/create-an-api#define-the-security-policy-manifest)        |
+| Path and Method based permissions | ✅     | v0.1           | [Path based permission](/tyk-stack/tyk-operator/create-an-api#security-policy-example)        |
+| Partitions                     | ✅        | v0.1           | [Partitioned policies](/tyk-stack/tyk-operator/create-an-api#security-policy-example)       |
+| Per API limit                  | ✅        | v1.0           | [Per API Limit](/tyk-stack/tyk-operator/create-an-api#security-policy-example)        |
+| Per-Endpoint limit             | ✅        | v1.0           | [Per Endpoint Limit](/tyk-stack/tyk-operator/create-an-api#security-policy-example)        |
+
+## Manage API MetaData
+
+
+### API Name
+
+#### Tyk OAS API and Tyk Streams API
+
+API name can be set through `x-tyk-api-gateway.info.name` field in [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas) object.
+
+#### Tyk Classic API
+
+To set the name of an API in the `ApiDefinition`, use the `spec.name` string field. This name is displayed on the Tyk Dashboard and should concisely describe what the API represents.
+
+Example:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["6-6"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: example-api # This is the metadata name of the Kubernetes resource
+spec:
+  name: Example API # This is the "API NAME" in Tyk
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://example.com
+    listen_path: /example
+    strip_listen_path: true
+```
+
+### API Status
+
+#### API Active Status
+
+An active API will be loaded to the Gateway, while an inactive API will not, resulting in a 404 response when called.
+
+#### Tyk OAS API and Tyk Streams API
+
+API active state can be set through `x-tyk-api-gateway.info.state.active` field in [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas) object.
+
+#### Tyk Classic API
+
+The active status of an API can be set by modifying the `spec.active` configuration parameter. When set to `true`, this enables the API so that Tyk will listen for and process requests made to the `listenPath`. 
+
+```yaml {linenos=true, linenostart=1, hl_lines=["9-9"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: inactive-api
+spec:
+  name: Inactive API
+  use_keyless: true
+  protocol: http
+  active: false
+  proxy:
+    target_url: http://inactive.example.com
+    listen_path: /inactive
+    strip_listen_path: true
+```
+
+### API Accessibility
+
+An API can be configured as internal so that external requests are not processed. 
+
+#### Tyk OAS API and Tyk Streams API
+
+API accessibility can be set through `x-tyk-api-gateway.info.state.internal` field in [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas) object.
+
+#### Tyk Classic API
+
+API accessibility can be set through the `spec.internal` configuration parameter as shown in the example below.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["10-10"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: inactive-api
+spec:
+  name: Inactive API
+  use_keyless: true
+  protocol: http
+  active: true
+  internal: true
+  proxy:
+    target_url: http://inactive.example.com
+    listen_path: /inactive
+    strip_listen_path: true
+```
+
+### API ID
+
+#### Creating a new API
+
+If you're creating a new API using Tyk Operator, you don't need to specify the ID. The API ID will be generated in a deterministic way.
+
+#### Tyk OAS API and Tyk Streams API
+
+The generated ID is stored in `status.id` field. Run the following command to inspect generated API ID of a Tyk OAS API.
+
+```bash
+% kubectl get tykoasapidefinition [API_NAME] --namespace [NAMESPACE] -o jsonpath='{.status.id}'
+ZGVmYXVsdC9wZXRzdG9yZQ
+```
+
+In this example, the generated API ID is `ZGVmYXVsdC9wZXRzdG9yZQ`.
+
+#### Tyk Classic API
+
+The generated ID is stored in `status.api_id` field. Run the following command to inspect generated API ID of a Tyk Classic API.
+
+```bash
+% kubectl get apidefinition [API_NAME] --namespace [NAMESPACE] -o jsonpath='{.status.api_id}'
+ZGVmYXVsdC90ZXN0
+```
+
+In this example, the generated API ID is `ZGVmYXVsdC90ZXN0`.
+
+### Updating an existing API
+
+#### Tyk OAS API and Tyk Streams API
+
+If you already have API configurations created in the Tyk Dashboard and want to start using Tyk Operator to manage these APIs, you can include the existing API ID in the manifest under the `x-tyk-api-gateway.info.id` field in [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas) object.
+
+#### Tyk Classic API
+
+If you already have API configurations created in the Tyk Dashboard and want to start using Tyk Operator to manage these APIs, you can include the existing API ID in the manifest under the `spec.api_id` field. This way, when you apply the manifest, Tyk Operator will not create a new API in the Dashboard. Instead, it will update the original API with the Kubernetes spec.
+
+Example
+
+```yaml  {linenos=true, linenostart=1, hl_lines=["8-8"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: existing-api
+  namespace: default
+spec:
+  name: Existing API
+  api_id: 12345
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://existing.example.com
+    listen_path: /existing
+    strip_listen_path: true
+```
+
+In this example, the API with ID `12345` will be updated according to the provided spec instead of creating a new API.
+
+
+### API Categories
+[API categories](/platform-management/api-categories) are configured differently for Tyk OAS APIs and Tyk Classic APIs. Please see below for examples.
+
+#### Tyk OAS API
+
+API categories can be specified through `categories` field in `TykOasApiDefinition` CRD.
+
+Here's an example:
+
+```yaml  {linenos=true, linenostart=1, hl_lines=["7-9"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: oas-api-with-categories
+  namespace: tyk
+spec:
+  categories:
+  - category 1
+  - category 2
+  tykOAS:
+    configmapRef:
+      keyName: oas-api-definition.json
+      name: tyk-oas-api-config
+      namespace: tyk
+```
+
+#### Tyk Streams API
+
+As of Tyk Operator v1.1, API categories is not supported in `TykStreamsApiDefinition` CRD.
+
+#### Tyk Classic API
+
+For a Tyk Classic API, you can specify the category name using the `name` field with a `#` qualifier. This will categorize the API in the Tyk Dashboard. See [How API categories work](/platform-management/api-categories#tyk-classic-apis) to learn about limitations on API names.
+
+Example
+
+```yaml  {linenos=true, linenostart=1, hl_lines=["6-6"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: categorized-api
+spec:
+  name: "my-classic-api #global #staging"
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://categorized.example.com
+    listen_path: /categorized
+    strip_listen_path: true
+```
+
+### API Versioning
+[API versioning](/api-management/api-versioning) are configured differently for [Tyk OAS APIs](#tyk-oas-api) and [Tyk Classic APIs](#tyk-classic-api). Please see below for examples.
+
+#### Configuring API Version in Tyk OAS API Definition
+
+In the [Tyk OAS API Definition](/api-management/api-versioning), versioning can be configured via `x-tyk-api-gateway.versioning` object of the Base API, where the child API's IDs are specified. In the Kubernetes environment with Tyk Operator, where we reference API resources through its Kubernetes name and namespace, this is not desired. Therefore, we add support for versioning configurations through the field `versioning` in `TykOasApiDefinition` custom resource definition (CRD).
+
+Here's an example:
+
+```yaml{linenos=true, linenostart=1, hl_lines=["12-24"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: order-api
+  namespace: default
+spec:
+  tykOAS:
+    configmapRef:
+      namespace: default
+      name: order-api
+      keyName: order-api-definition-v1.json
+  versioning:
+    enabled: true
+    location: header
+    key: x-api-version
+    name: v1
+    default: v1
+    fallbackToDefault: true
+    stripVersioningData: true
+    versions:
+      - name: v2
+        tykOasApiDefinitionRef:
+          name: order-api-v2
+          namespace: default
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: order-api-v2
+  namespace: default
+spec:
+  tykOAS:
+    configmapRef:
+      namespace: default
+      name: order-api-v2
+      keyName: order-api-definition-v2.json
+```
+
+In this example, two different versions of an API are defined: `order-api` (v1) and `order-api-v2` (v2).
+
+`versioning` is configured at `order-api` (v1), the Base API, and it has similiar structure as [Tyk OAS API Definition](/api-management/api-versioning):
+
+- `versioning`: This object configures API versioning for the `order-api`.
+    - `enabled`: Set to true to enable versioning.
+    - `name`: an identifier for this version of the API (v1).
+    - `default`: Specifies the default version (v1), which will be used if no version is specified in the request.
+    - `location`: Specifies where the version key is expected (in this case, in the header). It can be set to `header` or `url-param`.
+    - `key`: Specifies the versioning identifier key (`x-api-version`) to identify the version. In this example, the version is determined by an HTTP header named `x-api-version`.
+    - `fallbackToDefault`: When set to true, if an unspecified or invalid version is requested, the default version (v1) will be used.
+    - `stripVersioningData`: When true, removes versioning identifier (like headers or query parameters) from the upstream request to avoid exposing internal versioning details.
+    - `urlVersioningPattern`: Specifies a regex that matches the format that you use for the versioning identifier (name) if you are using stripVersioningData and fallBackToDefault with location=url with Tyk 5.5.0 or later
+    - `versions`: Defines the list of API versions available:
+        - `name`: an identifier for this version of the API (v2).
+        - `tykOasApiDefinitionRef`: Refers to a separate TykOasApiDefinition resource that represent a new API version.
+          - `name`: Kubernetes metadata name of the resource (`order-api-v2`).
+          - `namespace`: Kubernetes metadata namespace of the resource (`default`).
+
+With Tyk Operator, you can easily associate different versions of your APIs using their Kubernetes names. This eliminates the need to include versioning information directly within the base API's definition (`x-tyk-api-gateway.versioning` object), which typically requires referencing specific API IDs. Instead, the Operator allows you to manage versioning declaratively in the `TykOasApiDefinition` CRD, using the `versioning` field to specify versions and their Kubernetes references (names and namespaces).
+
+When using the CRD for versioning configuration, you don't have to worry about knowing or managing the unique API IDs within Tyk. The Tyk Operator handles the actual API definition configuration behind the scenes, reducing the complexity of version management.
+
+In case if there is original versioning information in the base API Definition, the versioning information will be kept and be merged with what is specified in CRD. If there are conflicts between the Tyk OAS API Definition and CRD, we will make use of CRD values as the final configuration. 
+
+Tyk Operator would also protect you from accidentally deleting a version of an API that is being referenced by another API, maintaining your API integrity.
+
+#### Configuring API Version in Tyk Streams API Definition
+
+As of Tyk Operator v1.1, API versioning is not supported in `TykStreamsApiDefinition` CRD. This can be configured natively in the Tyk Streams API Definition.
+
+#### Configuring API Version in Tyk Classic API Definition
+
+For Tyk Classic API, versioning can be configured via `ApiDefinition` custom resource definition (CRD). See [Tyk Classic versioning](/api-management/gateway-config-tyk-classic#tyk-classic-api-versioning) for a comprehensive example of configuring API versioning for Tyk Classic API with Tyk Operator.
+
+### API Ownership
+
+Please consult the [API Ownership](/platform-management/api-ownership) documentation for the fundamental concepts of API Ownership in Tyk and [Operator Context](/api-management/automations/operator#multi-tenancy-in-tyk) documentation for an overview of the use of OperatorContext to manage resources for different teams effectively.
+
+The guide includes practical examples for managing API ownership via OperatorContext. Key topics include defining user owners and user group owners in OperatorContext for connecting and authenticating with a Tyk Dashboard, and using `contextRef` in `TykOasApiDefinition` or `ApiDefinition` objects to ensure configurations are applied within specific organizations. The provided YAML examples illustrate how to set up these configurations.
+
+#### How API Ownership works in Tyk Operator
+
+In Tyk Dashboard, API Ownership ensures that only designated 'users' who own an API can modify it. This security model is crucial for maintaining control over API configurations, especially in a multi-tenant environment where multiple teams or departments may have different responsibilities and permissions.
+
+Tyk Operator is designed to interact with Tyk Dashboard as a system user. For the Tyk Dashboard, Tyk Operator is just another user that must adhere to the same access controls and permissions as any other user. This means:
+
+- Tyk Operator needs the correct access rights to modify any APIs.
+- It must be capable of managing APIs according to the ownership rules set in Tyk Dashboard.
+
+To facilitate API ownership and ensure secure operations, Tyk Operator must be able to 'impersonate' different users for API operations. This is where `OperatorContext` comes into play. Users can define different `OperatorContext` objects that act as different agents to connect to Tyk Dashboard. Each `OperatorContext` can specify different access parameters, including the user access key and organization it belongs to. Within `OperatorContext`, users can specify the IDs of owner users or owner user groups. All APIs managed through that `OperatorContext` will be owned by the specified users and user groups, ensuring compliance with Tyk Dashboard's API ownership model.
+
+<img src="/img/operator/tyk-api-ownership.svg" alt="Enabling API ownership with OperatorContext" width="600" />
+
+#### OperatorContext
+
+Here's how `OperatorContext` allows Tyk Operator to manage APIs under different ownerships:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: OperatorContext
+metadata:
+  name: team-alpha
+  namespace: default
+spec:
+  env:
+    # The mode of the admin api
+    # ce - community edition (open source gateway)
+    # pro - dashboard (requires a license)
+    mode: pro
+    # Org ID to use
+    org: *YOUR_ORGANIZATION_ID*
+    # The authorization token this will be set in x-tyk-authorization header on the
+    # client while talking to the admin api
+    auth: *YOUR_API_ACCESS_KEY*
+    # The url to the Tyk Dashboard API
+    url: http://dashboard.tyk.svc.cluster.local:3000
+    # Set this to true if you want to skip tls certificate and host name verification
+    # this should only be used in testing
+    insecureSkipVerify: true
+    # For ingress the operator creates and manages ApiDefinition resources, use this to configure
+    # which ports the ApiDefinition resources managed by the ingress controller binds to.
+    # Use this to override default ingress http and https port
+    ingress:
+      httpPort: 8000
+      httpsPort: 8443
+    # Optional - The list of users who are authorized to update/delete the API.
+    # The user pointed by auth needs to be in this list, if not empty.
+    user_owners:
+    - a1b2c3d4e5f6
+    # Optional - The list of groups of users who are authorized to update/delete the API.
+    # The user pointed by auth needs to be a member of one of the groups in this list, if not empty.
+    user_group_owners:
+    - 1a2b3c4d5e6f
+```
+
+#### Tyk OAS API
+
+<Note>
+API ownership is currently not supported for Tyk OAS APIs (planned for Tyk Operator v1.5.0).
+</Note>
+
+Once an `OperatorContext` is defined, you can reference it in your Tyk OAS API Definition objects using `contextRef`. Below is an example with TykOasApiDefinition:
+```yaml {hl_lines=["40-43"],linenos=true}
+apiVersion: v1
+data:
+  test_oas.json: |-
+    {
+        "info": {
+          "title": "Petstore",
+          "version": "1.0.0"
+        },
+        "openapi": "3.0.3",
+        "components": {},
+        "paths": {},
+        "x-tyk-api-gateway": {
+          "info": {
+            "name": "Petstore",
+            "state": {
+              "active": true
+            }
+          },
+          "upstream": {
+            "url": "https://petstore.swagger.io/v2"
+          },
+          "server": {
+            "listenPath": {
+              "value": "/petstore/",
+              "strip": true
+            }
+          }
+        }
+      }
+kind: ConfigMap
+metadata:
+  name: cm
+  namespace: default
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: petstore
+spec:
+  contextRef:
+    name: team-alpha
+    namespace: default
+  tykOAS:
+    configmapRef:
+      name: cm
+      namespace: default
+      keyName: test_oas.json
+```
+
+In this example, the `TykOasApiDefinition` object references the `team-alpha` context, ensuring that it is managed under the ownership of the specified users and user groups.
+
+#### Tyk Classic API
+
+Similarly, if you are using Tyk Classic API, you can reference it in your API Definition objects using `contextRef`. Below is an example:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+  namespace: alpha
+spec:
+  contextRef:
+    name: team-alpha
+    namespace: default
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+In this example, the `ApiDefinition` object references the `team-alpha` context, ensuring that it is managed under the ownership of the specified users and user groups.
+
+## Troubleshooting and FAQ
+
+<AccordionGroup>
+<Accordion title='Can I use Tyk Operator with non-Kubernetes Tyk installations?'>
+While Tyk Operator is designed to work within a Kubernetes environment, you can still use it to manage non-Kubernetes Tyk installations. You'll need to:
+
+1. Run Tyk Operator in a Kubernetes cluster.
+2. Configure Tyk Operator to point to your external Tyk installation, e.g. via `tyk-operator-conf`, environment variable, or OperatorContext:
+```yaml
+    TYK_MODE: pro
+    TYK_URL: http://external-tyk-dashboard
+    TYK_AUTH: api-access-key
+    TYK_ORG: org-id
+```
+
+This allows you to manage your external Tyk installation using Kubernetes resources.
+</Accordion>
+
+<Accordion title='Tyk Operator changes not applied?'>
+From [Tyk Operator v0.15.0](https://github.com/TykTechnologies/tyk-operator/releases/tag/v0.15.0), we introduce a new status [subresource](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#subresources) in APIDefinition CRD, called _latestTransaction_ which holds information about reconciliation status.
+
+> The [Status subresource](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#status-subresource) in Kubernetes is a specialized endpoint that allows developers and operators to retrieve the real-time status of a specific Kubernetes resource. By querying this subresource, users can efficiently access essential information about a resource's current state, conditions, and other relevant details without fetching the entire resource, simplifying monitoring and aiding in prompt decision-making and issue resolution.
+
+The new status subresource _latestTransaction_ consists of a couple of fields that show the latest result of the reconciliation:
+- `.status.latestTransaction.status`: shows the status of the latest reconciliation, either Successful or Failed;
+- `.status.latestTransaction.time`: shows the time of the latest reconciliation;
+- `.status.latestTransaction.error`: shows the message of an error if observed in the latest transaction.
+
+**Example: Find out why an APIDefinition resource cannot be deleted**
+
+Consider the scenario when APIDefinition and SecurityPolicy are connected. Usually, APIDefinition cannot be deleted directly since it is protected by SecurityPolicy. The proper approach to remove an APIDefinition is to first remove the reference to the SecurityPolicy (either by deleting the SecurityPolicy CR or updating SecurityPolicy CR’s specification), and then remove the APIDefinition itself. However, if we directly delete this APIDefinition, Tyk Operator won’t delete the APIDefinition unless the link between SecurityPolicy and APIDefinition is removed. It is to protect the referential integrity between your resources.
+
+```console
+$ kubectl delete tykapis httpbin 
+apidefinition.tyk.tyk.io "httpbin" deleted 
+^C%
+```
+
+After deleting APIDefinition, the operation hangs, and we suspect that something is wrong. 
+Users might still look through the logs to comprehend the issue, as they did in the past, but they can now examine their APIDefinition’s status subresource to make their initial, speedy issue diagnosis.
+
+```console
+$ kubectl get tykapis httpbin 
+NAME      DOMAIN   LISTENPATH   PROXY.TARGETURL      ENABLED   STATUS
+httpbin            /httpbin     http://httpbin.org   true      Failed
+```
+As seen in the STATUS column, something went wrong, and the STATUS is Failed. 
+
+To get more information about the APIDefinition resource, we can use `kubectl describe` or `kubectl get`:
+```console
+$ kubectl describe tykapis httpbin 
+Name:         httpbin 
+Namespace:    default 
+API Version:  tyk.tyk.io/v1alpha1 
+Kind:         ApiDefinition 
+Metadata:
+  ... 
+Spec:
+   ...
+Status:
+  api_id:                ZGVmYXVsdC9odHRwYmlu
+  Latest CRD Spec Hash:  9169537376206027578
+  Latest Transaction:
+    Error:               unable to delete api due to security policy dependency=default/httpbin
+    Status:              Failed
+    Time:                2023-07-18T07:26:45Z
+  Latest Tyk Spec Hash:  14558493065514264307
+  linked_by_policies:
+    Name:       httpbin
+    Namespace:  default
+```
+or
+```console
+$ kubectl get tykapis httpbin -o json | jq .status.latestTransaction
+{
+  "error": "unable to delete api due to security policy dependency=default/httpbin",
+  "status": "Failed",
+  "time": "2023-07-18T07:26:45Z"
+}
+```
+Instead of digging into Tyk Operator's logs, we can now diagnose this issue simply by looking at the `.status.latestTransaction` field. As `.status.latestTransaction.error` implies, the error is related to *SecurityPolicy* dependency.
+</Accordion>
+
+<Accordion title='Can I use Tyk Operator with multiple Tyk installations?'>
+Yes, you can use Tyk Operator to manage multiple Tyk installations. You'll need to create separate `OperatorContext` resources for each installation:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: OperatorContext
+metadata:
+  name: prod-context
+spec:
+  env:
+    TYK_MODE: pro
+    TYK_URL: http://tyk-dashboard-staging
+    TYK_AUTH: prod-secret
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: OperatorContext
+metadata:
+  name: staging-context
+spec:
+  env:
+    TYK_MODE: pro
+    TYK_URL: http://tyk-dashboard-staging
+    TYK_AUTH: staging-secret
+```
+
+Then, you can specify which context to use in your API and Policy resources:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: my-api
+spec:
+  name: My API
+  context: prod-context
+  # ... other API configuration
+```
+</Accordion>
+</AccordionGroup> 
diff --git a/api-management/automations/sync.mdx b/api-management/automations/sync.mdx
new file mode 100644
index 0000000000..bc20799f2e
--- /dev/null
+++ b/api-management/automations/sync.mdx
@@ -0,0 +1,155 @@
+---
+title: "Tyk Sync - Synchronize Tyk Environment With GitHub"
+description: "Learn how to synchronize your Tyk configuration with GitHub using Tyk Sync"
+keywords: "Tyk API Management, Tyk Sync, Tyk Operator, Github, Kubernetes, Automations"
+sidebarTitle: "Overview"
+---
+
+## Introduction
+
+Tyk Sync enables you to export and import Tyk configurations directly from Git, keeping environments aligned without manual configuration updates. This section covers the setup and use of Tyk Sync, providing steps to ensure consistent configurations across different environments.
+
+
+## Tyk Sync Features
+Tyk Sync works with *Tyk Dashboard* installation. With Tyk Dashboard, Tyk Sync supports managing API definitions, security policies, and API templates.
+
+| Tyk Sync Feature                                                           | Tyk Dashboard (Licensed) |
+| :--------------------------------------------------------------------------- | :-------------------------- |
+| <h4>Backup objects from Tyk to a directory</h4>If you want to backup your API definitions, policies and templates in Tyk, you can use the `dump` command. It allows you to save the objects in transportable files. You can use this command to backup important API configurations before upgrading Tyk, or to save API configurations from one Dashboard instance and then use `update`, `publish`, or `sync` commands to update the API configurations to another Dashboard instance. | ✅ |
+| <h4>Synchronise objects from Git (or any VCS) to Tyk</h4>To implement GitOps for API management, store your API definitions, policies and templates in Git or any version control system. Use the `sync` command to synchronise those objects to Tyk. During this operation, Tyk Sync will delete any objects in the Dashboard that cannot be found in the VCS, and update those that can be found and create those that are missing. | ✅ |
+| <h4>Update objects</h4>The `update` command will read from VCS or file system and will attempt to identify matching API definitions, policies and templates in the target Dashboard, and update them. Unmatched objects will not be created. | ✅ |
+| <h4>Publish objects</h4>The `publish` command will read from VCS or file system and create API definitions, policies, and templates in target Dashboard. This will not update any existing objects. If it detects a collision, the command will stop. | ✅ |
+| <h4>Show and import Tyk examples</h4>The `examples` command allow you to show and import [Tyk examples](https://github.com/TykTechnologies/tyk-examples). An easy way to load up your Tyk installation with some interesting examples!| ✅ |
+
+### Working with OAS APIs
+
+Starting with Sync v1.5+ and Dashboard v5.3.2+, Tyk Sync supports both [Tyk OAS APIs](/api-management/gateway-config-tyk-oas) and [Tyk Classic APIs](/api-management/gateway-config-tyk-classic) when working with the Tyk Dashboard, without requiring special flags or configurations.
+
+For Sync versions v1.4.1 to v1.4.3, enabling Tyk Sync for Tyk OAS APIs requires the [allow-unsafe-oas](/tyk-dashboard/configuration#allow_unsafe_oas) configuration in the Dashboard, along with the `--allow-unsafe-oas` flag when invoking Tyk Sync. Note that Tyk Sync versions v1.4.1 to 1.4.3 do not support API Category for Tyk OAS APIs.
+
+### Working with Tyk Streams APIs
+
+Tyk Streams API support was introduced in Tyk Dashboard v5.7.0. Tyk Sync v2.0 and later is compatible with Tyk Streams APIs and manages them similarly to Tyk OAS APIs. With Tyk Sync, you can seamlessly sync, publish, update, and dump Tyk Streams APIs just like OAS APIs.
+
+Note: The Streams API validator is not applied during these operations.
+
+### Working with Open Source Gateway
+
+From Sync v2.0, compatibility with the Open Source Tyk Gateway has been removed, making Tyk Sync v2.0 compatible exclusively with licensed Tyk Dashboard. As a result, Tyk Sync is no longer usable with the Open Source (OSS) version of the Tyk Gateway.
+
+## Installation
+
+To install Tyk Sync, follow the instructions in the [Tyk Sync installation guide](/product-stack/tyk-sync/installing-tyk-sync). You can install Tyk Sync using Docker or download the binary directly.
+
+## Quick Start Guide
+
+For a quick start guide to using Tyk Sync, refer to the [Tyk Sync Quick Start Guide](/api-management/sync/quick-start). This guide will help you set up Tyk Sync, dump API configurations, and synchronize them with your Tyk Dashboard.
+
+## Glossary
+
+### Tyk Sync
+A command line tool and library designed to manage and synchronize Tyk API Gateway configurations with version control systems. Originally called "tyk-git," it was renamed to "tyk-sync" as its capabilities expanded beyond Git to support synchronization with any file system.
+
+### Synchronization
+The process of ensuring that API and policy configurations in your Tyk Gateway match those stored in your version control system. Tyk Sync performs one-way synchronization, where definitions are written from the VCS to the Tyk Dashboard.
+
+### Spec File (.tyk.json)
+A metadata file created by Tyk Sync that contains information about the APIs and policies in a directory. This file is used during synchronization to determine what needs to be created, updated, or deleted.
+
+## FAQ
+
+<AccordionGroup>
+<Accordion title='Tyk Sync and Gateway Configurations?'>
+Tyk Sync is designed to dump API configurations from a Tyk Dashboard, not directly from a Tyk Gateway.
+
+Tyk Sync's `dump` command is specifically designed to work with the Tyk Dashboard. The command requires a dashboard URL and API secret:
+
+```bash
+tyk-sync dump -d="http://dashboard-url" -s="dashboard-secret" -t="./output-directory"
+```
+
+There is no equivalent flag or functionality to dump configurations directly from a standalone Gateway. This is because:
+
+1. The Dashboard serves as the central configuration repository in the Tyk architecture
+2. The Gateway is primarily focused on runtime execution of those configurations
+3. While Gateways can operate standalone, they don't expose the same management APIs as the Dashboard
+</Accordion>
+
+<Accordion title='Differences between sync, publish, and update commands?'>
+The three commands in Tyk Sync have distinct purposes and behaviors when managing API configurations:
+
+**sync**
+- **Purpose**: Comprehensive synchronization from a source (Git repo or file system) to Tyk Dashboard
+- **Behavior**:
+  - Creates new APIs, policies, and assets that exist in the source but not in the Dashboard
+  - Updates existing APIs, policies, and assets that exist in both places
+  - Deletes APIs, policies, and assets that exist in the Dashboard but not in the source (unless `--no-delete` flag is used)
+- **Use case**: When you want to make the Dashboard exactly match your source repository
+
+**publish**
+- **Purpose**: Only adds new API configurations to Tyk Dashboard
+- **Behavior**:
+  - Creates new APIs, policies, and assets that don't already exist in the Dashboard
+  - Will not update existing items
+  - Stops if it detects a collision (an API that already exists)
+  - Will not delete anything
+- **Use case**: When you want to add new APIs without affecting existing ones
+
+**update**
+- **Purpose**: Only updates existing API configurations in Tyk Dashboard
+- **Behavior**:
+  - Updates APIs, policies, and assets that already exist in the Dashboard
+  - Will not create new items
+  - Will not delete anything
+- **Use case**: When you want to update existing APIs without adding new ones or removing any
+
+In summary, "sync" is the most comprehensive operation (create + update + delete), "publish" only creates new items, and "update" only modifies existing items.
+</Accordion>
+
+<Accordion title='How are Tyk configurations synchronized to Git?'>
+Tyk Sync allows you to dump configurations to a local directory, which can then be committed to a Git repository. This enables version control and easy synchronization across environments.
+
+For example:
+1. Dump configurations: `tyk-sync dump -d http://dashboard:3000 -s secret -t ./configs`
+2. Commit to Git: 
+   ```
+   cd configs
+   git add .
+   git commit -m "Update Tyk configurations"
+   git push
+   ```
+</Accordion>
+
+<Accordion title='Can I sync multiple APIs to a single Git repository?'>
+Yes, you can store multiple API definitions, policies, and other Tyk resources in a single Git repository. Tyk Sync and Tyk Operator can work with multiple resources in the same directory.
+
+Your repository structure might look like this:
+```
+tyk-configs/
+├── apis/
+│   ├── api1.yaml
+│   └── api2.yaml
+├── policies/
+│   ├── policy1.yaml
+│   └── policy2.yaml
+└── tyk-operator/
+    └── operator-context.yaml
+```
+</Accordion>
+
+<Accordion title='How do I roll back changes made with Tyk Sync?'>
+To roll back changes made with Tyk Sync:
+
+1. If you're using Git, check out the previous version of your configurations:
+   ```bash
+   git checkout <previous-commit-hash>
+   ```
+
+2. Use Tyk Sync to publish the previous version:
+   ```bash
+   tyk-sync sync -d http://dashboard:3000 -s <secret> -p ./
+   ```
+
+It's a good practice to maintain separate branches or tags for different environments to make rollbacks easier.
+</Accordion>
+</AccordionGroup> 
diff --git a/api-management/batch-processing.mdx b/api-management/batch-processing.mdx
new file mode 100644
index 0000000000..25e0dc8b00
--- /dev/null
+++ b/api-management/batch-processing.mdx
@@ -0,0 +1,234 @@
+---
+title: "Batch Processing"
+description: "Make multiple API requests in a single HTTP call using Batch Requests"
+keywords: "Request Optimization, Optimization, Batched Requests, Batch, Batch Processing"
+sidebarTitle: "Batch Processing"
+---
+
+## Overview
+
+Batch Requests is a powerful Tyk Gateway feature that allows clients to make multiple requests to an API in a single HTTP call. Instead of sending numerous individual requests to the API, clients can bundle these requests together, reducing network overhead and improving performance.
+
+### What are Batch Requests?
+
+Batch Requests act as an aggregator for multiple API calls. When a client sends a batch request to Tyk, the Gateway processes each request in the batch individually (applying all relevant middleware, authentication, and rate limiting) and returns a combined response containing the results of all requests. The scope of a batch request is limited to a single API deployed on Tyk, though can comprise requests to different endpoints (method and path) defined for that API.
+
+### Key Benefits
+
+- Reduced Network Overhead: Minimize the number of HTTP connections required for multiple related API operations
+- Improved Client Performance: Decrease latency by eliminating multiple round-trips to the server
+- Simplified Error Handling: Process success and failure responses for multiple operations in a single place
+- Maintained Security: Each individual request within a batch still goes through Tyk's full security pipeline
+- Flexible Execution: Choose between parallel or sequential execution of requests
+
+### When to Use Batch Requests
+
+Batch Requests are ideal for scenarios such as:
+
+- Mobile applications that need to fetch data from multiple endpoints during startup
+- Dashboard applications that need to populate multiple widgets with different API data
+- Complex workflows that require data from several API endpoints to complete a single user action
+- Integration scenarios where you need to synchronize operations across multiple services
+
+### How Batch Requests Work
+
+When Tyk receives a batch request, it:
+
+- Validates the batch request format
+- Processes each request in the batch individually (applying all middleware, authentication, and quotas)
+- Collects all responses
+- Returns a single combined response to the client
+
+This process ensures that security is maintained while providing the performance benefits of batching.
+
+## Using Batch Requests
+
+### Configuration
+
+Batch Requests are disabled by default, so you need to enable batch request support in your API definition by setting `server.batchProcessing.enabled` in the Tyk Vendor Extension (Tyk Classic: `enable_batch_request_support`).
+
+### Batch Request Endpoint
+
+When batch requests are enabled, Tyk automatically creates an additional logical endpoint on the subrouter for the API. This won't appear in the API definition and so will not be added to the OpenAPI description. This `/tyk/batch/` endpoint accepts requests in a specific "batch" format and processes them as described in the next section.
+
+For example, if your API's listen path is `/myapi/` the batch request endpoint would be `/myapi/tyk/batch/`.
+
+Note that the trailing slash `/` at the end of the URL is required when calling this endpoint.
+
+### Batch Request Format
+
+Batch requests must be sent as HTTP `POST` requests with a JSON payload that follows this structure:
+
+```json
+{
+  "requests": [
+    {
+      "method": "GET",
+      "headers": {
+        "x-header-1": "value-1",
+        "authorization": "your-auth-token"
+      },
+      "body": "",
+      "relative_url": "resource/123"
+    },
+    {
+      "method": "POST",
+      "headers": {
+        "x-header-2": "value-2",
+        "authorization": "your-auth-token"
+      },
+      "body": "{\"property\": \"value\"}",
+      "relative_url": "resource/create"
+    },
+    {
+      "method": "GET",
+      "headers": {
+        "x-header-3": "value-3",
+        "authorization": "your-auth-token"
+      },
+      "body": "",      
+      "relative_url": "resource/invalid"
+    }    
+  ],
+  "suppress_parallel_execution": false
+}
+```
+
+Where:
+
+- `requests`: An array of individual requests to be processed
+  - `method`: The HTTP method for the individual request (`GET`, `POST`, `PUT`, `DELETE`, etc.)
+  - `headers`: Any HTTP headers to include with the request
+  - `body`: The request body (for `POST`, `PUT` requests) in the format prescribed by the API (e.g. JSON string)
+  - `relative_url`: The endpoint for the request, which can include query parameters
+- `suppress_parallel_execution`: A boolean flag to control whether requests should be processed in parallel (`false`) or sequentially in the order that they appear in the array (`true`)
+
+In the example above, on receipt of a request to `POST /my-api/tyk/batch` with this payload, Tyk would process three requests in parallel:
+
+- `GET /my-api/resource/123` passing `x-header-1` and `Authorization` headers
+- `POST /my-api/resource/create` passing `x-header-2` and `Authorization` headers and the payload descrbied in `body`
+- `GET /my-api/resource/invalid` passing `x-header-3` and `Authorization` headers
+
+### Execution Order
+
+Tyk will work through the requests in the batch in the order that they are declared in the `requests` array. The `suppress_parallel_execution` setting is used to determine whether Tyk should wait for each request to complete before starting the next (`true`), or if it should issue all of the requests in parallel (`false`).
+
+If sequential execution is in use, Tyk will work through the entire `requests` array regardless of whether any requests return errors. All responses (success and failure) will be logged and returned to the client as described [below](/api-management/batch-processing#batch-response-format).
+ 
+### Batch Response Format
+
+When you send a batch request to Tyk, each individual request within the batch is processed independently. This means that some requests in a batch may succeed while others fail. Tyk provides detailed response information for each request in the batch to help you identify and handle errors appropriately.
+
+The response from a batch request is an array of response objects, each corresponding to one of the requests in the batch in the order that they appeared in the `requests` array:
+
+```json
+[
+    {
+        "relative_url": "resource/123",
+        "code": 200,
+        "headers": {
+            "Content-Type": ["application/json"],
+            "Date": ["Wed, 15 Mar 2023 12:34:56 GMT"]
+        },
+        "body": "{\"id\":\"123\",\"name\":\"Example Resource\"}"
+    },
+    {
+        "relative_url": "resource/create",
+        "code": 201,
+        "headers": {
+            "Content-Type": ["application/json"],
+            "Date": ["Wed, 15 Mar 2023 12:34:56 GMT"]
+        },
+        "body": "{\"id\":\"456\",\"name\":\"New Resource\",\"status\":\"created\"}"
+    },
+    {
+        "relative_url": "resource/invalid",
+        "code": 404,
+        "headers": {
+            "Content-Type": ["application/json"],
+            "Date": ["Wed, 15 Mar 2023 12:34:56 GMT"]            
+            },
+        "body": "{\"error\":\"Resource not found\"}"
+    }   
+]
+```
+
+Each response object contains:
+
+- `relative_url`: The URL of the endpoint targeted by the request
+- `code`: The HTTP status code returned from the individual request
+- `headers`: The response headers
+- `body`: The response body as a string
+
+### Response Status Codes
+
+The batch endpoint itself returns an `HTTP 200 OK` status code as long as the batch request was properly formatted and processed, regardless of whether individual requests within the batch succeeded or failed.
+
+To determine the success or failure of individual requests, you need to examine the status code for each request in the response array.
+
+In the previous example, we can see that the first two requests were successful, returning `HTTP 200 OK` and `HTTP 201 Created`, whereas the third failed returning `HTTP 404 Not found`.
+
+## Invoking Batch Requests from Custom JavaScript Middleware
+
+You can make requests to the logical batch request endpoint from within [custom JavaScript middleware](/api-management/plugins/javascript) via the `TykBatchRequest` function that is included in Tyk's  [JavaScript API](/api-management/plugins/javascript#javascript-api).
+
+This integration enables you to:
+
+- Create batch requests programmatically 
+- Process batch responses with custom logic
+- Implement advanced error handling specific to your use case
+
+## Security Considerations
+
+Requests to the `/tyk/batch/` endpoint do not require any authentication, however the requests within the batch (declared in the payload) do not bypass any security mechanisms.
+
+As this endpoint is keyless, no rate limiting is applied to the requests to `/tyk/batch/`.
+
+Each request in a batch is processed through Tyk's full security pipeline, including authentication and rate limiting, so API keys or other authentication credentials must be included in each individual request within the batch.
+
+Rate limiting and quotas are applied to each request in the batch individually - so a batch containing three requests using the same API key will add three to their rate limit and quota counts. This could lead to one or more of the batched requests being rejected.
+
+This means that, whilst anyone can make a request to the batch endpoint, they can only successfully execute requests within the batch by providing valid authentication credentials in those requests.
+
+This means that the batch endpoint could potentially be used for reconnaissance, as attackers might determine which APIs exist based on responses. If this is a concern then you could consider:
+
+- using IP allowlists to restrict access to your API
+- using [Internal Routing](/advanced-configuration/transform-traffic/looping) to put the batch request API behind a protected API
+- disabling batch requests entirely if you don't need this feature
+
+## Performance Considerations
+
+- Setting `suppress_parallel_execution` to `false` provides better performance but doesn't guarantee response order.
+- For large batches, consider the impact on your upstream services
+- Tyk applies rate limiting to each request in the batch, which may cause some requests to be rejected if limits are exceeded
+
+## Best Practices when using Tyk's Batch Request feature
+
+We recommend that you consider the following best practice guidelines when using batch requests:
+
+- Validate Before Sending: Perform client-side validation before including requests in a batch to minimize predictable errors.
+- Implement Timeouts: Set appropriate timeouts for batch requests to prevent long-running operations from blocking your application.
+- Log Detailed Errors: Log detailed error information for failed requests to facilitate debugging.
+- Group Similar Requests: Group requests with similar authentication requirements and rate limits to minimize errors.
+- Implement Circuit Breakers: Use circuit breaker patterns to prevent repeated failures when upstream services are experiencing issues.
+
+## Troubleshooting
+
+There are some common issues that can be encountered when using Tyk's batch requests feature.
+
+### Missed trailing slash
+
+When an API client makes a request to the logical `tyk/batch/` endpoint, it is essential that the trailing slash is included in the request, otherwise Tyk will return an `HTTP 404` error.
+
+### Custom domains
+
+Several specific issues can arise when using batch requests with custom domains:
+
+**DNS Resolution**: The Tyk Gateway needs to be able to resolve the custom domain internally. If the Gateway can't resolve the custom domain name, batch requests will fail with connection errors, even though external requests to the same API work fine.
+**Solution**: Ensure that the Tyk Gateway host can resolve the custom domain, either through proper DNS configuration or by adding entries to the host's `/etc/hosts` file.
+
+**Internal vs. External Routing**: When a batch request is made to a custom domain, Tyk needs to route the individual requests within the batch correctly. If the custom domain is only configured for external access but not for internal routing, the batch requests may fail.
+**Solution**: Configure your custom domain to work with both external and internal routing.
+
+**Certificate Validation**: If your custom domain uses HTTPS, certificate validation issues can occur during the internal processing of batch requests.
+**Solution**: Ensure that the certificates for your custom domain are properly configured and trusted by the Tyk Gateway.
\ No newline at end of file
diff --git a/api-management/certificates.mdx b/api-management/certificates.mdx
new file mode 100644
index 0000000000..3b0582ba25
--- /dev/null
+++ b/api-management/certificates.mdx
@@ -0,0 +1,286 @@
+---
+title: "TLS and Certificate Management"
+description: "Transport Layer Security and Tyk Certificate Store"
+keywords: "Transport Layer Security, TLS, SSL, mTLS, mutual TLS, Security, Certificate, Pinning, Certificate Authority, Tyk Certificate Store"
+order: 2
+sidebarTitle: "TLS and Certificate Management"
+---
+
+## Introduction
+
+Modern web applications require secure communication to protect sensitive data from eavesdropping and tampering. Transport Layer Security (TLS) is the foundation of secure internet communication, and Tyk provides comprehensive TLS support for both client-facing APIs and backend service communication.
+
+## Understanding Secure Communication
+
+<img src="/img/diagrams/certificates-insecure-secure.png" alt="Insecure and Secure Communication" />
+
+### The Problem: Insecure Communication
+
+Without encryption, network communication faces several risks:
+
+- **Eavesdropping**: Anyone can read your data as it travels across networks.
+- **Tampering**: Attackers can modify data in transit without detection.
+- **Impersonation**: Malicious actors can pretend to be legitimate servers or clients.
+
+### The Solution: Transport Layer Security (TLS)
+
+**TLS (Transport Layer Security)** is a cryptographic protocol that solves these problems by providing:
+
+- **Confidentiality**: Encrypts data so only intended recipients can read it.
+- **Integrity**: Ensures data hasn't been modified during transmission.
+- **Authentication**: Verifies the identity of communicating parties.
+
+TLS is the "S" in HTTPS and secures billions of web transactions daily.
+
+#### TLS or SSL
+
+SSL (Secure Sockets Layer) is the older version of TLS, which is now the standard for secure web communication. TLS uses stronger encryption and better key management. All SSL and earlier TLS versions (1.0, 1.1) are deprecated. Today, "SSL" usually refers to TLS, especially versions 1.2 and 1.3, which are secure.
+
+## Fundamentals of Public Key Cryptography
+
+Transport Layer Security uses public key cryptography. This is an asymmetric method in which each communicating party possesses a unique key pair: a private key for decryption and a public key for encryption, enabling secure communication.
+
+### Encryption Keys
+
+A key is a specific value used within a cryptographic algorithm to encrypt data into an unreadable format and decrypt it back to its original state with the correct key using a defined algorithm.
+
+With public key cryptography, there are two different keys:
+- the *private key* is held by the originator of the message and is kept private
+- the *public key* is shared with the recipient of the message
+
+A key exchange algorithm, such as RSA, uses the public-private key pair to agree upon session keys, which are used for symmetric encryption once the handshake is complete.
+
+{/* [DIAGRAM: Public Key Encryption] Visual representation of asymmetric encryption with Party A using Party B's public key to encrypt, Party B using their private key to decrypt. Visual flow arrows showing the data encryption/decryption process */}
+
+### Digital Certificates
+
+<img src="/img/diagrams/certificates-x509-certificate.png" alt="X.509 Digital Certificate" />
+
+The public key is usually shared in the form of an [X.509](https://datatracker.ietf.org/doc/html/rfc5280) *digital certificate*. This is like a digital passport or driver's license. It's an electronic document that proves identity and contains the elements shown above. The certificate is itself *signed* using the private key owned by an entity that is trusted by both parties, known as a *Certificate Authority*.
+
+<Note>
+    Various signature algorithms are available for signing certificates. The chosen algorithm can affect performance, as some are easier for Tyk to verify than others. Generally, elliptic curve algorithms offer better performance on average, but actual results may vary depending on CPU architecture. It is recommended to test and determine the most suitable balance between security and performance for specific needs.
+</Note>
+
+### Certificate Authorities (CAs)
+
+<img src="/img/diagrams/certificates-ca-trust-store.png" alt="Certificate Authorities and Trust Store" />
+
+Certificate Authorities are organizations trusted to issue digital certificates. Their role is analogous to that of government agencies that issue official identification documents.
+
+Popular Certificate Authorities include:
+- Let's Encrypt: Free, automated certificates
+- DigiCert: Enterprise-grade certificates
+- GlobalSign: International CA with global presence
+- Internal CAs: Organizations can run their own CAs for internal use (self-signed certificates)
+
+### Certificate Chains and Trust
+
+<img src="/img/diagrams/certificates-trust-chain.png" alt="Certificate Trust Chain" />
+
+The recipient checks the certificate by following a chain of trust up to a recognized root CA, verifying each signature along the way.
+
+
+## Fundamentals of Transport Layer Security
+
+### Standard TLS: Server Authentication
+
+<img src="/img/diagrams/certificates-tls-handshake.png" alt="TLS Handshake" />
+
+In typical HTTPS connections, only the **server** proves its identity through this one-way authentication process.
+
+### Mutual TLS (mTLS): Two-Way Authentication
+
+<img src="/img/diagrams/certificates-mtls-handshake.png" alt="Mutual TLS Handshake" />
+
+Mutual TLS (mTLS) extends TLS with two-way authentication, meaning both sides verify their identities by exchanging certificates.
+
+This provides stronger security because:
+
+- The server knows that the client is who they claim to be.
+- The client knows that the server is legitimate.
+- Both parties are cryptographically verified.
+
+
+## Certificate Management
+
+Wherever Tyk accepts a certificate, the value is a **certificate reference** which can take one of three forms:
+
+- The recommended approach for most deployments is the [Tyk Certificate Store](#tyk-certificate-store), which centralizes certificate management and is available in both licensed and OSS installations.
+- [Inline PEM content](#inline-pem-content) (from **Tyk Gateway 5.14.0**) is the preferred approach for Kubernetes deployments where certificates are managed externally.
+- A legacy [local file path](#local-file-path) approach is also supported for backwards compatibility.
+
+Any of these forms can be used in the certificate fields in the API definition; the inline PEM content form is not supported in the `cert_file, key_file, ca_file` fields in the [External Services mTSL Config](/configure/external-service#mutual-tls-mtls-configuration) in the Gateway config file (`tyk.conf`).
+
+### Tyk Certificate Store
+
+The Tyk Certificate Store centralizes certificates within Tyk’s data layer for use by multiple APIs.
+
+#### Licensed Deployments
+
+In licensed Tyk installations, the Tyk Dashboard manages certificates. Certificates are stored in the Control Plane Redis and synced to the Data Plane Redis for Tyk Gateway to consume.
+
+#### Tyk OSS Deployments
+
+In a Tyk OSS installation, there is no Tyk Dashboard or Control Plane. Tyk Gateway manages the certificates directly, storing them in Redis. Tyk Gateway also exposes a Certificate Management API so that OSS users can manage certificates without a Tyk Dashboard.
+
+#### Certificate ID and Redis Key
+
+When a certificate is added, it gets a unique **certificate ID**, used to refer to it, such as when linking to an API. This ID combines the `orgID` and the certificate’s SHA-256 hash. In Redis, it is stored under `cert-raw-` plus the certificate ID.
+
+This means that certificate IDs are predictable and can be calculated if you know the Organisation ID and have the certificate file. You can generate the SHA256 fingerprint using the following command:
+
+```
+openssl x509 -noout -fingerprint -sha256 -inform pem -in <cert>
+```
+
+<img src="/img/diagrams/certificates-add-to-store.png" alt="Tyk Certificate ID" />
+
+<Note>
+  Notice that you can’t retrieve the raw certificate from just the certificate ID and that this is a unique identifier.
+</Note>
+
+#### Certificate Data
+
+The data stored against a certificateID is the [PEM-encoded](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) certificate chain data, comprising:
+
+1. The Certificate(s):
+    - The primary X.509 certificate
+    - Any intermediate certificates in the chain
+2. Encrypted Private Key (if provided):
+    - If a private key was included with the certificate, it’s encrypted using AES-256
+    - The encryption uses the `private_certificate_encoding_secret` from your Tyk configuration
+    - The encrypted key is appended to the certificate chain with the header `ENCRYPTED PRIVATE KEY`
+
+A typical certificate with a private key would be stored as:
+```
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUJhdB...
+... (certificate data) ...
+-----END CERTIFICATE-----
+
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFHDBOBgkqhkiG9w0BBQ0w...
+... (encrypted private key data) ...
+-----END ENCRYPTED PRIVATE KEY-----
+```
+
+##### Encryption of the Private Key
+
+If the private key was provided in the imported PEM file, it will be encrypted using the AES-256 algorithm with an encryption key that you must set in the Gateway, Dashboard, and MDCB configurations (if used).
+
+- **Gateway**: [`TYK_GW_SECURITY_PRIVATECERTIFICATEENCODINGSECRET`](/tyk-oss-gateway/configuration#security-private_certificate_encoding_secret)
+- **Dashboard**: [`TYK_DB_SECURITY_PRIVATECERTIFICATEENCODINGSECRET`](/tyk-dashboard/configuration#security-private_certificate_encoding_secret)
+- **MDCB**: [`TYK_MDCB_SECURITY_PRIVATECERTIFICATEENCODINGSECRET`](/tyk-multi-data-centre/mdcb-configuration-options#security-private_certificate_encoding_secret)
+
+It is essential that these secrets match so that the Gateway can decrypt the key when required during a TLS handshake.
+
+<Note>
+    It is important to keep the shared secret secure.
+</Note>
+
+**Standalone Public Key**
+
+Stand-alone public keys (not contained within a certificate) are sometimes used for upstream certificate pinning or JWT verification.
+
+If only the public key were provided, rather than the certificate containing that key, then just the PEM-encoded public key would be stored against the certificateID, for example:
+
+```
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
+-----END PUBLIC KEY-----
+```
+
+#### Monitoring Certificate Expiry
+
+X.509 certificates have a validity period with both start and end timestamps outside which they will not be accepted in the TLS handshake.
+
+Tyk Gateway checks the validity of each certificate when it is used in an API request and will generate both an error log and a [Gateway event](/api-management/gateway-events#certificate-expiry-events) if an attempt is made to use an expired certificate (after its `notAfter` timestamp).
+
+An optional warning can be configured to generate a log and Gateway event if a certificate is used within a configurable window before the `notAfter` timestamp.
+
+- `CertificateExpired`: an expired certificate has been used in a request
+- `CertificateExpiringSoon`: a certificate has been used within the expiry threshold window
+
+The behavior of this Certificate Expiry Monitor is configured at the Gateway level using the following fields in the [`security.certificate_expiry_monitor`](/tyk-oss-gateway/configuration#security-certificate_expiry_monitor) section of the Gateway configuration (or equivalent environment variables):
+
+| Field | Effect |
+|-------|--------|
+| `warning_threshold_days` | The number of days before certificate expiry that the Gateway will start generating CertificateExpiringSoon events when the certificate is used |
+| `check_cooldown_seconds` | A cool-off period after checking a certificate's expiry before another check is made, to avoid unnecessary log generation when an API is called repeatedly |
+| `event_cooldown_seconds` | A cool-off period after generating `CertificateExpired` or `CertificateExpiringSoon` for a certificate, to avoid unnecessary event generation when an API is called repeatedly |
+
+Note that the certificate expiry monitor is reactive and only checks for certificate expiry when the certificate is used; it will not flag impending expiry or expired certificates if they are not actively used.
+
+[Event handlers](/api-management/gateway-events#handling-events-with-tyk) can be configured at the API level to respond to Gateway event generation.
+
+#### Tyk Certificate Store API
+
+The Tyk Dashboard API exposes endpoints to manage the Tyk Certificate Store, allowing you to:
+
+- [Register](https://tyk.io/docs/api-reference/certificates/create-a-certificate-in-tyk-org-cert-store) a new certificate with the store
+    - Provide either a PEM-encoded certificate (optionally concatenated with PEM-encoded private key) or a PEM-encoded public key.
+    - This returns the assigned certificate ID.
+- [Retrieve](https://tyk.io/docs/api-reference/certificates/get-single-certificate-with-id) details of a specific entry in the store
+    - Provide a certificate ID.
+    - This returns metadata including the certificate issuer, whether there is a private key, and the certificate fingerprint (SHA256 hash of the certificate).
+- [Retrieve](https://tyk.io/docs/api-reference/certificates/list-certificates) a list of all certificates in the store
+- [Delete](https://tyk.io/docs/api-reference/certificates/delete-certificate) a certificate from the store
+- [Retrieve](https://tyk.io/docs/api-reference/certificates/list-apis-lined-to-a-certificate) a list of APIs that are using a certificate
+
+There is a similar API exposed by [Tyk Gateway](https://tyk.io/docs/api-reference/certs/list-certificates), for use in Tyk OSS installations to manage the certificates stored in Redis. This does not include the advanced functionality for identifying the APIs that use each certificate.
+
+#### Managing Certificates Using the Dashboard UI
+
+The Tyk Dashboard provides a visual interface to the Tyk Certificate Store via the **API Security > TLS/SSL Certificates** screen.
+
+<img src="/img/dashboard/certificate-manager/certificates-tyk-certificate-store.png" alt="Dashboard listing content of Tyk Certificate Store" />
+
+This screen displays a list of certificates registered in the store; any for which the [certificate expiry monitor](/api-management/certificates#monitoring-certificate-expiry) has generated an event will be highlighted with a warning or error symbol; a banner will be displayed to highlight these symbols.
+
+Click on the certificate ID or select **View** from the **Actions** menu to view details of the certificate, including a list of APIs currently using the certificate.
+
+<img src="/img/dashboard/certificate-manager/certificates-cert-details.png" alt="Dashboard showing details of a certificate in the store" />
+
+You can click on the name of an API in this list to go directly to that API in the API Designer. Note that this will list all APIs, even those for which the logged in user does not have [access](/platform-management/api-ownership). This is to mitigate against the scenario where a certificate is deleted because the user believes it is unused. Users are unable to click through to APIs to which they do not have access.
+
+You can upload a new certificate to the Tyk Certificate Store using the **+ Add Certificate** button.
+
+<img src="/img/dashboard/certificate-manager/certificates-upload-cert.png" alt="Dashboard showing the certificate upload screen" />
+
+Select either a valid PEM-encoded file containing a certificate, or a file containing PEM-encoded certificate concatenated with the PEM-encoded private key, and select **Upload**. If successful, the certificate will be loaded into the Certificate Store and assigned a certificate ID that you can use to associate it with a TLS interaction via API definition or Gateway configuration.
+
+### Inline PEM Content
+
+From **Tyk Gateway 5.14.0**, certificate fields in API definitions accept inline PEM-encoded content directly, in addition to a certificate ID or file path. The PEM content follows the same format as the Tyk Certificate Store: a certificate chain optionally followed by a PEM-encoded private key.
+
+The primary use case is supplying certificates from a secret management system without storing them in the Control Plane. Any supported [KV reference](/tyk-configuration-reference/kv-store) can supply the PEM content at load time, for example, a `file://` reference can read a certificate mounted from a Kubernetes secret volume without the Control Plane ever storing the private key. See [Using Local Files as a KV Store](/tyk-configuration-reference/kv-store#local-files) for configuration details.
+
+For example:
+
+```yaml
+server:
+  clientCertificates:
+    enabled: true
+    allowlist:
+      # Inline PEM content — suitable for testing; avoid embedding private keys directly
+      - |
+          -----BEGIN CERTIFICATE-----
+          MIIDazCCAlOgAwIBAgIUJhdB...
+          -----END CERTIFICATE-----
+      # file:// KV reference — recommended for Kubernetes deployments
+      - "file:///etc/tyk/certs/client-ca.pem"
+```
+
+<Note>
+Embedding a private key directly in an API definition is a security risk. The intended pattern is to supply PEM content via a KV reference, such as a `file://` reference pointing to a Kubernetes secret volume, so the private key never appears in the API definition itself.
+</Note>
+
+### Local File Path
+
+A legacy approach allows certificate fields to contain the path to a `.pem` file on the local filesystem. Tyk Gateway reads the certificate from that path when the API is loaded. The Gateway process must have read access to the file.
+
+This is distinct from a `file://` KV reference (see [Inline PEM Content](#inline-pem-content)): a local file path is used directly as the certificate's location on disk, whereas a `file://` reference is resolved to the file's contents and treated as inline PEM content.
+
+This approach is still supported but is not recommended for new deployments. It couples the Gateway to the local filesystem and does not benefit from the centralized management or access controls provided by the Tyk Certificate Store.
+
diff --git a/api-management/client-authentication.mdx b/api-management/client-authentication.mdx
new file mode 100644
index 0000000000..f33410f06c
--- /dev/null
+++ b/api-management/client-authentication.mdx
@@ -0,0 +1,374 @@
+---
+title: "Client Authentication and Authorization"
+description: "Learn how to apply the most appropriate authentication method to secure access your APIs with Tyk. Here you will find everything there is to know about authenticating and authorizing API clients with Tyk."
+keywords: "Authentication, Authorization, Tyk Authentication, Tyk Authorization, Secure APIs, client"
+sidebarTitle: "Overview"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+
+## Introduction
+
+Tyk Gateway sits between your clients and your services, securely routing requests and responses. For each API proxy that you expose on Tyk, you can configure a range of different methods that clients must use to identify (authenticate) themselves to Tyk Gateway when making a request to access the API.
+
+*Authentication* and *Authorization* are the processes that you use to control access to your APIs and protect your upstream services. Each serves a distinct purpose:
+
+* **Authentication** (or **AuthN**) is the process of confirming the identity of the user or system making the API request. This step validates "who" is attempting to access the API, commonly using credentials such as tokens, passwords, or certificates.
+
+* **Authorization** (or **AuthZ**) is the process that determines if the user or system has the right permissions to perform the requested action. This step defines "what" they are allowed to do based on assigned roles, scopes, or policies.
+
+Whilst AuthN and AuthZ are separate actions with different standards, they are often considered together under the topic of *Securing the API*. Together, these processes allow API providers to control access, safeguard data integrity, and meet security and compliance standards, making them vital for any API management strategy.
+
+---
+
+## How does Tyk Implement Authentication and Authorization?
+
+The API request processing flow within Tyk Gateway consists of a [chain of middleware](/api-management/traffic-transformation#request-middleware-chain) that perform different checks and transformations on the request (headers, parameters and payload). Several dedicated **authentication middleware** are provided and there is also support for user-provided **custom authentication plugins**. Multiple authentication middleware can be chained together if required by the API's access security needs. *Note that it is not possible to set the order of chained auth methods.*
+
+The OpenAPI description can contain a list of [securitySchemes](https://spec.openapis.org/oas/v3.0.3.html#security-scheme-object) which define the authentication methods to be used for the API; the detailed configuration of the Tyk authentication middleware is set in the [server.authentication](/api-management/gateway-config-tyk-oas#authentication) section of the Tyk Vendor Extension.
+
+You must enable client authentication using the `server.authentication.enabled` flag and then configure the appropriate authentication method as indicated in the relevant section of this document. When creating a Tyk OAS API from an OpenAPI description, Tyk can automatically enable authentication based upon the content of the OpenAPI description as described [here](/api-management/gateway-config-managing-oas#importing-an-openapi-description-to-create-an-api).
+
+When using Tyk Classic APIs, each authentication middleware has its own fields within the API definition
+
+### Managing authorization data
+
+The data that the client provides with the API request used to authenticate with Tyk and confirm that it is authorized to access the API is often of no use to the upstream service and, depending on your security governance, may even be prohibited from being made available to the upstream.
+
+Tyk offers a simple option, separately configurable for each API to remove, or "strip", the authentication/authorization date from the incoming request before proxying to the upstream.
+
+This is controlled using the [server.authentication.stripAuthorizationData](/api-management/gateway-config-tyk-oas#authentication) field in the Tyk Vendor Extension (Tyk Classic: `strip_auth_data`).
+
+## What does Tyk Support?
+
+Tyk includes support for various industry-standard methods to secure your APIs. This page provides an overview of the options available, helping you to choose and implement what works best for you.
+
+Use Ctrl+F or the sidebar to find specific topics, for example “JWT” for JSON Web Tokens or “mTLS” for mutual TLS.
+
+You can also use the links below to jump directly to the appropriate sections to learn how to secure your APIs using Tyk.
+
+<ResponsiveGrid>
+
+<Card title="Tyk OAuth 2.0" href="/api-management/authentication/oauth-2">
+Use Tyk Gateway as a built-in OAuth 2.0 authorization server to issue and manage access tokens.
+</Card>
+
+<Card title="OAuth 2.0 (External IdP)" href="/api-management/authentication/oauth2-authentication">
+Validate tokens issued by an external OAuth 2.0 / OIDC provider, with scope enforcement and Protected Resource Metadata.
+</Card>
+
+<Card title="JWT" href="/basic-config-and-security/security/authentication-authorization/json-web-tokens">
+Securely transmit information between parties.
+</Card>
+
+<Card title="Basic Auth" href="/api-management/authentication/basic-authentication">
+Secure APIs with username and password credentials.
+</Card>
+
+<Card title="Auth Tokens" href="/api-management/authentication/bearer-token">
+Implement token-based authentication for API access.
+</Card>
+
+<Card title="mTLS" href="/api-management/implement-tls#secure-hosted-apis-with-mtls">
+Establish secure channels with two-way certificate verification.
+</Card>
+
+<Card title="HMAC" href="/basic-config-and-security/security/authentication-authorization/hmac-signatures">
+Verify message integrity using shared secret keys.
+</Card>
+
+{/* To be added
+<Card title="RSA" href="/api-management/client-authentication/#sign-requests-with-rsa">
+Verify message integrity using shared secret certificates.
+</Card> */}
+
+<Card title="Custom Authentication" href="/api-management/authentication/custom-auth">
+Create custom plugins to implement specific authentication requirements.
+</Card>
+
+<Card title="Open Access" href="/basic-config-and-security/security/authentication-authorization/open-keyless">
+Allow unrestricted access for public APIs.
+</Card>
+
+
+</ResponsiveGrid>
+
+---
+
+## Other Authentication Methods
+
+### Integrate with External Authorization Server (deprecated)
+
+
+<Note>
+Tyk has previously offered two types of OAuth authentication flow; [Tyk as the authorization server]() and Tyk connecting to an external *auth server* via a dedicated *External OAuth* option. The dedicated external *auth server* option was deprecated in Tyk 5.7.0.
+<br />
+
+From Tyk 5.14.0, the recommended replacement for third-party OAuth integration is the [OAuth 2.0 (External IdP)](/api-management/authentication/oauth2-authentication) scheme, which provides token validation, scope enforcement, Protected Resource Metadata, and token exchange in a single declaration. If you are on an earlier version, use the [JSON Web Token (JWT)](/basic-config-and-security/security/authentication-authorization/json-web-tokens) middleware as an interim replacement.
+<br />
+
+The remainder of this section is left for reference and is not maintained.
+</Note>
+
+
+To call an API that is protected by OAuth, you need to have an access token from the third party IDP (it could be an opaque token or a JWT). 
+
+For subsequent calls the access token is provided alongside the API call and needs to be validated. With JWT, Tyk can confirm the validity of the JWT with the secret provided in your config. The secret signs the JWT when created and confirms that none of its contents has changed. 
+
+For this reason, information like the expiry date which are often set within the JWT cannot be changed after the JWT has been initially created and signed. This means you are not able to revoke a token before the expiry set in the JWT with the standard JWT flow. With OAuth you can use [OAuth introspection](https://www.rfc-editor.org/rfc/rfc7662) to overcome this. With introspection, you can validate the access token via an introspection endpoint that validates the token. 
+
+Let’s see how external OAuth middleware is configured.
+
+#### OAS contract
+
+```yaml
+externalOAuthServer:
+  enabled: true,
+  providers: # only one item in the array for now (we're going to support just one IDP config in the first iteration)
+  - jwt: #validate JWTs generated by 3rd party Oauth servers (like Okta)
+      enabled: true
+      signingMethod: HMAC/RSA/ECDSA # to verify signing method used in jwt
+      source: key # secret to verify signature
+      issuedAtValidationSkew: 0
+      notBeforeValidationSkew: 0
+      expiresAtValidationSkew: 0
+      identityBaseField: # identity claimName
+    introspection: # array for introspection details
+      enabled: true/false
+      clientID: # for introspection request
+      clientSecret: # for introspection request, if empty will use oAuth.secret
+      url: # token introspection endpoint
+      cache: # Tyk will cache the introspection response when `cache.enabled` is set to `true`
+        enabled: true/false,
+        timeout: 0 # The duration (in seconds) for which Tyk will retain the introspection outcome in its cache. If the value is "0", it indicates that the introspection outcome will be stored in the cache until the token's expiration.
+      identityBaseField: # identity claimName
+```
+
+#### Tyk Classic API definition contract
+
+```yaml
+"external_oauth": {
+  "enabled": true,
+  "providers": [
+    {
+      "jwt": {
+        "enabled": false,
+        "signing_method": rsa/ecdsa/hmac,
+        "source": # jwk url/ base64 encoded static secret / base64 encoded jwk url
+        "identity_base_field": # identity claim name
+        "expires_at_validation_skew": # validation skew config for exp
+        "not_before_validation_skew": # validation skew config for nbf
+        "issued_at_validation_skew" : # validation skew config for iat
+      },
+      "introspection": {
+        "enabled": true,
+        "url": # introspection endpoint url
+        "client_id": # client Id used for introspection
+        "client_secret": # client secret to be filled here (plain text for now, TODO: decide on a more secure mechanism)
+        "identity_base_field": # identity claim name
+        "cache": {
+          "enabled": true,
+          "timeout": # timeout in seconds
+        }
+      }
+    }
+  ]
+}
+```
+- `externalOAuthServer` set `enabled` to `true` to enable the middleware.
+- `providers` is an array of multiple IDP configurations, with each IDP config being an element in the `providers` array. 
+- You can use this config to use JWT self validation using `jwt` or use introspection via `instropection` in the `providers` section .
+
+
+
+    <Note>
+    For now, you’ll be limiting `providers` to have only one element, ie one IDP configured.
+    </Note>
+
+
+#### JWT
+
+There could be cases when you don’t need to introspect a JWT access token from a third party IDP, and instead you can just validate the JWT. This is similar to existing JWT middleware, adding it in External OAuth middleware for semantic reasons.
+
+- `enabled` - enables JWT validation.
+- `signingMethod` - specifies the signing method used to sign the JWT.
+- `source` - the secret source, it can be one of:
+  - a base64 encoded static secret
+  - a valid JWK url in plain text
+  - a valid JWK url in base64 encoded format
+- `issuedAtValidationSkew` , `notBeforeValidationSkew`, `expiresAtValidationSkew` can be used to [configure clock skew](/api-management/authentication/jwt-claim-validation#clock-skew-configuration) for json web token validation.
+- `identityBaseField` - the identity key name for claims. If empty it will default to `sub`.
+
+##### Example: Tyk OAS API definition with JWT validation enabled
+
+```json
+"securitySchemes": {
+  "external_jwt": {
+    "enabled": true,
+    "header": {
+      "enabled": true,
+      "name": "Authorization"
+    },
+    "providers": [
+      {
+        "jwt": {
+          "enabled": true,
+          "signingMethod": "hmac",
+          "source": "dHlrLTEyMw==",
+          "identityBaseField": "sub"
+        }
+      }
+    ]
+  }
+}
+```
+
+##### Example: Tyk Classic API definition with JWT validation enabled
+
+```json
+"external_oauth": {
+  "enabled": true,
+  "providers": [
+      {
+          "jwt": {
+              "enabled": true,
+              "signing_method": "hmac",
+              "source": "dHlrLTEyMw==",
+              "issued_at_validation_skew": 0,
+              "not_before_validation_skew": 0,
+              "expires_at_validation_skew": 0,
+              "identity_base_field": "sub"
+          },
+          "introspection": {
+              "enabled": false,
+              "url": "",
+              "client_id": "",
+              "client_secret": "",
+              "identity_base_field": "",
+              "cache": {
+                  "enabled": false,
+                  "timeout": 0
+              }
+          }
+      }
+  ]
+}
+```
+#### Introspection
+
+For cases where you need to introspect the OAuth access token, Tyk uses the information in the `provider.introspection` section of the contract. This makes a network call to the configured introspection endpoint with the provided `clientID` and `clientSecret` to introspect the access token.
+
+- `enabled` - enables OAuth introspection
+- `clientID` - clientID used for OAuth introspection, available from IDP
+- `clientSecret` - secret used to authenticate introspection call, available from IDP
+- `url` - endpoint URL to make the introspection call
+- `identityBaseField` - the identity key name for claims. If empty it will default to `sub`.
+
+##### Caching
+
+Introspection via a third party IdP is a network call. Sometimes it may be inefficient to call the introspection endpoint every time an API is called. Caching is the solution for this situation. Tyk caches the introspection response when `enabled` is set to `true` inside the `cache` configuration of `introspection`. Then it retrieves the value from the cache until the `timeout` value finishes. However, there is a trade-off here. When the timeout is long, it may result in accessing the upstream with a revoked access token. When it is short, the cache is not used as much resulting in more network calls. 
+
+The recommended way to handle this balance is to never set the `timeout` value beyond the expiration time of the token, which would have been returned in the `exp` parameter of the introspection response.
+
+See the example introspection cache configuration:
+
+```yaml
+"introspection": {
+  ...
+  "cache": {
+    "enabled": true,
+    "timeout": 60 // in seconds
+  }
+}
+```
+##### Example: Tyk OAS API definition external OAuth introspection enabled
+
+```json
+"securitySchemes": {
+  "keycloak_oauth": {
+    "enabled": true,
+    "header": {
+      "enabled": true,
+      "name": "Authorization"
+    },
+    "providers": [
+      {
+        "introspection": {
+          "enabled": true,
+          "url": "http://localhost:8080/realms/tyk/protocol/openid-connect/token/introspect",
+          "clientId": "introspection-client",
+          "clientSecret": "DKyFN0WXu7IXWzR05QZOnnSnK8uAAZ3U",
+          "identityBaseField": "sub",
+          "cache": {
+            "enabled": true,
+            "timeout": 3
+          }
+        }
+      }
+    ]
+  }
+}
+```
+##### Example: Tyk Classic API definition with external OAuth introspection enabled
+
+```json
+"external_oauth": {
+  "enabled": true,
+  "providers": [
+      {
+          "jwt": {
+              "enabled": false,
+              "signing_method": "",
+              "source": "",
+              "issued_at_validation_skew": 0,
+              "not_before_validation_skew": 0,
+              "expires_at_validation_skew": 0,
+              "identity_base_field": ""
+          },
+          "introspection": {
+              "enabled": true,
+              "url": "http://localhost:8080/realms/tyk/protocol/openid-connect/token/introspect",
+              "client_id": "introspection-client",
+              "client_secret": "DKyFN0WXu7IXWzR05QZOnnSnK8uAAZ3U",
+              "identity_base_field": "sub",
+              "cache": {
+                  "enabled": true,
+                  "timeout": 3
+              }
+          }
+      }
+  ]
+}
+```
+
+### Integrate with OpenID Connect (deprecated)
+
+
+<Note>
+Tyk has previously offered a dedicated OpenID Connect option for client authentication, but this was not straightforward to use and was deprecated in Tyk 5.7.0.
+<br />
+
+For integration with a third-party OIDC provider we recommend using the JSON Web Token (JWT) middleware which is described [above](/basic-config-and-security/security/authentication-authorization/json-web-tokens), which offers the same functionality with a more streamlined setup and reduced risk of misconfiguration.
+<br />
+
+The remainder of this section is left for reference and is not maintained.
+</Note>
+
+
+
+[OpenID Connect](https://openid.net/developers/how-connect-works) (OIDC) builds on top of OAuth 2.0, adding authentication. You can secure your APIs on Tyk by integrating with any standards compliant OIDC provider using [JSON Web Tokens](/basic-config-and-security/security/authentication-authorization/json-web-tokens) (JWTs).
+JWTs offer a simple way to use the third-party Identity Provider (IdP) without needing any direct integration between the Tyk and 3rd-party systems.
+
+To integrate a 3rd party OAuth2/OIDC IdP with Tyk, all you will need to do is ensure that your IdP can issue OAuth2 JWT access tokens as opposed to opaque tokens.
+
+The client application authenticates with the IdP which then provides an access token that is accepted by Tyk. Tyk will take care of the rest, ensuring that the rate limits and quotas of the underlying identity of the bearer are maintained across JWT token re-issues, so long as the "sub" (or whichever identity claim you chose to use) is available and consistent throughout and the policy that underpins the security clearance of the token exists too.
+
+
+
+## Conclusion
+
+Securing your APIs is a foundational step toward managing data integrity and access control effectively. Now that you've configured authentication and authorization, the next steps in your API journey with Tyk should involve:
+
+Defining Access Policies: Use Tyk’s Policies to refine API access controls, rate limits, and quotas. This lets you align your security model with business needs and enhance user experience through granular permissions. You can learn more about Policies [here](/api-management/policies).
+
+Exploring API Analytics: Leverage Tyk’s analytics to monitor access patterns, track usage, and gain insights into potential security risks or high-demand endpoints. Understanding usage data can help in optimizing API performance and enhancing security measures. You can learn more about analytics [here](/api-management/dashboard-analytics#analyzing-api-traffic-activity).
\ No newline at end of file
diff --git a/api-management/client-idp-registry.mdx b/api-management/client-idp-registry.mdx
new file mode 100644
index 0000000000..6ebf77877e
--- /dev/null
+++ b/api-management/client-idp-registry.mdx
@@ -0,0 +1,115 @@
+---
+title: "Identity Provider Registry"
+description: "Manage Identity Providers centrally with the Tyk Identity Provider Registry for JWT authentication and Dynamic Client Registration"
+keywords: "IdP, Identity Provider, JWKS, JWT, Dynamic Client Registration, DCR, scope-to-policy, identity provider registry"
+sidebarTitle: "Identity Provider Registry"
+---
+
+## Availability
+
+| Component | Version | Edition |
+| :-------- | :------ | :------ |
+| Tyk Gateway | Available since [v5.14.0](/developer-support/release-notes/gateway#5-14-0-release-notes) | Enterprise |
+| Tyk Dashboard | Available since [v5.14.0](/developer-support/release-notes/dashboard#5-14-0-release-notes) | Enterprise |
+| Tyk Sync | Available since [v2.2.0](/developer-support/release-notes/sync#2-2-0-release-notes) | Enterprise |
+
+## Introduction
+
+When using JWT authentication, Tyk needs to know which Identity Providers (IdPs) are trusted to issue tokens for an API. Specifically, it needs to know where to fetch the JWKS to validate signatures, and how to map token scopes to Tyk policies. Traditionally this configuration was stored directly inside the API definition.
+
+Embedding IdP config in the API definition causes problems at scale:
+
+- The Tyk Dashboard and Tyk Developer Portal can overwrite each other's changes when both write to the same API definition concurrently.
+- Deleting an [API Product using Dynamic Client Registration (DCR)](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration) from the Developer Portal does not reliably clean up the IdP config it added, leaving orphaned JWKS URLs and scope mappings.
+- Changes to an IdP's configuration must be separately applied to all APIs accessed with tokens issued by that provider.
+
+The Identity Provider Registry solves these problems by managing IdP records as a standalone resource in the Tyk Dashboard, separate from API definitions. Tyk Gateway loads the registry at startup alongside API definitions and applies it during JWT validation.
+
+<Note>
+The Identity Provider Registry manages IdPs used to authenticate *clients accessing your APIs* (inbound JWT validation). It is not related to the configuration of upstream services that the Gateway authenticates to, which is covered in [Upstream Authentication](/api-management/upstream-authentication).
+</Note>
+
+## What Is the Identity Provider Registry
+
+The Identity Provider Registry is a collection of IdP records managed by the Tyk Dashboard. Each record describes a single Identity Provider and its relationship to one or more APIs:
+
+| Field | Description |
+|-------|-------------|
+| `name` | A human-readable label for the IdP |
+| `issuer` | The issuer claim (`iss`) expected in tokens from this IdP |
+| `jwks_uri` | The URL of the IdP's JSON Web Key Set endpoint, used to fetch public keys for JWT signature validation |
+| `scope_claim_name` | The JWT claim that contains the token scopes, such as `scope` or `scp` |
+| `api_mappings` | A map of API IDs to scope-to-policy mappings, defining which Tyk policies should be applied when a token from this IdP is presented to each API |
+
+Adopting the registry is a non-breaking change. Any JWKS or scope configuration already present in an API definition continues to take precedence over registry-sourced config, which means existing API definitions keep working correctly on Gateways that predate 5.14.0. APIs that have no registry entries are unaffected. The registry is supported by both Tyk OAS and Tyk Classic API definitions.
+
+The Gateway caches JWKS fetched via registry entries the same way as those configured directly in an API definition.
+
+<Note>
+Registry JWKS URIs always use the gateway-level `jwks.cache.timeout` setting (defaulting to 240 seconds) and cannot currently be individually tuned per IdP.
+</Note>
+
+In distributed deployments, the registry is served to Data Plane Gateways by MDCB alongside API definitions. No additional configuration is required. Registry entries reach the Gateways that load the APIs they are mapped to, and are automatically pruned to include only the relevant `api_mappings` for each Data Plane.
+
+## When to Use the Identity Provider Registry
+
+The registry is the recommended approach when:
+
+- The Tyk Developer Portal manages API Product access via [Dynamic Client Registration](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration), where multiple systems write IdP config for the same API.
+- Multiple IdPs need to be trusted for a single API (the registry supports many-to-many relationships between IdPs and APIs).
+- IdP lifecycle (creation, update, and deletion) needs to be decoupled from API definition management.
+
+If you configure a single JWKS URI directly in the API definition and do not use DCR, the registry is not required.
+
+## Managing IdPs
+
+The IdP registry is managed exclusively via the Tyk Dashboard API or the [Tyk Developer Portal](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration). There is no Dashboard UI for the registry at this time.
+
+The Dashboard API exposes the following operations on the `/api/clientidps` endpoint:
+
+- **Create** an IdP record with a name, issuer, and JWKS URI.
+- **Retrieve** a single IdP or list all IdPs for the organisation.
+- **Update** an IdP record.
+- **Delete** an IdP record, which removes all its API mappings.
+- **Manage API mappings** in bulk using a `PATCH` request with JSON Merge Patch (RFC 7386) semantics: present keys upsert the mapping, null-valued keys remove it.
+
+Full endpoint reference and request/response schemas are available in the [Tyk Dashboard API reference](/tyk-dashboard-api).
+
+### API Mappings
+
+The `api_mappings` field is a map of API IDs to scope-to-policy configuration. Each entry defines how token scopes from this IdP are translated into Tyk policy IDs when the token is presented to that API.
+
+A single IdP can be mapped to multiple APIs, and a single API can have mappings from multiple IdPs.
+
+To add or update the mapping for a specific API without affecting other mappings on the same IdP, use the `PATCH /api/clientidps/{id}/mappings` endpoint with a JSON Merge Patch body:
+
+```json
+{
+  "<api_id>": {
+    "scope_to_policy": {
+      "read": "policy-id-for-read",
+      "write": "policy-id-for-write"
+    }
+  }
+}
+```
+
+To remove a mapping for a specific API, set its value to `null`:
+
+```json
+{
+  "<api_id>": null
+}
+```
+
+## Tyk Sync
+
+From **Tyk Sync 2.2.0** the full IdP lifecycle is supported alongside APIs and policies:
+
+- `tyk-sync dump` exports each IdP to a `clientidp-{id}.json` file and adds a `client_idps` array to `.tyk.json`.
+  - Use the `--idps` flag to export a specific subset.
+- `tyk-sync publish` and `tyk-sync update` push IdP files to the registry in Tyk Dashboard.
+- `tyk-sync sync` reconciles the full create, update, and delete lifecycle for IdPs.
+
+Referential integrity warnings are printed when an IdP's `api_mappings` references an API ID or policy ID not included in the current dump.
+
diff --git a/api-management/cloud/audit-logs.mdx b/api-management/cloud/audit-logs.mdx
new file mode 100644
index 0000000000..23d0ada1d6
--- /dev/null
+++ b/api-management/cloud/audit-logs.mdx
@@ -0,0 +1,54 @@
+---
+title: "Configure Audit Logs in Tyk Cloud"
+description: "Learn how to set up and manage audit logs in Tyk Cloud Control Plane deployments."
+keywords: "Audit Logs, Tyk Cloud, Control Plane, Data Plane"
+sidebarTitle: "Audit Logs"
+---
+
+## Introduction
+
+Tyk Cloud provides comprehensive audit logging capabilities to track and monitor all administrative actions performed within your Tyk Dashboard. This feature is essential for compliance and security.
+
+## What are Audit Logs?
+
+Audit logs capture detailed records of all requests made to endpoints under the `/api` route in your Tyk Dashboard. These logs include information about:
+
+- User actions and administrative operations
+- API changes and configurations
+- Authentication and authorisation events
+- System access and modifications
+- Response status codes and timestamps
+
+## Enabling Audit Logs for Control Plane Deployments
+
+
+<Note>
+The audit log feature is available for Control Plane versions v5.7.0 or later.
+</Note>
+
+
+### How to Enable Audit Logging
+
+1. **Contact Your Account Manager**: Audit logging must be enabled at the subscription level. Reach out to your Tyk account manager to add this feature to your plan.
+
+2. **Enable via Tyk Cloud UI**: Once the feature is available in your subscription, you can enable audit logging directly from the Tyk Cloud console:
+   - Navigate to your Control Plane deployment
+   - Select **Edit** from the deployment options
+   - Enable the **Audit Logging** option
+   - Save and redeploy your Control Plane
+
+Audit logs will be stored in your Control Plane's database for easy access and management.
+
+### Viewing and Accessing Audit Logs
+
+Once audit logging is enabled, you can retrieve the logs via the Tyk Dashboard API. 
+
+For details on the API endpoints and usage, see [Viewing and Retrieving Audit Logs](/api-management/logs/audit-logs#viewing-and-retrieving-audit-logs).
+
+## Storage Size Caps
+
+Tyk Cloud enforces audit log storage size caps based on your subscription terms:
+
+- **Storage Limits**: A size cap is applied to audit logs based on your subscription plan
+- **Automatic Cleanup**: When the storage limit is reached, the oldest logs are automatically removed to make space for new entries.
+
diff --git a/api-management/collecting-gateway-logs-otel-kubernetes.mdx b/api-management/collecting-gateway-logs-otel-kubernetes.mdx
new file mode 100644
index 0000000000..f575ff22e3
--- /dev/null
+++ b/api-management/collecting-gateway-logs-otel-kubernetes.mdx
@@ -0,0 +1,205 @@
+---
+title: "Collecting Tyk Gateway Logs with OpenTelemetry Collector on Kubernetes"
+description: "Step-by-step guide for platform engineers to collect Tyk Gateway logs using the OpenTelemetry Collector Filelog Receiver and ship them to Elasticsearch on Kubernetes."
+keywords: "OpenTelemetry, Logs, Kubernetes, Filelog Receiver, Elasticsearch, OTel Collector, Observability, Log Collection, DaemonSet, Sidecar"
+sidebarTitle: "Gateway Logs with OTel Collector"
+---
+
+## Introduction
+
+Tyk Gateway produces logs that capture internal events, errors, warnings, and details of request processing. In Kubernetes environments, these logs are written to `stdout`/`stderr` and captured by the container runtime, but they are ephemeral by default. Without a log collection strategy, critical operational data is lost when pods are restarted or evicted.
+
+The [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/) provides a vendor-neutral way to collect, process, and export logs from your Tyk Gateway pods to any supported backend. By using the [Filelog Receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/filelogreceiver), the Collector can tail container log files on each Kubernetes node and forward them to a log analytics backend such as Elasticsearch.
+
+This guide walks you through deploying the OpenTelemetry Collector alongside Tyk on Kubernetes, configuring it to collect Gateway logs, and shipping those logs to Elasticsearch.
+
+### Architecture Overview
+
+The following diagram illustrates how logs flow from Tyk Gateway containers through the OpenTelemetry Collector to Elasticsearch:
+
+```mermaid
+flowchart LR
+    subgraph Kubernetes Node
+        A[Tyk Gateway Pod] -->|stdout/stderr| B[Container Runtime]
+        B -->|writes to| C["/var/log/containers/*.log"]
+        D[OTel Collector DaemonSet] -->|tails| C
+    end
+    D -->|exports logs via HTTP| E[Elasticsearch]
+    E --> F[Kibana Dashboard]
+```
+
+## Prerequisites
+
+Before getting started, ensure you have the following:
+
+- [Kubernetes](https://kubernetes.io/docs/setup/) with `kubectl` configured
+- [Helm 3+](https://helm.sh/docs/intro/install/)
+- [Elasticsearch Cluster](https://www.elastic.co/guide/en/elasticsearch/reference/current/install-elasticsearch.html)
+- [Enterprise Edition License](/apim#licensing)
+- Basic familiarity with [Otel Collector](https://opentelemetry.io/docs/collector/configuration/) concepts
+
+## Instructions Overview
+
+### 1. Install Tyk Stack on Kubernetes
+
+For installing Tyk on Kubernetes, follow the [Tyk Helm Charts installation guide](/tyk-self-managed/install/kubernetes#instructions).
+
+<Note>
+When installing Tyk stack, add this flag `--set tyk-gateway.gateway.log.format=json` to configure the Gateway to output logs in JSON format.
+</Note>
+
+You should see Tyk Gateway, Dashboard, and Pump pods running.
+
+```
+dashboard-tyk-tyk-dashboard-85bf686b86-xhhm9         1/1     Running   0               4h25m
+gateway-tyk-tyk-gateway-6957669779-5tknn             1/1     Running   1 (4h24m ago)   4h25m
+otel-collector-opentelemetry-collector-agent-tr8zf   1/1     Running   0               93m
+pump-tyk-tyk-pump-5c9d94787f-vxdxs                   1/1     Running   0               4h25m
+tyk-postgres-postgresql-0                            1/1     Running   0               4h28m
+tyk-redis-master-0                                   1/1     Running   0               4h29m
+tyk-redis-replicas-0                                 1/1     Running   0               4h29m
+tyk-redis-replicas-1                                 1/1     Running   0               4h28m
+tyk-redis-replicas-2                                 1/1     Running   0               4h28m
+```
+
+### 2. Deploy OpenTelemetry Collector
+
+Add the OpenTelemetry Helm repository and install the Collector as a DaemonSet:
+
+```bash
+helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
+helm repo update
+```
+
+Create an `otel-collector-values.yaml` file. This configures the Collector in DaemonSet mode with the Filelog Receiver, and exports logs to Elasticsearch.
+
+<Note>
+In the configuration below, replace the Elasticsearch host and password with your actual values.
+</Note>
+
+```yaml Expandable
+mode: daemonset
+
+image:
+  repository: otel/opentelemetry-collector-contrib
+  tag: latest
+
+presets:
+  logsCollection:
+    enabled: false
+
+extraVolumes:
+  - name: varlog
+    hostPath:
+      path: /var/log
+  - name: dockercontainers
+    hostPath:
+      # This is where the actual .log files usually reside
+      path: /var/lib/docker/containers 
+
+extraVolumeMounts:
+  - name: varlog
+    mountPath: /var/log
+    readOnly: true
+  - name: dockercontainers
+    mountPath: /var/lib/docker/containers
+    readOnly: true
+
+config:
+  receivers:
+    filelog:
+      # To target all tyk components, you use the following pattern "/var/log/pods/*/*/*.log"
+      include:
+        - /var/log/pods/*tyk-gateway*/*/*.log
+      start_at: end
+      include_file_path: true  
+      operators:
+        - type: container      
+          id: container-parser
+
+        - type: json_parser       
+          parse_from: body
+          parse_to: attributes
+          if: 'body matches "^\\{"'
+
+  processors:
+    batch: {}
+    k8sattributes:
+      auth_type: "serviceAccount"
+      passthrough: false
+      extract:
+        metadata:
+          - k8s.pod.name
+          - k8s.pod.uid
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.container.name
+        labels:
+          - tag_name: $$1
+            key_regex: (.*)
+
+  exporters:
+    elasticsearch:
+      endpoints: ["http://<replace_host>:9200"]
+      logs_index: k8s-logs
+      mapping:
+        mode: none 
+      user: elastic
+      password: <replace_password>
+      tls:
+        insecure_skip_verify: true
+
+  service:
+    pipelines:
+      logs:
+        receivers: [filelog]
+        processors: [k8sattributes, batch]
+        exporters: [elasticsearch]
+```
+
+#### Pipeline Overview
+
+This **logs pipeline** reads container logs directly from the node filesystem using the `filelog` receiver, targeting Gateway pod log files. 
+
+The `json_parser` operator parses JSON-formatted log entries, extracting structured fields from the log body into attributes for richer filtering and analysis. 
+
+Each log entry is then enriched by the `k8sattributes` processor, which adds pod, namespace, node, container metadata, and all Kubernetes labels for better filtering and correlation. 
+
+The `batch` processor groups logs efficiently to reduce export overhead. Finally, the processed logs are sent to Elasticsearch, where they are indexed under `k8s-logs` for centralized search and analysis.
+
+
+<Note>
+
+The above configuration sends logs to the `k8s-logs` index in Elasticsearch. Before installing the collector, ensure the `k8s-logs` index is created in your Elasticsearch cluster.
+
+`curl -u elastic:<replace_password> -X PUT "<replace_host>:9200/k8s-logs" -H 'Content-Type: application/json' -d'{"settings": {"index": {}}}'`
+</Note>
+
+Install the Collector:
+
+```bash
+helm install otel-collector open-telemetry/opentelemetry-collector \
+  -n tyk \
+  -f otel-collector-values.yaml
+```
+
+Verify the Collector DaemonSet is running:
+
+```bash
+kubectl get pods -n tyk -l app.kubernetes.io/name=opentelemetry-collector
+```
+
+You should see a pod running on each node.
+
+```
+NAME                                                 READY   STATUS    RESTARTS   AGE
+otel-collector-opentelemetry-collector-agent-tr8zf   1/1     Running   0          125m
+```
+
+### 3. Verify Logs in Elasticsearch
+
+To view logs in Elasticsearch, you can use Kibana to create a [data view](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views) for the `k8s-logs` index to visualize the logs.
+
+Make some test requests to your Tyk Gateway to generate logs, then check Kibana for incoming log entries.
+
+<img src="/img/gateway-logs-elasticsearch.png" alt="Gateway logs in Elasticsearch" />
diff --git a/api-management/custom-auth-with-proxy-identity-provider.mdx b/api-management/custom-auth-with-proxy-identity-provider.mdx
new file mode 100644
index 0000000000..dd4d0e8d12
--- /dev/null
+++ b/api-management/custom-auth-with-proxy-identity-provider.mdx
@@ -0,0 +1,237 @@
+---
+title: "SSO with Proxy Provider"
+description: "Use Tyk Identity Broker's Proxy Provider to authenticate users against a custom or legacy HTTP endpoint."
+keywords: "Tyk Identity Broker, TIB, SSO, Proxy Provider, Custom Authentication, Legacy Authentication, Basic Auth"
+sidebarTitle: "Proxy Provider"
+---
+
+## Introduction
+
+The Proxy Provider (`ProxyProvider`) is a passthrough authentication method that forwards the user's request to a custom or legacy HTTP endpoint and evaluates the response to determine whether authentication succeeded. No browser redirect to an external IdP is involved.
+
+This is useful for integrating with systems that do not support standard protocols such as OIDC, SAML, or LDAP, for example a legacy authentication service that accepts Basic Auth and returns a JSON response.
+
+Before configuring your TIB profile, read [Dashboard SSO](/tyk-identity-broker/dashboard-sso) or [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case.
+
+## How It Works
+
+TIB proxies the incoming authentication request to the configured `TargetHost` and evaluates the response:
+
+```mermaid
+sequenceDiagram
+    actor User
+    participant TIB as Tyk Identity Broker
+    participant Upstream as Target Host
+
+    User->>TIB: POST /auth/{profile-id}/ProxyProvider
+    TIB->>Upstream: Proxy request
+    Upstream->>TIB: Response
+    TIB->>TIB: Evaluate success (OKCode / OKResponse / OKRegex)
+    TIB->>User: Redirect to ReturnURL or return token
+```
+
+1. The user submits credentials to the TIB endpoint (typically via a form `POST` or HTTP Basic Auth header).
+2. TIB proxies the request to `TargetHost`.
+3. TIB evaluates the response against the configured success criteria.
+4. If successful, TIB extracts the user identity and executes the configured action.
+
+## Evaluating Success
+
+TIB evaluates the upstream response in order. At least one of `OKCode`, `OKResponse`, or `OKRegex` must be configured.
+
+1. **Hard failure**: if the upstream returns HTTP `400` or above, authentication fails immediately.
+2. **`OKCode`**: if set (non-zero), the response status code must exactly match this value.
+3. **`OKResponse`**: if set, TIB base64-encodes the raw response body and compares it to this value. The configured value must therefore be a base64-encoded string.
+4. **`OKRegex`**: if set, TIB applies this regular expression against the raw response body.
+
+All configured criteria must pass for authentication to succeed.
+
+## Extracting User Identity
+
+If authentication succeeds, TIB extracts the user identity to pass to the identity handler:
+
+- If `ResponseIsJson` is `true`, TIB parses the response body as JSON and extracts values using `AccessTokenField` and `UsernameField` as JSON field names.
+- If `ExrtactUserNameFromBasicAuthHeader` is `true`, TIB extracts the username from the incoming request's Basic Auth header.
+- If no username can be extracted, TIB generates a random identifier and appends `@soSession.com` to form a placeholder email address.
+
+<Warning>
+The field name `ExrtactUserNameFromBasicAuthHeader` contains a known typo that is preserved in the TIB codebase to avoid a breaking change. You must spell it exactly as shown.
+</Warning>
+
+## TIB Profile
+
+The Proxy Provider configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `ProxyProvider` and `Type` to `passthrough`.
+
+```json expandable
+{
+  "ProviderName": "ProxyProvider",
+  "Type": "passthrough",
+  "ProviderConfig": {
+    "TargetHost": "http://{upstream-host}/{path}",
+    "OKCode": 200,
+    "OKResponse": "",
+    "OKRegex": "",
+    "ResponseIsJson": false,
+    "AccessTokenField": "",
+    "UsernameField": "",
+    "ExrtactUserNameFromBasicAuthHeader": false
+  }
+}
+```
+
+The `ProviderConfig` fields are:
+
+| Field | Description |
+|---|---|
+| `TargetHost` | URL of the upstream authentication endpoint. |
+| `OKCode` | HTTP status code that indicates a successful response. Set to `0` to disable this check. |
+| `OKResponse` | Base64-encoded string that the response body must exactly match. Leave empty to disable. |
+| `OKRegex` | Regular expression that must match the raw response body. Leave empty to disable. |
+| `ResponseIsJson` | Set to `true` if the upstream response body is JSON, enabling field extraction via `AccessTokenField` and `UsernameField`. |
+| `AccessTokenField` | JSON field name in the upstream response containing an access token. |
+| `UsernameField` | JSON field name in the upstream response containing the username. |
+| `ExrtactUserNameFromBasicAuthHeader` | Set to `true` to extract the username from the incoming request's Basic Auth header. See the warning above for the intentional field name typo. |
+
+## Login Page
+
+Since `ProxyProvider` is a passthrough flow, users submit credentials directly to TIB. Create a login page with a form that posts to the TIB authentication endpoint:
+
+```html
+<form method="POST" action="http://{tib-host}/auth/{profile-id}/ProxyProvider">
+  <input type="text" name="username" />
+  <input type="password" name="password" />
+  <button type="submit">Log in</button>
+</form>
+```
+
+Alternatively, credentials can be passed via an HTTP Basic Auth header if `ExrtactUserNameFromBasicAuthHeader` is set to `true`.
+
+## Worked Example
+
+This example proxies a Basic Auth request to an upstream service. TIB evaluates the HTTP `200` response code and extracts the username from the JSON response body.
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for full details.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "proxy-dashboard",
+  "Name": "Proxy Provider Dashboard SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "passthrough",
+  "ProviderName": "ProxyProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "TargetHost": "http://{upstream-host}/{auth-path}",
+    "OKCode": 200,
+    "OKResponse": "",
+    "OKRegex": "",
+    "ResponseIsJson": true,
+    "AccessTokenField": "access_token",
+    "UsernameField": "username",
+    "ExrtactUserNameFromBasicAuthHeader": false
+  }
+}
+```
+
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+
+**Login page form action**
+
+Your login page form should `POST` to:
+
+```
+http://dashboard.example.com:3000/auth/proxy-dashboard/ProxyProvider
+```
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "proxy-portal",
+  "Name": "Proxy Provider Portal SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "passthrough",
+  "ProviderName": "ProxyProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "TargetHost": "http://{upstream-host}/{auth-path}",
+    "OKCode": 200,
+    "OKResponse": "",
+    "OKRegex": "",
+    "ResponseIsJson": true,
+    "AccessTokenField": "access_token",
+    "UsernameField": "username",
+    "ExrtactUserNameFromBasicAuthHeader": false
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `DashboardCredential` to the [`PortalAPISecret`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+
+**Login page form action**
+
+Your login page form should `POST` to:
+
+```
+http://portal.example.com:3001/tib/auth/proxy-portal/ProxyProvider
+```
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
diff --git a/api-management/custom-error-responses.mdx b/api-management/custom-error-responses.mdx
new file mode 100644
index 0000000000..eb0e1b6b6a
--- /dev/null
+++ b/api-management/custom-error-responses.mdx
@@ -0,0 +1,482 @@
+---
+title: "Customizing Error Responses"
+description: "Learn how to customize the HTTP error responses returned by Tyk Gateway to API clients, using Error Overrides, Response Body Overrides, and Authentication Error Configuration"
+keywords: "custom error response, error override, error template, response body override, override_messages, authentication error, HTTP error, status code, error message, Tyk Gateway"
+sidebarTitle: "Customize Error Responses"
+---
+
+## Availability
+
+| Component | Version | Edition |
+| :-------- | :------ | :------ |
+| Tyk Gateway (Error Overrides) | Available since [v5.13.0](/developer-support/release-notes/gateway#5-13-0-release-notes) | Community & Enterprise |
+| Tyk Gateway (Response Body Overrides, `override_messages`) | All versions | Community & Enterprise |
+
+<Note>
+This document focuses exclusively on customizing errors returned by API proxies deployed on the Gateway (data plane traffic). It does not apply to errors returned by the Tyk Dashboard API nor the Tyk Gateway API (management traffic).
+</Note>
+
+## Tyk Gateway Error Handling
+
+When an error occurs during request processing, Tyk Gateway generates an HTTP error response automatically. Error conditions include authentication failures, rate limit rejections, request validation failures, and upstream connection problems, as well as error status codes (`HTTP 4xx` and `HTTP 5xx`) returned by upstream services.
+
+The default response comprises:
+- the HTTP status code defined by the triggering middleware
+- a `Content-Type: application/json` header
+- an `X-Generator: tyk.io` header
+- a JSON response body
+
+```http
+HTTP/1.1 403 Forbidden
+Content-Type: application/json
+X-Generator: tyk.io
+
+{"error": "Access to this API has been disallowed"}
+```
+
+Notes on the default error response:
+- the response is provided in JSON format regardless of the `Content-Type` of the request.
+- the `X-Generator` header can be suppressed by setting [`hide_generator_header: true`](/tyk-oss-gateway/configuration#hide_generator_header) in `tyk.conf` (or using the equivalent environment variable).
+
+This default behavior is often insufficient in production for various reasons such as:
+
+- **Standardizing Format:** clients expect a specific error structure, such as [RFC 7807 Problem Details](https://datatracker.ietf.org/doc/html/rfc7807), that the default response does not produce.
+- **Gateway Migration:** clients may depend on error response formats from a previous API gateway that differ from Tyk's defaults.
+- **Hiding Internal Detail:** default messages might expose information about your authentication mechanism, key structure, or upstream topology.
+- **Consistency Across APIs:** upstream services may return different error formats; normalizing them at the Gateway improves the client experience.
+- **Per-API Requirements:** different APIs published on the same Gateway may need to return different error formats or status codes for the same underlying error condition.
+
+### Customization Mechanisms
+
+Tyk provides three mechanisms for customizing error responses. The first two are long-standing features with narrow, specific purposes. The third, introduced in Tyk v5.13.0, is a comprehensive replacement for both.
+
+[**Authentication Error Configuration**](#authentication-error-configuration) targets specific scenarios: the HTTP status codes and message strings that Tyk returns for errors reported by the [client authentication](/api-management/client-authentication) middleware, which may not suit your API contract. Its scope is intentionally narrow: it covers only the 11 built-in auth and OAuth error conditions and applies identically to all APIs on the Gateway.
+
+[**Response Body Overrides**](#response-body-overrides) solve a different problem: the format of the response body. By placing Go template files in the Gateway's `templates/` directory, you can replace the body structure (as JSON or XML) for any HTTP error status code. Templates are resolved globally based on status code and the request's `Content-Type`. This applies identically to all APIs; it cannot intercept or modify error responses that originated from upstream services, and cannot differentiate between different errors that generate the same status code.
+
+[**Error Overrides**](#error-overrides), introduced in Tyk v5.13.0, supersedes both. You define a set of rules against which each error is tested. Separate rules can be configured for different status codes, error type, message pattern, or upstream response content. When a rule matches, Tyk can modify any part of the response before it is returned to the client. Error Overrides works with errors generated by both Tyk and upstream services, which neither legacy mechanism can intercept.
+
+The table below summarizes the key differences:
+
+| | Authentication Error Configuration | Response Body Overrides | Error Overrides |
+|---|:--:|:--:|:--:|
+| Available since | Early versions | v2.2 | v5.13.0 |
+| Configuration location | `tyk.conf` | Template files in `templates/` | `tyk.conf` and/or API definition |
+| Scope | All APIs | All APIs | All APIs or per-API |
+| Customize status code | ✅ | ❌ | ✅ |
+| Customize message string | ✅ | ❌ | ✅ |
+| Customize body format | ❌ | ✅ | ✅ |
+| Customize upstream errors | ❌ | ❌ | ✅ |
+| Customize by error type | ❌ | ❌ | ✅ |
+
+For new API deployments, we strongly recommend that you use **Error Overrides** to customize error responses. Authentication Error Configuration and Response Body Overrides remain fully supported for backward compatibility.
+
+### How the Mechanisms Interact
+
+The three error customization mechanisms can be implemented together. **We don't recommend this**, now that Error Overrides provides full customization, however it is important to understand how they will interact if more than one is deployed.
+
+{/* DIAGRAM PLACEHOLDER */}
+{/*
+Suggested diagram: flowchart with these steps:
+1. Gateway starts up -> Authentication Error Configuration remaps default auth/OAuth status codes and messages
+2. Request arrives and error occurs
+3. Error Overrides evaluated -> if a matching rule provides a complete body, return response immediately (end)
+4. If no complete body from Error Overrides -> Response Body Overrides format the body
+5. HTTP response sent to client
+*/}
+
+{/* Three points about the sequence may not be obvious from the diagram: */}
+
+- **Authentication Error Configuration runs at Gateway startup, not at request time.** Error Overrides and Response Body Overrides see the already-modified status codes and messages, not the original Tyk defaults.
+- **Error Overrides only bypasses Response Body Overrides when it provides a complete body.** A rule that changes only the status code or message still falls through to the template for body formatting.
+- **The mechanisms can coexist.** Error Overrides can be introduced incrementally: existing template files and `override_messages` settings continue to function for any error condition not covered by an override rule.
+
+## Error Overrides
+
+Error Overrides is a powerful, declarative system that allows you to intercept errors and rewrite their HTTP status codes, headers, and bodies. It can handle both Gateway-generated errors (e.g., rate limits, auth failures) and Upstream errors (e.g., `HTTP 500 Internal Server Error` returned from your backend service).
+
+It works using a rule matching approach where each error response generated by Tyk middleware (including the proxy stage which receives the response from the upstream) is checked against a set of [rules](#rule-structure) that determine the [modification](#response-customization) to be made to matching responses. If no rule matches, the response is returned to the client unaltered.
+
+### Rule Structure
+
+Rules are organized by status code key, which can be either an exact code such as `400` or a wildcard pattern such as `4xx` or `5xx`. Multiple rules can share the same key; they are evaluated in order and the first match wins.
+
+Each rule has two objects:
+- an optional `match` object to specify which errors within that status code trigger the rule.
+- a `response` object that defines what Tyk returns when the rule fires (in place of the original error response).
+
+Omitting `match` means that the transformation in the `response` is applied to **any error with that status code**.
+
+```json
+{
+  "error_overrides": {
+    "403": [                        // key: exact code ("403") or wildcard ("4xx")
+      {
+        "match": {                  // optional: specifies which errors trigger this rule
+          "flag": "AKI"             // match by error classification flag
+        },
+        "response": {               // what Tyk returns when this rule fires
+          "status_code": 401,       // new HTTP status code
+          "headers": { "WWW-Authenticate": "Bearer" },        // headers to set in the response
+          "body": "{\"error\": \"Authentication required\"}"  // response body
+        }
+      }
+    ]
+  }
+}
+```
+
+This structure is used for [Gateway-level](#gateway-level) overrides; for API-level overrides see the [relevant section](#api-level). 
+
+### Matching Criteria
+
+After the initial match on the status code key, you can refine which errors trigger the rule using the `match` object. The fields available depend on whether the error was generated by Tyk Gateway or returned by an upstream service.
+
+| Field | Gateway-generated errors | Upstream errors |
+|---|---|---|
+| `flag` | Matches any flag from the [Flag Reference](#flag-reference). | `URS` is supported for `5xx` errors; leave blank for `4xx` errors. Any other value prevents the rule from matching. |
+| `messagePattern` | Regex matched against the error message string. | Regex matched against the response body. |
+| `bodyField` + `bodyValue` | Not evaluated. | A [gjson](https://github.com/tidwall/gjson) path and expected value matched against a JSON response body. |
+
+#### Matching Gateway-generated errors
+
+- If `flag` is set and matches, the rule fires.
+- Otherwise, if `messagePattern` is set and matches the error message, the rule fires.
+- If a match field is set but does not match, the rule does not fire.
+- If **neither** field is set, the rule **matches any error with that status code**.
+
+#### Matching Upstream-generated errors
+
+`bodyField` and `bodyValue` work together to match a specific field and value in the upstream JSON response body. `bodyField` is a [gjson](https://github.com/tidwall/gjson) path expression identifying a field in the response; `bodyValue` is the expected string value for that field.
+
+For example, given an upstream error response:
+
+```http
+HTTP/1.1 503 Service Unavailable
+Content-Type: application/json
+
+{"error": {"code": "OUT_OF_STOCK"}}
+```
+
+The following match configuration fires only when the upstream returns that specific error code:
+
+```json
+"match": {
+  "flag": "URS",
+  "bodyField": "error.code",
+  "bodyValue": "OUT_OF_STOCK"
+}
+```
+
+**`5xx` Upstream Errors:**
+- Set `flag=URS` to match upstream `5xx` responses only, excluding Gateway-generated errors with the same code (such as a circuit-breaker `503`).
+- To differentiate between different upstream `5xx` errors, set `bodyField`/`bodyValue` or `messagePattern` to match on the response body. Note that `messagePattern` matches on the response body for upstream errors.
+
+**`4xx` Upstream Errors:**
+- `flag=URS` is `5xx`-only. There is no flag that isolates upstream `4xx` responses from Gateway-generated ones with the same status code.
+- Use `messagePattern` to differentiate by content: for Gateway errors it matches against the error message string; for upstream errors it matches against the response body. A pattern that matches the upstream response format but not Tyk's fixed error messages effectively targets upstream responses only.
+
+<Warning>
+`bodyField`/`bodyValue` is not evaluated when matching Gateway-generated errors. A `4xx` rule that sets only body criteria, with no `flag` or `messagePattern`, will match all Gateway-generated errors of that status code, not just upstream responses.
+</Warning>
+
+<Note>
+When `messagePattern` or `bodyField`/`bodyValue` are used to match upstream responses, Tyk reads up to 4 KB of the response body. Content beyond 4 KB is not evaluated. If no match is found, the original response body is passed through unchanged.
+</Note>
+
+### Response Customization
+
+The response object defines what Tyk returns to the client when a rule matches (or fires). *All fields are optional*: provide any combination to achieve the override you need.
+
+**`statusCode`**: (`status_code` in Tyk Classic and `tyk.conf`)
+- This is the HTTP status code to return to the client.
+- Any valid HTTP status code is accepted.
+- If omitted, the original error status code is preserved.
+- Available as `{{.statusCode}}` in [Go Template Syntax](#go-template-syntax) used in `body` or `template`.
+
+**`headers`**:
+- A JSON object of key-value string pairs to set on the response. These are merged into the existing response headers; any key you specify sets or overrides that header while all other headers remain intact.
+ - If omitted, no additional headers are set.
+- To remove a header, include it in `headers` with an empty value.
+- Note that the `X-Generator` header cannot be removed via override rules; suppress it globally using [`hide_generator_header`](/tyk-oss-gateway/configuration#hide_generator_header).
+
+**`message`**:
+- The error message text.
+- Available as `{{.Message}}` in [Go Template Syntax](#go-template-syntax) used in `body` or `template`.
+- If omitted, `{{.Message}}` resolves to an empty string in the `body` or `template`.
+
+**`body`**:
+- The response body, written verbatim to the client.
+- Can be a static string or a Go template string (see [Go Template Syntax](#go-template-syntax)).
+- When `body` is provided, the legacy template system is bypassed entirely.
+- If `body` is set, `template` is ignored.
+
+**`template`**:
+- The base filename (without extension) of a file in the Gateway's `templates/` directory.
+- The file content is used as the response body, written verbatim to the client.
+- Tyk appends `.json` or `.xml` to the base filename based on the `Content-Type` of the original request.
+    - For example, `"my_error"` resolves to `templates/my_error.json` for JSON requests and `templates/my_error.xml` for XML requests.
+- Use `template` as an alternative to `body` when the template body is large or shared across multiple rules.
+
+#### Partial Override
+
+If neither `body` nor `template` is set, the rule is a partial override as it does not contain any response body content. Tyk applies the `statusCode` and `message` from the matching rule. Use this when you want to change the status code or message while retaining the existing body format.
+
+<Note>
+A partial override will pass through the legacy template system, which may format the response body. Be careful if you have both Error Overrides and [Response Body Overrides](#response-body-overrides) configured to avoid unintended behavior.
+</Note>
+
+#### XML Clients
+
+Inline `body` overrides are written verbatim **regardless of the `Content-Type` of the original request**. To serve XML to XML clients using an inline body, ensure that the `body` contains XML formatted content. If using `template`, then ensure you provide a `.xml` file variant, as Tyk will select that given `Content-Type: "application/xml"` in the request.
+
+#### Go Template Syntax
+
+<Note>
+The files referenced by the `template` field are distinct from the [Response Body Overrides](#response-body-overrides) legacy system. Both reside in the Gateway's `templates/` directory, but Error Override template files are referenced explicitly by name in a rule and have access to the variables listed below. Legacy template files are selected automatically by filename convention and only have access to `{{.Message}}`.
+</Note>
+
+The `body` field and the files referenced by the `template` field support [Go template syntax](/api-management/traffic-transformation/go-templates). The variables available in error override templates are specific to the error context and are listed below.
+
+The following variables are always available:
+
+- `{{.StatusCode}}`: The HTTP status code being returned.
+- `{{.Message}}`: The error message text.
+
+Note that for both variables, if `response.statusCode` or `response.message` are declared in the override rule, these will be applied prior to the template being resolved and so the override value will be applied to the template, not the value from the original error message.
+
+Some errors inject additional variables:
+
+- `{{.InvalidParams}}`: A string describing the specific validation failure. Only available when `flag=BIV` (see [Request Validation](/api-management/traffic-transformation/request-validation)). Example: `"body.age must be a positive integer"`.
+
+Example of an RFC 7807 compliant inline template:
+
+```json
+"response": {
+  "statusCode": 400,
+  "headers": { "Content-Type": "application/problem+json" },
+  "body": "{\"type\": \"https://example.com/probs/validation\", \"title\": \"Invalid Request\", \"status\": {{.StatusCode}}, \"detail\": \"{{.Message}}\"}"
+}
+```
+
+### Configuration
+
+Error Overrides can be configured in two layers:
+
+- [Gateway-level](#gateway-level) configuration is applied to all APIs deployed on the Gateway
+- [API-level](#api-level) configuration applies to a specific API and is evaluated first
+
+If no API-level rule matches, Tyk checks the error response against the Gateway-level rules.
+
+#### Gateway Level
+
+Configure overrides that apply to all APIs deployed on the Gateway using the [`error_overrides`](/tyk-oss-gateway/configuration#error_overrides) object in the Gateway config (`tyk.conf` or equivalent environment variables):
+
+```json
+"error_overrides": {
+  "403": [{
+    "match": {
+      "flag": "AKI"
+    },
+    "response": {
+      "status_code": 401,
+      "headers": { "WWW-Authenticate": "Bearer" },
+      "body": "{\"error\": \"Authentication required\"}"
+    }
+  }]
+}
+```
+
+#### API Level
+
+Configure overrides for a specific API in the [`errorOverrides`](/api-management/gateway-config-tyk-oas#erroroverrides) section of the Tyk Vendor Extension:
+
+```json
+"x-tyk-api-gateway": {
+  "errorOverrides": {
+    "enabled": true,
+    "value": {
+      "403": [{
+        "match": {
+          "flag": "AKI"
+        },
+        "response": {
+          "statusCode": 401,
+          "headers": { "WWW-Authenticate": "Bearer" },
+          "body": "{\"error\": \"Authentication required\"}"
+        }
+      }]
+    }
+  }
+}
+```
+
+Set `"enabled": false` to disable API-level overrides without removing the configuration.
+
+If using Tyk Classic APIs, configure overrides at the top level of the API definition:
+
+```json
+{
+  "error_overrides_disabled": false,
+  "error_overrides": {
+    "403": [{
+      "match": {
+        "flag": "AKI"
+      },
+      "response": {
+        "status_code": 401,
+        "headers": { "WWW-Authenticate": "Bearer" },
+        "body": "{\"error\": \"Authentication required\"}"
+      }
+    }]
+  }
+}
+```
+
+Set `"error_overrides_disabled": true` to disable API-level overrides without removing the configuration.
+
+### Flag Reference
+
+The following flags classify errors generated by Tyk Gateway and can be used in the `flag` field of a match object. For intercepting upstream error responses, see [Upstream Error Responses](#upstream-error-responses).
+
+#### Authentication and Authorization Errors
+
+| Flag | Name | Description | Typical HTTP Status |
+|:----:|------|-------------|:-------------------:|
+| `AMF` | Auth Field Missing | Authorization field missing from request | `401` (auth token) / `400` (OAuth) |
+| `AKI` | API Key Invalid | API key invalid | `403` |
+| `TKE` | Token Expired | Token or certificate has expired | `403` |
+| `TKI` | Token Invalid | Token is invalid | `403` |
+| `TCV` | Token Claims Invalid | Token claims invalid (JWT) | `401` |
+| `EAD` | External Auth Denied | External authentication denied | `403` |
+| `CRQ` | Client Certificate Required | Mutual TLS client certificate required | `401` |
+| `CMM` | Client Certificate Mismatch | Mutual TLS client certificate mismatch | `401` |
+
+#### Request Validation Errors
+
+| Flag | Name | Description | Typical HTTP Status |
+|:----:|------|-------------|:-------------------:|
+| `BTL` | Body Too Large | Request body too large | `400` |
+| `CLM` | Content-Length Missing | Content-Length header missing | `411` |
+| `BIV` | Body Invalid | [Request validation](/api-management/traffic-transformation/request-validation) failed | `400` or `422` |
+| `IHD` | Invalid Header | Invalid request header | `400` |
+
+#### Rate Limiting and Quota Errors
+
+| Flag | Name | Description | Typical HTTP Status |
+|:----:|------|-------------|:-------------------:|
+| `RLT` | Rate Limited | Request rate limited | `429` |
+| `QEX` | Quota Exceeded | Quota exceeded | `403` |
+
+#### Upstream Connectivity Errors
+
+| Flag | Name | Description | Typical HTTP Status |
+|:----:|------|-------------|:-------------------:|
+| `UCF` | Upstream Connection Refused | Upstream connection refused | `500` |
+| `UCT` | Upstream Connection Timeout | Upstream connection timed out (TCP connect phase) | `500` |
+| `URR` | Connection Reset | Upstream connection reset by peer | `500` |
+| `URT` | Response Timeout | Upstream request timed out (no response headers received) | `504` |
+| `EPI` | Broken Pipe | Broken pipe (EPIPE) writing to upstream | `500` |
+| `CAB` | Connection Aborted | Connection aborted | `500` |
+| `NRS` | Network Reset | Network reset (ENETRESET) | `500` |
+| `DNS` | DNS Resolution Failure | DNS resolution failure | `500` |
+| `NRH` | No Route to Host | No route to host | `500` |
+| `NHU` | No Healthy Upstreams | No healthy upstreams available | `503` |
+| `CBO` | Circuit Breaker Open | Circuit breaker open | `503` |
+| `CDC` | Client Disconnected | Client disconnected before response was sent | `499` |
+| `UPE` | Upstream Protocol Error | Upstream protocol error (generic fallback) | `500` |
+
+#### TLS Errors
+
+| Flag | Name | Description | Typical HTTP Status |
+|:----:|------|-------------|:-------------------:|
+| `TLE` | TLS Certificate Expired | TLS certificate on the upstream has expired | `500` |
+| `TLI` | TLS Certificate Invalid | TLS certificate on the upstream is invalid | `500` |
+| `TLM` | TLS Hostname Mismatch | TLS certificate hostname mismatch | `500` |
+| `TLN` | TLS Not Trusted | TLS certificate not trusted (unknown authority) | `500` |
+| `TLH` | TLS Handshake Failure | TLS handshake failed | `500` |
+| `TLP` | TLS Protocol Error | TLS protocol error | `500` |
+| `TLA` | TLS Alert | TLS alert (handshake failure, version mismatch) | `500` |
+| `TLC` | TLS Certificate Chain Incomplete | TLS certificate chain incomplete | `500` |
+
+#### Upstream Error Responses
+
+Upstream `5xx` error responses carry the `URS` flag. Use `flag=URS` in a match rule to restrict it to upstream responses only, preventing it from also matching gateway-generated errors with the same status code.
+
+| Flag | Name | Description | Typical HTTP Status |
+|:----:|------|-------------|:-------------------:|
+| `URS` | Upstream Response 5XX | Upstream returned a 5xx error response | Varies (`500` to `599`) |
+
+## Response Body Overrides
+
+<Note>
+This is a legacy feature. For new implementations, we recommend using [Error Overrides](#error-overrides) instead.
+</Note>
+
+The Response Body Overrides system works by the Gateway reading text files from the `templates/` directory in its local filesystem. Tyk selects a file based on the HTTP status code and the request's `Content-Type` (for example, `error_500.json` or `error_500.xml`), falling back to a generic `error.json` or `error.xml` if no status code-specific file exists.
+
+The content of the selected file is used to replace the body of the error response. Go template syntax is available, but only the `{{.Message}}` variable is supported, which contains the error message text.
+
+Note the following limitations on the scope of this feature:
+- **Gateway-Level Scope:** The same customized response bodies are applied for all APIs on the Gateway.
+- **Upstream Errors:** This method cannot intercept upstream errors.
+- **Status Code Scope:** There is no way to differentiate between different errors that share the same status code.
+- **`HTTP 404` Limitation:** Response Body Overrides cannot be used to customize the body of `HTTP 404` responses.
+- **Response Body Only:** This method does not enable customization of status code, error message or headers.
+
+<Warning>
+The files used by Response Body Overrides share the same `templates/` directory as the files referenced by the Error Overrides [`template`](#go-template-syntax) field. If using both override methods, be careful to take account of the specific naming required by Response Body Overrides and the fact that this cannot be disabled, so a file named `error.json` will be used to override any error response without a specific [rule](#rule-structure).
+</Warning>
+
+## Authentication Error Configuration
+
+<Note>
+This is a legacy feature. For new implementations, we recommend using [Error Overrides](#error-overrides) instead.
+</Note>
+
+Authentication Error Configuration allows you to change the default HTTP status codes and error messages that Tyk returns for its built-in authentication and OAuth error conditions, using the `override_messages` configuration in `tyk.conf`. It is provided for cases where your API contract requires specific status codes or messages for auth failures that differ from Tyk's defaults.
+
+Specify the message ID in the `override_messages` object in `tyk.conf` and provide a `code`, `message`, or both:
+
+```json
+"override_messages": {
+  "auth.key_not_found": {
+    "code": 401,
+    "message": "Invalid or missing API key"
+  }
+}
+```
+
+Note the following limitations on the scope of this feature:
+- **Limited Scope:** This method only works for specific auth-related errors.
+- **Gateway-Level Scope:** The same responses are applied for all APIs on the Gateway.
+- **Limited Customization:** This method does not enable customization of response body or headers.
+
+<Warning>
+Authentication Error Configuration takes effect at Gateway startup, before any requests are processed. If configured alongside Error Overrides, the Error Overrides rules see the values modified by Authentication Error Configuration, not the original Tyk defaults. For example, if you use `override_messages` to remap an error to a different status code, any Error Overrides rules must match the new code, not the original.
+</Warning>
+
+**Supported Message IDs and Their Defaults:**
+
+| Message ID | Default Message | Default HTTP Status |
+|------------|-----------------|:-------------------:|
+| `auth.auth_field_missing` | "Authorization field missing" | `401` |
+| `auth.key_not_found` | "Access to this API has been disallowed" | `403` |
+| `auth.cert_not_found` | "Access to this API has been disallowed" | `403` |
+| `auth.key_is_invalid` | "Access to this API has been disallowed" | `403` |
+| `auth.cert_expired` | "Certificate has expired" | `403` |
+| `auth.cert_required` | "Client certificate required" | `401` |
+| `auth.cert_mismatch` | "Access to this API has been disallowed" | `401` |
+| `oauth.auth_field_missing` | "Authorization field missing" | `400` |
+| `oauth.auth_field_malformed` | "Bearer token malformed" | `400` |
+| `oauth.key_not_found` | "Key not authorised" | `403` |
+| `oauth.client_deleted` | "Key not authorised. OAuth client access was revoked" | `403` |
+
+## Other Error Configurations
+
+Tyk offers error configurations within certain middleware:
+
+- [**Request Validation**](/api-management/traffic-transformation/request-validation#configuring-the-request-validation-middleware): When using Request Validation middleware, the HTTP status code returned in case of validation failure can be configured in the API definition.
+- [**HMAC Signature Validation**](/basic-config-and-security/security/authentication-authorization/hmac-signatures): The HMAC signature authentication middleware exposes fields that set the HTTP status code and error message returned when signature validation fails.
+- **Custom Plugins**: [JavaScript plugins](/api-management/plugins/javascript#using-returnoverrides) and [Rich Plugins](/api-management/plugins/rich-plugins#returnoverrides) can use the *Return Overrides* mechanism to halt middleware execution and return a custom HTTP response directly to the client. [Go plugins](/api-management/plugins/golang#terminating-the-request) can write directly to the `http.ResponseWriter` to terminate the request and return a fully custom status code, headers, and body.
+- [**Virtual Endpoints**](/api-management/traffic-transformation/virtual-endpoints#working): Virtual endpoints execute a JavaScript function that returns a fully custom response (status code, headers, and body) via the `TykJsResponse()` function.
\ No newline at end of file
diff --git a/api-management/dashboard-analytics.mdx b/api-management/dashboard-analytics.mdx
new file mode 100644
index 0000000000..317d351444
--- /dev/null
+++ b/api-management/dashboard-analytics.mdx
@@ -0,0 +1,360 @@
+---
+title: "Dashboard Analytics"
+description: "Learn how Tyk Dashboard's Analytics UI and Log Browser get their data."
+keywords: "Dashboard Analytics, Tyk Pump, Log Browser, Traffic Analytics, MDCB, Hybrid Pump"
+sidebarTitle: "Overview"
+---
+
+## What Is Dashboard Analytics
+
+Tyk Dashboard presents [built-in analytics](#traffic-analytics) giving visibility of the traffic passing through your APIs. It covers two levels of visibility, each gated by its own [Dashboard permission](/platform-management/user-permissions#user-permissions-in-the-tyk-dashboard-api):
+
+- **Traffic Analytics** (`analytics:read`): graphs and breakdowns of request volume, error rates, and latency, sliced by dimensions such as API, access key, or OAuth client.
+- **Log Browser** (`log:read`): inspect individual requests and responses.
+
+This data comes from traffic logs generated by Tyk Gateway for every request, delivered to Tyk Dashboard's persistent storage by [Tyk Pump](/api-management/tyk-pump), not by OpenTelemetry (OTel). This is true regardless of how far you've adopted OTel elsewhere: OTel traces and metrics export to external observability backends, but they don't feed Tyk Dashboard's own UI.
+
+### Two Kinds of Data
+
+Traffic Analytics and the Log Browser need different data, and can be enabled independently of each other:
+
+| Dashboard Feature | Needs |
+| :-- | :-- |
+| Traffic Analytics | Aggregated analytics: hourly summaries computed from traffic logs |
+| Log Browser | Traffic logs: the full detail of each request |
+
+Aggregated analytics is cheaper to store and query, since it's summarized, while traffic logs preserve full request detail at the cost of storage volume. Many deployments enable both.
+
+### How Aggregation Works
+
+Aggregation calculates hourly analytics from traffic logs, grouped into a fixed set of dimensions, offloading this processing from Tyk Dashboard and reducing storage compared to keeping every traffic log:
+
+| Dashboard Screen | Aggregated By | Field |
+| :-- | :-- | :-- |
+| [Activity by API](#activity-by-api) | API proxy | [`api_id`](/api-management/logs/traffic-logs#param-api-id) |
+| [Activity by Endpoint](#activity-by-endpoint) | API endpoint | [`track_path`](/api-management/logs/traffic-logs#param-track-path) |
+| [Activity by Errors](#activity-by-error) | HTTP status code | [`response_code`](/api-management/logs/traffic-logs#param-response-code) |
+| [Activity by Key](#activity-by-key) | Client access key or token | [`api_key`](/api-management/logs/traffic-logs#param-api-key) |
+| [Traffic per OAuth Client](#activity-by-oauth-client) | OAuth client | [`oauth_id`](/api-management/logs/traffic-logs#param-oauth-id) |
+| [Activity by Location](#activity-by-location) | Client geographic location | [`geo`](/api-management/logs/traffic-logs#param-geo) |
+| n/a | API version | [`api_version`](/api-management/logs/traffic-logs#param-api-version) |
+
+`track_path` decides whether an endpoint is broken out individually in the Activity by Endpoint breakdown above; see [Controlling Which Endpoints Are Tracked](#controlling-which-endpoints-are-tracked) below for what sets it.
+
+Additional [custom aggregation](#custom-aggregation-tags) is also supported for users requiring data aggregated by different dimensions.
+
+### Pre-Computed vs Live Aggregation
+
+An Aggregate Pump is not the only way to get this aggregated data. Tyk Dashboard can also compute it itself: on every request to a Traffic Analytics screen, live, it runs the equivalent aggregation directly against the traffic log collection or table (a MongoDB aggregation pipeline, or a SQL query), and discards the result once the screen has rendered.
+
+Which of the two Tyk Dashboard uses is controlled by a single setting, [`enable_aggregate_lookups`](/tyk-dashboard/configuration#enable_aggregate_lookups):
+
+- `true`: Tyk Dashboard reads pre-computed aggregated analytics, written by an [Aggregate Pump](/api-management/dashboard-analytics/control-plane-pumps#choosing-a-pump-type).
+- `false` (the default): Tyk Dashboard computes the aggregation live instead, regardless of whether an Aggregate Pump is deployed and running; any aggregated analytics it computes and stores go unread.
+
+Live computation is a legitimate way to run Tyk Dashboard, and needs no extra pump configuration. But it has a cost:
+
+- It runs inside Tyk Dashboard itself, competing for the same CPU and database resources, rather than on a dedicated process built for this job (Tyk Pump). This can make Traffic Analytics screens feel slower to load, especially at higher traffic volumes or with several users viewing the Dashboard UI at once.
+- It repeats the same aggregation on every screen load, rather than once per hour, so the cost grows with the volume of traffic logs it has to scan.
+
+Deploying an Aggregate Pump and setting `enable_aggregate_lookups: true` is the recommended approach. It also means you can [cap or evict old traffic logs](/api-management/dashboard-analytics/analytics-storage-management) without losing the historical data behind these screens, since the aggregated summaries are preserved separately.
+
+<Note>
+For MCP proxy traffic, there's no working live fallback: live computation has no MCP-specific aggregation logic. If you're using [MCP Analytics](/ai-management/mcp-gateway/mcp-analytics), running an MCP Aggregate Pump with `enable_aggregate_lookups: true` is required, not just recommended.
+</Note>
+
+<Note>
+`enable_aggregate_lookups` doesn't apply to the **Activity by Graph** screen. That screen is fed by a dedicated `tyk_graph_aggregated` table, written by the [SQL GraphQL Aggregate Pump](/api-management/dashboard-analytics/control-plane-pumps#sql-graphql-aggregate-pump), which Tyk Dashboard's Postgres driver always queries directly. There's no live-computation fallback and no config flag for this screen, and it's PostgreSQL-only.
+</Note>
+
+## Where the Data Comes From
+
+Tyk Gateway generates a traffic log for every request and writes it to Redis. See [Traffic Logs](/api-management/logs/traffic-logs) for how and when these are generated, and the full field reference.
+
+## What Data Is Captured
+
+The [Traffic Log Field Reference](/api-management/logs/traffic-logs#traffic-log-field-reference) documents every field. The rest of this section covers what specifically affects Dashboard Analytics: per-endpoint tracking, detailed recording, and custom tags.
+
+### Controlling Which Endpoints Are Tracked
+
+By default, only some endpoints are broken out individually in the per-endpoint aggregates: Activity by Endpoint, and the per-endpoint breakdowns nested within Activity by Key and Traffic per OAuth Client. Which ones depends on the `track_path` field; see [Controlling Which Endpoints Are Tracked](/api-management/logs/traffic-logs#controlling-which-endpoints-are-tracked) on the Traffic Logs page for what sets it.
+
+- Endpoints with Track Endpoint enabled get `track_path: true`, and appear individually in these breakdowns.
+- Endpoints without it get `track_path: false`. Their traffic is excluded from these per-endpoint breakdowns specifically, but still counted in every other aggregate dimension: API totals, error codes, API versions, key/OAuth-client counts, geo, and tags.
+
+Set `track_all_paths: true` on an Aggregate Pump to override this and include every endpoint in these breakdowns, regardless of whether Track Endpoint is enabled on it.
+
+<Note>
+Track Endpoint only affects this aggregated per-endpoint breakdown. It has no effect on traffic logs or the Log Browser.
+</Note>
+
+### Detailed Recording
+
+Detailed recording, [configured at the Gateway](/api-management/logs/traffic-logs#detailed-recording), includes the full request and response, in wire format and base64-encoded, in the traffic log's `raw_request` and `raw_response` fields. Enabling it significantly increases record size and storage requirements; Tyk Cloud users are subject to the subscription's storage quota.
+
+### Custom Aggregation Tags
+
+Aggregation groups traffic logs by a fixed set of [standard fields](#how-aggregation-works). When those don't capture the dimension you care about, for example when several sub-accounts or environments share a single API key so the standard `api_key` aggregation can't separate them, Tyk Gateway can [tag traffic logs](/api-management/logs/traffic-logs#custom-tags) with the value of any HTTP request header, such as `X-Account-ID`. Tyk Pump's aggregate pumps then compute an hourly aggregate for each distinct tag value observed, the same way they do for the standard fields.
+
+Because every distinct tag value gets its own aggregate bucket, tagging a header whose value is unique per request, such as a timestamp or request ID, creates one bucket per request: no aggregation benefit, just storage growth. Tyk Pump logs a warning if it detects this happening.
+
+You might also tag a header you never intended to aggregate at all, for example a request ID useful for finding one specific transaction in the Log Browser, but meaningless as an aggregate dimension.
+
+In both cases, you can add the tag, or its prefix, to the aggregate pump type's `ignore_tag_prefix_list` setting. This only affects aggregation: the tag itself is still recorded on the traffic log and remains visible in the Log Browser either way.
+
+**Viewing the Aggregated Data**
+
+In the Tyk Dashboard UI, use the **filter by tag** option on the [API Activity Dashboard](#api-activity-dashboard) to see the aggregate graphs for a specific tag value. Programmatically, pass the tag as a `tags` parameter to the [Dashboard API](/tyk-dashboard-api)'s analytics endpoints.
+
+### GraphQL-Specific Detail
+
+Traffic logs for GraphQL APIs carry additional fields; see [GraphQL Fields](/api-management/logs/traffic-logs#graphql-fields) on the Traffic Logs page. This data is not currently surfaced in Tyk Dashboard; it's stored for export to external tools. See the Mongo GraphQL Pump and SQL GraphQL Pump sections of [Control Plane Pumps](/api-management/dashboard-analytics/control-plane-pumps#mongodb) for configuration.
+
+### MCP-Specific Detail
+
+Traffic logs for MCP proxy requests carry additional fields; see [MCP Fields](/api-management/logs/traffic-logs#mcp-fields) on the Traffic Logs page. See [MCP Analytics](/ai-management/mcp-gateway/mcp-analytics) for how Tyk Dashboard surfaces this data.
+
+## How Data Reaches Tyk Dashboard
+
+How that data actually reaches Tyk Dashboard depends on your deployment topology. Tyk Gateway's side of the job, generating the traffic log and writing it to Redis, is identical either way; what differs is what reads it next.
+
+In a combined control and data plane (the `tyk-stack` chart, no Tyk MDCB), Tyk Pump reads directly from that Redis instance and writes straight to the persistent storage (MongoDB or SQL), forwarding traffic logs, aggregated analytics, or both, in parallel:
+
+```mermaid
+graph TD
+    A[Client Request] -->|Request received| B[Tyk Gateway]
+    B -->|Forward request| U[Upstream Service]
+    B -->|Generate Traffic Log| C[Redis]
+    C -->|Tyk Pump reads traffic logs| D[Tyk Pump]
+    D -->|Write traffic logs| E[Persistent Storage]
+    D -->|Compute and write aggregated analytics| E
+```
+
+In a distributed deployment, with separate control and data planes connected via Tyk MDCB, the Hybrid Pump (the pump type that runs on each data plane) reads from its own local Redis and forwards the data to Tyk MDCB instead, which then writes it to the persistent storage in the control plane, either using its own built-in writer or by forwarding it via a Redis queue to a Control Plane Pump:
+
+```mermaid
+graph TD
+    A[Client Request] -->|Request received| B[Tyk Gateway]
+    B -->|Forward request| U[Upstream Service]
+    B -->|Generate Traffic Log| C[Local Redis]
+    C -->|Hybrid Pump reads traffic logs| D[Hybrid Pump]
+    D -->|Forward traffic logs or aggregated data| M[Tyk MDCB]
+    M -->|Write directly| E[Persistent Storage]
+    M -->|Forward via Redis queue| F[Control Plane Pump]
+    F -->|Write| E
+```
+
+See [Data Plane Pump](/api-management/dashboard-analytics/data-plane-pump) for that mechanism in full, including which of the two paths applies to traffic logs versus aggregated analytics.
+
+Both paths write to the same MongoDB or SQL collections that Tyk Dashboard reads from.
+
+## Storage Backends
+
+Whichever topology you use, Tyk Pump ultimately writes traffic logs and aggregated analytics into either MongoDB or SQL (PostgreSQL or MySQL), and Tyk Dashboard reads from that same database.
+
+- MongoDB stores each kind of data, traffic logs and aggregated analytics, in its own collection, and can optionally split traffic logs into a separate collection per Organisation.
+- SQL also stores each kind of data in its own table, but has no per-Organisation split: every Organisation's rows share the same table, distinguished by an indexed `org_id` column.
+
+See [Control Plane Pumps](/api-management/dashboard-analytics/control-plane-pumps#choosing-a-pump-type) for the specific pump types and configuration for each (or [Data Plane Pump](/api-management/dashboard-analytics/data-plane-pump) if your control and data planes are separate).
+
+Tyk Dashboard's own configuration file has a `storage` section, with `analytics` and `logs` sub-sections used to connect it to those same databases; see the [Tyk Dashboard configuration reference](/tyk-dashboard/configuration#storage) for the full field list, and [Database Management](/planning-for-production/database-settings) for production sizing guidance.
+
+For guidance on managing the size of that stored data over time, see [Analytics Storage Management](/api-management/dashboard-analytics/analytics-storage-management).
+
+## Traffic Analytics
+
+The Tyk Dashboard provides a full set of analytics functions and graphs that you can use to segment and view your API traffic and activity. The Dashboard offers a great way for you to debug your APIs and quickly pin down where errors might be cropping up and for which clients.
+
+[User Owned Analytics](/platform-management/user-permissions), introduced in Tyk v5.1, can be used to limit the visibility of aggregate statistics to users when API Ownership is enabled. Due to the way that the analytics data are aggregated, not all statistics can be filtered by API and so may be inaccessible to users with the Owned Analytics permission.
+
+
+<Note>
+For the Tyk Dashboard's analytics functionality to work, you must configure both per-request and aggregated pumps for the database platform that you are using. For more details see the [Control Plane Pumps](/api-management/dashboard-analytics/control-plane-pumps#choosing-a-pump-type) section.
+</Note>
+
+
+
+## Analyzing API Traffic Activity
+
+### API Activity Dashboard
+
+The first screen (and main view) of the Tyk Dashboard will show you an overview of the aggregate usage of your APIs, this view includes the number of hits, the number of errors and the average latency over time for all of your APIs as an average:
+
+<img src="/img/2.10/analytics_overview2.png" alt="API Activity Dashboard" />
+
+You can toggle the graphs by clicking the circular toggles above the graph to isolate only the stats you want to see.
+
+Use the Start and End dates to set the range of the graph, and the version drop-down to select the API and version you wish to see traffic for.
+
+You can change the granularity of the data by selecting the granularity drop down (in the above screenshot: it is set to “Day”).
+
+The filter by tag option, in a graph view, will enable you to see the graph filtered by any tags you add to the search.
+
+Below the aggregate graph, you’ll see an error breakdown and endpoint popularity chart. These charts will show you the overall error type (and code) for your APIs as an aggregate and the popularity of the endpoints that are being targeted by your clients:
+
+<img src="/img/2.10/error_breakdown.png" alt="Error Breakdown and Endpoints" />
+
+
+<Note>
+From Tyk v5.1 (and LTS patches v4.0.14 and v5.0.3) the Error Breakdown and Endpoint Popularity charts will not be visible to a user if they are assigned the [Owned Analytics](/platform-management/user-permissions) permission.
+</Note>
+
+
+### Activity Logs
+
+When you look through your Dashboard and your error breakdown statistics, you'll find that you will want to drill down to the root cause of the errors. This is what the Log Browser is for.
+
+The Log Browser will isolate individual log lines in your analytics data set and allow you to filter them by:
+
+* API Name
+* Token ID (hashed)
+* Errors Only
+* By Status Code
+
+You will be presented with a list of requests, and their metadata:
+
+<img src="/img/2.10/log_browser.png" alt="Log Viewer" />
+
+Click a request to view its details.
+
+<img src="/img/2.10/log_browser_selected.png" alt="Log Viewer Details" />
+
+#### Self-Managed Installations Option
+
+In an Self-Managed installation, if you have request and response logging enabled, then you can also view the request payload and the response if it is available.
+To enable request and response logging, please take a look at [useful debug modes](/api-management/troubleshooting-debugging#capturing-detailed-logs) .
+
+**A warning on detailed logging:** This mode generates a very large amount of data, and that data exponentially increases the size of your log data set, and may cause problems with delivering analytics in bulk to your MongoDB instances. This mode should only be used to debug your APIs for short periods of time.
+
+
+
+### Activity by API
+
+To get a tabular view of how your API traffic is performing, you can select the **Activity by API** option in the navigation and see a tabular view of your APIs. This table will list out your APIs by their traffic volume and you'll be able to see when they were last accessed:
+
+<img src="/img/2.10/traffic_api.png" alt="Activity per API" />
+
+You can use the same range selectors as with the Dashboard view to modify how you see the data. However, granularity and tag views will not work since they do not apply to a tabulated view.
+
+If you select an API name, you will be taken to the drill-down view for that specific API, here you will have a similar Dashboard as you do with the aggregate API Dashboard that you first visit on log in, but the whole view will be constrained to just the single API in question:
+
+<img src="/img/2.10/average_use_api.png" alt="Traffic per API: CLosed graph" />
+
+You will also see an error breakdown and the endpoint popularity stats for the API:
+
+<img src="/img/2.10/error_breakdown_api.png" alt="API error breakdown pie chart" />
+
+Tyk will try to normalize endpoint metrics by identifying IDs and UUIDs in a URL string and replacing them with normalized tags, this can help make your analytics more useful. It is possible to configure custom tags in the configuration file of your Tyk Self-Managed or Multi-Cloud installation.
+
+
+<Note>
+From Tyk v5.1 (and LTS patches v4.0.14 and v5.0.3) the Error Breakdown and Endpoint Popularity charts will not be visible to a user if they are assigned the [Owned Analytics](/platform-management/user-permissions) permission.
+</Note>
+
+
+### Activity by Key
+
+You will often want to see what individual keys are up to in Tyk, and you can do this with the **Activity per Key** section of your analytics Dashboard. This view will show a tabular layout of all keys that Tyk has seen in the range period and provide analytics for them:
+
+<img src="/img/dashboard/usage-data/test_alias_key.png" alt="Activity per Token" />
+
+You'll notice in the screenshot above that the keys look completely different to the ones you can generate in the key designer (or via the API), this is because, by default, Tyk will hash all keys once they are created in order for them to not be snooped should your key-store be breached.
+
+This poses a problem though, and that is that the keys also no longer have any meaning as analytics entries. You'll notice in the screenshot above, one of the keys is appended by the text **TEST_ALIAS_KEY**. This is what we call an Alias, and you can add an alias to any key you generate and that information will be transposed into your analytics to make the information more human-readable.
+
+The key `00000000` is an empty token, or an open-request. If you have an API that is open, or a request generates an error before we can identify the API key, then it will be automatically assigned this nil value.
+
+If you select a key, you can get a drill down view of the activity of that key, and the errors and codes that the token has generated:
+
+<img src="/img/2.10/traffic_by_key.png" alt="Traffic activity by key graph" />
+
+<img src="/img/2.10/error_by_key.png" alt="Errors by Key" />
+
+(The filters in this view will not be of any use except to filter by API Version).
+
+
+<Note>
+From Tyk v5.1 (and LTS patches v4.0.14 and v5.0.3) the <b>Traffic per Key</b> screen will not be visible to a user if they are assigned the [Owned Analytics](/platform-management/user-permissions) permission.
+</Note>
+
+
+### Activity by Endpoint
+
+To get a tabular view of how your API traffic is performing at the endpoint level, you can select the Activity by Endpoint option in the navigation and see a tabular view of your API endpoints. This table will list your API endpoints by their traffic volume and you’ll be able to see when they were last accessed:
+
+<img src="/img/dashboard/analytics/endpoint_popularity.png" alt="Activity by endpoint" />
+
+Not every endpoint necessarily appears here: see [Controlling Which Endpoints Are Tracked](#controlling-which-endpoints-are-tracked) for what controls that.
+
+### Activity by Graph
+
+The **Activity by Graph** page provides analytics for your [GraphQL APIs](/api-management/graphql) (Universal Data Graph / UDG). It allows you to monitor and analyze GraphQL-specific traffic through the following charts and tables:
+
+* **Popularity by Graph API**: Displays the most popular GraphQL APIs based on request volume.
+* **Errors by Graph API**: Shows the error rates and distribution across your GraphQL APIs.
+* **All Graph APIs**: A comprehensive table listing all configured GraphQL APIs and their key metrics.
+
+{/* TODO: Add screenshots of the Activity by Graph dashboard */}
+
+### Activity by Location
+
+Tyk will attempt to record GeoIP based information based on your inbound traffic. This requires a MaxMind IP database to be available to Tyk and is limited to the accuracy of that database.
+
+You can view the overview of what the traffic breakdown looks like per country, and then drill down into the per-country traffic view by selecting a country code from the list:
+
+<img src="/img/2.10/geographic_dist.png" alt="Geographic Distribution" />
+
+
+<Note>
+From Tyk v5.1 (and LTS patches v4.0.14 and v5.0.3) the <b>Geographic Distribution</b> screen will not be visible to a user if they are assigned the [Owned Analytics](/platform-management/user-permissions) permission.
+</Note>
+
+
+**MaxMind Settings**
+
+To use a MaxMind database, see [MaxMind Database Settings](/tyk-oss-gateway/configuration#analytics_config-enable_geo_ip) in the Tyk Gateway Configuration Options.
+
+### Activity by MCP
+
+The **Activity by MCP** page provides analytics for your Model Context Protocol (MCP) [proxies and primitives](/ai-management/mcp-gateway/managing-proxies). It allows you to track and monitor MCP-specific traffic through the following charts and tables:
+
+* **Activity per MCP**: Displays request volumes and traffic trends across your configured MCP servers.
+* **Errors by MCP**: Tracks error rates and distribution across different MCP servers.
+* **Primitives Traffic**: Shows the overall traffic volume handled by your MCP primitives (tools, resources, and prompts).
+* **Most Used Primitives**: Identifies the most frequently invoked primitives.
+* **Most Failing Primitives**: Highlights the primitives with the highest failure rates.
+* **Slowest Primitives**: Measures latency and identifies the slowest-performing primitives.
+* **Error Status Codes by Primitive**: Breaks down error responses by HTTP status codes for each primitive.
+
+For more information, see [MCP Analytics](/ai-management/mcp-gateway/mcp-analytics).
+
+![Activity by MCP](/img/ai-management/activity-by-mcp.png)
+
+### Activity by Error
+
+The error overview page limits the analytics down to errors only, and gives you a detailed look over the range of the number of errors that your APIs have generated. This view is very similar to the Dashboard, but will provide more detail on the error types:
+
+<img src="/img/2.10/errors_overview.png" alt="Error Overview" />
+
+
+<Note>
+From Tyk v5.1 (and LTS patches v4.0.14 and v5.0.3) the Errors by Category data will not be visible to a user if they are assigned the [Owned Analytics](/platform-management/user-permissions) permission.
+</Note>
+
+
+### Activity by OAuth Client
+
+Traffic statistics are available on a per OAuth Client ID basis if you are using the OAuth mode for one of your APIs. To get a breakdown view of traffic aggregated to a Client ID, you will need to go to the **System Management -> APIs** section and then under the **OAuth API**, there will be a button called **OAuth API**. Selecting an OAuth client will then show its aggregate activity
+
+<img src="/img/dashboard/system-management/oauthClientNav.png" alt="OAuth Client" />
+
+In the API list view – an **OAuth Clients** button will appear for OAuth enabled APIs, use this to browse to the Client ID and the associated analytics for that client ID:
+
+<img src="/img/dashboard/system-management/oauthClientAnalytics.png" alt="OAuth Client Analytics Data" />
+
+You can view the analytics of individual tokens generated by this Client ID in the regular token view.
+
+
+<Note>
+From Tyk v5.1 (and LTS patches v4.0.14 and v5.0.3) the Traffic per OAuth Client ID charts will not be visible to a user if they are assigned the [Owned Analytics](/platform-management/user-permissions) permission.
+</Note>
diff --git a/api-management/dashboard-analytics/analytics-storage-management.mdx b/api-management/dashboard-analytics/analytics-storage-management.mdx
new file mode 100644
index 0000000000..ad99c12525
--- /dev/null
+++ b/api-management/dashboard-analytics/analytics-storage-management.mdx
@@ -0,0 +1,174 @@
+---
+title: "Analytics Storage Management"
+description: "Manage the size of the persistent analytics storage, with capped MongoDB collections, TTL indexes, and SQL table sharding."
+keywords: "Tyk Pump, Tyk Dashboard, Capping, TTL, MongoDB, SQL, Table Sharding"
+sidebarTitle: "Analytics Storage Management"
+---
+
+## Overview
+
+Tyk Pump writes two different kinds of data to the Control Plane's persistent storage, from which it's used by Tyk Dashboard's Traffic Analytics and Log Browser, and they behave very differently when it comes to storage growth.
+
+- **Traffic logs** are one record per request, stored close to verbatim, so they grow unbounded: proportional to request volume, with no built-in limit.
+- **Aggregated analytics**, computed by the Aggregate pumps, roll traffic logs up into per-hour (or per-minute) buckets by dimensions such as API and key, so their size is bounded by the number of tracked endpoints and time buckets rather than by request volume; they stay small even at high traffic.
+
+This page offers strategies for managing traffic logs; aggregated analytics don't need it.
+
+As a guideline, every 3 million requests generates roughly 1GB of traffic log data. [Detailed recording](/api-management/logs/traffic-logs#detailed-recording), which captures the full request and response body on every record, multiplies this considerably, and is the single biggest driver of storage growth where it's enabled.
+
+This creates two different problems, not one:
+
+- **Persistent storage** accumulates every record you don't evict, so it needs active management over time, covered below.
+- **Redis** is different: Tyk Pump continuously reads and purges these records, so the analytics buffer doesn't grow indefinitely under normal operation. Its risk is one of throughput instead: a high request rate, or Tyk Pump falling behind, can spike Redis memory and compete with the request path for resources. See [Separate Analytics Storage](/planning-for-production/database-settings#separate-analytics-storage) for information on isolating analytics traffic onto its own Redis instance.
+
+## Managing Analytics Storage
+
+How you control the size of your analytics store depends on which type of storage is in use.
+
+### MongoDB
+
+The techniques on this page target `tyk_analytics`, the collection the [Standard Mongo Pump](/api-management/dashboard-analytics/control-plane-pumps#standard-mongo-pump) writes every traffic log into, one document per request, shared across all Organisations by default. If you're using the [Per-Organisation Mongo Pump](/api-management/dashboard-analytics/control-plane-pumps#per-organisation-mongo-pump) instead, each Organisation gets its own collection, `z_tyk_analyticz_{ORG_ID}`; apply the same techniques to each one individually.
+
+MongoDB gives you two independent ways to bound the size of these collections: cap by size, or evict records after a fixed time with a TTL index. The two are mutually exclusive: MongoDB won't create a TTL index on a collection that's already capped.
+
+#### Capped Collections
+
+You can make use of MongoDB's [capped collection](https://docs.mongodb.com/manual/core/capped-collections/) concept. A capped collection acts as a FIFO buffer: once it reaches its size limit, new records replace the oldest ones rather than the collection continuing to grow. This has no effect on Tyk Dashboard's Traffic Analytics graphs if you're using [pre-computed aggregation](/api-management/dashboard-analytics#pre-computed-vs-live-aggregation); if you're relying on live aggregation instead, capping this collection also shortens the historical window available to those screens.
+
+<Note>
+Capped collections are not supported on Amazon DocumentDB. See the [DocumentDB documentation](https://docs.aws.amazon.com/documentdb/latest/developerguide/mongo-apis.html) for details.
+</Note>
+
+To have Tyk Pump create a capped collection for you, add the following to the `mongo.meta` object in `pump.conf`:
+
+```json
+{
+  "pumps": {
+    "mongo": {
+      "type": "mongo",
+      "meta": {
+        "collection_cap_enable": true,
+        "collection_cap_max_size_bytes": 1048577
+      }
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `collection_cap_enable` | `false` | If `true`, caps the collection at `collection_cap_max_size_bytes`, turning it into a FIFO buffer. |
+| `collection_cap_max_size_bytes` | 5GB | Maximum collection size, in bytes, when `collection_cap_enable` is `true`. |
+
+Tyk Pump only does this for a collection that doesn't exist yet: on startup, if `tyk_analytics` already exists, Tyk Pump logs a warning and leaves it alone rather than risk data loss by capping it retroactively.
+
+<Note>
+The size value is in bytes. We recommend a value just under the amount of RAM on your machine.
+</Note>
+
+To convert an existing collection instead, use MongoDB's [convertToCapped](https://docs.mongodb.com/manual/reference/command/convertToCapped/) command directly:
+
+```javascript
+use tyk_analytics
+db.runCommand({"convertToCapped": "tyk_analytics", size: 100000});
+```
+
+If you're using the [Per-Organisation Mongo Pump](/api-management/dashboard-analytics/control-plane-pumps#per-organisation-mongo-pump), run the equivalent command for each Organisation's collection:
+
+```javascript
+db.runCommand({"convertToCapped": "z_tyk_analyticz_<org-id>", size: 100000});
+```
+
+#### TTL Indexes
+
+As an alternative to capping by size, you can configure MongoDB to delete documents automatically based on a TTL (Time To Live) index. A TTL index can be any date field in a document - once that field's value is in the past, the document will be deleted. This runs in the background, not instantly: MongoDB sweeps for expired documents roughly once a minute.
+
+<Note>
+Unlike capped collections, Tyk never creates a TTL index for you, even on a brand-new collection. It's always a manual step, and you need to repeat it for every collection this applies to (each Organisation's collection, if you're using the Per-Organisation Mongo Pump).
+</Note>
+
+<Note>
+If `tyk_analytics` is already a capped collection, MongoDB won't create the TTL index, and you'll see errors in the MongoDB logs. See the [MongoDB TTL documentation](https://docs.mongodb.com/manual/tutorial/expire-data/) for details.
+</Note>
+
+<Note>
+Azure CosmosDB (`mongo_db_type: 2`) does not support the `expireAt` TTL index; Tyk Pump skips creating it on that target automatically.
+</Note>
+
+The traffic log contains two fields that can be used for the TTL index:
+
+- `timestamp` which is set with the current time when the log record is created
+- `expireAt` which Tyk Gateway calculates based on a retention period set in the Organisation Key; if no retention period is configured, it defaults to 100 years from creation, so the record effectively never expires via this index
+
+**Creating the TTL Index**
+
+You create a TTL index the same way as any other MongoDB index, with:
+
+```javascript
+db.<collection>.createIndex(<field and sort direction>, <options>)
+```
+
+What makes it a TTL index specifically is adding `expireAfterSeconds` to `<options>`.
+
+**Setting a Shared TTL for All Traffic Logs**
+
+If you want the same lifetime for all traffic logs, then use the `timestamp` field for the index, and set `expireAfterSeconds` to the required TTL, in seconds.
+
+This example keeps the entries in the collection for 30 days (2,592,000 seconds) before deletion:
+
+```javascript
+db.tyk_analytics.createIndex( { "timestamp": 1 }, { expireAfterSeconds: 2592000 } )
+```
+
+**Setting Different TTLs per Organisation**
+
+If the collection contains records created for different Organisations that need different retention periods, we take a different approach.
+
+<Note>
+If you're using the [Per-Organisation Mongo Pump](/api-management/dashboard-analytics/control-plane-pumps#per-organisation-mongo-pump), each Organisation already has its own collection. Apply the shared-TTL approach above to each collection individually.
+</Note>
+
+Use the `expireAt` field for the index and set `expireAfterSeconds` to `0`, so MongoDB deletes each document as soon as its own `expireAt` value is in the past:
+
+```javascript
+db.tyk_analytics.createIndex( { "expireAt": 1 }, { expireAfterSeconds: 0 } )
+```
+
+This configures MongoDB to delete the traffic logs once they expire - but you still need to configure Tyk Gateway to set an appropriate retention period in `expireAt` when creating the log.
+
+The value set in `expireAt` combines the creation timestamp with the `data_expires` value taken from the Organisation Key. The Organisation Key is created using the Tyk Gateway API's [Create an Organisation Key](https://tyk.io/docs/api-reference/organisation-quotas/create-an-organisation-key) endpoint (`POST /tyk/org/keys/{org-id}`), passing a payload such as:
+
+```json
+{
+  "org_id": "{your-org-id}",
+  "data_expires": 86400
+}
+```
+
+Traffic logs generated for this Organisation will be retained in MongoDB for 24 hours (86400 seconds).
+
+### SQL
+
+Unlike MongoDB, the SQL pumps (PostgreSQL and MySQL) have no capped-collection or TTL-index equivalent: there's no built-in way to have Tyk Pump automatically evict old rows. The closest tool is table sharding, which doesn't cap anything by itself, but makes it practical to manage size yourself by dropping old dated tables instead of running slow `DELETE` queries against one huge table.
+
+#### Table Sharding
+
+By default, every SQL pump type stores all its records in one table, which becomes slow to query or prune as it grows. Setting `table_sharding: true` switches to one table per day instead, using the pump's table name as a prefix, for example `tyk_analytics_20230327`.
+
+You must ensure that the equivalent `table_sharding` configuration for each relevant section of Tyk Dashboard's `storage` configuration (`main`, `analytics`, `logs`, `uptime`) matches.
+
+**Maintaining Consistency**
+
+When Tyk Pump starts, it checks its sharded tables against the current data model (traffic log schema) and adds any missing columns, for example following an update that adds to the schema; it never drops or renames existing columns.
+
+When using table sharding, by default it only updates the schema for the current day's table, leaving older dated tables exactly as they were when created. Setting `migrate_sharded_tables: true` automatically scans the database for every table matching this pump's prefix on startup, updating the schema for any that are out of date. If a table fails to migrate, Tyk Pump logs a warning and continues.
+
+<Warning>
+This scan-and-update runs on every Pump restart, not just once, and it touches every table matching this pump's prefix.
+
+In a deployment with months or years of daily-sharded tables, that can mean scanning and potentially altering hundreds or thousands of tables. Startup can take a long time, and Tyk Pump won't begin processing analytics again until it completes.
+
+The sustained read and write load this puts on the database can also affect other services sharing it, not just Tyk Pump's own performance.
+
+Only enable `migrate_sharded_tables` when you actually need it, such as the first restart after a Tyk Pump upgrade that changed the schema, then turn it back off.
+</Warning>
diff --git a/api-management/dashboard-analytics/control-plane-pumps.mdx b/api-management/dashboard-analytics/control-plane-pumps.mdx
new file mode 100644
index 0000000000..c161b087da
--- /dev/null
+++ b/api-management/dashboard-analytics/control-plane-pumps.mdx
@@ -0,0 +1,517 @@
+---
+title: "Control Plane Pumps"
+description: "Configure the Tyk Pump types that write traffic logs and aggregated analytics into Tyk Dashboard's MongoDB or SQL storage."
+keywords: "Control Plane Pumps, Tyk Pump, Dashboard Analytics, Log Browser, Mongo Pump, SQL Pump, Aggregate Pump, GraphQL, MCP"
+sidebarTitle: "Control Plane Pumps"
+---
+
+## Introduction
+
+This page covers the [Tyk Pump types](/api-management/tyk-pump#pump-type-catalog) that write traffic logs and aggregated analytics into Tyk Dashboard's persistent storage (MongoDB or SQL): the pumps that ultimately feed Tyk Dashboard's Log Browser and Traffic Analytics screens.
+
+How you deploy these pumps depends on your deployment topology:
+
+- In a combined control and data plane, such as the `tyk-stack` chart, you configure them directly: Tyk Pump already has access to both Redis and the persistent storage.
+- In a distributed deployment, with separate control and data planes connected via Tyk MDCB, these same pump types are instead configured as the Control Plane Pump, running on the control plane, which receives data forwarded by the Hybrid Pump on each data plane. See [Data Plane Pump](/api-management/dashboard-analytics/data-plane-pump) for that mechanism.
+
+For an explanation of how traffic logging works in general, including detailed recording and aggregation, see the [Dashboard Analytics overview](/api-management/dashboard-analytics).
+
+For settings common to every pump type, such as `filters` and `timeout`, see [Common Pump Settings](/api-management/tyk-pump#common-pump-settings).
+
+## Choosing a Pump Type
+
+Tyk Pump implements separate pump types for MongoDB and SQL because of how differently the two store data.
+
+- MongoDB groups records into collections, so Tyk Pump has a separate pump type for each way of storing them: one collection holding every Organisation's traffic logs together, one collection per Organisation splitting traffic logs apart, and one collection holding aggregated analytics.
+- SQL databases store records as rows in a single table, so there's no equivalent to Mongo's "one collection per Organisation" pump type: every Organisation's rows live in the same table, distinguished by an indexed `org_id` column.
+
+The pump type that you should deploy depends on which Tyk Dashboard feature you want to populate and the protocol (REST, GraphQL, MCP) the traffic logs come from.
+
+For Tyk Dashboard's Traffic Analytics screens (Traffic Analytics graphs, Activity by Graph, Activity by MCP):
+
+| Protocol | MongoDB | SQL |
+| :-- | :-- | :-- |
+| REST | [`mongo-pump-aggregate`](#mongo-aggregate-pump) | [`sql_aggregate`](#sql-aggregate-pump) |
+| GraphQL | not available | [`sql-graph-aggregate`](#sql-graphql-aggregate-pump) (PostgreSQL only) |
+| MCP | [`mongo-mcp-aggregate`](#mongo-mcp-aggregate-pump) | [`sql-mcp-aggregate`](#sql-mcp-aggregate-pump) |
+
+For Tyk Dashboard's Log Browser:
+
+| Protocol | MongoDB | SQL |
+| :-- | :-- | :-- |
+| REST | [`mongo`](#standard-mongo-pump) (or [`mongo-pump-selective`](#per-organisation-mongo-pump), which splits Log Browser data into a separate collection per Organisation) | [`sql`](#standard-sql-pump) |
+| GraphQL | not available | not available |
+| MCP | not available | not available |
+
+For your own downstream querying:
+
+| Protocol | MongoDB | SQL |
+| :-- | :-- | :-- |
+| REST | already covered by [`mongo`](#standard-mongo-pump)/[`mongo-pump-selective`](#per-organisation-mongo-pump) above | already covered by [`sql`](#standard-sql-pump) above |
+| GraphQL | [`mongo-graph`](#mongo-graphql-pump) | [`sql-graph`](#sql-graphql-pump) |
+| MCP | [`mongo-mcp`](#mongo-mcp-pump) | [`sql-mcp`](#sql-mcp-pump) |
+
+These pumps write the data into a MongoDB collection or SQL table, where it's queryable by your own tooling. For REST, that's the same `mongo`/`mongo-pump-selective`/`sql` pump you're already running for the Log Browser; GraphQL and MCP need a dedicated pump instead, since the plain pumps either pass GraphQL through without the extra structured detail, or exclude MCP entirely. Tyk Dashboard itself doesn't read any of this back out, so you'll need your own tooling, such as a BI tool or a scheduled export job, connected directly to that database. This is different from the [External Data Sink Pumps](/api-management/tyk-pump#external-data-sink-pumps), which actively forward traffic logs to a separate third-party system such as Splunk or Kafka.
+
+## MongoDB
+
+Tyk Pump offers MongoDB pump types for REST, MCP proxy and GraphQL traffic. All share the same connection settings.
+
+The pumps are declared and configured as described in the [Tyk Pump configuration guide](/api-management/tyk-pump#declaring-pumps). Each pump to be deployed has its own entry in that configuration and has both [common](/api-management/tyk-pump#common-pump-settings) and specific configuration options. The specific config is held in the `meta` object - some of this is common, some is dependent on the specific pump as outlined in the following sections.
+
+### Common Mongo Meta
+
+Every Mongo pump type on this page accepts these fields in `meta`, in addition to whatever is listed in its own section below. Each pump's own snippet only shows its additional fields; combine them with these to build a complete `meta` block.
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `mongo_url` | - | Full connection URL to your MongoDB instance, including credentials and database name. Can point at a cluster. |
+| `mongo_use_ssl` | `false` | Enables a TLS connection to MongoDB. |
+| `mongo_ssl_insecure_skip_verify` | `false` | Allows self-signed certificates when `mongo_use_ssl` is enabled. |
+| `mongo_ssl_allow_invalid_hostnames` | `false` | Skips the TLS hostname check, useful when connecting through an SSH tunnel; the rest of TLS verification still applies. |
+| `mongo_ssl_ca_file` | - | Path to a PEM file containing trusted root certificates. |
+| `mongo_ssl_pem_keyfile` | - | Path to a PEM file containing both the client certificate and private key, for mutual TLS. |
+| `mongo_db_type` | `0` | Target database: `0` for MongoDB, `1` for Amazon DocumentDB, `2` for CosmosDB. |
+| `mongo_session_consistency` | `Strong` | Session consistency mode: `strong`, `monotonic`, or `eventual`. |
+| `omit_index_creation` | `false` | If `true`, Tyk Pump never creates indexes. If `false`, it creates them only if the collection doesn't already exist, except on Amazon DocumentDB or Azure CosmosDB, where indexes are always (re-)created, since checking for an existing collection is unreliable on those platforms. |
+| `driver` | `mongo-go` | Underlying MongoDB driver: `mongo-go` (MongoDB v4+) or `mgo` (deprecated, MongoDB v4 and below). |
+| `mongo_direct_connection` | `false` | If `true`, connects only to the host given in `mongo_url` rather than discovering the rest of the cluster. Useful where network restrictions prevent discovery, such as SSH tunneling. |
+
+<Warning>
+Only set `mongo_ssl_insecure_skip_verify` to `true` for local development or testing.
+
+It disables all TLS certificate validation for the connection to MongoDB, not just the hostname check that `mongo_ssl_allow_invalid_hostnames` skips, so Tyk Pump can no longer verify it's actually talking to your MongoDB server.
+
+This exposes the connection to man-in-the-middle attacks, where an attacker intercepts or tampers with the analytics data in transit.
+
+If you need to connect to a MongoDB instance with a self-signed certificate in production, add that certificate to `mongo_ssl_ca_file` instead, so Tyk Pump can verify it properly.
+</Warning>
+
+### Standard Mongo Pump
+
+The `mongo` pump stores every individual traffic log as a separate document in one collection. It's the source for Tyk Dashboard's Log Browser in a single-Organisation deployment.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-mongo-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "mongo": {
+      "type": "mongo",
+      "meta": {
+        "collection_name": "tyk_analytics",         // required
+        "max_insert_batch_size_bytes": 10485760,
+        "max_document_size_bytes": 10485760,
+        "collection_cap_enable": false,
+        "collection_cap_max_size_bytes": 5368709120,
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `collection_name` | - | The collection to write to. Required; there's no default. Set this to `tyk_analytics` unless you're not using the Log Browser at all: Tyk Dashboard has no setting of its own for this name, and always queries `tyk_analytics` directly when `use_sharded_analytics` is `false`, so any other value here means Log Browser finds nothing. |
+| `max_insert_batch_size_bytes` | 10MB | Maximum size of a single insert batch (in bytes); larger batches are split into multiple inserts. |
+| `max_document_size_bytes` | 10MB | Maximum document size (in bytes); documents that would exceed this are skipped rather than written. |
+| `collection_cap_enable` | `false` | If `true`, caps the collection at `collection_cap_max_size_bytes`, turning it into a FIFO buffer. See [Analytics Storage Management](/api-management/dashboard-analytics/analytics-storage-management). |
+| `collection_cap_max_size_bytes` | 5GB | Maximum collection size, in bytes, when `collection_cap_enable` is `true`. |
+
+Because this collection grows with every request, especially with detailed recording enabled, it [should be capped](/api-management/dashboard-analytics/analytics-storage-management).
+
+**Tyk Dashboard Setting:** set [`use_sharded_analytics: false`](/tyk-dashboard/configuration#use_sharded_analytics) in the Tyk Dashboard configuration so that it queries the `tyk_analytics` collections to populate the Log Browser.
+
+### Per-Organisation Mongo Pump
+
+The `mongo-pump-selective` pump stores every individual traffic log as a separate document, in a collection called `z_tyk_analyticz_{ORG_ID}` (i.e. one collection per Organisation). It's the source for Tyk Dashboard's Log Browser in a multi-Organisation deployment, isolating each Organisation's data from the others.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-mongo-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "mongo-pump-selective": {
+      "type": "mongo-pump-selective",
+      "meta": {
+        "max_insert_batch_size_bytes": 10485760,
+        "max_document_size_bytes": 10485760,
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `max_insert_batch_size_bytes` | 10MB | Maximum size of a single insert batch; larger batches are split. |
+| `max_document_size_bytes` | 10MB | Maximum document size; oversized documents are skipped rather than written. |
+
+There's no `collection_name` field: the collection name is always computed per-Organisation. There's also no `collection_cap_*` support, so, unlike the [Standard Mongo Pump](#standard-mongo-pump), Tyk Pump can't cap these collections for you. Given the volume of individual documents, cap each Organisation's collection manually instead, using MongoDB's `convertToCapped` command; see [Analytics Storage Management](/api-management/dashboard-analytics/analytics-storage-management#capped-collections) for the exact command.
+
+**Tyk Dashboard Setting:** set [`use_sharded_analytics: true`](/tyk-dashboard/configuration#use_sharded_analytics) in the Tyk Dashboard configuration so that it queries `z_tyk_analyticz_{ORG_ID}` collections to populate the Log Browser.
+
+### Mongo Aggregate Pump
+
+The `mongo-pump-aggregate` pump computes analytics from traffic logs, aggregating hourly or per minute, and stores them in a collection called `z_tyk_analyticz_aggregate_{ORG_ID}` (i.e. one collection per Organisation). Tyk Dashboard's Traffic Analytics graphs are built on this aggregated analytics.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-mongo-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "mongo-pump-aggregate": {
+      "type": "mongo-pump-aggregate",
+      "meta": {
+        "use_mixed_collection": true,
+        "track_all_paths": false,
+        "ignore_tag_prefix_list": [],
+        "threshold_len_tag_list": 1000,
+        "store_analytics_per_minute": false,
+        "aggregation_time": 60,
+        "enable_aggregate_self_healing": false,
+        "ignore_aggregations": [],
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `use_mixed_collection` | `false` | If `true`, the pump also writes to the org-less `tyk_analytics_aggregates` collection, see note below. |
+| `track_all_paths` | `false` | If `true`, stores aggregated data for every endpoint rather than only [tracked endpoints](/api-management/dashboard-analytics#controlling-which-endpoints-are-tracked). |
+| `ignore_tag_prefix_list` | (none) | Prefixes of [custom aggregation tags](/api-management/dashboard-analytics#custom-aggregation-tags) to exclude from aggregation. |
+| `threshold_len_tag_list` | `1000` | Logs a warning if the number of distinct tag values in an aggregation exceeds this threshold. |
+| `store_analytics_per_minute` | `false` | If `true`, aggregates per minute instead of per hour. Takes precedence over `aggregation_time`. |
+| `aggregation_time` | `60` | Aggregation window, in minutes (1-60). Ignored if `store_analytics_per_minute` is `true`. |
+| `enable_aggregate_self_healing` | `false` | See [Self-Healing](#self-healing) below. |
+| `ignore_aggregations` | (none) | Dimensions to exclude from aggregation, to reduce document size. Valid values (case-insensitive): `APIID`, `Errors`, `Versions`, `APIKeys`, `OauthIDs`, `Geo`, `Tags`, `Endpoints`, `KeyEndpoint`, `OauthEndpoint`, `ApiEndpoint`. |
+
+Because it stores aggregated analytics, this collection needs minimal capping. If an API definition tags unique per-request headers, such as a `request_id`, aggregation creates one document per unique value and the collection can grow rapidly; avoid tagging unique headers where possible, or add them to `ignore_aggregations`.
+
+**Tyk Dashboard Setting:** this pump supplies the **API Usage Data** screens. Set [enable_aggregate_lookups: true](/tyk-dashboard/configuration#enable_aggregate_lookups) in the Tyk Dashboard configuration so it reads this pre-computed data, rather than computing it live from traffic logs on every request; see [Pre-Computed vs Live Aggregation](/api-management/dashboard-analytics#pre-computed-vs-live-aggregation) for the trade-off.
+
+<Note>
+Tyk Dashboard's [`use_sharded_analytics`](/tyk-dashboard/configuration#use_sharded_analytics) controls which collection(s) it queries. If `use_sharded_analytics: false`, you must set `use_mixed_collection: true` so the pump populates the shared collection `tyk_analytics_aggregates`, which Dashboard always reads in this mode. If `use_sharded_analytics: true`, ordinary per-Organisation queries read the per-Organisation collections, which the pump populates regardless of `use_mixed_collection`, but a superuser session not attached to a single Organisation still falls back to the shared collection, so set `use_mixed_collection: true` too if you need those cross-org views to show data.
+</Note>
+
+#### Self-Healing
+
+MongoDB, DocumentDB, and CosmosDB all cap individual document size (16MB for standard MongoDB). The Mongo Aggregate Pump writes one document per `aggregation_time` period, and if that document grows past the limit before the period ends, the database rejects further writes for that period.
+
+The pump's self-healing feature solves this problem by automatically adjusting the aggregation window for each document, resulting in more, smaller documents for a given time period. The performance trade-off is that this can increase the query complexity and load for Tyk Dashboard when it reads and consolidates this data to render the Dashboard Analytics graphs.
+
+Set `enable_aggregate_self_healing: true` to trigger self-healing: when a write fails because the document is too large, Tyk Pump creates a new document immediately and halves `aggregation_time` for subsequent periods, reducing the chance of hitting the limit again. This can repeat, halving `aggregation_time` further each time the limit is hit, down to a minimum of 1 minute. For example, with `aggregation_time: 50`, if the document reaches 16MB, Tyk Pump starts a new document and reduces `aggregation_time` to 25.
+
+<Note>
+`store_analytics_per_minute` takes precedence over `aggregation_time`. If `store_analytics_per_minute` is `true`, `aggregation_time` is fixed at 1 and self-healing has no effect.
+</Note>
+
+### Mongo GraphQL Pump
+
+The `mongo-graph` pump parses GraphQL-specific detail out of the raw request and response of every GraphQL request: types requested, fields requested per type, operation type, variables, root fields, and any errors.
+
+The resultant MongoDB collection exists for your own downstream querying, such as with a BI tool or data warehouse; Tyk Dashboard doesn't read this data back out anywhere.
+
+Enable [detailed recording](/api-management/logs/traffic-logs#detailed-recording) first, so that GraphQL information can be parsed from the request body and response; this applies globally across all APIs on the Gateway.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-mongo-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "mongo-graph": {
+      "type": "mongo-graph",
+      "meta": {       
+        "collection_name": "tyk_graph_analytics",   // required
+        "max_insert_batch_size_bytes": 10485760,
+        "max_document_size_bytes": 10485760,
+        "collection_cap_enable": false,
+        "collection_cap_max_size_bytes": 5368709120,
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+Accepts the same `collection_name`, `max_insert_batch_size_bytes`, `max_document_size_bytes`, and `collection_cap_*` fields as the [Standard Mongo Pump](#standard-mongo-pump); `collection_name` is required, with no default.
+
+<Note>
+The [Standard Mongo Pump](#standard-mongo-pump) doesn't filter out traffic logs for GraphQL requests, so they already reach `tyk_analytics` as ordinary, undifferentiated entries. If you point `mongo-graph`'s `collection_name` at the same collection as your Standard Mongo Pump, you'll get duplicate entries in the Log Browser for every GraphQL request, one plain copy and one GraphQL-enriched copy, without gaining anything: Log Browser can't display the extra fields anyway. Always use a separate, dedicated collection.
+</Note>
+
+Limitations:
+
+- Records can grow quickly, since detailed recording is required.
+- Subgraph requests in a federation setup are not recorded, only supergraph requests.
+- Universal Data Graph requests are recorded, but subsequent requests to data sources are ignored.
+
+### Mongo MCP Pump
+
+The `mongo-mcp` pump stores MCP (Model Context Protocol) tool-call traffic logs in their own collection, mirroring the [Standard Mongo Pump](#standard-mongo-pump). **Unlike GraphQL records, MCP records are excluded from the Standard Mongo Pump, so this is the only way to get MCP traffic logs into MongoDB.**
+
+As with the [Mongo GraphQL Pump](#mongo-graphql-pump), Tyk Dashboard doesn't read this data anywhere, including the Activity by MCP screen; it exists for your own downstream querying.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-mongo-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "mongo-mcp": {
+      "type": "mongo-mcp",
+      "meta": {
+        "collection_name": "tyk_mcp_analytics",     // required
+        "max_insert_batch_size_bytes": 10485760,
+        "max_document_size_bytes": 10485760,
+        "collection_cap_enable": false,
+        "collection_cap_max_size_bytes": 5368709120,
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+Accepts the same `collection_name`, `max_insert_batch_size_bytes`, `max_document_size_bytes`, and `collection_cap_*` fields as the [Standard Mongo Pump](#standard-mongo-pump); `collection_name` is required, with no default.
+
+### Mongo MCP Aggregate Pump
+
+The `mongo-mcp-aggregate` pump computes aggregated MCP analytics, mirroring the [Mongo Aggregate Pump](#mongo-aggregate-pump), and stores them in a collection called `z_tyk_mcp_analyticz_aggregate_{ORG_ID}`. Tyk Dashboard's MCP Traffic Analytics graphs are built on this aggregated analytics.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-mongo-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "mongo-mcp-aggregate": {
+      "type": "mongo-mcp-aggregate",
+      "meta": {
+        "use_mixed_collection": true,
+        "track_all_paths": false,
+        "ignore_tag_prefix_list": [],
+        "threshold_len_tag_list": 1000,
+        "store_analytics_per_minute": false,
+        "aggregation_time": 60,
+        "enable_aggregate_self_healing": false,
+        "ignore_aggregations": [],
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+Accepts the same `use_mixed_collection`, `track_all_paths`, `ignore_tag_prefix_list`, `threshold_len_tag_list`, `store_analytics_per_minute`, `aggregation_time`, `enable_aggregate_self_healing`, and `ignore_aggregations` fields as the [Mongo Aggregate Pump](#mongo-aggregate-pump) above. `use_mixed_collection: true` writes to the org-less `tyk_mcp_analytics_aggregate` collection instead of `tyk_analytics_aggregates`.
+
+**Tyk Dashboard Setting:** this pump supplies the **Activity by MCP** screen. [enable_aggregate_lookups: true](/tyk-dashboard/configuration#enable_aggregate_lookups) is required in the Tyk Dashboard configuration, not just recommended: unlike the REST case, there's no working [live fallback](/api-management/dashboard-analytics#pre-computed-vs-live-aggregation) if it's left `false`, since that fallback has no MCP-specific logic and queries the plain REST traffic log collection, returning nothing useful. See [MCP Analytics](/ai-management/mcp-gateway/mcp-analytics) for the Dashboard side of this feature.
+
+<Note>
+Tyk Dashboard's [`use_sharded_analytics`](/tyk-dashboard/configuration#use_sharded_analytics) controls which collection(s) it queries. If `use_sharded_analytics: false`, you must set `use_mixed_collection: true` so the pump populates the shared collection `tyk_mcp_analytics_aggregate`, which Dashboard always reads in this mode. If `use_sharded_analytics: true`, ordinary per-Organisation queries read the per-Organisation collections, which the pump populates regardless of `use_mixed_collection`, but a superuser session not attached to a single Organisation still falls back to the shared collection, so set `use_mixed_collection: true` too if you need those cross-org views to show data.
+</Note>
+
+## SQL
+
+Tyk Pump offers SQL pump types for REST, MCP proxy and GraphQL traffic. All share the same connection settings.
+
+The pumps are declared and configured as described in the [Tyk Pump configuration guide](/api-management/tyk-pump#declaring-pumps). Each pump to be deployed has its own entry in that configuration and has both [common](/api-management/tyk-pump#common-pump-settings) and specific configuration options. The specific config is held in the `meta` object - some of this is common, some is dependent on the specific pump as outlined in the following sections.
+
+<Note>
+Tyk no longer supports SQLite as of Tyk 5.7.0. Transition to [PostgreSQL](/planning-for-production/database-settings#postgresql), [MongoDB](/planning-for-production/database-settings#mongodb), or a listed compatible alternative.
+</Note>
+
+### Common SQL Meta
+
+Every SQL pump type on this page accepts these fields in `meta`, in addition to whatever is listed in its own section below. Each pump's own snippet only shows its additional fields; combine them with these to build a complete `meta` block.
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `type` | - | `postgres` or `mysql`. |
+| `connection_string` | - | The database connection string, for example `user:password@tcp(hostname:3306)/dbname` for MySQL, or host/port/user/password/dbname for PostgreSQL. |
+| `postgres.prefer_simple_protocol` | `false` | Disables implicit prepared statement usage. PostgreSQL only. |
+| `mysql.default_string_size` | `256` | Default size for string fields. MySQL only. |
+| `mysql.disable_datetime_precision` | `false` | Disables datetime precision, unsupported before MySQL 5.6. |
+| `mysql.dont_support_rename_index` | `false` | Drops and recreates an index instead of renaming it; needed before MySQL 5.7, or on MariaDB. |
+| `mysql.dont_support_rename_column` | `false` | Uses `CHANGE` instead of `RENAME COLUMN`; needed before MySQL 8, or on MariaDB. |
+| `mysql.skip_initialize_with_version` | `false` | Skips auto-configuring behavior based on the connected MySQL version. |
+| `table_sharding` | `false` | If `true`, records are stored in one table per day instead of a single table. See [Table Sharding](/api-management/dashboard-analytics/analytics-storage-management#table-sharding). |
+| `log_level` | `silent` | SQL log verbosity: `debug`, `info`, or `warning`. Any other value, including `error`, is treated as `silent` (no query logging). |
+| `batch_size` | `1000` | Maximum records written per batch. |
+| `migrate_sharded_tables` | `false` | See [Table Sharding](/api-management/dashboard-analytics/analytics-storage-management#table-sharding). |
+
+### Standard SQL Pump
+
+The `sql` pump stores every individual traffic log as a separate row in one table. It's the source for Tyk Dashboard's Log Browser, for both single- and multi-Organisation deployments: unlike MongoDB, there's no separate per-Organisation pump type, since every Organisation's rows already live in the same table, distinguished by an indexed `org_id` column.
+
+It has no pump-specific fields beyond [Common SQL Meta](#common-sql-meta) and the [common pump settings](/api-management/tyk-pump#common-pump-settings): set `type` to `postgres` or `mysql` and configure those.
+
+By default, the pump stores all records in a single table, `tyk_analytics`. With `table_sharding: true`, records are instead stored in per-day tables named `tyk_analytics_YYYYMMDD`.
+
+**Tyk Dashboard Setting:** the **API Usage Data > Log Browser** screen shows requests recorded by the `sql` pump. Unlike MongoDB, there's no Dashboard setting to configure: the same table is always queried, regardless of Organisation.
+
+### SQL Aggregate Pump
+
+The `sql_aggregate` pump computes analytics from traffic logs, aggregating hourly or per minute, and stores them in a table called `tyk_aggregated` by default.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-sql-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "sql_aggregate": {
+      "type": "sql_aggregate",
+      "meta": {
+        "track_all_paths": false,
+        "ignore_tag_prefix_list": [],
+        "store_analytics_per_minute": false,
+        "omit_index_creation": false,
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `track_all_paths` | `false` | If `true`, stores aggregated data for every endpoint rather than only [tracked endpoints](/api-management/dashboard-analytics#controlling-which-endpoints-are-tracked). |
+| `ignore_tag_prefix_list` | (none) | Prefixes of [custom aggregation tags](/api-management/dashboard-analytics#custom-aggregation-tags) to exclude from aggregation. |
+| `store_analytics_per_minute` | `false` | If `true`, aggregates per minute instead of per hour. |
+| `omit_index_creation` | `false` | If `true`, Tyk Pump never creates the default indexes. |
+
+With `table_sharding: true`, records are stored in a `tyk_aggregated_YYYYMMDD` table per day instead of a single `tyk_aggregated` table.
+
+**Tyk Dashboard Setting:** supplies **Activity by API**, **Activity by Key**, and **Errors**. Set [enable_aggregate_lookups: true](/tyk-dashboard/configuration#enable_aggregate_lookups) in the Tyk Dashboard configuration so it reads this pre-computed data, rather than computing it live from traffic logs on every request, and configure matching SQL connection settings, as above. See [Pre-Computed vs Live Aggregation](/api-management/dashboard-analytics#pre-computed-vs-live-aggregation) for the trade-off.
+
+<Note>
+Unlike MongoDB, there's no `use_mixed_collection` equivalent here, and `use_sharded_analytics` has no effect on this pump: Tyk Dashboard always reads the single `tyk_aggregated` table, regardless of Organisation, since SQL storage never splits into per-Organisation tables the way MongoDB can.
+</Note>
+
+### SQL GraphQL Pump
+
+The `sql-graph` pump parses GraphQL-specific detail out of the raw request and response of every GraphQL request, storing it in a dedicated table (`tyk_analytics_graph` by default): types requested, fields requested per type, operation type, variables, root fields, and any errors.
+
+The resultant table exists for your own downstream querying, such as with a BI tool or data warehouse; Tyk Dashboard doesn't read this data back out anywhere.
+
+Enable [detailed recording](/api-management/logs/traffic-logs#detailed-recording) first, so that GraphQL information can be parsed from the request body and response; this applies globally across all APIs on the Gateway.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-sql-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "sql-graph": {
+      "type": "sql-graph",
+      "meta": {
+        "table_name": "tyk_analytics_graph",
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `table_name` | `tyk_analytics_graph` | Used directly for unsharded setups, or as a table prefix for sharded setups, for example `tyk_analytics_graph_20230327`. |
+
+<Note>
+The [Standard SQL Pump](#standard-sql-pump) doesn't filter out traffic logs for GraphQL requests, so they already reach `tyk_analytics` as ordinary, undifferentiated rows. If you point `sql-graph`'s `table_name` at the same table as your Standard SQL Pump, you'll get duplicate rows in the Log Browser for every GraphQL request, one plain copy and one GraphQL-enriched copy, without gaining anything: Log Browser can't display the extra fields anyway. Always use a separate, dedicated table.
+</Note>
+
+The same limitations apply as for the [Mongo GraphQL Pump](#mongo-graphql-pump) above.
+
+### SQL GraphQL Aggregate Pump
+
+The `sql-graph-aggregate` pump computes aggregated GraphQL-specific analytics, mirroring the [SQL Aggregate Pump](#sql-aggregate-pump), and stores them in a fixed table, `tyk_graph_aggregated`. Unlike the GraphQL pumps that store traffic logs, this one does feed Tyk Dashboard. Unlike Mongo, there's no `mongo-graph-aggregate` equivalent.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-sql-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "sql-graph-aggregate": {
+      "type": "sql-graph-aggregate",
+      "meta": {
+        "track_all_paths": false,
+        "ignore_tag_prefix_list": [],
+        "store_analytics_per_minute": false,
+        "omit_index_creation": false,
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+Accepts the same `track_all_paths`, `ignore_tag_prefix_list`, `store_analytics_per_minute`, and `omit_index_creation` fields as the [SQL Aggregate Pump](#sql-aggregate-pump) above. The table name is fixed at `tyk_graph_aggregated`; there's no `table_name` override, though [table sharding](/api-management/dashboard-analytics/analytics-storage-management#table-sharding) still applies, storing per-day tables such as `tyk_graph_aggregated_20230327`.
+
+**Tyk Dashboard Setting:** powers the **Activity by Graph** screen (Popularity by Graph API, Errors by Graph API, All Graph APIs). Tyk Dashboard's Postgres storage driver queries this pump's table directly; there's no separate Dashboard config flag to enable it, and it's PostgreSQL-only.
+
+### SQL MCP Pump
+
+The `sql-mcp` pump stores MCP tool-call traffic logs in a dedicated table, `tyk_analytics_mcp` by default, mirroring the [Standard SQL Pump](#standard-sql-pump). **Unlike GraphQL records, MCP records are excluded from the [Standard SQL Pump](#standard-sql-pump), so this is the only way to get MCP traffic logs into SQL.**
+
+As with the [SQL GraphQL Pump](#sql-graphql-pump), Tyk Dashboard doesn't read this data anywhere, including the Activity by MCP screen; it exists for your own downstream querying.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-sql-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "sql-mcp": {
+      "type": "sql-mcp",
+      "meta": {
+        "table_name": "tyk_analytics_mcp",
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `table_name` | `tyk_analytics_mcp` | Used directly for unsharded setups, or as a table prefix for sharded setups. |
+
+### SQL MCP Aggregate Pump
+
+The `sql-mcp-aggregate` pump computes aggregated MCP analytics, mirroring the [SQL Aggregate Pump](#sql-aggregate-pump), and stores them in a fixed table, `tyk_mcp_aggregated`; unlike the [SQL MCP Pump](#sql-mcp-pump), this table name isn't configurable.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings) and [common `meta` fields](#common-sql-meta), the pump has the following settings:
+
+```json
+{
+  "pumps": {
+    "sql-mcp-aggregate": {
+      "type": "sql-mcp-aggregate",
+      "meta": {
+        "track_all_paths": false,
+        "ignore_tag_prefix_list": [],
+        "store_analytics_per_minute": false,
+        "omit_index_creation": false,
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+Accepts the same `track_all_paths`, `ignore_tag_prefix_list`, `store_analytics_per_minute`, and `omit_index_creation` fields as the [SQL Aggregate Pump](#sql-aggregate-pump) above. The table name is fixed at `tyk_mcp_aggregated`; there's no `table_name` override, though [table sharding](/api-management/dashboard-analytics/analytics-storage-management#table-sharding) still applies, storing per-day tables such as `tyk_mcp_aggregated_20230327`.
+
+**Tyk Dashboard Setting:** this pump supplies the **Activity by MCP** screen. [enable_aggregate_lookups: true](/tyk-dashboard/configuration#enable_aggregate_lookups) is required in the Tyk Dashboard configuration, not just recommended: unlike the REST case, there's no working [live fallback](/api-management/dashboard-analytics#pre-computed-vs-live-aggregation) if it's left `false`, since that fallback has no MCP-specific logic and queries the plain REST traffic log table, returning nothing useful. See [MCP Analytics](/ai-management/mcp-gateway/mcp-analytics) for the Dashboard side of this feature.
diff --git a/api-management/dashboard-analytics/data-plane-pump.mdx b/api-management/dashboard-analytics/data-plane-pump.mdx
new file mode 100644
index 0000000000..5bf46794b0
--- /dev/null
+++ b/api-management/dashboard-analytics/data-plane-pump.mdx
@@ -0,0 +1,219 @@
+---
+title: "Data Plane Pump"
+description: "How Tyk Dashboard gets its analytics data when the control plane and data plane(s) are separate, connected via Tyk MDCB, and what the aggregated analytics setting does and does not affect."
+keywords: "Data Plane Pump, Distributed Deployment, Tyk MDCB, Hybrid Pump, Aggregated Analytics, forward_analytics_to_pump"
+sidebarTitle: "Data Plane Pump"
+---
+
+In a distributed deployment, the control plane and one or more data planes run separately, often in different regions or clouds, connected via [Tyk MDCB](/api-management/mdcb). This changes how traffic data reaches Tyk Dashboard's persistent storage: instead of Tyk Pump writing directly to MongoDB or SQL, as it does when the control and data planes are combined, a Data Plane Pump (`type: hybrid`) on each data plane is used to forward the data to Tyk MDCB on the control plane, which then writes it to the Control Plane's persistent storage.
+
+```mermaid
+graph TD
+    G[Data Plane Gateway] -->|Generate Traffic Log| R[Local Redis]
+    R -->|Hybrid Pump reads traffic logs| H[Hybrid Pump]
+    H -->|aggregated: true| AG[Aggregated Analytics]
+    H -->|aggregated: false| TL[Traffic Logs]
+    AG --> MDCB[Tyk MDCB]
+    TL --> MDCB
+    MDCB -->|Aggregated analytics: always| E[Control Plane Persistent Storage]
+    MDCB -->|Traffic logs, forward_analytics_to_pump: false| W[Tyk MDCB's Built-In Writer]
+    W --> E
+    MDCB -->|Traffic logs, forward_analytics_to_pump: true| Q[Control Plane Redis]
+    Q --> C[Control Plane Pump]
+    C --> E
+    C -.->|optional| S[Third-Party Sink]
+```
+
+## Why a Separate Pump Process
+
+Tyk Gateway writes traffic logs to its own local Redis, which is not reachable from the control plane. Tyk MDCB never reaches into a data plane's Redis itself. It only receives data pushed to it over the RPC connection Gateways already use for configuration synchronization.
+
+The Hybrid Pump is a Tyk Pump instance, configured with `type: hybrid`, deployed alongside your data plane Gateways. It reads traffic logs from the local Redis and forwards them, individually or as aggregated analytics, to Tyk MDCB, the same role Tyk Pump plays when the control and data planes are combined, adapted for a deployment where they're separate.
+
+<Note>
+Tyk Gateway also has a legacy built-in mechanism for this, enabled with `analytics_config.type: rpc`, which sends traffic logs to Tyk MDCB without a separate pump process. It has no aggregation support and runs inside the Gateway process itself. The Hybrid Pump is the current recommended approach. If you adopt the Hybrid Pump, set `analytics_config.type` to an empty string on your Data Plane Gateways to disable the legacy mechanism, otherwise both compete to send the same traffic logs to Tyk MDCB.
+</Note>
+
+## Connecting the Hybrid Pump to Tyk MDCB
+
+To connect to Tyk MDCB, on the control plane, the Hybrid Pump needs to know where to find it (`connection_string`) and a secret to authenticate with (`api_key`).
+
+`api_key` is the API key of a Tyk Dashboard user, obtained by registering a user scoped to the same Organisation as your data plane. See [Tyk MDCB](/api-management/mdcb) for that setup.
+
+Set `use_ssl: true` to encrypt this connection over TLS. The Hybrid Pump is the TLS client and Tyk MDCB the server; there's no client certificate involved, so this only encrypts the connection, it doesn't identify the Pump to MDCB (`api_key` does that). If Tyk MDCB's certificate isn't trusted by your system's CA pool, for example because it's self-signed, set `ssl_insecure_skip_verify: true` rather than skip TLS entirely.
+
+## Hybrid Pump Meta
+
+The Hybrid Pump is declared and configured like any other pump, as described in the [Tyk Pump configuration guide](/api-management/tyk-pump#declaring-pumps), with both [common](/api-management/tyk-pump#common-pump-settings) and pump-specific settings. The specific settings live in `meta`:
+
+```json
+{
+  "pumps": {
+    "hybrid": {
+      "type": "hybrid",
+      "meta": {
+        "connection_string": "",       // required
+        "api_key": "",                 // required
+        "use_ssl": false,
+        "ssl_insecure_skip_verify": false,
+        "rpc_key": "",                 // unused
+        "call_timeout": 10,
+        "rpc_pool_size": 5,
+        "aggregated": false,
+        "track_all_paths": false,
+        "store_analytics_per_minute": false,
+        "enable_mcp_aggregation": false,
+        "ignore_tag_prefix_list": []
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `connection_string` | - | Tyk MDCB's address, as `host:port`, for example `mdcb.example.com:9091`. **Required** |
+| `api_key` | - | See [Connecting the Hybrid Pump to Tyk MDCB](#connecting-the-hybrid-pump-to-tyk-mdcb) above. **Required** |
+| `use_ssl` | `false` | Connect to Tyk MDCB over TLS. |
+| `ssl_insecure_skip_verify` | `false` | Skips TLS certificate verification when `use_ssl` is `true`. |
+| `rpc_key` | - | Unused. |
+| `call_timeout` | `10` | RPC call timeout, in seconds. |
+| `rpc_pool_size` | `5` | RPC connection pool size, see [Tuning the RPC Connection Pool](#tuning-the-rpc-connection-pool) below. |
+| `aggregated` | `false` | See [Traffic Logs or Aggregated Analytics](#traffic-logs-or-aggregated-analytics) below. |
+| `track_all_paths` | `false` | See [Traffic Logs or Aggregated Analytics](#traffic-logs-or-aggregated-analytics) below. |
+| `store_analytics_per_minute` | `false` | See [Traffic Logs or Aggregated Analytics](#traffic-logs-or-aggregated-analytics) below. |
+| `enable_mcp_aggregation` | `false` | See [Traffic Logs or Aggregated Analytics](#traffic-logs-or-aggregated-analytics) below. |
+| `ignore_tag_prefix_list` | (none) | Prefixes of [custom aggregation tags](/api-management/dashboard-analytics#custom-aggregation-tags) to exclude from aggregation, when `aggregated` is `true`. |
+
+### Tuning the RPC Connection Pool
+
+`rpc_pool_size` controls how many concurrent RPC connections the Hybrid Pump opens to Tyk MDCB. Each connection can carry data independently, so a larger pool lets the pump push more data to Tyk MDCB in parallel.
+
+Consider increasing this value if:
+
+- You're running high API request volumes and the pump can't keep up with sending data to Tyk MDCB.
+- You're sending (non-aggregated) traffic logs, which produce significantly more records than `aggregated` mode.
+
+Each connection has a real cost on both ends: the Hybrid Pump and Tyk MDCB each allocate a 64KB send buffer and a 64KB receive buffer per connection. Tyk MDCB doesn't cap how many connections it will accept, so this cost accumulates across every data plane connected to it, not just your own.
+
+Raising `rpc_pool_size` also has diminishing returns past a point: Tyk MDCB only processes up to 8,192 RPC calls concurrently by default, a limit shared across every connection from every data plane. Once that's saturated, more connections just queue for the same shared budget rather than increasing overall throughput.
+
+There's usually no benefit to raising `rpc_pool_size` beyond your actual concurrency needs.
+
+## Traffic Logs or Aggregated Analytics
+
+The Hybrid Pump can send every traffic log to Tyk MDCB, or it can create [aggregated analytics](/api-management/dashboard-analytics#how-aggregation-works).
+
+The `aggregated` field controls this behavior:
+
+- `aggregated: false` (default): the Hybrid Pump sends every traffic log to Tyk MDCB individually. This is the appropriate mode to use if you need to see the traffic in Tyk Dashboard's Log Browser.
+- `aggregated: true`: the Hybrid Pump summarizes traffic logs, before sending it to the Control Plane. This reduces the bandwidth requirement with less data crossing the (often expensive, sometimes cross-region) link to Tyk MDCB. The side-effect is that **the individual traffic logs are not available to view in the Log Browser**.
+
+<Note>
+The `tyk-data-plane` Helm chart sets `aggregated: true` by default, to minimize traffic out of the box.
+</Note>
+
+The following settings only take effect when `aggregated: true`; they have no effect on individual traffic logs:
+
+- `track_all_paths`: aggregate all endpoints, not just [tracked ones](/api-management/dashboard-analytics#controlling-which-endpoints-are-tracked).
+- `store_analytics_per_minute`: aggregate per minute rather than per hour.
+- `enable_mcp_aggregation`: see [MCP Proxy Traffic](#mcp-proxy-traffic) below.
+
+## How Tyk MDCB Handles The Data
+
+Tyk MDCB receives either [traffic logs or aggregated analytics](#traffic-logs-or-aggregated-analytics) from each Hybrid Pump, and writes it into the Control Plane's persistent storage that Tyk Dashboard reads from.
+
+Aggregated analytics (generated if the Hybrid Pump is configured with `aggregated: true`) are always written directly to persistent storage, for Tyk Dashboard's [Traffic Analytics graphs](/api-management/dashboard-analytics#traffic-analytics).
+
+Traffic logs (`aggregated: false`) can be handled in one of two ways, controlled by Tyk MDCB's [`forward_analytics_to_pump`](/tyk-multi-data-centre/mdcb-configuration-options#forward_analytics_to_pump) setting:
+
+| `forward_analytics_to_pump` | Behavior |
+| :-- | :-- |
+| `false` (default) | Tyk MDCB's [built-in writer](#tyk-mdcbs-built-in-writer) processes the data. |
+| `true` | Tyk MDCB stores the traffic logs in the Control Plane Redis instead, for a Control Plane Pump to process. |
+
+If you need to [export the data](/api-management/logs/external-data-sinks) from the Control Plane to a third-party sink such as Splunk or Datadog, you must first store it in the Control Plane Redis by setting `forward_analytics_to_pump: true`.
+
+<Note>
+**`forward_analytics_to_pump` has no effect on aggregated analytics.** Tyk MDCB always writes aggregated analytics straight to persistent storage, whichever way it's set. This means analytics aggregated in the data plane by the Hybrid Pump reliably populate Tyk Dashboard's Traffic Analytics graphs, but cannot be routed onward to a third-party sink through the Control Plane Pump.
+</Note>
+
+### Tyk MDCB's Built-In Writer
+
+Tyk MDCB has much of the same capability as the dedicated Mongo/SQL pumps described in [Control Plane Pumps](/api-management/dashboard-analytics/control-plane-pumps), but not all of it. When `forward_analytics_to_pump` is `false`, this built-in writer will process the traffic logs received from the data planes.
+
+This facility:
+
+- Writes traffic logs directly to the persistent storage for the Log Browser
+- In parallel, computes and writes aggregated analytics from that same data, for the Traffic Analytics graphs: the same computation the Mongo/SQL Aggregate Pumps perform
+
+This is configured in Tyk MDCB's own config file, `tyk_sink.conf`, not in `pump.conf`:
+
+```json
+{
+  "forward_analytics_to_pump": false,
+  "analytics": {
+    "type": "mongo",
+    ...
+  },
+  "dont_store_selective": false,
+  "dont_store_aggregate": false,
+  "track_all_paths": false,
+  "store_analytics_per_minute": false,
+  "ignore_tag_prefix_list": []
+}
+```
+
+The `analytics` object's connection fields exactly mirror [Common Mongo Meta](/api-management/dashboard-analytics/control-plane-pumps#common-mongo-meta) or [Common SQL Meta](/api-management/dashboard-analytics/control-plane-pumps#common-sql-meta), depending on `analytics.type`; see those for the full field list rather than a third copy of it here.
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `forward_analytics_to_pump` | `false` | See [How Tyk MDCB Handles The Data](#how-tyk-mdcb-handles-the-data) above. |
+| `analytics.type` | `mongo` | Storage backend: `mongo` or `postgres`. |
+| `dont_store_selective` | `false` | If `true`, skips writing per-Organisation storage, which otherwise mirrors the [Per-Organisation Mongo Pump](/api-management/dashboard-analytics/control-plane-pumps#per-organisation-mongo-pump). |
+| `dont_store_aggregate` | `false` | If `true`, skips computing aggregated analytics; only traffic logs are stored, for the Log Browser. |
+| `track_all_paths` | `false` | Aggregate all endpoints, not just [tracked ones](/api-management/dashboard-analytics#controlling-which-endpoints-are-tracked). |
+| `store_analytics_per_minute` | `false` | Aggregate per minute rather than per hour. |
+| `ignore_tag_prefix_list` | (none) | Prefixes of [custom aggregation tags](/api-management/dashboard-analytics#custom-aggregation-tags) to exclude from aggregation. |
+
+Limitations:
+
+- **No filtering:** there's no equivalent to a Tyk Pump's `filters` setting (`org_ids`, `api_ids`, `response_codes`, and their `skip_*` counterparts). Every request that reaches Tyk MDCB is stored; you can't exclude specific APIs, Organisations, or response codes.
+- **No MySQL support:** `analytics.type` only recognizes `mongo` and `postgres`; any other value, including `mysql`, is accepted but silently falls back to `mongo` rather than failing.
+- **No GraphQL awareness:** GraphQL requests pass through as ordinary traffic logs and general aggregated analytics only; see [GraphQL Traffic](#graphql-traffic) below for what's missing.
+- **No automatic MCP aggregation:** MCP traffic logs are stored, but not aggregated automatically the way REST traffic is; see [MCP Proxy Traffic](#mcp-proxy-traffic) below for how to populate Activity by MCP.
+
+If you need MySQL, filtering, or a third-party sink, use a Control Plane Pump instead: set `forward_analytics_to_pump: true` and configure the Control Plane Pump as any other [Control Plane Pump](/api-management/dashboard-analytics/control-plane-pumps).
+
+## Choosing a Configuration
+
+This table covers REST traffic; see [GraphQL Traffic](#graphql-traffic) and [MCP Proxy Traffic](#mcp-proxy-traffic) below for how those differ.
+
+| Goal | Hybrid Pump `aggregated` | Tyk MDCB `forward_analytics_to_pump` |
+| :-- | :-- | :-- |
+| Traffic Analytics graphs only, minimize WAN traffic | `true` | Either value; has no effect |
+| Traffic Analytics graphs and Log Browser | `false` | `false` |
+| Traffic Analytics graphs, Log Browser, and third-party sinks | `false` | `true`, with a Control Plane Pump configured to write to both the Control Plane persistent storage and your third-party sink |
+| Third-party sink only, minimal Tyk Dashboard dependency | Run a separate [OpenTelemetry](/api-management/traces) integration on the Gateway instead | n/a |
+
+## GraphQL Traffic
+
+The mechanics above are for REST traffic. There is no dedicated path through the Hybrid Pump or Tyk MDCB for GraphQL.
+
+The Hybrid Pump has no GraphQL-specific handling, so GraphQL requests pass through as ordinary, undifferentiated traffic logs: they're included in Log Browser and in the general aggregated analytics like any other request, but they never populate the GraphQL-specific [Activity by Graph](/api-management/dashboard-analytics#activity-by-graph) screen. That screen depends on the `sql-graph-aggregate` pump, which only exists for combined deployments; there's no distributed-deployment equivalent.
+
+## MCP Proxy Traffic
+
+The mechanics above are for REST traffic. MCP proxy traffic has its own dedicated path through the Hybrid Pump and Tyk MDCB. But unlike REST, storing MCP traffic logs doesn't also generate aggregated MCP analytics automatically, and Tyk Dashboard's Log Browser never reads MCP data at all, in any topology.
+
+When `forward_analytics_to_pump` is `false`, Tyk MDCB stores MCP traffic logs in the Control Plane's persistent storage for your own downstream querying only, the same as the [Mongo MCP Pump](/api-management/dashboard-analytics/control-plane-pumps#mongo-mcp-pump) in a combined deployment. It doesn't compute and store MCP aggregated analytics.
+
+To populate [Activity by MCP](/ai-management/mcp-gateway/mcp-analytics), you can either:
+
+- Set `enable_mcp_aggregation: true` and `aggregated: true` on the Hybrid Pump. This aggregates MCP traffic logs on the data plane before sending: you gain Activity by MCP, but lose the individual MCP traffic logs. This is the same trade-off as REST API traffic has with `aggregated: true`.
+- Keep the Hybrid Pump sending MCP traffic logs individually, set `forward_analytics_to_pump: true`, and configure a Control Plane Pump with an MCP aggregate pump type (`mongo-mcp-aggregate` or `sql-mcp-aggregate`) to compute Activity by MCP's data from that forwarded data.
+
+<Note>
+If `aggregated: true` on the Hybrid Pump but `enable_mcp_aggregation` is left `false` (the default), MCP analytics are dropped entirely rather than aggregated. Unlike REST traffic, which still gets aggregated in this mode, MCP traffic gets nothing at all: no aggregated data, and no traffic logs either, since `aggregated: true` already means individual traffic logs of any kind aren't sent.
+</Note>
diff --git a/api-management/dashboard-configuration.mdx b/api-management/dashboard-configuration.mdx
new file mode 100644
index 0000000000..b4a68eccd8
--- /dev/null
+++ b/api-management/dashboard-configuration.mdx
@@ -0,0 +1,110 @@
+---
+title: "Tyk Dashboard Overview"
+description: "Learn about Tyk Dashboard, the control plane for managing your Tyk Platform, and how to configure its data storage"
+keywords: "Tyk Dashboard, Dashboard Configuration, Data Storage, Platform Management"
+sidebarTitle: "Tyk Dashboard"
+---
+
+## Introduction
+
+<img src="/img/diagrams/tyk-selfmanaged-architecture-dashboard.png" alt="Tyk Dashboard diagram" />
+
+The Tyk Dashboard is a web-based interface that serves as the **central management hub for your API ecosystem**. It provides a user-friendly Graphical User Interface (GUI) for configuring, monitoring, and analyzing your APIs managed by Tyk.
+
+The Dashboard also exposes a **REST API**, allowing for programmatic control and integration with other tools and workflows.
+
+## Exploring the Dashboard UI
+
+To get a tour of the Dashboard UI, refer to this [document](/getting-started/using-tyk-dashboard).
+
+## Exploring the Dashboard API
+
+The Dashboard is a large, granular REST API with a thin-client web front-end, and if being deployed as part of a Tyk install, serves as the main integration point instead of the Gateway API.
+
+<img src="/img/diagrams/dashboardapi2.png" alt="API Overview" />
+
+**The Dashboard API is a superset of the Gateway API**, providing the same functionality, with additional features (anything that can be done in the Dashboard has an API endpoint), and offers some additional advantages:
+ - The Dashboard API has a granular structure, you can create separate clients easily.
+ - The API features read/write permissions on a per-endpoint level to have extra control over integrations.
+ - The API enforces a schema that can be modified and hardened depending on your usage requirements.
+
+### Types of Dashboard API
+
+The Dashboard exposes two APIs:
+ - **Dashboard API**: Is used for operational management of Tyk resources (APIs, policies, keys, etc.). This API offers granular permissions based on user roles.
+
+    To know more about the Dashboard API, refer to the [Tyk Dashboard API documentation](/tyk-dashboard-api).
+
+ - **Dashboard Admin API**: Is used for system-level administration and initial setup tasks like managing organizations, initial user creation, backups/migrations and SSO setup.
+
+    To know more about the Dashboard Admin API, refer to the [Tyk Dashboard Admin API documentation](/dashboard-admin-api).
+
+### Authenticating with Dashboard APIs
+
+**Dashboard API**
+
+The [Tyk Dashboard API](/tyk-dashboard-api) is secured using an `Authorization` header that must be added to each request that is made. The **Tyk Dashboard API Access Credentials** `Authorization` key can be found within the Dashboard UI at the bottom of the **Edit User** section for a user.
+
+**Dashboard Admin API**
+
+The Tyk Dashboard Admin API is secured using a shared secret that is set in the `tyk_analytics.conf` file. Calls to the Admin API require the `admin-auth` header to be provided, to differentiate the call from a regular Dashboard API call.
+
+## Data Storage Solutions
+
+Tyk Dashboard requires a persistent datastore for its operations. For supported database engines and versions, see [Installation Requirements](/tyk-self-managed/install#requirements).
+
+Tyk stores a variety of data in 4 separate data storage layers. You can configure each layer separately to use one of our supported database platforms. Alternatively a single platform can be used for all layers. The 4 data storage layers are as follows:
+1. **Main**: Stores configurations of: APIs, Policies, Users and User Groups.
+2. **Aggregate Analytics**: Data used to display Dashboard charts and [analytics](/api-management/dashboard-analytics#traffic-analytics).
+3. **Logs**: When [detailed logging](/api-management/troubleshooting-debugging#capturing-detailed-logs) is enabled, request and response data is logged to storage. These logs can previewed in the Dashboard [log browser](/api-management/dashboard-analytics#activity-logs).
+4. **Uptime**: Uptime test analytics.
+
+Being extensible, Tyk supports storing this data across different databases (MongoDB, MySQL and PostgreSQL etc.). For example, Tyk can be configured to store analytics in PostgreSQL, logs in MongoDB and uptime data in MySQL.
+
+As illustrated below it can be seen that Tyk Pump writes to one or more external data sources via a Redis store. Conversely, Tyk Dashboard reads this data from the external data sources.
+
+<img src="/img/diagrams/diagram_docs_pump-open-source@2x.png" alt="Tyk Dashboard Pump Architecture" />
+
+The following details are required to manage this configuration:
+- Data storage layer type
+- Database engine
+- Database connection string
+
+### Configure Dashboard to Read from a Data Storage Layer
+
+Tyk Dashboard has configuration environment variables for each data storage layer in the following format:
+
+```console
+TYK_DB_STORAGE_<LAYER>_TYPE
+TYK_DB_STORAGE_<LAYER>_CONNECTIONSTRING
+```
+
+where *LAYER* can be *MAIN*, *ANALYTICS*, *LOGS* or *UPTIME*.
+
+For example, to configure Tyk Dashboard to read logs from a mongo database, the following environment variables are required:
+
+```console
+TYK_DB_STORAGE_LOGS_TYPE=mongo
+TYK_DB_STORAGE_LOGS_CONNECTIONSTRING=mongodb://db_host_name:27017/tyk_analytics
+```
+
+The full set of environment variables are listed below:
+
+```console
+TYK_DB_STORAGE_MAIN_TYPE
+TYK_DB_STORAGE_MAIN_CONNECTIONSTRING
+TYK_DB_STORAGE_LOGS_TYPE
+TYK_DB_STORAGE_LOGS_CONNECTIONSTRING
+TYK_DB_STORAGE_ANALYTICS_TYPE
+TYK_DB_STORAGE_ANALYTICS_CONNECTIONSTRING
+TYK_DB_STORAGE_UPTIME_TYPE
+TYK_DB_STORAGE_UPTIME_CONNECTIONSTRING
+```
+
+It should be noted that Tyk will attempt to use the configuration for the *main* data storage layer when no corresponding configuration is available for logs, uptime or analytics.
+
+Please refer to the [storage configuration](/tyk-dashboard/configuration#storage) section to explore the parameters for configuring Tyk Dashboard to read from different storage layers.
+
+### Configure Pump to Write to Data Storage Layers
+
+Tyk Pump writes traffic logs, aggregated analytics and uptime test results to these same storage layers. See [Control Plane Pumps](/api-management/dashboard-analytics/control-plane-pumps) for configuring Tyk Pump to write logs and analytics, or [Uptime Tests](/planning-for-production/ensure-high-availability/uptime-tests#monitoring-uptime-tests-in-tyk-dashboard) for the uptime storage layer specifically.
diff --git a/api-management/data-graph.mdx b/api-management/data-graph.mdx
new file mode 100644
index 0000000000..7683988aa9
--- /dev/null
+++ b/api-management/data-graph.mdx
@@ -0,0 +1,1970 @@
+---
+title: "Universal Data Graph"
+description: "Learn how to configure Tyk Data Graph to stitch multiple APIs into a single GraphQL endpoint"
+keywords: "UDG, Universal Data Graph, Datasource, Concepts, Arguments, Field Mapping, Header Management, Graphql, Kafka, Rest, Examples"
+sidebarTitle: "Universal Data Graph (UDG)"
+---
+
+## Overview
+
+The Universal Data Graph (UDG) lets you combine multiple APIs into one universal interface.
+With the help of GraphQL you're able to access multiple APIs with a single query.
+
+It's important to note that you don't even have to build your own GraphQL server.
+If you have existing REST APIs all you have to do is configure the UDG.
+
+With the Universal Data Graph Tyk becomes your central integration point for all your internal as well as external APIs.
+In addition to this, the UDG benefits from all existing solutions that already come with your Tyk installation.
+That is, your Data Graph will be secure from the start and there's a large array of middleware you can build on to power your Graph.
+
+<img src="/img/diagrams/universal_datagraph_overview.png" alt="Universal Datagraph Overview" />
+
+Currently supported DataSources:
+- REST
+- GraphQL
+- SOAP (through the REST datasource)
+- Kafka
+
+
+
+    <Note>
+    To start creating your first Universal Data Graph in Tyk Dashboard, go to "Data Graphs" section of the menu.
+    </Note>
+
+
+Make sure to check some of the resources to help you start:
+- [How to create UDG schema](/api-management/data-graph#creating-schema)
+- [How to connect data sources](/api-management/data-graph#connect-datasource)
+- [How to secure the data graph](/api-management/data-graph#security)
+
+## Key Concepts
+
+### Universal Data Graph
+
+The Universal Data Graph (UDG) introduces a few concepts you should fully understand in order to make full use of it.
+
+UDG comes with a fully spec compliant GraphQL engine that you don't have to code, you just have to configure it. 
+
+For that you have to define your "DataSources" and might want to add "Field Mappings" as well as "Arguments" to your configuration.
+Read on in the sub sections to understand the full picture to use UDG to its full potential.
+
+To help you, we have put together the following video.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/Z2kTqpxcv-E" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+### DataSources
+
+In most GraphQL implementations you have the concept of Resolvers.
+Resolvers are functions that take optional parameters and return (resolve) some data.
+Each resolver is attached to a specific type and field.
+
+DataSources are similar in that they are responsible for loading the data for a certain field and type.
+The difference is that with DataSources you simply configure how the engine should fetch the data whereas with traditional GraphQL frameworks you have to implement the function on your own.
+
+DataSources can be internal as well as external.
+
+Internal DataSources are APIs that are already managed by Tyk, such as REST or SOAP services configured through the Dashboard.
+You can take advantage of Tyk’s rich middleware ecosystem to validate and transform requests and responses for these internal DataSources.
+
+External DataSources are APIs that you’re not currently managing through Tyk.
+For simplicity, you can add them to your data graph without first configuring them as dedicated APIs in Tyk.
+If you later decide to apply middleware or other policies, you can easily transition an external DataSource into a managed internal API.
+
+Head over to the [connect data source](/api-management/data-graph#udg) section to learn about the supported data sources and how to connect them to Tyk.
+
+### Arguments
+
+Looking back at the example from the "Field Mappings", you might wonder how to use the "id" argument from the GraphQL query to make the correct REST API call to the user service.
+
+Here's the schema again:
+
+```graphql
+type Query {
+    user(id: Int!): User
+}
+
+type User {
+    id: Int!
+    name: String
+}
+```
+
+We assume you already have your DataSource attached and now want to configure it so that the path argument gets propagated accordingly.
+You need to tell the GraphQL engine that when it comes to resolving the field "user", take the argument with the name "id" and use it in the URL to make the request to the REST API.
+You do this by using templating syntax to inject it into the URL.
+This is done from the "Configure data source" tab, which will show after clicking a schema argument or object field.
+Typing an opening curly brace ( `{` ) will produce a dropdown that contains all available fields and arguments.
+
+```html
+https://example.com/user/{{ .arguments.id }}
+``` 
+
+<img src="/img/dashboard/udg/concepts/parameter_dropdown.png" alt="Create New API" />
+
+### Field Mappings
+
+Universal Data Graph can automatically resolve where data source information should go in the GraphQL response as long as the GraphQL schema mirrors the data source response structure.
+
+Let's assume you have a REST API with a user resource like this: `http://example.com/users/:id`
+
+The following is an example response:
+
+```json
+{
+  "id": 1,
+  "name": "Martin Buhr"
+}
+```
+
+If GraphQL schema in UDG is set as the following:
+```graphql
+type Query {
+    user(id: Int!): User
+}
+
+type User {
+    id: Int!
+    name: String
+}
+```
+and REST data source at attached behind `user(id: Int!)` query, UDG will be able to automatically resolve where `id` and `name` values should be in UDG response. In this case no field mapping is necessary.
+
+
+<Note>
+GraphQL does not support field names with hyphens (e.g. `"user-name"`). This can be resolved by using field mappings as described below.
+</Note>
+
+
+Let's assume that the JSON response looked a little different:
+
+````json
+{
+  "id": 1,
+  "user_name": "Martin Buhr"
+}
+````
+
+If this were the JSON response you received from the REST API, you must modify the path for the field "name".
+This is achieved by unchecking the "Disable field mapping" checkbox and setting the Path to "user_name".
+
+Nested paths can be defined using a period ( . ) to separate each segment of the JSON path, *e.g.*, "name.full_name" 
+
+In cases where the JSON response from the data source is wrapped with `[]` like this:
+
+```json
+[
+  {
+  "id": 1,
+  "name": "Martin Buhr",
+  "phone-number": "+12 3456 7890"
+  }
+]
+```
+UDG will not be able to automatically parse `id`, `name` and `phone-number` and fields mapping needs to be used as well. To get the response from inside the brackets the following syntax has to be used in field mapping: `[0]`.
+
+It is also possible to use this syntax for nested paths. For example: `[0].user.phone-number`
+
+#### Field mapping in Tyk Dashboard
+
+See below how to configure the field mapping for each individual field.
+
+<img src="/img/dashboard/udg/concepts/field-mapping-new.png" alt="Field mapping UI" />
+
+
+#### Field mapping in Tyk API definition
+
+If you're working with raw Tyk API definition the field mapping settings look like this:
+
+```json
+{"graphql": {
+      "engine": {
+        "field_configs": [
+          {
+            "type_name": "User",
+            "field_name": "phoneNumber",
+            "disable_default_mapping": false,
+            "path": [
+              "[0]",
+              "user",
+              "phone-number"
+            ]
+          }
+        ]
+      }
+    }
+  }
+```
+
+Notice that even though in Tyk Dashboard the nested path has a syntax with ( . ), in Tyk API definition it becomes an array of strings.
+
+There's more UDG concepts that would be good to understand when using it for the first time:
+* [UDG Arguments](/api-management/data-graph#arguments)
+* [UDG Datasources](/api-management/data-graph#udg)
+
+### Reusing response fields
+
+When using the UDG, there may be a situation where you want to access an API with data coming from another API.
+Consider the following REST APIs:
+
+ - REST API for people: `https://people-api.dev/people`
+ - REST API for a specific person: `https://people-api.dev/people/{person_id}`
+ - REST API for driver licenses: `https://driver-license-api.dev/driver-licenses/{driver_license_id}`
+
+The REST API for a person will give us the following response:
+```json
+{
+    "id": 1,
+    "name": "John Doe",
+    "age": 40,
+    "driverLicenseID": "DL1234"
+}
+```
+
+And the REST API response for driver licenses looks like this:
+```json
+{
+    "id": "DL1234",
+    "issuedBy": "United Kingdom",
+    "validUntil": "2040-01-01"
+}
+```
+
+As you can see by looking at the example responses, you could use the `driverLicenseID` from the People API to obtain the driver license data from the Driver License API.
+
+You also want to design the schema so that it represents the relationship between a person and a driver license.
+As the person object is referencing a driver license by its ID, it means that we will need to define the driver license inside the person object as a field.
+Consequently, a schema representing such a relationship might look like this:
+
+```graphql
+type Query {
+    people: [Person]  # Data source for people
+    person(id: Int!): Person  # Data Source for a specific person
+}
+
+type Person {
+    id: Int!
+    name: String!
+    age: Int!
+    driverLicenseID: ID
+    driverLicense: DriverLicense  # Data Source for a driver license
+}
+
+scalar Date
+
+type DriverLicense {
+    id: ID!
+    issuedBy: String!
+    validUntil: Date! 
+}
+```
+
+#### Defining the data source URLs
+
+Now it's all about defining the data source URLs. 
+
+For the field `Query.people`, you can simply use the URL to the API:
+```
+https://people-api.dev/people
+```
+
+The `Query.person` field needs to use its `id` argument to call the correct API endpoint.
+
+See [Concept: Arguments](/api-management/data-graph#arguments) to learn more about it.
+ ```
+ https://people-api.dev/people/{{.arguments.id}}
+ ```
+
+To retrieve the driver license data you need to be able to use the `driverLicenseID` from the `Person` object. As we defined the driver license data source on the `Person` object, you can now access all properties from the `Person` object by using the `.object` placeholder.
+
+
+<Note>
+If you want to access data from the object on which the data source is defined, use the `.object` placeholder (e.g: `.object.id` to access the `id` property from an object).
+</Note>
+
+
+So the URL for the driver license data source would look like this:
+```
+https://driver-license-api.dev/driver-licenses/{{.object.driverLicenseID}}
+```
+ <img src="/img/dashboard/udg/concepts/object_placeholder.png" alt="Use the object placeholder" />
+
+#### Result
+
+A query like:
+```graphql
+{
+    people {
+        id
+        name
+        age
+        driverLicense {
+            id
+            issuedBy
+            validUntil
+        }
+    }
+}
+```
+
+... will now result in something like this:
+```json
+{
+    "data": {
+        "people": [
+            {
+                "id": 1,
+                "name": "John Doe",
+                "age": 40,
+                "driverLicense": {
+                    "id": "DL1234",
+                    "issuedBy": "United Kingdom",
+                    "validUntil": "2040-01-01"
+                }
+            },
+            {
+                "id": 2,
+                "name": "Jane Doe",
+                "age": 30,
+                "driverLicense": {
+                    "id": "DL5555",
+                    "issuedBy": "United Kingdom",
+                    "validUntil": "2035-01-01"
+                }
+            }
+        ]
+    }
+}
+```
+
+
+### Header management
+
+With Tyk v5.2 the possibilities of managing headers for Universal Data Graph and all associated data sources have been extended.
+
+#### Global headers for UDG
+
+Global headers can be configured via Tyk API Definition. The correct place to do that is within `graphql.engine.global_headers` section. For example:
+
+```json
+{
+    "graphql": {
+        "engine": {
+            "global_headers": [
+                {
+                    "key": "global-header",
+                    "value": "example-value"
+                },
+                {
+                    "key": "request-id",
+                    "value": "$tyk_context.request_id"
+                }
+            ]
+        }
+    }
+}
+```
+
+Global headers now have access to all [request context variables](/api-management/traffic-transformation/request-context-variables).
+
+By default, any header that is configured as a global header, will be forwarded to all data sources of the UDG.
+
+#### Data source headers
+
+Data source headers can be configured via Tyk API Definition and via Tyk Dashboard UI. The correct place to do that is within `graphql.engine.datasources.config.headers` section. For example:
+
+```json
+{
+    "engine": {
+        "data_sources": [
+            {
+                "config": {
+                    "headers": {
+                        "data-source-header": "data-source-header-value",
+                        "datasource1-jwt-claim": "$tyk_context.jwt_claims_datasource1"
+                    }
+                }
+            }
+        ]
+    }
+}
+```
+
+Data source headers now have access to all [request context variables](/api-management/traffic-transformation/request-context-variables).
+
+#### Headers priority order
+
+If a header has a value at the data source and global level, then the data source value takes precedence.
+
+For example for the below configuration:
+
+```json
+{
+    "engine": {
+        "data_sources": [
+            {
+                "config": {
+                    "headers": {
+                        "example-header": "data-source-value",
+                        "datasource1-jwt-claim": "$tyk_context.jwt_claims_datasource1"
+                    }
+                }
+            }
+        ],
+        "global_headers": [
+          {
+              "key": "example-header",
+              "value": "global-header-value"
+          },
+          {
+              "key": "request-id",
+              "value": "$tyk_context.request_id"
+          }
+      ]
+    }
+}
+```
+
+The `example-header` header name is used globally and there is also a data source level header, with a different value. Value `data-source-value` will take priority over `global-header-value`, resulting in the following headers being sent to the data source:
+
+| Header name    | Header value                        | Defined on level |
+| :---------------- | :------------------------------------- | :------------------ |
+| example-header | data-source-value                   | data source      |
+| datasource1    | $tyk_context.jwt_claims_datasource1 | data source      |
+| request-id     | $tyk_context.request_id             | global           |
+
+## Connect Data Sources
+
+### UDG
+
+Datasources are the fuel to power any Unified Data Graph and the designed schema.
+
+Datasources can be attached to any field available in the composed UDG schema. They can also be nested within each other.
+
+You can add Datasources to your Universal Data Graph without adding them to Tyk as a dedicated API. This is useful for getting started but also limited in capabilities. Datasources that are managed within Tyk offer much more flexibility and allow for a much fuller API Management control.
+
+If you want to add quotas, rate limiting, body transformations etc. to a REST Datasource it is recommended to first import the API to Tyk.
+
+Supported DataSources:
+- REST (Query and Mutation only)
+- GraphQL (Query, Mutation, and Subscription)
+- SOAP (through the REST DataSource, Query and Mutation only)
+- Kafka (Subscription only)
+
+
+
+<Note>
+UDG subscriptions (including SSE) are only supported for data sources of kind **GraphQL** or **Kafka**. REST data sources do not support subscriptions. If your upstream service exposes subscriptions via SSE, configure it as a **GraphQL** data source with the appropriate `subscription_type`. See [GraphQL Subscriptions](/api-management/graphql#graphql-subscriptions) for configuration details.
+</Note>
+
+### GraphQL
+
+The GraphQL Datasource is able to make GraphQL queries to your upstream GraphQL service. In terms of configuration there are no real differences between the GraphQL Datasource and the one for REST with one slight exception.
+
+#### GraphQL data source at operation root level
+
+To illustrate this we'll have a look at an example graph.
+
+Consider the following schema:
+
+```graphql
+type Query {
+    employee(id: Int!): Employee
+}
+type Employee {
+    id: Int!
+    name: String!
+}
+```
+
+Let's assume we would send the following query to a GraphQL server running this schema:
+
+```graphql
+query TykCEO {
+    employee(id: 1) {
+        id
+        name
+    }
+}
+```
+
+The response of this query would look like this:
+
+```json
+{
+  "data": {
+    "employee": {
+        "id": 1,
+        "name": "Martin Buhr"
+      }
+  }
+}
+```
+
+Compared to a REST API one difference is obvious. The response is wrapped in the root field "data".
+There's also the possibility of having a root field "errors" but that's another story.
+For simplicity reasons the GraphQL Datasource will not return the "data" object but rather extract the "employee" object directly.
+So if you want to get the field mappings right you don't have to think about errors or data.
+You can assume that your response object looks like this:
+
+````json
+{
+  "employee": {
+    "id": 1,
+    "name": "Martin Buhr"
+  }
+}
+````
+
+Compared to a REST API you should be able to identify the key difference here.
+The response is wrapped in the field "employee" whereas in a typical REST API you usually don't have this wrapping.
+
+Because of this, field mappings are by default disabled for REST APIs.
+For GraphQL APIs, the mapping is enabled by default and the path is set to the root field name.
+
+<img src="/img/dashboard/udg/datasources/graph-fieldmapping.png" alt="Create New API" />
+
+Other than this slight difference what's so special about the GraphQL Datasource to give it a dedicated name?
+
+The GraphQL Datasource will make specification-compliant GraphQL requests to your GraphQL upstream. When you attach a GraphQL Datasource to a field the Query planner of the Tyk GraphQL engine will collect all the sub fields of a root field in order to send the correct GraphQL query to the upstream. This means you can have multiple GraphQL and REST APIs side by side in the same schema, even nested, and the query planner will always send the correct query/request to each individual upstream to fetch all the data required to return a query response.
+
+**How does the query planner know which Datasource is responsible for a field?**
+
+When the query planner enters a field it will check if there is a Datasource attached to it.
+If that's the case this Datasource will be responsible for resolving this field.
+If there are multiple nested fields underneath this root field they will all be collected and provided to the root field Datasource.
+
+If however, one of the nested fields has another Datasource attached, ownership of the Datasource will shift to this new "root" field.
+After leaving this second root field ownership of the Datasource for resolving fields will again shift back to the first Datasource.
+
+#### GraphQL data source at type/field level
+
+In case you want to add GraphQL data source at a lower level of your schema - type/field - the configuration steps are as follows:
+
+1. Navigate to the field you want the GraphQL data source to be connected to and click on it.
+2. From the right-hand side menu choose **GraphQL | Tyk** or **External GraphQL** depending on wheather your data source was previously created in Tyk or if it's an external service.
+Provide a data source name and URL.
+
+Above steps are explained in detail in our [Getting started pages](/api-management/data-graph#connect-datasource).
+
+
+4. Tick the box next to `Add GraphQL operation` to see additional configuration fields. This will allow you to provide a query that will execute against the data source.
+5. Write the query in the `Operation` box and if you're using any variables provide those in `Variables` box.
+
+
+
+    <Note>
+    You can use objects from your Data Graph schema as variables by referring to them using this syntax: `{{.object.code}}`
+    </Note>
+
+
+
+<img src="/img/dashboard/udg/datasources/add_gql_operation.png" alt="Add GQL Operation" />
+
+### Kafka
+
+The Kafka DataSource is able to subscribe to Kafka topics and query the events with GraphQL.
+
+
+The Kafka DataSource utilizes consumer groups to subscribe to the given topics, and inherits all behavior of the consumer group concept.   
+
+Consumer groups are made up of multiple cooperating consumers, and the membership of these groups can change over time. Users can easily add a new consumer to the group to scale the processing load. A consumer can also go offline either for planned maintenance or due to an unexpected failure. Kafka maintains the membership of each group and redistributes work when necessary.   
+
+When multiple consumers are subscribed to a topic and belong to the same consumer group, each consumer in the group will receive messages from a different subset of the partitions in the topic. You should know that if you add more consumers to a single group with a single topic than you have partitions, some consumers will be idle and get no messages.  
+
+#### Basic Configuration
+
+You can find the full documentation for Kafka DataSource configuration here.
+
+**broker_addresses**
+In order to work with the Kafka DataSource, you first need a running Kafka cluster. The configuration takes a list of known broker addresses and discovers the rest of the cluster.
+
+``` bash
+{
+    "broker_addresses": ["localhost:9092"]
+}
+```
+
+**topics**
+The Kafka DataSource is able to subscribe to multiple topics at the same time but you should know that the structs of events have to match the same GraphQL schema.
+
+```bash
+{
+    "topics": ["product-updates"]
+}
+```
+
+**group_id**
+As mentioned earlier, the Kafka DataSource utilizes the consumer group concept to subscribe to topics. We use the `group_id` field to set the consumer group name.
+
+```bash
+{
+    "group_id": "product-updates-group"
+}
+```
+
+Multiple APIs can use the same `group_id` or you can run multiple subscription queries using the same API. Please keep in mind that the Kafka DataSource inherits all behaviors of the consumer group concept.
+
+**client_id**
+Finally, we need the `client_id` field to complete the configuration. It is a user-provided string that is sent with every request to the brokers for logging, debugging, and auditing purposes.
+
+```bash
+{
+    "client_id": "tyk-kafka-integration"
+}
+```
+
+Here is the final configuration for the Kafka DataSource:
+
+```bash
+{
+    "broker_addresses": ["localhost:9092"],
+    "topics": ["product-updates"],
+    "group_id": "product-updates-group",
+    "client_id": "tyk-kafka-integration"
+}
+```
+
+The above configuration object is just a part of the API Definition Object of Tyk Gateway.
+
+#### Kafka Datasource configuration via Dashboard
+
+1. Click on the field which should have Kafka datasource attached
+
+2. From the right-hand side *Configure data source* panel choose KAFKA at the bottom in the *Add a new external data source* section
+
+<img src="/img/dashboard/udg/datasources/kafka-config.png" alt="Kafkaconfig" /> 
+
+3. Provide datasource name, broker address (at least 1), topics (at least 1), groupID, clientID. Optionally you can also choose Kafka version, balance strategy and field mapping options. 
+
+4. Click *SAVE* button to persist the configuration.
+
+Once done the field you just configured will show information about data source type and name:
+
+<img src="/img/dashboard/udg/datasources/kafka-list.png" alt="KafkaList" /> 
+
+##### Subscribing to topics
+
+The `Subscription` type always defines the top-level fields that consumers can subscribe to. Let's consider the following definition:
+
+```bash
+type Product {
+  name: String
+  price: Int
+  inStock: Int
+}
+
+type Subscription {
+  productUpdated: Product
+}
+```
+
+The `productUpdated` field will be updated each time a product is updated. Updating a product means a `price` or `inStock` fields of `Product` are updated and an event is published to a Kafka topic.  Consumers can subscribe to the `productUpdated` field by sending the following query to the server:
+
+```bash
+subscription Products {
+    productUpdated {
+        name
+        price
+        inStock
+    }
+}
+```
+
+You can use any GraphQL client that supports subscriptions.
+
+##### Publishing events for testing
+
+In order to test the Kafka DataSource, you can publish the following  event to `product-updates` topic:
+
+```bash
+{
+    "productUpdated": {
+        "name": "product1",
+        "price": 1624,
+        "inStock": 219
+    }
+}
+```
+
+You can use any Kafka client or GUI to publish events to `product-updates`.
+
+When you change any of the fields, all subscribers of the `productUpdated`kafk field are going to receive the new product info.
+
+The result should be similar to the following:
+
+<img src="/img/2.10/kafka0.png" alt="API Menu" />
+
+
+##### API Definition for the Kafka DataSource
+
+The Kafka DataSource configuration:
+
+```bash
+{
+	"kind": "Kafka",
+	"name": "kafka-consumer-group",
+	"internal": false,
+	"root_fields": [{
+		"type": "Subscription",
+		"fields": [
+			"productUpdated"
+		]
+	}],
+	"config": {
+		"broker_addresses": [
+			"localhost:9092"
+		],
+		"topics": [
+			"product-updates"
+		],
+		"group_id": "product-updates-group",
+		"client_id": "tyk-kafka-integration"
+	}
+}
+```
+
+Here is a sample API definition for the Kafka DataSource.
+
+```bash
+{
+	"created_at": "2022-09-15T16:19:07+03:00",
+	"api_model": {},
+	"api_definition": {
+		"api_id": "7ec1a1c117f641847c5adddfdcd4630f",
+		"jwt_issued_at_validation_skew": 0,
+		"upstream_certificates": {},
+		"use_keyless": true,
+		"enable_coprocess_auth": false,
+		"base_identity_provided_by": "",
+		"custom_middleware": {
+			"pre": [],
+			"post": [],
+			"post_key_auth": [],
+			"auth_check": {
+				"name": "",
+				"path": "",
+				"require_session": false,
+				"raw_body_only": false
+			},
+			"response": [],
+			"driver": "",
+			"id_extractor": {
+				"extract_from": "",
+				"extract_with": "",
+				"extractor_config": {}
+			}
+		},
+		"disable_quota": false,
+		"custom_middleware_bundle": "",
+		"cache_options": {
+			"cache_timeout": 60,
+			"enable_cache": true,
+			"cache_all_safe_requests": false,
+			"cache_response_codes": [],
+			"enable_upstream_cache_control": false,
+			"cache_control_ttl_header": "",
+			"cache_by_headers": []
+		},
+		"enable_ip_blacklisting": false,
+		"tag_headers": [],
+		"jwt_scope_to_policy_mapping": {},
+		"pinned_public_keys": {},
+		"expire_analytics_after": 0,
+		"domain": "",
+		"openid_options": {
+			"providers": [],
+			"segregate_by_client": false
+		},
+		"jwt_policy_field_name": "",
+		"enable_proxy_protocol": false,
+		"jwt_default_policies": [],
+		"active": true,
+		"jwt_expires_at_validation_skew": 0,
+		"config_data": {},
+		"notifications": {
+			"shared_secret": "",
+			"oauth_on_keychange_url": ""
+		},
+		"jwt_client_base_field": "",
+		"auth": {
+			"disable_header": false,
+			"auth_header_name": "Authorization",
+			"cookie_name": "",
+			"name": "",
+			"validate_signature": false,
+			"use_param": false,
+			"signature": {
+				"algorithm": "",
+				"header": "",
+				"use_param": false,
+				"param_name": "",
+				"secret": "",
+				"allowed_clock_skew": 0,
+				"error_code": 0,
+				"error_message": ""
+			},
+			"use_cookie": false,
+			"param_name": "",
+			"use_certificate": false
+		},
+		"check_host_against_uptime_tests": false,
+		"auth_provider": {
+			"name": "",
+			"storage_engine": "",
+			"meta": {}
+		},
+		"blacklisted_ips": [],
+		"graphql": {
+			"schema": "type Product {\n  name: String\n  price: Int\n  inStock: Int\n}\n\ntype Query {\n    topProducts(first: Int): [Product]\n}\n\ntype Subscription {\n  productUpdated: Product\n}",
+			"enabled": true,
+			"engine": {
+				"field_configs": [{
+						"type_name": "Query",
+						"field_name": "topProducts",
+						"disable_default_mapping": false,
+						"path": [
+							"topProducts"
+						]
+					},
+					{
+						"type_name": "Subscription",
+						"field_name": "productUpdated",
+						"disable_default_mapping": false,
+						"path": [
+							"productUpdated"
+						]
+					}
+				],
+				"data_sources": [{
+						"kind": "GraphQL",
+						"name": "topProducts",
+						"internal": false,
+						"root_fields": [{
+							"type": "Query",
+							"fields": [
+								"topProducts"
+							]
+						}],
+						"config": {
+							"url": "http://localhost:4002/query",
+							"method": "POST",
+							"headers": {},
+							"default_type_name": "Product"
+						}
+					},
+					{
+						"kind": "Kafka",
+						"name": "kafka-consumer-group",
+						"internal": false,
+						"root_fields": [{
+							"type": "Subscription",
+							"fields": [
+								"productUpdated"
+							]
+						}],
+						"config": {
+							"broker_addresses": [
+								"localhost:9092"
+							],
+							"topics": [
+								"product-updates"
+							],
+							"group_id": "product-updates-group",
+							"client_id": "tyk-kafka-integration"
+						}
+					}
+				]
+			},
+			"type_field_configurations": [],
+			"execution_mode": "executionEngine",
+			"proxy": {
+				"auth_headers": {
+					"Authorization": "Bearer eyJvcmciOiI2MWI5YmZmZTY4OGJmZWNmZjAyNGU5MzEiLCJpZCI6IjE1ZmNhOTU5YmU0YjRmMDFhYTRlODllNWE5MjczZWZkIiwiaCI6Im11cm11cjY0In0="
+				}
+			},
+			"subgraph": {
+				"sdl": ""
+			},
+			"supergraph": {
+				"subgraphs": [],
+				"merged_sdl": "",
+				"global_headers": {},
+				"disable_query_batching": false
+			},
+			"version": "2",
+			"playground": {
+				"enabled": false,
+				"path": "/playground"
+			},
+			"last_schema_update": "2022-09-15T16:45:42.062+03:00"
+		},
+		"hmac_allowed_clock_skew": -1,
+		"dont_set_quota_on_create": false,
+		"uptime_tests": {
+			"check_list": [],
+			"config": {
+				"expire_utime_after": 0,
+				"service_discovery": {
+					"use_discovery_service": false,
+					"query_endpoint": "",
+					"use_nested_query": false,
+					"parent_data_path": "",
+					"data_path": "",
+					"cache_timeout": 60
+				},
+				"recheck_wait": 0
+			}
+		},
+		"enable_jwt": false,
+		"do_not_track": false,
+		"name": "Kafka DataSource",
+		"slug": "kafka-datasource",
+		"analytics_plugin": {},
+		"oauth_meta": {
+			"allowed_access_types": [],
+			"allowed_authorize_types": [],
+			"auth_login_redirect": ""
+		},
+		"CORS": {
+			"enable": false,
+			"max_age": 24,
+			"allow_credentials": false,
+			"exposed_headers": [],
+			"allowed_headers": [
+				"Origin",
+				"Accept",
+				"Content-Type",
+				"X-Requested-With",
+				"Authorization"
+			],
+			"options_passthrough": false,
+			"debug": false,
+			"allowed_origins": [
+				"*"
+			],
+			"allowed_methods": [
+				"GET",
+				"POST",
+				"HEAD"
+			]
+		},
+		"event_handlers": {
+			"events": {}
+		},
+		"proxy": {
+			"target_url": "",
+			"service_discovery": {
+				"endpoint_returns_list": false,
+				"cache_timeout": 0,
+				"parent_data_path": "",
+				"query_endpoint": "",
+				"use_discovery_service": false,
+				"_sd_show_port_path": false,
+				"target_path": "",
+				"use_target_list": false,
+				"use_nested_query": false,
+				"data_path": "",
+				"port_data_path": ""
+			},
+			"check_host_against_uptime_tests": false,
+			"transport": {
+				"ssl_insecure_skip_verify": false,
+				"ssl_min_version": 0,
+				"proxy_url": "",
+				"ssl_ciphers": []
+			},
+			"target_list": [],
+			"preserve_host_header": false,
+			"strip_listen_path": true,
+			"enable_load_balancing": false,
+			"listen_path": "/kafka-datasource/",
+			"disable_strip_slash": true
+		},
+		"client_certificates": [],
+		"use_basic_auth": false,
+		"version_data": {
+			"not_versioned": true,
+			"default_version": "",
+			"versions": {
+				"Default": {
+					"name": "Default",
+					"expires": "",
+					"paths": {
+						"ignored": [],
+						"white_list": [],
+						"black_list": []
+					},
+					"use_extended_paths": true,
+					"extended_paths": {
+						"ignored": [],
+						"white_list": [],
+						"black_list": [],
+						"transform": [],
+						"transform_response": [],
+						"transform_jq": [],
+						"transform_jq_response": [],
+						"transform_headers": [],
+						"transform_response_headers": [],
+						"hard_timeouts": [],
+						"circuit_breakers": [],
+						"url_rewrites": [],
+						"virtual": [],
+						"size_limits": [],
+						"method_transforms": [],
+						"track_endpoints": [],
+						"do_not_track_endpoints": [],
+						"validate_json": [],
+						"internal": []
+					},
+					"global_headers": {},
+					"global_headers_remove": [],
+					"global_response_headers": {},
+					"global_response_headers_remove": [],
+					"ignore_endpoint_case": false,
+					"global_size_limit": 0,
+					"override_target": ""
+				}
+			}
+		},
+		"jwt_scope_claim_name": "",
+		"use_standard_auth": false,
+		"session_lifetime": 0,
+		"hmac_allowed_algorithms": [],
+		"disable_rate_limit": false,
+		"definition": {
+			"enabled": false,
+			"name": "",
+			"default": "",
+			"location": "header",
+			"key": "x-api-version",
+			"strip_path": false,
+			"strip_versioning_data": false,
+			"versions": {}
+		},
+		"use_oauth2": false,
+		"jwt_source": "",
+		"jwt_signing_method": "",
+		"jwt_not_before_validation_skew": 0,
+		"use_go_plugin_auth": false,
+		"jwt_identity_base_field": "",
+		"allowed_ips": [],
+		"request_signing": {
+			"is_enabled": false,
+			"secret": "",
+			"key_id": "",
+			"algorithm": "",
+			"header_list": [],
+			"certificate_id": "",
+			"signature_header": ""
+		},
+		"org_id": "630899e6688bfe5fd6bbe679",
+		"enable_ip_whitelisting": false,
+		"global_rate_limit": {
+			"rate": 0,
+			"per": 0
+		},
+		"protocol": "",
+		"enable_context_vars": false,
+		"tags": [],
+		"basic_auth": {
+			"disable_caching": false,
+			"cache_ttl": 0,
+			"extract_from_body": false,
+			"body_user_regexp": "",
+			"body_password_regexp": ""
+		},
+		"listen_port": 0,
+		"session_provider": {
+			"name": "",
+			"storage_engine": "",
+			"meta": {}
+		},
+		"auth_configs": {
+			"authToken": {
+				"disable_header": false,
+				"auth_header_name": "Authorization",
+				"cookie_name": "",
+				"name": "",
+				"validate_signature": false,
+				"use_param": false,
+				"signature": {
+					"algorithm": "",
+					"header": "",
+					"use_param": false,
+					"param_name": "",
+					"secret": "",
+					"allowed_clock_skew": 0,
+					"error_code": 0,
+					"error_message": ""
+				},
+				"use_cookie": false,
+				"param_name": "",
+				"use_certificate": false
+			},
+			"basic": {
+				"disable_header": false,
+				"auth_header_name": "Authorization",
+				"cookie_name": "",
+				"name": "",
+				"validate_signature": false,
+				"use_param": false,
+				"signature": {
+					"algorithm": "",
+					"header": "",
+					"use_param": false,
+					"param_name": "",
+					"secret": "",
+					"allowed_clock_skew": 0,
+					"error_code": 0,
+					"error_message": ""
+				},
+				"use_cookie": false,
+				"param_name": "",
+				"use_certificate": false
+			},
+			"coprocess": {
+				"disable_header": false,
+				"auth_header_name": "Authorization",
+				"cookie_name": "",
+				"name": "",
+				"validate_signature": false,
+				"use_param": false,
+				"signature": {
+					"algorithm": "",
+					"header": "",
+					"use_param": false,
+					"param_name": "",
+					"secret": "",
+					"allowed_clock_skew": 0,
+					"error_code": 0,
+					"error_message": ""
+				},
+				"use_cookie": false,
+				"param_name": "",
+				"use_certificate": false
+			},
+			"hmac": {
+				"disable_header": false,
+				"auth_header_name": "Authorization",
+				"cookie_name": "",
+				"name": "",
+				"validate_signature": false,
+				"use_param": false,
+				"signature": {
+					"algorithm": "",
+					"header": "",
+					"use_param": false,
+					"param_name": "",
+					"secret": "",
+					"allowed_clock_skew": 0,
+					"error_code": 0,
+					"error_message": ""
+				},
+				"use_cookie": false,
+				"param_name": "",
+				"use_certificate": false
+			},
+			"jwt": {
+				"disable_header": false,
+				"auth_header_name": "Authorization",
+				"cookie_name": "",
+				"name": "",
+				"validate_signature": false,
+				"use_param": false,
+				"signature": {
+					"algorithm": "",
+					"header": "",
+					"use_param": false,
+					"param_name": "",
+					"secret": "",
+					"allowed_clock_skew": 0,
+					"error_code": 0,
+					"error_message": ""
+				},
+				"use_cookie": false,
+				"param_name": "",
+				"use_certificate": false
+			},
+			"oauth": {
+				"disable_header": false,
+				"auth_header_name": "Authorization",
+				"cookie_name": "",
+				"name": "",
+				"validate_signature": false,
+				"use_param": false,
+				"signature": {
+					"algorithm": "",
+					"header": "",
+					"use_param": false,
+					"param_name": "",
+					"secret": "",
+					"allowed_clock_skew": 0,
+					"error_code": 0,
+					"error_message": ""
+				},
+				"use_cookie": false,
+				"param_name": "",
+				"use_certificate": false
+			},
+			"oidc": {
+				"disable_header": false,
+				"auth_header_name": "Authorization",
+				"cookie_name": "",
+				"name": "",
+				"validate_signature": false,
+				"use_param": false,
+				"signature": {
+					"algorithm": "",
+					"header": "",
+					"use_param": false,
+					"param_name": "",
+					"secret": "",
+					"allowed_clock_skew": 0,
+					"error_code": 0,
+					"error_message": ""
+				},
+				"use_cookie": false,
+				"param_name": "",
+				"use_certificate": false
+			}
+		},
+		"strip_auth_data": false,
+		"id": "6323264b688bfe40b7d71ab3",
+		"certificates": [],
+		"enable_signature_checking": false,
+		"use_openid": false,
+		"internal": false,
+		"jwt_skip_kid": false,
+		"enable_batch_request_support": false,
+		"enable_detailed_recording": false,
+		"scopes": {
+			"jwt": {},
+			"oidc": {}
+		},
+		"response_processors": [],
+		"use_mutual_tls_auth": false
+	},
+	"hook_references": [],
+	"is_site": false,
+	"sort_by": 0,
+	"user_group_owners": [],
+	"user_owners": []
+}
+```
+
+### REST
+
+The REST Datasource is a base component of UDG to help you add existing REST APIs to your data graph. By attaching a REST datasource to a field the engine will use the REST resource for resolving.
+
+<Note>
+REST data sources only support **Query** and **Mutation** operations. **Subscriptions** (including SSE and WebSockets) are **not supported** for REST kind data sources.
+
+To use GraphQL subscriptions with UDG (including SSE), you must use a data source of kind **GraphQL** or **Kafka**. See [GraphQL Subscriptions](/api-management/graphql#graphql-subscriptions) for details on configuring SSE subscriptions with a GraphQL data source.
+</Note>
+
+We have a video which demoes this functionality for you.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/PEwG8F8PxUs" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+#### Using external REST API as a Datasource
+
+In order to use an external REST API as a Datasource you need to first navigate to the field which that Datasource should be attached to. 
+
+1. Click on the field which should have a datasource attached
+2. From the right-hand side *Configure data source* panel choose REST at the bottom in the *Add a new external data source* section
+
+<img src="/img/dashboard/udg/datasources/external-rest-config.png" alt="ExternalREST" />
+
+3. Provide data source name, URL, method to be used. Optionally you can add headers information and configure field mapping 
+
+<img src="/img/dashboard/udg/datasources/rest-datasource.png" alt="ExternalRESTdetail" />
+
+4. Click the *Save & Update API* button to persist the configuration and generate a REST resolver, to  resolve this field at runtime.
+
+#### Using Tyk REST API as a Datasource
+
+1. Click on the field which should have a datasource attached
+2. From the right-hand side *Configure data source* panel choose *REST | Tyk* dropdown to see all available APIs
+
+<img src="/img/dashboard/udg/datasources/rest-internal-config.png" alt="InternalREST" />
+
+3. Choose which Tyk REST API you want to attach
+4. Provide data source name, endpoint and method to be used. Optionally you can add headers information and configure field mapping
+
+<img src="/img/dashboard/udg/datasources/tyk-rest-datasource.png" alt="InternalRESTdetail" />
+
+5. Click the *Save & Update API* button to persist the configuration and generate a REST resolver, to resolve this field at runtime.
+
+Once done the field you just configured will show information about data source type and name:
+
+<img src="/img/dashboard/udg/datasources/datasources-list.png" alt="datasourcesList" />
+
+#### Automatically creating REST UDG configuration based on OAS specification
+
+Tyk Dashboard users have an option to use Tyk Dashboard API and quickly transform REST API OAS specification into a UDG config and have it published in the Dasboard within seconds.
+
+See our [Postman collections](https://www.postman.com/tyk-technologies/workspace/tyk-public-workspace/overview) and fork `Tyk Dashboard API v5.1`.
+
+The endpoint you need to use is:
+
+```bash
+POST /api/data-graphs/data-sources/import
+```
+
+Request body:
+
+```json
+{
+    "type": "string",
+    "data": "string"
+}
+```
+
+`type` is an enum with the following possible values:
+
+- openapi
+- asyncapi
+
+To import an OAS specification you need to choose `openapi`.
+
+If you are using Postman and your OAS document is in `yaml` format you can use a simple pre-request script to transform it into a `string`.
+
+```bash
+pm.environment.set("oas_document", JSON.stringify(`<your_yaml_goes_here>`))
+```
+
+Then your request body will look like this:
+
+```json
+{
+    "type": "openapi",
+    "data": {{oas_document}}
+}
+```
+
+### Tyk
+
+Tyk DataSources are exactly the same as GraphQL or REST DataSources.
+
+The only difference is that you can directly choose an endpoint from your existing APIs using a drop-down.
+This makes it easier to set up and prevents typos compared to typing in the URL etc.
+
+From a technical perspective there's another difference:
+
+Tyk DataSources make it possible to call into existing APIs on a Tyk Gateway, even if those are marked as internal.
+They also add a lot of flexibility as you can add custom middleware, AuthZ as well as AuthN, rate limits, quotas etc. to these.
+
+In general, it is advised to first add all APIs you'd wish to add to a data graph as a dedicated API to Tyk.
+Then in a second step you'd add these to your data graph.
+
+Then in a second step you'd add these to your data graph.
+
+
+<Note>
+As of `v3.2.0` internal datasorces (`TykRESTDataSource` and `TykGraphQLDataSource`) will be deprecated at the API level. Please use `HTTPJSONDataSource` or `GraphQLDataSource` respectively.
+</Note>
+
+
+## Getting Started
+
+### Overview
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/TGITEGnJH6c" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> 
+
+In this getting started tutorial we will combine 2 different HTTP services (Users and Reviews) into one single unified UDG API. Instead of querying these two services separately (and probably merging their responses later) we'll use UDG to get result from both the API's in one single response.
+
+#### Prerequisites 
+
+- Access to Tyk Dashboard
+- Node.JS v.13^ (only to follow this example)
+
+#### Running example services locally
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/9UEgR0VTVmE" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> 
+
+Clone repo
+
+```bash
+git clone https://github.com/jay-deshmukh/example-rest-api-for-udg.git
+```
+
+Run it locally
+```bash
+cd example-rest-api-for-udg
+```
+
+```bash
+npm i
+```
+
+```bash
+npm run build
+```
+
+```bash
+npm start
+```
+
+You should see following in your terminal
+
+```
+Users Service Running on http://localhost:4000
+Review service running on http://localhost:4001
+```
+
+<hr/>
+
+Now that we have Users service running on port `4000` and Reviews service running on port `4001` let's see how we can combine these two into one single UDG API in following tutorial.
+
+
+### Creating Schema
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/ocdY0IKwX_I" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> 
+
+1. Create API
+
+To start with a Universal Data Graph from scratch head over to the dashboard and click on “APIs” in the left menu. Then click the `“Add New API”` and `UDG`. You might want to give your Universal Data Graph an individual name (i.e. `User-Reviews-Demo`)
+
+
+2. Set Authentication
+
+To get started easily we'll set the API to `Keyless(Open)`. To do this, scroll down to the Authentication section.
+
+
+<Note>
+The API authentication is set to Keyless for demo purposes, it’s not recommended to use this setting in production, we’ll explore how to secure the UDG later in this guide.
+</Note>
+
+
+3. Configure Schema
+
+Switch to schema tab in your designer and you should already see a default schema. We will edit the schema as follows to connect with our datasources later.
+
+```gql
+type Mutation {
+  default: String
+}
+
+type Query {
+  user(id: String): User
+}
+
+type Review {
+  id: String
+  text: String
+  userId: String
+  user: User
+}
+
+type User {
+  id: String
+  username: String
+  reviews: [Review]
+}
+
+```
+
+You can also import an existing schema using the import feature, file types supported :  `gql` , `graphql` and `graphqls`.
+
+4. Save
+
+Click on save button and that should create our first UDG API
+
+<hr/>
+
+Now if we try to query our UDG API it should error at this moment as we do not have any data-source attached to it, let's see how we can do that in next section.
+
+### Connect Datasource
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/tjzjaykQqkg" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> 
+
+Upon navigating to schema tab on API details page you’ll see a split screen view with schema and user interface for available fields to configure the datasource.
+
+You can attach datasource to each individual field and can also re-use the datasource for multiple fields for performance benefits in case it has similar configuration (it needs to use the same upstream URL and method).
+
+We will start with attaching datasource to user query using following approach. 
+
+#### 1. Select field to attach datasource.
+Upon selecting the `Users` field on type `Query`, you'll see the options to configure that field for following kinds of datasources.
+
+* REST
+* GraphQL
+* Kafka
+
+#### 2. Select datasource type.
+
+Since our upstream services are REST, we'll select REST as datasource type but other kind of datasources can be used as well:
+
+* *Use external data source*: Will allow to configure the field to resolve with the external API (outside Tyk environment)
+* *Using exiting APIs*: Which will allow to configure the field with the API that already exists in Tyk environment.
+* *Re-use already configured data source*: If you already have configured a data source for the same API you can re-use the same data-source. If the data source is reused the endpoint will only be called once by Tyk.
+
+You can learn more about it [here](#udg)
+
+#### 3. Configure datasource details.
+
+Configure the data source with the following fields
+
+**Name**
+
+ Enter a unique datasource name configuration to reuse it in the future. We will name this as `getUserById` for the given example.
+When configuring a datasource name with Tyk Dashboard, a default name is created automatically by concatenating the field name and the GraphQL type name with an underscore symbol in between. For example, _getUserById_Query_. This name is editable and can be changed by the user.
+
+**URL**
+
+We will use the URL for our `Users` service which returns details of an user for given `id` i.e `http://localhost:4000/users/:id`.
+
+To dynamically inject the `id` for every request made, we can use templating syntax and inject `id` with user supplied argument or we can also use session object.
+
+To avoid typos in template you can use the UI component to automatically create a template for you. You can select from the available argument and object template options from the list generated by input component which is triggered by entering `{` in input.
+
+To learn more about arguments click [here](#arguments)
+
+To learn more about reusing response fields click [here](#reusing-response-fields)
+
+#### 4. Enter datasource name.
+
+Enter a unique datasource name your configuration to reuse it in the future. We will name this as `getUserById` for the given example
+
+#### 5. Select HTTP method for the URL.
+
+You can select the HTTP method for your upstream url. Which should be `GET` in our case.
+
+#### 6. Add headers (Optional)
+
+If you upstream expects headers, you can supply them using this.
+You can also use templating syntax here to reuse request headers.
+
+#### 7. Select field mapping
+
+Keep the field mapping disabled by default.
+You can use field mapping to map the API response with your schema.
+
+You can learn more about field mapping [here](#field-mappings)
+
+#### 8. Save data source
+
+It is important to save the datasource configuration in order to reflect the changes in your API definition.
+The` “Save & Update API” `button will persist the full API definition.
+
+#### 9. Update API and Test
+
+Click Update the API.
+
+You can now query your UDG API of `user` using the Playground tab in API designer
+
+```gql
+query getUser {
+  user(id:"1"){
+    username
+    id
+    reviews {
+      id
+      text
+      user {
+        id
+      }
+      
+    }
+  }
+}
+```
+
+The above query should return the response as follows 
+
+```json
+{
+  "data": {
+    "user": {
+      "username": "John Doe",
+      "id": "1",
+      "reviews": null
+    }
+  }
+}
+```
+
+#### Challenge
+
+1. Try to resolve `reviews` field on type `Users`
+2. Try to resolve `users` field on type `Reviews`
+
+As you can see our query resolved for user details but returns `null` for `reviews`. 
+
+This happens because we haven't defined datasource on field level for `reviews` on type `User`. 
+
+```
+Notes
+- For reviews field on type User
+- - Description :: get reviews by userId
+- - URL :: http://localhost:4001/reviews/:userId
+- - Method :: GET
+
+- For users field on type Review
+- - Description :: get user details by Id
+- - URL :: http://localhost:4000/users/:userId
+- - Method :: GET
+
+- You can reuse response filed using templating syntax example `{{.object.id}}`
+```
+
+
+<Note>
+You can find the solution for the challenge in the above video.
+</Note>
+
+
+<hr />
+
+Now that we have linked datasources for our queries, let's see how we can do the same for mutations in the next section.
+
+
+### Mutations
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/za2KdDQSCnI" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> 
+
+Now that we have attached datasources to our `Query` in the schema let's try to do the same for `Mutation`.
+
+#### Steps for Configuration
+
+1. **Update Schema**
+
+    ```gql
+    type Mutation {
+    addReview(text: String, userId: String): Review
+    deletReview(reviewId: String): String
+    }
+    ```
+
+    We’ll update the Mutatation type as above where we’ll add two operations 
+
+    * `addReview`: Which accepts two `arguments` (i.e `text` and `userId`) and adds a new review by making a `POST` request to `http://localhost:4001/reviews` endpoint, which expects something like the following in the request payload 
+
+    ```
+    {
+        "id": "1", // UserId of the user posting review 
+        "text": "New Review by John Doe11" // review text
+    }
+    ```
+    * `deleteReview`: Which accepts one `argument` (i.e `reviewId`), that deletes a review by making a `DELETE` request to `http://localhost:4001/reviews/:reviewId`
+
+2. **Configure datasource.**
+
+    Follow these steps to configure a data source for the `Mutation`.
+
+    * Navigate to schema tab in the api where you would see the split screen view of schema editor on left and list of configurable fields on right
+    * Select `addReview` field from `Mutation` type
+    * Select `REST` option
+    * Set a unique datasource name
+    * Set the URL as `http://localhost:4001/reviews`
+    * Select method type as `POST`
+    * Set request body to relay the graphql arguments to our upstream payload as follows:
+
+    ```
+    {
+        "text": "{{.arguments.text}}",
+        "userId": "{{.arguments.userId}}"
+        }
+    ```
+    * Update the API
+
+3. **Execute mutation operation**
+
+    We can now test our mutation operation with the playground in API designer using the following operation
+
+    ```gql
+    mutation AddReview {
+    addReview(text: "review using udg", userId:"1"){
+        id
+        text
+    }
+    }
+    ```
+
+    That should return us the following response:
+
+    ```gql
+    {
+    "data": {
+        "addReview": {
+        "id": "e201e6f3-b582-4772-b95a-d25199b4ab82",
+        "text": "review using udg"
+        }
+    }
+    }
+
+    ```
+
+
+#### Challenge
+
+Configure a datasource to delete a review using review id.
+
+```
+Notes
+
+- For users field on type Review
+- - Description :: delete review using reviewId
+- - URL :: http://localhost:4001/reviews/:reviewId
+- - Method :: DELETE
+
+- Enable field mapping to map your API response 
+
+```
+
+<Note>
+You can find the solution for the challenge in the above video.
+</Note>
+
+
+<hr />
+
+Now that we have a good idea how we could do CRUD operations with UDG APIs, let's see how we can secure them using policies
+
+### Security
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/lRLLFLv2rN4" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> 
+
+Due to the nature of graphql, clients can craft complex or large queries which can cause your upstream APIs to go down or have performance issues.
+
+Some of the common strategies to mitigate these risks include 
+
+- Rate limiting
+- Throttling
+- Query depth limiting
+
+
+For this tutorial we'll mitigate these risks using `Query Depth Limit` but you can also use common strategies like rate limiting and throttling, which you can read more about [here](/api-management/rate-limit)
+
+#### Steps for Configuration
+
+1. **Set authentication mode**
+
+    In you Api designer core settings tab scroll down to Authentication section and set the authentication mode `Authentication Token` and update the API.
+
+    Our API is not open and keyless anymore and would need appropriate Authentication token to execute queries.
+
+2. **Applying to query depth**
+
+    Currently if users want they could run queries with unlimited depth as follows 
+
+    ```gql
+    query getUser {
+    user(id: "1") {
+        reviews {
+        user {
+            reviews {
+            user {
+                reviews {
+                user {
+                    reviews {
+                    user {
+                        id
+                    }
+                    }
+                }
+                }
+            }
+            }
+        }
+        }
+    }
+    }
+
+    ```
+
+    To avoid these kind of scenarios we will set query depth limit on the keys created to access this API.
+
+    Although we can directly create keys by selecting this API but we'll use a Policy as it will make it easier to update keys for this API in future. You can read more about Policies [here](/api-management/policies)
+
+    **Create Policy**
+    - Navigate to policies page
+    - Click Add Policy
+    - Select our API from Access Rights table
+    - Expand `Global Limits and Quota` section
+    - Unselect `Unlimited Query Depth` and set limit to `5`
+    - Switch to configuration tab
+    - Set policy name (eg. user-reviews-policy)
+    - Set expiration date for the keys that would be created using this policy
+    - Click on create policy
+
+    **Create a key using above policy**
+    - Navigate to keys page
+    - Click Add Key
+    - Select our newly created policy
+    - Click create key
+    - Copy the key ID
+
+    Now if you try to query our UDG API using the  key you should see an error as follows
+
+    ```json
+    {
+    "error": "depth limit exceeded"
+    }
+    ```
+
+    
+<Note>
+Watch the video above to see how you can use these policies to publish your UDG APIs on your portal with documentation and playground.
+</Note>
+
+
+### Field Based Permissions
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/EBza1BFegrk" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> 
+
+It is also possible to restrict user's based on fields using policies. For example you can create two policies 
+
+1. For read-only access for users to only execute queries.
+
+2. For read and write access to run mutations and queries both. 
+
+#### Creating keys with read-only access
+
+**Create Policy**
+
+- Navigate to policies page
+- Click Add Policy
+- Select our API from Access Rights table
+- Expand Api panel under global section
+- Toggle Field-Based Permissions and check Mutation
+- Switch to configuration tab
+- Set policy name (eg. user-reviews-policy-read-only)
+- Set expiration date for the keys that would be created using this policy
+- Click on create policy
+
+Now keys created using these policies cannot be used for mutations.
+
+### Header Forwarding
+
+**Min Version: Tyk v3.2.0**
+
+You’re able to configure upstream Headers dynamically, that is, you’re able to inject Headers from the client request into UDG upstream requests. For example, it can be used to access protected upstreams.
+
+The syntax for this is straight forward:
+
+```
+{{.request.headers.someheader}}
+```
+
+  In your data sources, define your new Header name and then declare which request header's value to use:
+
+  <img src="/img/dashboard/udg/getting-started/request-forward-syntax.png" alt="Forwarding Headers" />
+
+  That's it!
+
+  
+<Note>
+A JSON string has to be escaped before using as a header value. For example:
+```
+{\"hello\":\"world\"}
+```
+</Note>
+
+
+### UDG Examples
+
+It is possible to import various UDG examples from the [official Tyk examples repository](https://github.com/TykTechnologies/tyk-examples).
+
+We offer 3 ways of importing an example into Tyk:
+ - Using [tyk-sync](/api-management/sync/use-cases#synchronize-api-configurations-with-github-actions)
+ - Manually import via [Dashboard API Import](/api-management/gateway-config-managing-classic#import-an-api)
+- Using Tyk Dashboard to browse and import the examples directly
+
+#### Import via tyk-sync
+
+Please follow the [tyk-sync documentation](/product-stack/tyk-sync/commands#examples-publish-command) to learn more about this approach.
+
+#### Import via Tyk Dashboard API Import
+
+Navigate to an example inside the [examples repository](https://github.com/TykTechnologies/tyk-examples) and grab the relevant API definition from there.
+Then you can move in the Dashboard UI to `APIs -> Import API` and select `Tyk API` as source format.
+
+Paste the API definition inside the text box and hit `Import API`.
+
+You can find more detailed instructions in the [Dashboard API Import documentation section](/api-management/gateway-config-managing-classic#import-an-api).
+
+#### Import via Tyk Dashboard UI
+
+Navigate to `Data Graphs` section of the Tyk Dashboard menu. If you haven't yet created any Universal Data Graphs you will see three options in the screen - one of them `Try example data graph` - will allow you to browse all examples compatible with your Dashboard version and choose the one you want to import.
+
+<img src="/img/dashboard/udg/getting-started/example data graph.png" alt="Examples in Dashboard" />
+
+In case you have created data graphs before and your screen looks different, just use the `Add Data Graph` button and in the next step decide if you want to create one yourself, or use one of the available examples.
+
+<img src="/img/dashboard/udg/getting-started/data graph example new graph menu.png" alt="Examples in Dashboard New Graph" />
+## Data Graphs API
+
+Currently `/api/data-graphs/` has only one endpoint called `/data-sources` with only a `POST` HTTP method.
+
+The Dashboard exposes the `/api/data-graphs/data-sources/import` endpoint which allows you to import an [AsyncAPI](https://www.asyncapi.com/docs/reference/specification/v3.0.0) or [OpenAPI](https://swagger.io/specification/) document.
+
+### Supported AsyncAPI versions
+* 2.0.0
+* 2.1.0
+* 2.2.0
+* 2.3.0
+* 2.4.0
+
+### Supported OpenAPI versions
+* 3.0.0
+
+### Import a document from a remote resource
+
+| **Property** | **Description**                            |
+| :-------------- | :-------------------------------------------- |
+| Resource URL | `/api/data-graphs/data-sources/import`     |
+| Method       | `POST`                                     |
+| Content-Type  | `application/json`                        |
+| Body         | `{`<br/>` "url": "resource URL" `<br/>`}`  |
+
+The fetched document can be an OpenAPI or AsyncAPI document. The format will be detected automatically. The data source import API only checks the fetched data and tries to determine the document format, the status codes are ignored. 
+It returns an error if it fails to determine the format and the document type. HTTP 500 is returned if a programming or network error occurs. If the fetched request body is malformed then HTTP 400 is returned.
+
+### Import an OpenAPI document
+
+The data source import API supports importing OpenAPI documents. The document can be used as a request body.
+
+| **Property** | **Description**                           |
+| :-------------- | :------------------------------------------- |
+| Resource URL | `/api/data-graphs/data-sources/import`    |
+| Method       | `POST`                                    |
+| Content-Type  | `application/vnd.tyk.udg.v2.openapi`     |
+| Body         | `<OpenAPI Document>`                   |
+
+
+The document can be in JSON or YAML format. The import API can determine the type and parse it.
+
+### Import an AsyncAPI document
+
+The data source import API supports importing AsyncAPI documents. The document can be used as a request body.
+
+| **Property** | **Description**                        |
+| :-------------- | :---------------------------------------- |
+| Resource URL | `/api/data-graphs/data-sources/import` |
+| Method       | `POST`                                 |
+| Content-Type | `application/vnd.tyk.udg.v2.asyncapi`  |
+| Body         | `<AsyncAPI Document>`                  |
+
+The document can be in JSON or YAML format. The import API can determine the type and parse it.
+
+### Response Structure
+
+The response structure is consistent with other endpoints, as shown in the table below:
+
+| **Property** | **Description**                                       |
+| :-------------- | :------------------------------------------------------- |
+| Status       | `Error` or `OK`                                       |
+| Message      | Verbal explanation                                    |
+| Meta         | API ID for success and `null` with error (not in use) |
+
+**Sample Response**
+
+```json
+{
+    "Status": "OK",
+    "Message": "Data source imported",
+    "Meta": "64102568f2c734bd2c0b8f99"
+}
+```
+
diff --git a/api-management/enable-audit-logs-dashboard.mdx b/api-management/enable-audit-logs-dashboard.mdx
new file mode 100644
index 0000000000..4d687073aa
--- /dev/null
+++ b/api-management/enable-audit-logs-dashboard.mdx
@@ -0,0 +1,157 @@
+---
+title: "Enable and View Audit Logs in Tyk Dashboard"
+description: "Learn how to enable audit logging in Tyk Dashboard using database storage and view audit logs through the Dashboard UI."
+keywords: "Audit Logs, Tyk Dashboard, database storage, compliance, security, self-managed"
+sidebarTitle: "Enable Audit Logs"
+---
+
+## Availability
+
+| Component | Version | Edition |
+| :-------- | :------ | :------- |
+| Tyk Dashboard | Available since [v5.7.0](/developer-support/release-notes/dashboard#5-7-0-release-notes) | Enterprise |
+
+## Prerequisites
+
+1. **Dashboard License**: [Contact our team](https://tyk.io/contact/) to obtain a license or get a self-managed trial license by completing the registration on our [website](https://tyk.io/self-managed-trial/).
+2. **Working Tyk Environment**: You need access to a running Tyk instance. For quick setup instructions using Docker, please refer to the [Tyk Getting Started Guide](/getting-started/quick-start).
+3. **Admin Access**: You need admin permissions to configure audit logging and access audit log data.
+
+## What We Will Do
+
+In this guide, we will:
+1. Enable [audit logs in Tyk Dashboard](/api-management/logs/audit-logs) using the [database storage](/api-management/logs/audit-logs#audit-log-storage) option
+2. View the audit logs through the Dashboard UI
+3. Learn how to [access audit logs via the API](/api-management/logs/audit-logs#viewing-and-retrieving-audit-logs)
+
+<Note>
+This guide is focused on **self-managed / on-premise** installations. For Tyk Cloud deployments, refer to the [Tyk Cloud Audit Logs guide](/api-management/cloud/audit-logs).
+</Note>
+
+## Instructions
+
+### 1. Configure Audit Logging with Database Storage
+
+To enable audit logging with database storage, you need to update your Tyk Dashboard configuration. Database storage is recommended as it enables viewing logs directly in the Dashboard UI.
+
+<Tabs>
+<Tab title="Configuration File">
+
+Add the following `audit` section to your `tyk_analytics.conf` file:
+
+```json
+{
+  "audit": {
+    "enabled": true,
+    "format": "json",
+    "store_type": "db",
+    "detailed_recording": false
+  }
+}
+```
+
+</Tab>
+<Tab title="Environment Variables">
+
+Set the following environment variables:
+
+```bash
+TYK_DB_AUDIT_ENABLED=true
+TYK_DB_AUDIT_FORMAT=json
+TYK_DB_AUDIT_STORETYPE=db
+TYK_DB_AUDIT_DETAILEDRECORDING=false
+```
+
+</Tab>
+</Tabs>
+
+For more information on configuration options and default values, refer to the [Audit Logs Configuration Reference](/tyk-dashboard/configuration#audit).
+
+### 2. Restart Tyk Dashboard
+
+After updating the configuration, restart your Tyk Dashboard service for the changes to take effect:
+
+```bash
+# For systemd
+sudo systemctl restart tyk-dashboard
+
+# For Docker
+docker restart tyk-dashboard
+
+# For Kubernetes
+kubectl rollout restart deployment tyk-dashboard -n tyk
+```
+
+### 3. View Audit Logs in Dashboard UI
+
+Once audit logging is enabled with database storage, you can view logs directly in the Dashboard:
+
+1. Log in to your Tyk Dashboard
+2. Interact with the system (e.g., create/update APIs, users, policies) to generate audit log entries
+3. Go to **System Management** > **Audit Logs** to see the recorded logs
+4. Use the available filters to search and filter logs:
+   - **Date range**: Filter logs by time period
+   - **User**: Filter by the user who performed the action
+   - **IP address**: Filter by the originating IP address
+   - **HTTP method**: Filter by http method
+
+    <img src="/img/dashboard/dashboard-audit-logs.png" alt="Dashboard Audit Logs" />
+
+### 5. Access Audit Logs via API
+
+You can also retrieve audit logs programmatically using the Dashboard API:
+
+```bash
+curl -X GET "https://your-dashboard.com/api/audit-logs" \
+  -H "Authorization: Bearer YOUR_API_KEY" \
+  -H "Content-Type: application/json"
+```
+
+For more information on the API endpoint, refer to the [Dashboard API Reference](https://tyk.io/docs/api-reference/auditlogs/list-audit-logs).
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title='Permission Denied When Accessing Audit Logs'>
+
+Users need the appropriate RBAC permissions to view audit logs.
+
+#### Via Dashboard UI
+
+1. Navigate to **Users** in your Tyk Dashboard
+2. Select the user you want to grant access
+3. In the **Permissions** section, enable **Audit Logs** with `read` access
+4. Save the user
+
+#### Via Dashboard API
+
+Include `audit_logs` in the user's permissions object when creating or updating a user:
+
+```json
+{
+  "user_permissions": {
+    "IsAdmin": "false",
+    "analytics": "read",
+    "apis": "write",
+    "audit_logs": "read"
+  }
+}
+```
+
+<Note>
+Only `read` access is available for audit logs. Write or delete operations are not permitted to maintain audit integrity.
+</Note>
+
+</Accordion>
+
+<Accordion title='Audit Logs Not Appearing'>
+
+1. **Verify configuration**: Ensure `audit.enabled` is set to `true` in your configuration
+2. **Check storage type**: Confirm `audit.store_type` is set to `db` for UI access
+3. **Restart Dashboard**: Configuration changes require a restart to take effect
+4. **Check version**: Database storage requires Tyk Dashboard v5.7.0 or later
+
+</Accordion>
+
+</AccordionGroup>
diff --git a/api-management/endpoint-designer.mdx b/api-management/endpoint-designer.mdx
new file mode 100644
index 0000000000..47ac5b1e33
--- /dev/null
+++ b/api-management/endpoint-designer.mdx
@@ -0,0 +1,101 @@
+---
+title: "API Endpoint Designer"
+description: "Learn how to use the Tyk Dashboard's API Endpoint Designer, a graphical environment for configuring your Tyk Classic APIs"
+keywords: "Endpoint Designer, Tyk Classic, API Designer, Core Settings, Versions, Advanced Options, Uptime Tests, Debugging"
+sidebarTitle: "Endpoint Designer"
+---
+
+## Classic APIs
+
+Tyk Dashboard's Endpoint Designer provides a graphical environment for the creation and update of your Tyk Classic APIs.
+
+The Endpoint Designer allows to configure all elements of your Tyk Classic API and consists of several tabs, plus a **Raw Definition** view which allows you to directly edit the Tyk Classic API Definition (in JSON format). Note that 
+
+## Core Settings
+
+<img src="/img/dashboard/endpoint-designer/classic-endpoint-designer-core.png" alt="The Tyk Classic Endpoint Designer - Core Settings tab" />
+
+The **Core Settings** tab provides access to configure basic settings for the API:
+- [Detailed logging](/api-management/logs/traffic-logs#detailed-recording)
+- API Settings including
+   - Listen path
+   - [API Categories](/platform-management/api-categories)
+- Upstream settings including
+   - Upstream service (target) URL
+   - [Service Discovery](/planning-for-production/ensure-high-availability/service-discovery)
+- [API Ownership](/platform-management/api-ownership)
+- [API level rate limiting](/api-management/rate-limit#configuring-the-rate-limiter-at-the-api-level)
+- [Authentication](/api-management/client-authentication)
+
+## Versions
+
+<img src="/img/dashboard/endpoint-designer/classic-endpoint-designer-versions.png" alt="The Tyk Classic Endpoint Designer - Versions tab" />
+
+The **Versions** tab allows you to create and manage [API versioning](/api-management/gateway-config-tyk-classic#tyk-classic-api-versioning) for the API.
+
+At the top of the Endpoint Designer, you can see which version you are currently editing. If you have more than one option, selecting it from the drop-down will load its endpoint configuration into the editor.
+
+## Endpoint Designer
+
+<img src="/img/dashboard/endpoint-designer/classic-endpoint-designer-endpoint.png" alt="The Tyk Classic Endpoint Designer - Endpoint Designer tab" />
+
+The **Endpoint Designer** is where you can define endpoints for your API so that you can enable and configure Tyk middleware to [perform checks and transformations](/api-management/traffic-transformation) on the API traffic.
+
+In some cases, you will want to set global settings that affect all paths that are managed by Tyk. The **Global Version Settings** section will enable you to configure API-level [request](/api-management/traffic-transformation/request-headers#tyk-classic-api) and [response](/api-management/traffic-transformation/request-headers#tyk-classic-api) header transformation.
+
+## Advanced Options
+
+<img src="/img/dashboard/endpoint-designer/classic-endpoint-designer-advanced.png" alt="The Tyk Classic Endpoint Designer - Advanced Options tab" />
+
+The **Advanced Options** tab is where you can configure Tyk's other powerful features including:
+- Upstream certificate management
+- [API-level caching](/api-management/response-caching#configuring-the-cache-via-the-dashboard) including a button to invalidate (flush) the cache for the API
+- [CORS](/api-management/gateway-config-tyk-classic#cross-origin-resource-sharing-cors)
+- Add custom attributes to the API definition as *config data* that can be accessed by middleware
+- Enable [context variables](/api-management/traffic-transformation/request-context-variables) so that they are extracted from requests and made available to middleware
+- Manage *segment tags* if you are working with [sharded gateways](/api-management/api-sharding#gateway-sharding)
+- Manage client IP address [allow](/api-management/gateway-config-tyk-classic#ip-access-control) and [block](/api-management/gateway-config-tyk-classic#ip-access-control) lists
+- Attach [webhooks](/api-management/gateway-events#event-handling-with-webhooks) that will be triggered for different events
+
+## Uptime Tests
+
+<img src="/img/dashboard/endpoint-designer/classic-endpoint-designer-uptime.png" alt="The Tyk Classic Endpoint Designer - Uptime Tests tab" />
+
+In the **Uptime Tests** tab you can configure Tyk's [Uptime Test](/api-management/gateway-config-tyk-classic#uptime-tests) functionality
+
+## Debugging
+
+<img src="/img/dashboard/endpoint-designer/classic-endpoint-designer-debugging.png" alt="The Tyk Classic Endpoint Designer - Debugging tab" />
+
+The **Debugging** tab allows you to test your endpoints before you publish or update them. You can also use it for testing any middleware plugins you have implemented. Any debugging you create will persist while still in the current API, enabling you to make changes in the rest of the API settings without losing the debugging scenario.
+
+The Debugging tab consists of the following sections:
+
+- Request
+- Response
+- Logs
+
+#### Request
+
+<img src="/img/2.10/debugging_request.png" alt="Debugging Request" />
+
+In this section, you can enter the following information:
+
+- Method - select the method for your test from the drop-down list
+- Path - your endpoint to test
+- Headers/Body - enter any header information, such as Authorization, etc. Enter any body information. For example, entering user information if creating/updating a user.
+
+Once you have entered all the requested information, click **Run**. Debugging Response and Log information will be displayed:
+
+#### Response
+
+<img src="/img/2.10/debugging_results.png" alt="Debugging Response" />
+
+The Response section shows the JSON response to your request.
+
+#### Logs
+
+<img src="/img/2.10/debugging_logs.png" alt="Debugging Logs" />
+
+The debugging level is set to **debug** for the request. This outputs all logging information in the Endpoint Designer. In the Tyk Gateway logs you will see a single request. Any Error messages will be displayed at the bottom of the Logs output.
+
diff --git a/api-management/event-driven-apis.mdx b/api-management/event-driven-apis.mdx
new file mode 100644
index 0000000000..cf22a31b3a
--- /dev/null
+++ b/api-management/event-driven-apis.mdx
@@ -0,0 +1,1099 @@
+---
+title: "Tyk Streams – Manage Event-Driven APIs"
+description: "Introduction to Tyk Streams"
+keywords: "Tyk Streams, Glossary, Use Cases, Asynchronus APIs, Async, Configuration"
+sidebarTitle: "Tyk Streams"
+---
+
+{/* ## TODO: Add availability */}
+
+## Overview
+
+*Tyk Streams* is a feature of the Tyk API management platform that enables organizations to securely expose,
+manage and monetize real-time event streams and asynchronous APIs.
+
+With *Tyk Streams*, you can easily connect to event brokers and streaming platforms, such as
+[Apache Kafka](https://kafka.apache.org), and expose them as
+managed API endpoints for internal and external consumers.
+
+<div style={{display: 'flex', justifyContent: 'center'}}>
+<img src="/img/streams/tyk-streams-overview.png" alt="Tyk Streams Overview" width="670px" height="500px" />
+</div>
+
+The purpose of Tyk Streams is to provide a unified platform for managing both synchronous APIs (such as REST and
+GraphQL) and asynchronous APIs, in addition to event-driven architectures. This allows organizations to leverage the
+full potential of their event-driven systems while maintaining the same level of security, control and visibility they
+expect from their API management solution.
+
+### Why use Tyk Streams
+
+Tyk Stream is a powerful stream processing engine integrated into the Tyk API Gateway, available as part of the Enterprise Edition. It allows you to manage asynchronous APIs and event streams as part of your API ecosystem. It provides a range of capabilities to support async API management, including:
+
+- **Protocol Mediation**: Tyk Streams can mediate between different asynchronous protocols and API styles, such as WebSocket, Server-Sent Events (SSE), and Webhooks. This allows you to expose your event streams in a format compatible with your consumers' requirements.
+- **Security**: Apply the same security policies and controls to your async APIs as you do to your synchronous APIs. This includes features like authentication and authorization.
+- **Transformations**: Transform and enrich your event data on the fly using Tyk's powerful middleware and plugin system. This allows you to adapt your event streams to meet the needs of different consumers.
+- **Analytics**: Monitor the usage and performance of your async APIs with detailed analytics and reporting. Gain insights into consumer behavior and system health.
+- **Developer Portal**: Publish your async APIs to the Tyk Developer Portal, which provides a centralised catalog for discovery, documentation, and subscription management.
+
+---
+## Getting Started
+
+This guide will help you implement your first event-driven API with Tyk in under 15 minutes. To illustrate the capabilities of Tyk Streams, let's consider an example: building a basic asynchronous chat application, nicknamed **Chat Jippity**.
+
+In this scenario, a user sends a message (e.g., asking for a joke) via a simple web interface and receives an asynchronous response generated by a backend service.
+
+This application flow demonstrates two key patterns enabled by Tyk Streams: acting as an **API Producer Gateway** and an **API Consumer Gateway**.
+
+```mermaid
+sequenceDiagram
+    participant Browser
+    participant Tyk Gateway
+    participant Joker Service
+
+    Note over Browser, Tyk Gateway: Consumer - SSE Connection Setup
+    Browser->>+Tyk Gateway: Make Server Side Events (SSE) Connection
+    Tyk Gateway-->>-Browser: Connection Established
+
+    Note over Browser, discKafka: Producer - Message Flow for Request/Response
+    Browser->>+Tyk Gateway: (1) POST /chat (Request: "Tell me a joke")
+    Tyk Gateway->>+chatKafka: (2) Publish message to 'chat' topic
+    chatKafka-->>-Tyk Gateway: Ack (implied)
+    chatKafka-->>+Joker Service: (3) Consume message from 'chat' topic
+    Note over Joker Service: Processes request, gets joke
+    Joker Service->>+discKafka: (4) Publish response to 'discussion' topic
+    discKafka-->>-Joker Service: Ack (implied)
+    discKafka-->>+Tyk Gateway: (6) Consume/Receive message from 'discussion' topic
+    Tyk Gateway-->>-Browser: (7) Push joke response (via established WS/SSE connection)
+    Tyk Gateway-->>-discKafka: Ack (implied)
+```
+
+Let's break down how Tyk Streams facilitates this, focusing on the distinct producer and consumer roles Tyk plays:
+
+### Example Scenario
+
+#### Tyk as an API Producer Gateway (Client to Stream)
+
+*   **Goal:** Allow a client (like a browser or a script) to easily send a message into our asynchronous system without needing direct access or knowledge of the backend message broker (Kafka in this case).
+*   **Scenario:** The user types "Tell me a joke" into the chat interface and hits send.
+*   **Flow:**
+    1.  The browser sends a standard HTTP `POST` request to an endpoint exposed by Tyk Gateway (e.g., `/chat`).
+    2.  **Tyk Streams Role (Producer):** Tyk Gateway receives this `POST` request. An API definition configured with Tyk Streams defines this endpoint as an *input*. Tyk takes the request payload and *publishes* it as a message onto a designated backend topic (e.g., the `chat` topic in Kafka).
+    3.  A backend service (our "Joker Service") listens to the `chat` topic for incoming requests.
+*   **Value Demonstrated:**
+    *   **Protocol Bridging:** Tyk translates a synchronous HTTP POST into an asynchronous Kafka message.
+    *   **Decoupling:** The browser only needs to know the Tyk HTTP endpoint, not the Kafka details (brokers, topic name, protocol).
+    *   **API Management:** Tyk can enforce authentication, rate limits, etc., on the `/chat` endpoint before the message even enters the Kafka system.
+
+#### Tyk as an API Consumer Gateway (Stream to Client)
+
+*   **Goal:** Deliver the asynchronous response (the joke) from the backend system to the client in real time.
+*   **Scenario:** The "Joker Service" has processed the request and generated a joke. It needs to send this back to the originating user's browser session.
+*   **Flow:**
+    1.  The Joker Service *publishes* the joke response as a message onto a different backend topic (e.g., the `discussion` topic in Kafka).
+    2.  **Tyk Streams Role (Consumer):** Tyk Gateway is configured via another (or the same) API definition to *subscribe* to the `discussion` topic.
+    3.  When Tyk receives a message from the `discussion` topic, it *pushes* the message content (the joke) to the appropriate client(s) (provided they have already established a connection) using a suitable real-time protocol like Server-Sent Events (SSE) or WebSockets.
+    **Note:** In case of multiple clients, events would round-robin amongst the consumers.
+
+*   **Value Demonstrated:**
+    *   **Protocol Bridging:** Tyk translates Kafka messages into SSE messages suitable for web clients.
+    *   **Decoupling:** The browser doesn't need a Kafka client; it uses standard web protocols (SSE/WS) provided by Tyk. The Joker Service only needs to publish to Kafka, unaware of the final client protocol.
+
+The following sections will guide you through the prerequisites and steps to configure Tyk Gateway to implement this use case.
+
+### Prerequisites
+
+- **Docker**: We will run the entire Tyk Stack on Docker. For installation, refer to this [guide](https://docs.docker.com/desktop/setup/install/mac-install/).
+- **Git**: A CLI tool to work with git repositories. For installation, refer to this [guide](https://git-scm.com/downloads)
+- **Dashboard License**: We will configure Streams API using Dashboard. [Contact our team](https://tyk.io/contact/) to obtain a license or get self-managed trial license by completing the registration on our [website](https://tyk.io/self-managed-trial/). **Note:** To use the dashboard to design streams APIs, the dashboard license must include the `streams` scope.
+- **Curl and JQ**: These tools will be used for testing.
+
+### Instructions
+
+1. **Clone Git Repository:**
+
+    The [tyk-demo](https://github.com/TykTechnologies/tyk-demo) repository offers a docker-compose environment you can run locally to explore Tyk streams. Open your terminal and clone the git repository using the command below.
+
+    ```bash
+    git clone https://github.com/TykTechnologies/tyk-demo
+    cd tyk-demo
+    ```
+
+2. **Enable Tyk Streams:**
+
+   By default, Tyk Streams is disabled. To enable Tyk Streams in the Gateway and Dashboard, you need to configure the following settings:
+
+   Create an `.env` file and populate it with the values below:
+
+   ```bash
+   DASHBOARD_LICENCE=<your-dashboard-license>
+   GATEWAY_IMAGE_REPO=tyk-gateway-ee
+   TYK_DB_STREAMING_ENABLED=true
+   TYK_GW_STREAMING_ENABLED=true
+   ```
+
+   - `DASHBOARD_LICENCE`: Add your license key. Contact [our team](https://tyk.io/contact/) to obtain a license.
+   - `GATEWAY_IMAGE_REPO`: Tyk Streams is available as part of the Enterprise Edition of the Gateway.
+   - `TYK_DB_STREAMING_ENABLED` and `TYK_GW_STREAMING_ENABLED`: These must be set to `true` to enable Tyk Streams in the Dashboard and Gateway, respectively. Refer to the [configuration options](/tyk-oss-gateway/configuration#streaming) for more details.
+
+3. **Start Tyk Streams**
+
+    Execute the following command:
+    ```bash
+    ./up.sh
+    ```
+
+    
+
+    <Note>
+    This script also starts `Kafka` within a Docker container, which is necessary for this guide.
+    </Note>
+
+
+    This process will take a few minutes to complete and will display some credentials upon completion. Copy the Dashboard **username, password, and API key**, and save them for later use.
+    ```
+            ▾ Tyk Demo Organisation
+                  Username : admin-user@example.org
+                  Password : 3LEsHO1jv1dt9Xgf
+          Dashboard API Key : 5ff97f66188e48646557ba7c25d8c601
+    ```
+
+4. **Verify Setup:**
+
+    Open Tyk Dashboard in your browser by visiting [http://localhost:3000](http://localhost:3000) or [http://tyk-dashboard.localhost:3000](http://tyk-dashboard.localhost:3000) and login with the provided **admin** credentials.
+
+5. **Create Producer API:**
+
+    Create a file `producer.json` with the below content: (**Note:** `tyk-demo-kafka-1` is the hostname used to access Kafka running in a container; alternatively, you can use the IP address assigned to your computer.)
+
+    
+
+    <Expandable title='Click to expand the API Definition'>
+    ```json
+        {
+            "components": {},
+            "info": {
+                "title": "jippity-chat",
+                "version": "1.0.0"
+            },
+            "openapi": "3.0.3",
+            "paths": {},
+            "servers": [
+                {
+                    "url": "http://tyk-gateway.localhost:8080/jippity-chat/"
+                }
+            ],
+            "x-tyk-api-gateway": {
+                "info": {
+                    "name": "jippity-chat",
+                    "state": {
+                        "active": true
+                    }
+                },
+                "server": {
+                    "listenPath": {
+                        "value": "/jippity-chat/",
+                        "strip": true
+                    }
+                },
+                "upstream": {
+                  "url": ""
+                }
+            },
+            "x-tyk-streaming": {
+                "streams": {
+                    "default_stream": {
+                        "input": {
+                            "http_server": {
+                                "address": "",
+                                "allowed_verbs": [
+                                    "POST"
+                                ],
+                                "path": "/chat",
+                                "rate_limit": "",
+                                "timeout": "5s"
+                            },
+                            "label": ""
+                        },
+                        "output": {
+                            "kafka": {
+                                "addresses": ["tyk-demo-kafka-1:9092"],
+                                "max_in_flight": 10,
+                                "topic": "chat"
+                            },
+                            "label": ""
+                        }
+                    }
+                }
+            }
+        }
+        ```
+    </Expandable>
+
+
+
+
+    Create the API by executing the following command. Be sure to replace `<your-api-key>` with the API key you saved earlier:
+
+    ```bash
+    curl -H "Authorization: <your-api-key>" -H "Content-Type: application/vnd.tyk.streams.oas" http://localhost:3000/api/apis/streams -d @producer.json
+    ```
+
+    You should expect a response similar to the one shown below, indicating success. Note that the Meta and ID values will be different each time:
+    ```bash
+    {"Status":"OK","Message":"API created","Meta":"67e54cadbfa2f900013b501c","ID":"3ddcc8e1b1534d1d4336dc6b64a0d22f"}
+    ```
+
+5. **Create Consumer API:**
+
+    Create a file `consumer.json` with the below content: (**Note:** `tyk-demo-kafka-1` is the hostname used to access Kafka running in a container; alternatively, you can use the IP address assigned to your computer.)
+
+    
+
+    <Expandable title='Click to expand the API Definition'>
+    ```json
+        {
+            "components": {},
+            "info": {
+                "title": "jippity-discuss",
+                "version": "1.0.0"
+            },
+            "openapi": "3.0.3",
+            "paths": {},
+            "servers": [
+                {
+                    "url": "http://tyk-gateway.localhost:8080/jippity-discuss/"
+                }
+            ],
+            "x-tyk-api-gateway": {
+                "info": {
+                    "name": "jippity-discuss",
+                    "state": {
+                        "active": true
+                    }
+                },
+                "server": {
+                    "listenPath": {
+                        "value": "/jippity-discuss/",
+                        "strip": true
+                    }
+                },
+                "upstream": {
+                  "url": ""
+                }
+            },
+            "x-tyk-streaming": {
+                "streams": {
+                    "default_stream": {
+                        "input": {
+                            "kafka": {
+                                "addresses": ["tyk-demo-kafka-1:9092"],
+                                "auto_replay_nacks": true,
+                                "checkpoint_limit": 1024,
+                                "consumer_group": "tyk-streams",
+                                "target_version": "3.3.0",
+                                "topics": ["discussion"]
+                            },
+                            "label": ""
+                        },
+                        "output": {
+                            "http_server": {
+                                "address": "",
+                                "allowed_verbs": [
+                                    "GET"
+                                ],
+                                "stream_path": "/sse"
+                            },
+                            "label": ""
+                        }
+                    }
+                }
+            }
+        }
+        ```
+    </Expandable>
+
+
+
+
+    Create the API by executing the following command. Be sure to replace `<your-api-key>` with the API key you saved earlier:
+
+    ```bash
+    curl -H "Authorization: <your-api-key>" -H "Content-Type: application/vnd.tyk.streams.oas" http://localhost:3000/api/apis/streams -d @consumer.json
+    ```
+
+    You should expect a response similar to the one shown below, indicating success. Note that the Meta and ID values will be different each time:
+    ```bash
+    {"Status":"OK","Message":"API created","Meta":"67e54cadbfa2f900013b501c","ID":"3ddcc8e1b1534d1d4336dc6b64a0d22f"}
+    ```
+
+7. **Start Joker Service:**
+
+    Create a file `joker-service.sh` with the below content:
+
+    
+
+    <Expandable title='Click to expand Joker Service'>
+    ```bash
+        #!/bin/bash
+
+        # Container name
+        CONTAINER="tyk-demo-kafka-1"
+
+        # Kafka bootstrap server
+        BOOTSTRAP_SERVER="localhost:9092"
+
+        # Topics
+        SOURCE_TOPIC="chat"
+        TARGET_TOPIC="discussion"
+
+        # Kafka consumer and producer commands
+        CONSUMER_CMD="/opt/kafka/bin/kafka-console-consumer.sh --bootstrap-server $BOOTSTRAP_SERVER --topic $SOURCE_TOPIC"
+        PRODUCER_CMD="/opt/kafka/bin/kafka-console-producer.sh --broker-list $BOOTSTRAP_SERVER --topic $TARGET_TOPIC"
+
+        # Joke API URL
+        JOKE_API="https://icanhazdadjoke.com/"
+
+        echo "Starting to listen for messages on '$SOURCE_TOPIC'..."
+
+        # Run the consumer in the container, pipe output to a while loop
+        docker exec -i $CONTAINER bash -c "$CONSUMER_CMD" | while IFS= read -r message; do
+            # Skip empty lines
+            [ -z "$message" ] && continue
+
+            echo "Received message from $SOURCE_TOPIC: $message"
+
+            # Fetch a random joke from the API and extract it with jq
+            joke=$(curl -s -H "Accept: application/json" "$JOKE_API" | jq .joke)
+
+            # Check if joke was fetched successfully
+            if [ -n "$joke" ]; then
+                response_message="In response to '$message': Here's a dad joke - $joke"
+            else
+                response_message="In response to '$message': Couldn't fetch a joke, sorry!"
+            fi
+
+            # Send the response message to 'discussion' topic
+            echo "$response_message" | docker exec -i $CONTAINER bash -c "$PRODUCER_CMD"
+
+            echo "Posted to $TARGET_TOPIC: $response_message"
+        done
+
+        echo "Consumer stopped."
+        ```
+    </Expandable>
+
+
+
+
+    Make the file executable and start the service.
+
+    ```bash
+    chmod +x joker-service.sh
+    ./joker-service.sh
+    ```
+
+8. **Test the API:**
+
+   Open a terminal and execute the following command to start listening for messages from the Consumer API you created:
+
+   ```bash
+   curl -N http://tyk-gateway.localhost:8080/jippity-discuss/sse
+   ```
+
+   In a second terminal, execute the command below to send a message to the Producer API. You can run this command multiple times and modify the message to send different messages:
+
+   ```bash
+   curl -X POST http://tyk-gateway.localhost:8080/jippity-chat/chat -H "Content-Type: text/plain" -d "Tell me a joke."
+   ```
+
+   Now, you will see the message appear in the terminal window where you are listening for messages.
+
+**Wrapping Up:** And that’s it—you’ve just created an Async API with Tyk Streams! From here, you can tweak the configuration to suit your needs, [explore glossary](#glossary), or explore more [advanced use cases](#use-cases).
+
+---
+## How It Works
+
+Tyk Streams seamlessly integrates with the Tyk API Gateway, extending its capabilities beyond traditional synchronous request/response patterns to natively support asynchronous APIs and event-driven architectures.
+
+This section details the architecture, components, and request processing flow of Tyk Streams.
+
+### High-Level Architecture
+
+At a high level, Tyk Streams operates within the Tyk ecosystem, interacting with several key elements:
+
+*   **Tyk API Gateway**: The core API management platform. It is the entry point, handling initial request processing (like authentication and rate limiting) and routing requests.
+*   **Tyk Streams Module**: An integrated extension within the Gateway designed explicitly for asynchronous communication. It intercepts relevant requests and manages the streaming logic.
+*   **Event Brokers / Sources**: External systems that act as the origin or destination for data streams. Examples include Apache Kafka, NATS, MQTT brokers, or WebSocket servers. Tyk Streams connects to these systems based on API configuration.
+*   **Upstream Services / APIs**: The backend systems, microservices, or APIs that ultimately produce or consume the data being streamed or processed via Tyk Streams.
+
+Think of the Tyk Gateway as the central dispatch for all API traffic. When traffic requires asynchronous handling (like pushing data to Kafka or subscribing to an MQTT topic), the integrated Tyk Streams module manages the interaction with the specific Event Broker and Upstream Service according to the API's configuration.
+
+### Internal Components of Tyk Streams
+
+To manage these asynchronous interactions, the Tyk Streams module relies on several internal components operating within the Gateway:
+
+1.  **Stream Middleware**: This component plugs into the Tyk Gateway's request processing chain. It runs *after* standard middleware like authentication and rate limiting but *before* the request would normally be proxied. Its job is to inspect incoming requests, identify if they match a configured stream path, and if so, divert them from the standard proxy flow into the stream handling logic.
+2.  **Stream Manager**: Acts as the supervisor for streaming operations defined in an API. A given stream configuration is responsible for initializing, managing the lifecycle (starting/stopping), and coordinating the necessary `Stream Instances`. It ensures the correct streaming infrastructure is ready based on the API definition.
+3.  **Stream Instance**: Represents a running, active instance of a specific stream processing task. Each instance executes the logic defined in its configuration – connecting to an event broker, processing messages, transforming data, handling connections, etc. There can be multiple instances depending on the configuration and workload.
+4.  **Stream Analytics**: This component captures connection attempts and errors related to HTTP outputs. This data can be exported to popular analytics platforms like Prometheus, OpenTelemetry, and StatsD.
+
+The following diagram shows the relationships and primary interactions between these internal components and how they relate to the Gateway and Upstream API:
+
+```mermaid
+graph TD
+    idClient[Client]
+    idTykGateway[Tyk Gateway]
+    idStreamMiddleware[Stream Middleware]
+    idStreamManager[Stream Manager]
+    idStreamAnalytics[Stream Analytics]
+    idStreamInstance[Stream Instance]
+    idUpstreamAPI[Upstream API]
+
+    idClient -- Request --> idTykGateway
+    idTykGateway -- Response --> idClient
+    idTykGateway -- Process Request --> idStreamMiddleware
+    idStreamMiddleware -- Response --> idTykGateway
+    idStreamMiddleware -- Configure & Manage --> idStreamManager
+    idStreamMiddleware -- Capture Analytics --> idStreamAnalytics
+    idStreamManager -- Create & Run --> idStreamInstance
+    idStreamInstance -- Processed Response --> idStreamMiddleware
+    idStreamInstance -- Process Data --> idUpstreamAPI
+    idUpstreamAPI -- Response --> idStreamInstance
+```
+
+### Request Processing Flow
+
+Understanding how these components work together is key. Here’s the typical flow when a request interacts with a Tyk Streams-enabled API endpoint:
+
+```mermaid
+sequenceDiagram
+    participant Client
+    participant TykGateway as Tyk Gateway
+    participant StreamingMiddleware as Streaming Middleware
+    participant StreamManager as Stream Manager
+    participant StreamInstance as Stream Instance
+    participant UpstreamService as Upstream Service
+
+    Client->>TykGateway: HTTP Request
+    TykGateway->>StreamingMiddleware: Process Request
+    StreamingMiddleware->>StreamingMiddleware: Strip Listen Path
+    StreamingMiddleware->>StreamingMiddleware: Check if path is handled by streams
+
+    alt Path handled by streams
+        StreamingMiddleware->>StreamManager: Create/Get Stream Manager for request
+        StreamingMiddleware->>StreamManager: Match request to route
+        StreamManager->>StreamInstance: Handle request
+        StreamInstance->>Client: Stream response
+    else Not handled by streams
+        StreamingMiddleware-->>TykGateway: Continue middleware chain
+        TykGateway->>UpstreamService: Proxy request
+        UpstreamService->>TykGateway: Response
+    end
+
+    TykGateway->>Client: HTTP Response
+```
+
+1.  **Request Arrival & Gateway Pre-processing**: A client sends a request to an API endpoint managed by Tyk Gateway. The request passes through the initial middleware, such as authentication, key validation, and rate limiting.
+2.  **Streaming Middleware Interception**: The request reaches the `Stream Middleware`. It checks the request path against the stream routes defined in the API configuration.
+3.  **Path Matching**:
+    *   **If No Match**: The `Stream Middleware` will respond with a `404 Not Found` status code.
+    *   **If Match**: The request is intended for a stream. The `Stream Middleware` takes control of the request handling.
+4.  **Stream Manager Coordination**: The middleware interacts with the `Stream Manager` associated with the API's stream configuration. The `Stream Manager` ensures the required `Stream Instance`(s) are initialized and running based on the loaded configuration. This might involve creating a new instance or reusing a cached one.
+5.  **Stream Instance Execution**: The instance then executes its defined logic, interacting with the configured `Upstream Service / Event Broker` (e.g., publishing a message to Kafka, subscribing to an MQTT topic, forwarding data over a WebSocket).
+6.  **Analytics Capture**: The `Stream Analytics` component captures relevant metrics throughout the stream handling process.
+8.  **Final Gateway Response**: The response or data stream generated by the streaming components is relayed back through the Gateway to the originating client.
+
+### Scaling and Availability
+
+The beauty of Tyk Streams is that it’s baked into the Tyk Gateway, so it scales naturally as your API traffic ramps up—no extra setup or separate systems required. It’s efficient too, reusing the same resources as the Gateway to keep things lean.
+
+---
+## Configuration Options
+
+Configuring Tyk Streams involves two distinct levels:
+
+1.  **System-Level Configuration:** Enabling the Streams functionality globally within your Tyk Gateway and Tyk Dashboard instances. This activates the necessary components but doesn't define any specific streams.
+2.  **API-Level Configuration:** Defining the actual stream behaviors (inputs, outputs, processing logic) within a specific Tyk OAS API Definition using the `x-tyk-streaming` extension. This is where you specify *how* data flows for a particular asynchronous API.
+
+Let's look at each level in detail.
+
+### System-Level Configuration
+
+Before you can define streams in your APIs, you must enable the core Streams feature in both the Tyk Gateway and, if you're using it for management, the Tyk Dashboard.
+
+#### Installation / Deployment
+
+Tyk Streams is available as part of the Enterprise Edition of the Gateway.
+
+- **Helm**: Use `--set tyk-gateway.gateway.image.repository=tykio/tyk-gateway-ee --set global.streaming.enabled=true`
+- **Docker/Kubernetes**: Use the `tykio/tyk-gateway-ee` image.
+- **OS packages**: Available via Package cloud in the `tyk-ee` repo.
+
+#### Tyk Gateway
+
+Enable the Streams processing engine within the Gateway by setting `enabled` to `true` in the `streaming` section of your `tyk.conf` file or via environment variables.
+
+<Tabs>
+<Tab title="Config File">
+```json
+{
+// Partial config from tyk.conf
+    "streaming": {
+        "enabled": true // Required to activate Streams functionality
+    },
+// ... more config follows
+}
+```
+</Tab>
+<Tab title="Environment Variable">
+```bash
+export TYK_GW_STREAMING_ENABLED=true
+```
+</Tab>
+</Tabs>
+
+Refer to the [Tyk Gateway Configuration Reference](/tyk-oss-gateway/configuration#streaming-enabled) for more details on this setting.
+
+**Note on WebSockets:** To use WebSockets as a streaming protocol, you must also enable `TYK_GW_HTTPSERVEROPTIONS_ENABLEWEBSOCKETS=true` in your Gateway configuration.
+
+#### Tyk Dashboard
+
+If you manage your APIs via the Tyk Dashboard, you must also enable Streams support within the Dashboard configuration (`tyk_analytics.conf`) to expose Streams-related UI elements and functionality.
+
+<Tabs>
+<Tab title="Config File">
+```json
+{
+// Partial config from tyk_analytics.conf
+    "streaming": {
+        "enabled": true // Required to activate Streams functionality
+    },
+// ... more config follows
+}
+```
+</Tab>
+<Tab title="Environment Variable">
+```bash
+export TYK_DB_STREAMING_ENABLED=true
+```
+</Tab>
+</Tabs>
+
+Refer to the [Tyk Dashboard Configuration Reference](/tyk-dashboard/configuration#streaming-enabled) for more details.
+
+### API-Level Configuration
+
+Once Streams is enabled at the system level, you define the specific behavior for each asynchronous API within its Tyk Open API Specification (OAS) definition. This is done using the `x-tyk-streaming` vendor extension.
+
+The core structure under `x-tyk-streaming` is the `streams` object, which contains one or more named stream configurations. Each named stream defines:
+
+*   **`input`**: Specifies how data enters this stream (e.g., via an HTTP request, by consuming from Kafka, connecting via WebSocket).
+*   **`output`**: Specifies where the data goes after processing (e.g., published to Kafka, sent over WebSocket, delivered via webhook).
+
+```json
+{
+// Partial config from Tyk OAS API Definition
+    "x-tyk-streaming": {
+        "streams": {
+            "your_stream_name": { // A unique name for this stream configuration within the API
+                "input": {
+                    // Input configuration object - specifies the data source
+                    // Example: "http_server": { ... } or "kafka": { ... }
+                },
+                "output": {
+                    // Output configuration object - specifies the data destination
+                    // Example: "kafka": { ... } or "websocket_server": { ... }
+                }
+                // Optional processing/transformation steps can also be defined here
+            },
+            "another_stream": { // You can define multiple independent streams
+                "input": { ... },
+                "output": { ... }
+            }
+        }
+    },
+// ... more config follows
+}
+```
+
+**Available Input and Output Types:**
+
+Tyk supports various connector types for both `input` and `output`. **The specific types available (like `http_server`, `kafka`, `http_client`, etc.) and their respective configuration parameters are detailed in the [Tyk Streams Configuration Reference](/api-management/stream-config).** Please consult this reference page for the full list of options and how to configure each one.
+
+**Example Configuration:**
+
+<Tabs>
+
+<Tab title="Tyk OAS API Definition">
+```json
+{
+// Partial config from Tyk OAS API Definition
+    "x-tyk-streaming": {
+        "streams": {
+            "http_to_kafka_chat": {
+                "input": {
+                    "http_server": {
+                        "path": "/chat",
+                        "allowed_verbs": [ "POST" ],
+
+                    },
+                    "label": "HTTP Chat Input"
+                },
+                "output": {
+                    "kafka": {
+                        "addresses": ["kafka-broker:9092"],
+                        "topic": "chat",
+
+                    },
+                    "label": "Kafka Chat Output"
+                }
+            }
+        }
+    },
+// ... more config follows
+}
+```
+
+For comprehensive details on all fields within `x-tyk-streaming`, see the [Tyk OAS Extension documentation](/api-management/gateway-config-tyk-oas#xtykstreaming).
+
+</Tab>
+
+<Tab title="Dashboard UI">
+
+The Tyk Dashboard provides a wizard to create Streams APIs, which generates the underlying Tyk OAS configuration shown above.
+
+1.  Navigate to **APIs > Add New API**.
+2.  Select the **Streams** API type and give your API a name. Click **Configure API**.
+    <img src="/img/streams/streams-option.png" alt="Streams Option" width="670px" height="500px" />
+3.  In the **API Designer**, under the **Streams** tab, configure your desired `Input` and `Output`. Select the types (e.g., HTTP Server for input, Kafka for output) and fill in the required parameters based on the [Streams Configuration Reference](/api-management/stream-config).
+    <img src="/img/streams/selection.png" alt="Input/Output Selection" width="670px" height="500px" />
+4.  Configure any other API settings (e.g., Authentication, Rate Limiting) as needed in the other tabs.
+5.  **Save** the API. The Dashboard translates your UI configuration into the `x-tyk-streaming` JSON structure within the API definition. You can view the generated JSON in the **Advanced Options** tab under **API Definition**.
+
+</Tab>
+
+<Tab title="Tyk Classic API Definition">
+
+Tyk Streams configuration (`x-tyk-streaming`) is **only supported** within **Tyk OAS API Definitions**. It is not available for legacy Tyk Classic API Definitions.
+
+</Tab>
+
+</Tabs>
+
+### Supported Connectors and Protocols
+
+Tyk Streams provides out-of-the-box connectors for popular event brokers and async protocols, including:
+
+- [Apache Kafka](https://kafka.apache.org/documentation/)
+- [WebSocket](https://websocket.org/guides/websocket-protocol/)
+- [Server-Sent Events](https://en.wikipedia.org/wiki/Server-sent_events) (SSE)
+- [Webhooks](https://en.wikipedia.org/wiki/Webhook)
+
+When configuring HTTP-based outputs, keep the following behavior in mind:
+- **REST**: A simple GET request to the path retrieves one entry and exits. This is subject to `http_server_options.write_timeout` and `read_timeout`.
+- **SSE**: Stream results for `http_server_options.write_timeout` seconds (defaults to 120s).
+- **WebSocket**: Not subject to the same timeout issues as REST and SSE, and will continue indefinitely.
+
+You can expose all three protocols from a single `http_server` output by defining all three paths together:
+
+```yaml
+output:
+  http_server:
+    allowed_verbs:
+      - GET
+    path: /output
+    stream_path: /output/stream
+    ws_path: /output/subscribe
+```
+
+This makes the same data available as a single REST response at `/output`, an SSE stream at `/output/stream`, and a WebSocket connection at `/output/subscribe`.
+
+---
+## Use Cases
+
+Tyk Streams brings full lifecycle API management to asynchronous APIs and event-driven architectures. It provides a
+comprehensive set of capabilities to secure, transform, monitor and monetize your async APIs.
+
+### Security
+
+[Tyk Streams](/api-management/event-driven-apis#) supports all the authentication and authorization options available for traditional synchronous APIs. This
+ensures that your async APIs are protected with the same level of security as your REST, GraphQL, and other API types.
+
+Refer to these docs, to know more about [Authentication](/api-management/client-authentication) and [Authorization](/api-management/access-control/overview) in Tyk.
+
+### Transformations and Enrichment
+
+[Tyk Streams](/api-management/event-driven-apis#) allows you to transform and enrich the messages flowing through your async APIs. You can modify message payloads, filter events, combine data from multiple sources and more.
+
+- **[Transformation](/api-management/traffic-transformation)**: Use Tyk's powerful middleware and plugin system to transform message payloads on the fly. You can convert between different data formats (e.g., JSON to XML), filter fields, or apply custom logic.
+- **[Enrichment](/api-management/plugins/overview)**: Enrich your async API messages with additional data from external sources. For example, you can lookup customer information from a database and append it to the message payload.
+- **Bloblang**: Bloblang can be used in the `pipeline.processors` section to transform the body of the request. For example:
+  ```yaml
+  pipeline:
+    processors:
+      - bloblang: |
+          root.name = "jim"
+  ```
+
+### Monetization
+
+[Tyk Streams](/api-management/event-driven-apis#) enables you to monetize your async APIs by exposing them through the Developer Portal. Developers can discover, subscribe to and consume your async APIs using webhooks or streaming subscriptions.
+
+- **Developer Portal Integration**: Async APIs can be published to the Tyk Developer Portal, allowing developers to browse, subscribe, and access documentation. Developers can manage their async API subscriptions just like traditional APIs.
+- **Webhooks**: Tyk supports exposing async APIs as webhooks, enabling developers to receive event notifications via HTTP callbacks. Developers can configure their webhook endpoints and subscribe to specific events or topics.
+
+### Complex Event Processing
+
+Tyk Streams allows you to perform complex event processing on streams of events in real-time. You can define custom processing logic to:
+
+- Filter events based on specific criteria
+- Aggregate and correlate events from multiple streams
+- Enrich events with additional data from other sources
+- Detect patterns and sequences of events
+- Trigger actions or notifications based on event conditions
+
+Here's an example of a Tyk Streams configuration that performs complex event processing, specifically it creates a new event stream, which filters high-value orders and enriches them with customer email addresses, by making an additional HTTP request.
+
+```yaml
+input:
+  kafka:
+    addresses:
+      - "localhost:9092" # Replace with actual Kafka broker addresses
+    consumer_group: my-group
+    topics:
+      - orders
+output:
+  http_server:
+    allowed_verbs:
+      - GET
+    path: /high-value-orders
+pipeline:
+  processors:
+    - mapping: |
+        root = if this.order_value > 1000 {
+          this
+        } else {
+          deleted()
+        }
+    - branch:
+        processors:
+          - http:
+              headers:
+                Content-Type: application/json
+              url: http://customer-api.local/emails
+              verb: POST
+        request_map: |-
+          root = {
+            "customer_id": this.customer_id
+          }
+        result_map: root.customer_email = this.customer_email
+    - mapping: |
+        root = this.merge({ "high_value_order": true })
+```
+
+In this example:
+
+- **Tyk Streams Setup**: Consumes events from a Kafka topic called *orders*.
+- **Processor Block Configuration**: Utilizes a custom `Mapping` script that performs the following operations:
+    - **Filters** orders, only processing those with a value greater than 1000.
+    - **Enriches** the high-value orders by retrieving the customer ID and email from a separate data source.
+    - **Adds** a new high_value_order flag to each qualifying event.
+- **Output Handling**: Processed high-value order events are exposed via a WebSocket stream at the endpoint */high-value-orders*.
+
+### Legacy Modernization
+
+Tyk Streams can help you modernise legacy applications and systems by exposing their functionality as async APIs. This allows you to:
+- Decouple legacy systems from modern consumers
+- Enable real-time, event-driven communication with legacy apps
+- Gradually migrate away from legacy infrastructure
+
+Here's an example of exposing a legacy application as an async API using Tyk Streams:
+
+```yaml
+input:
+  http_client:
+    url: "http://legacy-app/orders"
+    verb: GET
+    rate_limit: "60s"
+pipeline:
+  processors:
+    - mapping: |
+        root.order_id = this.id
+        root.total = this.total
+        root.timestamp = this.timestamp
+output:
+  kafka:
+    addresses: ["localhost:9092"]
+    topic: "orders"
+```
+
+In this configuration:
+- Tyk Streams periodically polls the legacy */orders* REST endpoint every 60 seconds
+- The *processor* transforms the legacy response format into a simplified event structure
+- The transformed events are published to a Kafka topic called *orders*, which can be consumed by modern applications
+
+### Async API Orchestration
+
+Tyk Streams enables you to orchestrate multiple async APIs and services into composite event-driven flows. You can:
+- Combine events from various streams and sources
+- Implement complex routing and mediation logic between async APIs
+- Create reactive flows triggered by event conditions
+- Fanout events to multiple downstream consumers
+
+Here's an example async API orchestration with Tyk Streams:
+
+```yaml
+input:
+  broker:
+    inputs:
+      - kafka:
+          addresses: ["localhost:9092"]
+          topics: ["stream1"]
+          consumer_group: "group1"
+      - kafka:
+          addresses: ["localhost:9092"]
+          topics: ["stream2"]
+          consumer_group: "group2"
+pipeline:
+  processors:
+    - switch:
+        cases:
+          - check: 'meta("kafka_topic") == "stream1"'
+            processors:
+              - mapping: |
+                  root.type = "event_from_stream1"
+                  root.details = this
+              - branch:
+                  processors:
+                    - http:
+                        url: "http://api1.example.com/process"
+                        verb: POST
+                        body: '${! json() }'
+                  result_map: 'root.api1_response = this'
+          - check: 'meta("kafka_topic") == "stream2"'
+            processors:
+              - mapping: |
+                  root.type = "event_from_stream2"
+                  root.details = this
+              - branch:
+                  processors:
+                    - http:
+                        url: "http://api2.example.com/analyze"
+                        verb: POST
+                        body: '${! json() }'
+                  result_map: 'root.api2_response = this'
+    - mapping: 'root = if this.type == "event_from_stream1" && this.api1_response.status == "ok" { this } else if this.type == "event_from_stream2" && this.api2_response.status == "ok" { this } else { deleted() }'
+output:
+  broker:
+    pattern: "fan_out"
+    outputs:
+      - kafka:
+          addresses: ["localhost:9092"]
+          topic: "processed_stream1"
+          client_id: "tyk_fanout1"
+      - kafka:
+          addresses: ["localhost:9092"]
+          topic: "processed_stream2"
+          client_id: "tyk_fanout2"
+      - http_client:
+          url: "https://webhook.site/unique-id"
+          verb: POST
+          body: '${! json() }'
+```
+
+1. **Input Configuration**
+    - Uses a broker to combine events from two different Kafka topics, stream1 and stream2, allowing for the integration of events from various streams.
+2. **Complex Routing and Processing**
+    - A switch processor directs messages based on their origin (differentiated by Kafka topic metadata).
+    - Each stream’s messages are processed and conditionally sent to different APIs.
+    - Responses from these APIs are captured and used to decide on message processing further.
+3. **Reactive Flows**
+    - Conditions based on API responses determine if messages are forwarded or discarded, creating a flow reactive to the content and success of API interactions.
+    - Fanout to Multiple Consumers:
+    - The broker output with a fan-out pattern sends processed messages to multiple destinations: two different Kafka topics and an HTTP endpoint, demonstrating the capability to distribute events to various downstream consumers.
+
+These are just a few examples of the advanced async API scenarios made possible with Tyk Streams. The platform provides a flexible and extensible framework to design, deploy and manage sophisticated event-driven architectures.
+
+### Monetize APIs using Developer Portal
+
+Tyk Streams seamlessly integrates with the Tyk Developer Portal, enabling developers to easily discover, subscribe to, and consume async APIs and event streams. This section covers how to publish async APIs to the developer portal, provide documentation, and enable developers to subscribe to events and streams.
+
+
+
+#### Publishing Async APIs to the Developer Portal
+
+Publishing async APIs to the Tyk Developer Portal follows a similar process to publishing traditional synchronous APIs. API publishers can create API products that include async APIs and make them available to developers through the portal.
+
+To publish an async API:
+- In the Tyk Dashboard, create a new API and define the async API endpoints and configuration.
+- Associate the async API with an API product.
+- Publish the API product to the Developer Portal.
+- Copy code
+
+{/* [Placeholder for screenshot or GIF demonstrating the process of publishing an async API to the Developer Portal] */}
+
+
+
+#### Async API Documentation
+
+Providing clear and comprehensive documentation is crucial for developers to understand and effectively use async APIs. While Tyk Streams does not currently support the AsyncAPI specification format, it allows API publishers to include detailed documentation for each async API.
+
+When publishing an async API to the Developer Portal, consider including the following information in the documentation:
+- Overview and purpose of the async API
+- Supported protocols and endpoints (e.g., WebSocket, Webhook)
+- Event types and payloads
+- Subscription and connection details
+- Example code snippets for consuming the async API
+- Error handling and troubleshooting guidelines
+
+{/* [Placeholder for screenshot showcasing async API documentation in the Developer Portal] */}
+
+
+
+#### Enabling Developers to Subscribe to Events and Streams
+
+Tyk Streams provides a seamless way for developers to subscribe to events and streams directly from the Developer Portal. API publishers can enable webhook subscriptions for specific API products, allowing developers to receive real-time updates and notifications.
+To enable webhook subscriptions for an API product:
+1. In the Tyk Developer Portal, navigate to the API product settings.
+2. Enable the "Webhooks" option and specify the available events for subscription.
+3. Save the API product settings.
+
+<img src="/img/streams/enable-portal-webhooks.png" alt="Enable Portal Webhooks" width="1000" />
+
+{/* [Placeholder for screenshot showing the API product settings with webhook configuration] */}
+
+Once webhook subscriptions are enabled, developers can subscribe to events and streams by following these steps:
+- In the Developer Portal, navigate to the My Apps page.
+- Select the desired app.
+- In the "Webhooks" section, click on "Subscribe".
+- Provide the necessary details:
+    - *Webhook URL*: The URL where the event notifications will be sent.
+    - *HMAC Secret*: Provide a secret key used to sign the webhook messages for authentication.
+    - *Events*: Select the specific events to subscribe to.
+- Save the subscription settings.
+- Copy code
+{/* [Placeholder for screenshot illustrating the developer's view of subscribing to webhooks] */}
+
+<img src="/img/streams/subscribe-webhooks.png" alt="subscribe to webhooks from portal" width="1000" />
+
+To configure the async API stream for webhook subscriptions, use the following output configuration in your API definition:
+
+```yaml
+outputs:
+  - portal_webhook:
+      event_type: bar
+      portal_url: http://localhost:3001
+      secret: <portal-api-secret>
+```
+
+Replace `<portal-api-secret>` with the secret key for signing the webhook messages.
+
+Enabling webhook subscriptions allows developers to easily integrate real-time updates and notifications from async APIs into their applications, enhancing the overall developer experience and facilitating seamless communication between systems.
+{/* [Placeholder for a diagram illustrating the flow of webhook subscriptions and event notifications] */}
+
+With Tyk Streams and the Developer Portal integration, API publishers can effectively manage and expose async APIs, while developers can discover, subscribe to, and consume event streams effortlessly, enabling powerful real-time functionality in their applications.
+
+
+---
+## Glossary
+
+### Event
+
+An event represents a significant change or occurrence within a system, such as a user action, a sensor reading, or a data update. Events are typically lightweight and contain minimal data, often just a unique identifier and a timestamp.
+
+### Stream
+
+A stream is a continuous flow of events ordered by time. Streams allow for efficient, real-time processing and distribution of events to multiple consumers.
+
+### Publisher (or Producer)
+
+A publisher is an application or system that generates events and sends them to a broker or event store for distribution to interested parties.
+
+### Subscriber (or Consumer)
+
+A subscriber is an application or system that expresses interest in receiving events from one or more streams. Subscribers can process events in real-time or store them for later consumption.
+
+### Broker
+
+A broker is an intermediary system that receives events from publishers, stores them, and forwards them to subscribers. Brokers decouple publishers from subscribers, allowing for scalable and flexible event-driven architectures.
+
+### Topic (or Channel)
+
+A topic is a named destination within a broker where events are published. Subscribers can subscribe to specific topics to receive relevant events.
+
+## Troubleshooting and Gotchas
+
+When working with Tyk Streams, keep the following points in mind:
+
+<AccordionGroup>
+<Accordion title='Dashboard HTTP Access'>
+Streams APIs cannot be edited over HTTP unless the dashboard is hosted on the localhost interface.
+</Accordion>
+
+<Accordion title='Upstream Attribute'>
+The `upstream` attribute is not used by streams APIs.
+</Accordion>
+
+<Accordion title='Missing Streaming Tab'>
+If streams are not enabled in the dashboard config, the option to create streams APIs is present, but the "Streaming" tab is missing in the API designer.
+</Accordion>
+
+<Accordion title='Gateway Proxy Error'>
+If streams are not enabled in the gateway config, the client gets `{"error": "There was a problem proxying the request"}` and the gateway logs `http: proxy error: unsupported protocol scheme ""`.
+</Accordion>
+
+<Accordion title='Analytics'>
+Analytics are not available for Streams APIs in the dashboard (only connection attempts are tracked).
+</Accordion>
+
+<Accordion title='Message Distribution'>
+Streams round-robins output between listeners. Tyk is not a broker, so messages are not sent to all consumers unless a broker such as Kafka is configured.
+</Accordion>
+
+<Accordion title='Missing License Scope'>
+If the dashboard license does not include the `streams` scope, the Streaming tab still appears and the API can be created. Saving or publishing the API fails with `"Message":"Your license does not support adding/modifying streams API configuration"`.
+</Accordion>
+
+<Accordion title='Malformed Stream Definition'>
+If the stream definition is invalid or uses an unsupported input or output, the dashboard does not catch this when the API is saved. The gateway logs `Failed to set YAML: lint errors: (2,1) unable to infer component type` in addition to the Gateway Proxy Error above.
+</Accordion>
+
+<Accordion title='Load Balancing with http_server'>
+The `http_server` input and output used in the [Getting Started](#getting-started) example tie each request and its reply to the Tyk Gateway instance that received it. If multiple Tyk Gateway instances sit behind a load balancer without a shared broker, only requests routed to the instance holding the matching connection succeed, and others fail. Use a broker such as Kafka to distribute messages reliably across multiple Tyk Gateway instances.
+</Accordion>
+
+<Accordion title='Active Connections During API Changes'>
+Editing a Streams API does not affect connections that are already open. They keep running with the previous configuration. New connections pick up the updated configuration after a short delay (around 10 seconds). Deactivating the API does not stop active connections.
+</Accordion>
+</AccordionGroup>
+
+---
+## FAQ
+
+<AccordionGroup>
+<Accordion title='What is Tyk Streams and what problem does it solve?'>
+Tyk Streams is an extension to the Tyk API Gateway that supports asynchronous APIs and event-driven architectures. It solves the challenge of managing both synchronous and asynchronous APIs in a unified platform, allowing organizations to handle real-time event streams alongside traditional REST APIs.
+</Accordion>
+
+<Accordion title='Which event brokers and protocols does Tyk Streams support?'>
+Refer this [documentation](#supported-connectors-and-protocols).
+</Accordion>
+
+<Accordion title='How can I enable Tyk Streams on Tyk Cloud?'>
+Currently, Tyk Streams is only available for hybrid customers on Tyk Cloud. To enable it, [contact support](https://tyk.io/contact/).
+</Accordion>
+
+<Accordion title='Can I publish Tyk Streams APIs to the Developer Portal?'>
+Yes, as of Tyk v5.7.0, you can publish Tyk Streams APIs to the Tyk Developer Portal. The process is similar to publishing traditional APIs: create a Tyk Streams API, create a Policy to protect it, and publish it to the Developer Portal Catalog.
+</Accordion>
+
+<Accordion title='What deployment considerations should I keep in mind for Tyk Streams?'>
+Tyk Streams is embedded within the Tyk Gateway and scales with your existing Tyk infrastructure. No additional infrastructure is required for broker-based inputs and outputs, such as Kafka.
+
+If you use the `http_server` input or output without a broker, requests and their replies are tied to a single Tyk Gateway instance. Running multiple Tyk Gateway instances behind a load balancer can then cause inconsistent results. See [Troubleshooting and Gotchas](#troubleshooting-and-gotchas) for details.
+</Accordion>
+
+<Accordion title='Is Tyk Streams available in all Tyk editions?'>
+Tyk Streams is available exclusively in the `enterprise` edition. Currently, it is only accessible for hybrid customers using Tyk Cloud. Please refer to the latest documentation or reach out to [Tyk support](https://tyk.io/contact/) for specific availability in your edition.
+</Accordion>
+</AccordionGroup>
diff --git a/api-management/fips-implementation.mdx b/api-management/fips-implementation.mdx
new file mode 100644
index 0000000000..bd883794e0
--- /dev/null
+++ b/api-management/fips-implementation.mdx
@@ -0,0 +1,169 @@
+---
+title: "FIPS Implementation"
+description: "Configuring and Verifying FIPS Deployments"
+keywords: "FIPS, FIPS 140-3, compliance, cryptography, security, federal, government, regulated"
+sidebarTitle: "FIPS Implementation"
+---
+
+This page covers the practical steps for deploying Tyk in FIPS mode: configuring cryptographic settings, choosing a delivery format, deploying via Helm, verifying image integrity, scanning for vulnerabilities, and understanding what is and is not covered by Tyk's FIPS compliance attestation.
+
+---
+
+## Cryptographic Configuration
+
+Regardless of delivery format or version, your environment must be configured to use only FIPS-approved cryptographic primitives. Legacy algorithms such as MD5 are not compliant with FIPS 140-3 and must not be used.
+
+When running Tyk Gateway in FIPS mode, you must configure key hashing to use SHA-256 or higher.
+
+**In** `tyk.conf`**:**
+
+```json
+"hash_key_function": "sha256"
+```
+
+**Via environment variable:**
+
+```bash
+TYK_GW_HASHKEYFUNCTION=sha256
+```
+
+This setting is not required when using FIPS mode for Tyk Pump.
+
+---
+
+## Choosing a Delivery Format
+
+From version 5.13.x, Tyk FIPS components are available in two formats. Both deliver the same FIPS 140-3 compliant application-layer cryptography. The right choice depends on your infrastructure and compliance requirements.
+
+|  | Docker Hardened Images (DHI) | Native OS Packages (RPM/DEB) |
+| --- | --- | --- |
+| FIPS 140-3 application-layer cryptography | ✅ | ✅ |
+| Built on FIPS-certified base image | ✅ | ❌ |
+| SLSA Level 3 build provenance | ✅ | ❌ |
+| Signed SBOMs (CycloneDX/SPDX) | ✅ | ❌ |
+| Cryptographic image signatures | ✅ | ❌ |
+| STIG-compliant | ✅ | ❌ |
+| VEX statements for vulnerability scanning | ✅ | ❌ |
+| Supported platforms | Container environments | Ubuntu, Debian, RHEL, CentOS, CentOS Stream |
+
+> If your organization requires a certified base image, supply chain attestations, or STIG compliance, you must use Docker Hardened Images.
+
+Version 5.8.x (LTS-1) is available as RPM/DEB packages only, targeting FIPS 140-2. See the [FIPS Policy](/developer-support/release-types/fips-release#fips-standard-by-version) page for a full breakdown of compliance posture by version.
+
+---
+
+## Deploying with Docker Hardened Images
+
+### Helm
+
+Tyk's Helm charts support FIPS deployments by allowing you to override the default image references with FIPS-compliant image tags. The charts themselves are not FIPS-specific — FIPS readiness is achieved through the image override for each component you are deploying (Gateway, Dashboard, Pump, MDCB, Enterprise Developer Portal).
+
+The override follows the same pattern for each component: set the image repository to the `-fips` suffixed equivalent and pin the tag to your target version. Full per-component key paths are documented in the [Tyk Helm chart reference](/product-stack/tyk-charts/overview).
+
+---
+
+### Verifying Image Integrity
+
+All Tyk DHI FIPS images are cryptographically signed using [Sigstore](https://www.sigstore.dev/). Each image ships with a signed SBOM in both CycloneDX and SPDX formats and SLSA Level 3 build provenance, which can be inspected using `cosign` or any compatible attestation tooling.
+
+To verify signatures and attestations, you will need the Tyk signing identity and OIDC issuer values. These are available from your account manager or via [Tyk support](https://support.tyk.io/). Once you have those values, verification follows the standard `cosign verify` workflow for image signatures, SBOM attestations, and build provenance.
+
+---
+
+### Vulnerability Scanning
+
+Tyk's DHI images are published with **Vulnerability Exploitability eXchange (VEX)** statements. VEX statements communicate which reported CVEs are not exploitable in the context of a given image. Compatible scanners consume these statements automatically to suppress non-exploitable findings and reduce false positives.
+
+Without VEX filtering applied, scanners will report CVEs that are present in the image but not exploitable in this context. This is expected behavior, not a signal that the image is insecure. We strongly recommend configuring VEX filtering before running compliance scans.
+
+VEX documents for Tyk DHI images are available through your account manager.
+
+#### Using Grype
+
+[Grype](https://github.com/anchore/grype) supports VEX filtering natively. To scan with VEX applied:
+
+```bash
+grype tykio/tyk-gateway-fips:v5.13.x --vex <path-to-vex-document>
+```
+
+To generate a full vulnerability report in table format:
+
+```bash
+grype tykio/tyk-gateway-fips:v5.13.x --vex <path-to-vex-document> -o table
+```
+
+#### Using Trivy
+
+[Trivy](https://github.com/aquasecurity/trivy) supports VEX filtering and also consumes Docker-published VEX statements for the DHI base image layer:
+
+```bash
+trivy image \
+--vex <path-to-vex-document> \
+tykio/tyk-gateway-fips:v5.13.x
+```
+
+To output results in a format suitable for compliance reporting:
+
+```bash
+trivy image \
+--vex <path-to-vex-document> \
+--format cyclonedx \
+--output report.json \
+tykio/tyk-gateway-fips:v5.13.x
+```
+
+#### Using Docker Scout
+
+If you are already using Docker Scout as part of your DHI workflow, it natively understands VEX statements published alongside DHI images without requiring a separate `--vex` flag:
+
+```bash
+docker scout cves tykio/tyk-gateway-fips:v5.13.x
+```
+
+---
+
+## Deploying with Native OS Packages
+
+Native packages are available for Ubuntu, Debian, RHEL, CentOS, and CentOS Stream. They deliver the same FIPS 140-3 application-layer cryptography as DHI builds, but do not include a certified base image or supply chain attestations.
+
+Ensure you install the `-fips` suffixed package for your distribution:
+
+```bash
+# RHEL/CentOS
+sudo yum install tyk-gateway-fips
+# Ubuntu/Debian
+sudo apt-get install tyk-gateway-fips
+```
+
+Apply the cryptographic configuration described above before starting the service.
+
+> If you are running 5.8.x packages and have regulatory requirements that mandate FIPS 140-3, a certified base image, or supply chain attestations, contact your account team to plan migration to 5.13.x.
+
+---
+
+## What Is Not Covered
+
+Tyk's FIPS compliance attestation covers the Tyk components listed on the [FIPS Policy](/developer-support/release-types/fips-release#tyk-fips-offering) page when deployed and configured as described in this documentation. It does not extend to:
+
+* **The surrounding infrastructure** — operating system configuration, network controls, load balancers, service meshes, or cloud provider services are outside Tyk's attestation boundary
+* **Third-party plugins or custom middleware** — any code you introduce into the Tyk pipeline is your responsibility to assess for FIPS compliance
+* **Data stores** — Redis, MongoDB, PostgreSQL, and any other backing services must be independently assessed and configured for FIPS compliance
+* **Native OS packages (5.13.x)** — while these deliver FIPS 140-3 application-layer cryptography, they are not built on a FIPS-certified base image and do not carry supply chain attestations; if your audit requires these, use DHI
+* **Version 5.8.x** — targets FIPS 140-2 only; does not meet FIPS 140-3 requirements
+* **Non-FIPS suffixed builds** — standard Tyk releases do not operate in FIPS mode regardless of configuration
+
+Customers are responsible for ensuring their complete deployment meets applicable regulatory requirements. If you have questions about your specific compliance boundary, contact your account manager.
+
+---
+
+## Responsibility Boundaries for CVEs
+
+Understanding who is responsible for remediating a CVE helps you assess risk accurately and set appropriate expectations.
+
+| CVE source | Responsible for fix | Tyk's role |
+| --- | --- | --- |
+| DHI base OS | Docker | Publishes updated base image and VEX statements. Tyk ships updated container images once the patch is available. |
+| Third-party dependencies (Go stdlib, packages) | The upstream maintainer | Tyk applies the fix, recompiles, tests, and releases an updated version once the upstream patch is published. |
+| Tyk-owned code | Tyk | Tyk is fully responsible for authoring and releasing the fix. |
+
+If you hold a **Priority Remediation SLA**, the SLA clock starts once the responsible party (Docker or the upstream maintainer) publishes a patch. Speak to your account manager for details.
diff --git a/api-management/gateway-config-introduction.mdx b/api-management/gateway-config-introduction.mdx
new file mode 100644
index 0000000000..b28382a89a
--- /dev/null
+++ b/api-management/gateway-config-introduction.mdx
@@ -0,0 +1,90 @@
+---
+title: "Configuring Tyk Gateway"
+description: "An introduction to Tyk API definitions, how the Gateway processes requests, and the different configuration types available"
+keywords: "API Definition, API Definition Object, API Definition Location"
+sidebarTitle: "Overview"
+---
+
+## Introduction
+
+Tyk API Gateway is a [reverse-proxy](https://en.wikipedia.org/wiki/Reverse_proxy) that serves as an intermediary managing API traffic between clients and the upstream API service. It consists of a series of middleware blocks that process API requests received from clients. These middleware perform various checks and transformations of and to the request preparing it to be routed to the upstream. The upstream API service executes core business logic and returns responses to Tyk Gateway. The response is similarly passed through a series of middleware blocks before being returned to the client.
+
+Each of these middleware can be configured so that it will only allow the specific requests that you want to reach your upstream, and in the correct form. The request middleware chain encompasses functionality that includes:
+
+- listening for requests
+- authentication and authorization of the client
+- rate and quota limiting
+- checking that the request is valid
+- applying transformations to the payload and headers
+- triggering event handlers that can notify external systems of certain events
+- checking availability of the upstream service
+- ... and finally routing to the correct target applying load balancing between multiple upstreams if required
+
+You can even create custom middleware (plugins) that will perform non-standard checks and transformations. As you can imagine Tyk has a lot of configuration options to implement all of this!
+
+
+## Configuring the Gateway
+
+Tyk Gateway is configurable at three levels of granularity:
+
+- *Gateway level* settings that apply to all API proxies hosted on Tyk
+- *API level* settings that apply to a specific API proxy
+- *Endpoint level* settings that apply to specific endpoints (operations consisting of HTTP method and path) within an API proxy
+
+Some features can be configured at multiple levels. Where this is the case, specific precedence rules apply and are described in the relevant section of the documentation.
+
+### Gateway level settings
+
+Gateway level settings are stored in a file (typically `tyk.conf`) that is applied when the Gateway starts up, affecting all API proxies deployed on Tyk. They can also be configured using the equivalent environment variables. The Gateway level settings are documented [here](/tyk-oss-gateway/configuration).
+
+If you are using a config file you can store settings, typically secrets, in environment variables or an external key-value store and provide references to the stored keys within the configuration file. This is explained [here](/tyk-configuration-reference/kv-store).
+
+### API and endpoint level settings
+
+API and endpoint level settings are configured using an *API definition*.
+
+This is a structured JSON object that encapsulates all of the details that apply specifically to that API, including the listen path, upstream target details, valid endpoints and operations, rate limits, authentication, versioning, and both built-in and custom middleware.
+
+You can store settings, typically secrets, in environment variables or an external key-value store and provide references to the stored keys within the API definition. This is explained [here](/tyk-configuration-reference/kv-store).
+
+API definition objects can be compact for a basic pass-through API, and can become very complex and large for APIs that require significant processing to be completed both before the request is proxied to the upstream service and once the response is received.
+
+
+## API Definitions
+
+An *API definition* is the specification for an API proxy, providing Tyk with everything it needs to receive and process requests. Using Tyk's mock response, virtual endpoint and custom plugin functionality, you don't even need an upstream service - with a single API definition you can emulate a service entirely within Tyk, providing a [mock response](/api-management/traffic-transformation/mock-response#mock-response).
+
+Tyk supports two types of API definition depending on the type of service that you are looking to proxy:
+
+- [Tyk OAS API definitions](/api-management/gateway-config-tyk-oas) are used for REST and streaming use cases
+- [Tyk Classic API definitions](/api-management/gateway-config-tyk-classic) are used for GraphQL, XML/SOAP and TCP services
+
+
+
+    <Note>
+    For versions of Tyk prior to 5.8 not all Gateway features can be configured using the Tyk OAS API definition, for edge cases you might need to use Tyk Classic for REST APIs, though we recommend updating to Tyk 5.8 and adopting Tyk OAS.
+    </Note>
+
+
+
+### Migrating to Tyk OAS
+
+In Tyk 4.1, we introduced the Tyk OAS API definition but initially it supported only a subset of the Gateway configuration options offered by Tyk Classic. Since then we have gradually added support until finally, with the launch of Tyk 5.8, we have reached effective parity with Tyk Classic and now recommend that Tyk OAS is used exclusively for REST use cases.
+
+**Tyk 5.8 continues to support Tyk Classic for REST, but we will not be adding support for new features to this API definition style and strongly recommend migrating to Tyk OAS.**
+
+For Tyk Dashboard users with an existing portfolio of Tyk Classic API definitions, we provide a [migration tool](/api-management/migrate-from-tyk-classic), available via the Dashboard API and UI.
+
+### Storing API definitions
+
+For Tyk Open Source users, API definitions should be stored in `.json` files in the following location accessible by the Tyk Gateway:
+- `/var/tyk-gateway/apps` (Linux)
+- `/opt/tyk-gateway/apps` (Docker)
+
+For Tyk Dashboard users, API definitions will be kept in your [main storage](/api-management/dashboard-configuration#data-storage-solutions).
+
+### A note on terminology
+
+It's important not to confuse the *API proxy* with the API for the upstream service. Typically we refer to *API proxy* or *API* when refering to the endpoints exposed on Tyk Gateway and *upstream* or *upstream API* for the service that you develop and deploy to perform your business logic and data handling.
+
+
diff --git a/api-management/gateway-config-managing-classic.mdx b/api-management/gateway-config-managing-classic.mdx
new file mode 100644
index 0000000000..c7442b0230
--- /dev/null
+++ b/api-management/gateway-config-managing-classic.mdx
@@ -0,0 +1,556 @@
+---
+title: "Managing Tyk Classic API Definition"
+description: "A guide to managing Tyk Classic API definitions"
+keywords: "Tyk Classic API, Create, Update, Import, API Key, Security Policy"
+sidebarTitle: "Working with Tyk Classic"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+import CreateApiInclude from '/snippets/create-api-include.mdx';
+import CreateApiKeyInclude from '/snippets/create-api-key-include.mdx';
+import CreateSecurityPolicyInclude from '/snippets/create-security-policy-include.mdx';
+import ImportApiInclude from '/snippets/import-api-include.mdx';
+
+## Create an API
+
+### What does it mean to create an API in Tyk
+
+You have a running service with an API that you want your users to consume; you want to protect and manage access to that API using Tyk Gateway - how do you do that?  
+<br />
+For Tyk Gateway to protect and [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy) calls to your upstream service, you need to configure an API on Tyk Gateway. The minimum information that Tyk requires is the **listen path** (which is a path on the Tyk Gateway URL that you want your consumers to call) and your **API URL** (which is the URL of your service to which Tyk should forward requests).  
+<br />
+This information and other configuration values are stored in an object called a *Tyk API Definition*. Once you have created your Tyk API Definition and deployed it in the Gateway, Tyk can start serving your consumers, forwarding their requests to your upstream service's API.
+
+To reach a detailed guide to creating Tyk API Definitions, please choose the tab for the product you are using:
+
+### Tyk Cloud
+
+Tyk Cloud is a fully managed service that makes it easy for API teams to create, secure, publish and maintain APIs at any scale, anywhere in the world. Tyk Cloud includes everything you need to manage your global API ecosystem: [Tyk Gateways](/tyk-oss-gateway), [Tyk Dashboard](/api-management/dashboard-configuration), [Tyk Developer Portal](/portal/overview/intro) and [Universal Data Graph](/api-management/data-graph#overview). 
+<br />  
+
+To embark on your API journey with Tyk Cloud, we recommend going to our [Quick Start guide](/tyk-cloud#quick-start-tyk-cloud). This guide will walk you through the process of creating your very first API in Tyk Cloud.
+For an advanced step by step guide we recommend visiting our [Getting Started guide](/tyk-cloud#comprehensive-tyk-cloud-setup). This will explain advanced configuration steps relating to how to distribute your API across nodes, in addition to adding and testing your API.
+
+### Tyk Self-Managed
+
+<CreateApiInclude/>
+
+If the command succeeds, you will see:
+```json
+{
+  "action": "added",
+  "key": "xxxxxxxxx",
+  "status": "ok"
+}
+```
+
+**What did we just do?**
+
+We just sent an API definition to the Tyk `/apis` endpoint. See [API definition objects](/api-management/gateway-config-tyk-classic) for details of all the available objects. These objects encapsulate all of the settings for an API within Tyk.
+
+Want to learn more from one of our team of engineers?
+
+<ButtonLeft href="https://tyk.io/book-a-demo" color="green" content="Book a demo" />
+
+### Tyk Open Source
+
+
+<Note>
+**Note: Integration with your OpenAPI documentation**
+
+In Tyk v4.1 we introduced support for APIs defined according to the [OpenAPI Specification v3.0.3](https://spec.openapis.org/oas/v3.0.3) (OAS).  
+This introduces a standard way to describe the vendor-agnostic elements of an API (the OpenAPI Definition, stored as an OpenAPI Document); we take this and add Tyk-specific configuration options to create the *Tyk OAS API Definition*. You can import your own OpenAPI document and Tyk will use this to generate the Tyk OAS API Definition.  
+For details on using Tyk OAS with Tyk Gateway, check out our guide to [working with Tyk OAS APIs](/api-management/gateway-config-managing-oas).
+</Note>
+
+
+**Prerequisites**
+
+Before you continue this tutorial, you will need a running [Tyk OSS gateway](/tyk-oss-gateway). Click the button for instructions on how to install Tyk Gateway:
+
+<ButtonLeft href="https://tyk.io/sign-up/#oss" color="green" content="Install Tyk Gateway" />
+
+#### Creating an API on Tyk Gateway
+
+There are two ways to configure Tyk Gateway with an API definition:
+1. [Create an API with the Tyk Gateway API](#using-tyk-gateway-api) - Tyk Gateway has its own APIs which provides various services including the registering of Tyk API Definitions on the Gateway.
+2. [Create an API in File-based Mode](#create-an-api-in-file-based-mode) - alternatively you can create a Tyk API Definition in a file and then load it to the Gateway.
+
+
+#### Using Tyk Gateway API
+
+Watch our video to learn how to add an API to Tyk's Open Source Gateway using [Postman](https://www.postman.com/downloads/).
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/UWM2ZQoGhQA" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+In order to use the Gateway API to create a Tyk API Definition you will need the API key for your deployment's Gateway API and then issue just one command to create the API and make it live.
+
+1. **Make sure you know your API secret**
+
+    The API key to access your Tyk Gateway API is stored in your `tyk.conf` file; the property is called `secret`. You will need to provide this value in a header called `x-tyk-authorization` when making calls to the Gateway API.
+
+2. **Create an API**
+
+    To create the API, let's send a Tyk API definition to the `/apis` endpoint on your Tyk Gateway. Remember to change the `x-tyk-authorization` value (API key) in the header of your API call and set the domain name and port to target your Tyk Gateway in the `curl` command.
+    ```curl
+    curl -v -H "x-tyk-authorization: {your-secret}" \
+    -s \
+    -H "Content-Type: application/json" \
+    -X POST \
+    -d '{
+        "name": "Hello-World",
+        "slug": "hello-world",
+        "api_id": "Hello-World",
+        "org_id": "1",
+        "use_keyless": true,
+        "auth": {
+        "auth_header_name": "Authorization"
+        },
+        "definition": {
+        "location": "header",
+        "key": "x-api-version"
+        },
+        "version_data": {
+        "not_versioned": true,
+        "versions": {
+            "Default": {
+            "name": "Default",
+            "use_extended_paths": true
+            }
+        }
+        },
+        "proxy": {
+        "listen_path": "/hello-world/",
+        "target_url": "http://httpbin.org",
+        "strip_listen_path": true
+        },
+        "active": true
+    }' http://{your-tyk-host}:{port}/tyk/apis | python -mjson.tool
+    ```
+
+    If the command succeeds, you will see:
+    ```json
+    {
+    "key": "Hello-World",
+    "status": "ok",
+    "action": "added"
+    }
+    ```
+
+
+<Note>
+All APIs deployed on Tyk Gateway are given a unique `API ID`; if you don't provide one in the Tyk API Definition when creating the API, then an `API ID` will be generated automatically.
+</Note>
+
+
+**What did we just do?**
+
+We just registered a new API on your Tyk Gateway by sending a Tyk API definition to your Gateway's `/apis` endpoint.  
+Tyk API definitions encapsulate all of the settings for an API within Tyk Gateway and are discussed in detail in the [API section](/api-management/gateway-config-tyk-classic) of this documentation.
+
+**Restart or hot reload**
+
+Once you have created the file, you will need to either restart the Tyk Gateway, or issue a hot reload command, lets do the latter:
+```curl
+curl -H "x-tyk-authorization: {your-secret}" -s http://{your-tyk-host}:{port}/tyk/reload/group | python -mjson.tool
+```
+
+This command will hot-reload your API Gateway(s) and the new API will be loaded, if you take a look at the output of the Gateway (or the logs), you will see that it should have loaded Hello-World API on `/hello-world/`.
+
+#### Create an API in File-based Mode
+
+
+<Note>
+APIs created without API ID in file based mode are invalid.
+</Note>
+
+
+
+To create a file-based API definition is very easy.
+
+Create a file called `api1.json` and place it in the `/apps` folder of your Tyk Gateway installation (usually in `/var/tyk-gateway`), then add the following:
+```json
+{
+  "name": "Test API",
+  "slug": "test-api",
+  "api_id": "1",
+  "org_id": "1",
+  "auth_configs": {
+    "authToken": {
+      "auth_header_name": "Authorization"
+    }
+  },
+  "definition": {
+    "location": "header",
+    "key": "x-api-version"
+  },
+  "version_data": {
+    "not_versioned": true,
+    "versions": {
+      "Default": {
+        "name": "Default",
+        "use_extended_paths": true
+    }
+   }
+  },
+  "proxy": {
+    "listen_path": "/test-api/",
+    "target_url": "http://httpbin.org/",
+    "strip_listen_path": true
+  },
+  "active": true
+}
+```
+
+**Restart or hot reload**
+
+Once you have created the file, you will need to either restart the Tyk Gateway, or issue a hot reload command, lets do the latter:
+```curl
+curl -H "x-tyk-authorization: {your-secret}" -s https://{your-tyk-host}:{port}/tyk/reload/group | python -mjson.tool
+```
+
+This command will hot-reload your API Gateway(s) and the new API will be loaded, if you take a look at the output of the Gateway (or the logs), you will see that it should have loaded Test API on `/test-api/`.
+
+Your API is now ready to use via the Gateway.
+
+## Secure an API
+
+A security policy encapsulates several options that can be applied to a key. It acts as a template that can override individual sections of an API key (or identity) in Tyk.
+
+See [What is a Security Policy?](/api-management/policies) for more details.
+
+### Tyk Cloud
+
+<CreateSecurityPolicyInclude/>
+
+### Tyk Self Manged
+
+<CreateSecurityPolicyInclude/>
+
+### Tyk Open Source
+
+#### Create a Policy with the Gateway
+
+Adding a policy to the Tyk Gateway is very easy. Polices are loaded into memory on load and so need to be specified in advanced in a file called `policies.json`. To add a policy, simply create or edit the `/policies/policies.json` file and add the policy object to the object array:
+
+```json
+{
+  "POLICYID": {
+    "access_rights": {
+      "{API-ID}": {
+        "allowed_urls": [],
+        "api_id": "{API-ID}",
+        "api_name": "{API-NAME}",
+        "versions": [
+            "Default"
+        ]
+      }
+    },
+    "active": true,
+    "name": "POLICY NAME",
+    "rate": 1000,
+    "per": 1,
+    "quota_max": 10000,
+    "quota_renewal_rate": 3600,
+    "tags": ["Startup Users"]
+  }
+}
+```
+
+The above creates a new policy with a policy ID that you can define, with the rate limits, and security profile that grants access to the APIs listed in the `access_rights` section.
+
+- `{API-ID}`: The API ID you wish this policy to grant access to, there can be more than one of these entries.
+- `{API-NAME}`: The name of the API that is being granted access to (this is not required, but helps when debugging or auditing).
+- `POLICY NAME`: The name of this security policy.
+
+The important elements:
+
+- `access_rights`: A list of objects representing which APIs that you have configured to grant access to.
+- `rate` and `per`: The number of requests to allow per period.
+- `quota_max`: The maximum number of allowed requests over a quota period.
+- `quota_renewal_rate`: how often the quota resets, in seconds. In this case we have set it to renew every hour.
+
+## Access an API
+
+### Tyk Cloud
+
+<CreateApiKeyInclude/>
+
+You will see a 200 response with your new key:
+
+```yaml
+{
+  "api_model": {},
+  "key_id": "59bf9159adbab8abcdefghijac9299a1271641b94fbaf9913e0e048c",
+  "data": {...}
+}
+```
+
+The value returned in the `key_id` parameter of the response is the access key you can now use to access the API that was specified in the `access_rights` section of the call.
+
+### Tyk Self Managed
+
+<CreateApiKeyInclude/>
+
+You will see a response with your new key:
+
+```json
+{
+  "action": "create",
+  "key": "c2cb92a78f944e9a46de793fe28e847e",
+  "status": "ok"
+}
+```
+
+The value returned in the `key` parameter of the response is the access key you can now use to access the API that was specified in the `access_rights` section of the call.
+
+### Tyk Open Source
+
+To create an API Key, you will need the API ID that we wish to grant the key access to, then creating the key is an API call to the endpoint.
+
+**Prerequisite**
+
+- You will need your API secret, this is the `secret` property of the `tyk.conf` file.
+
+Once you have this value, you can use them to access the Gateway API, the below `curl` command will generate a key for one of your APIs, remember to replace `{API-SECRET}`, `{API-ID}` and `{API-NAME}` with the real values as well as the `curl` domain name and port to be the correct values for your environment.
+
+```curl
+curl -X POST -H "x-tyk-authorization: {API-SECRET}" \
+  -s \
+  -H "Content-Type: application/json" \
+  -X POST \
+  -d '{
+    "allowance": 1000,
+    "rate": 1000,
+    "per": 1,
+    "expires": -1,
+    "quota_max": -1,
+    "org_id": "1",
+    "quota_renews": 1449051461,
+    "quota_remaining": -1,
+    "quota_renewal_rate": 60,
+    "access_rights": {
+      "{API-ID}": {
+        "api_id": "{API-ID}",
+        "api_name": "{API-NAME}",
+        "versions": ["Default"]
+      }
+    },
+    "meta_data": {}
+  }' http://localhost:8080/tyk/keys/create | python -mjson.tool
+```
+
+The above creates a new key with the rate limits, and security profile that grants access to the APIs listed in the `access_rights` section.
+
+- `{API-ID}`: The API ID you wish this policy to grant access to, there can be more than one of these entries.
+- `{API-NAME}`: The name of the API being granted access to (this is not required, but helps when debugging or auditing).
+
+The important elements:
+
+- `access_rights`: A list of objects representing which APIs you have configured to grant access to.
+- `rate` and `per`: The number of allowed requests per period.
+- `quota_max`: The maximum number of allowed requests over a quota period.
+- `quota_renewal_rate`: how often the quota resets, in seconds. In this case, we have set it to renew every hour.
+
+You will see a response with your new key:
+
+```json
+{
+  "action": "create",
+  "key": "c2cb92a78f944e9a46de793fe28e847e",
+  "status": "ok"
+}
+```
+
+The value returned in the `key` parameter of the response is the access key you can now use to access the API that was specified in the `access_rights` section of the call.
+
+## Import an API
+
+Tyk supports importing both API Blueprint and Swagger (OpenAPI) JSON definitions from either the Gateway or the Dashboard. Tyk will output the converted file to to `stdout`. Below are the commands you can use to get Tyk to switch to command mode and generate the respective API definitions for both API Blueprint and Swagger files.
+
+### API Blueprint is being deprecated
+
+Our support for API Blueprint is being deprecated. We have been packaging [aglio](https://github.com/danielgtaylor/aglio) in our Docker images for the Dashboard which enables rendering API Blueprint Format in the portal. This module is no longer maintained and is not compatible with newer NodeJS. If you wish to continue using this feature, you can do so by installing the module yourself in your Dockerfile. The imapct of this change is that our Docker images will no longer contain this functionality.
+
+As a work around, you can do the following:
+
+* Create API Blueprint in JSON format using the Apiary [Drafter](https://github.com/apiaryio/drafter) tool
+* Convert API Blueprint to OpenAPI (Swagger) using the Apiary [API Elements CLI](https://github.com/apiaryio/api-elements.js/tree/master/packages/cli) tool.
+
+### Using API Blueprint
+
+
+<Note>
+See [note](#api-blueprint-is-being-deprecated) above regarding deprecation of support for API Blueprint.
+</Note>
+
+
+Tyk supports an easy way to import Apiary API Blueprints in JSON format using the command line.
+
+Blueprints can be imported and turned into standalone API definitions (for new APIs) and also imported as versions into existing APIs.
+
+It is possible to import APIs and generate mocks or to generate Allow Lists that pass-through to an upstream URL.
+
+All imported Blueprints must be in the JSON representation of Blueprint's markdown documents. This can be created using Apiary's [Snow Crash tool](https://github.com/apiaryio/snowcrash).
+
+Tyk outputs all new API definitions to `stdout`, so redirecting the output to a file is advised in order to generate new definitions to use in a real configuration.
+
+#### Importing a Blueprint as a new API:
+
+Create a new definition from the Blueprint:
+
+```{.copyWrapper}
+./tyk --import-blueprint=blueprint.json --create-api --org-id=<id> --upstream-target="http://widgets.com/api/"
+```
+
+#### Importing a definition as a version in an existing API:
+
+Add a version to a definition:
+
+```{.copyWrapper}
+./tyk --import-blueprint=blueprint.json --for-api=<path> --as-version="version_number"
+```
+
+#### Creating your API versions as a mock
+
+As the API Blueprint definition allows for example responses to be embedded, these examples can be imported as forced replies, in effect mocking out the API. To enable this mode, when generating a new API or importing as a version, simply add the `--as-mock` parameter.
+
+### Using Swagger (OpenAPI)
+
+Tyk supports importing Swagger documents to create API definitions and API versions. Swagger imports do not support mocking though, so sample data and replies will need to be added manually later.
+
+#### Importing a Swagger document as a new API
+
+Create a new definition from Swagger:
+
+```{.copyWrapper}
+./tyk --import-swagger=petstore.json --create-api --org-id=<id> --upstream-target="http://widgets.com/api/"
+```
+
+<Note>
+When creating a new definition from an OAS 3.0 spec, you will have to manually add the listen path after the API is created.
+</Note>
+
+
+
+#### Importing a Swagger document as a version into an existing API
+
+Add a version to a definition:
+
+```{.copyWrapper}
+./tyk --import-swagger=petstore.json --for-api=<path> --as-version="version_number"
+```
+
+#### Mocks
+
+Tyk supports API mocking using our versioning `use_extended_paths` setup, adding mocked URL data to one of the three list types (white_list, black_list or ignored). In order to handle a mocked path, use an entry that has `action` set to `reply`:
+
+```json
+"ignored": [
+  {
+    "path": "/v1/ignored/with_id/{id}",
+    "method_actions": {
+      "GET": {
+        "action": "reply",
+        "code": 200,
+        "data": "Hello World",
+        "headers": {
+          "x-tyk-override": "tyk-override"
+        }
+      }
+    }
+  }
+],
+```
+
+See [Versioning](/api-management/gateway-config-tyk-classic#tyk-classic-api-versioning) for more details.
+
+### Import APIs via the Dashboard API
+
+<ImportApiInclude/>
+
+### Import APIs via the Dashboard UI
+
+1. **Select "APIs" from the "System Management" section**
+
+    <img src="/img/2.10/apis_menu.png" alt="API listing" />
+
+2. **Click "IMPORT API"**
+
+    <img src="/img/2.10/import_api_button.png" alt="Add API button location" />
+
+    Tyk supports the following import options:
+
+    1. From an Existing Tyk API definition
+    2. From a Apiary Blueprint (JSON) file
+    3. From a Swagger/OpenAPI (JSON only) file
+    4. From a SOAP WSDL definition file (new from v1.9)
+
+    To import a Tyk Definition, just copy and paste the definition into the code editor.
+
+    For Apiary Blueprint and Swagger/OpenAPI, the process is the same. For example:
+
+    Click the "From Swagger (JSON)" option from the pop-up
+
+    <img src="/img/2.10/import_api_json.png" alt="Import popup" />
+
+    For WSDL:
+
+    <img src="/img/2.10/import_api_wsdl.png" alt="Import WSDL" />
+
+3. **Enter API Information**
+
+    You need to enter the following information:
+
+    * Your **Upstream Target**
+    * A **Version Name** (optional)
+    * An optional **Service Name** and **Port** (WSDL only)
+    * Copy code into the editor
+
+4. **Click "Generate API"**
+
+    Your API will appear in your APIs list. If you select **EDIT** from the **ACTIONS** drop-down list, you can see the endpoints (from the [Endpoint Designer](/api-management/endpoint-designer)) that have been created as part of the import process.
+
+### Creating a new API Version by importing an API Definition using Tyk Dashboard
+
+As well as importing new APIs, with Tyk, you can also use import to create a new version of an existing Tyk Classic API.
+
+1. Open the API Designer page and select Import Version from the **Options** drop-down.
+
+    <img src="/img/oas/import-api-version.png" alt="Import API Version Drop-Down" />
+
+2. Select either OpenAPI (v2.0 or 3.0) or WSDL/XML as your source API
+
+3. You need to add a new **API Version Name**. **Upstream URL** is optional.
+
+    <img src="/img/oas/import-api-version-config.png" alt="Import API Version Configuration" />
+
+4. Click **Import API**.
+
+    <img src="/img/oas/import-api-button.png" alt="Import API" />
+
+5. Select the **Versions** tab and your new version will be available.
+6. Open the **Endpoint Designer** for your API and select your new version from **Edit Version**.
+7. You will see all the endpoints are saved for your new version.
+
+<img src="/img/oas/version-endpoints.png" alt="Version Endpoints" />
+
+##### Import from an OpenAPI v2.0 Document
+
+1. From the Import API screen, select OpenAPI.
+
+    <img src="/img/oas/open-api-format.png" alt="Import OAS 2.0 API" />
+
+2. Paste your OAS v2.0 compliant definition into the code editor.
+
+    <img src="/img/oas/oas-2-code.png" alt="OAS 2.0 definition in Editor" />
+
+3. Note that the Dashboard has detected that an OAS v2.0 definition has been imported and you need to specify an upstream URL field to proceed.
+
+    <img src="/img/oas/upstream-url.png" alt="Upstream URL" />
+
+4. Click **Import API**. 
+
+    <img src="/img/oas/import-api-button.png" alt="Import API" />
+
+    Your API will be added to your list of APIs.
diff --git a/api-management/gateway-config-managing-oas.mdx b/api-management/gateway-config-managing-oas.mdx
new file mode 100644
index 0000000000..8ffe723021
--- /dev/null
+++ b/api-management/gateway-config-managing-oas.mdx
@@ -0,0 +1,859 @@
+---
+title: "Working with Tyk OAS APIs"
+description: "A guide to working with and managing Tyk OAS API definitions"
+keywords: "Tyk OAS API, Create, Update, Import, Export, Versioning, API Key, Security Policy"
+sidebarTitle: "Working with Tyk OAS"
+---
+
+## Overview
+
+Tyk's support for the OpenAPI Specification is designed to fit in with your existing workflows as seamlessly as possible, whether you have one of our paid offerings, or are using our free open-source Gateway. You should be able to do a huge amount in the editor of your choice. The Tyk Dashboard's API Designer will support you whether you want to create a new API from a blank slate, or just to dip into if you want a bit of help with configuring Tyk's powerful transformation middleware. 
+
+One of the great things about working with Tyk is that the OpenAPI document containing the OAS compliant description of your service is a single file (or group of files) that you deploy throughout your workflow. You can iterate on that document within your source control system until you are totally happy. At this point, you can publish the OpenAPI description to your Developer Portal to document what a Developer needs to use the API (and nothing they don’t need to know). As the OpenAPI description is the source of truth for the Tyk OAS API definition and can be updated without impacting the Tyk Vendor Extension, you can automate deployment of updates to your API on Tyk whenever a new version is committed into your source control. This model is very popular in GitOps and CI/CD environments.
+
+<img src="/img/oas/diagram_oas-flow-2.png" alt="Tyk OAS API workflow" />
+
+
+### API Definition Management with Tyk
+
+There are three methods by which API definitions can be deployed to Tyk: using the [Tyk Dashboard API Designer](/api-management/dashboard-configuration), using the [Tyk Dashboard API](/tyk-dashboard-api) and using the [Tyk Gateway API](/tyk-gateway-api).
+
+The first two options provide access to the powerful licensed features of Tyk, whilst the third is used for open source deployments. Tyk provides additional tools to assist with automation when using the Tyk Dashboard API - namely [Tyk Operator](/api-management/automations/operator)(for Kubernetes deployments) and [Tyk Sync](/api-management/automations/sync) (for gitops).
+
+| Feature           | API Designer | Tyk Dashboard API | Tyk Gateway API |
+| :------------------- | :-------------- | :------------------- | :----------------- |
+| Work with YAML format                                | ✅ | ✅ | ❌ |
+| Work with JSON format                                | ✅ | ✅ | ✅ |
+| Import an OpenAPI description                        | ✅ | ✅ | ✅ |
+| Import a complete Tyk OAS API definition             | ✅ | ✅ | ✅ |
+| Import [multi-part OpenAPI descriptions](/api-management/gateway-config-managing-oas#multi-part-openapi-documents) | ✅ | ✅ | ❌ |
+| Apply API [Templates](/platform-management/api-templates)  | ✅ | ✅ | ❌ |
+| Export the OpenAPI description                       | ✅ | ✅ | ✅ |
+| Export the Tyk OAS API definition                    | ✅ | ✅ | ✅ |
+| Update API with new OpenAPI description              | ✅ | ✅ | ✅ |
+| Manage API versions                                  | ✅ | ✅ | ✅ | 
+| Assign APIs to [Categories](/platform-management/api-categories) | ✅ | ✅ | ❌ |
+| Assign API [Owners](/platform-management/api-ownership) | ✅ | ✅ | ❌ |
+
+## Creating an API
+
+Tyk is designed to fit into your workflow, so has full support for you to import your existing OpenAPI descriptions as the starting point for a Tyk OAS API. Tyk can automatically configure aspects of the Gateway's API security and management functions based upon the content of the OpenAPI description, for example using the security settings to configure client authentication or the endpoint examples and schemas to configure request validation and mock response middleware.
+
+Alternatively, if you don't have an existing OpenAPI description, you can use the API Designer to bootstrap one for you: build your API in Tyk and then export an OAS compliant description that you can use elsewhere, for example as documentation for your new API.
+
+### Using Tyk Dashboard API Designer to create an API
+
+In this tutorial we guide you through the steps to create a new Tyk OAS API using the GUI.
+
+{/* - hiding this video as it is out of date <iframe width="560" height="315" src="https://www.youtube.com/embed/-LyJ14wuOrI" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> */}
+
+1. Start by selecting **APIs** from the **API Management** section
+
+    <img src="/img/oas/api-menu.png" alt="Add new API" />
+
+2. Now select **Add New API** and then, choose **Design from scratch**
+
+    <img src="/img/oas/add-new-api.png" alt="Start designing a new API" />
+
+3. Now complete the basic configuration for your new API following the guided steps providing:
+    - API name
+    - API type (**HTTP**)
+    - API style (**OpenAPI**)
+    - [API template](/platform-management/api-templates#working-with-api-templates-using-the-template-designer) (optional)
+    - Upstream URL
+
+    <img src="/img/oas/api-create-stepper.png" alt="Basic configuration of the new API" />
+
+4. Deploy the API to your Gateway
+
+    - If you are using Tyk Cloud or a [sharded](/api-management/multiple-environments) deployment you will be prompted to select on which Gateways the API should be deployed
+
+    <img src="/img/oas/api-create-deploy-targets.png" alt="Choose where to deploy the API" />
+
+    - You need to set the **API status** (if you set this to **Active**, Tyk will accept requests to the API)
+    - You need to set the **Access** (set this to **External** to expose your API outside Tyk so that your clients can consume it)
+    - When creating a new API you will probably want to set API status to **Inactive** while you configure the rest of the API definition
+
+    <img src="/img/oas/api-create-set-status.png" alt="Set API Status" />
+
+    Click **Save API** to create the API definition and, depending on the options you chose for API status and access, deploy the API to your gateway to start serving traffic.
+
+    
+
+    <Note>
+    You can see the URL given to your API, in the Info section displayed at the top of the page (**API URL**).
+    </Note>
+
+
+5. Secure your API by configuring [client authentication](/api-management/client-authentication)
+
+    From the API page:
+
+    1. Click **Edit**
+    2. Scroll down to the **Server** section and enable **Authentication**
+    3. Select **Auth Token** from the drop-down list
+    4. For **Authentication token location** select **Use header value**
+    5. Note that the default Auth key header name is *Authorization*
+    6. Save your API
+
+6. Declare endpoints for your API
+
+    1. After selecting **Edit**, move to the **Endpoints** tab.
+
+    <img src="/img/oas/api-create-no-endpoints.png" alt="Add new endpoint" />
+
+
+    2. Click **Add Endpoint** then complete the requested details for the new endpoint:
+
+        - Select a method from the drop-down list
+        - Add a path for your endpoint
+        - Add an optional summary and description
+        - select  **Add Endpoint**
+
+        <img src="/img/oas/api-create-endpoint.png" alt="Provide the details of the new endpoint" />
+
+    3. Your new endpoint will now be listed in the Endpoints tab
+
+    <img src="/img/oas/api-create-endpoint-list.png" alt="List of all endpoints declared for the API" />
+
+    4. You can now add [middleware](/api-management/traffic-transformation) to your endpoint via the **Add Middleware** button.
+
+    5. Click **Save API** to apply the changes to your API.
+
+7. Test your API
+
+    From the **Info** section, copy the [API base path](/api-management/gateway-config-managing-oas#api-base-path) and send a request to the API without providing an authorization token:
+
+    ```
+    curl --location --request GET 'http://localhost:8181/petstore/' \
+    --header 'Authorization: wrongkey'
+    ```
+
+    Note that the Gateway will respond with the following error message, confirming that authentication is required:
+
+    ```.json
+    {
+        "error": "Access to this API has been disallowed"
+    }
+    ```
+
+### Using your own code editor to create Tyk OAS API definitions
+
+The API definition is often generated either from the codebase or using API design tools (such as [Swagger Editor](https://editor.swagger.io/), [Postman](https://www.postman.com/) and [Stoplight](https://stoplight.io/)).
+
+To enjoy writing a *Tyk OAS API definition* as if it is [a native programming language](https://tyk.io/blog/get-productive-with-the-tyk-intellisense-extension/), you can add the [Tyk OAS API definition schema](https://raw.githubusercontent.com/TykTechnologies/tyk-schemas/main/JSON/draft-04/schema_TykOasApiDef_3.0.x.json) to your favorite IDE or editor. We have published a Tyk VS Code extension that provides Tyk API schema validation and auto-completion (both OAS and other schemas) in the [VS Code marketplace](https://marketplace.visualstudio.com/items?itemName=TykTechnologiesLimited.tyk-schemas). You can use it to create Tyk objects in your IDE (Tyk API definitions, Key and Tyk config file).
+
+#### Loading the API definition into Tyk
+
+<Tabs>
+
+<Tab title="API Designer">
+
+Armed with a Tyk OAS API definition, in YAML or JSON format, you can use this to create an API in Tyk Dashboard with only a few clicks.
+
+1. Start by selecting **APIs** from the **API Management** section
+
+    <img src="/img/oas/api-menu.png" alt="Add new API" />
+
+2. Now select **Add New API** and then, choose **Import**.
+
+    <img src="/img/oas/add-new-api.png" alt="Loading the API definition into Tyk Dashboard" />
+
+    Note that you can optionally apply an [API template](/platform-management/api-templates) by choosing **Start from template** as explained [here](/platform-management/api-templates#using-a-template-when-creating-a-new-api), however in this explanation we will not be applying a template.
+
+3. From the Import API screen, select **Tyk API** because the object you want to import to Tyk is a complete API definition.
+
+    <img src="/img/oas/api-create-import.png" alt="Choosing what to import" />
+
+    
+
+    <Note>
+    On the Import API screen, there are three options for <b>Import Type</b>, it is important to select the correct one for the object that you want to load into Tyk:
+
+    - <b>openAPI</b> is used only for [OpenAPI descriptions](/api-management/gateway-config-tyk-oas#openapi-description) (without the [Tyk Vendor Extension](/api-management/gateway-config-tyk-oas#tyk-vendor-extension))
+    - <b>TykAPI</b> is used for a full [Tyk OAS API definition](/api-management/gateway-config-tyk-oas#what-is-a-tyk-oas-api-definition) (comprising OpenAPI description plus Tyk Vendor Extension) or Tyk Classic API definition
+    - <b>WSDL/XML</b> is used for WSDL/XML content and will result in a Tyk Classic API
+    </Note>
+
+
+4. Now you can paste the entire Tyk OAS API definition into the text editor.
+
+    <img src="/img/oas/api-create-import-tykapi.png" alt="Loading the API definition into Tyk Dashboard" />
+
+5. Select **Import API** to complete the import and create the API based on your API definition.
+
+</Tab>
+
+<Tab title="Dashboard API">
+
+When making calls to the Tyk Dashboard API you'll need to set the domain name and port for your environment and provide credentials in the `Authorization` field for Tyk to authorize your request, as follows:
+
+| Interface         | Port | Authorization Header | Authorization credentials   |
+| :------------------- | :------ | :---------------------- | :----------------------------- |
+| Tyk Dashboard API | 3000 | `Authorization`      | From Dashboard User Profile |
+
+You can obtain your authorization credential (Dashboard API key) from the Tyk Dashboard UI:
+
+- Select **Edit profile** from the dropdown that appears when you click on your username in the top right corner of the screen
+- Scroll to the bottom of the page were you will see your **Tyk Dashboard API Access Credentials**
+
+You will also need to have ‘admin’ or ‘api:write’ permission if [RBAC](/api-management/user-management) is enabled.
+
+To create the API in Tyk, you simply send your Tyk OAS API Definition in the payload to the `POST /api/apis/oas` endpoint of your Tyk Dashboard API. 
+
+| Property     | Description              |
+| :-------------- | :-------------------------- |
+| Resource URL | `/api/apis/oas`          |
+| Method       | `POST`                   |
+| Type         | None                     |
+| Body         | Tyk OAS API Definition   |
+| Parameters   | Query: `templateID`      |
+
+Using [this](https://bit.ly/39jUnuq) API definition it is possible to create a Tyk OAS API on your Tyk Gateway that forwards requests to the [Swagger Petstore](https://petstore3.swagger.io) request/response service.
+
+```
+curl -H "Authorization: ${DASH_KEY}" -H "Content-Type: application/json" ${DASH_URL}/apis/oas -d "$(wget -qO- https://bit.ly/39jUnuq)"
+```
+
+**Check request response**
+
+If the command succeeds, you will see the following response, where `Meta` contains the unique identifier (`id`) for the API you have just created. If you did not provide a value in the `id` field, then Tyk will automatically assign one.
+
+```
+{
+    "Status": "OK",
+    "Message": "API created",
+    "Meta": {NEW-API-ID}
+}
+```
+
+What you have done is to send a Tyk OAS API definition to Tyk Dashboard's `/api/apis/oas` endpoint resulting in the creation of the API in your Tyk Dashboard which will automatically deploy it to your Gateway.
+
+You can use the optional `templateId` parameter to apply an [API Template](/platform-management/api-templates#applying-a-template-when-creating-an-api-from-a-tyk-oas-api-definition) to your API definition when creating the API.
+
+</Tab>
+
+<Tab title="Gateway API">
+
+When making calls to the Tyk Gateway API you'll need to set the domain name and port for your environment and provide credentials in the `x-tyk-authorization` field for Tyk to authorize your request, as follows:
+
+| Interface       | Port | Authorization Header  | Authorization credentials        |
+| :----------------- | :------ | :----------------------- | :---------------------------------- |
+| Tyk Gateway API | 8080 | `x-tyk-authorization` | `secret` value set in `tyk.conf` |
+
+To create the API in Tyk, you simply send your Tyk OAS API Definition in the payload to the `POST /tyk/apis/oas` endpoint of your Tyk Gateway API. 
+
+Using [this](https://bit.ly/39tnXgO) minimal API definition it is possible to create a Tyk OAS API on your Tyk Gateway using only 30 lines:
+
+```curl
+curl --location --request POST 'http://{your-tyk-host}:{port}/tyk/apis/oas' \
+--header 'x-tyk-authorization: {your-secret}' \
+--header 'Content-Type: text/plain' \
+--data-raw 
+'{
+  "info": {
+    "title": "Petstore",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "components": {},
+  "paths": {},
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "Petstore",
+      "state": {
+        "active": true
+      }
+    },
+    "upstream": {
+      "url": "https://petstore.swagger.io/v2"
+    },
+    "server": {
+      "listenPath": {
+        "value": "/petstore/",
+        "strip": true
+      }
+    }
+  }
+}'
+```
+
+**Check request response**
+
+If the command succeeds, you will see the following response, where `key` contains the unique identifier (`id`) for the API you have just created. If you did not provide a value in the `id` field, then Tyk will automatically assign one.
+
+```.json
+{
+    "key": {NEW-API-ID},
+    "status": "ok",
+    "action": "added"
+}
+```
+
+What you have done is to send a Tyk OAS API definition to Tyk Gateway's `/tyk/apis/oas` endpoint resulting in the creation of the API in your Tyk Gateway.
+
+**Restart or hot reload**
+
+Once you have created your API you need to load it into the Gateway so that it can serve traffic. To do this you can either restart the Tyk Gateway or issue a [hot reload](/tyk-stack/tyk-gateway/important-prerequisites#hot-reload-is-critical-in-tyk-ce) command:
+
+```.curl
+curl -H "x-tyk-authorization: {your-secret}" -s http://{your-tyk-host}:{port}/tyk/reload/group
+```
+
+You can go to the `/apps` folder of your Tyk Gateway installation (by default in `/var/tyk-gateway`) to see where Tyk has stored your Tyk OAS API Definition.
+
+</Tab>
+
+</Tabs>
+
+### Importing an OpenAPI description to create an API
+
+Tyk will automatically update the `servers` section in the imported OpenAPI description, adding the base path URL to which requests should be sent to access the new API. It will take the existing entry and use this to generate the upstream (target) URL if none is provided.
+
+<Tabs>
+
+<Tab title="API Designer">
+
+If you have a valid OAS 3.0 or OAS 3.1 compliant OpenAPI description, in YAML or JSON format, you can use this to create an API in Tyk Dashboard with only a few clicks.
+
+1. Start by selecting **APIs** from the **API Management** section
+
+    <img src="/img/oas/api-menu.png" alt="Add new API" />
+
+2. Now select **Add New API** and then, choose **Import**.
+
+    <img src="/img/oas/add-new-api.png" alt="Loading the API definition into Tyk Dashboard" />
+
+3. From the Import API screen, select **openAPI** because the object you want to import to Tyk is an OpenAPI description.
+
+    <img src="/img/oas/api-create-import.png" alt="Choosing what to import" />
+
+    
+
+    <Note>
+    On the Import API screen, there are three options for <b>Import Type</b>, it is important to select the correct one for the object that you want to load into Tyk:
+
+    - <b>openAPI</b> is used only for [OpenAPI descriptions](/api-management/gateway-config-tyk-oas#openapi-description) (without the [Tyk Vendor Extension](/api-management/gateway-config-tyk-oas#tyk-vendor-extension))
+    - <b>TykAPI</b> is used for a full [Tyk OAS API definition](/api-management/gateway-config-tyk-oas#what-is-a-tyk-oas-api-definition) (comprising OpenAPI description plus Tyk Vendor Extension) or Tyk Classic API definition
+    - <b>WSDL/XML</b> is used for WSDL/XML content and will result in a Tyk Classic API
+    </Note>
+
+
+4. Now you can choose the location of the OpenAPI description, which can be:
+
+    - pasted into the text editor
+    - uploaded using a file picker
+    - retrieved from a file server
+
+    <img src="/img/oas/api-create-import-location.png" alt="Loading the API definition into Tyk Dashboard" />
+
+5. You can optionally apply an [API template](/platform-management/api-templates) from the drop-down.
+
+    <img src="/img/oas/api-create-import-template.png" alt="Applying a template" />
+
+6. You can configure the *listen path* and *upstream (target) URL* in the **Manual configuration options** section. Note that if you do not provide a listen path, Tyk will default to `/` and if you do not provide an upstream URL, Tyk will use the first value provided in the [servers.url](/api-management/gateway-config-managing-oas#api-base-path) section in the OpenAPI description.
+
+    <img src="/img/oas/api-create-import-manual-options.png" alt="Configuring the listen path and upstream URL" />
+
+7. Tyk can automatically configure the request processing middleware chain based upon configuration defined by the OpenAPI Specification. If your OpenAPI desription contains the relevant data then select the characteristics you would like to configure.
+
+    <img src="/img/oas/api-create-import-auto-options.png" alt="Configuring the listen path and upstream URL" />
+
+    | Middleware | OpenAPI data used for configuration |
+    |------------|-------------------------------------|
+    | [Request validation](/api-management/traffic-transformation/request-validation#request-schema-in-openapi-specification) | Endpoints that have `requestBody` or `schema` |
+    | [Mock response](/api-management/traffic-transformation/mock-response#tyk-oas) | Endpoints with `examples` or `schema` |
+    | [Client authentication](/api-management/client-authentication#how-does-tyk-implement-authentication-and-authorization) | Defined in `security` and `securitySchemes` |
+    | [Allow list](/api-management/traffic-transformation/allow-list) | Restrict access only to declared endpoint paths |
+   
+8. Select **Import API** to complete the import and create the API based on your API definition.
+
+</Tab>
+
+<Tab title="Dashboard API">
+
+When making calls to the Tyk Dashboard API you'll need to set the domain name and port for your environment and provide credentials in the `Authorization` field for Tyk to authorize your request, as follows:
+
+| Interface         | Port | Authorization Header | Authorization credentials   |
+| :------------------- | :------ | :---------------------- | :----------------------------- |
+| Tyk Dashboard API | 3000 | `Authorization`      | From Dashboard User Profile |
+
+You can obtain your authorization credential (Dashboard API key) from the Tyk Dashboard UI:
+
+- Select **Edit profile** from the dropdown that appears when you click on your username in the top right corner of the screen
+- Scroll to the bottom of the page were you will see your **Tyk Dashboard API Access Credentials**
+
+You will also need to have ‘admin’ or ‘api:write’ permission if [RBAC](/api-management/user-management) is enabled.
+
+To create the API in Tyk, you simply send your OpenAPI document in the payload to the `POST /api/apis/oas/import` endpoint of your Tyk Dashboard API. 
+
+| Property     | Description                              |
+| :-------------- | :------------------------------------------ |
+| Resource URL | `/api/apis/oas/import`                   |
+| Method       | `POST`                                   |
+| Type         | None                                     |
+| Body         | OpenAPI Document                         |
+| Parameters   | Query: `listenPath`  `upstreamURL`  `authentication`  `allowList`   `validateRequest`     `mockResponse`  `apiID`   `templateId` |
+
+The optional parameters are:
+
+| Parameter         | Effect                          | Default if omitted |
+| :------------------- | :--------------------------------- | :-------------------- |
+| `listenPath`      | Set the listen path for the API | Defaults to `/`    |
+| `upstreamURL`     | Set the upstream (target) URL   | Defaults to the first URL in the `servers` section of the [OpenAPI description](/api-management/gateway-config-managing-oas#api-base-path) |
+| `authentication`  | Configure [client authentication](/api-management/client-authentication#how-does-tyk-implement-authentication-and-authorization) based on `security` and `securitySchemes` | Client authentication is not configured |
+| `allowList`       | Enable [allow list](/api-management/traffic-transformation/allow-list) middleware for all endpoints declared in the OpenAPI description | Allow list not configured |
+| `validateRequest` | Configure [request validation](/api-management/traffic-transformation/request-validation#request-schema-in-openapi-specification) for all endpoints with `requestBody` or `schema` defined | Request validation not configured |
+| `mockResponse`    | Configure [mock response](/api-management/traffic-transformation/mock-response#tyk-oas) for all endpoints with `examples` or `schema` defined | Mock response not configured |
+| `apiID`           | Id to be assigned to the new API | Tyk will determine and assign a unique Id |
+| `templateId`    | Apply the selected [API template](/platform-management/api-templates#applying-a-template-when-creating-an-api-from-a-tyk-oas-api-definition) when creating the API | No template is applied |
+
+**Check request response**
+
+If the command succeeds, you will see the following response, where `Meta` contains the unique identifier (`id`) for the API you have just created.
+
+```
+{
+    "Status": "OK",
+    "Message": "API created",
+    "Meta": {NEW-API-ID}
+}
+```
+
+</Tab>
+
+<Tab title="Gateway API">
+
+When making calls to the Tyk Gateway API you'll need to set the domain name and port for your environment and provide credentials in the `x-tyk-authorization` field for Tyk to authorize your request, as follows:
+
+| Interface       | Port | Authorization Header  | Authorization credentials        |
+| :----------------- | :------ | :----------------------- | :---------------------------------- |
+| Tyk Gateway API | 8080 | `x-tyk-authorization` | `secret` value set in `tyk.conf` |
+
+To create the API in Tyk, you simply send your OpenAPI document in the payload to the `POST /tyk/apis/oas/import` endpoint of your Tyk Gateway API. 
+
+| Property     | Description                              |
+| :-------------- | :------------------------------------------ |
+| Resource URL | `/tyk/apis/oas/import`                   |
+| Method       | `POST`                                   |
+| Type         | None                                     |
+| Body         | OpenAPI Document                         |
+| Parameters   | Query: `listenPath`  `upstreamURL`  `authentication`  `allowList`   `validateRequest`     `mockResponse`   `apiID` |
+
+The optional parameters are:
+
+| Parameter         | Effect                          | Default if omitted |
+| :------------------- | :--------------------------------- | :-------------------- |
+| `listenPath`      | Set the listen path for the API | Defaults to `/`    |
+| `upstreamURL`     | Set the upstream (target) URL   | Defaults to the first URL in the `servers` section of the [OpenAPI description](/api-management/gateway-config-managing-oas#api-base-path) |
+| `authentication`  | Configure [client authentication](/api-management/client-authentication#how-does-tyk-implement-authentication-and-authorization) based on `security` and `securitySchemes` | Client authentication is not configured |
+| `allowList`       | Enable [allow list](/api-management/traffic-transformation/allow-list) middleware for all endpoints declared in the OpenAPI description | Allow list not configured |
+| `validateRequest` | Configure [request validation](/api-management/traffic-transformation/request-validation#request-schema-in-openapi-specification) for all endpoints with `requestBody` or `schema` defined | Request validation not configured |
+| `mockResponse`    | Configure [mock response](/api-management/traffic-transformation/mock-response#tyk-oas) for all endpoints with `examples` or `schema` defined | Mock response not configured |
+| `apiID`           | Id to be assigned to the new API | Tyk will determine and assign a unique Id |
+
+**Check request response**
+
+If the command succeeds, you will see the following response, where `key` contains the unique identifier (`id`) for the API you have just created.
+
+```.json
+{
+    "key": {NEW-API-ID},
+    "status": "ok",
+    "action": "added"
+}
+```
+
+**Restart or hot reload**
+
+Once you have created your API you need to load it into the Gateway so that it can serve traffic. To do this you can either restart the Tyk Gateway or issue a [hot reload](/tyk-stack/tyk-gateway/important-prerequisites#hot-reload-is-critical-in-tyk-ce) command:
+
+```.curl
+curl -H "x-tyk-authorization: {your-secret}" -s http://{your-tyk-host}:{port}/tyk/reload/group
+```
+
+You can go to the `/apps` folder of your Tyk Gateway installation (by default in `/var/tyk-gateway`) to see where Tyk has stored your Tyk OAS API Definition.
+
+</Tab>
+
+</Tabs>
+
+#### API base path
+
+The [API base path](https://swagger.io/docs/specification/v3_0/api-host-and-base-path/) is the URL that a client should use when consuming (sending requests to) the API deployed on Tyk. This will comprise the address of the Tyk Gateway plus the API's listen path.
+
+**Detecting an Existing API Base Path**
+
+When creating an API, Tyk analyzes the `servers.url` section of the OpenAPI description to determine if it already contains a valid API base path.
+
+- If the first entry in `servers.url` is an address on the Tyk Gateway, then this is considered a valid API base path.
+- If there is not a valid API base path, then Tyk will assume that the first value in `servers.url` is the address of the upstream service - and so will use this as the *upstream (target) URL* for the API proxy. If there are multiple entries in `servers.url` Tyk will only consider the first entry and ignore all others.
+
+Tyk supports [OpenAPI server variables](https://learn.openapis.org/specification/servers.html#server-variables), so if the first `servers` entry contains a parameterised URL, Tyk will fill in the parameters with the values provided in the `variables` associated with that entry.
+
+**Setting the API Base Path**
+
+If the `servers.url` section did not contain a valid *API base path* then Tyk will insert a new entry in the first location in `servers.url` with a valid API base path comprising the Tyk Gateway address plus the *listen path* for the API.
+
+For example, given the following fragment of the OpenAPI description and importing to a Tyk Gateway at `https://my-gateway.com` specifying a listen path of `my-api`:
+
+```yaml
+    servers:
+    - url: https://upstream-A.com
+    - url: http://upstream-B.com
+```
+
+Tyk will configure the Tyk OAS API with the following:
+
+```yaml
+    servers:
+    - url: https://my-gateway.com/my-api/
+    - url: https://upstream-A.com
+    - url: http://upstream-B.com
+
+    x-tyk-api-gateway:
+      server:
+        listenPath:
+          value: /my-api/ 
+      upstream:
+        url: https://upstream-A.com
+```
+
+
+<Note>
+This can introduce a change to the "source of truth" (OpenAPI description) for the API (the addition of the API base path). We recommend that you export the modified OpenAPI description and apply this to your documentation, as it provides the address to which clients should direct their traffic.
+</Note>
+
+
+**Upstream URL Override**
+
+The servers section is not analyzed if an upstream (target) URL is specified during the import action. If an upstream URL was specified, that will be used as the upstream for the API. The API base path will still be constructed and added to the `servers` section of the OpenAPI description.
+
+**Tyk does not support relative URLs**
+
+If the first entry is a relative URL, or another format that Tyk cannot process, the import will fail with an error.
+
+For example attempting to import an OpenAPI description containing this configuration:
+
+```yaml
+    servers:
+      - url: /relative-url
+      - url: http://upstream-B.com
+```
+will error with the following message:
+
+```json
+{
+    "status": "error",
+    "message": "error validating servers entry in OAS: Please update \"/relative-url\" to be a valid url or pass a valid url with upstreamURL query param"
+}
+```
+
+#### Multi-part OpenAPI documents
+
+The OpenAPI Specification allows an OpenAPI description to be [split across multiple files](https://swagger.io/docs/specification/v3_0/using-ref/) by use of the `$ref` keyword.
+
+This allows you to share snippets of the API definition across multiple APIs, or to have specific ownership of elements of the API configuration owned by different teams.
+
+Tyk Dashboard supports the creation of Tyk OAS APIs from these multi-part OpenAPI documents.
+
+We consider two different types of file containing these OpenAPI descriptions:
+
+- the **main fragment**, which contains the `info` section
+- the **secondary fragments**, which contain snippets of the OpenAPI description that are referred to using external references (`$ref`)
+
+Note that secondary fragments can also contain external references to other secondary fragments (but not to the main fragment).
+
+When creating or updating an API, you simply provide Tyk with the **main fragment** and ensure that all of the references can be resolved.
+
+Resolution can be:
+- local, by providing a ZIP archive containing all fragments
+- remote, by providing resolvable paths to the secondary fragments (this is particularly used if the main fragment is provided via URL, as all fragments can then exist on the same file server).
+
+<Note>
+    The **main fragment** must be in a file named `openapi.json` or `openapi.yaml` (depending on the format used).
+</Note>
+
+
+##### Creating the ZIP Archive
+
+When creating ZIP archives for the multi-part OpenAPI import feature, it's important to exclude operating system metadata files that could interfere with the import process.
+
+- **MacOS Users**
+
+    When using the `zip` command on MacOS, include the `-X` flag to exclude extended attributes and hidden files: `zip -X -r archive.zip directory/`
+    
+- **Linux Users**
+
+    When using the `zip` command on Linux, you can exclude hidden files using: `zip -r archive.zip directory/ -x "*/\.*"`
+
+    To exclude specific metadata files: `zip -r archive.zip directory/ -x "*/\.*" "*/Thumbs.db" "*/.DS_Store"`
+
+- **Windows Users**
+
+    When using PowerShell to create ZIP archives on Windows, you can exclude hidden and system files with: `Compress-Archive -Path "directory\*" -DestinationPath "archive.zip" -CompressionLevel Optimal`
+
+    To exclude specific metadata files (like Thumbs.db or .DS_Store) you can use: `Get-ChildItem "directory" -Recurse -File | Where-Object { $_.Name -notmatch '(^\.DS_Store$|^Thumbs\.db$)' } | Compress-Archive -DestinationPath "archive.zip"`
+
+- **Using GUI Tools**
+
+    If using GUI tools like WinZip, WinRAR, or the built-in archive utilities:
+    - Ensure options to include hidden/system files are disabled
+    - Look for options like "Store Mac OS X resource forks/special files" and disable them
+    - Some tools have specific options to exclude .DS_Store files and other metadata
+
+Including these unwanted files may cause validation errors during the import process.
+
+## Maintaining your APIs
+
+Once a Tyk OAS API has been created in Tyk the Gateway will manage traffic to the exposed endpoints and proxy requests to the upstream service.
+
+Your service might evolve over time, with new features and endpoints being added and others retired. Tyk's flexible API versioning and update options provide you with choice for how to reflect this evolution in the APIs you expose to your clients.
+
+Your OpenAPI description is a living document that describes your upstream service. When this changes (for example, due to the addition of a new endpoint) you can use Tyk's [update API](/api-management/gateway-config-managing-oas#updating-an-api) feature to seamlessly apply the updated OpenAPI description, instantly extending the API proxy to handle traffic as your upstream evolves.
+
+Alternatively, and especially when you need to make breaking changes as your services and APIs evolve, you can create new [versions](/api-management/api-versioning) of your API and use configurable version identifiers to route traffic to the appropriate target.
+
+### Updating an API
+
+As developers working on services it can be necessary to regularly update the API when, for example, we add endpoints or support new methods. 
+
+One of the most powerful features of working with Tyk OAS is that you can make changes to the OpenAPI description outside Tyk and then update your API with the updated details. You can simply update the OpenAPI part of the Tyk OAS API definition without having to make any changes to the [Tyk Vendor Extension](/api-management/gateway-config-tyk-oas#tyk-vendor-extension) (`x-tyk-api-gateway`).
+
+You can alternatively work on the full Tyk OAS API definition outside Tyk and update your existing API proxy with the new configuration, without having to create a [new version](/api-management/api-versioning) of the API.
+
+<Tabs>
+
+<Tab title="API Designer">
+
+If you have an updated OpenAPI description or Tyk OAS API definition, in YAML or JSON format, you can use this to modify your existing API in Tyk Dashboard with only a few clicks.
+
+1. Start by selecting your API from the list on the **APIs** page in the **API Management** section.
+
+2. Now select **Update OAS** from the **Actions** dropdown.
+
+    <img src="/img/oas/api-actions-menu.png" alt="Select Update OAS to import the new OpenAPI description" />
+
+3. Now you can choose the location of the file that you want to use to update your API, which can be:
+
+    - pasted into the text editor
+    - uploaded using a file picker
+    - retrieved from a file server
+
+    <img src="/img/oas/api-update-options.png" alt="Configuring the import location and options" />
+
+4. You can re-configure the *listen path* and *upstream (target) URL* in the **Manual configuration options** section, but if you do not provide these then Tyk will leave them unchanged.
+
+5. Tyk must select the options to automatically configure the request processing middleware chain based upon configuration defined by the OpenAPI Specification for any new endpoints added in the update. If your OpenAPI desription contains the relevant data then select the characteristics you would like to configure.
+
+    <img src="/img/oas/api-create-import-auto-options.png" alt="Configuring the listen path and upstream URL" />
+
+    | Middleware | OpenAPI data used for configuration |
+    |------------|-------------------------------------|
+    | [Request validation](/api-management/traffic-transformation/request-validation#request-schema-in-openapi-specification) | Endpoints that have `requestBody` or `schema` |
+    | [Mock response](/api-management/traffic-transformation/mock-response#tyk-oas) | Endpoints with `examples` or `schema` |
+    | [Client authentication](/api-management/client-authentication#how-does-tyk-implement-authentication-and-authorization) | Defined in `security` and `securitySchemes` |
+    | [Allow list](/api-management/traffic-transformation/allow-list) | Restrict access only to declared endpoint paths |
+   
+8. Select **Import API** to complete the update.
+
+</Tab>
+
+<Tab title="Dashboard API">
+
+When making calls to the Tyk Dashboard API you'll need to set the domain name and port for your environment and provide credentials in the `Authorization` field for Tyk to authorize your request, as follows:
+
+| Interface         | Port | Authorization Header | Authorization credentials   |
+| :------------------- | :------ | :---------------------- | :----------------------------- |
+| Tyk Dashboard API | 3000 | `Authorization`      | From Dashboard User Profile |
+
+You can obtain your authorization credential (Dashboard API key) from the Tyk Dashboard UI:
+
+- Select **Edit profile** from the dropdown that appears when you click on your username in the top right corner of the screen
+- Scroll to the bottom of the page were you will see your **Tyk Dashboard API Access Credentials**
+
+You will also need to have ‘admin’ or ‘api:write’ permission if [RBAC](/api-management/user-management) is enabled.
+
+**Applying an Updated OpenAPI Description**
+
+To update just the OpenAPI description of your API in Tyk, you simply send the OpenAPI document in the payload to the `PATCH /api/apis/oas/{API-ID}` endpoint of your Tyk Gateway API. 
+
+| Property     | Description                              |
+| :-------------- | :------------------------------------------ |
+| Resource URL | `/api/apis/oas/{API-ID}`                 |
+| Method       | `PATCH`                                  |
+| Type         | None                                     |
+| Body         | OpenAPI document                         |
+| Parameters   | Path: `{API-ID}`                         |
+
+You need to specify which API to update - and do so using the `API-ID` value from the response you received from Tyk when creating the API. You can find this in the `x-tyk-api-gateway.info.id` field of the Tyk OAS API Definition stored in your main storage.
+
+**Applying an Updated Tyk OAS API Definition** 
+
+To update the whole API in Tyk, you simply send the Tyk OAS API definition in the payload to the `PATCH /api/apis/oas/{API-ID}` endpoint of your Tyk Gateway API. 
+
+| Property     | Description                              |
+| :-------------- | :------------------------------------------ |
+| Resource URL | `/api/apis/oas/{API-ID}`                 |
+| Method       | `PATCH`                                  |
+| Type         | None                                     |
+| Body         | Tyk OAS API Definition                   |
+| Parameters   | Path: `{API-ID}`                         |
+
+You need to specify which API to update - and do so using the `API-ID` value from the response you received from Tyk when creating the API. You can find this in the `x-tyk-api-gateway.info.id` field of the Tyk OAS API Definition stored in your main storage.
+
+**Check request response**
+
+If the command succeeds, you will see the following response, where `Meta` contains the unique identifier (`id`) for the API you have just updated:
+
+```.json
+{
+    "Status": "OK",
+    "Message": "API modified",
+    "Meta": {API-ID}
+}
+```
+
+</Tab>
+
+<Tab title="Gateway API">
+
+When making calls to the Tyk Gateway API you'll need to set the domain name and port for your environment and provide credentials in the `x-tyk-authorization` field for Tyk to authorize your request, as follows:
+
+| Interface       | Port | Authorization Header  | Authorization credentials        |
+| :----------------- | :------ | :----------------------- | :---------------------------------- |
+| Tyk Gateway API | 8080 | `x-tyk-authorization` | `secret` value set in `tyk.conf` |
+
+
+**Applying an Updated OpenAPI Description**
+
+To update just the OpenAPI description of your API in Tyk, you simply send the OpenAPI document in the payload to the `PATCH /tyk/apis/oas/{API-ID}` endpoint of your Tyk Gateway API. 
+
+| Property     | Description                              |
+| :-------------- | :------------------------------------------ |
+| Resource URL | `/tyk/apis/oas/{API-ID}`                 |
+| Method       | `PATCH`                                  |
+| Type         | None                                     |
+| Body         | OpenAPI document                         |
+| Parameters   | Path: `{API-ID}`  Query: `templateId`    |
+
+You need to specify which API to update - and do so using the `API-ID` value from the response you received from Tyk when creating the API. You can find this in the `x-tyk-api-gateway.info.id` field of the Tyk OAS API Definition that Tyk has stored in the `/apps` folder of your Tyk Gateway installation.
+
+
+**Applying an Updated Tyk OAS API Definition** 
+
+To update the whole API in Tyk, you simply send the Tyk OAS API definition in the payload to the `PATCH /tyk/apis/oas/{API-ID}` endpoint of your Tyk Gateway API. 
+
+| Property     | Description                              |
+| :-------------- | :------------------------------------------ |
+| Resource URL | `/tyk/apis/oas/{API-ID}`                 |
+| Method       | `PATCH`                                  |
+| Type         | None                                     |
+| Body         | Tyk OAS API Definition                   |
+| Parameters   | Path: `{API-ID}`                         |
+
+You need to specify which API to update - and do so using the `API-ID` value from the response you received from Tyk when creating the API. You can find this in the `x-tyk-api-gateway.info.id` field of the Tyk OAS API Definition that Tyk has stored in the `/apps` folder of your Tyk Gateway installation.
+
+
+**Check request response**
+
+If the command succeeds, you will see the following response, where `key` contains the unique identifier (`id`) for the API you have just updated:
+
+```.json
+{
+    "key": {API-ID},
+    "status": "ok",
+    "action": "modified"
+}
+```
+
+**Restart or hot reload**
+
+Once you have updated your API you need to load it into the Gateway so that it can serve traffic. To do this you can either restart the Tyk Gateway or issue a [hot reload](/tyk-stack/tyk-gateway/important-prerequisites#hot-reload-is-critical-in-tyk-ce) command:
+
+```.curl
+curl -H "x-tyk-authorization: {your-secret}" -s http://{your-tyk-host}:{port}/tyk/reload/group
+```
+
+</Tab>
+
+</Tabs>
+
+
+### Exporting an API asset
+
+Each API on Tyk has an API definition comprising the OpenAPI description and the Tyk Vendor Extension. We offer the facility for you to export (download) two assets for an API - just the OpenAPI description, or the full Tyk OAS API definition.
+
+When using Tyk Dashboard these can be exported in either JSON or YAML format; for Tyk Gateway API users the assets can only be exported in JSON format.
+
+<Tabs>
+
+<Tab title="API Designer">
+
+1. Start by selecting your API from the list on the **APIs** page in the **API Management** section.
+
+2. Select **Export API** from the **Actions** dropdown.
+
+    <img src="/img/oas/api-actions-menu.png" alt="Select Export API to download an asset from Tyk" />
+
+3. Now you can choose what you want to export, the filename (a default is offered which is based on the API Id) and the file format (JSON or YAML).
+
+    <img src="/img/oas/api-export-options.png" alt="Choosing what to download" />
+
+4. Finally select **Export** to save the file to your local machine.
+
+</Tab>
+
+<Tab title="Dashboard API">
+
+When making calls to the Tyk Dashboard API you'll need to set the domain name and port for your environment and provide credentials in the `Authorization` field for Tyk to authorize your request, as follows:
+
+| Interface         | Port | Authorization Header | Authorization credentials   |
+| :------------------- | :------ | :---------------------- | :----------------------------- |
+| Tyk Dashboard API | 3000 | `Authorization`      | From Dashboard User Profile |
+
+You can obtain your authorization credential (Dashboard API key) from the Tyk Dashboard UI:
+
+- Select **Edit profile** from the dropdown that appears when you click on your username in the top right corner of the screen
+- Scroll to the bottom of the page were you will see your **Tyk Dashboard API Access Credentials**
+
+You will also need to have ‘admin’ or ‘api:write’ permission if [RBAC](/api-management/user-management) is enabled.
+
+To export an API asset, you use the `GET /api/apis/oas/{API-ID}/export` endpoint, indicating whether you require the full Tyk OAS API definition or only the OpenAPI description using the `mode` parameter.
+
+| Property     | Description                                      |
+| :-------------- | :-------------------------------------------------- |
+| Resource URL | `/api/apis/oas/{API-ID}`                         |
+| Method       | `GET`                                            |
+| Type         | None                                             |
+| Parameters   | Path: `{API-ID}`  Query: `mode`   `Content-Type` |
+
+Where:
+- `API-ID` is the unique `id` assigned in the Tyk Vendor Extension that identifies the API
+- `mode` to identify the asset to export: `public` for the OpenAPI description (default empty for full API definition)
+- `Content-Type` to select the format for the exported asset: `application/x-yaml` or `application/json`
+</Tab>
+
+<Tab title="Gateway API">
+
+When making calls to the Tyk Gateway API you'll need to set the domain name and port for your environment and provide credentials in the `x-tyk-authorization` field for Tyk to authorize your request, as follows:
+
+| Interface       | Port | Authorization Header  | Authorization credentials        |
+| :----------------- | :------ | :----------------------- | :---------------------------------- |
+| Tyk Gateway API | 8080 | `x-tyk-authorization` | `secret` value set in `tyk.conf` |
+
+To export an API asset, you use the `GET /tyk/apis/oas/{API-ID}/export` endpoint, indicating whether you require the full Tyk OAS API definition or only the OpenAPI description using the `mode` parameter.
+
+| Property     | Description                                |
+| :-------------- | :-------------------------------------------- |
+| Resource URL | `/tyk/apis/oas/{API-ID}`                   |
+| Method       | `GET`                                      |
+| Type         | None                                       |
+| Parameters   | Path: `{API-ID}`  Query: `mode`            |
+
+Where:
+- `API-ID` is the unique `id` assigned in the Tyk Vendor Extension that identifies the API
+- `mode=public` to export the OpenAPI description (otherwise, export the full API definition)
+</Tab>
+
+</Tabs>
diff --git a/api-management/gateway-config-tyk-classic.mdx b/api-management/gateway-config-tyk-classic.mdx
new file mode 100644
index 0000000000..bf23aef18c
--- /dev/null
+++ b/api-management/gateway-config-tyk-classic.mdx
@@ -0,0 +1,793 @@
+---
+title: "Tyk Classic API Definition"
+description: "Learn how to configure Tyk Classic API Definitions for your API management needs"
+keywords: "Gateway, Configuration, Tyk Classic, Tyk Classic API Definition, Tyk Classic API Definition Object"
+sidebarTitle: "Tyk Classic Reference"
+---
+
+import ApiDefGraphql from '/snippets/api-def-graphql.mdx';
+
+## Introduction to Tyk Classic
+
+Tyk's legacy API definition is now called Tyk Classic and is used for GraphQL, XML/SOAP and TCP services.
+
+From Tyk 5.8 we recommend that any REST APIs are migrated to the newer [Tyk OAS API](/api-management/gateway-config-tyk-oas) style, in order that they can benefit from simpler configuration and future enhancements.
+
+For Tyk Dashboard users with an existing portfolio of Tyk Classic API definitions, we provide a [migration tool](/api-management/migrate-from-tyk-classic), available via the Dashboard API and UI.
+
+
+<Note>
+For versions of Tyk prior to 5.8 not all Gateway features can be configured using the Tyk OAS API definition, for edge cases you might need to use Tyk Classic for REST APIs, though we recommend updating to Tyk 5.8 and adopting Tyk OAS.
+</Note>
+
+
+The Tyk Classic API definition has a flat structure that does not use the `omitempty` style, requiring all fields to be present even if set to null, resulting in a larger object than that for an equivalent Tyk OAS API definition.
+
+Note that there are some specific differences between Tyk Classic and Tyk OAS APIs, in particular with respect to [default authentication method](#configuring-authentication-for-tyk-classic-apis) and [API versioning](#tyk-classic-api-versioning).
+
+## Tyk Classic API versioning
+
+When multiple versions of a Tyk Classic API are created, the details are stored in a single API definition - unlike with Tyk OAS where a separate API definition is created for each version. The common configuration is stored in the root, whereas the details of the different versions are stored in a dedicated `version_data` object, within the API definition.
+
+Whilst this allows for easy management of all the API versions, it limits the number of features that can be configured differently between versions, as not all Gateway configuration options are duplicated in `version_data`.
+
+Tyk enforces strict access control to specific versions of APIs if these are specified in the access token (key). If, once Tyk has identified the API to load, and has allowed the access key through, it will check the access token's session data for access permissions. If it finds none, it will let the token through. However, if there are permissions and versions defined, it will be strict in **only** allowing access to that version.
+
+Key things to note when configuring versioning for a Tyk Classic API:
+
+- you must set `version_data.not_versioned` to `false` for Tyk to treat the API as versioned
+- `version_data.default_version` must contain the `name` of the version that shall be treated as default (for access control and default fallback)
+- you can use `version_data.paths` to configure endpoint-level ignore, allow and block lists (which can be used to configure a mock response)
+- you must use `version_data.extended_paths` to configure other endpoint-level middleware
+- common versioning configuration is mostly contained within the [definition](/api-management/gateway-config-tyk-classic#common-versioning-configuration) object
+- configuration for the different versions is contained within the [version_data](/api-management/gateway-config-tyk-classic#version-specific-configuration) object
+  - this also contains some common configuration (`not_versioned` and `default_version`)
+
+When you first create an API, it will not be "versioned" (i.e. `not_versioned` will be set to `true`) and there will be a single version with the name `Default` created in the `version_data` section.
+
+### Common versioning configuration
+
+<ParamField path="definition">
+This object in the root of the Tyk Classic API definition handles information related to how Tyk should handle requests to the versioned API
+</ParamField>
+
+<ParamField path="definition.location">
+Used to configure where the versioning identifier should be provided, one of:`header`, `url`, `url-param`.
+</ParamField>
+
+<ParamField path="definition.key">
+The name of the key that contains the versioning identifier if `definition.location` is set to `header` or `url-param`.
+</ParamField>
+
+<ParamField path="definition.strip_versioning_data">
+Set this to `true` to remove the versioning identifier when creating the upstream (target) URL.
+</ParamField>
+
+<ParamField path="definition.fallback_to_default">
+Set this to `true` to invoke the default version if an invalid version is specified in the request.
+</ParamField>
+
+<ParamField path="definition.url_versioning_pattern">
+Available from Tyk 5.5.0, if you are have set both `definition.strip_versioning_data` and `definition.fallback_to_default` to `true` and are using `definition.location=url` you can configure this with a regex that matches the format that you use for the versioning identifier (`versions.{version-name}.name`)
+</ParamField>
+
+The following fields are either deprecated or otherwise not used for Tyk Classic API versioning and should be left with their default values:
+
+- `definition.default`: defaults to an empty string `""`
+- `definition.enabled`: defaults to `false`
+- `definition.name`: defaults to an empty string `""`
+- `definition.strip_path`: deprecated field; defaults to `false`
+- `definition.versions`: defaults to an empty array `{}`
+
+### Version specific configuration
+
+<ParamField path="version_data">
+This object contains the version status and configuration for  your API
+</ParamField>
+
+<ParamField path="version_data.not_versioned">
+Set this to `false` to treat this as a versioned API. If you are not using versioning for this API you must have a single `Default` entry in the `version_data.versions` map.
+</ParamField>
+
+<ParamField path="version_data.default_version">
+Used to configure where the versioning identifier should be provided, one of:`header`, `url`, `url-param`.
+</ParamField>
+
+<ParamField path="version_data.versions">
+A list of objects that describe the versions of the API; there must be at least one (`Default`) version defined for any API (even non-versioned APIs). Each version of your API should be defined here with a unique `name`.
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.name">
+An identifier for this version of the API, for example `Default` or `v1`. The value given here is what will Tyk will match against the value in the `definition.key`.
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.expires">
+If a value is set then Tyk will automatically deprecate access to the API after the specified timestamp. The entry here takes the form of: `"YYYY-MM-DD HH:MM"`. If this is not set the version will never expire.
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.paths">
+This object enables configuration of the basic allow list, block list and ignore authentication middleware for specific endpoints in the API version. You can also configure these and many other per-endpoint middleware using the `extended_paths` field.
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.override_target">
+You can configure a different target URL here which will be used instead of the value stored in `proxy.target_url`, redirecting requests to a different hostname or domain. Note that this will also override (and so is not compatible with) upstream load balancing and Service Discovery, if configured for this API.
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.global_headers">
+A `key:value` map of HTML headers to inject to the request.
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.global_headers_remove">
+A list of HTML headers to remove from the request.
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.global_size_limit">
+Apply a maximum size to the request body (payload) - in bytes.
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.ignore_endpoint_case">
+If this boolean flag is set to `false`, Tyk will apply case sensitive matching of requests to endpoints defined in the API definition. 
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.use_extended_paths">
+Set this value to `true` if you want Tyk to apply specific middleware to endpoints in this version, configured using `version_data.versions.{version-name}.extended_paths`.
+</ParamField>
+
+<ParamField path="version_data.versions.{version-name}.extended_paths">
+This field contains a list of middleware configurations and to which paths they should be applied. The available middleware are:
+
+```
+{
+  black_list[],
+  white_list[],
+  ignore[],
+  track_endpoints[],
+  do_not_track_endpoints[],
+  internal[],
+  method_transforms[],
+  transform[],
+  transform_headers[],
+  transform_response[],
+  transform_response_headers[],
+  size_limits[],
+  validate_json[],
+  url_rewrites[],
+  virtual[],
+  transform_jq[],
+  cache[],
+  hard_timeouts[],
+  circuit_breakers[]
+}
+```
+
+Each entry must include the method and path (identifying the endpoint) where the middleware runs. You can find full documentation for each middleware in the [Traffic Transformation](/api-management/traffic-transformation) section including configuration instructions for the Tyk Classic API definition, for example the [allow list](/api-management/traffic-transformation/allow-list#api-definition-1). When using Tyk Classic, the mock response functionality is configured via the `black_list[]`, `white_list[]` or `ignore[]` middleware.
+</ParamField>
+
+
+## Configuring authentication for Tyk Classic APIs
+
+Tyk Classic APIs *default to the auth token method* for authenticating requests. Flags in the API definition can be configured to enforce an alternative method:
+
+- keyless (no authentication of the client)
+- basic authentication
+- HMAC request signing
+- Tyk as the OAuth 2.0 authorization server
+- JWT authentication
+
+<ParamField path="use_keyless">
+This will switch off all key checking and open the API definition up, some analytics will still be recorded, but rate-limiting, quotas and security policies will not be possible (there is no session to attach requests to). This is a good setting for checking if Tyk works and is proxying traffic correctly.
+</ParamField>
+
+<ParamField path="auth">
+This object contains the basic configuration for the Auth (Bearer) Token method.
+</ParamField>
+
+<ParamField path="auth.auth_header_name">
+The header name (key) where Tyk should look for the token.
+</ParamField>
+
+<ParamField path="auth.use_param">
+Set this to true to instruct Tyk to expect the token in the URL parameter with key `auth.param_name`.
+</ParamField>
+
+<ParamField path="auth.param_name">
+The name of the URL parameter key containing the auth token. Note that this is case sensitive.
+</ParamField>
+
+<ParamField path="auth.use_cookie">
+Set this to true to instruct Tyk to expect the token in the URL parameter with key `auth.cookie_name`.
+</ParamField>
+
+<ParamField path="auth.cookie_name">
+The name of the cookie containing the auth token. Note that this is case sensitive.
+</ParamField>
+
+<ParamField path="auth.use_certificate">
+Implement Certificate Authentication (Dynamic mTLS prior to Tyk 5.12.0)
+</ParamField>
+
+<ParamField path="auth.validate_signature">
+Boolean value set to `true` to enable Auth Token Signature Validation
+</ParamField>
+
+<ParamField path="auth.signature">
+Configuration for Auth Token Signature Validation
+</ParamField>
+
+<ParamField path="auth.signature.algorithm">
+The algorithm you wish to validate the signature against. Options are:
+- `MasherySHA256`
+- `MasheryMD5`
+ 
+</ParamField>
+
+<ParamField path="auth.signature.header">
+Header key for attempted signature
+</ParamField>
+
+<ParamField path="auth.signature.secret">
+The shared secret which was used to sign the request
+- this can hold a dynamic value, by referencing `$tyk_meta` or `$tyk_context` variables.
+- for example: if you have stored the shared secret in the field `individual_secret` of the session token's meta-data you would use the value `"secret": "$tyk_meta.individual_secret"`.
+</ParamField>
+
+<ParamField path="auth.signature.allowed_clock_skew">
+Maximum permitted deviation in seconds between UNIX timestamp of Tyk & UNIX timestamp used to generate the signed request
+</ParamField>
+
+<ParamField path="use_basic_auth">
+This method will enable basic auth as specified by the HTTP spec, an API with this flag set will request for a username and password and require a standard base64 Authentication header to be let through. 
+</ParamField>
+
+<ParamField path="basic_auth.disable_caching">
+This disables the caching of basic authentication keys.
+</ParamField>
+
+<ParamField path="basic_auth.cache_ttl">
+This is the refresh period for the basic authentication key cache (in seconds).
+</ParamField>
+
+<ParamField path="enable_signature_checking">
+If this option is set to `true`, Tyk will implement the HMAC signing standard as proposed in the [HTTP Signatures Spec](https://web-payments.org/specs/ED/http-signatures/2014-02-01/#page-3). In particular the structure of the Authorization header and the encoding method need to be taken into account.
+- this method will use a session key to identify a user and a user secret that should be used by the client to sign each request's `date` header
+- it will also introduce clock skew checks, requests outside of 300ms of the system time will be rejected
+- it is not recommended for Single-Page-Webapps (SPA) or Mobile apps due to the fact that secrets need to be distributed
+</ParamField>
+
+<ParamField path="hmac_allowed_algorithms">
+Tyk supports the following HMAC algorithms: “hmac-sha1", "hmac-sha256", "hmac-sha384", "hmac-sha512”. You can limit which ones you want to support with this option. For example, [“hmac-sha256”]
+</ParamField>
+
+<ParamField path="hmac_allowed_clock_skew">
+Set this value to anything larger than `0` to set the number of milliseconds that will be tolerated for clock skew. Set to `0` to prevent clock skew checks on requests (only in HMAC mode, i.e. when `enable_signature_checking` is set to `true`).
+</ParamField>
+
+<ParamField path="use_oauth2">
+This authentication method will use Tyk as the OAuth 2.0 Authorization Server. Enabling this option will cause Tyk to add OAuth2-standard endpoints to the API for `/authorize` and `/token`, these will supersede any other requests to your proxied system in order to enable the flow. 
+</ParamField>
+
+<ParamField path="oauth_meta.allowed_access_types">
+This is a string array of OAuth access options depending on the OAuth grant types to be supported. Valid options are:
+- `authorization_code` - client has an authorization code to request a new access token.
+- `refresh_token` - client can use a refresh token to refresh expired bearer access token.
+</ParamField>
+
+<ParamField path="oauth_meta.allowed_authorize_types">
+This is a string array of OAuth authorization types. Valid options are:
+- `code` - Client can request an authorization code which can be used to request an access code via a server request (traditionally reserved for server-side apps).
+- `token` - Client can request an access token directly, this will not enable refresh tokens and all tokens have a 12 hour validity. Recommended for mobile apps and single-page webapps.
+</ParamField>
+
+<ParamField path="oauth_meta.auth_login_redirect">
+The Tyk OAuth flow has a dummy (intercept) `/authorize` endpoint which basically redirects the user to your login and authentication page, it will also send along all OAuth data as part of the request (so as to mimic a regular app flow). This is the URL that the user will be sent to (via `POST`).
+</ParamField>
+
+<ParamField path="notifications">
+When Tyk is used as the OAuth 2.0 Authorization Server, because it will handle access requests on your behalf once authorization codes have been issued, it will need to notify your system that these have occurred. It will `POST` key data to the URL set in these options to ensure that your system is synchronised with Tyk.
+</ParamField>
+
+<ParamField path="notifications.shared_secret">
+Posted data to your service will use this shared secret as an authorization header. This is to ensure that messages being received are from Tyk and not from another system.
+</ParamField>
+
+<ParamField path="notifications.oauth_on_keychange_url">
+The URL that will be sent the updated information - the URL will be polled up to 3 times if there is a communications failure. On a `200 OK` response it stops.
+</ParamField>
+
+<ParamField path="auth_configs">
+This section allows definition of multiple chained authentication mechanisms that will be applied to requests to the API, with distinct authentication headers identified for the different auth modes.
+
+For example:
+
+```json
+{
+  "auth_configs": {
+    "authToken": { "auth_header_name": "My-Auth-Header-Key" },
+    "basic": { "auth_header_name": "My-Basic-Auth-Header-Key" }
+  }
+}
+```
+</ParamField>
+
+<ParamField path="base_identity_provided_by">
+This enables multiple authentication and indicates which authentication method provides the session object that determines access control, rate limits and usage quotas.
+
+It should be set to one of the following:
+
+- `auth_token`
+- `hmac_key`
+- `basic_auth_user`
+- `jwt_claim`
+- `oidc_user`
+- `oauth_key`
+- `custom_auth`
+</ParamField>
+
+<ParamField path="enable_jwt">
+Set JWT as the authentication method for this API.
+</ParamField>
+
+<ParamField path="jwt_signing_method">
+Either HMAC or RSA - HMAC requires a shared secret while RSA requires a public key to use to verify against. Please see the section on JSON web tokens for more details on how to generate these.
+</ParamField>
+
+<ParamField path="jwt_source">
+Must be a base64 encoded valid RSA, ECDSA or HMAC key or the full address of a JSON Web Key Set (JWKS) endpoint. This key (or the JWKS retrieved from the endpoint) will be used to validate inbound JWT and throttle them according to the centralised JWT options and fields set in the configuration. See [JWT signature validation](/api-management/authentication/jwt-signature-validation#configuring-idps-in-the-api-definition) for more details on using a JWKS endpoint.
+</ParamField>
+
+<ParamField path="jwt_identity_base_field">
+Identifies the user or identity to be used in the Claims of the JWT. This will fallback to `sub` if not found. This field forms the basis of a new "virtual" token that gets used after validation. It means policy attributes are carried forward through Tyk for attribution purposes.
+    
+Centralised JWTs add a `TykJWTSessionID` to the session metadata on create to enable upstream hosts to work with the internalised token should things need changing.
+</ParamField>
+
+<ParamField path="jwt_policy_field_name">
+The policy ID to apply to the virtual token generated for a JWT.
+</ParamField>
+
+<ParamField path="jwt_issued_at_validation_skew">
+Prevent token rejection due to clock skew between servers for Issued At claim (seconds, default: 0)
+</ParamField>
+
+<ParamField path="jwt_expires_at_validation_skew">
+Prevent token rejection due to clock skew between servers for Expires At claim (seconds, default: 0)
+</ParamField>
+
+<ParamField path="jwt_not_before_validation_skew">
+Prevent token rejection due to clock skew between servers for Not Before claim (seconds, default: 0)
+</ParamField>
+
+## GraphQL specific fields 
+
+<ApiDefGraphql/>
+
+## General features
+
+### API identification
+
+<ParamField path="api_id">
+The identifier for the API This should be unique, but can actually be any kind of string. For single-instance setups this can probably be set to `1`. It is recommended to make this a UUID. The `api_id` is used to identify the API in queries to the Tyk Gateway API or Tyk Dashboard API.
+</ParamField>
+
+<ParamField path="name">
+Human readable name of the API. It is used for identification purposes but does not act as an index.
+</ParamField>
+
+<ParamField path="org_id">
+This is an identifier that can be set to indicate ownership of an API key or of an individual API. If the Org ID is set (recommended), it is prepended to any keys generated by Tyk - this enables lookups by prefixes from Redis of keys that are in the system.
+</ParamField>
+
+<ParamField path="domain">
+The domain to bind this API to. Multiple APIs can share the same domain, so long as their listen paths are unique.
+This domain will affect your API only. To set up the portal domain for your organization, please register it in the main Tyk Dashboard settings file. 
+Your Tyk Gateway can listen on multiple domains/subdomains through the use of regular expressions, more precisely the RE2 Syntax. They are defined using the format `{name}` or `{name:pattern}`. 
+  * `www.example.com` Matches only if domain is www.example.com
+  * `{subdomain:[a-z]+}.example.com` Matches dynamic subdomain
+  * `{subdomain:foo|bar}.example.com` will listen on foo.example.com and bar.example.com"
+</ParamField>
+
+<ParamField path="ignore_endpoint_case">
+If set to `true` when matching the URL path for requests to this API, the case of the endpoint path will be ignored. So for an API `my-api` and the endpoint `getuser`, requests to all of the following will be matched:
+ 
+  * `/my-api/getuser`
+  * `/my-api/getUser`
+  * `/my-api/GetUser`
+
+If set to true, this will override the endpoint level settings in [Ignore](/api-management/traffic-transformation/ignore-authentication#case-sensitivity), [Allowlist](/api-management/traffic-transformation/allow-list#case-sensitivity) and [Blocklist](/api-management/traffic-transformation/block-list#case-sensitivity) middleware. This setting can be overriden at the Tyk Gateway level, and so applied to all APIs, by setting `ignore_endpoint_case` to `true` in your `tyk.conf` file. See [ignore_endpoint_case](/tyk-oss-gateway/configuration#ignore_endpoint_case) for details.
+</ParamField>
+
+<ParamField path="enable_batch_request_support">
+Set to true to enable batch support
+</ParamField>
+
+<ParamField path="id">
+This is allocated by Tyk to locate the API definition in the Dashboard main storage and bears no actual relation to the identity of the API.
+</ParamField>
+
+<ParamField path="active">
+This field is used by Tyk Dashboard to control whether the API will serve traffic. If set to `false` then on Gateway start, restart or reload, the API will be ignored and all paths and routes for that API will cease to be proxied. Any keys assigned to it will still exist, though they will not be let through for that particular API.
+</ParamField>
+
+<ParamField path="internal">
+This field controls the exposure of the API on the Gateway. When set to `true`, the API will not be made available for external access and will not be included in API listings returned by the Gateway's management APIs; it will be accessible only via [internal routing](/advanced-configuration/transform-traffic/looping).
+</ParamField>
+
+### Access token management
+
+<ParamField path="session_lifetime">
+The session (API access key/token) lifetime will override the expiry date if it has been set on a key (in seconds). for example, if a key has been created that never expires, then it will remain in the session cache forever unless manually deleted. If a re-auth needs to be forced or a default expiry needs to be applied to all keys, then use this feature to set the session expiry for an an entire API.
+</ParamField>
+
+<ParamField path="session_lifetime_respects_key_expiration">
+If this is set to `true` and the key expiration date is less than the `session_lifetime`, the key expiration value will be set to `session_lifetime`. Don't forget that the key expiration is set in unix timestamp but `session_lifetime` is set in seconds. Also, `session_lifetime_respects_key_expiration` exists in the global config too. When the global one is set to `true`, the one set at the API level will be ignored.
+</ParamField>
+
+<ParamField path="dont_set_quota_on_create">
+If set to true, when the keys are created, edited or added for this API, the quota cache in Redis will not be reset.
+</ParamField>
+
+### Traffic logs
+
+<ParamField path="enable_detailed_recording">
+If this value is set to `true`, the Gateway will record the request and response payloads in traffic logs.
+</ParamField>
+
+<ParamField path="do_not_track">
+If this value is set to `true`, the Gateway will not generate traffic logs for requests to the API.
+</ParamField>
+
+<ParamField path="tag_headers">
+This specifies a string array of HTTP headers values which turned into tags. For example, if you include the `X-Request-ID` header to `tag_headers`, for each incoming request it will include an `x-request-id-<header_value>` tag to request an analytic record. This functionality can be useful if you need analytics for request headers without the body content (Enabling detailed logging is another option, but it records the full request and response objects and consumes a lot more space). 
+</ParamField>
+
+<ParamField path="expire_analytics_after">
+This value (in seconds) will be used to indicate a TTL (ExpireAt) for the retention of analytics created from traffic logs generated for this API that are stored in MongoDB. If using an alternative analytics storage solution that does not respect ExpireAt then you must manage the record TTL separately.
+</ParamField>
+
+### OpenTelemetry
+
+<ParamField path="detailed_tracing">
+If this value is set to `true`, the Gateway will generate detailed OpenTelemetry spans for requests to the API.
+</ParamField>
+
+### API Level Rate Limits
+
+<ParamField path="global_rate_limit">
+The [API-level rate limit](/api-management/rate-limit#rate-limiting-layers) aggregates the traffic coming into an API from all sources and ensures that the overall rate limit is not exceeded. It is composed of a `rate` (number of requests) and `per` (interval). If either is set to `0` then no API-level limit is applied.
+</ParamField>
+
+<ParamField path="disable_rate_limit">
+If set to `true`, all rate limits are disabled for the specified API (both API-level and key-level)
+</ParamField>
+
+### Event handlers
+
+<ParamField path="event_handlers">
+This adds the ability to configure an API with event handlers to perform specific actions when an event occurs.
+</ParamField>
+
+<ParamField path="events">
+Each event handler that is added to the event_handlers.events section, is mapped by the event type, and then a list of each handler configuration, defined by the handler name and the handler metadata (usually some kind of configurable options for the specific handler)
+</ParamField>
+
+### Custom data
+
+<ParamField path="enable_context_vars">
+Context variables are extracted from the request at the start of the middleware chain, and must be explicitly enabled in order for them to be made available to your transforms. These values can be very useful for later transformation of request data, for example, in converting a Form-based POST into a JSON-based PUT or to capture an IP address as a header.
+</ParamField>
+
+<ParamField path="config_data">
+You can use this field to pass custom attributes to the virtual endpoint middleware. It is a list of key:value pairs.
+</ParamField>
+
+### IP Access Control
+
+<ParamField path="enable_ip_whitelisting">
+This works with the associated `allowed_ips` list and, when set to `true`, accepts only requests coming from the defined list of allowed IP addresses.
+</ParamField>
+
+<ParamField path="allowed_ips">
+A list of strings that defines the IP addresses (in [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation)) that are allowed access via Tyk. This list is explicit and wildcards are not supported.
+</ParamField>
+
+<ParamField path="enable_ip_blacklisting">
+This works with the associated `blacklisted_ips` list and, when set to `true`, rejects and requests coming from the defined list of blocked IP addresses.
+</ParamField>
+
+<ParamField path="blacklisted_ips">
+A list of strings that defines the IP addresses (in [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation)) that are blocked access via Tyk. This list is explicit and wildcards are not supported.
+</ParamField>
+
+### Cross-Origin Resource Sharing (CORS)
+
+<ParamField path="CORS.enable">
+Enable CORS for the API
+</ParamField>
+
+<ParamField path="CORS.allowed_origin">
+A list of origin domains to allow access from. Wildcards are also supported, e.g. http://*.foo.com
+</ParamField>
+
+<ParamField path="CORS.allowed_methods">
+A list of HTTP methods to allow access via.
+</ParamField>
+
+<ParamField path="CORS.allowed_headers">
+Headers that are allowed within a request.
+</ParamField>
+
+<ParamField path="CORS.exposed_headers">
+Headers that are exposed back in the response.
+</ParamField>
+
+<ParamField path="CORS.allow_credentials">
+Whether credentials (cookies) should be allowed.
+</ParamField>
+
+<ParamField path="CORS.max_age">
+Maximum age of credentials.
+</ParamField>
+
+<ParamField path="CORS.options_passthrough">
+Allow CORS OPTIONS preflight request to be proxied directly to upstream, without authentication and the rest of the checks. This means that pre-flight requests generated by web-clients such as SwaggerUI will be able to test the API using trial keys. If your service handles CORS natively, then enable this option.
+</ParamField>
+
+### Proxy Transport Settings
+
+<ParamField path="proxy.preserve_host_header">
+Set to `true` to preserve the host header. If `proxy.preserve_host_header` is set to `true` in an API definition then the host header in the outbound request is retained to be the inbound hostname of the proxy.
+</ParamField>
+
+<ParamField path="proxy.listen_path">
+The path to listen on, e.g. `/api` or `/`. Any requests coming into the host, on the port that Tyk is configured to run on, that go to this path will have the rules defined in the API Definition applied. Versioning assumes that different versions of an API will live on the same URL structure. If you are using URL-based versioning (e.g. `/v1/function`, `/v2/function/`) then it is recommended to set up a separate non-versioned definition for each version as they are essentially separate APIs.
+    
+Proxied requests are literal, no re-writing takes place, for example, if a request is sent to the listen path of: `/listen-path/widgets/new` and the URL to proxy to is `http://your.api.com/api/` then the *actual* request that will land at your service will be: `http://your.api.com/api/listen-path/widgets/new`.
+    
+This behavior can be circumvented so that the `listen_path` is stripped from the outgoing request. See the section on `strip_listen_path` below.
+</ParamField>
+
+<ParamField path="proxy.strip_listen_path">
+By setting this to `true`, Tyk will attempt to replace the `listen-path` in the outgoing request with an empty string. This means that in the above scenario where `/listen-path/widgets/new` and the URL to proxy to is `http://your.api.com/api/` becomes `http://your.api.com/api/listen-path/widgets/new`, actually changes the outgoing request to be: `http://your.api.com/api/widgets/new`.
+</ParamField>
+
+<ParamField path="proxy.target_url">
+This defines the target URL that the request should be proxied to if it passes all checks in Tyk.
+</ParamField>
+
+<ParamField path="proxy.disable_strip_slash">
+This boolean option allows you to add a way to disable the stripping of the slash suffix from a URL.
+</ParamField>
+
+<ParamField path="proxy.enable_load_balancing">
+Set this value to `true` to have a Tyk node distribute traffic across a list of servers. **Required: ** You must fill in the `target_list` section.
+</ParamField>
+
+<ParamField path="proxy.target_list">
+A list of upstream targets for load balancing (can be one or many hosts).
+</ParamField>
+
+<ParamField path="proxy.check_host_against_uptime_tests">
+If uptime tests are enabled, Tyk will check the hostname of the outbound request against the downtime list generated by the host checker. If the host is found, then it is skipped.
+</ParamField>
+
+<ParamField path="proxy.service_discovery">
+The service discovery section tells Tyk where to find information about the host to proxy to. In a clustered environment this is useful if servers are coming online and offline dynamically with new IP addresses. The service discovery module can pull out the required host data from any service discovery tool that exposes a RESTful endpoint that outputs a JSON object.
+
+```json
+{
+  "enable_load_balancing": true,
+  "service_discovery": {
+    "use_discovery_service": true,
+    "query_endpoint": "http://127.0.0.1:4001/v2/keys/services/multiobj",
+    "use_nested_query": true,
+    "parent_data_path": "node.value",
+    "data_path": "array.hostname",
+    "port_data_path": "array.port",
+    "use_target_list": true,
+    "cache_timeout": 10
+  },
+}
+```
+</ParamField>
+
+<ParamField path="proxy.service_discovery.use_discovery_service">
+Set this to `true` to enable the discovery module.
+</ParamField>
+
+<ParamField path="proxy.service_discovery.query_endpoint">
+The endpoint to call.
+</ParamField>
+
+<ParamField path="proxy.service_discovery.data_path">
+The namespace of the data path. For example, if your service responds with:
+
+```json
+{
+  "action": "get",
+  "node": {
+    "key": "/services/single",
+    "value": "http://httpbin.org:6000",
+    "modifiedIndex": 6,
+    "createdIndex": 6
+  }
+}
+```
+
+Then your name space would be `node.value`.
+</ParamField>
+
+<ParamField path="proxy.service_discovery.use_nested_query">
+Sometimes the data you are retrieving is nested in another JSON object. For example, this is how Etcd responds with a JSON object as a value key:
+
+```json
+{
+  "action": "get",
+  "node": {
+    "key": "/services/single",
+    "value": "{\"hostname\": \"http://httpbin.org\", \"port\": \"80\"}",
+    "modifiedIndex": 6,
+    "createdIndex": 6
+  }
+}
+```
+
+In this case, the data actually lives within this string-encoded JSON object. So in this case, you set the `use_nested_query` to `true`, and use a combination of the `data_path` and `parent_data_path` (below)
+</ParamField>
+
+<ParamField path="proxy.service_discovery.parent_data_path">
+This is the namespace of where to find the nested value. In the above example, it would be `node.value`. You would then change the `data_path` setting to be `hostname`. Tyk will decode the JSON string and then apply the `data_path` namespace to that object in order to find the value.
+</ParamField>
+
+<ParamField path="proxy.service_discovery.port_data_path">
+In the above nested example, we can see that there is a separate PORT value for the service in the nested JSON. In this case you can set the `port_data_path` value and Tyk will treat `data_path` as the hostname and zip them together (this assumes that the hostname element does not end in a slash or resource identifier such as `/widgets/`). In the example, the `port_data_path` would be `port`.
+</ParamField>
+
+<ParamField path="proxy.service_discovery.target_path">
+The target path to append to the host:port combination provided by the service discovery engine.
+</ParamField>
+
+<ParamField path="proxy.service_discovery.use_target_list">
+If you are using load_balancing, set this value to `true` and Tyk will treat the data path as a list and inject it into the target list of your API definition.
+</ParamField>
+
+<ParamField path="proxy.service_discovery.cache_timeout">
+Tyk caches target data from a discovery service. In order to make this dynamic you can set a cache value when the data expires and new data is loaded.
+</ParamField>
+
+<ParamField path="proxy.transport">
+The transport section allows you to specify a custom proxy and set the minimum TLS versions and any SSL ciphers.
+
+This is an example of `proxy.transport` definition followed by explanations for every field.
+```json
+{
+  "transport": {
+    "proxy_url": "http(s)://proxy.url:1234",
+    "ssl_min_version": 771,
+    "ssl_ciphers": [
+      "TLS_RSA_WITH_AES_128_GCM_SHA256", 
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
+    ],
+    "ssl_insecure_skip_verify": true,
+    "ssl_force_common_name_check": false
+  }
+}
+```
+</ParamField>
+
+<ParamField path="proxy.transport.proxy_url">
+Use this setting to specify your custom forward proxy and port.
+</ParamField>
+
+<ParamField path="proxy.transport.ssl_min_version">
+Use this setting to specify your minimum TLS version; note that this is limited by the version of Tyk due to underlying Golang support for legacy TLS versions.
+</ParamField>
+
+<ParamField path="proxy.transport.ssl_ciphers">
+You can add `ssl_ciphers` which takes an array of strings as its value. Each string must be one of the allowed cipher suites as defined at https://golang.org/pkg/crypto/tls/#pkg-constants. This is not applicable from TLS 1.3.
+</ParamField>
+
+<ParamField path="proxy.transport.ssl_insecure_skip_verify">
+Boolean flag to control at the API definition whether it is possible to use self-signed certs for some APIs, and actual certs for others. This also works for `TykMakeHttpRequest` & `TykMakeBatchRequest` in virtual endpoints.
+</ParamField>
+
+<ParamField path="proxy.transport.ssl_force_common_name_check">
+Use this setting to force the validation of a hostname against the certificate Common Name.
+</ParamField>
+
+### Upstream Authentication
+
+<ParamField path="strip_auth_data">
+When set to `true`, auth related headers will be stripped from requests proxied through the gateway.
+</ParamField>
+
+<ParamField path="request_signing">
+Configuration for Upstream Request Signing using HMAC or RSA algorithms.
+</ParamField>
+
+<ParamField path="request_signing.secret">
+The secret used for signing (not shared with the upstream).
+</ParamField>
+
+<ParamField path="request_signing.key_id">
+An identifier allocated by the upstream used to identify Tyk as the requesting client.
+</ParamField>
+
+<ParamField path="request_signing.algorithm">
+The signing algorithm to be used - one from `hmac-sha1`, `hmac-sha256`, `hmac-sha384`, `hmac-sha512`, `hmac-rsa256`
+</ParamField>
+
+<ParamField path="request_signing.header_list">
+A list of headers to be included in the signature calculation.
+</ParamField>
+
+<ParamField path="request_signing.certificate_id">
+The certificate ID used in the RSA signing operation.
+</ParamField>
+
+<ParamField path="request_signing.signature_header">
+The HTTP header to be used to pass the signature to the upstream.
+</ParamField>
+
+### Uptime Tests
+
+<ParamField path="uptime_tests">
+This section defines the uptime tests to run for this API.
+</ParamField>
+
+<ParamField path="uptime_tests.check_list">
+A list of tests to run, which can be either short form:
+
+```json
+{
+  "uptime_tests": {
+    "check_list": [
+      {
+        "url": "http://google.com/"
+      }
+    ]
+  }
+}
+```
+
+or long form:
+
+```json
+{
+  "uptime_tests": {
+    "check_list": [
+      {
+        "url": "http://posttestserver.com/post.php?dir=uptime-checker",
+        "method": "POST",
+        "headers": {
+            "this": "that",
+            "more": "beans"
+        },
+        "body": "VEhJUyBJUyBBIEJPRFkgT0JKRUNUIFRFWFQNCg0KTW9yZSBzdHVmZiBoZXJl",
+        "timeout": 1000
+      }
+    ]
+  }
+}
+```
+</ParamField>
+
+<ParamField path="uptime_tests.check_list.url">
+The URL to be used for the uptime test.
+</ParamField>
+
+<ParamField path="uptime_tests.check_list.method">
+The HTML method to be used for the request to the `check_list.url` (required for long form tests).
+</ParamField>
+
+<ParamField path="uptime_tests.check_list.headers">
+A list of headers to be applied to the request to the `check_list.url` as key:value pairs (only for long form tests).
+</ParamField>
+
+<ParamField path="uptime_tests.check_list.body">
+The body of the request to be sent to the `check_list.url`, this is Base64 encoded (only for long form tests).
+</ParamField>
+
+<ParamField path="uptime_tests.check_list.timeout">
+The timeout in milliseconds for the uptime check (only for long form tests).
+</ParamField>
+
diff --git a/api-management/gateway-config-tyk-oas.mdx b/api-management/gateway-config-tyk-oas.mdx
new file mode 100644
index 0000000000..6ced00cb3a
--- /dev/null
+++ b/api-management/gateway-config-tyk-oas.mdx
@@ -0,0 +1,82 @@
+---
+title: "Tyk OAS"
+description: "Learn how to configure Tyk OAS API Definitions to manage your APIs using the OpenAPI Specification"
+keywords: "Gateway, Configuration, Tyk OAS, Tyk OAS API Definition, Tyk OAS API Definition Object"
+sidebarTitle: "Tyk OAS Reference"
+---
+
+import XTykGateway from '/snippets/x-tyk-gateway.mdx';
+
+## Introduction to Tyk OAS
+
+The upstream service receives requests from Tyk to the *upstream API* after processing based on the configuration applied in the Tyk API definition. Crucially the upstream service remains unaware of Tyk Gateway's processing, responding to incoming requests as it would for direct client-to-service communication. The *API proxy* deployed on Tyk is typically designed to have the same API endpoints, resources and methods that are defined for the upstream service's API. The *upstream API* will often be described according to the industry standard OpenAPI Specification - and this is where Tyk OAS comes in.
+
+### What is the OpenAPI Specification?
+
+The *OpenAPI Specification* (OAS) is a standardized framework for describing RESTful APIs in a machine-readable format (typically JSON or YAML). It defines how APIs should be documented, including details about endpoints, request/response formats, authentication, and error codes. In short, OAS is a blueprint for your API—detailing how the API behaves and how users or services can interact with it. The *OpenAPI Description* (OAD) is the actual content that adheres to this specification, essentially an object that describes the specific functionality of an API. The *OpenAPI Document* refers to a file that contains an OpenAPI description, following the OAS format.
+
+OpenAPI has become the de facto standard for API documentation because of its consistency, ease of use, and broad tooling support. It allows both developers and machines to interact with APIs more effectively, offering benefits like auto-generated client SDKs, server stubs, and up-to-date documentation. Tools such as Tyk also support validation, testing, and mock servers, which speeds up development and ensures consistency across API implementations.
+
+Tyk fully supports [OpenAPI Specification v3.0.x](https://spec.openapis.org/oas/v3.0.3).
+
+#### OpenAPI Specification 3.1
+
+From **Tyk 5.12.0**, there is basic support for [OAS v3.1.x](https://spec.openapis.org/oas/v3.1.2.html) covering:
+
+- Import and validation of OpenAPI 3.1 descriptions using Tyk Dashboard to create Tyk OAS APIs
+- OAS 3.1 [features](https://www.openapis.org/blog/2021/02/16/migrating-from-openapi-3-0-to-3-1-0)
+    - Full JSON Schema Support and `$schema` keyword
+    - The single `example` keyword is deprecated in OAS 3.1
+    - `type` can be an array
+    - exclusiveMinimum and exclusiveMaximum keywords
+
+We do not yet support:
+
+- Conversion from OAS 3.0 to OAS 3.1
+- Reusable Path Item Objects
+- New mutualTLS security scheme
+- Tyk Dashboard's API Editor does not yet validate the schema, so validation is performed only when saving the API
+
+### What is a Tyk OAS API definition?
+
+Not every feature of an advanced API management platform such as Tyk is covered by the OpenAPI Specification. The *API definition* must provide Tyk with everything it needs to receive and process requests on behalf of the upstream service - so the OpenAPI description of the upstream API is not enough on its own to configure the Gateway. This is where the *Tyk Vendor Extension* comes in, allowing you to configure all the powerful features of Tyk Gateway that are not covered by OAS.
+
+The [Tyk Vendor Extension](#tyk-vendor-extension) follows the same architectural style as the OpenAPI Specification and is encapsulated in a single object that is appended to the OpenAPI description, creating a *Tyk OAS API definition*.
+
+#### OpenAPI description
+
+There are many great explanations of the features and capabilities of the OpenAPI Specification so we won't repeat it all here. A good place to start learning is from the maintainers of the specification: the [OpenAPI Initiative](https://learn.openapis.org/).
+
+Tyk treats the OpenAPI description as the source of truth for the data stored within it. This means that Tyk does not duplicate those data in the Tyk Vendor Extension but rather builds upon the basic configuration defined in the OAD.
+
+#### Tyk Vendor Extension
+
+The Tyk Vendor Extension is a JSON object (`x-tyk-api-gateway`) within the Tyk OAS API definition that encapsulates all of the Gateway configuration that is not contained within the OpenAPI description.
+
+It is structured in four sections:
+
+- `info` containing metadata used by Tyk to manage the API proxy, including name, identifiers, status, and version
+- `server` contains configuration for the client-gateway integration, including listen path and authentication method. Supported scheme types under `server.authentication.securitySchemes` include `oauth2` — for external IdP token validation, scope enforcement, and token exchange. See [OAuth 2.0 (External IdP)](/api-management/authentication/oauth2-authentication).
+- `middleware` contains configuration for the gateway's middleware chain, split into API-level and endpoint-level settings
+- `upstream` contains configuration for the gateway-upstream integration, including targets, load balancing and rate limits
+
+The extension has been designed, as has OAS, to have minimal content so if a feature is not required for your API (for example, payload transformation) then this can be omitted from the API definition. Most features have an `enabled` flag which must be set for Tyk to apply that configuration. This can be used to include settings in the API definition and enable them only when required (useful during API development, testing and debug).
+
+In the OpenAPI Specification *paths* define the API endpoints, while *operations* specify the HTTP methods (GET, POST, PUT, DELETE) and actions for each endpoint. They describe how the API handles requests, including parameters, request bodies, responses, and status codes, providing a clear structure for API interactions. Tyk interprets this information directly from the OpenAPI description and uses the `operationID` field to link the endpoint level middleware configuration within the Tyk Vendor Extension to the appropriate endpoint.
+
+### Modifying the OpenAPI description
+
+Tyk will only make additions or modifications to the OAD when the user makes certain changes in the Tyk API Designer and as follows:
+
+- The URL(s) on Tyk Gateway(s) to which client requests should be sent will be added to the beginning of the `servers` list
+- The OpenAPI Specification declares `paths` which describe the available endpoints (paths) and the operations that can be performed on them (such as `GET`, `POST`, `PUT`, `DELETE`). Tyk will modify this list if changes are made using the Tyk API Designer, for example if an endpoint is added.
+
+Where Tyk might modify the OpenAPI description, this is noted in the appropriate section of the documentation.
+
+If changes are made via the Tyk API Designer that impact the OpenAPI description, we recommend that you export the OAD from Tyk to store in your source of truth repository. This ensures that your records outside Tyk accurately reflect the API that is consumed by your clients (for example, if you publish documentation from the OpenAPI Specification of your API).
+
+Equally, if you make changes to your OpenAPI description outside Tyk, we provide a simple method to update (or patch) your Tyk API definition with the updated OAD. Alternatively you might prefer to create a new version of your API for the updated OpenAPI description, depending on the current stage of the API in its lifecycle.
+
+
+<XTykGateway/>
+
diff --git a/api-management/gateway-events.mdx b/api-management/gateway-events.mdx
new file mode 100644
index 0000000000..45de700d1e
--- /dev/null
+++ b/api-management/gateway-events.mdx
@@ -0,0 +1,925 @@
+---
+title: "Gateway Events"
+description: "Introduction to Gateway Events"
+keywords: "Gateway, Events, Async APIs, Asynchronus APIs, Event Types, Event Webhooks, Event Metadata"
+sidebarTitle: "Gateway Events"
+---
+
+Tyk Gateway will generate asynchronous events when certain conditions are met, for example a rate limit being exceeded, an expired key attempting to access an API, or a circuit breaker triggering due to a slow or unresponsive upstream.
+
+Tyk has a flexible model for handling these API events.
+
+## Event categories
+
+There are four different categories of events that can be fired by Tyk:
+- [API events](#api-events)
+- [Token lifecycle events](#token-lifecycle-events)
+- [Advanced quota usage events](#advanced-quota-usage-events)
+- [Custom events](#custom-events)
+
+### API events
+
+Tyk can generate (or *fire*) a variety of built-in API events due to activity triggered by an API request, such as exceeded rate limits, depleted quotas or attempts to access using expired keys. The full list of standard API events is available [here](/api-management/gateway-events#api-events).
+
+### Token lifecycle events
+
+Alongside the events that are fired in response to API requests, Tyk will also mark the creation, update or deletion of access tokens (keys) with dedicated events as indicated [here](/api-management/gateway-events#token-lifecycle-events).
+
+### Advanced quota usage events
+
+Tyk will generate [standard quota events](/api-management/gateway-events#standard-quota-events) when a client quota has been consumed, but what if you want to have more granular notification of quota usage as your clients are approaching their quota limit?
+
+For this, Tyk provides [advanced quota monitoring](/api-management/gateway-events#monitoring-quota-consumption) that can be configured to trigger a dedicated event handler when the API usage exceeds different thresholds approaching the quota limit.
+
+### Custom events
+
+The event subsystem has been designed to be easily extensible, so the community can define additional events within the Tyk codebase which can then be handled using the exsiting event handling system.
+
+## Handling events with Tyk
+
+Tyk has a simple event handling system where *event handlers* are assigned (or registered) to the different [events](/api-management/gateway-events#event-types) that Tyk can generate. These handlers are assigned per-API so when an event is generated for an API and there is an *event handler* registered for that *event*, the handler will be triggered.
+
+Three different categories of *event handler* can be registered for each event:
+- a [webhook](/api-management/gateway-events#event-handling-with-webhooks) that will call out to an external endpoint
+- an [event log](/api-management/gateway-events#logging-api-events-1) that will write to the configured [log output](/api-management/logs/application-logs)
+- your own [custom event handler](/api-management/gateway-events#custom-api-event-handlers) that will run in a JavaScript virtual machine on the Tyk server
+
+
+
+    <Note>
+    Remember that <b>quota usage monitoring</b> has a [dedicated mechanism](/api-management/gateway-events#monitoring-quota-consumption) for handling these special events.
+    </Note>
+
+
+## Event Types
+
+The built-in events that Tyk Gateway will generate are:
+
+### Rate limit events
+
+- `RatelimitExceeded`: the rate limit has been exceeded for a specific key
+- `OrgRateLimitExceeded`: the rate limit has been exceeded for a specific organization
+- `RateLimitSmoothingUp`: the [intermediate rate limit allowance](/api-management/rate-limit#rate-limit-smoothing) has been increased for a specific key
+- `RateLimitSmoothingDown`: the [intermediate rate limit allowance](/api-management/rate-limit#rate-limit-smoothing) has been decreased for a specific key
+
+### Standard quota events
+
+- `QuotaExceeded`: the quota for a specific key has been exceeded
+- `OrgQuotaExceeded`: the quota for a specific organization has been exceeded
+
+### Authentication failure events
+
+- `AuthFailure`: a key has failed authentication or has attempted access and was denied
+- `KeyExpired`: an attempt has been made to access an API using an expired key
+- `UpstreamOAuthError`: an error occurred when trying to authenticate with an upstream using an OAuth provider
+
+### API version events
+
+- `VersionFailure`: a key has attempted access to a version of an API that it does not have permission to access
+
+### Circuit breaker events
+
+- `BreakerTripped`: a circuit breaker on a path has tripped and been taken offline
+- `BreakerReset`: a circuit breaker has reset and the path is available again
+- `BreakerTriggered`: a circuit breaker has changed state, this is generated when either a `BreakerTripped`, or a `BreakerReset` event occurs; a status code in the metadata passed to the webhook will indicate which of these events was triggered
+
+### Uptime events
+
+- `HostDown`: the uptime checker has found that a host is down/not available
+- `HostUp`: the uptime checker has found that a host is available again after being offline
+
+### Token lifecycle events
+
+- `TokenCreated`: a token has been created
+- `TokenUpdated`: a token has been changed/updated
+- `TokenDeleted`: a token has been deleted
+
+### Certificate expiry events
+
+- `CertificateExpiringSoon`: a certificate has been used within the expiry threshold and should be updated
+- `CertificateExpired`: an expired certificate has been used in a request
+
+## Event Metadata
+
+When an event is fired, and an *event handler* is registered for that specific API and event combination, Tyk Gateway provides the handler with a rich set of [metadata](/api-management/gateway-events#event-metadata). The external system (webhook) or custom (JavaScript) code can then use this metadata to decide what action to take.
+
+Most events provide common metadata as follows:
+
+- `message` (string): a human-readable message from Tyk Gateway that provides details about the event
+- `path` (string): the path of the API endpoint request that led to the event being fired
+- `origin` (string): origin data for the source of the request (if this exists)
+- `key` (string): the key that was used in the request
+- `originating_request` (string): a Base64-encoded [raw inbound request](#raw-request-data)
+
+### Specific Event Metadata
+
+Some events provide alternative metadata specific to that event. The following sections detail the event-specific metadata provided for such events.
+
+<ul>
+
+<li>
+<Expandable title='CertificateExpiringSoon'>
+- `message` (string): a human readable message from Tyk Gateway that adds detail about the event
+- `cert_id` (string): the certificate ID
+- `cert_name` (string): the name of the certificate
+- `expires_at` (string, RFC3339): the certificate expiry date
+- `days_remaining` (integer): the remaining days until the certificate expires
+- `api_id`(string): the ID of the API that triggered the event
+</Expandable>
+</li>
+
+<li>
+<Expandable title='CertificateExpired'>
+- `message` (string): a human readable message from Tyk Gateway that adds detail about the event
+- `cert_id` (string): the certificate ID
+- `cert_name` (string): the name of the certificate
+- `expired_at` (string, RFC3339): the date when the certificate expired
+- `days_since_expiry` (integer): the number of days since the certificate expired
+- `api_id`(string): the ID of the API that triggered the event
+</Expandable>
+</li>
+
+</ul>
+
+### Using the metadata
+
+The metadata are exposed so that they can be used by the event handler (webhook or custom) using Go templating. For details of how each type of event handler can access these data, please see the appropriate section for [webhook](/api-management/gateway-events#webhook-payload) or [custom](/api-management/gateway-events#the-event-object) event handlers.
+
+### Raw Request Data
+
+The `OriginatingRequest` metadata is a Base64-encoded wire-protocol representation of the original request to the event handler. If you are running a service bus or queue that stores failed, throttled or other types of requests, you can decode this object and parse it in order to re-create the original intent of the request (e.g. for post-processing).
+
+### Logging API Events
+
+Tyk’s built-in logging event handler is designed primarily for debugging purposes and will store details of an API event to the configured logger output.
+
+The Tyk platform can be configured to log at various verbosity levels (info, debug, warn, error) and can be integrated with third-party log aggregation tools like Sentry, Logstash, Graylog, and Syslog. For full details on configuring the Tyk logger, see [this section](/api-management/logs/application-logs).
+
+<br />
+
+<Note>
+Logging event handlers are currently only supported by Tyk Classic APIs.
+</Note>
+
+
+### Configuring the event handler
+
+Registering a logging event handler to your Tyk Classic API is the same as adding any other event handler, within the `event_handlers` section of the API definition.
+
+The `handler_name` for the logging event handler should be set to: `eh_log_handler`.
+
+The `handler_meta` for the logging event handler contains a single field:
+- `prefix` is a label that will be prepended to each log entry
+
+For example, to register event handlers to log the `AuthFailure` and `KeyExpired` events you might add the following to your API definition:
+
+```json
+{
+  "event_handlers": {
+    "events": {
+      "AuthFailure": [
+        {
+          "handler_name": "eh_log_handler",
+          "handler_meta": {
+            "prefix": "AuthFailureEvent"
+          }
+        }
+      ],
+      "KeyExpired": [
+        {
+          "handler_name": "eh_log_handler",
+          "handler_meta": {
+            "prefix": "KeyExpiredEvent"
+          }
+        }
+      ]
+    }
+  }
+}
+```
+
+In this example
+- the `AuthFailure` event will trigger the event handler to generate a log with the prefix `AuthFailureEvent`
+- the `KeyExpired` event will trigger the event handler to generate a log with the prefix `KeyExpiredEvent`
+
+When the event handler is triggered an entry will be made in the log containing the corresponding prefix, which can be useful for monitoring and debugging purposes.
+
+## Event handling with webhooks
+
+### Overview
+
+A webhook is a mechanism for real-time, event-driven communication between different systems or applications over the internet. It is an HTTP callback, typically an HTTP POST request that occurs when something happens. Webhooks are real-time, automated and lightweight. Notifications are sent immediately when events occur without the need for the receiving service to poll.
+
+In the context of Tyk Gateway, webhooks are event handlers that can be registered against API Events. The webhook will be triggered when the corresponding event is fired and will send a customizable fixed payload to any open endpoint.
+
+#### When to use webhook event handlers
+
+There are many occasions when you might use webhooks for event handling, here are just a few examples.
+
+##### Rate limit violations
+
+When an API consumer exceeds their allocated rate limit, the `RatelimitExceeded` event will be fired. A webhook event handler can be employed to notify an upstream system to take actions such as updating a dashboard, notifying the account manager, or adjusting the client's service tier.
+
+##### API key lifecycle events
+
+When an expired API key is used to access an API, the client will receive an error and the `KeyExpired` event will be fired. A webhook event handler can be employed to notify an upstream system to take actions such as renewing the key, logging the failure in a CRM or notifying the account manager to initiate customer communication.
+
+##### Upstream service problems
+
+When an API circuit breaker triggers due to an unresponsive upstream service, the `BreakerTripped` event will be fired. A webhook event handler can be employed to update monitoring dashboards or to trigger automated recovery scripts or processes.
+
+#### How webhook event handlers work
+
+With Tyk Gateway, the webhook event handler is a process that runs asynchronously in response to an API event being fired. It will issue an HTTP request to any open endpoint and is fully configurable within the API definition.
+
+The HTTP method, body, header values, and target URL can all be configured in the API definition. The [request body](#webhook-payload) is generated using a Tyk template file that has access to the [event metadata](/api-management/gateway-events#event-metadata).
+
+The webhook event handler runs in its own process and so does not block the operation of the Gateway.
+
+##### Webhook cooldown
+
+It is very likely that an `AuthFailure` event will fire on the same endpoint more than once if the requesting client is automated. If this event triggered a webhook that caused an email to be sent, then if this event occurred 10 times a second, the email recipient would be flooded with emails. In an attempt to mitigate against events such as this, you can set a cooldown timer, in the webhook handler. This prevents the webhook from being triggered again if the event is fired again within the time period specified.
+
+##### Webhook payload
+
+When your webhook event handler is triggered, it will send an HTTP request to the configured target. For HTTP methods that support a request body, for example `POST`, the event handler will process a [Go template](/api-management/traffic-transformation/go-templates) to produce the payload.
+
+If no template is provided in the webhook event handler configuration in the API definition, Tyk Gateway will look for the default file `templates/default_webhook.json`. Any text file accessible to the Gateway can be used to store the Go template to be used by the event handler when constructing the payload.
+
+The event handler has access to the [event metadata](/api-management/gateway-events#event-metadata) and this can be accessed by the template using the `{{.Meta.XXX}}` namespace.
+
+The [event type](/api-management/gateway-events#event-types) that triggered the event handler can be accessed as `{{.Type}}`.
+
+For most event types, the default webhook template has this form:
+
+```json
+{
+  "event": "{{.Type}}",
+  "message": "{{.Meta.Message}}",
+  "path": "{{.Meta.Path}}",
+  "origin": "{{.Meta.Origin}}",
+  "key": "{{.Meta.Key}}"
+}
+```
+
+This would generate a request body (payload) such as:
+```json
+{
+  "event": "RatelimitExceeded",
+  "message": "API Rate Limit Exceeded",
+  "path": "/example-global-webhook/",
+  "origin": "99.242.139.220",
+  "key": "apilimiter-66336c67cb7191f791f167134b20d1f4c14b4bb5672b57f4b2813c86"
+}
+```
+
+#### Using webhooks with Tyk Dashboard
+
+Webhook event handlers are configured within the API definition, which is used by Tyk Gateway to determine the appropriate action to be performed in response to a Gateway event.
+
+When using Tyk Dashboard, you are able to create *global webhooks* that can be re-used across multiple events and APIs, allowing you to modify the webhook configuration for a batch of APIs and/or events from one location.
+
+##### Local and global webhooks
+
+Tyk Dashboard supports the declaration of webhooks *globally* and *locally*:
+- **Global webhooks** are declared outside the API definition and linked via a *webhook id*; changes to the global webhook definition will be reflected in all APIs that reference that *webhook id*
+- **Local webhooks** are fully defined within the API definition; changes to the local webhook configuration will affect only the API within which it is defined
+
+*Global webhook definitions* are registered with the Dashboard using the [UI](#creating-a-global-webhook-definition-using-tyk-dashboard) or [Dashboard API](https://tyk.io/docs/api-reference/webhooks/list-webhooks) and assigned a unique *webhook id* that can be obtained via the [Dashboard API](https://tyk.io/docs/api-reference/webhooks/list-webhooks) or via drop-down selection within the UI.
+
+If you assign a global webhook definition to an API to handle an event, then Tyk Dashboard will retrieve the definition and update it in the API definition when the API is loaded (or re-loaded) to the Gateway.
+
+##### Creating a global webhook definition using Tyk Dashboard
+
+To create a global webhook definition from the Dashboard UI you should follow these steps:
+
+**Steps for Configuration**
+
+1. **Create the webhook definition**
+
+    Select **Webhooks** from the **API Management** Menu:
+
+    <img src="/img/2.10/webhooks_menu.png" alt="Webhooks menu item" />
+
+    Click **Add Webhook**.
+
+    <img src="/img/2.10/add_webhook.png" alt="Add webhook button" />
+
+2. **Configure the webhook**
+
+    Now you need to tell Tyk how and where to send the request. You can include custom headers, for example to inform the target service that the request has come from Tyk - remember to click **ADD** to add the custom header to the configuration.
+
+    <img src="/img/2.10/webhook_details.png" alt="Add webhook detail" />
+
+    Click **Save** to save it.
+
+<hr />
+
+If you're using Tyk OAS APIs, then you can find details and examples of how to configure webhook event handlers [here](/api-management/gateway-events#webhook-event-handlers-with-tyk-oas-apis).
+
+If you're using Tyk Classic APIs, then you can find details and examples of how to configure webhook event handlers [here](/api-management/gateway-events#webhook-event-handlers-with-tyk-classic-apis).
+
+### Webhook event handlers with Tyk OAS APIs
+
+[Webhooks](/api-management/gateway-events#event-handling-with-webhooks) are event handlers that can be registered against API Events. The webhook will be triggered when the corresponding event is fired and will send a customizable fixed payload to any open endpoint.
+
+Webhooks are configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](/api-management/gateway-events#webhook-event-handlers-with-tyk-classic-apis) page.
+
+#### Set up a webhook event handler in the Tyk OAS API Definition
+
+Event handling is configured by adding the `eventHandlers` object to the `server` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition.
+
+The `eventHandlers` object is an array containing configurations for all event handlers registered with the API.
+
+##### Local webhook configuration
+
+When using a local webhook, the event handler element in the `eventHandlers` object has the following configuration which fully declares the webhook behaviour:
+- `enabled`: enable the event handler
+- `trigger`: the API event that will trigger the webhook
+- `type`: the type of event handler, in this case should be set to `webhook`
+- `cooldownPeriod`: the [webhook cooldown](/api-management/gateway-events#webhook-cooldown) for duplicate events (in duration format, e.g. 10s, 1m30s); use this to prevent flooding of the target endpoint when multiple events are fired in quick succession
+- `name`: a human readable name for the webhook, which will be displayed in Tyk Dashboard
+- `url`: this is an **absolute URL** to which the request will be sent
+- `method`: this can be any of `GET`, `PUT`, `POST`, `PATCH` or `DELETE` and will be the HTTP method used to send the request; methods that do not support an encoded request body will not have the event metadata provided with the request; we advise using `POST` where possible
+- `bodyTemplate`: this is the path to the [webhook template](/api-management/gateway-events#webhook-payload) that will be used to construct the request body
+- `headers`: a map of custom headers to be provided with the request
+
+For example:
+```json {hl_lines=["18-33"],linenos=true, linenostart=1}
+{
+    "info": {
+        "title": "example-local-webhook",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {},
+    "components": {},
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-local-webhook",
+            "state": {
+                "active": true
+            }
+        },
+        "server": {
+            "eventHandlers": [
+                {
+                    "enabled": true,
+                    "trigger": "RatelimitExceeded",
+                    "cooldownPeriod": "1s",
+                    "type": "webhook",
+                    "name": "My local webhook",
+                    "url": "https://webhook.site/<unique-target>",
+                    "method": "POST",
+                    "headers": [
+                        {
+                        "name": "X-Tyk",
+                            "value": "example-local-webhook"
+                        }
+                    ],
+                    "bodyTemplate": "templates/default_webhook.json"
+                }
+            ],
+            "listenPath": {
+                "strip": true,
+                "value": "/example-local-webhook/"
+            }
+        },
+        "upstream": {
+            "rateLimit": {
+                "enabled": true,
+                "per": "10s",
+                "rate": 2
+            },
+            "url": "http://httpbin.org/"
+        }
+    }
+}
+```
+
+In this example a local webhook has been registered to trigger when the `RatelimitExceeded` event is fired. The request rate limit has been set at 2 requests per 10 seconds, so simply make three requests in quick succession to trigger the webhook.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the local webhook feature.
+
+Note that to test this you will need to provide a valid target URL for your webhook to send the request; we've used `http://webhook.site`.
+
+
+##### Global webhook configuration
+
+When using a *global webhook*, the event handler element in the `eventHandlers` object has the following configuration, which references the externally declared webhook using its `id`:
+- `enabled`: enable the event handler
+- `trigger`: the API event that will trigger the webhook
+- `type`: the type of event handler, in this case should be set to `webhook`
+- `cooldownPeriod`: the [webhook cooldown](/api-management/gateway-events#webhook-cooldown) for duplicate events (in duration format, e.g. 10s, 1m30s); use this to prevent flooding of the target endpoint when multiple events are fired in quick succession
+- `id`: the *webhook id* assigned by Tyk to the global webhook when it was created (this can be determined using the [list webhooks](https://tyk.io/docs/api-reference/webhooks/list-webhooks) endpoint in the Tyk Dashboard API)
+
+For example:
+
+```json {hl_lines=["18-24"],linenos=true, linenostart=1}
+{
+    "info": {
+        "title": "example-global-webhook",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {},
+    "components": {},
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-global-webhook",
+            "state": {
+                "active": true
+            }
+        },
+        "server": {
+            "eventHandlers": [
+                {
+                    "enabled": true,
+                    "trigger": "RatelimitExceeded",
+                    "cooldownPeriod": "1s",
+                    "type": "webhook",
+                    "id": "<your-global-webhook-id>"
+                }
+            ],
+            "listenPath": {
+                "strip": true,
+                "value": "/example-global-webhook/"
+            }
+        },
+        "upstream": {
+            "rateLimit": {
+                "enabled": true,
+                "per": "10s",
+                "rate": 2
+            },
+            "url": "http://httpbin.org/"
+        }
+    }
+}
+```
+
+In this example a local webhook has been registered to trigger when the `RatelimitExceeded` event is fired. The request rate limit has been set at 2 requests per 10 seconds, so simply make three requests in quick succession to trigger the webhook.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the global webhook feature.
+
+Note, however, that to test this you will need to create a *global webhook* in your Tyk Dashboard and replace the value in `id` with the *webhook id* that Tyk Dashboard has allocated to your webhook. You can find this by querying the [list webhooks](https://tyk.io/docs/api-reference/webhooks/list-webhooks) endpoint in the Tyk Dashboard API.
+<br />
+<br />
+
+<Note>
+When a *global webhook* is registered to a Tyk OAS API, Tyk will create a read-only copy of the webhook [configuration](#local-webhook-configuration) (`url`, `method`, `bodyTemplate`, `headers`) within the API definition. This is so that Tyk Gateway knows how to handle the event, as it does not have access to the store of *global webhooks* registered with Tyk Dashboard.
+<br />
+<br />
+If the global webhook is subsequently deleted from the Tyk Dashboard, the webhook will automatically be converted to a local webhook in any API definition that was using it.
+</Note>
+
+
+
+#### Set up a webhook event handler in the Tyk Dashboard
+
+It is very simple to register webhooks to be triggered in response to specific API events when using Tyk OAS APIs with the Tyk Dashboard. The API Designer in the Dashboard allows you to define *local webhooks* and to register *global webhooks* to handle events.
+
+If you want to use a *global webhook* then you'll need to declare it first, following [these instructions](/api-management/gateway-events#creating-a-global-webhook-definition-using-tyk-dashboard).
+
+1. **Add event handler**
+
+    From the **Settings** tab in the API Designer, scroll down to the **Server** section to find the **Event Handlers** pane. Select **Add Event**.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-webhook-server.png" alt="Add an event handler from the Server section" />
+
+2. **Choose the event to be handled**
+
+    This will add an event handler to the API. You'll need to select which event you want to handle from the drop-down list. Note that currently Tyk OAS only supports webhook event handlers, so this will default to *webhook* type.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-webhook-event-trigger.png" alt="Choose the event that will trigger the webhook" />
+
+3. **Choose and configure global webhook**
+
+    If you want to use a webhook that you've already registered with Tyk Dashboard, ensure that the **Webhook source** is set to **Global webhook** then select from the drop-down list.
+
+    The only other thing you'll need to configure is the cooldown period.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-webhook-global.png" alt="Select from the list of available global webhooks" />
+
+    Note that Tyk automatically retrieves the details of the *global webhook* and displays them (read-only) in the API designer.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-webhook-global-complete.png" alt="A fully configured global webhook" />
+
+    Don't forget to select **Save API** to apply the changes.
+
+4. **Configure local webhook**
+
+    If you don't want to use a shared *global webhook* but instead want to configure a *local webhook* only available to this API/event then you should ensure that the **Webhook source** is set to **Local webhook**.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-webhook-local.png" alt="Ready to configure a local webhook" />
+
+    Now you can complete the various fields to set up your *local webhook*. If you want to add custom headers to send with the HTTP request, select **New Header** then enter the header key and value.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-webhook-local-complete.png" alt="A fully configured global webhook" />
+
+    Don't forget to select **Save API** to apply the changes.
+
+### Webhook event handlers with Tyk Classic APIs
+
+[Webhooks](/api-management/gateway-events#event-handling-with-webhooks) are event handlers that can
+be registered against API Events. The webhook will be triggered when the corresponding event is fired and will send a
+customisable fixed payload to any open endpoint.
+
+Webhooks are configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API
+Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk
+OAS](/api-management/gateway-events#webhook-event-handlers-with-tyk-oas-apis)
+page.
+
+#### Set up a webhook event handler in the Tyk Classic API Definition
+
+To add a webhook event handler you must add a new event handler object within the `event_handlers.events` section of the
+API definition for the appropriate [API event](/api-management/gateway-events#event-types).
+
+The event handler object has the following configuration:
+
+- `handler_name`: this identifies the type of event handler and must be set to `eh_web_hook_handler`
+- `handler_meta`: this structure configures the HTTP request that will be sent when the webhook is triggered
+
+The `handler_meta` object has the following configuration:
+
+- `method`: this can be any of `GET`, `PUT`, `POST`, `PATCH` or `DELETE` and will be the HTTP method used to send the
+  request; methods that do not support an encoded request body will not have the event metadata provided with the
+  request; we advise using `POST` where possible
+- `target_path`: this is an **absolute URL** to which the request will be sent
+- `template_path`: this is the path to the [webhook
+  template](/api-management/gateway-events#webhook-payload) that will be
+  used to construct the request body
+- `header_map`: a map of custom headers to be provided with the request
+- `event_timeout`: the [webhook
+  cooldown](/api-management/gateway-events#webhook-cooldown) for duplicate
+  events (in seconds); use this to prevent flooding of the target endpoint when multiple events are fired in quick succession
+
+For example:
+
+```json {linenos=true, linenostart=1}
+{
+  "event_handlers": {
+    "events": {
+      "AuthFailure": [
+        {
+          "handler_name": "eh_web_hook_handler",
+          "handler_meta": {
+            "method": "POST",
+            "target_path": "http://posttestserver.com/post.php?dir=tyk-event-test",
+            "template_path": "templates/default_webhook.json",
+            "header_map": { "X-Tyk-Test-Header": "Tyk v1.BANANA" },
+            "event_timeout": 10
+          }
+        }
+      ]
+    }
+  }
+}
+```
+
+In this example, when the `AuthFailure` event is fired, the webhook event handler will send a request to
+`POST http://posttestserver.com/post.php?dir=tyk-event-test` and then start a 10 second cooldown before another webhook
+request can be sent.
+
+The request will have one custom header `X-Tyk-Test-Header: Tyk v1.BANANA` and the body will be constructed from the
+webhook template located at `templates/default_webhook.json`.
+
+
+<Note>
+This manually configured webhook event handler is private to the API within which it has been defined, it is not a
+[global
+webhook](/api-management/gateway-events#using-webhooks-with-tyk-dashboard).
+</Note>
+
+
+#### Set up a webhook event handler in the Tyk Dashboard
+
+It is very simple to register webhooks to be triggered in response to specific API events when using Tyk Classic APIs
+with the Tyk Dashboard. The API Designer in the Dashboard allows you to register _global webhooks_ to handle events.
+
+Note that Tyk Gateway does not have access to the _global webhook_ definitions registered with Tyk Dashboard and can
+only operate on the configuration within the API definition. Dashboard will manage the conversion of _global webhooks_
+to [locally defined webhook handlers](#set-up-a-webhook-event-handler-in-the-tyk-classic-api-definition) within the Tyk
+Classic API definition, automatically updating the configuration in each API definition when the APIs are reloaded to
+the Gateway.
+
+1. **Define the webhook**
+
+    Before you can configure a webhook event handler for your API, you must first create a global webhook from the
+    **Webhooks** screen in the **API Management** menu, as described
+    [here](/api-management/gateway-events#creating-a-global-webhook-definition-using-tyk-dashboard).
+
+2. **Register the webhook with the event**
+
+    From the API Designer select the **Advanced Options** tab and locate the **Webhooks** panel:
+
+    <img src="/img/2.10/webhooks_designer_settings.png" alt="Webhook API Details" />
+
+    Now:
+
+    - select the _API Event_ for which you want to trigger the webhook from the dropdown list
+    - select the _Webhook to use_ when the event fires, again from the dropdown list
+    - finally, configure the required _Cooldown period_
+    - click **Add**
+
+    Note that you can register multiple webhooks to be triggered in response to a single event and you can register the same
+    webhook with multiple API events.
+
+    Remember to click **Save** to save your changes.
+
+#### Set up a webhook event handler in Tyk Operator
+
+Tyk Operator supports event handler integration for Tyk Classic API Definition. Configuring the `event_handlers` field
+in ApiDefinition Custom Resource Definition (CRD) enables webhooks to be triggered by [specific
+API events](/api-management/gateway-events#event-types).
+
+The process for configuring webhook event handlers using Tyk Operator is similar to that explained in
+[Set up a webhook event handler in the Tyk Classic API Definition](#set-up-a-webhook-event-handler-in-the-tyk-classic-api-definition).
+The example API Definition below enables the event handler by setting `spec.event_handlers`.
+
+```yaml {hl_lines=["14-25"],linenos=true, linenostart=1}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: webhook-handler
+spec:
+  name: webhook-handler
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /webhook-handler
+    strip_listen_path: true
+  event_handlers:
+    events:
+      AuthFailure:
+        - handler_name: "eh_web_hook_handler"
+          handler_meta:
+            method: "POST"
+            name: "webhook name"
+            target_path: "http://posttestserver.com/post.php?dir=tyk-event-test"
+            template_path: "templates/default_webhook.json"
+            header_map:
+              X-Tyk-Test-Header: "Tyk v1.BANANA"
+            event_timeout: 10
+```
+
+
+## Logging API events
+
+Tyk’s built-in logging event handler is designed primarily for debugging purposes and will store details of an API event to the configured logger output.
+
+The Tyk platform can be configured to log at various verbosity levels (info, debug, warn, error) and can be integrated with third-party log aggregation tools like Sentry, Logstash, Graylog, and Syslog. For full details on configuring the Tyk logger, see [this section](/api-management/logs/application-logs).
+
+<br />
+
+<Note>
+Logging event handlers are currently only supported by Tyk Classic APIs.
+</Note>
+
+
+### Configuring the event handler
+
+Registering a logging event handler to your Tyk Classic API is the same as adding any other event handler, within the `event_handlers` section of the API definition.
+
+The `handler_name` for the logging event handler should be set to: `eh_log_handler`.
+
+The `handler_meta` for the logging event handler contains a single field:
+- `prefix` is a label that will be prepended to each log entry
+
+For example, to register event handlers to log the `AuthFailure` and `KeyExpired` events you might add the following to your API definition:
+
+```json
+{
+  "event_handlers": {
+    "events": {
+      "AuthFailure": [
+        {
+          "handler_name": "eh_log_handler",
+          "handler_meta": {
+            "prefix": "AuthFailureEvent"
+          }
+        }
+      ],
+      "KeyExpired": [
+        {
+          "handler_name": "eh_log_handler",
+          "handler_meta": {
+            "prefix": "KeyExpiredEvent"
+          }
+        }
+      ]
+    }
+  }
+}
+```
+
+In this example
+- the `AuthFailure` event will trigger the event handler to generate a log with the prefix `AuthFailureEvent`
+- the `KeyExpired` event will trigger the event handler to generate a log with the prefix `KeyExpiredEvent`
+
+When the event handler is triggered an entry will be made in the log containing the corresponding prefix, which can be useful for monitoring and debugging purposes.
+
+## Custom API event handlers
+
+Tyk supports you to script your own custom code in JavaScript (JS) that will be invoked in response to API events. This is executed asynchronously so you don't need to worry about it blocking the Gateway handling requests. Event handlers like this can be very powerful for automating session, user and API-level functions.
+
+It is important to note that unlike custom JavaScript [plugins](/api-management/plugins/javascript#), custom event handlers execute in a *global* JavaScript environment. This means that you need to be careful when naming the event handlers: if you use the same event handler name for different event handling code across two APIs, only one of them will execute, as the other will be overridden when loaded.
+
+Custom event handlers have access to the [JavaScript API](/api-management/plugins/javascript#javascript-api) which gives access to the session object and enables your code to make HTTP calls. This is particularly useful if you want to interface with another API with a complex request/response cycle.
+
+<br />
+
+<Note>
+Custom event handlers are currently only supported by Tyk Classic APIs.
+</Note>
+
+
+### Creating a custom event handler
+
+A custom event handler consists of a function that accepts two variables (`event` and `context`) and has no return value.
+
+Creating an event handler is very similar to [creating custom JS plugins](/api-management/plugins/javascript#using-javascript-with-tyk), simply invoke the correct constructors with a closure in the TykJS namespace:
+
+```js
+// ---- Sample custom event handler -----
+var sampleHandler = new TykJS.TykEventHandlers.NewEventHandler({});
+
+sampleHandler.NewHandler(function(event, context) {
+  // You can log to Tyk console output by calling the built-in log() function:
+  log("This handler does nothing, but this will appear in your terminal")
+
+  return
+});
+```
+
+#### The `event` object
+
+This contains the [event metadata](/api-management/gateway-events#event-metadata) in the following structure:
+
+```json
+{
+  "EventType": "Event Type Code",
+  "EventMetaData": {
+    "Message": "My Event Description",
+    "Path": "/{{api_id}}/{{path}}",
+    "Origin": "1.1.1.1:PORT",
+    "Key": "{{Auth Key}}"
+  },
+  "TimeStamp": "2024-01-01 23:59:59.111157073 +0000 UTC"
+}
+```
+
+#### The `context` Variable
+
+Tyk injects a `context` object into your event handler giving access to more information about the request. This object has the following structure:
+
+```js
+type JSVMContextGlobal struct {
+  APIID string
+  OrgID string
+}
+```
+
+It is populated with the API ID and Org ID of the request that your custom function can use together with the `event` metadata to interact with the Tyk REST API functions, for example:
+
+```js
+// Use the TykGetKeyData function to retrieve a session from the session store, use the context variable to give the APIID for the key.
+var thisSession = JSON.parse(TykGetKeyData(event.EventMetaData.Key, context.APIID))
+log("Expires: " + thisSession.expires)
+```
+
+### Registering a custom event handler
+
+Registering a custom event handler to your Tyk Classic API is the same as adding any other event handler, within the `event_handlers` section of the API definition.
+
+The `handler_name` for a custom event handler should be set to: `eh_dynamic_handler`.
+
+The `handler_meta` for a custom event handler consists of two fields:
+- `name` is the unique name of your middleware object
+- `path` is the relative path to the file (it can be absolute)
+
+For example, to register a custom event handler with the name `sessionHandler` to be invoked in response to the `KeyExpired` event you would add the following to your API definition:
+
+```json
+{
+  "event_handlers": {
+    "events": {
+      "KeyExpired": [
+        {
+          "handler_name":"eh_dynamic_handler",
+          "handler_meta": {
+            "name": "sessionHandler",
+            "path": "event_handlers/session_editor.js"
+          }
+        }
+      ]
+    }
+  }
+}
+```
+
+### Loading custom event handlers
+
+The JavaScript files are loaded on API reload into the global JSVM. If a hot-reload event occurs, the global JSVM is re-set and files are re-loaded. This could cause event handlers that are currently executing to get abandoned. This is a measured risk and should not cause instability, however it should be noted that because of this, in an environment where reloads occur frequently, there is risk that event handler may not fire correctly.
+
+## Monitoring quota consumption
+
+Tyk provides the ability to actively monitor both user and organization quotas, using a dedicated webhook to notify your stakeholders, your system stack or the requesting API client when certain thresholds have been reached for a token.
+
+Unlike API event [webhooks](/api-management/gateway-events#event-handling-with-webhooks) the quota monitor is configured at the Gateway level.
+
+<br />
+
+<Note>
+Advanced quota threshold monitoring is currently only supported by Tyk Classic APIs.
+</Note>
+
+
+### Configuring the quota consumption monitor
+
+To enable advanced quota monitoring you will need to add a new `monitor` section to your Tyk Gateway configuration file (`tyk.conf`).
+
+This has the following fields:
+- `enable_trigger_monitors`: set to `true` to have the monitors start to measure quota thresholds
+- `configuration`: a [webhook configuration](/api-management/gateway-events#event-handling-with-webhooks) object
+- `global_trigger_limit`: this is a percentage of the quota that the key must consume for the webhook to be fired
+- `monitor_user_keys`: set to `true` to monitor individual tokens (this may result in a large number of triggers as it scales with the number of user tokens that are issued)
+- `monitor_org_keys`: set to `true` to monitor organization quotas
+
+For example:
+
+```json
+{
+  "monitor": {
+    "enable_trigger_monitors": true,
+    "configuration": {
+      "method": "POST",
+      "target_path": "http://posttestserver.com/post.php?dir=tyk-monitor-drop",
+      "template_path": "templates/monitor_template.json",
+      "header_map": {"x-tyk-monitor-secret": "12345"},
+      "event_timeout": 10
+    },
+    "global_trigger_limit": 80.0,
+    "monitor_user_keys": false,
+    "monitor_org_keys": true
+  }
+}
+```
+
+With this configuration, a monitor is configured to issue a request to `POST http://posttestserver.com/post.php?dir=tyk-monitor-drop` when 80% of the API-level quota has been consumed. This request will have the `x-tyk-monitor-secret` header (set to a value of `12345`) and will provide the content of the template file found at `templates/monitor_template.json` in the request body. A minimum of 10 seconds will elapse between successive monitor webhooks being fired.
+
+<br />
+
+<Note>
+If you are using our [Classic Developer Portal](/tyk-developer-portal/tyk-portal-classic/portal-events-notifications), developers registered in the portal will also receive emails about quota threshold limits being reached.
+</Note>
+
+
+#### Setting advanced thresholds
+
+The default quota consumption monitor will be triggered at the same level of quota usage for all users. Sometimes you might want to have a more granular approach with different triggering thresholds per user or organization. Sometimes you might want to fire the event at multiple thresholds, for example when the user hits 50%, 75% and 90% of their allowed quota.
+
+You can set user specific trigger levels for a user by additionally adding a `monitor` section to the Key's [Session](/api-management/access-control/sessions-and-keys/understanding-sessions). This has one field, which is an array of `trigger_limits` (thresholds) that must be in *descending* order and represent the percentage of the quota that must be reached in order for the trigger to be fired, for example:
+
+```yaml
+"monitor": {
+  "trigger_limits": [90.0, 75.0, 50.0]
+}
+```
+
+If this is included in the session object, then the quota threshold event will be fired and the monitor webhook triggered when the user hits 50%, then 75%, and then again at 90% consumption.
+
+You can configure advanced thresholds for all users in an organization by adding the `monitor` section to the organization session object.
+
+### Webhook payload
+
+When the quota consumption monitor is fired, the webhook request that is issued will have the following payload:
+
+```json
+{
+  "event": "TriggerExceeded",
+  "message": "Quota trigger reached",
+  "org": "53ac07777cbb8c2d53000002",
+  "key": "",
+  "trigger_limit": "80",
+}
+```
+
+- `trigger_limit` will indicate which threshold has been reached (as defined in the session object's `monitor` section).
+- `org` will contain the OrgID for the user or organization that triggered the event
+- `key` will contain the *raw API key* used in the request only if the event was triggered by a user quota
+
+*Note: if the webhook was triggered by an organization threshold, `key` will be blank.*
+
+<br />
+
+<Warning>
+When the monitor is triggered by a user hitting their quota threshold, the <b>raw API key</b> is provided in the webhook payload. It is important to secure the webhook endpoint and to handle the payload securely on the receiving end.
+</Warning>
+
diff --git a/api-management/graphql.mdx b/api-management/graphql.mdx
new file mode 100644
index 0000000000..b95721a125
--- /dev/null
+++ b/api-management/graphql.mdx
@@ -0,0 +1,2531 @@
+---
+title: "GraphQL"
+description: "Learn how to configure and manage GraphQL APIs"
+keywords: "GraphQL, Federation, Entities, Grapqhl Proxy, Validation, Schema, Complexity Limiting, Persisted Queries, Migration Guide, GraphQL Playground, GQL Headers"
+sidebarTitle: "Overview"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+## Overview
+
+Tyk has **native** GraphQL support, so it doesn’t require any external services or middleware.
+It fully complies with the latest GraphQL specifications, as outlined on the [GraphQL Foundation webpage](https://spec.graphql.org/), including:
+
+- **[Queries](https://spec.graphql.org/October2021/#sec-Query)** – Fetching data  
+- **[Mutations](https://spec.graphql.org/October2021/#sec-Mutations)** – Modifying data  
+- **[Subscriptions](https://spec.graphql.org/October2021/#sec-Subscription)** – Real-time updates
+- **[Schema Types](/api-management/graphql/graphql-schema-types)** - Defining your data structure
+
+
+### What can you do with GraphQL and Tyk?
+
+You can securely expose existing GraphQL APIs using our [GraphQL core functionality](/api-management/graphql#create-a-graphql-api).
+
+In addition to this, you can also use Tyk's integrated GraphQL engine to build a [Universal Data Graph](/api-management/data-graph#overview). The Universal Data Graph (UDG) lets you expose existing services as one single combined GraphQL API.
+
+See our video on getting started with GraphQL.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/6yAqgnzzH10" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+### What is GraphQL?
+
+> GraphQL is a query language for APIs and a runtime for fulfilling those queries with your existing data. GraphQL provides a complete and understandable description of the data in your API, gives clients the power to ask for exactly what they need and nothing more, makes it easier to evolve APIs over time, and enables powerful developer tools.
+
+source: [GraphQL Foundation website](https://graphql.org/)
+
+### Why would you want to use GraphQL?
+
+Since this is the documentation section, we won't get into a debate about GraphQL vs REST. The main benefits of using GraphQL are:
+* **Reduced network traffic** One of the biggest benefits of GraphQL is that it allows clients to specify exactly what data they need. This means that you can avoid sending unnecessary data over the network, which can help reduce the amount of traffic and improve the performance of your application.
+* **Flexibility** GraphQL is very flexible and can be used with many different programming languages and frameworks. It can also be used to retrieve data from multiple sources, such as databases, APIs, and even third-party services.
+* **Simplified data fetching** With GraphQL, you can fetch all the data you need with a single request. This is because GraphQL allows you to specify exactly what data you need and how it should be structured, which can simplify the process of fetching data and reduce the amount of code you need to write.
+* **Easy maintenance** Because GraphQL allows you to define a schema for your data, it can be easier to maintain and evolve your API over time. This is because changes to the schema can be made without breaking existing clients, as long as the changes are backward compatible.
+* **Strong typing** GraphQL has a strong type system that allows you to define the shape of your data and ensure that the data you receive is of the correct type. This can help catch errors early on and make your code more reliable.
+* **Better developer experience for certain use cases** Examples of those use cases mostly mentioned by developers are: APIs with multiple consumers that have very different requirements, public APIs with large groups of unknown users (like Shopify of Github), rapidly evolving APIs, backends for mobile applications, aggregating data from multiple microservices and development of data-driven products.
+
+Our team has also published some blog posts that go deeper into GraphQL discussions. You can check some of them here:
+* [How Airbnb, Shopify, GitHub and more are winning with GraphQL](https://tyk.io/blog/how-airbnb-shopify-github-and-more-are-winning-with-graphql-and-why-you-may-need-it-too/)
+* [Who is Tyk GraphQL functionality for](https://tyk.io/blog/using-tyks-new-graphql-functionality-whos-it-for-and-what-does-it-do/)
+* [GraphQL: Performance is no longer a trade-off](https://tyk.io/blog/graphql-performance-is-no-longer-a-trade-off/)
+
+## Create a GraphQL API
+
+GraphQL API can be created in Tyk using:
+* Tyk Dashboard UI
+* Tyk Dashboard API
+* Tyk Gateway API - for OSS users
+
+The process is very similar to [HTTP API creation](/api-management/gateway-config-managing-classic#create-an-api) with a few additional steps to cover GraphQL-specific functionalities.
+
+### Via Tyk Dashboard UI
+
+#### Prerequisites
+
+In order to complete the next steps, you need to have [Tyk Self Managed installed](/tyk-self-managed/install). You can also create a 5-week trial account in Tyk Cloud.
+
+<ButtonLeft href="https://tyk.io/sign-up/" color="green" content="Try it free" />
+
+#### Steps for Configuration
+
+1. **Select "APIs" from the "System Management" section**
+
+    <img src="/img/2.10/apis_menu.png" alt="API Menu" />
+
+2. **Click "ADD NEW API"**
+
+    <img src="/img/2.10/add_api.png" alt="Add API button location" />
+
+3. **Set up the Base Configuration for your API**
+
+    <img src="/img/dashboard/graphql/choose-gql-api.png" alt="Create GQL API" />
+
+    - From the **Overview** section, add your **API Name** and your API **Type** (In this case it's GraphQL). 
+    - From the **Details** section, add your **Target URL**. This will set the upstream origin that hosts the service you want to proxy to. As an example, you can use [https://countries.trevorblades.com/](https://countries.trevorblades.com/).
+    - In case your upstream GQL service is protected, tick the box next to **Upstream Protected** and provide authorization details, so that Tyk can introspect the GraphQL service. You can provide authorization details as a set of headers or a certificate. [Introspection](/api-management/graphql#introspection) of your upstream service is important for Tyk to correctly work with your GraphQL.
+    - If you would like to persist authorization information for future use you can tick the **Persist headers for future use** box. That way, if the upstream GQL schema changes in the future, you will be able to update it easily in Tyk.
+    - Click **Configure API** when you have finished
+
+4. **Set up the Authentication for your API**
+
+    From the **Authentication** section:
+
+    <img src="/img/2.10/authentication.png" alt="Authentication" />
+
+    You have the following options:
+
+    - **Authentication mode**: This is the security method to use with your API. First, you can set it to `Open(Keyless)`, but that option is not advised for production APIs. See [Client Authentication](/api-management/client-authentication) for more details on securing your API.
+    - **Strip Authorization Data**: Select this option to strip any authorization data from your API requests.
+    - **Auth Key Header Name**: The header name that will hold the token on inbound requests. The default for this is `Authorization`.
+    - **Allow Query Parameter As Well As Header**: Set this option to enable checking the query parameter as well as the header for an auth token. **This is a setting that might be important if your GQL includes subscription operations**.
+    - **Use Cookie Value**: It is possible to use a cookie value as well as the other two token locations. 
+    - **Enable client certificate**: Select this to use Mutual TLS. See [Mutual TLS](/api-management/implement-tls#secure-hosted-apis-with-mtls) for details on implementing mutual TLS.
+
+5. **Save the API**
+
+    Click **SAVE**
+
+    <img src="/img/2.10/save.png" alt="Save button" />
+
+    Once saved, you will be taken back to the API list, where the new API will be displayed.
+
+    To see the URL given to your API, select the API from the list to open it again. The API URL will be displayed at the top of the editor:
+
+    <img src="/img/2.10/api_url.png" alt="API URL location" />
+
+    Your GQL API is now secured and ready to use.
+
+### Via Tyk Dashboard API
+
+#### Prerequisites
+
+It is possible to create GQL APIs using [Tyk Dashboard APIs](https://tyk.io/docs/api-reference/apis/get-list-of-apis). To make things easier you can use our [Postman collection](https://www.postman.com/tyk-technologies/workspace/tyk-public-workspace/overview).
+
+You will need an API key for your organization and one command to create a GQL API and make it live.
+
+#### Steps for Configuration
+
+1. **Obtain your Tyk Dashboard API Access Credentials key & Dashboard URL**
+
+    From the Tyk Dashboard, select "Users" from the "System Management" section.
+    Click **Edit** for your user, then scroll to the bottom of the page. Your **Tyk Dashboard API Access Credentials** key is the first entry:
+
+    <img src="/img/2.10/user_api_id.png" alt="API key location" />
+
+    Store your Dashboard Key, Dashboard URL & Gateway URL as environment variables so you don't need to keep typing them in:
+
+    ```bash
+    export DASH_KEY=db8adec7615d40db6419a2e4688678e0
+
+    # Locally installed dashboard
+    export DASH_URL=http://localhost:3000/api
+
+    # Tyk's Cloud Dashboard
+    export DASH_URL=https://admin.cloud.tyk.io/api
+
+    # Locally installed gateway
+    export GATEWAY_URL=http://localhost:8080
+
+    # Your Cloud Gateway
+    export GATEWAY_URL=https://YOUR_SUBDOMAIN.cloud.tyk.io
+    ```
+
+2. **Query the `/api/apis` endpoint to see what APIs are loaded**
+
+    ```curl
+    curl -H "Authorization: ${DASH_KEY}" ${DASH_URL}/apis
+    {"apis":[],"pages":1}
+    ```
+
+    For a fresh install, you will see that no APIs currently exist.
+
+3. **Create your first GQL API**
+
+    This example API definition configures the Tyk Gateway to reverse proxy to the [https://countries.trevorblades.com/](https://countries.trevorblades.com/) public GraphQL service.
+
+    To view the raw API definition object, you may visit: https://bit.ly/3zmviZ3
+
+    ```curl
+    curl -H "Authorization: ${DASH_KEY}" -H "Content-Type: application/json" ${DASH_URL}/apis \
+      -d "$(wget -qO- https://bit.ly/3zmviZ3)"
+    {"Status":"OK","Message":"API created","Meta":"64270eccb1821e3a5c203d98"}
+    ```
+
+    Take note of the API ID returned in the meta above - you will need it later.
+
+    ```
+    export API_ID=64270eccb1821e3a5c203d98
+    ```
+
+4. **Test your new GQL API**
+
+    ```curl
+    curl --location ${GATEWAY_URL}/trevorblades/
+    --header 'Content-Type: application/json'
+    --data '{"query":"query {\n    countries {\n        name\n        capital\n        awsRegion\n    }\n}","variables":{}}'
+    ```
+
+    You just sent a request to the gateway on the listen path `/trevorblades`. Using this path-based-routing, the gateway was able to identify the API the client intended to target.
+
+    The gateway stripped the listen path and reverse-proxied the request to https://countries.trevorblades.com/
+
+5. **Protect your API**
+
+  Let's grab the API definition we created before and store the output in a file locally.
+
+  ```curl
+  curl -s -H "Authorization: ${DASH_KEY}" -H "Content-Type: application/json" ${DASH_URL}/apis/${API_ID} | python -mjson.tool > api.trevorblades.json
+  ```
+
+  We can now edit the `api.trevorblades.json` file we just created, and modify a couple of fields to enable authentication.
+
+  Change `use_keyless` from `true` to `false`.
+
+  Change `auth_configs.authToken.auth_header_name` to `apikey`. 
+
+  Then send a `PUT` request back to Tyk Dashboard to update its configurations.
+
+  ```curl
+  curl -H "Authorization: ${DASH_KEY}" -H "Content-Type: application/json" ${DASH_URL}/apis/${API_ID} -X PUT -d "@api.trevorblades.json"
+  {"Status":"OK","Message":"Api updated","Meta":null}
+  ```
+
+6. **Test protected API**
+
+  Send request without any credentials
+
+  ```curl
+  curl -I ${GATEWAY_URL}/trevorblades/ \
+  --header 'Content-Type: application/json' \
+  --data '{"query":"query {\n    countries {\n        name\n        capital\n        awsRegion\n    }\n}","variables":{}}'
+
+  HTTP/1.1 401 Unauthorized
+  Content-Type: application/json
+  X-Generator: tyk.io
+  Date: Wed, 04 Dec 2019 23:35:34 GMT
+  Content-Length: 46
+  ```
+
+  Send a request with incorrect credentials
+
+  ```curl
+  curl -I ${GATEWAY_URL}/trevorblades/ \
+  --header 'Content-Type: application/json' \
+  --data '{"query":"query {\n    countries {\n        name\n        capital\n        awsRegion\n    }\n}","variables":{}}' \
+  -H 'apikey: somekey'
+
+  HTTP/1.1 403 Forbidden
+  Content-Type: application/json
+  X-Generator: tyk.io
+  Date: Wed, 04 Dec 2019 23:36:16 GMT
+  Content-Length: 57
+  ```
+
+  Congratulations - You have just created your first keyless GQL API, and then protected it using Tyk!
+
+### Via Tyk Gateway API
+
+#### Prerequisites
+
+In order to complete the next steps, you need to have the [Tyk OSS](/tyk-oss-gateway) installed.
+
+<ButtonLeft href="https://tyk.io/sign-up/" color="green" content="Try it out" />
+
+#### Creation Methods
+
+With Tyk OSS, it is possible to create GQL APIs using Tyk's Gateway API or to generate a file with the same object and store it in the `/apps` folder of the Tyk Gateway installation folder. This is demonstrated [in the file-based configuration section](/api-management/manage-apis/deploy-apis/deploy-apis-overview#file-based-configuration).
+
+
+#### Steps for Configuration
+
+
+<Note>
+A generated API ID will be added to the Tyk API definition if it's not provided while creating a GQL API with Tyk Gateway API.
+</Note>
+
+
+See our video for adding an API to the Open Source Gateway via the Gateway API and Postman:
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/UWM2ZQoGhQA" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+You can also use our [Postman collection](https://www.postman.com/tyk-technologies/workspace/tyk-public-workspace/overview) to make things easier.
+
+In order to use the Gateway API you will need an API key for your Gateway and one command to create the API and make it live.
+
+1. **Make sure you know your API secret**
+
+    Your Tyk Gateway API secret is stored in your `tyk.conf` file, the property is called `secret`, you will need to use this as a header called `x-tyk-authorization` to make calls to the Gateway API.
+
+2. **Create a GQL API**
+
+    To create a GQL API, let's send a definition to the `apis` endpoint, which will return the status and version of your Gateway. Change the `x-tyk-authorization` value and `curl` domain name and port to be the correct values for your environment.
+
+    This example API definition configures the Tyk Gateway to reverse proxy to the [https://countries.trevorblades.com/](https://countries.trevorblades.com/) public GraphQL service.
+
+    To view the raw API definition object, you may visit: https://bit.ly/3nt8KDa
+
+    ```curl
+    curl --location --request POST 'http://{your-tyk-host}:{port}/tyk/apis' \
+    --header 'Content-Type: application/json' \
+    --header 'Accept: application/json' \
+    --header 'X-Tyk-Authorization: {your-secret}' \
+    --data "$(wget -qO- https://bit.ly/3nt8KDa)"
+    ```
+
+    If the command succeeds, you will see:
+    ```json
+    {
+      "key": "trevorblades",
+      "status": "ok",
+      "action": "added"
+    }
+    ```
+
+    **What did we just do?**
+
+    We just sent an API definition to the Tyk `/apis` endpoint. API definitions are discussed in detail in the API section of this documentation. These objects encapsulate all of the settings for an API within Tyk Gateway.
+
+    
+<Note>
+Notice that  when creating a GQL API you need to include your GQL service schema in the API definition. Tyk Gateway doesn't have the capacity to introspect your GQL service on its own.
+
+Including the correct schema allows Tyk Gateway to validate incoming requests against it. More on validation can be found [here](/api-management/graphql#validation)
+</Note>
+
+
+    **Restart or hot reload**
+
+    After generating the file, you must either restart the Gateway or initiate a hot reload through an API call to the gateway, as outlined below:
+    ```curl
+    curl -H "x-tyk-authorization: {your-secret}" -s http://{your-tyk-host}:{port}/tyk/reload/group
+    ```
+
+    This command will hot-reload your API Gateway(s) and the new GQL API will be loaded, if you take a look at the output of the Gateway (or the logs), you will see that it should have loaded [Trevorblades API](https://countries.trevorblades.com/) on `/trevorblades/`.
+
+    Your GraphQL API is now ready to use. We recommend securing any GraphQL API before publishing it.
+
+    Check the following docs for more on GraphQL-specific security options:
+    * [Field based permissions](/api-management/graphql#field-based-permissions)
+    * [Complexity limiting](/api-management/graphql#complexity-limiting-1)
+    * [Introspection](/api-management/graphql#introspection)
+
+## GraphQL Proxy Only
+
+### What is GraphQL Proxy Only
+
+GraphQL Proxy Only is a GraphQL API with a single data source and a read-only schema. The schema is automatically loaded from the GraphQL upstream, which must support introspection queries.
+Like other APIs, the GraphQL API supports policies, but with more advanced settings.
+
+### Creating a GraphQL API via the Dashboard UI
+
+1. Log in to the Dashboard and go to APIs > Add New API > GraphQL.
+
+<img src="/img/dashboard/graphql/create_graphql.png" alt="Creating GraphQL Proxy Only API" />
+
+2. Choose a name for your API and provide an upstream URL
+
+
+
+    <Note>
+    In case your upstream URL is protected, select **Upstream Protected** and provide authorization details (either Header or Certificate information).
+    </Note>
+
+
+3. In this case, the upstream is protected with Basic Authentication, so we add an Authorization header.
+
+
+
+    <Note>
+    **Persist headers for future use** checkbox is selected. That way, you will not need to provide the auth headers anymore as they will be persisted in the API definition.
+    </Note>
+
+
+<img src="/img/dashboard/graphql/gql_upstream_header.png" alt="Adding Auth Header for GraphQL Proxy Only API" />
+
+
+4. Once done, click **Configure API**, and the Dashboard API designer will show up.
+
+5. Configure your API and click **save**, Your API will now be saved.
+
+### Managing GQL Schema
+
+There can be a need to update/sync the schema on your GraphQL API, say when the schema on the upstream is updated.
+The Dashboard UI can show the last time your API schema was synced with the upstream schema.
+
+<img src="/img/dashboard/graphql/schema_sync.png" alt="schema last updated screenshot" />
+
+If you click the **Get latest version**, the gateway will make an introspection query to your upstream to fetch the schema.
+You need to click **Update** on the top right button, to update your API.
+
+
+<Note>
+If you upstream is protected, you will need to provide an Authorization Header. In the Dashboard go to your API > Advanced Options > Upstream Auth headers
+and fill in your credentials
+</Note>
+
+
+### Policies, Keys, and Developer Portal
+
+#### Field-based permission
+
+You may want to allow different consumers access to your GraphQL API without exposing all data to them. So for example this could be a schema for a GraphQL API:
+```graphql
+type Query {
+  accounts: [Account!]
+}
+
+type Account {
+  owner: String!
+  number: ID!
+  balance: Float!
+}
+```
+
+and you don't want some associate with a certain key to access the `balance` field on type `Account`, the gateway will respond with:
+```json
+{
+    "errors": [
+        {
+            "message": "field: balance is restricted on type: Account"
+        }
+    ]
+}
+```
+Check the [Setup field-based permission](/api-management/graphql#setup-field-based-permissions-in-dashboard) section, to learn how to configure them.
+
+
+#### Complexity Limiting
+
+The complexity of a GraphQL query is about its depth. checkout this query:
+```graphql
+{
+  continents {
+    countries {
+      continent {
+        countries {
+          continent {
+            countries {
+              name
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+The above query has a depth of seven since the nested queries are seven.
+
+Tyk offers a solution to limit the depth of a query.
+Check out [this link](/api-management/graphql#query-depth-limit) on how to set query depth.
+
+#### Developer Portal
+
+As of Tyk v3.0.0, you can now publish GraphQL APIs to the Tyk Developer Portal.
+[This section](/tyk-developer-portal/tyk-portal-classic/graphql) will show how you can expose a GraphQL API to the developer portal.
+
+## Introspection
+
+### Overview
+
+A GraphQL server can provide information about its schema. This functionality is called **introspection** and is achievable by sending an **introspection query** to the GraphQL server. 
+
+If **introspection** is a completely new concept for you, browse through the official [GraphQL Specification](https://spec.graphql.org/October2021/#sec-Introspection) published by the GrapQL Foundation to find out more.
+
+When [creating a GraphQL proxy](/api-management/graphql#create-a-graphql-api) in Tyk Dashboard an introspection query is used to fetch the schema from the GraphQL upstream and display it in the schema tab.
+
+
+<Note>
+When using a GraphQL proxy the introspection query is always sent to the GraphQL upstream. This means that changes in the Tyk schema won't be reflected in the introspection response. You should keep the schemas synchronised to avoid confusion.
+</Note>
+
+
+#### Introspection for protected upstreams
+
+When you are creating a GQL API using Tyk Dashboard and your target GQL API is protected, you need to provide authorization details, so that Tyk Gateway can obtain your schema.
+
+In the *Create new API* screen you have to tick the **Upstream Protected** option under your Upstream URL.
+
+ <img src="/img/dashboard/graphql/introspection-auth.png" alt="Upstream protected" />
+
+ - From the **Upstream protected by** section choose the right option for your case: Headers or Certificate.
+ - Choosing **Headers** will allow you to add multiple key/value pairs in *Introsopection headers* section. 
+ - You can also **Persist headers for future use** by ticking that option. This will save information you provided in case in the future your schema changes and you need to sync it again. To understand better where this information will be saved, go to [GQL Headers](/api-management/graphql#graphql-apis-headers). To read more about schema syncing go [here](/api-management/graphql#syncing-gql-schema).
+- Choosing **Certificate** will allow you to provide *Domain* details and either *Select certificate* or *Enter certificate ID*.
+
+#### Turning off introspection
+
+The introspection feature should primarily be used as a discovery and diagnostic tool for development purposes.
+
+Problems with introspection in production:
+
+* It may reveal sensitive information about the GraphQL API and its implementation details. 
+* An attacker can discover potentially malicious operations.
+
+You should note that if the *Authentication Mode* is *Open(Keyless)*, GraphQL introspection is enabled and it cannot be turned off.
+
+GraphQL introspection is enabled in Tyk by default. You can disable the introspection per key or security policy using:
+* Tyk Dashboard
+* Tyk Dashboard and Gateway API
+
+<Tabs>
+<Tab title="Tyk Dashboard">
+
+First, check the general information on [how to create a security policy with Tyk](/api-management/gateway-config-managing-classic#secure-an-api)
+
+For GraphQL APIs the *API ACCESS* section will show additional, GQL-specific options that can be enabled. 
+
+<img src="/img/dashboard/graphql/disable-introspection.png" alt="Disable introspection" />
+
+You can diable introspection by changing the switch position.
+
+Because introspection control in Tyk works on Policy and Key level, it means you can control each of your consumer's access to introspection. You can have keys that allow introspection, while also having keys that disallow it.
+
+</Tab>
+<Tab title="Tyk APIs">
+
+First, you need to [create an API Key](/api-management/gateway-config-managing-classic#tyk-open-source-2). If you prefer, you can follow [these instructions](/api-management/gateway-config-managing-classic#secure-an-api) to learn how to do this using a [Policy](/api-management/policies).
+
+Once you learn how to utilize the API to create a Policy or a Key, you can use the following snippet in the Policy or directly in the Session:
+
+```bash
+{
+    "access_rights": {
+        "{API-ID}": {
+            "api_id": "{API-ID}",
+            "api_name": "{API-NAME}",
+            "disable_introspection": true,
+            "allowed_types": [],
+            "restricted_types": []
+        }
+    }
+}
+```
+
+With this configuration, we set `true` to `disable_introspection` field. When you try to run an introspection query on your API, you will receive an error response *(403 Forbidden)*:  
+
+```bash
+{
+    "error": "introspection is disabled"
+}
+```
+
+</Tab>
+</Tabs>
+
+
+
+Introspection also works for the [Universal Data Graph](/api-management/data-graph#overview).
+
+### Introspection Queries
+
+Any GraphQL API can be introspected with the right introspection query. Here's some examples on what introspection queries can look like and what information you can learn about the GraphQL service using them.
+
+#### Introspecting all types
+
+This query will respond with information about all types and queries defined in the schema. Additional information like *name*, *description* and *kind* will also be provided.
+
+```graphql
+query {
+ __schema {
+	    types {
+		  name
+		  description
+		  kind
+		}
+		queryType {
+		  fields {
+			name
+			description
+		  }
+		}
+   }
+ }
+
+```
+
+#### Introspecting single type details
+
+If you want to know more about a certain type in the schema, you can use the following query:
+
+```graphql
+  query {
+    __type(name: "{type name}") {
+  	...FullType
+    }
+  }
+
+  fragment FullType on __Type {
+    kind
+    name
+    description
+    fields(includeDeprecated: true) {
+  	name
+  	description
+  	args {
+  	  ...InputValue
+  	}
+  	type {
+  	  ...TypeRef
+  	}
+  	isDeprecated
+  	deprecationReason
+    }
+
+    inputFields {
+  	...InputValue
+    }
+
+    interfaces {
+  	...TypeRef
+    }
+
+    enumValues(includeDeprecated: true) {
+  	name
+  	description
+  	isDeprecated
+  	deprecationReason
+    }
+
+    possibleTypes {
+  	...TypeRef
+    }
+  }
+
+  fragment InputValue on __InputValue {
+    name
+    description
+    type {
+  	...TypeRef
+    }
+    defaultValue
+  }
+
+  fragment TypeRef on __Type {
+    kind
+    name
+    ofType {
+  	kind
+  	name
+  	ofType {
+  	  kind
+  	  name
+  	  ofType {
+  		kind
+  		name
+  		ofType {
+  		  kind
+  		  name
+  		  ofType {
+  			kind
+  			name
+  			ofType {
+  			  kind
+  			  name
+  			  ofType {
+  				kind
+  				name
+  			  }
+  			}
+  		  }
+  		}
+  	  }
+  	}
+    }
+  }
+```
+
+#### Introspecting types associated with an interface
+
+The query to introspect a single type can be used for any type, but you might prefer a simpler response for types such as `interface`. With this query you can get a list of objects that implements a specific `interface`.
+
+```graphql
+query {
+__type(name: "{interface name}") {
+  name
+  kind
+  description
+  possibleTypes {
+    name
+    kind
+    description
+  }
+}
+}  
+```
+
+#### Introspecting ENUM values
+
+An `enum` type defines a set of discrete values. With this query you can get a complete list of those values for a chosen `enum`.
+
+```graphql
+query {
+__type(name: "{enum name}") {
+  name
+  kind
+  description
+  enumValues {
+    name
+    description
+  }
+}
+}
+```
+
+#### Introspecting query definitions
+
+GraphQL requires queries to be defined in a special type `Query` in the schema. You can use the below introspection query to find out more about a query operations of the graph.
+
+```graphql
+  query {
+    __type(name: "Query") {
+  	...QueryType
+    }
+  }
+
+  fragment QueryType on __Type {
+    fields {
+  	name
+  	description
+  	type {
+  		name
+  		kind
+  	}
+  	args {
+  	  name
+  	  description
+  	  type {
+  		  name
+  		  kind
+  	  }
+  	}
+    }
+  }
+```
+
+
+<Note>
+You might find GQL APIs where the `Query` type is called `QueryRoot`. In those cases the above introspection query needs to be modified in line 2 to: `__type(name: "QueryRoot")`
+</Note>
+
+
+#### Introspecting mutation and subscription definitions
+
+You should use the same introsopection query as you would for `Query` type, just change the name argument to `Mutation` or `Subscription`.
+
+#### Full introspection
+
+If you prefer to introspect GraphQL all at once, you can do that by sending this query:
+
+```graphql
+
+    query IntrospectionQuery {
+      __schema {
+        
+        queryType { name }
+        mutationType { name }
+        subscriptionType { name }
+        types {
+          ...FullType
+        }
+        directives {
+          name
+          description
+          
+          locations
+          args {
+            ...InputValue
+          }
+        }
+      }
+    }
+
+    fragment FullType on __Type {
+      kind
+      name
+      description
+      
+      fields(includeDeprecated: true) {
+        name
+        description
+        args {
+          ...InputValue
+        }
+        type {
+          ...TypeRef
+        }
+        isDeprecated
+        deprecationReason
+      }
+      inputFields {
+        ...InputValue
+      }
+      interfaces {
+        ...TypeRef
+      }
+      enumValues(includeDeprecated: true) {
+        name
+        description
+        isDeprecated
+        deprecationReason
+      }
+      possibleTypes {
+        ...TypeRef
+      }
+    }
+
+    fragment InputValue on __InputValue {
+      name
+      description
+      type { ...TypeRef }
+      defaultValue
+      
+      
+    }
+
+    fragment TypeRef on __Type {
+      kind
+      name
+      ofType {
+        kind
+        name
+        ofType {
+          kind
+          name
+          ofType {
+            kind
+            name
+            ofType {
+              kind
+              name
+              ofType {
+                kind
+                name
+                ofType {
+                  kind
+                  name
+                  ofType {
+                    kind
+                    name
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  
+```
+
+Tyk also allows you to block introspection queries for security reasons if you wish to do so. More information on how to do that is provided [here](/api-management/graphql#turning-off-introspection).
+
+## Validation
+
+In order to prevent errors happening during request processing or sending invalid queries to the upstream Tyk supports the validation of GraphQL queries and schemas.
+
+### Query Validation
+Tyk's native GraphQL engine supports validating GraphQL queries based on the [GraphQL Specification](https://spec.graphql.org/October2021/).
+
+Both the GraphQL engine in front of your existing GraphQL API as well as any Universal Data Graph you build gets protected with a validation middleware.
+
+This means, no invalid request will be forwarded to your upstream.
+The Gateway will catch the error and return it to the client.
+
+### Schema Validation
+A broken schema can lead to undesired behaviors of the API including queries not being processed by the GraphQL middleware. As the search for the root cause for 
+such a malfunction can be tedious, Tyk provides schema validation.
+
+
+<Note>
+Schema validation is only available when using the Dashboard or Dashboard API.
+</Note>
+
+
+The schema validation will prevent you from saving or updating an API with a broken schema. This includes schemas breaking the following rules:
+ - No duplicated operation types (Query, Mutation, Subscription)
+ - No duplicated type names
+ - No duplicated field names
+ - No duplicated enum values
+ - No usage of unknown types
+
+When using the [Dashboard API](https://tyk.io/docs/api-reference/apis/get-list-of-apis) the response for a broken schema will be a *400 Bad Request* with a body containing the validation errors. For example:
+
+```json
+{
+  "Status": "Error",
+  "Message": "Invalid GraphQL schema",
+  "Meta": null,
+  "Errors": [
+    "field 'Query.foo' can only be defined once"
+  ]
+}
+```
+
+## GraphQL APIs headers
+
+Users can set up two kinds of headers when configuring GraphQL APIs:
+
+- Introspection headers
+- Request headers
+
+Both types of headers can be set in the Advanced Options tab in Tyk Dashboard.
+
+### Introspection headers
+
+Tyk Dashboard can introspect any upstream GraphQL API and download a copy of the GQL schema. That schema will be displayed in the Schema tab.
+
+For protected upstreams that require authorization for introspection, Tyk allows you to persist authorization headers within the GraphQL API configuration using **Introspection headers**.
+
+<img src="/img/dashboard/graphql/introspection-headers.png" alt="Introspection headers" />
+
+Any header key/value pair defined in **Introspection headers** will only be used while making an introspection call from Tyk Dashboard to the upstream. Those headers will not be used while proxying requests from consumers to the upstream.
+
+**Introspection headers** can also be configured in the raw API definition:
+
+```json
+...
+"graphql": {
+      "execution_mode": "proxyOnly",
+      "proxy": {
+        "auth_headers": {
+          "admin-auth": "token-value"
+        }
+      }
+}
+```
+
+### Request headers
+
+You can enrich any GraphQL request proxied through Tyk Gateway with additional information in the headers by configuring **Request headers** in the Tyk Dashboard.
+
+<img src="/img/dashboard/graphql/headers-gql-request.png" alt="Request headers" />
+
+**Request headers** values can be defined as context variables. To know how to refer to request context variables check [this page](/api-management/traffic-transformation/request-context-variables).
+
+Any header key/value pair defined in **Request headers** will only be used to inject headers into requests proxied through the Gateway. It will not be used to introspect the upstream schema from Tyk Dashboard.
+
+**Request headers** can also be configured in the raw API definition:
+
+```bash
+...
+"graphql": {
+      "execution_mode": "proxyOnly",
+      "proxy": {
+        "request_headers": {
+          "context-vars-metadata": "$tyk_context.path",
+          "static-metadata": "static-value"
+        }
+      }
+}
+```
+
+## Syncing GQL Schema
+
+A GraphQL Proxy API maintains a copy of the upstream GraphQL schema. When the upstream schema changes, these updates need to be reflected in the proxy schema.
+
+To manage this, Tyk Dashboard stores the timestamp of the last schema change each time a GraphQL API is updated. This timestamp helps identify whether the schema is outdated and needs to be synced with the upstream version. You can find this information above the schema editor.
+
+To sync the schema, click the **Resync** button.
+
+
+
+<Note>
+Syncing schemas is only available for proxy-only GraphQL APIs and **not** for UDG.
+</Note>
+
+
+<img src="/img/dashboard/graphql/schema_sync.png" alt="Sync Schema Button" />
+
+If your upstream is protected then you need to make sure you provide Tyk with the authorization details to execute the introspection query correctly. You can add those detail while [creating GQL API](/api-management/graphql#introspection-for-protected-upstreams) or using [Introspection headers](/api-management/graphql#introspection-headers) later on.
+
+
+
+## Persisting GraphQL queries
+
+Tyk Gateway `4.3.0` release includes a way to expose GraphQL queries as REST endpoints. For now, this can only be configured via the raw API definition, Tyk Dashboard support is coming soon.
+
+### How to persist GraphQL query
+
+The ability to expose a GraphQL query as a REST endpoint can be enabled by adding the `persist_graphql` section of the `extended_paths` on an HTTP type in any API version you intend to use to serve as the GraphQL query to REST endpoint proxy.
+
+Here is a sample REST API proxy for the HTTP type API:
+
+```json
+{
+  "name": "Persisted Query API",
+  "api_id": "trevorblades",
+  "org_id": "default",
+  "use_keyless": true,
+  "enable_context_vars": true,
+  "definition": {
+    "location": "header",
+    "key": "x-api-version"
+  },
+  "proxy": {
+    "listen_path": "/trevorblades/",
+    "target_url": "https://countries.trevorblades.com",
+    "strip_listen_path": true
+  }
+}
+```
+
+The target URL should point to a GraphQL upstream although this is a REST proxy. This is important for the feature to work.
+
+#### Adding versions
+
+On its own, this isn’t particularly remarkable. To enable GraphQL to REST middleware, modify the Default version like so:
+
+```json
+{
+  "name": "Persisted Query API",
+  "definition": {
+    "location": "header",
+    "key": "x-api-version"
+  },
+  ...
+  "version_data": {
+    "not_versioned": true,
+    "default_version": "",
+    "versions": {
+      "Default": {
+        "name": "Default",
+        "expires": "",
+        "paths": {
+          "ignored": [],
+          "white_list": [],
+          "black_list": []
+        },
+        "use_extended_paths": true,
+        "global_headers": {},
+        "global_headers_remove": [],
+        "global_response_headers": {},
+        "global_response_headers_remove": [],
+        "ignore_endpoint_case": false,
+        "global_size_limit": 0,
+        "override_target": "",
+        "extended_paths": {
+          "persist_graphql": [
+            {
+              "method": "GET",
+              "path": "/getContinentByCode",
+              "operation": "query ($continentCode: ID!) {\n    continent(code: $continentCode) {\n        code\n        name\n        countries {\n            name\n        }\n    }\n}",
+              "variables": {
+                "continentCode": "EU"
+              }
+            }
+          ]
+        }
+      }
+    }
+  }
+}
+```
+
+The vital part of this is the `extended_paths.persist_graphql` field. The `persist_graphql` object consists of three fields:
+
+`method`: The HTTP method used to access that endpoint, in this example, any GET requests to `<PROXY ENDPOINT>/getContinentByCode` will be handled by the *persist graphql* middleware
+
+`path`: The path the middleware listens to
+
+`operation`: This is the GraphQL operation (`query` in this case) that is sent to the upstream.
+
+`variables`: A list of variables that should be included in the upstream request.
+
+If you run a request to your proxy, you should get a response similar to this: 
+
+```json
+{
+    "data": {
+        "continent": {
+            "code": "EU",
+            "name": "Europe",
+            "countries": [
+                {
+                    "name": "Andorra"
+                },
+                ...
+            ]
+        }
+    }
+}
+```
+
+#### Dynamic variables
+
+We have seen support for passing static variable values via the API definition, but there will be cases where we want to extract variables from the request header or URL. More information about available request context variables in Tyk can be found [here](/api-management/traffic-transformation/request-context-variables)
+
+Below is an examples of using an incoming `code` header value as a variable in `persist_graphql` middleware configuration:
+
+```json
+{
+  "method": "GET",
+  "path": "/getCountryByCode",
+  "operation": "query ($countryCode: ID!) {\n   country(code: $countryCode) {\n        code\n        name\n        }\n}",
+  "variables": {
+    "countryCode": "$tyk_context.headers_Code"
+  }
+}
+```
+
+Making a request to that endpoint and providing header `"code": "UK"`, should result in a response similar to this:
+
+```json
+{
+    "data": {
+        "country": {
+            "code": "UK",
+            "name": "United Kingdom"
+        }
+    }
+}
+```
+
+Similarly, you can also pass variables in the request URL. Modify your `persist_graphql` block to this:
+
+```json
+{
+  "method": "GET",
+  "path": "/getCountryByCode/{countryCode}",
+  "operation": "query ($countryCode: ID!) {\n   country(code: $countryCode) {\n        code\n        name\n        }\n}",
+  "variables": {
+    "countryCode": "$path.countryCode"
+  }
+}
+```
+
+If you now make a request to `/getCountryByCode/NG` you should get a result similar to this:
+
+```json
+{
+    "data": {
+        "country": {
+            "code": "NG",
+            "name": "Nigeria"
+        }
+    }
+}
+```
+
+## Complexity Limiting
+
+Depending on the GraphQL schema an operation can cause heavy loads on the upstream by using deeply nested or resource-expensive operations. Tyk offers a solution to this issue by allowing you to control query depth and define its max value in a policy or directly on a key.
+
+### Deeply nested query
+
+Even if you have a simple GraphQL schema, that looks like this:
+
+```graphql
+type Query {
+  continents: [Continent!]!
+}
+
+type Continent {
+  name: String!
+  countries: [Country!]!
+}
+
+type Country {
+  name: String!
+  continent: Continent!
+}
+```
+
+There is a potential risk, that a consumer will try to send a deeply nested query, that will put a lot of load on your upstream service. An example of such query could be:
+
+```graphql
+query {
+  continents {
+    countries {
+      continent {
+        countries {
+          continent {
+            countries {
+              continent {
+                countries {
+                  name
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+### Query depth limit
+Deeply nested queries can be limited by setting a query depth limitation. The depth of a query is defined by the highest amount of nested selection sets in a query.
+
+Example for a query depth of `2`:
+```json
+{
+  continents {
+    name
+  }
+}
+```
+
+Example for a query depth of `3`:
+```json
+{
+  continents {
+    countries {
+      name
+    }
+  }
+}
+```
+
+When a GraphQL operation exceeds the query depth limit the consumer will receive an error response (*403 Forbidden*):
+```json
+{
+    "error": "depth limit exceeded"
+}
+```
+
+#### Enable depth limits from the Dashboard
+
+Query depth limitation can be applied on three different levels:
+
+* **Key/Policy global limits and quota section. (`Global Limits and Quota`)** The query depth value will be applied on all APIs attached on a Key/Policy.
+  1. *Optional:* Configure a Policy from **System Management > Policies > Add Policy**.
+  2. From **System Management > Keys > Add Key** select a policy or configure directly for the key.
+  3. Select your GraphQL API (marked as *GraphQL*). <em>(if Policy is not applied on Key)</em>
+  4. Change the value for **Query depth**, from `Global Limits and Quota` by unchecking the *Unlimited query depth* checkmark and insert the maximum allowed query depth.
+
+<img src="/img/dashboard/system-management/global_limits_query_depth.png" alt="query-depth-limit" />
+
+* **API limits and quota. (`Set per API Limits and Quota`)** This value will overwrite any value registered for query depth limitation on global Key/Policy level, and will be applied on all fields for Query and Mutation types defined within the API schema.
+  1. *Optional:* Configure a Policy from **System Management > Policies > Add Policy**.
+  2. From **System Management > Keys > Add Key** select a policy or configure directly for the key.
+  3. Select your GraphQL API (marked as *GraphQL*). <em>(if Policy is not applied on Key)</em>
+  4. Enable `Set per API Limits and Quota` section.
+  5. Change the value for **Query depth**, from API level, by unchecking the *Unlimited query depth* checkmark and insert the maximum allowed query depth
+
+<img src="/img/dashboard/system-management/api_limits_query_depth.png" alt="query-depth-limit" />
+
+* **API per query depth limit. (`Set per query depth limits`)** By setting a query depth limit value on a specific Query/Mutation type field, will take highest priority and all values set on first 2 steps will be overwritten.
+  1. *Optional:* Configure a Policy from **System Management > Policies > Add Policy**.
+  2. From **System Management > Keys > Add Key** select a policy or configure directly for the key.
+  3. Select your GraphQL API (marked as *GraphQL*). <em>(if Policy is not applied on Key)</em>
+  4. Enable `Set per query depth limits` section.
+  5. Add as many queries you want to apply depth limitation on.
+
+<img src="/img/dashboard/system-management/query_limits_query_depth.png" alt="query-depth-limit" />
+
+
+#### Enable depth limits using Tyk APIs
+
+You can set the same query depth limits using the Tyk Gateway API (for open-source users) or Tyk Dashboard API. To make it easier we have [Postman collections](https://www.postman.com/tyk-technologies/workspace/tyk-public-workspace/overview) you can use.
+
+**Global query depth limit for Key/Policy**
+
+In the key/policy json you need to make sure this section has your desired `max_query_depth` set:
+
+```yaml
+{...
+   "rate": 1000,
+    "per": 60,
+    "max_query_depth": 5
+...}
+```
+
+**Per API depth limits**
+
+In the key/policy json you need to make sure that this section is set correctly:
+
+```yaml
+{
+  ...
+  "access_rights_array": [
+    {
+      "api_name": "trevorblades",
+      "api_id": "68496692ef5a4cb35a2eac907ec1c1d5",
+      "versions": [
+        "Default"
+      ],
+      "allowed_urls": [],
+      "restricted_types": [],
+      "allowed_types": [],
+      "disable_introspection": false,
+      "limit": {
+        "rate": 1000,
+        "per": 60,
+        "throttle_interval": -1,
+        "throttle_retry_limit": -1,
+        "max_query_depth": 3,
+        "quota_max": -1,
+        "quota_renews": 0,
+        "quota_remaining": 0,
+        "quota_renewal_rate": -1,
+        "set_by_policy": false
+      },
+      "field_access_rights": [],
+      "allowance_scope": ""
+    }
+  ]
+  ...
+}
+```
+
+**API per query depth limits**
+
+If you have more than one query in your schema and you want to set different depth limits for each of those, Tyk also allows you to do that. In this case you need to make sure, that `field_access_rights` per API are set correctly:
+
+```yaml
+{
+  ...
+  "access_rights_array": [
+    {
+        "api_name": "trevorblades",
+        "api_id": "68496692ef5a4cb35a2eac907ec1c1d5",
+        "versions": [
+          "Default"
+        ],
+        "allowed_urls": [],
+        "restricted_types": [],
+        "allowed_types": [],
+        "disable_introspection": false,
+        "limit": null,
+        "field_access_rights": [
+          {
+              "type_name": "Query",
+              "field_name": "continents",
+              "limits": {
+                "max_query_depth": 3
+              }
+          },
+          {
+              "type_name": "Query",
+              "field_name": "countries",
+              "limits": {
+                "max_query_depth": 5
+              }
+          }
+        ],
+        "allowance_scope":""
+    }
+  ]
+  ...
+}
+```
+
+
+<Note>
+Setting the depth limit to `-1` in any of the above examples will allow *Unlimited* query depth for your consumers.
+</Note>
+
+
+## Field Based Permissions
+
+You may want to allow different consumers access to your GraphQL API without exposing all data to them. So for example this could be a schema for a GraphQL API:
+
+```graphql
+type Query {
+  accounts: [Account!]
+}
+
+type Account {
+  owner: String!
+  number: ID!
+  balance: Float!
+}
+```
+
+For one type of consumer, it will be fine to query all data the schema exposes, while for another type of consumer it should not be allowed to retrieve the `balance` for example.
+
+Field access can be restricted by setting up *field based permissions* in a policy or directly on a key.
+
+When a field is restricted and used in a GraphQL operation, the consumer will receive an error response (*400 Bad Request*):
+
+```yaml
+{
+    "errors": [
+        {
+            "message": "field: balance is restricted on type: Account"
+        }
+    ]
+}
+```
+### Field based permissions with the list of allowed types
+Field access can be restricted by setting up an allowed types list in a policy or directly on a key. If new fields are added to the GraphQL schema, you don't need to update the field-based permissions. This is because the fields that are not in the list of allowed types are automatically access-restricted.
+
+First, you need to learn [how to create a security policy with the API](/api-management/gateway-config-managing-classic#secure-an-api) or [how to create an API Key with the API](/api-management/gateway-config-managing-classic#secure-an-api).
+
+Once you learn how to utilize the API to create a security policy or key, you can use the following snippet:
+
+```yaml
+{
+    "access_rights": {
+        "{API-ID}": {
+            "api_id": "{API-ID}",
+            "api_name": "{API-NAME}",
+            "allowed_types": [
+                {
+                    "name": "Query",
+                    "fields": ["accounts"]
+                },
+                {
+                    "name": "Account",
+                    "fields": ["owner"]
+                }
+            ]
+        }
+    }
+}
+```
+With this configuration, a consumer can only access the field called the `owner`. When any other fields are used in a GraphQL operation, the consumer will receive an error response *(400 Bad Request)*: 
+
+```yaml
+{
+    "errors": [
+        {
+            "message": "field: balance is restricted on type: Account"
+        }
+    ]
+}
+```
+It's important to note that once you set a list of allowed types, Tyk will use this list to control access rights and disable the list of restricted types. The same behavior will occur if an asterisk operator is used to control access.
+
+### Allow or restrict all fields with the asterisk operator
+
+You can allow or restrict all fields of a type by using an asterisk (*) operator. Any new fields of that type will be allowed or blocked by default. For example: 
+
+```yaml
+{
+    "access_rights": {
+        "{API-ID}": {
+            "api_id": "{API-ID}",
+            "api_name": "{API-NAME}",
+            "allowed_types": [
+                {
+                    "name": "Query",
+                    "fields": ["*"]
+                },
+                {
+                    "name": "Account",
+                    "fields": ["*"]
+                }
+            ]
+        }
+    }
+}
+```
+With this configuration, the consumers are allowed to access all current and future fields of the `Query` and `Account` types. Please note that the asterisk operator does not work recursively. For example, in the example below, the asterisk operator only allows access to fields of the `Query` type. Fields of the `Account` type remain restricted.
+
+```yaml
+{
+    "access_rights": {
+        "{API-ID}": {
+            "api_id": "{API-ID}",
+            "api_name": "{API-NAME}",
+            "allowed_types": [
+                {
+                    "name": "Query",
+                    "fields": ["*"]
+                }
+            ]
+        }
+    }
+}
+```
+The asterisk operator also works for the list of restricted types:  
+
+```yaml
+{
+    "access_rights": {
+        "{API-ID}": {
+            "api_id": "{API-ID}",
+            "api_name": "{API-NAME}",
+            "restricted_types": [
+                {
+                    "name": "Query",
+                    "fields": ["accounts"]
+                },
+                {
+                    "name": "Account",
+                    "fields": ["*"]
+                }
+            ]
+        }
+    }
+}
+```
+
+The configuration above restricts access to all fields of the `Account` type. 
+
+Please note that the list of allowed types overrides the list of restricted types.
+
+
+
+### Setup field based permissions in Dashboard
+
+Restricted and allowed types and fields can also be set up via Tyk Dashboard.
+
+1. *Optional:* Configure a Policy from **System Management > Policies > Add Policy**.
+2. From **System Management > Keys > Add Key** select a policy or configure directly for the key.
+3. Select your GraphQL API (marked as *GraphQL*).
+4. Enable either **Block list** or **Allow list**. By default, both are disabled. It's not possible to have both enabled at the same time - enabling one switch automatically disables the other.
+
+#### Block list
+
+By default all *Types* and *Fields* will be unchecked. By checking a *Type* or *Field* you will disallow to use it for any GraphQL operation associated with the key.
+
+For example, the settings illustrated below would block the following:
+- `code` and `countries` fields in `Continent` type.
+- `latt` and `longt` fields in `Coordinates` type.
+
+<img src="/img/dashboard/system-management/field-based-permissions-blocklist.png" alt="field-based-permissions" />
+
+#### Allow list
+
+By default all *Types* and *Fields* will be unchecked. By checking a *Type* or *Field* you will allow it to be used for any GraphQL operation associated with the key.
+
+For example, the settings illustrated below would only allow the following:
+- `code` field in `Continent` type.
+- `code` and `name` fields in `Language` type.
+
+Note that the `Query` type is unchecked, which indicates that all fields in `Query` type are unchecked. Subsequently, you will not be able to run any query.
+
+<img src="/img/dashboard/system-management/field-based-permissions-allowlist.png" alt="field-based-permissions" />
+
+## GraphQL Federation
+
+### Overview
+
+#### Federation Version Support
+
+Tyk supports Federation v1
+
+#### What is federation?
+
+Ease-of-use is an important factor when adopting GraphQL either as a provider or a consumer. Modern enterprises have dozens of backend services and need a way to provide a unified interface for querying them. Building a single, monolithic GraphQL service is not the best option. It leads to a lot of dependencies, over-complication and is hard to maintain.
+
+To remedy this, Tyk, with release 4.0 offers GraphQL federation that allows you to divide GQL implementation across multiple back-end services, while still exposing them all as a single graph for the consumers.
+
+<img src="/img/dashboard/graphql/diagram_graphql-federation-B.png" alt="GraphQL federation flowchart" />
+
+#### Subgraphs and supergraphs
+
+**Subgraph** is a representation of a back-end service and defines a distinct GraphQL schema. It can be queried directly as a separate service or it can be federated into a larger schema of a supergraph.
+
+**Supergraph** is a composition of several subgraphs that allows the execution of a query across multiple services in the backend.
+
+#### Subgraphs examples
+
+**Users**
+```graphql
+extend type Query {
+  me: User
+}
+
+type User @key(fields: "id") {
+  id: ID!
+  username: String!
+}
+```
+
+**Products**
+
+```graphql
+extend type Query {
+  topProducts(first: Int = 5): [Product]
+}
+
+extend type Subscription {
+  updatedPrice: Product!
+  updateProductPrice(upc: String!): Product!
+  stock: [Product!]
+}
+
+type Product @key(fields: "upc") {
+  upc: String!
+  name: String!
+  price: Int!
+  inStock: Int!
+}
+```
+
+**Reviews**
+
+```graphql
+type Review {
+  body: String!
+  author: User! @provides(fields: "username")
+  product: Product!
+}
+
+extend type User @key(fields: "id") {
+  id: ID! @external
+  username: String! @external
+  reviews: [Review]
+}
+
+extend type Product @key(fields: "upc") {
+  upc: String! @external
+  reviews: [Review]
+}
+```
+
+#### Subgraph conventions
+
+- A subgraph can reference a type that is defined by a different subgraph. For example, the Review type defined in the last subgraph includes an `author` field with type `User`, which is defined in a different subgraph.
+
+- A subgraph can extend a type defined in another subgraph. For example, the Reviews subgraph extends the Product type by adding a `reviews` field to it.
+
+- A subgraph has to add a `@key` directive to an object’s type definition so that other subgraphs can reference or extend that type. The `@key` directive makes an object type an entity.
+#### Supergraph schema
+
+After creating all the above subgraphs in Tyk, they can be federated in your Tyk Gateway into a single supergraph. The schema of that supergraph will look like this:
+
+```graphql
+type Query {
+  topProducts(first: Int = 5): [Product]
+  me: User
+}
+
+type Subscription {
+  updatedPrice: Product!
+  updateProductPrice(upc: String!): Product!
+  stock: [Product!]
+}
+
+type Review {
+  body: String!
+  author: User!
+  product: Product!
+}
+
+type Product {
+  upc: String!
+  name: String!
+  price: Int!
+  inStock: Int!
+  reviews: [Review]
+}
+
+type User {
+  id: ID!
+  username: String!
+  reviews: [Review]
+}
+```
+
+#### Creating a subgraph via the Dashboard UI
+
+1. Log in to the Dashboard and go to APIs > Add New API > Federation > Subgraph.
+<img src="/img/dashboard/graphql/add-subgraph-api.png" alt="Add federation subgraph" />
+
+2. Choose a name for the subgraph and provide an upstream URL.
+
+
+
+    <Note>
+    Note
+
+    In case your upstream URL is protected, select **Upstream Protected** and provide authorization details (either Header or Certificate information).
+    </Note>
+
+
+<img src="/img/dashboard/graphql/subgraph-upstream-url.png" alt="Add upstream URL" />
+
+3. Go to Configure API and configure your subgraph just as you would any other API in Tyk.
+
+
+
+    <Note>
+    Note
+
+    In v4.0, subgraphs will be set to **Internal** by default.
+    </Note>
+
+
+4. Once you have configured all the options, click Save. The subgraph is now visible in the list of APIs.
+<img src="/img/dashboard/graphql/subgraph-api-listing.png" alt="Subgraph API listing" />
+
+#### Creating a supergraph via the Dashboard UI
+1. Log in to the Dashboard and go to APIs > Add New API > Federation > Supergraph.
+<img src="/img/dashboard/graphql/add-supergraph-api.png" alt="Add supergraph API" />
+
+2. In the Details section, select all the subgraphs that will be included in your supergraph.
+<img src="/img/dashboard/graphql/select-subgraphs.png" alt="Select subgraphs" />
+
+3. Go to Configure API and configure your supergraph just as you would any other API in Tyk.
+4. Once you configure all the options, click Save. The supergraph is now available in your list of APIs.
+<img src="/img/dashboard/graphql/supergraph-api-listing.png" alt="Supergraph API listing" />
+
+#### Defining Headers
+In v4.0 you can define global (Supergraph) headers. Global headers are forwarded to all subgraphs that apply to the specific upstream request.
+
+##### Setting a Global Header
+
+1. After creating your supergraph, open the API in your Dashboard.
+2. From the Subgraphs tab, click Global Headers.
+<img src="/img/dashboard/graphql/global-header1.png" alt="Global Header setup for a supergraph" />
+
+3. Enter your header name and value. You can add more headers by clicking Add Headers.
+<img src="/img/dashboard/graphql/global-header2.png" alt="Add further Global headers in a supergraph" />
+
+4. Click **Update** to save the header.
+5. On the pop-up that is displayed, click Update API.
+6. If you want to delete a global header, click the appropriate bin icon for it.
+7. You can update your headers by repeating steps 2-5.
+
+### Entities
+
+#### Defining the base entity
+
+- Must be defined with the @key directive.
+- The "fields" argument of the @key directive must reference a valid field that can uniquely identify the entity.
+- Multiple primary keys are possible.
+
+An example is provided below:
+
+**Subgraph 1 (base entity)**
+
+```graphql
+type MyEntity @key(fields: "id") @key(fields: "name") {
+  id: ID!
+  name: String!
+}
+```
+
+#### Extending entities
+
+Entities cannot be shared types (be defined in more than one single subgraph; see **Entity stubs** below).
+
+The base entity remains unaware of fields added through extension; only the extension itself is aware of them.
+
+Attempting to extend a non-entity with an extension that includes the @key directive or attempting to extend a base entity with an extension that does not include the @key directive will both result in errors.
+
+The primary key reference should be listed as a field with the @external directive.
+
+Below is an example extension for **MyEntity** (which was defined above in **Subgraph 1**):
+
+**Subgraph 2 (extension):**
+
+```graphql
+extend type MyEntity @key(fields: "id") {
+  id: ID! @external
+  newField: String!
+}
+```
+
+#### Entity stubs
+If one subgraph references a base entity (an entity defined in another subgraph) without adding new fields, that reference must be declared as a stub. In **federation v1**, stubs appear similar to extensions but do not add any new fields.
+
+An entity stub contains the minimal amount of information necessary to identify the entity (referencing exactly one of the primary keys from the base entity regardless of whether there are multiple primary keys on the base entity).
+
+The identifying primary key should feature the @external directive.
+
+For example, a stub of **MyEntity** (which was defined above in **Subgraph 1**):
+
+**Subgraph 3 (stub):**
+
+```graphql
+extend type MyEntity @key(fields: "id") {
+  id: ID! @external
+}
+```
+
+##### What is a shared type?
+Types that are identical by name and structure and feature in more than one subgraph are shared types.
+
+##### Can I extend a shared type?
+Subgraphs are normalized before federation. This means you can extend a type if the resolution of the extension after normalization is exactly identical to the resolution of the type after normalization in other subgraphs.
+
+Unless the resolution of the extension in a single subgraph is exactly identical to all other subgraphs, extension is not possible.
+
+Here is a valid example where both subgraphs resolve to identical enums after normalization:
+
+**Subgraph 1:**
+
+```graphql
+enum Example {
+  A,
+  B
+}
+
+extend enum Example {
+  C  
+}
+```
+
+**Subgraph 2:**
+
+```graphql
+enum Example {
+  A,
+  B,
+  C
+}
+```
+
+Here, the enum named Example in **Subgraph 1** resolves to be identical to the enum named Example in **Subgraph 2**.
+
+However, if we were to include **Subgraph 3**, which does not feature the “C” value, the enum is no longer identical in all 3 subgraphs. Consequently, federation would fail.
+
+**Subgraph 3:**
+
+```graphql
+enum Example {
+  A,
+  B
+}
+```
+
+
+
+### Extension Orphans
+
+#### What is an extension orphan?
+
+An extension orphan is an unresolved extension of a type after federation has completed. This will cause federation to fail and produce an error.
+
+#### How could an extension orphan occur?
+
+You may extend a type within a subgraph where the base type (the original definition of that type) is in another subgraph. This means that it is only after the creation of the supergraph that it can be determined whether the extension was valid. If the extension was invalid or was otherwise unresolved, an “extension orphan” would remain in the supergraph.
+
+For example, the type named Person does not need to be defined in **Subgraph 1**, but it must be defined in exactly one subgraph (see **Shared Types**: extension of shared types is not possible, so extending a type that is defined in multiple subgraphs will produce an error).
+
+**Subgraph 1**
+
+```graphql
+extend type Person {
+  name: String!
+}
+```
+
+If the type named Person were not defined in exactly one subgraph, federation will fail and produce an error.
+
+
+
+## GraphQL WebSockets
+
+Tyk supports GraphQL via WebSockets using the protocols _graphql-transport-ws_ or _graphql-ws_ between client and Tyk Gateway.
+
+Before this feature can be used, WebSockets need to be enabled in the Tyk Gateway configuration. To enable it set [http_server_options.enable_websockets](/tyk-oss-gateway/configuration#http_server_options-enable_websockets) to `true` in your `tyk.conf` file.
+
+<Tabs>
+<Tab title="graphql-transport-ws">
+You can find the full documentation of the _graphql-transport-ws_ protocol itself [here](https://github.com/enisdenjo/graphql-ws/tree/master).
+
+In order to upgrade the HTTP connection for a GraphQL API to WebSockets by using the _graphql-transport-ws_ protocol, the request should contain following headers:
+
+```
+Connection: Upgrade
+Upgrade: websocket
+Sec-WebSocket-Key: <random key>
+Sec-WebSocket-Version: 13
+Sec-WebSocket-Protocol: graphql-transport-ws
+```
+
+**Messages**
+
+The connection needs to be initialised before sending Queries, Mutations, or Subscriptions via WebSockets:
+
+```
+{ "type": "connection_init" }
+```
+
+Always send unique IDs for different Queries, Mutations, or Subscriptions.
+
+For Queries and Mutations, the Tyk Gateway will respond with a `complete` message, including the GraphQL response inside the payload.
+
+```json
+{ "id": "1", "type": "complete" }
+```
+
+For Subscriptions, the Tyk Gateway will respond with a stream of `next` messages containing the GraphQL response inside the payload until the data stream ends with a `complete` message. It can happen infinitely if desired.
+
+
+<Note>
+Be aware of those behaviors:
+  - If no `connection_init` message is sent after 15 seconds after opening, then the connection will be closed.
+  - If a duplicated ID is used, the connection will be closed.
+  - If an invalid message type is sent, the connection will be closed.
+</Note>
+
+
+**Examples**
+
+**Sending queries**
+
+```
+{"id":"1","type":"subscribe","payload":{"query":"{ hello }"}}
+```
+
+**Sending mutations**
+
+```
+{"id":"2","type":"subscribe","payload":{"query":"mutation SavePing { savePing }"}}
+```
+
+**Starting and stopping Subscriptions**
+
+```
+{"id":"3","type":"subscribe","payload":{"query":"subscription { countdown(from:10) }" }}
+```
+```
+{"id":"3","type":"complete"}
+```
+</Tab>
+<Tab title="graphql-ws">
+In order to upgrade the HTTP connection for a GraphQL API to WebSockets by using the _graphql-ws_ protocol, the request should contain following headers:
+
+```
+Connection: Upgrade
+Upgrade: websocket
+Sec-WebSocket-Key: <random key>
+Sec-WebSocket-Version: 13
+Sec-WebSocket-Protocol: graphql-ws
+```
+
+**Messages**
+
+The connection needs to be initialised before sending Queries, Mutations, or Subscriptions via WebSockets:
+
+```
+{ "type": "connection_init" }
+```
+
+Always send unique IDs for different Queries, Mutations, or Subscriptions.
+
+For Queries and Mutations, the Tyk Gateway will respond with a `complete` message, including the GraphQL response inside the payload.
+
+For Subscriptions, the Tyk Gateway will respond with a stream of `data` messages containing the GraphQL response inside the payload until the data stream ends with a `complete` message. It can happen infinitely if desired.
+
+**Examples**
+
+**Sending queries**
+
+```
+{"id":"1","type":"start","payload":{"query":"{ hello }"}}
+```
+
+**Sending mutations**
+
+```
+{"id":"2","type":"start","payload":{"query":"mutation SavePing { savePing }"}}
+```
+
+**Starting and stopping Subscriptions**
+
+```
+{"id":"3","type":"start","payload":{"query":"subscription { countdown(from:10) }" }}
+```
+```
+{"id":"3","type":"stop"}
+```
+</Tab>
+</Tabs>
+
+### Upstream connections
+
+For setting up upstream connections (between Tyk Gateway and Upstream) please refer to the [GraphQL Subscriptions Key Concept](/api-management/graphql#graphql-subscriptions).
+
+
+## GraphQL Subscriptions
+
+Tyk **natively** supports also GraphQL subscriptions, so you can expose your full range of GQL operations using Tyk Gateway. Subscriptions support was added in `v4.0.0` in which *graphql-ws* protocol support was introduced. 
+
+With the release of Tyk `v4.3.0` the number of supported subscription protocols has been extended.
+
+In Tyk subscriptions are using the [WebSocket transport](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API) for connections between the client and Gateway. For connections between Gateway and upstream WebSockets or [SSE](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events) can be used.
+
+### Supported transports and protocols
+
+| Transport  | Protocol                                                                                                                 |
+| :------------ | :-------------------------------------------------------------------------------------------------------------------------- |
+| WebSockets | [graphql-ws](http://github.com/apollographql/subscriptions-transport-ws) (default, no longer maintained)                 |
+| WebSockets | [graphql-transport-ws](http://github.com/enisdenjo/graphql-ws)                                                           |
+| HTTP       | [Server-Sent Events (SSE)](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events) |
+
+#### Setting up subscription types via API definition
+Subscription types or subscription transports/protocols are set inside the graphql section of the API definition.
+
+Depending on whether you want to configure GraphQL proxy-only, UDG, or GraphQL Federation there are different places for the configuration option.
+
+The values for subscription types are the same on all API types:
+- `graphql-ws`
+- `graphql-transport-ws`
+- `sse` (Server-Sent Events)
+
+##### HTTP method for Server-Sent Event subscription
+
+When using `subscription_type=sse`, Tyk will use the HTTP `GET` method to subscribe to the upstream service. For some use cases, for example, to support larger subscription payloads or to increase security by keeping the subscription payload out of server logs, the upstream requires HTTP `POST`. In Tyk 5.9.0, we have added `POST` support for SSE with the introduction of the boolean `use_sse_post` option, which is only relevant if `subscription_type=sse`.
+
+```json
+{
+  "graphql": {
+    "proxy": {
+      "subscription_type": "sse",
+      "sse_use_post": true
+    }
+  }
+}
+```
+
+If you need to use HTTP `GET` then you can omit `sse_use_post` or set it to `false`.
+
+
+##### GraphQL Proxy
+
+```
+{
+  ...,
+  "graphql": {
+    ...,
+    "proxy": {
+      ...,
+      "subscription_type": "graphql-ws"
+    }
+  }
+}
+```
+
+##### Universal Data Graph
+
+<Note>
+In UDG, the `subscription_type` setting only applies to data sources of kind **GraphQL**. It is not supported for REST kind data sources. REST data sources can only resolve Query and Mutation operations. If your upstream exposes subscriptions via SSE, you must configure it as a GraphQL data source.
+</Note>
+
+```
+{
+  ...,
+  "graphql": {
+    ...,
+    "engine": {
+      ...,
+      "data_sources": [
+        ...,
+        {
+          "kind": "GraphQL",
+          ...,
+          "subscription_type": "sse"
+        }
+      ]
+    }
+  }
+}
+```
+
+**Example: Configuring an SSE subscription with a GraphQL data source in UDG**
+
+The following example shows a complete data source configuration for a GraphQL upstream that uses SSE for subscriptions. The data source is of kind `GraphQL` and the `subscription_type` is set to `sse`:
+
+```json
+{
+  "graphql": {
+    "engine": {
+      "data_sources": [
+        {
+          "kind": "GraphQL",
+          "name": "my-graphql-sse-upstream",
+          "internal": false,
+          "root_fields": [
+            {
+              "type": "Subscription",
+              "fields": ["onMessage"]
+            }
+          ],
+          "config": {
+            "url": "https://my-graphql-upstream.example.com/graphql",
+            "method": "POST",
+            "headers": {}
+          },
+          "subscription_type": "sse"
+        }
+      ]
+    }
+  }
+}
+```
+
+In this configuration:
+- `kind` must be `"GraphQL"` — SSE subscriptions are not available for REST data sources.
+- `root_fields` maps the `Subscription` type and its fields to this data source.
+- `subscription_type` is set to `"sse"` to use Server-Sent Events for the upstream connection.
+- Use `"graphql-ws"` or `"graphql-transport-ws"` instead of `"sse"` if your upstream uses WebSockets.
+
+##### Federation
+
+```
+{
+  ...,
+  "graphql": {
+    ...,
+    "supergraph": {
+      ...,
+      "subgraphs": [
+        ...,
+        {
+          ...,
+          "subscription_type": "graphql-transport-ws"
+        }
+      ]
+    }
+  }
+}
+```
+
+
+<Note>
+If the upstream subscription GraphQL API is protected please enable the authentication via query params to pass the header through.
+</Note>
+
+
+There is no need to enable subscriptions separately. They are supported alongside GraphQL as a standard. The only requirement for subscriptions to work is to [enable WebSockets](/api-management/graphql#graphql-websockets) in your Tyk Gateway configuration file.
+
+Here's a general sequence diagram showing how subscriptions in Tyk work exactly:
+
+<img src="/img/dashboard/graphql/tyk-subscriptions-workflow.png" alt="Tyk Subscriptions workflow" />
+
+## GraphQL playground
+
+When you are creating or editing your GraphQL API, any change you make can be tested using Tyk Dashboard built-in GraphiQL Playground.
+
+<img src="/img/dashboard/graphql/gql-playground-new.png" alt="Playground" />
+
+At the top of the Playground itself, you can switch between Dark and Light theme using the `Set theme` dropdown.
+
+There's also a built in `Explorer` to help with query building and a `Prettify` button that helps to make the typed out operation easier to read.
+
+The GraphiQL try-out playground comes with a series of features by default, which can be very useful while configuring the API:
+  1.  Syntax highlighting.
+  2.  Intelligent type ahead of fields, arguments, types, and more.
+  3.  Real-time error highlighting and reporting for queries and variables.
+  4.  Automatic query and variables completion.
+  5.  Automatically adds required fields to queries.
+  6.  Documentation explorer, search, with markdown support.
+  7.  Query History using local storage
+  8.  Run and inspect query results using any promise that resolves JSON results. 9.  HTTPS or WSS not required.
+  10. Supports full GraphQL Language Specification: Queries, Mutations, Subscriptions, Fragments, Unions, directives, multiple operations per query, etc
+
+### GraphQL Playgrounds in Tyk
+
+Tyk offers you two types of Playgrounds, depending on who should be authorized to use them.
+
+* **Playground** tab in `API Designer`, that's only accessible via Tyk Dashboard and is always enabled. You need to log into the Tyk Dashboard to be able to use it.
+* **Public Playground** that you can enable for any GraphQL API and that is accessible for any consumer interacting with your GQL API. This playground will follow all security rules you set for your GQL API - authentication, authorization, etc.
+
+
+
+    <Note>
+    The Public Playground relies on assets in the `playground` folder under [template_path](/tyk-oss-gateway/configuration#template_path) (default: `/opt/tyk-gateway/templates`).
+    If you change this path, be sure to copy the `playground` folder to the new location to preserve functionality.
+    </Note>
+
+
+#### Enabling Public GraphQL Playground
+
+<Tabs>
+<Tab title="Tyk Dashboard">
+
+To enable a Public GraphQL Playground for one of your GQL APIs follow these few simple steps:
+
+1. Navigate to `Core Settings` tab in `API designer`
+2. Change the setting in `Enable API Playground` section.
+3. Provide `Playground path`. By default, this path is set to `/playground` but you can change it.
+
+<img src="/img/dashboard/graphql/enable-playground.png" alt="Headers" />
+
+Your `Public Playground` will be available at `http://{API-URL}/playground`.
+
+</Tab>
+<Tab title="Tyk API definition">
+
+To enable Public GraphQL Playground using just Tyk API definition, you need to set the following:
+
+```bash
+...
+"graphql": {
+    "playground": {
+      "enabled": true,
+      "path": "/playground"
+    }
+  }
+...
+```
+
+You can choose yourself the `path` name.
+
+Your `Public Playground` will be available at `http://{API-URL}/playground`.
+
+</Tab>
+</Tabs>
+
+#### Query variables
+
+You can pass query variables in two different ways, both are fully supported in Tyk Dashboard.
+
+##### Using inline arguments in GraphiQL Playground
+
+A query or mutation string in this case, would be written like in the example below and there would be no other requirements for executing an operation like this:
+
+```graphql
+mutation createUser {
+  createUser(input: {
+      username: "test", 
+      email: "test@test.cz", 
+      phone: "479332973", 
+      firstName: "David", 
+      lastName: "Test"
+      }) {
+    user {
+        id
+        username
+        email
+        phone
+        firstName
+        lastName
+    }
+  }
+}
+```
+
+##### Using query variables in GraphiQL Playground
+
+For complex sets of variables, you might want to split the above example into two parts: GQL operation and variables. 
+
+The operation itself would change to:
+
+```graphql
+mutation createUser($input: CreateUserInput!) {
+  createUser(input: $input) {
+    user {
+      id
+      username
+      email
+      phone
+      firstName
+      lastName
+    }
+  }
+}
+```
+
+The values for variables would need be provided in the `Query variables` section of the Playground like this:
+
+```graphql
+{
+  "input": {
+    "username": "test",
+    "email": "test@test.cz",
+    "phone": "479332973",
+    "firstName": "David",
+    "lastName": "Test"
+  }
+}
+```
+
+#### Headers
+
+Debugging a GraphQL API might require additional headers to be passed to the requests while playing with the GraphiQL interface (i.e. `Authorization` header in case of Authentication Token protection over the API). This can be done using the dedicated headers tab in the Graphiql IDE.
+
+<img src="/img/dashboard/udg/getting-started/headers.png" alt="Headers" />
+
+You can also [forward headers](/api-management/graphql#graphql-apis-headers) from your client request to the upstream data sources.
+
+
+#### Logs
+
+
+<Note>
+GraphQL request logs described below are **only available in Tyk Dashboard**.
+</Note>
+
+
+Besides the results displayed in the GraphiQL playground, Tyk also provides you with a full list of logs of the triggered request, which can help a lot when debugging the API functionality.
+
+<img src="/img/dashboard/udg/getting-started/logs.png" alt="Logs" />
+  
+The Request Logs can be seen under the playground itself. When no logs are present, there will be no option to expand the logs, and the filter buttons (top right) will be disabled:
+
+<img src="/img/dashboard/udg/getting-started/logs_bar.png" alt="Logs Bar" />
+
+After creating and sending a query, the logs will automatically expand, and the filter buttons will display the number of logs for its respective level (category).
+
+<img src="/img/dashboard/udg/getting-started/logs_table.png" alt="Logs table" />
+
+##### Contents of the logs
+
+There are four levels (categories) of logs: `Info`, `Debug`, `Warning`, and `Error`, and each log belongs to one of these levels. 
+
+The first column of the table displays the color-coded `“level”` property of the log. A log should never be absent of a level. The second column displays the log `“msg”` (message) property, if any. The third column displays the `“mw” `(middleware) property, if any.
+
+##### Expansion/collapse of Request Logs
+
+The Request Logs can be expanded or collapsed, using the chevron on the left side to toggle these states.
+
+##### Filter buttons and states
+
+Filter buttons have two states: active and inactive; the default of which is active. A solid background color of the button indicates that a filter is active. 
+
+In the below picture, the `info` and `error` filters buttons are both active. If there are no logs for a particular level of log, the button will appear as a gray and disabled, as shown by the `Warning` filter button.
+
+<img src="/img/dashboard/udg/getting-started/logs_navigation.png" alt="Logs navigation" />
+
+Here's an example where there is at least one log, but all the filter buttons are in the inactive state. If the cursor (not shown) hovers over an inactive filter button, the button background will change to solid, and the tooltip will display `“Show”`. 
+
+If all filter buttons are inactive, a message asking whether the user would like to reset all filters will display. Clicking this text will activate all available filters.
+
+<img src="/img/dashboard/udg/getting-started/logs_empty.png" alt="Logs empty" />
+
+## Migrating to 3.2
+
+As of 3.2 GraphQL schema for Tyk API definitions (i.e `api_definition.graphql`) changed significantly, hence GraphQL API definitions created in previous beta versions are not supported via the UI and need to go through a manual migration.
+
+
+<Note>
+Before you continue, we strongly advise to simply create a new API and avoid migration of the API definition. You'll achieve results faster and can avoid typos and errors that happens with the manual migration.
+</Note>
+
+
+
+<Note>
+Old API definitions will continue to work for the Tyk Gateway
+</Note>
+
+
+
+### The changes
+- To improve performance now a single Data Source can be used to link to multiple fields instead of having an independent data source for every field hence `graphql.type_field_configurations` is now obsolete and new data sources can be defined under `graphql.engine.data_sources` (see example below).
+
+- Data Source kind are `REST` or `GraphQL` regardless of your API being internal or not.
+
+- In case of internal APIs that are accessed via `tyk://`scheme, the `graphql.engine.data_sources[n].internal` property is set to true.
+
+- Each dataSources needs to be defined with a unique name `graphql.engine.data_sources[n].name`.
+
+- Each field connected to the data source is expected to be configured for mapping under `graphql.engine.field_configs` regardless of it requiring mapping or not.
+
+- It is important that all new GraphQL APIs have the version `graphql.version` property set to `2`.
+
+### Examples
+
+#### Old Data Source Config
+
+```json
+"type_field_configurations": [
+  {
+    "type_name": "Query",
+    "field_name": "pet",
+    "mapping": {
+      "disabled": true,
+      "path": ""
+    },
+    "data_source": {
+      "kind": "HTTPJSONDataSource",
+      "data_source_config": {
+        "url": "https://petstore.swagger.io/v2/pet/{{.arguments.id}}",
+        "method": "GET",
+        "body": "",
+        "headers": [],
+        "default_type_name": "Pet",
+        "status_code_type_name_mappings": [
+          {
+            "status_code": 200,
+            "type_name": ""
+          }
+        ]
+      }
+    }
+  },
+  {
+    "type_name": "Query",
+    "field_name": "countries",
+    "mapping": {
+      "disabled": false,
+      "path": "countries"
+    },
+    "data_source": {
+      "kind": "GraphQLDataSource",
+      "data_source_config": {
+        "url": "https://countries.trevorblades.com",
+        "method": "POST"
+      }
+    }
+  },
+]
+```
+
+#### New Data Source Config
+
+```json
+"engine": {
+  "field_configs": [
+    {
+      "type_name": "Query",
+      "field_name": "pet",
+      "disable_default_mapping": true,
+      "path": [
+        ""
+      ]
+    },
+    {
+      "type_name": "Query",
+      "field_name": "countries",
+      "disable_default_mapping": false,
+      "path": [
+        "countries"
+      ]
+    },
+  ],
+  "data_sources": [
+    {
+      "kind": "REST",
+      "name": "PetStore Data Source",
+      "internal": false,
+      "root_fields": [
+        {
+          "type": "Query",
+          "fields": [
+            "pet"
+          ]
+        }
+      ],
+      "config": {
+        "url": "https://petstore.swagger.io/v2/pet/{{.arguments.id}}",
+        "method": "GET",
+        "body": "",
+        "headers": {},
+      }
+    },
+    {
+      "kind": "GraphQL",
+      "name": "Countries Data Source",
+      "internal": false,
+      "root_fields": [
+        {
+          "type": "Query",
+          "fields": [
+            "countries"
+          ]
+        }
+      ],
+      "config": {
+        "url": "https://countries.trevorblades.com",
+        "method": "POST",
+        "body": ""
+      }
+    }
+  ]
+},
+```
+
+#### Example of new graphql definition
+
+``` json
+"graphql" : {
+  "schema": "type Mutation {\n  addPet(name: String, status: String): Pet\n}\n\ntype Pet {\n  id: Int\n  name: String\n  status: String\n}\n\ntype Query {\n  default: String\n}\n",
+  "enabled": true,
+  "engine": {
+    "field_configs": [
+      {
+        "type_name": "Mutation",
+        "field_name": "addPet",
+        "disable_default_mapping": true,
+        "path": [""]
+      },
+      {
+        "type_name": "Pet",
+        "field_name": "id",
+        "disable_default_mapping": true,
+        "path": [""]
+      },
+      {
+        "type_name": "Query",
+        "field_name": "default",
+        "disable_default_mapping": false,
+        "path": ["default"]
+      }
+    ],
+    "data_sources": [
+      {
+        "kind": "REST",
+        "name": "Petstore",
+        "internal": false,
+        "root_fields": [
+          {
+            "type": "Mutation",
+            "fields": ["addPet"]
+          }
+        ],
+        "config": {
+          "url": "https://petstore.swagger.io/v2/pet",
+          "method": "POST",
+          "body": "{\n  \"name\": \"{{ .arguments.name }}\",\n  \"status\": \"{{ .arguments.status }}\"\n}",
+          "headers": {
+            "qa": "{{ .request.header.qa }}",
+            "test": "data"
+          },
+        }
+      },
+      {
+        "kind": "REST",
+        "name": "Local Data Source",
+        "internal": false,
+        "root_fields": [
+          {
+            "type": "Pet",
+            "fields": ["id"]
+          }
+        ],
+        "config": {
+          "url": "http://localhost:90909/graphql",
+          "method": "HEAD",
+          "body": "",
+          "headers": {},
+        }
+      },
+      {
+        "kind": "GraphQL",
+        "name": "asd",
+        "internal": false,
+        "root_fields": [
+          {
+            "type": "Query",
+            "fields": ["default"]
+          }
+        ],
+        "config": {
+          "url": "http://localhost:8200/{{.arguments.id}}",
+          "method": "POST",
+        }
+      }
+    ]
+  },
+  "execution_mode": "executionEngine",
+  "version": "2",
+  "playground": {
+    "enabled": false,
+    "path": ""
+  },
+  "last_schema_update": "2021-02-16T15:05:27.454+05:30"
+}
+```
+
diff --git a/api-management/graphql/graphql-schema-types.mdx b/api-management/graphql/graphql-schema-types.mdx
new file mode 100644
index 0000000000..47489e40c7
--- /dev/null
+++ b/api-management/graphql/graphql-schema-types.mdx
@@ -0,0 +1,319 @@
+---
+title: "GraphQL Schema Types"
+description: "Understanding GraphQL schema types and how they work with Tyk"
+keywords: "GraphQL, Schema, Types, Custom Scalars"
+sidebarTitle: "Schema Types"
+---
+
+## Introduction
+
+When working with GraphQL APIs in Tyk, understanding the different schema types is important for proper API design and implementation. This page covers the standard types supported by Tyk, custom scalar types, and best practices for type definitions.
+
+## Standard GraphQL Types
+
+Tyk supports all standard GraphQL types as defined in the [GraphQL specification](https://spec.graphql.org/October2021/):
+
+### Scalar Types
+
+Scalar types are the fundamental building blocks of your schema, representing actual data values.
+
+- `Int`: 32-bit integer
+- `Float`: Double-precision floating-point value
+- `String`: UTF-8 character sequence
+- `Boolean`: `true` or `false`
+- `ID`: Unique identifier, serialized as a String
+
+### Object Types
+
+Object types define collections of fields and are the most common type in GraphQL schemas. They model complex entities and can include fields of any type, enabling rich, nested data structures.
+
+```graphql
+type User {
+  id: ID!
+  name: String!
+  age: Int
+  isActive: Boolean
+}
+```
+
+### Interface Types
+
+Interfaces are abstract types that define a set of fields that implementing object types must include.
+
+```graphql
+interface Node {
+  id: ID!
+}
+
+type User implements Node {
+  id: ID!
+  name: String!
+  email: String
+}
+
+type Product implements Node {
+  id: ID!
+  name: String!
+  price: Float!
+}
+```
+
+### Union Types
+
+Unions represent an object that could be one of several object types, but don't share common fields like interfaces.
+
+```graphql
+union SearchResult = User | Product | Article
+
+type Query {
+  search(term: String!): [SearchResult!]!
+}
+```
+
+When querying a union, you need to use inline fragments:
+
+```graphql
+{
+  search(term: "example") {
+    ... on User { id name }
+    ... on Product { id price }
+    ... on Article { title content }
+  }
+}
+```
+
+### Input Types
+
+Input types are special object types used specifically for arguments. They make complex operations more manageable by grouping related arguments, particularly useful for mutations.
+
+```graphql
+input UserInput {
+  name: String!
+  age: Int
+  email: String!
+}
+```
+
+### Enum Types
+
+Enums restrict fields to specific allowed values, improving type safety and self-documentation in your API.
+
+```graphql
+enum UserRole {
+  ADMIN
+  EDITOR
+  VIEWER
+}
+```
+
+### List and Non-Null Types
+GraphQL provides two type modifiers:
+
+- Non-Null (`!`): Indicates that the value cannot be null
+- List (`[]`): Indicates that the value is an array of the specified type
+
+These modifiers can be combined:
+
+```graphql
+type Collection {
+  requiredItemsRequired: [Item!]!  # Non-null list of non-null items
+  optionalItemsRequired: [String!]  # Nullable list of non-null items
+  requiredItemsOptional: [String]!  # Non-null list of nullable items
+  optionalItemsOptional: [String]   # Nullable list of nullable items
+  nestedRequiredItemsRequired: [[String!]!]!   # nested non-nullable list in non-nullable list with non-null items
+}
+```
+
+## Custom Scalar Types
+
+### Implementation in Tyk
+Tyk supports custom scalar types through the underlying GraphQL engine. While Tyk passes custom scalar values through its system, the actual validation, parsing, and serialization of these values should be implemented in your upstream service.
+
+### Using the @specifiedBy Directive
+The `@specifiedBy` directive allows you to provide a URL to the specification for a custom scalar type:
+
+```graphql
+scalar DateTime @specifiedBy(url: "https://tools.ietf.org/html/rfc3339")
+scalar UUID @specifiedBy(url: "https://tools.ietf.org/html/rfc4122")
+```
+
+### Common Custom Scalar Types
+
+#### JSON Scalar
+
+The JSON scalar handles arbitrary JSON data, useful for dynamic structures without defining every possible field.
+
+```graphql
+scalar JSON
+
+type Configuration {
+  settings: JSON
+}
+```
+
+#### Long/BigInt
+```graphql
+scalar Long
+
+type Transaction {
+  amount: Long
+  timestamp: Long
+}
+```
+
+
+<Note>
+**Note:**
+
+According to the [GraphQL spec](https://spec.graphql.org/), `Long/BigInt` values must be serialized as **strings** (IEEE standard). Some libraries incorrectly serialize them as numbers, which can lead to compatibility issues.
+
+Tyk’s GraphQL engine expects `Long` values to be serialized as strings to ensure interoperability.
+</Note>
+
+
+**Example:**
+
+```json
+{
+  "amount": "9223372036854775807",
+  "timestamp": "1690991344000"
+}
+```
+
+#### DateTime
+```graphql
+scalar DateTime
+
+type Event {
+  startTime: DateTime
+  endTime: DateTime
+}
+```
+
+## GraphQL Federation Types
+
+Tyk supports [GraphQL Federation v1](/api-management/graphql#graphql-federation) for building unified APIs across multiple services.
+
+### Entity Types with @key
+
+The @key directive is fundamental to federation. It identifies fields that can be used to uniquely identify entities across services:
+
+```graphql
+# In the Users service
+type User @key(fields: "id") {
+  id: ID!
+  name: String!
+  email: String!
+}
+
+# In the Orders service
+type User @key(fields: "id") {
+  id: ID!
+  orders: [Order!]!
+}
+```
+
+In this example:
+- The `User` type is defined in both services
+- The `@key` directive specifies that `id` is the field that uniquely identifies a User
+- The Users service owns the core User fields (id, name, email)
+- The Orders service extends User to add the orders field
+
+When a client queries for a User with their orders, Tyk's federation engine knows how to fetch the core User data from the Users service and the orders data from the Orders service, then combine them into a single response.
+
+### Extended Types with @external
+
+The `@external` directive explicitly indicates that a type extends an entity defined in another service:
+
+```graphql
+# In a service extending the User type
+extend type User @key(fields: "id") {
+  id: ID! @external
+  reviews: [Review!]!
+}
+```
+
+In this example:
+- The `extend` keyword and `@external` directive indicate this is extending the User type
+- The `@external` directive on the `id` field indicates this field is defined in another service
+- This service adds the `reviews` field to the User type
+
+## Best Practices
+
+### Type Definition Best Practices
+
+1. **Use Non-Nullable Fields Wisely**
+   Consider future API evolution when deciding which fields should be non-nullable.
+
+2. **Consistent Naming Conventions**
+   Use PascalCase for type names, camelCase for field names, and ALL_CAPS for enum values.
+
+3. **Input Type Naming**
+   Name input types clearly to indicate their purpose (e.g., CreateUserInput, UpdateUserInput).
+
+4. **Scalar Type Usage**
+   Choose appropriate scalar types based on semantic meaning, not just data format.
+
+5. **Interface and Union Usage**
+   Use interfaces for shared fields and unions for different types that might be returned from the same field.
+
+### Limitations and Considerations
+
+1. **Custom Scalar Validation**
+   Ensure your upstream service properly validates custom scalar values.
+
+2. **Schema Evolution**
+   Start with nullable fields when unsure about requirements and use deprecation before removing fields.
+
+3. **Performance Considerations**
+   Limit nesting depth in types and consider pagination for list fields.
+
+## Type System Example
+
+```graphql
+# Custom scalars
+scalar DateTime @specifiedBy(url: "https://tools.ietf.org/html/rfc3339")
+scalar JSON
+
+# Interfaces
+interface Node {
+  id: ID!
+}
+
+# Enums
+enum Status {
+  ACTIVE
+  PENDING
+  INACTIVE
+}
+
+# Input types
+input ProductInput {
+  name: String!
+  description: String
+  price: Float!
+  metadata: JSON
+}
+
+# Object types
+type Product implements Node {
+  id: ID!
+  name: String!
+  description: String
+  price: Float!
+  status: Status!
+  createdAt: DateTime!
+  metadata: JSON
+}
+
+# Query and Mutation types
+type Query {
+  getProduct(id: ID!): Product
+  listProducts(status: Status): [Product!]!
+}
+
+type Mutation {
+  createProduct(input: ProductInput!): Product!
+  updateProduct(id: ID!, input: ProductInput!): Product!
+}
+```
\ No newline at end of file
diff --git a/api-management/implement-tls.mdx b/api-management/implement-tls.mdx
new file mode 100644
index 0000000000..a18bcf6c2a
--- /dev/null
+++ b/api-management/implement-tls.mdx
@@ -0,0 +1,731 @@
+---
+title: "Implementing TLS with Tyk"
+description: "Secure access to APIs and Tyk components"
+keywords: "Authentication, Tyk Authentication, Mutual TLS, mTLS, Client mTLS"
+sidebarTitle: "Implement TLS"
+---
+
+## Introduction
+
+Transport Layer Security (TLS) and Mutual TLS (mTLS) can be used to secure access to Tyk components and to the hosted APIs that provide access to your upstream services. Tyk can also connect securely to those upstream services using TLS and mTLS.
+
+For more details on security protocols and public key cryptography, see our [TLS and Certificates](/api-management/certificates) guide.
+
+## Tyk Gateway as a TLS Server (Inbound Connections)
+
+This section covers scenarios in which the Tyk Gateway terminates TLS connections from an external client. The Gateway has two distinct interfaces where it acts as a server:
+
+1.  *Control API Interface*: The [Tyk Gateway API](/tyk-gateway-api) used for managing the Gateway (adding APIs, hot reloads, etc.)
+2.  *Hosted API Interface*: The public-facing interface where API clients connect to access your APIs
+
+### Basic Server Configuration
+
+Configure TLS for these interfaces in the Gateway config file (tyk.conf) or environment variables:
+
+```json
+{
+  "http_server_options": {
+    "use_ssl": true,
+    "server_name": "api.example.com"
+  },
+  "listen_port": 443
+}
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `use_ssl` | Enables the use of TLS for the Gateway server; if set to true then client requests to the control and hosted APIs must use HTTPS |
+| `server_name` | (optional) If provided this will be used to identify the Gateway for SNI (Server Name Indication) in the TLS handshake |
+| `listen_port` | Set the port on which Tyk will listen; typically set to 443 for HTTPS |
+
+Optionally, expose the Control API on a separate hostname from Hosted APIs. This is required to [secure the Control API with mTLS](/api-management/implement-tls#secure-the-gateway-control-api-with-mtls). See the [Planning For Production](/planning-for-production#change-your-control-port) guide for details.
+
+#### Configure Server Certificates
+
+In the TLS handshake, Tyk Gateway proves its identity using its private key and certificate, known as the server certificate pair.
+
+Server certificate pairs are registered in the Gateway config file (`tyk.conf`) or equivalent environment variable:
+
+```json
+{
+  "http_server_options": {
+    "ssl_certificates": ["server-cert-id", "/path/to/server-cert.pem"]
+  }
+}
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `ssl_certificates` | An array of server certificate pairs, each specified as a [certificate reference](/api-management/certificates#certificate-management) |
+
+During the TLS handshake, Tyk Gateway inspects the hostname sent in the Server Name Indication (SNI) extension of the client request. It then searches its list of registered server certificates to find one with a matching Subject Alternative Name (SAN). The search prioritises certificates assigned to specific [API custom domains](/api-management/implement-tls#configure-server-certificates-for-api-custom-domains) before checking globally configured certificates. If a matching certificate pair is found, it is presented to the client. If no specific match is found, the Gateway will use the first certificate loaded from its configuration as the default to complete the handshake.
+
+<Note>
+  The referenced server certificate pairs are used to verify Tyk's identity in the TLS handshake and so must contain both the certificate (public key) and private key.
+</Note>
+
+#### Configure Server Certificates for API Custom Domains
+
+APIs hosted on Tyk can be exposed on individual hostnames (custom domains), for which separate server certificate pairs can be registered.
+
+Tyk Gateway must first be configured to allow the use of custom domains in the Gateway config file (`tyk.conf`) or equivalent environment variables:
+
+```json
+{
+  "enable_custom_domains": true
+}
+```
+| Parameter | Description |
+| --------- | ----------- |
+| `enable_custom_domains | Allow the use of custom domains for Hosted APIs |
+
+Within the API definition, the custom domain is configured in the Tyk Vendor Extension:
+
+```yaml
+  server:
+    customDomain:
+      enabled: true
+      name: api.example.com
+      certificates:
+        - /path/to/server-certificate-pair.pem
+        - server-cert-pair-id
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `enabled` | Set to `true` to use a dedicated domain for this API |
+| `name`    | The domain name for which Tyk should provide server certificates |
+| `certificates` | The server certificate pairs to associate with the API, each specified as a [certificate reference](/api-management/certificates#certificate-management) |
+
+Note: If you are using Tyk Classic APIs, the equivalent configuration fields are `domain_disabled`, `domain`, and `certificate_pairs[]` in the root of the API definition.
+
+### Secure the Gateway Control API with mTLS
+
+With [TLS enabled](/api-management/implement-tls#basic-server-configuration) for the Gateway you can enforce mutual TLS for requests to the **Control API** if it is [exposed on a different hostname](/planning-for-production#change-your-control-port) by setting the following options in the Gateway config file (`tyk.conf`) or equivalent environment variables:
+
+```json
+{
+  "security": {
+    "control_api_use_mutual_tls": true,
+    "certificates": {
+      "control_api": ["/path/to/ca-cert.pem", "control-api-cert-id"]
+    }
+  },
+  "control_api_hostname": "gw-control.example.com",
+  "control_api_port": 443
+}
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `security.control_api_use_mutual_tls` | Require clients (e.g. Tyk Dashboard) to present a valid certificate when connecting to the Gateway API |
+| `security.certificates.control_api` | An array of CA certificates, each specified as a [certificate reference](/api-management/certificates#certificate-management) |
+| `control_api_hostname` | The hostname to which you want to bind the Control API |
+| `control_api_port` | The HTTP port to which you want to bind the Control API |
+
+<Note>
+  The referenced certificates are used to verify the client's identity in the mTLS handshake and so will typically be the CA certificates that can be used to validate the client certificate.
+</Note>
+
+### Secure Hosted APIs with mTLS
+
+Tyk takes a very flexible approach to mutual TLS for securing access to hosted APIs.
+
+With [TLS enabled](/api-management/implement-tls#basic-server-configuration) for the Gateway you can selectively enforce mTLS per API.
+
+For each API, you can determine a list of one or more *allowed* client certificates. Once the mTLS handshake completes, Tyk will check the client's certificate against the allow list for that API. The request will be authorized only if the client certificate matches.
+
+For complete flexibility, Tyk offers two different types of allow list:
+
+- a static list stored in the API definition (historically referred to by Tyk as static mTLS)
+- a dynamic list in the Redis/temporal storage (historically referred to by Tyk as dynamic mTLS)
+
+Either approach can be combined with any authentication method or used alone to secure the API.
+
+<Note>
+  Tyk must be the server that terminates the TLS request from the client. If a load balancer sits between the client and Tyk and terminates TLS then the client certificate won't be presented to Tyk for verification.
+  
+  In this scenario, neither of Tyk's static nor dynamic allow lists can be used to secure your APIs. You can, of course, secure the connection between clients and your load balancer using mTLS but this is outside the scope of Tyk.
+</Note>
+
+#### Using a static client certificate allow list
+
+The 
+Mutual TLS with a static allow list will be enforced for requests to an API if the Tyk Vendor Extension contains the following configuration:
+
+```yaml
+  server:
+    clientCertificates:
+      enabled: true
+      allowlist:
+        - client-cert-id1
+        - client-cert-id2
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `clientCertificates.enabled`   | Set this to true to enable mTLS with a static allow list |
+| `clientCertificates.allowlist` | A list of [certificate references](/api-management/certificates#certificate-management) for the client certificates that are authorized to access the API |
+
+<Note>
+  If using Tyk Classic, the fields are `use_mutual_tls_auth` and `client_certificates`.
+</Note>
+
+You can upload an issuing certificate (e.g., a CA certificate) to the Tyk Certificate Store and include it in the static allow list. Tyk will then validate client certificates signed by that authority.
+
+From Tyk 5.12.0, we added support for [Certificate-Token Binding](/api-management/authentication/bearer-token#client-certificate-token-binding) when using the Auth Token (also known as Bearer Token) method for authentication. This adds an additional layer of security on top of the static mTLS list by linking one or more client certificates on the list to the Authentication Token. This prevents an Auth Token from being used with certificates belonging to a different API client.
+
+#### Using a dynamic client certificate allow list
+
+Tyk's powerful dynamic client certificate allow list provides an alternative to declaring the allow list in the API definition. This is a separate authentication method historically called Dynamic mTLS but, from Tyk 5.12, referred to as [Certificate Auth](/api-management/authentication/certificate-auth). Changes were implemented with the introduction of Certificate Auth to address some [limitations](/api-management/implement-tls#legacy-dynamic-mtls-mode) in Dynamic mTLS.
+
+The allow list is described as *dynamic* because it is stored in Redis rather than the API definition. The entries in the list can thus be managed without making any changes to the API definition, no need to reload the Gateway to make changes, unlike the static allow list described [above](/api-management/implement-tls#using-a-static-client-certificate-allow-list).
+
+When a request is made to an API secured with mTLS and a dynamic allow list, the client certificate in the request is used to locate a matching session in Redis. If a match is found, the request is authorized.
+
+<Note>
+  From Tyk 5.12, this is called Certificate Authentication. Please see the [dedicated section](/api-management/authentication/certificate-auth) for more details.
+</Note>
+
+Prior to Tyk 5.12, Dynamic mTLS will be enforced for requests to an API if the Tyk Vendor Extension contains the following configuration:
+
+```yaml
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        authToken:
+          enabled: true
+          enableClientCertificate: true
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `authToken.enableClientCertificate` | Set this to true to enable mTLS with a dynamic allow list (prior to Tyk 5.12) |
+
+<Note>
+  The `enableClientCertificate` field will still work in Tyk 5.12 but will be deprecated in a future release. Users are encouraged to adopt Certificate Authentication.
+
+  If using Tyk Classic, the equivalent field is `auth_configs.authToken.useCertificate`.
+</Note>
+
+**Adding a certificate to the dynamic allow list**
+
+The dynamic allow list comprises session objects in the Gateway temporal storage (typically Redis) linked to the authorized client certificates.
+
+The certificates must first be registered with the Tyk Certificate Store and then a session (key) created with a link to the allocated certificate ID.
+
+For full details, see the [Certificate Auth](/api-management/authentication/certificate-auth#registering-certificate-authentication-user-credentials) section.
+
+#### Legacy Dynamic mTLS mode
+
+Prior to Tyk 5.12, this method was called Dynamic mTLS and permitted authentication using either the client certificate or an Auth Token matching the Redis key for the session state object. If the token was presented, then Tyk treated the certificate as optional and did not enforce the mutual TLS handshake.
+
+A key concept of the [mTLS handshake](/api-management/certificates#mutual-tls-mtls--two-way-authentication) is that it ensures that the client has possession of the private key. Possession of the certificate (i.e., the public key) does not confirm the client's identity (since this is by its nature public information).
+
+With the Dynamic API, the token can be constructed if you have knowledge of the certificate ID/hash and Organization ID - so possession of the token does not guarantee possession of the private key and hence is not equivalent to completion of the mTLS handshake (which requires possession of the private key).
+
+From Tyk 5.12, the option to authenticate using only the token has been placed behind a Gateway configuration option [`allow_unsafe_dynamic_mtls_token`](/tyk-oss-gateway/configuration#security-allow_unsafe_dynamic_mtls_token). If this is not set (the default behavior), then requests presenting just the token will be rejected; the certificate must be presented and the mTLS handshake is enforced.
+
+The legacy behavior is maintained for existing Tyk users who require this method for testing, but it is strongly discouraged; hence, the default setting is to restrict authentication to the certificate only.
+
+<Note>
+  In Tyk 5.12, the option to use only the token to authenticate has been placed behind the Gateway configuration option `allow_unsafe_dynamic_mtls_token`.
+</Note>
+
+### Advanced Server-Side TLS Settings
+
+#### Controlling TLS Version and Cipher Suites
+
+The Transport Layer Security specification has evolved through multiple versions, the most recent being TLS 1.3 which is the fastest and most secure. TLS 1.0 and 1.1 have been deprecated due to vulnerabilities and should no longer be used; Tyk has not supported these since Tyk 5.6.
+
+Whilst TLS 1.3 is often recommended, some legacy systems continue to use TLS 1.2, so Tyk has full support including the specification of allowed ciphers. When using TLS 1.3 the standard only allows secure ciphers and these are automatically negotiated during the handshake.
+
+You can configure Tyk Gateway with a minimum and maximum TLS version, and select the cipher suites to be used with TLS 1.2 using the `http_server_options` configuration:
+
+```json
+{
+  "http_server_options": {
+    "min_version": 771,  // TLS 1.2
+    "max_version": 772,  // TLS 1.3
+    "ssl_ciphers": ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"]
+  }
+}
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `min_version` and `max_version` | Can be configured with the values 771 (representing TLS 1.2) or 772 (representing TLS 1.3) |
+| `ssl_ciphers` | Indicates the allowed cipher suites when the request uses TLS 1.2 and is used to restrict the use of unsafe ciphers; the options are taken from the [Go TLS package](https://pkg.go.dev/crypto/tls#pkg-constants) documentation |
+
+<Note>
+  Tyk uses Golang libraries to provide TLS functionality, so the range of supported TLS versions depends on the underlying library. Support for TLS 1.0 and 1.1 was removed in Go 1.22 (which was adopted in Tyk 5.3.6/5.6.0), so these are no longer supported by Tyk.
+
+  The default minimum and maximum TLS versions are inherited from the Golang library and thus are presently 1.2 and 1.3 respectively.
+
+  Prior to Tyk 5.8.14/5.13.0 the default for the maximum TLS version was set to 1.2.
+</Note>
+
+#### Supporting HTTP/2
+
+Tyk supports the use of [HTTP/2](https://datatracker.ietf.org/doc/html/rfc9113) for hosted APIs with compatible clients by configuring:
+
+```json
+{
+  "http_server_options": {
+    "enable_http2": true
+  }
+}
+```
+
+#### Skipping Client CA Announcement
+
+When using mTLS, the server (Tyk Gateway) announces to the client which Certificate Authorities it trusts, so the client can ensure it presents a certificate signed by a mutually trusted authority. If there are many Certificate Authorities, this can add overhead to the mTLS handshake. Tyk provides an opportunity to skip the announcement (which is an optional step in the handshake) by configuring:
+
+```json
+"http_server_options": {
+  "skip_client_ca_announcement": true
+}
+```
+
+
+## Tyk Gateway as a TLS Client (Outbound Connections)
+
+This section covers scenarios where the Tyk Gateway is initiating a TLS connection to another service, such as an upstream service, the Tyk Dashboard, or other external services like Redis.
+
+### Integrating with Dashboard
+
+If TLS is in use for the Dashboard's [Control API](/api-management/implement-tls#using-tls-with-tyk-dashboard), i.e., the Dashboard is the TLS server, then the Gateway will need to verify the server certificate presented by the Dashboard (unless configured to [skip verification](/api-management/implement-tls#skipping-server-certificate-verification) of the server certificate).
+
+The following must be configured in the Gateway (via `tyk.conf` or the equivalent environment variable):
+
+```json
+{
+  "security": {
+    "certificates": {
+      "dashboard_api": ["/path/to/ca-cert.pem"]
+    }
+  }
+}
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `certificates.dashboard_api` | An array of path references to CA certificates (PEM format) |
+
+### Connecting Securely to Upstream Services
+
+When communicating with upstream services, Tyk acts as the TLS client and must therefore hold both the client certificate and the private key. When mTLS is implemented with the upstream service, the Gateway will verify the upstream's identity by examining the server certificate it presents.
+
+- CA certificates can be directly registered with the Tyk Certificate Store
+- Client certificates with a private key can be registered as a pair with the Tyk Certificate Store
+    - The client certificate must be concatenated with the private key before being PEM encoded
+
+As usual with Tyk, some configuration is performed at the Gateway level and will be applied to all hosted APIs, whereas more granular configuration can be set in the API definition and applied to the specific API.
+
+<Note>
+  The minimum and maximum TLS versions are both set to TLS 1.2 by default, unless set otherwise in the Gateway or API configuration.
+</Note>
+
+#### Common Gateway-level Configuration
+
+The following common settings for upstream TLS connections are set in the Gateway config (tyk.conf or the equivalent environment variables):
+
+| Parameter | Description |
+| --------- | ----------- |
+| `proxy_enable_http2`    | Use HTTP/2 for upstream connections |
+| `proxy_ssl_insecure_skip_verify` | Do not verify server certificates presented by the upstream; not recommended for production environments   |
+| `proxy_ssl_min_version` | Minimum TLS version allowed |
+| `proxy_ssl_max_version` | Maximum TLS version allowed |
+| `proxy_ssl_ciphers`     | Allowed cipher suites (TLS 1.2 only) |
+| `proxy_ssl_disable_renegotiation` | Prevent [TLS renegotiation](/api-management/implement-tls#tls-1-2-renegotiation-behavior) (TLS 1.2 only) |
+| `security.pinned_public_keys` | Specify an allow list of server certificates that will be accepted; if the upstream server presents a certificate that isn't on the list then the TLS handshake will fail; see [server certificate pinning](/api-management/upstream-authentication/mtls#certificate-pinning) |
+| `security.certificate.upstream` | Map of upstream domains to [certificate references](/api-management/certificates#certificate-management) for mTLS client authentication |
+| `ssl_force_common_name_check` | Validate that the upstream hostname matches the Common Name (CN) in the server certificate ([legacy support](/api-management/implement-tls#common-name-cn-check)) |
+
+#### API-Specific Configuration
+
+Granular configuration of the TLS connection is controlled via the [`upstream.tlsTransport`](/api-management/gateway-config-tyk-oas#tlstransport) object in the Tyk Vendor Extension:
+
+```yaml
+  upstream:
+    tlsTransport:
+      insecureSkipVerify: true
+      minVersion: 1.2
+      maxVersion: 1.3
+      ciphers:
+        - TLS_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+      forceCommonNameCheck: true
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `insecureSkipVerify` | Disables verification of the upstream server's certificate chain; not recommended for production environments |
+| `minVersion` | Sets the minimum TLS version allowed (default: 1.2) |
+| `maxVersion` | Sets the maximum TLS version allowed (default: 1.2) |
+| `ciphers` | Allowed cipher suites (optional, only for TLS 1.2) |
+| `forceCommonNameCheck` | Validate that the upstream hostname matches the Common Name (CN) in the server certificate ([legacy support](/api-management/implement-tls#common-name-cn-check)) |
+
+Full details for configuring certificates for mTLS with upstream services are in the dedicated [upstream mTLS](/api-management/upstream-authentication/mtls) section.
+
+#### Routing Through a Forward Proxy
+
+The "custom proxy" feature in Tyk lets you configure the Gateway to route requests to your upstream services via a forward proxy (also known as an HTTP proxy). This is often required in enterprise environments where outbound traffic must pass through a centralized proxy for security, logging, or policy enforcement.
+
+When you define an API in Tyk, you specify a *Target URL* for your upstream service. By default, the Tyk Gateway connects directly to this URL. The custom proxy feature allows you to insert an intermediary proxy for this connection.
+
+The configuration is handled within the [`upstream.proxy`](/api-management/gateway-config-tyk-oas#proxy) object of the Tyk Vendor Extension (`proxy` in the Tyk Classic API definition):
+
+```yaml
+  upstream:
+    proxy:
+      enabled: true
+      url: https://{USER}:{PASSWORD}@my-proxy.com:8080
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `enabled` | Set to `true` to activate the proxy redirect |
+| `url`     | The URL of the forward proxy to which Tyk should direct upstream requests |
+
+<Note>
+  If you are using a secure proxy with an `https://` URL, Tyk will apply the TLS configuration for the target upstream, using the host operating system's standard root CA store to validate the proxy's server certificate. Tyk does not support mTLS connections to the forward proxy; only to the upstream target beyond the proxy.
+</Note>
+
+### Connecting Securely to Other External Services
+
+Tyk Gateway can be integrated with various external services that support proxying hosted APIs, for example, Identity Providers (for authentication), webhook targets (for event handling), and storage (for example, to Redis).
+
+Tyk's [External Services Configuration guide](/configure/external-service) provides the details required to secure these connections using mTLS.
+
+### Advanced Client-Side TLS Settings
+
+#### Common Name (CN) Check
+
+Use of a server Common Name (CN) was deprecated by RFC 2818 in May 2000 in favor of Subject Alternative Names (SANs). Since Go 1.17, the standard library no longer validates hostnames against the CN field.
+
+When Tyk acts as a TLS client connecting to upstream services, it can perform a manual CN check to support:
+
+- Legacy systems that still rely on Common Name
+- Internal certificates with CN but incomplete or missing SANs
+
+**Configuration**
+
+The CN check can be implemented for all hosted APIs in the Gateway config file (`tyk.conf`) or equivalent environment variable:
+
+```json
+{
+  "SSLForceCommonNameCheck": true
+}
+```
+
+Or more granularly in the Tyk Vendor Extension in the API definition:
+
+```yaml
+  upstream:
+    tlsTransport:
+      forceCommonNameCheck: true
+```
+
+If using Tyk Classic, the equivalent field is `proxy.transport.ssl_force_common_name_check`.  
+
+**Behavior**
+
+When the CN check is enabled, Tyk performs manual hostname verification against the certificate's Common Name field:
+
+- Direct connections: Tyk bypasses standard Go TLS verification and manually validates that the CN matches the upstream hostname
+- [Proxy connections](/api-management/implement-tls#routing-through-a-forward-proxy): Tyk performs standard certificate chain verification then additionally validates the CN
+
+Security Note: This feature behaves as if `proxy.ssl_insecure_skip_verify=true` during the handshake to bypass Go's standard verification, then performs custom validation. Use only when necessary for legacy systems.
+
+**Recommendation**
+
+For modern integrations, ensure upstream certificates include proper SANs and avoid relying on CN validation.
+
+#### TLS 1.2 Renegotiation Behavior
+
+Prior to TLS 1.3, after completing the TLS handshake, either party (client or server) could request to renegotiate the session parameters (such as keys or ciphers). This introduced a potential security vulnerability, such as man-in-the-middle prefix injection attacks (e.g., CVE-2009-3555).
+
+The `proxy.ssl_disable_renegotiation` option in the Gateway configuration mitigates this risk. Setting it to `true` disallows renegotiation once the TLS connection has been established, which is the most secure configuration.
+
+By default, this option is `false`, which permits the Gateway (acting as a client) to initiate a renegotiation. This is for backward compatibility with legacy upstream services that may require it. However, even in this default mode, the Gateway will reject renegotiation requests initiated by the upstream server.
+
+This setting is only relevant to TLS 1.2 connections, as renegotiation is not supported in TLS 1.3.
+
+#### Skipping Server Certificate Verification
+
+In trusted environments, such as development environments, it is often easier to use self-signed certificates for expediency. During the TLS handshake, the client will be unable to verify the server's certificate, and the connection will be rejected.
+
+When acting as the client in the TLS handshake (for example, when connecting to Tyk Dashboard), Tyk Gateway can skip the verification of the server certificate if you configure:
+
+```json
+{
+  "http_server_options": {
+    "ssl_insecure_skip_verify": true
+  }
+}
+```
+
+When set to `true` this:
+
+- Disables verification of the server's certificate chain
+- Skips hostname validation against the certificate's Subject Alternative Names (SANs)
+- Accepts any certificate presented by the server, regardless of its validity or trust status
+
+<Note>
+  It is important to note that this skips TLS security and so is not recommended for production environments. This setting does not affect Tyk's behaviour when interacting with your upstream API servers - there is a separate configuration for that, as explained [here](/api-management/implement-tls#connecting-securely-to-upstream-services).
+</Note>
+
+## Using TLS with Tyk Dashboard
+
+### TLS Server Configuration
+
+The Tyk Dashboard can be configured to use HTTPS for its Control API using the `http_server_options` section in its configuration file (`tyk_analytics.conf`) or equivalent environment variables. This is similar to the section of the same name in the Gateway config, allowing configuration of TLS certificates (generic and for specific domains using SNI), the minimum TLS version, the cipher suites to be used (for TLS 1.2), and the option to skip certificate verification (recommended only for non-production deployments).
+
+Note however that, unlike the Gateway, the Dashboard **does not** support configuring a maximum TLS version. It relies on Go's default behavior, which automatically supports up to the highest available TLS version (currently TLS 1.3).
+
+<Note>
+  The Dashboard does not have access to the Tyk Certificate Store when configuring its own interfaces, so certificates and keys must be available on the filesystem and referenced by path.
+</Note>
+
+```json
+{
+  "http_server_options": {
+    "use_ssl": true,
+    "certificates": [
+      {
+        "domain_name": "dashboard.example.com",
+        "cert_file": "/path/to/server-cert.cert",
+        "key_file": "/path/to/server-cert.key"
+      }
+    ],
+    "ssl_certificates": ["/path/to/server-certificate-pair.pem"],
+    "min_version": 771,  // TLS 1.2
+    "ssl_ciphers": ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"],
+    "ssl_insecure_skip_verify": false
+  },
+  "host_config": {
+    "generate_secure_paths": true
+  }
+}
+```
+
+| Parameter | Description |
+| --------- | ----------- |
+| `use_ssl` | Enables HTTPS for the Dashboard web interface |
+| `certificates` | Domain-mapped server certificate pairs used for domain-specific configuration when using SNI |
+| `ssl_certificates` | Array of paths to PEM-encoded server certificate pairs. Each file must contain both the certificate and its private key in a single PEM file. Unlike `certificates[]`, these certificates cannot be mapped to specific domains. |
+| `min_version` | Minimum TLS version (771 = TLS 1.2, 772 = TLS 1.3) |
+| `ssl_ciphers` | List of allowed cipher suites (only applicable to TLS 1.2 handshakes) |
+| `ssl_insecure_skip_verify` | If `true`, the Dashboard's web server will not verify the certificates presented by connecting clients. This is insecure and not recommended for production environments. |
+| `host_config.generate_secure_paths` | Set this to `true` so that Dashboard URLs will start with `HTTPS` |
+
+<Note>
+  If both `certificates[]` and `ssl_certificates[]` are provided, all certificates from both configurations will be loaded, with domain-specific certificates from `certificates[]` taking precedence for their specified domains.
+</Note>
+
+You must set the [host_config.generate_secure_paths](/tyk-dashboard/configuration#host_config-generate_secure_paths) flag to `true` so that your Dashboard URL starts with HTTPS. This will also set the default protocol for Target URLs to `https://` when creating APIs in the Dashboard's API Designer if no protocol is explicitly set.
+
+### Integrating with Tyk Gateway
+
+For management communications with a Tyk Gateway (such as reloading APIs, managing keys, and updating configurations), where the Gateway is the TLS server, the Dashboard uses a dedicated internal client. This client is hardcoded to always skip TLS certificate verification. This behavior is not configurable and is intended to simplify setup in environments where the Gateway may use self-signed certificates.
+
+You do not need to configure anything for the Dashboard to skip TLS verification when communicating with a Gateway for management tasks; this is the default and the only behavior.
+
+### Using mTLS between Dashboard and storage
+
+#### Integrating with Redis
+
+To enable mTLS for the connection between Dashboard and Redis, add the following settings to your `tyk_analytics.conf` file:
+
+```json
+{
+  "redis_use_ssl": true,
+  "redis_ca_file": "/path/to/ca.cert",
+  "redis_cert_file": "/path/to/client.cert",
+  "redis_key_file": "/path/to/client.key"
+}
+```
+
+| Parameter | Description |
+|-----------|-------------|
+| `redis_use_ssl` | Set to true to enable TLS for Redis connections |
+| `redis_cert_file` | Path to the client certificate file that Tyk Dashboard will present to Redis |
+| `redis_key_file` | Path to the client private key file corresponding to the certificate |
+| `redis_ca_file` | Path to the Certificate Authority (CA) certificate file the Dashboard should use to verify the Redis server's certificate |
+| `redis_tls_min_version` | Minimum TLS version to use. Options are "1.2" or "1.3". Defaults to "1.2" |
+| `redis_tls_max_version` | Maximum TLS version to use. Options are "1.2" or "1.3". Defaults to "1.2" |
+| `redis_ssl_insecure_skip_verify` | Set to `true` to skip verification of the Redis server's certificate; not recommended for production environments |
+
+**Important Notes**
+
+- **Certificate Format**: The cert and key files should be in PEM format
+- **File Permissions**: Ensure the Dashboard process has read access to the certificate and key files
+- **Redis Server Configuration**: Your Redis server must be configured to require client certificates for mTLS to work
+- **Gateway Sync**: Ensure your Tyk Gateway is also configured with the same [Redis mTLS settings](/configure/external-service#service-specific-configuration)
+
+For more details on configuring Tyk Dashboard with Redis, see the [Database Management](/planning-for-production/database-settings) guide.
+
+
+#### Integrating with MongoDB
+
+To enable mTLS for the connection between Dashboard and MongoDB persistent storage, add the following settings to your `tyk_analytics.conf` file:
+
+```json
+{
+  "storage": {
+    "main": {
+      "type": "mongo",
+      "connection_string": "mongodb://your-mongo-host:27017/tyk_analytics",
+      "mongo": {
+        "ssl": {
+          "enabled": true,
+          "ca_file": "/path/to/ca-cert.pem",
+          "key_file": "/path/to/client-cert-and-key.pem",
+          "insecure_skip_verify": false,
+          "allow_invalid_hostnames": false,
+        },
+        "driver": "mongo-go"
+      }
+    }
+  }
+}
+```
+
+| Parameter | Description |
+|-----------|-------------|
+| `type` | Set to `mongo` |
+| `connection_string` | URL of the MongoDB instance |
+| `ssl.enabled` | Set to `true` to enforce mTLS |
+| `ssl.ca_file` | Path to the Certificate Authority (CA) certificate file the Dashboard should use to verify the MongoDB server's certificate |
+| `ssl.key_file` | Path to file containing both the server certificate and private key for Dashboard |
+| `ssl.ssl_insecure_skip_verify` | Set to `true` to skip verification of the MongoDB server's certificate; not recommended for production environments |
+| `ssl.allow_invalid_hostnames` | Set to `true` to skip validation of the MongoDB server hostname |
+| `driver` | Choose the [MongoDB driver](/tyk-dashboard/configuration#mongo_driver) to be used, typically `mongo-go` |
+
+**Important Notes**
+
+- **Certificate Format**: The ca and key files should be in PEM format
+- **File Permissions**: Ensure the Dashboard process has read access to the certificate and key files
+- **Redis Server Configuration**: Your MongoDB server must be configured to require client certificates for mTLS to work
+
+For more details on using Tyk Dashboard with MongoDB, see the [Database Management](/planning-for-production/database-settings) guide.
+
+
+#### Integrating with PostgreSQL
+
+PostgreSQL uses connection string parameters for TLS configuration. To enable mTLS for the connection between Dashboard and PostgreSQL persistent storage, add the following settings to your `tyk_analytics.conf` file:
+
+```json
+{
+  "storage": {
+    "main": {
+      "type": "postgres",
+      "connection_string": "host=your-postgres-host port=5432 dbname=tyk_analytics user={USERNAME} password={PASSWORD} sslmode=verify-full sslrootcert=/path/to/ca-cert.pem sslcert=/path/to/client-cert.pem sslkey=/path/to/client-key.pem"
+    }
+  }
+}
+```
+
+| Parameter | Description |
+|-----------|-------------|
+| `type` | Set to `postgres` |
+| `connection_string` | PostgreSQL connection string |
+
+
+| TLS Connection String Parameters | Description |
+|------------------------------|-------------|
+| `sslmode` | Set to `verify-full` for full certificate validation (recommended for production) |
+| `sslrootcert` | Path to the CA certificate file |
+| `sslcert` | Path to the client certificate file |
+| `sslkey` | Path to the client private key file |
+
+Alternative values for `sslmode`:
+
+- `require`: Encrypts the connection but doesn't verify the server certificate
+- `verify-ca`: Verifies server certificate against CA
+- `verify-full`: Verifies server certificate and hostname (most secure)
+
+For more details on using Tyk Dashboard with PostgreSQL, see the [Database Management](/planning-for-production/database-settings) guide.
+
+## Using TLS with MDCB
+
+In a distributed deployment, MDCB is the server and the Data Plane Gateways are the clients. If you want to secure this connection using TLS you must configure both components.
+
+### Configuring MDCB
+
+MDCB has two separate servers that can be configured individually in the `tyk-sink.conf` file or environment variables:
+
+- `server_options`: the main RPC (Remote Procedure Call) server is the primary endpoint that Tyk Gateways connect to in order to synchronize API definitions, policies, and security keys.
+- `http_server_options`: the HTTP control API server used for administrative, monitoring, and debugging purposes.
+
+Each server has a similar configuration to Dashboard, with settings described in the [reference documentation](/tyk-multi-data-centre/mdcb-configuration-options).
+
+Note that you must set `security.private_certificate_encoding_secret` in the MDCB configuration file to the same value as specified in your Control Plane Gateway and Dashboard configuration files, to ensure that MDCB can [decode private keys](/api-management/certificates#encryption-of-the-private-key) that have been added to the Tyk Certificate Store.
+
+<Note>
+  MDCB does not have access to the Tyk Certificate Store when configuring its own interfaces, so certificates and keys must be available on the filesystem and referenced by path.
+</Note>
+
+### Configuring Data Plane Gateways
+
+The following must be configured in the Data Plane Gateways (via `tyk.conf` or environment variables) to set up TLS for the connection to MDCB's RPC server:
+
+```json
+{
+  "slave_options": {
+    "use_ssl": true,
+    "ssl_insecure_skip_verify": false
+  },
+  "security": {
+    "certificates": {
+      "mdcb_api": [
+        "cert-id-from-store",
+        "/path/to/client-cert.pem"
+      ]
+    }
+  }
+}
+```
+
+| Parameter | Description |
+|-----------|-------------|
+| `slave_options.use_ssl` | Instructs the Gateway to use TLS in the connection to MDCB |
+| `slave_options.ssl_insecure_skip_verify` | Skips the verification of the server certificate presented by MDCB; not recommended for production environments |
+| `security.certificates.mdcb_api` | A list of client certificate-key pairs, each specified as a [certificate reference](/api-management/certificates#certificate-management) |
+
+The MDCB's server certificate will be verified against the CA certificates in the Gateway host's standard root CA store. This is not separately configurable.
+
+During the mTLS handshake, the server (MDCB) will advertise the Certificate Authorities it will use to verify the client certificate. The client (Data Plane Gateway) will present the first valid certificate in the `certificates.mdcb_api` list that matches one of these CAs. Multiple certificates allow rotation scenarios with overlapping validity periods.
+
+
+## Frequently Asked Questions
+
+<AccordionGroup>
+
+<Accordion title='How to create a self-signed certificate pair'>
+You can create self-signed client and server certificates with this command:
+
+```
+openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
+```
+</Accordion>
+
+<Accordion title='How to calculate the certificate fingerprint'>
+To get the certificate SHA256 fingerprint, use the following command:
+
+```
+openssl x509 -noout -fingerprint -sha256 -inform pem -in <cert>
+```
+</Accordion>
+
+<Accordion title='How to make a request using cURL'>
+If you are testing using cURL, your request to an mTLS secured API will look like:
+
+```
+curl --cert client_cert.pem --key client_key.pem https://localhost:8181
+```
+</Accordion>
+
+</AccordionGroup> 
diff --git a/api-management/logs-metrics.mdx b/api-management/logs-metrics.mdx
new file mode 100644
index 0000000000..1dfc51eec4
--- /dev/null
+++ b/api-management/logs-metrics.mdx
@@ -0,0 +1,205 @@
+---
+title: "Metrics Configuration in Tyk Gateway"
+description: "Learn how to configure Tyk Gateway to export metrics using OpenTelemetry Protocol (OTLP) and legacy approaches."
+keywords: "Metrics, OpenTelemetry, OTLP, New Relic, StatsD, API Observability, Monitoring, Prometheus, Grafana, Datadog"
+sidebarTitle: "Overview"
+---
+
+## Introduction
+
+Metrics provide aggregated, quantitative data about the performance and behavior of your APIs over time. They offer insights into the overall health of the system.
+
+Tyk supports several ways to export metrics, from different components:
+
+| Method | Component | Status | Description |
+|--------|-----------|--------|-------------|
+| [OpenTelemetry Metrics](#opentelemetry-metrics) | Tyk Gateway | **Recommended** | Native OTLP metrics export. Works with any OpenTelemetry-compatible backend. |
+| [Metrics Pumps](#metrics-pumps) | Tyk Pump | Legacy | Prometheus, StatsD, or DogStatsD metrics derived from traffic logs. Relevant for existing deployments. |
+| [New Relic Instrumentation](#new-relic-instrumentation) | Tyk Gateway | [Deprecated](/developer-support/deprecation#understanding-deprecation-and-end-of-life-eol) | Legacy New Relic agent integration available since Gateway v2.5. |
+| [StatsD Instrumentation](#statsd-instrumentation) | Tyk Gateway, Pump, Dashboard | [Deprecated](/developer-support/deprecation#understanding-deprecation-and-end-of-life-eol) | Legacy StatsD protocol export for Gateway, Pump, and Dashboard. |
+
+## OpenTelemetry Metrics
+
+### Availability
+
+| Component | Version | Edition |
+| :-------- | :------ | :------- |
+| Tyk Gateway | Available since [v5.13.0](/developer-support/release-notes/gateway#5-13-0-release-notes) | Community & Enterprise |
+
+### Tyk Gateway Metrics
+
+Tyk Gateway natively exports metrics via the OpenTelemetry Protocol (OTLP), the recommended way to collect Gateway metrics. When enabled, the Gateway pushes standard RED metrics (Rate, Errors, Duration) plus Go runtime and configuration state metrics to any OTLP-compatible backend. Some backends accept this natively; others need an OpenTelemetry Collector in between, see [Supported Backends](#supported-backends) below.
+
+For a complete reference, see:
+
+- [Default Metrics](/api-management/metrics/default-metrics): all metrics exported automatically (RED, Go runtime, configuration state)
+- [Custom Metrics](/api-management/metrics/custom-metrics): defining custom counters and histograms with your own dimensions
+
+### Supported Backends
+
+The metrics exporter sends data using standard OTLP, so any OTLP-compatible backend works. Some common setups:
+
+**Via OTel Collector (recommended for self-managed):** Route metrics from the OTel Collector to Prometheus, Grafana Mimir, Splunk, or other backends. The Collector also handles batching, retries, and fanout to multiple destinations.
+
+**Direct OTLP:** Send directly to backends that natively accept OTLP, such as:
+
+- New Relic (`otlp.nr-data.net:4317`)
+- Dynatrace (via the Dynatrace OTLP endpoint)
+- Grafana Cloud Mimir
+
+Standalone Prometheus doesn't accept OTLP by default: use the OTel Collector path above, unless you're running Prometheus v3.0+ with its native OTLP receiver explicitly enabled.
+
+## Configuration Options
+
+Metrics can be enabled independently; distributed tracing does not need to be configured. To configure distributed tracing alongside metrics, see [Distributed Tracing](/api-management/traces).
+
+### Enable Metrics
+
+If you only need metrics export, configure the `metrics` sub-object directly:
+
+```json
+{
+  "opentelemetry": {
+    "metrics": {
+      "enabled": true,
+      "endpoint": "otel-collector:4317"
+    }
+  }
+}
+```
+
+### Traces and metrics together
+
+When both are configured, `metrics.endpoint` defaults to the `traces.endpoint` value if not set explicitly:
+
+```json
+{
+  "opentelemetry": {
+    "traces": {
+      "enabled": true,
+      "endpoint": "otel-collector:4317"
+    },
+    "metrics": {
+      "enabled": true
+    }
+  }
+}
+```
+
+This is enough to start exporting [default Gateway metrics](/api-management/metrics/default-metrics) to the same OTLP endpoint configured for traces.
+
+### Reference
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| [opentelemetry.metrics.enabled](/tyk-oss-gateway/configuration#opentelemetry-metrics-enabled) | Enable OTLP metrics export | `false` |
+| [opentelemetry.metrics.exporter](/tyk-oss-gateway/configuration#opentelemetry-metrics-exporter) | Export protocol: `grpc` or `http` | `grpc` |
+| [opentelemetry.metrics.endpoint](/tyk-oss-gateway/configuration#opentelemetry-metrics-endpoint) | OTLP collector endpoint. Defaults to `opentelemetry.traces.endpoint` if not set | — |
+| [opentelemetry.metrics.connection_timeout](/tyk-oss-gateway/configuration#opentelemetry-metrics-connection_timeout) | Connection timeout in seconds | `1` |
+| [opentelemetry.metrics.headers](/tyk-oss-gateway/configuration#opentelemetry-metrics-headers) | Additional HTTP headers sent with each OTLP export request | — |
+| [opentelemetry.metrics.tls](/tyk-oss-gateway/configuration#opentelemetry-metrics-tls) | TLS configuration for the OTLP connection | — |
+| [opentelemetry.metrics.export_interval](/tyk-oss-gateway/configuration#opentelemetry-metrics-export_interval) | How often metrics are pushed to the backend, in seconds | `60` |
+| [opentelemetry.metrics.shutdown_timeout](/tyk-oss-gateway/configuration#opentelemetry-metrics-shutdown_timeout) | Maximum time allowed for a single export request, in seconds | `30` |
+| [opentelemetry.metrics.cardinality_limit](/tyk-oss-gateway/configuration#opentelemetry-metrics-cardinality_limit) | Maximum unique attribute combinations tracked per instrument. Set to `0` to disable | `2000` |
+| [opentelemetry.metrics.runtime_metrics](/tyk-oss-gateway/configuration#opentelemetry-metrics-runtime_metrics) | Export Go runtime metrics (memory, goroutines, GC). Set to `false` to disable | `true` |
+| [opentelemetry.metrics.api_metrics](/tyk-oss-gateway/configuration#opentelemetry-metrics-api_metrics) | Custom metric instrument definitions. See [Custom Metrics](/api-management/metrics/custom-metrics) | — |
+
+All fields are also documented in the [Tyk Gateway Configuration Reference](/tyk-oss-gateway/configuration#opentelemetry).
+
+<Note>
+Root-level configuration such as `opentelemetry.enabled` and `opentelemetry.endpoint` still work for traces but are deprecated. Use `opentelemetry.traces.*` for new deployments.
+</Note>
+
+### Cardinality Control
+
+Each unique combination of dimension values creates a separate time series in your metrics backend. For example, a metric with 100 APIs × 5 methods × 10 status codes = 5,000 time series. Adding dimensions that have many possible values (such as user IDs or free-text fields) can create millions of time series, causing high storage costs and potential out-of-memory crashes.
+
+The `opentelemetry.metrics.cardinality_limit` field caps how many unique attribute combinations are tracked per metric instrument:
+
+- **Default limit:** 2,000 combinations per instrument
+- **When the limit is reached:** New attribute combinations are aggregated into an overflow bucket marked with `otel.metric.overflow=true`
+- **Existing time series are not affected**; only new combinations are blocked
+- **To disable the limit:** Set to `0` (not recommended for production)
+
+You can alert on cardinality overflow using this PromQL expression:
+
+```promql
+increase(some_metric{otel_metric_overflow="true"}[5m]) > 0
+```
+
+This lets you catch runaway cardinality before costs escalate.
+
+## Tyk Cloud
+
+On Tyk Cloud, metrics export is enabled per environment via the **Telemetry** settings in the Tyk Cloud UI. A **Telemetry entitlement** is required; contact your account team if it is not available on your plan.
+
+**Supported export destinations on Tyk Cloud:**
+
+- New Relic
+- Elastic (Elasticsearch / OpenSearch)
+- Dynatrace
+- Custom OTLP endpoint (any OTLP-compatible backend)
+
+Tyk Cloud exports the [default gateway metrics](/api-management/metrics/default-metrics) through the telemetry pipeline. Custom metric configuration is not currently self-service on Tyk Cloud; contact Tyk support to request it.
+
+## Metrics Pumps
+
+[Tyk Pump](/api-management/tyk-pump) can expose metrics derived from the traffic logs that the Gateway stores in Redis, the same traffic logs used for [Dashboard Analytics](/api-management/dashboard-analytics). This is an older, separate mechanism: computed by Tyk Pump after the fact from traffic log records, not by Tyk Gateway in real time, so it can only produce traffic-derived counters and histograms (status codes, latency, and whatever traffic log fields you tag). It has no visibility into Gateway's own runtime health or configuration state.
+
+There are three Metrics Pumps, [documented here](/api-management/metrics/metrics-pumps), that target different backends:
+
+- Prometheus
+- DogStatsD (Datadog)
+- StatsD (not to be confused with the native Gateway [StatsD instrumentation](#statsd-instrumentation))
+
+Metrics Pumps aren't deprecated, and existing deployments can keep using them, but we recommend [OpenTelemetry Metrics](#opentelemetry-metrics) where you can: it's more powerful and flexible, and doesn't require the Redis and Tyk Pump hop to get metrics out.
+
+## Deprecated Backends
+
+### New Relic Instrumentation
+
+<Warning>
+This instrumentation method is deprecated. New Relic users should migrate to the [OpenTelemetry metrics exporter](/api-management/logs-metrics#opentelemetry-metrics) with a New Relic OTLP endpoint. The OTel approach provides richer metrics, more dimensions, and does not require a New Relic agent license.
+</Warning>
+
+Tyk Gateway has been instrumented for New Relic metrics since v2.5. Add the following to `tyk.conf` to enable it:
+
+```json
+{
+  "newrelic": {
+    "app_name": "<app-name>",
+    "license_key": "<license_key>"
+  }
+}
+```
+
+### StatsD Instrumentation
+
+<Warning>
+This instrumentation method is deprecated. We recommend using [OpenTelemetry metrics](/api-management/logs-metrics#opentelemetry-metrics) instead, which provides richer metrics and works with any modern observability backend.
+</Warning>
+
+Tyk Gateway, Pump, and Dashboard have been instrumented for [StatsD](https://github.com/etsy/statsd) monitoring. StatsD is a network daemon that listens for statistics sent over UDP or TCP and forwards aggregates to pluggable backend services.
+
+<Note>
+Not to be confused with Tyk Pump's `statsd`/`dogstatsd` [Metrics Pumps](#metrics-pumps) above: those export traffic-log-derived request metrics, a different mechanism from this internal system instrumentation.
+</Note>
+
+#### Configuring StatsD
+
+To enable StatsD instrumentation, set the environment variable `TYK_INSTRUMENTATION=1` and configure `statsd_connection_string` in each component's config file. This field specifies how to connect to the StatsD server (host, port, and optional configuration).
+
+You can also set `statsd_prefix` to a custom value to differentiate metrics between environments (for example, separate prefixes for production and staging).
+
+For Tyk Pump specifically, both fields sit at the top level of `pump.conf`, alongside `log_level` and the other [global settings](/api-management/tyk-pump#configuring-tyk-pump).
+
+#### StatsD Keys
+
+| Key | Description |
+|-----|-------------|
+| `gauges.<prefix>.Load.rps` | API traffic handled by Gateway (requests per second) |
+| `counters.<prefix>.SystemAPICall.called.count` | Gateway API call count |
+| `timers.<prefix>.SystemAPICall.success` | Gateway API response time |
+| `counters.<prefix>.SystemAPICall.SystemCallComplete.count` | Dashboard API request count |
+| `counters.<prefix>.DashSystemAPIError.*` | Dashboard API error reporting |
+| `counters.<prefix>.record.count` | Number of records processed by Pump |
diff --git a/api-management/logs.mdx b/api-management/logs.mdx
new file mode 100644
index 0000000000..dfd55e80f3
--- /dev/null
+++ b/api-management/logs.mdx
@@ -0,0 +1,185 @@
+---
+title: "Logs"
+description: "Learn about the different types of logs in Tyk, how to configure them and how to integrate with third-party log management tools for effective API observability."
+keywords: "Logs, Application Logs, System Logs, API Traffic, Access Logs, Traffic Logs, Datadog, Dynatrace, New Relic, Elastic Search, Jaeger, Monitoring, Observability"
+sidebarTitle: "Overview"
+---
+
+A log is a timestamped text record, either structured (recommended) or unstructured, with some metadata.
+
+## Types of Logs
+
+Tyk generates four types of logs:
+
+- **[Application Log](/api-management/logs/application-logs):** Internal system events such as health-checks, configuration changes, and errors.
+- **[API Traffic Log](/api-management/dashboard-analytics#where-the-data-comes-from):** <Badge color="orange">Gateway</Badge> A record of every API request, written into Redis and processed by Tyk Pump for analytics and reporting.
+- **[Access Log](/api-management/logs/access-logs):** <Badge color="orange">Gateway</Badge> Per-request server logs intended for external log aggregators. Similar to API Traffic Logs in that both record individual requests, but Access Logs are lightweight and real-time whereas API Traffic Logs are richer and processed asynchronously.
+- **[Audit Log](/api-management/logs/audit-logs):** <Badge color="blue">Dashboard</Badge> A record of user actions in Tyk Dashboard, such as API changes and login events.
+
+
+## Configuring Application and Access Logs
+
+Tyk Gateway, Tyk Pump, Tyk Dashboard, Tyk MDCB, and Tyk Developer Portal each write an **Application Log** to `stderr`, handled in a typical installation by the service manager running the process.
+
+Tyk Gateway's **Access Log** uses the same underlying logger, so every setting that applies to Tyk Gateway's Application Log also affects the Access Log.
+
+Three aspects can be configured:
+
+- **verbosity**: which severity levels are written
+- **format**: the structure and content of each entry
+- **log output**: where logs are sent, for example to a third-party aggregator
+
+Both verbosity and format can be controlled globally across all components, or per component for finer control. Global settings take priority over component-specific ones.
+
+### Global Settings
+
+Two environment variables apply across multiple components and override any component-specific setting:
+
+| Setting | Environment variable | Applies to |
+| :--- | :--- | :--- |
+| Verbosity | `TYK_LOGLEVEL` | All components except Tyk Developer Portal |
+| Format | `TYK_LOGFORMAT` | Tyk Gateway, Tyk Dashboard, Tyk Pump |
+
+### Component Settings
+
+When global variables are not set, each component can be configured individually using environment variables or the equivalent `log_level` and `log_format` settings in its configuration file.
+
+All components default to `info` verbosity and `text` format. Tyk Developer Portal is an exception: it defaults to `prod` format, which is equivalent to `json`.
+
+| Tyk component | Log level env var | Log format env var | Supported formats |
+| :--- | :--- | :--- | :--- |
+| [Tyk Gateway](/tyk-oss-gateway/configuration#log_level) | `TYK_GW_LOGLEVEL` | `TYK_GW_LOGFORMAT` | `text`, `json`, `legacy` |
+| [Tyk Pump](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#log_level) | `TYK_PMP_LOGLEVEL` | `TYK_PMP_LOGFORMAT` | `text`, `json`, `legacy` |
+| [Tyk Dashboard](/tyk-dashboard/configuration) | `TYK_DB_LOGLEVEL` (from `v5.14.0`) | `TYK_DB_LOGFORMAT` | `text`, `json` |
+| [Tyk MDCB](/tyk-multi-data-centre/mdcb-configuration-options#log_level) | `TYK_MDCB_LOGLEVEL` | N/A | Legacy text only |
+| [Tyk Developer Portal](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_log_level) | `PORTAL_LOG_LEVEL` | `PORTAL_LOG_FORMAT` | `text`, `json` |
+
+<Note>
+The `legacy` format was introduced in Tyk Gateway 5.14.0 and Tyk Pump 5.14.0 to maintain backward compatibility for existing users with log pipelines reliant on the precise log content. See [legacy format](/api-management/logs#legacy-format).
+</Note>
+
+### Severity and Verbosity
+
+The severity of a log is an indication of its likely importance to the system administrator. The system will generate logs at four different levels of severity:
+
+| Severity | Purpose | Example |
+|:---------|:--------|:--------|
+| Error | Conditions that require immediate attention, such as a component being unreachable or a request failing due to a system fault. | Failed to connect to Redis |
+| Warning | Potential issues or degraded behavior that may require investigation, but do not prevent the system from operating. | Configuration value out of bounds, using default |
+| Information | Normal operational events confirming the system is functioning as expected. This is the default level. | Gateway started, API loaded, access log entries |
+| Debug | Detailed diagnostic output useful for troubleshooting, such as middleware execution steps and request routing decisions. | Middleware execution details |
+
+Each component can individually be configured to output only the logs generated at or above a given severity level by setting the **log level** as follows:
+
+- `error`: only errors are logged
+- `warn`: warnings and errors are logged
+- `info`: errors, warnings, and informational messages are logged (default)
+- `debug`: all of the above, plus detailed diagnostic output
+
+<Note>
+Access Logs have `info` level severity. Setting Tyk Gateway's log level to `warn` or `error` therefore suppresses Access Log output. There are additional controls for the generation and content of access logs as described in [Access Logs](/api-management/logs/access-logs).
+</Note>
+
+<Warning>
+Debug log level generates a significant amount of data and is not recommended unless debugging.
+</Warning>
+
+### Format Options
+
+Log format controls the structure and timestamp style of application and access logs generated by a component. The supported values are `text` (default), `json` (recommended), and `legacy`.
+
+<Tip>
+As a general performance tip, the `json` output format incurs less memory allocation overhead than the `text` format. For optimal performance, it's recommended to configure logging in the JSON format.
+</Tip>
+
+<Tabs>
+<Tab title="Text Format">
+
+```
+time="2024-09-05T09:04:12Z" level=info message="Tyk API Gateway v5.14.0" prefix=main
+```
+
+</Tab>
+<Tab title="JSON Format">
+
+```json
+{"level":"info","message":"Tyk API Gateway v5.14.0","prefix":"main","time":"2024-09-05T09:04:12Z"}
+```
+
+</Tab>
+<Tab title="Legacy Format">
+
+Preserves the previous timestamp format and `msg` field key:
+
+```
+time="Sep 05 09:04:12" level=info msg="Tyk API Gateway v5.14.0" prefix=main
+```
+
+</Tab>
+</Tabs>
+
+#### Legacy Format
+
+From Tyk Gateway 5.14.0 and Tyk Pump 5.14.0, the `text` and `json` formats use RFC3339 timestamps and a standardized `message` field.
+
+If your log pipeline relies on the previous timestamp format (`Dec 12 13:50:45`) or the `msg` field key, set `log_format` to `legacy` to preserve the old behavior.
+
+### Log Output
+
+By default, application and access log output is written to `stderr`.
+
+Tyk Gateway and Dashboard can also forward logs to a third-party aggregator, in addition to `stderr`:
+
+| Data Sink | Gateway | Dashboard |
+| :--- | :---: | :---: |
+| Sentry | ✅ | ✅ |
+| Logstash | ✅ | ❌ |
+| Graylog | ✅ | ❌ |
+| Syslog | ✅ | ❌ |
+
+Add the relevant settings to `tyk.conf` for Tyk Gateway, or `tyk_analytics.conf` for Tyk Dashboard (or use the equivalent environment variables):
+
+<Tabs>
+<Tab title="Sentry">
+
+<Badge color="orange">Gateway</Badge> <Badge color="blue">Dashboard</Badge>
+
+- `use_sentry`: Set to `true` to enable output to [Sentry](https://sentry.io/product/logs/).
+- `sentry_code`: The Sentry-assigned DSN (endpoint URL) to which the logs are sent.
+
+</Tab>
+<Tab title="Logstash">
+
+<Badge color="orange">Gateway Only</Badge>
+
+- `use_logstash`: Set to `true` to enable output to [Logstash](https://www.elastic.co/logstash).
+- `logstash_transport`: Set this to `"tcp"`.
+- `logstash_network_addr`: The network address of the Logstash server, in the form `hostname:port`.
+
+</Tab>
+<Tab title="Graylog">
+
+<Badge color="orange">Gateway Only</Badge>
+
+- `use_graylog`: Set to `true` to enable output to [Graylog](https://graylog.org/).
+- `graylog_network_addr`: The network address of the Graylog server, in the form `hostname:port`.
+
+</Tab>
+<Tab title="Syslog">
+
+<Badge color="orange">Gateway Only</Badge>
+
+- `use_syslog`: Set to `true` to enable output to syslog.
+- `syslog_transport`: Set to `"udp"` to send to a remote syslog server, or leave empty to use the local Unix socket.
+- `syslog_network_addr`: The network address of the syslog server, in the form `hostname:port`.
+
+</Tab>
+</Tabs>
+
+## Configuring Traffic Logs
+
+Traffic Logs are generated by Tyk Gateway and written to Redis, not `stderr`, so none of the settings above apply to them. Enable them by setting [`enable_analytics`](/tyk-oss-gateway/configuration#enable_analytics) in the Gateway configuration; see [Dashboard Analytics](/api-management/dashboard-analytics) for how Tyk Pump then processes and routes them from Redis.
+
+## Configuring Audit Logs
+
+Audit Logs are generated by Tyk Dashboard and configured through its own `audit.*` settings block, unrelated to the Application Log settings above. See [Audit Logs](/api-management/logs/audit-logs) for the full configuration reference, or [Enable and View Audit Logs in Tyk Dashboard](/api-management/enable-audit-logs-dashboard) for a step-by-step guide.
diff --git a/api-management/logs/access-logs.mdx b/api-management/logs/access-logs.mdx
new file mode 100644
index 0000000000..22fa5fee40
--- /dev/null
+++ b/api-management/logs/access-logs.mdx
@@ -0,0 +1,439 @@
+---
+title: "Gateway Access Logs"
+description: "Learn how to configure Tyk Gateway to generate API access logs"
+keywords: "Logs, Logging, Tyk Gateway, Access Log, API Request"
+sidebarTitle: "Access Logs"
+---
+
+## Introduction
+
+An Access Log is a single log line written at `info` severity to `stderr` for every request Tyk Gateway handles, giving you a lightweight, real-time record of individual requests. This is a different mechanism from an [API Traffic Log](/api-management/logs/traffic-logs), which also records individual requests but is written to Redis and processed asynchronously by Tyk Pump, carrying richer detail as a result.
+
+Access Logs are generated by the same logger as Tyk Gateway's Application Log, so their severity, format, and third-party output are all controlled by the same shared settings:
+
+- **verbosity**: which severity levels are written (must be `info` or `debug` for Access Logs to be recorded at all)
+- **format**: the structure and timestamp style of each entry
+- **log output**: where logs are sent, for example to a third-party aggregator
+
+See [Configuring Application and Access Logs](/api-management/logs#configuring-application-and-access-logs) for details of these and how to configure them.
+
+Access Logs have two additional settings of their own, covered below: whether they're generated at all ([Enabling Access Logs](#enabling-access-logs)), and which fields they include ([Access Log Content](#access-log-content)).
+
+## Availability
+
+| Component | Version | Edition |
+| :-------- | :------ | :------- |
+| Tyk Gateway | Available since [v5.8.0](/developer-support/release-notes/gateway#5-8-0-release-notes) | Community & Enterprise |
+
+<Note>
+Access Logs are not available on Tyk Cloud.
+</Note>
+
+## Enabling Access Logs
+
+Access Logs are disabled by default. Set `access_logs.enabled` to `true` to turn them on:
+
+<Tabs>
+<Tab title="Configuration File">
+
+Configuration using `tyk.conf`:
+
+```json
+{
+    "access_logs": {
+        "enabled": true
+    }
+}
+```
+
+</Tab>
+<Tab title="Environment Variables">
+
+Configuration using environment variables:
+
+```
+TYK_GW_ACCESSLOGS_ENABLED=true
+```
+
+</Tab>
+</Tabs>
+
+## Access Log Content
+
+Each Access Log entry contains:
+
+- timestamp
+- the log severity (always `info`)
+- `prefix`, always set to `access-log`; this identifies the entry as an Access Log, since Application Log entries are written to the same output but use other `prefix` values.
+- a configurable list of key-value pairs giving details of the request (for example API ID or HTTP response status code)
+
+For example:
+```
+time="2025-01-29T08:27:09Z" level=info api_id=b1a41c9a89984ffd7bb7d4e3c6844ded api_key=00000000 api_name=httpbin api_type=oas client_ip="::1" host="localhost:8080" latency_gateway=1 latency_total=62 method=GET org_id=678e6771247d80fd2c435bf3 original_path=/get path=/get prefix=access-log protocol=HTTP/1.1 remote_addr="[::1]:63251" status=200 trace_id=4bf92f3577b34da6a3ce929d0e0e4736 upstream_addr="http://httpbin.org/get" upstream_latency=61 user_agent=PostmanRuntime/7.43.0
+```
+
+The keys that will be included in the logs are configured using an [access log template](#access-log-templates). If no template is configured, then all available fields will be included in each log entry. The `prefix` field is always included, whether or not a template is configured.
+
+The full list of available fields that can be included in an access log is [here](#access-log-field-reference).
+
+<Note>
+Field order is predictable, not arbitrary: `time` and `level` always come first, followed by every other field in alphabetical order.
+</Note>
+
+### Access Log Templates
+
+You can define an access log template to reduce the size of the access log by including only a subset of the available fields. This is a simple list of field names declared in the Tyk Gateway configuration as a `template` array within the `access_logs` object.
+
+For example:
+
+<Tabs>
+<Tab title="Configuration File">
+
+Configuration using `tyk.conf`
+
+```json
+{
+    "access_logs": {
+        "enabled": true,
+        "template": [
+            "api_key",
+            "remote_addr",
+            "upstream_addr"
+        ]
+    }
+}
+```
+</Tab>
+
+<Tab title="Environment Variables">
+
+Configuration using environment variables:
+
+```
+TYK_GW_ACCESSLOGS_ENABLED=true
+TYK_GW_ACCESSLOGS_TEMPLATE="api_key,remote_addr,upstream_addr"
+```
+</Tab>
+</Tabs>
+
+Output:
+
+```
+time="2025-01-29T08:27:48Z" level=info api_key=00000000 prefix=access-log remote_addr="[::1]:63270" upstream_addr="http://httpbin.org/get"
+```
+
+Only the three templated fields appear, plus `prefix`, which is always included regardless of the template.
+
+### MCP-Specific Fields
+
+When the log is generated for a request to an MCP Proxy, MCP-specific fields are added to the access log:
+
+- [`mcp_method`](#param-mcp-method)
+- [`mcp_primitive_type`](#param-mcp-primitive-type)
+- [`mcp_primitive_name`](#param-mcp-primitive-name)
+- [`mcp_error_code`](#param-mcp-error-code)
+
+These fields are omitted when empty, so non-MCP logs are unaffected.
+
+**Examples**
+
+<AccordionGroup>
+<Accordion title='MCP tools/call request (success)'>
+
+When an AI client calls a tool via an MCP Proxy:
+
+```
+time="2025-04-07T10:15:30Z" level=info api_id=mcp-weather-api api_name=weather-mcp api_type=mcp
+  latency_total=143 mcp_method=tools/call
+  mcp_primitive_name=get_current_weather mcp_primitive_type=tool
+  method=POST path=/mcp prefix=access-log status=200
+```
+
+Key fields:
+- `api_type=mcp` identifies this as an MCP Proxy request.
+- `mcp_method=tools/call` indicates the JSON-RPC method invoked.
+- `mcp_primitive_type=tool` and `mcp_primitive_name=get_current_weather` identify the specific tool that was called.
+
+</Accordion>
+<Accordion title='MCP tools/call request (error)'>
+
+When the upstream MCP server returns a JSON-RPC error:
+
+```
+time="2025-04-07T10:16:02Z" level=info api_id=mcp-weather-api api_name=weather-mcp api_type=mcp
+  latency_total=38 mcp_error_code=-32602 mcp_method=tools/call
+  mcp_primitive_name=get_forecast mcp_primitive_type=tool
+  method=POST path=/mcp prefix=access-log status=200
+```
+
+Note that JSON-RPC errors are typically returned with HTTP 200 (as per the JSON-RPC spec). The `mcp_error_code` field identifies the error, and `response_flag` will reflect the gateway classification.
+
+</Accordion>
+</AccordionGroup>
+
+### Access Log Field Reference
+
+<ParamField path="api_id">
+  ID of the requested API definition. Present whenever the request matched an API.
+</ParamField>
+
+<ParamField path="api_key">
+  Obfuscated or hashed API key used in the request.
+</ParamField>
+
+<ParamField path="api_name">
+  Name of the requested API definition. Present whenever the request matched an API.
+</ParamField>
+
+<ParamField path="api_type">
+  API type classification. One of `mcp`, `graphql`, `oas`, or `classic`. Always present.
+</ParamField>
+
+<ParamField path="circuit_breaker_state">
+  Circuit breaker state (for example, `OPEN`), only present on circuit breaker errors.
+</ParamField>
+
+<ParamField path="client_ip">
+  IP address of the client making the request.
+</ParamField>
+
+<ParamField path="error_source">
+  Gateway component that generated the error, only present on error requests.
+</ParamField>
+
+<ParamField path="error_target">
+  Upstream address being accessed, only present on upstream or proxy errors.
+</ParamField>
+
+<ParamField path="host">
+  Hostname of the request.
+</ParamField>
+
+<ParamField path="latency_gateway">
+  Time spent in Tyk Gateway's own processing, separate from the upstream round trip.
+</ParamField>
+
+<ParamField path="latency_total">
+  Total time taken to process the request, including upstream latency and additional gateway processing.
+</ParamField>
+
+<ParamField path="mcp_error_code">
+  JSON-RPC error code when the MCP request fails (for example, `-32001` for Authentication required, `-32002` for Access denied). Only present when an MCP error occurs.
+</ParamField>
+
+<ParamField path="mcp_method">
+  JSON-RPC method called on an MCP Proxy (for example, `tools/call`, `initialize`, `resources/read`). Only present on MCP Proxy requests.
+</ParamField>
+
+<ParamField path="mcp_primitive_name">
+  Name of the MCP tool, resource, or prompt that was invoked. Only present on MCP Proxy requests.
+</ParamField>
+
+<ParamField path="mcp_primitive_type">
+  MCP primitive type invoked: `tool`, `resource`, or `prompt`. Only present on MCP Proxy requests.
+</ParamField>
+
+<ParamField path="method">
+  HTTP method used in the request (for example, GET or POST).
+</ParamField>
+
+<ParamField path="org_id">
+  Organisation ID of the requested API definition. Present whenever the request matched an API.
+</ParamField>
+
+<ParamField path="original_path">
+  The client's request path, captured before Tyk Gateway applies any path-modifying middleware, such as stripping the API's listen path. Equal to `path` unless something changes the path during processing.
+</ParamField>
+
+<ParamField path="path">
+  URL path of the request.
+</ParamField>
+
+<ParamField path="protocol">
+  Protocol used in the request (for example, HTTP/1.1).
+</ParamField>
+
+<ParamField path="remote_addr">
+  Remote address of the client.
+</ParamField>
+
+<ParamField path="response_code_details">
+  Detailed error description in snake_case, only present on error requests.
+</ParamField>
+
+<ParamField path="response_flag">
+  Error classification code, only present on error requests. See [Error Classification](#error-classification).
+</ParamField>
+
+<ParamField path="status">
+  HTTP response status code.
+</ParamField>
+
+<ParamField path="tls_cert_expiry">
+  TLS certificate expiration date in RFC 3339 format, only present on TLS certificate errors.
+</ParamField>
+
+<ParamField path="tls_cert_subject">
+  TLS certificate subject (for example, `CN=api.example.com`), only present on TLS certificate errors.
+</ParamField>
+
+<ParamField path="trace_id">
+  The OpenTelemetry trace ID for the request (32-character hex W3C trace ID). Only present when OpenTelemetry is enabled and a trace ID is available. Use this to navigate from an access log entry to the corresponding trace in your observability backend.
+</ParamField>
+
+<ParamField path="upstream_addr">
+  Full upstream address, including scheme, host, and path.
+</ParamField>
+
+<ParamField path="upstream_latency">
+  Round-trip duration between the gateway sending the request to the upstream service and receiving the response.
+</ParamField>
+
+<ParamField path="upstream_status">
+  HTTP status code returned by the upstream, only present when the upstream responds with a 5XX status.
+</ParamField>
+
+<ParamField path="user_agent">
+  User agent string provided by the client.
+</ParamField>
+
+## Error Classification
+
+Access logs include a small set of additional fields when a request fails, so you can diagnose problems, such as TLS certificate expiry, connection refusal, or authentication errors, directly from the log without cross-referencing application or API Traffic Logs. Whether a given field appears depends on the specific error; each field's exact conditions are noted in [Access Log Field Reference](#access-log-field-reference) above. Two fields anchor this classification: `response_flag` and `error_source`.
+
+<Note>
+Error classification fields are omitted entirely, not set to an empty string or zero, when they don't apply. This keeps successful requests and errors that don't trigger a given field unchanged.
+</Note>
+
+### Response Flags
+
+A response flag is a short, fixed code, such as `UCF` or `AKI`, that classifies the specific error condition Tyk Gateway encountered while processing the request. `response_flag` values are shared with Tyk Gateway's [error response customization](/api-management/custom-error-responses) feature, which uses the same flags to match errors you want to override. See the [Flag Reference](/api-management/custom-error-responses#flag-reference) there for the full list, what each one means, and its typical HTTP status.
+
+### Error Source
+
+`error_source` identifies the Gateway component that generated the error, helping you locate where in the request pipeline the failure occurred. It's present alongside `response_flag` on every error entry.
+
+| error_source | Component | Typical flags |
+| :--- | :--- | :--- |
+| `ReverseProxy` | Upstream proxy and transport layer | `UCF`, `TLE`, `URT`, `DNS`, `CBO`, `NHU` |
+| `Upstream` | The upstream server itself (responded with error) | `URS` |
+| `AuthKey` | Auth Token middleware | `AMF`, `AKI`, `TKE` |
+| `Oauth2KeyExists` | OAuth2 middleware | `AMF`, `AKI`, `EAD` |
+| `JWTMiddleware` | JWT middleware | `AMF`, `TKI`, `TCV`, `TKE` |
+| `BasicAuthMiddleware` | Basic Auth middleware | `AMF`, `IHD`, `BIV` |
+| `RateLimitAndQuotaCheck` | Rate limiting and quota middleware | `RLT`, `QEX` |
+| `APIRateLimitMiddleware` | API-level rate limiting | `RLT` |
+| `RequestSizeLimitMiddleware` | Request size limit middleware | `BTL`, `CLM` |
+| `ValidateJSONMiddleware` | JSON schema validation middleware | `BIV` |
+
+### Examples
+
+<AccordionGroup>
+<Accordion title='Upstream connection refused (500)'>
+
+When the upstream server refuses the TCP connection, the access log shows:
+
+```
+time="2025-02-10T14:23:01Z" level=info api_id=abc123 api_name=my-api api_type=oas
+  error_source=ReverseProxy error_target=api.backend.com:443
+  method=GET path=/users prefix=access-log
+  response_code_details=connection_refused response_flag=UCF status=500
+```
+
+Key fields:
+- `response_flag=UCF` identifies the error as an Upstream Connection Failure.
+- `error_target=api.backend.com:443` shows the specific upstream that refused the connection.
+- `upstream_status` is absent because no HTTP response was received from the upstream.
+
+</Accordion>
+
+<Accordion title='TLS certificate expired (500)'>
+
+When the upstream's TLS certificate has expired:
+
+```
+time="2025-02-10T14:25:33Z" level=info api_id=abc123 api_name=my-api api_type=oas
+  error_source=ReverseProxy error_target=api.backend.com:443
+  method=GET path=/users prefix=access-log
+  response_code_details=tls_certificate_expired response_flag=TLE status=500
+  tls_cert_expiry=2024-01-15T00:00:00Z tls_cert_subject="CN=api.backend.com"
+```
+
+The `tls_cert_expiry` and `tls_cert_subject` fields help you identify exactly which certificate needs renewal and when it expired.
+
+</Accordion>
+
+<Accordion title='Circuit breaker open (503)'>
+
+When a [circuit breaker](/planning-for-production/ensure-high-availability/circuit-breakers) trips for an endpoint, the access log shows:
+
+```
+time="2025-02-10T14:30:00Z" level=info api_id=abc123 api_name=my-api api_type=oas
+  circuit_breaker_state=OPEN error_source=ReverseProxy error_target=api.backend.com:443/health
+  method=GET path=/health prefix=access-log
+  response_code_details=circuit_breaker_open response_flag=CBO status=503
+```
+
+</Accordion>
+
+<Accordion title='Rate limited (429)'>
+
+When a client exceeds the configured rate limit, the access log shows:
+
+```
+time="2025-02-10T14:31:22Z" level=info api_id=abc123 api_name=my-api api_type=oas
+  error_source=RateLimitAndQuotaCheck method=POST path=/orders prefix=access-log
+  response_code_details=session_rate_limited response_flag=RLT status=429
+```
+
+Note that `error_target` is absent for gateway-level errors (authentication, rate limiting, validation) because the request did not reach the upstream.
+
+</Accordion>
+
+<Accordion title='Upstream returned 503 (5XX passthrough)'>
+
+When the upstream receives the request but responds with an error status, the access log shows:
+
+```
+time="2025-02-10T14:32:45Z" level=info api_id=abc123 api_name=my-api api_type=oas
+  error_source=Upstream error_target=api.backend.com:443
+  method=GET path=/health prefix=access-log
+  response_code_details=upstream_response_5xx response_flag=URS status=503
+  upstream_status=503
+```
+
+Key distinction: `error_source=Upstream` and `upstream_status=503` indicate that the upstream returned an error, unlike a connection failure, where no response was received.
+
+</Accordion>
+
+</AccordionGroup>
+
+## Performance Considerations
+
+Enabling access logs introduces some performance overhead:
+
+- **Latency:** Increases consistently by approximately 4%-13%, depending on CPU allocation and configuration.
+- **Memory Usage:** Memory consumption increases by approximately 6%-7%.
+- **Allocations:** The number of memory allocations increases by approximately 5%-6%.
+
+<Note>
+While the overhead of enabling access logs is noticeable, the impact is relatively modest. These findings suggest the performance trade-off may be acceptable depending on the criticality of logging to your application.
+</Note>
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title='Distinguishing Connection Errors from Upstream Response Errors'>
+
+A common troubleshooting question is whether the upstream received the request or if the connection itself failed. The error classification fields make this distinction clear:
+
+| Scenario | `error_source` | `upstream_status` | `error_target` | Example flags |
+| :--- | :--- | :--- | :--- | :--- |
+| Connection failed (upstream never received request) | `ReverseProxy` | absent (0) | present | `UCF`, `UCT`, `DNS`, `TLE` |
+| Upstream responded with error | `Upstream` | present (for example, 503) | present | `URS` |
+| Gateway rejected request (never proxied) | middleware name | absent | absent | `RLT`, `AMF`, `BTL` |
+
+</Accordion>
+
+</AccordionGroup>
diff --git a/api-management/logs/application-logs.mdx b/api-management/logs/application-logs.mdx
new file mode 100644
index 0000000000..32c0ca1b99
--- /dev/null
+++ b/api-management/logs/application-logs.mdx
@@ -0,0 +1,69 @@
+---
+title: "Application Logs"
+description: "Learn how to configure Tyk's application logs"
+keywords: "Logs, Logging, Tyk Gateway, Tyk Dashboard, Tyk Pump, Tyk MDCB, Application Log, System Log"
+sidebarTitle: "Application Logs"
+---
+
+## Introduction
+
+Every Tyk component writes an Application Log, capturing internal events of the system, such as health-checks, status, configuration changes, and errors, which are typically used for monitoring and debugging.
+
+**Example**
+
+```
+time="2025-02-16T22:48:39Z" level=info message="Using Policies from Dashboard Service" prefix=main
+time="2025-02-16T22:48:39Z" level=info message="Calling dashboard service for policy list" prefix=policy
+time="2025-02-16T22:48:39Z" level=info message="Processing policy list" prefix=policy
+time="2025-02-16T22:48:39Z" level=info message="Policies found (5 total):" prefix=main
+```
+
+Three aspects can be configured:
+
+- **verbosity**: which severity levels are written
+- **format**: the structure and content of each entry
+- **log output**: where logs are sent, for example to a third-party aggregator
+
+See [Configuring Application and Access Logs](/api-management/logs#configuring-application-and-access-logs) for details of these and how to configure them.
+
+The rest of this page covers behavior specific to **Tyk Gateway's Application Log**.
+
+## OpenTelemetry Trace and Span IDs
+
+<Badge color="orange">Gateway Only</Badge>
+
+When OpenTelemetry tracing is enabled, Tyk Gateway automatically injects `trace_id` and `span_id` fields into all request-scoped application log entries, including middleware execution, error handling, and debug output. This lets you correlate an application log line with the corresponding span in your distributed trace.
+
+```
+time="2025-02-16T22:48:39Z" level=error message="Rate limit exceeded" prefix=rate-limit api_id=b1a41c9a89984ffd7bb7d4e3c6844ded trace_id=4bf92f3577b34da6a3ce929d0e0e4736 span_id=00f067aa0ba902b7
+```
+
+Non-request-scoped entries (startup, configuration reload, health-checks) do not carry trace or span IDs because they are not associated with a specific request.
+
+## Tracking HTTP 404 Errors
+
+<Badge color="orange">Gateway Only</Badge>
+
+By default, requests that do not match any configured API listen path return HTTP 404 and are not logged. Because these requests never enter the proxy pipeline, they are not recorded in Access Logs or API Traffic Logs, which only cover requests that are routed and processed by the Gateway.
+
+To track them in the application log, set [`track_404_logs`](/tyk-oss-gateway/configuration#track_404_logs) to `true` in `tyk.conf` (or the equivalent environment variable).
+
+When enabled, a log entry is written at `error` level for each unmatched request.
+
+From **Tyk Gateway 5.14.0**, the entry includes a `host` field when using the `text` or `json` log format. Because Tyk Gateway exposes both a proxy API and a control API, and these can be [configured on a separate hostname and port](/planning-for-production#change-your-control-port), the `host` field identifies which one received the unmatched request:
+
+```
+time="2025-07-15T10:25:30Z" level=error message="Not Found" prefix=gateway request="GET /nonexistent/path HTTP/1.1" origin=192.168.1.5:54321 host=api.example.com:9696
+```
+
+In `legacy` format, the `host` field is omitted:
+
+```
+time="Jul 15 10:25:30" level=error msg="Not Found" prefix=gateway request="GET /nonexistent/path HTTP/1.1" origin=192.168.1.5:54321
+```
+
+## Event Log Handlers
+
+<Badge color="orange">Gateway Only</Badge>
+
+[Event log handlers](/api-management/gateway-events#logging-api-events) can be registered against Gateway events to write a log entry each time a specific event fires, such as an authentication failure or rate limit being exceeded.
diff --git a/api-management/logs/audit-logs.mdx b/api-management/logs/audit-logs.mdx
new file mode 100644
index 0000000000..fef3c4a56a
--- /dev/null
+++ b/api-management/logs/audit-logs.mdx
@@ -0,0 +1,88 @@
+---
+title: "Dashboard Audit Logs"
+description: "Learn how to configure Tyk Dashboard to log user activity"
+keywords: "Logs, Logging, Tyk Dashboard, Audit Log"
+sidebarTitle: "Audit Logs"
+---
+
+## Introduction
+
+Tyk Dashboard's audit log system captures detailed records of all requests made to endpoints under the `/api` route, providing a record of user activity via Dashboard API or in the UI. The audit logs can be written to local files or to the Control Plane's persistent storage database, providing flexible options for log management and retrieval.
+
+See [Enable and View Audit Logs in Tyk Dashboard](/api-management/enable-audit-logs-dashboard) for a step-by-step guide on using the audit log feature.
+
+### Enabling the Audit Log
+
+The audit log is configured within the Tyk Dashboard config file (`tyk_analytics.conf`) or using the equivalent environment variables.
+
+```json
+{
+  "audit": {
+    "enabled": true,
+    "format": "json",
+    "path": "/tmp/audit.log",
+    "detailed_recording": false,
+    "store_type": "file"
+  }
+}
+```
+
+| Field     | Description | Default |
+| :-------- | :--- | :--- |
+| `enabled` | Enable audit logging. | `false` |
+| `format`  | Specifies the log format used when `store_type` is `file`. Valid values are `json` and `text`; ignored when `store_type` is `db`. | `text` |
+| `path`    | Path to the audit log file on the Dashboard's server. | |
+| `detailed_recording` | Enable detailed records in the audit log. If set to `true`, audit log records will contain the http-request (without body) and full http-response including the body. | `false` |
+| `store_type` | Specifies the storage in which audit logs will be written. Valid values are `file` and `db`. | `file` |
+
+Please consult [Tyk Dashboard Configuration Options](/tyk-dashboard/configuration#audit) for equivalent configuration with environment variables.
+
+<Warning>
+Enabling `detailed_recording` captures the complete HTTP response body from every Dashboard API call. Depending on the endpoint, that response can include sensitive data, such as a newly generated API key, OAuth client secret, or other credentials returned by the call. This data is stored as-is in the audit log, wherever `store_type` points it. Enable this only when you need it, and make sure the resulting audit log has appropriate access controls.
+</Warning>
+
+<Note>
+The legacy setting [`security.audit_log_path`](/tyk-dashboard/configuration#security-audit_log_path) can also be used to enable audit logging. This accepts a file path and combines the functionality of `audit.enabled` and `audit.path`. The value configured in `audit.path` will overrule anything set in `security.audit_log_path`.
+</Note>
+
+### Audit Log Storage
+
+If `audit.store_type` is set to `file`, the logs will be added to the file identified using `audit.path`, in JSON or text format depending on the configuration of `audit.format`. In `text` format, each field is written on its own line, in the order listed in the [table below](#audit-log-content).
+
+<Note>
+If hosting Tyk Dashboard within a Kubernetes cluster, please ensure that the configured log file path is valid and writeable.
+</Note>
+
+If `audit.store_type` is set to `db`, the logs will be added to a collection or table named `audit_records` in the Control Plane's persistent storage, and `audit.format` is ignored: records are always stored in their native structured form, not as `json` or `text`. Database storage has been available since [Tyk Dashboard v5.7.0](/developer-support/release-notes/dashboard#5-7-0-release-notes).
+
+<Note>
+Tyk does not manage the size of the audit log file or collection.
+</Note>
+
+## Audit Log Content
+
+For each request made to the Tyk Dashboard API's `/api/*` endpoints, a log will be generated containing the following data:
+
+| Field    | Description |
+| :------- | :---- |
+| `_id`    | Database identifier for the record, assigned when `store_type` is `db`. In `file` storage the record is never inserted into a database, so `json` format includes `_id` as an empty value and `text` format omits it entirely. |
+| `req_id` | Unique request ID |
+| `org_id` | Organisation ID |
+| `date`   | Date in *RFC1123* format |
+| `timestamp` | UNIX timestamp |
+| `ip`     | IP address the request originated from |
+| `user`   | Dashboard user who performed the request |
+| `action` | Description of the action performed (for example, Update User) |
+| `method` | HTTP request method |
+| `url`    | URL of the request |
+| `status` | HTTP response status of the request |
+| `diff`   | Provides a diff of changed fields (available only for PUT requests) |
+| `request_dump`  | HTTP request copy (available if `detailed_recording` is set to `true`) |
+| `response_dump` | HTTP response copy (available if `detailed_recording` is set to `true`) |
+
+## Viewing and Retrieving Audit Logs
+
+Tyk Dashboard's **System Management > Audit Logs** screen provides a searchable and filterable view of the collected audit logs.
+
+The [List Audit Logs](https://tyk.io/docs/api-reference/auditlogs/list-audit-logs) endpoint, available since [Tyk Dashboard v5.7.0](/developer-support/release-notes/dashboard#5-7-0-release-notes), provides access to logs stored in the persistent storage.
+
diff --git a/api-management/logs/external-data-sinks.mdx b/api-management/logs/external-data-sinks.mdx
new file mode 100644
index 0000000000..1f03507e4b
--- /dev/null
+++ b/api-management/logs/external-data-sinks.mdx
@@ -0,0 +1,713 @@
+---
+title: "External Data Sinks (Legacy)"
+description: "Configure Tyk Pump to forward traffic logs to external tools such as Splunk, Datadog, Elasticsearch, Moesif, and Logz.io."
+keywords: "Tyk Pump, Splunk, Datadog, Elasticsearch, Moesif, Logzio, CSV, Legacy"
+sidebarTitle: "External Data Sinks (Legacy)"
+---
+
+<Note>
+This page describes forwarding traffic logs to external tools using Tyk Pump. [OpenTelemetry tracing](/api-management/traces) is an alternative for new integrations: it exports per-request span data directly from Tyk Gateway, without the Redis and Tyk Pump hop. It's not a like-for-like replacement, though: OTel spans use a different schema from Tyk's traffic log fields, and not every destination on this page has an OTel exporter. Use this page if you need Tyk's traffic log format, a destination without OTel support, or already have an existing deployment built around Tyk Pump.
+</Note>
+
+Tyk Pump can forward traffic logs to a range of external tools, each its own pump type, in parallel with, or instead of, the [pumps that populate Tyk Dashboard Analytics](/api-management/dashboard-analytics). Every pump on this page is declared the same way, under the `pumps` object in `pump.conf`, and every pump also accepts the [common pump settings](/api-management/tyk-pump#common-pump-settings) (`filters`, `timeout`, and so on) in addition to its own fields shown below.
+
+Every pump on this page forwards each traffic log largely as-is, mapped into that destination's native format.
+
+<Note>
+None of the pumps on this page ever receive aggregated analytics, whichever way you deploy them. Aggregation only ever feeds Tyk Dashboard's Traffic Analytics graphs; see [How Aggregation Works](/api-management/dashboard-analytics#how-aggregation-works). External sinks only ever see individual traffic logs.
+</Note>
+
+This page covers every External Data Sink pump. StatsD, DogStatsD, and Prometheus are metrics pumps, not sink pumps, so they're covered on [Metrics Pumps](/api-management/metrics/metrics-pumps) instead; see the [pump type catalog](/api-management/tyk-pump#pump-type-catalog) for the full breakdown.
+
+## Combined vs Distributed Deployments
+
+In a combined control and data plane, these pumps work exactly like the ones that feed Tyk Dashboard: Tyk Pump reads from the shared Redis and writes to each configured destination in parallel.
+
+In a distributed deployment, with separate control and data planes connected via Tyk MDCB, you have two options, and they're not equivalent:
+
+- **Run the sink pump directly on the data plane**, alongside the [Hybrid Pump](/api-management/dashboard-analytics/data-plane-pump), reading from the same local Redis. This is the simpler option.
+- **Run the sink pump on the control plane**, as a [Control Plane Pump](/api-management/dashboard-analytics/control-plane-pumps), receiving traffic logs the Hybrid Pump has forwarded via Tyk MDCB. This requires `forward_analytics_to_pump: true`. See [Data Plane Pump](/api-management/dashboard-analytics/data-plane-pump#how-tyk-mdcb-handles-the-data) for that mechanism in full.
+
+## CSV
+
+Tyk Pump can create or append to a CSV file to track API traffic logs.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `csv` pump accepts the following `meta` field:
+
+```json
+{
+  "pumps": {
+    "csv": {
+      "type": "csv",
+      "meta": {
+        "csv_dir": "./your_directory_here"
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `csv_dir` | - | Directory the CSV file is written to; created automatically if it doesn't exist. **Required** |
+
+Limitations:
+
+- Writes one file per hour, named `YYYY-Month-DD-HH.csv`, inside `csv_dir`.
+- Every traffic log field is written; there's no `fields` filtering support.
+
+## Stdout
+
+Writes traffic logs to standard output as JSON, useful for sidecar log collectors such as the Datadog logging agent in Kubernetes.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `stdout` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "stdout": {
+      "type": "stdout",
+      "meta": {
+        "log_field_name": "tyk-analytics-record",
+        "format": "json",
+        "use_legacy_payload_format": false
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `log_field_name` | `tyk-analytics-record` | Root field name the traffic log is nested under. |
+| `format` | `text` | `text` or `json`. With `json`, every Tyk Pump log written to stdout becomes JSON, not just this pump's output. |
+| `use_legacy_payload_format` | `false` | With `format: json`, renders `raw_request`/`raw_response` as legacy escaped strings instead of the newer JSON-aware format. |
+
+## Syslog
+
+Sends traffic logs to a syslog daemon.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `syslog` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "syslog": {
+      "type": "syslog",
+      "meta": {
+        "transport": "udp",
+        "network_addr": "localhost:5140",
+        "log_level": 6,
+        "tag": "syslog-pump"
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `transport` | `udp` | `udp`, `tcp`, or `tls`. |
+| `network_addr` | `localhost:5140` | Host and port of your syslog daemon. |
+| `log_level` | - | Severity level, an integer from 0-7, following the [syslog severity levels](https://en.wikipedia.org/wiki/Syslog#Severity_level) standard. |
+| `tag` | `syslog-pump` | Prefix tag. |
+
+Limitations:
+
+- If working with FluentD, use a [FluentD parser](https://docs.fluentd.org/input/syslog) matching your OS so FluentD reads the logs correctly.
+
+## Open Source Data Sinks
+
+These sinks are open source software you run and manage yourself.
+
+### Elasticsearch
+
+[Elasticsearch](https://www.elastic.co/) is a highly scalable, distributed search engine for large volumes of data.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `elasticsearch` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "elasticsearch": {
+      "type": "elasticsearch",
+      "meta": {
+        "index_name": "tyk_analytics",
+        "elasticsearch_url": "http://localhost:9200",
+        "use_sniffing": false,
+        "document_type": "tyk_analytics",
+        "rolling_index": false,
+        "extended_stats": false,
+        "version": "3",
+        "disable_bulk": false,
+        "bulk_config": {},                 // only if disable_bulk: false
+        "use_ssl": false,
+        "ssl_insecure_skip_verify": false,
+        "ssl_cert_file": "",                // only if use_ssl: true
+        "ssl_key_file": "",                 // only if use_ssl: true
+        "ssl_ca_file": "",                  // only if use_ssl: true
+        "generate_id": false,
+        "decode_base64": false,
+        "mcp_index_name": "",
+        "auth_api_key_id": "",              // alternative to auth_basic_username/auth_basic_password
+        "auth_api_key": "",
+        "auth_basic_username": "",          // alternative to auth_api_key_id/auth_api_key
+        "auth_basic_password": ""
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `index_name` | `tyk_analytics` | Index for all analytics data. |
+| `elasticsearch_url` | `http://localhost:9200` | Target URL, used when `use_sniffing` is `false`. |
+| `use_sniffing` | `false` | If `true`, uses `elasticsearch_url` to discover all cluster node addresses, then uses those instead. |
+| `document_type` | `tyk_analytics` | The document type created in Elasticsearch. |
+| `rolling_index` | `false` | Appends the date to the index name, for example `tyk_analytics-2016.02.28`, so each day is a separate index. |
+| `extended_stats` | `false` | If `true`, includes `Raw Request`, `Raw Response`, and `User Agent` fields. |
+| `version` | `3` | The Elasticsearch major version: `3`, `5`, `6`, or `7`. |
+| `disable_bulk` | `false` | Disables batch writing. |
+| `bulk_config` | - | Batch writing triggers, evaluated as an OR of each other: `workers` (default `1`), `flush_interval` in seconds (disabled by default), `bulk_actions` (default `1000`, `-1` to disable), and `bulk_size` in bytes (default 5MB, `-1` to disable). |
+| `use_ssl` | `false` | Enables an SSL connection. |
+| `ssl_insecure_skip_verify` | `false` | Skips verifying the Elasticsearch server's certificate chain and host name. |
+| `ssl_cert_file`, `ssl_key_file` | - | Paths to the PEM client certificate and private key for authenticating with the Elasticsearch server. |
+| `ssl_ca_file` | - | Path to the PEM file of trusted CA certificates used to verify the Elasticsearch server's certificate. |
+| `generate_id` | `false` | Generates a deterministic document ID per record, to prevent duplicates if a record is retried after a failed write. |
+| `decode_base64` | `false` | Decodes the `raw_request`/`raw_response` fields from base64 before sending to Elasticsearch. |
+| `auth_api_key_id`, `auth_api_key` | - | Authenticate to Elasticsearch using an API key, sent via the `Authorization` header. |
+| `auth_basic_username`, `auth_basic_password` | - | Authenticate to Elasticsearch using HTTP basic auth. |
+| `mcp_index_name` | (none) | When set, MCP records are written to this index instead of `index_name`, and follow the same `rolling_index` date-suffix behavior. Leave unset to keep MCP records in the same index as everything else. |
+
+<Warning>
+`ssl_insecure_skip_verify` disables all TLS certificate validation for this connection. Only use it for local development or testing, never in production, it exposes the connection to man-in-the-middle attacks.
+</Warning>
+
+### Graylog
+
+Sends traffic logs to [Graylog](https://graylog.org/).
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `graylog` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "graylog": {
+      "type": "graylog",
+      "meta": {
+        "host": "10.60.6.15",
+        "port": 12216,
+        "tags": ["path", "method", "response_code", "api_name"]
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `host` | `localhost` | Graylog host. |
+| `port` | `1000` | Graylog port. |
+| `tags` | (none) | Traffic log fields to send. If left empty, nothing is sent. Available values: `path`, `method`, `response_code`, `api_key`, `api_version`, `api_name`, `api_id`, `org_id`, `oauth_id`, `raw_request`, `raw_response`, `request_time`, and `ip_address`. |
+
+### InfluxDB
+
+Tyk Pump can write traffic logs to [InfluxDB](https://www.influxdata.com/) 1.x. For InfluxDB 2.x, use [Influx2](#influx2) below instead.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `influx` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "influx": {
+      "type": "influx",
+      "meta": {
+        "database_name": "tyk_analytics",
+        "address": "http://localhost:8086",
+        "username": "",
+        "password": "",
+        "fields": ["request_time"],
+        "tags": ["method", "path", "response_code"]
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `database_name` | - | The InfluxDB database name. |
+| `address` | - | The InfluxDB host. |
+| `username`, `password` | - | InfluxDB credentials. |
+| `fields` | all available | Which traffic log fields to send as point fields. Available values, all included by default: `method`, `path`, `response_code`, `api_key`, `time_stamp`, `api_version`, `api_name`, `api_id`, `org_id`, `oauth_id`, `raw_request`, `request_time`, `raw_response`, and `ip_address`. |
+| `tags` | (none) | Which of those same fields act as tags on the point instead. |
+
+Limitations:
+
+- Points are written to a fixed measurement, `analytics`; this isn't configurable.
+
+### Influx2
+
+For InfluxDB 1.x, use [InfluxDB](#influxdb) above instead. Uses the official Go client library for InfluxDB 2.x.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `influx2` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "influx2": {
+      "type": "influx2",
+      "meta": {
+        "organization": "my-org",
+        "bucket": "my-bucket",
+        "address": "http://localhost:8086",
+        "token": "my-super-secret-auth-token",
+        "create_missing_bucket": false,
+        "new_bucket_config": {},            // only if create_missing_bucket: true
+        "fields": ["request_time"],
+        "tags": ["method", "path", "response_code"],
+        "flush": false
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `organization` | - | The InfluxDB organization name. |
+| `bucket` | - | The InfluxDB bucket analytics data is stored in. |
+| `address` | - | The InfluxDB host. |
+| `token` | - | The InfluxDB auth token. |
+| `create_missing_bucket` | `false` | Creates the bucket if it doesn't exist. |
+| `new_bucket_config` | - | Used when `create_missing_bucket` is `true`: `description` (shown in the Influx UI) and `retention_rules`, a list of rules such as `{"every_seconds": 100000, "shard_group_duration_seconds": 0, "type": "expire"}` to expire data after a set period. |
+| `fields` | - | Which traffic log fields to send as point fields. |
+| `tags` | - | Which fields act as tags on the time series. |
+| `flush` | `false` | Writes each record to InfluxDB as soon as Tyk Pump receives it, rather than batching. |
+
+### Kafka
+
+Publishes traffic logs to a [Kafka](https://kafka.apache.org/) topic.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `kafka` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "kafka": {
+      "type": "kafka",
+      "meta": {
+        "broker": ["localhost:9092"],
+        "topic": "tyk-pump",
+        "client_id": "tyk-pump",
+        "timeout": 60,
+        "use_ssl": false,
+        "ssl_insecure_skip_verify": false,
+        "ssl_cert_file": "",                // only if use_ssl: true
+        "ssl_key_file": "",                 // only if use_ssl: true
+        "ssl_ca_file": "",                  // only if use_ssl: true
+        "compressed": false,
+        "batch_bytes": 0,
+        "meta_data": {},
+        "sasl_mechanism": "",                // enables SASL auth: "plain" or "scram"
+        "sasl_username": "",                 // only if sasl_mechanism is set
+        "sasl_password": "",                 // only if sasl_mechanism is set
+        "sasl_algorithm": "sha-256"           // only if sasl_mechanism is "scram"
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `broker` | - | List of brokers used to discover the partitions available on the Kafka cluster, for example `localhost:9092`. |
+| `client_id` | - | Unique identifier for connections established with Kafka. |
+| `topic` | - | The topic messages are produced to. |
+| `timeout` | - | Maximum time, in seconds, to wait for a connect or write to complete. |
+| `compressed` | `false` | Compresses Kafka messages using the Snappy codec. |
+| `meta_data` | - | Custom metadata to attach to each Kafka message. |
+| `batch_bytes` | `0` | Maximum request size, in bytes, before it's sent to a partition. If `0`, uses the `kafka-go` library's own default (1MB). |
+| `use_ssl` | `false` | Enables an SSL connection. |
+| `ssl_insecure_skip_verify` | `false` | Skips verifying the Kafka server's certificate chain and host name. |
+| `ssl_cert_file`, `ssl_key_file` | - | PEM client certificate and private key for authenticating with the Kafka server. |
+| `ssl_ca_file` | - | Path to the PEM file of trusted CA certificates used to verify the Kafka server's certificate. |
+| `sasl_mechanism` | - | Enables SASL authentication: `plain` or `scram`. |
+| `sasl_username`, `sasl_password` | - | SASL credentials. |
+| `sasl_algorithm` | `sha-256` | Hash algorithm for SCRAM: `sha-256` or `sha-512`. |
+
+<Warning>
+`ssl_insecure_skip_verify` disables all TLS certificate validation for this connection. Only use it for local development or testing, never in production, it exposes the connection to man-in-the-middle attacks.
+</Warning>
+
+<Tip>
+  Kafka brokers commonly auto-create a topic on its first use. If you point Tyk Pump at a topic that doesn't exist yet, its first write attempt can fail with `Unknown Topic Or Partition` while the broker creates it, silently dropping that batch. Create the topic before starting Tyk Pump against it, so no records are lost.
+</Tip>
+
+#### Working Example
+
+The example below connects to a Kafka cluster secured with SASL\_SSL and SCRAM-SHA-256 authentication, the setup used by Confluent Cloud, Amazon MSK, and most managed Kafka clusters:
+
+<Tabs>
+<Tab title="pump.conf">
+```json
+{
+  "pumps": {
+    "kafka": {
+      "type": "kafka",
+      "meta": {
+        "broker": ["your-cluster.kafka.example.com:9092"],
+        "topic": "tyk-pump",
+        "client_id": "tyk-pump",
+        "timeout": 30,
+        "use_ssl": true,
+        "ssl_ca_file": "/etc/tyk-pump/certs/ca.pem",
+        "sasl_mechanism": "scram",
+        "sasl_username": "tyk-pump",
+        "sasl_password": "<password>",
+        "sasl_algorithm": "sha-256"
+      }
+    }
+  }
+}
+```
+</Tab>
+<Tab title="Environment variables">
+```bash
+TYK_PMP_PUMPS_KAFKA_TYPE=kafka
+TYK_PMP_PUMPS_KAFKA_META_BROKER=your-cluster.kafka.example.com:9092
+TYK_PMP_PUMPS_KAFKA_META_TOPIC=tyk-pump
+TYK_PMP_PUMPS_KAFKA_META_CLIENTID=tyk-pump
+TYK_PMP_PUMPS_KAFKA_META_TIMEOUT=30
+TYK_PMP_PUMPS_KAFKA_META_USESSL=true
+TYK_PMP_PUMPS_KAFKA_META_SSLCAFILE=/etc/tyk-pump/certs/ca.pem
+TYK_PMP_PUMPS_KAFKA_META_SASLMECHANISM=scram
+TYK_PMP_PUMPS_KAFKA_META_USERNAME=tyk-pump
+TYK_PMP_PUMPS_KAFKA_META_PASSWORD=your-password
+TYK_PMP_PUMPS_KAFKA_META_ALGORITHM=sha-256
+```
+Set `TYK_PMP_OMITCONFIGFILE=true` if you're configuring Tyk Pump purely from environment variables, with no `pump.conf` at all.
+</Tab>
+</Tabs>
+
+
+## Commercial and SaaS Data Sinks
+
+These sinks are commercial products or hosted SaaS platforms.
+
+### Logz.io
+
+[Logz.io](https://logz.io/) is a cloud-based log management and analytics platform built on Elasticsearch, Logstash, and Kibana.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `logzio` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "logzio": {
+      "type": "logzio",
+      "meta": {
+        "token": "<YOUR-LOGZ.IO-TOKEN>",
+        "url": "https://listener.logz.io:8071",
+        "queue_dir": "",
+        "drain_duration": "3s",
+        "disk_threshold": 98,
+        "check_disk_space": true
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `token` | - | Token for sending data to your Logz.io account. **Required** |
+| `url` | `https://listener.logz.io:8071` | Use a non-default Logz.io URL, for example when proxying. |
+| `queue_dir` | A generated path under the OS temp directory | Directory used for the on-disk send queue. |
+| `drain_duration` | `3s` | How often queued logs are flushed to disk. |
+| `disk_threshold` | `98` | Disk usage percentage at which the sender stops enqueuing received logs. |
+| `check_disk_space` | `true` | Whether the sender checks disk usage against `disk_threshold`. |
+
+### Moesif
+
+[Moesif](https://www.moesif.com/solutions/track-api-program?language=tyk-api-gateway&utm_medium=docs&utm_campaign=partners&utm_source=tyk) provides API analytics and usage-based billing. With the Moesif pump, traffic logs are sent to Moesif asynchronously, including payloads, and Moesif collects the authenticated user (Alias ID or OAuth ID) to identify customers.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `moesif` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "moesif": {
+      "type": "moesif",
+      "meta": {
+        "application_id": "Your Moesif Application Id",
+        "user_id_header": "",
+        "company_id_header": "",
+        "request_header_masks": [],
+        "response_header_masks": [],
+        "request_body_masks": [],
+        "response_body_masks": [],
+        "authorization_header_name": "authorization",
+        "authorization_user_id_field": "sub",
+        "disable_capture_request_body": false,
+        "disable_capture_response_body": false,
+        "enable_bulk": false
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `application_id` | - | Moesif Application ID. Multiple Tyk API IDs are logged under the same app ID. **Required** |
+| `user_id_header` | token alias | Header identifying the user. By default, Moesif identifies the customer from the authenticated user (Alias ID or OAuth ID); override with a header such as `X-Consumer-Id`. |
+| `company_id_header` | - | Header identifying the company or account, to link a user to a company. |
+| `request_header_masks`, `response_header_masks` | - | Mask a specific request or response header field. |
+| `request_body_masks`, `response_body_masks` | - | Mask a specific request or response body field. |
+| `disable_capture_request_body`, `disable_capture_response_body` | `false` | Disable logging of the request or response body. |
+| `authorization_header_name` | `authorization` | Request header used to identify the user in Moesif. |
+| `authorization_user_id_field` | `sub` | Field used to parse the user from the authorization header. |
+| `enable_bulk` | `false` | Enables the `bulk_config` batching options: `event_queue_size` (default `10000`), `batch_size` (default `200`), and `timer_wake_up_seconds` (default `2`). |
+
+Limitations:
+
+- Moesif needs [detailed recording](/api-management/logs/traffic-logs#detailed-recording) enabled to log HTTP headers and bodies.
+- See [Moesif's documentation on identifying customers](https://www.moesif.com/docs/getting-started/identify-customers/?utm_medium=docs&utm_campaign=partners&utm_source=tyk) for `user_id_header`/`company_id_header`.
+
+### Resurface.io
+
+[Resurface](https://resurface.io/) captures every API call as a durable transaction in a purpose-built data lake, for attack and failure triage, root cause analysis, and usage monitoring.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `resurfaceio` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "resurfaceio": {
+      "type": "resurfaceio",
+      "meta": {
+        "capture_url": "http://localhost:7701/message",
+        "rules": "include debug"
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `capture_url` | - | The Resurface database's [capture endpoint URL](https://resurface.io/docs/#getting-capture-url). **Required** |
+| `rules` | - | An [active set of rules](https://resurface.io/logging-rules) controlling what's logged and how sensitive data is masked. **Required** |
+
+Limitations:
+
+- Requires [detailed recording](/api-management/logs/traffic-logs#detailed-recording) enabled to capture full API call details.
+
+### Segment
+
+Tyk Pump can send traffic logs to [Segment](https://segment.com/) as `Track` events.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `segment` pump accepts the following `meta` field:
+
+```json
+{
+  "pumps": {
+    "segment": {
+      "type": "segment",
+      "meta": {
+        "segment_write_key": "<YOUR-SEGMENT-WRITE-KEY>"
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `segment_write_key` | - | Your Segment source's write key. **Required** |
+
+Limitations:
+
+- Every traffic log field is sent as the event's properties; there's no `fields`/`tags` filtering support.
+- Each event is named `Hit`, with `AnonymousId` set to the request's API key.
+
+### Splunk
+
+Sends traffic logs to [Splunk](https://www.splunk.com/) via its HTTP Event Collector (HEC).
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `splunk` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "splunk": {
+      "type": "splunk",
+      "meta": {
+        "collector_token": "<token>",
+        "collector_url": "https://localhost:8088/services/collector/event",
+        "fields": [],
+        "obfuscate_api_keys": false,
+        "obfuscate_api_keys_length": 0,
+        "ignore_tag_prefix_list": [],
+        "enable_batch": false,
+        "batch_max_content_length": 838860800,
+        "max_retries": 0,
+        "ssl_insecure_skip_verify": false,
+        "ssl_cert_file": "",                // only for mutual TLS to the HEC endpoint
+        "ssl_key_file": "",                 // only for mutual TLS to the HEC endpoint
+        "ssl_ca_file": "",                  // only for mutual TLS to the HEC endpoint
+        "ssl_server_name": ""               // only if it differs from the hostname in collector_url
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `collector_token` | - | The HEC token from your Splunk collector. **Required** |
+| `collector_url` | - | Your Splunk HEC endpoint, for example `https://splunk:8088/services/collector/event`. **Required** |
+| `obfuscate_api_keys` | `false` | Masks the API key in each event. |
+| `obfuscate_api_keys_length` | `0` | With `obfuscate_api_keys: true`, keeps this many characters from the end of the API key rather than masking it fully. |
+| `fields` | all available | Restricts which traffic log fields are included in each Splunk event. Defaults to `method`, `path`, `response_code`, `api_key`, `time_stamp`, `api_version`, `api_name`, `api_id`, `org_id`, `oauth_id`, `raw_request`, `request_time`, `raw_response`, and `ip_address`. |
+| `ignore_tag_prefix_list` | (none) | Excludes tags, by prefix, from the event. |
+| `enable_batch` | `false` | Sends traffic logs to Splunk in batches rather than individually. |
+| `batch_max_content_length` | `838860800` (~800MB) | Maximum batch size in bytes, matching Splunk's own `max_content_length` default. If purged traffic logs don't reach this size before the next purge loop, they're sent anyway. |
+| `max_retries` | `0` | Maximum retry attempts for failed requests to the Splunk HEC. Connection, network, timeout, rate-limit, and server errors are all retried. |
+| `ssl_insecure_skip_verify` | `false` | Skips verifying the Splunk server's certificate chain and host name. |
+| `ssl_cert_file`, `ssl_key_file` | - | PEM client certificate and private key for authenticating with the Splunk server. |
+| `ssl_ca_file` | - | Path to the PEM file of trusted CA certificates used to verify the Splunk server's certificate. |
+| `ssl_server_name` | - | Server name used for the TLS handshake, if it differs from the hostname in `collector_url`. |
+
+<Warning>
+`ssl_insecure_skip_verify` disables all TLS certificate validation for this connection. Only use it for local development or testing, never in production, it exposes the connection to man-in-the-middle attacks.
+</Warning>
+
+## AWS Pumps
+
+Timestream, SQS, and Kinesis all authenticate using the official AWS Go SDK's default credential chain: environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, or `AWS_WEB_IDENTITY_TOKEN_FILE`), the shared credentials file under `.aws` in your home directory, an ECS task role, or an EC2 instance role, in that order. See the [AWS SDK documentation](https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials) for details. Without credentials from one of these sources, the pump can't connect. The SQS pump additionally accepts explicit `aws_key`/`aws_secret`/`aws_token` fields in its own config, which override the default credential chain when set.
+
+### Kinesis
+
+Publishes traffic logs to an [Amazon Kinesis](https://aws.amazon.com/kinesis/) stream.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `kinesis` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "kinesis": {
+      "type": "kinesis",
+      "meta": {
+        "stream_name": "my-stream",
+        "region": "eu-west-2",
+        "batch_size": 100,
+        "kms_key_id": ""
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `stream_name` | - | The name of your Kinesis stream in the specified AWS region. **Required** |
+| `region` | - | The AWS region your Kinesis stream is located in, for example `eu-west-2`. **Required** |
+| `batch_size` | `100` | Maximum records per batch. Kinesis limits each batch to 5MiB; lower this if your records are large enough to risk failed delivery. |
+| `kms_key_id` | (none) | AWS KMS key ID used to encrypt records in the stream. Records are unencrypted if omitted. |
+
+### SQS
+
+Publishes traffic logs to an [Amazon SQS](https://aws.amazon.com/sqs/) queue.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `sqs` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "sqs": {
+      "type": "sqs",
+      "meta": {
+        "aws_queue_name": "access-logs-queue.fifo",
+        "aws_region": "us-east-1",
+        "aws_key": "",                       // overrides the default AWS credential chain
+        "aws_secret": "",                    // overrides the default AWS credential chain
+        "aws_token": "",                     // overrides the default AWS credential chain
+        "aws_endpoint": "",
+        "aws_message_group_id": "message_group_id",
+        "aws_sqs_batch_limit": 10,
+        "aws_message_id_deduplication_enabled": false,
+        "aws_delay_seconds": 0
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `aws_queue_name` | - | The name of the AWS SQS queue messages are sent to. **Required** |
+| `aws_region` | - | The AWS region where the SQS queue is located. **Required** |
+| `aws_key`, `aws_secret`, `aws_token` | - | Explicit AWS credentials, overriding the default credential chain above when set. |
+| `aws_endpoint` | - | Custom endpoint URL for AWS SQS, if applicable. |
+| `aws_message_group_id` | - | The SQS message group ID, for ordered processing. |
+| `aws_sqs_batch_limit` | - | Maximum number of messages per batch sent to the queue. |
+| `aws_message_id_deduplication_enabled` | `false` | Deduplicates messages by unique ID to prevent unintended duplicates. |
+| `aws_delay_seconds` | `0` | Delay, in seconds, before a sent message becomes available for processing. |
+
+### Timestream
+
+Writes traffic logs to [Amazon Timestream](https://aws.amazon.com/timestream/).
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `timestream` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "timestream": {
+      "type": "timestream",
+      "meta": {
+        "aws_region": "us-east-1",
+        "timestream_table_name": "tyk-pump-table",
+        "timestream_database_name": "tyk-pump",
+        "write_rate_limit": false,
+        "read_geo_from_request": false,
+        "write_zero_values": false,
+        "dimensions": ["Method", "Host", "Path", "APIKey"],
+        "measures": ["ResponseCode", "RequestTime", "Latency.Total"],
+        "field_name_mappings": {}
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `aws_region` | - | The AWS region that contains the Timestream database. **Required** |
+| `timestream_database_name` | - | The Timestream database name that contains the table being written to. **Required** |
+| `timestream_table_name` | - | The table name where the data is written. **Required** |
+| `dimensions` | - | Which traffic log fields to write as Timestream dimensions. Available values: `Method`, `Host`, `Path`, `RawPath`, `APIKey`, `APIVersion`, `APIName`, `APIID`, `OrgID`, `OauthID`. **Required** |
+| `measures` | - | Which traffic log fields, including nested ones such as `Latency.Total`, to write as Timestream measures. Available values: `ContentLength`, `ResponseCode`, `RequestTime`, `NetworkStats.*`, `Latency.Total`, `Latency.Upstream`, `IPAddress`, `UserAgent`, `RawRequest`, `RawResponse`, `RateLimit.*`, and `GeoData.*`. **Required** |
+| `write_rate_limit` | `false` | Records `RateLimit` measures extracted from the response headers. |
+| `read_geo_from_request` | `false` | Reads geolocation information from the request headers, if not already present on the traffic log. |
+| `write_zero_values` | `false` | If `true`, numerical values equal to zero are recorded rather than omitted. |
+| `field_name_mappings` | - | Renames traffic log fields to your preferred Timestream field names. |
diff --git a/api-management/logs/traffic-logs.mdx b/api-management/logs/traffic-logs.mdx
new file mode 100644
index 0000000000..ba66a22da4
--- /dev/null
+++ b/api-management/logs/traffic-logs.mdx
@@ -0,0 +1,485 @@
+---
+title: "Traffic Logs"
+description: "Learn about Tyk Gateway's API traffic logs, and get a full field-by-field reference for every field they contain."
+keywords: "Logs, Logging, Tyk Gateway, Tyk Pump, Traffic Log, API Request, Fields Reference"
+sidebarTitle: "Traffic Logs"
+---
+
+## Introduction
+
+A Traffic Log is a structured record of an individual API request and response, generated by Tyk Gateway and written to Redis.
+
+[Tyk Pump](/api-management/tyk-pump) is used to read these from Redis and distribute them to Tyk Dashboard's [Traffic Analytics and Log Browser](/api-management/dashboard-analytics), and to [external analytics backends](/api-management/logs/external-data-sinks).
+
+This page covers how Traffic Logs are generated and stored, and contains a full reference for every field they contain.
+
+### Traffic Log vs Access Log
+
+Both Traffic Logs and [Access Logs](/api-management/logs/access-logs) record individual requests, but serve different purposes:
+
+| | Traffic Log | Access Log |
+| :--- | :--- | :--- |
+| Written to | Redis, then onto Tyk Pump's configured destinations | `stderr` directly |
+| Timing | Asynchronous: read in batches from Redis by Tyk Pump | Real-time: written as the request completes |
+| Detail | Richer: full field set, with optional request/response bodies | Lightweight: limited to a configured template of fields |
+| Typical use | Tyk Dashboard's Traffic Analytics and Log Browser | External log aggregators, real-time troubleshooting |
+
+Use a Traffic Log when you need Tyk Dashboard's Traffic Analytics or Log Browser, or want request data routed to an external analytics backend via Tyk Pump.
+
+Use an Access Log when you want a lightweight, real-time per-request line in your existing log pipeline.
+
+## How Traffic Logs Are Generated
+
+When a client makes a request, Tyk Gateway generates a Traffic Log capturing the request and response details, and writes it to Redis when the request completes.
+
+Redis is a temporary, high-throughput buffer, not intended as a long-term store. [Tyk Pump](/api-management/tyk-pump) reads and purges the logs from there; see [Dashboard Analytics](/api-management/dashboard-analytics#where-the-data-comes-from) for what happens to the data after that.
+
+Enable traffic logging by setting [`enable_analytics`](/tyk-oss-gateway/configuration#enable_analytics) in the Gateway configuration:
+
+```json
+{
+    "enable_analytics": true
+}
+```
+
+To exclude specific APIs or endpoints entirely, use the [do-not-track middleware](/api-management/traffic-transformation/do-not-track).
+
+Individual request and response headers are not captured by default, aside from `user_agent`. The full set of headers, and the request and response bodies, are only captured when [Detailed Recording](#detailed-recording) is enabled.
+
+### Controlling Which Endpoints Are Tracked
+
+The [`track_path`](#param-track-path) field is set on each Traffic Log by the **Track Endpoint** middleware (`trackEndpoint` in Tyk OAS, `track_endpoints` in Tyk Classic), enabled per endpoint on the API definition:
+
+- Endpoints with Track Endpoint enabled get `track_path: true`.
+- Endpoints without it get `track_path: false`.
+
+For Tyk OAS APIs, enable it under the operation's ID in the `x-tyk-api-gateway.middleware.operations` section of the API definition. For example, to enable tracking for the `GET /status/200` operation:
+
+```yaml
+x-tyk-api-gateway:
+  middleware:
+    operations:
+      status/200get:
+        trackEndpoint:
+          enabled: true
+```
+
+<Note>
+This only determines the value of the `track_path` field. It's [Tyk Dashboard's aggregation](/api-management/dashboard-analytics#controlling-which-endpoints-are-tracked) that uses this field to decide whether an endpoint is broken out individually in its per-endpoint breakdowns. Despite the similar name, this is unrelated to [Do Not Track](/api-management/traffic-transformation/do-not-track), which suppresses the Traffic Log entirely.
+</Note>
+
+### Detailed Recording
+
+Tyk Gateway does not usually include the full request and response, with headers and body, in Traffic Logs, to keep them small and to avoid capturing sensitive data.
+
+If this level of detail is required, for example when debugging an API, you can use Tyk's **detailed recording** option. With this enabled, the complete request and response are included in wire format, base64-encoded, in the Traffic Log's [`raw_request`](#param-raw-request) and [`raw_response`](#param-raw-response) fields respectively.
+
+**Traffic logs generated for GraphQL APIs automatically include full request and response**, regardless of these config settings. See [GraphQL Fields](#graphql-fields).
+
+<Warning>
+Detailed recording captures the complete, unmodified request and response, including headers and body.
+
+If your APIs handle sensitive data, such as personally identifiable information, payment details, or authentication tokens and credentials, that data is captured too, and only base64-encoded, not encrypted, so it's trivially readable by anyone with access to the Traffic Log: in Tyk Dashboard's Log Browser, in Redis and persistent storage, or at any external destination Tyk Pump forwards it to. This can have real implications for regulatory compliance, such as GDPR or HIPAA.
+
+In production environments, ensure that you scope the use of detailed recording as narrowly as possible, at the [API](#api-level) or [Key](#key-level) level rather than Gateway-wide, and use [`omit_detailed_recording`](/api-management/tyk-pump#omit-detailed-recording) on any pump forwarding to a destination that doesn't need this data.
+
+Enabling detailed recording also significantly increases record size and storage requirements. Tyk Cloud users can enable it per API using the instructions below, or at the Gateway level through a support request; traffic logs are subject to the subscription's storage quota.
+</Warning>
+
+There are three levels of granularity at which detailed recording of logs can be configured:
+
+1. [API level](#api-level) to capture detailed records for all requests made to a specific API
+2. [Key level](#key-level) to capture detailed records for all requests made by a specific access token
+3. [Gateway level](#gateway-level) to capture detailed records for all requests to APIs on the Gateway
+
+<Tabs>
+<Tab title="API Level">
+
+Set [`server.detailedActivityLogs.enabled`](/api-management/gateway-config-tyk-oas#detailedactivitylogs) in the Tyk Vendor Extension, or use the **Record payload in traffic logs** option in the API Designer.
+
+<img src="/img/dashboard/api-designer/tyk-oas-detailed-logs.png" alt="Enabling detailed activity logs for a Tyk OAS API" />
+
+If using Tyk Classic APIs, set the equivalent [`enable_detailed_recording`](/api-management/gateway-config-tyk-classic#param-enable-detailed-recording), or use **Enable Detailed Logging** in **Core Settings** in the Tyk Classic API Designer.
+
+<img src="/img/dashboard/endpoint-designer/classic-detailed-logging.png" alt="Enabling detailed activity logs for a Tyk Classic API" />
+
+With Tyk Operator, set `spec.enable_detailed_recording` to `true`:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["10-10"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  enable_detailed_recording: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+</Tab>
+<Tab title="Key Level">
+
+Enable **Enable Detailed Logging** on the **2. Configurations** tab of the Key Designer to record detailed request and response data for transactions using that key (Session) only, useful for debugging a specific consumer.
+
+Alternatively, add the following to the root of the Session's JSON, for example when creating or updating keys via the [Keys API](/tyk-dashboard-api):
+
+```json
+"enable_detailed_recording": true
+```
+
+<Note>
+This setting is not available on [Policies](/api-management/policies), only directly on individual [Sessions](/api-management/access-control/sessions-and-keys/understanding-sessions).
+</Note>
+
+</Tab>
+<Tab title="Gateway Level">
+
+Enable [detailed recording](/tyk-oss-gateway/configuration#analytics_config-enable_detailed_recording) in `tyk.conf`, which affects all APIs on the Gateway:
+
+```json
+{
+    "enable_analytics": true,
+    "analytics_config": {
+        "enable_detailed_recording": true
+    }
+}
+```
+
+</Tab>
+</Tabs>
+
+<Note>
+Tyk Pump has additional, pump-specific options to give you granular control over whether and how this recorded data reaches its destination: see [Omit Detailed Recording](/api-management/tyk-pump#omit-detailed-recording) and [Decode Raw Request and Raw Response](/api-management/tyk-pump#decode-raw-request-and-raw-response).
+</Note>
+
+### Custom Tags
+
+Tyk Gateway can tag a Traffic Log with the value of any HTTP request header, such as `X-Account-ID`. This is useful when you need to distinguish traffic beyond the [standard fields](#traffic-log-field-reference), for example when several sub-accounts share a single API key and you need to differentiate between them in the logs.
+
+Configure custom tags by adding the header name to `middleware.global.trafficLogs.tagHeaders` in the Tyk Vendor Extension. For example:
+
+```yaml
+x-tyk-api-gateway:
+  middleware:
+    global:
+      trafficLogs:
+        tagHeaders:
+        - x-account-id
+```
+
+This will tag every Traffic Log for a request that includes an `x-account-id` header, using the value `x-account-id-<value>`.
+
+A request sent with `--header "x-account-id: 1234"` therefore produces a Traffic Log tagged `x-account-id-1234`, added to the [`tags`](#param-tags) field.
+
+If using Tyk Classic APIs, the equivalent field is [tag_headers](/api-management/gateway-config-tyk-classic#traffic-logs), also available in the Tyk Classic API Designer under **Advanced Options**:
+
+<img src="/img/custom-analytics-tags/tag-headers.png" alt="Tag Headers option in the Tyk Classic API Designer" />
+
+With Tyk Operator, set `spec.tag_headers`:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["10-12"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-tag-headers
+spec:
+  name: httpbin-tag-headers
+  use_keyless: true
+  protocol: http
+  active: true
+  tag_headers:
+  - Host
+  - User-Agent
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-tag-headers
+    strip_listen_path: true
+```
+
+<Note>
+Tyk Dashboard's Aggregate Pumps can compute hourly aggregates per distinct tag value observed; see [Custom Aggregation Tags](/api-management/dashboard-analytics#custom-aggregation-tags) for that usage.
+</Note>
+
+## Traffic Log Content
+
+Tyk Gateway writes each Traffic Log as a structured record, which Tyk Pump then serializes into whatever format a given [Pump](/api-management/tyk-pump) requires. An illustrative JSON representation, using the field names documented below, looks like:
+
+```json
+{
+  "method": "GET",
+  "host": "tyk.io",
+  "path": "/foo/bar",
+  "raw_path": "/foo/bar",
+  "original_path": "/api/v1/users",
+  "listen_path": "/api/v1/",
+  "content_length": 10,
+  "user_agent": "curl/7.86.0",
+  "raw_request": "",
+  "response_code": 200,
+  "raw_response": "",
+  "request_time": 3,
+  "latency": {"total": 4, "upstream": 3, "gateway": 1},
+  "api_id": "727dad853a8a45f64ab981154d1ffdad",
+  "api_name": "Foo API",
+  "api_version": "1",
+  "org_id": "5e9d9544a1dcd60001d0ed20",
+  "api_key": "6129dc1e8b64c6b4",
+  "oauth_id": "",
+  "alias": "my-key-alias",
+  "timestamp": "2022-11-16T03:01:54.648+00:00",
+  "day": 16,
+  "month": 11,
+  "year": 2022,
+  "hour": 3,
+  "expireAt": "2022-11-23T07:26:25.762+00:00",
+  "ip_address": "172.18.0.1",
+  "geo": {"country": {"iso_code": "SG"}, "city": {}, "location": {}},
+  "network": {"open_connections": 0, "closed_connections": 0, "bytes_in": 0, "bytes_out": 0},
+  "tags": ["key-00000000", "org-5e9d9544a1dcd60001d0ed20", "api-accbdd1b89e84ec97f4f16d4e3197d5c"],
+  "track_path": true
+}
+```
+
+<Note>
+SQL-based Pumps (Postgres) use different column names, and don't store `api_name`, `day`, `month`, `year`, `hour`, `api_schema`, `graphql_stats`, or `mcp_stats` at all.
+</Note>
+
+## Traffic Log Field Reference
+
+### Request
+
+<ParamField path="method">
+  Request method.
+
+  **Example:** `GET`, `POST`.
+</ParamField>
+
+<ParamField path="host">
+  Request `Host` header, including the host and optional port number of the server the request was sent to.
+
+  **Example:** `tyk.io`, or `tyk.io:8080` if a port is included.
+</ParamField>
+
+<ParamField path="path">
+  Request path, in decoded form.
+
+  **Example:** `/foo/bar` for `/foo%2Fbar` or `/foo/bar`.
+</ParamField>
+
+<ParamField path="raw_path">
+  Request path, decoded but otherwise unchanged from the original request.
+
+  **Example:** `/foo/bar` for `/foo%2Fbar` or `/foo/bar`.
+</ParamField>
+
+<ParamField path="original_path">
+  The client's request path, captured before Tyk Gateway applies any path-modifying middleware, such as stripping the API's listen path. Equal to `path` unless something changes the path during processing.
+
+  **Example:** `/api/v1/users`, when `path` is `/users` because the API's listen path `/api/v1/` was stripped.
+</ParamField>
+
+<ParamField path="listen_path">
+  The API's configured listen path.
+
+  **Example:** `/api/v1/`.
+</ParamField>
+
+<ParamField path="content_length">
+  Request `Content-Length` header: the number of bytes in the request body.
+
+  **Example:** `10` for a request body of `0123456789`.
+</ParamField>
+
+<ParamField path="user_agent">
+  Request `User-Agent` header.
+
+  **Example:** `curl/7.86.0`.
+</ParamField>
+
+<ParamField path="raw_request">
+  Base64-encoded copy of the request sent from Tyk Gateway to the upstream server. Empty unless [detailed recording](#detailed-recording) is enabled (automatic for GraphQL APIs). A pump can remove the base64 encoding via [`raw_request_decoded`](/api-management/tyk-pump#decode-raw-request-and-raw-response), or omit this field entirely via [`omit_detailed_recording`](/api-management/tyk-pump#omit-detailed-recording).
+
+  **Example:** `R0VUIC9nZXQgSFRUUC8xLjEKSG9zdDogdHlrLmlv`.
+</ParamField>
+
+### Response
+
+<ParamField path="response_code">
+  The integer response code, generated by either Tyk Gateway or the upstream server depending on how the request was handled.
+
+  **Example:** `200` for `200 OK`.
+</ParamField>
+
+<ParamField path="raw_response">
+  Base64-encoded copy of the response sent from Tyk Gateway to the client. Empty unless [detailed recording](#detailed-recording) is enabled (automatic for GraphQL APIs). A pump can remove the base64 encoding via [`raw_response_decoded`](/api-management/tyk-pump#decode-raw-request-and-raw-response), or omit this field entirely via [`omit_detailed_recording`](/api-management/tyk-pump#omit-detailed-recording).
+
+  **Example:** `SFRUUC8xLjEgMjAwIE9LCkNvbnRlbnQtTGVuZ3RoOiAxOQpEYXRlOiBXZWQsIDE2IE5vdiAyMDIyIDA2OjIxOjE2IEdNVApTZXJ2ZXI6IGd1bmljb3JuLzE5LjkuMAoKewogICJmb28iOiAiYmFyIgp9Cg==`.
+</ParamField>
+
+<ParamField path="request_time">
+  Duration of the upstream round trip, equal to `latency.total`.
+
+  **Example:** `3` for a 3ms round trip.
+</ParamField>
+
+<ParamField path="latency">
+  Contains three fields: `upstream`, the round trip between Tyk Gateway sending the request and receiving a response; `gateway`, additional Gateway-side processing outside that round trip, such as writing analytics; and `total`, the sum of both.
+
+  **Example:** `{"total":4,"upstream":3,"gateway":1}`.
+
+  <Note>
+  Measured from Tyk Gateway's reverse proxy: the sum of leaving Tyk, reaching the upstream, and the response returning to Tyk, plus Tyk Gateway's own processing time.
+  </Note>
+</ParamField>
+
+### API and Authentication
+
+<ParamField path="api_id">
+  The ID of the requested API definition.
+
+  **Example:** `727dad853a8a45f64ab981154d1ffdad`.
+</ParamField>
+
+<ParamField path="api_name">
+  The name of the requested API definition. Not stored by SQL-based Pumps.
+
+  **Example:** `Foo API`.
+</ParamField>
+
+<ParamField path="api_version">
+  The version of the requested API definition, or `Not Versioned` if the API is unversioned.
+
+  **Example:** `1`, `b`, or `Not Versioned`.
+</ParamField>
+
+<ParamField path="org_id">
+  The Organisation ID of the requested API definition.
+
+  **Example:** `5e9d9544a1dcd60001d0ed20`.
+</ParamField>
+
+<ParamField path="api_key">
+  The authentication key provided in the request. If no key was provided, Tyk Gateway substitutes a default value.
+
+  **Example:** an unhashed `auth_key`, a hashed value such as `6129dc1e8b64c6b4`, or `00000000` if no authentication was provided.
+
+  <Warning>
+  By default, Tyk Gateway stores the raw, unhashed API key in this field.
+
+  Anyone with access to Traffic Logs, whether in Tyk Dashboard's Log Browser, Redis, persistent storage, or any external destination Tyk Pump forwards them to, can read and reuse that key.
+
+  Enable [key hashing](/api-management/access-control/sessions-and-keys/key-hashing) so that this field contains a hash instead.
+  </Warning>
+</ParamField>
+
+<ParamField path="oauth_id">
+  The OAuth client ID, or an empty string if OAuth was not used.
+
+  **Example:** `my-oauth-client-id`.
+</ParamField>
+
+<ParamField path="alias">
+  The alias of the authenticated identity, blank if unset or the request is unauthenticated.
+
+  **Example:** `my-key-alias`.
+</ParamField>
+
+### Timestamps
+
+<ParamField path="timestamp">
+  Generated by Tyk Gateway when it finishes handling the request and writes the traffic log, not when it first received the request. For most requests the difference is small, roughly the request's own `request_time`, but it's after the upstream round trip, not before it.
+
+  **Example:** `2022-11-16T03:01:54.648+00:00`.
+</ParamField>
+
+<ParamField path="day">
+  Day of the month, derived from `timestamp`. Not stored by SQL-based Pumps.
+
+  **Example:** `16` for `2022-11-16T03:01:54Z`.
+</ParamField>
+
+<ParamField path="month">
+  Month, derived from `timestamp`. Not stored by SQL-based Pumps.
+
+  **Example:** `11` for `2022-11-16T03:01:54Z`.
+</ParamField>
+
+<ParamField path="year">
+  Year, derived from `timestamp`. Not stored by SQL-based Pumps.
+
+  **Example:** `2022` for `2022-11-16T03:01:54Z`.
+</ParamField>
+
+<ParamField path="hour">
+  Hour of the day, derived from `timestamp`. Not stored by SQL-based Pumps.
+
+  **Example:** `3` for `2022-11-16T03:01:54Z`.
+</ParamField>
+
+<ParamField path="expireAt">
+  A future expiry date, used to implement [automated data expiry](/api-management/dashboard-analytics/analytics-storage-management#ttl-indexes) where the storage backend supports it.
+
+  **Example:** `2022-11-23T07:26:25.762+00:00`.
+</ParamField>
+
+### Client
+
+<ParamField path="ip_address">
+  Client IP address, taken from the `X-Real-IP` or `X-Forwarded-For` header if set, otherwise determined by Tyk Gateway from the request.
+
+  **Example:** `172.18.0.1`.
+</ParamField>
+
+<ParamField path="geo">
+  Client geolocation, calculated from the IP address using the MaxMind database.
+
+  **Example:** `{"country":{"iso_code":"SG"},"city":{"geonameid":0,"names":{}},"location":{"latitude":0,"longitude":0,"timezone":""}}`.
+</ParamField>
+
+<ParamField path="network">
+  Network statistics. Not currently populated by Tyk Gateway.
+</ParamField>
+
+### Metadata
+
+<ParamField path="tags">
+  Session context tags, which can refer to the Gateway, API key, Organisation, API definition, and other dimensions.
+
+  **Example:** `["key-00000000","org-5e9d9544a1dcd60001d0ed20","api-accbdd1b89e84ec97f4f16d4e3197d5c"]`.
+</ParamField>
+
+<ParamField path="track_path">
+  `true` if the requested endpoint is configured to be tracked, otherwise `false`. See [Controlling Which Endpoints Are Tracked](#controlling-which-endpoints-are-tracked).
+</ParamField>
+
+### GraphQL Fields
+
+Only populated for requests to a GraphQL API; absent or empty for other requests. Not stored by SQL-based Pumps.
+
+<ParamField path="api_schema">
+  Base64-encoded copy of the API's GraphQL schema.
+
+  **Example:** `dHlwZSBRdWVyeSB7IGhlbGxvOiBTdHJpbmd9`.
+</ParamField>
+
+<ParamField path="graphql_stats">
+  Details about the GraphQL operation: `Variables`, `RootFields`, `Types`, `Errors`, `OperationType` (`0` Unknown, `1` Query, `2` Mutation, `3` Subscription), `HasErrors`, and `IsGraphQL`.
+
+  **Example:** `{"IsGraphQL":true,"OperationType":1,"RootFields":["hello"],"HasErrors":false}`.
+</ParamField>
+
+### MCP Fields
+
+Only populated for requests to an [MCP](/ai-management/mcp-gateway/overview) Proxy; absent or empty for other requests. Not stored by SQL-based Pumps.
+
+<ParamField path="mcp_stats">
+  Details about the MCP request: `is_mcp`, `jsonrpc_method`, `primitive_type` (`tool`, `resource`, or `prompt`), and `primitive_name`.
+
+  **Example:** `{"is_mcp":true,"jsonrpc_method":"tools/call","primitive_type":"tool","primitive_name":"get_current_weather"}`.
+</ParamField>
diff --git a/api-management/manage-apis/deploy-apis/deploy-apis-overview.mdx b/api-management/manage-apis/deploy-apis/deploy-apis-overview.mdx
new file mode 100644
index 0000000000..3053acc266
--- /dev/null
+++ b/api-management/manage-apis/deploy-apis/deploy-apis-overview.mdx
@@ -0,0 +1,56 @@
+---
+title: "API Creation Methods"
+description: "Different ways to create and manage APIs in Tyk"
+keywords: "API Management, API Configuration, Dashboard, Tyk Sync, Tyk Operator"
+sidebarTitle: "API Creation Methods"
+---
+
+This page explains the different methods available for creating and managing APIs in Tyk, each suited to different use cases and workflow requirements.
+
+## File-based configuration
+<a id="file-based-configuration"></a>
+
+Load API configurations directly to the `/apps` folder using JSON API specifications. This method is available for open source users and is ideal for testing gateway and API configurations.
+
+**Use case:** Testing and experimentation in development environments.
+
+**Learn more:**
+* [Create an API in file-based mode](/api-management/gateway-config-managing-classic#create-an-api-in-file-based-mode)
+
+## Dashboard UI
+
+Create and configure APIs through the web-based Dashboard interface. Changes take effect immediately, making this method suitable for learning, testing, and proof-of-concept work.
+
+**Use case:** Manual API management, learning, and proof-of-concept projects.
+
+**Learn more:**
+* [Create an API with the Dashboard](/api-management/gateway-config-managing-classic#create-an-api-with-the-dashboard)
+
+## Dashboard and Gateway API
+
+Programmatically create and manage APIs, policies, keys, and developer portals using REST APIs. This method provides flexibility for automation but requires imperative scripting.
+
+**Use case:** Programmatic API management and basic automation needs.
+
+**Learn more:**
+- [Dashboard API](/tyk-dashboard-api)
+- [Gateway API](/tyk-gateway-api)
+
+## Tyk Sync
+
+Manage API configurations declaratively using version-controlled files. Tyk Sync enables GitOps workflows by maintaining API configurations as code that can be versioned and deployed through CI/CD pipelines.
+
+**Use case:** GitOps workflows and teams requiring version-controlled API configurations.
+
+**Learn more:**
+- [Tyk Sync](/api-management/automations/sync)
+
+## Tyk Operator
+
+Kubernetes-native API management using Custom Resource Definitions (CRDs). Tyk Operator provides declarative configuration with automatic drift detection and reconciliation in Kubernetes environments.
+
+**Use case:** Kubernetes-native environments requiring automated API lifecycle management.
+
+**Learn more:**
+- [Tyk Operator](/api-management/automations/operator#what-is-tyk-operator)
+- [Using Tyk Operator to enable GitOps](/api-management/automations)
diff --git a/api-management/mdcb.mdx b/api-management/mdcb.mdx
new file mode 100644
index 0000000000..ae62c43f02
--- /dev/null
+++ b/api-management/mdcb.mdx
@@ -0,0 +1,1004 @@
+---
+title: "Using Tyk In Distributed Environments"
+description: "Learn about Tyk Multi Data Center Bridge (MDCB) and how it enables you to manage multiple API gateways across different data centers"
+keywords: "MDCB, Multi Data Center Bridge, Control Plane, Data Plane, Synchroniser"
+sidebarTitle: "Manage Distributed Gateways"
+---
+
+## Overview
+
+Tyk’s Multi Data Center Bridge (MDCB) is a separately licensed extension to the Tyk control plane that performs management and synchronization of logically or geographically distributed clusters of Tyk API Gateways. We use it ourselves to support our Tyk Cloud offering.
+
+### Challenges in Distributed Environment
+
+When your users are spread geographically and want to access your APIs from different parts of the world you can optimize the performance, value and utility of your APIs by deploying API Gateways in data centers local to them.
+
+<img src="/img/mdcb/mdcb-intro1.png" alt="Single API gateway" width="800" height="975" />
+
+Having localised gateways offers benefits to you and your users, such as:
+
+- Reduced latency (roundtrip time) for users by accessing a local data center
+- Deployment close to backend services, reducing interconnect costs and latencies
+- Increased availability across your estate - if one region goes offline the rest will continue to serve users
+- Compliance with data residency and sovereignty regulations
+
+<img src="/img/mdcb/mdcb-intro2.png" alt="Distributed API gateways" width="800" height="975" />
+
+This distributed architecture, however, introduces challenges for you in terms of managing the configuration, synchronization and resilience of the Gateways in each data center.
+
+- How do you configure each of the Tyk API Gateways to ensure that a user can access only their authorized APIs, but from any location?
+- How can you ensure that the correct APIs are deployed to the right Gateways - and kept current as they are updated?
+
+As the complexity of your architecture increases, this maintenance becomes an increasingly difficult and expensive manual task.
+
+This is where Tyk’s Multi Data Center Bridge (MDCB) comes in.
+
+### How does Tyk Multi Data Center Bridge help?
+
+The Tyk MDCB makes it possible to manage federated global deployments easily, from a central Dashboard: you can confidently deploy a multi-data center, geographically isolated set of Tyk Gateway clusters for maximum redundancy, failover, latency optimization, and uptime.
+
+Combining Tyk Dashboard with MDCB, you are provided with a “single pane of glass” or control plane that allows you to centrally manage multiple Tyk Gateway clusters. This has many advantages over having separate gateways and corresponding dashboard/portals, which would require manual synchronization to roll out any changes (e.g. new APIs) across all the individual gateways. 
+
+By deploying MDCB, API Management with Tyk becomes a service that can be easily offered to multiple teams from a centralised location.
+
+<img src="/img/mdcb/mdcb-intro3.png" alt="Distributed API Gateways with MDCB" width="800" height="975" />
+
+### How does MDCB work?
+
+MDCB acts as a broker between the Tyk Gateway instances that you deploy in data centers around the world. A single Control Plane (Management) Gateway is used as reference: you configure APIs, keys and quotas in one central location; MDCB looks after the propagation of these to the Data Plane Gateways, ensuring the synchronization of changes.
+
+MDCB is extremely flexible, supporting clusters of Tyk Gateways within or across data centers - so for example two clusters within the same data center could run different configurations of APIs, users etc.
+
+MDCB keeps your Tyk API Gateways highly available because all the Data Plane Gateways, where your users access your APIs, can be configured and run independently. If the MDCB link back to the Management Gateway goes down, the Data Plane Gateways will continue to service API requests; when the link is back up, MDCB will automatically refresh the Data Planes with any changes they missed.
+
+<img src="/img/mdcb/mdcb-intro4.png" alt="Multi Data Center Bridge is down" width="800" height="975" />
+
+What happens if the worst happens and Data Plane Gateways fail while the link to the Control Plane is down? We’ve thought of that: Tyk will automatically configure the new Gateways that spin up using the last known set of API resources in the Data Plane cluster, minimizing the impact on availability of your services.
+
+### When might you deploy MDCB?
+
+#### Managing geographically distributed gateways to minimize latency and protect data sovereignty
+
+Consider Acme Global Bank: they have customers in the USA and the EU. Due to compliance, security and performance requirements they need to deploy their Tyk API Gateways locally in each of those regions. They need to manage the deployment and synchronization of APIs and associated resources (e.g. keys, policies and certificates) between the data centers to ensure global service for their customers.
+
+<img src="/img/mdcb/mdcb-acme-global-bank1.png" alt="Acme Global Bank without MDCB" width="600" height="750" />
+
+Tyk MDCB enables Acme Global Bank to power this architecture by creating a primary data center with all the Tyk Control Plane components and secondary (Data Plane) data centers that act as local caches to run validation and rate limiting operations to optimize latency and performance.
+
+<img src="/img/mdcb/mdcb-acme-global-bank2.png" alt="Acme Global Bank with MDCB" width="600" height="750" />
+
+#### Managing a complex deployment of services with internal and externally facing APIs
+
+Consider Acme Telecoms: they have a large nationally distributed workforce and complex self-hosted IT systems; are using Tyk API Gateways to deploy internal and external APIs; and have different teams managing and consuming different sets of APIs across multiple sites. They need to ensure data segregation, availability, and access for internal and external users and partners.
+
+<img src="/img/mdcb/mdcb-acme-telecoms1.png" alt="Acme Telecoms without MDCB" width="600" height="750" />
+
+Combining Tyk’s built-in multi-tenancy capability with MDCB enables Acme Telecoms to set up dedicated logical gateways for different user groups and different physical gateways to guarantee data segregation, with a single management layer for operational simplicity.
+
+<img src="/img/mdcb/mdcb-acme-telecoms2.png" alt="Acme Telecoms with MDCB" width="600" height="750" />
+
+### Why Choose MDCB for Your API Infrastructure?
+
+Beyond the two usage scenarios described here, there are many others where MDCB will provide you with the power and flexibility you need to manage your own particular situation.
+
+Here are some examples of the benefits that deploying Tyk MDCB can bring:
+
+#### Flexible architecture
+
+- You can control geographic distribution of traffic, restricting traffic to data centers/regions of your choice.
+- You can put your Tyk API Gateways close to users, but still have a single management layer.
+- You have a single, simple, point of access for configuration of your complex API infrastructure and yet deploy multiple Developer Portals, if required, to provide access to different user groups (e.g. Internal and External).
+- You can physically [segment teams and environments](/api-management/api-sharding#gateway-sharding) within a single physical data center, giving each team full control of its own API gateway and server resources without the noisy neighbors you might experience in a standard self-managed deployment.
+- You can deploy gateways with whichever mix of cloud vendors you wish.
+- You can mix and match cloud and on premises data centers.
+
+#### Improved resiliency, security and uptime
+
+- Each Data Plane Gateway operates autonomously using a locally stored copy of the API resources it needs.
+- The Control Plane (Management) Gateway maintains synchronization of these configurations across your Tyk deployment via the MDCB backbone link.
+- If the Management Gateway or MDCB backbone fails, the Data Planes will continue to handle API requests, rejecting only new authorization tokens created on other Gateways. When connectivity is restored, the Data Plane Gateways will hot-reload to fetch any updated configurations (e.g. new authorization tokens) from the Control Plane.
+- If a Data Plane Gateway fails, this does not impact the operation of the others: when it comes back online, if it is unable to contact the Control Plane, it will retrieve the “last good” configuration held locally.
+- The MDCB backbone runs on a resilient compressed RPC channel that is designed to handle ongoing and unreliable connectivity; all traffic on the backbone is encrypted and so safer to use over the open internet or inter-data center links.
+- Improved data security through separation of traffic into completely separate clusters within your network.
+
+#### Reduced latency
+
+- Deploying Data Plane Gateways close to your geographically distributed API consumers helps reduce their perceived request latency.
+- Deploying Data Plane Gateways close to your backend services will minimize round trip time servicing API requests.
+- The Data Plane Gateways cache keys and other configuration locally, so all operations can be geographically localised.
+- All traffic to and from one Gateway cluster will have rate limiting, authentication and authorization performed within the data center rather than “calling home” to a central control point; this reduces the  API request round trip time.
+
+#### Improved Infrastructure Management
+
+- Due to the shared Control Plane, all Data Plane Gateways report into a single Tyk Dashboard. This provides a simple, consistent place to manage your APIM deployment.
+- This allows a shared infra team to offer API management and API Gateways as a service, globally, across multiple clouds and Self-Managed regions, from a single pane of glass.
+
+#### Next Steps
+
+- [The components of an MDCB deployment](/api-management/mdcb#mdcb-components)
+- [Run an MDCB Proof of Concept](/api-management/mdcb#minimizing-latency-with-mdcb)
+- [MDCB reference guide](/tyk-multi-data-centre/mdcb-configuration-options)
+
+## MDCB Components
+
+### Overview
+
+Here we will give an overview of the main elements of a Tyk Multi Data Center (distributed) solution, clarifying the terminology used by Tyk.
+<img src="/img/mdcb/mdcb-components.png" alt="A Tyk Multi Data Center Bridge deployment" width="800" height="975" />
+
+#### Tyk Gateway 
+- The workhorse of any deployment, Tyk’s lightweight Open Source API gateway that exposes your APIs for consumption by your users. It is a reverse proxy that secures your APIs, manages session and policies, monitors, caches and manipulates requests/responses when needed before/after it proxies them to and from the upstream.
+
+#### Tyk Dashboard
+- Tyk’s management platform used to control the creation of API configurations, policies and keys in a persistent manner. It provides analytic information on the traffic the Gateways have processed which includes aggregated API usage and detailed information per transaction.
+
+#### Tyk Multi Data Center Bridge (MDCB)
+- The backbone of the distributed Tyk deployment, connecting the distributed Data Plane deployments back to the Control Plane.
+
+#### Tyk Pump
+- Tyk’s open source analytics purger that can be used to export transaction logs from the Tyk deployment to the visualisation tool or other data store of your choice
+
+#### Tyk Developer Portal
+- The access point for your API Consumers where you publish your API catalog(s) and they obtain API keys.
+
+#### Redis
+- An in-memory data store used as a database, cache and message broker. We use it as pub/sub broker for inter-Gateway communication, and as a cache for API configurations, keys, certificates, and temporary store for analytics records.
+
+#### MongoDB/SQL
+- A persistent data store for API configurations, policies, analytics and aggregated analytics, Dashboard organizations, configurations, dashboard users, portal developers and configuration.
+
+
+### Control Plane
+<img src="/img/mdcb/mdcb-control-plane.png" alt="The Tyk Control Plane" width="800" height="975" />
+
+The Control Plane must consist of the following elements:
+- **Tyk Dashboard** (used to configure and control the whole Tyk installation)
+- **Tyk Gateway** (used for creation of keys and certificates, this does not service API requests; it is important to ensure there is no public access to it and it must not be sharded (tagged) as it "belongs" to the whole Tyk installation)
+- **Tyk MDCB**
+- **Redis** (high availability Redis data store that should be backed up in case of failure; this [document](https://redis.io/docs/management/persistence/) gives recommendation on Redis persistency)
+- **MongoDB or SQL** (a persistent data store that should be deployed and set up for redundancy and high availability)
+
+To improve resilience and availability, multiple instances of each Tyk component should be deployed and load balanced within the Control Plane.
+
+#### Optional Components
+- One or more **Tyk Pumps** can be deployed within the Control Plane to export analytics data (request/response logs) to your [data sink of choice](/api-management/logs/external-data-sinks) for further analytics and visualisation.
+- A **Tyk Developer Portal** can be added to enhance the end-user experience when accessing your APIs.
+ 
+### Data Plane
+<img src="/img/mdcb/mdcb-data-plane.png" alt="The Tyk Data Plane" width="800" height="975" />
+
+The Data Plane deployment must consist of the following elements:
+- **Tyk Gateway** (one or more Gateways specifically configured to operate in the Data Plane)
+- **Redis** (a single Redis data store shared by all Gateways in the cluster)
+
+To provide resilience and availability, multiple Gateways should be deployed and load balanced within the cluster.
+If you want this Data Plane deployment to be resilient, available, and independent from the Control Plane during a disconnection event, it is advised to make the Redis data store persistent.
+
+#### Optional Components
+- A **Tyk Pump** specifically configured as a [Hybrid Pump](/product-stack/tyk-charts/tyk-data-plane-chart#hybrid-pump) can be deployed with the Data Plane gateways to export analytics data (request/response logs) to your [data sink of choice](/api-management/logs/external-data-sinks) for further analytics and visualisation.
+
+## Setup MDCB Control Plane
+
+The [Tyk control plane](/api-management/mdcb#control-plane) contains all the
+standard components of a standard Tyk Self-Managed installation with the addition of the Multi Data Center Bridge (MDCB).
+
+### Installing MDCB Component On Linux
+The MDCB component must be able to connect to Redis and MongoDB/PostgreSQL directly from within the Control Plane deployment. It does not require access to the Tyk Gateway(s) or Dashboard application.
+
+The MDCB component will however, by default, expose an RPC service on port 9091, to which the [Tyk Data Plane](/api-management/mdcb#data-plane) data centers, i.e. the Gateways that serve API traffic, will need connectivity.
+
+#### Prerequisites
+We will assume that your account manager has provided you with a valid MDCB and Dashboard License and the command to enable you to download the MDCB package.
+We will assume that the following components are up and running in your Controller DC:
+
+* MongoDB or SQL (check [supported versions](/planning-for-production/database-settings))
+* Redis (check [supported versions](/tyk-self-managed/install#redis))
+* Tyk Dashboard
+* Tyk Gateway / Gateways Cluster
+* Working Tyk-Pro [Self-Managed installation](/tyk-self-managed/install)
+
+
+
+    <Note>
+    When using SQL rather than MongoDB in a production environment, we only support PostgreSQL.
+    </Note>
+
+
+#### Installing using RPM and Debian packages
+To download the relevant MDCB package from PackageCloud:
+
+```curl
+curl -s https://packagecloud.io/install/repositories/tyk/tyk-mdcb-stable/script.deb.sh | sudo bash
+```
+
+```curl
+curl -s https://packagecloud.io/install/repositories/tyk/tyk-mdcb-stable/script.rpm.sh | sudo bash
+```
+
+After the relevant script for your distribution has run, the script will let you know it has finished with the following message:
+
+`The repository is setup! You can now install packages.`
+
+You will now be able to install MDCB as follows:
+
+```curl
+sudo apt-get install tyk-sink
+```
+
+Or
+
+```curl
+sudo yum install tyk-sink
+```
+
+### Installing in a Kubernetes Cluster with our Helm Chart
+
+The [Tyk Control Plane](/product-stack/tyk-charts/tyk-control-plane-chart) helm chart is pre-configured to install Tyk control plane for multi data center API management from a single Dashboard with the MDCB component.
+
+Below is a concise instruction on how to set up an MDCB Control Plane with Redis and PostgreSQL.
+
+To access the comprehensive installation instructions and configuration options, please see [Tyk Control Plane Helm Chart](/product-stack/tyk-charts/tyk-control-plane-chart).
+
+#### Prerequisites
+- [Kubernetes 1.19+](https://kubernetes.io/docs/setup/)
+- [Helm 3+](https://helm.sh/docs/intro/install/)
+- MDCB and Dashboard license
+
+#### Quick Start
+
+1. **Setup required credentials**
+
+    First, you need to provide Tyk Dashboard and MDCB license, admin email and password, and API keys. We recommend to store them in secrets.
+
+    ```bash
+    NAMESPACE=tyk-cp
+
+    API_SECRET=changeit
+    ADMIN_KEY=changeit
+    ADMIN_EMAIL=admin@default.com
+    ADMIN_PASSWORD=changeit
+    DASHBOARD_LICENSE=changeit
+    MDCB_LICENSE=changeit
+    SECURITY_SECRET=changeit
+    OPERATOR_LICENSE=changeit
+
+    kubectl create namespace $NAMESPACE
+
+    kubectl create secret generic my-secrets -n $NAMESPACE \
+        --from-literal=APISecret=$API_SECRET \
+        --from-literal=AdminSecret=$ADMIN_KEY \
+        --from-literal=DashLicense=$DASHBOARD_LICENSE \
+        --from-literal=OperatorLicense=$OPERATOR_LICENSE
+
+    kubectl create secret generic mdcb-secrets -n $NAMESPACE \
+        --from-literal=MDCBLicense=$MDCB_LICENSE \
+        --from-literal=securitySecret=$SECURITY_SECRET
+
+    kubectl create secret generic admin-secrets -n $NAMESPACE \
+        --from-literal=adminUserFirstName=Admin \
+        --from-literal=adminUserLastName=User \
+        --from-literal=adminUserEmail=$ADMIN_EMAIL \
+        --from-literal=adminUserPassword=$ADMIN_PASSWORD
+    ```
+
+2. **Install Redis (if you don't already have Redis installed)**
+
+    If you do not already have Redis installed, you may use these charts provided by Bitnami.
+
+    ```bash
+    helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --install --version 19.0.2 --set image.repository=bitnamilegacy/redis
+    ```
+    Follow the notes from the installation output to get connection details and password. The DNS name of your Redis as set by Bitnami is `tyk-redis-master.tyk-cp.svc:6379` (Tyk needs the name including the port) 
+
+    The Bitnami chart also creates a secret `tyk-redis` which stores the connection password in `redis-password`. We will make use of this secret in installation later.
+
+    
+<Note>
+Ensure that you are installing Redis versions that are supported by Tyk. Please consult the list of [supported versions](/tyk-self-managed/install#redis) that are compatible with Tyk.
+</Note>
+
+
+3. **Install PostgreSQL (if you don't already have PostgreSQL installed)**
+
+    If you do not already have PostgreSQL installed, you may use these charts provided by Bitnami.
+
+    ```bash
+    helm upgrade tyk-postgres oci://registry-1.docker.io/bitnamicharts/postgresql --set "auth.database=tyk_analytics" -n $NAMESPACE --install --version 14.2.4 --set image.repository=bitnamilegacy/postgresql
+    ```
+
+    Follow the notes from the installation output to get connection details.
+
+    We require the PostgreSQL connection string for Tyk installation. This can be stored in a secret and will be used in installation later.
+
+    ```bash
+    POSTGRESQLURL=host=tyk-postgres-postgresql.$NAMESPACE.svc\ port=5432\ user=postgres\ password=$(kubectl get secret --namespace $NAMESPACE tyk-postgres-postgresql -o jsonpath="{.data.postgres-password}" | base64 -d)\ database=tyk_analytics\ sslmode=disable
+
+    kubectl create secret generic postgres-secrets  -n $NAMESPACE --from-literal=postgresUrl="$POSTGRESQLURL"
+    ```
+
+    
+<Note>
+Ensure that you are installing PostgreSQL versions that are supported by Tyk. Please consult the list of [supported versions](/tyk-self-managed/install#requirements) that are compatible with Tyk.
+</Note>
+
+
+4. **Install Tyk Control Plane**
+
+    ```bash
+    helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+
+    helm repo update
+
+    helm upgrade tyk-cp tyk-helm/tyk-control-plane -n $NAMESPACE \
+    --install \
+    --set global.adminUser.useSecretName=admin-secrets \
+    --set global.secrets.useSecretName=my-secrets \
+    --set tyk-mdcb.mdcb.useSecretName=mdcb-secrets \
+    --set global.redis.addrs="{tyk-redis-master.$NAMESPACE.svc:6379}" \
+    --set global.redis.passSecret.name=tyk-redis \
+    --set global.redis.passSecret.keyName=redis-password \
+    --set global.postgres.connectionStringSecret.name=postgres-secrets \
+    --set global.postgres.connectionStringSecret.keyName=postgresUrl
+    ```
+
+5. **Done!**
+
+    Now Tyk Dashboard and Tyk MDCB should be accessible through service `dashboard-svc-tyk-cp-tyk-dashboard` at port `3000` and `mdcb-svc-tyk-cp-tyk-mdcb` at port `9091` respectively. You can login to Dashboard using the admin email and password to start managing APIs.
+
+    You can use the MDCB connection details included in the installation output, to install the [MDCB Data Plane](/api-management/mdcb#setup-mdcb-data-plane).
+
+### Configuration
+If you install MDCB component with package, modify your `/opt/tyk-sink/tyk_sink.conf` file as follows:
+
+#### Configuration Example
+```json
+{
+  "listen_port": 9091,
+  "healthcheck_port": 8181,
+  "server_options": {
+    "use_ssl": false,
+    "certificate": {
+      "cert_file": "<path>",
+      "key_file": "<path>"
+    },
+    "min_version": 771
+  },
+  "storage": {
+    "type": "redis",
+    "host": "localhost",
+    "port": 6379,
+    "username": "",
+    "password": "",
+    "enable_cluster": false,
+    "redis_use_ssl": false,
+    "redis_ssl_insecure_skip_verify": false
+  },
+  "basic-config-and-security/security": {
+    "private_certificate_encoding_secret": "<gateway-secret>"
+  },
+  "hash_keys": true,
+  "forward_analytics_to_pump": true,
+  "ignore_tag_prefix_list": [
+    
+  ],
+  "analytics": {
+    "mongo_url": "mongodb://localhost/tyk_analytics",
+    "mongo_use_ssl": false,
+    "mongo_ssl_insecure_skip_verify": false
+  },
+  "license": "MDCB_LICENSE_KEY"
+}
+```
+
+For the synchronization of [TLS certificates](/api-management/certificates#encryption-of-the-private-key) to Data Planes, the value of [security.private_certificate_encoding_secret](/tyk-multi-data-centre/mdcb-configuration-options#security-private_certificate_encoding_secret) must be identical across all components involved: your Tyk Dashboard, your Control Plane and Data Plane Gateways, and your Tyk MDCB instances.
+
+<Note>
+From MDCB 2.0+, you can choose between Mongo or SQL databases to setup your `analytics` storage. In order to setup your PostgreSQL storage, you can use the same configuration from your [Tyk Dashboard main storage](/planning-for-production/database-settings#postgresql).
+
+For example, to set up a `postgres` storage the `analytics` configurations would be:
+
+```json
+{
+...
+  ...
+  "analytics": {
+      "type": "postgres",
+      "connection_string": "user=postgres_user password=postgres_password database=dbname host=potgres_host port=postgres_port",
+      "table_sharding": false
+  },
+} 
+```
+This storage will work for fetching your organization data (APIs, Policies, etc) and for analytics.
+</Note>
+
+
+You should now be able to start the MDCB service, check that it is up and running and ensure that the service starts on system boot:
+
+```console
+sudo systemctl start tyk-sink
+```
+
+
+```console
+sudo systemctl enable tyk-sink
+```
+
+### Health check
+
+It is possible to perform a health check on the MDCB service. This allows you to determine if the service is running, so is useful when using MDCB with load balancers.
+
+Health checks are available via the HTTP port. This is defined by `http_port` configuration setting and defaults to `8181`. Do **not** use the standard MDCB listen port (`listen_port`) for MDCB health checks.
+
+From MDCB v2.7.0, there are 2 health check services available:
+1. `/liveness` endpoint returns a `HTTP 200 OK` response when the service is operational.
+2. `/readiness` endpoint returns a `HTTP 200 OK` response when MDCB is ready to accept requests. It ensures that dependent components such as Redis and data store are connected, and the gRPC server is ready for connection.
+
+See [MDCB API](/tyk-mdcb-api) for details of the endpoints.
+
+In MDCB v2.6.0 or earlier, MDCB only offers one health check endpoint at `/health` via the port defined by the `healthcheck_port` configuration setting. The default port is `8181`. The `/health` endpoint is also available on v2.7.0 or later for backward compatibility.
+
+To use the health check service, call the `/health` endpoint i.e. `http://my-mdcb-host:8181/health`. This will return a `HTTP 200 OK` response if the service is running.
+
+Please note that an HTTP 200 OK response from the `/health` endpoint merely indicates that the MDCB service is operational. However, it is important to note that the service may not yet be ready for use if it is unable to establish a connection with its dependent components (such as Redis and Data store) or if they are offline. Upgrade to v2.7.0 and later to have more accurate health checking.
+
+### Troubleshooting
+
+#### Check that the MDCB service is running 
+
+```console
+sudo systemctl status tyk-sink
+```
+
+Should Return:
+
+```console
+tyk-sink.service - Multi Data Center Bridge for the Tyk API Gateway
+
+  Loaded: loaded (/usr/lib/systemd/system/tyk-sink.service; enabled; vendor preset: disabled)
+
+  Active: active (running) since Thu 2018-05-03 09:39:37 UTC; 3 days ago
+  Main PID: 1798 (tyk-sink)
+
+  CGroup: /system.slice/tyk-sink.service
+
+      └─1798 /opt/tyk-sink/tyk-sink -c /opt/tyk-sink/tyk_sink.conf
+```
+
+#### Check that MDCB is listening on port 9091
+
+```console
+sudo netstat -tlnp
+```
+
+Should Return:
+
+```
+Active Internet connections (only servers)
+Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
+...
+tcp6       0      0 :::9091                 :::*                    LISTEN      1798/tyk-sink
+```
+
+#### Check the logs for MDCB
+
+```{.copyWrapper}
+> sudo journalctl -u tyk-sink 
+```
+
+Add the `-f` flag to follow the log. The command should return output similar to this:
+
+```console
+-- Logs begin at Thu 2018-05-03 09:30:56 UTC, end at Mon 2018-05-07 08:58:23 UTC. --
+May 06 11:50:37 master tyk-sink[1798]: time="2018-05-06T11:50:37Z" level=info msg="RPC Stats:{\"RPCCalls\":0,\"RPCTime\":0,\"Byte
+May 06 11:50:38 master tyk-sink[1798]: time="2018-05-06T11:50:38Z" level=info msg="RPC Stats:{\"RPCCalls\":0,\"RPCTime\":0,\"Byte
+...
+May 06 11:50:42 master tyk-sink[1798]: time="2018-05-06T11:50:42Z" level=info msg="Ping!"
+```
+
+#### Check MDCB configurations
+
+From MDCB v2.7.0, a secured HTTP endpoint `/config` can be enabled that allows you to query configuration of MDCB.
+
+To enable the secured HTTP endpoint, make sure you have the following in your `/opt/tyk-sink/tyk_sink.conf` config file.
+
+```json
+{
+  "security": {
+    "enable_http_secure_endpoints": true,
+    "secret": "<secured-endpoint-secret>"
+  },
+  "http_server_options": {
+    "use_ssl": true,
+    "certificate": {
+      "cert_file": ...,
+      "key_file": ...,
+      "min_version": ...
+    }
+  }
+}
+```
+
+Subsequently, you can issue a request to the `/config` endpoint to return a json representation of your MDCB config:
+
+```bash
+curl -H "x-tyk-authorization: <secured-endpoint-secret>" https://my-mdcb-host:8181/config
+```
+
+Alternatively, you can issue a request to the `/env` endpoint to return your MDCB config in the form of environment variables settings:
+
+```bash
+curl -H "x-tyk-authorization: <secured-endpoint-secret>" https://my-mdcb-host:8181/env
+```
+
+### Enabling MDCB on Organization Object on Tyk Dashboard
+
+Before a Data Plane Gateway can connect to MDCB, it is important to enable the organization that owns all the APIs to be distributed to be allowed to utilize Tyk MDCB. To do this, the organization record needs to be modified with two flags using the [Tyk Dashboard Admin API](/dashboard-admin-api).
+
+To make things easier, we will first set a few [environment variables](/tyk-oss-gateway/configuration):
+
+1. `export DASH_ADMIN_SECRET=<YOUR_ADMIN_SECRET>`
+
+You can find `<YOUR_ADMIN_SECRET>` in `tyk_analytics.conf` file under `admin_secret` field or `TYK_DB_ADMINSECRET` environment variable.
+
+2. `export DASH_URL=<YOUR_DASH_URL>`
+
+This is the URL you use to access the Dashboard (including the port if not using the default port).
+
+3. `export ORG_ID=<YOUR_ORG_ID>`
+
+You can find your organization id in the Dashboard, under your user account details.
+
+<img src="/img/2.10/user_api_id.png" alt="Org ID" />
+
+4. Send a GET request to the Dashboard API to `/admin/organisations/$ORG_ID` to retrieve the organization object. In the example below, we are redirecting the output json to a file `myorg.json` for easy editing.
+
+```curl
+curl $DASH_URL/admin/organisations/$ORG_ID -H "Admin-Auth: $DASH_ADMIN_SECRET" | python -mjson.tool > myorg.json
+```
+5. Open `myorg.json` in your favorite text editor and add the following fields as follows.
+New fields are between the `...` .
+
+```json {linenos=table,hl_lines=["5-12"],linenostart=1}
+{
+  "_id": "55780af69b23c30001000049",
+  "owner_slug": "portal-test",
+  ...
+  "hybrid_enabled": true,
+  "event_options": {
+    "key_event": {
+         "webhook": "https://example.com/webhook",
+         "email": "user@example.com",
+         "redis": true
+    },
+  },
+  ...
+  "apis": [
+    {
+      "api_human_name": "HttpBin (again)",
+      "api_id": "2fdd8512a856434a61f080da67a88851"
+    }
+  ]
+}
+```
+
+In the example above it can be seen that the `hybrid_enabled` and `event_options` configuration fields have been added:
+
+- `hybrid_enabled:` Allows a Data Plane Gateway to login as an Organisation member into MDCB.
+- `event_options:` The `event_options` object is optional. By default the update and removal of Redis keys (hashed and unhashed), API Definitions and policies are propagated to various instance zones. The `event_options` object contains a `key_event` object that allows configuration of the following additional features:
+
+  - event notification mechanism for all Redis key (hashed and unhashed) events. Events can be notified via webhook by setting the `webhook` property to the value of the webhook URL. Similarly, events can be notified via email by setting the `email` property to the value of the target email address.
+  - enable propagation of events for when an OAuth token is revoked from Dashboard by setting the `redis` property to `true`.
+  
+  The `event_options` in the example above enables the following functionality:
+
+  - events are propagated when OAuth tokens are revoked from Dashboard since `redis` is `true`
+  - events associated with Redis keys (hashed and unhashed) and revoking OAuth tokens via Dashboard are sent to webhook `https://example.com/webhook` and email address `user@example.com`
+
+6. Update your organization with a PUT request to the same endpoint, but this time, passing in your modified `myorg.json` file.
+
+```curl
+curl -X PUT $DASH_URL/admin/organisations/$ORG_ID -H "Admin-Auth: $DASH_ADMIN_SECRET" -d @myorg.json
+```
+
+This should return:
+
+```json
+{"Status":"OK","Message":"Org updated","Meta":null}
+```
+
+## Setup MDCB Data Plane
+
+You may configure an unlimited number of [Tyk Data Planes](/api-management/mdcb#data-plane) containing Gateways for ultimate High Availablity (HA). We recommend that you deploy your Data Plane Gateways as close to your upstream services as possible in order to reduce latency.
+
+It is a requirement that all the Gateways in a Data Plane data center share the same Redis DB in order to take advantage of Tyk's DRL and quota features.
+Your Data Plane can be in the same physical data center as the Control Plane with just a logical network separation. If you have many Tyk Data Planes, they can be deployed in a private-cloud, public-cloud, or even on bare-metal.
+
+### Installing in a Kubernetes Cluster with our Helm Chart
+
+The [Tyk Data Plane](/product-stack/tyk-charts/tyk-data-plane-chart) helm chart is pre-configured to install Tyk Gateway and Tyk Pump that connects to MDCB or Tyk Cloud, our SaaS MDCB Control Plane. After setting up Tyk Control Plane with Helm Chart, obtain the required connection details from installation output and configure data plane chart as below. For Tyk Cloud users, following [Tyk Cloud instructions](/tyk-cloud/environments-deployments/hybrid-gateways) to deploy your hybrid gateways.
+
+#### Prerequisites
+
+* [Kubernetes 1.19+](https://kubernetes.io/docs/setup/)
+* [Helm 3+](https://helm.sh/docs/intro/install/)
+* Connection details to remote control plane from the tyk-control-plane installation output.
+
+The following quick start guide explains how to use the [Tyk Data Plane Helm chart](/product-stack/tyk-charts/tyk-data-plane-chart) to configure Tyk Gateway that includes:
+- Redis for key storage
+- Tyk Pump to send analytics to Tyk Control Plane and Prometheus
+
+At the end of this quickstart Tyk Gateway should be accessible through service `gateway-svc-tyk-dp-tyk-gateway` at port `8080`. Pump is also configured with Hybrid Pump which sends aggregated analytics to MDCB, and Prometheus Pump which expose metrics locally at `:9090/metrics`.
+
+1. **Set connection details**
+
+    Set the below environment variables and replace values with connection details to your MDCB control plane. See [Tyk Data Plane](/product-stack/tyk-charts/tyk-data-plane-chart#obtain-remote-control-plane-connection-details-from-tyk-control-plane-chart) documentation on how to get the connection details.
+
+    ```bash
+    USER_API_KEY=9d20907430e440655f15b851e4112345
+    ORG_ID=64cadf60173be90001712345
+    MDCB_CONNECTIONSTRING=mdcb-svc-tyk-cp-tyk-mdcb.tyk-cp.svc:9091
+    GROUP_ID=your-group-id
+    MDCB_USESSL=false
+    ```
+
+2. **Then use Helm to install Redis and Tyk**
+
+    ```bash
+    NAMESPACE=tyk-dp
+    APISecret=foo
+
+    helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+    helm repo update
+
+    helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --create-namespace --install --set image.repository=bitnamilegacy/redis
+
+    helm upgrade tyk-dp tyk-helm/tyk-data-plane -n $NAMESPACE --create-namespace \
+    --install \
+    --set global.remoteControlPlane.userApiKey=$USER_API_KEY \
+    --set global.remoteControlPlane.orgId=$ORG_ID \
+    --set global.remoteControlPlane.connectionString=$MDCB_CONNECTIONSTRING \
+    --set global.remoteControlPlane.groupID=$GROUP_ID \
+    --set global.remoteControlPlane.useSSL=$MDCB_USESSL \
+    --set global.secrets.APISecret="$APISecret" \
+    --set global.redis.addrs="{tyk-redis-master.$NAMESPACE.svc.cluster.local:6379}" \
+    --set global.redis.passSecret.name=tyk-redis \
+    --set global.redis.passSecret.keyName=redis-password
+    ```
+
+3. **Done!**
+
+    Now Tyk Gateway should be accessible through service `gateway-svc-tyk-dp-tyk-gateway` at port `8080`. Pump is also configured with Hybrid Pump which sends aggregated analytics to MDCB, and Prometheus Pump which expose metrics locally at `:9090/metrics`.
+
+    For the complete installation guide and configuration options, please see [Tyk Data Plane Chart](/product-stack/tyk-charts/tyk-data-plane-chart).
+
+### Configuring an existing Tyk Gateway
+If you have Redis and a working Tyk Gateway deployed, follow below steps to configure your gateways to work in RPC mode.
+
+
+<Note>
+If you have deployed Gateway with `tyk-data-plane` Chart, you don't need to go through following steps to configure Tyk Gateway. The necessary configurations has been set in `tyk-data-plane` chart templates.
+</Note>
+
+
+#### Prerequisites
+- Redis
+- A working headless/open source Tyk Gateway deployed
+
+#### Data Plane Gateway Configuration
+
+Modify the Tyk Gateway configuration (`tyk.conf`) as follows:
+`"use_db_app_configs": false,`
+
+Next, we need to ensure that the policy loader and analytics pump use the RPC driver:
+
+```{.json}
+"policies": {
+  "policy_source": "rpc",
+  "policy_record_name": "tyk_policies"
+},
+"analytics_config": {
+  "type": "rpc",
+  ... // remains the same
+},
+```
+
+Lastly, we add the sections that enforce the Data Plane mechanism:
+
+```{.json}
+"slave_options": {
+  "use_rpc": true,
+  "rpc_key": "{ORGID}",
+  "api_key": "{APIKEY}",
+  "connection_string": "{MDCB_HOSTNAME:9091}",
+  "enable_rpc_cache": true,
+  "bind_to_slugs": false,
+  "group_id": "{ny}",
+  "use_ssl": false,
+  "ssl_insecure_skip_verify": true
+},
+"auth_override": {
+  "force_auth_provider": true,
+  "auth_provider": {
+    "name": "",
+    "storage_engine": "rpc",
+    "meta": {}
+  }
+}
+```
+
+<Note>
+if you set `analytics_config.type` to `rpc` - make sure you don't have your Tyk Pump configured to send analytics via the `hybrid` Pump type.
+</Note>
+
+
+
+As an optional configuration you can use `key_space_sync_interval` to set the period's length in which the gateway will check for changes in the key space, if this value is not set then by default it will be 10 seconds.
+
+
+The most important elements here are:
+
+| Field         | Description    |
+| :--------------- | :---------------- |
+|`api_key`      |This the API key of a user used to authenticate and authorize the Gateway's access through MDCB. The user should be a standard Dashboard user with minimal privileges so as to reduce risk if compromised. The suggested security settings are `read` for `Real-time notifications` and the remaining options set to `deny`.|
+|`group_id`    |This is the "zone" that this instance inhabits, e.g. the cluster/data center the gateway lives in. The group ID must be the same across all the gateways of a data center/cluster which are also sharing the same Redis instance. This id should also be unique per cluster (otherwise another gateway's cluster can pick up your keyspace events and your cluster will get zero updates).
+|`connection_string`     |The MDCB instance or load balancer.|
+|`bind_to_slugs` | For all Tyk installations this should be set to false.|
+
+Once this is complete, you can restart the Tyk Gateway in the Data Plane, and it will connect to the MDCB instance, load its API definitions, and is ready to proxy traffic.
+
+## Minimizing latency with MDCB
+
+### Overview
+
+As described [previously](/api-management/mdcb#managing-geographically-distributed-gateways-to-minimize-latency-and-protect-data-sovereignty), Acme Global Bank has operations and customers in both the EU and USA.
+
+To decrease the latency in response from their systems and to ensure that data remains in the same legal jurisdiction as the customers (data residency), they have deployed backend (or, from the perspective of the API gateway, “upstream”) services in two data centers: one in the US, the other in the EU.
+
+Without a dedicated solution for this multi-region use case, Acme Global Bank would deploy a Tyk Gateway cluster in each data center and then have the operational inconvenience of maintaining two separate instances of Tyk Dashboard to configure, secure and publish the APIs.
+
+By using Tyk's Multi-Data Center Bridge (MDCB), however, they are able to centralise the management of their API Gateways and gain resilience against failure of different elements of the deployment - data or control plane - improving the availability of their public APIs.
+
+In this example we will show you how to create the Acme Global Bank deployment using our example Helm charts.
+
+<img src="/img/mdcb/mdcb_poc1_overview.png" alt="MDCB Proof of Concept - Acme Global Bank" width="600" height="750" />
+
+**Step-by-step instructions to deploy the Acme Global Bank scenario with Kubernetes in a public cloud (here we’ve used Google Cloud Platform):**
+
+### Pre-requisites and configuration
+
+1. What you need to install/set-up
+    - Tyk Pro license (Dashboard and MDCB keys - obtained from Tyk)
+    - Access to a cloud account of your choice, e.g. GCP
+    - You need to grab this Tyk Demo repository: [GitHub - TykTechnologies/tyk-k8s-demo](https://github.com/TykTechnologies/tyk-k8s-demo)
+    - You need to install `helm`, `jq`, `kubectl` and `watch`
+
+2. To configure GCP
+    - Create a GCP cluster
+    - Install the Google Cloud SDK
+       - install `gcloud`
+       - `./google-cloud-sdk/install.sh`
+    - Configure the Google Cloud SDK to access your cluster
+       - `gcloud auth login`
+       - `gcloud components install gke-gcloud-auth-plugin`
+       - `gcloud container clusters get-credentials <<gcp_cluster_name>> —zone <<zone_from_gcp_cluster>>—project <<gcp_project_name>>`
+    - Verify that everything is connected using `kubectl`
+       - `kubectl get nodes`
+
+3. You need to configure the Tyk build
+    - Create a `.env` file within tyk-k8s-demo based on the provided `.env.example` file
+    - Add the Tyk license keys to your `.env`:
+       - `LICENSE=<dashboard_license>`
+       - `MDCB_LICENSE=<mdcb_license>`
+
+### Deploy Tyk Stack to create the Control and Data Planes
+
+1. Create the Tyk Control Plane
+     - `./up.sh -r redis-cluster -e load-balancer tyk-cp`
+
+*Deploying the Tyk Control Plane*
+<img src="/img/mdcb/mdcb-poc1-screenshot1.png" alt="Tyk Control Plane Deployed" />
+
+2. Create two logically-separate Tyk Data Planes to represent Acme Global Bank’s US and EU operations using the command provided in the output from the `./up.sh` script:
+    - `TYK_WORKER_CONNECTIONSTRING=<MDCB-exposure-address:port> TYK_WORKER_ORGID=<org_id> TYK_WORKER_AUTHTOKEN=<mdcb_auth_token> TYK_WORKER_USESSL=false ./up.sh --namespace <worker-namespace> tyk-worker`
+
+Note that you need to run the same command twice, once setting `<worker-namespace>` to `tyk-worker-us`, the other to `tyk-worker-eu` (or namespaces of your choice)
+
+*Deploying the `tyk-worker-us` namespace (Data Plane #1)*
+<img src="/img/mdcb/mdcb-poc1-screenshot2.png" alt="Deploying the tyk-worker-us namespace" />  
+
+*Deploying the `tyk-worker-eu` namespace (Data Plane #2)*
+<img src="/img/mdcb/mdcb-poc1-screenshot3.png" alt="Deploying the tyk-worker-eu namespace" />
+
+3. Verify and observe the Tyk Control and Data Planes
+    - Use `curl` to verify that the gateways are alive by calling their `/hello` endpoints
+
+<img src="/img/mdcb/mdcb-poc1-screenshot4.png" alt="observe Tyk K8s namespace console output" />
+
+    - You can use `watch` to observe each of the Kubernetes namespaces
+
+*`tyk-cp` (Control Plane)*
+<img src="/img/mdcb/mdcb-poc1-screenshot5.png" alt="Control Plane" />  
+
+*`tyk-worker-us` (Data Plane #1)*
+<img src="/img/mdcb/mdcb-poc1-screenshot6.png" alt="Data Plane #1" /> 
+
+*`tyk-worker-eu` (Data Plane #2)*
+<img src="/img/mdcb/mdcb-poc1-screenshot7.png" alt="Data Plane #2" />
+
+### Testing the deployment to prove the concept
+As you know, the Tyk Multi Data Center Bridge provides a link from the Control Plane to the Data Plane Gateways, so that we can control all the remote gateways from a single dashboard.
+
+1. Access Tyk Dashboard
+    - You can log into the dashboard at the external IP address reported in the watch window for the Control Plane - in this example it was at `34.136.51.227:3000`, so just enter this in your browser
+    - The user name and password are provided in the `./up.sh` output:
+      - username: `default@example.com`
+      - password: `topsecretpassword` (or whatever you’ve configured in the `.env` file)
+      
+<img src="/img/mdcb/mdcb-poc1-screenshot8.png" alt="Tyk Dashboard login" />
+
+2. Create an API in the dashboard, but don’t secure it (set it to `Open - keyless`); for simplicity we suggest a simple pass-through proxy to `httbin.org`.
+3. MDCB will propagate this API through to the Data Plane Gateways - so try hitting that endpoint on the two Data Plane gateways (their addresses are given in the watch windows: for example `34.173.240.149:8081` for my `tyk-worker-us` gateway above).
+4. Now secure the API from the dashboard using the Authentication Token option. You’ll need to set a policy for the API and create a key.
+5. If you try to hit the API again from the Data Plane Gateways, you’ll find that the request is now rejected because MDCB has propagated out the change in authentication rules. Go ahead and add the Authentication key to the request header… and now you reach `httpbin.org` again. You can see in the Dashboard’s API Usage Data section that there will have been success and error requests to the API.
+6. OK, so that’s pretty basic stuff, let’s show what MDCB is actually doing for you… reset the API authentication to be `Open - keyless` and confirm that you can hit the endpoint without the Authentication key from both Data Planes.
+7. Next we’re going to experience an MDCB outage - by deleting its deployment in Kubernetes:
+<br />`kubectl delete deployment.apps/mdcb-tyk-cp-tyk-pro -n tyk`
+8. Now there's no connection from the data placne to the control plane, but try hitting the API endpoint on either Data Plane Gateway and you’ll see that they continue serving your users' requests regardless of their isolation from the Control Plane.
+9. Back on the Tyk Dashboard make some changes - for example, re-enable Authentication on your API, add a second API. Verify that these changes **do not** propagate through to the Data Plane Gateways.
+10. Now we’ll bring MDCB back online with this command:
+<br />`./up.sh -r redis-cluster -e load-balancer tyk-cp`
+11. Now try hitting the original API endpoint from the Data Planes - you’ll find that you need the Authorization key again because MDCB has updated the Data Planes with the new config from the Control Plane.
+12. Now try hitting the new API endpoint - this will also have automatically been propagated out to the Data Planes when MDCB came back up and so is now available for your users to consume.
+
+Pretty cool, huh?
+
+There’s a lot more that you could do - for example by deploying real APIs (after all, this is a real Tyk deployment) and configuring different Organisation Ids for each Data Plane to control which APIs propagate to which Gateways (allowing you to ensure data localisation, as required by the Acme Global Bank).
+
+### Closing everything down
+We’ve provided a simple script to tear down the demo as follows:
+1. `./down.sh -n tyk-worker-us`
+2. `./down.sh -n tyk-worker-eu`
+3. `./down.sh`
+
+**Don’t forget to tear down your clusters in GCP if you no longer need them!**
+
+## MDCB Synchroniser
+
+### Overview
+
+Data Plane Gateways need resources such as API keys, certificates, and OAuth clients to process API requests. To ensure high availability and resilience, these resources need to be synchronized from the Control Plane to the Data Planes.
+
+The MDCB Synchroniser is a feature that proactively pushes these resources to the Data Planes when they start up. This improves resilience if the MDCB link or the Control Plane is unavailable, as the Data Planes can continue to operate independently using the resources stored locally in their Redis instances. It also offers a performance improvement, as Gateways do not have to retrieve resources on demand when an API is first called.
+
+<Note>
+  **A note on spelling**
+
+  Throughout this documentation, we use specific spelling conventions to help distinguish between product features and general concepts:
+  - Synchroniser (with an ‘s’) refers specifically to a core functionality of Tyk MDCB
+  - synchronize (with a ‘z’) and its derivatives refer to the general concept of synchronization
+
+  This British/American English distinction helps clarify when we’re discussing the Tyk MDCB feature versus general synchronization concepts.
+</Note>
+
+### How Resources are Synchronized
+
+There are two models for synchronizing resources from the Control Plane to the Data Planes: on-demand retrieval and proactive synchronization using the Synchroniser.
+
+#### Without the Synchroniser (On-demand)
+
+If the Synchroniser is not in use, the Data Plane Gateways pull resources on demand. When a Gateway requires a resource (for example, a TLS certificate to serve a request), it first checks its local Redis cache. If the resource doesn't exist locally, it requests it from the Control Plane via the MDCB. Once retrieved, the resource is cached locally in Redis for future use.
+
+This model introduces a potential single point of failure. If the MDCB or Control Plane is down, a Data Plane Gateway cannot retrieve a resource it has not previously cached, which could impact API availability.
+
+<img src="/img/mdcb/synchroniser-before.gif" alt="Without Synchroniser" width="1000" />
+
+#### With the Synchroniser (Proactive)
+
+When the Synchroniser is enabled, API keys, certificates, and OAuth clients are synchronized and stored in the Data Plane's Redis in advance. When one of these resources is created, modified, or deleted on the Control Plane, a signal is emitted, and the Data Planes update their local stores accordingly. This ensures that all required resources are already in place when the Gateway needs to handle traffic.
+
+<Note>
+  **Note**
+
+  By default, the Synchroniser will synchronize all certificates to every Data Plane. In Tyk 5.12.0, we added the option to configure a more granular, selective synchronization for TLS certificates. This is particularly useful in environments with a large number of certificates where different Data Planes serve different domains.
+
+  This selective approach reduces both the memory footprint of each Data Plane's Redis instance and unnecessary network traffic between the Control and Data Planes.
+</Note>
+
+
+Considerations:
+
+- **Redis Storage**: Proactively synchronizing all resources will increase the storage requirements for each Data Plane's local Redis instance. Using the selective certificate sync feature from Tyk 5.12.0 can help mitigate this for certificates.
+- **Data Residency**: The synchronization of keys and OAuth clients is an all-or-nothing process. All keys and OAuth clients will be propagated to all Data Planes. If you have strict data residency requirements, be aware that there is no mechanism to restrict these resources to specific Gateway groups.
+
+<img src="/img/mdcb/synchroniser-after.gif" alt="With Synchroniser" width="1000" />
+
+### Configuring the Synchroniser for Tyk Self Managed
+
+The Synchroniser is disabled by default. To enable it, please configure both the Data Plane Gateways and MDCB accordingly.
+
+#### Data Plane configuration
+
+The Synchroniser behaviour is configured in [`slave_options`](/tyk-oss-gateway/configuration#slave_options) object  in the Data Plane Gateway's `tyk.conf` file or equivalent environment variables, in addition to the [standard Data Plane Gateway settings](/api-management/mdcb#data-plane-gateway-configuration):
+
+```json
+{
+  "slave_options": {
+    "synchroniser_enabled": true,
+    "sync_used_certs_only": true
+  }
+}
+```
+
+| Property               | Description                              |
+| :--------------------- | :--------------------------------------- |
+| `synchroniser_enabled` | Set to `true` to use the Synchroniser    |
+| `sync_used_certs_only` | Synchronize only the TLS certificates used by APIs loaded to the Gateway |
+
+<Note>
+  *Note*
+
+  The `sync_used_certs_only` option was added in Tyk 5.12.0 to prevent the Data Plane from loading irrelevant TLS certificates (which could generate noise in the Gateway application logs if expired). With this option set to `true` only certificates required for APIs loaded by the Gateway will be synchronised to the Data Plane.
+
+  In Tyk 5.12.0, there is a small limitation. When this option is enabled, certificates registered for APIs secured with [Certificate Authentication](/api-management/authentication/certificate-auth) are retrieved on demand rather than during the initial sync.
+</Note>
+
+#### Control Plane configuration
+
+The Synchroniser behaviour is configured in the [`sync_worker_config`](/tyk-multi-data-centre/mdcb-configuration-options#sync_worker_config) object in the MDCB's `tyk_sink.conf` file or equivalent environment variables, in addition to the [standard MDCB settings](/api-management/mdcb#configuration):
+
+```json
+{
+  "sync_worker_config": {
+    "enabled": true,
+    "hash_keys": true,
+    "max_batch_size": 1000,
+    "time_between_batches": 0,
+    "max_workers": 10000,
+    "warmup_time": 2,
+    "group_key_ttl": 180
+  }
+}
+```
+
+| Property         | Description                              |
+| :--------------- | :--------------------------------------- |
+| `enabled`        | Set to `true` to use the Synchroniser |
+| `hash_keys`      | Set to `true` if [key hashing](/api-management/access-control/sessions-and-keys/key-hashing) is also enabled in your Tyk Dashboard and Gateway configurations. This ensures that the Synchroniser correctly handles hashed API keys. |
+| `max_batch_size` | The maximum number of keys that the Synchroniser will fetch from Redis in a single batch. The default value is 1000. |
+| `time_between_batches` | The cooldown period in seconds between fetching batches of keys. The default is 0, which means there is no delay. |
+| `max_workers`    | The maximum number of Gateway groups (clusters) that can be synchronized concurrently. The default value is 10000. |
+| `warmup_time`    | The time in seconds that MDCB will wait before starting the synchronization process. This allows the worker nodes to load APIs and policies from their local Redis before synchronising other resources. The default value is 2 seconds. |
+| `group_key_ttl`  | The Time To Live (TTL) in seconds for the group synchronization key in Redis. This key (`syncworker-{groupID}-{orgID}`) prevents multiple Gateways in the same group from triggering a sync simultaneously. The default value is 180 seconds. |
+
+
+### Configuring the Synchroniser for Tyk Cloud
+
+Please [submit a support ticket](https://support.tyk.io/hc/en-gb) to us if you want to enable Synchroniser for your Tyk Cloud deployment.
+
+### Frequently Asked Questions
+
+<AccordionGroup>
+
+<Accordion title='How do I know if synchronization happened?'>
+
+You could check the MDCB log message to know when synchronization started and finished:
+
+```
+Starting oauth clients sync worker for orgID...
+Starting keys sync worker for orgID...
+Starting keys sync worker for orgID...
+
+Sync APIKeys worker for orgID:...
+Sync Certs worker for orgID:...
+Sync oauth worker for orgID:...
+```
+
+</Accordion>
+
+<Accordion title='Can I trigger a re-synchronization?'>
+
+Synchronization will be triggered when the Time To Live (TTL) of a Data Plane Gateway expires. The default expiry duration is 3 minutes. The Time To Live (TTL) value can be set in the MDCB config using [`sync_worker_config.group_key_ttl`](/tyk-multi-data-centre/mdcb-configuration-options#sync_worker_config-group_key_ttl).
+
+</Accordion>
+
+</AccordionGroup> 
diff --git a/api-management/metrics/custom-metrics.mdx b/api-management/metrics/custom-metrics.mdx
new file mode 100644
index 0000000000..65e41a6f70
--- /dev/null
+++ b/api-management/metrics/custom-metrics.mdx
@@ -0,0 +1,429 @@
+---
+title: "Custom Metrics in Tyk Gateway"
+description: "Define custom metric instruments in Tyk Gateway with your own dimensions sourced from request headers, JWT claims, session data, endpoint paths, and more."
+keywords: "Custom Metrics, OpenTelemetry, OTLP, Dimensions, Labels, Multi-tenant, Counter, Histogram, Cardinality, config_data, endpoint, listen_path"
+sidebarTitle: "Custom Metrics"
+---
+
+## Availability
+
+| Component | Version | Edition |
+| :-------- | :------ | :------- |
+| Tyk Gateway | Available since [v5.13.0](/developer-support/release-notes/gateway#5-13-0-release-notes) | Community & Enterprise |
+
+## Custom Metrics
+
+By default, Tyk Gateway exports [standard RED metrics](/api-management/metrics/default-metrics) with a fixed set of dimensions. Custom metrics let you define additional instruments with dimensions drawn from request headers, session data, JWT claims, and other context, enabling use cases such as:
+
+- **Multi-tenant billing:** Count requests per customer ID from a header or JWT claim
+- **Tier-based SLOs:** Track latency separately for premium vs. standard API tiers
+- **Business KPIs:** Measure domain-specific signals (e.g., successful transactions per payment provider)
+
+## The api_metrics Array
+
+Custom metrics are defined in the `api_metrics` array inside `opentelemetry.metrics`:
+
+```json
+{
+  "opentelemetry": {
+    "metrics": {
+      "enabled": true,
+      "api_metrics": [
+        { ... }
+      ]
+    }
+  }
+}
+```
+
+The behavior of this field depends on its value:
+
+| Value | Behavior |
+|-------|----------|
+| Field omitted or `null` | [Default RED metrics](/api-management/metrics/default-metrics) are exported automatically. |
+| Empty array `[]` | API-level metrics are disabled entirely; no request metrics are exported. |
+| Populated array | Only the instruments you define are exported. Default RED metrics are not exported unless you explicitly define them. |
+
+<Tip>
+**Preserving default RED metrics**
+
+When you populate `api_metrics`, the built-in RED instruments are no longer exported automatically. Use the block below as a starting point, it re-creates all four default instruments, then append your custom instruments after them.
+
+```json expandable
+{
+  "opentelemetry": {
+    "metrics": {
+      "enabled": true,
+      "api_metrics": [
+        {
+          "name": "http.server.request.duration",
+          "type": "histogram",
+          "description": "End-to-end request latency",
+          "histogram_source": "total",
+          "dimensions": [
+            { "source": "metadata", "key": "method",        "label": "http.request.method" },
+            { "source": "metadata", "key": "response_code", "label": "http.response.status_code" },
+            { "source": "metadata", "key": "api_id",        "label": "tyk.api.id" },
+            { "source": "metadata", "key": "response_flag", "label": "tyk.response_flag" }
+          ]
+        },
+        {
+          "name": "tyk.gateway.request.duration",
+          "type": "histogram",
+          "description": "Gateway processing time",
+          "histogram_source": "gateway",
+          "dimensions": [
+            { "source": "metadata", "key": "method",        "label": "http.request.method" },
+            { "source": "metadata", "key": "api_id",        "label": "tyk.api.id" },
+            { "source": "metadata", "key": "response_flag", "label": "tyk.response_flag" }
+          ]
+        },
+        {
+          "name": "tyk.upstream.request.duration",
+          "type": "histogram",
+          "description": "Upstream response time",
+          "histogram_source": "upstream",
+          "dimensions": [
+            { "source": "metadata", "key": "method",        "label": "http.request.method" },
+            { "source": "metadata", "key": "api_id",        "label": "tyk.api.id" },
+            { "source": "metadata", "key": "response_flag", "label": "tyk.response_flag" }
+          ]
+        },
+        {
+          "name": "tyk.api.requests.total",
+          "type": "counter",
+          "description": "Request count with identity dimensions",
+          "dimensions": [
+            { "source": "metadata", "key": "method",        "label": "http.request.method" },
+            { "source": "metadata", "key": "response_code", "label": "http.response.status_code" },
+            { "source": "metadata", "key": "api_id",        "label": "tyk.api.id" }
+          ]
+        }
+      ]
+    }
+  }
+}
+```
+</Tip>
+
+## Instrument Types
+
+Each entry in `api_metrics` defines one instrument:
+
+| Type | Description |
+|------|-------------|
+| `counter` | A monotonically increasing count. Use for request counts, error counts, etc. |
+| `histogram` | A distribution of values. Use for latency measurements. |
+
+Histograms require a `histogram_source` field that selects which latency to measure:
+
+| `histogram_source` | Measures |
+|--------------------|----------|
+| `total` | End-to-end request latency (client to Gateway to upstream) |
+| `gateway` | Gateway processing time only (excludes upstream response time) |
+| `upstream` | Upstream service response time only |
+
+## Dimension Sources
+
+Dimensions let you slice your metrics by any signal available at request time. Tyk can source dimension values from six places; the sections below describe common use cases and which source and key to use for each.
+
+| Source | What It Provides | Example Keys |
+|--------|-----------------|--------------|
+| `metadata` | Request metadata always in scope | `method`, `response_code`, `api_id`, `api_name`, `org_id`, `response_flag`, `ip_address`, `api_version`, `host`, `scheme`, `listen_path`, `endpoint`. MCP APIs also expose `mcp_method`, `mcp_primitive_type`, `mcp_primitive_name`, `mcp_error_code`, see [MCP dimensions](#mcp-dimensions). |
+| `session` | Authenticated session fields | `api_key`, `oauth_id`, `alias`, `portal_app`, `portal_org` |
+| `header` | Any HTTP request header | `X-Customer-ID`, `X-Tenant-ID`, `Authorization` |
+| `context` | Tyk [context variables](/api-management/traffic-transformation/request-context-variables) | `jwt_claims_tier`, `request_id`, `path_parts` |
+| `response_header` | Any upstream response header | `X-Cache-Status`, `X-Backend-Version` |
+| `config_data` | API definition metadata from the `config_data` map | Any key set on the API definition |
+
+### Response status
+
+Two `metadata` keys capture response status, and they answer different questions:
+
+| Key | Source | What it captures |
+|-----|--------|-----------------|
+| `response_code` | `metadata` | The numeric HTTP status code returned to the client (`200`, `429`, `502`, etc.). Always populated. Bounded cardinality (~100 values). |
+| `response_flag` | `metadata` | A 3-letter error classification code set by the gateway, e.g. `URS` (upstream returned 5XX), `AKI` (API key invalid), `CBO` (circuit breaker open). Falls back to the HTTP status code string (e.g. `"200"`) when no error classification applies. See the [full list of response flags](/api-management/logs/access-logs#error-classification). |
+
+Use `response_code` to break down traffic by HTTP status. Use `response_flag` to understand Gateway-level error causes.
+
+The `status_codes` filter in the `filters` block decides *whether* a request is recorded at all. The `response_code` dimension attaches the actual code as a label on the recorded data points. A common pattern is to combine both: filter to error responses, then break them down by exact code:
+
+```json
+{
+  "name": "tyk.api.errors.by_status",
+  "type": "counter",
+  "dimensions": [
+    { "source": "metadata", "key": "response_code", "label": "http_status_code" },
+    { "source": "metadata", "key": "api_id",        "label": "api_id" }
+  ],
+  "filters": { "status_codes": ["4xx", "5xx"] }
+}
+```
+
+### Request path
+
+Four options are available, at different cardinality levels:
+
+| | Source | Key | Cardinality | Notes |
+|---|--------|-----|-------------|-------|
+| API listen path | `metadata` | `listen_path` | Bounded (one value per API) | The configured listen path (e.g. `/api/v1/`). Safe to use in any metric. |
+| Endpoint template | `metadata` | `endpoint` | Bounded (one per track endpoint) | The matched path template (e.g. `/user/{id}`). Requires `track_endpoints` configured on the API. Empty string for unmatched requests. |
+| Raw request path | `context` | `path` | ⚠️ Potentially unbounded | The URL path as requested by the client (e.g. `/api/v1/users/12345`). Avoid unless paths have known low cardinality. |
+| Path segments | `context` | `path_parts` | ⚠️ Potentially unbounded | The path split by `/` into a list of segments (e.g. `/api/v1/users/123` → `["api", "v1", "users", "123"]`). Access a specific segment with `{{ index ._tyk_context.path_parts N }}`. Carries the same cardinality risk as `path` if any segment varies per request. |
+
+Prefer `listen_path` or `endpoint` (with `track_endpoints`) over raw `path` or `path_parts` in most cases.
+
+### Client and auth identity
+
+Several sources expose client identity, with different cardinality trade-offs:
+
+- **Session fields** (`session` source): `alias` (the human-readable key alias), `portal_app` (Developer Portal app ID), and `portal_org` (Developer Portal org ID) are typically bounded and safe to use. `api_key` and `oauth_id` are ⚠️ high cardinality (one value per key/client); only use these with [cardinality control](/api-management/logs-metrics#cardinality-control) enabled.
+- **JWT claims** (`context` source): any claim is available as `jwt_claims_<name>` (e.g. `jwt_claims_tier`, `jwt_claims_tenant_id`). See [Request context variables](#request-context-variables) for setup requirements and cardinality notes.
+- **Request headers** (`header` source): use when client identity is passed as a header (e.g. `X-Tenant-ID`). Cardinality depends on what the header contains.
+
+### Custom API metadata
+
+If you want to attach static, API-level metadata (such as team ownership, service tier, cost centre, or criticality) to your metrics without touching request headers or tokens, use the `config_data` source.
+
+The [config_data](/api-management/gateway-config-tyk-oas#pluginconfigdata) field in the API definition is a free-form key-value map you can populate per API:
+
+```json
+{
+  "config_data": {
+    "environment": "staging",
+    "team": "platform",
+    "criticality": "high"
+  }
+}
+```
+
+A dimension like `{"source": "config_data", "key": "team"}` will carry `team="platform"` on every metric recorded for that API; no request modification required.
+
+**Fallback behaviour:** If `config_data_disabled` is `true` on the API, or the key is absent, the dimension falls back to the `default` value on the dimension definition. If no default is set, an empty string is used. All values are treated as strings.
+
+### Request context variables
+
+The `context` source reads from Tyk's [request context variables](/api-management/traffic-transformation/request-context-variables), a set of values extracted from the incoming request and enriched during middleware processing. The `context` source covers two kinds of variables: those populated automatically by Tyk, and those written by custom plugins.
+
+<Note>
+Context variables must be enabled on the API definition (`enable_context_vars: true`) for the `context` source to work. Without this setting, all `context` dimensions will be empty.
+</Note>
+
+#### Default context variables (no plugin required)
+
+When context variables are enabled, Tyk automatically populates the following variables for every request:
+
+| Key | Description | Cardinality |
+|-----|-------------|-------------|
+| `request_id` | A generated correlation ID for the request. | ⚠️ Unbounded, unique per request. Not suitable as a metric dimension. |
+| `path` | The raw request path (e.g. `/api/v1/users/123`). | ⚠️ Potentially unbounded. See [Request path](#request-path). |
+| `path_parts` | The request path split by `/` into a list of segments. E.g. `/api/v1/users/123` → `["api", "v1", "users", "123"]`. Access individual segments with `{{ index ._tyk_context.path_parts N }}`. | ⚠️ Potentially unbounded. |
+| `remote_addr` | The connecting client IP address. | ⚠️ High cardinality. |
+| `jwt_claims_<name>` | Individual JWT claims, e.g. `jwt_claims_tier`, `jwt_claims_tenant_id`. Available when JWT auth is in use. | Bounded if the claim takes a fixed set of values (e.g. subscription tier). Safe to use. |
+| `cookies_<name>` | Cookie values by name (hyphens replaced with underscores). | Depends on cookie values. |
+| `headers_<name>` | Request header values by name (capitalised, hyphens replaced with underscores, e.g. `headers_User_Agent`). | Depends on header values. |
+| `token` | The raw inbound bearer token. | ⚠️ Extremely high cardinality. Do not use as a dimension. |
+
+Usually the most useful defaults for metrics are **JWT claims**: they let you segment traffic by tenant, subscription tier, or any other bounded claim without requiring a plugin:
+
+```json
+{ "source": "context", "key": "jwt_claims_tier", "label": "tier", "default": "standard" }
+```
+
+#### Custom context variables (via plugin)
+
+Go plugins and [JQ request transforms](/api-management/traffic-transformation/jq-transforms) can write arbitrary variables into the request context, which are then accessible as `context` source dimensions. This is useful for computed signals, such as enriched tenant IDs, feature flags, routing decisions, or values decoded from opaque tokens.
+
+**Go plugin:**
+
+```go
+import "github.com/TykTechnologies/tyk/ctx"
+
+func MyPlugin(w http.ResponseWriter, r *http.Request) {
+    if ctxData, ok := r.Context().Value(ctx.ContextData).(map[string]interface{}); ok {
+        ctxData["my_custom_var"] = "value"
+    }
+}
+```
+
+**JQ transform**: return a `tyk_context` object alongside the transformed body:
+
+```json
+{
+  "body": "<transformed-body>",
+  "tyk_context": { "my_custom_var": "value" }
+}
+```
+
+The variable is then available as a dimension:
+
+```json
+{ "source": "context", "key": "my_custom_var", "label": "my_variable" }
+```
+
+<Note>
+Python, gRPC (coprocess), and JavaScript (JSVM) plugins cannot write to request context variables. To pass data from these plugins into metrics dimensions, use session metadata (`session` source, via `session.meta_data`) or inject a custom HTTP request header (`header` source) instead.
+</Note>
+
+### MCP dimensions
+
+When a request is handled by an MCP API, Tyk populates four additional `metadata` keys derived from the JSON-RPC payload. These are available as dimensions in any custom metric instrument.
+
+| Key | Description | Example Values | Cardinality |
+|-----|-------------|----------------|-------------|
+| `mcp_method` | JSON-RPC method invoked | `tools/call`, `initialize`, `resources/read`, `prompts/get` | Bounded |
+| `mcp_primitive_type` | MCP primitive category | `tool`, `resource`, `prompt` | Bounded (3 values) |
+| `mcp_primitive_name` | Name of the specific tool, resource, or prompt | `get_current_weather`, `search_docs` | Bounded per API |
+| `mcp_error_code` | JSON-RPC error code on failure; empty string on success | `-32001`, `-32002`, `` | Bounded |
+
+<Note>
+These keys are only populated for MCP APIs. For non-MCP requests all four keys resolve to an empty string; use the `default` field on the dimension definition to set a fallback value. There is no performance overhead on non-MCP metric configurations.
+</Note>
+
+**Example: count tool calls by tool name:**
+
+```json
+{
+  "name": "tyk.mcp.tool_calls.total",
+  "type": "counter",
+  "description": "MCP tool invocations by tool name and API",
+  "dimensions": [
+    { "source": "metadata", "key": "mcp_primitive_name", "label": "tool_name", "default": "" },
+    { "source": "metadata", "key": "mcp_primitive_type", "label": "primitive_type", "default": "" },
+    { "source": "metadata", "key": "api_id",             "label": "api_id" }
+  ],
+  "filters": { "methods": ["POST"] }
+}
+```
+
+For a complete set of MCP monitoring use cases, see [MCP Observability](/ai-management/mcp-gateway/mcp-metrics).
+
+### Other request metadata
+
+Remaining `metadata` keys available for general request context:
+
+| Key | Description | Cardinality |
+|-----|-------------|-------------|
+| `method` | HTTP method (`GET`, `POST`, etc.) | Bounded |
+| `api_id` | Tyk API ID | Bounded |
+| `api_name` | API display name | Bounded |
+| `org_id` | Organisation ID | Bounded |
+| `api_version` | API version name | Bounded |
+| `host` | Request host | Typically bounded |
+| `scheme` | URL scheme (`http`, `https`) | Bounded |
+| `ip_address` | Client IP address | ⚠️ High cardinality |
+
+Each dimension definition has four fields:
+
+| Field | Required | Description |
+|-------|----------|-------------|
+| `source` | Yes | One of the source names above. |
+| `key` | Yes | The specific field or header name to read from. |
+| `label` | Yes | The dimension name as it appears in your metrics backend. |
+| `default` | No | Fallback value when the key is not present on the request. |
+
+## Filters
+
+Each instrument can restrict which requests it records using the `filters` block. All filter conditions use AND logic (a request must match all specified filters):
+
+| Filter Field | Type | Description |
+|--------------|------|-------------|
+| `api_ids` | string array | Only record requests to these API IDs. |
+| `methods` | string array | Only record requests with these HTTP methods (e.g., `["GET", "POST"]`). |
+| `status_codes` | string array | Only record responses with these status codes. Supports exact values (`"200"`) and class patterns (`"2xx"`, `"4xx"`, `"5xx"`). |
+
+## Example Configuration
+
+The following example defines two custom instruments:
+
+1. A counter that tracks requests by customer ID and subscription tier
+2. A histogram that tracks latency for premium-tier requests only
+
+```json expandable
+{
+  "opentelemetry": {
+    "metrics": {
+      "enabled": true,
+      "api_metrics": [
+        {
+          "name": "tyk.requests.by_customer",
+          "type": "counter",
+          "description": "Request count by customer ID and subscription tier",
+          "dimensions": [
+            {
+              "source": "header",
+              "key": "X-Customer-ID",
+              "label": "customer_id",
+              "default": "unknown"
+            },
+            {
+              "source": "context",
+              "key": "jwt_claims_tier",
+              "label": "tier",
+              "default": "standard"
+            },
+            {
+              "source": "metadata",
+              "key": "api_id",
+              "label": "api_id"
+            }
+          ],
+          "filters": {
+            "api_ids": ["payments-api", "orders-api"]
+          }
+        },
+        {
+          "name": "tyk.latency.premium_tier",
+          "type": "histogram",
+          "description": "End-to-end latency for premium tier requests",
+          "histogram_source": "total",
+          "histogram_buckets": [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10],
+          "dimensions": [
+            {
+              "source": "context",
+              "key": "jwt_claims_tier",
+              "label": "tier"
+            },
+            {
+              "source": "metadata",
+              "key": "api_id",
+              "label": "api_id"
+            }
+          ],
+          "filters": {
+            "methods": ["POST", "PUT", "PATCH"],
+            "status_codes": ["2xx"]
+          }
+        }
+      ]
+    }
+  }
+}
+```
+
+## Full Field Reference
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `name` | string | Yes | Metric instrument name. Use lowercase with dots or underscores (e.g., `tyk.requests.by_customer`). |
+| `type` | string | Yes | `"counter"` or `"histogram"`. |
+| `description` | string | No | Human-readable description included in metric metadata. |
+| `dimensions` | array | Yes | List of dimension definitions. See [Dimension Sources](#dimension-sources). |
+| `filters` | object | No | Restricts which requests are recorded. See [Filters](#filters). |
+| `histogram_source` | string | Histograms only | `"total"`, `"gateway"`, or `"upstream"`. |
+| `histogram_buckets` | float array | No | Custom histogram bucket boundaries in seconds. If omitted, OTel default buckets are used. |
+
+## Cardinality Considerations
+
+Custom dimensions can significantly increase cardinality. Before adding a dimension, estimate the number of unique values it can take:
+
+- `api_id`: bounded (tens or hundreds of APIs)
+- `method`: bounded (fewer than 10 values)
+- `customer_id` from a header: potentially unbounded if unique per user
+
+The `cardinality_limit` setting (default: 2,000 unique combinations per instrument) protects against unbounded cardinality. When the limit is reached, new combinations are tracked in an overflow bucket. See [Cardinality Control](/api-management/logs-metrics#cardinality-control) for details.
+
+<Note>
+On Tyk Cloud, custom metric configuration is not currently self-service. Contact Tyk support to request custom dimensions for your Cloud deployment.
+</Note>
diff --git a/api-management/metrics/default-metrics.mdx b/api-management/metrics/default-metrics.mdx
new file mode 100644
index 0000000000..06bd14fcbc
--- /dev/null
+++ b/api-management/metrics/default-metrics.mdx
@@ -0,0 +1,181 @@
+---
+title: "Default Tyk Gateway Metrics Reference"
+description: "Complete reference of all metrics exported by Tyk Gateway when OpenTelemetry is enabled: request metrics, Go runtime metrics, and configuration state metrics."
+keywords: "OpenTelemetry, Metrics, RED Metrics, Request Duration, Go Runtime, Prometheus, Grafana, API Observability"
+sidebarTitle: "Default Metrics"
+---
+
+## Availability
+
+| Component | Version | Edition |
+| :-------- | :------ | :------- |
+| Tyk Gateway | Available since [v5.13.0](/developer-support/release-notes/gateway#5-13-0-release-notes) | Community & Enterprise |
+
+## Default Gateway Metrics
+
+When `opentelemetry.metrics.enabled` is set to `true`, Tyk Gateway automatically exports three groups of metrics, no additional configuration required:
+
+1. [Request metrics](#request-metrics): Rate, Errors, and Duration (RED) for every API request
+2. [Go runtime metrics](#go-runtime-metrics): Memory, goroutines, and GC health
+3. [Configuration state metrics](#configuration-state-metrics): API/policy load counts and reload events
+
+All metrics are exported as OpenTelemetry-semantic-convention-compliant instruments and include [resource attributes](#resource-attributes) that identify the gateway instance.
+
+### Request Metrics
+
+These four instruments cover the standard RED signals for every API proxied by the Gateway.
+
+| Metric Name | Type | Unit | Description |
+|-------------|------|------|-------------|
+| `http.server.request.duration` | Histogram | seconds | End-to-end request latency (client to Gateway to upstream and back). |
+| `tyk.gateway.request.duration` | Histogram | seconds | Time spent inside the gateway only (middleware processing, routing). Excludes upstream response time. |
+| `tyk.upstream.request.duration` | Histogram | seconds | Time spent waiting for the upstream service to respond. |
+| `tyk.api.requests.total` | Counter | requests | Total number of requests processed. |
+
+The three-way latency breakdown is particularly useful for distinguishing gateway processing overhead from upstream service slowness.
+
+#### Default Dimensions
+
+Default dimensions vary by instrument:
+
+| Instrument | `http.request.method` | `http.response.status_code` | `tyk.api.id` | `tyk.response_flag` |
+|-----------|:---:|:---:|:---:|:---:|
+| `http.server.request.duration` | Yes | Yes | Yes | Yes |
+| `tyk.gateway.request.duration` | Yes | - | Yes | Yes |
+| `tyk.upstream.request.duration` | Yes | - | Yes | Yes |
+| `tyk.api.requests.total` | Yes | Yes | Yes | - |
+
+| Dimension | Description |
+|-----------|-------------|
+| `http.request.method` | HTTP request method (`GET`, `POST`, etc.). |
+| `tyk.api.id` | The Tyk API ID. |
+| `http.response.status_code` | HTTP response status code (`200`, `404`, `500`, etc.). |
+| `tyk.response_flag` | Tyk 3-letter error classification code (e.g., `AKI`, `URS`, `CBO`), or the HTTP status code string (e.g., `"200"`) for successful requests or when error classification is absent. See the [full list of response flags](/api-management/logs/access-logs#error-classification). |
+
+You can add more dimensions to any instrument using [custom metrics](/api-management/metrics/custom-metrics).
+
+### Go Runtime Metrics
+
+These metrics are exported automatically and reflect the health of the Go runtime inside the Gateway process. They can be disabled by setting `runtime_metrics: false` in the metrics config.
+
+| Metric Name | Type | Unit | Description |
+|-------------|------|------|-------------|
+| `go.memory.used` | Gauge | bytes | Current heap memory in use. |
+| `go.memory.limit` | Gauge | bytes | Soft memory limit set via `GOMEMLIMIT`. |
+| `go.memory.allocated` | Gauge | bytes | Total bytes allocated to the heap. |
+| `go.memory.allocations` | Counter | bytes | Cumulative bytes allocated since startup. |
+| `go.memory.gc.goal` | Gauge | bytes | Target heap size for the next GC cycle. |
+| `go.goroutine.count` | Gauge | goroutines | Number of active goroutines. Useful for detecting goroutine leaks. |
+| `go.processor.limit` | Gauge | threads | Number of OS threads available (`GOMAXPROCS`). |
+| `go.config.gogc` | Gauge | percent | GC target percentage (`GOGC` env var). |
+
+### Configuration State Metrics
+
+These metrics reflect the operational state of the Gateway's loaded configuration. They are useful for detecting silent configuration failures, for example, alerting when the number of loaded APIs drops unexpectedly.
+
+| Metric Name | Type | Unit | Description |
+|-------------|------|------|-------------|
+| `tyk.gateway.apis.loaded` | Gauge | APIs | Number of API definitions currently loaded and active. |
+| `tyk.gateway.policies.loaded` | Gauge | policies | Number of policies currently loaded and active. |
+| `tyk.gateway.config.reload.total` | Counter | reloads | Cumulative number of configuration reload events since startup. |
+| `tyk.gateway.config.reload.duration` | Histogram | seconds | Time taken to complete each configuration reload cycle. |
+
+## Resource Attributes
+
+Every metric exported from a Gateway instance carries resource attributes, metadata that identifies the source. These are set once at startup and attached to all metrics.
+
+### Tyk-Specific Resource Attributes
+
+| Attribute | Always Present | Example | Description |
+|-----------|---------------|---------|-------------|
+| `tyk.gw.id` | Yes | `gw-prod-eu-west-1-a` | Unique Gateway ID. |
+| `tyk.gw.dataplane` | Yes | `true` | Whether the Gateway is running in a distributed Data Plane |
+| `tyk.gw.group.id` | No | `prod-eu-west-1` | Present only for Data Plane Gateways, identifies the group. |
+| `tyk.gw.tags` | No | `["region:eu", "env:prod"]` | Present only when the Gateway has [segment tags](/api-management/api-sharding#what-is-api-sharding-) configured. |
+
+### Standard OTel Resource Attributes
+
+| Category | Attributes |
+|----------|-----------|
+| Service | `service.name`, `service.version`, `service.instance.id` |
+| Host | `host.name`, `host.arch`, `host.ip` |
+| Process | `process.pid` |
+
+### Using Resource Attributes in Prometheus
+
+When using an OTel Collector to export to Prometheus, enable `resource_to_telemetry_conversion` to expose resource attributes as metric labels:
+
+```yaml
+exporters:
+  prometheus:
+    endpoint: "0.0.0.0:8889"
+    resource_to_telemetry_conversion:
+      enabled: true
+```
+
+Alternatively, add a transform processor to metrics pipeline for OTLP exporters:
+
+```yaml
+processors:
+  transform/tyk_gw_resource_attrs:
+    error_mode: ignore
+    metric_statements:
+      - context: datapoint
+        statements:
+          - set(attributes["tyk_gw_group_id"], resource.attributes["tyk.gw.group.id"]) where resource.attributes["tyk.gw.group.id"] != nil
+          - set(attributes["tyk_gw_id"], resource.attributes["tyk.gw.id"]) where resource.attributes["tyk.gw.id"] != nil
+          - set(attributes["tyk_gw_tags"], resource.attributes["tyk.gw.tags"]) where resource.attributes["tyk.gw.tags"] != nil
+          - set(attributes["tyk_gw_dataplane"], resource.attributes["tyk.gw.dataplane"]) where resource.attributes["tyk.gw.dataplane"] != nil
+```
+
+This allows PromQL queries like:
+
+```promql
+# All metrics from a specific gateway node
+{tyk_gw_id="gw-prod-eu-west-1-a"}
+
+# Compare request rates across gateways in an edge group
+sum by (tyk_gw_id) (
+  rate(tyk_api_requests_total{tyk_gw_group_id="edge-eu-west"}[5m])
+)
+```
+
+Without this setting, resource attributes are available via the `target_info` metric and can be joined in PromQL.
+
+## Exemplars
+
+Exemplars are sample observations attached to histogram metric data points that carry the active trace context (specifically the `trace_id` and `span_id` of the request that produced the measurement). They create a direct, clickable link from an aggregated metric to the specific trace that caused an anomaly.
+
+### How they work in Tyk
+
+When OpenTelemetry tracing is enabled and a histogram metric (such as `http.server.request.duration`) is recorded during an active sampled request, the OTel Go SDK automatically attaches the current trace and span IDs to the observation. Exemplars are only attached for sampled requests.
+
+### Infrastructure requirements
+
+Exemplar storage and rendering must be enabled in your observability stack; nothing additional is needed on the Tyk side.
+
+For example, in the following standard OTel pipeline:
+
+```
+Tyk Gateway
+  └─ OTLP/gRPC ──► OTel Collector ──► Prometheus ──► Grafana
+                                       (exemplar storage)   (exemplar markers)
+```
+
+| Component | Requirement |
+|-----------|-------------|
+| OTel Collector | Any version supporting OTLP metrics with exemplar passthrough |
+| Prometheus | v2.26+. Start with `--enable-feature=exemplar-storage` |
+| Grafana | v7.4+. Enable "Exemplars" toggle on the Prometheus data source |
+
+### Querying exemplars in Prometheus
+
+Exemplars are accessible via the Prometheus exemplar API:
+
+```
+GET /api/v1/query_exemplars?query=http_server_request_duration_seconds&start=<start>&end=<end>
+```
+
+### Grafana workflow
+
+When exemplar rendering is enabled, Grafana displays scatter plot markers on histogram panels. Clicking a marker navigates directly to the linked trace in your configured tracing backend (Jaeger, Grafana Tempo, etc.), with no manual trace ID lookup required.
\ No newline at end of file
diff --git a/api-management/metrics/metrics-pumps.mdx b/api-management/metrics/metrics-pumps.mdx
new file mode 100644
index 0000000000..404c9a34d3
--- /dev/null
+++ b/api-management/metrics/metrics-pumps.mdx
@@ -0,0 +1,239 @@
+---
+title: "Metrics Pumps (Legacy)"
+description: "Configure Tyk Pump to expose Prometheus, StatsD, or DogStatsD metrics derived from traffic logs."
+keywords: "Tyk Pump, Prometheus, StatsD, DogStatsD, Datadog, Grafana, Metrics, Legacy"
+sidebarTitle: "Metrics Pumps (Legacy)"
+---
+
+<Note>
+For new deployments, we recommend [OpenTelemetry Metrics](/api-management/logs-metrics#opentelemetry-metrics) instead: Tyk Gateway pushes Rate, Errors, and Duration (RED) metrics via an OpenTelemetry Collector. This page remains relevant for existing deployments already using Tyk Pump for metrics.
+</Note>
+
+## Introduction
+
+[Tyk Pump](/api-management/tyk-pump) can independently expose metrics, derived from the traffic logs it reads out of Redis, the same traffic logs used for [Dashboard Analytics](/api-management/dashboard-analytics). These metrics are computed by Tyk Pump after the fact from traffic log records, so it can only produce traffic-derived counters and histograms (status codes, latency, and whatever traffic log fields you tag). It has no visibility into Gateway's own runtime health or configuration state, unlike [OpenTelemetry metrics](/api-management/metrics/default-metrics).
+
+Three pump types expose metrics this way, all deriving from the same traffic log fields:
+
+| Pump Type | Format |
+| :-- | :-- |
+| [Prometheus](#prometheus) | Exposes an HTTP endpoint for Prometheus to scrape |
+| [StatsD](#statsd) | Sends per-request metrics to a StatsD server |
+| [DogStatsD](#dogstatsd-datadog) | Sends per-request metrics in the DogStatsD format, for example to Datadog |
+
+<Note>
+Not to be confused with [Tyk Gateway's native StatsD instrumentation](/api-management/logs-metrics#statsd-instrumentation): that's a completely different, built-in mechanism exporting internal system metrics (request rate, goroutine health, and so on), not traffic-log-derived request metrics. The [StatsD pump](#statsd) on this page is unrelated to that feature.
+</Note>
+
+## Prometheus
+
+Tyk Pump can expose Prometheus metrics derived from the traffic logs it reads out of Redis, useful for tracking how often your APIs are called, how they perform, and what status codes they return. See the [demo project on GitHub](https://github.com/TykTechnologies/demo-slo-prometheus-grafana) for a working example.
+
+Unlike the other pumps on this page, Tyk Pump doesn't send these metrics anywhere itself: it exposes them on a plain HTTP endpoint (`/metrics` by default), and Prometheus scrapes that endpoint on its own schedule.
+
+<Warning>
+This endpoint has no built-in authentication or TLS: anyone who can reach it can read all your metrics. That's more than a data-exposure risk: request rates, status codes, and latency broken down per API give an attacker a detailed map of your system's architecture, traffic patterns, and likely weak points, valuable reconnaissance for an attack. Restrict access at the network level, for example with firewall rules or security groups, rather than relying on Tyk Pump to secure it.
+</Warning>
+
+### Base Metrics
+
+By default, the `prometheus` pump exposes these metrics:
+
+| Metric | Type | Labels | Description |
+| :-- | :-- | :-- | :-- |
+| `tyk_http_status` | Counter | `code`, `api` | HTTP status codes per API. |
+| `tyk_http_status_per_path` | Counter | `code`, `api`, `path`, `method` | HTTP status codes per API path and method. |
+| `tyk_http_status_per_key` | Counter | `code`, `key` | HTTP status codes per access key. |
+| `tyk_http_status_per_oauth_client` | Counter | `code`, `client_id` | HTTP status codes per OAuth client. |
+| `tyk_latency` | Histogram | `type`, `api` | Latency added by Tyk, per API. `type` distinguishes total, upstream, and gateway latency. |
+
+You can add further custom metrics of your own; see [Custom Metrics](#custom-metrics) below.
+
+### Configuring the Pump
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `prometheus` pump accepts the following `meta` fields. Add them to `pump.conf`:
+
+```json
+{
+  "pumps": {
+    "prometheus": {
+      "type": "prometheus",
+      "meta": {
+        "listen_address": ":9090",
+        "path": "/metrics",
+        "custom_metrics": [],
+        "disabled_metrics": []
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `listen_address` | - | Bind address for the metrics endpoint, in Go's `host:port` format. Use `:9090` to listen on all interfaces; add a host, for example `127.0.0.1:9090`, only if you want to restrict it to one interface. |
+| `path` | `/metrics` | HTTP path Prometheus scrapes. |
+| `custom_metrics` | (none) | Additional counters and histograms, on top of the [base metrics](#base-metrics) above. See [Custom Metrics](#custom-metrics) below. |
+| `disabled_metrics` | (none) | Base metric families to remove. |
+
+Tyk Pump will listen on the port configured in `listen_address`. The Prometheus scraper must be configured to access that port on the Tyk Pump service. You must ensure that the port is exposed for the scraper to find.
+
+Restart Tyk Pump, then verify metrics are exposed by visiting `http://<tyk-pump-host>:9090/metrics` from a machine that can reach it. Then add a scrape target to your [Prometheus configuration](https://prometheus.io/docs/prometheus/latest/configuration/configuration/) pointing at that same host and port, and connect a [Grafana data source](https://grafana.com/docs/grafana/latest/datasources/add-a-data-source/) to your Prometheus server. See the [Tyk Pump GitHub repository](https://github.com/TykTechnologies/tyk-pump#prometheus) for example dashboard queries, including request rate, error rate, and percentile latency, per API or across all APIs.
+
+### Custom Metrics
+
+The base metrics above cover a fixed set of dimensions. You can define your own counters and histograms instead, built from any traffic log fields you choose as labels, for example, you could break down requests by a custom aggregation tag or API alias that the base metrics don't expose.
+
+Add custom metrics to your Prometheus pump using the `custom_metrics` object in the pump `meta`:
+
+```json
+"custom_metrics": [
+  {
+    "name": "tyk_http_requests_total",
+    "description": "Total of API requests",
+    "metric_type": "counter",
+    "labels": ["response_code", "api_name", "method", "api_key", "alias", "path"]
+  },
+  {
+    "name": "tyk_http_latency",
+    "description": "Latency of API requests",
+    "metric_type": "histogram",
+    "labels": ["type", "response_code", "api_name", "method", "api_key", "alias", "path"],
+    "buckets": [1, 5, 10, 50, 100, 500, 1000, 5000, 10000]
+  }
+],
+```
+
+Each entry accepts:
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `name` | - | Metric name. |
+| `description` | - | Metric description. |
+| `metric_type` | - | `counter` or `histogram`. Histograms always observe the `request_time` field. |
+| `labels` | - | Traffic log fields to expose as metric labels. Available values: `host`, `method`, `path`, `response_code`, `api_key`, `time_stamp`, `api_version`, `api_name`, `api_id`, `org_id`, `oauth_id`, `request_time`, `ip_address`, `alias`, `mcp_method`, `mcp_primitive_type`, `mcp_primitive_name`, `mcp_error_code`. |
+| `buckets` | `[1, 2, 5, 7, 10, 15, 20, 25, 30, 40, 50, 60, 70, 80, 90, 100, 200, 300, 400, 500, 1000, 2000, 5000, 10000, 30000, 60000]` | Histogram bucket boundaries, in milliseconds. Histograms only. |
+| `mcp_only` | `false` | Restrict this metric to [MCP Gateway](/ai-management/mcp-gateway/overview) traffic. When `false`, the metric processes all traffic, and the `mcp_*` labels resolve to an empty string for non-MCP requests. |
+
+<Note>
+`mcp_method`, `mcp_primitive_type`, `mcp_primitive_name`, and `mcp_error_code` are only populated for MCP Gateway traffic. Use `mcp_only` to keep a metric exclusively for MCP records, for example to count MCP tool and prompt invocations separately from your REST API traffic:
+
+```json
+{
+  "name": "tyk_mcp_requests_total",
+  "description": "Total MCP requests per method and primitive",
+  "metric_type": "counter",
+  "labels": ["api_id", "mcp_method", "mcp_primitive_type", "mcp_primitive_name"],
+  "mcp_only": true
+}
+```
+</Note>
+
+### Docker
+
+If `listen_address` is set to `:9090`, make sure to publish port 9090 in addition to the health check port.
+
+For example, in Docker Compose:
+
+```yaml
+tyk-pump:
+   image: tykio/tyk-pump-docker-pub:${PUMP_VERSION}
+   ports:
+   - 8083:8083
+   - 9090:9090
+```
+
+### Kubernetes
+
+Tyk Pump's Prometheus endpoint can be scraped on Kubernetes using either of the standard Prometheus discovery mechanisms:
+
+- **Prometheus Operator**: if enabled on your cluster (for example via the [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) chart), it looks for `PodMonitor` or `ServiceMonitor` resources and scrapes the specified port automatically. Enable this with `tyk-pump.pump.prometheusPump.prometheusOperator.enabled=true` on the [Tyk OSS Helm chart](/product-stack/tyk-charts/tyk-oss-chart).
+- **Pod annotations**: if your Prometheus deployment scrapes pods by annotation instead, for example using the [prometheus-community/prometheus](https://github.com/prometheus-community/helm-charts/tree/main/charts/prometheus#scraping-pod-metrics-via-annotations) chart, set matching `prometheus.io/scrape`, `prometheus.io/path`, and `prometheus.io/port` annotations via `tyk-pump.pump.podAnnotations`.
+
+Either way, Tyk Pump must also be exposed as a Kubernetes service so Prometheus can reach `/metrics`: set `tyk-pump.pump.service.enabled: true`.
+
+<img src="/img/diagrams/pump-prometheus.png" alt="Tyk Pump exposing Prometheus metrics on Kubernetes" />
+
+## StatsD
+
+[StatsD](https://github.com/etsy/statsd) is a network daemon that listens for statistics sent over UDP or TCP and forwards aggregates to pluggable backend services. The `statsd` pump sends per-request metrics to a StatsD server this way, derived from the same traffic logs as the other pumps on this page.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `statsd` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "statsd": {
+      "type": "statsd",
+      "meta": {
+        "address": "localhost:8125",
+        "fields": ["request_time"],
+        "tags": ["path", "response_code", "api_key", "api_version", "api_name", "api_id", "raw_request", "ip_address", "org_id", "oauth_id"],
+        "separated_method": false
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `address` | - | StatsD server host and port. |
+| `fields` | - | Traffic log fields sent as timing values. Accepts `request_time`, `latency_total`, `latency_upstream`, and `latency_gateway`. |
+| `tags` | - | Traffic log fields sent as tags. |
+| `separated_method` | `false` | By default, the method and path are combined into a single path field. Set to `true` to record the method in its own field instead. |
+
+## DogStatsD (Datadog)
+
+Tyk Pump can send API traffic analytics to [Datadog](https://www.datadoghq.com/), which you can use to build [dashboards](https://docs.datadoghq.com/integrations/tyk/#dashboards) from your API traffic.
+
+**Prerequisites:**
+
+- A working Datadog agent. See the [Datadog Tyk integration documentation](https://docs.datadoghq.com/integrations/tyk/).
+- A [Tyk Self-Managed](/tyk-self-managed/install) or [Tyk Open Source](/apim/open-source/installation) installation with [Tyk Pump](/api-management/tyk-pump) configured.
+
+**How it works:** when running the Datadog Agent, the `dogstatsd` pump sends the [request_time](https://docs.datadoghq.com/integrations/tyk/#data-collected) metric from Tyk Pump in real time, per request, so you can aggregate by API, version, response code, method, and other parameters.
+
+In addition to the [common pump settings](/api-management/tyk-pump#common-pump-settings), the `dogstatsd` pump accepts the following `meta` fields:
+
+```json
+{
+  "pumps": {
+    "dogstatsd": {
+      "type": "dogstatsd",
+      "meta": {
+        "address": "dd-agent:8126",
+        "namespace": "tyk",
+        "async_uds": true,
+        "async_uds_write_timeout_seconds": 2,
+        "buffered": true,
+        "buffered_max_messages": 32,
+        "sample_rate": 0.9999999999,
+        "tags": ["method", "response_code", "api_version", "api_name", "api_id", "org_id", "tracked", "path", "oauth_id"]
+      },
+      ...
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `address` | - | Datadog agent host and port. |
+| `namespace` | - | Prefix applied to metrics sent to Datadog. |
+| `async_uds` | `false` | Enable async [UDS over UDP](https://github.com/Datadog/datadog-go#unix-domain-sockets-client). |
+| `async_uds_write_timeout_seconds` | - | Write timeout in seconds if `async_uds: true`. |
+| `buffered` | `false` | Enable buffering of messages. |
+| `buffered_max_messages` | `16` | Maximum messages per datagram if `buffered: true`. |
+| `sample_rate` | `1` | Fraction of requests to sample; `1` is 100%, `0.5` samples 50%. |
+| `tags` | `path`, `method`, `response_code`, `api_version`, `api_name`, `api_id`, `org_id`, `tracked`, `oauth_id` | Traffic log fields sent as tags. |
+
+<Note>
+Including `path` as a tag can generate significant cardinality, since it's unbounded.
+</Note>
+
+Tyk maintains a default Datadog dashboard canvas to give you an easier starting point. In the Datadog portal, under [Dashboards → Lists](https://app.datadoghq.com/dashboard/lists), it's named **Tyk Analytics Canvas**. To use it, ensure your Datadog agent deployment has the tag `env:tyk-demo-env` and that `dogstatsd.meta.namespace` is set to `pump`. You can also import it from the [Datadog integrations-extras repository](https://github.com/DataDog/integrations-extras/blob/master/tyk/assets/dashboards/tyk_analytics_canvas.json) and adjust those values to match your own setup.
+
+<img src="/img/pump/datadog-tyk-analytics-dashboard.jpeg" alt="Sample Datadog dashboard" />
diff --git a/api-management/migrate-from-tyk-classic.mdx b/api-management/migrate-from-tyk-classic.mdx
new file mode 100644
index 0000000000..e992774529
--- /dev/null
+++ b/api-management/migrate-from-tyk-classic.mdx
@@ -0,0 +1,197 @@
+---
+title: "Migrating from Tyk Classic APIs"
+description: "API Migration: Converting Tyk Classic APIs to Tyk OAS Format"
+keywords: "Tyk OAS API, Tyk Classic API, Migrate, Convert, Migration, Tyk Classic, Tyk OAS, API definition"
+sidebarTitle: "Migrate from Tyk Classic APIs"
+---
+
+## Overview
+
+From Tyk 5.8.0, you can convert your existing [Tyk Classic APIs](/api-management/gateway-config-tyk-classic) to the recommended [Tyk OAS API](/api-management/gateway-config-tyk-oas) format.
+
+The API Migration feature provides a powerful way to convert your existing Tyk Classic API definitions to the newer Tyk OAS format with various options to ensure a smooth transition. We've built support into the Tyk Dashboard's [API Designer](/api-management/migrate-from-tyk-classic#using-the-api-designer) to convert individual Tyk Classic APIs one by one. The Tyk Dashboard API [migrate endpoint](/api-management/migrate-from-tyk-classic#using-the-migration-api) allows you to migrate individual APIs or perform bulk migrations.
+
+### Features of Tyk Dashboard's Migration Feature
+
+- **Flexibility**: Migrate APIs using the API Designer or using the Tyk Dashboard API
+- **Bulk Migration**: Convert multiple APIs in a single operation via the Dashboard API
+- **Risk Mitigation**: Test migrations before applying changes
+- **Phased Implementation**: Stage and test migrations before final deployment
+- **Detailed Reporting**: Get comprehensive success, failure, and skip information
+
+## Migration Modes
+
+Tyk Dashboard supports four different migration modes to suit your needs:
+
+1. **Dry Run Mode**: Simulates the conversion process without making changes. This mode returns the converted API definitions in Tyk OAS format for your review, allowing you to verify the conversion before committing to it.
+
+2. **Stage Mode**: Perform a phased conversion by creating staged copies of your APIs in Tyk OAS format alongside the existing Tyk Classic APIs. You can then thoroughly test that the migrated APIs will behave as expected without affecting production traffic. When you are happy, you can **promote** the staged APIs.
+
+    The **staged** API will be the same as the original Tyk Classic, with the following modifications to allow it to coexist: 
+
+    - The API ID will have the `staging-` prefix added
+    - `[staged] ` prefix will be added to the API name
+    - The listen path will be modified by the addition of the `/tyk-staging` prefix
+    - A reference will be added to link the staged API to the original Tyk Classic API's ID
+
+3. **Promote Mode**: Promote previously staged APIs, replacing their Tyk Classic counterparts. This process removes the staging prefixes from ID, name, and listen path. It then replaces the original Tyk Classic API with the Tyk OAS version - the Tyk OAS API will inherit both the API ID and database ID of the original API.
+
+4. **Direct Mode**: Directly migrates APIs from Tyk Classic to Tyk OAS format without staging; typically this will be used if testing was performed on a **dry run** copy of the original. This mode will also replace the original Tyk Classic API with the Tyk OAS version - the Tyk OAS API will inherit both the API ID and database ID of the original API.
+
+
+
+    <Warning>
+    Note that both <b>Promote</b> and <b>Direct</b> operations are destructive. The converted API will replace the original in the API database, inheriting both API Id and database ID.
+    </Warning>
+
+
+## Using the API Designer
+
+The API Designer provides a simple interface for migrating your Tyk Classic APIs to Tyk OAS, offering both **staged** and **direct** conversions.
+
+1. **Back Up Your APIs:**
+
+    First ensure that you have taken a backup of your API, in case of accidental deletion - the direct and promote operations are destructive and will permanently delete the original Tyk Classic API definition from your database. You can export the API definition using the **Actions** menu or, if you want to backup all APIs you can do so via the Tyk Dashboard API by following [these instructions](/developer-support/upgrading#backup-apis-and-policies).
+
+2. **Start API Migration:**
+
+    Find the API that you want to convert in the list of **Created APIs**. You can use the **Select API type** filter to show just Tyk Classic APIs.
+
+    <img src="/img/dashboard/api-designer/migrate-classic-filter.png" alt="Applying a filter to see just the Tyk Classic APIs" />
+
+    From the **Actions** menu select **Convert to Tyk OAS**. You can also find this option in the **Actions** menu within the Tyk Classic API Designer.
+
+    <img src="/img/dashboard/api-designer/migrate-classic-actions.png" alt="Convert an API to Tyk OAS" />
+    
+    This will open the **Convert to Tyk OAS** mode selector. Choose whether to **stage** the conversion or perform a **direct** migration, then select **Convert API**.
+
+    <img src="/img/dashboard/api-designer/migrate-classic-choose.png" alt="Choosing the migration path: staged or direct" />
+
+5. **Staging the API:**
+
+    If you selected **stage** you'll be taken to the API Designer for the newly created staged Tyk OAS API. Note the prefixes that have been applied to the API name, API ID and API base path.
+
+    <img src="/img/dashboard/api-designer/migrate-classic-staged.png" alt="The staged Tyk OAS API with prefixes" />
+
+    For the staged API, you can now validate the configuration, make any required modifications and test that behavior is as expected.
+
+6. **Promote the Stage API:**
+
+    When you are ready, you can promote the staged API to complete migration by selecting **Promote staged API** from the API Designer's **Actions** menu. Note that the **promote** option is not available from the API list, only within the API Designer for the specific API. This is to protect against accidentally promoting the wrong API.
+
+    <img src="/img/dashboard/api-designer/migrate-classic-promote.png" alt="Promoting a staged API" />
+<br />
+
+    <img src="/img/dashboard/api-designer/migrate-classic-confirm.png" alt="Confirm the promotion" />
+<br />
+
+    
+<Note>
+There is a known issue in Tyk 5.8.0 that the <b>cancel</b> button does not work in the promotion confirmation window, so once you have selected <b>Promote staged API</b> you will have to hit <b>back</b> in your browser if you do not want to complete the migration. This will be addressed in the next patch.
+</Note>
+
+
+
+7. **Final Stage:**
+
+    Following promotion, or if you selected **direct** conversion, you'll be taken to the API Designer for the newly created Tyk OAS API. Note that this has inherited the API ID from your Tyk Classic API and has replaced the Tyk Classic in your API database.
+
+    <img src="/img/dashboard/api-designer/migrate-classic-oas.png" alt="Migration complete!" />
+
+## Using the Migration API
+
+You can use the Tyk Dashboard API to convert individual APIs, multiple API, or all APIs stored in your API storage database via the dedicated [/migrate](/api-management/migrate-from-tyk-classic#tyk-dashboard-api-migrate-endpoint) endpoint.
+
+### Tyk Dashboard API Migrate Endpoint
+
+`POST /api/apis/migrate`
+
+The payload for this request is:
+
+```json
+{
+  "mode": "dryRun",           // Required: Migration mode (dryRun, stage, promote, direct)
+  "apiIDs": ["api123", "api456"], // List of API IDs to migrate (cannot be used with 'all')
+  "all": false,               // Migrate all APIs (cannot be used with 'apiIDs')
+  "abortOnFailure": false,    // Stop migration process on first failure
+  "overrideStaged": false     // When mode is 'stage', overwrite existing staged APIs
+}
+```
+
+- Indicate the migration [mode] using the following options:
+
+    - `dryRun`
+    - `stage`
+    - `promote`
+    - `direct`
+
+- You can convert specific APIs by providing their API IDs in the `apiIDs` array or convert all your Tyk Classic APIs in one go using the `all` option.
+
+- Set `abortOnFailure` to `true` if you want Tyk to stop processing if it encounters a failure while operating on a batch of APIs.
+
+- You can only have one **staged** version of a Tyk Classic API, so if you have already started the migration of an API and try again - for example after making changes to the original Tyk Classic API, the operation will fail. Use **overrideStaged** to delete the existing staged API and create a new one.
+
+
+#### Example: Dry Run Migration
+
+```
+curl -X POST \
+  https://your-tyk-dashboard/api/apis/migrate \
+  -H "Authorization: your-dashboard-api-key" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "mode": "dryRun",
+    "apiIDs": ["api123", "api456"],
+    "abortOnFailure": false
+  }'
+```
+
+#### Example: Migrate All APIs
+
+```
+curl -X POST \
+  https://your-tyk-dashboard/api/apis/migrate \
+  -H "Authorization: your-dashboard-api-key" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "mode": "direct",
+    "all": true,
+    "abortOnFailure": false
+  }'
+```
+
+## Known Limitations of Migration
+
+There are some differences between the way Tyk Gateway works with Tyk Classic and Tyk OAS APIs, so you are advised to take the following into account and, if your API uses any of these features, to stage (or dry run) your migrations and ensure you perform appropriate testing on the interim versions.
+
+1. **Handling of Regular Expression Path Parameters**
+
+    When migrating APIs with regex-based path parameters, be aware that:
+
+    - In Tyk Classic, the Gateway only routes requests matching the regex pattern
+    - In Tyk OAS, the Gateway routes all requests matching the pattern structure by default
+
+    Recommended action: Enable the [Validate Request](/api-management/traffic-transformation/request-validation#request-validation-using-tyk-oas) middleware in your migrated Tyk OAS API to maintain the same behavior.
+
+2. **Location of Mock Response Middleware**
+
+    The position of mock response middleware in the request processing chain [differs between Tyk Classic and Tyk OAS](/api-management/traffic-transformation/mock-response#how-it-works):
+
+    - In Tyk Classic, it appears at the start of the request processing chain (before authentication)
+    - In Tyk OAS, it appears at the end of the request processing chain
+
+    During migration, the system automatically adds the [ignore authentication](/api-management/traffic-transformation/ignore-authentication#ignore-authentication-overview) middleware to endpoints with mock responses to maintain similar behavior. Note, however, that any other middleware configured for that endpoint or at the API level will be applied for the Tyk OAS API (which was not the case for the Tyk Classic API).
+
+3. **Enhanced Request Validation**
+
+    Tyk OAS uses the more advanced [Validate Request](/api-management/traffic-transformation/request-validation#request-validation-using-tyk-oas) middleware, whereas Tyk Classic is limited to the [Validate JSON](/api-management/traffic-transformation/request-validation#request-validation-using-classic) middleware. The migration will configure Validate Request to check the request body (as performed by Validate JSON).
+
+## Recommended Migration Strategy
+
+For a safe migration approach, we recommend following these steps:
+1. **Back Up Your APIs**: Perform a full [back-up](/developer-support/upgrading#backup-apis-and-policies) of your API Definitions - remember that the final migration is destructive, as the Tyk OAS APIs will inherit the database and API IDs of the originals
+2. **Start with Dry Run**: Use the `dryRun` mode to validate the migration before making changes
+3. **Stage Critical APIs**: For important APIs, use the `stage` mode to create test versions
+4. **Test Thoroughly**: Verify all functionality in the staged APIs
+5. **Promote Gradually**: Once testing is complete, use the `promote` mode to complete the migration of original APIs in batches
+6. **Monitor Performance**: After migration, closely monitor the performance of migrated APIs
diff --git a/api-management/multiple-environments.mdx b/api-management/multiple-environments.mdx
new file mode 100644
index 0000000000..35a8d2abb8
--- /dev/null
+++ b/api-management/multiple-environments.mdx
@@ -0,0 +1,230 @@
+---
+title: "Promote APIs, Keys and Policies Between Environments"
+description: "Learn how to promote APIs, keys and policies between Tyk environments, such as Development, Staging and Production"
+keywords: "Multiple Environments, Environment Promotion, Move APIs, Move Keys, Move Policies, Tyk Sync, Export, Import"
+sidebarTitle: "Promote Between Environments"
+---
+
+## Introduction
+
+It is possible with the Multi-Cloud and the Self-Managed version of Tyk to manage multiple environments across data centers. This can be very useful if you have QA, UAT and Production environments that are physically or geographically separate and you want to move API configurations between environments seamlessly.
+
+This page explains how to promote APIs, keys and policies from one environment to another. If you instead want to segment a single Tyk cluster into zones, so that specific Gateways selectively load specific APIs, see [Gateway and API Sharding](/api-management/api-sharding).
+
+## Move APIs Between Environments 
+
+It is possible to move APIs between Tyk environments in the following ways:
+
+### In Shared Dashboard Environments
+
+If the environments are both Self-Managed installations and are sharing a Tyk Dashboard (and optionally an MDCB instance) then you can use API and Gateway tagging to transparently and effortlessly move an API from one environment to another.
+
+See [API Tagging](/api-management/api-sharding#api-tagging-with-on-premises) for more details.
+
+#### API Sharding
+
+You can also use [API Sharding](/api-management/api-sharding#what-is-api-sharding-) to move APIs in a Shards (and or MDCB) Tyk Self-Managed installation.
+
+### In Separate Dashboard Environments
+
+If the API dashboards are separate and you wish to migrate API Definitions between two completely segregated environments (e.g. migrating to new hardware or a new DC), then you can use the Export functionality of the Dashboard to download the API definition as JSON and import it into your new installation.
+
+#### Steps for Configuration:
+
+1. **Select Your API**
+
+    From the **API Designer**, select your API:
+
+    <img src="/img/2.10/apis_list.png" alt="API designer" />
+
+2. **Export the API**
+
+    Click **EXPORT**:
+
+    <img src="/img/2.10/export_api_button.png" alt="Export button location" />
+
+3. **Save the API**
+
+    Save and rename the JSON file:
+
+4. **Import into your New Environment**
+
+    In your new environment, click **IMPORT API**:
+
+    <img src="/img/2.10/import_api_button.png" alt="Select import" />
+
+5. **Generate the new API**
+
+    Select the **From Tyk Definition** tab and paste the contents of the JSON file into the code editor and click **GENERATE API**:
+
+    <img src="/img/2.10/import_tyk_definition.png" alt="Generate API" />
+
+    This will now import the API Definition into your new environment, if you have kept the API ID in the JSON document as is, the ID will remain the same.
+
+
+
+    <Note>
+    The ID you use in with any Dashboard API integrations will change as the documents physical ID will have changed with the import.
+    </Note>
+
+
+### Use Tyk-Sync
+
+You can also use our new Tyk-Sync tool which allows you to sync your APIs (and Policies) with a Version Control System (VCS). You can then move your APIs between environments. See [Tyk-Sync](/api-management/automations/sync) for more details.
+
+## Move Keys Between Environments 
+
+Tyk currently does not have a facility to export a group of keys from one environment and reissue them in another and still be able to manage those keys from within the Dashboard.
+
+However, it is possible to temporarily allow access to existing keys in a new environment, but it should be noted that these keys should eventually be expired and re-generated within the new environment.
+
+### Moving Keys Between Environments / Creating Custom Keys
+
+In order to use a legacy key in a new environment, simply extract the key from the old environment using the Tyk REST APIs and then create them in the new environment using the custom key creation API.
+
+To create a key with a custom identifier, ie Token, simply use the [Gateway (OSS)](/tyk-gateway-api) or [Dashboard (Pro)](https://tyk.io/docs/api-reference/keys/create-custom-key) REST APIs to import a custom key.
+
+## Move Policies Between Environments 
+
+Moving policies between two (Dashboard) environments is not as easy as moving API definitions and requires working with the Dashboard API to first retrieve the policies, and then modifying the document to reinsert them in your new environment:
+
+### Preparation
+
+First you must set up your new environment to respect explicit policy IDs. To do so, edit the `tyk.conf` and `tyk_analytics.conf` files in your new environment and set the `policies. allow_explicit_policy_id` setting to `true` (the setting is just `allow_explicit_policy_id` at the root level of the Dashboard configuration). In order to retain your `api_id` when moving between environments then set `enable_duplicate_slugs` to `true` in your target `tyk_analytics.conf`.
+
+### Steps for Configuration
+
+1. **Get your Policy**
+
+    ```{.copyWrapper}
+    curl -X GET -H "authorization: {YOUR TOKEN}" \
+    -s \
+    -H "Content-Type: application/json" \
+    https://admin.cloud.tyk.io/api/portal/policies/{POLICY-ID} | python -mjson.tool > policy.json
+    ```
+
+2. **Edit the file we just created**
+
+    The original file will look something like this, notice the two ID fields:
+
+    ```{.json}
+    {
+    "_id": "5777ecdb0a91ff0001000003",
+    "access_rights": {
+        "xxxxx": {
+        "allowed_urls": [],
+        "api_id": "xxxxx",
+        "api_name": "Test",
+        "versions": [
+            "Default"
+        ]
+        }
+    },
+    "active": true,
+    "date_created": "0001-01-01T00:00:00Z",
+    "hmac_enabled": false,
+    "id": "",
+    "is_inactive": false,
+    "key_expires_in": 0,
+    "name": "Test Policy",
+    "org_id": "xxxxx",
+    "partitions": {
+        "acl": false,
+        "quota": false,
+        "rate_limit": false
+    },
+    "per": 60,
+    "quota_max": -1,
+    "quota_renewal_rate": 60,
+    "rate": 1000,
+    "tags": []
+    }
+    ```
+
+3. **Move the id field value**
+
+    Remove the `_id` field and put the value of the `_id` field into the `id` field, so `policy.json` should look like this:
+
+    ```{.json}
+    {
+    "access_rights": {
+        "xxxxx": {
+        "allowed_urls": [],
+        "api_id": "xxxxx",
+        "api_name": "Test",
+        "versions": [
+            "Default"
+        ]
+        }
+    },
+    "active": true,
+    "date_created": "0001-01-01T00:00:00Z",
+    "hmac_enabled": false,
+    "id": "5777ecdb0a91ff0001000003", <------ NEW ID FIELD
+    "is_inactive": false,
+    "key_expires_in": 0,
+    "name": "Test Policy",
+    "org_id": "xxxxx",
+    "partitions": {
+        "acl": false,
+        "quota": false,
+        "rate_limit": false
+    },
+    "per": 60,
+    "quota_max": -1,
+    "quota_renewal_rate": 60,
+    "rate": 1000,
+    "tags": []
+    }
+    ```
+
+4. **Update the policy via the API**
+
+    Save the new `policies.json` file and then let's POST it back to the new environment:
+
+    ```{.copyWrapper}
+    curl -X POST -H "authorization: {API-TOKEN}" \
+    -s \
+    -H "Content-Type: application/json" \
+    -d @policies.json \
+    https://{YOUR-NEW-ENV}/api/portal/policies | python -mjson.tool
+    ```
+
+That's it, Tyk will now load this policy, and you will be able to manage and edit it the same way in your new environment, if you are re-creating tokens in your new environment, then those tokens' ACL does not need to be changed to a new policy ID since the legacy one will always be used as the reference for the policy.
+
+#### Policy IDs in the Dashboard
+
+After migrating a Policy from one environment to another, it is important to note that the **displayed** Policy ID is not going to match.  **That is okay**.  It happens because Tyk Dashboard displays the [`Mongo ObjectId`](https://docs.mongodb.com/manual/reference/glossary/#term-id), which is the `_id` field, but the `id` is the important part.
+
+**For example:**
+
+Policies in source environment
+<img src="/img/2.10/policy_id_before.png" alt="Policy ID Before" />
+
+Policies in target environment after migration
+<img src="/img/2.10/policy_id_after.png" alt="Policy ID After" />
+
+Notice that the IDs appear to be different.  These are the BSON IDs and are expected to be different.  But if we look for the underlying GUID `id`, you can see it's been mapped properly in the target environment.
+
+```
+$ curl dash-host-source/api/portal/policies/
+
+    ....
+    "_id": "5eb1b133e7644400013e54ec",
+    "id": "",
+    "name": "credit score",
+
+$ curl dash-host-target/api/portal/policies/
+
+    ....
+    "_id": "5f03be2ce043fe000177b047",
+    "id": "5eb1b133e7644400013e54ec",
+    "name": "credit score",
+```
+
+As you can see, under the hood, the policy has been migrated correctly with target Tyk Dashboard saving the proper ID inside `id`.   That is the value that will be referred to inside Key Creation, etc.
+
+### Use Tyk-Sync
+
+You can also use our new Tyk-Sync tool which allows you to sync your Policies (and APIs) with a Version Control System (VCS). You can then move your Policies between environments. See [Tyk-Sync](/api-management/automations/sync) for more details.
+
diff --git a/api-management/observability-getting-started.mdx b/api-management/observability-getting-started.mdx
new file mode 100644
index 0000000000..94b5b7d717
--- /dev/null
+++ b/api-management/observability-getting-started.mdx
@@ -0,0 +1,385 @@
+---
+title: "Get Started with Tyk Observability"
+description: "Add logs, distributed traces, and metrics to a Tyk Gateway deployment using Docker Compose with an OpenTelemetry Collector, Prometheus, Loki, Tempo, and Grafana."
+sidebarTitle: "Getting Started"
+keywords: ["opentelemetry", "OTLP", "logs", "metrics", "traces", "observability", "getting started", "docker compose", "grafana", "prometheus", "loki", "tempo"]
+---
+
+## Introduction
+
+Tyk Gateway exports all three observability signals (structured logs, distributed traces, and metrics) via the OpenTelemetry Protocol (OTLP). This guide shows you how to enable each signal and route them to a local Grafana stack (Prometheus, Loki, Tempo) using an OpenTelemetry Collector.
+
+By the end of this guide you will have:
+
+- Structured JSON access logs from Tyk Gateway shipping to [Loki](https://grafana.com/oss/loki/)
+- Distributed traces exporting to [Tempo](https://grafana.com/oss/tempo/)
+- Gateway metrics (request rate, latency, error rate) flowing to [Prometheus](https://grafana.com/oss/prometheus/)
+- A Grafana instance wired up to all three backends
+
+## Availability
+
+| Signal | Minimum Gateway version |
+|--------|------------------------|
+| Structured JSON logs (`log_format: json`) | 5.6.0 |
+| Access logs (`access_logs.enabled`) | 5.8.0 |
+| Distributed traces (OTLP) | 5.3.0 |
+| OTLP metrics | 5.13.0 |
+
+## Prerequisites
+
+- [Docker](https://docs.docker.com/get-docker/) and [Docker Compose](https://docs.docker.com/compose/install/) installed
+- A running Tyk deployment. We recommend following the [Tyk getting started guide](https://tyk.io/docs/getting-started/quick-start#getting-started-with-tyk-self-managed) to set up a local Docker environment
+- Basic familiarity with Docker Compose
+
+## Architecture
+
+All three signals flow from Tyk Gateway to a single OpenTelemetry Collector endpoint. The Collector fans them out to the appropriate backend. Grafana queries all three.
+
+```mermaid
+flowchart LR
+    TGW[Tyk Gateway]
+    COL[OTel Collector]
+    PRO[Prometheus]
+    LOK[Loki]
+    TMP[Tempo]
+    GRA[Grafana]
+
+    TGW -->|"OTLP gRPC :4317\n(traces + metrics)"| COL
+    TGW -->|"container logs\n(filelog receiver)"| COL
+    COL -->|metrics| PRO
+    COL -->|logs| LOK
+    COL -->|traces| TMP
+    PRO --> GRA
+    LOK --> GRA
+    TMP --> GRA
+```
+
+<Note>
+Tyk Gateway does not export logs via OTLP. It writes structured JSON to `stderr`. The OTel Collector reads those logs from the Docker container log path using the `filelog` receiver.
+</Note>
+
+## Instructions
+
+### Step 1: Configure Tyk Gateway
+
+Add the following environment variables to your `tyk-gateway` service. These enable all three signals:
+
+```yaml expandable
+services:
+  tyk-gateway:
+    environment:
+      # Structured JSON logs (requires v5.6.0+)
+      - TYK_GW_LOGFORMAT=json
+      # Per-request access logs with trace ID correlation (requires v5.8.0+)
+      - TYK_GW_ACCESSLOGS_ENABLED=true
+
+      # Distributed tracing
+      - TYK_GW_OPENTELEMETRY_TRACES_ENABLED=true
+      - TYK_GW_OPENTELEMETRY_TRACES_ENDPOINT=otel-collector:4317
+      - TYK_GW_OPENTELEMETRY_TRACES_SAMPLING_TYPE=TraceIDRatioBased
+      - TYK_GW_OPENTELEMETRY_TRACES_SAMPLING_RATE=1.0
+
+      # OTLP metrics
+      - TYK_GW_OPENTELEMETRY_METRICS_ENABLED=true
+      - TYK_GW_OPENTELEMETRY_METRICS_ENDPOINT=otel-collector:4317
+      - TYK_GW_OPENTELEMETRY_METRICS_EXPORTINTERVAL=15
+```
+
+If you prefer `tyk.conf`, the equivalent configuration is:
+
+```json expandable
+{
+  "log_format": "json",
+  "access_logs": {
+    "enabled": true
+  },
+  "opentelemetry": {
+    "traces": {
+      "enabled": true,
+      "endpoint": "otel-collector:4317",
+      "sampling": {
+        "type": "TraceIDRatioBased",
+        "rate": 1.0
+      }
+    },
+    "metrics": {
+      "enabled": true,
+      "endpoint": "otel-collector:4317",
+      "export_interval": 15
+    }
+  }
+}
+```
+
+<Note>
+`sampling.rate: 1.0` captures every request, which is suitable for getting started. In production, lower this to `0.1` (10%) or use `ParentBased` sampling. See the [Tyk Gateway configuration reference](/tyk-oss-gateway/configuration#opentelemetry-sampling) for all options.
+</Note>
+
+### Step 2: Add the OTel Collector
+
+Create an `otelcol-config.yml` file in your deployment directory:
+
+```yaml expandable
+receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: 0.0.0.0:4317
+      http:
+        endpoint: 0.0.0.0:4318
+
+  filelog/tyk-gateway:
+    include: ["/var/lib/docker/containers/*/*-json.log"]
+    include_file_name: false
+    include_file_path: true
+    start_at: end
+    operators:
+      - type: json_parser
+        parse_from: body
+        parse_to: attributes.docker
+        on_error: drop
+      - type: move
+        from: attributes.docker.log
+        to: body
+      - type: json_parser
+        parse_from: body
+        parse_to: attributes.tyk
+        on_error: drop
+      - type: filter
+        expr: 'attributes.tyk.prefix == nil and attributes.tyk.msg == nil'
+      - type: time_parser
+        parse_from: attributes.tyk.time
+        layout: '%Y-%m-%dT%H:%M:%SZ'
+        on_error: send_quiet
+      - type: severity_parser
+        parse_from: attributes.tyk.level
+        on_error: send_quiet
+
+processors:
+  batch: {}
+  resource/tyk_gateway_logs:
+    attributes:
+      - action: upsert
+        key: service.name
+        value: tyk-gateway
+  memory_limiter:
+    check_interval: 1s
+    limit_percentage: 75
+    spike_limit_percentage: 20
+  transform/tyk_gw_resource_attrs:
+    error_mode: ignore
+    metric_statements:
+      - context: datapoint
+        statements:
+          - set(attributes["tyk_gw_id"], resource.attributes["tyk.gw.id"]) where resource.attributes["tyk.gw.id"] != nil
+          - set(attributes["tyk_gw_group_id"], resource.attributes["tyk.gw.group.id"]) where resource.attributes["tyk.gw.group.id"] != nil
+          - set(attributes["tyk_gw_tags"], resource.attributes["tyk.gw.tags"]) where resource.attributes["tyk.gw.tags"] != nil
+
+exporters:
+  otlphttp/prometheus:
+    endpoint: "http://prometheus:9090/api/v1/otlp"
+    tls:
+      insecure: true
+  otlphttp/loki:
+    endpoint: "http://loki:3100/otlp"
+    tls:
+      insecure: true
+  otlp/tempo:
+    endpoint: "tempo:4317"
+    tls:
+      insecure: true
+
+service:
+  pipelines:
+    traces:
+      receivers: [otlp]
+      processors: [memory_limiter, batch]
+      exporters: [otlp/tempo]
+    metrics:
+      receivers: [otlp]
+      processors: [memory_limiter, transform/tyk_gw_resource_attrs, batch]
+      exporters: [otlphttp/prometheus]
+    logs:
+      receivers: [filelog/tyk-gateway]
+      processors: [memory_limiter, resource/tyk_gateway_logs, batch]
+      exporters: [otlphttp/loki]
+```
+
+Then add the `otel-collector` service to your `docker-compose.yml`:
+
+```yaml expandable
+services:
+  otel-collector:
+    image: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-contrib:0.133.0
+    user: "0"   # Required — without this, permission denied reading /var/lib/docker/containers
+    volumes:
+      - ./otelcol-config.yml:/etc/otelcol-contrib/config.yaml
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    ports:
+      - "4317:4317"
+      - "4318:4318"
+    networks:
+      - tyk
+```
+
+The volume mounts give the Collector read access to Docker container logs for the `filelog` receiver.
+
+### Step 3: Add the Grafana stack
+
+Add Prometheus, Loki, Tempo, and Grafana to your `docker-compose.yml`:
+
+```yaml expandable
+services:
+  prometheus:
+    image: prom/prometheus:v3.4.0
+    command:
+      - --config.file=/etc/prometheus/prometheus.yml
+      - --web.enable-otlp-receiver
+    volumes:
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml
+    ports:
+      - "9090:9090"
+    networks:
+      - tyk
+
+  loki:
+    image: grafana/loki:3.5.0
+    command: -config.file=/etc/loki/local-config.yaml
+    ports:
+      - "3100:3100"
+    networks:
+      - tyk
+
+  tempo:
+    image: grafana/tempo:2.7.2
+    command: -config.file=/etc/tempo.yaml
+    volumes:
+      - ./tempo.yaml:/etc/tempo.yaml
+    ports:
+      - "3200:3200"
+      - "4317"
+    networks:
+      - tyk
+
+  grafana:
+    image: grafana/grafana:12.0.0
+    environment:
+      - GF_AUTH_ANONYMOUS_ENABLED=true
+      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
+    volumes:
+      - ./grafana/provisioning:/etc/grafana/provisioning
+    ports:
+      - "3001:3000"
+    networks:
+      - tyk
+    depends_on:
+      - prometheus
+      - loki
+      - tempo
+```
+
+<Note>
+Grafana is mapped to port `3001` to avoid conflicting with Tyk Dashboard on port `3000`. Adjust if needed.
+</Note>
+
+Create a minimal `prometheus.yml` to allow OTLP ingest:
+
+```yaml
+global:
+  scrape_interval: 15s
+
+storage:
+  tsdb:
+    out_of_order_time_window: 10m
+```
+
+Create a minimal `tempo.yaml`:
+
+```yaml expandable
+server:
+  http_listen_port: 3200
+
+distributor:
+  receivers:
+    otlp:
+      protocols:
+        grpc:
+          endpoint: 0.0.0.0:4317
+
+storage:
+  trace:
+    backend: local
+    local:
+      path: /tmp/tempo/blocks
+```
+
+#### Provision Grafana datasources
+
+Create `grafana/provisioning/datasources/tyk.yaml`:
+
+```yaml expandable
+apiVersion: 1
+datasources:
+  - name: Prometheus
+    type: prometheus
+    url: http://prometheus:9090
+    isDefault: true
+
+  - name: Loki
+    type: loki
+    url: http://loki:3100
+
+  - name: Tempo
+    type: tempo
+    url: http://tempo:3200
+```
+
+### Step 4: Start and verify
+
+Restart your deployment to apply the configuration changes to your Gateway and bring up the new services:
+
+```bash
+docker compose up -d
+```
+
+Send test requests through Tyk Gateway, then open Grafana at **http://localhost:3001** and verify each signal.
+
+<Note>
+If you are following this guide using the Tyk Self-Managed getting started setup, an **httpbingo** API is pre-configured. Generate test traffic with:
+
+```bash
+for i in $(seq 1 10); do curl -s -o /dev/null -w "HTTP %{http_code}\n" \
+  -H "Authorization: <your-api-key>" http://localhost:8080/httpbingo/get; done
+```
+</Note>
+
+**Metrics**: in Explore, select the Prometheus datasource and run:
+```promql
+{__name__="tyk.http.requests_total"}
+```
+You should see request counts rise as traffic flows through the Gateway.
+
+![Metrics in Grafana](/img/observability/grafana-metrics.png)
+
+**Logs**: in Explore, select the Loki datasource and run:
+```logql
+{service_name="tyk-gateway"} | json
+```
+You should see structured access log entries with fields like `api_id`, `path`, `status`, `latency_total`, and `trace_id`.
+
+![Logs in Grafana](/img/observability/grafana-logs.png)
+
+**Traces**: in Explore, select the Tempo datasource and search for recent traces. Each trace should show one span for the request.
+
+![Traces in Grafana](/img/observability/grafana-traces.png)
+
+<Tip>
+If traces are not appearing, verify that `TYK_GW_OPENTELEMETRY_TRACES_ENABLED=true` is set and that the Gateway can reach `otel-collector:4317`. Check the OTel Collector logs with `docker compose logs otel-collector` for any connection errors.
+</Tip>
+
+## Next steps
+
+- **Explore default metrics**: see all Gateway metrics available out of the box in [Default Metrics](/api-management/logs-metrics)
+- **Add custom metrics**: attach request headers, JWT claims, and response codes as metric dimensions using [Custom Metrics](/api-management/metrics/custom-metrics)
+- **Kubernetes deployment**: for log collection in Kubernetes using the OTel Collector DaemonSet, see [Collecting Gateway Logs with OTel on Kubernetes](/api-management/collecting-gateway-logs-otel-kubernetes)
diff --git a/api-management/observability.mdx b/api-management/observability.mdx
new file mode 100644
index 0000000000..28237a1fe8
--- /dev/null
+++ b/api-management/observability.mdx
@@ -0,0 +1,121 @@
+---
+title: "OpenTelemetry in Tyk Gateway: Tracing, Metrics, and Logs"
+description: "Tyk's native OpenTelemetry support for distributed tracing, metrics export, and log collection. The recommended observability approach for Tyk Gateway."
+keywords: "OpenTelemetry, OTel, OTLP, Distributed Tracing, Metrics, Observability, Tyk Gateway, Prometheus, Datadog, Jaeger"
+sidebarTitle: "Overview"
+---
+
+[OpenTelemetry](https://opentelemetry.io/docs/what-is-opentelemetry/) is an open-source observability framework providing a vendor-neutral standard for collecting traces, metrics, and logs. Since Tyk Gateway v5.2, it is the recommended observability approach for Tyk Gateway.
+
+Tyk supports all three signals. Traces and metrics are exported natively via the [OpenTelemetry Protocol (OTLP)](https://opentelemetry.io/docs/specs/otlp/) to any compatible backend. Logs are written as structured JSON to stderr and collected by an external agent. No additional components are required alongside Tyk to get started.
+
+<img src="/img/observability/tyk-observability.png" alt="Tyk Gateway exporting traces and metrics via OTLP to tracing and metrics backends, and logs via stdout to an OTel Collector and log backend" />
+
+## Tracing
+
+Distributed tracing gives you an end-to-end view of individual API requests as they flow through Tyk Gateway and into your upstream services. Traces help you pinpoint latency bottlenecks, trace error propagation across services, and understand the full request lifecycle.
+
+Tyk generates parent and child [spans](https://opentelemetry.io/docs/concepts/signals/traces/#spans) for each proxied request. For each API, you can optionally enable **detailed tracing** to produce a span per middleware, giving granular visibility into authentication, rate limiting, transformation, and routing steps.
+
+**Supported propagation formats:** W3C TraceContext (default), B3, and custom or composite header modes for proprietary correlation headers.
+
+**Supported backends:** Datadog, Dynatrace, Jaeger, New Relic, Elastic, and any OTLP-compatible endpoint.
+
+For configuration details and vendor-specific integration guides, see [Distributed Tracing with Tyk](/api-management/traces).
+
+## Metrics
+
+Tyk Gateway natively pushes metrics to any OTLP-compatible backend with a configurable push interval. No sidecar or agent is required alongside the Gateway.
+
+When enabled, the Gateway automatically exports three groups of metrics:
+
+- **Request metrics:** Rate, Errors, and Duration (RED) with a three-way latency split: total, Gateway-only, and upstream-only
+- **Go runtime metrics:** Memory usage, goroutine count, and GC health
+- **Configuration state metrics:** Number of APIs and policies loaded, config reload counts and durations
+
+You can extend these with [custom counters and histograms](/api-management/metrics/custom-metrics) that use request context, JWT claims, session data, response headers, or static API metadata as dimensions.
+
+**Compatible backends:** Prometheus, Grafana Mimir, Datadog, New Relic, Dynatrace, Elastic, and any OTel Collector.
+
+For full configuration details, see:
+
+- [OpenTelemetry Metrics Configuration](/api-management/logs-metrics): enabling metrics, export config, and cardinality control
+- [Default Gateway Metrics](/api-management/metrics/default-metrics): all automatically exported metrics and their dimensions
+- [Custom Metrics](/api-management/metrics/custom-metrics): defining your own counters and histograms
+
+## Logs
+
+Tyk Gateway writes logs to `stdout`/`stderr` in structured JSON format. It does not have a native OTLP log exporter. To ship gateway logs to an observability backend, deploy the [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/) with the [Filelog Receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/filelogreceiver). The Collector tails container log files on each Kubernetes node, optionally enriches them with pod and namespace metadata, and forwards them to a backend like Elasticsearch.
+
+For a step-by-step guide, see [Collecting Gateway Logs with OTel on Kubernetes](/api-management/collecting-gateway-logs-otel-kubernetes).
+
+## Dashboard Analytics
+
+Separately from OpenTelemetry, Tyk Dashboard has its own built-in Traffic Analytics UI and Log Browser, populated by [Tyk Pump](/api-management/tyk-pump) rather than OTel. This is not an alternative to OTel for external observability tooling, it's the only route into Tyk Dashboard's native analytics. See [Dashboard Analytics](/api-management/dashboard-analytics).
+
+## Resource Attributes
+
+All OTel signals produced by Tyk Gateway include resource attributes: metadata set once at startup that identifies the source instance. Use these to filter and correlate signals across nodes, edge groups, and environments.
+
+| Attribute | Always Present | Description |
+|:----------|:--------------|:------------|
+| `tyk.gw.id` / `service.instance.id` | Yes | Unique ID for this Gateway instance. |
+| `tyk.gw.dataplane` | Yes | Whether the Gateway is running in a distributed Data Plane. |
+| `tyk.gw.group.id` | No | Data Plane group ID. Populated only for Gateways in distributed Data Planes. |
+| `tyk.gw.tags` | No | Segment tags. Populated only when the Gateway is [segmented](/api-management/api-sharding#what-is-api-sharding-). |
+
+Standard OTel attributes (`service.name`, `service.version`, `host.name`, `host.arch`, `host.ip`, `process.pid`) are also included automatically.
+
+<Note>
+All OpenTelemetry configuration options are documented in the [Tyk Gateway configuration reference](/tyk-oss-gateway/configuration#opentelemetry).
+</Note>
+
+## Signal Correlation
+
+Tyk's three signal types (traces, metrics, and logs) are produced independently, but three mechanisms let you correlate them in your observability backend.
+
+### Trace and Span IDs in Logs
+
+When OpenTelemetry tracing is enabled, Tyk Gateway injects trace context into both log types:
+
+[**Access logs**](/api-management/logs/access-logs) include `trace_id`, the W3C trace ID for the request, matching the root span exported to your tracing backend.
+
+```
+... status=200 trace_id=4bf92f3577b34da6a3ce929d0e0e4736 upstream_latency=61 ...
+```
+
+[**Application logs**](/api-management/logs/application-logs) include both `trace_id` and `span_id` on all request-scoped entries (middleware execution, errors, debug output):
+
+```
+... level=error msg="Rate limit exceeded" prefix=rate-limit api_id=b1a41c9a89984ffd7bb7d4e3c6844ded trace_id=4bf92f3577b34da6a3ce929d0e0e4736 span_id=00f067aa0ba902b7
+```
+
+The `span_id` identifies the exact span active when the log was emitted, so you can navigate from an error log directly to the span in a trace waterfall.
+
+For the full log field reference, see [Logging in Tyk](/api-management/logs).
+
+<Note>
+Trace and span IDs are only present in log entries associated with a sampled request. Non-request-scoped entries (startup, configuration reload, health-checks) and unsampled requests do not carry these fields.
+</Note>
+
+### Exemplars in Histogram Metrics
+
+When both OpenTelemetry tracing and metrics are enabled, Tyk Gateway automatically attaches exemplars whenever a histogram is recorded during an active sampled request.
+
+An exemplar embeds the `trace_id` and `span_id` of the active request directly inside a histogram bucket, creating a direct link from an aggregated metric to a specific trace.
+
+**What this enables:** When you see a latency spike on a `http.server.request.duration` histogram in Grafana, click the exemplar marker on the chart to navigate directly to the offending trace in Jaeger or Tempo, with no manual trace ID search required.
+
+For full setup details, see [Exemplars](/api-management/metrics/default-metrics#exemplars) in the default metrics reference.
+
+### Resource Attributes Across All Signals
+
+Traces and metrics both carry the same [resource attributes](#resource-attributes) set at Gateway startup. The key correlating attribute is `tyk.gw.id` (also exported as `service.instance.id`), which uniquely identifies the Gateway that produced each signal.
+
+When running multiple Gateway replicas, this lets you filter metrics to a specific instance using `tyk.gw.id` and find that same Gateway's traces using the same attribute.
+
+## What's Next
+
+- **Getting Started:** A hands-on walkthrough spinning up a full observability stack (Loki, Grafana, Tempo, Prometheus) with Tyk Gateway. *(Coming soon)*
+- **[Best Practices](/api-management/observability/guides/best-practices):** Production guidance on export topology, cardinality control, trace sampling, and log collection.
+- **[Gateway Observability Playbook](/api-management/observability/guides/gateway-playbook):** Diagnosing common failures using RED metrics, response flags, and PromQL alert rules.
diff --git a/api-management/observability/guides/best-practices.mdx b/api-management/observability/guides/best-practices.mdx
new file mode 100644
index 0000000000..d523fddd16
--- /dev/null
+++ b/api-management/observability/guides/best-practices.mdx
@@ -0,0 +1,182 @@
+---
+title: "Tyk Gateway Observability Best Practices"
+description: "Production-ready guidance for configuring Tyk Gateway observability: OTLP export topology, metrics cardinality control, trace sampling strategy, and log collection."
+keywords: "OpenTelemetry, OTel, Observability, Best Practices, Cardinality, Sampling, Metrics, Traces, Logs, OTLP, Prometheus, Grafana, Jaeger, Performance"
+sidebarTitle: "Observability Best Practices"
+---
+
+Tyk Gateway exports **metrics and traces** via the OpenTelemetry Protocol (OTLP) and writes **logs** to stderr for external collection.
+
+This page covers production-ready configuration for each signal: which export topology to use, how to control metrics cardinality, how to tune trace sampling, and how to correlate logs with traces.
+
+## Exporting Data via OTLP
+
+Use OTLP as the export protocol. It is vendor-neutral and supported by every modern observability backend. The Gateway supports both gRPC (default, more efficient for high throughput) and HTTP transports. Choose gRPC unless your network or backend requires HTTP.
+
+### Export Topology
+
+**Direct to backend**: simpler setup, works well for managed cloud backends (Datadog, Dynatrace, New Relic, Elastic Cloud). Suitable for lower traffic volumes where buffering and retry are handled by the backend.
+
+**Via OTel Collector**: recommended for production. Decouples Tyk from the backend, adds buffering and retry, enables tail-based sampling (see [Trace Sampling](#traces-sampling-strategy)), and fans out to multiple backends simultaneously.
+
+### Open Source Backends
+
+| Backend | Best for | Notes |
+|---------|----------|-------|
+| **Grafana LGTM** (Loki, Grafana, Tempo, Mimir) | All signals | Tempo for traces, Mimir/Prometheus for metrics, Loki for logs |
+| **Jaeger** | Tracing only | Accepts OTLP natively since v1.35; simple to self-host |
+| **Prometheus + Grafana** | Metrics only | Pull model; use OTel Collector's Prometheus exporter or `remote_write` |
+| **ELK / OpenSearch** | Logs + APM | Elastic APM accepts OTLP; Logstash can ingest OTel Collector output |
+
+For vendor-specific configuration (Datadog, Dynatrace, New Relic, Elastic, Jaeger), see the [Traces](/api-management/traces) configuration guide.
+
+## Metrics: Cardinality and Performance
+
+### What Is the Cardinality Problem?
+
+Each unique combination of dimension values for a metric creates a separate time series. Unbounded dimensions, such as one label per user, per IP address, or per request ID, cause exponential growth in series count. This consumes memory in Tyk Gateway, increases storage costs in your backend, and slows query performance.
+
+### Tyk's Built-In Cardinality Limit
+
+Tyk ordinarily caps each metric instrument at **2,000 unique label-value combinations**. A different limit can be set using the [cardinality control](/api-management/logs-metrics#cardinality-control).
+
+If the configured limit is exceeded, the additional combinations are aggregated into an overflow bucket marked with the attribute `otel.metric.overflow=true`. Aggregate counts are preserved in the overflow bucket, but you lose the ability to break down data by the overflowing dimension combination.
+
+Alert on overflow to catch cardinality issues early. The following example uses PromQL:
+
+```promql
+increase(<your_metric_name>{otel_metric_overflow="true"}[5m]) > 0
+```
+
+If you are hitting the cardinality cap then the limit can be raised, but the recommended action is to reduce cardinality in your [custom metrics configuration](/api-management/metrics/custom-metrics).
+
+### Custom Metrics: Stay at 10 Dimensions or Fewer
+
+The OTel SDK processes metrics on a fast path when an instrument has 10 or fewer dimensions. Exceeding this threshold increases memory allocations and slows metric recording. Keep each custom metric instrument to **10 or fewer dimensions**.
+
+### Dimension Safety Guide
+
+When defining [custom metrics](/api-management/metrics/custom-metrics), choose dimension sources based on their cardinality characteristics:
+
+| Cardinality | Sources | Examples |
+|-------------|---------|---------|
+| **Safe** | `metadata`, `config_data` bounded fields | `listen_path`, `endpoint`, `method`, `http.response.status_code` |
+| **Caution** | `session` fields, bounded JWT claims | `api_key`, `oauth_id`, `alias` (bounded per tenant but can be large) |
+| **Avoid** | `header` / `context` with unbounded values | `ip_address`, `user_id` JWT claim, `request_id`, raw `path` |
+| **Never** | Token or bearer values | Unique per request; exhausts the cardinality limit immediately |
+
+## Traces: Sampling Strategy
+
+Trace data is the most expensive observability signal to collect, store, and query. Sampling controls what fraction of traces you keep.
+
+### Head-Based Sampling
+
+With *head-based* sampling, the decision whether to create a trace for a request is made before any span data exists. In other words, the sampling logic is applied in the Gateway. This is controlled using the `TraceIDRatioBased` approach as described in the [trace sampling](/api-management/traces#sampling) section.
+
+```json
+{
+  "opentelemetry": {
+    "traces": {
+      "sampling": {
+        "type": "TraceIDRatioBased",
+        "rate": 0.1
+      }
+    }
+  }
+}
+```
+
+**Characteristics:**
+- Fast: no buffering required, predictable overhead
+- Limitation: cannot guarantee capture of all errors or slow outliers at low sample rates
+- **Recommended default: 10% (`rate: 0.1`)** for most production deployments
+
+### Tail-Based Sampling
+
+With *tail-based* sampling, the sampling decision is made in the OTel Collector after the full trace has been collected. The OTel Collector buffers spans in memory, then applies policies to decide what to keep. This allows you to guarantee 100% retention of error traces and slow requests regardless of the overall sample rate.
+
+To use tail-based sampling, send all traces from Tyk to the Collector using the `AlwaysOn` approach as described in the [trace sampling](/api-management/traces#sampling) section, then apply policies in the Collector. This is the default setting.
+
+```yaml
+# OTel Collector processors section
+processors:
+  tail_sampling:
+    decision_wait: 10s
+    policies:
+      - name: keep-errors
+        type: status_code
+        status_code: {status_codes: [ERROR]}
+      - name: keep-slow
+        type: latency
+        latency: {threshold_ms: 1000}
+      - name: sample-rest
+        type: probabilistic
+        probabilistic: {sampling_percentage: 5}
+```
+
+### Sampling Trade-Offs
+
+| Strategy | Cost | Accuracy | Best for |
+|----------|------|----------|---------|
+| `AlwaysOn` (100%) | High | Perfect | Dev/staging, low-traffic APIs |
+| `TraceIDRatioBased`, `rate: 0.1` (10%) | Low | Good average | Most production deployments |
+| `TraceIDRatioBased`, `rate: 0.01` (1%) | Very low | Poor for rare events | Very high traffic, budget-constrained |
+| Tail-based via OTel Collector | Medium (Collector infra) | Best | When you need all errors and outliers |
+
+## Logs: Collection and Correlation
+
+Tyk Gateway writes logs to stderr, not via OTLP. They must be collected by an external agent.
+
+### Enable Access Logs
+
+Access logs record one line per request: HTTP method, path, upstream latency, status code, response size, and client IP. They are the fastest way to observe Gateway traffic without a full tracing setup and are essential for log-based alerting such as 5xx spike detection.
+
+Access logs are enabled in the Gateway configuration or the equivalent [environment variable](/tyk-oss-gateway/configuration#access_logs-enabled):
+
+```json
+{
+  "access_logs": {
+    "enabled": true
+  }
+}
+```
+
+See [Access Logs](/api-management/logs/access-logs) for the full list of configurable fields and custom template options.
+
+### Use JSON Log Format
+
+JSON format has lower parsing overhead than the default text format and is directly indexable by log backends (Loki, Elasticsearch, CloudWatch). Enable this mode in the Gateway configuration or the equivalent [environment variable](/tyk-oss-gateway/configuration#log_format):
+
+```json
+{
+  "log_format": "json"
+}
+```
+
+JSON log format is recommended for all production deployments.
+
+### Trace Correlation
+
+When OpenTelemetry is enabled, Tyk injects `trace_id` and `span_id` into request-scoped log entries. This lets you pivot from a log line directly to the corresponding trace in Tempo or Jaeger.
+
+<Note>
+`trace_id` and `span_id` are only present on **sampled requests**. At 10% head-based sampling, 90% of log lines will not carry trace IDs.
+</Note>
+
+### Log Collection Options
+
+| Stack | Recommended Approach |
+|-------|---------------------|
+| Grafana LGTM | Promtail or Grafana Alloy → Loki |
+| ELK / OpenSearch | Filebeat or Logstash |
+| Kubernetes | OTel Collector with `filelog` receiver; see [Collecting Gateway Logs with OTel on Kubernetes](/api-management/collecting-gateway-logs-otel-kubernetes) |
+| Cloud (AWS/GCP/Azure) | CloudWatch agent, GCP Logging agent, or Azure Monitor agent |
+
+## Performance Impact Summary
+
+| Signal | Baseline Cost | Main Risk | Mitigation |
+|--------|--------------|-----------|------------|
+| **Metrics** | Low (batched OTLP export) | Cardinality explosion in custom metrics | ≤10 dimensions per instrument; monitor `otel.metric.overflow` |
+| **Traces** | Medium (per-request spans) | High sampling rate at scale | Head-based 10% default; tail-based for error capture |
+| **Logs** | Low (stdout write) | Log volume at debug verbosity | Use `info` level in production; enable JSON format |
+| **Analytics (Tyk Pump)** | Medium–High (Redis writes) | ~13% RPS reduction when tracking all requests | Use [Do-Not-Track](/api-management/traffic-transformation/do-not-track) middleware for non-critical endpoints |
diff --git a/api-management/observability/guides/gateway-playbook.mdx b/api-management/observability/guides/gateway-playbook.mdx
new file mode 100644
index 0000000000..fcc3bac6c7
--- /dev/null
+++ b/api-management/observability/guides/gateway-playbook.mdx
@@ -0,0 +1,574 @@
+---
+title: "Tyk Gateway Observability Playbook"
+description: "Use native OTLP metrics to monitor Tyk Gateway RED signals, diagnose common failures, and configure Prometheus alerting rules."
+keywords: "opentelemetry, metrics, prometheus, alerting, latency, error rate, goroutines, observability, RED metrics, response flags"
+sidebarTitle: "Gateway Observability Playbook"
+---
+
+## Overview
+
+Tyk Gateway 5.13+ exports metrics natively via OTLP, removing the need for Tyk Pump as an intermediary for Prometheus-based observability:
+
+<img src="/img/observability/tyk-prometheus-diagram.png" alt="Tyk Gateway pushing OTLP metrics to an OTel Collector, which exports to any OTLP backend and exposes a Prometheus scrape endpoint" />
+
+Every request the Gateway handles generates three signal types that share common identifiers, enabling end-to-end correlation:
+
+| Identifier | In logs | In metrics (Prometheus label) | In traces |
+|-----------|---------|-------------------------------|-----------|
+| API ID | `api_id` | `tyk_api_id` | `tyk.api.id` attribute |
+| Response flag | `response_flag` | `tyk_response_flag` | — |
+| Consumer key | `api_key` | Available via custom `api_metrics` config | `tyk.api.apikey` |
+| Trace ID | `trace_id` | — (use exemplars) | span `traceId` |
+| Gateway instance | — | `service_name` | `service.instance.id` |
+
+This guide covers two categories of metrics:
+
+- **RED metrics**: What your APIs are doing right now: request rate, error classification, and latency decomposition.
+- **Gateway health metrics**: What the Gateway process itself is doing: memory, goroutines, and configuration state.
+
+## Prerequisites
+
+- Tyk Gateway 5.13 or later
+- OpenTelemetry metrics enabled (`opentelemetry.metrics.enabled: true` in `tyk.conf`, or `TYK_GW_OPENTELEMETRY_METRICS_ENABLED=true`)
+- An OTel Collector configured to export to Prometheus (or a compatible OTLP backend)
+- Prometheus scraping the Collector's metrics endpoint
+
+If you haven't set up the OTel pipeline yet, see [OpenTelemetry tracing and metrics](/api-management/traces).
+
+## Key thresholds at a glance
+
+<Note>
+Use these as starting points and adjust based on your API's traffic profile and SLOs.
+
+| Signal | Healthy threshold | Alert threshold |
+|--------|------------------|-----------------|
+| p95 end-to-end latency | < 500ms | > 1s for 5 min |
+| p99 end-to-end latency | < 1s | > 2s for 5 min |
+| Error rate (non-2xx) | < 2% | > 10% for 5 min |
+| Gateway-only avg latency | < 10ms | > 50ms |
+| Goroutine count | < 2,000 | > 5,000 for 10 min |
+| Auth failure rate | < 0.01/s baseline | > 0.1/s for 2 min |
+| Upstream error rate (URS) | 0 | Any sustained for 3 min |
+</Note>
+
+---
+
+## Core RED Metrics
+
+### Request Rate
+
+Request rate tells you how much traffic the Gateway is handling. Sudden drops indicate that requests are not reaching the Gateway: DNS failures, network partitions between clients and the gateway, or client-side misconfiguration.
+
+**Metrics:**
+
+| Metric name (OTel) | Prometheus name | Type | Key dimensions |
+|-------------------|-----------------|------|----------------|
+| `tyk.api.requests.total` | `tyk_api_requests_total` | counter | `http_request_method`, `http_response_status_code`, `tyk_api_id` |
+
+**What are normal request rate thresholds?**
+
+There is no universal baseline. Request rate varies by deployment. Establish a baseline over 7 days and alert on deviations greater than ±30% from the rolling average for the same hour of the prior week.
+
+A more actionable check is to watch for a sudden drop to near-zero on a previously active API:
+
+```promql
+# Alert if rate drops > 80% compared to 1 hour ago
+rate(tyk_api_requests_total{tyk_api_id="<api_id>"}[5m])
+  < 0.2 * rate(tyk_api_requests_total{tyk_api_id="<api_id>"}[5m] offset 1h)
+```
+
+**Troubleshooting unexpected changes in request rate:**
+
+| Issue | Possible Causes | Remediation |
+|-------|----------------|-------------|
+| Rate drops to zero on one API, others normal | API definition deleted or disabled; DNS for that API's listen path changed | Check Gateway logs for `api_id` config errors; verify API is active in Tyk Dashboard |
+| Rate drops uniformly across all APIs | Network partition between clients and Gateway; load balancer health check failure; OTel Collector not receiving (metrics gap, not a real traffic drop) | Check Gateway health endpoint; confirm traffic is actually dropping and not just metric export failing |
+| Rate spikes suddenly on one API | Traffic surge, DDoS, or runaway batch client | Filter logs by `api_id` and group by `api_key` to identify the calling consumer |
+| Rate split unevenly across Gateway instances | Sticky sessions or uneven load balancer weights | Check `service.instance.id` label in metrics to compare per-instance rates |
+
+---
+
+### Error Rate
+
+Error rate is the primary SLI for API availability. Tyk classifies every non-success response with a `response_flag`: a two- or three-character code that tells you exactly where and why a request failed, before you read a single log line.
+
+**Metrics:**
+
+| Metric name (OTel) | Prometheus name | Type | Key dimensions |
+|-------------------|-----------------|------|----------------|
+| `http.server.request.duration` | `http_server_request_duration_seconds` | histogram | `http_request_method`, `http_response_status_code`, `tyk_api_id`, `tyk_response_flag` |
+| `tyk.api.requests.total` | `tyk_api_requests_total` | counter | `http_request_method`, `http_response_status_code`, `tyk_api_id` |
+
+**Response flag reference** (full list: [Error classification](/api-management/logs/access-logs#error-classification)):
+
+| Flag | HTTP Status | Upstream called? | `error_source` | Meaning |
+|------|------------|-----------------|----------------|---------|
+| *(HTTP status code, e.g. `200`)* | 200 | **Yes** | *(absent)* | Successful request — `tyk_response_flag` is set to the HTTP status code |
+| `AMF` | 401 | **No** | `AuthKey` | Auth header entirely absent |
+| `AKI` | 403 | **No** | `AuthKey` | Auth header present, key invalid or expired |
+| `QEX` | 403 | **No** | `RateLimitAndQuotaCheck` | Key's quota window exhausted |
+| `RLT` | 429 | **No** | `RateLimitAndQuotaCheck` | Per-second rate limit exceeded |
+| `URS` | 500 | **Yes** | `Upstream` | Upstream returned a 5xx error |
+
+**What error rate thresholds should I set?**
+
+A non-2xx rate below **2%** is a healthy baseline for most APIs with authenticated consumers. Alert at **10%** over a 5-minute window for most APIs. For payment or health endpoints, tighten to 1%.
+
+Calculate the current error rate:
+
+```promql
+(
+  rate(tyk_api_requests_total{http_response_status_code!~"2..", tyk_api_id="<api_id>"}[5m])
+  /
+  rate(tyk_api_requests_total{tyk_api_id="<api_id>"}[5m])
+) * 100
+```
+
+Classify errors by flag to route to the right runbook:
+
+```promql
+sum by (tyk_response_flag) (
+  rate(http_server_request_duration_seconds_count{tyk_api_id="<api_id>"}[5m])
+)
+```
+
+<Note>
+Check `upstream_latency` in logs first. If it is `0`, the request never left the Gateway: the error originated in auth, quota, or rate-limit middleware. If `upstream_latency > 0` and `response_flag = URS`, the upstream itself failed.
+</Note>
+
+**Troubleshooting elevated error rates:**
+
+| Issue | Possible Causes | Remediation |
+|-------|----------------|-------------|
+| Surge in `AMF` (401) | Auth header entirely absent at Tyk — the client never sends it, or an intermediary (load balancer, CDN, reverse proxy) strips it before reaching the Gateway | Identify source: `{prefix="access-log"} \| json \| response_flag="AMF" \| line_format "ip={{.client_ip}} api={{.api_name}}"`. Single IP after a network change → suspect header stripping by an intermediary. Wide IP spread → clients calling the wrong listen path |
+| Surge in `AKI` (403) | Key was rotated, expired, or revoked; credential stuffing attack | Single source IP → contact consumer. Wide IP spread → credential attack; tighten rate limits |
+| Sustained `QEX` (403) | Consumer legitimately exhausted their quota tier | Identify consumer via `key` field in logs; invite upgrade or raise quota ceiling in policy |
+| `RLT` (429) climbing | Legitimate traffic burst; retry storm after upstream error | Check whether RLT is protecting a degraded upstream (correct) or blocking legitimate traffic (adjust limit). Add backoff guidance to consumer |
+| Sustained `URS` (500) | Backend service degraded; upstream 5xx errors | Extract `error_target` (upstream hostname) and `upstream_addr` from logs; escalate to backend team. Check retry/circuit-breaker plugin config |
+| Non-2xx with no `response_flag` | Auth plugin returning custom status; unhandled middleware error | Search Gateway error logs for the request's `trace_id` |
+
+---
+
+### Latency
+
+Tyk exports three latency histograms that let you decompose end-to-end response time into what the Gateway spent versus what the upstream spent. Use them together. Any one alone gives an incomplete picture.
+
+**Metrics:**
+
+| Prometheus name | Measures | Key labels |
+|----------------|---------|------------|
+| `http_server_request_duration_seconds` | Total time from first byte received to last byte sent (client view) | `http_request_method`, `http_response_status_code`, `tyk_api_id`, `tyk_response_flag` |
+| `tyk_gateway_request_duration_seconds` | Gateway-only processing time (middleware chain, auth, rate limiting) | `http_request_method`, `tyk_api_id`, `tyk_response_flag` |
+| `tyk_upstream_request_duration_seconds` | Time waiting for the upstream service to respond | `http_request_method`, `tyk_api_id`, `tyk_response_flag` |
+
+**Histogram bucket boundaries (all three metrics, in seconds):**
+
+```
+0.001  0.005  0.01  0.025  0.05  0.1  0.25  0.5  1  2.5  5  10  +Inf
+```
+
+**What latency thresholds should I set?**
+
+| Percentile | Target | Alert |
+|-----------|--------|-------|
+| p50 (median) | < 100ms | — |
+| p95 | < 500ms | > 1s for 5 min |
+| p99 | < 1s | > 2s for 5 min |
+| Gateway-only average | < 10ms | > 50ms |
+
+<Note>
+**Latency isolation rule**: If `http_server_request_duration_seconds` p95 is high but `tyk_gateway_request_duration_seconds` p95 is < 10ms, **the Gateway is healthy**: the latency is upstream. If both histograms are elevated, the gateway is the bottleneck.
+</Note>
+
+Query p95 and p99 end-to-end:
+
+```promql
+histogram_quantile(0.95, rate(http_server_request_duration_seconds_bucket{tyk_api_id="<api_id>"}[5m]))
+histogram_quantile(0.99, rate(http_server_request_duration_seconds_bucket{tyk_api_id="<api_id>"}[5m]))
+```
+
+Query Gateway-only average:
+
+```promql
+rate(tyk_gateway_request_duration_seconds_sum{tyk_api_id="<api_id>"}[5m])
+  / rate(tyk_gateway_request_duration_seconds_count{tyk_api_id="<api_id>"}[5m])
+```
+
+**Troubleshooting high latency:**
+
+| Issue | Possible Causes | Remediation |
+|-------|----------------|-------------|
+| High p95 overall, gateway avg < 10ms | Upstream service degradation; slow backend endpoint | Check `tyk_upstream_request_duration_seconds` p95. Extract `error_target` from URS logs. Escalate to backend team |
+| Both gateway and upstream histograms elevated | Gateway CPU saturation; goroutine backpressure | Check `go_goroutine_count` trend and `go_memory_used_bytes`. See [Goroutines](#goroutines) below |
+| p99 widening without p50 or p95 change | Load-induced queuing tail; a fraction of requests hitting a slow upstream path | Filter slow requests in logs: `latency_total > 1000`. Copy `trace_id` → Jaeger/Tempo to see which span is slow |
+| High latency scoped to one client | Client calling a slow upstream endpoint (not a gateway issue) | Per-key filter in logs: `api_id="<api_id>" \| line_format "key={{.api_key}} latency={{.latency_total}} path={{.path}}"` |
+| Latency spike after config reload | Cold cache or policy recalculation during reload | Check `tyk_gateway_config_reload_duration_seconds`. Latency spike should resolve within 1–2 minutes |
+
+---
+
+## Gateway Health Metrics
+
+Gateway health metrics reflect the internal state of the Gateway process itself, independent of API traffic. They are available when `opentelemetry.metrics.enabled: true` (Tyk Gateway 5.13+) and can be disabled independently with `runtime_metrics: false` if you only need RED signals.
+
+### Memory
+
+**Metrics:**
+
+| Metric name (OTel) | Prometheus name | Type | What it tells you |
+|-------------------|-----------------|------|------------------|
+| `go.memory.used` | `go_memory_used_bytes` | Gauge | Memory in use by the Go runtime, broken down by `go_memory_type` label (`"stack"` or `"other"`). Monitor `go_memory_type="other"` for leak detection; the stack series grows proportionally with goroutine count |
+| `go.memory.gc.goal` | `go_memory_gc_goal_bytes` | Gauge | Target heap size before next GC cycle |
+| `go.memory.limit` | `go_memory_limit_bytes` | Gauge | Configured `GOMEMLIMIT` value; use as the denominator for utilization alerts (alert when `go_memory_used_bytes` exceeds 85% of this) |
+| `go.memory.allocated` | `go_memory_allocated_bytes_total` | Counter | Total bytes allocated since startup |
+| `go.memory.allocations` | `go_memory_allocations_total` | Counter | Total allocation count since startup. High rate = allocation pressure |
+
+**What memory thresholds should I set?**
+
+There is no fixed absolute limit. Thresholds depend on how many APIs are loaded. Alert on **rate of growth** instead:
+
+- `go_memory_used_bytes{go_memory_type="other"}` growing > 10% per hour with stable traffic and stable API count → investigate
+- If you set `GOMEMLIMIT`, alert when `go_memory_used_bytes{go_memory_type="other"}` exceeds 85% of `go_memory_limit_bytes`; GC will become aggressive and start impacting request latency
+
+**Troubleshooting memory issues:**
+
+| Issue | Possible Causes | Remediation |
+|-------|----------------|-------------|
+| `go_memory_used_bytes{go_memory_type="other"}` growing monotonically over hours with stable API count | Memory leak in a middleware or connection pool | Requires `"enable_http_profiler": true` in `tyk.conf`. Capture heap profile: `curl http://gateway:<control_api_port>/debug/pprof/heap > heap.pprof`. Contact Tyk support with the profile and trend chart |
+| Memory growing proportionally with API count | Normal — each API definition has memory overhead | Increase instance memory; review whether all loaded APIs are still needed |
+| Memory growing faster than expected with stable API count | High allocation pressure from request handling | Check rate of `go_memory_allocations_total`; if climbing steeply, contact Tyk support with a heap profile |
+
+---
+
+### Goroutines
+
+**Metrics:**
+
+| Metric name (OTel) | Prometheus name | Type | What it tells you |
+|-------------------|-----------------|------|------------------|
+| `go.goroutine.count` | `go_goroutine_count` | Gauge | Number of active goroutines. Monotonic growth = leak |
+| `go.processor.limit` | `go_processor_limit` | Gauge | Number of OS threads available (GOMAXPROCS) |
+| `go.config.gogc` | `go_config_gogc_percent` | Gauge | GC target percentage (GOGC env var) |
+
+**What goroutine thresholds should I set?**
+
+A healthy Gateway at moderate load runs with 500–2,000 goroutines. Alert at **5,000 goroutines sustained for 10 minutes**. A one-time spike during a traffic burst is normal; a monotonically increasing trend over hours is not.
+
+```promql
+go_goroutine_count{service_name="tyk-gateway"}
+```
+
+**Troubleshooting goroutine growth:**
+
+| Issue | Possible Causes | Remediation |
+|-------|----------------|-------------|
+| Monotonically increasing goroutine count over hours | Goroutine leak in connection handler or background worker | Requires `"enable_http_profiler": true` in `tyk.conf` (off by default). Collect from the Control API port: `curl http://gateway:<control_api_port>/debug/pprof/goroutine > goroutine.pprof`. Share with Tyk support along with the trend chart |
+| Goroutine count high relative to traffic | CPU saturation; too many goroutines contending for OS threads | Check `go_processor_limit` (GOMAXPROCS). Consider scaling horizontally |
+| Goroutine spike correlated with config reload | Reload spawning goroutines before previous ones complete | Check `tyk_gateway_config_reload_total` rate. Avoid overlapping reloads |
+
+---
+
+### Configuration State
+
+**Metrics:**
+
+| Metric name (OTel) | Prometheus name | Type | What it tells you |
+|-------------------|-----------------|------|------------------|
+| `tyk.gateway.apis.loaded` | `tyk_gateway_apis_loaded` | Gauge | API definitions currently loaded. Sudden drop = sync failure |
+| `tyk.gateway.policies.loaded` | `tyk_gateway_policies_loaded` | Gauge | Policies currently loaded |
+| `tyk.gateway.config.reload` | `tyk_gateway_config_reload_total` | Counter | Total config reloads since startup |
+| `tyk.gateway.config.reload.duration` | `tyk_gateway_config_reload_duration_seconds` | Histogram | Time per reload. High values indicate large API counts |
+
+**What to watch for:**
+
+- A **sudden drop** in `tyk_gateway_apis_loaded` (not a gradual decrease) typically means a failed sync from the Dashboard or an accidental bulk delete. Alert if the value drops by more than 10% in a single scrape interval.
+- A **steady increase** in `tyk_gateway_config_reload_total` at a rate faster than your deployment cadence suggests a reload loop; investigate what is triggering reloads.
+- Reload duration p95 growing over time suggests the API definition set is expanding and reload times need to be accounted for in SLOs.
+
+---
+
+## Common Anti-Patterns
+
+### Auth Failure Surge
+
+A sudden spike in `AMF` or `AKI` response flags means clients are failing authentication. Sustained rates above **0.1 req/s** (6 per minute) warrant investigation.
+
+**Identify:**
+
+```promql
+rate(http_server_request_duration_seconds_count{tyk_response_flag=~"AMF|AKI"}[5m])
+```
+
+In Loki:
+
+```logql
+{prefix="access-log"} | json | response_flag=~"AMF|AKI"
+  | line_format "{{.time}} {{.response_flag}} ip={{.client_ip}} api={{.api_name}}"
+```
+
+**Classify:**
+
+| Pattern | Likely cause | Action |
+|---------|-------------|--------|
+| Single source IP, sustained after deployment | Credential rotation missed in deploy config | Contact consumer; verify keys still valid in Tyk Dashboard |
+| Single source IP, random key attempts | Misconfigured integration (wrong env endpoint) | Contact consumer |
+| Wide IP spread, varied keys | Credential stuffing or API scanning | Add IP allowlisting; tighten rate limits |
+| All APIs, after Tyk Dashboard restart | Gateway missed key sync | Trigger manual key sync; check Dashboard connectivity |
+
+<Note>
+`AMF` and `AKI` are identical from a consumer-impact perspective: both result in the request never reaching the upstream. The distinction matters for root cause: `AMF` means the client didn't send a key at all; `AKI` means the client sent a key that Tyk cannot resolve.
+</Note>
+
+---
+
+### Cardinality Overflow
+
+The Gateway caps at **2,000 unique attribute combinations per instrument** by default (see [cardinality control](/api-management/logs-metrics#cardinality-control)). When this cap is reached, additional data points are recorded with `otel.metric.overflow = true` rather than creating new time series.
+
+**Detect:**
+
+```promql
+# Any non-zero result means cardinality overflow is occurring
+tyk_api_requests_total{otel_metric_overflow="true"}
+```
+
+**Troubleshoot:**
+
+| Issue | Possible Causes | Remediation |
+|-------|----------------|-------------|
+| Overflow on `tyk_api_requests_total` | More than 2,000 unique `api_id × method × status_code` combinations | Audit which APIs are generating unusual method/status combinations; consider raising `cardinality_limit` — contact Tyk support before doing so in production |
+| Overflow after adding custom dimensions | Custom dimension like `client_ip` or `user_id` is high-cardinality | Remove the high-cardinality dimension or scope it with a hash/prefix |
+
+<Note>
+Cardinality overflow does **not** drop data. The aggregate counts are preserved in the overflow bucket. You will see correct totals but lose the ability to break the data down by the overflowing dimension combination.
+</Note>
+
+---
+
+### Retry Storm
+
+Client retries without exponential backoff amplify an upstream failure. `RLT` (429) responses trigger more retries, which hit rate limits, which trigger more retries, a self-reinforcing loop that increases load on both the Gateway and the upstream.
+
+**Identify:**
+
+A retry storm shows `RLT` rate climbing while overall request rate is also climbing:
+
+```promql
+# RLT rate climbing
+rate(http_server_request_duration_seconds_count{tyk_response_flag="RLT"}[1m])
+
+# If this is also climbing, clients are retrying
+rate(tyk_api_requests_total[1m])
+```
+
+**Troubleshoot:**
+
+| Issue | Possible Causes | Remediation |
+|-------|----------------|-------------|
+| RLT climbing with overall rate climbing | Clients retrying 429s without backoff | Identify consumer via logs: `response_flag="RLT" \| line_format "key={{.key}} ip={{.client_ip}}"`. Advise consumer to implement exponential backoff with jitter |
+| RLT starts immediately after upstream error (URS) | Upstream degradation triggers client retries which hit rate limits | Fix the upstream first. The rate limit is correctly protecting the backend during degradation |
+| RLT on a single consumer, others unaffected | Single consumer batch job sending bursts | Work with consumer to spread requests or raise their rate limit ceiling |
+
+---
+
+## Set Up Alerting
+
+Prometheus Alertmanager handles alert routing. The Gateway emits Prometheus-compatible metrics via the OTel Collector; alert rules evaluate against those metrics.
+
+**Configure Prometheus to load alert rules:**
+
+```yaml
+# prometheus.yml
+rule_files:
+  - "tyk_alerts.yml"
+
+alerting:
+  alertmanagers:
+    - static_configs:
+        - targets: ["alertmanager:9093"]
+```
+
+Restart Prometheus after adding the rule file.
+
+**Recommended alert rules:**
+
+```yaml expandable
+groups:
+  - name: tyk-gateway
+    rules:
+
+      # Error rate > 10% over 5 minutes
+      - alert: TykHighErrorRate
+        expr: |
+          (
+            rate(tyk_api_requests_total{http_response_status_code!~"2..", tyk_api_id="<api_id>"}[5m])
+            /
+            rate(tyk_api_requests_total{tyk_api_id="<api_id>"}[5m])
+          ) > 0.10
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Error rate > 10% for {{ $labels.tyk_api_id }}"
+
+      # p95 latency > 1 second
+      - alert: TykHighLatency
+        expr: |
+          histogram_quantile(0.95,
+            rate(http_server_request_duration_seconds_bucket{tyk_api_id="<api_id>"}[5m])
+          ) > 1
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "p95 latency > 1s for {{ $labels.tyk_api_id }}"
+
+      # Auth failure surge (AMF or AKI)
+      - alert: TykAuthFailureSurge
+        expr: |
+          rate(http_server_request_duration_seconds_count{tyk_response_flag=~"AMF|AKI"}[5m]) > 0.1
+        for: 2m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Auth failures > 6/min: client misconfiguration or credential attack"
+
+      # Quota exhaustion
+      - alert: TykQuotaExhaustion
+        expr: |
+          rate(http_server_request_duration_seconds_count{tyk_response_flag="QEX"}[5m]) > 0
+        for: 1m
+        labels:
+          severity: info
+        annotations:
+          summary: "Consumers hitting quota limits"
+
+      # Rate limit rejections
+      - alert: TykRateLimitRejections
+        expr: |
+          rate(http_server_request_duration_seconds_count{tyk_response_flag="RLT"}[1m]) > 0
+        for: 1m
+        labels:
+          severity: info
+        annotations:
+          summary: "Rate limit rejections (RLT)"
+
+      # Upstream 5xx errors
+      - alert: TykUpstreamErrors
+        expr: |
+          rate(http_server_request_duration_seconds_count{tyk_response_flag="URS"}[5m]) > 0
+        for: 3m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Upstream returning 5xx for {{ $labels.tyk_api_id }}"
+
+      # Goroutine growth
+      - alert: TykGoroutineGrowth
+        expr: go_goroutine_count{service_name="tyk-gateway"} > 5000
+        for: 10m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Goroutine count elevated, possible leak"
+
+      # API count dropped suddenly
+      - alert: TykApisLoadedDrop
+        expr: |
+          (tyk_gateway_apis_loaded - tyk_gateway_apis_loaded offset 2m)
+            / tyk_gateway_apis_loaded offset 2m < -0.1
+        for: 0m
+        labels:
+          severity: critical
+        annotations:
+          summary: "API definition count dropped > 10%: possible sync failure"
+```
+
+**Alert summary:**
+
+| Alert | Threshold | Severity | What it signals |
+|-------|----------|----------|----------------|
+| `TykHighErrorRate` | > 10% non-2xx for 5 min | warning | API availability degraded |
+| `TykHighLatency` | p95 > 1s for 5 min | warning | Slow responses |
+| `TykAuthFailureSurge` | > 0.1/s for 2 min | warning | Credential problem or attack |
+| `TykQuotaExhaustion` | Any QEX for 1 min | info | Consumer tier management needed |
+| `TykRateLimitRejections` | Any RLT for 1 min | info | Consumer hitting rate limits |
+| `TykUpstreamErrors` | Any URS for 3 min | critical | Backend degraded |
+| `TykGoroutineGrowth` | > 5,000 for 10 min | warning | Possible goroutine leak |
+| `TykApisLoadedDrop` | > 10% drop in 2 min | critical | Config sync failure |
+
+---
+
+## PromQL Quick Reference
+
+Replace `<api_id>` with your Tyk API definition ID.
+
+```promql expandable
+## Error rates
+
+# Overall non-2xx rate (as percentage)
+(
+  rate(tyk_api_requests_total{http_response_status_code!~"2..", tyk_api_id="<api_id>"}[5m])
+  / rate(tyk_api_requests_total{tyk_api_id="<api_id>"}[5m])
+) * 100
+
+# Error breakdown by response flag
+sum by (tyk_response_flag) (
+  rate(http_server_request_duration_seconds_count{tyk_api_id="<api_id>"}[5m])
+)
+
+# Upstream error rate (URS only)
+rate(http_server_request_duration_seconds_count{tyk_response_flag="URS", tyk_api_id="<api_id>"}[5m])
+
+## Latency
+
+# p50 / p95 / p99 end-to-end
+histogram_quantile(0.50, rate(http_server_request_duration_seconds_bucket{tyk_api_id="<api_id>"}[5m]))
+histogram_quantile(0.95, rate(http_server_request_duration_seconds_bucket{tyk_api_id="<api_id>"}[5m]))
+histogram_quantile(0.99, rate(http_server_request_duration_seconds_bucket{tyk_api_id="<api_id>"}[5m]))
+
+# Gateway-only average latency
+rate(tyk_gateway_request_duration_seconds_sum{tyk_api_id="<api_id>"}[5m])
+  / rate(tyk_gateway_request_duration_seconds_count{tyk_api_id="<api_id>"}[5m])
+
+# Upstream average latency
+rate(tyk_upstream_request_duration_seconds_sum{tyk_api_id="<api_id>"}[5m])
+  / rate(tyk_upstream_request_duration_seconds_count{tyk_api_id="<api_id>"}[5m])
+
+## Gateway health
+
+# Goroutine count trend
+go_goroutine_count{service_name="tyk-gateway"}
+
+# Memory in use (go_memory_type="other" = heap-adjacent; use for leak detection)
+go_memory_used_bytes{service_name="tyk-gateway", go_memory_type="other"}
+
+# GC target heap size
+go_memory_gc_goal_bytes{service_name="tyk-gateway"}
+
+# Configured GOMEMLIMIT (denominator for utilization alert)
+go_memory_limit_bytes{service_name="tyk-gateway"}
+
+# APIs and policies loaded
+tyk_gateway_apis_loaded{service_name="tyk-gateway"}
+tyk_gateway_policies_loaded{service_name="tyk-gateway"}
+
+## Consumer-level breakdown (requires custom api_metrics configuration)
+# These metrics are NOT emitted by default. They must be defined in
+# opentelemetry.metrics.api_metrics in tyk.conf.
+
+# Example: requests by API key (last 6 chars), if configured with api_key session dimension
+# increase(tyk_requests_by_apikey_total{tyk_api_id="<api_id>"}[1h]) by (api_key)
+
+# Example: 5xx errors by route, if configured with endpoint metadata dimension
+# increase(tyk_requests_by_route_total{tyk_api_id="<api_id>", http_response_status_code="500"}[1h]) by (tyk_endpoint)
+```
+
+---
+
+## Next Steps
+
+1. **Enable the OTel pipeline**: if you haven't yet, follow the [setup instructions](/api-management/observability) to enable native OTLP export and route signals to your observability backend.
+
+2. **Try the reference Grafana dashboards**: see the [observability setup guide](/api-management/observability) for a full modern observability stack (Loki, Grafana, Tempo, Prometheus) with pre-built panels for all the metrics in this guide.
+
+3. **Configure Prometheus alerting**: copy the alert rules from [Set Up Alerting](#set-up-alerting), replace `<api_id>` with your real API IDs, save as `tyk_alerts.yml`, and restart Prometheus.
\ No newline at end of file
diff --git a/api-management/performance-monitoring.mdx b/api-management/performance-monitoring.mdx
new file mode 100644
index 0000000000..2dd9f3f1aa
--- /dev/null
+++ b/api-management/performance-monitoring.mdx
@@ -0,0 +1,156 @@
+---
+title: "Performance Monitoring"
+description: "Learn how to monitor and analyze the performance of your Tyk Gateway"
+keywords: "Performance, Monitoring, Observability"
+sidebarTitle: "Performance Monitoring"
+---
+
+## What is the performance impact of analytics
+
+Tyk Gateway allows analytics to be recorded and stored in a persistent data store (MongoDB/SQL) for all APIs by default, via [Tyk Pump](/api-management/tyk-pump).
+
+Tyk Gateway generates transaction records for each API request and response, containing [analytics data](/api-management/logs/traffic-logs) relating to: the originating host (where the request is coming from), which Tyk API version was used, the HTTP method requested and request path etc.
+
+The transaction records are transmitted to Redis and subsequently transferred to a persistent [data store](/api-management/logs/external-data-sinks) of your choice via Tyk Pump. Furthermore, Tyk Pump can also be configured to [aggregate](/api-management/dashboard-analytics#how-aggregation-works) the transaction records (using different data keys - API ID, access key, endpoint, response status code, location) and write to a persistent data store. Tyk Dashboard uses this data for:
+- [Aggregated analytics](/api-management/dashboard-analytics#traffic-analytics) - Displaying analytics based on the aggregated data.
+- [Log Browser](/api-management/dashboard-analytics#activity-logs) to display raw transaction records.
+
+### How Do Analytics Impact Performance?
+
+Analytics may introduce the problem of increased CPU load and a decrease in the number of requests per second (RPS).
+
+In the *Tyk Dashboard API* screen below, there are two APIs, *track* and *notrack*. The APIs were created to conduct a simple load test, to show the gateway's RPS (requests per second) for each API:
+
+- **track**: Traffic to this API is tracked, i.e. transaction records are generated for each request/response.
+- **notrack**: Traffic to this API is not tracked, i.e. transaction records are not generated for each request/response.
+
+<img src="/img/faq/do-not-track-usage-scenario/dashboard_apis_measured.png" alt="apis measured in Tyk Dashboard" width="864" />
+
+100,000 requests were sent to each API and the rate at which Tyk was able to handle those requests (number of requests per second) was measured. The results for the *tracked* API are displayed in the left pane terminal window; with the right pane showing the results for the *untracked* API.
+
+### Tracked API Performance
+
+<img src="/img/faq/do-not-track-usage-scenario/track.png" alt="measuring tracked API performance impact" />
+
+### Untracked API Performance
+
+<img src="/img/faq/do-not-track-usage-scenario/notrack.png" alt="measuring do_not_track API performance impact" />
+
+### Explaining the results
+
+We can see that **19,253.75** RPS was recorded for the *untracked* API; with **16,743.6011** RPS reported for the *tracked* API. The number of requests per second decreased by **~13%** when analytics was enabled.
+
+### What Can Be Done To Address This Performance Impact?
+
+Tyk is configurable, allowing fine grained control over which information should be recorded and which can be skipped, thus reducing CPU cycles, traffic and storage.
+
+Users can selectively prevent the generation of analytics for
+[do_not_track](/api-management/traffic-transformation/do-not-track) middleware:
+- **Per API**: Tyk Gateway will not create records for requests/responses for any endpoints of an API.
+- **Per Endpoint**: Tyk Gateway will not create records for requests/responses for specific endpoints.
+
+When set, this prevents Tyk Gateway from generating the transaction records. Without transaction records, Tyk Pump will not transfer analytics to the chosen persistent data store. It's worth noting that the [track middleware](/api-management/dashboard-analytics#activity-by-endpoint) exclusively influences the generation of *endpoint popularity* aggregated data by Tyk Pump.
+
+### Conclusion
+
+[Disabling](/api-management/traffic-transformation/do-not-track)  the creation of analytics (either per API or for specific endpoints) helps to reduce CPU cycles and network requests for systems that exhibit high load and traffic, e.g. social media platforms, streaming, financial services and trading platforms.
+
+Application decisions need to be made concerning which endpoints are non critical and can thus have analytics disabled. Furthermore, benchmarking and testing will be required to evaluate the actual benefits for the application specific use case.
+
+Subsequently, it is worthwhile monitoring traffic and system load and using this feature to improve performance. 
+
+## What is the performance impact of OpenTelemetry metrics
+
+Tyk Gateway can emit RED (Rate, Errors, Duration) metrics, Go runtime metrics, and distributed traces via [OpenTelemetry](/api-management/traces). Enabling these signals adds a per-request cost that shows up as higher latency and resource usage, not as lost throughput.
+
+For a broader overview of what Tyk exposes, see [Logs and Metrics](/api-management/logs-metrics).   These numbers go alongside those in [What is the performance impact of analytics](/api-management/performance-monitoring#what-is-the-performance-impact-of-analytics). Most production deployments run both pipelines, and the costs add up rather than multiply.
+
+### How do OTel metrics impact performance?
+
+The figures below come from internal load tests on Tyk Gateway `v5.13.0` (GCP `c2-standard-4`, 30-minute runs at 15k rps against 10 routes, with a OpenTelemetry collector on a 5s export interval) and Go micro-benchmarks. Horizontal Pod Autoscaler was bounded to 2–12 pods and the fleet sat near the cap in every scenario (~11.8 pods on average), so pod counts were roughly constant across configurations. A higher HPA cap might absorb tracing overhead as extra pods rather than higher per-pod CPU, so treat the figures as an upper bound on per-instance cost.
+
+- **Default RED metrics are cheap.** Compared to a baseline (OTel off) at 0.57 ms p75 and 25,259 rps, enabling default RED metrics raises p75 to 0.78 ms (+37%) and adds +4.6% mean CPU and +2.3% mean memory. Still sub-millisecond.
+- **Tracing is the expensive part.** Adding tracing on top of metrics pushes p99 from 11.16 ms to 29.68 ms at 50% sampling, and to 35.53 ms at 100% sampling. CPU goes up ~27% and memory ~34% over baseline.
+- **Sampling has a floor.** Dropping from 100% to 50% sampling saves about 17% at p99, but CPU and memory are identical at both rates. Most of the tracing cost is fixed: span context propagation and SDK overhead are paid even when a span is dropped.
+- **Runtime metrics are free.** Adding Go runtime metrics on top of RED produces no measurable difference in either load tests or micro-benchmarks.
+- **Cardinality and instrument count scale flat.** Going from 2 to 14 dimensions on a single counter, or from 1 to 6 instruments, keeps per-request overhead inside a +3% to +7% band
+- **Throughput holds.** RPS stayed within ±1.5% of baseline across every configuration. The cost is in latency and resource usage, not in dropped requests.
+
+The table below shows per-configuration overhead against the OTel-off baseline (10 routes, 15k rps, 30-minute runs):
+
+| Configuration | p75 Δ | p99 Δ | CPU mean Δ | Memory mean Δ | RPS Δ |
+|---|---:|---:|---:|---:|---:|
+| Baseline (OTel off, analytics off) — 0.57 ms p75 / 13.0 cores / 13.1 GiB / 25,259 rps | — | — | — | — | — |
+| Analytics only | +28.1% | +78.5% | +6.9% | +1.5% | -1.0% |
+| Metrics only (default RED) | +36.8% | +76.9% | +4.6% | +2.3% | -0.6% |
+| Metrics + runtime | +17.5% | +26.2% | +2.3% | 0% | -0.7% |
+| Metrics + tracing (50% sampling) + runtime | +189.5% | +235.7% | +29.2% | +34.4% | -0.9% |
+| Full OTel: tracing (100%) + metrics + runtime | +173.7% | +301.9% | +30.0% | +34.4% | -1.4% |
+| Metrics + analytics (Pump) | +31.6% | +100.1% | +12.3% | +6.1% | -1.1% |
+
+These are internal benchmark numbers. Absolute figures won't transfer to different hardware or collector setups, but the relative deltas have been verified across both the micro-benchmark suite and the GCP load tests.
+
+### What can be done to address this performance impact?
+
+- **Enable runtime metrics.** They add GC, goroutine, and heap data at no measurable cost. The load test shows CPU +0.5% and memory +0% versus metrics-only. There's no reason to leave them off.
+- **Treat custom metrics as a memory problem, not a CPU one.** In load tests, 3 custom metric definitions across 50 routes pushed mean memory up +28% and peak memory up +32%, with no CPU change. Avoid high-cardinality label values like user IDs, JWT subjects, full URLs, or trace IDs. Each unique combination creates a new time series held in memory until export. Before adding custom metrics, estimate `routes × instruments × dimension cardinality`.
+- **Sample traces aggressively, but don't expect linear savings.** Configure [opentelemetry.sampling.type](/tyk-oss-gateway/configuration#opentelemetry-sampling-type) as `TraceIDRatioBased` and set [opentelemetry.sampling.rate](/tyk-oss-gateway/configuration#opentelemetry-sampling-rate) to 0.05–0.1 for high-RPS gateways. Use [opentelemetry.sampling.parent_based](/tyk-oss-gateway/configuration#opentelemetry-sampling-parent_based) to keep spans coherent. See [Sampling Strategies](/api-management/traces#sampling) for all options. Since dropping from 100% to 50% only saves ~17% at p99 and nothing on CPU/memory, the real fix is to disable tracing for APIs that don't need it.
+- **Enable detailed tracing per API, not globally.** The Tyk OAS API [server.detailedTracing](/api-management/gateway-config-tyk-oas#detailedtracing) field (and its [Tyk Classic equivalent](/api-management/gateway-config-tyk-classic#opentelemetry)) turns on middleware-level spans for specific APIs only. Use it to limit span volume to where it's useful.
+- **Keep the default 5s export interval.** Gateway-side cost stays under +5% even at 1,000 APIs. Changing the interval doesn't help the gateway; it only shifts pressure to the collector. Tune [opentelemetry.span_batch_config](/tyk-oss-gateway/configuration#opentelemetry-span_batch_config) (`max_queue_size`, `max_export_batch_size`, `batch_timeout`) only if traces are being dropped because the collector can't keep up.
+- **Don't run both signal pipelines unless you need to.** Running OTel metrics alongside Tyk analytics adds about +3% p75 and +12% p99 over analytics alone. If a Pump-driven Prometheus pipeline already covers your KPIs, the overlap may not be worth it.
+- **Avoid 100% trace sampling on high-RPS gateways.** The worst-case configuration (full OTel at 100% sampling) hit +174% p75, +302% p99, +30% CPU, and +34% memory. Use head-based sampling at a low ratio, or limit tracing to a subset of APIs.
+
+### Conclusion
+
+The default RED instruments and Go runtime metrics are safe to enable in production. The cost is small, throughput barely moves, and adding more dimensions or instruments doesn't compound overhead. Tracing is the expensive part: the cost is largely fixed, and the only real way to eliminate it is to disable tracing, not to sample it low. Keep sample rates low, use per-API detailed tracing where possible, and size pod memory against your API count. For more detail on OTel configuration, see [Distributed Tracing with OpenTelemetry](/api-management/traces) and [Sampling Strategies](/api-management/traces#sampling).
+
+## How to reduce CPU usage in a Redis Cluster
+
+### What does high CPU usage in a Redis node within a Redis Cluster mean ?
+
+When a single Redis node within a Redis Cluster exhibits high CPU usage, it indicates that the CPU resources of that particular node are being heavily utilized compared to others in the cluster.
+
+The illustration below highlights the scenario where a single Redis node is exhibiting high CPU usage of 1.20% within a Redis Cluster. 
+
+<img src="/img/faq/enable-multiple-analytics-keys/redis_single.png" alt="analytics keys stored in one Redis server" width="768" />
+
+### What could be causing this high CPU usage ?
+
+One possible reason for high CPU usage in a single Redis node within a Redis Cluster is that analytics features are enabled and keys are being stored within that specific Redis node.
+
+### How does storing keys within a single Redis server contribute to high CPU usage ?
+
+A high volume of analytics traffic can decrease performance, since all analytics keys are stored within one Redis server. Storing keys within a single Redis server can lead to increased CPU usage because all operations related to those keys, such as retrieval, updates and analytics processing, are concentrated on that server. This can result in heavier computational loads on that particular node. This leads to high CPU usage.
+
+### What can be done to address high CPU usage in this scenario ?
+
+Consider distributing the analytics keys across multiple Redis nodes within the cluster. This can help distribute the computational load more evenly, reducing the strain on any single node and potentially alleviating the high CPU usage.
+
+In Redis, *key sharding* is a term used to describe the practice of distributing data across multiple Redis instances or *shards* based on the keys. This feature is provided by [Redis Cluster](https://redis.io/docs/management/scaling/) and provides horizontal scalability and improved performance. 
+
+Tyk supports configuring this behavior so that analytics keys are distributed across multiple servers within a Redis cluster. The image below illustrates that CPU usage is reduced across two Redis servers after making this configuration change.
+
+<img src="/img/faq/enable-multiple-analytics-keys/redis_distributed.png" alt="analytics keys distributed across Redis servers" width="600" />
+
+### How do I configure Tyk to distribute analytics keys to multiple Redis shards ?
+
+Follow these steps:
+
+1. **Check that your Redis Cluster is correctly configured**
+
+    Confirm that the `enable_cluster` configuration option is set to true in the [Tyk Gateway](/tyk-oss-gateway/configuration#storage-enable_cluster), [Tyk Dashboard](/tyk-dashboard/configuration#enable_cluster) and [Tyk Pump](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#analytics_storage_config-enable_cluster) configuration files. This setting 
+    informs Tyk that a Redis Cluster is in use for key storage.
+
+    Ensure that the `addrs` array is populated in the [Tyk Gateway](/tyk-oss-gateway/configuration#storage-addrs) and [Tyk Pump](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#analytics_storage_config-addrs) configuration files (*tyk.conf* and *pump.conf*) with the addresses of all Redis Cluster nodes. If you are using Tyk Self Managed (the licensed product), also update [Tyk Dashboard](/tyk-dashboard/configuration#redis_addrs) configuration file (*tyk_analytics.conf*). This ensures that the Tyk components can interact with the entire Redis Cluster. Please refer to the [configure Redis Cluster](/tyk-configuration-reference/redis-cluster-sentinel#configure-redis-cluster) guide for further details.
+
+2. **Configure Tyk to distribute analytics keys to multiple Redis shards**
+
+    To distribute analytics keys across multiple Redis shards effectively you need to configure the Tyk components to leverage the Redis cluster's sharding capabilities:
+
+    1. **Optimize Analytics Configuration**: In the Tyk Gateway configuration (tyk.conf), set [analytics_config.enable_multiple_analytics_keys](/tyk-oss-gateway/configuration#analytics_config-enable_multiple_analytics_keys) to true. This option allows Tyk to distribute analytics data across Redis nodes, using multiple keys for the analytics. There's a corresponding option for Self Managed MDCB, also named [enable_multiple_analytics_keys](/tyk-multi-data-centre/mdcb-configuration-options#enable_multiple_analytics_keys). Useful only if the gateways in the data plane are configured to send analytics to MDCB.
+    2. **Optimize Connection Pool Settings**: Adjust the [optimization_max_idle](/tyk-oss-gateway/configuration#storage-optimisation_max_idle) and [optimization_max_active](/tyk-oss-gateway/configuration#storage-optimisation_max_active) settings in the configuration files to ensure that the connection pool can handle the analytics workload without overloading any Redis shard.
+    3. **Use a Separate Analytics Store**: For high analytics traffic, you can opt to use a dedicated *Redis Cluster* for analytics by setting [enable_separate_analytics_store](/tyk-oss-gateway/configuration#enable_separate_analytics_store) to true in the Tyk Gateway configuration file (*tyk.conf*) and specifying the separate Redis cluster configuration in the `analytics_storage` section. See [Separate Analytics Storage](/planning-for-production/database-settings#separate-analytics-storage) for a worked example.
+    4. **Review and Test**: After implementing these changes, thoroughly review your configurations and conduct load testing to verify that the analytics traffic is now evenly distributed across all Redis shards.
+
+    By following these steps you can enhance the distribution of analytics traffic across the Redis shards. This should lead to improved scalability and performance of your Tyk deployment.
+
diff --git a/api-management/plugins/advance-config.mdx b/api-management/plugins/advance-config.mdx
new file mode 100644
index 0000000000..2104068cf4
--- /dev/null
+++ b/api-management/plugins/advance-config.mdx
@@ -0,0 +1,625 @@
+---
+title: "Custom Plugins Advance Configuration"
+description: "Explore advanced configuration options for custom plugins in Tyk, including CICD automation, OpenTelemetry instrumentation, and gRPC server health checks in Kubernetes."
+sidebarTitle: "Advanced Configuration"
+---
+
+## CICD - Automating Your Plugin Builds
+
+It's very important to automate the deployment of your infrastructure.  
+
+Ideally, you store your configurations and code in version control, and then through a trigger, have the ability to deploy everything automatically into higher environments.
+
+With custom plugins, this is no different.
+
+To illustrate this, we can look at the GitHub Actions of the [example repo][0].
+
+We see that upon every pull request, a section of steps are taken to "Build, [Bundle](/api-management/plugins/overview#plugin-bundles), Release Go Plugin".
+
+Let's break down the [workflow file][1]:
+
+
+### Compiling the Plugin
+
+We can see the first few steps replicate our first task, bootstrapping the environment and compiling the plugin into a binary format.
+
+```make
+ steps:
+    - uses: actions/checkout@v3
+      
+    - name: Copy Env Files
+      run: cp tyk/confs/tyk_analytics.env.example tyk/confs/tyk_analytics.env
+
+    - name: Build Go Plugin
+      run: make go-build
+```
+
+We can look at the [Makefile][2] to further break down the last `go-build` command.
+
+### Bundle The Plugin
+
+The next step of the workflow is to "[bundle](/api-management/plugins/overview#plugin-bundles)" the plugin.
+
+```
+- name: Bundle Go Plugin
+      run: docker-compose run --rm --user=1000 --entrypoint "bundle/bundle-entrypoint.sh" tyk-gateway
+```
+
+This command generates a "bundle" from the sample Go plugin in the repo.
+
+
+<Note>
+For added security, please consider signing your [bundles](/api-management/plugins/overview#plugin-deployment-types), especially if the connection between the Gateways and the Bundler server traverses the internet.
+</Note>
+
+
+
+Custom plugins can be "bundled", (zipped/compressed) into a standard format, and then uploaded to some server so that they can be downloaded by the Gateways in real time.
+
+This process allows us to decouple the building of our custom plugins from the runtime of the Gateways.
+
+In other words, Gateways can be scaled up and down, and pointed at different plugin repos very easily.  This makes it easier to deploy Custom plugins especially in containerized environments such as Kubernetes, where we don't have to worry about persistent volumes.
+
+You can read more about plugin bundles [here][3].
+
+### Deploy The Plugin
+
+Next step of the workflow is to publish our bundle to a server that's reachable by the Gateways.
+
+```make
+- name: Upload Bundle
+      uses: actions/upload-artifact@v3
+      with:
+        name: customgoplugin.zip
+        path: tyk/bundle/bundle.zip
+
+    - uses: jakejarvis/s3-sync-action@master
+      with:
+        args: --acl public-read --follow-symlinks
+      env:
+        AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        AWS_REGION: 'us-east-1'   
+        SOURCE_DIR: 'tyk/bundle'
+```
+
+This step uploads the Bundle to both GitHub and an AWS S3 bucket.  Obviously, your workflow will look slightly different here.
+
+
+<Note>
+For seamless deployments, take a look at multi-version [plugin support](/tyk-cloud/using-plugins) to enable zero downtime deployments of your Tyk Gateway installs
+</Note>
+
+
+### Configure the Gateway
+
+In order to instruct the Gateway to download the bundle, we need two things:
+
+1. The root server - The server which all bundles will be downloaded from.  This is set globally in the Tyk conf file [here](/tyk-oss-gateway/configuration#enable_bundle_downloader).
+
+2. The name of the bundle - this is generated during your workflow usually.  This is defined at the API level (this is where you declare Custom plugins, as evident in task 2)
+
+The field of the API Definition that needs to be set is `custom_middleware_bundle`.
+
+### Summary
+
+That's it!  
+
+We've set up our dev environment, built, compiled, a Custom Go plugin, loaded onto a Tyk Gateway, and tested it by sending an API request.  Finally, we've talked about deploying a Bundle in a production grade set up.
+
+Have a look at our [examples repo][4] for more inspiration.
+
+[0]: https://github.com/TykTechnologies/custom-go-plugin
+[1]: https://github.com/TykTechnologies/custom-go-plugin/blob/master/.github/workflows/makefile.yml
+[2]: https://github.com/TykTechnologies/custom-go-plugin/blob/master/Makefile#L59
+[3]: https://github.com/TykTechnologies/custom-go-plugin#deploying-the-go-plugin
+[4]: https://github.com/TykTechnologies/custom-plugin-examples
+
+## Instrumenting Plugins with OpenTelemetry
+
+By instrumenting your custom plugins with Tyk's *OpenTelemetry* library, you can gain additional insights into custom plugin behavior like time spent and exit status. Read on to see some examples of creating span and setting attributes for your custom plugins.
+
+
+<Note>
+**Note:**
+Although this documentation is centered around Go plugins, the outlined principles are universally applicable to plugins written in other languages. Ensuring proper instrumentation and enabling detailed tracing will integrate the custom plugin span into the trace, regardless of the underlying programming language.
+</Note>
+
+
+### Prerequisites
+
+- Go v1.19 or higher
+- Gateway instance with OpenTelemetry and DetailedTracing enabled:
+
+Add this field within your [Gateway config file](/tyk-oss-gateway/configuration):
+
+```json
+{
+  "opentelemetry": {
+    "enabled": true
+  }
+}
+```
+
+And this field within your [API definition](/api-management/gateway-config-introduction):
+
+```json
+{
+  "detailed_tracing": true
+}
+```
+
+You can find more information about enabling OpenTelemetry [here](/api-management/traces).
+
+
+<Note>
+DetailedTracing must be enabled in the API definition to see the plugin spans in the traces.
+</Note>
+
+
+In order to instrument our plugins we will be using Tyk's OpenTelemetry library implementation.
+You can import it by running the following command:
+
+```console
+$ go get github.com/TykTechnologies/opentelemetry
+```
+
+<br />
+
+
+<Note>
+In this case, we are using our own OpenTelemetry library for convenience. You can also use the [Official OpenTelemetry Go SDK](https://github.com/open-telemetry/opentelemetry-go)
+</Note>
+
+
+### Create a new span from the request context
+
+`trace.NewSpanFromContext()` is a function that helps you create a new span from the current request context. When called, it returns two values: a fresh context with the newly created span embedded inside it, and the span itself. This method is particularly useful for tracing the execution of a piece of code within a web request, allowing you to measure and analyze its performance over time.
+
+The function takes three parameters:
+
+1. `Context`: This is usually the current request's context. However, you can also derive a new context from it, complete with timeouts and cancelations, to suit your specific needs.
+2. `TracerName`: This is the identifier of the tracer that will be used to create the span. If you do not provide a name, the function will default to using the `tyk` tracer.
+3. `SpanName`: This parameter is used to set an initial name for the child span that is created. This name can be helpful for later identifying and referencing the span.
+
+Here's an example of how you can use this function to create a new span from the current request context:
+
+```go
+package main
+import (
+    "net/http"
+    "github.com/TykTechnologies/opentelemetry/trace"
+)
+// AddFooBarHeader adds a custom header to the request.
+func AddFooBarHeader(rw http.ResponseWriter, r *http.Request) {
+    // We create a new span using the context from the incoming request.
+    _, newSpan := trace.NewSpanFromContext(r.Context(), "", "GoPlugin_first-span")
+    // Ensure that the span is properly ended when the function completes.
+    defer newSpan.End()
+    // Add a custom "Foo: Bar" header to the request.
+    r.Header.Add("Foo", "Bar")
+}
+func main() {}
+```
+
+In your exporter (in this case, Jaeger) you should see something like this:
+
+<img src="/img/plugins/span_from_context.png" alt="OTel Span from context" />
+
+As you can see, the name we set is present: `GoPlugin_first-span` and it's the first child of the `GoPluginMiddleware` span.
+
+### Modifying span name and set status
+
+The span created using `trace.NewSpanFromContext()` can be further configured after its creation. You can modify its name and set its status:
+
+```go
+func AddFooBarHeader(rw http.ResponseWriter, r *http.Request) {
+	_, newSpan := trace.NewSpanFromContext(r.Context(), "", "GoPlugin_first-span")
+	defer newSpan.End()
+
+	// Set a new name for the span.
+	newSpan.SetName("AddFooBarHeader Testing")
+
+	// Set the status of the span.
+	newSpan.SetStatus(trace.SPAN_STATUS_OK, "")
+
+	r.Header.Add("Foo", "Bar")
+}
+```
+
+This updated span will then appear in the traces as `AddFooBarHeader Testing` with an **OK Status**.
+
+The second parameter of the `SetStatus` method can accept a description parameter that is valid for **ERROR** statuses.
+
+The available span statuses in ascending hierarchical order are:
+
+- `SPAN_STATUS_UNSET`
+
+- `SPAN_STATUS_ERROR`
+
+- `SPAN_STATUS_OK`
+
+This order is important: a span with an **OK** status cannot be overridden with an **ERROR** status. However, the reverse is possible - a span initially marked as **UNSET** or **ERROR** can later be updated to **OK**.
+
+<img src="/img/plugins/span_name_and_status.png" alt="OTel Span name and status" />
+
+Now we can see the new name and the `otel.status_code` tag with the **OK** status.
+
+### Setting attributes
+
+The `SetAttributes()` function allows you to set attributes on your spans, enriching each trace with additional, context-specific information.
+
+The following example illustrates this functionality using the OpenTelemetry library's implementation by Tyk
+
+```go
+func AddFooBarHeader(rw http.ResponseWriter, r *http.Request) {
+	_, newSpan := trace.NewSpanFromContext(r.Context(), "", "GoPlugin_first-span")
+	defer newSpan.End()
+
+    // Set an attribute on the span.
+	newSpan.SetAttributes(trace.NewAttribute("go_plugin", "1"))
+
+	r.Header.Add("Foo", "Bar")
+}
+```
+
+In the above code snippet, we set an attribute `go_plugin` with a value of `1` on the span. This is just a demonstration; in practice, you might want to set attributes that carry meaningful data relevant to your tracing needs.
+
+Attributes are key-value pairs. The value isn't restricted to string data types; it can be any value, including numerical, boolean, or even complex data types, depending on your requirements. This provides flexibility and allows you to include rich, structured data within your spans.
+
+The illustration below, shows how the `go_plugin` attribute looks in Jaeger:
+
+<img src="/img/plugins/span_attributes.png" alt="OTel Span attributes" />
+
+### Multiple functions = Multiple spans
+
+To effectively trace the execution of your plugin, you can create additional spans for each function execution. By using context propagation, you can link these spans, creating a detailed trace that covers multiple function calls. This allows you to better understand the sequence of operations, pinpoint performance bottlenecks, and analyze application behavior.
+
+Here's how you can implement it:
+
+```go
+func AddFooBarHeader(rw http.ResponseWriter, r *http.Request) {
+	// Start a new span for this function.
+	ctx, newSpan := trace.NewSpanFromContext(r.Context(), "", "GoPlugin_first-span")
+	defer newSpan.End()
+
+	// Set an attribute on this span.
+	newSpan.SetAttributes(trace.NewAttribute("go_plugin", "1"))
+
+	// Call another function, passing in the context (which includes the new span).
+	NewFunc(ctx)
+
+	// Add a custom "Foo: Bar" header to the request.
+	r.Header.Add("Foo", "Bar")
+}
+
+func NewFunc(ctx context.Context) {
+	// Start a new span for this function, using the context passed from the calling function.
+	_, newSpan := trace.NewSpanFromContext(ctx, "", "GoPlugin_second-span")
+	defer newSpan.End()
+
+	// Simulate some processing time.
+	time.Sleep(1 * time.Second)
+
+	// Set an attribute on this span.
+	newSpan.SetAttributes(trace.NewAttribute("go_plugin", "2"))
+}
+```
+
+In this example, the `AddFooBarHeader` function creates a span and then calls `NewFunc`, passing the updated context. The `NewFunc` function starts a new span of its own, linked to the original through the context. It also simulates some processing time by sleeping for 1 second, then sets a new attribute on the second span. In a real-world scenario, the `NewFunc` would contain actual code logic to be executed.
+
+The illustration below, shows how this new child looks in Jaeger:
+
+<img src="/img/plugins/multiple_spans.png" alt="OTel Span attributes" />
+
+### Error handling
+
+In OpenTelemetry, it's essential to understand the distinction between recording an error and setting the span status to error. The `RecordError()` function records an error as an exception span event. However, this alone doesn't change the span's status to error. To mark the span as error, you need to make an additional call to the `SetStatus()` function.
+
+> RecordError will record err as an exception span event for this span. An additional call to SetStatus is required if the Status of the Span should be set to Error, as this method does not change the Span status. If this span is not being recorded or err is nil then this method does nothing.
+
+Here's an illustrative example with function calls generating a new span, setting attributes, setting an error status, and recording an error:
+
+```go
+func AddFooBarHeader(rw http.ResponseWriter, r *http.Request) {
+	// Create a new span for this function.
+	ctx, newSpan := trace.NewSpanFromContext(r.Context(), "", "GoPlugin_first-span")
+	defer newSpan.End()
+
+	// Set an attribute on the new span.
+	newSpan.SetAttributes(trace.NewAttribute("go_plugin", "1"))
+
+	// Call another function, passing in the updated context.
+	NewFunc(ctx)
+
+	// Add a custom header "Foo: Bar" to the request.
+	r.Header.Add("Foo", "Bar")
+}
+
+func NewFunc(ctx context.Context) {
+	// Create a new span using the context passed from the previous function.
+	ctx, newSpan := trace.NewSpanFromContext(ctx, "", "GoPlugin_second-span")
+	defer newSpan.End()
+
+	// Simulate some processing time.
+	time.Sleep(1 * time.Second)
+
+	// Set an attribute on the new span.
+	newSpan.SetAttributes(trace.NewAttribute("go_plugin", "2"))
+
+	// Call a function that will record an error and set the span status to error.
+	NewFuncWithError(ctx)
+}
+
+func NewFuncWithError(ctx context.Context) {
+	// Start a new span using the context passed from the previous function.
+	_, newSpan := trace.NewSpanFromContext(ctx, "", "GoPlugin_third-span")
+	defer newSpan.End()
+
+	// Set status to error.
+	newSpan.SetStatus(trace.SPAN_STATUS_ERROR, "Error Description")
+
+	// Set an attribute on the new span.
+	newSpan.SetAttributes(trace.NewAttribute("go_plugin", "3"))
+
+	// Record an error in the span.
+	newSpan.RecordError(errors.New("this is an auto-generated error"))
+}
+```
+
+In the above code, the `NewFuncWithError` function demonstrates error handling in OpenTelemetry. First, it creates a new span. Then it sets the status to error, and adds an attribute. Finally, it uses `RecordError()` to log an error event. This two-step process ensures that both the error event is recorded and the span status is set to reflect the error.
+
+<img src="/img/plugins/span_error_handling.png" alt="OTel Span error handling" />
+
+
+## Highly Available gRPC Servers in Kubernetes
+
+When deploying gRPC servers to host [rich plugins](/api-management/plugins/rich-plugins#using-grpc) in Kubernetes, implementing proper health checks on those servers is crucial so that you can achieve high availability and enable seamless rolling updates. 
+
+Kubernetes needs to know when your gRPC server is ready to accept traffic otherwise:
+
+- Traffic may be routed to pods that aren't ready
+- Failed pods won't be automatically restarted
+- Load balancing becomes unreliable
+- Rolling deployments can cause service disruption
+
+When using gRPC plugins to implement custom processing of API requests, this is especially important since the Gateway depends on having reliable access to these services to process requests. If Tyk is unable to reach the gRPC server, then it will be unable to correctly execute the plugins hosted there, leading to API requests failing.
+
+### Key Benefits of Health Checks for Rolling Updates
+
+1. **Zero-Downtime Deployments**
+- Readiness probes ensure new pods are fully ready before receiving traffic
+- Old pods continue serving until new ones are ready
+- Traffic is never routed to non-functional pods
+
+2. **Graceful Shutdown**
+- SIGTERM triggers immediate graceful shutdown sequence
+- Health status changes to "not serving" during shutdown
+- gRPC server stops gracefully, finishing in-flight requests
+- 30-second timeout ensures forced shutdown if graceful shutdown hangs
+
+3. **Failure Recovery**
+- Liveness probes detect and restart unhealthy pods
+- Startup probes give adequate time for slow-starting services
+- Failed deployments are automatically rolled back
+
+### Using gRPC Health Probes with Tyk
+
+Tyk's native support for gRPC health probes is provided via the Health Checking service in the standard gRPC Go library and provides several benefits:
+
+1. **Native Integration**: Uses the same transport protocol as your main service
+2. **Service-Specific Checks**: Can check the health of individual gRPC services
+3. **Better Resource Utilization**: No need for a separate HTTP server
+4. **Consistent Protocol**: Maintains gRPC throughout the stack
+
+#### gRPC Health Checking Protocol
+
+The following example uses the [gRPC Health Checking Protocol](https://github.com/grpc/grpc/blob/master/doc/health-checking.md) instead of HTTP endpoints.
+
+#### Health Check Implementation Details
+
+The gRPC health server manages two service states:
+
+- `""` (empty string): Overall server health
+- `"coprocess.Dispatcher"`: Specific service health for readiness checks
+
+Health states transition as follows:
+- **Startup**: `NOT_SERVING` → `SERVING` (when ready)
+- **Shutdown**: `SERVING` → `NOT_SERVING` (immediate)
+- **Error**: `SERVING` → `NOT_SERVING` (on failure)
+
+#### Example Implementation
+
+##### Required Dependencies
+
+You should add this to your `go.mod`:
+
+```go
+require (
+    google.golang.org/grpc v1.50.0 // or later
+)
+```
+
+##### main.go Setup
+
+```go
+package main
+
+import (
+	"context"
+	"log"
+	"net"
+	"os"
+	"os/signal"
+	"sync/atomic"
+	"syscall"
+	"time"
+
+	"github.com/TykTechnologies/tyk/coprocess"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/health"
+	"google.golang.org/grpc/health/grpc_health_v1"
+)
+
+const (
+	ListenAddress = ":50051"
+)
+
+func main() {
+	// Track server readiness
+	var isReady int32
+
+	lis, err := net.Listen("tcp", ListenAddress)
+	if err != nil {
+		log.Fatalf("Failed to listen: %v", err)
+	}
+
+	log.Printf("starting grpc server on %v", ListenAddress)
+	s := grpc.NewServer()
+	
+	// Register the main coprocess service
+	coprocess.RegisterDispatcherServer(s, &Dispatcher{})
+	
+	// Register health service
+	healthServer := health.NewServer()
+	grpc_health_v1.RegisterHealthServer(s, healthServer)
+	
+	// Initially mark all services as not serving
+	healthServer.SetServingStatus("", grpc_health_v1.HealthCheckResponse_NOT_SERVING)
+	healthServer.SetServingStatus("coprocess.Dispatcher", grpc_health_v1.HealthCheckResponse_NOT_SERVING)
+
+	// Channel to listen for errors coming from the listener.
+	serverErrors := make(chan error, 1)
+
+	// Start the service listening for requests.
+	go func() {
+		// Mark as ready once server is initialized
+		atomic.StoreInt32(&isReady, 1)
+		
+		// Set health status to serving
+		healthServer.SetServingStatus("", grpc_health_v1.HealthCheckResponse_SERVING)
+		healthServer.SetServingStatus("coprocess.Dispatcher", grpc_health_v1.HealthCheckResponse_SERVING)
+		
+		log.Printf("gRPC server is ready to accept connections")
+		serverErrors <- s.Serve(lis)
+	}()
+
+	// Channel to listen for an interrupt or terminate signal from the OS.
+	shutdown := make(chan os.Signal, 1)
+	signal.Notify(shutdown, os.Interrupt, syscall.SIGTERM)
+
+	// Blocking main and waiting for shutdown.
+	select {
+	case err := <-serverErrors:
+		atomic.StoreInt32(&isReady, 0)
+		// Mark services as not serving
+		healthServer.SetServingStatus("", grpc_health_v1.HealthCheckResponse_NOT_SERVING)
+		healthServer.SetServingStatus("coprocess.Dispatcher", grpc_health_v1.HealthCheckResponse_NOT_SERVING)
+		log.Fatalf("Server error: %v", err)
+	case sig := <-shutdown:
+		atomic.StoreInt32(&isReady, 0)
+		log.Printf("Received signal: %v", sig)
+		
+		// Mark services as not serving during shutdown
+		healthServer.SetServingStatus("", grpc_health_v1.HealthCheckResponse_NOT_SERVING)
+		healthServer.SetServingStatus("coprocess.Dispatcher", grpc_health_v1.HealthCheckResponse_NOT_SERVING)
+		
+		// Give outstanding requests 5 seconds to complete.
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+
+		stopped := make(chan struct{})
+		go func() {
+			s.GracefulStop()
+			close(stopped)
+		}()
+
+		select {
+		case <-ctx.Done():
+			log.Printf("Graceful shutdown timed out")
+			s.Stop()
+		case <-stopped:
+			log.Printf("Graceful shutdown completed")
+		}
+	}
+}
+
+```
+
+##### Kubernetes Deployment
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tyk-grpc-coprocess
+  labels:
+    app: tyk-grpc-coprocess
+spec:
+  replicas: 3
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: tyk-grpc-coprocess
+  template:
+    metadata:
+      labels:
+        app: tyk-grpc-coprocess
+    spec:
+      containers:
+      - name: grpc-server
+        image: your-registry/tyk-grpc-coprocess:latest
+        ports:
+        - containerPort: 50051
+          name: grpc
+        
+        ## Readiness probe - determines when pod is ready for traffic
+        readinessProbe:
+          grpc:
+            port: 50051
+            service: coprocess.Dispatcher
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+          successThreshold: 1
+        
+        ## Liveness probe - determines when to restart pod
+        livenessProbe:
+          grpc:
+            port: 50051
+          initialDelaySeconds: 15
+          periodSeconds: 20
+          timeoutSeconds: 5
+          failureThreshold: 3
+        
+        ## Startup probe - gives more time for initial startup
+        startupProbe:
+          grpc:
+            port: 50051
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          timeoutSeconds: 5
+          failureThreshold: 30
+        
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tyk-grpc-coprocess-service
+spec:
+  selector:
+    app: tyk-grpc-coprocess
+  ports:
+  - name: grpc
+    port: 50051
+    targetPort: 50051
+    protocol: TCP
+  type: ClusterIP
+```
+
diff --git a/api-management/plugins/golang.mdx b/api-management/plugins/golang.mdx
new file mode 100644
index 0000000000..508e2ec396
--- /dev/null
+++ b/api-management/plugins/golang.mdx
@@ -0,0 +1,1040 @@
+---
+title: "Golang Plugins"
+description: "Learn how to extend Tyk Gateway functionality by writing custom middleware plugins in Go"
+sidebarTitle: "Golang Plugins"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+## Introduction
+
+Golang plugins are a very flexible and powerful way to extend the functionality of Tyk by attaching custom logic written in Go to [hooks](/api-management/plugins/plugin-types#plugin-types) in the Tyk [middleware chain](/api-management/traffic-transformation#request-middleware-chain).
+The chain of middleware is specific to an API and gets created at API load time. When Tyk Gateway performs an API re-load it also loads any custom middleware and "injects" them into a chain to be called at different stages of the HTTP request life cycle.
+
+For a quick-start guide to working with Go plugins, start [here](/api-management/plugins/overview#getting-started).
+
+The [Go plugin writing guide](/api-management/plugins/golang#writing-custom-go-plugins) provides details of how to access dynamic data (such as the key session object) from your Go functions. Combining these resources provides you with a powerful set of tools for shaping and structuring inbound traffic to your API.
+
+## Supported plugin types
+
+All of Tyk's [custom middleware hooks](/api-management/plugins/plugin-types#plugin-types) support Go plugins. They represent different stages in the request and response [middleware chain](/api-management/traffic-transformation#request-middleware-chain) where custom functionality can be added.
+
+- **Pre** - supports an array of middleware that run before any others (i.e. before authentication)
+- **Auth** - this middleware performs custom authentication and adds API key session info into the request context and can be used only if the API definition has both:
+  - `"use_keyless": false`
+  - `"use_go_plugin_auth": true`
+- **Post-Auth** - supports an array of middleware to be run after authentication; at this point, we have authenticated the session API key for the given key (in the request context) so we can perform any extra checks. This can be used only if the API definition has both:
+  - `"use_keyless": false`
+  - an authentication method specified
+- **Post** - supports an array of middleware that run at the very end of the middleware chain, just before Tyk makes a round-trip to the upstream target
+- **Response** - run only at the point the response has returned from a service upstream of the API Gateway; note that the [method signature for Response Go plugins](/api-management/plugins/golang#creating-a-custom-response-plugin) is slightly different from the other hook types
+
+
+
+    <Note>
+    The `use_keyless` and `use_go_plugin_auth` fields are populated automatically with the correct values if you add a plugin to the **Auth** or **Post-Auth** hooks when using the Tyk Dashboard.
+    </Note>
+
+## Custom Go plugin development flow
+
+Go Plugins need to be compiled to native shared object code, which can then be loaded by Tyk Gateway.
+
+We recommend that you familiarize yourself with the following official Go documentation to help you work effectively with Go plugins:
+
+- [The official plugin package documentation - Warnings](https://pkg.go.dev/plugin)
+- [Tutorial: Getting started with multi-module workspaces](https://go.dev/doc/tutorial/workspaces)
+
+
+
+    <Note>
+    Plugins are currently supported only on Linux, FreeBSD, and macOS, making them unsuitable for applications intended to be portable.
+    </Note>
+
+
+### Tyk Plugin Compiler
+
+We provide the [Tyk Plugin Compiler](/api-management/plugins/golang#plugin-compiler) docker image, which we **strongly recommend** is used to build plugins compatible with the official Gateway releases. That tool provides the cross compilation toolchain, Go version used to build the release, ensures that compatible flags are used when compiling plugins (such as `-trimpath`, `CC`, `CGO_ENABLED`, `GOOS`, `GOARCH`) and also works around known Go issues such as:
+
+- https://github.com/golang/go/issues/19004
+- https://www.reddit.com/r/golang/comments/qxghjv/plugin_already_loaded_when_a_plugin_is_loaded/
+
+#### Understanding Plugin Compiler Security Scans
+
+The Tyk Plugin Compiler Docker image is a development tool used exclusively during the build phase to compile custom Go plugins for the Tyk Gateway. This tool:
+
+1. **Is not a runtime component** - It is never deployed as part of your production Tyk environment
+2. **Operates in isolated build environments** - It should only be used in controlled development or CI/CD pipelines
+3. **Is not designed to be network-exposed** - It should never be deployed as a service or exposed to untrusted networks
+
+##### Technical Context
+The Plugin Compiler is built on Debian Bullseye to ensure binary compatibility with RHEL8 environments, which are commonly used in enterprise Tyk deployments. Security scanning tools may flag numerous Common Vulnerabilities and Exposures (CVEs) in the base Debian Bullseye libraries included in this image.
+
+##### Security Clarification
+These CVEs do not represent an exploitable attack surface in your Tyk deployment for several reasons:
+
+1. **Build-time vs. Runtime Separation:** The Plugin Compiler is strictly a build-time tool. The compiled plugins that it produces are what get deployed to your Tyk Gateway, not the compiler itself.
+
+2. **Ephemeral Usage Pattern**: The recommended usage pattern is to run the compiler only when needed to generate plugin binaries, then discard the container.
+
+3. **Air-gapped Operation**: The compilation process typically occurs in development environments or CI/CD pipelines that are separate from production systems.
+
+4. **No Persistent Deployment**: Unlike the Tyk Gateway, Dashboard, and other runtime components, the Plugin Compiler is never deployed as a long-running service in your API management infrastructure.
+
+For optimal security, we recommend running the Plugin Compiler in isolated build environments and transferring only the compiled plugin binaries to your production Tyk deployment.
+
+
+### Setting up your environment
+
+It's important to understand the need for plugins to be compiled using exactly the same environment and build flags as the Gateway. To simplify this and minimise the risk of compatibility problems, we recommend the use of [Go workspaces](https://go.dev/blog/get-familiar-with-workspaces), to provide a consistent environment.
+
+To develop plugins without using the Tyk Plugin Compiler, you'll need:
+
+- Go (matching the version used in the Gateway, which you can determine using `go.mod`).
+- Git to check out Tyk Gateway source code.
+- A folder with the code that you want to build into plugins.
+
+We recommend that you set up a *Go workspace*, which, at the end, is going to contain:
+
+- `/tyk-release-x.y.z` - the Tyk Gateway source code
+- `/plugins` - the plugins
+- `/go.work` - the *Go workspace* file
+- `/go.work.sum` - *Go workspace* package checksums
+
+Using the *Go workspace* ensures build compatibility between the plugins and Gateway.
+
+### Steps for Configuration:
+
+1. **Checking out Tyk Gateway source code**
+
+    ```
+    git clone --branch release-5.3.6 https://github.com/TykTechnologies/tyk.git tyk-release-5.3.6 || true
+    ```
+
+    This example uses a particular `release-5.3.6` branch, to match Tyk Gateway release 5.3.6. With newer `git` versions, you may pass `--branch v5.3.6` and it would use the tag. In case you want to use the tag it's also possible to navigate into the folder and issue `git checkout tags/v5.3.6`.
+
+2. **Preparing the Go workspace**
+
+    Your Go workspace can be very simple:
+
+    1. Create a `.go` file containing the code for your plugin.
+    2. Create a `go.mod` file for the plugin.
+    3. Ensure the correct Go version is in use.
+
+    As an example, we can use the [CustomGoPlugin.go](https://github.com/TykTechnologies/custom-go-plugin/blob/master/go/src/CustomGoPlugin.go) sample as the source for our plugin as shown:
+
+    ```
+    mkdir -p plugins
+    cd plugins
+    go mod init testplugin
+    go mod edit -go $(go mod edit -json go.mod | jq -r .Go)
+    wget -q https://raw.githubusercontent.com/TykTechnologies/custom-go-plugin/refs/heads/master/go/src/CustomGoPlugin.go
+    cd -
+    ```
+
+    The following snippet provides you with a way to get the exact Go version used by Gateway from it's [go.mod](https://github.com/TykTechnologies/tyk/blob/release-5.3.6/go.mod#L3) file:
+
+    - `go mod edit -json go.mod | jq -r .Go` (e.g. `1.22.7`)
+
+    This should be used to ensure the version matches between gateway and the plugin.
+
+    To summarize what was done:
+
+    1. We created a plugins folder and initialzed a `go` project using `go mod` command.
+    2. Set the Go version of `go.mod` to match the one set in the Gateway.
+    3. Initialzied the project with sample plugin `go` code.
+
+    At this point, we don't have a *Go workspace* but we will create one next so that we can effectively share the Gateway dependency across Go modules.
+
+3. **Creating the Go workspace**
+
+    To set up the Go workspace, start in the directory that contains the Gateway and the Plugins folder. You'll first, create the `go.work` file to set up your Go workspace, and include the `tyk-release-5.3.6` and `plugins` folders. Then, navigate to the plugins folder to fetch the Gateway dependency at the exact commit hash and run `go mod tidy` to ensure dependencies are up to date.
+
+    Follow these commands:
+
+    ```
+    go work init ./tyk-release-5.3.6
+    go work use ./plugins
+    commit_hash=$(cd tyk-release-5.3.6 && git rev-parse HEAD)
+    cd plugins && go get github.com/TykTechnologies/tyk@${commit_hash} && go mod tidy && cd -
+    ```
+
+    The following snippet provides you to get the commit hash exactly, so it can be used with `go get`.
+
+    - `git rev-parse HEAD`
+
+    The Go workspace file (`go.work`) should look like this:
+
+    ```
+    go 1.22.7
+
+    use (
+        ./plugins
+        ./tyk-release-5.3.6
+    )
+    ```
+
+4. **Building and validating the plugin**
+
+    Now that your *Go workspace* is ready, you can build your plugin as follows:
+
+    ```
+    cd tyk-release-5.3.6 && go build -tags=goplugin -trimpath . && cd -
+    cd plugins           && go build -trimpath -buildmode=plugin . && cd -
+    ```
+
+    These steps build both the Gateway and the plugin.
+
+    You can use the Gateway binary that you just built to test that your new plugin loads into the Gateway without having to configure and then make a request to an API using this command:
+
+    ```
+    ./tyk-release-5.3.6/tyk plugin load -f plugins/testplugin.so -s AuthCheck
+    ```
+
+    You should see an output similar to:
+
+    ```
+    time="Oct 14 13:39:55" level=info msg="--- Go custom plugin init success! ---- "
+    [file=plugins/testplugin.so, symbol=AuthCheck] loaded ok, got 0x76e1aeb52140
+    ```
+
+    The log shows that the plugin has correctly loaded into the Gateway and that its `init` function has been successfully invoked.
+
+5. **Summary**
+
+    In the preceding steps we have put together an end-to-end build environment for both the Gateway and the plugin. Bear in mind that runtime environments may have additional restrictions beyond Go version and build flags to which the plugin developer must pay attention.
+
+    Compatibility in general is a big concern when working with Go plugins: as the plugins are tightly coupled to the Gateway, consideration must always be made for the build restrictions enforced by environment and configuration options.
+
+    Continue with [Loading Go Plugins into Tyk](/api-management/plugins/golang#loading-custom-go-plugins-into-tyk).
+
+### Debugging Golang Plugins
+
+Plugins are native Go code compiled to a binary shared object file. The code may depend on `cgo` and require libraries like `libc` provided by the runtime environment. The following are some debugging steps for diagnosing issues arising from using plugins.
+
+#### Warnings
+
+The [Plugin package - Warnings](https://pkg.go.dev/plugin#hdr-Warnings) section in the Go documentation outlines several requirements which can't be ignored when working with plugins. The most important restriction is the following:
+
+> Runtime crashes are likely to occur unless all parts of the program (the application and all its plugins) are compiled using exactly the same version of the toolchain, the same build tags, and the same values of certain flags and environment variables.
+
+#### Using Incorrect Build Flags
+
+When working with Go plugins, it's easy to miss the restriction that the plugin at the very least must be built with the same Go version, and the same flags (notably `-trimpath`) as the Tyk Gateway on which it is to be used.
+
+If you miss an argument (for example `-trimpath`) when building the plugin, the Gateway will report an error when your API attempts to load the plugin, for example:
+
+```
+task: [test] cd tyk-release-5.3.6 && go build -tags=goplugin -trimpath .
+task: [test] cd plugins && go build -buildmode=plugin .
+task: [test] ./tyk-release-5.3.6/tyk plugin load -f plugins/testplugin.so -s AuthCheck
+tyk: error: unexpected error: plugin.Open("plugins/testplugin"): plugin was built with a different version of package internal/goarch, try --help
+```
+
+Usually when the error hints at a standard library package, the build flags between the Gateway and plugin binaries don't match.
+
+Other error messages may be reported, depending on what triggered the issue. For example, if you omitted `-race` in the plugin but the gateway was built with `-race`, the following error will be reported:
+
+```
+plugin was built with a different version of package runtime/internal/sys, try --help
+```
+
+Strictly speaking:
+
+- Build flags like `-trimpath`, `-race` need to match.
+- Go toolchain / build env needs to be exactly the same.
+- For cross compilation you must use the same `CC` value for the build (CGO).
+- `CGO_ENABLED=1`, `GOOS`, `GOARCH` must match with runtime.
+
+When something is off, you can check what is different by using the `go version -m` command for the Gateway (`go version -m tyk`) and plugin (`go version -m plugin.so`). Inspecting and comparing the output of `build` tokens usually yields the difference that caused the compatibility issue.
+
+#### Plugin Compatibility Issues
+
+Below are some common situations where dependencies might cause issues:
+
+- The `Gateway` has a dependency without a `go.mod` file, but the plugin needs to use it.
+- Both the `Gateway` and the plugin share a dependency. In this case, the plugin must use the exact same version as the `Gateway`.
+- The plugin requires a different version of a shared dependency.
+
+Here’s how to handle each case:
+
+**Case 1: Gateway dependency lacks `go.mod`**
+
+- The plugin depends on the `Gateway`, which uses dependency *A*.
+- *A* doesn’t have a `go.mod` file, so a pseudo version is generated during the build.
+- Result: The build completes, but the plugin fails to load due to a version mismatch.
+
+**Solution:** Update the code to remove dependency *A*, or use a version of *A* that includes a `go.mod` file.
+
+**Case 2: Shared dependency with version matching**
+
+- The plugin and `Gateway` share a dependency, and this dependency includes a `go.mod` file.
+- The version matches, and the dependency is promoted to *direct* in `go.mod`.
+- Outcome: You’ll need to keep this dependency version in sync with the `Gateway`.
+
+**Case 3: Plugin requires a different version of a shared dependency**
+
+- The plugin and `Gateway` share a dependency, but the plugin needs a different version.
+- If the other version is a major release (e.g., `/v4`), it’s treated as a separate package, allowing both versions to coexist.
+- If it’s just a minor/patch difference, the plugin will likely fail to load due to a version conflict.
+
+**Recommendation:** For best results, use Go package versions that follow the Go module versioning (metaversion). However, keep in mind that many `Gateway` dependencies use basic `v1` semantic versioning, which doesn’t always enforce strict versioned import paths. 
+
+#### List plugin symbols
+
+Sometimes it's useful to list symbols from a plugin. For example, we can list the symbols as they are compiled into our testplugin:
+
+```
+# nm -gD testplugin.so | grep testplugin
+00000000014db4b0 R go:link.pkghashbytes.testplugin
+000000000170f7d0 D go:link.pkghash.testplugin
+000000000130f5e0 T testplugin.AddFooBarHeader
+000000000130f900 T testplugin.AddFooBarHeader.deferwrap1
+000000000130f980 T testplugin.AuthCheck
+0000000001310100 T testplugin.AuthCheck.deferwrap1
+000000000130f540 T testplugin.init
+0000000001310ce0 T testplugin.init.0
+0000000001ce9580 D testplugin..inittask
+0000000001310480 T testplugin.InjectConfigData
+0000000001310180 T testplugin.InjectMetadata
+0000000001d2a3e0 B testplugin.logger
+0000000001310cc0 T testplugin.main
+0000000001310820 T testplugin.MakeOutboundCall
+0000000001310c40 T testplugin.MakeOutboundCall.deferwrap1
+```
+
+This command prints other symbols that are part of the binary. In the worst case, a build compatibility issue may cause a crash in the Gateway due to an unrecoverable error and this can be used to further debug the binaries produced.
+
+A very basic check to ensure Gateway/plugin compatibility is using the built in `go version -m <file>`:
+
+```
+[output truncated]
+	build	-buildmode=exe
+	build	-compiler=gc
+	build	-race=true
+	build	-tags=goplugin
+	build	-trimpath=true
+	build	CGO_ENABLED=1
+	build	GOARCH=amd64
+	build	GOOS=linux
+	build	GOAMD64=v1
+	build	vcs=git
+	build	vcs.revision=1db1935d899296c91a55ba528e7b653aec02883b
+	build	vcs.time=2024-09-24T12:54:26Z
+	build	vcs.modified=false
+```
+
+These options should match between the Gateway binary and the plugin. You can use the command for both binaries and then compare the outputs.
+
+
+## Writing Custom Go Plugins
+
+Tyk's custom Go plugin middleware is very powerful as it provides you with access to different data types and functionality as explained in this section.
+
+Golang plugins are a very flexible and powerful way to extend the functionality of Tyk and uses the native Golang plugins API (see [go pkg/plugin docs](https://golang.org/pkg/plugin) for more details).
+
+Custom Go plugins can access various data objects relating to the API request:
+
+- [session](/api-management/plugins/golang#accessing-the-session-object): the key session object provided by the client when making the API request
+- [API definition](/api-management/plugins/golang#accessing-the-api-definition): the Tyk OAS or Tyk Classic API definition for the requested API
+
+Custom Go plugins can also [terminate the request](/api-management/plugins/golang#terminating-the-request) and stop further processing of the API request such that it is not sent to the upstream service.
+
+For more resources for writing plugins, please visit our [Plugin Hub](/api-management/plugins/overview#plugins-hub).
+To see an example of a Go plugin, please visit our [Go plugin examples](/api-management/plugins/golang#example-custom-go-plugins) page.
+
+### Accessing the internal state of a custom plugin
+
+A Golang plugin can be treated as a normal Golang package but:
+
+- the package name is always `"main"` and this package cannot be imported
+- this package loads at run-time by Tyk and loads after all other Golang packages
+- this package has to have an empty `func main() {}`.
+
+A Go plugin can have a declared `func init()` and it gets called only once (when Tyk loads this plugin for the first time for an API).
+
+It is possible to create structures or open connections to 3d party services/storage and then share them within every call and export the function in your Golang plugin.
+
+For example, here is an example of a Tyk Golang plugin with a simple hit counter:
+
+```go  {linenos=true, linenostart=1}
+package main
+
+import (
+  "encoding/json"
+  "net/http"
+  "sync"
+
+  "github.com/TykTechnologies/tyk/ctx"
+  "github.com/TykTechnologies/tyk/log"
+  "github.com/TykTechnologies/tyk/user"
+)
+
+var logger = log.Get()
+
+// plugin exported functionality
+func MyProcessRequest(rw http.ResponseWriter, r *http.Request) {
+  endPoint := r.Method + " " + r.URL.Path
+  logger.Info("Custom middleware, new hit:", endPoint)
+
+  hitCounter := recordHit(endPoint)
+  logger.Debug("New hit counter value:", hitCounter)
+
+  if hitCounter > 100 {
+    logger.Warning("Hit counter to high")
+  }
+
+  reply := myReply{
+    Session:    ctx.GetSession(r),
+    Endpoint:   endPoint,
+    HitCounter: hitCounter,
+  }
+
+  jsonData, err := json.Marshal(reply)
+  if err != nil {
+    logger.Error(err.Error())
+    rw.WriteHeader(http.StatusInternalServerError)
+    return
+  }
+
+  rw.Header().Set("Content-Type", "application/json")
+  rw.WriteHeader(http.StatusOK)
+  rw.Write(jsonData)
+}
+
+// called once plugin is loaded, this is where we put all initialisation work for plugin
+// i.e. setting exported functions, setting up connection pool to storage and etc.
+func init() {
+  hitCounter = make(map[string]uint64)
+}
+
+// plugin internal state and implementation
+var (
+  hitCounter   map[string]uint64
+  hitCounterMu sync.Mutex
+)
+
+func recordHit(endpoint string) uint64 {
+  hitCounterMu.Lock()
+  defer hitCounterMu.Unlock()
+  hitCounter[endpoint]++
+  return hitCounter[endpoint]
+}
+
+type myReply struct {
+  Session    *user.SessionState `json:"session"`
+  Endpoint   string             `json:"endpoint"`
+  HitCounter uint64             `json:"hit_counter"`
+}
+
+func main() {}
+```
+
+Here we see how the internal state of the Golang plugin is used by the exported function `MyProcessRequest` (the one we set in the API spec in the `"custom_middleware"` section). The map `hitCounter` is used to send internal state and count hits to different endpoints. Then our exported Golang plugin function sends an HTTP reply with endpoint hit statistics.
+
+### Accessing the API definition
+
+When Tyk passes a request to your plugin, the API definition is made available as part of the request context.
+
+
+<Note>
+The API definition is accessed differently for Tyk OAS APIs and Tyk Classic APIs, as indicated in the following sections. If you use the wrong call for your API type, it will return `nil`.
+</Note>
+
+
+#### Working with Tyk OAS APIs
+
+The API definition can be accessed as follows:
+
+```go
+package main
+
+import (
+  "fmt"
+  "net/http"
+
+  "github.com/TykTechnologies/tyk/ctx"
+)
+
+func MyPluginFunction(w http.ResponseWriter, r *http.Request) {
+  oas := ctx.GetOASDefinition(r)
+  fmt.Println("OAS doc title is", oas.Info.Title)
+}
+
+func main() {}
+```
+
+The invocation of `ctx.GetOASDefinition(r)` returns an `OAS` object containing the Tyk OAS API definition.
+The Go data structure can be found [here](https://github.com/TykTechnologies/tyk/blob/master/apidef/oas/oas.go#L28).
+
+#### Working with Tyk Classic APIs
+
+The API definition can be accessed as follows:
+
+```go
+package main
+
+import (
+  "fmt"
+  "net/http"
+
+  "github.com/TykTechnologies/tyk/ctx"
+)
+
+func MyPluginFunction(w http.ResponseWriter, r *http.Request) {
+  apidef := ctx.GetDefinition(r)
+  fmt.Println("API name is", apidef.Name)
+}
+
+func main() {}
+```
+
+The invocation of `ctx.GetDefinition(r)` returns an APIDefinition object containing the Tyk Classic API Definition.
+The Go data structure can be found [here](https://github.com/TykTechnologies/tyk/blob/master/apidef/api_definitions.go#L583).
+
+### Accessing the session object
+
+When Tyk passes a request to your plugin, the key session object is made available as part of the request context. This can be accessed as follows:
+
+```go
+package main
+import (
+  "fmt"
+  "net/http"
+  "github.com/TykTechnologies/tyk/ctx"
+)
+func main() {}
+func MyPluginFunction(w http.ResponseWriter, r *http.Request) {
+  session := ctx.GetSession(r)
+  fmt.Println("Developer ID:", session.MetaData["tyk_developer_id"]
+  fmt.Println("Developer Email:", session.MetaData["tyk_developer_email"]
+}
+```
+
+
+<Note>
+Tyk Gateway sets the session in the [Authentication layer](/api-management/traffic-transformation#request-middleware-chain) of the middleware chain. Because of this, the session object does not exist until the middleware chain runs after the authentication middleware. If you call `ctx.GetSession` inside a custom auth plugin, it will always return an empty object.
+</Note>
+
+
+The invocation of `ctx.GetSession(r)` returns an SessionState object.
+The Go data structure can be found [here](https://github.com/TykTechnologies/tyk/blob/master/user/session.go#L106).
+
+Here is an [example](https://github.com/TykTechnologies/custom-plugin-examples/blob/master/plugins/go-auth-multiple_hook_example/main.go#L135) custom Go plugin that makes use of the session object.
+
+### Terminating the request
+
+You can terminate the request within your custom Go plugin and provide an HTTP response to the originating client, such that the plugin behaves similarly to a [virtual endpoint](/api-management/traffic-transformation/virtual-endpoints).
+
+- the HTTP request processing is stopped and other middleware in the chain won't be used
+- the HTTP request round-trip to the upstream target won't happen
+- analytics records will still be created and sent to the analytics processing flow
+
+This [example](/api-management/plugins/golang#using-a-custom-go-plugin-as-a-virtual-endpoint) demonstrates a custom Go plugin configured as a virtual endpoint.
+
+### Logging from a custom plugin
+
+Your plugin can write log entries to Tyk's logging system.
+
+To do so you just need to import the package `"github.com/TykTechnologies/tyk/log"` and use the exported public method `Get()`:
+
+```go  {linenos=true, linenostart=1}
+package main
+
+import (
+  "net/http"
+
+  "github.com/TykTechnologies/tyk/log"
+)
+
+var logger = log.Get()
+
+// AddFooBarHeader adds custom "Foo: Bar" header to the request
+func AddFooBarHeader(rw http.ResponseWriter, r *http.Request) {
+  logger.Info("Processing HTTP request in Golang plugin!!")
+  r.Header.Add("Foo", "Bar")
+}
+
+func main() {}
+```
+
+#### Monitoring instrumentation for custom plugins
+
+All custom middleware implemented as Golang plugins support Tyk's current built in instrumentation.
+
+The format for an event name with metadata is: `"GoPluginMiddleware:" + Path + ":" + SymbolName`,  e.g., for our example, the event name will be:
+
+```text
+"GoPluginMiddleware:/tmp/AddFooBarHeader.so:AddFooBarHeader"
+```
+
+The format for a metric with execution time (in nanoseconds) will have the same format but with the `.exec_time` suffix:
+
+```text
+"GoPluginMiddleware:/tmp/AddFooBarHeader.so:AddFooBarHeader.exec_time"
+```
+
+### Creating a custom response plugin
+
+As explained [here](/api-management/plugins/plugin-types#response-plugins), you can register a custom Go plugin to be triggered in the response middleware chain. You must configure the `driver` field to `goplugin` in the API definition when registering the plugin.
+
+#### Response plugin method signature
+
+To write a response plugin in Go you need it to have a method signature as in the example below i.e. `func(http.ResponseWriter, *http.Response, *http.Request)`.
+You can then access and modify any part of the request or response. User session and API definition data can be accessed as with other Go plugin hook types.
+
+```go
+package main
+
+import (
+  "bytes"
+  "encoding/json"
+  "io/ioutil"
+  "net/http"
+
+)
+
+// MyPluginResponse intercepts response from upstream
+func MyPluginResponse(rw http.ResponseWriter, res *http.Response, req *http.Request) {
+        // add a header to our response object
+  res.Header.Add("X-Response-Added", "resp-added")
+
+        // overwrite our response body
+  var buf bytes.Buffer
+  buf.Write([]byte(`{"message":"Hi! I'm a response plugin"}`))
+  res.Body = ioutil.NopCloser(&buf)
+
+}
+
+func main() {}
+```
+
+## Plugin compiler
+
+Tyk provides a Plugin Compiler tool that will create a file that can be [loaded into Tyk](/api-management/plugins/golang#loading-custom-go-plugins-into-tyk) to implement your desired custom logic.
+
+
+<Note>
+The plugin compiler is not supported on Ubuntu 16.04 (Xenial Xerus) as it uses glibc 2.23 which is incompatible with our standard build environment. If you absolutely must have Go plugin support on Xenial, please contact Tyk support.
+
+<ButtonLeft href="https://tyk.io/contact/" color="green" content="Contact us" />
+</Note>
+
+
+### Compiler options
+
+Most of the following arguments are applied only to developer flows. These aid development and testing purposes, and support of these varies across releases, due to changes in the Go ecosystem.
+
+The latest plugin compiler implements the following options:
+
+- `plugin_name`: output root file name (for example `plugin.so`)
+- `build_id`: [optional] provides build uniqueness
+- `GOOS`: [optional] override of GOOS (add `-e GOOS=linux`)
+- `GOARCH`: [optional] override of GOARCH (add `-e GOARCH=amd64`)
+
+By default, if `build_id` is not provided, the gateway will not allow the plugin to be loaded twice. This is a restriction of the Go plugins standard library implementation. As long as the builds are made with a unique `build_id`, the same plugin can be loaded multiple times.
+
+When you provide a unique `build_id` argument, that also enables hot-reload compatibility of your `.so` plugin build, so that you would not need to restart the gateway, only reload it.
+
+- before 5.1: the plugin would be built in a filesystem path based on `build_id`
+- since 5.2.4: the plugin compiler adjusts the Go module in use for the plugin.
+
+As the plugins are built with `-trimpath`, to omit local filesystem path details and improve plugin compatibility, the plugin compiler relies on the Go module itself to ensure each plugin build is unique. It modifies the plugin build `go.mod` file and imports to ensure a unique build.
+
+- [plugin package: Warnings](https://pkg.go.dev/plugin#hdr-Warnings)
+- [golang#29525 - plugin: cannot open the same plugin with different names](https://github.com/golang/go/issues/29525)
+
+### Output filename
+
+Since v4.1.0 the plugin compiler has automatically added the following suffixes to the root filename provided in the `plugin_name` argument:
+
+- `{Gw-version}`: the Tyk Gateway version, for example, `v5.3.0`
+- `{OS}`: the target operating system, for example `linux`
+- `{arch}`: the target CPU architecture, for example, `arm64`
+
+Thus, if `plugin_name` is set to `plugin.so` then given these example values the output file will be: `plugin_v5.3.0_linux_arm64.so`.
+
+This enables you to have one directory with multiple versions of the same plugin targeting different Gateway versions.
+
+#### Cross-compiling for different architectures and operating systems
+
+The Tyk Go Plugin Compiler can generate output for different architectures and operating systems from the one in which the compiler is run (cross-compiling). When you do this, the output filename will be suffixed with the target OS and architecture.
+
+You simply provide the target `GOOS` and `GOARCH` arguments to the plugin compiler, for example:
+
+```yaml
+docker run --rm -v `pwd`:/plugin-source \
+           --platform=linux/amd64 \
+           tykio/tyk-plugin-compiler:v5.2.1 plugin.so $build_id linux arm64
+```
+
+This command will cross-compile your plugin for a `linux/arm64` architecture. It will produce an output file named `plugin_v5.2.1_linux_arm64.so`.
+
+
+<Note>
+If you are using the plugin compiler on MacOS, the docker run argument `--platform=linux/amd64` is necessary. The plugin compiler is a cross-build environment implemented with `linux/amd64`.
+</Note>
+
+
+### Experimental options
+
+The plugin compiler also supports a set of environment variables being passed:
+
+- `DEBUG=1`: enables debug output from the plugin compiler process.
+- `GO_TIDY=1`: runs go mod tidy to resolve possible dependency issues.
+- `GO_GET=1`: invokes go get to retrieve the exact Tyk gateway dependency.
+
+These environment options are only available in the latest gateway and plugin compiler versions.
+They are unsupported and are provided to aid development and testing workflows.
+
+## Loading Custom Go Plugins into Tyk
+
+For development purposes, we are going to load the plugin from local file storage. For production, you can use [bundles](#loading-a-tyk-golang-plugin-from-a-bundle) to deploy plugins to multiple gateways.
+
+In this example we are using a Tyk Classic API. In the API definition find the `custom_middleware` section and make it look similar to the snippet below. Tyk Dashboard users should use RAW API Editor to access this section.
+
+```json
+"custom_middleware": {
+  "pre": [],
+  "post_key_auth": [],
+  "auth_check": {},
+  "post": [
+    {
+      "name": "AddFooBarHeader",
+      "path": "<path>/plugin.so"
+    }
+  ],
+  "driver": "goplugin"
+}
+```
+
+Here we have:
+
+- `driver` - Set this to `goplugin` (no value created for this plugin) which says to Tyk that this custom middleware is a Golang native plugin.
+- `post` - This is the hook name. We use middleware with hook type `post` because we want this custom middleware to process the request right before it is passed to the upstream target (we will look at other types later).
+- `post.name` - is your function name from the Go plugin project.
+- `post.path` - is the full or relative (to the Tyk binary) path to the built plugin file (`.so`). Make sure Tyk has read access to this file.
+
+Also, let's set fields `"use_keyless": true` and `"target_url": "http://httpbin.org/"` - for testing purposes. We will test what request arrives to our upstream target and `httpbin.org` is a perfect fit for that.
+
+The API needs to be reloaded after that change (this happens automatically when you save the updated API in the Dashboard).
+
+Now your API with its Golang plugin is ready to process traffic:
+
+```bash
+# curl http://localhost:8181/my_api_name/get   
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Accept-Encoding": "gzip",
+    "Foo": "Bar",
+    "Host": "httpbin.org",
+    "User-Agent": "curl/7.54.0"
+  },
+  "url": "https://httpbin.org/get"
+}
+```
+
+We see that the upstream target has received the header `"Foo": "Bar"` which was added by our custom middleware implemented as a native Golang plugin in Tyk.
+
+### Updating the plugin
+
+Loading an updated version of your plugin requires one of the following actions:
+
+- An API reload with a NEW path or file name of your `.so` file with the plugin. You will need to update the API spec section `"custom_middleware"`, specifying a new value for the `"path"` field of the plugin you need to reload.
+- Tyk main process reload. This will force a reload of all Golang plugins for all APIs.
+
+If a plugin is loaded as a bundle and you need to update it you will need to update your API spec with a new `.zip` file name in the `"custom_middleware_bundle"` field. Make sure the new `.zip` file is uploaded and available via the bundle HTTP endpoint before you update your API spec.
+
+### Loading a Tyk Golang plugin from a bundle
+
+Currently we have loaded Golang plugins only directly from the file system. However, when you have multiple gateway instances, you need a more dynamic way to load plugins. Tyk offer bundle instrumentation [Plugin Bundles](/api-management/plugins/overview#plugin-bundles). Using the bundle command creates an archive with your plugin, which you can deploy to the HTTP server (or AWS S3) and then your plugins will be fetched and loaded from that HTTP endpoint.
+
+You will need to set in `tyk.conf` these two fields:
+
+- `"enable_bundle_downloader": true` - enables the plugin bundles downloader
+- `"bundle_base_url": "http://mybundles:8000/abc"` - specifies the base URL with the HTTP server where you place your bundles with Golang plugins (this endpoint must be reachable by the gateway)
+
+Also, you will need to specify the following field in your API spec:
+
+`"custom_middleware_bundle"` - here you place your filename with the bundle (`.zip` archive) to be fetched from the HTTP endpoint you specified in your `tyk.conf` parameter `"bundle_base_url"`
+
+To load a plugin, your API spec should set this field like so:
+
+```json
+"custom_middleware_bundle": "FooBarBundle.zip"
+```
+
+Let's look at `FooBarBundle.zip` contents. It is just a ZIP archive with two files archived inside:
+
+- `AddFooBarHeader.so` - this is our Golang plugin
+- `manifest.json` - this is a special file with meta information used by Tyk's bundle loader
+
+The contents of `manifest.json`:
+
+```yaml
+{
+  "file_list": [
+    "AddFooBarHeader.so"
+  ],
+  "custom_middleware": {
+    "post": [
+      {
+        "name": "AddFooBarHeader",
+        "path": "AddFooBarHeader.so"
+      }
+    ],
+    "driver": "goplugin"
+  },
+
+  ...
+}
+```
+
+Here we see:
+
+- field `"custom_middleware"` with exactly the same structure we used to specify `"custom_middleware"` in API spec without bundle
+- field `"path"` in section `"post"` now contains just a file name without any path. This field specifies `.so` filename placed in a ZIP archive with the bundle (remember how we specified `"custom_middleware_bundle": "FooBarBundle.zip"`).
+
+## Using custom Go plugins with Tyk Cloud
+
+The following supporting resources are provided for developing plugins on Tyk Cloud:
+
+- [Enabling Plugins On The Control Plane](/tyk-cloud/using-plugins)
+- [Uploading Your Plugin Bundle To S3 Bucket](/tyk-cloud/using-plugins#uploading-your-bundle)
+
+## Example custom Go plugins
+
+This document provides a working example for providing specific functionality with a custom Go plugin.
+
+For more resources for writing plugins, please visit our [Plugin Hub](/api-management/plugins/overview#plugins-hub).
+
+### Using a custom Go plugin as a virtual endpoint
+
+It is possible to send a response from the Golang plugin custom middleware. In the case that the HTTP response was sent:
+
+- The HTTP request processing is stopped and other middleware in the chain won't be used.
+- The HTTP request round-trip to the upstream target won't happen
+- Analytics records will still be created and sent to the analytics processing flow.
+
+Let's look at an example of how to send an HTTP response from the Tyk Golang plugin. Imagine that we need middleware which would send JSON with the current time if the request contains the parameter `get_time=1` in the request query string:
+
+```go
+package main
+
+import (
+  "encoding/json"
+  "net/http"
+  "time"
+)
+
+func SendCurrentTime(rw http.ResponseWriter, r *http.Request) {
+  // check if we don't need to send reply
+  if r.URL.Query().Get("get_time") != "1" {
+    // allow request to be processed and sent to upstream
+        return
+  }
+
+  //Prepare data to send
+  replyData := map[string]interface{}{
+    "current_time": time.Now(),
+  }
+
+  jsonData, err := json.Marshal(replyData)
+  if err != nil {
+    rw.WriteHeader(http.StatusInternalServerError)
+    return
+  }
+
+  //Send HTTP response from the Golang plugin
+  rw.Header().Set("Content-Type", "application/json")
+  rw.WriteHeader(http.StatusOK)
+  rw.Write(jsonData)
+}
+
+func main() {}
+```
+
+Let's build the plugin by running this command in the plugin project folder:
+
+```bash
+go build -trimpath -buildmode=plugin -o /tmp/SendCurrentTime.so
+```
+
+Then let's edit the API spec to use this custom middleware:
+
+```json
+"custom_middleware": {
+  "pre": [
+    {
+       "name": "SendCurrentTime",
+       "path": "/tmp/SendCurrentTime.so"
+    }
+  ],
+  "post_key_auth": [],
+  "auth_check": {},
+  "post": [],
+  "driver": "goplugin"
+}
+```
+
+Let's check that we still perform a round trip to the upstream target if the request query string parameter `get_time` is not set:
+
+```bash
+# curl http://localhost:8181/my_api_name/get
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Accept-Encoding": "gzip",
+    "Host": "httpbin.org",
+    "User-Agent": "curl/7.54.0"
+  },
+  "url": "https://httpbin.org/get"
+}
+```
+
+Now let's check if our Golang plugin sends an HTTP 200 response (with JSON containing current time) when we set `get_time=1` query string parameter:
+
+```bash
+# curl http://localhost:8181/my_api_name/get?get_time=1
+{"current_time":"2019-09-11T23:44:10.040878-04:00"}
+```
+
+Here we see that:
+
+- We've got an HTTP 200 response code.
+- The response body has a JSON payload with the current time.
+- The upstream target was not reached. Our Tyk Golang plugin served this request and stopped processing after the response was sent.
+
+### Performing custom authentication with a Golang plugin
+
+You can implement your own authentication method, using a Golang plugin and custom `"auth_check"` middleware. Ensure you set the two fields in Post Authentication Hook.
+
+Let's have a look at the code example. Imagine we need to implement a very trivial authentication method when only one key is supported (in the real world you would want to store your keys in some storage or have some more complex logic).
+
+```go
+package main
+
+import (
+  "net/http"
+
+  "github.com/TykTechnologies/tyk/ctx"
+  "github.com/TykTechnologies/tyk/headers"
+  "github.com/TykTechnologies/tyk/user"
+)
+
+func getSessionByKey(key string) *user.SessionState {
+  //Here goes our logic to check if the provided API key is valid and appropriate key session can be retrieved
+
+  // perform auth (only one token "abc" is allowed)
+  if key != "abc" {
+    return nil
+  }
+
+  // return session
+  return &user.SessionState{
+    OrgID: "default",
+    Alias: "abc-session",
+  }
+}
+
+func MyPluginAuthCheck(rw http.ResponseWriter, r *http.Request) {
+  //Try to get a session by API key
+  key := r.Header.Get(headers.Authorization)
+  session := getSessionByKey(key)
+  if session == nil {
+    // auth failed, reply with 403
+    rw.WriteHeader(http.StatusForbidden)
+    return
+  }
+  
+  // auth was successful, add the session to the request's context so other middleware can use it
+  ctx.SetSession(r, session, true)
+  
+  // if compiling on a version older than 4.0.1, use this instead
+  // ctx.SetSession(r, session, key, true) 
+}
+
+func main() {}
+```
+
+A couple of notes about this code:
+
+- the package `"github.com/TykTechnologies/tyk/ctx"` is used to set a session in the request context - this is something `"auth_check"`-type custom middleware is responsible for.
+- the package `"github.com/TykTechnologies/tyk/user"` is used to operate with Tyk's key session structure.
+- our Golang plugin sends a 403 HTTP response if authentication fails.
+- our Golang plugin just adds a session to the request context and returns if authentication was successful.
+
+Let's build the plugin by running the following command in the folder containing your plugin project:
+
+```bash
+go build -trimpath -buildmode=plugin -o /tmp/MyPluginAuthCheck.so
+```
+
+Now let's check if our custom authentication works as expected (only one key `"abc"` should work).
+
+Authentication will fail with the wrong API key:
+
+```bash
+# curl -v -H "Authorization: xyz" http://localhost:8181/my_api_name/get
+*   Trying ::1...
+* TCP_NODELAY set
+* Connected to localhost (::1) port 8181 (#0)
+> GET /my_api_name/get HTTP/1.1
+> Host: localhost:8181
+> User-Agent: curl/7.54.0
+> Accept: */*
+> Authorization: xyz
+>
+< HTTP/1.1 403 Forbidden
+< Date: Wed, 11 Sep 2019 04:31:34 GMT
+< Content-Length: 0
+<
+* Connection #0 to host localhost left intact
+```
+
+Here we see that our custom middleware replied with a 403 response and request processing was stopped at this point.
+
+Authentication successful with the right API key:
+
+```bash
+# curl -v -H "Authorization: abc" http://localhost:8181/my_api_name/get
+*   Trying ::1...
+* TCP_NODELAY set
+* Connected to localhost (::1) port 8181 (#0)
+> GET /my_api_name/get HTTP/1.1
+> Host: localhost:8181
+> User-Agent: curl/7.54.0
+> Accept: */*
+> Authorization: abc
+>
+< HTTP/1.1 200 OK
+< Content-Type: application/json
+< Date: Wed, 11 Sep 2019 04:31:39 GMT
+< Content-Length: 257
+<
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Accept-Encoding": "gzip",
+    "Authorization": "abc",
+    "Host": "httpbin.org",
+    "User-Agent": "curl/7.54.0"
+  },
+  "url": "https://httpbin.org/get"
+}
+* Connection #0 to host localhost left intact
+```
+
+Here we see that our custom middleware successfully authenticated the request and we received a reply from the upstream target.
+
+## Upgrading your Tyk Gateway
+
+When upgrading your Tyk Gateway deployment, you need to re-compile your plugin with the new version. At the moment of loading a plugin, the Gateway will try to find a plugin with the name provided in the API definition. If none is found then it will fall back to search the plugin file with the name: `{plugin-name}_{Gw-version}_{OS}_{arch}.so`.
+
+Since Tyk v4.1.0, the compiler [automatically](/api-management/plugins/golang#output-filename) creates plugin files following this convention so when you upgrade, say from Tyk v5.2.5 to v5.3.0 you only need to have the plugins compiled for v5.3.0 before performing the upgrade.
+
+This diagram shows how every Tyk Gateway will search and load the plugin binary that it is compatible with.
+<img src="/img/plugins/go-plugin-different-tyk-versions.png" alt="APIs Menu" />
diff --git a/api-management/plugins/javascript.mdx b/api-management/plugins/javascript.mdx
new file mode 100644
index 0000000000..4e85877dc1
--- /dev/null
+++ b/api-management/plugins/javascript.mdx
@@ -0,0 +1,743 @@
+---
+title: "Javascript Plugins"
+description: "Learn how to script custom middleware, dynamic event handlers, and virtual endpoints in Tyk using JavaScript"
+sidebarTitle: "JavaScript Plugins"
+---
+
+## Introduction
+
+There are three middleware components that can be scripted with Tyk:
+
+1. **Custom JavaScript plugins**: These execute either *pre* or *post* validation. A *pre* middleware component will execute before any session validation or token validation has taken place, while a *post* middleware component will execute after the request has been passed through all checks and is ready to be proxied upstream.
+
+2. **Dynamic event handlers**: These components fire on certain API events (see the event handlers section), these are fired Async and do not have a cooldown timer. These are documented [here](/api-management/gateway-events#set-up-a-webhook-event-handler-in-the-tyk-oas-api-definition).
+
+3. **Virtual endpoints**: These are powerful programmable middleware invoked towards the end of the request processing chain. Unlike the custom JavaScript plugins, the virtual endpoint terminates the request. These are documented [here](/api-management/traffic-transformation/virtual-endpoints).
+
+The JavaScript (JS) [scripting guide](/api-management/plugins/javascript#using-javascript-with-tyk) provides details of how to access dynamic data (such as the key session object) from your JS functions. Combining these resources provides you with a powerful set of tools for shaping and structuring inbound traffic to your API.
+
+### Declared plugin functions
+
+JavaScript functions are available globally in the same namespace. So, if you include two or more JSVM plugins that call the same function, the last declared plugin implementation of the function will be returned.
+
+### Enabling the JavaScript Virtual Machine (JSVM)
+
+The JavaScript Virtual Machine (JSVM) provided in the Gateway is a traditional ECMAScript5 compatible environment.
+
+Before you can use JavaScript customization in any component you will need to enable the JSVM.
+
+You do this by setting `enable_jsvm` to `true` in your `tyk.conf` [file](/tyk-oss-gateway/configuration#enable_jsvm).
+
+### Installing JavaScript middleware
+
+Installing middleware is different for different Tyk deployments, for example, in Tyk OSS it is possible to directly specify a path to a file in the API Definition, while in Tyk Self-Managed, we recommend using a directory-based loader.
+
+We've provided the following guides:
+
+- [Tyk OSS](/api-management/plugins/javascript#installing-middleware-on-tyk-oss)
+- [Tyk Self-Managed](/api-management/plugins/javascript#installing-middleware-on-tyk-self-managed)
+- [Tyk Hybrid](/api-management/plugins/javascript#installing-middleware-on-tyk-hybrid)
+
+
+
+
+## Using JavaScript with Tyk
+
+Tyk's JavaScript Virtual Machine (JSVM) provides a serverless compute function that allows for the execution of custom logic directly within the gateway itself. This can be accessed from [multiple locations](/api-management/plugins/javascript#) in the API processing chain and allows significant customization and optimization of your request handling.
+
+In this guide we will cover the features and resources available to you when creating custom functions, highlighting where there are limitations for the different middleware stages.
+
+### Scripting basics
+
+Here we cover various facets that you need to be aware of when creating custom functions for Tyk.
+
+#### Accessing external and dynamic data
+
+JS functions can be given access to external data objects relating to the API request. These allow for the modification of both the request itself and the session:
+
+- `request`: an [object](/api-management/plugins/javascript#the-request-object) describing the API request that invoked the middleware
+- `session`: the key session [object](/api-management/plugins/javascript#the-session-object) provided by the client when making the API request
+- `config`: an [object](/api-management/plugins/javascript#the-config-object) containing fields from the API definition
+
+
+
+    <Note>
+    There are other ways of accessing and editing a session object using the [Tyk JavaScript API functions](/api-management/plugins/javascript#working-with-the-key-session-object).
+    </Note>
+
+
+#### Creating a middleware component
+
+Tyk injects a `TykJS` namespace into the JSVM, which can be used to initialise a new middleware component. The JS for each middleware component should be in its own `*.js` file.
+
+You create a middleware object by calling the `TykJS.TykMiddleware.NewMiddleware({})` constructor with an empty object and then initialising it with your function using the `NewProcessRequest()` closure syntax. This is where you expose the [external data objects](/api-management/plugins/javascript#accessing-external-and-dynamic-data) to your custom function.
+
+
+<Note>
+- For Custom JS plugins and Dynamic Event Handlers, the source code filename must match the function name
+- Virtual Endpoints do not have this limitation
+</Note>
+
+
+#### Returning from the middleware
+
+When returning from the middleware, you provide specific return data depending upon the type of middleware.
+
+##### Returning from Custom JS plugin
+
+A custom JS plugin can modify fields in the API request and the session metadata, however this is not performed directly within the JSVM so the required updates must be passed out of the JSVM for Tyk to apply the changes. This is a requirement and omitting them can cause the middleware to fail.
+
+The JS function must provide the `request` and `session.meta_data` objects in the `ReturnData` as follows:
+
+```js
+return sampleMiddleware.ReturnData(request, session.meta_data);
+```
+
+Custom JS plugins sit in the [middleware processing chain](/api-management/traffic-transformation#request-middleware-chain) and pass the request onto the next middleware before it is proxied to the upstream. If required, however, a custom JS plugin can terminate the request and provide a custom response to the client if you configure the `ReturnOverrides` in the `request` object, as described [here](/api-management/plugins/javascript#using-returnoverrides).
+
+##### Returning from Virtual Endpoint
+
+Unlike custom JS plugins, Virtual Endpoints always [terminate the request](/api-management/traffic-transformation/virtual-endpoints#working) so have a different method of returning from the JS function.
+
+The function must return a `responseObject`. This is crucial as it determines the HTTP response that will be sent back to the client. The structure of this object is defined to ensure that the virtual endpoint can communicate the necessary response details back to the Tyk Gateway, which then forwards it to the client.
+
+The `responseObject` has the following structure:
+
+- `code`: an integer representing the HTTP status code of the response
+- `headers`: an object containing key-value pairs representing the HTTP headers of the response
+- `body`: a string that represents the body of the response which can be plain text, JSON, or XML, depending on what your API client expects to receive
+
+You must provide the `responseObject` together with the `session.meta_data` as parameters in a call to `TykJsResponse` as follows:
+
+```js
+return TykJsResponse(responseObject, session.meta_data);
+```
+
+You can find some examples of how this works [here](/api-management/traffic-transformation/virtual-endpoints#examples).
+
+### JavaScript resources
+
+JavaScript (JS) functions have access to a [system API](/api-management/plugins/javascript#javascript-api) and [library of functions](/api-management/plugins/javascript#underscore-js-library). They can also be given access to certain Tyk data objects relating to the API request.
+
+The system API provides access to resources outside of the JavaScript Virtual Machine sandbox, the ability to make outbound HTTP requests and access to the key management REST API functions.
+
+#### The `request` object
+
+The `request` object provides a set of arrays that describe the API request. These can be manipulated and, when changed, will affect the request as it passes through the middleware pipeline. For [virtual endpoints](/api-management/traffic-transformation/virtual-endpoints) the request object has a [different structure](#VirtualEndpoint-Request).
+
+The structure of the `request` object is:
+
+```typesecript
+class ReturnOverrides {
+  ResponseCode: number = 200;
+  ResponseBody: string = "";
+  ResponseHeaders: string[] = [];
+}
+
+class Request {
+  Headers: { [key: string]: string[] } = {};
+  SetHeaders: { [key: string]: string } = {};
+  DeleteHeaders: string[] = [];
+  Body: string = "";
+  URL: string = "";
+  AddParams: { [key: string]: string } = {};
+  DeleteParams: string[] = [];
+  ReturnOverrides: ReturnOverrides = new ReturnOverrides();
+  IgnoreBody: boolean = false;
+  Method: string = "";
+  RequestURI: string = "";
+  Scheme: string = "";
+}
+```
+
+{/* ```go
+struct {
+  Headers       map[string][]string
+  SetHeaders    map[string]string
+  DeleteHeaders []string
+  Body          string
+  URL           string
+  AddParams     map[string]string
+  DeleteParams  []string
+  ReturnOverrides {
+    ResponseCode: int
+    ResponseBody: string
+    ResponseHeaders []string
+  }
+  IgnoreBody    bool
+  Method        string
+  RequestURI    string
+  Scheme        string
+}
+``` */}
+
+- `Headers`: this is an object of string arrays, and represents the current state of the request header; this object cannot be modified directly, but can be used to read header data
+- `SetHeaders`: this is a key-value map that will be set in the header when the middleware returns the object; existing headers will be overwritten and new headers will be added
+- `DeleteHeaders`: any header name that is in this list will be deleted from the outgoing request; note that `DeleteHeaders` happens before `SetHeaders`
+- `Body`: this represents the body of the request, if you modify this field it will overwrite the request
+- `URL`: this represents the path portion of the outbound URL, you can modify this to redirect a URL to a different upstream path
+- `AddParams`: you can add parameters to your request here, for example internal data headers that are only relevant to your network setup
+- `DeleteParams`: these parameters will be removed from the request as they pass through the middleware; note `DeleteParams` happens before `AddParams`
+- `ReturnOverrides`: values stored here are used to stop or halt middleware execution and return an error code
+- `IgnoreBody`: if this parameter is set to `true`, the original request body will be used; if set to `false` the `Body` field will be used (`false` is the default behavior)
+- `Method`: contains the HTTP method (`GET`, `POST`, etc.)
+- `RequestURI`: contains the request URI, including the query string, e.g. `/path?key=value`
+- `Scheme`: contains the URL scheme, e.g. `http`, `https`
+
+
+##### Using `ReturnOverrides`
+
+If you configure values in `request.ReturnOverrides` then Tyk will terminate the request and provide a response to the client when the function completes. The request will not be proxied to the upstream.
+
+The response will use the parameters configured in `ReturnOverrides`:
+
+- `ResponseCode`
+- `ResponseBody`
+- `ResponseHeaders`
+
+In this example, if the condition is met, Tyk will return `HTTP 403 Access Denied` with the custom header `"X-Error":"the-condition"`:
+
+```js
+var testJSVMData = new TykJS.TykMiddleware.NewMiddleware({});
+
+testJSVMData.NewProcessRequest(function(request, session, config) {
+  // Logic to determine if the request should be overridden
+  if (someCondition) {
+      request.ReturnOverrides.ResponseCode = 403;
+      request.ReturnOverrides.ResponseBody = "Access Denied";
+      request.ReturnOverrides.headers = {"X-Error": "the-condition"};
+      // This stops the request from proceeding to the upstream
+  }
+    return testJSVMData.ReturnData(request, session.meta_data);
+});
+```
+
+##### The virtual endpoint `request` object
+<a id="VirtualEndpoint-Request"></a>
+
+For [virtual endpoint](/api-management/traffic-transformation/virtual-endpoints) functions the structure of a Javascript `request` object is:
+
+```typescript
+class VirtualEndpointRequest {
+  Body: string = "";
+  Headers: { [key: string]: string[] } = {};
+  Params: { [key: string]: string[] } = {};
+  Scheme: string = "";
+  URL: string = "";
+}
+```
+
+- `Body`: HTTP request body, e.g. `""`
+- `Headers`: HTTP request headers, e.g. `"Accept": ["*/*"]`
+- `Params`: Decoded query and form parameters, e.g. `{ "confirm": ["true"], "userId": ["123"] }`
+- `Scheme`: The scheme of the URL ( e.g. `http` or `https`)
+- `URL`: The full URL of the request, e.g `/vendpoint/anything?user_id=123\u0026confirm=true`
+
+<br />
+
+
+<Note>
+Each query and form parameter within the request is stored as an array field in the `Params` field of the request object.
+
+Repeated parameter assignments are appended to the corresponding array. For example, a request against `/vendpoint/anything?user_id[]=123&user_id[]=234` would result in a Javascript request object similar to that shown below:
+
+```javascript
+const httpRequest = {
+  Headers: {
+    "Accept": ["*/*"],
+    "User-Agent": ["curl/8.1.2"]
+  },
+  Body: "",
+  URL: "/vendpoint/anything?user_id[]=123\u0026user_id[]=234",
+  Params: {
+    "user_id[]": ["123", "234"]
+  },
+  Scheme: "http"
+};
+```
+</Note>
+
+
+#### The `session` object
+
+Tyk uses an internal [session object](/api-management/access-control/sessions-and-keys/understanding-sessions) to handle the quota, rate limits, access allowances and auth data of a specific key. JS middleware can be granted access to the session object but there is also the option to disable it as deserialising it into the JSVM is computationally expensive and can add latency. Other than the `meta_data` field, the session object itself cannot be directly edited as it is crucial to the correct functioning of Tyk.
+
+##### Limitations
+
+- Custom JS plugins at the [pre-](/api-management/plugins/plugin-types#request-plugins) stage do not have access to the session object (as it has not been created yet)
+- When scripting for Virtual Endpoints, the `session` data will only be available to the JS function if enabled in the middleware configuration. To enable this, set `requireSession` to `true` in the `virtualEndpoint` object of your Tyk OAS API definition (or `use_session` to `true` in the `virtual` object for Tyk Classic APIs).
+
+###### Tyk OAS API Definition example:
+```
+"virtualEndpoint": {
+  "enabled": true,
+  "functionName": "myVirtualEndpoint",
+  "path": "my_script.js",
+  "requireSession": true
+}
+```
+###### Tyk Classic API Definition example:
+```
+"extended_paths": {
+  "virtual": [
+    {
+      "path": "/my-endpoint",
+      "method": "GET",
+      "response_function_name": "myVirtualEndpoint",
+      "function_source_type": "file",
+      "function_source_uri": "my_script.js",
+      "use_session": true
+    }
+  ]
+}
+```
+
+
+##### Sharing data between middleware using the `session` object
+
+For different middleware to be able to transfer data between each other, the session object makes available a `meta_data` key/value field that is written back to the session store (and can be retrieved by the middleware down the line) - this data is permanent, and can also be retrieved by the REST API from outside of Tyk using the `/tyk/keys/` method.
+
+
+<Note>
+A new JSVM instance is created for *each* API that is managed. Consequently, inter-API communication is not possible via shared methods, since they have different bounds. However, it *is* possible using the session object if a key is shared across APIs.
+</Note>
+
+
+#### The `config` object
+
+The third Tyk data object that is made available to the script running in the JSVM contains data from the API Definition. This is read-only and cannot be modified by the JS function. The structure of this object is:
+
+- `APIID`: the unique identifier for the API
+- `OrgID`: the organization identifier
+- `config_data`: custom attributes defined in the API description
+
+##### Adding custom attributes to the API Definition
+
+When working with Tyk OAS APIs, you can add custom attributes in the `data` object in the `x-tyk-api-gateway.middleware.global.pluginConfig` section of the API definition, for example:
+
+```json {linenos=true, linenostart=1}
+{
+  "x-tyk-api-gateway": {  
+    "middleware": {
+      "global": {
+        "pluginConfig": {
+          "data": {
+            "enabled": true,
+            "value": {
+              "foo": "bar"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+When working with Tyk Classic APIs, you simply add the attributes in the `config_data` object in the root of the API definition:
+
+```json {linenos=true, linenostart=1}
+{
+  "config_data": {
+    "foo": "bar"
+  }
+}
+```
+
+#### Underscore.js Library
+
+In addition to our Tyk JavaScript API functions, you also have access to all the functions from the [underscore](http://underscorejs.org) library.
+
+Underscore.js is a JavaScript library that provides a lot of useful functional programming helpers without extending any built-in objects. Underscore provides over 100 functions that support your favorite functional helpers:
+
+- map
+- filter
+- invoke
+
+There are also more specialized goodies, including:
+
+- function binding
+- JavaScript templating
+- creating quick indexes
+- deep equality testing
+
+### Example
+
+In this basic example, we show the creation and initialisation of a middleware object. Note how the three Tyk data objects (`request`, `session`, `config`) are made available to the function and the two objects that are returned from the function (in case the external objects need to be updated).
+
+```js {linenos=true, linenostart=1}
+/* --- sampleMiddleware.js --- */
+
+// Create new middleware object
+var sampleMiddleware = new TykJS.TykMiddleware.NewMiddleware({});
+
+// Initialise the object with your functionality by passing a closure that accepts
+// two objects into the NewProcessRequest() function:
+sampleMiddleware.NewProcessRequest(function(request, session, config) {
+    log("This middleware does nothing, but will print this to your terminal.")
+
+    // You MUST return both the request and session metadata
+    return sampleMiddleware.ReturnData(request, session.meta_data);
+});
+```
+
+## JavaScript API
+
+This system API provides access to resources outside of the JavaScript Virtual Machine sandbox, the ability to make outbound HTTP requests and access to the key management REST API functions.
+
+Embedded JavaScript interpreters offer the bare bones of a scripting language, but not necessarily the functions that you would expect, especially with JavaScript, where objects such as `XMLHttpRequest()` are a given. However, those interfaces are actually provided by the browser / DOM that the script engine are executing in. In a similar vein, we have included a series of functions to the JSVM for convenience and give the interpreter more capability.
+
+This list is regularly revised and any new suggestions should be made in our [Github issue tracker](https://github.com/TykTechnologies/tyk/issues).
+
+Below is the list of functions currently provided by Tyk.
+
+- `log(string)`: Calling `log("this message")` will cause Tyk to log the string to Tyk's default logger output in the form `JSVM Log: this message` as an INFO statement. This function is especially useful for debugging your scripts. It is recommended to put a `log()` call at the end of your middleware and event handler module definitions to indicate on load that they have been loaded successfully - see the [example scripts](https://github.com/TykTechnologies/tyk/tree/master/middleware) in your Tyk installation `middleware` directory for more details.
+- `rawlog(string)`: Calling `rawlog("this message")` will cause Tyk to log the string to Tyk's default logger output without any additional formatting, like adding prefix or date. This function can be used if you want to have own log format, and parse it later with custom tooling.
+- `b64enc` - Encode string to base64
+- `b64dec` - Decode base64 string
+- `TykBatchRequest` this function is similar to `TykMakeHttpRequest` but makes use of Tyk's [batch request feature](/api-management/batch-processing).
+- `TykMakeHttpRequest(JSON.stringify(requestObject))`: This method is used to make an HTTP request, requests are encoded as JSON for deserialisation in the min binary and translation to a system HTTP call. The request object has the following structure:
+
+```js
+newRequest = {
+  "Method": "POST",
+  "Body": JSON.stringify(event),
+  "Headers": {},
+  "Domain": "http://foo.com",
+  "Resource": "/event/quotas",
+  "FormData": {"field": "value"}
+};
+```
+
+
+<Note>
+If you want to include querystring values, add them as part of the `Domain` property.
+</Note>
+
+
+Tyk passes a simplified response back which looks like this:
+
+```go
+type TykJSHttpResponse struct {
+	Code    int
+	Body    string
+	Headers map[string][]string
+}
+```
+
+The response is JSON string encoded, and so will need to be decoded again before it is usable:
+
+```js
+usableResponse = JSON.parse(response);
+log("Response code: " + usableResponse.Code);
+log("Response body: " + usableResponse.Body);
+```
+
+This method does not execute asynchronously, so execution will block until a response is received.
+
+### Working with the key session object
+
+To work with the key session object, two functions are provided: `TykGetKeyData` and `TykSetKeyData`:
+
+- `TykGetKeyData(api_key, api_id)`: Use this method to retrieve a [session object](/api-management/access-control/sessions-and-keys/understanding-sessions) for the key and the API provided:
+
+  ```js
+  // In an event handler, we can get the key idea from the event, and the API ID from the context variable.
+  var thisSession = JSON.parse(TykGetKeyData(event.EventMetaData.Key, context.APIID))
+  log("Expires: " + thisSession.expires)
+  ```
+
+- `TykSetKeyData(api_key, api_id)`: Use this method to write data back into the Tyk session store:
+
+  ```js
+  // You can modify the object just like with the REST API
+  thisSession.expires = thisSession.expires + 1000;
+
+  // Use TykSetKeyData to set the key data back in the session store
+  TykSetKeyData(event.EventMetaData.Key, JSON.stringify(thisSession));
+  ```
+
+All of these methods are described in functional examples in the Tyk `middleware/` and `event_handlers/` folders.
+
+## Installing Middleware on Tyk Self-Managed
+
+In some cases middleware references can't be directly embedded in API Definitions (for example, when using the Tyk Dashboard in an Self-Managed installation). However, there is an easy way to distribute and enable custom middleware for an API in a Tyk node by adding them as a directory structure.
+
+Tyk will load the middleware plugins dynamically on host-reload without needing a direct reference to them in the API Definition.
+
+The directory structure should look like this:
+
+```text
+middleware
+  / {API Id}
+    / pre
+    / {middlewareObject1Name}.js
+    /  {middlewareObject2Name}.js
+    / post
+      / {middlewareObject1Name}_with_session.js
+      / {middlewareObject2Name}.js
+```
+
+Tyk will check for a folder that matches the `API Id` being loaded, and then load the `pre` and `post` middleware from the respective directories.
+
+
+<Note>
+The filename MUST match the object to be loaded exactly.
+</Note>
+
+
+If your middleware requires session injection, then append `_with_session` to the filename.
+
+### Enable the JSVM
+
+Before you can use Javascript Middleware you will need to enable the JSVM.
+
+You can do this by setting `enable_jsvm` to `true` in your `tyk.conf` file.
+
+## Installing Middleware on Tyk Hybrid
+
+In some cases middleware references can't be directly embedded in API Definitions (for example, when using the dashboard in a Hybrid install). However, there is an easy way to distribute and enable custom middleware for an API on a Tyk node.
+
+A second method of loading API Definitions in Tyk nodes is to add them as a directory structure in the Tyk node. Tyk will load the middleware plugins dynamically on host-reload without needing a direct reference to them in the API Definition.
+
+The directory structure looks as follows:
+
+```text
+middleware
+  / {API Id}
+    / pre
+    / {middlewareObject1Name}.js
+    /  {middlewareObject2Name}.js
+    / post
+      / {middlewareObject1Name}_with_session.js
+      / {middlewareObject2Name}.js
+```
+
+Tyk will check for a folder that matches the `{API Id}` being loaded, and then load the `pre` and `post` middleware from the respective folders.
+
+
+<Note>
+The filename MUST match the object to be loaded exactly.
+</Note>
+
+
+If your middleware requires session injection, then append `_with_session` to the filename.
+
+### Enable the JSVM
+
+Before you can use Javascript Middleware you will need to enable the JSVM
+
+You can do this by setting `enable_jsvm` to `true` in your `tyk.conf` file.
+
+## Installing Middleware on Tyk OSS
+
+In order to activate middleware when using Tyk OSS or when using a file-based setup, the middleware needs to be registered as part of your API Definition. Registration of middleware components is relatively simple.
+
+
+<Note>
+It is important that your object names are unique.
+</Note>
+
+
+
+<Note>
+This functionality may change in subsequent releases.
+</Note>
+
+
+### Enable the JSVM
+
+Before you can use Javascript Middleware you will need to enable the JSVM
+
+You can do this by setting `enable_jsvm` to `true` in your `tyk.conf` file.
+
+Adding the middleware plugin is as simple as adding it to your definition file in the middleware sections:
+
+```json
+...
+"event_handlers": {},
+"custom_middleware": {
+  "driver": "otto",
+  "pre": [
+    {
+      "name": "sampleMiddleware",
+      "path": "middleware/sample.js",
+      "require_session": false
+    }
+  ],
+  "post": [
+    {
+      "name": "sampleMiddleware",
+      "path": "middleware/sample.js",
+      "require_session": false
+    }
+  ]
+},
+"enable_batch_request_support": false,
+...
+```
+
+As you can see, the parameters are all dynamic, so you will need to ensure that the path to your middleware is correct. The configuration sections are as follows:
+
+- `pre`: Defines a list of custom middleware objects to run *in order* from top to bottom. That will be executed *before* any authentication information is extracted from the header or parameter list of the request. Use middleware in this section to pre-process a request before feeding it through the Tyk middleware.
+
+- `pre[].name`: The name of the middleware object to call. This is case sensitive, and **must** match the name of the middleware object that was created, so in our example - we created `sampleMiddleware` by calling:
+
+  `var sampleMiddleware = new TykJS.TykMiddleware.NewMiddleware({});`
+
+- `pre[].path`: The path to the middleware component, this will be loaded into the JSVM when the API is initialised. This means that if you reload an API configuration, the middleware will also be re-loaded. You can hot-swap middleware on reload with no service interruption.
+
+- `pre[].require_session`: Irrelevant for pre-processor middleware, since no auth data has been extracted by the authentication middleware, it cannot be made available to the middleware.
+
+- `post`: Defines a list of custom middleware objects to run *in order* from top to bottom. That will be executed *after* the authentication, validation, throttling, and quota-limiting middleware has been executed, just before the request is proxied upstream. Use middleware in this section to post-process a request before sending it to your upstream API.
+
+- `post[].name`: The name of the middleware object to call. This is case sensitive, and **must** match the name of the middleware object that was created, so in our example - we created `sampleMiddleware` by calling:
+
+  `var sampleMiddleware = new TykJS.TykMiddleware.NewMiddleware({});`
+
+- `post[].path`: The path to the middleware component, this will be loaded into the JSVM when the API is initialised. This means that if you reload an API configuration, the middleware will also be re-loaded. You can hot-swap middleware on reload with no service interruption.
+
+- `post[].require_session`: Defaults to `false`, if you require access to the session object, it will be supplied as a `session` variable to your middleware processor function.
+
+## WAF (OSS) ModSecurity Plugin example
+
+Traditionally, a Web Application Firewall (WAF) would be the first layer requests would hit, before reaching the API  gateway.  This is not possible if the Gateway has to terminate SSL, for things such as mTLS.
+
+So what do you do if you still want to run your requests through a WAF to automatically scan for malicious action?  We incorporate a WAF as part of the request lifecycle by using Tyk's plugin architecture.
+
+### Prerequisites
+
+* Already running Tyk -  Community Edition or Pro
+* Docker, to run the WAF
+
+### Disclaimer
+
+This is NOT a production ready plugin because 
+
+* The JavaScript plugin creates a new connection with the WAF for every request
+* The request is not sent over SSL
+* The WAF is only sent the query params for inspection.
+
+For higher performance, the plugin could be written in Golang, and a connection pool would be opened and maintained over SSL
+
+### Steps for Configuration
+
+1. **Turn JSVM on your `tyk.conf` at the root level:**
+
+    Turn on JSVM interpreter to allow Tyk to run JavaScript plugins.
+
+    ```
+    "enable_jsvm": true
+    ```
+
+2. **Place the JavaScript plugin on Tyk file system**
+
+    Copy the JS Plugin as a local .js file to the Gateway's file system.  
+
+    From the Gateway root, this will download the plugin called `waf.js` into the `middleware` directory:
+    ```
+    curl https://raw.githubusercontent.com/TykTechnologies/custom-plugins/master/plugins/js-pre-post-waf/waf.js | cat > middleware/waf.js
+    ```
+
+    (Instructions)
+    If you are running Tyk in Docker, you can get into Tyk Gateway with `docker exec`
+    ```
+    $ docker ps | grep gateway
+    670039a3e0b8        tykio/tyk-gateway:latest           "./entrypoint.sh"        14 minutes ago      Up 14 minutes       0.0.0.0:8080->8080/tcp             tyk-demo_tyk-gateway_1
+
+    ## copy container name or ID 
+    $ docker exec -it 670039a3e0b8 bash
+
+    ## Now SSH'd into Tyk Gateway container and can perform curl
+    root@670039a3e0b8:/opt/tyk-gateway# ls
+
+    apps	   entrypoint.sh   install  middleware	templates  tyk-gateway.pid  tyk.conf.example
+    coprocess  event_handlers  js	    policies	tyk	   tyk.conf	    utils
+
+    ## Download the plugin
+    root@670039a3e0b8:/opt/tyk-gateway# curl https://raw.githubusercontent.com/TykTechnologies/custom-plugins/master/plugins/js-pre-post-waf/waf.js | cat > middleware/waf.js
+
+    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                    Dload  Upload   Total   Spent    Left  Speed
+    100  1125  100  1125    0     0   3906      0 --:--:-- --:--:-- --:--:--  3975
+
+    ```
+
+    [waf.js source](https://raw.githubusercontent.com/TykTechnologies/custom-plugins/master/plugins/js-pre-post-waf/waf.js)
+
+3. **Import API definition into Tyk**
+
+    Copy the following Tyk API definition and import it into your environment.
+
+    [API Definition JSON](https://raw.githubusercontent.com/TykTechnologies/custom-plugins/master/plugins/js-pre-post-waf/apidef.json)
+
+    Here's the important section which adds the plugin to the request lifecycle for this API:
+    ```{.json}
+    "custom_middleware": {
+        "pre": [
+            {
+            "name": "Waf",
+            "path": "./middleware/waf.js"
+            }
+        ],
+    ```
+
+    ##### How to Import?
+    [Tyk Self-Managed](/api-management/gateway-config-managing-classic#import-an-api)
+
+    [Tyk OSS](/api-management/gateway-config-managing-classic#create-an-api)
+
+4. **Run WAF ModSecurity Using Docker**
+
+    First run ModSecurity with the popular [Core RuleSet](https://coreruleset.org/) in Docker
+    ```
+    $ docker run -ti -p 80:80 -e PARANOIA=1 --rm owasp/modsecurity-crs:v3.0
+    ```
+
+    Open a second terminal and curl it
+    ```
+    $ curl localhost
+
+    hello world
+    ```
+
+    We should see the request show in the WAF server:
+
+    ```
+    172.17.0.1 - - [30/Jun/2020:00:56:42 +0000] "GET / HTTP/1.1" 200 12
+    ```
+
+    Now try a dirty payload:
+    ```
+    $ curl 'localhost/?param="><script>alert(1);</script>'
+
+    <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
+    <html><head>
+    <title>403 Forbidden</title>
+    </head><body>
+    <h1>Forbidden</h1>
+    <p>You don't have permission to access /
+    on this server.<br />
+    </p>
+    </body></html>
+    ```
+
+    Our WAF catches the response and returns a `403`.
+
+
+    Now we try through Tyk.
+
+    ```
+    ## Clean requests, should get response from upstream's IP endpoint
+    $ curl localhost:8080/waf/ip
+
+    {
+    "origin": "172.30.0.1, 147.253.129.30"
+    }
+
+    ## WAF will detect malicious payload and instruct Tyk to deny
+    $ curl 'localhost:8080/waf/ip?param="><script>alert(1);</script>
+    {
+        "error": "Bad request!"
+    }
+    ```
diff --git a/api-management/plugins/overview.mdx b/api-management/plugins/overview.mdx
new file mode 100644
index 0000000000..38028fe449
--- /dev/null
+++ b/api-management/plugins/overview.mdx
@@ -0,0 +1,1247 @@
+---
+title: "Custom Plugins"
+description: "Learn how to extend Tyk's capabilities using custom plugins to enhance API functionality."
+sidebarTitle: "Overview"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+
+## Introduction
+
+Plugins can be used to customize and enhance the capabilities of your APIs through integration with external services and databases to perform operations such as data transformation, custom authentication, logging and monitoring etc.
+
+When Tyk receives an API request, it works through a [chain](/api-management/traffic-transformation#request-middleware-chain) of processing *middleware* that is configured using the API definition. There are a large number of built-in middleware in the processing chain that are dedicated to performing [client authentication](/api-management/client-authentication), [request transformation](/api-management/traffic-transformation), [caching](/api-management/response-caching) and many other processes before proxying the request to the upstream.
+
+Tyk's custom plugin facility provides a powerful and flexible way to extend the middleware chain. It allows API developers to write custom middleware, in various programming languages, that can perform additional processing of requests and responses.
+
+For example, a custom authentication scheme can be implemented and executed on API requests, custom plugins can be used to provide integration with external services and databases, or additional processing can be performed on the response returned from the upstream.
+
+There are several different stages of the [API request lifecycle](/api-management/traffic-transformation#request-middleware-chain) where custom plugins can be attached (or *hooked*) into the middleware chain allowing significant customization to meet your specific requirements.
+
+Custom plugins are usually referred to by the location where they can be *hooked* into the middleware processing chain as follows:
+
+1. [Pre (Request)](/api-management/plugins/plugin-types#request-plugins)
+2. [Authentication](/api-management/plugins/plugin-types#authentication-plugins)
+3. [Post-Auth (Request)](/api-management/plugins/plugin-types#request-plugins)
+4. [Post (Request)](/api-management/plugins/plugin-types#request-plugins)
+5. [Response](/api-management/plugins/plugin-types#response-plugins)
+6. [Analytics (Response)](/api-management/plugins/plugin-types#analytics-plugins)
+
+## How Plugin Works
+
+The diagram below illustrates a high level architectural overview for how Tyk Gateway interacts with plugins.
+
+<img src="/img/plugins/plugins_overview.svg" alt="plugins overview" width="500px" />
+
+From the above illustration it can be seen that:
+
+1. The client sends a request to an API served by Tyk Gateway.
+2. Tyk processes the request and forwards it to one or more plugins implemented and configured for that API.
+3. A plugin performs operations (e.g., custom authentication, data transformation).
+4. The processed request is then returned to Tyk Gateway, which forwards it upstream.
+5. Finally, the upstream response is sent back to the client.
+
+## Types of Plugin
+
+Tyk supports four types of plugins:
+
+1. **[Request Plugin](/api-management/plugins/plugin-types#request-plugins)**
+2. **[Authentication Plugin](/api-management/plugins/plugin-types#authentication-plugins)**
+3. **[Response Plugin](/api-management/plugins/plugin-types#response-plugins)**
+4. **[Analytics Plugin](/api-management/plugins/plugin-types#analytics-plugins)**
+
+To know more about plugin types and it's advanced configuration, refer the following [docs](/api-management/plugins/plugin-types).
+
+## Getting Started
+
+This section takes you through the process of running and building a quickstart **Go plugin**, included within Tyk's [getting started](https://github.com/TykTechnologies/custom-go-plugin) repository. Go plugins are the recommended plugin type and suitable for most use cases.
+
+### Expected outcome
+
+At the end of this process you should have a Tyk Gateway or Tyk Self-Managed environment running locally, with a simple Go plugin executing on each API request. For each reponse to an API request the example plugin will inject a *Foo* header, with a value of *Bar*.
+
+### Prerequisites
+
+- [Docker](https://docs.docker.com/get-docker/)
+- [Docker-compose](https://docs.docker.com/compose/install/)
+- [Tyk license](https://tyk.io/sign-up/#self) (if using Self-Managed Tyk, which will make the process easier via UI)
+- [Make](https://www.gnu.org/software/make)
+- OSX (Intel) -> Not a prerequisite, though these steps are tested on OSX Intel/ARM
+
+### Before you begin
+
+Please clone the [getting started](https://github.com/TykTechnologies/custom-go-plugin) respository.
+
+```bash
+git clone https://github.com/TykTechnologies/custom-go-plugin
+cd custom-go-plugin
+```
+
+### Choose your environment
+
+<ResponsiveGrid>
+
+<Card href="/api-management/plugins/overview#dashboard-plugins" img="/img/logos/tyk-logo-selfmanaged.svg">
+**Read time: 15 mins**
+
+Dashboard Tutorial
+</Card>
+
+<Card href="/api-management/plugins/overview#open-source-plugins" img="/img/logos/tyk-logo-selfmanaged.svg">
+**Read time: 15 mins**
+
+Tyk OSS Gateway Tutorial
+</Card>
+
+</ResponsiveGrid>
+
+
+### Dashboard Plugins
+
+This quick start explains how to run the [getting started](https://github.com/TykTechnologies/custom-go-plugin) Go plugin within Tyk Dashboard.
+
+**Estimated time**: 10-15 minutes
+
+In this tutorial you will learn how to:
+
+1. Add your Tyk license.
+2. Bootstrap the Tyk Dashboard environment.
+3. Login to Tyk Dashboard.
+4. View the pre-configured API.
+5. Test the plugin.
+6. View the analytics.
+7. Next steps.
+
+**Steps for Configuration:**
+
+1. **Add your Tyk license**
+
+    Create and edit the file `.env` with your Tyk Dashboard license key
+
+    ```console
+    # Make a copy of the example .env file for the Tyk-Dashboard 
+    cp .env.example .env
+    ```
+
+2. **Bootstrap the getting started example**
+
+    run the `make` command:
+
+    ```bash
+    make
+    ```
+
+    This will take a few minutes to run as it compiles the plugin for the first time and downloads all the necessary Docker images.
+
+3. **Log in to Tyk Dashboard**
+
+    Log on to the Tyk Dashboard on `http://localhost:3000` using the following Bootstrapped credentials:
+    ```
+    demo@tyk.io
+    ```
+    and password:
+    ```
+    topsecretpassword
+    ```
+
+    Note: these are editable in `.env.example`
+
+4. **View the pre-configured API**
+
+    Once you're logged on to the Tyk Dashboard, navigate to the *APIs* screen.
+
+    You'll see a sample *Httpbin* API.  Let's click into it for more details.
+
+    Click on *VIEW RAW DEFINITION*.  Note the *custom_middleware* block is filled out, injecting the compiled example Go plugin into the API.
+
+5. **Test the plugin**
+
+    Let's send an API request to the API Gateway so it can reverse proxy to our API.
+
+    ```terminal
+    curl localhost:8080/httpbin/get
+    ```
+
+    Yields the response:
+    ```
+    {
+    "args": {},
+    "headers": {
+        "Accept": "*/*",
+        "Accept-Encoding": "gzip",
+        "Foo": "Bar",
+        "Host": "httpbin.org",
+        "User-Agent": "curl/7.79.1",
+        "X-Amzn-Trace-Id": "Root=1-63f78c47-51e22c5b57b8576b1225984a"
+    },
+    "origin": "172.26.0.1, 99.242.70.243",
+    "url": "http://httpbin.org/get"
+    }
+    ```
+
+    Note, we see a *Foo:Bar* HTTP Header was injected by our Go plugin and echoed back to us by the Httpbin mock server.
+
+6. **View the analytics**
+
+    Navigate to the Dashboard's various *API Usage Data* to view analytics on the API request!
+
+### Open-Source Plugins
+
+This quick start guide will explain how to run the [getting started](https://github.com/TykTechnologies/custom-go-plugin) Go plugin using the Tyk OSS Gateway.
+
+**Steps for Configuration:**
+
+1. **Bootstrap the getting started example**
+
+    Please run the following command from within your newly cloned directory to run the Tyk Stack and compile the sample plugin.  This will take a few minutes as we have to download all the necessary dependencies and docker images.
+
+    ```bash
+    make up-oss && make build
+    ```
+
+2. **Test the plugin**
+
+    Let's test the plugin by sending an API request to the pre-configured API definition:
+
+    ```
+    curl localhost:8080/httpbin/get
+    ```
+
+    Response:
+    ```
+    {
+    "args": {},
+    "headers": {
+        "Accept": "*/*",
+        "Accept-Encoding": "gzip",
+        "Foo": "Bar",
+        "Host": "httpbin.org",
+        "User-Agent": "curl/7.79.1"
+    },
+    "origin": "172.28.0.1, 99.242.70.243",
+    "url": "http://httpbin.org/get"
+    }
+    ```
+
+    We've sent an API request to the Gateway. We can see that the sample custom plugin has injected an HTTP header with a value of *Foo:Bar*. This header was echoed back in the Response Body via the mock Httpbin server.
+
+    The `./tyk/scripts/bootstrap-oss.sh` script creates an API definition that includes the custom plugin.
+
+3. **View the analytics**
+
+    We can see that Tyk Pump is running in the background. Let's check the logs after sending the API request:
+
+    ```
+    docker logs custom-go-plugin_tyk-pump_1 
+    ```
+
+    Output:
+    ```
+    time="Feb 23 16:29:27" level=info msg="Purged 1 records..." prefix=stdout-pump
+    {"level":"info","msg":"","time":"0001-01-01T00:00:00Z","tyk-analytics-record":{"method":"GET","host":"httpbin.org","path":"/get","raw_path":"/get","content_length":0,"user_agent":"curl/7.79.1","day":23,"month":2,"year":2023,"hour":16,"response_code":200,"api_key":"00000000","timestamp":"2023-02-23T16:29:27.53328605Z","api_version":"Non Versioned","api_name":"httpbin","api_id":"845b8ed1ae964ea5a6eccab6abf3f3de","org_id":"","oauth_id":"","request_time":1128,"raw_request":"...","raw_response":"...","ip_address":"192.168.0.1","geo":{"country":{"iso_code":""},"city":{"geoname_id":0,"names":null},"location":{"latitude":0,"longitude":0,"time_zone":""}},"network":{"open_connections":0,"closed_connections":0,"bytes_in":0,"bytes_out":0},"latency":{"total":1128,"upstream":1111},"tags":["key-00000000","api-845b8ed1ae964ea5a6eccab6abf3f3de"],"alias":"","track_path":false,"expireAt":"2023-03-02T16:29:27.54271855Z","api_schema":""}}
+    ```
+
+    As we can see, when we send API requests, the Tyk Pump will scrape them from Redis and then send them to a persistent store as configured in the Tyk Pump env file. 
+
+    In this example, we've configured a simple `STDOUT` Pump where the records will be printed to the Standard OUT (docker logs!)
+
+## API Configuration
+
+This page provides an overview on how to register one or more custom plugins to be executed at different stages or [hooks](/api-management/plugins/plugin-types#plugin-and-hook-types) in the API request/response lifecycle. If you wish to learn how to register custom plugins to be executed on the traffic logs generated by the Gateway please refer to the [analytics plugins](/api-management/plugins/plugin-types#analytics-plugins) page. 
+
+If you need fine-grained control at the endpoint level then it is also possible to configure [per-endpoint plugins](/api-management/plugins/plugin-types#per-endpoint-custom-plugins). These are custom Golang plugins that are triggered at the end of the request processing chain before API-level *Post* plugins are executed.
+
+---
+
+### Introduction
+
+There are three locations where Tyk Gateway can find plugin functions:
+
+1. **gRPC plugins**: Plugin functions are implemented by a gRPC server with the associated configuration specified with the API definition. For further details on how to configure gRPC plugins, please refer to our [gRPC](/api-management/plugins/rich-plugins#overview-1) documentation.
+2. **Local plugins**: Plugins are implemented by functions within source code files located on the Gateway's file system. The API Definition allows the source code file path and function name to be configured for each plugin. For further details read on.
+3. **Plugin bundles**: The plugin source code and configuration are bundled into a zip file that is served by a remote web server. For further details see the [plugin bundles](/api-management/plugins/overview#plugin-bundles) page.
+
+### Plugin configuration
+
+Each plugin for an API can be configured within the API Definition with the following details:
+
+| Property | Description |
+| :------- | :------------- |
+| `Enabled` | When true, the plugin is activated |
+| `Name` | A name used to identify the plugin |
+| `Path` | The path to the source code file on the Tyk Gateway file system |
+| `Function name` | The name of the function that implements the plugin. The function should exist within the source code file referenced in `path` |
+| `Raw body only` | When set to true, this flag indicates that only the raw request body should be processed |
+| `Require session state`| When set to true, Tyk Gateway will serialize the request session state and pass it as an argument to the function that implements the plugin in the target language. This is applicable to Post, Response, and Authentication hooks only |
+
+---
+
+### Language configuration
+
+For local and bundle plugins a [plugin driver](/api-management/plugins/overview#plugin-driver-names) is configured to specify the plugin implementation language. If using gRPC plugins a `grpc` plugin driver should be used to instruct Tyk to request execution of plugins from within a gRPC server that is external to the Tyk process. This offers additional language support since Tyk can integrate with a gRPC server that is implemented using any supported [gRPC language](https://grpc.io/docs/).
+
+For a given API it is not possible to mix the implementation language for the plugin types: Pre, Authentication, Post, Post Authentication and Response plugins. For example, it is not possible to implement a pre request plugin in *Go* and also implement a post request plugin in *Python* for the same API.
+
+### Tyk OAS APIs
+
+An API can be configured so that one or more of its associated plugins can execute at different phases of the request / response life cycle. Each plugin configuration serves to identify the plugin source file path and the name of the corresponding function, triggered at each request / response lifecycle stage.
+
+This guide explains how to configure plugins for Tyk OAS APIs within the [Tyk OAS API definition](#tyk-oas-apidef) or via the [API designer](#tyk-oas-dashboard) in Tyk Dashboard.
+
+If you’re using the legacy Tyk Classic APIs, then check out the [Tyk Classic](/api-management/plugins/overview#tyk-classic-apis) page.
+
+#### Using API Definition
+<a id="tyk-oas-apidef"></a>
+
+The `x-tyk-api-gateway.middleware.global` section is used to configure plugins in a Tyk OAS API. It contains a `pluginConfig` section and a list of plugins for each phase of the API request / response lifecycle. 
+
+The `pluginConfig` section contains the `driver` parameter that is used to configure the plugin implementation [language](/api-management/plugins/overview#plugin-driver-names):
+
+```yaml
+"pluginConfig": {
+  "driver": "goplugin"
+}
+```
+
+Within the `x-tyk-api-gateway.middleware.global` section, keyed lists of plugins can be configured for each phase of the API request / response lifecycle described in the table below:
+
+| Phase | Description       | Config Key  |
+| :----- | :--- | :---- |
+| Pre   | Executed at the start of the request processing chain | `prePlugins` |            
+| Post Auth | Executed after the requester has been authenticated | `postAuthenticationPlugins` |
+| Post | Executed at the end of the request processing chain | `postPlugins` |       
+| Response | Occurs after the main request processing but before the response is sent. | `responsePlugins` | 
+
+Each plugin configuration can have the following fields configured:
+
+- `enabled`: When true, enables the plugin.
+- `functionName`: The name of the function that implements the plugin within the source file.
+- `path`: The path to the plugin source file. 
+- `rawBodyOnly`: When true, indicates that only the raw body should be processed.
+- `requireSession`: When true, indicates that session metadata will be available to the plugin. This is applicable only for post, post authentication and response plugins.
+
+For example a Post Authentication plugin would be configured within a `postAuthenticationPlugins` list as shown below:
+
+```yaml
+"postAuthenticationPlugins": [
+  {
+    "enabled": true,
+    "functionName": "post_authentication_func",
+    "path": "/path/to/plugin1.so",
+    "rawBodyOnly": true,
+    "requireSession": true
+  }
+]
+```
+
+An full example is given below to illustrate how to set up plugins for different phases of the request / response lifecycle:
+
+```json {linenos=true, linenostart=1, hl_lines=["15-52"]}
+{
+  "x-tyk-api-gateway": {
+    "info": {
+      "dbId": "667962397f6de50001508ac4",
+      "id": "b4d8ac6e5a274d7c7959d069b47dc206",
+      "orgId": "6672f4377f6de50001508abf",
+      "name": "OAS APIs Plugins",
+      "state": {
+        "active": true,
+        "internal": false
+      }
+    },
+    "middleware": {
+      "global": {
+        "pluginConfig": {
+          "driver": "goplugin"
+        },
+        "postAuthenticationPlugins": [
+          {
+            "enabled": true,
+            "functionName": "post_authentication_func",
+            "path": "/path/to/plugin1.so",
+            "rawBodyOnly": true,
+            "requireSession": true
+          }
+        ],
+        "postPlugins": [
+          {
+            "enabled": true,
+            "functionName": "postplugin",
+            "path": "/path/to/plugin1.so",
+            "rawBodyOnly": true,
+            "requireSession": true
+          }
+        ],
+        "prePlugins": [
+          {
+            "enabled": true,
+            "functionName": "pre-plugin",
+            "path": "/path/to/plugin1.so"
+          }
+        ],
+        "responsePlugins": [
+          {
+            "enabled": true,
+            "functionName": "Response",
+            "path": "/path/to/plugin1.so",
+            "rawBodyOnly": true,
+            "requireSession": true
+          }
+        ]
+      }
+    }
+  }
+}
+```
+
+In this example we can see that the plugin driver has been configured by setting the `driver` field to `goplugin` within the `pluginConfig` object. This configuration instructs Tyk Gateway that our plugins are implemented using Golang.
+
+We can also see that the following type of plugins are configured:
+
+- **Pre**: A plugin is configured within the `prePlugins` list. The plugin is enabled and implemented by function `pre-plugin` within the source file located at path `/path/to/plugin1.so`.
+- **Post Authentication**: A plugin is configured within the `postAuthenticationPlugins` list. The plugin is enabled and implemented by function `post_authentication_func` within the source file located at path `/path/to/plugin1.so`. The raw request body and session metadata is available to the plugin.
+- **Post**: A plugin is configured within the `responsePlugins` list. The plugin is enabled and implemented by function `postplugin` within the source file located at path `/path/to/plugin1.so`. The raw request body and session metadata is available to the plugin.
+- **Response**: A plugin is configured within the `postPlugins` list. The plugin is enabled and implemented by function `Response` within the source file located at path `/path/to/plugin1.so`. The raw request body and session metadata is available to the plugin.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can use as a basis for trying out custom plugins. You will need to update the [driver](/api-management/plugins/overview#plugin-driver-names) parameter to reflect the target language type of your plugins. You will also need to update the `path` and `functionName` parameters for each plugin to reflect the source code.
+
+#### Using API Designer
+<a id="tyk-oas-dashboard"></a>
+
+Select your API from the list of *Created APIs* to reach the API designer and then follow these steps:
+
+1. **Configure plugin type and custom data**
+
+    In the *Plugins Configuration* section, select the *Plugin Driver*, which tells Tyk which type of plugin to expect: Go, gRPC, JavaScript (OTTO), Lua or Python.
+
+    You can configure custom data that will be made available to your plugin function as a JSON formatted object in the *Config Data* option.
+
+    <img src="/img/plugins/plugins_oas_api_driver_options.png" alt="OAS API Plugins Driver Config" />
+
+2. **Configure the custom plugins**
+
+    For each plugin that you wish to register with the API, click on the **Add Plugin** button to display a plugin configuration section:
+
+    <img src="/img/plugins/plugins_oas_api_source_config.png" alt="OAS Plugins Config Section" />
+
+    Complete the following fields:
+
+    - `Function Name`: Enter the name of the function within your plugin code that Tyk should invoke.
+    - `Path`: Enter the path to the source file that contains the function that implements your plugin.
+    - `Raw Body Only`: Optionally, toggle the *Raw Body Only* switch to true when you do not wish to fill body in request or response object for your plugins.
+
+3. **Save the API**
+
+    Select **Save API** to apply the changes to your API.
+
+### Tyk Classic APIs
+
+An API can be configured so that one or more of its associated plugins can execute at different phases of the request / response lifecycle. Each plugin configuration serves to identify the plugin source file path and the name of the corresponding function, triggered at each request / response lifecycle stage.
+
+This guide explains how to configure plugins for Tyk Classic APIs within the [Tyk Classic API definition](#tyk-classic-apidef) or via the [API designer](#tyk-classic-dashboard) in Tyk Dashboard.
+
+If you’re using the newer Tyk OAS APIs, then check out the [Tyk OAS](/api-management/plugins/overview#tyk-oas-apis) page.
+
+#### Using API Definition
+<a id="tyk-classic-apidef"></a>
+
+In Tyk Classic APIs, the *custom_middleware* section of the Tyk Classic API Definition is where you configure plugins that will run at different points during the lifecycle of an API request.
+
+This table illustrates the different phases of the API request lifecycle where custom plugins can be executed:
+
+| Phase | Description       | Config |
+| :----- | :--- | :---- |
+| Pre   | Executed at the start of the request processing chain | `pre`    |            
+| Auth  | Executed during the authentication step | `auth_check` |  
+| Post Auth | Executed after the requester has been authenticated | `post_key_auth` |
+| Post | Executed at the end of the request processing chain | `post` |       
+| Response | Executed on the response received from the upstream | `response` |   
+
+This example configuration illustrates how to set up plugins for different phases of the request lifecycle:
+
+```json  {linenos=true, linenostart=1}
+{
+    "custom_middleware": {
+        "pre": [
+            {
+                "name": "PreHook1",
+                "path": "/path/to/plugin1.so",
+                "disabled": false,
+                "require_session": false,
+                "raw_body_only": false
+            }
+        ],
+        "auth_check": {
+            "name": "AuthCheck",
+            "path": "/path/to/plugin.so",
+            "disabled": false,
+            "require_session": false,
+            "raw_body_only": false
+        },
+        "post_key_auth": [
+            {
+                "name": "PostKeyAuth",
+                "path": "/path/to/plugin.so",
+                "disabled": false,
+                "require_session": false,
+                "raw_body_only": false
+            }
+        ],
+        "post": [
+            {
+                "name": "PostHook1",
+                "path": "/path/to/plugin1.so",
+                "disabled": false,
+                "require_session": false,
+                "raw_body_only": false
+            },
+            {
+                "name": "PostHook2",
+                "path": "/path/to/plugin2.so",
+                "disabled": false,
+                "require_session": false,
+                "raw_body_only": false
+            }
+        ],
+        "response": [
+            {
+                "name": "ResponseHook",
+                "path": "/path/to/plugin.so",
+                "disabled": false,
+                "require_session": false,
+                "raw_body_only": false
+            }
+        ],
+        "driver": "goplugin"
+    }
+}
+```
+
+In this example we can see that there are Golang custom authentication (`auth_check`), post authentication (`post_key_auth`), post, pre and response plugins configured.
+
+It can be seen that each plugin is configured with the specific function name and associated source file path of the file that contains the function. Furthermore, each lifecycle phase (except `auth`) can have a list of plugins configured, allowing for complex processing workflows. For example, you might develop one plugin for logging and another for modifying the request in the pre request phase. When multiple plugins are configured for a phase they will be executed in the order that they appear in the API definition.
+
+The `driver` configuration parameter describes the plugin implementation language. Please refer to the [supported languages](/api-management/plugins/overview#plugin-driver-names) section for list of supported plugin driver names.
+
+Each plugin can have additional settings, such as:
+- `disabled`: When true, disables the plugin.
+- `raw_body_only`: When true, indicates that only the raw body should be processed.
+- `require_session`: When true, indicates that session metadata will be available to the plugin. This is applicable only for post, post authentication and response plugins.
+
+#### Using API Designer
+<a id="tyk-classic-dashboard"></a>
+
+This section explains how to configure plugins for a Tyk Classic API using Tyk Dashboard. It specifically covers the use case where the source files of your plugins are deployed on the Tyk Gateway file system. 
+
+Select your API from the list of *Created APIs* to reach the API designer and then follow these steps:
+
+<img src="/img/plugins/plugins_classic_api_source_config.png" alt="Plugins Classic API screen" />
+
+1. **Display the Tyk Classic API Definition editor**
+
+    Click on the **View Raw Definition** button to display an editor for updating the Tyk Classic API Definition.
+
+    <img src="/img/plugins/plugins_classic_api_definition_editor.png" alt="Plugins Classic API Definition editor screen" />
+
+2. **Edit the Tyk Classic API Definition to configure plugins**
+
+    Use the editor to edit the `custom_middleware` section of the [Tyk Classic API Definition](/api-management/plugins/overview#tyk-classic-apis).
+
+    <img src="/img/plugins/plugins_classic_api_bundles_config.png" alt="Plugins Classic API Bundle Field" />
+
+3. **Save changes**
+
+    Select the **Update** button to apply your changes to the Tyk Classic API Definition.
+
+## Plugin Deployment Types
+
+There are a variety of scenarios relating to the deployment of plugins for an API, concerning the location of the plugin source code and its associated configuration.
+
+### Local Plugins
+
+The plugin source code and associated configuration are co-located with Tyk Gateway in the same file system. The configuration is located within the API Definition. For further details please consult [API configuration](/api-management/plugins/overview#api-configuration).
+
+Local plugins can be supplied to Tyk Gateway in one of two ways:
+
+- **Volume-mounted files**: the plugin file is mounted into the Gateway's file system at runtime, for example using a Kubernetes ConfigMap, Secret, or CSI volume. See [Custom Plugins with Tyk Operator](/product-stack/tyk-operator/advanced-configurations/custom-plugins) for an example that mounts a plugin this way.
+- **Baked into the container image**: the plugin file is copied into a custom Tyk Gateway image at build time, so that it ships as part of the container.
+
+Both variants share the same underlying constraint: Tyk Gateway only loads the plugin file that is present in its file system when the API definition referencing it is loaded. Any change to the plugin therefore requires the file to be replaced and the affected API definition to be reloaded. If the plugin is baked into the container image, that still means restarting or rolling out the Gateway pods, since the image itself has to change. If it is volume-mounted, updating the file in place followed by a Gateway reload can be enough, without a pod restart.
+
+#### Advantages Of Local Plugins
+
+- No external bundle server, network access, or signing keys are required, as the plugin ships with the Gateway.
+- Tyk Gateway fails to load the API if the plugin file is missing, which makes startup issues easy to spot.
+- You can roll out a new plugin version alongside the old one, for example during an upgrade, by shipping both files and pointing the relevant API definitions at the new file path. This avoids rebuilding a shared bundle for every API.
+
+#### Trade-Offs Of Local Plugins
+
+- Every plugin change requires the file to be replaced and the API definition reloaded. If the plugin is baked into the image, this also means restarting or rolling out the Gateway pods to deploy the new image, which can interrupt live traffic if it is not managed carefully.
+- Each cluster or Gateway deployment needs its own copy of the image or mounted files, so a multi-cluster fleet can end up with several copies to keep in sync.
+- Tyk Gateway does not version local plugins for you, so tracking which Gateway is running which plugin build depends on your own image or file naming discipline.
+
+<Note>
+Tyk Cloud Data Planes only support plugin bundles for custom plugins. If you use Tyk Cloud, see [Configure Custom Plugins in Tyk Cloud](/tyk-cloud/using-plugins).
+</Note>
+
+### Plugin Bundles (Remote)
+
+The plugin source code and associated configuration are bundled into a zip file and uploaded to a remote webserver. Multiple plugins can be stored in a single *plugin bundle*. Tyk Gateway will download the plugin bundle from the remote webserver and then extract, cache and execute plugins for each of the configured phases of the API request / response lifecycle. For further details on plugin bundles and how to configure them, please refer to the [plugin bundles](/api-management/plugins/overview#plugin-bundles) page.
+
+### gRPC Plugins (Remote)
+
+Custom plugins can be hosted on a remote server and executed from the Tyk Gateway middleware chain via gRPC. These plugins can be written in any language you prefer, as they are executed on the gRPC server. You'll configure your API definition so that Tyk Gateway will send requests to your gRPC server at the appropriate points in the API request / response lifecycle. For further details please consult our [gRPC](/api-management/plugins/rich-plugins#overview-1) documentation.
+
+### Choosing Between Local Plugins And Plugin Bundles
+
+Neither approach is universally better. Use the table below to compare them against your operational requirements.
+
+| Dimension | Local Plugins (Volume-Mounted Or Baked-In) | Plugin Bundles (Remote) |
+| --- | --- | --- |
+| Distribution scope | Per Gateway deployment. The image or mounted files must be duplicated across clusters | Shared. Any Gateway that can reach the bundle server uses the same bundle |
+| Update workflow | Rebuild the image and roll out the Gateway, or update the mounted files and reload the Gateway | Publish a new bundle file, update the API definition, then trigger a Gateway reload |
+| External dependencies | None beyond your own image registry or cluster storage | Requires an HTTP(S) server to host the bundle, and optionally signing keys |
+| Adding or changing a single plugin file | Copy or mount the new file directly | Rebuild and republish the entire bundle, as all files in a bundle are fixed by its `manifest.json` at build time |
+| Rollback | Roll the Gateway back to the previous image or mounted files | Point the API definition back to the previous bundle filename |
+| Behavior if the plugin source is unavailable at startup | The Gateway fails to load the affected API | Tyk Gateway can keep using a previously cached copy of the same bundle if the download fails. A first-time download or a new bundle filename still fails to load the affected API |
+| Best fit | Air-gapped or restricted-network environments, or teams with a mature image or configuration promotion workflow | Fleets that share plugins across many APIs or Gateways, or that need frequent plugin updates without restarting pods |
+
+Consider the following when deciding between the two:
+
+- Use **local plugins** if you operate in a restricted network, want to avoid a runtime dependency on an external server, or already have a strong image or configuration promotion workflow.
+- Use **plugin bundles** if you need the same plugin shared across many APIs or Gateways, want to roll out plugin changes without restarting pods, or require [signed bundles](/api-management/plugins/overview#gateway-configuration) for supply-chain integrity.
+- The two approaches are not mutually exclusive. Different APIs on the same Tyk Gateway fleet can use either approach, as long as each API definition clearly states where its plugin lives.
+- If you use [Tyk Cloud](/tyk-cloud/using-plugins), plugin bundles are the only supported option for custom plugins.
+
+## Plugin Bundles
+
+For Tyk Gateway to execute local custom plugins during the processing of API requests and responses, the plugin source code must be loaded into the Gateway. The source is usually stored in files and the API definition is used to point the Gateway at the correct file for each [plugin type](/api-management/plugins/plugin-types#plugin-types). To simplify the management of plugins, you can group (or *bundle*) multiple plugin files together in a ZIP file that is referred to as a *plugin bundle*.
+
+### When To Use Plugin Bundles
+
+Plugin bundles are intended to simplify the process of attaching and loading custom middleware. Multiple API definitions can refer to the same plugin bundle (containing the source code and configuration) if required. Having this common, shared resource avoids you from having to duplicate plugin configuration for each of your APIs definitions. 
+
+### How Plugin Bundles Work
+
+The source code and a [manifest file](#manifest) are bundled into a zip file and uploaded to an external remote web server. The manifest file references the source code file path and the function name within the code that should be invoked for each [plugin type](/api-management/plugins/plugin-types#plugin-types). Within the API definition, custom plugins are configured simply using the name of the bundle (zip file). Tyk Gateway downloads, caches, extracts and executes plugins from the downloaded bundle according to the configuration in the manifest file. 
+
+<img src="/img/plugins/plugin-bundles-overview.png" alt="plugin bundles architectural overview" />
+
+#### Caching plugin bundles
+
+Tyk downloads a plugin bundle on startup based on the configuration in the API definition, e.g. `http://my-bundle-server.com/bundles/bundle-latest.zip`. The bundle contents will be cached so that, when a Tyk reload event occurs, the Gateway does not have to retrieve the bundle from the server again each time. If you want to use a different bundle then you must update your API to retrieve a different bundle filename and then trigger a reload. It is not sufficient simply to replace the bundle file on your server with an updated version with the same name - the caching ensures this will not be retrieved during a reload event.
+
+As a suggestion, you may organize your plugin bundle files using a Git commit reference or version number, e.g. `bundle-e5e6044.zip`, `bundle-48714c8.zip`, `bundle-1.0.0.zip`, `bundle-1.0.1.zip`, etc.
+
+Alternatively, you may delete the cached bundle from Tyk manually and then trigger a hot reload to tell Tyk to fetch a new one.  By default, Tyk will store downloaded bundles in this path:
+`{ TYK_ROOT } / { CONFIG_MIDDLEWARE_PATH } / bundles`
+
+#### Gateway configuration
+
+To configure Tyk Gateway to load plugin bundles the following parameters must be specified in your `tyk.conf`:
+
+```yaml
+"enable_bundle_downloader": true,
+"bundle_base_url": "http://my-bundle-server.com/bundles/",
+"public_key_path": "/path/to/my/pubkey",
+```
+
+- `enable_bundle_downloader`: Enables the bundle downloader.
+- `bundle_base_url`: A base URL that will be used to download the bundle. For example if we have `bundle-latest.zip` specified in the API definition, Tyk will fetch the following file: `http://my-bundle-server.com/bundles/bundle-latest.zip` (see the next section for details).
+-  `public_key_path`: Sets a public key, used for verifying signed bundles. If unsigned bundles are used you may omit this.
+
+
+
+    <Note>
+    Remember to set `"enable_coprocess": true` in your `tyk.conf` when using [rich plugins](/api-management/plugins/overview#plugin-bundles)!
+    </Note>
+
+
+#### The manifest file
+<a id="manifest"></a>
+
+A plugin bundle must include a manifest file (called `manifest.json`). The manifest file contains important information like the configuration block and the list of source code files that will be included as part of the bundle file. If a file isn't specified in the list, it won't be included in the resulting file, even if it's present in the current directory.
+
+A sample manifest file looks like this:
+
+```json
+{
+  "file_list": [
+    "middleware.py",
+    "mylib.py"
+  ],
+  "custom_middleware": {
+    "pre": [
+      {
+        "name": "PreMiddleware"
+      }
+    ],
+    "post": [
+      {
+        "name": "PostMiddleware"
+      }
+    ],
+    "driver": "python"
+  },
+  "checksum": "",
+  "signature": ""
+}
+```
+
+You may leave the `checksum` and `signature` fields empty, the bundler tool will fill these during the build process.
+
+The `custom_middleware` block follows the standard syntax we use for Tyk plugins. In Tyk Community Edition, where file-based API configuration is used by default, a `custom_middleware` block is located/added to the API configuration file.
+
+#### Creating plugin bundles
+
+Tyk provides the Bundle CLI tool as part of the `tyk` binary. For further details please visit the [Bundle CLI tool](/api-management/plugins/overview#bundler-cli-tool) page.
+
+### Tyk OAS API Configuration
+
+For API plugins that are deployed as [plugin bundles](/api-management/plugins/overview#plugin-bundles), the API should be configured with the name of the plugin bundle file to download from your remote web server. Furthermore, the Gateway should be [configured](/api-management/plugins/overview#gateway-configuration) to enable downloading plugin bundles.
+
+You can configure your API with the name of the plugin bundle file to download within the Tyk OAS API definition or API Designer.
+
+If you’re using the legacy Tyk Classic APIs, then check out the [Tyk Classic](/api-management/plugins/overview#tyk-classic-apis) page.
+
+#### Using API Definition
+
+The configuration for a Tyk OAS API to fetch the download of a plugin bundle from a remote web server is encapsulated within the `pluginConfig` section within the `middleware.global` section of the `x-tyk-api-gateway` part of a Tyk OAS API Definition.
+
+The `pluginConfig` section is structured as follows:
+
+- `bundle`: A JSON entity that contains the following configuration parameters:
+  - `enabled`: When `true`, enables the plugin.
+  - `path`: The relative path of the zip file in relation to the base URL configured on the remote webserver that hosts plugin bundles.
+- `driver`: Indicates the type of plugin, e.g. `golang`, `grpc`, `lua`, `otto` or `python`.
+
+An illustrative example is listed below:
+
+```json{hl_lines=["37-45"], linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-oas-plugin-configuration",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "put": {
+                "operationId": "anythingput",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-oas-plugin-configuration",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-oas-plugin-configuration/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "global": {
+              "pluginConfig": {
+                "bundle": {
+                  "enabled": true,
+                  "path": "plugin.zip"
+                },
+                "driver": "goplugin"
+              }
+            } 
+        }
+    }
+}
+```
+
+In this example we can see that bundle plugin has been configured within the `middleware.global.pluginConfig.bundle` object. The plugin is enabled and bundled within file `plugin.zip`. The plugin bundle is a Go plugin, i.e. `middleware.global.pluginConfig.driver` has been configured with value `goplugin`.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out custom plugin bundles, assuming that you have provided a valid bundle file named `plugin.zip`.
+
+#### Using API Designer
+
+To configure plugin bundles for Tyk OAS APIs click on the APIs menu item in the *API Management* menu of Dashboard and select your API to display the editor screen. Subsequently, follow the steps below:
+
+1. **Access plugin options**
+
+    Scroll down until the *Enable Plugin* section is displayed.
+
+    <img src="/img/plugins/plugins_oas_api_bundles_config.png" alt="Tyk OAS API Bundle section" />
+
+2. **Enable plugin bundle for you API**
+
+    Enable a plugin bundle for your API by activating the toggle switch. 
+
+3. **Enter relative path to plugin bundle file**
+
+    Enter the relative path of the plugin bundle file in the *Plugin Bundle ID* field that Tyk Gateway should download from the web server that hosts your plugin bundles.
+
+4. **Save the API**
+
+    Select **Save API** to apply the changes to your API.
+
+### Tyk Classic API Configuration
+
+For custom plugins that are deployed as [plugin bundles](/api-management/plugins/overview#plugin-bundles), the API should be configured with the name of the plugin bundle file to download from your remote web server. Furthermore, the Gateway should be [configured](/api-management/plugins/overview#gateway-configuration) to enable downloading plugin bundles.
+
+You can configure your API with the name of the plugin bundle file to download within the Tyk Classic API definition or API Designer.
+
+If you’re using the newer Tyk OAS APIs, then check out the [Tyk OAS](/api-management/plugins/overview#tyk-oas-api-configuration) page.
+
+#### Using API Definition
+
+The configuration for an API to fetch and download a plugin bundle from a remote server is encapsulated within the `custom_middleware_bundle` field of the Tyk Classic API Definition. An illustrative example is listed below:
+
+```json {hl_lines=["33"], linenos=true, linenostart=1}
+{
+  "name": "Tyk Classic Bundle API",
+  "api_id": "1",
+  "org_id": "default",
+  "definition": {
+    "location": "header",
+    "key": "version"
+  },
+  "auth": {
+    "auth_header_name": "authorization"
+  },
+  "use_keyless": true,
+  "version_data": {
+    "not_versioned": true,
+    "versions": {
+      "Default": {
+        "name": "Default",
+        "expires": "3000-01-02 15:04",
+        "use_extended_paths": true,
+        "extended_paths": {
+          "ignored": [],
+          "white_list": [],
+          "black_list": []
+        }
+      }
+    }
+  },
+  "proxy": {
+    "listen_path": "/quickstart/",
+    "target_url": "http://httpbin.org",
+    "strip_listen_path": true
+  },
+  "custom_middleware_bundle": "bundle-latest.zip"
+}
+```
+
+With the configuration given in the example above, calls to the API will invoke the custom plugins defined in the `manifest.json` file contained within `bundle-latest.zip` uploaded to your remote webserver, e.g. `http://your-example-plugin-server.com/plugins`.
+
+Tyk Gateway should be configured for downloading plugin bundles from a secured web server. Please consult the [plugin bundles](/api-management/plugins/overview#plugin-bundles) documentation for further details.
+
+#### Using API Designer
+
+To configure plugin bundles for Tyk Classic APIs click on the APIs menu item in the *API Management* menu of Dashboard and select your API to display the API editor screen. Subsequently, follow the steps below:
+
+1. **Access plugin options**
+
+    Click on the *Advanced Options* tab and scroll down until the *Plugin Options* section is displayed.
+
+    <img src="/img/plugins/plugins_classic_api_bundles_config.png" alt="Tyk Classic Plugin Options section" />
+
+2. **Enter relative path to bundle file**
+
+    Enter the relative path of the plugin bundle file in the *Plugin Bundle ID* field that Tyk Gateway should download from the web server hosting plugin bundles.
+
+3. **Save the API**
+
+    Select the **save** or **update** button to apply the changes to your API.
+
+### Bundler CLI Tool
+
+The bundler tool is a CLI service, provided by _Tyk Gateway_ as part of its binary since v2.8. This lets you generate
+[plugin bundles](/api-management/plugins/overview#plugin-bundles).
+
+
+<Note>
+Generated plugin bundles must be served using your own web server.
+</Note>
+
+
+Issue the following command to see more details on the `bundle` command:
+
+```bash
+/opt/tyk-gateway/bin/tyk bundle -h
+```
+
+---
+
+#### Prerequisites
+
+To create plugin bundles you will need the following:
+
+- **Manifest.json**: The [manifest.json](/api-management/plugins/overview#manifest) file
+  contains the paths to the plugin source files and the name of the function implementing each plugin. The
+  _manifest.json_ file is mandatory and must exist on the Tyk Gateway file system. By default the bundle CLI looks for
+  a file named _manifest.json_ in the current working directory where the bundle command is run from. The exact location
+  can be specified using the `--manifest` command option.
+- **Plugin source code files**: The plugin source code files should be contained relative to the directory in which the
+  _manifest.json_ file is located. The _manifest.json_ should contain relative path references to source code files.
+
+  
+<Note>
+Source code files are not required when creating a plugin bundle for gRPC plugins since the plugin
+  source code is located at the gRPC server.
+</Note>
+
+
+- **Certificate key**: Plugin bundles can optionally be signed with an RSA private key. The corresponding public key
+  should be located in the file configured in environmental variable `TYK_GW_PUBLICKEYPATH` or the `public_key_path`
+  parameter in `tyk.conf`:
+
+```json
+{
+  "enable_bundle_downloader": true,
+  "bundle_base_url": "http://my-bundle-server.com/bundles/",
+  "public_key_path": "/path/to/my/pubkey.pem"
+}
+```
+
+---
+
+#### Directory Structure
+
+A suggested directory structure is shown below for Golang, Javascript and Python bundles in the tabs below.
+
+
+<Note>
+Sub-directories (folders) are not supported inside the `bundle-directory` location.
+</Note>
+
+
+<Tabs> <Tab title="Golang">
+
+```bash
+/bundle-directory
+├── manifest.json               # Manifest file with plugin references
+└── plugin.so                   # Compiled Golang plugin
+```
+
+</Tab> <Tab title="Javascript">
+
+```bash
+/bundle-directory
+├── manifest.json               # Manifest file with plugin references
+├── plugin1.js                  # First JavaScript plugin source file
+└── plugin2.js                  # Second JavaScript plugin source file
+```
+
+</Tab>
+
+<Tab title="Python">
+
+```bash
+/bundle-directory
+├── manifest.json               # Manifest file with plugin references
+├── plugin1.py                  # First Python plugin source file
+└── plugin2.py                  # Second Python plugin source file
+```
+
+</Tab>
+
+</Tabs>
+
+The `manifest.json` will reference the files located in the `bundle-directory`, ensure plugin source files are organized relative to the manifest. The Tyk Gateway will load and execute these plugins based on the paths defined in the `manifest.json` file.
+
+Sample `manifest.json` is shown below for Golang, Javascript and Python bundles in the tabs below.
+
+<Tabs> <Tab title="Golang">
+
+```json
+{
+  "file_list": [
+    "plugin.so"
+  ],
+  "custom_middleware": {
+    "pre": [
+      {
+        "name": "PreMiddleware",
+        "path": "./plugin.so"
+      }
+    ],
+    "post": [
+      {
+        "name": "PostMiddleware",
+        "path": "./plugin.so"
+      }
+    ],
+    "driver": "goplugin"
+  },
+  "checksum": "",
+  "signature": ""
+}
+
+```
+
+</Tab> <Tab title="Javascript">
+
+```json
+{
+  "file_list": [
+    "plugin1.js",
+    "plugin2.js"
+  ],
+  "custom_middleware": {
+    "pre": [
+      {
+        "name": "PreMiddleware",
+        "path": "./plugin1.js"
+      }
+    ],
+    "post": [
+      {
+        "name": "PostMiddleware",
+        "path": "./plugin2.js"
+      }
+    ],
+    "driver": "otto"
+  },
+  "checksum": "",
+  "signature": ""
+}
+```
+
+</Tab>
+
+<Tab title="Python">
+
+```json
+{
+  "file_list": [
+    "plugin1.py",
+    "plugin2.py"
+  ],
+  "custom_middleware": {
+    "pre": [
+      {
+        "name": "PreMiddleware",
+        "path": "./plugin1.py"
+      }
+    ],
+    "post": [
+      {
+        "name": "PostMiddleware",
+        "path": "./plugin2.py"
+      }
+    ],
+    "driver": "python"
+  },
+  "checksum": "",
+  "signature": ""
+}
+```
+
+</Tab>
+
+</Tabs>
+
+---
+
+#### Creating a plugin bundle
+
+Run the following command to create the bundle:
+
+```bash
+$ tyk bundle build
+```
+
+The resulting file will contain all your specified files and a modified `manifest.json` with the checksum and signature
+(if required) applied, in ZIP format.
+
+By default, Tyk will attempt to sign plugin bundles for improved security. If no private key is specified, the program
+will prompt for a confirmation. Use `-y` to override this (see options below).
+
+---
+
+#### Command Options
+
+Instructions on how to create plugin bundles is displayed by issuing the following command:
+
+```bash
+/opt/tyk-gateway/bin/tyk bundle build -h
+```
+
+The following options are supported:
+
+- `--manifest`: Specifies the path to the manifest file. This defaults to `manifest.json` within the current working
+  directory.
+- `--output`: Specifies the name of the bundle file e.g. `--output bundle-latest.zip`. If this flag is not specified,
+  `bundle.zip` will be used.
+- `-y`: Force tool to create unsigned bundle without prompting e.g. `$ tyk bundle build --output bundle-latest.zip -y`.
+- `--key`: Specifies the path to your private key which is used to generate signed bundle e.g.
+  `$ tyk bundle build --output bundle-latest.zip --key=mykey.pem`.
+
+---
+
+#### Docker Example
+
+Since v5.5 Tyk Gateway uses distroless docker images.
+
+For Gateway version < v5.5 it is possible to use Docker to create plugin bundles as shown in the example below.
+
+```bash
+docker run --rm -it \
+  --name bundler \
+  -v `pwd`:/plugin-source \
+  -v `pwd`/../../../confs/keys:/keys \
+  -w /plugin-source \
+  --entrypoint /bin/bash \
+  tykio/tyk-gateway:v5.4.0 \
+  -c 'export PATH="/opt/tyk-gateway:$$PATH"; tyk bundle build -o bundle.zip -k /keys/key.pem'
+```
+
+This Docker command runs a container using the `tykio/tyk-gateway:v5.4.0` image to build a Tyk plugin bundle. It mounts
+the current directory from the host as `/plugin-source` and a directory containing keys as `/keys` inside the container.
+The working directory within the container is set to `/plugin-source`, and the default entrypoint is overridden to use
+`/bin/bash`. The command executed in the container exports a modified `PATH` to include the Tyk Gateway binaries, then
+runs `tyk bundle build` to generate a plugin bundle named `bundle.zip`, using the specified key for authentication. The
+container is automatically removed after the command completes, and the operation is conducted interactively.
+
+## Supported Languages
+
+The following languages are supported for custom plugins:
+*   [Golang](/api-management/plugins/golang#): A plugin written in Golang is called a **Native Plugin**. Tyk recommends using Go plugins for performance, flexibility, and nativity reasons (all Tyk components are written in Go).
+*   [JavaScript](/api-management/plugins/javascript#): A plugin written in Javascript uses JavaScript Virtual Machine (JSVM) interpreter.
+*   [Rich Plugins](/api-management/plugins/rich-plugins#) includes Python, Lua, gRPC - With gRPC, you can write plugins in Java, .NET, C++ / C#, PHP, and all other [gRPC supported languages](https://grpc.io/docs/languages/).
+Rich plugins give ultimate flexibility in the language of implementation, however, there are some performance and management overheads when compared with native GoLang plugin.
+
+**Common To All Plugin Languages:**
+
+* Make Layer 4 (TCP) or Layer 7 (HTTP/REST/SOAP) calls
+* Open Persistent Connections
+* Modify the request in-flight
+* Used to stop the request and return a [custom response](/api-management/plugins/plugin-types#return-overrides-%2F-returnoverrides)
+* Be served using [Bundles](/api-management/plugins/overview#plugin-deployment-types) or by files on the file system, except gRPC of course which by definition is served by some webserver in the language of your choosing
+
+### Plugin Hook Types
+
+Tyk provide 5 different phases, i.e. hooks to inject custom plugin throughout the [API execution lifecycle](/api-management/traffic-transformation#request-middleware-chain).
+
+Not all hooks are supported in every language. The following table shows you which plugin language support which phase/hook:
+
+|            | Auth   |   Pre    | Post-Auth | Post | Response   
+| :------------ | :-------- | :---------- | :----------- | :------ | :----------- |
+| GoLang     | ✅     |✅	        |✅         |✅    |✅
+| JavaScript | ❌		 |✅	        |❌	       |✅ 	 |❌
+| gRPC       | ✅		 |✅	        |✅	       |✅	   |✅
+| Python     | ✅		 |✅	        |✅	       |✅	   |✅
+| Lua        | ✅	   |✅	        |✅	       |✅	   |❌
+
+More reading on the [hook types](/api-management/plugins/rich-plugins#coprocess-dispatcher-hooks) in rich plugins and explanation with common use case for each [hook type](/api-management/plugins/plugin-types#plugin-types) 
+
+
+### Plugin Driver Names
+
+We use the following Plugin driver names:
+
+| Plugin     | Name      | 
+| :---------- | :--------- |
+| GoLang     | goplugin  |
+| JavaScript | otto      |
+| gRPC       | grpc      |
+| Python 		 | python    |
+| Lua        | lua	     |
+
+### Limitations
+
+What are the limitations to using this programming Language?
+
+|   | GoLang |   JavaScript     | gRPC      | Python    |  Lua   
+| :--- | :-------- | :------------------ | :----------- | :----------- | :----------- |
+| Runs in Gateway process | ✅<br />Runs<br />natively | ✅<br />Built-In JSVM Interpreter | ❌<br />Standalone server	| ✅<br />Tyk talks with Python interpreter	|✅
+| Built-in SDK | ✅<br />All Gateway Functionality | ✅<br />[Yes](/api-management/plugins/javascript#javascript-api)	| ❌	| ✅<br />[Yes](/api-management/plugins/rich-plugins#tyk-python-api-methods)	| ❌
+| TCP Connections<p>(DBs, Redis, etc)</p> | ✅ | ❌<br />Very Limited | ✅ | ✅ | ✅ | 
+
+### Custom Plugin Table
+
+We have put together a [GitHub repo with a table of custom plugins](https://github.com/TykTechnologies/custom-plugins#custom-gateway-plugins) in various languages that you can experiment with. If you would like to submit one that you have developed, feel free to open an issue in the repo.
+
+### Differences between Rich Plugins and JSVM middleware
+
+#### JavaScript
+The JavaScript Virtual Machine provides pluggable middleware that can modify a request on the fly and are designed to augment a running Tyk process, are easy to implement and run inside the Tyk process in a sandboxed *ECMAScript* interpreter. This is good, but there are some drawbacks with the JSVM:
+
+*   **Performance**: JSVM is performant, but is not easy to optimize and is dependent on the [otto interpreter](https://github.com/robertkrimen/otto) - this is not ideal. The JSVM also requires a copy of the interpreter object for each request to be made, which can increase memory footprint.
+*   **Extensibility**: JSVM is a limited interpreter, although it can use some NPM modules, it isn't NodeJS so writing interoperable code (especially with other DBs) is difficult.
+*   **TCP Access**: The JSVM has no socket access so working with DB drivers and directly with Redis is not possible.
+
+#### Rich Plugins
+Rich Plugins can provide replacements for existing middleware functions (as opposed to augmentation) and are designed to be full-blown, optimized, highly capable services. They enable a full customized architecture to be built that integrates with a user's infrastructure.
+
+Rich Plugins bring about the following improvements:
+
+*   **Performance**: Run on STDIN (unix pipes), which are extremely fast and run in their own memory space, and so can be optimized for performance way beyond what the JSVM could offer.
+*   **Extensibility**: By allowing any language to be used so long as GRPC is supported, the extensibility of a CPH is completely open.
+*   **TCP Access**: Because a plugin is a separate process, it can have it's own low-level TCP connections opens to databases and services.
+
+## Plugin Caveats
+
+- Tyk Gateway manages plugins for each API within the same process.
+- For [gRPC plugins](/api-management/plugins/rich-plugins#overview-1), Tyk Gateway can only be configured to integrate with one gRPC server.
+- Javascript plugins only allow Pre and Post Request hooks of the API Request Lifecycle.
+
+
+## Plugins Hub
+
+{/* Want to try and get a design layout setup for this that uses stylesheets from home page to offer similar layout */}
+
+Welcome to the Tyk Plugins Hub, dedicated to providing you with a curated list of resources that showcase how to develop Tyk Plugins. 
+
+[Tyk Plugins](/api-management/plugins/overview#) are a powerful tool that allows you to develop custom middleware that can intercept requests at different stages of the request lifecycle, modifying/transforming headers and body content.
+
+Tyk has extensive support for writing custom plugins using a wide range of languages, most notably: Go, Python, Javascript etc. In fact, plugins can be developed using most languages via *gRPC*.
+
+### Blogs
+
+Selected blogs for plugin development are included below. Further examples are available at the Tyk [website](https://tyk.io/?s=plugin).
+
+1. **[Decoupling micro-services using Message-based RPC](https://medium.com/@asoorm/decoupling-micro-services-using-message-based-rpc-fa1c12409d8f)**
+    
+    - **Summary**: Explains how to write a plugin that intercepts an API request and forwards it to a gRPC server. The gRPC server processes the request and dispatches work to an RabbitMQ message queue. The source code is available in the accompanying [GitHub repository](https://github.com/asoorm/tyk-rmq-middleware)
+
+2. **[How to configure a gRPC server using Tyk](https://tyk.io/blog/how-to-configure-a-grpc-server-using-tyk/)**
+    
+    - **Summary**: Explains how to configure a Python implementation of a gRPC server to add additional logic to API requests. During the request lifecycle, the Tyk-Gateway acts as a gRPC client that contacts the Python gRPC server, providing additional custom logic.
+
+3. **[How to deploy Python plugins in Tyk running On Kubernetes](https://tyk.io/blog/how-to-deploy-python-plugins-in-tyk-running-on-kubernetes/)**
+    
+    - **Summary**: Explains how to deploy a custom Python plugin into a Tyk installation running on a Kubernetes cluster.
+
+### GitHub Repositories
+
+Here are some carefully selected GitHub repositories that will help you learn how to integrate and utilize Tyk Plugins in your development projects:
+
+1. **[Tyk Awesome Plugins](https://github.com/TykTechnologies/tyk-awesome-plugins)**
+
+    - **Description**: Index of plugins developed using a variety of languages.
+    - **Key Features Demonstrated**: A comprehensive index for a collection of plugins that can be used with the Tyk API Gateway in areas such as: rate limiting, authentication and request transformation. The examples are developed using a diverse array of languages, including but not limited to: Python, JavaScript and Go. This broad language support ensures that developers from different backgrounds and with various language preferences can seamlessly integrate these plugins with their Tyk API Gateway implementations.
+
+2. **[Custom Plugin Examples](https://github.com/TykTechnologies/custom-plugin-examples/tree/master)**
+
+    - **Description**: Index of examples for a range of plugin hooks (Pre, Post, Post-Auth and Response) developed using a variety of languages.
+    - **Key Features Demonstrated**: Specific examples include invoking an AWS lambda, inserting a new claim into a JWT, inject a signed JWT into authorization header, request header modification. A range of examples are available including Python, Java, Ruby, Javascript, NodeJS and Go.
+
+3. **[Environment For Plugin Development](https://github.com/TykTechnologies/custom-go-plugin)**
+
+    - **Description**: Provides a docker-compose environment for developing your own custom Go plugins.
+    - **Key Features Demonstrated**: Showcases support for bundling plugins, uploading plugins to AWS S3 storage, test coverage etc.
+
+
diff --git a/api-management/plugins/plugin-types.mdx b/api-management/plugins/plugin-types.mdx
new file mode 100644
index 0000000000..4af1153df3
--- /dev/null
+++ b/api-management/plugins/plugin-types.mdx
@@ -0,0 +1,724 @@
+---
+title: "Plugin Types"
+description: "Understand the different types of custom plugins and execution hooks available in the Tyk middleware chain"
+keywords: "Dashboard, User Management, RBAC, Role Based Access Control, User Groups, Teams, Permissions, API Ownership, SSO, Single Sing On, Multi Tenancy"
+sidebarTitle: "Plugin Types"
+---
+
+## Introduction
+
+Custom Plugins enable users to execute custom code to complete tasks specific to their use case, allowing users to complete tasks that would not otherwise be possible using Tyk’s standard middleware options. 
+
+Tyk has a [pre-defined execution order](/api-management/traffic-transformation#request-middleware-chain) for the middleware which also includes **seven hooks** for the custom plugins. As such, users can execute, or `hook`, their plugin in these phases of the API request/response lifecycle based on their specific use case.
+
+## Plugin and Hook Types
+This table includes all the plugin types with the relevant hooks, their place in the execution chain, description and examples:
+
+| Hook Type (in their execution order) | Plugin Type | HTTP Request/Response phase | Executed before/after reverse proxy to the upstream API | Details | Common Use Cases |  
+|--------------------------|----|---|--------------|--------------------|---------
+| Pre (Request) | Request Plugin |  HTTP request | Before | The first thing to be executed, before any middleware  | IP Rate Limit plugins,  API Request enrichment      |
+| Authentication| Authentication Plugin |  HTTP request | Before | Replaces Tyk's authentication & authorization middleware with your own business logic |  When you need your a custom flow, for example, interfacing with legacy Auth database |
+| Post-Auth (Request)| Authentication Plugin |  HTTP request | Before | Executed immediately after authentication middleware  | Additional special custom authentication is needed |
+| Post (Request)| Request Plugin  |  HTTP request| Before | The final middleware to be executed during the *HTTP request* phase (see **Note** below)  | Update the request before it gets to the upstream, for example, adding a header that might override another header, so we add it at the end to ensure it doesn't get overridden |
+| Response Plugin| Response Plugin |  HTTP Response | After | Executed after the reverse proxy to the upstream API | Executed straight after the reverse proxy returns from the upstream API to Tyk  |  Change the response before the user gets it, for example, change `Location` header from internal to an external URL |
+| Analytics Plugin (Request+Response)| Analytics Plugin | HTTP request | After | The final middleware to be executed during the *HTTP response* phase  | Change analytics records, for example, obfuscating sensitive data such as the `Authorization` header |
+
+
+<Note>
+There are two different options for the <b>Post</b> Plugin that is executed at the end of the request processing chain. The API-level Post Plugin is applied to all requests, whilst the [endpoint-level](/api-management/plugins/plugin-types#per-endpoint-custom-plugins) custom Golang plugin is only applied to requests made to specific endpoints. If both are configured, the endpoint-level plugin will be executed first.
+</Note>
+
+
+## Plugin Types
+
+Tyk supports four types of plugins:
+
+1. **[Request Plugin](#request-plugins)**
+2. **[Authentication Plugin](#authentication-plugins)**
+3. **[Response Plugin](#response-plugins)**
+4. **[Analytics Plugin](#analytics-plugins)**
+
+## Request Plugins
+
+There are 4 different phases in the [request lifecycle](/api-management/traffic-transformation#request-middleware-chain) you can inject custom plugins, including [Authentication plugins](/api-management/plugins/plugin-types#authentication-plugins).  There are performance advantages to picking the correct phase, and of course that depends on your use case and what functionality you need.
+
+### Hook Capabilities
+| Functionality           |   Pre    |  Auth       | Post-Auth |    Post   |
+| :------------------------- | :---------- | :------------- | :----------- | :----------- |
+| Can modify the Header   | ✅       | ✅          | ✅       | ✅  
+| Can modify the Body     | ✅       | ✅          | ✅       |✅
+| Can modify Query Params | ✅       | ✅          | ✅       |✅
+| Can view Session<sup>1</sup> Details (metadata, quota, context-vars, tags, etc)  |   ❌       | ✅          |✅          |✅
+| Can modify Session<sup>1</sup> <sup>2</sup> |    ❌      | ✅          |    ❌      |❌
+| Can Add More Than One<sup>3</sup> |    ✅      |        ❌   |✅          | ✅
+
+1. A [Session](/api-management/access-control/sessions-and-keys/understanding-sessions) contains allowances and identity information that is unique to each requestor
+
+2. You can modify the session by using your programming language's SDK for Redis. Here is an [example](https://github.com/TykTechnologies/custom-plugins/blob/master/plugins/go-auth-multiple_hook_example/main.go#L135) of doing that in Golang.
+
+3. For select hook locations, you can add more than one plugin.  For example, in the same API request, you can have 3 Pre, 1 auth, 5 post-auth, and 2 post plugins.
+
+### Return Overrides / ReturnOverrides  
+You can have your plugin finish the request lifecycle and return a response with custom  payload & headers to the requestor.
+
+[Read more here](/api-management/plugins/rich-plugins#returnoverrides)
+
+##### Python Example
+
+```python
+from tyk.decorators import *
+
+@Hook
+def MyCustomMiddleware(request, session, spec):
+    print("my_middleware: MyCustomMiddleware")
+    request.object.return_overrides.headers['content-type'] = 'application/json'
+    request.object.return_overrides.response_code = 200
+    request.object.return_overrides.response_error = "{\"key\": \"value\"}\n"
+    return request, session
+```
+
+##### JavaScript Example
+```javascript
+var testJSVMData = new TykJS.TykMiddleware.NewMiddleware({});
+
+testJSVMData.NewProcessRequest(function(request, session, config) {
+	request.ReturnOverrides.ResponseError = "Foobarbaz"
+    request.ReturnOverrides.ResponseBody = "Foobar"
+	request.ReturnOverrides.ResponseCode = 200
+	request.ReturnOverrides.ResponseHeaders = {
+		"X-Foo": "Bar",
+		"X-Baz": "Qux"
+	}
+	return testJSVMData.ReturnData(request, {});
+});
+```
+
+
+## Authentication Plugins
+
+If you have unique authentication requirements, you can write a custom authentication plugin.
+
+### Session Authentication and Authorization
+
+A very important thing to understand when using custom authentication plugins is that Tyk will continue to perform session authentication and authorization using the information returned by your plugin. Tyk will cache this Session information. **This is necessary in order to do things like rate limiting, access control, quotas, throttling, etc.**
+
+Tyk will try to be clever about what to cache, but we need to help it. There are two ways to do that, with and without the `ID Extractor`.
+
+#### The ID Extractor 
+
+The ID Extractor is a caching mechanism that's used in combination with Tyk Plugins. It can be used specifically with plugins that implement custom authentication mechanisms. The ID Extractor works for all rich plugins: gRPC-based plugins, Python and Lua.
+
+See [ID Extractor](/api-management/plugins/plugin-types#plugin-caching-mechanism) for more details.
+
+#### Token Metadata
+
+Tyk creates an in-memory object to track the rate limit, quotas, and more for each session. 
+
+This is why we set the `token` metadata when using custom authentication middleware, in order to give Tyk a unique ID with which to track each session.
+
+For backwards compatibility, even when using an ID Extractor, we need to continue to set the `token` metadata.  For example, when building a session object in GoLang custom middleware:
+
+```{.copyWrapper}
+object.Session = &coprocess.SessionState{
+        LastUpdated: time.Now().String(),
+        Rate: 5,
+        Per:  10,
+        QuotaMax:            int64(0),
+        QuotaRenews:         time.Now().Unix(),
+        IdExtractorDeadline: extractorDeadline,
+        Metadata: map[string]string{
+            "token": "my-unique-token",
+        },
+        ApplyPolicies: ["5d8929d8f56e1a138f628269"],
+    }
+```
+[source](https://github.com/TykTechnologies/tyk-grpc-go-basicauth-jwt/blob/master/main.go#L102)
+
+#### Without ID Extractor
+
+When not using ID Extractor, Tyk will continue to cache authenticated sessions returned by custom auth plugins. We must set a unique `token` field in the Metadata (see above) that Tyk will use to cache.
+
+### Supported Languages 
+
+The following languages are supported for custom authentication plugins:
+
+- All Rich Plugins (gRPC, Python, Lua)
+- GoLang
+
+See the [supported languages](/api-management/plugins/overview#supported-languages) section for custom authentication plugin examples in a language of your choosing. There's also a [blog that walks you through setting up gRPC custom auth in Java](https://tyk.io/blog/how-to-setup-custom-authentication-middleware-using-grpc-and-java/).
+
+### Tyk Operator
+
+Please consult the Tyk Operator supporting documentation for examples of how to configure a Tyk Operator API to use:
+
+- [Go custom authentication plugin](/tyk-stack/tyk-operator/create-an-api#custom-plugin-auth-go)
+- [gRPC custom authentication plugin](/tyk-stack/tyk-operator/create-an-api#custom-plugin-auth-grpc)
+
+## Response Plugins
+
+Since Tyk 3.0 we have incorporated response hooks, this type of hook allows you to modify the response object returned by the upstream. The flow is follows:
+
+- Tyk receives the request.
+- Tyk runs the full middleware chain, including any other plugins hooks like Pre, Post, Custom Authentication, etc.
+- Tyk sends the request to your upstream API.
+- The request is received by Tyk and the response hook is triggered.
+- Your plugin modifies the response and sends it back to Tyk.
+- Tyk takes the modified response and is received by the client.
+
+This snippet illustrates the hook function signature:
+
+```python
+@Hook
+def ResponseHook(request, response, session, metadata, spec):
+    tyk.log("ResponseHook is called", "info")
+    # In this hook we have access to the response object, to inspect it, uncomment the following line:
+    # print(response)
+    tyk.log("ResponseHook: upstream returned {0}".format(response.status_code), "info")
+    # Attach a new response header:
+    response.headers["injectedkey"] = "injectedvalue"
+    return response
+```
+
+If working with a Tyk Classic API, you would add this configuration to the API definition:
+
+```
+{
+    "custom_middleware": {
+        "response": [
+            {
+                "name": "ResponseHook",
+                "path": "middleware/middleware.py"
+            }
+        ],
+        "driver": "python"
+    }
+}
+```
+
+ - `driver`: set this to the appropriate value for the plugin type (e.g. `python`, `goplugin`)
+ - `response`: this is the hook name. You use middleware with the `response` hook type because you want this custom middleware to process the request on its return leg of a round trip.
+ - `response.name`: is your function name from the plugin file.
+ - `response.path`: is the full or relative (to the Tyk binary) path to the plugin source file. Ensure Tyk has read access to this file.
+
+Starting from versions 5.0.4 and 5.1.1+ for our Go, Python and Ruby users we have introduced the `multivalue_headers` field to facilitate more flexible and efficient management of headers, particularly for scenarios involving a single header key associated with multiple values.  The `multivalue_headers` field, similar to its predecessor, the `headers` field, is a key-value store. However, it can accommodate an array or list of string values for each key, instead of a single string value. This feature empowers you to represent multiple values for a single header key. Here's an example of how you might use `multivalue_headers`, using the Set-Cookie header which often has multiple values:
+
+```
+multivalue_headers = {
+    "Set-Cookie": ["sessionToken=abc123; HttpOnly; Secure", "language=en-US; Secure"],
+}
+```
+
+In this example, Set-Cookie header has two associated values: `"sessionToken=abc123; HttpOnly; Secure"` and `"language=en-US; Secure"`.  To help you understand this further, let's see how `multivalue_headers` can be used in a Tyk response plugin written in Python:
+
+```python
+from tyk.decorators import *
+from gateway import TykGateway as tyk
+
+@Hook
+def Del_ResponseHeader_Middleware(request, response, session, metadata, spec):
+    # inject a new header with 2 values
+    new_header = response.multivalue_headers.add()
+    new_header.key = "Set-Cookie"
+    new_header.values.extend("sessionToken=abc123; HttpOnly; Secure")
+    new_header.values.extend("language=en-US; Secure")
+    
+    tyk.log(f"Headers content :\n {response.headers}\n----------", "info")
+    tyk.log(f"Multivalue Headers updated :\n {response.multivalue_headers}\n----------", "info")
+    
+    return response
+```
+
+In this script, we add 2 values for the `Set-Cookie` header and then log both: the traditional `headers` and the new `multivalue_headers`. This is a great way to monitor your transition to `multivalue_headers` and ensure that everything is functioning as expected.
+
+Please note, while the `headers` field will continue to be available and maintained for backward compatibility, we highly encourage the adoption of `multivalue_headers` for the added flexibility in handling multiple header values.
+
+### Go response plugins
+
+[Go response plugins](/api-management/plugins/golang#creating-a-custom-response-plugin) have been available since Tyk v3.2.
+
+### Supported Response Plugin Languages
+
+See [Supported Plugins](/api-management/plugins/overview#supported-languages) for details on which languages the response plugin is supported in.
+
+## Analytics Plugins
+
+Since Tyk 4.1.0 we have incorporated analytic plugins which enables editing or removal of all parts of analytics records and raw request and responses recorded by Tyk at the gateway level. This feature leverages existing Go plugin infrastructure.
+
+- Tyk receives the request.
+- Tyk runs the full middleware chain, including any other plugins hooks like Pre, Post, Custom Authentication, etc.
+- Tyk sends the request to your upstream API.
+- The response is received and analytics plugin function is triggered before recording the hit to redis.
+- Your plugin modifies the analytics record and sends it back to Tyk.
+- Tyk takes the modified analytics record and record the hit in redis.
+
+Example analytics Go plugins can be found [here](https://github.com/TykTechnologies/tyk/blob/master/test/goplugins/test_goplugin.go#L149)
+
+An analytics plugin is configured using the `analytics_plugin` configuration block within an API Definition. This contains the following configuration parameters:
+
+- `enable`: Set to `true` to enable the plugin
+- `func_name`: The name of the function representing the plugin
+- `plugin_path`: The path to the source code file containing the function that implements the plugin
+
+<Tabs>
+
+<Tab title="Tyk Gateway">
+
+To enable the analytics rewriting functionality, adjust the following in API definition:
+
+```json
+{
+    "analytics_plugin": {
+        "enable": true,
+        "func_name": "<function name>",
+        "plugin_path": "<path>/analytics_plugin.so"
+    }
+}
+```
+
+</Tab>
+
+<Tab title="Tyk Operator">
+
+The example API Definition resource listed below listens on path */httpbin* and forwards requests upstream to *http://httpbin.org*. A Go Analytics Plugin is enabled for function *MaskAnalyticsData*, located within the */opt/tyk-gateway/plugins/example-plugin.so* shared object file.
+
+```yaml {linenos=table,hl_lines=["15-18"],linenostart=1}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: analytics-plugin
+spec:
+  name: httpbin-analytics-plugin
+  active: true
+  protocol: http
+  proxy:
+    listen_path: /httpbin
+    strip_listen_path: true
+    target_url: http://httpbin.org
+  use_keyless: true
+  enable_detailed_recording: true
+  analytics_plugin:
+    enable: true
+    func_name: MaskAnalyticsData # Replace it with function name of your plugin
+    plugin_path: /opt/tyk-gateway/plugins/example-plugin.so  # Replace it with path of your plugin file
+```
+
+</Tab>
+
+</Tabs>
+
+<br />
+
+## Advance Configuration
+
+There are two advance configuratin with plugin types:
+
+1. **[Per Endpoint Custom Plugin](#per-endpoint-custom-plugins)**
+2. **[Plugin Caching Mechanism for Authentication Plugin](#plugin-caching-mechanism)**
+
+## Per-Endpoint Custom Plugins
+
+Tyk's custom plugin architecture allows you to deploy custom logic that will be invoked at certain points in the [middleware chain](/api-management/traffic-transformation#request-middleware-chain) as Tyk processes requests to your APIs.
+
+At the API-level, there are several points in the processing flow where custom plugins can be "hooked", as explained [here](/api-management/plugins/plugin-types#plugin-types). Each of these will be invoked for calls to any endpoint on an API. If you want to perform custom logic only for specific endpoints, you must include selective processing logic within the plugin.
+
+At the endpoint-level, Tyk provides the facility to attach a custom Golang plugin at the end of the request processing chain (immediately before the API-level post-plugin is executed).
+
+### When to use the per-endpoint custom plugin
+
+##### Aggregating data from multiple services
+
+From a custom plugin, you can make calls out to other internal and upstream APIs. You can then aggregate and process the responses, returning a single response object to the originating client. This allows you to configure a single externally facing API to simplify interaction with multiple internal services, leaving the heavy lifting to Tyk rather than standing up an aggregation service within your stack.
+
+##### Enforcing custom policies
+
+Tyk provides a very flexible middleware chain where you can combine functions to implement the access controls you require to protect your upstream services. Of course, not all scenarios can be covered by Tyk’s standard middleware functions, but you can use a custom plugin to apply whatever custom logic you require to optimize your API experience.
+
+##### Dynamic Routing
+
+With a custom plugin you can implement complex dynamic routing of requests made to a single external endpoint on to different upstream services. The flexibility of the virtual endpoint gives access to data within the request (including the key session) and also the ability to make calls to other APIs to make decisions on the routing of the request. It can operate as a super-powered URL rewrite middleware.
+
+### How the per-endpoint custom plugin works
+
+Tyk Gateway is written using Golang. This has a flexible plugin architecture which allows for custom code to be compiled separately from the gateway and then invoked natively by the gateway. When registering a custom Go plugin in the API definition, you must provide the location of the compiled plugin and also the name of the function to be invoked within that package. 
+
+Go plugins must therefore be [compiled](/api-management/plugins/golang#plugin-compiler) and [loaded](/api-management/plugins/golang#loading-custom-go-plugins-into-tyk) into the Gateway in order that the function named in the plugin configuration in the API definition can be located and executed at the appropriate stage in the request middleware processing chain.
+
+The custom code within the plugin has access to contextual data such as the session object and API definition. If required, it can [terminate the request](/api-management/plugins/golang#terminating-the-request) and hence can provide a [Virtual Endpoint](/api-management/traffic-transformation/virtual-endpoints) style capability using the Go language, rather than JavaScript (as supported by the virtual endpoint middleware). This can then act as a high-performance replacement for the JavaScript virtual endpoints or for cases when you want to make use of external libraries.
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ ## Ignore Authentication middleware summary
+  - The Per-Endpoint Custom Plugin is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Per-Endpoint Custom Plugin can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+### Using the Per-Endpoint Plugin with Tyk OAS APIs
+
+The [per-endpoint custom plugin](/api-management/plugins/plugin-types#per-endpoint-custom-plugins) provides the facility to attach a custom Go plugin at the end of the request processing chain.
+This plugin allows you to add custom logic to the processing flow for the specific endpoint without adding to the processing complexity of other endpoints.
+It can [terminate the request](/api-management/plugins/golang#terminating-the-request) if required,
+and provides a [Virtual Endpoint](/api-management/traffic-transformation/virtual-endpoints) style capability using the Go language, rather than JavaScript (as supported by the virtual endpoint middleware).
+
+The middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](/api-management/plugins/plugin-types#using-the-per-endpoint-plugin-with-tyk-classic-apis) page.
+
+#### Using Tyk OAS API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. The `path` can contain wildcards in the form of any string bracketed by curly braces, for example `{user_id}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The endpoint plugin middleware (`postPlugins`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `postPlugins` object has the following configuration:
+
+- `enabled`: enable the middleware for the endpoint
+- `functionName`: this is the name of the Go function that will be executed when the middleware is triggered
+- `path`: the relative path to the source file containing the compiled Go code
+
+You can chain multiple plugin functions in an array. Tyk will process them in the order they appear in the API definition.
+
+For example:
+
+```json {hl_lines=["39-45"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-endpoint-plugin",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-endpoint-plugin",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },          
+        "server": {
+            "listenPath": {
+                "value": "/example-endpoint-plugin/",                
+                "strip": true
+            }
+        },      
+        "middleware": {
+            "operations": {
+                "anythingget": {
+                    "postPlugins": [
+                        {
+                            "enabled": true,
+                            "functionName": "myUniqueFunctionName",
+                            "path": "/middleware/myPlugin.so"
+                        }
+                    ]
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the per-endpoint custom plugin middleware has been configured for HTTP `GET` requests to the `/anything` endpoint. For any call made to this endpoint, Tyk will invoke the function `myUniqueFunctionName` in the file located at `/middleware/myPlugin.so`.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the per-endpoint custom plugin middleware.
+
+#### Using API Designer
+
+Adding a per-endpoint custom plugin to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Go Post-Plugin middleware**
+
+    Select **ADD MIDDLEWARE** and choose **Go Post-Plugin** from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-go-plugin.png" alt="Adding the Go Post-Plugin middleware" />
+
+3. **Configure the middleware**
+
+    You must provide the path to the compiled plugin and the name of the Go function that should be invoked by Tyk Gateway when the middleware is triggered.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-go-plugin-config.png" alt="Configuring the per-endpoint custom plugin" />
+
+4. **Save the API**
+
+    Select **ADD MIDDLEWARE** to save the middleware configuration. Remember to select **SAVE API** to apply the changes.
+
+
+
+    <Note>
+    You are only able to add one custom plugin to each endpoint when using the API Designer, however you can add more by editing the API definition directly in the Raw Definition editor.
+    </Note>
+
+
+### Using the Per-Endpoint Plugin with Tyk Classic APIs
+
+The [per-endpoint custom plugin](/api-management/plugins/plugin-types#per-endpoint-custom-plugins) provides the facility to attach a custom Golang plugin at the end of the request processing chain.
+This plugin allows you to add custom logic to the processing flow for the specific endpoint without adding to the processing complexity of other endpoints.
+It can [terminate the request](/api-management/plugins/golang#terminating-the-request), if required,
+and hence can provide a [Virtual Endpoint](/api-management/traffic-transformation/virtual-endpoints) style capability using the Go language, rather than JavaScript (as supported by the virtual endpoint middleware).
+
+This middleware is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](/api-management/plugins/plugin-types#using-the-per-endpoint-plugin-with-tyk-oas-apis) page.
+
+#### Using Tyk Classic API Definition
+
+To enable the middleware you must add a new `go_plugin` object to the `extended_paths` section of your API definition.
+
+The `go_plugin` object has the following configuration:
+
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+- `func_name`: this is the "symbol" or function name you are calling in your Go plugin once loaded - a function can be called by one or more APIs
+- `plugin_path`: the relative path of the shared object containing the function you wish to call, one or many `.so` files can be called
+
+You can register multiple plugin functions for a single endpoint. Tyk will process them in the order they appear in the API definition.
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "go_plugin": [
+            {
+                "disabled": false,
+                "path": "/anything",
+                "method": "GET",
+                "plugin_path": "/middleware/myPlugin.so",
+                "func_name": "myUniqueFunctionName"
+            }
+        ]
+    }
+}
+```
+
+In this example the per-endpoint custom plugin middleware has been configured for HTTP `GET` requests to the `/anything` endpoint. For any call made to this endpoint, Tyk will invoke the function `myUniqueFunctionName` in the file located at `/middleware/myPlugin.so`.
+
+#### Using API Designer
+
+You can use the API Designer in the Tyk Dashboard to add the per-endpoint custom plugin middleware for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to trigger the custom plugin function. Select the **Go Plugin** plugin.
+
+    <img src="/img/dashboard/endpoint-designer/endpointplugin.png" alt="Selecting the middleware" />
+
+2. **Locate the middleware in the raw API definition**
+
+    Once you have selected the middleware for the endpoint, you need to switch to the *Raw Definition* view and then locate the `go_plugin` section (you can search within the text editor window).
+
+    <img src="/img/dashboard/endpoint-designer/endpointplugin_search.png" alt="Locating the middleware configuration" />
+
+3. **Configure the middleware**
+
+    Now you can directly edit the `plugin_path` and `func_name` to locate your compiled plugin function.
+
+    <img src="/img/dashboard/endpoint-designer/endpointplugin_config.png" alt="Configuring the middleware" />
+
+4. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+## Plugin Caching Mechanism
+
+The **ID extractor** is a caching mechanism that's used in combination with Tyk Plugins. It is used specifically with plugins that implement **custom authentication mechanisms**.
+
+We use the term `ID` to describe any key that's used for authentication purposes.
+
+When a custom authentication mechanism is used, every API call triggers a call to the associated middleware function, if you're using a gRPC-based plugin this translates into a gRPC call. If you're using a native plugin -like a Python plugin-, this involves a Python interpreter call.
+
+The ID extractor works the following rich plugins: gRPC-based plugins, Python and Lua.
+
+### When to use the ID Extractor?
+
+The main idea of the ID extractor is to reduce the number of calls made to your plugin and cache the API keys that have been already authorized by your authentication mechanism. This means that after a successful authentication event, subsequent calls will be handled by the Tyk Gateway and its Redis cache, resulting in a performance similar to the built-in authentication mechanisms that Tyk provides.
+
+### When does the ID Extractor Run?
+
+When enabled, the ID extractor runs right before the authentication step, allowing it to take control of the flow and decide whether to call your authentication mechanism or not.
+
+If my ID is cached by this mechanism and my plugin isn't longer called, how do I expire it?
+When you implement your own authentication mechanism using plugins, you initialise the session object from your own code. The session object has a field that's used to configure the lifetime of a cached ID, this field is called `id_extractor_deadline`. See [Plugin Data Structures](/api-management/plugins/rich-plugins#rich-plugins-data-structures) for more details. 
+The value of this field should be a UNIX timestamp on which the cached ID will expire, like `1507268142958`. It's an integer.
+
+For example, this snippet is used in a NodeJS plugin, inside a custom authentication function:
+
+```
+// Initialize a session state object
+  var session = new tyk.SessionState()
+  // Get the current UNIX timestamp
+  var timestamp = Math.floor( new Date() / 1000 )
+  // Based on the current timestamp, add 60 seconds:
+  session.id_extractor_deadline = timestamp + 60
+  // Finally inject our session object into the request object:
+  Obj.session = session
+```
+
+If you already have a plugin that implements a custom authentication mechanism, appending the `id_extractor_deadline` and setting its value is enough to activate this feature.
+In the above sample, Tyk will cache the key for 60 seconds. During that time any requests that use the cached ID won't call your plugin.
+
+### How to enable the ID Extractor
+
+The ID extractor is configured on a per API basis.
+The API should be a protected one and have the `enable_coprocess_auth` flag set to true, like the following definition:
+
+```json
+{
+  "name": "Test API",
+  "api_id": "my-api",
+  "org_id": "my-org",
+  "use_keyless": false,
+  "auth": {
+      "auth_header_name": "Authorization"
+  },
+  "proxy": {
+      "listen_path": "/test-api/",
+      "target_url": "http://httpbin.org/",
+      "strip_listen_path": true
+  },
+  "enable_coprocess_auth": true,
+  "custom_middleware_bundle": "bundle.zip"
+}
+```
+
+If you're not using the Community Edition, check the API settings in the dashboard and make sure that "Custom Auth" is selected.
+
+The second requirement is to append an additional configuration block to your plugin manifest file, using the `id_extractor` key:
+
+```json
+{
+  "custom_middleware": {
+    "auth_check": { "name": "MyAuthCheck" },
+    "id_extractor": {
+      "extract_from": "header",
+      "extract_with": "value",
+      "extractor_config": {
+        "header_name": "Authorization"
+      }
+    },
+    "driver": "grpc"
+  }
+}
+```
+
+*   `extract_from` specifies the source of the ID to extract.
+*   `extract_with` specifies how to extract and parse the extracted ID.
+*   `extractor_config` specifies additional parameters like the header name or the regular expression to use, this is different for every choice, see below for more details.
+
+
+### Available ID Extractor Sources
+
+#### Header Source
+
+Use this source to extract the key from a HTTP header. Only the name of the header is required:
+
+```json
+{
+  "id_extractor": {
+    "extract_from": "header",
+    "extract_with": "value",
+    "extractor_config": {
+      "header_name": "Authorization"
+    }
+  }
+}
+```
+
+#### Form source
+
+Use this source to extract the key from a submitted form, where `param_name` represents the key of the submitted parameter:
+
+
+```json
+{
+  "id_extractor": {
+    "extract_from": "form",
+    "extract_with": "value",
+    "extractor_config": {
+      "param_name": "my_param"
+    }
+  }
+}
+```
+
+
+### Available ID Extractor Modes
+
+#### Value Extractor
+
+Use this to take the value as its present. This is commonly used in combination with the header source:
+
+```json
+{
+  "id_extractor": {
+    "extract_from": "header",
+    "extract_with": "value",
+    "extractor_config": {
+      "header_name": "Authorization"
+    }
+  }
+}
+```
+
+#### Regular Expression Extractor
+
+Use this to match the ID with a regular expression. This requires additional parameters like `regex_expression`, which represents the regular expression itself and `regex_match_index` which is the item index:
+
+```json
+{
+  "id_extractor": {
+    "extract_from": "header",
+    "extract_with": "regex",
+    "extractor_config": {
+      "header_name": "Authorization",
+      "regex_expression": "[^-]+$",
+      "regex_match_index": 0
+    }
+  }
+}
+```
+
+Using the example above, if we send a header like `prefix-d28e17f7`, given the regular expression we're using, the extracted ID value will be `d28e17f7`.
+
+### Example Session
+Here's an example of a Session being built in GoLang custom middleware:
+```{.copyWrapper}
+extractorDeadline := time.Now().Add(time.Second * 5).Unix()
+object.Session = &coprocess.SessionState{
+
+        LastUpdated: time.Now().String(),
+        Rate: 5,
+        Per:  10,
+        QuotaMax:            int64(0),
+        QuotaRenews:         time.Now().Unix(),
+        Metadata: map[string]string{
+            "token": "my-unique-token",
+        },
+        ApplyPolicies: ["5d8929d8f56e1a138f628269"],
+    }
+```
+[source](https://github.com/TykTechnologies/tyk-grpc-go-basicauth-jwt/blob/master/main.go#L102)
+
+Note: When using an ID Extractor, you must set a `LastUpdated` or else token updates will not be applied.  If you don't set an ID Extractor, Tyk will store session information in the cache based off the `token` field that is set in the metadata.
+
diff --git a/api-management/plugins/rich-plugins.mdx b/api-management/plugins/rich-plugins.mdx
new file mode 100644
index 0000000000..d2956f5323
--- /dev/null
+++ b/api-management/plugins/rich-plugins.mdx
@@ -0,0 +1,3533 @@
+---
+title: "Rich Plugins"
+description: "Learn how to write powerful custom middleware for Tyk using Python, Lua, or gRPC-supported languages"
+sidebarTitle: "Rich Plugins"
+---
+
+import GrpcInclude from '/snippets/grpc-include.mdx';
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+## Introduction
+
+Rich plugins make it possible to write powerful middleware for Tyk. Tyk supports: 
+
+*   [Python](/api-management/plugins/rich-plugins#overview)
+*   [gRPC](/api-management/plugins/rich-plugins#overview-1)
+*   [Lua](/api-management/plugins/rich-plugins#using-lua)
+
+gRPC provides the ability to write plugins using many languages including C++, Java, Ruby and C#.
+
+The dynamically built Tyk binaries can expose and call Foreign Function Interfaces in guest languages that extend the functionality of a gateway process.
+
+The plugins are able to directly call some Tyk API functions from within their guest language. They can also be configured so that they hook into various points along the standard middleware chain.
+
+
+<Note>
+When using Python plugins, the middleware function names are set globally. So, if you include two or more plugins that implement the same function, the last declared plugin implementation of the function will be returned. We plan to add namespaces in the future.
+</Note>
+
+
+## How do rich plugins work ?
+
+### ID Extractor & Auth Plugins
+
+The ID Extractor is a caching mechanism that's used in combination with Tyk Plugins. It can be used specifically with plugins that implement custom authentication mechanisms. The ID Extractor works for all rich plugins: gRPC-based plugins, Python and Lua.
+
+See [ID Extractor](/api-management/plugins/plugin-types#plugin-caching-mechanism) for more details.
+
+### Interoperability
+
+This feature implements an in-process message passing mechanism, based on [Protocol Buffers](https://developers.google.com/protocol-buffers/), any supported languages should provide a function to receive, unmarshal and process this kind of messages.
+
+The main interoperability task is achieved by using [cgo](https://golang.org/cmd/cgo/) as a bridge between a supported language -like Python- and the Go codebase.
+
+Your C bridge function must accept and return a `CoProcessMessage` data structure like the one described in [`api.h`](https://github.com/TykTechnologies/tyk/blob/master/coprocess/api.h), where `p_data` is a pointer to the serialised data and `length` indicates the length of it.
+
+```{.copyWrapper}
+struct CoProcessMessage {
+  void* p_data;
+  int length;
+};
+```
+
+The unpacked data will hold the actual `CoProcessObject` data structure.
+
+- `HookType` - the hook type (see below)
+- `Request`  - the HTTP request
+- `Session`  - the client's [Session](/api-management/access-control/sessions-and-keys/understanding-sessions).
+- `Metadata`  - the metadata from the session data above (key/value string map).
+- `Spec`     - the API specification data. Currently organization ID, API ID and config_data.
+
+```{.copyWrapper}
+type CoProcessObject struct {
+  HookType string
+  Request  CoProcessMiniRequestObject
+  Session  SessionState
+  Metadata map[string]string
+  Spec     map[string]string
+}
+```
+
+### Coprocess Dispatcher
+
+`Coprocess.Dispatcher` describes a very simple interface for implementing the dispatcher logic, the required methods are: `Dispatch`, `DispatchEvent` and `Reload`.
+
+`Dispatch` accepts a pointer to a struct `CoProcessObject` (as described above) and must return an object of the same type. This method is called for every configured hook on every request.
+Typically, it performs a single function call in the target language (such as `Python_DispatchHook` in `coprocess_python`), where the corresponding logic is handled—mainly because different languages have different ways of loading, referencing, or calling middleware.
+
+`DispatchEvent` provides a way of dispatching Tyk events to a target language. This method doesn't return any variables but does receive a JSON-encoded object containing the event data. For extensibility purposes, this method doesn't use Protocol Buffers, the input is a `[]byte`, the target language will take this (as a `char`) and perform the JSON decoding operation.
+
+`Reload` is called when triggering a hot reload, this method could be useful for reloading scripts or modules in the target language.
+
+### Coprocess Dispatcher - Hooks
+
+This component is in charge of dispatching your HTTP requests to the custom middleware. The list, from top to bottom, shows the order of execution. The dispatcher follows the standard middleware chain logic and provides a simple mechanism for "hooking" your custom middleware behavior, the supported hooks are:
+
+*   **Pre**: gets executed before the request is sent to your upstream target and before any authentication information is extracted from the header or parameter list of the request. When enabled, this applies to both keyless and protected APIs.
+*   **AuthCheck**: gets executed as a custom authentication middleware, instead of the standard ones provided by Tyk. Use this to provide your own authentication mechanism.
+*   **PostKeyAuth**: gets executed right after the authentication process.
+*   **Post**: gets executed after the authentication, validation, throttling, and quota-limiting middleware has been executed, just before the request is proxied upstream. Use this to post-process a request before sending it to your upstream API. This is only called when using protected APIs. If you want to call a hook after the authentication but before the validation, throttling and other middleware, see **PostKeyAuth**.
+*   **Response**: gets executed after the upstream API replies. The arguments passed to this hook include both the request and response data. Use this to modify the HTTP response before it's sent to the client. This hook also receives the request object, the session object, the metadata and API definition associated with the request.
+
+
+
+    <Note>
+    Response hooks are not available for native Go plugins. Python and gRPC plugins are supported.
+    </Note>
+
+
+
+### Coprocess Gateway API
+
+[`coprocess_api.go`](https://github.com/TykTechnologies/tyk/tree/master/coprocess) provides a bridge between the Gateway API and C. Any function that needs to be exported should have the `export` keyword:
+
+```{.copyWrapper}
+//export TykTriggerEvent
+func TykTriggerEvent( CEventName *C.char, CPayload *C.char ) {
+  eventName := C.GoString(CEventName)
+  payload := C.GoString(CPayload)
+
+  FireSystemEvent(tykcommon.TykEvent(eventName), EventMetaDefault{
+    Message: payload,
+  })
+}
+```
+
+You should also expect a header file declaration of this function in [`api.h`](https://github.com/TykTechnologies/tyk/blob/master/coprocess/api.h), like this:
+
+```{.copyWrapper}
+#ifndef TYK_COPROCESS_API
+#define TYK_COPROCESS_API
+extern void TykTriggerEvent(char* event_name, char* payload);
+#endif
+```
+
+The language binding will include this header file (or declare the function inline) and perform the necessary steps to call it with the appropriate arguments (like an FFI mechanism could do). As a reference, this is how this could be achieved if you're building a [Cython](http://cython.org/) module:
+
+```{.copyWrapper}
+cdef extern:
+  void TykTriggerEvent(char* event_name, char* payload);
+
+def call():
+  event_name = 'my event'.encode('utf-8')
+  payload = 'my payload'.encode('utf-8')
+  TykTriggerEvent( event_name, payload )
+```
+
+### Basic usage
+
+The intended way of using a Coprocess middleware is to specify it as part of an API Definition:
+
+```{.json}
+"custom_middleware": {
+  "pre": [
+    {
+      "name": "MyPreMiddleware",
+      "require_session": false
+    },
+    {
+      "name": "AnotherPreMiddleware",
+      "require_session": false
+    }
+  ],
+  "post": [
+    {
+      "name": "MyPostMiddleware",
+      "require_session": false
+    }
+  ],
+  "post_key_auth": [
+    {
+      "name": "MyPostKeyAuthMiddleware",
+      "require_session": true
+    }
+  ],
+  "auth_check": {
+    "name": "MyAuthCheck"
+  },
+  "driver": "python"
+}
+```
+
+<Note>
+All hook types support chaining except the custom auth check (`auth_check`).
+</Note>
+
+
+---
+
+## Rich Plugins Data Structures
+
+This section describes the data structures used by the Tyk rich plugins.
+
+The coprocess object is a message dispatched by Tyk to the gRPC server handling the custom plugins.
+
+The Tyk [Protocol Buffer definitions](https://github.com/TykTechnologies/tyk/tree/master/coprocess/proto) are intended for users to generate their own bindings using the appropriate gRPC tools for the required target language.
+The remainder of this document illustrates a class diagram and explins the attributes of the protobuf messages.
+
+### Coprocess Object
+
+The `Coprocess.Object` data structure wraps a `Coprocess.MiniRequestObject` and `Coprocess.ResponseObject` It contains additional fields that are useful for users that implement their own request dispatchers, like the middleware hook type and name.
+It also includes the session state object (`SessionState`), which holds information about the current key/user that's used for authentication.
+
+```protobuf
+message Object {
+  HookType hook_type = 1;
+  string hook_name = 2;
+  MiniRequestObject request = 3;
+  SessionState session = 4;
+  map<string, string> metadata = 5;
+  map<string, string> spec = 6;
+  ResponseObject response = 7;
+}
+```
+
+This class diagram presents the structure of the object:
+
+<img src="/img/grpc/grpc-class-diagram.svg" alt="" width="600" />
+
+
+#### Field Descriptions
+
+`hook_type`
+Contains the middleware hook type: pre, post, custom auth.
+
+`hook_name`
+Contains the hook name.
+
+`request`
+Contains the request object, see `MiniRequestObject` for more details.
+
+`session`
+Contains the session object, see `SessionState` for more details.
+
+`metadata`
+Contains the metadata. This is a dynamic field.
+
+`spec`
+Contains information about API definition, including `APIID`, `OrgID` and `config_data`.
+
+`response`
+Contains information populated from the upstream HTTP response data, for response hooks. See [ResponseObject](#responseobject) for more details. All the field contents can be modified.
+
+### MiniRequestObject
+
+The `Coprocess.MiniRequestObject` is the main request data structure used by rich plugins. It's used for middleware calls and contains important fields like headers, parameters, body and URL. A `MiniRequestObject` is part of a `Coprocess.Object`.
+
+```protobuf
+message MiniRequestObject {
+   map<string, string> headers = 1;
+   map<string, string> set_headers = 2;
+   repeated string delete_headers = 3;
+   string body = 4;
+   string url = 5;
+   map<string, string> params = 6;
+   map<string, string> add_params = 7;
+   map<string, string> extended_params = 8;
+   repeated string delete_params = 9;
+   ReturnOverrides return_overrides = 10;
+   string method = 11;
+   string request_uri = 12;
+   string scheme = 13;
+   bytes raw_body = 14;
+}
+```
+
+#### Field Descriptions
+
+`headers`
+A read-only field for reading headers injected by previous middleware. Modifying this field won't alter the request headers See `set_headers` and `delete_headers` for this.
+
+`set_headers`
+This field appends the given headers (keys and values) to the request.
+
+`delete_headers`
+This field contains an array of header names to be removed from the request.
+
+`body`
+Contains the request body. See `ReturnOverrides` for response body modifications.
+
+`raw_body`
+Contains the raw request body (bytes).
+
+`url`
+The request URL.
+
+`params`
+A read-only field that contains the request params. Modifying this value won't affect the request params.
+
+`add_params`
+Add paramaters to the request.
+
+`delete_params`
+This field contains an array of parameter keys to be removed from the request.
+
+`return_overrides`
+See `ReturnOverrides` for more information.
+
+`method`
+The request method, e.g. GET, POST, etc.
+
+`request_uri`
+Raw unprocessed URL which includes query string and fragments.
+
+`scheme`
+Contains the URL scheme, e.g. `http`, `https`.
+
+---
+
+### ResponseObject
+
+The `ResponseObject` exists within an [object](#coprocess-object) for response hooks. The fields are populated with the upstream HTTP response data. All the field contents can be modified.
+
+```protobuf
+syntax = "proto3";
+
+package coprocess;
+
+message ResponseObject {
+  int32 status_code = 1;
+  bytes raw_body = 2;
+  string body = 3;
+  map<string, string> headers = 4;
+  repeated Header multivalue_headers = 5;
+}
+
+message Header {
+  string key = 1;
+  repeated string values = 2;
+}
+```
+
+#### Field Descriptions
+
+`status_code`
+This field indicates the HTTP status code that was sent by the upstream.
+
+`raw_body`
+This field contains the HTTP response body (bytes). It's always populated.
+
+`body`
+This field contains the HTTP response body in string format. It's not populated if the `raw_body` contains invalid UTF-8 characters.
+
+`headers`
+A map that contains the headers sent by the upstream.
+
+`multivalue_headers`
+A list of headers, each header in this list is a structure that consists of two parts: a key and its corresponding values.
+The key is a string that denotes the name of the header, the values are a list of strings that hold the content of the header, this is useful when the header has multiple associated values.
+This field is available for Go, Python and Ruby since tyk v5.0.4 and  5.1.1+.
+
+---
+
+### ReturnOverrides
+
+The `ReturnOverrides` object, when returned as part of a `Coprocess.Object`, overrides the response of a given HTTP request. It also stops the request flow and the HTTP request isn't passed upstream. The fields specified in the `ReturnOverrides` object are used as the HTTP response.
+A sample usage for `ReturnOverrides` is when a rich plugin needs to return a custom error to the user.
+
+```protobuf
+syntax = "proto3";
+
+package coprocess;
+
+message ReturnOverrides {
+  int32 response_code = 1;
+  string response_error = 2;
+  map<string, string> headers = 3;
+  bool override_error = 4;
+  string response_body = 5;
+}
+```
+
+#### Field Descriptions
+
+`response_code`
+This field overrides the HTTP response code and can be used for error codes (403, 500, etc.) or for overriding the response.
+
+`response_error`
+This field overrides the HTTP response body.
+
+`headers`
+This field overrides response HTTP headers.
+
+`override_error`
+This setting provides enhanced customization for returning custom errors. It should be utilized alongside `response_body` for optimal effect.
+
+`response_body`
+This field serves as an alias for `response_erro`r and holds the HTTP response body.
+
+---
+
+### SessionState
+<a id="session-state"></a>
+
+A `SessionState` data structure is created for every authenticated request and stored in Redis. It's used to track the activity of a given key in different ways, mainly by the built-in Tyk middleware like the quota middleware or the rate limiter.
+A rich plugin can create a `SessionState` object and store it in the same way built-in authentication mechanisms do. This is what a custom authentication middleware does. This is also part of a `Coprocess.Object`.
+Returning a null session object from a custom authentication middleware is considered a failed authentication and the appropriate HTTP 403 error is returned by the gateway (this is the default behavior) and can be overridden by using `ReturnOverrides`.
+
+#### Field Descriptions
+
+`last_check`
+No longer used.
+
+`allowance`
+No longer in use, should be the same as `rate`.
+
+`rate` 
+The number of requests that are allowed in the specified rate limiting window.
+
+`per`
+The number of seconds that the rate window should encompass.
+
+`expires`
+An epoch that defines when the key should expire.
+
+`quota_max`
+The maximum number of requests allowed during the quota period.
+
+`quota_renews`
+An epoch that defines when the quota renews.
+
+`quota_remaining`
+Indicates the remaining number of requests within the user's quota, which is independent of the rate limit.
+
+`quota_renewal_rate`
+The time in seconds during which the quota is valid. So for 1000 requests per hour, this value would be 3600 while `quota_max` and `quota_remaining` would be 1000.
+
+`access_rights`
+Defined as a `map<string, APIDefinition>` instance, that maps the session's API ID to an [AccessDefinition](#access-definition). The AccessDefinition defines the [access rights](/api-management/access-control/sessions-and-keys/access-rights) for the API in terms of allowed: versions and URLs(endpoints). Each URL (endpoint) has a list of allowed methods. For further details consult the tutorials for how to create a [security policy](/api-management/gateway-config-managing-classic#secure-an-api) for Tyk Cloud, Tyk Self Managed and Tyk OSS platforms.
+
+`org_id`
+The organization this user belongs to. This can be used in conjunction with the org_id setting in the API Definition object to have tokens "owned" by organizations.
+
+`oauth_client_id`
+This is set by Tyk if the token is generated by an OAuth client during an OAuth authorization flow.
+
+`basic_auth_data`
+This section contains a hashed representation of the basic auth password and the hashing method used.
+For further details see [BasicAuthData](#basicauthdata).
+
+`jwt_data`
+Added to sessions where a Tyk key (embedding a shared secret) is used as the public key for signing the JWT. The JWT token's KID header value references the ID of a Tyk key. See [JWTData](#jwtdata) for an example.
+
+`hmac_enabled`
+When set to `true` this indicates generation of a [HMAC signature](/basic-config-and-security/security/authentication-authorization/hmac-signatures) using the secret provided in `hmac_secret`. If the generated signature matches the signature provided in the *Authorization* header then authentication of the request has passed.
+
+`hmac_secret`
+The value of the HMAC shared secret.
+
+`is_inactive`
+Set this value to true to deny access.
+
+`apply_policy_id`
+The policy ID that is bound to this token.
+
+
+<Note>
+Although `apply_policy_id` is still supported, it is now deprecated. `apply_policies` is now used to list your policy IDs as an array. See [here](/api-management/access-control/policies/applying-policies#policy-ids) for more details.
+</Note>
+
+
+`data_expires`
+A value, in seconds, that defines when data generated by this token expires in the analytics DB (must be using Pro edition and MongoDB).
+
+`monitor`
+Defines a [quota monitor](/api-management/gateway-events#monitoring-quota-consumption) containing a list of percentage threshold limits in descending order. These limits determine when webhook notifications are triggered for API users or an organization. Each threshold represents a percentage of the quota that, when reached, triggers a notification. See [Monitor](#monitor) for further details and an example.
+
+`enable_detailed_recording`
+Set this value to true to have Tyk store the inbound request and outbound response data in HTTP Wire format as part of the analytics data.
+
+`metadata`
+Metadata to be included as part of the session. This is a key/value string map that can be used in other middleware such as transforms and header injection to embed user-specific data into a request, or alternatively to query the providence of a key.
+
+`tags`
+Tags are embedded into analytics data when the request completes. If a policy has tags, those tags will supersede the ones carried by the token (they will be overwritten).
+
+`alias`
+As of v2.1, an Alias offers a way to identify a token in a more human-readable manner, add an Alias to a token in order to have the data transferred into Analytics later on so you can track both hashed and un-hashed tokens to a meaningful identifier that doesn't expose the security of the underlying token.
+
+`last_updated`
+A UNIX timestamp that represents the time the session was last updated. Applicable to *Post*, *PostAuth* and *Response* plugins. When developing *CustomAuth* plugins developers should add this to the SessionState instance.
+
+`id_extractor_deadline`
+This is a UNIX timestamp that signifies when a cached key or ID will expire. This relates to custom authentication, where authenticated keys can be cached to save repeated requests to the gRPC server. See [id_extractor](/api-management/plugins/plugin-types#plugin-caching-mechanism) and [Auth Plugins](/api-management/plugins/plugin-types#authentication-plugins) for additional information.
+
+`session_lifetime`
+UNIX timestamp that denotes when the key will automatically expire. Any·subsequent API request made using the key will be rejected. Overrides the global session lifetime. See [Key Expiry and Deletion](/api-management/access-control/sessions-and-keys/session-lifecycle) for more information.
+
+`key_id`
+This is the unique identifier for the access token used to authenticate the request, introduced in v5.9.0.
+
+---
+
+### AccessDefinition
+<a id="access-definition"></a>
+
+```protobuf
+message AccessDefinition {
+  string api_name = 1;
+  string api_id = 2;
+  repeated string versions = 3;
+  repeated AccessSpec allowed_urls = 4;
+}
+```
+
+Defined as an attribute within a [SessionState](#session-state) instance. Contains the allowed versions and URLs (endpoints) for the API that the session request relates to. Each URL (endpoint) specifies an associated list of allowed methods. See also [AccessSpec](#access-spec).
+
+#### Field Descriptions
+
+`api_name`
+The name of the API that the session request relates to.
+
+`api_id`
+The ID of the API that the session request relates to.
+
+`versions`
+List of allowed API versions, e.g.  `"versions": [ "Default" ]`.
+
+`allowed_urls` List of [AccessSpec](#access-spec) instances. Each instance defines a URL (endpoint) with an associated allowed list of methods. If all URLs (endpoints) are allowed then the attribute is not set.
+
+---
+
+### AccessSpec
+<a id="access-spec"></a>
+
+Defines an API's URL (endpoint) and associated list of allowed methods
+
+```protobuf
+message AccessSpec {
+  string url = 1;
+  repeated string methods = 2;
+}
+```
+
+#### Field Descriptions 
+
+`url`
+A URL (endpoint) belonging to the API associated with the request session.
+
+`methods`
+List of allowed methods for the URL (endpoint), e.g. `"methods": [ "GET". "POST", "PUT", "PATCH" ]`.
+
+---
+
+### BasicAuthData
+
+The `BasicAuthData` contains a hashed password and the name of the hashing algorithm used. This is represented by the `basic_auth_data` attribute in [SessionState](#session-state) message.
+
+```yaml
+"basicAuthData": {
+    "password": <a_hashed_password_presentation>,
+    "hash": <the_hashing_algorithm_used_to_hash_the_password>
+}
+```
+
+#### Field Descriptions
+
+`password`
+A hashed password.
+
+`hash`
+Name of the [hashing algorithm](/api-management/access-control/sessions-and-keys/key-hashing#hashing-algorithms) used to hash the password.
+
+---
+
+### JWTData
+
+Added to [sessions](#session-state) where a Tyk key (embedding a shared secret) is used as the public key for signing the JWT. This message contains the shared secret.
+
+```yaml
+"jwtData": {
+  "secret": "the_secret"
+}
+```
+
+#### Field Descriptions
+
+`secret`
+The shared secret.
+
+---
+
+### Monitor
+<a id="monitor"></a>
+
+Added to a [session](#session-state) when [monitor quota thresholds](/api-management/gateway-events#monitoring-quota-consumption) are defined within the Tyk key. This message contains the quota percentage threshold limits, defined in descending order, that trigger webhook notification.
+
+```yaml
+message Monitor {
+  repeated double trigger_limits = 1;
+}
+```
+
+#### Field Descriptions
+
+`trigger_limits`
+List of trigger limits defined in descending order. Each limit represents the percentage of the quota that must be reached in order for the webhook notification to be triggered.
+
+```yaml
+"monitor": {
+  "trigger_limits": [80.0, 60.0, 50.0]
+}
+```
+
+---
+
+<br />
+
+
+
+## Using Python
+
+### Overview
+
+#### Requirements
+
+Since v2.9, Tyk supports any currently stable [Python 3.x version](https://www.python.org/downloads/). The main requirement is to have the Python shared libraries installed. These are available as `libpython3.x` in most Linux distributions.
+
+- Python3-dev
+- [Protobuf](https://pypi.org/project/protobuf/): provides [Protocol Buffers](https://developers.google.com/protocol-buffers/) support
+- [gRPC](https://pypi.org/project/grpcio/): provides [gRPC](http://www.grpc.io/) support
+
+#### Important Note Regarding Performance
+
+Python plugins are [embedded](https://docs.python.org/3/extending/embedding.html) within the Tyk Gateway process. Tyk Gateway integrates with Python custom plugins via a [cgo](https://golang.org/cmd/cgo) bridge.
+
+`Tyk Gateway`  &lt;-&gt; CGO &lt;-&gt; `Python Custom Plugin`
+
+In order to integrate with Python custom plugins, the *libpython3.x.so* shared object library is used to embed a Python interpreter directly in the Tyk Gateway. Further details can be found [here](/api-management/plugins/rich-plugins#coprocess-gateway-api)
+
+This allows combining the strengths of both Python and Go in a single application. However, it's essential to be aware of the potential complexities and performance implications of mixing languages, as well as the need for careful memory management when working with Python objects from Go.
+
+The Tyk Gateway process initialises the Python interpreter using [Py_initialize](https://docs.python.org/3/c-api/init.html#c.Py_Initialize). The Python [Global Interpreter Lock (GIL)](https://docs.python.org/3/glossary.html#term-global-interpreter-lock) allows only one thread to execute Python bytecode at a time, ensuring thread safety and simplifying memory management. While the GIL simplifies these aspects, it can limit the scalability of multi-threaded applications, particularly those with CPU-bound tasks, as it restricts parallel execution of Python code.
+
+In the context of custom Python plugins, API calls are queued and the Python interpreter handles requests sequentially, processing them one at a time. Subsequently, this would consume large amounts of memory, and network sockets would remain open and blocked until the API request is processed.
+
+#### Install the Python development packages
+
+<Tabs>
+
+<Tab title="Docker">
+
+<Note>
+Starting from Tyk Gateway version `v5.3.0`, Python is no longer bundled with the official Tyk Gateway Docker image by default, to address security vulnerabilities in the Python libraries highlighted by [Docker Scout](https://docs.docker.com/scout/).
+<br />
+Whilst Python plugins are still supported by Tyk Gateway, if you want to use them you must extend the image to add support for Python. For further details, please refer to the [release notes](/developer-support/release-notes/gateway) for Tyk Gateway `v5.3.0`.
+</Note>
+
+
+If you wish to use Python plugins using Docker, you can extend the official Tyk Gateway Docker image by adding Python to it.
+
+This example Dockerfile extends the official Tyk Gateway image to support Python plugins by installing python and the required modules:
+
+```dockerfile
+ARG BASE_IMAGE
+FROM ${BASE_IMAGE} AS base
+
+FROM python:3.11-bookworm
+COPY --from=base /opt/tyk-gateway/ /opt/tyk-gateway/
+RUN pip install setuptools && pip install google && pip install 'protobuf==4.24.4'
+
+EXPOSE 8080 80 443
+
+ENV PYTHON_VERSION=3.11
+ENV PORT=8080
+
+WORKDIR /opt/tyk-gateway/
+
+ENTRYPOINT ["/opt/tyk-gateway/tyk" ]
+CMD [ "--conf=/opt/tyk-gateway/tyk.conf" ]
+```
+
+To use this, you simply run `docker build` with this Dockerfile, providing the Tyk Gateway image that you would like to extend as build argument `BASE_IMAGE`.
+As an example, this command will extend Tyk Gateway `v5.3.0` to support Python plugins, generating the image `tyk-gateway-python:v5.3.0`:
+
+```bash
+docker build --build-arg BASE_IMAGE=tykio/tyk-gateway:v5.3.0 -t tyk-gateway-python:v5.3.0 .
+```
+
+</Tab>
+
+<Tab title="Ubuntu/Debian">
+
+```apt
+apt install python3 python3-dev python3-pip build-essential
+```
+
+#### Install the Required Python Modules
+
+Make sure that "pip" is available in your system, it should be typically available as "pip", "pip3" or "pipX.X" (where X.X represents the Python version):
+
+```pip3
+pip3 install protobuf grpcio
+```
+
+</Tab>
+
+<Tab title="Red Hat or CentOS">
+
+```yum
+yum install python3-devel python3-setuptools
+python3 -m ensurepip
+```
+
+#### Install the Required Python Modules
+
+Make sure that "pip" is now available in your system, it should be typically available as "pip", "pip3" or "pipX.X" (where X.X represents the Python version):
+
+```pip3
+pip3 install protobuf grpcio
+```
+
+</Tab>
+
+</Tabs>
+
+#### Python versions
+
+Newer Tyk versions provide more flexibility when using Python plugins, allowing the users to set which Python version to use. By default, Tyk will try to use the latest version available.
+
+To see the Python initialisation log, run the Tyk gateway in debug mode.
+
+To use a specific Python version, set the `python_version` flag under `coprocess_options` in the Tyk Gateway configuration file (tyk.conf).
+
+
+<Note>
+Tyk doesn't support Python 2.x.
+</Note>
+
+
+#### Troubleshooting
+
+To verify that the required Python Protocol Buffers module is available:
+
+```python3
+python3 -c 'from google import protobuf'
+```
+
+No output is expected from this command on successful setups.
+
+#### How do I write Python Plugins?
+
+We have created [a demo Python plugin repository](https://github.com/TykTechnologies/tyk-plugin-demo-python).
+
+The project implements a simple middleware for header injection, using a Pre hook (see [Tyk custom middleware hooks](/api-management/plugins/rich-plugins#coprocess-dispatcher-hooks). A single Python script contains the code for it, see [middleware.py](https://github.com/TykTechnologies/tyk-plugin-demo-python/blob/master/middleware.py).
+
+
+### Custom Authentication Plugin Tutorial
+
+#### Introduction
+This tutorial will guide you through the creation of a custom authentication plugin, written in Python.
+A custom authentication plugin allows you to implement your own authentication logic and override the default Tyk authentication mechanism. The sample code implements a very simple key check; currently it supports a single, hard-coded key. It could serve as a starting point for your own authentication logic. We have tested this plugin with Ubuntu 14.
+
+The code used in this tutorial is also available in [this GitHub repository](https://github.com/TykTechnologies/tyk-plugin-demo-python).
+
+#### Requirements
+
+* Tyk API Gateway: This can be installed using standard package management tools like Yum or APT, or from source code. See [here](/tyk-self-managed/install) for more installation options.
+
+##### Dependencies
+
+* The Tyk CLI utility, which is bundled with our RPM and DEB packages, and can be installed separately from [https://github.com/TykTechnologies/tyk-cli](https://github.com/TykTechnologies/tyk-cli)
+* In Tyk 2.8 the Tyk CLI is part of the gateway binary, you can find more information by running "tyk help bundle".
+* Python 3.4
+
+#### Create the Plugin
+The first step is to create a new directory for your plugin file:
+
+```bash
+mkdir ~/my-tyk-plugin
+cd ~/my-tyk-plugin
+```
+
+Next you need to create a manifest file. This file contains information about our plugin file structure and how you expect it to interact with the API that will load it.
+This file should be named `manifest.json` and needs to contain the following content:
+
+```json
+{
+  "file_list": [
+    "middleware.py"
+  ],
+  "custom_middleware": {
+    "driver": "python",
+    "auth_check": {
+      "name": "MyAuthMiddleware"
+    }
+  }
+}
+```
+
+* The `file_list` block contains the list of files to be included in the bundle, the CLI tool expects to find these files in the current working directory.
+* The `custom_middleware` block contains the middleware settings like the plugin driver we want to use (`driver`) and the hooks that our plugin will expose. You use the `auth_check` for this tutorial. For other hooks see [here](/api-management/plugins/rich-plugins#coprocess-dispatcher-hooks).
+* The `name` field references the name of the function that you implement in your plugin code: `MyAuthMiddleware`.
+* You add an additional file called `middleware.py`, this will contain the main implementation of our middleware.
+
+
+
+    <Note>
+    Your bundle should always contain a file named `middleware.py` as this is the entry point file.
+    </Note>
+
+
+##### Contents of middleware.py
+
+You import decorators from the Tyk module as this gives you the `Hook` decorator, and you import [Tyk Python API helpers](/api-management/plugins/rich-plugins#tyk-python-api-methods)
+
+You implement a middleware function and register it as a hook, the input includes the request object, the session object, the API meta data and its specification:
+
+```python
+from tyk.decorators import *
+from gateway import TykGateway as tyk
+
+@Hook
+def MyAuthMiddleware(request, session, metadata, spec):
+  auth_header = request.get_header('Authorization')
+  if auth_header == '47a0c79c427728b3df4af62b9228c8ae':
+    tyk.log("I'm logged!", "info")
+    tyk.log("Request body" + request.object.body, "info")
+    tyk.log("API config_data" + spec['config_data'], "info")
+    session.rate = 1000.0
+    session.per = 1.0
+    metadata["token"] = "47a0c79c427728b3df4af62b9228c8ae"
+  return request, session, metadata
+```
+
+
+You can modify the `manifest.json` to add as many files as you want. Files that aren't listed in the `manifest.json` file will be ignored when building the plugin bundle.
+
+#### Building the Plugin
+
+A plugin bundle is a packaged version of the plugin, it may also contain a cryptographic signature of its contents. The `-y` flag tells the Tyk CLI tool to skip the signing process in order to simplify the flow of this tutorial. For more information on the Tyk CLI tool, see [here](/api-management/plugins/overview#plugin-bundles).
+
+You will use the Dockerised version of the Tyk CLI tool to bundle our package.
+
+First, export your Tyk Gateway version to a variable.
+```bash
+##### THIS MUST MATCH YOUR TYK GATEWAY VERSION
+$ IMAGETAG=v3.1.2
+```
+
+Then run the following commands to generate a `bundle.zip` in your current directory:
+```docker
+$ docker run \
+  --rm -w "/tmp" -v $(pwd):/tmp \
+  --entrypoint "/bin/sh" -it \
+  tykio/tyk-gateway:$IMAGETAG \
+  -c '/opt/tyk-gateway/tyk bundle build -y'
+```
+
+**Success!**
+
+You should now have a `bundle.zip` file in the plugin directory.
+
+#### Publishing the Plugin
+
+To allow Tyk access to the plugin bundle, you need to serve this file using a web server. For this tutorial we'll use the Python built-in HTTP server (check the official docs for additional information). This server listens on port 8000 by default. To start it use:
+
+`python3 -m http.server`
+
+When the server is started our current working directory is used as the web root path, this means that our `bundle.zip` file should be accessible from the following URL:
+
+`http://<IP Address>:8000/bundle.zip`
+
+The Tyk Gateway fetches and loads a plugin bundle during startup time and subsequent reloads. For updating plugins using the hot reload feature, you should use different plugin bundle names as you expect them to be used for versioning purposes, e.g. bundle-1, bundle-2, etc.
+If a bundle already exists, Tyk will skip the download process and load the version that's already present.
+
+#### Configure Tyk
+
+You will need to modify the Tyk global configuration file (`tyk.conf`) to use Python plugins. The following block should be present in this file:
+
+```json
+"coprocess_options": {
+    "enable_coprocess": true,
+    "python_path_prefix": "/opt/tyk-gateway"
+},
+"enable_bundle_downloader": true,
+"bundle_base_url": "http://dummy-bundle-server.com/bundles/",
+"public_key_path": "/path/to/my/pubkey"
+```
+
+##### Options
+
+* `enable_coprocess`: This enables the plugin
+* `python_path_prefix`: Sets the path to built-in Tyk modules, this will be part of the Python module lookup path. The value used here is the default one for most installations.
+* `enable_bundle_downloader`: This enables the bundle downloader
+* `bundle_base_url`: This is a base URL that will be used to download the bundle. You should replace the `bundle_base_url` with the appropriate URL of the web server that's serving your plugin bundles. For now HTTP and HTTPS are supported but we plan to add more options in the future (like pulling directly from S3 buckets). You use the URL that's exposed by the test HTTP server in the previous step.
+* `public_key_path`: Modify `public_key_path` in case you want to enforce the cryptographic check of the plugin bundle signatures. If the `public_key_path` isn't set, the verification process will be skipped and unsigned plugin bundles will be loaded normally.
+
+#### Configure an API Definition
+
+There are two important parameters that you need to add or modify in the API definition.
+The first one is `custom_middleware_bundle` which must match the name of the plugin bundle file. If we keep this with the default name that the Tyk CLI tool uses, it will be `bundle.zip`.
+
+`"custom_middleware_bundle": "bundle.zip"`
+
+The second parameter is specific to this tutorial, and should be used in combination with `use_keyless` to allow an API to authenticate against our plugin:
+
+`"use_keyless": false`
+`"enable_coprocess_auth": true`
+
+`"enable_coprocess_auth"` will instruct the Tyk gateway to authenticate this API using the associated custom authentication function that's implemented by the plugin.
+
+#### Configuration via the Tyk Dashboard
+
+To attach the plugin to an API, From the **Advanced Options** tab in the **API Designer** enter **bundle.zip** in the **Plugin Bundle ID** field.
+
+<img src="/img/2.10/plugin_bundle_id.png" alt="Plugin Options" />
+
+You also need to modify the authentication mechanism that's used by the API.
+From the **Core Settings** tab in the **API Designer** select **Use Custom Authentication (Python, CoProcess, and JSVM plugins)** from the **Authentication - Authentication Mode** drop-down list. 
+
+<img src="/img/2.10/custom_auth_python.png" alt="Advanced Options" />
+
+#### Testing the Plugin
+
+Now you can simply make an API call against the API for which we've loaded the Python plugin.
+
+
+##### If Running Tyk Gateway from Source
+
+At this point you have your test HTTP server ready to serve the plugin bundle and the configuration with all the required parameters.
+The final step is to start or restart the **Tyk Gateway** (this may vary depending on how you setup Tyk).
+A separate service is used to load the Tyk version that supports Python (`tyk-gateway-python`), so we need to stop the standard one first (`tyk-gateway`):
+
+```service
+service tyk-gateway stop
+service tyk-gateway-python start
+```
+
+From now on you should use the following command to restart the service:
+
+```service
+service tyk-gateway-python restart
+```
+
+A cURL request will be enough for testing our custom authentication middleware.
+
+This request will trigger a bad authentication:
+
+```curl
+curl http://<IP Address>:8080/my-api/my-path -H 'Authorization: badtoken'
+```
+
+This request will trigger a successful authentication. You are using the token that's set by your Python plugin:
+
+```curl
+curl http://<IP Address>:8080/my-api/my-path -H 'Authorization: 47a0c79c427728b3df4af62b9228c8ae'
+```
+
+#### What's Next?
+
+In this tutorial you learned how Tyk plugins work. For a production-level setup we suggest the following steps:
+
+* Configure Tyk to use your own key so that you can enforce cryptographic signature checks when loading plugin bundles, and sign your plugin bundles!
+* Configure an appropriate web server and path to serve your plugin bundles.
+
+
+### Add Python Plugin To Your Gateway
+
+#### API settings
+
+To add a Python plugin to your API, you must specify the bundle name using the `custom_middleware_bundle` field:
+
+```{.json}
+{
+  "name": "Tyk Test API",
+  "api_id": "1",
+  "org_id": "default",
+  "definition": {
+    "location": "header",
+    "key": "version"
+  },
+  "auth": {
+      "auth_header_name": "authorization"
+  },
+  "use_keyless": true,
+  "version_data": {
+    "not_versioned": true,
+    "versions": {
+      "Default": {
+        "name": "Default",
+        "expires": "3000-01-02 15:04",
+        "use_extended_paths": true,
+        "extended_paths": {
+          "ignored": [],
+          "white_list": [],
+          "black_list": []
+        }
+      }
+    }
+  },
+  "proxy": {
+    "listen_path": "/quickstart/",
+    "target_url": "http://httpbin.org",
+    "strip_listen_path": true
+  },
+  "custom_middleware_bundle": "test-bundle"
+}
+```
+
+#### Global settings
+
+To enable Python plugins you need to add the following block to `tyk.conf`:
+
+```{.copyWrapper}
+"coprocess_options": {
+  "enable_coprocess": true,
+  "python_path_prefix": "/opt/tyk-gateway"
+},
+"enable_bundle_downloader": true,
+"bundle_base_url": "http://dummy-bundle-server.com/bundles/",
+"public_key_path": "/path/to/my/pubkey",
+```
+
+`enable_coprocess`: enables the rich plugins feature.
+
+`python_path_prefix`: Sets the path to built-in Tyk modules, this will be part of the Python module lookup path. The value used here is the default one for most installations.
+
+`enable_bundle_downloader`: enables the bundle downloader.
+
+`bundle_base_url`: is a base URL that will be used to download the bundle, in this example we have `test-bundle` specified in the API settings, Tyk will fetch the URL for your specified bundle server (in the above example): `dummy-bundle-server.com/bundles/test-bundle`. You need to create and then specify your own bundle server URL.
+
+`public_key_path`: sets a public key, this is used for verifying signed bundles, you may omit this if unsigned bundles are used. 
+
+### Tyk Python API methods
+
+Python plugins may call these Tyk API methods:
+
+#### store_data(key, value, ttl)
+
+`store_data` sets a Redis `key` with the specified `value` and `ttl`.
+
+#### get_data(key)
+
+`get_data` retrieves a Redis `key`.
+
+#### trigger_event(event_name, payload)
+
+`trigger_event` triggers an internal Tyk event, the `payload` must be a JSON object.
+
+#### log(msg, level)
+
+`log` will log a message (`msg`) using the specified `level`.
+
+#### log_error(*args)
+
+`log_error` is a shortcut for `log`, it uses the error log level.
+
+### Python Performance
+
+These are some benchmarks performed on Python plugins. Python plugins run in a standard Python interpreter, embedded inside Tyk.
+
+<img src="/img/diagrams/pythonResponseTime.png" alt="Python Performance" />
+
+<img src="/img/diagrams/pythonHitRate.png" alt="Python Performance" />
+
+---
+
+## Using gRPC
+
+### Overview
+
+gRPC is a very powerful framework for RPC communication across different [languages](https://www.grpc.io/docs). It was created by Google and makes heavy use of HTTP2 capabilities and the [Protocol Buffers](https://developers.google.com/protocol-buffers/) serialisation mechanism to dispatch and exchange requests between Tyk and your gRPC plugins.
+
+When it comes to built-in plugins, we have been able to integrate several languages like Python, Javascript & Lua in a native way: this means the middleware you write using any of these languages runs in the same process. At the time of writing, the following languages are supported: C++, Java, Objective-C, Python, Ruby, Go, C# and Node.JS.
+
+For supporting additional languages we have decided to integrate gRPC connections and perform the middleware operations within a gRPC server that is external to the Tyk process. Please contact us to learn more:
+
+<br />
+
+<ButtonLeft href="https://tyk.io/contact/" color="green" content="Contact us" />
+
+Tyk has built-in support for gRPC backends, enabling you to build rich plugins using any of the gRPC supported languages. See [gRPC by language](http://www.grpc.io/docs/) for further details.
+
+#### Use Cases
+
+Deploying an external gRPC server to handle plugins provides numerous technical advantages:
+
+- Allows for independent scalability of the service from the Tyk Gateway.
+- Utilizes a custom-designed server tailored to address specific security concerns, effectively mitigating various security risks associated with native plugins.
+
+#### gRPC Plugin Architectural Overview
+
+An example architecture is illustrated below.
+
+<img src="/img/diagrams/diagram_docs_gRPC-plugins_why-use-it-for-plugins@2x.png" alt="Using gRPC for plugins" />
+
+Here we can see that Tyk Gateway sends requests to an external Java gRPC server to handle authentication, via a CustomAuth plugin. The flow is as follows:
+
+- Tyk receives a HTTP request.
+- Tyk serialises the request and session into a protobuf message that is dispatched to your gRPC server. 
+- The gRPC server performs custom middleware operations (for example, any modification of the request object). Each plugin (Pre, PostAuthKey, Post, Response etc.) is handled as separate gRPC request.
+- The gRPC server sends the request back to Tyk.
+- Tyk proxies the request to your upstream API.
+
+#### Limitations of gRPC plugins
+
+At the time of writing the following features are currently unsupported and unavailable in the serialised request:
+- Client certificiates
+- OAuth keys
+- For graphQL APIs details concerning the *max_query_depth* is unavailable
+- A request query parameter cannot be associated with multiple values
+
+#### gRPC Developer Resources
+
+The [Protocol Buffers](https://github.com/TykTechnologies/tyk/tree/master/coprocess/proto ) and [bindings](https://github.com/TykTechnologies/tyk/tree/master/coprocess/bindings) provided by Tyk should be used in order for successful ommunication between Tyk Gateway and your gRPC plugin server. Documentation for the protobuf messages is available in the [Rich Plugins Data Structures](/api-management/plugins/rich-plugins#rich-plugins-data-structures) page.
+
+You can generate supporting HTML documentation using the *docs* task in the [Taskfile](https://github.com/TykTechnologies/tyk/blob/master/coprocess/proto/Taskfile.yml) file of the [Tyk repository](https://github.com/TykTechnologies/tyk). This documentation explains the protobuf messages and services that allow gRPC plugins to handle a request made to the Gateway. Please refer to the README file within the proto folder of the tyk repository for further details.
+
+You may re-use the bindings that were generated for our samples or generate the bindings youself for Go, Python and Ruby, as implemented by the *generate* task in the [Taskfile](https://github.com/TykTechnologies/tyk/blob/master/coprocess/proto/Taskfile.yml) file of the [Tyk repository](https://github.com/TykTechnologies/tyk).
+
+If you wish to generate bindings for another target language you may generate the bindings yourself. The [Protocol Buffers](https://developers.google.com/protocol-buffers/) and [gRPC documentation](http://www.grpc.io/docs) provide specific requirements and instructions for each language.
+
+#### Load Balancing Between gRPC Servers
+
+Since Tyk 5.8.3 Tyk Gateway has had the ability to load balance between multiple gRPC servers.
+
+To implement this you must first specify the address of the load balanced service using the `dns:///` (note: triple slash) [protocol](https://github.com/grpc/grpc/blob/master/doc/naming.md) in Tyk Gateway's [gRPC server address](/tyk-oss-gateway/configuration#coprocess_options-coprocess_grpc_server) configuration (`TYK_GW_COPROCESSOPTIONS_COPROCESSGRPCSERVER`). Tyk will retrieve the list of addresses for each gRPC server from that service.
+
+You can control whether Tyk will implement load balancing using the [gRPC round robin load balancing](/tyk-oss-gateway/configuration#coprocess_options-grpc_round_robin_load_balancing)) config  (`TYK_GW_COPROCESSOPTIONS_GRPCROUNDROBINLOADBALANCING`):
+
+- If set to `true`, Tyk will balance load between the server addresses retrieved using a round robin approach.
+- If set to `false`, Tyk will implement a sticky session approach without load balancing.
+
+Note that Tyk will only query the DNS on start-up, so if you need to update the list of gRPC servers that you want Tyk to target, you must restart Tyk Gateway.
+
+If you are not load balancing, you can alternatively provide the `tcp://` address of the gRPC server in Tyk Gateway's [gRPC server address](/tyk-oss-gateway/configuration#coprocess_options-coprocess_grpc_server) configuration (`TYK_GW_COPROCESSOPTIONS_COPROCESSGRPCSERVER`) and set [gRPC round robin load balancing](/tyk-oss-gateway/configuration#coprocess_options-grpc_round_robin_load_balancing)  (`TYK_GW_COPROCESSOPTIONS_GRPCROUNDROBINLOADBALANCING`) to `false`.
+
+---
+
+### Getting Started: Key Concepts
+
+This document serves as a developer's guide for understanding the key concepts and practical steps for writing and configuring gRPC plugins for Tyk Gateway. It provides technical insights and practical guidance to seamlessly integrate Tyk plugins into your infrastructure through gRPC. The goal is to equip developers with the knowledge and tools needed to effectively utilize gRPC for enhancing Tyk Gateway functionalities.
+
+This comprehensive guide covers essential tasks, including:
+
+1. **Developing a gRPC Server:** Learn how to develop a gRPC server using [Tyk protocol buffers](https://github.com/TykTechnologies/tyk/tree/master/coprocess/proto). The gRPC server facilitates the execution of Tyk plugins, which offer custom middleware for various phases of the API request lifecycle. By integrating these plugins, developers can enable Tyk Gateway with enhanced control and flexibility in managing API requests, allowing for fine-grained customization and tailored processing at each stage of the request lifecycle.
+
+2. **Configuring Tyk Gateway:** Set up Tyk Gateway to communicate with your gRPC Server and, optionally, an external secured web server hosting the gRPC plugin bundle for API configurations. Configure Tyk Gateway to fetch the bundle configured for an API from the web server, enabling seamless integration with gRPC plugins. Specify connection settings for streamlined integration.
+
+3. **API Configuration:** Customize API settings within Tyk Gateway to configure gRPC plugin utilization. Define plugin hooks directly within the API Definition or remotely via an external web server for seamless request orchestration. Tyk plugins provide custom middleware for different phases of the API request lifecycle, enhancing control and flexibility.
+
+4. **API Testing:** Test that Tyk Gateway integrates with your gRPC server for the plugins configured for your API. 
+
+---
+
+#### Develop gRPC server
+
+Develop your gRPC server, using your preferred language, to handle requests from Tyk Gateway for each of the required plugin hooks. These hooks allow Tyk Gateway to communicate with your gRPC server to execute custom middleware at various stages of the API request lifecycle. 
+
+##### Prerequisites
+
+The following prerequisites are necessary for developing a gRPC server that integrates with Tyk Gateway.
+
+####### Tyk gRPC Protocol Buffers
+
+A collection of [Protocol Buffer](https://github.com/TykTechnologies/tyk/tree/master/coprocess/proto) messages are available in the Tyk Gateway repository to allow Tyk Gateway to integrate with your gRPC server, requesting execution of plugin code. These messages establish a standard set of data structures that are serialised between Tyk Gateway and your gRPC Server. Developers should consult the [Rich Plugins Data Structures](/api-management/plugins/rich-plugins#rich-plugins-data-structures) page for further details.
+
+####### Protocol Buffer Compiler
+
+The protocol buffer compiler, `protoc`, should be installed to generate the service and data structures in your preferred language(s) from the [Tyk gRPC Protocol Buffer](https://github.com/TykTechnologies/tyk/tree/master/coprocess/proto) files. Developers should consult the [installation](https://grpc.io/docs/protoc-installation/) documentation at [grpc.io](https://grpc.io/) for an explanation of how to install `protoc`.
+
+##### Generate Bindings
+
+Generate the bindings (service and data structures) for your target language using the `protoc` compiler. Tutorials are available at [protobuf.dev](https://protobuf.dev/getting-started/) for your target language.
+
+##### Implement service
+
+Your gRPC server should implement the *Dispatcher* service to enable Tyk Gateway to integrate with your gRPC server. The Protocol Buffer definition for the *Dispatcher* service is listed below:
+
+```protobuf
+service Dispatcher {
+  rpc Dispatch (Object) returns (Object) {}
+  rpc DispatchEvent (Event) returns (EventReply) {}
+}
+```
+
+The *Dispatcher* service contains two RPC methods, *Dispatch* and *DispatchEvent*. Dispatch handles a requests made by Tyk Gateway for each plugin configured in your API. DispatchEvent receives notification of an event.
+
+Your *Dispatch* RPC should handle the request made by Tyk Gateway, implementing custom middleware for the intended plugin hooks. Each plugin hook allows Tyk Gateway to communicate with your gRPC server to execute custom middleware at various stages of the API request lifecycle, such as Pre, PostAuth, Post, Response etc. The Tyk Protocol Buffers define the [HookType](https://github.com/TykTechnologies/tyk/blob/master/coprocess/proto/coprocess_common.proto) enumeration to inspect the type of the intended gRPC plugin associated with the request. This is accessible as an attribute on the *Object* message, e.g. *object_message_instance.hook_type*.
+
+##### Developer resources
+
+Consult the [Tyk protocol buffers](https://github.com/TykTechnologies/tyk/tree/master/coprocess/proto) for the definition of the service and data structures that enable integration of Tyk gateway with your gRPC server. Tyk provides pre-generated [bindings](https://github.com/TykTechnologies/tyk/tree/master/coprocess/bindings) for C++, Java, Python and Ruby.
+
+Example tutorials are available that explain how to generate the protobuf bindings and implement a server for [Java](/api-management/plugins/rich-plugins#create-a-request-transformation-plugin-with-java), [.NET](/api-management/plugins/rich-plugins#create-custom-auth-plugin-with-dotnet) and [NodeJS](/api-management/plugins/rich-plugins#create-custom-auth-plugin-with-dotnet).
+
+Tyk Github repositories are also available with examples for [Ruby](https://github.com/TykTechnologies/tyk-plugin-demo-ruby) and [C#/.NET](https://github.com/TykTechnologies/tyk-plugin-demo-dotnet)
+ 
+---
+
+#### Configure Tyk Gateway
+
+Configure Tyk Gateway to issue requests to your gRPC server and optionally, specify the URL of the web server that will serve plugin bundles.
+
+##### Configure gRPC server
+
+Modify the root of your `tyk.conf` file to include the *coprocess_options* section, similar to that listed below:
+
+```yaml
+"coprocess_options": {
+  "enable_coprocess": true,
+  "coprocess_grpc_server": "tcp://127.0.0.1:5555",
+  "grpc_authority": "localhost",
+  "grpc_recv_max_size": 100000000,
+  "grpc_send_max_size": 100000000
+},
+```
+
+A gRPC server can configured under the `coprocess_options` section as follows:
+
+- `enable_coprocess`: Enables the rich plugins feature.
+- `coprocess_grpc_server`: Specifies the gRPC server URL, in this example we're using TCP. Tyk will attempt a connection on startup and keep reconnecting in case of failure.
+- `grpc_recv_max_size`: Specifies the message size supported by the gateway gRPC client, for receiving gRPC responses.
+- `grpc_send_max_size`: Specifies the message size supported by the gateway gRPC client for sending gRPC requests.
+- `grpc_authority`: The `authority` header value, defaults to `localhost` if omitted. Allows configuration according to [RFC 7540](https://datatracker.ietf.org/doc/html/rfc7540#section-8.1.2.3).
+
+When using gRPC plugins, Tyk acts as a gRPC client and dispatches requests to your gRPC server. gRPC libraries usually set a default maximum size, for example, the official gRPC Java library establishes a 4
+MB message size [https://jbrandhorst.com/post/grpc-binary-blob-stream/](https://jbrandhorst.com/post/grpc-binary-blob-stream/).
+
+Configuration parameters are available for establishing a message size in both directions (send and receive). For most use cases and especially if you're dealing with multiple hooks, where the same request object is dispatched, it is recommended to set both values to the same size.
+
+##### Configure Web server (optional)
+
+Tyk Gateway can be configured to download the gRPC plugin configuration for an API from a web server. For further details related to the concept of bundling plugins please refer to [plugin bundles](/api-management/plugins/overview#plugin-bundles).
+
+```yaml
+"enable_bundle_downloader": true,
+"bundle_base_url": "https://my-bundle-server.com/bundles/",
+"public_key_path": "/path/to/my/pubkey",
+```
+
+The following parameters can be configured: 
+- `enable_bundle_downloader`: Enables the bundle downloader to download bundles from a webserver.
+- `bundle_base_url`: Base URL from which to serve bundled plugins.
+- `public_key_path`: Public key for bundle verification (optional)
+
+The `public_key_path` value is used for verifying signed bundles, you may omit this if unsigned bundles are used.
+
+---
+
+#### Configure API
+
+Plugin hooks for your APIs in Tyk can be configured either by directly specifying them in a configuration file on the Gateway server or by hosting the configuration externally on a web server. This section explains how to configure gRPC plugins for your API endpoints on the local Gateway or remotely from an external secured web server.
+
+##### Local
+
+This section provides examples for how to configure gRPC plugin hooks, locally within an API Definition. Examples are provided for Tyk Gateway and Tyk Operator.
+
+###### Tyk Gateway
+
+For configurations directly embedded within the Tyk Gateway, plugin hooks can be defined within your API Definition. An example snippet from a Tyk Classic API Definition is provided below:
+
+```yaml
+"custom_middleware": {
+    "pre": [
+        {"name": "MyPreMiddleware"}
+    ],
+    "post": [
+        {"name": "MyPostMiddleware"}
+    ],
+    "auth_check": {
+        "name": "MyAuthCheck"
+    },
+    "driver": "grpc"
+}
+```
+
+For example, a Post request plugin hook has been configured with name `MyPostMiddleware`. Before the request is sent upstream Tyk Gateway will serialize the request into a [Object protobuf message](/api-management/plugins/rich-plugins#coprocess-object) with the `hook_name` property set to `MyPostMiddleware` and the `hook_type` property set to `Post`. This message will then then be dispatched to the gRPC server for processing before the request is sent upstream.
+
+<br />
+
+<Note>
+Ensure the plugin driver is configured as type *grpc*. Tyk will issue a request to your gRPC server for each plugin hook that you have configured.
+</Note>
+
+
+###### Tyk Operator
+
+The examples below illustrate how to configure plugin hooks for an API Definition within Tyk Operator.
+
+Setting the `driver` configuring parameter to `gRPC` instructs Tyk Gateway to issue a request to your gRPC server for each plugin hook that you have configured.
+
+**Pre plugin hook example**
+
+In this example we can see that a `custom_middleware` configuration block has been used to configure a gRPC Pre request plugin hook with name `HelloFromPre`. Before any middleware is executed Tyk Gateway will serialize the request into a [Object protobuf message](/api-management/plugins/rich-plugins#coprocess-object) with the `hook_name` property set to `HelloFromPre` and the `hook_type` property set to `Pre`. This message will then then be dispatched to the gRPC server.
+
+```yaml {linenos=table,hl_lines=["14-18"],linenostart=1}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-grpc-pre
+spec:
+  name: httpbin-grpc-pre
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.default.svc:8000
+    listen_path: /httpbin-grpc-pre
+    strip_listen_path: true
+  custom_middleware:
+    driver: grpc
+    pre:
+      - name: HelloFromPre
+        path: ""
+```
+
+**Post plugin hook example**
+
+In the example we can see that a `custom_middleware` configuration block has been used to configure a gRPC Post plugin with name `HelloFromPost`. 
+
+Before the request is sent upstream Tyk Gateway will serialize the request and session details into a [Object protobuf message](/api-management/plugins/rich-plugins#coprocess-object) with the `hook_name` property set to `HelloFromPost` and the `hook_type` property set to `Post`. This message will then then be dispatched to the gRPC server for processing before the request is sent upstream.
+
+```yaml {linenos=table,hl_lines=["14-18"],linenostart=1}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-grpc-post
+spec:
+  name: httpbin-grpc-post
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.default.svc:8000
+    listen_path: /httpbin-grpc-post
+    strip_listen_path: true
+  custom_middleware:
+    driver: grpc
+    post:
+      - name: HelloFromPost
+        path: ""
+```
+
+##### Remote
+
+It is possible to configure your API so that it downloads a bundled configuration of your plugins from an external webserver. The bundled plugin configuration is contained within a zip file.
+
+A gRPC plugin bundle is similar to the [standard bundling mechanism](/api-management/plugins/overview#plugin-bundles). The standard bundling mechanism zips the configuration and plugin source code, which will be executed by Tyk. Conversely, a gRPC plugin bundle contains only the configuration (`manifest.json`), with plugin code execution being handled independently by the gRPC server.
+
+Bundling a gRPC plugin requires the following steps:
+- Create a `manifest.json` that contains the configuration of your plugins
+- Build a zip file that bundles your plugin
+- Upload the zip file to an external secured webserver
+- Configure your API to download your plugin bundle
+
+###### Create the manifest file
+
+The `manifest.json` file specifies the configuration for your gRPC plugins. An example `manifest.json` is listed below:
+
+```yaml
+{
+    "file_list": [],
+    "custom_middleware": {
+        "pre": [{"name": "MyPreMiddleware"}],
+        "post": [{"name": "MyPostMiddleware"}],
+        "auth_check": {"name": "MyAuthCheck"},
+        "driver": "grpc"
+    },
+    "checksum": "",
+    "signature": ""
+}
+```
+
+
+<Note>
+The source code files, *file_list*, are empty for gRPC plugins. Your gRPC server contains the source code for handling plugins.
+</Note>
+
+
+###### Build plugin bundle
+
+A plugin bundle can be built using the Tyk Gateway binary and should only contain the `manifest.json` file:
+
+```bash
+tyk bundle build -output mybundle.zip -key mykey.pem
+```
+
+The example above generates a zip file, name `mybundle.zip`. The zip file is signed with key `mykey.pem`.
+
+The resulting bundle file should then be uploaded to the webserver that hosts your plugin bundles.
+
+###### Configure API
+
+####### Tyk Gateway
+
+To add a gRPC plugin to your API definition, you must specify the bundle file name within the `custom_middleware_bundle` field:
+
+```yaml
+{
+   "name": "Tyk Test API",
+   ...
++  "custom_middleware_bundle": "mybundle.zip"
+}
+```
+
+The value of the `custom_middleware_bundle` field will be used in combination with the gateway settings to construct a bundle URL. For example, if Tyk Gateway is configured with a webserver base URL of `https://my-bundle-server.com/bundles/` then an attempt would be made to download the bundle from `https://my-bundle-server.com/bundles/mybundle.zip`.
+
+####### Tyk Operator
+
+ Currently this feature is not yet documented with a Tyk Operator example for configuring an API to use plugin bundles. For further details please reach out and contact us on the [community support forum](https://community.tyk.io).
+
+---
+
+#### Test your API Endpoint
+
+It is crucial to ensure the security and reliability of your gRPC server. As the developer, it is your responsibility to verify that your gRPC server is secured and thoroughly tested with appropriate test coverage. Consider implementing unit tests, integration tests and other testing methodologies to ensure the robustness of your server's functionality and security measures. This step ensures that the Tyk Gateway properly communicates with your gRPC server and executes the custom logic defined by the plugin hooks.
+
+Test the API endpoint using tools like *Curl* or *Postman*. Ensure that your gRPC server is running and the gRPC plugin(s) are functioning. An example using *Curl* is listed below:
+
+```bash
+curl -X GET https://www.your-gateway-server.com:8080/api/path
+```
+
+Replace `https://www.your-gateway-server.com:8080/api/path` with the actual endpoint of your API.
+
+---
+
+#### Summary
+
+This guide has explained the key concepts and processes for writing gRPC plugins that integrate with Tyk Gateway. The following explanations have been given:
+
+- Prerequisites for developing a gRPC server for your target language.
+- The *Dispatcher* service interface.
+- How to configure Tyk Gateway to integrate with your gRPC server.
+- How to configure Tyk Gateway with an optional external web server for fetching plugin configuration.
+- How to configure gRPC plugins for your APIs.
+- How to test your API integration with your gRPC server using curl.
+
+---
+
+#### What's Next?
+
+- Consult the [Protocol Buffer messages](/api-management/plugins/rich-plugins#rich-plugins-data-structures) that Tyk Gateway uses when making a request to a gRPC server.
+- Visit tutorial guides that explain how to implement a [Java](/api-management/plugins/rich-plugins#create-a-request-transformation-plugin-with-java), [.NET](/api-management/plugins/rich-plugins#create-custom-auth-plugin-with-dotnet) and [NodeJS](/api-management/plugins/rich-plugins#create-custom-auth-plugin-with-dotnet) gRPC server.
+- Visit our [plugins hub](/api-management/plugins/overview#plugins-hub) to explore further gRPC development examples and resources.
+
+---
+
+
+
+
+### Getting Started: Creating A Python gRPC Server
+
+In the realm of API integration, establishing seamless connections between services is paramount.
+
+Understanding the fundamentals of gRPC server implementation is crucial, especially when integrating with a Gateway solution like Tyk. This guide aims to provide practical insights into this process, starting with the basic principles of how to implement a Python gRPC server that integrates with Tyk Gateway.
+
+#### Objectives
+
+By the end of this guide, you will be able to implement a gRPC server that will integrate with Tyk Gateway, setting the stage for further exploration in subsequent parts:
+
+- Establishing the necessary tools, Python libraries and gRPC service definition for implementing a gRPC server that integrates with Tyk Gateway.
+- Developing a basic gRPC server that echoes the request payload to the console, showcasing the core principles of integration.
+- Configuring Tyk Gateway to interact with our gRPC server, enabling seamless communication between the two services.
+
+Before implementing our first gRPC server it is first necessary to understand the service interface that defines how Tyk Gateway integrates with a gRPC server.
+
+
+#### Tyk Dispatcher Service
+
+The *Dispatcher* service, defined in the [coprocess_object.proto](https://github.com/TykTechnologies/tyk/blob/master/coprocess/proto/coprocess_object.proto) file, contains the *Dispatch* RPC method, invoked by Tyk Gateway to request remote execution of gRPC plugins. Tyk Gateway dispatches accompanying data relating to the original client request and session. The service definition is listed below:
+
+```protobuf
+service Dispatcher {
+  rpc Dispatch (Object) returns (Object) {}
+  rpc DispatchEvent (Event) returns (EventReply) {}
+}
+```
+
+On the server side, we will implement the *Dispatcher* service methods and a gRPC server to handle requests from Tyk Gateway. The gRPC infrastructure decodes incoming requests, executes service methods and encodes service responses.
+
+Before we start developing our gRPC server we need to setup our development environment with the supporting libraries and tools.
+
+
+#### Prerequisites
+
+Firstly, we need to download the [Tyk Protocol Buffers](https://github.com/TykTechnologies/tyk/tree/master/coprocess/proto) and install the Python protoc compiler.
+
+We are going to use the *protoc* compiler to generate the supporting classes and data structures to implement the *Dispatcher* service.
+
+
+##### Tyk Protocol Buffers
+
+Issue the following command to download and extract the Tyk Protocol Buffers from the Tyk GitHub repository:
+
+```bash
+curl -sL "https://github.com/TykTechnologies/tyk/archive/master.tar.gz " -o tyk.tar.gz && \
+    mkdir tyk && \
+    tar -xzvf tyk.tar.gz --strip-components=1 -C tyk && \
+    mv tyk/coprocess/proto/* . && \
+    rm -r tyk tyk.tar.gz
+```
+
+##### Install Dependencies
+
+We are going to setup a Python virtual environment and install some supporting dependencies. Assuming that you have Python [virtualenv](https://virtualenv.pypa.io/en/latest/) already installed, then issue the following commands to setup a Python virtual environment containing the grpcio and grpcio-tools libraries:
+
+```bash
+python3 -m venv .venv
+source .venv/bin/activate
+pip install –upgrade pip
+pip install grpcio grpcio-tools grpcio-reflection
+```
+
+The [grpcio](https://pypi.org/project/grpcio/) library offers essential functionality to support core gRPC features such as message serialisation and deserialisation. The [grpcio-tools](https://pypi.org/project/grpcio-tools/) library provides the Python *protoc* compiler that we will use to generate the supporting classes and data structures to implement our gRPC server. The [grpcio-reflection](https://pypi.org/project/grpcio-reflection/) library allows clients to query information about the services and methods provided by a gRPC server at runtime. It enables clients to dynamically discover available services, their RPC methods, in addition to the message types and field names associated with those methods.
+
+
+##### Install grpcurl
+
+Follow the [installation instructions](https://github.com/fullstorydev/grpcurl?tab=readme-ov-file#installation) to install grpcurl. We will use grpcurl to send test requests to our gRPC server.
+
+
+##### Generate Python Bindings
+
+We are now able to generate the Python classes and data structures to allow us to implement our gRPC server. To accomplish this we will use the Python *protoc* command as listed below:
+
+```bash
+python -m grpc_tools.protoc --proto_path=. --python_out=. --grpc_python_out=. *.proto
+```
+
+This compiles the Protocol Buffer files (*.proto) from the current working directory and generates the Python classes representing the Protocol Buffer messages and services. A series of *.py* files should now exist in the current working directory. We are interested in the *coprocess_object_pb2_grpc.py* file, containing a default implementation of *Tyk’s Dispatcher* service.
+
+Inspect the generated Python file, *coprocess_object_pb2_grpc.py*, containing the *DispatcherServicer* class:
+
+```python
+class DispatcherServicer(object):
+    """ GRPC server interface, that must be implemented by the target language """
+    def Dispatch(self, request, context):
+        """ Accepts and returns an Object message """
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+    def DispatchEvent(self, request, context):
+        """ Dispatches an event to the target language """
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+```
+
+This superclass contains a default stub implementation for the **Dispatch** and **DispatchEvent** RPC methods, each defining request and context parameters:
+
+The *request* parameter allows our server to access the message payload sent by Tyk Gateway. We can use this data, pertaining to the request and session, to process and generate a response.
+
+The *context* parameter provides additional information and functionalities related to the RPC call, such as timeout limits, cancelation signals etc. This is a [grpc.ServicerContext](https://grpc.github.io/grpc/python/grpc.html#grpc.ServicerContext) or a [grpc.aio.ServicerContext](https://grpc.github.io/grpc/python/grpc_asyncio.html#grpc.aio.ServicerContext), object depending upon whether a synchronous or AsyncIO gRPC server is implemented.
+
+In the next step we will implement a subclass that will handle requests made by Tyk Gateway for remote execution of custom plugins.
+
+
+#### Implement Dispatcher Service
+
+We will now develop the *Dispatcher* service, adding implementations of the *Dispatch* and *DispatchEvent* methods, to allow our gRPC server to integrate with Tyk Gateway. Before we continue, create a file, *async_server.py*, within the same folder as the generated Protocol Buffer (.proto) files. 
+
+
+##### Dispatch
+
+Our implementation of the Dispatch RPC method will deserialize the request payload and output to the console as JSON format. This serves as a useful development and debugging aid, allowing inspection of the request and session state dispatched by Tyk Gateway to our gRPC server.
+
+Copy and paste the following source code into the *async_server.py* file. Notice that we have used type hinting to aid readability. The type hints are located within the type hint files (.pyi) we generated with the protoc compiler. 
+
+
+```python
+import asyncio
+import grpc
+import json
+import signal
+import logging
+from google.protobuf.json_format import MessageToJson
+from grpc_reflection.v1alpha import reflection
+import coprocess_object_pb2_grpc
+import coprocess_object_pb2
+from coprocess_common_pb2 import HookType
+from coprocess_session_state_pb2 import SessionState
+class PythonDispatcher(coprocess_object_pb2_grpc.DispatcherServicer):
+    async def Dispatch(
+        self, object: coprocess_object_pb2.Object, context: grpc.aio.ServicerContext
+    ) -> coprocess_object_pb2.Object:
+        logging.info(f"STATE for {object.hook_name}\n{MessageToJson(object)}\n")
+        if object.hook_type == HookType.Pre:
+            logging.info(f"Pre plugin name: {object.hook_name}")
+            logging.info(f"Activated Pre Request plugin from API: {object.spec.get('APIID')}")
+        elif object.hook_type == HookType.CustomKeyCheck:
+            logging.info(f"CustomAuth plugin: {object.hook_name}")
+            logging.info(f"Activated CustomAuth plugin from API: {object.spec.get('APIID')}")
+        elif object.hook_type == HookType.PostKeyAuth:
+            logging.info(f"PostKeyAuth plugin name: {object.hook_name}")
+            logging.info(f"Activated PostKeyAuth plugin from API: {object.spec.get('APIID')}")
+        elif object.hook_type == HookType.Post:
+            logging.info(f"Post plugin name: {object.hook_name}")
+            logging.info(f"Activated Post plugin from API: {object.spec.get('APIID')}")
+        elif object.hook_type == HookType.Response:
+            logging.info(f"Response plugin name: {object.hook_name}")
+            logging.info(f"Activated Response plugin from API: {object.spec.get('APIID')}")
+            logging.info("--------\n")
+        return object
+```
+
+Our *Dispatch* RPC method accepts the two parameters, *object* and *context*. The object parameter allows us to inspect the state and session of the request object dispatched by Tyk Gateway, via accessor methods. The *context* parameter can be used to set timeout limits etc. associated with the RPC call.
+
+The important takeaways from the source code listing above are:
+
+- The [MessageToJson](https://googleapis.dev/python/protobuf/latest/google/protobuf/json_format.html#google.protobuf.json_format.MessageToJson) function is used to deserialize the request payload as JSON.
+- In the context of custom plugins we access the *hook_type* and *hook_name* attributes of the *Object* message to determine which plugin to execute.
+- The ID of the API associated with the request is accessible from the spec dictionary, *object.spec.get('APIID')*.
+
+An implementation of the *Dispatch* RPC method must return the object payload received from Tyk Gateway. The payload can be modified by the service implementation, for example to add or remove headers and query parameters before the request is sent upstream.
+
+
+##### DispatchEvent
+
+Our implementation of the *DispatchEvent* RPC method will deserialize and output the event payload as JSON. Append the following source code to the *async_server.py* file:
+
+```python
+   async def DispatchEvent(
+        self, event: coprocess_object_pb2.Event, context: grpc.aio.ServicerContext
+    ) -> coprocess_object_pb2.EventReply:
+        event = json.loads(event.payload)
+        http://logging.info (f"RECEIVED EVENT: {event}")
+        return coprocess_object_pb2.EventReply()
+```
+
+The *DispatchEvent* RPC method accepts the two parameters, *event* and *context*. The event parameter allows us to inspect the payload of the event dispatched by Tyk Gateway. The context parameter can be used to set timeout limits etc. associated with the RPC call.
+
+The important takeaways from the source code listing above are:
+
+- The event data is accessible from the *payload* attribute of the event parameter.
+- An implementation of the *DispatchEvent* RPC method must return an instance of  *coprocess_object_pb2.EventReply*.
+
+
+#### Create gRPC Server
+
+Finally, we will implement an AsyncIO gRPC server to handle requests from Tyk Gateway to the *Dispatcher* service. We will add functions to start and stop our gRPC server. Finally, we will use *grpcurl* to issue a test payload to our gRPC server to test that it is working.
+
+
+##### Develop gRPC Server
+
+Append the following source code from the listing below to the *async_server.py* file:
+
+```python
+async def serve() -> None:
+    server = grpc.aio.server()
+    coprocess_object_pb2_grpc.add_DispatcherServicer_to_server(
+        PythonDispatcher(), server
+    )
+   listen_addr = "[::]:50051"
+    SERVICE_NAMES = (
+        coprocess_object_pb2.DESCRIPTOR.services_by_name["Dispatcher"].full_name,
+        reflection.SERVICE_NAME,
+    )
+
+    reflection.enable_server_reflection(SERVICE_NAMES, server)
+    server.add_insecure_port(listen_addr)
+
+    logging.info ("Starting server on %s", listen_addr)
+
+    await server.start()
+    await server.wait_for_termination()
+
+async def shutdown_server(server) -> None:
+    http://logging.info ("Shutting down server...")
+    await server.stop(None)
+```
+
+The *serve* function starts the gRPC server, listening for requests on port 50051 with reflection enabled.
+
+Clients can use reflection to list available services, obtain their RPC methods and retrieve their message types and field names dynamically. This is particularly useful for tooling and debugging purposes, allowing clients to discover server capabilities without prior knowledge of the service definitions. 
+
+
+<Note>
+**note**
+
+A descriptor is a data structure that describes the structure of the messages, services, enums and other elements defined in a .proto file. The purpose of the descriptor is primarily metadata: it provides information about the types and services defined in the protocol buffer definition. The *coprocess_object_pb2.py* file that we generated using *protoc* contains a DESCRIPTOR field that we can use to retrieve this metadata. For further details consult the documentation for the Google's protobuf [FileDescriptor](https://googleapis.dev/python/protobuf/latest/google/protobuf/descriptor.html#google.protobuf.descriptor.FileDescriptor.services_by_name) class.
+</Note>
+
+
+The *shutdown_server* function stops the gRPC server via the *stop* method of the server instance. 
+
+The key takeaways from the source code listing above are:
+
+- An instance of a gRPC server is created using *grpc.aio.server()*.
+- A service implementation should be registered with the gRPC server. We register our *PythonDispatcher* class via *coprocess_object_pb2_grpc.add_DispatcherServicer_to_server(PythonDispatcher(), server)*.
+- Reflection can be enabled to allow clients to dynamically discover the services available at a gRPC server. We enabled our *Dispatcher* service to be discovered via *reflection.enable_server_reflection(SERVICE_NAMES, server)*. SERVICE_NAMES is a tuple containing the full names of two gRPC services: the *Dispatcher* service obtained by using the DESCRIPTOR field within the *coprocess_object_pb2* module and the other being the standard reflection service.
+- The server instance should be started via invoking and awaiting the *start* and *wait_for_termination* methods of the server instance.
+- A port may be configured for the server. In this example we configured an insecure port of 50051 on the server instance via the [add_insecure_port function](https://grpc.github.io/grpc/python/grpc.html#grpc.Server.add_insecure_port). It is also possible to add a secure port via the [add_secure_port](https://grpc.github.io/grpc/python/grpc.html#grpc.Server.add_secure_port) method of the server instance, which accepts the port number in addition to an SSL certificate and key to enable TLS encryption.
+- The server instance can be stopped via its stop method.
+
+Finally, we will allow our server to terminate upon receipt of SIGTERM and SIGINT signals. To achieve this, append the source code listed below to the *async_server.py* file.
+
+```python
+def handle_sigterm(sig, frame) -> None:
+    asyncio.create_task(shutdown_server(server))
+
+async def handle_sigint() -> None:
+    loop = asyncio.get_running_loop()
+    for sig in (signal.SIGINT, signal.SIGTERM):
+        loop.add_signal_handler(sig, loop.stop)
+
+if __name__ == '__main__':
+    logging.basicConfig(level=logging.INFO)
+    server = None
+    signal.signal(signal.SIGTERM, handle_sigterm)
+    try:
+        asyncio.get_event_loop().run_until_complete(serve())
+    except KeyboardInterrupt:
+        pass
+```
+
+
+##### Start gRPC Server
+
+Issue the following command to start the gRPC server:
+
+```bash
+python3 -m async_server
+```
+
+A message should be output on the console, displaying the port number and confirming that the gRPC server has started.
+
+
+##### Test gRPC Server
+
+To test our gRPC server is working, issue test requests to the *Dispatch* and *DispatchEvent* methods, using *grpcurl*.
+
+
+####### Send Dispatch Request
+
+Use the *grpcurl* command to send a test dispatch request to our gRPC server:
+
+```bash
+grpcurl -plaintext -d '{
+  "hookType": "Pre",
+  "hookName": "MyPreCustomPluginForBasicAuth",
+  "request": {
+    "headers": {
+      "User-Agent": "curl/8.1.2",
+      "Host": "tyk-gateway.localhost:8080",
+      "Authorization": "Basic ZGV2QHR5ay5pbzpwYXN0cnk=",
+      "Accept": "*/*"
+    },
+    "url": "/basic-authentication-valid/get",
+    "returnOverrides": {
+      "responseCode": -1
+    },
+    "method": "GET",
+    "requestUri": "/basic-authentication-valid/get",
+    "scheme": "https"
+  },
+  "spec": {
+    "bundle_hash": "d41d8cd98f00b204e9800998ecf8427e",
+    "OrgID": "5e9d9544a1dcd60001d0ed20",
+    "APIID": "04e911d3012646d97fcdd6c846fafc4b"
+  }
+}' localhost:50051 coprocess.Dispatcher/Dispatch
+```
+
+Inspect the console output of your gRPC server. It should echo the payload that you sent in the request.
+
+
+####### Send DispatchEvent Request
+
+Use the grpcurl command to send a test event payload to our gRPC server:
+
+```bash
+grpcurl -plaintext -d '{"payload": "{\"event\": \"test\"}"}' localhost:50051 coprocess.Dispatcher/DispatchEvent
+```
+
+Inspect the console output of your gRPC server. It should display a log similar to that shown below:
+
+```bash
+INFO:root:RECEIVED EVENT: {'event': 'test'}
+```
+
+The response received from the server should be an empty event reply, similar to that shown below:
+
+```bash
+grpcurl -plaintext -d '{"payload": "{\"event\": \"test\"}"}' localhost:50051 coprocess.Dispatcher/DispatchEvent
+{}
+```
+
+At this point we have tested, independently of Tyk Gateway, that our gRPC Server can handle an example request payload for gRPC plugin execution. In the next section we will create a test environment for testing that Tyk Gateway integrates with our gRPC server for API requests.
+
+
+#### Configure Test Environment
+
+Now that we have implemented and started a gRPC server, Tyk Gateway needs to be configured to integrate with it. To achieve this we will enable the coprocess feature and configure the URL of the gRPC server.
+
+We will also create an API so that we can test that Tyk Gateway integrates with our gRPC server.
+
+
+##### Configure Tyk Gateway
+
+Within the root of the *tyk.conf* file, add the following configuration, replacing host and port with values appropriate for your environment:
+
+```yaml
+"coprocess_options": {
+  "enable_coprocess":   true,
+  "coprocess_grpc_server": "tcp://host:port"
+}
+```
+
+Alternatively, the following environment variables can be set in your .env file:
+
+```bash
+TYK_GW_COPROCESSOPTIONS_ENABLECOPROCESS=true
+TYK_GW_COPROCESSOPTIONS_COPROCESSGRPCSERVER=tcp://host:port
+```
+
+Replace host and port with values appropriate for your environment.
+
+
+##### Configure API
+
+Before testing our gRPC server we will create and configure an API with 2 plugins:
+
+- **Pre Request**: Named *MyPreRequestPlugin*.
+- **Response**: Named *MyResponsePlugin* and configured so that Tyk Gateway dispatches the session state with the request.
+
+Each plugin will be configured to use the *grpc* plugin driver.
+
+Tyk Gateway will forward details of an incoming request to the gRPC server, for each of the configured API plugins.
+
+
+####### Tyk Classic API
+
+gRPC plugins can be configured within the *custom_middleware* section of the Tyk Classic ApiDefinition, as shown in the listing below:
+
+```yaml
+{
+  "created_at": "2024-03-231T12:49:52Z",
+  "api_model": {},
+  "api_definition": {
+    ...
+    ...
+    "custom_middleware": {
+      "pre": [
+        {
+          "disabled": false,
+          "name": "MyPreRequestPlugin",
+          "path": "",
+          "require_session": false,
+          "raw_body_only": false
+        }
+      ],
+      "post": [],
+      "post_key_auth": [],
+      "auth_check": {
+        "disabled": false,
+        "name": "",
+        "path": "",
+        "require_session": false,
+        "raw_body_only": false
+      },
+      "response": [
+        {
+          "disabled": false,
+          "name": "MyResponsePlugin",
+          "path": "",
+          "require_session": true,
+          "raw_body_only": false
+        }
+      ],
+      "driver": "grpc",
+      "id_extractor": {
+        "disabled": false,
+        "extract_from": "",
+        "extract_with": "",
+        "extractor_config": {}
+      }
+    }
+}
+```
+
+In the above listing, the plugin driver parameter has been configured with a value of *grpc*. Two plugins are configured within the *custom_middleware* section: a *Pre Request* plugin and a *Response* plugin.
+
+The *Response* plugin is configured with *require_session* enabled, so that Tyk Gateway will send details for the authenticated key / user with the gRPC request. Note, this is not configured for *Pre Request* plugins that are triggered before authentication in the request lifecycle.
+
+
+####### Tyk OAS API
+
+To quickly get started, a Tyk OAS API schema can be created by importing the infamous [pet store](https://petstore3.swagger.io/api/v3/openapi.json) OAS schema. Then the [findByStatus](https://petstore3.swagger.io/#/pet/findPetsByStatus) endpoint can be used for testing.
+
+The resulting Tyk OAS API Definition contains the OAS JSON schema with an *x-tyk-api-gateway* section appended, as listed below. gRPC plugins can be configured within the middleware section of the *x-tyk-api-gateway* that is appended at the end of the OAS schema:
+
+```yaml
+"x-tyk-api-gateway": {
+  "info": {
+    "id": "6e2ae9b858734ea37eb772c666517f55",
+    "dbId": "65f457804773a600011af41d",
+    "orgId": "5e9d9544a1dcd60001d0ed20",
+    "name": "Swagger Petstore - OpenAPI 3.0 Custom Authentication",
+    "state": {
+      "active": true
+    }
+  },
+  "upstream": {
+    "url": "https://petstore3.swagger.io/api/v3/"
+  },
+  "server": {
+    "listenPath": {
+      "value": "/custom_auth",
+      "strip": true
+    },
+    "authentication": {
+      "enabled": true,
+      "custom": {
+        "enabled": true,
+        "header": {
+          "enabled": false,
+          "name": "Authorization"
+        }
+      }
+    }
+  },
+  "middleware": {
+    "global": {
+      "pluginConfig": {
+        "driver": "grpc"
+      }
+    },
+    "cors": {
+      "enabled": false,
+      "maxAge": 24,
+      "allowedHeaders": [
+        "Accept",
+        "Content-Type",
+        "Origin",
+        "X-Requested-With",
+        "Authorization"
+      ],
+      "allowedOrigins": [
+        "*"
+      ],
+      "allowedMethods": [
+        "GET",
+        "HEAD",
+        "POST"
+      ]
+    },
+    "prePlugin": {
+      "api-management/plugins/overview#": [
+        {
+          "enabled": true,
+          "functionName": "MyPreRequestPlugin",
+          "path": ""
+        }
+      ]
+    },
+    "responsePlugin": {
+      "api-management/plugins/overview#": [
+        {
+          "enabled": true,
+          "functionName": "MyResponsePlugin",
+          "path": "",
+          "requireSession": true
+        }
+      ]
+    }
+  }
+}
+```
+
+In the above listing, the plugin driver parameter has been set to *grpc*. Two plugins are configured within the middleware section: a *Pre Request* plugin and a *Response* plugin.
+
+The *Response* plugin is configured with *requireSession* enabled, so that Tyk Gateway will send details for the authenticated key / user with the gRPC request. Note, this is not configurable for *Pre Request* plugins that are triggered before authentication in the request lifecycle.
+
+Tyk Gateway will forward details of an incoming request to the gRPC server, for each plugin.
+
+
+#### Test API
+
+We have implemented and configured a gRPC server to integrate with Tyk Gateway. Furthermore, we have created an API that has been configured with two gRPC plugins: a *Pre Request* and *Response* plugin.
+
+When we issue a request to our API and observe the console output of our gRPC server we should see a JSON representation of the request headers etc. echoed in the terminal.
+
+Issue a request for your API in the terminal window. For example:
+
+```bash
+curl -L http://.localhost:8080/grpc-http-bin
+```
+
+Observe the console output of your gRPC server. Tyk Gateway should have dispatched two requests to your gRPC server; a request for the *Pre Request* plugin and a request for the *Response* plugin.  
+
+The gRPC server we implemented echoes a JSON representation of the request payload dispatched by Tyk Gateway.
+
+Note that this is a useful feature for learning how to develop gRPC plugins and understanding the structure of the request payload dispatched by Tyk Gateway to the gRPC server. However, in production environments care should be taken to avoid inadvertently exposing sensitive data such as secrets in the session. 
+
+
+#### Summary
+
+In this guide, we've delved into the integration of a Python gRPC server with Tyk Gateway.
+
+We have explained how to implement a Python gRPC server and equipped developers with the necessary tools, knowledge and capabilities to effectively utilize Tyk Gateway through gRPC services.
+
+The following essential groundwork has been covered:
+
+- Setting up tools, libraries and service definitions for the integration.
+- Developing a basic gRPC server with functionality to echo the request payload, received from Tyk Gateway, in JSON format.
+- Configuring Tyk Gateway for seamless communication with our gRPC server.
+
+
+### Create a Request Transformation Plugin with Java
+
+This tutorial will guide you through the creation of a gRPC-based Java plugin for Tyk.
+Our plugin will inject a header into the request before it gets proxied upstream. For additional information about gRPC, check the official documentation [here](https://grpc.io/docs/guides/index.html).
+
+The sample code that we'll use implements a request transformation plugin using Java and uses the proper gRPC bindings generated from our Protocol Buffers definition files.
+
+#### Requirements
+
+- Tyk Gateway: This can be installed using standard package management tools like Yum or APT, or from source code. See [here][1] for more installation options.
+- The Tyk CLI utility, which is bundled with our RPM and DEB packages, and can be installed separately from [https://github.com/TykTechnologies/tyk-cli][2].
+- In Tyk 2.8 the Tyk CLI is part of the gateway binary, you can find more information by running "tyk help bundle".
+- Gradle Build Tool: https://gradle.org/install/.
+- gRPC tools: https://grpc.io/docs/quickstart/csharp.html#generate-grpc-code
+- Java JDK 7 or higher.
+
+#### Create the Plugin
+
+##### Setting up the Java Project
+
+We will use the Gradle build tool to generate the initial files for our project:
+
+```bash
+cd ~
+mkdir tyk-plugin
+cd tyk-plugin
+gradle init
+```
+
+We now have a `tyk-plugin` directory containing the basic skeleton of our application.
+
+Add the following to `build.gradle`
+
+```{.copyWrapper}
+buildscript {
+  repositories {
+    jcenter()
+  }
+  dependencies {
+    classpath 'com.google.protobuf:protobuf-gradle-plugin:0.8.1'
+  }
+}
+
+plugins {
+  id "com.google.protobuf" version "0.8.1"
+  id "java"
+  id "application"
+  id "idea"
+}
+
+protobuf {
+  protoc {
+    artifact = "com.google.protobuf:protoc:3.3.0"
+  }
+  plugins {
+    grpc {
+      artifact = 'io.grpc:protoc-gen-grpc-java:1.5.0'
+    }
+  }
+  generateProtoTasks {
+    all()*.plugins {
+      grpc {}
+    }
+  }
+  generatedFilesBaseDir = "$projectDir/src/generated"
+}
+
+sourceCompatibility = 1.8
+targetCompatibility = 1.8
+
+mainClassName = "com.testorg.testplugin.PluginServer"
+
+repositories {
+  mavenCentral()
+}
+
+dependencies {
+  compile 'io.grpc:grpc-all:1.5.0'
+}
+
+idea {
+  module {
+    sourceDirs += file("${projectDir}/src/generated/main/java");
+    sourceDirs += file("${projectDir}/src/generated/main/grpc");
+  }
+}
+```
+
+##### Create the Directory for the Server Class
+
+```bash
+cd ~/tyk-plugin
+mkdir -p src/main/java/com/testorg/testplugin
+```
+
+##### Install the gRPC Tools
+
+We need to download the Tyk Protocol Buffers definition files, these files contains the data structures used by Tyk. See [Data Structures](/api-management/plugins/rich-plugins#rich-plugins-data-structures) for more information:
+
+```bash
+cd ~/tyk-plugin
+git clone https://github.com/TykTechnologies/tyk
+mv tyk/coprocess/proto src/main/proto
+```
+
+##### Generate the Bindings
+
+To generate the Protocol Buffers bindings we use the Gradle build task:
+
+```bash
+gradle build
+```
+
+If you need to customize any setting related to the bindings generation step, check the `build.gradle` file.
+
+##### Implement Server
+
+We need to implement two classes: one class will contain the request dispatcher logic and the actual middleware implementation. The other one will implement the gRPC server using our own dispatcher.
+
+From the `~/tyk-plugin/src/main/java/com/testorg/testplugin` directory, create a file named `PluginDispatcher.java` with the following code:
+
+```java
+package com.testorg.testplugin;
+
+import coprocess.DispatcherGrpc;
+import coprocess.CoprocessObject;
+
+public class PluginDispatcher extends DispatcherGrpc.DispatcherImplBase {
+
+  @Override
+  public void dispatch(CoprocessObject.Object request,
+        io.grpc.stub.StreamObserver<CoprocessObject.Object> responseObserver) {
+    CoprocessObject.Object modifiedRequest = null;
+
+    switch (request.getHookName()) {
+      case "MyPreMiddleware":
+        modifiedRequest = MyPreHook(request);
+      default:
+      // Do nothing, the hook name isn't implemented!
+    }
+
+    // Return the modified request (if the transformation was done):
+    if (modifiedRequest != null) {
+      responseObserver.onNext(modifiedRequest);
+    };
+
+    responseObserver.onCompleted();
+  }
+
+  CoprocessObject.Object MyPreHook(CoprocessObject.Object request) {
+    CoprocessObject.Object.Builder builder = request.toBuilder();
+    builder.getRequestBuilder().putSetHeaders("customheader", "customvalue");
+    return builder.build();
+  }
+}
+```
+
+In the same directory, create a file named `PluginServer.java` with the following code. This is the server implementation:
+
+```java
+package com.testorg.testplugin;
+
+import coprocess.DispatcherGrpc;
+
+import io.grpc.Server;
+import io.grpc.ServerBuilder;
+import io.grpc.stub.StreamObserver;
+import java.io.IOException;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+public class PluginServer {
+
+  private static final Logger logger = Logger.getLogger(PluginServer.class.getName());
+  static Server server;
+  static int port = 5555;
+
+  public static void main(String[] args) throws IOException, InterruptedException {
+    System.out.println("Initializing gRPC server.");
+
+    // Our dispatcher is instantiated and attached to the server:
+    server = ServerBuilder.forPort(port)
+            .addService(new PluginDispatcher())
+            .build()
+            .start();
+
+    blockUntilShutdown();
+
+  }
+
+  static void blockUntilShutdown() throws InterruptedException {
+      if (server != null) {
+          server.awaitTermination();
+      }
+  }
+}
+```
+
+To run the gRPC server we can use the following command:
+
+```bash
+cd ~/tyk-plugin
+gradle runServer
+```
+
+The gRPC server will listen on port 5555 (as defined in `Server.java`). In the next steps we'll setup the plugin bundle and modify Tyk to connect to our gRPC server.
+
+
+#### Bundle the Plugin
+
+We need to create a manifest file within the `tyk-plugin` directory. This file contains information about our plugin and how we expect it to interact with the API that will load it. This file should be named `manifest.json` and needs to contain the following:
+
+```json
+{
+  "custom_middleware": {
+    "driver": "grpc",
+    "pre": [{
+        "name": "MyPreMiddleware"
+    }]
+  }
+}
+```
+
+- The `custom_middleware` block contains the middleware settings like the plugin driver we want to use (`driver`) and the hooks that our plugin will expose. We use the `pre` hook for this tutorial. For other hooks see [here](/api-management/plugins/rich-plugins#coprocess-dispatcher-hooks).
+- The `name` field references the name of the function that we implemented in our plugin code - `MyPreMiddleware`. This will be handled by our dispatcher gRPC method in `PluginServer.java`.
+
+To bundle our plugin run the following command in the `tyk-plugin` directory. Check your tyk-cli install path first:
+
+```bash
+/opt/tyk-gateway/utils/tyk-cli bundle build -y
+```
+
+For Tyk 2.8 use:
+```bash
+/opt/tyk-gateway/bin/tyk bundle build -y
+```
+
+A plugin bundle is a packaged version of the plugin. It may also contain a cryptographic signature of its contents. The `-y` flag tells the Tyk CLI tool to skip the signing process in order to simplify the flow of this tutorial. 
+
+For more information on the Tyk CLI tool, see [here](/api-management/plugins/overview#plugin-bundles).
+
+You should now have a `bundle.zip` file in the `tyk-plugin` directory.
+
+#### Publish the Plugin
+
+To publish the plugin, copy or upload `bundle.zip` to a local web server like Nginx, or Apache or storage like Amazon S3. For this tutorial we'll assume you have a web server listening on `localhost` and accessible through `http://localhost`.
+
+<GrpcInclude/>
+
+#### What's Next?
+
+In this tutorial we learned how Tyk gRPC plugins work. For a production-level setup we suggest the following:
+
+- Configure an appropriate web server and path to serve your plugin bundles.
+
+[1]: /tyk-self-managed/install
+[2]: https://github.com/TykTechnologies/tyk-cli
+[3]: /img/dashboard/system-management/api_settings.png
+[4]: /img/dashboard/system-management/plugin_options.png
+
+### Create Custom Authentication Plugin with .NET
+<a id="create-custom-auth-plugin-with-dotnet"></a>
+
+This tutorial will guide you through the creation of a custom authentication plugin for Tyk with a gRPC based plugin with .NET and C#. For additional information check the official gRPC [documentation](https://grpc.io/docs/guides/index.html).
+
+The sample code that we’ll use implements a very simple authentication layer using .NET and the proper gRPC bindings generated from our Protocol Buffers definition files.
+
+<img src="/img/diagrams/diagram_docs_gRPC-plugins_why-use-it-for-plugins@2x.png" alt="Using gRPC for plugins" />
+
+#### Requirements
+
+- Tyk Gateway: This can be installed using standard package management tools like Yum or APT, or from source code. See [here][1] for more installation options.
+- The Tyk CLI utility, which is bundled with our RPM and DEB packages, and can be installed separately from [https://github.com/TykTechnologies/tyk-cli][2]
+- In Tyk 2.8 the Tyk CLI is part of the gateway binary, you can find more information by running "tyk help bundle".
+- .NET Core for your OS: https://www.microsoft.com/net/core
+- gRPC tools: https://grpc.io/docs/quickstart/csharp.html#generate-grpc-code
+
+#### Create the Plugin
+
+##### Create .NET Project
+
+We use the .NET CLI tool to generate the initial files for our project:
+
+```bash
+cd ~
+dotnet new console -o tyk-plugin
+```
+
+We now have a `tyk-plugin` directory containing the basic skeleton of a .NET application.
+
+From the `tyk-plugin` directory we need to install a few packages that the gRPC server requires:
+
+```bash
+dotnet add package Grpc --version 1.6.0
+dotnet add package System.Threading.ThreadPool --version 4.3.0
+dotnet add package Google.Protobuf --version 3.4.0
+```
+
+- The `Grpc` package provides base code for our server implementation.
+- The `ThreadPool` package is used by `Grpc`.
+- The `Protobuf` package will be used by our gRPC bindings.
+
+##### Install the gRPC Tools
+
+We need to install the gRPC tools to generate the bindings. We recommended you follow the official guide here: https://grpc.io/docs/quickstart/csharp.html#generate-grpc-code.
+
+Run the following Commands (both MacOS and Linux):
+
+```bash
+cd ~/tyk-plugin
+temp_dir=packages/Grpc.Tools.1.6.x/tmp
+curl_url=https://www.nuget.org/api/v2/package/Grpc.Tools/
+mkdir -p $temp_dir && cd $temp_dir && curl -sL $curl_url > tmp.zip; unzip tmp.zip && cd .. && cp -r tmp/tools . && rm -rf tmp && cd ../..
+chmod -Rf +x packages/Grpc.Tools.1.6.x/tools/
+```
+
+Then run the following, depending on your OS:
+
+**MacOS (x64)**
+
+```bash
+export GRPC_TOOLS=packages/Grpc.Tools.1.6.x/tools/macosx_x64
+```
+
+**Linux (x64)**
+
+```bash
+export GRPC_TOOLS=packages/Grpc.Tools.1.6.x/tools/linux_x64
+```
+
+The `GRPC_TOOLS` environment variable will point to the appropriate GrpcTools path that matches our operating system and architecture. The last step is to export a variable for the `protoc` program; this is the main program used to generate bindings:
+
+```bash
+export GRPC_PROTOC=$GRPC_TOOLS/protoc
+```
+
+Now that we can safely run `protoc`, we can download the Tyk Protocol Buffers definition files. These files contain the data structures used by Tyk. See [Data Structures](/api-management/plugins/rich-plugins#rich-plugins-data-structures) for more information:
+
+```bash
+cd ~/tyk-plugin
+git clone https://github.com/TykTechnologies/tyk
+```
+
+##### Generate the bindings
+
+To generate the bindings, we create an empty directory and run the `protoc` tool using the environment variable that was set before:
+
+```bash
+mkdir Coprocess
+$GRPC_PROTOC -I=tyk/coprocess/proto --csharp_out=Coprocess --grpc_out=Coprocess --plugin=protoc-gen-grpc=$GRPC_TOOLS/grpc_csharp_plugin tyk/coprocess/proto/*.proto
+```
+
+Run the following command to check the binding directory:
+
+```bash
+ls Coprocess
+```
+
+The output will look like this:
+
+```
+CoprocessCommon.cs      CoprocessObject.cs      CoprocessReturnOverrides.cs
+CoprocessMiniRequestObject.cs   CoprocessObjectGrpc.cs              CoprocessSessionState.cs
+```
+
+##### Implement Server
+
+Create a file called `Server.cs`.
+
+Add the following code to `Server.cs`.
+
+```c#
+using System;
+using System.Threading.Tasks;
+using Grpc.Core;
+
+using Coprocess;
+
+class DispatcherImpl : Dispatcher.DispatcherBase
+{
+  public DispatcherImpl()
+  {
+    Console.WriteLine("Instantiating DispatcherImpl");
+  }
+
+
+  // The Dispatch method will be called by Tyk for every configured hook, we'll implement a very simple dispatcher here:
+  public override Task<Coprocess.Object> Dispatch(Coprocess.Object thisObject, ServerCallContext context)
+  {
+    // thisObject is the request object:
+    Console.WriteLine("Receiving object: " + thisObject.ToString());
+
+    // hook contains the hook name, this will be defined in our plugin bundle and the implementation will be a method in this class (DispatcherImpl), we'll look it up:
+    var hook = this.GetType().GetMethod(thisObject.HookName);
+
+    // If hook is null then a handler method for this hook isn't implemented, we'll log this anyway:
+    if (hook == null)
+    {
+      Console.WriteLine("Hook name: " + thisObject.HookName + " (not implemented!)");
+      // We return the unmodified request object, so that Tyk can proxy this in the normal way.
+      return Task.FromResult(thisObject);
+    };
+
+    // If there's a handler method, let's log it and proceed with our dispatch work:
+    Console.WriteLine("Hook name: " + thisObject.HookName + " (implemented)");
+
+    // This will dynamically invoke our hook method, and cast the returned object to the required Protocol Buffers data structure:
+    var output = hook.Invoke(this, new object[] { thisObject, context });
+    return (Task<Coprocess.Object>)output;
+  }
+
+  // MyPreMiddleware implements a PRE hook, it will be called before the request is proxied upstream and before the authentication step:
+  public Task<Coprocess.Object> MyPreMiddleware(Coprocess.Object thisObject, ServerCallContext context)
+  {
+    Console.WriteLine("Calling MyPreMiddleware.");
+    // We'll inject a header in this request:
+    thisObject.Request.SetHeaders["my-header"] = "my-value";
+    return Task.FromResult(thisObject);
+  }
+
+  // MyAuthCheck implements a custom authentication mechanism, it will initialize a session object if the token matches a certain value:
+  public Task<Coprocess.Object> MyAuthCheck(Coprocess.Object thisObject, ServerCallContext context)
+  {
+    // Request.Headers contains all the request headers, we retrieve the authorization token:
+    var token = thisObject.Request.Headers["Authorization"];
+    Console.WriteLine("Calling MyAuthCheck with token = " + token);
+
+    // We initialize a session object if the token matches "abc123":
+    if (token == "abc123")
+    {
+      Console.WriteLine("Successful auth!");
+      var session = new Coprocess.SessionState();
+      session.Rate = 1000;
+      session.Per = 10;
+      session.QuotaMax = 60;
+      session.QuotaRenews = 1479033599;
+      session.QuotaRemaining = 0;
+      session.QuotaRenewalRate = 120;
+      session.Expires = 1479033599;
+
+      session.LastUpdated = 1478033599.ToString();
+
+      thisObject.Metadata["token"] = token;
+      thisObject.Session = session;
+      return Task.FromResult(thisObject);
+
+    }
+
+    // If the token isn't "abc123", we return the request object in the original state, without a session object, Tyk will reject this request:
+    Console.WriteLine("Rejecting auth!");
+    return Task.FromResult(thisObject);
+  }
+}
+```
+
+Create a file called `Program.cs` to instantiate our dispatcher implementation and start a gRPC server.
+
+Add the following code to `Program.cs`. 
+
+```bash
+using System;
+using Grpc.Core;
+
+namespace tyk_plugin
+{
+  class Program
+  {
+
+    // Port to attach the gRPC server to:
+    const int Port = 5555;
+
+    static void Main(string[] args)
+    {
+      // We initialize a  Grpc.Core.Server and attach our dispatcher implementation to it:
+      Server server = new Server
+      {
+          Services = { Coprocess.Dispatcher.BindService(new DispatcherImpl()) },
+          Ports = { new ServerPort("localhost", Port, ServerCredentials.Insecure) }
+      };
+      server.Start();
+
+      Console.WriteLine("gRPC server listening on " + Port);
+      Console.WriteLine("Press any key to stop the server...");
+      Console.ReadKey();
+
+      server.ShutdownAsync().Wait();
+
+    }
+  }
+}
+```
+
+To run the gRPC server use the following command from the plugin directory:
+
+```bash
+dotnet run
+```
+
+The gRPC server will listen on port 5555 (as defined in `Program.cs`). In the next steps we'll setup the plugin bundle and modify Tyk to connect to our gRPC server.
+
+#### Bundle the Plugin
+
+We need to create a manifest file within the `tyk-plugin` directory. This file contains information about our plugin and how we expect it to interact with the API that will load it. This file should be named `manifest.json` and needs to contain the following:
+
+```json
+{
+  "custom_middleware": {
+    "driver": "grpc",
+    "auth_check": {
+      "name": "MyAuthMiddleware",
+      "path": "",
+      "raw_body_only": false,
+      "require_session": false
+    }
+  }
+}
+```
+
+- The `custom_middleware` block contains the middleware settings like the plugin driver we want to use (`driver`) and the hooks that our plugin will expose. We use the `auth_check` hook for this tutorial. For other hooks see [here](/api-management/plugins/rich-plugins#coprocess-dispatcher-hooks).
+- The `name` field references the name of the function that we implement in our plugin code - `MyAuthMiddleware`. This will be handled by our dispatcher gRPC method (implemented in `Server.cs`).
+- The `path` field is the path to the middleware component.
+- The `raw_body_only` field 
+- The `require_session` field, if set to `true` gives you access to the session object. It will be supplied as a session variable to your middleware processor function
+
+
+To bundle our plugin run the following command in the `tyk-plugin` directory. Check your tyk-cli install path first:
+
+```bash
+/opt/tyk-gateway/utils/tyk-cli bundle build -y
+```
+
+From Tyk v2.8 upwards you can use:
+```bash
+/opt/tyk-gateway/bin/tyk bundle build -y
+```
+
+A plugin bundle is a packaged version of the plugin. It may also contain a cryptographic signature of its contents. The `-y` flag tells the Tyk CLI tool to skip the signing process in order to simplify the flow of this tutorial. 
+
+For more information on the Tyk CLI tool, see [here](/api-management/plugins/overview#plugin-bundles).
+
+You should now have a `bundle.zip` file in the `tyk-plugin` directory.
+
+#### Publish the Plugin
+
+To publish the plugin, copy or upload `bundle.zip` to a local web server like Nginx, or Apache or storage like Amazon S3. For this tutorial we'll assume you have a web server listening on `localhost` and accessible through `http://localhost`.
+
+<GrpcInclude/>
+
+#### What's Next?
+
+In this tutorial we learned how Tyk gRPC plugins work. For a production-level setup we suggest the following:
+
+- Configure an appropriate web server and path to serve your plugin bundles.
+- See the following [GitHub repo](https://github.com/TykTechnologies/tyk-plugin-demo-dotnet) for a gRPC based .NET plugin that incorporates authentication based on Microsoft SQL Server. 
+
+[1]: /tyk-self-managed/install
+[2]: https://github.com/TykTechnologies/tyk-cli
+[3]: /img/dashboard/system-management/plugin_options.png
+[4]: /img/dashboard/system-management/plugin_auth_mode.png
+
+### Create Custom Authentication Plugin with NodeJS
+
+This tutorial will guide you through the creation of a custom authentication plugin for Tyk with a gRPC based plugin written in NodeJS. For additional information about gRPC, check the official documentation [here](https://grpc.io/docs/guides/index.html).
+
+The sample code that we'll use implements a very simple authentication layer using NodeJS and the proper gRPC bindings generated from our Protocol Buffers definition files.
+
+<img src="/img/dashboard/system-management/custom_grpc_authentication.png" alt="gRPC Auth Diagram" />
+
+#### Requirements
+
+- Tyk Gateway: This can be installed using standard package management tools like Yum or APT, or from source code. See [here](/tyk-self-managed/install) for more installation options.
+- The Tyk CLI utility, which is bundled with our RPM and DEB packages, and can be installed separately from [https://github.com/TykTechnologies/tyk-cli](https://github.com/TykTechnologies/tyk-cli)
+- In Tyk 2.8 and upwards the Tyk CLI is part of the gateway binary, you can find more information by running "tyk help bundle".
+- NodeJS v6.x.x [https://nodejs.org/en/download/](https://nodejs.org/en/download/) 
+
+#### Create the Plugin
+
+##### Create NodeJS Project
+
+We will use the NPM tool to initialize our project, follow the steps provided by the `init` command:
+
+```bash
+cd ~
+mkdir tyk-plugin
+cd tyk-plugin
+npm init
+```
+
+Now we'll add the gRPC package for this project:
+
+```bash
+npm install --save grpc
+```
+
+##### Install gRPC Tools
+
+Typically to use gRPC and Protocol Buffers you need to use a code generator and generate bindings for the target language that you're using. For this tutorial we'll skip this step and use the dynamic loader that's provided by the NodeJS gRPC library. This mechanism allows a program to load Protocol Buffers definitions directly from `.proto` files. See [this section](https://grpc.io/docs/tutorials/basic/node.html#loading-service-descriptors-from-proto-files) in the gRPC documentation for more details.
+
+To fetch the required `.proto` files, you may use an official repository where we keep the Tyk Protocol Buffers definition files:
+
+```bash
+cd ~/tyk-plugin
+git clone https://github.com/TykTechnologies/tyk
+```
+
+##### Implement Server
+
+Now we're ready to implement our gRPC server, create a file called `main.js` in the project's directory
+
+Add the following code to `main.js`.
+
+```nodejs
+const grpc = require('grpc'),
+  resolve = require('path').resolve
+
+const tyk = grpc.load({
+  file: 'coprocess_object.proto',
+  root: resolve(__dirname, 'tyk/coprocess/proto')
+}).coprocess
+
+const listenAddr = '127.0.0.1:5555',
+    authHeader = 'Authorization'
+    validToken = '71f6ac3385ce284152a64208521c592b'
+
+// The dispatch function is called for every hook:
+const dispatch = (call, callback) => {
+  var obj = call.request
+  // We dispatch the request based on the hook name, we pass obj.request which is the coprocess.Object:
+  switch (obj.hook_name) {
+    case 'MyPreMiddleware':
+      preMiddleware(obj, callback)
+      break
+    case 'MyAuthMiddleware':
+      authMiddleware(obj, callback)
+      break
+    default:
+      callback(null, obj)
+      break
+  }
+}
+
+const preMiddleware = (obj, callback) => {
+  var req = obj.request
+
+  // req is the coprocess.MiniRequestObject, we inject a header using the "set_headers" field:
+  req.set_headers = {
+    'mycustomheader': 'mycustomvalue'
+  }
+
+  // Use this callback to finish the operation, sending back the modified object:
+  callback(null, obj)
+}
+
+const authMiddleware = (obj, callback) => {
+  var req = obj.request
+
+  // We take the value from the "Authorization" header:
+  var token = req.headers[authHeader]
+
+  // The token should be attached to the object metadata, this is used internally for key management:
+  obj.metadata = {
+    token: token
+  }
+
+  // If the request token doesn't match the  "validToken" constant we return the call:
+  if (token != validToken) {
+    callback(null, obj)
+    return
+  }
+
+  // At this point the token is valid and a session state object is initialized and attached to the coprocess.Object:
+  var session = new tyk.SessionState()
+  session.id_extractor_deadline = Date.now() + 100000000000
+  obj.session = session
+  callback(null, obj)
+}
+
+main = function() {
+  server = new grpc.Server()
+  server.addService(tyk.Dispatcher.service, {
+      dispatch: dispatch
+  })
+  server.bind(listenAddr, grpc.ServerCredentials.createInsecure())
+  server.start()
+}
+
+main()
+```
+
+
+To run the gRPC server run:
+
+```bash
+node main.js
+```
+
+The gRPC server will listen on port `5555` (see the `listenAddr` constant). In the next steps we'll setup the plugin bundle and modify Tyk to connect to our gRPC server.
+
+
+#### Bundle the Plugin
+
+We need to create a manifest file within the `tyk-plugin` directory. This file contains information about our plugin and how we expect it to interact with the API that will load it. This file should be named `manifest.json` and needs to contain the following:
+
+```json
+{
+  "custom_middleware": {
+    "driver": "grpc",
+    "auth_check": {
+      "name": "MyAuthMiddleware",
+      "path": "",
+      "raw_body_only": false,
+      "require_session": false
+    }
+  }
+}
+```
+
+- The `custom_middleware` block contains the middleware settings like the plugin driver we want to use (`driver`) and the hooks that our plugin will expose. We use the `auth_check` hook for this tutorial. For other hooks see [here](/api-management/plugins/rich-plugins#coprocess-dispatcher-hooks).
+- The `name` field references the name of the function that we implement in our plugin code - `MyAuthMiddleware`. The implemented dispatcher uses a switch statement to handle this hook, and calls the `authMiddleware` function in `main.js`.
+- The `path` field is the path to the middleware component.
+- The `raw_body_only` field 
+- The `require_session` field, if set to `true` gives you access to the session object. It will be supplied as a session variable to your middleware processor function
+
+To bundle our plugin run the following command in the `tyk-plugin` directory. Check your tyk-cli install path first:
+
+```bash
+/opt/tyk-gateway/utils/tyk-cli bundle build -y
+```
+
+For Tyk 2.8 use:
+```bash
+/opt/tyk-gateway/bin/tyk bundle build -y
+```
+
+A plugin bundle is a packaged version of the plugin. It may also contain a cryptographic signature of its contents. The `-y` flag tells the Tyk CLI tool to skip the signing process in order to simplify the flow of this tutorial. 
+
+For more information on the Tyk CLI tool, see [here](/api-management/plugins/overview#plugin-bundles).
+
+You should now have a `bundle.zip` file in the `tyk-plugin` directory.
+
+#### Publish the Plugin
+
+To publish the plugin, copy or upload `bundle.zip` to a local web server like Nginx, Apache or storage like Amazon S3. For this tutorial we'll assume you have a web server listening on `localhost` and accessible through `http://localhost`.
+
+<GrpcInclude/>
+
+
+#### What's Next?
+
+In this tutorial we learned how Tyk gRPC plugins work. For a production-level setup we suggest the following:
+
+- Configure an appropriate web server and path to serve your plugin bundles.
+
+[1]: /tyk-self-managed/install
+[2]: https://github.com/TykTechnologies/tyk-cli
+[3]: /img/dashboard/system-management/plugin_options.png
+[4]: /img/dashboard/system-management/plugin_auth_mode.png
+
+### Create Custom Authentication Plugin With Python
+
+In the realm of API security, HMAC-signed authentication serves as a foundational concept. In this developer-focused blog post, we'll use HMAC-signed authentication as the basis for learning how to write gRPC custom authentication plugins with Tyk Gateway. Why learn how to write Custom Authentication Plugins?
+
+- **Foundational knowledge**: Writing custom authentication plugins provides foundational knowledge of Tyk's extensibility and customization capabilities.
+- **Practical experience**: Gain hands-on experience in implementing custom authentication logic tailored to specific use cases, starting with HMAC-signed authentication.
+- **Enhanced control**: Exercise greater control over authentication flows and response handling, empowering developers to implement advanced authentication mechanisms beyond built-in features.
+
+While Tyk Gateway offers built-in support for HMAC-signed authentication, this tutorial serves as a practical guide for developers looking to extend Tyk's capabilities through custom authentication plugins. It extends the gRPC server that we developed in our [getting started guide](/api-management/plugins/rich-plugins#using-python).
+
+We will develop a basic gRPC server that implements the Tyk Dispatcher service with a custom authentication plugin to handle authentication keys, signed using the HMAC SHA512 algorithm. Subsequently, you will be able to make a request to your API with a HMAC signed authentication key in the *Authorization* header. Tyk Gateway will intercept the request and forward it to your Python gRPC server for HMAC signature and token verification.
+
+Our plugin will only verify the key against an expected value. In a production environment it will be necessary to verify the key against Redis storage.
+
+Before we continue ensure that you have:
+
+- Read and completed our getting started guide that explains how to implement a basic Python gRPC server to echo the request payload received from Tyk Gateway. This tutorial extends the source code of the tyk_async_server.py file to implement a custom authentication plugin for a HMAC signed authentication key.
+- Read our HMAC signatures documentation for an explanation of HMAC signed authentication  with Tyk Gateway. A brief summary is given in the HMAC Signed Authentication section below. 
+
+
+#### HMAC Signed Authentication
+
+Before diving in further, we will give a brief overview of HMAC signed authentication using our custom authentication plugin.
+
+- **Client request**: The journey begins with a client requesting access to a protected resource on the Tyk API.
+- **HMAC signing**: Before dispatching the request, the client computes an HMAC signature using a secret key and request date, ensuring the payload's integrity.
+- **Authorization header**: The HMAC signature, along with essential metadata such as the API key and HMAC algorithm, is embedded within the Authorization header.
+- **Tyk Gateway verification**: Upon receipt, Tyk Gateway forwards the request to our gRPC server to execute the custom authentication plugin. This will validate the HMAC signature, ensuring the request's authenticity before proceeding with further processing.
+
+Requests should be made to an API that uses our custom authentication plugin as follows. A HMAC signed key should be included in the *Authorization* header and a date/time string in the *Date* header. An example request is shown in the curl command below:
+
+```bash
+curl -v -H 'Date: Fri, 03 May 2024 12:00:42 GMT' \
+-H 'Authorization: Signature keyId="eyJvcmciOiI1ZTlkOTU0NGExZGNkNjAwMDFkMGVkMjAiLCJpZCI6ImdycGNfaG1hY19rZXkiLCJoIjoibXVybXVyNjQifQ==", \
+algorithm="hmac-sha512",signature="9kwBK%2FyrjbSHJDI7INAhBmhHLTHRDkIe2uRWHEP8bgQFQvfXRksm6t2MHeLUyk9oosWDZyC17AbGeP8EFqrp%2BA%3D%3D"' \
+http://localhost:8080/grpc-custom-auth/get
+```
+
+From the above example, it should be noted that:
+
+- The *Date* header contains a date string formatted as follows: *Fri, 03 May 2024 11:06:00 GMT*.
+- The *Authorization* header is formatted as `Signature keyId="<keyId>", algorithm="<hmac-algorithm>", signature="<hmac signature>"` where:
+
+    - **keyId** is a Tyk authentication key.
+    - **algorithm** is the HMAC algorithm used to sign the signature, *hmac-sha512* or *hmac-sha256*. 
+    - **signature** is the HAMC signature calculated with the date string from the *Date* header, signed with a base64 encoded secret value, using the specified HMAC algorithm. The HMAC signature is then encoded as base64.
+
+#### Prerequisites
+
+Firstly, we need to create the following:
+
+- An API configured to use a custom authentication plugin.
+- A HMAC enabled key with a configured secret for signing.
+
+This will enable us to issue a request to test that Tyk Gateway integrates with our custom authentication plugin on the gRPC server.
+
+###### Create API
+
+We will create an API served by Tyk Gateway, that will forward requests upstream to https://httpbin.org/. 
+
+The API will have the following parameters configured:
+
+- **Listen path**: Tyk Gateway will listen to API requests on */grpc-custom-auth/* and will strip the listen path for upstream requests.
+- **Target URL**: The target URL will be configured to send requests to *http://httpbin/*.
+- **Authentication Mode**: The authentication mode will be configured for custom authentication. This is used to trigger CoProcess (gRPC), Python or JSVM plugins to handle custom authentication.
+
+You can use the following Tyk Classic API definition to get you started, replacing the *org_id* with the ID of your organization.
+
+```json
+{
+    "api_definition": {
+        "id": "662facb2f03e750001a03500",
+        "api_id": "6c56dd4d3ad942a94474df6097df67ed",
+        "org_id": "5e9d9544a1dcd60001d0ed20",
+        "name": "Python gRPC Custom Auth",
+        "enable_coprocess_auth": true,
+        "auth": {
+            "auth_header_name": "Authorization"
+        },
+        "proxy": {
+            "preserve_host_header": false,
+            "listen_path": "/grpc-custom-auth/",
+            "disable_strip_slash": true,
+            "strip_listen_path": true,
+            "target_url": "http://httpbin/"
+        },
+        "version_data": {
+            "not_versioned": false,
+            "versions": {
+                "Default": {
+                    "name": "Default",
+                    "expires": "",
+                    "use_extended_paths": true,
+                    "extended_paths": {
+                        "ignored": [],
+                        "white_list": [],
+                        "black_list": []
+                    }
+                }
+            },
+            "default_version": "Default"
+        },
+        "active": true
+    }
+}
+```
+
+The Tyk API definition above can be imported via Tyk Dashboard. Alternatively, if using Tyk Gateway OSS, a POST request can be made to the *api/apis* endpoint of Tyk Gateway. Consult the [Tyk Gateway Open API Specification documentation](/tyk-gateway-api) for usage.
+
+An illustrative example using *curl* is given below. Please note that you will need to:
+
+- Update the location to use the protocol scheme, host and port suitable for your environment.
+- Replace the value in the *x-tyk-authorization* header with the secret value in your *tyk.conf* file.
+- Replace the *org_id* with the ID of your organization.
+
+```bash
+curl -v \
+	--header 'Content-Type: application/json' \
+  	--header 'x-tyk-authorization: your Gateway admin secret' \
+	--location http://localhost:8080/tyk/apis/ \
+	--data '{\
+		"api_definition": {\
+			"id": "662facb2f03e750001a03502",\
+			"api_id": "6c56dd4d3ad942a94474df6097df67ef",\
+			"org_id": "5e9d9544a1dcd60001d0ed20",\
+			"name": "Python gRPC Custom Auth",\
+			"enable_coprocess_auth": true,\
+			"auth": {\
+				"auth_header_name": "Authorization"\
+			},\
+			"proxy": {\
+				"preserve_host_header": false,\
+				"listen_path": "/grpc-custom-auth-error/",\
+				"disable_strip_slash": true,\
+				"strip_listen_path": true,\
+				"target_url": "http://httpbin/"\
+			},\
+			"version_data": {\
+				"not_versioned": false,\
+				"versions": {\
+					"Default": {\
+						"name": "Default",\
+						"expires": "",\
+						"use_extended_paths": true,\
+						"extended_paths": {\
+							"ignored": [],\
+							"white_list": [],\
+							"black_list": []\
+						}\
+					}\
+				},\
+				"default_version": "Default"\
+			},\
+			"active": true\
+		}\
+	}'
+```
+
+A response similar to that given below will be returned by Tyk Gateway:
+
+```bash
+{
+    "key": "f97b748fde734b099001ca15f0346dfe",
+    "status": "ok",
+    "action": "added"
+}
+```
+
+###### Create HMAC Key
+
+We will create an key configured to use HMAC signing, with a secret of *secret*. The key will configured to have access to our test API.
+
+You can use the following configuration below, replacing the value of the *org_id* with the ID of your organization.
+
+```bash
+{
+    "quota_max": 1000,
+    "quota_renews": 1596929526,
+    "quota_remaining": 1000,
+    "quota_reset": 1596843126,
+    "quota_used": 0,
+    "org_id": "5e9d9544a1dcd60001d0ed20",
+    "access_rights": {
+        "662facb2f03e750001a03500": {
+            "api_id": "662facb2f03e750001a03500",
+            "api_name": "Python gRPC Custom Auth",
+            "versions": ["Default"],
+            "allowed_urls": [],
+            "limit": null,
+            "quota_max": 1000,
+            "quota_renews": 1596929526,
+            "quota_remaining": 1000,
+            "quota_reset": 1596843126,
+            "quota_used": 0,
+            "per": 1,
+            "expires": -1
+        }
+    },
+    "enable_detailed_recording": true,
+    "hmac_enabled": true,
+    "hmac_string": "secret",
+    "meta_data": {}
+}
+```
+
+You can use Tyk Gateway’s API to create the key by issuing a POST request to the *tyk/keys* endpoint. Consult the [Tyk Gateway Open API Specification documentation](/tyk-gateway-api) for usage.
+
+An illustrative example using *curl* is given below. Please note that you will need to:
+
+- Update the location to use the protocol scheme, host and port suitable for your environment.
+- Replace the value in the *x-tyk-authorization* header with the secret value in your *tyk.conf* file.
+
+Replace the *org_id* with the ID of your organization.
+
+```bash
+curl --location 'http://localhost:8080/tyk/keys/grpc_hmac_key' \
+--header 'x-tyk-authorization: your Gateay admin secret' \
+--header 'Content-Type: application/json' \
+--data '{\
+    "alias": "grpc_hmac_key",\
+    "quota_max": 1000,\
+    "quota_renews": 1596929526,\
+    "quota_remaining": 1000,\
+    "quota_reset": 1596843126,\
+    "quota_used": 0,\
+    "org_id": "5e9d9544a1dcd60001d0ed20",\
+    "access_rights": {\
+        "662facb2f03e750001a03500": {\
+            "api_id": "662facb2f03e750001a03500",\
+            "api_name": "python-grpc-custom-auth",\
+            "versions": ["Default"],\
+            "allowed_urls": [],\
+            "limit": null,\
+            "quota_max": 1000,\
+            "quota_renews": 1596929526,\
+            "quota_remaining": 1000,\
+            "quota_reset": 1596843126,\
+            "quota_used": 0,\
+            "per": 1,\
+            "expires": -1\
+        }\
+    },\
+    "enable_detailed_recording": true,\
+    "hmac_enabled": true,\
+    "hmac_string": "secret",\
+    "meta_data": {}\
+}\
+'
+```
+
+A response similar to that given below should be returned by Tyk Gateway:
+
+```json
+{
+    "key": "eyJvcmciOiI1ZTlkOTU0NGExZGNkNjAwMDFkMGVkMjAiLCJpZCI6ImdycGNfaG1hY19rZXkiLCJoIjoibXVybXVyNjQifQ==",
+    "status": "ok",
+    "action": "added",
+    "key_hash": "a72fcdc09caa86b5"
+}
+```
+
+
+<Note>
+Make a note of the key ID given in the response, since we will need this to test our API.
+</Note>
+
+
+#### Implement Plugin
+
+Our custom authentication plugin will perform the following tasks:
+
+- Extract the *Authorization* and *Date* headers from the request object.
+- Parse the *Authorization* header to extract the *keyId*, *algorithm* and *signature* attributes.
+- Compute the HMAC signature using the specific algorithm and date included in the header.
+- Verify that the computed HMAC signature matches the signature included in the *Authorization* header. A 401 error response will be returned if verification fails. Our plugin will only verify the key against an expected value. In a production environment it will be necessary to verify the key against Redis storage.
+- Verify that the *keyId* matches an expected value (VALID_TOKEN). A 401 error response will be returned to Tyk Gateway if verification fails.
+- If verification of the signature and key passes then update the session with HMAC enabled and set the HMAC secret. Furthermore, add the key to the *Object* metadata.
+
+Return the request *Object* containing the updated session back to Tyk Gateway. When developing custom authentication plugins it is the responsibility of the developer to update the session state with the token, in addition to setting the appropriate response status code and error message when authentication fails.
+
+##### Import Python Modules
+
+Ensure that the following Python modules are imported at the top of your *tyk_async_server.py* file:
+
+```python
+import asyncio
+import base64
+import hashlib
+import hmac
+import json
+import re
+import signal
+import logging
+import urllib.parse
+
+import grpc
+from google.protobuf.json_format import MessageToJson
+from grpc_reflection.v1alpha import reflection
+import coprocess_object_pb2_grpc
+import coprocess_object_pb2
+from coprocess_common_pb2 import HookType
+from coprocess_session_state_pb2 import SessionState
+```
+
+##### Add Constants
+
+Add the following constants to the top of the *tyk_async_server.py* file, after the import statements:
+
+```bash
+SECRET = "c2VjcmV0"
+VALID_TOKEN = "eyJvcmciOiI1ZTlkOTU0NGExZGNkNjAwMDFkMGVkMjAiLCJpZCI6ImdycGNfaG1hY19rZXkiLCJoIjoibXVybXVyNjQifQ=="
+```
+
+- **SECRET** is a base64 representation of the secret used for HMAC signing.
+- **VALID_TOKEN** is the key ID that we will authenticate against.
+
+The values listed above are designed to align with the examples provided in the *Prerequisites* section, particularly those related to HMAC key generation. If you've made adjustments to the HMAC secret or you've modified the key alias referred to in the endpoint path (for instance, *grpc_hmac_key*), you'll need to update these constants accordingly.
+
+##### Extract headers
+
+Add the following function to your *tyk_async_server.py* file to extract a dictionary of the key value pairs from the *Authorization* header. We will use a regular expression to extract the key value pairs.
+
+```python
+def parse_auth_header(auth_header: str) -> dict[str,str]:
+    pattern = r'(\w+)\s*=\s*"([^"]+)"'
+
+    matches = re.findall(pattern, auth_header)
+
+    parsed_data = dict(matches)
+
+    return parsed_data
+```
+
+##### Compute HMAC Signature
+
+Add the following function to your *tyk_async_server.py* to compute the HMAC signature.
+
+```python
+def generate_hmac_signature(algorithm: str, date_string: str, secret_key: str) -> str:
+
+    if algorithm == "hmac-sha256":
+        hash_algorithm = hashlib.sha256
+    elif algorithm == "hmac-sha512":
+        hash_algorithm = hashlib.sha512
+    else:
+        raise ValueError("Unsupported hash algorithm")
+
+    base_string = f"date: {date_string}"
+
+    logging.info(f"generating signature from: {base_string}")
+    hmac_signature = hmac.new(secret_key.encode(), base_string.encode(), hash_algorithm)
+
+    return base64.b64encode(hmac_signature.digest()).decode()
+```
+
+Our function accepts three parameters:
+
+- **algorithm** is the HMAC algorithm to use for signing. We will use HMAC SHA256 or HMAC SHA512 in our custom authentication plugin
+- **date_string** is the date extracted from the date header in the request sent by Tyk Gateway.
+- **secret_key** is the value of the secret used for signing.
+
+The function computes and returns the HMAC signature for a string formatted as *date: date_string*, where *date_string* corresponds to the value of the *date_string* parameter. The signature is computed using the secret value given in the *secret_key* parameter and the HMAC algorithm given in the *algorithm* parameter. A *ValueError* is raised if the hash algorithm is unrecognized. 
+
+We use the following Python modules in our implementation:
+
+- hmac Python module to compute the HMAC signature.
+- base64 Python module to encode the result.
+
+##### Verify HMAC Signature
+
+Add the following function to your *tyk_async_server.py* file to verify the HMAC signature provided by the client:
+
+```python
+def verify_hmac_signature(algorithm: str, signature: str, source_string) -> bool:
+
+    expected_signature = generate_hmac_signature(algorithm, source_string, SECRET)
+    received_signature = urllib.parse.unquote(signature)
+
+    if expected_signature != received_signature:
+        error = f"Signatures did not match\nreceived: {received_signature}\nexpected: {expected_signature}"
+        logging.error(error)
+    else:
+        logging.info("Signatures matched!")
+
+    return expected_signature == received_signature
+```
+
+Our function accepts three parameters:
+
+- **algorithm** is the HMAC algorithm to use for signing. We will use hmac-sha256 or hmac-sha512 in our custom authentication plugin.
+- **signature** is the signature string extracted from the *Authorization* header.
+- **source_string** is the date extracted from the date header in the request sent by Tyk Gateway.
+- **secret_key** is the value of the secret used for signing.
+
+The function calls *generate_hmac_signature* to verify the signatures match. It returns true if the computed and client HMAC signatures match, otherwise false is returned.
+
+##### Set Error Response
+
+Add the following helper function to *tyk_async_server.py* to allow us to set the response status and error message if authentication fails.
+
+```python
+def set_response_error(object: coprocess_object_pb2.Object, code: int, message: str) -> None:
+    object.request.return_overrides.response_code = code
+    object.request.return_overrides.response_error = message
+```
+
+Our function accepts the following three parameters:
+
+- **object** is an instance of the [Object](/api-management/plugins/rich-plugins#coprocess-object) message representing the payload sent by Tyk Gateway to the *Dispatcher* service in our gRPC server. For further details of the payload structure dispatched by Tyk Gateway to a gRPC server please consult our gRPC documentation.
+- **code** is the HTTP status code to return in the response.
+- **message** is the response message.
+
+The function modifies the *return_overrides* attribute of the request, updating the response status code and error message. The *return_overrides* attribute is an instance of a [ReturnOverrides](/api-management/plugins/rich-plugins#returnoverrides) message that can be used to override the response of a given HTTP request. When this attribute is modified the request is terminated and is not sent upstream.
+
+##### Authenticate
+
+Add the following to your *tyk_async_server.py* file to implement the main custom authentication function. This parses the headers to extract the signature and date from the request, in addition to verifying the HMAC signature and key:
+
+```python
+def authenticate(object: coprocess_object_pb2.Object) -> coprocess_object_pb2.Object:
+    keys_to_check = ["keyId", "algorithm", "signature"]
+
+    auth_header = object.request.headers.get("Authorization")
+    date_header = object.request.headers.get("Date")
+
+    parse_dict = parse_auth_header(auth_header)
+
+    if not all(key in parse_dict for key in keys_to_check) or not all([auth_header, date_header]):
+        set_response_error(object, 400, "Custom middleware: Bad request")
+        return object
+
+    try:
+        signature_valid = verify_hmac_signature(
+            parse_dict["algorithm"],
+            parse_dict["signature"],
+            date_header
+        )
+    except ValueError:
+        set_response_error(object, 400, "Bad HMAC request, unsupported algorithm")
+        return object
+
+    if not signature_valid or parse_dict["keyId"] != VALID_TOKEN:
+        set_response_error(object, 401, "Custom middleware: Not authorized")
+    else:
+        new_session = SessionState()
+        new_session.hmac_enabled = True
+        new_session.hmac_secret = SECRET
+
+        object.metadata["token"] = VALID_TOKEN
+        object.session.CopyFrom(new_session)
+
+    return object
+```
+
+The *Object* payload received from the Gateway is updated and returned as a response from the *Dispatcher* service:
+
+- If authentication fails then we set the error message and status code for the response accordingly, using our *set_response_error* function.
+- If authentication passes then we update the session attribute in the *Object* payload to indicate that HMAC verification was performed and provide the secret used for signing. We also add the verified key to the meta data of the request payload.
+
+Specifically, our function performs the following tasks:
+
+- Extracts the *Date* and *Authorization* headers from the request and verifies that the *Authorization* header is structured correctly, using our *parse_auth_header* function. We store the extracted *Authorization* header fields in the *parse_dict* dictionary. If the structure is invalid then a 400 bad request response is returned to Tyk Gateway, using our *set_response_error* function.
+- We use our *verify_hmac_signature* function to compute and verify the HMAC signature. A 400 bad request error is returned to the Gateway if HMAC signature verification fails, due to an unrecognized HMAC algorithm.
+- A 401 unauthorized error response is returned to the Gateway under the following conditions:
+
+    - The client HMAC signature and the computed HMAC signature do not match.
+    - The extracted key ID does not match the expected key value in VALID_TOKEN.
+
+- If HMAC signature verification passed and the key included in the *Authorization* header is valid then we update the *SessionState* instance to indicate that HMAC signature verification is enabled, i.e. *hmac_enabled* is set to true.  We also specify the HMAC secret used for signing in the *hmac_secret* field and include the valid token in the metadata dictionary.
+
+##### Integrate Plugin
+
+Update the *Dispatch* method of the *PythonDispatcher* class in your *tyk_async_server.py* file so that our authenticate function is called when the a request is made by Tyk Gateway to execute a custom authentication (*HookType.CustomKeyCheck*) plugin.
+
+```python
+class PythonDispatcher(coprocess_object_pb2_grpc.DispatcherServicer):
+    async def Dispatch(
+        self, object: coprocess_object_pb2.Object, context: grpc.aio.ServicerContext
+    ) -> coprocess_object_pb2.Object:
+        
+        logging.info(f"STATE for {object.hook_name}\n{MessageToJson(object)}\n")
+        
+        if object.hook_type == HookType.Pre:
+            logging.info(f"Pre plugin name: {object.hook_name}")
+            logging.info(f"Activated Pre Request plugin from API: {object.spec.get('APIID')}")
+        
+        elif object.hook_type == HookType.CustomKeyCheck:
+            logging.info(f"CustomAuth plugin: {object.hook_name}")
+            logging.info(f"Activated CustomAuth plugin from API: {object.spec.get('APIID')}")
+            
+            authenticate(object)
+
+        elif object.hook_type == HookType.PostKeyAuth:
+            logging.info(f"PostKeyAuth plugin name: {object.hook_name}")
+            logging.info(f"Activated PostKeyAuth plugin from API: {object.spec.get('APIID')}")
+        
+        elif object.hook_type == HookType.Post:
+            logging.info(f"Post plugin name: {object.hook_name}")
+            logging.info(f"Activated Post plugin from API: {object.spec.get('APIID')}")
+        
+        elif object.hook_type == HookType.Response:
+            logging.info(f"Response plugin name: {object.hook_name}")
+            logging.info(f"Activated Response plugin from API: {object.spec.get('APIID')}")
+            logging.info("--------\n")
+        
+        return object
+```
+
+#### Test Plugin
+
+Create the following bash script, *hmac.sh*, to issue a test request to an API served by Tyk Gateway. The script computes a HMAC signature and constructs the *Authorization* and *Date* headers for a specified API. The *Authorization* header contains the HMAC signature and key for authentication.
+
+Replace the following constant values with values suitable for your environment:
+
+- **KEY** represents the key ID for the HMAC signed key that you created at the beginning of this guide.
+- **HMAC_SECRET** represents the base64 encoded value of the secret for your HMAC key that you created at the beginning of this guide.
+- **BASE_URL** represents the base URL, containing the protocol scheme, host and port number that Tyk Gateway listens to for API requests.
+- **ENDPOINT** represents the path of your API that uses HMAC signed authentication.
+
+```bash
+#!/bin/bash
+
+BASE_URL=http://localhost:8080
+ENDPOINT=/grpc-custom-auth/get
+HMAC_ALGORITHM=hmac-sha512
+HMAC_SECRET=c2VjcmV0
+KEY=eyJvcmciOiI1ZTlkOTU0NGExZGNkNjAwMDFkMGVkMjAiLCJpZCI6ImdycGNfaG1hY19rZXkiLCJoIjoibXVybXVyNjQifQ==
+REQUEST_URL=${BASE_URL}${ENDPOINT}
+
+
+function urlencode() {
+  echo -n "$1" | perl -MURI::Escape -ne 'print uri_escape($_)' | sed "s/%20/+/g"
+}
+
+# Set date in expected format
+date="$(LC_ALL=C date -u +"%a, %d %b %Y %H:%M:%S GMT")"
+
+# Generate the signature using hmac algorithm with hmac secret from created Tyk key and
+# then base64 encoded
+signature=$(echo -n "date: ${date}" | openssl sha512 -binary -hmac "${HMAC_SECRET}" | base64)
+
+# Ensure the signature is base64 encoded
+url_encoded_signature=$(echo -n "${signature}" | perl -MURI::Escape -ne 'print uri_escape($_)' | sed "s/%20/+/g")
+
+# Output the date, encoded date, signature and the url encoded signature
+echo "request: ${REQUEST_URL}"
+echo "date: $date"
+echo "signature: $signature"
+echo "url_encoded_signature: $url_encoded_signature"
+
+# Make the curl request using headers
+printf "\n\n----\n\nMaking request to  http://localhost:8080/grpc-custom-auth/get\n\n"
+set -x
+curl -v -H "Date: ${date}" \
+    -H "Authorization: Signature keyId=\"${KEY}\",algorithm=\"${HMAC_ALGORITHM}\",signature=\"${url_encoded_signature}\"" \
+    ${REQUEST_URL}
+```
+
+After creating and saving the script, ensure that it is executable by issuing the following command:
+
+```bash
+chmod +x hmac.sh
+```
+
+Issue a test request by running the script:
+
+```bash
+./hmac.sh
+```
+
+Observe the output of your gRPC server. You should see the request payload appear in the console output for the server and your custom authentication plugin should have been triggered. An illustrative example is given below:
+
+```bash
+2024-05-13 12:53:49 INFO:root:STATE for CustomHMACCheck
+2024-05-13 12:53:49 {
+2024-05-13 12:53:49   "hookType": "CustomKeyCheck",
+2024-05-13 12:53:49   "hookName": "CustomHMACCheck",
+2024-05-13 12:53:49   "request": {
+2024-05-13 12:53:49     "headers": {
+2024-05-13 12:53:49       "User-Agent": "curl/8.1.2",
+2024-05-13 12:53:49       "Date": "Mon, 13 May 2024 11:53:49 GMT",
+2024-05-13 12:53:49       "Host": "localhost:8080",
+2024-05-13 12:53:49       "Authorization": "Signature keyId=\"eyJvcmciOiI1ZTlkOTU0NGExZGNkNjAwMDFkMGVkMjAiLCJpZCI6ImdycGNfaG1hY19rZXkiLCJoIjoibXVybXVyNjQifQ==\",algorithm=\"hmac-sha512\",signature=\"e9OiifnTDgi3PW2EGJWfeQXCuhuhi6bGLiGhUTFpjEfgdKmX%2FQOFrePAQ%2FAoSFGU%2FzpP%2FCabmQi4zQDPdRh%2FZg%3D%3D\"",
+2024-05-13 12:53:49       "Accept": "*/*"
+2024-05-13 12:53:49     },
+2024-05-13 12:53:49     "url": "/grpc-custom-auth/get",
+2024-05-13 12:53:49     "returnOverrides": {
+2024-05-13 12:53:49       "responseCode": -1
+2024-05-13 12:53:49     },
+2024-05-13 12:53:49     "method": "GET",
+2024-05-13 12:53:49     "requestUri": "/grpc-custom-auth/get",
+2024-05-13 12:53:49     "scheme": "http"
+2024-05-13 12:53:49   },
+2024-05-13 12:53:49   "spec": {
+2024-05-13 12:53:49     "bundle_hash": "d41d8cd98f00b204e9800998ecf8427e",
+2024-05-13 12:53:49     "OrgID": "5e9d9544a1dcd60001d0ed20",
+2024-05-13 12:53:49     "APIID": "6c56dd4d3ad942a94474df6097df67ed"
+2024-05-13 12:53:49   }
+2024-05-13 12:53:49 }
+2024-05-13 12:53:49 
+2024-05-13 12:53:49 INFO:root:CustomAuth plugin: CustomHMACCheck
+2024-05-13 12:53:49 INFO:root:Activated CustomAuth plugin from API: 6c56dd4d3ad942a94474df6097df67ed
+2024-05-13 12:53:49 INFO:root:generating signature from: date: Mon, 13 May 2024 11:53:49 GMT
+2024-05-13 12:53:49 INFO:root:Signatures matched!
+2024-05-13 12:53:49 INFO:root:--------
+```
+
+Try changing the SECRET and/or KEY constants with invalid values and observe the output of your gRPC server. You should notice that authentication fails. An illustrative example is given below:
+
+```
+2024-05-13 12:56:37 INFO:root:STATE for CustomHMACCheck
+2024-05-13 12:56:37 {
+2024-05-13 12:56:37   "hookType": "CustomKeyCheck",
+2024-05-13 12:56:37   "hookName": "CustomHMACCheck",
+2024-05-13 12:56:37   "request": {
+2024-05-13 12:56:37     "headers": {
+2024-05-13 12:56:37       "User-Agent": "curl/8.1.2",
+2024-05-13 12:56:37       "Date": "Mon, 13 May 2024 11:56:37 GMT",
+2024-05-13 12:56:37       "Host": "localhost:8080",
+2024-05-13 12:56:37       "Authorization": "Signature keyId=\"eyJvcmciOiI1ZTlkOTU0NGExZGNkNjAwMDFkMGVkMjAiLCJpZCI6ImdycGNfaG1hY19rZXkiLCJoIjoibXVybXVyNjQifQ==\",algorithm=\"hmac-sha512\",signature=\"KXhkWOS01nbxuFfK7wEBggkydXlKJswxbukiplboJ2n%2BU6JiYOil%2Bx4OE4edWipg4EcG9T49nvY%2Fc9G0XFJcfg%3D%3D\"",
+2024-05-13 12:56:37       "Accept": "*/*"
+2024-05-13 12:56:37     },
+2024-05-13 12:56:37     "url": "/grpc-custom-auth/get",
+2024-05-13 12:56:37     "returnOverrides": {
+2024-05-13 12:56:37       "responseCode": -1
+2024-05-13 12:56:37     },
+2024-05-13 12:56:37     "method": "GET",
+2024-05-13 12:56:37     "requestUri": "/grpc-custom-auth/get",
+2024-05-13 12:56:37     "scheme": "http"
+2024-05-13 12:56:37   },
+2024-05-13 12:56:37   "spec": {
+2024-05-13 12:56:37     "bundle_hash": "d41d8cd98f00b204e9800998ecf8427e",
+2024-05-13 12:56:37     "OrgID": "5e9d9544a1dcd60001d0ed20",
+2024-05-13 12:56:37     "APIID": "6c56dd4d3ad942a94474df6097df67ed"
+2024-05-13 12:56:37   }
+2024-05-13 12:56:37 }
+2024-05-13 12:56:37 
+2024-05-13 12:56:37 INFO:root:CustomAuth plugin: CustomHMACCheck
+2024-05-13 12:56:37 INFO:root:Activated CustomAuth plugin from API: 6c56dd4d3ad942a94474df6097df67ed
+2024-05-13 12:56:37 INFO:root:generating signature from: date: Mon, 13 May 2024 11:56:37 GMT
+2024-05-13 12:56:37 ERROR:root:Signatures did not match
+2024-05-13 12:56:37 received: KXhkWOS01nbxuFfK7wEBggkydXlKJswxbukiplboJ2n+U6JiYOil+x4OE4edWipg4EcG9T49nvY/c9G0XFJcfg==
+2024-05-13 12:56:37 expected: zT17C2tgDCYBJCgFFN/mknf6XydPaV98a5gMPNUHYxZyYwYedIPIhyDRQsMF9GTVFe8khCB1FhfyhpmzrUR2Lw==
+```
+
+#### Summary
+
+In this guide, we've explained how to write a Python gRPC custom authentication plugin for Tyk Gateway, using HMAC-signed authentication as a practical example. Through clear instructions and code examples, we've provided developers with insights into the process of creating custom authentication logic tailored to their specific API authentication needs.
+
+While Tyk Gateway already supports HMAC-signed authentication out of the box, this guide goes beyond basic implementation by demonstrating how to extend its capabilities through custom plugins. By focusing on HMAC-signed authentication, developers have gained valuable experience in crafting custom authentication mechanisms that can be adapted and expanded to meet diverse authentication requirements.
+
+It's important to note that the authentication mechanism implemented in this guide solely verifies the HMAC signature's validity and does not include access control checks against specific API resources. Developers should enhance this implementation by integrating access control logic to ensure authenticated requests have appropriate access permissions.
+
+By mastering the techniques outlined in this guide, developers are better equipped to address complex authentication challenges and build robust API security architectures using Tyk Gateway's extensibility features. This guide serves as a foundation for further exploration and experimentation with custom authentication plugins, empowering developers to innovate and customize API authentication solutions according to their unique requirements.
+
+---
+
+<br />
+
+### Performance
+
+These are some benchmarks performed on gRPC plugins.
+
+gRPC plugins may use different transports, we've tested TCP and Unix Sockets.
+
+#### TCP
+
+<img src="/img/diagrams/tcpResponseTime.png" alt="TCP Response Times" />
+
+<img src="/img/diagrams/tcpHitRate.png" alt="TCP Hit Rate" />
+
+#### Unix Socket
+
+<img src="/img/diagrams/unixResponseTime.png" alt="Unix Socket Response Times" />
+
+<img src="/img/diagrams/unixHitRate.png" alt="Unix Socket Hit Rate" />
+
+---
+
+## Using Lua
+
+### Overview
+
+#### Requirements
+
+Tyk uses [LuaJIT](http://luajit.org/). The main requirement is the LuaJIT shared library, you may find this as `libluajit-x` in most distros.
+
+For Ubuntu 14.04 you may use:
+
+`$ apt-get install libluajit-5.1-2
+$ apt-get install luarocks`
+
+The LuaJIT required modules are as follows:
+
+*   [lua-cjson](https://github.com/mpx/lua-cjson): in case you have `luarocks`, run: `$ luarocks install lua-cjson`
+
+#### How to write LuaJIT Plugins
+
+We have a demo plugin hosted in the repo [tyk-plugin-demo-lua](https://github.com/TykTechnologies/tyk-plugin-demo-lua). The project implements a simple middleware for header injection, using a Pre hook (see [Tyk custom middleware hooks](/api-management/plugins/javascript#using-javascript-with-tyk)) and [mymiddleware.lua](https://github.com/TykTechnologies/tyk-plugin-demo-lua/blob/master/mymiddleware.lua).
+#### Lua Performance
+Lua support is currently in beta stage. We are planning performance optimizations for future releases.
+#### Tyk Lua API Methods
+Tyk Lua API methods aren’t currently supported.
+
+### Lua Plugin Tutorial
+
+#### Settings in the API Definition
+
+To add a Lua plugin to your API, you must specify the bundle name using the `custom_middleware_bundle` field:
+
+```json
+{
+  "name": "Tyk Test API",
+  "api_id": "1",
+  "org_id": "default",
+  "definition": {
+    "location": "header",
+    "key": "version"
+  },
+  "auth": {
+    "auth_header_name": "authorization"
+  },
+  "use_keyless": true,
+  "version_data": {
+    "not_versioned": true,
+    "versions": {
+      "Default": {
+        "name": "Default",
+        "expires": "3000-01-02 15:04",
+        "use_extended_paths": true,
+        "extended_paths": {
+          "ignored": [],
+          "white_list": [],
+          "black_list": []
+        }
+      }
+    }
+  },
+  "proxy": {
+    "listen_path": "/quickstart/",
+    "target_url": "http://httpbin.org",
+    "strip_listen_path": true
+  },
+  "custom_middleware_bundle": "test-bundle",
+}
+```
+
+#### Global settings
+
+To enable Lua plugins you need to add the following block to `tyk.conf`:
+
+```json
+"coprocess_options": {
+  "enable_coprocess": true,
+},
+"enable_bundle_downloader": true,
+"bundle_base_url": "http://my-bundle-server.com/bundles/",
+"public_key_path": "/path/to/my/pubkey",
+```
+
+`enable_coprocess` enables the rich plugins feature.
+
+`enable_bundle_downloader` enables the bundle downloader.
+
+`bundle_base_url` is a base URL that will be used to download the bundle, in this example we have "test-bundle" specified in the API settings, Tyk will fetch the following URL: `http://my-bundle-server.com/bundles/test-bundle`.
+
+`public_key_path` sets a public key, this is used for verifying signed bundles, you may omit this if unsigned bundles are used.
+
+#### Running the Tyk Lua build
+
+To use Tyk with Lua support you will need to use an alternative binary, it is provided in the standard Tyk package but it has a different service name.
+
+Firstly stop the standard Tyk version:
+
+```console
+service tyk-gateway stop
+```
+
+and then start the Lua build:
+
+```console
+service tyk-gateway-lua start
+```
+
+
diff --git a/api-management/policies.mdx b/api-management/policies.mdx
new file mode 100644
index 0000000000..51a3d474da
--- /dev/null
+++ b/api-management/policies.mdx
@@ -0,0 +1,59 @@
+---
+title: "Understanding Policies"
+description: "Learn what Tyk Policies are, why you should use them, and how they interact with Sessions to manage access at scale."
+keywords: "Policies, Access Control, Rate Limits, Quotas, JWT Scopes, Multiple Policies"
+sidebarTitle: "Understanding Policies"
+---
+
+## Introduction
+
+In Tyk, a [**Session**](/api-management/access-control/sessions-and-keys/understanding-sessions) dictates the lifecycle, limits, and access rights for a specific client. However, managing these settings individually for thousands or millions of clients is inefficient and error-prone.
+
+This is where **Policies** come in. A Policy is essentially a reusable template or blueprint that defines a set of access rights, rate limits, and quotas. Instead of configuring these rules directly on every individual Session, you configure them once in a Policy, and then link multiple Sessions to that Policy.
+
+## Why Use Policies?
+
+We highly recommend using Policies as the primary method for managing access control in Tyk. 
+
+### 1. Management at Scale
+If you need to change a rate limit or grant access to a new API endpoint, doing so without Policies would require updating all the relevant Sessions in your database. With Policies, you simply update the Policy object once, and the changes instantly apply to all linked Sessions.
+
+### 2. Tiered Access Models
+Policies are perfect for implementing tiered subscription models (e.g., "Free", "Pro", and "Enterprise"). You can create a Policy for each tier with different rate limits and quotas, and assign clients to the appropriate Policy when they register.
+
+### 3. Granular Feature Toggles
+Because you can apply multiple Policies to a single Session, you can use Policies to represent individual features or add-ons. If a user purchases an add-on, you simply link the corresponding Policy to their Session.
+
+## How Policies are Managed
+
+How you [create and manage Policies](/api-management/access-control/policies/managing-policies) depends on your Tyk deployment:
+
+- **Tyk Dashboard (Cloud & Self-Managed)**: Policies are managed centrally via the Dashboard UI or the Dashboard API. They are stored in your database and automatically synchronized across all your connected Gateways.
+- **Tyk Open Source**: If you are using the open-source Gateway, Policies are typically defined in a local `policies.json` file or managed directly via the Gateway API.
+
+## How and When Policies are Applied
+
+When a Policy is linked to a Session, the Gateway does not permanently copy the Policy's rules into the Session data in Redis. 
+
+Instead, Policies are [applied](/api-management/access-control/policies/applying-policies) **dynamically during request processing**. 
+
+When a client makes a request, Tyk retrieves their Session from Redis (or the local cache). Tyk then looks up the linked Policies and overlays their rules onto the Session on the fly. 
+
+This dynamic application is what makes Policies so powerful: **updating a Policy immediately affects all existing Sessions linked to it**. The next time a client makes a request, Tyk will apply the newly updated Policy rules.
+
+### Applying Multiple Policies
+
+Tyk allows you to link more than one Policy to a single Session. This is incredibly useful for combining base access tiers with specific feature add-ons.
+
+When [multiple Policies](/api-management/access-control/policies/applying-policies#applying-multiple-policies) are applied to a Session, Tyk must merge their rules to determine the final access rights. For example Tyk uses the following merging logic:
+
+- **Rate Limits:** Tyk applies the most permissive rate limit settings. If Policy A allows 10 requests per second, and Policy B allows 100 requests per second, the Session will be allowed 100 requests per second.
+- **Access Rights:** Tyk combines the allowed URLs and methods from all policies. If Policy A allows `GET /users` and Policy B allows `POST /reports`, the Session will be allowed to do both.
+
+### JWT Scope-to-Policy Mapping
+
+For token-based authentication methods such as JWT and OAuth 2.0, Tyk offers a powerful feature called [**Scope-to-Policy Mapping**](/api-management/authentication/jwt-authorization#identifying-the-tyk-policies-to-be-applied).
+
+Instead of assigning a Policy to a client's Session statically, you can configure Tyk to inspect the claims within the token (such as the `scope` claim) and dynamically map those scopes to specific Tyk Policies.
+
+For example, if an Identity Provider issues a JWT with the scopes `read:data` and `admin`, Tyk can automatically apply the "Read-Only Policy" and the "Admin Policy" to the dynamically generated Session. This allows you to drive Tyk's granular access controls directly from your centralized Identity Provider.
\ No newline at end of file
diff --git a/api-management/rate-limit.mdx b/api-management/rate-limit.mdx
new file mode 100644
index 0000000000..a2bb1ca1f4
--- /dev/null
+++ b/api-management/rate-limit.mdx
@@ -0,0 +1,926 @@
+---
+title: "Rate Limiting"
+description: "Overview of Rate Limiting with the Tyk Gateway"
+keywords: "Rate Limit, Rate Limiting, Rate Limit Algorithms, Distributed Rate Limiter, Redis Rate Limiter, Fixed Window, Spike Arrest, Rate Limit Scope, Local, Local rate Limits, Tyk Classic, Tyk Classic API, Tyk OAS, Tyk OAS API, Rate Limiting, Global limits, Per API limits"
+sidebarTitle: "Rate Limiting"
+---
+
+## Introduction
+
+API rate limiting is a technique that allows you to control the rate at which clients can consume your APIs and is one of the fundamental aspects of managing traffic to your services. It serves as a safeguard against abuse, overloading, and denial-of-service attacks by limiting the rate at which an API can be accessed. By implementing rate limiting, you can ensure fair usage, prevent resource exhaustion, and maintain system performance and stability, even under high traffic loads.
+
+## What is rate limiting?
+
+Rate limiting involves setting thresholds for the maximum number of requests that can be made within a specific time window, such as requests per second, per minute, or per day. Once a client exceeds the defined rate limit, subsequent requests may be delayed, throttled, or blocked until the rate limit resets or additional capacity becomes available.
+
+## When might you want to use rate limiting?
+
+Rate limiting may be used as an extra line of defense around attempted denial of service attacks. For instance, if you have load-tested your current system and established a performance threshold that you would not want to exceed to ensure system availability and/or performance then you may want to set a global rate limit as a defense to ensure it hasn't exceeded.
+
+Rate limiting can also be used to ensure that one particular user or system accessing the API is not exceeding a determined rate. This makes sense in a scenario such as APIs which are associated with a monetization scheme where you may allow so many requests per second based on the tier in which that consumer is subscribed or paying for.
+
+Of course, there are plenty of other scenarios where applying a rate limit may be beneficial to your APIs and the systems that your APIs leverage behind the scenes.
+
+## How does rate limiting work?
+
+At a basic level, when rate limiting is in use, Tyk Gateway will compare the incoming request rate against the configured limit and will block requests that arrive at a higher rate. For example, let’s say you only want to allow a client to call the API a maximum of 10 times per minute. In this case, you would apply a rate limit to the API expressed as "10 requests per 60 seconds". This means that the client will be able to successfully call the API up to 10 times within any 60 second interval (or window) and after for any further requests within that window, the user will get an [HTTP 429 (Rate Limit Exceeded)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429) error response stating the rate limit has been exceeded.
+
+Tyk's rate limiter is configured using two variables:
+- `rate` which is the maximum number of requests that will be permitted during the interval (window)
+- `per` which is the length of the interval (window) in seconds
+
+So for this example you would configure `rate` to 10 (requests) and `per` to 60 (seconds).
+
+### Rate Limit Response Headers
+
+When rate limiting is active, API clients expect to see `X-RateLimit-*` headers in the HTTP response to inform clients about their current limits. 
+
+Historically, Tyk populated these headers (`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`) with quota data rather than rate limit data.
+
+From Tyk 5.13.0, you can control the behavior of these headers using the [`rate_limit_response_headers`](/tyk-oss-gateway/configuration#rate_limit_response_headers) configuration in your `tyk.conf` (or the equivalent environment variable):
+
+- **`rate_limits`**: the headers are only generated if a rate limit is configured; they are populated with rate limit data.
+- **`quotas`**: the headers are only generated if a quota is configured; they are populated with quota data.
+
+If `rate_limit_response_headers` is not set, it defaults to `quotas` for backward compatibility.
+
+
+### Rate limiting scopes: API-level vs key-level
+
+Rate limiting can be applied at different scopes to control API traffic effectively. This section covers the two primary scopes - API-level rate limiting and key-level rate limiting. Understanding the distinctions between these scopes will help you configure appropriate rate limiting policies based on your specific requirements.
+
+#### API-level rate limiting
+
+API-level rate limiting aggregates the traffic coming into an API from all sources and ensures that the overall rate limit is not exceeded. Overwhelming an endpoint with traffic is an easy and efficient way to execute a denial of service attack. By using a API-level rate limit you can easily ensure that all incoming requests are within a specific limit so excess requests are rejected by Tyk and do not reach your service. You can calculate the rate limit to set by something as simple as having a good idea of the maximum number of requests you could expect from users of your API during a period. You could alternatively apply a more scientific and precise approach by considering the rate of requests your system can handle while still performing at a high-level. This limit may be easily determined with some performance testing of your service under load.
+
+#### Key-level rate limiting
+
+Key-level rate limiting is more focused on controlling traffic from individual sources and making sure that users are staying within their prescribed limits. This approach to rate limiting allows you to configure a policy to rate limit in two ways:
+
+- **key-level global limit** limiting the rate of calls the user of a key can make to all APIs authorized by that key
+- **key-level per-API limit** limiting the rate of calls the user of a key can make to specific individual APIs
+- **key-level per-endpoint limit** limiting the rate of calls the user of a key can make to specific individual endpoints of an API
+ 
+These guides include explanation of how to configure key-level rate limits when using [API Keys](/api-management/gateway-config-managing-classic#access-an-api) and [Security Policies](/api-management/gateway-config-managing-classic#secure-an-api).
+
+#### Which scope should I use?
+
+The simplest way to figure out which level of rate limiting you’d like to apply can be determined by asking a few questions:
+
+- do you want to protect your service against denial of service attacks or overwhelming amounts of traffic from **all users** of the API? **You’ll want to use an API-level rate limit!**
+- do you have a health endpoint that consumes very little resource on your service and can handle significantly more requests than your other endpoints? **You'll want to use an API-level per-endpoint rate limit!**
+- do you want to limit the number of requests a specific user can make to **all APIs** they have access to? **You’ll want to use a key-level global rate limit!**
+- do you want to limit the number of requests a specific user can make to **specific APIs** they have access to? **You’ll want to use a key-level per-API rate limit.**
+- do you want to limit the number of requests a specific user can make to a **specific endpoint of an API** they have access to? **You’ll want to use a key-level per-endpoint rate limit.**
+
+### Applying multiple rate limits
+
+When multiple rate limits are configured, they are assessed in this order (if applied):
+
+1. API-level per-endpoint rate limit (configured in API definition)
+2. API-level rate limit (configured in API definition)
+3. Key-level per-endpoint rate limit (configured in access key)
+4. Key-level per-API rate limit (configured in access key)
+5. Key-level global rate limit (configured in access key)
+
+### Combining multiple policies configuring rate limits
+
+If more than one policy defining a rate limit is applied to a key then Tyk will apply the highest request rate permitted by any of the policies that defines a rate limit.
+
+If `rate` and `per` are configured in multiple policies applied to the same key then the Gateway will determine the effective rate limit configured for each policy and apply the highest to the key.
+
+Given, policy A with `rate` set to 90 and `per` set to 30 seconds (3rps) and policy B with `rate` set to 100 and `per` set to 10 seconds (10rps). If both are applied to a key, Tyk will take the rate limit from policy B as it results in a higher effective request rate (10rps).
+
+
+<Note>
+Prior to Tyk 5.4.0 there was a long-standing bug in the calculation of the effective rate limit applied to the key where Tyk would combine the highest `rate` and highest `per` from the policies applied to the key, so for the example above the key would have `rate` set to 100 and `per` set to 30 giving an effective rate limit of 3.33rps. This has now been corrected.
+</Note>
+
+
+## Rate limiting algorithms
+
+Different rate limiting algorithms are employed to cater to varying requirements, use cases and gateway deployments. A one-size-fits-all approach may not be suitable, as APIs can have diverse traffic patterns, resource constraints, and service level objectives. Some algorithms are more suited to protecting the upstream service from overload whilst others are suitable for per-client limiting to manage and control fair access to a shared resource.
+
+Tyk offers the following rate limiting algorithms:
+
+1. [Distributed Rate Limiter](#distributed-rate-limiter): recommended for most use cases, implements the [token bucket algorithm](https://en.wikipedia.org/wiki/Token_bucket)
+2. [Redis Rate Limiter](#redis-rate-limiter): implements the [sliding window log algorithm](https://developer.redis.com/develop/dotnet/aspnetcore/rate-limiting/sliding-window)
+3. [Fixed Window Rate Limiter](#fixed-window-rate-limiter): implements the [fixed window algorithm](https://redis.io/learn/develop/dotnet/aspnetcore/rate-limiting/fixed-window)
+
+When the rate limits are reached, Tyk will block requests with an [HTTP 429 (Rate Limit Exceeded)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429) response.
+
+
+<Note>
+Tyk supports selection of the rate limit algorithm at the Gateway level, so the same algorithm will be applied to all APIs.
+It can be configured to switch dynamically between two algorithms depending on the request rate, as explained [here](#dynamic-algorithm-selection-based-on-request-rate).
+</Note>
+
+
+### Distributed Rate Limiter
+
+The Distributed Rate Limiter (DRL) is the default rate limiting mechanism in Tyk Gateway. It is
+implemented using a token bucket implementation that does not use Redis.
+In effect, it divides the configured rate limit between the number of
+addressable gateway instances.
+
+The characteristics of DRL are:
+
+- a rate limit of 100 requests/min with 2 gateways yields 50 requests/min per gateway
+- unreliable at low rate limits where requests are not fairly balanced
+- if [configured to return rate limits](/api-management/rate-limit#rate-limit-response-headers), the `X-RateLimit-Remaining` response header will only reflect the current Gateway's share of the limit, rather than the true global remaining limit across the cluster
+
+DRL can face challenges in scenarios where traffic is not evenly
+distributed across gateways, such as with sticky sessions or keepalive
+connections. These conditions can lead to certain gateways becoming
+overloaded while others remain underutilized, compromising the
+effectiveness of configured rate limiting. This imbalance is particularly
+problematic in smaller environments or when traffic inherently favors
+certain gateways, leading to premature rate limits on some nodes and
+excess capacity on others.
+
+DRL will be used automatically unless one of the other rate limit
+algorithms are explicitly enabled via configuration.
+
+It's important to note that this algorithm will yield approximate results due to the nature of the local
+rate limiting, where the total allowable request rate is split between the gateways; uneven distribution
+of requests could lead to exhaustion of the limit on some gateways before others.
+
+### Redis Rate Limiter
+
+This algorithm implements a sliding window log algorithm and can be enabled via the [enable_redis_rolling_limiter](/tyk-oss-gateway/configuration#enable_redis_rolling_limiter) configuration option.
+
+The characteristics of the Redis Rate Limiter (RRL) are:
+
+- using Redis lets any gateway respect a cluster-wide rate limit (shared counter)
+- a record of each request, including blocked requests that return `HTTP 429`, is written to the sliding log in Redis
+- the log is constantly trimmed to the duration of the defined window
+- requests are blocked if the count in the log exceeds the configured rate limit
+
+An important behavior of this rate limiting algorithm is that it blocks
+access to the API when the rate exceeds the rate limit and does not let
+further API calls through until the rate drops below the specified rate
+limit. For example, if the configured rate limit is 3000 requests/minute the call rate would
+have to be reduced below 3000 requests/minute for a whole minute before the `HTTP 429`
+responses stop and traffic is resumed. This behavior is called **spike arrest**.
+
+The complete request log is stored in Redis so resource usage when using this rate limiter is high.
+This algorithm will use significant resources on Redis even when blocking requests, as it must
+maintain the request log, mostly impacting CPU usage. Redis resource
+usage increases with traffic therefore shorter `per` values are recommended to
+limit the amount of data being stored in Redis.
+
+If you wish to avoid spike arrest behavior but the DRL is not suitable, you might use the [Fixed Window Rate Limiter](#fixed-window-rate-limiter) algorithm.
+
+You can configure [Rate Limit Smoothing](#rate-limit-smoothing) to manage the traffic spike, allowing time to increase upstream capacity if required.
+
+The [Redis Sentinel Rate Limiter](#redis-sentinel-rate-limiter) reduces latency for clients, however increases resource usage on Redis and Tyk Gateway.
+
+#### Rate Limit Smoothing
+
+Rate Limit Smoothing is an optional mechanism of the RRL that dynamically adjusts the request
+rate limit based on the current traffic patterns. It helps in managing
+request spikes by gradually increasing or decreasing the rate limit
+instead of making abrupt changes or blocking requests excessively.
+
+This mechanism uses the concept of an intermediate *current allowance* (rate limit) that moves between an initial lower 
+bound (`threshold`) and the maximum configured request rate (`rate`). As the request rate approaches the current 
+*current allowance*, Tyk will emit an event to notify you that smoothing has been triggered. When the event is emitted, 
+the *current allowance* will be increased by a defined increment (`step`). A hold-off counter (`delay`) must expire 
+before another event is emitted and the *current allowance* further increased. If the request rate exceeds the 
+*current allowance* then the rate limiter will block further requests, returning `HTTP 429` as usual.
+
+As the request rate falls following the spike, the *current allowance* will gradually reduce back to the lower bound (`threshold`).
+
+Events are emitted and adjustments made to the *current allowance* based on the following calculations:
+
+- when the request rate rises above `current allowance - (step * trigger)`,
+  a `RateLimitSmoothingUp` event is emitted and *current allowance* increases by `step`.
+- when the request rate falls below `allowance - (step * (1 + trigger))`,
+  a `RateLimitSmoothingDown` event is emitted and *current allowance* decreases by `step`.
+
+##### Configuring rate limit smoothing
+
+When Redis Rate Limiter is in use, rate limit smoothing is configured with the following options within the `smoothing` object alongside the standard `rate` and `per` parameters:
+
+- `enabled` (boolean) to enable or disable rate limit smoothing
+- `threshold` is the initial rate limit (*current allowance*) beyond which smoothing will be applied
+- `step` is the increment by which the *current allowance* will be increased or decreased each time a smoothing event is emitted
+- `trigger` is a fraction (typically in the range 0.1-1.0) of the `step` at which point a smoothing event will be emitted as the request rate approaches the *current allowance*
+- `delay` is a hold-off between smoothing events and controls how frequently the current allowance will step up or down (in seconds).
+
+Rate Limit Smoothing is configured using the `smoothing` object within access keys and policies. For API-level rate limiting, this configuration is within the `access_rights[*].limit` object.
+
+An example configuration would be as follows:
+
+```yaml
+    "smoothing": {
+      "enabled": true,
+      "threshold": 5,
+      "trigger": 0.5,
+      "step": 5,
+      "delay": 30
+    }
+```
+
+#### Redis Sentinel Rate Limiter
+
+The Redis Sentinel Rate Limiter option will:
+
+- write a sentinel key into Redis when the request limit is reached
+- use the sentinel key to block requests immediately for `per` duration
+- requests, including blocked requests, are written to the sliding log in a background thread
+
+This optimizes the latency for connecting clients, as they don't have to
+wait for the sliding log write to complete. This algorithm exhibits spike
+arrest behavior the same as the basic Redis Rate Limiter, however recovery may take longer as the blocking is in
+effect for a minimum of the configured window duration (`per`). Gateway and Redis
+resource usage is increased with this option.
+
+This option can be enabled using the following configuration option
+[enable_sentinel_rate_limiter](/tyk-oss-gateway/configuration#enable_sentinel_rate_limiter).
+
+To optimize performance, you may configure your rate limits with shorter
+window duration values (`per`), as that will cause Redis to hold less
+data at any given moment.
+
+Performance can be improved by enabling the [enable_non_transactional_rate_limiter](/tyk-oss-gateway/configuration#enable_non_transactional_rate_limiter). This leverages Redis Pipelining to enhance the performance of the Redis operations. Please consult the [Redis documentation](https://redis.io/docs/manual/pipelining/) for more information.
+
+Please consider the [Fixed Window Rate Limiter](#fixed-window-rate-limiter) algorithm as an alternative, if Redis performance is an issue.
+
+### Fixed Window Rate Limiter
+
+The Fixed Window Rate Limiter will limit the number of requests in a
+particular window in time. Once the defined rate limit has been reached,
+the requests will be blocked for the remainder of the configured window
+duration. After the window expires, the counters restart and again allow
+requests through.
+
+- the implementation uses a single counter value in Redis
+- the counter expires after every configured window (`per`) duration.
+
+The implementation does not smooth out traffic bursts within a window. For any
+given `rate` in a window, the requests are processed without delay, until
+the rate limit is reached and requests are blocked for the remainder of the
+window duration.
+
+When using this option, resource usage for rate limiting does not
+increase with traffic. A simple counter with expiry is created for every
+window and removed when the window elapses. Regardless of the traffic
+received, Redis is not impacted in a negative way, resource usage remains
+constant.
+
+This algorithm can be enabled using the following configuration option [enable_fixed_window_rate_limiter](/tyk-oss-gateway/configuration#enable_fixed_window_rate_limiter).
+
+If you need spike arrest behavior, the [Redis Rate Limiter](#redis-rate-limiter) should be used.
+
+### Dynamic algorithm selection based on request rate
+
+The Distributed Rate Limiter (DRL) works by distributing the
+rate allowance equally among all gateways in the cluster. For example,
+with a rate limit of 1000 requests per second and 5 gateways, each
+gateway can handle 200 requests per second. This distribution allows for
+high performance as gateways do not need to synchronize counters for each
+request.
+
+DRL assumes an evenly load-balanced environment, which is typically
+achieved at a larger scale with sufficient requests. In scenarios with
+lower request rates, DRL may generate false positives for rate limits due
+to uneven distribution by the load balancer. For instance, with a rate of
+10 requests per second across 5 gateways, each gateway would handle only
+2 requests per second, making equal distribution unlikely.
+
+It's possible to configure Tyk to switch automatically between the Distributed Rate Limiter
+and the Redis Rate Limiter by setting the `drl_threshold` configuration.
+
+This threshold value is used to dynamically switch the rate-limiting
+algorithm based on the volume of requests. This option sets a
+minimum number of requests per gateway that triggers the Redis Rate
+Limiter. For example, if `drl_threshold` is set to 2, and there are 5
+gateways, the DRL algorithm will be used if the rate limit exceeds 10
+requests per second. If it is 10 or fewer, the system will fall back to
+the Redis Rate Limiter.
+
+See [DRL Threshold](/tyk-oss-gateway/configuration#drl_threshold) for details on how to configure this feature.
+
+
+## Custom Rate Limiting
+
+Different business models may require applying rate limits and quotas not only by credentials but also by other entities, such as per application, per developer, per organization, etc. For example, if an API Product is sold to a B2B customer, the quota of API calls is usually applied to all developers and their respective applications combined, in addition to a specific credential.
+
+To enable this, Tyk introduced support for custom rate limit keys in [Tyk 5.3.0](/developer-support/release-notes/dashboard#5-3-0-release-notes). This feature allows you to define custom patterns for rate limiting that go beyond the default credential-based approach.
+
+### How Custom Rate Limiting Works
+
+Custom rate limit keys are applied at a policy level. When a custom rate limit key is specified, quota, rate limit and throttling will be calculated against the specified value and not against a credential ID.
+
+To specify a custom rate limit key, add to a policy a new metadata field called `rate_limit_pattern`. In the value field you can specify any value or expression that you want to use as a custom rate limit key for your APIs.
+
+The `rate_limit_pattern` field supports:
+- Referencing session metadata using `$tyk_meta.FIELD_NAME` syntax
+- Concatenating multiple values together using the pipe operator (`|`)
+
+### Configuring Custom Rate Limit Keys
+
+Custom rate limit keys are configured in the Tyk Dashboard by adding a metadata field to your policy:
+
+1. Navigate to your policy in the Tyk Dashboard
+2. Add a new metadata field called `rate_limit_pattern`
+3. Set the value to your desired pattern expression
+
+For example, if you want to specify a rate limit pattern to calculate the rate limit for a combination of developers and plans, where all credentials of a developer using the same plan share the same rate limit, you can use the following expression (assuming that the `DeveloperID` and `PlanID` metadata fields are available in a session):
+
+```gotemplate
+$tyk_meta.DeveloperID|$tyk_meta.PlanID
+```
+
+<img src="/img/dashboard/portal-management/enterprise-portal/configuring-custom-rate-limit-keys.png" alt="Configuring custom rate limit keys" />
+
+### Important Considerations
+
+
+<Note>
+**Updating credential metadata**
+
+The custom rate limit key capability uses only metadata objects, such as credentials metadata available in a session. Therefore, if the `rate_limit_pattern` relies on credentials metadata, this capability will work only if those values are present. If, after evaluating the `rate_limit_pattern`, its value is equal to an empty string, the rate limiter behavior defaults to rate limiting by credential IDs.
+</Note>
+
+
+### Advanced Custom Rate Limiting
+
+As mentioned above, we can easily configure custom rate limit keys for simple scenarios that do not require awareness of the request context. When more complex logic or integration with external services is required to determine the rate-limiting key, for example when you want to rate limit per requester IP address, a [custom authentication plugin](/api-management/plugins/plugin-types#authentication-plugins) can be used to identify and generate the rate limiter key.
+
+We use an authentication plugin because [it lets us modify the session object](/api-management/plugins/plugin-types#hook-capabilities). 
+
+<br />
+
+
+<Note>
+This mechanism works only for authenticated APIs, since the authentication plugin is not invoked for unauthenticated (keyless) APIs.
+</Note>
+
+
+#### Example: Rate Limiting by IP Address
+
+The example below shows an IP based rate limiter implemented as a custom Go plugin for a Tyk OAS API. Note that the Go library function to [obtain the API definition](/api-management/plugins/golang#accessing-the-api-definition) is specific to Tyk OAS APIs, so you would need to modify the plugin for a Tyk Classic API.
+
+1. It extracts the client's IP address from the request
+2. Creates a session object with rate limiting parameters (2 requests per 5 seconds)
+3. Sets a custom `rate_limit_pattern` in the session's metadata to use the IP as the rate limiting key
+4. Stores this session in Tyk's session store
+
+When Tyk processes subsequent requests, it uses the IP address as the rate-limiting key, allowing you to rate-limit by IP address.
+
+
+
+```go
+// IP Rate Limiter for Tyk OAS APIs
+func Authenticate(rw http.ResponseWriter, r *http.Request) {
+	// Get the API definition
+	requestedAPI := ctx.GetOASDefinition(r)
+	if requestedAPI == nil {
+		logger.Error("Could not get Tyk OAS API Definition")
+		rw.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	// Extract the client's real IP address
+	realIp := request.RealIP(r)
+
+	// Create a session object with rate limiting parameters
+	sessionObject := &user.SessionState{}
+	sessionObject = &user.SessionState{
+		OrgID: requestedAPI.OrgID,
+		Rate:  2,                       // Allow 2 requests
+		Per:   5,                       // Per 5 seconds
+		AccessRights: map[string]user.AccessDefinition{
+			requestedAPI.APIID: {
+				APIID: requestedAPI.APIID,
+			},
+		},
+		MetaData: map[string]interface{}{
+			"rate_limit_pattern": realIp, // Use IP address as rate limit key
+		},
+	}
+
+	logger.Info("Session Alias: ", sessionObject.Alias)
+
+	// Set session state using session object
+	ctx.SetSession(r, sessionObject, false)
+	logger.Info("Session created for request")
+}
+```
+
+#### How to Use This
+
+1. **Build and Deploy plugin**: Build the plugin and deploy it to your Tyk Gateway. Refer to the [Go Plugin Development Guide](/api-management/plugins/golang#setting-up-your-environment) for instructions on building and deploying Go plugins.
+
+2. **Configure your API**: Create an authenticated API and set up your API to use the [custom authentication plugin](/api-management/plugins/golang#loading-custom-go-plugins-into-tyk). Note that you will need to select the [multiple authentication](/basic-config-and-security/security/authentication-authorization/multiple-auth) method to invoke both the plugin and your chosen auth method.
+
+3. **Test your implementation**: Make requests to your API and verify that rate limiting is applied based on client IP addresses.
+
+While this example demonstrates IP-based rate limiting, you can modify the `rate_limit_pattern` to use any value you want as the rate limiting key, such as:
+- A specific header value: `request.Header.Get("X-Custom-ID")`
+- A combination of values: `userID + "-" + deviceID`
+- A value extracted from the request body or JWT claims
+
+## Rate Limiting Layers
+
+You can protect your upstream services from being flooded with requests by configuring rate limiting in Tyk Gateway. Rate limits in Tyk are configured using two parameters: allow `rate` requests in any `per` time period (given in seconds).
+
+As explained in the [Rate Limiting Concepts](/api-management/rate-limit#introduction) section, Tyk supports configuration of rate limits at both the API-Level and Key-Level for different use cases.
+
+The API-Level rate limit takes precedence over Key-Level, if both are configured for a given API, since this is intended to protect your upstream service from becoming overloaded. The Key-Level rate limits provide more granular control for managing access by your API clients.
+
+### Configuring the rate limiter at the API-Level
+
+If you want to protect your service with an absolute limit on the rate of requests, you can configure an API-level rate limit. You can do this from the API Designer in Tyk Dashboard as follows:
+
+1. Navigate to the API for which you want to set the rate limit
+2. From the **Core Settings** tab, navigate to the **Rate Limiting and Quotas** section
+3. Ensure that **Disable rate limiting** is not selected
+4. Enter in your **Rate** and **Per (seconds)** values
+5. **Save/Update** your changes
+
+Tyk will now accept a maximum of **Rate** requests in any **Per** period to the API and will reject further requests with an `HTTP 429 Too Many Requests` error.
+
+Check out the following video to see this being done.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/ETI7nOd3DNc" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+### Configuring the rate limiter at the Key-Level
+
+If you want to restrict an API client to a certain rate of requests to your APIs, you can configure a Key-Level rate limit via a [Policy](/api-management/policies). The allowance that you configure in the policy will be consumed by any requests made to APIs using a key generated from the policy. Thus, if a policy grants access to three APIs with `rate=15 per=60` then a client using a key generated from that policy will be able to make a total of 15 requests - to any combination of those APIs - in any 60 second period before receiving the `HTTP 429 Too Many Requests` error. 
+
+
+<Note>
+It is assumed that the APIs being protected with a rate limit are using the [auth token](/api-management/authentication/bearer-token) client authentication method and policies have already been created.
+</Note>
+
+
+You can configure this rate limit from the API Designer in Tyk Dashboard as follows:
+
+1. Navigate to the Tyk policy for which you want to set the rate limit
+2. Ensure that API(s) that you want to apply rate limits to are selected
+3. Under **Global Limits and Quota**, make sure that **Disable rate limiting** is not selected and enter your **Rate** and **Per (seconds)** values
+4. **Save/Update** the policy
+
+### Setting up a Key-Level Per-API rate limit
+
+If you want to restrict API clients to a certain rate of requests for a specific API you will also configure the rate limiter via the security policy. However this time you'll assign per-API limits. The allowance that you configure in the policy will be consumed by any requests made to that specific API using a key generated from that policy. Thus, if a policy grants access to an API with `rate=5 per=60` then three clients using keys generated from that policy will each independently be able to make 5 requests in any 60 second period before receiving the `HTTP 429 Too Many Requests` error. 
+
+
+<Note>
+It is assumed that the APIs being protected with a rate limit are using the [auth token](/api-management/authentication/bearer-token) client authentication method and policies have already been created.
+</Note>
+
+
+You can configure this rate limit from the API Designer in Tyk Dashboard as follows:
+
+1. Navigate to the Tyk policy for which you want to set the rate limit
+2. Ensure that API that you want to apply rate limits to is selected
+3. Under **API Access**, turn on **Set per API Limits and Quota**
+4. You may be prompted with "Are you sure you want to disable partitioning for this policy?". Click **CONFIRM** to proceed
+5. Under **Rate Limiting**, make sure that **Disable rate limiting** is not selected and enter your **Rate** and **Per (seconds)** values
+6. **Save/Update** the policy
+
+Check out the following video to see this being done.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/n7jbmuWgPsw" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+### Setting up a key-level per-endpoint rate limit
+
+To restrict the request rate for specific API clients on particular endpoints, you can use the security policy to assign per-endpoint rate limits. These limits are set within the policy and will be #enforced for any requests made to that endpoint by clients using keys generated from that policy.
+
+Each key will have its own independent rate limit allowance. For example, if a policy grants access to an endpoint with a rate limit of 5 requests per 60 seconds, each client with a key from that policy can make 5 requests to the endpoint in any 60-second period. Once the limit is reached, the client will receive an HTTP `429 Too Many Requests` error.
+
+If no per-endpoint rate limit is defined, the endpoint will inherit the key-level per-API rate limit or the global rate limit, depending on what is configured.
+
+
+<Note>
+The following assumptions are made:
+ - The [ignore authentication](/api-management/traffic-transformation/ignore-authentication) middleware should not be enabled for the relevant endpoints.
+ - If [path-based permissions](/api-management/gateway-config-managing-classic#path-based-permissions) are configured, they must grant access to these endpoints for keys generated from the policies.
+</Note>
+
+
+You can configure per-endpoint rate limits from the API Designer in Tyk Dashboard as follows:
+
+1. Navigate to the Tyk policy for which you want to set the rate limit
+2. Ensure that API that you want to apply rate limits to is selected
+3. Under **API Access** -> **Set endpoint-level usage limits** click on **Add Rate Limit** to configure the rate limit. You will need to provide the rate limit and the endpoint path and method.
+4. **Save/Update** the policy
+
+
+### Setting Rate Limits in the Tyk Community Edition Gateway (CE)
+
+#### Configuring the rate limiter at the (Global) API-Level
+
+Using the `global_rate_limit` field in the API definition you can specify the API-level rate limit in the following format: `{"rate": 10, "per": 60}`.
+
+An equivalent example using Tyk Operator is given below:
+
+```yaml {linenos=table,hl_lines=["14-17"],linenostart=1}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-global-rate-limit
+spec:
+  name: httpbin-global-rate-limit
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+  # setting a global rate-limit for the API of 10 requests per 60 seconds
+  global_rate_limit:
+    rate: 10
+    per: 60
+```
+
+### Configuring the rate limiter on the session object
+
+All actions on the session object must be done via the Gateway API.
+
+1. Ensure that `allowance` and `rate` are set to the same value: this should be number of requests to be allowed in a time period, so if you wanted 100 requests every second, set this value to 100.
+
+2. Ensure that `per` is set to the time limit. Again, as in the above example, if you wanted 100 requests per second, set this value to 1. If you wanted 100 requests per 5 seconds, set this value to 5.
+
+#### Can I disable the rate limiter?
+
+Yes, the rate limiter can be disabled for an API Definition by selecting **Disable Rate Limits** in the API Designer, or by setting the value of `disable_rate_limit` to `true` in your API definition.
+
+Alternatively, you could also set the values of `Rate` and `Per (Seconds)` to be 0 in the API Designer.
+
+
+<Note>
+Disabling the rate limiter at the API-Level does not disable rate limiting at the Key-Level. Tyk will enforce the Key-Level rate limit even if the API-Level limit is not set.
+</Note>
+
+
+#### Can I set rate limits by IP address?
+
+Not yet, though IP-based rate limiting is possible using custom pre-processor middleware JavaScript that generates tokens based on IP addresses. See our [Middleware Scripting Guide](/api-management/plugins/javascript#using-javascript-with-tyk) for more details.
+
+## Rate Limiting by API
+
+### Tyk Classic API Definition
+
+The per-endpoint rate limit middleware allows you to enforce rate limits on specific endpoints. This middleware is configured in the Tyk Classic API Definition, either via the Tyk Dashboard API or in the API Designer.
+
+To enable the middleware, add a new `rate_limit` object to the `extended_paths` section of your API definition.
+
+The `rate_limit` object has the following configuration:
+
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+- `enabled`: boolean to enable or disable the rate limit
+- `rate`: the maximum number of requests that will be permitted during the interval (window)
+- `per`: the length of the interval (window) in seconds
+
+You can set different rate limits for various endpoints by specifying multiple `rate_limit` objects.
+
+#### Simple endpoint rate limit
+
+For example:
+
+```json  {linenos=true, linenostart=1}
+{
+    "use_extended_paths": true,
+    "extended_paths": {
+        "rate_limit": [
+            {
+                "path": "/anything",
+                "method": "GET",
+                "enabled": true,
+                "rate": 60,
+                "per": 1
+            }
+        ]
+    }
+}
+```
+
+In this example, the rate limit middleware has been configured for HTTP
+`GET` requests to the `/anything` endpoint, limiting requests to 60 per
+second.
+
+#### Advanced endpoint rate limit
+
+For more complex scenarios, you can configure rate limits for multiple
+paths. The order of evaluation matches the order defined in the
+`rate_limit` array. For example, if you wanted to limit the rate of
+`POST` requests to your API allowing a higher rate to one specific
+endpoint you could configure the API definition as follows: 
+
+```json  {linenos=true, linenostart=1}
+{
+    "use_extended_paths": true,
+    "extended_paths": {
+        "rate_limit": [
+            {
+                "path": "/user/login",
+                "method": "POST",
+                "enabled": true,
+                "rate": 100,
+                "per": 1
+            },
+            {
+                "path": "/.*",
+                "method": "POST",
+                "enabled": true,
+                "rate": 60,
+                "per": 1
+            }
+        ]
+    }
+}
+```
+
+In this example, the first rule limits `POST` requests to `/user/login`
+to 100 requests per second (rps). Any other `POST` request matching the
+regex pattern `/.*` will be limited to 60 requests per second. The order
+of evaluation ensures that the specific `/user/login` endpoint is matched
+and evaluated before the regex pattern.
+
+The per-endpoint rate limit middleware allows you to enforce rate limits on specific endpoints. This middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation), either via the Tyk Dashboard API or in the API Designer.
+
+If you’re using the legacy Tyk Classic APIs, then check out the [Tyk Classic](/api-management/rate-limit#tyk-classic-api-definition) page.
+
+### Tyk OAS API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the
+`operationId` defined in the OpenAPI Document that declares both the path
+and method for which the middleware should be added. Endpoint `paths`
+entries (and the associated `operationId`) can contain wildcards in the
+form of any string bracketed by curly braces, for example
+`/status/{code}`. These wildcards are so they are human-readable and do
+not translate to variable names. Under the hood, a wildcard translates to
+the “match everything” regex of: `(.*)`.
+
+The rate limit middleware (`rateLimit`) can be added to the `operations` section of the
+Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition
+for the appropriate `operationId` (as configured in the `paths` section
+of your OpenAPI Document).
+
+The `rateLimit` object has the following configuration:
+
+- `enabled`: enable the middleware for the endpoint
+- `rate`: the maximum number of requests that will be permitted during the interval (window)
+- `per`: the length of the interval (window) in time duration notation (e.g. 10s)
+
+#### Simple endpoint rate limit
+
+For example:
+
+```json {hl_lines=["39-43"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-rate-limit",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/status/200": {
+            "get": {
+                "operationId": "status/200get",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-rate-limit",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-rate-limit/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "status/200get": {
+                    "rateLimit": {
+                        "enabled": true,
+                        "rate": 60,
+                        "per": "1s"
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example, a rate limit has been configured for the `GET
+/status/200` endpoint, limiting requests to 60 per second.
+
+The configuration above is a complete and valid Tyk OAS API Definition
+that you can import into Tyk to try out the Per-endpoint Rate Limiter
+middleware.
+
+#### Advanced endpoint rate limit
+
+For more complex scenarios, you can configure rate limits for multiple
+paths. The order of evaluation matches the order that endpoints are
+defined in the `paths` section of the OpenAPI description. For example,
+if you wanted to limit the rate of `POST` requests to your API allowing a
+higher rate to one specific endpoint you could configure the API
+definition as follows: 
+
+```json {hl_lines=["49-53", "56-60"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "advanced-rate-limit",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/user/login": {
+            "post": {
+                "operationId": "user/loginpost",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        },
+        "/{any}": {
+            "post": {
+                "operationId": "anypost",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "advanced-rate-limit",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/advanced-rate-limit/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "user/loginpost": {
+                    "rateLimit": {
+                        "enabled": true,
+                        "rate": 100,
+                        "per": "1s"
+                    }
+                },
+                "anypost": {
+                    "rateLimit": {
+                        "enabled": true,
+                        "rate": 60,
+                        "per": "1s"
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example, the first rule limits requests to the `POST /user/login`
+endpoint to 100 requests per second (rps). Any other `POST` request to an
+endpoint path that matches the regex pattern `/{any}` will be limited to
+60 rps. The order of evaluation ensures that the specific `POST
+/user/login` endpoint is matched and evaluated before the regex pattern.
+
+The configuration above is a complete and valid Tyk OAS API Definition
+that you can import into Tyk to try out the Per-endpoint Rate Limiter
+middleware.
+
+### Configuring the middleware in the API Designer
+
+Configuring per-endpoint rate limits for your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Rate Limit middleware**
+
+    Select **ADD MIDDLEWARE** and choose **Rate Limit** from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-rate-limit.png" alt="Adding the Rate Limit middleware" />
+
+3. **Configure the middleware**
+
+    You must provide the path to the compiled plugin and the name of the Go function that should be invoked by Tyk Gateway when the middleware is triggered.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-rate-limit-config.png" alt="Configuring the per-endpoint custom plugin" />
+
+4. **Save the API**
+
+    Select **ADD MIDDLEWARE** to save the middleware configuration. Remember to select **SAVE API** to apply the changes.
+
+## Rate Limiting with Tyk Streams
+
+A rate limit is a strategy for limiting the usage of a shared resource across parallel components in a Tyk Streams instance, or potentially across multiple instances. They are configured as a resource:
+
+```yaml
+rate_limit_resources:
+  - label: foobar
+    local:
+      count: 500
+      interval: 1s
+```
+
+And most components that hit external services have a field `rate_limit` for specifying a rate limit resource to use. For example, if we wanted to use our `foobar` rate limit with a HTTP request:
+
+```yaml
+input:
+  http_client:
+    url: TODO
+    verb: GET
+    rate_limit: foobar
+```
+
+By using a rate limit in this way we can guarantee that our input will only poll our HTTP source at the rate of 500 requests per second.
+
+{/* TODO: when rate-limit processor supported:
+Some components don't have a `rate_limit` field but we might still wish to throttle them by a rate limit, in which case we can use the rate_limit processor that applies back pressure to a processing pipeline when the limit is reached. For example:
+
+```yaml
+input:
+  http_server:
+    path: /post
+output:
+  http_server:
+    ws_path: /subscribe
+pipeline:
+  processors:
+    - rate_limit:
+        resource: example_rate_limit
+rate_limit_resources:
+  - label: example_rate_limit
+    local:
+      count: 3
+      interval: 20s
+``` */}
+
+
+### Local
+
+The local rate limit is a simple X every Y type rate limit that can be shared across any number of components within the pipeline but does not support distributed rate limits across multiple running instances of Tyk Streams.
+
+```yml
+# Config fields, showing default values
+label: ""
+local:
+  count: 1000
+  interval: 1s
+```
+
+**Configuration Fields**
+
+**count**
+
+The maximum number of requests to allow for a given period of time.
+
+
+Type: `int`  
+Default: `1000`  
+
+**interval**
+
+The time window to limit requests by.
+
+
+Type: `string`  
+Default: `"1s"`  
diff --git a/api-management/request-quotas.mdx b/api-management/request-quotas.mdx
new file mode 100644
index 0000000000..925d5bd1d0
--- /dev/null
+++ b/api-management/request-quotas.mdx
@@ -0,0 +1,777 @@
+---
+title: "Request Quotas"
+description: "Overview of Rate Quotas with the Tyk Gateway"
+keywords: "Request Quotas, API Quotas, Usage Limits, Consumption Control"
+sidebarTitle: "Request Quotas"
+---
+
+## Introduction
+
+Request Quotas in Tyk Gateway allow you to set a maximum number of API requests for a specific API key or [Policy](/api-management/policies) over longer, defined periods (e.g., day, week, month). This feature is distinct from [rate limiting](/api-management/rate-limit) (which controls requests per second), and it is essential for managing API consumption, enforcing service tiers, and protecting your backend services from sustained overuse over time.
+
+```mermaid
+flowchart LR
+    Client[API Client] -->|Makes Request| Gateway[Tyk Gateway]
+    Gateway -->|Check Quota| Redis[(Redis)]
+    Redis -->|Quota OK| Gateway
+    Redis -->|Quota Exceeded| Gateway
+    Gateway -->|If Quota OK| Upstream[Upstream API]
+    Gateway -->|If Quota Exceeded| Reject[Reject Request]
+    Upstream -->|Response| Gateway
+    Gateway -->|Response| Client
+```
+
+### Key Benefits
+
+*   **Enforce Usage Limits:** Cap the total number of requests allowed over extended periods (days, weeks, months) per consumer.
+*   **Implement Tiered Access:** Easily define different usage allowances for various subscription plans (e.g., Free, Basic, Pro).
+*   **Protect Backend Services:** Prevent individual consumers from overwhelming upstream services with consistently high volume over long durations.
+*   **Enable Usage-Based Monetization:** Provide a clear mechanism for charging based on consumption tiers.
+
+---
+## Quick Start 
+
+### Overview
+
+In this tutorial, we will configure Request Quotas on a [Policy](/api-management/policies) to limit the number of requests an API key can make over a defined period. Unlike [rate limits](/api-management/rate-limit) (requests per second), quotas control overall volume. We'll set a low quota limit with a short renewal period for easy testing, associate a key with the policy, observe blocked requests once the quota is exhausted, and verify that the quota resets after the period elapses. This guide primarily uses the Tyk Dashboard for configuration.
+
+### Prerequisites
+
+-   **Working Tyk Environment:** You need access to a running Tyk instance that includes both the Tyk Gateway and Tyk Dashboard components. For Docker setup instructions, please refer to this [guide](/tyk-self-managed/install/docker).
+-   **Curl, Seq and Sleep**: These tools will be used for testing.
+
+### Instructions
+
+#### Create an API
+
+1.  **Create an API:**
+    1. Log in to your Tyk Dashboard.
+    2. Navigate to **API Management > APIs**
+    3. Click **Add New API**
+    4. Click **Import**
+    5. Select **Import Type** as **Tyk API**
+    6. Copy the below Tyk OAS definition in the text box and click **Import API** to create an API.
+
+        
+
+    <Expandable title='Click to expand API Definition'>
+    ```json
+            {
+              "components": {
+                "securitySchemes": {
+                  "authToken": {
+                    "in": "header",
+                    "name": "Authorization",
+                    "type": "apiKey"
+                  }
+                }
+              },
+              "info": {
+                "title": "Request Quota Test",
+                "version": "1.0.0"
+              },
+              "openapi": "3.0.3",
+              "paths": {},
+              "security": [
+                {
+                  "authToken": []
+                }
+              ],
+              "servers": [
+                {
+                  "url": "http://tyk-gateway.localhost:8080/request-quota-test/"
+                }
+              ],
+              "x-tyk-api-gateway": {
+                "info": {
+                  "name": "Request Quota Test",
+                  "state": {
+                    "active": true
+                  }
+                },
+                "middleware": {
+                  "global": {
+                    "contextVariables": {
+                      "enabled": true
+                    },
+                    "trafficLogs": {
+                      "enabled": true
+                    }
+                  }
+                },
+                "server": {
+                  "authentication": {
+                    "enabled": true,
+                    "securitySchemes": {
+                      "authToken": {
+                        "enabled": true
+                      }
+                    }
+                  },
+                  "listenPath": {
+                    "strip": true,
+                    "value": "/request-quota-test/"
+                  }
+                },
+                "upstream": {
+                  "url": "http://httpbin.org/"
+                }
+              }
+            }
+            ```
+    </Expandable>
+
+
+
+#### Configure Policy and Quota
+
+2.  **Create and Configure a Security Policy with a Request Quota:**
+
+    
+
+    <Expandable title='Click to expand to see detailed steps to configure a Request Quota in the Tyk Dashboard UI'>
+    1. Navigate to **API Security > Policies** in the Tyk Dashboard sidebar.
+        2. Click the **Add Policy** button.
+        3. Under the **1. Access Rights** tab, in the **Add API Access Rule** section, select the `Request Quota Test` API.
+        4. Scroll down to the **Global Limits and Quota** section (still under the **1. Access Rights** tab):
+            * **Important:** Disable **[Rate Limiting](/api-management/rate-limit)** by selecting **Disable rate limiting** option, so it doesn't interfere with testing the quota.
+            * Set the following values for `Usage Quotas`:
+              * Uncheck the `Unlimited requests` checkbox
+              * Enter `10` into the **Max Requests per period** field. (This is our low quota limit for testing).
+              * Select `1 hour` from the **Quota resets every:** dropdown. (In the next step, we will modify it to 60 seconds via API for quick testing, as 1 hour is a very long period. From the dashboard, we can only select pre-configured options.)
+        5. Select the **2. Configuration** tab.
+        6. In the **Policy Name** field, enter `Request Quota Policy`.
+        7. From the **Key expire after** dropdown, select `1 hour`.
+        8. Click the **Create Policy** button.
+    </Expandable>
+
+
+
+    <img src="/img/dashboard/system-management/request-quotas-policy-quick-start.png" alt="policy with request quota configured" />
+
+4.  **Update Quota Reset Period via API:**
+
+    As the Dashboard UI doesn't allow setting a shorter duration, we will set the Quota reset period to a value of 1 minute for testing purposes. The following commands search for the policy, modify its `quota_renewal_rate` to 60 seconds, and update the API.
+
+    **Note:** Obtain your Dashboard API key by clicking on the User profile at the top right corner, then click on `Edit Profile`, and select the key available under `Tyk Dashboard API Access Credentials`. Now in the below command replace `<your-api-key>` with the API key you obtained from the Dashboard UI.
+
+    ```
+    curl -s --location 'http://localhost:3000/api/portal/policies/search?q=Request%20Quota%20Policy' \
+    -H "Authorization: <your-api-key>" \
+    -H "Accept: application/json" > policy.json
+
+    jq '.Data[0] | .quota_renewal_rate = 60' policy.json > updated_policy.json
+    jq -r '.Data[0]._id' policy.json > policy_id.txt
+
+    curl --location "http://localhost:3000/api/portal/policies/$(cat policy_id.txt)" \
+    -H "Authorization: <your-api-key>" \
+    -H "Content-Type: application/json" \
+    -H "Accept: application/json" \
+    -X PUT \
+    -d @updated_policy.json
+    ```
+
+3.  **Associate an Access Key with the Policy:**
+
+    
+
+    <Expandable title='Click to expand to see detailed steps to Associate an Access Key with the Policy in the Tyk Dashboard UI'>
+    1. Navigate to **API Security > Keys** in the Tyk Dashboard sidebar.
+        2. Click the **Add Key** button.
+        3. Under the **1. Access Rights** tab:
+            * In the **Apply Policy** section, select the `Request Quota Policy`.
+        4. Select the **2. Configuration** tab.
+        5. In the **Alias** field, enter `Request Quota Key`. This provides a human-readable identifier.
+        6. From the **Expires** dropdown, select `1 hour`.
+        7. Click the **Create Key** button.
+        8. A pop-up window **"Key created successfully"** will appear displaying the key details. **Copy the Key ID** value shown and save it securely. You will need this key to make API requests in the following steps.
+        9. Click **OK** to close the pop-up.
+    </Expandable>
+
+
+
+#### Testing
+
+4.  **Test Quota Exhaustion:**
+
+    We've set a quota of 10 requests per 60 seconds. Let's send more than 10 requests within that window to observe the quota being enforced.
+
+    1. Open your terminal.
+    2. Execute the following command, replacing `<replace-with-key-id>` with the API Key ID you saved earlier. This command attempts to send 15 requests sequentially.
+
+    ```bash
+    for i in $(seq 1 15); do \
+        echo -n "Request $i: "; \
+        curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: <replace-with-key-id>" http://tyk-gateway.localhost:8080/request-quota-test/get; \
+        sleep 0.1; \
+    done
+    ```
+        
+    *(Note: The `sleep 0.1` adds a tiny delay, but ensure all 15 requests execute well within the 60-second quota window).*
+
+    3.  **Expected Observation:** You should see the first 10 requests succeed, returning an HTTP status code `200`. After the 10th request, the subsequent requests (11 through 15) should be blocked by the quota limit, returning an HTTP status code `403` (Forbidden).
+
+    **Sample Output:**
+
+    ```bash
+    Request 1: 200
+    Request 2: 200
+    Request 3: 200
+    Request 4: 200
+    Request 5: 200
+    Request 6: 200
+    Request 7: 200
+    Request 8: 200
+    Request 9: 200
+    Request 10: 200
+    Request 11: 403
+    Request 12: 403
+    Request 13: 403
+    Request 14: 403
+    Request 15: 403
+    ```
+
+5.  **Test Quota Reset:**
+
+    Now, let's wait for the quota period (60 seconds) to elapse and then send another request to verify that the quota allowance has been reset.
+
+    1. Wait slightly longer than the reset period in the same terminal. The command below waits for 70 seconds.
+
+        ```bash
+        echo "Waiting for quota to reset (70 seconds)..."
+        sleep 70
+        echo "Wait complete. Sending one more request..."
+        ```
+
+    2. Send one more request using the same API key:
+
+        ```bash
+        curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: <replace-with-key-id>" http://tyk-gateway.localhost:8080/request-quota-test/get
+        ```
+
+    3.  **Expected Observation:** This request should now succeed, returning an HTTP status code `200`. This demonstrates that because the 60-second quota period ended, the *next* request made after that period triggered the quota reset, replenishing the allowance.
+
+    **Sample Output:**
+
+    ```bash
+    Waiting for quota to reset (70 seconds)...
+    Wait complete. Sending one more request...
+    200
+    ```
+
+This quick start demonstrates the fundamental behaviour of Request Quotas: they limit the total number of requests allowed within a specific period and automatically reset the allowance once that period renews (triggered by the next request).
+
+---
+## Configuration Options
+
+Request Quotas in Tyk can be configured at various levels.
+
+The configuration involves setting two specific fields:
+
+1. **QuotaMax**: The maximum number of requests allowed during the quota period.
+   - Set to `-1` for unlimited requests
+   - Set to a positive integer (e.g., `1000`) to limit total requests
+
+2. **QuotaRenewalRate**: The time in seconds for which the quota applies.
+   - Example: `3600` for the hourly quota (1 hour = 3600 seconds)
+   - Example: `86400` for the daily quota (24 hours = 86400 seconds)
+   - Example: `2592000` for the monthly quota (30 days = 2592000 seconds)
+
+### System-Level Configuration
+
+Global quota settings are configured in the Tyk Gateway configuration file (`tyk.conf`). These settings affect how quotas are enforced across the entire gateway.
+
+<Tabs>
+<Tab title="Config File">
+
+```json
+{
+// Partial config from tyk.conf
+  "enforce_org_quotas": true,
+  "enforce_org_data_detail_logging": false,
+  "monitor": {
+    "enable_trigger_monitors": true,
+    "global_trigger_limit": 80.0,
+    "monitor_user_keys": true,
+    "monitor_org_keys": true
+  },
+// ... more config follows
+}
+```
+
+- `enforce_org_quotas`: When set to `true`, enables organization-level quota enforcement
+- `monitor.enable_trigger_monitors`: Enables quota monitoring and webhook triggers
+- `monitor.global_trigger_limit`: Percentage of quota usage that triggers alerts (e.g., 80.0 means 80%)
+- `monitor.monitor_user_keys`: Enables monitoring for individual API keys
+- `monitor.monitor_org_keys`: Enables monitoring for organization quotas
+
+</Tab>
+<Tab title="Environment Variable">
+```bash
+export TYK_GW_ENFORCEORGQUOTAS=true
+```
+</Tab>
+</Tabs>
+
+Refer to the [Tyk Gateway Configuration Reference](/tyk-oss-gateway/configuration#enforce_org_quotas) for more details on this setting.
+
+
+{/* ### Organization-Level Configuration
+
+Organization quotas limit the total number of requests across all APIs for a specific organization. These are enforced by the `OrganizationMonitor` middleware when `enforce_org_quotas` is enabled.
+
+- `quota_max`: Maximum number of requests allowed during the quota period
+- `quota_renewal_rate`: Time in seconds for the quota period (e.g., 3600 for hourly quotas)
+
+Organization quotas are configured through the Tyk Dashboard API or Gateway API:
+
+```bash
+curl -X POST -H "Authorization: {your-api-key}" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "quota_max": 1000,
+    "quota_renewal_rate": 3600,
+  }' \
+  http://tyk-gateway:8080/tyk/org/keys/{org-id}
+``` */}
+
+### API-Level Configuration
+
+You **cannot set** quota values within an API Definition, but you can **disable** quota checking entirely for all requests proxied through that specific API, regardless of Key or Policy settings. This is useful if an API should never have quota limits applied.
+
+<Tabs>
+
+<Tab title="Tyk OAS API Definition">
+
+In a Tyk OAS API Definition, you can globally disable quotas for specific APIs:
+
+- **skipQuota**: When set to true, disables quota enforcement for the API.
+- **skipQuotaReset**: When set to true, prevents quota counters from being reset when creating or updating quotas.
+
+```json
+{
+  // Partial config from Tyk OAS API Definition
+  "middleware": {
+    "global": {
+      "skipQuota": true,
+      "skipQuotaReset": false
+    }
+  },
+  // ... more config follows
+}
+```
+
+Refer to the [Tyk OAS API Definition reference](/api-management/gateway-config-tyk-oas#global) for details.
+
+</Tab>
+<Tab title="Tyk Classic API Definition">
+
+In a Tyk Classic API Definition (JSON), set the `disable_quota` field to `true`.
+
+```json
+{
+  // Partial config from Tyk Classic API Definition
+  "disable_quota": true // Set to true to disable quota checks
+  // ... more config follows
+}
+
+```
+
+Refer to the [Tyk Classic API Definition reference](/api-management/gateway-config-tyk-classic) for details.
+
+</Tab>
+
+</Tabs>
+
+
+
+### Configure via UI
+
+The Tyk Dashboard provides a straightforward interface to set request quota parameters using [Policies](/api-management/policies) or directly in the [Session](/api-management/access-control/sessions-and-keys/understanding-sessions) when creating a Key.
+
+<Tabs>
+
+<Tab title="Security Policy">
+
+The image below shows a policy with request quotas. Any key using this policy will inherit the quota settings and behave as follows: each key will be permitted 1000 requests per 24-hour (86400 seconds) cycle before the quota resets.
+
+<img src="/img/dashboard/system-management/request-quotas-in-policy.png" alt="policy with request quota configured" />
+
+<br />
+<Expandable title='Click to expand to see detailed steps to configure Request Quotas in the Tyk Dashboard UI'>
+1. Navigate to **API Security > Policies** in the Tyk Dashboard sidebar
+2. Click the **Add Policy** button
+3. Under the **1. Access Rights** tab and in the **Add API Access Rule** section, select the required API
+4. Scroll down to the **Global Limits and Quota** section (still under the **1. Access Rights** tab):
+    * Enable `Request Quotas` by setting the following values in the `Usage Quotas` section:
+        * Uncheck the `Unlimited Requests` checkbox
+        * Field **Requests (or connection attempts) per period** - Enter the total number of requests a client can use during the defined quota period.
+        * Field **Quota resets every:** - Select the duration of the quota period.
+5. Select the **2. Configuration** tab
+6. In the **Policy Name** field, enter a name
+7. From the **Key expire after** dropdown, select an option
+8. Click the **Create Policy** button
+</Expandable>
+
+</Tab>
+
+<Tab title="Access Key">
+
+The image below shows an access key with request quotas. This access key behaves as follows: each key will be permitted 1000 requests per 24-hour (86400 seconds) cycle before the quota resets.
+
+**Note:** Direct key configuration overrides policy settings only for that specific key.
+
+<img src="/img/dashboard/system-management/request-quotas-in-key.png" alt="policy with request quota configured" />
+
+<br />
+<Expandable title='Click to expand to see detailed steps to configure Request Quota in the Tyk Dashboard UI'>
+1. Navigate to **API Security > Keys** in the Tyk Dashboard sidebar
+2. Click the **Create Key** button
+3. Under the **1. Access Rights** tab:
+    * Select **Choose API**
+    * In the **Add API Access Rule** section, select the required API
+4. Scroll down to the **Global Limits and Quota** section (still under the **1. Access Rights** tab):
+    * Enable `Request Quotas` by setting the following values in the `Usage Quotas` section:
+        * Uncheck the `Unlimited Requests` checkbox
+        * Field **Requests (or connection attempts) per period** - Enter the total number of requests a client can use during the defined quota period.
+        * Field **Quota resets every:** - Select the duration of the quota period.
+5. Select the **2. Configuration** tab
+6. In the **Alias** field, enter a name. This human-readable identifier makes tracking and managing this specific access key easier in your analytics and logs.
+7. From the **Expires** dropdown, select an option
+8. Click the **Create Key** button
+</Expandable>
+
+</Tab>
+
+</Tabs>
+
+### Configure via API
+
+These are the fields that you can set directly in the Policy object or the Access Key:
+
+```json
+{
+  // Partial policy/session object fields
+  "quota_max": 1000,       // Allow one thousand requests
+  "quota_renewal_rate": 86400,    // 1 day or 24 hours
+  // ... more config follows
+}
+```
+
+<Tabs>
+
+<Tab title="Security Policy">
+
+To update the policy, do the following:
+1. Retrieve the policy object using `GET /api/portal/policies/{POLICY_ID}`
+2. Add or modify the `quota_max` and `quota_renewal_rate` fields within the policy JSON object
+3. Update the policy using `PUT /api/portal/policies/{POLICY_ID}` with the modified object, or create a new one using `POST /api/portal/policies/`
+
+**Explanation:**
+The above adds request quotas to a policy. Any key using this policy will inherit the quotas settings and behaves as follows: each key will be permitted 1000 requests per 24-hour (86400 seconds) cycle before the quota resets.
+
+</Tab>
+
+<Tab title="Access Key">
+
+**Note:** Direct key configuration overrides policy settings only for that specific key.
+
+To update the access key do the following:
+1. Retrieve the key's session object using `GET /api/keys/{KEY_ID}`
+2. Add or modify the `quota_max` and `quota_renewal_rate` fields within the session object JSON
+3. Update the key using `PUT /api/keys/{KEY_ID}` with the modified session object
+
+**Explanation:**
+The above adds quotas to an access key. Any request made by the key will behave as follows: each key will be permitted 1000 requests per 24-hour (86400 seconds) cycle before the quota resets.
+
+</Tab>
+
+</Tabs>
+
+### Important Considerations
+
+*   **Policy Precedence:** Quotas set on a [Policy](/api-management/policies) apply to all keys using that policy *unless* overridden by a specific quota set directly on the key (using the "Set per API Limits and Quota" option).
+*   **Unlimited Quota:** Setting `quota_max` to `-1` grants unlimited requests for the quota period.
+*   **Event-Driven Resets:** Quotas reset *after* the `quota_renewal_rate` (in seconds) has passed *and* upon the next request using the key. They do not reset automatically on a fixed schedule (e.g., precisely at midnight or the 1st of the month) unless external automation updates the session object.
+*   **Response Headers:** Historically, Tyk populated the `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset` headers with quota data. Starting with Tyk v5.13.0, this [behavior is configurable](/api-management/rate-limit#rate-limit-response-headers) via the `rate_limit_response_headers` setting in the Gateway config. By default, for backward compatibility, these headers continue to reflect quota data, but they can be configured to reflect actual rate limits instead.
+
+---
+## How It Works
+
+Request Quotas in Tyk limit a client's total number of API requests within a defined period (hours, days, months). Unlike [rate limits](/api-management/rate-limit) that control the frequency of requests over short intervals (like seconds or minutes) to prevent immediate system overload, Request Quotas control the total volume of requests allowed over much longer periods to manage overall consumption and align with service tiers. 
+
+When clients reach their quota limit, further requests are rejected until the quota period renews. It helps API providers implement usage-based pricing tiers, prevent API abuse, control infrastructure costs, and ensure fair resource distribution among clients.
+
+Think of Request Quotas as a prepaid phone plan with a fixed number of minutes per month. When you sign up, you get allocated a specific number of call minutes (API requests) that you can use over the billing period. You can make calls (API requests) at any pace you want – all at once or spread throughout the month – but once you've used up your allocated minutes, you can't make any more calls until the next billing cycle begins.
+
+```mermaid
+flowchart LR
+ Client[API Client] -->|Makes Request| Gateway[Tyk Gateway]
+ Gateway -->|Check Quota| Redis[(Redis)]
+ Redis -->|Quota OK| Gateway
+ Redis -->|Quota Exceeded| Gateway
+ Gateway -->|If Quota OK| Upstream[Upstream API]
+ Gateway -->|If Quota Exceeded| Reject[Reject Request]
+ Upstream -->|Response| Gateway
+ Gateway -->|Response| Client
+```
+
+### How Tyk Implements Quotas
+
+Tyk implements request quotas using a [Redis](/tyk-configuration-reference/redis-cluster-sentinel) based counter mechanism with time-based expiration. Here's a detailed breakdown of the implementation:
+
+```mermaid
+graph LR
+ A[API Request Received] --> B(Check Redis Quota Counter);
+ B -- Counter < QuotaMax --> C{Increment Redis Counter};
+ C --> D[Calculate quota_remaining = QuotaMax - Counter];
+ D --> E[Update Session State];
+ E --> F[Forward Request to Upstream];
+ B -- Counter >= QuotaMax --> G[Reject Request with 403];
+```
+
+#### Core Components
+
+1. **[Redis Storage](/tyk-configuration-reference/redis-cluster-sentinel)**: Quotas are tracked in Redis using incrementing counters for each API key. The TTL is set to the quota renewal period, and the counter is reset to 0 on the next request after expiration.
+
+    Here is a sample Redis key for a  Request Quota:
+    ```
+    quota-[scope]-[key_hash]
+    ```
+
+    Where:
+        - `scope` is optional and represents an API-specific allowance scope
+        - `key_hash` is the hashed API key (if hash keys are enabled)
+
+2. **Session State**: Quota configuration is stored in the user's `SessionState`, which contains several quota-related fields:
+
+    - `QuotaMax`: Maximum number of requests allowed during the quota period.
+    - `QuotaRemaining`: Number of requests remaining for the current period. **Note:** This is a derived value, not the primary counter.
+    - `QuotaRenews`: Unix timestamp when the quota will reset.
+    - `QuotaRenewalRate`: Time in seconds for the quota period (e.g., 3600 for hourly quotas).
+
+3. **Middleware**: The quota check is performed by the `RateLimitAndQuotaCheck` middleware
+
+#### Quota Enforcement
+
+The core logic for checking and enforcing Request Quotas is executed within the `RateLimitAndQuotaCheck` middleware, which is a step in the request processing pipeline. Here's a breakdown of this process:
+
+1.  **Initiation:** As a request enters the Tyk Gateway, it passes through configured middleware. The quota validation process begins when it hits the `RateLimitAndQuotaCheck` middleware.
+
+2.  **Applicability Check:** The middleware first determines if quota enforcement is relevant:
+    * It checks the API Definition to see if quotas are globally disabled. If so, the process stops here for quotas and the request proceeds.
+    * It identifies the API key for the request and retrieves its associated `SessionState`.
+
+3.  **Retrieve Limits:** The middleware accesses the `SessionState` to get the specific quota parameters applicable to this key and potentially the specific API being accessed (if per-API quotas are configured):
+    *   `QuotaMax`: The maximum number of requests allowed.
+    *   `QuotaRenewalRate`: The duration (in seconds) of the quota period for setting the TTL in Redis.
+
+4.  **Redis Interaction & Enforcement:** This is the core enforcement step, interacting directly with Redis:
+    *   **Construct Key:** Generates the unique Redis key for tracking this specific quota counter (e.g., `quota-{scope}-{api-key-hash}`).
+    *   **Check Expiry/Existence:** It checks Redis to see if the key exists and if its TTL is still valid.
+    *   **Handle Renewal (If Expired/Missing):** If the key doesn't exist or its TTL has passed, Tyk initiates the renewal logic described previously (attempting a distributed lock, setting the counter to 0, and applying the `QuotaRenewalRate` as the new TTL).
+    *   **Increment Counter:** Tyk atomically increments the Redis counter value. This operation returns the *new* value of the counter *after* the increment.
+    *   **Compare Against Limit:** The middleware compares this *new* counter value against the `QuotaMax` retrieved from the session state.
+    *   **Decision:**
+        * If `new_counter_value <= QuotaMax`: The request is within the allowed quota.
+        * If `new_counter_value > QuotaMax`: This request has exceeded the quota limit.
+
+5.  **Outcome:**
+    *   **Quota OK:** The middleware allows the request to proceed to the next stage in the processing pipeline (e.g., other middleware, upstream service).
+    *   **Quota Exceeded:** The middleware halts further request processing down the standard pipeline. It prepares and returns an error response to the client, typically `HTTP 403 Forbidden` with a "Quota exceeded" message.
+
+6.  **Session State Update:** Regardless of whether the request was allowed or blocked due to the quota, the middleware calls an internal function (like `updateSessionQuota`) to update the in-memory `SessionState` associated with the API key. This update synchronizes the `QuotaRemaining` field in the session with the latest calculated state based on the Redis counter and its expiry. It ensures that subsequent operations within the same request lifecycle (if any) or diagnostic information have access to the most recent quota status.
+
+#### Quota Reset Mechanisms
+
+The available allowance (`QuotaRemaining`) for an API key is replenished back to its maximum (`QuotaMax`) through several distinct mechanisms:
+
+1.  **Event-Driven Renewal (Primary Mechanism):**
+    *   **Condition:** This occurs *after* the time duration specified by `QuotaRenewalRate` (in seconds) has elapsed since the quota period began (i.e., since the last reset or key creation/update). In Redis, this corresponds to the Time-To-Live (TTL) expiring on the quota tracking key.
+    *   **Trigger:** The reset is **not** automatic based on a timer. It is triggered by the **next API request** made using that specific key *after* the `QuotaRenewalRate` duration has passed (and the Redis TTL has expired).
+    *   **Process:** Upon detecting the expired TTL during that next request, Tyk resets the Redis counter (typically by setting it to 0 and immediately incrementing it to 1 for the current request) and applies a *new* TTL based on the `QuotaRenewalRate`. This effectively makes the full `QuotaMax` available for the new period starting from that moment.
+
+    ```mermaid
+    graph LR
+    A[Request After Quota Period] --> B{Redis Key Expired?};
+    B -- Yes --> C[Reset Counter to 0];
+    C --> D[Set New Expiration];
+    D --> E[Process Request Normally];
+    B -- No --> F[Continue Normal Processing];
+    ```
+
+2.  **Manual Reset via API:**
+    *   **Mechanism:** You can force an immediate quota reset for a specific API key by calling an endpoint on the Tyk Gateway Admin API.
+    *   **Effect:** This action directly deletes the corresponding quota tracking key in Redis. The *next* request using this API key will find no existing key, triggering the renewal logic (Step 1) as if the period had just expired, immediately granting the full `QuotaMax` and setting a new TTL. This provides an immediate, on-demand refresh of the quota allowance.
+
+3.  **Key Creation or Update:**
+    *   **Trigger:** When a new API key is created or an existing key's configuration is updated (e.g., via the Dashboard or the Gateway API), Tyk reapplies the quota settings based on the current policy or key-specific configuration.
+    *   **Process:** This typically involves setting the `QuotaRemaining` value to `QuotaMax` in the key's session data and ensuring the corresponding Redis key is created with the correct initial value (or implicitly reset) and its TTL set according to the `QuotaRenewalRate`. This ensures the key starts with a fresh quota allowance according to its defined limits.
+    *   **Exception:** This behavior can be suppressed if the API definition includes the `DontSetQuotasOnCreate` field (referred to as `SkipQuotaReset` in the OAS specification), which prevents automatic quota resets during key creation or updates.
+  
+#### Key Technical Aspects
+
+1. **Time-Based Reset**: Unlike [rate limiting](/api-management/rate-limit), which uses sliding windows, quotas have a fixed renewal time determined by `QuotaRenewalRate` (in seconds)
+
+2. **Atomic Operations**: Redis pipelining is used to ensure atomic increment and expiration setting:
+
+3. **Race Condition Handling**: Distributed locks prevent multiple servers from simultaneously resetting quotas
+
+4. **Quota Scope Support**: The implementation supports both global quotas and API-specific quotas through the scoping mechanism
+
+---
+## FAQs
+
+<AccordionGroup>
+<Accordion title='What are Request Quotas in Tyk?'>
+Request Quotas in Tyk limit the total number of API requests a client can make within a specific time period. Unlike rate limits (which control requests per second), quotas control the total number of requests over longer periods like hours, days, or months. Once a quota is exhausted, further requests are rejected until the quota is renewed.
+</Accordion>
+
+<Accordion title='How do Request Quotas differ from Rate Limits?'>
+While both control API usage, they serve different purposes:
+- **[Rate Limits](/api-management/rate-limit)** control the frequency of requests (e.g., 10 requests per second) to prevent traffic spikes and ensure consistent performance
+- **Request Quotas** control the total volume of requests over a longer period (e.g., 10,000 requests per month) to manage overall API consumption and often align with business/pricing models
+</Accordion>
+
+<Accordion title='How are Request Quotas configured in Tyk?'>
+Refer this [documentation](#configuration-options).
+</Accordion>
+
+<Accordion title='What are the key parameters for Request Quotas?'>
+The main parameters for configuring quotas are:
+- `quota_max`: Maximum number of requests allowed during the quota period
+- `quota_remaining`: Number of requests remaining for the current period
+- `quota_renewal_rate`: Time in seconds during which the quota is valid (e.g., 3600 for hourly quotas)
+- `quota_renews`: Timestamp indicating when the quota will reset
+</Accordion>
+
+<Accordion title='Can I disable Request Quotas for specific APIs?'>
+You can disable quotas for specific APIs by setting the `disable_quota` flag to `true` in the API definition. This config will bypass quota checking for all requests to that API, regardless of any quotas set at the key or policy level.
+
+Refer this [documentation](#api-level-configuration).
+</Accordion>
+
+<Accordion title='What happens when a Request Quota is exceeded?'>
+When a quota is exceeded:
+1. The request is rejected with a 403 Forbidden status code
+2. A "QuotaExceeded" event is triggered (which can be used for notifications or monitoring)
+3. The client must wait until the quota renewal period before making additional requests
+4. The quota violation is logged and can be monitored in the Tyk Dashboard
+</Accordion>
+
+<Accordion title='How are Request Quotas tracked and stored?'>
+Tyk stores quota information in Redis:
+- Quota keys are prefixed with "quota-" followed by the key identifier
+- For each request, Tyk increments a counter in Redis and checks if it exceeds the quota_max
+- When a quota period expires, the counter is reset
+- For distributed deployments, quota information is synchronized across all Tyk nodes
+</Accordion>
+
+<Accordion title='Can I set different quotas for different endpoints within the same API?'>
+Yes, you can implement per-endpoint quotas using policies enabling the "per_api" partitioning. This config allows you to define different quota limits for API endpoints, giving you fine-grained control over resource usage.
+</Accordion>
+
+<Accordion title='How do organization-level quotas work?'>
+Organization quotas allow you to limit the total number of requests across all keys belonging to an organization. When enabled (using `enforce_org_quotas`), Tyk tracks the combined usage of all keys in the organization and rejects requests when the organization quota is exceeded, regardless of individual key quotas.
+</Accordion>
+
+<Accordion title='Can I monitor quota usage and receive notifications before quotas are exceeded?'>
+Yes, Tyk provides quota monitoring capabilities:
+- You can set up trigger monitors with percentage thresholds
+- When usage reaches a threshold (e.g., 80% of quota), Tyk can trigger notifications
+- These notifications can be sent via webhooks to external systems
+- The monitoring configuration is set in the `monitor` section of your Tyk configuration
+</Accordion>
+
+<Accordion title="Why isn't my quota resetting automatically at midnight?">
+Tyk's quota renewal is event-driven rather than time-driven. Quotas don't automatically reset at specific times (like midnight); instead, they reset when the first request is made after the renewal period has passed. If no requests are made after renewal, the quota counter remains unchanged until the next request triggers the check and renewal process.
+</Accordion>
+
+<Accordion title='How can I manually reset a quota for a specific key?'>
+You can manually reset a quota for a specific key in two ways:
+
+**Via Tyk Dashboard:**
+1. Navigate to the "Keys" section
+2. Find and select the key you want to reset
+3. Click on "Reset Quota" button
+
+**Via Tyk Gateway API:**
+```
+POST /tyk/keys/reset/{key_id}
+Authorization: {your-gateway-secret}
+```
+This endpoint will immediately reset the quota for the specified key, allowing the key to make requests up to its quota limit again.
+</Accordion>
+
+<Accordion title='Does Tyk count failed requests against my quota?'>
+It depends on where the failure occurs:
+
+1. **Gateway Rejections (Do NOT count against quota):** Requests rejected by Tyk's early middleware checks—such as Authentication failures (401/403) or Rate Limit exceeded (429)—do *not* decrement your quota. This is because these checks happen *before* the quota evaluation in the middleware chain.
+
+2. **Upstream Rejections (DO count against quota):** Once a request passes Tyk's rate limiting and authentication checks, it decrements the quota. If the upstream service then returns an error (e.g., 400 Bad Request, 500 Internal Server Error), the request *will still count* against the quota.
+
+This behavior is designed to prevent abuse and ensure consistent quota enforcement regardless of the upstream API's response, while not penalizing users for requests that Tyk blocks at the edge.
+</Accordion>
+<Accordion title='Why are my quota counts inconsistent in a multi-gateway setup?'>
+In multi-datacenter or multi-region setups, quota inconsistencies can occur due to:
+
+1. **Redis replication lag**: If you're using separate Redis instances with replication, there may be delays in syncing quota information
+2. **Network latency**: In geographically distributed setups, network delays can cause temporary inconsistencies
+3. **Configuration issues**: Each gateway must be properly configured to use the same Redis database for quota storage
+
+To resolve this, ensure all gateways are configured to use the same Redis database or a properly configured Redis cluster with minimal replication lag. Consider using Redis Enterprise or a similar solution with cross-region synchronization capabilities for multi-region deployments.
+</Accordion>
+
+<Accordion title='Why do I see "Quota disabled" error logs when I have intentionally disabled quotas?'>
+In some older versions of Tyk, setting `quota_max` to -1 (to disable quotas) would generate an error log message: `Quota disabled: quota max <= 0`. This was a known issue that has been fixed in more recent versions.
+
+If you're still seeing these logs, consider:
+1. Upgrading to the latest version of Tyk
+2. Adjusting your log level to reduce noise
+3. Using the API definition's `disable_quota` flag instead of setting `quota_max` to -1
+
+This log message is informational and doesn't indicate a functional problem with your API.
+</Accordion>
+
+<Accordion title='Can I set quotas to only count successful requests?'>
+By default, Tyk counts all requests against the quota regardless of the response code. There is no built-in configuration to count only successful (2xx) responses toward quota limits.
+
+If you need this functionality, you have two options:
+1. Implement a custom middleware plugin that conditionally decrements the quota based on response codes
+2. Use the Tyk Pump to track successful vs. failed requests separately in your analytics platform and implement quota management at the application level
+</Accordion>
+
+<Accordion title='What happens if I change a quota mid-period?'>
+If you modify a quota configuration mid-period (before the renewal time):
+
+1. For **increasing** the quota: The new maximum will apply, but the current remaining count stays the same
+2. For **decreasing** the quota: If the new quota is less than what's already been used, further requests will be rejected
+3. For **changing the renewal rate**: The new renewal period will apply from the next renewal
+
+Changes to quota settings take effect immediately, but don't reset the current usage counter. Use the "Reset Quota" functionality to apply new settings and reset the counter immediately.
+</Accordion>
+
+<Accordion title='Can I implement different quota plans for different users?'>
+Yes, Tyk provides several ways to implement different quota plans:
+
+1. **Policies**: Create different policies with varying quota limits and assign them to keys based on subscription level
+2. **Key-specific settings**: Override policy quotas for individual keys when necessary
+3. **Meta Data**: Use key metadata to adjust quota behavior through middleware dynamically
+4. **Multiple APIs**: Create separate API definitions with different quota configurations for different service tiers
+
+This flexibility allows you to implement complex quota schemes that align with your business model and customer tiers.
+</Accordion>
+
+<Accordion title='How do I troubleshoot quota issues?'>
+When troubleshooting quota issues:
+
+1. **Check Redis**: Ensure Redis is functioning properly and examine the quota keys directly
+2. **Review logs**: Look for quota-related messages in the Tyk Gateway logs
+3. **Verify configuration**: Confirm that quota settings are correctly configured in policies and API definitions
+4. **Test with the API**: Use the Tyk Gateway API to check quota status for specific keys
+5. **Monitor request headers**: Examine the `X-Rate-Limit-Remaining` headers in API responses
+
+For multi-gateway setups, verify that all gateways use the same Redis instance and that there are no synchronization issues between Redis clusters.
+</Accordion>
+</AccordionGroup>
+
diff --git a/api-management/request-throttling.mdx b/api-management/request-throttling.mdx
new file mode 100644
index 0000000000..15abef1aa8
--- /dev/null
+++ b/api-management/request-throttling.mdx
@@ -0,0 +1,437 @@
+---
+title: "Request Throttling"
+description: "Understand how request throttling works in Tyk Gateway to protect your upstream services from traffic spikes"
+keywords: "Request Throttling"
+sidebarTitle: "Request Throttling"
+---
+
+## Introduction
+
+Tyk's Request Throttling feature provides a mechanism to manage traffic spikes by queuing and automatically retrying client requests that exceed [rate limits](/api-management/rate-limit), rather than immediately rejecting them. This helps protect upstream services from sudden bursts and improves the resilience of API interactions during temporary congestion.
+
+---
+## Quick Start
+
+### Overview
+
+In this tutorial, we will configure Request Throttling on a Tyk Security Policy to protect a backend service from sudden traffic spikes. We'll start by defining a basic rate limit on a policy, then enable throttling with specific retry settings to handle bursts exceeding that limit, associate a key with the policy, and finally test the behaviour using simulated traffic. This guide primarily uses the Tyk Dashboard for configuration.
+
+### Prerequisites
+
+- **Working Tyk Environment:** You need access to a running Tyk instance that includes both the Tyk Gateway and Tyk Dashboard components. For Docker setup instructions, please refer to this [guide](/tyk-self-managed/install/docker).
+- **Curl, seq and xargs**: These tools will be used for testing.
+
+### Instructions
+
+#### Create an API
+
+1.  **Create an API:**
+    1. Log in to your Tyk Dashboard.
+    2. Navigate to **API Management > APIs**
+    3. Click **Add New API**
+    4. Click **Import**
+    5. Select **Import Type** as **Tyk API**
+    6. Copy the below Tyk OAS definition in the text box and click **Import API** to create an API
+
+        
+
+    <Expandable title='Click to expand API Definition'>
+    ```json
+            {
+                "components": {
+                    "securitySchemes": {
+                        "authToken": {
+                            "in": "header",
+                            "name": "Authorization",
+                            "type": "apiKey"
+                        }
+                    }
+                },
+                "info": {
+                    "title": "Request Throttling Test",
+                    "version": "1.0.0"
+                },
+                "openapi": "3.0.3",
+                "paths": {},
+                "security": [
+                    {
+                        "authToken": []
+                    }
+                ],
+                "servers": [
+                    {
+                        "url": "http://tyk-gateway.localhost:8080/request-throttling-test/"
+                    }
+                ],
+                "x-tyk-api-gateway": {
+                    "info": {
+                        "name": "Request Throttling Test",
+                        "state": {
+                            "active": true
+                        }
+                    },
+                    "middleware": {
+                        "global": {
+                            "contextVariables": {
+                                "enabled": true
+                            },
+                            "trafficLogs": {
+                                "enabled": true
+                            }
+                        }
+                    },
+                    "server": {
+                        "authentication": {
+                            "enabled": true,
+                            "securitySchemes": {
+                                "authToken": {
+                                    "enabled": true
+                                }
+                            }
+                        },
+                        "listenPath": {
+                            "strip": true,
+                            "value": "/request-throttling-test/"
+                        }
+                    },
+                    "upstream": {
+                        "url": "http://httpbin.org/"
+                    }
+                }
+            }
+            ```
+    </Expandable>
+
+
+
+#### Configure Policy and Rate Limit
+
+2.  **Create and Configure an Security Policy with Rate Limiting:**
+
+    
+
+    <Expandable title='Click to expand to see a detailed steps to configure rate limit in the Tyk Dashboard UI'>
+    1.  Navigate to **API Security > Policies** in the Tyk Dashboard sidebar
+        2.  Click the **Add Policy** button
+        3.  Under the **1. Access Rights** tab, in the **Add API Access Rule** section, select the `Request Throttling Test` API
+        4.  Scroll down to the **Global Limits and Quota** section (still under the **1. Access Rights** tab):
+            *   Set the following values for `Rate Limiting`
+            *   Enter `5` into the **Requests (or connection attempts)** field
+            *   Enter `10` into the **Per (seconds):** field
+        5.  Select the **2. Configuration** tab
+        6.  In the **Policy Name** field, enter `Request Throttling Policy`
+        7.  From the **Key expire after** dropdown, select `1 hour`
+        8.  Click the **Create Policy** button
+    </Expandable>
+
+
+
+    <img src="/img/dashboard/system-management/rate-limit-in-policy.png" alt="policy with throttling configured" />
+
+3.  **Associate an Access Key with the Policy:**
+
+    
+
+    <Expandable title='Click to expand to see a detailed steps to Associate an Access Key with the Policy in the Tyk Dashboard UI'>
+    1.  Navigate to **API Security > Keys** in the Tyk Dashboard sidebar
+        2.  Click the **Add Key** button
+        3.  Under the **1. Access Rights** tab:
+            *   In the **Apply Policy** section, select the `Request Throttling Policy` API
+        5.  Select the **2. Configuration** tab
+        6.  In the **Alias** field, enter `Request Throttling Key`. This provides a human-readable identifier that makes tracking and managing this specific access key easier in your analytics and logs.
+        7.  From the **Expires** dropdown, select `1 hour`
+        8.  Click the **Create Key** button
+        9.  A pop-up window **"Key created successfully"** will appear displaying the key details. **Copy the Key ID** value shown and save it securely. You will need this key to make API requests in the following steps
+        10. Click **OK** to close the pop-up
+    </Expandable>
+
+
+
+4. **Test Rate Limit**
+
+    So far, we've created a policy for an API definition and created a key that complies with that policy. Before enabling throttling, let's observe the standard rate limiting behaviour. We'll send 10 requests in parallel using `xargs` to simulate a burst that exceeds our configured limit (5 requests per 10 seconds).
+
+    1.  Open your terminal.
+    2.  Execute the following command, replacing `<replace-with-key-id>` with the API Key ID you saved earlier:
+
+        ```bash
+        seq 10 | xargs -n1 -P10 -I {} bash -c 'curl -s -I -H "Authorization: <replace-with-key-id>" http://tyk-gateway.localhost:8080/request-throttling-test/ | head -n 1'
+        ```
+
+    3.  **Expected Observation:** You should see some requests succeed with `HTTP/1.1 200 OK`, and other requests failing with `HTTP/1.1 429 Too Many Requests` as the rate limit is immediately enforced. The order of `200s` vs `429s` might vary depending upon the processing time, but you will see immediate rejections once the limit is hit.
+
+    **Sample Output (Illustrative):**
+
+    ```bash
+    HTTP/1.1 429 Too Many Requests
+    HTTP/1.1 429 Too Many Requests
+    HTTP/1.1 429 Too Many Requests
+    HTTP/1.1 429 Too Many Requests
+    HTTP/1.1 429 Too Many Requests
+    HTTP/1.1 200 OK
+    HTTP/1.1 200 OK
+    HTTP/1.1 200 OK
+    HTTP/1.1 200 OK
+    HTTP/1.1 200 OK
+    ```
+
+#### Configure Throttling
+
+Now that the policy enforces a basic rate limit, we will enable and configure Request Throttling. This adds the queue-and-retry behavior for requests that exceed the limit, preventing immediate rejection and helping to smooth out traffic spikes.
+
+5.  **Configure Request Throttling by Updating the Security Policy**
+
+    1.  Navigate to **API Security > Policies** in the Tyk Dashboard sidebar
+    2.  Click on the `Request Throttling Policy`
+    3.  Under the **1. Access Rights** tab:
+        *   In the **Global Limits and Quota** section
+        *   Set the following values for `Throttling`
+        *   Uncheck the `Disable Throttling` checkbox
+        *   Enter `3` into the **Throttle retries (or connection attempts)** field
+        *   Enter `5` into the **Per (seconds):** field
+    4.  Click the **Update** button
+    5.  A pop-up window will appear to confirm the changes. Click **Update** to close the pop-up
+
+#### Testing
+
+6. **Test Request Throttling**
+
+    1.  **Repeat the Test:** Open your terminal and execute the *exact same command* as in step 4:
+
+        ```bash
+        seq 10 | xargs -n1 -P10 -I {} bash -c 'curl -s -I -H "Authorization: <replace-with-key-id>" http://tyk-gateway.localhost:8080/request-throttling-test/ | head -n 1'
+        ```
+
+    2.  **Expected Observation:**
+        *   You will still see the first ~5 requests return `HTTP/1.1 200 OK` quickly
+        *   Critically, the subsequent requests (6 through 10) will **not** immediately return `429`. Instead, you should observe a **delay** before their status lines appear
+        *   After the delay (`throttle_interval`), Tyk will retry the queued requests. Some might now succeed (return `200 OK`) if the rate limit window allows
+        *   If a request is retried `throttle_retry_limit` (3) times and still encounters the rate limit, *then* it will finally return `HTTP/1.1 429 Too Many Requests`
+        *   Overall, you might see more `200 OK` responses compared to the previous test, and any `429` responses will appear significantly later
+
+    **Sample Output (Illustrative - timing is key):**
+
+    ```bash
+    HTTP/1.1 200 OK  # Appears quickly
+    HTTP/1.1 200 OK  # Appears quickly
+    HTTP/1.1 200 OK  # Appears quickly
+    HTTP/1.1 200 OK  # Appears quickly
+    HTTP/1.1 200 OK  # Appears quickly
+    # --- Noticeable pause here ---
+    HTTP/1.1 200 OK
+    # --- Noticeable pause here ---
+    HTTP/1.1 200 OK
+    # --- Noticeable pause here ---
+    HTTP/1.1 200 OK
+    HTTP/1.1 200 OK
+    HTTP/1.1 200 OK
+    ```
+    *(The exact mix of 200s and 429s on the delayed requests depends heavily on timing relative to the 10-second rate limit window reset and the retry attempts).*
+
+This comparison clearly shows how Request Throttling changes the behaviour from immediate rejection to queued retries, smoothing the traffic flow and potentially allowing more requests to succeed during bursts.
+
+---
+## Configuration Options
+
+Request Throttling is configured using [Policies](/api-management/policies) or directly on individual [Sessions](/api-management/access-control/sessions-and-keys/understanding-sessions).
+
+The configuration involves setting two specific fields:
+
+- `throttle_interval`: Defines the wait time (in seconds) between retry attempts for a queued request. (*Note*: Do not set it to `0`. If you do, no delay is applied, and the request is immediately retried. This will creates a “busy waiting” scenario that consumes more resources than a positive interval value)
+- `throttle_retry_limit`: Sets the maximum number of retry attempts before the request is rejected. (*Note*: Do not set it to `0`. Setting it to `0` means that there will be no throttling on the request)
+
+To enable throttling, both fields must be set to a value greater than `0`. 
+
+### Disable throttling
+
+The default value is `-1` and means it is disabled by default.
+Setting `throttle_interval` and `throttle_retry_limit` values to any number smaller than `0`, to ensure the feature is diabled.
+
+You can configure these settings using either the Tyk Dashboard UI or the Tyk Dashboard API.
+
+### Configure via UI
+
+The Tyk Dashboard provides a straightforward interface to set throttling parameters on both Security Policies and Access Keys.
+
+<Tabs>
+
+<Tab title="Security Policy">
+
+The image below shows a policy with throttling. Any key using this policy will inherit the throttling settings and behaves as follows: wait 2 seconds between retries for queued requests, attempting up to 3 times before failing (so overall 6 seconds before getting another 429 error response).
+
+<img src="/img/dashboard/system-management/throttling-in-policy.png" alt="policy with throttling configured" />
+
+<br />
+<Expandable title='Click to expand to see a detailed steps to configure Request Throttling in the Tyk Dashboard UI'>
+1.  Navigate to **API Security > Policies** in the Tyk Dashboard sidebar
+2.  Click the **Add Policy** button
+3.  Under the **1. Access Rights** tab and in the **Add API Access Rule** section, select the required API
+4.  Scroll down to the **Global Limits and Quota** section (still under the **1. Access Rights** tab):
+    *   To enable *Throttling*,  we must configure *Rate Limiting* in the policy.
+        *   Field **Requests (or connection attempts)**  - Enter the number of requests you want to allow before rate limit is applied.
+        *   Field **Per (seconds):** - Enter the time window in seconds during which the number of requests specified above is allowed.
+    *   Now enable `Throttling` by setting the following values in the `Throttling` section:
+        *   Uncheck the `Disable Throttling` checkbox
+        *   Field **Throttle retries (or connection attempts)** - Enter the maximum number of times Tyk should attempt to retry a request after it has been queued due to exceeding a rate limit or quota.
+        *   Field **Per (seconds):** - Enter the time interval in seconds Tyk should wait between each retry attempt for a queued request.
+5.  Select the **2. Configuration** tab
+6.  In the **Policy Name** field, enter a name
+7.  From the **Key expire after** dropdown, select an option
+8.  Click the **Create Policy** button
+</Expandable>
+
+</Tab>
+
+<Tab title="Access Key">
+
+The image below shows an access key with throttling. This access key behaves as follows: wait 2 seconds between retries for queued requests, attempting up to 3 times before failing (so overall 6 seconds before getting another 429 error response).
+
+**Note:** Direct key configuration overrides policy settings only for that specific key.
+
+<img src="/img/dashboard/system-management/create-access-key-for-request-throttling.png" alt="access key with throttling configured" />
+
+<br />
+<Expandable title='Click to expand to see a detailed steps to configure Request Throttling in the Tyk Dashboard UI'>
+1.  Navigate to **API Security > Keys** in the Tyk Dashboard sidebar
+2.  Click the **Create Key** button
+3.  Under the **1. Access Rights** tab:
+    *   Select **Choose API**
+    *   In the **Add API Access Rule** section, select the required API
+4.  Scroll down to the **Global Limits and Quota** section (still under the **1. Access Rights** tab):
+    *   To enable *Throttling*,  we must configure *Rate Limiting* in the Access Key.
+        *   Field **Requests (or connection attempts)**  - Enter the number of requests you want to allow before rate limit is applied.
+        *   Field **Per (seconds):** - Enter the time window in seconds during which the number of requests specified above is allowed.
+    *   Now enable `Throttling` by setting the following values in the `Throttling` section:
+        *   Uncheck the `Disable Throttling` checkbox
+        *   Field **Throttle retries (or connection attempts)** - Enter the maximum number of times Tyk should attempt to retry a request after it has been queued due to exceeding a rate limit or quota.
+        *   Field **Per (seconds):** - Enter the time interval in seconds Tyk should wait between each retry attempt for a queued request.
+5.  Select the **2. Configuration** tab
+6.  In the **Alias** field, enter a name. This provides a human-readable identifier that makes tracking and managing this specific access key easier in your analytics and logs.
+7.  From the **Expires** dropdown, select an option
+8.  Click the **Create Key** button
+</Expandable>
+
+</Tab>
+
+</Tabs>
+
+### Configure via API
+
+These are the fields that you can set directly in the Policy object or the Access Key:
+
+```json
+{
+  // Partial policy/session object fields
+  "throttle_interval": 2,       // Wait 2 second between retries
+  "throttle_retry_limit": 3,    // Attempt a maximum of 3 retries
+  // ... more config follows
+}
+```
+
+<Tabs>
+
+<Tab title="Security Policy">
+
+To update the policy, do the following:
+1. Retrieve the policy object using `GET /api/portal/policies/{POLICY_ID}`
+2. Add or modify the `throttle_interval` and `throttle_retry_limit` fields within the policy JSON object
+3. Update the policy using `PUT /api/portal/policies/{POLICY_ID}` with the modified object, or create a new one using `POST /api/portal/policies/`
+
+**Explanation:**
+The above adds throttling to a policy. Any key using this policy will inherit the throttling settings and behaves as follows: wait 1 second between retries for queued requests, attempting up to 5 times before failing (so overall 5 seconds before getting another 429 error response).
+
+</Tab>
+
+<Tab title="Access Key">
+
+Note: Direct key configuration overrides policy settings only for that specific key.
+
+To update the access key do the following:
+1. Retrieve the key's session object using `GET /api/keys/{KEY_ID}`
+2. Add or modify the `throttle_interval` and `throttle_retry_limit` fields within the session object JSON
+3. Update the key using `PUT /api/keys/{KEY_ID}` with the modified session object
+
+
+**Explanation:**
+The above adds throttling to a key. Any request made by the key will behave as follows: wait 1 second between retries for queued requests, attempting up to 5 times before failing (so overall 5 seconds before getting another 429 error response).
+
+</Tab>
+
+</Tabs>
+
+---
+## How It Works
+
+```mermaid
+flowchart LR
+    A[Client Request] --> GW(Tyk Gateway);
+
+    subgraph Rate Limits
+        GW --> RL{Rate Limit OK?};
+        RL -- Yes --> Q{Quota OK?};
+        RL -- No --> T{Throttle Enabled?};
+        Q -- Yes --> Fwd[Forward Request];
+        Q -- No --> Reject[Reject Request];
+    end
+
+    subgraph Throttling Logic
+        T -- No --> Reject;
+        T -- Yes --> Queue[Queue Request];
+        Queue --> Wait[Wait ThrottleInterval];
+        Wait --> RetryL{Retry Limit Reached?};
+        RetryL -- Yes --> Reject;
+        RetryL -- No --> Recheck(Re-evaluate Rate Limit Only);
+        %% Loop back to rate limit check only %%
+        Recheck --> RL;
+    end
+
+    Fwd --> Backend((Upstream Service));
+    Backend --> Success((Success Response));
+    Success --> Client;
+    Reject --> Failure((Failure Response));
+    Failure --> Client;
+```
+
+Tyk's Request Throttling intercepts API requests *after* they have exceeded a configured [Rate Limit](/api-management/rate-limit). 
+
+Instead of immediately rejecting these requests with a `429 Too Many Requests` error (which is the default rate-limiting behaviour), the Gateway temporarily holds them in a queue. After waiting for a specified duration (`throttle_interval`), Tyk attempts to process the request again, re-checking the rate limit status. 
+
+This retry cycle repeats until either the request can be successfully processed (if capacity becomes available) or a configured maximum number of retries (`throttle_retry_limit`) is reached. Only after exhausting all retries does Tyk return the `429` error to the client.
+
+Think of it like trying to access a service with a restriction on how many people can enter per minute (Rate Limit). If you arrive when the per-minute limit is full, standard behaviour is to turn you awa
+y immediately. With Throttling enabled, the service instead asks you to wait briefly (the interval) and tries your entry again shortly, checking if the rate limit has freed up capacity, repeating this a f
+ew times (the retry limit) before finally turning you away if access is still restricted.
+
+---
+## FAQ
+
+
+<AccordionGroup>
+<Accordion title='What is Request Throttling in Tyk?'>
+Request Throttling in Tyk is a mechanism that allows for graceful handling of rate limit violations. Instead of immediately rejecting requests that exceed rate limits, throttling gives clients a chance to retry after a specified delay.
+</Accordion>
+
+<Accordion title='How does Request Throttling differ from Rate Limiting?'>
+Rate Limiting is a mechanism to restrict the number of requests a client can make in a given time period (e.g., 100 requests per minute). Request Throttling is an extension of rate limiting that provides a retry mechanism when rate limits are exceeded. Instead of immediately failing with a 429 status code, throttling allows the gateway to wait and retry the request internally.
+</Accordion>
+
+<Accordion title='Does Request Throttling work with Request Quotas?'>
+No, Request Throttling in Tyk is exclusively linked to rate limits and does not work with request quotas. When a quota is exceeded, the request is immediately rejected without any throttling or retry attempts. Throttling is only applied when rate limits are exceeded.
+</Accordion>
+
+<Accordion title='How do I configure Request Throttling in Tyk?'>
+Refer to this [documentation](#configuration-options).
+</Accordion>
+
+<Accordion title='How does Request Throttling affect response times?'>
+Request Throttling can increase response times for requests that exceed rate limits, as the gateway will wait for the specified `ThrottleInterval` between retry attempts. The maximum additional latency would be `ThrottleInterval × ThrottleRetryLimit` seconds. This trade-off provides better success rates at the cost of potentially longer response times for some requests.
+</Accordion>
+
+<Accordion title='Can I monitor throttled requests in Tyk?'>
+Yes, Tyk tracks throttled requests in its health check metrics. You can monitor the `ThrottledRequestsPS` (throttled requests per second) metric to see how often requests are being throttled. Additionally, when a request is throttled, Tyk emits a `RateLimitExceeded` event that can be captured in your monitoring system.
+</Accordion>
+
+<Accordion title='Is Request Throttling enabled by default?'>
+No, Request Throttling is not enabled by default. To enable throttling, you need to explicitly set `ThrottleRetryLimit` to a value greater than 0 and configure an appropriate `ThrottleInterval`. These settings can be applied through policies or directly in access keys.
+</Accordion>
+</AccordionGroup> 
\ No newline at end of file
diff --git a/api-management/response-caching.mdx b/api-management/response-caching.mdx
new file mode 100644
index 0000000000..2d813d130a
--- /dev/null
+++ b/api-management/response-caching.mdx
@@ -0,0 +1,754 @@
+---
+title: "Caching Responses"
+description: "Learn how to configure response caching in Tyk Gateway to reduce upstream load and improve API response times"
+keywords: "Caching, Request Optimization, Optimization, Endpoint Caching, Configuration, Cache"
+sidebarTitle: "Response Caching"
+---
+
+## Overview
+
+The Tyk Gateway can cache responses from your upstream services.
+
+API Clients which make subsequent requests to a cached endpoint will receive the cached response directly from the Gateway, which:
+ - reduces load on the upstream service
+ - provides a quicker response to the API Client (reduces latency)
+ - reduces concurrent load on the API Gateway
+
+Caching is best used on endpoints where responses infrequently change and are computationally expensive for the upstream service to generate.
+
+### Caching with Tyk
+
+Tyk uses Redis to store the cached responses and, as you'd expect from Tyk, there is lots of flexibility in how you configure caching so that you can optimize the performance of your system.
+
+There are two approaches to configure caching for an API deployed with Tyk:
+
+ - [Basic](/api-management/response-caching#basic-caching) or [Safe Request](/api-management/response-caching#global-cache-safe-requests) caching is applied at the API level for all requests for which it is safe to do so.
+ - [Advanced](/api-management/response-caching#endpoint-caching) caching options can be applied at the endpoint level.
+
+Tyk's advanced caching options allow you to selectively cache the responses to all requests, only those from specific paths or only responses with specific status codes returned by the API. You can even cache dynamically based upon instruction from the upstream service received within the response.
+
+Caching is enabled by default at the Gateway level, but no caching will happen until the API Definition is configured to do so.
+
+### Cache Terminology and Features
+
+#### Cache Key
+Cache keys are used to differentiate cached responses, such that slight variations in the request can generate different cache keys. This enables you to configure the cache so that different API Clients receive different cached responses when accessing the same API endpoint.
+
+This makes for a very granular cache, which may result in duplication of cached responses. This is preferable to the cache not being granular enough and therefore rendering it unsuitable for use, such that two API Clients receive the same cached response when this is not desired.
+
+The cache key is calculated using many factors:
+ - request HTTP method
+ - request URL (API path/endpoint)
+ - keys and values of any headers specified by `cache_by_headers` property
+ - hash of the request body
+ - API Id of the requested API
+ - value of the authorization header, if present, or if not, the API Client IP address
+
+#### Cache Value
+The value stored in the cache is a base64 encoded string of the response body. When a subsequent request matches the cache key (a **cache hit**), Tyk decodes the cache value and  returns this to the API Client that made the request.
+
+#### Indicating a Cached Response
+When a request causes a cache hit, the Gateway will add a special header to indicate that the response being received is from a cache:
+ - `X-Tyk-Cached-Response` is added to the response header with the value `1`
+
+The API Client can use this to identify cached responses from non-cached responses.
+
+#### Global Cache (Safe Requests)  
+We define a <b>safe request</b> as any category of API request that is considered cacheable without causing any undesired side effects or security concerns. These are requests made using the HTTP methods `GET`, `HEAD` or `OPTIONS` that do not modify data and can be safely cached for performance gains (i.e. they should be idempotent and so are good candidates for caching). If these methods are not idempotent for your API, then you should not use safe request caching.
+
+Safe request caching at the API level is enabled by setting the `cache_all_safe_requests` option to `true`, or by checking the equivalent checkbox in the Dashboard UI. This will enable safe request caching on all endpoints for an API.
+
+This mode of operation is referred to as Global Caching because it is applied globally within the scope of a single API. Picking this approach will override any per-endpoint (per-path) caching configuration, so it’s not suitable if granular control is required.
+
+Tyk does support safe request caching at the more granular, per-endpoint level, as described [here](/api-management/response-caching#request-selective-cache-control) - but `cache_all_safe_requests` must be set to `false` in that scenario.
+
+#### Cache Timeout
+The cache timeout (Time-To-Live or TTL) value can be configured per API and is the maximum age for which Tyk will consider a cache entry to be valid. You should use this to optimize the tradeoff between reducing calls to your upstream service and potential for changes to the upstream data.
+
+If the timeout has been exceeded when a request is made to a cached API, that request will be passed to the upstream and the response will (if appropriate) be used to refresh the cache.
+
+The timeout is configured in seconds.
+
+#### Cache Response Codes
+You can configure Tyk to cache only responses with certain HTTP status codes (e.g. 200 OK), for example to save caching error responses. You can configure multiple status codes that will be cached for an API, but note that this applies only to APIs that return with an HTTP status code in the response.
+
+#### Dynamic Caching
+By default Tyk maintains its response cache with a separate entry for each combination of API key (if authorization is enabled), request method and request path. Dynamic caching is a more flexible method of caching API responses based on header or body content rather than just the request method and path. This allows for more granular caching control and maintainance of separate caches for different users or request properties.
+
+#### Upstream Cache Control
+Upstream cache control refers to caching API responses based on instructions provided by the upstream service within the response headers. This allows the upstream service to have more control over which responses are cached and for how long.
+
+## Basic Caching
+
+_On this page we describe the use of Tyk's API response cache at the API level (Global); for details on the more advanced Endpoint level cache you should refer to [this](/api-management/response-caching#endpoint-caching) page._
+
+Caching is configured separately for each API according to values you set within the API definition. Subsequently, the caching scope is restricted to an API definition, rather than being applied across the portfolio of APIs deployed in the Gateway.
+
+If you are using the Tyk Dashboard you can set these options from the Dashboard UI, otherwise you will need to edit the raw API definition.
+
+### Configuring Tyk's API-level cache 
+Within the API Definition, the cache controls are grouped within the `cache_options` section.
+
+The main configuration options are:
+ - `enable_cache`: Set to `true` to enable caching for the API
+ - `cache_timeout`: Number of seconds to cache a response for, after which the next new response will be cached
+ - `cache_response_codes`: The HTTP status codes a response must have in order to be cached
+ - `cache_all_safe_requests`: Set to `true` to apply the caching rules to all requests using `GET`, `HEAD` and `OPTIONS` HTTP methods
+
+For more advanced use of the API-level cache we also have:
+ - `cache_by_headers`: used to create multiple cache entries based on the value of a [header value](#selective-caching-by-header-value) of your choice
+ - `enable_upstream_cache`: used to allow your [upstream service](/api-management/response-caching#upstream-cache-control-1) to identify the responses to be cached
+ - `cache_control_ttl_headers`: used with `enable_upstream_cache`
+
+#### An example of basic caching 
+To enable global caching for all safe requests to an API, only storing HTTP 200 responses, with a 10 second time-to-live (TTL), you would set:
+```
+"cache_options": {
+  "enable_cache": true,
+  "cache_timeout": 10,
+  "cache_all_safe_requests": true,
+  "cache_response_codes": [200]
+}
+```
+
+
+<Note>
+If you set `cache_all_safe_requests` to true, then the cache will be global and *all* inbound requests made to the API will be evaluated by the caching middleware. This is great for simple APIs, but for most, a finer-grained control is required. This control will over-ride any per-endpoint cache configuration.
+</Note>
+
+
+#### Selective caching by header value
+To create a separate cache entry for each response that has a different value in a specific HTTP header you would configure the `cache_option.cache_by_headers` option with a list of the headers to be cached.
+
+For example, to cache each value in the custom `Unique-User-Id` header of your API response separately you would set:
+```
+  "cache_options": {
+   "cache_by_headers": ["Unique-User-Id"]
+}
+```
+
+
+<Note>
+The `cache_by_headers` configuration is not currently exposed in the Dashboard UI, so it must be enabled though either the raw API editor or the Dashboard API.
+</Note>
+
+
+### Configuring the Cache via the Dashboard
+Follow these simple steps to enable and configure basic API caching via the Dashboard.
+
+**Steps for Configuration:**
+
+1. **Go to the Advanced Options**
+
+    From the API Designer, select the **Advanced Options** tab:
+
+    <img src="/img/2.10/advanced_options_designer.png" alt="Advanced options tab location" />
+
+2. **Set the Cache Options for the Global Cache**
+
+    <img src="/img/2.10/cache_options.png" alt="Cache settings" />
+
+    Here you must set:
+
+    1.  **Enable caching** to enable the cache middleware
+    2.  **Cache timeout** to set the [TTL](/api-management/response-caching#cache-timeout) (in seconds) for cached requests
+    3.  **Cache only these status codes** to set which [response codes](/api-management/response-caching#cache-response-codes) to cache (ensure that you click **ADD** after entering each response code so that it is added to the list)
+    4.  **Cache all safe requests** to enable the [global cache](/api-management/response-caching#global-cache-safe-requests)
+
+## Endpoint Caching
+
+### Overview
+
+On this page we describe how to configure Tyk's API response cache per endpoint within an API. This gives granular control over which paths are cached and allows you to vary cache configuration across API versions. For details on the API level (Global) cache you should refer to the [global-cache](/api-management/response-caching#basic-caching) configuration page.
+
+When you use the API-level cache, Tyk will maintain a cache entry for each combination of request method, request path (endpoint) and API key (if authentication is enabled) for an API. The Endpoint Caching middleware gives you granular control over which paths are cached and allows you to vary cache configuration across API versions.
+
+For details on the API-level cache you should refer to the [API-level cache](/api-management/response-caching#basic-caching) configuration page.
+
+#### When to use the Endpoint Caching middleware
+
+##### API with multiple endpoints
+When your API has more than one endpoint the upstream data could have different degrees of freshness, for example the data returned by one endpoint might refresh only once every five minutes (and so should be suitably cached) whilst another might give real-time data and so should not be cached. The endpoint cache allows you to optimize the caching of each endpoint to meet your requirements.
+
+##### Request based caching
+If you have an API that's providing search capability (for example into a catalog of products) and want to optimize the performance for the most frequently requested search terms, you could use the endpoint cache's [request-selective](#request-selective-cache-control) capability to cache only a subset of all requests to an endpoint.
+
+#### How the endpoint cache works
+If caching is enabled then, by default, Tyk will create separate cache entries for every endpoint (path) of your API. This may be unnecessary for your particular API, so Tyk provides a facility to cache only specific endpoint(s).
+
+The endpoint-level cache relies upon the API-level cache being enabled but then allows you to enable the middleware for the specific endpoints that you wish to cache. No other endpoint requests will be cached.
+
+For each endpoint in your API with endpoint caching middleware enabled, you can configure which response codes should be cached (for example, you might not want to cache error responses) and also the refresh interval - or timeout - for the cache entries.
+
+
+<Note>
+It's important to note that the [cache all safe requests](/api-management/response-caching#global-cache-safe-requests) feature of the API-level cache will overrule the per-endpoint configuration so you must ensure that both are not enabled for the same API.
+</Note>
+
+
+##### Request-selective cache control
+For ultimate control over what Tyk caches, you can optionally configure the endpoint cache middleware to look for specific content in the request body. Tyk will then create a separate cache entry for each response where the request matches the specific combination of method, path and body content.
+
+You define a regex pattern and, if Tyk finds a match for this anywhere in the request body, the response will be cached.  
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ ## Internal Endpoint middleware summary
+  - The Endpoint Cache middleware is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Endpoint Cache middleware can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+
+### Using Tyk OAS API
+
+The [Endpoint Caching](/api-management/response-caching#endpoint-caching) middleware allows you to perform selective caching for specific endpoints rather than for the entire API, giving you granular control over which paths are cached.
+
+When working with Tyk OAS APIs the middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](/api-management/response-caching#using-classic-api) page.
+
+#### Configuring the middleware in the Tyk OAS API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. The `path` can contain wildcards in the form of any string bracketed by curly braces, for example `{user_id}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+**Configuring the endpoint cache is performed in two parts:**
+
+1. **Enable Tyk's caching function**
+
+    The caching function is enabled by adding the `cache` object to the `global` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API.
+
+    This object has the following configuration:
+    - `enabled`: enable the cache for the API
+    - `timeout`: set as the default cache refresh period for any endpoints for which you don't want to configure individual timeouts (in seconds) 
+
+2. **Enable and configure the middleware for the specific endpoint**
+
+    The endpoint caching middleware (`cache`) should then be added to the `operations` section of `x-tyk-api-gateway` for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+    The `cache` object has the following configuration:
+    - `enabled`: enable the middleware for the endpoint
+    - `timeout`: set to the refresh period for the cache (in seconds)
+    - `cacheResponseCodes`: HTTP responses codes to be cached (for example `200`)
+    - `cacheByRegex`: Pattern match for [selective caching by body value](/api-management/response-caching#request-selective-cache-control)
+
+    For example:
+    ```json {hl_lines=["37-40", "45-51"],linenos=true, linenostart=1}
+    {
+        "components": {},
+        "info": {
+            "title": "example-endpoint-cache",
+            "version": "1.0.0"
+        },
+        "openapi": "3.0.3",
+        "paths": {
+            "/delay/5": {
+                "post": {
+                    "operationId": "delay/5post",
+                    "responses": {
+                        "200": {
+                            "description": ""
+                        }
+                    }
+                }
+            }
+        },
+        "x-tyk-api-gateway": {
+            "info": {
+                "name": "example-endpoint-cache",
+                "state": {
+                    "active": true
+                }
+            },
+            "upstream": {
+                "url": "http://httpbin.org/"
+            },
+            "server": {
+                "listenPath": {
+                    "value": "/example-endpoint-cache/",
+                    "strip": true
+                }
+            },
+            "global": {
+                "cache": {
+                    "enabled": true,
+                    "timeout": 60
+                }
+            },
+            "middleware": {
+                "operations": {
+                    "delay/5post": {
+                        "cache": {
+                            "enabled": true,
+                            "cacheResponseCodes": [
+                                200
+                            ],
+                            "timeout": 5
+                        }
+                    }
+                }
+            }
+        }
+    }
+    ```
+
+    In this example the endpoint cache middleware has been configured to cache `HTTP 200` responses to requests to the `POST /delay/5` endpoint. The cache will refresh after 5 seconds. Note that requests to other endpoints will also be cached, with a default cache timeout of 60 seconds according to the configuration in lines 37-40.
+
+    The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the endpoint caching.
+
+#### Configuring the middleware in the API Designer
+
+Adding endpoint caching to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Endpoint Cache middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Cache** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-cache.png" alt="Adding the Endpoint Cache middleware" />
+
+3. **Configure the middleware**
+
+    Set the timeout and HTTP response codes for the endpoint. You can remove a response code from the list by clicking on the `x` next to it.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-cache-config.png" alt="Configuring the endpoint cache middleware for a Tyk OAS API" />
+
+    
+
+    <Note>
+    Body value match or [request selective](/api-management/response-caching#request-selective-cache-control) caching is not currently exposed in the Dashboard UI, so it must be enabled though either the raw API editor or the Dashboard API.
+    </Note>
+
+
+    Select **UPDATE MIDDLEWARE** to apply the change to the middleware configuration.
+
+4. **Save the API**
+
+    Select **SAVE API** to apply the changes to your API.
+
+### Using Classic API
+
+The [Endpoint Caching](/api-management/response-caching#endpoint-caching) middleware allows you to perform selective caching for specific endpoints rather than for the entire API, giving you granular control over which paths are cached.
+
+When working with Tyk Classic APIs the middleware is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](/api-management/response-caching#using-tyk-oas-api) page.
+
+If using Tyk Operator please refer to section [configuring the middleware in the Tyk Operator](#tyk-operator).
+
+#### Configuring the middleware in the Tyk Classic API Definition
+
+When using the Tyk Classic API Definition, there are two options for endpoint caching - simple and advanced.
+
+The [simple](#simple-endpoint-cache) option works with the API-level cache and allows you to select which endpoints are cached, but relies upon the cache timeout (refresh) configured at the API-level. It will cache all responses received from the endpoint regardless of the HTTP response code for all [safe requests](/api-management/response-caching#global-cache-safe-requests).
+
+The [advanced](#advanced-endpoint-cache) option allows you to cache more selectively, giving control over the HTTP response codes to be cached, a per-endpoint cache timeout and also the possibility of caching responses only to requests containing specific data in the request body.
+
+##### Simple endpoint cache
+
+To enable the simple middleware you must add a new `cache` object to the `extended_paths` section of your API definition. The `cache` object is a list of endpoints for which you wish to cache all safe requests.
+
+In the API-level `cache_options` you must enable caching and configure the timeout whilst ensuring that the option to cache all safe requests is disabled.
+
+The `cache_options` object has the following configuration:
+- `enable_cache`: set to `true` to enable caching for this API
+- `cache_all_safe_requests`: set to `false` to allow selective caching per-endpoint
+- `cache_timeout`: set to the refresh period for the cache (in seconds)
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "cache_options": {
+        "enable_cache": true,
+        "cache_timeout": 60,
+        "cache_all_safe_requests": false
+    },
+
+    "extended_paths": {
+        "cache": [
+            {
+                "/widget",
+                "/fish"
+            }
+        ]
+    }
+}
+```
+
+In this example, the endpoint caching middleware has been configured to cache all safe requests to two endpoints (`/widget` and `/fish`) with a cache refresh period of 60 seconds.
+
+##### Advanced endpoint cache
+<a id="tyk-classic-advanced-caching"></a>
+
+For ultimate control over what Tyk caches, you should use the advanced configuration options for the per-endpoint cache. You can separately configure, for each HTTP method for an endpoint:
+- an individual cache refresh (timeout)
+- a list of HTTP response codes that should be cached
+- a pattern match to cache only requests containing specific data in the [request body](/api-management/response-caching#request-selective-cache-control)
+
+To enable the advanced middleware you must add a new `advance_cache_config` object to the `extended_paths` section of your API definition.
+
+In the API-level `cache_options` you must enable caching and ensure that the option to cache all safe requests is disabled. The timeout that you set here will be used as a default  for any endpoints for which you don't want to configure individual timeouts.
+
+The `advance_cache_config` object has the following configuration:
+- `path`: the endpoint path
+- `method`: the endpoint method
+- `timeout`: set to the refresh period for the cache (in seconds)
+- `cache_response_codes`: HTTP response codes to be cached (for example `200`)
+- `cache_key_regex`: pattern match for selective caching by body value
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "cache_options": {
+        "enable_cache": true,
+        "cache_timeout": 60,
+        "cache_all_safe_requests": false
+    },
+
+    "extended_paths": {
+        "advance_cache_config": [
+            {
+                "disabled": false,
+                "method": "POST",
+                "path": "/widget",
+                "cache_key_regex": "",
+                "cache_response_codes": [
+                    200
+                ],
+                "timeout": 10
+            }, 
+            {
+                "disabled": false,
+                "method": "GET",
+                "path": "/fish",
+                "cache_key_regex": "^shark$",
+                "cache_response_codes": [
+                    200, 300
+                ],
+                "timeout": 0
+            } 
+        ]
+    }
+}
+```
+
+In this example the endpoint caching middleware has been configured to cache requests to two endpoints (`/widget` and `/fish`) as follows:
+
+| endpoint | HTTP response codes to cache | cache refresh timeout | body value regex |
+| :---------- | :------------------------------ | :----------------------- | :------------------ |
+| `POST /widget` | 200 | 10 seconds | none |
+| `GET /fish` | 200, 300 | 60 seconds (taken from `cache_options`) | `shark` |
+
+#### Configuring the middleware in the API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the endpoint caching middleware for your Tyk Classic API by following these steps.
+
+##### Simple endpoint cache
+
+To enable and configure the simple endpoint cache, follow these instructions:
+
+1. **Configure the API level caching options**
+
+    From the **Advanced Options** tab configure the cache as follows:
+    - **Enable caching** to enable the cache middleware
+    - **Cache timeout** to configure the timeout (in seconds) for cached requests
+    - **Cache only these status codes** is a list of HTTP status codes that should be cached, remember to click **Add** after entering each code to add it to the list 
+    - **Cache all safe requests** ensure that this is **not** selected, otherwise the responses from all endpoints for the API will be cached
+
+    <img src="/img/dashboard/endpoint-designer/cache-options.png" alt="Cache Options" />
+
+2. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to cache responses. Select the **Cache** plugin.
+
+    <img src="/img/2.10/cache_plugin.png" alt="Dropdown list showing Cache plugin" />
+
+3. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+##### Advanced endpoint cache
+
+To enable and configure the advanced endpoint cache, follow these instructions:
+
+1. **Configure the API level caching options**
+
+    From the **Advanced Options** tab configure the cache as follows:
+    - **Enable caching** to enable the cache middleware
+    - **Cache timeout** to configure the default timeout (in seconds) for any endpoints for which you don't want to configure individual timeouts
+    - **Cache only these status codes** leave this blank
+    - **Cache all safe requests** ensure that this is **not** selected, otherwise the responses from all endpoints for the API will be cached
+
+    <img src="/img/dashboard/endpoint-designer/cache-options.png" alt="Cache Options" />
+
+2. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to cache responses. Select the **Advanced Cache** plugin.
+
+    <img src="/img/dashboard/endpoint-designer/advanced-cache.png" alt="Selecting the Advanced Cache plugin for a Tyk Classic API" />
+
+3. **Configure the Advanced Cache plugin**
+
+    Set the timeout and HTTP response codes for the endpoint. If you don't need to set a specific timeout for an endpoint you can leave this blank and Tyk will use the cache timeout configured at the API level.
+
+    <img src="/img/dashboard/endpoint-designer/advanced-cache-config.png" alt="Endpoint cache configuration for Tyk Classic API" />
+
+    
+
+    <Note>
+    Body value match or [request selective](/api-management/response-caching#request-selective-cache-control) caching is not currently exposed in the Dashboard UI, so it must be configured through either the raw API editor or the Dashboard API.
+    </Note>
+
+
+4. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+#### Configuring the middleware in the Tyk Operator
+<a id="tyk-operator"></a>
+
+You can use Tyk Operator to configure the endpoint caching middleware for your Tyk Classic API by following these steps.
+
+##### Simple endpoint cache
+
+Configuring simple endpoint caching in Tyk Operator is similar to the process for a Tyk Classic API Definition. A list of endpoints for which you wish to cache safe requests should be configured within the `cache` list in the `extended_paths` section.
+
+In the API-level `cache_options` object, you must enable caching by setting `enable_cache` to true and configure the cache refresh period by setting a value for the `cache_timeout` in seconds. To allow selective caching per endpoint you should also set `cache_all_safe_requests`to `false`.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["26-35"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-cache
+spec:
+  name: httpbin-cache
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-cache
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          cache:
+            - /get
+            - /anything
+  cache_options:
+    cache_all_safe_requests: false
+#    cache_by_headers: []
+    cache_timeout: 10
+    cache_response_codes:
+      - 400
+    enable_cache: true
+```
+
+##### Advanced endpoint cache
+
+Advanced caching with Tyk Operator is a similar process to that for configuring the [advanced caching middleware in the Tyk Classic API Definition](#tyk-classic-advanced-caching).
+
+To enable the advanced middleware you must add a new `advance_cache_config` object to the `extended_paths` section of your API definition.
+
+This allows you to configure caching per endpoint. For each endpoint, it is possible to specify the endpoint path, method, list of response codes to cache, cache timeout and a cache key regular expression. The cache key regular expression represents a pattern match to cache only requests containing specific data in the [request body](/api-management/response-caching#request-selective-cache-control)
+
+For example:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["26-35"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-advance-cache
+spec:
+  name: httpbin-advance-cache
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-advance-cache
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          advance_cache_config:
+          - path: /anything 
+            method: GET
+            cache_key_regex: ""
+            cache_response_codes: [200]
+  cache_options:
+    cache_timeout: 30
+    enable_cache: true
+```
+
+In this example the endpoint caching middleware has been configured to cache requests for the `/anything` endpoint as follows:
+
+| endpoint | HTTP response codes to cache | cache refresh timeout | body value regex |
+| :---------- | :------------------------------ | :----------------------- | :------------------ |
+| `GET /anything` | 200 | 30 seconds (taken from `cache_options`) | none |
+
+## Upstream Cache Control
+
+Upstream cache control refers to the caching of API responses based on instructions provided by the upstream service. This allows the upstream service to have control over which responses are cached and for how long and can be used to perform caching of traditionally "non-safe" requests. The upstream service controls the cache using parameters in the response header.
+
+This approach gives the most granular control as it will also only cache responses based on the request method.
+
+For example, if you only want to cache requests made with the `OPTIONS` method, you can configure the upstream cache control accordingly and return cache control headers only in those responses. With this configuration, Tyk will cache only those responses, not those for other methods for the same path.
+
+Upstream cache control is configured on a per-API and per-endpoint basis, giving maximum flexibility. All configuration is performed within the API definition.
+
+### Enabling upstream cache control for an API
+
+To set up upstream cache control, you must configure `cache_options` in the API definition as follows:
+ - first enable the Tyk cache (using `enable_cache`)
+ - ensure that global/safe request caching is disabled (`cache_all_safe_requests` is set to `false`)
+ - set `enable_upstream_cache_control` to `true`
+ - add the endpoints to be cached to the list in `extended_paths.cache`
+
+For example, to enable upstream cache control for the `/ip` endpoint (path) of your API you would add the following to the API definition:
+
+```
+"cache_options": {
+  "enable_cache": true,
+  "cache_all_safe_requests": false,
+  "enable_upstream_cache_control": true,
+  "extended_paths": {
+     "cache": [
+         "ip"
+     ]
+  }
+}
+```
+
+If you are using Tyk Dashboard, you can configure these settings within the Advanced Settings section of the API Designer. You should select **Enable upstream cache control** and deselect **Global cache**, then follow the steps for per-path caching.
+
+### Operating cache control from the upstream server
+
+When upstream cache control is configured, the Gateway will check the response from the upstream server for the header `x-tyk-cache-action-set`:
+ - if this is provided in the response header and is set to `1` or `true` then the response will be stored in the cache
+ - if the header is empty or absent, Tyk follows its default behavior, which typically involves not caching the request, or caching only valid response codes (`cache_response_codes`)
+
+The upstream server also controls the length of time that Tyk should cache the response (Time-To-Live or TTL).
+
+Tyk looks for the header `x-tyk-cache-action-set-ttl` in the response:
+ - if this is found and has a positive integer value, the Gateway will cache the response for that many seconds
+ - if the header is not present, Tyk falls back to the value specified in `cache_options.cache_timeout`
+
+By configuring these headers in the responses from your services, you can have precise control over caching behavior.
+
+#### Using a custom TTL header key
+If you wish to use a different header value to indicate the TTL you can do so by adding the `cache_control_ttl_header` option to the API definition.
+
+For example, if you configure:
+ ```
+ "cache_options": {
+     "cache_control_ttl_header": "x-expire"
+ }
+ ```
+
+and also send `x-expire: 30` in the response header, Tyk will cache that specific response for 30 seconds.
+
+
+
+## Invalidating the Cache
+
+The cache for an API can be invalidated (or flushed) to force the creation of a new cache entry before the cache’s normal expiry.
+
+This is achieved by calling one of the dedicated cache invalidation API endpoints. There is a cache invalidation endpoint in both the Tyk Dashboard API and Tyk Gateway API; the URLs differ slightly, but they have the same effect.
+
+For Dashboard-managed deployments, it’s recommended to call the Dashboard API version, as this will handle the delivery of the message to all Gateways in the cluster.
+
+Caches are cleared on per-API basis, so the request to the invalidation endpoint must include the ID of the API in the path.
+
+For example, with the Tyk Gateway API:
+
+```
+DELETE /tyk/cache/{api-id}
+```
+
+and with the Tyk Dashboard API:
+
+```
+DELETE /api/cache/{api-id}
+```
+
+Note that prior to Tyk version 3.0.9 and 4.0, this was not supported on MDCB Data Plane gateways.
+
+
+<Note>
+Cache invalidation is performed at the API level, so all cache entries for the API will be flushed.
+</Note>
+
+
+## Optimizing the Cache Storage
+
+Tyk creates the API cache in Redis, as it gives high performance and low latency. By default, the cache will use the same database that is used to store the API keys, minimizing the deployment footprint.
+
+For [multi-data center](/api-management/mdcb#redis) deployments, the Data Planes have a locally deployed Redis. This enables them to have a localised cache close to the traffic-serving Gateways.
+
+The [cache key](/api-management/response-caching#cache-key) is used as the Redis key, for quick lookups.
+
+For high-traffic systems that make heavy use of caching, it can make sense to use separate Redis databases for cache storage and for API keys, at the expense of increased deployment footprint.
+
+### Configuring a separate cache
+To enable a separate cache server, you must deploy additional Redis instance(s) and apply additional configuration within your Tyk Gateway's `tyk.conf` configuration file.
+
+You must
+ - set `enable_separate_cache_store` to `true`
+ - provide additional Redis connection information in the `cache_storage` section
+
+For example:
+```json
+{
+"enable_separate_cache_store": true,
+"cache_storage": {
+  "type": "redis",
+  "host": "",
+  "port": 0,
+  "addrs": [
+      "localhost:6379"
+  ],
+  "username": "",
+  "password": "",
+  "database": 0,
+  "optimisation_max_idle": 3000,
+  "optimisation_max_active": 5000,
+  "enable_cluster": false
+  }
+}
+```
+
+The configuration of the separate Redis Cache is the same (and uses the same underlying driver) as the regular configuration, so [Redis Cluster](/tyk-configuration-reference/redis-cluster-sentinel#configure-redis-cluster) is fully supported. If you set `enable_cluster` to `false`, you only need to set one entry in `addrs`.
+
+
+<Note>
+Prior to Tyk Gateway v2.9.3, `hosts` was used instead of `addrs`; since v2.9.3 `hosts` has been deprecated.
+</Note>
+
+
diff --git a/api-management/routing-traffic/overview.mdx b/api-management/routing-traffic/overview.mdx
new file mode 100644
index 0000000000..5820ef0c2f
--- /dev/null
+++ b/api-management/routing-traffic/overview.mdx
@@ -0,0 +1,81 @@
+---
+title: "Routing Traffic"
+description: "Learn how Tyk Gateway routes incoming requests to their destinations"
+keywords: "routing, traffic routing, request matching, request forwarding, internal routing"
+sidebarTitle: "Overview"
+---
+
+Tyk Gateway sits between clients and upstream services, receiving every API request and deciding where it goes. This section covers the mechanisms that control those decisions: how Tyk identifies which API and endpoint owns a request, where it sends the matched request, and what happens when the standard request-response flow needs to be modified or bypassed.
+
+## The Request Journey
+
+{/*
+  **DIAGRAM REQUEST: "The Tyk Request Journey"**
+
+  Purpose: Show how a request moves through Tyk's routing pipeline,
+  including the three possible exit paths and the internal routing loop.
+
+  Structure (top to bottom, with one loop):
+
+    Client
+      ↓
+    Matching
+    (listen path → API, URL pattern → endpoint)
+      ↓
+    Path Modification?  ──── No ────┐
+      ↓ Yes                         │
+    URL Rewrite                     │
+      └─────────────────────────────┘
+      ↓
+    Route to... (three branches)
+      ├── External Upstream
+      │     ↓
+      │   Load Balancing / Service Discovery
+      │     ↓
+      │   Upstream Service → Client
+      │
+      ├── Internal Target (tyk://)
+      │     └── Arrow curves back up to "Matching"
+      │         Label this arc: "Re-enters pipeline on target API"
+      │
+      └── Gateway Response
+            ↓
+          Client (no upstream reached)
+
+  Design notes:
+  - Use three visually distinct colours for the three exit branches
+    (External Upstream, Internal Target, Gateway Response)
+  - The Internal Target arc looping back to Matching is the most
+    important visual element — it should be prominent and clearly labelled
+    to show the request re-enters the full pipeline, not just jumps to an endpoint
+  - Path Modification is a bypass, not a required stage — show it as
+    an optional detour rather than a mandatory box
+  - "Client" appears at both the top (origin) and bottom (response receipt)
+    to bookend the journey
+  - Keep labels concise — the bold stage names in the text below
+    correspond directly to the boxes in this diagram
+*/}
+
+A request arriving at Tyk passes through a sequence of routing stages.
+
+**[Matching](/getting-started/key-concepts/url-matching):** Tyk compares the incoming request against all configured APIs to find the one whose listen path matches the
+request URL. Within that API, it identifies the endpoint whose path pattern matches. No further processing occurs until a
+match is found.
+
+**[Forwarding](/planning-for-production/ensure-high-availability/load-balancing):** Tyk forwards the matched request to the configured upstream target. Where multiple targets are configured,
+load balancing distributes traffic across them. Where upstream addresses are dynamic, [service discovery](/planning-for-production/ensure-high-availability/service-discovery) resolves the current
+target at request time.
+
+**[Path Modification](/transform-traffic/url-rewriting):** Before forwarding, the request path can be rewritten. This handles cases where the path a client
+sends differs from the path the upstream expects, or where request content should determine the destination.
+
+**[Internal Routing](/advanced-configuration/transform-traffic/looping):** Rather than forwarding to an external upstream, a request can be routed to another API or endpoint
+within the same Tyk instance using the `tyk://` addressing scheme. This enables multi-step processing pipelines that stay
+entirely inside the gateway.
+
+**[Request Termination](/api-management/traffic-transformation/mock-response):** Some requests are handled entirely by the gateway and never reach an upstream. A mock response, for
+example, returns a pre-configured static payload directly to the client.
+
+## Protocol Support
+
+The stages above apply to all traffic Tyk handles. Where behavior differs for [gRPC](/key-concepts/grpc-proxy), [WebSocket](/advanced-configuration/websockets), [Server-Sent Events](/advanced-configuration/sse-proxy), or [TCP](/key-concepts/tcp-proxy) traffic, the relevant page notes the difference.
diff --git a/api-management/security-best-practices.mdx b/api-management/security-best-practices.mdx
new file mode 100644
index 0000000000..931c3ca0e0
--- /dev/null
+++ b/api-management/security-best-practices.mdx
@@ -0,0 +1,418 @@
+---
+title: "Security Best Practices"
+description: "Guide on API management and security best practices, including authentication, authorization, resource protection, governance, and OWASP threat mitigation with Tyk."
+keywords: "OWASP, Security, Top Ten, API Management best practice, API Security, Authentication, Security, Configuration, SSL, Certificates, Authentication, Authorization, API security, API Gateway Security"
+sidebarTitle: "Security Best Practices"
+---
+
+## Overview
+
+This section serves as a detailed resource for understanding key concepts and tools related to API security. It provides explanations of critical practices such as authentication, authorization, and governance, offering insights into how these concepts work and why they matter. Whether you're looking to mitigate threats identified by the [OWASP API Security Top 10](https://owasp.org/API-Security/editions/2023/en/0x00-header/) or to configure your APIs for better resilience, this page breaks down the essentials.
+
+Two of the most prevalent topics are [authentication](#authentication) and [authorization](#authorization), which occupy four of the top five positions. These are critical elements of API security, which verify the identity of API clients and control what they’re able to do. Alongside these are a number of other beneficial topics that are also within the remit of API management, all of which will be covered in this section. These include:
+
+- [Governance](#governing-apis-effectively)
+- [Configuration](#configuration-best-practices)
+- [Resource Consumption](#managing-api-resources)
+
+## Mitigating The Top 10 OWASP Threats 
+
+The Open Web Application Security Project (OWASP) provides a top ten threat awareness document compiled by security experts. For more details on the OWASP project visit [https://www.owasp.org](https://www.owasp.org). Below are the top ten threats and how Tyk guards against them. For further details please visit our [blog](https://tyk.io/blog/res-owasp-api-security-intro/)
+
+##### 1 - Broken Object Level Authorization (BOLA)
+
+Broken Object Level Authorization (BOLA) can occur due to a lack of access control to API resources. This vulnerability allows attackers to manipulate or bypass authorization mechanisms, typically by tampering with resource identifiers to gain unauthorized access to specific resources or data. BOLA is a critical security concern as it can lead to data breaches and unauthorized actions within a system.
+
+It is the responsibility of the API to handle this form of attack since it can access and understand the data needed to make authorization decisions on individual objects within the application database.
+
+##### 2 - Broken Authentication
+
+Authentication is a vital aspect of API security. Failure to do so, as noted by OWASP, leads to *Broken Authentication* posing a significant risk to both API providers and data.
+
+Tyk provides the following features and authentication mechanisms:
+-  Prioritize secure methods, like [mutual TLS](/api-management/implement-tls#secure-hosted-apis-with-mtls), over [basic authentication](/api-management/authentication/basic-authentication) wherever feasible.
+- API owners can integrate external Identity Providers (IdPs) supporting methods like [OpenID Connect](/api-management/client-authentication#integrate-with-openid-connect-deprecated), [OAuth 2.0](/api-management/authentication/oauth-2#using-the-authorization-code-grant) or [JSON Web Tokens](/basic-config-and-security/security/authentication-authorization/json-web-tokens).
+- [Single Sign-On](/tyk-identity-broker/dashboard-sso) can be used for a centralized and trusted authentication source. API operators can choose from common authentication methods such as OAuth 2.0, LDAP, and SAML.
+- [Dynamic Client Registration](/tyk-developer-portal/tyk-portal-classic/dynamic-client-registration#oauth-2-0-dynamic-client-registration-protocol-dcr), enables third-party authorization servers to issue client credentials via the Tyk Developer Portal. This streamlines Identity Management, eliminating the need to manage credentials across multiple systems.
+- Tyk's default authentication setup disallows credentials in URLs, reducing the risk of inadvertent exposure through backend logs.
+- Tyk Gateway can be configured to enforce a [minimum TLS version](/api-management/certificates#tls-or-ssl), enhancing security by blocking outdated and insecure TLS versions.
+
+##### 3 - Broken Object Property Level Authorization (BOPLA)
+
+REST APIs provide endpoints that return all properties of an object in the reponse, some of which could contain sensitive data. Conversely, GraphQL API requests allow the clients to specify which properties of an object should be retrieved.
+
+From a REST API perspespective, it is the responsibility of the API to ensure that the correct data is retrieved. The Gateway can provide additional security measures as follows:
+- [Body transformation plugins](/api-management/traffic-transformation/request-method) can be used to remove sensitive data from the response if the API is unable to do so itself.
+- [JSON Schema validation](/api-management/traffic-transformation/request-validation#request-validation-using-classic) to validate that an incoming data payload meets a defined schema. Payloads that do not adhere to the schema are rejected.
+
+For GraphQL APIs, the gateway can be used to define the GraphQL schemas, limiting which properties of an object are queryable. Furthermore, access can be controlled to specific properties by configuring [field-based permissions](/api-management/graphql#field-based-permissions). Subsequently, the visiblity of a schema's properties can be controlled for different consumers of the GraphQL API.
+
+
+##### 4 - Unrestricted Resource Consumption
+
+APIs can become overwhelmed if the resources upon which they rely are fully consumed. In such situations, an API can no longer operate, and will no longer be able to service requests, or potentially even be unable to complete those currently in progress.
+
+As an APIM product, Tyk Gateway can be configured to use the following out-of-the-box functionality when handling API traffic for legitimate users:
+
+- [Circuit breaker](/planning-for-production/ensure-high-availability/circuit-breakers)
+- [Payload size limiter](/api-management/traffic-transformation/request-size-limits)
+- [Rate limiter / throttling](/api-management/rate-limit#introduction)
+- [Caching](/api-management/response-caching)
+- [Enforced timeout](/planning-for-production/ensure-high-availability/enforced-timeouts)
+- [IP restriction](/api-management/gateway-config-tyk-classic#ip-access-control)
+- [GraphQL query complexity limiting](/api-management/graphql#complexity-limiting-1)
+
+For Denial of Service (DoS) attacks it is recommended to use specialist 3rd party services to prevent DoS attacks from reaching your infrastructure.
+
+##### 5 - Broken Function Level Authorization (BFLA)
+
+To prevent Broken Functional Level Authorization (BFLA), requests to REST API endpoints must be authorized correctly. This involves validating client permissions against the requested resources. Requests from clients with insufficient permissions must be rejected.
+
+Tyk offers several measures to assist with protection from BFLA threats:
+
+- *Establish path-based access rights*: [Policies](/api-management/policies) are predefined sets of rules which grant access to particular APIs. These can include [path-based permissions](/api-management/access-control/sessions-and-keys/access-rights#granular-endpoint-access), which restrict access to particular paths and methods within an API. Clients can be assigned one or more policies which the Gateway will validate when it receives a request.
+- *Access Control*: Tyk has plugins that control access to API endpoints. They are known as [allowlist](/api-management/traffic-transformation/allow-list#api-definition) and [blocklist](/api-management/traffic-transformation/block-list#api-designer) and can be configured via the Endpoint Designer of an API Definition. Both plugins grant and deny access to API paths and methods, but do so in different ways, which makes them mutually exclusive. When the allowlist plugin is used, only the marked paths and methods are allowed, all other paths and methods are blocked. This can be perceived as *deny by default* since it provides the least privileges. The reverse is true for the blocklist plugin, only the paths and methods marked as blocklist are blocked, all other paths and methods are allowed. It is recommended to use the *allowlist* approach, since it is the most restrictive, only allowing marked endpoint paths and paths.
+- *CORS*: This [functionality](/api-management/gateway-config-tyk-classic#cross-origin-resource-sharing-cors) allows the Tyk Gateway to limit API access to particular browser-based consumers.
+
+##### 6 - Unrestricted Access To Sensitive Business Flows
+
+This involves attackers understanding an API's business model, identifying sensitive business processes and automating unauthorized access to these processes. This can disrupt business operations by preventing legitimate users from making purchases for example. Attackers manually locate target resources and work to bypass any existing mitigation measures.
+
+These business flows are application specific, being unique to the API's backend systems. Subsequently, the API owner is responsible for addressing the security issues posed by this threat. Furthermore, to discover points of exploitation and test IT security breaches, pentesting is recommended.
+
+The APIM can be used to protect sensitive endpoints using authentication and authorization. Tyk recommends considering splitting Admin APIs from client facing APIs. This allows authentication and authorization checks to be defined and managed by different governance models, thus establishing clear role models.
+
+Furthermore, the APIM can validate authentication and authorization by scope to ensure that the client has the correct credentials before the upstream API processes the request.
+
+##### 7 - Server Side Request Forgery (SSRF)
+
+Server Side Request Forgery (SSRF) is a security vulnerability in web applications where an attacker can manipulate a server to make unauthorized requests to internal or external resources, potentially leading to data leaks or remote code execution. This can allow an attacker to probe or attack other parts of the application's infrastructure, potentially compromising sensitive information and systems.
+
+This is application specific and is largely the responsibility of the API. However, Tyk Gateway can assist with this form of attack through [JSON schema validation](/api-management/traffic-transformation/request-validation#request-validation-using-classic) for incoming payloads. For example, a schema could contain a regular expression to reject localhost URLs. These URLs could be used by an attacker to perform port scanning for example.
+
+##### 8 - Security Misconfiguration
+
+Tyk offers several mechanisms to help protect an API from Security Misconfiguration exploits:
+
+- Use [response header manipulation](/api-management/traffic-transformation/response-headers) to remove or modify API sensitive information.
+- Use [response body manipulation](/api-management/traffic-transformation/response-body) to remove or modify parts containing sensitive information.
+- [TLS](/api-management/certificates) to ensure that clients use the right service and encrypt traffic.
+- [Mutual TLS](/api-management/implement-tls#secure-hosted-apis-with-mtls) with both the clients and API to ensure that callers with explicitly allowed client certificates can connect to the endpoints.
+- [Error Customization](/api-management/custom-error-responses) can be used to return a response body based on status code and content type. This can help minimize the implementation details returned to the client.
+- [CORS functionality](/api-management/gateway-config-tyk-classic#cross-origin-resource-sharing-cors) allows the Tyk Gateway to limit API access to particular browser-based consumers.
+- [Policy Path-Based Permissions](/api-management/access-control/sessions-and-keys/access-rights#granular-endpoint-access) and the [allowlist](/api-management/traffic-transformation/allow-list#api-definition) plugin can be used to prevent clients from accessing API endpoints using non-authorized HTTP methods. For example, blocking the use of the DELETE method on an endpoint which should only accept GET requests.
+- [Environment variables](/tyk-oss-gateway/configuration) can help standardize configuration across containerised deployments.
+- For GraphQL APIs:
+- [Schema Introspection](/api-management/graphql#introspection) ensures that the Tyk Dashboard automatically uses the schema of the upstream GraphQL API and can keep it synchronised if it changes.
+- [GraphQL Schema Validation](/api-management/graphql#schema-validation) prevents invalid schemas from being saved. This catches errors such as duplicate type names and usage of unknown types.
+- Third-party [Secret Storage](/tyk-configuration-reference/kv-store) to centralise configuration of sensitive data such as passwords. This data can then be dynamically referenced by Tyk configuration files, rather than being hard coded.
+- Users can can write their own [custom plugins](/api-management/plugins/overview#) in a variety of languages, either directly or through gRPC calls, to implement their requirements.
+
+The Ops team should also take reponsibility for monitoring the APIs for errors and patching accordingly. Regular [Penetration Tests](https://en.wikipedia.org/wiki/Penetration_test) should be scheduled to ensure the security of published services. Tyk, through our Professional Services or Partners, can assist in the process.
+
+##### 9 - Improper Inventory Management
+
+Tyk offers the following features to support improper inventory management:
+
+- [Versioning](/api-management/api-versioning) allows newer versions of APIs to coexist with the older versions, facilitating deprecation and sunsetting.
+- [Sunsetting](/api-management/api-versioning#sunsetting-api-versions) allows versions to be configured with an Expiry Time, ensuring that a version is not accessible after the expiry date.
+- [Key expiry](/api-management/access-control/sessions-and-keys/session-lifecycle) ensures that access to an API is short lived, with a per key configurable Time to Live (TTL) for which a token remains valid before it expires. The implementation of key expiry, with a configurable Time To Live (TTL), mitigates the impact of compromised tokens by narrowing the window of vulnerability. Setting a TTL reduces the time frame during which a compromised token could be exploited, enhancing overall security.
+- Tyk Developer Portal catalogs APIs and facilitates granting access to them.  Integrated with a CMDB it can help keep documentation updated.
+- [Tyk Analytics](/api-management/dashboard-analytics#traffic-analytics) can help identify the stagnant APIs and used stale APIs.
+- [Tyk Pump](/api-management/tyk-pump) can ship metrics needed for analytics into Tyk Dashboard and other systems.
+- Third-party [Secret Storage](/tyk-configuration-reference/kv-store) can be used to centralise and protect sensitive configuration data such as passwords, rather than exposing them as plain text in Tyk configuration files.
+
+In addition, it is best practice to consider any definition of done to include corresponding documentation updates.
+
+##### 10 - Unsafe Consumption Of APIs
+
+Attackers may identify and target the third party APIs/services used by an API. This can lead to leaked sensitive information, denial of service, injection attacks etc.
+
+It is the responsibility of the API to provide protection against these attacks. However, if the organization uses the Gateway as a forwarding proxy to third party APIs, then the following features could be used:
+
+- [JSON Schema validation](/api-management/traffic-transformation/request-validation#request-validation-using-classic) to validate that an incoming data payload meets a defined schema. Payloads that do not adhere to the schema are rejected.
+- [Versioning](/api-management/api-versioning) allows newer versions of third party APIs to coexist with the older versions, facilitating deprecation and sunsetting.
+- [TLS](/api-management/certificates) to ensure that clients use the right service and encrypt traffic.
+
+
+## Managing Authentication and Authorization
+
+### Authentication
+
+Authentication is the process of identifying API clients. It’s a broad topic, with many approaches to choose from. Choosing the right approach is important, as it forms a fundamental part of the overall security strategy. The decision depends on many risk factors; users, functionality, data, accessibility and compliance, to name just a few. While there isn’t necessarily a single, correct choice, it’s usually safe to assume that some form of authentication is needed, as it’s a crucial prerequisite in performing subsequent identity-based authorization checks.
+
+**Implement Appropriate Authentication**
+
+Choose a suitable authentication approach based on the risk profile of the API. Is it publicly accessible or internal? Does it require user interaction or is it machine to machine? How sensitive is the data and functionality provided by the API? Simplistic approaches, such as [Auth Tokens](/api-management/authentication/bearer-token), can work for low risk, basic APIs, but for higher risk or more sophisticated APIs, it may be more appropriate to use a standards-based approach such as [OAuth 2.0](/api-management/authentication/oauth-2) or [OpenID Connect](/api-management/client-authentication#integrate-with-openid-connect-deprecated). Furthermore, using an [external identity provider](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated) can deliver additional benefits, such as [single sign-on](/tyk-identity-broker/dashboard-sso), as well as multi-factor authentication approaches such as [biometric verification](https://www.okta.com/identity-101/biometrics-secure-authentication).
+
+**Handle Data Securely**
+
+Don’t undermine the authentication process by leaking sensitive authentication data. Use [transport layer security](/api-management/certificates) and hashing to prevent credentials from being intercepted and stolen through insecure transmission and storage. These principles also apply to upstream requests made by the gateway and upstream API to other APIs and services.
+
+**Enforce Good Practices**
+
+
+Establish rules that reduce risk and enhance overall system security. Use [password policies](/platform-management/dashboard-users#password-policy) to prevent the use of weak passwords, and [TLS policies](/api-management/certificates#tls-or-ssl) to prevent the use of older TLS versions that are now deprecated and considered vulnerable.
+
+**Protect Sensitive Endpoints**
+
+Reduce susceptibility of sensitive endpoints to brute force dictionary or password stuffing attacks. The typical target for this type of attack are endpoints that use credentials, such as login and password recovery. Unfortunately, anonymous access is required for these endpoints, so authentication cannot be used to protect them, so the best approach is to hinder access by using techniques such as [rate limiting](/api-management/rate-limit#rate-limiting-layers), [captcha](https://en.wikipedia.org/wiki/CAPTCHA) and one-time URLs.
+
+
+### Authorization 
+Authorization is the process of validating API client requests against the access rights they have been granted, ensuring that the requests comply with any imposed limitations. It’s the most prevalent topic on the OWASP list, with three entries covering different levels of authorization.
+
+Almost any part of a request can be scrutinised as part of authorization, but choosing the best approach depends on the type of API. For example, with REST APIs, the requested method and path are good candidates, but they aren’t relevant for GraphQL APIs, which should focus on the GraphQL query instead.
+
+Authorization can be a complex process that occurs at multiple locations throughout the request lifecycle. For example, a gateway can use access control policies to determine whether a required path is acceptable. But for decisions based on object data, such as when a client requests a particular record from the database, it’s the API that’s best positioned, as only it has access to the necessary data. For more information about the authorization process, see Authorization Levels in the appendix.
+
+#### Split Authorization
+
+Implement authorization in the best locations across the stack. For an overview of the different authorization levels across the stack please visit this [page](#managing-authorization-levels). Use the gateway to handle general API authorization related to hosts, methods, paths and properties. This leaves the API to handle the finer details of object-level authorization. In terms of OWASPs authorization categories, it can be split as follows:
+
+##### Object Level Authorization
+
+Handle with the API. It can access and understand the data needed to make authorization decisions on individual objects within its database.
+
+##### Object Property Level Authorization
+
+Handle with both the API and the gateway. The approach depends on the type of API:
+
+For REST APIs, it’s the API that’s primarily responsible for returning the correct data. To complement this, the gateway can use [body transforms](/api-management/traffic-transformation/response-body) to remove sensitive data from responses if the API is unable to do so itself. The gateway can also enforce object property-level restrictions using [JSON validation](/api-management/traffic-transformation/request-validation#request-validation-using-classic), for scenarios where the client is sending data to the API.
+
+For GraphQL APIs, use the gateway to define [GraphQL schemas](/api-management/graphql#managing-gql-schema) to limit which properties are queryable, then optionally use [field-based permissions](/api-management/graphql#field-based-permission) to also specify access rights to those properties. 
+
+##### Function Level Authorization
+
+Handle with the gateway. Use [Policies](/api-management/policies), [path-based permissions](/api-management/access-control/sessions-and-keys/access-rights#granular-endpoint-access), [allow lists](/api-management/traffic-transformation/allow-list#api-definition) and [block lists](/api-management/traffic-transformation/block-list#api-designer) to manage authorization of hosts and paths.
+
+#### Assign Least Privileges
+
+Design [Policies](/api-management/policies) that contain the least privileges necessary for users to achieve the workflows supported by the API. By favoring specific, granular access over broad access, this enables user groups and use cases to be addressed directly, as opposed to broad policies that cover multiple use cases and expose functionality unnecessarily.
+
+##### Deny by Default
+
+Favor use of [allow lists](/api-management/traffic-transformation/allow-list#api-definition) to explicitly allow endpoints access, rather than [block lists](/api-management/traffic-transformation/block-list#api-designer) to explicitly deny. This approach prevents new API endpoints from being accessible by default, as the presence of other, allowed endpoints means that access to them is implicitly denied.
+
+##### Validate and Control All User Input
+
+Protect APIs from erroneous or malicious data by validating all input before it’s processed by the API. Bad data, whether malicious or not, can cause many problems for APIs, from basic errors and bad user experience, to data leaks and downtime. The standard mitigation approach is to validate all user input, for which there are various solutions depending on the type of API:
+
+For REST APIs, use [schema validation](/api-management/graphql#schema-validation) to control acceptable input data values.
+
+For GraphQL APIs, use [GraphQL schema](/api-management/graphql#managing-gql-schema) definitions to limit what data can be queried and mutated. Additionally, [complexity limiting](/api-management/graphql#complexity-limiting-1) can be used to block resource-intensive queries.
+
+#### Track Anomalies
+
+Use [log aggregation](/api-management/logs#log-output) and [event triggers](/api-management/gateway-events#event-categories) to push data generated by application logs and events into centralised monitoring and reporting systems. This real-time data stream can be used to highlight application issues and security-related events, such as authentication and authorization failures.
+
+##### Understand System State
+
+Perform application performance monitoring by capturing gateway [instrumentation data](/api-management/logs-metrics#statsd-instrumentation). This enables the current system state, such as requests per second and response time, to be monitored and alerted upon.
+
+##### Manage Cross-Origin Resource Sharing
+
+Use [CORS filtering](/api-management/gateway-config-tyk-classic#cross-origin-resource-sharing-cors) to control the resources accessible by browser-based clients. This is a necessity for APIs that expect to be consumed by external websites.
+
+
+### Managing Authorization Levels
+
+This section provides basic examples of where different authorization levels occur in the API management stack. The accompanying diagrams use color-coding to show links between request element and the associated authorization locations and methods.
+
+This is how OWASP describe the attack vectors for the three authorization levels:
+
+**Object Level Authorization**: “Attackers can exploit API endpoints that are vulnerable to broken object-level authorization by manipulating the ID of an object that is sent within the request. Object IDs can be anything from sequential integers, UUIDs, or generic strings. Regardless of the data type, they are easy to identify in the request target (path or query string parameters), request headers, or even as part of the request payload.” (source: [OWASP Github](https://github.com/OWASP/API-Security/blob/9c9a808215fcbebda9f657c12f3e572371697eb2/editions/2023/en/0xa1-broken-object-level-authorization.md))
+
+**Object Property Level Authorization**: “APIs tend to expose endpoints that return all object’s properties. This is particularly valid for REST APIs. For other protocols such as GraphQL, it may require crafted requests to specify which properties should be returned. Identifying these additional properties that can be manipulated requires more effort, but there are a few automated tools available to assist in this task.” (source: [OWASP Github](https://github.com/OWASP/API-Security/blob/9c9a808215fcbebda9f657c12f3e572371697eb2/editions/2023/en/0xa3-broken-object-property-level-authorization.md))
+
+**Function Level Authorization**: “Exploitation requires the attacker to send legitimate API calls to an API endpoint that they should not have access to as anonymous users or regular, non-privileged users. Exposed endpoints will be easily exploited.” (source: [OWASP Github](https://github.com/OWASP/API-Security/blob/9c9a808215fcbebda9f657c12f3e572371697eb2/editions/2023/en/0xa3-broken-object-property-level-authorization.md))
+
+
+#### REST API - Reading Data
+
+<img src="/img/api-management/security/rest-api-read-data.jpeg" alt="Rest API - Read Data" width="150px" />
+
+The client sends a `GET` request using the path `/profile/1`. This path has two parts:
+
+1. `/profile/`: The resource type, which is static for all requests related to profile objects. This requires function level authorization.
+
+2. `1`: The resource reference, which is dynamic and depends on the profile is being requested. This requires object level authorization.
+
+Next, the gateway handles function level authorization by checking that the static part of the path, in this case `/profile/`, is authorized for access. It does this by cross referencing the security policies connected to the API key provided in the `authorization` header.
+
+The gateway ignores the dynamic part of the part of the path, in this case `1`, as it doesn't have access to the necessary object-level data to make an authorization decision for this.
+
+Lastly, the API handles object level authorization by using custom logic. This typically involves using the value of the `authorization` header in combination with the ownership and authorization model specific to the API to determine if the client is authorized to read is requested record.
+
+#### REST API - Writing Data
+
+<img src="/img/api-management/security/rest-api-write-data.jpeg" alt="Rest API - Write Data" width="150px" />
+
+The client sends a `POST` request using the path `/profile` and body data containing the object to write. The path `/profile` is static and requires function level authorization. The body data contains a JSON object that has two fields:
+
+1. `name`: A standard object field. This requires object property authorization.
+
+2. `id`: An object identifier field that refers to the identity of an object, so needs to be treated differently. As such, it requires both object property authorization, like name, and also object authorization.
+
+Next, the gateway handles function level authorization, by checking that the path, in the case `/profile`, is authorized for access. It does this by cross referencing the security policies connected to the API key provided in the `authorization` header.
+
+The gateway can also perform object property level authorization, by validating that the values of the body data fields, `name` and `id`, conform to a schema.
+
+Lastly, the API handles object level authorization by using custom logic. This typically involves using the value of the `authorization` header in combination with the ownership and authorization model specific to the API to determine if the client is authorized to write the requested data.
+
+#### GraphQL API - Querying Data
+
+<img src="/img/api-management/security/graphql-query-data.jpeg" alt="Rest API - Write Data" width="150px" />
+
+The client sends a `POST` request using the path `/graphql` and body data containing a GraphQL query. The path `/graphql` is static and requires function level authorization. The GraphQL query contains several elements:
+
+- `profile`: An object type, referring to the type of object being requested. This requires object property authorization.
+- `id`: An object identifier field that refers to the identity of an object, so needs to be treated differently. As such, it requires both object property authorization, like name, and also object authorization.
+- `name`: A standard object field, referring to a property of the profile object type. This requires object property authorization.
+
+Next, the Gateway handles function level authorization, by checking that the path, in the case `/graphql`, is authorized for access. It does this by cross referencing the security policies connected to the API key provided in the `authorization` header. Due to the nature of GraphQL using just a single endpoint, there is no need for additional path-based authorization features, only a basic security policy is required.
+
+Another difference between this and the REST examples is in the way that the body data is authorized:
+
+- All object types and fields contained in the query are checked against the API’s GraphQL schema, to ensure they are valid. In this case, the object type is `profile`, and the fields are `id` and `name`. The schema defined in the gateway configuration can differ from that in the upstream API, which enables fields to be restricted by default.
+- Field-based permissions can also be used, to authorize client access of individual fields available in the schema. In this case, `id` and `name`.
+
+Lastly, the API handles object level authorization by using custom logic. This typically involves using the value of the `authorization` header in combination with the ownership and authorization model specific to the API to determine if the client is authorized to access the requested data. This can be more complicated for GraphQL APIs, as the data presented by the schema may actually come from several different data sources.
+
+## Managing API Resources
+
+Excessive resource consumption poses a risk to APIs. As the number of concurrent requests handled by a server increases, so too does its consumption of CPU, RAM and storage resources. Should any of these become depleted, then the quality of service offered by applications running on the server will rapidly decline, and may even lead to their complete failure.
+
+This issue can be caused by both legitimate consumers and malicious attackers, but they are different situations that require different solutions. For legitimate consumers, solutions should be focused on controlling API utilization through the gateway, to keep usage within agreed or desired limits. But malicious attackers require a different approach, as denial of service attacks must be blocked as far as possible from the core API infrastructure.
+
+**Restrict Request Flows**: Use [rate limits](/api-management/rate-limit#rate-limiting-layers) and [quotas](/api-management/request-quotas) to prevent excessive API usage. Rate limits are best used for short term control, in the range of seconds. Whereas quotas are more suited to longer terms, in the range of days, weeks or beyond. [Throttling](/api-management/request-throttling) can also be used as a type of enhanced rate limiter that queues and retries requests on the clients behalf, rather than immediately rejecting them.
+
+**Block Excessively Large Requests**: Place reasonable [limitations on payload sizes](/api-management/traffic-transformation/request-size-limits) to prevent oversized requests from reaching upstream servers, thereby avoiding the unnecessary consumption of resources.
+
+**Avoid Unnecessary Resource Usage**: Appropriate use of [caching](/api-management/response-caching) can reduce server resource consumption by simply returning cached responses instead of generating new ones. The extent to which caching can be used depends on the purpose of the endpoint, as it’s generally unsuitable for requests that modify data or responses that frequently change. Caching can be applied to [particular requests](/api-management/response-caching#endpoint-caching) or enabled for an [entire API](/api-management/response-caching#basic-caching), and can also be [controlled by the upstream API](/api-management/response-caching#upstream-cache-control-1) or [invalidated programmatically](/api-management/troubleshooting-debugging#how-to-clear-%2F-invalidate-api-cache).
+
+**Limit Complex Long-Running Tasks**: Use [GraphQL complexity limiting](/api-management/graphql#complexity-limiting-1) to prevent convoluted queries from being processed. Alternatively, [timeouts](/planning-for-production/ensure-high-availability/enforced-timeouts) can be used to terminate long-running requests that exceed a given time limit.
+
+**Protect Failing Services**: Defend struggling endpoints by using a [circuit breaker](/planning-for-production/ensure-high-availability/circuit-breakers). This feature protects endpoints by detecting error responses, then blocking requests for a short duration to allow them to recover. The same principle can be applied in a wider sense by using [uptime tests](/api-management/gateway-config-tyk-classic#uptime-tests), though this works on a host level instead, by removing failed hosts from the gateway load balancer.
+
+**Enforce Network-Level Security**: Problematic clients can be prevented from accessing the API by [blocking their address](/api-management/gateway-config-tyk-classic#ip-access-control). Conversely, for APIs with a known set of clients, [allow lists](/api-management/gateway-config-tyk-classic#ip-access-control) can be used to create a list of allowed addresses, thereby implicitly blocking every other address from the API.
+
+**Mitigate DoS Attacks**: Increase the chance of maintaining API availability during a denial of service attack by using [specialist mitigation services](https://www.cloudflare.com). These have the infrastructure capacity needed to handle [large scale distributed attacks](https://www.cloudflare.com/en-gb/learning/ddos/what-is-a-ddos-attack), with the purpose of preventing attacks from reaching the API infrastructure, thereby enabling the API to continue operating normally.
+
+
+## Configuration Best Practices
+
+Modern APIs are often backed by large technology stacks composed of numerous components and libraries. Each of these is a potential weak link in the security chain, so efforts must be made to ensure that security measures are implemented throughout. The API gateway plays a critical part in an overall security strategy, by utilizing its ability to process requests in a secure manner.
+
+**Secure Connections**
+
+
+Use [transport layer security](/api-management/certificates) where possible. Most importantly, on inbound connections to the gateway and outbound connection from the gateway to the upstream API and other services. TLS can also be used as a form of authentication, using [Mutual TLS](/api-management/implement-tls#secure-hosted-apis-with-mtls).
+
+**Limit Functionality**
+
+
+Use [Policies](/api-management/policies) to specify which paths, methods and schemas are accessible, whilst blocking all others.
+
+**Mitigate Server-Side Request Forgery**
+
+
+Restrict any URL-based input data to specific schemas, hosts and paths by using [schema validation](/api-management/graphql#schema-validation). When data is fetched server-side, it should be validated and not returned to the client in raw format.
+
+**Protect Secrets**
+
+
+Prevent sensitive data, such as usernames, passwords, license keys and other secrets, from being stored as plain text in application configuration files. Use [key value secret storage](/tyk-configuration-reference/kv-store) to dynamically load sensitive data from a secure secret manager.
+
+**Sanitise Responses**
+
+
+Modify or remove sensitive data from responses by using [transforms](/api-management/traffic-transformation) to alter the [response headers](/api-management/traffic-transformation/response-headers) and [body](/api-management/traffic-transformation/response-body).
+
+<a id="sign-payloads"></a>
+
+**Sign payloads between the Dashboard and Gateway**
+
+
+Using payload signatures for the communication between Tyk Gateway and Tyk Dashboard is strongly recommended as an additional security measure, particularly in production environments.
+
+Enable payload signatures in the Gateway configuration (`tyk.conf` or environment variable) by setting `allow_insecure_configs` to `false` and then provide the public key (certificate) to the Gateway in the `public_key_path`.
+
+You'll need to provide the private key to the Dashboard using the `private_key_path` option in the appropriate configuration (`tyk_analytics.conf` or environment variable). This will allow your Dashboard to sign all of its payloads using the private key.
+
+You can easily create a public / private keypair with:
+
+```{.copyWrapper}
+# private key
+openssl genrsa -out privkey.pem 2048
+
+# public key
+openssl rsa -in privkey.pem -pubout -out pubkey.pem
+```
+
+Make sure to keep your private key safe!
+
+<br />
+
+## Governing APIs Effectively
+
+APIs need to be managed and governed just like any other resource, otherwise organizations risk losing track of their API estate and becoming unaware of potentially vulnerable APIs running within their infrastructure. This risk is magnified as the number of teams, environments and APIs increases. Use API management as part of overarching business processes to control how APIs are accessed, managed and deployed.
+
+**Restrict Version Availability**: Enforce the expiry of [API versions](/api-management/api-versioning) that are planned for deprecation, by setting a sunset date, beyond which they will not be accessible.
+
+**Enforce Key Expiry**: In many situations it’s best to issue API keys that have a short, finite lifetime, especially when serving anonymous, external consumers. Set [expiry dates](/api-management/access-control/sessions-and-keys/session-lifecycle) for API keys, or use ephemeral credentials with complementary authentication techniques that support key renewal, such as [OAuth 2.0 refresh tokens](/api-management/authentication/oauth-2#using-refresh-tokens) and [dynamic client registration](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration). Then, should an API key fall into the wrong hands, there’s a chance that it has already expired.
+
+**Use Standardized Specifications**: Use the [OpenAPI Specification](https://en.wikipedia.org/wiki/OpenAPI_Specification) standard to design APIs. These specification documents act as a source of truth that can generate [API configuration](/api-management/gateway-config-tyk-oas) and [portal documentation](/tyk-apis/tyk-portal-api/portal-documentation#create-documentation).
+
+**Understand API Usage**: Use [API analytics](/api-management/dashboard-analytics#traffic-analytics) to report on usage. This captured data generates useful, actionable insights across a variety of metrics, such as API popularity, performance and trends.
+
+**Control API Distribution**: Use [sharding](/api-management/api-sharding#what-is-api-sharding-) to control availability of APIs across multi-gateway, multi-environment deployments. This ensures that specific APIs are only available through specific gateways, which helps to prevent undesirable situations, such as internal APIs being published to externally accessible gateways, or test API configurations reaching the production environment.
+<br />
+
+## Securing APIs with Tyk
+
+Securing your APIs is one of the primary uses of Tyk API management solution. Out of the box, the Gateway offers a lot of functionality for securing your APIs and the Gateway itself.
+
+This section outlines all of the security configurations and components that are available to you when securing your Tyk stack.
+
+This section outlines some of the key security concepts that Tyk uses and that you should be familiar with before setting up and using a Tyk stack to secure your API.
+
+**Key Hashing**
+
+
+See [Key Hashing](/api-management/access-control/sessions-and-keys/key-hashing) for details on how Tyk obfuscates keys in Redis.
+
+**TLS and SSL**
+
+
+Tyk supports TLS connections and Mutual TLS. All TLS connections also support HTTP/2. Tyk also supports Let's Encrypt. See [TLS and SSL](/api-management/certificates) for more details.
+
+**Trusted Certificates**
+
+
+As part of using Mutual TLS, you can create a list of [trusted certificates](/api-management/implement-tls#using-a-static-client-certificate-allow-list).
+
+**Certificate Pinning**
+
+
+Introduced in Tyk Gateway 2.6.0, [certificate pinning](/api-management/upstream-authentication/mtls#certificate-pinning) is a feature which allows you to allow only specified public keys used to generate certificates, so you will be protected in case an upstream certificate is compromised.
+
+**API Security**
+
+Tyk supports various ways to secure your APIs, including:
+
+* Bearer Tokens
+* HMAC
+* JSON Web Tokens (JWT)
+* Multi Chained Authentication
+* OAuth 2.0
+* OpenID Connect
+
+See [Authentication and Authorization](/api-management/client-authentication) for more details.
+
+**Security Policies**
+
+
+A Tyk security policy incorporates several security options that can be applied to an API key. These include [Partioned Policies](/api-management/access-control/policies/applying-policies#partitioned-policies) and securing by [Method and Path](/api-management/access-control/sessions-and-keys/access-rights#granular-endpoint-access).
+
+See [Access Control](/api-management/access-control/overview) for more details.
diff --git a/api-management/security-features.mdx b/api-management/security-features.mdx
new file mode 100644
index 0000000000..3993d25768
--- /dev/null
+++ b/api-management/security-features.mdx
@@ -0,0 +1,86 @@
+---
+title: "Security Features"
+description: "Learn how to configure security features in Tyk Gateway, including Cross-Origin Resource Sharing (CORS) for browser-based requests"
+keywords: "Security, security features, CORS, API Security, Cross-Origin Resource Sharing, Security, Configuration"
+sidebarTitle: "Security Features"
+---
+
+## Cross-Origin Resource Sharing (CORS)
+
+CORS (Cross-Origin Resource Sharing) is a security feature that controls how web pages from one domain (origin) can make requests to resources hosted on a different domain. With Tyk Gateway, it is possible to enable and configure CORS per-API so that users can make browser-based requests.
+
+The `CORS` section is added to an API definition as listed in the examples below for Tyk Gateway and Tyk Operator.
+
+### Examples
+
+<Tabs>
+<Tab title="Tyk Classic API Definition">
+```json
+"CORS": {
+  "enable": true,
+  "allowed_origins": [
+    "http://foo.com"
+  ],
+  "allowed_methods": [],
+  "allowed_headers": [],
+  "exposed_headers": [],
+  "allow_credentials": false,
+  "max_age": 24,
+  "options_passthrough": false,
+  "debug": false
+}
+```
+</Tab>
+<Tab title="Tyk Operator API Definition">
+```yaml {linenos=true, linenostart=1, hl_lines=["14-24"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-cors-sample
+spec:
+  name: httpbin-cors-sample
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /cors
+    strip_listen_path: true
+  CORS:
+    enable: true
+    allowed_origins:
+      - "http://foo.com"
+    allowed_methods: null
+    allowed_headers: null
+    exposed_headers: null
+    allow_credentials: false
+    max_age: 24
+    options_passthrough: false
+    debug: false
+```
+</Tab>
+</Tabs>
+
+---
+
+### Configuration
+
+The CORS middleware has the following options:
+
+* `CORS.allowed_origins`: A list of origin domains to allow access from. Wildcards are also supported, e.g. `http://*.foo.com`. Default value is `["*"]`
+
+* `CORS.allowed_methods`: A list of methods to allow access via. Default value is `["GET", "POST", "HEAD"]`
+
+* `CORS.allowed_headers`: A list of headers that are allowed within a request. Default value is `["Origin", "Accept", "Content-Type", "X-Requested-With"]`
+
+* `CORS.exposed_headers`: A list of headers that are exposed back in the response.
+
+* `CORS.allow_credentials`: Whether credentials (cookies) should be allowed.
+
+* `CORS.max_age`: Maximum age of credentials.
+
+* `CORS.options_passthrough`: allow CORS OPTIONS preflight request to be proxied directly to upstream, without authentication and rest of checks. This means that pre-flight requests generated by web-clients such as SwaggerUI or 
+the Tyk Portal documentation system will be able to test the API using trial keys. If your service handles CORS natively, then enable this option.
+
+* `debug`: If set to `true`, this option produces log files for the CORS middleware.
+
diff --git a/api-management/single-sign-on-ldap.mdx b/api-management/single-sign-on-ldap.mdx
new file mode 100644
index 0000000000..de005c09de
--- /dev/null
+++ b/api-management/single-sign-on-ldap.mdx
@@ -0,0 +1,222 @@
+---
+title: "SSO with LDAP"
+description: "Learn how to configure Single Sign-On (SSO) for Tyk Dashboard or Tyk Developer Portal using LDAP or Active Directory."
+keywords: "Tyk Identity Broker, TIB, SSO, Single Sign-On, LDAP, Active Directory, Authentication"
+sidebarTitle: "LDAP / Active Directory"
+---
+
+## Introduction
+
+TIB supports Lightweight Directory Access Protocol (LDAP) and Active Directory using the `ADProvider` method, which uses a passthrough flow; user credentials are submitted directly to TIB, which validates them against your LDAP server. No browser redirect to an external IdP is involved.
+
+Because LDAP is a passthrough flow, you must provide a login page that submits credentials to TIB. Tyk Dashboard and Tyk Developer Portal do not include a built-in LDAP login page.
+
+Before configuring your TIB profile, read [Dashboard SSO](/tyk-identity-broker/dashboard-sso) or [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case.
+
+## TIB Profile
+
+The LDAP-specific configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `ADProvider` and `Type` to `passthrough`.
+
+```json expandable
+{
+  "ProviderName": "ADProvider",
+  "Type": "passthrough",
+  "ProviderConfig": {
+    "LDAPServer": "{ldap-server-hostname}",
+    "LDAPPort": "389",
+    "LDAPUserDN": "cn=*USERNAME*,dc=example,dc=com",
+    "LDAPBaseDN": "dc=example,dc=com",
+    "LDAPFilter": "(objectClass=person)",
+    "LDAPEmailAttribute": "mail",
+    "LDAPFirstNameAttribute": "givenName",
+    "LDAPLastNameAttribute": "sn",
+    "LDAPAttributes": [],
+    "FailureRedirect": "http://{failure-redirect-url}",
+    "GetAuthFromBAHeader": true
+  }
+}
+```
+
+The LDAP-specific `ProviderConfig` fields are:
+
+| Field | Description |
+|---|---|
+| `LDAPServer` | Hostname or IP address of your LDAP server. |
+| `LDAPPort` | Port of your LDAP server. Use `389` for standard LDAP or `636` for LDAPS. |
+| `LDAPUserDN` | Distinguished Name template used to bind as the authenticating user. The literal string `*USERNAME*` is replaced at runtime with the submitted username. |
+| `LDAPBaseDN` | Base DN from which LDAP searches are performed. |
+| `LDAPFilter` | LDAP search filter applied when looking up users. |
+| `LDAPEmailAttribute` | LDAP attribute containing the user's email address. Defaults to `mail`. |
+| `LDAPFirstNameAttribute` | LDAP attribute containing the user's first name. Defaults to `givenName`. |
+| `LDAPLastNameAttribute` | LDAP attribute containing the user's last name. Defaults to `sn`. |
+| `LDAPAttributes` | Additional LDAP attributes to retrieve. Can be an empty list. |
+| `LDAPUseSSL` | Set to `true` to connect using LDAPS. |
+| `LDAPAdminUser` | DN of an admin user for performing user-lookup searches, if required. |
+| `LDAPAdminPassword` | Password for the admin user. |
+| `LDAPSearchScope` | Depth of the LDAP search: `0` for base object only, `1` for single level below the base DN, `2` for the entire subtree. Defaults to `2`. |
+| `DefaultDomain` | Domain appended to the username when building the full user identifier. Used to construct the username but not for performing LDAP requests. |
+| `FailureRedirect` | URL to redirect the user to on authentication failure. |
+| `GetAuthFromBAHeader` | Set to `true` to read the username and password from the HTTP Basic Auth header. Recommended for form-based login pages. |
+| `SlugifyUserName` | Set to `true` to normalize the username to a URL-safe slug. |
+
+## Login Page
+
+Since LDAP is a passthrough flow, users submit credentials directly to TIB via a form `POST`. Create a login page with a form that posts to the TIB authentication endpoint:
+
+```html
+<form method="POST" action="http://{tib-host}/auth/{profile-id}/ADProvider">
+  <input type="text" name="username" />
+  <input type="password" name="password" />
+  <button type="submit">Log in</button>
+</form>
+```
+
+The form must use `POST` method and include `username` and `password` fields. TIB reads these field names exactly.
+
+For embedded TIB, `{tib-host}` is the same as your Dashboard host. For Portal, the embedded TIB is accessible under the `/tib` path prefix, so use `{portal-host}/tib` as the base.
+
+## Worked Examples
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso#unregistered-user-login) for full details.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "ldap-dashboard",
+  "Name": "LDAP Dashboard SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "passthrough",
+  "ProviderName": "ADProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "LDAPServer": "ldap.example.com",
+    "LDAPPort": "389",
+    "LDAPUserDN": "cn=*USERNAME*,dc=example,dc=com",
+    "LDAPBaseDN": "dc=example,dc=com",
+    "LDAPFilter": "(objectClass=person)",
+    "LDAPEmailAttribute": "mail",
+    "LDAPFirstNameAttribute": "givenName",
+    "LDAPLastNameAttribute": "sn",
+    "LDAPAttributes": [],
+    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
+    "GetAuthFromBAHeader": true
+  }
+}
+```
+
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+- update `LDAPUserDN` to match your LDAP directory structure, keeping `*USERNAME*` as a literal placeholder
+
+**Login page form action**
+
+Your login page form should `POST` to:
+
+```
+http://dashboard.example.com:3000/auth/ldap-dashboard/ADProvider
+```
+
+**Redirect to login page**
+
+To redirect users to your custom login page instead of the default Dashboard login, set `sso_custom_login_url` in the Tyk Dashboard configuration:
+
+```json
+{
+  "sso_custom_login_url": "http://{your-login-page-url}"
+}
+```
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "ldap-portal",
+  "Name": "LDAP Portal SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "passthrough",
+  "ProviderName": "ADProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "LDAPServer": "ldap.example.com",
+    "LDAPPort": "389",
+    "LDAPUserDN": "cn=*USERNAME*,dc=example,dc=com",
+    "LDAPBaseDN": "dc=example,dc=com",
+    "LDAPFilter": "(objectClass=person)",
+    "LDAPEmailAttribute": "mail",
+    "LDAPFirstNameAttribute": "givenName",
+    "LDAPLastNameAttribute": "sn",
+    "LDAPAttributes": [],
+    "FailureRedirect": "http://portal.example.com:3001/?fail=true",
+    "GetAuthFromBAHeader": true
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `DashboardCredential` to the [`PortalAPISecret`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+- update `LDAPUserDN` to match your LDAP directory structure, keeping `*USERNAME*` as a literal placeholder
+
+**Login page form action**
+
+Your login page form should `POST` to:
+
+```
+http://portal.example.com:3001/tib/auth/ldap-portal/ADProvider
+```
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
diff --git a/api-management/single-sign-on-social-idp.mdx b/api-management/single-sign-on-social-idp.mdx
new file mode 100644
index 0000000000..9efa961376
--- /dev/null
+++ b/api-management/single-sign-on-social-idp.mdx
@@ -0,0 +1,454 @@
+---
+title: "SSO with Social Identity Providers"
+description: "Learn how to configure Single Sign-On (SSO) for Tyk Dashboard or Tyk Developer Portal using OAuth-based social identity providers such as Google, GitHub, and LinkedIn."
+keywords: "Tyk Identity Broker, TIB, SSO, Single Sign-On, Google, GitHub, LinkedIn, OAuth, Social Login, Authentication"
+sidebarTitle: "Social Login"
+---
+
+## Introduction
+
+TIB supports OAuth 2.0-based social identity providers using `SocialProvider`. Each supported provider requires an OAuth application registered with that provider, from which you obtain a Client ID and Client Secret.
+
+The following provider names are supported in `UseProviders[].Name`:
+
+| Provider | `Name` value |
+|---|---|
+| GitHub | `github` |
+| LinkedIn | `linkedin` |
+| Twitter / X | `twitter` |
+| Bitbucket | `bitbucket` |
+| DigitalOcean | `digitalocean` |
+| Dropbox | `dropbox` |
+| Salesforce | `salesforce` |
+
+<Note>
+The legacy `gplus` provider for Google no longer works following the Google+ shutdown in 2019. Use the `openid-connect` provider name instead, as shown in the [Google example](#worked-example-google) below.
+</Note>
+
+Before configuring your TIB profile, read [Dashboard SSO](/tyk-identity-broker/dashboard-sso) or [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case.
+
+## TIB Profile
+
+The social provider configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `SocialProvider` and `Type` to `redirect`.
+
+```json expandable
+{
+  "ProviderName": "SocialProvider",
+  "Type": "redirect",
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://{tib-host}",
+    "FailureRedirect": "http://{failure-redirect-url}",
+    "UseProviders": [
+      {
+        "Name": "{provider-name}",
+        "Key": "{client-id}",
+        "Secret": "{client-secret}"
+      }
+    ]
+  }
+}
+```
+
+| Field | Description |
+|---|---|
+| `CallbackBaseURL` | The base URL of your TIB instance. TIB appends the callback path automatically. |
+| `FailureRedirect` | URL to redirect the user to on authentication failure. |
+| `UseProviders.Name` | The provider name (for example, `github`, `linkedin`). See the table above. |
+| `UseProviders.Key` | The OAuth Client ID from your social provider application. |
+| `UseProviders.Secret` | The OAuth Client Secret from your social provider application. |
+
+### Domain Constraint
+
+For providers that return the user's email address (such as Google), you can restrict access to users from a specific email domain by adding a `ProviderConstraints` block to the profile:
+
+```json
+{
+  "ProviderConstraints": {
+    "Domain": "your-company.com",
+    "Group": ""
+  }
+}
+```
+
+Users whose email address does not match the configured domain will be redirected to `FailureRedirect`.
+
+### JSON Web Encryption (JWE)
+
+`SocialProvider` supports JSON Web Encryption (JWE), which allows TIB to decrypt encrypted ID tokens returned by the IdP. This is useful when your IdP is configured to encrypt tokens for additional security.
+
+JWE requires Tyk Identity Broker v1.6.1+ and Tyk Dashboard v5.7.0+.
+
+To enable JWE, add a `JWE` block to `ProviderConfig`:
+
+```json
+{
+  "ProviderConfig": {
+    "UseProviders": [...],
+    "JWE": {
+      "Enabled": true,
+      "PrivateKeyLocation": "{certificate-id-or-path}"
+    }
+  }
+}
+```
+
+| Field | Description |
+|---|---|
+| `Enabled` | Set to `true` to enable JWE decryption. |
+| `PrivateKeyLocation` | For embedded TIB in Tyk Dashboard, use the certificate ID from the Tyk Dashboard certificate manager. For standalone TIB, use the file path to a PEM file containing the private key. |
+
+The private key must correspond to the public key registered with your IdP for token encryption. Configure your IdP to encrypt ID tokens using the matching public key before enabling this setting.
+
+
+## Configure Your Provider
+
+Register an OAuth application with your chosen social provider and note the Client ID and Client Secret. The callback URL to register with the provider is shown below. The `{profile-id}` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://{tib-host}/auth/{profile-id}/{provider-name}/callback
+```
+
+For example, for GitHub with a profile ID of `github-dashboard` and TIB running at `http://dashboard.example.com:3000`:
+
+```
+http://dashboard.example.com:3000/auth/github-dashboard/github/callback
+```
+
+## Worked Example: GitHub
+
+This example configures GitHub OAuth for Dashboard SSO. The same pattern applies to all other social providers; only the `Name`, `Key`, `Secret`, and the callback URL registered with the provider differ.
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+**GitHub OAuth application**
+
+Register an OAuth application at [github.com/settings/applications/new](https://github.com/settings/applications/new). Set the **Authorization callback URL** to:
+
+```
+http://dashboard.example.com:3000/auth/github-dashboard/github/callback
+```
+
+Note the **Client ID** and **Client Secret**.
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for full details.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "github-dashboard",
+  "Name": "GitHub Dashboard SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://dashboard.example.com:3000",
+    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "github",
+        "Key": "{github-client-id}",
+        "Secret": "{github-client-secret}"
+      }
+    ]
+  }
+}
+```
+
+- set `Key` to the GitHub **Client ID**
+- set `Secret` to the GitHub **Client Secret**
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://dashboard.example.com:3000/auth/github-dashboard/github
+```
+
+In production, present this as a "Log in with GitHub" button or link on a custom login page, rather than expecting users to navigate to it directly.
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**GitHub OAuth application**
+
+Register an OAuth application at [github.com/settings/applications/new](https://github.com/settings/applications/new). Set the **Authorization callback URL** to:
+
+```
+http://portal.example.com:3001/tib/auth/github-portal/github/callback
+```
+
+Note the **Client ID** and **Client Secret**.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "github-portal",
+  "Name": "GitHub Portal SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://portal.example.com:3001",
+    "FailureRedirect": "http://portal.example.com:3001/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "github",
+        "Key": "{github-client-id}",
+        "Secret": "{github-client-secret}"
+      }
+    ]
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `Key` to the GitHub **Client ID**
+- set `Secret` to the GitHub **Client Secret**
+- set `DashboardCredential` to the [`PortalAPISecret`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://portal.example.com:3001/tib/auth/github-portal/github
+```
+
+In production, present this as a "Log in with GitHub" button or link on the Portal login page.
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
+
+## Worked Example: Google
+
+Google authentication uses the `openid-connect` provider name rather than a named OAuth provider, since the `gplus` provider was retired in 2019. The setup follows the same pattern as any OIDC provider.
+
+**Configure Google**
+
+1. Go to the [Google Cloud Console](https://console.cloud.google.com/) and navigate to **APIs and Services > Credentials**.
+2. Click **Create Credentials** and select **OAuth client ID**.
+3. Select **Web application** as the application type.
+4. Under **Authorized redirect URIs**, add the TIB callback URL:
+   ```
+   http://{tib-host}/auth/{profile-id}/openid-connect/callback
+   ```
+5. Click **Create** and note the **Client ID** and **Client Secret**.
+
+Google's OIDC discovery URL is:
+```
+https://accounts.google.com/.well-known/openid-configuration
+```
+
+
+These examples use embedded TIB, so the `CallbackBaseURL` is the same as the Dashboard or Portal respectively; TIB handles requests on the same host and port.
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for full details.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "google-dashboard-oidc",
+  "Name": "Google Dashboard SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://dashboard.example.com:3000",
+    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{google-client-id}",
+        "Secret": "{google-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://accounts.google.com/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `Key` to the Google **Client ID**
+- set `Secret` to the Google **Client Secret**
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+
+**Google redirect URI**
+
+Ensure the following URL is listed in **Authorized redirect URIs** in your Google Cloud Console credentials. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://dashboard.example.com:3000/auth/google-dashboard-oidc/openid-connect/callback
+```
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://dashboard.example.com:3000/auth/google-dashboard-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Google" button or link on a custom login page, rather than expecting users to navigate to it directly.
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "google-portal-oidc",
+  "Name": "Google Portal SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://portal.example.com:3001",
+    "FailureRedirect": "http://portal.example.com:3001/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{google-client-id}",
+        "Secret": "{google-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://accounts.google.com/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `Key` to the Google **Client ID**
+- set `Secret` to the Google **Client Secret**
+- set `DashboardCredential` to the [`PortalAPISecret`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+
+**Google redirect URI**
+
+Ensure the following URL is listed in **Authorized redirect URIs** in your Google Cloud Console credentials. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://portal.example.com:3001/tib/auth/google-portal-oidc/openid-connect/callback
+```
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://portal.example.com:3001/tib/auth/google-portal-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Google" button or link on the Portal login page.
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
diff --git a/api-management/stream-config.mdx b/api-management/stream-config.mdx
new file mode 100644
index 0000000000..2f59121e60
--- /dev/null
+++ b/api-management/stream-config.mdx
@@ -0,0 +1,6720 @@
+---
+title: "Tyk Streams Configuration"
+description: "Learn how to configure Tyk Streams for event-driven API management"
+keywords: "Broker, Input, Output, HTTP Client, HTTP Server, Processors, Scanners, CSV, Lines, Regular Expression, Switch, Avro, Kafka"
+sidebarTitle: "Tyk Streams Reference"
+---
+
+## Overview
+
+Tyk streams configuration is specified using YAML. The configuration consists of several main sections: *input*, *pipeline*, *output* and optionally *logger*.
+
+### Input
+
+The input section defines the publisher source of the data stream. Tyk Streams supports various input types such as Kafka, HTTP, MQTT etc. Each input type has specific configuration parameters.
+
+```yaml
+input:
+  kafka:
+    addresses:
+      - localhost:9092
+    topics:
+      - example_topic
+    consumer_group: example_group
+    client_id: example_client
+```
+
+### Pipeline
+
+The pipeline section defines the processing steps applied to the data. It includes processors for filtering, mapping, enriching and transforming the data. Processors can be chained together.
+
+```yaml
+pipeline:
+  processors:
+    - mapping: |
+        root = this
+        root.foo = this.bar.uppercase()
+    - json_schema:
+        schema_path: "./schemas/example_schema.json"
+```
+
+### Output
+
+The output section specifies the destination of the processed data. Similar to inputs, Tyk Streams supports various output types like Kafka, HTTP etc.
+
+```yaml
+output:
+  kafka:
+    addresses:
+      - localhost:9092
+    topic: output_topic
+    client_id: example_output_client
+```
+
+### Logger (Optional)
+
+The logger section is used to configure logging options, such as log level and output format.
+
+```yaml
+logger:
+  level: INFO
+  format: json
+```
+
+## Inputs
+
+### Overview
+
+An input is a source of data piped through an array of optional [processors](/api-management/stream-config#overview-3):
+
+```yaml
+input:
+  label: my_kafka_input
+
+  kafka:
+    addresses: [ localhost:9092 ]
+    topics: [ foo, bar ]
+    consumer_group: foogroup
+
+  # Optional list of processing steps
+  processors:
+    - avro:
+        operator: to_json
+```
+
+#### Brokering
+
+Only one input is configured at the root of a Tyk Streams config. However, the root input can be a [broker](/api-management/stream-config#broker) which combines multiple inputs and merges the streams:
+
+```yaml
+input:
+  broker:
+    inputs:
+      - kafka:
+          addresses: [ localhost:9092 ]
+          topics: [ foo, bar ]
+          consumer_group: foogroup
+
+      - http_client:
+          url: https://localhost:8085
+          verb: GET
+          stream:
+            enabled: true
+```
+
+#### Labels
+
+Inputs have an optional field `label` that can uniquely identify them in observability data such as logs.
+
+{/* TODO
+
+When know if Tyk Streams will support metrics then link to metrics
+
+Inputs have an optional field `label` that can uniquely identify them in observability data such as metrics and logs. This can be useful when running configs with multiple inputs, otherwise their metrics labels will be generated based on their composition. For more information check out the [metrics documentation][metrics.about]. */}
+
+### Broker
+
+Allows you to combine multiple inputs into a single stream of data, where each input will be read in parallel.
+
+#### Common
+
+```yml
+# Common config fields, showing default values
+input:
+  label: ""
+  broker:
+    inputs: [] # No default (required)
+    batching:
+      count: 0
+      byte_size: 0
+      period: ""
+      check: ""
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+input:
+  label: ""
+  broker:
+    copies: 1
+    inputs: [] # No default (required)
+    batching:
+      count: 0
+      byte_size: 0
+      period: ""
+      check: ""
+      processors: [] # No default (optional)
+```
+
+A broker type is configured with its own list of input configurations and a field to specify how many copies of the list of inputs should be created.
+
+Adding more input types allows you to combine streams from multiple sources into one. For example, reading from both RabbitMQ and Kafka:
+
+```yaml
+input:
+  broker:
+    copies: 1
+    inputs:
+      - amqp_0_9:
+          urls:
+            - amqp://guest:guest@localhost:5672/
+          consumer_tag: tyk-consumer
+          queue: tyk-queue
+
+        # Optional list of input specific processing steps
+        processors:
+          - mapping: |
+              root.message = this
+              root.meta.link_count = this.links.length()
+              root.user.age = this.user.age.number()
+
+      - kafka:
+          addresses:
+            - localhost:9092
+          client_id: tyk_kafka_input
+          consumer_group: tyk_consumer_group
+          topics: [ tyk_stream:0 ]
+```
+
+If the number of copies is greater than zero the list will be copied that number of times. For example, if your inputs were of type foo and bar, with 'copies' set to '2', you would end up with two 'foo' inputs and two 'bar' inputs.
+
+##### Batching
+
+It's possible to configure a [batch policy](/api-management/stream-config#batch-policy) with a broker using the `batching` fields. When doing this the feeds from all child inputs are combined. Some inputs do not support broker based batching and specify this in their documentation.
+
+##### Processors
+
+It is possible to configure processors at the broker level, where they will be applied to *all* child inputs, as well as on the individual child inputs. If you have processors at both the broker level *and* on child inputs then the broker processors will be applied *after* the child nodes processors.
+
+#### Fields
+
+##### copies
+
+Whatever is specified within `inputs` will be created this many times.
+
+
+Type: `int`
+Default: `1`
+
+##### inputs
+
+A list of inputs to create.
+
+
+Type: `array`
+
+##### batching
+
+Allows you to configure a [batching policy](/api-management/stream-config#batch-policy).
+
+
+Type: `object`
+
+```yml
+# Examples
+
+batching:
+  byte_size: 5000
+  count: 0
+  period: 1s
+
+batching:
+  count: 10
+  period: 1s
+
+batching:
+  check: this.contains("END BATCH")
+  count: 0
+  period: 1m
+```
+
+##### batching.count
+
+A number of messages at which the batch should be flushed. If `0` disables count based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.byte_size
+
+An amount of bytes at which the batch should be flushed. If `0` disables size based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.period
+
+A period in which an incomplete batch should be flushed regardless of its size.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+period: 1s
+
+period: 1m
+
+period: 500ms
+```
+
+##### batching.check
+
+A Bloblang query that should return a boolean value indicating whether a message should end a batch.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+check: this.type == "end_of_transaction"
+```
+
+##### batching.processors
+
+A list of processors to apply to a batch as it is flushed. This allows you to aggregate and archive the batch however you see fit. Please note that all resulting messages are flushed as a single batch, therefore splitting the batch into smaller batches using these processors is a no-op.
+
+
+Type: `array`
+
+```yml
+# Examples
+
+processors:
+  - archive:
+      format: concatenate
+
+processors:
+  - archive:
+      format: lines
+
+processors:
+  - archive:
+      format: json_array
+```
+
+### Http Client
+
+Connects to a server and continuously performs requests for a single message.
+
+#### Common
+
+```yml
+# Common config fields, showing default values
+input:
+  label: ""
+  http_client:
+    url: "" # No default (required)
+    verb: GET
+    headers: {}
+    timeout: 5s
+    payload: "" # No default (optional)
+    stream:
+      enabled: false
+      reconnect: true
+    auto_replay_nacks: true
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+input:
+  label: ""
+  http_client:
+    url: "" # No default (required)
+    verb: GET
+    headers: {}
+    metadata:
+      include_prefixes: []
+      include_patterns: []
+    dump_request_log_level: ""
+    oauth:
+      enabled: false
+      consumer_key: ""
+      consumer_secret: ""
+      access_token: ""
+      access_token_secret: ""
+    oauth2:
+      enabled: false
+      client_key: ""
+      client_secret: ""
+      token_url: ""
+      scopes: []
+      endpoint_params: {}
+    basic_auth:
+      enabled: false
+      username: ""
+      password: ""
+    jwt:
+      enabled: false
+      private_key_file: ""
+      signing_method: ""
+      claims: {}
+      headers: {}
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+    extract_headers:
+      include_prefixes: []
+      include_patterns: []
+    timeout: 5s
+    retry_period: 1s
+    max_retry_backoff: 300s
+    retries: 3
+    backoff_on:
+      - 429
+    drop_on: []
+    successful_on: []
+    proxy_url: "" # No default (optional)
+    payload: "" # No default (optional)
+    drop_empty_bodies: true
+    stream:
+      enabled: false
+      reconnect: true
+    auto_replay_nacks: true
+```
+
+##### Streaming
+
+If you enable streaming then Tyk Streams will consume the body of the response as a continuous stream of data. This allows you to consume APIs that provide long lived streamed data feeds (such as Twitter).
+
+##### Pagination
+
+This input supports interpolation functions in the `url` and `headers` fields where data from the previous successfully consumed message (if there was one) can be referenced. This can be used in order to support basic levels of pagination.
+
+#### Examples
+
+##### Basic Pagination
+
+Interpolation functions within the `url` and `headers` fields can be used to reference the previously consumed message, which allows simple pagination.
+
+```yaml
+input:
+  http_client:
+    url: >-
+      http://api.example.com/search?query=allmyfoos&start_time=${! (
+        (timestamp_unix()-300).ts_format("2006-01-02T15:04:05Z","UTC").escape_url_query()
+      ) }${! ("&next_token="+this.meta.next_token.not_null()) | "" }
+    verb: GET
+```
+
+{/* Update example when Tyk secrets Stream release has been performed
+
+```yaml
+input:
+  http_client:
+    url: >-
+      http://api.example.com/search?query=allmyfoos&start_time=${! (
+        (timestamp_unix()-300).ts_format("2006-01-02T15:04:05Z","UTC").escape_url_query()
+      ) }${! ("&next_token="+this.meta.next_token.not_null()) | "" }
+    verb: GET
+    rate_limit: foo_searches
+    # oauth2:
+    #   enabled: true
+    #   token_url: https://api.example.com/oauth2/token
+    #   client_key: "${EXAMPLE_KEY}"
+    #   client_secret: "${EXAMPLE_SECRET}"
+
+rate_limit_resources:
+  - label: foo_searches
+    local:
+      count: 1
+      interval: 30s
+``` */}
+
+#### Fields
+
+##### url
+
+The URL to connect to.
+
+
+Type: `string`
+
+##### verb
+
+A verb to connect with
+
+
+Type: `string`
+Default: `"GET"`
+
+```yml
+# Examples
+
+verb: POST
+
+verb: GET
+
+verb: DELETE
+```
+
+##### headers
+
+A map of headers to add to the request.
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `object`
+Default: `{}`
+
+```yml
+# Examples
+
+headers:
+  Content-Type: application/octet-stream
+  traceparent: ${! tracing_span().traceparent }
+```
+
+##### metadata
+
+Specify optional matching rules to determine which metadata keys should be added to the HTTP request as headers.
+
+
+Type: `object`
+
+##### metadata.include_prefixes
+
+Provide a list of explicit metadata key prefixes to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_prefixes:
+  - foo_
+  - bar_
+
+include_prefixes:
+  - kafka_
+
+include_prefixes:
+  - content-
+```
+
+##### metadata.include_patterns
+
+Provide a list of explicit metadata key regular expression (re2) patterns to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_patterns:
+  - .*
+
+include_patterns:
+  - _timestamp_unix$
+```
+
+##### dump_request_log_level
+
+Optionally set a level at which the request and response payload of each request made will be logged.
+
+
+Type: `string`
+Default: `""`
+Options: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`, `FATAL`, ``.
+
+##### oauth
+
+Allows you to specify open authentication via OAuth version 1.
+
+
+Type: `object`
+
+##### oauth.enabled
+
+Whether to use OAuth version 1 in requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### oauth.consumer_key
+
+A value used to identify the client to the service provider.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth.consumer_secret
+
+A secret used to establish ownership of the consumer key.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth.access_token
+
+A value used to gain access to the protected resources on behalf of the user.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth.access_token_secret
+
+A secret provided in order to establish ownership of a given access token.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth2
+
+Allows you to specify open authentication via OAuth version 2 using the client credentials token flow.
+
+
+Type: `object`
+
+##### oauth2.enabled
+
+Whether to use OAuth version 2 in requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### oauth2.client_key
+
+A value used to identify the client to the token provider.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth2.client_secret
+
+A secret used to establish ownership of the client key.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth2.token_url
+
+The URL of the token provider.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth2.scopes
+
+A list of optional requested permissions.
+
+
+Type: `array`
+Default: `[]`
+
+##### oauth2.endpoint_params
+
+A list of optional endpoint parameters, values should be arrays of strings.
+
+
+Type: `object`
+Default: `{}`
+
+```yml
+# Examples
+
+endpoint_params:
+  bar:
+    - woof
+  foo:
+    - meow
+    - quack
+```
+
+##### basic_auth
+
+Allows you to specify basic authentication.
+
+
+Type: `object`
+
+##### basic_auth.enabled
+
+Whether to use basic authentication in requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### basic_auth.username
+
+A username to authenticate as.
+
+
+Type: `string`
+Default: `""`
+
+##### basic_auth.password
+
+A password to authenticate with.
+
+
+Type: `string`
+Default: `""`
+
+##### jwt
+
+Allows you to specify JWT authentication.
+
+
+Type: `object`
+
+##### jwt.enabled
+
+Whether to use JWT authentication in requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### jwt.private_key_file
+
+A file with the PEM encoded via PKCS1 or PKCS8 as private key.
+
+
+Type: `string`
+Default: `""`
+
+##### jwt.signing_method
+
+A method used to sign the token such as RS256, RS384, RS512 or EdDSA.
+
+
+Type: `string`
+Default: `""`
+
+##### jwt.claims
+
+A value used to identify the claims that issued the JWT.
+
+
+Type: `object`
+Default: `{}`
+
+##### jwt.headers
+
+Add optional key/value headers to the JWT.
+
+
+Type: `object`
+Default: `{}`
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're seeing the error message `local error: tls: no renegotiation`.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified, but not both.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+client_certs:
+  - cert: foo
+    key: bar
+
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in PKCS#1 or PKCS#8 format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+password: foo
+```
+
+##### extract_headers
+
+Specify which response headers should be added to resulting messages as metadata. Header keys are lowercased before matching, so ensure that your patterns target lowercased versions of the header keys that you expect.
+
+
+Type: `object`
+
+##### extract_headers.include_prefixes
+
+Provide a list of explicit metadata key prefixes to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_prefixes:
+  - foo_
+  - bar_
+
+include_prefixes:
+  - kafka_
+
+include_prefixes:
+  - content-
+```
+
+##### extract_headers.include_patterns
+
+Provide a list of explicit metadata key regular expression (re2) patterns to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_patterns:
+  - .*
+
+include_patterns:
+  - _timestamp_unix$
+```
+
+##### timeout
+
+A static timeout to apply to requests.
+
+
+Type: `string`
+Default: `"5s"`
+
+##### retry_period
+
+The base period to wait between failed requests.
+
+
+Type: `string`
+Default: `"1s"`
+
+##### max_retry_backoff
+
+The maximum period to wait between failed requests.
+
+
+Type: `string`
+Default: `"300s"`
+
+##### retries
+
+The maximum number of retry attempts to make.
+
+
+Type: `int`
+Default: `3`
+
+##### backoff_on
+
+A list of status codes whereby the request should be considered to have failed and retries should be attempted, but the period between them should be increased gradually.
+
+
+Type: `array`
+Default: `[429]`
+
+##### drop_on
+
+A list of status codes whereby the request should be considered to have failed but retries should not be attempted. This is useful for preventing wasted retries for requests that will never succeed. Note that with these status codes the *request* is dropped, but *message* that caused the request will not be dropped.
+
+
+Type: `array`
+Default: `[]`
+
+##### successful_on
+
+A list of status codes whereby the attempt should be considered successful, this is useful for dropping requests that return non-2XX codes indicating that the message has been dealt with, such as a 303 See Other or a 409 Conflict. All 2XX codes are considered successful unless they are present within `backoff_on` or `drop_on`, regardless of this field.
+
+
+Type: `array`
+Default: `[]`
+
+##### proxy_url
+
+An optional HTTP proxy URL.
+
+
+Type: `string`
+
+##### payload
+
+An optional payload to deliver for each request.
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+
+Type: `string`
+
+##### drop_empty_bodies
+
+Whether empty payloads received from the target server should be dropped.
+
+
+Type: `bool`
+Default: `true`
+
+##### stream
+
+Allows you to set streaming mode, where requests are kept open and messages are processed line-by-line.
+
+
+Type: `object`
+
+##### stream.enabled
+
+Enables streaming mode.
+
+
+Type: `bool`
+Default: `false`
+
+##### stream.reconnect
+
+Sets whether to re-establish the connection once it is lost.
+
+
+Type: `bool`
+Default: `true`
+
+
+##### auto_replay_nacks
+
+Whether messages that are rejected (nacked) at the output level should be automatically replayed indefinitely, eventually resulting in back pressure if the cause of the rejections is persistent. If set to `false` these messages will instead be deleted. Disabling auto replays can greatly improve memory efficiency of high throughput streams as the original shape of the data can be discarded immediately upon consumption and mutation.
+
+
+Type: `bool`
+Default: `true`
+
+### HTTP Server
+
+Receive messages POSTed over HTTP(S). HTTP 2.0 is supported when using TLS, which is enabled when key and cert files are specified.
+
+#### Common
+
+```yml
+# Common config fields, showing default values
+input:
+  label: ""
+  http_server:
+    address: ""
+    path: /post
+    ws_path: /post/ws
+    allowed_verbs:
+      - POST
+    timeout: 5s
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+input:
+  label: ""
+  http_server:
+    address: ""
+    path: /post
+    ws_path: /post/ws
+    ws_welcome_message: ""
+    allowed_verbs:
+      - POST
+    timeout: 5s
+    cert_file: ""
+    key_file: ""
+    cors:
+      enabled: false
+      allowed_origins: []
+    sync_response:
+      status: "200"
+      headers:
+        Content-Type: application/octet-stream
+      metadata_headers:
+        include_prefixes: []
+        include_patterns: []
+```
+
+{/* TODO add link to service wide HTTP server If the `address` config field is left blank the [service-wide HTTP server](/docs/components/http/about) will be used. */}
+
+{/* TODO add rate limit The field `rate_limit` allows you to specify an optional [`rate_limit` resource](/docs/components/rate_limits/about), which will be applied to each HTTP request made and each websocket payload received.
+
+When the rate limit is breached HTTP requests will have a 429 response returned with a Retry-After header. Websocket payloads will be dropped and an optional response payload will be sent as per `ws_rate_limit_message`. */}
+
+##### Responses
+
+{/* TODO describe how to use synchronous responses when avail:
+
+It's possible to return a response for each message received using synchronous responses. When doing so you can customise headers with the `sync_response` field `headers`, which can also use function interpolation in the value based on the response message contents. */}
+
+
+##### Endpoints
+
+The following fields specify endpoints that are registered for sending messages, and support path parameters of the form `/{foo}`, which are added to ingested messages as metadata. A path ending in `/` will match against all extensions of that path:
+
+###### path (defaults to `/post`)
+
+This endpoint expects POST requests where the entire request body is consumed as a single message.
+
+If the request contains a multipart `content-type` header as per [rfc1341](https://www.w3.org/Protocols/rfc1341/7_2_Multipart.html) then the multiple parts are consumed as a batch of messages, where each body part is a message of the batch.
+
+###### ws_path (defaults to `/post/ws`)
+
+Creates a websocket connection, where payloads received on the socket are passed through the pipeline as a batch of one message.
+
+Please note that components within a Tyk Streams config will register their respective endpoints in a non-deterministic order. This means that establishing precedence of endpoints that are registered via multiple `http_server` inputs or outputs (either within brokers or from cohabiting streams) is not possible in a predictable way.
+
+This ambiguity makes it difficult to ensure that paths which are both a subset of a path registered by a separate component, and end in a slash (`/`) and will therefore match against all extensions of that path, do not prevent the more specific path from matching against requests.
+
+It is therefore recommended that you ensure paths of separate components do not collide unless they are explicitly non-competing.
+
+For example, if you were to deploy two separate `http_server` inputs, one with a path `/foo/` and the other with a path `/foo/bar`, it would not be possible to ensure that the path `/foo/` does not swallow requests made to `/foo/bar`.
+
+You may specify an optional `ws_welcome_message`, which is a static payload to be sent to all clients once a websocket connection is first established.
+
+##### Metadata
+
+This input adds the following metadata fields to each message:
+
+``` text
+- http_server_user_agent
+- http_server_request_path
+- http_server_verb
+- http_server_remote_ip
+- All headers (only first values are taken)
+- All query parameters
+- All path parameters
+- All cookies
+```
+
+If HTTPS is enabled, the following fields are added as well:
+``` text
+- http_server_tls_version
+- http_server_tls_subject
+- http_server_tls_cipher_suite
+```
+
+{/* TODO: when interpolaion supported
+You can access these metadata fields using interpolation functions. */}
+
+#### Examples
+
+
+##### Path Switching
+
+This example shows an `http_server` input that captures all requests and processes them by switching on that path:
+
+```yaml
+input:
+  http_server:
+    path: /
+    allowed_verbs: [ GET, POST ]
+    sync_response:
+      headers:
+        Content-Type: application/json
+
+  processors:
+    - switch:
+      - check: '@http_server_request_path == "/foo"'
+        processors:
+          - mapping: |
+              root.title = "You Got Fooed!"
+              root.result = content().string().uppercase()
+
+      - check: '@http_server_request_path == "/bar"'
+        processors:
+          - mapping: 'root.title = "Bar Is Slow"'
+          - sleep: # Simulate a slow endpoint
+              duration: 1s
+```
+
+##### Mock OAuth 2.0 Server
+
+This example shows an `http_server` input that mocks an OAuth 2.0 Client Credentials flow server at the endpoint `/oauth2_test`:
+
+```yaml
+input:
+  http_server:
+    path: /oauth2_test
+    allowed_verbs: [ GET, POST ]
+    sync_response:
+      headers:
+        Content-Type: application/json
+
+  processors:
+    - log:
+        message: "Received request"
+        level: INFO
+        fields_mapping: |
+          root = @
+          root.body = content().string()
+
+    - mapping: |
+        root.access_token = "MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3"
+        root.token_type = "Bearer"
+        root.expires_in = 3600
+
+    - sync_response: {}
+    - mapping: 'root = deleted()'
+```
+
+#### Fields
+
+##### address
+
+An alternative address to host from. If left empty the service wide address is used.
+
+
+Type: `string`
+Default: `""`
+
+##### path
+
+The endpoint path to listen for POST requests.
+
+
+Type: `string`
+Default: `"/post"`
+
+##### ws_path
+
+The endpoint path to create websocket connections from.
+
+
+Type: `string`
+Default: `"/post/ws"`
+
+##### ws_welcome_message
+
+An optional message to deliver to fresh websocket connections.
+
+
+Type: `string`
+Default: `""`
+
+##### allowed_verbs
+
+An array of verbs that are allowed for the `path` endpoint.
+
+
+Type: `array`
+Default: `["POST"]`
+Requires version 3.33.0 or newer
+
+##### timeout
+
+Timeout for requests. If a consumed messages takes longer than this to be delivered the connection is closed, but the message may still be delivered.
+
+
+Type: `string`
+Default: `"5s"`
+
+{/* TODO add rate limit ##### rate_limit
+
+An optional [rate limit](/docs/components/rate_limits/about) to throttle requests by. */}
+
+
+Type: `string`
+Default: `""`
+
+##### cert_file
+
+Enable TLS by specifying a certificate and key file. Only valid with a custom `address`.
+
+
+Type: `string`
+Default: `""`
+
+##### key_file
+
+Enable TLS by specifying a certificate and key file. Only valid with a custom `address`.
+
+
+Type: `string`
+Default: `""`
+
+##### cors
+
+Adds Cross-Origin Resource Sharing headers. Only valid with a custom `address`.
+
+
+Type: `object`
+Requires version 3.63.0 or newer
+
+##### cors.enabled
+
+Whether to allow CORS requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### cors.allowed_origins
+
+An explicit list of origins that are allowed for CORS requests.
+
+
+Type: `array`
+Default: `[]`
+
+##### sync_response
+
+{/* TODO add links to synchronous responses */}
+Customize messages returned via synchronous responses.
+
+
+Type: `object`
+
+##### sync_response.status
+
+Specify the status code to return with synchronous responses. This is a string value, which allows you to customize it based on resulting payloads and their metadata.
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+
+Type: `string`
+Default: `"200"`
+
+```yml
+# Examples
+
+status: ${! json("status") }
+
+status: ${! meta("status") }
+```
+
+##### sync_response.headers
+
+Specify headers to return with synchronous responses.
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+
+Type: `object`
+Default: `{"Content-Type":"application/octet-stream"}`
+
+##### sync_response.metadata_headers
+
+Specify criteria for which metadata values are added to the response as headers.
+
+
+Type: `object`
+
+##### sync_response.metadata_headers.include_prefixes
+
+Provide a list of explicit metadata key prefixes to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_prefixes:
+  - foo_
+  - bar_
+
+include_prefixes:
+  - kafka_
+
+include_prefixes:
+  - content-
+```
+
+##### sync_response.metadata_headers.include_patterns
+
+Provide a list of explicit metadata key regular expression (re2) patterns to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_patterns:
+  - .*
+
+include_patterns:
+  - _timestamp_unix$
+```
+
+### Kafka
+
+Connects to Kafka brokers and consumes one or more topics.
+
+#### Common
+
+```yml
+# Common config fields, showing default values
+input:
+  label: ""
+  kafka:
+    addresses: [] # No default (required)
+    topics: [] # No default (required)
+    target_version: 2.1.0 # No default (optional)
+    consumer_group: ""
+    checkpoint_limit: 1024
+    auto_replay_nacks: true
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+input:
+  label: ""
+  kafka:
+    addresses: [] # No default (required)
+    topics: [] # No default (required)
+    target_version: 2.1.0 # No default (optional)
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+    sasl:
+      mechanism: none
+      user: ""
+      password: ""
+      access_token: ""
+      token_cache: ""
+      token_key: ""
+    consumer_group: ""
+    client_id: tyk
+    rack_id: ""
+    start_from_oldest: true
+    checkpoint_limit: 1024
+    auto_replay_nacks: true
+    commit_period: 1s
+    max_processing_period: 100ms
+    extract_tracing_map: root = @ # No default (optional)
+    group:
+      session_timeout: 10s
+      heartbeat_interval: 3s
+      rebalance_timeout: 60s
+    fetch_buffer_cap: 256
+    multi_header: false
+    batching:
+      count: 0
+      byte_size: 0
+      period: ""
+      check: ""
+      processors: [] # No default (optional)
+```
+
+Offsets are managed within Kafka under the specified consumer group, and partitions for each topic are automatically balanced across members of the consumer group.
+
+The Kafka input allows parallel processing of messages from different topic partitions, and messages of the same topic partition are processed with a maximum parallelism determined by the field [checkpoint_limit](#checkpoint_limit).
+
+In order to enforce ordered processing of partition messages set the [checkpoint_limit](#checkpoint_limit) to `1` and this will force partitions to be processed in lock-step, where a message will only be processed once the prior message is delivered.
+
+Batching messages before processing can be enabled using the [batching](#batching) field, and this batching is performed per-partition such that messages of a batch will always originate from the same partition. This batching mechanism is capable of creating batches of greater size than the [checkpoint_limit](#checkpoint_limit), in which case the next batch will only be created upon delivery of the current one.
+
+##### Metadata
+
+This input adds the following metadata fields to each message:
+
+``` text
+- kafka_key
+- kafka_topic
+- kafka_partition
+- kafka_offset
+- kafka_lag
+- kafka_timestamp_unix
+- kafka_tombstone_message
+- All existing message headers (version 0.11+)
+```
+
+The field `kafka_lag` is the calculated difference between the high water mark offset of the partition at the time of ingestion and the current message offset.
+
+{/* TODO: when interpolation supported
+You can access these metadata fields using function interpolation. */}
+
+##### Ordering
+
+By default messages of a topic partition can be processed in parallel, up to a limit determined by the field `checkpoint_limit`. However, if strict ordered processing is required then this value must be set to 1 in order to process shard messages in lock-step. When doing so it is recommended that you perform batching at this component for performance as it will not be possible to batch lock-stepped messages at the output level.
+
+##### Troubleshooting
+
+- I'm seeing logs that report `Failed to connect to kafka: kafka: client has run out of available brokers to talk to (Is your cluster reachable?)`, but the brokers are definitely reachable.
+
+Unfortunately this error message will appear for a wide range of connection problems even when the broker endpoint can be reached. Double check your authentication configuration and also ensure that you have [enabled TLS](#tlsenabled) if applicable.
+
+#### Fields
+
+##### addresses
+
+A list of broker addresses to connect to. If an item of the list contains commas it will be expanded into multiple addresses.
+
+
+Type: `array`
+
+```yml
+# Examples
+
+addresses:
+  - localhost:9092
+
+addresses:
+  - localhost:9041,localhost:9042
+
+addresses:
+  - localhost:9041
+  - localhost:9042
+```
+
+##### topics
+
+A list of topics to consume from. Multiple comma separated topics can be listed in a single element. Partitions are automatically distributed across consumers of a topic. Alternatively, it's possible to specify explicit partitions to consume from with a colon after the topic name, e.g. `foo:0` would consume the partition 0 of the topic foo. This syntax supports ranges, e.g. `foo:0-10` would consume partitions 0 through to 10 inclusive.
+
+
+Type: `array`
+Requires version 3.33.0 or newer
+
+```yml
+# Examples
+
+topics:
+  - foo
+  - bar
+
+topics:
+  - foo,bar
+
+topics:
+  - foo:0
+  - bar:1
+  - bar:3
+
+topics:
+  - foo:0,bar:1,bar:3
+
+topics:
+  - foo:0-5
+```
+
+##### target_version
+
+The version of the Kafka protocol to use. This limits the capabilities used by the client and should ideally match the version of your brokers. Defaults to the oldest supported stable version.
+
+
+Type: `string`
+
+```yml
+# Examples
+
+target_version: 2.1.0
+
+target_version: 3.1.0
+```
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're seeing the error message `local error: tls: no renegotiation`.
+
+
+Type: `bool`
+Default: `false`
+Requires version 3.45.0 or newer
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified, but not both.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+client_certs:
+  - cert: foo
+    key: bar
+
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in PKCS#1 or PKCS#8 format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Example
+
+password: foo
+```
+
+{/* When Tyk streams with secrets released include this in above example => password: ${KEY_PASSWORD} */}
+
+##### sasl
+
+Enables SASL authentication.
+
+
+Type: `object`
+
+##### sasl.mechanism
+
+The SASL authentication mechanism, if left empty SASL authentication is not used.
+
+
+Type: `string`
+Default: `"none"`
+
+| Option | Summary |
+| :--- | :--- |
+| `OAUTHBEARER` | OAuth Bearer based authentication. |
+| `PLAIN` | Plain text authentication. NOTE: When using plain text auth it is extremely likely that you'll also need to [enable TLS](#tlsenabled). |
+| `SCRAM-SHA-256` | Authentication using the SCRAM-SHA-256 mechanism. |
+| `SCRAM-SHA-512` | Authentication using the SCRAM-SHA-512 mechanism. |
+| `none` | Default, no SASL authentication. |
+
+
+##### sasl.user
+
+A PLAIN username. It is recommended that you use environment variables to populate this field.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+user: ${USER}
+```
+
+##### sasl.password
+
+A PLAIN password. It is recommended that you use environment variables to populate this field.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+password: ${PASSWORD}
+```
+
+##### sasl.access_token
+
+A static OAUTHBEARER access token
+
+
+Type: `string`
+Default: `""`
+
+{/* TODO add ##### sasl.token_cache
+
+Instead of using a static `access_token` allows you to query a [`cache`](/docs/components/caches/about) resource to fetch OAUTHBEARER tokens from */}
+
+
+Type: `string`
+Default: `""`
+
+##### sasl.token_key
+
+Required when using a `token_cache`, the key to query the cache with for tokens.
+
+
+Type: `string`
+Default: `""`
+
+##### consumer_group
+
+An identifier for the consumer group of the connection. This field can be explicitly made empty in order to disable stored offsets for the consumed topic partitions.
+
+
+Type: `string`
+Default: `""`
+
+##### client_id
+
+An identifier for the client connection.
+
+
+Type: `string`
+Default: `"tyk"`
+
+##### rack_id
+
+A rack identifier for this client.
+
+
+Type: `string`
+Default: `""`
+
+##### start_from_oldest
+
+Determines whether to consume from the oldest available offset, otherwise messages are consumed from the latest offset. The setting is applied when creating a new consumer group or the saved offset no longer exists.
+
+
+Type: `bool`
+Default: `true`
+
+##### checkpoint_limit
+
+The maximum number of messages of the same topic and partition that can be processed at a given time. Increasing this limit enables parallel processing and batching at the output level to work on individual partitions. Any given offset will not be committed unless all messages under that offset are delivered in order to preserve at least once delivery guarantees.
+
+
+Type: `int`
+Default: `1024`
+Requires version 3.33.0 or newer
+
+##### auto_replay_nacks
+
+Whether messages that are rejected (nacked) at the output level should be automatically replayed indefinitely, eventually resulting in back pressure if the cause of the rejections is persistent. If set to `false` these messages will instead be deleted. Disabling auto replays can greatly improve memory efficiency of high throughput streams as the original shape of the data can be discarded immediately upon consumption and mutation.
+
+
+Type: `bool`
+Default: `true`
+
+##### commit_period
+
+The period of time between each commit of the current partition offsets. Offsets are always committed during shutdown.
+
+
+Type: `string`
+Default: `"1s"`
+
+##### max_processing_period
+
+A maximum estimate for the time taken to process a message, this is used for tuning consumer group synchronization.
+
+
+Type: `string`
+Default: `"100ms"`
+
+##### extract_tracing_map
+
+A Bloblang mapping that attempts to extract an object containing tracing propagation information, which will then be used as the root tracing span for the message. The specification of the extracted fields must match the format used by the service wide tracer.
+
+
+Type: `string`
+Requires version 3.45.0 or newer
+
+```yml
+# Examples
+
+extract_tracing_map: root = @
+
+extract_tracing_map: root = this.meta.span
+```
+
+##### group
+
+Tuning parameters for consumer group synchronization.
+
+
+Type: `object`
+
+##### group.session_timeout
+
+A period after which a consumer of the group is kicked after no heartbeats.
+
+
+Type: `string`
+Default: `"10s"`
+
+##### group.heartbeat_interval
+
+A period in which heartbeats should be sent out.
+
+
+Type: `string`
+Default: `"3s"`
+
+##### group.rebalance_timeout
+
+A period after which rebalancing is abandoned if unresolved.
+
+
+Type: `string`
+Default: `"60s"`
+
+##### fetch_buffer_cap
+
+The maximum number of unprocessed messages to fetch at a given time.
+
+
+Type: `int`
+Default: `256`
+
+##### multi_header
+
+Decode headers into lists to allow handling of multiple values with the same key
+
+
+Type: `bool`
+Default: `false`
+
+##### batching
+
+Allows you to configure a [batching policy](/api-management/stream-config#batch-policy).
+
+Type: `object`
+
+```yml
+# Examples
+
+batching:
+  byte_size: 5000
+  count: 0
+  period: 1s
+
+batching:
+  count: 10
+  period: 1s
+
+batching:
+  check: this.contains("END BATCH")
+  count: 0
+  period: 1m
+```
+
+##### batching.count
+
+A number of messages at which the batch should be flushed. If `0` disables count based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.byte_size
+
+An amount of bytes at which the batch should be flushed. If `0` disables size based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.period
+
+A period in which an incomplete batch should be flushed regardless of its size.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+period: 1s
+
+period: 1m
+
+period: 500ms
+```
+
+##### batching.check
+
+A Bloblang query that should return a boolean value indicating whether a message should end a batch.
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+check: this.type == "end_of_transaction"
+```
+
+##### batching.processors
+
+A list of processors to apply to a batch as it is flushed. This allows you to aggregate and archive the batch however you see fit. Please note that all resulting messages are flushed as a single batch, therefore splitting the batch into smaller batches using these processors is a no-op.
+
+
+Type: `array`
+
+```yml
+# Examples
+
+processors:
+  - archive:
+      format: concatenate
+
+processors:
+  - archive:
+      format: lines
+
+processors:
+  - archive:
+      format: json_array
+```
+
+### MQTT
+Subscribe to topics on MQTT brokers.
+
+#### Common
+```yml
+# Common config fields, showing default values
+input:
+  label: ""
+  mqtt:
+    urls: [] # No default (required)
+    client_id: ""
+    connect_timeout: 30s
+    topics: [] # No default (required)
+    auto_replay_nacks: true
+```
+
+#### Advanced
+```yml
+# All config fields, showing default values
+input:
+  label: ""
+  mqtt:
+    urls: [] # No default (required)
+    client_id: ""
+    dynamic_client_id_suffix: "" # No default (optional)
+    connect_timeout: 30s
+    will:
+      enabled: false
+      qos: 0
+      retained: false
+      topic: ""
+      payload: ""
+    user: ""
+    password: ""
+    keepalive: 30
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+    topics: [] # No default (required)
+    qos: 1
+    clean_session: true
+    auto_replay_nacks: true
+```
+
+#### Metadata
+
+This input adds the following metadata fields to each message:
+
+``` text
+- mqtt_duplicate
+- mqtt_qos
+- mqtt_retained
+- mqtt_topic
+- mqtt_message_id
+```
+
+You can access these metadata fields using function interpolation.
+
+#### Fields
+
+##### urls
+
+A list of URLs to connect to. If an item of the list contains commas it will be expanded into multiple URLs.
+
+
+Type: `array`
+
+```yml
+# Examples
+
+urls:
+  - tcp://localhost:1883
+```
+
+##### client_id
+
+An identifier for the client connection.
+
+
+Type: `string`
+Default: `""`
+
+##### dynamic_client_id_suffix
+
+Append a dynamically generated suffix to the specified `client_id` on each run of the pipeline. This can be useful when clustering Streams producers.
+
+
+Type: `string`
+
+| Option | Summary |
+| :--- | :--- |
+| `nanoid` | append a nanoid of length 21 characters |
+
+
+##### connect_timeout
+
+The maximum amount of time to wait in order to establish a connection before the attempt is abandoned.
+
+
+Type: `string`
+Default: `"30s"`
+Requires version 1.0.0 or newer
+
+```yml
+# Examples
+
+connect_timeout: 1s
+
+connect_timeout: 500ms
+```
+
+##### will
+
+Set last will message in case of Streams failure
+
+
+Type: `object`
+
+##### will.enabled
+
+Whether to enable last will messages.
+
+
+Type: `bool`
+Default: `false`
+
+##### will.qos
+
+Set QoS for last will message. Valid values are: 0, 1, 2.
+
+
+Type: `int`
+Default: `0`
+
+##### will.retained
+
+Set retained for last will message.
+
+
+Type: `bool`
+Default: `false`
+
+##### will.topic
+
+Set topic for last will message.
+
+
+Type: `string`
+Default: `""`
+
+##### will.payload
+
+Set payload for last will message.
+
+
+Type: `string`
+Default: `""`
+
+##### user
+
+A username to connect with.
+
+
+Type: `string`
+Default: `""`
+
+##### password
+
+A password to connect with.
+
+
+Type: `string`
+Default: `""`
+
+##### keepalive
+
+Max seconds of inactivity before a keepalive message is sent.
+
+
+Type: `int`
+Default: `30`
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're seeing the error message `local error: tls: no renegotiation`.
+
+
+Type: `bool`
+Default: `false`
+Requires version 1.0.0 or newer
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified, but not both.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+client_certs:
+  - cert: foo
+    key: bar
+
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in PKCS#1 or PKCS#8 format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+password: foo
+
+password: ${KEY_PASSWORD}
+```
+
+##### topics
+
+A list of topics to consume from.
+
+
+Type: `array`
+
+##### qos
+
+The level of delivery guarantee to enforce. Has options 0, 1, 2.
+
+
+Type: `int`
+Default: `1`
+
+##### clean_session
+
+Set whether the connection is non-persistent.
+
+
+Type: `bool`
+Default: `true`
+
+##### auto_replay_nacks
+
+Whether messages that are rejected (nacked) at the output level should be automatically replayed indefinitely, eventually resulting in back pressure if the cause of the rejections is persistent. If set to `false` these messages will instead be deleted. Disabling auto replays can greatly improve memory efficiency of high throughput streams as the original shape of the data can be discarded immediately upon consumption and mutation.
+
+Type: `bool`
+Default: `true`
+
+
+### amqp_0_9
+
+Connects to an AMQP (0.91) queue. AMQP is a messaging protocol used by various message brokers, including RabbitMQ.
+
+#### Common
+
+```yaml
+# Common config fields, showing default values
+input:
+  label: ""
+  amqp_0_9:
+    urls: [] # No default (required)
+    queue: "" # No default (required)
+    consumer_tag: ""
+    prefetch_count: 10
+```
+
+#### Advanced
+
+```yaml
+# All config fields, showing default values
+input:
+  label: ""
+  amqp_0_9:
+    urls: [] # No default (required)
+    queue: "" # No default (required)
+    queue_declare:
+      enabled: false
+      durable: true
+      auto_delete: false
+    bindings_declare: [] # No default (optional)
+    consumer_tag: ""
+    auto_ack: false
+    nack_reject_patterns: []
+    prefetch_count: 10
+    prefetch_size: 0
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+```
+
+TLS is automatic when connecting to an `amqps` URL, but custom settings can be enabled in the `tls` section.
+
+#### Metadata
+
+This input adds the following metadata fields to each message:
+
+```
+- amqp_content_type
+- amqp_content_encoding
+- amqp_delivery_mode
+- amqp_priority
+- amqp_correlation_id
+- amqp_reply_to
+- amqp_expiration
+- amqp_message_id
+- amqp_timestamp
+- amqp_type
+- amqp_user_id
+- amqp_app_id
+- amqp_consumer_tag
+- amqp_delivery_tag
+- amqp_redelivered
+- amqp_exchange
+- amqp_routing_key
+```
+
+All existing message headers, including nested headers prefixed with the key of their respective parent, can be added.
+
+#### Fields
+
+##### urls
+
+A list of URLs to connect to. The first URL to successfully establish a connection will be used until the connection is closed. 
+If an item of the list contains commas, it will be expanded into multiple URLs.
+
+Type: `array`
+
+```yaml
+# Examples
+urls:
+  - amqp://guest:guest@127.0.0.1:5672/
+urls:
+  - amqp://127.0.0.1:5672/,amqp://127.0.0.2:5672/
+urls:
+  - amqp://127.0.0.1:5672/
+  - amqp://127.0.0.2:5672/
+```
+
+##### queue
+
+An AMQP queue to consume from.
+
+Type: `string`
+
+##### queue_declare
+
+Allows you to passively declare the target queue. If the queue already exists, then the declaration passively verifies that 
+they match the target fields.
+
+type: `object`
+
+##### queue_declare.enabled
+
+Whether to enable queue declaration.
+
+Type: `bool`
+Default: `false`
+
+##### queue_declare.durable
+
+Whether the declared queue is durable.
+
+Type: `bool`
+Default: `true`
+
+##### queue_declare.auto_delete
+
+Whether the declared queue will auto-delete.
+
+Type: `bool`
+Default: `false`
+
+##### bindings_declare
+
+Allows you to passively declare bindings for the target queue.
+
+Type: `array`
+
+```yaml
+# Examples
+bindings_declare:
+  - exchange: foo
+    key: bar
+```
+
+##### bindings_declare[].exchange
+
+The exchange of the declared binding.
+
+Type: `string`
+Default: `""`
+
+##### bindings_declare[].key
+
+The key of the declared binding.
+
+Type: `string`
+Default: `""`
+
+##### consumer_tag
+
+A consumer tag.
+
+Type: `string`
+Default: `""`
+
+##### auto_ack
+
+Acknowledge messages automatically as they are consumed rather than waiting for acknowledgments from downstream. 
+This can improve throughput and prevent the pipeline from blocking but at the cost of eliminating delivery guarantees.
+
+Type: `bool`
+Default: `false`
+
+##### nack_reject_patterns
+
+A list of regular expression patterns whereby if a message that has failed to be delivered by Bento has an error that matches 
+it will be dropped (or delivered to a dead-letter queue if one exists). By default, failed messages are nacked with requeue enabled.
+
+Type: `array`
+Default: `[]`
+
+```yaml
+# Examples
+nack_reject_patterns:
+  - ^reject me please:.+$
+```
+
+##### prefetch_count
+
+The maximum number of pending messages to have consumed at a time.
+
+Type: `int`
+Default: `10`
+
+##### prefetch_size
+
+The maximum number of pending messages measured in bytes to have consumed at a time.
+
+Type: `int`
+Default: `0`
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're getting the error message 
+`local error: tls: no renegotiation.`
+
+Type: `bool`
+Default: `false`
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate, 
+to possible intermediate signing certificates, to the host certificate.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing 
+a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host 
+certificate.
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified, 
+but not both.
+
+Type: `array`
+Default: `[]`
+
+```yaml
+# Examples
+client_certs:
+  - cert: foo
+    key: bar
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: ""
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in *PKCS#1* or *PKCS#8* format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not 
+supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an 
+attacker recover the plaintext.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+password: foo
+```
+
+
+
+### amqp_1
+
+Reads messages from an AMQP (1.0) server.
+
+#### Common
+
+```yaml
+# Common config fields, showing default values
+input:
+  label: ""
+  amqp_1:
+    urls: [] # No default (optional)
+    source_address: /foo # No default (required)
+```
+
+#### Advanced
+
+```yaml
+# All config fields, showing default values
+input:
+  label: ""
+  amqp_1:
+    urls: [] # No default (optional)
+    source_address: /foo # No default (required)
+    azure_renew_lock: false
+    read_header: false
+    credit: 64
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+    sasl:
+      mechanism: none
+      user: ""
+      password: ""
+```
+
+#### Metadata
+
+This input adds the following metadata fields to each message:
+
+```
+- amqp_content_type
+- amqp_content_encoding
+- amqp_creation_time
+- All string typed message annotations
+```
+
+You can access these metadata fields using function interpolation.
+
+By setting `read_header` to `true`, additional message header properties will be added to each message:
+
+```
+- amqp_durable
+- amqp_priority
+- amqp_ttl
+- amqp_first_acquirer
+- amqp_delivery_count
+```
+
+#### Performance
+
+This input benefits from receiving multiple messages in flight in parallel for improved performance. You can tune the max 
+number of in flight messages with the field `credit`.
+
+#### Fields
+
+##### urls
+
+A list of URLs to connect to. The first URL to successfully establish a connection will be used until the connection is closed. 
+If an item of the list contains commas it will be expanded into multiple URLs.
+
+Type: `array`
+
+```yaml
+# Examples
+urls:
+  - amqp://guest:guest@127.0.0.1:5672/
+urls:
+  - amqp://127.0.0.1:5672/,amqp://127.0.0.2:5672/
+urls:
+  - amqp://127.0.0.1:5672/
+  - amqp://127.0.0.2:5672/
+```
+
+##### source_address
+
+The source address to consume from.
+
+Type: `string`
+
+```yaml
+# Examples
+source_address: /foo
+source_address: queue:/bar
+source_address: topic:/baz
+```
+
+##### azure_renew_lock
+
+**Experimental:** Azure service bus specific option to renew lock if processing takes more then configured lock time.
+
+Type: `bool`
+Default: `false`
+
+##### read_header
+
+Read additional message header fields into `amqp_*` metadata properties.
+
+Type: `bool`
+Default: `false`
+
+##### credit
+
+Specifies the maximum number of unacknowledged messages the sender can transmit. Once this limit is reached, no more messages 
+will arrive until messages are acknowledged and settled.
+
+Type: `int`
+Default: `64`
+
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're getting the error message
+`local error: tls: no renegotiation.`
+
+Type: `bool`
+Default: `false`
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate,
+to possible intermediate signing certificates, to the host certificate.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing
+a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host
+certificate.
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified,
+but not both.
+
+Type: `array`
+Default: `[]`
+
+```yaml
+# Examples
+client_certs:
+  - cert: foo
+    key: bar
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: ""
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in *PKCS#1* or *PKCS#8* format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not
+supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an
+attacker recover the plaintext.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+password: foo
+```
+
+##### sasl
+
+Enables SASL authentication.
+
+Type: `object`
+
+##### sasl.mechanism
+
+The SASL authentication mechanism to use.
+
+Type: `string`
+Default: `"none"`
+
+| Option    | Summary                              |
+| :----------- | :-------------------------------------- |
+| anonymous | Anonymous SASL authentication.       |
+| none      | No SASL based authentication.        |
+| plain     | Plain text SASL authentication.      |
+
+
+##### sasl.user
+
+A SASL plain text username. It is recommended that you use environment variables to populate this field.
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+user: ${USER}
+```
+
+##### sasl.password
+
+A SASL plain text password. It is recommended that you use environment variables to populate this field.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+
+```yaml
+# Examples
+password: ${PASSWORD}
+```
+
+## Outputs
+
+### Overview
+
+An output is a sink where we wish to send our consumed data after applying an optional array of [processors](/api-management/stream-config#overview-3). Only one output is configured at the root of a Tyk Streams config. However, the output can be a [broker](/api-management/stream-config#broker-1) which combines multiple outputs under a chosen brokering pattern.
+
+An output config section looks like this:
+
+```yaml
+outout:
+  label: my_kafka_output
+
+  kafka:
+    addresses: [ localhost:9092 ]
+    topic: "foobar"
+
+  # Optional list of processing steps
+  processors:
+    - avro:
+        operator: from_json
+```
+
+#### Labels
+
+Outputs have an optional field `label` that can uniquely identify them in observability data such as logs.
+
+{/* TODO replace with this paragraph when determine if product supports metrics
+
+Outputs have an optional field `label` that can uniquely identify them in observability data such as metrics and logs. This can be useful when running configs with multiple outputs, otherwise their metrics labels will be generated based on their composition. For more information check out the [metrics documentation][metrics.about]. */}
+
+### Broker
+
+Allows you to route messages to multiple child outputs using a range of brokering [patterns](#patterns).
+
+#### Common
+
+```yml
+# Common config fields, showing default values
+output:
+  label: ""
+  broker:
+    pattern: fan_out
+    outputs: [] # No default (required)
+    batching:
+      count: 0
+      byte_size: 0
+      period: ""
+      check: ""
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+output:
+  label: ""
+  broker:
+    copies: 1
+    pattern: fan_out
+    outputs: [] # No default (required)
+    batching:
+      count: 0
+      byte_size: 0
+      period: ""
+      check: ""
+      processors: [] # No default (optional)
+```
+
+Processors can be listed to apply across individual outputs or all outputs:
+
+```yaml
+output:
+  broker:
+    pattern: fan_out
+    outputs:
+      - resource: foo
+      - resource: bar
+        # Processors only applied to messages sent to bar.
+        processors:
+          - resource: bar_processor
+
+  # Processors applied to messages sent to all brokered outputs.
+  processors:
+    - resource: general_processor
+```
+
+#### Fields
+
+##### copies
+
+The number of copies of each configured output to spawn.
+
+
+Type: `int`
+Default: `1`
+
+##### pattern
+
+The brokering pattern to use.
+
+
+Type: `string`
+Default: `"fan_out"`
+Options: `fan_out`, `fan_out_fail_fast`, `fan_out_sequential`, `fan_out_sequential_fail_fast`, `round_robin`, `greedy`.
+
+##### outputs
+
+A list of child outputs to broker.
+
+
+Type: `array`
+
+##### batching
+
+Allows you to configure a [batching policy](/api-management/stream-config#batch-policy).
+
+
+Type: `object`
+
+```yml
+# Examples
+
+batching:
+  byte_size: 5000
+  count: 0
+  period: 1s
+
+batching:
+  count: 10
+  period: 1s
+
+batching:
+  check: this.contains("END BATCH")
+  count: 0
+  period: 1m
+```
+
+##### batching.count
+
+A number of messages at which the batch should be flushed. If `0` disables count based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.byte_size
+
+An amount of bytes at which the batch should be flushed. If `0` disables size based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.period
+
+A period in which an incomplete batch should be flushed regardless of its size.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+period: 1s
+
+period: 1m
+
+period: 500ms
+```
+
+##### batching.check
+
+A Bloblang query that should return a boolean value indicating whether a message should end a batch.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+check: this.type == "end_of_transaction"
+```
+
+##### batching.processors
+
+A list of processors to apply to a batch as it is flushed. This allows you to aggregate and archive the batch however you see fit. Please note that all resulting messages are flushed as a single batch, therefore splitting the batch into smaller batches using these processors is a no-op.
+
+
+Type: `array`
+
+```yml
+# Examples
+
+processors:
+  - archive:
+      format: concatenate
+
+processors:
+  - archive:
+      format: lines
+
+processors:
+  - archive:
+      format: json_array
+```
+
+#### Patterns
+
+The broker pattern determines the way in which messages are allocated and can be chosen from the following:
+
+##### fan_out
+
+With the fan out pattern all outputs will be sent every message that passes through Tyk Streams in parallel.
+
+If an output applies back pressure it will block all subsequent messages, and if an output fails to send a message it will be retried continuously until completion or service shut down. This mechanism is in place in order to prevent one bad output from causing a larger retry loop that results in a good output from receiving unbounded message duplicates.
+
+##### fan_out_fail_fast
+
+The same as the `fan_out` pattern, except that output failures will not be automatically retried. This pattern should be used with caution as busy retry loops could result in unlimited duplicates being introduced into the non-failure outputs.
+
+##### fan_out_sequential
+
+Similar to the fan out pattern except outputs are written to sequentially, meaning an output is only written to once the preceding output has confirmed receipt of the same message.
+
+If an output applies back pressure it will block all subsequent messages, and if an output fails to send a message it will be retried continuously until completion or service shut down. This mechanism is in place in order to prevent one bad output from causing a larger retry loop that results in a good output from receiving unbounded message duplicates.
+
+##### fan_out_sequential_fail_fast
+
+The same as the `fan_out_sequential` pattern, except that output failures will not be automatically retried. This pattern should be used with caution as busy retry loops could result in unlimited duplicates being introduced into the non-failure outputs.
+
+##### round_robin
+
+With the round robin pattern each message will be assigned a single output following their order. If an output applies back pressure it will block all subsequent messages. If an output fails to send a message then the message will be re-attempted with the next input, and so on.
+
+##### greedy
+
+The greedy pattern results in higher output throughput at the cost of potentially disproportionate message allocations to those outputs. Each message is sent to a single output, which is determined by allowing outputs to claim messages as soon as they are able to process them. This results in certain faster outputs potentially processing more messages at the cost of slower outputs.
+
+
+### HTTP Client
+
+Sends messages to an HTTP server.
+
+#### Common
+
+```yml
+# Common config fields, showing default values
+output:
+  label: ""
+  http_client:
+    url: "" # No default (required)
+    verb: POST
+    headers: {}
+    timeout: 5s
+    max_in_flight: 64
+    batching:
+      count: 0
+      byte_size: 0
+      period: ""
+      check: ""
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+output:
+  label: ""
+  http_client:
+    url: "" # No default (required)
+    verb: POST
+    headers: {}
+    metadata:
+      include_prefixes: []
+      include_patterns: []
+    dump_request_log_level: ""
+    oauth:
+      enabled: false
+      consumer_key: ""
+      consumer_secret: ""
+      access_token: ""
+      access_token_secret: ""
+    oauth2:
+      enabled: false
+      client_key: ""
+      client_secret: ""
+      token_url: ""
+      scopes: []
+      endpoint_params: {}
+    basic_auth:
+      enabled: false
+      username: ""
+      password: ""
+    jwt:
+      enabled: false
+      private_key_file: ""
+      signing_method: ""
+      claims: {}
+      headers: {}
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+    extract_headers:
+      include_prefixes: []
+      include_patterns: []
+    timeout: 5s
+    retry_period: 1s
+    max_retry_backoff: 300s
+    retries: 3
+    backoff_on:
+      - 429
+    drop_on: []
+    successful_on: []
+    proxy_url: "" # No default (optional)
+    batch_as_multipart: false
+    propagate_response: false
+    max_in_flight: 64
+    batching:
+      count: 0
+      byte_size: 0
+      period: ""
+      check: ""
+      processors: [] # No default (optional)
+    multipart: []
+```
+
+When the number of retries expires the output will reject the message, the behavior after this will depend on the pipeline but usually this simply means the send is attempted again until successful whilst applying back pressure.
+
+{/* TODO: when interpolation supported
+The URL and header values of this type can be dynamically set using function interpolations. */}
+
+The body of the HTTP request is the raw contents of the message payload. If the message has multiple parts (is a batch) the request will be sent according to [RFC1341](https://www.w3.org/Protocols/rfc1341/7_2_Multipart.html). This behavior can be disabled by setting the field [batch_as_multipart](#batch_as_multipart) to `false`.
+
+##### Propagating Responses
+
+It's possible to propagate the response from each HTTP request back to the input source by setting `propagate_response` to `true`. Only inputs that support synchronous responses are able to make use of these propagated responses.
+
+#### Performance
+
+This output benefits from sending multiple messages in flight in parallel for improved performance. You can tune the max number of in flight messages (or message batches) with the field `max_in_flight`.
+
+This output benefits from sending messages as a [batch](/api-management/stream-config#batching-6) for improved performance. Batches can be formed at both the input and output level.
+
+#### Fields
+
+##### url
+
+The URL to connect to.
+{/* TODO: when interpolation supported
+This field supports interpolation functions. */}
+
+Type: `string`
+
+##### verb
+
+A verb to connect with
+
+
+Type: `string`
+Default: `"POST"`
+
+```yml
+# Examples
+
+verb: POST
+
+verb: GET
+
+verb: DELETE
+```
+
+##### headers
+
+A map of headers to add to the request.
+{/* TODO: when interpolation supported
+This field supports interpolation functions. */}
+
+
+Type: `object`
+Default: `{}`
+
+```yml
+# Examples
+
+headers:
+  Content-Type: application/octet-stream
+  traceparent: ${! tracing_span().traceparent }
+```
+
+##### metadata
+
+Specify optional matching rules to determine which metadata keys should be added to the HTTP request as headers.
+
+
+Type: `object`
+
+##### metadata.include_prefixes
+
+Provide a list of explicit metadata key prefixes to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_prefixes:
+  - foo_
+  - bar_
+
+include_prefixes:
+  - kafka_
+
+include_prefixes:
+  - content-
+```
+
+##### metadata.include_patterns
+
+Provide a list of explicit metadata key regular expression (re2) patterns to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_patterns:
+  - .*
+
+include_patterns:
+  - _timestamp_unix$
+```
+
+##### dump_request_log_level
+
+Optionally set a level at which the request and response payload of each request made will be logged.
+
+
+Type: `string`
+Default: `""`
+Options: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`, `FATAL`, ``.
+
+##### oauth
+
+Allows you to specify open authentication via OAuth version 1.
+
+
+Type: `object`
+
+##### oauth.enabled
+
+Whether to use OAuth version 1 in requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### oauth.consumer_key
+
+A value used to identify the client to the service provider.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth.consumer_secret
+
+A secret used to establish ownership of the consumer key.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth.access_token
+
+A value used to gain access to the protected resources on behalf of the user.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth.access_token_secret
+
+A secret provided in order to establish ownership of a given access token.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth2
+
+Allows you to specify open authentication via OAuth version 2 using the client credentials token flow.
+
+
+Type: `object`
+
+##### oauth2.enabled
+
+Whether to use OAuth version 2 in requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### oauth2.client_key
+
+A value used to identify the client to the token provider.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth2.client_secret
+
+A secret used to establish ownership of the client key.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth2.token_url
+
+The URL of the token provider.
+
+
+Type: `string`
+Default: `""`
+
+##### oauth2.scopes
+
+A list of optional requested permissions.
+
+
+Type: `array`
+Default: `[]`
+
+##### oauth2.endpoint_params
+
+A list of optional endpoint parameters, values should be arrays of strings.
+
+
+Type: `object`
+Default: `{}`
+
+```yml
+# Examples
+
+endpoint_params:
+  bar:
+    - woof
+  foo:
+    - meow
+    - quack
+```
+
+##### basic_auth
+
+Allows you to specify basic authentication.
+
+
+Type: `object`
+
+##### basic_auth.enabled
+
+Whether to use basic authentication in requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### basic_auth.username
+
+A username to authenticate as.
+
+
+Type: `string`
+Default: `""`
+
+##### basic_auth.password
+
+A password to authenticate with.
+
+
+Type: `string`
+Default: `""`
+
+##### jwt
+
+Allows you to specify JWT authentication.
+
+
+Type: `object`
+
+##### jwt.enabled
+
+Whether to use JWT authentication in requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### jwt.private_key_file
+
+A file with the PEM encoded via PKCS1 or PKCS8 as private key.
+
+
+Type: `string`
+Default: `""`
+
+##### jwt.signing_method
+
+A method used to sign the token such as RS256, RS384, RS512 or EdDSA.
+
+
+Type: `string`
+Default: `""`
+
+##### jwt.claims
+
+A value used to identify the claims that issued the JWT.
+
+
+Type: `object`
+Default: `{}`
+
+##### jwt.headers
+
+Add optional key/value headers to the JWT.
+
+
+Type: `object`
+Default: `{}`
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're seeing the error message `local error: tls: no renegotiation`.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified, but not both.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+client_certs:
+  - cert: foo
+    key: bar
+
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in PKCS#1 or PKCS#8 format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+password: foo
+```
+
+##### extract_headers
+
+Specify which response headers should be added to resulting synchronous response messages as metadata. Header keys are lowercased before matching, so ensure that your patterns target lowercased versions of the header keys that you expect. This field is not applicable unless `propagate_response` is set to `true`.
+
+
+Type: `object`
+
+##### extract_headers.include_prefixes
+
+Provide a list of explicit metadata key prefixes to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_prefixes:
+  - foo_
+  - bar_
+
+include_prefixes:
+  - kafka_
+
+include_prefixes:
+  - content-
+```
+
+##### extract_headers.include_patterns
+
+Provide a list of explicit metadata key regular expression (re2) patterns to match against.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+include_patterns:
+  - .*
+
+include_patterns:
+  - _timestamp_unix$
+```
+
+##### timeout
+
+A static timeout to apply to requests.
+
+
+Type: `string`
+Default: `"5s"`
+
+##### retry_period
+
+The base period to wait between failed requests.
+
+
+Type: `string`
+Default: `"1s"`
+
+##### max_retry_backoff
+
+The maximum period to wait between failed requests.
+
+
+Type: `string`
+Default: `"300s"`
+
+##### retries
+
+The maximum number of retry attempts to make.
+
+
+Type: `int`
+Default: `3`
+
+##### backoff_on
+
+A list of status codes whereby the request should be considered to have failed and retries should be attempted, but the period between them should be increased gradually.
+
+
+Type: `array`
+Default: `[429]`
+
+##### drop_on
+
+A list of status codes whereby the request should be considered to have failed but retries should not be attempted. This is useful for preventing wasted retries for requests that will never succeed. Note that with these status codes the _request_ is dropped, but _message_ that caused the request will not be dropped.
+
+
+Type: `array`
+Default: `[]`
+
+##### successful_on
+
+A list of status codes whereby the attempt should be considered successful, this is useful for dropping requests that return non-2XX codes indicating that the message has been dealt with, such as a 303 See Other or a 409 Conflict. All 2XX codes are considered successful unless they are present within `backoff_on` or `drop_on`, regardless of this field.
+
+
+Type: `array`
+Default: `[]`
+
+##### proxy_url
+
+An optional HTTP proxy URL.
+
+
+Type: `string`
+
+##### batch_as_multipart
+
+Send message batches as a single request using [RFC1341](https://www.w3.org/Protocols/rfc1341/7_2_Multipart.html). If disabled messages in batches will be sent as individual requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### propagate_response
+
+Whether responses from the server should be propagated back to the input.
+
+
+Type: `bool`
+Default: `false`
+
+##### max_in_flight
+
+The maximum number of parallel message batches to have in flight at any given time.
+
+
+Type: `int`
+Default: `64`
+
+##### batching
+
+Allows you to configure a [batching policy](/api-management/stream-config#batching-6).
+
+
+Type: `object`
+
+```yml
+# Examples
+
+batching:
+  byte_size: 5000
+  count: 0
+  period: 1s
+
+batching:
+  count: 10
+  period: 1s
+
+batching:
+  check: this.contains("END BATCH")
+  count: 0
+  period: 1m
+```
+
+##### batching.count
+
+A number of messages at which the batch should be flushed. If `0` disables count based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.byte_size
+
+An amount of bytes at which the batch should be flushed. If `0` disables size based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.period
+
+A period in which an incomplete batch should be flushed regardless of its size.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+period: 1s
+
+period: 1m
+
+period: 500ms
+```
+
+{/* TODO: when bloblang supported
+##### batching.check
+
+A Bloblang query that should return a boolean value indicating whether a message should end a batch.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+check: this.type == "end_of_transaction"
+``` */}
+
+##### batching.processors
+
+A list of processors to apply to a batch as it is flushed. This allows you to aggregate and archive the batch however you see fit. Please note that all resulting messages are flushed as a single batch, therefore splitting the batch into smaller batches using these processors is a no-op.
+
+
+Type: `array`
+
+```yml
+# Examples
+
+processors:
+  - archive:
+      format: concatenate
+
+processors:
+  - archive:
+      format: lines
+
+processors:
+  - archive:
+      format: json_array
+```
+
+##### multipart
+
+Create explicit multipart HTTP requests by specifying an array of parts to add to the request, each part specified consists of content headers and a data field that can be populated dynamically. If this field is populated it will override the default request creation behavior.
+
+
+Type: `array`
+Default: `[]`
+
+##### multipart[].content_type
+
+The content type of the individual message part.
+{/* TODO: when interpolation supported
+This field supports interpolation functions. */}
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+content_type: application/bin
+```
+
+##### multipart[].content_disposition
+
+The content disposition of the individual message part.
+{/* TODO: when interpolation supported
+This field supports interpolation functions. */}
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+content_disposition: form-data; name="bin"; filename='${! @AttachmentName }
+```
+
+##### multipart[].body
+
+The body of the individual message part.
+{/* TODO: when interpolation supported
+This field supports interpolation functions. */}
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+body: ${! this.data.part1 }
+```
+
+### HTTP Server
+
+Sets up an HTTP server that will send messages over HTTP(S) GET requests. HTTP 2.0 is supported when using TLS, which is enabled when key and cert files are specified.
+
+#### Common
+
+```yml
+# Common config fields, showing default values
+output:
+  label: ""
+  http_server:
+    address: ""
+    path: /get
+    stream_path: /get/stream
+    ws_path: /get/ws
+    allowed_verbs:
+      - GET
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+output:
+  label: ""
+  http_server:
+    address: ""
+    path: /get
+    stream_path: /get/stream
+    ws_path: /get/ws
+    allowed_verbs:
+      - GET
+    timeout: 5s
+    cert_file: ""
+    key_file: ""
+    cors:
+      enabled: false
+      allowed_origins: []
+```
+
+Sets up an HTTP server that will send messages over HTTP(S) GET requests.
+
+{/* TODO add link here  If the `address` config field is left blank the [service-wide HTTP server](/docs/components/http/about) will be used. */}
+
+Three endpoints will be registered at the paths specified by the fields `path`, `stream_path` and `ws_path`. Which allow you to consume a single message batch, a continuous stream of line delimited messages, or a websocket of messages for each request respectively.
+
+When messages are batched the `path` endpoint encodes the batch according to [RFC1341](https://www.w3.org/Protocols/rfc1341/7_2_Multipart.html).
+
+{/* TODO add link here - This behavior can be overridden by [archiving your batches](/docs/configuration/batching#post-batch-processing). */}
+
+Please note, messages are considered delivered as soon as the data is written to the client. There is no concept of at least once delivery on this output.
+
+Please note that components within a Tyk config will register their respective endpoints in a non-deterministic order. This means that establishing precedence of endpoints that are registered via multiple `http_server` inputs or outputs (either within brokers or from cohabiting streams) is not possible in a predictable way.
+
+This ambiguity makes it difficult to ensure that paths which are both a subset of a path registered by a separate component, and end in a slash (`/`) and will therefore match against all extensions of that path, do not prevent the more specific path from matching against requests.
+
+It is therefore recommended that you ensure paths of separate components do not collide unless they are explicitly non-competing.
+
+For example, if you were to deploy two separate `http_server` inputs, one with a path `/foo/` and the other with a path `/foo/bar`, it would not be possible to ensure that the path `/foo/` does not swallow requests made to `/foo/bar`.
+
+
+#### Fields
+
+##### address
+
+An alternative address to host from. If left empty the service wide address is used.
+
+
+Type: `string`
+Default: `""`
+
+##### path
+
+The path from which discrete messages can be consumed.
+
+
+Type: `string`
+Default: `"/get"`
+
+##### stream_path
+
+The path from which a continuous stream of messages can be consumed.
+
+
+Type: `string`
+Default: `"/get/stream"`
+
+##### ws_path
+
+The path from which websocket connections can be established.
+
+
+Type: `string`
+Default: `"/get/ws"`
+
+##### allowed_verbs
+
+An array of verbs that are allowed for the `path` and `stream_path` HTTP endpoint.
+
+
+Type: `array`
+Default: `["GET"]`
+
+##### timeout
+
+The maximum time to wait before a blocking, inactive connection is dropped (only applies to the `path` endpoint).
+
+
+Type: `string`
+Default: `"5s"`
+
+##### cert_file
+
+Enable TLS by specifying a certificate and key file. Only valid with a custom `address`.
+
+
+Type: `string`
+Default: `""`
+
+##### key_file
+
+Enable TLS by specifying a certificate and key file. Only valid with a custom `address`.
+
+
+Type: `string`
+Default: `""`
+
+##### cors
+
+Adds Cross-Origin Resource Sharing headers. Only valid with a custom `address`.
+
+
+Type: `object`
+
+##### cors.enabled
+
+Whether to allow CORS requests.
+
+
+Type: `bool`
+Default: `false`
+
+##### cors.allowed_origins
+
+An explicit list of origins that are allowed for CORS requests.
+
+
+Type: `array`
+Default: `[]`
+
+
+
+### Kafka
+
+The kafka output type writes a batch of messages to Kafka brokers and waits for acknowledgment before propagating it back to the input.
+
+#### Common
+
+```yml
+# Common config fields, showing default values
+output:
+  label: ""
+  kafka:
+    addresses: [] # No default (required)
+    topic: "" # No default (required)
+    target_version: 2.1.0 # No default (optional)
+    key: ""
+    partitioner: fnv1a_hash
+    compression: none
+    static_headers: {} # No default (optional)
+    metadata:
+      exclude_prefixes: []
+    max_in_flight: 64
+    batching:
+      count: 0
+      byte_size: 0
+      period: ""
+      check: ""
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+output:
+  label: ""
+  kafka:
+    addresses: [] # No default (required)
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+    sasl:
+      mechanism: none
+      user: ""
+      password: ""
+      access_token: ""
+      token_cache: ""
+      token_key: ""
+    topic: "" # No default (required)
+    client_id: tyk
+    target_version: 2.1.0 # No default (optional)
+    rack_id: ""
+    key: ""
+    partitioner: fnv1a_hash
+    partition: ""
+    custom_topic_creation:
+      enabled: false
+      partitions: -1
+      replication_factor: -1
+    compression: none
+    static_headers: {} # No default (optional)
+    metadata:
+      exclude_prefixes: []
+    inject_tracing_map: meta = @.merge(this) # No default (optional)
+    max_in_flight: 64
+    idempotent_write: false
+    ack_replicas: false
+    max_msg_bytes: 1000000
+    timeout: 5s
+    retry_as_batch: false
+    batching:
+      count: 0
+      byte_size: 0
+      period: ""
+      check: ""
+      processors: [] # No default (optional)
+    max_retries: 0
+    backoff:
+      initial_interval: 3s
+      max_interval: 10s
+      max_elapsed_time: 30s
+```
+
+The config field `ack_replicas` determines whether we wait for acknowledgment from all replicas or just a single broker.
+
+{/* Add links to bloblang queries : Both the `key` and `topic` fields can be dynamically set using function interpolations. */}
+
+Metadata will be added to each message sent as headers (version 0.11+), but can be restricted using the field [metadata](#metadata).
+
+##### Strict Ordering and Retries
+
+When strict ordering is required for messages written to topic partitions it is important to ensure that both the field `max_in_flight` is set to `1` and that the field `retry_as_batch` is set to `true`.
+
+You must also ensure that failed batches are never rerouted back to the same output. This can be done by setting the field `max_retries` to `0` and `backoff.max_elapsed_time` to empty, which will apply back pressure indefinitely until the batch is sent successfully.
+
+{/* TODO: Add link to fallback broker */}
+However, this also means that manual intervention will eventually be required in cases where the batch cannot be sent due to configuration problems such as an incorrect `max_msg_bytes` estimate. A less strict but automated alternative would be to route failed batches to a dead letter queue using a `fallback` broker, but this would allow subsequent batches to be delivered in the meantime whilst those failed batches are dealt with.
+
+##### Troubleshooting
+
+- I'm seeing logs that report `Failed to connect to kafka: kafka: client has run out of available brokers to talk to (Is your cluster reachable?)`, but the brokers are definitely reachable.
+
+Unfortunately this error message will appear for a wide range of connection problems even when the broker endpoint can be reached. Double check your authentication configuration and also ensure that you have [enabled TLS](#tlsenabled) if applicable.
+
+#### Performance
+
+This output benefits from sending multiple messages in flight in parallel for improved performance. You can tune the max number of in flight messages (or message batches) with the field `max_in_flight`.
+
+This output benefits from sending messages as a [batch](/api-management/stream-config#batching-6) for improved performance. Batches can be formed at both the input and output level.
+
+#### Fields
+
+##### addresses
+
+A list of broker addresses to connect to. If an item of the list contains commas it will be expanded into multiple addresses.
+
+
+Type: `array`
+
+```yml
+# Examples
+
+addresses:
+  - localhost:9092
+
+addresses:
+  - localhost:9041,localhost:9042
+
+addresses:
+  - localhost:9041
+  - localhost:9042
+```
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're seeing the error message `local error: tls: no renegotiation`.
+
+
+Type: `bool`
+Default: `false`
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified, but not both.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+client_certs:
+  - cert: foo
+    key: bar
+
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in PKCS#1 or PKCS#8 format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Example
+
+password: foo
+```
+
+{/* When Tyk streams with secrets released include this in above example => password: ${KEY_PASSWORD} */}
+
+##### sasl
+
+Enables SASL authentication.
+
+
+Type: `object`
+
+##### sasl.mechanism
+
+The SASL authentication mechanism, if left empty SASL authentication is not used.
+
+
+Type: `string`
+Default: `"none"`
+
+| Option | Summary |
+| :--- | :--- |
+| `OAUTHBEARER` | OAuth Bearer based authentication. |
+| `PLAIN` | Plain text authentication. NOTE: When using plain text auth it is extremely likely that you'll also need to [enable TLS](#tlsenabled). |
+| `SCRAM-SHA-256` | Authentication using the SCRAM-SHA-256 mechanism. |
+| `SCRAM-SHA-512` | Authentication using the SCRAM-SHA-512 mechanism. |
+| `none` | Default, no SASL authentication. |
+
+
+##### sasl.user
+
+A PLAIN username. It is recommended that you use environment variables to populate this field.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+user: ${USER}
+```
+
+##### sasl.password
+
+A PLAIN password. It is recommended that you use environment variables to populate this field.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+password: ${PASSWORD}
+```
+
+##### sasl.access_token
+
+A static OAUTHBEARER access token
+
+
+Type: `string`
+Default: `""`
+
+##### sasl.token_cache
+
+Instead of using a static `access_token` allows you to query a `cache` resource to fetch OAUTHBEARER tokens from
+{/* TODO: add cache resource link */}
+
+Type: `string`
+Default: `""`
+
+##### sasl.token_key
+
+Required when using a `token_cache`, the key to query the cache with for tokens.
+
+
+Type: `string`
+Default: `""`
+
+##### topic
+
+The topic to publish messages to.
+{/* TODO: when interpolation supported
+This field supports interpolation functions. */}
+
+
+Type: `string`
+
+##### client_id
+
+An identifier for the client connection.
+
+
+Type: `string`
+Default: `"tyk"`
+
+##### target_version
+
+The version of the Kafka protocol to use. This limits the capabilities used by the client and should ideally match the version of your brokers. Defaults to the oldest supported stable version.
+
+
+Type: `string`
+
+```yml
+# Examples
+
+target_version: 2.1.0
+
+target_version: 3.1.0
+```
+
+##### rack_id
+
+A rack identifier for this client.
+
+
+Type: `string`
+Default: `""`
+
+##### key
+
+The key to publish messages with.
+{/* TODO: when interpolation supported
+This field supports interpolation functions. */}
+
+
+Type: `string`
+Default: `""`
+
+##### partitioner
+
+The partitioning algorithm to use.
+
+
+Type: `string`
+Default: `"fnv1a_hash"`
+Options: `fnv1a_hash`, `murmur2_hash`, `random`, `round_robin`, `manual`.
+
+##### partition
+
+The manually-specified partition to publish messages to, relevant only when the field `partitioner` is set to `manual`. Must be able to parse as a 32-bit integer.
+{/* TODO: when interpolation supported
+This field supports interpolation functions. */}
+
+
+Type: `string`
+Default: `""`
+
+##### custom_topic_creation
+
+If enabled, topics will be created with the specified number of partitions and replication factor if they do not already exist.
+
+
+Type: `object`
+
+##### custom_topic_creation.enabled
+
+Whether to enable custom topic creation.
+
+
+Type: `bool`
+Default: `false`
+
+##### custom_topic_creation.partitions
+
+The number of partitions to create for new topics. Leave at -1 to use the broker configured default. Must `be >= 1`.
+
+
+Type: `int`
+Default: `-1`
+
+##### custom_topic_creation.replication_factor
+
+The replication factor to use for new topics. Leave at -1 to use the broker configured default. Must be an odd number, and less then or equal to the number of brokers.
+
+
+Type: `int`
+Default: `-1`
+
+##### compression
+
+The compression algorithm to use.
+
+
+Type: `string`
+Default: `"none"`
+Options: `none`, `snappy`, `lz4`, `gzip`, `zstd`.
+
+##### static_headers
+
+An optional map of static headers that should be added to messages in addition to metadata.
+
+
+Type: `object`
+
+```yml
+# Examples
+
+static_headers:
+  first-static-header: value-1
+  second-static-header: value-2
+```
+
+##### metadata
+
+Specify criteria for which metadata values are sent with messages as headers.
+
+
+Type: `object`
+
+##### metadata.exclude_prefixes
+
+Provide a list of explicit metadata key prefixes to be excluded when adding metadata to sent messages.
+
+
+Type: `array`
+Default: `[]`
+
+##### inject_tracing_map
+
+A Bloblang mapping used to inject an object containing tracing propagation information into outbound messages. The specification of the injected fields will match the format used by the service wide tracer.
+
+
+Type: `string`
+Requires version 3.45.0 or newer
+
+```yml
+# Examples
+
+inject_tracing_map: meta = @.merge(this)
+
+inject_tracing_map: root.meta.span = this
+```
+
+##### max_in_flight
+
+The maximum number of messages to have in flight at a given time. Increase this to improve throughput.
+
+
+Type: `int`
+Default: `64`
+
+##### idempotent_write
+
+Enable the idempotent write producer option. This requires the `IDEMPOTENT_WRITE` permission on `CLUSTER` and can be disabled if this permission is not available.
+
+
+Type: `bool`
+Default: `false`
+
+##### ack_replicas
+
+Ensure that messages have been copied across all replicas before acknowledging receipt.
+
+
+Type: `bool`
+Default: `false`
+
+##### max_msg_bytes
+
+The maximum size in bytes of messages sent to the target topic.
+
+
+Type: `int`
+Default: `1000000`
+
+##### timeout
+
+The maximum period of time to wait for message sends before abandoning the request and retrying.
+
+
+Type: `string`
+Default: `"5s"`
+
+##### retry_as_batch
+
+When enabled forces an entire batch of messages to be retried if any individual message fails on a send, otherwise only the individual messages that failed are retried. Disabling this helps to reduce message duplicates during intermittent errors, but also makes it impossible to guarantee strict ordering of messages.
+
+
+Type: `bool`
+Default: `false`
+
+##### batching
+
+Allows you to configure a [batching policy](/api-management/stream-config#batch-policy).
+
+
+Type: `object`
+
+```yml
+# Examples
+
+batching:
+  byte_size: 5000
+  count: 0
+  period: 1s
+
+batching:
+  count: 10
+  period: 1s
+
+batching:
+  check: this.contains("END BATCH")
+  count: 0
+  period: 1m
+```
+
+##### batching.count
+
+A number of messages at which the batch should be flushed. If `0` disables count based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.byte_size
+
+An amount of bytes at which the batch should be flushed. If `0` disables size based batching.
+
+
+Type: `int`
+Default: `0`
+
+##### batching.period
+
+A period in which an incomplete batch should be flushed regardless of its size.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+period: 1s
+
+period: 1m
+
+period: 500ms
+```
+
+##### batching.check
+
+A Bloblang query that should return a boolean value indicating whether a message should end a batch.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+check: this.type == "end_of_transaction"
+```
+
+##### batching.processors
+
+{/* TODO: add list of processors link */}
+
+A list of processors to apply to a batch as it is flushed. This allows you to aggregate and archive the batch however you see fit. Please note that all resulting messages are flushed as a single batch, therefore splitting the batch into smaller batches using these processors is a no-op.
+
+
+Type: `array`
+
+```yml
+# Examples
+
+processors:
+  - archive:
+      format: concatenate
+
+processors:
+  - archive:
+      format: lines
+
+processors:
+  - archive:
+      format: json_array
+```
+
+##### max_retries
+
+The maximum number of retries before giving up on the request. If set to zero there is no discrete limit.
+
+
+Type: `int`
+Default: `0`
+
+##### backoff
+
+Control time intervals between retry attempts.
+
+
+Type: `object`
+
+##### backoff.initial_interval
+
+The initial period to wait between retry attempts.
+
+
+Type: `string`
+Default: `"3s"`
+
+```yml
+# Examples
+
+initial_interval: 50ms
+
+initial_interval: 1s
+```
+
+##### backoff.max_interval
+
+The maximum period to wait between retry attempts
+
+
+Type: `string`
+Default: `"10s"`
+
+```yml
+# Examples
+
+max_interval: 5s
+
+max_interval: 1m
+```
+
+##### backoff.max_elapsed_time
+
+The maximum overall period of time to spend on retry attempts before the request is aborted. Setting this value to a zeroed duration (such as `0s`) will result in unbounded retries.
+
+
+Type: `string`
+Default: `"30s"`
+
+```yml
+# Examples
+
+max_elapsed_time: 1m
+
+max_elapsed_time: 1h
+```
+
+### MQTT
+Pushes messages to an MQTT broker.
+
+The topic field can be dynamically set using function interpolations described here. When sending batched messages these interpolations are performed per message part.
+
+#### Common
+```yml
+# Common config fields, showing default values
+output:
+  label: ""
+  mqtt:
+    urls: [] # No default (required)
+    client_id: ""
+    connect_timeout: 30s
+    topic: "" # No default (required)
+    qos: 1
+    write_timeout: 3s
+    retained: false
+    max_in_flight: 64
+```
+
+#### Advanced
+```yml
+# All config fields, showing default values
+output:
+  label: ""
+  mqtt:
+    urls: [] # No default (required)
+    client_id: ""
+    dynamic_client_id_suffix: "" # No default (optional)
+    connect_timeout: 30s
+    will:
+      enabled: false
+      qos: 0
+      retained: false
+      topic: ""
+      payload: ""
+    user: ""
+    password: ""
+    keepalive: 30
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+    topic: "" # No default (required)
+    qos: 1
+    write_timeout: 3s
+    retained: false
+    retained_interpolated: "" # No default (optional)
+    max_in_flight: 64
+```
+
+#### Performance
+
+This output benefits from sending multiple messages in flight in parallel for improved performance. You can tune the max number of in flight messages (or message batches) with the field `max_in_flight`.
+
+#### Fields
+
+##### urls
+
+A list of URLs to connect to. If an item of the list contains commas it will be expanded into multiple URLs.
+
+
+Type: `array`
+
+```yml
+# Examples
+
+urls:
+  - tcp://localhost:1883
+```
+
+##### client_id
+
+An identifier for the client connection.
+
+
+Type: `string`
+Default: `""`
+
+##### dynamic_client_id_suffix
+
+Append a dynamically generated suffix to the specified `client_id` on each run of the pipeline. This can be useful when clustering Streams producers.
+
+
+Type: `string`
+
+| Option | Summary |
+| :--- | :--- |
+| `nanoid` | append a nanoid of length 21 characters |
+
+
+##### connect_timeout
+
+The maximum amount of time to wait in order to establish a connection before the attempt is abandoned.
+
+
+Type: `string`
+Default: `"30s"`
+Requires version 1.0.0 or newer
+
+```yml
+# Examples
+
+connect_timeout: 1s
+
+connect_timeout: 500ms
+```
+
+##### will
+
+Set last will message in case of Streams failure
+
+
+Type: `object`
+
+##### will.enabled
+
+Whether to enable last will messages.
+
+
+Type: `bool`
+Default: `false`
+
+##### will.qos
+
+Set QoS for last will message. Valid values are: 0, 1, 2.
+
+
+Type: `int`
+Default: `0`
+
+##### will.retained
+
+Set retained for last will message.
+
+
+Type: `bool`
+Default: `false`
+
+##### will.topic
+
+Set topic for last will message.
+
+
+Type: `string`
+Default: `""`
+
+##### will.payload
+
+Set payload for last will message.
+
+
+Type: `string`
+Default: `""`
+
+##### user
+
+A username to connect with.
+
+
+Type: `string`
+Default: `""`
+
+##### password
+
+A password to connect with.
+
+
+Type: `string`
+Default: `""`
+
+##### keepalive
+
+Max seconds of inactivity before a keepalive message is sent.
+
+
+Type: `int`
+Default: `30`
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're seeing the error message `local error: tls: no renegotiation`.
+
+
+Type: `bool`
+Default: `false`
+Requires version 1.0.0 or newer
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified, but not both.
+
+
+Type: `array`
+Default: `[]`
+
+```yml
+# Examples
+
+client_certs:
+  - cert: foo
+    key: bar
+
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in PKCS#1 or PKCS#8 format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+password: foo
+
+password: ${KEY_PASSWORD}
+```
+
+##### topic
+
+The topic to publish messages to.
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+
+Type: `string`
+
+##### qos
+
+The QoS value to set for each message. Has options 0, 1, 2.
+
+
+Type: `int`
+Default: `1`
+
+##### write_timeout
+
+The maximum amount of time to wait to write data before the attempt is abandoned.
+
+
+Type: `string`
+Default: `"3s"`
+Requires version 1.0.0 or newer
+
+```yml
+# Examples
+
+write_timeout: 1s
+
+write_timeout: 500ms
+```
+
+##### retained
+
+Set message as retained on the topic.
+
+
+Type: `bool`
+Default: `false`
+
+##### retained_interpolated
+
+Override the value of `retained` with an interpolable value, this allows it to be dynamically set based on message contents. The value must resolve to either `true` or `false`.
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+
+Type: `string`
+Requires version 1.0.0 or newer
+
+##### max_in_flight
+
+The maximum number of messages to have in flight at a given time. Increase this to improve throughput.
+
+
+Type: `int`
+Default: `64`
+
+
+### amqp_0_9
+
+Sends messages to an AMQP (0.91) exchange. AMQP is a messaging protocol used by various message brokers, 
+including RabbitMQ.
+
+#### Common
+
+```yaml
+# Common config fields, showing default values
+output:
+  label: ""
+  amqp_0_9:
+    urls: [] # No default (required)
+    exchange: "" # No default (required)
+    key: ""
+    type: ""
+    metadata:
+      exclude_prefixes: []
+    max_in_flight: 64
+```
+
+#### Advanced
+
+```yaml
+# All config fields, showing default values
+output:
+  label: ""
+  amqp_0_9:
+    urls: [] # No default (required)
+    exchange: "" # No default (required)
+    exchange_declare:
+      enabled: false
+      type: direct
+      durable: true
+    key: ""
+    type: ""
+    content_type: application/octet-stream
+    content_encoding: ""
+    correlation_id: ""
+    reply_to: ""
+    expiration: ""
+    message_id: ""
+    user_id: ""
+    app_id: ""
+    metadata:
+      exclude_prefixes: []
+    priority: ""
+    max_in_flight: 64
+    persistent: false
+    mandatory: false
+    immediate: false
+    timeout: ""
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+```
+
+#### Metadata
+
+The metadata from each message is delivered as headers.
+
+It's possible for this output type to create the target exchange by setting `exchange_declare.enabled` to `true`, if the exchange 
+already exists then the declaration passively verifies that the settings match.
+
+TLS is automatic when connecting to an `amqps` URL, but custom settings can be enabled in the `tls` section.
+
+#### Fields
+
+##### urls
+
+A list of URLs to connect to. The first URL to successfully establish a connection will be used until the connection is closed. 
+If an item of the list contains commas, it will be expanded into multiple URLs.
+
+Type: `array`
+
+```yaml
+# Examples
+urls:
+  - amqp://guest:guest@127.0.0.1:5672/
+urls:
+  - amqp://127.0.0.1:5672/,amqp://127.0.0.2:5672/
+urls:
+  - amqp://127.0.0.1:5672/
+  - amqp://127.0.0.2:5672/
+```
+
+##### exchange
+
+An AMQP exchange to publish to. 
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+
+##### exchange_declare
+
+Optionally declare the target exchange (passive).
+
+Type: `object`
+
+##### exchange_declare.enabled
+
+Whether to declare the exchange.
+
+Type: `bool`
+Default: `false`
+
+##### exchange_declare.type
+
+The type of the exchange.
+
+Type: `string`
+Default: `"direct"`
+Options: `direct`, `fanout`, `topic`, `x-custom`
+
+##### exchange_declare.durable
+
+Whether the exchange should be durable.
+
+Type: `bool`
+Default: `true`
+
+
+##### key
+
+The binding key to set for each message. 
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+##### type
+
+The type property to set for each message. 
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+##### content_type
+
+The content type attribute to set for each message. 
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `application/octet-stream`
+
+##### content_encoding
+
+The content encoding attribute to set for each message. 
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+##### correlation_id
+
+Set the correlation ID of each message with a dynamic interpolated expression. 
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+##### reply_to
+
+Carries response queue name - set with a dynamic interpolated expression. 
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+##### expiration
+
+Set the per-message TTL. 
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+##### message_id
+
+Set the message ID of each message with a dynamic interpolated expression. 
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+##### user_id
+
+Set the user ID to the name of the publisher. If this property is set by a publisher, its value must be equal to the name 
+of the user used to open the connection.
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+##### app_id
+
+Set the application ID of each message with a dynamic interpolated expression.
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+##### metadata
+
+Specify criteria for which metadata values are attached to messages as headers.
+
+Type: `object`
+
+##### metadata.exclude_prefixes
+
+Provide a list of explicit metadata key prefixes to be excluded when adding metadata to sent messages.
+
+Type: `array`
+Default: `[]`
+
+##### priority
+
+Set the priority of each message with a dynamic interpolated expression.
+{/* TODO: when interpolation supported:
+This field supports interpolation functions. */}
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+priority: "0"
+priority: ${! metadata("amqp_priority") }
+priority: ${! json("doc.priority") }
+```
+
+##### max_in_flight
+
+The maximum number of messages to have in flight at a given time. Increase this to improve throughput.
+
+Type: `int`
+Default: `64`
+
+##### persistent
+
+Whether message delivery should be persistent (transient by default).
+
+Type: `bool`
+Default: `false`
+
+##### mandatory
+
+Whether to set the mandatory flag on published messages. When set if a published message is routed to zero queues, it is returned.
+
+Type: `bool`
+Default: `false`
+
+##### immediate
+
+Whether to set the immediate flag on published messages. When set if there are no ready consumers of a queue, then the message is dropped instead of waiting.
+
+Type: `bool`
+Default: `false`
+
+##### timeout
+
+The maximum period to wait before abandoning it and reattempting. If not set, wait indefinitely.
+
+Type: `string`
+Default: `""`
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're getting the error message
+`local error: tls: no renegotiation.`
+
+Type: `bool`
+Default: `false`
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate,
+to possible intermediate signing certificates, to the host certificate.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing
+a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host
+certificate.
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified,
+but not both.
+
+Type: `array`
+Default: `[]`
+
+```yaml
+# Examples
+client_certs:
+  - cert: foo
+    key: bar
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in *PKCS#1* or *PKCS#8* format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not
+supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an
+attacker recover the plaintext.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+password: foo
+```
+
+### amqp_1
+
+Sends messages to an AMQP (1.0) server.
+
+#### Common
+
+```yaml
+# Common config fields, showing default values
+output:
+  label: ""
+  amqp_1:
+    urls: [] # No default (optional)
+    target_address: /foo # No default (required)
+    max_in_flight: 64
+    metadata:
+      exclude_prefixes: []
+```
+
+#### Advanced
+
+```yaml
+# All config fields, showing default values
+output:
+  label: ""
+  amqp_1:
+    urls: [] # No default (optional)
+    target_address: /foo # No default (required)
+    max_in_flight: 64
+    tls:
+      enabled: false
+      skip_cert_verify: false
+      enable_renegotiation: false
+      root_cas: ""
+      root_cas_file: ""
+      client_certs: []
+    application_properties_map: "" # No default (optional)
+    sasl:
+      mechanism: none
+      user: ""
+      password: ""
+    metadata:
+      exclude_prefixes: []
+```
+
+#### Metadata
+
+Message metadata is added to each AMQP message as string annotations. To control which metadata keys are added, use the `metadata` config field.
+
+#### Performance
+
+This output benefits from sending multiple messages in flight in parallel for improved performance. You can tune the max number of in flight 
+messages (or message batches) with the field `max_in_flight`.
+
+
+#### Fields
+
+##### urls
+
+A list of URLs to connect to. The first URL to successfully establish a connection will be used until the connection is closed. 
+If an item of the list contains commas it will be expanded into multiple URLs.
+
+Type: `array`
+
+```yaml
+# Examples
+urls:
+  - amqp://guest:guest@127.0.0.1:5672/
+urls:
+  - amqp://127.0.0.1:5672/,amqp://127.0.0.2:5672/
+urls:
+  - amqp://127.0.0.1:5672/
+  - amqp://127.0.0.2:5672/
+```
+
+##### target_address
+
+The target address to write to.
+
+Type: `string`
+
+```yaml
+# Examples
+target_address: /foo
+target_address: queue:/bar
+target_address: topic:/baz
+```
+
+##### max_in_flight
+
+The maximum number of messages to have in flight at a given time. Increase this to improve throughput.
+
+Type: `int`
+Default: `64`
+
+##### tls
+
+Custom TLS settings can be used to override system defaults.
+
+Type: `object`
+
+##### tls.enabled
+
+Whether custom TLS settings are enabled.
+
+Type: `bool`
+Default: `false`
+
+##### tls.skip_cert_verify
+
+Whether to skip server side certificate verification.
+
+Type: `bool`
+Default: `false`
+
+##### tls.enable_renegotiation
+
+Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you're getting the error message
+`local error: tls: no renegotiation.`
+
+Type: `bool`
+Default: `false`
+
+##### tls.root_cas
+
+An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate,
+to possible intermediate signing certificates, to the host certificate.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+root_cas: |-
+  -----BEGIN CERTIFICATE-----
+  ...
+  -----END CERTIFICATE-----
+```
+
+##### tls.root_cas_file
+
+An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing
+a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host
+certificate.
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+root_cas_file: ./root_cas.pem
+```
+
+##### tls.client_certs
+
+A list of client certificates to use. For each certificate either the fields `cert` and `key`, or `cert_file` and `key_file` should be specified,
+but not both.
+
+Type: `array`
+Default: `[]`
+
+```yaml
+# Examples
+client_certs:
+  - cert: foo
+    key: bar
+client_certs:
+  - cert_file: ./example.pem
+    key_file: ./example.key
+```
+
+##### tls.client_certs[].cert
+
+A plain text certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key
+
+A plain text certificate key to use.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].cert_file
+
+The path of a certificate to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].key_file
+
+The path of a certificate key to use.
+
+Type: `string`
+Default: `""`
+
+##### tls.client_certs[].password
+
+A plain text password for when the private key is password encrypted in *PKCS#1* or *PKCS#8* format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not
+supported for the PKCS#8 format. Warning: Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an
+attacker recover the plaintext.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+password: foo
+```
+
+##### application_properties_map
+
+An optional Bloblang mapping that can be defined to set the `application-properties` on output messages.
+
+Type: `string`
+
+##### sasl
+
+Enables SASL authentication.
+
+Type: `object`
+
+##### sasl.mechanism
+
+The SASL authentication mechanism to use.
+
+Type: `string`
+Default: `"none"`
+
+| Option    | Summary                              |
+| :----------- | :-------------------------------------- |
+| anonymous | Anonymous SASL authentication.       |
+| none      | No SASL based authentication.        |
+| plain     | Plain text SASL authentication.      |
+
+
+##### sasl.user
+
+A SASL plain text username. It is recommended that you use environment variables to populate this field.
+
+Type: `string`
+Default: `""`
+
+```yaml
+# Examples
+user: ${USER}
+```
+
+##### sasl.password
+
+A SASL plain text password. It is recommended that you use environment variables to populate this field.
+{/* TODO add secrets link :::warning Secret
+This field contains sensitive information that usually shouldn't be added to a config directly, read our [secrets page for more info](/docs/configuration/secrets).
+::: */}
+
+Type: `string`
+Default: `""`
+
+
+```yaml
+# Examples
+password: ${PASSWORD}
+```
+
+##### metadata
+
+Specify criteria for which metadata values are attached to messages as headers.
+
+Type: `object`
+
+##### metadata.exclude_prefixes
+
+Provide a list of explicit metadata key prefixes to be excluded when adding metadata to sent messages.
+
+Type: `array`
+Default: `[]`
+
+## Processors
+
+### Overview
+
+Tyk Streams processors are functions applied to messages passing through a pipeline.
+
+Processors are set via config, and depending on where in the config they are placed they will be run either immediately after a specific input (set in the input section), on all messages (set in the pipeline section) or before a specific output (set in the output section). Most processors apply to all messages and can be placed in the pipeline section:
+
+```yaml
+pipeline:
+  threads: 1
+  processors:
+    - label: my_avro
+      avro:
+        operator: "to_json"
+        encoding: textual
+```
+
+The `threads` field in the pipeline section determines how many parallel processing threads are created. You can read more about parallel processing in the [pipeline guide](/api-management/stream-config#processing-pipelines).
+
+#### Labels
+
+{/* TODO: Replace paragraph below in subsequent iteration when know if metrics supported from product
+
+Processors have an optional field `label` that can uniquely identify them in observability data such as metrics and logs. This can be useful when running configs with multiple nested processors, otherwise their metrics labels will be generated based on their composition. For more information check out the [metrics documentation]. */}
+
+Processors have an optional field `label` that can uniquely identify them in observability data such as logs.
+
+### Avro
+
+```yml
+# Config fields, with default values
+label: ""
+avro:
+  operator: "" # No default (required)
+  encoding: textual
+  schema: ""
+  schema_path: ""
+```
+
+
+<Warning>
+**Note**
+
+If you are consuming or generating messages using a schema registry service then it is likely this processor will fail as those services require messages to be prefixed with the identifier of the schema version being used.
+</Warning>
+
+
+#### Operators
+
+##### to_json
+
+Converts Avro documents into a JSON structure. This makes it easier to
+manipulate the contents of the document within Tyk Streams. The encoding field
+specifies how the source documents are encoded.
+
+
+##### from_json
+
+Attempts to convert JSON documents into Avro documents according to the
+specified encoding.
+
+#### Fields
+
+##### operator
+
+The [operator](#operators) to execute
+
+
+Type: `string`
+Options: `to_json`, `from_json`.
+
+##### encoding
+
+An Avro encoding format to use for conversions to and from a schema.
+
+
+Type: `string`
+Default: `"textual"`
+Options: `textual`, `binary`, `single`.
+
+##### schema
+
+A full Avro schema to use.
+
+
+Type: `string`
+Default: `""`
+
+##### schema_path
+
+The path of a schema document to apply. Use either this or the `schema` field.
+
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+schema_path: file://path/to/spec.avsc
+
+schema_path: http://localhost:8081/path/to/spec/versions/1
+```
+
+### Mapping
+
+Executes a Bloblang mapping on messages, creating a new document that replaces (or filters) the original message.
+
+Bloblang is a powerful language that enables various mapping, transformation, and filtering tasks. For more information, check out the [Bloblang docs](https://warpstreamlabs.github.io/bento/docs/guides/bloblang/about/).
+
+```yml
+label: ""
+mapping: "" # No default (required)
+```
+
+#### Example
+
+Given a JSON document with US location names and the states they are located in:
+```json
+{
+  "locations": [
+    {"name": "Seattle", "state": "WA"},
+    {"name": "New York", "state": "NY"},
+    {"name": "Bellevue", "state": "WA"},
+    {"name": "Olympia", "state": "WA"}
+  ]
+}
+```
+
+If we want to collapse the location names from the state of Washington into a field `Cities`:
+
+```json
+{"Cities": "Bellevue, Olympia, Seattle"}
+```
+
+We could use the following bloblang mapping:
+
+```yml
+pipeline:
+  processors:
+    - mapping: |
+        root.Cities = this.locations.
+                        filter(loc -> loc.state == "WA").
+                        map_each(loc -> loc.name).
+                        sort().join(", ")
+```
+
+#### Considerations
+
+ - If a mapping fails, the message remains unchanged. However, Bloblang provides powerful ways to ensure your mappings do not fail by specifying desired fallback behaviour. See [this section of the Bloblang docs](https://warpstreamlabs.github.io/bento/docs/configuration/error_handling/).
+ - Mapping operates by creating an entirely new object during assignments. This has the advantage of treating the original referenced document as immutable and, therefore, queryable at any stage of your mapping. As a result, the `Cities` JSON document in the above example is a new, separate copy of the original document, which remains unchanged.
+
+## Tracers
+
+### Overview
+
+A tracer type represents a destination for Tyk Streams to send tracing events to such as [Jaeger](https://www.jaegertracing.io/).
+
+When a tracer is configured all messages will be allocated a root span during ingestion that represents their journey through a Streams pipeline. Many Streams processors create spans, and so tracing is a great way to analyse the pathways of individual messages as they progress through a Streams instance.
+
+Some inputs, such as `http_server` and `http_client`, are capable of extracting a root span from the source of the message (HTTP headers). This is
+a work in progress and should eventually expand so that all inputs have a way of doing so.
+
+Other inputs, such as `kafka` can be configured to extract a root span by using the `extract_tracing_map` field.
+
+A tracer config section looks like this:
+
+```yaml
+tracer:
+  jaeger:
+    agent_address: localhost:6831
+    sampler_type: const
+    sampler_param: 1
+```
+
+
+<Warning>
+**Note**
+
+Although the configuration spec of this component is stable the format of spans, tags and logs created by Streams is subject to change as it is tuned for improvement.
+</Warning>
+
+
+### Jaeger
+
+```yml
+# Common config fields, showing default values
+tracer:
+  jaeger:
+    agent_address: ""
+    collector_url: ""
+    sampler_type: const
+    flush_interval: "" # No default (optional)
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+tracer:
+  jaeger:
+    agent_address: ""
+    collector_url: ""
+    sampler_type: const
+    sampler_param: 1
+    tags: {}
+    flush_interval: "" # No default (optional)
+```
+
+Send tracing events to a [Jaeger](https://www.jaegertracing.io/) agent or collector.
+
+#### Fields
+
+##### agent_address
+
+The address of a Jaeger agent to send tracing events to.
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+agent_address: jaeger-agent:6831
+```
+
+##### collector_url
+
+The URL of a Jaeger collector to send tracing events to. If set, this will override `agent_address`.
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+collector_url: https://jaeger-collector:14268/api/traces
+```
+
+##### sampler_type
+
+The sampler type to use.
+
+Type: `string`
+Default: `"const"`
+
+| Option | Summary |
+| :--- | :--- |
+| `const` | Sample a percentage of traces. 1 or more means all traces are sampled, 0 means no traces are sampled and anything in between means a percentage of traces are sampled. Tuning the sampling rate is recommended for high-volume production workloads. |
+
+##### sampler_param
+
+A parameter to use for sampling. This field is unused for some sampling types.
+
+Type: `float`
+Default: `1`
+
+##### tags
+
+A map of tags to add to tracing spans.
+
+Type: `object`
+Default: `{}`
+
+##### flush_interval
+
+The period of time between each flush of tracing spans.
+
+Type: `string`
+
+### OpenTelemetry Collector
+
+```yml
+# Common config fields, showing default values
+tracer:
+  open_telemetry_collector:
+    http: [] # No default (required)
+    grpc: [] # No default (required)
+    sampling:
+      enabled: false
+      ratio: 0.85 # No default (optional)
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+tracer:
+  open_telemetry_collector:
+    http: [] # No default (required)
+    grpc: [] # No default (required)
+    tags: {}
+    sampling:
+      enabled: false
+      ratio: 0.85 # No default (optional)
+```
+
+
+<Warning>
+**Note**
+
+This component is experimental and therefore subject to change or removal outside of major version releases.
+</Warning>
+
+
+Send tracing events to an [Open Telemetry collector](https://opentelemetry.io/docs/collector/).
+
+#### Fields
+
+##### http
+
+A list of http collectors.
+
+Type: `array`
+
+##### http[].address
+
+The endpoint of a collector to send tracing events to.
+
+Type: `string`
+
+```yml
+# Examples
+
+address: localhost:4318
+```
+
+##### http[].secure
+
+Connect to the collector over HTTPS
+
+Type: `bool`
+Default: `false`
+
+##### grpc
+
+A list of grpc collectors.
+
+Type: `array`
+
+##### grpc[].address
+
+The endpoint of a collector to send tracing events to.
+
+Type: `string`
+
+```yml
+# Examples
+
+address: localhost:4317
+```
+
+##### grpc[].secure
+
+Connect to the collector with client transport security
+
+Type: `bool`
+Default: `false`
+
+##### tags
+
+A map of tags to add to all tracing spans.
+
+Type: `object`
+Default: `{}`
+
+##### sampling
+
+Settings for trace sampling. Sampling is recommended for high-volume production workloads.
+
+Type: `object`
+
+##### sampling.enabled
+
+Whether to enable sampling.
+
+Type: `bool`
+Default: `false`
+
+##### sampling.ratio
+
+Sets the ratio of traces to sample.
+
+Type: `float`
+
+```yml
+# Examples
+
+ratio: 0.85
+
+ratio: 0.5
+```
+
+## Metrics
+
+### Overview
+
+Streams emits lots of metrics in order to expose how components configured within your pipeline are behaving. You can configure exactly where these metrics end up with the config field `metrics`, which describes a metrics format and destination. For example, if you wished to push them via the Prometheus protocol you could use this configuration:
+
+```yaml
+metrics:
+  prometheus:
+    push_interval: 1s
+    push_job_name: in
+    push_url: http://localhost:9091
+```
+
+### Metric Names
+
+Metrics are emitted with a prefix that can be configured with the field `prefix`. The default prefix is `bento`. The following metrics are emitted with the respective types:
+
+#### Gauges
+
+- `{prefix}_input_count` Number of inputs currently active.
+- `{prefix}_output_count` Number of outputs currently active.
+- `{prefix}_processor_count` Number of processors currently active.
+- `{prefix}_cache_count` Number of caches currently active.
+- `{prefix}_condition_count` Number of conditions currently active.
+- `{prefix}_input_connection_up` 1 if a particular input is connected, 0 if it is not.
+- `{prefix}_output_connection_up` 1 if a particular output is connected, 0 if it is not.
+- `{prefix}_input_running` 1 if a particular input is running, 0 if it is not.
+- `{prefix}_output_running` 1 if a particular output is running, 0 if it is not.
+- `{prefix}_processor_running` 1 if a particular processor is running, 0 if it is not.
+- `{prefix}_cache_running` 1 if a particular cache is running, 0 if it is not.
+- `{prefix}_condition_running` 1 if a particular condition is running, 0 if it is not.
+- `{prefix}_buffer_running` 1 if a particular buffer is running, 0 if it is not.
+- `{prefix}_buffer_available` The number of messages that can be read from a buffer.
+- `{prefix}_input_retry` The number of active retry attempts for a particular input.
+- `{prefix}_output_retry` The number of active retry attempts for a particular output.
+- `{prefix}_processor_retry` The number of active retry attempts for a particular processor.
+- `{prefix}_cache_retry` The number of active retry attempts for a particular cache.
+- `{prefix}_condition_retry` The number of active retry attempts for a particular condition.
+- `{prefix}_buffer_retry` The number of active retry attempts for a particular buffer.
+- `{prefix}_threads_active` The number of processing threads currently active.
+
+#### Counters
+
+- `{prefix}_input_received` Count of messages received by a particular input.
+- `{prefix}_input_batch_received` Count of batches received by a particular input.
+- `{prefix}_output_sent` Count of messages sent by a particular output.
+- `{prefix}_output_batch_sent` Count of batches sent by a particular output.
+- `{prefix}_processor_processed` Count of messages processed by a particular processor.
+- `{prefix}_processor_batch_processed` Count of batches processed by a particular processor.
+- `{prefix}_processor_dropped` Count of messages dropped by a particular processor.
+- `{prefix}_processor_batch_dropped` Count of batches dropped by a particular processor.
+- `{prefix}_processor_error` Count of errors returned by a particular processor.
+- `{prefix}_processor_batch_error` Count of batch errors returned by a particular processor.
+- `{prefix}_cache_hit` Count of cache key lookups that found a value.
+- `{prefix}_cache_miss` Count of cache key lookups that did not find a value.
+- `{prefix}_cache_added` Count of new cache entries.
+- `{prefix}_cache_err` Count of errors that occurred during a cache operation.
+- `{prefix}_condition_hit` Count of condition checks that passed.
+- `{prefix}_condition_miss` Count of condition checks that failed.
+- `{prefix}_condition_error` Count of errors that occurred during a condition check.
+- `{prefix}_buffer_added` Count of messages added to a particular buffer.
+- `{prefix}_buffer_batch_added` Count of batches added to a particular buffer.
+- `{prefix}_buffer_read` Count of messages read from a particular buffer.
+- `{prefix}_buffer_batch_read` Count of batches read from a particular buffer.
+- `{prefix}_buffer_ack` Count of messages removed from a particular buffer.
+- `{prefix}_buffer_batch_ack` Count of batches removed from a particular buffer.
+- `{prefix}_buffer_nack` Count of messages that failed to be removed from a particular buffer.
+- `{prefix}_buffer_batch_nack` Count of batches that failed to be removed from a particular buffer.
+- `{prefix}_buffer_err` Count of errors that occurred during a buffer operation.
+- `{prefix}_buffer_batch_err` Count of batch errors that occurred during a buffer operation.
+- `{prefix}_input_error` Count of errors that occurred during an input operation.
+- `{prefix}_input_batch_error` Count of batch errors that occurred during an input operation.
+- `{prefix}_output_error` Count of errors that occurred during an output operation.
+- `{prefix}_output_batch_error` Count of batch errors that occurred during an output operation.
+- `{prefix}_resource_cache_error` Count of errors that occurred during a resource cache operation.
+- `{prefix}_resource_condition_error` Count of errors that occurred during a resource condition operation.
+- `{prefix}_resource_input_error` Count of errors that occurred during a resource input operation.
+- `{prefix}_resource_processor_error` Count of errors that occurred during a resource processor operation.
+- `{prefix}_resource_output_error` Count of errors that occurred during a resource output operation.
+- `{prefix}_resource_rate_limit_error` Count of errors that occurred during a resource rate limit operation.
+
+#### Timers
+
+- `{prefix}_input_latency` Latency of a particular input.
+- `{prefix}_input_batch_latency` Latency of a particular input at the batch level.
+- `{prefix}_output_latency` Latency of a particular output.
+- `{prefix}_output_batch_latency` Latency of a particular output at the batch level.
+- `{prefix}_processor_latency` Latency of a particular processor.
+- `{prefix}_processor_batch_latency` Latency of a particular processor at the batch level.
+- `{prefix}_condition_latency` Latency of a particular condition.
+- `{prefix}_condition_batch_latency` Latency of a particular condition at the batch level.
+- `{prefix}_cache_latency` Latency of a particular cache.
+- `{prefix}_buffer_latency` Latency of a particular buffer.
+- `{prefix}_buffer_batch_latency` Latency of a particular buffer at the batch level.
+
+### Metric Labels
+
+All metrics are emitted with the following labels:
+
+- `path` The path of the component within the config.
+- `label` A custom label for the component, which is optional and falls back to the component type.
+
+### Prometheus
+
+```yml
+# Common config fields, showing default values
+metrics:
+  prometheus:
+    prefix: tyk
+    push_interval: ""
+    push_job_name: kafka_out
+    push_url: ""
+```
+
+#### Advanced
+
+```yml
+# All config fields, showing default values
+metrics:
+  prometheus:
+    prefix: tyk
+    push_interval: ""
+    push_job_name: my_stream
+    push_url: ""
+    push_basic_auth:
+      enabled: false
+      username: ""
+      password: ""
+    file_path: ""
+    use_histogram_timing: false
+    histogram_buckets: [0.000001, 0.00001, 0.0001, 0.001, 0.01, 0.1, 1.0]
+```
+
+Send metrics to a Prometheus push gateway, or expose them via HTTP endpoints.
+
+#### Fields
+
+##### prefix
+
+A string prefix for all metrics.
+
+Type: `string`
+Default: `"bento"`
+
+##### push_interval
+
+The interval between pushing metrics to the push gateway.
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+push_interval: 1s
+
+push_interval: 1m
+```
+
+##### push_job_name
+
+A job name to attach to metrics pushed to the push gateway.
+
+Type: `string`
+Default: `"bento_push"`
+
+##### push_url
+
+The URL to push metrics to.
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+push_url: http://localhost:9091
+```
+
+##### push_basic_auth
+
+Basic authentication configuration for the push gateway.
+
+Type: `object`
+
+##### push_basic_auth.enabled
+
+Whether to use basic authentication when pushing metrics.
+
+Type: `bool`
+Default: `false`
+
+##### push_basic_auth.username
+
+The username to authenticate with.
+
+Type: `string`
+Default: `""`
+
+##### push_basic_auth.password
+
+The password to authenticate with.
+
+Type: `string`
+Default: `""`
+
+##### file_path
+
+The file path to write metrics to.
+
+Type: `string`
+Default: `""`
+
+```yml
+# Examples
+
+file_path: /tmp/metrics.txt
+```
+
+##### use_histogram_timing
+
+Whether to use histogram metrics for timing values. When set to false, summary metrics are used instead.
+
+Type: `bool`
+Default: `false`
+
+##### histogram_buckets
+
+A list of duration buckets to track when use_histogram_timing is set to true.
+
+Type: `array`
+Default: `[0.000001, 0.00001, 0.0001, 0.001, 0.01, 0.1, 1.0]`
+
+## Common Configuration
+
+### Batching
+
+Tyk Streams is able to join sources and sinks with sometimes conflicting batching behaviours without sacrificing its strong delivery guarantees. Therefore, batching within Tyk Streams is a mechanism that serves multiple purposes:
+
+1. [Performance (throughput)](#performance)
+2. [Compatibility (mixing multi and single part message protocols)](#compatibility)
+
+#### Performance
+
+For most users the only benefit of batching messages is improving throughput over your output protocol. For some protocols this can happen in the background and requires no configuration from you. However, if an output has a `batching` configuration block this means it benefits from batching and requires you to specify how you'd like your batches to be formed by configuring a [batching policy](#batch-policy):
+
+```yaml
+output:
+  kafka:
+    addresses: [ todo:9092 ]
+    topic: tyk_stream
+
+    # Either send batches when they reach 10 messages or when 100ms has passed
+    # since the last batch.
+    batching:
+      count: 10
+      period: 100ms
+```
+
+However, a small number of inputs such as [kafka](/api-management/stream-config#kafka) must be consumed sequentially (in this case by partition) and therefore benefit from specifying your batch policy at the input level instead:
+
+```yaml
+input:
+  kafka:
+    addresses: [ todo:9092 ]
+    topics: [ tyk_input_stream ]
+    batching:
+      count: 10
+      period: 100ms
+
+output:
+  kafka:
+    addresses: [ todo:9092 ]
+    topic: tyk_stream
+```
+
+Inputs that behave this way are documented as such and have a `batching` configuration block.
+
+Sometimes you may prefer to create your batches before processing, in which case if your input doesn't already support [a batch policy](#batch-policy) you can instead use a [broker](/api-management/stream-config#broker), which also allows you to combine inputs with a single batch policy:
+
+```yaml
+input:
+  broker:
+    inputs:
+      - resource: foo
+      - resource: bar
+    batching:
+      count: 50
+      period: 500ms
+```
+
+This also works the same with [output brokers](/api-management/stream-config#broker-1).
+
+#### Compatibility
+
+Tyk Streams is able to read and write over protocols that support multiple part messages, and all payloads travelling through Tyk Streams are represented as a multiple part message. Therefore, all components within Tyk Streams are able to work with multiple parts in a message as standard.
+
+When messages reach an output that *doesn't* support multiple parts the message is broken down into an individual message per part, and then one of two behaviours happen depending on the output. If the output supports batch sending messages then the collection of messages are sent as a single batch. Otherwise, Tyk Streams falls back to sending the messages sequentially in multiple, individual requests.
+
+This behaviour means that not only can multiple part message protocols be easily matched with single part protocols, but also the concept of multiple part messages and message batches are interchangeable within Tyk Streams.
+
+#### Batch Policy
+
+When an input or output component has a config field `batching` that means it supports a batch policy. This is a mechanism that allows you to configure exactly how your batching should work on messages before they are routed to the input or output it's associated with. Batches are considered complete and will be flushed downstream when either of the following conditions are met:
+
+
+- The `byte_size` field is non-zero and the total size of the batch in bytes matches or exceeds it (disregarding metadata.)
+- The `count` field is non-zero and the total number of messages in the batch matches or exceeds it.
+- The `period` field is non-empty and the time since the last batch exceeds its value.
+
+This allows you to combine conditions:
+
+```yaml
+output:
+  kafka:
+    addresses: [ todo:9092 ]
+    topic: tyk_stream
+
+    # Either send batches when they reach 10 messages or when 100ms has passed
+    # since the last batch.
+    batching:
+      count: 10
+      period: 100ms
+```
+
+
+<Note>
+A batch policy has the capability to *create* batches, but not to break them down.
+</Note>
+
+
+If your configured pipeline is processing messages that are batched *before* they reach the batch policy then they may circumvent the conditions you've specified here, resulting in sizes you aren't expecting.
+
+### Field Paths
+
+Many components within Tyk Streams allow you to target certain fields using a JSON dot path. The syntax of a path within Tyk Streams is similar to [JSON Pointers](https://tools.ietf.org/html/rfc6901), except with dot separators instead of slashes (and no leading dot.) When a path is used to set a value any path segment that does not yet exist in the structure is created as an object.
+
+For example, if we had the following JSON structure:
+
+```json
+{
+  "foo": {
+    "bar": 21
+  }
+}
+```
+
+The query path `foo.bar` would return `21`.
+
+The characters `~` (%x7E) and `.` (%x2E) have special meaning in Tyk Streams paths. Therefore `~` needs to be encoded as `~0` and `.` needs to be encoded as `~1` when these characters appear within a key.
+
+For example, if we had the following JSON structure:
+
+```json
+{
+  "foo.foo": {
+    "bar~bo": {
+      "": {
+        "baz": 22
+      }
+    }
+  }
+}
+```
+
+The query path `foo~1foo.bar~0bo..baz` would return `22`.
+
+#### Arrays
+
+When Tyk Streams encounters an array whilst traversing a JSON structure it requires the next path segment to be either an integer of an existing index, or, depending on whether the path is used to query or set the target value, the character `*` or `-` respectively.
+
+For example, if we had the following JSON structure:
+
+```json
+{
+  "foo": [
+    0, 1, { "bar": 23 }
+  ]
+}
+```
+
+The query path `foo.2.bar` would return `23`.
+
+##### Querying
+
+When a query reaches an array the character `*` indicates that the query should return the value of the remaining path from each element of the array (within an array.)
+
+##### Setting
+
+When an array is reached the character `-` indicates that a new element should be appended to the end of the existing elements, if this character is not the final segment of the path then an object is created.
+
+### Processing Pipelines
+
+Within a Tyk Streams configuration, in between `input` and `output`, is a `pipeline` section. This section describes an array of processors that are to be applied to *all* messages, and are not bound to any particular input or output.
+
+If you have processors that are heavy on CPU and aren't specific to a certain input or output they are best suited for the pipeline section. It is advantageous to use the pipeline section as it allows you to set an explicit number of parallel threads of execution:
+
+```yaml
+input:
+  resource: foo
+
+pipeline:
+  threads: 4
+  processors:
+    - avro:
+        operator: "to_json"
+
+output:
+  resource: bar
+```
+
+If the field `threads` is set to `-1` (the default) it will automatically match the number of logical CPUs available. By default almost all Tyk Streams sources will utilize as many processing threads as have been configured, which makes horizontal scaling easy.
diff --git a/api-management/streams-end-to-end-example.mdx b/api-management/streams-end-to-end-example.mdx
new file mode 100644
index 0000000000..e3dddfcfbd
--- /dev/null
+++ b/api-management/streams-end-to-end-example.mdx
@@ -0,0 +1,230 @@
+---
+title: "Tyk Streams End-to-End Example"
+description: "A comprehensive end-to-end example of Tyk Streams implementation"
+keywords: "Tyk Streams, Event-Driven APIs, Kafka, WebSockets, SSE, Correlation IDs"
+sidebarTitle: "Tyk Streams End-to-End Example"
+---
+
+<div style={{position: 'relative', paddingBottom: '64.6900269541779%', height: 0}}><iframe src="https://www.loom.com/embed/4f5a017aa33648c9abb75d01a739a96f?sid=756a81af-170a-48e5-af62-09b26d9b2c26" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen style={{position: 'absolute', top: 0, left: 0, width: '100%', height: '100%'}}></iframe></div>
+
+## Why Tyk Streams?
+
+Tyk Streams adds a **declarative event layer** on top of the Tyk Gateway, letting you expose or consume broker topics (Kafka, NATS, RabbitMQ…) through normal HTTP channels—REST, WebSocket, Server-Sent Events—without glue code.
+
+You can manage stream definitions in three interchangeable ways:
+
+| Method | When to use |
+| :-------- | :------------- |
+| **Tyk Dashboard UI** | Rapid prototyping and PoCs |
+| **OpenAPI + `x-tyk-streaming`** | “Everything-as-code”, safe for Git |
+| **Tyk Operator (Kubernetes CRD)** | GitOps & CI/CD pipelines |
+
+---
+
+## Requirements
+
+* **Tyk Gateway ≥ 5.8** with **Streams** feature enabled  
+* **Apache Kafka** reachable on `localhost:9093`  
+* *(Optional)* **Prometheus** and **Jaeger** if you enable the commented observability blocks
+
+---
+
+## Architecture
+
+The demo shows a classic pattern: a user request becomes an event on a bus, a worker processes it asynchronously, and the result is delivered back to the same user—without leaking data across tenants.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant Client
+    participant GatewayIn as Gateway<br/>in stream
+    participant KafkaJobs as Kafka<br/>topic **jobs**
+    participant Worker as Worker<br/>Worker stream
+    participant KafkaCompleted as Kafka<br/>topic **completed**
+    participant GatewayOut as Gateway<br/>out stream
+
+    %% synchronous request from client
+    Client ->> GatewayIn: POST /push-event **(sync)**
+    GatewayIn -->> Client: 200 OK + echo **(sync)**
+
+    %% asynchronous event flow
+    GatewayIn -->> KafkaJobs: publish event **(async)**
+    KafkaJobs -->> Worker: consume job **(async)**
+    Worker -->> KafkaCompleted: publish result **(async)**
+    KafkaCompleted -->> GatewayOut: consume result **(async)**
+
+    %% synchronous delivery back to the same user
+    GatewayOut ->> Client: GET /get-event / WS / SSE **(sync)**
+```
+
+### Stream-per-responsibility pattern
+
+| Stream | Role | Input | Output |
+| :-------- | :------ | :------- | :-------- |
+| **`in`** | Edge entrypoint: accepts HTTP, enriches payload (`user_id`, `job_id`), publishes to **`jobs`** and echoes to caller | HTTP | Kafka + sync response |
+| **`Worker`** | Background micro-service: listens to **`jobs`**, attaches `result: "bar"`, publishes to **`completed`** | Kafka | Kafka |
+| **`out`** | Edge exit point: listens to **`completed`**, drops messages not owned by caller, delivers via REST/WS/SSE | Kafka | HTTP |
+
+---
+
+## Processor mapping (built-in scripting)
+
+Streams pipelines include **processors**. The *mapping* processor embeds [Bloblang](https://www.benthos.dev/docs/guides/bloblang/about/) so you can transform or filter messages inline:
+
+* **Enrich** – `in` adds `user_id` & `job_id`
+* **Augment** – `Worker` adds a static field `{ "result": "bar" }`
+* **Filter** – `out` calls `deleted()` for non-matching users
+
+Dynamic placeholders (`$tyk_context.…`) can reference query params, headers, JWT claims, or any other context variable—usable anywhere in the Streams config.
+
+---
+
+## Observability (optional)
+
+Uncomment the `metrics:` and `tracer:` blocks to push per-stream Prometheus metrics and Jaeger traces. Tags like `stream: Worker` make end-to-end tracing trivial.
+
+---
+
+## Full OpenAPI definition
+
+Copy/paste into `streams-demo.yaml`, import via Dashboard UI, or apply with Tyk Operator:
+
+```yaml
+info:
+  title: streams-demo
+  version: 1.0.0
+openapi: 3.0.3
+servers:
+  - url: http://tyk-gateway:8282/stream-demo/
+x-tyk-streaming:
+  streams:
+    Worker:
+      input:
+        kafka:
+          addresses:
+            - localhost:9093
+          consumer_group: worker
+          topics:
+            - jobs
+      output:
+        kafka:
+          addresses:
+            - localhost:9093
+          topic: completed
+      pipeline:
+        processors:
+          - mapping: |
+              root = this.merge({ "result": "bar" })
+#      metrics:
+#        prometheus:
+#          push_interval: 1s
+#          push_job_name: Worker
+#          push_url: http://localhost:9091
+#      tracer:
+#        jaeger:
+#          collector_url: http://localhost:14268/api/traces
+#          tags:
+#            stream: Worker
+
+    in:
+      input:
+        http_server:
+          path: /push-event
+          ws_path: /ws-out
+      output:
+        broker:
+          outputs:
+            - kafka:
+                addresses:
+                  - localhost:9093
+                topic: jobs
+            - sync_response: {}
+      pipeline:
+        processors:
+          - mapping: |
+              root = this
+              root.user_id = "$tyk_context.request_data_user"  # or $tyk_context.jwt.claims.sub
+              root.job_id = uuid_v4()
+#      tracer:
+#        jaeger:
+#          collector_url: http://localhost:14268/api/traces
+#          tags:
+#            stream: in
+#      metrics:
+#        prometheus:
+#          push_interval: 1s
+#          push_job_name: in
+#          push_url: http://localhost:9091
+
+    out:
+      input:
+        kafka:
+          addresses:
+            - localhost:9093
+          consumer_group: $tyk_context.request_data_user
+          topics:
+            - completed
+      output:
+        http_server:
+          path: /get-event
+          ws_path: /ws-in
+      pipeline:
+        processors:
+          - mapping: |
+              root = if this.user_id != "$tyk_context.request_data_user" {
+                deleted()
+              }
+#      tracer:
+#        jaeger:
+#          collector_url: http://localhost:14268/api/traces
+#          tags:
+#            stream: out
+#      metrics:
+#        prometheus:
+#          push_interval: 1s
+#          push_job_name: out
+#          push_url: http://localhost:9091
+security: []
+paths: {}
+components:
+  securitySchemes: {}
+x-tyk-api-gateway:
+  info:
+    name: stream-demo
+    state:
+      active: true
+      internal: false
+  middleware:
+    global:
+      contextVariables:
+        enabled: true
+      trafficLogs:
+        enabled: true
+  server:
+    listenPath:
+      strip: true
+      value: /stream-demo/
+  upstream:
+    proxy:
+      enabled: false
+      url: ""
+```
+
+---
+
+## Running the demo
+
+1. **Start Kafka** (e.g. docker-compose).
+2. **Launch Tyk Gateway 5.8+** with the YAML above.
+3. **Send an event**  
+   ```bash
+   curl -X POST "http://localhost:8282/stream-demo/push-event?user=alice" \
+        -H "Content-Type: application/json" \
+        -d '{"message":"hello world"}'
+   ```
+4. **Receive the result** (only *alice*’s jobs)  
+   ```bash
+   curl "http://localhost:8282/stream-demo/get-event?user=alice"
+   ```
+5. **Switch transport** – connect via websocket `wscat -c http://127.0.0.1:8282/stream-demo/ws-in\?user\=alice`
+6. *(Optional)* **Enable metrics & tracing** – uncomment blocks, restart Gateway, explore in Grafana & Jaeger.
diff --git a/api-management/sync/quick-start.mdx b/api-management/sync/quick-start.mdx
new file mode 100644
index 0000000000..ed7424e1ca
--- /dev/null
+++ b/api-management/sync/quick-start.mdx
@@ -0,0 +1,100 @@
+---
+title: "Tyk Sync Quick Start Guide"
+description: "Quick start guide for Tyk Sync to synchronize API configurations with Tyk Dashboard"
+keywords: "Quick Start, Tyk Sync, API Management, Automations"
+sidebarTitle: "Quick Start"
+---
+
+**Tyk Sync** is a command line tool and library to manage and synchronise a Tyk installation with your version control system (VCS). This guide will help you get started with Tyk Sync to manage your API configurations.
+
+## What We'll Cover in This Guide
+
+1. Set up Tyk Demo (gateway with prebuilt APIs)
+2. Install Tyk Sync using Docker
+3. Use Tyk Sync to dump API configurations from the Tyk Demo
+4. Observe the dumped configurations
+5. Make changes and sync back to Tyk Demo
+6. Verify changes in Tyk Demo
+
+## Instructions
+
+### 1. Set Up Tyk Demo
+
+First, let's set up a Tyk Demo environment with some prebuilt APIs. Follow our Docker [guide](/tyk-self-managed/install/docker).
+
+This will start a Tyk Gateway and Dashboard with some sample APIs already configured. The Dashboard will be available at `http://localhost:3000`.
+
+### 2. Install Tyk Sync
+
+Follow this [guide](/product-stack/tyk-sync/installing-tyk-sync) to install Tyk Sync. You can either use the Docker image or download the binary directly. We will be using the Docker image for this quick start.
+
+### 3. Dump API Configurations
+
+Now, let's dump the API configurations from the Tyk Dashboard:
+
+```bash
+# Create a directory to store your API configurations
+mkdir -p tyk-sync-data
+
+# Get your Dashboard API key from the Dashboard UI (User menu > Profile)
+# Replace YOUR_DASHBOARD_API_KEY with your actual key
+
+# Using Docker
+docker run --rm -v $(pwd)/tyk-sync-data:/opt/tyk-sync/data --network=host tykio/tyk-sync:v2.1 dump -d="http://localhost:3000" -s="YOUR_DASHBOARD_API_KEY" -t="/opt/tyk-sync/data"
+
+# Or using the binary directly
+tyk-sync dump -d="http://localhost:3000" -s="YOUR_DASHBOARD_API_KEY" -t="./tyk-sync-data"
+```
+
+This command will:
+- Connect to your Tyk Dashboard at `http://localhost:3000`
+- Use your Dashboard API key for authentication
+- Extract all APIs and policies
+- Save them to the `tyk-sync-data` directory
+
+### 4. Observe the Dumped Configurations
+
+Let's examine what was dumped:
+
+```bash
+ls -la tyk-sync-data
+```
+
+You should see:
+- A `.tyk.json` file (index file for synchronization)
+- A `policies` directory containing policy definitions
+- An `apis` directory containing API definitions
+
+Each API and policy is stored as a separate JSON file, making it easy to track changes in version control.
+
+### 5. Make Changes and Sync Back
+
+Now, let's modify an API definition and sync it back to the Dashboard:
+
+```bash
+# Edit one of the API definition files
+# For example, change the name of an API
+# Then sync the changes back
+
+# Using Docker
+docker run --rm -v $(pwd)/tyk-sync-data:/opt/tyk-sync/data --network=host tykio/tyk-sync:v2.1 update -d="http://localhost:3000" -s="YOUR_DASHBOARD_API_KEY" -p="/opt/tyk-sync/data"
+
+# Or using the binary directly
+tyk-sync update -d="http://localhost:3000" -s="YOUR_DASHBOARD_API_KEY" -p="./tyk-sync-data"
+```
+
+This will update the API configurations in your Tyk Dashboard based on the local files.
+
+### 6. Verify Changes in Tyk Demo
+
+Open your Tyk Dashboard at `http://localhost:3000` and navigate to the APIs section. You should see that your changes have been applied.
+
+## Conclusion
+
+Tyk Sync provides a powerful way to manage your API configurations as code. By following this quick start guide, you've learned how to:
+- Extract API configurations from a Tyk Dashboard
+- Store them as files that can be version-controlled
+- Modify and update configurations
+- Synchronize configurations between different environments
+
+This approach helps ensure consistency across environments and enables you to implement Gitops for your API management.
diff --git a/api-management/sync/use-cases.mdx b/api-management/sync/use-cases.mdx
new file mode 100644
index 0000000000..fbee6f7936
--- /dev/null
+++ b/api-management/sync/use-cases.mdx
@@ -0,0 +1,268 @@
+---
+title: "Automate API Configuration Management with Tyk Sync"
+description: "Learn how to automate API configuration management using Tyk Sync and GitHub Actions."
+keywords: "Tyk Sync, GitHub Actions, API Management, Automations"
+sidebarTitle: "Use Cases"
+---
+
+By integrating GitHub Actions, teams can schedule backups to cloud storage, sync configurations from a Git repository, and update local API definitions directly to the Tyk Dashboard. These workflows ensure configurations are securely maintained, aligned across environments, and easily managed within the API lifecycle.
+
+## Backup API Configurations with Github Actions
+API platform teams can automate configuration backups using GitHub Actions. By setting up a scheduled GitHub Action, API configurations can be periodically exported and stored in cloud storage, like AWS S3. This approach ensures backups remain up-to-date, offering a reliable way to safeguard data and simplify restoration if needed.
+
+
+### Create a GitHub Action workflow
+
+1. In your repository, create a new file `.github/workflows/tyk-backup.yml`.
+2. Add the following content to the `tyk-backup.yml` file:
+
+```yaml
+name: Tyk Backup
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  # Runs every day at midnight
+
+jobs:
+  backup:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    - name: Create Backup Directory
+      run: |
+        BACKUP_DIR="backup/$(date +%Y-%m-%d)"
+        mkdir -p $BACKUP_DIR
+        echo "BACKUP_DIR=$BACKUP_DIR" >> $GITHUB_ENV
+
+    - name: Set Permissions for Backup Directory
+      run: |
+        sudo chown -R 1001:1001 ${{ github.workspace }}/backup
+
+    - name: Dump API Configurations
+      run: |
+        docker run --user 1001:1001 -v ${{ github.workspace }}:/app/data tykio/tyk-sync:${TYK_SYNC_VERSION} dump --target /app/data/${{ env.BACKUP_DIR }} --dashboard ${TYK_DASHBOARD_URL} --secret ${TYK_DASHBOARD_SECRET}
+      env:
+        TYK_SYNC_VERSION: ${{ vars.TYK_SYNC_VERSION }}
+        TYK_DASHBOARD_URL: ${{ secrets.TYK_DASHBOARD_URL }}
+        TYK_DASHBOARD_SECRET: ${{ secrets.TYK_DASHBOARD_SECRET }}
+
+    - name: Upload to S3
+      uses: jakejarvis/s3-sync-action@v0.5.1
+      with:
+        args: --acl private --follow-symlinks --delete
+      env:
+        AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        AWS_REGION: 'us-east-1'  # Change to your region
+        SOURCE_DIR: ${{ env.BACKUP_DIR }}
+```
+
+### Set up secrets
+
+1. Go to your GitHub repository.
+2. Navigate to Settings > Secrets and variables > Actions.
+3. Add the following variable:
+    - `TYK_SYNC_VERSION`: The version of Tyk Sync you want to use.
+4. Add the following secrets:
+   - `TYK_DASHBOARD_URL`: The URL of your Tyk Dashboard.
+   - `TYK_DASHBOARD_SECRET`: The secret key for your Tyk Dashboard.
+   - `AWS_S3_BUCKET`: The name of your AWS S3 bucket.
+   - `AWS_ACCESS_KEY_ID`: Your AWS access key ID.
+   - `AWS_SECRET_ACCESS_KEY`: Your AWS secret access key.
+
+### Commit and push changes
+
+Commit the `tyk-backup.yml` file and push it to the main branch of your repository.
+
+### Verify backups
+
+The GitHub Action will run every day at midnight, dumping API configurations into a backup directory and uploading them to your specified S3 bucket.
+
+
+## Synchronize API configurations with GitHub Actions
+API platform teams can use GitHub Actions to sync API configurations, policies, and templates from a Git repository to Tyk. Triggered by repository changes, the action generates a .tyk.json file and applies updates with the sync command, keeping the Tyk setup aligned with the repository.
+
+### Setup GitHub repository
+Organize your repository with the following structure:
+
+- `/apis/` for API definition files.
+- `/policies/` for security policy files.
+- `/assets/` for API template files.
+
+### Create a GitHub Action workflow
+
+1. In your repository, create a new file `.github/workflows/tyk-sync.yml`.
+2. Add the following content to the `tyk-sync.yml` file:
+
+```yaml
+name: Tyk Sync
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    - name: Create .tyk.json
+      run: |
+        echo '{' > .tyk.json
+        echo '  "type": "apidef",' >> .tyk.json
+        echo '  "files": [' >> .tyk.json
+        find . -type f -name '*.json' -path './apis/*' -exec echo '    {"file": "{}"},' \; | sed '$ s/,$//' >> .tyk.json
+        echo '  ],' >> .tyk.json
+        echo '  "policies": [' >> .tyk.json
+        find . -type f -name '*.json' -path './policies/*' -exec echo '    {"file": "{}"},' \; | sed '$ s/,$//' >> .tyk.json
+        echo '  ],' >> .tyk.json
+        echo '  "assets": [' >> .tyk.json
+        find . -type f -name '*.json' -path './assets/*' -exec echo '    {"file": "{}"},' \; | sed '$ s/,$//' >> .tyk.json
+        echo '  ]' >> .tyk.json
+        echo '}' >> .tyk.json
+        cat .tyk.json
+
+    - name: Sync with Tyk
+      run: |
+        docker run tykio/tyk-sync:${TYK_SYNC_VERSION} version
+        docker run -v ${{ github.workspace }}:/app/data tykio/tyk-sync:${TYK_SYNC_VERSION} sync --path /app/data --dashboard ${TYK_DASHBOARD_URL} --secret ${TYK_DASHBOARD_SECRET}
+      env:
+        TYK_SYNC_VERSION: ${{ vars.TYK_SYNC_VERSION }}
+        TYK_DASHBOARD_URL: ${{ secrets.TYK_DASHBOARD_URL }}
+        TYK_DASHBOARD_SECRET: ${{ secrets.TYK_DASHBOARD_SECRET }}
+```
+
+### Set up secrets
+
+1. Go to your GitHub repository.
+2. Navigate to Settings > Secrets and variables > Actions.
+3. Add the following variable:
+    - `TYK_SYNC_VERSION`: The version of Tyk Sync you want to use (e.g., v2.0.0).
+4. Add the following secrets:
+    - `TYK_DASHBOARD_URL`: The URL of your Tyk Dashboard.
+    - `TYK_DASHBOARD_SECRET`: The secret key for your Tyk Dashboard.
+
+### Commit and push changes
+
+Commit the `tyk-sync.yml` file and push it to the main branch of your repository.
+
+### Verify synchronisation
+
+Each time there is a change in the repository, the GitHub Action will be triggered. It will create the `.tyk.json` file including all JSON files in the repository and use the `sync` command to update the Tyk installation.
+
+
+## Update API Definitions locally
+For API developers managing definitions locally, Tyk Sync's publish or update commands can upload local API definitions directly to the Tyk Dashboard, streamlining updates and keeping definitions in sync during development. Follow these steps to update your API definitions locally.
+
+### Prepare your API Definition
+
+Create your API definition file and save it locally. For example, save it as *api1.json* in a directory structure of your choice.
+
+### Create a .tyk.json index file
+
+In the root directory of your API definitions, create a `.tyk.json` file to list all API definition files that Tyk Sync should process.
+
+Example `.tyk.json`:
+```json
+{
+  "type": "apidef",
+  "files": [
+    { 
+        "file": "api1.json" 
+    }
+  ]
+}
+```
+
+### Install Tyk Sync via Docker
+
+If you haven't installed Tyk Sync, you can do so via Docker:
+
+```bash
+docker pull tykio/tyk-sync:v2.0.0
+```
+
+### Publish API Definitions to Tyk
+
+Use the `publish` command to upload your local API definitions to Tyk. Use Docker bind mounts to access your local files.
+
+```bash
+docker run -v /path/to/your/directory:/app/data tykio/tyk-sync:v2.0.0 publish \
+  --path /app/data \
+  --dashboard [DASHBOARD_URL] \
+  --secret [SECRET]
+```
+
+### Update API Definitions to Tyk
+
+Similarly, to update existing API definitions, use the update command.
+
+```bash
+docker run -v /path/to/your/directory:/app/data tykio/tyk-sync:v2.0.0 update \
+  --path /app/data \
+  --dashboard [DASHBOARD_URL] \
+  --secret [SECRET]
+```
+
+### Verify the update
+
+Log in to your Tyk Dashboard to verify that the API definitions have been published or updated successfully.
+
+
+## Specify Source API Configurations
+For the `sync`, `update`, and `publish` commands, you need to specify where Tyk Sync can get the source API configurations to update the target Tyk installation. You can store the source files either in a Git repository or the local file system.
+
+### Working with Git
+For any Tyk Sync command that requires Git repository access, specify the Git repository as the first argument after the command. By default, Tyk Sync reads from the `master` branch. To specify a different branch, use the `--branch` or `-b` flag. If the Git repository requires connection using Secure Shell Protocol (SSH), you can specify SSH keys with `--key` or `-k` flag.
+
+```bash
+tyk-sync [command] https://github.com/your-repo --branch develop
+```
+
+### Working with the local file system
+To update API configurations from the local file system, use the `--path` or `-p` flag to specify the source directory for your API configuration files.
+
+```bash
+tyk-sync [command] --path /path/to/local/directory
+```
+
+### Index File Requirement
+A `.tyk.json` index file is required at the root of the source Git repository or the specified path. This `.tyk.json` file lists all the files that should be processed by Tyk Sync.
+
+Example `.tyk.json`:
+```json
+{
+  "type": "apidef",
+  "files": [
+    {
+      "file": "api1/api1.json"
+    },
+    {
+      "file": "api2/api2.json"
+    },
+    {
+      "file": "api3.json"
+    }
+  ],
+  "policies": [
+    {
+      "file": "policy1.json"
+    }
+  ],
+  "assets": [
+    {
+      "file": "template1.json"
+    }
+  ]
+}
+```
+
+
diff --git a/api-management/traces.mdx b/api-management/traces.mdx
new file mode 100644
index 0000000000..4cdacd9a77
--- /dev/null
+++ b/api-management/traces.mdx
@@ -0,0 +1,463 @@
+---
+title: "Distributed Tracing in Tyk Gateway"
+description: "Learn how to configure distributed tracing in Tyk for API observability, including integration with OpenTelemetry and third-party tracing tools."
+keywords: "Distributed Tracing, OpenTelemetry, OTel, OTLP, Span Attributes, Context Propagation, Sampling, Jaeger, Datadog, Dynatrace, Observability, Tyk Gateway"
+sidebarTitle: "Traces"
+---
+
+Distributed traces provide a detailed, end-to-end view of a single API request or transaction as it traverses through various services and components. Traces are crucial for understanding the flow of requests and identifying bottlenecks or latency issues. Here’s how you can make use of traces for API observability:
+
+- **End-to-end request tracing:** Implement distributed tracing across your microservices architecture to track requests across different services and gather data about each service's contribution to the overall request latency.
+    
+- **Transaction Flow:** Visualize the transaction flow by connecting traces to show how requests move through different services, including entry points (e.g., API gateway), middleware and backend services.
+    
+- **Latency Analysis:** Analyze trace data to pinpoint which service or component is causing latency issues, allowing for quick identification and remediation of performance bottlenecks.
+    
+- **Error Correlation:** Use traces to correlate errors across different services to understand the root cause of issues and track how errors propagate through the system.
+
+## OpenTelemetry Tracing
+
+Since v5.2, Tyk Gateway supports distributed tracing via [OpenTelemetry](https://opentelemetry.io/docs/what-is-opentelemetry/). The gateway exports traces using the [OpenTelemetry Protocol (OTLP)](https://opentelemetry.io/docs/specs/otlp/), making it compatible with any modern tracing backend: Jaeger, Datadog, Dynatrace, Elasticsearch, New Relic, and others.
+
+<img src="/img/observability/tyk-otel-tracing.png" alt="Client request flowing through Tyk Gateway, which exports traces via OTLP to an OpenTelemetry Collector, which forwards to Jaeger, Datadog, Dynatrace, or any OTLP-compatible backend" />
+
+Tyk also supports the legacy [OpenTracing](#opentracing-deprecated) approach (now deprecated). Migrate to OpenTelemetry for vendor-neutral, actively maintained tracing.
+
+## Configuration
+
+### Enable Tracing
+
+Enable OpenTelemetry tracing at the Gateway level in `tyk.conf`:
+
+<Tabs>
+  <Tab title="Config File (tyk.conf)">
+```json
+{
+  "opentelemetry": {
+    "traces": {
+      "enabled": true
+    }
+  }
+}
+```
+  </Tab>
+  <Tab title="Environment Variable">
+     Set the environment variable `TYK_GW_OPENTELEMETRY_TRACES_ENABLED=true`.
+  </Tab>
+</Tabs>
+
+Tyk Gateway will now generate two spans for each request made to your APIs, encapsulating the entire request lifecycle. These spans include attributes and tags but lack fine-grained details. The parent span represents the total time from request reception to response and the child span represent the time spent in the upstream service.
+
+<img src="/img/distributed-tracing/opentelemetry/detailed-tracing-false.png" alt="Two spans generated per request with basic tracing enabled" width="800px" />
+
+### Reference
+
+<Note>
+The root-level `opentelemetry.enabled`, `opentelemetry.exporter`, and `opentelemetry.endpoint` fields are deprecated from Tyk 5.13.0. 
+
+They continue to work for backward compatibility but should be replaced with the `opentelemetry.traces.*` equivalents in new deployments.
+</Note>
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| [opentelemetry.traces.enabled](/tyk-oss-gateway/configuration#opentelemetry-traces-enabled) | Enable distributed tracing | `false` |
+| [opentelemetry.traces.exporter](/tyk-oss-gateway/configuration#opentelemetry-traces-exporter) | Export protocol: `grpc` or `http` | `grpc` |
+| [opentelemetry.traces.endpoint](/tyk-oss-gateway/configuration#opentelemetry-traces-endpoint) | OTLP collector endpoint | `localhost:4317` |
+| [opentelemetry.traces.connection_timeout](/tyk-oss-gateway/configuration#opentelemetry-traces-connection_timeout) | Connection timeout in seconds | `1` |
+| [opentelemetry.traces.headers](/tyk-oss-gateway/configuration#opentelemetry-traces-headers) | Additional HTTP headers sent with each OTLP export request | — |
+| [opentelemetry.traces.tls](/tyk-oss-gateway/configuration#opentelemetry-traces-tls) | TLS configuration for the OTLP connection | — |
+| [opentelemetry.traces.context_propagation](/tyk-oss-gateway/configuration#opentelemetry-traces-context_propagation) | Trace context format: `tracecontext`, `b3`, `custom`, or `composite` | `tracecontext` |
+| [opentelemetry.traces.custom_trace_header](/tyk-oss-gateway/configuration#opentelemetry-traces-custom_trace_header) | Custom propagation header name (used with `custom` or `composite` modes) | — |
+| [opentelemetry.traces.span_processor_type](/tyk-oss-gateway/configuration#opentelemetry-traces-span_processor_type) | Span processing mode: `batch` or `simple` | `batch` |
+| [opentelemetry.traces.span_batch_config.max_queue_size](/tyk-oss-gateway/configuration#opentelemetry-traces-span_batch_config-max_queue_size) | Maximum number of spans buffered before export | `2048` |
+| [opentelemetry.traces.span_batch_config.max_export_batch_size](/tyk-oss-gateway/configuration#opentelemetry-traces-span_batch_config-max_export_batch_size) | Maximum number of spans per export batch | `512` |
+| [opentelemetry.traces.span_batch_config.batch_timeout](/tyk-oss-gateway/configuration#opentelemetry-traces-span_batch_config-batch_timeout) | Seconds to wait before forcing an export | `5` |
+| [opentelemetry.traces.sampling.type](/tyk-oss-gateway/configuration#opentelemetry-traces-sampling-type) | Sampling strategy: `AlwaysOn`, `AlwaysOff`, or `TraceIDRatioBased` | `AlwaysOn` |
+| [opentelemetry.traces.sampling.rate](/tyk-oss-gateway/configuration#opentelemetry-traces-sampling-rate) | Fraction of traces to sample when using `TraceIDRatioBased` (0.0–1.0) | `0.5` |
+| [opentelemetry.traces.sampling.parent_based](/tyk-oss-gateway/configuration#opentelemetry-traces-sampling-parent_based) | Inherit the parent span's sampling decision | `false` |
+
+### Detailed Tracing
+
+Enable detailed tracing per API to generate a span for each middleware in the request pipeline. These spans offer detailed insights, including the time taken for each middleware execution and the sequence of invocations.
+
+Set the [server.detailedTracing](/api-management/gateway-config-tyk-oas#detailedtracing) flag in the Tyk OAS API definition, or toggle **OpenTelemetry Tracing** in the Tyk OAS API Designer.
+
+<img src="/img/distributed-tracing/opentelemetry/detailed-tracing-oas.png" alt="OpenTelemetry Tracing toggle in the Tyk OAS API Designer" width="800px" />
+
+<img src="/img/distributed-tracing/opentelemetry/detailed-tracing-true.png" alt="Multiple middleware spans generated with detailed tracing enabled" width="800px" />
+
+For Tyk Classic APIs, use the [detailed_tracing](/api-management/gateway-config-tyk-classic#opentelemetry) field in the API definition.
+
+### Span Processor Configuration
+
+A span processor controls how completed spans are batched and sent to the tracing backend. This is configured in the Tyk Gateway configuration file under `opentelemetry.traces`.
+
+When using `span_processor_type: batch` (the default), you can tune the batch processor to avoid span loss under high traffic. Use the `span_batch_config` block to configure the following fields:
+
+```json
+{
+  "opentelemetry": {
+    "traces": {
+      "span_processor_type": "batch",
+      "span_batch_config": {
+        "max_queue_size": 8192,
+        "max_export_batch_size": 1024,
+        "batch_timeout": 3
+      }
+    }
+  }
+}
+```
+
+| Field | Default | Description |
+|-------|---------|-------------|
+| [`max_queue_size](/tyk-oss-gateway/configuration#opentelemetry-span_batch_config-max_queue_size) | `2048` | maximum number of spans buffered before export |
+| [`max_export_batch_size](/tyk-oss-gateway/configuration#opentelemetry-span_batch_config-max_export_batch_size) | `512` | maximum number of spans per export batch |
+| [`batch_timeout](/tyk-oss-gateway/configuration#opentelemetry-span_batch_config-batch_timeout) | `5` | seconds to wait before forcing an export |
+
+Increase `max_queue_size` and `max_export_batch_size` in high-throughput environments where spans are being dropped before they can be exported.
+
+## Understanding The Traces
+
+Tyk Gateway exposes a helpful set of *span attributes* and *resource attributes* with the generated spans. These attributes provide useful insights for analyzing your API requests. A clear analysis can be obtained by observing the specific actions and associated context within each request/response. This is where span and resource attributes play a significant role.
+
+### Span Attributes
+
+A span is a named, timed operation that represents an operation. Multiple spans represent different parts of the workflow and are pieced together to create a trace. While each span includes a duration indicating how long the operation took, the span attributes provide additional contextual metadata.
+
+Span attributes are key-value pairs that provide contextual metadata for individual spans. Tyk automatically sets the following span attributes:
+
+- `tyk.api.name`: API name.
+- `tyk.api.orgid`: Organization ID.
+- `tyk.api.id`: API ID.
+- `tyk.api.path`: API listen path.
+- `tyk.api.tags`: If tagging is enabled in the API definition, the tags are added here.
+- `tyk.api.apikey.alias`: The identity alias of the authenticated client. Populated for APIs using JWT authentication or multi-auth (compliant mode).
+
+
+### Resource Attributes
+
+Resource attributes provide contextual information about the entity that produced the telemetry data. Tyk exposes following resource attributes:
+
+### Service Attributes
+
+The service attributes supported by Tyk are:
+
+| Attribute             | Type   | Description | 
+| :--------------------- | :-------- | :- | 
+| `service.name`        | String | Service name for Tyk API Gateway:  `tyk-gateway`                                                                          |
+| `service.instance.id` and `tyk.gw.id` | String | The Node ID assigned to the gateway. Example `solo-6b71c2de-5a3c-4ad3-4b54-d34d78c1f7a3` | 
+| `service.version`     | String | Represents the service version. Example `v5.2.0`                                    |
+| `tyk.gw.dataplane` | Bool     | Whether the Tyk Gateway is hybrid (`slave_options.use_rpc=true`)                                 | 
+| `tyk.gw.group.id`  | String   | Represents the `slave_options.group_id` of the gateway. Populated only if the gateway is hybrid. | 
+| `tyk.gw.tags`      | []String | Represents the gateway `segment_tags`. Populated only if the gateway is segmented.               | 
+
+By understanding and using these resource attributes, you can gain better insights into the performance of your API Gateways.
+
+### Common HTTP Span Attributes
+
+Tyk follows the OpenTelemetry semantic conventions for HTTP spans. You can find detailed information on common attributes [here](https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md#common-attributes).
+
+Some of these common attributes include:
+
+- `http.method`: HTTP request method.
+- `http.scheme`: URL scheme.
+- `http.status_code`: HTTP response status code.
+- `http.url`: Full HTTP request URL.
+
+For the full list and details, refer to the official [OpenTelemetry Semantic Conventions](https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md#common-attributes).
+
+## Advanced Configuration
+
+### Context Propagation
+
+This setting allows you to specify the type of context propagator to use for trace data. This is essential for ensuring compatibility and data integrity between different services in your architecture.
+
+<Tabs>
+  <Tab title="Config File (tyk.conf)">
+
+[opentelemetry.traces.context_propagation](/tyk-oss-gateway/configuration#opentelemetry-traces-context_propagation) controls which trace context format the gateway reads from incoming requests and writes to upstream requests.
+
+```json
+{
+  "opentelemetry": {
+    "traces": {
+      "context_propagation": ""
+    }
+  }
+}
+```
+  </Tab>
+  <Tab title="Environment Variable">
+     Set the environment variable [TYK_GW_OPENTELEMETRY_TRACES_CONTEXTPROPAGATION](/tyk-oss-gateway/configuration#opentelemetry-context_propagation).
+  </Tab>
+</Tabs>
+
+The available options are:
+
+| Value | Behavior |
+|-------|-----------|
+| `tracecontext` (default) | [W3C Trace Context](https://www.w3.org/TR/trace-context/) format |
+| `b3` | [B3 multi-header](https://github.com/openzipkin/b3-propagation) format |
+| `custom` | Reads and writes only the custom header set in `custom_trace_header`. No standard headers written to upstream |
+| `composite` | Reads from the custom header (priority) or standard headers (fallback). Writes both the custom header and `traceparent` to upstream |
+
+<Note>
+`custom` and `composite` are available from Tyk Gateway v5.12.0 and require [opentelemetry.custom_trace_header](/tyk-oss-gateway/configuration#opentelemetry) to be set.
+</Note>
+
+The diagram below shows which headers the Gateway reads from the client and writes to the upstream for each mode:
+
+```mermaid
+sequenceDiagram
+    participant C as Client
+    participant G as Tyk Gateway
+    participant U as Upstream
+
+    rect rgb(230, 240, 255)
+        Note over C,U: tracecontext (default)
+        C->>G: Request + traceparent
+        G->>U: Request + traceparent
+    end
+
+    rect rgb(230, 255, 235)
+        Note over C,U: custom + custom_trace_header: X-Correlation-ID
+        C->>G: Request + X-Correlation-ID
+        G->>U: Request + X-Correlation-ID (no standard headers)
+    end
+
+    rect rgb(255, 245, 220)
+        Note over C,U: composite + custom_trace_header: X-Correlation-ID
+        C->>G: Request + X-Correlation-ID
+        G->>U: Request + X-Correlation-ID + traceparent
+    end
+```
+
+### Custom Trace Header
+
+If your upstream systems use a proprietary correlation header (for example, `X-Correlation-ID`), set `custom_trace_header` to that header name. The behavior depends on `context_propagation`:
+
+<Tabs>
+  <Tab title="Tracecontext">
+**Tracecontext mode** (`tracecontext` + `custom_trace_header`): reads from the custom header (with fallback to `traceparent`), writes only the standard `traceparent` header to upstream.
+
+```json
+{
+  "opentelemetry": {
+    "traces": {
+      "enabled": true,
+      "context_propagation": "tracecontext",
+      "custom_trace_header": "X-Correlation-ID"
+    }
+  }
+}
+```
+  </Tab>
+  <Tab title="Custom">
+**Custom mode** (`custom` + `custom_trace_header`) — reads from and writes to the custom header only. No standard headers are involved.
+
+```json
+{
+  "opentelemetry": {
+    "traces": {
+      "enabled": true,
+      "context_propagation": "custom",
+      "custom_trace_header": "X-Correlation-ID"
+    }
+  }
+}
+```
+  </Tab>
+  <Tab title="Composite">
+**Composite mode** (`composite` + `custom_trace_header`) — reads from the custom header (priority) or standard headers (fallback), and writes both the custom header and `traceparent` to upstream.
+
+```json
+{
+  "opentelemetry": {
+    "traces": {
+      "enabled": true,
+      "context_propagation": "composite",
+      "custom_trace_header": "X-Correlation-ID"
+    }
+  }
+}
+```
+  </Tab>
+</Tabs>
+
+In all modes, if the custom header is absent from the incoming request, the gateway falls back to standard headers or generates a new trace ID. The custom header is never generated if it wasn't present in the original request.
+
+### Sampling
+
+Tyk supports configuring the following sampling strategies using [opentelemetry.sampling](/tyk-oss-gateway/configuration#opentelemetry) in `tyk.conf`.
+
+```mermaid
+flowchart LR
+    Req["Incoming Request"] --> Type{"opentelemetry.sampling.type"}
+    Type -- AlwaysOn --> Sampled["Sampled"]
+    Type -- AlwaysOff --> Dropped["Not Sampled"]
+    Type -- TraceIDRatioBased --> PB{"parent_based enabled?"}
+    PB -- No --> Ratio{"random value\n< sampling.rate?"}
+    PB -- Yes --> Parent{"Has parent span?"}
+    Parent -- Yes --> Inherit["Inherit parent's sampling decision"]
+    Parent -- No --> Ratio
+    Ratio -- Yes --> Sampled
+    Ratio -- No --> Dropped
+
+    style Sampled fill:#22c55e,color:#fff
+    style Dropped fill:#ef4444,color:#fff
+```
+
+#### Sampling Type
+
+This setting dictates the sampling policy that OpenTelemetry uses to decide if a trace should be sampled for analysis. The decision is made at the start of a trace and applies throughout its lifetime. By default, the setting is `AlwaysOn`.
+
+Set the [opentelemetry.traces.sampling.type](/tyk-oss-gateway/configuration#opentelemetry-traces-sampling-type) field in the Tyk Gateway configuration file or use the equivalent environment variable. Allowed values for this setting are:
+
+| Value | Behavior |
+|-------|-----------|
+| `AlwaysOn` (default) | All traces are sampled |
+| `AlwaysOff` | No traces are sampled |
+| `TraceIDRatioBased` | Samples a fraction of traces based on the configured [sampling rate](/api-management/traces#sampling-rate) |
+
+#### Sampling Rate
+
+The [opentelemetry.traces.sampling.rate](/tyk-oss-gateway/configuration#opentelemetry-traces-sampling-rate) field is used to control what fraction of total traces will be sampled when the `TraceIDRatioBased` sampling is configured. It accepts a value between 0.0 and 1.0. For example, a `rate` set to 0.5 implies that approximately 50% of the traces will be sampled. The default value is 0.5.
+
+- **Configuration File**: Update the `opentelemetry.traces.sampling.rate` field in the configuration file.
+
+#### ParentBased Sampling
+
+Parent based sampling ensures sampling consistency between parent and child spans. Specifically, if a parent span is sampled, all its child spans will be sampled at the same rate.
+
+This is particularly effective when used with `TraceIDRatioBased` sampling, as it helps to keep the entire transaction story together. Using `ParentBased` with `AlwaysOn` or `AlwaysOff` may not be as useful, since in these cases, either all or no spans are sampled.
+
+Enable parent based sampling by setting [opentelemetry.traces.sampling.parent_based](/tyk-oss-gateway/configuration#opentelemetry-traces-sampling-parent_based) or the equivalent environment variable. The default value is `false`.
+
+## Tracing Backends
+
+For step-by-step setup guides connecting Tyk Gateway traces to a specific backend:
+
+- [Datadog](/api-management/traces/datadog)
+- [Dynatrace](/api-management/traces/dynatrace)
+- [Elasticsearch](/api-management/traces/elasticsearch)
+- [New Relic](/api-management/traces/new-relic)
+- [Jaeger](/api-management/traces/jaeger)
+
+All configuration options are documented in the [Tyk Gateway configuration reference](/tyk-oss-gateway/configuration#opentelemetry).
+
+## OpenTracing (deprecated)
+
+<Warning>
+**Deprecation**
+
+The CNCF has archived the OpenTracing project. Tyk introduced [OpenTelemetry](#opentelemetry) support in v5.2.
+
+Migrate to OpenTelemetry for active support and wider vendor compatibility. OpenTracing is deprecated in all Tyk products.
+</Warning>
+
+### Enabling OpenTracing
+
+Configure OpenTracing at the Gateway level in `tyk.conf`:
+
+```json
+{
+  "tracing": {
+    "enabled": true,
+    "name": "${tracer_name}",
+    "options": {}
+  }
+}
+```
+
+| Field | Environment variable | Description |
+|-------|----------------------|-------------|
+| `tracing.enabled` | `TYK_GW_TRACER_ENABLED` | Set to `true` to enable tracing |
+| `tracing.name` | `TYK_GW_TRACER_NAME` | Name of the supported tracer |
+| `tracing.options` | `TYK_GW_TRACER_OPTIONS` | Key-value pairs for configuring the tracer. See the tracer's documentation for details |
+
+Tyk automatically propagates tracing headers to upstream APIs when tracing is enabled.
+
+### Legacy Vendor Configurations
+
+<Tabs>
+  <Tab title="Jaeger">
+    <Note>
+    Tyk's OpenTelemetry tracing works with Jaeger. Follow the [Jaeger guide](/api-management/traces/jaeger) instead.
+    </Note>
+
+    Prior to Tyk 5.2, use [OpenTracing](https://opentracing.io/) with the [Jaeger client libraries](https://www.jaegertracing.io/docs/1.11/client-libraries/).
+
+    ```json
+    {
+      "tracing": {
+        "enabled": true,
+        "name": "jaeger",
+        "options": {
+          "baggage_restrictions": null,
+          "disabled": false,
+          "headers": null,
+          "reporter": {
+            "BufferFlushInterval": "0s",
+            "collectorEndpoint": "",
+            "localAgentHostPort": "jaeger:6831",
+            "logSpans": true,
+            "password": "",
+            "queueSize": 0,
+            "user": ""
+          },
+          "rpc_metrics": false,
+          "sampler": {
+            "maxOperations": 0,
+            "param": 1,
+            "samplingRefreshInterval": "0s",
+            "samplingServerURL": "",
+            "type": "const"
+          },
+          "serviceName": "tyk-gateway",
+          "tags": null,
+          "throttler": null
+        }
+      }
+    }
+    ```
+  </Tab>
+  <Tab title="New Relic">
+    <Note>
+    Tyk's OpenTelemetry tracing works with New Relic. Follow the [New Relic guide](/api-management/traces/new-relic) instead.
+    </Note>
+
+    Prior to Tyk 5.2, use [OpenTracing](https://opentracing.io/) with Zipkin format to send traces to New Relic.
+
+    ```json
+    {
+      "tracing": {
+        "enabled": true,
+        "name": "zipkin",
+        "options": {
+          "reporter": {
+            "url": "https://trace-api.newrelic.com/trace/v1?Api-Key=NEW_RELIC_LICENSE_KEY&Data-Format=zipkin&Data-Format-Version=2"
+          }
+        }
+      }
+    }
+    ```
+  </Tab>
+  <Tab title="Zipkin">
+    Prior to Tyk 5.2, use [OpenTracing](https://opentracing.io/) with the [Zipkin Go tracer](https://zipkin.io/pages/tracers_instrumentation).
+
+    ```json
+    {
+      "tracing": {
+        "enabled": true,
+        "name": "zipkin",
+        "options": {
+          "reporter": {
+            "url": "http://localhost:9411/api/v2/spans"
+          }
+        }
+      }
+    }
+    ```
+  </Tab>
+</Tabs>
diff --git a/api-management/traces/datadog.mdx b/api-management/traces/datadog.mdx
new file mode 100644
index 0000000000..19f464fff3
--- /dev/null
+++ b/api-management/traces/datadog.mdx
@@ -0,0 +1,157 @@
+---
+title: "Send Tyk Traces to Datadog"
+description: "Step-by-step guide to connect Tyk Gateway distributed traces to Datadog using the OpenTelemetry Collector."
+keywords: "Distributed Tracing, Datadog, OpenTelemetry, OTLP, OTel Collector, Tyk Gateway, APM, Observability"
+sidebarTitle: "Datadog"
+---
+
+This guide explains how to set up Datadog to ingest OpenTelemetry traces via the OpenTelemetry Collector (OTel Collector) using Docker. It follows the reference documentation from [Datadog](https://docs.datadoghq.com/opentelemetry/otel_collector_datadog_exporter/?tab=onahost).
+
+While this tutorial demonstrates using an OpenTelemetry Collector running in Docker, the core concepts remain consistent regardless of how and where the OpenTelemetry collector is deployed.
+
+## Prerequisites
+
+- [Docker installed on your machine](https://docs.docker.com/get-docker/)
+- Tyk Gateway v5.2.0 or higher
+- OpenTelemetry Collector Contrib [docker image](https://hub.docker.com/r/otel/opentelemetry-collector-contrib). Make sure to use the Contrib distribution of the OpenTelemetry Collector as it is required for the [Datadog exporter](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/datadogexporter). 
+- An [API key from Datadog](https://docs.datadoghq.com/account_management/api-app-keys/#add-an-api-key-or-client-token). For example, `6c35dacbf2e16aa8cda85a58d9015c3c`. 
+- Your [Datadog site](https://docs.datadoghq.com/getting_started/site/#access-the-datadog-site). Examples are: `datadoghq.com`, `us3.datadoghq.com` and `datadoghq.eu`.
+
+## Instructions
+
+### Step 1. Configure the OpenTelemetry Collector
+
+    Create a new YAML configuration file named `otel-collector.yml` with the following content:
+
+    ```yaml
+    receivers:
+      otlp:
+        protocols:
+          grpc:
+            endpoint: 0.0.0.0:4317
+    processors:
+      batch:
+        send_batch_max_size: 100
+        send_batch_size: 10
+        timeout: 10s
+    exporters:
+      datadog:
+        api:
+          site: "YOUR-DATADOG-SITE"
+          key: "YOUR-DATAGOG-API-KEY"
+    service:
+      pipelines:
+        traces:
+          receivers: [otlp]
+          processors: [batch]
+          exporters: [datadog]
+    ```
+
+### Step 2. Configure a test API
+
+    If you don't have any APIs configured yet, create a subdirectory called `apps` in the current directory. Create a new file `apidef-hello-world.json` and copy this very simple API definition for testing purposes:
+
+    ```json
+    { 
+        "name": "Hello-World",
+        "slug": "hello-world",
+        "api_id": "Hello-World",
+        "org_id": "1",
+        "use_keyless": true,
+        "detailed_tracing": true,
+        "version_data": {
+          "not_versioned": true,
+          "versions": {
+            "Default": {
+              "name": "Default",
+              "use_extended_paths": true
+            }
+          }
+        },
+        "proxy": {
+          "listen_path": "/hello-world/",
+          "target_url": "http://httpbin.org/",
+          "strip_listen_path": true
+        },
+        "active": true
+    }
+    ```
+
+### Step 3. Create the Docker-Compose file
+
+    Save the following YAML configuration to a file named `docker-compose.yml`.
+
+    ```yaml
+    version: "2"
+    services:
+      # OpenTelemetry Collector Contrib
+      otel-collector:
+        image: otel/opentelemetry-collector-contrib:latest
+        volumes:
+          - ./otel-collector.yml:/etc/otel-collector.yml
+        command: ["--config=/etc/otel-collector.yml"]
+        ports:
+          - "4317" # OTLP gRPC receiver
+        networks:
+          - tyk
+      
+      # Tyk API Gateway, open-source deployment
+      tyk:
+        image: tykio/tyk-gateway:v5.2
+        ports:
+          - 8080:8080
+        environment:
+          - TYK_GW_OPENTELEMETRY_ENABLED=true
+          - TYK_GW_OPENTELEMETRY_EXPORTER=grpc
+          - TYK_GW_OPENTELEMETRY_ENDPOINT=otel-collector:4317
+        volumes:
+          - ./apps:/opt/tyk-gateway/apps
+        depends_on:
+          - redis
+        networks:
+          - tyk
+
+      redis:
+        image: redis:4.0-alpine
+        ports:
+          - 6379:6379
+        command: redis-server --appendonly yes
+        networks:
+          - tyk
+
+    networks:
+      tyk:
+    ```
+
+
+    To start the services, go to the directory that contains the docker-compose.yml file and run the following command:
+
+    ```bash
+    docker-compose up
+    ```
+
+### Step 4. Explore OpenTelemetry traces in Datadog
+
+    1. Send a few requests to the API endpoint configured in step 2: 
+    ``
+    http://localhost:8080/hello-world/
+    ``
+
+    2. Log in to Datadog and navigate to the **APM / Traces** section. Here, you should start observing traces generated by Tyk:
+
+    <img src="/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-datadog.png" alt="Tyk API Gateway distributed trace in Datadog" />
+
+    3. Click on a trace to view all its internal spans:
+
+    <img src="/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-datadog-spans.png" alt="Tyk API Gateway spans in Datadog" />
+
+    4. Datadog will generate a service entry to monitor Tyk Gateway and will automatically compute valuable metrics using the ingested traces.4
+
+    <img src="/img/distributed-tracing/opentelemetry/api-gateway-tyk-service-monitoring-datadog.png" alt="Tyk API Gateway service monitoring in Datadog" />
+
+## Troubleshooting
+
+If you do not see any traces from Tyk appearing in Datadog, consider the following steps for resolution:
+
+- Logging: Examine logs from Tyk Gateway and from the OpenTelemetry Collector for any issues or warnings that might provide insights.
+- Data Ingestion Delays: Be patient, as there could be some delay in data ingestion. We configured a 10 second timeout in the batch processing of the OpenTelemetry collector in step 1, so give the system time to process the data.
diff --git a/api-management/traces/dynatrace.mdx b/api-management/traces/dynatrace.mdx
new file mode 100644
index 0000000000..a4f4341545
--- /dev/null
+++ b/api-management/traces/dynatrace.mdx
@@ -0,0 +1,124 @@
+---
+title: "Send Tyk Traces to Dynatrace"
+description: "Step-by-step guide to connect Tyk Gateway distributed traces to Dynatrace using the OpenTelemetry Collector and Docker."
+keywords: "Distributed Tracing, Dynatrace, OpenTelemetry, OTLP, OTel Collector, Tyk Gateway, APM, Observability"
+sidebarTitle: "Dynatrace"
+---
+
+This guide explains how to set up Dynatrace to ingest OpenTelemetry traces via the OpenTelemetry Collector (OTel Collector) using Docker.
+
+## Prerequisites
+
+- [Docker installed on your machine](https://docs.docker.com/get-docker/)
+- [Dynatrace account](https://www.dynatrace.com/)
+- Dynatrace Token
+- Gateway v5.2.0 or higher
+- OTel Collector [docker image](https://hub.docker.com/r/otel/opentelemetry-collector)
+
+## Instructions
+
+### Step 1. Generate Dynatrace Token
+
+  1. In the Dynatrace console, navigate to access keys.
+  2. Click on _Create a new key_
+  3. You will be prompted to select a scope. Choose _Ingest OpenTelemetry_ traces.
+  4. Save the generated token securely; it cannot be retrieved once lost.
+      Example of a generated token ([taken from Dynatrace website](https://www.dynatrace.com/support/help/dynatrace-api/basics/dynatrace-api-authentication#token-format-example)):
+
+      ```bash
+      dt0s01.ST2EY72KQINMH574WMNVI7YN.G3DFPBEJYMODIDAEX454M7YWBUVEFOWKPRVMWFASS64NFH52PX6BNDVFFM572RZM
+      ```
+
+### Step 2. Configuration Files
+
+  1. **OTel Collector Configuration File**
+
+      Create a YAML file named `otel-collector-config.yml`. In this file replace `<YOUR-ENVIRONMENT-STRING>` with the string from the address bar when you log into Dynatrace. Replace `<YOUR-DYNATRACE-API-KEY>` with the token you generated earlier.
+
+      Here's a sample configuration file:
+
+    ```yaml expandable
+    receivers:
+      otlp:
+        protocols:
+          http:
+            endpoint: 0.0.0.0:4318
+          grpc:
+            endpoint: 0.0.0.0:4317
+    processors:
+      batch:
+    exporters:
+      otlphttp:
+        endpoint: "https://<YOUR-ENVIRONMENT-STRING>.live.dynatrace.com/api/v2/otlp"
+        headers:
+          Authorization: "Api-Token <YOUR-DYNATRACE-API-KEY>" # You must keep 'Api-Token', just modify <YOUR-DYNATRACE-API-KEY>
+    extensions:
+      health_check:
+      pprof:
+        endpoint: :1888
+      zpages:
+        endpoint: :55679
+    service:
+      extensions: [pprof, zpages, health_check]
+      pipelines:
+        traces:
+          receivers: [otlp]
+          processors: [batch]
+          exporters: [otlphttp]
+    ```
+
+  2. **Docker Compose File**
+
+      Create a file named docker-compose.yml.
+
+      Here is the sample Docker Compose file:
+
+    ```yaml expandable
+    version: "3.9"
+    services:
+      otel-collector:
+        image: otel/opentelemetry-collector:latest
+        volumes:
+          - ./configs/otel-collector-config.yml:/etc/otel-collector.yml
+        command: ["--config=/etc/otel-collector.yml"]
+        networks:
+          - tyk
+        ports:
+          - "1888:1888" # pprof extension
+          - "13133:13133" # health_check extension
+          - "4317:4317" # OTLP gRPC receiver
+          - "4318:4318" # OTLP http receiver
+          - "55670:55679" # zpages extension
+    networks:
+      tyk:
+    ```
+
+### Step 3. Testing and Viewing Traces
+
+  1. Launch the Docker containers: docker-compose up -d
+
+  2. Initialize your Tyk environment.
+
+  3. Deploy a simple HTTP API on your Tyk Gateway.
+
+  4. Use cURL or Postman to send requests to the Gateway.
+
+  5. Navigate to Dynatrace -> Services -> Tyk-Gateway.
+
+      <img src="/img/distributed-tracing/opentelemetry/dynatrace-services.png" alt="Dynatrace Services" />
+
+  6. Wait for 5 minutes and refresh.
+
+  7. Traces, along with graphs, should appear. If they don't, click on the "Full Search" button.
+
+      <img src="/img/distributed-tracing/opentelemetry/dynatrace-metrics.png" alt="Dynatrace Metrics" />
+
+And there you have it! You've successfully integrated Dynatrace with the OpenTelemetry Collector using Docker.
+
+## Troubleshooting
+
+If traces are not appearing:
+- try clicking on the "Full Search" button after waiting for 5 minutes.
+- Make sure your Dynatrace token is correct in the configuration files.
+ - Validate the Docker Compose setup by checking the logs for any errors: `docker-compose logs`
+
diff --git a/api-management/traces/elasticsearch.mdx b/api-management/traces/elasticsearch.mdx
new file mode 100644
index 0000000000..8c84d5e271
--- /dev/null
+++ b/api-management/traces/elasticsearch.mdx
@@ -0,0 +1,112 @@
+---
+title: "Send Tyk Traces to Elasticsearch"
+description: "Step-by-step guide to connect Tyk Gateway distributed traces to Elasticsearch using the OpenTelemetry Collector, for OSS, self-managed, and hybrid deployments."
+keywords: "Distributed Tracing, Elasticsearch, Elastic APM, OpenTelemetry, OTLP, OTel Collector, Tyk Gateway, Observability"
+sidebarTitle: "Elasticsearch"
+---
+
+This guide explains how to set up [Elasticsearch](https://www.elastic.co/observability) to ingest OpenTelemetry traces via the OpenTelemetry Collector (OTel Collector).
+
+## Prerequisites
+
+Ensure the following prerequisites are met before proceeding:
+
+- Tyk Gateway v5.2 or higher
+- OpenTelemetry Collector deployed locally
+- Elasticsearch deployed locally or an account on Elastic Cloud with Elastic APM
+
+Elastic Observability natively supports OpenTelemetry and its OpenTelemetry protocol (OTLP) to ingest traces, metrics, and logs. 
+
+<img src="/img/distributed-tracing/opentelemetry/elastic-otel.png" alt="OpenTelemetry support in Elasticsearch" />
+Credit: Elasticsearch, [OpenTelemetry on Elastic](https://www.elastic.co/blog/opentelemetry-observability)
+
+## Steps for Configuration 
+
+### Step 1. Configure Tyk Gateway
+
+
+    To enable OpenTelemetry when using Tyk Helm Charts add the following configuration to the Tyk Gateway section:
+
+    ```yaml
+    tyk-gateway:
+      gateway:
+        opentelemetry:
+          enabled: true
+          endpoint: {{Add your endpoint here}}
+          exporter: grpc
+    ```
+
+    To enable OpenTelemetry when using Docker Compose add the following environment variables to your `docker-compose.yml` file for Tyk Gateway:
+
+    ```yaml
+    environment:
+      - TYK_GW_OPENTELEMETRY_ENABLED=true
+      - TYK_GW_OPENTELEMETRY_EXPORTER=grpc
+      - TYK_GW_OPENTELEMETRY_ENDPOINT={{Add your endpoint here}}
+    ```
+
+<Note>
+    For both deployment types, make sure to replace `<Add your endpoint here>` with the appropriate endpoint from your OpenTelemetry collector.
+</Note>
+
+    After enabling OpenTelemetry for the Gateway, you can activate [detailed tracing](/api-management/traces#detailed-tracing) for specific APIs in their respective API definitions. Detailed tracing is not enabled by default so you will need to set the `detailed_tracing` option to `true` to collect detailed traces.
+
+### Step 2. Configure the OpenTelemetry Collector to Export to Elasticsearch
+
+    To configure the OTel Collector with Elasticsearch Cloud, follow these steps:
+
+    1. Sign up for an [Elastic account](https://www.elastic.co/) if you haven't already
+    2. Once logged in to your Elastic account, select **Observability** and click on the option **Monitor my application performance**
+
+    <img src="/img/distributed-tracing/opentelemetry/elastic-configure-otel-01.png" alt="Configure Elasticsearch" />
+
+    3. Scroll down to the **APM Agents** section and click on the **OpenTelemetry** tab
+
+    <img src="/img/distributed-tracing/opentelemetry/elastic-configure-otel-02.png" alt="Configure Elasticsearch" />
+
+    4. Search for the section **Configure OpenTelemetry in your application"** You will need to copy the value of `OTEL_EXPORTER_OTLP_ENDPOINT` and `OTEL_EXPORTER_OTLP_HEADERS` in your OpenTelemetry Collector configuration file.
+
+    <img src="/img/distributed-tracing/opentelemetry/elastic-configure-otel-03.png" alt="Configure Elasticsearch" />
+
+    5. Update your OpenTelemetry Collector configuration, here's a simple example:
+
+    ```yaml expandable
+    receivers:
+      otlp:
+        protocols:
+          grpc:
+            endpoint: 0.0.0.0:4317 # OpenTelemetry receiver endpoint
+    processors:
+      batch:
+    exporters:
+    otlp/elastic:
+        endpoint: "ELASTIC_APM_SERVER_ENDPOINT_GOES_HERE" #exclude scheme, e.g. HTTPS:// or HTTP://
+        headers:
+          # Elastic APM Server secret token
+          Authorization: "Bearer ELASTIC_APM_SECRET_TOKEN_GOES_HERE"
+    service:
+      pipelines:
+        traces:
+          receivers: [otlp]
+          exporters: [otlp/elastic]
+    ```
+
+    If are running Elasticsearch locally, you will need to use your APM Server endpoint (elastic-apm-server:8200) and set up [a secret token authorization in ElasticSearch](https://www.elastic.co/guide/en/observability/current/secret-token.html).
+
+    You can refer to the [example configuration provided by Elastic](https://www.elastic.co/guide/en/observability/current/open-telemetry-direct.html#connect-open-telemetry-collector) for more guidance on the OpenTelemetry Collector configuration.
+
+### Step 3. Explore OpenTelemetry Traces in Elasticsearch
+
+    In Elasticsearch Cloud:
+    1. Go to **Home** and select **Observability**.
+    <img src="/img/distributed-tracing/opentelemetry/elastic-configure-otel-04.png" alt="Configure Elasticsearch" />
+    2. On the right menu, click on **APM / Services**.
+    3. Click on **tyk-gateway**.
+
+    4. You will see a dashboard automatically generated based on the distributed traces sent by Tyk Gateway to Elasticsearch.
+
+    <img src="/img/distributed-tracing/opentelemetry/elastic-configure-otel-05.png" alt="Configure Elasticsearch" />
+
+    Select a transaction to view more details, including the distributed traces:
+
+    <img src="/img/distributed-tracing/opentelemetry/elastic-configure-otel-06.png" alt="Configure Elasticsearch" />
diff --git a/api-management/traces/jaeger.mdx b/api-management/traces/jaeger.mdx
new file mode 100644
index 0000000000..31fb97a35e
--- /dev/null
+++ b/api-management/traces/jaeger.mdx
@@ -0,0 +1,285 @@
+---
+title: "Send Tyk Traces to Jaeger"
+description: "Step-by-step guide to connect Tyk Gateway distributed traces to Jaeger using Docker or Kubernetes."
+keywords: "Distributed Tracing, Jaeger, OpenTelemetry, OTLP, Tyk Gateway, Kubernetes, Docker, Observability"
+sidebarTitle: "Jaeger"
+---
+
+## Using Docker
+
+This guide explains how to set up [Jaeger](https://www.jaegertracing.io/)  to ingest OpenTelemetry traces via the OpenTelemetry Collector (OTel Collector) using Docker. We will cover the installation of essential components, their configuration, and the process of ensuring seamless integration.
+
+For Kubernetes instructions, please refer to [How to integrate with Jaeger on Kubernetes](#using-kubernetes).
+
+### Prerequisites
+
+Ensure the following prerequisites are met before proceeding:
+
+- [Docker installed on your machine](https://docs.docker.com/get-docker/)
+- Gateway v5.2.0 or higher
+
+### Steps for Configuration
+
+1. **Create the Docker-Compose File for Jaeger**
+
+    Save the following YAML configuration in a file named docker-compose.yml:
+
+    ```yaml
+    version: "2"
+    services:
+      # Jaeger: Distributed Tracing System
+      jaeger-all-in-one:
+        image: jaegertracing/all-in-one:latest
+        ports:
+          - "16686:16686" # Jaeger UI
+          - "4317:4317" # OTLP receiver
+    ```
+
+    This configuration sets up Jaeger's all-in-one instance with ports exposed for Jaeger UI and the OTLP receiver.
+
+2. **Deploy a Test API Definition**
+
+    If you haven't configured any APIs yet, follow these steps:
+
+    - Create a subdirectory named apps in the current directory.
+    - Create a new file named `apidef-hello-world.json`.
+    - Copy the provided simple API definition below into the `apidef-hello-world.json` file:
+
+
+    ```json
+    { 
+        "name": "Hello-World",
+        "slug": "hello-world",
+        "api_id": "Hello-World",
+        "org_id": "1",
+        "use_keyless": true,
+        "detailed_tracing": true,
+        "version_data": {
+          "not_versioned": true,
+          "versions": {
+            "Default": {
+              "name": "Default",
+              "use_extended_paths": true
+            }
+          }
+        },
+        "proxy": {
+          "listen_path": "/hello-world/",
+          "target_url": "http://httpbin.org/",
+          "strip_listen_path": true
+        },
+        "active": true
+    }
+    ```
+
+    This API definition sets up a basic API named Hello-World for testing purposes, configured to proxy requests to `http://httpbin.org/`.
+
+3. **Run Tyk Gateway OSS with OpenTelemetry Enabled**
+
+    To run Tyk Gateway with OpenTelemetry integration, extend the previous Docker Compose file to include Tyk Gateway and Redis services. Follow these steps:
+
+    - Add the following configuration to your existing docker-compose.yml file:
+
+    ```yaml
+    # ... Existing docker-compose.yml content for jaeger
+
+    tyk:
+      image: tykio/tyk-gateway:v5.2.0
+      ports:
+        - 8080:8080
+      environment:
+        - TYK_GW_OPENTELEMETRY_ENABLED=true
+        - TYK_GW_OPENTELEMETRY_EXPORTER=grpc
+        - TYK_GW_OPENTELEMETRY_ENDPOINT=jaeger-all-in-one:4317
+      volumes:
+        - ${TYK_APPS:-./apps}:/opt/tyk-gateway/apps
+      depends_on:
+        - redis
+
+    redis:
+      image: redis:4.0-alpine
+      ports:
+        - 6379:6379
+      command: redis-server --appendonly yes
+    ```
+
+    - Navigate to the directory containing the docker-compose.yml file in your terminal.
+    - Execute the following command to start the services:
+
+    ```bash
+    docker compose up
+    ```
+
+4. **Explore OpenTelemetry Traces in Jaeger**
+
+    - Start by sending a few requests to the API endpoint configured in Step 2:
+    ```bash
+    curl http://localhost:8080/hello-world/ -i
+    ```
+
+    - Access Jaeger at [http://localhost:16686](http://localhost:16686).
+    - In Jaeger's interface:
+    - Select the service named tyk-gateway.
+    - Click the *Find Traces* button.
+
+    You should observe traces generated by Tyk Gateway, showcasing the distributed tracing information.
+
+    <img src="/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger.png" alt="Tyk API Gateway distributed trace in Jaeger" />
+
+    Select a trace to visualize its corresponding internal spans:
+
+    <img src="/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger-spans.png" alt="Tyk API Gateway spans in Jaeger" />
+
+
+## Using Kubernetes
+
+This guide explains how to set up [Jaeger](https://www.jaegertracing.io/)  to ingest OpenTelemetry traces via the OpenTelemetry Collector (OTel Collector) using Kubernetes. We will cover the installation of essential components, their configuration, and the process of ensuring seamless integration.
+
+For Docker instructions, please refer to [How to integrate with Jaeger on Docker](#using-docker).
+
+
+### Prerequisites
+
+Ensure the following prerequisites are in place before proceeding:
+
+- A functional Kubernetes cluster
+- [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) and [helm](https://helm.sh/docs/intro/install/) CLI tools installed
+
+### Steps for Configuration
+
+1. **Install Jaeger Operator**
+
+    For the purpose of this tutorial, we will use jaeger-all-in-one, which includes the Jaeger agent, collector, query, and UI in a single pod with in-memory storage. This deployment is intended for development, testing, and demo purposes. Other deployment patterns can be found in the [Jaeger Operator documentation](https://www.jaegertracing.io/docs/1.51/operator/#deployment-strategies).
+
+
+    1. Install the cert-manager release manifest (required by Jaeger)
+
+    ```bash
+    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.2/cert-manager.yaml
+    ```
+
+    2. Install [Jaeger Operator](https://www.jaegertracing.io/docs/1.51/operator/).
+
+    ```bash
+    kubectl create namespace observability
+    kubectl create -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.51.0/jaeger-operator.yaml -n observability
+
+    ```
+
+    3. After the Jaeger Operator is deployed to the `observability` namespace, create a Jaeger instance:
+
+    ```bash
+    kubectl apply -n observability -f - <<EOF
+    apiVersion: jaegertracing.io/v1
+    kind: Jaeger
+    metadata:
+      name: jaeger-all-in-one
+    EOF
+    ```
+
+2. **Deploy Tyk Gateway with OpenTelemetry Enabled using Helm**
+
+    To install or upgrade [Tyk Gateway OSS using Helm](https://github.com/TykTechnologies/tyk-charts/tree/main/tyk-oss), execute the following commands:
+
+    ```bash
+    NAMESPACE=tyk
+    APISecret=foo
+    TykVersion=v5.3.0
+    REDIS_BITNAMI_CHART_VERSION=19.0.2
+
+    helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --create-namespace --install --version $REDIS_BITNAMI_CHART_VERSION --set image.repository=bitnamilegacy/redis
+    helm upgrade tyk-otel tyk-helm/tyk-oss -n $NAMESPACE --create-namespace \
+    --install \
+    --set global.secrets.APISecret="$APISecret" \
+    --set tyk-gateway.gateway.image.tag=$TykVersion \
+    --set global.redis.addrs="{tyk-redis-master.$NAMESPACE.svc.cluster.local:6379}" \
+    --set global.redis.pass="$(kubectl get secret --namespace $NAMESPACE tyk-redis -o jsonpath='{.data.redis-password}' | base64 -d)" \
+    --set tyk-gateway.gateway.opentelemetry.enabled=true \
+    --set tyk-gateway.gateway.opentelemetry.exporter="grpc" \
+    --set tyk-gateway.gateway.opentelemetry.endpoint="jaeger-all-in-one-collector.observability.svc:4317"
+    ```
+
+    <br />
+
+    
+<Note>
+Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#redis).
+</Note>
+
+
+
+    Tyk Gateway is now accessible through service `gateway-svc-tyk-oss-tyk-gateway` at port `8080` and exports the OpenTelemetry traces to the `jaeger-all-in-one-collector` service.
+
+3. **Deploy Tyk Operator**
+
+    Deploy Tyk Operator to manage APIs in your cluster:
+
+    ```bash
+    kubectl create namespace tyk-operator-system
+    kubectl create secret -n tyk-operator-system generic tyk-operator-conf \
+    --from-literal "TYK_AUTH=$APISecret" \
+    --from-literal "TYK_ORG=org" \
+    --from-literal "TYK_MODE=ce" \
+    --from-literal "TYK_URL=http://gateway-svc-tyk-otel-tyk-gateway.tyk.svc:8080" \
+    --from-literal "TYK_TLS_INSECURE_SKIP_VERIFY=true"
+    helm install tyk-operator tyk-helm/tyk-operator -n tyk-operator-system
+
+    ```
+
+4. **Deploy a Test API Definition**
+
+    Save the following API definition as `apidef-hello-world.yaml`:
+
+    ```yaml
+    apiVersion: tyk.tyk.io/v1alpha1
+    kind: ApiDefinition
+    metadata:
+      name: hello-world
+    spec:
+      name: hello-world
+      use_keyless: true
+      protocol: http
+      active: true
+      proxy:
+        target_url: http://httpbin.org/
+        listen_path: /hello-world
+        strip_listen_path: true
+    ```
+
+    To apply this API definition, run the following command:
+
+    ```bash
+    kubectl apply -f apidef-hello-world.yaml 
+    ```
+
+    This step deploys an API definition named *hello-world* using the provided configuration. It enables a keyless HTTP API proxying requests to `http://httpbin.org/` and accessible via the path `/hello-world`.
+
+5. **Explore OpenTelemetry traces in Jaeger**
+
+    You can use the kubectl `port-forward command` to access Tyk and Jaeger services running in the cluster from your local machine's localhost:
+
+    For Tyk Gateway:
+
+    ```bash
+    kubectl port-forward service/gateway-svc-tyk-otel-tyk-gateway 8080:8080 -n tyk
+    ```
+
+    For Jaeger:
+
+    ```bash
+    kubectl port-forward service/jaeger-all-in-one-query 16686 -n observability
+    ```
+
+    Begin by sending a few requests to the API endpoint configured in step 2: 
+
+    ```bash
+    curl http://localhost:8080/hello-world/ -i
+    ```
+
+    Next, navigate to Jaeger on `http://localhost:16686`, select the ´service´ called ´tyk-gateway´ and click on the button ´Find traces´. You should see traces generated by Tyk:
+
+    <img src="/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger.png" alt="Tyk Gateway distributed trace in Jaeger" />
+
+    Click on a trace to view all its internal spans:
+
+    <img src="/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger-spans.png" alt="Tyk Gateway spans in Jaeger" />
\ No newline at end of file
diff --git a/api-management/traces/new-relic.mdx b/api-management/traces/new-relic.mdx
new file mode 100644
index 0000000000..2cea676f59
--- /dev/null
+++ b/api-management/traces/new-relic.mdx
@@ -0,0 +1,142 @@
+---
+title: "Send Tyk Traces to New Relic"
+description: "Step-by-step guide to connect Tyk Gateway distributed traces to New Relic using the OpenTelemetry Collector."
+keywords: "Distributed Tracing, New Relic, OpenTelemetry, OTLP, OTel Collector, Tyk Gateway, APM, Observability"
+sidebarTitle: "New Relic"
+---
+
+This guide explains how to set up [New Relic](https://newrelic.com/)  to ingest OpenTelemetry traces via the OpenTelemetry Collector (OTel Collector) using Docker. At the end of this guide, you will be able to visualize traces and metrics from your Tyk Gateway on the New Relic console.
+
+## Prerequisites
+
+- [Docker installed on your machine](https://docs.docker.com/get-docker/)
+- [New Relic Account](https://newrelic.com/)
+- New Relic API Key
+- Gateway v5.2.0 or higher
+- OTel Collector [docker image](https://hub.docker.com/r/otel/opentelemetry-collector)
+
+## Steps for Configuration
+
+### Step 1. Obtain New Relic API Key
+
+    1. Navigate to your New Relic Console.
+
+    2. Go to **Profile → API keys**.
+
+    3. Copy the key labeled as `INGEST-LICENSE`.
+
+    <Note>
+    You can follow the [official New Relic documentation](https://docs.newrelic.com/docs/apis/intro-apis/new-relic-api-keys/) for more information.
+    </Note>
+
+    **Example token:**
+
+    ```bash
+    93qwr27e49e168d3844c5h3d1e878a463f24NZJL
+    ```
+
+### Step 2. Configuration Files
+
+    **OTel Collector Configuration YAML**
+
+    1. Create a file named `otel-collector-config.yml` under the configs directory.
+    2. Copy the following template into that file:
+
+    ```yaml expandable
+    receivers:
+      otlp:
+        protocols:
+          http:
+            endpoint: 0.0.0.0:4318
+          grpc:
+            endpoint: 0.0.0.0:4317
+    processors:
+      batch:
+    exporters:
+      otlphttp:
+        endpoint: "<YOUR-ENVIRONMENT-STRING>"
+        headers:
+          api-Key: "<YOUR-NEW-RELIC-API-KEY>"
+    extensions:
+      health_check:
+      pprof:
+        endpoint: :1888
+      zpages:
+        endpoint: :55679
+    service:
+      extensions: [pprof, zpages, health_check]
+      pipelines:
+        traces:
+          receivers: [otlp]
+          processors: [batch]
+          exporters: [otlphttp]
+    ```
+
+    - Replace `<YOUR-ENVIRONMENT-STRING>` with your specific New Relic endpoint (`https://otlp.nr-data.net` for US or `https://otlp.eu01.nr-data.net` for EU).
+    - Replace `<YOUR-NEW-RELIC-API-KEY>` with the API key obtained in Step 1.
+
+    **Docker Compose configuration**
+
+    1. Create a file named `docker-compose.yml` at the root level of your project directory.
+
+    2. Paste the following code into that file:
+
+    ```yaml expandable
+    version: "3.9"
+    services:
+      otel-collector:
+        image: otel/opentelemetry-collector:latest
+        volumes:
+          - ./otel-collector-config.yml:/etc/otel-collector.yml
+        command: ["--config=/etc/otel-collector.yml"]
+        networks:
+          - tyk
+        ports:
+          - "1888:1888" # pprof extension
+          - "13133:13133" # health_check extension
+          - "4317:4317" # OTLP gRPC receiver
+          - "4318:4318" # OTLP http receiver
+          - "55670:55679" # zpages extension
+
+    networks:
+      tyk:
+    ```
+
+    <Note>
+    Replace the variable fields with the relevant data.
+    </Note>
+
+
+### Step 3. Testing and Verifying Traces
+
+    1. Run `docker-compose up -d` to start all services.
+
+    2. Initialize your Tyk environment.
+
+    3. Create a simple API and deploy it to your Tyk Gateway. You can follow the [Tyk Dashboard documentation](/api-management/gateway-config-managing-classic#create-an-api) for more information.
+
+    4. Send requests to the API using cURL or Postman.
+
+    5. Open New Relic Console.
+
+    6. Navigate to **APM & Services → Services - OpenTelemetry → tyk-gateway**.
+
+        <img src="/img/distributed-tracing/opentelemetry/new-relic-services.png" alt="New Relic Services" />
+
+    7. Wait for about 5 minutes for the data to populate.
+
+        Traces and graphs should now be visible on your New Relic console.
+
+        <img src="/img/distributed-tracing/opentelemetry/new-relic-metrics.png" alt="New Relic Metrics" />
+
+        <Note>
+        If traces are not showing, try refreshing the New Relic dashboard.
+        </Note>
+
+You have successfully integrated New Relic with Tyk Gateway via the OpenTelemetry Collector. You can now monitor and trace your APIs directly from the New Relic console.
+
+## Troubleshooting
+
+If the traces aren't appearing:
+- Double-check your API key and endpoints.
+- Ensure that your Tyk Gateway and New Relic are both running and connected.
diff --git a/api-management/traffic-transformation.mdx b/api-management/traffic-transformation.mdx
new file mode 100644
index 0000000000..5bb0ff9171
--- /dev/null
+++ b/api-management/traffic-transformation.mdx
@@ -0,0 +1,107 @@
+---
+title: "Transform Traffic by using Tyk Middleware"
+description: "Learn how to transform API traffic using Tyk's middleware capabilities."
+keywords: "Overview, Allow List, Block List, Ignore Authentication, Internal Endpoint, Request Method , Request Body , Request Headers , Response Body, Response Headers, Request Validation, Mock Response, Virtual Endpoints, Go Templates, JQ Transforms, Request Context Variables"
+sidebarTitle: "Overview"
+---
+
+## Overview
+
+When you configure an API on Tyk, the Gateway will proxy all requests received at the listen path that you have defined through to the upstream (target) URL configured in the API definition. Responses from the upstream are likewise proxied on to the originating client. Requests and responses are processed through a powerful [chain of middleware](/api-management/traffic-transformation#request-middleware-chain) that perform security and processing functions.
+
+Within that chain are a highly configurable set of optional middleware that can, on a per-endpint basis:
+- apply processing to [API requests](#middleware-applied-to-the-api-request) before they are proxied to the upstream service
+- apply customization to the [API response](#middleware-applied-to-the-api-response) prior to it being proxied back to the client
+
+Tyk also supports a powerful custom plugin feature that enables you to add custom processing at different stages in the processing chains. For more details on custom plugins please see the [dedicated guide](/api-management/plugins/overview#).
+
+### Middleware applied to the API Request
+
+The following standard middleware can optionally be applied to API requests on a per-endpoint basis.
+
+#### Allow list
+
+The [Allow List](/api-management/traffic-transformation/allow-list) middleware is a feature designed to restrict access to only specific API endpoints. It rejects requests to endpoints not specifically "allowed", returning `HTTP 403 Forbidden`. This enhances the security of the API by preventing unauthorized access to endpoints that are not explicitly permitted.
+
+Enabling the allow list will cause the entire API to become blocked other than for endpoints that have this middleware enabled. This is great if you wish to have very strict access rules for your services, limiting access to specific published endpoints.
+
+#### Block list
+
+The [Block List](/api-management/traffic-transformation/block-list)  middleware is a feature designed to prevent access to specific API endpoints. Tyk Gateway rejects all requests made to endpoints with the block list enabled, returning `HTTP 403 Forbidden`. 
+
+#### Cache
+
+Tyk's [API-level cache](/api-management/response-caching#basic-caching) does not discriminate between endpoints and will usually be configured to cache all safe requests. You can use the granular [Endpoint Cache](/api-management/response-caching#endpoint-caching) to ensure finer control over which API responses are cached by Tyk.
+
+#### Circuit Breaker
+
+The [Circuit Breaker](/planning-for-production/ensure-high-availability/circuit-breakers) is a protective mechanism that helps to maintain system stability by preventing repeated failures and overloading of services that are erroring. When a network or service failure occurs, the circuit breaker prevents further calls to that service, allowing the affected service time to recover while ensuring that the overall system remains functional.
+
+#### Do Not Track Endpoint
+
+If [traffic logging](/api-management/logs/traffic-logs) is enabled for your Tyk Gateway, then it will create transaction logs for all API requests (and responses) to deployed APIs. You can use the [Do-Not-Track](/api-management/traffic-transformation/do-not-track) middleware to suppress creation of transaction records for specific endpoints.
+
+#### Enforced Timeout
+
+Tyk’s [Enforced Timeout](/planning-for-production/ensure-high-availability/circuit-breakers) middleware can be used to apply a maximum time that the Gateway will wait for a response before it terminates (or times out) the request. This helps to maintain system stability and prevents unresponsive or long-running tasks from affecting the overall performance of the system.
+
+#### Ignore Authentication
+
+Adding the [Ignore Authentication](/api-management/traffic-transformation/ignore-authentication) middleware means that Tyk Gateway will not perform authentication checks on requests to that endpoint. This plugin can be very useful if you have a specific endpoint (such as a ping) that you don't need to secure.
+
+#### Internal Endpoint
+
+The [Internal Endpoint](/advanced-configuration/transform-traffic/looping#internal-only-apis) middleware instructs Tyk Gateway not to expose the endpoint externally. Tyk Gateway will then ignore external requests to that endpoint while continuing to process internal requests from other APIs; this is used for [internal routing](/advanced-configuration/transform-traffic/looping).
+
+#### Method Transformation
+
+The [Method Transformation](/api-management/traffic-transformation/request-method) middleware allows you to change the HTTP method of a request.
+
+#### Mock Response
+
+A [Mock Response](/api-management/traffic-transformation/mock-response#mock-response) is a simulated API response that can be returned by the API gateway without actually sending the request to the backend API. Mock responses are an integral feature for API development, enabling developers to emulate API behavior without the need for upstream execution.
+
+#### Request Body Transform
+
+The [Request Body Transform](/api-management/traffic-transformation/request-body) middleware allows you to perform modification to the body (payload) of the API request to ensure that it meets the requirements of your upstream service.
+
+#### Request Header Transform
+
+The [Request Header Transform](/api-management/traffic-transformation/request-headers) middleware allows you to modify the header information provided in the request before it leaves the Gateway and is passed to your upstream API.
+
+#### Request Size Limit
+
+Tyk Gateway offers a flexible tiered system of limiting request sizes ranging from globally applied limits across all APIs deployed on the gateway down to specific size limits for individual API endpoints. The [Request Size Limit](/api-management/traffic-transformation/request-size-limits) middleware provides the most granular control over request size by enabling you to set different limits for individual endpoints.
+
+#### Request Validation
+
+Tyk’s [Request Validation](/api-management/traffic-transformation/request-validation) middleware provides a way to validate the presence, correctness and conformity of HTTP requests to make sure they meet the expected format required by the upstream API endpoints.
+
+When working with Tyk OAS APIs, the request validation covers both headers and body (payload); with the older Tyk Classic API style we can validate only the request body (payload).
+
+#### Track Endpoint
+
+If you do not want to include all endpoints in your [Activity by Endpoint](/api-management/dashboard-analytics#activity-by-endpoint) statistics in Tyk Dashboard, you can enable this middleware for the endpoints to be included. 
+
+#### URL Rewrite
+
+[URL Rewriting](/transform-traffic/url-rewriting) is a powerful feature that enables the modification of the target path to match the expected endpoint format of your backend services. This allows you to translate an outbound API interface to the internal structure of your services. It is a key capability used in [internal looping](/advanced-configuration/transform-traffic/looping)
+
+#### Virtual Endpoint
+
+Tyk’s [Virtual Endpoints](/api-management/traffic-transformation/virtual-endpoints) is a programmable middleware component that allows you to perform complex interactions with your upstream service(s) that cannot be handled by one of the other middleware components.
+
+### Middleware applied to the API Response
+
+The following transformations can be applied to the response recieved from the upstream to ensure that it contains the correct data and format expected by your clients.
+
+#### Response Body Transform
+
+The [Response Body Transform](/api-management/traffic-transformation/response-body) middleware allows you to perform modification to the body (payload) of the response received from the upstream service to ensure that it meets the expectations of the client.
+
+#### Response Header Transform
+
+The [Response Header Transform](/api-management/traffic-transformation/response-headers) middleware allows you to modify the header information provided in the response before it leaves the Gateway and is passed to the client.
+### Request Middleware Chain
+
+<img src="/img/diagrams/middleware-execution-order@3x.png" alt="Middleware execution flow" />
diff --git a/api-management/traffic-transformation/allow-list.mdx b/api-management/traffic-transformation/allow-list.mdx
new file mode 100644
index 0000000000..28d8c56692
--- /dev/null
+++ b/api-management/traffic-transformation/allow-list.mdx
@@ -0,0 +1,320 @@
+---
+title: "Allow List"
+description: "Learn how to configure an endpoint Allow List for your API"
+keywords: "Traffic Transformation, Allow List"
+sidebarTitle: "Allow List"
+---
+
+## Overview
+
+The Allow List middleware is a feature designed to restrict access to only specific API endpoints. It rejects requests to endpoints not specifically "allowed", returning `HTTP 403 Forbidden`. This enhances the security of the API by preventing unauthorized access to endpoints that are not explicitly permitted.
+
+Note that this is not the same as Tyk's [IP allow list](/api-management/gateway-config-tyk-classic#ip-access-control) feature, which is used to restrict access to APIs based upon the IP of the requestor.
+
+### Use Cases
+
+#### Restricting access to private endpoints
+
+If you have a service that exposes endpoints or supports methods that you do not want to be available to clients, you should use the allow list to perform strict restriction to a subset of methods and paths. If the allow list is not enabled, requests to endpoints that are not explicitly defined in Tyk will be proxied to the upstream service and may lead to unexpected behavior.
+
+### Working
+
+Tyk Gateway does not actually maintain a list of allowed endpoints but rather works on the model whereby if the *allow list* middleware is added to an endpoint then this will automatically block all other endpoints.
+
+Tyk Gateway will subsequently return `HTTP 403 Forbidden` to any requested endpoint that doesn't have the *allow list* middleware enabled, even if the endpoint is defined and configured in the API definition.
+
+<br />
+
+<Note>
+If you enable the allow list feature by adding the middleware to any endpoint, ensure that you also add the middleware to any other endpoint for which you wish to accept requests.
+</Note>
+
+
+#### Case sensitivity
+
+By default the allow list is case-sensitive, so for example if you have defined the endpoint `GET /userID` in your API definition then only calls to `GET /userID` will be allowed: calls to `GET /UserID` or `GET /userid` will be rejected. You can configure the middleware to be case-insensitive at the endpoint level.
+
+You can also set case sensitivity for the entire [gateway](/tyk-oss-gateway/configuration#ignore_endpoint_case) in the Gateway configuration file `tyk.conf`. If case insensitivity is configured at the gateway level, this will override the endpoint-level setting.
+
+#### Endpoint parsing
+
+When using the allow list middleware, we recommend that you familiarize yourself with [Request Matching](/getting-started/key-concepts/url-matching) concepts.
+
+<br />
+
+<Note>
+Tyk recommends that you use [exact matching](/getting-started/key-concepts/url-matching#matching-modes) for maximum security, though prefix and wildcard strategies might also apply for your particular deployment or use case.
+</Note>
+
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Allow List middleware summary
+  - The Allow List is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Allow List can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+
+## Using Tyk OAS
+<a id="allow-list-using-tyk-oas"></a>
+
+The [allow list](/api-management/traffic-transformation/allow-list) is a feature designed to restrict access to only specific API endpoints. It rejects requests to endpoints not specifically "allowed", returning `HTTP 403 Forbidden`. This enhances the security of the API by preventing unauthorized access to endpoints that are not explicitly permitted.
+
+When working with Tyk OAS APIs the middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#allow-list-using-classic) page.
+
+
+### API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The allow list middleware (`allow`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `allow` object has the following configuration:
+
+- `enabled`: enable the middleware for the endpoint
+- `ignoreCase`: if set to `true` then the path matching will be case insensitive
+
+For example:
+
+```json {hl_lines=["47-50", "53-56"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-allow-list",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            },
+            "put": {
+                "operationId": "anythingput",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-allow-list",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-allow-list/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "anythingget": {
+                    "allow": {
+                        "enabled": true,
+                        "ignoreCase": true
+                    }                
+                },
+                "anythingput": {
+                    "allow": {
+                        "enabled": true,
+                        "ignoreCase": true
+                    }                
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the allow list middleware has been configured for requests to the `GET /anything` and `PUT /anything` endpoints. Requests to any other endpoints will be rejected with `HTTP 403 Forbidden`, unless they also have the allow list middleware enabled.
+Note that the allow list has been configured to be case insensitive, so calls to `GET /Anything` will be allowed
+Note also that the endpoint path has not been terminated with `$`. Requests to, for example, `GET /anything/foobar` will be allowed as the [regular expression pattern match](#endpoint-parsing) will recognize this as `GET /anything`.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the allow list feature.
+
+### API Designer
+
+Adding the allow list to your API endpoints is easy is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Allow List middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Allow List** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-allow.png" alt="Adding the Allow List middleware" />
+
+3. **Optionally configure case-insensitivity**
+
+    If you want to disable case-sensitivity for the allow list, then you must select **EDIT** on the Allow List icon.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-allow-added.png" alt="Allow List middleware added to endpoint - click through to edit the config" />
+
+    This takes you to the middleware configuration screen where you can alter the case sensitivity setting.
+    <img src="/img/dashboard/api-designer/tyk-oas-allow-config.png" alt="Configuring case sensitivity for the Allow List" />
+
+    Select **UPDATE MIDDLEWARE** to apply the change to the middleware configuration.
+
+4. **Save the API**
+
+    Select **SAVE API** to apply the changes to your API.
+
+## Using Classic
+<a id="allow-list-using-classic"></a>
+
+The [allow list](/api-management/traffic-transformation/allow-list) is a feature designed to restrict access to only specific API endpoints. It rejects requests to endpoints not specifically "allowed", returning `HTTP 403 Forbidden`. This enhances the security of the API by preventing unauthorized access to endpoints that are not explicitly permitted.
+
+When working with Tyk Classic APIs the middleware is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#allow-list-using-tyk-oas) page.
+
+### API Definition
+
+To enable and configure the allow list you must add a new `white_list` object to the `extended_paths` section of your API definition.
+
+
+<Note>
+Historically, Tyk followed the out-dated whitelist/blacklist naming convention. We are working to remove this terminology from the product and documentation, however this configuration object currently retains the old name.
+</Note>
+
+
+The `white_list` object has the following configuration:
+
+- `path`: the endpoint path
+- `method`: this should be blank
+- `ignore_case`: if set to `true` then the path matching will be case insensitive
+- `method_actions`: a shared object used to configure the [mock response](/api-management/traffic-transformation/mock-response#tyk-classic) middleware for Tyk Classic APIs
+
+The `method_actions` object should be configured as follows, with an entry created for each allowed method on the path:
+
+- `action`: this should be set to `no_action`
+- `code`: this should be set to `200`
+- `headers` : this should be blank
+
+For example:
+
+```json  {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "white_list": [
+            {
+                "disabled": false,
+                "path": "/status/200",
+                "method": "",
+                "ignore_case": false,
+                "method_actions": {
+                    "GET": {
+                        "action": "no_action",
+                        "code": 200,
+                        "headers": {}
+                    },
+                    "PUT": {
+                        "action": "no_action",
+                        "code": 200,
+                        "headers": {}
+                    }            
+                }
+            }
+        ]
+    }
+}
+```
+
+In this example the allow list middleware has been configured for HTTP `GET` and `PUT` requests to the `/status/200` endpoint. Requests to any other endpoints will be rejected with `HTTP 403 Forbidden`, unless they also have the allow list middleware enabled.
+Note that the allow list has been configured to be case sensitive, so calls to `GET /Status/200` will also be rejected.
+Note also that the endpoint path has not been terminated with `$`. Requests to, for example, `GET /status/200/foobar` will be allowed as the [regular expression pattern match](#endpoint-parsing) will recognize this as `GET /status/200`.
+
+Consult section [configuring the Allow List in Tyk Operator](#tyk-operator) for details on how to configure allow lists for endpoints using Tyk Operator.
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the allow list middleware for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer**, add an endpoint that matches the path for which you want to allow access. Select the **Whitelist** plugin.
+
+2. **Configure the allow list**
+
+    Once you have selected the middleware for the endpoint, the only additional feature that you need to configure is whether to make the middleware case insensitive by selecting **Ignore Case**.
+
+    <img src="/img/2.10/whitelist.png" alt="Allowlist options" />
+
+3. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the allow list middleware.
+
+### Tyk Operator
+
+Similar to the configuration of a Tyk Classic API Definition you must add a new `white_list` object to the `extended_paths` section of your API definition. Furthermore, the `use_extended_paths` configuration parameter should be set to `true`.
+
+
+<Note>
+Historically, Tyk followed the out-dated whitelist/blacklist naming convention. We are working to remove this terminology from the product and documentation, however this configuration object currently retains the old name.
+</Note>
+
+
+```yaml {linenos=true,linenostart=1,hl_lines=["26-34"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-whitelist
+spec:
+  name: httpbin-whitelist
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org/
+    listen_path: /httpbin
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          white_list:
+            - ignore_case: true
+              method_actions:
+                GET:
+                  action: "no_action"
+                  code: 200
+                  data: ""
+                  headers: {}
+              path: "/get"
+```
+
+In this example the allow list middleware has been configured for `HTTP GET` requests to the `/get` endpoint. Requests to any other endpoints will be rejected with `HTTP 403 Forbidden`, unless they also have the allow list middleware enabled. Note that the allow list has been configured to case insensitive, so calls to `GET /Get` will also be accepted. Note also that the endpoint path has not been terminated with `$`. Requests to, for example, `GET /get/foobar` will be allowed as the [regular expression pattern match](#endpoint-parsing) will recognize this as `GET /get`.
+
+
diff --git a/api-management/traffic-transformation/block-list.mdx b/api-management/traffic-transformation/block-list.mdx
new file mode 100644
index 0000000000..758dca26d5
--- /dev/null
+++ b/api-management/traffic-transformation/block-list.mdx
@@ -0,0 +1,309 @@
+---
+title: "Block List"
+description: "Learn how to configure an endpoint Block List for your API"
+keywords: "Traffic Transformation, Block List"
+sidebarTitle: "Block List"
+---
+
+## Overview
+
+The Block List middleware is a feature designed to block access to specific API endpoints. Tyk Gateway rejects all requests made to endpoints with the block list enabled, returning `HTTP 403 Forbidden`.
+
+Note that this is not the same as Tyk's [IP block list](/api-management/gateway-config-tyk-classic#ip-access-control) feature, which is used to restrict access to APIs based upon the IP of the requestor.
+
+### Use Cases
+
+#### Prevent access to deprecated resources
+
+If you are versioning your API and deprecating an endpoint then, instead of having to remove the functionality from your upstream service's API you can simply block access to it using the block list middleware.
+
+### Working
+
+Tyk Gateway does not actually maintain a list of blocked endpoints but rather works on the model whereby if the *block list* middleware is added to an endpoint then any request to that endpoint will be rejected, returning `HTTP 403 Forbidden`.
+
+#### Case sensitivity
+
+By default the block list is case-sensitive, so for example if you have defined the endpoint `GET /userID` in your API definition then only calls to `GET /userID` will be blocked: calls to `GET /UserID` or `GET /userid` will be allowed. You can configure the middleware to be case-insensitive at the endpoint level.
+
+You can also set case sensitivity for the entire [gateway](/tyk-oss-gateway/configuration#ignore_endpoint_case) in the Gateway configuration file `tyk.conf`. If case insensitivity is configured at the gateway level, this will override the endpoint-level setting.
+
+#### Endpoint parsing
+
+When using the block list middleware, we recommend that you familiarize yourself with [Request Matching](/getting-started/key-concepts/url-matching) options.
+
+<br />
+
+<Note>
+Tyk recommends that you use [exact matching](/getting-started/key-concepts/url-matching#matching-modes) for maximum security, though prefix and wildcard strategies might also apply for your particular deployment or use case.
+</Note>
+
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Block List middleware summary
+  - The Block List is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Block List can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+## Using Tyk OAS
+<a id="block-list-using-tyk-oas"></a>
+
+The [block list](/api-management/traffic-transformation/block-list) is a feature designed to block access to specific API endpoints. Tyk Gateway rejects all requests made to endpoints with the block list enabled, returning `HTTP 403 Forbidden`. 
+
+When working with Tyk OAS APIs the middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#block-list-using-classic) page.
+
+### API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. The `path` can contain wildcards in the form of any string bracketed by curly braces, for example `{user_id}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The block list middleware (`block`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `block` object has the following configuration:
+- `enabled`: enable the middleware for the endpoint
+- `ignoreCase`: if set to `true` then the path matching will be case insensitive
+
+For example:
+```json {hl_lines=["47-50", "53-56"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-block-list",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            },
+            "put": {
+                "operationId": "anythingput",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-block-list",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-block-list/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "anythingget": {
+                    "block": {
+                        "enabled": true,
+                        "ignoreCase": true
+                    }                
+                },
+                "anythingput": {
+                    "block": {
+                        "enabled": true,
+                        "ignoreCase": true
+                    }                
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the block list middleware has been configured for requests to the `GET /anything` and `PUT /anything` endpoints. Requests to these endpoints will be rejected with `HTTP 403 Forbidden`.
+Note that the block list has been configured to be case insensitive, so calls to `GET /Anything` will also be blocked.
+Note also that the endpoint path has not been terminated with `$`. Requests to, for example, `GET /anything/foobar` will be rejected as the [regular expression pattern match](#endpoint-parsing) will recognize this as `GET /anything`.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the block list feature.
+
+### API Designer
+
+Adding the block list to your API endpoints is easy is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Block List middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Block List** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-block.png" alt="Adding the Block List middleware" />
+
+3. **Optionally configure case-insensitivity**
+
+    If you want to disable case-sensitivity for the block list, then you must select **EDIT** on the Block List icon.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-block-added.png" alt="Block List middleware added to endpoint - click through to edit the config" />
+
+    This takes you to the middleware configuration screen where you can alter the case sensitivity setting.
+    <img src="/img/dashboard/api-designer/tyk-oas-block-config.png" alt="Configuring case sensitivity for the Block List" />
+
+    Select **UPDATE MIDDLEWARE** to apply the change to the middleware configuration.
+
+4. **Save the API**
+
+    Select **SAVE API** to apply the changes to your API.
+
+## Using Classic
+<a id="block-list-using-classic"></a>
+
+The [block list](/api-management/traffic-transformation/block-list) is a feature designed to block access to specific API endpoints. Tyk Gateway rejects all requests made to endpoints with the block list enabled, returning `HTTP 403 Forbidden`. 
+
+When working with Tyk Classic APIs the middleware is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#block-list-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring the block list in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+To enable and configure the block list you must add a new `black_list` object to the `extended_paths` section of your API definition.
+
+
+<Note>
+Historically, Tyk followed the out-dated whitelist/blacklist naming convention. We are working to remove this terminology from the product and documentation, however this configuration object currently retains the old name.
+</Note>
+
+
+The `black_list` object has the following configuration:
+- `path`: the endpoint path
+- `method`: this should be blank
+- `ignore_case`: if set to `true` then the path matching will be case insensitive
+- `method_actions`: a shared object used to configure the [mock response](/api-management/traffic-transformation/mock-response#tyk-classic) middleware for Tyk Classic APIs
+
+The `method_actions` object should be configured as follows, with an entry created for each blocked method on the path:
+- `action`: this should be set to `no_action`
+- `code`: this should be set to `200`
+- `headers` : this should be blank
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "black_list": [
+            {
+                "disabled": false,
+                "path": "/status/200",
+                "method": "",
+                "ignore_case": false,
+                "method_actions": {
+                    "GET": {
+                        "action": "no_action",
+                        "code": 200,
+                        "headers": {}
+                    }
+                    "PUT": {
+                        "action": "no_action",
+                        "code": 200,
+                        "headers": {}
+                    }            
+                }
+            }
+        ]
+    }
+}
+```
+
+In this example the block list middleware has been configured for HTTP `GET` and `PUT` requests to the `/status/200` endpoint. Requests to these endpoints will be rejected with `HTTP 403 Forbidden`.
+Note that the block list has been configured to be case sensitive, so calls to `GET /Status/200` will not be rejected.
+Note also that the endpoint path has not been terminated with `$`. Requests to, for example, `GET /status/200/foobar` will be rejected as the [regular expression pattern match](#endpoint-parsing) will recognize this as `GET /status/200`.
+
+Consult section [configuring the Allow List in Tyk Operator](#tyk-operator) for details on how to configure allow lists for endpoints using Tyk Operator.
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the block list middleware for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to prevent access. Select the **Blacklist** plugin.
+
+2. **Configure the block list**
+
+    Once you have selected the middleware for the endpoint, the only additional feature that you need to configure is whether to make the middleware case insensitive by selecting **Ignore Case**.
+
+    <img src="/img/2.10/blacklist.png" alt="Blocklist options" />
+
+3. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+### Tyk Operator
+
+Similar to the configuration of a Tyk Classic API Definition you must add a new `black_list` object to the `extended_paths` section of your API definition. Furthermore, the `use_extended_paths` configuration parameter should be set to `true`.
+
+
+<Note>
+Historically, Tyk followed the out-dated whitelist/blacklist naming convention. We are working to remove this terminology from the product and documentation, however this configuration object currently retains the old name.
+</Note>
+
+
+```yaml {linenos=true, linenostart=1, hl_lines=["26-34"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-blacklist
+spec:
+  name: httpbin-blacklist
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org/
+    listen_path: /httpbin
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          black_list:
+            - ignore_case: true
+              method_actions:
+                GET:
+                  action: "no_action"
+                  code: 200
+                  data: ""
+                  headers: {}
+              path: "/get"
+```
+
+In this example the block list middleware has been configured for HTTP `GET` requests to the `/get` endpoint. Requests to this endpoint will be rejected with `HTTP 403 Forbidden`.
+Note that the block list has been configured to be case insensitive, so calls to `GET /Get` will not be rejected.
+Note also that the endpoint path has not been terminated with `$`. Requests to, for example, `GET /get/foobar` will be rejected as the [regular expression pattern match](#endpoint-parsing) will recognize this as `GET /get`.
+
+
+
diff --git a/api-management/traffic-transformation/do-not-track.mdx b/api-management/traffic-transformation/do-not-track.mdx
new file mode 100644
index 0000000000..ff0d939a51
--- /dev/null
+++ b/api-management/traffic-transformation/do-not-track.mdx
@@ -0,0 +1,278 @@
+---
+title: "Do Not Track"
+description: "Learn how to suppress generation of traffic logs for an API endpoint"
+keywords: "Traffic Transformation, Do Not Track"
+sidebarTitle: "Do Not Track"
+---
+
+## Overview
+<a id="do-not-track-overview"></a>
+
+When [traffic logging](/api-management/logs/traffic-logs) is enabled in the Tyk Gateway, a traffic log will be generated for every request made to an API endpoint deployed on the gateway. You can suppress the generation of traffic logs for any API by enabling the do-not-track middleware. This provides granular control over request tracking.
+
+### Use Cases
+
+#### Compliance and privacy
+
+Disabling tracking on endpoints that handle personal or sensitive information is crucial for adhering to privacy laws such as GDPR or HIPAA. This action prevents the storage and logging of sensitive data, ensuring compliance and safeguarding user privacy.
+
+#### Optimizing performance
+
+For endpoints experiencing high traffic, disabling tracking can mitigate the impact on the analytics processing pipeline and storage systems. Disabling tracking on endpoints used primarily for health checks or load balancing can prevent the analytics data from being cluttered with information that offers little insight. These optimizations help to maintain system responsiveness and efficiency by reducing unnecessary data load and help to ensure that analytics efforts are concentrated on more meaningful data. 
+
+#### Cost Management
+
+In scenarios where analytics data storage and processing incur significant costs, particularly in cloud-based deployments, disabling tracking for non-essential endpoints can be a cost-effective strategy. This approach allows for focusing resources on capturing valuable data from critical endpoints.
+
+### Working
+
+When transaction logging is enabled, the gateway will automatically generate a transaction record for every request made to deployed APIs. 
+
+You can enable the do-not-track middleware on whichever endpoints for which you do not want to generate logs. This will instruct the Gateway not to generate any transaction records for those endpoints or APIs. As no record of these transactions will be generated by the Gateway, there will be nothing created in Redis and hence nothing for the pumps to transfer to the persistent storage and these endpoints will not show traffic in the Dashboard's analytics screens.
+
+
+<Note>
+You can disable tracking at the API or endpoint level, for both Tyk OAS and Tyk Classic APIs.
+</Note>
+
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Do-Not-Track middleware summary
+  - The Do-Not-Track middleware is an optional stage in Tyk's API Request processing chain sitting between the [TBC]() and [TBC]() middleware.
+  - The Do-Not-Track middleware can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+
+## Using Tyk OAS
+<a id="do-not-track-using-tyk-oas"></a>
+
+The [Do-Not-Track](#do-not-track-overview) middleware provides the facility to disable generation of transaction records (which are used to track requests to your APIs), at either the API level or the endpoint level.
+
+When working with Tyk OAS APIs the middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation) either manually within the `.json` file or from the API Designer in the Tyk Dashboard.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#do-not-track-using-classic) page.
+
+### API Definition
+
+To disable tracking for an entire API, set `enabled` to `false` under `middleware.global.trafficLogs` in the Tyk OAS Extension (`x-tyk-api-gateway`):
+
+```json
+"middleware": {
+    "global": {
+        "trafficLogs": {
+            "enabled": false
+        }
+    }
+}
+```
+
+To disable tracking for specific endpoints instead, use the `doNotTrackEndpoint` middleware, described below.
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. The `path` can contain wildcards in the form of any string bracketed by curly braces, for example `{user_id}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The do-not-track middleware (`doNotTrackEndpoint`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `doNotTrackEndpoint` object has the following configuration:
+- `enabled`: enable the middleware for the endpoint
+
+For example:
+```json {hl_lines=["39-41"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-do-not-track",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-do-not-track",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-do-not-track/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "anythingget": {
+                    "doNotTrackEndpoint": {
+                        "enabled": true
+                    }               
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the do-not-track middleware has been configured for requests to the `GET /anything` endpoint. Any such calls will not generate transaction records from the Gateway and so will not appear in the analytics.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the do-not-track middleware.
+
+### API Designer
+
+The API-level `trafficLogs.enabled` setting is currently only configurable via the raw API Definition, not a dedicated control in the API Designer. Adding do-not-track to your API endpoints, however, is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Do Not Track Endpoint middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Do Not Track Endpoint** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-do-not-track.png" alt="Adding the Do Not Track middleware" />
+
+3. **Save the API**
+
+    Select **SAVE API** to apply the changes to your API.
+
+## Using Classic
+<a id="do-not-track-using-classic"></a>
+
+The [Do-Not-Track](#do-not-track-overview) middleware provides the facility to disable generation of transaction records (which are used to track requests) at the API or endpoint level.
+
+When working with Tyk Classic APIs the middleware is configured in the Tyk Classic API Definition either manually within the `.json` file or from the API Designer in the Tyk Dashboard.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](/api-management/traffic-transformation/do-not-track#do-not-track-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring the middleware in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+You can prevent tracking for all endpoints of an API by configuring the `do_not_track` field in the root of your API definition.
+- `true`: no transaction logs will be generated for requests to the API
+- `false`: transaction logs will be generated for requests to the API
+ 
+If you want to be more granular and disable tracking only for selected endpoints, then you must add a new `do_not_track_endpoints` object to the `extended_paths` section of your API definition.
+
+The `do_not_track_endpoints` object has the following configuration:
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+
+The `path` can contain wildcards in the form of any string bracketed by curly braces, for example `{user_id}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "do_not_track_endpoints": [
+            {
+                "disabled": false,
+                "path": "/anything",
+                "method": "GET"
+            }
+        ]
+    }
+}
+```
+
+In this example the do-not-track middleware has been configured for requests to the `GET /anything` endpoint. Any such calls will not generate transaction records from the Gateway and so will not appear in the analytics.
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the per-endpoint Do-Not-Track middleware for your Tyk Classic API by following these steps. Note that the API-level middleware can only be configured from the Raw Definition screen.
+
+1. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you do not want to generate records. Select the **Do not track endpoint** plugin.
+
+    <img src="/img/gateway/middleware/classic_do_not_track.png" alt="Select the middleware" />
+
+2. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+### Tyk Operator
+
+The process for configuring the middleware in Tyk Operator is similar to that explained in configuring the middleware in the Tyk Classic API Definition.
+
+It is possible to prevent tracking for all endpoints of an API by configuring the `do_not_track` field in the root of your API definition as follows:
+
+- `true`: no transaction logs will be generated for requests to the API
+- `false`: transaction logs will be generated for requests to the API
+
+```yaml {linenos=true, linenostart=1, hl_lines=["10"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-do-not-track
+spec:
+  name: httpbin-do-not-track 
+  use_keyless: true
+  protocol: http
+  active: true
+  do_not_track: true
+  proxy:
+    target_url: http://example.com
+    listen_path: /example
+    strip_listen_path: true
+```
+
+If you want to disable tracking only for selected endpoints, then the process is similar to that defined in configuring the middleware in the Tyk Classic API Definition, i.e. you must add a new `do_not_track_endpoints` list to the extended_paths section of your API definition.
+This should contain a list of objects representing each endpoint `path` and `method` that should have tracking disabled:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["31-33"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-endpoint-tracking
+spec:
+  name: httpbin - Endpoint Track
+  use_keyless: true
+  protocol: http
+  active: true
+  do_not_track: false
+  proxy:
+    target_url: http://httpbin.org/
+    listen_path: /httpbin
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          track_endpoints:
+            - method: GET
+              path: "/get"
+          do_not_track_endpoints:
+            - method: GET
+              path: "/headers"
+```
+
+In the example above we can see that the `do_not_track_endpoints` list is configured so that requests to `GET /headers` will have tracking disabled.
+
diff --git a/api-management/traffic-transformation/go-templates.mdx b/api-management/traffic-transformation/go-templates.mdx
new file mode 100644
index 0000000000..2db74891a2
--- /dev/null
+++ b/api-management/traffic-transformation/go-templates.mdx
@@ -0,0 +1,229 @@
+---
+title: "Go Templates"
+description: "Learn how to use Go Templates with your body transforms"
+keywords: "Traffic Transformation, Go Templates"
+sidebarTitle: "Go Templates"
+---
+
+Tyk's [request](/api-management/traffic-transformation/request-body) and [response](/api-management/traffic-transformation/response-body) body transform middleware use the [Go template language](https://golang.org/pkg/text/template/) to parse and modify the provided input.
+
+Go templates are also used by Tyk's [webhook event handler](/api-management/gateway-events#event-handling-with-webhooks) to produce the payload for the HTTP request sent to the target system.
+
+In this section of the documentation, we provide some guidance and a few examples on the use of Go templating with Tyk.
+
+## Data format conversion using helper functions
+
+Tyk provides two helper functions to assist with data format translation between JSON and XML:
+- `jsonMarshal` performs JSON style character escaping on an XML field and, for complex objects, serialises them to a JSON string ([example](#xml-to-json-conversion-using-jsonmarshal))
+- `xmlMarshal` performs the equivalent conversion from JSON to XML ([example](#json-to-xml-conversion-using-xmlmarshal))
+
+When creating these functions within your Go templates, please note:
+- the use of `.` in the template refers to the entire input, whereas something like `.myField` refers to just the `myField` field of the input
+- the pipe `|` joins together the things either side of it, which is typically input data on the left and a receiving command to process the data on the right, such as `jsonMarshal`
+
+Hence `{{ . | jsonMarshal }}` will pass the entire input to the `jsonMarshal` helper function.
+
+## Using functions within Go templates
+
+You can define and use functions in the Go templates that are used for body transforms in Tyk. Functions allow you to abstract common template logic for cleaner code and to aid reusability. Breaking the template into functions improves readability of more complex tenplates.
+
+Here is an example where we define a function called `myFunction` that accepts one parameter:
+```go
+{{- define "myFunction" }}
+  Hello {{.}}!
+{{- end}}
+```
+
+We can call that function and pass "world" as the parameter:
+```go
+{
+  "message": {{ call . "myFunction" "world"}}
+}
+```
+
+The output would be:
+```json
+{
+  "message": "Hello world!" 
+}
+```
+
+We have bundled the [Sprig Library (v3)](http://masterminds.github.io/sprig/) which provides over 70 pre-written functions for transformations to assist the creation of powerful Go templates to transform your API requests. 
+
+## Additional resources
+
+Here's a useful [blog post](https://blog.gopheracademy.com/advent-2017/using-go-templates/) and [YouTube tutorial](https://www.youtube.com/watch?v=k5wJv4XO7a0) that can help you to learn about using Go templates. 
+
+## Go templating examples
+Here we provide worked examples for both [JSON](#example-json-transformation-template) and [XML](#example-xml-transformation-template) formatted inputs. We also explain examples using the [jsonMarshal](#xml-to-json-conversion-using-jsonmarshal) and [xmlMarshal](#json-to-xml-conversion-using-xmlmarshal) helper functions.
+
+### Example JSON transformation template
+Imagine you have a published API that accepts the request listed below, but your upstream service requires a few alterations, namely:
+- swapping the values of parameters `value1` and `value2`
+- renaming the `value_list` to `transformed_list`
+- adding a `user-id` extracted from the session metadata
+- adding a `client-ip` logging the client IP
+- adding a `req-type` that logs the value provided in query parameter `type`
+
+**Input**
+- Session metadata `uid` = `user123`
+- IP address of calling client = `192.0.0.1`
+- Query parameter `type` = `strict`
+```json
+{
+  "value1": "value-1",
+  "value2": "value-2",
+  "value_list": [
+    "one",
+    "two",
+    "three"
+  ]
+}
+```
+
+**Template**
+```go
+{
+  "value1": "{{.value2}}",
+  "value2": "{{.value1}}",
+  "transformed_list": [
+    {{range $index, $element := index . "value_list"}}
+    {{if $index}}, {{end}}
+    "{{$element}}"
+    {{end}}
+  ],
+  "user-id": "{{._tyk_meta.uid}}",
+  "user-ip": "{{._tyk_context.remote_addr}}",
+  "req-type": "{{ ._tyk_context.request_data.param.type }}" 
+}
+```
+In this template:
+- `.value1` accesses the "value1" field of the input JSON
+- we swap value1 and value2
+- we use the range function to loop through the "value_list" array
+- `._tyk_meta.uid` injects the "uid" session metadata value
+- `._tyk_context.remote_addr` injects the client IP address from the context
+- `._tyk_context.request_data.param.type` injects query parameter "type"
+
+**Output**
+``` .json
+{
+  "value1": "value-2",
+  "value2": "value-1",
+  "transformed_list": [
+    "one",
+    "two",
+    "three"
+  ],
+  "user-id": "user123"
+  "user-ip": "192.0.0.1"
+  "req-type": "strict"
+}
+```
+
+### Example XML transformation template
+XML cannot be as easily decoded into strict structures as JSON, so the syntax is a little different when working with an XML document. Here we are performing the reverse translation, starting with XML and converting to JSON.
+
+**Input**
+- Session metadata `uid` = `user123`
+- IP address of calling client = `192.0.0.1`
+- Query parameter `type` = `strict`
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<data>
+  <body>
+    <value1>value-1</value1>
+    <value2>value-2</value2>
+    <valueList>
+      <item>one</item>
+      <item>two</item>
+      <item>three</item>
+    </valueList>
+  </body>
+</data>
+```
+
+**Template**
+``` .xml
+<?xml version="1.0" encoding="UTF-8"?>
+<data>
+  <body>
+    <value1>{{ .data.body.value2 }}</value1>
+    <value2>{{ .data.body.value1 }}</value2>
+    <transformedList>
+      {{range $index, $element := .data.body.valueList.item }}
+      <item>{{$element}}</item>
+      {{end}}
+    </transformedList>
+    <userId>{{ ._tyk_meta.uid }}</userId>
+    <userIp>{{ ._tyk_context.remote_addr }}</userIp>
+    <reqType>{{ ._tyk_context.request_data.param.type }}</reqType>
+  </body>
+</data>
+```
+In this template:
+- `.data.body.value1` accesses the "value1" field of the input XML
+- we swap value1 and value2
+- we use the range function to loop through the "value_list" array
+- `._tyk_meta.uid` injects the "uid" session metadata value
+- `._tyk_context.remote_addr` injects the client IP address from the context
+- `._tyk_context.request_data.param.type` injects query parameter "type"
+
+**Output**
+``` .xml
+<?xml version="1.0" encoding="UTF-8"?>
+<data>
+  <body>
+    <value1>value-2</value1>
+    <value2>value-1</value2>
+    <transformedList>
+      <item>one</item>
+      <item>two</item>
+      <item>three</item>
+    </transformedList>
+    <userId>user123</userId>
+    <userIp>192.0.0.1</userIp>
+    <reqType>strict</reqType>
+  </body>
+</data>
+```
+
+### XML to JSON conversion using jsonMarshal
+The `jsonMarshal` function converts XML formatted input into JSON, for example:
+
+**Input**
+```xml
+<hello>world</hello>
+```
+
+**Template**
+```go
+{{ . | jsonMarshal }}
+```
+
+**Output**
+```json
+{"hello":"world"}
+```
+
+Note that in this example, Go will step through the entire data structure provided to the template. When used in the [Request](/api-management/traffic-transformation/request-body#data-accessible-to-the-middleware) or [Response](/api-management/traffic-transformation/request-body#data-accessible-to-the-middleware) Body Transform middleware, this would include Context Variables and Session Metadata if provided to the middleware.
+
+### JSON to XML conversion using xmlMarshal
+The `xmlMarshal` function converts JSON formatted input into XML, for example:
+
+**Input**
+```json
+{"hello":"world"}
+```
+**Template**
+``` .go
+{{ . | xmlMarshal }}
+```
+
+**Output**
+```xml
+<hello>world</hello>
+```
+
+Note that in this example, Go will step through the entire data structure provided to the template. When used in the [Request](/api-management/traffic-transformation/request-body#data-accessible-to-the-middleware) or [Response](/api-management/traffic-transformation/request-body#data-accessible-to-the-middleware) Body Transform middleware, this would include Context Variables and Session Metadata if provided to the middleware.
+
diff --git a/api-management/traffic-transformation/ignore-authentication.mdx b/api-management/traffic-transformation/ignore-authentication.mdx
new file mode 100644
index 0000000000..f4e64f0a7f
--- /dev/null
+++ b/api-management/traffic-transformation/ignore-authentication.mdx
@@ -0,0 +1,301 @@
+---
+title: "Ignore Authentication"
+description: "Learn how to skip authentication for an API endpoint"
+keywords: "Traffic Transformation, Ignore Authentication"
+sidebarTitle: "Ignore Authentication"
+---
+
+## Overview
+<a id="ignore-authentication-overview"></a>
+
+The Ignore Authentication middleware instructs Tyk Gateway to skip the authentication step for calls to an endpoint, even if authentication is enabled for the API.
+
+### Use Cases
+
+#### Health and liveness endpoints
+
+This plugin can be very useful if you have an endpoint (such as a ping or health check) that you don’t need to secure.
+
+### Working
+
+When the Ignore Authentication middleware is configured for a specific endpoint, it instructs the gateway to bypass the client authentication process for requests made to that endpoint. If other (non-authentication) middleware are configured for the endpoint, they will still execute on the request.
+
+It is important to exercise caution when using the Ignore Authentication middleware, as it effectively disables Tyk's security features for the ignored paths. Only endpoints that are designed to be public or have independent security mechanisms should be configured to bypass authentication in this way. When combining Ignore Authentication with response transformations be careful not to inadvertently expose sensitive data or rely on authentication or session data that is not present.
+
+#### Case sensitivity
+
+By default the ignore authentication middleware is case-sensitive. If, for example, you have defined the endpoint `GET /ping` in your API definition then only calls to `GET /ping` will ignore the authentication step: calls to `GET /Ping` or `GET /PING` will require authentication. You can configure the middleware to be case insensitive at the endpoint level.
+
+You can also set case sensitivity for the entire Tyk Gateway in its [configuration file](/tyk-oss-gateway/configuration#ignore_endpoint_case) `tyk.conf`. If case insensitivity is configured at the gateway level, this will override the endpoint-level setting.
+
+#### Endpoint parsing
+
+When using the ignore authentication middleware, we recommend that you familiarize yourself with [Request Matching](/getting-started/key-concepts/url-matching) options.
+
+<br />
+
+<Note>
+Tyk recommends that you use [exact matching](/getting-started/key-concepts/url-matching#matching-modes) for maximum security, though prefix and wildcard strategies might also apply for your particular deployment or use case.
+</Note>
+
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Ignore Authentication middleware summary
+  - The Ignore Authentication middleware is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Ignore Authentication middleware can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+
+## Using Tyk OAS
+<a id="ignore-authentication-using-tyk-oas"></a>
+
+The [Ignore Authentication](/api-management/traffic-transformation/ignore-authentication) middleware instructs Tyk Gateway to skip the authentication step for calls to an endpoint, even if authentication is enabled for the API.
+
+When working with Tyk OAS APIs the middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#ignore-authentication-using-classic) page.
+
+### API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The ignore authentication middleware (`ignoreAuthentication`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `ignoreAuthentication` object has the following configuration:
+- `enabled`: enable the middleware for the endpoint
+- `ignoreCase`: if set to `true` then the path matching will be case insensitive
+
+For example:
+```json {hl_lines=["65-69"],linenos=true, linenostart=1}
+{
+    "info": {
+        "title": "example-ignore-authentication",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "servers": [
+        {
+            "url": "http://localhost:8181/example-ignore-authentication/"
+        }
+    ], 
+    "security": [
+        {
+            "authToken": []
+        }
+    ],     
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "components": {
+        "securitySchemes": {
+            "authToken": {
+                "type": "apiKey",
+                "in": "header",
+                "name": "Authorization"
+            }
+        }        
+    },    
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-ignore-authentication",
+            "state": {
+                "active": true,
+                "internal": false
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "authentication": {
+                "enabled": true,
+                "securitySchemes": {
+                    "authToken": {
+                        "enabled": true
+                    }
+                }
+            },
+            "listenPath": {
+                "strip": true,
+                "value": "/example-ignore-authentication/"
+            }        
+        },
+        "middleware": {
+            "operations": {
+                "anythingget": {
+                    "ignoreAuthentication": {
+                        "enabled": true
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the ignore authentication middleware has been configured for requests to the `GET /anything` endpoint. Any such calls will skip the authentication step in the Tyk Gateway's processing chain.
+- the middleware has been configured to be case sensitive, so calls to `GET /Anything` will not skip authentication
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the Ignore Authentication middleware.
+
+### API Designer
+
+Adding and configuring the Ignore Authentication middleware to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Ignore Authentication middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Ignore Authentication** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-ignore.png" alt="Adding the Ignore Authentication middleware" />
+
+3. **Optionally configure case-insensitivity**
+
+    If you want to disable case-sensitivity for the path that you wish to skip authentication, then you must select **EDIT** on the Ignore Authentication icon.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-ignore-added.png" alt="Ignore Authentication middleware added to endpoint - click through to edit the config" />
+
+    This takes you to the middleware configuration screen where you can alter the case sensitivity setting.
+    <img src="/img/dashboard/api-designer/tyk-oas-ignore-config.png" alt="Configuring case sensitivity for the path for which to ignore authentication" />
+
+    Select **UPDATE MIDDLEWARE** to apply the change to the middleware configuration.
+
+4. **Save the API**
+
+    Select **SAVE API** to apply the changes to your API.
+
+## Using Classic
+<a id="ignore-authentication-using-classic"></a>
+
+The [Ignore Authentication](/api-management/traffic-transformation/ignore-authentication) middleware instructs Tyk Gateway to skip the authentication step for calls to an endpoint, even if authentication is enabled for the API.
+
+When working with Tyk Classic APIs the middleware is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#ignore-authentication-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring the middleware in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+To enable the middleware you must add a new `ignored` object to the `extended_paths` section of your API definition.
+
+The `ignored` object has the following configuration:
+- `path`: the endpoint path
+- `method`: this should be blank
+- `ignore_case`: if set to `true` then the path matching will be case insensitive
+- `method_actions`: a shared object used to configure the [mock response](/api-management/traffic-transformation/mock-response#tyk-classic) middleware for Tyk Classic APIs
+
+The `method_actions` object should be configured as follows, with an entry created for each allowed method on the path:
+- `action`: this should be set to `no_action`
+- `code`: this should be set to `200`
+- `headers` : this should be blank
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "ignored": [
+            {
+                "disabled": false,
+                "path": "/status/200",
+                "method": "",
+                "ignore_case": false,
+                "method_actions": {
+                    "GET": {
+                        "action": "no_action",
+                        "code": 200,
+                        "headers": {}
+                    }          
+                }
+            }
+        ]
+    }
+}
+```
+
+In this example the ignore authentication middleware has been configured for requests to the `GET /status/200` endpoint. Any such calls will skip the authentication step in the Tyk Gateway's processing chain.
+- the middleware has been configured to be case sensitive, so calls to `GET /Status/200` will not skip authentication
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the Ignore Authentication middleware for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to ignore authentication. Select the **Ignore** plugin.
+
+    <img src="/img/dashboard/endpoint-designer/ignore-authentication.png" alt="Adding the ignore authentication middleware to a Tyk Classic API endpoint" />
+
+2. **Configure the middleware**
+
+    Once you have selected the Ignore middleware for the endpoint, the only additional feature that you need to configure is whether to make it case-insensitive by selecting **Ignore Case**.
+
+    <img src="/img/2.10/ignore.png" alt="Ignore options" />
+
+3. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+### Tyk Operator
+
+The process for configuring the middleware in Tyk Operator is similar to that explained in configuring the middleware in the Tyk Classic API Definition. It is possible to configure an enforced timeout using the `ignored` object within the `extended_paths` section of the API Definition.
+
+In the example below the ignore authentication middleware has been configured for requests to the `GET /get` endpoint. Any such calls will skip the authentication step in the Tyk Gateway's processing chain.
+- the middleware has been configured to be case insensitive, so calls to `GET /Get` will also skip authentication
+
+```yaml {linenos=true, linenostart=1, hl_lines=["27-35"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-ignored
+spec:
+  name: httpbin-ignored
+  use_keyless: false
+  use_standard_auth: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org/
+    listen_path: /httpbin
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          ignored:
+            - ignore_case: true
+              method_actions:
+                GET:
+                  action: "no_action"
+                  code: 200
+                  data: ""
+                  headers: {}
+              path: "/get"
+```
\ No newline at end of file
diff --git a/api-management/traffic-transformation/jq-transforms.mdx b/api-management/traffic-transformation/jq-transforms.mdx
new file mode 100644
index 0000000000..9fe3e99686
--- /dev/null
+++ b/api-management/traffic-transformation/jq-transforms.mdx
@@ -0,0 +1,65 @@
+---
+title: "JQ Transforms"
+description: "Learn how to use the experimental JQ traffic transformation middleware"
+keywords: "Traffic Transformation, JQ Transforms"
+sidebarTitle: "JQ Transforms"
+---
+
+
+<Note>
+This feature is experimental and can be used only if you compile Tyk yourself own using `jq` tag: `go build --tags 'jq'`
+</Note>
+
+
+
+If you work with JSON you are probably aware of the popular `jq` command line JSON processor. For more details, see https://stedolan.github.io/jq/.
+
+Now you can use the full power of its queries and transformations to transform requests, responses, headers and even context variables.
+
+We have added two new plugins: 
+
+* `transform_jq` - for request transforms.
+* `transform_jq_response` - for response transforms
+ 
+Both have the same structure, similar to the rest of our plugins: 
+`{ "path": "<path>", "method": "<method>", "filter": "<content>" }`
+
+## Request Transforms
+Inside a request transform you can use following variables:
+
+* `.body` - your current request body
+* `._tyk_context` - Tyk context variables. You can use it to access request headers as well.
+
+Your JQ request transform should return an object in the following format: 
+`{ "body": <transformed-body>, "rewrite_headers": <set-or-add-headers>, "tyk_context": <set-or-add-context-vars> }`. 
+
+`body` is required, while `rewrite_headers` and `tyk_context` are optional.
+
+## Response Transforms
+Inside a response transform you can use following variables:
+
+* `.body` - your current response body
+* `._tyk_context` - Tyk context variables. You can use it to access request headers as well.
+* `._tyk_response_headers` - Access to response headers
+
+Your JQ response transform should return an object in the following format: 
+`{ "body": <transformed-body>, "rewrite_headers": <set-or-add-headers>}`. 
+
+`body` is required, while `rewrite_headers` is optional.
+
+## Example
+```{.json}
+"extended_paths": {
+  "transform_jq": [{
+    "path": "/post",
+    "method": "POST",
+    "filter": "{\"body\": (.body + {\"TRANSFORMED-REQUEST-BY-JQ\": true, path: ._tyk_context.path, user_agent: ._tyk_context.headers_User_Agent}), \"rewrite_headers\": {\"X-added-rewrite-headers\": \"test\"}, \"tyk_context\": {\"m2m_origin\": \"CSE3219/C9886\", \"deviceid\": .body.DEVICEID}}"
+   }],
+  "transform_jq_response": [{
+    "path": "/post",
+    "method": "POST",
+    "filter": "{\"body\": (.body + {\"TRANSFORMED-RESPONSE-BY-JQ\": true, \"HEADERS-OF-RESPONSE\": ._tyk_response_headers}), \"rewrite_headers\": {\"JQ-Response-header\": .body.origin}}"
+  }]
+}
+```
+
diff --git a/api-management/traffic-transformation/mock-response.mdx b/api-management/traffic-transformation/mock-response.mdx
new file mode 100644
index 0000000000..ba16dc0b01
--- /dev/null
+++ b/api-management/traffic-transformation/mock-response.mdx
@@ -0,0 +1,324 @@
+---
+title: "Request Termination"
+description: "Learn how to configure Tyk to handle a request entirely within the Gateway, returning a response to the client without forwarding to an upstream service"
+keywords: "request termination, mock response, virtual endpoint, static response, fixed response, deprecated endpoint, endpoint blocking"
+sidebarTitle: "Request Termination"
+---
+
+Request termination configures an endpoint to generate a response directly within Tyk Gateway, without forwarding the request to an upstream service. Tyk handles the request entirely and returns the response to the client.
+
+Common uses include:
+- Returning a fixed response for a health check or status endpoint that requires no backend logic.
+- Retiring a deprecated endpoint with an informative error response.
+- Returning a maintenance message while an upstream service is offline.
+- Implementing complex response logic or aggregation that would otherwise require a dedicated microservice.
+
+## Approaches
+
+Tyk Gateway offers three mechanisms for request termination, differing in flexibility and complexity:
+
+| Approach | Flexibility | Best For |
+| :--- | :--- | :--- |
+| [Mock Response](#mock-response) | Fixed response configured in the API definition | Static responses, deprecation notices, health checks, development mocking |
+| [Virtual Endpoint](#virtual-endpoint) | JavaScript function runs in the Gateway | Dynamic responses, conditional logic, aggregation from multiple upstreams |
+| [Custom Plugins](#custom-plugins) | Custom code in Go or via gRPC (Python, Lua, others) | High-performance termination, complex business logic, access to external systems |
+
+## Mock Response
+
+The mock response middleware returns a configured static response for an endpoint. No upstream call is made.
+
+### How It Works
+
+The point in the request pipeline at which the mock response fires differs between Tyk OAS and Tyk Classic:
+
+- **Tyk OAS**: the mock response fires near the end of the request-processing chain, after authentication, rate limiting, and request transforms. The request is fully authenticated before the response is generated. Analytics records are created as normal.
+- **Tyk Classic**: the mock response fires at the start of the request-processing chain, before authentication. Credentials are not required to receive the response, and no analytics records are created.
+
+### Configuration
+
+#### Tyk OAS
+
+The `mockResponse` middleware is configured in the `operations` section of the Tyk Vendor Extension (`x-tyk-api-gateway`), under the `operationId` for the endpoint.
+
+The response that will be returned by the endpoint can be configured manually, or automatically generated from the OpenAPI description.
+
+**Manual Configuration**
+
+You can configure the desired response directly in the API definition:
+
+| Field | Description |
+| :--- | :--- |
+| `enabled` | Activates the middleware for the endpoint. |
+| `code` | The HTTP response status code. Defaults to `200` if not set. |
+| `body` | The response body, as a string. |
+| `headers` | An array of `{ "name": "...", "value": "..." }` objects to include as response headers. |
+
+```json
+"operations": {
+  "getBooksHealth": {
+    "mockResponse": {
+      "enabled": true,
+      "code": 200,
+      "body": "{\"status\": \"ok\"}",
+      "headers": [
+        { "name": "Content-Type", "value": "application/json" }
+      ]
+    }
+  }
+}
+```
+
+**From OAS Examples**
+
+Alternatively, the response can be generated automatically from example data or schema declarations in the OpenAPI description.
+
+The OpenAPI description provides the response content via one of three mechanisms:
+
+- **`example`** - a single sample value for a specific content type and response code
+- **`examples`** - a named map of sample values; use `exampleName` in `fromOASExamples` to select one, or leave `exampleName` unset to use the first entry (sorted by key).
+- **`schema`** - a JSON schema for the response body; Tyk uses any `example` values on individual schema properties, and falls back to type defaults (`"string"`, `0`, `true`) for properties with no example.
+
+`example` and `examples` are mutually exclusive within the OpenAPI description for a given response object - you cannot provide both for the same content type and response code.
+
+Response headers defined in the OpenAPI description via `headers[*].schema` are also included in the generated response.
+
+This approach is configured using `fromOASExamples`:
+
+| Field | Description |
+| :--- | :--- |
+| `enabled` | Activates automatic response generation from the OpenAPI description. |
+| `code` | (Optional) Identifies the HTTP response code for the example response that should be returned. Defaults to `200`. |
+| `contentType` | (Optional) Identifies the content type of the example response that should be returned. Defaults to `application/json`. |
+| `exampleName` | (Optional) Identifies the specific example response that should be returned via the `name` given to the example in the OpenAPI description. If not set, the first entry alphabetically is used. |
+
+The optional `code`, `contentType` and `exampleName` fields are used to select a specific response when the OpenAPI description defines responses for multiple codes, content types, or named examples. The API client can override this configuration using [control headers](#response-selection) to select a specific response.
+
+```json
+"operations": {
+  "anythingget": {
+    "mockResponse": {
+      "enabled": true,
+      "fromOASExamples": {
+        "enabled": true,
+        "code": 200,
+        "contentType": "text/plain",
+        "exampleName": "preview-example"
+      }
+    }
+  }
+}
+```
+
+**API Designer**
+
+1. **Add an endpoint** - From the API Designer, add an endpoint for the path and method to configure.
+2. **Select the Mock Response middleware** - Select **ADD MIDDLEWARE** and choose **Mock Response**.
+3. **Configure the response**:
+   - To provide the response directly, select **Manually configure mock response** and set the HTTP status code, content type, response body, and any headers.
+   - To generate from the OpenAPI description, select **Use mock response from Open API Specification** and choose the desired response code and content type from the drop-down.
+4. **Save the API** - Select **UPDATE MIDDLEWARE**, then **SAVE API**.
+
+#### Tyk Classic
+
+If using Tyk Classic, mock responses are manually configured via the `method_actions` field on an allow list, block list, or ignore authentication entry for the endpoint. Set `action` to `reply` and provide the response `code`, `data` (body), and `headers`.
+
+```json
+"extended_paths": {
+  "white_list": [
+    {
+      "path": "/health",
+      "method": "",
+      "ignore_case": false,
+      "method_actions": {
+        "GET": {
+          "action": "reply",
+          "code": 200,
+          "data": "{\"status\": \"ok\"}",
+          "headers": {
+            "Content-Type": "application/json"
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+The endpoint must be registered in one of the three list types (`white_list`, `black_list`, or `ignored`) for the mock response to take effect. The choice of list type does not affect the response returned - it determines the path matching rules applied to other endpoints on the same API.
+
+Because the Tyk Classic mock response fires before authentication, the endpoint does not require credentials regardless of the authentication method configured for the API.
+
+**API Designer**
+
+1. **Add an endpoint** - From the Endpoint Designer, add an endpoint and select the **Allow List** (or **Block List** / **Ignore Authentication**) plugin to register the path.
+2. **Add the mock response plugin** - Select the **Mock response** plugin on the same endpoint.
+3. **Configure the response** - Set the HTTP status code, headers, and body. Select **ADD** to add each header.
+4. **Save the API** - Select **Save** or **Create**.
+
+#### Tyk Operator
+
+Tyk Operator supports both Tyk OAS and Tyk Classic API definitions. The mock response middleware is configured in the same way as described above for each format.
+
+See [Tyk Operator](/api-management/automations/operator) for details on creating and managing API definitions with Tyk Operator.
+
+### Response Selection
+
+This section applies to mock responses generated from the OpenAPI description (`fromOASExamples`). Note that when the response is [configured directly](#tyk-oas) in the Tyk Vendor Extension, Tyk returns it as-is and response selection does not apply.
+
+Three control headers can be used in the request to override the defaults configured in the Tyk Vendor Extension, selecting a different response from the OpenAPI description without modifying the API definition:
+
+| Header | Overrides | Description |
+| :--- | :--- | :--- |
+| `Accept` | `fromOASExamples.contentType` | Standard HTTP header, for example `text/plain`. |
+| `X-Tyk-Accept-Example-Code` | `fromOASExamples.code` | Selects which response code's definition to use, for example `404`. |
+| `X-Tyk-Accept-Example-Name` | `fromOASExamples.exampleName` | Selects a named entry from an `examples` map. Has no effect when the media type uses a direct `example` value. |
+
+The three headers are independent and can be combined. They operate at different levels of the OAS response structure:
+- `X-Tyk-Accept-Example-Code` selects the response object.
+- `Accept` selects the media type within that response.
+- `X-Tyk-Accept-Example-Name` selects a named entry within the media type's `examples` map.
+
+#### Defaults
+
+When `fromOASExamples` is enabled and no control headers are sent, Tyk uses the values from the `fromOASExamples` configuration as defaults:
+
+- **Response code** - the value of `fromOASExamples.code`, defaulting to `200` if not set.
+- **Content type** - the value of `fromOASExamples.contentType`, defaulting to `application/json` if not set.
+- **Example name** - the value of `fromOASExamples.exampleName`, if set. If not set, no name is used and selection falls through to the priority order below.
+
+#### Selection Priority
+
+Once the response code and content type have been resolved, Tyk selects the example body from the matching section of the OpenAPI description in the following order:
+
+1. **Direct `example` value** - if the media type declares a single `example` value (not an `examples` map), that value is returned. The `X-Tyk-Accept-Example-Name` header and `fromOASExamples.exampleName` are both ignored in this case.
+
+2. **Named entry from `examples`** - if an example name is set (via `fromOASExamples.exampleName` or the `X-Tyk-Accept-Example-Name` header), Tyk looks up that name in the media type's `examples` map. If the name is not found, Tyk returns `HTTP 404`.
+
+3. **First entry alphabetically from `examples`** - if no example name is set and the media type has an `examples` map, Tyk sorts the keys alphabetically and returns the first non-nil entry. This selection is deterministic from Tyk Gateway 5.8 onwards. In earlier versions, Tyk iterated directly over the map and the selection was non-deterministic.
+
+4. **Schema-derived example** - if no `example` or `examples` values are present, Tyk generates a body from the media type's JSON schema, using any `example` values on individual properties and falling back to type defaults (`"string"`, `0`, `true`) for properties with no example.
+
+If no example can be resolved at the selected code and content type, Tyk returns `HTTP 404`.
+
+#### Error Responses
+
+| Condition | Response |
+| :--- | :--- |
+| `X-Tyk-Accept-Example-Code` is not a valid integer | `HTTP 400` |
+| No response defined for the selected HTTP code | `HTTP 404` |
+| No content defined for the selected content type | `HTTP 404` |
+| Named example not found in the `examples` map | `HTTP 404` |
+
+## Virtual Endpoint
+
+The virtual endpoint middleware runs a JavaScript function directly within Tyk Gateway. The function determines the response returned to the client. No upstream call is made unless the function explicitly makes one.
+
+Virtual endpoints run after authentication, rate limiting, and request transforms. They have access to the full request context and the client's session data.
+
+Use a virtual endpoint when the response depends on logic that cannot be expressed in static configuration - for example, conditional responses based on request content, aggregation of data from multiple upstream services, or calls to an external service to look up data before responding.
+
+Virtual endpoints require the Tyk JavaScript Virtual Machine to be enabled in `tyk.conf` (`enable_jsvm: true`). They are not available in deployments where the JSVM is disabled.
+
+For full configuration detail, the JavaScript function API, and examples, see [Virtual Endpoints](/api-management/traffic-transformation/virtual-endpoints).
+
+## Custom Plugins
+
+Custom plugins can also terminate requests by writing a response directly, without forwarding to an upstream service. Unlike mock response and virtual endpoints, plugins are compiled and loaded separately from the API definition, and can call external systems, use arbitrary dependencies, and run at native speed.
+
+Plugins can be attached at multiple points in the request-processing chain - as pre-auth hooks, post-auth hooks, or response hooks. A plugin that terminates the request should be registered as a post-auth hook when authentication is required, or as a pre-auth hook when the response must be returned before authentication runs.
+
+For full detail on writing and deploying plugins, see:
+- [Go Plugins](/api-management/plugins/golang)
+- [Rich Plugins](/api-management/plugins/rich-plugins) (gRPC, Python, Lua)
+- [Plugin Types](/api-management/plugins/plugin-types)
+
+## Worked Example
+
+Acme Publishing is retiring the legacy single-book download endpoint `GET /books/{category}/{id}/download` in favor of the authenticated download flow introduced in [Internal Routing](/advanced-configuration/transform-traffic/looping). The endpoint is configured to return `HTTP 410 Gone` with a message directing clients to the replacement flow.
+
+**Tyk OAS Configuration**
+
+```json
+"operations": {
+  "getLegacyBookDownload": {
+    "mockResponse": {
+      "enabled": true,
+      "code": 410,
+      "body": "This endpoint has been retired. Download books using GET /books/{category}/{id}?download=true with a valid subscriber token.",
+      "headers": [
+        { "name": "Content-Type", "value": "text/plain" },
+        { "name": "Deprecation", "value": "true" }
+      ]
+    }
+  }
+}
+```
+
+If using Tyk Classic, add to `extended_paths.white_list` (or `black_list` / `ignored`):
+
+```json
+"extended_paths": {
+  "white_list": [
+    {
+      "path": "/{category}/{id}/download",
+      "method": "",
+      "ignore_case": false,
+      "method_actions": {
+        "GET": {
+          "action": "reply",
+          "code": 410,
+          "data": "This endpoint has been retired. Download books using GET /books/{category}/{id}?download=true with a valid subscriber token.",
+          "headers": {
+            "Content-Type": "text/plain",
+            "Deprecation": "true"
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+**Outcomes**
+
+| Request | Response |
+| :--- | :--- |
+| `GET /books/fiction/9780/download` | `HTTP 410` with deprecation message and `Deprecation: true` header |
+
+With Tyk OAS, the Books API is keyless so no credentials are required; the mock response fires after the no-op authentication stage. With Tyk Classic, the response fires before authentication.
+
+**DIAGRAM PLACEHOLDER: Request Termination vs Normal Routing**
+{/*
+  Diagram: Request Termination vs Normal Routing
+
+  Purpose: Show the contrast between a normal request (forwarded to upstream) and a
+  terminated request (response generated at the Gateway). The key insight is that
+  the request never reaches the upstream when termination is configured.
+
+  Structure: Two vertical flows side by side.
+
+  Left flow (normal routing):
+  1. Client sends request
+  2. Gateway: Auth → Rate limit → Transforms (single labelled box)
+  3. Arrow to upstream service (grey rectangle)
+  4. Response returned to client
+
+  Right flow (request termination):
+  1. Client sends request
+  2. Gateway: Auth → Rate limit → Transforms (same box structure as left)
+  3. Mock Response / Virtual Endpoint / Plugin box (blue, labelled "terminates here")
+  4. Arrow blocked before upstream - upstream box greyed out with "not reached" label
+  5. Response returned directly to client from the termination box
+
+  Key visual elements:
+  - The "terminates here" label on the right flow's termination box is the most
+    important annotation - make it visually prominent
+  - The upstream box on the right must be visually suppressed (grey, strikethrough,
+    or absent) to make clear the upstream is not reached
+  - A small annotation "no upstream call" on the right flow
+
+  Design notes:
+  - Keep both flows vertically aligned so the contrast is immediately obvious
+  - A small inset below the diagram can show the Tyk Classic difference: mock
+    response fires before the Auth/Rate limit box, not after it
+*/}
diff --git a/api-management/traffic-transformation/request-body.mdx b/api-management/traffic-transformation/request-body.mdx
new file mode 100644
index 0000000000..4731aac989
--- /dev/null
+++ b/api-management/traffic-transformation/request-body.mdx
@@ -0,0 +1,395 @@
+---
+title: "Request Body"
+description: "Learn how to transform the body of API requests"
+keywords: "Traffic Transformation, Request Body"
+sidebarTitle: "Request Body"
+---
+
+## Overview
+
+Tyk enables you to modify the payload of API requests before they are proxied to the upstream. This makes it easy to transform between payload data formats or to expose legacy APIs using newer schema models without having to change any client implementations. This middleware is only applicable to HTTP methods that can support a request body (i.e. PUT, POST or PATCH).
+
+With the body transform middleware you can modify XML or JSON formatted payloads to ensure that the response contains the information required by your upstream service. You can enrich the request by adding contextual data that is held by Tyk but not included in the original request from the client.
+
+This middleware changes only the payload and not the headers. You can, however, combine this with the [Request Header Transform](/api-management/traffic-transformation/request-headers) middleware to apply more complex transformation to requests.
+
+There is a closely related [Response Body Transform](/api-management/traffic-transformation/response-body) middleware that provides the same functionality on the response from the upstream, prior to it being returned to the client.
+
+### Use Cases
+
+#### Maintaining compatibility with legacy clients
+
+Sometimes you might have a legacy API and need to migrate the transactions to a new upstream service but do not want to upgrade all the existing clients to the newer upstream API. Using request body transformation, you can convert the incoming legacy XML or JSON request structure into a newer, cleaner JSON format that your upstream services expect.
+
+#### Shaping requests received from different devices
+
+You can detect device types via headers or context variables and transform the request payload to optimize it for that particular device. For example, you might send extra metadata to the upstream for mobile apps.
+
+#### SOAP to REST translation
+
+A common use of the request body transform middleware is to surface a legacy SOAP service with a REST API. Full details of how to perform this conversion using Tyk are provided [here](/advanced-configuration/transform-traffic/soap-rest).
+
+### Working
+
+Tyk's body transform middleware uses the [Go template language](https://golang.org/pkg/text/template/) to parse and modify the provided input. We have bundled the [Sprig Library (v3)](http://masterminds.github.io/sprig/) which provides over 70 pre-written functions for transformations to assist the creation of powerful Go templates to transform your API requests. 
+
+The Go template can be defined within the API Definition or can be read from a file that is accessible to Tyk.
+
+We have provided more detail, links to reference material and some examples of the use of Go templating [here](/api-management/traffic-transformation/go-templates).
+
+
+<Note>
+Tyk evaluates templates stored in files on startup, so if you make changes to a template you must remember to restart the gateway.
+</Note>
+
+
+#### Supported request body formats
+
+The body transformation middleware can modify request payloads in the following formats:
+- JSON
+- XML
+
+When working with JSON format data, the middleware will unmarshal the data into a data structure, and then make that data available to the template in dot-notation.
+
+#### Data accessible to the middleware
+
+The middleware has direct access to the request body and also to dynamic data as follows:
+ - [context variables](/api-management/traffic-transformation/request-context-variables), extracted from the request at the start of the middleware chain, can be injected into the template using the `._tyk_context.KEYNAME` namespace
+ - [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context), from the Tyk Session Object linked to the request, can be injected into the template using the `._tyk_meta.KEYNAME` namespace 
+ - inbound form or query data can be accessed through the `._tyk_context.request_data` namespace where it will be available in as a `key:[]value` map
+ - values from [key-value (KV) storage](/tyk-configuration-reference/kv-store#transformation-middleware) can be injected into the template using the notation appropriate to the location of the KV store
+ 
+The request body transform middleware can iterate through list indices in dynamic data so, for example, calling `{{ index ._tyk_context.request_data.variablename 0 }}` in a template will expose the first entry in the `request_data.variablename` key/value array.
+
+
+<Note>
+As explained in the [documentation](https://pkg.go.dev/text/template), templates are executed by applying them to a data structure. The template receives the decoded JSON or XML of the request body. If session variables or meta data are enabled, additional fields will be provided: `_tyk_context` and `_tyk_meta` respectively.
+</Note>
+
+
+#### Automatic XML &lt;-&gt; JSON Transformation
+
+A very common transformation that is applied in the API Gateway is to convert between XML and JSON formatted body content.
+
+The Request Body Transform supports two helper functions that you can use in your Go templates to facilitate this:
+ - `jsonMarshal` performs JSON style character escaping on an XML field and, for complex objects, serialises them to a JSON string ([example](/api-management/traffic-transformation/go-templates#xml-to-json-conversion-using-jsonmarshal))
+ - `xmlMarshal` performs the equivalent conversion from JSON to XML ([example](/api-management/traffic-transformation/go-templates#json-to-xml-conversion-using-xmlmarshal))
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Request Body Transform middleware summary
+  - The Request Body Transform middleware is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Request Body Transform middleware can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. 
+  - Request Body Transform can access both [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context) and [request context variables](/api-management/traffic-transformation/request-context-variables). */}
+
+## Using Tyk OAS
+<a id="request-body-using-tyk-oas"></a>
+
+The [request body transform](/api-management/traffic-transformation/request-body) middleware provides a way to modify the payload of API requests before they are proxied to the upstream.
+
+The middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#request-body-using-classic) page.
+
+### API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The request body transformation middleware (`transformRequestBody`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `transformRequestBody` object has the following configuration:
+- `enabled`: enable the middleware for the endpoint
+- `format`: the format of input data the parser should expect (either `xml` or `json`)
+- `body`: [see note] this is a `base64` encoded representation of your template
+- `path`: [see note] this is the path to the text file containing the template
+
+
+
+    <Note>
+    You should configure only one of `body` or `path` to indicate whether you are embedding the template within the middleware or storing it in a text file. The middleware will automatically select the correct source based on which of these fields you complete. If both are provided, then `body` will take precedence and `path` will be ignored.
+    </Note>
+
+
+For example:
+```json {hl_lines=["39-43"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-request-body-transform",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "put": {
+                "operationId": "anythingput",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-request-body-transform",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-request-body-transform/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "anythingput": {
+                    "transformRequestBody": {
+                        "enabled": true,
+                        "format": "json",
+                        "body": "ewogICJ2YWx1ZTEiOiAie3sudmFsdWUyfX0iLAogICJ2YWx1ZTIiOiAie3sudmFsdWUxfX0iLAogICJyZXEtaGVhZGVyIjogInt7Ll90eWtfY29udGV4dC5oZWFkZXJzX1hfSGVhZGVyfX0iLAogICJyZXEtcGFyYW0iOiAie3suX3R5a19jb250ZXh0LnJlcXVlc3RfZGF0YS5wYXJhbX19Igp9"
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the request body transform middleware has been configured for  requests to the `PUT /anything` endpoint. The `body` contains a base64 encoded Go template (which you can check by pasting the value into a service such as [base64decode.org](https://www.base64decode.org)).
+
+Decoded, this template is:
+```json
+{
+  "value1": "{{.value2}}",
+  "value2": "{{.value1}}",
+  "req-header": "{{._tyk_context.headers_X_Header}}",
+  "req-param": "{{._tyk_context.request_data.param}}"
+}
+```
+
+So if you make a request to `PUT /anything?param=foo` as follows:
+```bash
+PUT /anything?param=foo
+HTTP/1.1
+Host: my-gateway.host
+X-Header: bar
+
+{
+    "value1": "world",
+    "value2": "hello"
+}
+```
+
+You will receive a response from the upstream with this payload: 
+```json
+{
+    "req-header": "bar",
+    "req-param": "[foo]",
+    "value1": "hello",
+    "value2": "world"
+}
+```
+
+The `/anything` endpoint returns the details of the request that was received by httpbin.org. You can see that Tyk has swapped `value1` and `value2` and embedded the `X-Header` header and `param` query values into the body of the request.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the mock response middleware.
+
+
+<Note>
+If using a template in a file (i.e. you configure `path` in the `transformRequestBody` object), remember that Tyk will load and evaluate the template when the Gateway starts up. If you modify the template, you will need to restart Tyk in order for the changes to take effect.
+</Note>
+
+
+### API Designer
+
+Adding Request Body Transformation to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow the following steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Request Body Transform middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Request Body Transform** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-request-body.png" alt="Adding the Request Body Transform middleware" />
+
+3. **Configure the middleware**
+
+    Now you can select the request body format (JSON or XML) and add either a path to the file containing the template, or directly enter the transformation template in the text box.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-request-body-config.png" alt="Configuring the Request Body Transform middleware" />
+
+    The **Test with data** control will allow you to test your body transformation function by providing an example request body and generating the output from the transform. It is not possible to configure headers, other request parameters, context or session metadata to this template test so if you are using these data sources in your transform it will not provide a complete output, for example:
+
+    <img src="/img/dashboard/api-designer/tyk-oas-body-transform-test.png" alt="Testing the Request Body Transform" />
+
+4. **Save the API**
+
+    Select **SAVE API** to apply the changes to your API.
+
+## Using Classic
+<a id="request-body-using-classic"></a>
+
+The [request body transform](/api-management/traffic-transformation/request-body) middleware provides a way to modify the payload of API requests before they are proxied to the upstream.
+
+This middleware is configured in the Tyk Classic API Definition at the endpoint level. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you want to use dynamic data from context variables, you must [enable](/api-management/traffic-transformation/request-context-variables#enabling-context-variables-for-use-with-tyk-classic-apis) context variables for the API to be able to access them from the request header transform middleware.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#request-body-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [Configuring the middleware in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+To enable the middleware you must add a new `transform` object to the `extended_paths` section of your API definition.
+
+The `transform` object has the following configuration:
+- `path`: the path to match on
+- `method`: this method to match on
+- `template_data`: details of the Go template to be applied for the transformation of the request body
+ 
+The Go template is described in the `template_data` object by the following fields:
+- `input_type`: the format of input data the parser should expect (either `xml` or `json`)
+- `enable_session`: set this to `true` to make session metadata available to the transform template
+- `template_mode`: instructs the middleware to look for the template either in a `file` or in a base64 encoded `blob`; the actual file location (or base64 encoded template) is provided in `template_source`
+- `template_source`: if `template_mode` is set to `file`, this will be the path to the text file containing the template; if `template_mode` is set to `blob`, this will be a `base64` encoded representation of your template
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "transform": [
+            {
+                "path": "/anything",
+                "method": "POST",
+                "template_data": {
+                    "template_mode": "file",
+                    "template_source": "./templates/transform_test.tmpl",
+                    "input_type": "json",
+                    "enable_session": true
+                }
+            }
+        ]
+    }
+}
+```
+
+In this example, the Request Body Transform middleware is directed to use the template located in the `file` at location `./templates/transform_test.tmpl`. The input (pre-transformation) request payload will be `json` format and session metadata will be available for use in the transformation.
+
+
+<Note>
+Tyk will load and evaluate the template file when the Gateway starts up. If you modify the template, you will need to restart Tyk in order for the changes to take effect.
+</Note>
+
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the request body transform middleware for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the plugin**
+
+From the **Endpoint Designer** add an endpoint that matches the path for which you want to perform the transformation. Select the **Body Transforms** plugin.
+
+<img src="/img/2.10/body_transforms.png" alt="Endpoint designer" />
+
+2. **Configure the middleware**
+
+Ensure that you have selected the `REQUEST` tab, then select your input type, and then add the template you would like to use to the **Template** input box.
+
+<img src="/img/dashboard/endpoint-designer/body-transform-request.png" alt="Setting the body request transform" />
+
+3. **Test the Transform**
+
+If sample input data is available, you can use the Input box to add it, and then test it using the **Test** button. You will see the effect of the template on the sample input displayed in the Output box.
+
+<img src="/img/dashboard/endpoint-designer/body-transform-test.png" alt="Testing the body transform function" />
+
+4. **Save the API**
+
+Use the *save* or *create* buttons to save the changes and activate the Request Body Transform middleware.
+
+### Tyk Operator
+
+The process for configuring a request body transform is similar to that defined in section configuring the middleware in the Tyk Classic API Definition. Tyk Operator allows you to configure a request body transform by adding a `transform` object to the `extended_paths` section of your API definition.
+
+In the example below the Request Body middleware (`transform`) has been configured for `HTTP POST` requests to the `/anything` endpoint. The Request Body Transform middleware is directed to use the template located in the blob included in the `template_source` field. The input (pre-transformation) request payload will be json format and session metadata will be available for use in the transformation.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["32-40"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-transform
+spec:
+  name: httpbin-transform
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-transform
+    strip_listen_path: true
+  response_processors:
+    - name: response_body_transform
+    - name: header_injector
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          transform:
+            - method: POST
+              path: /anything
+              template_data:
+                enable_session: false
+                input_type: json
+                template_mode: blob
+                # base64 encoded template
+                template_source: eyJiYXIiOiAie3suZm9vfX0ifQ==
+          transform_headers:
+            - delete_headers:
+                - "remove_this"
+              add_headers:
+                foo: bar
+              path: /anything
+              method: POST
+          transform_response:
+            - method: GET
+              path: /xml
+              template_data:
+                enable_session: false
+                input_type: xml
+                template_mode: blob
+                # base64 encoded template
+                template_source: e3sgLiB8IGpzb25NYXJzaGFsIH19
+          transform_response_headers:
+            - method: GET
+              path: /xml
+              add_headers:
+                Content-Type: "application/json"
+              act_on: false
+              delete_headers: []
+```
+
diff --git a/api-management/traffic-transformation/request-context-variables.mdx b/api-management/traffic-transformation/request-context-variables.mdx
new file mode 100644
index 0000000000..783370d6a8
--- /dev/null
+++ b/api-management/traffic-transformation/request-context-variables.mdx
@@ -0,0 +1,122 @@
+---
+title: "Request Context Variables"
+description: "Learn how to use the request context in your transformation middleware"
+keywords: "Traffic Transformation, Request Context Variables"
+sidebarTitle: "Request Context Variables"
+---
+
+Context variables are extracted from the request at the start of the middleware chain. These values can be very useful for later transformation of request data, for example, in converting a form POST request into a JSON PUT request or to capture an IP address as a header.
+
+
+<Note>
+When using Tyk Classic APIs, you must [enable](#enabling-context-variables-for-use-with-tyk-classic-apis) context variables for the API to be able to access them. When using Tyk OAS APIs, the context variables are always available to the context-aware middleware.
+</Note>
+
+
+
+## Available context variables
+
+| Variable name  | Description |
+|----------------|-------------|
+| `request_data` | If the inbound request contained any query data or form data, it will be available in this object. For the header injector Tyk will format this data as `key:value1,value2,valueN;key:value1,value2` etc. |
+| `path_parts` | The components of the path, split on `/`. These values should be in the format of a comma delimited list. |
+|`token` | The inbound raw token of this user (if bearer tokens are being used). |
+| `path` | The path that is being requested. |
+| `remote_addr` | The client's IP address. |
+| `request_id` | Allows the injection of request correlation ID (for example X-Request-ID) |
+| `jwt_claims_CLAIMNAME` | If JWT tokens are being used, then each claim in the JWT is available in this format to the context processor. `CLAIMNAME` is case sensitive so use the exact claim. |
+| `cookies_COOKIENAME` | If there are cookies, then each cookie is available in context processor in this format. `COOKIENAME` is case sensitive so use the exact cookie name and replace any `-` in the cookie name with `_`. |
+| `headers_HEADERNAME` | Request headers are accessed using the following format: Convert the **first letter** in each word of an incoming header to Capital Case and replace any `-` in the `HEADERNAME` name with `_`. For example, to get the value stored in `test-header`, the syntax would be `$tyk_context.headers_Test_Header`. |
+
+From Tyk 5.13.0 the current Session's rate limit and quota data are available from the following context variables:
+
+| Variable name          | Description |
+|------------------------|-------------|
+| `rate_limit_limit`     | Number of requests that can be sent in the rate limit period |
+| `rate_limit_remaining` | Number of requests remaining in the current rate limit period |
+| `rate_limit_reset`     | Timestamp for next rate limit period reset (Unix time) |
+| `quota_limit`          | Number of requests that can be sent in the quota period |
+| `quota_remaining`      | Number of requests remaining in the current quota period |
+| `quota_reset`          | Timestamp for next quota period reset (Unix time) |
+
+## Middleware that can use context variables:
+Context variables are exposed in three middleware plugins but are accessed differently depending on the caller as follows:
+
+1.   URL Rewriter - Syntax is `$tyk_context.CONTEXTVARIABLES`. See [Path Modification](/transform-traffic/url-rewriting) for more details.
+2.   Modify Headers - Syntax is `$tyk_context.CONTEXTVARIABLES`. See [Request Headers](/api-management/traffic-transformation/request-headers) for more details.
+3.   Body Transforms - Syntax is `{{ ._tyk_context.CONTEXTVARIABLES }}`. See [Body Transforms](/api-management/traffic-transformation/request-body) for more details.
+
+
+
+    <Note>
+    The Body Transform can fully iterate through list indices within context data so, for example, calling `{{ index ._tyk_context.path_parts 0 }}` in the Go Template in a Body Transform will expose the first entry in the `path_parts` list.
+
+    URL Rewriter and Header Transform middleware cannot iterate through list indices.
+    </Note>
+
+
+
+## Example use of context variables
+
+### Examples of the syntax to use with all the available context variables:
+```
+"x-remote-addr": "$tyk_context.remote_addr",
+"x-token": "$tyk_context.token",
+"x-jwt-sub": "$tyk_context.jwt_claims_sub",
+"x-part-path": "$tyk_context.path_parts",
+"x-jwt-pol": "$tyk_context.jwt_claims_pol",
+"x-cookie": "$tyk_context.cookies_Cookie_Context_Var",
+"x-cookie-sensitive": "$tyk_context.cookies_Cookie_Case_sensitive",
+"x-my-header": "$tyk_context.headers_My_Header",
+"x-path": "$tyk_context.path",
+"x-request-data": "$tyk_context.request_data",
+"x-req-id": "$tyk_context.request_id"
+```
+<img src="/img/dashboard/system-management/context_variables_ui.jpg" alt="Example of the syntax in the UI" />
+
+### The context variable values in the response:
+```
+"My-Header": "this-is-my-header",
+"User-Agent": "PostmanRuntime/7.4.0",
+"X-Cookie": "this-is-my-cookie",
+"X-Cookie-Sensitive": "case-sensitive",
+"X-Jwt-Pol": "5bca6a739afe6a00017eb267",
+"X-Jwt-Sub": "john.doe@test.com",
+"X-My-Header": "this-is-my-header",
+"X-Part-Path": "context-var-example,anything",
+"X-Path": "/context-var-example/anything",
+"X-Remote-Addr": "127.0.0.1",
+"X-Req-Id": "e3e99350-b87a-4d7d-a75f-58c1f89b2bf3",
+"X-Request-Data": "key1:val1;key2:val2",
+"X-Token": "5bb2c2abfb6add0001d65f699dd51f52658ce2d3944d3d6cb69f07a2"
+```
+
+## Enabling Context Variables for use with Tyk Classic APIs
+1. In the your Tyk Dashboard, select `APIs` from the `System Management` menu 
+2. Open the API you want to add Context Variable to
+3. Click the `Advanced Options` tab and then select the `Enable context variables` option
+
+<img src="/img/2.10/context_variables.png" alt="Context Variables" />
+
+If not using a Tyk Dashboard, add the field `enable_context_vars` to your API definition file at root level and set it to `true`.
+
+If you are using Tyk Operator, set the field `spec.enable_context_vars` to `true`.
+
+The example API Definition below enabled context variable:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["10-10"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  enable_context_vars: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
diff --git a/api-management/traffic-transformation/request-headers.mdx b/api-management/traffic-transformation/request-headers.mdx
new file mode 100644
index 0000000000..0e859e6520
--- /dev/null
+++ b/api-management/traffic-transformation/request-headers.mdx
@@ -0,0 +1,554 @@
+---
+title: "Request Headers"
+description: "Learn how to modify API request headers"
+keywords: "Traffic Transformation, Request Headers"
+sidebarTitle: "Request Headers"
+---
+
+## Overview
+
+Tyk allows you to modify the headers of incoming requests to your API endpoints before they are passed to your upstream service.
+
+There are two options for this:
+- API-level modification that is applied to all requests to the API
+- endpoint-level modification that is applied only to requests to a specific endpoint
+
+With the header transform middleware you can append or delete any number of headers to ensure that the request contains the information required by your upstream service. You can enrich the request by adding contextual data that is held by Tyk but not included in the original request from the client.
+
+This middleware changes only the headers and not the method or payload. You can, however, combine this with the [Request Method Transform](/api-management/traffic-transformation/request-method) and [Request Body Tranform](/api-management/traffic-transformation/request-body) to apply more complex transformation to requests.
+
+There are related [Response Header Transform](/api-management/traffic-transformation/response-headers) middleware (at API-level and endpoint-level) that provide the same functionality on the response from your upstream, prior to it being returned to the client.
+
+### Use Cases
+
+#### Adding Custom Headers
+
+A common use of this feature is to add custom headers to requests, such as adding a secure header to all upstream requests (to verify that traffic is coming from the gateway), or adding a timestamp for tracking purposes.
+
+#### Modifying Headers for Compatibility
+
+You could use the request header transform middleware to modify headers for compatibility with a downstream system, such as changing the Content-Type header from "application/json" to "application/xml" for an API that only accepts XML requests while using the [Request Body Tranform](/api-management/traffic-transformation/request-body) to transform the payload.
+
+#### Prefixing or Suffixing Headers
+
+Upstream systems or corporate policies might mandate that a prefix or suffix is added to header names, such as adding a "Bearer" prefix to all Authorization headers for easier identification internally, without modifying the externally published API consumed by the client applications.
+
+#### Adding multi-user access to a service
+
+You can add multi-user access to an upstream API that has a single authentication key and you want to add multi-user access to it without modifying it or adding clunky authentication methods to it to support new users.
+
+### Working
+
+The request header transform can be applied per-API or per-endpoint; each has a separate entry in the API definition so that you can configure both API-level and endpoint-level transforms for a single API.
+
+The middleware is configured with a list of headers to delete from the request and a list of headers to add to the request. Each header to be added to the request is configured as a key:value pair.
+
+The "delete header" functionality is intended to ensure that any header in the delete list is not present once the middleware completes - so if a header is not originally present in the request but is on the list to be deleted, the middleware will ignore its omission.
+
+The "add header" functionality will capitalize any header name provided, for example if you configure the middleware to append `x-request-id` it will be added to the request as `X-Request-Id`.
+
+In the request middleware chain, the API-level transform is applied before the endpoint-level transform so if both middleware are enabled, the endpoint-level transform will operate on the headers that have been added by the API-level transform (and will not receive those that have been deleted by it).
+
+#### Injecting dynamic data into headers
+
+You can enrich the request headers by injecting data from context variables or session objects into the headers.
+- [context variables](/api-management/traffic-transformation/request-context-variables) are extracted from the request at the start of the middleware chain and can be injected into added headers using the `$tyk_context.` namespace
+- [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context), from the Tyk Session Object linked to the request, can be injected into added headers using the `$tyk_meta.` namespace
+- values from [key-value (KV) storage](/tyk-configuration-reference/kv-store#transformation-middleware) can be injected into added headers using the notation appropriate to the location of the KV store
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Request Header Transform middleware summary
+  - The Request Header Transform is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Request Header Transform can be configured at the per-endpoint or per-API level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+## Using Tyk OAS
+<a id="request-headers-using-tyk-oas"></a>
+
+Tyk's [request header transform](/api-management/traffic-transformation/request-headers) middleware enables you to append or delete headers on requests to your API endpoints before they are passed to your upstream service.
+
+There are two options for this:
+- API-level modification that is applied to all requests to the API
+- endpoint-level modification that is applied only to requests to a specific endpoint
+
+
+
+    <Note>
+    If both API-level and endpoint-level middleware are configured, the API-level transformation will be applied first.
+    </Note>
+
+
+When working with Tyk OAS APIs the transformation is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#request-headers-using-classic) page.
+
+### API Definition
+
+The API-level and endpoint-level request header transforms are configured in different sections of the API definition, though have a common configuration.
+
+### API-level transform
+
+To append headers to, or delete headers from, all requests to your API (i.e. for all endpoints) you must add a new `transformRequestHeaders` object to the `middleware.global` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition.
+
+You only need to enable the middleware (set `enabled:true`) and then configure the details of headers to `add` and those to `remove`.
+
+For example:
+```json {hl_lines=["38-56"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-request-header",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/status/200": {
+            "get": {
+                "operationId": "status/200get",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-request-header",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-request-header/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "global": {
+                "transformRequestHeaders": {
+                    "enabled": true,
+                    "remove": [
+                        "Auth_Id"
+                    ],
+                    "add": [
+                        {
+                            "name": "X-Static",
+                            "value": "foobar"
+                        },
+                        {
+                            "name": "X-Request-ID",
+                            "value": "$tyk_context.request_id"
+                        },
+                        {
+                            "name": "X-User-ID",
+                            "value": "$tyk_meta.uid"
+                        }
+                    ]
+                }
+            }
+        }
+    }
+}
+```
+
+This configuration will add three new headers to each request:
+- `X-Static` with the value `foobar`
+- `X-Request-ID` with a dynamic value taken from the `request_id` [context variables](/api-management/traffic-transformation/request-context-variables)
+- `X-User-ID` with a dynamic value taken from the `uid` field in the [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context)
+
+It will also delete one header (if present) from each request:
+- `Auth_Id`
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the API-level request header transform.
+
+### Endpoint-level transform
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The request header transform middleware (`transformRequestHeaders`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `transformRequestHeaders` object has the following configuration:
+- `enabled`: enable the middleware for the endpoint
+- `add`: a list of headers, in key:value pairs, to be appended to the request
+- `remove`: a list of headers to be deleted from the request (if present) 
+
+For example:
+```json {hl_lines=["39-50"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-request-header",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/status/200": {
+            "get": {
+                "operationId": "status/200get",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-request-header",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-request-header/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "status/200get": {
+                    "transformRequestHeaders": {
+                        "enabled": true,
+                        "remove": [
+                            "X-Static"
+                        ],
+                        "add": [
+                            {
+                                "name": "X-Secret",
+                                "value": "the-secret-key-is-secret"
+                            }
+                        ]
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the Request Header Transform middleware has been configured for requests to the `GET /status/200` endpoint. Any request received to that endpoint will have the `X-Static` header removed and the `X-Secret` header added, with the value set to `the-secret-key-is-secret`.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the endpoint-level request header transform.
+
+### Combining API-level and Endpoint-level transforms
+
+If the API-level transform in the previous [example](/api-management/traffic-transformation/request-headers#api-level-transform) is applied to the same API, then because the API-level transformation is performed first, the `X-Static` header will be added (by the API-level transform) and then removed (by the endpoint-level transform) such that the overall effect of the two transforms for a call to `GET /status/200` would be to add three headers:
+ - `X-Request-ID`
+ - `X-User-ID`
+ - `X-Secret`
+
+and to remove one:
+ - `Auth_Id` 
+
+### API Designer
+
+Adding and configuring the transforms to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+### Adding an API-level transform
+
+From the **API Designer** on the **Settings** tab, after ensuring that you are in *edit* mode, toggle the switch to **Enable Transform request headers** in the **Middleware** section:
+<img src="/img/dashboard/api-designer/tyk-oas-request-header-api-level.png" alt="Tyk OAS API Designer showing API-level Request Header Transform" />
+
+Then select **NEW HEADER** as appropriate to add or remove a header from API requests. You can add or remove multiple headers by selecting **ADD HEADER** to add another to the list:
+<img src="/img/dashboard/api-designer/tyk-oas-request-header-api-new-header.png" alt="Configuring the API-level Request Header Transform in Tyk OAS API Designer" />
+
+### Adding an endpoint level transform
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Request Header Transform middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Request Header Transform** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-request-header.png" alt="Adding the Request Header Transform middleware" />
+
+3. **Configure header transformation**
+
+    Select **NEW HEADER** to configure a header to be added to or removed from the request.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-request-header-added.png" alt="Configuring the Request Header transformation" />
+
+    You can add multiple headers to either list by selecting **NEW HEADER** again.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-request-header-new.png" alt="Adding another header to the transformation" />
+
+4. **Save the API**
+
+    Select **ADD MIDDLEWARE** to save the middleware configuration. Remember to select **SAVE API** to apply the changes.
+
+## Using Classic
+<a id="request-headers-using-classic"></a>
+
+Tyk's [request header transform](/api-management/traffic-transformation/request-headers) middleware enables you to append or delete headers on requests to your API endpoints before they are passed to your upstream service.
+
+There are two options for this:
+- API-level modification that is applied to all requests to the API
+- endpoint-level modification that is applied only to requests to a specific endpoint
+
+
+
+    <Note>
+    If both API-level and endpoint-level middleware are configured, the API-level transformation will be applied first.
+    </Note>
+
+
+When working with Tyk Classic APIs the transformation is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you want to use dynamic data from context variables, you must [enable](/api-management/traffic-transformation/request-context-variables#enabling-context-variables-for-use-with-tyk-classic-apis) context variables for the API to be able to access them from the request header transform middleware.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#request-headers-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring the Request Header Transform in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+The API-level and endpoint-level request header transforms have a common configuration but are configured in different sections of the API definition.
+
+#### API-level transform
+<a id="tyk-classic-api"></a>
+
+To **append** headers to all requests to your API (i.e. for all endpoints) you must add a new `global_headers` object to the `versions` section of your API definition. This contains a list of key:value pairs, being the names and values of the headers to be added to requests.
+
+To **delete** headers from all requests to your API, you must add a new `global_headers_remove` object to the `versions` section of the API definition. This contains a list of the names of existing headers to be removed from requests.
+
+For example:
+```json  {hl_lines=["39-45"],linenos=true, linenostart=1}
+{
+    "version_data": {
+        "versions": {
+            "Default": {
+                "global_headers": {
+                    "X-Static": "foobar",
+                    "X-Request-ID":"$tyk_context.request_id",
+                    "X-User-ID": "$tyk_meta.uid"
+                },
+                "global_headers_remove": [
+                    "Auth_Id"
+                ]
+            }
+        }
+    },
+}
+```
+
+This configuration will add three new headers to each request:
+- `X-Static` with the value `foobar`
+- `X-Request-ID` with a dynamic value taken from the `request_id` [context variables](/api-management/traffic-transformation/request-context-variables)
+- `X-User-ID` with a dynamic value taken from the `uid` field in the [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context)
+
+It will also delete one header (if present) from each request:
+- `Auth_Id`
+
+#### Endpoint-level transform
+<a id="tyk-classic-endpoint"></a>
+
+To configure a transformation of the request header for a specific endpoint you must add a new `transform_headers` object to the `extended_paths` section of your API definition.
+
+It has the following configuration:
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+- `delete_headers`: A list of the headers that should be deleted from the request
+- `add_headers`: A list of headers, in key:value pairs, that should be added to the request
+
+The `path` can contain wildcards in the form of any string bracketed by curly braces, for example `{user_id}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+For example:
+```json
+{
+    "transform_headers": [
+        {
+            "path": "status/200",
+            "method": "GET",
+            "delete_headers": ["X-Static"],
+            "add_headers": {"X-Secret": "the-secret-key-is-secret"}
+        }
+    ]
+}
+```
+
+In this example the Request Header Transform middleware has been configured for HTTP `GET` requests to the `/status/200` endpoint. Any request received to that endpoint will have the `X-Static` header removed and the `X-Secret` header added, with the value set to `the-secret-key-is-secret`.
+
+#### Combining API-level and Endpoint-level transforms
+
+If the API-level transform in the previous [example](/api-management/traffic-transformation/request-headers#api-level-transform) is applied to the same API, then because the API-level transformation is performed first, the `X-Static` header will be added (by the API-level transform) and then removed (by the endpoint-level transform) such that the overall effect of the two transforms for a call to `GET /status/200` would be to add three headers:
+- `X-Request-ID`
+- `X-User-ID`
+- `X-Secret`
+
+and to remove one:
+- `Auth_Id` 
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the request header transform middleware for your Tyk Classic API by following these steps.
+
+#### API-level transform
+
+Configuring the API-level request header transform middleware is very simple when using the Tyk Dashboard.
+
+In the Endpoint Designer you should select the **Global Version Settings** and ensure that you have selected the **Request Headers** tab:
+
+<img src="/img/2.10/global_settings_modify_headers.png" alt="Global version settings" />
+
+Note that you must click **ADD** to add a header to the list (for appending or deletion).
+
+#### Endpoint-level transform
+
+1. **Add an endpoint for the path and select the Header Transform plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to perform the transformation. Select the **Modify Headers** plugin.
+
+    <img src="/img/2.10/modify_headers.png" alt="Endpoint designer" />
+
+2. **Select the "Request" tab**
+
+    This ensures that this will only be applied to inbound requests.
+
+    <img src="/img/2.10/modify_headers1.png" alt="Request tab" />
+
+3. **Declare the headers to be modified**
+
+    Select the headers to delete and insert using the provided fields. You need to click **ADD** to ensure they are added to the list.
+
+    <img src="/img/2.10/modify_headers2.png" alt="Header transforms" />
+
+4. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+### Tyk Operator
+
+The process for configuring a request header transform is similar to that defined in section Configuring the Request Header Transform in the Tyk Classic API Definition. Tyk Operator allows you to configure a request size limit for [all endpoints of an API](#tyk-operator-api) or for a [specific API endpoint](#tyk-operator-endpoint).
+
+#### API-level transform
+<a id="tyk-operator-api"></a>
+
+Request headers can be removed and inserted using the following fields within an `ApiDefinition`:
+
+- `global_headers`: Mapping of key values corresponding to headers to add to API requests.
+- `global_headers_remove`: List containing the name of headers to remove from API requests.
+
+The example below shows an `ApiDefinition` custom resource that adds *foo-req* and *bar-req* headers to the request before it is sent upstream. The *foo-req* header has a value of *foo-val* and the *bar-req* header has a value of *bar-val*. Furthermore, the *hello* header is removed from the request before it is sent upstream.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["25-29"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-global-headers
+spec:
+  name: httpbin-global-headers
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-global-headers
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        global_headers:
+          foo-req: my-foo
+          bar-req: my-bar
+        global_headers_remove:
+          - hello
+```
+
+#### Endpoint-level transform
+<a id="tyk-operator-endpoint"></a>
+
+The process of configuring a transformation of a request header for a specific endpoint is similar to that defined in section [Endpoint-level transform](#tyk-classic-endpoint). To configure a transformation of the request header for a specific endpoint you must add a new `transform_headers` object to the `extended_paths` section of your API definition.
+
+In the example below the Request Header Transform middleware (`transform_headers`) has been configured for HTTP `POST` requests to the `/anything` endpoint. Any request received to that endpoint will have the `remove_this` header removed and the `foo` header added, with the value set to `bar`.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["41-47"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-transform
+spec:
+  name: httpbin-transform
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-transform
+    strip_listen_path: true
+  response_processors:
+    - name: response_body_transform
+    - name: header_injector
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          transform:
+            - method: POST
+              path: /anything
+              template_data:
+                enable_session: false
+                input_type: json
+                template_mode: blob
+                # base64 encoded template
+                template_source: eyJiYXIiOiAie3suZm9vfX0ifQ==
+          transform_headers:
+            - delete_headers:
+                - "remove_this"
+              add_headers:
+                foo: bar
+              path: /anything
+              method: POST
+          transform_response:
+            - method: GET
+              path: /xml
+              template_data:
+                enable_session: false
+                input_type: xml
+                template_mode: blob
+                # base64 encoded template
+                template_source: e3sgLiB8IGpzb25NYXJzaGFsIH19
+          transform_response_headers:
+            - method: GET
+              path: /xml
+              add_headers:
+                Content-Type: "application/json"
+              act_on: false
+              delete_headers: []
+```
+
diff --git a/api-management/traffic-transformation/request-method.mdx b/api-management/traffic-transformation/request-method.mdx
new file mode 100644
index 0000000000..df34c7df08
--- /dev/null
+++ b/api-management/traffic-transformation/request-method.mdx
@@ -0,0 +1,243 @@
+---
+title: "Request Method"
+description: "Learn how to modify the API request method"
+keywords: "Traffic Transformation, Request Method"
+sidebarTitle: "Request Method"
+---
+
+## Overview
+
+Tyk's Request Method Transform middleware allows you to modify the HTTP method of incoming requests to an API endpoint prior to the request being proxied to the upstream service. You might use this to map `POST` requests from clients to upstream services that support only `PUT` and `DELETE` operations, providing a modern interface to your users. It is a simple middleware that changes only the method and not the payload or headers. You can, however, combine this with the [Request Header Transform](/api-management/traffic-transformation/request-headers) and [Request Body Tranform](/api-management/traffic-transformation/request-body) to apply more complex transformation to requests.
+
+### Use Cases
+
+#### Simplifying API consumption
+
+In cases where an upstream API requires different methods (e.g. `PUT` or `DELETE`) for different functionality but you want to wrap this in a single client-facing API, you can provide a simple interface offering a single method (e.g. `POST`) and then use the method transform middleware to map requests to correct upstream method.
+
+#### Enforcing API governance and standardization
+
+You can use the transform middleware to ensure that all requests to a service are made using the same HTTP method, regardless of the original method used by the client. This can help maintain consistency across different client applications accessing the same upstream API.
+
+#### Error Handling and Redirection
+
+You can use the method transformation middleware to handle errors and redirect requests to different endpoints, such as changing a DELETE request to a GET request when a specific resource is no longer available, allowing for graceful error handling and redirection.
+
+#### Testing and debugging
+
+Request method transformation can be useful when testing or debugging API endpoints; temporarily changing the request method can help to identify issues or test specific functionalities.
+
+### Working
+
+This is a very simple middleware that is assigned to an endpoint and configured with the HTTP method to which the request should be modified. The Request Method Transform middleware modifies the request method for the entire request flow, not just for the specific upstream request, so all subsequent middleware in the processing chain will use the new (transformed) method.
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Request Method Transform middleware summary
+  - The Request Method Transform is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Request Method Transform is configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+## Using Tyk OAS
+<a id="request-method-using-tyk-oas"></a>
+
+Tyk's [request method transform](/api-management/traffic-transformation/request-method) middleware is configured at the endpoint level, where it modifies the HTTP method used in the request to a configured value.
+
+When working with Tyk OAS APIs the transformation is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#request-method-using-classic) page.
+
+### API Definition
+
+The request method transform middleware (`transformRequestMethod`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document). Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+You only need to enable the middleware (set `enabled:true`) and then configure `toMethod` as the new HTTP method to which the request should be transformed. The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the method should be transformed.
+
+All standard HTTP methods are supported: `GET`, `PUT`, `POST`, `PATCH`, `DELETE`, `HEAD`, `OPTIONS`.
+
+For example:
+```json {hl_lines=["39-41"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-request-method",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/status/200": {
+            "get": {
+                "operationId": "status/200get",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-request-method",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-request-method/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "status/200get": {
+                    "transformRequestMethod": {
+                        "enabled": true,
+                        "toMethod": "POST"
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the Request Method Transform middleware has been configured for requests to the `GET /status/200` endpoint. Any request received to that endpoint will be modified to `POST /status/200`.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the request method transform.
+
+### API Designer
+
+Adding the transform to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Method Transform middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Method Transform** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-method-transform.png" alt="Adding the Request Method Transform middleware" />
+
+3. **Configure the middleware**
+
+    Select the new HTTP method to which requests to this endpoint should be transformed
+
+    <img src="/img/dashboard/api-designer/tyk-oas-method-transform-config.png" alt="Selecting the new HTTP method for requests to the endpoint" />
+
+    Select **ADD MIDDLEWARE** to apply the change to the middleware configuration.
+
+4. **Save the API**
+
+    Select **SAVE API** to apply the changes to your API.
+
+## Using Classic
+<a id="request-method-using-classic"></a>
+
+Tyk's [request method transform](/api-management/traffic-transformation/request-method) middleware is configured at the endpoint level, where it modifies the HTTP method used in the request to a configured value.
+
+When working with Tyk Classic APIs the transformation is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#request-method-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring a Request Method Transform in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+To configure a transformation of the request method you must add a new `method_transforms` object to the `extended_paths` section of your API definition.
+
+It has the following configuration:
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+- `to_method`: The new HTTP method to which the request should be transformed
+
+All standard HTTP methods are supported: `GET`, `PUT`, `POST`, `PATCH`, `DELETE`, `HEAD`, `OPTIONS`.
+
+For example:
+```json
+{
+    "method_transforms": [
+        {
+            "path": "/status/200",
+            "method": "GET",
+            "to_method": "POST"
+        }
+    ]
+}
+```
+
+In this example the Request Method Transform middleware has been configured for HTTP `GET` requests to the `/status/200` endpoint. Any request received to that endpoint will be modified to `POST /status/200`.
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the request method transform middleware for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the Method Transform plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to perform the transformation. Select the **Method Transform** plugin.
+
+    <img src="/img/2.10/method_transform.png" alt="Method Transform" />
+
+2. **Configure the transform**
+
+    Then select the HTTP method to which you wish to transform the request.
+
+    <img src="/img/2.10/method_transform2.png" alt="Method Path" />
+
+3. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+### Tyk Operator
+
+The process for configuring a request method transform for an endpoint in Tyk Operator is similar to that defined in section configuring a Request Method Transform in the Tyk Classic API Definition.
+
+To configure a transformation of the request method you must add a new `method_transforms` object to the `extended_paths` section of your API definition:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["26-29"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.default.svc:8000
+    listen_path: /transform
+    strip_listen_path: true
+  version_data:
+    default_version: v1
+    not_versioned: true
+    versions:
+      v1:
+        name: v1
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          method_transforms:
+            - path: /anything
+              method: GET
+              to_method: POST
+```
+
+The example API Definition above configures an API to listen on path `/transform` and forwards requests upstream to http://httpbin.org.
+
+In this example the Request Method Transform middleware has been configured for `HTTP GET` requests to the `/anything` endpoint. Any request received to that endpoint will be modified to `POST /anything`.
+
diff --git a/api-management/traffic-transformation/request-size-limits.mdx b/api-management/traffic-transformation/request-size-limits.mdx
new file mode 100644
index 0000000000..03188c3e21
--- /dev/null
+++ b/api-management/traffic-transformation/request-size-limits.mdx
@@ -0,0 +1,368 @@
+---
+title: "Request Size Limits"
+description: "Learn how to set request size limits"
+keywords: "Traffic Transformation, Request Size Limits"
+sidebarTitle: "Request Size Limits"
+---
+
+## Overview
+
+With Tyk, you can apply limits to the size of requests made to your HTTP APIs. You might use this feature to protect your Tyk Gateway or upstream services from excessive memory usage or brute force attacks.
+
+Tyk Gateway offers a flexible tiered system of limiting request sizes ranging from globally applied limits across all APIs deployed on the gateway down to specific size limits for individual API endpoints.
+
+### Use Case
+
+#### Protecting the entire Tyk Gateway from DDoS attacks
+You can configure a system-wide request size limit that protects all APIs managed by the Tyk Gateway from being overwhelmed by excessively large requests, which could be part of a DDoS attack, ensuring the stability and availability of the gateway.
+
+#### Limiting request sizes for a lightweight microservice
+You might expose an API for a microservice that is designed to handle lightweight, fast transactions and is not equipped to process large payloads. You can set an API-level size limit that ensures the microservice behind this API is not forced to handle requests larger than it is designed for, maintaining its performance and efficiency.
+
+#### Controlling the size of GraphQL queries
+A GraphQL API endpoint might be susceptible to complex queries that can lead to performance issues. By setting a request size limit for the GraphQL endpoint, you ensure that overly complex queries are blocked, protecting the backend services from potential abuse and ensuring a smooth operation.
+
+#### Restricting upload size on a file upload endpoint
+An API endpoint is designed to accept file uploads, but to prevent abuse, you want to limit the size of uploads to 1MB. To enforce this, you can enable the Request Size Limit middleware for this endpoint, configuring a size limit of 1MB. This prevents users from uploading excessively large files, protecting your storage and bandwidth resources.
+
+### Working
+
+Tyk compares each incoming API request with the configured maximum size for each level of granularity in order of precedence and will reject any request that exceeds the size you have set at any level of granularity, returning an HTTP 4xx error as detailed below.
+
+All size limits are stated in bytes and are applied only to the request _body_ (or payload), excluding the headers.
+
+| Precedence | Granularity      | Error returned on failure      |
+| :------------ | :------------------ | :-------------------------------- |
+| 1st        | System (gateway) | `413 Request Entity Too Large` |
+| 2nd        | API              | `400 Request is too large`     |
+| 3rd        | Endpoint         | `400 Request is too large`     |
+
+
+<Note>
+The system level request size limit is the only size limit applied to [TCP](/key-concepts/tcp-proxy) and [Websocket](/advanced-configuration/websockets) connections.
+</Note>
+
+
+<hr />
+
+#### Applying a system level size limit
+You can configure a request size limit (in bytes) that will be applied to all APIs on your Tyk Gateway by adding `max_request_body_size` to the `http_server_options` [element](/tyk-oss-gateway/configuration#http_server_options-max_request_body_size) of your `tyk.conf` Gateway configuration. For example:
+```yaml
+"max_request_body_size": 5000
+```
+A value of zero (default) means that no maximum is set and the system-wide size limit check will not be performed.
+
+This limit will be evaluated before API-level or endpoint-level configurations. If this test fails, the Tyk Gateway will return an error `HTTP 413 Request Entity Too Large`.
+
+
+
+
+<hr />
+
+If you're using Tyk OAS APIs, then you can find details and examples of how to configure an API or endpoint-level request size limit [here](#request-size-limits-using-tyk-oas).
+
+If you're using Tyk Classic APIs, then you can find details and examples of how to configure an API or endpoint-level request size limit [here](#request-size-limits-using-classic).
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Request Size Limit middleware summary
+  - The Request Size Limit middleware is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Request Size Limit middleware can be configured at the system level within the Gateway config, or per-API or per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+
+## Using Tyk OAS
+<a id="request-size-limits-using-tyk-oas"></a>
+
+The [request size limit](/api-management/traffic-transformation/request-size-limits) middleware enables you to apply limits to the size of requests made to your HTTP APIs. You might use this feature to protect your Tyk Gateway or upstream services from excessive memory usage or brute force attacks.
+
+The middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#request-size-limits-using-classic) page.
+
+### API Definition
+
+There are three different levels of granularity that can be used when configuring a request size limit.
+- [system-wide](#applying-a-system-level-size-limit): affecting all APIs deployed on the gateway
+- [API-level](#applying-a-size-limit-for-a-specific-api): affecting all endpoints for an API
+- [endpoint-level](#applying-a-size-limit-for-a-specific-endpoint): affecting a single API endpoint
+
+#### Applying a size limit for a specific API
+
+You can configure a request size limit (in bytes) to an API by configuring the `requestSizeLimit` within the `middleware.global` element of the Tyk OAS Extension (`x-tyk-api-gateway`), for example:
+
+```json
+"x-tyk-api-gateway": {
+    "middleware": {
+        "global": {
+            "requestSizeLimit": {
+                "enabled": true,
+                "value": 2500
+            }
+        }
+    }
+}
+```
+
+A value of zero (default) means that no maximum is set and the API-level size limit check will not be performed.
+
+This limit is applied to all endpoints within an API. It is evaluated after the Gateway-wide size limit and before any endpoint-specific size limit. If this test fails, the Tyk Gateway will report `HTTP 400 Request is too large`.
+
+#### Applying a size limit for a specific endpoint
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The virtual endpoint middleware (`requestSizeLimit`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `requestSizeLimit` object has the following configuration:
+- `enabled`: enable the middleware for the endpoint
+- `value`: the maximum size permitted for a request to the endpoint (in bytes) 
+
+For example:
+```json {hl_lines=["39-44"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-request-size-limit",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "post": {
+                "operationId": "anythingpost",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-request-size-limit",
+            "state": {
+                "active": true,
+                "internal": false
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },          
+        "server": {
+            "listenPath": {
+                "value": "/example-request-size-limit/",                
+                "strip": true
+            }
+        },      
+        "middleware": {
+            "operations": {
+                "anythingpost": {
+                    "requestSizeLimit": {
+                        "enabled": true,
+                        "value": 100
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the endpoint-level Request Size Limit middleware has been configured for HTTP `POST` requests to the `/anything` endpoint. For any call made to this endpoint, Tyk will check the size of the payload (Request body) and, if it is larger than 100 bytes, will reject the request, returning `HTTP 400 Request is too large`.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the virtual endpoint middleware.
+
+### API Designer
+
+Adding the Request Size Limit middleware to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint for the path**
+
+    From the **API Designer** add an endpoint that matches the path for you want to limit the size of requests.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Request Size Limit middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Request Size Limit** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-request-size-limit.png" alt="Adding the Request Size Limit middleware" />
+
+3. **Configure the middleware**
+
+    Now you can set the **size limit** that the middleware should enforce - remember that this is given in bytes.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-request-size-limit-config.png" alt="Setting the size limit that should be enforced" />
+
+4. **Save the API**
+
+    Select **ADD MIDDLEWARE** to save the middleware configuration. Remember to select **SAVE API** to apply the changes to your API.
+
+## Using Classic
+<a id="request-size-limits-using-classic"></a>
+
+The [request size limit](/api-management/traffic-transformation/request-size-limits) middleware enables you to apply limits to the size of requests made to your HTTP APIs. You might use this feature to protect your Tyk Gateway or upstream services from excessive memory usage or brute force attacks.
+
+This middleware is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#request-size-limits-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring the middleware in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+There are three different levels of granularity that can be used when configuring a request size limit.
+- [system-wide](#applying-a-system-level-size-limit): affecting all APIs deployed on the gateway
+- [API-level](/api-management/traffic-transformation/request-headers#tyk-classic-api): affecting all endpoints for an API
+- [endpoint-level](#tyk-classic-endpoint): affecting a single API endpoint
+
+#### Applying a size limit for a specific API
+<a id="tyk-classic-api"></a>
+
+You can configure a request size limit (in bytes) to an API by configuring the `global_size_limit` within the `version` element of the API Definition, for example:
+```
+"global_size_limit": 2500 
+```
+
+A value of zero (default) means that no maximum is set and the API-level size limit check will not be performed.
+
+This limit is applied for all endpoints within an API. It is evaluated after the Gateway-wide size limit and before any endpoint-specific size limit. If this test fails, the Tyk Gateway will report `HTTP 400 Request is too large`.
+
+#### Applying a size limit for a specific endpoint
+<a id="tyk-classic-endpoint"></a>
+
+The most granular control over request sizes is provided by the endpoint-level configuration. This limit will be applied after any Gateway-level or API-level size limits and is given in bytes. If this test fails, the Tyk Gateway will report `HTTP 400 Request is too large`.
+
+To enable the middleware you must add a new `size_limits` object to the `extended_paths` section of your API definition.
+
+The `size_limits` object has the following configuration:
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+- `size_limit`: the maximum size permitted for a request to the endpoint (in bytes)
+
+For example:
+```.json  {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "size_limits": [
+            {
+                "disabled": false,
+                "path": "/anything",
+                "method": "POST",
+                "size_limit": 100
+            }
+        ]
+    }
+}
+```
+
+In this example the endpoint-level Request Size Limit middleware has been configured for HTTP `POST` requests to the `/anything` endpoint. For any call made to this endpoint, Tyk will check the size of the payload (Request body) and, if it is larger than 100 bytes, will reject the request, returning `HTTP 400 Request is too large`.
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure a request size limit for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to limit the size of requests. Select the **Request size limit** plugin.
+
+    <img src="/img/2.10/request_size_limit.png" alt="Select middleware" />
+
+2. **Configure the middleware**
+
+    Set the request size limit, in bytes.
+        
+    <img src="/img/2.10/request_size_settings.png" alt="Configure limit" />
+
+3. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+    
+
+    <Note>
+    The Tyk Classic API Designer does not provide an option to configure `global_size_limit`, but you can do this from the Raw Definition editor.
+    </Note>
+
+
+### Tyk Operator
+
+The process for configuring a request size limit is similar to that defined in section configuring the middleware in the Tyk Classic API Definition. Tyk Operator allows you to configure a request size limit for [all endpoints of an API](#tyk-operator-api) or for a [specific API endpoint](#tyk-operator-endpoint).
+
+#### Applying a size limit for a specific API
+<a id="tyk-operator-api"></a>
+
+{/* Need an example */}
+The process for configuring the request size_limits middleware for a specific API is similar to that explained in [applying a size limit for a specific API](#tyk-classic-api).
+
+You can configure a request size limit (in bytes) for all endpoints within an API by configuring the `global_size_limit` within the `version` element of the API Definition, for example:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["19"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-global-limit
+spec:
+  name: httpbin-global-limit
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-global-limit
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        global_size_limit: 5
+        name: Default
+```
+
+The example API Definition above configures an API to listen on path `/httpbin-global-limit` and forwards requests upstream to http://httpbin.org.
+
+In this example the request size limit is set to 5 bytes. If the limit is exceeded then the Tyk Gateway will report `HTTP 400 Request is too large`.
+
+#### Applying a size limit for a specific endpoint
+<a id="tyk-operator-endpoint"></a>
+
+The process for configuring the request size_limits middleware for a specific endpoint is similar to that explained in [applying a size limit for a specific endpoint](#tyk-classic-endpoint).
+
+To configure the request size_limits middleware you must add a new `size_limits` object to the `extended_paths` section of your API definition, for example:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["22-25"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-limit
+spec:
+  name: httpbin-limit
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-limit
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        extended_paths:
+          size_limits:
+            - method: POST
+              path: /post
+              size_limit: 5
+```
+
+The example API Definition above configures an API to listen on path `/httpbin-limit` and forwards requests upstream to http://httpbin.org.
+
+In this example the endpoint-level Request Size Limit middleware has been configured for `HTTP POST` requests to the `/post` endpoint. For any call made to this endpoint, Tyk will check the size of the payload (Request body) and, if it is larger than 5 bytes, will reject the request, returning `HTTP 400 Request is too large`.
\ No newline at end of file
diff --git a/api-management/traffic-transformation/request-validation.mdx b/api-management/traffic-transformation/request-validation.mdx
new file mode 100644
index 0000000000..2d2e1df732
--- /dev/null
+++ b/api-management/traffic-transformation/request-validation.mdx
@@ -0,0 +1,399 @@
+---
+title: "Request Validation"
+description: "Learn how to validate that requests meet the expected contract"
+keywords: "Traffic Transformation, Request Validation"
+sidebarTitle: "Request Validation"
+---
+
+## Overview
+<a id="request-validation-overview"></a>
+
+Requests to your upstream services should meet the contract that you have defined for those APIs. Checking the content and format of incoming requests before they are passed to the upstream APIs can avoid unexpected errors and provide additional security to those services. Tyk's request validation middleware provides a way to validate the presence, correctness and conformity of HTTP requests to make sure they meet the expected format required by the upstream API endpoints.
+
+Request validation enables cleaner backend APIs, better standardization across consumers, easier API evolution and reduced failure risk leading to higher end-to-end reliability.
+
+### Use Cases
+
+#### Improving security of upstream services
+
+Validating incoming requests against a defined schema protects services from unintended consequences arising from bad input, such as SQL injection or buffer overflow errors, or other unintended failures caused by missing parameters or invalid data types. Offloading this security check to the API Gateway provides an early line of defense as potentially bad requests are not proxied to your upstream services.
+
+#### Offloading contract enforcement
+
+You can ensure that client requests adhere to a defined contract specifying mandatory headers or parameters before sending requests upstream. Performing these validation checks in the API Gateway allows API developers to focus on core domain logic.
+
+#### Supporting data transformation
+
+Validation goes hand-in-hand with request [header](/api-management/traffic-transformation/request-headers) and [body](/api-management/traffic-transformation/request-body) transformation by ensuring that a request complies with the expected schema prior to transformation. For example, you could validate that a date parameter is present, then transform it into a different date format as required by your upstream API dynamically on each request.
+
+### Working
+
+The incoming request is compared with a defined schema, which is a structured description of the expected format for requests to the endpoint. This request schema defines the required and optional elements such as headers, path/query parameters, payloads and their data types. It acts as a contract for clients.
+
+If the incoming request does not match the schema, it will be rejected with an `HTTP 422 Unprocessable Entity` error. This error code can be customized if required.
+
+When using [Tyk OAS APIs](/api-management/traffic-transformation/request-validation#request-validation-using-tyk-oas), request validation is performed by the `Validate Request` middleware which can be enabled per-endpoint. The schema against which requests are compared is defined in the OpenAPI description of the endpoint. All elements of the request can have a `schema` defined in the OpenAPI description so requests to Tyk OAS APIs can be validated for headers, path/query parameters and body (payload).
+
+When using the legacy [Tyk Classic APIs](/api-management/traffic-transformation/request-validation#request-validation-using-classic), request validation is performed by the `Validate JSON` middleware which can be enabled per-endpoint. The schema against which requests are compared is defined in the middleware configuration and is limited to the request body (payload). Request headers and path/query parameters cannot be validated when using Tyk Classic APIs.
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Validate Request middleware summary
+  - The Validate Request middleware is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Validate Request middleware can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+ 
+
+## Using Tyk OAS
+<a id="request-validation-using-tyk-oas"></a>
+
+The [request validation](#request-validation-overview) middleware provides a way to validate the presence, correctness and conformity of HTTP requests to make sure they meet the expected format required by the upstream API endpoints. If the incoming request fails validation, the Tyk Gateway will reject the request with an `HTTP 422 Unprocessable Entity` response. Tyk can be [configured](#configuring-the-request-validation-middleware) to return a different HTTP status code if required. 
+
+The middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](/api-management/traffic-transformation/request-validation#request-validation-using-classic) page.
+
+### Request schema in OpenAPI Specification
+
+The OpenAPI Specification supports the definition of a [schema](https://learn.openapis.org/specification/content.html#the-schema-object) to describe and limit the content of any field in an API request or response.
+
+Tyk's request validation middleware automatically parses the schema for the request in the OpenAPI description part of the Tyk OAS API Definition and uses this to compare against the incoming request.
+
+An OpenAPI schema can reference other schemas defined elsewhere, letting you write complex validations very efficiently since you don’t need to re-define the validation for a particular object every time you wish to refer to it. Tyk only supports local references to schemas (within the same OpenAPI document).
+
+As explained in the OpenAPI [documentation](https://learn.openapis.org/specification/parameters.html), the structure of an API request is described by two components:
+- parameters (headers, query parameters, path parameters)
+- request body (payload)
+
+#### Request parameters
+
+The `parameters` field in the OpenAPI description is an array of [parameter objects](https://swagger.io/docs/specification/describing-parameters/) that each describe one variable element in the request. Each `parameter` has two mandatory fields:
+- `in`: the location of the parameter (`path`, `query`, `header`)
+- `name`: a unique identifier within that location (i.e. no duplicate header names for a given operation/endpoint)
+
+There are also optional `description` and `required` fields.
+
+For each parameter, a schema can be declared that defines the `type` of data that can be stored (e.g. `boolean`, `string`) and any `example` or `default` values. 
+
+##### Operation (endpoint-level) parameters
+
+An operation is a combination of HTTP method and path or, as Tyk calls it, an endpoint - for example `GET /users`. Operation, or endpoint-level parameters can be defined in the OpenAPI description and will apply only to that operation within the API. These can be added or modified within Tyk Dashboard's [API designer](#api-designer).
+
+##### Common (path-level) parameters
+
+[Common parameters](https://swagger.io/docs/specification/v3_0/describing-parameters/#common-parameters), that apply to all operations within a path, can be defined at the path level within the OpenAPI description. Tyk refers to these as path-level parameters and displays them as read-only fields in the Dashboard's API designer. If you need to add or modify common parameters you must use the *Raw Definition* editor, or edit your OpenAPI document outside Tyk and [update](/api-management/gateway-config-managing-oas#updating-an-api) the API.
+
+#### Request body
+
+The `requestBody` field in the OpenAPI description is a [Request Body Object](https://swagger.io/docs/specification/describing-request-body/). This has two optional fields (`description` and `required`) plus the `content` section which allows you to define a schema for the expected payload. Different schemas can be declared for different media types that are identified by content-type (e.g. `application/json`, `application/xml` and `text/plain`).
+
+### Configuring the request validation middleware
+
+When working with Tyk OAS APIs, the request validation middleware automatically determines the validation rules based on the API schema. The only configurable option for the middleware is to set the desired HTTP status code that will be returned if a request fails validation. The default response will be `HTTP 422 Unprocessable Entity` unless otherwise configured.
+
+### Enabling the request validation middleware
+
+If the middleware is enabled for an endpoint, then Tyk will automatically validate requests made to that endpoint against the schema defined in the API definition.
+
+When you create a Tyk OAS API by importing your OpenAPI description, you can instruct Tyk to enable request validation [automatically](#automatically-enabling-the-request-validation-middleware) for all endpoints with defined schemas.
+
+If you are creating your API without import, or if you only want to enable request validation for some endpoints, you can [manually enable](#manually-enabling-the-request-validation-middleware) the middleware in the Tyk OAS API definition.
+
+#### Automatically enabling the request validation middleware
+
+The request validation middleware can be enabled for all endpoints that have defined schemas when [importing](/api-management/gateway-config-managing-oas#importing-an-openapi-description-to-create-an-api) an OpenAPI Document to create a Tyk OAS API.
+- if you are using the `POST /apis/oas/import` endpoint in the [Tyk Dashboard API](/tyk-dashboard-api) or [Tyk Gateway API](/tyk-gateway-api) then you can do this by setting the `validateRequest=true` query parameter
+- if you are using the API Designer, select the **Auto-generate middleware to validate requests** option on the **Import API** screen
+
+<img src="/img/dashboard/api-designer/tyk-oas-validate-request-import.png" alt="Select the option during OpenAPI import to validate requests" />
+
+As noted, the automatic application of request validation during import will apply the middleware to all endpoints declared in your OpenAPI description. If you want to adjust this configuration, for example to remove validation from specific endpoints or to change the HTTP status code returned on error, you can update the Tyk OAS API definition as described [here](#manually-enabling-the-request-validation-middleware).
+
+#### Manually enabling the request validation middleware
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The request validation middleware (`validateRequest`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId`. The `operationId` for an endpoint can be found within the `paths` section of your [OpenAPI specification](https://swagger.io/docs/specification/paths-and-operations/?sbsearch=operationIds).
+
+The `validateRequest` object has the following configuration:
+- `enabled`: enable the middleware for the endpoint
+- `errorResponseCode`: [optional] the HTTP status code to be returned if validation fails (this defaults to `HTTP 422 Unprocessable Entity` if not set)
+
+For example:
+```json {hl_lines=["69-72"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-validate-request",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "parameters": [
+                    {
+                        "in": "header",
+                        "name": "X-Security",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean"
+                        }
+                    }
+                ],                
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "properties": {
+                                    "firstname": {
+                                        "description": "The person's first name",
+                                        "type": "string"
+                                    },
+                                    "lastname": {
+                                        "description": "The person's last name",
+                                        "type": "string"
+                                    }
+                                },
+                            "type": "object"
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-validate-request",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-validate-request/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "anythingget": {
+                    "validateRequest": {
+                        "enabled": true,
+                        "errorResponseCode": 400
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the request validation middleware has been configured for requests to the `GET /anything` endpoint. The middleware will check for the existence of a header named `X-Security` and the request body will be validated against the declared schema. If there is no match, the request will be rejected and Tyk will return `HTTP 400` (as configured in `errorResponseCode`).
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the request validation middleware.
+
+### API Designer
+
+Adding and configuring Request Validation for your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Validate Request middleware**
+
+    Select **ADD MIDDLEWARE** and choose **Validate Request** from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-validate-request.png" alt="Adding the Validate Request middleware" />
+
+    The API Designer will show you the request body and request parameters schema detected in the OpenAPI description of the endpoint.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-validate-request-added.png" alt="Validate Request middleware schema is automatically populated" />
+
+3. **Configure the middleware**
+
+    If required, you can select an alternative HTTP status code that will be returned if request validation fails.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-validate-request-config.png" alt="Configuring the Request Validation error response" />
+
+4. **Save the API**
+
+    Select **ADD MIDDLEWARE** to save the middleware configuration. Remember to select **SAVE API** to apply the changes.
+
+
+## Using Classic
+<a id="request-validation-using-classic"></a>
+
+The [request validation](#request-validation-overview) middleware provides a way to validate the presence, correctness and conformity of HTTP requests to make sure they meet the expected format required by the upstream API endpoints.
+
+When working with legacy Tyk Classic APIs, request validation is performed by the `Validate JSON` middleware which can be enabled per-endpoint. The schema against which requests are compared is defined in the middleware configuration and is limited to the request body (payload). Request headers and path/query parameters cannot be validated when using Tyk Classic APIs.
+
+This middleware is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](/api-management/traffic-transformation/request-validation#request-validation-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring the middleware in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+To enable the middleware you must add a new `validate_json` object to the `extended_paths` section of your API definition.
+
+The `validate_json` object has the following configuration:
+
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+- `schema`: the [JSON schema](https://json-schema.org/understanding-json-schema/basics) against which the request body will be compared
+- `error_response_code`: the HTTP status code that will be returned if validation fails (defaults to `422 Unprocessable Entity`)
+
+For example:
+
+```json  {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "validate_json": [
+            {
+                "disabled": false,
+                "path": "/register",
+                "method": "POST",
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "firstname": {
+                            "type": "string",
+                            "description": "The person's first name"
+                        },
+                        "lastname": {
+                            "type": "string",
+                            "description": "The person's last name"
+                        }
+                    }
+                },
+                "error_response_code": 422
+            }
+        ]
+    }
+}
+```
+
+In this example the Validate JSON middleware has been configured for requests to the `POST /register` endpoint. For any call made to this endpoint, Tyk will compare the request body with the schema and, if it does not match, the request will be rejected with the error code `HTTP 422 Unprocessable Entity`.
+
+#### Understanding JSON Schema Version Handling
+
+The Gateway automatically detects the version of the JSON schema from the `$schema` field in your schema definition. This field specifies the version of the [JSON schema standard](https://json-schema.org/specification-links) to be followed.
+
+From Tyk 5.8 onwards, supported versions are [draft-04](https://json-schema.org/draft-04/schema), [draft-06](https://json-schema.org/draft-06/schema) and [draft-07](https://json-schema.org/draft-07/schema).
+
+In previous versions of Tyk, only [draft-04](https://json-schema.org/draft-04/schema) is supported. Please be careful if downgrading from Tyk 5.8 to an earlier version that your JSON is valid as you might experience unexpected behaviour if using features from newer drafts of the JSON schema.
+
+- If the `$schema` field is present, the Gateway strictly follows the rules of the specified version.  
+- If the `$schema` field is missing or the version is not specified, the Gateway uses a hybrid mode that combines features from multiple schema versions. This mode ensures that the validation will still work, but may not enforce the exact rules of a specific version. 
+
+To ensure consistent and predictable validation, it is recommended to always include the `$schema` field in your schema definition. For example:  
+
+```json
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "firstname": {
+      "type": "string"
+    },
+    "lastname": {
+      "type": "string"
+    }
+  }
+}
+```
+
+By including `$schema`, the validator can operate in strict mode, ensuring that the rules for your chosen schema version are followed exactly.
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the request validation middleware for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to validate the request payload. Select the **Validate JSON** plugin.
+
+    <img src="/img/2.10/validate_json.png" alt="validate json plugin" />
+
+2. **Configure the middleware**
+
+    Once you have selected the request validation middleware for the endpoint, you can select an error code from the drop-down list (if you don't want to use the default `422 Unprocessable Entity`) and enter your JSON schema in the editor.
+
+    <img src="/img/dashboard/endpoint-designer/validate-json-schema.png" alt="Adding schema to the Validate JSON middleware" />
+
+3. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+### Tyk Operator
+
+The process for configuring the middleware in Tyk Operator is similar to that explained in configuring the middleware in the Tyk Classic API Definition. To configure the request validation middleware you must add a new `validate_json` object to the `extended_paths` section of your API definition, for example:
+
+The example API Definition below configures an API to listen on path `/httpbin` and forwards requests upstream to http://httpbin.org.
+
+In this example, the Validate JSON middleware has been configured for requests to the `GET /get` endpoint. For any call made to this endpoint, Tyk will compare the request body with the schema and, if it does not match, the request will be rejected with the error code `HTTP 422 Unprocessable Entity`.
+
+```yaml  {linenos=true, linenostart=1, hl_lines=["26-41"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-json-schema-validation
+spec:
+  name: httpbin-json-schema-validation
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          validate_json:
+            - error_response_code: 422
+              disabled: false
+              path: /get
+              method: GET
+              schema:
+                properties:
+                  userName:
+                    type: string
+                    minLength: 2
+                  age:
+                    type: integer
+                    minimum: 1
+                required:
+                  - userName
+                type: object
+```
+
diff --git a/api-management/traffic-transformation/response-body.mdx b/api-management/traffic-transformation/response-body.mdx
new file mode 100644
index 0000000000..363a80ad83
--- /dev/null
+++ b/api-management/traffic-transformation/response-body.mdx
@@ -0,0 +1,482 @@
+---
+title: "Response Body"
+description: "Learn how to transform the body of API responses"
+keywords: "Traffic Transformation, Response Body"
+sidebarTitle: "Response Body"
+---
+
+## Overview
+
+Tyk enables you to modify the payload of API responses received from your upstream services before they are passed on to the client that originated the request. This makes it easy to transform between payload data formats or to expose legacy APIs using newer schema models without having to change any client implementations. This middleware is only applicable to endpoints that return a body with the response.
+
+With the body transform middleware you can modify XML or JSON formatted payloads to ensure that the response contains the information required by your upstream service. You can enrich the response by adding contextual data that is held by Tyk but not included in the original response from the upstream.
+
+This middleware changes only the payload and not the headers. You can, however, combine this with the [Response Header Transform](/api-management/traffic-transformation/response-headers) to apply more complex transformation to responses.
+
+There is a closely related [Request Body Transform](/api-management/traffic-transformation/request-body) middleware that provides the same functionality on the request sent by the client prior to it being proxied to the upstream.
+
+### Use Cases
+
+#### Maintaining compatibility with legacy clients
+
+Sometimes you might have a legacy API and need to migrate the transactions to a new upstream service but do not want to upgrade all the existing clients to the newer upstream API. Using response body transformation, you can convert the new format that your upstream services provide into legacy XML or JSON expected by the clients.
+
+#### Shaping responses for different devices
+
+You can detect the client device types via headers or context variables and transform the response payload to optimize it for that particular device. For example, you might optimize the response content for mobile apps.
+
+#### SOAP to REST translation
+
+A common use of the response body transform middleware is when surfacing a legacy SOAP service with a REST API. Full details of how to perform this conversion using Tyk are provided [here](/advanced-configuration/transform-traffic/soap-rest).
+
+### Working
+
+Tyk's body transform middleware uses the [Go template language](https://golang.org/pkg/text/template/) to parse and modify the provided input. We have bundled the [Sprig Library (v3)](http://masterminds.github.io/sprig/) which provides over 70 pre-written functions for transformations to assist the creation of powerful Go templates to transform your API responses. 
+
+The Go template can be defined within the API Definition or can be read from a file that is accessible to Tyk.
+
+We have provided more detail, links to reference material and some examples of the use of Go templating [here](/api-management/traffic-transformation/go-templates).
+
+
+<Note>
+Tyk evaluates templates stored in files on startup, so if you make changes to a template you must remember to restart the gateway.
+</Note>
+
+
+#### Supported response body formats
+
+The body transformation middleware can modify response payloads in the following formats:
+- JSON
+- XML
+
+When working with JSON format data, the middleware will unmarshal the data into a data structure, and then make that data available to the template in dot-notation.
+
+#### Data accessible to the middleware
+
+The middleware has direct access to the response body and also to dynamic data as follows:
+- [Context variables](/api-management/traffic-transformation/request-context-variables), extracted from the request at the start of the middleware chain, can be injected into the template using the `._tyk_context.KEYNAME` namespace
+- [Session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context), from the Tyk Session Object linked to the request, can be injected into the template using the `._tyk_meta.KEYNAME` namespace 
+- Inbound form or query data can be accessed through the `._tyk_context.request_data` namespace where it will be available in as a `key:[]value` map
+- values from [key-value (KV) storage](/tyk-configuration-reference/kv-store#transformation-middleware) can be injected into the template using the notation appropriate to the location of the KV store
+ 
+The response body transform middleware can iterate through list indices in dynamic data so, for example, calling `{{ index ._tyk_context.request_data.variablename 0 }}` in a template will expose the first entry in the `request_data.variablename` key/value array.
+
+
+<Note>
+As explained in the [documentation](https://pkg.go.dev/text/template), templates are executed by applying them to a data structure. The template receives the decoded JSON or XML of the response body. If session variables or meta data are enabled, additional fields will be provided: `_tyk_context` and `_tyk_meta` respectively.
+</Note>
+
+
+#### Automatic XML &lt;-&gt; JSON Transformation
+
+A very common transformation that is applied in the API Gateway is to convert between XML and JSON formatted body content.
+
+The Response Body Transform supports two helper functions that you can use in your Go templates to facilitate this:
+- `jsonMarshal` performs JSON style character escaping on an XML field and, for complex objects, serialises them to a JSON string ([example](/api-management/traffic-transformation/go-templates#xml-to-json-conversion-using-jsonmarshal))
+- `xmlMarshal` performs the equivalent conversion from JSON to XML ([example](/api-management/traffic-transformation/go-templates#json-to-xml-conversion-using-xmlmarshal))
+
+<hr />
+
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Response Body Transform middleware summary
+  - The Response Body Transform middleware is an optional stage in Tyk's API Response processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Response Body Transform middleware can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. 
+  - Response Body Transform can access both [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context) and [request context variables](/api-management/traffic-transformation/request-context-variables). */}
+
+
+## Using Tyk OAS
+<a id="response-body-using-tyk-oas"></a>
+
+The [response body transform](/api-management/traffic-transformation/response-body) middleware provides a way to modify the payload of API responses before they are returned to the client.
+
+The middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#response-body-using-classic) page.
+
+### API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The response body transformation middleware (`transformResponseBody`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `transformResponseBody` object has the following configuration:
+- `enabled`: enable the middleware for the endpoint
+- `format`: the format of input data the parser should expect (either `xml` or `json`)
+- `body`: [see note] this is a `base64` encoded representation of your template
+- `path`: [see note] this is the path to the text file containing the template
+
+
+
+    <Note>
+    You should configure only one of `body` or `path` to indicate whether you are embedding the template within the middleware or storing it in a text file. The middleware will automatically select the correct source based on which of these fields you complete. If both are provided, then `body` will take precedence and `path` will be ignored.
+    </Note>
+
+
+For example:
+```json {hl_lines=["39-43"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-response-body-transform",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "put": {
+                "operationId": "anythingput",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-response-body-transform",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-response-body-transform/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "anythingput": {
+                    "transformResponseBody": {
+                        "enabled": true,
+                        "format": "json",
+                        "body": "ewogICJ2YWx1ZTEiOiAie3sudmFsdWUyfX0iLAogICJ2YWx1ZTIiOiAie3sudmFsdWUxfX0iLAogICJyZXEtaGVhZGVyIjogInt7Ll90eWtfY29udGV4dC5oZWFkZXJzX1hfSGVhZGVyfX0iLAogICJyZXEtcGFyYW0iOiAie3suX3R5a19jb250ZXh0LnJlcXVlc3RfZGF0YS5wYXJhbX19Igp9"
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the response body transform middleware has been configured for requests to the `PUT /anything` endpoint. The `body` contains a base64 encoded Go template (which you can check by pasting the value into a service such as [base64decode.org](https://www.base64decode.org)).
+
+Decoded, this template is:
+```go
+{
+    "value1": "{{.value2}}",
+    "value2": "{{.value1}}",
+    "req-header": "{{._tyk_context.headers_X_Header}}",
+    "req-param": "{{._tyk_context.request_data.param}}"
+}
+```
+
+So if you make a request to `PUT /anything?param=foo`, configuring a header `X-Header`:`bar` and providing this payload:
+```json
+{
+    "value1": "world",
+    "value2": "hello"
+}
+```
+
+httpbin.org will respond with the original payload in the response and, if you do not have the response body transform middleware enabled, the response from Tyk will include:
+```json
+{
+    "value1": "world",
+    "value2": "hello"
+}
+```
+
+If, however, you enable the response body transform middleware, Tyk will modify the response to include this content:
+```json
+{
+    "req-header": "bar",
+    "req-param": "[foo]",
+    "value1": "hello",
+    "value2": "world"
+}
+```
+
+You can see that Tyk has swapped `value1` and `value2` and embedded the `X-Header` header and `param` query values from the request into the body of the response.
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the mock response middleware.
+
+
+<Note>
+If using a template in a file (i.e. you configure `path` in the `transformResponseBody` object), remember that Tyk will load and evaluate the template when the Gateway starts up. If you modify the template, you will need to restart Tyk in order for the changes to take effect.
+</Note>
+
+
+### API Designer
+
+Adding Response Body Transformation to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow the following steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Response Body Transform middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Response Body Transform** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-response-body.png" alt="Adding the Response Body Transform middleware" />
+
+3. **Configure the middleware**
+
+    Now you can select the response body format (JSON or XML) and add either a path to the file containing the template, or directly enter the transformation template in the text box.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-response-body-config.png" alt="Configuring the Response Body Transform middleware" />
+
+    The **Test with data** control will allow you to test your body transformation function by providing an example response body and generating the output from the transform. It is not possible to configure headers, other request parameters, context or session metadata to this template test so if you are using these data sources in your transform it will not provide a complete output, for example:
+
+    <img src="/img/dashboard/api-designer/tyk-oas-body-transform-test.png" alt="Testing the Response Body Transform" />
+
+4. **Save the API**
+
+    Select **SAVE API** to apply the changes to your API.
+
+## Using Classic
+<a id="response-body-using-classic"></a>
+
+The [response body transform](/api-management/traffic-transformation/response-body) middleware provides a way to modify the payload of API responses before they are returned to the client.
+
+This middleware is configured in the Tyk Classic API Definition at the endpoint level. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#response-body-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring the middleware in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+To enable the middleware you must add a new `transform_response` object to the `extended_paths` section of your API definition.
+
+The `transform_response` object has the following configuration:
+- `path`: the path to match on
+- `method`: this method to match on
+- `template_data`: details of the Go template to be applied for the transformation of the response body
+ 
+The Go template is described in the `template_data` object by the following fields:
+- `input_type`: the format of input data the parser should expect (either `xml` or `json`)
+- `enable_session`: set this to `true` to make session metadata available to the transform template
+- `template_mode`: instructs the middleware to look for the template either in a `file` or in a base64 encoded `blob`; the actual file location (or base64 encoded template) is provided in `template_source`
+- `template_source`: if `template_mode` is set to `file`, this will be the path to the text file containing the template; if `template_mode` is set to `blob`, this will be a `base64` encoded representation of your template
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "transform_response": [
+            {
+                "path": "/anything",
+                "method": "POST",
+                "template_data": {
+                    "template_mode": "file",
+                    "template_source": "./templates/transform_test.tmpl",
+                    "input_type": "json",
+                    "enable_session": true 
+                }
+            }
+        ]
+    }
+}
+```
+
+In this example, the Response Body Transform middleware is directed to use the template located in the `file` at location `./templates/transform_test.tmpl`. The input (pre-transformation) response payload will be `json` format and session metadata will be available for use in the transformation.
+
+
+<Note>
+Tyk will load and evaluate the template file when the Gateway starts up. If you modify the template, you will need to restart Tyk in order for the changes to take effect.
+</Note>
+
+
+
+<Note>
+Prior to Tyk 5.3, there was an additional step to enable response body transformation. You would need to add the following to the Tyk Classic API definition:
+
+```json
+{
+    "response_processors":[
+        {"name": "response_body_transform"}
+    ]
+}
+```
+
+If using the Endpoint Designer in the Tyk Dashboard, this would be added automatically.
+
+We removed the need to configure the `response_processors` element in Tyk 5.3.0.
+</Note>
+
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the response body transform middleware for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to perform the transformation. Select the **Body Transforms** plugin.
+
+    <img src="/img/2.10/body_transforms.png" alt="Endpoint designer" />
+
+2. **Configure the middleware**
+
+    Ensure that you have selected the `RESPONSE` tab, then select your input type, and then add the template you would like to use to the **Template** input box.
+
+    <img src="/img/dashboard/endpoint-designer/body-transform-response.png" alt="Setting the body response transform" />
+
+3. **Test the Transform**
+
+    If you have sample input data, you can use the Input box to add it, and then test it using the **Test** button. You will see the effect of the template on the sample input in the Output box.
+
+    <img src="/img/dashboard/endpoint-designer/body-transform-test.png" alt="Testing the body transform function" />
+
+4. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the Response Body Transform middleware.
+
+### Tyk Operator
+
+The process of configuring a transformation of a response body for a specific endpoint is similar to that defined in section configuring the middleware in the Tyk Classic API Definition for the Tyk Classic API definition. To enable the middleware you must add a new `transform_response` object to the `extended_paths` section of your API definition.
+
+In the examples below, the Response Body Transform middleware (`transform_response`) is directed to use the template located in the `template_source`, decoding the xml in the base64 encoded string. The input (pre-transformation) response payload will be `xml` format and there is no session metadata provided for use in the transformation.
+
+#### Example
+
+```yaml {linenos=true, linenostart=1, hl_lines=["45-53"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-transform
+spec:
+  name: httpbin-transform
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-transform
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          transform:
+            - method: POST
+              path: /anything
+              template_data:
+                enable_session: false
+                input_type: json
+                template_mode: blob
+                # base64 encoded template
+                template_source: eyJiYXIiOiAie3suZm9vfX0ifQ==
+          transform_headers:
+            - delete_headers:
+                - "remove_this"
+              add_headers:
+                foo: bar
+              path: /anything
+              method: POST
+          transform_response:
+            - method: GET
+              path: /xml
+              template_data:
+                enable_session: false
+                input_type: xml
+                template_mode: blob
+                # base64 encoded template
+                template_source: e3sgLiB8IGpzb25NYXJzaGFsIH19
+          transform_response_headers:
+            - method: GET
+              path: /xml
+              add_headers:
+                Content-Type: "application/json"
+              act_on: false
+              delete_headers: []
+```
+
+#### Tyk Gateway < 5.3.0 Example
+
+If using Tyk Gateway < v5.3.0 then a `response_processor` object must be added to the API definition containing a `response_body_transform` item, as highlighted below:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["17-18", "48-56"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-transform
+spec:
+  name: httpbin-transform
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-transform
+    strip_listen_path: true
+  response_processors:
+    - name: response_body_transform
+    - name: header_injector
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          transform:
+            - method: POST
+              path: /anything
+              template_data:
+                enable_session: false
+                input_type: json
+                template_mode: blob
+                # base64 encoded template
+                template_source: eyJiYXIiOiAie3suZm9vfX0ifQ==
+          transform_headers:
+            - delete_headers:
+                - "remove_this"
+              add_headers:
+                foo: bar
+              path: /anything
+              method: POST
+          transform_response:
+            - method: GET
+              path: /xml
+              template_data:
+                enable_session: false
+                input_type: xml
+                template_mode: blob
+                # base64 encoded template
+                template_source: e3sgLiB8IGpzb25NYXJzaGFsIH19
+          transform_response_headers:
+            - method: GET
+              path: /xml
+              add_headers:
+                Content-Type: "application/json"
+              act_on: false
+              delete_headers: []
+```
+
diff --git a/api-management/traffic-transformation/response-headers.mdx b/api-management/traffic-transformation/response-headers.mdx
new file mode 100644
index 0000000000..3c99502099
--- /dev/null
+++ b/api-management/traffic-transformation/response-headers.mdx
@@ -0,0 +1,670 @@
+---
+title: "Response Headers"
+description: "Learn how to modify API response headers"
+keywords: "Traffic Transformation, Response Headers"
+sidebarTitle: "Response Headers"
+---
+
+## Overview
+
+Tyk enables you to modify header information when a response is proxied back to the client. This can be very useful in cases where you have an upstream API that potentially exposes sensitive headers that you need to remove.
+
+There are two options for this:
+- API-level modification that is applied to responses for all requests to the API
+- endpoint-level modification that is applied only to responses for requests to a specific endpoint
+
+With the header transform middleware you can append or delete any number of headers to ensure that the response contains the information required by your client. You can enrich the response by adding contextual data that is held by Tyk but not included in the original response from the upstream.
+
+This middleware changes only the headers and not the payload. You can, however, combine this with the [Response Body Transform](/api-management/traffic-transformation/response-body) to apply more complex transformation to responses.
+
+There are related [Request Header Transform](/api-management/traffic-transformation/request-headers) middleware (at API-level and endpoint-level) that provide the same functionality on the request from a client, prior to it being proxied to the upstream.
+
+### Use Cases
+
+#### Customizing responses for specific clients
+
+A frequent use case for response header transformation is when a client requires specific headers for their application to function correctly. For example, a client may require a specific header to indicate the status of a request or to provide additional information about the response.
+
+#### Adding security headers
+
+The response header transform allows you to add security headers to the response to protect against common attacks such as cross-site scripting (XSS) and cross-site request forgery (CSRF). Some security headers may be required for compliance with industry standards and, if not provided by the upstream, can be added by Tyk before forwarding the response to the client.
+
+#### Adding metadata to response headers
+
+Adding metadata to response headers can be useful for tracking and analyzing API usage, as well as for providing additional information to clients. For example, you may want to add a header that indicates the version of the API being used or the time taken to process the request.
+
+#### Modifying response headers for dynamic performance optimization
+
+You can use response header transformation to dynamically optimize the performance of the API. For example, you may want to indicate to the client the maximum number of requests that they can make in a given time period. By doing so through the response headers, you can perform dynamic optimization of the load on the upstream service without triggering the rate limiter and so avoiding errors being sent to the client.
+
+### Working
+
+The response header transform can be applied per-API or per-endpoint; each has a separate entry in the API definition so that you can configure both API-level and endpoint-level transforms for a single API.
+
+The middleware is configured with a list of headers to delete from the response and a list of headers to add to the response. Each header to be added to the response is configured as a key:value pair.
+- the "delete header" functionality is intended to ensure that any header in the delete list is not present once the middleware completes. If a header in the delete list is not present in the upstream response, the middleware will ignore the omission
+- the "add header" functionality will capitalize any header name provided. For example, if you configure the middleware to append `x-request-id` it will be added to the response as `X-Request-Id`
+
+In the response middleware chain, the endpoint-level transform is applied before the API-level transform. Subsequently, if both middleware are enabled, the API-level transform will operate on the headers that have been added by the endpoint-level transform (and will not have access to those that have been deleted by it).
+
+#### Injecting dynamic data into headers
+
+You can enrich the response headers by injecting data from context variables or session objects into the headers.
+- [context variables](/api-management/traffic-transformation/request-context-variables), extracted from the request at the start of the middleware chain, can be injected into added headers using the `$tyk_context.` namespace
+- [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context), from the Tyk Session Object linked to the request, can be injected into added headers using the `$tyk_meta.` namespace
+- values from [key-value (KV) storage](/tyk-configuration-reference/kv-store#transformation-middleware) can be injected into added headers using the notation appropriate to the location of the KV store
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Response Header Transform middleware summary
+  - The Response Header Transform is an optional stage in Tyk's API Response processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Response Header Transform can be configured at the per-endpoint or per-API level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+## Using Tyk OAS
+<a id="response-headers-using-tyk-oas"></a>
+
+Tyk's [response header transform](/api-management/traffic-transformation/response-headers) middleware enables you to append or delete headers on responses received from the upstream service before sending them to the client.
+
+There are two options for this:
+- API-level modification that is applied to all responses for the API
+- endpoint-level modification that is applied only to responses from a specific endpoint
+
+
+
+    <Note>
+    If both API-level and endpoint-level middleware are configured, the endpoint-level transformation will be applied first.
+    </Note>
+
+
+When working with Tyk OAS APIs the transformation is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#response-headers-using-classic) page.
+
+### API Definition
+
+The API-level and endpoint-level response header transforms have a common configuration but are configured in different sections of the API definition.
+
+#### API-level transform
+
+To append headers to, or delete headers from, responses from all endpoints defined for your API you must add a new `transformResponseHeaders` object to the `middleware.global` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition.
+
+You only need to enable the middleware (set `enabled:true`) and then configure the details of headers to `add` and those to `remove`.
+
+For example:
+```json {hl_lines=["38-57"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-response-header",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/status/200": {
+            "get": {
+                "operationId": "status/200get",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-response-header",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-response-header/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "global": {
+                "transformResponseHeaders": {
+                    "enabled": true,
+                    "remove": [
+                        "X-Secret"
+                    ],
+                    "add": [
+                        {
+                            "name": "X-Static",
+                            "value": "foobar"
+                        },
+                        {
+                            "name": "X-Request-ID",
+                            "value": "$tyk_context.request_id"
+                        },
+                        {
+                            "name": "X-User-ID",
+                            "value": "$tyk_meta.uid"
+                        }
+                    ]
+                }
+            }
+        }
+    }
+}
+```
+
+This configuration will add three new headers to each response:
+- `X-Static` with the value `foobar`
+- `X-Request-ID` with a dynamic value taken from the `request_id` [context variable](/api-management/traffic-transformation/request-context-variables)
+- `X-User-ID` with a dynamic value taken from the `uid` field in the [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context)
+
+It will also delete one header (if present) from each response:
+- `X-Secret`
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the API-level response header transform.
+
+#### Endpoint-level transform
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The response header transform middleware (`transformResponseMethod`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+You only need to enable the middleware (set `enabled:true`) and then configure the details of headers to `add` and those to `remove`.
+
+For example:
+```json {hl_lines=["39-50"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-response-method",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/status/200": {
+            "get": {
+                "operationId": "status/200get",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-response-method",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-response-method/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "status/200get": {
+                    "transformResponseHeaders": {
+                        "enabled": true,
+                        "remove": [
+                            "X-Static"
+                        ],
+                        "add": [
+                            {
+                                "name": "X-Secret",
+                                "value": "the-secret-key-is-secret"
+                            }
+                        ]
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the Response Header Transform middleware has been configured for HTTP `GET` requests to the `/status/200` endpoint. Any response received from the upstream service following a request to that endpoint will have the `X-Static` header removed and the `X-Secret` and `X-New` headers added (with values set to `the-secret-key-is-secret` and `another-header`).
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the endpoint-level response header transform.
+
+#### Combining API-level and Endpoint-level transforms
+
+If the example [API-level](#api-level-transform) and [endpoint-level](#endpoint-level-transform) transforms are applied to the same API, then the `X-Secret` header will be added (by the endpoint-level transform first) and then removed (by the API-level transform). Subsequently, the result of the two transforms for a call to `GET /status/200` would be to add four headers:
+- `X-Request-ID`
+- `X-User-ID`
+- `X-Static`
+- `X-New`
+
+### API Designer
+
+Adding and configuring the transforms to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+#### Adding an API-level transform
+
+From the **API Designer** on the **Settings** tab, after ensuring that you are in *edit* mode, toggle the switch to **Enable Transform response headers** in the **Middleware** section:
+<img src="/img/dashboard/api-designer/tyk-oas-response-header-api-level.png" alt="Tyk OAS API Designer showing API-level Response Header Transform" />
+
+Then select **NEW HEADER** as appropriate to add or remove a header from API responses. You can add or remove multiple headers by selecting **ADD HEADER** to add another to the list:
+<img src="/img/dashboard/api-designer/tyk-oas-response-header-api-new-header.png" alt="Configuring the API-level Response Header Transform in Tyk OAS API Designer" />
+
+#### Adding an endpoint level transform
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Response Header Transform middleware**
+
+    Select **ADD MIDDLEWARE** and choose the **Response Header Transform** middleware from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-response-header.png" alt="Adding the URL Rewrite middleware" />
+
+3. **Configure header transformation**
+
+    Select **NEW HEADER** to configure a header to be added to or removed from the response, you can add multiple headers to either list by selecting **NEW HEADER** again.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-response-header.png" alt="Configuring the rewrite rules for Advanced Triggers" />
+    <img src="/img/dashboard/api-designer/tyk-oas-response-header-new.png" alt="Configuring the Response Header Transform" />
+
+4. **Save the API**
+
+    Select **ADD MIDDLEWARE** to save the middleware configuration. Remember to select **SAVE API** to apply the changes.
+
+## Using Classic
+<a id="response-headers-using-classic"></a>
+
+Tyk's [response header transform](/api-management/traffic-transformation/response-headers) middleware enables you to append or delete headers on responses received from the upstream service before sending them to the client.
+
+There are two options for this:
+- API-level modification that is applied to all responses for the API
+- endpoint-level modification that is applied only to responses from a specific endpoint
+
+
+
+    <Note>
+    If both API-level and endpoint-level middleware are configured, the endpoint-level transformation will be applied first.
+    </Note>
+
+
+When working with Tyk Classic APIs the transformation is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you want to use dynamic data from context variables, you must [enable](/api-management/traffic-transformation/request-context-variables#enabling-context-variables-for-use-with-tyk-classic-apis) context variables for the API to be able to access them from the response header transform middleware.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#response-headers-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring the Response Header Transform in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+The API-level and endpoint-level response header transforms have a common configuration but are configured in different sections of the API definition.
+
+<Note>
+Prior to Tyk 5.3.0, there was an additional step to enable response header transforms (both API-level and endpoint-level). You would need to add the following to the Tyk Classic API definition:
+
+```json
+{
+    "response_processors":[
+        {"name": "header_injector"}
+    ]
+}
+```
+
+If using the Endpoint Designer in the Tyk Dashboard, this would be added automatically.
+
+We removed the need to configure the `response_processors` element in Tyk 5.3.0.
+</Note>
+
+
+#### API-level transform
+<a id="tyk-classic-api"></a>
+
+To **append** headers to all responses from your API (i.e. for all endpoints) you must add a new `global_response_headers` object to the `versions` section of your API definition. This contains a list of key:value pairs, being the names and values of the headers to be added to responses.
+
+To **delete** headers from all responses from your API (i.e. for all endpoints), you must add a new `global_response_headers_remove` object to the `versions` section of the API definition. This contains a list of the names of existing headers to be removed from responses.
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "version_data": {
+        "versions": {
+            "Default": {
+                "global_response_headers": {
+                    "X-Static": "foobar",
+                    "X-Request-ID":"$tyk_context.request_id",
+                    "X-User-ID": "$tyk_meta.uid"
+                },
+                "global_response_headers_remove": [
+                    "X-Secret"
+                ]
+            }
+        }
+    },
+}
+```
+
+This configuration will add three new headers to each response:
+- `X-Static` with the value `foobar`
+- `X-Request-ID` with a dynamic value taken from the `request_id` [context variable](/api-management/traffic-transformation/request-context-variables)
+- `X-User-ID` with a dynamic value taken from the `uid` field in the [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context)
+
+It will also delete one header (if present) from each response:
+ - `X-Secret`
+
+#### Endpoint-level transform
+<a id="tyk-classic-endpoint"></a>
+
+To configure response header transformation for a specific endpoint you must add a new `transform_response_headers` object to the `extended_paths` section of your API definition.
+
+It has the following configuration:
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+- `delete_headers`: a list of the headers that should be deleted from the response
+- `add_headers`: a list of headers, in key:value pairs, that should be added to the response
+
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "transform_response_headers": [
+        {
+            "path": "status/200",
+            "method": "GET",
+            "delete_headers": ["X-Static"],
+            "add_headers": [
+                {"X-Secret": "the-secret-key-is-secret"},
+                {"X-New": "another-header"}
+            ],
+        }
+    ]
+}
+```
+
+In this example the Response Header Transform middleware has been configured for HTTP `GET` requests to the `/status/200` endpoint. Any response received from the upstream service following a request to that endpoint will have the `X-Static` header removed and the `X-Secret` and `X-New` headers added (with values set to `the-secret-key-is-secret` and `another-header`).
+
+#### Combining API-level and Endpoint-level transforms
+
+If the example [API-level](#api-level-transform) and [endpoint-level](#endpoint-level-transform) transforms are applied to the same API, then the `X-Secret` header will be added (by the endpoint-level transform first) and then removed (by the API-level transform). Subsequently, the result of the two transforms for a call to `GET /status/200` would be to add four headers:
+- `X-Request-ID`
+- `X-User-ID`
+- `X-Static`
+- `X-New`
+
+#### Fixing response headers that leak upstream server data
+
+A middleware called `header_transform` was added in Tyk 2.1 specfically to allow you to ensure that headers such as `Location` and `Link` reflect the outward facade of your API Gateway and also align with the expected response location to be terminated at the gateway, not the hidden upstream proxy.
+
+This is configured by adding a new `rev_proxy_header_cleanup` object to the `response_processors` section of your API definition.
+
+It has the following configuration:
+- `headers`: a list of headers in the response that should be modified
+- `target_host`: the value to which the listed headers should be updated
+ 
+For example:
+```json
+{
+    "response_processors": [
+        {
+            "name": "header_transform",
+            "options": {
+                "rev_proxy_header_cleanup": {
+                    "headers": ["Link", "Location"],
+                    "target_host": "http://TykHost:TykPort"
+                }
+            }
+        }
+    ]
+}
+```
+
+In this example, the `Link` and `Location` headers will be modified from the server-generated response, with the protocol, domain and port of the value set in `target_host`.
+
+This feature is rarely used and has not been implemented in the Tyk Dashboard UI, nor in the [Tyk OAS API](#response-headers-using-tyk-oas).
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the response header transform middleware for your Tyk Classic API by following these steps.
+
+#### API-level transform
+
+Configuring the API-level response header transform middleware is very simple when using the Tyk Dashboard.
+
+In the Endpoint Designer you should select the **Global Version Settings** and ensure that you have selected the **Response Headers** tab:
+
+<img src="/img/dashboard/endpoint-designer/response-header-global.png" alt="Configuring the API-level response header transform" />
+
+Note that you must click **ADD** to add a header to the list (for appending or deletion).
+
+#### Endpoint-level transform
+
+1. **Add an endpoint for the path and select the Header Transform plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to perform the transformation. Select the **Modify Headers** plugin.
+
+    <img src="/img/dashboard/endpoint-designer/modify-headers-plugin.png" alt="Adding the Modify Headers plugin to an endpoint" />
+
+2. **Select the "Response" tab**
+
+    This ensures that the transform will be applied to responses prior to them being sent to the client.
+
+    <img src="/img/dashboard/endpoint-designer/response-header-added.png" alt="Selecting the response header transform" />
+
+3. **Declare the headers to be modified**
+
+    Select the headers to delete and insert using the provided fields. You need to click **ADD** to ensure they are added to the list.
+
+    <img src="/img/dashboard/endpoint-designer/response-header-details.png" alt="Configuring the response header transform" />
+
+4. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+### Tyk Operator
+
+The process for configuring a response header transform in Tyk Operator is similar to that defined in section configuring the Response Header Transform in the Tyk Classic API Definition. Tyk Operator allows you to configure a response header transformation for [all endpoints of an API](#tyk-operator-endpoint) or for a [specific API endpoint](#tyk-operator-api).
+
+#### API-level transform
+<a id="tyk-operator-api"></a>
+
+The process of configuring transformation of response headers for a specific API in Tyk Operator is similar to that defined in section [API-level transform](#tyk-classic-api) for the Tyk Classic API definition. 
+
+To **append** headers to all responses from your API (i.e. for all endpoints) you must add a new `global_response_headers` object to the `versions` section of your API definition. This contains a list of key:value pairs, being the names and values of the headers to be added to responses.
+
+To **delete** headers from all responses from your API (i.e. for all endpoints), you must add a new `global_response_headers_remove` object to the `versions` section of the API definition. This contains a list of the names of existing headers to be removed from responses.
+
+An example is listed below:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["25-30"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-global-header
+spec:
+  name: httpbin-global-header
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-global-header
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        global_response_headers:
+          X-Static: foobar
+          X-Request-ID: "$tyk_context.request_id"
+          X-User-ID: "$tyk_meta.uid"
+        global_response_headers_remove:
+          - X-Secret
+```
+
+The example API Definition above configures an API to listen on path `/httpbin-global-header` and forwards requests upstream to http://httpbin.org.
+
+This configuration will add three new headers to each response:
+
+- `X-Static` with the value `foobar`
+- `X-Request-ID` with a dynamic value taken from the `request_id` [context variable](/api-management/traffic-transformation/request-context-variables)
+- `X-User-ID` with a dynamic value taken from the `uid` field in the [session metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context)
+
+It will also delete one header (if present) from each response:
+
+- `X-Secret`
+
+
+#### Endpoint-level transform
+<a id="tyk-operator-endpoint"></a>
+
+The process of configuring a transformation of a response header for a specific endpoint in Tyk Operator is similar to that defined in section [endpoint-level transform](#tyk-classic-endpoint) for the Tyk Classic API definition. To configure a transformation of the response headers for a specific endpoint you must add a new `transform_response_headers` object to the `extended_paths` section of your API definition.
+
+In this example the Response Header Transform middleware (`transform_response_headers`) has been configured for HTTP `GET` requests to the `/xml` endpoint. Any response received from the upstream service following a request to that endpoint will have the `Content-Type` header added with a value set to `application/json`.
+
+#### Example
+
+```yaml {linenos=true, linenostart=1, hl_lines=["54-60"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-transform
+spec:
+  name: httpbin-transform
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-transform
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          transform:
+            - method: POST
+              path: /anything
+              template_data:
+                enable_session: false
+                input_type: json
+                template_mode: blob
+                # base64 encoded template
+                template_source: eyJiYXIiOiAie3suZm9vfX0ifQ==
+          transform_headers:
+            - delete_headers:
+                - "remove_this"
+              add_headers:
+                foo: bar
+              path: /anything
+              method: POST
+          transform_response:
+            - method: GET
+              path: /xml
+              template_data:
+                enable_session: false
+                input_type: xml
+                template_mode: blob
+                # base64 encoded template
+                template_source: e3sgLiB8IGpzb25NYXJzaGFsIH19
+          transform_response_headers:
+            - method: GET
+              path: /xml
+              add_headers:
+                Content-Type: "application/json"
+              act_on: false
+              delete_headers: []
+```
+
+#### Tyk Gateway < 5.3.0 Example
+
+If using Tyk Gateway < v5.3.0 then a `response_processor` object must be added to the API definition containing a `header_injector` item, as highlighted below:
+
+```yaml  {linenos=true, linenostart=1, hl_lines=["17", "19", "57-63"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-transform
+spec:
+  name: httpbin-transform
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-transform
+    strip_listen_path: true
+  response_processors:
+    - name: response_body_transform
+    - name: header_injector
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          transform:
+            - method: POST
+              path: /anything
+              template_data:
+                enable_session: false
+                input_type: json
+                template_mode: blob
+                # base64 encoded template
+                template_source: eyJiYXIiOiAie3suZm9vfX0ifQ==
+          transform_headers:
+            - delete_headers:
+                - "remove_this"
+              add_headers:
+                foo: bar
+              path: /anything
+              method: POST
+          transform_response:
+            - method: GET
+              path: /xml
+              template_data:
+                enable_session: false
+                input_type: xml
+                template_mode: blob
+                # base64 encoded template
+                template_source: e3sgLiB8IGpzb25NYXJzaGFsIH19
+          transform_response_headers:
+            - method: GET
+              path: /xml
+              add_headers:
+                Content-Type: "application/json"
+              act_on: false
+              delete_headers: []
+```
\ No newline at end of file
diff --git a/api-management/traffic-transformation/virtual-endpoints.mdx b/api-management/traffic-transformation/virtual-endpoints.mdx
new file mode 100644
index 0000000000..dd645e1adc
--- /dev/null
+++ b/api-management/traffic-transformation/virtual-endpoints.mdx
@@ -0,0 +1,753 @@
+---
+title: "Virtual Endpoints"
+description: "Learn how to terminate requests with a Virtual Endpoint"
+keywords: "Traffic Transformation, Virtual Endpoints"
+sidebarTitle: "Virtual Endpoints"
+---
+
+## Overview
+
+Tyk's Virtual Endpoint is a programmable middleware component that is invoked towards the end of the request processing chain. It can be enabled at the per-endpoint level and can perform complex interactions with your upstream service(s) that cannot be handled by one of the other middleware components.
+
+Virtual endpoint middleware provides a serverless compute function that allows for the execution of custom logic directly within the gateway itself, without the need to proxy the request to an upstream service. This functionality is particularly useful for a variety of use cases, including request transformation, aggregation of responses from multiple services, implementing custom authentication mechanisms, or [terminating requests](/api-management/traffic-transformation/mock-response#virtual-endpoint).
+
+The Virtual Endpoint is an extremely powerful feature that is unique to Tyk and provides exceptional flexibility to your APIs.
+
+### Use Cases
+
+#### Aggregating data from multiple services
+
+From a virtual endpoint, you can make calls out to other internal and upstream APIs. You can then aggregate and process the responses, returning a single response object to the originating client. This allows you to configure a single externally facing API to simplify interaction with multiple internal services, leaving the heavy lifting to Tyk rather than starting up an aggregation service within your stack.
+
+#### Enforcing custom policies
+
+Tyk provides a very flexible [middleware chain](/api-management/traffic-transformation#request-middleware-chain) where you can combine functions to implement the access controls you require to protect your upstream services. Of course, not all scenarios can be covered by Tyk's standard middleware functions, but you can use a virtual endpoint to apply whatever custom logic you require to optimize your API experience.
+
+#### Dynamic Routing
+
+With a virtual endpoint you can implement complex [dynamic routing](/transform-traffic/url-rewriting) of requests made to a single external endpoint on to different upstream services. The flexibility of the virtual endpoint gives access to data within the request (including the key session) and also the ability to make calls to other APIs to make decisions on the routing of the request.
+
+### Working
+
+The virtual endpoint middleware provides a JavaScript engine that runs the custom code that you provide either inline within the API definition or in a source code file accessible to the Gateway. The JavaScript Virtual Machine (JSVM) provided in the middleware is a traditional ECMAScript5 compatible environment which does not offer the more expressive power of something like Node.js.
+
+The virtual endpoint terminates the request, so the JavaScript function must provide the response to be passed to the client. When a request hits a virtual endpoint, the JSVM executes the JavaScript code which can modify the request, make calls to other APIs or upstream services, process data, and ultimately determines the response returned to the client.
+
+
+<Note>
+You will need to enable Tyk's JavaScript Virtual Machine by setting `enable_jsvm` to `true` in your `tyk.conf` [file](/tyk-oss-gateway/configuration#enable_jsvm) for your virtual endpoints to work.
+</Note>
+
+
+### Scripting virtual endpoint functions
+
+The [middleware scripting guide](/api-management/plugins/javascript#using-javascript-with-tyk) provides guidance on writing JS functions for your virtual endpoints, including how to access key session data and custom attributes from the API definition.
+
+#### Function naming
+
+The virtual endpoint middleware will invoke a named function within the JS code that you provide (either inline or in a file). Both the filename and function name are configurable per endpoint, but note that function names must be unique across your API portfolio because all plugins run in the same virtual machine. This means that you can share a single function definition across multiple endpoints and APIs but you cannot have two different functions with the same name (this applies across all [JavaScript middleware components](/api-management/plugins/javascript#)).
+
+Inline mode is mainly used by the dashboard to make code injection easier on multiple node deployments.
+
+### Virtual endpoint library
+
+We have put together a [library](https://github.com/TykTechnologies/custom-plugins#virtual-endpoints) of JS functions that you could use in your virtual endpoints. We welcome submissions from the Tyk community so if you've created a function that you think would be useful to other users, please open an issue in the Github repository and we can discuss bringing it into the library.
+
+
+
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ # Virtual Endpoint middleware summary
+  - The Virtual Endpoint middleware is an optional stage in Tyk's API Request processing chain, sitting between the [TBC]() and [TBC]() middleware.
+  - The Virtual Endpoint middleware can be configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+
+## Using Tyk OAS
+<a id="virtual-endpoints-using-tyk-oas"></a>
+
+The [virtual endpoint](/api-management/traffic-transformation/virtual-endpoints) middleware provides a serverless compute function that allows for the execution of custom logic directly within the gateway itself, without the need to proxy the request to an upstream service. This functionality is particularly useful for a variety of use cases, including request transformation, aggregation of responses from multiple services, or implementing custom authentication mechanisms.
+
+The middleware is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#virtual-endpoints-using-classic) page.
+
+### API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The virtual endpoint middleware (`virtualEndpoint`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `virtualEndpoint` object has the following configuration:
+
+- `enabled`: enable the middleware for the endpoint
+- `functionName`: the name of the JavaScript function that will be executed when the virtual endpoint is triggered
+- `body`: [optional] a `base64` encoded string containing the JavaScript code
+- `path`: [optional] the relative path to the source file containing the JavaScript code
+- `proxyOnError`: [optional, defaults to `false`] a boolean that determines the behavior of the gateway if an error occurs during the execution of the virtual endpoint's function; if set to `true` the request will be proxied to upstream if the function errors, if set to `false` the request will not be proxied and Tyk will return an error response 
+- `requireSession`: [optional defaults to `false`] a boolean that indicates whether the virtual endpoint should have access to the session object; if `true` then the key session data will be provided to the function as the `session` variable
+
+
+
+    <Note>
+    One of either `path` or `body` must be provided, depending on whether you are providing the JavaScript code in a file or inline within the API definition. If both are provided then `body` will take precedence.
+    </Note>
+
+
+For example:
+
+```json {hl_lines=["39-50", "54-58"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-virtual-endpoint",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-virtual-endpoint",
+            "state": {
+                "active": true,
+                "internal": false
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },          
+        "server": {
+            "listenPath": {
+                "value": "/example-virtual-endpoint/",                
+                "strip": true
+            }
+        },      
+        "middleware": {
+            "global": {
+                "pluginConfig": {
+                    "data": {
+                        "enabled": true,
+                        "value": {
+                            "map": {
+                                "key": 3
+                            },
+                        "num": 4,
+                        "string": "example"
+                        }
+                    }
+                }
+            },
+            "operations": {
+                "anythingget": {
+                    "virtualEndpoint": {
+                        "enabled": true,
+                        "functionName": "myVirtualHandler",
+                        "body": "ZnVuY3Rpb24gbXlWaXJ0dWFsSGFuZGxlciAocmVxdWVzdCwgc2Vzc2lvbiwgY29uZmlnKSB7ICAgICAgCiAgdmFyIHJlc3BvbnNlT2JqZWN0ID0gewogICAgQm9keTogIlZpcnR1YWwgRW5kcG9pbnQgIitjb25maWcuY29uZmlnX2RhdGEuc3RyaW5nLAogICAgSGVhZGVyczogewogICAgICAiZm9vLWhlYWRlciI6ICJiYXIiLAogICAgICAibWFwLWhlYWRlciI6IEpTT04uc3RyaW5naWZ5KGNvbmZpZy5jb25maWdfZGF0YS5tYXApLAogICAgICAic3RyaW5nLWhlYWRlciI6IGNvbmZpZy5jb25maWdfZGF0YS5zdHJpbmcsCiAgICAgICJudW0taGVhZGVyIjogSlNPTi5zdHJpbmdpZnkoY29uZmlnLmNvbmZpZ19kYXRhLm51bSkKICAgIH0sCiAgICBDb2RlOiAyMDAKICB9CiAgcmV0dXJuIFR5a0pzUmVzcG9uc2UocmVzcG9uc2VPYmplY3QsIHNlc3Npb24ubWV0YV9kYXRhKQp9"
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example the virtual endpoint middleware has been configured for requests to the `GET /anything` endpoint. We have also configured the following custom attributes in the `pluginConfig` section of the API definition:
+
+```json
+{
+    "map": {
+        "key": 3
+    },
+    "num": 4,
+    "string": "example"
+}
+```
+
+The `body` field value is a `base64` encoded string containing this JavaScript code, which will be invoked by the virtual endpoint middleware:
+
+```js
+function myVirtualHandler (request, session, config) {      
+  var responseObject = {
+    Body: "Virtual Endpoint "+config.config_data.string,
+    Headers: {
+      "foo-header": "bar",
+      "map-header": JSON.stringify(config.config_data.map),
+      "string-header": config.config_data.string,
+      "num-header": JSON.stringify(config.config_data.num)
+    },
+    Code: 200
+  }
+  return TykJsResponse(responseObject, session.meta_data)
+}
+```
+
+A call to the `GET /anything` endpoint returns:
+
+```bash
+HTTP/1.1 200 OK
+Date: Fri, 01 Mar 2024 12:14:36 GMT
+Foo-Header: bar
+Map-Header: {"key":3}
+Num-Header: 4
+Server: tyk
+String-Header: example
+Content-Length: 24
+Content-Type: text/plain; charset=utf-8
+ 
+Virtual Endpoint example
+```
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the virtual endpoint middleware.
+
+### API Designer
+
+Adding a Virtual Endpoint to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+1. **Add an endpoint**
+
+    From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+    <img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+2. **Select the Virtual Endpoint middleware**
+
+    Select **ADD MIDDLEWARE** and choose **Virtual Endpoint** from the *Add Middleware* screen.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-virtual-endpoint.png" alt="Adding the Virtual Endpoint middleware" />
+
+3. **Configure the middleware**
+
+    Now you can provide either the path to a file containing the JavaScript function to be run by the middleare, or you can directly enter the JavaScript in the code editor.
+
+    For both sources, you must provide the **function name** that should be called when the middleware executes.
+
+    You can also optionally configure the behavior required if the function should return an error and also indicate to Tyk whether the virtual middleware requires access to the key session metadata.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-virtual-endpoint-config.png" alt="Configuring the Virtual Endpoint middleware" />
+
+4. **Save the API**
+
+    Select **ADD MIDDLEWARE** to save the middleware configuration. Remember to select **SAVE API** to apply the changes.
+
+## Using Classic
+<a id="virtual-endpoints-using-classic"></a>
+
+The [virtual endpoint](/api-management/traffic-transformation/virtual-endpoints) middleware provides a serverless compute function that allows for the execution of custom logic directly within the gateway itself, without the need to proxy the request to an upstream service. This functionality is particularly useful for a variety of use cases, including request transformation, aggregation of responses from multiple services, or implementing custom authentication mechanisms.
+
+This middleware is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#virtual-endpoints-using-tyk-oas) page.
+
+If you're using Tyk Operator then check out the [configuring the middleware in Tyk Operator](#tyk-operator) section below.
+
+### API Definition
+
+If you want to use Virtual Endpoints, you must [enable Tyk's JavaScript Virtual Machine](/tyk-oss-gateway/configuration#enable_jsvm) by setting `enable_jsvm` to `true` in your `tyk.conf` file.
+
+To enable the middleware you must add a new `virtual` object to the `extended_paths` section of your API definition.
+
+The `virtual` object has the following configuration:
+
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+- `response_function_name`: this is the name of the JavaScript function that will be executed when the virtual endpoint is triggered
+- `function_source_type`: instructs the middleware to look for the JavaScript code either in a `file` or in a base64 encoded `blob`; the actual file location (or base64 encoded code) is provided in `function_source_uri`
+- `function_source_uri`: if `function_source_type` is set to `file`, this will be the relative path to the source file containing the JavaScript code; if `function_source_type` if set to `blob`, this will be a `base64` encoded string containing the JavaScript code
+- `use_session`: a boolean that indicates whether the virtual endpoint should have access to the session object; if `true` then the key session data will be provided to the function as the `session` variable
+- `proxy_on_error`: a boolean that determines the behavior of the gateway if an error occurs during the execution of the virtual endpoint's function; if set to `true` the request will be proxied to upstream if the function errors, if set to `false` the request will not be proxied and Tyk will return an error response
+
+For example:
+
+```json {linenos=true, linenostart=1}
+{
+    "extended_paths": {
+        "virtual": [
+            {
+                "response_function_name": "myUniqueFunctionName",
+                "function_source_type": "blob",
+                "function_source_uri": "ZnVuY3Rpb24gbXlVbmlxdWVGdW5jdGlvbk5hbWUocmVxdWVzdCwgc2Vzc2lvbiwgY29uZmlnKSB7CiB2YXIgcmVzcG9uc2VPYmplY3QgPSB7IAogIEJvZHk6ICJUSElTIElTIEEgVklSVFVBTCBSRVNQT05TRSIsIAogIENvZGU6IDIwMCAKIH0KIHJldHVybiBUeWtKc1Jlc3BvbnNlKHJlc3BvbnNlT2JqZWN0LCBzZXNzaW9uLm1ldGFfZGF0YSkKfQ==",
+                "path": "/anything",
+                "method": "GET",
+                "use_session": false,
+                "proxy_on_error": false
+            }
+        ]
+    }
+}
+```
+
+In this example the Virtual Endpoint middleware has been configured for requests to the `GET /anything` endpoint. For any call made to this endpoint, Tyk will invoke the function `myUniqueFunctionName` that is `base64` encoded in the `function_source_uri` field. This virtual endpoint does not require access to the session data and will not proxy the request on to the upstream if there is an error when processing the `myUniqueFunctionName` function.
+
+Decoding the value in `function_source_uri` we can see that the JavaScript code is:
+
+```js {linenos=true, linenostart=1}
+function myUniqueFunctionName(request, session, config) {
+ var responseObject = { 
+  Body: "THIS IS A VIRTUAL RESPONSE", 
+  Code: 200 
+ }
+ return TykJsResponse(responseObject, session.meta_data)
+}
+```
+
+This function will terminate the request without proxying it to the upstream returning `HTTP 200` as follows:
+
+```bash
+HTTP/1.1 200 OK
+Date: Wed, 28 Feb 2024 20:52:30 GMT
+Server: tyk
+Content-Type: text/plain; charset=utf-8
+Content-Length: 26
+ 
+THIS IS A VIRTUAL RESPONSE
+```
+
+If, however, we introduce an error to the JavaScript, such that Tyk fails to process the function, we will receive an `HTTP 500 Internal Server Error` as follows:
+
+```bash
+HTTP/1.1 500 Internal Server Error
+Date: Wed, 28 Feb 2024 20:55:27 GMT
+Server: tyk
+Content-Type: application/json
+Content-Length: 99
+ 
+{
+"error": "Error during virtual endpoint execution. Contact Administrator for more details."
+}
+```
+
+If we set `proxy_on_error` to `true` and keep the error in the Javascript, the request will be forwarded to the upstream and Tyk will return the response received from that service.
+
+### API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure a virtual endpoint for your Tyk Classic API by following these steps.
+
+1. **Add an endpoint for the path and select the plugin**
+
+    From the **Endpoint Designer** add an endpoint that matches the path for which you want to trigger the virtual endpoint. Select the **Virtual Endpoint** plugin.
+
+    <img src="/img/dashboard/endpoint-designer/virtual-endpoint-middleware.png" alt="Selecting the middleware" />
+
+2. **Configure the middleware**
+
+    Once you have selected the virtual endpoint middleware for the endpoint, you need to supply:
+
+    - JS function to call
+    - Source type (`file` or `inline`)
+
+    If you select source type `file` you must provide the path to the file:
+    <img src="/img/dashboard/endpoint-designer/virtual-endpoint-file.png" alt="Configuring file based JS code" />
+
+    If you select `inline` you can enter the JavaScript code in the Code Editor window.
+    <img src="/img/dashboard/endpoint-designer/virtual-endpoint-inline.png" alt="Configuring inline JS code" />
+
+3. **Save the API**
+
+    Use the *save* or *create* buttons to save the changes and activate the Virtual Endpoint middleware.
+
+
+
+    <Note>
+    The Tyk Classic API Designer does not provide options to configure `use_session` or `proxy_on_error`, but you can do this from the Raw Definition editor.
+    </Note>
+
+
+### Tyk Operator
+
+The process for configuring a virtual endpoint using Tyk Operator is similar to that explained in configuring the middleware in the Tyk Classic API Definition
+
+The example API Definition below configures an API to listen on path `/httpbin` and forwards requests upstream to `http://httpbin.org`. The Virtual Endpoint middleware has been configured for requests to the `GET /virtual` endpoint. For any call made to this endpoint, Tyk will invoke the function `myVirtualHandler` that is base64 encoded in the `function_source_uri` field. This virtual endpoint does not require access to the session data and will not proxy the request on to the upstream if there is an error when processing the `myVirtualHandler` function.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["23-35"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: test-config-data-test
+spec:
+  name: test-config-data-test
+  protocol: http
+  proxy:
+    listen_path: /httpbin/
+    target_url: http://httpbin.org
+    strip_listen_path: true
+  active: true
+  use_keyless: true
+  enable_context_vars: true
+  version_data:
+    default_version: Default
+    not_versioned: false
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        extended_paths:
+          virtual:
+            - function_source_type: blob
+              response_function_name: myVirtualHandler
+              function_source_uri: "ZnVuY3Rpb24gbXlWaXJ0dWFsSGFuZGxlciAocmVxdWVzdCwgc2Vzc2lvbiwgY29uZmlnKSB7ICAgICAgCiAgdmFyIHJlc3BvbnNlT2JqZWN0ID0gewogICAgQm9keTogIlRISVMgSVMgQSAgVklSVFVBTCBSRVNQT05TRSIsCiAgICBIZWFkZXJzOiB7CiAgICAgICJmb28taGVhZGVyIjogImJhciIsCiAgICAgICJtYXAtaGVhZGVyIjogSlNPTi5zdHJpbmdpZnkoY29uZmlnLmNvbmZpZ19kYXRhLm1hcCksCiAgICAgICJzdHJpbmctaGVhZGVyIjogY29uZmlnLmNvbmZpZ19kYXRhLnN0cmluZywKICAgICAgIm51bS1oZWFkZXIiOiBKU09OLnN0cmluZ2lmeShjb25maWcuY29uZmlnX2RhdGEubnVtKQogICAgfSwKICAgICAgQ29kZTogMjAwCiAgfQogIHJldHVybiBUeWtKc1Jlc3BvbnNlKHJlc3BvbnNlT2JqZWN0LCBzZXNzaW9uLm1ldGFfZGF0YSkKfQ=="
+              path: /virtual
+              method: GET
+              use_session: false
+              proxy_on_error: false
+  config_data:
+    string: "string"
+    map:
+      key: 3
+    num: 4
+```
+
+Decoding the value in `function_source_uri` we can see that the JavaScript code is:
+
+```javascript
+function myVirtualHandler (request, session, config) {      
+  var responseObject = {
+    Body: "THIS IS A  VIRTUAL RESPONSE",
+    Headers: {
+      "foo-header": "bar",
+      "map-header": JSON.stringify(config.config_data.map),
+      "string-header": config.config_data.string,
+      "num-header": JSON.stringify(config.config_data.num)
+    },
+    Code: 200
+  }
+  return TykJsResponse(responseObject, session.meta_data)
+}
+```
+
+This function will terminate the request without proxying it to the upstream, returning HTTP 200 as follows:
+
+```bash
+HTTP/1.1 200 OK
+Date: Wed, 14 Aug 2024 15:37:46 GMT
+Foo-Header: bar
+Map-Header: {"key":3}
+Num-Header: 4
+Server: tyk
+String-Header: string
+Content-Length: 27
+Content-Type: text/plain; charset=utf-8
+ 
+THIS IS A VIRTUAL RESPONSE
+```
+
+If, however, we introduce an error to the JavaScript, such that Tyk fails to process the function, we will receive an HTTP 500 Internal Server Error as follows:
+
+```bash
+HTTP/1.1 500 Internal Server Error
+Date: Wed, 14 Aug 2024 15:37:46 GMT
+Server: tyk
+Content-Type: application/json
+Content-Length: 99
+ 
+{
+"error": "Error during virtual endpoint execution. Contact Administrator for more details."
+}
+```
+
+If we set `proxy_on_error` to `true` and keep the error in the Javascript, the request will be forwarded to the upstream and Tyk will return the response received from that service.
+
+## Examples
+
+### Accessing Tyk data objects
+
+In this example, we demonstrate how you can access different [external Tyk objects](/api-management/plugins/javascript#accessing-external-and-dynamic-data) (API request, session key, API definition).
+
+1. Enable the Virtual Endpoint middleware on an endpoint of your API and paste this JavaScript into the API Designer (or save in a file and reference it from the middleware config):
+
+```javascript
+function myFirstVirtualHandler (request, session, config) {
+  log("Virtual Test running")
+  
+  log("Request Body: " + request.Body)
+  log("Session: " + JSON.stringify(session.allowance))
+  log("Config: " + JSON.stringify(config.APIID))
+  log("param-1: " + request.Params["param1"]) // case sensitive
+  log("auth Header: " + request.Headers["Authorization"]) // case sensitive
+  
+  var responseObject = {
+    Body: "VIRTUAL ENDPOINT EXAMPLE #1",
+    Headers: {
+      "x-test": "virtual-header",
+      "x-test-2": "virtual-header-2"
+    },
+    Code: 200
+  }
+  
+  return TykJsResponse(responseObject, session.meta_data)   
+}
+log("Virtual Test initialised")
+```
+
+2. Make a call to your API endpoint passing a request body, a value in the `Authorization` header and a query parameter `param1`.
+
+3. The virtual endpoint will terminate the request and return this response:
+
+```bash
+HTTP/1.1 200 OK
+Date: Thu, 29 Feb 2024 17:39:00 GMT
+Server: tyk
+X-Test: virtual-header
+X-Test-2: virtual-header-2
+Content-Length: 27
+Content-Type: text/plain; charset=utf-8
+ 
+VIRTUAL ENDPOINT EXAMPLE #1
+```
+
+4. The gateway logs will include:
+
+```text
+time="" level=info msg="Virtual Test running" prefix=jsvm type=log-msg
+time="" level=info msg="Request Body: <your-request-body>" prefix=jsvm type=log-msg
+time="" level=info msg="Session: <allowance-from-your-session-key>" prefix=jsvm type=log-msg
+time="" level=info msg="Config: <your-APIID>" prefix=jsvm type=log-msg
+time="" level=info msg="param-1: <your_query_parameter>" prefix=jsvm type=log-msg
+time="" level=info msg="auth Header: <your-auth-header>" prefix=jsvm type=log-msg
+```
+
+### Accessing custom attributes in the API Definition
+
+You can add [custom attributes](/api-management/plugins/javascript#adding-custom-attributes-to-the-api-definition) to the API definition and access these from within your Virtual Endpoint.
+
+1. Add the following custom attributes to your API definition:
+
+```json
+{
+  "string": "string",
+  "map": {
+    " key": 3
+  },
+  "num": 4
+}
+```
+
+2. Enable the Virtual Endpoint middleware on an endpoint of your API and paste this JavaScript into the API Designer (or save in a file and reference it from the middleware config):
+
+```js
+function mySecondVirtualHandler (request, session, config) {      
+  var responseObject = {
+    Body: "VIRTUAL ENDPOINT EXAMPLE #2",
+    Headers: {
+      "foo-header": "bar",
+      "map-header": JSON.stringify(config.config_data.map),
+      "string-header": config.config_data.string,
+      "num-header": JSON.stringify(config.config_data.num)
+    },
+      Code: 200
+  }
+  return TykJsResponse(responseObject, session.meta_data)
+}
+```
+
+3. Make a call to your API endpoint.
+
+4. The virtual endpoint will terminate the request and return this response:
+
+```bash
+HTTP/1.1 200 OK
+Date: Thu, 29 Feb 2024 17:29:12 GMT
+Foo-Header: bar
+Map-Header: {" key":3}
+Num-Header: 4
+Server: tyk
+String-Header: string
+Content-Length: 26
+Content-Type: text/plain; charset=utf-8
+ 
+VIRTUAL ENDPOINT EXAMPLE #2
+```
+
+### Advanced example
+
+In this example, every line in the script gives an example of a functionality usage, including:
+
+- how to get form param
+- how to get to a specific key inside a JSON variable
+- the structure of the request object
+- using `TykMakeHttpRequest` to make an HTTP request from within the virtual endpoint, and the json it returns - `.Code` and `.Body`.
+
+```js
+function myVirtualHandlerGetHeaders (request, session, config) {
+  rawlog("Virtual Test running")
+    
+  //Usage examples:
+  log("Request Session: " + JSON.stringify(session))
+  log("API Config:" + JSON.stringify(config))
+ 
+  log("Request object: " + JSON.stringify(request))   
+  log("Request Body: " + JSON.stringify(request.Body))
+  log("Request Headers:" + JSON.stringify(request.Headers))
+  log("param-1:" + request.Params["param1"])
+    
+  log("Request header type:" + typeof JSON.stringify(request.Headers))
+  log("Request header:" + JSON.stringify(request.Headers.Location))
+    
+
+  //Make api call to upstream target
+  newRequest = {
+    "Method": "GET",
+    "Body": "",
+    "Headers": {"location":JSON.stringify(request.Headers.Location)},
+    "Domain": "http://httpbin.org",
+    "Resource": "/headers",
+    "FormData": {}
+  };
+  rawlog("--- before get to upstream ---")
+  response = TykMakeHttpRequest(JSON.stringify(newRequest));
+  rawlog("--- After get to upstream ---")
+  log("response type: " + typeof response);
+  log("response: " + response);
+  usableResponse = JSON.parse(response);
+  var bodyObject = JSON.parse(usableResponse.Body);
+    
+  var responseObject = {
+    //Body: "THIS IS A VIRTUAL RESPONSE",
+    Body: "yo yo",
+    Headers: {
+      "test": "virtual",
+      "test-2": "virtual",
+      "location" : bodyObject.headers.Location
+    },
+    Code: usableResponse.Code
+  }
+    
+  rawlog("Virtual Test ended")
+  return TykJsResponse(responseObject, session.meta_data)   
+}
+```
+
+### Running the Advanced example
+
+You can find a Tyk Classic API definition [here](https://gist.github.com/letzya/5b5edb3f9f59ab8e0c3c614219c40747) that includes the advanced example, with the JS encoded `inline` within the middleware config for the `GET /headers` endpoint.
+
+Create a new Tyk Classic API using that API definition and then run the following command to send a request to the API endpoint:
+
+```bash
+curl http://tyk-gateway:8080/testvirtualendpoint2/headers -H "location: /get" -v
+```
+
+This should return the following:
+
+```bash
+Trying 127.0.0.1...
+TCP_NODELAY set
+Connected to tyk-gateway (127.0.0.1) port 8080 (#0)
+GET /testvirtualendpoint2/headers HTTP/1.1
+Host: tyk-gateway:8080
+User-Agent: curl/7.54.0
+Accept: */*
+location: /get
+
+HTTP/1.1 200 OK
+Date: Fri, 08 Jun 2018 21:53:57 GMT
+**Location: /get**
+Server: tyk
+Test: virtual
+Test-2: virtual
+Content-Length: 5
+Content-Type: text/plain; charset=utf-8
+
+Connection #0 to host tyk-gateway left intact
+yo yo
+```
+
+### Checking the Tyk Gateway Logs
+
+The `log` and `rawlog` commands in the JS function write to the Tyk Gateway logs. If you check the logs you should see the following:
+
+```text
+[Jun 13 14:45:21] DEBUG jsvm: Running: myVirtualHandlerGetHeaders
+Virtual Test running
+[Jun 13 14:45:21]  INFO jsvm-logmsg: Request Session: {"access_rights":null,"alias":"","allowance":0,"apply_policies":null,"apply_policy_id":"","basic_auth_data":{"hash_type":"","password":""},"certificate":"","data_expires":0,"enable_detail_recording":false,"expires":0,"hmac_enabled":false,"hmac_string":"","id_extractor_deadline":0,"is_inactive":false,"jwt_data":{"secret":""},"last_check":0,"last_updated":"","meta_data":null,"monitor":{"trigger_limits":null},"oauth_client_id":"","oauth_keys":null,"org_id":"","per":0,"quota_max":0,"quota_remaining":0,"quota_renewal_rate":0,"quota_renews":0,"rate":0,"session_lifetime":0,"tags":null} type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: API Config:{"APIID":"57d72796c5de45e649f22da390d7df43","OrgID":"5afad3a0de0dc60001ffdd07","config_data":{"bar":{"y":3},"foo":4}} type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: Request object: {"Body":"","Headers":{"Accept":["*/*"],"Location":["/get"],"User-Agent":["curl/7.54.0"]},"Params":{"param1":["I-am-param-1"]},"URL":"/testvirtualendpoint2/headers"} type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: Request Body: "" type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: Request Headers:{"Accept":["*/*"],"Location":["/get"],"User-Agent":["curl/7.54.0"]} type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: param-1:I-am-param-1 type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: Request header type:[object Object] type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: Request header: ["/get"] type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: Request location type: object type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: Request location type: string type=log-msg
+[Jun 13 14:45:21]  INFO jsvm-logmsg: Request location: /get type=log-msg
+--- before get to upstream ---
+--- After get to upstream ---
+[Jun 13 14:45:22]  INFO jsvm-logmsg: response type: string type=log-msg
+[Jun 13 14:45:22]  INFO jsvm-logmsg: response: {"Code":200,"Body":"{\"headers\":{\"Accept-Encoding\":\"gzip\",\"Connection\":\"close\",\"Host\":\"httpbin.org\",\"Location\":\"/get\",\"User-Agent\":\"Go-http-client/1.1\"}}\n","Headers":{"Access-Control-Allow-Credentials":["true"],"Access-Control-Allow-Origin":["*"],"Content-Length":["133"],"Content-Type":["application/json"],"Date":["Wed, 13 Jun 2018 13:45:21 GMT"],"Server":["gunicorn/19.8.1"],"Via":["1.1 vegur"]},"code":200,"body":"{\"headers\":{\"Accept-Encoding\":\"gzip\",\"Connection\":\"close\",\"Host\":\"httpbin.org\",\"Location\":\"/get\",\"User-Agent\":\"Go-http-client/1.1\"}}\n","headers":{"Access-Control-Allow-Credentials":["true"],"Access-Control-Allow-Origin":["*"],"Content-Length":["133"],"Content-Type":["application/json"],"Date":["Wed, 13 Jun 2018 13:45:21 GMT"],"Server":["gunicorn/19.8.1"],"Via":["1.1 vegur"]}} type=log-msg
+Virtual Test ended
+[Jun 13 14:45:22] DEBUG JSVM Virtual Endpoint execution took: (ns) 191031553
+```
+
+### Aggregating upstream calls using batch processing
+
+One of the most common use cases for virtual endpoints is to provide some form of aggregate data to your users, combining the responses from multiple upstream service calls. This virtual endpoint function will do just that using the batch processing function from the [JavaScript API](/api-management/plugins/javascript#javascript-api)
+
+```js
+function batchTest(request, session, config) {
+  // Set up a response object
+  var response = {
+    Body: "",
+    Headers: {
+      "test": "virtual-header-1",
+      "test-2": "virtual-header-2",
+      "content-type": "application/json"
+    },
+    Code: 200
+  }
+    
+  // Batch request
+  var batch = {
+    "requests": [
+      {
+        "method": "GET",
+        "headers": {
+          "x-tyk-test": "1",
+          "x-tyk-version": "1.2",
+          "authorization": "1dbc83b9c431649d7698faa9797e2900f"
+        },
+        "body": "",
+        "relative_url": "http://httpbin.org/get"
+      },
+      {
+        "method": "GET",
+        "headers": {},
+        "body": "",
+        "relative_url": "http://httpbin.org/user-agent"
+      }
+    ],
+    "suppress_parallel_execution": false
+  }
+    
+  log("[Virtual Test] Making Upstream Batch Request")
+  var newBody = TykBatchRequest(JSON.stringify(batch))
+    
+  // We know that the requests return JSON in their body, lets flatten it
+  var asJS = JSON.parse(newBody)
+  for (var i in asJS) {
+    asJS[i].body = JSON.parse(asJS[i].body)
+  }
+    
+  // We need to send a string object back to Tyk to embed in the response
+  response.Body = JSON.stringify(asJS)
+    
+  return TykJsResponse(response, session.meta_data)
+    
+}
+log("Batch Test initialised")                
+```
+
diff --git a/api-management/troubleshooting-debugging.mdx b/api-management/troubleshooting-debugging.mdx
new file mode 100644
index 0000000000..6fb9c77919
--- /dev/null
+++ b/api-management/troubleshooting-debugging.mdx
@@ -0,0 +1,1636 @@
+---
+title: "Troubleshooting and Debugging"
+description: "Tyk troubleshooting and debugging gateway, streams, pump, dashboard"
+keywords: "troubleshooting, debugging, Open Source, Self-Managed, Tyk Cloud, API Gateway"
+sidebarTitle: "Troubleshooting"
+---
+
+## Gateway
+
+1. ##### Users receive 499 error in the Gateway
+
+    **Cause**
+
+    The Gateway receives closed client responses from the upstream client. There are number of different configuration settings that could bring about this issue.
+
+    **Solution**
+
+    For a standard web app, used by standard HTTP clients 499 errors are not a problem.
+    ​
+
+    However, in some specific cases, depending on the service you provide, your clients can have their own fixed constraints. 
+    For example, if you are building an API used by IoT devices, and those devices internally have a strict  2 second timeout for HTTP calls and your service responding with > 2 seconds. In this case a lot of 499 errors may mean that a lot of clients are malfunctioning, and you should investigate this behavior.
+
+    On the other hand, sometimes a client closing the connection before reading the server response is expected functionality. Taking the same example as above, you may have some IoT sensor, which just pushes data to your servers in "fire and forgot" mode, and does not care about the server response. In this case a 499 error is completely expected behavior.
+
+
+2. ##### Users receive 502 error in the Gateway
+
+    **Cause**
+
+    The Gateway received an invalid response from the upstream server. There are number of different configuration settings that could bring about this issue.
+
+    **Solution**
+
+    Try using the following settings in your tyk.conf file:
+
+    ```{.copyWrapper}
+    enable_detailed_recording: false, 
+    enable_jsvm: false,
+    ```
+
+
+    And the following key-value pairs should be set in the relevant API definition:
+
+    ```{.copyWrapper}
+    proxy.service_discovery.use_nested_query = false
+    proxy.service_discovery.use_target_list = true
+    proxy.service_discovery.endpoint_returns_list = true
+    proxy.service_discovery.data_path = ""Address”
+    proxy.service_discovery.port_data_path = “ServicePort""
+    ```
+        
+    See [Tyk Gateway configuration](/tyk-oss-gateway/configuration) and [Tyk Gateway API](/api-management/gateway-config-tyk-classic) for further information regarding API definition settings.
+
+3. ##### Gateway proxy error "context canceled"
+
+    In some cases you can see "proxy error: context canceled" error message in the Gateway logs.
+    The error itself means that the connection was closed unexpectedly. 
+    It can happen for various reasons, and in some cases it is totally fine: for example client can have unstable mobile internet.
+
+    When it happens on the high load, it can be a lot of different reasons.
+    For example your OS is running out of system limits, like number of opened sockets, and to validate it, you need to try your system limits.
+    See [this guide](/planning-for-production).
+
+    Additionally, it can be CPU bottleneck: you can't process more than your machine  can do.
+    And note that it is not only about the actual utilization %, it is also about context switches it has to do. 
+    E.g. having one job which consume 100% of your CPU/cores vs having a few thousands jobs, causing CPU constantly switch between them. 
+    Such problems cause internal request processing queues, which cause latency growth (highly recommend measure it). 
+    And in some cases latency can grow so big, that some clients can just disconnect/timeout because of it. 
+
+    Additionally, highly recommend read the following blog post https://tyk.io/blog/performance-tuning-your-tyk-api-gateway/.
+    For example, you can trade memory for performance, and context switch reduction by tuning garbage collector to run less frequently: see `Tuning Tyk’s Garbage Collector` section.
+
+
+    Also note that it is not Tyk or Golang specific.
+    The problem described above will happen with any webserver on high scale. 
+    So in general if you see a lot of "context" errors on high load, use it as a sign that the process is really struggling with the given load, and you need scale it up, either vertically or horizontally. 
+
+4. ##### Invalid memory address or nil pointer dereference error
+
+    **Cause**
+
+    There are a number of reasons, most commonly, an API may have been configured incorrectly in some way (for instance, it may have been set up without an organization). The error itself is a specific to Go language which Tyk was written in and could also suggest that alterations made to the code by the user could also be the culprit.
+
+    **Solution**
+
+    Make sure that API definitions are set up correctly. Information on how to do this with the Tyk Gateway API can be found in the following links:
+
+    *   [API Definition Object Details](/api-management/gateway-config-tyk-classic)
+    *   [API Management](/tyk-gateway-api)
+
+5. ##### Users receive this error message when attempting to make API calls to an existing key.
+
+    **Cause**
+    When the token was created, most probably it was configured without the `meta_data` key.
+
+    **Solution**
+    The user will need to add the key-value pair `meta_data: {}` to their key as per the [Tyk Gateway REST API Documentation](/tyk-gateway-api).
+
+6. ##### There was a problem proxying the request
+
+    **Cause**
+
+    The upstream server may have returned an empty response or cut the response off early so it was unable to complete the proxying process. A proxy error means actual connectivity issues between Tyk and the target host (i.e., a connection-level issue with the downstream server misbehaving for some reason).
+
+    Expired TLS certificates may also cause issues.
+
+    **Solution**
+
+    Users are advised to upgrade to the latest versions of any Tyk packages at their earliest convenience as a patch was released to resolve this issue. Packages are available to download from [Packagecloud.io][1]. See [Upgrading Tyk](/developer-support/upgrading) for details on upgrading to the latest version. It may also be worth checking if any TLS certificates associated with the domain have expired.
+
+    [1]: https://packagecloud.io/tyk
+
+6. ##### Tyk Gateway Profiling
+
+    In some cases, to identify tricky issues like concurrency or memory related issues, it may be required to get information about the Gateway process runtime. For example, memory or CPU usage details.
+    The Tyk Gateway is built using Go, and inherits its powerful profiling tools, specifically Google's [`pprof`](https://github.com/google/pprof/).
+
+    The Tyk Gateway can generate various profiles in the `pprof` supported format, which you can analyze by yourself, using the `go tool pprof` command, or you can send the profiles to our support team for analysis.
+
+    There are two way to get profiles:
+
+    1. Running the process with flags mentioned below which will gather information about the running process for the first 30 seconds, and will generate files containing profiling info:
+
+        * `--memprofile` - memory profile, generates `tyk.mprof` file
+        * `--cpuprofile` - CPU usage profile, generates `tyk.prof` file
+        * `--blockprofile` - Blocking profile, generates `tyk.blockprof` file
+        * `--mutexprofile` - Mutex profile, generates `tyk.mutexprof` file
+
+    2. Running with the `--httpprofile` flag, or set `enable_http_profiler` to `true` in tyk.conf, which will run a special `/debug/pprof/` public web page, containing dynamic information about the running process, and where you can download various profiles:
+
+        * goroutine    - stack traces of all current goroutines
+        * heap         - a sampling of all heap allocations
+        * threadcreate - stack traces that led to the creation of new OS threads
+        * block        - stack traces that led to blocking on synchronisation primitives
+        * mutex        - stack traces of holders of contended mutexes
+
+##### Support Information
+<a id="support-information"></a>
+
+    When contacting support, you may be asked to supply extra information and supply log files, etc, so we can quickly handle your request. Questions may include:
+
+    * "Can you send us your log files"
+    * "Can you change the logging detail level"
+    * "What version of Tyk are you on"
+    * "What profiling information can I get"
+
+
+    This page will let you know how to get the above info to us.
+
+    **Log Files**
+
+    **Where do I find my log files?**
+
+    The Gateway will log its output to `stderr` and `stdout`. In a typical installation, these will be handled or redirected by the service manager running the process, and depending on the Linux distribution, will either be output to `/var/log/` or `/var/log/upstart`.
+
+    Tyk will try to output structured logs, and so will include context data around request errors where possible.
+
+    **How do I increase Logging Verbosity?**
+
+    You can set the logging verbosity in two ways:
+
+    1. Via an Environment Variable to affect all Tyk components
+    2. Just for the Gateway via your `tyk.conf` config file  
+
+    **Setting via Environment Variable**
+    The environment variable is `TYK_LOGLEVEL`.
+
+
+    By default, the setting is `info`. You also have the following options:
+
+    * `debug`
+    * `warn`
+    * `error`
+
+    You will be advised by support which setting to change the logging level to.
+
+    **For the Gateway**
+
+    You can set the logging level in your `tyk.conf` by adding the following:
+
+    ```{.copyWrapper}
+    "log_level": "info",
+    ```
+
+    By default, the setting is `info`. You also have the following options:
+
+    * `debug`
+    * `warn`
+    * `error`
+
+    You will be advised by support which setting to change the logging level to.
+
+    **Tyk Version**
+
+    For support requests it is beneficial to provide more information about your Gateway build. These pinpoint the exact Gateway build that is in use.
+
+    - Since Gateway version `5.0.8` or `5.2.3` you can inspect detailed build information by running `tyk version`. The information also includes the Go version it was built with, the operating system and architecture.
+
+    - If you're running an an older version than the above, `tyk --version` prints out the release version for your Gateway binary.
+
+    The binary is installed in `/opt/tyk-gateway/tyk` by default. If your binary is not available in your `PATH` environment, invoke it from there.
+
+    **Profile Information**
+
+    You can provide various profile information for us in [pprof format](https://github.com/google/pprof/). See [Gateway Profiling](#tyk-gateway-profiling) for more details.
+
+8. ##### API definition URL case sensitive
+
+    For security reasons Tyk lowercases the URL before performing any pattern matching.
+
+9. ##### Gateway detected 0 APIs
+
+    Tyk Gateway is not able to get API configs from the Tyk Portal.
+    If you configured your Gateway to be segmented, you would also need to assign tags and you must also tag the APIs in the API Designer to make sure that they load.
+
+    * In the Pro edition that is a connectivity or misconfiguration issue
+    * In the Community edition, since you are not using the Dashboard we
+    assume that you use file-based APIs , so in this case it's because
+    API definition files are missing.
+
+10. ##### How to import existing keys into Tyk CE
+
+    You can use an API to import existing keys that were not created in Tyk into Tyk's Gateway.
+    This doc explains how to do that with the Gateway's APIs directly.
+
+    This example uses standard `authorization` header authentication, and assumes that the Gateway is located at `127.0.0.1:8080` and the Tyk secret is `352d20ee67be67f6340b4c0605b044b7` - update these as necessary to match your environment.
+
+    To import a key called `mycustomkey`, save the JSON contents as `token.json` (see example below), then run the following Curl command:
+
+    The Example `token.json` file
+
+    ```{.json}
+    {
+    "allowance": 1000,
+    "rate": 1000,
+    "per": 60,
+    "expires": -1,
+    "quota_max": -1,
+    "quota_renews": 1406121006,
+    "quota_remaining": 0,
+    "quota_renewal_rate": 60,
+    "access_rights": {
+        "3": {
+        "api_name": "Tyk Test API",
+        "api_id": "3"
+        }
+    },
+    "org_id": "53ac07777cbb8c2d53000002",
+    "basic_auth_data": {
+        "password": "",
+        "hash_type": ""
+    },
+    "hmac_enabled": false,
+    "hmac_string": "",
+    "is_inactive": false,
+    "apply_policy_id": "",
+    "apply_policies": [
+        "59672779fa4387000129507d",
+        "53222349fa4387004324324e",
+        "543534s9fa4387004324324d"
+        ],
+    "monitor": {
+        "trigger_limits": []
+    }
+    }
+    ```
+
+    The import of the key to Tyk:
+
+    ```
+    curl http://127.0.0.1:8080/tyk/keys/mycustomkey -H 'x-tyk-authorization: 352d20ee67be67f6340b4c0605b044b7' -H 'Content-Type: application/json'  -d @token.json
+    ```
+
+    Test the key after the import:
+
+    ```
+    curl http://127.0.0.1:8080/quickstart/headers -H 'Authorization: mycustomkey'
+    ```
+
+    See also the Keys section of the [Tyk Gateway API documentation](/tyk-gateway-api).
+
+
+10. ##### Redis persistence using containers
+
+    Use case: Keep my data persistent at Docker container restart
+
+    The Multi-Cloud Redis container is ephemeral, it isn't configured for persistence because it would very quickly get very large (Docker containers in general should really be considered as ephemeral).
+
+    If using Redis with Multi-Cloud we strongly recommend using an external Redis database.
+
+    There are no settings for Redis available via environment variable, you would need to mount a new `redis.conf` into the container to customize the configuration, but again, we don't recommend it.
+
+11. ##### DRL not ready, skipping this notification
+
+    **Description**
+
+    You see the following `Log Warning:`
+
+    `DRL not ready, skipping this notification`
+
+
+    **Cause**
+
+    There can be a couple of reasons for seeing this error about the [Distributed Rate Limiter](/api-management/rate-limit#rate-limiting-layers):
+
+    1. When you have more than one installation of the Gateway with one configured to use DRL, and others not.
+    2. When the Gateway is started and the DRL receives an event before it has finished initialising.
+
+    **Solution**
+
+    For cause **1**, ensure that all instances of the Tyk Gateway are configured to use DRL.
+
+    For cause **2**, the error will disappear when the DRL has initialised. 
+
+12. ##### "Index out of range“ error in logs
+
+    **Description**
+
+    Redis cluster users receive the aforementioned error message in their logs. The log stack may resemble the following:
+
+    ```
+        2016/06/22 09:58:41 http: panic serving 10.0.0.1:37196: runtime error: index out of range
+        2016/06/22 09:58:41 http: panic serving 10.0.0.1:37898: runtime error: index out of range
+        2016/06/22 09:58:41 http: panic serving 10.0.0.1:38013: runtime error: index out of range
+        2016/06/22 09:58:42 http: panic serving 10.0.0.1:39753: runtime error: index out of range
+        2016/06/22 10:01:07 http: panic serving 10.0.0.1:34657: runtime error: invalid memory address or nil pointer dereference
+        2016/06/22 10:01:07 http: panic serving 10.0.0.1:36801: runtime error: invalid memory address or nil pointer dereference
+    ```
+
+    **Cause**
+
+    This is due to a bug that prevents the driver from picking up a random redis handle in single-instance connections such as pub/sub. The issue affects later patch releases of Tyk 2.2 and the first release of Tyk 2.3.
+
+    **Solution**
+
+    Users are advised to upgrade to the latest versions of any Tyk packages as a patch was released to resolve this issue. Packages are available to download from [Packagecloud.io](https://packagecloud.io/tyk) and further details on how to upgrade can be found [here](/developer-support/upgrading).
+
+13. ##### Hot restart a Tyk Gateway Process
+
+    It is possible to hot-restart a Tyk Gateway process without dropping any connections. This can be useful if you need to load up a new configuration or change a configuration on a production server without losing any traffic.
+
+    To hot-restart a Tyk Gateway process, you simply need to send a `SIGUSR2` signal to the process, for example:
+
+    ```bash
+    > sudo kill -SIGUSR2 {gateway-pid}
+    ```
+
+    This will fork and load a new process, passing all open handles to the new server and wait to drain the old ones.
+
+14. ##### How to add Custom Certificates to Trusted Storage of Docker Images
+
+    To add your custom Certificate Authority(CA) to your docker containers. You can mount your CA certificate directly into `/etc/ssl/certs` folder.
+
+    Docker: 
+    ```{.copyWrapper}
+    docker run -it tykio/tyk-gateway:latest \
+    -v $(pwd)/myCA.pem:/etc/ssl/certs/myCA.pem
+    ```
+
+    Kubernetes - using Helm Chart and secrets:
+    ```yaml
+    extraVolumes: 
+        - name: self-signed-ca
+        secret:
+            secretName: self-signed-ca-secret
+    extraVolumeMounts: 
+        - name: self-signed-ca
+        mountPath: "/etc/ssl/certs/myCA.pem"
+        subPath: myCA.pem
+    ```
+
+15. ##### How to change the logging output location
+
+    It's not possible to segregate out the error locations in the `tyk.conf`, but you can modify the actual initialisation files to specify the log location, we supply initialisation scripts for `SysV`, `systemd` and `upstart`.
+
+16. ##### How to clear / invalidate API cache
+
+    Use the REST API to clear the cache
+
+    **OSS**
+
+    ```
+    DELETE /tyk/cache/{api-id}
+    ```
+
+    **Tyk Dashboard**
+
+    ```
+    DELETE /api/cache/{api-id}
+    ```
+
+17. ##### How to find the Gateway logging output
+
+    You are able to see a more detailed output in your Gateway log `/var/log` or `/var/log/upstart`.
+
+18. Gateway `proxy_default_timeout` vs `http_server_options.write_timeout`
+
+    **Tyk to Upstream timeout**
+
+    `proxy_default_timeout` specifies the amount of time that Tyk will wait for the upstream service to complete its reply to Tyk
+
+    With gateways prior to release 5.0.7 `proxy_default_timeout` defaulted to zero which would result in the gateway waiting forever. This consumed resources and could lead to depletion of ephemeral sockets.
+
+    Since gateway 5.0.7 `proxy_default_timeout` defaults to 30 seconds.
+
+    When increasing `proxy_default_timeout` beyond 120 seconds it is necessary to consider the client to Tyk timeouts.
+
+    **Client to Tyk timeouts**
+
+    `http_server_options.write_timeout` specifies the number of seconds that Tyk will keep the client connection open for Tyk to write to it. If this is less than `proxy_default_timeout` then the connection to the client will be closed and the upstream reply will not be proxied back to the client if the upstream takes longer than `http_server_options.write_timeout` seconds. To avoid this please make sure that `http_server_options.write_timeout`is at least 1 second longer than `proxy_default_timeout`
+
+    `http_server_options.read_timeout` specifies that number of seconds that Tyk will allow the client to complete sending the request to it. This usually doesn't need to be changed since a lot of data can be sent in the default of 120 seconds, but it can be changed if needed.
+
+## Gateway Error Response Status Codes
+
+Tyk Gateway responses include HTTP status codes that follow the [HTTP status code standard](https://datatracker.ietf.org/doc/html/rfc9110). They have three digits that describe the result of the request and the semantics of the response. 
+The first digit defines the class of response as shown in the [list](https://en.wikipedia.org/wiki/List_of_HTTP_status_codes) below:
+- 1xx (Informational): The request was received, continuing process
+- 2xx (Successful): The request was successfully received, understood, and accepted
+- 3xx (Redirection): Further action needs to be taken in order to complete the request
+- 4xx (Client Error): The request contains bad syntax or cannot be fulfilled
+- 5xx (Server Error): The server failed to fulfill an apparently valid request
+
+Here we provide a list of all the error status codes (4xx and 5xx) that may be returned by the Tyk Gateway along with their corresponding messages and some guidance on the likely cause of the error.
+
+Tyk supports comprehensive [error response customization](/api-management/custom-error-responses), allowing you to configure the Gateway to return customized messages for different HTTP error codes.
+
+
+| Code | Text                                                                                    | Recommended action                                                                                                                                                             |
+| :--- | :-------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 400  | Access to this API has been disallowed                                                  | Check if the key has access to the right API version or definition. Check if the authentication key used is still valid. Check if the certificate used for authentication is present. Check if the authentication key is created and present in the database. You can use Gateway Keys APIs for confirmation. Check if API definition is using JWT auth and if auth header key and or value is empty or missing.|
+| 400  | API is not OAuth2                                                                       | Check if OAuth2 is integrated into the API by auth tokens or using Tyk OAuth flow.                                                                                      |
+| 400  | Attempted access with malformed header                                                  | Values not in basic auth format or auth data not encoded correctly.                                                                                                     |
+| 400  | Authorization Field Missing                                                             | Check if the authorization field is missing. Check if the OAuth authorization field is missing.                                                                         |
+| 400  | Batch request creation failed, request structure malformed                              | Attempted to construct unsafe requests. Check if request structure is in correct format.                                                                                |
+| 400  | Batch request malformed                                                                 | Attempted to decode request but failed. Check if request structure is in correct format.                                                                                |
+| 400  | Bearer token malformed                                                                  | Check if the OAuth authorization field is malformed.                                                                                                                    |
+| 400  | Body do not contain password or username                                                | Check if body contains both password and username. If not, then insert the correct login credentials.                                                                   |
+| 400  | Cannot parse form. Form malformed                                                       | Attempted to revoke token but could not parse the request form. Check if the request form is malformed.                                                                 |
+| 400  | Content length is not a valid Integer                                                   | Check the value provided in the Content-Length field in the header.                                                                                                |
+| 400  | Couldn’t decode instruction                                                             | Attempted to decode policy record from an update request. Check if the request body is malformed and is valid.                                                          |
+| 400  | Couldn’t decode OAS object                                                              | Attempted to import OAS Tyk API but failed to retrieve object from request. Check if request body is valid.                                                             |
+| 400  | Error API not migrated                                                                  | The supplied API definition is in OAS format. Please use the Tyk native format for this API.                                                                            |
+| 400  | Failed to create key, keys must have at least one Access Rights record set              | Attempted to create a key with master keys disabled in configurations.                                                                                                  |
+| 400  | Failed to remove the key                                                                | Failed to delete requested key. Make sure orgID and keyname are correct.                                                                                                |
+| 400  | Health checks are not enabled for this node                                             | Enable health checks for the gateway.                                                                                                                                   |
+| 400  | Key not authorized                                                                      | Check if OAuth key is present. Check if the OAuth client is not deleted. Check if there is a valid policy associated with the key/token used. Check if the policy associated with the key is not expired or if the owner is valid. Check if JWT default policies exist. |
+| 400  | Key cannot be used without a certificate                                                | Check if key contains a certificate. If not, add a certificate to the key.                                                                                              |
+| 400  | Key must be used with an existent certificate                                           | Check if the certificate on the key exist within the system.                                                                                                            |
+| 400  | Missing parameter api_id                                                                | Check if API_ID is missing. If so, fill in the api_ID field with the correct value.                                                                                     |
+| 400  | OAuth client ID not found                                                               | Check if API_ID is missing. If so, fill in the api_ID field with the correct value.                                                                                     |
+| 400  | OAuth client ID is empty                                                                | Check if OAuth client ID field is empty. If so, fill in with the correct client ID value.                                                                               |
+| 400  | OAuth is not enabled for this API                                                       | Check if OAuth is enabled for the API.                                                                                                                                  |
+| 400  | Policy access rights doesn’t contain API this OAuth client belongs to                   | Check if the policy rights contains the proper api_ID for the API.                                                                                                      |
+| 400  | Request apiID does not match that in Definition! For Update operations these must match | Attempted a PUT operation using different api_ID's. Make sure the api_ID's are the same.                                                                                |
+| 400  | Request field is missing                                                                | Check if the request field is missing. If so, fill in the request field.                                                                                                |
+| 400  | Request ID does not match that in policy! For Update operations these must match        | Attempted a PUT operation using different policy ID's. Make sure both policy ID's are the same.                                                                         |
+| 400  | Request is too large                                                                   | The request body exceeds the configured size limit for the API endpoint.                                                                                                                           |
+| 400  | Request with empty authorization header                                                 | Fill in authorization header for the request.                                                                                                                           |
+| 400  | Spec field is missing                                                                   | Attempted to trace a request but spec field is missing. Fill in the spec field.                                                                                         |
+| 400  | The provided request is empty                                                           | Check if request in the GraphQL playground is correct.                                                                                                                  |
+| 401  | Authorization Field Missing                                                             | Check if the authorization field is missing. Check if the OAuth authorization field is missing.                                                                         |
+| 401  | Header missing                                                                          | Check if header field exist when making request.                                                                                                                        |
+| 401  | Key has expired, please renew                                                           | Current key has expired. Please request for a new key.                                                                                                                  |
+| 401  | OAuth Client Id Empty                                                                   | Fill in the Client ID field.                                                                                                                                            |
+| 401  | OAuth Client Secret Empty                                                               | Client secret is empty. Insert the required client secret.                                                                                                              |
+| 401  | Request signature verification failed                                                   | Possible empty signature header or validation failed.                                                                                                                   |
+| 401  | Wrong Password                                                                          | Enter the correct password. Contact an administrator if further help is needed.                                                                                         |
+| 403  | Access to this API has been disallowed                                                  | Request access to the API from an administrator.                                                                                                                        |
+| 403  | Access to this resource has been disallowed                                             | Request access to the resource from an administrator.                                                                                                                   |
+| 403  | Attempted access with non-existent cert                                                 | Check if authentication certificate exist.                                                                                                                              |
+| 403  | Attempted administrative access with invalid or missing key!                            | Check if there is correct security credentials of the Tyk API.                                                                                                          |
+| 403  | Certificate with SHA256 $certID not allowed                                             | Certificate ID is nil or invalid. Please have a valid certificate.                                                                                                      |
+| 403  | Client authorize request in with invalid redirect URI                                   | Check if Auth Redirect URI is malformed or use a valid redirect URI.                                                                                                    |
+| 403  | Client TLS certificate is required                                                      | Check if theres multiple APIs on the same domain with no certificates.                                                                                                  |
+| 403  | Certificate has expired                                                                 | Please update the certificate with one that is currently valid and has not expired.                                                                                                  |
+| 403  | Depth limit exceeded                                                                    | Exceeded the depth limit that has been applied. Check the key/policy global limits and quota section or the API limits and quota section.                               |
+| 403  | Empty Signature Header                                                                  | Fill in a signature for auth keys.                                                                                                                                      |
+| 403  | Empty Signature Path                                                                    | Check if path for signature is empty.                                                                                                                                   |
+| 403  | Failed with 403 after $x-amount of requests over quota                                  | Process request off thread with quota or process request live with rate limit or process request off thread with rate limit.                                            |
+| 403  | Found an empty user ID in predefined base claim user_id                                 | Request with valid JWT/RSA or signature/empty user_id/sub claim, or signature/no base field or no sub or no id claim.                                                   |
+| 403  | GraphQL Depth Limit Exceeded                                                            | Exceeded the depth limit that has been applied. Check the key/policy global limits and quota section or the API limits and quota section.                               |
+| 403  | Invalid Token                                                                           | Check if JWT token is valid and not malformed.                                                                                                                          |
+| 403  | Invalid Signature Header                                                                | Insert correct signature header value.                                                                                                                                  |
+| 403  | Invalid Signature Path                                                                  | Make sure signature path is correct and valid.                                                                                                                          |
+| 403  | Key has expired, please renew                                                           | Create a new key.                                                                                                                                                       |
+| 403  | Key not authorized: Unexpected signing method                                           | Invalid JWT signature, JWT access with non-existent key.                                                                                                                |
+| 403  | Key not authorised: OAuth client access was revoked                                     | Check if OAuth client exists.                                                                                                                                           |
+| 403  | Key not authorised: no matching policy                                                  | Request with invalid policy in JWT, or checking session and identity for valid key for openID.                                                                          |
+| 403  | No matching policy found in scope claim                                                 | Check if scope is wrong for JWT request.                                                                                                                                |
+| 403  | Quota Exceeded                                                                          | Quota limit has been exceeded. Check quota limit settings.                                                                                                              |
+| 403  | Run Go-plugin auth failed                                                               | Used an invalid token for authentication. Please use a valid token to authenticate.                                                                                     |
+| 403  | This API version does not seem to exist                                                 | Attempted to extract version data from a request. Version does not exist when loading version data.                                                                     |
+| 403  | This organisation access has been disabled, please contact your API administrator       | Organisation session is inactive. Contact API administrator.                                                                                                            |
+| 403  | This organisation quota has been exceeded, please contact your API administrator        | Organisation's quota limit has been exceeded. Contact API administrator.                                                                                                |
+| 403  | This organisation rate limit has been exceeded, please contact your API administrator   | Organisation's rate limit has been exceeded. Contact API administrator.                                                                                                 |
+| 403  | TLS: bad certificate                                                                    | Check if the certificates exist and have valid ID's.                                                                                                                    |
+| 403  | Version Information not found                                                           | Checking version data from request. No default version has been set or found.                                                                                           |
+| 404  | API not found                                                                           | Checking if API exists when rotating OauthClient or if ApiSpec value is nil.                                                                                            |
+| 404  | API for this refresh token not found                                                    | When invalidating OAuth refresh or if ApiSpec value is nil.                                                                                                             |
+| 404  | API ID not found                                                                        | Check if API ID exists in the Gateway.                                                                                                                                  |
+| 404  | API not found                                                                           | Check if API exists.                                                                                                                                                    |
+| 404  | Bundle not found                                                                        | No bundles found within the Gateway.                                                                                                                                    |
+| 404  | Certificate with given SHA256 fingerprint not found                                     | No certificates exist in the certificate manager list.                                                                                                                  |
+| 404  | Couldn't find organisation session in active API list                                   | Attempted to update session object. However, spec for organisation is nil. Make sure to have the correct organisation ID.                                               |
+| 404  | Error getting oauth client                                                              | See if OAuth client id exists in the system.                                                                                                                            |
+| 404  | Key not found                                                                           | Failed to update hashed key.                                                                                                                                            |
+| 404  | No such organisation found in Active API list                                           | Make sure organisation ID is correct.                                                                                                                                   |
+| 404  | OAuth client ID not found                                                               | Attempted to retrieve APIs for OAuth or client ID. Client ID was not found                                                                                              |
+| 404  | OAuth client ID not found                                                               | Check if OAuth client ID exist in storage. Check if OAuth tokens or client details are valid. Failed to retrieve OAuth client list. Failed to revoke OAuth client list. |
+| 404  | Org not found                                                                           | Could not retrieve record of org ID or failed to delete org keys. Spec for org is nil, make sure orgID value is correct                                                 |
+| 404  | Policy not found                                                                        | Could not retrieve policy data. Make sure policy ID is correct.                                                                                                         |
+| 404  | There is no such key found                                                              | Check if key is already deleted. Check if hashed key has been deleted already.                                                                                          |
+| 404  | Version Does Not Exist                                                                  | Check if version path is filled and correct.                                                                                                                            |
+| 405  | Malformed request body                                                                  | Attempted a POST request with a malformed request body. Make sure the request body is valid.                                                                            |
+| 405  | Method not supported                                                                    | Attempting to add a method that is not supported by our system.                                                                                                         |
+| 411  | Content length is required for this request                                             | You need to provide the `Content-Length` field in the request header.                                                                                                         |
+| 429  | API Rate Limit Exceeded                                                                 | Check the rate of the requests on the API level. Check the rate of requests on the API key (Auth token, certs, etc).                                                    |
+| 499  | Client closed request                                                                   | Check if the client closed the TCP connection                                                                                                                           |
+| 500  | Cache invalidation failed                                                               | Attempted to scan or delete the cache, which failed, causing cache invalidation to fail.                                                                                |
+| 500  | Can't detect loop target                                                                | Verify target API exsists. Check if URL scheme is "tyk://". Refer to 404 errors                                                                                         |
+| 500  | Could not write key data                                                                | Failed to update hashed key. Make sure key name is valid.                                                                                                               |
+| 500  | Delete failed                                                                           | Attempted to delete policy with invalid filename. Attempted to delete API with invalid filename. Attempted to delete OAuth Client with incorrect OAuth client ID.       |
+| 500  | Due to enabled service policy source, please use the Dashboard API                      | Attempted to add/update a policy and rejected due to Policysource=service. Please use the Dashboard API.                                                                |
+| 500  | Due to enabled use_dp_app_configs, please use Dashboard API                             | When trying to import OAS, when Dashboard config is set to true. Please use Dashboard API.                                                                              |
+| 500  | Error writing to key store                                                              | Attempted to update session with a new session. Make sure orgID is correct.                                                                                             |
+| 500  | Failed to create file                                                                   | When add/update policy, failed to create a file. Make sure the policy file path is correct                                                                              |
+| 500  | Failed to create key                                                                    | Check if key already exist or if the key exists with a given certificate. Ensure security settings are correct                                                          |
+| 500  | Failure in storing client data                                                          | Attempted to store data when creating a new OAuth client but failed. Make sure the storageID, or orgID is correct and valid.                                            |
+| 500  | Get client tokens failed                                                                | Failed to retrieve OAuth tokens. Make sure client ID is valid or keyName is valid.                                                                                      |
+| 500  | Marshalling failed                                                                      | Attempted to import printDef but failed. Marshalling of policy failed. Unmarshal object into the file failed when writing to file.                                      |
+| 500  | There was a problem proxying the request                                                | Check if the target URL is unavailable to the Gateway.                                                                                                                  |
+| 500  | Unmarshalling failed                                                                    | Key creation failed. Failed to create OAuth client. Failed to update OAuth client.                                                                                      |
+| 500  | Unsupported schema, unable to validate                                                  | Check if GraphQL schema is valid.                                                                                                                                       |
+| 500  | Upstream host lookup failed                                                          | Check if the target URL is not resolvable in DNS.                                                                                                                       |
+| 503  | Service temporarily unavailable                                                         | Check if a circuit breaker middleware is enforced.                                                                                                                      |
+| 503  | All hosts are down                                                                      | Attempted to reverse proxy a URL rewrite to a scheme and host, but all the hosts in hostlist are down.                                                                  |
+| 504  | Upstream service reached hard timeout                                                   | Timeout awaiting response headers during a request round trip.                                                                                                          |
+| 507  | Status Insufficient Storage                                                             | Attempted to update an API through a POST request but failed to due insufficient storage.                                                                               |
+
+
+## Dashboard
+
+1. ##### Can't update policy. Please ensure at least one access rights setting is set
+
+    **Description**
+
+    Users receive this error when attempting to create a new Policy on the Dashboard.
+
+    **Cause**
+
+    The Access Rights field is a required setting for a policy.
+
+    **Solution**
+
+    Users should first [create a new API](/api-management/gateway-config-managing-classic#create-an-api) and then [create a new policy](/api-management/gateway-config-managing-classic#secure-an-api) with an existing API in the Access Rights.
+
+2. ##### Dashboard not showing any analytics data
+
+    **Description**
+
+    The user is unable to see analytics data from a particular time period in the Dashboard
+
+    **Cause**
+
+    Missing analytics data could be caused by a number of different reasons:
+
+    * Gateway incorrectly configured
+    * Pump incorrectly configured
+    * Pump service not running
+    * Dashboard incorrectly configured
+    * MDCB incorrectly configured
+    * Browser caching stale data
+
+    **Solution**
+
+    **Gateway incorrectly configured**
+
+    Ensure the Gateway `tyk.conf` has:
+
+    * `enable_analytics` set to `true`. This sets the Gateway to record analytics data.
+    * `analytics_config.storage_expiration_time` set to a value larger than the Pump's `purge_delay`. This allows the analytics data to exist long enough in Redis to be processed by the Pump.
+    * `analytics_config.ignored_ips` set to `[]`. This ensures the Gateway will create analytics for requests from any IP address. 
+    * `enforce_org_data_age` set to `false`. This prevents the data from being removed based on it reaching a certain age.
+
+    **Pump incorrectly configured**
+
+    Ensure the Pump `pump.conf` has:
+
+    * `analytics_storage_type` set to `redis`.
+    * `analytics_storage_config` settings are set to the same Redis instance that the Gateway is connected to.
+
+    **Pump service not running**
+
+    Ensure the Pump service is running.
+
+    **Dashboard incorrectly configured**
+
+    Ensure the Dashboard `tyk_analytics.conf` has:
+
+    * `mongo_url` set to the same MongoDB instance that the Pump is connected to.
+
+    **MDCB incorrectly configured**
+
+    For scenarios where MDCB is used, ensure the `sink.conf` has:
+
+    * `analytics.mongo_url` set to the same MongoDB instance that the Dashboard is connected to.
+    * `forward_analytics_to_pump` set to the correct value for your solution. `false` if MDCB is directly recording the analytics itself, `true` if it is forwarding analytics data for the Pump to process. For the forwarding scenario, set the `storage` settings to the same Redis instance that the Pump is connected to.
+
+    **Browser caching stale data**
+
+    Try restarting your browser, or using a private session.
+
+    You can also try restarting the Dashboard service.
+
+    **Troubleshooting tip**
+
+    Check if MongoDB contains analytics data by running the following query (but update the date parameter first):
+
+    ```{.copyWrapper}
+    db.getCollection('tyk_analytics_aggregates').find({timestamp: {$gte: new ISODate("2016-09-26T23:59:00Z")}})
+    ```
+
+    The query gets all aggregated analytics data from the date provided, so if you set it to yesterday you will get all data since yesterday. The data must be in the ISO format.
+
+3. ##### Fatal - Dashboard and portal domains cannot be the same
+
+    **Description**
+
+    The Tyk Dashboard service will not start and displays a fatal error as follows:
+
+    ```
+    FATAL Dashboard and portal domains cannot be the same. 
+    Dashboard domain: tyk-dashboard.com, Portal domain: tyk-dashboard.com
+    ```
+
+    **Cause**
+
+    Tyk's developer portal UI needs to run on either a different subdomain or different domain name to the dashboard UI.
+
+    Tyk's Dashboard service may be run in a multi-tenant configuration, and each tenant may have their own developer portals.
+
+    The Dashboard service determines which portal to load based on the `Host` header in the request by the browser. If this
+    conflicts with the hostname of the dashboard UI the dashboard service will not know whether to serve the dashboard or
+    developer portal.
+
+    **Solution**
+
+    Firstly, we will need to disable hostnames from within the Dashboard configuration file in order to get the dashboard
+    service started again.
+
+    Change `host_config.enable_host_names` from `true` to `false`
+    ```
+    "host_config": {
+    "enable_host_names": true,    <------ CHANGE TO false
+    ...
+    ...
+    },
+    ```
+
+    You should now be able to start the Dashboard service.
+
+    Navigate to the Dashboard via it's public IP address and log-in.
+
+    Change your portal domain to something different - e.g. `portal.tyk-dashboard.com`
+
+    Edit the Dashboard configuration file to re-enable host names.
+
+    Restart the Dashboard service.
+
+4. ##### Internal TIB SSO User unable to log in
+
+    **Description**
+
+    After creating an SSO Identity profile in the Tyk Dashboard, a user is unable to log in to the Dashboard or the Developer Portal
+
+    **Cause**
+
+    One potential cause is that the `DashboardCredential` setting has not been populated with the user's Tyk Dashboard API Access Credentials.
+    You can check this from:
+
+    1. From the Dashboard menu, select the Identity Management option
+    2. Edit the profile you created
+    3. Select the Raw Editor
+    4. Check to see if the `DashboardCredential` setting is set
+
+    <img src="/img/2.10/identity_profile2.png" alt="DashboardCredentials" />
+
+
+
+    **Workaround Solution**
+
+    If, as above, the `DashboardCredential` setting is empty (`"DashboardCredential": ""`), you can manually add the user's Tyk Dashboard API Access Credentials by performing the following:
+
+    1. From the System Management > Users menu, select Actions > Edit from the user whose credentials you want to use
+    2. Copy the **Tyk Dashboard API Access Credentials** value
+
+    <img src="/img/2.10/user_api_credentials.png" alt="User API Access Credentials" />
+
+    3. Paste this into the Raw editor for the `DashboardCredential` setting. For example - `"DashboardCredential": "887dad0de40b4ff05b6b50739b311099"`
+    4. Click **Update**
+    5. The user should now be able to log in to the Dashboard/Portal
+
+    
+
+    <Note>
+    This issue is due to be fixed in an up coming release
+    </Note>
+
+
+5. ##### Key object validation failed, most likely malformed input error
+
+    **Description**
+
+    The user is getting error as `Key object validation failed, most likely malformed input` when calling the Dashboard API.
+
+    **Cause**
+
+    Issue caused by invalid character passed in the JSON body of the request.
+
+    **Solution**
+
+    Validate the JSON using JSON validator.
+
+    Further, please see [this community forum post](https://community.tyk.io/t/error-creating-new-api-through-dashboard-rest-api/1555/2) for additional guidance.
+
+6. ##### Port 5000 Errors in the Browser Console
+
+    > **NOTE**: Port 5000 is no longer required from v2.9.3.
+
+    **Description**
+
+    You see a lot of `net::ERR_CONNECTION_REFUSED` errors in the browser console.
+
+    **Cause**
+
+    The Dashboard is trying to connect to `https://<Your Dashboard URL>:5000/socket.io/?chan=ui_notifications` and you don't have port 5000 open.
+
+    **Solution**
+
+    Port 5000 is used for WebSocket connections for real-time Dashboard notifications. You can change the port by changing the default `notifications_listen_port` in your `tyk_analytics.conf`. Otherwise you can ignore the errors in the browser console.
+
+    
+<Note>
+Port 5000 is only required if you need to enable the Tyk Gateway log viewer.
+</Note>
+
+
+7. ##### There was a problem updating your CNAME“ error in the Dashboard
+
+    **Description**
+
+    A user may find that they are unable to update a CNAME from within the Dashboard. The following error will appear in a pop-up:
+
+    ```
+    There was a problem updating your CNAME, please contact support
+    ```
+
+    **Cause**
+
+    The UI for setting the domain name has a very strict validation, so it may just be rejecting this domain.
+
+    **Solution**
+
+    The best way to set the domain is to use the Tyk Dashboard Admin API, to obtain the organization object via a GET request and then update the object using a PUT request with the relevant CNAME added to the body of the request.<sup>[[1](https://tyk.io/docs/api-reference/organisations/list-all-organisations)]</sup> Restarting the process will then set the domain.
+
+8. ##### runtime error invalid memory address or nil pointer dereference
+
+    **Description**
+
+    When attempting to POST an OAuth Client to a newly generated API, user may receive the following stack trace:
+
+    ```
+    2016/12/08 08:06:16 http: panic serving 172.18.0.4:46304: runtime error: invalid memory address or nil pointer dereference
+    goroutine 364279 [running]:
+    net/http.(*conn).serve.func1(0xc420569500)
+    panic(0xb0e780, 0xc420014040)
+    /usr/local/go/src/runtime/panic.go:458 +0x243
+    main.createOauthClient(0xf58260, 0xc4203a41a0, 0xc4206764b0)
+    /home/tyk/go/src/github.com/lonelycode/tyk/api.go:1526 +0x64a
+    main.CheckIsAPIOwner.func1(0xf58260, 0xc4203a41a0, 0xc4206764b0)
+    /home/tyk/go/src/github.com/lonelycode/tyk/middleware_api_security_handler.go:24 +0x2ae
+    net/http.HandlerFunc.ServeHTTP(0xc420533e50, 0xf58260, 0xc4203a41a0, 0xc4206764b0)
+    /usr/local/go/src/net/http/server.go:1726 +0x44
+    github.com/gorilla/mux.(*Router).ServeHTTP(0xc42061cdc0, 0xf58260, 0xc4203a41a0, 0xc4206764b0)
+    /home/tyk/go/src/github.com/gorilla/mux/mux.go:98 +0x255
+    net/http.(*ServeMux).ServeHTTP(0xc420667290, 0xf58260, 0xc4203a41a0, 0xc4206764b0)
+    /usr/local/go/src/net/http/server.go:2022 +0x7f
+    net/http.serverHandler.ServeHTTP(0xc42000fc80, 0xf58260, 0xc4203a41a0, 0xc4206764b0)
+    /usr/local/go/src/net/http/server.go:2202 +0x7d
+    net/http.(*conn).serve(0xc420569500, 0xf58d20, 0xc42068bdc0)
+    /usr/local/go/src/net/http/server.go:1579 +0x4b7
+    created by net/http.(*Server).Serve
+    /usr/local/go/src/net/http/server.go:2293 +0x44d
+    ```
+
+    **Cause**
+
+    The API that the OAuth Client has been POSTed to either doesn't exist or hasn't had a chance to propagate throughout the system.
+
+    **Solution**
+
+    When creating a new OAuth Client, make sure that API it is created under exists. If the API was created recently, please wait a few minutes before attempting to create an OAuth Client under it.
+
+9. ##### ValueError No JSON object could be decoded" when running Dashboard Bootstrap script
+
+    **Description**
+
+    Users receive the following error message when attempting to run the bootstrap script in their Tyk instance:
+
+    ```
+    Traceback (most recent call last):
+    File ""<string>"", line 1, in <module>
+    File ""/usr/lib64/python2.7/json/__init__.py"", line 290, in load
+    **kw)
+    File ""/usr/lib64/python2.7/json/__init__.py"", line 338, in loads
+    return _default_decoder.decode(s)
+    File ""/usr/lib64/python2.7/json/decoder.py"", line 365, in decode
+    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
+    File ""/usr/lib64/python2.7/json/decoder.py"", line 383, in raw_decode
+    raise ValueError(""No JSON object could be decoded"")
+    ValueError: No JSON object could be decoded
+    ORGID:
+    Adding new user
+    Traceback (most recent call last):
+    File ""<string>"", line 1, in <module>
+    File ""/usr/lib64/python2.7/json/__init__.py"", line 290, in load
+    **kw)
+    File ""/usr/lib64/python2.7/json/__init__.py"", line 338, in loads
+    return _default_decoder.decode(s)
+    File ""/usr/lib64/python2.7/json/decoder.py"", line 365, in decode
+    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
+    File ""/usr/lib64/python2.7/json/decoder.py"", line 383, in raw_decode
+    raise ValueError(""No JSON object could be decoded"")
+    ValueError: No JSON object could be decoded
+    USER AUTH:
+    Traceback (most recent call last):
+    File ""<string>"", line 1, in <module>
+    File ""/usr/lib64/python2.7/json/__init__.py"", line 290, in load
+    **kw)
+    File ""/usr/lib64/python2.7/json/__init__.py"", line 338, in loads
+    return _default_decoder.decode(s)
+    File ""/usr/lib64/python2.7/json/decoder.py"", line 365, in decode
+    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
+    File ""/usr/lib64/python2.7/json/decoder.py"", line 383, in raw_decode
+    raise ValueError(""No JSON object could be decoded"")
+    ValueError: No JSON object could be decoded
+    NEW ID:
+    Setting password
+    DONE"
+    ```
+
+    **Cause**
+
+    The bootstrap script requires a valid hostname and port number to generate a new login user.
+
+    **Solution**
+
+    Make sure that the correct hostname and port number used to run the bootstrap.sh script. An example command would be: `./bootstrap.sh new-tyk-instance.com:3000`
+
+10. ##### Dashboard bootstrap error
+
+    Make sure you:
+
+    Target the correct domain with your `bootstrap.sh` as it is very specific once you set up a Dashboard service with hostname set
+
+    ```{.copyWrapper}
+    ./bootstrap.sh my-tyk-instance.com
+
+    ```
+
+    Have checked the firewall rules in your instance and VPC to allow
+    port 3000 access.
+
+11. ##### How to find the policy ID for a created policy
+
+    Open the Active Policies page in the Dashboard (System Management > Policies) and click **Edit** next to the name of the policy you've created. The policy ID should appear in the URL of the edit page that opens up.
+
+12. ##### How to Connect to DocumentDB with X.509 client cert
+
+    As AWS DocumentDB runs with TLS enabled, we require a way to run it without disabling the TLS verification.
+    DocumentDB uses self-signed certs for verification, and provides a bundle with root certificates for this purpose, so we need a way to load this bundle.
+
+    Additionally DocumentDB can't be exposed to the local machine outside of the Amazon Virtual Private Cloud (VPC), which means that even if verification is turned on, it will always fail since if we use a SSH tunnel or a similar method, the domain will differ from the original. Also, it can have [Mutual TLS](/api-management/implement-tls#secure-hosted-apis-with-mtls) enabled.
+
+    So, in order to support it, we provide the following variables for both our [Tyk Analytics Dashboard](/tyk-dashboard/configuration) and [Tyk Pump](/api-management/tyk-pump#configuring-tyk-pump):
+
+    * `mongo_ssl_ca_file` - path to the PEM file with trusted root certificates
+    * `mongo_ssl_pem_keyfile` - path to the PEM file which contains both client certificate and private key. This is required for Mutual TLS.
+    * `mongo_ssl_allow_invalid_hostnames` - ignore hostname check when it differs from the original (for example with SSH tunneling). The rest of the TLS verification will still be performed.
+
+
+    A working DocumentDB configuration looks like this (assuming that there is SSH tunnel, proxying to 27018 port).
+
+    ```{.json}
+    "mongo_url": "mongodb://testest:testtest@127.0.0.1:27018/tyk_analytics?connect=direct",
+    "mongo_use_ssl": true,
+    "mongo_ssl_insecure_skip_verify": false,
+    "mongo_ssl_ca_file": "<path to>/rds-combined-ca-bundle.pem",
+    "mongo_ssl_allow_invalid_hostnames": true,
+    ```
+
+    **Capped Collections**
+
+    If you are using DocumentDB, [capped collections](/api-management/dashboard-analytics/analytics-storage-management) are not supported. See [here](https://docs.aws.amazon.com/documentdb/latest/developerguide/mongo-apis.html) for more details.
+
+13. ##### How to disable an API
+
+    You will need to GET the API from the Dashboard, then set `active` property to `false`, then PUT it back.
+    See [Dashboard API - API Definitions](https://tyk.io/docs/api-reference/apis/get-list-of-apis) for more details on how to GET and PUT an API definition.
+
+14. ##### How to Setup CORS
+
+    **Upstream service supports CORS**
+    If your upstream service supports CORS already then Tyk should ignore **OPTIONS** methods as these are pre-flights sent by the browser. In order to do that you should select **Options passthrough**, and **NOT CHECK** CORS in Tyk.
+
+    - If you not do allow **OPTIONS** to pass through, it will cause Tyk to dump the options request upstream and reply with the service's response so you'll get an error similar to `no 'access-control-allow-origin' header is present on the requested resource`. 
+
+    - If you check **CORS** as well you'll get an error similar to this: 
+    ```
+    Failed to load https://ORG_NAME.cloud.tyk.io/YOUR_API: The 'Access-Control-Allow-Origin' header 
+    contains multiple values 'http://UPSTREAM', but only one is allowed. Origin 'http://UPSTREAM' 
+    is therefore not allowed access. Have the server send the header with a valid value, or, if an 
+    opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with
+    CORS disabled
+    ```
+    This is because you have enabled CORS on the Api Definition and the upstream **also** supports CORS and so both add the header.
+
+
+    **Upstream does not handle CORS**
+    If your upstream does not handle CORS, you should let Tyk manage all CORS related headers and responses. In order to do that you should **enable CORS** in Tyk and **NOT ENABLE** Options pass through.
+
+    To learn more, look for `CORS.options_passthrough` [here](/api-management/gateway-config-tyk-classic#cross-origin-resource-sharing-cors).
+
+
+    **CORS middleware is allowing headers which I did not allow**
+    This may be the case when you enable CORS but don't provide any headers explicitly (basically providing an empty array). In this case the CORS middleware will use some sensible defaults. 
+    To allow all headers, you will need to provide `*` (although this is not recommended).
+
+    The same can happen with Allowed Origins and Allowed Methods. Read more about it [here](/api-management/gateway-config-tyk-classic#cross-origin-resource-sharing-cors).
+
+    **CORS middleware is blocking my authenticated request**
+    Please make sure that you did allow the authorization header name (e.g. `Authorization`) or else the request will be blocked by the CORS middleware. If you're having trouble on the developer portal with authenticated requests make sure to also allow the `Content-Type` header.
+
+15. ##### No Key information on the Dashboard
+
+    Information relating to a given key doesn't automatically appear in the Dashboard for users who have switched from a Self-Managed installation to a Multi-Cloud setup.
+
+    The stats for a key will never update in the Cloud for a Multi-Cloud installation. The Dashboard in this mode only sets the initial “master” values for a key and those keys are then propagated across the Multi-Cloud instances that are using them (for example, you may have multiple zones with independent Redis DBs) at which point they diverge from each other.
+
+    To see the up to date stats for a token, the key must be queried via the Gateway API.
+
+16. ##### How to rename or move existing headers in a request
+
+    To rename a header, or to move a value from one header to another (for example, moving an authentication token to a secondary place, or copying a value that gets replaced upstream) is easy with [context variables](/api-management/traffic-transformation/request-context-variables). Here is an example where we move the value of `X-Custom-Header` to a new header called `X-New-Custom-Header` in all requests.
+
+    We do this by setting the following in our API Definition Version section:
+    ```{.copyWrapper}
+    "global_headers": {
+        "X-New-Custom-Header": "$tyk_context.headers_X_Custom_Header"
+    },
+    "global_headers_remove": ["X-Custom-Header"],
+    ```
+
+    You can test the header with the following command. This assumes your API Authentication mode is set to open(keyless):
+
+    ```{.copyWrapper}
+    curl -X GET \
+    https://DOMAIN/LISTEN_PATH/get \
+    -H 'content-type: application/json' \
+    -H 'x-custom-header: Foo' \
+    ```
+
+
+    You can also do this via the Dashboard from the Endpoint Designer tab within the API Designer:
+
+    <img src="/img/dashboard/system-management/rename_headers.png" alt="rename header" />
+
+17. ##### How to run the Dashboard and portal on different ports
+
+    Unfortunately its not possible to run the Dashboard and Portal on different ports, they must use the same port.
+
+18. ##### How to run two Gateways with docker-compose
+
+    Managing a second Tyk Gateway with our [Tyk Install](/tyk-self-managed/install/docker) is a case of mounting the `tyk.conf` file into a new volume and declaring a new Gateway service but exposed on a different port.
+    You will need to make some minor modifications to `docker-compose.yml` and start your services as usual with `docker-compose up`.
+
+    
+
+    <Note>
+    This will only work with an appropriate license. The free license is for development purposes and would allow running Tyk's licensed platform with only one Gateway. If you want to test Tyk with more please contact us by email [info@tyk.io](mailto:info@tyk.io) and we will be happy to discuss your case and PoC requirements as well as providing a short period license.
+    </Note>
+
+
+
+    **Add the following to `docker-compose.yml` (after the `tyk-gateway` definition)**
+
+    ```
+    tyk-gateway2:
+    image: tykio/tyk-gateway:latest
+    ports:
+    - "8081:8080"
+    networks:
+    - tyk
+    depends_on:
+    - tyk-redis
+    volumes:
+    ./confs/tyk.conf:/opt/tyk-gateway/tyk.conf
+    ```
+
+19. ##### “Payload signature is invalid!“ error
+
+    **Description**
+
+    Users receive the error "Payload signature is invalid!” in their logs.
+
+    **Cause**
+
+    Users may not have enabled payload signatures in their settings after an upgrade.
+
+    **Solution**
+
+    See [System Payloads](/api-management/security-best-practices#sign-payloads) for more details.
+
+## Pump
+
+1. ##### Capturing detailed logs
+
+    If you've seen the documentation for Tyk Dashboard's [log browser](/api-management/dashboard-analytics#activity-logs), then you'll also be wondering how to set up your Tyk configuration to enable detailed request logging.
+
+    **What is detailed request logging?**
+
+    When [detailed request logging](/api-management/logs/traffic-logs#detailed-recording) is enabled, Tyk will record the request and response in wire-format in the analytics database. This can be very useful when trying to debug API requests to see what went wrong for a user or client.
+
+    This mode is configured in the gateway and can be enabled at the [system](/api-management/logs/traffic-logs#gateway-level), [API](/api-management/logs/traffic-logs#api-level) or [access key](/api-management/logs/traffic-logs#key-level) level.
+
+    You will also need your Tyk Pump configured to move data into your preferred data store.
+
+    **Disabling detailed recording for a particular pump**
+
+    In some cases, you don't want to send the detailed request and response to a particular data store. 
+    In order to do that, you can set `omit_detailed_recording` in your Tyk Pump configuration file to `true`. This will disable the detailed logging for a specific pump.
+
+    For example, if we have an ElasticSearch, Kafka and CSV stores, and you want to save the detailed recording in all of them except Kafka you can use the following configuration:
+
+    Enable detailed analytics on the Gateway `tyk.conf` using:
+    ```{.copyWrapper}
+    "enable_analytics" : true,
+    "analytics_config": {
+    "enable_detailed_recording": true
+    }
+    ```
+    - Configure each pump on `pump.conf`.
+    - Add the `omit_detailed_recording` variable to the Kafka pump:
+    ```{.copyWrapper}
+    "pumps": {
+    "kafka": {
+        "type": "kafka",
+        "omit_detailed_recording":"true"
+        "meta": {
+            ...
+        }
+    },
+    ... 
+    },
+    ```
+
+2. ##### Connection dropped, connecting...
+
+    **Description**
+
+    Users may notice the following message in their logs for the Tyk Pump:
+
+    ```
+    [Jun 3 22:48:02] INFO elasticsearch-pump: Elasticsearch Index: tyk_analytics
+    [Jun 3 22:48:02] INFO main: Init Pump: Elasticsearch Pump
+    [Jun 3 22:48:02] INFO main: Starting purge loop @10(s)
+    [Jun 3 22:48:12] WARN redis: Connection dropped, connecting..
+    [Jun 3 22:48:23] INFO elasticsearch-pump: Writing 1386 records
+    [Jun 3 22:50:11] INFO elasticsearch-pump: Writing 13956 records
+    ```
+
+    **Cause**
+
+    This is normal behavior for the Tyk Pump.
+
+    **Solution**
+
+    N/A
+
+3. ##### Data Seen in Log Browser but No Reports
+
+    **Description**
+
+    You can see data in the log browser but the rest of the reports display nothing.
+
+    **Solution**
+
+    If your Pump is configured to use `mongo_selective_pump` (e.g. store data in a collection per organization), ensure that the [Dashboard configuration setting](/tyk-dashboard/configuration) `use_sharded_analytics` is set to `true`. 
+
+    The same applies in the reverse direction. If you are using `mongo-pump-aggregate` in your [pump configuration](/api-management/tyk-pump#configuring-tyk-pump), set `use_sharded_analytics` to false.
+
+    This is because you've enabled `use_sharded_analytics` as per above and you're using the `mongo-pump-aggregate`, but you now also have to add a `mongo-pump-selective` in order to save individual requests to Mongo, which the Dashboard can read into the Log Browser.
+
+4. ##### No Elasticsearch node available
+
+    **Description**
+
+    Tyk Pump is configured to use Elasticsearch, but it does not work and shows `no Elasticsearch node available` message in log.
+
+    ```
+    tyk-pump[68354]: time="Aug 30 15:19:36" level=error msg="Elasticsearch connection failed: no Elasticsearch node available"
+    ```
+
+    **Cause**
+
+    The `elasticsearch_url` configuration property in the `pump.conf` is missing the HTTP prefix e.g.
+
+    ```
+    "elasticsearch_url": "127.0.0.1:9200"
+    ```
+
+    **Solution**
+
+    Ensure the HTTP prefix is present in the `elasticsearch_url` configuration property e.g.
+
+    ```
+    "elasticsearch_url": "http://127.0.0.1:9200"
+    ```
+
+5. ##### Tyk Pump Panic “stack exceeds 1000000000-byte limit“
+
+    **Description**
+
+    Users receive a the aforementioned error message in a stack trace in the Pump.
+
+    **Cause**
+
+    Users receive a the aforementioned error message in a stack trace in the Pump.
+
+    **Solution**
+
+    Users are advised to upgrade to the latest version of Tyk. They must also ensure that their Pump is configured with a `purge_delay` and an `optimisation_max_active` value that's greater than 0. Packages are available to download from [Packagecloud.io](https://packagecloud.io/tyk) and further details on how to upgrade can be found [here](/developer-support/upgrading)
+
+6. ##### Pump overloaded
+
+    **Description**
+
+    The Tyk Pump cannot deal with amount of analytics data generated by the Gateway. This means the Pump is unable to process all the analytics data within the purge period.
+
+    **Cause**
+
+    If there is excessive analytics data, the pump may become overwhelmed and not able to move the data from Redis to the target data store.
+
+    **Solution**
+
+    There are many ways to approach solving this problem.
+
+    **Scale the Pump**
+
+    Scale the Pump by either increasing the CPU capacity of the Pump host or by adding more Pump instances.
+
+    By adding more instances you are spreading the load of processing analytics records across multiple hosts, which will increase processing capacity.
+
+    **Disable detailed analytics recording**
+
+    Set `analytics_config.enable_detailed_recording` to `false` in the Gateway configuration file `tyk.conf`. Detailed analytics records contain much more data and are more expensive to process, by disabling detailed analytics recording the Pump will be able to process higher volumes of data.
+
+    **Reduce the Pump purge delay**
+
+    Set `purge_delay` to a low value e.g. `1` in the Pump configuration file `pump.conf`. This value is the number of seconds the Pump waits between checking for analytics data. Setting it to a low value will prevent the analytics data set from growing too large as the pump will purge the records more frequently.
+
+    **Reduce analytics record expiry time**
+
+    Set `analytics_config.storage_expiration_time` to a low value e.g. `5` in the Gateway configuration file `tyk.conf`. This value  is the number of seconds beyond which analytics records will be deleted from the database. The value must be higher than the `purge_delay` set for the Pump. This will allow for analytics records to be discarded in the scenario that the system is becoming overwhelmed. Note that this results in analytics record loss, but will help prevent degraded system performance.
+
+## Streams
+
+1. ##### Failure to connect to the event broker
+
+    If Tyk Gateway is unable to establish a connection to the configured event broker (e.g., Kafka, MQTT), check the following:
+    - Verify that the broker connection details in the Tyk Dashboard are correct, including the hostname, port, and any required credentials.
+    - Ensure that the event broker is running and accessible from the Tyk Gateway instance.
+    - Check the network connectivity between the Tyk Gateway and the event broker. Use tools like telnet or nc to validate the connection.
+
+2. ##### Messages are not being published or consumed
+
+    If messages are not being successfully published to or consumed from the event broker, consider the following:
+    - Verify that the topic or queue names are correctly configured in the Tyk Dashboard and match the expected values in the event broker.
+    - Check the Tyk Gateway logs for any error messages related to message publishing or consumption. Adjust the log level to "debug" for more detailed information.
+    - Validate that the message format and schema match the expectations of the consumer or producer. Inspect the message payloads and ensure compatibility.
+
+3. ##### Async API performance is poor or connections are being throttled
+
+    If you observe performance issues or connection throttling with async APIs, consider the following:
+    - Review the configured rate limits and quotas for the async API. Adjust the limits if necessary to accommodate the expected traffic.
+    - Monitor the resource utilization of the Tyk Gateway instances and the event broker. Ensure that there is sufficient capacity to handle the load.
+    - Consider scaling the Tyk Gateway horizontally by adding more instances to distribute the traffic load.
+
+4. ##### What are best practices of using Tyk Streams
+
+    - Use meaningful and descriptive names for your async APIs, topics, and subscriptions to improve readability and maintainability.
+    - Implement proper security measures, such as authentication and authorization, to protect your async APIs and restrict access to authorized clients only.
+    - Set appropriate rate limits and quotas to prevent abuse and ensure fair usage of the async API resources.
+    - Monitor the performance and health of your async APIs using Tyk's built-in analytics and monitoring capabilities. Set up alerts and notifications for critical events.
+    - Version your async APIs to manage compatibility and enable seamless updates without disrupting existing clients.
+    - Provide comprehensive documentation for your async APIs, including details on message formats, schemas and example payloads, to assist developers in integrating with your APIs effectively.
+
+
+## Debugging Series 
+
+### MongoDB
+
+Tyk uses Mongo as a database to store much of its analytical data. This means if you have a dashboard instance that is down, there’s a high chance that this is because of either Mongo being down or an issue with your dashboard connecting to Mongo.
+
+Here, we'll outline the following:
+
+ - How to isolate Mongo as the root of the error
+ - The steps to take to help stop your system from going down.
+
+1. ##### Isolating Mongo as the fault
+
+    Here are a few ways to identify Mongo as the source of the problem:
+
+    1. Analytics is not showing up on the dashboard
+    2. When hitting the `/hello` endpoint, the dashboard is down
+    3. The Mongo database size is hitting hardware resource limits.
+
+2. ##### Mongo status
+
+    Similarly to Tyk, Mongo has a health check that we can run to get the status of our Mongo instance. This should be a starting point for debugging Mongo (depending on which system):
+
+    - `Sudo systemctl status mongod` or `sudo service mongodb status`
+    - Logs under `/var/log/mongo/mongo.log` should also outline any outage
+
+3. ##### Mongo version
+
+    Does Tyk support the version of Mongo that you’re using? Read more about that [here](/planning-for-production/database-settings#mongodb).
+
+4. ##### Capped collections
+
+    Suppose a Mongo instance runs over a long period in addition to a lot of traffic in a Tyk system. In that case, the chances of the collections growing out of control are very real - especially the `tyk_analytics` collections.
+
+    In some cases, `enable_detailed_logging: true` adds fuel to the fire, as this parameter should only be set temporarily during debugging. This configuration exists on the gateway and the API levels, so ensure this is off after debugging.
+
+    We advise everyone to cap every collection in Mongo, as this prevents collections from growing out of control and bringing your dashboard down by hitting resource limits.
+
+    You can determine each collection's cap size by visiting our [MongoDB sizing calculator](/planning-for-production/database-settings#mongodb-sizing-guidelines).
+
+    Here’s more information on how and why you want to [cap your collections](https://www.mongodb.com/docs/manual/core/capped-collections/).
+
+5. ##### Size caps versus TTL-capped collections
+
+    Are you trying to decide between capping your collections or by size? It depends on a couple of factors. Ultimately, both settings will get rid of older data, so it’s based on how far back you need to view it.
+
+    Assuming you only need data for a few days, then using a TTL will be the best route, as it will only allow your collections to grow that wild over a short period.
+
+    Alternatively, if you care about how big the collections grow and want to see longer-lived data, then capping by size is your best direction. This will limit the collection to developing within a controlled resource limit. And in the context of aggregate analytics, this collection will hold data for long periods.
+
+    One thing to note here is that if you head down the TTL route, and if your environment has A LOT of traffic, then your collections can grow wild and fast, while a size-capped collection will always stay within a known size limit.
+
+6. ##### Handling overgrown, uncapped collections
+
+    There are three ways to do this:
+
+    1. The first method is to delete (drop) the collection and create a new collection with a cap (commands below).
+
+    ```bash
+    # This will drop a collection. When using this, cached data will not be deleted.
+    db.<collection_name>.drop()
+    ```
+
+    ```bash
+    #  Can use the below call. Drops the collection and removes any cache data
+    db.<collection_name>.remove()
+    ```
+
+    2. The second method is to rename the collection to a random name and then create a new collection with a cap. Then restart Mongo with a larger size (we do this because the overgrown collections still exist). This is to confirm that the collection size grew too large and dropped the Mongo connection. The renaming also helps conserve the existing data if you still need it (but it will be useless in the background unless you attempt the third method).
+
+    3. The third method is to delete (deleteMany() call below) the old data to trim down their collection size. Then, you can restart your instance to see if the connection goes up again.
+
+    ```bash
+    # Will delete data off a collection that does NOT have a cap. Otherwise, it will throw an error.
+    db.<collection_name>.deleteMany()
+    ```
+
+7. ##### Secure Mongo connection
+
+    You will use a secured connection to your Mongo instance in most production cases. Here are a few things to consider:
+
+    - Verify there isn’t a network issue that stops your dashboard from connecting to Mongo. You can do this by hitting the dashboard server from your Mongo server (or vice versa)
+
+    - Validate certificate and `.pem` files
+
+    - Connect (command below) to Mongo with certificates
+
+    ```bash
+    # Replace the above files with the correct parameters (proper file paths and host).
+    mongo --ssl --sslCAFile /opt/mongodb/ssl/ca.pem --sslPEMKeyFile /opt/mongodb/ssl/mongodb.pem --host 127.0.0.1
+    ```
+    - Verify Pump has the correct parameters to include your certificates
+
+    - Verify your dashboard has the correct parameters relative to your environment:
+
+    ```json
+    "mongo_url": "mongodb://localhost/tyk_analytics",
+    "mongo_use_ssl": true,
+    "mongo_ssl_ca_file": "/opt/mongodb/ssl/ca.pem",
+    "mongo_ssl_pem_keyfile": "/opt/mongodb/ssl/mongodb.pem",
+    "mongo_ssl_insecure_skip_verify": true
+    ```
+
+8. ##### How to Cap analytics data storage
+
+    What methods are available to enable me to manage my MongoDB analytics storage?
+
+    [TTL Indexes](/api-management/dashboard-analytics/analytics-storage-management#ttl-indexes)
+
+    [Capped Collections](/api-management/dashboard-analytics/analytics-storage-management#capped-collections)
+
+    
+
+    <Note>
+    Time based caps (TTL indexes) are incompatible with already configured size based caps.
+    </Note>
+
+
+    
+<Note>
+If you are using DocumentDB, capped collections are not supported. See [here](https://docs.aws.amazon.com/documentdb/latest/developerguide/mongo-apis.html) for more details.
+</Note>
+
+
+9. ##### MongoDB X.509 Client Authentication
+
+    You can use the *MongoDB X509 Certificate* flow to authenticate the *Tyk Dashboard*, *Tyk Pump*, and *Tyk MDCB* with your *MongoDB* install.  This is slightly different from AWS DocumentDB setup instructions.
+
+    Before we get into the configuration, we need to understand the two key components: connection strings and certificates.
+
+    1. **Connection Strings**
+
+        1) You must specify a username (and password if needed) in the connection string.  [Why do you need a username at all?](https://docs.mongodb.com/manual/tutorial/configure-x509-client-authentication/)
+
+        2) We must specify the following parameters: `?authSource=$external&authMechanism=MONGODB-X509"`
+
+        **An example of a connection string would be:**
+
+        ```bash
+        "mongodb://CN=tyk-mongo-client,OU=TykTest@<host>:<port>/<db>?authSource=$external&authMechanism=MONGODB-X509"
+        ```
+
+        ##### Passwords
+        If you have to include a password, you can do it after the username in basic auth format:
+
+        ```bash
+        "mongodb://CN=tyk-mongo-client,OU=TykTest,O=TykTest:mypassword@<host>:<port>/<db>?authSource=$external&authMechanism=MONGODB-X509"
+        ```
+
+        ##### URL Encoding Protected Characters
+        Note that you must URL encode the `:` character into `%40`.   So replace any `:` in the username field into the URL encoded version.
+
+    2. **Certificates**
+
+        You'll need to provide two certificates to complete the X509 Client Authentication:
+
+        **CA Cert** containing just the public key of the Certificate Authority (CA).
+
+        **Client Cert** containing both the public and private keys of the client.
+
+    ##### Configuration
+
+    Here's what it looks like all put together:
+
+    1. **Tyk Dashboard**
+
+        Your `tyk_analytics.conf` should include these fields at the root level:
+
+        ```json
+        {
+        ...
+        "mongo_url": "mongodb://<username>@<host>:<port>/<db>?authSource=$external&authMechanism=MONGODB-X509",
+        "mongo_use_ssl": true,
+        "mongo_ssl_ca_file": "ca.pem",
+        "mongo_ssl_pem_keyfile": "client.pem"
+        }
+        ```
+
+        | Config File           | Environment Variable | Type   | Examples
+        | ---                   | --                   | ----   | ---- |
+        | "mongo_url"                       | TYK_DB_MONGOURL      | string | "mongodb://{username}@{host}:{port}/{db}?authSource=$external&authMechanism=MONGODB-X509" |
+        | "mongo_use_ssl"                   | TYK_DB_MONGOUSESSL      | bool | true, false |
+        | "mongo_ssl_ca_file"               | TYK_DB_MONGOSSLCAFILE      | string | "certificates/ca.pem" |
+        | "mongo_ssl_pem_keyfile"           | TYK_DB_MONGOSSLPEMKEYFILE      | string | "certificates/key.pem" |
+        | "mongo_ssl_insecure_skip_verify"  | TYK_DB_MONGOSSLINSECURESKIPVERIFY      | bool | true, false |
+        | "mongo_ssl_allow_invalid_hostnames" | TYK_DB_MONGOSSLALLOWINVALIDHOSTNAMES      | bool | true, false |
+        | "mongo_session_consistency"       | TYK_DB_MONGOSESSIONCONSISTENCY      | string | "strong", "eventual", or "monotonic". default is "strong" |
+        | "mongo_batch_size"                | TYK_DB_MONGOBATCHSIZE      | int | Default "2000", min "100" |
+
+    2. **Tyk Pump**
+
+        Tyk offers three different MongoDB pumps (`mongo`, `mongo_aggregate`, and `mongo_selective`), each of which must be separately configured for X509 certificate authentication. 
+
+        The following fields must be set under the `meta` section of each pump (or set as environment variable):
+
+        ```yaml
+        { 
+        ...
+        "pumps": {
+            "mongo": {
+            "type": "mongo",
+            "meta": {
+                "collection_name": "tyk_analytics",
+                "mongo_url": "mongodb://CN=tyk-mongo-client,OU=TykTest@<host>:<port>/<db>?authSource=$external&authMechanism=MONGODB-X509",
+                "mongo_use_ssl": true,
+                "mongo_ssl_ca_file": "ca.pem",
+                "mongo_ssl_pem_keyfile": "client.pem"
+            }
+            }
+        }
+        }
+        ```
+
+        In addition to the other configs, these are the ones related to MongoDB:
+
+        | Config File           | Type  | Examples
+        | -- | -- | --
+        "mongo_url" | string     | "mongodb://{username}@{host}:{port}/{db}?authSource=$external&authMechanism=MONGODB-X509" |   
+        "mongo_use_ssl" | bool | true, false |
+        "mongo_ssl_ca_file" | string      | "certificates/ca.pem" |  
+        “mongo_ssl_pem_keyfile" | string     | "certificates/key.pem" |     
+        "mongo_ssl_insecure_skip_verify" | bool     | true, false |     
+        "mongo_ssl_allow_invalid_hostnames" | bool         | true, false | 
+
+    3. **Tyk MDCB**
+
+        As of Tyk MDCB v1.8.0, you have been able to secure Tyk MDCB with MongoDB using X509 Certificate Authentication flow.
+
+        The config settings are exactly the same as the Tyk Dashboard steps, just nested one level deeper:
+
+        **Example Config:**
+        ```json
+        {
+        ...
+        "analytics": {
+            "mongo_url": "mongodb://CN=tyk-mongo-client,OU=TykTest@<host>:<port>/<db>?authSource=$external&authMechanism=MONGODB-X509",
+            "mongo_use_ssl": true,
+            "mongo_ssl_ca_file": "ca.pem",
+            "mongo_ssl_pem_keyfile": "client.pem"
+        }
+        }
+        ```
+        | Config File           | Environment Variable | Type   | Examples
+        | ---                   | --                   | ----   | ---- |
+        "analytics.mongo_url" | TYK_MDCB_ANALYTICSCONFIG_MONGOURL | string   |  "mongodb://{username}@{host}:{port}/{db}?authSource=$external&authMechanism=MONGODB-X509"
+        "analytics.mongo_use_ssl" | TYK_MDCB_ANALYTICSCONFIG_MONGOUSESSL | bool | true, false |
+        "analytics.mongo_ssl_ca_file" | TYK_MDCB_ANALYTICSCONFIG_MONGOSSLCAFILE | string |  "certificates/ca.pem" |
+        "analytics.mongo_ssl_pem_keyfile" | TYK_MDCB_ANALYTICSCONFIG_MONGOSSLPEMKEYFILE | string | "certificates/key.pem" |
+        "analytics.mongo_ssl_insecure_skip_verify" | TYK_MDCB_ANALYTICSCONFIG_MONGOSSLINSECURESKIPVERIFY | bool | true, false |
+        "analytics.mongo_ssl_allow_invalid_hostnames" | TYK_MDCB_ANALYTICSCONFIG_MONGOSSLALLOWINVALIDHOSTNAMES | bool  | true, false |
+        "analytics.mongo_session_consistency" | TYK_MDCB_ANALYTICSCONFIG_MONGOSESSIONCONSISTENCY | string |  "strong", "eventual", or "monotonic". default is "strong" |
+        "analytics.mongo_batch_size" |  TYK_MDCB_ANALYTICSCONFIG_MONGOBATCHSIZE | int |  Default "2000", min "100" |
+
+### Tyk Self-Managed
+
+This guide should help a user of Tyk Self-Managed in debugging common issues. A helpful way to go about this is by:
+
+1. Isolating your components to see where the error is coming from
+2. Enabling debug logs to ensure you get all the information you need
+
+1. ##### Gateway `/hello` endpoint
+
+    Querying the gateway's `/hello` health endpoint is the quickest way to determine the status of your Tyk instance. You can find more information in our docs about the [Gateway Liveness health check](/planning-for-production/ensure-high-availability/health-check).
+
+    This endpoint is important as it allows the user to isolate the problem's origin. At a glance, the `/hello` endpoint reports the Gateways connectivity to Redis, and the control plane components eg. Tyk Dashboard, Tyk Multi-Data Center Bridge (MDCB), and Tyk Cloud. 
+
+    ```json
+    {
+        "status": "pass",
+        "version": "v5.0",
+        "description": "Tyk GW",
+        "details":{
+            "dashboard":{
+                "status": "pass",
+                "componentType": "system",
+                "time": "2023-01-13T14:45:00Z"
+                },
+            "redis":{
+                "status": "pass",
+                "componentType": "datastore",
+                "time": "2023-01-13T14:45:00Z"
+                }
+            },
+            "rpc": {
+                "status": "pass",
+                "componentType": "system",
+                "time": "2023-01-13T14:45:00Z"
+            }
+    }
+    ```
+
+    If the Dashboard or RPC connectivity fails (control plane components), the Gateway will still function based on the last received configurations from those components. However, if Redis fails, Gateway will go down since it is a hard dependency.
+
+#### Debug Logs
+
+Setting the log level to debug will allow for more descriptive logs that will give a better context around any issue you might be facing. For example, here are the different outputs you receive when calling an Open Keyless API with `info` and `debug` log-level modes.
+
+Here is the output when using `info` as the log level:
+
+```bash
+tyk-pump       | time="Jan 24 14:39:19" level=info msg="Purged 1 records..." prefix=mongo-pump
+tyk-pump       | time="Jan 24 14:39:19" level=info msg="Purged 1 records..." prefix=mongo-pump-selective
+tyk-mongo      | 2023-01-24T14:39:19.228+0000 I  NETWORK  [listener] connection accepted from 172.20.0.2:51028 #19 (19 connections now open)
+tyk-pump       | time="Jan 24 14:39:19" level=info msg="Completed upserting" collection="tyk_analytics_aggregates" prefix=mongo-pump-aggregate
+tyk-pump       | time="Jan 24 14:39:19" level=info msg="Purged 1 records..." prefix=mongo-pump-aggregate
+```
+
+Here is a more detailed output of the same call when using `debug` as the log level:
+
+```bash
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Started proxy"
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Stripping proxy listen path: /api1/"
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Upstream path is: /get"
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg=Started api_id=63666619de884d0563ee3ccc67d57929 api_name=api1 mw=ReverseProxy org_id=63ca963f6888c7000191890e ts=1674570739659369736
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Upstream request URL: /get" api_id=63666619de884d0563ee3ccc67d57929 api_name=api1 mw=ReverseProxy org_id=63ca963f6888c7000191890e
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Outbound request URL: http://httpbin.org/get" api_id=63666619de884d0563ee3ccc67d57929 api_name=api1 mw=ReverseProxy org_id=63ca963f6888c7000191890e
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Creating new transport" api_id=63666619de884d0563ee3ccc67d57929 api_name=api1 mw=ReverseProxy org_id=63ca963f6888c7000191890e
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Out request url: http://httpbin.org/get" api_id=63666619de884d0563ee3ccc67d57929 api_name=api1 mw=ReverseProxy org_id=63ca963f6888c7000191890e
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Request is not cacheable" mw=ResponseCacheMiddleware
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg=Finished api_id=63666619de884d0563ee3ccc67d57929 api_name=api1 mw=ReverseProxy ns=316559477 org_id=63ca963f6888c7000191890e
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Upstream request took (ms): 316.639871"
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Checking: 63ca963f6888c7000191890e" api_id=63666619de884d0563ee3ccc67d57929 api_name=api1 org_id=63ca963f6888c7000191890e
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="no cached entry found, returning 7 days" api_id=63666619de884d0563ee3ccc67d57929 api_name=api1 org_id=63ca963f6888c7000191890e
+tyk-gateway    | time="Jan 24 14:32:19" level=debug msg="Done proxy"
+tyk-pump       | time="Jan 24 14:32:20" level=info msg="Purged 0 records..." prefix=mongo-pump-aggregate
+tyk-pump       | time="Jan 24 14:32:20" level=info msg="Purged 1 records..." prefix=mongo-pump-selective
+tyk-pump       | time="Jan 24 14:32:20" level=info msg="Completed purging the records" collection="tyk_analytics" number of records=1 prefix=mongo-pump
+tyk-pump       | time="Jan 24 14:32:20" level=info msg="Purged 1 records..." prefix=mongo-pump
+tyk-mongo      | 2023-01-24T14:32:20.398+0000 I  NETWORK  [listener] connection accepted from 172.20.0.3:54712 #19 (19 connections now open)
+tyk-pump       | time="Jan 24 14:32:20" level=info msg="Completed upserting" collection="tyk_analytics_aggregates" prefix=mongo-pump-aggregate
+tyk-pump       | time="Jan 24 14:32:20" level=info msg="Purged 1 records..." prefix=mongo-pump-aggregate
+
+```
+
+As shown above, the `debug` log level mode provides more information which will help during your debugging stage, i.e when the API call was started, when it was finished, how long it took for the call to finish, the endpoint that was called, the upstream that was called, the organization that the API belongs to, and more.
+
+1. ##### Gateway Debug Settings
+
+    If you’re using a `*.conf` for your configuration parameters:
+
+    ```json
+    "log_level": "debug"
+    ```
+
+    If you’re using environment variables for your configuration:
+
+    ```bash
+    TYK_GW_LOGLEVEL=debug
+    ```
+
+    If you're using Tyk Helm Charts. Add the following items to your `values.yaml`:
+
+    ```yaml
+    extraEnvs:
+    - name: TYK_LOGLEVEL
+        value: debug
+    ```
+
+2. ##### Dashboard Debug Settings
+
+    If you’re using a `*.conf` for your configuration parameters:
+
+    ```json
+    "log_level": "debug"
+    ```
+
+    If you’re using environment variables for your configuration:
+
+    ```
+    TYK_LOGLEVEL=debug
+    ```
+
+    If you're using Tyk Helm Charts. Add the following items to your `values.yaml`:
+
+    ```yaml
+    extraEnvs:
+    - name: TYK_LOGLEVEL
+        value: debug
+    ```
+
+    You can find the full [log levels](/api-management/logs/application-logs) in our documentation.
+
+#### Versions
+
+You can access all Tyk release information on the [release notes](/developer-support/release-notes/overview) overview page.
+
+We recommend always using the [Long-Term Support (LTS) release](/developer-support/release-types/long-term-support) for stability and long term support.
+
+##### Non-LTS versions
+Tyk is backwards compatible, upgrading to newer versions won't turn on new features or change the behavior of your existing environment.
+
+For the best experience when experimenting with Tyk and exploring its latest capabilities, you can use our latest version. You can access all Tyk releases on the [release notes summary](/developer-support/release-notes/overview) page. 
+
+#### Dashboard
+
+The Dashboard front-end (GUI included) uses [Tyk Dashboard API](/tyk-dashboard-api) to retrieve data to display or update. This means you can use the [developer tools on your browser](https://developer.mozilla.org/en-US/docs/Learn/Common_questions/Tools_and_setup/What_are_browser_developer_tools) to access the API and its information. Looking into the API details, the URL, the headers, the payload and the response can help you investigate the source of the issue and replicate it with API calls using an HTTP client such as [cURL](https://curl.se/) or [Postman](https://www.postman.com/).
+As a next step to this investigation, if that specific endpoint exists also in [Tyk Gateway API](/tyk-gateway-api), you can compare the responses from both gateway and dashboard requests. 
+
+##### Isolating
+
+As mentioned above, errors can happen in any of the components of your Tyk deployment, and as such, one of the critical things you'll pick up during your debugging phase is isolating these environments.
+
+##### Dashboard Level
+
+When debugging an issue, in order to isolate the gateway from the Dashboard, try to call the same API ednpoint on both Tyk Dashboard and Tyk Gateway 
+If it works with the gateway API only, then the issue is likely to be in the Dashboard. It could be that you need to set in the Dashboard some [configuration parameters](/tyk-dashboard/configuration) (using the config file or via environment variables).
+
+##### Gateway or API level
+
+Are you making calls against your gateway or API, and it's not working? Try isolating the gateway from everything else. Often you'll see that the gateway or API aren't at fault and that it's something else; it can be the load balancer you have in your environment blocking the call from ever reaching it.
+
+In the case of the API error-ing out, you can also isolate it by:
+
+- Creating a generic Httpbin API and calling it
+    - If this works, then the API configuration or the backend is at fault
+- Changing the target URL of the API
+    - The upstream API can be at fault
+- Assuming your API has a plugin, take away the plugin and test the API
+    - The error most likely exists in the plugin
+- If the error exists in your plugin, try taking out certain parts of the code and testing it with minimal logic
+    - This means that part of your code with integrated logic is incorrect
+- Is the target URL the same in another one of your APIs?
+    - The gateway sees the API as duplicated and changes the new target URL causing the gateway to error.
+
+You will eventually hit the point of error by further isolating parts of your API.
+
diff --git a/api-management/tyk-pump.mdx b/api-management/tyk-pump.mdx
new file mode 100644
index 0000000000..b12189318a
--- /dev/null
+++ b/api-management/tyk-pump.mdx
@@ -0,0 +1,449 @@
+---
+title: "Tyk Pump"
+description: "Install and configure Tyk Pump, the component that moves analytics data out of Redis to persistent storage and external systems."
+keywords: "Tyk Pump, Analytics, Redis, MongoDB, SQL, Configuration"
+sidebarTitle: "Tyk Pump"
+---
+
+## What Is Tyk Pump?
+
+Tyk Gateway writes a [traffic log](/api-management/logs/traffic-logs), a structured record of the request and response, for every API call it processes, into Redis. Redis is a temporary, high-throughput buffer, not a long-term store, so something has to move those traffic logs out before they expire.
+
+Tyk Pump is the [open source](https://github.com/TykTechnologies/tyk-pump) component that does this. It reads traffic logs out of Redis and writes them to one or more configured destinations, which Tyk calls pumps. Each pump has a type, such as `mongo` or `sql`, from the [Pump Type Catalog](#pump-type-catalog) below: depending on the type, it can forward traffic logs unaltered, or compute aggregated analytics or metrics from them. A single Tyk Pump process can run several pumps at once, so the same traffic data can be sent to multiple destinations in parallel.
+
+<Note>
+For new integrations, we recommend [OpenTelemetry tracing](/api-management/traces), since it gives you richer per-request detail without the Redis and Tyk Pump hop, and [OpenTelemetry metrics](/api-management/logs-metrics#opentelemetry-metrics) instead.
+</Note>
+
+**A Note on Terminology**
+
+Throughout this documentation, "Tyk Pump" (capitalized) always refers to the component itself. "A pump" or "pump type" refers to one of its configured destinations, such as the `mongo` or `hybrid` pump type.
+
+
+Tyk Pump serves four distinct outcomes, covered in full elsewhere in the documentation:
+
+- **Populating Tyk Dashboard's built-in Traffic Analytics UI and Log Browser.** These have no other source of data. This is the primary, ongoing purpose of Tyk Pump. See [Dashboard Analytics](/api-management/dashboard-analytics).
+- **Forwarding traffic logs, unaltered, to external systems** such as Splunk or Datadog. See [External Data Sinks](/api-management/logs/external-data-sinks).
+- **Exposing metrics derived from traffic logs** to Prometheus, StatsD, or DogStatsD. See [Metrics Pumps](/api-management/metrics/metrics-pumps).
+- **Storing the results of Tyk Gateway's own uptime tests**, periodic health checks against upstream hosts, for Tyk Dashboard's separate Uptime Tests reporting screen. Unlike the other three, the dedicated uptime pump doesn't work with traffic log data. See [Uptime Tests](/planning-for-production/ensure-high-availability/uptime-tests#monitoring-uptime-tests-in-tyk-dashboard).
+
+This page covers what applies to Tyk Pump regardless of which of those goals you're pursuing: installation, the shape of `pump.conf`, and the full catalog of available pump types.
+
+<Note>
+Tyk Pump is not configurable in Tyk Cloud.
+</Note>
+
+
+## Architecture
+
+The architecture differs depending on your deployment model:
+
+<Tabs>
+<Tab title="Enterprise">
+
+<img src="/img/diagrams/tyk-selfmanaged-architecture-pump.png" alt="Tyk Enterprise Pump Architecture" />
+
+</Tab>
+<Tab title="Open Source">
+
+<img src="/img/diagrams/diagram_docs_pump-open-source@2x.png" alt="Tyk Open Source Pump Architecture" />
+
+</Tab>
+</Tabs>
+
+Tyk Pump is flexible: you can run multiple pumps in a single instance to write the same traffic data to several destinations at once. It's also scalable, both horizontally and vertically.
+
+The figure below shows each Tyk Pump instance ("1", "2", and "n") running two pumps concurrently, labeled Pump Backend (i) and (ii), with `pump_type: "mongo"` and `pump_type: "elasticsearch"` respectively.
+
+| <img src="/img/diagrams/diagram_docs_pump-configuration-multi-backend.png" alt="Configuration and Scaling of Tyk Pump" />  |
+| :-- |
+| Figure 1: An architecture diagram illustrating horizontal scaling of "n" instances of Tyk Pump, each running two pumps. |
+
+Tyk Pump can be horizontally scaled without causing duplicate data, provided your configuration follows one of the supported combinations below:
+
+| Configuration | Supported |
+| :-- | :-------: |
+| Single pump instance, single backend | ✅ |
+| Single pump instance, multiple backends | ✅ |
+| Multiple pump instances, same backend(s) | ✅ |
+| Multiple pump instances, different backend(s) | ❌ |
+
+You can apply filters to control which records go to which destination: see [Sharding Analytics to Different Data Sinks](#sharding-analytics-to-different-data-sinks).
+
+## Installing Tyk Pump
+
+Tyk Pump is installed as part of a Tyk Self-Managed or Tyk Open Source deployment. See the [Tyk Self-Managed installation options](/tyk-self-managed/install) or [Tyk Open Source installation](/apim/open-source/installation) for platform-specific instructions (Docker, Kubernetes, Linux packages).
+
+Set the `TYK_PMP_OMITCONFIGFILE` environment variable to omit `pump.conf` entirely and configure Tyk Pump purely from environment variables. This is particularly useful in Docker, since the Tyk Pump image ships with a default configuration file with pre-loaded pumps.
+
+## Configuring Tyk Pump
+
+Tyk Pump is configured through a JSON file, conventionally called `pump.conf`, or through equivalent environment variables:
+
+```json
+{
+  "analytics_storage_type": "redis",
+  "analytics_storage_config": { ... },
+  "purge_delay": 1,
+  "purge_chunk": 0,
+  "storage_expiration_time": 60,
+  "log_level": "info",
+  "log_format": "text",
+  "health_check_endpoint_name": "health",
+  "health_check_endpoint_port": 8083,
+  "enable_http_profiler": false,
+  "statsd_connection_string": "",
+  "statsd_prefix": "",
+  "max_record_size": 0,
+  "uptime_pump_config": { ... },
+  "dont_purge_uptime_data": false,
+  "pumps": { ... }
+}
+```
+
+<Note>
+For the full field-by-field reference, environment variable names, and default values for every pump type, see the [Tyk Pump configuration reference](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables). For the fields contained in a traffic log itself, see [Traffic Log Field Reference](/api-management/logs/traffic-logs#traffic-log-field-reference).
+</Note>
+
+### Connecting to Redis
+
+`analytics_storage_config` is the Redis instance Tyk Pump reads traffic logs from, the same Redis that Tyk Gateway writes to. For single-node, Cluster, and Sentinel configuration, connection pool tuning, and TLS, see [Configure Redis](/tyk-configuration-reference/redis-cluster-sentinel), which covers Tyk Gateway, Tyk Dashboard, and Tyk Pump together.
+
+### Purge Configuration
+
+```json
+{
+  "purge_delay": 1,
+  "purge_chunk": 0,
+  "storage_expiration_time": 60
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `purge_delay` | `1` | Seconds Tyk Pump waits between checking Redis for new analytics data and purging it. |
+| `purge_chunk` | Unset (all in one pass) | Maximum traffic logs to pull from Redis at a time. If set, `storage_expiration_time` is used to reset the traffic log's TTL instead. |
+| `storage_expiration_time` | `60` seconds | TTL applied to traffic logs in Redis. Only takes effect if `purge_chunk` is set. |
+
+### Logging and Health Checks
+
+```json
+{
+  "log_level": "info",
+  "log_format": "text",
+  "health_check_endpoint_name": "health",
+  "health_check_endpoint_port": 8083,
+  "enable_http_profiler": false
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `log_level` | `info` | `info`, `debug`, `error`, or `warn`. |
+| `log_format` | `text` | `text`, `json`, or `legacy`. From Tyk Pump 1.16.0, `text` and `json` use RFC3339 timestamps and map the `msg` field to `message`; `legacy` preserves the previous timestamp format and field names. |
+| `health_check_endpoint_name` | `health` | Path for the HTTP health check endpoint. |
+| `health_check_endpoint_port` | `8083` | Port for the HTTP health check endpoint. Returns `{"status": "ok"}` with a `200` response while Tyk Pump is running. |
+| `enable_http_profiler` | `false` | Exposes Go profiling information to support debugging, the same way as [Tyk Gateway](/api-management/troubleshooting-debugging). |
+
+### Instrumentation
+
+```json
+{
+  "statsd_connection_string": "",
+  "statsd_prefix": ""
+}
+```
+
+`statsd_connection_string` and `statsd_prefix` configure Tyk Pump to send its own operational metrics to a StatsD server, separate from any traffic-derived metrics sent by the [`statsd`/`dogstatsd` Metrics Pumps](/api-management/metrics/metrics-pumps). Only takes effect when `TYK_INSTRUMENTATION=1` is set. See [Configuring StatsD](/api-management/logs-metrics#configuring-statsd) for details.
+
+### Uptime Test Results
+
+```json
+{
+  "uptime_pump_config": { ... },
+  "dont_purge_uptime_data": false
+}
+```
+
+`uptime_pump_config` stores the results of Tyk Gateway's own uptime tests, periodic health checks against upstream hosts. It's unrelated to traffic logs and configured independently of `pumps`. See [Uptime Tests](/planning-for-production/ensure-high-availability/uptime-tests#monitoring-uptime-tests-in-tyk-dashboard) for configuration.
+
+<Warning>
+`dont_purge_uptime_data` defaults to `false`, which starts an Uptime Pump on every Tyk Pump launch, even if you haven't configured a real `uptime_pump_config` target. If it can't connect to a persistent store, **Tyk Pump exits immediately, taking down every other pump in that instance too.**
+
+**Set `dont_purge_uptime_data: true` if you're not using the Uptime Pump.**
+</Warning>
+
+### Declaring Pumps
+
+At least one pump must be configured in the `pumps` object:
+
+```json
+{
+  "pumps": {
+    "<pump-name>": {
+      "type": "<pump-type>",
+      "meta": {
+        ...
+      },
+      ...
+    }
+  }
+}
+```
+
+`<pump-name>` is more than a label: it's also the environment variable prefix for that pump, `TYK_PMP_PUMPS_<PUMP-NAME>_`. For example, naming a pump `PROD` lets you configure it with `TYK_PMP_PUMPS_PROD_TYPE`, `TYK_PMP_PUMPS_PROD_META_...`, and so on, whether or not it's also declared in `pump.conf`. If you omit `type` from the JSON block entirely, Tyk Pump also falls back to using `<pump-name>` itself as the type.
+
+Beyond that, `<pump-name>` is logged once, when Tyk Pump starts up, and then dropped: at runtime, warnings, errors, and metrics identify a pump by its type's display name (for example, "Mongo Pump"), not by this name. If you run multiple instances of the same type, choose names that help you tell them apart in configuration, but expect their ongoing logs to look identical.
+
+The `type` is selected from the [Pump Type Catalog](#pump-type-catalog) and determines the specific `meta` configuration; there is also [common configuration](#common-pump-settings) that is applicable to all pump types.
+
+## Common Pump Settings
+
+Every pump entry accepts the following settings, alongside its `type` and `meta`:
+
+```json
+{
+  "pumps": {
+    "<pump-name>": {
+      "type": "<pump-type>",
+      "meta": {
+        ...
+      },
+      "filters": {
+        ...
+      },
+      "timeout": 0,
+      "omit_detailed_recording": false,
+      "max_record_size": 0,
+      "ignore_fields": [],
+      "raw_request_decoded": false,
+      "raw_response_decoded": false
+    }
+  }
+}
+```
+
+| Field | Description |
+| :-- | :-- |
+| `type` | Selects the pump type to use, from the [Pump Type Catalog](#pump-type-catalog) below. |
+| `meta` | Pump-type-specific settings. |
+| `filters` | Restricts which records this pump receives, by API, Organisation, or response code. See [Sharding Analytics to Different Data Sinks](#sharding-analytics-to-different-data-sinks). |
+| `timeout` | Maximum time to wait for a write to complete, in seconds. Defaults to `0` (wait indefinitely). See [Pump Timeout](#pump-timeout). |
+| `omit_detailed_recording` | Excludes the `raw_request` and `raw_response` fields from this pump's records. See [Omit Detailed Recording](#omit-detailed-recording). |
+| `max_record_size` | Caps the size, in bytes, of the `raw_request` and `raw_response` fields. See [Max Record Size](#max-record-size). |
+| `ignore_fields` | Excludes specific traffic log fields from this pump's records. See [Ignore Fields](#ignore-fields). |
+| `raw_request_decoded` / `raw_response_decoded` | Base64-decodes the raw request or response before writing. See [Decode Raw Request and Raw Response](#decode-raw-request-and-raw-response). |
+
+### Sharding Analytics to Different Data Sinks
+
+In a multi-Organisation deployment, each Organisation, team, or environment might have a preferred destination. The `filters` field, available on every pump, lets you control which records are sent to which pump using an allowlist and a blocklist:
+
+```json
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+
+- `api_ids`, `org_ids`, and `response_codes` act as an allowlist: only matching records are sent to this pump.
+- `skip_api_ids`, `skip_org_ids`, and `skip_response_codes` act as a blocklist: matching records are never sent to this pump.
+- The blocklist always takes priority over the allowlist.
+
+For example, this configuration sends all analytics for `org1` and `org2` to a CSV file, and everything except `api_id_1` to Elasticsearch:
+
+```json
+"csv": {
+  "type": "csv",
+  "filters": {
+    "org_ids": ["org1", "org2"]
+  },
+  ...
+},
+"elasticsearch": {
+  "type": "elasticsearch",
+  "filters": {
+    "skip_api_ids": ["api_id_1"]
+  },
+  ...
+}
+```
+
+### Pump Timeout
+
+By default, Tyk Pump waits indefinitely for each write operation to complete (`timeout: 0`). You can configure an optional `timeout`, in seconds, per pump:
+
+```json
+"mongo": {
+  "type": "mongo",
+  "timeout": 5,
+  ...
+}
+```
+
+If a pump's write operation takes longer than the [purge loop interval](#purge-configuration) (`purge_delay`) and no timeout is configured, Tyk Pump logs: `Pump PMP_NAME is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If a timeout is configured and the pump is still falling behind, it logs: `Pump PMP_NAME is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`
+
+### Omit Detailed Recording
+
+`omit_detailed_recording`, set on a pump, stops that pump from writing the `raw_request` and `raw_response` fields for every record. Defaults to `false`.
+
+### Max Record Size
+
+`max_record_size` caps the size, in bytes, of the `raw_request` and `raw_response` fields written by a pump. Defaults to `0` (unlimited). Set it at the top level of `pump.conf` to apply a default to every pump:
+
+```json
+{
+  "max_record_size": 1000,
+  "pumps": { ... }
+}
+```
+
+Or set it on a specific pump instead, which takes precedence over the global default for that pump only:
+
+```json
+"csv": {
+  "type": "csv",
+  "max_record_size": 1000,
+  ...
+}
+```
+
+### Ignore Fields
+
+`ignore_fields` lists fields, by JSON tag, to exclude when a pump writes its record. Useful for keeping sensitive or unneeded data out of a specific destination:
+
+```json
+"csv": {
+  "type": "csv",
+  "ignore_fields": ["api_id", "api_version"],
+  ...
+}
+```
+
+### Decode Raw Request and Raw Response
+
+When [detailed recording](/api-management/logs/traffic-logs#detailed-recording) is configured in Tyk Gateway, the full request and response will be base64-encoded and stored in the [`raw_request`](/api-management/logs/traffic-logs#param-raw-request) and [`raw_response`](/api-management/logs/traffic-logs#param-raw-response) fields respectively in the traffic log.
+
+The pump can optionally remove the base64-encoding before writing the record to the target, which avoids the need for post-processing by your analytics package.
+
+Decoding of request and response are individually controlled using `raw_request_decoded` and `raw_response_decoded` (both default to `false`).
+
+```json
+"csv": {
+  "type": "csv",
+  "raw_request_decoded": true,
+  "raw_response_decoded": true
+  ...
+}
+```
+
+<Note>
+Do not decode the request and response data when transferring the unaggregated traffic logs to the control plane's persistent storage for Tyk Dashboard's Log Browser. The Dashboard automatically base64-decodes this data when displaying a record; if this decoding has already been performed by Tyk Pump, the result will be nonsense in the Log Browser display. Only decode for destinations that read the data directly, such as an external sink.
+</Note>
+
+## Pump Type Catalog
+
+Tyk Pump's pump types fall into three categories, each covered in more detail on its own page. Every pump type is configured the same way: an entry under `pumps` with a `type` and a `meta` block.
+
+<Note>
+This doesn't include the uptime pump, covered separately under [Uptime Test Results](#uptime-test-results) above.
+</Note>
+
+### Dashboard Analytics Pumps
+
+Dashboard Analytics pumps transfer, and in some cases aggregate, traffic logs to the persistent storage. Tyk Dashboard's Log Browser and Traffic Analytics screens require different data and hence separate pumps.
+
+When using a combined control and data plane deployment (such as with the `tyk-stack` chart), you only need [Control Plane Pumps](#control-plane-pumps). When using a distributed deployment with separate control and data planes, connected via Tyk MDCB, you also need a [Data Plane Pump](#data-plane-pump) to get the data to the control plane.
+
+#### Control Plane Pumps
+
+| Type | Purpose | Storage Type | Configuration |
+| :-- | :-- | :-- | :-- |
+| `mongo` | Log Browser | MongoDB | [Standard Mongo Pump](/api-management/dashboard-analytics/control-plane-pumps#standard-mongo-pump) |
+| `mongo-pump-selective` | Log Browser, split per Organisation | MongoDB | [Per-Organisation Mongo Pump](/api-management/dashboard-analytics/control-plane-pumps#per-organisation-mongo-pump) |
+| `mongo-pump-aggregate` | Traffic Analytics graphs | MongoDB | [Mongo Aggregate Pump](/api-management/dashboard-analytics/control-plane-pumps#mongo-aggregate-pump) |
+| `sql` | Log Browser | SQL | [Standard SQL Pump](/api-management/dashboard-analytics/control-plane-pumps#standard-sql-pump) |
+| `sql_aggregate` | Traffic Analytics graphs | SQL | [SQL Aggregate Pump](/api-management/dashboard-analytics/control-plane-pumps#sql-aggregate-pump) |
+| `mongo-graph` | GraphQL-specific traffic logs: types, fields, and errors requested | MongoDB | [Mongo GraphQL Pump](/api-management/dashboard-analytics/control-plane-pumps#mongo-graphql-pump) |
+| `sql-graph` | GraphQL-specific traffic logs: types, fields, and errors requested | SQL | [SQL GraphQL Pump](/api-management/dashboard-analytics/control-plane-pumps#sql-graphql-pump) |
+| `sql-graph-aggregate` | Aggregated GraphQL-specific analytics, mirroring `sql_aggregate` | SQL | [SQL GraphQL Aggregate Pump](/api-management/dashboard-analytics/control-plane-pumps#sql-graphql-aggregate-pump) |
+| `mongo-mcp` | MCP (Model Context Protocol) tool-call traffic logs, mirroring `mongo` | MongoDB | [Mongo MCP Pump](/api-management/dashboard-analytics/control-plane-pumps#mongo-mcp-pump) |
+| `mongo-mcp-aggregate` | Aggregated MCP-specific analytics, mirroring `mongo-pump-aggregate` | MongoDB | [Mongo MCP Aggregate Pump](/api-management/dashboard-analytics/control-plane-pumps#mongo-mcp-aggregate-pump) |
+| `sql-mcp` | MCP tool-call traffic logs, mirroring `sql` | SQL | [SQL MCP Pump](/api-management/dashboard-analytics/control-plane-pumps#sql-mcp-pump) |
+| `sql-mcp-aggregate` | Aggregated MCP-specific analytics, mirroring `sql_aggregate` | SQL | [SQL MCP Aggregate Pump](/api-management/dashboard-analytics/control-plane-pumps#sql-mcp-aggregate-pump) |
+
+<Note>
+Unlike Mongo, SQL has an aggregate GraphQL pump; there's no `mongo-graph-aggregate` equivalent.
+</Note>
+
+#### Data Plane Pump
+
+For separate control and data planes you must transfer the traffic logs from the data plane (where they are generated) to the control plane (where they are used by Tyk Dashboard). A `hybrid` pump should be deployed in each data plane to transfer the records to Tyk MDCB.
+
+| Type | Purpose | Configuration |
+| :-- | :-- | :-- |
+| `hybrid` | Forwards traffic logs, or aggregated analytics, from a data plane to Tyk MDCB | [Data Plane Pump](/api-management/dashboard-analytics/data-plane-pump) |
+
+As explained in the dedicated [Data Plane Pump](/api-management/dashboard-analytics/data-plane-pump) section, once data reaches Tyk MDCB, it must be transferred to the control plane's persistent storage via one of two options: Tyk MDCB's own built-in writer or a [Control Plane Pump](#control-plane-pumps): an ordinary Tyk Pump instance running one of the pump types listed above.
+
+<Note>
+The `hybrid` pump can create aggregated analytics from MCP proxy and standard REST API traffic logs, but cannot create aggregated analytics for GraphQL API traffic.
+</Note>
+
+### External Data Sink Pumps
+
+Forward traffic logs, unaltered, to external tools. Considered the legacy approach: for new integrations, use [OpenTelemetry tracing](/api-management/traces) instead.
+
+| Type | Description |
+| :-- | :-- |
+| [`csv`](/api-management/logs/external-data-sinks#csv) | Writes traffic logs to local CSV files |
+| [`elasticsearch`](/api-management/logs/external-data-sinks#elasticsearch) | Indexes traffic logs in Elasticsearch |
+| [`graylog`](/api-management/logs/external-data-sinks#graylog) | Forwards traffic logs to Graylog |
+| [`influx`](/api-management/logs/external-data-sinks#influxdb) | Writes traffic logs to InfluxDB v1 |
+| [`influx2`](/api-management/logs/external-data-sinks#influx2) | Writes traffic logs to InfluxDB v2 |
+| [`kafka`](/api-management/logs/external-data-sinks#kafka) | Publishes traffic logs to a Kafka topic |
+| [`kinesis`](/api-management/logs/external-data-sinks#kinesis) | Publishes traffic logs to an Amazon Kinesis stream |
+| [`logzio`](/api-management/logs/external-data-sinks#logz-io) | Forwards traffic logs to Logz.io |
+| [`moesif`](/api-management/logs/external-data-sinks#moesif) | Forwards traffic logs to Moesif |
+| [`resurfaceio`](/api-management/logs/external-data-sinks#resurface-io) | Forwards traffic logs to Resurface.io |
+| [`segment`](/api-management/logs/external-data-sinks#segment) | Forwards traffic logs to Segment |
+| [`splunk`](/api-management/logs/external-data-sinks#splunk) | Forwards traffic logs to Splunk |
+| [`sqs`](/api-management/logs/external-data-sinks#sqs) | Publishes traffic logs to an Amazon SQS queue |
+| [`stdout`](/api-management/logs/external-data-sinks#stdout) | Writes traffic logs to standard output, useful for container log collectors |
+| [`syslog`](/api-management/logs/external-data-sinks#syslog) | Forwards traffic logs to a syslog server |
+| [`timestream`](/api-management/logs/external-data-sinks#timestream) | Writes traffic logs to Amazon Timestream |
+
+### Metrics Pumps
+
+Derive per-request metrics from traffic logs, rather than forwarding the full record. Considered the legacy approach: for new integrations, use [OpenTelemetry metrics](/api-management/logs-metrics#opentelemetry-metrics) instead.
+
+| Type | Description |
+| :-- | :-- |
+| [`dogstatsd`](/api-management/metrics/metrics-pumps#dogstatsd-datadog) | Sends per-request metrics in the DogStatsD format, for example to Datadog |
+| [`prometheus`](/api-management/metrics/metrics-pumps#prometheus) | Exposes an HTTP endpoint for Prometheus to scrape |
+| [`statsd`](/api-management/metrics/metrics-pumps#statsd) | Sends per-request metrics to a StatsD server |
+
+<Note>
+Some pump types accept a `filters` object to restrict which Organisations or APIs they receive data for; see [Sharding Analytics to Different Data Sinks](#sharding-analytics-to-different-data-sinks) above.
+</Note>
+
+## Demo Mode
+
+Tyk Pump can generate synthetic analytics data and send it to your configured pumps, without needing any live API traffic. This is useful for previewing Tyk Dashboard's Traffic Analytics and Log Browser with realistic-looking data, for example while evaluating Tyk, or for testing a new pump configuration in isolation before pointing it at live traffic.
+
+Demo mode is controlled by command-line flags when starting Tyk Pump, not by `pump.conf` or environment variables. `--demo` is required to enable it; the rest are optional and customize the generated data:
+
+| Flag | Default | Description |
+| :-- | :-- | :-- |
+| `--demo=<ORG_ID>` | Required | Enables demo mode for the given Organisation ID. |
+| `--demo-api=<API_ID>` | Random ID | The `API_ID` to record for all demo transactions. |
+| `--demo-api-version=<API_VERSION>` | - | The API version to record for demo transactions. |
+| `--demo-days=<DAYS>` | `30` | How many days of demo data to generate. |
+| `--demo-records-per-hour=<RECORDS_PER_HOUR>` | `0` (random 300-500/hour) | Records generated per hour. |
+| `--demo-future-data` | `false` | Generates data forward from now instead of backward. |
+| `--demo-track-path` | `false` | Enables request path tracking in demo data. Overridden by an Aggregate Pump's own [`track_all_paths`](/api-management/dashboard-analytics/control-plane-pumps#mongo-aggregate-pump), if set to `true`. |
diff --git a/api-management/upstream-authentication.mdx b/api-management/upstream-authentication.mdx
new file mode 100644
index 0000000000..6f507d778f
--- /dev/null
+++ b/api-management/upstream-authentication.mdx
@@ -0,0 +1,34 @@
+---
+title: "Upstream Authentication"
+description: "Authenticating Tyk Gateway with upstream services"
+keywords: "security, upstream authentication, gateway to upstream, OAuth, mTLS, Basic Auth"
+sidebarTitle: "Overview"
+---
+
+## Introduction
+
+Tyk Gateway sits between your clients and your services, securely routing requests and responses. For each API proxy that you expose on Tyk, you can configure a range of different methods that clients must use to identify (authenticate) themselves to Tyk Gateway. These are described in detail in the [Client Authentication](/api-management/client-authentication) section.
+
+In the same way as you use Client Authentication to securely confirm the identity of the API clients, your upstream services probably need to securely confirm the identity of their client - namely Tyk. This is where Tyk's flexible **Upstream Authentication** capability comes in.
+
+When using Tyk, you can choose from a range of authentication methods for each upstream API:
+- [Mutual TLS](/api-management/upstream-authentication/mtls)
+- [Token-based authentication](/api-management/upstream-authentication/auth-token)
+- [Request signing](/api-management/upstream-authentication/request-signing)
+- [Basic Authentication](/api-management/upstream-authentication/basic-auth)
+- [OAuth 2.0](/api-management/upstream-authentication/oauth)
+    - [OAuth 2.0 Client Credentials](/api-management/upstream-authentication/oauth#oauth-client-credentials)
+    - [OAuth 2.0 Password Grant](/api-management/upstream-authentication/oauth#oauth-resource-owner-password-credentials)
+
+
+
+    <Note>
+    Upstream Basic Authentication and OAuth 2.0 support are only available to licensed users, via the Tyk Dashboard. These features are not available to open source users.
+    </Note>
+
+
+
+<Warning>
+Note that OAuth 2.0 Password Grant is prohibited in the [OAuth 2.0 Security Best Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-13#section-3.4") but is supported by Tyk for use with legacy upstream services.
+</Warning>
+
diff --git a/api-management/upstream-authentication/auth-token.mdx b/api-management/upstream-authentication/auth-token.mdx
new file mode 100644
index 0000000000..b2506cb53b
--- /dev/null
+++ b/api-management/upstream-authentication/auth-token.mdx
@@ -0,0 +1,24 @@
+---
+title: "Upstream Authentication using Auth Token"
+description: "How to authenticate upstream service using auth token"
+keywords: "security, upstream authentication, gateway to upstream, auth token"
+sidebarTitle: "Auth Token"
+---
+
+## Token-based authentication
+
+Token-based authentication (also referred to as Auth Token) is a method whereby the client is identified and authenticated by the server based on a key/token they present as a credential with each request. Typically the token is issued by the server to a specific client.
+
+The server determines how the key should be provided - typically in a request header, cookie or query parameter.
+
+Tyk supports [Auth Token](/api-management/authentication/bearer-token) as a method for authenticating **clients** with the **Gateway** - you can use Tyk Gateway or Dashboard to generate access *keys* for an Auth Token protected API as explained in the [documentation](/api-management/access-control/overview). The client must then provide the *key* in the appropriate parameter for each request.
+
+If your **upstream service** is protected using Auth Token then similarly, Tyk will need to provide a token, issued by the upstream, in the request.
+
+### How to use Upstream Token-based Authentication
+Typically Auth Token uses the `Authorization` header to pass the token in the request.
+
+Tyk's [Request Header Transform](/api-management/traffic-transformation/request-headers) middleware can be configured to add this header to the request prior to it being proxied to the upstream. To enhance security by restricting visibility of the access token, the key/token can be stored in a [key-value store](/tyk-self-managed/install), with only the reference included in the middleware configuration.
+
+
+
diff --git a/api-management/upstream-authentication/basic-auth.mdx b/api-management/upstream-authentication/basic-auth.mdx
new file mode 100644
index 0000000000..2694ee1d71
--- /dev/null
+++ b/api-management/upstream-authentication/basic-auth.mdx
@@ -0,0 +1,127 @@
+---
+title: "Upstream Authentication using Basic Auth"
+description: "How to authenticate upstream service basic authentication"
+keywords: "security, upstream authentication, gateway to upstream, basic auth"
+sidebarTitle: "Basic Auth"
+---
+
+## Availability 
+
+| Component   | Editions   |
+| :----------- | :---------- |
+| Gateway and Dashboard | Enterprise |
+
+## Basic Authentication
+
+Basic Authentication is a standard authentication mechanism implemented by HTTP servers, clients and web browsers. This makes it an excellent access control method for smaller APIs.
+
+An API request made using Basic Authentication will have an `Authorization` header that contains the client's credentials in the form: `Basic <credentials>`.
+
+The `<credentials>` are a base64 encoded concatenation of a client username and password, joined by a single colon `:`.
+
+Tyk supports Basic Authentication as a method for authenticating **clients** with the **Gateway** - you can use Tyk Gateway or Dashboard to create Basic Auth users, as explained in the [documentation](/api-management/authentication/basic-authentication#registering-basic-authentication-user-credentials-with-tyk).
+
+If your **upstream service** is protected using Basic Authentication then similarly, Tyk will need to provide user credentials, registered with the upstream, in the request.
+
+### How to use Upstream Basic Authentication
+
+If your upstream service requires that Tyk authenticates using Basic Authentication, you will first need to obtain a valid username and password from the server. To enhance security by restricting visibility of the credentials, these can be stored in a [key-value store](/tyk-self-managed/install), with only references included in the API definition.
+
+If the incoming request from the client already has credentials in the `Authorization` header, then Tyk will replace those with the basic auth credentials before proxying onwards to the upstream.
+
+Sometimes a non-standard upstream server might require the authentication credentials to be provided in a different header (i.e. not `Authorization`). With Tyk, you can easily configure a custom header to be used for the credentials if required.
+
+Upstream Basic Authentication is only supported by Tyk OAS APIs. If you are using Tyk Classic APIs, you could create the client credential offline and add the `Authorization` header using the [Request Header Transform](/api-management/traffic-transformation/request-headers) middleware.
+
+#### Configuring Upstream Basic Auth in the Tyk OAS API definition
+
+Upstream Authentication is configured per-API in the Tyk extension (`x-tyk-api-gateway`) within the Tyk OAS API definition by adding the `authentication` section within the `upstream` section.
+
+Set `upstream.authentication.enabled` to `true` to enable upstream authentication.
+
+For Basic Authentication, you will need to add the `basicAuth` section within `upstream.authentication`.
+
+This has the following parameters:
+- `enabled` set this to `true` to enable upstream basic authentication
+- `username` is the username to be used in the request *credentials*
+- `password` is the password to be used in the request *credentials*
+- `header.enabled` must be set to `true` if your upstream expects the *credentials* to be in a custom header, otherwise it can be omitted to use `Authorization` header 
+- `header.name` is the custom header to be used if `header.enabled` is set to `true`
+
+Note that if you use the [Tyk API Designer](#configuring-upstream-basic-auth-using-the-api-designer) in Tyk Dashboard it will always configure the `header` parameter - even if you are using the default `Authorization` value.
+
+For example:
+
+```json {hl_lines=["43-54"],linenos=true, linenostart=1}
+{
+    "info": {
+        "title": "example-upstream-basic-auth",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "servers": [
+        {
+            "url": "http://localhost:8181/example-upstream-basic-auth/"
+        }
+    ],
+    "security": [],
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "components": {
+    "securitySchemes": {}
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-upstream-basic-auth",
+            "state": {
+                "active": true
+            }
+        },
+        "server": {
+            "listenPath": {
+                "strip": true,
+                "value": "/example-upstream-basic-auth/"
+            }
+        },
+        "upstream": {
+            "url": "https://httpbin.org/basic-auth/myUsername/mySecret",
+            "authentication": {
+                "enabled": true,
+                "basicAuth": {
+                    "password": "mySecret",
+                    "username": "myUsername",
+                    "enabled": true,
+                    "header": {
+                        "enabled": true,
+                        "name": "Authorization"
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example upstream authentication has been enabled (line 44). Requests will be proxied to the `GET /basic-auth` endpoint at httpbin.org using the credentials in lines 46 and 47 (username: myUsername, password: mySecret). These credentials will be combined, base64 encoded and then provided in the `Authorization` header, as required by the httpbin.org [documentation](https://httpbin.org/#/Auth/get_basic_auth__user___passwd_").
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the Upstream Basic Authentication feature.
+
+#### Configuring Upstream Basic Auth using the API Designer
+
+Upstream Authentication is configured from the **Settings** tab of the Tyk OAS API Designer, where there is a dedicated section within the **Upstream** section.
+
+Select **Basic Auth** from the choice in the **Authentication Method** drop-down, then you can provide the client credentials and header name.
+
+<img src="/img/dashboard/api-designer/upstream-basic-auth.png" alt="Tyk OAS API Designer showing Upstream Basic Auth configuration options" />
+
+<hr />
diff --git a/api-management/upstream-authentication/mtls.mdx b/api-management/upstream-authentication/mtls.mdx
new file mode 100644
index 0000000000..e37010e54d
--- /dev/null
+++ b/api-management/upstream-authentication/mtls.mdx
@@ -0,0 +1,456 @@
+---
+title: "Upstream Authentication using Mutual TLS"
+description: "How to authenticate upstream service using mutual tls"
+keywords: "security, upstream authentication, gateway to upstream, mTLS, mutual tls"
+sidebarTitle: "Mutual TLS"
+---
+
+## Mutual TLS (mTLS)
+
+If your upstream API is protected with [mutual TLS](/api-management/implement-tls#secure-hosted-apis-with-mtls) then Tyk must provide a certificate when connecting to the upstream service and also will need to verify the certificate presented by the upstream. This ensures secure communication between Tyk and your upstream services.
+
+When Tyk performs an mTLS handshake with an upstream, it needs to know:
+
+- which client certificate Tyk should use to identify itself
+- which public key (certificate) that Tyk should use to verify the identity of the upstream
+
+We use a system of [mapping certificates](#mapping-certificates-to-domains) to upstreams based on their host domain. This is used for both the [client certificate](#upstream-client-certificates) and, optionally, for the [upstream public key](#upstream-server-certificates) if we want to use specific certificates to protect against compromised certificate authorities (CAs).
+
+#### Upstream mTLS for Tyk middleware and plugins
+
+If upstream mTLS certificates are configured for an API, they will not be used for direct proxies to the upstream and will also automatically be used for any HTTP requests made from the [JavaScript Virtual Endpoint](/api-management/traffic-transformation/virtual-endpoints) middleware. They will **not** be used for HTTP requests from custom plugins.
+
+
+#### Upstream mTLS for Tyk Cloud
+
+All Tyk Cloud users can secure their upstream services with mTLS 
+
+### Mapping certificates to domains
+
+Tyk maintains mappings of certificates to domains (which can include the port if a non-standard HTTP port is used). Separate maps can be declared globally, to be applied to all APIs, and at the API level for more granular control. The granular API level mapping takes precedence if both are configured. Within each mapping, both default and specific maps can be defined, giving ultimate flexibility.
+
+When Tyk performs an mTLS handshake with an upstream, it will check if there are certificates mapped to the domain:
+
+- first it will check in the API definition for a specific certificate
+- then it will check in the API definition if there is a default certificate
+- then it will check at the Gateway level for a specific certificate
+- then it will check at the Gateway level for a default certificate
+
+Certificates are identified in the mapping using a [certificate reference](/api-management/certificates#certificate-management). In practice this is typically the certificate ID assigned by the Tyk Certificate Store, for example: `{"<domain>": "<cert-id>"}`.
+
+When mapping a certificate to a domain:
+
+- do not include the protocol (e.g. `https://`)
+- include the port if a non-standard HTTP port is in use
+- you can use the `*` wildcard - either in place of the whole domain or as part of the domain name
+
+For example, to map a certificate with Id `certId` to an upstream service located at `https://api.production.myservice.com:8443` you could map the certificate as:
+
+- `{"api.production.myservice.com:8443": "certId"}`
+- `{"*.production.myservice.com:8443": "certId"}`
+- `{"api.*.myservice.com:8443": "certId"}`
+
+Note that when using the wildcard (`*`) to replace part of the domain name, it can only represent one fragment so, using our example, you would not achieve the same mapping using `{"*.myservice.com:8443": "certId"}`.
+
+
+A *default* certificate to be used for all upstream requests can be mapped by replacing the specific domain with the wildcard, for example `{"*", "certId"}`.
+
+
+### Upstream client certificates
+
+Tyk can be configured to proxy requests to a single API on to different upstream hosts (for example via load balancing, API versions or URL rewrite middleware). You can configure Tyk to present specific client certificates to specific hosts, and you can specify a default certificate to be usedfor all upstream hosts.
+
+The upstream service uses the public key (from the certificate presented by Tyk) to verify the signed data, confirming that Tyk possesses the corresponding private key.
+
+All certificates are retrieved from the [Tyk Certificate Store](/api-management/certificates#certificate-management) when the proxy occurs.
+
+#### Mapping client certificates at the Gateway level
+
+You can map certificates to domains using the [security.certificates.upstream](/tyk-oss-gateway/configuration#security-certificates-upstream) field in your Gateway configuration file.
+
+Mapping a certificate to domain `*` will ensure that this certificate will be used in all upstream requests where no other certificate is mapped (at Gateway or API level).
+
+#### Mapping client certificates at the API level
+
+You can map certificates to domains using the [upstream.mutualTLS](/api-management/gateway-config-tyk-oas#mutualtls) object (Tyk Classic: `upstream_certificates`) in your API definition.
+
+Mapping a certificate to domain `*` will ensure that this certificate will be used in all upstream requests where no other certificate is mapped in the API definition.
+
+
+### Upstream server certificates
+
+Tyk will verify the certificate received from the upstream by performing the following checks:
+
+- Check that it's issued by a trusted CA
+- Check that the certificate hasn't expired
+- Verify the certificate's digital signature using the public key from the certificate
+
+
+
+    <Note>
+    Tyk will look in the system trust store for the server that is running Tyk Gateway (typically `/etc/ssl/certs`). If you are using self-signed certificates, store them here so that Tyk can verify the upstream service.
+    </Note>
+
+
+If you want to restrict the public keys that can be used by the upstream service, then you can use [certificate pinning](/api-management/upstream-authentication/mtls#certificate-pinning) to store a list of certificates that Tyk will use to verify the upstream.
+
+#### Certificate Pinning
+
+Tyk provides the facility to allow only certificates generated from specific public keys to be accepted from the upstream services during the mTLS exchange. This is called "certificate pinning" because you *pin* a specific public certificate to an upstream service (domain) and Tyk will only use this to verify connections to that domain. This helps to protect against compromised certificate authorities. You can pin one or more public keys per domain.
+
+The public keys must be stored in PEM format in the [Tyk Certificate Store](/api-management/certificates#certificate-management).
+
+##### Configuring Certificate Pinning at the Gateway level
+
+If you want to lock down the public certificates that can be used in mTLS handshakes for specific upstream domains across all APIs, you can pin public certificates to domains using the [security.pinned_public_keys](/tyk-oss-gateway/configuration#security-pinned_public_keys) field in your Gateway configuration file.
+
+This accepts a map of domain addresses to certificates in the same way as for the client certificates. Wildcards are supported in the domain addresses. Pinning one or more certificates to domain `*` will ensure that only these certificates will be used to verify the upstream service during the mTLS handshake. 
+
+##### Configuring Certificate Pinning at the API level
+
+Restricting the certificates that can be used by the upstream for specific APIs is simply a matter of registering a map of domain addresses to certificates in the [upstream.certificatePinning](/api-management/gateway-config-tyk-oas#certificatepinning) object in the API definition (Tyk Classic: `pinned_public_keys`).
+
+
+### Overriding mTLS for non-production environments
+
+When you are developing or testing an API, your upstream might not have the correct certificates that are deployed for your production service. This could cause problems when integrating with Tyk.
+
+You can use the [`upstream.tlsTransport.insecureSkipVerify`](/api-management/gateway-config-tyk-oas#tlstransport) option in the API definition (Tyk Classic: `proxy.transport.ssl_insecure_skip_verify`) to instruct Tyk to ignore the certificate verification stage for a specific API.
+
+If you want to ignore upstream certificate verification for all APIs deployed on Tyk, you can use the [proxy_ssl_insecure_skip_verify](/tyk-oss-gateway/configuration#proxy_ssl_insecure_skip_verify) option in the Tyk Gateway configuration.
+
+These are labelled *insecure* with good reason and should never be configured in production.
+
+
+### Using Tyk Dashboard to configure upstream mTLS
+
+Using the Tyk Dashboard, you can enable upstream mTLS from the **Upstream** section in the API Designer:
+
+<img src="/img/dashboard/api-designer/tyk-oas-upstream-mtls-client.png" alt="Enable upstream mTLS" />
+
+Click on **Attach Certificate** to open the certificate attachment window:
+
+<img src="/img/dashboard/api-designer/tyk-oas-certificate-attach.png" alt="Attach a certificate to an API" />
+
+This is where you can define the upstream **Domain Name** and either select an existing certificate from the Tyk Certificate Store, or upload a new certificate to the store.
+
+If you want to [pin the public certificates](/api-management/upstream-authentication/mtls#certificate-pinning) that can be used by Tyk when verifying the upstream service, then you should enable **Public certificates** and attach certificates in the same manner as for the client certificates:
+
+<img src="/img/dashboard/api-designer/tyk-oas-upstream-mtls-public.png" alt="Enable public key pinning" />
+
+For details on managing certificates with Tyk, please see the [certificate management](/api-management/certificates#certificate-management) documentation.
+
+For Tyk Classic APIs, the **Upstream Certificates** controls are on the **Advanced Options** tab of the Tyk Classic API Designer.
+
+
+### Using Tyk Operator to configure mTLS
+
+<Tabs>
+<Tab title="Upstream Client Certificates">
+
+Configure upstream mTLS client certificates using the `mutualTLS` field in the `TykOasApiDefinition` object when using Tyk Operator, for example:
+
+```yaml{hl_lines=["12-18"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+ kind: TykOasApiDefinition
+ metadata:
+   name: petstore
+   namespace: default
+ spec:
+   tykOAS:
+     configmapRef:
+       name: petstore
+       namespace: default
+       keyName: petstore.json
+   mutualTLS:
+     enabled: true
+     domainToCertificateMapping:
+       - domain: "petstore.com"
+         certificateRef: petstore-domain
+       - domain: "petstore.co.uk"
+         certificateRef: petstore-uk-domain
+```
+
+</Tab>
+<Tab title="Certificate Pinning">
+
+Tyk Operator supports certificate pinning in the Tyk OAS custom resource, allowing you to secure your API by pinning a public key stored in a secret to a specific domain.
+
+Example of public keys pinning
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm
+  namespace: default
+data:
+  test_oas.json: |-
+    {
+      "info": {
+        "title": "httpbin with certificate pinning",
+        "version": "1.0.0"
+      },
+      "openapi": "3.0.3",
+      "components": {},
+      "paths": {},
+      "x-tyk-api-gateway": {
+        "info": {
+          "name": "httpbin with certificate pinning",
+          "state": {
+            "active": true
+          }
+        },
+        "upstream": {
+          "url": "https://httpbin.org/"
+        },
+        "server": {
+          "listenPath": {
+            "value": "/httpbin/",
+            "strip": true
+          }
+        }
+      }
+    }
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: domain-secret
+type: kubernetes.io/tls # The secret needs to be a type of kubernetes.io/tls
+data:
+  tls.crt: <PUBLIC_KEY>
+  tls.key: ""
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: "oas-pinned-public-keys"
+spec:
+  tykOAS:
+    configmapRef:
+      keyName: test_oas.json
+      name: cm
+  certificatePinning:
+    enabled: true
+    domainToPublicKeysMapping:
+      - domain: "httpbin.org"
+        publicKeyRefs:
+          - domain-secret
+```
+
+This example demonstrates how to enable certificate pinning for the domain `httpbin.org` using a public key stored in a Kubernetes secret (`domain-secret`).
+
+</Tab>
+</Tabs>
+
+### Using Tyk Operator to configure mTLS for Tyk Classic APIs
+
+<Tabs>
+<Tab title="Upstream Client Certificates">
+When using Tyk Classic APIs with Tyk Operator, you can configure upstream client certificates for mTLS using one of the following fields within the ApiDefinition object:
+
+- **upstream_certificate_refs**: Configure using certificates stored within Kubernetes secret objects.
+- **upstream_certificates**: Configure using certificates stored within Tyk Dashboard's certificate store.
+
+**upstream_certificate_refs**
+
+The `upstream_certificate_refs` field can be used to configure certificates for different domains. References can be held to multiple secrets which are used for the domain mentioned in the key. Currently "*" is used as a wildcard for all the domains
+
+The example listed below shows that the certificate in the secret, *my-test-tls*, is used for all domains.
+
+```yaml
+# First apply this manifest using the command
+# "kubectl apply -f config/samples/httpbin_upstream_cert.yaml"
+#
+# The operator will try to create the ApiDefinition and will succeed but will log an error that a certificate is missing
+# in the cluster for an upstream
+#
+# Generate your public-private key pair , for test you can use the following command to obtain one fast:
+# "openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out tls.crt -keyout tls.key"
+#
+# Run the following command to obtain the values that must be put inside the yaml that contians the secret resource:
+# "kubectl create secret tls my-test-tls --key="tls.key" --cert="tls.crt" -n default -o yaml --dry-run=client"
+#
+# Apply your TLS certificate using the following command: (we already have an example one in our repo)
+# "kubectl apply -f config/sample/simple_tls_secret.yaml"
+#
+# NOTE: the upstream_certificate_refs can hold references to multiple secrets which are used for the domain
+# mentioned in the key (currently "*" is used as a wildcard for all the domains)
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  upstream_certificate_refs:
+    "*": my-test-tls
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+```
+
+A secret can be created and output in yaml format using the following command:
+
+```bash
+kubectl create secret tls my-test-tls --key="keyfile.key" --cert="certfile.crt" -n default -o yaml --dry-run=client
+kubectl apply -f path/to/your/tls_secret.yaml
+```
+
+**upstream_certificates**
+
+The `upstream_certificates` field allows certificates uploaded to the certificate store in Tyk Dashboard to be referenced in the Api Definition:
+
+```yaml
+# Skip the concatenation and .pem file creation if you already have a certificate in the correct format
+
+# First generate your public-private key pair , for test use you can use the following command to obtain one fast:
+# "openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out tls.crt -keyout tls.key"
+
+# Concatenate the above files to obtain a .pem file which we will upload using the dashboard UI
+# "cat tls.crt tls.key > cert.pem"
+
+# Upload it to the tyk certificate store using the dashboard
+
+# Fill in the manifest with the certificate id (the long hash) that you see is given to it in the dashboard
+# (in place of "INSERT UPLOADED CERTIFICATE NAME FROM DASHBOARD HERE")
+# Optional: Change the domain from "*" to something more specific if you need to use different
+# upstream certificates for different domains
+
+# Then apply this manifest using the command
+# "kubectl apply -f config/samples/httpbin_upstream_cert_manual.yaml"
+
+# The operator will try create the ApiDefinition and will succeed and it will have the requested domain upstream certificate
+# in the cluster for an upstream
+
+# NOTE: the upstream_certificate can hold multiple domain-certificateName pairs
+# (currently "*" is used as a wildcard for all the domains)
+
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  upstream_certificates:
+    "*": #INSERT UPLOADED CERTIFICATE NAME FROM DASHBOARD HERE#
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+```
+
+</Tab>
+<Tab title="Certificate Pinning">
+
+When using Tyk Classic APIs with Tyk Operator you can configure certificate pinning using one of the following fields within the ApiDefinition object:
+
+- **pinned_public_keys**: Use public keys uploaded via the Certificate API.
+- **pinned_public_keys_refs**: Uses public keys configured from Kubernetes secret objects.
+
+###### pinned_public_keys
+
+Use the `pinned_public_keys` mapping to pin public keys to specific domains, referencing public keys that have been uploaded to Tyk Certificate storage via the Certificate API.  
+
+```yaml
+pinned_public_keys:
+  "foo.com": "<key_id>",
+  "*": "<key_id-1>,<key_id-2>"
+```
+
+Each `key-id` value should be set to the ID returned from uploading the public key via the Certificate API. Multiple public keys can be specified by separating their IDs by a comma.
+
+<br />
+
+###### pinned_public_keys_refs
+
+The `pinned_public_keys_refs` mapping should be used to configure pinning of public keys sourced from Kubernetes secret objects for different domains.
+
+Each key should be set to the name of the domain and the value should refer to the name of a Kuberenetes secret object that holds the corresponding public key for that domain.
+
+Wildcard domains are supported and "*" can be used to denote all domains.
+
+
+<Warning>
+**Caveats**
+
+- Only *kubernetes.io/tls* secret objects are allowed.
+- Please use the *tls.crt* field for the public key.
+- The secret that includes a public key must be in the same namespace as the ApiDefinition object.
+</Warning>
+
+
+The example below illustrates a scenario where the public key from the Kubernetes secret object, *httpbin-secret*, is used for all domains, denoted by the wildcard character '*'. In this example the *tls.crt* field of the secret is set to the actual public key of *httpbin.org*. Subsequently, if you any URL other than https://httpbin.org is targetted (e.g. https://github.com/) a *public key pinning error* will be raised for that particular domain. This is because the public key of *httpbin.org* has been configured for all domains.
+
+```yaml
+# ApiDefinition object 'pinned_public_keys_refs' field uses the following format:
+#  spec:
+#   pinned_public_keys_refs:
+#    "domain.org": <secret_name> # the name of the Kubernetes Secret Object that holds the public key for the 'domain.org'.
+#
+# In this way, you can refer to Kubernetes Secret Objects through 'pinned_public_keys_refs' field.
+#
+# In this example, we have an HTTPS upstream target as `https://httpbin.org`. The public key of httpbin.org is obtained
+# with the following command:
+#   $ openssl s_client -connect httpbin.org:443 -servername httpbin.org 2>/dev/null | openssl x509 -pubkey -noout
+#
+# Note: Please set tls.crt field of your secret to actual public key of httpbin.org.
+#
+# We are creating a secret called 'httpbin-secret'. In the 'tls.crt' field of the secret, we are specifying the public key of the
+#  httpbin.org obtained through above `openssl` command, in the decoded manner.
+#
+apiVersion: v1
+kind: Secret
+metadata:
+  name: httpbin-secret
+type: kubernetes.io/tls
+data:
+  tls.crt: <PUBLIC_KEY> # Use tls.crt field for the public key.
+  tls.key: ""
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-certificate-pinning
+spec:
+  name: httpbin - Certificate Pinning
+  use_keyless: true
+  protocol: http
+  active: true
+  pinned_public_keys_refs:
+    "*": httpbin-secret
+  proxy:
+    target_url: https://httpbin.org
+    listen_path: /pinning
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+```
+</Tab>
+</Tabs>
+
+<hr />
+
diff --git a/api-management/upstream-authentication/oauth.mdx b/api-management/upstream-authentication/oauth.mdx
new file mode 100644
index 0000000000..c3d14aab17
--- /dev/null
+++ b/api-management/upstream-authentication/oauth.mdx
@@ -0,0 +1,269 @@
+---
+title: "Upstream Authentication using OAuth"
+description: "How to authenticate upstream service using oauth"
+keywords: "security, upstream authentication, gateway to upstream, oauth"
+sidebarTitle: "OAuth 2.0"
+---
+
+## Availability 
+
+| Component   | Editions   |
+| :----------- | :---------- |
+| Gateway and Dashboard | Enterprise |
+
+## Upstream OAuth 2.0
+
+OAuth 2.0 is an open standard authorization protocol that allows services to provide delegated and regulated access to their APIs; critically the user credentials are not shared with the upstream service, instead the client authenticates with a separate Authentication Server which issues a time-limited token that the client can then present to the upstream (Resource Server). The upstream service validates the token against the Authentication Server before granting access to the client.
+
+The Authentication Server (auth server) has the concept of an OAuth Client - this is equivalent to the client's account on the auth server. There are different ways that a client can authenticate with the auth server, each with their own advantages and disadvantages for different use cases.
+
+The auth server is often managed by a trusted third party Identity Provider (IdP) such as Okta or Auth0.
+
+Tyk supports OAuth 2.0 as a method for authenticating **clients** with the **Gateway** - you can use Tyk's own auth server functionality via the [Tyk OAuth 2.0](/api-management/authentication/oauth-2) auth method or obtain the access token via a third party auth server and use the [JWT Auth](/basic-config-and-security/security/authentication-authorization/json-web-tokens) method.
+
+If your **upstream service** is protected using OAuth 2.0 then similarly, Tyk will need to obtain a valid access token to provide in the request to the upstream.
+
+Tyk supports two different OAuth grant types for connecting to upstream services:
+- [Client credentials](#oauth-client-credentials)
+- [Resource owner password credentials](#oauth-resource-owner-password-credentials)
+
+#### OAuth client credentials
+
+The client credentials grant relies upon the client providing an id and secret (the *client credentials*) to the auth server. These are checked against the list of OAuth Clients that it holds and, if there is a match, it will issue an access token that instructs the Resource Server which resources that client is authorized to access. For details on configuring Tyk to use Upstream Client Credentials see [below](#configuring-upstream-oauth-20-client-credentials-in-the-tyk-oas-api-definition).
+
+#### OAuth resource owner password credentials
+
+The resource owner password credentials grant (also known simply as **Password Grant**) is a flow where the client must provide both their own credentials (client Id and secret) and a username and password identifying the resource owner to the auth server to obtain an access token. Thus the (upstream) resource owner must share credentials directly with the client. This method is considered unsafe and is prohibited in the [OAuth 2.0 Security Best Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-13#section-3.4") but is supported by Tyk for use with legacy upstream services. For details on configuring Tyk to use Upstream Password Grant see [below](#configuring-upstream-oauth-20-password-grant-in-the-tyk-oas-api-definition).
+
+### How to use Upstream OAuth 2.0 for Authentication
+
+If your upstream service requires that Tyk authenticates via an OAuth auth server, you will first need to obtain credentials for the OAuth Client created in the auth server. You select which grant type to use and provide the required credentials in the API definition.
+
+To enhance security by restricting visibility of the credentials, these can be stored in a [key-value store](/tyk-self-managed/install), with only references included in the API definition.
+
+Some auth servers will return *additional metadata* with the access token (for example, the URL of the upstream server that should be addressed using the token if this can vary per client). Tyk can accommodate this using the optional `extraMetadata` field in the API definition. The response from the auth server will be parsed for any fields defined in `extraMetadata`; any matches will be saved to the request context where they can be accessed from other middleware (for our example, the URL rewrite middleware could be used to [transform the upstream target URL](/transform-traffic/url-rewriting)).
+
+#### Configuring Upstream OAuth 2.0 Client Credentials in the Tyk OAS API definition
+
+Upstream Authentication is configured per-API in the Tyk extension (`x-tyk-api-gateway`) within the Tyk OAS API definition by adding the `authentication` section within the `upstream` section.
+
+Set `upstream.authentication.enabled` to `true` to enable upstream authentication.
+
+For OAuth 2.0 Client Credentials, you will need to add the `oauth` section within `upstream.authentication`.
+
+This has the following parameters:
+- `enabled` set this to `true` to enable upstream OAuth authentication
+- `allowedAuthorizeTypes` should include the value `clientCredentials`
+- `clientCredentials` should be configured with:
+    - `tokenUrl` is the URL of the `/token` endpoint on the *auth server*
+    - `clientId` is the client ID to be provided to the *auth server*
+    - `clientSecret` is the client secret to be provided to the *auth server*
+    - `scopes` is an optional array of authorization scopes to be requested
+    - `extraMetadata` is an optional array of additional fields to be extracted from the *auth server* response
+    - `header.enabled` must be set to `true` if your upstream expects the credentials to be in a custom header, otherwise it can be omitted to use `Authorization` header 
+    - `header.name` is the custom header to be used if `header.enabled` is set to `true`
+
+Note that if you use the [Tyk API Designer](/api-management/upstream-authentication/basic-auth#configuring-upstream-basic-auth-using-the-api-designer) in Tyk Dashboard it will always configure the `header` parameter - even if you are using the default `Authorization` value.
+
+For example:
+
+```json {hl_lines=["43-62"],linenos=true, linenostart=1}
+{
+    "info": {
+        "title": "example-upstream-client-credentials",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "servers": [
+        {
+            "url": "http://localhost:8181/example-upstream-client-credentials/"
+        }
+    ],
+    "security": [],
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "components": {
+    "securitySchemes": {}
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-upstream-client-credentials",
+            "state": {
+                "active": true
+            }
+        },
+        "server": {
+            "listenPath": {
+                "strip": true,
+                "value": "/example-upstream-client-credentials/"
+            }
+        },
+        "upstream": {
+            "url": "https://httpbin.org/",
+            "authentication": {
+                "enabled": true,
+                "oauth": {
+                    "enabled": true,
+                    "allowedAuthorizeTypes": [
+                        "clientCredentials"
+                    ],
+                    "clientCredentials": {
+                        "header": {
+                            "enabled": true,
+                            "name": "Authorization"
+                        },
+                        "tokenUrl": "http://<my-auth-server>/token",
+                        "clientId": "client123",
+                        "clientSecret": "secret123",
+                        "scopes": ["scope1"],
+                        "extraMetadata": ["instance_url"]
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example upstream authentication has been enabled (line 44). The authentication method to be used is indicated in lines 46 (OAuth) and 48 (client credentials). When a request is made to the API, Tyk will request an access token from the *authorization server* at `http://<my-auth-server>` providing client credentials and the scope `scope1`.
+
+Tyk will parse the response from the *authorization server* for the key `instance_url`, storing any value found in the *request context* were it can be accessed by other middleware as `$tyk_context.instance_url` (note the rules on accessing [request context variables from middleware](/api-management/traffic-transformation/request-context-variables)).
+
+On receipt of an access token from the *authorization server*, Tyk will proxy the original request to the upstream server (`https://httpbin.org/`) passing the access token in the `Authorization` header.
+
+If you replace the `upstream.url` and *authorization server* details with valid details, then the configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the Upstream OAuth 2.0 Client Credentials feature.
+
+#### Configuring Upstream OAuth 2.0 Client Credentials using the API Designer
+
+Upstream Authentication is configured from the **Settings** tab of the Tyk OAS API Designer, where there is a dedicated section within the **Upstream** section.
+
+Select **OAuth** from the choice in the **Authentication Method** drop-down, then you can provide the header name, authorization server token URL and select **Client Credentials** to reveal the configuration for the credentials to be passed to the auth server.
+
+<img src="/img/dashboard/api-designer/upstream-oauth-client-credentials.png" alt="Tyk OAS API Designer showing Upstream OAuth client credentials configuration options" />
+
+#### Configuring Upstream OAuth 2.0 Password Grant in the Tyk OAS API definition
+
+Upstream Authentication is configured per-API in the Tyk extension (`x-tyk-api-gateway`) within the Tyk OAS API definition by adding the `authentication` section within the `upstream` section.
+
+Set `upstream.authentication.enabled` to `true` to enable upstream authentication.
+
+For OAuth 2.0 Resource Owner Password Credentials (*Password Grant*), you will need to add the `oauth` section within `upstream.authentication`.
+
+This has the following parameters:
+- `enabled` set this to `true` to enable upstream OAuth authentication
+- `allowedAuthorizeTypes` should include the value `password`
+- `password` should be configured with:
+    - `tokenUrl` is the URL of the `/token` endpoint on the *auth server*
+    - `clientId` is the client ID to be provided to the *auth server*
+    - `clientSecret` is the client secret to be provided to the *auth server*
+    - `username` is the Resource Owner username to be provided to the *auth server*
+    - `password` is the Resource Owner password to be provided to the *auth server*
+    - `scopes` is an optional array of authorization scopes to be requested
+    - `extraMetadata` is an optional array of additional fields to be extracted from the *auth server* response
+    - `header.enabled` must be set to `true` if your upstream expects the credentials to be in a custom header, otherwise it can be omitted to use `Authorization` header 
+    - `header.name` is the custom header to be used if `header.enabled` is set to `true`
+
+Note that if you use the [Tyk API Designer](/api-management/upstream-authentication/basic-auth#configuring-upstream-basic-auth-using-the-api-designer) in Tyk Dashboard it will always configure the `header` parameter - even if you are using the default `Authorization` value.
+
+For example:
+
+```json {hl_lines=["43-64"],linenos=true, linenostart=1}
+{
+    "info": {
+        "title": "example-upstream-password-grant",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "servers": [
+        {
+            "url": "http://localhost:8181/example-upstream-password-grant/"
+        }
+    ],
+    "security": [],
+    "paths": {
+        "/anything": {
+            "get": {
+                "operationId": "anythingget",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "components": {
+    "securitySchemes": {}
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-upstream-password-grant",
+            "state": {
+                "active": true
+            }
+        },
+        "server": {
+            "listenPath": {
+                "strip": true,
+                "value": "/example-upstream-password-grant/"
+            }
+        },
+        "upstream": {
+            "url": "https://httpbin.org/",
+            "authentication": {
+                "enabled": true,
+                "oauth": {
+                    "enabled": true,
+                    "allowedAuthorizeTypes": [
+                        "password"
+                    ],
+                    "password": {
+                        "header": {
+                            "enabled": true,
+                            "name": "Authorization"
+                        },
+                        "tokenUrl": "http://<my-auth-server>/token",
+                        "clientId": "client123",
+                        "clientSecret": "secret123",
+                        "username": "user123",
+                        "password": "pass123",
+                        "scopes": ["scope1"],
+                        "extraMetadata": ["instance_url"]
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example upstream authentication has been enabled (line 44). The authentication method to be used is indicated in lines 46 (OAuth) and 48 (password grant). When a request is made to the API, Tyk will request an access token from the *authorization server* at `http://<my-auth-server>` providing client credentials, resource owner credentials and the scope `scope1`.
+
+Tyk will parse the response from the *authorization server* for the key `instance_url`, storing any value found in the *request context* were it can be accessed by other middleware as `$tyk_context.instance_url` (note the rules on accessing [request context variables from middleware](/api-management/traffic-transformation/request-context-variables)).
+
+On receipt of an access token from the *authorization server*, Tyk will proxy the original request to the upstream server (`https://httpbin.org/`) passing the access token in the `Authorization` header.
+
+If you replace the `upstream.url` and *authorization server* details with valid details, then the configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the Upstream OAuth 2.0 Password Grant feature.
+
+#### Configuring Upstream OAuth 2.0 Password Grant using the API Designer
+
+Upstream Authentication is configured from the **Settings** tab of the Tyk OAS API Designer, where there is a dedicated section within the **Upstream** section.
+
+Select **OAuth** from the choice in the **Authentication Method** drop-down, then you can provide the header name, authorization server token URL and select **Resource Owner Password Credentials** to reveal the configuration for the credentials to be passed to the auth server.
+
+<img src="/img/dashboard/api-designer/upstream-oauth-password-grant.png" alt="Tyk OAS API Designer showing Upstream OAuth password grant configuration options" />
+
+
+<Note>
+Any error encountered in the communication with the OAuth server will generate an `UpstreamOAuthError` event. This event can be used to trigger an event handler, for example you could use a [webhook](/api-management/gateway-events) to alert the system administrator of the issue.
+</Note>
diff --git a/api-management/upstream-authentication/request-signing.mdx b/api-management/upstream-authentication/request-signing.mdx
new file mode 100644
index 0000000000..3a921c3422
--- /dev/null
+++ b/api-management/upstream-authentication/request-signing.mdx
@@ -0,0 +1,133 @@
+---
+title: "Upstream Authentication using Request Signing"
+description: "How to authenticate upstream service using request signing"
+keywords: "security, upstream authentication, gateway to upstream, request signing"
+sidebarTitle: "Request Signing"
+---
+
+## Request signing
+
+Request Signing is an access token method that adds another level of security where the client generates a unique signature that identifies the request temporally to ensure that the request is from the requesting user, using a secret key that is never broadcast over the wire.
+
+Tyk can apply either the symmetric Hash-Based Message Authentication Code (HMAC) or asymmetric Rivest-Shamir-Adleman (RSA) algorithms when generating the signature for a request to be sent upstream. For HMAC, Tyk supports different options for the hash length. 
+
+The following algorithms are supported:
+
+| Hashing algorithm | Tyk identifier used in API definition |
+| :------------------- | :--------------------------------------- |
+| HMAC SHA1         | `hmac-sha1`                           |
+| HMAC SHA256       | `hmac-sha256`                         |
+| HMAC SHA384       | `hmac-sha384`                         |
+| HMAC SHA512       | `hmac-sha512`                         |
+| RSA SHA256        | `rsa-sha256`                          |
+
+This feature is implemented using [Draft 10](https://tools.ietf.org/html/draft-cavage-http-signatures-10) RFC. The signatures generated according to this standard are temporal - that is, they include a time stamp. If there is no `Date` header in the request that is to be proxied to the upstream, Tyk will add one.
+
+### Configuring Request Signing in the API definition
+Upstream Authentication is configured per-API in the Tyk Vendor Extension by adding the authentication section within the `upstream` section.
+
+For Request Signing, you must configure [upstream.authentication.upstreamRequestSigning](/api-management/gateway-config-tyk-oas#upstreamrequestsigning), providing the following settings:
+
+- the `signatureHeader` in which the signature should be sent (typically `Authorization`)
+- the `algorithm` to be used to generate the signature (from the table above)
+- the `secret` to be used in the encryption operation
+- optional `headers` that Tyk should include in the string that is encrypted to generate the signature
+- the `keyId` that the upstream will use to identify Tyk as the client (used for HMAC encryption)
+- the `certificateId` that the upstream will use to identify Tyk as the client (used for RSA encryption) 
+
+The Tyk Classic equivalent is [request_signing](/api-management/gateway-config-tyk-classic#upstream-authentication).
+
+### Configuring Request Signing with Tyk Operator
+
+When using Tyk Operator, the `certificateId` and `secret` are encapsulated in Kubernetes references:
+- `certificateRef`: references a Secret containing the private and secret key.
+- `secretRef`: references a Kubernetes Secret that holds the secret used in the encryption operation.
+
+For example:
+
+```yaml{linenos=true, linenostart=1, hl_lines=["66-73"]}
+ apiVersion: v1
+ data:
+   secretKey: cGFzc3dvcmQxMjM=
+ kind: Secret
+ metadata:
+   name: upstream-secret
+   namespace: default
+ type: Opaque
+ ---
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: booking
+   namespace: default
+ data:
+   test_oas.json: |-
+     {
+       "info": {
+         "title": "bin",
+         "version": "1.0.0"
+       },
+       "openapi": "3.0.3",
+       "components": {},
+       "paths": {},
+       "x-tyk-api-gateway": {
+         "info": {
+           "name": "bin",
+           "state": {
+             "active": true,
+             "internal": false
+           }
+         },
+         "server": {
+           "listenPath": {
+             "strip": true,
+             "value": "/bin/"
+           }
+         },
+         "upstream": {
+           "url": "http://httpbin.org/",
+           "authentication": {
+             "requestSigning": {
+               "enabled": true,
+               "signatureHeader": "Signature",
+               "algorithm": "hmac-sha256",
+               "keyId": "random-key-id", 
+               "headers": [],
+               "secret": ""
+             }
+           }
+         }
+       }
+     }
+ ---
+ apiVersion: tyk.tyk.io/v1alpha1
+ kind: TykOasApiDefinition
+ metadata:
+   name: booking
+   namespace: default
+ spec:
+   tykOAS:
+     configmapRef:
+       namespace: default
+       name: booking
+       keyName: test_oas.json
+   upstreamRequestSigning:
+     certificateRef: ""
+     secretRef:
+       namespace: default
+       name: upstream-secret
+       secretKey: secretKey   
+     algorithm: "hmac-sha256"
+     keyId: ""
+ ```
+In this example, a Tyk OAS API was created using the `upstreamRequestSigning` field. It can be broken down as follows:
+- `upstreamRequestSigning`: This defines the settings for Upstream Request Signing. in the example manifest, it configures Upstream Request Signing using the `booking` API.
+  - `certificateRef`: References a Secret containing the private and secret key for signing client API requests. This should be used if `secretRef` is not specified.
+  - `secretRef`: References a Kubernetes Secret that holds the secret key for signing client requests.
+  - `algorithm`: Specifies the algorithm used for signing.
+    - For `secretRef`, supported algorithms include: `hmac-sha1`, `hmac-sha256`, `hmac-sha384`, and `hmac-sha512`.
+    - For `certificateRef`, the required algorithm is `rsa-sha256`.
+  - `keyId`: A user-defined key assumed to be available on the upstream service. This is used in the `SignatureHeader` and should be included when using `certificateRef`. It is required when using the RSA algorithm.
+
+<hr />
+
diff --git a/api-management/user-management.mdx b/api-management/user-management.mdx
new file mode 100644
index 0000000000..50af3efabd
--- /dev/null
+++ b/api-management/user-management.mdx
@@ -0,0 +1,76 @@
+---
+title: "User Management with Tyk Dashboard"
+description: "Learn how to manage users, teams, permissions, and Role-Based Access Control (RBAC) in the Tyk Dashboard"
+keywords: "Dashboard, User Management, RBAC, Role Based Access Control, User Groups, Teams, Permissions, API Ownership, SSO, Single Sign On, Multi Tenancy"
+sidebarTitle: "Overview"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+## Introduction 
+
+Tyk Dashboard provides you with the ability to manage Users, Teams and Permissions enabling organizations to maintain robust control over access and visibility. These capabilities empower teams to manage large-scale API portfolios, mitigate risks of unauthorized access, and reduce operational complexity.
+
+In this section, we delve into the following key topics: 
+
+1. **[Managing Users](/platform-management/dashboard-users)**: 
+    Streamlining user administration by creating, updating, and deactivating accounts within the Tyk Dashboard using both the UI and API, including password management, password policy and user search.
+2. **[Managing User Permissions](/platform-management/user-permissions)**: 
+    Configuring and enforcing role-based access control for users within the Tyk Dashboard, using both the API and UI.  
+3. **[Managing User Groups/Teams](/platform-management/user-groups)**: 
+    Organizing users into groups or teams to simplify role assignment, permissions management, and collaborative workflows within the Tyk Dashboard.
+4. **[Configuring API Ownership](/platform-management/api-ownership)**: 
+    Applying role-based access control to APIs to govern visibility and manageability for specific teams or users.
+5. **[Managing Users across Multiple Tyk Organizations](#manage-tyk-dashboard-users-in-multiple-organizations)**: 
+    Administering user access and roles across multiple organizations, ensuring consistent and secure management in multi-tenant setups.  
+6. **[Single Sign-On](#single-sign-on-integration)**: 
+    Integrating and configuring Single Sign-On (SSO) solutions to streamline authentication and enhance security across the Tyk Dashboard.  
+
+<br />
+
+<Note>
+The availability of some features described in this section depends on your license.
+<br />
+For further information, please check our [price comparison](https://tyk.io/price-comparison/) or consult our sales and expert engineers:
+<ButtonLeft href="https://tyk.io/contact/" color="green" content="Contact us" />
+</Note>
+ 
+
+## Understanding "User" in Tyk
+
+In the context of Tyk, a User refers to an individual responsible for managing, configuring, and maintaining the Tyk API Gateway and its related components. These users interact with the Tyk Dashboard and API to control various aspects such as API management, user permissions, security policies, and organizational settings. This term does not refer to end-users or consumers of the APIs managed through Tyk but specifically to administrators and developers operating the Tyk ecosystem.
+
+## Initial Admin User Creation
+
+When you start the Tyk Dashboard the first time, the bootstrap process creates an initial "user" for you with admin permissions, which allows them access to control and configure everything in the Dashboard (via the UI or Tyk Dashboard API).
+
+
+## Manage Tyk Dashboard Users in Multiple Organizations
+
+If you have deployed multiple [Tyk Organizations](/dashboard-admin-api#organizations), you may have users that need access to more than one Organization (known as a "multi-org user"). **This functionality requires a specific Tyk license.**
+
+To support multi-org users, you must first enable the feature in your Dashboard configuration by setting either of the following to `true`:
+ - `"enable_multi_org_users"` in `tyk_analytics.conf`
+ - `TYK_DB_ENABLEMULTIORGUSERS` environment variable
+
+You then must create users in both Organizations with identical credentials.
+
+During the login flow the user will see an additional page asking them to pick which available Organization they wish to log into. Once logged in, the user will have an additional drop-down in the top right navigation menu allowing them to switch between Organizations quickly. 
+
+
+<Note>
+A user that does not belong to an Organization is sometimes referred to as an *unbounded user*. These users have visibility across all Organizations, but should be granted read-only access.
+</Note>
+
+
+## Single Sign-On Integration
+
+Tyk Identity Broker (TIB) enables Single Sign-On (SSO) for Tyk Dashboard, allowing users to authenticate with an external identity provider instead of a separate Dashboard account.
+
+<Warning>
+By default, users who log in via SSO are granted admin permissions. You must configure either default permissions or a default user group to prevent this. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso#unregistered-user-login) for full details on configuring SSO behavior, user permissions, and user group mapping.
+</Warning>
+
+For full SSO documentation including setup guides for specific identity providers, see:
+- [SSO into Tyk Dashboard](/tyk-identity-broker/dashboard-sso)
+- [Tyk Identity Broker Overview](/tyk-identity-broker/overview)
diff --git a/apim.mdx b/apim.mdx
new file mode 100644
index 0000000000..4e45d615a2
--- /dev/null
+++ b/apim.mdx
@@ -0,0 +1,53 @@
+---
+title: "Tyk API Management Deployment Options"
+description: "A guide to choosing the best Tyk deployment option for your API management needs"
+keywords: "Tyk API Management, Licensing, Open Source, Self-Managed, Tyk Cloud, API Gateway"
+sidebarTitle: "Deployment Options"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+import SelfManagedLicensingInclude from '/snippets/self-managed-licensing-include.mdx';
+
+Tyk API Platform offers various deployment options, consisting of both [open source and proprietary](/tyk-stack)
+components.
+
+Choosing the right one for your organization depends on your specific requirements and preferences.
+<br />Don’t hesitate to contact us for assistance <ButtonLeft href="https://tyk.io/contact/" color="green" content="Contact us" />
+
+|                                                                                                                                                                                                                                    | [Open Source](/tyk-open-source)  |   [Self-Managed](/tyk-self-managed/install)      |  [Cloud](https://account.cloud-ara.tyk.io/signup)
+|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-------------------|---------
+| API Gateway Capabilities <br /> <ul><li>Rate Limiting</li><li>Authentication</li> <li>API Versioning</li><li>Granular Access Control</li><li>GraphQL</li>  <li>and [much more](/tyk-open-source)</li></ul> | ✅             |✅	              |✅
+| [Version Control](/api-management/automations/sync) Integration                                                                                                                                                      | -		      |✅	              |✅
+| [API Analytics Exporter](/api-management/tyk-pump)                                                                                                                                                                                   | ✅		      |✅	              |✅	 
+| [Tyk Dashboard](/api-management/dashboard-configuration)                                                                                                                                                                                       | -	          |✅	              |✅	 
+| [Single Sign On (SSO)](/tyk-identity-broker/dashboard-sso)                                                                                                                                                         | -	          |✅	              |✅	      
+| [RBAC and API Teams](/api-management/user-management)                                                                                                                                                                             | -	          |✅	              |✅	      
+| [Universal Data Graph](/api-management/data-graph#overview)                                                                                                                                                                         | -	          |✅	              |✅	      
+| [Multi-Tenant](/dashboard-admin-api#organizations)                                                                                                                                           | -	          |✅	              |✅	      
+| [Multi-Data Center](/api-management/mdcb#managing-geographically-distributed-gateways-to-minimize-latency-and-protect-data-sovereignty)                                                                                                                                                                           | -	          |✅	              |✅	      
+| [Developer Portal](/portal/overview/intro)                                                                                                                                                                             | -		      |✅	              |✅	 
+| [Developer API Analytics](/api-management/dashboard-analytics#traffic-analytics)                                                                                                                                                                   | -		      |✅	              |✅	   
+| Hybrid Deployments                                                                                                                                                                                                                 | -		      |-	              |✅
+| Fully-Managed SaaS                                                                                                                                                                                                                 | -		      |-	              |✅
+| [HIPAA, SOC2, PCI](https://tyk.io/governance-and-auditing/)                                                                                                                                                                        | ✅		      |✅	              | -
+
+
+## Licensing
+
+### Self-managed (On-Prem)
+
+<SelfManagedLicensingInclude/>
+
+### Cloud (Software as a Service / SaaS)
+
+Tyk cloud is a fully managed service that makes it easy for API teams to create, secure, publish and maintain APIs at any scale, anywhere in the world. Tyk Cloud includes everything you need to manage your global API ecosystem.
+
+Get your free account [here](https://tyk.io/sign-up/).
+
+### Open Source (OSS)
+
+The Tyk Gateway is the backbone of all our solutions and can be deployed for free, forever. It offers various [installation options](/apim/open-source/installation) to suit different needs.
+
+Visit the [OSS section](/tyk-open-source) for more information on it and other open source components.
+
+Explore the various open and closed source [Tyk components](/tyk-stack) that are part of the Tyk platform solutions.
diff --git a/apim/open-source/installation.mdx b/apim/open-source/installation.mdx
new file mode 100644
index 0000000000..2ea4af732b
--- /dev/null
+++ b/apim/open-source/installation.mdx
@@ -0,0 +1,686 @@
+---
+title: "Installation Options for Tyk Gateway"
+description: "This page serves as a comprehensive guide to installing Tyk Gateway Open Source"
+keywords: "installation, migration, open source"
+sidebarTitle: "Installation Options"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+
+## Introduction
+
+The backbone of all our products is our open source Gateway. You can install our Open Source / Community Edition on the following platforms:
+
+<ResponsiveGrid>
+
+
+<Card href="/deployment-and-operations/tyk-open-source-api-gateway/quick-start" img="/img/docker.png">
+**Read time: 2 mins**
+
+Install with Docker.
+</Card>
+
+<Card href="/apim/open-source/installation#install-tyk-gateway-with-kubernetes" img="/img/k8s.png">
+**Read time: 10 mins**
+
+Install with K8s.
+</Card>
+
+<Card href="/apim/open-source/installation#install-tyk-gateway-with-ansible" img="/img/ansible.png">
+**Read time: 10 mins**
+
+Install with Ansible.
+</Card>
+
+<Card href="/apim/open-source/installation#install-tyk-gateway-on-red-hat-rhel-%2F-centos" img="/img/redhat-logo2.png">
+**Read time: 10 mins**
+
+Install on RHEL / CentOS.
+</Card>
+
+<Card href="/apim/open-source/installation#install-tyk-gateway-with-ubuntu" img="/img/debian-nd-753.png">
+**Read time: 10 mins**
+
+Install on Debian / Ubuntu.
+</Card>
+
+<Card href="https://github.com/TykTechnologies/tyk" img="/img/GitHub-Mark-64px.png">
+**Read time: 10 mins**
+
+Visit our Gateway GitHub Repo.
+</Card>
+
+
+</ResponsiveGrid>
+
+## Install Tyk Gateway with Kubernetes
+
+The main way to install the Open Source *Tyk Gateway* in a Kubernetes cluster is via Helm charts. 
+We are actively working to add flexibility and more user flows to our chart. Please reach out
+to our teams on support or the community forum if you have questions, requests or suggestions for improvements.
+
+Get started with our [Quick Start guide](#quick-start-with-helm-chart) or go to [Tyk Open Source helm chart](/product-stack/tyk-charts/tyk-oss-chart) for detailed installation instructions and configuration options.
+
+### Quick Start with Helm Chart
+
+At the end of this quick start, Tyk Gateway should be accessible through the service `gateway-svc-tyk-oss-tyk-gateway` at port `8080`. 
+The following guides provide instructions to install Redis and Tyk Open Source with default configurations. It is intended for a quick start only. For production, you should install and configure Redis separately. 
+
+#### Prerequisites
+
+1. [Kubernetes 1.19+](https://kubernetes.io/docs/setup/)
+2. [Helm 3+](https://helm.sh/docs/intro/install/)
+
+#### Steps for Installation
+
+1. **Install Redis and Tyk**
+
+```bash
+NAMESPACE=tyk-oss
+APISecret=foo
+REDIS_BITNAMI_CHART_VERSION=19.0.2
+
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --create-namespace --install --version $REDIS_BITNAMI_CHART_VERSION --set image.repository=bitnamilegacy/redis
+
+helm upgrade tyk-oss tyk-helm/tyk-oss -n $NAMESPACE --create-namespace \
+  --install \
+  --set global.secrets.APISecret="$APISecret" \
+  --set global.redis.addrs="{tyk-redis-master.$NAMESPACE.svc.cluster.local:6379}" \
+  --set global.redis.passSecret.name=tyk-redis \
+  --set global.redis.passSecret.keyName=redis-password
+```
+
+2. **Done!**
+
+Now Tyk Gateway should be accessible through service `gateway-svc-tyk-oss-tyk-gateway` at port `8080`. 
+
+You are now ready to [create an API](/api-management/gateway-config-managing-classic#create-an-api).
+
+For the complete installation guide and configuration options, please see [Tyk OSS Helm Chart](/product-stack/tyk-charts/tyk-oss-chart).
+
+### Configure Legacy Tyk Headless Helm Chart
+
+<Warning>
+`tyk-headless` chart is deprecated. Please use our Tyk Chart for Tyk Open Source at [tyk-oss](#quick-start-with-helm-chart) instead. 
+
+We recommend all users migrate to the `tyk-oss` Chart. Please review the [Configuration](#quick-start-with-helm-chart) section of the new helm chart and cross-check with your existing configurations while planning for migration.
+</Warning>
+
+
+This is the preferred (and easiest) way to install the Tyk OSS Gateway on Kubernetes.
+It will install Tyk gateway in your Kubernetes cluster where you can add and manage APIs directly or via the *Tyk Operator*.
+
+#### Prerequisites
+
+The following are required for a Tyk OSS installation:
+1. Redis   - required for all the Tyk installations and must be installed in the cluster or reachable from inside K8s.
+             You can find instructions for a simple Redis installation below.
+2. MongoDB/SQL - Required only if you choose to use the MongoDB/SQL Tyk pump with your Tyk OSS installation. The same goes for any
+             [other pump](/api-management/logs/external-data-sinks) you choose to use.
+3. Helm - Tyk Helm supports the Helm 3+ version.
+
+#### Steps for Installation
+
+As well as our official OSS Helm repo, you can also find it in [ArtifactHub](https://artifacthub.io/packages/helm/tyk-helm/tyk-headless).
+[Open in ArtifactHub](https://artifacthub.io/packages/helm/tyk-helm/tyk-headless)
+
+If you are interested in contributing to our charts, suggesting changes, creating PRs, or any other way,
+please use [GitHub Tyk-helm-chart repo](https://github.com/TykTechnologies/tyk-helm-chart/tree/master/tyk-headless)
+
+1. **Add Tyk official Helm repo**
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+```
+
+2. **Create a namespace for Tyk deployment**
+
+```bash
+kubectl create namespace tyk
+```
+
+3. **Getting values.yaml**
+
+Before we proceed with installation of the chart you may need to set some custom values.
+To see what options are configurable on a chart and save those options to a custom `values.yaml` file run:
+
+```bash
+helm show values tyk-helm/tyk-headless > values.yaml
+```
+
+Some of the necessary configuration parameters will be explained in the next steps.
+
+4. **Installing Redis**
+
+* Recommended: via *Bitnami* chart - For Redis, you can use these rather excellent chart provided by Bitnami.
+Copy the following commands to add it: 
+
+  ```bash
+  helm repo add bitnami https://charts.bitnami.com/bitnami
+  helm install tyk-redis bitnami/redis -n tyk --version 19.0.2 --set image.repository=bitnamilegacy/redis
+  ```
+
+
+<Note>
+Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get a list of [supported versions](/tyk-configuration-reference/redis-cluster-sentinel#supported-versions).
+</Note>
+
+
+Follow the notes from the installation output to get connection details and password.
+
+```
+  Redis(TM) can be accessed on the following DNS names from within your cluster:
+
+    tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
+    tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)
+
+  export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)
+```
+
+The DNS name of your Redis as set by Bitnami is `tyk-redis-master.tyk.svc.cluster.local:6379`
+You can update them in your local `values.yaml` file under `redis.addrs` and `redis.pass`
+Alternatively, you can use `--set` flag to set it in the Tyk installation. For example  `--set redis.pass=$REDIS_PASSWORD`
+
+**For evaluation only: Use *simple-redis* chart**
+
+
+<Warning>
+Another option for Redis, to get started quickly, is to use our *simple-redis* chart.
+Please note that these provided charts must never be used in production or for anything
+but a quick start evaluation only. Use Bitnami Redis or Official Redis Helm chart in any other case.
+We provide this chart, so you can quickly deploy *Tyk gateway*, but it is not meant for long-term storage of data.
+</Warning>
+
+
+```bash
+helm install redis tyk-helm/simple-redis -n tyk
+```
+
+5. **Installing Tyk Open Source Gateway**
+
+```bash
+helm install tyk-ce tyk-helm/tyk-headless -f values.yaml -n tyk
+ ```
+
+Please note that by default, Gateway runs as `Deployment` with `ReplicaCount` as 1. You should not update this part because multiple instances of OSS gateways won't sync the API Definition.
+
+#### Installation Video
+
+See our short video on how to install the Tyk Open Source Gateway.
+Please note that this video shows the use of the Github repository since it was recorded before the official repo was available, However,
+it's very similar to the above commands.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/mkyl38sBAF0" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+#### Pump Installation
+By default pump installation is disabled. You can enable it by setting `pump.enabled` to `true` in `values.yaml` file.
+Alternatively, you can use `--set pump.enabled=true` while doing Helm install.
+
+**Quick Pump configuration(Supported from tyk helm v0.10.0)**
+*1. Mongo Pump*
+
+To configure the Mongo pump, make the following changes in `values.yaml` file:
+1. Set `backend` to `mongo`.
+2. Set connection string in `mongo.mongoURL`.
+
+*2. Postgres Pump*
+
+To configure the Postgres pump, make the following changes in `values.yaml` file:
+1. Set `backend` to `postgres`.
+2. Set connection string parameters in `postgres` section.
+
+#### Optional - Using TLS
+You can turn on the TLS option under the gateway section in your local `values.yaml` file which will make your Gateway
+listen on port 443 and load up a dummy certificate.
+You can set your own default certificate by replacing the file in the `certs/` folder.
+
+#### Optional - Mounting Files
+To mount files to any of the Tyk stack components, add the following to the mounts array in the section of that component.
+
+For example:
+ ```bash
+ - name: aws-mongo-ssl-cert
+  filename: rds-combined-ca-bundle.pem
+  mountPath: /etc/certs
+```
+
+#### Optional - Tyk Ingress
+To set up an ingress for your Tyk Gateways see our [Tyk Operator GitHub repository](https://github.com/TykTechnologies/tyk-operator).
+
+
+## Install Tyk Gateway with Ansible
+
+### Prerequisites
+
+1. [Ansible](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html) is required to run the following commands.
+2. Ensure port `8080` is open: this is used in this guide for Gateway traffic (the API traffic to be proxied).
+
+### Steps for Installation
+1. Clone the [tyk-ansible](https://github.com/TykTechnologies/tyk-ansible) repository
+
+```bash
+$ git clone https://github.com/TykTechnologies/tyk-ansible
+```
+
+2. `cd` into the directory
+```.bash
+$ cd tyk-ansible
+```
+
+3. Run the init script to initialize the environment
+
+```bash
+$ sh scripts/init.sh
+```
+
+4. Modify the `hosts.yml` file to update SSH variables to your server(s). For more information about the host file, visit the [Ansible inventory documentation] (https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html)
+
+5. Run ansible-playbook to install `tyk-ce`
+
+```bash
+$ ansible-playbook playbook.yaml -t tyk-ce -t redis
+```
+
+You can choose to not install Redis by removing the `-t redis`. However, Redis is a requirement and needs to be installed for the gateway to run.
+
+### Supported Distributions
+| Distribution | Version | Supported |
+| --------- | :---------: | :---------: |
+| Amazon Linux | 2 | ✅ |
+| CentOS | 8 | ✅ |
+| CentOS | 7 | ✅ |
+| Debian | 10 | ✅ |
+| Debian | 9 | ✅ |
+| RHEL | 9 | ✅ |
+| RHEL | 8 | ✅ |
+| RHEL | 7 | ✅ |
+| Ubuntu | 21 | ✅ |
+| Ubuntu | 20 | ✅ |
+| Ubuntu | 18 | ✅ |
+| Ubuntu | 16 | ✅ |
+
+### Variables
+- `vars/tyk.yaml`
+
+| Variable | Default | Comments |
+| --------- | :---------: | --------- |
+| secrets.APISecret | `352d20ee67be67f6340b4c0605b044b7` | API secret |
+| secrets.AdminSecret | `12345` | Admin secret |
+| redis.host |  | Redis server host if different than the host url |
+| redis.port | `6379` | Redis server listening port |
+| redis.pass |  | Redis server password |
+| redis.enableCluster | `false` | Enable if Redis is running in cluster mode |
+| redis.storage.database | `0` | Redis server database |
+| redis.tls | `false` | Enable if Redis connection is secured with SSL |
+| gateway.service.host | | Gateway server host if different than the host url |
+| gateway.service.port | `8080` | Gateway server listening port |
+| gateway.service.proto | `http` | Gateway server protocol |
+| gateway.service.tls | `false` | Set to `true` to enable SSL connections |
+| gateway.sharding.enabled | `false` | Set to `true` to enable filtering (sharding) of APIs |
+| gateway.sharding.tags | | The tags to use when filtering (sharding) Tyk Gateway nodes. Tags are processed as OR operations. If you include a non-filter tag (e.g. an identifier such as `node-id-1`, this will become available to your Dashboard analytics) |
+
+- `vars/redis.yaml`
+
+| Variable | Default | Comments |
+| --------- | :---------: | --------- |
+| redis_bind_interface | `0.0.0.0` | Binding address of Redis |
+
+Read more about Redis configuration [here](https://github.com/geerlingguy/ansible-role-redis).
+
+## Install Tyk Gateway with Ubuntu
+
+The Tyk Gateway can be installed following different installation methods including *Ansible* and *Shell*. Please select by clicking the tab with the installation path most suitable for you.
+
+### Install Tyk Gateway On Ubuntu Through Shell
+
+#### 
+
+| Distribution | Version | Supported |
+| --------- | :---------: | :---------: |
+| Debian | 11 | ✅ |
+| Ubuntu | 20 | ✅ |
+| Ubuntu | 18 | ✅ |
+| Ubuntu | 16 | ✅ |
+
+#### Prerequisites
+
+1. Ensure port `8080` is open: this is used in this guide for Gateway traffic (the API traffic to be proxied).
+
+#### Steps for Installation
+
+1. **Install Redis**
+
+```console
+$ sudo apt-get install -y redis-server
+```
+
+2. **First import the public key as required by Ubuntu APT**
+
+```console
+$ sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv EA312927
+```
+
+3. **Run Installation Scripts via our PackageCloud Repositories**
+
+From [https://packagecloud.io/tyk/tyk-gateway](https://packagecloud.io/tyk/tyk-gateway) you have the following options:
+
+* Via the correct package for your Ubuntu version. We have packages for the following:
+ * Xenial
+ * Trusty
+ * Precise
+
+* Via Quick Installation Instructions. You can use: 
+ * [Manual Instructions](https://packagecloud.io/tyk/tyk-gateway/install#manual-deb)
+ * [Chef](https://packagecloud.io/tyk/tyk-gateway/install#chef)
+ * [Puppet](https://packagecloud.io/tyk/tyk-gateway/install#puppet)
+ * [CI and Build Tools](https://packagecloud.io/tyk/tyk-gateway/ci)
+
+4. **Configure The Gateway**
+
+You can set up the core settings for the Tyk Gateway with a single setup script, however for more involved deployments, you will want to provide your own configuration file.
+
+
+<Note>
+You need to replace `<hostname>` for `--redishost=<hostname>` with your own value to run this script.
+</Note>
+
+
+
+```console
+$ sudo /opt/tyk-gateway/install/setup.sh --listenport=8080 --redishost=<hostname> --redisport=6379 --domain=""
+```
+
+What you've done here is tell the setup script that:
+
+*   `--listenport=8080`: Listen on port `8080` for API traffic.
+*   `--redishost=<hostname>`: The hostname for Redis.
+*   `--redisport=6379`: Use port `6379` for Redis.
+*   `--domain=""`: Do not filter domains for the Gateway, see the note on domains below for more about this.
+
+In this example, you don't want Tyk to listen on a single domain. It is recommended to leave the Tyk Gateway domain unbounded for flexibility and ease of deployment.
+
+5. **Starting Tyk**
+
+The Tyk Gateway can be started now that it is configured. Use this command to start the Tyk Gateway:
+```console
+$ sudo service tyk-gateway start
+```
+
+### Install Tyk Gateway On Ubuntu Through Ansible
+
+#### Supported Distributions
+
+| Distribution | Version | Supported |
+| --------- | :---------: | :---------: |
+| Debian | 11 | ✅ |
+| Ubuntu | 20 | ✅ |
+| Ubuntu | 18 | ✅ |
+| Ubuntu | 16 | ✅ |
+
+#### Prerequisites
+
+Before you begin the installation process, make sure you have the following:
+- [Git](https://git-scm.com/download/linux) - required for getting the installation files.
+- [Ansible](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html) is required to run the following commands. 
+- Ensure port `8080` is open: this is used in this guide for Gateway traffic (the API traffic to be proxied).
+
+#### Steps for Installation
+
+1. **Clone the [tyk-ansible](https://github.com/TykTechnologies/tyk-ansible) repository**
+
+```bash
+$ git clone https://github.com/TykTechnologies/tyk-ansible
+```
+
+2. **`cd` into the directory**
+```bash
+$ cd tyk-ansible
+```
+
+3. **Run initalisation script to initialise environment**
+
+```bash
+$ sh scripts/init.sh
+```
+
+4. Modify `hosts.yml` file to update ssh variables to your server(s). You can learn more about the hosts file [here](https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html)
+
+5. **Run ansible-playbook to install `tyk-gateway-ce`**
+
+```bash
+$ ansible-playbook playbook.yaml -t tyk-gateway-ce -t redis
+```
+
+<Note>
+Installation flavors can be specified by using the -t {tag} at the end of the ansible-playbook command. In this case we are using:
+-`tyk-gateway-ce`: Tyk Gateway with CE config
+-`redis`: Redis database as Tyk Gateway dependency
+</Note>
+
+
+#### Variables
+
+- `vars/tyk.yaml`
+
+| Variable | Default | Comments |
+| --------- | :---------: | --------- |
+| secrets.APISecret | `352d20ee67be67f6340b4c0605b044b7` | API secret |
+| secrets.AdminSecret | `12345` | Admin secret |
+| redis.host |  | Redis server host if different than the hosts url |
+| redis.port | `6379` | Redis server listening port |
+| redis.pass |  | Redis server password |
+| redis.enableCluster | `false` | Enable if redis is running in cluster mode |
+| redis.storage.database | `0` | Redis server database |
+| redis.tls | `false` | Enable if redis connection is secured with SSL |
+| gateway.service.host | | Gateway server host if different than the hosts url |
+| gateway.service.port | `8080` | Gateway server listening port |
+| gateway.service.proto | `http` | Gateway server protocol |
+| gateway.service.tls | `false` | Set to `true` to enable SSL connections |
+| gateway.sharding.enabled | `false` | Set to `true` to enable filtering (sharding) of APIs |
+| gateway.sharding.tags | | The tags to use when filtering (sharding) Tyk Gateway nodes. Tags are processed as OR operations. If you include a non-filter tag (e.g. an identifier such as `node-id-1`, this will become available to your Dashboard analytics) |
+
+- `vars/redis.yaml`
+
+| Variable | Default | Comments |
+| --------- | :---------: | --------- |
+| redis_bind_interface | `0.0.0.0` | Binding address of Redis |
+
+Read more about Redis configuration [here](https://github.com/geerlingguy/ansible-role-redis).
+
+
+## Install Tyk Gateway on Red Hat (RHEL / CentOS)
+
+The Tyk Gateway can be installed following different installation methods including *Shell* and *Ansible*. Please select by clicking the tab with the installation path most suitable for you.
+
+### Install Tyk Gateway Through Shell
+
+#### Supported Distributions
+
+| Distribution | Version | Supported |
+| --------- | :---------: | :---------: |
+| CentOS | 8 | ✅ |
+| CentOS | 7 | ✅ |
+| RHEL | 9 | ✅ |
+| RHEL | 8 | ✅ |
+| RHEL | 7 | ✅ |
+
+#### Prerequisites
+
+Before you begin the installation process, make sure you have the following:
+
+*   Ensure port `8080` is open for Gateway traffic (the API traffic to be proxied).
+*   The Tyk Gateway has a [dependency](/tyk-configuration-reference/redis-cluster-sentinel#supported-versions) on Redis. Follow the steps provided by Red Hat to make the installation of Redis, conducting a [search](https://access.redhat.com/search/?q=redis) for the correct version and distribution.
+
+#### Steps for Installation 
+1. **Create Tyk Gateway Repository Configuration**
+
+Create a file named `/etc/yum.repos.d/tyk_tyk-gateway.repo` that contains the repository configuration settings for YUM repositories `tyk_tyk-gateway` and `tyk_tyk-gateway-source` used to download packages from the specified URLs. This includes GPG key verification and SSL settings, on a Linux system.
+
+Make sure to replace `el` and `8` in the config below with your Linux distribution and version:
+```bash
+[tyk_tyk-gateway]
+name=tyk_tyk-gateway
+baseurl=https://packagecloud.io/tyk/tyk-gateway/el/8/$basearch
+repo_gpgcheck=1
+gpgcheck=0
+enabled=1
+gpgkey=https://packagecloud.io/tyk/tyk-gateway/gpgkey
+sslverify=1
+sslcacert=/etc/pki/tls/certs/ca-bundle.crt
+metadata_expire=300
+
+[tyk_tyk-gateway-source]
+name=tyk_tyk-gateway-source
+baseurl=https://packagecloud.io/tyk/tyk-gateway/el/8/SRPMS
+repo_gpgcheck=1
+gpgcheck=0
+enabled=1
+gpgkey=https://packagecloud.io/tyk/tyk-gateway/gpgkey
+sslverify=1
+sslcacert=/etc/pki/tls/certs/ca-bundle.crt
+metadata_expire=300
+```
+
+Update your local yum cache by running:
+```bash
+sudo yum -q makecache -y --disablerepo='*' --enablerepo='tyk_tyk-gateway'
+```
+
+2. **Install Tyk Gateway**
+
+Install the Tyk Gateway using yum:
+```bash
+sudo yum install -y tyk-gateway
+```
+
+<Note>
+You may be asked to accept the GPG key for our two repos and when the package installs, hit yes to continue.
+</Note>
+
+
+3. **Start Redis**
+
+If Redis is not running then start it using the following command:
+```bash
+sudo service redis start
+```
+4. **Configuring The Gateway**
+
+You can set up the core settings for the Tyk Gateway with a single setup script, however for more complex deployments you will want to provide your own configuration file.
+
+
+<Note>
+Replace `<hostname>` in `--redishost=<hostname>` with your own value to run this script.
+</Note>
+
+
+```bash
+sudo /opt/tyk-gateway/install/setup.sh --listenport=8080 --redishost=<hostname> --redisport=6379 --domain=""
+```
+
+What you've done here is told the setup script that:
+
+*   `--listenport=8080`: Listen on port `8080` for API traffic.
+*   `--redishost=<hostname>`: The hostname for Redis.
+*   `--redisport=6379`: Use port `6379` for Redis.
+*   `--domain=""`: Do not filter domains for the Gateway, see the note on domains below for more about this.
+
+In this example, you don't want Tyk to listen on a single domain. It is recommended to leave the Tyk Gateway domain unbounded for flexibility and ease of deployment.
+
+5. **Start the Tyk Gateway**
+
+The Tyk Gateway can be started now that it is configured. Use this command to start the Tyk Gateway:
+```bash
+sudo service tyk-gateway start
+```
+
+### Install Tyk Gateway Through Ansible
+
+#### Supported Distributions
+
+| Distribution | Version | Supported |
+| --------- | :---------: | :---------: |
+| CentOS | 8 | ✅ |
+| CentOS | 7 | ✅ |
+| RHEL | 9 | ✅ |
+| RHEL | 8 | ✅ |
+| RHEL | 7 | ✅ |
+
+#### Prerequisites
+Before you begin the installation process, make sure you have the following:
+
+1. [Git](https://git-scm.com/download/linux) - required for getting the installation files.
+2. [Ansible](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html) - required for running the commands below.
+3. Ensure port `8080` is open: this is used in this guide for Gateway traffic (the API traffic to be proxied).
+
+#### Steps for Installation
+
+1. **Clone the [tyk-ansible](https://github.com/TykTechnologies/tyk-ansible) repository**
+
+```bash
+$ git clone https://github.com/TykTechnologies/tyk-ansible
+```
+
+2. **`cd` into the directory**
+```bash
+$ cd tyk-ansible
+```
+
+3. **Run the initalisation script to initialise your environment**
+
+```bash
+$ sh scripts/init.sh
+```
+
+4. Modify the `hosts.yml` file to update ssh variables to your server(s). You can learn more about the hosts file [here](https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html)
+
+5. **Run ansible-playbook to install `tyk-gateway-ce`**
+
+```bash
+$ ansible-playbook playbook.yaml -t tyk-gateway-ce -t redis
+```
+
+<Note>
+Installation flavors can be specified by using the -t {tag} at the end of the ansible-playbook command. In this case we are using:
+  -`tyk-gateway-ce`: Tyk Gateway with CE config
+  -`redis`: Redis database as Tyk Gateway dependency
+</Note>
+
+
+#### Variables
+- `vars/tyk.yaml`
+
+| Variable | Default | Comments |
+| --------- | :---------: | --------- |
+| secrets.APISecret | `352d20ee67be67f6340b4c0605b044b7` | API secret |
+| secrets.AdminSecret | `12345` | Admin secret |
+| redis.host |  | Redis server host if different than the hosts url |
+| redis.port | `6379` | Redis server listening port |
+| redis.pass |  | Redis server password |
+| redis.enableCluster | `false` | Enable if redis is running in cluster mode |
+| redis.storage.database | `0` | Redis server database |
+| redis.tls | `false` | Enable if redis connection is secured with SSL |
+| gateway.service.host | | Gateway server host if different than the hosts url |
+| gateway.service.port | `8080` | Gateway server listening port |
+| gateway.service.proto | `http` | Gateway server protocol |
+| gateway.service.tls | `false` | Set to `true` to enable SSL connections |
+| gateway.sharding.enabled | `false` | Set to `true` to enable filtering (sharding) of APIs |
+| gateway.sharding.tags | | The tags to use when filtering (sharding) Tyk Gateway nodes. Tags are processed as OR operations. If you include a non-filter tag (e.g. an identifier such as `node-id-1`, this will become available to your Dashboard analytics) |
+
+- `vars/redis.yaml`
+
+| Variable | Default | Comments |
+| --------- | :---------: | --------- |
+| redis_bind_interface | `0.0.0.0` | Binding address of Redis |
+
+Read more about Redis configuration [here](https://github.com/geerlingguy/ansible-role-redis).
+
+## Install Tyk Gateway on Killercoda
+
+[Killercoda](https://killercoda.com/about) gives you instant access to a real Linux or Kubernetes command-line environment via your browser. 
+You can try this [Killercoda Tyk scenario](https://killercoda.com/tyk-tutorials/scenario/Tyk-install-OSS-docker-compose) to walk through the installation of our Open Source Gateway using Docker Compose (the exact same flow shown above).
+
diff --git a/basic-config-and-security/security/authentication-authorization/hmac-signatures.mdx b/basic-config-and-security/security/authentication-authorization/hmac-signatures.mdx
new file mode 100644
index 0000000000..b5411c0dd3
--- /dev/null
+++ b/basic-config-and-security/security/authentication-authorization/hmac-signatures.mdx
@@ -0,0 +1,147 @@
+---
+title: "Sign Requests with HMAC"
+description: "How to configure HMAC Signatures in Tyk"
+keywords: "Authentication, HMAC"
+sidebarTitle: "HMAC Signatures"
+---
+
+## Introduction
+
+Hash-Based Message Authentication Code (HMAC) Signing is an access token method that adds another level of security by forcing the requesting client to also send along a signature that identifies the request temporally to ensure that the request is from the requesting user, using a secret key that is never broadcast over the wire.
+
+Tyk currently implements the latest draft of the [HMAC Request Signing standard](http://tools.ietf.org/html/draft-cavage-http-signatures-05).
+
+HMAC Signing is a good way to secure an API if message reliability is paramount, it goes without saying that all requests should go via TLS/SSL to ensure that MITM attacks can be minimized. There are many ways of managing HMAC, and because of the additional encryption processing overhead requests will be marginally slower than more standard access methods.
+
+An HMAC signature is essentially some additional data sent along with a request to identify the end-user using a hashed value, in our case we encode the 'date' header of a request, the algorithm would look like:
+
+```
+Base64Encode(HMAC-SHA1("date: Mon, 02 Jan 2006 15:04:05 MST", secret_key))
+```
+
+The full request header for an HMAC request uses the standard `Authorization` header, and uses set, stripped comma-delimited fields to identify the user, from the draft proposal:
+
+```
+Authorization: Signature keyId="hmac-key-1",algorithm="hmac-sha1",signature="Base64Encode(HMAC-SHA1(signing string))"
+```
+
+Tyk supports the following HMAC algorithms: "hmac-sha1", "hmac-sha256", "hmac-sha384", "hmac-sha512”, and reads value from algorithm header. You can limit the allowed algorithms by setting the `hmac.allowedAlgorithms` (Tyk Classic: `hmac_allowed_algorithms`) field in your API definition, like this: `"hmac_allowed_algorithms": ["hmac-sha256", "hmac-sha512"]`.
+
+The date format for an encoded string is:
+
+```
+Mon, 02 Jan 2006 15:04:05 MST
+```
+
+This is the standard for most browsers, but it is worth noting that requests will fail if they do not use the above format.
+
+## How Tyk validates the signature of incoming requests
+
+When an HMAC-signed request comes into Tyk, the key is extracted from the `Authorization` header, and retrieved from Redis. If a key exists then Tyk will generate its own signature based on the request's "date" header, if this generated signature matches the signature in the `Authorization` header the request is passed.
+
+### Supported headers
+
+Tyk API Gateway supports full header signing through the use of the `headers` HMAC signature field. This includes the request method and path using the`(request-target)` value. For body signature verification, HTTP Digest headers should be included in the request and in the header field value.
+
+
+<Note>
+All headers should be in lowercase.
+</Note>
+
+
+#### Date header not allowed for legacy .Net
+
+Older versions of some programming frameworks do not allow the Date header to be set, which can causes problems with implementing HMAC, therefore, if Tyk detects a `x-aux-date` header, it will use this to replace the Date header.
+
+### Clock Skew
+
+Tyk also implements the recommended clock-skew from the specification to prevent against replay attacks, a minimum lag of 300ms is allowed on either side of the date stamp, any more or less and the request will be rejected. This means that requesting machines need to be synchronised with NTP if possible.
+
+You can edit the length of the clock skew in the API Definition by setting the `hmac.allowedClockSkew` (Tyk Classic: `hmac_allowed_clock_skew`) value. This value will default to 0, which deactivates clock skew checks.
+
+## Setting up HMAC using the Dashboard
+
+To enable the use of HMAC Signing in your API from the Dashboard:
+
+1. Scroll to the **Authentication** options
+2. Select **HMAC (Signed Authentication Key)** from the drop-down list
+3. Configure your **HMAC Request Signing** settings.
+4. Select **Strip Authorization Data** to strip any authorization data from your API requests.
+5. Select the location of the signature in the request.
+
+<img src="/img/dashboard/api-designer/tyk-oas-hmac-auth-settings.png" alt="Configuring HMAC request signing" />
+
+## Configuring your API to use HMAC Request Signing
+
+HMAC request signing is configured within the Tyk Vendor Extension by adding the `hmac` object within the `server.authentication` section and enabling authentication.
+
+You must indicate where Tyk should look for the request signature (`header`, `query` or `cookie`) and which `algorithm` will be used to encrypt the secret to create the signature. You can also optionally configure a limit for the `allowedClockSkew` between the timestamp in the signature and the current time as measured by Tyk. 
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      hmac:
+        enabled: true
+        header:
+          enabled: true
+          name: Authorization
+        allowedAlgorithms:
+          - hmac-sha256
+        allowedClockSkew: -1
+```
+
+Note that URL query parameter keys and cookie names are case sensitive, whereas header names are case insensitive.
+
+You can optionally [strip the auth token](/api-management/client-authentication#managing-authorization-data) from the request prior to proxying to the upstream using the `authentication.stripAuthorizationData` field  (Tyk Classic: `strip_auth_data`).
+
+### Using Tyk Classic
+
+As noted in the Tyk Classic API [documentation](/api-management/gateway-config-tyk-classic#configuring-authentication-for-tyk-classic-apis), you can select HMAC Request Signing using the `enable_signature_checking` option. 
+
+## Registering an HMAC user with Tyk
+
+When using HMAC request signing, you need to provide Tyk with sufficient information to verify the client's identity from the signature in the request. You do this by creating and registering an HMAC user [Session](/api-management/access-control/sessions-and-keys/understanding-sessions) with Tyk. When this is created, a matching HMAC secret is also generated, which must be used by the client when signing their requests.
+
+The way that this is implemented is through the creation of a key that grants access to the API (as you would for an API protected by [auth token](/api-management/authentication/bearer-token)) and indicating that the key is to be used for HMAC signed requests by setting `hmac_enabled` to `true`. Tyk will return the HMAC secret in the response confirming creation of the key.
+
+When calling the API, the client would never use the key itself as a token, instead they must sign requests using the provided secret.
+
+## Generating a signature
+
+This code snippet gives an example of how a client could construct and generate a Request Signature.
+
+```{.copyWrapper}
+...
+
+refDate := "Mon, 02 Jan 2006 15:04:05 MST"
+
+// Prepare the request headers:
+tim := time.Now().Format(refDate)
+req.Header.Add("Date", tim)
+req.Header.Add("X-Test-1", "hello")
+req.Header.Add("X-Test-2", "world")
+
+// Prepare the signature to include those headers:
+signatureString := "(request-target): " + "get /your/path/goes/here"
+signatureString += "date: " + tim + "\n"
+signatureString += "x-test-1: " + "hello" + "\n"
+signatureString += "x-test-2: " + "world"
+
+// SHA1 Encode the signature
+HmacSecret := "secret-key"
+key := []byte(HmacSecret)
+h := hmac.New(sha1.New, key)
+h.Write([]byte(signatureString))
+
+// Base64 and URL Encode the string
+sigString := base64.StdEncoding.EncodeToString(h.Sum(nil))
+encodedString := url.QueryEscape(sigString)
+
+// Add the header
+req.Header.Add("Authorization", 
+  fmt.Sprintf("Signature keyId="9876",algorithm="hmac-sha1",headers="(request-target) date x-test-1 x-test-2",signature="%s"", encodedString))
+
+...
+```
diff --git a/basic-config-and-security/security/authentication-authorization/json-web-tokens.mdx b/basic-config-and-security/security/authentication-authorization/json-web-tokens.mdx
new file mode 100644
index 0000000000..da66397d45
--- /dev/null
+++ b/basic-config-and-security/security/authentication-authorization/json-web-tokens.mdx
@@ -0,0 +1,155 @@
+---
+title: "JSON Web Token (JWT) Authentication"
+description: "How to use JWT Authentication with Tyk"
+keywords: "Authentication, JWT, JSON Web Tokens"
+sidebarTitle: "Overview"
+---
+
+## Introduction
+
+JSON Web Token (JWT) is an open standard ([RFC 7519](https://datatracker.ietf.org/doc/html/rfc7519)) that defines a compact and self-contained way for securely transmitting claims between parties as a JSON object. 
+
+The information in the JSON object is digitally signed using either a secret (with the HMAC algorithm) or a public/private key pair (using RSA or ECDSA encryption) allowing the JWT to be used for client authentication.
+
+### Key Benefits
+
+- **Stateless Authentication**: Eliminates the need for server-side session storage, improving scalability.
+- **Flexible Integration**: Works with multiple identity providers including Auth0, Okta, and custom JWT issuers.
+- **Enhanced Security**: Supports multiple signature validation methods (RSA, ECDSA, HMAC) and claim verification.
+- **Granular Access Control**: Leverage JWT claims for policy enforcement and scope-based permissions.
+- **Performance Optimized**: Efficient token validation with minimal overhead and support for JWKS caching.
+
+## How JWT Authentication works with Tyk
+
+JWTs are commonly used in OAuth 2.0 and OpenID Connect flows to authenticate users and authorize access to APIs. The following diagram and steps outline the flow when using JWT Auth to secure access to your API through Tyk.
+
+<img src="/img/diagrams/diagram_docs_JSON-web-tokens@2x.png" alt="JSON Web Tokens Flow" />
+
+1. **Authentication and Token Issuance**
+
+    Alice (the *user* or *resource owner*) authenticates with an Identity Provider (IdP) via the client application (steps 1 and 2).
+    -  The IdP issues a JWT containing specific **claims** (permissions delegated by the user).
+    -  The client application receives this authorization code and exchanges it for an access token (step 3).
+    -  The client acts as the **Token Bearer**, holding the token to access protected resources on Alice's behalf.
+
+2. **Request to Gateway**
+    
+    When the client sends a request to the API gateway, it includes the access token (JWT) in the request, usually in the `Authorization` header as a Bearer token (step 4).
+
+3. **Token Validation**
+
+    Tyk validates the token's signature using the shared secret or public key(s) of the trusted issuer (IdP). This process typically involves:
+    -  Locating the JWT in the request (header, cookie, or query parameter).
+    -  Decoding the JWT header to extract the `kid` (Key ID).
+    -  Fetching public keys from configured JWKS URIs (or using a local static key).
+    -  Searching the retrieved keys for a match to the `kid`.
+    -  Validating the signature using the matching JWK.
+    -  Ensuring the token is valid and not expired.
+        -  *If any validation step fails, the request is rejected immediately.*
+
+    To know more about how Tyk validates JWT signatures and claims, see [JWT Signature Validation](/api-management/authentication/jwt-signature-validation) and [JWT Claim Validation](/api-management/authentication/jwt-claim-validation).
+
+4. **Internal Identity Creation**
+
+    Once validated, Tyk creates an internal session for the request (step 5). This session is used to control access rights, consumption limits, and analytics. Tyk does not store user credentials; instead, it links the session to Alice using an identity [extracted from the JWT claims](/api-management/authentication/jwt-authorization#identifying-the-session-owner).
+
+    To know more about how Tyk authorizes requests using JWT claims, see [JWT Authorization](/api-management/authentication/jwt-authorization).
+
+5. **Policy Enforcement**
+
+    Tyk enforces authorization by inspecting specific claims to determine which Security Policies apply (step 6):
+    -  Tyk checks the **Policy Claim** (identified by the value stored in `basePolicyClaims`).
+    -  It maps this claim to a configured Tyk Security Policy. If no direct map exists, a `defaultPolicy` may be applied.
+    -  The applied policy configures the specific Access Rights (ACLs), rate limits, and usage quotas for that specific session.
+
+    To know more about how Tyk identifies the policies to be applied, see [Identifying the Tyk Policies to be Applied](/api-management/authentication/jwt-authorization#identifying-the-tyk-policies-to-be-applied).
+
+6. **Proxy to Upstream**
+
+    If the token is valid and the policy allows the request, Tyk proxies the traffic to your upstream target service (step 7).
+
+
+### JWT Workflow
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant IdP as Identity Provider (IdP)
+    participant Client as Client Application
+    participant Tyk as Tyk Gateway
+
+    User->>IdP: Authorizes Client
+    IdP-->>Client: Issues JWT (with claims)
+    Client->>Tyk: Sends API request with JWT
+    Tyk->>IdP: (Optional) Fetch JWKS for validation
+    Tyk-->>Tyk: Validates JWT Signature
+    Tyk-->>Tyk: Extracts Claims
+    Tyk-->>Tyk: Applies Security Policies based on Claims
+    Tyk-->>Client: Forwards request or responds
+```
+
+## Configuration Options
+
+The OpenAPI Specification treats JWT authentication as a variant of [bearer authentication](https://swagger.io/docs/specification/v3_0/authentication/bearer-authentication/) in the `components.securitySchemes` object using the `type: http`, `scheme: bearer` and `bearerFormat: jwt`:
+
+```yaml
+components:
+  securitySchemes:
+    myAuthScheme:
+      type: http
+      scheme: bearer
+      bearerFormat: jwt
+
+security:
+  - myAuthScheme: []
+```
+
+With this configuration provided by the OpenAPI description, in the Tyk Vendor Extension we need to enable authentication, to select this security scheme and to indicate where Tyk should look for the credentials. Usually the credentials will be provided in the `Authorization` header, but Tyk is configurable, via the Tyk Vendor Extension, to support custom header keys and credential passing via query parameter or cooke.
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        myAuthScheme:
+          enabled: true
+          header:
+            enabled: true
+            name: Authorization
+```
+
+**Note:** that URL query parameter keys and cookie names are case sensitive, whereas header names are case insensitive.
+
+You can optionally [strip the user credentials](/api-management/client-authentication#managing-authorization-data) from the request prior to proxying to the upstream using the `authentication.stripAuthorizationData` field (Tyk Classic: `strip_auth_data`).
+
+With the JWT method selected, you'll need to configure Tyk to handle the specific configuration of JSON Web Tokens that clients will be providing. All of the JWT specific configuration is performed within the `authentication.jwt` object in the [Tyk Vendor Extension](/api-management/gateway-config-tyk-oas#jwt).
+
+### Locating the JWT in the Request
+
+The OpenAPI Specification provides a `securitySchemes` mechanism that lets you define where the JWT should be located, for example in the request header. However, in practice, different clients may supply the token in different locations, such as a query parameter.
+
+While OAS does not support this natively, the Tyk Vendor Extension does this by allowing configuration of alternative locations in the JWT entry in `server.authentication.securitySchemes`. Building on the previous example, we can add optional query and cookie locations as follows:
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      enabled: true
+      securitySchemes:
+        myAuthScheme:
+          enabled: true
+          header:
+            enabled: true
+            name: Authorization
+          query:
+            enabled: true
+            name: query-auth
+          cookie:
+            enabled: true
+            name: cookie-auth
+```
+
+### Using Tyk Classic APIs
+
+As noted in the Tyk Classic API [documentation](/api-management/gateway-config-tyk-classic#configuring-authentication-for-tyk-classic-apis), you can select JSON Web Token authentication using the `use_jwt` option. Tyk Classic APIs do not natively support multiple JWKS endpoints, though a [custom authentication plugin](/api-management/plugins/plugin-types#authentication-plugins) could be used to implement this functionality.
diff --git a/basic-config-and-security/security/authentication-authorization/multiple-auth.mdx b/basic-config-and-security/security/authentication-authorization/multiple-auth.mdx
new file mode 100644
index 0000000000..428509aa8e
--- /dev/null
+++ b/basic-config-and-security/security/authentication-authorization/multiple-auth.mdx
@@ -0,0 +1,539 @@
+---
+title: "Combine Authentication Methods"
+description: "How to combine multiple authentication methods in Tyk to enhance security and flexibility."
+keywords: "Authentication, Authorization, Tyk Authentication, Tyk Authorization, Multi Authentication, Chained Authentication"
+sidebarTitle: "Multi Auth"
+---
+
+## Introduction 
+
+Tyk provides flexible multi-authentication capabilities, allowing you to combine various [authentication methods](/api-management/client-authentication#what-does-tyk-support) using different logical approaches:
+
+- AND logic: All configured authentication methods must succeed before granting access
+- OR logic: Any one of the configured authentication methods can grant access _(Tyk OAS APIs only)_
+
+This enables scenarios such as requiring both Bearer Token authentication and Basic Auth simultaneously, or allowing access via either JWT validation or API key authentication.
+
+```mermaid
+graph LR
+    Client([Client]) -->|Request| Gateway[Tyk Gateway]
+    
+    subgraph "Multiple Authentication"
+        Gateway --> Auth1[Authentication Method 1<br />e.g., API Key]
+        Auth1 --> Auth2[Authentication Method 2<br />e.g., Basic Auth]
+        Auth2 --> Auth3[Authentication Method N<br />e.g., JWT]
+        Auth3 --> SessionCreation[Create Session<br />& Apply Policies]
+        SessionCreation --> AccessDecision{Access<br />Decision}
+    end
+    
+    AccessDecision -->|Granted| Upstream[(Upstream<br />API)]
+    AccessDecision -->|Denied| Reject[Reject Request]
+    
+    %% Styling
+    classDef client fill:#f9f9f9,stroke:#333,stroke-width:2px
+    classDef gateway fill:#d4edda,stroke:#28a745,stroke-width:2px
+    classDef auth fill:#e2f0fb,stroke:#0275d8,stroke-width:1px
+    classDef session fill:#d1ecf1,stroke:#17a2b8,stroke-width:1px
+    classDef decision fill:#cce5ff,stroke:#0275d8,stroke-width:2px
+    classDef upstream fill:#f8f9fa,stroke:#6c757d,stroke-width:2px
+    classDef reject fill:#f8d7da,stroke:#dc3545,stroke-width:2px
+    
+    class Client client
+    class Gateway gateway
+    class Auth1,Auth2,Auth3 auth
+    class SessionCreation session
+    class AccessDecision decision
+    class Upstream upstream
+    class Reject reject
+```
+
+## Use Cases
+
+- **Multi-tenant APIs**: Different tenants using different identity providers
+- **Migration scenarios**: Supporting both legacy and modern auth during transitions  
+- **Partner integrations**: External partners use mTLS while internal users use JWT
+- **Mobile + Web**: Different auth methods for different client types
+
+{/* ## Quick Start
+
+<TODO: Work in Progress>
+
+In this quick-start guide, we will configure a Tyk OAS API with multiple authentication methods. We will demonstrate how to set up an API that supports both Basic Auth and API Key authentication, allowing clients to authenticate using either method.
+
+### Prerequisites
+
+- **Working Tyk Environment:** You need access to a running Tyk instance that includes both the Tyk Gateway and Tyk Dashboard components. For Docker setup instructions, please refer to this [guide](/tyk-self-managed/install/docker).
+- **Curl**: These tools will be used for testing.
+
+### Instructions
+
+#### Create an API
+
+#### Configuration
+
+#### Testing */}
+
+## Understanding Authentication Modes
+
+```mermaid
+graph LR
+    Client([Client]) -->|Request| Gateway[Tyk Gateway]
+    
+    subgraph "Tyk Multiple Authentication"
+        Gateway --> AuthConfig{Authentication<br />Configuration}
+        
+        %% Legacy Mode
+        AuthConfig -->|Legacy Mode| LegacyAuth["AND Logic<br />(All must pass)"]
+        LegacyAuth --> Auth1[Auth Method 1]
+        Auth1 --> Auth2[Auth Method 2]
+        Auth2 --> SessionCreation["Create Session<br />(from BaseIdentityProvider)"]
+        
+        %% Compliant Mode
+        AuthConfig -->|Compliant Mode| CompliantAuth["OR Logic<br />(Any group can pass)"]
+        CompliantAuth --> Group1["Group 1<br />(AND Logic)"]
+        CompliantAuth --> Group2["Group 2<br />(AND Logic)"]
+        
+        Group1 --> G1Auth1["Auth Method A"]
+        G1Auth1 --> G1Auth2["Auth Method B"]
+        
+        Group2 --> G2Auth1["Auth Method C"]
+        G2Auth1 --> G2Auth2["Auth Method D"]
+        
+        G1Auth2 --> DynamicSession1["Create Session<br />(from last auth in group)"]
+        G2Auth2 --> DynamicSession2["Create Session<br />(from last auth in group)"]
+        
+        SessionCreation --> AccessDecision
+        DynamicSession1 --> AccessDecision
+        DynamicSession2 --> AccessDecision
+        
+        AccessDecision{Access<br />Decision}
+    end
+    
+    AccessDecision -->|Granted| Upstream[(Upstream<br />API)]
+    AccessDecision -->|Denied| Reject[Reject Request]
+    
+    %% Styling
+    classDef client fill:#f9f9f9,stroke:#333,stroke-width:2px
+    classDef gateway fill:#d4edda,stroke:#28a745,stroke-width:2px
+    classDef auth fill:#e2f0fb,stroke:#0275d8,stroke-width:1px
+    classDef group fill:#fff3cd,stroke:#ffc107,stroke-width:1px
+    classDef session fill:#d1ecf1,stroke:#17a2b8,stroke-width:1px
+    classDef decision fill:#cce5ff,stroke:#0275d8,stroke-width:2px
+    classDef upstream fill:#f8f9fa,stroke:#6c757d,stroke-width:2px
+    classDef reject fill:#f8d7da,stroke:#dc3545,stroke-width:2px
+    
+    class Client client
+    class Gateway gateway
+    class Auth1,Auth2,G1Auth1,G1Auth2,G2Auth1,G2Auth2,LegacyAuth,CompliantAuth auth
+    class Group1,Group2 group
+    class SessionCreation,DynamicSession1,DynamicSession2 session
+    class AuthConfig,AccessDecision decision
+    class Upstream upstream
+    class Reject reject
+```
+
+Tyk OAS offers two modes for configuring multiple authentication methods:
+
+- **Legacy Mode** (Default): Maintains backward compatibility with existing Tyk implementations using AND logic only
+- **Compliant Mode**: Introduced in 5.10.0, provides enhanced flexibility by supporting both AND and OR logic between authentication methods
+
+
+
+    <Note>
+    Tyk Classic APIs and pre-5.10 Tyk OAS APIs only support the legacy mode.
+    </Note>
+
+
+### Legacy Mode
+
+The Legacy mode is the traditional implementation of multi-auth, supported by Tyk Classic APIs and Tyk OAS APIs prior to Tyk 5.10. 
+
+In this mode, all configured authentication methods must be satisfied in the request (i.e., they are combined using AND logic).
+
+**How does the operation differ between Tyk Classic and Tyk OAS APIs?**
+
+- **Tyk Classic API**: All configured authentication methods must be satisfied in the request
+
+- **Tyk OAS API**: Only the **first** security requirement object in the OpenAPI description's `security` array is processed. All the authentication methods in the first object must be satisfied in the request, together with any proprietary auth methods `enabled` in the Tyk Vendor Extension.
+
+    ```
+    security:
+      - api_key: []      # this security requirement is processed: both methods must be satisfied
+        basic_auth: []  
+      - jwt_auth: []     # Ignored in Legacy mode
+    ```
+
+#### Session Handling
+
+In Legacy mode, the `baseIdentityProvider` setting determines which authentication method provides the [session object](/api-management/access-control/sessions-and-keys/understanding-sessions). This setting must be configured to one of auth methods in the logical rule using the following mapping:
+
+- `auth_token` - for token-based authentication
+- `jwt_claim` - for JWT authentication
+- `basic_auth_user` - for Basic Authentication
+- `hmac_key` - for HMAC authentication
+- `custom_auth` - for custom authentication plugin
+
+
+### Compliant Mode
+
+The Compliant mode is named as such because Tyk complies with the security requirements declared in the OpenAPI description, combining different authentication methods using AND and OR logic as required.
+
+#### OpenAPI Security Requirements
+
+In OpenAPI, security is defined using **Security Requirement Objects** in the `security` section:
+
+```
+security:
+  - api_key: []
+    basic_auth: []  
+  - jwt_auth: []
+    oauth2: []
+```
+
+- Each security requirement object in the OAS `security` array represents an **alternative**, these are evaluated with **OR** logic.
+- Within a single security requirement object, multiple security schemes can be declared and will combined using **AND** logic (i.e., all listed schemes must succeed together).
+- A request is authorized if **any one** of the defined security requirement objects is successfully validated.
+- The session object is determined dynamically based on which security requirement is satisfied
+- This structure enables **multi-auth configurations**, supporting both **combined (AND)** and **alternative (OR)** authentication methods.
+
+#### How OR Logic Works
+
+When using Compliant mode with multiple security requirements:
+
+- Tyk attempts each authentication method in sequence
+- If any method succeeds, the request is authorized
+- If all methods fail, the request is rejected with the error from the last attempted method
+
+#### How AND Logic Works
+
+Within a single security requirement object that contains multiple schemes:
+
+- All schemes within that security requirement must be satisfied (AND logic)
+- The request is only authorized if all schemes are valid
+- If any scheme fails, the entire security requirement fails, and Tyk moves to the next one
+- This allows for combining different authentication methods that must all be present
+
+#### Examples
+
+Here's an example `security` object from an OpenAPI description with both AND and OR logic:
+
+```json
+{
+  "security": [
+    {
+      "scheme1": []
+    },
+    {
+      "scheme2": [],
+      "scheme3": []
+    }
+  ]
+}
+```
+You will notice that the `security` object should contain references to security schemes that you've defined in the `components.securitySchemes` section of the OpenAPI description.
+In this example, the request will be authorized if either:
+- `scheme1` is provided (first security requirement)
+- OR
+- Both `scheme2` AND `scheme3` are provided (second security requirement with AND logic)
+
+#### Session Handling
+
+The [Session object](/api-management/access-control/sessions-and-keys/understanding-sessions) (determining rate limits, quotas, and access rights) comes from the successful authentication method. This allows different auth methods to have different associated policies and permissions.
+
+When using **Compliant** mode, the session object handling is more dynamic:
+
+1. Between different security requirement objects (OR logic): The first security requirement that successfully authenticates will provide the session object.
+
+2. Within a single security requirement object (AND logic): When multiple authentication methods are specified in the same requirement object (as in your example below), all methods must pass, and the **last** successfully processed authentication method will provide the session object.
+
+Auth methods are always validated in the following order (and skipped if not included in the security requirement):
+
+1. [Tyk OAuth 2.0](/api-management/authentication/oauth-2)
+2. External OAuth (([deprecated](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated))
+3. [Basic Auth](/api-management/authentication/basic-authentication)
+4. [HMAC](/basic-config-and-security/security/authentication-authorization/hmac-signatures)
+5. [JWT](/basic-config-and-security/security/authentication-authorization/json-web-tokens)
+6. OpenID Connect ([deprecated](/api-management/client-authentication#integrate-with-openid-connect-deprecated))
+7. [Custom Plugin Auth](/api-management/authentication/custom-auth)
+8. [Auth Token](/api-management/authentication/bearer-token) (API Key/Bearer Token)
+
+For example, if this security requirement is satisfied in the request, the session metadata will come from the Auth Token, despite it being declared first in the security requirement:
+
+```
+security:
+  - api_key: []
+    basic_auth: []  
+```
+
+
+
+
+
+### Choosing the Right Mode
+
+**Use Legacy Mode when:**
+
+- Migrating from or using Tyk Classic APIs
+- You need the session metadata to be taken from an auth method earlier in the middleware processing order
+
+**Use Compliant Mode when:**
+
+- You need alternative auth methods (OR logic)
+- Supporting multiple client types or identity providers
+- For APIs that need to serve diverse client bases with different security requirements
+- Building new APIs with flexible authentication requirements
+
+## Configuration Options
+
+### Security Processing Mode
+
+The `securityProcessingMode` option in the Tyk Vendor Extension allows you to specify which mode to use when processing the `security` configuration in your API. This controls how Tyk will interpret the authentication settings in the OpenAPI description and the Vendor Extension.
+
+```yaml
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securityProcessingMode: compliant // or legacy
+```
+
+### Basic Example: API with Multiple Auth Methods
+
+Here's a simple example of an OpenAPI description that declares JWT and API Key security schemes:
+
+```yaml
+# Example: API supporting either JWT OR API Key authentication
+components:
+  securitySchemes:
+    api_key:
+      type: apiKey
+      name: X-API-Key
+      in: header
+      description: "API key for service-to-service authentication"
+    jwt_auth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: "JWT token for user authentication"
+security:
+  - api_key: []      # Option 1: API key only
+  - jwt_auth: []     # Option 2: JWT only
+```
+
+- If the `securityProcessingMode` in the Tyk Vendor Extension is set to `compliant`, Tyk will check incoming requests against each `security` option in turn, authenticating requests using Option 1 or Option 2.
+- If the `securityProcessingMode` is set to `legacy` (or is omitted), Tyk will check requests only against the first `security` option (Option 1).
+
+
+### Configuring Multiple Auth Methods in the API Designer
+
+You can configure chained authentication by following these steps:
+
+1. Enable **Authentication** in the **Servers** section
+
+2. Select the **Multiple Authentication Mechanisms** option from the drop-down list.
+
+3. Select the **Authentication Mode** that you wish to use: [Compliant](/basic-config-and-security/security/authentication-authorization/multiple-auth#compliant-mode) or [Legacy](/basic-config-and-security/security/authentication-authorization/multiple-auth#legacy-mode)
+
+    <Tabs>
+    <Tab title="Compliant mode">
+
+    Select **Compliant mode** for full interpretation of the security requirements declared in the OpenAPI description, allowing for fully flexible authentication of your API clients:
+    
+    <img src="/img/api-management/security/multiple-auth-compliant.png" alt="Select Compliant mode" />    
+    
+    Use the API Editor view to configure the different security schemes and requirements to satisfy the client authentication needs of your API:
+    
+    <img src="/img/api-management/security/multiple-auth-configure_compliant.png" alt="Configure Compliant mode" /> 
+
+    </Tab>
+    <Tab title="Legacy mode">
+
+    Use Legacy mode for simple scenarios where you can select the **Authentication methods** that the client must satisfy in the request.
+    
+    You must identify the **Base identity provider** that will provide the session metadata:
+
+    <img src="/img/api-management/security/multiple-auth-legacy.png" alt="Select Legacy mode" />  
+
+    You can now configure each authentication method in the usual manner using the options in the API designer.
+
+    <img src="/img/api-management/security/multiple-auth-configure_legacy.png" alt="Configure the Auth Methods for Legacy mode" />
+
+    </Tab>
+
+    </Tabs>  
+
+
+## Advanced Configuration
+
+### Using Proprietary Auth Methods
+
+Compliant mode allows you to combine standard OpenAPI security schemes with Tyk's proprietary authentication methods by extending the OpenAPI `security` section into the Tyk Vendor Extension:
+
+```yaml
+components:
+  securitySchemes:
+    api_key:
+      type: apiKey
+      name: Authorization
+      in: header
+    jwt_auth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+security:
+  - jwt_auth: []
+x-tyk-api-gateway:
+  server:
+    authentication:
+      securityProcessingMode: compliant
+      security:
+      - - hmac
+        - api_key
+      - - custom_auth
+      securitySchemes:
+        hmac:
+          enabled: true
+        custom_auth:
+          enabled: true
+          config:
+            authType: coprocess
+```
+
+The extended security requirements in the vendor extension (`x-tyk-api-gateway.server.authentication.security`) are concatenated onto the requirements declared in the OpenAPI description. This configuration allows three authentication methods: JWT, API Key with HMAC, and Custom Auth.
+
+## Migration Considerations
+
+### Moving from Legacy to Compliant Mode
+
+
+<Note>
+If you change the security processing mode for an existing API from the Dashboard's API Designer, Tyk will add the `securityProcessingMode` field to your Vendor Extension, but will not make any other changes to the API's configuration. You may need to make adjustments to the OpenAPI description or Vendor Extension to ensure that the authentication rules are set correctly.
+</Note>
+
+
+When migrating from Legacy to Compliant mode:
+
+- Review your API's authentication configuration
+- Ensure all required security schemes are properly defined, for example any use of Tyk proprietary auth methods (HMAC, custom authentication) will need to be reflected with creation of new security requirements within the Vendor Extension's `security` section and removal of requirements from the OpenAPI description's `security` section
+- Test thoroughly, as authentication behavior will change
+- Be aware that the session object may come from different sources depending on which auth method succeeds
+
+### Backward Compatibility
+
+*Legacy* mode ensures backward compatibility with existing Tyk implementations. If you're unsure which mode to use, start with *Legacy* mode and migrate to *Compliant* mode when ready.
+
+## Troubleshooting
+
+<AccordionGroup>
+<Accordion title='Authentication Fails Unexpectedly'>
+**Problem**: API returns 401 errors even with valid credentials.
+
+**Possible Causes & Solutions**:
+
+1. Security schemes not properly defined
+
+    ```yaml
+    # ❌ Incorrect - missing security scheme definition
+    security:
+      - api_key: []
+    # No corresponding securitySchemes definition
+
+    # ✅ Correct - complete definition
+    components:
+      securitySchemes:
+        api_key:
+          type: apiKey
+          name: Authorization
+          in: header
+    security:
+      - api_key: []
+    ```
+
+2. Security schemes not enabled in Tyk extension
+
+    ```yaml
+    x-tyk-api-gateway:
+      server:
+        authentication:
+          securityProcessingMode: compliant
+          securitySchemes:
+            api_key:
+              enabled: true  # ← Must be explicitly enabled
+    ```
+      
+3. Mixed Legacy/Compliant configuration
+
+    - Ensure you're not mixing `baseIdentityProvider` (Legacy) with complex security arrays (Compliant)
+    - Check that `securityProcessingMode` matches your intended configuration
+</Accordion>
+
+<Accordion title='Wrong Policies or Rate Limits Applied'>
+**Problem**: Requests are authenticated but get unexpected rate limits or access denials.
+
+**Root Cause**: In Compliant mode, the session object comes from whichever authentication method succeeds first.
+
+**Solutions**:
+
+1. Review security requirement order - Place most restrictive auth methods first:
+
+    ```yaml
+    security:
+      - premium_jwt: []     # Premium users (higher limits)
+      - basic_api_key: []   # Basic users (lower limits)
+      ```
+
+2. Ensure consistent policies across auth methods:
+
+    - Verify that API keys and JWT tokens for the same user have similar access rights
+    - Check that rate limits align with your business logic
+
+3. Debug session source:
+
+    ```bash
+    # Enable debug logging to see which auth method succeeded
+    "log_level": "debug"
+    ```
+</Accordion>
+
+<Accordion title='Performance Issues'>
+**Problem**: Slower response times with multiple authentication methods.
+
+**Expected Behavior**: Some performance impact is normal due to additional processing.
+
+**Optimization**:
+
+1. Order security requirements by likelihood:
+
+    ```yaml
+    security:
+      - most_common_auth: []    # Try most common first
+      - fallback_auth: []       # Fallback for edge cases
+    ```
+
+2. Monitor authentication attempts:
+
+    ```bash
+    # Look for "OR wrapper" log entries showing auth attempts
+    grep "OR wrapper" /var/log/tyk/tyk.log
+    ```
+</Accordion>
+
+<Accordion title='Debugging Tips'>
+Enable detailed logging in your Tyk Gateway to see which authentication methods are being attempted and which one succeeds:
+
+```json
+{
+  "global": {
+    "log_level": "debug"
+  }
+}
+```
+
+Look for these log entries:
+- `Processing multiple security requirements (OR conditions)`
+    - Confirms Compliant mode is active
+- `OR wrapper` entries
+    - In Compliant mode, this shows which auth methods are being tried
+- `BaseIdentityProvider set to`
+    - In Legacy mode, this shows which auth method succeeded
+</Accordion>
+</AccordionGroup> 
diff --git a/basic-config-and-security/security/authentication-authorization/open-keyless.mdx b/basic-config-and-security/security/authentication-authorization/open-keyless.mdx
new file mode 100644
index 0000000000..ee0158a7e4
--- /dev/null
+++ b/basic-config-and-security/security/authentication-authorization/open-keyless.mdx
@@ -0,0 +1,14 @@
+---
+title: "Open (No Authentication)"
+description: "How to configure open or keyless authentication in Tyk."
+keywords: "Authentication, Authorization, Tyk Authentication, Tyk Authorization, Open Authentication, Keyless Authentication"
+sidebarTitle: "No Authentication"
+---
+
+Open or keyless authentication allows access to APIs without any authentication. This method is suitable for public APIs where access control is not required.
+
+Tyk OAS APIs are inherently "open" unless authentication is configured, however the older Tyk Classic API applies [Auth Token](/api-management/authentication/bearer-token) protection by default.
+
+You can disable authentication for a Tyk Classic API by setting the `use_keyless` flag in the API definition.
+
+
diff --git a/basic-config-and-security/security/mutual-tls/client-mtls.mdx b/basic-config-and-security/security/mutual-tls/client-mtls.mdx
new file mode 100644
index 0000000000..86b896fc7a
--- /dev/null
+++ b/basic-config-and-security/security/mutual-tls/client-mtls.mdx
@@ -0,0 +1,313 @@
+---
+title: "Authentication using Mutual TLS"
+description: "How to configure Mutual TLS (mTLS) for client authentication in Tyk."
+keywords: "Authentication, Authorization, Tyk Authentication, Tyk Authorization, Mutual TLS, mTLS, Client mTLS"
+sidebarTitle: "Mutual TLS"
+---
+
+## Introduction
+
+Mutual TLS (mTLS) is a robust security feature that ensures both the client and server authenticate each other using TLS certificates. This two-way authentication process provides enhanced security for API communications by cryptographically verifying the identity of both parties involved in the connection.
+
+In most cases when you try to access a secured HTTPS/TLS endpoint, you experience only the client-side check of the server certificate. The purpose of this check is to ensure that no fraud is involved and the data transfer between the client and server is encrypted. In fact, the TLS standard allows specifying the client certificate as well, so the server can accept connections only for clients with certificates registered with the server certificate authority, or provide additional security checks based on the information stored in the client certificate. This is what we call "Mutual TLS" - when both sides of the connection verify certificates. See the video below that gives you an introduction to mutual TLS and how it can be used to secure your APIs.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/UzEzjon3IAo" title="Mutual TLS Intro" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+## Why Use Mutual TLS?
+
+Mutual TLS is particularly valuable in environments where security is paramount, such as microservices architectures, financial services, healthcare, and any scenario requiring zero-trust security. It not only encrypts the data in transit but also ensures that the communicating parties are who they claim to be, mitigating the risks of unauthorized access and data breaches.
+
+* **Enhanced Security:** Provides two-way authentication, ensuring both the client and server are verified and trusted.
+* **Data Integrity:** Protects the data exchanged between client and server by encrypting it, preventing tampering or interception.
+* **Compliance:** Helps meet stringent security and compliance requirements, especially in regulated industries.
+
+## Client mTLS for Tyk Cloud
+
+Tyk Cloud users cannot currently use mTLS to secure the client to Gateway communication for Tyk-hosted gateways.
+
+
+Tyk Hybrid users can, however, use mTLS with their self-hosted gateways.
+
+
+## How Does Mutual TLS Work?
+
+Mutual TLS operates by requiring both the client and server to present and verify TLS certificates during the handshake process. Here’s how it works:
+
+**Client Authentication:**
+
+1. When a client attempts to connect to the server, the server requests the client’s TLS certificate.
+2. The client provides its certificate, which the server verifies against a trusted Certificate Authority (CA).
+
+**Server Authentication:**
+
+1. Simultaneously, the server provides its own certificate to the client, which the client verifies against a trusted CA.
+
+This mutual verification ensures that both parties are legitimate, securing the connection from both ends.
+
+### Client authorization with mTLS
+At the TLS level, authorization means only allowing access for clients who provide client certificates that are verified and trusted by the server. 
+
+Tyk allows you to define a list of trusted certificates at the API level or Gateway (global) level. If you are updating API definition programmatically or via files, you need to set following the keys in your API 
+definition: 
+`use_mutual_tls_auth` to `true`, and `client_certificates` as an array of strings - certificate IDs. 
+
+From the Tyk Dashboard, to do the same from the **API Designer Core settings** section you need to select **Mutual TLS** authentication mode from the **Authentication** section, and allow the certificates using the built-in widget, as below:
+
+<img src="/img/2.10/mtls_auth_cert.png" alt="mutual_tls_auth" />
+
+If all your APIs have a common set of certificates, you can define them in your Gateway configuration file via the `security.certificates.apis` key - string array of certificate IDs or paths.
+
+Select **Strip Authorization Data** to strip any authorization data from your API requests.  
+
+Be aware that mutual TLS authorization has special treatment because it is not "authentication" and does not provide any identifying functionality, like keys, so you need to mix it with another authentication modes options like **Auth Key** or **Keyless**. On the dashboard, you need to choose **Use multiple auth mechanism** in the **Authentication mode** drop-down, where you should select **Mutual TLS** and another option which suits your use-case. 
+
+### Fallback to HTTP Authorization 
+The TLS protocol has no access to the HTTP payload and works on the lower level; thus the only information we have at the TLS handshake level is the domain. In fact, even a domain is not included into a TLS handshake by default, but there is TLS extension called SNI (Server Name Indication) 
+which allows the client to send the domain name to the TLS handshake level. 
+
+With this in mind, the only way to make API authorization work fully at the  TLS level, each API protected by Mutual TLS should be deployed on its own domain.
+
+However, Tyk will gracefully fallback to a client certificate authorization at the HTTP level in cases when you want to have multiple mutual TLS protected APIs on the same domain, or you have clients that do not support the SNI extension. No additional configuration is needed. In case of such fallback, 
+instead of getting TLS error, a client will receive 403 HTTP error.
+
+### Authentication 
+Tyk can be configured to guess a user authentication key based on the provided client certificate. In other words, a user does not need to provide any key, except the certificate, and Tyk will be able to identify the user, apply policies, and do the monitoring - the same as with regular Keys.
+
+### Using with Authorization 
+Mutual TLS authentication does not require mutual TLS authorization to be turned on, and can be used separately. For example, you may allow some of the users to be authenticated by using a token in the header or similar, and some of the users via client certificates. 
+
+If you want to use them both, just configure them separately. No additional knowledge is required.
+
+### Dynamic vs Static mTLS
+
+There are two ways to set up client mTLS in Tyk: static and dynamic. Each method is suited to different use cases, as outlined below:
+
+| Use Case                                                           | Static | Dynamic |
+| ------------------------------------------------------------------ | :----: | :-----: |
+| Let developers upload their own public certificates through the Developer Portal |   ❌    |   ✅      |
+| Combine client mTLS with another authentication method           |   ✅    |   ✅      |
+| Allow certs at the API level (one or more APIs per cert)           |   ✅    |   ❌      |
+| Allow certs at an individual level (one or more APIs per cert)     |   ❌    |   ✅      |
+
+## Dynamic mTLS
+
+Dynamic Client mTLS in Tyk allows you to authenticate users based solely on the provided client certificate, without the need for an additional authentication key. Tyk can identify the user, apply policies, and monitor usage just as with regular API keys.
+
+To set up Dynamic Client mTLS, we need to follow these steps:
+* Protect the API: Configure the API in the API Designer by setting the authentication type to Auth Token and enabling Client Certificate.
+
+* Generate a Self-Signed Certificate: Use OpenSSL to generate a self-signed certificate and key if you don't have one.
+
+* Add a Key in the Dashboard: In the Tyk Dashboard, create a key for the API and upload only the public certificate.
+
+* Make an API Request: Use curl with your certificate and key to make an API request to the protected API, ensuring the request returns a 200 response.
+
+* Allow Developers to Upload Certificates: Create a policy and catalog entry for the API, allowing developers to request keys and upload their public certificates through the Developer Portal. Developers can then make API requests using their cert and private key.
+
+
+### Protect the API
+
+In the API Designer, set the Authentication Type to Auth Token under Target Details > Authentication mode. Then select Enable Client Certificate.
+
+<img src="/img/api-management/security/client-mtls-api-setup.png" alt="Enable Client Certificate" />
+
+### Generate a Self-Signed Key Pair
+
+If you don’t already have a certificate, generate a self-signed key pair using the following command:
+
+```bash
+openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
+```
+
+### Add a Key through the Dashboard
+
+In the Tyk Dashboard, add a key for the API you set up in step #1. When uploading the certificate, ensure you only upload the public certificate.
+
+
+
+<Note>
+The certificate you upload for this key must only be the public certificate.
+</Note>
+
+
+
+### Make an API Request Using the Certificate
+
+Now you can make a cURL request to the API using the certificate and private key:
+
+```bash
+curl -k --cert cert.pem --key key.pem https://localhost:8080/mtls-api/my-endpoint
+```
+
+A successful request should return a 200 response.
+
+### Allow Developers to Upload Certificates
+
+Instead of manually creating keys, you can allow developers to upload their own certificates via the Developer Portal.
+
+1. **Create a Policy:** Create a policy for the API you set up earlier.
+2. **Create a Catalog Entry:** Create a catalog entry for this policy.
+3. **Request a Key through the Portal:** As a developer, request a key for the API through the Portal. This will present a screen where the developer can upload their public certificate.
+
+<img src="/img/dashboard/system-management/portal_cert_request.png" alt="portal_cert_request" />
+
+Add your public cert (cert.pem from above) into here and hit "Request Key".  
+
+4. **Make an API Request Using the Uploaded Certificate:** After adding the public certificate, developers can make API requests using their cert + private key:
+
+   ```bash
+   curl -k --cert cert.pem --key key.pem https://localhost:8080/mtls-api/my-endpoint
+   ```
+
+   A successful request should return a 200 response.
+
+## Static mTLS
+
+Static mTLS allows client certificates to be used at the API level. This method is straightforward and can be combined with another authentication method if needed.
+
+### Configure the API
+
+In the API authentication settings, choose mTLS as the authentication type and optionally select an additional authentication method. If you want to use only client certificates without another authentication method, select "keyless" as the other option.
+
+### Set the Base Identity
+
+The base identity can be anything, as the client certificate will be the primary authentication method.
+
+
+### Setup Static mTLS in Tyk Operator using the Tyk Classic API Definition
+
+This setup requires mutual TLS (mTLS) for client authentication using specified client certificates. The example provided shows how to create an API definition with mTLS authentication for `httpbin-client-mtls`.
+
+1. **Generate Self-Signed Key Pair:**
+
+You can generate a self-signed key pair using the following OpenSSL command:
+
+```bash
+openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
+```
+
+2. **Create Kubernetes Secret:**
+
+Create a secret in Kubernetes to store the client certificate:
+
+```bash
+kubectl create secret tls my-test-tls --cert cert.pem --key key.pem
+```
+
+3. **Create API Definition:**
+
+Below is the YAML configuration for an API that uses mTLS authentication. Note that the `client_certificate_refs` field references the Kubernetes secret created in the previous step.
+
+```yaml {hl_lines=["19-21"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-client-mtls
+spec:
+  name: Httpbin Client MTLS
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+  use_mutual_tls_auth: true
+  client_certificate_refs:
+    - my-test-tls
+```
+
+### Setup Static mTLS in Tyk Operator using Tyk OAS API Definition
+
+Client certificates, In Tyk OAS API Definition, are managed using the `TykOasApiDefinition` CRD. You can reference Kubernetes secrets that store client certificates in your API definitions.
+
+**Example of Referencing Client Certificates in Tyk OAS**
+
+In this example, the `clientCertificate` section allows you to enable client certificate management and specify a list of Kubernetes secrets (`tls-cert`) that store allowed client certificates.
+
+```yaml {hl_lines=["48-50"],linenos=false}
+# Secret is not created in this manifest.
+# Please store client certificate in k8s TLS secret `tls-cert`.
+
+apiVersion: v1
+data:
+  test_oas.json: |-
+    {
+        "info": {
+          "title": "Petstore",
+          "version": "1.0.0"
+        },
+        "openapi": "3.0.3",
+        "components": {},
+        "paths": {},
+        "x-tyk-api-gateway": {
+          "info": {
+            "name": "Petstore",
+            "state": {
+              "active": true
+            }
+          },
+          "upstream": {
+            "url": "https://petstore.swagger.io/v2"
+          },
+          "server": {
+            "listenPath": {
+              "value": "/petstore/",
+              "strip": true
+            }
+          }
+        }
+      }
+kind: ConfigMap
+metadata:
+  name: cm
+  namespace: default
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: petstore
+spec:
+  tykOAS:
+    configmapRef:
+      name: cm
+      namespace: default
+      keyName: test_oas.json
+  clientCertificate: 
+      enabled: true
+      allowlist: [tls-cert]
+```
+
+
+## FAQ
+
+*   **Why am I getting an error stating that certificates are not enabled for this API?**
+
+    This issue can occur because client mTLS is an extension of Auth Token authentication mode. To enable this feature, ensure the API definition has `auth.use_certificate` set to `true`.
+
+*   **Can I upload a full certificate chain when creating a key for dynamic client mTLS?**
+
+    Yes, you can do this when manually creating a key as an Admin Dashboard user. However, through the Portal, you must upload only the public key (certificate).
+
+*   **Can I use a root CA with client mTLS?**
+
+    Yes, Tyk allows you to upload a root CA certificate for static mTLS authentication. This setup allows clients with certificates signed by the registered CA to be validated.
+
+    **Key Points:**
+
+    *   The root CA certificate can be uploaded as a client certificate.
+    *   Clients presenting certificates signed by this CA will be validated.
+    *   Tyk traverses the certificate chain for validation.
+
+
+    <Note>
+    Root CA certificates are compatible only with Static mTLS and not with Dynamic mTLS.
+    </Note>
+
+
+
diff --git a/branches-config.json b/branches-config.json
index 35b9d06a82..4285e4b98a 100644
--- a/branches-config.json
+++ b/branches-config.json
@@ -1,18 +1,42 @@
 {
   "versions": [
     {
-      "branch": "release-5.8",
+      "branch": "release-5.11",
       "isLatest": true,
-      "folder": "5.8",
-      "label": "v5.8 (Latest)"
+      "sourceFolder": "5.11-source",
+      "targetFolder": "5.11",
+      "label": "v5.11 (latest)"
     },
     {
       "branch": "main",
       "isLatest": false,
       "isMain": true,
-      "folder": "nightly",
+      "sourceFolder": "nightly-source",
+      "targetFolder": "nightly",
       "label": "Nightly"
     },
+    {
+      "branch": "release-5.10",
+      "isLatest": false,
+      "sourceFolder": "5.10-source",
+      "targetFolder": "5.10",
+      "label": "v5.10"
+    },
+    {
+      "branch": "release-5.9",
+      "isLatest": false,
+      "sourceFolder": "5.9-source",
+      "targetFolder": "5.9",
+      "label": "v5.9"
+    },
+    {
+      "branch": "release-5.8",
+      "isLatest": false,
+      "isMain": false,
+      "sourceFolder": "5.8-source",
+      "targetFolder": "5.8",
+      "label": "v5.8 (LTS)"
+    },
     {
       "isExternal": true,
       "externalUrl": "https://tyk.io/docs/5.7",
@@ -92,4 +116,4 @@
   "buildConfig": {
     "docsDir": "."
   }
-}
\ No newline at end of file
+}
diff --git a/calculator.js b/calculator.js
new file mode 100644
index 0000000000..2f6a9d113c
--- /dev/null
+++ b/calculator.js
@@ -0,0 +1,3 @@
+/*! For license information please see main.b7b66d3b.js.LICENSE.txt */
+(() => { "use strict"; var __webpack_modules__ = { 111: (__unused_webpack_module, __webpack_exports__, __webpack_require__) => { __webpack_require__.d(__webpack_exports__, { A: () => __WEBPACK_DEFAULT_EXPORT__ }); var formik__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(892), _components_Calculator_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(297), react_jsx_runtime__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(579); const SUM = "sum", __WEBPACK_DEFAULT_EXPORT__ = _ref => { let { fields: fields } = _ref; const initialValues = {}; return Object.values(fields).map((e => Object.values(e).map((e => initialValues[e.name] = e.defaultValue || 0)))), (0, react_jsx_runtime__WEBPACK_IMPORTED_MODULE_2__.jsx)(formik__WEBPACK_IMPORTED_MODULE_0__.l1, { initialValues: initialValues, onSubmit: (values, _ref2) => { let { setFieldValue: setFieldValue } = _ref2, sum = 0, x; Object.values(fields.calculated_fields).map((_ref3 => { let { name: name, value: value } = _ref3; x = eval(value), sum += x, name.startsWith(SUM), setFieldValue(name, x) })) }, component: e => (0, react_jsx_runtime__WEBPACK_IMPORTED_MODULE_2__.jsx)(_components_Calculator_js__WEBPACK_IMPORTED_MODULE_1__.A, { fields: fields, onSubmit: !0, ...e }) }) } }, 297: (e, t, n) => { n.d(t, { A: () => u }); var r = n(892), a = n(579); const l = e => { if (e < 0 || 100 < e) return "Please enter a value between 0-100." }, o = e => { if (e < 0) return "Please enter a positive integer value." }, i = e => { let { fields: t, values: n, errors: i, fixed: u, disabled: s, handleChange: c } = e; return (0, a.jsx)(a.Fragment, { children: Object.entries(t).map((e => { let [t, { name: f, label: d, type: p, unit: m, description: h }] = e; return (0, a.jsxs)("div", { children: [(0, a.jsxs)("div", { style: { display: "flex", alignItems: "center" }, children: [(0, a.jsx)("label", { htmlFor: f, title: h, style: { marginRight: "auto" }, children: d }), (0, a.jsx)(r.D0, { id: f, name: f, type: p, value: u ? n[f].toFixed(4) : n[f], onChange: c, disabled: s, validate: "Percent" === m ? l : o, title: h, required: !0, style: { margin: "4px 10px", color: "black" } }), (0, a.jsx)("label", { style: { width: "80px" }, children: m })] }), i[f] ? (0, a.jsx)("div", { style: { color: "red" }, children: i[f] }) : null] }, t) })) }) }, u = e => { let { handleSubmit: t, handleChange: n, handleBlur: l, values: o, errors: u, fields: s } = e; return (0, a.jsxs)(r.lV, { onSubmit: t, children: [Object.keys(s).map((e => (0, a.jsxs)("div", { children: [(0, a.jsx)(i, { fields: s[e], values: o, errors: u, fixed: "calculated_fields" === e, disabled: "input_fields" !== e, handleChange: n }), (0, a.jsx)("hr", { style: { margin: "1rem 0" } })] }, e))), (0, a.jsx)("button", { type: "submit", disabled: 0 !== Object.keys(u).length, style: { width: "100%", backgroundColor: "#8438fa", borderColor: "#8438fa", color: "white" }, children: "Calculate" })] }) } }, 892: (e, t, n) => { n.d(t, { D0: () => gr, lV: () => _r, l1: () => mr }); var r = n(43), a = n(366), l = n.n(a), o = function (e) { return function (e) { return !!e && "object" === typeof e }(e) && !function (e) { var t = Object.prototype.toString.call(e); return "[object RegExp]" === t || "[object Date]" === t || function (e) { return e.$$typeof === i }(e) }(e) }; var i = "function" === typeof Symbol && Symbol.for ? Symbol.for("react.element") : 60103; function u(e, t) { return !1 !== t.clone && t.isMergeableObject(e) ? c((n = e, Array.isArray(n) ? [] : {}), e, t) : e; var n } function s(e, t, n) { return e.concat(t).map((function (e) { return u(e, n) })) } function c(e, t, n) { (n = n || {}).arrayMerge = n.arrayMerge || s, n.isMergeableObject = n.isMergeableObject || o; var r = Array.isArray(t); return r === Array.isArray(e) ? r ? n.arrayMerge(e, t, n) : function (e, t, n) { var r = {}; return n.isMergeableObject(e) && Object.keys(e).forEach((function (t) { r[t] = u(e[t], n) })), Object.keys(t).forEach((function (a) { n.isMergeableObject(t[a]) && e[a] ? r[a] = c(e[a], t[a], n) : r[a] = u(t[a], n) })), r }(e, t, n) : u(t, n) } c.all = function (e, t) { if (!Array.isArray(e)) throw new Error("first argument should be an array"); return e.reduce((function (e, n) { return c(e, n, t) }), {}) }; const f = c; const d = "object" == typeof global && global && global.Object === Object && global; var p = "object" == typeof self && self && self.Object === Object && self; const m = d || p || Function("return this")(); const h = m.Symbol; var y = Object.prototype, v = y.hasOwnProperty, b = y.toString, g = h ? h.toStringTag : void 0; const _ = function (e) { var t = v.call(e, g), n = e[g]; try { e[g] = void 0; var r = !0 } catch (l) { } var a = b.call(e); return r && (t ? e[g] = n : delete e[g]), a }; var S = Object.prototype.toString; const w = function (e) { return S.call(e) }; var k = h ? h.toStringTag : void 0; const E = function (e) { return null == e ? void 0 === e ? "[object Undefined]" : "[object Null]" : k && k in Object(e) ? _(e) : w(e) }; const x = function (e, t) { return function (n) { return e(t(n)) } }; const C = x(Object.getPrototypeOf, Object); const T = function (e) { return null != e && "object" == typeof e }; var P = Function.prototype, O = Object.prototype, z = P.toString, j = O.hasOwnProperty, R = z.call(Object); const A = function (e) { if (!T(e) || "[object Object]" != E(e)) return !1; var t = C(e); if (null === t) return !0; var n = j.call(t, "constructor") && t.constructor; return "function" == typeof n && n instanceof n && z.call(n) == R }; const N = function () { this.__data__ = [], this.size = 0 }; const M = function (e, t) { return e === t || e !== e && t !== t }; const L = function (e, t) { for (var n = e.length; n--;)if (M(e[n][0], t)) return n; return -1 }; var I = Array.prototype.splice; const F = function (e) { var t = this.__data__, n = L(t, e); return !(n < 0) && (n == t.length - 1 ? t.pop() : I.call(t, n, 1), --this.size, !0) }; const D = function (e) { var t = this.__data__, n = L(t, e); return n < 0 ? void 0 : t[n][1] }; const U = function (e) { return L(this.__data__, e) > -1 }; const V = function (e, t) { var n = this.__data__, r = L(n, e); return r < 0 ? (++this.size, n.push([e, t])) : n[r][1] = t, this }; function B(e) { var t = -1, n = null == e ? 0 : e.length; for (this.clear(); ++t < n;) { var r = e[t]; this.set(r[0], r[1]) } } B.prototype.clear = N, B.prototype.delete = F, B.prototype.get = D, B.prototype.has = U, B.prototype.set = V; const $ = B; const q = function () { this.__data__ = new $, this.size = 0 }; const W = function (e) { var t = this.__data__, n = t.delete(e); return this.size = t.size, n }; const H = function (e) { return this.__data__.get(e) }; const Q = function (e) { return this.__data__.has(e) }; const K = function (e) { var t = typeof e; return null != e && ("object" == t || "function" == t) }; const G = function (e) { if (!K(e)) return !1; var t = E(e); return "[object Function]" == t || "[object GeneratorFunction]" == t || "[object AsyncFunction]" == t || "[object Proxy]" == t }; const Y = m["__core-js_shared__"]; var X = function () { var e = /[^.]+$/.exec(Y && Y.keys && Y.keys.IE_PROTO || ""); return e ? "Symbol(src)_1." + e : "" }(); const Z = function (e) { return !!X && X in e }; var J = Function.prototype.toString; const ee = function (e) { if (null != e) { try { return J.call(e) } catch (t) { } try { return e + "" } catch (t) { } } return "" }; var te = /^\[object .+?Constructor\]$/, ne = Function.prototype, re = Object.prototype, ae = ne.toString, le = re.hasOwnProperty, oe = RegExp("^" + ae.call(le).replace(/[\\^$.*+?()[\]{}|]/g, "\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, "$1.*?") + "$"); const ie = function (e) { return !(!K(e) || Z(e)) && (G(e) ? oe : te).test(ee(e)) }; const ue = function (e, t) { return null == e ? void 0 : e[t] }; const se = function (e, t) { var n = ue(e, t); return ie(n) ? n : void 0 }; const ce = se(m, "Map"); const fe = se(Object, "create"); const de = function () { this.__data__ = fe ? fe(null) : {}, this.size = 0 }; const pe = function (e) { var t = this.has(e) && delete this.__data__[e]; return this.size -= t ? 1 : 0, t }; var me = Object.prototype.hasOwnProperty; const he = function (e) { var t = this.__data__; if (fe) { var n = t[e]; return "__lodash_hash_undefined__" === n ? void 0 : n } return me.call(t, e) ? t[e] : void 0 }; var ye = Object.prototype.hasOwnProperty; const ve = function (e) { var t = this.__data__; return fe ? void 0 !== t[e] : ye.call(t, e) }; const be = function (e, t) { var n = this.__data__; return this.size += this.has(e) ? 0 : 1, n[e] = fe && void 0 === t ? "__lodash_hash_undefined__" : t, this }; function ge(e) { var t = -1, n = null == e ? 0 : e.length; for (this.clear(); ++t < n;) { var r = e[t]; this.set(r[0], r[1]) } } ge.prototype.clear = de, ge.prototype.delete = pe, ge.prototype.get = he, ge.prototype.has = ve, ge.prototype.set = be; const _e = ge; const Se = function () { this.size = 0, this.__data__ = { hash: new _e, map: new (ce || $), string: new _e } }; const we = function (e) { var t = typeof e; return "string" == t || "number" == t || "symbol" == t || "boolean" == t ? "__proto__" !== e : null === e }; const ke = function (e, t) { var n = e.__data__; return we(t) ? n["string" == typeof t ? "string" : "hash"] : n.map }; const Ee = function (e) { var t = ke(this, e).delete(e); return this.size -= t ? 1 : 0, t }; const xe = function (e) { return ke(this, e).get(e) }; const Ce = function (e) { return ke(this, e).has(e) }; const Te = function (e, t) { var n = ke(this, e), r = n.size; return n.set(e, t), this.size += n.size == r ? 0 : 1, this }; function Pe(e) { var t = -1, n = null == e ? 0 : e.length; for (this.clear(); ++t < n;) { var r = e[t]; this.set(r[0], r[1]) } } Pe.prototype.clear = Se, Pe.prototype.delete = Ee, Pe.prototype.get = xe, Pe.prototype.has = Ce, Pe.prototype.set = Te; const Oe = Pe; const ze = function (e, t) { var n = this.__data__; if (n instanceof $) { var r = n.__data__; if (!ce || r.length < 199) return r.push([e, t]), this.size = ++n.size, this; n = this.__data__ = new Oe(r) } return n.set(e, t), this.size = n.size, this }; function je(e) { var t = this.__data__ = new $(e); this.size = t.size } je.prototype.clear = q, je.prototype.delete = W, je.prototype.get = H, je.prototype.has = Q, je.prototype.set = ze; const Re = je; const Ae = function (e, t) { for (var n = -1, r = null == e ? 0 : e.length; ++n < r && !1 !== t(e[n], n, e);); return e }; const Ne = function () { try { var e = se(Object, "defineProperty"); return e({}, "", {}), e } catch (t) { } }(); const Me = function (e, t, n) { "__proto__" == t && Ne ? Ne(e, t, { configurable: !0, enumerable: !0, value: n, writable: !0 }) : e[t] = n }; var Le = Object.prototype.hasOwnProperty; const Ie = function (e, t, n) { var r = e[t]; Le.call(e, t) && M(r, n) && (void 0 !== n || t in e) || Me(e, t, n) }; const Fe = function (e, t, n, r) { var a = !n; n || (n = {}); for (var l = -1, o = t.length; ++l < o;) { var i = t[l], u = r ? r(n[i], e[i], i, n, e) : void 0; void 0 === u && (u = e[i]), a ? Me(n, i, u) : Ie(n, i, u) } return n }; const De = function (e, t) { for (var n = -1, r = Array(e); ++n < e;)r[n] = t(n); return r }; const Ue = function (e) { return T(e) && "[object Arguments]" == E(e) }; var Ve = Object.prototype, Be = Ve.hasOwnProperty, $e = Ve.propertyIsEnumerable; const qe = Ue(function () { return arguments }()) ? Ue : function (e) { return T(e) && Be.call(e, "callee") && !$e.call(e, "callee") }; const We = Array.isArray; const He = function () { return !1 }; var Qe = "object" == typeof exports && exports && !exports.nodeType && exports, Ke = Qe && "object" == typeof module && module && !module.nodeType && module, Ge = Ke && Ke.exports === Qe ? m.Buffer : void 0; const Ye = (Ge ? Ge.isBuffer : void 0) || He; var Xe = /^(?:0|[1-9]\d*)$/; const Ze = function (e, t) { var n = typeof e; return !!(t = null == t ? 9007199254740991 : t) && ("number" == n || "symbol" != n && Xe.test(e)) && e > -1 && e % 1 == 0 && e < t }; const Je = function (e) { return "number" == typeof e && e > -1 && e % 1 == 0 && e <= 9007199254740991 }; var et = {}; et["[object Float32Array]"] = et["[object Float64Array]"] = et["[object Int8Array]"] = et["[object Int16Array]"] = et["[object Int32Array]"] = et["[object Uint8Array]"] = et["[object Uint8ClampedArray]"] = et["[object Uint16Array]"] = et["[object Uint32Array]"] = !0, et["[object Arguments]"] = et["[object Array]"] = et["[object ArrayBuffer]"] = et["[object Boolean]"] = et["[object DataView]"] = et["[object Date]"] = et["[object Error]"] = et["[object Function]"] = et["[object Map]"] = et["[object Number]"] = et["[object Object]"] = et["[object RegExp]"] = et["[object Set]"] = et["[object String]"] = et["[object WeakMap]"] = !1; const tt = function (e) { return T(e) && Je(e.length) && !!et[E(e)] }; const nt = function (e) { return function (t) { return e(t) } }; var rt = "object" == typeof exports && exports && !exports.nodeType && exports, at = rt && "object" == typeof module && module && !module.nodeType && module, lt = at && at.exports === rt && d.process; const ot = function () { try { var e = at && at.require && at.require("util").types; return e || lt && lt.binding && lt.binding("util") } catch (t) { } }(); var it = ot && ot.isTypedArray; const ut = it ? nt(it) : tt; var st = Object.prototype.hasOwnProperty; const ct = function (e, t) { var n = We(e), r = !n && qe(e), a = !n && !r && Ye(e), l = !n && !r && !a && ut(e), o = n || r || a || l, i = o ? De(e.length, String) : [], u = i.length; for (var s in e) !t && !st.call(e, s) || o && ("length" == s || a && ("offset" == s || "parent" == s) || l && ("buffer" == s || "byteLength" == s || "byteOffset" == s) || Ze(s, u)) || i.push(s); return i }; var ft = Object.prototype; const dt = function (e) { var t = e && e.constructor; return e === ("function" == typeof t && t.prototype || ft) }; const pt = x(Object.keys, Object); var mt = Object.prototype.hasOwnProperty; const ht = function (e) { if (!dt(e)) return pt(e); var t = []; for (var n in Object(e)) mt.call(e, n) && "constructor" != n && t.push(n); return t }; const yt = function (e) { return null != e && Je(e.length) && !G(e) }; const vt = function (e) { return yt(e) ? ct(e) : ht(e) }; const bt = function (e, t) { return e && Fe(t, vt(t), e) }; const gt = function (e) { var t = []; if (null != e) for (var n in Object(e)) t.push(n); return t }; var _t = Object.prototype.hasOwnProperty; const St = function (e) { if (!K(e)) return gt(e); var t = dt(e), n = []; for (var r in e) ("constructor" != r || !t && _t.call(e, r)) && n.push(r); return n }; const wt = function (e) { return yt(e) ? ct(e, !0) : St(e) }; const kt = function (e, t) { return e && Fe(t, wt(t), e) }; var Et = "object" == typeof exports && exports && !exports.nodeType && exports, xt = Et && "object" == typeof module && module && !module.nodeType && module, Ct = xt && xt.exports === Et ? m.Buffer : void 0, Tt = Ct ? Ct.allocUnsafe : void 0; const Pt = function (e, t) { if (t) return e.slice(); var n = e.length, r = Tt ? Tt(n) : new e.constructor(n); return e.copy(r), r }; const Ot = function (e, t) { var n = -1, r = e.length; for (t || (t = Array(r)); ++n < r;)t[n] = e[n]; return t }; const zt = function (e, t) { for (var n = -1, r = null == e ? 0 : e.length, a = 0, l = []; ++n < r;) { var o = e[n]; t(o, n, e) && (l[a++] = o) } return l }; const jt = function () { return [] }; var Rt = Object.prototype.propertyIsEnumerable, At = Object.getOwnPropertySymbols; const Nt = At ? function (e) { return null == e ? [] : (e = Object(e), zt(At(e), (function (t) { return Rt.call(e, t) }))) } : jt; const Mt = function (e, t) { return Fe(e, Nt(e), t) }; const Lt = function (e, t) { for (var n = -1, r = t.length, a = e.length; ++n < r;)e[a + n] = t[n]; return e }; const It = Object.getOwnPropertySymbols ? function (e) { for (var t = []; e;)Lt(t, Nt(e)), e = C(e); return t } : jt; const Ft = function (e, t) { return Fe(e, It(e), t) }; const Dt = function (e, t, n) { var r = t(e); return We(e) ? r : Lt(r, n(e)) }; const Ut = function (e) { return Dt(e, vt, Nt) }; const Vt = function (e) { return Dt(e, wt, It) }; const Bt = se(m, "DataView"); const $t = se(m, "Promise"); const qt = se(m, "Set"); const Wt = se(m, "WeakMap"); var Ht = "[object Map]", Qt = "[object Promise]", Kt = "[object Set]", Gt = "[object WeakMap]", Yt = "[object DataView]", Xt = ee(Bt), Zt = ee(ce), Jt = ee($t), en = ee(qt), tn = ee(Wt), nn = E; (Bt && nn(new Bt(new ArrayBuffer(1))) != Yt || ce && nn(new ce) != Ht || $t && nn($t.resolve()) != Qt || qt && nn(new qt) != Kt || Wt && nn(new Wt) != Gt) && (nn = function (e) { var t = E(e), n = "[object Object]" == t ? e.constructor : void 0, r = n ? ee(n) : ""; if (r) switch (r) { case Xt: return Yt; case Zt: return Ht; case Jt: return Qt; case en: return Kt; case tn: return Gt }return t }); const rn = nn; var an = Object.prototype.hasOwnProperty; const ln = function (e) { var t = e.length, n = new e.constructor(t); return t && "string" == typeof e[0] && an.call(e, "index") && (n.index = e.index, n.input = e.input), n }; const on = m.Uint8Array; const un = function (e) { var t = new e.constructor(e.byteLength); return new on(t).set(new on(e)), t }; const sn = function (e, t) { var n = t ? un(e.buffer) : e.buffer; return new e.constructor(n, e.byteOffset, e.byteLength) }; var cn = /\w*$/; const fn = function (e) { var t = new e.constructor(e.source, cn.exec(e)); return t.lastIndex = e.lastIndex, t }; var dn = h ? h.prototype : void 0, pn = dn ? dn.valueOf : void 0; const mn = function (e) { return pn ? Object(pn.call(e)) : {} }; const hn = function (e, t) { var n = t ? un(e.buffer) : e.buffer; return new e.constructor(n, e.byteOffset, e.length) }; const yn = function (e, t, n) { var r = e.constructor; switch (t) { case "[object ArrayBuffer]": return un(e); case "[object Boolean]": case "[object Date]": return new r(+e); case "[object DataView]": return sn(e, n); case "[object Float32Array]": case "[object Float64Array]": case "[object Int8Array]": case "[object Int16Array]": case "[object Int32Array]": case "[object Uint8Array]": case "[object Uint8ClampedArray]": case "[object Uint16Array]": case "[object Uint32Array]": return hn(e, n); case "[object Map]": case "[object Set]": return new r; case "[object Number]": case "[object String]": return new r(e); case "[object RegExp]": return fn(e); case "[object Symbol]": return mn(e) } }; var vn = Object.create; const bn = function () { function e() { } return function (t) { if (!K(t)) return {}; if (vn) return vn(t); e.prototype = t; var n = new e; return e.prototype = void 0, n } }(); const gn = function (e) { return "function" != typeof e.constructor || dt(e) ? {} : bn(C(e)) }; const _n = function (e) { return T(e) && "[object Map]" == rn(e) }; var Sn = ot && ot.isMap; const wn = Sn ? nt(Sn) : _n; const kn = function (e) { return T(e) && "[object Set]" == rn(e) }; var En = ot && ot.isSet; const xn = En ? nt(En) : kn; var Cn = "[object Arguments]", Tn = "[object Function]", Pn = "[object Object]", On = {}; On[Cn] = On["[object Array]"] = On["[object ArrayBuffer]"] = On["[object DataView]"] = On["[object Boolean]"] = On["[object Date]"] = On["[object Float32Array]"] = On["[object Float64Array]"] = On["[object Int8Array]"] = On["[object Int16Array]"] = On["[object Int32Array]"] = On["[object Map]"] = On["[object Number]"] = On[Pn] = On["[object RegExp]"] = On["[object Set]"] = On["[object String]"] = On["[object Symbol]"] = On["[object Uint8Array]"] = On["[object Uint8ClampedArray]"] = On["[object Uint16Array]"] = On["[object Uint32Array]"] = !0, On["[object Error]"] = On[Tn] = On["[object WeakMap]"] = !1; const zn = function e(t, n, r, a, l, o) { var i, u = 1 & n, s = 2 & n, c = 4 & n; if (r && (i = l ? r(t, a, l, o) : r(t)), void 0 !== i) return i; if (!K(t)) return t; var f = We(t); if (f) { if (i = ln(t), !u) return Ot(t, i) } else { var d = rn(t), p = d == Tn || "[object GeneratorFunction]" == d; if (Ye(t)) return Pt(t, u); if (d == Pn || d == Cn || p && !l) { if (i = s || p ? {} : gn(t), !u) return s ? Ft(t, kt(i, t)) : Mt(t, bt(i, t)) } else { if (!On[d]) return l ? t : {}; i = yn(t, d, u) } } o || (o = new Re); var m = o.get(t); if (m) return m; o.set(t, i), xn(t) ? t.forEach((function (a) { i.add(e(a, n, r, a, t, o)) })) : wn(t) && t.forEach((function (a, l) { i.set(l, e(a, n, r, l, t, o)) })); var h = f ? void 0 : (c ? s ? Vt : Ut : s ? wt : vt)(t); return Ae(h || t, (function (a, l) { h && (a = t[l = a]), Ie(i, l, e(a, n, r, l, t, o)) })), i }; const jn = function (e) { return zn(e, 4) }; const Rn = function (e, t) { for (var n = -1, r = null == e ? 0 : e.length, a = Array(r); ++n < r;)a[n] = t(e[n], n, e); return a }; const An = function (e) { return "symbol" == typeof e || T(e) && "[object Symbol]" == E(e) }; function Nn(e, t) { if ("function" != typeof e || null != t && "function" != typeof t) throw new TypeError("Expected a function"); var n = function () { var r = arguments, a = t ? t.apply(this, r) : r[0], l = n.cache; if (l.has(a)) return l.get(a); var o = e.apply(this, r); return n.cache = l.set(a, o) || l, o }; return n.cache = new (Nn.Cache || Oe), n } Nn.Cache = Oe; const Mn = Nn; var Ln = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g, In = /\\(\\)?/g; const Fn = function (e) { var t = Mn(e, (function (e) { return 500 === n.size && n.clear(), e })), n = t.cache; return t }((function (e) { var t = []; return 46 === e.charCodeAt(0) && t.push(""), e.replace(Ln, (function (e, n, r, a) { t.push(r ? a.replace(In, "$1") : n || e) })), t })); const Dn = function (e) { if ("string" == typeof e || An(e)) return e; var t = e + ""; return "0" == t && 1 / e == -1 / 0 ? "-0" : t }; var Un = h ? h.prototype : void 0, Vn = Un ? Un.toString : void 0; const Bn = function e(t) { if ("string" == typeof t) return t; if (We(t)) return Rn(t, e) + ""; if (An(t)) return Vn ? Vn.call(t) : ""; var n = t + ""; return "0" == n && 1 / t == -1 / 0 ? "-0" : n }; const $n = function (e) { return null == e ? "" : Bn(e) }; const qn = function (e) { return We(e) ? Rn(e, Dn) : An(e) ? [e] : Ot(Fn($n(e))) }; const Wn = function (e, t) { }; n(219); const Hn = function (e) { return zn(e, 5) }; function Qn() { return Qn = Object.assign || function (e) { for (var t = 1; t < arguments.length; t++) { var n = arguments[t]; for (var r in n) Object.prototype.hasOwnProperty.call(n, r) && (e[r] = n[r]) } return e }, Qn.apply(this, arguments) } function Kn(e, t) { e.prototype = Object.create(t.prototype), e.prototype.constructor = e, e.__proto__ = t } function Gn(e, t) { if (null == e) return {}; var n, r, a = {}, l = Object.keys(e); for (r = 0; r < l.length; r++)n = l[r], t.indexOf(n) >= 0 || (a[n] = e[n]); return a } function Yn(e) { if (void 0 === e) throw new ReferenceError("this hasn't been initialised - super() hasn't been called"); return e } var Xn = function (e) { return Array.isArray(e) && 0 === e.length }, Zn = function (e) { return "function" === typeof e }, Jn = function (e) { return null !== e && "object" === typeof e }, er = function (e) { return String(Math.floor(Number(e))) === e }, tr = function (e) { return "[object String]" === Object.prototype.toString.call(e) }, nr = function (e) { return 0 === r.Children.count(e) }, rr = function (e) { return Jn(e) && Zn(e.then) }; function ar(e, t, n, r) { void 0 === r && (r = 0); for (var a = qn(t); e && r < a.length;)e = e[a[r++]]; return void 0 === e ? n : e } function lr(e, t, n) { for (var r = jn(e), a = r, l = 0, o = qn(t); l < o.length - 1; l++) { var i = o[l], u = ar(e, o.slice(0, l + 1)); if (u && (Jn(u) || Array.isArray(u))) a = a[i] = jn(u); else { var s = o[l + 1]; a = a[i] = er(s) && Number(s) >= 0 ? [] : {} } } return (0 === l ? e : a)[o[l]] === n ? e : (void 0 === n ? delete a[o[l]] : a[o[l]] = n, 0 === l && void 0 === n && delete r[o[l]], r) } function or(e, t, n, r) { void 0 === n && (n = new WeakMap), void 0 === r && (r = {}); for (var a = 0, l = Object.keys(e); a < l.length; a++) { var o = l[a], i = e[o]; Jn(i) ? n.get(i) || (n.set(i, !0), r[o] = Array.isArray(i) ? [] : {}, or(i, t, n, r[o])) : r[o] = t } return r } var ir = (0, r.createContext)(void 0); ir.displayName = "FormikContext"; var ur = ir.Provider; ir.Consumer; function sr() { var e = (0, r.useContext)(ir); return e || Wn(!1), e } function cr(e, t) { switch (t.type) { case "SET_VALUES": return Qn({}, e, { values: t.payload }); case "SET_TOUCHED": return Qn({}, e, { touched: t.payload }); case "SET_ERRORS": return l()(e.errors, t.payload) ? e : Qn({}, e, { errors: t.payload }); case "SET_STATUS": return Qn({}, e, { status: t.payload }); case "SET_ISSUBMITTING": return Qn({}, e, { isSubmitting: t.payload }); case "SET_ISVALIDATING": return Qn({}, e, { isValidating: t.payload }); case "SET_FIELD_VALUE": return Qn({}, e, { values: lr(e.values, t.payload.field, t.payload.value) }); case "SET_FIELD_TOUCHED": return Qn({}, e, { touched: lr(e.touched, t.payload.field, t.payload.value) }); case "SET_FIELD_ERROR": return Qn({}, e, { errors: lr(e.errors, t.payload.field, t.payload.value) }); case "RESET_FORM": return Qn({}, e, t.payload); case "SET_FORMIK_STATE": return t.payload(e); case "SUBMIT_ATTEMPT": return Qn({}, e, { touched: or(e.values, !0), isSubmitting: !0, submitCount: e.submitCount + 1 }); case "SUBMIT_FAILURE": case "SUBMIT_SUCCESS": return Qn({}, e, { isSubmitting: !1 }); default: return e } } var fr = {}, dr = {}; function pr(e) { var t = e.validateOnChange, n = void 0 === t || t, a = e.validateOnBlur, o = void 0 === a || a, i = e.validateOnMount, u = void 0 !== i && i, s = e.isInitialValid, c = e.enableReinitialize, d = void 0 !== c && c, p = e.onSubmit, m = Gn(e, ["validateOnChange", "validateOnBlur", "validateOnMount", "isInitialValid", "enableReinitialize", "onSubmit"]), h = Qn({ validateOnChange: n, validateOnBlur: o, validateOnMount: u, onSubmit: p }, m), y = (0, r.useRef)(h.initialValues), v = (0, r.useRef)(h.initialErrors || fr), b = (0, r.useRef)(h.initialTouched || dr), g = (0, r.useRef)(h.initialStatus), _ = (0, r.useRef)(!1), S = (0, r.useRef)({}); (0, r.useEffect)((function () { return _.current = !0, function () { _.current = !1 } }), []); var w = (0, r.useReducer)(cr, { values: h.initialValues, errors: h.initialErrors || fr, touched: h.initialTouched || dr, status: h.initialStatus, isSubmitting: !1, isValidating: !1, submitCount: 0 }), k = w[0], E = w[1], x = (0, r.useCallback)((function (e, t) { return new Promise((function (n, r) { var a = h.validate(e, t); null == a ? n(fr) : rr(a) ? a.then((function (e) { n(e || fr) }), (function (e) { r(e) })) : n(a) })) }), [h.validate]), C = (0, r.useCallback)((function (e, t) { var n = h.validationSchema, r = Zn(n) ? n(t) : n, a = t && r.validateAt ? r.validateAt(t, e) : function (e, t, n, r) { void 0 === n && (n = !1); void 0 === r && (r = {}); var a = hr(e); return t[n ? "validateSync" : "validate"](a, { abortEarly: !1, context: r }) }(e, r); return new Promise((function (e, t) { a.then((function () { e(fr) }), (function (n) { "ValidationError" === n.name ? e(function (e) { var t = {}; if (e.inner) { if (0 === e.inner.length) return lr(t, e.path, e.message); var n = e.inner, r = Array.isArray(n), a = 0; for (n = r ? n : n[Symbol.iterator](); ;) { var l; if (r) { if (a >= n.length) break; l = n[a++] } else { if ((a = n.next()).done) break; l = a.value } var o = l; ar(t, o.path) || (t = lr(t, o.path, o.message)) } } return t }(n)) : t(n) })) })) }), [h.validationSchema]), T = (0, r.useCallback)((function (e, t) { return new Promise((function (n) { return n(S.current[e].validate(t)) })) }), []), P = (0, r.useCallback)((function (e) { var t = Object.keys(S.current).filter((function (e) { return Zn(S.current[e].validate) })), n = t.length > 0 ? t.map((function (t) { return T(t, ar(e, t)) })) : [Promise.resolve("DO_NOT_DELETE_YOU_WILL_BE_FIRED")]; return Promise.all(n).then((function (e) { return e.reduce((function (e, n, r) { return "DO_NOT_DELETE_YOU_WILL_BE_FIRED" === n || n && (e = lr(e, t[r], n)), e }), {}) })) }), [T]), O = (0, r.useCallback)((function (e) { return Promise.all([P(e), h.validationSchema ? C(e) : {}, h.validate ? x(e) : {}]).then((function (e) { var t = e[0], n = e[1], r = e[2]; return f.all([t, n, r], { arrayMerge: yr }) })) }), [h.validate, h.validationSchema, P, x, C]), z = br((function (e) { return void 0 === e && (e = k.values), E({ type: "SET_ISVALIDATING", payload: !0 }), O(e).then((function (e) { return _.current && (E({ type: "SET_ISVALIDATING", payload: !1 }), E({ type: "SET_ERRORS", payload: e })), e })) })); (0, r.useEffect)((function () { u && !0 === _.current && l()(y.current, h.initialValues) && z(y.current) }), [u, z]); var j = (0, r.useCallback)((function (e) { var t = e && e.values ? e.values : y.current, n = e && e.errors ? e.errors : v.current ? v.current : h.initialErrors || {}, r = e && e.touched ? e.touched : b.current ? b.current : h.initialTouched || {}, a = e && e.status ? e.status : g.current ? g.current : h.initialStatus; y.current = t, v.current = n, b.current = r, g.current = a; var l = function () { E({ type: "RESET_FORM", payload: { isSubmitting: !!e && !!e.isSubmitting, errors: n, touched: r, status: a, values: t, isValidating: !!e && !!e.isValidating, submitCount: e && e.submitCount && "number" === typeof e.submitCount ? e.submitCount : 0 } }) }; if (h.onReset) { var o = h.onReset(k.values, Y); rr(o) ? o.then(l) : l() } else l() }), [h.initialErrors, h.initialStatus, h.initialTouched]); (0, r.useEffect)((function () { !0 !== _.current || l()(y.current, h.initialValues) || (d && (y.current = h.initialValues, j()), u && z(y.current)) }), [d, h.initialValues, j, u, z]), (0, r.useEffect)((function () { d && !0 === _.current && !l()(v.current, h.initialErrors) && (v.current = h.initialErrors || fr, E({ type: "SET_ERRORS", payload: h.initialErrors || fr })) }), [d, h.initialErrors]), (0, r.useEffect)((function () { d && !0 === _.current && !l()(b.current, h.initialTouched) && (b.current = h.initialTouched || dr, E({ type: "SET_TOUCHED", payload: h.initialTouched || dr })) }), [d, h.initialTouched]), (0, r.useEffect)((function () { d && !0 === _.current && !l()(g.current, h.initialStatus) && (g.current = h.initialStatus, E({ type: "SET_STATUS", payload: h.initialStatus })) }), [d, h.initialStatus, h.initialTouched]); var R = br((function (e) { if (S.current[e] && Zn(S.current[e].validate)) { var t = ar(k.values, e), n = S.current[e].validate(t); return rr(n) ? (E({ type: "SET_ISVALIDATING", payload: !0 }), n.then((function (e) { return e })).then((function (t) { E({ type: "SET_FIELD_ERROR", payload: { field: e, value: t } }), E({ type: "SET_ISVALIDATING", payload: !1 }) }))) : (E({ type: "SET_FIELD_ERROR", payload: { field: e, value: n } }), Promise.resolve(n)) } return h.validationSchema ? (E({ type: "SET_ISVALIDATING", payload: !0 }), C(k.values, e).then((function (e) { return e })).then((function (t) { E({ type: "SET_FIELD_ERROR", payload: { field: e, value: t[e] } }), E({ type: "SET_ISVALIDATING", payload: !1 }) }))) : Promise.resolve() })), A = (0, r.useCallback)((function (e, t) { var n = t.validate; S.current[e] = { validate: n } }), []), N = (0, r.useCallback)((function (e) { delete S.current[e] }), []), M = br((function (e, t) { return E({ type: "SET_TOUCHED", payload: e }), (void 0 === t ? o : t) ? z(k.values) : Promise.resolve() })), L = (0, r.useCallback)((function (e) { E({ type: "SET_ERRORS", payload: e }) }), []), I = br((function (e, t) { var r = Zn(e) ? e(k.values) : e; return E({ type: "SET_VALUES", payload: r }), (void 0 === t ? n : t) ? z(r) : Promise.resolve() })), F = (0, r.useCallback)((function (e, t) { E({ type: "SET_FIELD_ERROR", payload: { field: e, value: t } }) }), []), D = br((function (e, t, r) { return E({ type: "SET_FIELD_VALUE", payload: { field: e, value: t } }), (void 0 === r ? n : r) ? z(lr(k.values, e, t)) : Promise.resolve() })), U = (0, r.useCallback)((function (e, t) { var n, r = t, a = e; if (!tr(e)) { e.persist && e.persist(); var l = e.target ? e.target : e.currentTarget, o = l.type, i = l.name, u = l.id, s = l.value, c = l.checked, f = (l.outerHTML, l.options), d = l.multiple; r = t || (i || u), a = /number|range/.test(o) ? (n = parseFloat(s), isNaN(n) ? "" : n) : /checkbox/.test(o) ? function (e, t, n) { if ("boolean" === typeof e) return Boolean(t); var r = [], a = !1, l = -1; if (Array.isArray(e)) r = e, a = (l = e.indexOf(n)) >= 0; else if (!n || "true" == n || "false" == n) return Boolean(t); if (t && n && !a) return r.concat(n); if (!a) return r; return r.slice(0, l).concat(r.slice(l + 1)) }(ar(k.values, r), c, s) : f && d ? function (e) { return Array.from(e).filter((function (e) { return e.selected })).map((function (e) { return e.value })) }(f) : s } r && D(r, a) }), [D, k.values]), V = br((function (e) { if (tr(e)) return function (t) { return U(t, e) }; U(e) })), B = br((function (e, t, n) { return void 0 === t && (t = !0), E({ type: "SET_FIELD_TOUCHED", payload: { field: e, value: t } }), (void 0 === n ? o : n) ? z(k.values) : Promise.resolve() })), $ = (0, r.useCallback)((function (e, t) { e.persist && e.persist(); var n = e.target, r = n.name, a = n.id, l = (n.outerHTML, t || (r || a)); B(l, !0) }), [B]), q = br((function (e) { if (tr(e)) return function (t) { return $(t, e) }; $(e) })), W = (0, r.useCallback)((function (e) { Zn(e) ? E({ type: "SET_FORMIK_STATE", payload: e }) : E({ type: "SET_FORMIK_STATE", payload: function () { return e } }) }), []), H = (0, r.useCallback)((function (e) { E({ type: "SET_STATUS", payload: e }) }), []), Q = (0, r.useCallback)((function (e) { E({ type: "SET_ISSUBMITTING", payload: e }) }), []), K = br((function () { return E({ type: "SUBMIT_ATTEMPT" }), z().then((function (e) { var t = e instanceof Error; if (!t && 0 === Object.keys(e).length) { var n; try { if (void 0 === (n = X())) return } catch (r) { throw r } return Promise.resolve(n).then((function (e) { return _.current && E({ type: "SUBMIT_SUCCESS" }), e })).catch((function (e) { if (_.current) throw E({ type: "SUBMIT_FAILURE" }), e })) } if (_.current && (E({ type: "SUBMIT_FAILURE" }), t)) throw e })) })), G = br((function (e) { e && e.preventDefault && Zn(e.preventDefault) && e.preventDefault(), e && e.stopPropagation && Zn(e.stopPropagation) && e.stopPropagation(), K().catch((function (e) { console.warn("Warning: An unhandled error was caught from submitForm()", e) })) })), Y = { resetForm: j, validateForm: z, validateField: R, setErrors: L, setFieldError: F, setFieldTouched: B, setFieldValue: D, setStatus: H, setSubmitting: Q, setTouched: M, setValues: I, setFormikState: W, submitForm: K }, X = br((function () { return p(k.values, Y) })), Z = br((function (e) { e && e.preventDefault && Zn(e.preventDefault) && e.preventDefault(), e && e.stopPropagation && Zn(e.stopPropagation) && e.stopPropagation(), j() })), J = (0, r.useCallback)((function (e) { return { value: ar(k.values, e), error: ar(k.errors, e), touched: !!ar(k.touched, e), initialValue: ar(y.current, e), initialTouched: !!ar(b.current, e), initialError: ar(v.current, e) } }), [k.errors, k.touched, k.values]), ee = (0, r.useCallback)((function (e) { return { setValue: function (t, n) { return D(e, t, n) }, setTouched: function (t, n) { return B(e, t, n) }, setError: function (t) { return F(e, t) } } }), [D, B, F]), te = (0, r.useCallback)((function (e) { var t = Jn(e), n = t ? e.name : e, r = ar(k.values, n), a = { name: n, value: r, onChange: V, onBlur: q }; if (t) { var l = e.type, o = e.value, i = e.as, u = e.multiple; "checkbox" === l ? void 0 === o ? a.checked = !!r : (a.checked = !(!Array.isArray(r) || !~r.indexOf(o)), a.value = o) : "radio" === l ? (a.checked = r === o, a.value = o) : "select" === i && u && (a.value = a.value || [], a.multiple = !0) } return a }), [q, V, k.values]), ne = (0, r.useMemo)((function () { return !l()(y.current, k.values) }), [y.current, k.values]), re = (0, r.useMemo)((function () { return "undefined" !== typeof s ? ne ? k.errors && 0 === Object.keys(k.errors).length : !1 !== s && Zn(s) ? s(h) : s : k.errors && 0 === Object.keys(k.errors).length }), [s, ne, k.errors, h]); return Qn({}, k, { initialValues: y.current, initialErrors: v.current, initialTouched: b.current, initialStatus: g.current, handleBlur: q, handleChange: V, handleReset: Z, handleSubmit: G, resetForm: j, setErrors: L, setFormikState: W, setFieldTouched: B, setFieldValue: D, setFieldError: F, setStatus: H, setSubmitting: Q, setTouched: M, setValues: I, submitForm: K, validateForm: z, validateField: R, isValid: re, dirty: ne, unregisterField: N, registerField: A, getFieldProps: te, getFieldMeta: J, getFieldHelpers: ee, validateOnBlur: o, validateOnChange: n, validateOnMount: u }) } function mr(e) { var t = pr(e), n = e.component, a = e.children, l = e.render, o = e.innerRef; return (0, r.useImperativeHandle)(o, (function () { return t })), (0, r.createElement)(ur, { value: t }, n ? (0, r.createElement)(n, t) : l ? l(t) : a ? Zn(a) ? a(t) : nr(a) ? null : r.Children.only(a) : null) } function hr(e) { var t = Array.isArray(e) ? [] : {}; for (var n in e) if (Object.prototype.hasOwnProperty.call(e, n)) { var r = String(n); !0 === Array.isArray(e[r]) ? t[r] = e[r].map((function (e) { return !0 === Array.isArray(e) || A(e) ? hr(e) : "" !== e ? e : void 0 })) : A(e[r]) ? t[r] = hr(e[r]) : t[r] = "" !== e[r] ? e[r] : void 0 } return t } function yr(e, t, n) { var r = e.slice(); return t.forEach((function (t, a) { if ("undefined" === typeof r[a]) { var l = !1 !== n.clone && n.isMergeableObject(t); r[a] = l ? f(Array.isArray(t) ? [] : {}, t, n) : t } else n.isMergeableObject(t) ? r[a] = f(e[a], t, n) : -1 === e.indexOf(t) && r.push(t) })), r } var vr = "undefined" !== typeof window && "undefined" !== typeof window.document && "undefined" !== typeof window.document.createElement ? r.useLayoutEffect : r.useEffect; function br(e) { var t = (0, r.useRef)(e); return vr((function () { t.current = e })), (0, r.useCallback)((function () { for (var e = arguments.length, n = new Array(e), r = 0; r < e; r++)n[r] = arguments[r]; return t.current.apply(void 0, n) }), []) } function gr(e) { var t = e.validate, n = e.name, a = e.render, l = e.children, o = e.as, i = e.component, u = Gn(e, ["validate", "name", "render", "children", "as", "component"]), s = Gn(sr(), ["validate", "validationSchema"]); var c = s.registerField, f = s.unregisterField; (0, r.useEffect)((function () { return c(n, { validate: t }), function () { f(n) } }), [c, f, n, t]); var d = s.getFieldProps(Qn({ name: n }, u)), p = s.getFieldMeta(n), m = { field: d, form: s }; if (a) return a(Qn({}, m, { meta: p })); if (Zn(l)) return l(Qn({}, m, { meta: p })); if (i) { if ("string" === typeof i) { var h = u.innerRef, y = Gn(u, ["innerRef"]); return (0, r.createElement)(i, Qn({ ref: h }, d, y), l) } return (0, r.createElement)(i, Qn({ field: d, form: s }, u), l) } var v = o || "input"; if ("string" === typeof v) { var b = u.innerRef, g = Gn(u, ["innerRef"]); return (0, r.createElement)(v, Qn({ ref: b }, d, g), l) } return (0, r.createElement)(v, Qn({}, d, u), l) } var _r = (0, r.forwardRef)((function (e, t) { var n = e.action, a = Gn(e, ["action"]), l = null != n ? n : "#", o = sr(), i = o.handleReset, u = o.handleSubmit; return (0, r.createElement)("form", Object.assign({ onSubmit: u, ref: t, onReset: i, action: l }, a)) })); _r.displayName = "Form"; var Sr = function (e, t, n) { var r = wr(e); return r.splice(t, 0, n), r }, wr = function (e) { if (e) { if (Array.isArray(e)) return [].concat(e); var t = Object.keys(e).map((function (e) { return parseInt(e) })).reduce((function (e, t) { return t > e ? t : e }), 0); return Array.from(Qn({}, e, { length: t + 1 })) } return [] }, kr = function (e) { function t(t) { var n; return (n = e.call(this, t) || this).updateArrayField = function (e, t, r) { var a = n.props, l = a.name; (0, a.formik.setFormikState)((function (n) { var a = "function" === typeof r ? r : e, o = "function" === typeof t ? t : e, i = lr(n.values, l, e(ar(n.values, l))), u = r ? a(ar(n.errors, l)) : void 0, s = t ? o(ar(n.touched, l)) : void 0; return Xn(u) && (u = void 0), Xn(s) && (s = void 0), Qn({}, n, { values: i, errors: r ? lr(n.errors, l, u) : n.errors, touched: t ? lr(n.touched, l, s) : n.touched }) })) }, n.push = function (e) { return n.updateArrayField((function (t) { return [].concat(wr(t), [Hn(e)]) }), !1, !1) }, n.handlePush = function (e) { return function () { return n.push(e) } }, n.swap = function (e, t) { return n.updateArrayField((function (n) { return function (e, t, n) { var r = wr(e), a = r[t]; return r[t] = r[n], r[n] = a, r }(n, e, t) }), !0, !0) }, n.handleSwap = function (e, t) { return function () { return n.swap(e, t) } }, n.move = function (e, t) { return n.updateArrayField((function (n) { return function (e, t, n) { var r = wr(e), a = r[t]; return r.splice(t, 1), r.splice(n, 0, a), r }(n, e, t) }), !0, !0) }, n.handleMove = function (e, t) { return function () { return n.move(e, t) } }, n.insert = function (e, t) { return n.updateArrayField((function (n) { return Sr(n, e, t) }), (function (t) { return Sr(t, e, null) }), (function (t) { return Sr(t, e, null) })) }, n.handleInsert = function (e, t) { return function () { return n.insert(e, t) } }, n.replace = function (e, t) { return n.updateArrayField((function (n) { return function (e, t, n) { var r = wr(e); return r[t] = n, r }(n, e, t) }), !1, !1) }, n.handleReplace = function (e, t) { return function () { return n.replace(e, t) } }, n.unshift = function (e) { var t = -1; return n.updateArrayField((function (n) { var r = n ? [e].concat(n) : [e]; return t < 0 && (t = r.length), r }), (function (e) { var n = e ? [null].concat(e) : [null]; return t < 0 && (t = n.length), n }), (function (e) { var n = e ? [null].concat(e) : [null]; return t < 0 && (t = n.length), n })), t }, n.handleUnshift = function (e) { return function () { return n.unshift(e) } }, n.handleRemove = function (e) { return function () { return n.remove(e) } }, n.handlePop = function () { return function () { return n.pop() } }, n.remove = n.remove.bind(Yn(n)), n.pop = n.pop.bind(Yn(n)), n } Kn(t, e); var n = t.prototype; return n.componentDidUpdate = function (e) { this.props.validateOnChange && this.props.formik.validateOnChange && !l()(ar(e.formik.values, e.name), ar(this.props.formik.values, this.props.name)) && this.props.formik.validateForm(this.props.formik.values) }, n.remove = function (e) { var t; return this.updateArrayField((function (n) { var r = n ? wr(n) : []; return t || (t = r[e]), Zn(r.splice) && r.splice(e, 1), r }), !0, !0), t }, n.pop = function () { var e; return this.updateArrayField((function (t) { var n = t; return e || (e = n && n.pop && n.pop()), n }), !0, !0), e }, n.render = function () { var e = { push: this.push, pop: this.pop, swap: this.swap, move: this.move, insert: this.insert, replace: this.replace, unshift: this.unshift, remove: this.remove, handlePush: this.handlePush, handlePop: this.handlePop, handleSwap: this.handleSwap, handleMove: this.handleMove, handleInsert: this.handleInsert, handleReplace: this.handleReplace, handleUnshift: this.handleUnshift, handleRemove: this.handleRemove }, t = this.props, n = t.component, a = t.render, l = t.children, o = t.name, i = Qn({}, e, { form: Gn(t.formik, ["validate", "validationSchema"]), name: o }); return n ? (0, r.createElement)(n, i) : a ? a(i) : l ? "function" === typeof l ? l(i) : nr(l) ? null : r.Children.only(l) : null }, t }(r.Component); kr.defaultProps = { validateOnChange: !0 } }, 219: (e, t, n) => { var r = n(86), a = { childContextTypes: !0, contextType: !0, contextTypes: !0, defaultProps: !0, displayName: !0, getDefaultProps: !0, getDerivedStateFromError: !0, getDerivedStateFromProps: !0, mixins: !0, propTypes: !0, type: !0 }, l = { name: !0, length: !0, prototype: !0, caller: !0, callee: !0, arguments: !0, arity: !0 }, o = { $$typeof: !0, compare: !0, defaultProps: !0, displayName: !0, propTypes: !0, type: !0 }, i = {}; function u(e) { return r.isMemo(e) ? o : i[e.$$typeof] || a } i[r.ForwardRef] = { $$typeof: !0, render: !0, defaultProps: !0, displayName: !0, propTypes: !0 }, i[r.Memo] = o; var s = Object.defineProperty, c = Object.getOwnPropertyNames, f = Object.getOwnPropertySymbols, d = Object.getOwnPropertyDescriptor, p = Object.getPrototypeOf, m = Object.prototype; e.exports = function e(t, n, r) { if ("string" !== typeof n) { if (m) { var a = p(n); a && a !== m && e(t, a, r) } var o = c(n); f && (o = o.concat(f(n))); for (var i = u(t), h = u(n), y = 0; y < o.length; ++y) { var v = o[y]; if (!l[v] && (!r || !r[v]) && (!h || !h[v]) && (!i || !i[v])) { var b = d(n, v); try { s(t, v, b) } catch (g) { } } } } return t } }, 730: (e, t, n) => { var r = n(43), a = n(853); function l(e) { for (var t = "https://reactjs.org/docs/error-decoder.html?invariant=" + e, n = 1; n < arguments.length; n++)t += "&args[]=" + encodeURIComponent(arguments[n]); return "Minified React error #" + e + "; visit " + t + " for the full message or use the non-minified dev environment for full errors and additional helpful warnings." } var o = new Set, i = {}; function u(e, t) { s(e, t), s(e + "Capture", t) } function s(e, t) { for (i[e] = t, e = 0; e < t.length; e++)o.add(t[e]) } var c = !("undefined" === typeof window || "undefined" === typeof window.document || "undefined" === typeof window.document.createElement), f = Object.prototype.hasOwnProperty, d = /^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\-.0-9\u00B7\u0300-\u036F\u203F-\u2040]*$/, p = {}, m = {}; function h(e, t, n, r, a, l, o) { this.acceptsBooleans = 2 === t || 3 === t || 4 === t, this.attributeName = r, this.attributeNamespace = a, this.mustUseProperty = n, this.propertyName = e, this.type = t, this.sanitizeURL = l, this.removeEmptyString = o } var y = {}; "children dangerouslySetInnerHTML defaultValue defaultChecked innerHTML suppressContentEditableWarning suppressHydrationWarning style".split(" ").forEach((function (e) { y[e] = new h(e, 0, !1, e, null, !1, !1) })), [["acceptCharset", "accept-charset"], ["className", "class"], ["htmlFor", "for"], ["httpEquiv", "http-equiv"]].forEach((function (e) { var t = e[0]; y[t] = new h(t, 1, !1, e[1], null, !1, !1) })), ["contentEditable", "draggable", "spellCheck", "value"].forEach((function (e) { y[e] = new h(e, 2, !1, e.toLowerCase(), null, !1, !1) })), ["autoReverse", "externalResourcesRequired", "focusable", "preserveAlpha"].forEach((function (e) { y[e] = new h(e, 2, !1, e, null, !1, !1) })), "allowFullScreen async autoFocus autoPlay controls default defer disabled disablePictureInPicture disableRemotePlayback formNoValidate hidden loop noModule noValidate open playsInline readOnly required reversed scoped seamless itemScope".split(" ").forEach((function (e) { y[e] = new h(e, 3, !1, e.toLowerCase(), null, !1, !1) })), ["checked", "multiple", "muted", "selected"].forEach((function (e) { y[e] = new h(e, 3, !0, e, null, !1, !1) })), ["capture", "download"].forEach((function (e) { y[e] = new h(e, 4, !1, e, null, !1, !1) })), ["cols", "rows", "size", "span"].forEach((function (e) { y[e] = new h(e, 6, !1, e, null, !1, !1) })), ["rowSpan", "start"].forEach((function (e) { y[e] = new h(e, 5, !1, e.toLowerCase(), null, !1, !1) })); var v = /[\-:]([a-z])/g; function b(e) { return e[1].toUpperCase() } function g(e, t, n, r) { var a = y.hasOwnProperty(t) ? y[t] : null; (null !== a ? 0 !== a.type : r || !(2 < t.length) || "o" !== t[0] && "O" !== t[0] || "n" !== t[1] && "N" !== t[1]) && (function (e, t, n, r) { if (null === t || "undefined" === typeof t || function (e, t, n, r) { if (null !== n && 0 === n.type) return !1; switch (typeof t) { case "function": case "symbol": return !0; case "boolean": return !r && (null !== n ? !n.acceptsBooleans : "data-" !== (e = e.toLowerCase().slice(0, 5)) && "aria-" !== e); default: return !1 } }(e, t, n, r)) return !0; if (r) return !1; if (null !== n) switch (n.type) { case 3: return !t; case 4: return !1 === t; case 5: return isNaN(t); case 6: return isNaN(t) || 1 > t }return !1 }(t, n, a, r) && (n = null), r || null === a ? function (e) { return !!f.call(m, e) || !f.call(p, e) && (d.test(e) ? m[e] = !0 : (p[e] = !0, !1)) }(t) && (null === n ? e.removeAttribute(t) : e.setAttribute(t, "" + n)) : a.mustUseProperty ? e[a.propertyName] = null === n ? 3 !== a.type && "" : n : (t = a.attributeName, r = a.attributeNamespace, null === n ? e.removeAttribute(t) : (n = 3 === (a = a.type) || 4 === a && !0 === n ? "" : "" + n, r ? e.setAttributeNS(r, t, n) : e.setAttribute(t, n)))) } "accent-height alignment-baseline arabic-form baseline-shift cap-height clip-path clip-rule color-interpolation color-interpolation-filters color-profile color-rendering dominant-baseline enable-background fill-opacity fill-rule flood-color flood-opacity font-family font-size font-size-adjust font-stretch font-style font-variant font-weight glyph-name glyph-orientation-horizontal glyph-orientation-vertical horiz-adv-x horiz-origin-x image-rendering letter-spacing lighting-color marker-end marker-mid marker-start overline-position overline-thickness paint-order panose-1 pointer-events rendering-intent shape-rendering stop-color stop-opacity strikethrough-position strikethrough-thickness stroke-dasharray stroke-dashoffset stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity stroke-width text-anchor text-decoration text-rendering underline-position underline-thickness unicode-bidi unicode-range units-per-em v-alphabetic v-hanging v-ideographic v-mathematical vector-effect vert-adv-y vert-origin-x vert-origin-y word-spacing writing-mode xmlns:xlink x-height".split(" ").forEach((function (e) { var t = e.replace(v, b); y[t] = new h(t, 1, !1, e, null, !1, !1) })), "xlink:actuate xlink:arcrole xlink:role xlink:show xlink:title xlink:type".split(" ").forEach((function (e) { var t = e.replace(v, b); y[t] = new h(t, 1, !1, e, "http://www.w3.org/1999/xlink", !1, !1) })), ["xml:base", "xml:lang", "xml:space"].forEach((function (e) { var t = e.replace(v, b); y[t] = new h(t, 1, !1, e, "http://www.w3.org/XML/1998/namespace", !1, !1) })), ["tabIndex", "crossOrigin"].forEach((function (e) { y[e] = new h(e, 1, !1, e.toLowerCase(), null, !1, !1) })), y.xlinkHref = new h("xlinkHref", 1, !1, "xlink:href", "http://www.w3.org/1999/xlink", !0, !1), ["src", "href", "action", "formAction"].forEach((function (e) { y[e] = new h(e, 1, !1, e.toLowerCase(), null, !0, !0) })); var _ = r.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED, S = Symbol.for("react.element"), w = Symbol.for("react.portal"), k = Symbol.for("react.fragment"), E = Symbol.for("react.strict_mode"), x = Symbol.for("react.profiler"), C = Symbol.for("react.provider"), T = Symbol.for("react.context"), P = Symbol.for("react.forward_ref"), O = Symbol.for("react.suspense"), z = Symbol.for("react.suspense_list"), j = Symbol.for("react.memo"), R = Symbol.for("react.lazy"); Symbol.for("react.scope"), Symbol.for("react.debug_trace_mode"); var A = Symbol.for("react.offscreen"); Symbol.for("react.legacy_hidden"), Symbol.for("react.cache"), Symbol.for("react.tracing_marker"); var N = Symbol.iterator; function M(e) { return null === e || "object" !== typeof e ? null : "function" === typeof (e = N && e[N] || e["@@iterator"]) ? e : null } var L, I = Object.assign; function F(e) { if (void 0 === L) try { throw Error() } catch (n) { var t = n.stack.trim().match(/\n( *(at )?)/); L = t && t[1] || "" } return "\n" + L + e } var D = !1; function U(e, t) { if (!e || D) return ""; D = !0; var n = Error.prepareStackTrace; Error.prepareStackTrace = void 0; try { if (t) if (t = function () { throw Error() }, Object.defineProperty(t.prototype, "props", { set: function () { throw Error() } }), "object" === typeof Reflect && Reflect.construct) { try { Reflect.construct(t, []) } catch (s) { var r = s } Reflect.construct(e, [], t) } else { try { t.call() } catch (s) { r = s } e.call(t.prototype) } else { try { throw Error() } catch (s) { r = s } e() } } catch (s) { if (s && r && "string" === typeof s.stack) { for (var a = s.stack.split("\n"), l = r.stack.split("\n"), o = a.length - 1, i = l.length - 1; 1 <= o && 0 <= i && a[o] !== l[i];)i--; for (; 1 <= o && 0 <= i; o--, i--)if (a[o] !== l[i]) { if (1 !== o || 1 !== i) do { if (o--, 0 > --i || a[o] !== l[i]) { var u = "\n" + a[o].replace(" at new ", " at "); return e.displayName && u.includes("<anonymous>") && (u = u.replace("<anonymous>", e.displayName)), u } } while (1 <= o && 0 <= i); break } } } finally { D = !1, Error.prepareStackTrace = n } return (e = e ? e.displayName || e.name : "") ? F(e) : "" } function V(e) { switch (e.tag) { case 5: return F(e.type); case 16: return F("Lazy"); case 13: return F("Suspense"); case 19: return F("SuspenseList"); case 0: case 2: case 15: return e = U(e.type, !1); case 11: return e = U(e.type.render, !1); case 1: return e = U(e.type, !0); default: return "" } } function B(e) { if (null == e) return null; if ("function" === typeof e) return e.displayName || e.name || null; if ("string" === typeof e) return e; switch (e) { case k: return "Fragment"; case w: return "Portal"; case x: return "Profiler"; case E: return "StrictMode"; case O: return "Suspense"; case z: return "SuspenseList" }if ("object" === typeof e) switch (e.$$typeof) { case T: return (e.displayName || "Context") + ".Consumer"; case C: return (e._context.displayName || "Context") + ".Provider"; case P: var t = e.render; return (e = e.displayName) || (e = "" !== (e = t.displayName || t.name || "") ? "ForwardRef(" + e + ")" : "ForwardRef"), e; case j: return null !== (t = e.displayName || null) ? t : B(e.type) || "Memo"; case R: t = e._payload, e = e._init; try { return B(e(t)) } catch (n) { } }return null } function $(e) { var t = e.type; switch (e.tag) { case 24: return "Cache"; case 9: return (t.displayName || "Context") + ".Consumer"; case 10: return (t._context.displayName || "Context") + ".Provider"; case 18: return "DehydratedFragment"; case 11: return e = (e = t.render).displayName || e.name || "", t.displayName || ("" !== e ? "ForwardRef(" + e + ")" : "ForwardRef"); case 7: return "Fragment"; case 5: return t; case 4: return "Portal"; case 3: return "Root"; case 6: return "Text"; case 16: return B(t); case 8: return t === E ? "StrictMode" : "Mode"; case 22: return "Offscreen"; case 12: return "Profiler"; case 21: return "Scope"; case 13: return "Suspense"; case 19: return "SuspenseList"; case 25: return "TracingMarker"; case 1: case 0: case 17: case 2: case 14: case 15: if ("function" === typeof t) return t.displayName || t.name || null; if ("string" === typeof t) return t }return null } function q(e) { switch (typeof e) { case "boolean": case "number": case "string": case "undefined": case "object": return e; default: return "" } } function W(e) { var t = e.type; return (e = e.nodeName) && "input" === e.toLowerCase() && ("checkbox" === t || "radio" === t) } function H(e) { e._valueTracker || (e._valueTracker = function (e) { var t = W(e) ? "checked" : "value", n = Object.getOwnPropertyDescriptor(e.constructor.prototype, t), r = "" + e[t]; if (!e.hasOwnProperty(t) && "undefined" !== typeof n && "function" === typeof n.get && "function" === typeof n.set) { var a = n.get, l = n.set; return Object.defineProperty(e, t, { configurable: !0, get: function () { return a.call(this) }, set: function (e) { r = "" + e, l.call(this, e) } }), Object.defineProperty(e, t, { enumerable: n.enumerable }), { getValue: function () { return r }, setValue: function (e) { r = "" + e }, stopTracking: function () { e._valueTracker = null, delete e[t] } } } }(e)) } function Q(e) { if (!e) return !1; var t = e._valueTracker; if (!t) return !0; var n = t.getValue(), r = ""; return e && (r = W(e) ? e.checked ? "true" : "false" : e.value), (e = r) !== n && (t.setValue(e), !0) } function K(e) { if ("undefined" === typeof (e = e || ("undefined" !== typeof document ? document : void 0))) return null; try { return e.activeElement || e.body } catch (t) { return e.body } } function G(e, t) { var n = t.checked; return I({}, t, { defaultChecked: void 0, defaultValue: void 0, value: void 0, checked: null != n ? n : e._wrapperState.initialChecked }) } function Y(e, t) { var n = null == t.defaultValue ? "" : t.defaultValue, r = null != t.checked ? t.checked : t.defaultChecked; n = q(null != t.value ? t.value : n), e._wrapperState = { initialChecked: r, initialValue: n, controlled: "checkbox" === t.type || "radio" === t.type ? null != t.checked : null != t.value } } function X(e, t) { null != (t = t.checked) && g(e, "checked", t, !1) } function Z(e, t) { X(e, t); var n = q(t.value), r = t.type; if (null != n) "number" === r ? (0 === n && "" === e.value || e.value != n) && (e.value = "" + n) : e.value !== "" + n && (e.value = "" + n); else if ("submit" === r || "reset" === r) return void e.removeAttribute("value"); t.hasOwnProperty("value") ? ee(e, t.type, n) : t.hasOwnProperty("defaultValue") && ee(e, t.type, q(t.defaultValue)), null == t.checked && null != t.defaultChecked && (e.defaultChecked = !!t.defaultChecked) } function J(e, t, n) { if (t.hasOwnProperty("value") || t.hasOwnProperty("defaultValue")) { var r = t.type; if (!("submit" !== r && "reset" !== r || void 0 !== t.value && null !== t.value)) return; t = "" + e._wrapperState.initialValue, n || t === e.value || (e.value = t), e.defaultValue = t } "" !== (n = e.name) && (e.name = ""), e.defaultChecked = !!e._wrapperState.initialChecked, "" !== n && (e.name = n) } function ee(e, t, n) { "number" === t && K(e.ownerDocument) === e || (null == n ? e.defaultValue = "" + e._wrapperState.initialValue : e.defaultValue !== "" + n && (e.defaultValue = "" + n)) } var te = Array.isArray; function ne(e, t, n, r) { if (e = e.options, t) { t = {}; for (var a = 0; a < n.length; a++)t["$" + n[a]] = !0; for (n = 0; n < e.length; n++)a = t.hasOwnProperty("$" + e[n].value), e[n].selected !== a && (e[n].selected = a), a && r && (e[n].defaultSelected = !0) } else { for (n = "" + q(n), t = null, a = 0; a < e.length; a++) { if (e[a].value === n) return e[a].selected = !0, void (r && (e[a].defaultSelected = !0)); null !== t || e[a].disabled || (t = e[a]) } null !== t && (t.selected = !0) } } function re(e, t) { if (null != t.dangerouslySetInnerHTML) throw Error(l(91)); return I({}, t, { value: void 0, defaultValue: void 0, children: "" + e._wrapperState.initialValue }) } function ae(e, t) { var n = t.value; if (null == n) { if (n = t.children, t = t.defaultValue, null != n) { if (null != t) throw Error(l(92)); if (te(n)) { if (1 < n.length) throw Error(l(93)); n = n[0] } t = n } null == t && (t = ""), n = t } e._wrapperState = { initialValue: q(n) } } function le(e, t) { var n = q(t.value), r = q(t.defaultValue); null != n && ((n = "" + n) !== e.value && (e.value = n), null == t.defaultValue && e.defaultValue !== n && (e.defaultValue = n)), null != r && (e.defaultValue = "" + r) } function oe(e) { var t = e.textContent; t === e._wrapperState.initialValue && "" !== t && null !== t && (e.value = t) } function ie(e) { switch (e) { case "svg": return "http://www.w3.org/2000/svg"; case "math": return "http://www.w3.org/1998/Math/MathML"; default: return "http://www.w3.org/1999/xhtml" } } function ue(e, t) { return null == e || "http://www.w3.org/1999/xhtml" === e ? ie(t) : "http://www.w3.org/2000/svg" === e && "foreignObject" === t ? "http://www.w3.org/1999/xhtml" : e } var se, ce, fe = (ce = function (e, t) { if ("http://www.w3.org/2000/svg" !== e.namespaceURI || "innerHTML" in e) e.innerHTML = t; else { for ((se = se || document.createElement("div")).innerHTML = "<svg>" + t.valueOf().toString() + "</svg>", t = se.firstChild; e.firstChild;)e.removeChild(e.firstChild); for (; t.firstChild;)e.appendChild(t.firstChild) } }, "undefined" !== typeof MSApp && MSApp.execUnsafeLocalFunction ? function (e, t, n, r) { MSApp.execUnsafeLocalFunction((function () { return ce(e, t) })) } : ce); function de(e, t) { if (t) { var n = e.firstChild; if (n && n === e.lastChild && 3 === n.nodeType) return void (n.nodeValue = t) } e.textContent = t } var pe = { animationIterationCount: !0, aspectRatio: !0, borderImageOutset: !0, borderImageSlice: !0, borderImageWidth: !0, boxFlex: !0, boxFlexGroup: !0, boxOrdinalGroup: !0, columnCount: !0, columns: !0, flex: !0, flexGrow: !0, flexPositive: !0, flexShrink: !0, flexNegative: !0, flexOrder: !0, gridArea: !0, gridRow: !0, gridRowEnd: !0, gridRowSpan: !0, gridRowStart: !0, gridColumn: !0, gridColumnEnd: !0, gridColumnSpan: !0, gridColumnStart: !0, fontWeight: !0, lineClamp: !0, lineHeight: !0, opacity: !0, order: !0, orphans: !0, tabSize: !0, widows: !0, zIndex: !0, zoom: !0, fillOpacity: !0, floodOpacity: !0, stopOpacity: !0, strokeDasharray: !0, strokeDashoffset: !0, strokeMiterlimit: !0, strokeOpacity: !0, strokeWidth: !0 }, me = ["Webkit", "ms", "Moz", "O"]; function he(e, t, n) { return null == t || "boolean" === typeof t || "" === t ? "" : n || "number" !== typeof t || 0 === t || pe.hasOwnProperty(e) && pe[e] ? ("" + t).trim() : t + "px" } function ye(e, t) { for (var n in e = e.style, t) if (t.hasOwnProperty(n)) { var r = 0 === n.indexOf("--"), a = he(n, t[n], r); "float" === n && (n = "cssFloat"), r ? e.setProperty(n, a) : e[n] = a } } Object.keys(pe).forEach((function (e) { me.forEach((function (t) { t = t + e.charAt(0).toUpperCase() + e.substring(1), pe[t] = pe[e] })) })); var ve = I({ menuitem: !0 }, { area: !0, base: !0, br: !0, col: !0, embed: !0, hr: !0, img: !0, input: !0, keygen: !0, link: !0, meta: !0, param: !0, source: !0, track: !0, wbr: !0 }); function be(e, t) { if (t) { if (ve[e] && (null != t.children || null != t.dangerouslySetInnerHTML)) throw Error(l(137, e)); if (null != t.dangerouslySetInnerHTML) { if (null != t.children) throw Error(l(60)); if ("object" !== typeof t.dangerouslySetInnerHTML || !("__html" in t.dangerouslySetInnerHTML)) throw Error(l(61)) } if (null != t.style && "object" !== typeof t.style) throw Error(l(62)) } } function ge(e, t) { if (-1 === e.indexOf("-")) return "string" === typeof t.is; switch (e) { case "annotation-xml": case "color-profile": case "font-face": case "font-face-src": case "font-face-uri": case "font-face-format": case "font-face-name": case "missing-glyph": return !1; default: return !0 } } var _e = null; function Se(e) { return (e = e.target || e.srcElement || window).correspondingUseElement && (e = e.correspondingUseElement), 3 === e.nodeType ? e.parentNode : e } var we = null, ke = null, Ee = null; function xe(e) { if (e = ga(e)) { if ("function" !== typeof we) throw Error(l(280)); var t = e.stateNode; t && (t = Sa(t), we(e.stateNode, e.type, t)) } } function Ce(e) { ke ? Ee ? Ee.push(e) : Ee = [e] : ke = e } function Te() { if (ke) { var e = ke, t = Ee; if (Ee = ke = null, xe(e), t) for (e = 0; e < t.length; e++)xe(t[e]) } } function Pe(e, t) { return e(t) } function Oe() { } var ze = !1; function je(e, t, n) { if (ze) return e(t, n); ze = !0; try { return Pe(e, t, n) } finally { ze = !1, (null !== ke || null !== Ee) && (Oe(), Te()) } } function Re(e, t) { var n = e.stateNode; if (null === n) return null; var r = Sa(n); if (null === r) return null; n = r[t]; e: switch (t) { case "onClick": case "onClickCapture": case "onDoubleClick": case "onDoubleClickCapture": case "onMouseDown": case "onMouseDownCapture": case "onMouseMove": case "onMouseMoveCapture": case "onMouseUp": case "onMouseUpCapture": case "onMouseEnter": (r = !r.disabled) || (r = !("button" === (e = e.type) || "input" === e || "select" === e || "textarea" === e)), e = !r; break e; default: e = !1 }if (e) return null; if (n && "function" !== typeof n) throw Error(l(231, t, typeof n)); return n } var Ae = !1; if (c) try { var Ne = {}; Object.defineProperty(Ne, "passive", { get: function () { Ae = !0 } }), window.addEventListener("test", Ne, Ne), window.removeEventListener("test", Ne, Ne) } catch (ce) { Ae = !1 } function Me(e, t, n, r, a, l, o, i, u) { var s = Array.prototype.slice.call(arguments, 3); try { t.apply(n, s) } catch (c) { this.onError(c) } } var Le = !1, Ie = null, Fe = !1, De = null, Ue = { onError: function (e) { Le = !0, Ie = e } }; function Ve(e, t, n, r, a, l, o, i, u) { Le = !1, Ie = null, Me.apply(Ue, arguments) } function Be(e) { var t = e, n = e; if (e.alternate) for (; t.return;)t = t.return; else { e = t; do { 0 !== (4098 & (t = e).flags) && (n = t.return), e = t.return } while (e) } return 3 === t.tag ? n : null } function $e(e) { if (13 === e.tag) { var t = e.memoizedState; if (null === t && (null !== (e = e.alternate) && (t = e.memoizedState)), null !== t) return t.dehydrated } return null } function qe(e) { if (Be(e) !== e) throw Error(l(188)) } function We(e) { return null !== (e = function (e) { var t = e.alternate; if (!t) { if (null === (t = Be(e))) throw Error(l(188)); return t !== e ? null : e } for (var n = e, r = t; ;) { var a = n.return; if (null === a) break; var o = a.alternate; if (null === o) { if (null !== (r = a.return)) { n = r; continue } break } if (a.child === o.child) { for (o = a.child; o;) { if (o === n) return qe(a), e; if (o === r) return qe(a), t; o = o.sibling } throw Error(l(188)) } if (n.return !== r.return) n = a, r = o; else { for (var i = !1, u = a.child; u;) { if (u === n) { i = !0, n = a, r = o; break } if (u === r) { i = !0, r = a, n = o; break } u = u.sibling } if (!i) { for (u = o.child; u;) { if (u === n) { i = !0, n = o, r = a; break } if (u === r) { i = !0, r = o, n = a; break } u = u.sibling } if (!i) throw Error(l(189)) } } if (n.alternate !== r) throw Error(l(190)) } if (3 !== n.tag) throw Error(l(188)); return n.stateNode.current === n ? e : t }(e)) ? He(e) : null } function He(e) { if (5 === e.tag || 6 === e.tag) return e; for (e = e.child; null !== e;) { var t = He(e); if (null !== t) return t; e = e.sibling } return null } var Qe = a.unstable_scheduleCallback, Ke = a.unstable_cancelCallback, Ge = a.unstable_shouldYield, Ye = a.unstable_requestPaint, Xe = a.unstable_now, Ze = a.unstable_getCurrentPriorityLevel, Je = a.unstable_ImmediatePriority, et = a.unstable_UserBlockingPriority, tt = a.unstable_NormalPriority, nt = a.unstable_LowPriority, rt = a.unstable_IdlePriority, at = null, lt = null; var ot = Math.clz32 ? Math.clz32 : function (e) { return e >>>= 0, 0 === e ? 32 : 31 - (it(e) / ut | 0) | 0 }, it = Math.log, ut = Math.LN2; var st = 64, ct = 4194304; function ft(e) { switch (e & -e) { case 1: return 1; case 2: return 2; case 4: return 4; case 8: return 8; case 16: return 16; case 32: return 32; case 64: case 128: case 256: case 512: case 1024: case 2048: case 4096: case 8192: case 16384: case 32768: case 65536: case 131072: case 262144: case 524288: case 1048576: case 2097152: return 4194240 & e; case 4194304: case 8388608: case 16777216: case 33554432: case 67108864: return 130023424 & e; case 134217728: return 134217728; case 268435456: return 268435456; case 536870912: return 536870912; case 1073741824: return 1073741824; default: return e } } function dt(e, t) { var n = e.pendingLanes; if (0 === n) return 0; var r = 0, a = e.suspendedLanes, l = e.pingedLanes, o = 268435455 & n; if (0 !== o) { var i = o & ~a; 0 !== i ? r = ft(i) : 0 !== (l &= o) && (r = ft(l)) } else 0 !== (o = n & ~a) ? r = ft(o) : 0 !== l && (r = ft(l)); if (0 === r) return 0; if (0 !== t && t !== r && 0 === (t & a) && ((a = r & -r) >= (l = t & -t) || 16 === a && 0 !== (4194240 & l))) return t; if (0 !== (4 & r) && (r |= 16 & n), 0 !== (t = e.entangledLanes)) for (e = e.entanglements, t &= r; 0 < t;)a = 1 << (n = 31 - ot(t)), r |= e[n], t &= ~a; return r } function pt(e, t) { switch (e) { case 1: case 2: case 4: return t + 250; case 8: case 16: case 32: case 64: case 128: case 256: case 512: case 1024: case 2048: case 4096: case 8192: case 16384: case 32768: case 65536: case 131072: case 262144: case 524288: case 1048576: case 2097152: return t + 5e3; default: return -1 } } function mt(e) { return 0 !== (e = -1073741825 & e.pendingLanes) ? e : 1073741824 & e ? 1073741824 : 0 } function ht() { var e = st; return 0 === (4194240 & (st <<= 1)) && (st = 64), e } function yt(e) { for (var t = [], n = 0; 31 > n; n++)t.push(e); return t } function vt(e, t, n) { e.pendingLanes |= t, 536870912 !== t && (e.suspendedLanes = 0, e.pingedLanes = 0), (e = e.eventTimes)[t = 31 - ot(t)] = n } function bt(e, t) { var n = e.entangledLanes |= t; for (e = e.entanglements; n;) { var r = 31 - ot(n), a = 1 << r; a & t | e[r] & t && (e[r] |= t), n &= ~a } } var gt = 0; function _t(e) { return 1 < (e &= -e) ? 4 < e ? 0 !== (268435455 & e) ? 16 : 536870912 : 4 : 1 } var St, wt, kt, Et, xt, Ct = !1, Tt = [], Pt = null, Ot = null, zt = null, jt = new Map, Rt = new Map, At = [], Nt = "mousedown mouseup touchcancel touchend touchstart auxclick dblclick pointercancel pointerdown pointerup dragend dragstart drop compositionend compositionstart keydown keypress keyup input textInput copy cut paste click change contextmenu reset submit".split(" "); function Mt(e, t) { switch (e) { case "focusin": case "focusout": Pt = null; break; case "dragenter": case "dragleave": Ot = null; break; case "mouseover": case "mouseout": zt = null; break; case "pointerover": case "pointerout": jt.delete(t.pointerId); break; case "gotpointercapture": case "lostpointercapture": Rt.delete(t.pointerId) } } function Lt(e, t, n, r, a, l) { return null === e || e.nativeEvent !== l ? (e = { blockedOn: t, domEventName: n, eventSystemFlags: r, nativeEvent: l, targetContainers: [a] }, null !== t && (null !== (t = ga(t)) && wt(t)), e) : (e.eventSystemFlags |= r, t = e.targetContainers, null !== a && -1 === t.indexOf(a) && t.push(a), e) } function It(e) { var t = ba(e.target); if (null !== t) { var n = Be(t); if (null !== n) if (13 === (t = n.tag)) { if (null !== (t = $e(n))) return e.blockedOn = t, void xt(e.priority, (function () { kt(n) })) } else if (3 === t && n.stateNode.current.memoizedState.isDehydrated) return void (e.blockedOn = 3 === n.tag ? n.stateNode.containerInfo : null) } e.blockedOn = null } function Ft(e) { if (null !== e.blockedOn) return !1; for (var t = e.targetContainers; 0 < t.length;) { var n = Gt(e.domEventName, e.eventSystemFlags, t[0], e.nativeEvent); if (null !== n) return null !== (t = ga(n)) && wt(t), e.blockedOn = n, !1; var r = new (n = e.nativeEvent).constructor(n.type, n); _e = r, n.target.dispatchEvent(r), _e = null, t.shift() } return !0 } function Dt(e, t, n) { Ft(e) && n.delete(t) } function Ut() { Ct = !1, null !== Pt && Ft(Pt) && (Pt = null), null !== Ot && Ft(Ot) && (Ot = null), null !== zt && Ft(zt) && (zt = null), jt.forEach(Dt), Rt.forEach(Dt) } function Vt(e, t) { e.blockedOn === t && (e.blockedOn = null, Ct || (Ct = !0, a.unstable_scheduleCallback(a.unstable_NormalPriority, Ut))) } function Bt(e) { function t(t) { return Vt(t, e) } if (0 < Tt.length) { Vt(Tt[0], e); for (var n = 1; n < Tt.length; n++) { var r = Tt[n]; r.blockedOn === e && (r.blockedOn = null) } } for (null !== Pt && Vt(Pt, e), null !== Ot && Vt(Ot, e), null !== zt && Vt(zt, e), jt.forEach(t), Rt.forEach(t), n = 0; n < At.length; n++)(r = At[n]).blockedOn === e && (r.blockedOn = null); for (; 0 < At.length && null === (n = At[0]).blockedOn;)It(n), null === n.blockedOn && At.shift() } var $t = _.ReactCurrentBatchConfig, qt = !0; function Wt(e, t, n, r) { var a = gt, l = $t.transition; $t.transition = null; try { gt = 1, Qt(e, t, n, r) } finally { gt = a, $t.transition = l } } function Ht(e, t, n, r) { var a = gt, l = $t.transition; $t.transition = null; try { gt = 4, Qt(e, t, n, r) } finally { gt = a, $t.transition = l } } function Qt(e, t, n, r) { if (qt) { var a = Gt(e, t, n, r); if (null === a) qr(e, t, r, Kt, n), Mt(e, r); else if (function (e, t, n, r, a) { switch (t) { case "focusin": return Pt = Lt(Pt, e, t, n, r, a), !0; case "dragenter": return Ot = Lt(Ot, e, t, n, r, a), !0; case "mouseover": return zt = Lt(zt, e, t, n, r, a), !0; case "pointerover": var l = a.pointerId; return jt.set(l, Lt(jt.get(l) || null, e, t, n, r, a)), !0; case "gotpointercapture": return l = a.pointerId, Rt.set(l, Lt(Rt.get(l) || null, e, t, n, r, a)), !0 }return !1 }(a, e, t, n, r)) r.stopPropagation(); else if (Mt(e, r), 4 & t && -1 < Nt.indexOf(e)) { for (; null !== a;) { var l = ga(a); if (null !== l && St(l), null === (l = Gt(e, t, n, r)) && qr(e, t, r, Kt, n), l === a) break; a = l } null !== a && r.stopPropagation() } else qr(e, t, r, null, n) } } var Kt = null; function Gt(e, t, n, r) { if (Kt = null, null !== (e = ba(e = Se(r)))) if (null === (t = Be(e))) e = null; else if (13 === (n = t.tag)) { if (null !== (e = $e(t))) return e; e = null } else if (3 === n) { if (t.stateNode.current.memoizedState.isDehydrated) return 3 === t.tag ? t.stateNode.containerInfo : null; e = null } else t !== e && (e = null); return Kt = e, null } function Yt(e) { switch (e) { case "cancel": case "click": case "close": case "contextmenu": case "copy": case "cut": case "auxclick": case "dblclick": case "dragend": case "dragstart": case "drop": case "focusin": case "focusout": case "input": case "invalid": case "keydown": case "keypress": case "keyup": case "mousedown": case "mouseup": case "paste": case "pause": case "play": case "pointercancel": case "pointerdown": case "pointerup": case "ratechange": case "reset": case "resize": case "seeked": case "submit": case "touchcancel": case "touchend": case "touchstart": case "volumechange": case "change": case "selectionchange": case "textInput": case "compositionstart": case "compositionend": case "compositionupdate": case "beforeblur": case "afterblur": case "beforeinput": case "blur": case "fullscreenchange": case "focus": case "hashchange": case "popstate": case "select": case "selectstart": return 1; case "drag": case "dragenter": case "dragexit": case "dragleave": case "dragover": case "mousemove": case "mouseout": case "mouseover": case "pointermove": case "pointerout": case "pointerover": case "scroll": case "toggle": case "touchmove": case "wheel": case "mouseenter": case "mouseleave": case "pointerenter": case "pointerleave": return 4; case "message": switch (Ze()) { case Je: return 1; case et: return 4; case tt: case nt: return 16; case rt: return 536870912; default: return 16 }default: return 16 } } var Xt = null, Zt = null, Jt = null; function en() { if (Jt) return Jt; var e, t, n = Zt, r = n.length, a = "value" in Xt ? Xt.value : Xt.textContent, l = a.length; for (e = 0; e < r && n[e] === a[e]; e++); var o = r - e; for (t = 1; t <= o && n[r - t] === a[l - t]; t++); return Jt = a.slice(e, 1 < t ? 1 - t : void 0) } function tn(e) { var t = e.keyCode; return "charCode" in e ? 0 === (e = e.charCode) && 13 === t && (e = 13) : e = t, 10 === e && (e = 13), 32 <= e || 13 === e ? e : 0 } function nn() { return !0 } function rn() { return !1 } function an(e) { function t(t, n, r, a, l) { for (var o in this._reactName = t, this._targetInst = r, this.type = n, this.nativeEvent = a, this.target = l, this.currentTarget = null, e) e.hasOwnProperty(o) && (t = e[o], this[o] = t ? t(a) : a[o]); return this.isDefaultPrevented = (null != a.defaultPrevented ? a.defaultPrevented : !1 === a.returnValue) ? nn : rn, this.isPropagationStopped = rn, this } return I(t.prototype, { preventDefault: function () { this.defaultPrevented = !0; var e = this.nativeEvent; e && (e.preventDefault ? e.preventDefault() : "unknown" !== typeof e.returnValue && (e.returnValue = !1), this.isDefaultPrevented = nn) }, stopPropagation: function () { var e = this.nativeEvent; e && (e.stopPropagation ? e.stopPropagation() : "unknown" !== typeof e.cancelBubble && (e.cancelBubble = !0), this.isPropagationStopped = nn) }, persist: function () { }, isPersistent: nn }), t } var ln, on, un, sn = { eventPhase: 0, bubbles: 0, cancelable: 0, timeStamp: function (e) { return e.timeStamp || Date.now() }, defaultPrevented: 0, isTrusted: 0 }, cn = an(sn), fn = I({}, sn, { view: 0, detail: 0 }), dn = an(fn), pn = I({}, fn, { screenX: 0, screenY: 0, clientX: 0, clientY: 0, pageX: 0, pageY: 0, ctrlKey: 0, shiftKey: 0, altKey: 0, metaKey: 0, getModifierState: xn, button: 0, buttons: 0, relatedTarget: function (e) { return void 0 === e.relatedTarget ? e.fromElement === e.srcElement ? e.toElement : e.fromElement : e.relatedTarget }, movementX: function (e) { return "movementX" in e ? e.movementX : (e !== un && (un && "mousemove" === e.type ? (ln = e.screenX - un.screenX, on = e.screenY - un.screenY) : on = ln = 0, un = e), ln) }, movementY: function (e) { return "movementY" in e ? e.movementY : on } }), mn = an(pn), hn = an(I({}, pn, { dataTransfer: 0 })), yn = an(I({}, fn, { relatedTarget: 0 })), vn = an(I({}, sn, { animationName: 0, elapsedTime: 0, pseudoElement: 0 })), bn = I({}, sn, { clipboardData: function (e) { return "clipboardData" in e ? e.clipboardData : window.clipboardData } }), gn = an(bn), _n = an(I({}, sn, { data: 0 })), Sn = { Esc: "Escape", Spacebar: " ", Left: "ArrowLeft", Up: "ArrowUp", Right: "ArrowRight", Down: "ArrowDown", Del: "Delete", Win: "OS", Menu: "ContextMenu", Apps: "ContextMenu", Scroll: "ScrollLock", MozPrintableKey: "Unidentified" }, wn = { 8: "Backspace", 9: "Tab", 12: "Clear", 13: "Enter", 16: "Shift", 17: "Control", 18: "Alt", 19: "Pause", 20: "CapsLock", 27: "Escape", 32: " ", 33: "PageUp", 34: "PageDown", 35: "End", 36: "Home", 37: "ArrowLeft", 38: "ArrowUp", 39: "ArrowRight", 40: "ArrowDown", 45: "Insert", 46: "Delete", 112: "F1", 113: "F2", 114: "F3", 115: "F4", 116: "F5", 117: "F6", 118: "F7", 119: "F8", 120: "F9", 121: "F10", 122: "F11", 123: "F12", 144: "NumLock", 145: "ScrollLock", 224: "Meta" }, kn = { Alt: "altKey", Control: "ctrlKey", Meta: "metaKey", Shift: "shiftKey" }; function En(e) { var t = this.nativeEvent; return t.getModifierState ? t.getModifierState(e) : !!(e = kn[e]) && !!t[e] } function xn() { return En } var Cn = I({}, fn, { key: function (e) { if (e.key) { var t = Sn[e.key] || e.key; if ("Unidentified" !== t) return t } return "keypress" === e.type ? 13 === (e = tn(e)) ? "Enter" : String.fromCharCode(e) : "keydown" === e.type || "keyup" === e.type ? wn[e.keyCode] || "Unidentified" : "" }, code: 0, location: 0, ctrlKey: 0, shiftKey: 0, altKey: 0, metaKey: 0, repeat: 0, locale: 0, getModifierState: xn, charCode: function (e) { return "keypress" === e.type ? tn(e) : 0 }, keyCode: function (e) { return "keydown" === e.type || "keyup" === e.type ? e.keyCode : 0 }, which: function (e) { return "keypress" === e.type ? tn(e) : "keydown" === e.type || "keyup" === e.type ? e.keyCode : 0 } }), Tn = an(Cn), Pn = an(I({}, pn, { pointerId: 0, width: 0, height: 0, pressure: 0, tangentialPressure: 0, tiltX: 0, tiltY: 0, twist: 0, pointerType: 0, isPrimary: 0 })), On = an(I({}, fn, { touches: 0, targetTouches: 0, changedTouches: 0, altKey: 0, metaKey: 0, ctrlKey: 0, shiftKey: 0, getModifierState: xn })), zn = an(I({}, sn, { propertyName: 0, elapsedTime: 0, pseudoElement: 0 })), jn = I({}, pn, { deltaX: function (e) { return "deltaX" in e ? e.deltaX : "wheelDeltaX" in e ? -e.wheelDeltaX : 0 }, deltaY: function (e) { return "deltaY" in e ? e.deltaY : "wheelDeltaY" in e ? -e.wheelDeltaY : "wheelDelta" in e ? -e.wheelDelta : 0 }, deltaZ: 0, deltaMode: 0 }), Rn = an(jn), An = [9, 13, 27, 32], Nn = c && "CompositionEvent" in window, Mn = null; c && "documentMode" in document && (Mn = document.documentMode); var Ln = c && "TextEvent" in window && !Mn, In = c && (!Nn || Mn && 8 < Mn && 11 >= Mn), Fn = String.fromCharCode(32), Dn = !1; function Un(e, t) { switch (e) { case "keyup": return -1 !== An.indexOf(t.keyCode); case "keydown": return 229 !== t.keyCode; case "keypress": case "mousedown": case "focusout": return !0; default: return !1 } } function Vn(e) { return "object" === typeof (e = e.detail) && "data" in e ? e.data : null } var Bn = !1; var $n = { color: !0, date: !0, datetime: !0, "datetime-local": !0, email: !0, month: !0, number: !0, password: !0, range: !0, search: !0, tel: !0, text: !0, time: !0, url: !0, week: !0 }; function qn(e) { var t = e && e.nodeName && e.nodeName.toLowerCase(); return "input" === t ? !!$n[e.type] : "textarea" === t } function Wn(e, t, n, r) { Ce(r), 0 < (t = Hr(t, "onChange")).length && (n = new cn("onChange", "change", null, n, r), e.push({ event: n, listeners: t })) } var Hn = null, Qn = null; function Kn(e) { Fr(e, 0) } function Gn(e) { if (Q(_a(e))) return e } function Yn(e, t) { if ("change" === e) return t } var Xn = !1; if (c) { var Zn; if (c) { var Jn = "oninput" in document; if (!Jn) { var er = document.createElement("div"); er.setAttribute("oninput", "return;"), Jn = "function" === typeof er.oninput } Zn = Jn } else Zn = !1; Xn = Zn && (!document.documentMode || 9 < document.documentMode) } function tr() { Hn && (Hn.detachEvent("onpropertychange", nr), Qn = Hn = null) } function nr(e) { if ("value" === e.propertyName && Gn(Qn)) { var t = []; Wn(t, Qn, e, Se(e)), je(Kn, t) } } function rr(e, t, n) { "focusin" === e ? (tr(), Qn = n, (Hn = t).attachEvent("onpropertychange", nr)) : "focusout" === e && tr() } function ar(e) { if ("selectionchange" === e || "keyup" === e || "keydown" === e) return Gn(Qn) } function lr(e, t) { if ("click" === e) return Gn(t) } function or(e, t) { if ("input" === e || "change" === e) return Gn(t) } var ir = "function" === typeof Object.is ? Object.is : function (e, t) { return e === t && (0 !== e || 1 / e === 1 / t) || e !== e && t !== t }; function ur(e, t) { if (ir(e, t)) return !0; if ("object" !== typeof e || null === e || "object" !== typeof t || null === t) return !1; var n = Object.keys(e), r = Object.keys(t); if (n.length !== r.length) return !1; for (r = 0; r < n.length; r++) { var a = n[r]; if (!f.call(t, a) || !ir(e[a], t[a])) return !1 } return !0 } function sr(e) { for (; e && e.firstChild;)e = e.firstChild; return e } function cr(e, t) { var n, r = sr(e); for (e = 0; r;) { if (3 === r.nodeType) { if (n = e + r.textContent.length, e <= t && n >= t) return { node: r, offset: t - e }; e = n } e: { for (; r;) { if (r.nextSibling) { r = r.nextSibling; break e } r = r.parentNode } r = void 0 } r = sr(r) } } function fr(e, t) { return !(!e || !t) && (e === t || (!e || 3 !== e.nodeType) && (t && 3 === t.nodeType ? fr(e, t.parentNode) : "contains" in e ? e.contains(t) : !!e.compareDocumentPosition && !!(16 & e.compareDocumentPosition(t)))) } function dr() { for (var e = window, t = K(); t instanceof e.HTMLIFrameElement;) { try { var n = "string" === typeof t.contentWindow.location.href } catch (r) { n = !1 } if (!n) break; t = K((e = t.contentWindow).document) } return t } function pr(e) { var t = e && e.nodeName && e.nodeName.toLowerCase(); return t && ("input" === t && ("text" === e.type || "search" === e.type || "tel" === e.type || "url" === e.type || "password" === e.type) || "textarea" === t || "true" === e.contentEditable) } function mr(e) { var t = dr(), n = e.focusedElem, r = e.selectionRange; if (t !== n && n && n.ownerDocument && fr(n.ownerDocument.documentElement, n)) { if (null !== r && pr(n)) if (t = r.start, void 0 === (e = r.end) && (e = t), "selectionStart" in n) n.selectionStart = t, n.selectionEnd = Math.min(e, n.value.length); else if ((e = (t = n.ownerDocument || document) && t.defaultView || window).getSelection) { e = e.getSelection(); var a = n.textContent.length, l = Math.min(r.start, a); r = void 0 === r.end ? l : Math.min(r.end, a), !e.extend && l > r && (a = r, r = l, l = a), a = cr(n, l); var o = cr(n, r); a && o && (1 !== e.rangeCount || e.anchorNode !== a.node || e.anchorOffset !== a.offset || e.focusNode !== o.node || e.focusOffset !== o.offset) && ((t = t.createRange()).setStart(a.node, a.offset), e.removeAllRanges(), l > r ? (e.addRange(t), e.extend(o.node, o.offset)) : (t.setEnd(o.node, o.offset), e.addRange(t))) } for (t = [], e = n; e = e.parentNode;)1 === e.nodeType && t.push({ element: e, left: e.scrollLeft, top: e.scrollTop }); for ("function" === typeof n.focus && n.focus(), n = 0; n < t.length; n++)(e = t[n]).element.scrollLeft = e.left, e.element.scrollTop = e.top } } var hr = c && "documentMode" in document && 11 >= document.documentMode, yr = null, vr = null, br = null, gr = !1; function _r(e, t, n) { var r = n.window === n ? n.document : 9 === n.nodeType ? n : n.ownerDocument; gr || null == yr || yr !== K(r) || ("selectionStart" in (r = yr) && pr(r) ? r = { start: r.selectionStart, end: r.selectionEnd } : r = { anchorNode: (r = (r.ownerDocument && r.ownerDocument.defaultView || window).getSelection()).anchorNode, anchorOffset: r.anchorOffset, focusNode: r.focusNode, focusOffset: r.focusOffset }, br && ur(br, r) || (br = r, 0 < (r = Hr(vr, "onSelect")).length && (t = new cn("onSelect", "select", null, t, n), e.push({ event: t, listeners: r }), t.target = yr))) } function Sr(e, t) { var n = {}; return n[e.toLowerCase()] = t.toLowerCase(), n["Webkit" + e] = "webkit" + t, n["Moz" + e] = "moz" + t, n } var wr = { animationend: Sr("Animation", "AnimationEnd"), animationiteration: Sr("Animation", "AnimationIteration"), animationstart: Sr("Animation", "AnimationStart"), transitionend: Sr("Transition", "TransitionEnd") }, kr = {}, Er = {}; function xr(e) { if (kr[e]) return kr[e]; if (!wr[e]) return e; var t, n = wr[e]; for (t in n) if (n.hasOwnProperty(t) && t in Er) return kr[e] = n[t]; return e } c && (Er = document.createElement("div").style, "AnimationEvent" in window || (delete wr.animationend.animation, delete wr.animationiteration.animation, delete wr.animationstart.animation), "TransitionEvent" in window || delete wr.transitionend.transition); var Cr = xr("animationend"), Tr = xr("animationiteration"), Pr = xr("animationstart"), Or = xr("transitionend"), zr = new Map, jr = "abort auxClick cancel canPlay canPlayThrough click close contextMenu copy cut drag dragEnd dragEnter dragExit dragLeave dragOver dragStart drop durationChange emptied encrypted ended error gotPointerCapture input invalid keyDown keyPress keyUp load loadedData loadedMetadata loadStart lostPointerCapture mouseDown mouseMove mouseOut mouseOver mouseUp paste pause play playing pointerCancel pointerDown pointerMove pointerOut pointerOver pointerUp progress rateChange reset resize seeked seeking stalled submit suspend timeUpdate touchCancel touchEnd touchStart volumeChange scroll toggle touchMove waiting wheel".split(" "); function Rr(e, t) { zr.set(e, t), u(t, [e]) } for (var Ar = 0; Ar < jr.length; Ar++) { var Nr = jr[Ar]; Rr(Nr.toLowerCase(), "on" + (Nr[0].toUpperCase() + Nr.slice(1))) } Rr(Cr, "onAnimationEnd"), Rr(Tr, "onAnimationIteration"), Rr(Pr, "onAnimationStart"), Rr("dblclick", "onDoubleClick"), Rr("focusin", "onFocus"), Rr("focusout", "onBlur"), Rr(Or, "onTransitionEnd"), s("onMouseEnter", ["mouseout", "mouseover"]), s("onMouseLeave", ["mouseout", "mouseover"]), s("onPointerEnter", ["pointerout", "pointerover"]), s("onPointerLeave", ["pointerout", "pointerover"]), u("onChange", "change click focusin focusout input keydown keyup selectionchange".split(" ")), u("onSelect", "focusout contextmenu dragend focusin keydown keyup mousedown mouseup selectionchange".split(" ")), u("onBeforeInput", ["compositionend", "keypress", "textInput", "paste"]), u("onCompositionEnd", "compositionend focusout keydown keypress keyup mousedown".split(" ")), u("onCompositionStart", "compositionstart focusout keydown keypress keyup mousedown".split(" ")), u("onCompositionUpdate", "compositionupdate focusout keydown keypress keyup mousedown".split(" ")); var Mr = "abort canplay canplaythrough durationchange emptied encrypted ended error loadeddata loadedmetadata loadstart pause play playing progress ratechange resize seeked seeking stalled suspend timeupdate volumechange waiting".split(" "), Lr = new Set("cancel close invalid load scroll toggle".split(" ").concat(Mr)); function Ir(e, t, n) { var r = e.type || "unknown-event"; e.currentTarget = n, function (e, t, n, r, a, o, i, u, s) { if (Ve.apply(this, arguments), Le) { if (!Le) throw Error(l(198)); var c = Ie; Le = !1, Ie = null, Fe || (Fe = !0, De = c) } }(r, t, void 0, e), e.currentTarget = null } function Fr(e, t) { t = 0 !== (4 & t); for (var n = 0; n < e.length; n++) { var r = e[n], a = r.event; r = r.listeners; e: { var l = void 0; if (t) for (var o = r.length - 1; 0 <= o; o--) { var i = r[o], u = i.instance, s = i.currentTarget; if (i = i.listener, u !== l && a.isPropagationStopped()) break e; Ir(a, i, s), l = u } else for (o = 0; o < r.length; o++) { if (u = (i = r[o]).instance, s = i.currentTarget, i = i.listener, u !== l && a.isPropagationStopped()) break e; Ir(a, i, s), l = u } } } if (Fe) throw e = De, Fe = !1, De = null, e } function Dr(e, t) { var n = t[ha]; void 0 === n && (n = t[ha] = new Set); var r = e + "__bubble"; n.has(r) || ($r(t, e, 2, !1), n.add(r)) } function Ur(e, t, n) { var r = 0; t && (r |= 4), $r(n, e, r, t) } var Vr = "_reactListening" + Math.random().toString(36).slice(2); function Br(e) { if (!e[Vr]) { e[Vr] = !0, o.forEach((function (t) { "selectionchange" !== t && (Lr.has(t) || Ur(t, !1, e), Ur(t, !0, e)) })); var t = 9 === e.nodeType ? e : e.ownerDocument; null === t || t[Vr] || (t[Vr] = !0, Ur("selectionchange", !1, t)) } } function $r(e, t, n, r) { switch (Yt(t)) { case 1: var a = Wt; break; case 4: a = Ht; break; default: a = Qt }n = a.bind(null, t, n, e), a = void 0, !Ae || "touchstart" !== t && "touchmove" !== t && "wheel" !== t || (a = !0), r ? void 0 !== a ? e.addEventListener(t, n, { capture: !0, passive: a }) : e.addEventListener(t, n, !0) : void 0 !== a ? e.addEventListener(t, n, { passive: a }) : e.addEventListener(t, n, !1) } function qr(e, t, n, r, a) { var l = r; if (0 === (1 & t) && 0 === (2 & t) && null !== r) e: for (; ;) { if (null === r) return; var o = r.tag; if (3 === o || 4 === o) { var i = r.stateNode.containerInfo; if (i === a || 8 === i.nodeType && i.parentNode === a) break; if (4 === o) for (o = r.return; null !== o;) { var u = o.tag; if ((3 === u || 4 === u) && ((u = o.stateNode.containerInfo) === a || 8 === u.nodeType && u.parentNode === a)) return; o = o.return } for (; null !== i;) { if (null === (o = ba(i))) return; if (5 === (u = o.tag) || 6 === u) { r = l = o; continue e } i = i.parentNode } } r = r.return } je((function () { var r = l, a = Se(n), o = []; e: { var i = zr.get(e); if (void 0 !== i) { var u = cn, s = e; switch (e) { case "keypress": if (0 === tn(n)) break e; case "keydown": case "keyup": u = Tn; break; case "focusin": s = "focus", u = yn; break; case "focusout": s = "blur", u = yn; break; case "beforeblur": case "afterblur": u = yn; break; case "click": if (2 === n.button) break e; case "auxclick": case "dblclick": case "mousedown": case "mousemove": case "mouseup": case "mouseout": case "mouseover": case "contextmenu": u = mn; break; case "drag": case "dragend": case "dragenter": case "dragexit": case "dragleave": case "dragover": case "dragstart": case "drop": u = hn; break; case "touchcancel": case "touchend": case "touchmove": case "touchstart": u = On; break; case Cr: case Tr: case Pr: u = vn; break; case Or: u = zn; break; case "scroll": u = dn; break; case "wheel": u = Rn; break; case "copy": case "cut": case "paste": u = gn; break; case "gotpointercapture": case "lostpointercapture": case "pointercancel": case "pointerdown": case "pointermove": case "pointerout": case "pointerover": case "pointerup": u = Pn }var c = 0 !== (4 & t), f = !c && "scroll" === e, d = c ? null !== i ? i + "Capture" : null : i; c = []; for (var p, m = r; null !== m;) { var h = (p = m).stateNode; if (5 === p.tag && null !== h && (p = h, null !== d && (null != (h = Re(m, d)) && c.push(Wr(m, h, p)))), f) break; m = m.return } 0 < c.length && (i = new u(i, s, null, n, a), o.push({ event: i, listeners: c })) } } if (0 === (7 & t)) { if (u = "mouseout" === e || "pointerout" === e, (!(i = "mouseover" === e || "pointerover" === e) || n === _e || !(s = n.relatedTarget || n.fromElement) || !ba(s) && !s[ma]) && (u || i) && (i = a.window === a ? a : (i = a.ownerDocument) ? i.defaultView || i.parentWindow : window, u ? (u = r, null !== (s = (s = n.relatedTarget || n.toElement) ? ba(s) : null) && (s !== (f = Be(s)) || 5 !== s.tag && 6 !== s.tag) && (s = null)) : (u = null, s = r), u !== s)) { if (c = mn, h = "onMouseLeave", d = "onMouseEnter", m = "mouse", "pointerout" !== e && "pointerover" !== e || (c = Pn, h = "onPointerLeave", d = "onPointerEnter", m = "pointer"), f = null == u ? i : _a(u), p = null == s ? i : _a(s), (i = new c(h, m + "leave", u, n, a)).target = f, i.relatedTarget = p, h = null, ba(a) === r && ((c = new c(d, m + "enter", s, n, a)).target = p, c.relatedTarget = f, h = c), f = h, u && s) e: { for (d = s, m = 0, p = c = u; p; p = Qr(p))m++; for (p = 0, h = d; h; h = Qr(h))p++; for (; 0 < m - p;)c = Qr(c), m--; for (; 0 < p - m;)d = Qr(d), p--; for (; m--;) { if (c === d || null !== d && c === d.alternate) break e; c = Qr(c), d = Qr(d) } c = null } else c = null; null !== u && Kr(o, i, u, c, !1), null !== s && null !== f && Kr(o, f, s, c, !0) } if ("select" === (u = (i = r ? _a(r) : window).nodeName && i.nodeName.toLowerCase()) || "input" === u && "file" === i.type) var y = Yn; else if (qn(i)) if (Xn) y = or; else { y = ar; var v = rr } else (u = i.nodeName) && "input" === u.toLowerCase() && ("checkbox" === i.type || "radio" === i.type) && (y = lr); switch (y && (y = y(e, r)) ? Wn(o, y, n, a) : (v && v(e, i, r), "focusout" === e && (v = i._wrapperState) && v.controlled && "number" === i.type && ee(i, "number", i.value)), v = r ? _a(r) : window, e) { case "focusin": (qn(v) || "true" === v.contentEditable) && (yr = v, vr = r, br = null); break; case "focusout": br = vr = yr = null; break; case "mousedown": gr = !0; break; case "contextmenu": case "mouseup": case "dragend": gr = !1, _r(o, n, a); break; case "selectionchange": if (hr) break; case "keydown": case "keyup": _r(o, n, a) }var b; if (Nn) e: { switch (e) { case "compositionstart": var g = "onCompositionStart"; break e; case "compositionend": g = "onCompositionEnd"; break e; case "compositionupdate": g = "onCompositionUpdate"; break e }g = void 0 } else Bn ? Un(e, n) && (g = "onCompositionEnd") : "keydown" === e && 229 === n.keyCode && (g = "onCompositionStart"); g && (In && "ko" !== n.locale && (Bn || "onCompositionStart" !== g ? "onCompositionEnd" === g && Bn && (b = en()) : (Zt = "value" in (Xt = a) ? Xt.value : Xt.textContent, Bn = !0)), 0 < (v = Hr(r, g)).length && (g = new _n(g, e, null, n, a), o.push({ event: g, listeners: v }), b ? g.data = b : null !== (b = Vn(n)) && (g.data = b))), (b = Ln ? function (e, t) { switch (e) { case "compositionend": return Vn(t); case "keypress": return 32 !== t.which ? null : (Dn = !0, Fn); case "textInput": return (e = t.data) === Fn && Dn ? null : e; default: return null } }(e, n) : function (e, t) { if (Bn) return "compositionend" === e || !Nn && Un(e, t) ? (e = en(), Jt = Zt = Xt = null, Bn = !1, e) : null; switch (e) { case "paste": default: return null; case "keypress": if (!(t.ctrlKey || t.altKey || t.metaKey) || t.ctrlKey && t.altKey) { if (t.char && 1 < t.char.length) return t.char; if (t.which) return String.fromCharCode(t.which) } return null; case "compositionend": return In && "ko" !== t.locale ? null : t.data } }(e, n)) && (0 < (r = Hr(r, "onBeforeInput")).length && (a = new _n("onBeforeInput", "beforeinput", null, n, a), o.push({ event: a, listeners: r }), a.data = b)) } Fr(o, t) })) } function Wr(e, t, n) { return { instance: e, listener: t, currentTarget: n } } function Hr(e, t) { for (var n = t + "Capture", r = []; null !== e;) { var a = e, l = a.stateNode; 5 === a.tag && null !== l && (a = l, null != (l = Re(e, n)) && r.unshift(Wr(e, l, a)), null != (l = Re(e, t)) && r.push(Wr(e, l, a))), e = e.return } return r } function Qr(e) { if (null === e) return null; do { e = e.return } while (e && 5 !== e.tag); return e || null } function Kr(e, t, n, r, a) { for (var l = t._reactName, o = []; null !== n && n !== r;) { var i = n, u = i.alternate, s = i.stateNode; if (null !== u && u === r) break; 5 === i.tag && null !== s && (i = s, a ? null != (u = Re(n, l)) && o.unshift(Wr(n, u, i)) : a || null != (u = Re(n, l)) && o.push(Wr(n, u, i))), n = n.return } 0 !== o.length && e.push({ event: t, listeners: o }) } var Gr = /\r\n?/g, Yr = /\u0000|\uFFFD/g; function Xr(e) { return ("string" === typeof e ? e : "" + e).replace(Gr, "\n").replace(Yr, "") } function Zr(e, t, n) { if (t = Xr(t), Xr(e) !== t && n) throw Error(l(425)) } function Jr() { } var ea = null, ta = null; function na(e, t) { return "textarea" === e || "noscript" === e || "string" === typeof t.children || "number" === typeof t.children || "object" === typeof t.dangerouslySetInnerHTML && null !== t.dangerouslySetInnerHTML && null != t.dangerouslySetInnerHTML.__html } var ra = "function" === typeof setTimeout ? setTimeout : void 0, aa = "function" === typeof clearTimeout ? clearTimeout : void 0, la = "function" === typeof Promise ? Promise : void 0, oa = "function" === typeof queueMicrotask ? queueMicrotask : "undefined" !== typeof la ? function (e) { return la.resolve(null).then(e).catch(ia) } : ra; function ia(e) { setTimeout((function () { throw e })) } function ua(e, t) { var n = t, r = 0; do { var a = n.nextSibling; if (e.removeChild(n), a && 8 === a.nodeType) if ("/$" === (n = a.data)) { if (0 === r) return e.removeChild(a), void Bt(t); r-- } else "$" !== n && "$?" !== n && "$!" !== n || r++; n = a } while (n); Bt(t) } function sa(e) { for (; null != e; e = e.nextSibling) { var t = e.nodeType; if (1 === t || 3 === t) break; if (8 === t) { if ("$" === (t = e.data) || "$!" === t || "$?" === t) break; if ("/$" === t) return null } } return e } function ca(e) { e = e.previousSibling; for (var t = 0; e;) { if (8 === e.nodeType) { var n = e.data; if ("$" === n || "$!" === n || "$?" === n) { if (0 === t) return e; t-- } else "/$" === n && t++ } e = e.previousSibling } return null } var fa = Math.random().toString(36).slice(2), da = "__reactFiber$" + fa, pa = "__reactProps$" + fa, ma = "__reactContainer$" + fa, ha = "__reactEvents$" + fa, ya = "__reactListeners$" + fa, va = "__reactHandles$" + fa; function ba(e) { var t = e[da]; if (t) return t; for (var n = e.parentNode; n;) { if (t = n[ma] || n[da]) { if (n = t.alternate, null !== t.child || null !== n && null !== n.child) for (e = ca(e); null !== e;) { if (n = e[da]) return n; e = ca(e) } return t } n = (e = n).parentNode } return null } function ga(e) { return !(e = e[da] || e[ma]) || 5 !== e.tag && 6 !== e.tag && 13 !== e.tag && 3 !== e.tag ? null : e } function _a(e) { if (5 === e.tag || 6 === e.tag) return e.stateNode; throw Error(l(33)) } function Sa(e) { return e[pa] || null } var wa = [], ka = -1; function Ea(e) { return { current: e } } function xa(e) { 0 > ka || (e.current = wa[ka], wa[ka] = null, ka--) } function Ca(e, t) { ka++, wa[ka] = e.current, e.current = t } var Ta = {}, Pa = Ea(Ta), Oa = Ea(!1), za = Ta; function ja(e, t) { var n = e.type.contextTypes; if (!n) return Ta; var r = e.stateNode; if (r && r.__reactInternalMemoizedUnmaskedChildContext === t) return r.__reactInternalMemoizedMaskedChildContext; var a, l = {}; for (a in n) l[a] = t[a]; return r && ((e = e.stateNode).__reactInternalMemoizedUnmaskedChildContext = t, e.__reactInternalMemoizedMaskedChildContext = l), l } function Ra(e) { return null !== (e = e.childContextTypes) && void 0 !== e } function Aa() { xa(Oa), xa(Pa) } function Na(e, t, n) { if (Pa.current !== Ta) throw Error(l(168)); Ca(Pa, t), Ca(Oa, n) } function Ma(e, t, n) { var r = e.stateNode; if (t = t.childContextTypes, "function" !== typeof r.getChildContext) return n; for (var a in r = r.getChildContext()) if (!(a in t)) throw Error(l(108, $(e) || "Unknown", a)); return I({}, n, r) } function La(e) { return e = (e = e.stateNode) && e.__reactInternalMemoizedMergedChildContext || Ta, za = Pa.current, Ca(Pa, e), Ca(Oa, Oa.current), !0 } function Ia(e, t, n) { var r = e.stateNode; if (!r) throw Error(l(169)); n ? (e = Ma(e, t, za), r.__reactInternalMemoizedMergedChildContext = e, xa(Oa), xa(Pa), Ca(Pa, e)) : xa(Oa), Ca(Oa, n) } var Fa = null, Da = !1, Ua = !1; function Va(e) { null === Fa ? Fa = [e] : Fa.push(e) } function Ba() { if (!Ua && null !== Fa) { Ua = !0; var e = 0, t = gt; try { var n = Fa; for (gt = 1; e < n.length; e++) { var r = n[e]; do { r = r(!0) } while (null !== r) } Fa = null, Da = !1 } catch (a) { throw null !== Fa && (Fa = Fa.slice(e + 1)), Qe(Je, Ba), a } finally { gt = t, Ua = !1 } } return null } var $a = [], qa = 0, Wa = null, Ha = 0, Qa = [], Ka = 0, Ga = null, Ya = 1, Xa = ""; function Za(e, t) { $a[qa++] = Ha, $a[qa++] = Wa, Wa = e, Ha = t } function Ja(e, t, n) { Qa[Ka++] = Ya, Qa[Ka++] = Xa, Qa[Ka++] = Ga, Ga = e; var r = Ya; e = Xa; var a = 32 - ot(r) - 1; r &= ~(1 << a), n += 1; var l = 32 - ot(t) + a; if (30 < l) { var o = a - a % 5; l = (r & (1 << o) - 1).toString(32), r >>= o, a -= o, Ya = 1 << 32 - ot(t) + a | n << a | r, Xa = l + e } else Ya = 1 << l | n << a | r, Xa = e } function el(e) { null !== e.return && (Za(e, 1), Ja(e, 1, 0)) } function tl(e) { for (; e === Wa;)Wa = $a[--qa], $a[qa] = null, Ha = $a[--qa], $a[qa] = null; for (; e === Ga;)Ga = Qa[--Ka], Qa[Ka] = null, Xa = Qa[--Ka], Qa[Ka] = null, Ya = Qa[--Ka], Qa[Ka] = null } var nl = null, rl = null, al = !1, ll = null; function ol(e, t) { var n = Rs(5, null, null, 0); n.elementType = "DELETED", n.stateNode = t, n.return = e, null === (t = e.deletions) ? (e.deletions = [n], e.flags |= 16) : t.push(n) } function il(e, t) { switch (e.tag) { case 5: var n = e.type; return null !== (t = 1 !== t.nodeType || n.toLowerCase() !== t.nodeName.toLowerCase() ? null : t) && (e.stateNode = t, nl = e, rl = sa(t.firstChild), !0); case 6: return null !== (t = "" === e.pendingProps || 3 !== t.nodeType ? null : t) && (e.stateNode = t, nl = e, rl = null, !0); case 13: return null !== (t = 8 !== t.nodeType ? null : t) && (n = null !== Ga ? { id: Ya, overflow: Xa } : null, e.memoizedState = { dehydrated: t, treeContext: n, retryLane: 1073741824 }, (n = Rs(18, null, null, 0)).stateNode = t, n.return = e, e.child = n, nl = e, rl = null, !0); default: return !1 } } function ul(e) { return 0 !== (1 & e.mode) && 0 === (128 & e.flags) } function sl(e) { if (al) { var t = rl; if (t) { var n = t; if (!il(e, t)) { if (ul(e)) throw Error(l(418)); t = sa(n.nextSibling); var r = nl; t && il(e, t) ? ol(r, n) : (e.flags = -4097 & e.flags | 2, al = !1, nl = e) } } else { if (ul(e)) throw Error(l(418)); e.flags = -4097 & e.flags | 2, al = !1, nl = e } } } function cl(e) { for (e = e.return; null !== e && 5 !== e.tag && 3 !== e.tag && 13 !== e.tag;)e = e.return; nl = e } function fl(e) { if (e !== nl) return !1; if (!al) return cl(e), al = !0, !1; var t; if ((t = 3 !== e.tag) && !(t = 5 !== e.tag) && (t = "head" !== (t = e.type) && "body" !== t && !na(e.type, e.memoizedProps)), t && (t = rl)) { if (ul(e)) throw dl(), Error(l(418)); for (; t;)ol(e, t), t = sa(t.nextSibling) } if (cl(e), 13 === e.tag) { if (!(e = null !== (e = e.memoizedState) ? e.dehydrated : null)) throw Error(l(317)); e: { for (e = e.nextSibling, t = 0; e;) { if (8 === e.nodeType) { var n = e.data; if ("/$" === n) { if (0 === t) { rl = sa(e.nextSibling); break e } t-- } else "$" !== n && "$!" !== n && "$?" !== n || t++ } e = e.nextSibling } rl = null } } else rl = nl ? sa(e.stateNode.nextSibling) : null; return !0 } function dl() { for (var e = rl; e;)e = sa(e.nextSibling) } function pl() { rl = nl = null, al = !1 } function ml(e) { null === ll ? ll = [e] : ll.push(e) } var hl = _.ReactCurrentBatchConfig; function yl(e, t) { if (e && e.defaultProps) { for (var n in t = I({}, t), e = e.defaultProps) void 0 === t[n] && (t[n] = e[n]); return t } return t } var vl = Ea(null), bl = null, gl = null, _l = null; function Sl() { _l = gl = bl = null } function wl(e) { var t = vl.current; xa(vl), e._currentValue = t } function kl(e, t, n) { for (; null !== e;) { var r = e.alternate; if ((e.childLanes & t) !== t ? (e.childLanes |= t, null !== r && (r.childLanes |= t)) : null !== r && (r.childLanes & t) !== t && (r.childLanes |= t), e === n) break; e = e.return } } function El(e, t) { bl = e, _l = gl = null, null !== (e = e.dependencies) && null !== e.firstContext && (0 !== (e.lanes & t) && (_i = !0), e.firstContext = null) } function xl(e) { var t = e._currentValue; if (_l !== e) if (e = { context: e, memoizedValue: t, next: null }, null === gl) { if (null === bl) throw Error(l(308)); gl = e, bl.dependencies = { lanes: 0, firstContext: e } } else gl = gl.next = e; return t } var Cl = null; function Tl(e) { null === Cl ? Cl = [e] : Cl.push(e) } function Pl(e, t, n, r) { var a = t.interleaved; return null === a ? (n.next = n, Tl(t)) : (n.next = a.next, a.next = n), t.interleaved = n, Ol(e, r) } function Ol(e, t) { e.lanes |= t; var n = e.alternate; for (null !== n && (n.lanes |= t), n = e, e = e.return; null !== e;)e.childLanes |= t, null !== (n = e.alternate) && (n.childLanes |= t), n = e, e = e.return; return 3 === n.tag ? n.stateNode : null } var zl = !1; function jl(e) { e.updateQueue = { baseState: e.memoizedState, firstBaseUpdate: null, lastBaseUpdate: null, shared: { pending: null, interleaved: null, lanes: 0 }, effects: null } } function Rl(e, t) { e = e.updateQueue, t.updateQueue === e && (t.updateQueue = { baseState: e.baseState, firstBaseUpdate: e.firstBaseUpdate, lastBaseUpdate: e.lastBaseUpdate, shared: e.shared, effects: e.effects }) } function Al(e, t) { return { eventTime: e, lane: t, tag: 0, payload: null, callback: null, next: null } } function Nl(e, t, n) { var r = e.updateQueue; if (null === r) return null; if (r = r.shared, 0 !== (2 & Ou)) { var a = r.pending; return null === a ? t.next = t : (t.next = a.next, a.next = t), r.pending = t, Ol(e, n) } return null === (a = r.interleaved) ? (t.next = t, Tl(r)) : (t.next = a.next, a.next = t), r.interleaved = t, Ol(e, n) } function Ml(e, t, n) { if (null !== (t = t.updateQueue) && (t = t.shared, 0 !== (4194240 & n))) { var r = t.lanes; n |= r &= e.pendingLanes, t.lanes = n, bt(e, n) } } function Ll(e, t) { var n = e.updateQueue, r = e.alternate; if (null !== r && n === (r = r.updateQueue)) { var a = null, l = null; if (null !== (n = n.firstBaseUpdate)) { do { var o = { eventTime: n.eventTime, lane: n.lane, tag: n.tag, payload: n.payload, callback: n.callback, next: null }; null === l ? a = l = o : l = l.next = o, n = n.next } while (null !== n); null === l ? a = l = t : l = l.next = t } else a = l = t; return n = { baseState: r.baseState, firstBaseUpdate: a, lastBaseUpdate: l, shared: r.shared, effects: r.effects }, void (e.updateQueue = n) } null === (e = n.lastBaseUpdate) ? n.firstBaseUpdate = t : e.next = t, n.lastBaseUpdate = t } function Il(e, t, n, r) { var a = e.updateQueue; zl = !1; var l = a.firstBaseUpdate, o = a.lastBaseUpdate, i = a.shared.pending; if (null !== i) { a.shared.pending = null; var u = i, s = u.next; u.next = null, null === o ? l = s : o.next = s, o = u; var c = e.alternate; null !== c && ((i = (c = c.updateQueue).lastBaseUpdate) !== o && (null === i ? c.firstBaseUpdate = s : i.next = s, c.lastBaseUpdate = u)) } if (null !== l) { var f = a.baseState; for (o = 0, c = s = u = null, i = l; ;) { var d = i.lane, p = i.eventTime; if ((r & d) === d) { null !== c && (c = c.next = { eventTime: p, lane: 0, tag: i.tag, payload: i.payload, callback: i.callback, next: null }); e: { var m = e, h = i; switch (d = t, p = n, h.tag) { case 1: if ("function" === typeof (m = h.payload)) { f = m.call(p, f, d); break e } f = m; break e; case 3: m.flags = -65537 & m.flags | 128; case 0: if (null === (d = "function" === typeof (m = h.payload) ? m.call(p, f, d) : m) || void 0 === d) break e; f = I({}, f, d); break e; case 2: zl = !0 } } null !== i.callback && 0 !== i.lane && (e.flags |= 64, null === (d = a.effects) ? a.effects = [i] : d.push(i)) } else p = { eventTime: p, lane: d, tag: i.tag, payload: i.payload, callback: i.callback, next: null }, null === c ? (s = c = p, u = f) : c = c.next = p, o |= d; if (null === (i = i.next)) { if (null === (i = a.shared.pending)) break; i = (d = i).next, d.next = null, a.lastBaseUpdate = d, a.shared.pending = null } } if (null === c && (u = f), a.baseState = u, a.firstBaseUpdate = s, a.lastBaseUpdate = c, null !== (t = a.shared.interleaved)) { a = t; do { o |= a.lane, a = a.next } while (a !== t) } else null === l && (a.shared.lanes = 0); Iu |= o, e.lanes = o, e.memoizedState = f } } function Fl(e, t, n) { if (e = t.effects, t.effects = null, null !== e) for (t = 0; t < e.length; t++) { var r = e[t], a = r.callback; if (null !== a) { if (r.callback = null, r = n, "function" !== typeof a) throw Error(l(191, a)); a.call(r) } } } var Dl = (new r.Component).refs; function Ul(e, t, n, r) { n = null === (n = n(r, t = e.memoizedState)) || void 0 === n ? t : I({}, t, n), e.memoizedState = n, 0 === e.lanes && (e.updateQueue.baseState = n) } var Vl = { isMounted: function (e) { return !!(e = e._reactInternals) && Be(e) === e }, enqueueSetState: function (e, t, n) { e = e._reactInternals; var r = ts(), a = ns(e), l = Al(r, a); l.payload = t, void 0 !== n && null !== n && (l.callback = n), null !== (t = Nl(e, l, a)) && (rs(t, e, a, r), Ml(t, e, a)) }, enqueueReplaceState: function (e, t, n) { e = e._reactInternals; var r = ts(), a = ns(e), l = Al(r, a); l.tag = 1, l.payload = t, void 0 !== n && null !== n && (l.callback = n), null !== (t = Nl(e, l, a)) && (rs(t, e, a, r), Ml(t, e, a)) }, enqueueForceUpdate: function (e, t) { e = e._reactInternals; var n = ts(), r = ns(e), a = Al(n, r); a.tag = 2, void 0 !== t && null !== t && (a.callback = t), null !== (t = Nl(e, a, r)) && (rs(t, e, r, n), Ml(t, e, r)) } }; function Bl(e, t, n, r, a, l, o) { return "function" === typeof (e = e.stateNode).shouldComponentUpdate ? e.shouldComponentUpdate(r, l, o) : !t.prototype || !t.prototype.isPureReactComponent || (!ur(n, r) || !ur(a, l)) } function $l(e, t, n) { var r = !1, a = Ta, l = t.contextType; return "object" === typeof l && null !== l ? l = xl(l) : (a = Ra(t) ? za : Pa.current, l = (r = null !== (r = t.contextTypes) && void 0 !== r) ? ja(e, a) : Ta), t = new t(n, l), e.memoizedState = null !== t.state && void 0 !== t.state ? t.state : null, t.updater = Vl, e.stateNode = t, t._reactInternals = e, r && ((e = e.stateNode).__reactInternalMemoizedUnmaskedChildContext = a, e.__reactInternalMemoizedMaskedChildContext = l), t } function ql(e, t, n, r) { e = t.state, "function" === typeof t.componentWillReceiveProps && t.componentWillReceiveProps(n, r), "function" === typeof t.UNSAFE_componentWillReceiveProps && t.UNSAFE_componentWillReceiveProps(n, r), t.state !== e && Vl.enqueueReplaceState(t, t.state, null) } function Wl(e, t, n, r) { var a = e.stateNode; a.props = n, a.state = e.memoizedState, a.refs = Dl, jl(e); var l = t.contextType; "object" === typeof l && null !== l ? a.context = xl(l) : (l = Ra(t) ? za : Pa.current, a.context = ja(e, l)), a.state = e.memoizedState, "function" === typeof (l = t.getDerivedStateFromProps) && (Ul(e, t, l, n), a.state = e.memoizedState), "function" === typeof t.getDerivedStateFromProps || "function" === typeof a.getSnapshotBeforeUpdate || "function" !== typeof a.UNSAFE_componentWillMount && "function" !== typeof a.componentWillMount || (t = a.state, "function" === typeof a.componentWillMount && a.componentWillMount(), "function" === typeof a.UNSAFE_componentWillMount && a.UNSAFE_componentWillMount(), t !== a.state && Vl.enqueueReplaceState(a, a.state, null), Il(e, n, a, r), a.state = e.memoizedState), "function" === typeof a.componentDidMount && (e.flags |= 4194308) } function Hl(e, t, n) { if (null !== (e = n.ref) && "function" !== typeof e && "object" !== typeof e) { if (n._owner) { if (n = n._owner) { if (1 !== n.tag) throw Error(l(309)); var r = n.stateNode } if (!r) throw Error(l(147, e)); var a = r, o = "" + e; return null !== t && null !== t.ref && "function" === typeof t.ref && t.ref._stringRef === o ? t.ref : (t = function (e) { var t = a.refs; t === Dl && (t = a.refs = {}), null === e ? delete t[o] : t[o] = e }, t._stringRef = o, t) } if ("string" !== typeof e) throw Error(l(284)); if (!n._owner) throw Error(l(290, e)) } return e } function Ql(e, t) { throw e = Object.prototype.toString.call(t), Error(l(31, "[object Object]" === e ? "object with keys {" + Object.keys(t).join(", ") + "}" : e)) } function Kl(e) { return (0, e._init)(e._payload) } function Gl(e) { function t(t, n) { if (e) { var r = t.deletions; null === r ? (t.deletions = [n], t.flags |= 16) : r.push(n) } } function n(n, r) { if (!e) return null; for (; null !== r;)t(n, r), r = r.sibling; return null } function r(e, t) { for (e = new Map; null !== t;)null !== t.key ? e.set(t.key, t) : e.set(t.index, t), t = t.sibling; return e } function a(e, t) { return (e = Ns(e, t)).index = 0, e.sibling = null, e } function o(t, n, r) { return t.index = r, e ? null !== (r = t.alternate) ? (r = r.index) < n ? (t.flags |= 2, n) : r : (t.flags |= 2, n) : (t.flags |= 1048576, n) } function i(t) { return e && null === t.alternate && (t.flags |= 2), t } function u(e, t, n, r) { return null === t || 6 !== t.tag ? ((t = Fs(n, e.mode, r)).return = e, t) : ((t = a(t, n)).return = e, t) } function s(e, t, n, r) { var l = n.type; return l === k ? f(e, t, n.props.children, r, n.key) : null !== t && (t.elementType === l || "object" === typeof l && null !== l && l.$$typeof === R && Kl(l) === t.type) ? ((r = a(t, n.props)).ref = Hl(e, t, n), r.return = e, r) : ((r = Ms(n.type, n.key, n.props, null, e.mode, r)).ref = Hl(e, t, n), r.return = e, r) } function c(e, t, n, r) { return null === t || 4 !== t.tag || t.stateNode.containerInfo !== n.containerInfo || t.stateNode.implementation !== n.implementation ? ((t = Ds(n, e.mode, r)).return = e, t) : ((t = a(t, n.children || [])).return = e, t) } function f(e, t, n, r, l) { return null === t || 7 !== t.tag ? ((t = Ls(n, e.mode, r, l)).return = e, t) : ((t = a(t, n)).return = e, t) } function d(e, t, n) { if ("string" === typeof t && "" !== t || "number" === typeof t) return (t = Fs("" + t, e.mode, n)).return = e, t; if ("object" === typeof t && null !== t) { switch (t.$$typeof) { case S: return (n = Ms(t.type, t.key, t.props, null, e.mode, n)).ref = Hl(e, null, t), n.return = e, n; case w: return (t = Ds(t, e.mode, n)).return = e, t; case R: return d(e, (0, t._init)(t._payload), n) }if (te(t) || M(t)) return (t = Ls(t, e.mode, n, null)).return = e, t; Ql(e, t) } return null } function p(e, t, n, r) { var a = null !== t ? t.key : null; if ("string" === typeof n && "" !== n || "number" === typeof n) return null !== a ? null : u(e, t, "" + n, r); if ("object" === typeof n && null !== n) { switch (n.$$typeof) { case S: return n.key === a ? s(e, t, n, r) : null; case w: return n.key === a ? c(e, t, n, r) : null; case R: return p(e, t, (a = n._init)(n._payload), r) }if (te(n) || M(n)) return null !== a ? null : f(e, t, n, r, null); Ql(e, n) } return null } function m(e, t, n, r, a) { if ("string" === typeof r && "" !== r || "number" === typeof r) return u(t, e = e.get(n) || null, "" + r, a); if ("object" === typeof r && null !== r) { switch (r.$$typeof) { case S: return s(t, e = e.get(null === r.key ? n : r.key) || null, r, a); case w: return c(t, e = e.get(null === r.key ? n : r.key) || null, r, a); case R: return m(e, t, n, (0, r._init)(r._payload), a) }if (te(r) || M(r)) return f(t, e = e.get(n) || null, r, a, null); Ql(t, r) } return null } function h(a, l, i, u) { for (var s = null, c = null, f = l, h = l = 0, y = null; null !== f && h < i.length; h++) { f.index > h ? (y = f, f = null) : y = f.sibling; var v = p(a, f, i[h], u); if (null === v) { null === f && (f = y); break } e && f && null === v.alternate && t(a, f), l = o(v, l, h), null === c ? s = v : c.sibling = v, c = v, f = y } if (h === i.length) return n(a, f), al && Za(a, h), s; if (null === f) { for (; h < i.length; h++)null !== (f = d(a, i[h], u)) && (l = o(f, l, h), null === c ? s = f : c.sibling = f, c = f); return al && Za(a, h), s } for (f = r(a, f); h < i.length; h++)null !== (y = m(f, a, h, i[h], u)) && (e && null !== y.alternate && f.delete(null === y.key ? h : y.key), l = o(y, l, h), null === c ? s = y : c.sibling = y, c = y); return e && f.forEach((function (e) { return t(a, e) })), al && Za(a, h), s } function y(a, i, u, s) { var c = M(u); if ("function" !== typeof c) throw Error(l(150)); if (null == (u = c.call(u))) throw Error(l(151)); for (var f = c = null, h = i, y = i = 0, v = null, b = u.next(); null !== h && !b.done; y++, b = u.next()) { h.index > y ? (v = h, h = null) : v = h.sibling; var g = p(a, h, b.value, s); if (null === g) { null === h && (h = v); break } e && h && null === g.alternate && t(a, h), i = o(g, i, y), null === f ? c = g : f.sibling = g, f = g, h = v } if (b.done) return n(a, h), al && Za(a, y), c; if (null === h) { for (; !b.done; y++, b = u.next())null !== (b = d(a, b.value, s)) && (i = o(b, i, y), null === f ? c = b : f.sibling = b, f = b); return al && Za(a, y), c } for (h = r(a, h); !b.done; y++, b = u.next())null !== (b = m(h, a, y, b.value, s)) && (e && null !== b.alternate && h.delete(null === b.key ? y : b.key), i = o(b, i, y), null === f ? c = b : f.sibling = b, f = b); return e && h.forEach((function (e) { return t(a, e) })), al && Za(a, y), c } return function e(r, l, o, u) { if ("object" === typeof o && null !== o && o.type === k && null === o.key && (o = o.props.children), "object" === typeof o && null !== o) { switch (o.$$typeof) { case S: e: { for (var s = o.key, c = l; null !== c;) { if (c.key === s) { if ((s = o.type) === k) { if (7 === c.tag) { n(r, c.sibling), (l = a(c, o.props.children)).return = r, r = l; break e } } else if (c.elementType === s || "object" === typeof s && null !== s && s.$$typeof === R && Kl(s) === c.type) { n(r, c.sibling), (l = a(c, o.props)).ref = Hl(r, c, o), l.return = r, r = l; break e } n(r, c); break } t(r, c), c = c.sibling } o.type === k ? ((l = Ls(o.props.children, r.mode, u, o.key)).return = r, r = l) : ((u = Ms(o.type, o.key, o.props, null, r.mode, u)).ref = Hl(r, l, o), u.return = r, r = u) } return i(r); case w: e: { for (c = o.key; null !== l;) { if (l.key === c) { if (4 === l.tag && l.stateNode.containerInfo === o.containerInfo && l.stateNode.implementation === o.implementation) { n(r, l.sibling), (l = a(l, o.children || [])).return = r, r = l; break e } n(r, l); break } t(r, l), l = l.sibling } (l = Ds(o, r.mode, u)).return = r, r = l } return i(r); case R: return e(r, l, (c = o._init)(o._payload), u) }if (te(o)) return h(r, l, o, u); if (M(o)) return y(r, l, o, u); Ql(r, o) } return "string" === typeof o && "" !== o || "number" === typeof o ? (o = "" + o, null !== l && 6 === l.tag ? (n(r, l.sibling), (l = a(l, o)).return = r, r = l) : (n(r, l), (l = Fs(o, r.mode, u)).return = r, r = l), i(r)) : n(r, l) } } var Yl = Gl(!0), Xl = Gl(!1), Zl = {}, Jl = Ea(Zl), eo = Ea(Zl), to = Ea(Zl); function no(e) { if (e === Zl) throw Error(l(174)); return e } function ro(e, t) { switch (Ca(to, t), Ca(eo, e), Ca(Jl, Zl), e = t.nodeType) { case 9: case 11: t = (t = t.documentElement) ? t.namespaceURI : ue(null, ""); break; default: t = ue(t = (e = 8 === e ? t.parentNode : t).namespaceURI || null, e = e.tagName) }xa(Jl), Ca(Jl, t) } function ao() { xa(Jl), xa(eo), xa(to) } function lo(e) { no(to.current); var t = no(Jl.current), n = ue(t, e.type); t !== n && (Ca(eo, e), Ca(Jl, n)) } function oo(e) { eo.current === e && (xa(Jl), xa(eo)) } var io = Ea(0); function uo(e) { for (var t = e; null !== t;) { if (13 === t.tag) { var n = t.memoizedState; if (null !== n && (null === (n = n.dehydrated) || "$?" === n.data || "$!" === n.data)) return t } else if (19 === t.tag && void 0 !== t.memoizedProps.revealOrder) { if (0 !== (128 & t.flags)) return t } else if (null !== t.child) { t.child.return = t, t = t.child; continue } if (t === e) break; for (; null === t.sibling;) { if (null === t.return || t.return === e) return null; t = t.return } t.sibling.return = t.return, t = t.sibling } return null } var so = []; function co() { for (var e = 0; e < so.length; e++)so[e]._workInProgressVersionPrimary = null; so.length = 0 } var fo = _.ReactCurrentDispatcher, po = _.ReactCurrentBatchConfig, mo = 0, ho = null, yo = null, vo = null, bo = !1, go = !1, _o = 0, So = 0; function wo() { throw Error(l(321)) } function ko(e, t) { if (null === t) return !1; for (var n = 0; n < t.length && n < e.length; n++)if (!ir(e[n], t[n])) return !1; return !0 } function Eo(e, t, n, r, a, o) { if (mo = o, ho = t, t.memoizedState = null, t.updateQueue = null, t.lanes = 0, fo.current = null === e || null === e.memoizedState ? ii : ui, e = n(r, a), go) { o = 0; do { if (go = !1, _o = 0, 25 <= o) throw Error(l(301)); o += 1, vo = yo = null, t.updateQueue = null, fo.current = si, e = n(r, a) } while (go) } if (fo.current = oi, t = null !== yo && null !== yo.next, mo = 0, vo = yo = ho = null, bo = !1, t) throw Error(l(300)); return e } function xo() { var e = 0 !== _o; return _o = 0, e } function Co() { var e = { memoizedState: null, baseState: null, baseQueue: null, queue: null, next: null }; return null === vo ? ho.memoizedState = vo = e : vo = vo.next = e, vo } function To() { if (null === yo) { var e = ho.alternate; e = null !== e ? e.memoizedState : null } else e = yo.next; var t = null === vo ? ho.memoizedState : vo.next; if (null !== t) vo = t, yo = e; else { if (null === e) throw Error(l(310)); e = { memoizedState: (yo = e).memoizedState, baseState: yo.baseState, baseQueue: yo.baseQueue, queue: yo.queue, next: null }, null === vo ? ho.memoizedState = vo = e : vo = vo.next = e } return vo } function Po(e, t) { return "function" === typeof t ? t(e) : t } function Oo(e) { var t = To(), n = t.queue; if (null === n) throw Error(l(311)); n.lastRenderedReducer = e; var r = yo, a = r.baseQueue, o = n.pending; if (null !== o) { if (null !== a) { var i = a.next; a.next = o.next, o.next = i } r.baseQueue = a = o, n.pending = null } if (null !== a) { o = a.next, r = r.baseState; var u = i = null, s = null, c = o; do { var f = c.lane; if ((mo & f) === f) null !== s && (s = s.next = { lane: 0, action: c.action, hasEagerState: c.hasEagerState, eagerState: c.eagerState, next: null }), r = c.hasEagerState ? c.eagerState : e(r, c.action); else { var d = { lane: f, action: c.action, hasEagerState: c.hasEagerState, eagerState: c.eagerState, next: null }; null === s ? (u = s = d, i = r) : s = s.next = d, ho.lanes |= f, Iu |= f } c = c.next } while (null !== c && c !== o); null === s ? i = r : s.next = u, ir(r, t.memoizedState) || (_i = !0), t.memoizedState = r, t.baseState = i, t.baseQueue = s, n.lastRenderedState = r } if (null !== (e = n.interleaved)) { a = e; do { o = a.lane, ho.lanes |= o, Iu |= o, a = a.next } while (a !== e) } else null === a && (n.lanes = 0); return [t.memoizedState, n.dispatch] } function zo(e) { var t = To(), n = t.queue; if (null === n) throw Error(l(311)); n.lastRenderedReducer = e; var r = n.dispatch, a = n.pending, o = t.memoizedState; if (null !== a) { n.pending = null; var i = a = a.next; do { o = e(o, i.action), i = i.next } while (i !== a); ir(o, t.memoizedState) || (_i = !0), t.memoizedState = o, null === t.baseQueue && (t.baseState = o), n.lastRenderedState = o } return [o, r] } function jo() { } function Ro(e, t) { var n = ho, r = To(), a = t(), o = !ir(r.memoizedState, a); if (o && (r.memoizedState = a, _i = !0), r = r.queue, qo(Mo.bind(null, n, r, e), [e]), r.getSnapshot !== t || o || null !== vo && 1 & vo.memoizedState.tag) { if (n.flags |= 2048, Do(9, No.bind(null, n, r, a, t), void 0, null), null === zu) throw Error(l(349)); 0 !== (30 & mo) || Ao(n, t, a) } return a } function Ao(e, t, n) { e.flags |= 16384, e = { getSnapshot: t, value: n }, null === (t = ho.updateQueue) ? (t = { lastEffect: null, stores: null }, ho.updateQueue = t, t.stores = [e]) : null === (n = t.stores) ? t.stores = [e] : n.push(e) } function No(e, t, n, r) { t.value = n, t.getSnapshot = r, Lo(t) && Io(e) } function Mo(e, t, n) { return n((function () { Lo(t) && Io(e) })) } function Lo(e) { var t = e.getSnapshot; e = e.value; try { var n = t(); return !ir(e, n) } catch (r) { return !0 } } function Io(e) { var t = Ol(e, 1); null !== t && rs(t, e, 1, -1) } function Fo(e) { var t = Co(); return "function" === typeof e && (e = e()), t.memoizedState = t.baseState = e, e = { pending: null, interleaved: null, lanes: 0, dispatch: null, lastRenderedReducer: Po, lastRenderedState: e }, t.queue = e, e = e.dispatch = ni.bind(null, ho, e), [t.memoizedState, e] } function Do(e, t, n, r) { return e = { tag: e, create: t, destroy: n, deps: r, next: null }, null === (t = ho.updateQueue) ? (t = { lastEffect: null, stores: null }, ho.updateQueue = t, t.lastEffect = e.next = e) : null === (n = t.lastEffect) ? t.lastEffect = e.next = e : (r = n.next, n.next = e, e.next = r, t.lastEffect = e), e } function Uo() { return To().memoizedState } function Vo(e, t, n, r) { var a = Co(); ho.flags |= e, a.memoizedState = Do(1 | t, n, void 0, void 0 === r ? null : r) } function Bo(e, t, n, r) { var a = To(); r = void 0 === r ? null : r; var l = void 0; if (null !== yo) { var o = yo.memoizedState; if (l = o.destroy, null !== r && ko(r, o.deps)) return void (a.memoizedState = Do(t, n, l, r)) } ho.flags |= e, a.memoizedState = Do(1 | t, n, l, r) } function $o(e, t) { return Vo(8390656, 8, e, t) } function qo(e, t) { return Bo(2048, 8, e, t) } function Wo(e, t) { return Bo(4, 2, e, t) } function Ho(e, t) { return Bo(4, 4, e, t) } function Qo(e, t) { return "function" === typeof t ? (e = e(), t(e), function () { t(null) }) : null !== t && void 0 !== t ? (e = e(), t.current = e, function () { t.current = null }) : void 0 } function Ko(e, t, n) { return n = null !== n && void 0 !== n ? n.concat([e]) : null, Bo(4, 4, Qo.bind(null, t, e), n) } function Go() { } function Yo(e, t) { var n = To(); t = void 0 === t ? null : t; var r = n.memoizedState; return null !== r && null !== t && ko(t, r[1]) ? r[0] : (n.memoizedState = [e, t], e) } function Xo(e, t) { var n = To(); t = void 0 === t ? null : t; var r = n.memoizedState; return null !== r && null !== t && ko(t, r[1]) ? r[0] : (e = e(), n.memoizedState = [e, t], e) } function Zo(e, t, n) { return 0 === (21 & mo) ? (e.baseState && (e.baseState = !1, _i = !0), e.memoizedState = n) : (ir(n, t) || (n = ht(), ho.lanes |= n, Iu |= n, e.baseState = !0), t) } function Jo(e, t) { var n = gt; gt = 0 !== n && 4 > n ? n : 4, e(!0); var r = po.transition; po.transition = {}; try { e(!1), t() } finally { gt = n, po.transition = r } } function ei() { return To().memoizedState } function ti(e, t, n) { var r = ns(e); if (n = { lane: r, action: n, hasEagerState: !1, eagerState: null, next: null }, ri(e)) ai(t, n); else if (null !== (n = Pl(e, t, n, r))) { rs(n, e, r, ts()), li(n, t, r) } } function ni(e, t, n) { var r = ns(e), a = { lane: r, action: n, hasEagerState: !1, eagerState: null, next: null }; if (ri(e)) ai(t, a); else { var l = e.alternate; if (0 === e.lanes && (null === l || 0 === l.lanes) && null !== (l = t.lastRenderedReducer)) try { var o = t.lastRenderedState, i = l(o, n); if (a.hasEagerState = !0, a.eagerState = i, ir(i, o)) { var u = t.interleaved; return null === u ? (a.next = a, Tl(t)) : (a.next = u.next, u.next = a), void (t.interleaved = a) } } catch (s) { } null !== (n = Pl(e, t, a, r)) && (rs(n, e, r, a = ts()), li(n, t, r)) } } function ri(e) { var t = e.alternate; return e === ho || null !== t && t === ho } function ai(e, t) { go = bo = !0; var n = e.pending; null === n ? t.next = t : (t.next = n.next, n.next = t), e.pending = t } function li(e, t, n) { if (0 !== (4194240 & n)) { var r = t.lanes; n |= r &= e.pendingLanes, t.lanes = n, bt(e, n) } } var oi = { readContext: xl, useCallback: wo, useContext: wo, useEffect: wo, useImperativeHandle: wo, useInsertionEffect: wo, useLayoutEffect: wo, useMemo: wo, useReducer: wo, useRef: wo, useState: wo, useDebugValue: wo, useDeferredValue: wo, useTransition: wo, useMutableSource: wo, useSyncExternalStore: wo, useId: wo, unstable_isNewReconciler: !1 }, ii = { readContext: xl, useCallback: function (e, t) { return Co().memoizedState = [e, void 0 === t ? null : t], e }, useContext: xl, useEffect: $o, useImperativeHandle: function (e, t, n) { return n = null !== n && void 0 !== n ? n.concat([e]) : null, Vo(4194308, 4, Qo.bind(null, t, e), n) }, useLayoutEffect: function (e, t) { return Vo(4194308, 4, e, t) }, useInsertionEffect: function (e, t) { return Vo(4, 2, e, t) }, useMemo: function (e, t) { var n = Co(); return t = void 0 === t ? null : t, e = e(), n.memoizedState = [e, t], e }, useReducer: function (e, t, n) { var r = Co(); return t = void 0 !== n ? n(t) : t, r.memoizedState = r.baseState = t, e = { pending: null, interleaved: null, lanes: 0, dispatch: null, lastRenderedReducer: e, lastRenderedState: t }, r.queue = e, e = e.dispatch = ti.bind(null, ho, e), [r.memoizedState, e] }, useRef: function (e) { return e = { current: e }, Co().memoizedState = e }, useState: Fo, useDebugValue: Go, useDeferredValue: function (e) { return Co().memoizedState = e }, useTransition: function () { var e = Fo(!1), t = e[0]; return e = Jo.bind(null, e[1]), Co().memoizedState = e, [t, e] }, useMutableSource: function () { }, useSyncExternalStore: function (e, t, n) { var r = ho, a = Co(); if (al) { if (void 0 === n) throw Error(l(407)); n = n() } else { if (n = t(), null === zu) throw Error(l(349)); 0 !== (30 & mo) || Ao(r, t, n) } a.memoizedState = n; var o = { value: n, getSnapshot: t }; return a.queue = o, $o(Mo.bind(null, r, o, e), [e]), r.flags |= 2048, Do(9, No.bind(null, r, o, n, t), void 0, null), n }, useId: function () { var e = Co(), t = zu.identifierPrefix; if (al) { var n = Xa; t = ":" + t + "R" + (n = (Ya & ~(1 << 32 - ot(Ya) - 1)).toString(32) + n), 0 < (n = _o++) && (t += "H" + n.toString(32)), t += ":" } else t = ":" + t + "r" + (n = So++).toString(32) + ":"; return e.memoizedState = t }, unstable_isNewReconciler: !1 }, ui = { readContext: xl, useCallback: Yo, useContext: xl, useEffect: qo, useImperativeHandle: Ko, useInsertionEffect: Wo, useLayoutEffect: Ho, useMemo: Xo, useReducer: Oo, useRef: Uo, useState: function () { return Oo(Po) }, useDebugValue: Go, useDeferredValue: function (e) { return Zo(To(), yo.memoizedState, e) }, useTransition: function () { return [Oo(Po)[0], To().memoizedState] }, useMutableSource: jo, useSyncExternalStore: Ro, useId: ei, unstable_isNewReconciler: !1 }, si = { readContext: xl, useCallback: Yo, useContext: xl, useEffect: qo, useImperativeHandle: Ko, useInsertionEffect: Wo, useLayoutEffect: Ho, useMemo: Xo, useReducer: zo, useRef: Uo, useState: function () { return zo(Po) }, useDebugValue: Go, useDeferredValue: function (e) { var t = To(); return null === yo ? t.memoizedState = e : Zo(t, yo.memoizedState, e) }, useTransition: function () { return [zo(Po)[0], To().memoizedState] }, useMutableSource: jo, useSyncExternalStore: Ro, useId: ei, unstable_isNewReconciler: !1 }; function ci(e, t) { try { var n = "", r = t; do { n += V(r), r = r.return } while (r); var a = n } catch (l) { a = "\nError generating stack: " + l.message + "\n" + l.stack } return { value: e, source: t, stack: a, digest: null } } function fi(e, t, n) { return { value: e, source: null, stack: null != n ? n : null, digest: null != t ? t : null } } function di(e, t) { try { console.error(t.value) } catch (n) { setTimeout((function () { throw n })) } } var pi = "function" === typeof WeakMap ? WeakMap : Map; function mi(e, t, n) { (n = Al(-1, n)).tag = 3, n.payload = { element: null }; var r = t.value; return n.callback = function () { Wu || (Wu = !0, Hu = r), di(0, t) }, n } function hi(e, t, n) { (n = Al(-1, n)).tag = 3; var r = e.type.getDerivedStateFromError; if ("function" === typeof r) { var a = t.value; n.payload = function () { return r(a) }, n.callback = function () { di(0, t) } } var l = e.stateNode; return null !== l && "function" === typeof l.componentDidCatch && (n.callback = function () { di(0, t), "function" !== typeof r && (null === Qu ? Qu = new Set([this]) : Qu.add(this)); var e = t.stack; this.componentDidCatch(t.value, { componentStack: null !== e ? e : "" }) }), n } function yi(e, t, n) { var r = e.pingCache; if (null === r) { r = e.pingCache = new pi; var a = new Set; r.set(t, a) } else void 0 === (a = r.get(t)) && (a = new Set, r.set(t, a)); a.has(n) || (a.add(n), e = Cs.bind(null, e, t, n), t.then(e, e)) } function vi(e) { do { var t; if ((t = 13 === e.tag) && (t = null === (t = e.memoizedState) || null !== t.dehydrated), t) return e; e = e.return } while (null !== e); return null } function bi(e, t, n, r, a) { return 0 === (1 & e.mode) ? (e === t ? e.flags |= 65536 : (e.flags |= 128, n.flags |= 131072, n.flags &= -52805, 1 === n.tag && (null === n.alternate ? n.tag = 17 : ((t = Al(-1, 1)).tag = 2, Nl(n, t, 1))), n.lanes |= 1), e) : (e.flags |= 65536, e.lanes = a, e) } var gi = _.ReactCurrentOwner, _i = !1; function Si(e, t, n, r) { t.child = null === e ? Xl(t, null, n, r) : Yl(t, e.child, n, r) } function wi(e, t, n, r, a) { n = n.render; var l = t.ref; return El(t, a), r = Eo(e, t, n, r, l, a), n = xo(), null === e || _i ? (al && n && el(t), t.flags |= 1, Si(e, t, r, a), t.child) : (t.updateQueue = e.updateQueue, t.flags &= -2053, e.lanes &= ~a, Wi(e, t, a)) } function ki(e, t, n, r, a) { if (null === e) { var l = n.type; return "function" !== typeof l || As(l) || void 0 !== l.defaultProps || null !== n.compare || void 0 !== n.defaultProps ? ((e = Ms(n.type, null, r, t, t.mode, a)).ref = t.ref, e.return = t, t.child = e) : (t.tag = 15, t.type = l, Ei(e, t, l, r, a)) } if (l = e.child, 0 === (e.lanes & a)) { var o = l.memoizedProps; if ((n = null !== (n = n.compare) ? n : ur)(o, r) && e.ref === t.ref) return Wi(e, t, a) } return t.flags |= 1, (e = Ns(l, r)).ref = t.ref, e.return = t, t.child = e } function Ei(e, t, n, r, a) { if (null !== e) { var l = e.memoizedProps; if (ur(l, r) && e.ref === t.ref) { if (_i = !1, t.pendingProps = r = l, 0 === (e.lanes & a)) return t.lanes = e.lanes, Wi(e, t, a); 0 !== (131072 & e.flags) && (_i = !0) } } return Ti(e, t, n, r, a) } function xi(e, t, n) { var r = t.pendingProps, a = r.children, l = null !== e ? e.memoizedState : null; if ("hidden" === r.mode) if (0 === (1 & t.mode)) t.memoizedState = { baseLanes: 0, cachePool: null, transitions: null }, Ca(Nu, Au), Au |= n; else { if (0 === (1073741824 & n)) return e = null !== l ? l.baseLanes | n : n, t.lanes = t.childLanes = 1073741824, t.memoizedState = { baseLanes: e, cachePool: null, transitions: null }, t.updateQueue = null, Ca(Nu, Au), Au |= e, null; t.memoizedState = { baseLanes: 0, cachePool: null, transitions: null }, r = null !== l ? l.baseLanes : n, Ca(Nu, Au), Au |= r } else null !== l ? (r = l.baseLanes | n, t.memoizedState = null) : r = n, Ca(Nu, Au), Au |= r; return Si(e, t, a, n), t.child } function Ci(e, t) { var n = t.ref; (null === e && null !== n || null !== e && e.ref !== n) && (t.flags |= 512, t.flags |= 2097152) } function Ti(e, t, n, r, a) { var l = Ra(n) ? za : Pa.current; return l = ja(t, l), El(t, a), n = Eo(e, t, n, r, l, a), r = xo(), null === e || _i ? (al && r && el(t), t.flags |= 1, Si(e, t, n, a), t.child) : (t.updateQueue = e.updateQueue, t.flags &= -2053, e.lanes &= ~a, Wi(e, t, a)) } function Pi(e, t, n, r, a) { if (Ra(n)) { var l = !0; La(t) } else l = !1; if (El(t, a), null === t.stateNode) qi(e, t), $l(t, n, r), Wl(t, n, r, a), r = !0; else if (null === e) { var o = t.stateNode, i = t.memoizedProps; o.props = i; var u = o.context, s = n.contextType; "object" === typeof s && null !== s ? s = xl(s) : s = ja(t, s = Ra(n) ? za : Pa.current); var c = n.getDerivedStateFromProps, f = "function" === typeof c || "function" === typeof o.getSnapshotBeforeUpdate; f || "function" !== typeof o.UNSAFE_componentWillReceiveProps && "function" !== typeof o.componentWillReceiveProps || (i !== r || u !== s) && ql(t, o, r, s), zl = !1; var d = t.memoizedState; o.state = d, Il(t, r, o, a), u = t.memoizedState, i !== r || d !== u || Oa.current || zl ? ("function" === typeof c && (Ul(t, n, c, r), u = t.memoizedState), (i = zl || Bl(t, n, i, r, d, u, s)) ? (f || "function" !== typeof o.UNSAFE_componentWillMount && "function" !== typeof o.componentWillMount || ("function" === typeof o.componentWillMount && o.componentWillMount(), "function" === typeof o.UNSAFE_componentWillMount && o.UNSAFE_componentWillMount()), "function" === typeof o.componentDidMount && (t.flags |= 4194308)) : ("function" === typeof o.componentDidMount && (t.flags |= 4194308), t.memoizedProps = r, t.memoizedState = u), o.props = r, o.state = u, o.context = s, r = i) : ("function" === typeof o.componentDidMount && (t.flags |= 4194308), r = !1) } else { o = t.stateNode, Rl(e, t), i = t.memoizedProps, s = t.type === t.elementType ? i : yl(t.type, i), o.props = s, f = t.pendingProps, d = o.context, "object" === typeof (u = n.contextType) && null !== u ? u = xl(u) : u = ja(t, u = Ra(n) ? za : Pa.current); var p = n.getDerivedStateFromProps; (c = "function" === typeof p || "function" === typeof o.getSnapshotBeforeUpdate) || "function" !== typeof o.UNSAFE_componentWillReceiveProps && "function" !== typeof o.componentWillReceiveProps || (i !== f || d !== u) && ql(t, o, r, u), zl = !1, d = t.memoizedState, o.state = d, Il(t, r, o, a); var m = t.memoizedState; i !== f || d !== m || Oa.current || zl ? ("function" === typeof p && (Ul(t, n, p, r), m = t.memoizedState), (s = zl || Bl(t, n, s, r, d, m, u) || !1) ? (c || "function" !== typeof o.UNSAFE_componentWillUpdate && "function" !== typeof o.componentWillUpdate || ("function" === typeof o.componentWillUpdate && o.componentWillUpdate(r, m, u), "function" === typeof o.UNSAFE_componentWillUpdate && o.UNSAFE_componentWillUpdate(r, m, u)), "function" === typeof o.componentDidUpdate && (t.flags |= 4), "function" === typeof o.getSnapshotBeforeUpdate && (t.flags |= 1024)) : ("function" !== typeof o.componentDidUpdate || i === e.memoizedProps && d === e.memoizedState || (t.flags |= 4), "function" !== typeof o.getSnapshotBeforeUpdate || i === e.memoizedProps && d === e.memoizedState || (t.flags |= 1024), t.memoizedProps = r, t.memoizedState = m), o.props = r, o.state = m, o.context = u, r = s) : ("function" !== typeof o.componentDidUpdate || i === e.memoizedProps && d === e.memoizedState || (t.flags |= 4), "function" !== typeof o.getSnapshotBeforeUpdate || i === e.memoizedProps && d === e.memoizedState || (t.flags |= 1024), r = !1) } return Oi(e, t, n, r, l, a) } function Oi(e, t, n, r, a, l) { Ci(e, t); var o = 0 !== (128 & t.flags); if (!r && !o) return a && Ia(t, n, !1), Wi(e, t, l); r = t.stateNode, gi.current = t; var i = o && "function" !== typeof n.getDerivedStateFromError ? null : r.render(); return t.flags |= 1, null !== e && o ? (t.child = Yl(t, e.child, null, l), t.child = Yl(t, null, i, l)) : Si(e, t, i, l), t.memoizedState = r.state, a && Ia(t, n, !0), t.child } function zi(e) { var t = e.stateNode; t.pendingContext ? Na(0, t.pendingContext, t.pendingContext !== t.context) : t.context && Na(0, t.context, !1), ro(e, t.containerInfo) } function ji(e, t, n, r, a) { return pl(), ml(a), t.flags |= 256, Si(e, t, n, r), t.child } var Ri, Ai, Ni, Mi, Li = { dehydrated: null, treeContext: null, retryLane: 0 }; function Ii(e) { return { baseLanes: e, cachePool: null, transitions: null } } function Fi(e, t, n) { var r, a = t.pendingProps, o = io.current, i = !1, u = 0 !== (128 & t.flags); if ((r = u) || (r = (null === e || null !== e.memoizedState) && 0 !== (2 & o)), r ? (i = !0, t.flags &= -129) : null !== e && null === e.memoizedState || (o |= 1), Ca(io, 1 & o), null === e) return sl(t), null !== (e = t.memoizedState) && null !== (e = e.dehydrated) ? (0 === (1 & t.mode) ? t.lanes = 1 : "$!" === e.data ? t.lanes = 8 : t.lanes = 1073741824, null) : (u = a.children, e = a.fallback, i ? (a = t.mode, i = t.child, u = { mode: "hidden", children: u }, 0 === (1 & a) && null !== i ? (i.childLanes = 0, i.pendingProps = u) : i = Is(u, a, 0, null), e = Ls(e, a, n, null), i.return = t, e.return = t, i.sibling = e, t.child = i, t.child.memoizedState = Ii(n), t.memoizedState = Li, e) : Di(t, u)); if (null !== (o = e.memoizedState) && null !== (r = o.dehydrated)) return function (e, t, n, r, a, o, i) { if (n) return 256 & t.flags ? (t.flags &= -257, Ui(e, t, i, r = fi(Error(l(422))))) : null !== t.memoizedState ? (t.child = e.child, t.flags |= 128, null) : (o = r.fallback, a = t.mode, r = Is({ mode: "visible", children: r.children }, a, 0, null), (o = Ls(o, a, i, null)).flags |= 2, r.return = t, o.return = t, r.sibling = o, t.child = r, 0 !== (1 & t.mode) && Yl(t, e.child, null, i), t.child.memoizedState = Ii(i), t.memoizedState = Li, o); if (0 === (1 & t.mode)) return Ui(e, t, i, null); if ("$!" === a.data) { if (r = a.nextSibling && a.nextSibling.dataset) var u = r.dgst; return r = u, Ui(e, t, i, r = fi(o = Error(l(419)), r, void 0)) } if (u = 0 !== (i & e.childLanes), _i || u) { if (null !== (r = zu)) { switch (i & -i) { case 4: a = 2; break; case 16: a = 8; break; case 64: case 128: case 256: case 512: case 1024: case 2048: case 4096: case 8192: case 16384: case 32768: case 65536: case 131072: case 262144: case 524288: case 1048576: case 2097152: case 4194304: case 8388608: case 16777216: case 33554432: case 67108864: a = 32; break; case 536870912: a = 268435456; break; default: a = 0 }0 !== (a = 0 !== (a & (r.suspendedLanes | i)) ? 0 : a) && a !== o.retryLane && (o.retryLane = a, Ol(e, a), rs(r, e, a, -1)) } return ys(), Ui(e, t, i, r = fi(Error(l(421)))) } return "$?" === a.data ? (t.flags |= 128, t.child = e.child, t = Ps.bind(null, e), a._reactRetry = t, null) : (e = o.treeContext, rl = sa(a.nextSibling), nl = t, al = !0, ll = null, null !== e && (Qa[Ka++] = Ya, Qa[Ka++] = Xa, Qa[Ka++] = Ga, Ya = e.id, Xa = e.overflow, Ga = t), t = Di(t, r.children), t.flags |= 4096, t) }(e, t, u, a, r, o, n); if (i) { i = a.fallback, u = t.mode, r = (o = e.child).sibling; var s = { mode: "hidden", children: a.children }; return 0 === (1 & u) && t.child !== o ? ((a = t.child).childLanes = 0, a.pendingProps = s, t.deletions = null) : (a = Ns(o, s)).subtreeFlags = 14680064 & o.subtreeFlags, null !== r ? i = Ns(r, i) : (i = Ls(i, u, n, null)).flags |= 2, i.return = t, a.return = t, a.sibling = i, t.child = a, a = i, i = t.child, u = null === (u = e.child.memoizedState) ? Ii(n) : { baseLanes: u.baseLanes | n, cachePool: null, transitions: u.transitions }, i.memoizedState = u, i.childLanes = e.childLanes & ~n, t.memoizedState = Li, a } return e = (i = e.child).sibling, a = Ns(i, { mode: "visible", children: a.children }), 0 === (1 & t.mode) && (a.lanes = n), a.return = t, a.sibling = null, null !== e && (null === (n = t.deletions) ? (t.deletions = [e], t.flags |= 16) : n.push(e)), t.child = a, t.memoizedState = null, a } function Di(e, t) { return (t = Is({ mode: "visible", children: t }, e.mode, 0, null)).return = e, e.child = t } function Ui(e, t, n, r) { return null !== r && ml(r), Yl(t, e.child, null, n), (e = Di(t, t.pendingProps.children)).flags |= 2, t.memoizedState = null, e } function Vi(e, t, n) { e.lanes |= t; var r = e.alternate; null !== r && (r.lanes |= t), kl(e.return, t, n) } function Bi(e, t, n, r, a) { var l = e.memoizedState; null === l ? e.memoizedState = { isBackwards: t, rendering: null, renderingStartTime: 0, last: r, tail: n, tailMode: a } : (l.isBackwards = t, l.rendering = null, l.renderingStartTime = 0, l.last = r, l.tail = n, l.tailMode = a) } function $i(e, t, n) { var r = t.pendingProps, a = r.revealOrder, l = r.tail; if (Si(e, t, r.children, n), 0 !== (2 & (r = io.current))) r = 1 & r | 2, t.flags |= 128; else { if (null !== e && 0 !== (128 & e.flags)) e: for (e = t.child; null !== e;) { if (13 === e.tag) null !== e.memoizedState && Vi(e, n, t); else if (19 === e.tag) Vi(e, n, t); else if (null !== e.child) { e.child.return = e, e = e.child; continue } if (e === t) break e; for (; null === e.sibling;) { if (null === e.return || e.return === t) break e; e = e.return } e.sibling.return = e.return, e = e.sibling } r &= 1 } if (Ca(io, r), 0 === (1 & t.mode)) t.memoizedState = null; else switch (a) { case "forwards": for (n = t.child, a = null; null !== n;)null !== (e = n.alternate) && null === uo(e) && (a = n), n = n.sibling; null === (n = a) ? (a = t.child, t.child = null) : (a = n.sibling, n.sibling = null), Bi(t, !1, a, n, l); break; case "backwards": for (n = null, a = t.child, t.child = null; null !== a;) { if (null !== (e = a.alternate) && null === uo(e)) { t.child = a; break } e = a.sibling, a.sibling = n, n = a, a = e } Bi(t, !0, n, null, l); break; case "together": Bi(t, !1, null, null, void 0); break; default: t.memoizedState = null }return t.child } function qi(e, t) { 0 === (1 & t.mode) && null !== e && (e.alternate = null, t.alternate = null, t.flags |= 2) } function Wi(e, t, n) { if (null !== e && (t.dependencies = e.dependencies), Iu |= t.lanes, 0 === (n & t.childLanes)) return null; if (null !== e && t.child !== e.child) throw Error(l(153)); if (null !== t.child) { for (n = Ns(e = t.child, e.pendingProps), t.child = n, n.return = t; null !== e.sibling;)e = e.sibling, (n = n.sibling = Ns(e, e.pendingProps)).return = t; n.sibling = null } return t.child } function Hi(e, t) { if (!al) switch (e.tailMode) { case "hidden": t = e.tail; for (var n = null; null !== t;)null !== t.alternate && (n = t), t = t.sibling; null === n ? e.tail = null : n.sibling = null; break; case "collapsed": n = e.tail; for (var r = null; null !== n;)null !== n.alternate && (r = n), n = n.sibling; null === r ? t || null === e.tail ? e.tail = null : e.tail.sibling = null : r.sibling = null } } function Qi(e) { var t = null !== e.alternate && e.alternate.child === e.child, n = 0, r = 0; if (t) for (var a = e.child; null !== a;)n |= a.lanes | a.childLanes, r |= 14680064 & a.subtreeFlags, r |= 14680064 & a.flags, a.return = e, a = a.sibling; else for (a = e.child; null !== a;)n |= a.lanes | a.childLanes, r |= a.subtreeFlags, r |= a.flags, a.return = e, a = a.sibling; return e.subtreeFlags |= r, e.childLanes = n, t } function Ki(e, t, n) { var r = t.pendingProps; switch (tl(t), t.tag) { case 2: case 16: case 15: case 0: case 11: case 7: case 8: case 12: case 9: case 14: return Qi(t), null; case 1: case 17: return Ra(t.type) && Aa(), Qi(t), null; case 3: return r = t.stateNode, ao(), xa(Oa), xa(Pa), co(), r.pendingContext && (r.context = r.pendingContext, r.pendingContext = null), null !== e && null !== e.child || (fl(t) ? t.flags |= 4 : null === e || e.memoizedState.isDehydrated && 0 === (256 & t.flags) || (t.flags |= 1024, null !== ll && (is(ll), ll = null))), Ai(e, t), Qi(t), null; case 5: oo(t); var a = no(to.current); if (n = t.type, null !== e && null != t.stateNode) Ni(e, t, n, r, a), e.ref !== t.ref && (t.flags |= 512, t.flags |= 2097152); else { if (!r) { if (null === t.stateNode) throw Error(l(166)); return Qi(t), null } if (e = no(Jl.current), fl(t)) { r = t.stateNode, n = t.type; var o = t.memoizedProps; switch (r[da] = t, r[pa] = o, e = 0 !== (1 & t.mode), n) { case "dialog": Dr("cancel", r), Dr("close", r); break; case "iframe": case "object": case "embed": Dr("load", r); break; case "video": case "audio": for (a = 0; a < Mr.length; a++)Dr(Mr[a], r); break; case "source": Dr("error", r); break; case "img": case "image": case "link": Dr("error", r), Dr("load", r); break; case "details": Dr("toggle", r); break; case "input": Y(r, o), Dr("invalid", r); break; case "select": r._wrapperState = { wasMultiple: !!o.multiple }, Dr("invalid", r); break; case "textarea": ae(r, o), Dr("invalid", r) }for (var u in be(n, o), a = null, o) if (o.hasOwnProperty(u)) { var s = o[u]; "children" === u ? "string" === typeof s ? r.textContent !== s && (!0 !== o.suppressHydrationWarning && Zr(r.textContent, s, e), a = ["children", s]) : "number" === typeof s && r.textContent !== "" + s && (!0 !== o.suppressHydrationWarning && Zr(r.textContent, s, e), a = ["children", "" + s]) : i.hasOwnProperty(u) && null != s && "onScroll" === u && Dr("scroll", r) } switch (n) { case "input": H(r), J(r, o, !0); break; case "textarea": H(r), oe(r); break; case "select": case "option": break; default: "function" === typeof o.onClick && (r.onclick = Jr) }r = a, t.updateQueue = r, null !== r && (t.flags |= 4) } else { u = 9 === a.nodeType ? a : a.ownerDocument, "http://www.w3.org/1999/xhtml" === e && (e = ie(n)), "http://www.w3.org/1999/xhtml" === e ? "script" === n ? ((e = u.createElement("div")).innerHTML = "<script><\/script>", e = e.removeChild(e.firstChild)) : "string" === typeof r.is ? e = u.createElement(n, { is: r.is }) : (e = u.createElement(n), "select" === n && (u = e, r.multiple ? u.multiple = !0 : r.size && (u.size = r.size))) : e = u.createElementNS(e, n), e[da] = t, e[pa] = r, Ri(e, t, !1, !1), t.stateNode = e; e: { switch (u = ge(n, r), n) { case "dialog": Dr("cancel", e), Dr("close", e), a = r; break; case "iframe": case "object": case "embed": Dr("load", e), a = r; break; case "video": case "audio": for (a = 0; a < Mr.length; a++)Dr(Mr[a], e); a = r; break; case "source": Dr("error", e), a = r; break; case "img": case "image": case "link": Dr("error", e), Dr("load", e), a = r; break; case "details": Dr("toggle", e), a = r; break; case "input": Y(e, r), a = G(e, r), Dr("invalid", e); break; case "option": default: a = r; break; case "select": e._wrapperState = { wasMultiple: !!r.multiple }, a = I({}, r, { value: void 0 }), Dr("invalid", e); break; case "textarea": ae(e, r), a = re(e, r), Dr("invalid", e) }for (o in be(n, a), s = a) if (s.hasOwnProperty(o)) { var c = s[o]; "style" === o ? ye(e, c) : "dangerouslySetInnerHTML" === o ? null != (c = c ? c.__html : void 0) && fe(e, c) : "children" === o ? "string" === typeof c ? ("textarea" !== n || "" !== c) && de(e, c) : "number" === typeof c && de(e, "" + c) : "suppressContentEditableWarning" !== o && "suppressHydrationWarning" !== o && "autoFocus" !== o && (i.hasOwnProperty(o) ? null != c && "onScroll" === o && Dr("scroll", e) : null != c && g(e, o, c, u)) } switch (n) { case "input": H(e), J(e, r, !1); break; case "textarea": H(e), oe(e); break; case "option": null != r.value && e.setAttribute("value", "" + q(r.value)); break; case "select": e.multiple = !!r.multiple, null != (o = r.value) ? ne(e, !!r.multiple, o, !1) : null != r.defaultValue && ne(e, !!r.multiple, r.defaultValue, !0); break; default: "function" === typeof a.onClick && (e.onclick = Jr) }switch (n) { case "button": case "input": case "select": case "textarea": r = !!r.autoFocus; break e; case "img": r = !0; break e; default: r = !1 } } r && (t.flags |= 4) } null !== t.ref && (t.flags |= 512, t.flags |= 2097152) } return Qi(t), null; case 6: if (e && null != t.stateNode) Mi(e, t, e.memoizedProps, r); else { if ("string" !== typeof r && null === t.stateNode) throw Error(l(166)); if (n = no(to.current), no(Jl.current), fl(t)) { if (r = t.stateNode, n = t.memoizedProps, r[da] = t, (o = r.nodeValue !== n) && null !== (e = nl)) switch (e.tag) { case 3: Zr(r.nodeValue, n, 0 !== (1 & e.mode)); break; case 5: !0 !== e.memoizedProps.suppressHydrationWarning && Zr(r.nodeValue, n, 0 !== (1 & e.mode)) }o && (t.flags |= 4) } else (r = (9 === n.nodeType ? n : n.ownerDocument).createTextNode(r))[da] = t, t.stateNode = r } return Qi(t), null; case 13: if (xa(io), r = t.memoizedState, null === e || null !== e.memoizedState && null !== e.memoizedState.dehydrated) { if (al && null !== rl && 0 !== (1 & t.mode) && 0 === (128 & t.flags)) dl(), pl(), t.flags |= 98560, o = !1; else if (o = fl(t), null !== r && null !== r.dehydrated) { if (null === e) { if (!o) throw Error(l(318)); if (!(o = null !== (o = t.memoizedState) ? o.dehydrated : null)) throw Error(l(317)); o[da] = t } else pl(), 0 === (128 & t.flags) && (t.memoizedState = null), t.flags |= 4; Qi(t), o = !1 } else null !== ll && (is(ll), ll = null), o = !0; if (!o) return 65536 & t.flags ? t : null } return 0 !== (128 & t.flags) ? (t.lanes = n, t) : ((r = null !== r) !== (null !== e && null !== e.memoizedState) && r && (t.child.flags |= 8192, 0 !== (1 & t.mode) && (null === e || 0 !== (1 & io.current) ? 0 === Mu && (Mu = 3) : ys())), null !== t.updateQueue && (t.flags |= 4), Qi(t), null); case 4: return ao(), Ai(e, t), null === e && Br(t.stateNode.containerInfo), Qi(t), null; case 10: return wl(t.type._context), Qi(t), null; case 19: if (xa(io), null === (o = t.memoizedState)) return Qi(t), null; if (r = 0 !== (128 & t.flags), null === (u = o.rendering)) if (r) Hi(o, !1); else { if (0 !== Mu || null !== e && 0 !== (128 & e.flags)) for (e = t.child; null !== e;) { if (null !== (u = uo(e))) { for (t.flags |= 128, Hi(o, !1), null !== (r = u.updateQueue) && (t.updateQueue = r, t.flags |= 4), t.subtreeFlags = 0, r = n, n = t.child; null !== n;)e = r, (o = n).flags &= 14680066, null === (u = o.alternate) ? (o.childLanes = 0, o.lanes = e, o.child = null, o.subtreeFlags = 0, o.memoizedProps = null, o.memoizedState = null, o.updateQueue = null, o.dependencies = null, o.stateNode = null) : (o.childLanes = u.childLanes, o.lanes = u.lanes, o.child = u.child, o.subtreeFlags = 0, o.deletions = null, o.memoizedProps = u.memoizedProps, o.memoizedState = u.memoizedState, o.updateQueue = u.updateQueue, o.type = u.type, e = u.dependencies, o.dependencies = null === e ? null : { lanes: e.lanes, firstContext: e.firstContext }), n = n.sibling; return Ca(io, 1 & io.current | 2), t.child } e = e.sibling } null !== o.tail && Xe() > $u && (t.flags |= 128, r = !0, Hi(o, !1), t.lanes = 4194304) } else { if (!r) if (null !== (e = uo(u))) { if (t.flags |= 128, r = !0, null !== (n = e.updateQueue) && (t.updateQueue = n, t.flags |= 4), Hi(o, !0), null === o.tail && "hidden" === o.tailMode && !u.alternate && !al) return Qi(t), null } else 2 * Xe() - o.renderingStartTime > $u && 1073741824 !== n && (t.flags |= 128, r = !0, Hi(o, !1), t.lanes = 4194304); o.isBackwards ? (u.sibling = t.child, t.child = u) : (null !== (n = o.last) ? n.sibling = u : t.child = u, o.last = u) } return null !== o.tail ? (t = o.tail, o.rendering = t, o.tail = t.sibling, o.renderingStartTime = Xe(), t.sibling = null, n = io.current, Ca(io, r ? 1 & n | 2 : 1 & n), t) : (Qi(t), null); case 22: case 23: return ds(), r = null !== t.memoizedState, null !== e && null !== e.memoizedState !== r && (t.flags |= 8192), r && 0 !== (1 & t.mode) ? 0 !== (1073741824 & Au) && (Qi(t), 6 & t.subtreeFlags && (t.flags |= 8192)) : Qi(t), null; case 24: case 25: return null }throw Error(l(156, t.tag)) } function Gi(e, t) { switch (tl(t), t.tag) { case 1: return Ra(t.type) && Aa(), 65536 & (e = t.flags) ? (t.flags = -65537 & e | 128, t) : null; case 3: return ao(), xa(Oa), xa(Pa), co(), 0 !== (65536 & (e = t.flags)) && 0 === (128 & e) ? (t.flags = -65537 & e | 128, t) : null; case 5: return oo(t), null; case 13: if (xa(io), null !== (e = t.memoizedState) && null !== e.dehydrated) { if (null === t.alternate) throw Error(l(340)); pl() } return 65536 & (e = t.flags) ? (t.flags = -65537 & e | 128, t) : null; case 19: return xa(io), null; case 4: return ao(), null; case 10: return wl(t.type._context), null; case 22: case 23: return ds(), null; default: return null } } Ri = function (e, t) { for (var n = t.child; null !== n;) { if (5 === n.tag || 6 === n.tag) e.appendChild(n.stateNode); else if (4 !== n.tag && null !== n.child) { n.child.return = n, n = n.child; continue } if (n === t) break; for (; null === n.sibling;) { if (null === n.return || n.return === t) return; n = n.return } n.sibling.return = n.return, n = n.sibling } }, Ai = function () { }, Ni = function (e, t, n, r) { var a = e.memoizedProps; if (a !== r) { e = t.stateNode, no(Jl.current); var l, o = null; switch (n) { case "input": a = G(e, a), r = G(e, r), o = []; break; case "select": a = I({}, a, { value: void 0 }), r = I({}, r, { value: void 0 }), o = []; break; case "textarea": a = re(e, a), r = re(e, r), o = []; break; default: "function" !== typeof a.onClick && "function" === typeof r.onClick && (e.onclick = Jr) }for (c in be(n, r), n = null, a) if (!r.hasOwnProperty(c) && a.hasOwnProperty(c) && null != a[c]) if ("style" === c) { var u = a[c]; for (l in u) u.hasOwnProperty(l) && (n || (n = {}), n[l] = "") } else "dangerouslySetInnerHTML" !== c && "children" !== c && "suppressContentEditableWarning" !== c && "suppressHydrationWarning" !== c && "autoFocus" !== c && (i.hasOwnProperty(c) ? o || (o = []) : (o = o || []).push(c, null)); for (c in r) { var s = r[c]; if (u = null != a ? a[c] : void 0, r.hasOwnProperty(c) && s !== u && (null != s || null != u)) if ("style" === c) if (u) { for (l in u) !u.hasOwnProperty(l) || s && s.hasOwnProperty(l) || (n || (n = {}), n[l] = ""); for (l in s) s.hasOwnProperty(l) && u[l] !== s[l] && (n || (n = {}), n[l] = s[l]) } else n || (o || (o = []), o.push(c, n)), n = s; else "dangerouslySetInnerHTML" === c ? (s = s ? s.__html : void 0, u = u ? u.__html : void 0, null != s && u !== s && (o = o || []).push(c, s)) : "children" === c ? "string" !== typeof s && "number" !== typeof s || (o = o || []).push(c, "" + s) : "suppressContentEditableWarning" !== c && "suppressHydrationWarning" !== c && (i.hasOwnProperty(c) ? (null != s && "onScroll" === c && Dr("scroll", e), o || u === s || (o = [])) : (o = o || []).push(c, s)) } n && (o = o || []).push("style", n); var c = o; (t.updateQueue = c) && (t.flags |= 4) } }, Mi = function (e, t, n, r) { n !== r && (t.flags |= 4) }; var Yi = !1, Xi = !1, Zi = "function" === typeof WeakSet ? WeakSet : Set, Ji = null; function eu(e, t) { var n = e.ref; if (null !== n) if ("function" === typeof n) try { n(null) } catch (r) { xs(e, t, r) } else n.current = null } function tu(e, t, n) { try { n() } catch (r) { xs(e, t, r) } } var nu = !1; function ru(e, t, n) { var r = t.updateQueue; if (null !== (r = null !== r ? r.lastEffect : null)) { var a = r = r.next; do { if ((a.tag & e) === e) { var l = a.destroy; a.destroy = void 0, void 0 !== l && tu(t, n, l) } a = a.next } while (a !== r) } } function au(e, t) { if (null !== (t = null !== (t = t.updateQueue) ? t.lastEffect : null)) { var n = t = t.next; do { if ((n.tag & e) === e) { var r = n.create; n.destroy = r() } n = n.next } while (n !== t) } } function lu(e) { var t = e.ref; if (null !== t) { var n = e.stateNode; e.tag, e = n, "function" === typeof t ? t(e) : t.current = e } } function ou(e) { var t = e.alternate; null !== t && (e.alternate = null, ou(t)), e.child = null, e.deletions = null, e.sibling = null, 5 === e.tag && (null !== (t = e.stateNode) && (delete t[da], delete t[pa], delete t[ha], delete t[ya], delete t[va])), e.stateNode = null, e.return = null, e.dependencies = null, e.memoizedProps = null, e.memoizedState = null, e.pendingProps = null, e.stateNode = null, e.updateQueue = null } function iu(e) { return 5 === e.tag || 3 === e.tag || 4 === e.tag } function uu(e) { e: for (; ;) { for (; null === e.sibling;) { if (null === e.return || iu(e.return)) return null; e = e.return } for (e.sibling.return = e.return, e = e.sibling; 5 !== e.tag && 6 !== e.tag && 18 !== e.tag;) { if (2 & e.flags) continue e; if (null === e.child || 4 === e.tag) continue e; e.child.return = e, e = e.child } if (!(2 & e.flags)) return e.stateNode } } function su(e, t, n) { var r = e.tag; if (5 === r || 6 === r) e = e.stateNode, t ? 8 === n.nodeType ? n.parentNode.insertBefore(e, t) : n.insertBefore(e, t) : (8 === n.nodeType ? (t = n.parentNode).insertBefore(e, n) : (t = n).appendChild(e), null !== (n = n._reactRootContainer) && void 0 !== n || null !== t.onclick || (t.onclick = Jr)); else if (4 !== r && null !== (e = e.child)) for (su(e, t, n), e = e.sibling; null !== e;)su(e, t, n), e = e.sibling } function cu(e, t, n) { var r = e.tag; if (5 === r || 6 === r) e = e.stateNode, t ? n.insertBefore(e, t) : n.appendChild(e); else if (4 !== r && null !== (e = e.child)) for (cu(e, t, n), e = e.sibling; null !== e;)cu(e, t, n), e = e.sibling } var fu = null, du = !1; function pu(e, t, n) { for (n = n.child; null !== n;)mu(e, t, n), n = n.sibling } function mu(e, t, n) { if (lt && "function" === typeof lt.onCommitFiberUnmount) try { lt.onCommitFiberUnmount(at, n) } catch (i) { } switch (n.tag) { case 5: Xi || eu(n, t); case 6: var r = fu, a = du; fu = null, pu(e, t, n), du = a, null !== (fu = r) && (du ? (e = fu, n = n.stateNode, 8 === e.nodeType ? e.parentNode.removeChild(n) : e.removeChild(n)) : fu.removeChild(n.stateNode)); break; case 18: null !== fu && (du ? (e = fu, n = n.stateNode, 8 === e.nodeType ? ua(e.parentNode, n) : 1 === e.nodeType && ua(e, n), Bt(e)) : ua(fu, n.stateNode)); break; case 4: r = fu, a = du, fu = n.stateNode.containerInfo, du = !0, pu(e, t, n), fu = r, du = a; break; case 0: case 11: case 14: case 15: if (!Xi && (null !== (r = n.updateQueue) && null !== (r = r.lastEffect))) { a = r = r.next; do { var l = a, o = l.destroy; l = l.tag, void 0 !== o && (0 !== (2 & l) || 0 !== (4 & l)) && tu(n, t, o), a = a.next } while (a !== r) } pu(e, t, n); break; case 1: if (!Xi && (eu(n, t), "function" === typeof (r = n.stateNode).componentWillUnmount)) try { r.props = n.memoizedProps, r.state = n.memoizedState, r.componentWillUnmount() } catch (i) { xs(n, t, i) } pu(e, t, n); break; case 21: pu(e, t, n); break; case 22: 1 & n.mode ? (Xi = (r = Xi) || null !== n.memoizedState, pu(e, t, n), Xi = r) : pu(e, t, n); break; default: pu(e, t, n) } } function hu(e) { var t = e.updateQueue; if (null !== t) { e.updateQueue = null; var n = e.stateNode; null === n && (n = e.stateNode = new Zi), t.forEach((function (t) { var r = Os.bind(null, e, t); n.has(t) || (n.add(t), t.then(r, r)) })) } } function yu(e, t) { var n = t.deletions; if (null !== n) for (var r = 0; r < n.length; r++) { var a = n[r]; try { var o = e, i = t, u = i; e: for (; null !== u;) { switch (u.tag) { case 5: fu = u.stateNode, du = !1; break e; case 3: case 4: fu = u.stateNode.containerInfo, du = !0; break e }u = u.return } if (null === fu) throw Error(l(160)); mu(o, i, a), fu = null, du = !1; var s = a.alternate; null !== s && (s.return = null), a.return = null } catch (c) { xs(a, t, c) } } if (12854 & t.subtreeFlags) for (t = t.child; null !== t;)vu(t, e), t = t.sibling } function vu(e, t) { var n = e.alternate, r = e.flags; switch (e.tag) { case 0: case 11: case 14: case 15: if (yu(t, e), bu(e), 4 & r) { try { ru(3, e, e.return), au(3, e) } catch (y) { xs(e, e.return, y) } try { ru(5, e, e.return) } catch (y) { xs(e, e.return, y) } } break; case 1: yu(t, e), bu(e), 512 & r && null !== n && eu(n, n.return); break; case 5: if (yu(t, e), bu(e), 512 & r && null !== n && eu(n, n.return), 32 & e.flags) { var a = e.stateNode; try { de(a, "") } catch (y) { xs(e, e.return, y) } } if (4 & r && null != (a = e.stateNode)) { var o = e.memoizedProps, i = null !== n ? n.memoizedProps : o, u = e.type, s = e.updateQueue; if (e.updateQueue = null, null !== s) try { "input" === u && "radio" === o.type && null != o.name && X(a, o), ge(u, i); var c = ge(u, o); for (i = 0; i < s.length; i += 2) { var f = s[i], d = s[i + 1]; "style" === f ? ye(a, d) : "dangerouslySetInnerHTML" === f ? fe(a, d) : "children" === f ? de(a, d) : g(a, f, d, c) } switch (u) { case "input": Z(a, o); break; case "textarea": le(a, o); break; case "select": var p = a._wrapperState.wasMultiple; a._wrapperState.wasMultiple = !!o.multiple; var m = o.value; null != m ? ne(a, !!o.multiple, m, !1) : p !== !!o.multiple && (null != o.defaultValue ? ne(a, !!o.multiple, o.defaultValue, !0) : ne(a, !!o.multiple, o.multiple ? [] : "", !1)) }a[pa] = o } catch (y) { xs(e, e.return, y) } } break; case 6: if (yu(t, e), bu(e), 4 & r) { if (null === e.stateNode) throw Error(l(162)); a = e.stateNode, o = e.memoizedProps; try { a.nodeValue = o } catch (y) { xs(e, e.return, y) } } break; case 3: if (yu(t, e), bu(e), 4 & r && null !== n && n.memoizedState.isDehydrated) try { Bt(t.containerInfo) } catch (y) { xs(e, e.return, y) } break; case 4: default: yu(t, e), bu(e); break; case 13: yu(t, e), bu(e), 8192 & (a = e.child).flags && (o = null !== a.memoizedState, a.stateNode.isHidden = o, !o || null !== a.alternate && null !== a.alternate.memoizedState || (Bu = Xe())), 4 & r && hu(e); break; case 22: if (f = null !== n && null !== n.memoizedState, 1 & e.mode ? (Xi = (c = Xi) || f, yu(t, e), Xi = c) : yu(t, e), bu(e), 8192 & r) { if (c = null !== e.memoizedState, (e.stateNode.isHidden = c) && !f && 0 !== (1 & e.mode)) for (Ji = e, f = e.child; null !== f;) { for (d = Ji = f; null !== Ji;) { switch (m = (p = Ji).child, p.tag) { case 0: case 11: case 14: case 15: ru(4, p, p.return); break; case 1: eu(p, p.return); var h = p.stateNode; if ("function" === typeof h.componentWillUnmount) { r = p, n = p.return; try { t = r, h.props = t.memoizedProps, h.state = t.memoizedState, h.componentWillUnmount() } catch (y) { xs(r, n, y) } } break; case 5: eu(p, p.return); break; case 22: if (null !== p.memoizedState) { wu(d); continue } }null !== m ? (m.return = p, Ji = m) : wu(d) } f = f.sibling } e: for (f = null, d = e; ;) { if (5 === d.tag) { if (null === f) { f = d; try { a = d.stateNode, c ? "function" === typeof (o = a.style).setProperty ? o.setProperty("display", "none", "important") : o.display = "none" : (u = d.stateNode, i = void 0 !== (s = d.memoizedProps.style) && null !== s && s.hasOwnProperty("display") ? s.display : null, u.style.display = he("display", i)) } catch (y) { xs(e, e.return, y) } } } else if (6 === d.tag) { if (null === f) try { d.stateNode.nodeValue = c ? "" : d.memoizedProps } catch (y) { xs(e, e.return, y) } } else if ((22 !== d.tag && 23 !== d.tag || null === d.memoizedState || d === e) && null !== d.child) { d.child.return = d, d = d.child; continue } if (d === e) break e; for (; null === d.sibling;) { if (null === d.return || d.return === e) break e; f === d && (f = null), d = d.return } f === d && (f = null), d.sibling.return = d.return, d = d.sibling } } break; case 19: yu(t, e), bu(e), 4 & r && hu(e); case 21: } } function bu(e) { var t = e.flags; if (2 & t) { try { e: { for (var n = e.return; null !== n;) { if (iu(n)) { var r = n; break e } n = n.return } throw Error(l(160)) } switch (r.tag) { case 5: var a = r.stateNode; 32 & r.flags && (de(a, ""), r.flags &= -33), cu(e, uu(e), a); break; case 3: case 4: var o = r.stateNode.containerInfo; su(e, uu(e), o); break; default: throw Error(l(161)) } } catch (i) { xs(e, e.return, i) } e.flags &= -3 } 4096 & t && (e.flags &= -4097) } function gu(e, t, n) { Ji = e, _u(e, t, n) } function _u(e, t, n) { for (var r = 0 !== (1 & e.mode); null !== Ji;) { var a = Ji, l = a.child; if (22 === a.tag && r) { var o = null !== a.memoizedState || Yi; if (!o) { var i = a.alternate, u = null !== i && null !== i.memoizedState || Xi; i = Yi; var s = Xi; if (Yi = o, (Xi = u) && !s) for (Ji = a; null !== Ji;)u = (o = Ji).child, 22 === o.tag && null !== o.memoizedState ? ku(a) : null !== u ? (u.return = o, Ji = u) : ku(a); for (; null !== l;)Ji = l, _u(l, t, n), l = l.sibling; Ji = a, Yi = i, Xi = s } Su(e) } else 0 !== (8772 & a.subtreeFlags) && null !== l ? (l.return = a, Ji = l) : Su(e) } } function Su(e) { for (; null !== Ji;) { var t = Ji; if (0 !== (8772 & t.flags)) { var n = t.alternate; try { if (0 !== (8772 & t.flags)) switch (t.tag) { case 0: case 11: case 15: Xi || au(5, t); break; case 1: var r = t.stateNode; if (4 & t.flags && !Xi) if (null === n) r.componentDidMount(); else { var a = t.elementType === t.type ? n.memoizedProps : yl(t.type, n.memoizedProps); r.componentDidUpdate(a, n.memoizedState, r.__reactInternalSnapshotBeforeUpdate) } var o = t.updateQueue; null !== o && Fl(t, o, r); break; case 3: var i = t.updateQueue; if (null !== i) { if (n = null, null !== t.child) switch (t.child.tag) { case 5: case 1: n = t.child.stateNode }Fl(t, i, n) } break; case 5: var u = t.stateNode; if (null === n && 4 & t.flags) { n = u; var s = t.memoizedProps; switch (t.type) { case "button": case "input": case "select": case "textarea": s.autoFocus && n.focus(); break; case "img": s.src && (n.src = s.src) } } break; case 6: case 4: case 12: case 19: case 17: case 21: case 22: case 23: case 25: break; case 13: if (null === t.memoizedState) { var c = t.alternate; if (null !== c) { var f = c.memoizedState; if (null !== f) { var d = f.dehydrated; null !== d && Bt(d) } } } break; default: throw Error(l(163)) }Xi || 512 & t.flags && lu(t) } catch (p) { xs(t, t.return, p) } } if (t === e) { Ji = null; break } if (null !== (n = t.sibling)) { n.return = t.return, Ji = n; break } Ji = t.return } } function wu(e) { for (; null !== Ji;) { var t = Ji; if (t === e) { Ji = null; break } var n = t.sibling; if (null !== n) { n.return = t.return, Ji = n; break } Ji = t.return } } function ku(e) { for (; null !== Ji;) { var t = Ji; try { switch (t.tag) { case 0: case 11: case 15: var n = t.return; try { au(4, t) } catch (u) { xs(t, n, u) } break; case 1: var r = t.stateNode; if ("function" === typeof r.componentDidMount) { var a = t.return; try { r.componentDidMount() } catch (u) { xs(t, a, u) } } var l = t.return; try { lu(t) } catch (u) { xs(t, l, u) } break; case 5: var o = t.return; try { lu(t) } catch (u) { xs(t, o, u) } } } catch (u) { xs(t, t.return, u) } if (t === e) { Ji = null; break } var i = t.sibling; if (null !== i) { i.return = t.return, Ji = i; break } Ji = t.return } } var Eu, xu = Math.ceil, Cu = _.ReactCurrentDispatcher, Tu = _.ReactCurrentOwner, Pu = _.ReactCurrentBatchConfig, Ou = 0, zu = null, ju = null, Ru = 0, Au = 0, Nu = Ea(0), Mu = 0, Lu = null, Iu = 0, Fu = 0, Du = 0, Uu = null, Vu = null, Bu = 0, $u = 1 / 0, qu = null, Wu = !1, Hu = null, Qu = null, Ku = !1, Gu = null, Yu = 0, Xu = 0, Zu = null, Ju = -1, es = 0; function ts() { return 0 !== (6 & Ou) ? Xe() : -1 !== Ju ? Ju : Ju = Xe() } function ns(e) { return 0 === (1 & e.mode) ? 1 : 0 !== (2 & Ou) && 0 !== Ru ? Ru & -Ru : null !== hl.transition ? (0 === es && (es = ht()), es) : 0 !== (e = gt) ? e : e = void 0 === (e = window.event) ? 16 : Yt(e.type) } function rs(e, t, n, r) { if (50 < Xu) throw Xu = 0, Zu = null, Error(l(185)); vt(e, n, r), 0 !== (2 & Ou) && e === zu || (e === zu && (0 === (2 & Ou) && (Fu |= n), 4 === Mu && us(e, Ru)), as(e, r), 1 === n && 0 === Ou && 0 === (1 & t.mode) && ($u = Xe() + 500, Da && Ba())) } function as(e, t) { var n = e.callbackNode; !function (e, t) { for (var n = e.suspendedLanes, r = e.pingedLanes, a = e.expirationTimes, l = e.pendingLanes; 0 < l;) { var o = 31 - ot(l), i = 1 << o, u = a[o]; -1 === u ? 0 !== (i & n) && 0 === (i & r) || (a[o] = pt(i, t)) : u <= t && (e.expiredLanes |= i), l &= ~i } }(e, t); var r = dt(e, e === zu ? Ru : 0); if (0 === r) null !== n && Ke(n), e.callbackNode = null, e.callbackPriority = 0; else if (t = r & -r, e.callbackPriority !== t) { if (null != n && Ke(n), 1 === t) 0 === e.tag ? function (e) { Da = !0, Va(e) }(ss.bind(null, e)) : Va(ss.bind(null, e)), oa((function () { 0 === (6 & Ou) && Ba() })), n = null; else { switch (_t(r)) { case 1: n = Je; break; case 4: n = et; break; case 16: default: n = tt; break; case 536870912: n = rt }n = zs(n, ls.bind(null, e)) } e.callbackPriority = t, e.callbackNode = n } } function ls(e, t) { if (Ju = -1, es = 0, 0 !== (6 & Ou)) throw Error(l(327)); var n = e.callbackNode; if (ks() && e.callbackNode !== n) return null; var r = dt(e, e === zu ? Ru : 0); if (0 === r) return null; if (0 !== (30 & r) || 0 !== (r & e.expiredLanes) || t) t = vs(e, r); else { t = r; var a = Ou; Ou |= 2; var o = hs(); for (zu === e && Ru === t || (qu = null, $u = Xe() + 500, ps(e, t)); ;)try { gs(); break } catch (u) { ms(e, u) } Sl(), Cu.current = o, Ou = a, null !== ju ? t = 0 : (zu = null, Ru = 0, t = Mu) } if (0 !== t) { if (2 === t && (0 !== (a = mt(e)) && (r = a, t = os(e, a))), 1 === t) throw n = Lu, ps(e, 0), us(e, r), as(e, Xe()), n; if (6 === t) us(e, r); else { if (a = e.current.alternate, 0 === (30 & r) && !function (e) { for (var t = e; ;) { if (16384 & t.flags) { var n = t.updateQueue; if (null !== n && null !== (n = n.stores)) for (var r = 0; r < n.length; r++) { var a = n[r], l = a.getSnapshot; a = a.value; try { if (!ir(l(), a)) return !1 } catch (i) { return !1 } } } if (n = t.child, 16384 & t.subtreeFlags && null !== n) n.return = t, t = n; else { if (t === e) break; for (; null === t.sibling;) { if (null === t.return || t.return === e) return !0; t = t.return } t.sibling.return = t.return, t = t.sibling } } return !0 }(a) && (2 === (t = vs(e, r)) && (0 !== (o = mt(e)) && (r = o, t = os(e, o))), 1 === t)) throw n = Lu, ps(e, 0), us(e, r), as(e, Xe()), n; switch (e.finishedWork = a, e.finishedLanes = r, t) { case 0: case 1: throw Error(l(345)); case 2: case 5: ws(e, Vu, qu); break; case 3: if (us(e, r), (130023424 & r) === r && 10 < (t = Bu + 500 - Xe())) { if (0 !== dt(e, 0)) break; if (((a = e.suspendedLanes) & r) !== r) { ts(), e.pingedLanes |= e.suspendedLanes & a; break } e.timeoutHandle = ra(ws.bind(null, e, Vu, qu), t); break } ws(e, Vu, qu); break; case 4: if (us(e, r), (4194240 & r) === r) break; for (t = e.eventTimes, a = -1; 0 < r;) { var i = 31 - ot(r); o = 1 << i, (i = t[i]) > a && (a = i), r &= ~o } if (r = a, 10 < (r = (120 > (r = Xe() - r) ? 120 : 480 > r ? 480 : 1080 > r ? 1080 : 1920 > r ? 1920 : 3e3 > r ? 3e3 : 4320 > r ? 4320 : 1960 * xu(r / 1960)) - r)) { e.timeoutHandle = ra(ws.bind(null, e, Vu, qu), r); break } ws(e, Vu, qu); break; default: throw Error(l(329)) } } } return as(e, Xe()), e.callbackNode === n ? ls.bind(null, e) : null } function os(e, t) { var n = Uu; return e.current.memoizedState.isDehydrated && (ps(e, t).flags |= 256), 2 !== (e = vs(e, t)) && (t = Vu, Vu = n, null !== t && is(t)), e } function is(e) { null === Vu ? Vu = e : Vu.push.apply(Vu, e) } function us(e, t) { for (t &= ~Du, t &= ~Fu, e.suspendedLanes |= t, e.pingedLanes &= ~t, e = e.expirationTimes; 0 < t;) { var n = 31 - ot(t), r = 1 << n; e[n] = -1, t &= ~r } } function ss(e) { if (0 !== (6 & Ou)) throw Error(l(327)); ks(); var t = dt(e, 0); if (0 === (1 & t)) return as(e, Xe()), null; var n = vs(e, t); if (0 !== e.tag && 2 === n) { var r = mt(e); 0 !== r && (t = r, n = os(e, r)) } if (1 === n) throw n = Lu, ps(e, 0), us(e, t), as(e, Xe()), n; if (6 === n) throw Error(l(345)); return e.finishedWork = e.current.alternate, e.finishedLanes = t, ws(e, Vu, qu), as(e, Xe()), null } function cs(e, t) { var n = Ou; Ou |= 1; try { return e(t) } finally { 0 === (Ou = n) && ($u = Xe() + 500, Da && Ba()) } } function fs(e) { null !== Gu && 0 === Gu.tag && 0 === (6 & Ou) && ks(); var t = Ou; Ou |= 1; var n = Pu.transition, r = gt; try { if (Pu.transition = null, gt = 1, e) return e() } finally { gt = r, Pu.transition = n, 0 === (6 & (Ou = t)) && Ba() } } function ds() { Au = Nu.current, xa(Nu) } function ps(e, t) { e.finishedWork = null, e.finishedLanes = 0; var n = e.timeoutHandle; if (-1 !== n && (e.timeoutHandle = -1, aa(n)), null !== ju) for (n = ju.return; null !== n;) { var r = n; switch (tl(r), r.tag) { case 1: null !== (r = r.type.childContextTypes) && void 0 !== r && Aa(); break; case 3: ao(), xa(Oa), xa(Pa), co(); break; case 5: oo(r); break; case 4: ao(); break; case 13: case 19: xa(io); break; case 10: wl(r.type._context); break; case 22: case 23: ds() }n = n.return } if (zu = e, ju = e = Ns(e.current, null), Ru = Au = t, Mu = 0, Lu = null, Du = Fu = Iu = 0, Vu = Uu = null, null !== Cl) { for (t = 0; t < Cl.length; t++)if (null !== (r = (n = Cl[t]).interleaved)) { n.interleaved = null; var a = r.next, l = n.pending; if (null !== l) { var o = l.next; l.next = a, r.next = o } n.pending = r } Cl = null } return e } function ms(e, t) { for (; ;) { var n = ju; try { if (Sl(), fo.current = oi, bo) { for (var r = ho.memoizedState; null !== r;) { var a = r.queue; null !== a && (a.pending = null), r = r.next } bo = !1 } if (mo = 0, vo = yo = ho = null, go = !1, _o = 0, Tu.current = null, null === n || null === n.return) { Mu = 1, Lu = t, ju = null; break } e: { var o = e, i = n.return, u = n, s = t; if (t = Ru, u.flags |= 32768, null !== s && "object" === typeof s && "function" === typeof s.then) { var c = s, f = u, d = f.tag; if (0 === (1 & f.mode) && (0 === d || 11 === d || 15 === d)) { var p = f.alternate; p ? (f.updateQueue = p.updateQueue, f.memoizedState = p.memoizedState, f.lanes = p.lanes) : (f.updateQueue = null, f.memoizedState = null) } var m = vi(i); if (null !== m) { m.flags &= -257, bi(m, i, u, 0, t), 1 & m.mode && yi(o, c, t), s = c; var h = (t = m).updateQueue; if (null === h) { var y = new Set; y.add(s), t.updateQueue = y } else h.add(s); break e } if (0 === (1 & t)) { yi(o, c, t), ys(); break e } s = Error(l(426)) } else if (al && 1 & u.mode) { var v = vi(i); if (null !== v) { 0 === (65536 & v.flags) && (v.flags |= 256), bi(v, i, u, 0, t), ml(ci(s, u)); break e } } o = s = ci(s, u), 4 !== Mu && (Mu = 2), null === Uu ? Uu = [o] : Uu.push(o), o = i; do { switch (o.tag) { case 3: o.flags |= 65536, t &= -t, o.lanes |= t, Ll(o, mi(0, s, t)); break e; case 1: u = s; var b = o.type, g = o.stateNode; if (0 === (128 & o.flags) && ("function" === typeof b.getDerivedStateFromError || null !== g && "function" === typeof g.componentDidCatch && (null === Qu || !Qu.has(g)))) { o.flags |= 65536, t &= -t, o.lanes |= t, Ll(o, hi(o, u, t)); break e } }o = o.return } while (null !== o) } Ss(n) } catch (_) { t = _, ju === n && null !== n && (ju = n = n.return); continue } break } } function hs() { var e = Cu.current; return Cu.current = oi, null === e ? oi : e } function ys() { 0 !== Mu && 3 !== Mu && 2 !== Mu || (Mu = 4), null === zu || 0 === (268435455 & Iu) && 0 === (268435455 & Fu) || us(zu, Ru) } function vs(e, t) { var n = Ou; Ou |= 2; var r = hs(); for (zu === e && Ru === t || (qu = null, ps(e, t)); ;)try { bs(); break } catch (a) { ms(e, a) } if (Sl(), Ou = n, Cu.current = r, null !== ju) throw Error(l(261)); return zu = null, Ru = 0, Mu } function bs() { for (; null !== ju;)_s(ju) } function gs() { for (; null !== ju && !Ge();)_s(ju) } function _s(e) { var t = Eu(e.alternate, e, Au); e.memoizedProps = e.pendingProps, null === t ? Ss(e) : ju = t, Tu.current = null } function Ss(e) { var t = e; do { var n = t.alternate; if (e = t.return, 0 === (32768 & t.flags)) { if (null !== (n = Ki(n, t, Au))) return void (ju = n) } else { if (null !== (n = Gi(n, t))) return n.flags &= 32767, void (ju = n); if (null === e) return Mu = 6, void (ju = null); e.flags |= 32768, e.subtreeFlags = 0, e.deletions = null } if (null !== (t = t.sibling)) return void (ju = t); ju = t = e } while (null !== t); 0 === Mu && (Mu = 5) } function ws(e, t, n) { var r = gt, a = Pu.transition; try { Pu.transition = null, gt = 1, function (e, t, n, r) { do { ks() } while (null !== Gu); if (0 !== (6 & Ou)) throw Error(l(327)); n = e.finishedWork; var a = e.finishedLanes; if (null === n) return null; if (e.finishedWork = null, e.finishedLanes = 0, n === e.current) throw Error(l(177)); e.callbackNode = null, e.callbackPriority = 0; var o = n.lanes | n.childLanes; if (function (e, t) { var n = e.pendingLanes & ~t; e.pendingLanes = t, e.suspendedLanes = 0, e.pingedLanes = 0, e.expiredLanes &= t, e.mutableReadLanes &= t, e.entangledLanes &= t, t = e.entanglements; var r = e.eventTimes; for (e = e.expirationTimes; 0 < n;) { var a = 31 - ot(n), l = 1 << a; t[a] = 0, r[a] = -1, e[a] = -1, n &= ~l } }(e, o), e === zu && (ju = zu = null, Ru = 0), 0 === (2064 & n.subtreeFlags) && 0 === (2064 & n.flags) || Ku || (Ku = !0, zs(tt, (function () { return ks(), null }))), o = 0 !== (15990 & n.flags), 0 !== (15990 & n.subtreeFlags) || o) { o = Pu.transition, Pu.transition = null; var i = gt; gt = 1; var u = Ou; Ou |= 4, Tu.current = null, function (e, t) { if (ea = qt, pr(e = dr())) { if ("selectionStart" in e) var n = { start: e.selectionStart, end: e.selectionEnd }; else e: { var r = (n = (n = e.ownerDocument) && n.defaultView || window).getSelection && n.getSelection(); if (r && 0 !== r.rangeCount) { n = r.anchorNode; var a = r.anchorOffset, o = r.focusNode; r = r.focusOffset; try { n.nodeType, o.nodeType } catch (S) { n = null; break e } var i = 0, u = -1, s = -1, c = 0, f = 0, d = e, p = null; t: for (; ;) { for (var m; d !== n || 0 !== a && 3 !== d.nodeType || (u = i + a), d !== o || 0 !== r && 3 !== d.nodeType || (s = i + r), 3 === d.nodeType && (i += d.nodeValue.length), null !== (m = d.firstChild);)p = d, d = m; for (; ;) { if (d === e) break t; if (p === n && ++c === a && (u = i), p === o && ++f === r && (s = i), null !== (m = d.nextSibling)) break; p = (d = p).parentNode } d = m } n = -1 === u || -1 === s ? null : { start: u, end: s } } else n = null } n = n || { start: 0, end: 0 } } else n = null; for (ta = { focusedElem: e, selectionRange: n }, qt = !1, Ji = t; null !== Ji;)if (e = (t = Ji).child, 0 !== (1028 & t.subtreeFlags) && null !== e) e.return = t, Ji = e; else for (; null !== Ji;) { t = Ji; try { var h = t.alternate; if (0 !== (1024 & t.flags)) switch (t.tag) { case 0: case 11: case 15: case 5: case 6: case 4: case 17: break; case 1: if (null !== h) { var y = h.memoizedProps, v = h.memoizedState, b = t.stateNode, g = b.getSnapshotBeforeUpdate(t.elementType === t.type ? y : yl(t.type, y), v); b.__reactInternalSnapshotBeforeUpdate = g } break; case 3: var _ = t.stateNode.containerInfo; 1 === _.nodeType ? _.textContent = "" : 9 === _.nodeType && _.documentElement && _.removeChild(_.documentElement); break; default: throw Error(l(163)) } } catch (S) { xs(t, t.return, S) } if (null !== (e = t.sibling)) { e.return = t.return, Ji = e; break } Ji = t.return } h = nu, nu = !1 }(e, n), vu(n, e), mr(ta), qt = !!ea, ta = ea = null, e.current = n, gu(n, e, a), Ye(), Ou = u, gt = i, Pu.transition = o } else e.current = n; if (Ku && (Ku = !1, Gu = e, Yu = a), o = e.pendingLanes, 0 === o && (Qu = null), function (e) { if (lt && "function" === typeof lt.onCommitFiberRoot) try { lt.onCommitFiberRoot(at, e, void 0, 128 === (128 & e.current.flags)) } catch (t) { } }(n.stateNode), as(e, Xe()), null !== t) for (r = e.onRecoverableError, n = 0; n < t.length; n++)a = t[n], r(a.value, { componentStack: a.stack, digest: a.digest }); if (Wu) throw Wu = !1, e = Hu, Hu = null, e; 0 !== (1 & Yu) && 0 !== e.tag && ks(), o = e.pendingLanes, 0 !== (1 & o) ? e === Zu ? Xu++ : (Xu = 0, Zu = e) : Xu = 0, Ba() }(e, t, n, r) } finally { Pu.transition = a, gt = r } return null } function ks() { if (null !== Gu) { var e = _t(Yu), t = Pu.transition, n = gt; try { if (Pu.transition = null, gt = 16 > e ? 16 : e, null === Gu) var r = !1; else { if (e = Gu, Gu = null, Yu = 0, 0 !== (6 & Ou)) throw Error(l(331)); var a = Ou; for (Ou |= 4, Ji = e.current; null !== Ji;) { var o = Ji, i = o.child; if (0 !== (16 & Ji.flags)) { var u = o.deletions; if (null !== u) { for (var s = 0; s < u.length; s++) { var c = u[s]; for (Ji = c; null !== Ji;) { var f = Ji; switch (f.tag) { case 0: case 11: case 15: ru(8, f, o) }var d = f.child; if (null !== d) d.return = f, Ji = d; else for (; null !== Ji;) { var p = (f = Ji).sibling, m = f.return; if (ou(f), f === c) { Ji = null; break } if (null !== p) { p.return = m, Ji = p; break } Ji = m } } } var h = o.alternate; if (null !== h) { var y = h.child; if (null !== y) { h.child = null; do { var v = y.sibling; y.sibling = null, y = v } while (null !== y) } } Ji = o } } if (0 !== (2064 & o.subtreeFlags) && null !== i) i.return = o, Ji = i; else e: for (; null !== Ji;) { if (0 !== (2048 & (o = Ji).flags)) switch (o.tag) { case 0: case 11: case 15: ru(9, o, o.return) }var b = o.sibling; if (null !== b) { b.return = o.return, Ji = b; break e } Ji = o.return } } var g = e.current; for (Ji = g; null !== Ji;) { var _ = (i = Ji).child; if (0 !== (2064 & i.subtreeFlags) && null !== _) _.return = i, Ji = _; else e: for (i = g; null !== Ji;) { if (0 !== (2048 & (u = Ji).flags)) try { switch (u.tag) { case 0: case 11: case 15: au(9, u) } } catch (w) { xs(u, u.return, w) } if (u === i) { Ji = null; break e } var S = u.sibling; if (null !== S) { S.return = u.return, Ji = S; break e } Ji = u.return } } if (Ou = a, Ba(), lt && "function" === typeof lt.onPostCommitFiberRoot) try { lt.onPostCommitFiberRoot(at, e) } catch (w) { } r = !0 } return r } finally { gt = n, Pu.transition = t } } return !1 } function Es(e, t, n) { e = Nl(e, t = mi(0, t = ci(n, t), 1), 1), t = ts(), null !== e && (vt(e, 1, t), as(e, t)) } function xs(e, t, n) { if (3 === e.tag) Es(e, e, n); else for (; null !== t;) { if (3 === t.tag) { Es(t, e, n); break } if (1 === t.tag) { var r = t.stateNode; if ("function" === typeof t.type.getDerivedStateFromError || "function" === typeof r.componentDidCatch && (null === Qu || !Qu.has(r))) { t = Nl(t, e = hi(t, e = ci(n, e), 1), 1), e = ts(), null !== t && (vt(t, 1, e), as(t, e)); break } } t = t.return } } function Cs(e, t, n) { var r = e.pingCache; null !== r && r.delete(t), t = ts(), e.pingedLanes |= e.suspendedLanes & n, zu === e && (Ru & n) === n && (4 === Mu || 3 === Mu && (130023424 & Ru) === Ru && 500 > Xe() - Bu ? ps(e, 0) : Du |= n), as(e, t) } function Ts(e, t) { 0 === t && (0 === (1 & e.mode) ? t = 1 : (t = ct, 0 === (130023424 & (ct <<= 1)) && (ct = 4194304))); var n = ts(); null !== (e = Ol(e, t)) && (vt(e, t, n), as(e, n)) } function Ps(e) { var t = e.memoizedState, n = 0; null !== t && (n = t.retryLane), Ts(e, n) } function Os(e, t) { var n = 0; switch (e.tag) { case 13: var r = e.stateNode, a = e.memoizedState; null !== a && (n = a.retryLane); break; case 19: r = e.stateNode; break; default: throw Error(l(314)) }null !== r && r.delete(t), Ts(e, n) } function zs(e, t) { return Qe(e, t) } function js(e, t, n, r) { this.tag = e, this.key = n, this.sibling = this.child = this.return = this.stateNode = this.type = this.elementType = null, this.index = 0, this.ref = null, this.pendingProps = t, this.dependencies = this.memoizedState = this.updateQueue = this.memoizedProps = null, this.mode = r, this.subtreeFlags = this.flags = 0, this.deletions = null, this.childLanes = this.lanes = 0, this.alternate = null } function Rs(e, t, n, r) { return new js(e, t, n, r) } function As(e) { return !(!(e = e.prototype) || !e.isReactComponent) } function Ns(e, t) { var n = e.alternate; return null === n ? ((n = Rs(e.tag, t, e.key, e.mode)).elementType = e.elementType, n.type = e.type, n.stateNode = e.stateNode, n.alternate = e, e.alternate = n) : (n.pendingProps = t, n.type = e.type, n.flags = 0, n.subtreeFlags = 0, n.deletions = null), n.flags = 14680064 & e.flags, n.childLanes = e.childLanes, n.lanes = e.lanes, n.child = e.child, n.memoizedProps = e.memoizedProps, n.memoizedState = e.memoizedState, n.updateQueue = e.updateQueue, t = e.dependencies, n.dependencies = null === t ? null : { lanes: t.lanes, firstContext: t.firstContext }, n.sibling = e.sibling, n.index = e.index, n.ref = e.ref, n } function Ms(e, t, n, r, a, o) { var i = 2; if (r = e, "function" === typeof e) As(e) && (i = 1); else if ("string" === typeof e) i = 5; else e: switch (e) { case k: return Ls(n.children, a, o, t); case E: i = 8, a |= 8; break; case x: return (e = Rs(12, n, t, 2 | a)).elementType = x, e.lanes = o, e; case O: return (e = Rs(13, n, t, a)).elementType = O, e.lanes = o, e; case z: return (e = Rs(19, n, t, a)).elementType = z, e.lanes = o, e; case A: return Is(n, a, o, t); default: if ("object" === typeof e && null !== e) switch (e.$$typeof) { case C: i = 10; break e; case T: i = 9; break e; case P: i = 11; break e; case j: i = 14; break e; case R: i = 16, r = null; break e }throw Error(l(130, null == e ? e : typeof e, "")) }return (t = Rs(i, n, t, a)).elementType = e, t.type = r, t.lanes = o, t } function Ls(e, t, n, r) { return (e = Rs(7, e, r, t)).lanes = n, e } function Is(e, t, n, r) { return (e = Rs(22, e, r, t)).elementType = A, e.lanes = n, e.stateNode = { isHidden: !1 }, e } function Fs(e, t, n) { return (e = Rs(6, e, null, t)).lanes = n, e } function Ds(e, t, n) { return (t = Rs(4, null !== e.children ? e.children : [], e.key, t)).lanes = n, t.stateNode = { containerInfo: e.containerInfo, pendingChildren: null, implementation: e.implementation }, t } function Us(e, t, n, r, a) { this.tag = t, this.containerInfo = e, this.finishedWork = this.pingCache = this.current = this.pendingChildren = null, this.timeoutHandle = -1, this.callbackNode = this.pendingContext = this.context = null, this.callbackPriority = 0, this.eventTimes = yt(0), this.expirationTimes = yt(-1), this.entangledLanes = this.finishedLanes = this.mutableReadLanes = this.expiredLanes = this.pingedLanes = this.suspendedLanes = this.pendingLanes = 0, this.entanglements = yt(0), this.identifierPrefix = r, this.onRecoverableError = a, this.mutableSourceEagerHydrationData = null } function Vs(e, t, n, r, a, l, o, i, u) { return e = new Us(e, t, n, i, u), 1 === t ? (t = 1, !0 === l && (t |= 8)) : t = 0, l = Rs(3, null, null, t), e.current = l, l.stateNode = e, l.memoizedState = { element: r, isDehydrated: n, cache: null, transitions: null, pendingSuspenseBoundaries: null }, jl(l), e } function Bs(e) { if (!e) return Ta; e: { if (Be(e = e._reactInternals) !== e || 1 !== e.tag) throw Error(l(170)); var t = e; do { switch (t.tag) { case 3: t = t.stateNode.context; break e; case 1: if (Ra(t.type)) { t = t.stateNode.__reactInternalMemoizedMergedChildContext; break e } }t = t.return } while (null !== t); throw Error(l(171)) } if (1 === e.tag) { var n = e.type; if (Ra(n)) return Ma(e, n, t) } return t } function $s(e, t, n, r, a, l, o, i, u) { return (e = Vs(n, r, !0, e, 0, l, 0, i, u)).context = Bs(null), n = e.current, (l = Al(r = ts(), a = ns(n))).callback = void 0 !== t && null !== t ? t : null, Nl(n, l, a), e.current.lanes = a, vt(e, a, r), as(e, r), e } function qs(e, t, n, r) { var a = t.current, l = ts(), o = ns(a); return n = Bs(n), null === t.context ? t.context = n : t.pendingContext = n, (t = Al(l, o)).payload = { element: e }, null !== (r = void 0 === r ? null : r) && (t.callback = r), null !== (e = Nl(a, t, o)) && (rs(e, a, o, l), Ml(e, a, o)), o } function Ws(e) { return (e = e.current).child ? (e.child.tag, e.child.stateNode) : null } function Hs(e, t) { if (null !== (e = e.memoizedState) && null !== e.dehydrated) { var n = e.retryLane; e.retryLane = 0 !== n && n < t ? n : t } } function Qs(e, t) { Hs(e, t), (e = e.alternate) && Hs(e, t) } Eu = function (e, t, n) { if (null !== e) if (e.memoizedProps !== t.pendingProps || Oa.current) _i = !0; else { if (0 === (e.lanes & n) && 0 === (128 & t.flags)) return _i = !1, function (e, t, n) { switch (t.tag) { case 3: zi(t), pl(); break; case 5: lo(t); break; case 1: Ra(t.type) && La(t); break; case 4: ro(t, t.stateNode.containerInfo); break; case 10: var r = t.type._context, a = t.memoizedProps.value; Ca(vl, r._currentValue), r._currentValue = a; break; case 13: if (null !== (r = t.memoizedState)) return null !== r.dehydrated ? (Ca(io, 1 & io.current), t.flags |= 128, null) : 0 !== (n & t.child.childLanes) ? Fi(e, t, n) : (Ca(io, 1 & io.current), null !== (e = Wi(e, t, n)) ? e.sibling : null); Ca(io, 1 & io.current); break; case 19: if (r = 0 !== (n & t.childLanes), 0 !== (128 & e.flags)) { if (r) return $i(e, t, n); t.flags |= 128 } if (null !== (a = t.memoizedState) && (a.rendering = null, a.tail = null, a.lastEffect = null), Ca(io, io.current), r) break; return null; case 22: case 23: return t.lanes = 0, xi(e, t, n) }return Wi(e, t, n) }(e, t, n); _i = 0 !== (131072 & e.flags) } else _i = !1, al && 0 !== (1048576 & t.flags) && Ja(t, Ha, t.index); switch (t.lanes = 0, t.tag) { case 2: var r = t.type; qi(e, t), e = t.pendingProps; var a = ja(t, Pa.current); El(t, n), a = Eo(null, t, r, e, a, n); var o = xo(); return t.flags |= 1, "object" === typeof a && null !== a && "function" === typeof a.render && void 0 === a.$$typeof ? (t.tag = 1, t.memoizedState = null, t.updateQueue = null, Ra(r) ? (o = !0, La(t)) : o = !1, t.memoizedState = null !== a.state && void 0 !== a.state ? a.state : null, jl(t), a.updater = Vl, t.stateNode = a, a._reactInternals = t, Wl(t, r, e, n), t = Oi(null, t, r, !0, o, n)) : (t.tag = 0, al && o && el(t), Si(null, t, a, n), t = t.child), t; case 16: r = t.elementType; e: { switch (qi(e, t), e = t.pendingProps, r = (a = r._init)(r._payload), t.type = r, a = t.tag = function (e) { if ("function" === typeof e) return As(e) ? 1 : 0; if (void 0 !== e && null !== e) { if ((e = e.$$typeof) === P) return 11; if (e === j) return 14 } return 2 }(r), e = yl(r, e), a) { case 0: t = Ti(null, t, r, e, n); break e; case 1: t = Pi(null, t, r, e, n); break e; case 11: t = wi(null, t, r, e, n); break e; case 14: t = ki(null, t, r, yl(r.type, e), n); break e }throw Error(l(306, r, "")) } return t; case 0: return r = t.type, a = t.pendingProps, Ti(e, t, r, a = t.elementType === r ? a : yl(r, a), n); case 1: return r = t.type, a = t.pendingProps, Pi(e, t, r, a = t.elementType === r ? a : yl(r, a), n); case 3: e: { if (zi(t), null === e) throw Error(l(387)); r = t.pendingProps, a = (o = t.memoizedState).element, Rl(e, t), Il(t, r, null, n); var i = t.memoizedState; if (r = i.element, o.isDehydrated) { if (o = { element: r, isDehydrated: !1, cache: i.cache, pendingSuspenseBoundaries: i.pendingSuspenseBoundaries, transitions: i.transitions }, t.updateQueue.baseState = o, t.memoizedState = o, 256 & t.flags) { t = ji(e, t, r, n, a = ci(Error(l(423)), t)); break e } if (r !== a) { t = ji(e, t, r, n, a = ci(Error(l(424)), t)); break e } for (rl = sa(t.stateNode.containerInfo.firstChild), nl = t, al = !0, ll = null, n = Xl(t, null, r, n), t.child = n; n;)n.flags = -3 & n.flags | 4096, n = n.sibling } else { if (pl(), r === a) { t = Wi(e, t, n); break e } Si(e, t, r, n) } t = t.child } return t; case 5: return lo(t), null === e && sl(t), r = t.type, a = t.pendingProps, o = null !== e ? e.memoizedProps : null, i = a.children, na(r, a) ? i = null : null !== o && na(r, o) && (t.flags |= 32), Ci(e, t), Si(e, t, i, n), t.child; case 6: return null === e && sl(t), null; case 13: return Fi(e, t, n); case 4: return ro(t, t.stateNode.containerInfo), r = t.pendingProps, null === e ? t.child = Yl(t, null, r, n) : Si(e, t, r, n), t.child; case 11: return r = t.type, a = t.pendingProps, wi(e, t, r, a = t.elementType === r ? a : yl(r, a), n); case 7: return Si(e, t, t.pendingProps, n), t.child; case 8: case 12: return Si(e, t, t.pendingProps.children, n), t.child; case 10: e: { if (r = t.type._context, a = t.pendingProps, o = t.memoizedProps, i = a.value, Ca(vl, r._currentValue), r._currentValue = i, null !== o) if (ir(o.value, i)) { if (o.children === a.children && !Oa.current) { t = Wi(e, t, n); break e } } else for (null !== (o = t.child) && (o.return = t); null !== o;) { var u = o.dependencies; if (null !== u) { i = o.child; for (var s = u.firstContext; null !== s;) { if (s.context === r) { if (1 === o.tag) { (s = Al(-1, n & -n)).tag = 2; var c = o.updateQueue; if (null !== c) { var f = (c = c.shared).pending; null === f ? s.next = s : (s.next = f.next, f.next = s), c.pending = s } } o.lanes |= n, null !== (s = o.alternate) && (s.lanes |= n), kl(o.return, n, t), u.lanes |= n; break } s = s.next } } else if (10 === o.tag) i = o.type === t.type ? null : o.child; else if (18 === o.tag) { if (null === (i = o.return)) throw Error(l(341)); i.lanes |= n, null !== (u = i.alternate) && (u.lanes |= n), kl(i, n, t), i = o.sibling } else i = o.child; if (null !== i) i.return = o; else for (i = o; null !== i;) { if (i === t) { i = null; break } if (null !== (o = i.sibling)) { o.return = i.return, i = o; break } i = i.return } o = i } Si(e, t, a.children, n), t = t.child } return t; case 9: return a = t.type, r = t.pendingProps.children, El(t, n), r = r(a = xl(a)), t.flags |= 1, Si(e, t, r, n), t.child; case 14: return a = yl(r = t.type, t.pendingProps), ki(e, t, r, a = yl(r.type, a), n); case 15: return Ei(e, t, t.type, t.pendingProps, n); case 17: return r = t.type, a = t.pendingProps, a = t.elementType === r ? a : yl(r, a), qi(e, t), t.tag = 1, Ra(r) ? (e = !0, La(t)) : e = !1, El(t, n), $l(t, r, a), Wl(t, r, a, n), Oi(null, t, r, !0, e, n); case 19: return $i(e, t, n); case 22: return xi(e, t, n) }throw Error(l(156, t.tag)) }; var Ks = "function" === typeof reportError ? reportError : function (e) { console.error(e) }; function Gs(e) { this._internalRoot = e } function Ys(e) { this._internalRoot = e } function Xs(e) { return !(!e || 1 !== e.nodeType && 9 !== e.nodeType && 11 !== e.nodeType) } function Zs(e) { return !(!e || 1 !== e.nodeType && 9 !== e.nodeType && 11 !== e.nodeType && (8 !== e.nodeType || " react-mount-point-unstable " !== e.nodeValue)) } function Js() { } function ec(e, t, n, r, a) { var l = n._reactRootContainer; if (l) { var o = l; if ("function" === typeof a) { var i = a; a = function () { var e = Ws(o); i.call(e) } } qs(t, o, e, a) } else o = function (e, t, n, r, a) { if (a) { if ("function" === typeof r) { var l = r; r = function () { var e = Ws(o); l.call(e) } } var o = $s(t, r, e, 0, null, !1, 0, "", Js); return e._reactRootContainer = o, e[ma] = o.current, Br(8 === e.nodeType ? e.parentNode : e), fs(), o } for (; a = e.lastChild;)e.removeChild(a); if ("function" === typeof r) { var i = r; r = function () { var e = Ws(u); i.call(e) } } var u = Vs(e, 0, !1, null, 0, !1, 0, "", Js); return e._reactRootContainer = u, e[ma] = u.current, Br(8 === e.nodeType ? e.parentNode : e), fs((function () { qs(t, u, n, r) })), u }(n, t, e, a, r); return Ws(o) } Ys.prototype.render = Gs.prototype.render = function (e) { var t = this._internalRoot; if (null === t) throw Error(l(409)); qs(e, t, null, null) }, Ys.prototype.unmount = Gs.prototype.unmount = function () { var e = this._internalRoot; if (null !== e) { this._internalRoot = null; var t = e.containerInfo; fs((function () { qs(null, e, null, null) })), t[ma] = null } }, Ys.prototype.unstable_scheduleHydration = function (e) { if (e) { var t = Et(); e = { blockedOn: null, target: e, priority: t }; for (var n = 0; n < At.length && 0 !== t && t < At[n].priority; n++); At.splice(n, 0, e), 0 === n && It(e) } }, St = function (e) { switch (e.tag) { case 3: var t = e.stateNode; if (t.current.memoizedState.isDehydrated) { var n = ft(t.pendingLanes); 0 !== n && (bt(t, 1 | n), as(t, Xe()), 0 === (6 & Ou) && ($u = Xe() + 500, Ba())) } break; case 13: fs((function () { var t = Ol(e, 1); if (null !== t) { var n = ts(); rs(t, e, 1, n) } })), Qs(e, 1) } }, wt = function (e) { if (13 === e.tag) { var t = Ol(e, 134217728); if (null !== t) rs(t, e, 134217728, ts()); Qs(e, 134217728) } }, kt = function (e) { if (13 === e.tag) { var t = ns(e), n = Ol(e, t); if (null !== n) rs(n, e, t, ts()); Qs(e, t) } }, Et = function () { return gt }, xt = function (e, t) { var n = gt; try { return gt = e, t() } finally { gt = n } }, we = function (e, t, n) { switch (t) { case "input": if (Z(e, n), t = n.name, "radio" === n.type && null != t) { for (n = e; n.parentNode;)n = n.parentNode; for (n = n.querySelectorAll("input[name=" + JSON.stringify("" + t) + '][type="radio"]'), t = 0; t < n.length; t++) { var r = n[t]; if (r !== e && r.form === e.form) { var a = Sa(r); if (!a) throw Error(l(90)); Q(r), Z(r, a) } } } break; case "textarea": le(e, n); break; case "select": null != (t = n.value) && ne(e, !!n.multiple, t, !1) } }, Pe = cs, Oe = fs; var tc = { usingClientEntryPoint: !1, Events: [ga, _a, Sa, Ce, Te, cs] }, nc = { findFiberByHostInstance: ba, bundleType: 0, version: "18.2.0", rendererPackageName: "react-dom" }, rc = { bundleType: nc.bundleType, version: nc.version, rendererPackageName: nc.rendererPackageName, rendererConfig: nc.rendererConfig, overrideHookState: null, overrideHookStateDeletePath: null, overrideHookStateRenamePath: null, overrideProps: null, overridePropsDeletePath: null, overridePropsRenamePath: null, setErrorHandler: null, setSuspenseHandler: null, scheduleUpdate: null, currentDispatcherRef: _.ReactCurrentDispatcher, findHostInstanceByFiber: function (e) { return null === (e = We(e)) ? null : e.stateNode }, findFiberByHostInstance: nc.findFiberByHostInstance || function () { return null }, findHostInstancesForRefresh: null, scheduleRefresh: null, scheduleRoot: null, setRefreshHandler: null, getCurrentFiber: null, reconcilerVersion: "18.2.0-next-9e3b772b8-20220608" }; if ("undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__) { var ac = __REACT_DEVTOOLS_GLOBAL_HOOK__; if (!ac.isDisabled && ac.supportsFiber) try { at = ac.inject(rc), lt = ac } catch (ce) { } } t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED = tc, t.createPortal = function (e, t) { var n = 2 < arguments.length && void 0 !== arguments[2] ? arguments[2] : null; if (!Xs(t)) throw Error(l(200)); return function (e, t, n) { var r = 3 < arguments.length && void 0 !== arguments[3] ? arguments[3] : null; return { $$typeof: w, key: null == r ? null : "" + r, children: e, containerInfo: t, implementation: n } }(e, t, null, n) }, t.createRoot = function (e, t) { if (!Xs(e)) throw Error(l(299)); var n = !1, r = "", a = Ks; return null !== t && void 0 !== t && (!0 === t.unstable_strictMode && (n = !0), void 0 !== t.identifierPrefix && (r = t.identifierPrefix), void 0 !== t.onRecoverableError && (a = t.onRecoverableError)), t = Vs(e, 1, !1, null, 0, n, 0, r, a), e[ma] = t.current, Br(8 === e.nodeType ? e.parentNode : e), new Gs(t) }, t.findDOMNode = function (e) { if (null == e) return null; if (1 === e.nodeType) return e; var t = e._reactInternals; if (void 0 === t) { if ("function" === typeof e.render) throw Error(l(188)); throw e = Object.keys(e).join(","), Error(l(268, e)) } return e = null === (e = We(t)) ? null : e.stateNode }, t.flushSync = function (e) { return fs(e) }, t.hydrate = function (e, t, n) { if (!Zs(t)) throw Error(l(200)); return ec(null, e, t, !0, n) }, t.hydrateRoot = function (e, t, n) { if (!Xs(e)) throw Error(l(405)); var r = null != n && n.hydratedSources || null, a = !1, o = "", i = Ks; if (null !== n && void 0 !== n && (!0 === n.unstable_strictMode && (a = !0), void 0 !== n.identifierPrefix && (o = n.identifierPrefix), void 0 !== n.onRecoverableError && (i = n.onRecoverableError)), t = $s(t, null, e, 1, null != n ? n : null, a, 0, o, i), e[ma] = t.current, Br(e), r) for (e = 0; e < r.length; e++)a = (a = (n = r[e])._getVersion)(n._source), null == t.mutableSourceEagerHydrationData ? t.mutableSourceEagerHydrationData = [n, a] : t.mutableSourceEagerHydrationData.push(n, a); return new Ys(t) }, t.render = function (e, t, n) { if (!Zs(t)) throw Error(l(200)); return ec(null, e, t, !1, n) }, t.unmountComponentAtNode = function (e) { if (!Zs(e)) throw Error(l(40)); return !!e._reactRootContainer && (fs((function () { ec(null, null, e, !1, (function () { e._reactRootContainer = null, e[ma] = null })) })), !0) }, t.unstable_batchedUpdates = cs, t.unstable_renderSubtreeIntoContainer = function (e, t, n, r) { if (!Zs(n)) throw Error(l(200)); if (null == e || void 0 === e._reactInternals) throw Error(l(38)); return ec(e, t, n, !1, r) }, t.version = "18.2.0-next-9e3b772b8-20220608" }, 391: (e, t, n) => { var r = n(950); t.createRoot = r.createRoot, t.hydrateRoot = r.hydrateRoot }, 950: (e, t, n) => { !function e() { if ("undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ && "function" === typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE) try { __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e) } catch (t) { console.error(t) } }(), e.exports = n(730) }, 366: e => { var t = Array.isArray, n = Object.keys, r = Object.prototype.hasOwnProperty, a = "undefined" !== typeof Element; function l(e, o) { if (e === o) return !0; if (e && o && "object" == typeof e && "object" == typeof o) { var i, u, s, c = t(e), f = t(o); if (c && f) { if ((u = e.length) != o.length) return !1; for (i = u; 0 !== i--;)if (!l(e[i], o[i])) return !1; return !0 } if (c != f) return !1; var d = e instanceof Date, p = o instanceof Date; if (d != p) return !1; if (d && p) return e.getTime() == o.getTime(); var m = e instanceof RegExp, h = o instanceof RegExp; if (m != h) return !1; if (m && h) return e.toString() == o.toString(); var y = n(e); if ((u = y.length) !== n(o).length) return !1; for (i = u; 0 !== i--;)if (!r.call(o, y[i])) return !1; if (a && e instanceof Element && o instanceof Element) return e === o; for (i = u; 0 !== i--;)if (("_owner" !== (s = y[i]) || !e.$$typeof) && !l(e[s], o[s])) return !1; return !0 } return e !== e && o !== o } e.exports = function (e, t) { try { return l(e, t) } catch (n) { if (n.message && n.message.match(/stack|recursion/i) || -2146828260 === n.number) return console.warn("Warning: react-fast-compare does not handle circular references.", n.name, n.message), !1; throw n } } }, 82: (e, t) => { var n = "function" === typeof Symbol && Symbol.for, r = n ? Symbol.for("react.element") : 60103, a = n ? Symbol.for("react.portal") : 60106, l = n ? Symbol.for("react.fragment") : 60107, o = n ? Symbol.for("react.strict_mode") : 60108, i = n ? Symbol.for("react.profiler") : 60114, u = n ? Symbol.for("react.provider") : 60109, s = n ? Symbol.for("react.context") : 60110, c = n ? Symbol.for("react.async_mode") : 60111, f = n ? Symbol.for("react.concurrent_mode") : 60111, d = n ? Symbol.for("react.forward_ref") : 60112, p = n ? Symbol.for("react.suspense") : 60113, m = n ? Symbol.for("react.suspense_list") : 60120, h = n ? Symbol.for("react.memo") : 60115, y = n ? Symbol.for("react.lazy") : 60116, v = n ? Symbol.for("react.block") : 60121, b = n ? Symbol.for("react.fundamental") : 60117, g = n ? Symbol.for("react.responder") : 60118, _ = n ? Symbol.for("react.scope") : 60119; function S(e) { if ("object" === typeof e && null !== e) { var t = e.$$typeof; switch (t) { case r: switch (e = e.type) { case c: case f: case l: case i: case o: case p: return e; default: switch (e = e && e.$$typeof) { case s: case d: case y: case h: case u: return e; default: return t } }case a: return t } } } function w(e) { return S(e) === f } t.AsyncMode = c, t.ConcurrentMode = f, t.ContextConsumer = s, t.ContextProvider = u, t.Element = r, t.ForwardRef = d, t.Fragment = l, t.Lazy = y, t.Memo = h, t.Portal = a, t.Profiler = i, t.StrictMode = o, t.Suspense = p, t.isAsyncMode = function (e) { return w(e) || S(e) === c }, t.isConcurrentMode = w, t.isContextConsumer = function (e) { return S(e) === s }, t.isContextProvider = function (e) { return S(e) === u }, t.isElement = function (e) { return "object" === typeof e && null !== e && e.$$typeof === r }, t.isForwardRef = function (e) { return S(e) === d }, t.isFragment = function (e) { return S(e) === l }, t.isLazy = function (e) { return S(e) === y }, t.isMemo = function (e) { return S(e) === h }, t.isPortal = function (e) { return S(e) === a }, t.isProfiler = function (e) { return S(e) === i }, t.isStrictMode = function (e) { return S(e) === o }, t.isSuspense = function (e) { return S(e) === p }, t.isValidElementType = function (e) { return "string" === typeof e || "function" === typeof e || e === l || e === f || e === i || e === o || e === p || e === m || "object" === typeof e && null !== e && (e.$$typeof === y || e.$$typeof === h || e.$$typeof === u || e.$$typeof === s || e.$$typeof === d || e.$$typeof === b || e.$$typeof === g || e.$$typeof === _ || e.$$typeof === v) }, t.typeOf = S }, 86: (e, t, n) => { e.exports = n(82) }, 153: (e, t, n) => { var r = n(43), a = Symbol.for("react.element"), l = Symbol.for("react.fragment"), o = Object.prototype.hasOwnProperty, i = r.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactCurrentOwner, u = { key: !0, ref: !0, __self: !0, __source: !0 }; function s(e, t, n) { var r, l = {}, s = null, c = null; for (r in void 0 !== n && (s = "" + n), void 0 !== t.key && (s = "" + t.key), void 0 !== t.ref && (c = t.ref), t) o.call(t, r) && !u.hasOwnProperty(r) && (l[r] = t[r]); if (e && e.defaultProps) for (r in t = e.defaultProps) void 0 === l[r] && (l[r] = t[r]); return { $$typeof: a, type: e, key: s, ref: c, props: l, _owner: i.current } } t.Fragment = l, t.jsx = s, t.jsxs = s }, 202: (e, t) => { var n = Symbol.for("react.element"), r = Symbol.for("react.portal"), a = Symbol.for("react.fragment"), l = Symbol.for("react.strict_mode"), o = Symbol.for("react.profiler"), i = Symbol.for("react.provider"), u = Symbol.for("react.context"), s = Symbol.for("react.forward_ref"), c = Symbol.for("react.suspense"), f = Symbol.for("react.memo"), d = Symbol.for("react.lazy"), p = Symbol.iterator; var m = { isMounted: function () { return !1 }, enqueueForceUpdate: function () { }, enqueueReplaceState: function () { }, enqueueSetState: function () { } }, h = Object.assign, y = {}; function v(e, t, n) { this.props = e, this.context = t, this.refs = y, this.updater = n || m } function b() { } function g(e, t, n) { this.props = e, this.context = t, this.refs = y, this.updater = n || m } v.prototype.isReactComponent = {}, v.prototype.setState = function (e, t) { if ("object" !== typeof e && "function" !== typeof e && null != e) throw Error("setState(...): takes an object of state variables to update or a function which returns an object of state variables."); this.updater.enqueueSetState(this, e, t, "setState") }, v.prototype.forceUpdate = function (e) { this.updater.enqueueForceUpdate(this, e, "forceUpdate") }, b.prototype = v.prototype; var _ = g.prototype = new b; _.constructor = g, h(_, v.prototype), _.isPureReactComponent = !0; var S = Array.isArray, w = Object.prototype.hasOwnProperty, k = { current: null }, E = { key: !0, ref: !0, __self: !0, __source: !0 }; function x(e, t, r) { var a, l = {}, o = null, i = null; if (null != t) for (a in void 0 !== t.ref && (i = t.ref), void 0 !== t.key && (o = "" + t.key), t) w.call(t, a) && !E.hasOwnProperty(a) && (l[a] = t[a]); var u = arguments.length - 2; if (1 === u) l.children = r; else if (1 < u) { for (var s = Array(u), c = 0; c < u; c++)s[c] = arguments[c + 2]; l.children = s } if (e && e.defaultProps) for (a in u = e.defaultProps) void 0 === l[a] && (l[a] = u[a]); return { $$typeof: n, type: e, key: o, ref: i, props: l, _owner: k.current } } function C(e) { return "object" === typeof e && null !== e && e.$$typeof === n } var T = /\/+/g; function P(e, t) { return "object" === typeof e && null !== e && null != e.key ? function (e) { var t = { "=": "=0", ":": "=2" }; return "$" + e.replace(/[=:]/g, (function (e) { return t[e] })) }("" + e.key) : t.toString(36) } function O(e, t, a, l, o) { var i = typeof e; "undefined" !== i && "boolean" !== i || (e = null); var u = !1; if (null === e) u = !0; else switch (i) { case "string": case "number": u = !0; break; case "object": switch (e.$$typeof) { case n: case r: u = !0 } }if (u) return o = o(u = e), e = "" === l ? "." + P(u, 0) : l, S(o) ? (a = "", null != e && (a = e.replace(T, "$&/") + "/"), O(o, t, a, "", (function (e) { return e }))) : null != o && (C(o) && (o = function (e, t) { return { $$typeof: n, type: e.type, key: t, ref: e.ref, props: e.props, _owner: e._owner } }(o, a + (!o.key || u && u.key === o.key ? "" : ("" + o.key).replace(T, "$&/") + "/") + e)), t.push(o)), 1; if (u = 0, l = "" === l ? "." : l + ":", S(e)) for (var s = 0; s < e.length; s++) { var c = l + P(i = e[s], s); u += O(i, t, a, c, o) } else if (c = function (e) { return null === e || "object" !== typeof e ? null : "function" === typeof (e = p && e[p] || e["@@iterator"]) ? e : null }(e), "function" === typeof c) for (e = c.call(e), s = 0; !(i = e.next()).done;)u += O(i = i.value, t, a, c = l + P(i, s++), o); else if ("object" === i) throw t = String(e), Error("Objects are not valid as a React child (found: " + ("[object Object]" === t ? "object with keys {" + Object.keys(e).join(", ") + "}" : t) + "). If you meant to render a collection of children, use an array instead."); return u } function z(e, t, n) { if (null == e) return e; var r = [], a = 0; return O(e, r, "", "", (function (e) { return t.call(n, e, a++) })), r } function j(e) { if (-1 === e._status) { var t = e._result; (t = t()).then((function (t) { 0 !== e._status && -1 !== e._status || (e._status = 1, e._result = t) }), (function (t) { 0 !== e._status && -1 !== e._status || (e._status = 2, e._result = t) })), -1 === e._status && (e._status = 0, e._result = t) } if (1 === e._status) return e._result.default; throw e._result } var R = { current: null }, A = { transition: null }, N = { ReactCurrentDispatcher: R, ReactCurrentBatchConfig: A, ReactCurrentOwner: k }; t.Children = { map: z, forEach: function (e, t, n) { z(e, (function () { t.apply(this, arguments) }), n) }, count: function (e) { var t = 0; return z(e, (function () { t++ })), t }, toArray: function (e) { return z(e, (function (e) { return e })) || [] }, only: function (e) { if (!C(e)) throw Error("React.Children.only expected to receive a single React element child."); return e } }, t.Component = v, t.Fragment = a, t.Profiler = o, t.PureComponent = g, t.StrictMode = l, t.Suspense = c, t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED = N, t.cloneElement = function (e, t, r) { if (null === e || void 0 === e) throw Error("React.cloneElement(...): The argument must be a React element, but you passed " + e + "."); var a = h({}, e.props), l = e.key, o = e.ref, i = e._owner; if (null != t) { if (void 0 !== t.ref && (o = t.ref, i = k.current), void 0 !== t.key && (l = "" + t.key), e.type && e.type.defaultProps) var u = e.type.defaultProps; for (s in t) w.call(t, s) && !E.hasOwnProperty(s) && (a[s] = void 0 === t[s] && void 0 !== u ? u[s] : t[s]) } var s = arguments.length - 2; if (1 === s) a.children = r; else if (1 < s) { u = Array(s); for (var c = 0; c < s; c++)u[c] = arguments[c + 2]; a.children = u } return { $$typeof: n, type: e.type, key: l, ref: o, props: a, _owner: i } }, t.createContext = function (e) { return (e = { $$typeof: u, _currentValue: e, _currentValue2: e, _threadCount: 0, Provider: null, Consumer: null, _defaultValue: null, _globalName: null }).Provider = { $$typeof: i, _context: e }, e.Consumer = e }, t.createElement = x, t.createFactory = function (e) { var t = x.bind(null, e); return t.type = e, t }, t.createRef = function () { return { current: null } }, t.forwardRef = function (e) { return { $$typeof: s, render: e } }, t.isValidElement = C, t.lazy = function (e) { return { $$typeof: d, _payload: { _status: -1, _result: e }, _init: j } }, t.memo = function (e, t) { return { $$typeof: f, type: e, compare: void 0 === t ? null : t } }, t.startTransition = function (e) { var t = A.transition; A.transition = {}; try { e() } finally { A.transition = t } }, t.unstable_act = function () { throw Error("act(...) is not supported in production builds of React.") }, t.useCallback = function (e, t) { return R.current.useCallback(e, t) }, t.useContext = function (e) { return R.current.useContext(e) }, t.useDebugValue = function () { }, t.useDeferredValue = function (e) { return R.current.useDeferredValue(e) }, t.useEffect = function (e, t) { return R.current.useEffect(e, t) }, t.useId = function () { return R.current.useId() }, t.useImperativeHandle = function (e, t, n) { return R.current.useImperativeHandle(e, t, n) }, t.useInsertionEffect = function (e, t) { return R.current.useInsertionEffect(e, t) }, t.useLayoutEffect = function (e, t) { return R.current.useLayoutEffect(e, t) }, t.useMemo = function (e, t) { return R.current.useMemo(e, t) }, t.useReducer = function (e, t, n) { return R.current.useReducer(e, t, n) }, t.useRef = function (e) { return R.current.useRef(e) }, t.useState = function (e) { return R.current.useState(e) }, t.useSyncExternalStore = function (e, t, n) { return R.current.useSyncExternalStore(e, t, n) }, t.useTransition = function () { return R.current.useTransition() }, t.version = "18.2.0" }, 43: (e, t, n) => { e.exports = n(202) }, 579: (e, t, n) => { e.exports = n(153) }, 234: (e, t) => { function n(e, t) { var n = e.length; e.push(t); e: for (; 0 < n;) { var r = n - 1 >>> 1, a = e[r]; if (!(0 < l(a, t))) break e; e[r] = t, e[n] = a, n = r } } function r(e) { return 0 === e.length ? null : e[0] } function a(e) { if (0 === e.length) return null; var t = e[0], n = e.pop(); if (n !== t) { e[0] = n; e: for (var r = 0, a = e.length, o = a >>> 1; r < o;) { var i = 2 * (r + 1) - 1, u = e[i], s = i + 1, c = e[s]; if (0 > l(u, n)) s < a && 0 > l(c, u) ? (e[r] = c, e[s] = n, r = s) : (e[r] = u, e[i] = n, r = i); else { if (!(s < a && 0 > l(c, n))) break e; e[r] = c, e[s] = n, r = s } } } return t } function l(e, t) { var n = e.sortIndex - t.sortIndex; return 0 !== n ? n : e.id - t.id } if ("object" === typeof performance && "function" === typeof performance.now) { var o = performance; t.unstable_now = function () { return o.now() } } else { var i = Date, u = i.now(); t.unstable_now = function () { return i.now() - u } } var s = [], c = [], f = 1, d = null, p = 3, m = !1, h = !1, y = !1, v = "function" === typeof setTimeout ? setTimeout : null, b = "function" === typeof clearTimeout ? clearTimeout : null, g = "undefined" !== typeof setImmediate ? setImmediate : null; function _(e) { for (var t = r(c); null !== t;) { if (null === t.callback) a(c); else { if (!(t.startTime <= e)) break; a(c), t.sortIndex = t.expirationTime, n(s, t) } t = r(c) } } function S(e) { if (y = !1, _(e), !h) if (null !== r(s)) h = !0, A(w); else { var t = r(c); null !== t && N(S, t.startTime - e) } } function w(e, n) { h = !1, y && (y = !1, b(C), C = -1), m = !0; var l = p; try { for (_(n), d = r(s); null !== d && (!(d.expirationTime > n) || e && !O());) { var o = d.callback; if ("function" === typeof o) { d.callback = null, p = d.priorityLevel; var i = o(d.expirationTime <= n); n = t.unstable_now(), "function" === typeof i ? d.callback = i : d === r(s) && a(s), _(n) } else a(s); d = r(s) } if (null !== d) var u = !0; else { var f = r(c); null !== f && N(S, f.startTime - n), u = !1 } return u } finally { d = null, p = l, m = !1 } } "undefined" !== typeof navigator && void 0 !== navigator.scheduling && void 0 !== navigator.scheduling.isInputPending && navigator.scheduling.isInputPending.bind(navigator.scheduling); var k, E = !1, x = null, C = -1, T = 5, P = -1; function O() { return !(t.unstable_now() - P < T) } function z() { if (null !== x) { var e = t.unstable_now(); P = e; var n = !0; try { n = x(!0, e) } finally { n ? k() : (E = !1, x = null) } } else E = !1 } if ("function" === typeof g) k = function () { g(z) }; else if ("undefined" !== typeof MessageChannel) { var j = new MessageChannel, R = j.port2; j.port1.onmessage = z, k = function () { R.postMessage(null) } } else k = function () { v(z, 0) }; function A(e) { x = e, E || (E = !0, k()) } function N(e, n) { C = v((function () { e(t.unstable_now()) }), n) } t.unstable_IdlePriority = 5, t.unstable_ImmediatePriority = 1, t.unstable_LowPriority = 4, t.unstable_NormalPriority = 3, t.unstable_Profiling = null, t.unstable_UserBlockingPriority = 2, t.unstable_cancelCallback = function (e) { e.callback = null }, t.unstable_continueExecution = function () { h || m || (h = !0, A(w)) }, t.unstable_forceFrameRate = function (e) { 0 > e || 125 < e ? console.error("forceFrameRate takes a positive int between 0 and 125, forcing frame rates higher than 125 fps is not supported") : T = 0 < e ? Math.floor(1e3 / e) : 5 }, t.unstable_getCurrentPriorityLevel = function () { return p }, t.unstable_getFirstCallbackNode = function () { return r(s) }, t.unstable_next = function (e) { switch (p) { case 1: case 2: case 3: var t = 3; break; default: t = p }var n = p; p = t; try { return e() } finally { p = n } }, t.unstable_pauseExecution = function () { }, t.unstable_requestPaint = function () { }, t.unstable_runWithPriority = function (e, t) { switch (e) { case 1: case 2: case 3: case 4: case 5: break; default: e = 3 }var n = p; p = e; try { return t() } finally { p = n } }, t.unstable_scheduleCallback = function (e, a, l) { var o = t.unstable_now(); switch ("object" === typeof l && null !== l ? l = "number" === typeof (l = l.delay) && 0 < l ? o + l : o : l = o, e) { case 1: var i = -1; break; case 2: i = 250; break; case 5: i = 1073741823; break; case 4: i = 1e4; break; default: i = 5e3 }return e = { id: f++, callback: a, priorityLevel: e, startTime: l, expirationTime: i = l + i, sortIndex: -1 }, l > o ? (e.sortIndex = l, n(c, e), null === r(s) && e === r(c) && (y ? (b(C), C = -1) : y = !0, N(S, l - o))) : (e.sortIndex = i, n(s, e), h || m || (h = !0, A(w))), e }, t.unstable_shouldYield = O, t.unstable_wrapCallback = function (e) { var t = p; return function () { var n = p; p = t; try { return e.apply(this, arguments) } finally { p = n } } } }, 853: (e, t, n) => { e.exports = n(234) } }, __webpack_module_cache__ = {}; function __webpack_require__(e) { var t = __webpack_module_cache__[e]; if (void 0 !== t) return t.exports; var n = __webpack_module_cache__[e] = { exports: {} }; return __webpack_modules__[e](n, n.exports, __webpack_require__), n.exports } __webpack_require__.n = e => { var t = e && e.__esModule ? () => e.default : () => e; return __webpack_require__.d(t, { a: t }), t }, __webpack_require__.d = (e, t) => { for (var n in t) __webpack_require__.o(t, n) && !__webpack_require__.o(e, n) && Object.defineProperty(e, n, { enumerable: !0, get: t[n] }) }, __webpack_require__.o = (e, t) => Object.prototype.hasOwnProperty.call(e, t); var __webpack_exports__ = {}, react = __webpack_require__(43), client = __webpack_require__(391), App = __webpack_require__(111); const reference_fields = [{ name: "api_key_size", label: "API Key Size", type: "number", defaultValue: 1, unit: "KB", description: "The storage requirement to store a single API key." }, { name: "api_definition_size", label: "API Definition Size", type: "number", defaultValue: 100, unit: "KB", description: "The storage requirement to store a single API definition." }, { name: "security_policy_definition_size", label: "Security Policy Definition Size", type: "number", defaultValue: 10, unit: "KB", description: "The storage requirement to store a single Security Policy definition." }, { name: "basic_request_analytics_size", label: "Basic Request Analytics Size", type: "number", defaultValue: 2, unit: "KB", description: "The storage requirement to store a single basic analytic record." }, { name: "detailed_request_analytics_size", label: "Detailed Request Analytics Size", type: "number", defaultValue: 52, unit: "KB", description: "The storage requirement to store a single detailed analytic record." }, { name: "pump_purge_interval", label: "Pump Purge Interval", type: "number", defaultValue: 10, unit: "Seconds", description: "How often does the pump pull/remove analytics data from the redis." }], input_fields = [{ name: "rps", label: "Requests Per Seconds", type: "number", defaultValue: 200, unit: "RPS", description: "The number of requests you expect per second." }, { name: "cache_hit_rate", label: "Cache Hit Rate", type: "number", defaultValue: 10, unit: "Percent", description: "The percentage of requests that will be cached by Tyk." }, { name: "cache_ttl", label: "Cache Time to Live", type: "number", defaultValue: 60, unit: "Seconds", description: "The duration that a cache is stored for." }, { name: "number_of_api_keys", label: "Number of API Keys", type: "number", defaultValue: 1e3, unit: "Count", description: "The number of Tyk managed API keys." }, { name: "average_payload_size", label: "Average Payload Size", type: "number", defaultValue: 20, unit: "KB", description: "The average payload size of a request." }, { name: "number_of_api_definitions", label: "Number of API Definitions", type: "number", defaultValue: 100, unit: "Count", description: "The number of Tyk managed API definitions." }, { name: "number_of_policy_definitions", label: "Number of Policy Definitions", type: "number", defaultValue: 100, unit: "Count", description: "The number of security policies definitions." }, { name: "detailed_analytics_percentage", label: "Detailed Analytics Percentage", type: "number", defaultValue: 0, unit: "Percent", description: "The percentage of analytics where detailed logging is enabled." }, { name: "ram_utilization_threshold", label: "RAM Utilization Threshold", type: "number", defaultValue: 50, unit: "Percent", description: "The acceptable percentage of RAM utilization on the host of the redis instance." }], calculated_fields = [{ name: "ram_for_api_keys", label: "RAM for API Keys", type: "number", value: "values.api_key_size * values.number_of_api_keys / 1000000", unit: "GB", description: "The RAM required to store all Tyk managed API keys." }, { name: "ram_for_cache", label: "RAM for Cache", type: "number", value: "(values.rps * values.cache_hit_rate / 100) * values.average_payload_size * values.cache_ttl / 1000000", unit: "GB", description: "The RAM required to store cache." }, { name: "ram_for_basic_analytics", label: "RAM for Basic Analytics", type: "number", value: "values.rps * values.basic_request_analytics_size * values.pump_purge_interval * (100 - values.detailed_analytics_percentage) / 100 / 1000000", unit: "GB", description: "The RAM required to store basic analytics." }, { name: "ram_for_detailed_analytics", label: "RAM for Detailed Analytics", type: "number", value: "values.rps * values.detailed_request_analytics_size * values.pump_purge_interval * values.detailed_analytics_percentage / 100 / 1000000", unit: "GB", description: "The RAM required to store detailed analytics." }, { name: "sum", label: "RAM per Host", type: "number", value: "sum / (values.ram_utilization_threshold / 100)", unit: "GB", description: "The RAM required per host." }], redis = { reference_fields: reference_fields, input_fields: input_fields, calculated_fields: calculated_fields }, database_reference_fields = [{ name: "api_definition_size", label: "API Definition Size", type: "number", defaultValue: 100, unit: "KB", description: "The storage requirement to store a single API definition." }, { name: "security_policy_definition_size", label: "Security Policy Definition Size", type: "number", defaultValue: 10, unit: "KB", description: "The storage requirement to store a single Security Policy definition." }, { name: "basic_request_analytics_size", label: "Basic Request Analytics Size", type: "number", defaultValue: 2, unit: "KB", description: "The storage requirement to store a single basic analytic record." }, { name: "detailed_request_analytics_size", label: "Detailed Request Analytics Size", type: "number", defaultValue: 52, unit: "KB", description: "The storage requirement to store a single detailed analytic record." }, { name: "aggregate_analytics_size", label: "Aggregate Record Analytics Size", type: "number", defaultValue: 1, unit: "KB", description: "The storage requirement to store a single aggregate record." }, { name: "audit_record_size", label: "Audit Record Size", type: "number", defaultValue: 2, unit: "KB", description: "The storage requirement to store a single audit record." }], database_input_fields = [{ name: "analytics_ttl", label: "Analytics Time to Live", type: "number", defaultValue: 14, unit: "Days", description: "The duration that an analytics record is stored for." }, { name: "rps", label: "Requests Per Seconds", type: "number", defaultValue: 200, unit: "RPS", description: "The number of requests you expect per second." }, { name: "number_of_api_keys", label: "Number of API Keys", type: "number", defaultValue: 1e3, unit: "Count", description: "The number of Tyk managed API keys." }, { name: "number_of_api_definitions", label: "Number of API Definitions", type: "number", defaultValue: 100, unit: "Count", description: "The number of Tyk managed API definitions." }, { name: "number_of_api_versions", label: "Number of API Versions", type: "number", defaultValue: 100, unit: "Count", description: "The number of Tyk managed API versions." }, { name: "number_of_api_tags", label: "Number of API Tags", type: "number", defaultValue: 100, unit: "Count", description: "The number of Tyk managed API tags." }, { name: "number_of_policy_definitions", label: "Number of Policy Definitions", type: "number", defaultValue: 100, unit: "Count", description: "The number of security policies definitions." }, { name: "number_of_audit_records", label: "Number of Audit Records", type: "number", defaultValue: 0, unit: "Count", description: "The number of audit records." }, { name: "detailed_analytics_percentage", label: "Detailed Analytics Percentage", type: "number", defaultValue: 0, unit: "Percent", description: "The percentage of analytics where detailed logging is enabled." }, { name: "storage_utilization_threshold", label: "Storage Utilization Threshold", type: "number", defaultValue: 80, unit: "Percent", description: "The acceptable percentage of storage utilization." }], database_calculated_fields = [{ name: "storage_for_basic_analytics", label: "Storage for Basic Analytics", type: "number", value: "values.rps * values.basic_request_analytics_size * values.analytics_ttl * 60 * 60 * 24 * (100 - values.detailed_analytics_percentage) / 100 / 1000000", unit: "GB", description: "The storage required to store basic analytics." }, { name: "storage_for_detailed_analytics", label: "Storage for Detailed Analytics", type: "number", value: "values.rps * values.detailed_request_analytics_size * values.analytics_ttl * 60 * 60 * 24 * values.detailed_analytics_percentage / 100 / 1000000", unit: "GB", description: "The storage required to store basic analytics." }, { name: "storage_for_aggregate_analytics", label: "Storage for Aggregate Analytics", type: "number", value: "(values.number_of_api_definitions + values.number_of_api_keys + values.number_of_api_versions + values.number_of_api_tags) * values.aggregate_analytics_size / 1000000", unit: "GB", description: "The storage required to store basic analytics." }, { name: "storage_for_policies", label: "Storage for Security Policies", type: "number", value: "values.number_of_policy_definitions * values.security_policy_definition_size / 1000000", unit: "GB", description: "The storage required to store basic analytics." }, { name: "storage_for_audit_records", label: "Storage for Audit Records", type: "number", value: "values.number_of_audit_records * values.audit_record_size / 1000000", unit: "GB", description: "The storage required to store audit records." }, { name: "sum_storage", label: "Storage requirement", type: "number", value: "sum / (values.storage_utilization_threshold / 100)", unit: "GB", description: "The storage required." }], database = { reference_fields: database_reference_fields, input_fields: database_input_fields, calculated_fields: database_calculated_fields }; var jsx_runtime = __webpack_require__(579); const REDIS = "redis", DATABASE = "database", calculator = document.getElementById("calculator"); client.createRoot(calculator).render((0, jsx_runtime.jsxs)(react.StrictMode, { children: [calculator.className.includes(REDIS) ? (0, jsx_runtime.jsx)(App.A, { fields: redis }) : null, calculator.className.includes(DATABASE) ? (0, jsx_runtime.jsx)(App.A, { fields: database }) : null] })) })();
+//# sourceMappingURL=main.b7b66d3b.js.map
diff --git a/configure/external-service.mdx b/configure/external-service.mdx
new file mode 100644
index 0000000000..0c05df5782
--- /dev/null
+++ b/configure/external-service.mdx
@@ -0,0 +1,654 @@
+---
+title: "External Services Configuration"
+description: "Complete guide to configuring external services in Tyk Gateway including proxy settings, mutual TLS, and service-specific configurations"
+keywords: "Configuration, External Services, Proxy, mTLS, OAuth, Security"
+sidebarTitle: "External Service Config"
+---
+
+## Availability
+
+| Component   | Version              | Editions                |
+| :------------- | :---------------------- | :------------------------- |
+| Tyk Gateway | Available since v5.10 | Community and Enterprise |
+
+## Introduction
+
+```mermaid
+graph LR
+    TykGateway["Tyk Gateway"]
+    
+    subgraph ExternalServices["External Services"]
+        OAuth["OAuth Providers"]
+        Analytics["Analytics Systems"]
+        Webhooks["Webhook Endpoints"]
+        Discovery["Service Discovery"]
+        Health["Health Check Services"]
+    end
+
+    TykGateway --> OAuth
+    TykGateway --> Analytics
+    TykGateway --> Webhooks
+    TykGateway --> Discovery
+    TykGateway --> Health
+
+    ExternalConfig["External Service Configuration"] --> |"Controls the outbound connections to the external services"| TykGateway
+```
+
+External Service Configuration gives you control over how Tyk Gateway securely connects to the [external services](/configure/external-service#external-service) that it needs to function correctly. You can configure proxy settings, mTLS authentication, and other connection parameters for Tyk's outbound connections to services such as OAuth providers, analytics systems, and webhook endpoints.
+
+### Key Benefits
+
+- Enables Tyk to operate in environments with strict network policies requiring proxy usage
+- Enhances security through mTLS client certificate authentication for external service connections
+- Provides granular control over connection parameters for different service types
+- Ensures compliance with security requirements for outbound connections
+ 
+## Configuration Options
+
+External Service Configuration allows you to control how Tyk Gateway connects to external services such as OAuth 2.0 Authorization Servers, storage systems, and webhook targets. This section explains the configuration structure and available options.
+
+The configuration is organized into two levels:
+
+1. **Global settings** - Applied to all service types unless overridden
+2. **Service-specific settings** - Override global settings for particular service types
+
+All settings are defined in the `external_services` section of the Gateway `tyk.conf` file (or the equivalent [environment variables](/tyk-oss-gateway/configuration#external_services).
+
+
+### Global Configuration
+
+Global Settings are used to configure Tyk to make external service connections through a proxy server. Separate servers can be configured for HTTP and HTTPS connections. If required, connections to specific hosts can bypass the common proxies. The Global Settings will be applied to all external service connections unless overridden by [service-specific settings](/configure/external-service#service-specific-configuration).
+
+| Option | Type | Required | Description |
+| :-------- | :------ | :---------- | :------------- |
+| `enabled` | Boolean | Required if using a proxy | Applies Global Settings for all external services. If no URL is provided for any of the Global Settings, the value configured in the legacy environment variable (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) will be applied. Set to `false` to disable proxy usage for all services (unless overridden by service-specific settings). |
+| `http_proxy` | String | No | HTTP proxy URL for HTTP requests (e.g., "http://localhost:3128"). This will be used if `enabled` is set to `true`. If not set, then Tyk will apply the URL from the standard `HTTP_PROXY` environment variable. |
+| `https_proxy` | String | No | HTTPS proxy URL for HTTPS requests (e.g., "https://localhost:3128").  This will be used if `enabled` is set to `true`. If not set, then Tyk will apply the URL from the standard `HTTPS_PROXY` environment variable. |
+| `bypass_proxy` | String | No | Comma-separated list of hosts to bypass proxy (e.g., `"localhost,127.0.0.1,.internal"`). Hosts in this list will be accessed directly, bypassing the proxy if `enabled` is set to `true`. If not set, then Tyk will use the list of hosts from the standard `NO_PROXY` environment variable|
+
+#### Example Configuration
+
+<Tabs>
+<Tab title="Config File">
+```json
+{
+// Partial config from tyk.conf
+    "external_services": {
+      "global": {
+        "enabled": true,
+        "http_proxy": "http://proxy.example.com:8080",
+        "https_proxy": "https://proxy.example.com:8080",
+        "bypass_proxy": "localhost,127.0.0.1,.internal,*.local"
+      }
+    }
+// ... more config follows
+}
+```
+</Tab>
+<Tab title="Environment Variable">
+
+All configuration options support environment variable overrides with the prefix `TYK_GW_EXTERNAL_SERVICES_`:
+
+```bash
+export TYK_GW_EXTERNAL_SERVICES_GLOBAL_ENABLED="true"
+export TYK_GW_EXTERNAL_SERVICES_GLOBAL_HTTP_PROXY="http://proxy.example.com:8080"
+export TYK_GW_EXTERNAL_SERVICES_GLOBAL_HTTPS_PROXY="https://proxy.example.com:8080"
+export TYK_GW_EXTERNAL_SERVICES_GLOBAL_BYPASS_PROXY="localhost,127.0.0.1,.internal,*.local"
+```
+</Tab>
+</Tabs>
+
+Refer to the [Tyk Gateway Configuration Reference](/tyk-oss-gateway/configuration#external_services) for more details on this setting.
+
+### Service-Specific Configuration
+
+In addition to the Global Settings, which are applied to all services, you can optionally set alternative proxies and mutual TLS (mTLS) configurations for specific services. The specific settings will override the global settings for and service for which both are configured.
+
+Service-specific settings can be configured for the following services:
+
+| Service Type | Description | Example Services |
+| :-------------- | :------------- | :------------ |
+| `oauth` | [OAuth/JWT token validation and introspection](/basic-config-and-security/security/authentication-authorization/json-web-tokens) | JWT auth interactions with Auth Server (Identity Provider) |
+| `storage` | mTLS configuration for the rate limiter's Redis connection. Proxy settings are not supported for this service type. | Rate limiter Redis TLS |
+| `webhooks` | [Webhook event notifications](/api-management/gateway-events#event-handling-with-webhooks) | Event handlers, notification delivery |
+| `health` | [Health check requests](/planning-for-production/ensure-high-availability/health-check) | Host checker, uptime monitoring |  
+| `discovery` | [Service discovery requests](/planning-for-production/ensure-high-availability/service-discovery) | Load balancer, service registry |
+
+For each type of service, you can configure:
+
+- specific proxies for HTTP, HTTPS and lists of hosts that should not be proxied (not applicable for `storage`)
+- mTLS certificates, versions and insecure mode
+
+#### Proxy Configuration
+
+Service-specific proxy settings override global proxy settings.
+
+| Option | Type | Required | Description |
+| :-------- | :------ | :---------- | :------------- |
+| `enabled` | Boolean | Yes | Activates specific proxy settings for this service |
+| `http_proxy` | String | No | HTTP proxy URL for this service |
+| `https_proxy` | String | No | HTTPS proxy URL for this service |
+| `bypass_proxy` | String | No | Comma-separated list of hosts to bypass proxy for this service |
+
+#### Mutual TLS (mTLS) Configuration
+
+mTLS settings enable client certificate authentication for secure connections.
+
+| Option | Type | Required | Description |
+| :-------- | :------ | :---------- | :------------- |
+| `enabled` | Boolean | Yes | Activates mTLS for this service |
+| `cert_id` | String | No | Certificate ID from [Tyk Certificate Store](/api-management/certificates#tyk-certificate-store) |
+| `ca_cert_ids` | Array | No | Array of CA certificate IDs from [Tyk Certificate Store](/api-management/certificates#tyk-certificate-store) |
+| `cert_file` | String | No | Path to client certificate file |
+| `key_file` | String | No | Path to client private key file |
+| `ca_file` | String | No | Path to CA certificate file for server verification |
+| `insecure_skip_verify` | Boolean | No | Insecure mode, skip server certificate verification; this should only be used in non-production environments (default: false) |
+| `tls_min_version` | String | No | Minimum TLS version (e.g., "1.2", default: "1.2") |
+| `tls_max_version` | String | No | Maximum TLS version (e.g., "1.3", default: "1.3") |
+
+- **Client authentication:** for Tyk to sign the outbound messages you must indicate which certificate should be used via `cert_id` or `cert_file`/`key_file`.
+- **Server verification:** for Tyk to verify the certificate provided by the external service, you must provide the CA certificates via `ca_cert_ids` or `ca_file`. If you do not need to validate the server's certificate (for example in a trusted test environment) you can set `insecure_skip_verify: true` (not recommended for production).
+
+- **For complete mTLS security:** both client and CA certificates should be configured.
+- **CA-only configuration:** you can enable mTLS with only CA certificates (no client certificates) if you only need server certificate verification without client authentication.
+
+    <Note>
+    Tyk Certificate Store configuration takes precedence over file-based configuration if both are provided.
+    </Note>
+
+
+From Tyk 5.13.0, the certificate paths (`cert_file`, `key_file`, `ca_file`) for service type `oauth`, used for integration with external Identity Providers (IdPs) for [client](/api-management/authentication/jwt-signature-validation#configuring-idps-in-the-api-definition) and [upstream](/api-management/upstream-authentication/oauth#upstream-oauth-2-0) authentication, can be set using [external references](/tyk-configuration-reference/kv-store#from-the-tyk-gateway-configuration-file). These references are resolved when the Gateway starts up and on each hot reload. This allows certificate rotation without a Gateway restart; however, updated certificates are applied only after a hot reload.
+
+The certificate paths for other integrations do not support external references at this time.
+
+<Note>
+If [multiple Identity Providers](/api-management/authentication/jwt-signature-validation#configuring-idps-in-the-api-definition) are configured, they share the same External Service Configuration.
+</Note>
+
+#### Example Configuration
+
+<Tabs>
+<Tab title="Config File">
+```json
+{
+// Partial config from tyk.conf
+    "external_services": {
+      "oauth": {
+        "proxy": {
+          "enabled": true,
+          "http_proxy": "http://oauth-proxy.example.com:8080",
+          "https_proxy": "https://oauth-proxy.example.com:8080",
+          "bypass_proxy": "localhost,127.0.0.1,auth.internal"
+        },
+        "mtls": {
+          "enabled": true,
+          "cert_file": "/etc/tyk/certs/oauth-client.crt",
+          "key_file": "/etc/tyk/certs/oauth-client.key",
+          "ca_file": "/etc/tyk/certs/oauth-ca.crt",
+          "insecure_skip_verify": false,
+          "tls_min_version": "1.2"
+        }
+      }
+    }
+// ... more config follows
+}
+```
+</Tab>
+<Tab title="Environment Variable">
+
+All configuration options support environment variable overrides with the prefix `TYK_GW_EXTERNAL_SERVICES_`:
+
+```bash
+# OAuth proxy settings
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_PROXY_ENABLED="true"
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_PROXY_HTTP_PROXY="http://oauth-proxy.example.com:8080"
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_PROXY_HTTPS_PROXY="https://oauth-proxy.example.com:8080"
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_PROXY_BYPASS_PROXY="localhost,127.0.0.1,auth.internal"
+
+# OAuth mTLS settings
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_MTLS_ENABLED="true"
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_MTLS_CERT_FILE="/etc/tyk/certs/oauth-client.crt"
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_MTLS_KEY_FILE="/etc/tyk/certs/oauth-client.key"
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_MTLS_CA_FILE="/etc/tyk/certs/oauth-ca.crt"
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_MTLS_INSECURE_SKIP_VERIFY="false"
+export TYK_GW_EXTERNAL_SERVICES_OAUTH_MTLS_TLS_MIN_VERSION="1.2"
+```
+</Tab>
+</Tabs>
+
+Refer to the [Tyk Gateway Configuration Reference](/tyk-oss-gateway/configuration#external_services) for more details.
+
+### Hierarchy and Precedence
+
+Settings are applied in the following priority order (highest to lowest):
+
+1. **Service-specific configuration** - Overrides all other settings
+2. **Global external_services configuration** - Applies to all services  
+3. **Standard proxy environment variables** - When proxy is enabled but no specific URLs are configured, Tyk falls back to using standard `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables. These are system-wide variables commonly used by HTTP clients to route traffic through proxy servers and are not specific to Tyk's configuration system.
+4. **Default settings** - If a setting is not specified, Tyk uses sensible defaults. You can find these in the [Tyk Gateway Configuration Reference](/tyk-oss-gateway/configuration#external_services).
+
+## Example Configurations
+
+### 1. Basic Proxy Setup (Local Testing)
+```json
+{
+  "external_services": {
+    "global": {
+      "enabled": true,
+      "http_proxy": "http://localhost:3128",
+      "https_proxy": "https://localhost:3128",
+      "bypass_proxy": "localhost,127.0.0.1,.internal"
+    }
+  }
+}
+```
+
+**What this does:**
+- Routes all external service connections through a local proxy server (port 3128)
+- Bypasses the proxy for localhost, 127.0.0.1, and any domain ending with .internal
+- Applies these settings globally to all service types (OAuth, webhooks, storage, etc.)
+
+### 2. OAuth with Dedicated Proxy and mTLS
+
+#### Using certificates in the file system
+```json
+{
+  "external_services": {
+    "global": {
+      "enabled": true,
+      "http_proxy": "http://localhost:3128",
+      "https_proxy": "https://localhost:3128",
+      "bypass_proxy": "localhost,127.0.0.1"
+    },
+    "oauth": {
+      "proxy": {
+        "enabled": true,
+        "http_proxy": "http://localhost:3129",
+        "https_proxy": "https://localhost:3129"
+      },
+      "mtls": {
+        "enabled": true,
+        "cert_file": "/etc/tyk/certs/oauth-client.crt",
+        "key_file": "/etc/tyk/certs/oauth-client.key",
+        "ca_file": "/etc/tyk/certs/oauth-ca.crt",
+        "tls_min_version": "1.2"
+      }
+    }
+  }
+}
+```
+
+**What this does:**
+- Sets a global proxy for most services (port 3128)
+- Configures OAuth services to use a different dedicated proxy (port 3129)
+- Enables mutual TLS for OAuth connections using file-based certificates
+- Enforces minimum TLS version 1.2 for OAuth connections
+
+#### Using Tyk Certificate Store
+```json
+{
+  "external_services": {
+    "global": {
+      "enabled": true,
+      "http_proxy": "http://localhost:3128",
+      "https_proxy": "https://localhost:3128",
+      "bypass_proxy": "localhost,127.0.0.1"
+    },
+    "oauth": {
+      "proxy": {
+        "enabled": true,
+        "http_proxy": "http://localhost:3129",
+        "https_proxy": "https://localhost:3129"
+      },
+      "mtls": {
+        "enabled": true,
+        "cert_id": "oauth-client-cert",
+        "ca_cert_ids": ["oauth-ca-cert"],
+        "tls_min_version": "1.2"
+      }
+    }
+  }
+}
+```
+
+**What this does:**
+- Similar to previous example, but uses [Tyk Certificate Store](/api-management/certificates#tyk-certificate-store) instead of file paths
+- References certificates by their IDs in the certificate store
+- Allows for centralized certificate management through the Tyk Dashboard
+
+### 3. Mixed Environment and Service-Specific Configuration
+```json
+{
+  "external_services": {
+    "global": {
+      "enabled": true,
+      "http_proxy": "http://localhost:3128",
+      "https_proxy": "https://localhost:3128",
+      "bypass_proxy": "localhost,127.0.0.1,redis"
+    },
+    "storage": {
+      "mtls": {
+        "enabled": true,
+        "cert_file": "/etc/tyk/certs/redis-client.crt",
+        "key_file": "/etc/tyk/certs/redis-client.key"
+      }
+    },
+    "webhooks": {
+      "proxy": {
+        "enabled": true,
+        "http_proxy": "http://localhost:3130",
+        "https_proxy": "https://localhost:3130"
+      }
+    }
+  }
+}
+```
+
+**What this does:**
+
+- **Global configuration**: Sets a baseline proxy (port 3128) for all external services with a general bypass list.
+- **Storage service customization**: Adds mTLS security for the rate limiter's Redis connection, ensuring encrypted and authenticated communication. Note that proxy settings are not supported for the `storage` service type.
+- **Webhook customization**:
+  - Routes webhook traffic through a separate dedicated proxy (port 3130)
+
+### 4. Production Enterprise Configuration
+```json
+{
+  "external_services": {
+    "global": {
+      "enabled": true,
+      "http_proxy": "http://proxy.company.com:8080",
+      "https_proxy": "https://proxy.company.com:8080",
+      "bypass_proxy": "localhost,127.0.0.1,.company.internal"
+    },
+    "oauth": {
+      "mtls": {
+        "enabled": true,
+        "cert_file": "/etc/tyk/certs/oauth-client.crt",
+        "key_file": "/etc/tyk/certs/oauth-client.key",
+        "ca_file": "/etc/tyk/certs/company-ca.crt",
+        "insecure_skip_verify": false,
+        "tls_min_version": "1.2"
+      }
+    },
+    "webhooks": {
+      "proxy": {
+        "enabled": true
+      },
+      "mtls": {
+        "enabled": true,
+        "cert_file": "/etc/tyk/certs/webhook-client.crt",
+        "key_file": "/etc/tyk/certs/webhook-client.key"
+      }
+    }
+  }
+}
+```
+
+**What this does:**
+- **Corporate proxy integration**: 
+  - Routes all external traffic through the company's central proxy server
+  - Bypasses the proxy for internal company domains (.company.internal) for direct access to internal services
+- **OAuth security hardening**:
+  - Implements mTLS for all OAuth provider connections (JWT validation, token introspection)
+  - Includes a CA certificate for validating the OAuth provider's server certificate
+  - Explicitly disables insecure certificate verification (`insecure_skip_verify: false`)
+  - Enforces TLS 1.2 minimum to prevent downgrade attacks
+- **Webhook security**:
+  - Uses the global proxy settings (inherits from global configuration)
+  - Adds a separate client certificate specifically for webhook connections
+
+### 5. Production Certificate Store Configuration
+```json
+{
+  "external_services": {
+    "global": {
+      "enabled": true,
+      "http_proxy": "http://proxy.company.com:8080",
+      "https_proxy": "https://proxy.company.com:8080",
+      "bypass_proxy": "localhost,127.0.0.1,.company.internal"
+    },
+    "oauth": {
+      "mtls": {
+        "enabled": true,
+        "cert_id": "oauth-client-prod",
+        "ca_cert_ids": ["oauth-ca-prod", "intermediate-ca"],
+        "tls_min_version": "1.2"
+      }
+    },
+    "storage": {
+      "mtls": {
+        "enabled": true,
+        "cert_id": "redis-client-prod",
+        "ca_cert_ids": ["redis-ca-prod"]
+      }
+    },
+    "webhooks": {
+      "mtls": {
+        "enabled": true,
+        "cert_id": "webhook-client-prod",
+        "ca_cert_ids": ["webhook-ca-prod"]
+      }
+    }
+  }
+}
+```
+
+**What this does:**
+- Similar to example 4, but uses [Tyk Certificate Store](/api-management/certificates#tyk-certificate-store) for all mTLS configurations
+- **Certificate store integration**:
+  - All certificates are referenced using their IDs in the certificate store
+  - This enables centralized certificate management through the Tyk Dashboard
+  - Certificates can be rotated, renewed, or replaced without changing configuration files
+- **Comprehensive mTLS deployment**:
+  - Every applicable service type (OAuth, storage, webhooks) has its own dedicated client certificate.
+  - For `storage`, this applies mTLS to the rate limiter's Redis connection specifically.
+  - This provides service-specific identity and enables granular access control.
+  - Each service also has its own CA certificate configuration for validating server certificates.
+- **Certificate chain support**:
+  - The OAuth configuration includes multiple CA certificates (`["oauth-ca-prod", "intermediate-ca"]`)
+  - This supports complex PKI setups with intermediate certificate authorities
+  - Ensures proper validation of certificate chains in enterprise environments
+
+## Performance Optimization
+
+### Connection Pooling
+
+Tyk implements connection pooling for each service type with built-in default values:
+
+| Service Type | Max Connections | Per Host | Idle Timeout |
+| :-------------- | :----------------- | :---------- | :-------------- |
+| OAuth | 50 | 10 | 30s |
+| Health | 20 | 5 | 15s |
+| Discovery | 30 | 5 | 20s |
+| Webhooks | 50 | 10 | 30s |
+
+> **Note:** These connection pooling settings are built into Tyk and are not configurable through the configuration file. They are optimized defaults based on the typical usage patterns of each service type. "Per Host" refers to the maximum number of idle connections maintained per upstream host. The `storage` service type uses a direct Redis TCP connection managed by go-redis and does not use HTTP connection pooling.
+
+### Service-Specific Timeouts
+
+Tyk applies different default timeout values for each service type:
+
+| Service Type | Client Timeout |
+| :-------------- | :---------------- |
+| OAuth | 15 seconds |
+| Health | 10 seconds |
+| Discovery | 10 seconds |
+| Webhooks | 30 seconds |
+
+> **Note:** These timeout values are built into Tyk and are not configurable through the configuration file. They represent the maximum time Tyk will wait for a response from the external service before timing out the request. These values are optimized based on the expected response times and criticality of each service type. The `storage` service type connects to Redis directly via TCP; its timeout is controlled by the `timeout` field in the `storage` block of `tyk.conf`, not by this table.
+
+## Migration from Legacy Configuration
+
+Before the introduction of the External Service Configuration feature, Tyk Gateway used various scattered configuration settings to control connections to external services. These settings were spread across different sections of the `tyk.conf` file, making it difficult to maintain a consistent approach to external connectivity. This section guides you through migrating from these legacy configurations to the new consolidated External Service Configuration.
+
+### Backward Compatibility
+
+The External Services Configuration provides a new way to configure external service connections while maintaining compatibility with legacy settings. Here's how it works:
+
+1. **Legacy settings continue to function**: Existing configurations using the legacy settings will continue to work without modification.
+
+2. **Precedence rules**: When both legacy and new settings are configured with different values:
+   - The new `external_services` settings take precedence over legacy settings
+   - Legacy settings are only used if the corresponding new settings are not specified
+
+3. **Migration path**: You can migrate gradually by moving settings to the new structure as needed:
+
+| Legacy Setting | New Location | Behavior When Both Are Set |
+| :---------------- | :-------------- | :---------------------------- |
+| `http_proxy` | `external_services.global.http_proxy` | `external_services` setting takes precedence |
+| `https_proxy` | `external_services.global.https_proxy` | `external_services` setting takes precedence |
+| `jwt_ssl_insecure_skip_verify` | `external_services.oauth.mtls.insecure_skip_verify` | `external_services` setting takes precedence |
+
+4. **Recommended approach**:
+   - For new deployments: Use only the new `external_services` structure
+   - For existing deployments: You can continue using legacy settings or gradually migrate to the new structure
+   - For production environments: We recommend migrating to the new structure as it provides more flexibility and service-specific configuration options
+
+### Migration Strategy
+
+**Phase 1: Assessment**
+1. Backup current configuration
+2. Identify existing proxy settings
+3. Document current external service dependencies
+
+**Phase 2: Gradual Migration**
+1. Add `external_services` section alongside existing settings
+2. Test in staging environment
+3. Validate all external service functionality
+
+**Phase 3: Optimization**
+1. Add service-specific configurations
+2. Implement mTLS where appropriate
+3. Optimize proxy settings per service
+
+**Phase 4: Cleanup (Optional)**
+1. Remove legacy settings
+2. Validate production deployment
+3. Update documentation
+
+### Migration Example
+
+**Before:**
+```json
+{
+  "http_proxy": "http://localhost:3128",
+  "jwt_ssl_insecure_skip_verify": true
+}
+```
+
+**After:**
+```json
+{
+  "external_services": {
+    "global": {
+      "enabled": true,
+      "http_proxy": "http://localhost:3128",
+    },
+    "oauth": {
+      "mtls": {
+        "enabled": true,
+        "insecure_skip_verify": true
+      }
+    }
+  }
+}
+```
+
+## Glossary
+
+### External Service
+
+In the context of Tyk Gateway, an **External Service** refers to any third-party system or service that Tyk Gateway itself needs to connect to as part of its operation. These are outbound connections initiated by Tyk Gateway to fulfill its functionality, as opposed to the inbound API requests that Tyk Gateway receives and processes.
+
+**Example OAuth Providers**: 
+
+External Identity Providers or OAuth 2.0 Authorization Servers that Tyk connects to for validating tokens, retrieving JWKS (JSON Web Key Sets), or performing token introspection
+   - Example: Connecting to Auth0 to validate JWT tokens
+   - Example: Retrieving JWK sets from Okta
+
+
+
+    <Note>
+    **Important Note**
+
+    **External Services** are not the same as the **upstream services** to which your APIs proxy. With Tyk, API definitions determine how client requests are proxied to upstream services; the External Service Configuration determines how Tyk itself connects to supporting infrastructure.
+
+    - When a client requests an API hosted on Tyk, the request is proxied to an upstream service based on the API definition
+    - When Tyk needs to validate a JWT token, it might connect to an external OAuth provider using the External Service Configuration
+    </Note>
+
+
+## FAQ
+
+<AccordionGroup>
+<Accordion title='Can I use different proxies for different service types?'>
+Yes, you can configure service-specific proxy settings that override the global settings.
+</Accordion>
+
+<Accordion title='Does External Service Configuration affect incoming API requests?'>
+No, it only affects outbound connections that Tyk itself initiates.
+</Accordion>
+
+<Accordion title='What happens if the proxy server becomes unavailable?'>
+If the configured proxy server becomes unavailable, Tyk's behavior depends on the specific scenario:
+
+**For new connections:**
+- Requests to external services will fail with connection timeout or connection refused errors
+- Tyk will log errors such as `dial tcp: i/o timeout` or `connection refused` in the logs
+- These failures can impact various Gateway functions depending on which services are affected:
+  - OAuth/JWT validation failures could prevent API access
+  - Webhook delivery failures might cause event notifications to be lost
+  - Health check failures could affect load balancing decisions
+
+**For existing connections:**
+- Established connections in the connection pool may continue to work briefly
+- Once the connection pool needs to establish new connections, requests will begin to fail
+
+**Recovery behavior:**
+- Tyk does not automatically retry failed proxy connections
+- The Gateway will continue to attempt to use the configured proxy for new requests
+- When the proxy becomes available again, new connections will succeed without requiring a Gateway restart
+</Accordion>
+
+<Accordion title='How do I troubleshoot connection issues?'>
+Enable debug logging in Tyk and check for proxy-related log messages. Look for the following patterns in your logs:
+
+**Proxy Configuration Issues:**
+```
+[ExternalServices] Failed to configure proxy: invalid HTTP proxy URL: parse "http://badproxy:wrong_port": invalid port "wrong_port" after host
+[ExternalServices] Failed to create JWK HTTP client
+```
+
+**Certificate/TLS Issues:**
+```
+[ExternalServices] Failed to configure TLS: invalid mTLS configuration: both cert_file and key_file must be specified for file-based configuration
+[ExternalServices] Failed to load client certificate: open /etc/tyk/certs/oauth-client.crt: no such file or directory
+[ExternalServices] Certificate not found in store: oauth-client-cert
+```
+
+**Connection Failures:**
+```
+error happened during the introspection call: dial tcp: lookup oauth.example.com: no such host
+status does not indicate success: code: 407, body: Proxy Authentication Required
+```
+
+To enable debug logging, set `"log_level": "debug"` in your `tyk.conf` file or use the environment variable `TYK_GW_LOGLEVEL=debug`.
+</Accordion>
+
+<Accordion title="What's the difference between External Service Configuration and API Definition configuration?">
+The difference between **External Service Configuration** and Normal **API Definition** is about **who initiates the connection**:
+
+1. **External Service Configuration:** Controls connections that Tyk initiates to external services as part of its internal operations, such as:
+   - Retrieving a JWKS from an external OAuth server (Identity Provider)
+   - Sending analytics data to storage
+
+2. **API Definition:** Controls how Tyk handles connections initiated by clients to your services (both the client-Gateway and Gateway-upstream connections)
+
+Think of External Service Configuration as configuring Tyk's own HTTP client behavior, while API definitions configure Tyk's HTTP server behavior. They operate at different layers of the system.
+
+External Service Configuration gives you control over how Tyk makes its own outbound connections, allowing it to work properly in environments with strict network policies or security requirements.
+</Accordion>
+</AccordionGroup> 
+
+
diff --git a/configure/outbound-email-configuration.mdx b/configure/outbound-email-configuration.mdx
new file mode 100644
index 0000000000..f5cd6c1d6b
--- /dev/null
+++ b/configure/outbound-email-configuration.mdx
@@ -0,0 +1,155 @@
+---
+title: "Outbound Email Configuration"
+order: 6
+robots: "noindex, nofollow"
+sidebarTitle: "Outbound Email Configuration"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+### Custom Email Templates
+
+The email templates for the Portal and system messages are located in the `portal/email_templates` directory. 
+The Tyk Dashboard will need to be restarted for changes to take effect.
+
+### Supported email drivers
+
+* SMTP
+* Mandrill
+* Sendgrid
+* Mailgun
+* AmazonSES
+
+To get email set up for your installation, add the following to your `tyk_analytics.conf` file:
+
+```{.copyWrapper}
+"email_backend": {
+  "enable_email_notifications": true,
+  "code": "{PROVIDER-NAME}",
+  "settings": {
+    // Client provider specific settings go here. You can find the specific field described below 
+  },
+  "default_from_email": "jeff@wheresmyrug.com",
+  "default_from_name": "Jeffrey (The Dude) Lebowski"
+}
+```
+
+#### SMTP
+
+> Available from Tyk Dashboard version 1.7
+
+```{.json}
+"code": "smtp",
+"settings": {
+  "SMTPUsername": "email@example.com",
+  "SMTPPassword": "examplepassword",
+  "SMTPAddress": "smtp.example.com:587",
+  "TLSInsecureSkipVerify": "false"
+},
+```
+
+#### SMTP NoAuth
+
+> Available from Tyk Dashboard version 1.8
+
+If `SMTPUsername` or `SMTPPassword` is omitted, Tyk assumes that authentication is not required for your SMTP server. When starting up and initialising the email driver, the Dashboard should output a log message as follows:
+
+```
+[May  6 13:46:41]  INFO email: initializing SMTP email driver
+[May  6 13:46:41]  INFO email: SMTPUsername and/or SMTPPassword not set - smtp driver configured for no-auth
+[May  6 13:46:41]  INFO email: SMTP email driver initialized
+```
+
+#### Mandrill
+
+```{.json}
+"code": "mandrill",
+"settings": {
+  "ClientKey": "xxxxxxxxx"
+},
+```
+
+#### Sendgrid
+
+```{.json}
+"code": "sendgrid",
+"settings": {
+  "ClientKey": "xxxxxxxxx"
+},
+```
+
+#### Mailgun
+
+```{.json}
+"code": "mailgun",
+"settings": {
+  "Domain": "KEY",
+  "PrivateKey": "KEY",
+  "PublicKey": "KEY"
+},
+```
+
+#### Amazon SES
+
+```{.json}
+"code": "amazonses",
+"settings": {
+  "Endpoint": "Endpoint",
+  "AccessKeyId": "Access-key",
+  "SecretAccessKey": "KEY"
+},
+```
+### Customize your Welcome Emails
+
+You can customize the welcome email that a developer recieves when they signup to your portal. You can use images and other HTML formatted content. The following video walks you through the process.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/XNyKRAlTDVs" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+
+1. Select **Settings** from your **Dashboard** > **Portal Management**
+2. You can change the from email address and the from email name for your welcome emails.
+3. To use customized email content, select **Enable custom welcome email**.
+4. You can then add the following custom content:
+  * Email Subject
+  * Email Body content
+  * Welcome email body copy
+  * Welcome email sign-off
+
+<img src="/img/2.10/welcome_email_config.png" alt="Welcome-Email" />
+
+5. Enter your plain text or HTML formatted content. If including an image, the `LINK TO IMAGE` in an image `<img src="[LINK TO IMAGE]"/>` link must be a publicly hosted resource.
+6. Click **Save** at the top of the Portal Settings screen.
+
+
+### Customize your Key Approval Emails
+
+#### Editing the Email Body
+
+1. Select **Settings** from your **Dashboard** > **Portal Management**
+2. From the "API Key approval email" section, select "Enable custom approval email", and edit the API Key email body.
+
+<img src="/img/2.10/key_approval_email_config.png" alt="Email-Customization" />
+
+#### Add an image or logo to the Key Approval Email
+
+1. Select "Enable custom approval email" as above.
+2. In the "API Key email body copy" field, enter `<img src="[LINK TO IMAGE]"/>`
+
+<img src="/img/2.10/key_approval_image_link.png" alt="Email-Image" />
+
+
+<Note>
+The `LINK TO IMAGE` must be a publicly hosted resource.
+</Note>
+
+
+In an Self-Managed installation you have full access to the HTML template, allowing you further customization.
+
+#### Portal Manager Email Settings
+
+<img src="/img/2.10/portal_manager_email_config.png" alt="Portal-Manager-Email" />
+
+1. Select **Settings** from your **Dashboard** > **Portal Management**
+2. From the **Portal manager email address** section, enter the email address of the person responsible for approving your developer API subscription requests. See [Portal Key Requests](/tyk-developer-portal/tyk-portal-classic/portal-concepts#key-requests) for more details.
diff --git a/dashboard-admin-api.mdx b/dashboard-admin-api.mdx
new file mode 100644
index 0000000000..e84678da21
--- /dev/null
+++ b/dashboard-admin-api.mdx
@@ -0,0 +1,82 @@
+---
+title: "Tyk Dashboard Admin API"
+description: "Tyk Dashboard Admin API documentation. This page provides details on how to use the Tyk Dashboard Admin API for setting up and provisioning a Tyk Dashboard instance."
+order: 4
+sidebarTitle: "Overview"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+<img src="https://tyk.io/docs/img/dashboard_admin_swagger_image.png" width="963" height="250" alt="Tyk Dashboard Admin APIs"/>
+
+<ButtonLeft href="https://raw.githubusercontent.com/TykTechnologies/tyk-docs/refs/heads/production/swagger/nightly/dashboard-admin-swagger.yml" color="green" content="Download Swagger" />
+
+For Tyk On-Premises installations only, the Dashboard Admin API is used to set up and provision a Tyk Dashboard instance without the command line. It provides the following administrator-level functions:
+
+ - Managing [organizations](#organizations)
+ - Creating initial [users](https://tyk.io/docs/api-reference/users/create-a-user) during boot-strapping of the system
+ - Forcing a [URL reload](https://tyk.io/docs/api-reference/dashboard-url-reload/reloads-dashboard-urls)
+ - [Exporting](https://tyk.io/docs/api-reference/organisations/retrieve-a-single-organisation) and [importing](https://tyk.io/docs/api-reference/import/import-organisations) Tyk assets (organizations, APIs and policies) for backup, or when migrating between environments; imported assets retain their base IDs so that they continue to work together
+ - Setting up [SSO integration](https://tyk.io/docs/api-reference/single-sign-on/generate-authentication-token)
+
+## Authentication
+
+In order to use the Dashboard Admin API, you'll need to get the `admin_secret` value from your Tyk Dashboard configurations.
+
+The secret you set should then be sent along as a header with each Dashboard Admin API Request in order for it to be successful:
+
+```
+admin-auth: <your-secret>
+```
+
+
+<Warning>
+In a production environment, you must change the default `admin_secret` in the `tyk_analytics.conf` file. Admin APIs use this value for authentication, and you should set it in the `admin-auth` header while sending the request.
+</Warning>
+
+
+
+<Note>
+**Important Note on Spelling:**
+
+While our documentation now uses American English [(en-us)](https://www.andiamo.co.uk/resources/iso-language-codes/), the product itself, including all user interfaces, configuration 
+fields, environment variables, and APIs, continues to use British English spellings. When interacting with the product, 
+please continue using the British English (en-gb) spellings as appear in the interface and API.  This change does not affect 
+how you use the product; all functionality remains the same. 
+
+<br />
+
+**Example:** The API endpoint `/organisations` uses British spelling (with an 's' not 'z'). In all other instances, such as when describing or referring to this object in the documentation, we will use the American spelling "organization" with a 'z'.
+</Note>
+
+
+## Organizations
+
+Many businesses have a complex structure, for example a lot of distinct departments where each department has its own teams. You might also need to deploy and manage multiple environments such as Production, Staging and QA for different stages in your product workflow. The Tyk Dashboard is multi-tenant capable which allows you to use a single Tyk Dashboard to host separate *organizations* for each team or environment.
+
+An Organization is a completely isolated unit, and has its own:
+ - API Definitions
+ - API Keys
+ - Users
+ - Developers
+ - Domain
+ - Tyk Classic Portal 
+
+When bootstrapping your Dashboard, the first thing the bootstrap script does is to create a new default Organization.
+
+Additional organizations can be created and managed using the [Dashboard Admin API](https://tyk.io/docs/api-reference/organisations/list-all-organisations).
+
+### Tyk Gateway and organizations
+The concept of an organization does not exist within the Tyk Gateway. Gateways only proxy and validate the rules imposed on them by the definitions and keys that are being processed, however at their core there are some security checks within the Gateway that ensure organizational ownership of objects.
+
+Tyk allows each organization to own its own set of Gateways, for example when you want to use different hosting providers you can segregate them in terms of resources, or just for security reasons.
+
+Self-Managed users should use [API tagging](/api-management/api-sharding#api-tagging-with-on-premises) and enforce a tagging standard across all organizations.
+
+All actions in a Self-Managed installation of Tyk must use a base Organization, and all actions should stem from a User owned by that organization.
+
+
+<Note>
+A user that does not belong to an Organization is sometimes referred to as an *unbounded user*. These users have visibility across all Organizations, but should be granted read-only access.
+</Note>
+
diff --git a/deployment-and-operations/container-runtimes.mdx b/deployment-and-operations/container-runtimes.mdx
new file mode 100644
index 0000000000..bde6263138
--- /dev/null
+++ b/deployment-and-operations/container-runtimes.mdx
@@ -0,0 +1,137 @@
+---
+title: "Container Runtimes"
+description: "Tyk runs as OCI-compatible containers and works with Docker, containerd, CRI-O, and Podman. Learn which runtimes are supported and how to configure each for local and Kubernetes deployments."
+sidebarTitle: "Container Runtimes"
+keywords: ["container runtime", "docker", "podman", "containerd", "CRI-O", "RHEL 8", "kubernetes", "OCI", "helm", "OpenShift"]
+---
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| Enterprise | Self-Managed, Hybrid |
+
+Tyk distributes all components as OCI-compatible container images, which means they run unchanged on any OCI-compliant runtime: Docker Engine, containerd, CRI-O, or Podman. You do not need to rebuild images when moving between runtimes or cloud providers.
+
+Since Kubernetes v1.24 removed the dockershim compatibility layer, managed Kubernetes services (EKS, GKE, AKS, OpenShift) use containerd or CRI-O directly. Docker is no longer required or present by default on Kubernetes nodes. Tyk's Helm-based installations work on all of these out of the box.
+
+## Supported runtimes
+
+The table below shows the default container runtime for each major provider.
+
+| Provider | Default runtime | Notes |
+| :--- | :--- | :--- |
+| **AWS EKS** | containerd | Default since dockershim removal; all Linux and Windows node groups |
+| **Google GKE** | containerd | Default since GKE 1.19; Docker deprecated by 1.24 |
+| **Azure AKS** | containerd | Linux nodes ≥ 1.19; Windows nodes ≥ 1.23 (only option) |
+| **Red Hat OpenShift** | CRI-O | Includes ROSA; uses CRI-O with runc/crun |
+| **Rancher (RKE2/K3s)** | containerd | Default for all cluster types |
+| **VMware Tanzu** | containerd | Default for all cluster types |
+| **DigitalOcean Kubernetes** | containerd | Default since Kubernetes 1.20 |
+| **IBM Cloud Kubernetes Service** | containerd | Default on all managed node pools |
+
+To check the container runtime on your cluster nodes:
+
+```bash
+kubectl get node -o jsonpath='{range .items[*]}{.metadata.name}{"  "}{.status.nodeInfo.containerRuntimeVersion}{"\n"}{end}'
+```
+
+## Running Tyk locally
+
+### Docker
+
+Docker is the fastest way to try Tyk on a laptop or VM. Tyk's quick starts and demo repositories use Docker Compose by default. See the [Docker installation guide](/tyk-self-managed/install/docker) for step-by-step instructions.
+
+### Podman (RHEL 8+)
+
+RHEL 8 ships Podman instead of Docker. Podman is daemonless, rootless-friendly, and uses the same CLI syntax as Docker. Tyk images run on Podman without modification.
+
+**Running Tyk Gateway with Podman (rootless):**
+
+```bash
+podman run -d --name tyk-gateway \
+  -p 8080:8080 \
+  -v $PWD/tyk.standalone.conf:/opt/tyk-gateway/tyk.conf:Z \
+  tykio/tyk-gateway:latest
+```
+
+The `:Z` suffix is required on SELinux-enabled systems (RHEL, Fedora) to relabel the bind-mounted volume so the container can access it.
+
+**Alias Podman as Docker (optional):**
+
+If your scripts call `docker`, you can alias Podman:
+
+```bash
+alias docker=podman
+```
+
+### Docker Compose and Podman Compose
+
+Tyk's demo repositories use standard `compose.yaml` files that work with both Docker Compose and Podman Compose.
+
+```yaml
+# Minimal example: Gateway + Redis
+services:
+  redis:
+    image: redis:7-alpine
+  gateway:
+    image: tykio/tyk-gateway:latest
+    ports: ["8080:8080"]
+    volumes:
+      - ./tyk.standalone.conf:/opt/tyk-gateway/tyk.conf:ro
+    depends_on: [redis]
+```
+
+```bash
+# Docker
+docker compose up -d
+
+# Podman
+podman compose up -d
+```
+
+## Running Tyk in Kubernetes
+
+Use Tyk's Helm charts for production Kubernetes deployments. The charts work across EKS, GKE, AKS, OpenShift (CRI-O), Rancher, and VMware Tanzu without modification.
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+helm install tyk tyk-helm/tyk-stack -n tyk --create-namespace -f values.yaml
+```
+
+For full installation instructions, see the [Tyk Self-Managed Kubernetes guide](/tyk-self-managed/install/kubernetes) or the [Tyk Stack Helm Chart reference](/product-stack/tyk-charts/tyk-stack-chart).
+
+## Building images
+
+Both `docker build` and `podman build` produce OCI-compliant images that run on containerd, CRI-O, or Docker Engine without modification.
+
+```bash
+# Build with Docker
+docker build -t your-registry/tyk-gateway:TAG .
+
+# Build with Podman (RHEL 8+)
+podman build -t your-registry/tyk-gateway:TAG .
+```
+
+OCI images are supported by all major registries (ECR, ACR, Google Artifact Registry, Docker Hub). For production, pin images by digest rather than by tag for reproducible deployments.
+
+## FAQ
+
+<AccordionGroup>
+
+<Accordion title="Do I need to rebuild Tyk images when moving from Docker to containerd or CRI-O?">
+No. Docker-built images are OCI images and run unchanged on containerd and CRI-O.
+</Accordion>
+
+<Accordion title="Does Podman change how Tyk runs?">
+Functionally, no. Images are identical. On RHEL, apply SELinux volume labels (`:Z` / `:z`) to bind mounts and be aware of rootless defaults.
+</Accordion>
+
+<Accordion title="Can I use Docker Compose files with Podman?">
+Yes. Use `podman compose` or point Docker Compose at Podman's Docker-compatible socket. See the [Podman documentation](https://docs.podman.io/en/latest/markdown/podman-compose.1.html) for details.
+</Accordion>
+
+<Accordion title="How do I check which runtime my cluster uses?">
+Run the `kubectl` one-liner in the [Supported runtimes](#supported-runtimes) section above.
+</Accordion>
+
+</AccordionGroup>
diff --git a/deployment-and-operations/tyk-open-source-api-gateway/quick-start.mdx b/deployment-and-operations/tyk-open-source-api-gateway/quick-start.mdx
new file mode 100644
index 0000000000..ac7acd60a9
--- /dev/null
+++ b/deployment-and-operations/tyk-open-source-api-gateway/quick-start.mdx
@@ -0,0 +1,84 @@
+---
+title: "Quick Start: Tyk Open Source Gateway"
+description: "Install and run Tyk Open Source Gateway with Docker in under 2 minutes."
+keywords: "Tyk Gateway, open source, quick start, Docker, installation"
+sidebarTitle: "Quick Start"
+---
+
+Get Tyk Open Source Gateway running locally with Docker in a few steps. For other deployment options, see the [installation options](/apim/open-source/installation) page.
+
+## Prerequisites
+
+- [Docker Engine](https://docs.docker.com/engine/install/) 24.0 or later
+- [Docker Compose](https://docs.docker.com/compose/install/) v2.20 or later
+
+## Instructions
+
+### Step 1: Create a Gateway configuration file
+
+Create a file named `tyk.conf` with the following content:
+
+```json
+{
+  "listen_port": 8080,
+  "secret": "your-secret",
+  "template_path": "/opt/tyk-gateway/templates",
+  "app_path": "/opt/tyk-gateway/apps",
+  "storage": {
+    "type": "redis",
+    "host": "tyk-redis",
+    "port": 6379
+  }
+}
+```
+
+For a full list of configuration options, see the [Gateway configuration reference](https://tyk.io/docs/tyk-oss-gateway/configuration).
+
+### Step 2: Create a Docker Compose file
+
+Create a file named `docker-compose.yml` with the following content:
+
+```yaml
+services:
+  tyk-gateway:
+    image: tykio/tyk-gateway:v5.8.13
+    ports:
+      - "8080:8080"
+    volumes:
+      - ./tyk.conf:/opt/tyk-gateway/tyk.conf
+    depends_on:
+      - tyk-redis
+  tyk-redis:
+    image: redis:8.2.0
+    ports:
+      - "6379:6379"
+```
+
+<Note>
+`v5.8.13` is the current LTS release. Always check the [Gateway release notes](https://tyk.io/docs/developer-support/release-notes/overview) for the latest stable version before deploying.
+</Note>
+
+### Step 3: Start Tyk Gateway
+
+```bash
+docker compose up -d
+```
+
+## Verify the Installation
+
+Check that the Gateway is running:
+
+```bash
+curl localhost:8080/hello
+```
+
+Expected response:
+
+```json
+{"status": "pass", "version": "v5.x.x", "description": "Tyk GW"}
+```
+
+## Next Steps
+
+- [Create your first API](/api-management/gateway-config-managing-oas#creating-an-api)
+- [Explore installation options](/apim/open-source/installation)
diff --git a/developer-support/community.mdx b/developer-support/community.mdx
new file mode 100644
index 0000000000..db9df4c9e0
--- /dev/null
+++ b/developer-support/community.mdx
@@ -0,0 +1,39 @@
+---
+title: "Community Support"
+description: "Developer support mechanisms, release notes and upgrading information for your Tyk installation"
+keywords: "FAQ, Troubleshooting, Release Notes, Upgrading, Developer Support"
+sidebarTitle: "Community Support"
+---
+
+Tyk offers a range of developer support services to assist with troubleshooting and Frequently Asked Questions (FAQs).
+
+## Expert Advice
+
+Prospective customers seeking technical advice can [contact us](https://tyk.io/contact/) to arrange a consultation with
+one of our expert engineers.
+
+## Community support
+
+Our [community](https://community.tyk.io/) is available to everyone, offering the following channels:
+
+| Channel | Purpose |
+| :--------- | :--------- |
+| [Support](https://community.tyk.io/c/support/) | Raise bugs and troubleshooting questions |
+| [Products](https://community.tyk.io/c/product/) | Discuss specific features of the Tyk Product Stack |
+| [Community](https://community.tyk.io/c/community/) | Access learning resources and community events |
+| [Announcements](https://community.tyk.io/c/announcements/) | Stay updated on new release announcements |
+| [Meta Feedback](https://community.tyk.io/c/meta) | Submit bug reports and forum feedback |
+
+You can also submit bug reports and feature requests through the
+[Tyk OSS Gateway repository](https://github.com/TykTechnologies/tyk).
+
+## Licensed
+
+Tyk Self-Managed and Tyk Cloud license holders have access to 24/7 support through our
+[helpdesk portal](https://support.tyk.io/hc/en-gb).
+
+
+## Additional Resources
+
+- [Release Notes](/developer-support/release-notes/gateway)
+- [Upgrading Tyk](/developer-support/upgrading)
diff --git a/developer-support/contributing.mdx b/developer-support/contributing.mdx
new file mode 100644
index 0000000000..4106f31508
--- /dev/null
+++ b/developer-support/contributing.mdx
@@ -0,0 +1,34 @@
+---
+title: "Contributing to Tyk documentation"
+description: "How to contribute to Tyk documentation"
+keywords: "Contributing, Documentation, Community"
+sidebarTitle: "Contribute"
+---
+
+This section provides resources and guidance for contributors to Tyk's documentation. Whether you're fixing a typo, adding new content, or helping improve our documentation standards, you'll find the tools and guidelines you need here.
+
+## What this section covers
+
+This contribution section includes:
+
+- **[Inclusive naming](/developer-support/documentation-projects/inclusive-naming)** - Information about Tyk's inclusive language initiative and the work done to update documentation terminology
+- **UI component examples** - Documentation and examples for using shortcodes in our documentation system
+
+## How to contribute to our docs
+
+We appreciate any form of engagement and contribution to our documentation. You can contribute in several ways:
+
+- [Report an error](https://github.com/TykTechnologies/tyk-docs/issues) in our GitHub repo
+- [Suggest/request an improvement](https://github.com/TykTechnologies/tyk-docs/issues) in our GitHub repo
+- Post a message in our [community forum](https://community.tyk.io/)
+- Update the code yourself:
+  1. To find the page that needs editing in the GitHub repository, copy a sentence from the HTML page on the [docs website](https://tyk.io/docs) and search for it using the GitHub search box in the top left corner of the repository
+  2. [Submit a PR](https://github.com/TykTechnologies/tyk-docs/pulls) directly to our [docs repo](https://github.com/TykTechnologies/tyk-docs/). See our [Guidelines for Pull Requests](/developer-support/contribution-guides) for detailed instructions.
+
+## Getting started with contributions
+
+For detailed contribution guidelines, including pull request requirements, coding conventions, and technical guidance, please refer to our [contribution guide](/developer-support/contribution-guides).
+
+### Technical guidance
+
+Our docs uses [Mintlify](https://mintlify.com/). For detailed technical guidance on creating and updating documentation pages, see the [technical guide](/developer-support/contribution-guides).
diff --git a/developer-support/contribution-guides.mdx b/developer-support/contribution-guides.mdx
new file mode 100644
index 0000000000..934004dfee
--- /dev/null
+++ b/developer-support/contribution-guides.mdx
@@ -0,0 +1,260 @@
+---
+title: "Contributing Guides"
+description: "Guide to releasing Tyk documentation"
+keywords: "Guides, Contribution to Tyk, Open source contribution guide"
+sidebarTitle: "Content Guide"
+---
+
+## Introduction
+
+Tyk documentation is built using [Mintlify](https://mintlify.com/), a platform that allows us to create, manage and publish our documentation. 
+This page provides an overview and guidelines to contributing to Tyk documentation, including setting up dev environment locally, creating new content, and utilize Mintlify's [UI objects](https://mintlify.com/docs/text).
+
+## Prerequisites - applys to all flows and tasks
+
+- You’ve set up the Tyk Docs local environment as described in the [Getting Started](#getting-started---running-mintlify-locally) section.
+- You have a basic understanding of [Page Structure](https://mintlify.com/docs/pages) and [Navigation](https://mintlify.com/docs/navigation) in Mintlify.
+- You’re familiar with Git and Markdown syntax.
+
+## Common steps for every task
+- Any update requires a PR
+- Please label your PR with the versions you want it to be added to
+- Please assign a reviewer that is also a stakeholder who can sign off the change
+
+## Getting Started - Running Mintlify locally
+
+This secion provides instructions for setting up your local environment to work with Tyk documentation using Mintlify.
+
+1. **Install Mintlify CLI globally**:
+   ```bash
+   npm i -g mint
+   ```
+2. **Clone the Tyk Docs repository**:
+   ```bash
+   git clone https://github.com/TykTechnologies/tyk-docs.git && cd tyk-docs
+   ```
+
+   For external contributions, you will need to fork the Tyk docs repository and clone your fork:
+   ```bash
+   git clone <fork-url>
+   cd tyk-docs
+   ```
+
+3. **Start the Mintlify development server**:
+   ```bash
+   mint dev
+   ```
+4. Open your browser and go to `http://localhost:3000` to view the documentation.
+
+## Creating a New Page
+
+To add a new page to the Tyk documentation, follow the steps below.
+
+1. **Switch to the `main` branch and pull the latest changes:**
+
+   ```bash
+   git checkout main
+   git pull origin main
+   ```
+
+2. **Create a new branch:**
+
+   ```bash
+   git checkout -b <br />
+   ```
+
+3. **Create the new page:**
+
+   The content is organized into folders under the root directory, reflecting the website's navigation structure (tabs, groups, etc.). Choose the appropriate folder for your new page.
+
+   * Create a new `.mdx` file for the page. For example, for a page titled “API Versioning” you might create a file named `api-versioning.mdx`.
+   * Add [front matter](https://mintlify.com/docs/pages#frontmatter) to the top of the file. This is a YAML block containing metadata like the title, description, and tags.
+
+   **Example front matter:**
+
+   ```mdx
+   ---
+   title: "API Versioning"
+   description: "Create and manage multiple versions of an API"
+   sidebarTitle: "API Versioning"
+   tags: ['API versioning', 'version', 'Tyk Classic', 'Tyk OAS', 'API', 'versioning']
+   ---
+
+   <Insert Lead paragraph here.>
+   ```
+
+   * Write your content using Markdown. You can also use Mintlify UI components (e.g., accordions, callouts, code blocks) to improve readability and user experience.
+
+4. **Update `docs.json`:**
+
+   To make your new page appear in the navigation, update the `docs.json` file in the root directory.
+
+   **Example**: Adding a new page under the *"API Management"* tab in the *"Overview"* group.
+
+   ```json
+   {
+     ...
+     "navigation": {
+       "tabs": [
+         {
+           "tab": "API Management",
+           "groups": [
+             {
+               "group": "Overview",
+               "pages": [
+                 "tyk-overview",
+                 "tyk-components",
+                 "apim",
+                 "api-versioning"  // New page added here
+               ]
+             }
+           ]
+         }
+       ]
+     }
+     ...
+   }
+   ```
+
+5. **Commit and push your changes:**
+
+   ```bash
+   git add -A
+   git commit -m "Add new page: <page-name>"
+   git push origin <br />
+   ```
+
+6. **Create a pull request** on GitHub to merge your changes into `main`.
+
+   Once the PR is opened, a series of automated checks will run:
+
+   *   Link Check: Mintlify checks for broken internal links.
+   *   Spell Check: A vale-spellcheck ensures content quality.
+   *   Documentation Validation: A custom script checks for things like missing images and redirect conflicts.
+
+7. **Preview your changes** using the link provided by Mintlify before merging.
+
+   **For Contributors Outside Tyk:** A Tyk team member will need to approve the Mintlify CI build for your pull request (PR). You will need to wait 
+   until the CI status is green.
+
+   **Locating Your Changes:** Since there's no search feature in this Mintlify build, you can find your changes by following these steps:
+      1.	**Copy the file path**: From the file path in GitHub, copy the path, excluding the `.md` file extension.
+      2.	**Construct the URL**: Append this copied path to the Mintlify URL after `/docs`.
+      3.	**Example**: To see the document at tyk-docs GitHub repository, copy `/tyk-self-managed/install` (omit `.md`) and add it after /docs/ in the Netlify URL, resulting in [https://branch-name.mintlify.app/docs/tyk-self-managed/install/](https://branch-name.mintlify.app/docs/tyk-self-managed/install/).
+
+8. **Merge to main (Updates Nightly)**
+   
+   Once the PR is reviewed, approved, and all checks pass, it can be merged into `main`. This automatically triggers a deployment, and your changes will go live on the Nightly version of the docs.
+
+9. **Backporting to Release Versions (Cherry-Picking)**
+   If your change needs to be included in a stable release (e.g., v5.9):
+
+   1.  Go to your original, now-merged PR on GitHub.
+   2.  Add a label corresponding to the target version, for example, release-5.9.
+   3.  That's it! An automated bot (buger) will detect this label.
+
+   The bot will:
+
+   1.  Cherry-pick the commit from your original PR.
+   2.  Create a new PR with those changes, targeting the release-5.9 branch.
+   3.  Automatically merge this new PR once all checks pass.
+
+   The merge into the `release-5.9` branch triggers the `main` deployment workflow, which rebuilds the `production` branch. Mintlify detects the update and deploys the changes to the live v5.9 documentation.
+
+## Updating an Existing Page
+
+To make changes to an existing page in the Tyk documentation, follow these steps:
+
+1. **Switch to the `main` branch and pull the latest changes:**
+
+   ```bash
+   git checkout main
+   git pull origin main
+   ```
+
+2. **Create a new branch:**
+
+   ```bash
+   git checkout -b <br />
+   ```
+
+3. **Locate and edit the page:**
+
+   * Navigate to the appropriate folder in the repository where the `.mdx` file for the page is located.
+   * Open the file and make your changes using Markdown syntax. You can enhance content using Mintlify UI components like callouts, accordions, tabs, and code blocks.
+   * If needed, update the front matter (e.g., `title`, `description`, `tags`) at the top of the file.
+
+4. **Preview your changes locally** to ensure formatting and layout appear as expected.
+
+   ```bash
+   mint dev
+   ```
+
+5. **Commit and push your changes:**
+
+   ```bash
+   git add .
+   git commit -m "<short-description-of-change>"
+   git push origin <br />
+   ```
+
+6. **Create a pull request** on GitHub to merge your branch into `main`.
+
+7. **Review the preview link** provided in the pull request to verify your changes before merging.
+
+## Deleting a Page
+
+To delete a page from the Tyk documentation, follow these steps:
+
+1. **Switch to the `main` branch and pull the latest changes:**
+
+   ```bash
+   git checkout main
+   git pull origin main
+   ```
+
+2. **Create a new branch from `main`:**
+
+   ```bash
+   git checkout -b <br />
+   ```
+
+3. **Delete the relevant Markdown file** corresponding to the page you want to remove.
+
+4. **Update `docs.json`:**
+
+   * Remove the entry for the deleted page from the `navigation` section.
+   * Add a redirect in the `redirect` section to point users to a relevant page. This prevents 404 errors when the deleted page is accessed.
+
+5. **Commit and push your changes:**
+
+   ```bash
+   git add .
+   git commit -m "Delete page: <page-name> - <Explain briefly the reason>"
+   git push origin <br />
+   ```
+
+6. **Create a pull request** on GitHub to merge your branch into `main`.
+
+7. **Review the preview link** provided by Mintlify to ensure your changes appear as expected before merging.
+
+## Guide for UI features
+
+Apart from the basic markdown writing, Tyk documentation also support UI components like accordions, callouts, cards, expandables, tabs etc. These components help in  enhance the documentation's usability and readability.
+
+Here's a table summarizing the UI features available for Tyk documentation:
+
+| Name | Description |
+| :------ | :------------- |
+| [Code Blocks](https://mintlify.com/docs/code) | Display inline code and code blocks |
+| [Accordions](https://mintlify.com/docs/components/accordions) | A dropdown component to toggle content visibility |
+| [Callouts](https://mintlify.com/docs/components/callouts) | Use callouts to add eye-catching context to your content |
+| [Cards](https://mintlify.com/docs/components/cards) | Highlight main points or links with customizable icons |
+| [Expandables](https://mintlify.com/docs/components/expandables) | Toggle to display nested properties. |
+| [Tabs](https://mintlify.com/docs/components/tabs) | Toggle content using the Tabs component |
+| [Mermaid](https://mintlify.com/docs/components/mermaid-diagrams) | Display diagrams using Mermaid |
+| [Steps](https://mintlify.com/docs/components/steps) | Sequence content using the Steps component |
+| Snipptet | A custom component written by us. TODO |
+
+**Note:** The above components is a list of mostly used components in Tyk documentation. To see the complete list of components, refer to the [Mintlify documentation](https://mintlify.com/docs/components).
+
diff --git a/developer-support/deprecation.mdx b/developer-support/deprecation.mdx
new file mode 100644
index 0000000000..17b1b0c45b
--- /dev/null
+++ b/developer-support/deprecation.mdx
@@ -0,0 +1,59 @@
+---
+title: "Tyk Deprecation and EOL Policy"
+description: "Official schedule and information regarding Tyk component deprecation and End-of-Life (EOL)."
+keywords: "Deprecation policy, EOL Policy, End of Life Policy"
+sidebarTitle: "Deprecation and EOL Policy"
+---
+
+## Introduction
+
+This page provides important information about the deprecation and End-of-Life (EOL) schedules for various **Tyk components, features, and packages**. Our goal is to keep you informed so you can plan your upgrades effectively and maintain a secure and supported environment.
+
+**Scope:** This policy and the notices on this page apply specifically to software, features, and components developed and distributed by Tyk. While we actively manage and update our external dependencies (like databases, libraries, Go versions), their individual EOL schedules are governed by their respective maintainers and are outside the scope of this specific Tyk deprecation policy.
+
+Currently, this page primarily focuses on Tyk software **packages** (Debian/RPM distributions hosted on packagecloud.io). We will expand this page to include other components or features as their lifecycle status changes. Please consider this a living document and check back periodically for updates.
+
+## Understanding Deprecation and End-of-Life (EOL)
+
+It's crucial to understand the terms we use for the lifecycle of Tyk components and features:
+
+*   **Deprecation:** This marks the phased retirement of a Tyk component or feature.
+    *   **What it means:** The component/feature will still be available for a period but will **no longer receive active support, updates, or enhancements** from Tyk.
+    *   **Action Required:** Customers are advised to plan and execute an upgrade or migration to the recommended alternative within the specified timeframe (the deprecation window).
+    *   **Future State:** Continued use is discouraged as the component/feature will eventually reach its End-of-Life (EOL).
+
+*   **End-of-Life (EOL):** This is the final stage following deprecation.
+    *   **What it means:** The Tyk component or feature is **completely removed from the product or service**, or rendered inaccessible.
+    *   **Action Required:** After the specified EOL date, the component/feature will no longer be available or functional. All dependencies on it within your systems must be eliminated *before* this date.
+
+*   **Deprecation Window:** This refers to the period between the initial deprecation announcement (when support ceases) and the final End-of-Life (EOL) date when the component/feature is removed or becomes inaccessible.
+
+**Key Distinction:** Deprecation is the *start* of the retirement process (support ends), while EOL is the *end* (removal/inaccessibility).
+
+## Deprecated Packages Schedule & Repository Removal
+
+The table below outlines the lifecycle dates for specific versions of Tyk software **packages** hosted on [packagecloud.io/tyk/](https://packagecloud.io/tyk/).
+
+| Component                 | Deprecation Date (Support Ends) | EOL Date (Package Removal) | Reason                       | Recommended Action             |
+| :------------------------ | :------------------------------ | :------------------------- | :--------------------------- | :----------------------------- |
+| Gateway & Dashboard < v3.0 | 2023                            | March 15, 2025             | Version reached End-of-Life  | Upgrade to a supported version |
+| Pump < v1.6.0             | 2023                            | March 15, 2025             | Version reached End-of-Life  | Upgrade to a supported version |
+| Tyk Identity Broker < v1.1.0 | 2023                            | March 15, 2025             | Version reached End-of-Life  | Upgrade to a supported version |
+| MDCB < v1.8.2             | 2023                            | March 15, 2025             | Version reached End-of-Life  | Upgrade to a supported version |
+
+*Deprecation Date indicates when support and updates ceased. EOL Date indicates when the package artifact will be removed from the public repository.*
+
+## Plan Your Upgrade
+
+Running outdated software versions can expose your systems to security vulnerabilities and prevent you from benefiting from the latest features, performance improvements, and bug fixes. Components that have passed their Deprecation Date are unsupported.
+
+We strongly recommend upgrading any components that are deprecated or nearing their EOL date to a currently supported version.
+
+*   **Upgrade Guides:** Please consult the official [Tyk Upgrade Documentation](/developer-support/upgrading) for detailed instructions.
+*   **Release Notes:** Review the [Tyk Release Notes](/developer-support/release-notes/overview) for information on new features and changes in recent versions.
+
+## Need Assistance?
+
+If you have questions regarding this schedule, require help planning your upgrade strategy, or need specific guidance related to your Tyk deployment:
+
+*   **Contact Tyk Support:** Please reach out to our [Support Team](https://tyk.io/contact) for assistance. We're here to help ensure your upgrade process is as smooth as possible.
\ No newline at end of file
diff --git a/developer-support/documentation-projects/inclusive-naming.mdx b/developer-support/documentation-projects/inclusive-naming.mdx
new file mode 100644
index 0000000000..84924add79
--- /dev/null
+++ b/developer-support/documentation-projects/inclusive-naming.mdx
@@ -0,0 +1,115 @@
+---
+title: "Inclusive Naming"
+description: "Explains the inclusive naming initiative concerning Tyk docs"
+keywords: "Inclusive Naming Initiative, Inclusivity, Inclusive, Inclusive Naming Project"
+sidebarTitle: "Inclusive Naming"
+---
+
+This document is intended for Tyk users, contributors, and anyone interested in our commitment to inclusive language within Tyk's documentation and product interfaces.
+
+## Inclusive Naming project
+We are excited to announce the launch of our *Inclusive Naming* project, in June 2024, dedicated to updating our documentation and aligning with the [Inclusive Naming Initiative (INI)](https://inclusivenaming.org). This initiative reflects our commitment to fostering an inclusive and respectful environment for our users and within our company.
+
+The [Inclusive Naming Initiative](https://inclusivenaming.org/) is a community-driven effort to promote and standardize the use of inclusive language in software and documentation. By adhering to their guidelines, we aim to eliminate terms that can be considered exclusionary, offensive, or insensitive and replace them with language that is respectful and welcoming to all.
+
+## Purpose
+
+Our commitment to diversity, equity, and inclusion is foundational to our values. By updating our documentation to comply with the *Inclusive Naming Initiative (INI)*, we are taking a significant step towards ensuring that our language reflects our dedication to inclusivity. This project will help us:
+
+- **Create a more welcoming environment**: By using inclusive language, we create a space where everyone feels valued and respected.
+- **Enhance accessibility**: Clear and inclusive documentation improves accessibility for all users, regardless of their background or identity.
+
+## Tier 1 word list
+
+INI sorts terms into word lists, considering both the severity of the term and the level of scrutiny it has received. [INI Tier 1 words](https://inclusivenaming.org/word-lists/tier-1) are considered critical and are recommended to be replaced immediately.
+
+INI has identified that terms included in this list have one or all of the following attributes:
+
+- Strong social consensus within the software development community on replacements
+- Are identified by the INI as high-severity terms in need of immediate replacement
+- Terms where the impact of change or removal is low: for example, there is little entanglement in low-level systems or standardized language set by standards bodies
+- Have passed through all the review stages in Tiers 2 and 3
+
+## Phase 1: Review of Tyk Documentation for Tier 1 Words
+
+An initial review of the Tyk documentation was conducted in April 2024 to check which tier 1 words can be replaced, which can't, and why.
+
+### Findings and planning
+The main findings of the review are:
+
+1. **Explanatory content with INI tier 1 words**: The content on these pages can be easily rephrased and is now completed.
+2. **Configuration parameters containing INI tier 1 words**:
+   - Some *INI tier 1 words* are embedded in the code as part of the name of parameters, fields, and keywords.
+   - These words are sourced from Tyk products, and third-party libraries, and tooling, e.g. Redis.
+   - Possible actions:
+     - Being part of the source code, we can't simply rephrase and use a different terminology. Such change requires following a deprecation process to ensure there are no breaking changes for our users.
+     - For now, we can minimize their usage and rephrase the explanatory content to use inclusive words.
+
+   
+## Phase 2: Removing Tier 1 words from Tyk documentation
+
+In June 2024, based on the review we executed the planned changes to the content in our [documentation](https://github.com/tykTechnologies/tyk-docs/).
+
+### Status update
+This is the update on the status of our documentation
+1. **Regular explanatory content with INI tier 1 words**: Content in the documentation has been rephrased and the work is now completed. 
+2. **Configuration parameters containing INI tier 1 words**: These words are still in our docs, however, we minimized their usage and rephrased their explanatory content to use inclusive words.
+   - **Tyk products**: These words are still in our docs, however, Tyk aims to gradually replace them (in a backward-compatible way) and update the docs accordingly.
+   - **Third-party and dependencies**: There's nothing much we can do at the moment except wait for them to replace these parameters, however, we are committed to updating our docs once this gets done.
+
+### List of configuration parameters containing INI tier 1 word
+For your records, the following sections highlight the existing *INI tier 1 words* in our docs, per Tyk component:
+
+#### Tyk Gateway
+
+**Config parameters**
+
+- [allow_master_keys](/tyk-oss-gateway/configuration#allow_master_keys)
+- [analytics_storage.master_name](/tyk-oss-gateway/configuration#analytics_storage-master_name)
+- [cache_storage.master_name](/tyk-oss-gateway/configuration#cache_storage-master_name)
+- [storage.master_name](/tyk-oss-gateway/configuration#storage-master_name)
+- [slave_options](/tyk-oss-gateway/configuration#slave_options)
+- [blacklisted_ips](/api-management/gateway-config-tyk-classic#ip-access-control)
+- [disable_ports_whitelist](/key-concepts/tcp-proxy#allowing-specific-ports)
+- [enable_ip_blacklisting](/api-management/gateway-config-tyk-classic#ip-access-control)
+- [ports_whitelist](/key-concepts/tcp-proxy#allowing-specific-ports)
+
+#### Tyk Classic API Definition
+
+The Tyk Gateway OpenAPI Document (Tyk Gateway swagger), includes references to the following Tyk Classic API Definition parameters:
+
+- [version_data.versions.version-name.extended_paths.black_list](/api-management/traffic-transformation/block-list#api-definition). There is also a parameter with equivalent functionality under the `paths` object (`version_data.versions.{version_name}.paths.black_list`).
+- [version_data.versions.version-name.extended_paths.white_list](/api-management/traffic-transformation/allow-list#api-definition). There is also a parameter with equivalent functionality under the `paths` object (`version_data.versions.{version_name}.paths.white_list`).
+
+#### Tyk Dashboard
+
+**Config parameters**
+- [enable_master_keys](/tyk-dashboard/configuration#enable_master_keys)
+- [redis_master_name](/tyk-dashboard/configuration#redis_master_name)
+
+**Tyk Classic API Definition**
+
+The Tyk Dashboard OpenAPI Document (Tyk Dashboard swagger), contains references to [the parameters from the above Tyk Classic API Definition list](#gw-classic-api-definition).
+
+**Dashboard UI**
+
+The Tyk Classic APIs *Endpoint Designer* shows configuration of [blacklist](/api-management/traffic-transformation/block-list#api-designer) and [whitelist](/api-management/traffic-transformation/allow-list#api-definition) middleware plugins.
+    
+#### Tyk MDCB
+
+The following MDCB configuration parameters contain tier 1 word occurrences:
+- [analytics_storage.master_name](/tyk-multi-data-centre/mdcb-configuration-options#analytics_storage-master_name)
+- [storage.master_name](/tyk-multi-data-centre/mdcb-configuration-options#storage-master_name)
+
+#### Tyk Pump
+
+The following Tyk Pump configuration parameters contain tier 1 word occurrences:
+- [analytics_storage_config.master_name](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#analytics_storage_config-master_name)
+
+#### Third-party dependencies 
+
+Content contains *INI Tier 1 word* occurrences due to the following external dependencies:
+- Links to Tyk Component GitHub repositories with a default branch set as `master`. 
+- Tyk Gateway and Tyk Pump content use Redis terminology for `master` in relation to key storage and analytics. 
+- Tyk Classic Developer Portal provides [documentation](/tyk-developer-portal/tyk-portal-classic/keycloak-dcr) that explains how to integrate Tyk with Keycloak using the [OpenID Connect Dynamic Client Registration](https://tools.ietf.org/html/rfc7591) protocol. The example in the guide uses the Keycloak default `master` realm.
+- Tyk Bitnami Helm charts use a service with a DNS name of *tyk-redis-master.tyk.svc*.
\ No newline at end of file
diff --git a/developer-support/faq.mdx b/developer-support/faq.mdx
new file mode 100644
index 0000000000..44c9c6d5d2
--- /dev/null
+++ b/developer-support/faq.mdx
@@ -0,0 +1,207 @@
+---
+title: "Frequently Asked Questions"
+description: "Frequently asked questions about Tyk, including configuration file backups, gateway version checking, and high traffic handling."
+keywords: "FAQ, frequently asked questions, answers, configuration files backup, backup tyk, tyk.conf, upgrade tyk, database backup, Analytics, Distributed Analytics, Redis, Redis Shards, analytics_config.enable_multiple_analytics_keys, do_not_track, RPS, Requests Per Second, CPU, high load, high traffic"
+order: 230
+sidebarTitle: "Frequently Asked Questions"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+This section lists commonly asked questions or frequently encountered issues and explains how to resolve them.
+
+## Tyk Configuration
+
+1. **If there's a configuration error or an unwanted change, can I easily revert to a previous API or Policy configuration? What are the options or best practices for effective rollbacks?**
+    
+    You can configure [Tyk-Sync](/api-management/automations/sync) to synchronise APIs and Policies with any version control system, like GitHub or GitLab and use it to perform roll back. Keys are not synchronised with Tyk Sync.
+
+2. **How to Backup Configuration Files of Tyk Component's ?**
+
+    Every Tyk component has a config file, that is used during start-up. They store critical settings and parameters that determine how your application behaves as well as settings for databases, passwords, and connections to other components.
+    To ensure a comprehensive backup strategy, regularly back up configuration files for all relevant components, using a version control system (such as Git).
+
+3. **What are the different Config file per Tyk component ?**
+
+    These are the config files per component:
+    - Tyk Gateway - `tyk.conf` (For any user)
+    -  Tyk Pump - `pump.conf` (For any user)
+    - Tyk Dashboard - `tyk_analytics.conf` (For Tyk Self-Managed clients)
+    - MDCB - `tyk_sink.conf` (for MDCB clients)
+    - Hybrid Tyk Gateway - `tyk.hybrid.conf`
+
+    **Note:** These are the config files with Tyk's default names. You might have different names for your config files.
+
+4. **How to Backup Tyk's Certificates Directory ?**
+    
+    Path to the private keys and certificate are defined in the config files of any of Tyk components. Make sure to back up the certificate and keys used by these config files.
+
+5. **How to Backup Middleware Directory for Custom Plugins ?**
+
+    If you use custom middleware plugins to extend your application's capabilities, regularly back up the middleware directory to preserve your customizations.
+    Details on middleware installation for [Tyk Self-Managed users](/api-management/plugins/javascript#installing-middleware-on-tyk-self-managed) (users of the licensed product).
+    Details on middleware installation for [Tyk Open Source users](/api-management/plugins/javascript#installing-middleware-on-tyk-oss)
+
+    **Note:** Tyk's default name is `/middleware`. You might use a different name for it.
+
+
+6. **How to Backup Tyk API Definitions Directory - For Tyk Open source users ?**
+
+    When using *Tyk Gateway* as an open-source product, it could use a dedicated directory to load your Tyk API definitions and start serving them. 
+    If you use such a directory, ensure these definitions are part of your backup plan.
+
+    **Note:** Tyk's default name is `/apps`. You might use a different name for it based on this [config field](/tyk-stack/tyk-gateway/important-prerequisites#tyk-config)
+
+7. **How to Backup Tyk Policies Directory - For Tyk Open source users ?**
+
+    When using *Tyk Gateway* as an open-source product, it could use a file to load policies to be used by API keys when consuming the APIs. 
+    If you use a policies file, ensure it is also part of your backup plan.
+
+    **Note:** Tyk's default name is `/policies`. You might use a different name for it based on this [config field](/tyk-stack/tyk-gateway/important-prerequisites#path-to-policies-file)
+
+8. **How to Backup Redis ?**
+
+    **Users:** Redis is used in any type of deployment and as such used by any type of user (Open Source and paying users).
+
+    Backup Redis is important as all of the keys used by *Tyk Gateway* are stored there.  
+    Redis, being an in-memory data store, is ephemeral and doesn't have a built-in default backup policy, as such it requires specific considerations for backup. 
+    To understand the best practices for Redis backup, please visit the official [Redis Backup Documentation](https://redis.io/docs/management/persistence/).
+
+
+9. **How to Backup Databases Used by Tyk Dashboard - a licensed product ?**
+
+    **Users:** For Tyk Self-managed and MDCB users who are using our licensed products.
+
+    Tyk Dashboard allows you to choose between *MongoDB* and *PostgreSQL* as your database solution, depending on your preferences and requirements. Regardless of your choice, it's crucial to implement a robust backup strategy to ensure the safety and availability of your data. Please check the section that fits your use case:
+
+
+    **MongoDB Backup**
+
+    MongoDB provides various methods for creating backups, and the choice of strategy often depends on your specific use case and environment. To learn more about MongoDB backup strategies, please refer to the [MongoDB Backup Documentation](https://www.mongodb.com/docs/manual/core/backups/).
+    - For *Amazon DocumentDB* user, check their [backup and restore documentation](https://docs.aws.amazon.com/documentdb/latest/developerguide/backup_restore.html)
+    - For *CosmosDB* users check their [online backup and on-demand data restore documentation](https://learn.microsoft.com/en-us/azure/cosmos-db/online-backup-and-restore) 
+
+    **Postgres Backup**
+
+    PostgreSQL offers multiple backup options, including logical and physical backups. The right choice depends on your database size, recovery time objectives, and other factors. For detailed information on PostgreSQL backup strategies, please consult the [PostgreSQL Backup and Restore Documentation](https://www.postgresql.org/docs/current/backup.html).
+
+    - For *Amazon RDS* users, check their [backup and restore documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_CommonTasks.BackupRestore.html). To further enhance your PostgreSQL backup process, you can explore services like [AWS RDS Automated Backups](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html) if you're hosting your database on AWS. 
+    - For *CosmosDB* users check their [online backup and on-demand data restore documentation](https://learn.microsoft.com/en-us/azure/cosmos-db/postgresql/concepts-backup) 
+
+## Enterprise Developer Portal
+
+1. **What happens if the Portal goes down ?**
+
+    In the event of the portal application being down, the other components of the Tyk Stack will remain unaffected.
+    This means your APIs will still be operational, and analytics will continue to be recorded.
+    Developers will also be able to use their credentials for both oAuth2.0 and API Keys APIs.
+
+    However, since the portal application is down, developers won't be able to access their credentials or the analytical dashboard, request access to new API Products, or revoke or rotate their access credentials.
+    Additionally, admin users won't be able to use the portal, whether through its UI or APIs.
+    This means you won't be able to create, change, or remove any item managed by the portal, such as developers, organizations, content pages, API Products, plans, and more.
+
+    Despite this, you still have some control over access credentials.
+    If you need to rotate or remove access credentials, you can do so directly in the Tyk Dashboard or in your identity provider.
+
+2. **What happens if the Dashboard goes down ?**
+
+    If the Tyk Dashboard goes down, developers will still be able to access their access credentials, but they won't be able to rotate or remove their existing credentials, or request access to API Products.
+    Additionally, the API Analytics dashboard will be compromised.
+
+    However, API traffic will remain unaffected, meaning that your APIs will continue to be operational, and analytics will continue to be recorded.
+
+    In terms of admin functionality, the only limitation will be the inability to approve or reject access requests or revoke or rotate access credentials.
+
+
+3. **Does the portal support SQL databases for storing the portal's CMS assets ?**
+
+    
+
+    <Note>
+    Tyk no longer supports SQLite as of Tyk 5.7.0. To avoid disruption, please transition to [PostgreSQL](/planning-for-production/database-settings#postgresql), [MongoDB](/planning-for-production/database-settings#mongodb), or one of the listed compatible alternatives.
+    </Note>
+
+
+    The Enterprise Developer Portal supports SQL databases (MariaDB, MySQL, and PostgreSQL) for storing the portal's CMS assets.
+    During the bootstrap process, the portal will create the appropriate tables in the main database. The only thing required to enable SQL storage for the portal's assets is to specify the `db` [storage type](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_storage) either via a config file or an environment variable.
+
+## Tyk Gateway
+
+1. **How to Check Your Gateway Version ?**
+
+    Since Gateway version `5.0.8` or `5.2.3` you can inspect detailed build information including the release version by running `tyk version`.
+
+    ```console
+    Release version: v5.3.0-dev
+    Built by:        goreleaser
+    Build date:      <date>
+    Commit:          <commit-hash>
+    Go version:      go1.20
+    OS/Arch:         linux/amd64
+    ```
+
+    If you need this in a machine readable format, a `--json` flag is available.
+
+    ```json
+    {
+        "Version": "v5.3.0-dev",
+        "BuiltBy": "goreleaser",
+        "BuildDate": "<date>",
+        "Commit": "<commit-hash>",
+        "Go": {
+            "Os": "linux",
+            "Arch": "amd64",
+            "Version": "go1.20"
+        }
+    }
+    ```
+
+    For older versions of Gateway, you can run `tyk --version` to print the release version for your tyk binary.
+
+    The binary is installed in `/opt/tyk-gateway/tyk` by default. If your binary is not available in your `PATH` environment, invoke it from there.
+
+    ```
+    time="Oct 31 17:06:06" level=info msg="Tyk API Gateway v5.3.0-dev" prefix=main
+    ``` 
+
+## Tyk Cloud
+
+1. **How can I track and audit changes made to Tyk Dashboard configurations ?**
+
+    To track changes in Dashboard configurations, please submit a [support ticket](https://support.tyk.io/hc/en-gb/articles/8671452599708-Ticket-Submission-Guide). No configuration changes will occur without your explicit request.
+
+## Miscellaneous
+
+1. **Error initialising system couldn't unmarshal config**
+
+    The error "Error initializing system: couldn't unmarshal config: invalid character" occurs in the Tyk Gateway logs due to improper syntax in the configuration files. To resolve this, carefully review and correct the syntax in all Tyk configuration files, restart the Gateway, and, if the issue persists, validate the JSON files using [JSONLint](https://jsonlint.com/).
+
+2. **All tyk container logs show up under the error status in Datadog logs**
+
+    With Datadog you can view logs of all your Tyk components.
+    To allow Datadog Agent to scrape the logs of your Tyk deployment correctly you need to create a pipeline in Datadog, to process and underst and this data.
+
+    To do that, we need to access the `/logs/pipelines` path on your datadog web application.
+    This will take us to the pipeline configuration page.
+    In here, we will create a new pipeline.
+    For the filter section, use `Service:tyk-*` this will capture logs for any of the Tyk related services.
+
+    <img src="/img/faq/datadog-logs-showup-as-errors/create-pipeline.png" alt="Create Datadog Logs Pipeline to process Tyk services' logs" />
+
+    Next, we will need to add a processor to the pipeline.
+
+    <img src="/img/faq/datadog-logs-showup-as-errors/add-processor.png" alt="Create Datadog Logs Pipeline to process Tyk services' logs" />
+
+    Select the Grok Parser processor type, give it a name and click on the `Parse My Logs` button and `Create` .
+
+    <img src="/img/faq/datadog-logs-showup-as-errors/create-grok-parser-processor.png" alt="Create pipeline processor to parse grok statements" />
+
+    Lastly, add another processor to the pipeline. Select the Status Remapper processor type, give it a name and set the status attribute to `level` then `Create`.
+
+    <img src="/img/faq/datadog-logs-showup-as-errors/create-status-remapper-processor.png" alt="Create pipeline processor to remap the status of the log to level attribute value" />
+
+    The Tyk logs statuses should now be shown under the right status.
+
+    Contact us to learn more:
+
+    <ButtonLeft href="https://tyk.io/contact/" color="green" content="Contact us" />
diff --git a/developer-support/release-guide.mdx b/developer-support/release-guide.mdx
new file mode 100644
index 0000000000..1f060ab8d4
--- /dev/null
+++ b/developer-support/release-guide.mdx
@@ -0,0 +1,210 @@
+---
+title: "Releasing Tyk Docs"
+description: "Guide to releasing Tyk documentation"
+keywords: "Authentication, Authorization, Tyk Authentication, Tyk Authorization, Secure APIs, client"
+sidebarTitle: "Release Tyk Docs"
+---
+
+## Introduction
+
+This document outlines the process for releasing Tyk documentation, including patch and major/minor releases. It provides a clear understanding of the versioning system, the release workflow, and the steps required to ensure that documentation is up-to-date.
+
+## Types of Releases
+
+Tyk has two types of releases:
+
+1.  **Patch Release:** e.g → 5.3.5, 5.3.6, 5.7.1, 5.7.2
+
+    A patch release includes bug fixes, small improvements, and security patches. It does not introduce any breaking changes.
+
+2.  **Major/Minor Release:** e.g → 4.1, 4.2, 5.3, 5.4
+
+    A major or minor release includes new features, improvements, and potentially breaking changes.
+
+### Versioning in Tyk Docs
+
+Tyk Docs uses a versioning system that aligns with the Tyk components. The versioning follows the Semantic Versioning of Tyk [Gateway](/developer-support/release-notes/gateway).
+
+## Understanding the Release Workflow
+
+Tyk Documentation is maintained in a [GitHub](https://github.com/TykTechnologies/tyk-docs) repository, and the release workflow is managed through branches. The following table outlines the special branches used in the Tyk Docs repository:
+
+| **Special Branches** | **Description** | **Docs URL** |
+| :--------------------------- | :----------------- | :-------------- |
+| `main`                  | Holds docs for nightly build. | [tyk.io/docs/nightly](https://tyk.io/docs/nightly) |
+| `release-x.y`             | Holds docs for that specific version. For example, `release-5.7` holds docs for 5.7 and its patch versions (5.7.1, 5.7.2, etc.). | [tyk.io/docs/5.7](https://tyk.io/docs/5.7) |
+| `production`                  | It acts as the single source of truth for the Mintlify platform. | [tyk.io/docs](https://tyk.io/docs) |
+
+### Production Branch
+
+*   This is a special, **automated-only** branch. **No one should ever commit to it directly**.
+*   It acts as the single source of truth for the Mintlify platform.
+*   A GitHub Action (`deploy-docs.yml`) automatically builds this branch by:
+    1.  Cloning the main branch and all active release- branches.
+    2.  Organizing their content into versioned subfolders (e.g., /nightly/, /5.9/, /5.8/).
+    3.  Generating a unified `docs.json` navigation file that contains the structure for all versions.
+    Mintlify is connected only to this `production` branch and deploys any changes made to it.
+
+### Workflow
+
+All documentation content is always merged into the `main` branch first, and then the changes are made to the `release-x.y` branches as needed.
+
+```mermaid
+graph TD;
+
+    classDef repoStyle fill:#E1D5E7,stroke:#9673A6,stroke-width:2px,font-weight:bold;
+    classDef branchStyle fill:#D1E8FF,stroke:#007BFF,stroke-width:2px;
+    classDef urlStyle fill:#E2F0D9,stroke:#548235,stroke-width:2px;
+    classDef inputStyle fill:#FFF2CC,stroke:#D6B656,stroke-width:1px;
+
+    Repo["GitHub: TykTechnologies/tyk-docs"]
+    class Repo repoStyle;
+
+    NewContent["New Documentation Content / Changes"]
+    class NewContent inputStyle;
+
+    subgraph SpecialBranches [Special Branches in Repository]
+        direction TB
+        main["<strong>main</strong><br/>Holds docs for nightly build"]
+        release_xy["<strong>release-x.y</strong><br/>(e.g., release-5.7)<br/>Docs for specific version x.y<br/>and its patch versions (x.y.z)"]
+        production["<strong>production</strong><br/>Holds the latest release docs"]
+    end
+    class main,release_xy,production branchStyle;
+
+    subgraph PublishedURLs [Published Documentation URLs]
+        direction TB
+        url_nightly["<code>tyk.io/docs/nightly</code>"]
+        url_version["<code>tyk.io/docs/x.y</code><br/>(e.g., tyk.io/docs/5.7)"]
+        url_production["<code>tyk.io/docs</code><br/>(Live site / Latest production)"]
+    end
+    class url_nightly,url_version,url_production urlStyle;
+
+    Repo --> main;
+    NewContent -- "Step 1. Content merged first into" --> main;
+    main -- "Step 2. Changes propagated/<br/>backported (as needed)" --> release_xy;
+    release_xy -- "Step 3. Trigger Mintlify Production Build" --> production;
+
+    main -. "Trigger Build" .-> production;
+    release_xy -. "Trigger Build" .-> production;
+
+    production -. "Publishes to" .-> url_nightly;
+    production -. "Publishes to" .-> url_version;
+    production -. "Publishes to" .-> url_production;
+```
+
+### Previous Releases
+
+Tyk maintains [LTS versions](/developer-support/release-types/long-term-support#current-lts-releases-timeline). During some releases, we need to update the LTS release alongside the latest version. For example, you may need to maintain both 5.7.2 (latest) and 5.3.2 (LTS).
+
+## Patch Release
+
+To release a patch version, we follow a simple process that involves merging the release notes and documentation PRs into the `main` and the specific release branch (e.g., `release-5.7`).
+
+### Pre-Requisites:
+
+Ensure the PRs for documentation, configuration, and release notes have already been approved.
+
+**Note:** For release notes, ensure that we have updated the Tyk component version on the [release summary page](https://tyk.io/docs/developer-support/release-notes/overview/)
+
+### Instructions
+
+1.  **Deploy release:**
+    The PRs mentioned in the prerequisites can now be merged into the main and release branches (release-5.7)
+
+2.  **Sync component versions to tyk-install:**
+    Merging the release notes PR into `main` automatically triggers the [Sync Component Versions](https://github.com/TykTechnologies/tyk-docs/actions/workflows/sync-versions-to-tyk-install.yml) workflow, which opens a PR in the [tyk-install](https://github.com/TykTechnologies/tyk-install) repository to update the component image tags in `docker/self-managed/.env.example`. Review and merge that PR.
+
+
+3.  **Verify:**
+    After merging the PRs on the version branch (release-5.7), it typically takes 5 minutes for the changes to be reflected on the live website. Verify these changes after release.
+
+**Note:** We can also have a patch release for previous versions. For example, if the latest version is 5.7.2 and the new patch is 5.7.3, and a patch for LTS version 5.3.3 also needs to be released, then you will have to merge the PRs for both versions.
+
+## Major/Minor Release
+
+To release a major or minor version, we follow a series of steps to ensure that the documentation is updated, the latest version is deployed, and the previous versions are maintained correctly. The following steps outline the process:
+
+### Pre-Requisites:
+
+Ensure the PRs for documentation, configuration, and release notes have already been approved.
+
+**Note:** For release notes, ensure that we have updated the Tyk component version on the [release summary page](https://tyk.io/docs/developer-support/release-notes/overview/)
+
+
+### Instructions
+
+1.  **Create the New Release Branch**
+    From the main branch, create a new branch named release-X.Y (e.g., release-5.10). This branch will be used to maintain the documentation for the latest version.
+
+2. **Update Redirects in docs.json**
+
+    - In the previous latest branch/version, remove all redirects from `docs.json` and move it to the newly created branch from the previous step.
+
+        ```json
+        "redirects": []
+        ```
+
+3.  **Update the Branch Configuration**
+    In the `production` branch, edit the `branches-config.json` file. Add a new JSON object for the latest version. This configuration tells the build system how to handle the new version.
+
+    *   Set isLatest to true for the new release-5.10.
+    *   Set isLatest to false for the previous latest version (e.g., release-5.9).
+
+    **Example:**
+
+    ```json
+    {
+      "branch": "release-5.10",
+      "isLatest": true,
+      "sourceFolder": "5.10-source",
+      "targetFolder": "5.10",
+      "label": "v5.10 (latest)"
+    }
+    ```
+
+4. **Manually Trigger the Deployment Workflow**
+
+    1.  Go to the "Actions" tab in the GitHub repository.
+    2.  Select the "Deploy Documentation" workflow.
+    3.  Click "Run workflow" and choose the `production` branch to run it against.
+
+    This will rebuild the `production` branch, creating the new versioned folder and updating the site's navigation to include v5.10 as the latest version.
+
+5. **Update Cloudflare Worker**
+
+    Add a new route in the `docs-rewrite-mintlify` Cloudflare Worker for the new version.
+
+    **Example:**
+    If the new version is 5.11, add the following route `*tyk.io/docs/5.11*`
+
+6.  **Deploy release:**
+
+    The PRs mentioned in the prerequisites can now be merged into `main` and the latest release branch.
+
+7. **Sync component versions to tyk-install:**
+    Merging the release notes PR into `main` automatically triggers the [Sync Component Versions](https://github.com/TykTechnologies/tyk-docs/actions/workflows/sync-versions-to-tyk-install.yml) workflow, which opens a PR in the [tyk-install](https://github.com/TykTechnologies/tyk-install) repository to update the component image tags in `docker/self-managed/.env.example`. Review and merge that PR.
+
+
+8. **Update Postman Collections:**\
+    We maintain a Postman collection for the following Tyk Components (Gateway, Dashboard, MDCB, and Developer Portal). After a major or minor release, we need to update the Postman collections.
+
+    These instructions are for a single Tyk component and must be repeated for other components.
+
+    1.  Download the Swagger from the docs website or the respective GitHub repository of the component.
+
+    2.  In Postman, select the import option and drop the file you downloaded in the first step.
+
+    3.  After the import, change the name. Refer to our previous collection name.
+
+    5.  Add the `latest` prefix and remove the previous one. This ensures that the latest version is always displayed at the top.
+
+8. **Update the HubSpot Banner to indicate the new release of the old docs pages.**
+    **Description:** We use HubSpot to display a banner at the top of our docs page, which indicates that you are viewing old documentation and points to the latest version.\
+    **Example:** [Sample Banner](https://tyk.io/docs/4.0/getting-started/key-concepts/graphql-subscriptions/).
+
+    **Steps:** Update the HubSpot banner to indicate the new release.
+
+9. **Add a reference to release notes in Github Releases:**
+    **Description:** Developers usually refer to the GitHub release tags to view the changelog. These release tags should point to the release notes in the docs.\
+    **Example:** `https://github.com/TykTechnologies/tyk/releases/tag/v5.3.8`\
+    **Steps:** Modify the release tags of all components modified in a release.\
diff --git a/developer-support/release-notes/ai-studio.mdx b/developer-support/release-notes/ai-studio.mdx
new file mode 100644
index 0000000000..ad68c764fd
--- /dev/null
+++ b/developer-support/release-notes/ai-studio.mdx
@@ -0,0 +1,137 @@
+---
+title: "Tyk AI Studio Release Notes"
+description: "Release notes documenting updates, enhancements, and changes for Tyk AI Studio and its Edge Gateway."
+keywords: "Tyk AI Studio, AI Management, Release notes, changelog, Edge Gateway"
+sidebarTitle: "Release Notes"
+---
+
+**This page contains all release notes for Tyk AI Studio, displayed in reverse chronological order.** Each release covers the AI Studio control plane, the Edge Gateway, and the bundled enterprise and community plugins.
+
+Tyk AI Studio is available as a [Community edition](/ai-management/ai-studio/overview#community-edition) (open source) and an [Enterprise edition](/ai-management/ai-studio/overview#enterprise-edition).
+
+---
+
+## 2.1 Release Notes
+
+### 2.1.0 Release Notes
+
+#### Release Date 14 May 2026
+
+#### Release Highlights
+
+Tyk AI Studio 2.1.0 is the first feature release on the 2.x line. It expands the range of AI providers you can manage, gives compliance teams visibility into what your guardrails are actually doing, and makes the platform easier to monitor and extend.
+
+**AWS Bedrock support**
+
+You can now connect [AWS Bedrock](/ai-management/ai-studio/llm-management) as an LLM provider, alongside OpenAI, Anthropic, and the other supported vendors. Bedrock works everywhere the other vendors do: in the chat interface, through the OpenAI-compatible API, with full streaming, and on Edge Gateways. Applications already built with the AWS SDK can call Bedrock through Tyk without any code changes, so you get governance, budgets, and analytics on top of your existing integration. The LLM setup form guides you through entering AWS credentials, which can be stored encrypted using AI Studio's secrets manager.
+
+**See what your guardrails are doing with Compliance Events**
+
+Until now, the Compliance dashboard could only show you requests that were blocked outright. In practice, most governance activity is quieter than that: a filter redacts an email address, rewrites a risky passage, or flags something suspicious while letting the request through. Those interventions were invisible.
+
+With [Compliance Events](/ai-management/ai-studio/compliance-events), your content filters can record exactly what they did and why. The events appear in a new Filter Events tab on the Compliance dashboard, where you can filter by severity, drill into the details, follow trends over time, and export everything to CSV for audits. Events recorded on Edge Gateways flow back to the central dashboard automatically. See [Filters](/ai-management/ai-studio/filters#compliance-event-reporting) to get started.
+
+**Monitor AI Studio with your existing tools**
+
+AI Studio and the Edge Gateway now publish [operational metrics](/ai-management/ai-studio/analytics#prometheus-and-opentelemetry-metrics) that Prometheus, Grafana, and OpenTelemetry-based tools can scrape out of the box: request volumes, token usage, cost, tool calls, policy blocks, and latency. Monitoring is on by default, so most teams just need to point their existing dashboards at it.
+
+**Keep sensitive conversations out of your logs**
+
+A new per-LLM setting, **Disable Request/Response Body Logging**, stops the content of requests and responses from being stored in logs and analytics for that provider. Usage counts, costs, and performance data are still recorded. This is designed for teams handling regulated or sensitive data who need usage visibility without retaining the conversations themselves.
+
+**New plugins**
+
+Enterprise customers get a new OAuth2 plugin that connects AI Studio to identity providers such as Auth0, Microsoft Entra ID, and Okta, automatically setting up access for new applications based on the permissions defined in your identity provider. The community plugin collection adds a flexible rate limiter for LLM traffic and a plugin that keeps model pricing up to date automatically.
+
+#### Breaking Changes
+
+**Custom analytics handlers need a small update.** This only affects you if your team has written a custom analytics handler plugin. The handler interface changed in this release, so custom implementations need their method signatures updated before upgrading. The details are in the [Plugin SDK Reference](/ai-management/ai-studio/plugins/sdk). If you only use the built-in analytics, no action is needed.
+
+#### Upgrade Instructions
+
+- **Database changes are automatic.** The schema updates itself on first startup after the upgrade; there is no manual migration step. One side effect: analytics recorded before the upgrade cannot be attributed to a specific LLM configuration, so older traffic will not appear in the new per-LLM detail views.
+
+#### Changelog
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='AWS Bedrock as an LLM provider'>
+We have added AWS Bedrock as a fully supported LLM vendor. Bedrock models work through the chat interface, the OpenAI-compatible API, and streaming connections, on both the embedded gateway and Edge Gateways. Applications built directly on the AWS SDK can point at Tyk and keep working unchanged, gaining authentication, budgets, and analytics on the way through. The LLM form includes dedicated AWS credential fields, and credentials can be kept encrypted at rest using the secrets manager. See [LLM Management](/ai-management/ai-studio/llm-management).
+</Accordion>
+
+<Accordion title='Compliance Events'>
+Content filters can now record structured events describing what they did: PII redacted, content rewritten, a policy matched, or an error quietly handled. Each event carries a severity (info, warning, or critical) and supporting detail.
+
+The Compliance dashboard surfaces these events with new summary cards for critical and warning activity, a clearer split between requests that were blocked and requests that were flagged but allowed through, risk scores that account for event severity, and a dedicated Filter Events tab with filtering, trends, and CSV export. Events from Edge Gateways are collected centrally and appear alongside everything else.
+
+The filter scripts that ship with AI Studio (PII redaction, content blocking, response guardrails) have been updated to record these events out of the box. See [Compliance Events](/ai-management/ai-studio/compliance-events).
+</Accordion>
+
+<Accordion title='Operational metrics for Prometheus and OpenTelemetry'>
+AI Studio and the Edge Gateway now expose a standard metrics endpoint covering request counts, token usage, cost, tool calls, policy blocks, latency, and in-flight requests. It works with Prometheus, Grafana, and any OpenTelemetry-based monitoring stack, and is enabled by default. See [Analytics & Monitoring](/ai-management/ai-studio/analytics#prometheus-and-opentelemetry-metrics) for the full list of metrics and configuration options.
+</Accordion>
+
+<Accordion title='Per-LLM control over body logging'>
+A new **Disable Request/Response Body Logging** option on each LLM keeps the content of requests and responses out of logs and analytics for that provider, while still recording usage, cost, and performance data. It applies on both the embedded gateway and Edge Gateways, and is switched off by default so existing behavior is unchanged.
+</Accordion>
+
+<Accordion title='Plugin SDK additions'>
+Plugin developers get three new capabilities: gateway plugins can register applications directly on an Edge Gateway (so access can be granted immediately rather than waiting for the next configuration sync), Studio plugins can read model pricing data, and new text-handling helpers prevent a class of errors when plugins process files in unusual encodings. See the [Plugin SDK Reference](/ai-management/ai-studio/plugins/sdk).
+</Accordion>
+
+<Accordion title='OAuth2 client credentials plugin (Enterprise)'>
+A new enterprise plugin connects AI Studio to external identity providers such as Auth0, Microsoft Entra ID, and Okta. When a new client authenticates for the first time, the plugin can automatically create its application in AI Studio from a template you define, mapped from the permissions assigned in your identity provider. Providers are managed from a new admin UI screen.
+</Accordion>
+
+<Accordion title='Community plugins: rate limiter and model price sync'>
+The community plugin collection gains a rate limiter for LLM traffic, with limits on requests, tokens, and concurrent calls that can target specific models or applications. It includes a shadow mode for trying out rules safely before enforcing them. A second new plugin keeps your model pricing table up to date automatically by syncing from a public pricing source on a schedule, with a dry-run mode and dashboard UI.
+</Accordion>
+
+<Accordion title='Export chat conversations to PDF'>
+Users can now export any chat conversation to PDF using the print button, in both standard and agent chats. See [Chat Interface](/ai-management/ai-studio/chat-interface).
+</Accordion>
+
+</AccordionGroup>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Analytics now distinguish between LLM configurations that share a vendor'>
+Previously, if you configured two connections to the same vendor (for example, separate Anthropic accounts for different departments), their traffic was mixed together in the LLM detail view. Each configuration now reports its own traffic, including traffic from Edge Gateways. Data recorded before the upgrade pre-dates this change and remains unattributed.
+</Accordion>
+
+<Accordion title='Stored secrets work in more places'>
+References to the secrets manager are now resolved consistently across more of the platform: in LLM provider settings (which is what enables encrypted AWS credentials for Bedrock), in data source connections used for RAG, when resuming chat sessions, and when configuration is synced to Edge Gateways. Previously some of these paths could receive a placeholder instead of the real credential.
+</Accordion>
+
+<Accordion title='Plugin reliability improvements'>
+Plugins now pick up configuration changes immediately instead of holding stale settings until a restart. Deleting and re-creating a plugin resource with the same name no longer fails. API responses now hide sensitive values in LLM metadata, and tool credentials are no longer returned in plain text by the admin API.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Bedrock authentication and analytics gaps'>
+Requests arriving through the OpenAI-compatible endpoint for Bedrock now go through the same application authentication, budget checks, and logging as every other route. Streaming Bedrock traffic is fully recorded in analytics, the model name is captured on all Bedrock paths, and records are no longer lost when a client disconnects right after a streaming response completes.
+</Accordion>
+
+
+<Accordion title='Security check no longer blocks the admin UI in development'>
+A browser security check (CSRF) was incorrectly rejecting legitimate requests in development setups and in the community quickstart, and in some cases requests could continue processing even after being rejected. Both issues are resolved.
+</Accordion>
+
+<Accordion title='File handling for international text'>
+Files containing accented characters, emoji, or non-standard encodings could fail during RAG document processing. Document chunking and file processing now handle these correctly.
+</Accordion>
+
+<Accordion title='Marketplace sync delay'>
+Manually triggering a plugin marketplace sync now fetches the latest catalog immediately, instead of sometimes receiving a cached copy.
+</Accordion>
+
+</AccordionGroup>
diff --git a/developer-support/release-notes/archived.mdx b/developer-support/release-notes/archived.mdx
new file mode 100644
index 0000000000..562c8865da
--- /dev/null
+++ b/developer-support/release-notes/archived.mdx
@@ -0,0 +1,1233 @@
+---
+title: "Archived Releases"
+description: "Tyk Old releases"
+keywords: "Tyk, Archived, Release notes, v2.4, v2.5, v2.6, v2.7, v2.8, v2.9, 2.9"
+sidebarTitle: "Archived Releases"
+---
+
+## 2.9.0 Release Notes
+
+### TCP Proxying
+
+Tyk now can be used as a reverse proxy for your TCP services. It means that you can put Tyk not only on top of your APIs, but on top of **any** network application, like databases, services using custom protocols and etc.
+
+The main benefit of using Tyk as your TCP proxy is that functionality you used to managed your APIs now can be used for your TCP services as well. Features like load balancing, service discovery, Mutual TLS (both authorization and communication with upstream), certificate pinning: all work exactly the same way as for your HTTP APIs.
+
+See our [TCP Proxy Docs](/key-concepts/tcp-proxy) for more details.
+
+### APIs as Products
+
+With this release we have removed all the barriers on how you can mix and match policies together, providing you with ultimate flexibility for configuring your access rules.
+
+Now a key can have multiple policies, each containing rules for different APIs. In this case each distinct policy will have its own rate limit and quota counters. For example if the first policy gives access to `API1` and second policy to `API2` and `API3`, if you create a key with both policies, your user will have access to all three APIs, where `API1` will have quotas and rate limits defined inside the first policy, and `API2`, `API3` will have shared quotas and rate limits defined inside the second policy.
+
+Additionally you can now mix policies defined for the same API but having different path and methods access rules. For example you can have one policy which allows only access to `/users` and a second policy giving user access to a `/companies` path. If you create a key with both policies, their access rules will be merged, and user will get access to both paths. See [Multiple APIs for single Key Requests](/tyk-developer-portal/tyk-portal-classic/portal-concepts#multiple-apis-for-a-single-key-request).
+
+#### Developer Portal Updates
+
+Developers now can have multiple API keys, and subscribe to multiple catalogs with a single key. Go to the Portal settings and set `Enable subscribing to multiple APIs with single key` option to enable this new flow. When enabled, developers will see the new API generation user interface, which allows users to request access to multiple Catalogs of the **same type** with a single key.
+
+From an implementation point of view, Developer objects now have a `Keys` attribute, which is the map where the key is a `key` and the value is an array of policy IDs. The `Subscriptions` field can be considered as deprecated, with retained backwards compatibility. We have added new set of Developer APIs to manage the keys, similar to the deprecated subscriptions APIs.
+
+Other changes:
+
+- Added two new Portal templates, which are used by a new key request flow `portal/templates/request_multi_key.html`, `portal/templates/request_multi_key_success.html`
+- The Portal Catalog list page has been updated to show the Catalog authentication mode
+- The API dashboard screen now show keys instead of subscriptions, and if subscribed to multiple policies, it will show the allowance rules for all catalogs.
+- The Key request API has been updated to accept an `apply_policies` array instead of `for_plan`
+
+### JWT and OpenID scope support
+
+Now you can set granular permissions on per user basis, by injecting permissions to the "scope" claim of a JSON Web Token. To make it work you need to provide mapping between the scope and policy ID, and thanks to enchanced policy merging capabilities mentioned above, Tyk will read the scope value from the JWT and will generate dynamic access rules. Your JWT scopes can look like `"users:read companies:write"` or similar, it is up to your imagination. OpenID supports it as well, but at the moment only if your OIDC provider can generate ID tokens in JWT format (which is very common this days).
+
+See our [JWT Scope docs](/basic-config-and-security/security/authentication-authorization/json-web-tokens) for more details.
+
+### Go plugins
+
+[Go](https://golang.org/) is an open source programming language that makes it easy to build simple, reliable, and efficient software. The whole Tyk stack is written in Go language, and it is one of the reasons of behind our success.
+
+With this release you now can write native Go plugins for Tyk. Which means extreme flexibility and the best performance without any overhead.
+
+Your plugin can be as simple as:
+
+```{.go}
+package main
+import (
+	"net/http"
+)
+// AddFooBarHeader adds custom "Foo: Bar" header to the request
+func AddFooBarHeader(rw http.ResponseWriter, r *http.Request) {
+	r.Header.Add("Foo", "Bar")
+}
+```
+
+See our [Golang plugin documentation](/api-management/plugins/golang#) for more details.
+
+### Distributed tracing
+
+We have listened to you, and tracing is recently one of your most common requests. Distributed tracing takes your monitoring and profiling experience to the next level, since you can see the whole request flow, even if it has complex route though multiple services. And inside this flow, you can go deep down into the details like individual middleware execution performance.
+At the moment we are offering [OpenTracing](https://opentracing.io/) support, with [Zipkin](https://zipkin.io/) and [Jaeger](https://www.jaegertracing.io/) as supported tracers.
+
+See our [Distributed Tracing documentation](/api-management/traces) for more details.
+
+### HMAC request signing
+
+Now Tyk can sign a request with HMAC, before sending to the upsteam target.
+
+This feature is implemented using [Draft 10](https://tools.ietf.org/html/draft-cavage-http-signatures-10) RFC.
+
+`(request-target)` and all the headers of the request will be used for generating signature string.
+If the request doesn't contain a `Date` header, middleware will add one as it is required according to above draft.
+
+A new config option `request_signing` can be added in an API Definition to enable/disable the request signing. It has following format:
+
+```{.json}
+"request_signing": {
+  "is_enabled": true,
+  "secret": "xxxx",
+  "key_id": "1",
+  "algorithm": "hmac-sha256"
+}
+```
+
+The following algorithms are supported:
+
+1. `hmac-sha1`
+2. `hmac-sha256`
+3. `hmac-sha384`
+4. `hmac-sha512`
+
+### Simplified Dashboard installation experience
+
+We worked a lot with our clients to build a way nicer on-boarding experience for Tyk. Instead of using the command line, you can just run the Dashboard, and complete a form which will configure your Dashboard. However, we did not forget about our experienced users too, and now provide a CLI enchanced tool for bootstrapping Tyk via a command line.
+
+See our updated [Getting Started](/tyk-self-managed/install) section and [new CLI documentation](/tyk-self-managed).
+
+### DNS Caching
+
+Added a global DNS cache in order to reduce the number of request to a Gateway's local DNS server and the appropriate gateway config section. This feature is turned off by default.
+
+```
+"dns_cache": {
+    "enabled": true, //Turned off by default
+    "ttl": 60, //Time in seconds before the record will be removed from cache
+    "multiple_ips_handle_strategy": "pick_first" //A strategy, which will be used when dns query will reply with more than 1 ip address per single host.
+},
+```
+
+### Python Plugin Improvements
+
+We have completed a massive rewrite of our Python scripting engine in order to simplify the installation and usage of Python scripts. From now on, you no longer need to use a separate Tyk binary for Python plugins. Everything is now bundled to the main binary.
+This also means that you can combine JSVM, Python and Coprocess plugins inside the same installation.
+In addition you can now use any Python 3.x version. Tyk will automatically detect a supported version and will load the required libraries. If you have multiple Python versions available, you can specify the exact version using `python_version`.
+
+### Importing Custom Keys using the Dashboard API
+
+Previously if you wanted migrate to Tyk and keep existing API keys, you had to use our low level Tyk Gateway API, which has lot of constraints, especially regarding complex setups with multiple organizations and data centers.
+
+We have introduced a new Dashboard API for importing custom keys, which is as simple as `POST /api/keys/{custom_key} {key-payload}`. This new API ensures that Keys from multiple orgs will not intersect, and it also works for multi-data center setups, and even Tyk SaaS.
+
+### Single sign on for the Tyk SaaS
+
+Before SSO was possible only for Tyk On-Premise, since it required access to low-level Dashboard Admin APIs. With 2.9 we have added new a new Dashboard SSO API, which you can use without having super admin access, and it works at the organization level. This means that all our Tyk SaaS users can use 3rd party IDPs to manage Dashboard users and Portal developers.
+
+> **NOTE**: This feature is available by request. Please contact our sales team for details.
+
+See our [Dashboard SSO documentation](https://tyk.io/docs/api-reference/single-sign-on/generate-authentication-token) for more details.
+
+### Importing WSDL APIs
+
+WSDL now is a first class citizen at Tyk. You can take your WSDL definition and simply import to the Dashboard, creating a nice boilerplate for your service. See [Import APIs](/api-management/gateway-config-managing-classic#import-an-api) for more details.
+
+### Updated Versions
+
+- Tyk Gateway 2.9.0
+- Tyk Dashboard 1.9.0
+- Tyk Pump 0.8.0
+- Tyk MDCB 1.7.0
+
+### Upgrading From Version 2.8
+
+#### Tyk On-Premises
+
+For this release, you should upgrade your Tyk Pump first.
+
+#### Tyk MDCB
+
+For this release, you should upgrade your MDCB component first.
+
+## 2.8.0 Release Notes
+### Debugger
+
+You can now safely test all API changes without publishing them, and visually see the whole request flow, including which plugins are running and even their individual logs.
+
+We have added a new `Debugging` tab in the API designer which provides a "Postman" like HTTP client interface to simulate queries for the current API definition being edited.
+
+You can even debug your virtual endpoints by dynamically modifying the code, sending the request via `Debugger` and watching the virtual endpoint plugin logs.
+
+See [Debugging Tab](/api-management/endpoint-designer#debugging) for more information.
+
+---
+
+### Developer portal oAuth support
+
+The Developer portal now fully supports exposing oAuth2 APIs:
+
+*  Developers can register their oAuth clients and see analytics
+*  Administrators can see list of oAuth clients from a developer screen
+
+---
+
+### Multi-organization users
+
+NOTE: Currently only available with >2 node Dashboard license.
+
+You can now create users with the same email address in different organizations. Users will then be able to select an organization 
+when logging in, and can easily switch between organizations via the navigation menu. To enable set 
+`"enable_multi_org_users": true`.
+
+---
+
+### Developer management improvements
+
+* You can now manually create developer subscriptions from the developer screen.
+* We've added a quick way to change a subscription policy and reset a quota
+* All actions on the developer screen now only require developer permissions 
+
+### Dashboard Audit Log improvements
+
+There is a [new section](/api-management/logs/audit-logs) in the Tyk Dashboard config file where you can specify parameters for the audit log (containing audit records for all requests made to all endpoints under the `/api` route).
+
+---
+
+
+### Detailed changelog
+
+- Added API Debugger tab to the API Designer.
+- Extended the Portal templating functionality.
+- Similar to the Gateway, you now can specify a list of acceptable TLS ciphers using the  
+  `http_server_options.cipher_suites` array option.
+- Audit log improvements
+- Exposing oAuth2 APIs to developer portal
+- Allow for the retrieval of an API via it's external API
+- Allow updating keys by hash
+- Added support for `SMTP` noauth.
+
+## <a name="new"></a> 2.7.0 Release Notes
+
+### <a name="gateway"></a>Tyk Gateway v2.7.0
+
+#### Performance improvements
+
+
+> **TLDR**
+> To get benefit or performance improvements ensure that you have `close_connections` set to `false` and set `max_idle_connections_per_host` according to our [production perfomance guide](/planning-for-production)
+
+We have thoroughly analyzed every part of our Gateway, and the results are astounding, up to 160% improvement, compared to our 2.6 release.
+
+Such a performance boost comes from various factors, such as optimizing our default configs, better HTTP connection re-use, optimization of the analytics processing pipeline, regexp caching, doing fewer queries to the database, and numerous small changes in each of the  middleware we have.
+
+Our performance testing plan was focused on replicating our customer's setup, and try not to optimize for “benchmarks”: so no supercomputers and no sub-millisecond inner DC latency. Instead, we were testing on average performance 2 CPU Linode machine, with 50ms latency between Tyk and upstream. For testing, we used the Tyk Gateway in Hybrid mode, with a default config, except for a single 2.7 change where `max_idle_connections_per_host ` is set to 500, as apposed to 100 in 2.6. Test runner was using [Locust](https://locust.io/) framework and [Boomer](https://github.com/myzhan/boomer) for load generation.
+
+For a keyless API we were able to achieve 3.7K RPS (requests per second) for 2.7, while 2.6 showed about 2.5K RPS, which is a 47% improvement.
+
+For protected APIs, when Tyk needs to track both rate limits and quotas, 2.7 shows around 3.1K RPS, while 2.6 shows around 1.2K RPS, which is 160% improvement!
+
+In 2.7 we optimized the connection pool between Tyk and upstream, and previously `max_idle_connections_per_host` option was capped to 100. In 2.7 you can set it to any value. `max_idle_connections_per_host` by itself controls an amount of keep-alive connections between clients and Tyk. If you set this value too low, then Tyk will not re-use connections and will have to open a lot of new connections to your upstream. If you set this value too big, you may encounter issues with slow clients occupying your connection and you may reach OS limits. You can calculate the correct value using a straightforward formula: if latency between Tyk and Upstream is around 50ms, then a single connection can handle 1s / 50s = 20 requests. So if you plan to handle 2000 requests per second using Tyk, the size of your connection pool should be at least 2000 / 20 = 100. For example, on low-latency environments (like 5ms), a connection pool of 100 connections will be enough for 20k RPS.
+
+To get the benefit of optimized connection pooling, ensure that `close_connections` is set to `false`, which enables keep-alive between Tyk and Upstream.
+
+#### Custom key hashing algorithms
+
+Key hashing is a security technique introduced inside Tyk a long time ago, which allows you to prevent storing your API tokens in database, and instead, only store their hashes. Only API consumers have access to their API tokens, and API owners have access to the hashes, which gives them access to usage and analytics in a secure manner. Time goes on, algorithms age, and to keep up with the latest security trends, we introduce a way to change algorithms used for key hashing.
+
+This new feature is in public beta, and turned off by default, keeping old behavior when Tyk uses `murmur32` algorithm. To set the custom algorithm, you need to set `hash_key_function` to one of the following options:
+- `murmur32`
+- `murmur64`
+- `murmur128`
+- `sha256`
+
+MurMur non-cryptographic hash functions is considered as industry fastest and conflict-prone algorithms up to date, which gives a nice balance between security and performance. With this change you now you may choose the different hash length, depending on your organization security policies. As well, we have introduced a new `sha256` **cryptographic** key hashing algorithm, for cases when you are willing to sacrifice performance with additional security.
+
+Performance wise, setting new key hashing algorithms can increase key hash length, as well as key length itself, so expect that your analytics data size to grow (but not that much, up to 10%). Additionally, if you set the `sha256` algorithm, it will significantly slowdown Tyk, because `cryptographic` functions are slow by design but very secure.
+
+Technically wise, it is implemented by new key generation algorithms, which now embed additional metadata to the key itself, and if you are curious about the actual implementation details, feel free to check the following [pull request](https://github.com/TykTechnologies/tyk/pull/1753).
+
+Changing hashing algorithm is entirely backward compatible. All your existing keys will continue working with the old `murmur32` hashing algorithm, and your new keys will use algorithm specified in Tyk config. Moreover, changing algorithms is also backward compatible, and Tyk will maintain keys multiple hashing algorithms without any issues.
+
+
+### Tyk Dashboard v1.7.0
+
+#### User Groups
+
+Instead of setting permissions per user, you can now [create a user group](/platform-management/user-groups), and assign it to multiple users. It works for Single Sign-On too, just specify group ID during [SSO API](https://tyk.io/docs/api-reference/single-sign-on/generate-authentication-token) flow.
+
+This feature is available to all our Cloud and Hybrid users. For Self-Managed installations, this feature is available for customers with an "Unlimited" license.
+
+To manage user groups, ensure that you have either admin or “user groups” permission for your user, which can be enabled by your admin.
+
+From an API standpoint, user groups can be managed by [new Dashboard API](https://tyk.io/docs/api-reference/usergroup/list-user-groups). The User object now has a new `group_id` field, and if it is specified, all permissions will be inherited from the specified group. [SSO API](https://tyk.io/docs/api-reference/single-sign-on/generate-authentication-token) has been updated to include `group_id` field as well.
+
+#### Added SMTP support
+Now you can configure the Dashboard to send transactional emails using your SMTP provider. See [Outbound Email Configuration](/configure/outbound-email-configuration) for details.
+
+#### <a name="upgrade"></a>Upgrading all new Components
+
+For details on upgrading all Tyk versions, see [Upgrading Tyk](/developer-support/upgrading).
+
+### <a name="new"></a>Don't Have Tyk Yet?
+
+Get started now, for free, or contact us with any questions.
+
+* [Get Started](https://tyk.io/pricing/compare-api-management-platforms/#get-started)
+* [Contact Us](https://tyk.io/about/contact/)
+
+
+## <a name="new"></a> 2.6.0 Release Notes
+
+### <a name="gateway"></a>Tyk Gateway v2.6.0
+
+#### Organization Level Rate Limiting
+
+Endpoints Create organization keys and 
+Add/update organization keys now allow you to set rate limits at an organization level. You will need to add the following fields in your create/add/update key request:
+
+* `"allowance"`
+* `"rate"`
+
+These are the number of allowed requests for the specified `per` value, and need to be set to the same value.
+
+* `"per"` is the time period, in seconds.
+
+So, if you want to restrict an organization rate limit to 100 requests per second you will need to add the following to your request:
+```
+  "allowance": 100,
+  "rate": 100,
+  "per": 5
+```
+
+> **NOTE:** if you don't want to have organization level rate limiting, set `"rate"` or `"per"` to zero, or don't add them to your request.
+
+See the Keys section of the [Tyk Gateway REST API](/tyk-gateway-api) Swagger doc for more details.
+
+#### Keys hashing improvements
+
+Now it is possible to do more operations with key by hash (when we set `"hash_keys":` to `true` in `tyk.conf`):
+
+- endpoints `POST /keys/create`, `POST /keys` and `POST /keys/{keyName}` also return field `"key_hash"` for future use
+- endpoint `GET /keys` get all (or per API) key hashes. You can disable this endpoint by using the new `tyk.conf` setting `enable_hashed_keys_listing` (set to false by default)
+- endpoint `GET /keys/{keyName}` was modified to be able to get a key by hash. You just need provide the key hash as a `keyName` 
+and call it with the new optional query parameter `hashed=true`. So the new format is `GET /keys/{keyName}?hashed=true"`
+- also, we already have the same optional parameter for endpoint `DELETE /keys/{keyName}?hashed=true`
+
+#### JSON schema validation
+
+You can now use Tyk to verify user requests against a specified JSON schema and check that the data sent to your API by a consumer is in the right format. This means you can offload data validation from your application to us.
+
+If it's not in the right format, then the request will be rejected. And even better, the response will be a meaningful error rather than just a 'computer says no'.
+
+Schema validation is implemented as for the rest of our plugins, and its configuration should be added to `extended_paths` in the following format:
+```
+"validate_json": [{
+  "method": "POST",
+  "path": "me",
+  "schema": {..schema..}, // JSON object
+  "error_response_code": 422 // 422 default however can override.
+}]
+```
+
+The schema must be a draft v4 JSON Schema spec, see http://json-schema.org/specification-links.html#draft-4 for details. An example schema can look like this:
+```
+{
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "firstName": {
+      "type": "string"
+    },
+    "lastName": {
+      "type": "string"
+    },
+    "age": {
+      "description": "Age in years",
+      "type": "integer",
+      "minimum": 0
+    }
+  },
+  "required": ["firstName", "lastName"]
+}
+```
+
+#### New endpoint to get list of tokens generated for provided OAuth-client
+
+`GET /oauth/clients/{apiID}/{oauthClientId}/tokens`
+
+This endpoint allows you to retrieve a list of all current tokens and their expiry date issued for a provided API ID and OAuth-client ID in the following format. New endpoint will work only for newly created tokens:
+```
+[
+  {
+    "code": "5a7d110be6355b0c071cc339327563cb45174ae387f52f87a80d2496",
+    "expires": 1518158407
+  },
+  {
+    "code": "5a7d110be6355b0c071cc33988884222b0cf436eba7979c6c51d6dbd",
+    "expires": 1518158594
+  },
+  {
+    "code": "5a7d110be6355b0c071cc33990bac8b5261041c5a7d585bff291fec4",
+    "expires": 1518158638
+  },
+  {
+    "code": "5a7d110be6355b0c071cc339a66afe75521f49388065a106ef45af54",
+    "expires": 1518159792
+  }
+]
+```
+
+You can control how long you want to store expired tokens in this list using `oauth_token_expired_retain_period ` which specifies the retain period for expired tokens stored in Redis. The value is in seconds, and the default value is `0`. Using the default value means expired tokens are never removed from Redis.
+
+#### Creating OAuth clients with access to multiple APIs
+
+When creating a client using `POST /oauth/clients/create`, the `api_id` is now optional - these changes make the endpoint more generic. If you provide the `api_id` it works the same as in previous releases. If you don't provide the `api_id` the request uses policy access rights and enumerates APIs from their setting in the newly created OAuth-client. 
+
+At the moment this changes not reflected on Dashboard UI yet, as we going to do major OAuth improvements in 2.7
+
+#### Certificate public key pinning
+
+Certificate pinning is a feature which allows you to allow public keys used to generate certificates, so you will be protected in case an upstream certificate is compromised.
+
+Using Tyk you can allow one or multiple public keys per domain. Wildcard domains are also supported.
+
+Public keys are stored inside the Tyk certificate storage, so you can use Certificate API to manage them.
+
+You can define them globally, from the Tyk Gateway configuration file using the `security.pinned_public_keys` option, or via an API definition `pinned_public_keys` field, using the following format:
+```
+{
+  "example.com": "<key-id>",
+  "foo.com": "/path/to/pub.pem",
+  "*.wild.com": "<key-id>,<key-id-2>"
+}
+```
+
+For `key-id` you should set the ID returned after you upload the public key using the Certificate API. Additionally, you can just set path to public key, located on your server. You can specify multiple public keys by separating their IDs by a comma.
+
+Note that only public keys in PEM format are supported.
+
+If public keys are not provided by your upstream, you can extract them
+by yourself using the following command:
+> openssl s_client -connect the.host.name:443 | openssl x509 -pubkey -noout
+
+If you already have a certificate, and just need to get its public key, you can do it using the following command:
+> openssl x509 -pubkey -noout -in cert.pem
+
+**Note:** Upstream certificates now also have wildcard domain support
+
+#### JQ transformations (experimental support)
+
+> This feature is experimental and can be used only if you compile Tyk yourself own using `jq` tag: `go build --tags 'jq'`
+
+If you work with JSON you are probably aware of the popular `jq` command line JSON processor. For more details, see here https://stedolan.github.io/jq/
+
+Now you can use the full power of its queries and transformations to transform requests, responses, headers and even context variables.
+
+We have added two new plugins: 
+
+* `transform_jq` - for request transforms.
+* `transform_jq_response` - for response transforms
+ 
+Both have the same structure, similar to the rest of our plugins: 
+`{ "path": "<path>", "method": "<method>", "filter": "<content>" }`
+
+#### Request Transforms
+Inside a request transform you can use following variables: 
+* `.body` - your current request body
+* `._tyk_context` - Tyk context variables. You can use it to access request headers as well.
+
+Your JQ request transform should return an object in the following format: 
+`{ "body": <transformed-body>, "rewrite_headers": <set-or-add-headers>, "tyk_context": <set-or-add-context-vars> }`. 
+
+`body` is required, while `rewrite_headers` and `tyk_context` are optional.
+
+
+#### Response Transforms 
+Inside a response transform you can use following variables: 
+* `.body` - your current response body
+* `._tyk_context` - Tyk context variables. You can use it to access request headers as well.
+* `._tyk_response_headers` - Access to response headers
+
+Your JQ response transform should return an object in the following format: 
+`{ "body": <transformed-body>, "rewrite_headers": <set-or-add-headers>}`. 
+
+`body` is required, while `rewrite_headers` is optional.
+
+#### Example
+```
+"extended_paths": {
+  "transform_jq": [{
+    "path": "/post",
+    "method": "POST",
+    "filter": "{\"body\": (.body + {\"TRANSFORMED-REQUEST-BY-JQ\": true, path: ._tyk_context.path, user_agent: ._tyk_context.headers_User_Agent}), \"rewrite_headers\": {\"X-added-rewrite-headers\": \"test\"}, \"tyk_context\": {\"m2m_origin\": \"CSE3219/C9886\", \"deviceid\": .body.DEVICEID}}"
+   }],
+  "transform_jq_response": [{
+    "path": "/post",
+    "method": "POST",
+    "filter": "{\"body\": (.body + {\"TRANSFORMED-RESPONSE-BY-JQ\": true, \"HEADERS-OF-RESPONSE\": ._tyk_response_headers}), \"rewrite_headers\": {\"JQ-Response-header\": .body.origin}}"
+  }]
+}
+```
+
+
+### <a name="dashboard"></a>Tyk Dashboard v1.6.0
+
+#### API categories
+
+You can apply multiple categories to an API definition, and then filter by these categories on the API list page.
+
+They might refer to the APIs general focus: 'weather', 'share prices'; geographic location 'APAC', 'EMEA'; or technical markers 'Dev', 'Test'. It's completely up to you.
+
+From an API perspective, categories are stored inside API definition `name` field like this: "Api name #category1 #category2", e.g. categories just appended to the end of the name. 
+
+Added new API `/api/apis/categories` to return list of all categories and belonging APIs.
+
+#### Raw API Definition mode
+
+Now you can directly edit a raw API definition JSON object directly from the API Designer, by selecting either the **Raw API Definition** or the **API Designer** at the top of the API Designer screen. 
+
+<img src="/img/dashboard/system-management/raw_or_designer_mode.png" alt="Raw or Designer" />
+
+This feature comes especially handy if you need copy paste parts of one API to another, or if you need to access fields not yet exposed to the Dashboard UI.
+
+#### Certificate public key pinning
+
+You can configure certificate pinning on the **Advanced** tab of the API Designer, using a similar method to how you specify upstream client certificates.
+
+<img src="/img/release-notes/certificate_pinning.png" alt="Certificate Pinning" />
+
+#### JSON schema validation
+
+Reflecting the Tyk Gateway changes, on the Dashboard we have added a new **Validate JSON** plugin, which you can specify per URL, and can set both a schema, and custom error code, if needed.
+
+#### Improved key hashing support
+
+The Tyk Dashboard API reflects changes made in the v2.6.0 Gateway API, and now supports more operations with key by hash (when we have set `"hash_keys":` to ` true` in `tyk_analytics.conf`):
+
+- endpoint `POST /keys/` also returns a new field `key_hash` per each key in the list
+- endpoint `GET /apis/{apiId}/keys/{keyId}` supports query string parameter `hashed=true` to get the key info via hash
+- endpoint `GET /apis/{apiId}/keys` returns keys hashes
+- endpoint `DELETE /apis/{apiId}/keys?hashed=true` can delete a key by its hash, but its functionality is disabled by default, unless you set `enable_delete_key_by_hash` boolean option inside the Dashboard configuration file. 
+
+
+#### Key requests management API now supports OAuth
+
+For this release we've improved our developer portal APIs to fully support an OAuth2.0 based workflow. Developers using your API will now be able to register OAuth clients and manage them.
+
+This change is not yet supported by our built-in portal, but if you are using custom developer portals, you can start using this new functionality right away. Full UI support for built-in portal will be shipped with our next 2.7 release.
+
+Developers can request access to an API protected with OAuth and get OAuth client credentials.
+
+The endpoint `POST /api/portal/requests` now has an optional `"oauth_info"` field which identifies the OAuth key request.
+
+Example of the OAuth key request:  
+```
+{
+  "by_user": "5a3b2e7798b28f03a4b7b3f0",
+  "date_created": "2018-01-15T04:49:20.992-04:00",
+  "for_plan": "5a52dfce1c3b4802c10053c8",
+  "version": "v2",
+  "oauth_info": {
+    "redirect_uri": "http://new1.com,http://new2.com"
+  }
+}
+```
+
+Where:
+
+- `"by_user"` - contains the ID of portal developer who is requesting OAuth access
+- `"for_plan"` - subscription ID
+- `"version"` - is expected to have the value `"v2"`
+- `"oauth_info"` - simple structure which contains a field with comma-separated list of redirect URI for OAuth flow
+
+A new field `"oauth_info"` will be present in replies for endpoints `GET /api/portal/requests/{id}` and `GET /api/portal/requests`
+
+When this kind of OAuth key request gets approved when using endpoint `PUT /api/portal/requests/approve/{id}` 
+a new OAuth-client is generated for a developer specified in the specified `"by_user"` field.
+
+Example of OAuth key request approval reply:
+```
+{
+    "client_id": "203defa5162b42708c6bcafcfa28c9fb",
+    "secret": "YjUxZDJjNmYtMzgwMy00YzllLWI2YzctYTUxODQ4ODYwNWQw",
+    "policy_id": "5a52dfce1c3b4802c10053c8",
+    "redirect_uri": "http://new1.com,http://new2.com"
+}
+```
+
+Where:
+
+- `"client_id"` and `"secret"` are OAuth-client credentials used to request the get token (they are to be kept in secret)
+- `"policy_id"` - the subscription this OAuth-client provides access to
+- `"redirect_uri"` - with comma-separated list of redirect URI for OAuth flow
+
+Also, if you set email notifications in your portal, an email with the  OAuth-client credentials will be sent to the developer 
+who made that OAuth key request.
+
+There is also a change in the reply from the `GET /api/portal/developers` endpoint.The developer object will have new field - 
+`"oauth_clients"` which will contain a mapping of subscription IDs to the list of OAuth clients that the developer requested and
+was approved, i.e.:
+```
+"oauth_clients": {
+  "5a52dfce1c3b4802c10053c8": [
+    {
+      "client_id": "203defa5162b42708c6bcafcfa28c9fb",
+      "redirect_uri": "http://new1.com,http://new2.com",
+      "secret": "YjUxZDJjNmYtMzgwMy00YzllLWI2YzctYTUxODQ4ODYwNWQw"
+    }
+  ]
+},
+```
+
+#### New endpoints to get tokens per OAuth client
+
+These endpoints allow you to get a list of all current tokens issued for provided OAuth client ID:
+
+- `GET /apis/oauth/{apiId}/{oauthClientId}/tokens`
+- `GET /apis/oauth/{oauthClientId}/tokens` when the API ID is unknown or OAuth-client provides access to several APIs
+
+
+#### Renamed the response `_id` field to `id` in List Key Requests
+
+We have renamed the response `_id` field when retrieving a list of key requests to `id`.
+
+See [List Key Requests](/tyk-apis/tyk-dashboard-api/manage-key-requests#list-key-requests) for more details.
+
+
+#### Developers can request a password reset email
+
+If a developer forgets their password, they can now request a password reset email from the Developer Portal Login screen.
+
+<img src="/img/dashboard/portal-management/password_request.png" alt="Request email reset" />
+
+See [Developer Profiles](/tyk-developer-portal/tyk-portal-classic/developer-profiles#reset-developer-password) for more details.
+
+#### SSO API custom email support
+
+Now you can set email address for users logging though the Dashboard SSO API, by adding an "Email" field to the JSON payload which you sent to `/admin/sso` endpoint. For example:
+```
+POST /admin/sso HTTP/1.1
+Host: localhost:3000
+admin-auth: 12345
+    
+{
+  "ForSection": "dashboard",
+  "Email": "user@example.com",
+  "OrgID": "588b4f0bb275ff0001cc7471"
+}
+```
+
+#### Set Catalog settings for each individual API 
+
+Now you can override the global catalog settings and specify settings per catalog. 
+The Catalog object now has `config` field, with exactly same structure as Portal Config, except new `override` boolean field. 
+If set, Catalog settings will override global ones. 
+
+At the moment the following options can be overriden: `Key request fields`, `Require key approval` and `Redirect on key request` (with `Redirect to` option as well).
+
+#### <Tooltip tip="A list of blocked or denied items or entries">Blocklist</Tooltip> IP Support
+
+Tyk allows you to block IP Addresses, which is located in the **Advanced Options** tab in the **Endpoint Designer**.
+
+<img src="/img/release-notes/blacklist_option.png" alt="Blocklist Support" />
+
+### <a name="tib"></a>Tyk Identity Broker v0.4.0
+
+With this release TIB joins the Tyk product line as a first class citizen and is now distributed via packages and [Docker image](https://hub.docker.com/r/tykio/tyk-identity-broker/).
+
+#### Support for SSO API email field
+If IDP provides a user email, it should be passed to the Dashboard SSO API, and you should see it in the Dashboard UI.
+
+#### Improved support for local IDPs
+If you run a local IDP, like Ping, with an untrusted SSL certificate, you can now turn off SSL verification by setting `SSLInsecureSkipVerify` to `true` in the TIB configuration file. 
+
+#### Added Redis TLS support
+To enable set `BackEnd.UseSSL` and, optionally, `BackEnd.SSLInsecureSkipVerify`.
+
+### <a name="tib"></a>Tyk Pump v0.5.2
+
+#### Redis TLS support
+Added new `redis_use_ssl` and `redis_ssl_insecure_skip_verify` options.
+
+
+### <a name="redis"></a> Redis TLS support
+
+Many Redis hosting providers now support TLS and we're pleased to confirm that we do too.
+
+Whether it's the open source API Gateway, or Dashboard, Pump, Sink and Tyk Identity Broker (TIB): you can now make secure connections to Redis from all Tyk products, as long as your provider allows it.
+
+### <a name="mdcb"></a>MDCB v1.5.3
+
+#### Redis TLS support
+Added new `redis_use_ssl` and `redis_ssl_insecure_skip_verify` options.
+
+### <a name="upgrade"></a>Upgrading all new Components
+
+For details on upgrading all Tyk versions, see [Upgrading Tyk](https://tyk.io/docs/upgrading-tyk/).
+
+### <a name="new"></a>Don't Have Tyk Yet?
+
+Get started now, for free, or contact us with any questions.
+
+* [Get Started](https://tyk.io/pricing/compare-api-management-platforms/#get-started)
+* [Contact Us](https://tyk.io/about/contact/)
+
+## <a name="new"></a>2.5.0 Release Notes
+
+This release touches all our products and brings you numerous features and fixes. Here are the packages and their versions we are releasing today: Tyk Gateway v2.5.0, Tyk Dashboard v1.5.0, Tyk Pump v0.6.0, MDCB v1.5.0, TIB v0.3.
+
+
+### <a name="major-highlights"></a>Major Highlights
+
+#### <a name="dashboard"></a>New Dashboard Look and Feel
+
+Our Dashboard has had a UI overhaul, with the following improvements:
+
+* A more modern, fun look and feel
+* Consistent layouts and action buttons across each section
+* Better feedback on errors and updates
+* Various UX improvements
+
+#### <a name="sso"></a>SSO with OpenId Identity Providers
+
+With TIB v0.3 we have made it possible to integrate any OpenID supported Identity provider with Tyk so you can configure Single Sign On (SSO), if the provider supports those.
+
+#### <a name="search"></a>Searching API and Policies List
+
+This long awaited feature has been added on the Dashboard UI.
+
+#### <a name="versioning"></a>Default API Versioning
+
+You can now specify a default API version when using a versioning strategy.
+
+#### <a name="pump"></a>Tyk Pump with MDCB
+
+We've added MDCB support in this release of Tyk Pump
+
+### <a name="gateway"></a>Tyk Gateway v2.5.0
+
+#### New Relic Instrumentation Support
+
+We have added support for New Relic Instrumentation using:
+
+`"newrelic": {"app_name": "<app-id>", "license_key": "<key>"}`
+
+[Docs](/api-management/logs-metrics#statsd-instrumentation)
+
+#### Default API Versioning
+
+You can now specify a default API version, and it will be used if a version is not set via headers, or URL parameters. Use the new option:
+
+`spec.version_data.default_version`
+
+[Docs](/api-management/gateway-config-tyk-classic#tyk-classic-api-versioning)
+
+#### Disable URL Encoding
+
+You can disable URL encoding using a new boolean `http_server_options` setting:
+ 
+`skip_target_path_escaping`
+
+[Docs](/tyk-oss-gateway/configuration#http_server_options)
+
+#### Enable Key Logging
+
+By default all key ids in logs are hidden. You can now turn it on if you want to see them for debugging reasons using the `enable_key_logging` option.
+
+[Docs](/tyk-oss-gateway/configuration#enable_key_logging)
+
+
+#### Specify TLS Cipher Suites
+
+We have added support for specifying allowed  SSL ciphers using the following option:
+
+`http_server_options - ssl_ciphers`
+
+[Docs](/api-management/certificates)
+
+### <a name="plugins"></a>Plugins Updates
+
+* Coprocess plugins now have access to `config_data`
+* The JSVM `spec` object now has access to `APIID` and `OriginID` to reflect similar functionality of Coprocess plugins.
+* Plugins now have access to Host HTTP Header.
+
+[JSVM Docs](/api-management/plugins/javascript#using-javascript-with-tyk)
+[Plugin Data Structure Docs](/api-management/plugins/rich-plugins#rich-plugins-data-structures)
+
+
+### <a name="dashboard"></a>Tyk Dashboard v1.5.0
+
+#### A Fresh Look and Feel
+
+With this release we have refreshed the entire Dashboard UI with a new look-and-feel, bringing with it such improvements as:
+
+* A more modern, fun look and feel
+* Consistent layouts and action buttons across each section
+* Better feedback on errors and updates
+* UX improvements
+
+#### Search on API and Policy List Pages
+
+We have added API and Policy search functionality, which should help those with long lists.
+
+* [API Docs](https://tyk.io/docs/api-reference/apis/get-list-of-apis)
+* [Policy Docs](/tyk-apis/tyk-dashboard-api/portal-policies)
+
+#### A New, Interactive Getting Started Walkthrough
+
+We have swapped out the old Getting started tutorial and added a new interactive one, which should make it easier for new users to get started with the Dashboard UI.
+
+#### Advanced URL Rewrites
+
+We have extended the URL Rewrite plugin functionality by enabling users to create more advanced rewrite rules based on Header matches, Query string variable/value matches, Path part matches, (i.e. components of the path itself), Session metadata values, and Payload matches.
+
+[Docs](/transform-traffic/url-rewriting)
+
+#### Portal Session Lifetime
+
+You can now control the portal session lifetime using the `portal_session_lifetime` config variable.
+
+[Docs](https://tyk.io/docs/configure/tyk-dashboard-configuration-options/)
+
+#### Configure Port for WebSockets
+
+We have added `notifications_listen_port` option to configure the port used by WebSockets for real-time notifications.
+
+[Docs](/tyk-oss-gateway/configuration)
+
+#### Slug
+
+Once set, the API slug will no longer be overridden when the API title is changed.
+
+#### Custom Domain
+
+We have fixed the API URL if a custom domain is set.
+
+
+### <a name="pump"></a> Tyk Pump v0.5.0
+
+#### Splunk Support
+
+We added support for forwarding analytics data to Splunk. A sample configuration is:
+
+```
+"pumps": {
+  "splunk": {
+    "name": "splunk",
+    "meta": {
+      "collector_token": "<secret>",
+      "collector_url": "https://<your-id>.cloud.splunk.com:
+                    8088",
+        "ssl_insecure_skip_verify": true
+    }
+  }
+},
+```
+
+#### <a name="analytics"></a>Analytics Collection Capping
+
+Detailed analytics collection capping is now enabled by default and configurable via the `collection_cap_enable` and `collection_cap_max_size_bytes` options.
+
+
+
+### <a name="mdcb"></a> MDCB v1.5.0
+
+We've introduced long awaited support for using Tyk Pump in conjunction with MDCB to use any of services supported by Tyk Pump, like ElasticSearch, Splunk and etc. This works by setting `forward_analytics_to_pump` to true, which disables analytics processing by MDCB itself, and enables the forwarding of all data to Tyk Pump running inside your management environment.
+
+
+### <a name="tib"></a>TIB v0.3
+  
+With this release, you now can use any OpenID Connect compatible provider with TIB. This means that you can use almost any Identity management solution, supporting OpenID, like Okta, Ping or Keycloak.
+ 
+Use `SocialProvider` with the following options:
+
+```
+"UseProviders": [{
+  "Name": "openid-connect",
+  "Key": "CLIENT-KEY",
+  "Secret": "CLIENT-SECRET",
+  "DiscoverURL": "https://<oidc-domain>/.well-known/openidconfiguration"
+}]
+```
+
+### Packaging changes across all products
+
+New deb and rpm packages add the "tyk" user and group so that package files and directories would be owned by it and the process run with its effective uid and gid. In addition to this gateway PID now has to reside in its own sub-rundir due to this change, so that's created (and additionally managed by systemd where it's available), default pidfile location changed appropriately so that upgrade wouldn't require any config changes by the users. The gateway config file is now only readable and writable by the "tyk" user and group. This change is applied across all our products except Gateway: its changes scheduled to 2.6. 
+
+The "default" init system files are not removed on upgrade/remove anymore so that it's now a way for users to run the respective process with custom environment variables.
+
+The bug with removal of init system files on upgrade in rpm-based systems is now fixed.
+
+
+### <a name="upgrade"></a>Upgrading all new Components
+
+For details on upgrading all Tyk versions, see [Upgrading Tyk](https://tyk.io/docs/upgrading-tyk/).
+
+### <a name="new"></a>Don't Have Tyk Yet?
+
+Get started now, for free, or contact us with any questions.
+
+* [Get Started](https://tyk.io/pricing/compare-api-management-platforms/#get-started)
+* [Contact Us](https://tyk.io/about/contact/)
+
+## 2.4.0 Release Notes
+
+This release touch all our products and brings you numerous long awaited features and fixes. 
+Here are the packages and their versions we are releasing today: Tyk Gateway v2.4.0, Tyk Dashboard v1.4.0, Tyk Pump v0.4.2, MDCB v1.4.0, TIB v0.2.
+
+### <a name="major-highlights"></a>Major highlights
+
+#### Mutual TLS
+
+A major feature of this release is the implementation of Mutual TLS. Now you can protect your APIs by allow listing certificates, idenitfy users based on them, and increase security between Tyk and upstream API. For details, see [Mutual TLS](/api-management/implement-tls#secure-hosted-apis-with-mtls).
+
+
+#### Extended use of Multiple Policies
+
+We have extended support for partitioned policies, and you can now mix them up when creating a key. Each policy should have own partition, and will not intersect, to avoid conflicts while merging their rules. 
+
+Using this approach could be useful when you have lot of APIs and multiple subscription options. Before, you had to create a separate policy per API and subscription option. 
+
+Using multiple partitioned policies you can create basic building blocks separately for accessing rules, rate limits and policies, and then mix them for the key, to creating unique combination that fit your needs. 
+
+We have added a new `apply_policies` field to the Key definition, which is an string array of Policy IDs. 
+> **NOTE**: The old key apply_policy_id is supported, but is now deprecated.
+
+We have updated the Dashboard **Apply Policies** section of the **Add Key** section.
+
+<img src="/img/release-notes/apply_policy.png" alt="apply-policy" />
+
+For this release multiple policies are only supported only via the Add Key section and via the API. Support for OIDC, oAuth, and Portal API Catalogs are planned for subsequent releases.
+
+[Docs](/api-management/access-control/policies/applying-policies#partitioned-policies)
+
+#### <a name="global-api"></a>Global API Rate Limits
+
+We have added a new API definition field `global_rate_limit` which specifies a global API rate limit in the following format: `{"rate": 10, "per": 1}`, similar to policies or keys. 
+
+The API rate limit is an aggregate value across all users, which works in parallel with user rate limits, but has higher priority.
+
+Extended Dashboard API designer Rate Limiting and Quotas section in Core settings:
+
+<img src="/img/release-notes/rate_limits.png" alt="rate-limits" />
+
+[Docs](/api-management/access-control/policies/applying-policies#partitioned-policies)
+
+#### Specify custom analytics tags using HTTP headers
+
+We have added a new API definition field `tag_headers` which specifies a string array of HTTP headers which can be extracted and turned to tags. 
+
+For example if you include `X-Request-ID` header to tag_headers, for each incoming request it will include a `x-request-id-<header_value>` tag to request an analytic record.
+
+This functionality can be useful if you need to pass additional information from the request to the analytics, without enabling detailed logging, which records the full request and response objects.
+
+We have added a new **Tag headers** section to the Dashboard **API Designer Advanced** tab.
+
+<img src="/img/release-notes/tag_headers.png" alt="tag_headers" />
+
+[Docs](/api-management/dashboard-analytics#activity-logs)
+
+#### <a name="sso"></a>Single-Sign-On (SSO) improvements
+
+More SSO functionality is something that a lot of our customers have been asking for. In this release we've significantly improved our support for SSO, and you can now:
+
+* Enable Tyk Identity Broker to apply LDAP filters to user search [Docs](/api-management/single-sign-on-ldap)
+* Set permissions for your users, logged via SSO, via `sso_permission_defaults` in Dashboard config file. [Docs](/tyk-identity-broker/overview)
+* Setup a login page redirect, using `sso_custom_login_url` and `sso_custom_portal_login_url` Dashboard config options to enable users login using a custom SSO login page. [Docs](/tyk-identity-broker/overview)
+* For those who love to build everything in-house, we have added new API for custom dashboard authentication integrations. [Docs](/api-management/custom-auth-with-proxy-identity-provider)
+
+
+
+### <a name="gateway"></a>Tyk Gateway v2.4.0
+
+#### Mutual TLS support
+[Docs](/api-management/implement-tls#secure-hosted-apis-with-mtls)
+
+#### Global API rate limits
+[Docs](/api-management/rate-limit#rate-limiting-layers)
+
+#### Specify custom analytics tags using HTTP headers
+[Docs](/api-management/dashboard-analytics#activity-logs)
+
+#### Attaching Multiple Policies to the Keys
+[Docs](/api-management/access-control/policies/applying-policies#partitioned-policies)
+
+#### Default User Agent set to Tyk/$VERSION
+If no user agent is specified in a request, it is now set as `Tyk/$VERSION`.
+
+#### Include `x-tyk-api-expires` date header for versioned APIs
+If a request is made for an API which has an expiry date, the response will include the `x-tyk-api-expires` header with expiry date. 
+
+[Docs](/api-management/gateway-config-tyk-classic#tyk-classic-api-versioning)
+
+#### Run Admin Control API on a separate port
+Using `control_api_port` option in configuration file, you can run the admin control api on a separate port, and hide it behind firewall if needed.
+
+[Docs](/tyk-oss-gateway/configuration#control_api_port)
+
+#### Added a Configuration Linter
+
+We have added a new `tyk lint ` command which will validate your `tyk.conf` file and validate it for syntax correctness, misspelled attribute names or format of values. The Syntax can be:
+
+`tyk lint` or `tyk --conf=path lint`
+
+If `--conf` is not used, the first of the following paths to exist is used:
+
+`./tyk.conf`
+`/etc/tyk/tyk.conf`
+
+[Docs](/tyk-oss-gateway/configuration)
+
+#### Set log_level from tyk.conf
+
+We have added a new `log_level` configuration variable to `tyk.conf` to control logging level.
+
+Possible values are: `debug`, `info`, `warn`, `error`
+
+[Docs](/tyk-oss-gateway/configuration#log_level)
+
+#### Added jsonMarshal to body transform templates
+
+We have added the `jsonMarshal` helper to the body transform templates. You can apply jsonMarshal on a string in order to perform JSON style character escaping, and on complex objects to serialise them to a JSON string.
+
+Example: `{{ .myField | jsonMarshal }}`
+
+[Docs](/api-management/traffic-transformation/request-body)
+
+#### Added a blocking reload endpoint
+
+Now you can add a `?block=true` argument to the `/tyk/reload` API endpoint, which will block a response, until the reload is performed. This can be useful in scripting environments like CI/CD workflows.
+
+[Docs](/tyk-gateway-api)
+
+#### `tyk_js_path` file now contains only user code
+
+Internal JS API not budled into tyk binary, and `js/tyk.js` file used only for custom user code. It is recommended to delete this file, if you are not using it, or remove Tyk internal code from it. New releases do not ship this file by default.
+
+#### Improved Swagger API import defaults
+
+When importing Swagger based APIs they now generate tracked URLs instead of allow listed ones.
+
+[More](https://github.com/TykTechnologies/tyk/issues/643)
+
+#### Respond with 503 if all hosts are down.
+Previously, the internal load balancer was cycling though hosts even if they were known as down.
+
+#### Request with OPTIONS method should not be cached.
+[More](https://github.com/TykTechnologies/tyk/issues/376)
+
+#### Health check API is officially deprecated.
+This was very resource consuming and unstable feature. We recommend using load balancers of your choice for this.
+
+#### Fixed custom error templates for authentication errors.
+[More](https://github.com/TykTechnologies/tyk/issues/438)
+
+
+### <a name="dashboard"></a>Tyk Dashboard v1.4.0
+
+#### Mutual TLS support
+[Docs](/api-management/implement-tls#secure-hosted-apis-with-mtls)
+
+#### Global API rate limits
+[Docs](/api-management/rate-limit#rate-limiting-layers)
+
+#### Specify custom analytics tags using HTTP headers
+[Docs](/api-management/dashboard-analytics#activity-logs)
+
+#### Attaching Multiple Policies to the Keys
+[Docs](/api-management/access-control/policies/applying-policies#applying-multiple-policies)
+
+#### Set permissions for users logged via SSO (Tyk Identity Broker)
+Added new option `sso_permission_defaults` in Dashboard config file. 
+Example:
+
+```
+"sso_permission_defaults": {
+  "analytics": "read",
+  "apis": "write",
+  "hooks": "write",
+  "idm": "write",
+  "keys": "write",
+  "policy": "write",
+  "portal": "write",
+  "system": "write",
+  "users": "write"
+},
+```
+[Docs](/tyk-identity-broker/overview)
+
+#### Set custom login pages for portal and dashboard
+If you are using 3-rd party authentication like TIB, you maybe want to redirect from standard login pages to your own using following attributes in dashboard config: `sso_custom_login_url`, `sso_custom_portal_login_url`.
+
+[Docs](/tyk-identity-broker/overview)
+
+#### Added new set of APIs for custom dashboard authentication
+Added new `/admin/sso` endpoint for custom integration. In fact, the same API is used by our own Tyk Identity Broker. 
+
+[Docs](/api-management/custom-auth-with-proxy-identity-provider)
+
+
+#### Service discovery form improved with most common pre-defined templates
+
+Now you can pre-fill the form with most popular templates like consul or etcd.
+
+#### RPC credentials renamed to Organization ID
+Yay!
+
+#### Replaced text areas with a code editors
+
+All multi-line text fields now replaced with a code editors.
+
+#### Replace dropdowns with the live search component
+
+All the dropdown lists now support live search, and work with a large number of elements (especially handy for API or Policiy lists).
+
+#### Display user ID and email on when listing users
+
+The **Users list** now displays the **User ID** and **Email**.
+
+#### Added search for portal developers
+
+We have added search for the users listed in the developer portal.
+
+#### Key request email link to developer details
+
+The email address in a **Key Request** from the **Developer Portal** is now a link to the relevant developer profile.
+
+#### Country code in log browser links to geo report
+
+The country code in the log browser has been changed to a link to the geographic report.
+
+#### Added support for HEAD methods in the Dashboard API Designer.
+
+#### Redirect user to the login page if session is timed out.
+
+#### When creating a portal API catalog, you can now attach documentation without saving the catalog first.
+
+#### Fixed the` proxy.preserve_host_header` field when saved via the UI.
+Previously, the field was available in the API definition, but got removed if the API was saved via the UI.
+
+#### Prevent an admin user revoking their own permissions.
+This is a  UI only fix, it is still allowable via the API (which is OK).
+
+#### Other UX Improvements
+
+* Key pieces of data made accessible to quickly copy+paste
+* Improved help tips
+* Get your API URL without having to save and go back
+* Improved pagination
+* Improved feedback messaging
+* Improved charts
+* Improved analytics search
+
+### <a name="pump"></a> Tyk Pump v0.4.2
+
+#### Support added for Mongo SSL connections
+
+See https://tyk.io/docs/configure/tyk-pump-configuration/ for a sample pump.conf file.
+
+### <a name="mdcb"></a> MDCB v1.4.0
+Added support for Mutual TLS, mentioned by Gateway and Dashboard above. See [Docs](/api-management/implement-tls#secure-hosted-apis-with-mtls)
+  
+Also fixed bug when Mongo connections became growing though the roof if client with wrong credentials tries to connect.
+
+
+### <a name="tib"></a>TIB v0.2
+  
+Tyk Identity Broker now fully support LDAP search with complex filters! [Docs](/api-management/single-sign-on-ldap)
+
+### <a name="upgrade"></a>Upgrading all new Components
+
+> **NOTE**: This release is fully compatible with the previous version, except that if you want to use new features, like Mutual TLS, you need to upgrade all the related components.
+
+Cloud users will be automatically upgraded to the new release.
+
+Hybrid users should follow the upgrade instructions [here](/developer-support/upgrading#tyk-upgrade-guides-for-different-deployment-models).
+
+Self-Managed users can download the new release packages from their usual repositories.
+
+[3]: /img/release-notes/tag_headers.png
+[4]: /img/release-notes/import_api_definition.png
+[5]: /img/release-notes/live_search.png
+[6]: /img/release-notes/user_list.png
+[7]: /img/release-notes/dev_list.png
+[8]: /img/release-notes/key_request_user.png
+
+## Upgrading to v2.3 from v2.2
+
+Tyk v2.3 is backwards-compatible with v2.2 in terms of the configuration file and the original `tyk.conf` can be used with the new version. If you would like to keep your v2.2 settings, please remember to <u>**backup your `tyk.conf` file before upgrading as it will be overwritten during the upgrade process.**</u>
+
+*However*, there are behavioral differences in a v2.3 cluster when hooked up to a Dashboard that can cause some odd behavior if the upgrade is not conducted in the right order.
+
+Tyk v2.3 Gateways continuously talk to each other sharing load data, they also share information with the Dashboard regarding their current configuration. This chatter, if exposed to a v2.2 Gateway, can cause it go into a reload loop, which isn't ideal. Because of this, the recommended upgrade procedure for a Tyk v2.2 system is:
+
+1.  Upgrade all the Tyk Gateways to v2.3
+2.  Upgrade the Dashboard to v1.3
+3.  Update the Tyk Pump to v0.4
+
+If upgraded in this order, then the reload loop can be avoided on a production system.
+
+If the reload loop does occur it is not disastrous, Tyk will just keep proxying traffic even though it is constantly pulling new configurations. It's just not particularly efficient.
+
+> **Note for MDCB**: If you are using MDCB and want to upgrade your Gateways to v2.3, you will also need to upgrade your MDCB to v1.2.0.2.
+
+#### Retaining rate limiter functionality
+
+Tyk v2.3 introduces a new in-memory leaky-bucket *distributed* rate limiter, this is much more performant than the older rate limiter which hard-synchronised via Redis, and puts far less strain on a Redis instance or cluster than the old rate limiter. By default, Tyk v2.3 will switch to this rate limiter, however it is possible to retain the old behavior by enabling it explicitly in the `tyk.conf` file:
+
+```
+    "enable_redis_rolling_limiter": true
+```
+
+This might be useful if you do not wish to switch over immediately and wish to test the new rate limiter first.
+
+#### Public and Private keys
+
+Tyk v2.3 introduces public/private key message authentication for messages that are sent from the management interface to the Gateways, and for code that is being deployed as a plugin to a Gateway via the bundle downloader.
+
+By default, Tyk's new config file has this feature *disabled*, however since it is new, an existing `tyk.conf` will assume a secure installation as the feature must be explicitly disabled. This means, prior to starting your new Gateways, either disable the security feature, or add a public/private key pair to your `tyk.conf` and `tyk_analytics.conf` files:
+
+##### Disable secure messages
+
+<u>**If you are upgrading from v2.2 then you must either generate a public/private keypair or disable the option to validate inbound payloads against a key. You can do this by setting the following key in your `tyk.conf`:**</u>
+
+```
+    "allow_insecure_configs": true
+```
+
+##### Add a public key and private key pair
+
+First, generate the key pair:
+
+```
+    # private key
+    openssl genrsa -out privkey.pem 2048
+    
+    # public key
+    openssl rsa -in privkey.pem -pubout -out pubkey.pem
+```
+
+**`tyk.conf`:**
+
+```
+    "public_key_path": "/path/to/public/key.pem"
+```
+
+**`tyk_analytics.conf`:**
+
+```
+    "private_key_path": "/path/to/private/key.pem"
+```
+
+#### Conclusion
+
+The above are the key changes in v2.3 that could affect your setup and configuration during an upgrade. All other settings should be backwards compatible and not introduce breaking changes.
+
+
diff --git a/developer-support/release-notes/cloud.mdx b/developer-support/release-notes/cloud.mdx
new file mode 100644
index 0000000000..50da739cc6
--- /dev/null
+++ b/developer-support/release-notes/cloud.mdx
@@ -0,0 +1,806 @@
+---
+title: "Tyk Cloud Release Notes"
+description: "Release notes documenting updates, enhancements, and changes for Tyk Cloud"
+keywords: "Tyk Cloud, Release notes, v1.23, 1.23.0, v1.24, 1.24.0, v1.25, 1.25.0, v1.26, 1.26.0, 1.27.0, 1.28.0, 1.28.1, 1.29.0, 1.30.0, 1.31.0, 1.31.1, 1.31.2, 1.32.0, 1.33.0 changelog"
+sidebarTitle: "Tyk Cloud"
+---
+
+## 1.33 Release Notes
+
+### 1.33.0 Release Notes
+
+#### Release Date July 22 2026
+
+
+#### Release Highlights
+Addressed several CVEs within dependencies; no functional changes have been implemented.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Changelog 
+<a id="Changelog-v1.33.0" data-scroll-offset></a>
+
+There is no changelog in this release.
+
+## 1.32 Release Notes
+
+### 1.32.0 Release Notes
+
+#### Release Date 1 June 2026
+
+#### Release Highlights
+
+This release completes the Tyk Cloud observability triangle by adding gateway metrics export, joining the distributed traces and application logs already supported through the OpenTelemetry pipeline. Customers with the Telemetry entitlement can now stream RED (Rate, Error, Duration) metrics from their Cloud Data Plane gateways into their existing observability backend and correlate them with the traces and logs they already receive.
+
+This release also fixes a bug where Hybrid Data Plane Groups could incorrectly appear as **NOT CONNECTED** on the Cloud Deployments list page even when their gateways were running.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.32.0) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Changelog 
+<a id="Changelog-v1.32.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Export Cloud Gateway metrics to observability providers'>
+Cloud customers with the Telemetry entitlement can now export gateway metrics to their observability backend through the same OpenTelemetry pipeline already used for distributed traces and application logs. A new **Enable Metrics** toggle has been added to the Telemetry Export section of each Cloud Data Plane deployment, to the provider configured at the organisation level (New Relic, Elastic, Dynatrace, Datadog, or any OpenTelemetry-native backend via the Custom option). Gateway metrics export requires the Cloud Data Plane to run Gateway v5.13.0 or later. See [Configure Telemetry in Tyk Cloud](https://tyk.io/docs/tyk-cloud/telemetry) for setup instructions.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed Hybrid Data Plane connection status on the Deployments list'>
+Resolved an issue where a Hybrid Data Plane Group could appear as **NOT CONNECTED** with "0 connected" Gateways on the Cloud Deployments list page, even when the Gateway was registered and running. Opening the same Data Plane Group showed the correct **CONNECTED** status, Gateway count, and version in the detail view. The list and detail views now report the same connection state, so the Deployments page reflects reality on page load and refresh.
+</Accordion>
+
+</AccordionGroup>
+
+## 1.31 Release Notes
+
+### 1.31.2 Release Notes
+
+#### Release Date 15th May 2026
+
+#### Release Highlights
+
+This release includes infrastructure improvements and security enhancements to ensure continued platform stability and compliance.
+No functional changes have been implemented in this release. 
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Changelog 
+<a id="Changelog-v1.31.2" data-scroll-offset></a>
+
+There are no changes in this release
+
+### 1.31.1 Release Notes
+
+#### Release Date 16th April 2026
+
+#### Release Highlights
+
+This release includes infrastructure improvements and security enhancements to ensure continued platform stability and compliance.
+No functional changes have been implemented in this release. 
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Changelog 
+<a id="Changelog-v1.31.1" data-scroll-offset></a>
+
+There are no changes in this release
+
+### 1.31.0 Release Notes
+
+#### Release Date 15th April 2026
+
+#### Release Highlights
+
+This release includes infrastructure improvements and security enhancements to ensure continued platform stability and compliance.
+No functional changes have been implemented in this release. 
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Changelog 
+<a id="Changelog-v1.31.0" data-scroll-offset></a>
+
+There are no changes in this release
+
+## 1.30 Release Notes
+
+### 1.30.3 Release Notes
+
+This release upgrades Tyk Cloud to Golang 1.25 for enhanced security and transitions to Enterprise Edition Gateway images by default, ensuring full feature support and consistency between Dashboard and Gateway components. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.30.3). 
+
+#### Release Date 12th February 2026
+
+#### Release Highlights
+
+No functional changes have been implemented in this release. 
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Changelog 
+<a id="Changelog-v1.30.3" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Upgraded Tyk Cloud to Golang 1.25'>
+Tyk Cloud has been updated to [Golang 1.25](https://tip.golang.org/doc/go1.25), improving security by staying current with the latest Go versions.
+</Accordion>
+
+<Accordion title='Upgraded Tyk Cloud to use Enterprise Edition (EE) Gateway images'>
+Tyk Cloud deployments now use Enterprise Edition (EE) Gateway images by default, replacing the previously used OSS images. This ensures that all EE features are fully supported and consistent between the Dashboard and the Gateway. This change is completely transparent and requires no action from users, and existing deployments maintain full compatibility.
+</Accordion>
+
+</AccordionGroup>
+
+### 1.30.2 Release Notes
+
+This release improves the database connection management in customer Control Plane deployments. This change intends to make database-related operations more stable and capacity management more predictable. No customer action required.
+
+#### Release Date 13th November 2025
+
+#### Release Highlights
+
+No functional changes have been implemented in this release. 
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Changelog 
+<a id="Changelog-v1.30.2" data-scroll-offset></a>
+
+There is no changelog in this release.
+
+### 1.30.1 Release Notes
+
+#### Release Date 29th of September 2025
+
+#### Release Highlights
+
+In release 1.30.1, we've improved the stability of our database connectivity. This is an internal change; no customer action required.
+No other changes have been added to this release.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Changelog
+<a id="Changelog-v1.30.1" data-scroll-offset></a>
+
+There is no changelog in this release.
+
+### 1.30.0 Release Notes
+
+#### Release Date 1st September 2025
+
+
+#### Release Highlights
+
+This release expands observability and upgrade management capabilities in Tyk Cloud. Teams can now export application logs to external log vendors, giving full flexibility in integrating with their preferred OpenTelemetry-compatible provider. Additionally, we’ve enhanced the auto-upgrade experience by providing detailed email notifications when the process begins.
+
+For a complete list of changes, see the detailed [changelog](#Changelog-v1.30.0) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Changelog
+<a id="Changelog-v1.30.0" data-scroll-offset></a>
+
+##### Added
+
+<Expandable title='Export Application Logs to Observability Providers'>
+Cloud users can now export Tyk application logs to observability providers using OpenTelemetry (such as Datadog, New Relic, Elastic, and Dynatrace). This feature can be enabled or disabled per deployment, and logs are streamed in real time to the chosen provider, enabling better monitoring and faster troubleshooting.
+</Expandable>
+
+<Expandable title='Email Notifications for Auto-Upgrades'>
+Introduced automated email notifications to inform organisations and team admins when a Control Plane [auto-upgrade](/tyk-cloud/environments-deployments/managing-control-planes#auto-upgrade) begins. Notifications include key details such as deployment name and version changes, helping teams track upgrade activity more effectively.
+</Expandable>
+
+## 1.29.0 Release Notes
+
+### Release Date 15 July 2025
+
+### Release Highlights
+
+This release introduces Auto-Upgrades for Control Plane deployments, allowing teams to stay up to date with the latest features on a configurable schedule, with related Data Planes upgraded automatically. We’ve also improved SSO access control by assigning a default 'View Only' role to newly provisioned SSO users, thereby enhancing security and auditability.
+
+
+For a complete list of changes, see the detailed [changelog](#Changelog-v1.29.0) below.
+
+### Breaking Changes
+
+There are no breaking changes in this release.
+
+### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+### Deprecations
+
+There are no deprecations in this release.
+
+### Changelog
+<a id="Changelog-v1.29.0" data-scroll-offset></a>
+
+#### Added
+
+<Expandable title='New Role to Restrict Local Login for SSO Users'>
+Introduced a new “View Only” role to enhance access control for organizations using SSO. Now, SSO users are granted this read-only role by default. This improves auditability and reduces the risk of unauthorized actions when SSO is the preferred authentication method.
+</Expandable>
+
+<Expandable title='Auto-Upgrade for Control Plane Deployments'>
+Users can now opt into automatic upgrades for Control Plane deployments and configure a weekly schedule to match their maintenance windows. This would also automatically upgrade the corresponding data planes related to this control plane to the latest available version in the channel.
+</Expandable>
+
+## 1.28.1 Release Notes
+
+### Release Date 03 June 2025
+
+### Release Highlights
+
+This release improves Tyk Cloud’s security, scalability, and reliability. We’ve hardened the signup and login flows, improved sensitive data handling in API responses, and enhanced Redis scalability in Control Plane deployments to support larger workloads.
+
+For a full list of changes, see the detailed [changelog](#Changelog-v1.28.1) below.
+
+### Breaking Changes
+
+There are no breaking changes in this release.
+
+### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+### Deprecations
+
+There are no deprecations in this release.
+
+### Changelog
+<a id="Changelog-v1.28.1" data-scroll-offset></a>
+
+#### Added
+
+<Expandable title='Improved scalability for Redis in Control Plane Deployments'>
+The change brings more flexible Redis scaling capabilities in the Control Plane deployments. Control Planes are now able to handle more/larger API keys in storage without causing stability issues. Tyk Cloud will expand this storage using this capability when needed, but a permanent arrangement is subject to commercial terms.
+</Expandable>
+
+#### Fixed
+
+<AccordionGroup>
+<Accordion title='Hardened Signup Flow Validation'>
+Improved the signup logic to prevent unintended automation and ensure tighter control over account creation, enhancing platform security and reliability.
+</Accordion>
+
+<Accordion title='Consistent Login Response Behavior'>
+Standardized response status codes in the login process to prevent discrepancies that could lead to information exposure through http status code.
+</Accordion>
+
+<Accordion title='Sanitized Sensitive Data in API Responses'>
+Resolved an issue where certain sensitive fields could be inadvertently included in API responses. The platform now enforces stricter data handling and output sanitization.
+</Accordion>
+</AccordionGroup>
+
+## 1.28.0 Release Notes
+
+### Release Date 26 May 2025
+
+### Release Highlights
+
+This release focuses on further enhancing Tyk Cloud’s stability, security, and overall user experience. We've resolved several UI issues, improved input validation, standardized security defaults across versions, and strengthened core platform behavior. Additionally, we’ve introduced new 2025 pricing plans!
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.28.0) below.
+
+### Breaking Changes
+
+There are no breaking changes in this release.
+
+### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+### Deprecations
+
+There are no deprecations in this release.
+
+### Changelog
+<a id="Changelog-v1.28.0" data-scroll-offset></a>
+
+#### Added
+
+<Expandable title='2025 Tyk Cloud Pricing Plans Introduced'>
+Tyk Cloud has introduced the 2025 base pricing plans, featuring new Core, Professional, and Enterprise tiers. These changes provide clearer value differentiation across plans while maintaining flexibility for both SaaS and Hybrid deployments. The "Account" section is now hidden for new customers, though existing customers remain unaffected. Usage and quota are still available in the "System Usage" and "Monitoring" sections. For more information, please check the [Pricing & Plans](https://tyk.io/pricing/)
+</Expandable>
+
+#### Fixed
+
+<AccordionGroup>
+<Accordion title='Improved Validation for Hybrid Data Plane Names'>
+We’ve fixed an issue where pasting invalid characters, such as tabs and spaces, into the hybrid data plane name field would break the registration flow in Ara. The system now includes input validation on both the frontend and backend, ensuring only valid characters are accepted. This prevents configuration issues and improves the reliability of the hybrid data plane creation process.
+</Accordion>
+
+<Accordion title='Improved Login Handling in Tyk Cloud'>
+We’ve made backend improvements to the Tyk Cloud login functionality to enhance its security and resilience against automated attacks. These changes help ensure a more consistent and secure authentication experience.
+</Accordion>
+
+<Accordion title='Secure Defaults Aligned Across Dashboard Versions'>
+We’ve fixed an issue where secure configuration defaults for the Tyk Dashboard admin view were not properly applied in older versions (v5.3). These settings now default to true in v5.8+ as intended, while remaining false in v5.3 to preserve backward compatibility. This ensures consistent and expected security behavior across versions.
+
+**Note:** Changes in deployment configurations are applied during a redeployment, triggered by the user or system. In addition, defaults can be changed individually by creating a support ticket.
+</Accordion>
+</AccordionGroup>
+
+## 1.27.0 Release Notes
+
+### Release Date 23 April 2025
+
+
+### Release Highlights
+
+This release focuses on improving Tyk Cloud's stability, security, and reliability. We’ve addressed several bugs, enhanced UI behavior, resolved performance bottlenecks, and implemented secure defaults to strengthen the platform’s security posture. 
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.27.0) below.
+
+### Breaking Changes
+
+There are no breaking changes in this release.
+
+### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+### Deprecations
+
+There are no deprecations in this release.
+
+### Changelog
+<a id="Changelog-v1.27.0" data-scroll-offset></a>
+
+#### Added
+
+<AccordionGroup>
+<Accordion title='Clear Error Message Shown When Control Plane Deployment Fails'>
+Tyk Cloud now displays an informative error message when a Control Plane fails to deploy. Previously, users received no feedback, causing confusion. The new message lets users know the issue is being addressed and guides what to do next, improving transparency and user experience during deployment failures.
+</Accordion>
+
+<Accordion title='UI Support for Enabling Audit Logging on Control Planes'>
+Audit logging can now be enabled or disabled directly from the UI for Control Plane deployments if it is included in your plan.
+</Accordion>
+
+<Accordion title='Secure Defaults Now Applied for Admin Token Visibility'>
+As announced in the previous release, Tyk Cloud now defaults to secure settings that restrict admin users from viewing or resetting other users' API tokens in the Dashboard.
+</Accordion>
+
+<Accordion title='Improved Performance of Hybrid Visibility Functionality'>
+We’ve made backend improvements to enhance the performance and stability of hybrid node visibility features in Tyk Cloud. These changes help support larger datasets more efficiently, ensuring smoother operations and better scalability behind the scenes.
+</Accordion>
+</AccordionGroup>
+
+#### Fixed
+
+<AccordionGroup>
+<Accordion title='Telemetry Optional Fields Now Persist After Saving'>
+Fixed an issue where optional fields in the ‘Edit New Relic Connection’ section of the Telemetry UI would disappear after saving. With this fix, all optional configuration fields now persist correctly, ensuring that user-defined telemetry settings are saved and visible for further updates.
+</Accordion>
+
+<Accordion title='Telemetry Export Now Applies Correctly on Existing Deployments'>
+Fixed an issue where enabling telemetry export on an existing deployment did not apply the expected network policy changes. This fix ensures that configuration changes are consistently applied, so telemetry features work as intended without requiring manual intervention.
+</Accordion>
+
+<Accordion title='Team Dropdown No Longer Locks When Switching Deployment Types'>
+We’ve resolved a UI issue where the team dropdown became unresponsive when switching between Control Plane and Hybrid Data Plane types during deployment creation. This fix ensures that users can seamlessly switch deployment types.
+</Accordion>
+
+<Accordion title='Reduced Data in Telemetry Configuration Responses'>
+We’ve removed unnecessary data from telemetry export configuration API responses to ensure cleaner and more secure payloads.
+</Accordion>
+</AccordionGroup>
+
+## 1.26.0 Release Notes
+
+### Release Date 17 of March 2025
+
+### Release Highlights
+
+Tyk Cloud now provides greater compliance controls, allowing customers to manage audit logging and storage more effectively. With new audit log storage and the ability to enable or disable audit logging per Control Plane deployment, users can optimize costs while maintaining security and compliance. These improvements give organizations more flexibility in handling audit data based on their specific regulatory and operational needs. To enable this feature, please contact your account manager.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.26.0) below.
+
+#### Admin Behavior Update in Control Planes v5.8.0
+In the next Tyk Cloud release, starting with the Control Planes version 5.8.0, we will be  restricting Tyk Dashboard admin users' ability to view and reset other users' API tokens. This change will automatically apply to all Control Plane deployments that are either newly created with or upgraded to version 5.8.0 or later.
+
+This security improvement helps protect sensitive access credentials and provides better isolation between user accounts. If your organization requires the previous behavior for specific operational needs, you can revert this change by submitting a request to Tyk Support.
+
+We remain committed to continuously improving the security of our platform while maintaining the flexibility needed for diverse environments.
+
+### Breaking Changes
+
+There are no breaking changes in this release.
+
+### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+### Deprecations
+
+There are no deprecations in this release.
+
+### Changelog
+<a id="Changelog-v1.26.0" data-scroll-offset></a>
+
+#### Added
+
+<AccordionGroup>
+<Accordion title='Enable/Disable Audit Logging for Control Plane Deployments'>
+Tyk Cloud allows users to enable or disable audit logging for their [Control Plane](/api-management/mdcb#data-plane) (CP) deployments, providing greater flexibility in managing compliance and storage costs. To enable this feature, please contact your account manager.
+
+Tyk Cloud now also enforces audit log storage quotas based on contractual terms (a storage quota limit assigned to organizations based on their subscription), allowing customers to manage costs effectively. Similar to analytics storage, a size cap is applied to audit logs, dropping the oldest logs to fit the new ones within the quota.
+
+For more information, please check the [Tyk Dashboard documentation on the feature](https://tyk.io/docs/api-management/dashboard-configuration/#retrieving-audit-logs-via-api)
+</Accordion>
+
+<Accordion title='Enhanced Onboarding Experience for Trial Users'>
+Tyk Cloud now enables the onboarding wizard by default for trial users, providing a guided Quick Start experience in Tyk 5.8.0.
+</Accordion>
+
+<Accordion title='Stability Improvements When Deploying Control Planes'>
+Tyk Cloud now features enhanced stability for Control Plane deployments, even in cases of license server issues.
+</Accordion>
+</AccordionGroup>
+
+#### Fixed
+
+<AccordionGroup>
+<Accordion title='Protecting Go Plugin Functionality by Isolating MServ API Definitions'>
+Tyk Cloud now moves MServ API definitions to a separate organization, preventing users from accidentally modifying or deleting them. Previously, these definitions were stored within the customer’s Tyk Dashboard deployment, posing the risk of breaking Go plugin functionality. With this update, Go plugins remain fully operational while deployments become more secure and error-proof. This change applies to new deployments only; existing deployments with plugins enabled will be gradually migrated in the future to avoid unexpected service disruption.
+</Accordion>
+
+<Accordion title='Provision First and Last Name for Cloud SSO Users'>
+Tyk Cloud now correctly populates first and last names when provisioning new users via SSO (Google SSO, KeyCloak). Previously, only the first name was set, causing validation errors when updating roles due to a missing last name. This fix ensures that SSO-provisioned users have complete profiles, preventing onboarding issues and improving role management for organizations
+</Accordion>
+
+<Accordion title="Enforce 'Only Registered Users' Flag for SSO in Tyk Cloud">
+Tyk Cloud now correctly enforces the 'Only Registered Users' flag for SSO (Google SSO, KeyCloak), preventing the creation of unregistered users via just-in-time provisioning. Previously, users without a corresponding local entry could still be created even when this setting was enabled.
+</Accordion>
+
+<Accordion title='Incorrect Display of Custom Domain Field in EDP'>
+Tyk Cloud now correctly hides the custom domain field in the Enterprise Developer Portal (EDP) edit page when the custom domain entitlement is not enabled. Previously, the field was visible even for organizations without access to this feature, causing confusion.
+</Accordion>
+
+<Accordion title='Improved Probes for Control Plane Deployments with SSO'>
+Tyk Cloud now ensures more reliable health checks for Control Plane deployments when SSO is configured.
+</Accordion>
+
+<Accordion title='Accurate Subscription Limits in Monitoring Charts'>
+The monitoring chart in Tyk Cloud now correctly displays the subscription limit based on the organization’s entitlement.
+</Accordion>
+
+<Accordion title='Improved Analytics Performance in Tyk Cloud'>
+Changing the analytics storage quota in Tyk Cloud no longer removes critical database indices, which previously led to performance degradation. This fix ensures that indices are preserved, maintaining fast query performance and data integrity. Customers should now experience improved analytics performance, especially when adjusting storage quotas.
+</Accordion>
+</AccordionGroup>
+
+---
+
+## 1.25.0 Release Notes
+
+### Release Date 10 of February 2025
+
+### Release Highlights
+This Tyk Cloud update enhances Gateway version management, ensuring a more streamlined, secure, and user-friendly experience. With the new UI versioning updates, users have clearer visibility into supported versions, direct upgrade recommendations, and the ability to automate version upgrades for effortless maintenance.
+These changes empower teams to stay on supported, secure, and high-performing versions.
+For more details, check out the [documentation on Gateway versioning and auto-upgrades](/developer-support/release-types/long-term-support)
+
+### Breaking Changes
+
+There are no breaking changes in this release.
+
+### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+### Deprecations
+
+There are no deprecations in this release.
+
+### Changelog
+
+#### Added
+
+<Expandable title='Custom Domains for API Manager Dashboard'>
+Tyk Cloud now supports custom domains for the API Manager Dashboard, allowing organizations to align their domain with their branding and provide a seamless experience for internal and external stakeholders.
+</Expandable>
+
+<Expandable title='Clearer LTS Version Support & Recommendations'>
+Tyk Cloud now provides improved visibility into supported LTS versions. Every patch version within the current LTS branch is labeled `Supported`, while the latest patch is marked as `Recommended`. This update eliminates confusion around deprecated versions and prevents unexpected `unsupported` status changes, allowing for smoother upgrade planning and system stability.
+</Expandable>
+
+#### Changed
+
+<Expandable title='Improved Organization Overview Page'>
+We have redesigned the Overview page in Tyk Cloud to provide a more streamlined and actionable summary of an organization's key elements.
+Users can now toggle between two views:
+- **Task View**: Groups control planes and developer portals by high-level jobs to be done, such as managing APIs or publishing products.
+- **Environment View**: Displays control planes and developer portals grouped by environment, making it easier to navigate large setups.
+Additionally, we have moved organization statistics to a new System Usage page under Deployments.
+</Expandable>
+
+#### Fixed
+
+<Expandable title='Removed "Delete User" Button for Team Admins'>
+Team admins will no longer see the `Delete User` button when viewing the profiles of other team admins. Previously, this button was incorrectly displayed, leading to an error when clicked. This fix ensures the UI reflects the correct permissions and prevents confusion for administrators managing team members.
+</Expandable>
+
+---
+
+## 1.24 Release Notes
+
+### 1.24.2 Release Notes
+
+#### Release Date 13 of January 2025
+
+#### Release Highlights
+
+This Tyk Cloud update resolves an issue related to Telemetry export configurations. Previously, when deploying a Data Plane in a region different from the Control Plane, Telemetry export settings could encounter compatibility issues. With this patch, Telemetry export configuration now works seamlessly across regional deployments, ensuring consistent observability for distributed Tyk Cloud setups.
+
+
+#### Breaking Changes
+
+There are no breaking changes in this release
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+
+There are no deprecations in this release
+
+#### Changelog
+<a id="Changelog-v1.23.0" data-scroll-offset></a>
+
+##### Fixed
+
+<Expandable title='Fixed Telemetry export configuration for cross-region deployments'>
+The Telemetry export configuration now functions as expected when a Data Plane is deployed in a region different from the Control Plane, ensuring compatibility across distributed setups.
+</Expandable>
+
+
+### 1.24.1 Release Notes
+
+#### Release Date 16 of December 2024
+
+#### Release Highlights
+
+This Tyk Cloud hotfix addresses a critical issue affecting Control Plane Redis scheduling. In certain scenarios, re-deploying existing CDPs (Control Data Planes) that were created before the 1.24.0 release would fail due to an unintended modification of Redis deployment selectors.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+There are no breaking changes in this release
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release
+
+#### Changelog
+<a id="Changelog-v1.23.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+<Expandable title='Fixed Redis scheduling issues in Control Plane deployments'>
+Corrected the Redis deployment selectors to prevent errors during both re-deployments of existing CDPs and deployments of new CDPs.
+</Expandable>
+
+
+### 1.24.0 Release Notes
+
+#### Release Date 16 of December 2024
+
+#### Release Highlights
+
+This Tyk Cloud update introduces a groundbreaking feature for enhanced API observability and troubleshooting. With the new native Telemetry export, Tyk Cloud now allows organizations to seamlessly integrate their deployments with a variety of popular observability platforms, including built-in support for Datadog, Dynatrace, Elastic, and New Relic. For other systems, the custom provider option ensures compatibility with any platform that supports the OpenTelemetry Protocol (OTLP).
+
+This feature enables trace export capabilities, providing deep insights into API and plugin performance. It marks the first step in Tyk Cloud’s broader observability journey, empowering users to monitor and troubleshoot their APIs more effectively while leveraging their existing observability tools.
+
+For more details, check out the [documentation on setting up Telemetry export](/tyk-cloud/telemetry).
+
+### Breaking Changes
+
+There are no breaking changes in this release
+
+#### Downloads
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+### Deprecations
+
+There are no deprecations in this release
+
+---
+
+## 1.23 Release Notes
+
+### Release Date 14 of November 2024
+
+### Release Highlights
+
+This Tyk Cloud update introduces features that improve both flexibility in plugin management and user onboarding. Now, [Mserv](/tyk-cloud/using-plugins#uploading-your-bundle),  supports **multiple plugin bundles**, allowing greater customization and easier deployment of plugin configurations. Additionally, we added an **embedded product tour** to enhance the deployment experience, offering a guided walkthrough of Tyk Dashboard’s features, ideal for users familiarizing themselves with the platform during onboarding.
+
+For a comprehensive list of improvements and fixes, please check the detailed [changelog](#Changelog-v1.23.0) below.
+
+### Breaking Changes
+
+There are no breaking changes in this release
+
+### Downloads
+
+- [latest version of Mserv](https://github.com/TykTechnologies/mserv/releases/latest)
+
+### Deprecations
+
+There are no deprecations in this release
+
+### Changelog
+<a id="Changelog-v1.23.0" data-scroll-offset></a>
+
+#### Added
+
+<AccordionGroup>
+<Accordion title='Contact form for POC requests on trial expiration'>
+A HubSpot contact form has been added in both Tyk Cloud and Dashboard to facilitate contacting Tyk for a Proof of Concept (PoC) when a trial expires. This new form makes it easier to connect with our team and explore further options once   
+the trial period ends.
+</Accordion>
+
+<Accordion title='Support for bundles with multiple plugins'>
+Tyk Cloud now supports multiple plugins in a bundle, allowing users to manage and deploy various binaries for the same plugin bundle. This enhancement provides greater flexibility in plugin configuration and deployment using `mservctl`.
+within MServ.
+</Accordion>
+
+<Accordion title='Embedded product tour during deployment wait time'>
+An embedded interactive product tour has been added within the deployment screen to guide users through the Tyk Dashboard while they wait for their free trial on-boarding to complete. This tour provides an overview of key features, helping users explore what they can do on Tyk Cloud during their trial.
+</Accordion>
+</AccordionGroup>
+
+#### Changed
+
+<Expandable title='UX Improvement: Redirect to activity by API section from the monitoring page'>
+Users are now redirected to the "Activity by API" section in the Tyk Dashboard upon clicking on the Control Plane (CP) name within the Cloud Monitoring page. This update provides a more seamless 
+transition for users needing detailed activity insights directly from the monitoring interface.
+</Expandable>
+
+#### Fixed
+
+<AccordionGroup>
+<Accordion title='"Add Portal Deployment" widget hidden for team members'>
+The "Add Portal Deployment" widget on the Environment page is now hidden for team members, providing a cleaner and more tailored UI experience by limiting portal management options to authorized roles 
+only.
+</Accordion>
+
+<Accordion title='"Delete User" button hidden for org admin on Org+Billing admin profiles'>
+The "Delete User" button for Org Admins has been hidden when viewing Org+Billing Admin profiles on the Teams page. Previously, Org Admins could see this button but would encounter an error message, "operation on this class is not permitted," when attempting deletion.
+</Accordion>
+
+<Accordion title='Standardized behavior for "Upgrade" and "Account & Billing" buttons'>
+The behavior for accessing the billing app through the 'Upgrade' and 'Account & Billing' buttons has been standardized. Previously, clicking the 'Upgrade' button opened the billing app in a new tab, while 'Account & Billing' opened it in the same tab. Now, both buttons open the billing app consistently in the same tab.
+</Accordion>
+
+<Accordion title='Direct access to "/password-reset" page now accessible without redirect'>
+Fixed an issue where accessing the /password-reset page directly redirected users to the login page. Now, users can navigate directly to the /password-reset page without being redirected, providing a consistent experience for password-reset requests regardless of how the page is accessed.
+</Accordion>
+
+<Accordion title='Billing sidebar display corrected when no subscriptions are present'>
+We have resolved a display issue in the billing sidebar that occurred when no subscriptions were active. Now, the sidebar menu displays correctly regardless of subscription status, providing a consistent and clear UI for all users.
+</Accordion>
+
+<Accordion title='Fix for hybrid codes visibility logic to manage node data retention'>
+This update addresses a critical bug in the Hybrid nodes visibility logic, which previously retained all connected node data for the Hybrid Data Planes indefinitely. The fix ensures that we only contains records from the last 7 days. This enhancement improves system performance at all stages within the Tyk Cloud UI for organizations with Hybrid Data Planes, especially those with multiple connected gateways.
+</Accordion>
+
+<Accordion title='Improve stability for paid customers'>
+We have enhanced separation between free-trial and paid deployments to improve resilience and stability.
+</Accordion>
+</AccordionGroup>
+
+##### Security Fixes
+
+<Expandable title='Bumped dependencies in Tyk Cloud components'>
+Dependencies across all Tyk Cloud components have been updated to address reported security issues. This update ensures compliance with security standards, aligning the project with best practices for secure dependency management.
+</Expandable>
+
+## Further Information
+
+### FAQ
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
+
+
+
diff --git a/developer-support/release-notes/dashboard.mdx b/developer-support/release-notes/dashboard.mdx
new file mode 100644
index 0000000000..a9dbd44e81
--- /dev/null
+++ b/developer-support/release-notes/dashboard.mdx
@@ -0,0 +1,8305 @@
+---
+title: "Tyk Dashboard Release Notes"
+description: "Release notes documenting updates, enhancements, and changes for Tyk Dashboard."
+keywords: "Tyk Dashboard, Release notes, changelog"
+sidebarTitle: "Tyk Dashboard"
+---
+
+**Licensed Protected Product**
+
+**This page contains all release notes for Dashboard displayed in  reverse chronological order**
+
+## Support Lifetime
+
+Only the most recent Tyk Dashboard release and the most recent on the [Long Term Support (LTS)](/developer-support/release-types/long-term-support) branch are supported. We recommend staying current on the feature or LTS branch to minimise exposure to security vulnerabilities from third party dependencies.
+
+---
+
+## 5.14 Release Notes 
+
+### 5.14.0 Release Notes 
+
+#### Release Date 7 July 2026
+
+#### Release Highlights
+
+**Client IdP Registry for JWT Authentication**
+
+Tyk Gateway's JWT authentication middleware validates tokens against JSON Web Key Sets (JWKS) retrieved from a 3rd party Identity Provider (IdP), and maps OAuth scopes to Policies using configuration stored in each API definition. When multiple APIs share the same IdP, this means duplicating the same issuer, JWKS endpoint, and scope-to-policy mapping across every API definition.
+
+The new Client IdP registry extracts the IdP details and scope-to-policy mapping from the API definitions into a central registry. When a request is received, Tyk Gateway checks the API definition first (for backward compatibility) before checking the registry. Updating the registry automatically applies to all APIs that reference that IdP, without touching the API definitions themselves.
+
+A full CRUD API has been implemented in Tyk Dashboard for creating and managing Client IdP assets. See the [changelog](#Changelog-v5.14.0) for the endpoint reference.
+
+<Note>
+There is no support for management of the Client IdP Registry from the Tyk Dashboard UI at this time.
+</Note>
+
+**OAuth 2.0 Configuration in the API Designer**
+
+The API Designer has been updated to support configuration of the new `oauth2` security scheme introduced in Tyk Gateway 5.14.0, which enables authentication against an external Authorization Server such as Keycloak, Okta, or Auth0.
+
+The new OAuth 2.0 option appears alongside JWT in the authentication method selector, reflecting that the two are typically configured together. Deprecated methods are listed at the bottom to guide users toward current options. Warnings and contextual help have been added throughout to guide users through scope enforcement and token exchange configuration.
+
+Existing APIs using the previous top-level `authentication.protectedResourceMetadata` configuration are automatically migrated at Tyk Dashboard startup to use the new configuration field located inside the `oauth2` scheme. No manual changes to API definitions are required.
+
+**Granular Enforced Timeout Configuration in the API Designer**
+
+The API Designer now supports the granular enforced timeout configuration introduced in Tyk Gateway 5.14.0. Both API-level and endpoint-level timeouts can be configured using human-readable values such as `500ms`, `1.5s`, or `2m`, replacing the previous whole-second-only entry for endpoint-level timeouts.
+
+For Tyk OAS APIs, the designer automatically rounds the configured value up to the nearest second and stores it in the legacy field, ensuring continued operation with older Tyk Gateway versions. For Tyk Classic APIs, the API-level timeout (`global_enforce_timeout`) and the granular endpoint-level field (`extended_paths.hard_timeouts.duration`) must be set directly in the raw API editor; the legacy endpoint-level field must also be set manually for compatibility with older Gateways.
+
+**Other Changes**
+
+This release also delivers: support for configuring the new `file://` KV storage option in the API editor; a dedicated log level control (`log_level`) for Tyk Dashboard application logs; logging of failed login attempts by inactive users; and an update to the embedded Tyk Identity Broker to version 1.7.3. Notable fixes include: loss of JWT Advanced Claim Mapping configuration when upgrading from pre-5.10.0 versions; policies becoming invisible to non-admin users after their referenced APIs are deleted; a Tyk Dashboard UI crash when an OAS parameter uses the `content` keyword; and temporary files accumulating on disk after multipart OpenAPI document imports.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.14.0) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release
+
+#### Dependencies
+<a id="dependencies-5.14.0"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :------ | :---------------- | :---------------- |
+| 5.14.0  | MDCB v2.12.0      | MDCB v2.12.0      |
+|         | Operator v1.4.2   | Operator v0.17    |
+|         | Sync v2.2.0       | Sync v2.2.0       |
+|         | Helm Chart v5.3.0 | Helm all versions |
+|         | EDP v1.18.0       | EDP all versions  |
+|         | Pump v1.16.0      | Pump all versions |
+|         | TIB (if using standalone) v1.7.3 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.14.0"></a>
+
+| Third Party Dependency                                    | Tested Versions     | Compatible Versions | Comments | 
+| :-------------------------------------------------------- | :------------------ | :------------------ | :------- | 
+| [Golang](https://go.dev/dl/)                              | 1.25                |  1.25               | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)                       | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | | 
+| [Valkey](https://valkey.io/download/)                     | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 7.0.x, 8.0.x  | 6.0.x, 7.0.x, 8.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)          | 4, 5                | 4, 5                | | 
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x         | 13.x - 17.x         | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | v3.1.x, v3.0.x | v3.1.x, v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.14.0"></a>
+
+If you are upgrading to 5.14.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.14.0)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.14.0
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+<Note>
+Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.14.0.
+</Note>
+
+#### Changelog
+<a id="Changelog-v5.14.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Added Client IdP registry for JWT Authentication'>
+{/* TT-17310 */}
+We have introduced a new asset class managed by Tyk Dashboard - Client IdPs. A full CRUD API has been implemented for the creation and management of these assets in the main storage, alongside API definitions.
+
+Each client IdP asset is configured with:
+- a unique user-defined (or automatically-assigned) identifier
+- Organisation ID to enforce per-Org scope
+- human-readable name for display in the UI (when supported)
+- Identity Provider's unique `issuer` identifier
+- IdP's JWKS endpoint
+- a mapping of API definitions to scope-to-policy mappings for APIs using this IdP
+
+These client IdP assets extract the IdP details (issuer value and JWKS endpoint) and the scope-to-policy mapping from the API definitions, and instead hold a central configuration per IdP with a list of APIs to which these should be applied.
+
+When a request is received, the Gateway will first check any JWKS URLs and scope-to-policy mappings in the API definition (for backward compatibility) before checking the registry.
+
+The new endpoints to manage the registry are:
+
+- `GET /api/clientidps` - list all client IdP assets for an Org
+- `POST /api/clientidps` - create a new entry in the register
+- `GET/PUT/DELETE /api/clientidps/{id}` - manage an existing entry in the register
+- `PATCH /api/clientidps/{id}/mappings` - bulk partial update to an asset's API mapping table
+- `GET/PUT/DELETE /api/clientidps/{id}/mappings/{api_id}` - manage one API mapping
+</Accordion>
+
+<Accordion title='Granular API-level and endpoint-level enforced timeouts'>
+{/* TT-12339, TT-15813, TT-16959, TT-16973 */}
+You can now configure an [enforced (request) timeout](/planning-for-production/ensure-high-availability/enforced-timeouts) at API level. This API-level timeout takes precedence over the Gateway default (`proxy_default_timeout`). The more granular endpoint-level timeout overrides the API-level value.
+
+Both API-level and endpoint-level timeouts accept granular configuration using human-readable values such as `500ms`, `1.5s`, or `2m`. Previously, the endpoint-level timeouts could only be configured in seconds.
+
+The Tyk OAS API designer exclusively supports the new format for both API-level and endpoint-level settings; behind the scenes the new value configured for an endpoint-level timeout is rounded up to the nearest second and stored in the legacy field to ensure continued operation with older Gateways.
+
+The Tyk Classic API designer only supports the legacy field for endpoint-level timeouts. If you want to set an API-level timeout (`global_enforce_timeout` in the `version_data` section), or a more granular endpoint-level timeout (`extended_paths.hard_timeouts.duration`), you must do this in the API editor. Note that Tyk does not automatically set the legacy endpoint-level field for you, so you must set a value in here to ensure continued operation with older Gateways.
+</Accordion>
+
+<Accordion title='Added OAuth 2.0 authentication configuration to API Designer'>
+{/* TT-17385 */}
+The API Designer supports the new OAuth 2.0 authentication method and guides users through configuring it correctly. A new **OAuth 2.0** option appears alongside JWT in the authentication method selector, reflecting that the two are typically configured together. Deprecated methods are listed at the bottom to steer users toward current options. Warnings and guidance have been added throughout to help users configure scope enforcement and token exchange correctly.
+</Accordion>
+
+<Accordion title='Auto-migrate Protected Resource Metadata configuration'>
+{/* TT-17176 */}
+Existing APIs using the previous top-level `authentication.protectedResourceMetadata` configuration are automatically migrated to the new location inside the `oauth2` scheme at Dashboard startup. No manual changes to API definitions are required.
+</Accordion>
+
+<Accordion title='Added support for KV references using `file` storage option'>
+{/* TT-17497 */}
+The new `file://` storage option added to Tyk Gateway's [Key-Value secret storage](/tyk-configuration-reference/kv-store#supported-storage-options) feature can be configured in the API editor.
+
+In the API designer, if a TLS certificate is located using a key-value reference, the Dashboard UI will direct the user to the API editor to view or modify the reference.
+</Accordion>
+
+<Accordion title='Added Dashboard-specific application log level control'>
+{/* TT-16953 */}
+The Dashboard now has a dedicated [application log verbosity](/api-management/logs#severity-and-verbosity) setting ([`log_level`](/tyk-dashboard/configuration)) to match those of other Tyk components. It accepts the same values: `error`, `warn`, `info` (the default), and `debug`. This applies to all Dashboard application logs.
+
+The global `TYK_LOGLEVEL` still takes precedence over `TYK_DB_LOGLEVEL` when it is set, an invalid value falls back to `info` with a warning, and the `--debug` flag continues to force `debug` verbosity.
+</Accordion>
+
+<Accordion title='Failed login by inactive user is now logged'>
+{/* TT-17058 */}
+The Dashboard now generates an entry in the application log when an authenticated request is rejected because the Dashboard user account is inactive.
+
+This log entry, which is generated as a `warning`, includes the user's ID and group ID to aid with debugging, without including any personally identifiable information in the log.
+</Accordion>
+
+</AccordionGroup>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated embedded Tyk Identity Broker to version 1.7.3'>
+{/* TT-17453 */}
+Tyk Dashboard embeds Tyk Identity Broker. This has been updated to [version 1.7.3](/developer-support/release-notes/tib#1-7-3-release-notes).
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed issue with Docker images incompatible with legacy registries and tools'>
+{/* TT-17333 */}
+Docker images published in v5.13.0 contained mixed layer compression: base image layers used zstd compression while Tyk application layers used gzip. This caused image copy and promotion failures with legacy Docker tooling, older registry versions, and some security scanners, with the error: `zstd compression is not officially supported for docker images`.
+
+All image layers are now uniformly compressed using `gzip`, restoring compatibility with `skopeo`, `oc image mirror`, and other tools that do not support OCI `zstd` compression.
+</Accordion>
+
+<Accordion title='Fixed unexpected removal of JWT Auth configuration when upgrading from pre-5.10.0 versions'>
+{/* TT-17139 */}
+We have resolved an issue where the **Advanced Claim Mapping** configured for a Tyk OAS API using JWT Auth could be accidentally cleared following an upgrade from a pre-5.10.0 version of the Tyk Dashboard. The API Designer would remove the `authentication.securitySchemes.jwtAuth.scopes` configuration when the API was updated following the upgrade, leaving the API incorrectly configured.
+
+The Dashboard's API Designer no longer makes this unrequested modification to the API definition.
+</Accordion>
+
+<Accordion title='Fixed policies disappearing for non-admin users when their APIs are deleted'>
+{/* TT-11902 */}
+We have resolved an issue where a policy became invisible to non-admin users once all of the APIs it granted access to had been deleted, even though the policy still existed. Users with explicit Read or Write policy permissions lost the ability to see or manage these policies, while admin users were unaffected.
+
+Non-admin users can now see and manage such policies again; when ownership cannot be determined from the referenced APIs, visibility falls back to the user's policy group permissions (Read or Write grants access, Deny does not).
+</Accordion>
+
+<Accordion title='Fixed inconsistent error codes returned when using non-existent API Ids'>
+{/* TT-16802 */}
+We have resolved an issue where, with API ownership enabled, a non-admin user providing an unrecognized API Id in a request to the Dashboard API received `HTTP 401 Unauthorized`, while an admin user making the same request correctly received `HTTP 400 Bad Request`.
+
+Non-admin users now receive the same error code as admin users when the provided API Id does not exist. Ownership protection is unchanged: `HTTP 401 Unauthorized` is still returned when the resource exists but the user does not own it.
+</Accordion>
+
+<Accordion title='Fixed issue with temporary files left behind after importing a multipart OpenAPI document'>
+{/* TT-16816 */}
+We have resolved an issue where importing a [multipart OpenAPI document](/api-management/gateway-config-managing-oas#multi-part-openapi-documents) from a ZIP archive left temporary files on the Dashboard's local disk after the import completed. Over time this could exhaust disk space and, because the temporary location was derived from the archive filename, a later import using the same filename could reuse stale contents resulting in unexpected API configuration.
+
+Imports now use a unique temporary location per upload that is always cleaned up, even if the import fails, and concurrent uploads no longer interfere with one another. This applies to both creation and updating of Tyk OAS APIs, whether imported through the UI or the Dashboard API.
+</Accordion>
+
+<Accordion title='Fixed orphaned Tyk OAS API versions not appearing in the Dashboard UI on PostgreSQL'>
+{/* TT-15988 */}
+We have resolved an issue where child API versions that were orphaned (due to deletion of the base API version) on Dashboard versions prior to 5.8.6 did not appear in the main API list when using PostgreSQL, and could only be found through search.
+
+The Dashboard now detects these legacy orphaned Tyk OAS APIs and restores them to the main API list.
+</Accordion>
+
+<Accordion title='Fixed Dashboard UI crash when an OAS parameter uses `content` instead of `schema`'>
+{/* TT-16916 */}
+We have resolved an issue where opening a Tyk OAS API whose parameters use the OpenAPI `content` keyword (rather than `schema`) caused the API Designer and API Debugger to crash, and the Validate Request middleware form to reject the definition as invalid. The Dashboard now fully supports content-form parameters as defined by OpenAPI Specification 3.0: these APIs load without errors, and saving them preserves the content wrapper, including the media type and inner schema, without writing a conflicting top-level schema.
+</Accordion>
+
+<Accordion title='Fixed unnecessary proxy configuration being added to Tyk Vendor Extension'>
+{/* TT-16800 */}
+We have resolved an issue where a harmless, but unnecessary `upstream.proxy.enabled=false` could be added to the Tyk Vendor Extension when using the Tyk Dashboard API Designer. This was due to a serialization artifact in the UI and has been corrected. The resultant API definition no longer contains this unwanted configuration.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33813" target="_blank">CVE-2026-33813</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46599" target="_blank">CVE-2026-46599</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45447" target="_blank">CVE-2026-45447</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34180" target="_blank">CVE-2026-34180</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45445" target="_blank">CVE-2026-45445</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-7383" target="_blank">CVE-2026-7383</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-9076" target="_blank">CVE-2026-9076</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46602" target="_blank">CVE-2026-46602</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46604" target="_blank">CVE-2026-46604</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41506" target="_blank">CVE-2026-41506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45571" target="_blank">CVE-2026-45571</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42500" target="_blank">CVE-2026-42500</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41889" target="_blank">CVE-2026-41889</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45570" target="_blank">CVE-2026-45570</a>
+- <a href="https://osv.dev/vulnerability/GHSA-j88v-2chj-qfwx" target="_blank">GHSA-j88v-2chj-qfwx</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+
+
+## 5.13 Release Notes
+
+### 5.13.2 Release Notes 
+
+#### Release Date: 26 August 2026
+
+#### Release Highlights
+
+This patch implements several changes and fixes to improve the stability and correct the behavior of the Dashboard.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.13.2) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release
+
+#### Dependencies
+<a id="dependencies-5.13.2"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :------ | :---------------- | :---------------- |
+| 5.13.2  | MDCB v2.13.0      | MDCB v2.13.0      |
+|         | Operator v1.5.0   | Operator v0.17    |
+|         | Sync v2.2.2       | Sync v2.2.2       |
+|         | Helm Chart v5.4.0 | Helm all versions |
+|         | EDP v1.19.0       | EDP all versions  |
+|         | Pump v1.17.0      | Pump all versions |
+|         | TIB (if using standalone) v1.8.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.13.2"></a>
+
+| Third Party Dependency                                    | Tested Versions     | Compatible Versions | Comments | 
+| :-------------------------------------------------------- | :------------------ | :------------------ | :------- | 
+| [Golang](https://go.dev/dl/)                              | 1.26                |  1.26               | [Go plugins](/api-management/plugins/golang) must be built using Go 1.26 | 
+| [Redis](https://redis.io/download/)                       | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | | 
+| [Valkey](https://valkey.io/download/)                     | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 7.0.x, 8.0.x  | 6.0.x, 7.0.x, 8.0.x  | |
+| [DocumentDB](https://aws.amazon.com/documentdb/)          | 4, 5                | 4, 5                | | 
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x         | 13.x - 17.x         | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | v3.1.x, v3.0.x | v3.1.x, v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.13.2"></a>
+
+If you are upgrading to 5.13.2, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.13.2)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.13.2
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+#### Changelog
+<a id="Changelog-v5.13.2" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+<Accordion title='Updated Golang version to 1.26'>
+{/* TT-17868 */}
+Tyk Dashboard has been updated to build with Go 1.26, keeping the toolchain current with upstream Go security and performance updates.
+</Accordion>
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed API Debugger requests failing behind a service mesh'>
+{/* TT-10248 */}
+We have resolved an issue where requests issued by the API Debugger used the Dashboard's Host header rather than the target Gateway's. Strict routing layers such as Istio could reject these requests before they reached the Gateway. The Dashboard now sets the correct Host header when proxying debug requests, so the API Debugger works without custom service mesh workarounds.
+</Accordion>
+
+<Accordion title='Fixed HTTP 403 error when creating users or user groups with separate read/write database connections'>
+{/* TT-15506 */}
+We have resolved an issue affecting Tyk Dashboard deployments using SQL databases configured with separate read and write connection strings. Dashboard could return a `403` error if replication lag meant the newly written record wasn't yet visible on the read replica, even though the record had been created successfully. The Dashboard no longer performs a redundant read-after-write check, so creation succeeds reliably regardless of replication lag. This applies to user and user group creation.
+</Accordion>
+
+<Accordion title='Added `key_hash` field to API key update responses'>
+{/* TT-16433 */}
+When updating an API key by its hash (`?hashed=1`), the Dashboard API previously returned the hash value in the `key_id` field of the response, rather than in `key_hash` as it does for create and get operations. The response now always includes a `key_hash` field alongside `key_id`, so key hash and key ID are consistently distinguishable across all key operations. Existing integrations that read the hash from `key_id` continue to work unchanged.
+</Accordion>
+
+<Accordion title='Fixed redundant default port in generated Tyk OAS API server URLs'>
+{/* TT-16721 */}
+We have resolved an issue where, if the Gateway hostname used a default port (443 for HTTPS, 80 for HTTP), the Dashboard generated a server URL that included the redundant port explicitly (for example `https://api.example.com:443` instead of `https://api.example.com`). Non-default ports (such as 8080 or 8443) continue to be included as before. New Tyk OAS APIs no longer generate this redundant default-port entry.
+</Accordion>
+
+<Accordion title='Improved performance of policy updates involving many Tyk OAS APIs'>
+{/* TT-16937 */}
+We have resolved a performance issue where updating a Policy containing a large number of Tyk OAS APIs (for example, 60 or more) caused high latency, due to the Dashboard repeatedly re-parsing each API's OpenAPI document for validation, audit logging, and response serialization. Policy updates now scale linearly with the number of APIs in a policy instead of degrading sharply as policies grow.
+</Accordion>
+
+<Accordion title='Masked secrets in Identity Profiles and the Dashboard API access token'>
+{/* TT-17160 */}
+Building on the sensitive-value masking already applied to the API Designer, the Provider Configuration Secret in Identity Profiles (the OAuth/OIDC client secret used by Social and OpenID Connect providers) and a user's Dashboard API Access Token are now masked by default in the Dashboard UI, with a reveal/hide toggle. Existing permission checks for who can view the access token are unchanged — masking only applies to users who could already see the value.
+</Accordion>
+
+<Accordion title='Dashboard now validates that Listen Path includes a leading slash'>
+{/* TT-17631 */}
+We have resolved an issue where the Dashboard accepted and saved a Listen Path without a leading slash (`/`). A Listen Path missing its leading slash causes the Gateway to fail to load that API, so every request to it returns HTTP 404.
+
+The Dashboard now validates the presence of the leading slash at both the UI and API level, and rejects the save or import with a clear error message before an invalid definition can reach the Gateway. An existing API is left unchanged if an update with an invalid Listen Path is attempted.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:
+- <a href="https://osv.dev/vulnerability/GHSA-r277-6w6q-xmqw" target="_blank">GHSA-r277-6w6q-xmqw</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39822" target="_blank">CVE-2026-39822</a>
+- <a href="https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf" target="_blank">GHSA-hrxh-6v49-42gf</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46384" target="_blank">CVE-2026-46384</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46385" target="_blank">CVE-2026-46385</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-71556" target="_blank">CVE-2026-71556</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-46721" target="_blank">CVE-2025-46721</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41178" target="_blank">CVE-2026-41178</a>
+- <a href="https://osv.dev/vulnerability/GHSA-jpcw-4wr7-c3vq" target="_blank">GHSA-jpcw-4wr7-c3vq</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-71557" target="_blank">CVE-2026-71557</a>
+</Accordion>
+
+</AccordionGroup>
+
+### 5.13.1 Release Notes 
+
+#### Release Date 2 July 2026
+
+#### Release Highlights
+
+This patch implements several changes and fixes to improve the stability and correct the behavior of the Dashboard.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.13.1) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release
+
+#### Dependencies
+<a id="dependencies-5.13.1"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :------ | :---------------- | :---------------- |
+| 5.13.1  | MDCB v2.12.0      | MDCB v2.12.0      |
+|         | Operator v1.4.2   | Operator v0.17    |
+|         | Sync v2.2.0       | Sync v2.2.0       |
+|         | Helm Chart v5.3.0 | Helm all versions |
+|         | EDP v1.18.0       | EDP all versions  |
+|         | Pump v1.16.0      | Pump all versions |
+|         | TIB (if using standalone) v1.7.3 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.13.1"></a>
+
+| Third Party Dependency                                    | Tested Versions     | Compatible Versions | Comments | 
+| :-------------------------------------------------------- | :------------------ | :------------------ | :------- | 
+| [Golang](https://go.dev/dl/)                              | 1.25                |  1.25               | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)                       | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | | 
+| [Valkey](https://valkey.io/download/)                     | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 7.0.x, 8.0.x  | 6.0.x, 7.0.x, 8.0.x  | |
+| [DocumentDB](https://aws.amazon.com/documentdb/)          | 4, 5                | 4, 5                | | 
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x         | 13.x - 17.x         | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | v3.1.x, v3.0.x | v3.1.x, v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.13.1"></a>
+
+If you are upgrading to 5.13.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.13.1)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.13.1
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+#### Changelog
+<a id="Changelog-v5.13.1" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated embedded Tyk Identity Broker to version 1.7.3'>
+{/* TT-17453 */}
+Tyk Dashboard embeds Tyk Identity Broker. This has been updated to [version 1.7.3](/developer-support/release-notes/tib#1-7-3-release-notes).
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed issue with Docker images incompatible with legacy registries and tools'>
+{/* TT-17333 */}
+Docker images published in v5.13.0 contained mixed layer compression — base image layers used zstd compression while Tyk application layers used gzip. This caused image copy and promotion failures with legacy Docker tooling, older registry versions, and some security scanners, with the error: `zstd compression is not officially supported for docker images`.
+
+All image layers are now uniformly compressed using `gzip`, restoring compatibility with `skopeo`, `oc image mirror`, and other tools that do not support OCI `zstd` compression.
+</Accordion>
+
+<Accordion title='Fixed unexpected removal of JWT Auth configuration when upgrading from pre-5.10.0 versions'>
+{/* TT-17139 */}
+We have resolved an issue where the **Advanced Claim Mapping** configured for a Tyk OAS API using JWT Auth could be accidentally cleared following an upgrade from a pre-5.10.0 version of the Tyk Dashboard. The API Designer would remove the `authentication.securitySchemes.jwtAuth.scopes` configuration when the API was updated following the upgrade, leaving the API incorrectly configured.
+
+The Dashboard's API Designer no longer makes this unrequested modification to the API definition.
+</Accordion>
+
+<Accordion title='Fixed policies disappearing for non-admin users when their APIs are deleted'>
+{/* TT-11902 */}
+Resolved an issue where a policy became invisible to non-admin users once all of the APIs it granted access to had been deleted, even though the policy still existed. Users with explicit Read or Write policy permissions lost the ability to see or manage these policies, while admin users were unaffected.
+
+Non-admin users can now see and manage such policies again; when ownership cannot be determined from the referenced APIs, visibility falls back to the user's policy group permissions (Read or Write grants access, Deny does not).
+</Accordion>
+
+<Accordion title='Fixed inconsistent error codes returned whenn using non-existent API Ids'>
+{/* TT-16802 */}
+Resolved an issue where, with API ownership enabled, a non-admin user providing an unrecognized API Id in a request to the Dashboard API received `HTTP 401 Unauthorized`, while an admin user making the same request correctly received `HTTP 400 Bad Request`.
+
+Non-admin users now receive the same error code as admin users when the provided API Id does not exist. Ownership protection is unchanged: `HTTP 401 Unauthorized` is still returned when the resource exists but the user does not own it.
+</Accordion>
+
+<Accordion title='Fixed issue with temporary files left behind after importing a multipart OpenAPI document'>
+{/* TT-16816 */}
+Resolved an issue where importing a [multipart OpenAPI document](/api-management/gateway-config-managing-oas#multi-part-openapi-documents) from a ZIP archive left temporary files on the Dashboard's local disk after the import completed. Over time this could exhaust disk space and, because the temporary location was derived from the archive filename, a later import using the same filename could reuse stale contents resulting in unexpected API configuration.
+
+Imports now use a unique temporary location per upload that is always cleaned up, even if the import fails, and concurrent uploads no longer interfere with one another. This applies to both creation and updating of Tyk OAS APIs, whether imported through the UI or the Dashboard API.
+</Accordion>
+
+<Accordion title='Fixed orphaned Tyk OAS API versions not appearing in the Dashboard UI on PostgreSQL'>
+{/* TT-15988 */}
+We have resolved an issue where child API versions that were orphaned (due to deletion of the base API version) on Dashboard versions prior to 5.8.6 did not appear in the main API list when using PostgreSQL, and could only be found through search.
+
+The Dashboard now detects these legacy orphaned Tyk OAS APIs and restores them to the main API list.
+</Accordion>
+
+<Accordion title='Fixed Dashboard UI crash when an OAS parameter uses `content` instead of `schema`'>
+{/* TT-16916 */}
+We have resolved an issue where opening a Tyk OAS API whose parameters use the OpenAPI `content` keyword (rather than `schema`) caused the API Designer and API Debugger to crash, and the Validate Request middleware form to reject the definition as invalid. The Dashboard now fully supports content-form parameters as defined by OpenAPI Specification 3.0: these APIs load without errors, and saving them preserves the content wrapper, including the media type and inner schema, without writing a conflicting top-level schema.
+</Accordion>
+
+<Accordion title='Fixed unnecessary proxy configuration being added to Tyk Vendor Extension'>
+{/* TT-16800 */}
+We have resolved an issue where a harmless, but unnecessary `upstream.proxy.enabled=false` could be added to the Tyk Vendor Extension when using the Tyk Dashboard API Designer. This was due to a serialization artifact in the UI and has been corrected. The resultant API definition no longer contains this unwanted configuration.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46599" target="_blank">CVE-2026-46599</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41506" target="_blank">CVE-2026-41506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45571" target="_blank">CVE-2026-45571</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42500" target="_blank">CVE-2026-42500</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41889" target="_blank">CVE-2026-41889</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45570" target="_blank">CVE-2026-45570</a>
+- <a href="https://osv.dev/vulnerability/GHSA-j88v-2chj-qfwx" target="_blank">GHSA-j88v-2chj-qfwx</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.13.0 Release Notes 
+
+#### Release Date 19 May 2026
+
+#### Release Highlights
+
+**MCP Gateway Management**
+Tyk Dashboard 5.13.0 adds comprehensive support for the MCP (Model Context Protocol) Gateway. A dedicated `/api/mcps` endpoint set provides full CRUD operations for MCP Proxy definitions.
+
+- A new `mcp` RBAC permission group (deny/read/write) controls access to MCP management independently of the existing `apis` permission. Visibility is controlled solely by the `mcp` RBAC permission.
+- Sessions (Keys) and Policies can now carry four new MCP-specific access-right fields for configuring tool-based access control and per-primitive rate limiting.
+
+This release also delivers a range of Dashboard UI enhancements, bug fixes, and CVE fixes to provide additional protection against security vulnerabilities.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.13.0) below.
+
+#### Breaking Changes
+
+**MCP Proxy policies incorrectly synchronize to Developer Portal versions prior to 1.17.2**
+
+Dashboard 5.13.0 introduces policies that grant access to MCP Proxies. Tyk Developer Portal versions prior to 1.17.2 may automatically retrieve these policies and present them as API Products when [synchronizing with the Dashboard](/portal/api-products#dashboard-first-approach).
+
+There is no facility at this time for Developer Portal to manage API Products that grant access to MCP Proxies. An administrator could inadvertently publish an MCP server to API Consumers leading to a confusing experience.
+
+Upgrade to **Developer Portal 1.17.2 or later** before or immediately after upgrading the Dashboard. Developer Portal 1.17.2 recognises MCP Proxy policies and does not make them available as API Products.
+
+**Strict Validation of Characters Allowed in Policy IDs**
+
+To avoid an issue where Policy IDs containing special characters could cause problems when parsing API endpoint requests, we have introduced strict validation of Policy IDs during Policy creation and update.
+
+The allowed characters are:
+- alphanumeric characters
+- `_`
+- `-`
+- `.`
+- `~`
+
+Strict validation can be disabled, if required for existing Policies with incompatible Policy IDs, using the new Dashboard configuration `allow_unsafe_policy_ids`. If using this mode, care must be taken not to use characters that could affect URL parsing.
+
+#### Dependencies
+<a id="dependencies-5.13.0"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|-------------|
+| 5.13.0 | MDCB v2.11.0       | MDCB v2.11.0 |
+|        | Operator v1.4.0   | Operator v0.17 |
+|        | Sync v2.1.8       | Sync v2.1.1 |
+|        | Helm Chart v5.2.0   | Helm all versions |
+|        | EDP v1.17.3        | EDP all versions |
+|        | Pump v1.15.0       | Pump all versions |
+|        | TIB (if using standalone) v1.7.1 | TIB all versions |
+
+<Note>
+To use MCP Gateway features introduced in this release, upgrade the following Tyk components at the same time:
+
+- **Gateway v5.13.0**: MCP Proxy request handling, SSE streaming, TBAC, and per-primitive rate limiting
+- **Pump v1.15.0**: MCP analytics (MongoDB, PostgreSQL, Elasticsearch, and Prometheus backends)
+- **MDCB v2.11.0**: MCP analytics routing in distributed deployments
+- **Operator v1.4.0**: MCP Proxy management via Kubernetes CRDs
+- **Sync v2.1.7**: MCP Proxy support in dump and sync operations
+- **Developer Portal v1.17.2 and later**: filter all MCP Proxy policies from the developer catalogue; v1.17.1 provides a partial mitigation covering policies with TBAC or per-primitive rate limiting configured
+</Note>
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.13.0"></a>
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [Golang](https://go.dev/dl/)          | 1.25 | 1.25 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.4) | 5.x, 6.x, 7.x, 8.x (up to 8.4) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 7.0.x, 8.0.x  | 6.0.x, 7.0.x, 8.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | v3.1.x, v3.0.x | v3.1.x, v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.13.0"></a>
+
+If you are upgrading to 5.13.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+If your deployment uses MCP Gateway, additional component ordering applies:
+- In distributed deployments, MDCB 2.11.0 must be deployed before Gateway and Dashboard.
+- Tyk Operator 1.4.0 must be deployed after Gateway and Dashboard are running.
+- Portal 1.17.3 or later should be deployed before any MCP Proxy policies are created in Dashboard.
+
+See [MCP Gateway upgrade considerations](/developer-support/upgrading#mcp-upgrade-considerations) for the full sequence.
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.13.0)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.13.0
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+<Note>
+Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.13.0.
+</Note>
+
+#### Changelog
+<a id="Changelog-v5.13.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Add MCP Proxy management API'>
+We have introduced the `/api/mcps` endpoint set, providing full CRUD operations for MCP Proxy definitions:
+
+- `GET /api/mcps`: list MCP Proxies
+- `POST /api/mcps`: create an MCP Proxy
+- `GET /api/mcps/{id}`: retrieve an MCP Proxy
+- `PUT /api/mcps/{id}`: update an MCP Proxy
+- `DELETE /api/mcps/{id}`: delete an MCP Proxy
+
+A schema endpoint at `/api/schemas/apidefs/mcp` returns the MCP Proxy definition JSON schema. MCP Proxy definitions are not returned by the standard API listing endpoints.
+
+For details, see the [Managing MCP Proxies documentation](/ai-management/mcp-gateway/managing-proxies).
+</Accordion>
+
+<Accordion title='Add dedicated MCP RBAC permission group'>
+We have introduced a dedicated `mcp` permission group (deny/read/write) for controlling access to MCP management endpoints in the Dashboard. Previously, `/api/mcps` endpoints fell under the `apis` permission.
+
+Users who need to manage MCP Proxies must be granted `mcp: write`. Read-only access to MCP listings requires `mcp: read`. This change allows organizations to grant access to MCP management without also granting broader API management permissions.
+
+For details, see the [Managing MCP proxies documentation](/ai-management/mcp-gateway/managing-proxies).
+</Accordion>
+
+<Accordion title='Add MCP access rights to Sessions and Policies'>
+Sessions and Policies now support four new fields for configuring Tool-Based Access Control (TBAC) and per-primitive rate limiting on MCP Proxies:
+
+- `json_rpc_methods`: per-method rate limits (e.g., `tools/call`, `resources/read`)
+- `json_rpc_methods_access_rights`: allow or deny rules by JSON-RPC method name
+- `mcp_primitives`: per-primitive rate limits keyed by type and name
+- `mcp_access_rights`: allow or deny rules by primitive type and name (tool, resource, or prompt)
+
+Validation rejects these fields on non-MCP APIs with an `HTTP 400 Bad Request` response. Unknown API IDs are skipped during validation to avoid false negatives at Gateway startup.
+
+For details, see the [MCP Proxy policies documentation](/ai-management/mcp-gateway/policies).
+</Accordion>
+
+<Accordion title='Simplified management of Session lifetime'>
+We have added a new, simplified, approach to configuring [Session lifetime](/api-management/access-control/sessions-and-keys/session-lifecycle) within Redis.
+
+Two new fields have been added to the Session object, which can be directly configured when creating Sessions using the [Keys API](https://tyk.io/docs/api-reference/keys/create-custom-key) or [Policy API](https://tyk.io/docs/api-reference/policies/create-policy-definition), or from the key/policy management screens in the Dashboard UI:
+
+- [post_expiry_action](/api-management/access-control/sessions-and-keys/session-lifecycle#2-define-the-post-expiry-action) - determines what happens to the data in Redis after the `expires` timestamp is reached.
+- [post_expiry_grace_period](/api-management/access-control/sessions-and-keys/session-lifecycle#3-configure-the-grace-period) - defines how long (in seconds) the Session is kept in Redis after expiration (if the `post_expiry_actions` is to retain the Session)
+
+
+The existing Gateway-wide [global session lifetime](/api-management/access-control/sessions-and-keys/session-lifecycle#gateway-level-settings) override is still respected.
+
+The [legacy API level controls](/api-management/access-control/sessions-and-keys/session-lifecycle#legacy-controls) can still be used if both new fields are set to `0` (or unset) so **there is no change in behavior for existing Sessions**.
+</Accordion>
+
+
+<Accordion title='Dashboard UI enhancements'>
+We have introduced several improvements to the Dashboard UI to enhance security, usability, and developer productivity.
+
+- **Masked sensitive configuration values**: Sensitive fields such as HMAC shared secrets, JWT public keys, OAuth client secrets, upstream basic auth passwords, Dashboard API access tokens, and Kafka SASL passwords are now masked by default across the API Designer, Tyk Classic and Tyk OAS API configuration forms, and Universal Data Graph data source configurations. A reveal/hide toggle allows authorised users to view values when needed, and values are automatically re-masked on page refresh.
+
+- **Improved certificate ID visibility**: Certificate IDs are now displayed in full when space allows, and truncated from the left (preserving the distinctive fingerprint) when space is limited. The behavior is consistent across the Certificate Store, API Designers, Keys, Policies, and all certificate selection components, with the full ID always available on hover.
+
+- **Configurable toast notification duration**: The display duration of toast notifications can now be configured separately for success, warning, info, and error messages via the new [ui.notifications.duration](/tyk-dashboard/configuration#ui-notifications-duration) configuration option, replacing the previous fixed three-second duration. This helps reduce visual noise from frequent notifications while keeping critical messages visible for longer.
+
+- **Skip Universal Data Graph schema update confirmations**: Added a checkbox to suppress the confirmation modal when updating Universal Data Graph schemas. When selected, confirmations are skipped for the remainder of the browser session and reset on a new session, supporting faster iterative development while preserving safe defaults.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fix JavaScript regex unicode escape sequence handling during OpenAPI import'>
+We have resolved an issue where JavaScript-style Unicode regex patterns in OpenAPI documents failed validation during API import.
+
+Previously, when regex patterns containing Unicode escape sequences (for example `\u0000-\u017f`) were defined with single quotes in YAML, the YAML-to-JSON conversion process would double-escape the backslashes, transforming valid `\u` sequences into invalid `\\u` sequences that were rejected by Tyk's regex validator.
+
+The system now automatically translates these escape sequences during API ingestion, ensuring that OpenAPI documents with JavaScript regex patterns import successfully regardless of whether single or double quotes are used in the YAML definition.
+</Accordion>
+
+<Accordion title='Fix Dashboard certificate filter for APIs'>
+We have resolved an issue where the Dashboard's "Filter by API" feature on the TLS/SSL Certificates page did not return all certificates linked to an API.
+
+Previously, the filter only displayed certificates used for client-to-gateway mTLS, ignoring certificates used for gateway-to-upstream mTLS, custom domain certificates, and certificate pinning. This resulted in incomplete and misleading results for users trying to view all certificates actively used by a given API.
+
+The Dashboard now correctly returns all certificates when filtering by API.
+</Accordion>
+
+<Accordion title='Fix Tyk OAS update failures during import'>
+We have resolved an issue when importing an updated OpenAPI document to update an existing Tyk OAS APIs if the OpenAPI document contained external parameter references.
+
+Previously, when importing OpenAPI documents that referenced multiple distinct parameters from external files (e.g., `$ref: './parameters.yaml#/ID'`, `$ref: './parameters.yaml#/Name'`), the Dashboard's import process incorrectly collapsed all external references into a single generic parameter component and duplicated that reference multiple times, creating invalid OpenAPI specifications with multiple parameters having the same name and location.
+
+The Dashboard now properly resolves external parameter references to distinct parameter definitions during import, ensuring that each `$ref` becomes a separate, uniquely-named parameter component and maintains OAS compliance for successful updates.
+</Accordion>
+
+<Accordion title='Add strict validation for Policy ID characters'>
+We have resolved an issue where policy IDs containing special characters could cause problems when parsing API endpoint requests. Previously, policy IDs with characters such as `#`, `?`, `%`, and `/` would interfere with URL parsing in Dashboard and Gateway API endpoints that use the policy ID as a path parameter, potentially causing request failures or unexpected behavior.
+
+We have introduced strict validation across both the Dashboard and Gateway APIs to restrict policy identifiers to a safe character set (alphanumeric characters plus `_`, `-`, `.`, `~`). The validation occurs during policy creation and updates via the following endpoints:
+- `POST /api/portal/policies` and `PUT /api/portal/policies/{id}` (Dashboard API)
+- `POST /tyk/policies` and `PUT /tyk/policies/{polID}` (Gateway API)
+
+The API now returns a clear error message if an unacceptable character is used in the policy ID field, ensuring reliable policy management across all deployment types.
+</Accordion>
+
+<Accordion title='JWT Subject and Policy Claim fields now migrated correctly on load'>
+This release fixes a migration issue affecting Tyk OAS APIs with JWT authentication that were created on versions prior to v5.10.0 - the release in which the multiple IdP enhancement introduced the new `subjectClaims`, `basePolicyClaims`, and `jwksURIs` fields, replacing the legacy `identityBaseField` and `policyFieldName` in the Dashboard UI.
+When a Tyk OAS JWT API definition created on an earlier version is now loaded in the Dashboard, the legacy field values are automatically copied into the new fields:
+| Legacy Field          | New Field            |
+|-----------------------|----------------------|
+| `identityBaseField`   | `subjectClaims`      |
+| `policyFieldName`     | `basePolicyClaims`   |
+
+The `jwksURIs` field is also now populated correctly on initial load rather than only after saving.
+Backward compatibility is preserved: the legacy fields are left untouched in the API definition, so the API will continue to work correctly with older Gateways during a phased upgrade.
+</Accordion>
+
+<Accordion title='Fix API expiry date drift'>
+We have resolved an issue where an API's expiry date could drift back by one day each time the API was saved in the API Designer. This was reported by users in positive UTC timezones (such as UTC+8). Saving an API without changing the expiry is now fully idempotent, and the expiry date remains stable across repeated saves regardless of the user's timezone.
+</Accordion>
+
+<Accordion title='Resolve Gateway registration failures at scale on unlimited node licenses'>
+We have resolved a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an **unlimited node license**. During mass registrations or rolling upgrades, a combination of lock contention, excessive Redis load, and incorrect handling of `409 Conflict` responses could leave Gateways stuck in registration loops without the credentials needed to serve traffic.
+
+Gateway registration is now significantly more robust at scale: registration requests are no longer serialized across the fleet, Gateways recover cleanly from transient `409 Conflict` responses instead of looping, and the Redis load generated during registration storms is substantially reduced.
+
+A dedicated fix for **limited node license** deployments will be provided in an upcoming release. 
+
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Fix CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33762" target="_blank">CVE-2026-33762</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-1229" target="_blank">CVE-2026-1229</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33812" target="_blank">CVE-2026-33812</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33532" target="_blank">CVE-2026-33532</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-2950" target="_blank">CVE-2026-2950</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-13465" target="_blank">CVE-2025-13465</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15599" target="_blank">CVE-2025-15599</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39882" target="_blank">CVE-2026-39882</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34165" target="_blank">CVE-2026-34165</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33671" target="_blank">CVE-2026-33671</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-4800" target="_blank">CVE-2026-4800</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39883" target="_blank">CVE-2026-39883</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15558" target="_blank">CVE-2025-15558</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33487" target="_blank">CVE-2026-33487</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-62718" target="_blank">CVE-2025-62718</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-40175" target="_blank">CVE-2026-40175</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+---
+
+## 5.12 Release Notes 
+
+### 5.12.1 Release Notes
+
+#### Release Date 21st April 2026
+
+#### Release Highlights
+
+Tyk Dashboard has been updated to Golang 1.25 and Debian 13 (Trixie) for enhanced security and performance. This release also addresses multiple CVEs in dependent libraries.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.12.1).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.12.1"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|-------------|
+| 5.12.1 | MDCB v2.9.0       | MDCB v2.9.0 |
+|        | Operator v1.3.0   | Operator v0.17 |
+|        | Sync v2.1.6       | Sync v2.1.0 |
+|        | Helm Chart v5.1   | Helm all versions |
+|        | EDP v1.17.0       | EDP all versions |
+|        | Pump v1.14.1      | Pump all versions |
+|        | TIB (if using standalone) v1.7.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.12.1"></a>
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [GoLang](https://go.dev/dl/)          | 1.25 | 1.25 | [Go plugins](/api-management/plugins/golang) must be built using Golang 1.25 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.4) | 5.x, 6.x, 7.x, 8.x (up to 8.4) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | v3.1.x | v3.1.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.12.1"></a>
+
+If you are upgrading to 5.12.1, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.12.1)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.12.1
+    ```
+- Helm charts
+  - [tyk-charts v5.1.0](/developer-support/release-notes/helm-chart#5-1-0-release-notes)
+
+<Note>
+Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.12.1.
+</Note>
+
+#### Changelog
+<a id="Changelog-v5.12.1" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated Golang version to 1.25'>
+The Tyk Dashboard has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
+</Accordion>
+
+<Accordion title='Update Docker images to Debian 13 (Trixie)'>
+Updated the Docker images to Debian 13 (Trixie) to address multiple vulnerabilities in the underlying operating system.
+</Accordion>
+
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security vulnerabilities:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15281" target="_blank">CVE-2025-15281</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-0861" target="_blank">CVE-2026-0861</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-0915" target="_blank">CVE-2026-0915</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25679" target="_blank">CVE-2026-25679</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32285" target="_blank">CVE-2026-32285</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32286" target="_blank">CVE-2026-32286</a>
+- <a href="https://www.cvedetails.com/cve/CVE-2026-33186/" target="_blank">CVE-2026-33186</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34986" target="_blank">CVE-2026-34986</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+
+### 5.12.0 Release Notes
+
+#### Release Date 06 March 2026
+
+#### Release Highlights
+
+**OpenAPI Specification 3.1 is now supported**
+
+In this release, we are delighted to bring initial support for OAS 3.1, covering:
+
+- Import and validation of OpenAPI 3.1 descriptions using Tyk Dashboard to create Tyk OAS APIs
+- OAS 3.1 features:
+    - Full JSON Schema Support and $schema keyword
+    - The single `example` keyword is deprecated in OAS 3.1
+    - `type` can be an array
+    - exclusiveMinimum and exclusiveMaximum keywords
+
+We do not yet have support for all new features. For more details, see the [documentation](/api-management/gateway-config-tyk-oas#openapi-specification-3-1).
+
+**Simplified Management of Versioned Tyk OAS APIs**
+
+Managing versioned API hierarchies is now much easier and safer. We've introduced the ability to promote any child API version to become the new base (routing) API directly from the Dashboard UI, seamlessly transferring routing configurations without service disruption.
+
+Additionally, we've improved the experience of deleting a base API. Instead of manually cleaning up orphaned child APIs, you are now presented with clear, intelligent options: promote a child to the new base, delete all associated child APIs together, or leave them as independent APIs. These enhancements eliminate manual cleanup work and give administrators full control over their API lifecycles.
+
+**Enhanced Security with Client Certificate-Token Binding**
+
+To provide an additional layer of security for your APIs, we've introduced Dashboard support for [Client Certificate-Token Binding](/api-management/authentication/bearer-token#client-certificate-token-binding). This feature allows you to form a strict binding association between an Auth Token issued to a client and their specific client certificate.
+
+By ensuring that a token can be used only with its bound certificate, you can significantly reduce the risk of token theft or misuse. You can now easily manage these bindings directly from the Dashboard when creating or modifying keys, with full support for certificate rotation scenarios by allowing multiple certificates to be bound to a single key.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.12.0).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.12.0"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|-------------|
+| 5.12.0 | MDCB v2.9.0       | MDCB v2.9.0 |
+|        | Operator v1.3.0   | Operator v0.17 |
+|        | Sync v2.1.6       | Sync v2.1.0 |
+|        | Helm Chart v5.1   | Helm all versions |
+|        | EDP v1.17.0       | EDP all versions |
+|        | Pump v1.14.0      | Pump all versions |
+|        | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.12.0"></a>
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [GoLang](https://go.dev/dl/)          | 1.24 | 1.24 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.4) | 5.x, 6.x, 7.x, 8.x (up to 8.4) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | v3.1.x | v3.1.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.12.0"></a>
+
+If you are upgrading to 5.12.0, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.12.0)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.12.0
+    ```
+- Helm charts
+  - [tyk-charts v5.1.0](/developer-support/release-notes/helm-chart#5-1-0-release-notes)
+
+<Note>
+Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.12.0.
+</Note>
+
+#### Changelog
+<a id="Changelog-v5.12.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Added support for OpenAPI 3.1 (OAS v3.1.x)'>
+This release introduces initial support for importing and validating OpenAPI 3.1 descriptions to create Tyk OAS APIs. The implementation maintains backward compatibility with OAS 3.0 while adding support for the new JSON Schema 2020-12 validator:
+
+- Added full JSON Schema support, including the `$schema` keyword.
+- Added support for defining `type` as an array (e.g., `["string", "null"]`).
+- Updated `exclusiveMinimum` and `exclusiveMaximum` to support numeric values instead of booleans, aligning with OAS 3.1 standards.
+- Deprecated the single `example` keyword in accordance with the OAS 3.1 specification.
+
+Please note the following limitations in this initial release:
+- Conversion from OAS 3.0 to OAS 3.1 is not yet supported.
+- Reusable Path Item Objects and the new `mutualTLS` security scheme are not currently supported.
+- Tyk Dashboard's API Editor does not yet validate the schema in real-time; validation is performed only when saving the API.
+</Accordion>
+
+<Accordion title='Added base API reassignment and intelligent deletion for versioned Tyk OAS APIs'>
+This release introduces comprehensive UI and API support for restructuring versioned Tyk OAS API hierarchies, eliminating the manual work previously required to manage orphaned APIs:
+
+- Added the ability to promote a child API to become the new base API directly from the versions table, automatically reassigning the existing base API as a child version.
+- Enhanced the API Designer deletion workflow for base APIs to present three options: promote a child to base, delete all child versions (bulk deletion), or leave child APIs orphaned (previous behavior).
+- Extended the Dashboard API with a new `PATCH /api/apis/oas/{current-base-api-id}/{next-base-api-id}` endpoint to programmatically convert a child API into the base API.
+- Added an optional `purge` parameter to the `DELETE /api/apis/oas/{apiId}` endpoint to enable bulk deletion of all child APIs when a base API is deleted.
+</Accordion>
+
+<Accordion title='JSON Log Format Support for Dashboard'>
+The Tyk Dashboard now supports [application logging](/api-management/logs/application-logs) in structured JSON format. To enable this feature, set the environment variable `TYK_DB_LOGFORMAT` to `json`.
+
+This feature provides consistency with the Gateway's JSON log format option (introduced in Tyk 5.6.0) and enables better log ingestion by centralized logging systems, SIEM tools, and observability platforms. The configuration is case-insensitive and falls back to the standard text format for any invalid values, ensuring backward compatibility and reliable operation.
+</Accordion>
+
+<Accordion title='Full Support for Custom Policy IDs in Dashboard API'>
+The Dashboard API's policy management endpoints now support the recommended Policy ID (`id`) for all operations. Previously the API only supported the Policy Database ID (`_id`) for some operations, which could cause problems when  migrating policies between environments. For reasons of backward compatibility, the Policy Database ID is still supported.
+
+Users are advised to avoid duplicate Policy IDs to minimise the risk of ambiguous interpretation.
+
+This enhancement streamlines policy management for users who prefer meaningful, custom identifiers over auto-generated database IDs, while ensuring existing workflows remain unaffected.
+</Accordion>
+
+<Accordion title='Added Dashboard support for Client Certificate-Token Binding'>
+This release introduces Dashboard UI and API support for managing Client Certificate-Token bindings for APIs secured with a static mTLS allow list. This allows administrators to easily configure enhanced token security:
+
+- Added the ability to bind one or more client certificates to a key (token) when creating or modifying it via the Dashboard.
+- Supports binding multiple client certificates to a single key to facilitate certificate rotation scenarios.
+- Maintains full backward compatibility with existing keys that do not specify certificate bindings.
+
+Please note that bound certificates must also be present in the client certificate allow list within the API definition to ensure successful validation after the mTLS handshake.
+</Accordion>
+
+<Accordion title='Replaced Dynamic mTLS with Certificate Authentication'>
+Renamed "Dynamic mTLS" to "Certificate Authentication" across the Tyk Classic and Tyk OAS API Designers and Key Management screens. It is now presented as a standalone authentication method rather than a sub-option of Auth Token, making it more intuitive to configure and aligning the UI with the Gateway's updated configuration structure.
+</Accordion>
+
+<Accordion title='Improved middleware visualization in the API Debugger'>
+Enhanced the visual timeline in the API Designer's debug panel to make request tracing easier. The "Inspect" tab now clearly differentiates between Request and Response middleware chains with distinct labels and colors, and visually isolates the Reverse Proxy step so you can easily see exactly where the request was sent upstream.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed GeoIP Location Data Display in SQL Analytics Storage'>
+Resolved issues preventing GeoIP location data from displaying correctly when using SQL storage for analytics. Previously, the Log Browser showed "GeoIP not recognized" for country codes, and geographic traffic filtering returned empty results, even though location data was properly captured and stored in the database. 
+
+The Dashboard can now correctly read and display all geographic information, including country codes, city names, coordinates, and timezone data from SQL storage. Geographic traffic filtering by country code now works as expected, enabling users to analyze traffic patterns by location when using SQL-based analytics storage.
+</Accordion>
+
+<Accordion title='Fixed API-Specific Key Retrieval in Dashboard'>
+Resolved an issue where the Dashboard's `GET /api/apis/{api_id}/keys` endpoint incorrectly returned all keys in the environment instead of only keys associated with the specified API. Users can now accurately retrieve and manage keys for individual APIs, eliminating confusion in multi-API environments. Note that adding this filtering can cause minor delays in responses to this endpoint when there are many APIs and keys.
+</Accordion>
+
+<Accordion title='Issues Associating Client Certificates with API Keys and Policy ID Display'>
+Resolved multiple Dashboard UI issues affecting mTLS configuration and policy management:
+- **Certificate Authentication Configuration**: Fixed an issue where the Create Key and Edit Key screens would incorrectly require the user to register a client certificate with the key when granting access to an API secured with static mTLS. Additionally, fixed a separate issue where the option to assign the client certificate was not possible when creating a key for an API which has the authentication method changed to use dynamic mTLS. 
+- **Policy ID Display Consistency**: Updated the Dashboard UI to consistently display the policy `id` field instead of the MongoDB database `_id` field across all policy listings, detail views, and selection components. This ensures that policy IDs shown in the UI work reliably with JWT `pol` claims regardless of how policies were created (Dashboard UI vs. Operator) or Gateway configuration settings. Copy-to-clipboard functionality now copies the correct `id` field, and policy selection dropdowns use consistent identifiers.
+
+These fixes eliminate confusing certificate linking requirements, ensure consistent dynamic mTLS key creation regardless of when certificate authentication is enabled, provide clearer separation between different mTLS authentication modes, and resolve JWT authentication failures caused by users copying database IDs from the UI instead of the proper policy identifiers.
+</Accordion>
+
+<Accordion title='Fixed Certificate Re-use After Swapping in Multi-Auth Keys'>
+Resolved an issue where swapping certificates in multi-auth (mTLS + Basic auth) keys prevented the original certificate from being reused. Previously, when updating a key's certificate, the original certificate remained incorrectly associated with the key internally, causing "key with given certificate already found" errors when attempting to reuse that certificate. 
+
+Tyk now properly detaches certificates during key updates, allowing certificates to be freely reused across different keys after being removed from their original association.
+</Accordion>
+
+<Accordion title='Improved Experience when License Missing or Expired'>
+Fixed inaccurate wording and links on the screen presented on startup when the Dashboard license is missing or has expired.
+</Accordion>
+
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Security Vulnerabilities Fixed'> 
+Multiple high-severity CVEs have been fixed. 
+</Accordion>
+
+</AccordionGroup>
+
+## 5.11 Release Notes 
+
+### 5.11.1 Release Notes 
+
+#### Release Date 13th February 2026
+
+In this release, we have fixed some priority CVEs. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.11.1).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.11.1"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|-------------|
+| 5.11.1 | MDCB v2.8.8       | MDCB v2.8.7 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.5       | Sync v2.1.0 |
+|        | Helm Chart v5.0   | Helm all versions |
+|        | EDP v1.15.0       | EDP all versions |
+|        | Pump v1.13.3      | Pump all versions |
+|        | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.11.1"></a>
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [GoLang](https://go.dev/dl/)          | 1.24 | 1.24 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.11.1"></a>
+
+If you are upgrading to 5.11.1, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.11.1)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.11.1
+    ```
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.11.1.
+
+#### Changelog
+<a id="Changelog-v5.11.1" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Fix CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15467" target="_blank">CVE-2025-15467</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-69419" target="_blank">CVE-2025-69419</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61726" target="_blank">CVE-2025-61726</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61728" target="_blank">CVE-2025-61728</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68121" target="_blank">CVE-2025-68121</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.11.0 Release Notes 
+
+#### Release Date 18 December 2025
+
+#### Release Highlights
+
+Tyk 5.11 delivers security enhancements, streamlined developer workflows, and deeper operational visibility - empowering teams to scale their API programs with confidence and efficiency.
+
+**Strengthened API Security & Authentication**
+This release advances our security foundation with enhanced JWT authentication capabilities. Teams can now leverage scope-to-policy mapping without requiring default policies, while new support for nested claims enables more granular policy and subject identification. We've also added IP spoofing protection through configurable depth selection in X-Forwarded-For headers, and introduced a new Dashboard API endpoint that allows admins to clear JWKS cache across all connected Gateways.
+
+**Improved Certificate Management & Visibility**
+Certificate management becomes more proactive with enhanced visibility showing which APIs are impacted by each certificate, plus highlighting certificates approaching expiry to prevent service disruptions before they occur.
+
+**Enhanced Developer Experience**
+API integration gets simpler with automatically populated OpenAPI descriptions that include all accessible URLs based on deployment targets and version identifiers. This reduces integration errors and accelerates time-to-value for API consumers.
+
+**Advanced Operational Control**
+Operations teams gain greater flexibility with the ability to temporarily remove targets from upstream load balancers during maintenance windows. Enhanced observability comes through OTel trace propagation to custom gRPC plugins, trace ID inclusion in API traffic logs, and dedicated Gateway latency metrics alongside upstream measurements.
+
+**Stability & User Experience Improvements**
+This release also includes important fixes for memory exhaustion issues when Redis logging is enabled, improved consistency between Dashboard and Gateway validation for JWT configurations, and streamlined policy management with standardized Policy ID usage across the platform. Multiple UI improvements enhance the user experience including fixes for API filtering, certificate search functionality, Quick Start onboarding flow, and various dashboard display issues - ensuring a smoother workflow for API management and configuration tasks.
+
+These enhancements collectively strengthen Tyk's position as the platform of choice for organizations requiring enterprise-scale API management with robust security, operational excellence, and developer productivity.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.11.0).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.11.0"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|-------------|
+| 5.11.0 | MDCB v2.8.7       | MDCB v2.8.7 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.5       | Sync v2.1.0 |
+|        | Helm Chart v5.0   | Helm all versions |
+|        | EDP v1.15.0       | EDP all versions |
+|        | Pump v1.13.2      | Pump all versions |
+|        | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.10.1"></a>
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [GoLang](https://go.dev/dl/)          | 1.24 | 1.24 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+In this release we've deprecated the [policies.allow_explicit_policy_id](/tyk-oss-gateway/configuration#policies-allow_explicit_policy_id) configuration option. This was previously added to allow the use of custom policy IDs, which is now the default behaviour so this option is redundant.
+
+#### Upgrade instructions
+<a id="upgrade-5.11.0"></a>
+
+If you are upgrading to 5.11.0, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.11.0)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.11.0
+    ```
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.11.0.
+
+#### Changelog
+<a id="Changelog-v5.11.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Improved Flexibility for Key Expiration Settings'>
+We've improved key expiration flexibility in the Tyk Dashboard by adding support for custom expiration periods using human-readable time formats (e.g., "5h,34m,30s"). Users can now input custom timeframes supporting months, weeks, days, hours, and seconds in addition to the existing predefined options, eliminating the previous restriction and removing the need for API calls or manual key revocation for custom expiration times.
+</Accordion>
+
+<Accordion title='Open Policy Agent Support for Distinguishing Tyk OAS APIs'>
+Added three new OPA helper functions (`isTykOas`, `isTykClassic`, and `isTykStreams`) that can be used in OPA rules to distinguish between different API types, ensuring that logic is only applied to the appropriate API types.
+</Accordion>
+
+<Accordion title='Added API Endpoint for Certificate Dependencies'>
+Introduced a new Dashboard API endpoint `GET /certs/{certificateId}/apis` that retrieves all APIs linked to a specific certificate. The endpoint returns API names, IDs, and how they are used by each API (client, upstream, server) with proper pagination support, enabling the frontend to display certificate impact information without expensive client-side filtering across all APIs.
+</Accordion>
+
+<Accordion title='Improvements in the Dashboard UI'>
+- **Proactive Certificate Expiry Notifications in Tyk Dashboard**: Added banner notification to inform the user if the Dashboard has received a certificate expiring soon/expired event from the Gateway. Such certificates are now highlighted on the certificates screen.
+- **Improved Automatic Configuration Options for API Creation**: Enhanced the user experience when importing OpenAPI descriptions by replacing checkboxes with toggle switches and improving the wording of configuration options. The new interface provides clearer descriptions for Request Validation, Mock Responses, Authentication Detection, and Path Restrictions.
+- **Enhanced Certificate Management with Impact Visibility**: Introduced a new Certificate Details page that displays user-friendly certificate metadata with a toggle between formatted and raw JSON views. The page now shows certificate status indicators (valid, expiring soon, expired) and lists all APIs using the certificate with clickable navigation to their API Designer pages.
+</Accordion>
+
+<Accordion title='Improved visibility of API base paths'>
+Tyk has always added the base path to the `servers` section of an API's OpenAPI description. Until now, this has been constructed from the address of the local Gateway with the unique listen path for the API. This is not always accessible, for example for child API versions configured for internal access.
+
+Now Tyk will calculate all the URLs where the API can be accessed, adding these to the `servers` section of the OpenAPI description. This takes into account the versioning identifier if URL location is in use (e.g. `<gateway_url>/<listen_path>/v1`) and, where `edge_endpoints` are defined in the Dashboard config, the data plane Gateways where the API is deployed.
+
+We have introduced a new Dashboard API endpoint (`GET /api/apis/oas/{apiID}/urls`) that returns a list of all of these base paths, presented in a structured format including detailed components (protocol, domain, port, listen-path, versioning identifier).
+
+The API Designer uses the data from this endpoint to display all known API URLs and also indicates how to select the specific API version (if applicable) using URL, query parameter or header.
+</Accordion>
+
+<Accordion title='Removed Default Policy Requirement for JWT Scope-to-Policy Mapping'>
+We’ve removed the need to supply a default policy when using scope-to-policy mapping with JWT Authentication. Now, if you enable scope-to-policy mapping by configuring `scopes.claimName`, you do not need to provide a policy ID in `defaultPolicies`. If a request does not contain any valid scopes, it will be rejected with `HTTP 403 Forbidden` (default deny). You can still provide a default policy if you require a different behaviour.
+</Accordion>
+
+<Accordion title='Added JWKS cache flush to the Dashboard API and MDCB'>
+Added JWKS cache invalidation endpoint `DELETE /api/cache/jwks/{apiID}` to the Dashboard API to flush JWKS cache for specific APIs across all connected Gateways. This extends the existing Gateway-level JWKS cache flush functionality to work through the Dashboard API with proper MDCB propagation to data plane Gateways. Access is restricted to admin users with API ownership validation, ensuring secure cache management across distributed Gateway deployments.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed Dashboard Memory Exhaustion When `use_redis_log` Is Enabled'>
+Fixed an issue where enabling `use_redis_log` on a Tyk Gateway could cause the Dashboard to exhaust memory due to unbounded log accumulation from the UI notification endpoint.
+</Accordion>
+
+<Accordion title='Dashboard Now Corrects Padding for Base64-Encoded JWKS URLs'>
+Fixed an issue where the Dashboard and Gateway had inconsistent validation for base64-encoded JWKS URIs when using JWT authentication. Previously, the Dashboard would accept a URI in the `source` (or `jwt_source` for Tyk Classic) field that was not correctly padded, while the Gateway required correct padding. This could cause an API to be saved successfully in the Dashboard but then fail when processed by the Gateway. The fix has been applied to the Dashboard, which now automatically adds the required padding to the base64-encoded string when the API definition is saved. This resolves the inconsistency and ensures the configuration is valid for the Gateway.
+</Accordion>
+
+<Accordion title='Fixed Certificate Filtering Not Working in Non-Detailed Mode'>
+Fixed an issue where certificate filtering (`filter=with_pk`, `filter=without_pk`) was only applied in detailed mode, causing inconsistent behavior. Tyk now properly applies filtering in both detailed and non-detailed modes, ensuring consistent results regardless of the mode parameter used.
+</Accordion>
+
+<Accordion title='Fixed Policy Deletion Failure When Referenced API No Longer Exists'>
+Fixed an issue where the user was unable to delete the policy if the referenced API didn't exist, even though the user had access to the policy before API deletion.
+</Accordion>
+
+<Accordion title='Renamed `XTykApiGateway` Schema to Avoid Case-Sensitive Conflicts'>
+Renamed `XTykApiGateway` schema to `TykVendorExtension` to eliminate case-only naming conflicts with the existing `XTykAPIGateway` schema. Updated all corresponding $ref references throughout swagger.yml to prevent code generation ambiguity and ensure compatibility across case-insensitive file systems.
+</Accordion>
+
+<Accordion title='Standardised Use of Policy IDs Across Tyk Gateway and Dashboard'>
+The Tyk Policy object has two identifiers `id` (Policy ID) and `_id` (Policy Database ID). All policy definitions will have a value in `_id` when loaded to the Dashboard, used to identify the object in the persistent storage. Historically, the Policy ID (`id`) has been optional (via the `allow_explicit_policy_id` Gateway configuration), and different Tyk components have used one or the other, leading to inconsistency and scenarios where a policy might be rejected due to the configuration of IDs.
+We have simplified the Tyk Gateway to use the Policy ID exclusively, instead of the Policy Database ID, improving consistency across the platform. This means that the `allow_explicit_policy_id` Gateway configuration is now redundant and marked deprecated, as the Policy ID field is always used.
+If a policy definition is loaded onto Tyk Dashboard that does not have a Policy ID set, Tyk will automatically set the `id` field to the value in `_id`. There are no changes to the Gateway or Dashboard APIs from this enhancement, ensuring backward compatibility.
+</Accordion>
+
+<Accordion title='Dashboard UI Fixes'>
+- **Incorrect Data Range Display in Total API Traffic Dashboard Chart**: Fixed an issue where the **Total API Traffic** chart on the **Nodes & Licenses** screen displays data from the wrong time period.
+- **TIB User Role Mappings Disappeared on Update**: Fixed a bug that caused TIB profiles to vanish on updates made to `Provider Configuration` advanced settings.
+- **Access Tab Selection from Filtered Dropdown**: Fixed an issue where users and categories could not be selected from filtered dropdown lists in the Access tab of the Tyk OAS API designer.
+- **Unable to Apply Multiple Filters to API List**: Resolved filtering issues where applying multiple filters (name + category) would drop previously applied filters instead of combining them. Users can now apply multiple filters that work together as expected, with all active filters preserved during pagination and sorting.
+- **Data Graph Wizard Incorrectly Displayed**: Fixed an issue where the Data Graph onboarding wizard incorrectly appeared when filters returned zero results - it now only shows when no APIs actually exist in the system, keeping filters visible when results are empty.
+- **Incomplete Certificate Search in API Designer**: Fixed an issue when selecting a TLS certificate to attach to a Tyk OAS API (for example, a client certificate for client-gateway mTLS). To improve performance when scrolling through the list of existing certificates, the UI uses pagination to load a subset of certificates at a time. The certificate ID search would only match against the currently loaded page of certificates, so a certificate might not appear to exist when it does, but just hasn't been loaded yet. Now the search functionality has been improved to look through the full list of certificates in the Tyk Certificate Store, rather than relying on the paginated data.
+</Accordion>
+
+<Accordion title='Fixed Quick Start API Testing Issues'>
+Resolved multiple issues preventing successful API testing in the Quick Start onboarding flow. Users can now test APIs with any response type (JSON, HTML, XML) without encountering HTTP 500 errors or blank response displays.
+Additionally, fixed URL handling issues that occurred when gateway endpoints were configured without URL schemas, ensuring the "Test your API" step works reliably regardless of configuration format. 
+</Accordion>
+
+<Accordion title='Removed Redundant Boolean Enums from OpenAPI Specification'>
+Fixed redundant boolean enum definitions in OpenAPI specification by removing unnecessary enum: [true, false] declarations from boolean type fields in swagger.yml files. Boolean parameters now use only type: boolean, following OpenAPI best practices.
+</Accordion>
+
+</AccordionGroup>
+
+## 5.10 Release Notes 
+
+### 5.10.2 Release Notes 
+
+#### Release Date 2 December 2025
+
+#### Release Highlights
+
+This patch release fixes an issue in the API Designer where JWKS cache timeout values could not be saved properly. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.10.2).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.10.2"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|-------------|
+| 5.10.2 | MDCB v2.8.6       | MDCB v2.8.6 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.4       | Sync v2.1.0 |
+|        | Helm Chart v4.1   | Helm all versions |
+|        | EDP v1.15.0       | EDP all versions |
+|        | Pump v1.13.1      | Pump all versions |
+|        | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.10.2"></a>
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [GoLang](https://go.dev/dl/)          | 1.24 | 1.24 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.10.2"></a>
+
+If you are upgrading to 5.10.2, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.10.2)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.10.2
+    ```
+- Helm charts
+  - [tyk-charts v4.1.0](/developer-support/release-notes/helm-chart#4-1-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.10.2.
+
+#### Changelog
+<a id="Changelog-v5.10.2" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fix JWKS Cache Timeout Setting in API Designer'>
+Fixed an issue where JWKS cache timeout values when configuring JWT authentication could not be saved in the API Designer. The timeout field would appear to accept values, but would disappear after saving the API configuration. Users can now successfully configure and persist JWKS cache timeout settings as expected
+</Accordion>
+
+</AccordionGroup>
+
+### 5.10.1 Release Notes 
+
+#### Release Date 19 November 2025
+
+#### Release Highlights
+
+This patch release upgrades the Go build environment and delivers UI, analytics, and security fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.10.1).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.10.1"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|-------------|
+| 5.10.1 | MDCB v2.8.5       | MDCB v2.8.5 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.4       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | EDP v1.14.1       | EDP all versions |
+|        | Pump v1.13.0      | Pump all versions |
+|        | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.10.1"></a>
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [GoLang](https://go.dev/dl/)          | 1.24 | 1.24 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.10.1"></a>
+
+If you are upgrading to 5.10.1, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.10.1)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.10.1
+    ```
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.10.1.
+
+#### Changelog
+<a id="Changelog-v5.10.1" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+<Accordion title='Upgraded Go build environment to Debian 12 ("Bookworm")'>
+We have updated the Go build environment from Debian 11 ("Bullseye") to Debian 12 ("Bookworm") across all pipelines. This change ensures that all builds use the latest Go 1.24 patch version, addressing recent CVEs and improving overall security and stability.
+</Accordion>
+
+</AccordionGroup>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Enabled Gzip Compression for Static Assets to Improve Dashboard Load Performance'>
+Implemented gzip compression for static assets (JavaScript, CSS, images, etc.) when the browser client requests for gzip with the `Accepted-Encoding` header. This significantly reduces the file size transferred when loading the Dashboard, reducing bandwidth usage and improving page load times for users.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='API Editor UI Glitch When Scrolling in Import Mode'>
+Fixed an issue introduced in 5.10.0 where there was a graphical glitch with the code editor in the API Designer.
+</Accordion>
+
+<Accordion title='Dashboard Analytics and Monitoring Fixes'>
+- **Fixed non-clickable endpoint rows in the Activity page**: Fixed an issue where selecting an endpoint in the "Most Popular Endpoints" list on the "Activity Overview" screen did not direct the user to the "Activity by Endpoint" screen.
+- **Fixed incorrect error code descriptions in API activity dashboard**: Error codes now display correct descriptions (409 shows "Conflict" instead of "Rate limit or quota exceeded", and missing descriptions for 502, 504, 499, and 422 have been added).
+- **Fixed unicode character display in Activity Logs view**: Non-ASCII characters (Cyrillic, Arabic, Hindi, Telugu, Yoruba, etc.) now display correctly instead of showing garbled text when viewing request/response logs.
+- **Fixed date range filtering showing extra day in analytics charts**: Date range selectors now accurately reflect the selected end date instead of automatically including the following day's data in charts and legends.
+- **Fixed Log Browser querying wrong tables when SQL table sharding is enabled**: Dashboard now correctly queries sharded tables (tyk_analytics_YYYYMMDD) instead of the main tyk_analytics table when `TYK_DB_STORAGE_LOGS_TABLESHARDING=true` is configured, ensuring analytics data displays properly with SQL database sharding.
+- **Fixed incorrect date labels and data aggregation in analytics charts**: Fixed multiple issues in the analytics aggregation layer when using PostgreSQL backend that caused incorrect chart rendering and service problems. Resolved problems, including hourly charts showing nonsensical dates like "30 Nov 1899", monthly charts displaying incorrect months, incomplete time-series data due to improper date padding, and API activity being incorrectly split across multiple rows.
+</Accordion>
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following high-priority CVEs, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-47912" target="_blank">CVE-2025-47912</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58183" target="_blank">CVE-2025-58183</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58185" target="_blank">CVE-2025-58185</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58186" target="_blank">CVE-2025-58186</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58187" target="_blank">CVE-2025-58187</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58188" target="_blank">CVE-2025-58188</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58189" target="_blank">CVE-2025-58189</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61723" target="_blank">CVE-2025-61723</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61724" target="_blank">CVE-2025-61724</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61725" target="_blank">CVE-2025-61725</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-63811" target="_blank">CVE-2025-63811</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-31133" target="_blank">CVE-2025-31133</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-52565" target="_blank">CVE-2025-52565</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-52881" target="_blank">CVE-2025-52881</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.10.0 Release Notes 
+
+#### Release Date 13th October 2025
+
+#### Release Highlights
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.10.0).
+
+##### Streamlined API Versioning Experience
+
+The Tyk Dashboard now provides a completely redesigned versioning experience for Tyk OAS APIs, making API version management intuitive and efficient through guided workflows and centralized controls.
+
+**Intuitive version creation**
+
+- **Step-by-step wizard**: Guided process for creating new API versions with clear configuration options at each step
+- **Smart configuration cloning**: Choose to inherit settings from existing versions or start fresh
+- **Flexible publishing**: Control version activation and Gateway deployment during creation
+- **Pre-configuration support**: Set up versioning parameters before creating any versions, preparing APIs for future versioning needs
+
+**Centralized version management**
+
+- **Unified "Versions" tab**: Single location to view and manage all aspects of API versioning
+- **Clear configuration visibility**: Version identifier settings, proxy options, and version lists displayed in one organized interface
+- **Inline editing**: Modify version names and configuration directly without navigating between screens
+- **Consistent experience**: Same interface and capabilities whether working with base or child APIs
+
+**Key benefits**
+
+- Eliminate confusion around version setup and management
+- Reduce time spent navigating between different configuration screens
+- Enable proactive versioning preparation for future API evolution
+- Provide clear visibility into version configuration and relationships
+
+Perfect for teams managing multiple API versions or planning version rollout strategies, this enhancement makes API versioning accessible to users of all experience levels while maintaining the power and flexibility that advanced users require.
+
+
+##### Certificate Expiry Monitoring and Notifications
+
+The Tyk Dashboard now provides proactive certificate lifecycle management to help prevent service outages caused by expired mTLS certificates.
+
+Proactive monitoring capabilities:
+- **Event-driven alerts**: Certificate expiry events are now available in the Tyk OAS API Designer for webhook and event handler configuration
+- **Dashboard API notifications**: New endpoint provides programmatic access to certificate status information
+  - **Smart monitoring**: Automatic detection of certificates approaching expiry or already expired with configurable warning thresholds
+  - **Duplicate prevention**: Intelligent notification system prevents alert flooding while ensuring visibility
+
+**Key benefits**
+
+- Prevent unexpected API outages due to expired certificates
+- Enable automated certificate renewal workflows through event handlers
+- Provide clear visibility into certificate health across your API infrastructure
+- Support integration with existing monitoring and alerting systems
+
+Perfect for organizations managing multiple certificates across complex API infrastructures where manual certificate tracking becomes impractical.
+
+For more details, please see the dedicated [Gateway events](/api-management/gateway-events) section.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.10.0"></a>
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :-------- | :------------------- | :------------- |
+| 5.10.0 | MDCB v2.8.5       | MDCB v2.8.5 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.3       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | EDP v1.14.1       | EDP all versions |
+|        | Pump v1.12.2      | Pump all versions |
+|        | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.10.0"></a>
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| :---------------------- | :--------------- | :------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)          | 1.24 | 1.24 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.10.0"></a>
+
+If you are upgrading to 5.10.0, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.10.0)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.10.0
+    ```
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.10.0.
+
+#### Changelog
+<a id="Changelog-v5.10.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Enhanced versioning experience for Tyk OAS APIs'>
+Completely redesigned the versioning experience for Tyk OAS APIs with an intuitive wizard-driven workflow and centralized version management interface.
+
+**New version creation wizard**
+
+- **Guided configuration process**: Step-by-step wizard for creating new API versions with clear decision points
+- **Configuration cloning options**: Choose whether to clone settings from an existing version, with selection from available versions when multiple exist
+- **Version identifier setup**: Configure version location (header, URL path, query parameter) and key name if not already set
+- **Publishing controls**: Decide whether to immediately activate the new version and select target Gateways using segment tags
+
+**Centralized version management**
+
+- **New "Versions" tab**: Unified interface displaying version identifier configuration and complete version list for both base and child APIs
+- **Pre-configuration support**: Set up version identifier location, key name, and proxy options before creating any child versions, preparing non-versioned APIs to become base APIs
+- **Clear configuration visibility**: Version identifier and proxy settings prominently displayed above the version list
+- **Inline editing capabilities**: Edit version names directly for any API version, and modify versioning configuration from the base API
+- **Streamlined access**: Create new versions from any API (base or child) with direct access to the creation wizard
+
+**Improved user experience**
+
+- Removed legacy version management screens that were difficult to locate
+- Consistent versioning interface across all Tyk OAS APIs
+- Reduced complexity in version setup and management workflows
+
+This enhancement significantly simplifies API versioning workflows and provides better visibility into version configuration and management.
+</Accordion>
+
+<Accordion title='Certificate expiry notifications and event handling'>
+Added certificate expiry monitoring capabilities to help administrators proactively manage certificate lifecycles and prevent service outages.
+
+**Event handling integration**
+
+- Certificate expiry events (`CertificateExpiringSoon` and `CertificateExpired`) are now available as selectable options in the event handling section, enabling users to assign webhooks or other event handlers directly through the UI
+
+**Dashboard notifications system**
+
+- **Proactive notification endpoint**: New `GET /api/org/notifications` Dashboard API endpoint provides organization-specific notifications for expiring and expired certificates
+- **Smart monitoring**: In-memory notification repository automatically checks certificate metadata storage and creates notifications for certificates approaching expiry or already expired
+- **Configurable thresholds**: Dashboard configuration options for refresh intervals and warning thresholds:
+
+**Notification details**
+
+- **Severity classification**: Notifications marked as "warning" for soon-to-expire certificates or "critical" for expired certificates
+- **Rich metadata**: Each notification includes certificate ID, expiry date, days remaining, and other relevant details
+- **Duplicate prevention**: Hash-based system prevents duplicate notifications for the same certificate status
+
+**Note:** This release provides the foundational API and event integration for certificate monitoring. Enhanced UI functionality for certificate management will be available in a future release.
+
+This enhancement provides multiple layers of certificate expiry visibility through Gateway events and API-based notifications, ensuring administrators can maintain certificate health across their API infrastructure.
+</Accordion>
+
+<Accordion title='Enhanced JWT claims configuration for Tyk OAS APIs'>
+Updated the Tyk OAS API Designer to support multiple claim sources for JWT authentication, enabling multi-Identity Provider scenarios where different providers use different claim names.
+
+**UI enhancements**
+
+- **Multiple subject claims**: Replace the single "Subject identity claim" field with support for multiple claim sources
+- **Multiple policy claims**: Replace the single "Policy claim" field with support for multiple claim mapping sources
+- **Multiple scope claims**: Replace the single "Scope claim" field with support for multiple scope claim sources
+
+**Current implementation**
+
+- Updated API editor schema to accept the new multi-value claim fields
+- Multi-value claim configuration available through the API Designer interface
+- Advanced JWT validation features (custom claims framework, issuer/audience/subject validation, JWT ID enforcement) must be configured directly in the API definition via the API editor or external API calls
+- Existing single-value configurations remain functional for backward compatibility
+
+This enhancement supports scenarios where different Identity Providers use different claim names (e.g., Keycloak's `scope` vs Okta's `scp`) within the same API configuration, laying the foundation for comprehensive JWT claim validation workflows.
+
+**Note:** Full API Designer integration for these fields will be available in a future release.
+</Accordion>
+
+<Accordion title='OpenAPI compliant multi-authentication configuration for Tyk OAS APIs'>
+Added initial support for OpenAPI Specification compliant multi-authentication configuration in Tyk OAS APIs, enabling flexible authentication workflows that follow standard OpenAPI security patterns.
+
+**UI enhancements**
+
+- We have added a new toggle in the Tyk OAS API Designer's *Server > Authentication* section to choose between "legacy" and "compliant" authentication processing modes when Multiple Authentication Methods is selected:
+  - **Legacy mode**: Existing configuration interface remains available for legacy mode behavior (AND logic for all authentication methods)
+  - **Compliant mode**: Users selecting compliant mode are directed to configure authentication directly in the API editor for full OpenAPI security specification support
+
+**Current implementation**
+
+- Manual configuration of compliant mode security settings available through the API definition editor
+- OpenAPI import with automatic authentication configuration continues to configure legacy mode by default (no change to existing behavior)
+- Advanced authentication combinations (OR logic between security entries) must be configured directly in the API definition
+
+This enhancement provides the foundation for OpenAPI compliant authentication workflows while maintaining complete backward compatibility with existing authentication configurations.
+
+**Note:** Full integration for compliant mode authentication configuration will be available in a future release.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Changed
+
+
+
+<Expandable title='Upgrade Tyk Dashboard to Golang 1.24'>
+The Tyk Dashboard has been updated to [Golang 1.24](https://tip.golang.org/doc/go1.24), improving security by staying current with the latest Go versions.
+</Expandable>
+
+
+
+
+
+##### Fixed
+
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed Policy and Key Management UI for versioned APIs'>
+Fixed UI issues in policy and key management that caused confusion and unnecessary validation errors. The API Versions field in the Dashboard UI now appears only when relevant - specifically for versioned Tyk Classic APIs. 
+
+The field is no longer displayed for Tyk OAS APIs or non-versioned Tyk Classic APIs, eliminating confusion about when version selection is required and preventing policies and keys from failing to save due to irrelevant validation requirements.
+</Accordion>
+
+<Accordion title='Fixed issues with Tyk OAS API Debugger'>
+Fixed some issues in the Tyk OAS API Debugger (Test Your API panel) when inspecting API tests:
+
+- The debugger only displayed request middleware execution, omitting response middleware from the debug output
+- The debugger did not show the details of the transformations applied by Request Body Transform and Request Header Transform middleware
+- The debugger incorrectly reported errors for endpoints using Response Body Transform middleware, even when API calls completed successfully
+
+The test debugger now correctly shows both request and response middleware execution, accurately displays the execution status, and eliminates false error messages that could mislead developers during API testing and troubleshooting.
+</Accordion>
+
+<Accordion title='Fixed Dashboard default page_size behavior'>
+Fixed an issue where the Tyk Dashboard did not correctly apply a default `page_size` value when none was specified in the Dashboard configuration, potentially causing unexpected pagination behavior. 
+
+The Dashboard now properly defaults to a page size of 10 items as documented, ensuring consistent and predictable pagination across all Dashboard views.
+</Accordion>
+
+<Accordion title='Fixed multiple issues with the creation of child versions of Tyk OAS APIs'>
+Fixed several issues that affected the creation of new child versions of Tyk OAS APIs to ensure reliable version creation and proper validation:
+
+UI and API Creation:
+- Resolved an issue that prevented users from creating new versions via the API Designer's Manage Versions screen
+- Added validation for the `base_api_id` parameter - providing a non-existent ID would previously create the API successfully, but leave it invisible in the Dashboard UI
+- Added stricter validation for version names - users can no longer create API versions without specifying a valid `new_version_name`, preventing unusable or empty version entries
+- Improved error messaging when the `base_api_version_name` parameter is missing or incorrectly specified
+
+Version Management:
+- Fixed an issue where creating new child versions would incorrectly reset the default version back to the base API, overriding previously configured settings
+
+The system now provides comprehensive validation with clear error responses (`HTTP 400 Bad Request` and `HTTP 422 Unprocessable Entity`), ensures that all API versions have meaningful identifiers, and maintains proper default version settings during the creation of child versions.
+</Accordion>
+
+<Accordion title='Fixed `/versions` endpoint to only accept valid Tyk OAS base APIs'>
+Fixed an issue where the `/api/apis/oas/{apiId}/versions` endpoint incorrectly returned version data for Tyk Classic APIs and non-versioned Tyk OAS APIs. The endpoint now properly validates requests and returns `HTTP 422 Unprocessable Entity` when the target API is not a valid Tyk OAS base API, ensuring the endpoint only returns meaningful version information.
+</Accordion>
+
+<Accordion title='Fixed OpenAPI `servers` section handling for regex-based custom domains'>
+Fixed an issue where custom domains containing regular expressions were not correctly parsed and stored in the `servers` section of OpenAPI descriptions for Tyk OAS APIs. The Dashboard now properly converts regex-based domains into valid OpenAPI `servers` entries with appropriate variables, ensuring accurate API documentation and preventing validation errors during API editing. 
+
+This fix includes enhanced syntax validation for regular expression (regex) patterns and improved capture group handling, which previously could cause Gateway crashes.
+</Accordion>
+
+<Accordion title='Fixed delayed application of global webhook changes for Tyk OAS APIs'>
+Fixed an issue where updates to [global webhooks](/api-management/gateway-events#local-and-global-webhooks) were not immediately applied to Tyk OAS APIs using those webhooks. When global webhook configurations were modified, the Gateway would continue using the previous settings for affected Tyk OAS APIs until a manual reload occurred. 
+
+The system now automatically triggers a Gateway reload for all impacted Tyk OAS APIs when global webhook configurations are updated, ensuring that the new webhook settings take effect immediately.
+</Accordion>
+
+<Accordion title='Fixed cross-interface compatibility for keys and policies with Tyk OAS and non-versioned Tyk Classic APIs'>
+Fixed an issue where keys and policies created or updated via the Dashboard API were sometimes rejected by the Dashboard UI, and vice versa, due to inconsistent handling of the `versions` field for non-versioned Tyk Classic APIs. The issue occurred because the API and UI used different formats when populating the versions list in access rights. 
+
+Both interfaces now consistently accept either `null` or `[]` (empty array) values in the `versions` field of the access control list, ensuring seamless interoperability between API and UI workflows for policy and key management. Tyk OAS APIs use a [different approach](/api-management/api-versioning#how-api-versioning-works-with-tyk) to versioning, with each (base or child) version having a unique API ID that is added to the access list.
+</Accordion>
+
+<Accordion title='Fixed visibility of orphaned Tyk OAS API versions when using PostgreSQL'>
+Fixed an issue where orphaned child versions of a Tyk OAS API would disappear from the Dashboard UI after their base API was deleted, specifically when using PostgreSQL as the datastore. 
+
+Orphaned Tyk OAS API versions now remain visible in the Dashboard, ensuring consistent behavior across all supported datastores and preventing loss of access to existing API versions.
+</Accordion>
+
+<Accordion title='Fixed inconsistent ordering of Tyk OAS API versions in Dashboard UI'>
+Fixed an issue where the child versions of a Tyk OAS API were sorted by creation date in the **Created APIs** and alphabetically by version name (e.g., v1, v2) in the **Versions** list. 
+
+Now versions are always sorted alphabetically by version name, providing predictable and controllable ordering.
+</Accordion>
+
+<Accordion title='Fixed Dashboard API panic when accessing logs without timestamp parameters in PostgreSQL'>
+Fixed an issue where the Tyk Dashboard API would panic and return `HTTP 500 Internal Server Error` when accessing the `/api/logs` endpoint without the required `start` and `end` timestamp parameters in PostgreSQL environments using table sharding. 
+
+The API now properly handles missing parameters by returning `HTTP 400 Bad Request` with a descriptive error message, improving error handling and API reliability.
+</Accordion>
+
+<Accordion title='Fixed PATCH endpoint validation to reject Tyk OAS API definitions when expecting OpenAPI description'>
+Fixed an inconsistency where the Dashboard API's `PATCH /api/apis/oas/{apiId}` endpoint incorrectly accepted full Tyk OAS API definitions containing Tyk Vendor Extensions, when it should only accept standard OpenAPI descriptions. 
+
+The endpoint now properly validates incoming requests and returns `HTTP 400 Bad Request` if the Tyk Vendor Extension is present, ensuring consistent behavior with the Dashboard UI and maintaining the intended separation between OpenAPI description updates and full API configuration changes.
+</Accordion>
+
+<Accordion title='Fixed incorrect creation of duplicate or blank API categories'>
+Fixed an issue where duplicate or blank API categories could be created for Tyk OAS APIs when using the Dashboard API's `PUT /api/apis/oas/{API_ID}/categories` endpoint. Now, if blank or duplicate category labels are provided in the body of the `PUT` request, these will be ignored. 
+
+This matches the validation in the API Designer which does not allow blank or duplicated categories to be assigned to APIs.
+</Accordion>
+
+<Accordion title='Fixed GraphQL API creation via upstream introspection when OPA rules modify requests'>
+Fixed an issue where creating GraphQL APIs using upstream introspection in the Dashboard could fail with `HTTP 502 Bad Gateway` errors when OPA rules (typically using `patch_request`) modified the introspection request body. 
+
+The problem occurred because the Dashboard did not recalculate the `Content-Length` header after OPA modifications, causing length mismatches that resulted in proxy errors. The Dashboard now properly recalculates the content length for modified introspection requests, ensuring reliable GraphQL API creation regardless of OPA rule configurations.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+
+##### Security Fixes
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high-priority CVEs identified in the Tyk Dashboard, providing increased protection against security
+vulnerabilities:<br />
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-47875" target="_blank">CVE-2024-47875</a><br />
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-45801" target="_blank">CVE-2024-45801</a>
+</Expandable>
+
+
+
+
+## 5.9 Release Notes 
+
+### 5.9.2 Release Notes
+
+#### Release Date 5th September 2025
+
+#### Release Highlights
+
+This release fixes a compatibility issue between MDCB and Dashboard where APIs containing dots (.) in their paths were not handled correctly in MDCB. API definitions are now processed consistently with the Dashboard, ensuring middleware works as expected across all gateways.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.9.2).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :-------- | :------------------- | :------------- |
+| 5.9.2  | MDCB v2.8.4       | MDCB v2.8.4 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.3       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | EDP v1.14.1       | EDP all versions |
+|        | Pump v1.12.1      | Pump all versions |
+|        | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| :---------------------- | :--------------- | :------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)          | 1.23 | 1.23 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.9.2"></a>
+
+To resolve the compatibility issue between MDCB and Tyk Dashboard when Tyk OAS API definition paths contain dot (.) characters, you can choose **one** of the following upgrade paths:
+
+##### Recommended Upgrade Paths
+
+1. **Upgrade Dashboard (Preferred)**
+
+   * Upgrade to Dashboard v5.9.2 to resolve the issue.
+   * In this version, `escape_dots_in_oas_paths` defaults to `false`, and the Dashboard automatically unescapes dots in all API definitions.
+   * **No MDCB upgrade is required.**
+
+2. **Upgrade MDCB to v2.8.4 (Alternative if you cannot upgrade the Dashboard)**
+
+    - Enable `escape_dots_in_oas_paths` in both Dashboard and MDCB configurations.
+    - This ensures consistent escaping/decoding of dots across all components.
+
+If you are upgrading to 5.9.2, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.9.2)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.9.2
+    ```
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.9.2.
+
+#### Changelog
+<a id="Changelog-v5.9.2" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Consistent Handling of Escaped Dots in OpenAPI Endpoint Paths'>
+Resolved a compatibility issue introduced via a fix in Dashboard v5.9.0 (LTS v5.8.3) to account for DocumentDB's handling of endpoint paths containing dots (`.`). The Dashboard now escapes dot characters (e.g., `\u002e`) when storing Tyk OAS API definitions in the database, but MDCB failed to unescape them when reading from the database. This caused the [request validation](/api-management/traffic-transformation/request-validation) and [mock response](/api-management/traffic-transformation/mock-response#mock-response) middleware configured on affected endpoints not to be applied. 
+
+To align MDCB's dot handling mechanism with Tyk Dashboard, a new configuration option, `escape_dots_in_oas_paths`, has been introduced in both [Dashboard](/tyk-dashboard/configuration#escape_dots_in_oas_paths) and [MDCB](/tyk-multi-data-centre/mdcb-configuration-options#escape_dots_in_oas_paths):
+
+* By Default, `escape_dots_in_oas_paths` is set to `false` in both MDCB and Dashboard, restoring the Dashboard behaviour before v5.9.0 (LTS v5.8.3), where dots are unescaped.
+* When `escape_dots_in_oas_paths` is set to `true`, Dots are escaped for compatibility with specific databases. With this config set to `true`, MDCB and Dashboard encode/decode these paths consistently.
+
+Check the [Upgrade and Compatibility section](#upgrade-5.9.2) for details on the recommended upgrade path.
+</Expandable>
+
+
+
+
+### 5.9.1 Release Notes
+
+#### Release Date 14th August 2025
+
+#### Release Highlights
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.9.1).
+
+#### Breaking Changes
+
+Since 5.9.0, Tyk Dashboard automatically escapes dots (`.`) in OpenAPI endpoint paths (e.g., <code>/v1.0</code> becomes <code>/v1\u002e0</code>) before saving to the database. This was introduced to support DocumentDB users as explained in the [change log](#Changelog-v5.8.3). MDCB 2.8.3 and earlier fails to properly decode these escaped paths when reading from the database. This causes the Validate Request and Mock Response middleware to malfunction for endpoints where the path contains dots; other middleware continues to work. The issue affects all MDCB deployments with Dashboard 5.9.1 and will be fixed in version Dashboard version 5.9.2 and MDCB version 2.8.4.
+
+#### Dependencies
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :-------- | :------------------- | :------------- |
+| 5.9.1  | MDCB v2.8.3       | MDCB v2.8.3 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.2       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | EDP v1.14.0       | EDP all versions |
+|        | Pump v1.12.0      | Pump all versions |
+|        | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| :---------------------- | :--------------- | :------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)          | 1.23 | 1.23 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.9.1, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.9.1)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.9.1
+    ```
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.9.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='URL Rewrite Middleware UI Compatibility Fix'>
+Resolved an issue in the URL Rewrite middleware UI where the absence of the `negate` field in OAS API definition configurations caused unexpected behavior. The UI now correctly interprets a missing `negate` field in URL rewrite rules as `false` by default, ensuring compatibility with APIs created in earlier versions.
+</Expandable>
+
+
+
+### 5.9.0 Release Notes
+
+#### Release Date 4th August 2025
+
+#### Release Highlights
+
+This release builds on the recent release of [Tyk 5.8.3](/developer-support/release-notes/dashboard#5-8-3-release-notes), adding a collection of new capabilities. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.9.0).
+
+##### Accept JSON Web Tokens (JWTs) Issued By Multiple Identity Providers
+
+Tyk can now validate JWTs against multiple JSON Web Key Set (JWKS) endpoints, allowing you to use different IdPs to issue JWTs for the same API. Previously, we supported only a single JWKS endpoint in the `source` field, but now you can register multiple JWKS endpoints in the Tyk OAS API definition.
+
+When a request is received bearing a JWT, Tyk will retrieve JWKS from all registered IdPs to check the token's validity. For full details of how to use this powerful feature see the improved [JWT Authentication](/api-management/authentication/jwt-signature-validation#configuring-idps-in-the-api-definition) section.
+
+**Please note that this functionality is not available for Tyk Classic APIs.**
+
+##### Compatibility with Valkey
+
+Tyk is now fully compatible with [Valkey](https://valkey.io/), the open-source (BSD) high-performance key/value datastore backed by the Linux Foundation, as an alternative to Redis.
+
+#### Breaking Changes
+
+1. We have implemented a [change](/developer-support/release-notes/dashboard#Fixed-v5.9.0) to the behaviour of the `GET /api/streams/{apiID}` endpoint, which now expects an `Accept` header, not `Content-Type`.
+
+2. Tyk Dashboard now automatically escapes dots (`.`) in OpenAPI endpoint paths (e.g., <code>/v1.0</code> becomes <code>/v1\u002e0</code>) before saving to the database. This was introduced to support DocumentDB users as explained in the [change log](#Changelog-v5.9.0). MDCB 2.8.3 and earlier fails to properly decode these escaped paths when reading from the database. This causes the Validate Request and Mock Response middleware to malfunction for endpoints where the path contains dots; other middleware continues to work. The issue affects all MDCB deployments with Dashboard 5.9.0 and will be fixed in Dashboard version 5.9.2 and MDCB version 2.8.4. We strongly recommend that users upgrade to the latest versions of Tyk components.
+
+#### Dependencies
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :-------- | :------------------- | :------------- |
+| 5.9.0  | MDCB v2.8.2       | MDCB v2.8.2 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.2       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | EDP v1.14.0       | EDP all versions |
+|        | Pump v1.12.0      | Pump all versions |
+|        | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| :---------------------- | :--------------- | :------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)          | 1.23 | 1.23 | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | | 
+| [Valkey](https://valkey.io/download/) | 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8  | 5, 6, 7, 8  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/) | 13.x - 17.x | 13.x - 17.x  | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.9.0, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.9.0)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.9.0
+    ```
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.9.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Authenticate with Multiple JWKS Providers'>
+Added support for configuration of multiple JWKS (JSON Web Key Set) endpoints for Tyk OAS APIs. This enables the Gateway to authenticate JSON Web Tokens (JWTs) in multi-identity provider environments. The JWKS endpoints are configured in the new `jwksURIs` array in the JWT Auth `securityScheme`. This will take precedence over the existing `source` field, and existing API definitions will be automatically migrated to use the new field, while maintaining backward compatibility in case of rollback. Full support has been added to the Tyk OAS API Designer.
+</Accordion>
+
+<Accordion title='Valkey Database Compatibility'>
+Added compatibility with Valkey database as an alternative to Redis. This is for fresh environments, with no migration support from Redis.
+</Accordion>
+
+<Accordion title='Experimental Access to Additional Input and Output Options for Tyk Streams APIs'>
+We have introduced a new Dashboard configuration option, `TYK_DB_STREAMING_ENABLEALLEXPERIMENTAL`, to enable all experimental input and output options for Tyk Streams APIs. This is strictly provided for demos and MVPs and should not be enabled in production use.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Changed
+
+<AccordionGroup>
+<Accordion title='Updated to use latest kin-openapi'>
+Upgraded to use the latest upstream version of kin-openapi (v0.132.0). This ensures improved compatibility, full stack interoperability, and continued support for existing OpenAPI 3.0.x specifications.
+
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+<a id="Fixed-v5.9.0"></a>
+
+<AccordionGroup>
+<Accordion title='Tyk Streams Endpoint Incorrectly Expected `Content-Type` Header'>
+Fixed an issue where the `/apis/streams/{apiID}` endpoint was expecting a `Content-Type` header instead of an `Accept` header for `GET` requests.
+
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+## 5.8 Release Notes
+
+### 5.8.15 Release Notes 
+
+#### Release Date 30 June 2026
+
+#### Release Highlights
+
+This patch implements several changes and fixes to improve the stability and correct the behavior of the Dashboard.
+
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.15) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.8.15"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :------ | :---------------- | :---------------- |
+| 5.8.15  | MDCB v2.12.0      | MDCB v2.12.0      |
+|         | Operator v1.4.2   | Operator v0.17    |
+|         | Sync v2.2.0       | Sync v2.2.0       |
+|         | Helm Chart v5.3.0 | Helm all versions |
+|         | EDP v1.18.0       | EDP all versions  |
+|         | Pump v1.16.0      | Pump all versions |
+|         | TIB (if using standalone) v1.7.3 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :----------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Golang](https://go.dev/dl/)                                 | 1.25  |  1.25  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)                          | 6.2.x, 7.x | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)    | 5.0.x, 6.0.x, 7.0.x | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)             | 4, 5  | 4, 5 | | 
+| [PostgreSQL](https://www.postgresql.org/download/)           | 13.x - 17.x | 13.x - 17.x | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.8.15"></a>
+
+If you are upgrading to 5.8.15, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.15)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.15
+    ```
+- Helm charts
+  - [tyk-charts v5.2.0](/developer-support/release-notes/helm-chart#5-2-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.15" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated embedded Tyk Identity Broker to version 1.7.3'>
+{/* TT-17453 */}
+Tyk Dashboard embeds Tyk Identity Broker. This has been updated to [version 1.7.3](/developer-support/release-notes/tib#1-7-3-release-notes).
+</Accordion>
+
+<Accordion title='Updated cryptographic module used by tyk-dashboard-fips'>
+The `tyk-dashboard-fips` image now builds using Go 1.25's native FIPS 140-3 capable cryptographic module (`GOFIPS140=v1.0.0`), replacing the BoringCrypto module (`GOEXPERIMENT=boringcrypto`) used by earlier 5.8.x FIPS releases.
+
+<Note>
+This is a build-time dependency change only. It does not change Tyk's official FIPS readiness target for the 5.8.x release line, which remains FIPS 140-2.
+
+Official FIPS 140-3 readiness, which additionally requires Docker Hardened Images and enterprise supply chain assurances, is available exclusively from 5.13.x onward. See [FIPS 140-3](/developer-support/release-types/fips-release#fips-standard-by-version) for details.
+</Note>
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed policies disappearing for non-admin users when their APIs are deleted'>
+{/* TT-11902 */}
+Resolved an issue where a policy became invisible to non-admin users once all of the APIs it granted access to had been deleted, even though the policy still existed. Users with explicit Read or Write policy permissions lost the ability to see or manage these policies, while admin users were unaffected.
+
+Non-admin users can now see and manage such policies again; when ownership cannot be determined from the referenced APIs, visibility falls back to the user's policy group permissions (Read or Write grants access, Deny does not).
+</Accordion>
+
+<Accordion title='Fixed inconsistent error codes returned whenn using non-existent API Ids'>
+{/* TT-16802 */}
+Resolved an issue where, with API ownership enabled, a non-admin user providing an unrecognized API Id in a request to the Dashboard API received `HTTP 401 Unauthorized`, while an admin user making the same request correctly received `HTTP 400 Bad Request`.
+
+Non-admin users now receive the same error code as admin users when the provided API Id does not exist. Ownership protection is unchanged: `HTTP 401 Unauthorized` is still returned when the resource exists but the user does not own it.
+</Accordion>
+
+<Accordion title='Fixed issue with temporary files left behind after importing a multipart OpenAPI document'>
+{/* TT-16816 */}
+Resolved an issue where importing a [multipart OpenAPI document](/api-management/gateway-config-managing-oas#multi-part-openapi-documents) from a ZIP archive left temporary files on the Dashboard's local disk after the import completed. Over time this could exhaust disk space and, because the temporary location was derived from the archive filename, a later import using the same filename could reuse stale contents resulting in unexpected API configuration.
+
+Imports now use a unique temporary location per upload that is always cleaned up, even if the import fails, and concurrent uploads no longer interfere with one another. This applies to both creation and updating of Tyk OAS APIs, whether imported through the UI or the Dashboard API.
+</Accordion>
+
+<Accordion title='Fixed orphaned Tyk OAS API versions not appearing in the Dashboard UI on PostgreSQL'>
+{/* TT-15988 */}
+We have resolved an issue where child API versions that were orphaned (due to deletion of the base API version) on Dashboard versions prior to 5.8.6 did not appear in the main API list when using PostgreSQL, and could only be found through search.
+
+The Dashboard now detects these legacy orphaned Tyk OAS APIs and restores them to the main API list.
+</Accordion>
+
+<Accordion title='Fixed Dashboard UI crash when an OAS parameter uses `content` instead of `schema`'>
+{/* TT-16916 */}
+We have resolved an issue where opening a Tyk OAS API whose parameters use the OpenAPI `content` keyword (rather than `schema`) caused the API Designer and API Debugger to crash, and the Validate Request middleware form to reject the definition as invalid. The Dashboard now fully supports content-form parameters as defined by OpenAPI Specification 3.0: these APIs load without errors, and saving them preserves the content wrapper, including the media type and inner schema, without writing a conflicting top-level schema.
+</Accordion>
+
+<Accordion title='Tyk Streams Endpoint Incorrectly Expected `Content-Type` Header'>
+{/* TT-17355 */}
+
+Fixed an issue where the `/apis/streams/{apiID}` endpoint was expecting a `Content-Type` header instead of an `Accept` header for `GET` requests.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41506" target="_blank">CVE-2026-41506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41889" target="_blank">CVE-2026-41889</a>
+- <a href="https://osv.dev/vulnerability/GHSA-j88v-2chj-qfwx" target="_blank">GHSA-j88v-2chj-qfwx</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45571" target="_blank">CVE-2026-45571</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45570" target="_blank">CVE-2026-45570</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.14 Release Notes 
+
+#### Release Date 21 May 2026
+
+#### Release Highlights
+
+This patch release contains various bug fixes and addresses some vulnerabilities in 3rd party libraries, providing improved performance and security enhancements.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.14) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.8.14"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.14   | MDCB v2.11.0     | MDCB v2.11.0 |
+|         | Operator v1.4.0 | Operator v0.17 |
+|         | Sync v2.1.8     | Sync v2.1.1 |
+|         | Helm Chart v5.2.0 | Helm all versions |
+|         | EDP v1.17.3     | EDP all versions |
+|         | Pump v1.15.0    | Pump all versions |
+|         | TIB (if using standalone) v1.7.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Golang](https://go.dev/dl/)                                     | 1.25  |  1.25  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.8.14"></a>
+
+If you are upgrading to 5.8.14, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.14)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.14
+    ```
+- Helm charts
+  - [tyk-charts v5.2.0](/developer-support/release-notes/helm-chart#5-2-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.14" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed JavaScript regex unicode escape sequence handling during OpenAPI import'>
+We have resolved an issue where JavaScript-style Unicode regex patterns in OpenAPI documents failed validation during API import.
+
+Previously, when regex patterns containing Unicode escape sequences (for example `\u0000-\u017f`) were defined with single quotes in YAML, the YAML-to-JSON conversion process would double-escape the backslashes, transforming valid `\u` sequences into invalid `\\u` sequences that were rejected by Tyk's regex validator.
+
+The system now automatically translates these escape sequences during API ingestion, ensuring that OpenAPI documents with JavaScript regex patterns import successfully regardless of whether single or double quotes are used in the YAML definition.
+</Accordion>
+
+<Accordion title='Fixed behavior of Filter by APIs option in certificate list'>
+We have resolved an issue where the "Filter by API" feature on the TLS/SSL Certificates page did not return all certificates linked to an API.
+
+Previously, the filter only displayed certificates used for client-to-gateway mTLS, ignoring certificates used for gateway-to-upstream mTLS, custom domain certificates, and certificate pinning. This resulted in incomplete and misleading results for users trying to view all certificates actively used by a given API.
+
+The Dashboard now correctly returns all certificates when filtering by API.
+</Accordion>
+
+<Accordion title='Fix API expiry date drift'>
+We have resolved an issue where an API's expiry date could drift back by one day each time the API was saved in the API Designer. This was reported by users in positive UTC timezones (such as UTC+8). Saving an API without changing the expiry is now fully idempotent, and the expiry date remains stable across repeated saves regardless of the user's timezone.
+</Accordion>
+
+<Accordion title='Resolved Gateway registration failures at scale with Unlimited Node licenses'>
+We have resolved a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an **unlimited node license**. During mass registrations or rolling upgrades, a combination of lock contention, excessive Redis load, and incorrect handling of `409 Conflict` responses could leave Gateways stuck in registration loops without the credentials needed to serve traffic.
+
+Gateway registration is now significantly more robust at scale: registration requests are no longer serialized across the fleet, Gateways recover cleanly from transient `409 Conflict` responses instead of looping, and the Redis load generated during registration storms is substantially reduced.
+
+A dedicated fix for **limited node license** deployments will be provided in an upcoming release.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+Addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33762" target="_blank">CVE-2026-33762</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-1229" target="_blank">CVE-2026-1229</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33532" target="_blank">CVE-2026-33532</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-2950" target="_blank">CVE-2026-2950</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-13465" target="_blank">CVE-2025-13465</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15599" target="_blank">CVE-2025-15599</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39882" target="_blank">CVE-2026-39882</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34165" target="_blank">CVE-2026-34165</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33671" target="_blank">CVE-2026-33671</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-4800" target="_blank">CVE-2026-4800</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39883" target="_blank">CVE-2026-39883</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33487" target="_blank">CVE-2026-33487</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-62718" target="_blank">CVE-2025-62718</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-40175" target="_blank">CVE-2026-40175</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+---
+
+### 5.8.13 Release Notes
+
+#### Release Date 22 April 2026
+
+#### Release Highlights
+
+Tyk Dashboard has been updated to Go 1.25 and Debian 13 (Trixie) for enhanced security and performance, including updated FIPS-compliant images. This release also addresses multiple CVEs in dependent libraries.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.13).
+
+#### Breaking Changes
+
+There are no breaking changes in this release
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.13   | MDCB v2.9.0     | MDCB v2.9.0 |
+|         | Operator v1.3.0 | Operator v0.17 |
+|         | Sync v2.1.6     | Sync v2.1.1 |
+|         | Helm Chart v5.1.0 | Helm all versions |
+|         | EDP v1.17.0     | EDP all versions |
+|         | Pump v1.14.1    | Pump all versions |
+|         | TIB (if using standalone) v1.7.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Golang](https://go.dev/dl/)                                     | 1.25  |  1.25  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+No deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.13, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.13)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.13
+    ``` 
+- Helm charts
+  - [tyk-charts v5.1.0](/developer-support/release-notes/helm-chart#5-1-0-release-notes)
+
+
+#### Changelog
+<a id="Changelog-v5.8.13" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated Go version to 1.25'>
+The Tyk Dashboard has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
+</Accordion>
+
+<Accordion title='Update Docker images to Debian 13 (Trixie)'>
+Updated the Docker images for Tyk Dashboard to Debian 13 (Trixie) to address multiple vulnerabilities in the underlying operating system.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15281" target="_blank">CVE-2025-15281</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-0861" target="_blank">CVE-2026-0861</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-0915" target="_blank">CVE-2026-0915</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25679" target="_blank">CVE-2026-25679</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32285" target="_blank">CVE-2026-32285</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32286" target="_blank">CVE-2026-32286</a>
+- <a href="https://www.cvedetails.com/cve/CVE-2026-33186/" target="_blank">CVE-2026-33186</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34986" target="_blank">CVE-2026-34986</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+---
+
+### 5.8.12 Release Notes
+
+#### Release Date 11 March 2026
+
+#### Release Highlights
+
+In this patch, we have fixed a number of small issues related to the management of API Keys (Auth Tokens) for APIs secured with mTLS in the Dashboard UI. We have also fixed the filtering applied when requesting the details of all keys that grant access to a specific API. 
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.12).
+
+#### Breaking Changes
+
+A change has been made to improve security of the legacy [**Auth Token + Dynamic mTLS**](/api-management/implement-tls#legacy-dynamic-mtls-mode) method for securing access to APIs deployed on Tyk. This removes the option to authenticate using only the auth token and enforces the mTLS handshake.
+
+Previously, API clients could authenticate without presenting the client certificate or holding the client's private key.
+
+For any user relying on that behavior, we have added a new Gateway configuration option: `allow_unsafe_dynamic_mtls_token`. Unless deliberately configured in the config file or environment, this is set to `false` to ensure that Tyk is secure by default.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.12   | MDCB v2.9.0     | MDCB v2.9.0 |
+|         | Operator v1.3.0 | Operator v0.17 |
+|         | Sync v2.1.6     | Sync v2.1.1 |
+|         | Helm Chart v5.1.0 | Helm all versions |
+|         | EDP v1.17.0     | EDP all versions |
+|         | Pump v1.14.0    | Pump all versions |
+|         | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+No deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.12, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.12)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.12
+    ``` 
+- Helm charts
+  - [tyk-charts v5.1.0](/developer-support/release-notes/helm-chart#5-1-0-release-notes)
+
+
+#### Changelog
+<a id="Changelog-v5.8.12" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed GeoIP Location Data Display in SQL Analytics Storage'>
+Resolved issues preventing GeoIP location data from displaying correctly when using SQL storage for analytics. Previously, the Log Browser showed "GeoIP not recognized" for country codes, and geographic traffic filtering returned empty results, even though location data was properly captured and stored in the database. 
+
+The Dashboard can now correctly read and display all geographic information, including country codes, city names, coordinates, and timezone data from SQL storage. Geographic traffic filtering by country code now works as expected, enabling users to analyze traffic patterns by location when using SQL-based analytics storage.
+</Accordion>
+
+<Accordion title='Fixed Issues Associating Client Certificates with API Keys'>
+We have addressed the following issues
+- Create Key and Edit Key screens would incorrectly require the user to register a client certificate with the key when granting access to an API secured with static mTLS.
+- The option to assign the client certificate was not possible when creating a key for an API that has the authentication method changed to use dynamic mTLS.
+</Accordion>
+
+
+<Accordion title='Improved Experience when License Missing or Expired'>
+Fixed inaccurate wording and links on the screen presented on startup when the Dashboard license is missing or has expired.
+</Accordion>
+
+<Accordion title='Fixed API-Specific Key Retrieval in Dashboard'>
+Resolved an issue where the Dashboard's `GET /api/apis/{api_id}/keys` endpoint incorrectly returned all keys in the environment instead of only keys associated with the specified API. Users can now accurately retrieve and manage keys for individual APIs, eliminating confusion when working with multi-API environments. Note that the addition of this filtering can lead to minor delays in the response to this endpoint when there are large numbers of APIs and keys.
+</Accordion>
+
+<Accordion title='Fixed Certificate Re-use After Swapping in Multi-Auth Keys'>
+Resolved an issue where swapping certificates in multi-auth (mTLS + Basic auth) keys prevented the original certificate from being reused. Previously, when updating a key's certificate, the original certificate remained incorrectly associated with the key internally, causing "key with given certificate already found" errors when attempting to reuse that certificate. 
+
+Tyk now properly detaches certificates during key updates, allowing certificates to be freely reused across different keys after being removed from their original association.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Security Vulnerabilities Fixed'> 
+Multiple high-severity CVEs have been fixed. 
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.11 Release Notes
+
+#### Release Date 12 February 2025
+
+#### Release Highlights
+
+In this release, we have fixed some priority CVEs. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.11).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.11   | MDCB v2.8.8     | MDCB v2.8.7 |
+|         | Operator v1.2.0 | Operator v0.17 |
+|         | Sync v2.1.5     | Sync v2.1.1 |
+|         | Helm Chart v5.0.0 | Helm all versions |
+|         | EDP v1.16.0     | EDP all versions |
+|         | Pump v1.13.3    | Pump all versions |
+|         | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+No deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.11, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.11)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.11
+    ``` 
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+
+#### Changelog
+<a id="Changelog-v5.8.11" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15467" target="_blank">CVE-2025-15467</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-69419" target="_blank">CVE-2025-69419</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61726" target="_blank">CVE-2025-61726</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61728" target="_blank">CVE-2025-61728</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68121" target="_blank">CVE-2025-68121</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.10 Release Notes
+
+#### Release Date 23 December 2025
+
+#### Release Highlights
+
+This patch release addresses a CVE present in 5.8.9. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.10).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.10   | MDCB v2.8.7     | MDCB v2.8.7 |
+|         | Operator v1.2.0 | Operator v0.17 |
+|         | Sync v2.1.5     | Sync v2.1.1 |
+|         | Helm Chart v5.0.0 | Helm all versions |
+|         | EDP v1.16.0     | EDP all versions |
+|         | Pump v1.13.2    | Pump all versions |
+|         | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+In this release we've deprecated the [allow_explicit_policy_id](/tyk-dashboard/configuration#allow_explicit_policy_id) configuration option. This was previously added to allow the use of custom policy IDs, which is now the default behaviour so this option is redundant.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.10, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.10)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.10
+    ``` 
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.10" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following high-priority CVE, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41248" target="_blank">CVE-2021-41248</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+
+### 5.8.9 Release Notes
+
+#### Release Date 12 December 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes and introduces new OPA helper functions to identify the type of API being processed (Tyk OAS, Tyk Streams, Tyk Classic). For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.9).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.9 | MDCB v2.8.7    | MDCB v2.8.7 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.4    | Sync v2.1.1 |
+|         | Helm Chart v5.0.0  | Helm all versions |
+| | EDP v1.15.0 | EDP all versions |
+| | Pump v1.13.1 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+In this release we've deprecated the [allow_explicit_policy_id](/tyk-dashboard/configuration#allow_explicit_policy_id) configuration option. This was previously added to allow the use of custom policy IDs, which is now the default behaviour so this option is redundant.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.9, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.9)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.9
+    ``` 
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+
+#### Changelog
+<a id="Changelog-v5.8.9" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Open Policy Agent Functions to Identify API Style'>
+Added three new OPA helper functions (`isTykOas`, `isTykClassic`, and `isTykStreams`) that can be used in OPA rules to distinguish between different API types, ensuring that only appropriate logic is applied.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed Dashboard Memory Exhaustion When `use_redis_log` Is Enabled in Gateway'>
+Fixed an issue where enabling `use_redis_log` on a Tyk Gateway could cause the Dashboard to exhaust memory due to unbounded log accumulation from the UI notification endpoint.
+</Accordion>
+
+<Accordion title='Aligned Dashboard and Gateway Validation for Base64-Encoded JWKS URLs'>
+Fixed an issue where the Gateway applied stricter validation than the Dashboard on the base64 encoded JWKS URI provided in the `source` (Tyk Classic: `jwt_source`) field when using JWT Auth. The Dashboard would accept a base64 encoded string that was not correctly padded, whereas the Gateway would require this padding.
+
+The impact of this was that a JWKS URI could be successfully registered in an API definition via the Dashboard but then would be rejected when the Gateway handled requests to the API. Now the Gateway allows for lack of padding in the string, removing the inconsistency.
+</Accordion>
+
+<Accordion title='Fixed Policy Deletion Failure When Referenced API No Longer Exists'>
+Fixed an issue where the user was unable to delete a policy if the referenced API didn't exist, even though the user had access to the policy before API deletion.
+</Accordion>
+
+<Accordion title='Fixed Certificate Filtering Not Working in Non-Detailed Mode'>
+Fixed an issue where certificate filtering (`filter=with_pk`, `filter=without_pk`) was only applied in detailed mode, causing inconsistent behavior. Tyk now properly applies filtering in both detailed and non-detailed modes, ensuring consistent results regardless of the mode parameter used.
+</Accordion>
+
+<Accordion title='Removed Redundant Boolean Enums from OpenAPI Specification'>
+Fixed redundant boolean enum definitions in OpenAPI specification by removing unnecessary enum: [true, false] declarations from boolean type fields in swagger.yml files. Boolean parameters now use only type: boolean, following OpenAPI best practices.
+</Accordion>
+
+<Accordion title='Renamed XTykApiGateway Schema to Avoid Case-Sensitive Conflicts'>
+Renamed `XTykApiGateway` schema to `TykVendorExtension` to eliminate case-only naming conflicts with existing `XTykAPIGateway`
+schema. Updated all corresponding $ref references throughout swagger.yml to prevent code generation ambiguity and ensure compatibility across case-insensitive file systems.
+</Accordion>
+
+<Accordion title='Standardised Use of Policy IDs Across Tyk Gateway and Dashboard'>
+The Tyk Policy object has two identifiers: `id` (Policy ID) and `_id` (Policy Database ID). All policy definitions will have a value in `_id` when loaded to the Dashboard, used to identify the object in the persistent storage. Historically, the Policy ID (`id`) has been optional (via the `allow_explicit_policy_id` Gateway configuration), and different Tyk components have used one or the other, leading to inconsistency and scenarios where a policy might be rejected due to the configuration of IDs.
+
+We have simplified the Tyk Gateway to use the Policy ID exclusively, instead of the Policy Database ID, improving consistency across the platform. This means that the `allow_explicit_policy_id` Gateway configuration is now redundant and marked deprecated, as the Policy ID field is always used.
+
+If a policy definition is loaded onto the Tyk Dashboard that does not have a Policy ID set, Tyk will automatically set the `id` field to the value in `_id`. There are no changes to the Gateway or Dashboard APIs from this enhancement, ensuring backward compatibility.
+</Accordion>
+
+<Accordion title='Fixed Quick Start API Testing Issues'>
+Resolved multiple issues preventing successful API testing in the Quick Start onboarding flow. Users can now test APIs with any response type (JSON, HTML, XML) without encountering HTTP 500 errors or blank response displays.
+
+Additionally, fixed URL handling issues that occurred when gateway endpoints were configured without URL schemas, ensuring the "Test your API" step works reliably regardless of configuration format. 
+</Accordion>
+
+<Accordion title='Dashboard UI Fixes'>
+- **Incorrect Data Range Display in Total API Traffic Dashboard Chart**: Fixed an issue where the **Total API Traffic** chart on the **Nodes & Licenses** screen displays data from the wrong time period.
+- **TIB User Role Mappings Disappeared on Update**: Fixed a bug that caused TIB profiles to vanish on updates made to `Provider Configuration` advanced settings.
+- **Access Tab Selection from Filtered Dropdown**: Fixed an issue where users and categories could not be selected from filtered dropdown lists in the Access tab of the Tyk OAS API designer.
+- **Unable to Apply Multiple Filters to API List**: Resolved filtering issues where applying multiple filters (name + category) would drop previously applied filters instead of combining them. Users can now apply multiple filters that work together as expected, with all active filters preserved during pagination and sorting.
+- **Data Graph Wizard Incorrectly Displayed**: Fixed an issue where the Data Graph onboarding wizard incorrectly appeared when filters returned zero results - it now only shows when no APIs actually exist in the system, keeping filters visible when results are empty.
+- **Incomplete Certificate Search in API Designer**: Fixed an issue when selecting a TLS certificate to attach to a Tyk OAS API (for example, a client certificate for client-gateway mTLS). To improve performance when scrolling through the list of existing certificates, the UI uses pagination to load a subset of certificates at a time. The certificate ID search would only match against the currently loaded page of certificates, so a certificate might not appear to exist when it does, but just hasn't been loaded yet. Now the search functionality has been improved to look through the full list of certificates in the Tyk Certificate Store, rather than relying on the paginated data.
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.8 Release Notes
+
+#### Release 20th November 2025
+
+#### Release Highlights
+
+This patch release upgrades the Go build environment and fixes some high-priority CVEs. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.8).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.8 | MDCB v2.8.6    | MDCB v2.8.6 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.4    | Sync v2.1.1 |
+|         | Helm Chart v4.1.0  | Helm all versions |
+| | EDP v1.15.0 | EDP all versions |
+| | Pump v1.13.1 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.8, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.8)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.8
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+
+#### Changelog
+<a id="Changelog-v5.8.8" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated Go build environment to Debian 12 ("Bookworm")'>
+We have updated the Go build environment from Debian 11 ("Bullseye") to Debian 12 ("Bookworm") across all pipelines. This change ensures that all builds use the latest Go 1.24 patch version, addressing recent CVEs and improving overall security and stability.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following high-priority CVEs, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-47912" target="_blank">CVE-2025-47912</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58183" target="_blank">CVE-2025-58183</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58185" target="_blank">CVE-2025-58185</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58186" target="_blank">CVE-2025-58186</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58187" target="_blank">CVE-2025-58187</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58188" target="_blank">CVE-2025-58188</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58189" target="_blank">CVE-2025-58189</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61723" target="_blank">CVE-2025-61723</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61724" target="_blank">CVE-2025-61724</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61725" target="_blank">CVE-2025-61725</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.7 Release Notes
+
+#### Release 29 October 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.7).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.7 | MDCB v2.8.5    | MDCB v2.8.5 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.4    | Sync v2.1.1 |
+|         | Helm Chart v4.0  | Helm all versions |
+| | EDP v1.14.1 | EDP all versions |
+| | Pump v1.13.0 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.7, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.7)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.7
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+
+#### Changelog
+<a id="Changelog-v5.8.7" data-scroll-offset></a>
+
+##### Added
+
+
+
+
+<Expandable title='Enabled Gzip Compression for Static Assets to Improve Dashboard Load Performance'>
+Implemented gzip compression for static assets (JavaScript, CSS, images, etc.) when the browser client requests for gzip with the `Accepted-Encoding` header. This significantly reduces the file size transferred when loading the Dashboard, reducing bandwidth usage and improving page load times for users.
+</Expandable>
+
+
+
+
+##### Fixed
+
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed inconsistent sorting of Tyk OAS API versions'>
+Fixed an issue where child versions of Tyk OAS APIs were sorted inconsistently between different Dashboard screens:
+- chronologically by creation date on the APIs listing page
+- alphabetically by version name on the Manage Versions page
+
+All API version listings now consistently use alphabetical sorting by version name, providing a more predictable and user-friendly experience when navigating between different screens.
+</Accordion>
+
+<Accordion title='Improved logging of Request Transform middleware in Tyk OAS debugger'>
+Fixed an issue where the API debugger did not display sufficient information about transformations applied by [Request Body Transform](/api-management/traffic-transformation/request-body) and [Request Header Transform](/api-management/traffic-transformation/request-headers) middleware. The debugger now shows detailed logs matching the format used for Response Transform middleware, including specific details about injected headers (e.g., "Adding: key: value") and body transformations, providing better visibility into request processing for debugging purposes.
+</Accordion>
+
+<Accordion title='Fixed GraphQL API creation via upstream introspection when OPA rules modify requests'>
+Fixed an issue where creating GraphQL APIs using upstream introspection in the Dashboard could fail with `HTTP 502 Bad Gateway` errors when OPA rules (typically using `patch_request`) modified the introspection request body.
+
+The problem occurred because the Dashboard did not recalculate the `Content-Length` header after OPA modifications, causing length mismatches that resulted in proxy errors. The Dashboard now properly recalculates the content length for modified introspection requests, ensuring reliable GraphQL API creation regardless of OPA rule configurations.
+</Accordion>
+
+<Accordion title='Fixed Category Validation for Tyk OAS APIs via Dashboard API'>
+Resolved an issue where the [Dashboard API](/tyk-dashboard-api) allowed creation of empty or duplicate categories when updating Tyk OAS APIs through the `PUT /api/apis/oas/{API_ID}/categories` endpoint.
+The API now properly validates category labels, automatically filtering out blank entries and duplicates to ensure data consistency. This update aligns the Dashboard API behavior with the existing validation rules in the API Designer interface.
+</Accordion>
+
+<Accordion title='Dashboard Analytics and Monitoring Fixes'>
+- **Fixed non-clickable endpoint rows in the Activity page**: Fixed an issue where selecting an endpoint in the "Most Popular Endpoints" list on the "Activity Overview" screen did not direct the user to the      "Activity by Endpoint" screen.
+- **Fixed incorrect error code descriptions in API activity dashboard**: Error codes now display correct descriptions (409 shows "Conflict" instead of "Rate limit or quota exceeded", and missing descriptions for 502, 504, 499, and 422 have been added).
+- **Fixed unicode character display in Activity Logs view**: Non-ASCII characters (Cyrillic, Arabic, Hindi, Telugu, Yoruba, etc.) now display correctly instead of showing garbled text when viewing request/response logs.
+- **Fixed date range filtering showing extra day in analytics charts**: Date range selectors now accurately reflect the selected end date instead of automatically including the following day's data in charts and legends.
+- **Fixed incorrect data tables being queried when SQL table sharding is enabled**: Dashboard now correctly queries sharded tables (tyk_analytics_YYYYMMDD) instead of the main tyk_analytics table when `TYK_DB_STORAGE_LOGS_TABLESHARDING=true` is configured, ensuring analytics data displays properly with SQL database sharding.
+- **Fixed incorrect date labels and data aggregation in analytics charts**: Fixed multiple issues in the analytics aggregation layer when using PostgreSQL backend that caused incorrect chart rendering and service problems. Resolved problems, including hourly charts showing nonsensical dates like "30 Nov 1899", monthly charts displaying incorrect months, incomplete time-series data due to improper date padding, and API activity being incorrectly split across multiple rows.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+### 5.8.6 Release Notes
+
+#### Release Date 25th September 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.6).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.6 | MDCB v2.8.4    | MDCB v2.8.4 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.3    | Sync v2.1.1 |
+|         | Helm Chart v4.0  | Helm all versions |
+| | EDP v1.14.1 | EDP all versions |
+| | Pump v1.12.2 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.6, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.6)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.6
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.6" data-scroll-offset></a>
+##### Changed
+
+
+
+<Expandable title='Upgrade Tyk Dashboard to Golang 1.24'>
+The Tyk Dashboard has been updated to [Golang 1.24](https://tip.golang.org/doc/go1.24), improving security by staying current with the latest Go versions.
+</Expandable>
+
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed Missing Response Middleware in Tyk OAS API Debugger'>
+Fixed an issue where the Tyk OAS API Debugger (Test Your API panel) only displayed request middleware execution, omitting response middleware from the debug output. The test debugger now correctly shows both request and response middleware execution, providing complete visibility into the entire request-response cycle for better API testing and troubleshooting.
+</Accordion>
+
+<Accordion title='Fixed OpenAPI `servers` section handling for regex-based custom domains'>
+Fixed an issue where custom domains containing regular expressions were not correctly parsed and stored in the `servers` section of OpenAPI descriptions for Tyk OAS APIs. The Dashboard now properly converts regex-based domains into valid OpenAPI `servers` entries with appropriate variables, ensuring accurate API documentation and preventing validation errors during API editing. This fix includes enhanced syntax validation for regular expression (regex) patterns and improved capture group handling, which previously could cause Gateway crashes.
+</Accordion>
+
+<Accordion title='Fixed false error reporting for Response Body Transform middleware in API Debugger'>
+Fixed an issue where the Tyk OAS API Debugger (Test Your API panel) incorrectly reported errors for endpoints using Response Body Transform middleware, even when API calls completed successfully. The debugger now accurately displays the execution status and eliminates false error messages that could mislead developers during API testing and troubleshooting.
+</Accordion>
+
+<Accordion title='Fixed PATCH endpoint validation to reject Tyk OAS API definitions when expecting OpenAPI description'>
+Fixed an inconsistency where the Dashboard API's `PATCH /api/apis/oas/{apiId}` endpoint incorrectly accepted full Tyk OAS API definitions containing Tyk Vendor Extensions, when it should only accept standard OpenAPI descriptions. The endpoint now properly validates incoming requests and returns `HTTP 400 Bad Request` if the Tyk Vendor Extension is present, ensuring consistent behavior with the Dashboard UI and maintaining the intended separation between OpenAPI description updates and full API configuration changes.
+</Accordion>
+
+<Accordion title='Fixed Dashboard API panic when accessing logs without timestamp parameters in PostgreSQL'>
+Fixed an issue where the Tyk Dashboard API would panic and return `HTTP 500 Internal Server Error` when accessing the `/api/logs` endpoint without the required `start` and `end` timestamp parameters in PostgreSQL environments using table sharding. The API now properly handles missing parameters by returning `HTTP 400 Bad Request` with a descriptive error message, improving error handling and API reliability.
+</Accordion>
+
+<Accordion title='Fixed orphaned Tyk OAS API versions visibility when using PostgreSQL'>
+Fixed an issue where orphaned child versions of a Tyk OAS API would disappear from the Dashboard UI after their base API was deleted, specifically when using PostgreSQL as the datastore. Orphaned Tyk OAS API versions now remain visible in the Dashboard, ensuring consistent behavior across all supported datastores and preventing loss of access to existing API versions.
+</Accordion>
+
+<Accordion title='Fixed cross-interface compatibility for keys and policies with Tyk OAS and non-versioned Tyk Classic APIs'>
+Fixed an issue where keys and policies created or updated via the Dashboard API were sometimes rejected by the Dashboard UI, and vice versa, due to inconsistent handling of the `versions` field for non-versioned Tyk Classic APIs. The issue occurred because the API and UI used different formats when populating the versions list in access rights. Both interfaces now consistently accept either `null` or `[]` (empty array) values in the `versions` field of the access control list, ensuring seamless interoperability between API and UI workflows for policy and key management. Tyk OAS APIs use a [different approach](/api-management/api-versioning#how-api-versioning-works-with-tyk) to versioning, with each (base or child) version having a unique API ID that is added to the access list.
+</Accordion>
+
+<Accordion title='Fixed Policy and Key Management UI for versioned APIs'>
+Fixed UI issues in policy and key management that caused confusion and unnecessary validation errors. The API Versions field in the Dashboard UI now appears only when relevant - specifically for versioned Tyk Classic APIs. The field is no longer displayed for Tyk OAS APIs or non-versioned Tyk Classic APIs, eliminating confusion about when version selection is required and preventing policies and keys from failing to save due to irrelevant validation requirements.
+</Accordion>
+
+<Accordion title='Fixed `/versions` endpoint to only accept valid Tyk OAS base APIs'>
+Fixed an issue where the `/api/apis/oas/{apiId}/versions` endpoint incorrectly returned version data for Tyk Classic APIs and non-versioned Tyk OAS APIs. The endpoint now properly validates requests and returns `HTTP 422 Unprocessable Entity` when the target API is not a valid Tyk OAS base API, ensuring the endpoint only returns meaningful version information.
+</Accordion>
+
+<Accordion title='Fixed multiple issues with the creation of child versions of Tyk OAS APIs'>
+Fixed several issues that affected the creation of new child versions of Tyk OAS APIs to ensure reliable version creation and proper validation:
+
+UI and API Creation:
+- Resolved an issue that prevented users from creating new versions via the API Designer's Manage Versions screen
+- Added validation for the `base_api_id` parameter - providing a non-existent ID would previously create the API successfully, but leave it invisible in the Dashboard UI
+- Added stricter validation for version names - users can no longer create API versions without specifying a valid `new_version_name`, preventing unusable or empty version entries
+- Improved error messaging when the `base_api_version_name` parameter is missing or incorrectly specified
+
+Version Management:
+- Fixed an issue where creating new child versions would incorrectly reset the default version back to the base API, overriding previously configured settings
+
+The system now provides comprehensive validation with clear error responses (`HTTP 400 Bad Request` and `HTTP 422 Unprocessable Entity`), ensures that all API versions have meaningful identifiers, and maintains proper default version settings during the creation of child versions.
+</Accordion>
+
+<Accordion title='Fixed Dashboard default page_size behavior'>
+Fixed an issue where the Tyk Dashboard did not correctly apply a default `page_size` value when none was specified in the Dashboard configuration, potentially causing unexpected pagination behavior. The Dashboard now properly defaults to a page size of 10 items as documented, ensuring consistent and predictable pagination across all Dashboard views.
+</Accordion>
+
+<Accordion title='Fixed delayed application of global webhook changes for Tyk OAS APIs'>
+Fixed an issue where updates to [global webhooks](/api-management/gateway-events#local-and-global-webhooks) were not immediately applied to Tyk OAS APIs using those webhooks. When global webhook configurations were modified, the Gateway would continue using the previous settings for affected Tyk OAS APIs until a manual reload occurred. The system now automatically triggers a Gateway reload for all impacted Tyk OAS APIs when global webhook configurations are updated, ensuring that the new webhook settings take effect immediately.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+
+##### Security Fixes
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high-priority CVEs identified in the Tyk Dashboard, providing increased protection against security
+vulnerabilities:<br />
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-47875" target="_blank">CVE-2024-47875</a><br />
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-45801" target="_blank">CVE-2024-45801</a>
+</Expandable>
+
+
+
+### 5.8.5 Release Notes
+
+#### Release Date 18th August 2025
+
+#### Release Highlights
+
+This release fixes a compatibility issue between MDCB and Dashboard where APIs containing dots (.) in their paths were not handled correctly in MDCB. API definitions are now processed consistently with the Dashboard, ensuring middleware works as expected across all gateways.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.5).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.5 | MDCB v2.8.4     | MDCB v2.8.4 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.1    | Sync v2.1.1 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.14 | EDP all versions |
+| | Pump v1.12.1 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.23  |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.8.5"></a>
+
+To resolve the compatibility issue between MDCB and Tyk Dashboard when OAS API definition paths contain dot (.) characters, you can choose **one** of the following upgrade paths:
+
+##### Recommended Upgrade Paths
+
+1. **Upgrade Dashboard (Preferred)**
+
+   * Upgrade to Dashboard v5.8.5 to resolve the issue.
+   * In this version, `escape_dots_in_oas_paths` defaults to `false`, and the Dashboard automatically unescapes dots in all API definitions.
+   * **No MDCB upgrade is required.**
+
+2. **Upgrade MDCB to v2.8.4 (Alternative if you cannot upgrade the Dashboard)**
+
+    - Enable `escape_dots_in_oas_paths` in both Dashboard and MDCB configurations.
+    - This ensures consistent escaping/decoding of dots across all components.
+
+If you are upgrading to 5.8.5, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.5)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.5
+    ``` 
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.5" data-scroll-offset></a>
+
+##### Fixed
+
+
+<Expandable title='Consistent Handling of Escaped Dots in OpenAPI Endpoint Paths'>
+Resolved a compatibility issue introduced via a fix in Dashboard v5.8.3 to account for DocumentDB's handling of endpoint paths containing dots (`.`). The Dashboard now escapes dot characters (e.g., `\u002e`) when storing Tyk OAS API definitions in the database, but MDCB failed to unescape them when reading from the database. This caused the [request validation](/api-management/traffic-transformation/request-validation) and [mock response](/api-management/traffic-transformation/mock-response#mock-response) middleware configured on affected endpoints not to be applied. 
+
+To align MDCB's dot handling mechanism with Tyk Dashboard, a new configuration option, `escape_dots_in_oas_paths`, has been introduced in both Dashboard and MDCB:
+
+* By Default, `escape_dots_in_oas_paths` is set to `false` in both MDCB and Dashboard, restoring the Dashboard behaviour before v5.8.3, where dots are unescaped.
+* When `escape_dots_in_oas_paths` is set to `true`, Dots are escaped for compatibility with specific databases. With this config set to `true`, MDCB and Dashboard encode/decode these paths consistently.
+
+Check the [Upgrade and Compatibility section](#upgrade-5.8.5) for details on the recommended upgrade path.
+</Expandable>
+
+
+
+### 5.8.4 Release Notes
+
+#### Release Date 13th August 2025
+
+#### Release Highlights
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.4).
+
+#### Breaking Changes
+
+Since 5.8.3, Tyk Dashboard automatically escapes dots (`.`) in OpenAPI endpoint paths (e.g., <code>/v1.0</code> becomes <code>/v1\u002e0</code>) before saving to the database. This was introduced to support DocumentDB users as explained in the [change log](#Changelog-v5.8.3). MDCB 2.8.3 and earlier fails to properly decode these escaped paths when reading from the database. This causes the Validate Request and Mock Response middleware to malfunction for endpoints where the path contains dots; other middleware continues to work. The issue affects all MDCB deployments with Dashboard 5.8.4 and is fixed in version Dashboard version 5.8.5 and MDCB version 2.8.4. We strongly recommend that users upgrade to the latest versions of Tyk components.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.4 | MDCB v2.8.3     | MDCB v2.8.3 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.1    | Sync v2.1.1 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.14 | EDP all versions |
+| | Pump v1.12.0| Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.23       | 1.23       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.4, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.4)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.4
+    ```
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.4" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='URL Rewrite Middleware UI Compatibility Fix'>
+Resolved an issue in the URL Rewrite middleware UI where the absence of the `negate` field in OAS API definition configurations caused unexpected behavior. The UI now correctly interprets a missing `negate` field in URL rewrite rules as `false` by default, ensuring compatibility with APIs created in earlier versions.
+</Expandable>
+
+
+
+---
+
+### 5.8.3 Release Notes
+
+#### Release Date 15th July 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.3) below.
+
+#### Breaking Changes
+
+Tyk Dashboard now automatically escapes dots (`.`) in OpenAPI endpoint paths (e.g., <code>/v1.0</code> becomes <code>/v1\u002e0</code>) before saving to the database. This was introduced to support DocumentDB users as explained in the [change log](#Changelog-v5.8.3). MDCB 2.8.3 and earlier fails to properly decode these escaped paths when reading from the database. This causes the Validate Request and Mock Response middleware to malfunction for endpoints where the path contains dots; other middleware continues to work. The issue affects all MDCB deployments with Dashboard 5.8.3 and is fixed in version Dashboard version 5.8.5 and MDCB version 2.8.4. We strongly recommend that users upgrade to the latest versions of Tyk components.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.3 | MDCB v2.8.2     | MDCB v2.8.2 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.1    | Sync v2.1.1 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.14 | EDP all versions |
+| | Pump v1.12.0| Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.23       | 1.23       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.3, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.3)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.3
+    ```
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.3" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed Automatic Configuration of Middleware when Importing OpenAPI Description'>
+Fixed an issue where the automatic configuration options (authentication, mock response, etc) had no effect when creating an API from an OpenAPI document if the `listenPath` was not also specified via query parameter.
+</Accordion>
+
+<Accordion title='Fixed the Search Function on the Traffic Activity by Key page when using MongoDB'>
+Fixed an issue where the Search function did not work correctly on the Traffic Activity by Key page that was observed only when using MongoDB for analytics storage. This was due to the specific syntax required by MongoDB for regular expressions.
+</Accordion>
+
+<Accordion title='Fixed an Incompatibility with DocumentDB for Certain Endpoint Names'>
+Fixed an issue where endpoints that contain dots in the path name failed with an error when creating or updating an API. The issue was caused by the underlying storage not accepting dots as valid URI characters and was observed only with DocumentDB.
+</Accordion>
+
+<Accordion title='Preserve Categories and Ownership on Tyk OAS Update'>
+Fixed an issue where API Categories and Ownership could be lost when applying an updated OpenAPI description to a Tyk OAS API.
+</Accordion>
+
+<Accordion title='Fixed Middleware Not Triggering in Tyk OAS Debugger'>
+Fixed an issue where some middleware (API-level rate limit and mock response) were not triggered correctly when using the Tyk OAS API designer's built in debugger to test APIs.
+</Accordion>
+
+<Accordion title='Removed Empty Fields in Tyk Classic to Tyk OAS Conversion'>
+Fixed an issue that occurred when converting Tyk Classic API definitions to Tyk OAS format, which could result in unnecessary empty fields in the Tyk OAS API definition.
+</Accordion>
+
+<Accordion title='Certificate API Filtering Added so that Relevant Certificates are Available when Configuring Upstream mTLS in Tyk OAS API Designer'>
+Fixed an issue where the Tyk OAS API designer did not always display all of the appropriate certificates for use in Gateway to Upstream connections. In this scenario Tyk is the client and so requires the private key to sign requests to the upstream server. The full list of certificates with private keys registered in the Tyk Certificate Store will now be available when configuring your API.
+
+For Dashboard API users, we’ve added a new optional `filter` query parameter to the `/api/certs` endpoint that will can be used to retrieve a subset of the certificate based on the presence of a Private Key (PK):
+
+- `omit`: (Default) Returns all certificates.
+- `with_pk`: Returns only certificates that include a Private Key.
+- `without_pk`: Returns only certificates that do not include a Private Key.
+
+For example:
+
+- To retrieve the first page of certificates: `/api/certs?mode=detailed&p=1`
+- To retrieve the first page of certificates with a Private Key: `/api/certs?mode=detailed&p=1&filter=with_pk`
+- To retrieve the first page of certificates without a Private Key: `/api/certs?mode=detailed&p=1&filter=without_pk`
+
+This new filtering capability provides more granular control over which certificates you retrieve from the Tyk Certificate Store. There is no change in behaviour if the `filter` parameter is omitted.
+</Accordion>
+
+<Accordion title='Use YAML Formatted OpenAPI Description to Update a Tyk OAS API'>
+We’ve fixed an issue when importing OpenAPI descriptions using the PATCH method, so you can now update your Tyk OAS APIs using either YAML or JSON formatted OpenAPI descriptions.
+</Accordion>
+
+<Accordion title='Improved Validation When Importing Tyk Streams API Definitions'>
+Fixed an issue where Dashboard did not correctly import Tyk Streams API definitions, skipping validation of the configuration.
+</Accordion>
+
+<Accordion title='Fixed Incorrect Auth Configuration when Importing OpenAPI Description'>
+Fixed an error in the Tyk OAS API Designer that added invalid config to the API definition when enabling Tyk OAuth 2.0 authentication method for an API that has an OAuth configuration in the OpenAPI description's securitySchemes.
+</Accordion>
+
+<Accordion title='Improved Experience for Tyk Streams APIs in API Definition Editor'>
+Fixed some issues when using the API Definition Editor to view and modify Tyk Streams APIs.
+</Accordion>
+
+<Accordion title='Various fixes to the Dashboard UI'>
+We have implemented various fixes and improvements in the Dashboard UI to enhance usability.
+
+- The Tyk OAS API designer now fully supports the use of Key-Value storage [references](/tyk-configuration-reference/kv-store#from-api-definitions) that are valid in the API definition.
+- Improved the error messages displayed in the Dashboard UI when there are problems importing OpenAPI documents - now they clearly explain the issue and provide guidance on how to resolve it.
+- Fixed an issue where users couldn't register Event Handlers in Tyk OAS API Designer.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.8.2 Release Notes
+
+#### Release Date 1st July 2025
+
+#### Release Highlights
+
+This is a version bump to align with Gateway v5.8.2, no changes have been implemented in this release.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.2 | MDCB v2.8.1     | MDCB v2.8.1 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0| Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.23       | 1.23       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.2, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.2)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.2
+    ```
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.2" data-scroll-offset></a>
+
+No changes in this release.
+
+
+---
+
+### 5.8.1 Release Notes
+
+#### Release Date 9 May 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.1) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.1 | MDCB v2.8.1     | MDCB v2.8.1 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0| Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.23       | 1.23       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.1, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.1)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.1
+    ```
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='License allocation now works across multiple dashboards'>
+Fixed an issue where the Dashboard might not allow the correct number of Gateways to connect. This was due to a conflict with license management in deployments with multiple Dashboards which has now been resolved.
+</Accordion>
+
+<Accordion title='Admin permissions correctly assigned during SSO login'>
+Fixed an issue where existing admin users could have their permissions overwritten by SSO group settings during login. Admin users now retain their original permissions when `sso_enable_user_lookup` is enabled. Group permissions are only applied to new or non-admin users.
+</Accordion>
+
+<Accordion title='Fixed import of Tyk OAS API definitions in YAML format'>
+Fixed an issue that prevented creation of an API from a YAML format Tyk OAS API definition. You can now export your Tyk OAS API definition in YAML or JSON format and use the content of this file to create a new API.
+</Accordion>
+
+<Accordion title='Fixed broken cancel button in Tyk Classic to Tyk OAS flow'>
+Fixed an issue when using API Designer to migrate an API from Tyk Classic to Tyk OAS. Previously the cancel button did not work in the pop-up when promoting a staged API.
+</Accordion>
+
+<Accordion title='Multi-part OpenAPI descriptions in YAML format can now be imported'>
+Fixed an issue that prevented import of multi-part OpenAPI descriptions in YAML format.
+</Accordion>
+
+<Accordion title='Various fixes to the Dashboard UI'>
+We have implemented various fixes and improvements in the Dashboard UI to enhance usability.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Security Fixes 
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority [CVEs](https://www.cve.org/) identified in the Tyk Dashboard, providing increased protection against security vulnerabilities:
+- [CVE-2025-46569](https://nvd.nist.gov/vuln/detail/CVE-2025-46569)
+</Expandable>
+
+
+
+### 5.8.0 Release Notes
+
+#### Release Date 28 March 2025
+
+#### Release Highlights
+
+With Tyk 5.8.0 we are delighted to unlock the power and flexibility of Tyk OAS for all users, with full feature parity with the legacy Tyk Classic style for REST APIs. We are thrilled to announce new updates and improvements in Tyk 5.8.0, delivering more control, flexibility, and performance.  For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.0) below.
+
+##### Full support for API configuration using Tyk OAS
+
+We have completed the journey with Tyk OAS that started back in Tyk 4.1 - and now anything that you can configure using the Tyk Classic API definition is also available in the Tyk OAS API definition. Tyk OAS is now the recommended API style for all REST services, with Tyk Classic recommended for use only for GraphQL and TCP services.
+
+With Tyk OAS we combine the industry standard OpenAPI description with the Tyk Vendor Extension, which encapsulates all of the Tyk Gateway settings that cannot be inferred from the OpenAPI Specification (OAS). You can keep your service description (OAS) as source of truth and update the OpenAPI description part of a Tyk OAS API independently from the Tyk Vendor Extension - no need to unpick distributed vendor extensions from your OAS. For more details, please see the [documentation](/api-management/gateway-config-tyk-oas).
+
+Now that we have achieved this milestone we are keen to support users in migrating their existing Tyk Classic API portfolio to Tyk OAS and offer methods to do this both within the Tyk Dashboard Classic API Designer and via the Tyk Dashboard API. For more details of the migration tool, please see the [documentation](/api-management/migrate-from-tyk-classic).
+
+##### Enhanced upstream authentication
+
+We are pleased to introduce advanced options for your Tyk OAS APIs when it comes to authenticating with the upstream service - a critical feature for integration with many partner services. With Tyk 5.8.0 you are now able to configure Tyk to act as an OAuth 2.0 client, retrieving an access token via the Client Credentials grant method. For legacy integrations Tyk can also support OAuth 2.0 Resource Owner Password Credentials grant and Basic Authentication methods. For more details please see the [documentation](/api-management/upstream-authentication).
+
+##### Enhanced user experience within the Tyk Dashboard API Designer
+
+To accompany the launch of fully featured Tyk OAS capabilities, we have made a raft of improvements in the Tyk Dashboard GUI. There's an all-new API test and debug facility in the API designer, allowing you to issue requests to your APIs and then examine the debug traces produced by the Gateway without leaving the Tyk Dashboard. Our new, enhanced code editor allows you to work in YAML or JSON. We've also given the UI a spring clean to improve the usability.
+
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.0 | MDCB v2.8.0     | MDCB v2.8.0 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0| Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.23       | 1.23       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.0, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.8.0)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.8.0
+    ```
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.8.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='YAML Support for Tyk OAS'>
+Tyk Dashboard's API and UI now support both YAML and JSON for Tyk OAS CRUD operations, giving users greater flexibility in managing their APIs.
+</Accordion>
+
+<Accordion title='Added Support for External References in OpenAPI Descriptions'>
+We've enhanced Tyk's OpenAPI handling to allow the import of multi-part OpenAPI documents. This allows users to import OpenAPI descriptions that are split across multiple files, making it easier to manage complex API specifications.
+</Accordion>
+
+<Accordion title='API Testing & Debugging with Tyk OAS'>
+We’ve added built-in testing and debugging capabilities to the Tyk OAS API Designer, making validating and troubleshooting your APIs easier. With a floating debugging panel and an endpoint dropdown, you can test your endpoints within the Dashboard UI.
+</Accordion>
+
+<Accordion title='Support for Read/Write Endpoints on RDS for Analytics and Logs'>
+Users can now configure separate RDS endpoints for read and write operations, optimizing database performance by handling reads on replicas and writes on the primary instance.
+
+New Configuration Fields:
+
+- **ReadConnectionString**: Defines the connection string for read operations. It is only used if `ConnectionString` is not set.
+- **WriteConnectionString**: Defines the connection string for write operations. It is only used if `ConnectionString` is not set.
+
+For backward compatibility, if `ConnectionString` is set, it will take precedence over the new fields.
+</Accordion>
+
+<Accordion title='Certificate Support for GraphQL Introspection During API Creation'>
+When creating a GraphQL API in the API designer, you can now attach certificates to be used during introspection of mTLS-protected upstream services. This simplifies the creation of GraphQL APIs by reducing the number of steps, as previously you had to use a dummy upstream during the initial creation and then reconfigure the API to perform introspection later.
+</Accordion>
+
+<Accordion title='Convert Tyk Classic API Definitions to Tyk OAS'>
+Introduced a new [API migration facility](/api-management/migrate-from-tyk-classic) to the Tyk Dashboard API and API Designer enabling a seamless transition from Tyk Classic to Tyk OAS. Both methods offer direct and staged conversions of individual APIs. The Tyk Dashboard API also supports bulk API conversions.
+
+Note that there is a known issue where the Cancel button in the Promote Staged API confirmation modal does not function. If you select Promote Staged API but decide not to proceed, you will need to use your browser’s Back button to exit the modal. This issue will be resolved in the next patch.
+</Accordion>
+
+<Accordion title='Upstream Authentication Support in Tyk Dashboard'>
+Tyk Dashboard now supports integration with upstream services secured using Basic Auth, OAuth 2.0 Client Credentials, and OAuth 2.0 Password Grant in Tyk OAS APIs, providing flexibility in securing upstream authentication flows.
+</Accordion>
+
+<Accordion title='Quick Start Wizard for New Dashboard Users on Tyk Cloud'>
+We have introduced a guided onboarding experience for Tyk Cloud users to help new users start effortlessly. Our step-by-step guide walks you through creating your first API, setting up policies and keys, testing endpoints, and exploring analytics - ensuring you can navigate the Dashboard and unlock its full potential from day one.
+</Accordion>
+
+<Accordion title='View Audit Logs in the Dashboard UI'>
+Tyk Dashboard now provides enhanced visibility into user activity by allowing audit logs to be stored in a database and viewed directly in the Dashboard UI. Previously, these logs were only written to local files, limiting accessibility. With this update, admins can filter and review user actions more easily, improving security, and compliance tracking.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Changed
+
+
+
+<AccordionGroup>
+<Accordion title='Support for PostgreSQL 17'>
+The Dashboard now supports PostgreSQL 17, ensuring compatibility with the latest database version.
+</Accordion>
+
+<Accordion title='Upgraded to Golang 1.23'>
+Tyk Dashboard now runs on Golang 1.23, bringing security and performance improvements. Key changes include:
+
+- unbuffered Timer/Ticker channels
+- removal of 3DES cipher suites
+- updates to X509KeyPair handling.
+
+**You may need to adjust your setup for compatibility**. For more details, please see the official Go [release notes](https://go.dev/doc/go1.23).
+</Accordion>
+
+<Accordion title='Improved Dashboard Code Editor'>
+Upgraded the code editor component library and enhanced its styling for a better user experience. With this upgrade comes the facility to work in YAML or JSON and to switch seamlessly between formats.
+</Accordion>
+
+<Accordion title='Improved Labelling in Tyk Dashboard'>
+We have made minor adjustments to labels within the Dashboard UI to enhance clarity.
+</Accordion>
+
+<Accordion title='"Manage Account" Link from Dashboard'>
+The "Manage Account" link in the Tyk Dashboard, which previously directed users to an outdated cloud login page, has been removed. This improves the user experience by eliminating confusion around account management and ensuring a more cohesive navigation flow between the Dashboard and Tyk Cloud.
+</Accordion>
+
+<Accordion title='Improved Form Performance in API Designer'>
+We’ve optimized form validation in the API Designer to enhance user experience. Forms are now validated on blur instead of during every keystroke, preventing cursor jumps and improving typing responsiveness.
+</Accordion>
+
+<Accordion title='Updated Default Configuration for Tyk Operator and Sync Compatibility'>
+Modified the default values of `allow_explicit_policy_id` and `enable_duplicate_slugs` to `true` in the example Dashboard configuration file, to eliminate config problems when deploying Tyk Sync and Tyk Operator. This has no impact on existing deployments.
+</Accordion>
+
+<Accordion title='Removed unsupported TLS options in Tyk Classic API Designer'>
+Removed unsupported TLS versions 1.0 and 1.1 from the Tyk Classic API Designer selector, improving clarity around supported TLS versions and enhancing security.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Enhanced OPA Rules for Token Reset and User Data Access'>
+Updated OPA rules in the Dashboard to allow all users to reset their own access tokens and view their user data, improving self-service while maintaining security.
+Note that users with custom OPA rules are strongly advised to update their configurations to include the `is_self_key_reset` and `is_me` helper rules. Additionally, they should modify their rules to exclude cases where `is_self_key_reset` or `is_me` apply, in order to enable this functionality.
+</Expandable>
+
+
+<Expandable title='Improved Control for Dashboard API Credentials'>
+Users can now always access their own Dashboard API credentials, regardless of permissions. Admins' ability to view or reset other users' credentials is now strictly controlled by security flags.
+</Expandable>
+
+
+
+---
+
+## 5.7 Release Notes
+
+### 5.7.3 Release Notes
+
+#### Release Date 05 June 2025
+
+#### Release Highlights
+
+This is a version bump to align with Gateway v5.7.3, no changes have been implemented in this release.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.7.3 | MDCB v2.7.2     | MDCB v2.5.1 |
+|         | Operator v1.1.0  | Operator v0.17 |
+|         | Sync v2.0.2    | Sync v1.4.3 |
+|         | Helm Chart v2.2  | Helm all versions |
+| | EDP v1.12 | EDP all versions |
+| | Pump v1.11.1 | Pump all versions |
+| | TIB (if using standalone) v1.6.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.7.3, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.7.3)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.7.3
+    ```
+- Helm charts
+  - [tyk-charts v2.2.0](/developer-support/release-notes/helm-chart#2-2-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.7.3" data-scroll-offset></a>
+
+No changes in this release.
+
+
+### 5.7.2 Release Notes
+
+#### Release Date 19 February 2025
+
+#### Release Highlights
+
+This release focuses mainly on a security fix. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.7.2) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.7.2 | MDCB v2.7.2     | MDCB v2.5.1 |
+|         | Operator v1.1.0  | Operator v0.17 |
+|         | Sync v2.0.2    | Sync v1.4.3 |
+|         | Helm Chart v2.2  | Helm all versions |
+| | EDP v1.12 | EDP all versions |
+| | Pump v1.11.1 | Pump all versions |
+| | TIB (if using standalone) v1.6.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+There are no deprecations in this release
+
+#### Upgrade instructions
+If you are upgrading to 5.7.2, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.7.2)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.7.2
+    ```
+- Helm charts
+  - [tyk-charts v2.2.0](/developer-support/release-notes/helm-chart#2-2-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.7.2" data-scroll-offset></a>
+
+No changes have been implemented in this release.
+
+##### Fixed
+
+
+
+<Expandable title='Adding a TLS/SSL certificate caused the page to go blank'>
+Fixed an issue where attempting to add a certificate on the TLS/SSL Certificates page caused the page to go blank with an error. This has been resolved by ensuring the file input is handled correctly.
+</Expandable>
+
+
+
+##### Security Fixes
+
+
+
+<Expandable title='Critical Priority CVE Fixed'>
+- Fixed the following critical-priority CVE identified in the Dashboard UI, providing increased protection and improved security:
+    - [CVE-2025-21613](https://nvd.nist.gov/vuln/detail/CVE-2025-21613)
+</Expandable>
+
+
+<Expandable title='High Priority CVE Fixed'>
+- Fixed the following CVE:
+    - [CVE-2025-21614](https://nvd.nist.gov/vuln/detail/CVE-2025-21614)
+</Expandable>
+
+
+
+---
+
+### 5.7.1 Release Notes
+
+#### Release Date 31 December 2024
+
+#### Release Highlights
+
+This release focuses mainly on bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.7.1) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.7.1 | MDCB v2.7.2     | MDCB v2.5.1 |
+|         | Operator v1.1.0  | Operator v0.17 |
+|         | Sync v2.0.1    | Sync v1.4.3 |
+|         | Helm Chart v2.2  | Helm all versions |
+| | EDP v1.12 | EDP all versions |
+| | Pump v1.11.1 | Pump all versions |
+| | TIB (if using standalone) v1.6.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+We have deprecated the obsolescent `http_server_options.prefer_server_ciphers` configuration option. This legacy control no longer has any effect on the underlying library and users are advised to remove this setting from their configurations.
+
+#### Upgrade instructions
+If you are upgrading to 5.7.1, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.7.1)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.7.1
+    ```
+- Helm charts
+  - [tyk-charts v2.2.0](/developer-support/release-notes/helm-chart#2-2-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.7.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Fixed Issue with Restore Zooming in API Activity Dashboard'>
+Resolved a bug where clicking "Restore zooming to initial state" in the API Activity Dashboard would cause the graph to show blank instead of resetting to the initial zoom level. This fix ensures that users can now correctly restore the default zoom state in all charts on the Dashboard.
+</Expandable>
+
+
+<Expandable title='Deprecation of http_server_options.prefer_server_ciphers'>
+This option has been marked as deprecated due to its obsolescence in the underlying library functions used by Tyk. Users are advised to remove this configuration from their setups as it no longer has any effect.
+</Expandable>
+
+
+
+---
+
+### 5.7.0 Release Notes
+
+#### Release Date 03 December 2024
+
+#### Release Highlights
+
+We are thrilled to announce new updates and improvements in Tyk 5.7.0, bringing more control, flexibility, and performance.  For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.7.0) below.
+
+##### Tyk Streams can be configured through Tyk Dashboard
+
+With this release we are adding a possibility for users to configure their Stream & Events APIs using Tyk Dashboard. 
+The new API designer leads users step-by-step to create a new Stream configuration easily. Pre-filled stream configurations for different inputs and outputs make it easy to make sure that the Stream is configured correctly.
+
+##### Improved Audit Log Management
+
+Tyk 5.7.0 enhances Audit Log management with new features designed for efficiency and security. Users can now store Dashboard Audit Logs in a database for persistent retention and access them via the new /audit-logs API, which supports advanced filtering by attributes like action, IP, status, and user. Additionally, a dedicated Audit Log RBAC group ensures secure access to sensitive log data. These improvements simplify monitoring and compliance workflows, particularly in containerized environments.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+
+There are no breaking changes in this release.
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.7.0 | MDCB v2.7.2     | MDCB v2.5.1 |
+|         | Operator v1.1.0  | Operator v0.17 |
+|         | Sync v2.0.1    | Sync v1.4.3 |
+|         | Helm Chart v2.2  | Helm all versions |
+| | EDP v1.12 | EDP all versions |
+| | Pump v1.11.1 | Pump all versions |
+| | TIB (if using standalone) v1.6.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+This section highlights features and dependencies that have been deprecated.
+
+##### Authentication Methods
+
+We’ve deprecated the following authentication methods in this release:
+
+* **[External OAuth](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated)**
+
+  * Tyk Classic: `external_oauth`
+  * Tyk OAS: `server.authentication.securitySchemes.externalOAuth`
+
+* **[OpenID Connect (OIDC)](/api-management/client-authentication#integrate-with-openid-connect-deprecated)**
+
+  * Tyk Classic: `auth_configs.oidc`
+  * Tyk OAS: `server.authentication.oidc`
+
+We recommend migrating to **[JWT Authentication](/basic-config-and-security/security/authentication-authorization/json-web-tokens)** for improved flexibility and long-term support.
+
+##### SQLite End of Life
+
+SQLite has reached **End of Life** for the Tyk Dashboard in this release. It was previously intended for **proof-of-concept** use only and is no longer supported.
+
+We now recommend using **PostgreSQL** or **MongoDB** for both development and production deployments, as they provide greater scalability and long-term support.
+
+**Why This Matters**
+
+* SQLite is written in **C**, and using it in Go projects typically requires [**CGO**](https://golang.org/cmd/cgo/), which enables Go code to call C libraries.
+* As long as the Dashboard had support for SQLite, CGO was required.
+* With SQLite removed, the Tyk Dashboard can now be compiled with `CGO_ENABLED=0`, resulting in a **fully static binary**.
+
+This change enables:
+
+* Easier cross-platform builds
+* Better compatibility with **RHEL8**
+* Fewer dependencies and improved portability
+
+#### Upgrade instructions
+If you are upgrading to 5.7.0, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.7.0)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.7.0
+    ```
+- Helm charts
+  - [tyk-charts v2.2.0](/developer-support/release-notes/helm-chart#2-2-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.7.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Added confirmation prompt for Stream deletion'>
+Introduced a confirmation prompt when deleting a stream, notifying users that this action will stop all data streaming and cannot be undone. This change ensures users are fully aware of the impact before proceeding with deletion.
+</Accordion>
+
+<Accordion title='Displayed Streaming API in API overview table'>
+Added "Streams" as an API type in the API Overview table, making it easier for API developers to identify APIs categorised as Streams & Events.
+</Accordion>
+
+<Accordion title='Implemented logic for config framework selection in Streaming API creation'>
+Added logic for the Streaming API creation process, allowing users to select config frameworks for inputs, processors, and outputs. An 'Advanced' option is also available, which leaves the code editor empty while generating and displaying the YAML Bento config based on the user's selections.
+</Accordion>
+
+<Accordion title='Enhanced info messages for securing Streaming & Events APIs in policies & keys'>
+Included new info messages and tooltips in the Policies & Keys section to guide users on securing Streaming & Events APIs. Updated messaging clarifies the combination of API types and revised copy in the Global Rate Limiting and Quota sections to better explain usage limits for keys and plans.
+</Accordion>
+
+<Accordion title='Enabled URL view and copy functionality in external playgrounds tab'>
+Enabled URL view and copy functionality in the External Playgrounds tab, supporting scenarios with multiple organisations and URLs for playgrounds.
+</Accordion>
+
+<Accordion title='Introduced /streams endpoint to Tyk Dashboard API'>
+Rolled out the `/streams` endpoint to the Tyk Dashboard API, dedicated to creating Stream and Events APIs in Tyk Streams. Documentation for the endpoint and its methods is available in the Tyk Docs.
+</Accordion>
+
+<Accordion title='Split Streaming API into new type in API designer'>
+Separated Streaming API into its own type in the API Designer, introducing a new selection card for easier creation and configuration. Navigation enhancements, including a shortcut menu item, provide quicker access to the streaming configuration UI.
+</Accordion>
+
+<Accordion title='Integrated step-by-step UI for Config framework selection in Streaming API creation'>
+Developed a step-by-step UI for Streaming API creation, enabling users to select a config framework for inputs, processors, and outputs. The dynamic wizard steps are integrated into the Tyk UI library to prefill configurations based on selections and prevent the combination of 'Custom' with other frameworks.
+</Accordion>
+
+<Accordion title='Easily contact Tyk Support during Tyk Cloud trial'>
+Introduced a form on the Tyk Dashboard that allows users to easily contact Tyk support during their trial period.
+</Accordion>
+
+<Accordion title='Support for JWE in OIDC SSO'>
+We have enhanced security for customers in highly regulated industries by introducing JSON Web Encryption (JWE) support for OIDC single sign-on (SSO). This ensures that tokens used in authentication flows are securely encrypted, providing an additional layer of protection.
+
+[Setup guide for JWE OIDC SSO](/api-management/single-sign-on-social-idp#json-web-encryption-jwe)
+</Accordion>
+
+<Accordion title='Store Audit Logs in a Database'>
+Users can now choose to store Dashboard Audit Logs directly in a database, enabling efficient and reliable log storage. This feature is particularly beneficial for organizations needing persistent audit log retention to meet compliance requirements or for forensic purposes.
+</Accordion>
+
+<Accordion title='Access Audit Logs via /audit-logs endpoint'>
+A new API endpoint, `/audit-logs`, has been introduced to provide programmatic access to audit logs stored in database. This allows users to retrieve, filter, and analyze logs more effectively. The API supports filtering logs by key attributes like action, IP address, URL accessed, date range, user, and page number.
+
+For detail usage of the `/audit-logs` endpoint, please see [Dashboard API documentation](/tyk-dashboard-api).
+</Accordion>
+
+<Accordion title='New Role-Based Access Control (RBAC) for Audit Logs'>
+To secure access to audit logs, we’ve added a new Audit Log RBAC group. This ensures that only authorized users can view or retrieve sensitive log information. Administrators can assign this permission as part of their security and compliance strategy.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Changed
+
+
+
+<AccordionGroup>
+<Accordion title='Removed AJV validation for Streams config editor'>
+Eliminated AJV validation in the Streams Config Editor to prevent false positives on valid YAML configurations. The frontend now solely checks the YAML structure, providing users with greater flexibility without enforcing strict Bento-specific schema rules
+</Accordion>
+
+<Accordion title='Hide unnecessary field from API Designer page for Streams'>
+Removed an unnecessary field from the API Designer page under the Streams section to enhance clarity. This update impacts the Event Handlers, Detailed Activity Logs, Caching, and Endpoints tabs.
+</Accordion>
+
+<Accordion title='Automatic configuration of request validation for path-level parameters during import of OpenAPI description'>
+Tyk will now detect path-level parameters in the OpenAPI description and can be set to enable and configure the [Request Validation](/api-management/traffic-transformation/request-validation#request-validation-using-tyk-oas) middleware automatically for these. Previously this automatic detection only worked for method-level parameters in the OpenAPI description.
+</Accordion>
+
+<Accordion title='Deprecated SQLite support from Dashboard for RHEL8 compatibility'>
+Removed SQLite support to enhance portability and security, ensuring the released binary can now be built statically and no longer relies on system libraries. This change supports continued compatibility with RHEL8.
+</Accordion>
+
+<Accordion title='Deprecated External OAuth and OpenID Connect Options in Tyk Dashboard'>
+The External OAuth and OpenID Connect authentication options have been deprecated in the Tyk Dashboard. Users are advised to utilize JWT Auth with external IDPs for a more complete integration, while existing functionality remains operational to avoid breaking changes.
+</Accordion>
+
+<Accordion title='Updated NPM package dependencies'>
+Updated NPM package dependencies of Dashboard, to address security vulnerabilities.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed navigation issue with "Back to APIs Page" Button on Streams API page'>
+Resolved an issue where the "Back to APIs Page" button was unresponsive on the Streams API page. The button now correctly redirects users to the main APIs page for all API types.
+</Accordion>
+
+<Accordion title='Resolved search box limitation on Tyk OAS and Streams API pages'>
+Corrected an issue where the search box on the Tyk OAS and Streams API pages only accepted a single character. Users can now input complete search terms, allowing for more accurate searches.
+</Accordion>
+
+<Accordion title='Unable to see all *user groups* in Dashboard dropdown'>
+Fixed an issue with the *user group* dropdown in the Dashboard UI, ensuring that all available user groups are displayed when creating a new user.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+
+
+## 5.6 Release Notes
+
+### 5.6.1 Release Notes
+
+#### Release Date 18 October 2024
+
+#### Release Highlights
+
+This is a version bump to align with Gateway v5.6.1, no changes have been implemented in this release.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.6.1 | MDCB v2.7.1     | MDCB v2.5.1 |
+|         | Operator v1.0.0  | Operator v0.17 |
+|         | Sync v2.0    | Sync v1.4.3 |
+|         | Helm Chart v2.1  | Helm all versions |
+| | EDP v1.11 | EDP all versions |
+| | Pump v1.11 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.6.1, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.6.1)
+- ```bash
+  docker pull tykio/tyk-dashboard:v5.6.1
+  ```
+- Helm charts
+  - [Tyk Charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.6.1" data-scroll-offset></a>
+
+No changes in this release.
+
+
+---
+### 5.6.0 Release Notes
+
+#### Release Date 10 October 2024
+
+#### Release Highlights
+
+We are thrilled to announce new updates and improvements in Tyk 5.6.0, bringing more control, flexibility, and performance.  For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.6.0) below.
+
+##### Per endpoint Rate Limiting for clients
+
+Now you can configure rate limits at the [endpoint level per client](/api-management/rate-limit#key-level-rate-limiting), using new configuration options in the access key. Use [Policies](/api-management/policies) to create templates to set appropriate rate limits for your different categories of user.
+
+##### Go upgrade to 1.22
+
+We’ve upgraded the Tyk Dashboard to Golang 1.22, bringing improved performance, better security, and enhanced stability to the core system.
+
+#####  Strengthened Role-Based Access Controls (RBAC) to combat privilege escalation risks
+
+We’ve tightened up the rules that govern a user's ability to create admin users and to reset other users' passwords when using Tyk's RBAC function. Now, only super-admins can create new admins, admin roles can't be assigned to user groups, and only admin users can reset another user's password (and only within their Tyk organization).
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+
+There are no breaking changes in this release.
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.6.0 | MDCB v2.7.1     | MDCB v2.5.1 |
+|         | Operator v1.0.0  | Operator v0.17 |
+|         | Sync v2.0    | Sync v1.4.3 |
+|         | Helm Chart v2.1  | Helm all versions |
+| | EDP v1.11 | EDP all versions |
+| | Pump v1.11 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+
+We are deprecating support for SQLite, External OAuth Middleware, and OpenID Connect (OIDC) Middleware in Tyk Dashboard to simplify the platform and enhance overall performance. These changes will take effect from 5.7.0.
+
+#### Why the Change?
+
+#### SQLite
+
+While useful for testing, SQLite is not designed for production environments. By focusing on PostgreSQL and MongoDB, we can provide users with more scalable and reliable options.
+
+#### External OAuth Middleware
+
+This feature serves a similar purpose to our JWT Authentication and may lead to confusion. We recommend transitioning to JWT Authentication for a more streamlined experience.
+
+#### OpenID Connect (OIDC) Middleware 
+
+The low adoption of this option, along with its functional overlap with other supported authentication methods, prompts us to deprecate OIDC middleware to reduce complexity within the platform. We recommend users transition to JWT Authentication.
+
+
+We encourage users to switch to the recommended alternatives. For more detailed information, please refer to the [Documentation](/api-management/client-authentication#integrate-with-openid-connect-deprecated)
+
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc.
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+#### Upgrade instructions
+If you are upgrading to 5.6.0, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.6.0)
+- ```bash
+  docker pull tykio/tyk-dashboard:v5.6.0
+  ```
+- Helm charts
+  - [tyk-charts v2.1.0](/developer-support/release-notes/helm-chart#2-1-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.6.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Per endpoint client rate limiting'>
+Building on the [per-endpoint upstream rate limits](/api-management/rate-limit#api-level-rate-limiting) introduced in Tyk 5.5.0 we have now added [per-endpoint client rate limits](/api-management/rate-limit#key-level-rate-limiting). This new feature allows for more granular control over client consumption of API resources by associating the rate limit with the access key, enabling you to manage and optimize API usage more effectively.
+</Expandable>
+
+
+
+##### Changed
+
+{/* This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Upgrade to Go 1.22 for Tyk Dashboard'>
+The Tyk Dashboard has been upgraded from Golang 1.21 to Golang 1.22, bringing enhanced performance, strengthened security, and access to the latest features available in the new Golang release.
+</Accordion>
+
+<Accordion title='Improved documentation and schema for Tyk Dashboard API'>
+We have updated the swagger.yml schema for Tyk Dashboard API to reflect the latest changes in product endpoints, payloads, and responses. This update includes new fields and endpoints, improved examples, documentation adjustments, and fixes for schema issues. These enhancements aim to improve usability and ensure that the documentation accurately represents the current code state.
+</Accordion>
+
+<Accordion title='Renamed GraphQL "Playground" tab to "Playgrounds"'>
+The "Playground" tab in the GraphQL API Designer has been renamed to "Playgrounds." This change consolidates access to both internal and external playgrounds within a single section, offering a more streamlined and intuitive experience for API design and testing.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Addressed some display issues in Dashboard Analytics and Classic Portal when using PostgreSQL storage'>
+- Resolved an issue where HTTP 429 status codes were not being displayed on the Activity Overview page.
+- Fixed portal graphs by adding a default "day" grouping resolution to the query.
+- Corrected issues with the Error Breakdown related to date parameters, ensuring accurate date handling and display.
+</Accordion>
+
+<Accordion title="Dashboard didn't display correctly if more than 10 policies assigned to a key">
+We have resolved an issue where the Keys page would display a blank screen if a key was associated with more than 10 policies. The UI has been fixed to display the page properly, regardless of the number of policies attached to a key.
+</Accordion>
+
+<Accordion title='Dashboard UI did not prevent multiple versions of a Tyk Classic API from being assigned to a policy'>
+When working with Tyk Classic APIs, you cannot permit access to multiple versions of the same API from a single policy. We have fixed an issue in the Dashboard UI where users were able to attach multiple versions to a policy leading to an unusable policy. The UI now correctly prevents the addition of multiple versions of an API to a single policy.
+</Accordion>
+
+<Accordion title="Dashboard didn't correctly record scope to policy mappings for JWTs">
+We have fixed an issue in the Dashboard UI when assigning multiple claim to policy mappings while configuring JWT auth for an API. The scope name was incorrectly recorded instead of the policy ID for the second and subsequent JWT scope mappings. The UI now correctly associates the defined claim with the appropriate policy, ensuring accurate JWT scope to policy mappings.
+</Accordion>
+
+<Accordion title='Gateway logs page not displaying correctly'>
+We have fixed an issue in the Monitoring section of the Dashboard UI where the *Gateway logs* page was not displaying correctly. The page is now rendered properly, ensuring users with appropriate permissions can view and manage *Gateway logs* as expected.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+---
+
+## 5.5 Release Notes
+
+### 5.5.2 Release Notes
+
+#### Release Date 03 October 2024
+
+#### Release Highlights
+
+This release replaces Tyk Dashboard 5.5.1 which was accidentally released as a non-distroless image.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.5.2 | MDCB v2.7     | MDCB v2.5.1 |
+|         | Operator v0.18 | Operator v0.17 |
+|         | Sync v1.5   | Sync v1.4.3 |
+|         | Helm Chart v2.0.0 | Helm all versions |
+| | EDP v1.10 | EDP all versions |
+| | Pump v1.11 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.5.2, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.5.2)
+- ```bash
+  docker pull tykio/tyk-dashboard:v5.5.2
+  ```
+- Helm charts
+  - [Tyk Charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+
+#### Changelog
+
+No changes in this release.
+
+---
+
+### 5.5.1 Release Notes
+
+#### Release Date 26 September 2024
+
+#### Release Highlights
+
+This is a version bump to align with Gateway v5.5.1, no changes have been implemented in this release.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.5.1 | MDCB v2.7     | MDCB v2.5.1 |
+|         | Operator v0.18 | Operator v0.17 |
+|         | Sync v1.5   | Sync v1.4.3 |
+|         | Helm Chart v2.0.0 | Helm all versions |
+| | EDP v1.10 | EDP all versions |
+| | Pump v1.11 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.5.1, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.5.1)
+- ```bash
+  docker pull tykio/tyk-dashboard:v5.5.1
+  ```
+- Helm charts
+  - [Tyk Charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.5.1" data-scroll-offset></a>
+
+No changes in this release.
+
+---
+
+### 5.5.0 Release Notes
+
+#### Release Date 12 August 2024
+
+#### Release Highlights
+
+We are excited to announce Tyk Dashboard 5.5, featuring a brand-new dashboard identity, advanced rate-limiting capabilities, and enhanced security options. For a comprehensive list of changes, please refer to the [changelog](#Changelog-v5.5.0) below.
+
+##### New Tyk brand identity
+
+Experience a refreshed and modern look with our updated brand identity. The new design enhances usability and provides a cleaner, more intuitive interface for managing your APIs.
+
+##### Per Endpoint Rate Limiting
+
+Now configure rate limits at the endpoint level for both [Tyk OAS](/api-management/rate-limit#tyk-oas-api-definition) and [Tyk Classic APIs](/api-management/rate-limit#tyk-classic-api-definition), providing granular protection for upstream services against overloading and abuse.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+
+There are no breaking changes in this release.
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.5.0 | MDCB v2.7     | MDCB v2.5.1 |
+|         | Operator v0.18 | Operator v0.17 |
+|         | Sync v1.5   | Sync v1.4.3 |
+|         | Helm Chart v1.6 | Helm all versions |
+| | EDP v1.10 | EDP all versions |
+| | Pump v1.11 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc.
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+#### Upgrade instructions
+If you are upgrading to 5.5.0, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.5.0)
+- ```bash
+  docker pull tykio/tyk-dashboard:v5.5.0
+  ```
+- Helm charts
+  - [tyk-charts v1.6](/developer-support/release-notes/helm-chart#1-6-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.5.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Configure the new endpoint level rate limits in API Designer'>
+Rate limits can now be configured at the endpoint level in Tyk OAS and Tyk Classic API definitions. Configure these new more granular controls from the API Designer.
+</Accordion>
+
+<Accordion title='Improved handling of requests to non-existent versions of APIs when using URL path versioning'>
+When configuring API versioning settings for Tyk OAS APIs, you can now set a *Version Identifier Pattern* when using the URL path to indicate the API version (for example `/v1/my-api`). This will be used to avoid accidentally stripping part of the target URL (and failed upstream proxy) if the client doesn't provide any version identifier. If you're using Tyk Classic APIs you can set the `url_versioning_pattern` field in the API definition using the raw API editor.
+</Accordion>
+
+<Accordion title='Improved schema editor functionality for GQL APIs'>
+We've expanded the functionality of the schema editor for GQL APIs. Users can now easily import their schema from a file, export it, or quickly clean the entire editor if a mistake is made.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Changed
+
+
+
+<Expandable title='Updated NPM packages dependencies'>
+Updated npm package dependencies of Dashboard, to address security vulnerabilities.
+</Expandable>
+
+
+
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Resolved an issue seen when using reponse plugins with Tyk OAS APIs'>
+Addressed a problem where Response Plugins were not being invoked for Tyk OAS APIs.
+</Accordion>
+
+<Accordion title='Save API button now visible for SSO users'>
+Addressed an issue for SSO users where user permissions were not correctly applied. This led to the Save API button not being visible to all appropriate users in the API Designer.
+</Accordion>
+
+<Accordion title='Public playground schema exposure fixed with Introspection disabled'>
+Resolved an issue where the Public GQL Playground displayed schema information despite introspection being turned off. Now, schema details are hidden unless valid authentication credentials are provided, ensuring a secure and consistent user experience.
+</Accordion>
+
+<Accordion title='Resolved issue with no analytics data showing on Endpoint Popularity page'>
+Addressed an issue where the Dashboard displayed a blank pane when accessing the Activity by Endpoint page after upgrading to Tyk 5.3.1.
+</Accordion>
+</AccordionGroup>
+ 
+
+
+##### Security Fixes
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Dashboard, providing increased protection against security vulnerabilities:
+- [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
+- [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
+</Expandable>
+
+
+
+---
+
+## 5.4 Release Notes
+### 5.4.0 Release Notes
+#### Release Date 2 July 2024
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+**Attention: Please read this section carefully**
+There are no breaking changes in this release.
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.4.0 | MDCB v2.6.0     | MDCB v2.5.1 |
+|         | Operator v0.18 | Operator v0.17 |
+|         | Sync v1.5.0   | Sync v1.4.3 |
+|         | Helm Chart v1.5.0 | Helm all versions |
+| | EDP v1.10.0 | EDP all versions |
+| | Pump v1.10.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc.
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+#### Upgrade instructions
+If you are upgrading to 5.4.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+Add upgrade steps here if necessary.
+
+#### Release Highlights
+
+We're thrilled to introduce exciting enhancements in Tyk Dashboard 5.4, aimed at improving your experience with Tyk Dashboard. For a comprehensive list of changes, please refer to the change log below.
+
+#### Event handling for Tyk OAS APIs
+
+We’ve added support for you to register webhooks with your Tyk OAS APIs so that you can handle events triggered by the Gateway, including circuit breaker and quota expiry. You can also assign webhooks to be fired when using the new smoothing rate limiter to notify your systems of ongoing traffic spikes. For more details see the [documentation](/api-management/gateway-events#event-handling-with-webhooks).
+
+#### Enhanced Header Handling in GraphQL APIs
+
+Introduced a features object in API definitions for GQL APIs, including the `use_immutable_headers` attribute. This allows advanced header control, enabling users to add new headers, rewrite existing ones, and selectively remove specific headers. Existing APIs will have this attribute set to `false` by default, ensuring no change in behavior. For new APIs, this attribute is true by default, facilitating smoother migration and maintaining backward compatibility.
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.4.0)
+- ```bash
+  docker pull tykio/tyk-dashboard:v5.4.0
+  ```
+- Helm charts
+  - [tyk-charts v1.5](/developer-support/release-notes/helm-chart#1-5-0-release-notes)
+
+#### Changelog
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Introduced Rate Limit Smoothing for Redis Rate Limiter'>
+Implemented a [rate limit smoothing mechanism](/api-management/rate-limit#rate-limit-smoothing) to gradually adjust the rate limit as the request rate increases and decreases between an intermediate threshold and the maximum rate limit. New `RateLimitSmoothingUp` and `RateLimitSmoothingDown` events will be triggered as this smoothing occurs, supporting auto-scaling of upstream capacity. The smoothing process gradually increases the rate, thereby unblocking clients that exceed the current request rate in a staggered manner.
+</Accordion>
+
+<Accordion title='Updated API designer toolbar for GraphQL and Universal Data Graph'>
+Revamped the API designer toolbar for GraphQL and Universal Data Graph, consolidating all relevant actions for each API type under a single menu dropdown for improved usability.
+</Accordion>
+
+<Accordion title='Updated API designer toolbar for HTTP and TCP'>
+Revamped the API designer toolbar for HTTP and TCP, consolidating all relevant actions for each API type under a single menu dropdown for improved usability.
+</Accordion>
+
+<Accordion title='New Tyk OAS features'>
+We’ve added some more features to the Tyk OAS API, moving closer to full parity with Tyk Classic. In this release we’ve added controls that allow you: to enable or prevent generation of traffic logs at the API-level; to enable or prevent the availability of session context to middleware and to pin public key certificates to an API. We’ve also added the facility to register webhooks that will be fired in response to Gateway events.
+</Accordion>
+
+<Accordion title='New Dashboard API endpoints'>
+We have added a new `/oas/dry-run` endpoint to the Tyk Dashboard API. This uses the Dashboard’s logic to create or update a Tyk OAS API definition using an OpenAPI document without instantiating the API on the Tyk platform.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Fixed template inheritance issue in API Designer'>
+Resolved a bug in the API Designer where certain properties, such as `use_immutable_headers`, were not correctly inherited from the new API template. This fix ensures all default settings from the template are properly applied when creating a new API.
+</Accordion>
+
+<Accordion title='Corrected assignment issue for API Templates in Tyk organizations'>
+Fixed an issue where API Templates were not correctly assigned to Tyk Organizations, preventing potential accidental sharing of secret data between Organizations through the use of incorrect templates.
+</Accordion>
+
+<Accordion title='Addressed keyboard shortcut issues in Universal Data Graph URL field configuration'>
+Fixed an issue where common keyboard shortcuts (Cmd + X, A, C, V) were not functioning correctly when configuring the URL field for a UDG data source.
+</Accordion>
+
+<Accordion title='Streamlined data source import endpoint in Dashboard API'>
+Improved the data source import endpoint in the Dashboard API by removing the need for users to convert OpenAPI/AsyncAPI documents into strings before submission. Users can now provide the documents directly, enhancing the overall user experience.
+</Accordion>
+
+<Accordion title='Enhanced password reset security'>
+Modified default OPA rules to fix an issue where admins were unable to reset their own password. Tyk Dashboard clients using custom OPA rules should update their rule set accordingly. Contact your assigned Tyk representative for assistance.
+</Accordion>
+
+<Accordion title='Corrected filtering for Dashboard Analytics with PostgreSQL'>
+Addressed an issue in the api/usage endpoint where Dashboard analytics with PostgreSQL returned unfiltered results. The endpoint now correctly filters results, eliminating the need for duplicating parameters to handle multiple tags.
+</Accordion>
+
+<Accordion title='Minor Dashboard UI fixes and improvements'>
+We have made some improvements to the wording used in the Dashboard user interface and fixed some minor usability issues.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Security Fixes
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Dashboard, providing increased protection against security vulnerabilities:
+- [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
+- [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
+</Expandable>
+
+
+
+---
+{/*  */}
+
+
+## 5.3 Release Notes
+
+### 5.3.13 Release Notes
+
+#### Release Date 18 May 2026
+
+#### Release Highlights
+
+This release resolves a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an **unlimited node license**, where mass registrations or rolling upgrades could leave Gateways stuck in registration loops.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.13) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.13 | MDCB v2.11.0     | MDCB v2.11.0 |
+|         | Operator v1.4.0  | Operator v0.17 |
+|         | Sync v2.1.6    | Sync v2.1.0 |
+|         | Helm Chart v5.2  | Helm all versions |
+| | EDP v1.17.3 | EDP all versions |
+| | Pump v1.13.3| Pump all versions |
+| | TIB (if using standalone) v1.7.1 | TIB all versions |
+
+##### Third-party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.24       | 1.24       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | Used by Tyk Dashboard | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | Used by Tyk Dashboard | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.3.13, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.13)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.3.13
+    ```
+
+- Helm charts
+  - [tyk-charts v5.2.0](/developer-support/release-notes/helm-chart#5-2-0-release-notes)
+
+<Note>
+Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.3.13.
+</Note>
+
+#### Changelog
+<a id="Changelog-v5.3.13"></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated Tyk Dashboard to Golang 1.24'>
+Updated the Tyk Dashboard to use Golang 1.24, reducing exposure to potential security vulnerabilities in older versions.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Resolve Gateway registration failures at scale on unlimited node licenses'>
+We have resolved a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an **unlimited node license**. During mass registrations or rolling upgrades, a combination of lock contention, excessive Redis load, and incorrect handling of `409 Conflict` responses could leave Gateways stuck in registration loops without the credentials needed to serve traffic.
+
+Gateway registration is now significantly more robust at scale: registration requests are no longer serialized across the fleet, Gateways recover cleanly from transient `409 Conflict` responses instead of looping, and the Redis load generated during registration storms is substantially reduced.
+
+
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41248" target="_blank">CVE-2021-41248</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44906" target="_blank">CVE-2021-44906</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+### 5.3.12 Release Notes
+
+#### Release Date 12th September 2025
+
+#### Release Highlights
+
+This is a version bump to align with Gateway v5.3.12, no changes have been implemented in this release.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.12 | MDCB v2.8.4     | MDCB v2.8.0 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0| Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.23       | 1.23       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | Used by Tyk Dashboard | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | Used by Tyk Dashboard | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.3.12, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.12)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.3.12
+    ```
+
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.12" data-scroll-offset></a>
+
+No changes in this release.
+
+---
+
+### 5.3.11 Release Notes
+
+#### Release Date 7 May 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.11) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.11 | MDCB v2.8.0     | MDCB v2.8.0 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0| Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.23       | 1.23       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.3.11, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.11)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.3.11
+    ```
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.11" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='License allocation now works across multiple dashboards'>
+Fixed an issue where the Dashboard might not allow the correct number of Gateways to connect. This was due to a conflict with license management in deployments with multiple Dashboards which has now been resolved.
+</Accordion>
+
+<Accordion title='Improved Control for Dashboard API Credentials'>
+Users can now always access their own Dashboard API credentials, regardless of permissions. Admins’ ability to view or reset other users’ credentials is now strictly controlled by security flags
+</Accordion>
+
+<Accordion title='Enhanced OPA Rules for Token Reset and User Data Access'>
+Updated OPA rules in the Dashboard to allow all users to reset their access tokens and view their user data, improving self-service while maintaining security.
+
+Users with custom OPA rules are <b>strongly advised</b> to add the `is_self_key_reset` and `is_me` helper rules to their configuration. They should then modify existing relevant rules to exclude cases where `is_self_key_reset` or `is_me` apply, to enable this functionality.
+</Accordion>
+
+<Accordion title='Various fixes to the Dashboard UI'>
+We have implemented various fixes and improvements in the Dashboard GUI to enhance usability.
+</Accordion>
+</AccordionGroup>
+
+
+
+#### Security Fixes 
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Dashboard, providing increased protection against security vulnerabilities:
+- [CVE-2025-46569](https://nvd.nist.gov/vuln/detail/CVE-2025-46569)
+</Expandable>
+
+
+
+### 5.3.10 Release Notes
+
+#### Release Date 19 February 2025
+
+#### Release Highlights
+
+In this release, we upgraded the Golang version to `v1.23` and fixed a [CVE-2025-21613](https://nvd.nist.gov/vuln/detail/CVE-2025-21613). For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.10) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.10 | MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments |
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- |
+| [GoLang](https://go.dev/dl/)                               | 1.23       | 1.23       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 |
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release 
+
+#### Upgrade Instructions
+If you are upgrading to 5.3.10, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.10)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.3.10
+    ```
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.10" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Upgraded to Golang 1.23'>
+Tyk Dashboard now runs on Golang 1.23, bringing security and performance improvements. Key changes include unbuffered Timer/Ticker channels, removal of 3DES cipher suites, and updates to X509KeyPair handling. Users may need to adjust their setup for compatibility.
+</Expandable>
+
+
+
+##### Security Fixes
+
+
+
+<Expandable title='Critical Priority CVEs Fixed'>
+Fixed the following critical priority CVE identified in the Dashboard UI, providing increased protection and improved security:
+    - [CVE-2025-21613](https://nvd.nist.gov/vuln/detail/CVE-2025-21613)
+</Expandable>
+
+
+<Expandable title='High Priority CVE Fixed'>
+- Fixed the following CVE:
+    - [CVE-2025-21614](https://nvd.nist.gov/vuln/detail/CVE-2025-21614)
+</Expandable>
+
+
+
+---
+
+### 5.3.9 Release Notes
+
+#### Release Date 31 December 2024
+
+#### Release Highlights
+This release contains bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.9) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.9 | MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments |
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- |
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+We have deprecated the obsolescent `http_server_options.prefer_server_ciphers` configuration option. This legacy control no longer has any effect on the underlying library and users are advised to remove this setting from their configurations.
+
+#### Upgrade Instructions
+If you are upgrading to 5.3.9, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.9)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.3.9
+    ```
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.9" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Fixed
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed Issue with Restore Zooming in API Activity Dashboard'>
+Resolved a bug where clicking "Restore zooming to initial state" in the API Activity Dashboard would cause the graph to show blank instead of resetting to the initial zoom level. This fix ensures that users can now correctly restore the default zoom state in all charts on the Dashboard.
+</Accordion>
+
+<Accordion title='Deprecation of http_server_options.prefer_server_ciphers'>
+This option has been marked as deprecated due to its obsolescence in the underlying library functions used by Tyk. Users are advised to remove this configuration from their setups as it no longer has any effect.
+</Accordion>
+
+<Accordion title='CVE-2020-8911 resolved in Tyk Dashboard'>
+Resolved CVE-2020-8911 by updating the Tyk Dashboard's email driver to use AWS SDK v2, addressing a medium-severity security vulnerability identified in version 5.3.8. This update ensures enhanced security for the Dashboard while maintaining functionality.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.3.8 Release Notes
+
+#### Release Date 07 November 2024
+
+#### Release Highlights
+This release focuses mainly on bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.8) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.8 | MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments |
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- |
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+This is an advanced notice that the dedicated External OAuth, OpenID Connect (OIDC) authentication options, and SQLite support will be deprecated starting in version 5.7.0. We recommend that users of the [External OAuth](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated) and [OpenID Connect](/api-management/client-authentication#integrate-with-openid-connect-deprecated) methods migrate to Tyk's dedicated [JWT Auth](/basic-config-and-security/security/authentication-authorization/json-web-tokens) method. Please review your API configurations, as the Gateway logs will provide notifications for any APIs utilizing these methods.
+
+#### Upgrade Instructions
+If you are upgrading to 5.3.8, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.8)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.3.8
+    ```
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.8" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+##### Added
+
+
+
+<Expandable title='Advanced notice of deprecation of dedicated External OAuth and OpenID Connect auth options'>
+The UI now displays a deprecation notice for the dedicated [External OAuth](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated) and [OpenID Connect (OIDC)](/api-management/client-authentication#integrate-with-openid-connect-deprecated) authentication mechanisms. This provides advanced notification that these authentication options will be deprecated in version 5.7.0. Users are advised to migrate to the [JWT Auth](/basic-config-and-security/security/authentication-authorization/json-web-tokens) method, which supports integration with both OAuth and OIDC providers, in preparation for future upgrade.
+</Expandable>
+
+
+
+##### Fixed
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='User Group dropdown limitations in Dashboard'>
+Fixed an issue with the user group dropdown in the Dashboard UI, ensuring that all available user groups are displayed when creating a new user.
+</Expandable>
+
+
+<Expandable title='Rate Limiting settings not saved when Upstream Certificates enabled for Tyk OAS API'>
+Fixed an issue in the Tyk OAS API Designer where Rate Limiting settings were not saved when Upstream Certificates were enabled. This fix ensures that both Rate Limits and Upstream Certificates configurations can now be saved together
+</Expandable>
+
+
+
+---
+### 5.3.7 Release Notes
+
+#### Release Date 22 October 2024
+
+#### Release Highlights
+
+This is a version bump to align with Gateway v5.3.7, no changes have been implemented in this release.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.7 | MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments |
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- |
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.3.7, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.7)
+- ```bash
+  docker pull tykio/tyk-dashboard:v5.3.7
+  ```
+- Helm charts
+  - [Tyk Charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.7" data-scroll-offset></a>
+
+No changes in this release.
+
+---
+
+### 5.3.6 Release Notes
+
+#### Release Date 04 October 2024
+
+#### Release Highlights
+
+This release primarily focuses on bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.6) below.
+
+#### Breaking Changes
+**Attention**: Please read this section carefully.
+Docker images are now based on [distroless](https://github.com/GoogleContainerTools/distroless). No shell is shipped in the image.  
+
+If moving from a version of Tyk older than 5.3.0 please read the explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+When upgrading to 5.3.6, please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+With MongoDB 4.4 reaching [EOL](https://www.mongodb.com/legal/support-policy/lifecycles) in February 2024, we can no longer guarantee full compatibility with this version of the database. If you are [using MongoDB](/planning-for-production/database-settings#mongodb) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.6).
+
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.6).
+
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.6 | MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.3.6"></a>
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments |
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- |
+| [GoLang](https://go.dev/dl/)                               | 1.22       | 1.22       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.6)
+ - ```bash
+   docker pull tykio/tyk-dashboard:v5.3.6
+   ```
+- Helm charts
+ - [tyk-charts v2.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.6" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Changed
+{/* This should be a bullet-point list of updated features. Explain:
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Upgrade to Go 1.22 for Tyk Dashboard'>
+The Tyk Dashboard has been upgraded from Golang 1.21 to Golang 1.22, bringing enhanced performance, strengthened security, and access to the latest features available in the new Golang release.
+</Expandable>
+
+
+ <Expandable title='Introducing Distroless Containers for Tyk Dashboard (2024 LTS)'>
+In this release, we've enhanced the security of the Tyk Dashboard image by changing the build process to support [distroless](https://github.com/GoogleContainerTools/distroless) containers. This significant update addresses critical CVEs associated with Debian, ensuring a more secure and minimal runtime environment. Distroless containers reduce the attack surface by eliminating unnecessary packages, which bolsters the security of your deployments.
+</Expandable>
+ 
+
+
+##### Fixed
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Gateway secret could be exposed in debug logs'>
+Resolved an issue where the Gateway secret was inadvertently included in the log generated by the Dashboard for a call to the `/api/keys` endpoint when in debug mode. This issue has been fixed to prevent sensitive information from appearing in system logs.
+</Accordion>
+
+<Accordion title="Dashboard didn't display correctly if more than 10 policies assigned to a key">
+We have resolved an issue where the Keys page would display a blank screen if a key was associated with more than 10 policies. The UI has been fixed to display the page properly, regardless of the number of policies attached to a key.
+</Accordion>
+
+<Accordion title='Dashboard UI did not prevent multiple versions of a Tyk Classic API from being assigned to a policy'>
+When working with Tyk Classic APIs, you cannot permit access to multiple versions of the same API from a single policy. We have fixed an issue in the Dashboard UI where users were able to attach multiple versions to a policy leading to an unusable policy. The UI now correctly prevents the addition of multiple versions of an API to a single policy.
+</Accordion>
+
+<Accordion title="Dashboard didn't correctly record scope to policy mappings for JWTs">
+We have fixed an issue in the Dashboard UI when assigning multiple claim to policy mappings while configuring JWT auth for an API. The scope name was incorrectly recorded instead of the policy ID for the second and subsequent JWT scope mappings. The UI now correctly associates the defined claim with the appropriate policy, ensuring accurate JWT scope to policy mappings.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Security Fixes
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high-priority CVEs identified in the Tyk Dashboard, providing increased protection against security vulnerabilities:
+- [CVE-2024-6104](https://nvd.nist.gov/vuln/detail/CVE-2024-6104)
+</Expandable>
+
+   
+
+
+---
+
+### 5.3.5 Release Notes
+
+
+#### Release Date 26 September 2024
+
+
+#### Release Highlights
+
+This is a version bump to align with Gateway v5.3.5, no changes have been implemented in this release.
+
+#### Breaking Changes
+
+**Attention**: Please read this section carefully.
+
+There are no breaking changes in this release, however, if moving from a version of Tyk older than 5.3.0 please read the explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+
+#### Upgrade Instructions
+
+When upgrading to 5.3.5, please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+With MongoDB 4.4 reaching [EOL](https://www.mongodb.com/legal/support-policy/lifecycles) in February 2024, we can no longer guarantee full compatibility with this version of the database. If you are [using MongoDB](/planning-for-production/database-settings#mongodb) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.5).
+
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.5).
+
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.5| MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.3.5"></a>
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments |
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- |
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.5)
+ - ```bash
+   docker pull tykio/tyk-dashboard:v5.3.5
+   ```
+- Helm charts
+ - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.5" data-scroll-offset></a>
+
+ No changes in this release.
+
+---
+
+### 5.3.4 Release Notes
+
+#### Release Date August 26 2024
+
+#### Breaking Changes
+**Attention**: Please read this section carefully.
+There are no breaking changes in this release, however, if moving from a version of Tyk older than 5.3.0 please read the explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+When upgrading to 5.3.4 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+
+#### Release Highlights
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.4) below.
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+With MongoDB 4.4 reaching [EOL](https://www.mongodb.com/legal/support-policy/lifecycles) in February 2024, we can no longer guarantee full compatibility with this version of the database. If you are [using MongoDB](/planning-for-production/database-settings#mongodb) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.3).
+
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.3).
+
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.4 | MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.4.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments |
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- |
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.4)
+ - ```bash
+   docker pull tykio/tyk-dashboard:v5.3.4
+   ```
+- Helm charts
+ - [tyk-charts v1.4](/developer-support/release-notes/helm-chart#1-4-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.4" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Fixed
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Fixed display issue for API stats'>
+Fixed API’s stats not being shown when adding 2 or more tags in the Activity page and using Postgres
+</Accordion>
+
+<Accordion title='Fixed display issue of 429 status codes on the Activity page'>
+Fixed 429 status codes not being shown on the Activity page when using Postgres
+</Accordion>
+
+<Accordion title='Fixed display of graphs and requests counter on Portal'>
+Fixed wrong graphs and incorrect requests counter on Portal when using Postgres
+</Accordion>
+
+<Accordion title='Fixed Error Breakdown display issues with dates'>
+Fixed Error Breakdown issues with dates (it was showing errors that happened on different dates than the one that was actually displayed)
+</Accordion>
+</AccordionGroup>
+
+
+   
+---
+### 5.3.3 Release Notes
+
+#### Release Date August 2nd 2024
+
+#### Breaking Changes
+**Attention**: Please read this section carefully.
+There are no breaking changes in this release, however, if moving from a version of Tyk older than 5.3.0 please read the explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+When upgrading to 5.3.3 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+#### Release Highlights
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.3) below.
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+With MongoDB 4.4 reaching [EOL](https://www.mongodb.com/legal/support-policy/lifecycles) in February 2024, we can no longer guarantee full compatibility with this version of the database. If you are [using MongoDB](/planning-for-production/database-settings#mongodb) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.3).
+
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.3).
+
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.3 | MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.4.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.3.3"></a>
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments |
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- |
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.3)
+ - ```bash
+   docker pull tykio/tyk-dashboard:v5.3.3
+   ```
+- Helm charts
+ - [tyk-charts v1.4](/developer-support/release-notes/helm-chart#1-4-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.3" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Corrected ordering of Tyk OAS API paths to prevent Middleware misapplication'>
+Fixed an issue where nested API endpoints, such as '/test' and '/test/abc', might incorrectly apply middleware from the parent path to the nested path. The fix ensures that API endpoint definitions are correctly ordered, preventing this middleware misapplication and ensuring both the HTTP method and URL match accurately.
+</Expandable>
+
+
+
+---
+
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Save API button now visible for all users'>
+Addressed an issue in SSO where user permissions were not correctly applied, ensuring the Save API button is visible to all users in the Dashboard UI.
+</Accordion>
+
+<Accordion title='Dashboard blank page issue when retrieving key for API with mTLS and dynamic JWT Auth fixed'>
+Resolved a bug causing the Dashboard UI to display a blank page when creating a key for an API using static mTLS with dynamic JWT authentication.
+</Accordion>
+
+<Accordion title='Empty Endpoint popularity page issue resolved in version 5.3.1'>
+Addressed an issue where the Dashboard displayed an empty page when accessing Activity by Endpoint information after upgrading to Tyk 5.3.1. Users can now see all necessary information.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.3.2 Release Notes
+
+
+#### Release Date 5th June 2024 
+
+
+#### Breaking Changes
+**Attention**: Please read this section carefully.
+
+
+There are no breaking changes in this release, however if moving from a version of Tyk older than 5.3.0 please read the explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+
+#### Deprecations
+There are no deprecations in this release.
+
+
+#### Upgrade Instructions
+When upgrading to 5.3.2 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+
+#### Release Highlights
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.2) below.
+
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+
+3rd party dependencies and tools */}
+
+
+With MongoDB 4.4 reaching [EOL](https://www.mongodb.com/legal/support-policy/lifecycles) in February 2024, we can no longer guarantee full compatibility with this version of the database. If you are [using MongoDB](/planning-for-production/database-settings#mongodb) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.2).
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.2).
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.2 | MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.4.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.3.2"></a>
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments |
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- |
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Dashboard |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | Used by Tyk Dashboard |
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | Used by Tyk Dashboard | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x LTS        | 12.x - 16.x            | Used by Tyk Dashboard |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.2)
+  - ```bash
+    docker pull tykio/tyk-dashboard:v5.3.2
+    ```
+- Helm charts
+  - [tyk-charts v1.4](/developer-support/release-notes/helm-chart#1-4-0-release-notes)
+
+
+#### Changelog
+<a id="Changelog-v5.3.2" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Fixed Dashboard Analytics for PostgreSQL'>
+Resolved an issue in the `api/usage` endpoint where the Dashboard with PostgreSQL integration returned unfiltered results when one valid tag was used. Corrected the need for duplicating the same parameter as a workaround for filtering by multiple tags. Results are now properly filtered as expected, improving the accuracy and reliability of analytics data.
+</Accordion>
+
+<Accordion title='Enhanced Password Reset security'>
+Modified default OPA rules to prevent unauthorized admins from modifying other admins' passwords, mitigating potential 'rogue admin' behavior. Tyk Dashboard clients using custom OPA rules should update their rule set accordingly. Contact your assigned Tyk representative for assistance.
+</Accordion>
+
+<Accordion title='Fixed Universal Data Graph Schema Editor Import Issue'>
+Resolved an issue in the GQL schema editor for Data Graphs, where users couldn't utilize the 'Import Schema' button. Now, it's possible to import files containing GQL schemas into the Dashboard.
+</Accordion>
+
+<Accordion title='Enhanced Dashboard UI language'>
+Adjusted wording in Tyk's Dashboard UI to ensure inclusivity and clarity, removing any potentially oppressive language.
+</Accordion>
+
+<Accordion title='API Template not associated with Tyk Organization'>
+Fixed an issue where API Templates were not correctly assigned to Tyk Organizations allowing the potential for accidental sharing of secret data between Organizations through use of the incorrect template.
+</Accordion>
+
+<Accordion title='Added control over access to context variables from middleware when using Tyk OAS APIs'>
+Addressed a potential issue when working with Tyk OAS APIs where request context variables are automatically made available to relevant Tyk and custom middleware. We have introduced a control in the Tyk OAS API definition to disable this access if required.
+</Accordion>
+
+<Accordion title='Resolved PostgreSQL Dashboard Analytics issue'>
+Fixed an issue in the api/usage endpoint where Dashboard+Postgres returned unfiltered results with one valid tag, requiring duplication of the parameter as a workaround for multiple tags. Analytics now correctly filter results as expected.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.3.1 Release Notes
+
+#### Release Date 24 April 2024
+
+#### Breaking Changes
+**Attention**: Please read this section carefully.
+
+There are no breaking changes in this release, however if moving from a version of Tyk older than 5.3.0 please read the explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+When upgrading to 5.3.1, please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+
+#### Release Highlights
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.1) below.
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+With MongoDB 4.4 reaching [EOL](https://www.mongodb.com/legal/support-policy/lifecycles) in February 2024, we can no longer guarantee full compatibility with this version of the database. If you are [using MongoDB](/planning-for-production/database-settings#mongodb) we recommend that you upgrade to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.1).
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.1 | MDCB v2.5.1     | MDCB v2.5.1 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.3.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.3.1"></a>
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | | 
+| [DocumentDB](https://aws.amazon.com/documentdb/)  | 4, 5  | 4, 5  | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 11.x - 15.x        | 11.x - 15.x            | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.1)
+- ```bash
+  docker pull tykio/tyk-dashboard:v5.3.1
+  ```
+- Helm charts
+  - [tyk-charts v1.3](/developer-support/release-notes/helm-chart#1-3-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v5.3.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Improved security: user search method transitioned to POST'>
+Improved the behavior of the Dashboard when searching for users to avoid transmitting sensitive information (user email addresses) in the request query parameters. Deprecated the `GET` method for the `/api/users/search` endpoint in favor of a `POST` method with the same logic but with parameters supplied in the request body.
+</Accordion>
+
+<Accordion title='Improved security: removal of Access-Control-Allow-Credentials header'>
+As Tyk Dashboard and Tyk Classic Portal do not accept cross origin requests we have removed the `Access-Control-Allow-Credentials` header from Dashboard API responses to prevent any potential misuse of the header by attackers. This allows simplification of the web application's security configuration.
+</Accordion>
+
+<Accordion title='Improved security: mitigation against brute force attacks based on login response time analysis'>
+Implemented a randomised delay to obscure login response times, mitigating brute force attacks that rely on response time analysis.
+</Accordion>
+
+<Accordion title='Improved security: now unable to log into deleted Orgs'>
+Fixed a bug where a user was still able to log into an Organization on the Tyk Dashboard after that Organization had been deleted. Now, when an Organization is deleted, it will not be offered as an option when logging in.
+</Accordion>
+
+<Accordion title='Improved security: suppressed accidental exposure of access keys to stdout'>
+Fixed an issue where access keys could accidentally also be printed to the Dashboard's stdout when a call was made to `/api/keys` to retrieve the keys. This has now been suppressed.
+</Accordion>
+
+<Accordion title='Endpoint Designer does not handle wildcards in GraphQL policy allow/block lists'>
+The Endpoint Designer did not correctly display a GraphQL policy's allow or block list if a wildcard character (`*`) was used in the list's definition. This has been fixed and now, if the wildcard (`*`) is present in the allow/block list definition, the UI correctly displays the list of allowed/blocked fields.
+</Accordion>
+
+<Accordion title='Open Policy Agent editor fails to open on Windows platform'>
+Fixed an issue that was preventing the OPA editor from being visible using the keyboard shortcut when using Microsoft Windows.
+</Accordion>
+
+<Accordion title='Common keyboard shortcuts not working with UDG URL field in Data Graph Designer'>
+Fixed an issue where common keyboard shortcuts (Cmd + X, A, C, V) were not working correctly when configuring the URL field for a UDG data source.
+</Accordion>
+
+<Accordion title='Unexplained HTTP 400 error reported in Tyk OAS API Designer'>
+Fixed an issue in the Tyk OAS API Designer where there was no input validation of the OAuth Introspection URL. The Gateway reported an HTTP 400 error when attempting to save an API with an illegal value, however the API Designer did not guide the user to the source of the error. Now there is automatic validation of the text entered in the Introspection URL field.
+</Accordion>
+
+<Accordion title='Replaced the text editor used in Tyk Dashboard to address cursor issues'>
+Fixed an issue with the text editor in the Tyk OAS API Designer where the cursor was misaligned with where characters would be entered. We have replaced the text editor module throughout the Tyk Dashboard to use a more modern, supported library.
+</Accordion>
+
+<Accordion title='Activity by Graph chart sometimes had display issues'>
+The 'Top 5 Errors by Graph' bar chart in the Activity by Graph dashboard experienced display issues with long graph names and sometimes showed empty bars. This has been resolved, and the chart now displays accurately.
+</Accordion>
+
+<Accordion title='Analytics screens fail when too many requests are aggregated'>
+Fixed a bug where some Tyk Dashboard analytics screens stopped working when the analytics aggregates collection grew too large.
+</Accordion>
+
+<Accordion title='Unable to delete APIs from DocumentDB storage'>
+In [Tyk 5.2.2](#Changelog-v5.2.2) we fixed an issue when using MongoDB and Tyk Security Policies where Tyk could incorrectly grant access to an API after that API had been deleted from the associated policy. This introduced an unintended side-effect for users of DocumentDB such that they were unable to delete APIs from the persistent storage. We identified that this was due to the use of the `$expr` operator in the solution - and discovered that this is supported by MongoDB but not by DocumentDB. We have now reimplemented the fix and removed the limitation introduced for DocumentDB users.
+</Accordion>
+
+<Accordion title='Unable to clear the API cache in distributed data plane Gateways from the control plane Dashboard'>
+Addressed a bug where clearing the API cache from the Tyk Dashboard failed to invalidate the cache in distributed data plane gateways.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.3.0 Release Notes
+
+#### Release Date 5 April 2024
+
+#### Deployment Options for Tyk Dashboard
+
+##### Tyk Cloud
+Tyk Dashboard 5.3.0 is available on Tyk Cloud since 5th April 2024.
+
+##### Self-Managed
+This release is ready for installation on your own infrastructure.
+
+#### Breaking Changes
+
+**Attention: Please read this section carefully.**
+
+##### Tyk OAS APIs Compatibility Caveats
+<a id="TykOAS-v5.3.0"></a>
+
+This upgrade transitions Tyk OAS APIs out of [Early Access](/developer-support/release-types/early-access-feature).
+
+- **Out of Early access**
+  - This means that from now on, all Tyk OAS APIs will be backwards compatible and in case of a downgrade from 5.3.X to 5.3.0, the Tyk OAS API definitions will always work.
+- **Not Backwards Compatible**
+  - Tyk OAS APIs in Tyk Dashboard v5.3.0 are not [backwards compatible](https://tinyurl.com/3xy966xn). This means that the new Tyk OAS API format used by Tyk Gateway/Dashboard v5.3.X does not work with older versions of Tyk Gateway/Dashboard, i.e. you cannot export these API definitions from a v5.3.X Tyk Dashboard and import to an earlier version.
+  - The upgrade of Tyk OAS API definitions is **not reversible**, i.e. you cannot use version 5.3.X Tyk OAS API definitions with an older version of Tyk Dashboard.
+  - This means that if you wish to downgrade or revert to your previous version of Tyk, you will need to restore these API definitions from a backup. Please go to the [backup](#upgrade-instructions) section for detailed instructions on backup before upgrading to v5.3.0.
+  - When using MongoDB as your persistent data store, Tyk OAS APIs from v5.3.0 require a minimum version of MongoDB 5.0.
+  - If you are not using Tyk OAS APIs, Tyk will maintain backward compatibility standards.
+- **Not Forward Compatible**
+  - Tyk OAS API Definitions prior to v5.3.0 are not [forward compatible](https://tinyurl.com/t3zz88ep) with Tyk Gateway v5.3.X.
+  - This means that any Tyk OAS APIs created in any previous release (4.1.0-5.2.x) cannot work with the new Tyk Dashboard v5.3.X without being migrated to its latest format.
+- **MDCB deployment and Tyk OAS APIs**
+  - Tyk OAS APIs created in Tyk v5.3.0 will not be loaded by the data plane gateways if you are using MDCB v2.4 or older. This means that MDCB users already working with Tyk OAS APIs **must wait for the release of MDCB v2.5** before upgrading Tyk Gateway and Dashboard to v5.3.0. 
+  - Tyk Dashboard v5.3.0 managing Tyk OAS APIs requires Tyk Gateway v5.3.0 and MDCB v2.5.X for proper functionality. Older versions of Tyk Gateway may experience compatibility issues with Tyk OAS API definitions from v5.3.0.
+- **After upgrade (the good news)**
+  - If you had a Tyk OAS API prior to v5.3.0 then Tyk Dashboard will automatically update the API definition to latest format.
+  - This means that you do not have to do anything to make your Tyk OAS APIs compatible with the new 5.3.0 release as Tyk Dashboard will take care of that during start-up.
+  - As mentioned above, this upgrade of Tyk OAS API definitions is irreversible.
+  
+**Important:** Please go to the [backup](#upgrade-instructions) section for essential instructions on how to backup before upgrading to v5.3.0
+ 
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+With MongoDB 4.4 reaching [EOL](https://www.mongodb.com/legal/support-policy/lifecycles) in February 2024, we can no longer guarantee full compatibility with this version of the database and recommend upgrading to a version that we have tested with, as indicated [below](#3rdPartyTools-v5.3.0).
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Dashboard Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.0 | MDCB v2.5     | MDCB v2.5 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.3.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.3.0"></a>
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x  | 5.0.x, 6.0.x, 7.0.x  | Used by Tyk Dashboard | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 11.x - 15.x LTS        | 11.x - 15.x            | Used by Tyk Dashboard | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+
+**The following steps are essential to follow before upgrading**
+
+1. For Self Managed deployments - Backup Your environment using the [usual guidance](/developer-support/upgrading#tyk-upgrade-guides-for-different-deployment-models) documented with every release (this includes backup config file and database).
+2. For all deployments - Backup all your API definitions (Tyk OAS API and Classic Definitions):
+   - For Tyk Cloud deployments - To perform the backup please use our guide for [exporting APIs and policies](/developer-support/upgrading#backup-apis-and-policies).
+   - For Self-Managed deployments -  To perform the backup please use [Tyk Sync](/api-management/automations/sync).
+4. Performing the upgrade - For all deployments, follow the instructions in the [upgrade guide](#upgrading-tyk) when upgrading Tyk.
+
+#### Release Highlights
+
+We are excited to announce the release of 5.3.0, packed with new features, improvements and bug fixes to enhance your experience with Tyk Dashboard. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.0) below.
+
+##### Tyk OAS Feature Maturity
+
+Tyk OAS is now out of [Early Access](/developer-support/release-types/early-access-feature) as we have reached feature maturity. You are now able to make use of the majority of Tyk's features from your Tyk OAS APIs, so they are a credible alternative to the legacy Tyk Classic APIs.
+From Tyk 5.3.0 we support the following features when using Tyk OAS APIs with Tyk Dashboard:
+- Security
+    - All Tyk-supported client-gateway authentication methods including custom auth plugins
+    - Automatic configuration of authentication from the OpenAPI description
+    - Gateway-upstream mTLS
+    - CORS
+  
+- API-level (global) middleware including:
+    - Response caching
+    - Custom plugins for PreAuth, Auth, PostAuth, Post and Response hooks
+    - API-level rate limits
+    - Request transformation - headers
+    - Response transformation - headers
+    - Service discovery
+    - Internal API
+
+- Endpoint-level (per-path) middleware including:
+    - Request validation - headers and body (automatically configurable from the OpenAPI description)
+    - Request transformation - method, headers and body
+    - Response transformation - headers and body
+    - URL rewrite and internal endpoints
+    - Mock responses (automatically configurable from the OpenAPI description)
+    - Response caching
+    - Custom Go Post-Plugin
+    - Request size limit
+    - Virtual endpoint
+    - Allow and block listing
+    - Do-not-track
+    - Circuit breakers
+    - Enforced timeouts
+    - Ignore authentication
+
+- Observability
+    - Open Telemetry tracing
+    - Detailed log recording (include payload in the logs)
+    - Do-not-track endpoint
+
+- Governance
+    - API Versioning
+    - API Categories
+    - API Ownership
+
+##### API Templates
+
+Exclusively for Tyk OAS APIs, we are pleased to announce the introduction of API Templates: an API governance feature provided to streamline the process of creating APIs. An API template is an asset managed by Tyk Dashboard that is used as the starting point - a blueprint - from which you can create a new Tyk OAS API definition. With templates you can standardize configuration of your APIs more easily, combining your service-specific OpenAPI descriptions with enterprise requirements such as health endpoints, caching and authorization.
+
+##### Enhanced User Permissions
+
+ Introducing allow list in field-based permissions via the Dashboard specifically tailored for GraphQL APIs. Users can now define granular access control for API key holders based on types and fields from a GraphQL schema. This feature enhances security and flexibility in managing API access, providing a more tailored and secure experience for users.
+
+ ##### Global Header Management 
+
+ We've introduced global header management specifically for UDG, simplifying header configuration across all data sources. Users can now effortlessly add, adjust, and delete multiple global headers, ensuring consistency and efficiency throughout API management, ultimately saving developers time and effort
+
+##### GraphQL focused analytics
+We have made the first step towards bringing our users GraphQL-focused monitoring capabilities. Users can now gain valuable insights into error trends and usage patterns for GraphQL APIs, when storing graph analytics in SQL databases. With the addition of popularity and error bar charts, users can delve deeper into their data, facilitating optimization and troubleshooting efforts.
+
+##### Redis v7.x Compatibility
+We have upgraded Redis driver [go-redis](https://github.com/redis/go-redis) to v9. Subsequently, Tyk 5.3 is compatible with Redis v7.x.
+
+##### MongoDB v7.0.x Compatibility
+We have upgraded `mongo-go` driver to [mongo-go v1.13.1](https://github.com/mongodb/mongo-go-driver/releases/tag/v1.13.1). It allows us to benefit from the bug fixes and enhancements released by MongoDB. We have also tested that both Tyk 5.0.x+ and Tyk 5.3 are compatible with MongoDB v7.0.x.
+
+#### Downloads
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=&page_size=&ordering=&name=v5.3.0)
+- ```bash
+  docker pull tykio/tyk-dashboard:v5.3.0
+  ```
+- Helm charts
+  - [tyk-charts GH Repo](https://github.com/TykTechnologies/tyk-charts/releases)
+
+#### Changelog
+<a id="Changelog-v5.3.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Additional features now supported in Tyk OAS API Designer when working with Tyk OAS APIs'>
+The following features have been added in 5.3.0 to bring Tyk OAS to feature maturity:
+  - Detailed log recording (include payload in the logs)
+  - Enable Open Telemetry tracing
+  - API-level header transforms (request and response)
+  - Endpoint-level cache
+  - Circuit breakers
+  - Track endpoint logs for inclusion in Dashboard aggregated data
+  - Do-not-track endpoint
+  - Enforced upstream timeouts
+  - Configure endpoint as Internal (not available externally)
+  - URL rewrite
+  - Per-endpoint request size limit
+  - Request transformation - method, header
+  - Response transformation - header
+  - Custom domain certificates
+</Accordion>
+
+<Accordion title='Implemented Design Elements for GraphQL Permissions'>
+Support for field-based permissions allow list has been added in the Dashboard. Users can now define which types and fields from a GraphQL schema an API key holder can access by simply putting a tick next to them in the policy/key definition screens.
+</Accordion>
+
+<Accordion title='Added API Categories support for Tyk OAS APIs'>
+In this update, we've added support for API Categories for Tyk OAS APIs in the Tyk Dashboard, enhancing portfolio management by enabling efficient categorization and organization of APIs.
+</Accordion>
+
+<Accordion title='Added API Ownership support for Tyk OAS APIs'>
+We’ve extended the API ownership capabilities of Tyk Dashboard to Tyk OAS APIs. This feature allows you to manage visibility of APIs deployed on the Dashboard, streamlining governance processes and enhancing internal security.
+</Accordion>
+
+<Accordion title='Added API Templates for Tyk OAS APIs'>
+Extended Tyk Dashboard API to support CRUD operations on API Templates, enabling users to create, apply, and manage templates programmatically.
+
+Added Dashboard UI functionality for creation and management of API Templates, including the ability to create templates from existing Tyk OAS APIs. You can apply templates during API creation, including when importing OpenAPI documents. Access to API templates is controlled through the introduction of a new user permission.
+</Accordion>
+
+<Accordion title='Import OpenAPI Documents from File or URL'>
+Now you can import the OpenAPI description from a file or URL when creating or updating your Tyk OAS APIs.
+</Accordion>
+
+<Accordion title='Introduced Global Header Management for GraphQL'>
+Access the new Global Header Management feature directly through the Headers Management tab. Swiftly add and configure multiple global headers or remove them with a single click, ensuring they're forwarded to all GraphQL data sources. This enhancement streamlines header management, providing a more user-friendly experience.
+</Accordion>
+
+<Accordion title='Added monitoring capabilities for GraphQL APIs in the Dashboard'>
+We’ve enabled basic Graph monitoring in the Dashboard. Due to the specificity of GQL APIs, monitoring them as you would REST, is not enough. One endpoint vs multiple endpoints, multiple queries/mutations vs HTTP methods, errors that happen not only in HTTP layer but also come back in response body - that all makes monitoring GQL slightly more complex than just looking at request and error rates.
+
+A new section of the Dashboard offers the following information:
+- top 5 most popular graphs and operations requested within them within a specified period of time
+- top 5 graphs with errors within a specified period of time
+- summary of number of requests, number of successful responses, number of errors, average latency and last access date within a specified period of time for all graphs
+</Accordion>
+
+<Accordion title='Support MongoDB v7.0.x'>
+Tyk 5.3 integrates with [storage v1.2.2](https://github.com/TykTechnologies/storage), which updated mongo-go driver we use from v1.11.2 to [mongo-go v1.13.1](https://github.com/mongodb/mongo-go-driver/releases/tag/v1.13.1). It allows us to benefit from the bug fixes and enhancements released by MongoDB. We have also tested that Tyk 5.0.x+ is compatible with MongoDB v7.0.x
+</Accordion>
+
+<Accordion title='Support Redis v7.0.x'>
+Tyk 5.3 refactors Redis connection logic by using [storage v1.2.2](https://github.com/TykTechnologies/storage/releases/tag/v1.2.2), which integrates with [go-redis](https://github.com/redis/go-redis) v9. Subsequently, support now exists for Redis v7.0.x.
+</Accordion>
+</AccordionGroup>
+
+
+
+  
+##### Changed
+{/* This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Enhanced Dashboard Navigation: Introducing Favorite Screens'>
+Every Dashboard menu item can now be flagged as a favorite so that it is pinned to the top of the menu navigation bar for easier access. We've also made a few changes in styling, so that the navigation menu is nicer to look at.
+</Accordion>
+
+<Accordion title='Improved UI for GraphQL Data Source Headers Management'>
+We have moved data source header management to a separate tab, so that it is easy to configure global headers that will be forwarded to all data sources by default. The data source configuration screen displays all headers that will be sent with the upstream request in read-only mode now and changes can be made by switching to Headers Management tab.
+</Accordion>
+
+<Accordion title='Go 1.21 upgrade for Dashboard'>
+We have updated Tyk Dashboard to use Go 1.21, matching the upgrade in Tyk Gateway 1.21. Remember to recompile any custom Go plugins with the matching version of Go to avoid incompatibility problems.
+</Accordion>
+
+<Accordion title='The internal TIB session secret defaults to admin_secret if it is not set explicitly'>
+If internal TIB is enabled in Dashboard and the TYK_IB_SESSION_SECRET environment variable is not set, it will be default to Dashboard admin_secret. It provides better security and user experience because SSO flow would not work if TYK_IB_SESSION_SECRET is not set.
+</Accordion>
+
+<Accordion title='Set default MongoDB driver to mongo-go'>
+Tyk uses `mongo-go` as the default MongoDB driver from v5.3. This provides support for MongoDB 4.4.x, 5.0.x, 6.0.x and 7.0.x. If you are using older MongoDB versions e.g. 3.x, please set MongoDB driver to `mgo`. The [MongoDB supported versions](/planning-for-production/database-settings#supported-versions) page provides details on how to configure MongoDB drivers in Tyk.
+</Accordion>
+</AccordionGroup>
+
+
+ 
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Resolved OPA rule restriction on UDG OAS import endpoint'>
+We fixed an issue where OPA rules were preventing users from importing an OpenAPI document as a UDG data source using the /api/data-graphs/data-sources/import endpoint. The endpoint has now been included into the correct user permission group and will be accessible for users who have `api:write` permissions.
+</Accordion>
+
+<Accordion title='Optimized Policy Creation Endpoint'>
+Fixed an issue where applying security policies to large numbers of APIs took a long time. We’ve implemented bulk processing in the validation step at the api/portal/policies/POLICY_ID endpoint, resulting in an 80% reduction in the time taken to apply a policy to 2000 APIs.
+</Accordion>
+
+<Accordion title='Improved Security for Classic Portal'>
+Moved all HTML inline scripts to their own script files, to accommodate the content security policies that have been enabled, to increase security.
+</Accordion>
+
+<Accordion title='Errors importing larger OpenAPI Documents'>
+Fixed an issue when importing reasonably large OpenAPI documents via the Dashboard would fail due to MongoDB storage limitation of 16 MB per document.
+</Accordion>
+
+<Accordion title='Removed the need for a Description to be provided in the OpenAPI schema when autogenerating a Tyk OAS mock response'>
+Relaxed the strict validation for mock response so that the `Description` field is now optional for `response`, `responses` and `schema` within the OpenAPI description. Automatically configuring mock responses when using [Tyk OAS APIs](/api-management/traffic-transformation/mock-response#tyk-oas) is now even easier.
+</Accordion>
+
+<Accordion title='Fixed SSO flow for Classic Developer Portal'>
+For Classic Portal cookies and Dashboard, use `SameSite = SameSiteLaxMode` so that SSO flows can be performed
+</Accordion>
+
+<Accordion title='Remove unnecessary warning output from `tyk-dashboard --version`'>
+Remove the following unnecessary warning output when users use the `tyk-dashboard --version` command to check dashboard version. 
+> `WARN toth/tothic: no TYK_IB_SESSION_SECRET environment variable is set. The default cookie store is not available and any calls will fail. Ignore this warning if you are using a different store.`
+</Accordion>
+</AccordionGroup>
+  
+
+
+##### Security Fixes
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Dashboard, providing increased protection against security vulnerabilities:
+- [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
+- [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
+</Expandable>
+
+
+
+
+
+---
+
+{/*  */}
+
+
+
+
+## 5.2 Release Notes 
+### 5.2.5 Release Notes 
+
+**Release Date 19 Dec 2023**
+
+#### Breaking Changes
+
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are using a 5.2.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Release Highlights
+Dashboard 5.2.5 was version bumped only, to align with Gateway 5.2.5. Subsequently, no changes were encountered in release 5.2.5. Gateway 5.2.5 was a critical patch release. For further information please see the release notes for Gateway [v5.2.5](/developer-support/release-notes/gateway) 
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.2.5/images/sha256-c09cb03dd491e18bb84a0d9d4e71177eb1396cd5debef694f1c86962dbee10c6?context=explore)
+
+#### Changelog
+<a id="Changelog-v5.2.5" data-scroll-offset></a>
+
+Since this release was version bumped only to align with Gateway v5.2.5, no changes were encountered in this release.
+
+---
+
+
+
+---
+
+### 5.2.4 Release Notes 
+
+**Release Date 7 Dec 2023**
+
+#### Breaking Changes
+
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are using a 5.2.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Release Highlights
+This release primarily focuses on bug fixes. 
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.4) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-dashboard/v5.2.4/images/sha256-8862e98c6ffd67d47b496275b228f4f8faae4359b9c8e42bcd8bd8a47d0c45e4?context=explore)
+
+#### Changelog
+<a id="Changelog-v5.2.4" data-scroll-offset></a>
+
+##### Fixed
+
+
+ 
+ <AccordionGroup>
+<Accordion title='Poor experience when using the Open Policy Agent (OPA) editor'>
+Fixed two UI issues with the [OPA editor](/platform-management/open-policy-agent#using-the-open-policy-agent-in-the-dashboard) in the Tyk Dashboard to improve experience when using this feature. Scrolling beyond the end of the OPA window does not now start to scroll the API Designer window, and minimizing then re-expanding the OPA editor no longer limits the text to one line.
+</Accordion>
+
+<Accordion title='Annoying bugs when setting Dashboard user access controls'>
+Fixed minor issues in the Dashboard UI when configuring the user access controls for the Identity Management (TIB) and Real Time Notifications permissions.
+</Accordion>
+
+<Accordion title='Unable to select Mutual TLS version 1.3 from the API Designer dropdown'>
+Fixed an issue where TLS 1.3 was not offered as an option in the "Minimum TLS version" dropdown in the API Designer. Also we gave better (human readable) names to the options, like TLS 1.0, TLS 1.1 etc. instead of their corresponding numbers 769, 770 etc.
+</Accordion>
+
+<Accordion title='Tyk Dashboard panic when using mongo-go driver'>
+Fixed a situation where Tyk Dashboard could panic when using the mongo-go driver.
+</Accordion>
+
+<Accordion title='Confusing error message if user tries to modify Tyk OAS API using a Tyk Classic API endpoint'>
+Improved the error message that is returned when user tries to update a Tyk OAS API using a Tyk Classic API endpoint when `allow_unsafe_oas` is not enabled.
+</Accordion>
+</AccordionGroup>
+ 
+
+
+##### Added
+
+
+ 
+ <Expandable title='Implemented a `tyk version` command that provides more details about the Tyk Dashboard build'>
+This prints the release version, git commit, Go version used, architecture and other build details.
+</Expandable>
+ 
+
+
+---
+
+### 5.2.3 Release Notes 
+
+**Release Date 21 Nov 2023**
+
+#### Breaking Changes
+
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are using a 5.2.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Release Highlights
+This release primarily focuses on bug fixes. 
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.3) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-dashboard/v5.2.3/images/sha256-7d61ed3ee3f03ff0e2f91be71a9113b90ef6637b1cef1f30d4c3e04ead09fa6a?context=explore)
+
+#### Changelog
+<a id="Changelog-v5.2.3" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Unable to resize OPA editor in Tyk Dashboard'>
+Fixed an issue where the [OPA editor](/platform-management/open-policy-agent#using-the-open-policy-agent-in-the-dashboard) was not resizable. The fix ensures the floating OPA editor is now resizable and the resizing operation is smooth, improving user experience.
+</Accordion>
+
+<Accordion title='User Search not working unless you enter the full email address'>
+Fixed an issue where the [User Search](/platform-management/dashboard-users#search-users) was not working unless the full email address was entered. The fix restores the functionality of showing suggestions for names as they are typed in, improving user experience and search efficiency.
+</Accordion>
+
+<Accordion title='Dashboard 4.1.0+ cannot retrieve certificates from downrev gateways'>
+Fixed an issue where Dashboard 4.1.0+ was unable to retrieve certificates from a Tyk Gateway with a version lower than 4.1.0. This was due to a change made in the 4.1 versions relating to the way certificate details are retrieved in the dashboard; in the newer versions, we can view more details of the certificates. Now you can use Tyk Dashboard with any version of the Tyk Gateway and still retrieve and view certificate details; the fix ensures smooth staged upgrades and prevents potential issues for customers who have weeks or months between upgrading components.
+</Accordion>
+
+<Accordion title='Authentication Mode changes after changing API Protocol in API Designer'>
+Fixed an issue in the Tyk Classic API Designer where if you changed the protocol for an API (for example from HTTP to HTTPS) then the authentication mechanism would be automatically set to Authentication Token.
+</Accordion>
+
+<Accordion title='Unable to configure external OAuth flow using Raw API editor'>
+Fixed an issue in the Classic API Designer where the 'use_standard_auth' value was constantly reverting to 'true' when editing an API with an [external OAuth flow](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated). This fix ensures the 'use_standard_auth' value remains consistent, enabling the use of external OAuth via the Raw API editor.
+</Accordion>
+
+<Accordion title='If the GraphQL subscription upstream disconnects, the UI is unaware of the reconnection event'>
+Fixed an issue with failed GraphQL subscriptions between the upstream and the Dashboard. When an upstream subscription was disconnected and later reconnected, the UI did not update to reflect the reconnection, preventing the seamless consumption of messages. Now the Dashboard can continue consuming messages after upstream reconnects.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.2.2 Release Notes 
+
+**Release Date 31 Oct 2023**
+
+#### Breaking Changes
+
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are using a 5.2.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Release Highlights
+This release primarily focuses on bug fixes. 
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.2) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-dashboard/v5.2.2/images/sha256-c6e701e270ebb2fed815483723375c454d0479ae41b5be2e1a6198b8d1e1a154?context=explore)
+
+#### Changelog
+<a id="Changelog-v5.2.2" data-scroll-offset></a>
+
+##### Added
+
+
+
+<Expandable title='Added new Dashboard configuration option `allow_unsafe_oas`'>
+Added a new Dashboard configuration option `allow_unsafe_oas`. This permits the modification of Tyk OAS APIs via the Tyk Classic API endpoints. This is not a recommended action due to the risk of inconsistent behavior and potential for breaking changes while Tyk OAS is in [Early Access](/developer-support/release-types/early-access-feature). This is provided for early adopters and will be deprecated later, once Tyk OAS reaches full maturity.
+</Expandable>
+
+
+
+##### Fixed
+
+
+<AccordionGroup>
+<Accordion title='Fixed security policy grant permissions issue encountered with MongoDB'>
+Fixed an issue when using MongoDB and [Policies](/api-management/policies) where Tyk could incorrectly grant access to an API after that API had been deleted from the associated Policy. This was due to the Policy cleaning operation that is triggered when an API is deleted from a Policy in a MongoDB installation. With this fix, the Policy cleaning operation will not remove the final (deleted) API from the Policy; Tyk recognizes that the API record is invalid and denies granting access rights to the key.
+</Accordion>
+
+<Accordion title='User might not correctly inherit all permissions from their user group'>
+Fixed an issue in the Tyk Dashboard where a user might not correctly inherit all permissions from their user group, and could incorrectly be granted visibility of Identity Management.
+</Accordion>
+
+<Accordion title='Tyk would not store Policy ID in the API Definition for a policy that did not exist'>
+Fixed an issue where Tyk would not store the *Policy Id* in the *API Definition* for a policy that did not exist. When using *JWT Authentication*, the *JWT Default Policy Id* is stored in the *API Definition*. If this policy had not been created in Tyk at the time the *API Definition* was created, Tyk Dashboard would invalidate the field in the *API Definition*. When the policy was later created, there would be no reference to it from the *API Definition*. This was a particular issue when using *Tyk Operator* to manage the creation of assets on Tyk.
+</Accordion>
+
+<Accordion title='Service Uptime page did not report the number of success hits correctly'>
+Fixed an issue in the Dashboard *Service Uptime* page where the number of success hits was being incorrectly reported as the total number of hits, inclusive of failures. After this fix, the *Success Column* displays only the number of success hits.
+</Accordion>
+
+<Accordion title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Dashboard, providing increased protection against security vulnerabilities:
+
+- [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082)
+- [CVE-2022-28946](https://nvd.nist.gov/vuln/detail/CVE-2022-28946)
+- [CVE-2021-23409](https://nvd.nist.gov/vuln/detail/CVE-2021-23409)
+- [CVE-2021-23351](https://nvd.nist.gov/vuln/detail/CVE-2021-23351)
+- [CVE-2023-28119](https://nvd.nist.gov/vuln/detail/CVE-2023-28119)
+- [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698)
+- [CVE-2020-26160](https://nvd.nist.gov/vuln/detail/CVE-2020-26160)
+- [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)
+- [CVE-2010-0928](https://nvd.nist.gov/vuln/detail/CVE-2010-0928)
+- [CVE-2007-6755](https://nvd.nist.gov/vuln/detail/CVE-2007-6755)
+- [CVE-2018-5709](https://nvd.nist.gov/vuln/detail/CVE-2018-5709)
+</Accordion>
+
+<Accordion title='Azure SAML2.0 Identity Provider was preventing users from authenticating'>
+Fixed an issue encountered with *Azure SAML2.0 Identity Provider* that was preventing users from authenticating.
+</Accordion>
+
+<Accordion title='Fields defined in Uptime_Tests.Check_List were not correctly handled in API Designer'>
+Fixed an issue encountered with the *API Designer* where fields defined in *Uptime_Tests.Check_List* were not correctly handled. Uptime tests can now be configured for *Tyk Classic APIs* using the *Raw API Definition* editor.
+</Accordion>
+
+<Accordion title='Tyk Dashboard API security vulnerability'>
+Fixed a security vulnerability with the Tyk Dashboard API where the `api_version` and `api_id` query parameters were potential targets for SQL injection attack.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Updated
+
+
+
+<Expandable title="Renamed License Limit to License Entitlement on Tyk Dashboard's Licensing Statistics screen">
+On Tyk Dashboard's Licensing Statistics screen, we have renamed the License Limit to License Entitlement. We've also improved the experience when there is no limit in the license by hiding the License Entitlement line if no limit is set.
+</Expandable>
+
+
+
+---
+
+### 5.2.1 Release Notes 
+
+**Release Date 10 Oct 2023**
+
+#### Breaking Changes
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible result in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are on a 5.2.0 we advise you to upgrade ASAP and if you are on an older version skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Release Highlights
+This release primarily focuses on bug fixes. 
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.0) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-dashboard/v5.2.1/images/sha256-2f9d8af0e57f7fe4afb618dcf34772c001104dc0ec62a27541d12dc9ae90d5c8?context=explore)
+
+#### Changelog
+
+##### Added
+
+
+
+<Expandable title='Support added to Tyk Dashboard API for Tyk Sync to fully support OAS API Definitions'>
+Added support to Tyk Dashboard API so that Tyk Sync can fully support Tyk OAS API Definitions; this will be enabled from Tyk Sync version 1.4.1.
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Pagination in APIs screen was breaking for API of type GraphQL/UDG'>
+Fixed a bug in the *Tyk Dashboard* UI where pagination in the APIs screen was breaking for API of type GraphQL/UDG. This resulted in the page failing to load data and displaying a 'No data to display' message.
+</Expandable>
+
+
+
+<Expandable title='Unable to disable Add Graph Operation checkbox in the GraphQL data source configuration screen'>
+Fixed an issue where the 'Add GraphQL Operation' checkbox in the GraphQL data source configuration screen couldn't be disabled, even when no operation was added. Now, its state can be adjusted based on the presence of GraphQL operations and variables.
+</Expandable>
+
+
+
+---
+
+### 5.2.0 Release Notes 
+
+**Release Date 29 Sep 2023**
+
+#### Breaking Changes
+
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Release Highlights
+
+We're thrilled to bring you some exciting enhancements and crucial fixes to improve your experience with Tyk Dashboard. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.0) below.
+
+Configure Caching Timeouts Per API Endpoint and Enable Advanced Caching Options From Within Dashboard
+
+We’ve added the ability to [configure](/api-management/response-caching#configuring-the-middleware-in-the-tyk-oas-api-definition) per-endpoint timeouts for Tyk’s response cache, giving you increased flexibility to tailor your APIs to your upstream services. While doing this, we’ve also fixed a longstanding issue within the *Tyk Dashboard* so that you can configure more of the [advanced caching](/api-management/response-caching#configuring-the-middleware-in-the-api-designer) options from within the UI.
+
+##### Added Body Transform Middleware to Tyk OAS API Definition
+
+With this release, we are adding the much requested *Body Transformations* to *Tyk OAS API Definition*. You can now [configure](/api-management/gateway-config-tyk-oas#transformbody) middleware for both [request](/api-management/traffic-transformation/request-body) and [response](/api-management/traffic-transformation/response-body) *Body Transformations* and - as a *Tyk Dashboard* user - you’ll be able to do so from within our simple and elegant API Designer tool. Visually test and preview *Body Transformations* from within the API Designer.
+
+##### Track Usage Of License APIs, Gateways And Distributed Data Planes Over Time
+
+Within the Dashboard UI, we’ve enhanced the *Licensing* information page, so that you can visualise your usage of licensed APIs, *Gateways* and distributed *Data Planes* over time. This allows the visualisation of deployed and active APIs using a range of different types of interactive charts.
+
+
+#### Downloads
+
+Tyk Dashboard 5.2 - [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-dashboard/v5.2.0/images/sha256-28ff62e1e1208d02fec44cf84c279a5f780207ccbb7c3bdef23d1bf8fc6af3b8?context=explore)
+
+
+#### API Changes
+
+The following is a list of API changes in this release. Please visit our [Postman collection](https://www.postman.com/tyk-technologies/workspace/tyk-public-workspace/overview) for further information on our APIs.
+
+
+
+<Expandable title='Added /system/stats endpoint to provide statistics for total and active APIs deployed'>
+Added a new [endpoint](/tyk-dashboard-api), */system/stats*, to provide insight and operational statistics on total and active APIs deployed. The endpoint's flexible date filtering options, equip users to obtain comprehensive insights into usage trends.
+</Expandable>
+
+
+
+
+#### Changelog
+<a id="Changelog-v5.2.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Configure request and response body transformations'>
+Added support for API developers to easily [configure](/api-management/gateway-config-tyk-oas#transformbody) both request and response *Body Transformations* for more precise data management when working with *Tyk OAS* APIs. Define input data, craft transformation templates and test them against specific inputs for reliable customization.
+</Accordion>
+
+<Accordion title='Adding a new data source is simpler when working with UDG'>
+Adding a new [data source](/api-management/data-graph#3-configure-datasource-details) is simpler when working with *UDG*. The default value for the *data source name* is pre-filled, saving time. The *data source name* is pre-filled in the format *fieldName_typeName*, with *typeName* being the name of any GraphQL type.
+</Accordion>
+
+<Accordion title='Added /system/stats endpoint to provide statistics for total and active APIs deployed'>
+Added a new [endpoint](/tyk-dashboard-api), */system/stats*, to provide insight and operational statistics on total and active APIs deployed. The endpoint's flexible date filtering options, equip users to obtain comprehensive insights into usage trends.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Changed
+
+
+<AccordionGroup>
+<Accordion title='Saving operation is simpler when creating an API within the API Designer'>
+Improved the flow when creating an API within the *API Designer* so that you remain on the same screen after saving. This means you can continue editing without having to navigate back to the screen to make subsequent changes.
+</Accordion>
+
+<Accordion title='Saving a UDG data source is simpler and quicker'>
+Updated the [screen](/api-management/data-graph#connect-datasource) for configuring and saving *UDG* data sources. The *Save* button has been replaced with *Save & Update API* button and users no longer need to click *Update* at the top of the screen to persist changes. Saving a *UDG* data source is now simpler and quicker.
+</Accordion>
+
+<Accordion title='Enhanced API usage monitoring added to Dashboard'>
+Updated the *Dashboard* with enhanced API usage monitoring. Users now benefit from an insightful chart on the *Licensing Statistics* page, detailing: maximum, minimum and average counts of created and active APIs. Flexible date filtering, license limit reference lines and the ability to toggle between line and bar graphs empower users to monitor usage effortlessly, ensuring license adherence.
+</Accordion>
+
+<Accordion title='New chart introduced on License Statistics page to show number of deployed Data Planes'>
+A new chart has been introduced on the *License Statistics* page that presents the number of deployed *Data Planes*. This addition enables users to easily monitor their *Data Plane* usage and nearness to their contract limits.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Advanced cache config data was absent in the Raw Editor'>
+Fixed an issue where *advanced_cache_config* data was absent in the *Raw Editor*. This fix now ensures that *advanced_cache_config* can be configured. Furthermore, API modifications in the *Designer* no longer lead to data loss, safeguarding cache configuration consistency. The UI now offers a clear view of advanced cache settings, including the new *Timeout* field and *Cache* response codes fields.
+</Accordion>
+
+<Accordion title='403 errors were raised with JWT claim names containing spaces'>
+Fixed an issue with *JWT claim names* containing spaces. Previously 403 errors were raised when using tokens containing such claims.
+</Accordion>
+
+<Accordion title='Popular endpoints were not displayed in Tyk Dashboard when SQL aggregated analytics was enabled'>
+Fixed an issue where *popular endpoints* data was not displayed in *Tyk Dashboard* with *SQL aggregated analytics* enabled. Users can now view *popular endpoints* when viewing *Traffic Activity* per API or filtering by API with *SQL aggregated analytics* enabled.
+</Accordion>
+
+<Accordion title='Fixed security issue with expired certificates'>
+Fixed a potential security vulnerability where *static* or *dynamic mTLS* requests with expired certificates could be proxied upstream.
+</Accordion>
+
+<Accordion title='Users were unable to view request analytics for a specific date in the API Activity dashboard'>
+Fixed an issue in the *API Activity* dashboard where users were unable to view request analytics for a specific date. Subsequently, users can now make informed decisions based on access to this data.
+</Accordion>
+
+<Accordion title='Enforced timeout configuration parameter for an API endpoint was not validated'>
+Fixed an issue where the [Enforced Timeout](/planning-for-production/ensure-high-availability/enforced-timeouts) configuration parameter of an API endpoint accepted negative values, without displaying validation errors. With this fix, users receive clear feedback and prevent unintended configurations.
+</Accordion>
+
+<Accordion title='Duplicate APIs could be created when click save button multiple times in API Designer'>
+Fixed an issue in *Tyk Dashboard* where duplicate APIs could be created with the same names and listen paths if you clicked multiple times on the *save* button in the API Designer. Now, this is not possible anymore and there is no risk of creating multiple APIs with the same name.
+</Accordion>
+
+<Accordion title='Connection issues were encountered with MongoDB connection strings'>
+Fixed an issue with *MongoDB* connection strings. To ensure consistent compatibility with both *mgo* and *mongo-go* drivers, users should now utilize URL-encoded values within the *MongoDB* connection string's username and password fields when they contain characters like "?", "@`". This resolves the need for different handling across *MongoDB* drivers.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+## 5.1 Release Notes
+### 5.1.0 Release Notes
+
+#### Release Date 23 June 2023
+
+#### Breaking Changes
+**Attention warning*: Please read carefully this section. We have two topics to report:
+ 
+###### Golang Version upgrade
+Our Dashboard is using [Golang 1.19](https://tip.golang.org/doc/go1.19) programming language starting with the 5.1 release. This brings improvements to the code base and allows us to benefit from the latest features and security enhancements in Go. Don’t forget that, if you’re using GoPlugins, you'll need to [recompile](/api-management/plugins/golang#upgrading-your-tyk-gateway) these to maintain compatibility with the latest Gateway.
+
+###### Tyk OAS APIs
+To provide a superior experience with OAS APIs, we have made some changes which include various security fixes, improved validation etc. Upgrading to v5.1 from v4.x.x may be irreversible, rollback to v4.x.x could break your OAS API definitions. For this reason, we recommend making a database backup so you can always restore from the backup (of v4.X.X) in case you encounter a problem during the upgrade. Please refer to our guides for detailed information on [upgrading Tyk](/developer-support/upgrading) and [how to back up tyk](/developer-support/faq#tyk-configuration)
+
+#### Deprecation
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade instructions.
+
+#### Release Highlights
+
+##### Dashboard Analytics for API Ownership
+
+When we implemented Role Based Access Control and API Ownership in Tyk
+Dashboard, we unlocked great flexibility for you to assign different roles to
+different users and user groups with visibility and control over different
+collections of APIs on your Gateway. Well, from 5.1 we have added a new Role,
+which layers on top of the existing “Analytics” role and can be used to restrict
+a user’s access, within the Dashboard Analytics screens, to view only the
+statistics from APIs that they own; we’ve called this “Owned Analytics”. Due to
+the way the analytics data are aggregated (to optimize storage), a user granted
+this role will not have access to the full range of charts. Take a look at the
+documentation for a full description of this new [user role](/platform-management/user-permissions).
+
+##### Import API examples from within the Dashboard
+
+In 5.0 we introduced the possibility to import API examples manually or via
+[_Tyk Sync_](/api-management/automations/sync). We have now extended this feature and it is now possible to do this without
+leaving the Dashboard. When having an empty “Data Graphs” section you will be
+presented with 3 icon buttons with one of them offering you to import an Example
+API.
+
+If you already have Data Graphs in your Dashboard you can either click on
+the “Import” button or click on the “Add Data Graph“ button and select “Use
+example data graph“ on the next screen. The examples UI will present you with a
+list of available examples. You can navigate to the details page for every
+example and import it as well from the same page.
+
+##### Improved nested GraphQL stitching
+
+Before this release, it was only possible to implement nested GraphQL stitching
+(GraphQL data source inside another data source) by using a REST data source and
+providing the GraphQL body manually. We have now extended the GraphQL data source so
+that you can provide a custom operation and therefore access arguments or object
+data from parent data sources.
+
+To use this feature you will only need to check the “Add GraphQL operation“ checkbox when creating a GraphQL data source.
+
+##### Import UDG API from OAS 3.0.0
+
+We added a [Dashboard API Endpoint](/api-management/data-graph#automatically-creating-rest-udg-configuration-based-on-oas-specification) that is capable of taking an OAS 3.0.0 document and converting it into a UDG API.
+
+This will generate the full schema as well as the data sources that are defined inside the OAS document.
+
+##### Changed default RPC pool size for MDCB deployments
+
+We have reduced the default RPC pool size from 20 to 5. This can reduce the CPU and
+memory footprint in high throughput scenarios. Please monitor the CPU and memory
+allocation of your environment and adjust accordingly. You can change the pool
+size using [slave_options.rpc_pool_size](/tyk-oss-gateway/configuration#slave_options-rpc_pool_size)
+
+#### Downloads
+
+[docker image to pull](https://hub.docker.com/layers/tykio/tyk-dashboard/v5.1/images/sha256-8cde3c6408b9a34daa508a570539ca6cd9fcb8ee5c4790abe907eaecddc1bd9b?context=explore)
+
+
+#### Changelog
+
+##### Added
+
+- Added two endpoints to the dashboard to support the retrieval of example API definitions. One for fetching all examples and another for fetching a single example.
+- Added a way to display UDG examples from the [tyk-examples](https://github.com/TykTechnologies/tyk-examples) repository in the Dashboard UI
+- Added screens in Dashboard New Graph flow, that allows users to choose between creating a graph from scratch or importing one of our example graphs
+- Added a screen to display details of a UDG example API
+- Added a feature to display a full [_Tyk Sync_](/api-management/automations/sync) command that will allow a user to import an example UDG into their Dashboard
+- Added `/examples` endpoint to Dashboard API that returns a list of available API examples that can later be imported into the Dashboard `GET /api/examples`
+- Added `/data-graphs/data-sources/import` endpoint to Dashboard API that transforms an OpenAPI document into UDG config and publishes it in Dashboard `POST /api/data-graphs/data-sources/import`
+- Added query param `apidef=true` to example detail endpoint in Dashboard API to retrieve the API definition of an example
+- Added new `owned_analytics` user permission which restricts the user's access only to analytics relating to APIs they own. These are the _API Activity Dashboard Requests_ and _Average Errors Over Time_ charts in the Tyk Dashboard. Note that it is not currently possible to respect API Ownership in other aggregated charts
+
+##### Changed
+
+- Tyk Dashboard updated to Go 1.19
+- Updated npm package dependencies of Dashboard, to address critical and high CVEs
+- Changed the field mapping tickbox description in GUI to be 'Use default field mapping'
+
+##### Fixed
+
+- Fixed an issue when using custom authentication with multiple authentication methods. Custom authentication could not be selected to provide the base identity
+- Fixed an issue where the login URL was displayed as undefined when creating a TIB Profile using LDAP as a provider
+- Fixed an issue where it was not possible to download Activity by API or Activity by Key from the Dashboard when using PostgreSQL for the analytics store
+- Fixed an issue where a new user could be stuck in a password reset loop in the dashboard if TYK_DB_SECURITY_FORCEFIRSTLOGINPWRESET was enabled
+- Fixed an issue where the `ssl_force_common_name_check` flag was disappearing. The flag was disappearing after being updated via dashboard UI raw API editor and a subsequent page reload. It was also disappearing when updating the API Definition via the GW/DB API.
+- Fixed an issue where a user could update their email address to match that of another user within the same organization
+- Fixed an issue where users without `user:write` permission were able to update their permissions through manipulation of Dashboard API calls
+- Fixed an issue where the versions endpoint returned APIs that were not owned by the logged-in user
+- Fixed an issue where the log browser showed analytics for APIs not owned by the logged-in user
+- Fixed an issue that prevented non-admin users from seeing _Endpoint Popularity_ data in the Tyk Dashboard
+- Fixed an issue where additional data was returned when requesting analytics with p=-1 query when using SQL for the analytics store
+- Fixed an issue so that filtering by API now respects API Ownership in three Dashboard charts.
+
+  - Gateway Dashboard - API Activity Dashboard - Requests
+  - Activity by API - Traffic Activity per API
+  - Errors - Average Errors Over Time
+
+- Fixed an issue so that the Log Browser now respects API Ownership. A user will now only be able to see logs for the APIs that they are authorized to view
+- Fixed filters for the Log Browser, Errors - Average Errors Over Time and API Activity Dashboard - Requests so that a user can only select from versions of APIs for which they have visibility
+- Fixed UI bug so that data graphs created with multiple words are [sluggified](https://www.w3schools.com/django/ref_filters_slugify.php#:~:text=Definition%20and%20Usage,ASCII%20characters%20and%20hyphens%20(%2D).), i.e. spaces are replaced with a hyphen `-`
+- Fixed an issue with routing, which was sending the user to a blank screen while creating a new Data Graph or importing an example API
+
+## 5.0 Release Notes
+### 5.0.15 Release Notes
+
+#### Release Date 24 October 2024
+
+#### Release Highlights
+
+This is a version bump to align with Gateway v5.0.15, no changes have been implemented in this release.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.0.15, please follow the detailed [upgrade instructions](#upgrading-tyk). 
+
+#### Changelog
+<a id="Changelog-v5.0.15" data-scroll-offset></a>
+
+No changes in this release.
+
+
+---
+
+### 5.0.14 Release Notes
+
+#### Release Date 18th September 2024
+
+#### Upgrade Instructions
+
+This release is not tightly coupled with Tyk Gateway v5.0.14, so you do not have to upgrade both together.
+
+
+Go to the [Upgrading Tyk](/developer-support/release-notes/gateway#upgrading-tyk) section for detailed upgrade instructions.
+
+
+#### Release Highlights
+
+This release fixes some display issues in Tyk Dashboard and Tyk Classic Portal when using PostgreSQL.
+
+#### Changelog
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Tyk Dashboard UI: Fixed display issue for API statistics'>
+Fixed an issue where API statistics were not being shown when using PostgreSQL and adding two or more tags in the Activity page
+</Accordion>
+
+<Accordion title='Tyk Dashboard UI:  Fixed issue with display of HTTP 429 status codes on the Activity page'>
+Fixed an issue where HTTP 429 status codes were not being shown on the Activity page when using PostgreSQL
+</Accordion>
+
+<Accordion title='Tyk Classic Portal UI: Fixed display of graphs and requests counter'>
+Fixed wrong graphs and incorrect requests counter on Tyk Classic Portal when using PostgreSQL
+</Accordion>
+
+<Accordion title='Tyk Dashboard UI: fixed issues with the Error Breakdown display, specifically related to date handling'>
+Fixed Error Breakdown issue showing errors that happened on different dates than selected date
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.0.13 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.13)
+
+---
+
+### 5.0.12 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.12)
+
+---
+
+### 5.0.11 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.11)
+
+---
+
+### 5.0.10 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.10)
+
+---
+
+### 5.0.9 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.9)
+
+---
+
+### 5.0.8 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.8)
+
+--- 
+
+### 5.0.7 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.7).
+
+---
+
+### 5.0.6 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.6). 
+
+---
+
+### 5.0.5 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.5).
+
+---
+
+### 5.0.4 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.4).
+
+---
+
+### 5.0.3 Release Notes
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.3).
+
+---
+
+### 5.0.2 Release Notes
+
+##### Release Date 29 May 2023
+
+##### Release Highlights
+
+###### Support for MongoDB 5 and 6
+From Tyk 5.0.2, we added support for MongoDB 5.0.x and 6.0.x. To enable this, you have to set new Dashboard config option driver to *mongo-go*. 
+The driver setting defines the driver type to use for MongoDB. It can be one of the following values:
+- [mgo](https://github.com/go-mgo/mgo) (default): Uses the *mgo* driver. This driver supports MongoDB versions `<= v4.x` (lower or equal to v4.x). You can get more information about this driver in the [mgo](https://github.com/go-mgo/mgo) GH repository. To allow users more time for migration, we will update our default driver to the new driver, *mongo-go*, in next major release.
+- [mongo-go](https://github.com/mongodb/mongo-go-driver): Uses the official MongoDB driver. This driver supports MongoDB versions >= v4.x (greater or equal to v4.x). You can get more information about this driver in [mongo-go-driver](https://github.com/mongodb/mongo-go-driver) GH repository.
+
+See how to [Choose a MongoDB driver](/planning-for-production/database-settings#mongodb)
+
+**Note: Tyk Pump 1.8.0 and MDCB 2.2 releases have been updated to support the new driver option**
+
+##### Downloads
+
+[docker image to pull](https://hub.docker.com/layers/tykio/tyk-dashboard/v5.0.2/images/sha256-fe3009c14ff9096771d10995a399a494389321707e951a3c46f944afd28d18cd?context=explore)
+
+
+##### Changelog
+<a id="Changelog-v5.0.2" data-scroll-offset></a>
+
+###### Fixed
+- Fixed a bug on migration of a portal catalog with deleted policy to SQL
+- Fixed: Redirect unregistered user to new page when SSOOnlyForRegisteredUsers is set to true
+
+---
+
+### 5.0.1 Release Notes
+
+##### Release Date 25 Apr 2023
+
+##### Release Highlights
+This release primarily focuses on bug fixes. 
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.0.1) below.
+
+##### Downloads
+- [docker image to pull](https://hub.docker.com/layers/tykio/tyk-dashboard/v5.0.1/images/sha256-013d971fc826507702f7226fa3f00e1c7e9d390fc0fb268bed42e410b126e89d?context=explore)
+
+##### Changelog
+<a id="Changelog-v5.0.1" data-scroll-offset></a>
+
+###### Added
+- Improved security for people using the Dashboard by adding the Referrer-Policy header with the value `no-referrer`
+- Added ability to select the plugin driver within the Tyk OAS API Designer
+
+###### Changed
+- When creating a new API in the Tyk OAS API Designer, caching is now disabled by default
+
+###### Fixed
+- Fixed a bug where a call to the `/hello` endpoint would unnecessarily log `http: superfluous response.WriteHeader call`
+- Fixed a bug where the Dashboard was showing *Average usage over time* for all Developers, rather than just those relevant to the logged in developer
+- Fixed a bug where logged in users could see Identity Management pages, even if they didn't have the rights to use these features
+- Fixed a bug that prevented Tyk Dashboard users from resetting their own passwords
+- Fixed issue with GraphQL proxy headers added via UI
+- Fixed a bug where the Dashboard would not allow access to any screens if a logged in user didn’t have access to the APIs resource regardless of other access rights
+- Fixed a bug on the key management page where searching by `key_id` did not work - you can now initiate the search by pressing enter after typing in the `key_id`
+- Fixed a bug where Dashboard API could incorrectly return HTTP 400 when deleting an API
+- Fixed UDG UI bug that caused duplicate data source creation on renaming
+- Fixed schema validation for custom domain in Tyk OAS API definition
+- Fixed a bug where the left menu did not change when Dashboard language was changed
+- Fixed a bug that caused the Dashboard to report errors when decoding multiple APIs associated with a policy
+- Fixed a bug where it was not possible to disable the Use Scope Claim option when using JWT authentication
+- Fixed a bug in the default OPA rule that prevented users from resetting their own password
+- Fixed a bug where authToken data was incorrectly stored in the JWT section of the authentication config when a new API was created
+
+---
+
+### 5.0.0 Release Notes
+
+#### Release Date 28 Mar 2023
+
+#### Release Highlights
+
+##### Improved OpenAPI support
+
+Tyk Dashboard has been enhanced with **all the custom middleware options** for Tyk OAS APIs, so **for the first time** you can configure your custom middleware from the Dashboard; this covers the full suite of custom middleware from pre- to post- and response plugins. We’ve got support for middleware bundles, Go plugins and Tyk Virtual Endpoints, all within the new and improved Tyk Dashboard UI.
+
+[Versioning your Tyk OAS APIs](/api-management/api-versioning) is easier than ever, with the Tyk OSS Gateway now looking after the maintenance of the list of versions associated with the base API for you; we’ve also added a new endpoint on the Tyk API that will return details of the versions for a given API.
+
+Tyk Dashboard hasn’t been left out, we’ve implemented a brand new version management UI for Tyk OAS APIs, to make it as easy as possible for you to manage those API versions as you develop and extend your API products with Tyk.
+
+We’ve improved support for [OAS Mock Responses](/api-management/traffic-transformation/mock-response#mock-response), with the Tyk OAS API definition now allowing you to register multiple Mock Responses in a single API, providing you with increased testing flexibility.
+
+Another new feature in the Tyk OAS API Designer is that you can now update (PATCH) your existing Tyk OAS APIs through the Dashboard API without having to resort to curl. That should make life just that little bit easier.
+Of course, we’ve also addressed some bugs and usability issues as part of our ongoing ambition to make Tyk OAS API the best way for you to create and manage your APIs.
+
+##### GraphQL and Universal Data Graph improvements
+
+This release is all about making things easier for our users with GraphQL and Universal Data Graph.
+
+In order to get our users up and running with a working Universal Data Graph quickly, we’ve created a repository of examples that anyone can import into their Dashboard or Gateway and see what Universal Data Graph is capable of. Import can be done in two ways:
+- manually, by simply copying a Tyk API definition from GitHub - [TykTechnologies/tyk-examples](https://github.com/TykTechnologies/tyk-examples): A repository containing example API definitions and policies for Tyk products. 
+- via command line [using tyk-sync](/api-management/data-graph#udg-examples)
+
+To make it easier for our users to find their way to Universal Data Graph, we’ve also given it its own space in the Dashboard. From now on you can find UDG under Data Graphs section of the menu.
+
+It also got a lot easier to turn a Kafka topic into a GraphQL subscription. Using our new Dashboard API endpoint, users will be able to transform their AsyncAPI documentation into Universal Data Graph definition with a single click. Support for OAS coming soon as well!
+
+With this release we are also giving our users [improved headers for GQL APIs](/api-management/graphql#graphql-apis-headers). It is now possible to use context variables in request headers and persist headers needed for introspection separately for improved security.
+
+Additionally we’ve added Dashboard support for introspection control on policy and key level. It is now possible to allow or block certain consumers from being able to introspect any graph while creating a policy or key via Dashboard.
+
+#### Downloads
+
+[docker image to pull](https://hub.docker.com/layers/tykio/tyk-dashboard/v5.0/images/sha256-3d736b06b023e23f406b1591f4915b3cb15a417fcb953d380eb8b4d71829f20f?tab=vulnerabilities)
+
+#### Changelog
+
+##### Added
+- Numerous UX improvements
+- New UI for custom middleware for Tyk OAS APIs
+- Significantly improved Tyk OAS API versioning user experience
+- It now possible to use PATCH method to modify Tyk OAS APIs via the Dashboard API
+- Now you can turn a Kafka topic into a GraphQL subscription by simply [importing your AsyncAPI definition](/api-management/data-graph#data-graphs-api)
+- Way to control access to introspection on policy and key level
+
+##### Changed
+- Universal Data Graph moved to a separate dashboard section
+
+---
+
+## 4.3 Release Notes
+### 4.3.0 Release Notes
+
+#### Release Highlights
+
+##### Tyk OAS APIs - Versioning via the Dashboard
+
+Tyk v4.3 adds API versioning to the Dashboard UI, including:
+
+- Performing CRUD operations over API versions
+- Navigate seamlessly between versions
+- A dedicated manage versions screen
+- easily identify the default version and the base API.
+
+##### Importing OAS v3 via the Dashboard
+
+Importing OpenAPI v3 documents in order to generate Tyk OAS API definition is now fully supported in our Dashboard UI. Our UI automatically detects the version of your OpenAPI Document, and will suggest options that you can pass or allow Tyk to read from the provided document, in order to configure the Tyk OAS API Definition. Such as: 
+
+- custom upstream URL
+- custom listen path
+- authentication mechanism
+- validation request rules and limit access only to the defined paths.
+
+[Importing OAS v3 via the Dashboard](/api-management/gateway-config-managing-oas#importing-an-openapi-description-to-create-an-api)
+
+##### Updated the Tyk Dashboard version of Golang, to 1.16.
+
+**Our Dashboard is using Golang 1.16 version starting with 4.3 release. This version of the Golang release deprecates x509 commonName certificates usage. This will be the last release where it's still possible to use commonName, users need to explicitly re-enable it with an environment variable.**
+
+The deprecated, legacy behavior of treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is now disabled by default. It can be temporarily re-enabled by adding the value x509ignoreCN=0 to the GODEBUG environment variable.
+
+Note that if the CommonName is an invalid host name, it's always ignored, regardless of GODEBUG settings. Invalid names include those with any characters other than letters, digits, hyphens and underscores, and those with empty labels or trailing dots.
+
+
+#### Changelog
+
+##### Added
+
+- Added an option for using multiple header/value pairs when configuring GraphQL API with a protected upstream and persisting those headers for future use.
+- Added documentation on how edge endpoints Dashboard configuration can be used by users to add tags for their API Gateways.
+- When retrieving the Tyk OAS API Definition of a versioned API, the base API ID is passed on the GET request as a header: `x-tyk-base-api-id`.
+- If Edge Endpoints Dashboard configuration is present, when users add segment/tags to the Tyk OAS API Definition, their corresponding URLs are populated in the servers section of the OAS document.
+- Listen path field is now hidden from the API Designer UI, when the screen presents a versioned or internal API.
+
+##### Changed
+
+- Extended existing `x-tyk-gateway` OAS documentation and improved the markdown generator to produce a better-formatted documentation for `x-tyk-gateway` schema.
+- Complete change of Universal Data Graph configuration UI. New UI is now fully functional and allows configuration of all existing datasources (REST, GraphQL and Kafka).
+- Changed look & feel of request logs for GraphQL Playground. It is now possible to filter the logs and display only the information the user is interested in.
+
+##### Fixed
+
+- Fixed: OAS API definition showing management gateway URL even if segment tags are present in cloud. From now on OAS servers section would be filled with edge endpoint URLs if configured.
+- Adding a path that contains a path parameter, doesn’t throw an error anymore on the Dashboard UI, and creates default path parameter description in the OAS.
+
+#### Updated Versions
+
+Tyk Dashboard 4.3 ([docker images](https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=1&name=4.3.0))
+
+#### Upgrade process
+
+Follow the [standard upgrade guide](/developer-support/upgrading), there are no breaking changes in this release.
+
+If you want switch from MongoDB to SQL, you can [use our migration tool](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance), but keep in mind that it does not yet support the migration of your analytics data.
+
+
+<Note>
+Note: Upgrading the Golang version implies that all the Golang custom plugins that you are using need to be recompiled before migrating to 4.3 version of the Gateway. Check our docs for more details [Golang Plugins](/api-management/plugins/golang).
+</Note>
+
+
+## 4.2 Release Notes
+### 4.2.0 Release Notes
+
+#### Release Highlights
+
+##### GraphQL Federation improvements
+
+###### Changed GUI in Universal Data Graph configuration section.
+
+A new GUI introduces enhancements to the user experience and more consistent user journey for UDG. 
+This change does not yet cover all possible use cases and is released with a feature flag. To enable the new GUI, analytics.conf needs the following setting:
+
+```
+"ui": {
+  "dev": true
+}
+```
+
+What’s possible with this change:
+- Importing GraphQL schema created outside of Tyk (formats accepted .json, .graphql, .grahqls)
+- Creating GraphQL schema in Tyk using schema editor
+- Hide/Unhide schema editor to focus on graphical representation of the schema
+- Resizing schema editor to adjust workspace look & feel to user preferences
+- Improved search in schema editor (search and search & replace available)
+- Quick link to UDG documentation from schema editor
+
+> Note: Full configuration of new Universal Data Graph is not yet possible in the GUI, however any UDGs created earlier will not be broken and will work as previously. 
+
+##### Changes to federation entities
+###### Defining the base entity
+Entities must be defined with the `@key` directive. The fields argument must reference a field by which the entity can be uniquely identified. Multiple primary keys are possible. For example:
+
+Subgraph 1 (base entity):
+```
+type MyEntity @key(fields: "id") @key(fields: "name") {
+  id: ID!
+  name: String!
+}
+```
+ Attempting to extend a non-entity with an extension that includes the @key directive or attempting to extend a base entity with an extension that does not include the @key directive will both result in errors.
+
+###### Entity stubs
+
+Entities cannot be shared types (be defined in more than one single subgraph).
+If one subgraph references a base entity (an entity defined in another subgraph), that reference must be declared as a stub (stubs look like an extension without any new fields in federation v1). This stub would contain the minimal amount of information to identify the entity (referencing exactly one of the primary keys on the base entity regardless of whether there are multiple primary keys on the base entity). For example, a stub for MyEntity from Subgraph 1 (defined above):
+
+Subgraph 2 (stub)
+```
+extend type MyEntity @key(fields: "id") {
+  id: ID! @external
+}
+```
+
+###### Supergraph extension orphans
+It is now possible to define an extension for a type in a subgraph that does not define the base type.
+However, if an extension is unresolved (an extension orphan) after an attempted federation, the federation will fail and produce an error.
+
+###### Improved Dashboard UI and error messages
+GraphQL-related (for example when federating subgraphs into a supergraph) errors in the Dashboard UI will show a lean error message with no irrelevant prefixes or suffixes.
+
+Changed the look & feel of request logs in Playground tab for GraphQL APIs. New component presents all logs in a clearer way and is easier to read for the user
+
+###### Shared types
+Types of the same name can be defined in more than one subgraph (a shared type). This will no longer produce an error if each definition is identical.
+Shared types cannot be extended outside of the current subgraph, and the resolved extension must be identical to the resolved extension of the shared type in all other subgraphs (see subgraph normalization notes). Attempting to extend a shared type will result in an error.
+The federated supergraph will include a single definition of a shared type, regardless of how many times it has been identically defined in its subgraphs.
+
+###### Subgraph normalization before federation
+Extensions of types whose base type is defined in the same subgraph will be resolved before an attempt at federation. A valid example involving a shared type:
+
+Subgraph 1:
+```
+enum Example {
+  A,
+  B
+}
+
+extend enum Example {
+  C  
+}
+```
+
+Subgraph 2:
+```
+enum Example {
+  A,
+  B,
+  C
+}
+```
+ 
+The enum named “Example” defined in Subgraph 1 would resolve to be identical to the same-named enum defined in Subgraph 2 before federation takes place. The resulting supergraph would include a single definition of this enum.
+
+###### Validation
+Union members must be both unique and defined.
+Types must have bodies, e.g., enums must contain at least one value; inputs, interfaces, or objects must contain at least one field
+
+##### OpenAPI 
+Added support for the Request Body Transform middleware, for new Tyk OAS API Definitions.
+
+##### Universal Data Graph
+
+Added support for Kafka as a data source in Universal Data Graph. Configuration allows the user to provide multiple topics and broker addresses.
+
+#### Changelog
+
+##### Added
+- Added support for Kafka as a data source in Universal Data Graph.
+- Added support for the Request Body Transform middleware for OAS based APIs
+
+##### Changed
+- Improved GraphQL Dashboard UI error messages
+- Changed GUI in Universal Data Graph
+- Changed look & feel of request logs in Playground tab for GraphQL APIs.
+
+##### Fixed
+- Fixed an issue with key lookup where keys were not being found when using the search field
+- Fixed an issue with object types dropdown in Universal Data Graph config, where it wasn’t working correctly when object type UNION was chosen
+- Fixed an issue in Universal Data Graph which prevented users from injecting an argument value or parameter value in the domain part of the defined data source upstream URL
+
+#### Updated Versions
+
+Tyk Dashboard 4.2
+
+
+#### Upgrade process
+
+Follow the [standard upgrade guide](/developer-support/upgrading), there are no breaking changes in this release.
+
+If you want switch from MongoDB to SQL, you can [use our migration tool](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance), but keep in mind that it does not yet support the migration of your analytics data.
+
+## 4.1 Release Notes
+### 4.1.0 Release Notes
+
+#### Release Highlights
+
+##### OpenAPI as a native API definition format
+Tyk has always had a proprietary specification for defining APIs. From Tyk v4.1 we now support defining APIs using the Open API Specification (OAS) as well, which can offer significant time and complexity savings. [This is an early access capability](/developer-support/release-types/early-access-feature).
+
+As we extend our OAS support, we would very much like your feedback on how we can extend and update to best meet your needs: .
+
+This capability is available in both the open source and paid versions of Tyk. See our [Tyk OAS documentation](/api-management/gateway-config-tyk-oas) for more details.
+
+
+##### MDCB Synchroniser
+
+Tyk Gateway v4.1 enables an improved synchroniser functionality within Multi Data Center Bridge (MDCB) v2.0. Prior to this release, the API keys, certificates and OAuth clients required by worker Gateways were synchronised from the controller Gateway on-demand. With Gateway v4.1 and MDCB v2.0 we introduce proactive synchronisation of these resources to the worker Gateways when they start up.
+ 
+This change improves resilience in case the MDCB link or controller Gateway is unavailable, because the worker Gateways can continue to operate independently using the resources stored locally. There is also a performance improvement, with the worker Gateways not having to retrieve resources from the controller Gateway when an API is first called.
+ 
+Changes to keys, certificates and OAuth clients are still synchronised to the worker Gateways from the controller when there are changes and following any failure in the MDCB link.
+
+##### Go Plugin Loader
+When upgrading your Tyk Installation you need to re-compile your plugin with the new version. At the moment of loading a plugin, the Gateway will try to find a plugin with the name provided in the API definition. If none is found then it will fallback to search the plugin file with the name: `{plugin-name}_{Gw-version}_{OS}_{arch}.so`
+
+From v4.1.0 the plugin compiler automatically names plugins with the above naming convention. It enables you to have one directory with different versions of the same plugin. For example:
+
+- `plugin_v4.1.0_linux_amd64.so`
+- `plugin_v4.2.0_linux_amd64.so`
+
+So, if you upgrade from Tyk v4.1.0 to v4.2.0 you only need to have the plugins compiled for v4.2.0 before performing the upgrade.
+
+#### Changelog
+
+##### Added
+- Added support for new OAS api definition format, and new API creation screens
+- Dashboard boostrap instalation script extended to support SQL databases
+- Added `TYK_DB_OMITCONFIGFILE` option for Tyk Dashboard to ignore the values in the config file and load its configuration only from environment variables and default values
+- Added a new config option `identity_broker.ssl_insecure_skip_verify` that will allow customers using the embedded TIB to use IDPs exposed with a self signed certificate. Not intended to be used in production, only for testing and POC purposes.
+- Added option to configure certificates for Tyk Dashboard using [environment variables](/tyk-dashboard/configuration#http_server_options-certificates).
+
+##### Changed
+- Detailed information about certificates can be viewed from certificates listing page
+- Dashboard APIs GQL Playground now shows additional information about certificates
+- Dashboard will now use default version of GraphiQL Playground which can switch between light and dark modes for more accessibility
+- Banner for resyncing GraphQL schema has been given a new, more accessible look in line with the rest of Dashboard design
+
+##### Fixed
+- Fixed an issue with key lookup where keys were not being found when using the search field
+- Fixed an issue with object types dropdown in Universal Data Graph config, where it wasn’t working correctly when object type UNION was chosen
+- Fixed an issue in Universal Data Graph which prevented users from injecting an argument value or parameter value in the domain part of the defined data source upstream URL
+
+#### Updated Versions
+Tyk Dashboard 4.1
+Tyk MDCB 2.0.1
+
+#### Upgrade process
+
+Follow the [standard upgrade guide](/developer-support/upgrading), there are no breaking changes in this release.
+
+If you want switch from MongoDB to SQL, you can [use our migration tool](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance), but keep in mind that it does not yet support the migration of your analytics data.
+ 
+## 4.0 Release Notes
+### 4.0.0 Release Notes
+
+#### Release Highlights
+
+##### GraphQL federation
+
+As we know, ease-of-use is an important factor when adopting GraphQL. Modern enterprises have dozens of backend services and need a way to provide a unified interface for querying them. Building a single, monolithic GraphQL server is not the best option. It is hard to maintain and leads to a lot of dependencies and over-complication.
+
+To remedy this, Tyk 4.0 offers GraphQL federation that allows the division of GraphQL implementation across multiple backend services, while still exposing them all as a single graph for the consumers. Subgraphs represent backend services and define a distinct GraphQL schema. A subgraph can be queried directly, as a separate service or federated in the Tyk Gateway into a larger schema of a supergraph – a composition of several subgraphs that allows execution of a query across multiple services in the backend.
+
+[Federation docs](/api-management/graphql#overview-1)
+
+[Subgraphs and Supergraphs docs](/api-management/graphql#subgraphs-and-supergraphs)
+
+##### GraphQL subscriptions
+
+Subscriptions are a way to push data from the server to the clients that choose to listen to real-time messages from the server, using the WebSocket protocol. There is no need to enable subscriptions separately; Tyk supports them alongside GraphQL as standard.
+
+With release 4.0, users can federate GraphQL APIs that support subscriptions. Federating subscriptions means that events pushed to consumers can be enriched with information from other federated graphs.
+
+[Subscriptions docs](/api-management/graphql#graphql-subscriptions)
+
+##### SQL database support
+The other major capability in Tyk 4.0 is that the Tyk Dashboard can store its data in a SQL  relational database. 
+
+Until now, Tyk Dashboard has used MongoDB for storing everything from data such as APIs, policies and users through to analytics and logs. MongoDB is still a great storage choice for most projects. However, not all users have MongoDB as part of their tech stack. Some are in heavily regulated industries which means adding it would be a pain. For others, the document storage type and lack of proper ACID transaction support may not be the best solution. These users can now choose a SQL database solution instead. 
+
+From version 4.0, Tyk Dashboard and Tyk Pump will support four data storage layers, which can be configured separately, each with a different officially supported database solution (if needed). All data stored in SQL databases will provide the same information in the Dashboard that MongoDB did.
+
+While SQL support for Tyk products does not depend on specific database features, with this release, we will provide official support for [PostgreSQL DB for production purposes](/planning-for-production/database-settings#postgresql), and SQLite for development and PoC environments. Note that SQL support is available for self-managed setups only.
+
+As part of SQL support we are also providing tooling to perform seamless migration of your Dashboard data from Mongo to SQL. However, at the moment migration of analytics data is not supported.
+[MongoDB to SQL migration docs](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance)
+
+#### Changelog
+- Now it is possible to configure GraphQL upstream authentication, in order for Tyk to work with its schema
+- JWT scopes now support arrray and comma delimiters
+- Go plugins can be attached on per-endpoint level, similar to virtual endpoints
+
+#### Updated Versions
+Tyk Dashboard 4.0
+Tyk Pump 1.5
+
+#### Upgrade process
+
+Follow the [standard upgrade guide](/developer-support/upgrading), there are no breaking changes in this release.
+
+If you want switch from MongoDB to SQL, you can [use our migration tool](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance), but keep in mind that it does not yet support the migration of your analytics data.
+ 
+## 3.2 Release Notes
+### 3.2.0 Release Notes
+
+#### Release Notes
+
+##### Bring your own Identity Provider - Dynamic Client Registration now available!
+
+DCR is a protocol of the Internet Engineering Task Force put in place to set standards in the dynamic registration of clients with authorization servers. This feature is a way for you to integrate your Tyk Developer Portal with an external identity provider such as Keycloak, Gluu, Auth0 or Okta. 
+The portal developer won't notice a difference. However, when they create the app via Tyk Developer portal, Tyk will dynamically register that client on your authorization server. This means that it is the Authorization Server that will issue the Client ID and Client Secret for the app.
+
+Check our DCR docs [here](/tyk-developer-portal/tyk-portal-classic/dynamic-client-registration)
+
+We also took this opportunity to give a refresh to the portal settings UI so let us know if you like it! 
+
+##### GraphQL and UDG improvements
+
+We've updated the GraphQL functionality of our [Universal Data Graph](/api-management/data-graph#overview). You’re now able to deeply nest GraphQL & REST APIs and stitch them together in any possible way.
+
+Queries are now possible via WebSockets and Subscriptions are coming in the next Release (3.3.0).
+
+You're also able to configure [upstream Headers dynamically](/api-management/data-graph#header-forwarding), that is, you’re able to inject Headers from the client request into UDG upstream requests. For example, it can be used to access protected upstreams. 
+
+We've added an easy to use URL-Builder to make it easier for you to inject object fields into REST API URLs when stitching REST APIs within UDG.
+
+Query-depth limits can now be configured on a per-field level.
+
+If you’re using GraphQL upstream services with UDG, you’re now able to forward upstream error objects through UDG so that they can be exposed to the client.
+
+
+##### Extendable Tyk Dashboard permissions system
+
+The Tyk Dashboard permission system can now be extended by writing custom rules using an Open Policy Agent (OPA). The rule engine works on top of the Tyk Dashboard API, which means you can control not only access rules, but also the behavior of all Dashboard APIs (except your public developer portal). You can find more details about OPA [here](/platform-management/open-policy-agent).
+
+In addition, you can now create your own custom permissions using the Additional Permissions API or by updating `security.additional_permissions` map in the Tyk Dashboard config, and writing Opa rule containing logic for the new permission.
+
+#### Changelog
+
+In addition to the above, version 3.2 includes all the fixes that are part of 3.0.5
+https://github.com/TykTechnologies/tyk/releases/tag/v3.0.5
+
+#### Updated Versions
+Tyk Dashboard 3.2
+
+#### Upgrade process
+If you already have GraphQL or UDG APIs you need to follow this [upgrade guide](/api-management/graphql#migrating-to-3-2).
+
+## 3.1 Release Notes
+### 3.1.0 Release Notes
+
+#### Release Highlights
+
+##### Identity Management UX and SAML support
+You will notice that the experience for creating a new profile in the Identity management section of the dashboard was changed to a ‘wizard’ approach which reduces the time it takes to get started and configure a profile. 
+In addition, users are now able to use SAML for the dashboard and portal login, whether you use TIB(Tyk Identity Broker) internally or externally of the dashboard.
+
+This follows the recent changes that we have made to embed TIB (Tyk Identity Broker)in the dashboard. See 3.0 [release notes](/developer-support/release-notes/dashboard#tyk-identity-broker-now-built-in-to-the-dashboard) for more information regarding this. 
+
+To learn more [see the documentation](/tyk-identity-broker/overview)
+
+##### UDG (Universal Data Graph) & GraphQL
+###### Schema Validation
+
+For any GraphQL API that is created via Dashboard or through our API, the GraphQL schema is now validated before saving the definition. Instant feedback is returned in case of error.
+
+###### Sync / Update schema with upstream API (Proxy Only Mode)
+
+If you’ve configured just a proxy GraphQL API, you can now keep in sync the upstream schema with the one from the API definition, just by clicking on the `Get latest version` button on the `Schema` tab from API Designer
+
+Docs [here](/api-management/graphql#syncing-gql-schema)
+
+###### Debug logs
+
+You can now see what responses are being returned by the data sources used while configuring a UDG (universal data graph). These can be seen by calling the `/api/debug` API or using the playground tab within API designer.
+
+The data that will be displayed will show information on the query before and after the request to a data source happens, as follows:
+
+Before the request is sent:
+
+Example log message: "`Query.countries: preSendHttpHook executed”. Along with this message, the log entry will contain the following set of fields: Typename, Fieldname and Upstream url;
+
+
+After the request is sent:
+
+Example log message: "Query.countries: postReceiveHttpHook executed”. Along with this message, the log entry will contain the following set of fields: Typename, Filename, response body, status code.
+
+Example: 
+
+```{"typename": "Query", "fielname": "countries", "response_body": "{\"data\":{}}", "status_code": 200}```
+
+Docs [here](/api-management/graphql#graphql-playground)
+
+##### Portal
+###### GraphQL Documentation
+
+Documentation for the GraphQL APIs that you are exposing to the portal is available now through a GraphQL Playground UI component, same as on the playground tab of API Designer.
+
+Also to overcome the CORS issues that you might encounter while testing documentation pages on the portal, we have pre-filled the CORS settings section in API Designer with explicit values from the start. All you need to do is to check the “Enable CORS” option.
+
+###### Portal - API key is hidden in email
+You now have the option to hide the API key in the email generated after you approve the key request for a developer.
+
+[Docs here](/tyk-developer-portal/tyk-portal-classic/key-requests)
+
+
+#### Changelog
+The 3.1 version includes the fixes that are part of 3.0.1. 
+https://github.com/TykTechnologies/tyk/releases/tag/v3.0.1
+
+
+#### Updated Versions
+- Tyk Dashboard 3.1
+
+## 3.0 Release Notes
+### 3.0.0 Release Notes
+
+#### Release Highlights
+
+##### Version changes and LTS releases
+
+We have bumped our major Tyk Gateway version from 2 to 3, a long overdue change as we’ve been on version 2 for 3 years. We have also changed our Tyk Dashboard major version from 1 to 3, and from now on it will always be aligned with the Tyk Gateway for major and minor releases. The Tyk Pump has also now updated to 1.0, so we can better indicate major changes in future. 
+
+Importantly, such a big change in versions does not mean that we going to break backward compatibility. More-over we are restructuring our internal release strategy to guarantee more stability and to allow us to deliver all Tyk products at a faster pace. We aim to bring more clarity to our users on the stability criteria they can expect, based on the version number.
+Additionally we are introducing Long Term Releases (also known as LTS).
+
+Read more about this changes in our blog post: https://tyk.io/blog/introducing-long-term-support-some-changes-to-our-release-process-product-versioning/
+
+##### New Look and Feel
+
+We have a brand new look to our Tyk Dashboard. About half a year ago, we made some changes to our visual branding to better express our love for creativity and great UX. Those changes started with our website and now we are also incorporating these visual changes into the UI of our products. We do this to keep our brand consistent across the whole Tyk experience and to enhance your experience using our products. 
+
+See our updated [Tutorials](/tyk-self-managed) section.
+
+##### Universal Data Graph and GraphQL
+
+Tyk now supports GraphQL **natively**. This means Tyk doesn’t have to use any external services or process for any GraphQL middleware. You can securely expose existing GraphQL APIs using our GraphQL core functionality.
+
+In addition to this you can also use Tyk’s integrated GraphQL engine to build a Universal Data Graph. The Universal Data Graph (UDG) lets you expose existing services as one single combined GraphQL API.
+
+All this without even have to build your own GraphQL server. If you have existing REST APIs all you have to do is configure the UDG and Tyk has done the work for you.
+
+With the Universal Data Graph (UDG), Tyk becomes the central integration point for all your internal and external APIs.
+It also benefits from the full set of capabilities included with your Tyk installation—meaning your data graph is secure from the start and can take advantage of a wide range of out-of-the-box middleware to power your graph.
+
+Read more about the [GraphQL](/api-management/graphql) and [Universal Data Graph](/api-management/data-graph#overview)
+
+
+##### Policies and Keys UX changes 
+
+We have a lot to update you on with our UX & UI revamp, but one thing we want to highlight here are the updates to the policies and keys Dashboard pages. We know there was confusion in the way we set policies and keys up in the Tyk Dashboard, so we redesigned the UI workflow to make it less error-prone, simpler and more intuitive when you create, view and edit security policies and keys.
+
+When you create, view or edit a key the steps are in a more logical order. We’ve removed the long form that needed to be filled out and replaced it with tabs so you can find and enter information easily. We’ve also grouped all information within each API so you know the exact set up of each of your access rights without any confusion. The new workflow should allow tasks to be completed faster and more efficiently.
+
+See updated tutorials on how to [create a policy](/api-management/gateway-config-managing-classic#secure-an-api) and [keys](/api-management/gateway-config-managing-classic#access-an-api)
+
+We also have a [blog post](https://tyk.io/blog/the-transformation-of-policies-and-keys/) that explains what we've done, and why we did it.
+
+
+##### Tyk Identity broker now built-in to the Dashboard
+
+Previously you had to run a separate process to setup SSO (single sign on). Now this functionality is built-in to the dashboard and got UI revamp. So now you can just start the dashboard, and via UI, create a SSO flow, without installing 3-rd party components. Including SSO via social logins, OpenID Connect and LDAP (with SAML coming very soon!) including integration with the Dashboards RBAC and your Identity Provider.
+
+See [updated flow details](/tyk-identity-broker/overview)
+
+
+##### Using external secret management services
+
+Want to reference secrets from a KV store in your API definitions? We now have native Vault & Consul integration. You can even pull from a tyk.conf dictionary or environment variable file.
+
+[Read more](/tyk-configuration-reference/kv-store)
+
+
+##### Co-Process Response Plugins
+
+We added a new middleware hook allowing middleware to modify the response from the upstream. Using response middleware you can transform, inspect or obfuscate parts of the response body or response headers, or fire an event or webhook based on information received by the upstream service.
+
+At the moment the Response hook is supported for [Python and gRPC plugins](/api-management/plugins/rich-plugins#coprocess-dispatcher-hooks).
+
+
+##### Enhanced Gateway health check API
+
+Now the standard Health Check API response include information about health of the dashboard, redis and mdcb connections.
+You can configure notifications or load balancer rules, based on new data. For example, you can be notified if your Tyk Gateway can’t connect to the Dashboard (or even if it was working correctly with the last known configuration).
+
+[Read More](/planning-for-production/ensure-high-availability/health-check)
+
+##### Enhanced Detailed logging
+Detailed logging is used in a lot of the cases for debugging issues. Now as well as enabling detailed logging globally (which can cause a huge overhead with lots of traffic), you can enable it for a single key, or specific APIs. 
+
+New detailed logging changes are available only to our Self-Managed customers currently.
+
+[Read More](/api-management/troubleshooting-debugging#capturing-detailed-logs)
+
+##### Weight-Based Load Balancing
+
+The Tyk Dashboard now allows you to control weighting of the upstreams, when using load balancing functionality. For example now you can configure Tyk to send 20% of traffic to one upstream, with 80% to another upstream service.
+
+This enables you to perform Canary or A/B tests of their APIs and services. Similarly, if caches require warming, then we can send a low % of traffic to these services, and when confident that they can handle the load, start incrementally sending a higher % of traffic to these services.
+
+[Read More](/planning-for-production/ensure-high-availability/load-balancing#load-balancing)
+
+##### Ability to shard analytics to different data-sinks
+
+In a multi-org deployment, each organization, team, or environment might have their preferred analytics tooling. At present, when sending analytics to the Tyk Pump, we do not discriminate analytics by org - meaning that we have to send all analytics to the same database - e.g. MongoDB. Now the Tyk Pump can be configured to send analytics for different organizations to different places. E.g. Org A can send their analytics to MongoDB + DataDog. But Org B can send their analytics to DataDog + expose the Prometheus metrics endpoint.
+
+It also becomes possible to put a <Tooltip tip="A list of blocked or denied items or entries">blocklist</Tooltip> in-place, meaning that some data sinks can receive information for all orgs, whereas others will not receive OrgA’s analytics if blocked.
+
+This change requires updating to new Tyk Pump 1.0
+
+[Read More](/api-management/tyk-pump#configuring-tyk-pump)
+
+##### 404 Error logging - unmatched paths
+
+Concerned that client’s are getting a 404 response? Could it be that the API definition or URL rewrites have been misconfigured? Telling Tyk to track 404 logs, will cause the Tyk Gateway to produce error logs showing that a particular resource has not been found. 
+
+The feature can be enabled by setting the config `track_404_logs` to `true` in the gateway's config file.
+
+
+#### Changelog
+- Fixed the bug when tokens created with non empty quota, and quota expiration set to `Never`, were treated as having unlimited quota. Now such tokens will stop working, once initial quota is reached. 
+
+#### Updated Versions
+
+- Tyk Dashboard 3.0
+- Tyk Pump 1.0
+
+#### Upgrading From Version 2.9
+
+No specific actions required.
+If you are upgrading from version 2.8, please [read this guide](/developer-support/release-notes/archived#upgrading-from-version-2-8)
+
+
+## Further Information
+
+### Upgrading Tyk
+Please refer to the [upgrading Tyk](/developer-support/upgrading) page for further guidance on the upgrade strategy.
+
+### API Documentation
+{/* Required. Update the link to the Gateway "tyk-gateway-api" or dashboard "tyk-dashboard-api" and the Postman collection
+
+If there were changes in any of Tyk’s API docs:
+
+- Have API endpoints been documented in the release note summary and changelog?				
+- Has a link to the endpoint documentation being included?
+- Has the benefit of the new/updated endpoint been explained in the release highlights and changelog? */}
+- [OpenAPI Document](/tyk-dashboard-api)
+- [Postman Collection](https://www.postman.com/tyk-technologies/workspace/tyk-public-workspace/overview)
+
+### FAQ
+
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
+
+
+
diff --git a/developer-support/release-notes/gateway.mdx b/developer-support/release-notes/gateway.mdx
new file mode 100644
index 0000000000..ec80b0adf8
--- /dev/null
+++ b/developer-support/release-notes/gateway.mdx
@@ -0,0 +1,9768 @@
+---
+title: "Tyk Gateway Release Notes"
+description: "Release notes documenting updates, enhancements, and changes for Tyk Gateway."
+keywords: "Tyk Gateway, Release notes, changelog"
+sidebarTitle: "Tyk Gateway"
+---
+
+**Open Source** ([Mozilla Public License](https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md))
+
+**This page contains all release notes for Tyk Gateway displayed in reverse chronological order**
+
+## Support Lifetime
+
+Only the most recent Tyk Gateway release and the most recent on the [Long Term Support (LTS)](/developer-support/release-types/long-term-support) branch are supported. We recommend staying current on the feature or LTS branch to minimise exposure to security vulnerabilities from third party dependencies.
+
+---
+
+## 5.14 Release Notes 
+
+### 5.14.0 Release Notes 
+
+#### Release Date 7 July 2026
+
+#### Release Highlights
+
+**OAuth 2.0 authentication with external Authorization Server**
+
+Tyk Gateway introduces a first-class OAuth 2.0 authentication method for Tyk OAS APIs, enabling token validation against an external Identity Provider such as Keycloak, Okta, or Auth0 that acts as the Authorization Server. Tyk acts as the OAuth 2.0 protected resource, validating inbound bearer tokens against the IdP's JWKS endpoint. It performs enforcement only and does not issue tokens.
+
+The new method supports **scope enforcement** at API, per-operation, and per-MCP-primitive granularity, giving you fine-grained access control over individual endpoints and tools without additional middleware. It is natively expressed through the standard `oauth2` security scheme in the Tyk OAS API definition, and replaces the deprecated [External OAuth](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated) method, which performed only limited token validation.
+
+This is also the foundation for Protected Resource Metadata and RFC 8693 Token Exchange, described below.
+
+**RFC 8693 Token Exchange for Upstream Authentication** *(Enterprise Edition)*
+
+When the inbound client token should not reach your upstream service, for example when an AI agent's SSO token needs to be replaced with a service-specific token carrying the correct audience and scopes, Tyk Gateway can perform an [RFC 8693 token exchange](https://datatracker.ietf.org/doc/html/rfc8693) transparently before forwarding the request. The original token is consumed at the Gateway; the upstream sees only the exchanged token.
+
+Token exchange is configured within the `oauth2` scheme and supports multiple named providers. Per-operation and per-MCP-primitive overrides allow a different audience and scope set for individual endpoints and tools. Exchanged tokens are cached to avoid a round-trip on every request, with a configurable safety margin to ensure upstream services always receive a valid token.
+
+**MCP Capability Discovery Aligned with Access Control**
+
+When an AI agent connects to an MCP proxy, it begins by discovering what tools, resources, and prompts are available. Previously, Tyk enforced allow and block rules only at invocation time: agents would discover capabilities they were not permitted to use and only encounter the restriction when they attempted to call them.
+
+The MCP proxy now filters the tool, resource, and prompt lists returned during capability discovery (`tools/list`, `resources/list`, `prompts/list`) and the `initialize` handshake using the same OAS-level rules. Agents see only what they are permitted to invoke, producing a cleaner agent experience and reducing unnecessary round-trips to Tyk Gateway.
+
+**Simplified Secrets and Certificate Management for Kubernetes Deployments**
+
+Local filesystem has been added to the [supported storage options](/tyk-configuration-reference/kv-store#supported-storage-options) for Key Value secret storage, using the `file://` and `$secret_file.` schema. This allows Tyk Gateway to resolve KV and secret references from the contents of a local file, such as a [Kubernetes Secret](https://kubernetes.io/docs/concepts/configuration/secret/) mounted on the Data Plane pod, without relying on third-party systems or environment variables.
+
+Building on this, API definitions can now reference a PEM-encoded certificate stored directly in a Key-Value store from any TLS certificate field. Rotating a certificate is then a matter of updating the value in the secret store and triggering a hot reload. No change to the API definition is required.
+
+**Other Changes**
+
+This release also delivers: granular enforced timeouts configurable in milliseconds, seconds, or minutes at both API and endpoint level; the original client request path recorded in OpenTelemetry spans, traffic logs, and access logs before any path stripping or rewriting; a configurable graceful shutdown delay to prevent `HTTP 502` errors during scale-down in high-traffic Kubernetes deployments; a Client IdP registry for centralized JWT Identity Provider management (Enterprise Edition); and standardized application log format aligned with other Tyk components - see [Breaking Changes](#breaking-changes) if your log parsing tools depend on the previous format.
+
+Notable fixes include: a Gateway crash under high authentication load; unbounded memory growth with CoProcess plugins and large sessions; and GraphQL API authentication headers not being forwarded upstream.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.14.0) below.
+
+#### Breaking Changes
+
+**Changes to application logs**
+
+This release makes changes to the format of Tyk Gateway application logs so that output is consistent with other Tyk components and aligned with industry observability standards.
+
+<Note>
+This is only a breaking change if you specifically rely on the current log format: for example, if your monitoring, parsing, or alerting tools are built around the existing timestamp format or the entire message.
+</Note>
+
+**Mitigation:** A new `legacy` option has been added to the [`log_format`](/tyk-oss-gateway/configuration#log_format) configuration. This setting preserves the format used in Tyk Gateway 5.13.0 and earlier, with the historical timestamp format and lack of a field identifying the originating API. The default value is `text`.
+
+#### Dependencies 
+<a id="dependencies-5.14.0"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :------ | :---------------- | :---------------- |
+| 5.14.0  | MDCB v2.12.0      | MDCB v2.12.0      |
+|         | Operator v1.4.2   | Operator v0.17    |
+|         | Sync v2.2.0       | Sync v2.2.0       |
+|         | Helm Chart v5.3.0 | Helm all versions |
+|         | Pump v1.16.0      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                   | Tested Versions     | Compatible Versions | Comments | 
+| :--------------------------------------- | :------------------ | :------------------ | :------- | 
+| [Golang](https://go.dev/dl/)             | 1.25                |  1.25               | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | | 
+| [Valkey](https://valkey.io/download/)    | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | 3.1.x, 3.0.x | 3.1.x, 3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+**Per-endpoint Enforced Timeout Configuration**
+
+The introduction of granular per-endpoint [enforced (request) timeouts](/planning-for-production/ensure-high-availability/enforced-timeouts) means that the existing controls (`value` for Tyk OAS and `timeout` for Tyk Classic) should now be considered as deprecated.
+
+For Tyk OAS APIs, the Gateway will automatically round this `duration` up to the nearest whole second and store that value in the original `value` field so that a timeout will continue to be enforced if that API is deployed to an older Gateway.
+
+This rounding up is not performed automatically for Tyk Classic APIs - the user must set `extended_paths.hard_timeouts.timeout` to ensure the timeout is enforced on older Gateways.
+
+
+#### Upgrade instructions
+<a id="upgrade-5.14.0"></a>
+
+If you are upgrading to 5.14.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.14.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.14.0
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+<Note>
+Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.14.0.
+</Note>
+
+- [Source code tarball of Tyk Gateway v5.14.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.14.0)
+
+#### Changelog
+<a id="Changelog-v5.14.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Added OAuth 2.0 authentication method for integration with external Authorization Server'>
+{/* TT-17172, TT-17173, TT-17174 */}
+A new **OAuth 2.0** authentication method is available for Tyk OAS APIs, enabling authentication against an external Identity Provider (IdP) such as Keycloak, Okta, or Auth0 that acts as the [OAuth 2.0 Authorization Server](https://datatracker.ietf.org/doc/html/rfc6749#section-1.1). Tyk acts as the OAuth 2.0 protected resource, validating inbound bearer tokens against the IdP's JWKS endpoint.
+
+<Note>
+This is distinct from [Tyk OAuth 2.0](/api-management/authentication/oauth-2), in which Tyk acts as the OAuth 2.0 Authorization Server and issues tokens to clients.
+
+It replaces and significantly improves upon the deprecated [External OAuth](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated) method, which performed limited validation of tokens provided by an external IdP.
+</Note>
+
+The OAuth 2.0 authentication method supports **scope enforcement** at the API, per-operation and per-MCP-primitive levels. This requires that inbound tokens carry specific OAuth scopes for fine-grained access control over individual endpoints and tools.
+
+The new auth method is natively integrated with the Tyk OAS API definition using the `oauth2` security scheme and is the foundation for scope enforcement, Protected Resource Metadata, and RFC 8693 Token Exchange.
+</Accordion>
+
+<Accordion title='Moved Protected Resource Metadata configuration into the OAuth 2.0 scheme'>
+{/* TT-17175, TT-17176 */}
+Protected Resource Metadata (PRM) configuration has moved from the top-level `authentication.protectedResourceMetadata` block into the `oauth2` scheme, under `authentication.securitySchemes[name].oauth2.protectedResourceMetadata`. This aligns PRM with the scheme it describes and allows each `oauth2` scheme to carry its own discovery configuration.
+
+A new `autoDeriveScopes` option automatically populates the PRM `scopes_supported` list from the API's OAS `security:` declarations, keeping the discovery document in sync with the API definition without manual maintenance.
+</Accordion>
+
+<Accordion title='Added RFC 8693 Token Exchange for upstream authentication'>
+{/* TT-17177, TT-17179 */}
+<Note>
+Enterprise Edition only
+</Note>
+
+Tyk Gateway supports RFC 8693 token exchange for upstream authentication. When configured, the Gateway exchanges the inbound client token for a new token issued by your identity provider before forwarding the request upstream; the original token never reaches the upstream service. This is particularly valuable for MCP flows where an AI agent's SSO token must be replaced with a service-specific token carrying the correct audience and scopes for the backend.
+
+Token exchange is configured within the `oauth2` scheme and supports multiple named providers, each with its own token endpoint, client credentials, and default target audience. Per-operation and per-MCP-primitive overrides allow a different audience and scope set for individual endpoints and tools.
+
+Exchanged tokens are cached using one of two models to avoid a round-trip to the identity provider on every request. A configurable safety margin causes tokens to be refreshed before they expire, ensuring upstream services always receive a valid token.
+</Accordion>
+
+<Accordion title='Local file-based KV/secret references'>
+{/* TT-17297 */}
+Local filesystem has been added to the [supported storage options](/tyk-configuration-reference/kv-store#supported-storage-options) for Key Value secret storage, using the `file://<key>` and `$secret_file.<key>` schema. This allows Gateway to resolve KV/secret references from the contents of a local file - such as [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) mounted on the Data Plane pod.
+
+The base path for all external `file` references must be configured in the Tyk Gateway config as [`kv.file.base_path`](/tyk-oss-gateway/configuration). This acts as an enable/disable control for external `file` references.
+
+Secrets and other environment specific values can be stored local to the Data Plane without the use of third party systems or environment variables. Trailing newlines are stripped by default and multi-line content is preserved. Secret rotations are picked up on API reload.
+</Accordion>
+
+<Accordion title='Certificates can be stored inline in the API definition'>
+{/* TT-17295 */}
+API definitions can now carry a PEM-encoded certificate as a string stored directly in any of the TLS certificate fields:
+- client certificates (`server.clientCertificates.allowlist`)
+- client CA certificates (`server.clientCertificates.clientCaCertificates`)
+- custom domain certificates (`server.customDomain.certificates`)
+- upstream client certificates (`upstream.mutualTLS.domainToCertificateMapping.certificate`)
+- upstream CA certificates (`upstream.tlsTransport.sslCertificates`)
+
+Whilst including the certificate in the API definition is not a recommended approach, this allows the PEM-encoded certificate to be stored directly in a Key-Value store and resolved into the API definition using the existing [KV reference system](/tyk-configuration-reference/kv-store#other-string-fields), keeping private key material out of the Control Plane. Changing the certificate stored as a "value" will ensure that Tyk automatically rotates to the new certificate when the API is reloaded.
+
+This is an alternative to the existing options of referencing a Tyk Certificate Store ID or a path to the certificate file on the local filesystem. Existing API definitions that reference certificates by ID or file path continue to work unchanged.
+</Accordion>
+
+<Accordion title='Granular enforced timeouts'>
+{/* TT-12339 */}
+You can now configure more granular [enforced (request) timeouts](/planning-for-production/ensure-high-availability/enforced-timeouts) using human-readable values such as `500ms`, `1.5s`, or `2m`.
+
+Configure the per-endpoint timeout in the Tyk Vendor Extension using the new `duration` field in the per-operation [`enforceTimeout`](/api-management/gateway-config-tyk-oas#enforcetimeout) object. This accepts human-readable durations in milliseconds, seconds, or minutes (for example `500ms`, `1.5s`, or `2m`).
+
+If using Tyk Classic APIs, the equivalent field name is `extended_paths.hard_timeouts.duration`. 
+
+The existing fields with a per-second granularity (`value` for Tyk OAS and `timeout` for Tyk Classic) should now be considered as deprecated, but remain fully compatible so existing API definitions continue to work unchanged.
+
+In a distributed (MDCB) deployment, the Control Plane will automatically round this `duration` up to the nearest whole second and store that value in the original `value` field so that a timeout will continue to be enforced if that API is deployed to an older Data Plane Gateway. This does not happen for Tyk Classic APIs, so you must remember to set the legacy field manually for the timeout to be enforced automatically on an older Data Plane Gateway.
+</Accordion>
+
+<Accordion title='New API-level enforced timeout configuration'>
+{/* TT-15813 */}
+You can now configure an [enforced (request) timeout](/planning-for-production/ensure-high-availability/enforced-timeouts) at API level. This API-level timeout takes precedence over the Gateway default (`proxy_default_timeout`). The more granular endpoint-level timeout overrides the API-level value.
+
+Configure the timeout in the Tyk Vendor Extension using [`upstream.enforceTimeout`](/api-management/gateway-config-tyk-oas#upstream) using human-readable durations in milliseconds, seconds, or minutes (for example `500ms`, `1.5s`, or `2m`).
+
+If using Tyk Classic APIs, the equivalent control is `global_enforce_timeout` in the `version_data` section.
+</Accordion>
+
+<Accordion title='Standardized application log format'>
+{/* TT-13727, TT-15935 */}
+We have made changes to the format of Tyk Gateway application logs to make them consistent with logs generated by other Tyk components and aligned with industry observability standards.
+
+- **RFC3339 timestamps:** Log entries now consistently use the industry-standard RFC3339 timestamp format (e.g. `2024-12-12T13:59:08Z`), previously a mix of timestamp formats was used.
+- **Log message field renamed:** The log message field is renamed from `msg` to `message`, for consistency with other Tyk components.
+- **Track 404 target:** A `host` field has been added to log entries for requests that generate `HTTP 404` errors. This records the Host header from the request, allowing users to distinguish whether the unmatched request was directed at the proxy API or the control API (if they are [configured on different ports](/planning-for-production#change-your-control-port))
+
+**Configuration**
+
+The [`log_format`](/tyk-oss-gateway/configuration#log_format) configuration option now accepts three explicit values:
+ 
+- `text`: plain-text logs in the new format introduced in this release (**new default**).
+- `json`: JSON logs in the new format.
+- `legacy`: preserves the format used in Gateway 5.13.0 and earlier, with the historical timestamp format and the `msg` field name.
+ 
+This is a **breaking change** for any user whose monitoring or log-parsing tools rely on the specific format of the Tyk Gateway application logs. If you require the previous timestamp format, the `msg` field name, or no `host` for HTTP 404 logs, you should set `log_format` to `legacy`.
+</Accordion>
+
+<Accordion title='Capture the original request path in analytics'>
+{/* TT-7519 */}
+The Gateway now records the original client request path, captured before any path stripping or URL rewriting, in logs. This allows you to tell which client-facing endpoint was called even when the request is transformed before reaching the upstream. 
+
+- The full path requested by the client is recorded as `original_path` in:
+  - OpenTelemetry span
+  - traffic logs
+  - access logs
+- The API listen path that was matched and indicates which API proxy was triggered is also now recorded in traffic logs, as `listen_path`. 
+- The existing `path` field is unchanged and continues to show the path sent to the upstream.
+</Accordion>
+
+<Accordion title='Added a configurable graceful shutdown delay'>
+{/* TT-16068 */}
+The Gateway can now wait for a configurable period after receiving a shutdown signal before it stops accepting new connections, giving load balancers and orchestrators time to detect that the node is no longer ready and remove it from the pool. This prevents the `HTTP 502` errors that could otherwise occur during scale-down in high-traffic deployments.
+
+A new [`graceful_shutdown_delay_seconds`](/tyk-oss-gateway/configuration) configuration option controls the wait (default: `0` seconds). As soon as a `SIGTERM`, `SIGINT`, or `SIGQUIT` is received, the readiness endpoint (`/ready`) immediately begins to return `503 Service Unavailable`, but the Gateway keeps accepting and serving traffic for the configured delay period. 
+
+Following the delay period, the existing [graceful shutdown](/planning-for-production/ensure-high-availability/graceful-shutdown#tyk-gateway) process continues.
+</Accordion>
+
+<Accordion title='Added Client IdP registry for JWT Authentication'>
+{/* TT-17312 */}
+<Note>
+Enterprise Edition only
+</Note>
+
+Tyk Gateway's authentication middleware provides support for JSON Web Token (JWT) [signature validation](/api-management/authentication/jwt-signature-validation#jwt-signature-fundamentals) against JSON Web Key Sets (JWKS) stored locally in the API definition or, more commonly, retrieved from the dedicated JWKS endpoint of a 3rd party Identity Provider (IdP) (the *issuer* of the token). Following signature validation, the claims within the JWT can be interrogated to identify scopes which are then used to identify the Policies that should be applied to the Session generated for the request. This scope-to-policy mapping is traditionally stored in the API definition.
+
+The new Client IdP registry extracts the IdP details (issuer value and JWKS endpoint) and the scope-to-policy mapping from the API definitions into a new registry that maps the IdP metadata against the API(s). When a request is received, the Gateway will first check any JWKS URLs and scope-to-policy mappings in the API definition (for backward compatibility) before checking the registry.
+
+This separation allows simpler and cleaner management of Identity Providers - modifying the metadata in the registry will automatically update the behavior of APIs without making any change to the API definitions themselves.
+
+The IdP registry exists as an in-memory table that is managed by the Tyk Dashboard.
+</Accordion>
+
+<Accordion title='Filter MCP capability discovery by OAS-level allow and block rules'>
+{/* TT-16823 */}
+The MCP proxy now filters the tool, resource, and prompt lists returned during capability discovery (`tools/list`, `resources/list`, `prompts/list`) and the `initialize` capability handshake using OAS-level allow and block rules configured in the MCP OAS definition.
+
+Previously, these rules were enforced at invocation time only: discovery responses passed through unfiltered from the upstream server, so agents would discover capabilities they could not use and only encounter the restriction when they tried to call them. Agents now see only the tools, resources, and prompts they are permitted to invoke.
+</Accordion>
+
+</AccordionGroup>
+
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed issue with Docker images incompatible with legacy registries and tools'>
+{/* TT-17333 */}
+Docker images published in v5.13.0 contained mixed layer compression: base image layers used zstd compression while Tyk application layers used gzip. This caused image copy and promotion failures with legacy Docker tooling, older registry versions, and some security scanners, with the error: `zstd compression is not officially supported for docker images`.
+
+All image layers are now uniformly compressed using `gzip`, restoring compatibility with `skopeo`, `oc image mirror`, and other tools that do not support OCI `zstd` compression.
+</Accordion>
+
+<Accordion title='Fixed issues with logging of HTTP 404 errors'>
+{/* TT-4023 */}
+When the Gateway control API is moved to a separate port via [`control_api_port`](/tyk-oss-gateway/configuration#control_api_port), requests to the proxy/data API port that did not match any configured API (generating an `HTTP 404` response) were silently dropped: no log entry was generated even with [`track_404_logs`](/tyk-oss-gateway/configuration#track_404_logs) enabled. This has been fixed; 404 logs are now correctly emitted for unmatched requests on all listening ports.
+</Accordion>
+
+<Accordion title='Fixed unbounded memory growth with CoProcess plugins and large sessions'>
+{/* TT-17049 */}
+We have resolved a risk of unbound memory consumption for APIs using gRPC plugins. The leak was due to an internal regular-expression cache that could grow without limit when Session access rights contained per-user URL patterns, and excessive memory churn when copying large sessions on every request. The fix bounds the maximum size of the cache and reuses Session objects to eliminate the churn. The Gateway now also aligns [`GOMAXPROCS`](https://pkg.go.dev/runtime#GOMAXPROCS) with the container's CPU quota at startup.
+
+This fix introduces the following new configuration options:
+
+- [`regexp_cache_max_entries`](/tyk-oss-gateway/configuration)  caps the regular-expression cache (default: `5000`)
+- [`disable_regexp_cache_bound`](/tyk-oss-gateway/configuration) restores the previous unbounded behavior for deployments with a naturally limited set of patterns (default:`false`)
+- [`disable_auto_max_procs`](/tyk-oss-gateway/configuration) restores the previous default behavior of GOMAXPROCS (default:`false`)
+</Accordion>
+
+<Accordion title='Fixed Gateway crash under high authentication load'>
+{/* TT-5486 */}
+Under sustained high-concurrency traffic to OIDC, JWT, or Auth-key protected APIs - particularly when the local session cache was disabled - the Gateway could crash with a fatal `concurrent map iteration and map write` panic. This caused unexpected pod restarts, in-flight request loss, and intermittent cluster instability.
+
+This has been fixed. The temporary workaround of enabling the local session cache (`disable_cached_session_state: false`) is no longer required.
+</Accordion>
+
+<Accordion title='Fixed issues with the use of short API keys'>
+{/* TT-17065 */}
+The Gateway's [`min_token_length`](/tyk-oss-gateway/configuration#min_token_length) configuration is intended to prevent the use of API tokens (keys) that are insecure due to their length. All tokens presented during a request to an API are checked against this value and immediately rejected with `HTTP 403` if shorter than the configured minimum length.
+
+Previously, a token with length *equal* to `min_token_length` would be rejected with `HTTP 403`, which is non-intuitive and can lead to wasted debugging time.
+
+Also, it was possible to [create a custom key](https://tyk.io/docs/api-reference/keys/create-custom-key-import-key) shorter than the configured minimum length. The Session would be created, but the key would be unusable as any attempt to use it in a request would be rejected due to the token's length.
+
+Now, tokens with length exactly equal to `min_token_length` are correctly accepted and an attempt to create a custom key shorter than `min_token_length` fails immediately with a `400 Bad Request`.
+</Accordion>
+
+<Accordion title='Fixed GraphQL API authentication headers not being forwarded upstream'>
+{/* TT-16017, TT-17442 */}
+We have resolved an issue where, when a GraphQL API was configured with `strip_auth_data` set to `false`, the client's authentication header (for example `Authorization`, or a custom header such as `X-API-KEY`) was not forwarded to the upstream service. This affected all GraphQL execution modes (proxy-only (including WebSocket subscriptions), subgraph, Universal Data Graph, and supergraph) leaving upstream services that require the header unable to authenticate the request.
+
+The active authentication method's header is now propagated upstream across all execution modes, with only the active method's header forwarded. In addition, upstream WebSocket connections for subscriptions are no longer reused across clients presenting different credentials, so each subscription carries its own authentication header, and one client's token can no longer leak to another. When `strip_auth_data` is `true`, no authentication headers are forwarded, as before.
+</Accordion>
+
+<Accordion title='Fixed MCP distributed trace blind spot enabling request tracing end-to-end from agent through Tyk to upstream MCP server'>
+{/* TT-17356 */}
+When an AI agent made a request through a Tyk MCP proxy, Tyk's spans, access logs, and analytics records were disconnected from the agent's distributed trace. This was because AI agents using MCP pass their trace context inside the JSON-RPC message body (`params._meta`) rather than the HTTP header - Tyk was only looking at the HTTP header, so it missed the agent's trace ID and started a fresh one.
+
+This made it impossible to correlate what Tyk did with the agent's journey using a single trace ID, forcing operators to reconstruct Tyk's role manually from timestamps rather than following one trace end-to-end.
+</Accordion>
+
+<Accordion title='Fixed a change in behavior of health endpoints for Control Plane Gateway when Redis goes down'>
+{/* TT-17486 */}
+Tyk 5.8.14 introduced a change in the behavior of the health endpoints when Tyk Gateway is deployed in the Control Plane. If Redis goes down and the Tyk Dashboard is still available, the Gateway's health endpoints can incorrectly report that everything is healthy.
+
+The Gateway regularly polls for the availability of Dashboard and Redis, caching the status and reporting this when the health endpoints are called. The cache is only updated once both checks are complete and, as a side effect of the fix applied in 5.8.14 to address an issue with the Gateway registration with Dashboard, it was possible for the checks to loop infinitely until Redis was available, such that the cached status was never updated with a "Redis down" message.
+
+The Control Plane Gateway's health endpoints now correctly report the most recent snapshot of Dashboard and Redis availability.
+</Accordion>
+
+</AccordionGroup>
+
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:
+
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33813" target="_blank">CVE-2026-33813</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46599" target="_blank">CVE-2026-46599</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45447" target="_blank">CVE-2026-45447</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34180" target="_blank">CVE-2026-34180</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45445" target="_blank">CVE-2026-45445</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-7383" target="_blank">CVE-2026-7383</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-9076" target="_blank">CVE-2026-9076</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46602" target="_blank">CVE-2026-46602</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46604" target="_blank">CVE-2026-46604</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42500" target="_blank">CVE-2026-42500</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41889" target="_blank">CVE-2026-41889</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+- <a href="https://osv.dev/vulnerability/GHSA-j88v-2chj-qfwx" target="_blank">GHSA-j88v-2chj-qfwx</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+
+## 5.13 Release Notes 
+
+### 5.13.2 Release Notes 
+
+#### Release Date 26 August 2026
+
+#### Release Highlights
+
+This patch introduces the next-generation (`-ng`) plugin compiler with native arm64 support, alongside several changes and fixes to improve the stability and correct the behavior of the Gateway.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.13.2) below.
+
+#### Breaking Changes
+
+This release moves to Go 1.26, please ensure that your custom Go plugins are rebuilt for compatibility.
+
+
+#### Dependencies 
+<a id="dependencies-5.13.2"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :------ | :---------------- | :---------------- |
+| 5.13.2  | MDCB v2.13.0      | MDCB v2.13.0      |
+|         | Operator v1.5.0   | Operator v0.17    |
+|         | Sync v2.2.2       | Sync v2.2.2       |
+|         | Helm Chart v5.4.0 | Helm all versions |
+|         | Pump v1.17.0      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                   | Tested Versions     | Compatible Versions | Comments | 
+| :--------------------------------------- | :------------------ | :------------------ | :------- | 
+| [Golang](https://go.dev/dl/)             | 1.26                |  1.26               | [Go plugins](/api-management/plugins/golang) must be built using Go 1.26 | 
+| [Redis](https://redis.io/download/)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | | 
+| [Valkey](https://valkey.io/download/)    | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | 3.1.x, 3.0.x | 3.1.x, 3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.13.2"></a>
+
+If you are upgrading to 5.13.2, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.13.2)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.13.2
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+- [Source code tarball of Tyk Gateway v5.13.2](https://github.com/TykTechnologies/tyk/releases/tag/v5.13.2)
+
+#### Changelog
+<a id="Changelog-v5.13.2" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated Golang version to 1.26'>
+{/* TT-17868 */}
+Tyk Gateway has been updated to build with Go 1.26, keeping the toolchain current with upstream Go security and performance updates.
+</Accordion>
+
+</AccordionGroup>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Next-generation (-ng) plugin compiler with native arm64 support'>
+{/* TT-9550, TT-17641 */}
+A new next-generation (`-ng`) plugin compiler is now available, as an alternative to the existing compiler.
+
+This image significantly reduces the OS-level CVE surface compared to the current compiler, and adds native `linux/arm64` support. Plugins built on Apple Silicon or other arm64 hosts no longer need to run the compiler under emulation.
+CE, EE, and FIPS variants are available with the `-ng` tag suffix.
+
+For more details see [Golang Plugin Compiler](/api-management/plugins/golang#plugin-compiler).
+</Accordion>
+ 
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed invalid JSON in request validation error responses'>
+{/* TT-14798 */}
+We have resolved an issue where error responses from Tyk's OAS request validation middleware could contain invalid JSON when the underlying error message included an apostrophe or other special character, for example when an OpenAPI schema's regex pattern contained a single quote. These responses are now automatically escaped to ensure they are valid JSON, so downstream systems parsing them no longer fail. XML and SOAP+XML error responses are unaffected.
+</Accordion>
+
+<Accordion title='Fixed GraphQL Playground failing to load the schema for authenticated APIs'>
+{/* TT-15516 */}
+We have resolved an issue where the GraphQL Playground could not load the schema (Docs and Explorer) for a GraphQL API that requires authentication, even after supplying valid credentials in the Playground's Request Headers editor.
+
+The Playground now re-runs schema introspection whenever the selected API or the supplied headers change, and clears the schema if credentials are invalid, removed, or introspection is disabled for that key.
+</Accordion>
+
+<Accordion title='Reduced noisy error logging for JWT scope-to-policy mapping'>
+{/* TT-5893 */}
+When using JWT scope-to-policy mapping, a token's scopes that don't match any policy are now logged at `debug` level, provided at least one scope successfully matched a policy. Previously, an `error` log was generated for every unmatched scope even when the request was authorized successfully, flooding logs unnecessarily. If none of a token's scopes match any policy, this is still logged as an `error` and the request is rejected. Unmatched scopes are now consolidated into a single log entry rather than one per scope.
+</Accordion>
+
+<Accordion title='Fixed a problem when deleting Sessions under heavy load'>
+{/* TT-16259 */}
+We have resolved a race condition between Session update and Session delete operations that, under heavy load, could either prevent a Session from being deleted, or leave it appearing deleted on the Control Plane while still valid on the Data Plane. This was seen with Sessions containing a usage quota. 
+
+Session deletion now completes reliably under load, and deleted Sessions are immediately invalidated across both Control and Data Planes.
+</Accordion>
+
+<Accordion title='Fixed formatting issue for shutdown signal log entry'>
+{/* TT-17316 */}
+We have resolved an issue where the log entry produced when the Gateway received a `SIGINT`, `SIGTERM`, or `SIGQUIT` shutdown signal did not follow the configured `log_format`. The shutdown signal is now logged in the configured format like any other application log entry.
+</Accordion>
+
+<Accordion title='Fixed cross-user credential and response leakage in GraphQL APIs with per-request auth propagation'>
+{/* TT-17921 */}
+Resolved an issue affecting GraphQL APIs configured with per-request auth propagation (strip_auth_data: false). This affected proxy-only, Universal Data Graph (UDG), and federated supergraph execution modes: under certain conditions, the Gateway could apply one caller's authentication header (for example a JWT or API key) to a request made on behalf of a different caller.
+
+In federated supergraph configurations specifically, identical GraphQL queries from different callers could also receive each other's response, since matching requests were deduplicated before each caller's authorization context was taken into account.
+
+Authorization context is now strictly isolated per caller: each request's authentication header is resolved and applied at request time instead of being cached with the execution plan, and supergraph response deduplication is now partitioned by the caller's authorization context so responses are never shared across users. If you run GraphQL APIs — proxy-only, UDG, or federated supergraph — with strip_auth_data: false, we strongly recommend upgrading as soon as possible.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:
+- <a href="https://osv.dev/vulnerability/GHSA-r277-6w6q-xmqw" target="_blank">GHSA-r277-6w6q-xmqw</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39822" target="_blank">CVE-2026-39822</a>
+- <a href="https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf" target="_blank">GHSA-hrxh-6v49-42gf</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46384" target="_blank">CVE-2026-46384</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46385" target="_blank">CVE-2026-46385</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41178" target="_blank">CVE-2026-41178</a>
+- <a href="https://osv.dev/vulnerability/GHSA-jpcw-4wr7-c3vq" target="_blank">GHSA-jpcw-4wr7-c3vq</a>
+</Accordion>
+</AccordionGroup>
+
+
+### 5.13.1 Release Notes 
+
+#### Release Date 2 July 2026
+
+#### Release Highlights
+
+This patch implements several changes and fixes to improve the stability and correct the behavior of the Gateway.
+
+The default content of application logs has been updated with RFC3339 format timestamp and consistent formatting with other components. This could be a **breaking change** for any user whose tooling relies on the specific content of application logs. A legacy mode is available, as described below.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.13.1) below.
+
+#### Breaking Changes
+
+**Changes to application logs**
+
+This release makes changes to the format of Tyk Gateway application logs so that output is consistent with other Tyk components and aligned with industry observability standards.
+
+<Note>
+This is only a breaking change if you specifically rely on the current log format: for example, if your monitoring, parsing, or alerting tools are built around the existing timestamp format or the entire message.
+</Note>
+
+**Mitigation:** A new `legacy` option has been added to the [`log_format`](/tyk-oss-gateway/configuration#log_format) configuration. This setting preserves the format used in Tyk Gateway 5.13.0 and earlier, with the historical timestamp format and lack of a field identifying for the originating API.
+
+
+#### Dependencies 
+<a id="dependencies-5.13.1"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :------ | :---------------- | :---------------- |
+| 5.13.1  | MDCB v2.12.0      | MDCB v2.12.0      |
+|         | Operator v1.4.2   | Operator v0.17    |
+|         | Sync v2.2.0       | Sync v2.2.0       |
+|         | Helm Chart v5.3.0 | Helm all versions |
+|         | Pump v1.16.0      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                   | Tested Versions     | Compatible Versions | Comments | 
+| :--------------------------------------- | :------------------ | :------------------ | :------- | 
+| [Golang](https://go.dev/dl/)             | 1.25                |  1.25               | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)   | | 
+| [Valkey](https://valkey.io/download/)    | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | 3.1.x, 3.0.x | 3.1.x, 3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.13.1"></a>
+
+If you are upgrading to 5.13.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.13.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.13.1
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+- [Source code tarball of Tyk Gateway v5.13.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.13.1)
+
+#### Changelog
+<a id="Changelog-v5.13.1" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed issue with Docker images incompatible with legacy registries and tools'>
+{/* TT-17333 */}
+Docker images published in v5.13.0 contained mixed layer compression — base image layers used zstd compression while Tyk application layers used gzip. This caused image copy and promotion failures with legacy Docker tooling, older registry versions, and some security scanners, with the error: `zstd compression is not officially supported for docker images`.
+
+All image layers are now uniformly compressed using `gzip`, restoring compatibility with `skopeo`, `oc image mirror`, and other tools that do not support OCI `zstd` compression.
+</Accordion>
+
+<Accordion title='Standardized application log format'>
+{/* TT-13727 */}
+We have made changes to the format of Tyk Gateway application logs to make them consistent with logs generated by other Tyk components and aligned with industry observability standards.
+
+- **RFC3339 timestamps:** Log entries now consistently use the industry-standard RFC3339 timestamp format (e.g. `2024-12-12T13:59:08Z`), previously a mix of timestamp formats was used.
+
+**Configuration**
+
+The [`log_format`](/tyk-oss-gateway/configuration#log_format) configuration option now accepts three explicit values:
+ 
+- `text`: plain-text logs in the new format introduced in this release (**new default**).
+- `json`: JSON logs in the new format.
+- `legacy`: preserves the format used in Gateway 5.13.0 and earlier, with the historical timestamp format.
+ 
+This is a **breaking change** for any user whose monitoring or log-parsing tools rely on the specific format of the Tyk Gateway application logs. If you require the previous timestamp format, you should set `log_format` to `legacy`.
+</Accordion>
+
+<Accordion title='Fixed MCP distributed trace blind spot enabling request tracing end-to-end from agent through Tyk to upstream MCP server'>
+{/* TT-17356 */}
+When an AI agent made a request through a Tyk MCP proxy, Tyk's spans, access logs, and analytics records were disconnected from the agent's distributed trace. This was because AI agents using MCP pass their trace context inside the JSON-RPC message body (`params._meta`) rather than the HTTP header - Tyk was only looking at the HTTP header, so it missed the agent's trace ID and started a fresh one. This made it impossible to correlate what Tyk did with the agent's journey using a single trace ID, forcing operators to reconstruct Tyk's role manually from timestamps rather than following one trace end-to-end.
+</Accordion>
+
+<Accordion title='Fixed issues with logging of HTTP 404 errors'>
+{/* TT-4023 */}
+When the Gateway control API is moved to a separate port via [`control_api_port`](/tyk-oss-gateway/configuration#control_api_port), requests to the proxy/data API port that did not match any configured API (generating an `HTTP 404` response) were silently dropped: no log entry was generated even with [`track_404_logs`](/tyk-oss-gateway/configuration#track_404_logs) enabled. This has been fixed; 404 logs are now correctly emitted for unmatched requests on all listening ports.
+
+Additionally, a `host` field has been added to 404 log entries (when using `text` or `json` [`log_format`](/tyk-oss-gateway/configuration#log_format)). This records the Host header from the request, allowing users to distinguish whether the unmatched request was directed at the proxy API or the control API.
+</Accordion>
+
+<Accordion title='Fixed unbounded memory growth with CoProcess plugins and large sessions'>
+{/* TT-17049 */}
+Resolved a risk of unbound memory consumption for APIs using gRPC plugins. The leak was due to an internal regular-expression cache that could grow without limit when Session access rights contained per-user URL patterns, and excessive memory churn when copying large sessions on every request. The fix bounds the maximum size of the cache and reuses Session objects to eliminate the churn. The Gateway now also aligns [`GOMAXPROCS`](https://pkg.go.dev/runtime#GOMAXPROCS) with the container's CPU quota at startup.
+
+This fix introduces the following new configuration options:
+
+- [`regexp_cache_max_entries`](/tyk-oss-gateway/configuration)  caps the regular-expression cache (default: `5000`)
+- [`disable_regexp_cache_bound`](/tyk-oss-gateway/configuration) restores the previous unbounded behaviour for deployments with a naturally limited set of patterns (default:`false`)
+- [`disable_auto_max_procs`](/tyk-oss-gateway/configuration) restores the previous default behavior of GOMAXPROCS (default:`false`)
+</Accordion>
+
+<Accordion title='Fixed Gateway crash under high authentication load'>
+{/* TT-5486 */}
+Under sustained high-concurrency traffic to OIDC, JWT, or Auth-key protected APIs - particularly when the local session cache was disabled - the Gateway could crash with a fatal `concurrent map iteration and map write` panic. This caused unexpected pod restarts, in-flight request loss, and intermittent cluster instability.
+
+This has been fixed. The temporary workaround of enabling the local session cache (`disable_cached_session_state: false`) is no longer required.
+</Accordion>
+
+<Accordion title='Fixed issues with the use of short API keys'>
+{/* TT-17065 */}
+The Gateway's [`min_token_length`](/tyk-oss-gateway/configuration#min_token_length) configuration is intended to prevent the use of API tokens (keys) that are insecure due to their length. All tokens presented during a request to an API are checked against this value and immediately rejected with `HTTP 403` if shorter than the configured minimum length.
+
+Previously, a token with length *equal* to `min_token_length` would be rejected with `HTTP 403`, which is non-intuitive and can lead to wasted debugging time.
+
+Also, it was possible to [create a custom key](https://tyk.io/docs/api-reference/keys/create-custom-key-import-key) shorter than the configured minimum length. The Session would be created, but the key would be unusable as any attempt to use it in a request would be rejected due to the token's length.
+
+Now, tokens with length exactly equal to `min_token_length` are correctly accepted and an attempt to create a custom key shorter than `min_token_length` fails immediately with a `400 Bad Request`.
+</Accordion>
+
+<Accordion title='Fixed GraphQL API authentication headers not being forwarded upstream'>
+{/* TT-16017, TT-17442 */}
+Resolved an issue where, when a GraphQL API was configured with `strip_auth_data` set to `false`, the client's authentication header (for example `Authorization`, or a custom header such as `X-API-KEY`) was not forwarded to the upstream service. This affected all GraphQL execution modes (proxy-only (including WebSocket subscriptions), subgraph, Universal Data Graph, and supergraph) leaving upstream services that require the header unable to authenticate the request.
+
+The active authentication method's header is now propagated upstream across all execution modes, with only the active method's header forwarded. In addition, upstream WebSocket connections for subscriptions are no longer reused across clients presenting different credentials, so each subscription carries its own authentication header, and one client's token can no longer leak to another. When `strip_auth_data` is `true`, no authentication headers are forwarded, as before.
+</Accordion>
+
+<Accordion title='Fixed a change in behavior of health endpoints for Control Plane Gateway when Redis goes down'>
+{/* TT-17486 */}
+Tyk 5.8.14 introduced a change in the behavior of the health endpoints when Tyk Gateway is deployed in the Control Plane. If Redis goes down and the Tyk Dashboard is still available, the Gateway's health endpoints can incorrectly report that everything is healthy.
+
+The Gateway regularly polls for the availability of Dashboard and Redis, caching the status and reporting this when the health endpoints are called. The cache is only updated once both checks are complete and, as a side effect of the fix applied in 5.8.14 to address an issue with the Gateway registration with Dashboard, it was possible for the checks to loop infinitely until Redis was available, such that the cached status was never updated with a "Redis down" message.
+
+The Control Plane Gateway's health endpoints now correctly report the most recent snapshot of Dashboard and Redis availability.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46599" target="_blank">CVE-2026-46599</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42500" target="_blank">CVE-2026-42500</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41889" target="_blank">CVE-2026-41889</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+- <a href="https://osv.dev/vulnerability/GHSA-j88v-2chj-qfwx" target="_blank">GHSA-j88v-2chj-qfwx</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.13.0 Release Notes 
+
+#### Release Date 19 May 2026
+
+#### Release Highlights
+
+Tyk 5.13.0 introduces MCP (Model Context Protocol) Gateway support, bringing AI agent tool servers into Tyk's API management platform. This release also completes Tyk's observability stack with full OpenTelemetry metrics export, and delivers a comprehensive API error response customization system.
+
+**Gateway support for MCP**
+
+We have introduced the MCP (Model Context Protocol) Gateway, enabling teams to proxy, secure, and manage AI agent tool servers within Tyk API management.
+
+The MCP Gateway is not a new component - the capabilities are generally available in this release of Tyk Gateway.
+
+MCP Proxies support Server-Sent Events (SSE) streaming, enabling long-lived agent sessions that survive beyond the configured write timeout. A configurable idle timeout terminates stale SSE streams cleanly, and the Gateway sends a structured error event to the client when an upstream connection drops unexpectedly.
+
+Tool-Based Access Control (TBAC) enforces fine-grained access rules at two levels: JSON-RPC method level (e.g., `tools/call`, `resources/read`) and MCP primitive level (individual tool, resource, or prompt by name).
+
+Per-primitive rate limiting sets independent rate limits for each method or named primitive within a Session or Policy. When multiple Policies apply, access lists merge as a union and rate limits use the most permissive value.
+
+MCP traffic appears in Gateway access logs with dedicated fields (`mcp_method`, `mcp_primitive_type`, `mcp_primitive_name`) alongside a new `api_type` field present on all access log entries.
+
+OpenTelemetry custom metrics expose the same four MCP dimensions, including `mcp_error_code`, aligned with the OpenTelemetry `mcp.*` semantic conventions.
+
+**Complete Observability with OpenTelemetry Metrics**
+
+We have introduced comprehensive real-time metrics export through OpenTelemetry, completing Tyk's observability stack alongside existing distributed tracing and logging.
+
+Teams have complete operational visibility with automatic RED metrics (Rate, Errors, Duration), Go runtime health monitoring, and configuration state tracking.
+
+The new custom metrics framework enables multi-tenant billing, tier-based SLOs, and business KPI tracking through configurable dimensions sourced from request headers, JWT claims, session data, and API metadata. Built-in cardinality controls and metric-to-trace correlation through exemplars ensure production-ready performance while enabling seamless navigation from metric anomalies to specific traces during incident investigation.
+
+**Fully Customizable API Error Responses**
+
+Transform your API's error experience with the new comprehensive [error override](/api-management/custom-error-responses#error-overrides) system. This feature provides complete control over HTTP error responses from both the Gateway and upstream services, enabling standardized, branded error formats that guide users toward solutions rather than leaving them confused.
+
+Configure error overrides at multiple levels - globally and per API - with flexible matching by status codes, error types, message patterns, or response content. Support for dynamic templates with validation context enables RFC 7807 compliance and actionable error feedback, while seamless integration with existing analytics and logging ensures complete observability of overridden responses.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.13.0) below.
+
+#### Breaking Changes
+
+**Default maximum and minimum TLS versions** are now inherited from the underlying Golang library and so will be TLS 1.3 and TLS 1.2, respectively (previously were both set to TLS 1.2).
+
+You must set [http_server_options.max_version](/tyk-oss-gateway/configuration#http_server_options-max_version) (or the equivalent environment variable)  to `771` if you require an upper limit of TLS 1.2.
+
+  See [here](/api-management/implement-tls#controlling-tls-version-and-cipher-suites) for details how to control TLS version and cipher suites.
+
+**Query parameters from original request are no longer automatically preserved when looping using `tyk://` protocol)**
+
+We have fixed an inconsistent behavior when using the URL rewrite middleware to loop requests using the Tyk protocol (`tyk://api-id/path`).
+
+Previously, query parameters added to the `rewrite_to` URL were silently dropped, while original request parameters were automatically preserved in the looped request.
+
+This behavior was inconsistent with standard HTTP URL rewrites and prevented proper parameter transformation during internal API routing.
+
+**Impact**
+- Original request query parameters are no longer automatically forwarded through internal loops
+- Existing URL rewrite configurations may lose query parameters that were previously passed through automatically
+- APIs relying on automatic parameter forwarding will receive incomplete requests
+
+**Migration Required**
+Update your URL rewrite configurations to **explicitly include** any original query parameters you want to preserve. For example:
+- **Before:** `"rewrite_to": "tyk://api-123/endpoint"` (original params auto-forwarded)
+- **After:** `"rewrite_to": "tyk://api-123/endpoint?param1=$tyk_context.request_data.param1"`
+
+**Strict Validation of Characters Allowed in Policy IDs**
+
+To avoid an issue where Policy IDs containing special characters could cause problems when parsing API endpoint requests, we have introduced strict validation of Policy IDs during Policy creation and update.
+
+The allowed characters are:
+- alphanumeric characters
+- `_`
+- `-`
+- `.`
+- `~`
+
+Strict validation can be disabled, if required for existing Policies with incompatible Policy IDs, using the new Gateway configuration `allow_unsafe_policy_ids`. If using this mode, care must be taken not to use characters that could affect URL parsing.
+
+#### Dependencies 
+<a id="dependencies-5.13.0"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|---- |
+| 5.13.0 | MDCB v2.11.0       | MDCB v2.11.0 |
+|        | Operator v1.4.0   | Operator v0.17 |
+|        | Sync v2.1.8       | Sync v2.1.0 |
+|        | Helm Chart v5.2.0   | Helm all versions |
+|        | Pump v1.15.0      | Pump all versions |
+
+<Note>
+To use MCP Gateway features introduced in 5.13.0, upgrade the following Tyk components at the same time:
+
+- **Dashboard 5.13.0**: MCP Proxy management and access control configuration
+- **Pump 1.15.0**: MCP analytics (MongoDB, PostgreSQL, Elasticsearch, and Prometheus backends)
+- **MDCB 2.11.0**: MCP analytics routing in distributed deployments
+- **Operator 1.4.0**: MCP Proxy management via Kubernetes CRDs
+- **Sync 2.1.7**: MCP Proxy support in `dump` and `sync` operations
+</Note>
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [Golang](https://go.dev/dl/)               | 1.25                   |  1.25  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | 3.1.x, 3.0.x | 3.1.x, 3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.13.0"></a>
+
+If you are upgrading to 5.13.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+If your deployment uses MCP Gateway, additional component ordering applies. In distributed deployments, MDCB 2.11.0 must be deployed before Gateway and Dashboard. Tyk Operator 1.4.0 must be deployed after Gateway and Dashboard are running. See [MCP Gateway upgrade considerations](/developer-support/upgrading#mcp-upgrade-considerations) for the full sequence.
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.13.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.13.0
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+<Note>
+Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.13.0.
+</Note>
+
+- [Source code tarball of Tyk Gateway v5.13.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.13.0)
+
+#### Changelog
+<a id="Changelog-v5.13.0" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Upgrade OpenTelemetry SDK dependencies'>
+We have updated all OpenTelemetry Go SDK dependencies to their latest compatible versions, addressing significant version skew across core packages, OTLP exporters, and contrib instrumentation libraries.
+
+The upgrade delivers cumulative performance improvements to span lifecycle methods, trace context propagation, metrics recording, and attribute handling that benefit hot paths exercised on every HTTP request. This change maintains full backward compatibility with existing functionality and serves as a prerequisite for upcoming metrics features.
+</Accordion>
+
+</AccordionGroup>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Add MCP Gateway'>
+We have introduced the MCP (Model Context Protocol) Gateway, enabling teams to proxy, secure, and manage AI agent tool servers using Tyk API management. MCP Proxy definitions use OpenAPI Specification (OAS) format and support the JSON-RPC over HTTP transport used by MCP clients and servers.
+
+This release includes:
+- **SSE streaming**: MCP Proxies support long-lived Server-Sent Events connections. The write deadline is cleared for SSE streams so connections survive beyond the configured write timeout. A structured `event: error` message is sent to the client if the upstream connection drops unexpectedly.
+- **Protected Resource Metadata (PRM)**: The `/.well-known/oauth-protected-resource` endpoint is served as a middleware in the Gateway chain, making `$tyk_context.*` substitution variables available for use in PRM resource field values.
+
+For configuration details, see the [MCP Gateway documentation](/ai-management/mcp-gateway/overview).
+</Accordion>
+
+<Accordion title='Add Tool-Based Access Control (TBAC) for MCP Proxies'>
+MCP Proxies support granular access control at the JSON-RPC method and MCP primitive levels. Two new middleware components enforce access rules independently for each request:
+
+- **JSON-RPC method access control**: Allows or denies requests by method name (e.g., `tools/call`, `resources/read`, `prompts/get`). Configured via `json_rpc_methods_access_rights` in a key or policy access definition.
+- **MCP primitive access control**: Allows or denies requests by primitive type (tool, resource, or prompt) and name. Configured via `mcp_access_rights` in a key or policy access definition.
+
+When multiple policies apply to a key, access control lists merge using union semantics: a primitive allowed by any policy is accessible. Block rules take precedence over allow rules. Denied requests receive a JSON-RPC error response rather than an HTTP error, maintaining protocol compatibility with MCP clients.
+
+For configuration details, see the [MCP proxy policies documentation](/ai-management/mcp-gateway/policies).
+</Accordion>
+
+<Accordion title='Add per-primitive rate limiting for MCP Proxies'>
+MCP Proxies support independent rate limits for each JSON-RPC method and for individual tools, resources, and prompts. Two new fields are available in key and policy access definitions:
+
+- `json_rpc_methods`: rate limits keyed by JSON-RPC method name (e.g., `tools/call`)
+- `mcp_primitives`: rate limits keyed by primitive type and name
+
+Limits are translated into Virtual Endpoint Method (VEM) entries at session load time and enforced by the existing rate limiting middleware with no additional processing overhead. The translation is in-memory only and is never persisted to Redis.
+
+When multiple Policies apply to a Session, rate limits merge using most-permissive semantics: the highest rate allowed by any Policy applies.
+
+For configuration details, see the [MCP Proxy policies documentation](/ai-management/mcp-gateway/policies).
+</Accordion>
+
+<Accordion title='Add MCP-specific fields to Gateway access logs'>
+Gateway access logs now include MCP-specific fields for requests handled by MCP Proxies:
+
+- `mcp_method`: the JSON-RPC method name (e.g., `tools/call`)
+- `mcp_primitive_type`: the primitive category (`tool`, `resource`, or `prompt`)
+- `mcp_primitive_name`: the name of the specific tool, resource, or prompt invoked
+
+A new `api_type` field is also added to all access log entries, distinguishing MCP traffic from `classic`, `oas`, and `graphql` API types.
+
+For details, see the [MCP access logs documentation](/ai-management/mcp-gateway/mcp-access-logs).
+</Accordion>
+
+<Accordion title='Add MCP dimensions to OpenTelemetry custom metrics'>
+OpenTelemetry custom metrics now expose four MCP-specific dimensions, enabling observability of MCP Proxy traffic through configurable metric instruments:
+
+- `mcp_method`: the JSON-RPC method name
+- `mcp_primitive_type`: the primitive category (tool, resource, or prompt)
+- `mcp_primitive_name`: the name of the specific primitive invoked
+- `mcp_error_code`: the JSON-RPC error code when an error is returned; empty otherwise
+
+The dimensions are aligned with the OpenTelemetry `mcp.*` semantic conventions. MCP context is propagated before access control runs, so rejected requests still carry full MCP dimension data.
+
+For details, see the [MCP metrics documentation](/ai-management/mcp-gateway/mcp-metrics).
+</Accordion>
+
+<Accordion title='Fully customizable API error responses'>
+We have uplifted the existing error response templating system with a new comprehensive mechanism to customize HTTP error responses generated by both the Tyk Gateway and upstream services.
+
+This allows users to fully control error responses to standardize formats, mask sensitive information, and comply with industry standards.
+
+**Key capabilities:**
+- **Multi-level Configuration:** Configure error overrides globally (Gateway-wide), or per API with clear precedence rules
+- **Flexible Matching:** Target errors by exact status codes (401, 500), patterns (4xx, 5xx), error flags, message patterns, or response body content
+- **Rich Response Customization:** Override status codes, response bodies, headers, and use template files with dynamic variables
+- **Universal Coverage:** Customize both Gateway-generated errors (authentication, rate limiting, validation) and upstream service errors (4xx/5xx responses)
+
+**Configuration:** Error overrides use a map-based structure indexed by HTTP status code in the new [error_overrides](/tyk-oss-gateway/configuration#error_overrides) configuration.
+
+**Template Support:** Response templates support dynamic variables including `{{.StatusCode}}`, `{{.Message}}`, and validation-specific context like `{{.InvalidParams}}` for detailed error feedback.
+
+**Precedence Order:**
+1. API-level overrides
+2. Gateway-level overrides
+3. Default Tyk responses (fallback)
+
+**Supported Error Types:**
+- Gateway errors: Authentication failures, rate limits, validation errors, transform failures
+- Proxy errors: DNS failures, timeouts, circuit breaker events
+- Upstream errors: 4xx/5xx responses from backend services
+
+**Benefits:**
+- Standardize error responses across APIs and environments
+- Mask sensitive internal error details for security
+- Provide consistent error formats for client applications
+- Enable RFC 7807 Problem Details compliance
+- Reduce client-side error handling complexity
+
+This feature integrates seamlessly with existing analytics, logging, and observability systems; all overridden responses are properly captured in access logs, analytics records, and distributed traces. The system is fully backward compatible with no configuration required; existing error responses remain unchanged unless explicitly overridden.
+</Accordion>
+
+<Accordion title='X-RateLimit response headers can now reflect rate-limit values'>
+When an API exceeded its rate limit and returned an HTTP 429 status code, the `X-RateLimit-Limit` and `X-RateLimit-Remaining` response headers were populated from quota data (e.g. monthly limits) rather than rate-limit data (e.g. per-minute thresholds). This was inconsistent with the RFC conventions for these headers and a common source of confusion.
+This release adds a new Gateway configuration option [rate_limit_response_headers](/tyk-oss-gateway/configuration#rate_limit_response_headers). When set to "rate_limits", the `X-RateLimit-*` headers are populated from rate-limit data instead of quota data:
+- `X-RateLimit-Limit`: the configured rate limit threshold
+- `X-RateLimit-Remaining`: remaining requests in the current rate limit window
+- `X-RateLimit-Reset`: time until the rate limit window resets
+
+Backward compatibility is preserved: when the option is unset, the headers continue to reflect quota data as before.
+</Accordion>
+
+<Accordion title='Simplified management of Session lifetime'>
+We have added a new, simplified, approach to configuring [Session lifetime](/api-management/access-control/sessions-and-keys/session-lifecycle) within Redis.
+
+Two new fields have been added to the Session object, which can be directly configured when creating Sessions using the [Keys API](https://tyk.io/docs/api-reference/keys/create-a-key-1) or [Policy API](https://tyk.io/docs/api-reference/policies/create-a-policy):
+- [post_expiry_action](/api-management/access-control/sessions-and-keys/session-lifecycle#2-define-the-post-expiry-action) - determines what happens to the data in Redis after the `expires` timestamp is reached.
+- [post_expiry_grace_period](/api-management/access-control/sessions-and-keys/session-lifecycle#3-configure-the-grace-period) - defines how long (in seconds) the Session is kept in Redis after expiration (if the `post_expiry_actions` is to retain the Session)
+
+The existing Gateway-wide [global session lifetime](/api-management/access-control/sessions-and-keys/session-lifecycle#gateway-level-settings) override is still respected.
+
+The [legacy API level controls](/api-management/access-control/sessions-and-keys/session-lifecycle#legacy-controls) can still be used if both new fields are set to `0` (or unset) so **there is no change in behavior for existing Sessions**.
+</Accordion>
+
+<Accordion title='OAuth mTLS certificates can now be rotated without a Gateway restart using KV store references'>
+Rotating the mTLS certificates used by the Gateway to authenticate with external Identity Providers — for the OAuth external service integration, covering both client and upstream authentication — previously required a Gateway restart. For organizations using short-lived certificates (e.g. 90-day rotation cycles), this added operational overhead, forced infrastructure changes, and in some cases required custom image rebuilds during routine rotation.
+This release extends KV store reference support to the following Gateway configuration fields:
+- `external_services.oauth.mtls.cert_file`
+- `external_services.oauth.mtls.key_file`
+- `external_services.oauth.mtls.ca_file`
+
+These fields now accept KV store references such as vault:// and consul://, in line with how other sensitive Gateway configuration fields already do. After updating the referenced certificate in the KV store, triggering a Gateway hot reload causes the new value to be picked up — no process restart required.
+Backward compatibility is preserved: existing OAuth external service configurations using absolute file paths or certificate IDs from the Tyk Certificate Store continue to work without modification.
+</Accordion>
+
+<Accordion title='Optional toggle to reuse upstream mTLS certificates for OAuth external service calls'>
+When configuring mTLS for both upstream authentication and the OAuth external service integration, the same certificate often had to be configured in two places — once for upstream auth, and again in the External Services OAuth configuration. For deployments using the same certificate for both, this created a redundant configuration that needed to be kept in sync.
+This release adds an optional configuration toggle that allows the Gateway to reuse the mTLS certificate configured for upstream connections when making OAuth calls to the external Identity Provider. When the toggle is enabled, the upstream certificate is used for both purposes, removing the need to maintain duplicate configurations.
+The toggle is intentionally optional: deployments may legitimately use different certificates for the two endpoints.
+When the toggle is unset, the OAuth external service continues to use its own dedicated certificate configuration.
+</Accordion>
+
+<Accordion title='Allow underscores in HashiCorp Vault and Consul secret reference paths'>
+We have added support for underscore characters in `$secret_vault` and `$secret_consul` secret reference paths. Previously, the underscore character was not supported in these Key-Value store reference paths due to regex pattern limitations, causing references to be truncated at the first underscore. For example, `$secret_vault.kv-v2/path.API_KEY` would only match up to `.API`, silently dropping `_KEY`.
+
+This enhancement aligns `$secret_vault` and `$secret_consul` patterns with existing `$secret_env`, `$tyk_context`, and `$tyk_meta` patterns that already support underscores. Users can now reference secrets using standard naming conventions like `API_KEY` and `DB_PASSWORD` without needing to duplicate secrets under underscore-free names. The change maintains full backward compatibility with existing references that don't contain underscores.
+</Accordion>
+
+<Accordion title='Configurable compression and decompression limit for API definitions and policies in Data Plane Redis'>
+Building on the API definition compression introduced in 5.12.0, this release extends Data Plane Redis storage optimisation to security policies and makes the previously hardcoded decompression size limit configurable. These improvements help customers with large API and policy footprints (for example, deployments with 100MB+ of API definitions and 60MB+ of security policies) reduce Redis storage costs without impacting request handling performance.
+
+Compression is opt-in per asset type via independent configuration flags: [`storage.compress_api_definitions`](/tyk-oss-gateway/configuration#storage-compress_api_definitions) (introduced in 5.12.0) for API definitions, and the new [`storage.compress_policies`](/tyk-oss-gateway/configuration#storage-compress_policies) for security policies. Both are disabled by default and remain backward compatible — Gateways transparently load both compressed and uncompressed data from Redis.
+
+The decompression size limit is now configurable via the new [`storage.max_decompressed_size`](/tyk-oss-gateway/configuration#storage-max_decompressed_size) option (default 100MB, minimum 1MB) and is applied independently to API definitions and policies, so each asset type has its own ceiling. As with the original feature, compression and decompression occur only during Gateway reloads, with no impact on the request hot path.
+</Accordion>
+
+
+<Accordion title='Add OpenTelemetry metrics export'>
+We have introduced comprehensive OpenTelemetry metrics export, providing real-time operational visibility into Gateway performance, health, and business KPIs. This complements existing distributed tracing and logging to deliver a complete observability solution.
+
+**Key Features:**
+- **Default Gateway Metrics:** Automatic export of RED metrics (Rate, Errors, Duration), Go runtime health metrics (CPU, memory, goroutines, garbage collection), and configuration state tracking (loaded APIs/policies, reload operations)
+- **Custom Business Metrics:** Define custom counters and histograms with dynamic dimensions sourced from request headers, JWT claims, session data, context variables, and API config_data
+- **Endpoint-Level Granularity:** Track metrics per endpoint using the new listen_path and endpoint dimensions for detailed API monitoring
+- **Multi-Tenant Support:** Track usage per customer, tier, or organization using dynamic dimensions
+- **Universal Backend Support:** Export via OTLP to Prometheus, Grafana, Datadog, New Relic, Dynatrace, and other observability platforms
+- **Metric-to-Trace Correlation:** Automatic exemplar support links metric anomalies directly to distributed traces, enabling seamless navigation from metrics to traces during incident investigation.
+- **Gateway Identity Attributes:** Configurable resource attributes help identify and filter individual Gateway instances in multi-node deployments.
+
+**Configuration:** Metrics are configured under the new [opentelemetry.metrics](/tyk-oss-gateway/configuration#opentelemetry-metrics) object with independent control from tracing.
+
+**Default Metrics Exported:**
+- **Request Metrics:** `http.server.request.duration`, `tyk.gateway.request.duration`, `tyk.upstream.request.duration`, `tyk.api.requests.total`
+- **Go Runtime Metrics:** CPU utilisation and processing time, memory usage breakdown (heap, stack, allocations), active goroutine count and lifecycle, garbage collection duration and frequency, thread count
+- **Configuration Metrics:** Loaded APIs and policies count, reload operations and duration
+
+The Go runtime metrics enable teams to correlate system-level resource constraints with API latency patterns, detect potential goroutine or memory leaks early, and right-size infrastructure based on actual resource utilisation.
+
+**Production Controls:** To ensure safe metric collection on the request hot path, the system includes built-in cardinality limits (default: 2,000 combinations per metric) and conditional data loading to prevent performance degradation.
+</Accordion>
+
+
+</AccordionGroup>
+
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fix log level for Client TLS certificate requirement errors'>
+We have resolved an issue where "Client TLS certificate is required" errors were logged at `warning` level, creating unnecessary noise in production logs.
+
+Previously, these common client-side authentication failures generated excessive warning-level log entries that could trigger false alerts and obscure more critical issues. The Gateway now logs these authentication failures at `info` level, maintaining security visibility while reducing log noise and alert fatigue for operations teams.
+</Accordion>
+
+<Accordion title='Fix malformed responses from Go plugins returning error status codes'>
+We have resolved an issue where a Go plugin returning an error status code would result in malformed response bodies that concatenated the original plugin response with additional Gateway error messages. 
+
+The Gateway now correctly handles plugin-generated error responses without double-writing headers, ensuring response bodies contain only the payload generated by the plugin and eliminating superfluous warnings in logs.
+</Accordion>
+
+<Accordion title='Fix query parameter handling when looping requests internally'>
+We have resolved inconsistent query parameter handling in URL rewrites when [internally looping](/advanced-configuration/transform-traffic/looping) using the `tyk://` scheme. Previously, custom query parameters specified in the `rewrite_to` URL were silently dropped, while original request parameters were unexpectedly preserved.
+
+**What's Fixed:**
+- Query parameters explicitly added to `rewrite_to` URLs are now correctly passed to target APIs
+- Control parameters (`method`, `loop_limit`, `check_limits`) are properly consumed and removed
+- Behavior now matches URL rewrites using `http://` protocol
+
+<Note>
+It is important to note that **query parameters provided with the original request are no longer automatically forwarded**. You must update your [URL rewrite configuration](/transform-traffic/url-rewriting) to explicitly include any required parameters in the `rewrite_to` URL.
+</Note>
+</Accordion>
+
+<Accordion title='Fix client mTLS authentication between Tyk Gateways'>
+We have resolved an issue where a Tyk Gateway acting as a client (using upstream mTLS) would fail to authenticate against another Tyk Gateway acting as the mTLS server, resulting in `HTTP 403 Forbidden: Client TLS certificate is required` errors.
+
+The Gateway now reliably presents the configured upstream client certificate whenever requested by the target server, ensuring seamless mTLS communication between APIs hosted on different Tyk Gateways.
+</Accordion>
+
+<Accordion title='Inherit maximum (1.3) and minimum (1.2) TLS versions from Go'>
+We have resolved an issue where the Tyk Gateway default maximum TLS version was incorrectly set to TLS 1.2 instead of TLS 1.3.
+
+Tyk Gateway now follows Go's native TLS defaults (TLS 1.2 minimum, TLS 1.3 maximum), aligning with industry security standards. This maintains full backward compatibility for existing deployments that explicitly configure TLS versions.
+
+To change the maximum TLS version, you must explicitly set [TYK_GW_HTTPSERVEROPTIONS_MAXVERSION](/tyk-oss-gateway/configuration#http_server_options-max_version) for client-to-Gateway connections or [TYK_GW_PROXYSSLMAXVERSION](/tyk-oss-gateway/configuration#proxy_ssl_max_version) for Gateway-to-upstream connections.
+
+To change the minimum TLS version, you must explicitly set [TYK_GW_HTTPSERVEROPTIONS_MINVERSION](/tyk-oss-gateway/configuration#http_server_options-min_version) for client-to-Gateway connections or [TYK_GW_PROXYSSLMINVERSION](/tyk-oss-gateway/configuration#proxy_ssl_min_version) for Gateway-to-upstream connections.
+
+For full details of TLS version configuration see [here](/api-management/implement-tls#controlling-tls-version-and-cipher-suites).
+</Accordion>
+
+<Accordion title='Fix CORS preflight blocking by AllowList middleware'>
+We have resolved an issue where CORS preflight OPTIONS requests were incorrectly blocked by the AllowList middleware when `options_passthrough` was disabled.
+
+Previously, when APIs had CORS enabled with Tyk handling OPTIONS requests internally (`options_passthrough: false`), preflight requests would fail AllowList validation because users typically don't explicitly define OPTIONS endpoints in their AllowList configurations, causing "Requested endpoint is forbidden" errors.
+
+The Tyk Gateway now properly recognizes CORS preflight requests and allows them to bypass AllowList middleware checks when Tyk is configured to handle OPTIONS internally, restoring the expected behavior where CORS preflight handling works automatically without requiring explicit OPTIONS endpoint definitions.
+</Accordion>
+
+<Accordion title='Fix analytics generation for Tyk OAS API mock endpoints'>
+We have resolved an issue where Tyk OAS APIs with mock endpoints stopped generating analytics data. This functionality was inadvertently broken while fixing an unrelated internal API proxying issue in Tyk Gateway 5.8.6.
+
+Note that analytics are not generated for mock endpoints in Tyk Classic APIs as has always been the case.
+</Accordion>
+
+<Accordion title='Fix OpenTelemetry configuration file settings being ignored'>
+We have resolved an issue where OpenTelemetry settings could only be set using environment variables and not the Gateway configuration file (`tyk.conf`).
+
+Now OpenTelemetry can be configured via the [`opentelemetry`](/tyk-oss-gateway/configuration#opentelemetry) section in the Gateway config file (including `enabled`, `exporter`, and `endpoint` fields) or their equivalent environment variables.
+</Accordion>
+
+<Accordion title='Resolved issue with Gateway entering an unresponsive state during startup'>
+We have fixed an issue where the Gateway could fail to load APIs and policies if the Control Plane database was temporarily unavailable during startup (either directly or via MDCB). The Gateway will now automatically retry loading configurations with exponential backoff until successful, restoring self-healing capabilities without requiring a manual restart.
+</Accordion>
+
+<Accordion title='Add strict validation for Policy ID characters'>
+We have resolved an issue where Policy IDs containing special characters could cause problems when parsing API endpoint requests. Previously, Policy IDs with characters such as `#`, `?`, `%`, and `/` would interfere with URL parsing in Tyk Gateway API endpoints that use the Policy ID as a path parameter, potentially causing request failures or unexpected behavior.
+
+Strict validation has been introduced to restrict policy identifiers to a safe character set (alphanumeric characters plus `_`, `-`, `.`, `~`). The validation occurs during Policy creation and updates via the following endpoints:
+- `POST /tyk/policies`
+- `PUT /tyk/policies/{polID}`
+
+A new Gateway configuration option `allow_unsafe_policy_ids` has been added to disable this character validation in case of existing non-compliant Policy IDs. If you must use other characters in your Policy IDs, be careful to avoid any that might cause URL parsing issues.
+</Accordion>
+
+<Accordion title='Fix error response format for SOAP+XML requests'>
+We have resolved an issue where requests with the `application/soap+xml` Content-Type received JSON-formatted error responses instead of the expected XML format. The Gateway now correctly returns XML-formatted errors for SOAP requests.
+</Accordion>
+
+
+<Accordion title='Fixed misleading span batch configuration values in Gateway startup logs'>
+Resolved an issue introduced alongside the `span_batch_config` feature in 5.12.0 where, when the configuration was omitted or left unset, Gateway startup logs reported the batch processor settings (`max_queue_size`, `max_export_batch_size`, `batch_timeout`) as zero values. The Gateway was internally applying the standard Go SDK defaults correctly, but the logs misrepresented this, making it appear that the OpenTelemetry exporter was misconfigured. Startup logs now report the actual default values in use, giving operators an accurate view of the active configuration.
+</Accordion>
+
+<Accordion title='Fixed missing access log entries for cached responses'>
+Resolved an issue where responses served from the Redis cache middleware did not emit access log entries, making cache hits invisible in access logs even when `access_logs.enabled` was set to `true`. Cache hits now generate access log entries with the same structure as non-cached responses. The same fix ensures that cache hits are also captured by the newly introduced OpenTelemetry API metrics.
+</Accordion>
+
+<Accordion title='Resolve Gateway registration failures at scale on unlimited node licenses'>
+We have resolved a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an **unlimited node license**. During mass registrations or rolling upgrades, a combination of lock contention, excessive Redis load, and incorrect handling of `409 Conflict` responses could leave Gateways stuck in registration loops without the credentials needed to serve traffic.
+
+Gateway registration is now significantly more robust at scale: registration requests are no longer serialized across the fleet, Gateways recover cleanly from transient `409 Conflict` responses instead of looping, and the Redis load generated during registration storms is substantially reduced.
+
+A dedicated fix for **limited node license** deployments will be provided in an upcoming release. 
+</Accordion>
+
+<Accordion title='Fixed memory issue and unintended rate limit reset in distributed rate limiting'>
+Resolved an issue where the [Distributed Rate Limiter's](/api-management/rate-limit#distributed-rate-limiter) cache cleanup stopped running after its first execution. This could cause unbounded memory growth on APIs using rate limits with high-cardinality keys (such as per-client-IP rate limiting or custom plugins generating unique keys), and could briefly reset active rate-limit buckets shortly after Gateway startup, allowing requests that should have been blocked to pass through. Memory usage now stays bounded, and rate limits are enforced as configured.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Fix CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15558" target="_blank">CVE-2025-15558</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33812" target="_blank">CVE-2026-33812</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39883" target="_blank">CVE-2026-39883</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39882" target="_blank">CVE-2026-39882</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+---
+
+## 5.12 Release Notes 
+
+### 5.12.1 Release Notes 
+
+#### Release Date 21st April 2026
+
+#### Release Highlights
+
+Tyk Gateway has been updated to Golang 1.25 and Debian 13 (Trixie) for enhanced security and performance, including updated FIPS-compliant images. This release addresses multiple CVEs in dependent libraries and fixes a path matching inconsistency for Tyk OAS APIs.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.12.1) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies 
+<a id="dependencies-5.12.1"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|---- |
+| 5.12.1 | MDCB v2.9.0       | MDCB v2.9.0 |
+|        | Operator v1.3.0   | Operator v0.17 |
+|        | Sync v2.1.6       | Sync v2.1.0 |
+|        | Helm Chart v5.1   | Helm all versions |
+|        | Pump v1.14.1      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [Go](https://go.dev/dl/)               | 1.25                   |  1.25  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | 3.1.x, 3.0.x | 3.1.x, 3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.12.1"></a>
+
+If you are upgrading to 5.12.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.12.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.12.1
+    ``` 
+- Helm charts
+  - [tyk-charts v5.1.0](/developer-support/release-notes/helm-chart#5-1-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.12.1.
+
+- [Source code tarball of Tyk Gateway v5.12.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.12.1)
+
+#### Changelog
+<a id="Changelog-v5.12.1" data-scroll-offset></a>
+
+##### Changed
+<AccordionGroup>
+
+<Accordion title='Updated Golang version to 1.25'>
+The Tyk Gateway has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
+</Accordion>
+
+<Accordion title='Update Docker images to Debian 13 (Trixie)'>
+Updated the Docker images for Tyk Gateway to Debian 13 (Trixie) to address multiple vulnerabilities in the underlying operating system.
+</Accordion>
+
+
+</AccordionGroup>
+
+##### Fixed
+<AccordionGroup>
+
+<Accordion title='Fixed path matching inconsistency for Tyk OAS APIs'>
+Resolved an issue where parameterized paths could incorrectly take precedence over static paths when using the Request Validation or Mock Response middleware in Tyk OAS APIs. Static paths will now correctly bypass these middleware if not explicitly configured, restoring the expected routing behavior.
+</Accordion>
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security vulnerabilities:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15281" target="_blank">CVE-2025-15281</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-0861" target="_blank">CVE-2026-0861</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-0915" target="_blank">CVE-2026-0915</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25679" target="_blank">CVE-2026-25679</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32285" target="_blank">CVE-2026-32285</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32286" target="_blank">CVE-2026-32286</a>
+- <a href="https://www.cvedetails.com/cve/CVE-2026-33186/" target="_blank">CVE-2026-33186</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34986" target="_blank">CVE-2026-34986</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+
+### 5.12.0 Release Notes 
+
+#### Release 06 March 2026
+
+#### Release Highlights
+
+**OpenAPI Specification 3.1 is now supported**
+
+In this release, we are delighted to bring initial support for OAS 3.1 in Tyk OAS APIs covering:
+
+- Import and validation of OpenAPI 3.1 descriptions using Tyk Dashboard to create Tyk OAS APIs
+- OAS 3.1 features:
+    - Full JSON Schema Support and $schema keyword
+    - The single `example` keyword is deprecated in OAS 3.1
+    - `type` can be an array
+    - `exclusiveMinimum` and `exclusiveMaximum` keywords
+
+We do not yet have support for all new features. For more details, see the [documentation](/api-management/gateway-config-tyk-oas#openapi-specification-3-1)
+
+**Enhanced OpenTelemetry Tracing and Log Correlation**
+
+In this release, we've significantly improved observability by bridging the gap between logs and distributed traces. When OpenTelemetry is enabled, Tyk Gateway now automatically injects W3C trace IDs into access logs, and both trace and span IDs into application logs. 
+
+This allows your DevOps and SRE teams to seamlessly correlate Gateway operational events with distributed traces across platforms such as Grafana Tempo, Jaeger, and OpenSearch, providing full visibility into the request journey.
+
+Additionally, we've introduced flexible support for custom trace headers. If your organization uses custom correlation ID systems (like `X-Correlation-ID`), the Gateway can now recognize these as trace context sources. With multiple propagation modes, you can gradually migrate to standard OpenTelemetry tracing without modifying existing downstream systems.
+
+**Enhanced Error Observability in Access Logs**
+
+Troubleshooting API errors in production just got significantly faster. We've enhanced Gateway [access logs](/api-management/logs/access-logs) to include rich, structured error context for 4XX and 5XX errors, eliminating the need to cross-reference multiple log sources during an incident.
+
+Users can now instantly identify the root cause of failures—whether it's an expired TLS certificate, a network connectivity issue, or a backend service problem—directly from the access logs. This comprehensive visibility drastically reduces time-to-resolution and simplifies debugging.
+
+**Programmatic Configuration Inspection for Faster Troubleshooting**
+
+Verifying configuration settings and debugging deployment issues can be time-consuming when multiple configuration sources (files, environment variables, defaults) are involved. 
+
+To streamline troubleshooting, we've introduced configuration inspection endpoints to the Tyk Gateway API. Platform engineers and support teams can now programmatically access the Gateway's actual runtime configuration directly through the control API. This eliminates the need for manual configuration file sharing and supports automated drift detection, while built-in redaction automatically protects sensitive data like passwords and secrets.
+
+**Enhanced Security with Client Certificate-Token Binding**
+
+To provide an additional layer of security for your APIs, we've introduced [Client Certificate-Token Binding](/api-management/authentication/bearer-token#client-certificate-token-binding). This feature allows you to form a strict binding association between an Auth Token issued to a client and their specific client certificate.
+
+By ensuring that a token can be used only with its bound certificate, you can significantly reduce the risk of token theft or misuse. The feature fully supports certificate rotation scenarios by allowing multiple certificates to be bound to a single key, ensuring uninterrupted access during credential updates.
+
+**Certificate Authentication as a Standalone Auth Method for Tyk OAS**
+
+We have restructured [Certificate Authentication](/api-management/authentication/certificate-auth) (formerly known as Dynamic mTLS) to be a dedicated, standalone authentication method in Tyk OAS API definitions. 
+
+Previously configured as an adjunct to Auth Token authentication, this change aligns Certificate Authentication with other Tyk proprietary methods like HMAC and Custom Auth. This improves API design consistency and makes it much more intuitive to configure certificate-based access, all while maintaining full backward compatibility with your existing API definitions.
+
+**Optimized Redis Storage for Data Planes**
+
+We have significantly reduced Redis memory consumption for Data Plane deployments, delivering immediate storage cost savings and improved efficiency for large-scale environments. 
+
+By implementing intelligent storage optimization, the Gateway now automatically omits empty fields when storing session data, reducing memory usage for typical API keys by up to 20%. Additionally, we've introduced optional compression for cached API definitions, reducing storage requirements by up to 75% without impacting API response times. These enhancements are fully backward compatible and require no migration of existing keys or definitions.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.12.0) below.
+
+#### Breaking Changes
+
+A change has been made to improve security of the legacy [**Auth Token + Dynamic mTLS**](/api-management/implement-tls#legacy-dynamic-mtls-mode) method for securing access to APIs deployed on Tyk. This removes the option to authenticate using only the auth token and enforces the mTLS handshake.
+
+Previously, API clients could authenticate without presenting the client certificate or holding the client's private key.
+
+For any user relying on that behavior, we have added a new Gateway configuration option: `allow_unsafe_dynamic_mtls_token`. Unless deliberately configured in the config file or environment, this is set to `false` to ensure that Tyk is secure by default.
+
+#### Dependencies 
+<a id="dependencies-5.12.0"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|---- |
+| 5.12.0 | MDCB v2.9.0       | MDCB v2.9.0 |
+|        | Operator v1.3.0   | Operator v0.17 |
+|        | Sync v2.1.6       | Sync v2.1.0 |
+|        | Helm Chart v5.1   | Helm all versions |
+|        | Pump v1.14.0      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [Go](https://go.dev/dl/)               | 1.24                   |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.1.2.html) | 3.1.x, 3.0.x | 3.1.x, 3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)|
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+The introduction of [Certificate Authentication](/api-management/authentication/certificate-auth) as a standalone auth method in place of Auth Token + dynamic mTLS means that the configuration field `authentication.securitySchemes.authToken.enableClientCertificate` in the Tyk Vendor Extension is now deprecated in favour of `authentication.certificateAuth.enabled`. The legacy field remains valid for backward compatibility at this time, but users are recommended to switch to the new configuration.
+
+#### Upgrade instructions
+<a id="upgrade-5.12.0"></a>
+
+If you are upgrading to 5.12.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.12.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.12.0
+    ``` 
+- Helm charts
+  - [tyk-charts v5.1.0](/developer-support/release-notes/helm-chart#5-1-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.12.0.
+
+- [Source code tarball of Tyk Gateway v5.12.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.12.0)
+
+#### Changelog
+<a id="Changelog-v5.12.0" data-scroll-offset></a>
+
+##### Added
+<AccordionGroup>
+
+<Accordion title='Added support for OpenAPI 3.1 (OAS v3.1.x)'>
+This release introduces initial support for importing and validating OpenAPI 3.1 descriptions to create Tyk OAS APIs. The implementation maintains backward compatibility with OAS 3.0 while adding support for the new JSON Schema 2020-12 validator:
+
+- Added full JSON Schema support, including the `$schema` keyword.
+- Added support for defining `type` as an array (e.g., `["string", "null"]`).
+- Support for `exclusiveMinimum` and `exclusiveMaximum` 
+
+Please note the following limitations in this initial release:
+- Reusable Path Item Objects and the new `mutualTLS` security scheme are not currently supported.
+</Accordion>
+
+<Accordion title='Optimized Data Plane Redis storage for sessions and API definitions'>
+This release introduces significant storage optimizations for Data Plane Redis caching, reducing memory consumption while maintaining full backward compatibility:
+
+- *Session Object Optimization*: The Gateway now automatically omits empty and zero-value fields when storing API keys and session objects. This results in up to a 20% reduction in memory usage, with minimal keys now consuming only 500-700 bytes.
+- *API Definition Compression*: Added optional Zstd compression for API definitions cached in Redis, achieving up to 75% storage reduction. Compression and decompression occur during Gateway reloads, ensuring zero impact on the request hot path.
+- *Configuration*: API definition compression is disabled by default. It can be enabled via the new `storage.enable_api_definition_compression` configuration option.
+- *Security Limit*: To mitigate the risk of decompression bombs, the maximum combined uncompressed size for the API definitions is limited to 100MB.
+</Accordion>
+
+<Accordion title='OpenTelemetry and Observability Enhancements'>
+This release brings significant improvements to OpenTelemetry tracing and log correlation capabilities within the Gateway. These enhancements ensure better observability and easier debugging across distributed systems by unifying trace context across all log types:
+
+- Added the `trace_id` field to Gateway [access logs](/api-management/logs/access-logs) when OpenTelemetry is enabled, matching the `X-Tyk-Trace-Id` response header.
+- Added `trace_id` and `span_id` fields to all request-scoped Gateway [application logs](/api-management/logs/application-logs) (middleware execution, errors, and debugging).
+- Introduced custom trace header configuration (e.g., `X-Correlation-ID`) to support non-standard header names as trace context sources with three trace propagation modes:
+  - **Custom-only** (read and write custom headers exclusively)
+  - **Hybrid** (read custom headers, write standard traceparent)
+  - **Composite** (read custom headers, write both custom and standard formats)
+- Implemented automatic fallback to standard W3C propagators when custom trace headers are missing or invalid.
+</Accordion>
+
+<Accordion title='Prevent OpenTelemetry Span Loss in High-Throughput Environments'>
+In high-throughput production environments, default OpenTelemetry settings can cause silent span loss and incomplete traces under heavy load. To address this, we've introduced the ability to tune OpenTelemetry `BatchSpanProcessor` settings to match your specific traffic patterns. By adjusting queue sizes and batch parameters, you can significantly reduce orphaned child spans and ensure trace completeness, giving you full visibility into your API traffic.
+
+Added a new `span_batch_config` section to the OpenTelemetry configuration to prevent span loss in high-throughput environments. Users can now override default Go SDK settings by tuning `max_queue_size`, `max_export_batch_size`, and `batch_timeout`. This configuration is optional and backward compatible; omitted or zero values will default to standard SDK values.
+</Accordion>
+
+<Accordion title='Added structured error context to access logs'>
+This release introduces detailed error context fields to access logs for 4XX and 5XX gateway and upstream errors, providing immediate technical insight into failure root causes including:
+
+- `response_flag` for standardized error codes (e.g., `TLE` for TLS expired, `UCF` for connection refused, `RLT` for rate limiting).
+- `response_code_details` for human-readable error descriptions.
+- `error_source` (originating component) and `error_target` (upstream address).
+- `upstream_status` to capture the HTTP status returned from the upstream service.
+- context-specific fields that appear only when relevant: `tls_cert_expiry` and `tls_cert_subject` for certificate errors, and `circuit_breaker_state` for circuit breaker errors.
+
+The full list of response flag codes is available in the [Access Logs documentation](/api-management/logs/access-logs).
+</Accordion>
+
+<Accordion title='Added configuration inspection endpoints to the Tyk Gateway API'>
+Added new `/config` and `/env` endpoints to the Tyk Gateway API to provide programmatic access to runtime configuration and environment variable mappings. This enables targeted troubleshooting and configuration auditing directly through authenticated API calls:
+
+- Supports both full configuration dumps and targeted single-field queries (e.g., `/config?field=storage.host`).
+- Automatically redacts sensitive data (passwords, secrets, connection strings) to preserve configuration structure visibility securely.
+- Clarifies configuration precedence and naming conventions from multiple sources.
+
+This feature is disabled by default and is enabled using [`enable_config_inspection`](/tyk-oss-gateway/configuration#enable_config_inspection).
+</Accordion>
+
+<Accordion title='Added Client Certificate-Token Binding for Auth Token APIs'>
+This release introduces the ability to bind client certificates to Auth Tokens for APIs secured with a static mTLS allow list. This provides enhanced token security by ensuring tokens are only used with their associated certificates:
+
+- Added a new `mtls_static_certificate_bindings` field to the session object, which accepts a list of one or more certificate IDs.
+- Enforces that the certificate presented in the request matches the bound certificate IDs; otherwise, the request is rejected.
+- Supports binding multiple client certificates to a single key (token) to facilitate certificate rotation.
+
+Please note that bound certificates must also be present in the client certificate allow list within the API definition for successful post-handshake validation. This feature maintains full backward compatibility with existing keys that do not specify certificate bindings.
+</Accordion>
+
+<Accordion title='Certificate Expiry Events for Upstream Connections'>
+Extended [certificate expiry monitoring](/api-management/certificates#monitoring-certificate-expiry) to include TLS certificates used by the Gateway as the client in connections to upstream services. When a certificate used by the Gateway to authenticate itself with the upstream has expired or is within the configured number of days prior to expiry, an entry will be added to the application log and the appropriate Gateway event will be generated. The new `cert_role` field in the event metadata indicates whether the certificate was used in `client` or `upstream` authentication.
+
+With this addition, the certificate expiry monitor now tracks all certificates used to represent the Gateway in TLS handshakes.
+</Accordion>
+
+<Accordion title='Restructured Certificate Authentication in Tyk OAS API definitions'>
+This release introduces a new, dedicated configuration structure for Certificate Authentication (formerly Dynamic mTLS) in Tyk OAS API definitions, separating it from Auth Token authentication:
+
+- Introduced the new `authentication.certificateAuth.enabled` field to configure Certificate Authentication as a standalone method.
+- Deprecated the legacy `authentication.securitySchemes.authToken.enableClientCertificate` field (it remains fully supported for backward compatibility).
+- When both the new and deprecated fields are present, the new `certificateAuth.enabled` field takes precedence.
+</Accordion>
+
+<Accordion title='Configurable Gateway-Default JWKS Cache Timeout'>
+In Tyk 5.10.0, we introduced API-level configuration for the validity period of the JWKS cache for Tyk OAS APIs. Now we have made the Gateway default (which is applied if no API-level configuration is set) configurable via a new option in the Gateway config file: [`jwks.cache.timeout`](/tyk-oss-gateway/configuration#jwks-cache-timeout) or the equivalent environment variable. If this is not set, the timeout will continue to default to 240 seconds. This will be applied to both Tyk Classic and Tyk OAS APIs, simplifying JWKS cache management across large API deployments while providing flexibility for APIs that require specific caching behaviors. 
+</Accordion>
+
+<Accordion title='Improved Policy ID Handling in Multi-Organisation Environments'>
+This release introduces improvements to how the Gateway handles policy IDs, particularly in multi-Organisation deployments. These changes ensure that policies are correctly applied and provide better visibility into potential configuration conflicts:
+
+- The Gateway now correctly discriminates between policies with identical `id` fields across different Organisations (Orgs), ensuring that policies are only applied to keys within their respective `org_id`.
+- Added a new warning-level log message that triggers if multiple policies are loaded with the same `id` within a single Org. The log details the shared `id` and the individual internal `_id` values of the conflicting policies to assist with troubleshooting.
+
+These enhancements allow users to safely use custom policy IDs without risking cross-Org conflicts. The new warning logs help administrators identify and resolve legacy configuration issues in which duplicate policy IDs may exist within the same Organisation.
+</Accordion>
+
+<Accordion title='Visibility of the APIs and Policies loaded by Data Plane Gateway'>
+Gateway now includes a list of the loaded APIs and policies in the information it provides to MDCB. This provides a clear picture of what is running on each Gateway in a distributed deployment, simplifying monitoring and troubleshooting of your deployed Data Planes.
+</Accordion>
+
+<Accordion title='Added Usage-Aware Certificate Synchronization for Data Planes'>
+This release introduces a usage-aware certificate synchronization system for distributed deployments (MDCB). Data Planes can now be configured to only sync and store certificates that are actually required by their loaded APIs when using the [MDCB Synchroniser](/api-management/mdcb#mdcb-synchroniser), rather than pulling all certificates from the Control Plane:
+
+- Added a new `sync_used_certs_only` boolean flag to the `slave_options` configuration.
+- When enabled alongside `use_rpc: true`, the data plane tracks certificate usage by analyzing loaded API specifications and filters synchronization to only pull required certificates.
+- Reduces memory usage and eliminates log noise caused by expired certificates that are not relevant to the specific Data Plane's APIs.
+
+This feature is disabled by default (`sync_used_certs_only: false`) to ensure backward compatibility. When disabled, the Gateway will continue to synchronize all certificates from the Control Plane as before.
+</Accordion>
+
+<Accordion title='Optimized Bundle Verification to Reduce Memory Consumption'>
+Fixed a performance issue introduced in v5.8.7 where bundle verification significantly increased CPU and memory consumption, particularly when using multiple APIs with plugin bundles.
+We have introduced a new Gateway configuration option `skip_verify_existing_plugin_bundle` that allows you to skip cryptographic verification when loading signed plugin bundles from disk. When set to true, this option reduces performance overhead in environments with large numbers of APIs using signed bundles, while still maintaining security by validating signatures during initial bundle download.
+Note: This option only affects signed bundles loaded from disk, unsigned bundles and initial downloads will continue to follow standard verification procedures.
+</Accordion>
+
+
+</AccordionGroup>
+
+
+##### Fixed
+<AccordionGroup>
+
+<Accordion title='Fixed Path Matching Inconsistencies Between Classic and OAS API Middleware'>
+Resolved path matching inconsistencies that could lead to Tyk OAS-specific middleware not being executed when expected.
+
+These inconsistencies could cause the [Request Validation](/api-management/traffic-transformation/request-validation) and [Mock Response](/api-management/traffic-transformation/mock-response#mock-response) middleware to be skipped in certain scenarios when using Tyk OAS APIs.
+These scenarios included:
+- Some subpaths, for example, the middleware configured for `/users` would not execute for `/users/123`
+- some child API versions
+- wildcard regexes in paths
+- root paths
+
+Now, Tyk will apply the same decisions to these middleware as it does to the rest of the request processing chain.
+</Accordion>
+
+<Accordion title='Fixed Certificate Re-use After Swapping in Multi-Auth Keys'>
+Resolved an issue where swapping certificates in multi-auth (mTLS + Basic auth) keys prevented the original certificate from being reused. Previously, when updating a key's certificate, the original certificate remained incorrectly associated with the key internally, causing "key with given certificate already found" errors when attempting to reuse that certificate.
+
+Tyk now properly detaches certificates during key updates, allowing certificates to be freely reused across different keys after being removed from their original association.
+</Accordion>
+
+<Accordion title='Improved JWKS Error Messaging for Faster JWT Troubleshooting'>
+Enhanced Gateway error logging for JWT authentication failures related to JWKS endpoints. Previously, JWKS configuration issues generated vague error messages that didn't indicate the root cause, making troubleshooting difficult and time-consuming. 
+
+The Gateway now provides specific, actionable error messages that clearly identify whether failures stem from Base64 decoding issues, network connectivity problems, or invalid JWKS content.
+</Accordion>
+
+<Accordion title='Fixed Gateway Panic if HashiCorp Vault Path Not Found'>
+Resolved an issue where the Gateway could crash with a panic if the API definition contained an illegal reference to a secret in HashiCorp Vault. If the requested path did not exist in Vault, this could cause the Gateway process to exit, resulting in a complete service outage during API loads, hot reloads, or Dashboard saves. The Gateway now gracefully handles the missing Vault path and logs a clear error message.
+</Accordion>
+
+<Accordion title='Fixed OpenAPI multipleOf Validation for Floating-Point Numbers'>
+Resolved a floating-point precision issue where mathematically valid multipleOf values were incorrectly rejected due to binary representation limitations. This could cause incorrect failures when performing Request Validation for Tyk OAS APIs.
+
+The Gateway now properly handles floating-point precision in multipleOf validation, ensuring that all mathematically valid decimal multiples pass validation consistently while continuing to correctly reject invalid values.
+</Accordion>
+
+<Accordion title='Fixed Incomplete Validation of Multi-Value Request Headers'>
+Resolved an issue where Tyk only validated the first instance of multi-value headers when processing requests to Tyk OAS APIs, allowing invalid header values to bypass schema constraints. 
+
+The Gateway now properly normalizes and validates all header values according to HTTP standards, ensuring that all values in multi-value headers comply with the defined OpenAPI schema constraints.
+</Accordion>
+
+<Accordion title='Fixed API Routing Issues with Custom Domains and Similar Listen Paths'>
+Resolved a routing issue where APIs could return `HTTP 404 Not Found` errors depending on custom domain settings, with differing behavior between Tyk OAS and Tyk Classic APIs. Previously, when APIs had similar listen path prefixes (e.g., `/caa` and `/caas2itsamu0456w2ayl9`), the Gateway's routing logic would incorrectly match requests, causing legitimate API calls to fail. The issue affected Tyk OAS APIs when custom domains were disabled, and Tyk Classic APIs when they were enabled. 
+
+The Gateway now properly sorts and matches API specifications by listen path length, while correctly considering domain configuration options, ensuring all APIs are accessible via their configured paths regardless of custom domain settings or API type. 
+</Accordion>
+
+<Accordion title='Fixed Missing Request Duration Logging for Gateway Error Responses'>
+Resolved an issue where the Gateway incorrectly logged 0ms duration for error responses, including `HTTP 504 Gateway Timeout`, `HTTP 499 Client Closed Request`, and `HTTP 500 Internal Server Error`, creating gaps in API observability and monitoring. Previously, these error responses were hardcoded with zero-latency values, making it impossible to determine the actual processing time, gateway saturation, or connection utilization for failed requests. 
+
+The Gateway now accurately calculates and logs the actual request duration from start to error occurrence for all error responses, providing complete timing visibility across successful and failed API requests. This enhancement improves observability for performance monitoring, capacity planning, and troubleshooting workflows.
+</Accordion>
+
+<Accordion title='Fixed Missing Identity Source in OTEL Traces for JWT Protected APIs'>
+Resolved an issue where OpenTelemetry traces were missing the "alias" field when using JWT-protected APIs, making it impossible to identify API consumers in tracing data. Previously, while the alias was correctly populated in Redis sessions and pump metrics, it was not included in OTEL spans for JWT-authenticated requests.
+
+The Gateway now ensures that OTEL spans include the alias attribute for all authentication methods, enabling proper consumer identification and request attribution in distributed tracing systems.
+</Accordion>
+
+<Accordion title='Fixed Intermittent NewRelic Tracing'>
+Resolved an issue where NewRelic OpenTracing integration worked inconsistently in Tyk Gateway. The Gateway now properly mounts NewRelic middleware on all routers, including reused ones, with thread-safe duplicate prevention and improved memory management during router swaps. This fix ensures consistent NewRelic APM visibility across all API calls and gateway versions, supporting both legacy NewRelic configurations and newer OpenTelemetry collector setups.
+</Accordion>
+
+<Accordion title='Fixed Custom Authentication Plugins in Compliant Mode'>
+Resolved an issue where custom authentication plugins failed to execute properly when APIs were configured with Compliant Mode security processing. Previously, switching from Legacy Mode to Compliant Mode caused custom plugins to generate "JSVM isn't enabled" errors and return 500 Internal Server Error responses, even when JSVM was correctly configured. Custom authentication plugins now function identically in both Legacy and Compliant modes, allowing users to leverage flexible OR/AND authentication logic without breaking existing plugin functionality. Users can now seamlessly switch between authentication modes and use custom plugins with individual authentication methods in Compliant Mode's OR logic scenarios.
+</Accordion>
+
+<Accordion title='Fixed Incorrect X-RateLimit-Reset Timestamp on First Request After Quota Initialization'>
+Resolved an issue where the `X-RateLimit-Reset` header showed an incorrect timestamp on the first API request after rate limit or quota counter initialization. Previously, when quota windows expired and were reset within the distributed lock, the Gateway failed to update its local timestamp variable, causing the first request to return stale timing information while subsequent requests showed correct values.
+
+The Gateway now properly synchronizes its internal timer with the storage backend during quota window resets, ensuring that `X-RateLimit-Reset` headers accurately reflect the correct expiration time from the very first request.
+</Accordion>
+
+<Accordion title='Fixed Policy ID Collisions Across Organizations in Multi-Org Gateway'>
+Resolved an issue where policies with identical custom IDs across different organizations could overwrite each other in the Gateway's memory storage, causing incorrect policy application. Previously, when multiple organizations used the same policy ID, the Gateway would retain only the last loaded policy, potentially applying incorrect rate limits, quotas, or access controls to API requests. The Gateway now properly isolates policies by organization, ensuring that policy lookups correctly match both the policy ID and organization ID. This fix prevents cross-organizational policy conflicts, ensures that keys and JWT tokens apply the correct policies from their respective organizations, and maintains proper tenant isolation in multi-organization deployments. Organizations can now safely use identical policy IDs without risk of policy collision or incorrect access control enforcement.
+</Accordion>
+
+<Accordion title='Fixed Missing Alias in OpenTelemetry Traces for JWT Multi-Auth APIs'>
+Resolved an issue where OpenTelemetry traces were missing the `alias` attribute for JWT-authenticated requests in multi-auth APIs using compliant security processing mode. Previously, while the alias was correctly populated in analytics records and Redis session data (e.g., JWT claims or API key names), it was not included in OpenTelemetry spans for JWT authentication, making request attribution difficult in distributed tracing systems. The fix ensures that OTEL spans now include the alias attribute for all authentication methods in multi-auth configurations, providing consistent identity information across analytics records, pump output, and distributed traces. This enhancement improves observability for APIs using multiple authentication schemes, allowing operators to easily identify request sources in tracing backends like Jaeger, Tempo, or Zipkin when analyzing JWT-authenticated traffic alongside API key requests.
+</Accordion>
+
+<Accordion title='Fixed SSL Certificate Loading from MDCB During Gateway Startup'>
+Resolved an issue where data plane gateways failed to load SSL certificates from MDCB during startup, preventing HTTPS listeners from functioning correctly. The fix implements exponential backoff retry logic that waits for the MDCB connection to become available during certificate loading, ensuring SSL certificates are properly retrieved, and HTTPS listeners start correctly. This resolves startup failures for new data plane deployments using HTTPS.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+<AccordionGroup>
+
+<Accordion title='Fixed Security Vulnerability in Dynamic mTLS Authentication'>
+The Gateway now enforces certificate presence for dynamic mTLS authentication by default, rejecting requests that provide only tokens without valid client certificates. A new configuration option `allow_unsafe_dynamic_mtls_token` has been added for backward compatibility, but defaults to `false` to ensure secure behavior. When enabled, this option restores the previous (insecure) behavior of accepting token-only authentication for dynamic mTLS APIs.
+</Accordion>
+
+</AccordionGroup>
+
+## 5.11 Release Notes 
+
+### 5.11.1 Release Notes 
+
+#### Release 13th February 2026
+
+#### Release Highlights
+
+In this release, we have fixed a memory leak that could occur when using JWT authentication; we have resolved a performance issue with bundle verification that significantly impacted resource consumption when using plugin bundles; and we have fixed some priority CVEs. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.11.1) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies 
+<a id="dependencies-5.11.1"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|---- |
+| 5.11.1 | MDCB v2.8.8       | MDCB v2.8.7 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.5       | Sync v2.1.0 |
+|        | Helm Chart v5.0   | Helm all versions |
+|        | Pump v1.13.3      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [Go](https://go.dev/dl/)               | 1.24                   |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x  | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this patch release.
+
+#### Upgrade instructions
+<a id="upgrade-5.11.1"></a>
+
+If you are upgrading to 5.11.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.11.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.11.1
+    ``` 
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.11.1.
+
+- [Source code tarball of Tyk Gateway v5.11.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.11.1)
+
+#### Changelog
+<a id="Changelog-v5.11.1" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed Memory Leak When Using JWKS URL Cache'>
+Resolved a memory leak issue that could occur when APIs used JWT authentication with JWKS URL cache.
+</Accordion>
+
+<Accordion title='Optimized Bundle Verification to Reduce Memory Consumption'>
+Fixed a performance issue introduced in v5.8.7 where bundle verification significantly increased CPU and memory consumption, particularly when using multiple APIs with plugin bundles.
+
+We have introduced a new Gateway configuration option `skip_verify_existing_plugin_bundle` that allows you to skip cryptographic verification when loading signed plugin bundles from disk. When set to `true`, this option reduces the performance overhead for environments with large numbers of APIs using signed bundles, while still maintaining security by validating signatures during the initial bundle download.
+
+**Note**: This option only affects signed bundles loaded from disk, unsigned bundles and initial downloads will continue to follow standard verification procedures.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15467" target="_blank">CVE-2025-15467</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-69419" target="_blank">CVE-2025-69419</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61726" target="_blank">CVE-2025-61726</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61728" target="_blank">CVE-2025-61728</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68121" target="_blank">CVE-2025-68121</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.11.0 Release Notes 
+
+#### Release Date 18 December 2025
+
+#### Release Highlights
+
+Tyk 5.11 delivers security enhancements and deeper operational visibility - empowering teams to scale their API programs with confidence and efficiency.
+
+**Strengthened API Security & Authentication**
+This release advances our security foundation with enhanced JWT authentication capabilities. Teams can now leverage scope-to-policy mapping without requiring default policies, while new support for nested claims enables more granular policy and subject identification. We've also added IP spoofing protection through configurable depth selection in X-Forwarded-For headers.
+
+**Advanced Operational Control**
+Operations teams gain greater flexibility with the ability to temporarily remove targets from upstream load balancers during maintenance windows. Enhanced observability comes through OTel trace propagation to custom gRPC plugins, trace ID inclusion in API traffic logs, and dedicated Gateway latency metrics alongside upstream measurements. Data Plane Gateways now recover more quickly from interruptions to the MDCB link to the Control Plane.
+
+**Enhanced Stability & Performance**
+This release includes important stability improvements, resolving crash conditions in JWT authentication and concurrent processing scenarios, eliminating blocking operations that could cause significant delays during MDCB connectivity issues, and improving performance for OAuth key retrieval in hybrid deployments. These fixes collectively deliver a more reliable and responsive API gateway experience for enterprise environments.
+
+These enhancements collectively strengthen Tyk's position as the platform of choice for organizations requiring enterprise-scale API management with robust security, operational excellence, and developer productivity.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.11.0).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies 
+<a id="dependencies-5.11.0"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|---- |
+| 5.11.0 | MDCB v2.8.8       | MDCB v2.8.7 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.5       | Sync v2.1.0 |
+|        | Helm Chart v5.0   | Helm all versions |
+|        | Pump v1.13.3      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [Go](https://go.dev/dl/)               | 1.24                   |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x  | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+In this release we've deprecated the [policies.allow_explicit_policy_id](/tyk-oss-gateway/configuration#policies-allow_explicit_policy_id) configuration option. This was previously added to allow the use of custom policy IDs, which is now the default behaviour so this option is redundant.
+
+#### Upgrade instructions
+<a id="upgrade-5.11.0"></a>
+
+If you are upgrading to 5.11.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.11.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.11.0
+    ``` 
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.11.0.
+
+- [Source code tarball of Tyk Gateway v5.10.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.11.0)
+
+#### Changelog
+<a id="Changelog-v5.11.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Support for Nested JWT Claim Paths in Subject, Policy, and Scope Mapping'>
+Added support for nested JWT claims for subject and policy fields, enabling hierarchical claim structures to be used in authentication and policy application. Now you can configure the `subjectClaims`, `basePolicyClaims`, and `scopes.claims fields` to use nested claim names, such as `test.sub` or `policy.base`.
+</Accordion>
+
+<Accordion title='Enhanced Latency Metrics with Gateway-Only Processing Time'>
+We have enhanced request-level timing by tracking precise timestamps when requests enter the Gateway, enabling accurate end-to-end latency calculations that extend beyond previous proxy-only measurements.
+- Added `gateway` field to the `latency` struct in traffic logs to capture Gateway-specific processing time separate from upstream latency.
+- Extended Prometheus and StatsD pumps to expose Gateway-only latency metrics alongside existing total and upstream measurements for improved observability.
+</Accordion>
+
+<Accordion title='Full Support for Custom GraphQL Scalar Values in Tyk GraphQL Engine'>
+We have added support for custom scalar values when working with GraphQL APIs. Custom scalars can accept any valid GraphQL value literal (string, number, boolean, enum, object, list, null, variable), matching the GraphQL specification's requirements for custom scalars.
+Existing standard scalar types (Int, Float, String, Boolean, ID) continue to work as before.
+</Accordion>
+
+<Accordion title='Background DNS Monitor for Faster MDCB Endpoint Failover'>
+We have implemented background monitoring of MDCB endpoint DNS resolution to ensure rapid response to changes without waiting for failures, which block API consumer requests. When a DNS change is detected, Tyk will now automatically reconnect the RPC client to minimise downtime and risk of request blocking. The DNS monitor checks for changes at a configurable interval (default: 30 seconds, minimum: 10 seconds). This can be set using the `slave_options.dns_monitor` configuration.
+</Accordion>
+
+<Accordion title='Support Temporary Removal of Upstream Targets via Zero-Weight Load Balancing'>
+You can now temporarily remove upstream targets (servers) from Tyk's upstream load balancing group. If a target is removed from the group, Tyk will route no traffic to it. This allows temporary target removal for maintenance, troubleshooting or environment issues.
+Simply set the weight for the target to zero, and it will be removed from the round robin list. Multiple targets can be removed, but at least one must have a non-zero weight and thus will be served traffic.
+</Accordion>
+
+<Accordion title='Removed Default Policy Requirement for JWT Scope-to-Policy Mapping'>
+We’ve removed the need to supply a default policy when using scope-to-policy mapping with JWT Authentication. Now, if you enable scope-to-policy mapping by configuring `scopes.claimName`, you do not need to provide a policy ID in `defaultPolicies`. If a request does not contain any valid scopes, it will be rejected with `HTTP 403 Forbidden` (default deny). You can still provide a default policy if you require a different behaviour.
+</Accordion>
+
+<Accordion title='Add OTel Trace ID to Traffic Logs for Improved Observability'>
+When OpenTelemetry is enabled, the Trace ID allocated to each request is tagged in traffic logs as `trace-id-{traceID}` and also exposed in `$tyk_context.tyk_trace_id`. This makes it easier to correlate traffic logs with OTel traces in observability platforms and also allows transformation middleware and custom plugins to correlate logs with traces.
+</Accordion>
+
+<Accordion title='Added Configurable `X-Forwarded-For` Header Selection'>
+Added `xff_depth` configuration parameter to the Gateway's HTTP server options for improved security. This specifies which entry in the `X-Forwarded-For` header chain should be considered to contain the real client IP. The value set in `xff_depth` is used when counting from the rightmost (most trusted) end of the IP chain, where a value of 1 is the first (counting from the right). If `xff_depth` is set to 0 or not configured, Tyk continues using the first IP address as before, maintaining backward compatibility. We have updated the default configurations across Tyk Demo, Helm Charts, and example files to use `xff_depth=1` for enhanced security in new deployments.
+</Accordion>
+<Accordion title='OpenTelemetry Trace Context Propagation for gRPC Plugins'>
+Implemented OpenTelemetry trace context propagation to maintain request tracing visibility as requests flow through plugins, with specific support for gRPC plugins. Enhanced the Protocol Buffer definitions and Dispatcher interface to include trace context fields, updated the `CoProcessor` and `GRPCDispatcher` to preserve trace information, and added OpenTelemetry gRPC interceptors for seamless context propagation. This eliminates observability blind spots in plugin processing, allowing customers to see complete end-to-end traces of API requests, including all plugin activities.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed JWT Authentication Panic in MDCB Emergency Mode'>
+Fixed a bug causing JWT authentication to panic in MDCB emergency mode. When processing tokens with new sub-claims, the gateway returned an uninitialized session missing its KeyID, leading to a crash when generating the session’s KeyHash. The fix ensures the KeyID is preserved in the emergency-mode path, allowing sessions to be created and cached correctly and preventing panics during MDCB outages.
+</Accordion>
+
+<Accordion title='Resolved Panic Triggered by DRL Updates in Mixed Rate-Limiter Environments'>
+Fixed an issue where Gateways using Redis-based rate limiters would crash when sharing Redis with Gateways using Distributed Rate Limiting (DRL). Non-DRL Gateways now properly ignore DRL update messages instead of attempting to process them, enabling mixed rate-limiter deployments across shared Redis instances.
+</Accordion>
+
+<Accordion title='Fixed Data Plane Startup Failures Causing Incorrect 404 Responses'>
+Fixed an issue where a Data Plane Gateway could fail to load API definitions the MDCB link failed during initialisation. This would lead to client requests returning HTTP 404 errors. The expected behaviour, if MDCB is unavailable, is for the Data Plane Gateway to retrieve policies and API definitions from the local storage (Redis), but this was not occurring in certain scenarios. We have improved the robustness of the Gateway startup so that, if MDCB goes down, it will automatically switch to the local storage (Redis) as expected.
+</Accordion>
+
+<Accordion title='Corrected mTLS Certificate Advertising for RFC-Compliant Clients'>
+Fixed an issue where Tyk Gateway advertised leaf certificate Subject DNs instead of Certificate Authority DNs during mTLS handshakes, causing connection failures with RFC-compliant TLS clients. The Gateway now properly extracts and advertises CA DNs from certificate chains in the CertificateRequest message, ensuring compatibility with standards-compliant clients like `Apache mod_ssl` while maintaining backward compatibility with existing configurations.
+</Accordion>
+
+<Accordion title='Fixed JSON Formatter Failures with Large Numeric Error Values'>
+We fixed a logging bug in the JSON formatter that could cause error logs to fail to serialize when an error message contained very large numeric values (for example a big integer), which sometimes resulted in missing or broken log output; the formatter now writes the error as a plain text string instead of attempting to encode the underlying error object, so logs reliably serialize to JSON.
+</Accordion>
+
+<Accordion title='Reduced RPC Retry Delays by Improving DNS Change Detection'>
+Fixed an issue where the Gateway would incorrectly retry RPC calls repeatedly when MDCB is unavailable, but the DNS hasn't changed. This would cause API requests to block for over 90 seconds before returning an error. Now it takes into account the fact that DNS has not changed and so fails fast, entering Emergency Mode after one retry (30 seconds).
+</Accordion>
+
+<Accordion title='Removed Redundant Boolean Enums from OpenAPI Specification'>
+Fixed redundant boolean enum definitions in OpenAPI specification by removing unnecessary enum: [true, false] declarations from boolean type fields in swagger.yml files. Boolean parameters now use only type: boolean, following OpenAPI best practices.
+</Accordion>
+
+<Accordion title='Fixed OAuth Client Key Retrieval Delays in JWT APIs on Hybrid Gateways'> 
+Resolved an issue where JWT APIs using Keycloak authentication experienced significant delays on hybrid gateways due to failed local key lookups. The gateway was unable to find OAuth client keys in local Redis and had to fetch them from the control plane on every request, causing performance degradation and "key not found" errors in logs. JWT API requests now retrieve keys efficiently from local storage, eliminating unnecessary round-trip requests and providing consistent response times.
+</Accordion>
+
+<Accordion title='Request pipeline blocked by synchronous RPC calls every 10 minutes when MDCB is unavailable'>
+Fixed blocking synchronous RPC calls in the request pipeline that occurred every 10 minutes during organization expiry checks when MDCB was unavailable. The organization expiry validation is now asynchronous and non-blocking, preventing API request timeouts and latency spikes (up to 90 seconds) when MDCB connectivity issues occur. This ensures consistent API response times regardless of MDCB availability status.
+</Accordion>
+
+<Accordion title='Fixed Gateway Crash During Concurrent JWT Claims Validation'>
+Resolved an issue where Tyk Gateway would crash when multiple users simultaneously accessed APIs with JWT claims validation enabled. The Gateway now processes JWT validation configurations once during API startup instead of during each request, eliminating the race conditions that caused service interruptions under concurrent load.
+</Accordion>
+
+<Accordion title='Fixed: API Keys Remain Active When Set to Inactive Status'>
+Resolved an issue where API keys continued to process traffic even after being marked as inactive through API updates.
+</Accordion>
+
+</AccordionGroup>
+
+## 5.10 Release Notes 
+
+### 5.10.2 Release Notes 
+
+#### Release Date 2 December 2025
+
+#### Release Highlights
+
+This is a version bump to align with Dashboard v5.10.2, no changes have been implemented in this release.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies 
+<a id="dependencies-5.10.2"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|---- |
+| 5.10.2 | MDCB v2.8.6       | MDCB v2.8.6 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.4       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | Pump v1.13.0      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [Go](https://go.dev/dl/)               | 1.24                   |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x  | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.10.2"></a>
+
+If you are upgrading to 5.10.2, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.10.2)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.10.2
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-1-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.10.2.
+
+- [Source code tarball of Tyk Gateway v5.10.2](https://github.com/TykTechnologies/tyk/releases/tag/v5.10.2)
+
+#### Changelog
+<a id="Changelog-v5.10.2" data-scroll-offset></a>
+
+No changes in this release.
+
+### 5.10.1 Release Notes 
+
+#### Release Date 19 November 2025
+
+#### Release Highlights
+
+This patch release contains various bug and security fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.10.1).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies 
+<a id="dependencies-5.10.1"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+|--------|-------------------|---- |
+| 5.10.1 | MDCB v2.8.5       | MDCB v2.8.5 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.4       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | Pump v1.13.0      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| ---------------------- | --------------- | ------------------- | -------- | 
+| [Go](https://go.dev/dl/)               | 1.24                   |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x  | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.10.1"></a>
+
+If you are upgrading to 5.10.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.10.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.10.1
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.10.1.
+
+- [Source code tarball of Tyk Gateway v5.10.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.10.1)
+
+#### Changelog
+<a id="Changelog-v5.10.1" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed Custom Authentication fallback when custom plugin bundle is disabled'>
+Fixed an issue where [Custom Authentication](/api-management/authentication/custom-auth) could fall back to a previously configured alternative authentication method if the custom plugin bundle was not loaded. Now this is treated as for any other failed plugin load, and requests to the API will be rejected with `HTTP 500 Internal Server Error` to prevent access to an improperly configured endpoint.
+</Accordion>
+
+<Accordion title='Fixed issue with invalid or missing bundle manifests'>
+Fixed an issue where the Gateway would load and attempt to use plugin bundles even when the manifest file was invalid or missing. The Gateway now properly validates bundle manifests and fails safely by rejecting API requests when bundles cannot be properly loaded or verified. 
+This prevents risks from corrupted or tampered bundles and ensures that APIs with invalid plugin configurations are not accessible, maintaining the integrity of authentication and authorization checks implemented by plugins.
+</Accordion>
+
+<Accordion title='Fixed JWT key activation when toggling default policy from draft to active'>
+Fixed an issue where keys could remain deactivated when a policy applied to them was changed from `draft` to `active` status. When an access key/token is presented to Tyk in a request, policies linked to the key will be applied, configuring the authorization for that request. If any policy is in `draft` state, the key will be rejected. 
+Toggling the policy to the `active` state should activate any keys to which the policy is applied. Previously, if the policy had never been applied when it was in `draft` state, there was an issue where keys would incorrectly be marked as `inactive`. This has now been resolved, and the policy state is correctly mapped to keys.
+</Accordion>
+
+<Accordion title='Added new configuration option for limiting response body size'>
+Added a new configuration option, [HttpServerOptions.MaxResponseBodySize](/tyk-oss-gateway/configuration#http_server_options-max_response_body_size) to limit the maximum size of the response bodies processed during any response body transformations.  When the limit is exceeded, the Gateway returns `HTTP 500 Response Body Too Large` instead of attempting to process the oversized content.
+</Accordion>
+
+<Accordion title='Fixed plugin loading failure errors being ignored for gRPC, Python, and Lua plugins'>
+Fixed an issue where plugin loading failure errors were ignored for gRPC, Python, and Lua plugins, allowing API requests to be processed even when plugins failed to load. The Gateway now properly validates plugin drivers during request processing and fails safely by returning `HTTP 500 Internal Server Error` when any plugin fails to load, ensuring consistent behavior across all plugin types.
+</Accordion>
+
+<Accordion title='Fixed random version selection when `not_versioned` is set to true'>
+Fixed an issue where a **Tyk Classic API** with inconsistent versioning configuration would process requests using a **random version’s configuration**.
+
+A non-versioned API should:
+
+- Contain a single entry in `version_data.versions` with the API configuration.
+- Have the `version_data.not_versioned` flag set to `true`.
+
+Previously, if multiple entries existed in the `version_data.versions` array while `not_versioned` was set to `true`, the Gateway would **randomly select one** of those versions to process incoming requests.
+
+**New behavior:**
+
+When `version_data.not_versioned` is set to `true` and multiple versions are present, Tyk now deterministically selects the configuration for the **default version** instead of picking one at random.
+
+Tyk determines the default version as follows:
+
+- First, it looks for an entry named `"Default"`.
+- If not found, it checks for `"default"`.
+- If neither exists, it checks for an entry with an **empty string key** (`""`).
+- If none of these are found, Tyk returns an **error**, indicating a misconfigured non-versioned API.
+</Accordion>
+
+<Accordion title='Improved path handling during bundle decompression.'>
+Tyk Gateway now validates all file paths in zip bundles before extraction, rejecting bundles that contain invalid paths. Bundle extraction fails immediately upon detecting invalid paths, with detailed error logging, ensuring that only proper bundles with valid relative paths are processed.
+</Accordion>
+
+<Accordion title='Fixed Data Plane Gateway hanging when MDCB connection is lost'>
+Fixed an issue where a Data Plane Gateway could hang for all client requests when the MDCB connection was lost. This was caused by the Gateway incorrectly checking the Organisation quota when `TYK_GW_ENFORCEORGQUOTAS` was not set. If the Organisation quota cache expired before the Gateway performed a health check, the Gateway could hang.
+
+From this release, the Gateway does not check the Organisation quota cache if this is not set. For users relying on Organisation quotas (setting `TYK_GW_ENFORCEORGQUOTAS=true`), the scenario is different and the lock does not occur.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following high-priority CVEs, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-47912" target="_blank">CVE-2025-47912</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58183" target="_blank">CVE-2025-58183</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58185" target="_blank">CVE-2025-58185</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58186" target="_blank">CVE-2025-58186</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58187" target="_blank">CVE-2025-58187</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58188" target="_blank">CVE-2025-58188</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58189" target="_blank">CVE-2025-58189</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61723" target="_blank">CVE-2025-61723</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61724" target="_blank">CVE-2025-61724</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61725" target="_blank">CVE-2025-61725</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-63811" target="_blank">CVE-2025-63811</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-31133" target="_blank">CVE-2025-31133</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-52565" target="_blank">CVE-2025-52565</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-52881" target="_blank">CVE-2025-52881</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.10.0 Release Notes 
+
+#### Release Date 13th October 2025
+
+#### Release Highlights
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.10.0).
+
+##### OpenAPI Compliant Multi-Authentication for Tyk OAS APIs
+
+Tyk Gateway now supports true OpenAPI specification compliant authentication workflows, giving developers the flexibility to implement industry-standard security patterns while maintaining backward compatibility.
+
+OpenAPI compliant authentication brings:
+
+- **Multiple authentication paths**: Process all entries in the OpenAPI `security` section, not just the first one
+- **Flexible security combinations**: Enable authentication scenarios like "OAuth2 OR Auth Token" where clients can choose their preferred method
+- **Proprietary method integration**: Seamlessly combine standard OpenAPI authentication with Tyk's proprietary methods (Custom Authentication plugin, HMAC) using the same flexible logic
+- **Standards compliance**: Follow OpenAPI security specification patterns that developers expect
+
+Backward compatibility guaranteed:
+
+- **Legacy mode preserved**: Existing APIs continue to work unchanged with the current AND-only logic
+- **Opt-in enhancement**: Switch to compliant mode via the `securityProcessingMode` configuration when ready
+- **No breaking changes**: Existing multi-security configurations remain functional
+
+**Real-world applications**
+
+- Support diverse client authentication capabilities within the same API
+- Implement progressive authentication strategies (basic → advanced security)
+- Align with OpenAPI tooling and documentation expectations
+- Reduce integration complexity for API consumers
+
+Perfect for organizations wanting to leverage standard OpenAPI security patterns while maintaining the flexibility of Tyk's advanced authentication features.
+
+For more details, please see the dedicated [Multi Auth](/basic-config-and-security/security/authentication-authorization/multiple-auth) section.
+
+##### Comprehensive JWT Claim Validation for Tyk OAS APIs
+
+Tyk Gateway now provides enterprise-grade JWT validation capabilities exclusively for Tyk OAS APIs, enabling complete control over token validation beyond basic expiry and signature checks.
+
+**Complete registered claim validation**
+
+- **Multi-Identity Provider support**: Validate issuer, audience, and subject claims against multiple allowed values
+- **Flexible claim mapping**: Configure different claim names for subject, policy, and scope mapping to support various Identity Providers (Keycloak, Okta, Auth0, etc.) within the same API
+- **JWT ID enforcement**: Require unique token identifiers for enhanced security
+
+**Advanced custom claim validation**
+
+- **Flexible validation rules**: Define validation for any JWT claim using required, exact match, or containment rules
+- **Rich data type support**: Handle strings, numbers, booleans, and arrays with nested claim access using dot notation
+- **Non-blocking validation**: Monitor claim compliance without rejecting requests, perfect for gradual policy enforcement
+
+**Real-world applications**
+
+- Role-based access control with custom permission claims
+- Department or organization-based API access restrictions
+- Multi-tenant scenarios with flexible claim validation
+- Gradual migration from legacy authentication systems
+
+This enhancement makes Tyk's JWT middleware the primary validation mechanism for complex enterprise authentication scenarios, providing the flexibility needed for modern Identity Provider integrations while maintaining backward compatibility.
+
+Ideal for organizations that require sophisticated JWT validation beyond standard token checks.
+
+For more details, please see the dedicated [JWT Auth](/api-management/authentication/jwt-authorization) section.
+
+##### Advanced JWKS Cache Management for Tyk OAS APIs
+
+Tyk Gateway now provides comprehensive JWKS (JSON Web Key Set) cache control for Tyk OAS APIs, delivering significant performance improvements and operational flexibility for JWT validation workflows with:
+
+- **Configurable cache timeouts**: Set custom cache durations per Identity Provider to match their key rotation schedules
+- **On-demand cache invalidation**: Instantly refresh cached keys for any API (Classic or OAS) when Identity Providers rotate their signing keys
+- **Intelligent pre-fetching**: Eliminate first-request latency by fetching JWKS data during Tyk OAS API initialization
+
+**Key benefits**
+
+- Faster JWT validation with reduced Identity Provider round-trips
+- Zero cold-start delays for JWT-protected endpoints
+- Immediate response to Identity Provider key rotations
+- Better performance in high-traffic JWT validation scenarios
+
+This enhancement is particularly valuable for organizations migrating to Tyk OAS APIs or those requiring consistent low-latency JWT validation performance with multiple Identity Providers that have different key rotation policies.
+
+For more details, please see the [JWT Auth](/basic-config-and-security/security/authentication-authorization/json-web-tokens) section.
+
+##### Centralized External Service Configuration
+
+Tyk Gateway now provides unified configuration for all external service connections through the new
+`external_services` section. This enhancement brings together previously scattered and incomplete configuration options into a single, coherent system that supports:
+
+- **Proxy configuration**: Apply proxy settings globally or per service, with automatic support for standard environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`)
+- **mTLS certificate management**:Centralized certificate configuration for secure connections to external services
+- **Comprehensive service coverage**: Covers all external integrations, including databases, OAuth providers, and webhook endpoints
+
+This improvement simplifies deployment in enterprise environments where proxy servers and certificate management are critical, while maintaining full backward compatibility with existing configurations.
+
+**Key benefits**
+- Reduced configuration complexity and duplication
+- Better security through centralized certificate management
+- Simplified proxy configuration for containerized deployments
+- Consistent external service connection handling across all Tyk components
+
+For more details, please see the dedicated [section](/configure/external-service).
+
+##### Proactive Certificate Expiry Monitoring
+
+Tyk Gateway now automatically monitors certificate health and proactively alerts administrators before certificates expire, helping prevent service outages caused by expired mTLS certificates.
+
+The new certificate monitoring system provides:
+
+- **Early warning notifications**: Configurable alerts when certificates approach expiry (default: 30 days)
+- **Immediate expiry detection**: Real-time notifications when expired certificates are detected in use
+- **Comprehensive coverage**: Monitors certificates used in both client-to-Gateway and Gateway-to-upstream connections
+- **Smart throttling**: Built-in cooldown mechanisms prevent alert flooding while ensuring visibility
+
+These events integrate seamlessly with existing monitoring and alerting systems through Tyk's standard event framework, enabling teams to set up automated workflows for certificate renewal and replacement.
+
+**Key benefits**
+
+- Prevent unexpected API outages due to expired certificates
+- Reduce manual certificate monitoring overhead
+- Enable proactive certificate lifecycle management
+- Improve overall API reliability and uptime
+
+Perfect for organizations managing multiple certificates across complex API infrastructures where manual tracking becomes impractical.
+
+For more details, please see the dedicated [Gateway events](/api-management/gateway-events) section.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+<a id="dependencies-5.10.0"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :-------- | :------------------- | :---- |
+| 5.10.0 | MDCB v2.8.5       | MDCB v2.8.5 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.3       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | Pump v1.12.2      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| :---------------------- | :--------------- | :------------------- | :-------- | 
+| [Go](https://go.dev/dl/)               | 1.24                   |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x  | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.10.0"></a>
+
+If you are upgrading to 5.10.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.10.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.10.0
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.10.0.
+
+- [Source code tarball of Tyk Gateway v5.10.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.10.0)
+
+#### Changelog
+<a id="Changelog-v5.10.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+
+<AccordionGroup>
+<Accordion title='OpenAPI compliant multi-authentication mode for Tyk OAS APIs'>
+Added OpenAPI Specification compliant multi-authentication support for Tyk OAS APIs, providing flexible authentication workflows that follow standard OpenAPI security patterns.
+
+**Compliant mode (new)**
+- Processes all entries in the OpenAPI `security` section sequentially, not just the first entry
+- Supports a local `security` section in the Tyk vendor extension for proprietary authentication methods (Custom Authentication plugin, HMAC)
+- Uses AND logic within each security entry and OR logic between entries, enabling flexible authentication combinations such as: OAuth2 OR Auth Token
+- Allows clients to authenticate using any of the defined security combinations
+
+**Legacy mode (existing behavior)**
+- Continues to use only the first entry from the OpenAPI `security` section
+- Combines all declared methods with proprietary vendor extension methods using AND logic
+- Requires clients to satisfy ALL authentication methods
+
+The authentication processing mode is controlled by the new `server.authentication.securityProcessingMode`
+field in the Tyk Vendor Extension, with `legacy` as the default to ensure backward compatibility. In compliant mode, proprietary authentication methods are configured in the new `server.authentication.security` section within the vendor extension, following the same array structure as the OpenAPI `security` section. This prevents breaking changes for existing API definitions that contain multiple entries in the
+`security` section but were designed for legacy processing behavior.
+</Accordion>
+
+<Accordion title='Enhanced JWT claim validation for Tyk OAS APIs'>
+Tyk OAS APIs now support comprehensive validation of JWT registered claims, extending beyond basic token validation to provide complete access control capabilities. This enhancement includes:
+
+**Registered claim validation**
+
+- **Subject, issuer, and audience validation**: Validate tokens against allowed values with support for multiple entries per claim type
+- **JWT ID enforcement**: Require presence of unique token identifiers (`jti`) when needed
+- **Flexible claim mapping**: Configure different claim names for subject, base policy, and scope-to-policy mapping to support multiple Identity Providers within the same API setup (e.g., Keycloak's `scope` vs Okta's `scp`)
+
+**Custom claim validation framework**
+
+- **Flexible validation rules**: Define validation for any custom JWT claim using three rule types: `required` (claim must exist), `exact_match` (claim equals specific values), or `contains` (claim contains specific values)
+- **Advanced data support**: Handle string, number, boolean, and array data types with nested claim access using dot notation (e.g., `user.department`)
+- **Non-blocking validation**: Configure rules to log warnings instead of rejecting requests for monitoring and gradual enforcement scenarios
+
+These features enable advanced use cases, such as role-based access control, department validation, and custom permission schemes, while maintaining backward compatibility with existing JWT configurations.
+
+**Note:** Available only for Tyk OAS APIs and configured directly in the API definition via the Tyk Vendor Extension.
+</Accordion>
+
+<Accordion title='Enhanced JWKS caching with configurable timeout, invalidation, and pre-fetching'>
+Enhanced the JWKS (JSON Web Key Set) caching system with three key improvements to reduce latency and provide better control over JWT validation:
+
+Configurable cache timeout - Tyk OAS APIs can now specify custom cache timeout values for JWKS endpoints in their JWT validation configuration, allowing fine-tuned control over cache refresh intervals based on Identity Provider requirements.
+
+- Cache invalidation API - Administrators can now manually invalidate JWKS cache entries via new Gateway API endpoints (`DELETE /tyk/cache/jwks/{apiID}` and `DELETE /tyk/cache/jwks`), either targeting specific APIs or purging all cached JWKS data. This enables immediate cache refresh when Identity Provider keys are rotated.
+- Automatic pre-fetching - For Tyk OAS APIs, JWKS data is now automatically fetched and cached when API definitions are loaded, eliminating cold-start delays for JWT validation. Pre-fetching includes comprehensive logging of fetch attempts and results, and failures do not prevent API initialization.
+
+**Note:** For Tyk Classic APIs, JWKS caching behavior remains unchanged with on-demand fetching during token validation using the default cache timeout (60 seconds). Cache invalidation via the new API endpoints works for both Classic and OAS APIs.
+
+These enhancements improve JWT validation performance for Tyk OAS APIs and provide administrators with better tools for managing JWKS cache lifecycle when Identity Provider keys change.
+</Accordion>
+
+<Accordion title='Enhanced external service integration with proxy and mTLS support'>
+Added a new `external_services` section in the [Gateway configuration](/configure/external-service) to provide centralized configuration for proxy settings and mTLS certificates when communicating with external services. This includes connections to persistent and temporal storage, OAuth 2.0 Authorization Servers, and webhook targets.
+
+Tyk Gateway can now apply proxy settings from standard environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) or use the new granular configuration options. All existing configuration methods remain supported, including legacy options such as `jwt_ssl_insecure_skip_verify` and `http_proxy`.
+</Accordion>
+
+<Accordion title='Gateway Certificate Expiry Notification Events'>
+Introduced a proactive event system to warn administrators when mTLS certificates are approaching expiry. The Gateway now emits two new [API events](/api-management/gateway-events#api-events) to provide visibility into certificate status:
+
+- `CertificateExpiringSoon` - Generated when a certificate is used in an API request (either client-to-Gateway or Gateway-to-upstream) within a configurable time period of its expiry date
+- `CertificateExpired` - Generated when an attempt is made to use an already expired certificate, in addition to the standard error response sent to the API client
+
+A cooldown mechanism prevents event flooding by throttling the generation of these notifications. The threshold for the `CertificateExpiringSoon` event and cooldown parameters are configured in the Gateway configuration:
+
+```
+"security": {
+  "certificate_expiry_monitor": {}
+}
+```
+
+The default threshold is 30 days before expiry.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Changed
+
+
+
+<Expandable title='Go 1.24 Upgrade for Tyk Gateway'>
+The Tyk Gateway has been updated to [Golang 1.24](https://tip.golang.org/doc/go1.24), improving security by staying up-to-date with Go versions.
+</Expandable>
+
+
+
+<Expandable title='Support for pre-configurable versioning setup for Tyk OAS APIs'>
+Implemented changes to the validation of Tyk OAS API definitions to support the enhanced versioning workflow implemented in Tyk Dashboard v5.10.0. This allows the pre-configuration of versioning settings before creating any child versions. You can now define the version identifier location (header, URL path, or query parameter) and key/name/pattern, and the request proxying behavior on a non-versioned API, preparing it to become a base API.
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed panic when an unexpected query parameter is provided to the Gateway API'>
+Fixed an issue where sending certain unexpected query parameters to the `GET /tyk/apis/oas/{id}` endpoint could cause a panic.
+</Accordion>
+
+<Accordion title='Fixed duplication of version identifier configuration when importing OpenAPI description'>
+Fixed an issue where importing an OpenAPI description with an `apiKey` security scheme, while using the `authentication` query parameter, resulted in the unnecessary generation of a `header` object within the Tyk Vendor Extension (`x-tyk-api-gateway`), duplicating information already present in the declared OpenAPI security scheme.
+</Accordion>
+
+<Accordion title='Fixed mock responses not working with internal API proxying'>
+Fixed an issue where Tyk OAS mock response middleware failed to execute when internal API proxying was enabled. Mock responses configured in the target API are now correctly returned when a request is redirected to another API on the same Tyk Gateway instance via [internal looping](/advanced-configuration/transform-traffic/looping).
+</Accordion>
+
+<Accordion title='Base API CORS settings incorrectly applied to child API versions'>
+Fixed an issue where CORS settings from the base API were incorrectly applied to all versions of a Tyk OAS API, preventing child API versions from using their own CORS configuration. This occurred because the CORS check was performed before the request was routed to the correct API version.
+
+The processing order has been corrected so that requests are first routed to the appropriate version (base or child), then the correct CORS settings are applied, allowing each API version to have its own CORS configuration.
+</Accordion>
+
+<Accordion title='Fixed Request Body Transform middleware not being applied with regex in URL rewrite'>
+Fixed an issue where Response Body Transformation middleware failed to apply to endpoints that used URL rewrite with regex patterns. When the endpoint path contained regex metacharacters (e.g., $, ^, (), []), these characters interfered with the body transformation's internal pattern-matching process, preventing the middleware from executing.
+</Accordion>
+
+<Accordion title='Fixed duration format validation errors in Tyk OAS API definitions'>
+Resolved an issue where the Gateway automatically converted Readable Duration values (such as uptime test timeouts) in Tyk OAS API definitions from integer-based formats to decimal formats, which triggered schema validation warnings. The effect of this was seen in the Tyk OAS API editor in the Dashboard UI where, for example, a duration of '4s500ms' would be converted to '4.5s' when reopening an API definition. 
+
+Duration values are now consistently serialized and maintained in their original, integer-based format, preventing these validation errors.
+</Accordion>
+
+<Accordion title='Fixed TLS configuration not being applied for Redis rate limiting'>
+Fixed an issue where Tyk Gateway did not properly apply the configured TLS settings when connecting to Redis for rate limiting operations. This could result in connection failures and incorrect `HTTP 429 Too Many Requests` responses being returned to clients. The rate limiter now correctly establishes TLS connections to Redis.
+</Accordion>
+
+<Accordion title='Fixed Gateway crash when deleting APIs with Uptime Test enabled'>
+Fixed a bug where deleting an API with the Uptime Test feature enabled could cause the Gateway to crash due to a nil pointer dereference during cleanup operations. The Gateway now properly handles memory cleanup when removing APIs with active uptime tests, preventing crashes and ensuring stable API lifecycle management.
+</Accordion>
+
+<Accordion title='Fixed Gateway re-registration failures after restart'>
+Fixed an issue where Gateways could fail to re-register with the Dashboard after a restart, particularly during upgrades or in large-scale deployments. This resulted in `Authorization failed (Nonce empty)` errors and Gateway crash loops that prevented successful registration. 
+
+The fix includes an updated license handler with hardened registration logic, enhanced Dashboard authentication retry mechanisms, and support for new "Unlimited Gateway" licenses, ensuring Gateways register reliably without entering failure loops even during heavy churn or rolling upgrades.
+</Accordion>
+
+<Accordion title='Fixed body decompression errors with GraphQL APIs when analytics is enabled'>
+Fixed an issue that caused repeated `Body decompression error: EOF` log messages when analytics were enabled for GraphQL APIs. The problem occurred because the Gateway attempted to decompress the response body after it had already been consumed for analytics processing, resulting in End of File (EOF) errors. 
+
+The Gateway now properly handles response body consumption for GraphQL APIs with analytics, eliminating the spurious error logs.
+</Accordion>
+
+<Accordion title='Stricter validation for version name parameter when creating a new child API version'>
+Fixed an issue where users could create child Tyk OAS API versions using the `/tyk/apis/oas` endpoint without specifying a valid version name (`new_version_name`). The Gateway API now rejects such requests with an `HTTP 422 Unprocessable Entity` error, ensuring all versions have meaningful identifiers and preventing the creation of unusable or empty version entries.
+</Accordion>
+
+<Accordion title='Fixed inconsistent middleware updates for Tyk OAS API `PATCH` requests'>
+Fixed an issue where updating a Tyk OAS API via `PATCH /tyk/apis/oas/{apiId}` did not properly update the Tyk Vendor Extension (`x-tyk-api-gateway`). When endpoints were removed or modified in the OpenAPI description, their corresponding middleware definitions could persist incorrectly in the vendor extension, leaving the API definition in an inconsistent state. 
+
+The vendor extension is now correctly rebuilt to reflect all changes made to the OpenAPI description.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+## 5.9 Release Notes 
+
+### 5.9.2 Release Notes
+
+#### Release Date 5th September 2025
+
+#### Release Highlights
+
+This is a version bump to align with Dashboard v5.9.2, no changes have been implemented in this release. For further information, please see the release notes for Dashboard [v5.9.2](/developer-support/release-notes/dashboard#5-9-2-release-notes).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :-------- | :------------------- | :---- |
+| 5.9.2  | MDCB v2.8.4       | MDCB v2.8.4 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.3       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | Pump v1.12.1      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| :---------------------- | :--------------- | :------------------- | :-------- | 
+| [Go](https://go.dev/dl/)               | 1.23                   |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x  | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.9.2"></a>
+
+If you are upgrading to 5.9.2, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.9.2)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.9.2
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.9.2.
+
+- [Source code tarball of Tyk Gateway v5.9.2](https://github.com/TykTechnologies/tyk/releases/tag/v5.9.2)
+
+#### Changelog
+<a id="Changelog-v5.9.2" data-scroll-offset></a>
+
+Since this release was version-bumped only to align with Dashboard v5.9.2, no changes were encountered in this release.
+
+### 5.9.1 Release Notes
+
+#### Release Date 14th August 2025
+
+#### Release Highlights
+
+This release restores the stable /hello health-check behavior for Kubernetes probes. Deployments using /hello for liveness or readiness will now behave consistently again.
+
+It also fixes a schema compatibility issue in the URL Rewrite middleware, ensuring that API promotion and validation flows no longer fail due to schema mismatches.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.9.1).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :-------- | :------------------- | :---- |
+| 5.9.1  | MDCB v2.8.3       | MDCB v2.8.3 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.2       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | Pump v1.12.0      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| :---------------------- | :--------------- | :------------------- | :-------- | 
+| [Go](https://go.dev/dl/)               | 1.23                   |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x  | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.9.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.9.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.9.1
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.9.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.9.1)
+
+#### Changelog
+<a id="Changelog-v5.9.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Gateway `/hello` endpoint behaviour restored when Redis is unavailable'>
+Reverted the change introduced in versions 5.9.0 and 5.8.3 to the `/hello` health check endpoint, restoring its original functionality. This fix resolves an issue where the endpoint returned a 503 error when Redis was down. The `/hello` endpoint now correctly returns HTTP 200 during normal operations, ensuring compatibility with Kubernetes liveness and readiness probes.
+</Expandable>
+
+
+
+<Expandable title='URL Rewrite Middleware Schema Compatibility Fix'>
+Fixed a breaking change in the URL Rewrite middleware schema where the ’negate’ field inadvertently became mandatory in versions 5.8.3 and 5.9.0. This change caused validation errors when promoting APIs created in earlier versions (e.g., 5.8.1) to newer environments. The ’negate’ field is now optional again, restoring backward compatibility and defaulting to ‘false’ when omitted.
+</Expandable>
+
+
+
+
+### 5.9.0 Release Notes
+
+#### Release Date 4th August 2025
+
+#### Release Highlights
+
+This release builds on the recent release of [Tyk 5.8.3](/developer-support/release-notes/gateway#5-8-3-release-notes), adding a collection of new capabilities. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.9.0).
+
+##### Accept JSON Web Tokens (JWTs) Issued By Multiple Identity Providers
+
+Tyk can now validate JWTs against multiple JSON Web Key Set (JWKS) endpoints, allowing you to use different IdPs to issue JWTs for the same API. Previously, we supported only a single JWKS endpoint in the `source` field, but now you can register multiple JWKS endpoints in the Tyk OAS API definition.
+
+When a request is received bearing a JWT, Tyk will retrieve JWKS from all registered IdPs to check the token's validity, for full details of how to use this powerful feature see the improved [JWT Authentication](/api-management/authentication/jwt-signature-validation#configuring-idps-in-the-api-definition) section.
+
+**Please note that this functionality is not available for Tyk Classic APIs.**
+
+##### Compatibility with Valkey
+
+Tyk is now fully compatible with [Valkey](https://valkey.io/), the open-source (BSD) high-performance key/value datastore backed by the Linux Foundation, as an alternative to Redis.
+
+##### Enhancements to Tyk Streams for Enterprise Edition
+
+We've added support for additional processors, inputs and outputs for [Tyk Streams event driven APIs](/api-management/event-driven-apis), extending the flexibility of this powerful feature.
+
+#### Breaking Changes
+
+**1. Modified `/hello` endpoint behavior affects kubernetes deployments**
+
+In Tyk Gateway version 5.9.0, we introduced a breaking change to the `/hello` health check endpoint behavior. Previously, this endpoint would always return HTTP 200 during normal operations, regardless of Redis connectivity. The change made the endpoint return HTTP 503 when Redis was unavailable (which shouldn't be the case), which caused issues for Kubernetes deployments using this endpoint for liveness probes.
+
+##### Impact
+
+-   Kubernetes pods may be unnecessarily terminated when Redis becomes temporarily unavailable
+-   Deployments using `/hello` for both liveness and readiness probes experience disruption
+-   This contradicts the documented behavior that the Gateway continues functioning when Redis is unavailable
+
+##### Expected Fix Version
+
+This issue will be fixed in Tyk Gateway version 5.9.1, where we will:
+
+-   Revert the `/hello` endpoint to its pre-5.8.3 behavior (always return HTTP 200 during normal operations)
+-   Ensure backward compatibility for existing Kubernetes deployments
+
+**2. URL rewrite rules now require explicit `negate` field**
+
+A breaking change has been identified in Tyk 5.9.0 regarding [URL rewrite rules](/transform-traffic/url-rewriting). The `negate` field, which was optional in previous versions, is now mandatory in all URL rewrite rule configurations.
+
+##### What Changed
+
+In Tyk 5.8.2 and earlier, the `negate` field in [URL rewrite rules](/transform-traffic/url-rewriting) included an omitempty tag, making it optional in JSON. If not provided, it would default to false
+
+In Tyk 5.9.0, this omitempty tag has been removed, making the negate field mandatory in all URL rewrite rule configurations.
+
+##### Impact
+
+API definitions that worked in Tyk 5.8.2 will fail validation in Tyk 5.9.0 if they contain URL rewrite rules without an explicit negate field. This may cause API updates, or promotion between environments failures between environments with error messages similar to:
+
+```
+Error: API Updating Returned error: {
+  "Status": "Error",
+  "Message": "x-tyk-api-gateway.middleware.operations.(.*)OPTIONS.urlRewrite.triggers.0.rules.0: negate is required"
+}
+```
+
+##### Workarounds
+
+When using Tyk 5.9.0, you must explicitly include the negate field in all URL rewrite rules:
+
+```
+{
+  "rules": [
+    {
+      "in": "header",
+      "name": "x-example",
+      "pattern": "test",
+      "negate": false  // This field is now required
+    }
+  ]
+}
+```
+
+Set negate: false for standard matching behavior, or negate: true
+
+##### Expected fix version
+
+This issue will be fixed in Tyk 5.9.1, where we're going to make negate field optional again.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :-------- | :------------------- | :---- |
+| 5.9.0  | MDCB v2.8.2       | MDCB v2.8.2 |
+|        | Operator v1.2.0   | Operator v0.17 |
+|        | Sync v2.1.2       | Sync v2.1.0 |
+|        | Helm Chart v4.0   | Helm all versions |
+|        | Pump v1.12.0      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency | Tested Versions | Compatible Versions | Comments | 
+| :---------------------- | :--------------- | :------------------- | :-------- | 
+| [Go](https://go.dev/dl/)               | 1.23                   |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x  | v3.0.x | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.9.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.9.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.9.0
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.9.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.9.0)
+
+#### Changelog
+<a id="Changelog-v5.9.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Valkey Database Compatibility'>
+Added compatibility with Valkey database as an alternative to Redis. This is for fresh environments, with no migration support from Redis.
+</Accordion>
+
+<Accordion title='Authenticate with Multiple JWKS Providers'>
+Added support for configuration of multiple JWKS (JSON Web Key Set) endpoints in the Tyk OAS API definition. This enables the Gateway to authenticate JSON Web Tokens (JWTs) in multi-identity provider environments. The JWKS endpoints are configured in the new `jwksURIs` array in the JWT Auth `securityScheme`. This will take precedence over the existing `source` field, and existing API definitions will be automatically migrated to use the new field, while maintaining backward compatibility in case of rollback.
+</Accordion>
+
+<Accordion title='Added GraphQL subscription support for upstream SSE servers that require the POST method'>
+Enabled configuration for GraphQL SSE subscriptions to use `POST` requests instead of `GET`, addressing compatibility issues with upstream servers that require `POST`. We’ve added a new option `proxy.sse_use_post` which can be set if `proxy.subscription_type=sse` to cause Tyk to issue `POST` requests. This allows for larger subscription payloads and keeps the subscription payload out of the URL.
+</Accordion>
+
+<Accordion title='Added AMQP and MQTT as Input/Output Methods for Tyk Streams APIs'>
+Added support for AMQP (0.9 and 1.0) and MQTT to be used for input and output methods when constructing Tyk Streams APIs.
+</Accordion>
+
+<Accordion title='Added Bloblang as a Processor for Tyk Streams APIs'>
+Added support for Bloblang to be used as a new processor option for Tyk Streams APIs.
+</Accordion>
+
+<Accordion title='Added KeyID to Tyk Protobufs'>
+Added the missing `KeyID` field to the coprocess `SessionState` proto, allowing gRPC plugins to access it and aligning it with the Go `SessionState` struct. This enables full feature parity for custom authentication and session management in gRPC plugins.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Changed
+
+
+
+<Expandable title='Updated to use latest kin-openapi'>
+Upgraded to use the latest upstream version of kin-openapi (v0.132.0). This ensures improved compatibility, full stack interoperability, and continued support for existing OpenAPI 3.0.x specifications.
+</Expandable>
+
+
+
+---
+
+## 5.8 Release Notes
+
+### 5.8.15 Release Notes 
+
+#### Release Date 30 June 2026
+
+#### Release Highlights
+
+This patch implements several changes and fixes to improve the stability and correct the behavior of the Gateway.
+
+The default content of application logs has been updated with RFC3339 format timestamp and consistent formatting with other components. This could be a **breaking change** for any user whose tooling relies on the specific content of application logs. A legacy mode is available, as described below.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.15) below.
+
+#### Breaking Changes
+
+**Changes to application logs**
+
+This release makes changes to the format of Tyk Gateway application logs so that output is consistent with other Tyk components and aligned with industry observability standards.
+
+<Note>
+This is only a breaking change if you specifically rely on the current log format: for example, if your monitoring, parsing, or alerting tools are built around the existing timestamp format or the entire message.
+</Note>
+
+**Mitigation:** A new `legacy` option has been added to the [`log_format`](/tyk-oss-gateway/configuration#log_format) configuration. This setting preserves the format used prior to Tyk Gateway 5.8.15, with the historical timestamp format and lack of a field identifying for the originating API.
+
+
+#### Dependencies
+<a id="dependencies-5.8.15"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :------ | :---------------- | :---------------- |
+| 5.8.15  | MDCB v2.12.0      | MDCB v2.12.0      |
+|         | Operator v1.4.2   | Operator v0.17    |
+|         | Sync v2.2.0       | Sync v2.2.0       |
+|         | Helm Chart v5.3.0 | Helm all versions |
+|         | Pump v1.16.0      | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.8.15"></a>
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Golang](https://go.dev/dl/)                                     | 1.25  |  1.25  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.8.15"></a>
+
+If you are upgrading to 5.8.15, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.15)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.15
+    ```
+- Helm charts
+  - [tyk-charts v5.2.0](/developer-support/release-notes/helm-chart#5-2-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.15](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.15)
+
+#### Changelog
+<a id="Changelog-v5.8.15" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated cryptographic module used by tyk-gateway-fips'>
+The `tyk-gateway-fips` image now builds using Go 1.25's native FIPS 140-3 capable cryptographic module (`GOFIPS140=v1.0.0`), replacing the BoringCrypto module (`GOEXPERIMENT=boringcrypto`) used by earlier 5.8.x FIPS releases.
+
+<Note>
+For deployments that do not use custom Go plugins, this is a build-time dependency change only and does not change Tyk's official FIPS readiness target for the 5.8.x release line, which remains FIPS 140-2.
+
+ If you build [custom Go plugins](/api-management/plugins/golang) for use with `tyk-gateway-fips`, you must rebuild them with a `tyk-plugin-compiler-fips` image for the matching Gateway version: plugins compiled against an older plugin compiler image are not binary-compatible with `tyk-gateway-fips:v5.8.15` and will fail to load. 
+
+Official FIPS 140-3 readiness, which additionally requires Docker Hardened Images and enterprise supply chain assurances, is available exclusively from 5.13.x onward. See [FIPS 140-3](/developer-support/release-types/fips-release#fips-standard-by-version) for details.
+</Note>
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Standardized application log format'>
+{/* TT-13727 */}
+We have made changes to the format of Tyk Gateway application logs to make them consistent with logs generated by other Tyk components and aligned with industry observability standards.
+
+- **RFC3339 timestamps:** Log entries now consistently use the industry-standard RFC3339 timestamp format (e.g. `2024-12-12T13:59:08Z`), previously a mix of timestamp formats was used.
+
+**Configuration**
+
+The [`log_format`](/tyk-oss-gateway/configuration#log_format) configuration option now accepts three explicit values:
+ 
+- `text`: plain-text logs in the new format introduced in this release (**new default**).
+- `json`: JSON logs in the new format.
+- `legacy`: preserves the format used prior to Gateway 5.8.15, with the historical timestamp format.
+ 
+This is a **breaking change** for any user whose monitoring or log-parsing tools rely on the specific format of the Tyk Gateway application logs. If you require the previous timestamp format, you should set `log_format` to `legacy`.
+</Accordion>
+
+<Accordion title='Fixed issues with logging of HTTP 404 errors'>
+{/* TT-4023 */}
+
+When the Gateway control API is moved to a separate port via [`control_api_port`](/tyk-oss-gateway/configuration#control_api_port), requests to the proxy/data API port that did not match any configured API (generating an `HTTP 404` response) were silently dropped: no log entry was generated even with [`track_404_logs`](/tyk-oss-gateway/configuration#track_404_logs) enabled. This has been fixed; 404 logs are now correctly emitted for unmatched requests on all listening ports.
+
+Additionally, a `host` field has been added to 404 log entries (when using `text` or `json` [`log_format`](/tyk-oss-gateway/configuration#log_format)). This records the Host header from the request, allowing users to distinguish whether the unmatched request was directed at the proxy API or the control API.
+</Accordion>
+
+<Accordion title='Fixed unbounded memory growth with CoProcess plugins and large sessions'>
+{/* TT-17049 */}
+Resolved a risk of unbound memory consumption for APIs using gRPC plugins. The leak was due to an internal regular-expression cache that could grow without limit when Session access rights contained per-user URL patterns, and excessive memory churn when copying large sessions on every request. The fix bounds the maximum size of the cache and reuses Session objects to eliminate the churn. The Gateway now also aligns [`GOMAXPROCS`](https://pkg.go.dev/runtime#GOMAXPROCS) with the container's CPU quota at startup.
+
+This fix introduces the following new configuration options:
+
+- [`regexp_cache_max_entries`](/tyk-oss-gateway/configuration)  caps the regular-expression cache (default: `5000`)
+- [`disable_regexp_cache_bound`](/tyk-oss-gateway/configuration) restores the previous unbounded behaviour for deployments with a naturally limited set of patterns (default:`false`)
+- [`disable_auto_max_procs`](/tyk-oss-gateway/configuration) restores the previous default behavior of GOMAXPROCS (default:`false`)
+</Accordion>
+
+<Accordion title='Fixed Gateway crash under high authentication load'>
+{/* TT-5486 */}
+Under sustained high-concurrency traffic to OIDC, JWT, or Auth-key protected APIs - particularly when the local session cache was disabled - the Gateway could crash with a fatal `concurrent map iteration and map write` panic. This caused unexpected pod restarts, in-flight request loss, and intermittent cluster instability.
+
+This has been fixed. The temporary workaround of enabling the local session cache (`disable_cached_session_state: false`) is no longer required.
+</Accordion>
+
+<Accordion title='Fixed issues with the use of short API keys'>
+{/* TT-17065 */}
+The Gateway's [`min_token_length`](/tyk-oss-gateway/configuration#min_token_length) configuration is intended to prevent the use of API tokens (keys) that are insecure due to their length. All tokens presented during a request to an API are checked against this value and immediately rejected with `HTTP 403` if shorter than the configured minimum length.
+
+Previously, a token with length *equal* to `min_token_length` would be rejected with `HTTP 403`, which is non-intuitive and can lead to wasted debugging time.
+
+Also, it was possible to [create a custom key](https://tyk.io/docs/api-reference/keys/create-custom-key-import-key) shorter than the configured minimum length. The Session would be created, but the key would be unusable as any attempt to use it in a request would be rejected due to the token's length.
+
+Now, tokens with length exactly equal to `min_token_length` are correctly accepted and an attempt to create a custom key shorter than `min_token_length` fails immediately with a `400 Bad Request`.
+</Accordion>
+
+<Accordion title='Fixed GraphQL API authentication headers not being forwarded upstream'>
+{/* TT-16017, TT-17442 */}
+Resolved an issue where, when a GraphQL API was configured with `strip_auth_data` set to `false`, the client's authentication header (for example `Authorization`, or a custom header such as `X-API-KEY`) was not forwarded to the upstream service. This affected all GraphQL execution modes (proxy-only (including WebSocket subscriptions), subgraph, Universal Data Graph, and supergraph) leaving upstream services that require the header unable to authenticate the request.
+
+The active authentication method's header is now propagated upstream across all execution modes, with only the active method's header forwarded. In addition, upstream WebSocket connections for subscriptions are no longer reused across clients presenting different credentials, so each subscription carries its own authentication header, and one client's token can no longer leak to another. When `strip_auth_data` is `true`, no authentication headers are forwarded, as before.
+</Accordion>
+
+<Accordion title='Fixed a change in behavior of health endpoints for Control Plane Gateway when Redis goes down'>
+{/* TT-17486 */}
+Tyk 5.8.14 introduced a change in the behavior of the health endpoints when Tyk Gateway is deployed in the Control Plane. If Redis goes down and the Tyk Dashboard is still available, the Gateway's health endpoints can incorrectly report that everything is healthy.
+
+The Gateway regularly polls for the availability of Dashboard and Redis, caching the status and reporting this when the health endpoints are called. The cache is only updated once both checks are complete and, as a side effect of the fix applied in 5.8.14 to address an issue with the Gateway registration with Dashboard, it was possible for the checks to loop infinitely until Redis was available, such that the cached status was never updated with a "Redis down" message.
+
+The Control Plane Gateway's health endpoints now correctly report the most recent snapshot of Dashboard and Redis availability.
+</Accordion>
+
+<Accordion title='Fixed a race condition when using enforced timeouts on multiple paths'>
+{/* TT-17386 */}
+Tyk 5.8.1 introduced a fix for an issue where an enforced timeout set for a specific API endpoint could be overruled by the configured `proxy_default_timeout`. A side effect of this fix was to uncover a race condition seen when an API has multiple endpoints with different enforced timeouts. The Gateway could incorrectly set the request timeout for all endpoint paths based on the first request received. This has now been resolved and requests to each endpoint are assigned the expected timeout.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41889" target="_blank">CVE-2026-41889</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+- <a href="https://osv.dev/vulnerability/GHSA-j88v-2chj-qfwx" target="_blank">GHSA-j88v-2chj-qfwx</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+
+### 5.8.14 Release Notes 
+
+#### Release Date 21 May 2026
+
+#### Release Highlights
+
+This patch implements several changes and fixes to improve the stability and correct the behavior of the Gateway.
+
+The default minimum and maximum TLS versions are now inherited directly from the underlying Go library, ensuring that Tyk users will benefit from best practice. If non-standard defaults are required, these must be deliberately configured.
+
+We have fixed an issue that was preventing CORS preflight checks from running properly if an allow list was in use and various other issues in observability, internal looping, and Gateway stability.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.14) below.
+
+#### Breaking Changes
+
+**Default maximum and minimum TLS versions** are now inherited from the underlying Golang library and so will be TLS 1.3 and TLS 1.2 respectively (previously were both set to TLS 1.2).
+
+You must set [http_server_options.max_version](/tyk-oss-gateway/configuration#http_server_options-max_version) (or the equivalent environment variable)  to `771` if you require an upper limit of TLS 1.2.
+
+  See [here](/api-management/implement-tls#controlling-tls-version-and-cipher-suites) for details how to control TLS version and cipher suites.
+
+**Query parameters from original request are no longer automatically preserved when looping using `tyk://` protocol)**
+
+We have fixed an inconsistent behavior when using the URL rewrite middleware to loop requests using the Tyk protocol (`tyk://api-id/path`).
+
+Previously, query parameters added to the `rewrite_to` URL were silently dropped, while original request parameters were automatically preserved in the looped request.
+
+This behavior was inconsistent with standard HTTP URL rewrites and prevented proper parameter transformation during internal API routing.
+
+**Impact**
+- Original request query parameters are no longer automatically forwarded through internal loops
+- Existing URL rewrite configurations may lose query parameters that were previously passed through automatically
+- APIs relying on automatic parameter forwarding will receive incomplete requests
+
+**Migration Required**
+Update your URL rewrite configurations to **explicitly include** any original query parameters you want to preserve. For example:
+- **Before:** `"rewrite_to": "tyk://api-123/endpoint"` (original params auto-forwarded)
+- **After:** `"rewrite_to": "tyk://api-123/endpoint?param1=$tyk_context.request_data.param1"`
+
+
+#### Dependencies
+<a id="dependencies-5.8.14"></a>
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.14   | MDCB v2.11.0     | MDCB v2.11.0 |
+|         | Operator v1.4.0 | Operator v0.17 |
+|         | Sync v2.1.8    | Sync v2.1.0 |
+|         | Helm Chart v5.2.0 | Helm all versions |
+|         | Pump v1.15.0    | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+<a id="3rdPartyTools-v5.8.14"></a>
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Golang](https://go.dev/dl/)                                     | 1.25  |  1.25  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.25 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.8.14"></a>
+
+If you are upgrading to 5.8.14, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.14)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.14
+    ```
+- Helm charts
+  - [tyk-charts v5.2.0](/developer-support/release-notes/helm-chart#5-2-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.14](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.14)
+
+#### Changelog
+<a id="Changelog-v5.8.14" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed log level for client TLS certificate requirement errors'>
+We have resolved an issue where "Client TLS certificate is required" errors were logged at `warning` level, creating unnecessary noise in production logs.
+
+Previously, these common client-side authentication failures generated excessive warning-level log entries that could trigger false alerts and obscure more critical issues. The Gateway now logs these authentication failures at `info` level, maintaining security visibility while reducing log noise and alert fatigue for operations teams.
+</Accordion>
+
+<Accordion title='Fixed malformed responses from Go plugins returning error status codes'>
+We have resolved an issue where a Go plugin returning an error status code would result in malformed response bodies that concatenated the original plugin response with additional Gateway error messages.
+
+The Gateway now correctly handles plugin-generated error responses without double-writing headers, ensuring response bodies contain only the payload generated by the plugin and eliminating superfluous warnings in logs.
+</Accordion>
+
+<Accordion title='Fixed query parameter handling when routing requests internally using tyk:// scheme'>
+We have resolved inconsistent query parameter handling in URL rewrites when [internally routing](/advanced-configuration/transform-traffic/looping) using the `tyk://` scheme. Previously, custom query parameters specified in the `rewrite_to` URL were silently dropped, while original request parameters were unexpectedly preserved.
+
+**What's Fixed:**
+- Query parameters explicitly added to `rewrite_to` URLs are now correctly passed to target APIs
+- Control parameters (`method`, `loop_limit`, `check_limits`) are properly consumed and removed
+- Behavior now matches URL rewrites using `http://` protocol
+
+<Note>
+It is important to note that **query parameters provided with the original request are no longer automatically forwarded**. You must update your [URL rewrite configuration](/transform-traffic/url-rewriting) to explicitly include any required parameters in the `rewrite_to` URL.
+</Note>
+</Accordion>
+
+<Accordion title='Fixed client mTLS authentication between Tyk Gateways'>
+We have resolved an issue where a Tyk Gateway acting as a client (using upstream mTLS) would fail to authenticate against another Tyk Gateway acting as the mTLS server, resulting in `HTTP 403 Forbidden: Client TLS certificate is required` errors.
+
+The Gateway now reliably presents the configured upstream client certificate whenever requested by the target server, ensuring seamless mTLS communication between APIs hosted on different Tyk Gateways.
+</Accordion>
+
+<Accordion title='Inherit Maximum (1.3) and Minimum (1.2) TLS Versions from Go'>
+We have resolved an issue where the Tyk Gateway default maximum TLS version was incorrectly set to TLS 1.2 instead of TLS 1.3.
+
+Tyk Gateway now follows Go's native TLS defaults (TLS 1.2 minimum, TLS 1.3 maximum), aligning with industry security standards. This maintains full backward compatibility for existing deployments that explicitly configure TLS versions.
+
+To change the maximum TLS version, you must explicitly set [TYK_GW_HTTPSERVEROPTIONS_MAXVERSION](/tyk-oss-gateway/configuration#http_server_options-max_version) for client-to-Gateway connections or [TYK_GW_PROXYSSLMAXVERSION](/tyk-oss-gateway/configuration#proxy_ssl_max_version) for Gateway-to-upstream connections.
+
+To change the minimum TLS version, you must explicitly set [TYK_GW_HTTPSERVEROPTIONS_MINVERSION](/tyk-oss-gateway/configuration#http_server_options-min_version) for client-to-Gateway connections or [TYK_GW_PROXYSSLMINVERSION](/tyk-oss-gateway/configuration#proxy_ssl_min_version) for Gateway-to-upstream connections.
+
+For full details of TLS version configuration see [here](/api-management/implement-tls#controlling-tls-version-and-cipher-suites).
+</Accordion>
+
+<Accordion title='Fixed CORS preflight blocking by AllowList middleware'>
+We have resolved an issue where CORS preflight OPTIONS requests were incorrectly blocked by the AllowList middleware when `options_passthrough` was disabled.
+
+Previously, when APIs had CORS enabled with Tyk handling OPTIONS requests internally (`options_passthrough: false`), preflight requests would fail AllowList validation because users typically don't explicitly define OPTIONS endpoints in their AllowList configurations, causing "Requested endpoint is forbidden" errors.
+
+The Tyk Gateway now properly recognizes CORS preflight requests and allows them to bypass AllowList middleware checks when Tyk is configured to handle OPTIONS internally, restoring the expected behavior where CORS preflight handling works automatically without requiring explicit OPTIONS endpoint definitions.
+</Accordion>
+
+<Accordion title='Fixed analytics generation for Tyk OAS API mock endpoints'>
+We have resolved an issue where Tyk OAS APIs with mock endpoints stopped generating analytics data. This functionality was inadvertently broken while fixing an unrelated internal API proxying issue in Tyk Gateway 5.8.6.
+
+Note that analytics are not generated for mock endpoints in Tyk Classic APIs as has always been the case.
+</Accordion>
+
+<Accordion title='Fixed OpenTelemetry configuration file settings being ignored'>
+We have resolved an issue where OpenTelemetry settings could only be set using environment variables and not the Gateway configuration file (`tyk.conf`).
+
+Now OpenTelemetry can be configured via the [`opentelemetry`](/tyk-oss-gateway/configuration#opentelemetry) section in the Gateway config file (including `enabled`, `exporter`, and `endpoint` fields) or their equivalent environment variables.
+</Accordion>
+
+<Accordion title='Resolved issue with Gateway entering an unresponsive state during startup'>
+We have fixed an issue where the Gateway could fail to load APIs and policies if the Control Plane database was temporarily unavailable during startup (either directly or via MDCB). The Gateway will now automatically retry loading configurations with exponential backoff until successful, restoring self-healing capabilities without requiring a manual restart.
+</Accordion>
+
+<Accordion title='Fixed error response format for SOAP+XML requests'>
+We have resolved an issue where requests with the `application/soap+xml` Content-Type received JSON-formatted error responses instead of the expected XML format. The Gateway now correctly returns XML-formatted errors for SOAP requests.
+</Accordion>
+
+<Accordion title='Resolved Gateway registration failures at scale with Unlimited Node licenses'>
+We have resolved a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an **unlimited node license**. During mass registrations or rolling upgrades, a combination of lock contention, excessive Redis load, and incorrect handling of `409 Conflict` responses could leave Gateways stuck in registration loops without the credentials needed to serve traffic.
+
+Gateway registration is now significantly more robust at scale: registration requests are no longer serialized across the fleet, Gateways recover cleanly from transient `409 Conflict` responses instead of looping, and the Redis load generated during registration storms is substantially reduced.
+
+A dedicated fix for **limited node license** deployments will be provided in an upcoming release.
+</Accordion>
+
+<Accordion title='Fixed memory issue and unintended rate limit reset in distributed rate limiting'>
+Resolved an issue where the [Distributed Rate Limiter's](/api-management/rate-limit#distributed-rate-limiter) cache cleanup stopped running after its first execution. This could cause unbounded memory growth on APIs using rate limits with high-cardinality keys (such as per-client-IP rate limiting or custom plugins generating unique keys), and could briefly reset active rate-limit buckets shortly after Gateway startup, allowing requests that should have been blocked to pass through. Memory usage now stays bounded, and rate limits are enforced as configured.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39883" target="_blank">CVE-2026-39883</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39882" target="_blank">CVE-2026-39882</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+---
+
+### 5.8.13 Release Notes
+
+#### Release Date 22 April 2026
+
+#### Release Highlights
+
+Tyk Gateway has been updated to Go 1.25 and Debian 13 (Trixie) for enhanced security and performance, including updated FIPS-compliant images. This release addresses multiple CVEs in dependent libraries and resolves a path matching inconsistency for Tyk OAS APIs. It also resurrects two fixes that have been missing since Tyk 5.8.6.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.13).
+
+#### Breaking Changes
+
+There are no breaking changes in this release
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.13   | MDCB v2.9.0     | MDCB v2.9.0 |
+|         | Operator v1.3.0 | Operator v0.17 |
+|         | Sync v2.1.6    | Sync v2.1.1 |
+|         | Helm Chart v5.1.0 | Helm all versions |
+|         | Pump v1.14.1    | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+No deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.13, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.13)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.13
+    ``` 
+- Helm charts
+  - [tyk-charts v5.1.0](/developer-support/release-notes/helm-chart#5-1-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.13](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.13)
+
+#### Changelog
+<a id="Changelog-v5.8.13" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated Go version to 1.25'>
+The Tyk Gateway has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
+</Accordion>
+
+<Accordion title='Update Docker images to Debian 13 (Trixie)'>
+Updated the Docker images for Tyk Gateway to Debian 13 (Trixie) to address multiple vulnerabilities in the underlying operating system.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed path matching inconsistency for Tyk OAS APIs'>
+Resolved an issue where parameterized paths could incorrectly take precedence over static paths when using the Request Validation or Mock Response middleware in Tyk OAS APIs. Static paths will now correctly bypass these middleware if not explicitly configured, restoring the expected routing behavior.
+</Accordion>
+
+<Accordion title='Gateway /hello endpoint behaviour restored when Redis is unavailable'>
+Reverted the change introduced in versions 5.9.0 and 5.8.3 to the /hello health check endpoint, restoring its original functionality. This fix resolves an issue where the endpoint returned a 503 error when Redis was down. The /hello endpoint now correctly returns HTTP 200 during normal operations, ensuring compatibility with Kubernetes liveness and readiness probes.
+
+_This issue was originally fixed in Tyk 5.8.4 but then was omitted from Tyk 5.8.6 onwards_
+</Accordion>
+
+<Accordion title='Gateways in Distributed Data Planes Were Unable To Perform mTLS When MDCB Link Unavailable'>
+Resolved an issue introduced in Tyk 5.7.1 where Gateways in distributed Data Planes failed to cache TLS certificates correctly in the local Redis, resulting in potential service disruptions if MDCB became unavailable. Data plane gateways now reliably serve HTTPS and mTLS traffic even if MDCB is unavailable.
+
+_This issue was originally fixed in Tyk 5.8.2 but then was omitted from Tyk 5.8.6 onwards_
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15281" target="_blank">CVE-2025-15281</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-0861" target="_blank">CVE-2026-0861</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-0915" target="_blank">CVE-2026-0915</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25679" target="_blank">CVE-2026-25679</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32285" target="_blank">CVE-2026-32285</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32286" target="_blank">CVE-2026-32286</a>
+- <a href="https://www.cvedetails.com/cve/CVE-2026-33186/" target="_blank">CVE-2026-33186</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34986" target="_blank">CVE-2026-34986</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+---
+
+### 5.8.12 Release Notes
+
+#### Release Date 11 March 2026
+
+#### Release Highlights
+
+In this release, we have fixed some discrepancies in the path matching decision making for different middleware when using Tyk OAS APIs. This corrects a number of unexpected behaviors and ensures consistent application of the expected transformations and checks to API requests. We have also addressed several issues that improve API reliability, observability, and user experience.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.12).
+
+#### Breaking Changes
+
+A change has been made to improve security of the *Auth Token + Dynamic mTLS* method for securing access to APIs deployed on Tyk. This removes the option to authenticate using only the auth token and enforces the mTLS handshake.
+
+Previously API clients could authenticate without presenting the client certificate or holding the client's private key.
+
+For any user relying on that behavior, we have added a new Gateway configuration option: `allow_unsafe_dynamic_mtls_token`. Unless deliberately configured in the config file or environment, this is set to `false` to ensure that Tyk is secure by default.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.12   | MDCB v2.9.0     | MDCB v2.9.0 |
+|         | Operator v1.3.0 | Operator v0.17 |
+|         | Sync v2.1.6    | Sync v2.1.1 |
+|         | Helm Chart v5.1.0 | Helm all versions |
+|         | Pump v1.14.0    | Pump all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+No deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.12, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.12)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.12
+    ``` 
+- Helm charts
+  - [tyk-charts v5.1.0](/developer-support/release-notes/helm-chart#5-1-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.12](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.12)
+
+#### Changelog
+<a id="Changelog-v5.8.12" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed Path Matching Inconsistencies Between Classic and OAS API Middleware'>
+Resolved path matching inconsistencies that could lead to Tyk OAS-specific middleware not being executed when expected.
+
+These inconsistencies could see the [Request Validation](/api-management/traffic-transformation/request-validation) and [Mock Response](/api-management/traffic-transformation/mock-response#mock-response) middleware being skipped in certain scenarios when using Tyk OAS APIs.
+
+These scenarios included:
+- some subpaths, for example the middleware configured for `/users` would not execute for `/users/123`
+- some child API versions
+- wildcard regexes in paths
+- root paths
+
+Now Tyk will apply the same decisions for these middleware as for the rest of the request processing chain.
+
+</Accordion>
+
+<Accordion title='Improved JWKS Error Messaging for Faster JWT Troubleshooting'>
+Enhanced Gateway error logging for JWT authentication failures related to JWKS endpoints. Previously, JWKS configuration issues generated vague error messages that didn't indicate the root cause, making troubleshooting difficult and time-consuming. 
+
+The Gateway now provides specific, actionable error messages that clearly identify whether failures stem from Base64 decoding issues, network connectivity problems, or invalid JWKS content.
+</Accordion>
+
+<Accordion title='Fixed Gateway Panic if HashiCorp Vault Path Not Found'>
+Resolved an issue where the Gateway could crash with a panic if the API definition contained an illegal reference to a secret in HashiCorp Vault. If the requested path did not exist in Vault, the Gateway process could exit, resulting in a complete service outage during API loads, hot reloads, or Dashboard saves. The Gateway now gracefully handles the missing Vault path and logs a clear error message.
+</Accordion>
+
+<Accordion title='Fixed Incomplete Validation of Multi-Value Request Headers'>
+Resolved an issue where Tyk only validated the first instance of multi-value headers when processing requests to Tyk OAS APIs, allowing invalid header values to bypass schema constraints. 
+
+The Gateway now properly normalizes and validates all header values according to HTTP standards, ensuring that all values in multi-value headers comply with the defined OpenAPI schema constraints.
+</Accordion>
+
+<Accordion title='Fixed API Routing Issues with Custom Domains and Similar Listen Paths'>
+Resolved a routing issue where APIs could return `HTTP 404 Not Found` errors depending on custom domain settings, with differing behavior between Tyk OAS and Tyk Classic APIs. Previously, when APIs had similar listen path prefixes (e.g., `/caa` and `/caas2itsamu0456w2ayl9`), the Gateway's routing logic would incorrectly match requests, causing legitimate API calls to fail. The issue affected Tyk OAS APIs when custom domains were disabled, and Tyk Classic APIs when they were enabled. 
+
+The Gateway now properly sorts and matches API specifications by listen path length, while correctly considering domain configuration options, ensuring all APIs are accessible via their configured paths regardless of custom domain settings or API type. 
+</Accordion>
+
+<Accordion title='Fixed Missing Request Duration Logging for Gateway Error Responses'>
+Resolved an issue where the Gateway incorrectly logged 0ms duration for error responses, including `HTTP 504 Gateway Timeout`, `HTTP 499 Client Closed Request`, and `HTTP 500 Internal Server Error`, creating gaps in API observability and monitoring. Previously, these error responses were hardcoded with zero-latency values, making it impossible to determine the actual processing time, gateway saturation, or connection utilization for failed requests. 
+
+The Gateway now accurately calculates and logs the actual request duration from start to error occurrence for all error responses, providing complete timing visibility across successful and failed API requests. This enhancement improves observability for performance monitoring, capacity planning, and troubleshooting workflows.
+</Accordion>
+
+<Accordion title='Fixed Missing Identity Source in OTEL Traces for JWT Protected APIs'>
+Resolved an issue where OpenTelemetry traces were missing the "alias" field when using JWT-protected APIs, making it impossible to identify API consumers in tracing data. Previously, while the alias was correctly populated in Redis sessions and pump metrics, it was not included in OTEL spans for JWT-authenticated requests.
+
+The Gateway now ensures that OTEL spans include the alias attribute for all authentication methods, enabling proper consumer identification and request attribution in distributed tracing systems.
+</Accordion>
+
+<Accordion title='Fixed Intermittent NewRelic Tracing'>
+Resolved an issue where NewRelic OpenTracing integration worked inconsistently in Tyk Gateway. The Gateway now properly mounts NewRelic middleware on all routers, including reused ones, with thread-safe duplicate prevention and improved memory management during router swaps. This fix ensures consistent NewRelic APM visibility across all API calls and gateway versions, supporting both legacy NewRelic configurations and newer OpenTelemetry collector setups.
+</Accordion>
+
+<Accordion title='Fixed Incorrect X-RateLimit-Reset Timestamp'>
+Resolved an issue where the `X-RateLimit-Reset` header showed an incorrect timestamp in the response to the first API request after rate limit or quota counter initialization. Previously, when quota windows expired and were reset within the distributed lock, the Gateway would return stale timing information in the first response.
+
+The Gateway now properly synchronizes its internal timer with the storage backend during quota window resets, ensuring that `X-RateLimit-Reset` headers accurately reflect the correct expiration time from the very first response.
+</Accordion>
+
+<Accordion title='Fixed OpenAPI multipleOf Validation for Floating-Point Numbers'>
+Resolved a floating-point precision issue where mathematically valid multipleOf values were incorrectly rejected due to binary representation limitations. This could cause incorrect failures when performing Request Validation for Tyk OAS APIs.
+
+The Gateway now properly handles floating-point precision in multipleOf validation, ensuring that all mathematically valid decimal multiples pass validation consistently while continuing to correctly reject invalid values.
+</Accordion>
+
+<Accordion title='Fixed SSL Certificate Loading from MDCB During Gateway Startup'>
+Resolved an issue where data plane gateways failed to load SSL certificates from MDCB during startup, preventing HTTPS listeners from functioning correctly. The fix implements exponential backoff retry logic that waits for the MDCB connection to become available during certificate loading, ensuring SSL certificates are properly retrieved, and HTTPS listeners start correctly. This resolves startup failures for new data plane deployments using HTTPS.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+<AccordionGroup>
+
+<Accordion title='Fixed Security Vulnerability in Dynamic mTLS Authentication'>
+The Gateway now enforces the mutual TLS handshake when an API is secured using Auth Token with Dynamic mTLS. The client must therefore present a valid client certificate in the request. Previously Dynamic mTLS would permit authentication using only the Auth Token and the mTLS handshake was not enforced.
+
+A new configuration option `allow_unsafe_dynamic_mtls_token` has been added for any users relying on the legacy behavior. This defaults to `false`.
+
+A new Gateway configuration option `allow_unsafe_dynamic_mtls_token` has been added for backward compatibility, but defaults to `false` to ensure secure behavior. When enabled, this option restores the previous (insecure) behavior of accepting token-only authentication for APIs secured with Auth Token + Dynamic mTLS.
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.11 Release Notes
+
+#### Release Date 12 February 2026
+
+#### Release Highlights
+
+In this release, we have resolved a performance issue with bundle verification that significantly impacted resource consumption when using plugin bundles, and we have fixed some priority CVEs.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.11).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.11   | MDCB v2.8.7     | MDCB v2.8.7 |
+|         | Operator v1.2.0 | Operator v0.17 |
+|         | Sync v2.1.5    | Sync v2.1.1 |
+|         | Helm Chart v5.0.0 | Helm all versions |
+|         | Pump v1.13.2    | Pump all versions |
+|         | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+No deprications in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.11, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.11)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.11
+    ``` 
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.11](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.11)
+
+#### Changelog
+<a id="Changelog-v5.8.11" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Optimized Bundle Verification to Reduce Memory Consumption'>
+Fixed a performance issue introduced in v5.8.7 where bundle verification significantly increased CPU and memory consumption, particularly when using multiple APIs with plugin bundles.
+
+We have introduced a new Gateway configuration option `skip_verify_existing_plugin_bundle` that allows you to skip cryptographic verification when loading signed plugin bundles from disk. When set to `true`, this option reduces the performance overhead for environments with large numbers of APIs using signed bundles, while still maintaining security by validating signatures during the initial bundle download.
+
+**Note**: This option only affects signed bundles loaded from disk. Unsigned bundles and initial downloads will continue to follow standard verification procedures.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15467" target="_blank">CVE-2025-15467</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-69419" target="_blank">CVE-2025-69419</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61726" target="_blank">CVE-2025-61726</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61728" target="_blank">CVE-2025-61728</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68121" target="_blank">CVE-2025-68121</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.10 Release Notes
+
+#### Release Date 23 December 2025
+
+#### Release Highlights
+
+This patch release addresses a CVE present in 5.8.9 and fixes an issue where API keys remained active when set to inactive status. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.10).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.10   | MDCB v2.8.7     | MDCB v2.8.7 |
+|         | Operator v1.2.0 | Operator v0.17 |
+|         | Sync v2.1.5    | Sync v2.1.1 |
+|         | Helm Chart v5.0.0 | Helm all versions |
+|         | EDP v1.16.0     | EDP all versions |
+|         | Pump v1.13.2    | Pump all versions |
+|         | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+In this release we've deprecated the [policies.allow_explicit_policy_id](/tyk-oss-gateway/configuration#policies-allow_explicit_policy_id) configuration option. This was previously added to allow the use of custom policy IDs, which is now the default behaviour so this option is redundant.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.10, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.10)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.10
+    ``` 
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.10](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.10)
+
+#### Changelog
+<a id="Changelog-v5.8.10" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed: API Keys Remain Active When Set to Inactive Status'>
+Resolved an issue where API keys continued to process traffic even after being marked as inactive through API updates.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following high-priority CVE, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41248" target="_blank">CVE-2021-41248</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.9 Release Notes
+
+#### Release Date 12 December 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes and introduces enhanced DNS monitoring for MDCB deployments. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.9).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.9   | MDCB v2.8.7     | MDCB v2.8.7 |
+|         | Operator v1.2.0 | Operator v0.17 |
+|         | Sync v2.1.4     | Sync v2.1.1 |
+|         | Helm Chart v5.0.0 | Helm all versions |
+|         | EDP v1.15.0     | EDP all versions |
+|         | Pump v1.13.1    | Pump all versions |
+|         | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+In this release we've deprecated the [policies.allow_explicit_policy_id](/tyk-oss-gateway/configuration#policies-allow_explicit_policy_id) configuration option. This was previously added to allow the use of custom policy IDs, which is now the default behaviour so this option is redundant.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.9, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.9)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.9
+    ``` 
+- Helm charts
+  - [tyk-charts v5.0.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.9](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.9)
+
+#### Changelog
+<a id="Changelog-v5.8.9" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Background DNS Monitor for Faster MDCB Endpoint Failover'>
+We have implemented background monitoring of MDCB endpoint DNS resolution to ensure rapid response to changes without waiting for failures, which block API consumer requests. When a DNS change is detected, Tyk will now automatically reconnect the RPC client to minimise downtime and risk of request blocking. The DNS monitor checks for changes at a configurable interval (default: 30 seconds, minimum: 10 seconds). This can be set using the `slave_options.dns_monitor` configuration.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed JWT Authentication Panic in MDCB Emergency Mode'>
+Fixed a bug causing JWT authentication to panic in MDCB emergency mode. When processing tokens with new sub-claims, the gateway returned an uninitialized session missing its KeyID, leading to a crash when generating the session’s KeyHash. The fix ensures the KeyID is preserved in the emergency-mode path, allowing sessions to be created and cached correctly and preventing panics during MDCB outages.
+</Accordion>
+
+<Accordion title='Resolved Panic Triggered by DRL Updates in Mixed Rate-Limiter Environments'>
+Fixed an issue where Gateways using [Redis Rate Limiters](/api-management/rate-limit#redis-rate-limiter) would crash when sharing Redis with Gateways using [Distributed Rate Limiting](/api-management/rate-limit#distributed-rate-limiter) (DRL). Non-DRL Gateways now properly ignore DRL update messages instead of attempting to process them, enabling mixed rate-limiter deployments across shared Redis instances.
+</Accordion>
+
+<Accordion title='Removed Redundant Boolean Enums from OpenAPI Specification'>
+Fixed redundant boolean enum definitions in OpenAPI specification by removing unnecessary enum: [true, false] declarations from boolean type fields in swagger.yml files. Boolean parameters now use only type: boolean, following OpenAPI best practices.
+</Accordion>
+
+<Accordion title='Fixed Data Plane Startup Process To Handle MDCB Failure'>
+Fixed an issue where a Data Plane Gateway could return HTTP 404 errors to client requests if the MDCB link failed during initialisation. The expected behaviour, if MDCB is unavailable, is for the Data Plane Gateway to retrieve policies and API definitions from the local storage (Redis), but this was not occurring in certain scenarios. 
+
+We have improved the robustness of the Gateway startup so that, if MDCB goes down, it will automatically switch to the local storage (Redis) as expected.
+</Accordion>
+
+<Accordion title='Fixed OAuth Client Key Retrieval Delays in JWT APIs on Hybrid Gateways'> 
+Resolved an issue where JWT APIs using Keycloak authentication experienced significant delays on hybrid gateways due to failed local key lookups. The Gateway was unable to find OAuth client keys in local Redis and had to fetch them from the Control Plane for every request, causing performance degradation and "key not found" errors in logs. 
+
+JWT API requests now retrieve keys efficiently from local storage, eliminating unnecessary round-trip requests and providing consistent response times. 
+</Accordion>
+
+<Accordion title='Corrected mTLS Certificate Advertising for RFC-Compliant Clients'>
+Fixed an issue where Tyk Gateway advertised leaf certificate Subject DNs instead of Certificate Authority DNs during mTLS handshakes, causing connection failures with RFC-compliant TLS clients. The Gateway now properly extracts and advertises CA DNs from certificate chains in the CertificateRequest message, ensuring compatibility with standards-compliant clients like `Apache mod_ssl` while maintaining backward compatibility with existing configurations.
+</Accordion>
+
+<Accordion title='Fixed JSON Formatter Failures with Large Numeric Error Values'>
+We fixed a logging bug in the JSON formatter that could cause error logs to fail to serialize when an error message contained very large numeric values (for example a big integer), which sometimes resulted in missing or broken log output; the formatter now writes the error as a plain text string instead of attempting to encode the underlying error object, so logs reliably serialize to JSON
+</Accordion>
+
+<Accordion title='Fixed Request Pipeline Blockage When MDCB is Unavailable'>
+Fixed an issue where the request pipeline could be blocked by synchronous RPC calls when MDCB was unavailable. The Gateway check for Organisation expiry every 10 minutes is now asynchronous and non-blocking, so it no longer causes API request timeouts and latency spikes (up to 90 seconds) when MDCB is unavailable. Previously this validity check would block the Gateway. This fix ensures consistent API response times regardless of MDCB availability.
+</Accordion>
+
+<Accordion title='Reduced RPC Retry Delays by Improving DNS Change Detection'>
+Fixed an issue where the Gateway would incorrectly retry RPC calls repeatedly when MDCB is unavailable, but the DNS hasn't changed. This would cause API requests to block for over 90 seconds before returning an error. Now it takes into account the fact that DNS has not changed and so fails fast, entering Emergency Mode after one retry (30 seconds).
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.8 Release Notes
+
+#### Release Date 20th November 2025
+
+#### Release Highlights
+
+This patch release fixes some high-priority CVEs. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.8).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.8   | MDCB v2.8.6     | MDCB v2.8.6 |
+|         | Operator v1.2.0 | Operator v0.17 |
+|         | Sync v2.1.4     | Sync v2.1.1 |
+|         | Helm Chart v4.1.0 | Helm all versions |
+|         | EDP v1.15.0     | EDP all versions |
+|         | Pump v1.13.1    | Pump all versions |
+|         | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.8, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.8)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.8
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.8](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.8)
+
+#### Changelog
+<a id="Changelog-v5.8.8" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following high-priority CVEs, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-47912" target="_blank">CVE-2025-47912</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58183" target="_blank">CVE-2025-58183</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58185" target="_blank">CVE-2025-58185</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58186" target="_blank">CVE-2025-58186</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58187" target="_blank">CVE-2025-58187</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58188" target="_blank">CVE-2025-58188</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58189" target="_blank">CVE-2025-58189</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61723" target="_blank">CVE-2025-61723</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61724" target="_blank">CVE-2025-61724</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61725" target="_blank">CVE-2025-61725</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.8.7 Release Notes
+
+#### Release Date 29 October 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.7).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.7   | MDCB v2.8.5     | MDCB v2.8.5 |
+|         | Operator v1.2.0 | Operator v0.17 |
+|         | Sync v2.1.4     | Sync v2.1.1 |
+|         | Helm Chart v4.0 | Helm all versions |
+|         | EDP v1.14.1     | EDP all versions |
+|         | Pump v1.13.0    | Pump all versions |
+|         | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.7, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.7)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.7
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.7](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.7)
+
+#### Changelog
+<a id="Changelog-v5.8.7" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed Custom Authentication fallback when custom plugin bundle is disabled'>
+Fixed an issue where [Custom Authentication](/api-management/authentication/custom-auth) could fall back to a previously configured alternative authentication method if the custom plugin bundle was not loaded. Now this is treated as for any other failed plugin load, and requests to the API will be rejected with `HTTP 500 Internal Server Error` to prevent access to an improperly configured endpoint.
+</Accordion>
+
+<Accordion title='Fixed Gateway panic when handling unexpected query parameters'>
+Fixed an issue where sending certain unexpected query parameters to the Gateway's `GET /tyk/apis/oas/{apiID}` endpoint could cause a panic instead of returning a proper `HTTP 400 Bad Request` response. The Gateway now handles unexpected query parameters gracefully without crashing, improving system stability and providing appropriate error responses to clients.
+</Accordion>
+
+<Accordion title='Fixed issue with invalid or missing bundle manifests'>
+Fixed an issue where the Gateway would load and attempt to use plugin bundles even when the manifest file was invalid or missing. The Gateway now properly validates bundle manifests and fails safely by rejecting API requests when bundles cannot be properly loaded or verified.
+
+This prevents risks from corrupted or tampered bundles and ensures that APIs with invalid plugin configurations are not accessible, maintaining the integrity of authentication and authorization checks implemented by plugins.
+</Accordion>
+
+<Accordion title='Fixed JWT key activation when toggling default policy from draft to active'>
+Fixed an issue where keys could remain deactivated when a policy applied to them was changed from `draft` to `active` status. When an access key/token is presented to Tyk in a request, policies linked to the key will be applied, configuring the authorization for that request. If any policy is in `draft` state, the key will be rejected.
+
+Toggling the policy to the `active` state should activate any keys to which the policy is applied. Previously, if the policy had never been applied when it was in `draft` state, there was an issue where keys would incorrectly be marked as `inactive`. This has now been resolved, and the policy state is correctly mapped to keys.
+</Accordion>
+
+<Accordion title='Added new configuration option for limiting response body size'>
+Added a new configuration option, [HttpServerOptions.MaxResponseBodySize](/tyk-oss-gateway/configuration#http_server_options-max_response_body_size) to limit the maximum size of the response bodies processed during any response body transformations.  When the limit is exceeded, the Gateway returns `HTTP 500 Response Body Too Large` instead of attempting to process the oversized content.
+</Accordion>
+
+<Accordion title='Fixed plugin loading failure errors being ignored for gRPC, Python, and Lua plugins'>
+Fixed an issue where plugin loading failure errors were ignored for gRPC, Python, and Lua plugins, allowing API requests to be processed even when plugins failed to load. The Gateway now properly validates plugin drivers during request processing and fails safely by returning `HTTP 500 Internal Server Error` when any plugin fails to load, ensuring consistent behavior across all plugin types.
+</Accordion>
+
+<Accordion title='Improved path handling during bundle decompression.'>
+Tyk Gateway now validates all file paths in zip bundles before extraction, rejecting bundles that contain invalid paths. Bundle extraction fails immediately upon detecting invalid paths, with detailed error logging, ensuring that only proper bundles with valid relative paths are processed.
+</Accordion>
+
+<Accordion title='Fixed random version selection when `not_versioned` is set to true'>
+Fixed an issue where a **Tyk Classic API** with inconsistent versioning configuration would process requests using a **random version’s configuration**.
+
+A non-versioned API should:
+
+- Contain a single entry in `version_data.versions` with the API configuration.
+- Have the `version_data.not_versioned` flag set to `true`.
+
+Previously, if multiple entries existed in the `version_data.versions` array while `not_versioned` was set to `true`, the Gateway would **randomly select one** of those versions to process incoming requests.
+
+**New behavior:**
+
+When `version_data.not_versioned` is set to `true` and multiple versions are present, Tyk now deterministically selects the configuration for the **default version** instead of picking one at random.
+
+Tyk determines the default version as follows:
+
+- First, it looks for an entry named `"Default"`.
+- If not found, it checks for `"default"`.
+- If neither exists, it checks for an entry with an **empty string key** (`""`).
+- If none of these are found, Tyk returns an **error**, indicating a misconfigured non-versioned API.
+</Accordion>
+
+<Accordion title='Fixed inappropriate warning logs for mock response requests'>
+Fixed an issue where the mock response middleware generated incorrect warning-level messages stating `session not found`, sending inappropriate rate-limit headers in the Gateway system logs.
+
+This warning was introduced incorrectly and caused confusion, as mock responses don't require session objects by design. The Gateway now returns to the previous behavior where mock response requests execute without generating spurious warning messages, reducing log noise.
+</Accordion>
+
+<Accordion title='Fixed Data Plane Gateway hanging when MDCB connection is lost'>
+Fixed an issue where a Data Plane Gateway could hang for all client requests when the MDCB connection was lost. This was caused by the Gateway incorrectly checking the Organisation quota when `TYK_GW_ENFORCEORGQUOTAS` was not set. If the Organisation quota cache expired before the Gateway performed a health check, the Gateway could hang.
+
+From this release, the Gateway does not check the Organisation quota cache if this is not set. For users relying on Organisation quotas (setting `TYK_GW_ENFORCEORGQUOTAS=true`), the scenario is different and the lock does not occur.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+### 5.8.6 Release Notes
+
+#### Release Date 25th September 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.6).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.6   | MDCB v2.8.4     | MDCB v2.8.4 |
+|         | Operator v1.2.0 | Operator v0.17 |
+|         | Sync v2.1.3     | Sync v2.1.1 |
+|         | Helm Chart v4.0 | Helm all versions |
+|         | EDP v1.14.1     | EDP all versions |
+|         | Pump v1.12.2    | Pump all versions |
+|         | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.24  |  1.24  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.6, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.6)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.6
+    ``` 
+- Helm charts
+  - [tyk-charts v4.0.0](/developer-support/release-notes/helm-chart#4-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.6](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.6)
+
+#### Changelog
+<a id="Changelog-v5.8.6" data-scroll-offset></a>
+
+##### Changed
+
+
+
+<Expandable title='Go 1.24 Upgrade for Tyk Gateway'>
+The Tyk Gateway has been updated to [Golang 1.24](https://tip.golang.org/doc/go1.24), enhancing security by staying up-to-date with the latest Go versions.
+</Expandable>
+
+
+
+
+##### Fixed
+
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed body decompression errors with GraphQL APIs when analytics is enabled'>
+Fixed an issue that caused repeated `Body decompression error: EOF` log messages when analytics were enabled for GraphQL APIs. The problem occurred because the Gateway attempted to decompress the response body after it had already been consumed for analytics processing, resulting in EOF (End of File) errors. The Gateway now correctly handles response body consumption for GraphQL APIs with analytics, eliminating the spurious error logs.
+</Accordion>
+
+<Accordion title='Fixed Gateway re-registration failures after restart'>
+Fixed an issue where Gateways could fail to re-register with the Dashboard after a restart, particularly during upgrades or in large-scale deployments. This resulted in `Authorization failed (Nonce empty)` errors and Gateway crash loops that prevented successful registration. The fix includes an updated license handler with hardened registration logic, enhanced Dashboard authentication retry mechanisms, and support for new "Unlimited Gateway" licenses, ensuring Gateways register reliably without entering failure loops even during heavy churn or rolling upgrades.
+</Accordion>
+
+<Accordion title='Fixed Gateway crash when deleting APIs with Uptime Test enabled'>
+Fixed a bug where deleting an API with the Uptime Test feature enabled could cause the Gateway to crash due to a nil pointer dereference during cleanup operations. The Gateway now properly handles memory cleanup when removing APIs with active uptime tests, preventing crashes and ensuring stable API lifecycle management.
+</Accordion>
+
+<Accordion title='Fixed TLS configuration not being applied for Redis rate limiting'>
+Fixed an issue where Tyk Gateway did not properly apply the configured TLS settings when connecting to Redis for rate limiting operations. This could result in connection failures and incorrect `HTTP 429 Too Many Requests` responses being returned to clients. The rate limiter now correctly establishes TLS connections to Redis.
+</Accordion>
+
+<Accordion title='Fixed Request Body Transform middleware not being applied with regex in URL rewrite'>
+Fixed an issue where Response Body Transformation middleware failed to apply to endpoints that used URL rewrite with regex patterns. When the endpoint path contained regex metacharacters (e.g., $, ^, (), []), these characters interfered with the body transformation's internal pattern-matching process, preventing the middleware from executing.
+</Accordion>
+
+<Accordion title='Base API CORS settings incorrectly applied to child API versions'>
+Fixed an issue where CORS settings from the base API were incorrectly applied to all versions of a Tyk OAS API, preventing child API versions from using their own CORS configuration. This occurred because the CORS check was performed before the request was routed to the correct API version. The processing order has been corrected so that requests are first routed to the appropriate version (base or child), then the correct CORS settings are applied, allowing each API version to have its own CORS configuration.
+</Accordion>
+
+<Accordion title='Fixed mock responses not working with internal API proxying'>
+Fixed an issue where Tyk OAS mock response middleware failed to execute when internal API proxying was enabled. Mock responses configured in the target API are now correctly returned when a request is redirected to another API on the same Tyk Gateway instance via [internal looping](/advanced-configuration/transform-traffic/looping).
+</Accordion>
+
+<Accordion title='Fixed duplication of version identifier configuration when importing OpenAPI description'>
+Fixed an issue where importing an OpenAPI description with an `apiKey` security scheme, while using the `authentication` query parameter, resulted in the unnecessary generation of a `header` object within the Tyk Vendor Extension (`x-tyk-api-gateway`), duplicating information already present in the declared OpenAPI security scheme.
+</Accordion>
+
+<Accordion title='Fixed duration format validation errors in Tyk OAS API definitions'>
+Resolved an issue where the Gateway automatically converted Readable Duration values (such as uptime test timeouts) in Tyk OAS API definitions from integer-based formats to decimal formats, which triggered schema validation warnings. The effect of this was seen in the Tyk OAS API editor in the Dashboard UI where, for example, a duration of '4s500ms' would be converted to '4.5s' when reopening an API definition. Duration values are now consistently serialized and maintained in their original integer-based format to prevent these validation errors.
+</Accordion>
+
+<Accordion title='Stricter validation for version name parameter when creating a new child API version'>
+Fixed an issue where users could create child Tyk OAS API versions using the `/tyk/apis/oas` endpoint without specifying a valid version name (`new_version_name`). The Gateway API now rejects such requests with an `HTTP 422 Unprocessable Entity` error, ensuring all versions have meaningful identifiers and preventing the creation of unusable or empty version entries.
+</Accordion>
+
+<Accordion title='Fixed inconsistent middleware updates for Tyk OAS API `PATCH` requests'>
+Fixed an issue where updating a Tyk OAS API via `PATCH /tyk/apis/oas/{apiId}` did not properly update the Tyk Vendor Extension (`x-tyk-api-gateway`). When endpoints were removed or modified in the OpenAPI description, their corresponding middleware definitions could persist incorrectly in the vendor extension, leaving the API definition in an inconsistent state. The vendor extension is now correctly rebuilt to reflect all changes made to the OpenAPI description.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+### 5.8.5 Release Notes
+
+#### Release Date 18th August 2025
+
+#### Release Highlights
+
+Gateway 5.8.5 was version bumped only to align with Dashboard 5.8.5. Subsequently, no changes were encountered in release 5.8.5. For further information, please see the release notes for Dashboard [v5.8.5](/developer-support/release-notes/dashboard#5-8-5-release-notes).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.5 | MDCB v2.8.4     | MDCB v2.8.4 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.1    | Sync v2.1.1 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.14 | EDP all versions |
+| | Pump v1.12.1 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.23  |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-5.8.5"></a>
+
+If you are upgrading to 5.8.5, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.5)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.5
+    ``` 
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.5](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.5)
+
+#### Changelog
+<a id="Changelog-v5.8.5" data-scroll-offset></a>
+
+Since this release was version-bumped only to align with Dashboard v5.8.5, no changes were encountered in this release.
+
+
+### 5.8.4 Release Notes
+
+#### Release Date 13th August 2025
+
+#### Release Highlights
+
+This release restores the stable /hello health-check behavior for Kubernetes probes. Deployments using /hello for liveness or readiness will now behave consistently again.
+
+It also fixes a schema compatibility issue in the URL Rewrite middleware, ensuring that API promotion and validation flows no longer fail due to schema mismatches.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.4).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.4 | MDCB v2.8.3     | MDCB v2.8.3 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.1    | Sync v2.1.1 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.14 | EDP all versions |
+| | Pump v1.12.0 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.23  |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.4, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.4)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.4
+    ``` 
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.4](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.4)
+
+#### Changelog
+<a id="Changelog-v5.8.4" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Gateway /hello endpoint behaviour restored when Redis is unavailable'>
+Reverted the change introduced in versions 5.9.0 and 5.8.3 to the `/hello` health check endpoint, restoring its original functionality. This fix resolves an issue where the endpoint returned a 503 error when Redis was down. The `/hello` endpoint now correctly returns HTTP 200 during normal operations, ensuring compatibility with Kubernetes liveness and readiness probes.
+</Expandable>
+
+
+
+<Expandable title='URL Rewrite Middleware Schema Compatibility Fix'>
+Fixed a breaking change in the URL Rewrite middleware schema where the 'negate' field incorrectly became mandatory in versions 5.8.3 and 5.9.0. This change caused validation errors when promoting APIs created in earlier versions (e.g., 5.8.1) to newer environments. The 'negate' field is now optional again, restoring backward compatibility and defaulting to 'false' when omitted.
+</Expandable>
+
+
+
+
+
+### 5.8.3 Release Notes
+
+#### Release Date 15th July 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.3) below.
+
+#### Breaking Changes
+
+**1. Modified `/hello` endpoint behavior affects kubernetes deployments**
+
+In Tyk Gateway version 5.8.3, we introduced a breaking change to the `/hello` health check endpoint behavior. Previously, this endpoint would always return HTTP 200 during normal operations, regardless of Redis connectivity. The change made the endpoint return HTTP 503 when Redis was unavailable (which shouldn't be the case), which caused issues for Kubernetes deployments using this endpoint for liveness probes.
+
+##### Impact
+
+-   Kubernetes pods may be unnecessarily terminated when Redis becomes temporarily unavailable
+-   Deployments using `/hello` for both liveness and readiness probes experience disruption
+-   This contradicts the documented behavior that the Gateway continues functioning when Redis is unavailable
+
+
+##### Expected Fix Version
+
+This issue will be fixed in Tyk Gateway version 5.8.4, where we will:
+
+-   Revert the `/hello` endpoint to its pre-5.8.3 behavior (always return HTTP 200 during normal operations)
+-   Ensure backward compatibility for existing Kubernetes deployments
+
+**2. URL rewrite rules now require explicit `negate` field**
+
+A breaking change has been identified in Tyk 5.8.3 regarding [URL rewrite rules](/transform-traffic/url-rewriting). The `negate` field, which was optional in previous versions, is now mandatory in all URL rewrite rule configurations.
+
+##### What Changed
+
+In Tyk 5.8.2 and earlier, the `negate` field in [URL rewrite rules](/transform-traffic/url-rewriting) included an omitempty tag, making it optional in JSON. If not provided, it would default to false
+
+In Tyk 5.8.3, this omitempty tag has been removed, making the negate field mandatory in all URL rewrite rule configurations.
+
+##### Impact
+
+API definitions that worked in Tyk 5.8.2 will fail validation in Tyk 5.8.3 if they contain URL rewrite rules without an explicit negate field. This may cause API updates, or promotion between environments failures between environments with error messages similar to:
+
+```
+Error: API Updating Returned error: {
+  "Status": "Error",
+  "Message": "x-tyk-api-gateway.middleware.operations.(.*)OPTIONS.urlRewrite.triggers.0.rules.0: negate is required"
+}
+```
+
+##### Workarounds
+
+When using Tyk 5.8.3, you must explicitly include the negate field in all URL rewrite rules:
+
+```
+{
+  "rules": [
+    {
+      "in": "header",
+      "name": "x-example",
+      "pattern": "test",
+      "negate": false  // This field is now required
+    }
+  ]
+}
+```
+
+Set negate: false for standard matching behavior, or negate: true
+
+##### Expected fix version
+
+This issue will be fixed in Tyk 5.8.4, where we're going to make negate field optional again.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.3 | MDCB v2.8.2     | MDCB v2.8.2 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.1    | Sync v2.1.1 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.14 | EDP all versions |
+| | Pump v1.12.0 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.23  |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.3, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.3)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.3
+    ``` 
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.3](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.3)
+
+#### Changelog
+<a id="Changelog-v5.8.3" data-scroll-offset></a>
+
+##### Added
+
+
+
+<Expandable title='Tyk Gateway Now Supports Configurable Graceful Shutdown Period'>
+The Gateway now supports a configurable [graceful shutdown](/planning-for-production/ensure-high-availability/graceful-shutdown) period, waiting up to `graceful_shutdown_timeout_duration` seconds (default value is 30s) for open connections to close before terminating. Additionally, improvements have been made to the liveness (`hello`) and readiness (`/ready`) endpoints.
+</Expandable>
+
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Load Balance Between gRPC Plugin Servers'>
+Fixed support for `dns:///` protocol for load balancing when using [gRPC plugins](/api-management/plugins/rich-plugins#load-balancing-between-grpc-servers). Setting the new configuration option `TYK_GW_COPROCESSOPTIONS_GRPCROUNDROBINLOADBALANCING` to `true` will cause Tyk to balance the load between multiple gRPC servers; the default behavior (`false`) is to use a sticky connection to a single server.
+</Accordion>
+
+<Accordion title='Restored TLS 1.2 Cipher Suite Support'>
+Fixed an issue introduced in Tyk 5.8.1 where several previously supported cipher suites were no longer recognized when configured, causing them to be silently skipped for clients relying on those ciphers. The issue was only visible with debug-level logging, making it difficult to diagnose in production environments. Support for these cipher suites has now been restored.
+</Accordion>
+
+<Accordion title='Calling Invalid Stream API Endpoint Now Returns HTTP 404'>
+Gateway no longer returns `HTTP 500` when calling an invalid path on a streams API and will instead return `HTTP 404` as expected.
+</Accordion>
+
+<Accordion title='Reliable GraphQL Proxying for Interface Arguments'>
+Fixed an issue where Tyk has trouble proxying a GraphQL edge case; a request that includes an argument on an interface leads to errors proxying.
+</Accordion>
+
+<Accordion title='Resolved Repeated “Unsupported Protocol Scheme” Errors'>
+Gateway no longer produces endless "unsupported protocol scheme" errors for Tyk Streams APIs
+</Accordion>
+
+<Accordion title='Stability Fixes for GraphQL Subscriptions and Kafka Messaging'>
+Fixed a panic triggered by starting GraphQL subscriptions and resolved an issue where Kafka messages failed to resolve correctly.
+</Accordion>
+
+<Accordion title='Removed Unnecessary Garbage Collection When Deleting Tyk Streams API'>
+Gateway no longer tries to start a garbage collection task after deleting a Tyk Streams API
+</Accordion>
+
+<Accordion title='Detailed Traffic Logs Missing Payload'>
+Fixed an issue where the payload (request body) was not included in detailed traffic logs for the following scenarios:
+- `Content-Type "application/x-www-form-urlencoded"`
+- `Transfer-Encoding: chunked`
+</Accordion>
+
+<Accordion title='Reliable SSE and WebSocket Streaming for Browser Clients'>
+Browser clients can now reliably consume streams outputs (SSE and WebSocket)
+</Accordion>
+
+<Accordion title="Tyk OAS API Definition Wasn't Accessible From Response Plugins">
+Fixed an issue when using Tyk OAS where the API definition was not accessible from Response Plugins unless a Request Plugin was also loaded. The issue was caused by the `ctx.GetOASDefinition(req)` function not consistently returning the proper OpenAPI Specification (OAS).
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.8.2 Release Notes
+
+#### Release Date 1st July 2025
+
+#### Release Highlights
+
+This patch release contains fixes to some bugs experienced when using MDCB and distributed data planes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.2) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.2 | MDCB v2.8.1     | MDCB v2.8.1 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.23  |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.2, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.2)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.2
+    ``` 
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.2](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.2)
+
+#### Changelog
+<a id="Changelog-v5.8.2" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Gateways in Distributed Data Planes Were Unable To Perform mTLS When MDCB Link Unavailable'>
+Resolved an issue introduced in Tyk 5.7.1 where Gateways in distributed Data Planes failed to cache TLS certificates correctly in the local Redis, resulting in potential service disruptions if MDCB became unavailable. Data plane gateways now reliably serve HTTPS and mTLS traffic even if MDCB is unavailable.
+</Accordion>
+
+<Accordion title='More Resilient RPC Connections During DNS Changes'>
+The Data Plane could lose connectivity to MDCB when DNS records changed (for example due to ELB updates). The RPC address became stale and the Gateways could not reconnect.
+We have improved the RPC connection handling in the gateway to properly detect and respond to DNS changes, ensuring seamless reconnection when remote IPs become unavailable.
+</Accordion>
+
+<Accordion title='Resolved MDCB Policy Sync Issue Caused by RPC Timeouts'>
+Fixed a bug where a timeout in an RPC call to MDCB could lead to policies not being synchronised to the data plane.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.8.1 Release Notes
+
+#### Release Date 9 May 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.1) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.1 | MDCB v2.8.1     | MDCB v2.8.1 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.23  |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.1
+    ``` 
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.1)
+
+#### Changelog
+<a id="Changelog-v5.8.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed Inconsistent Context Behavior in UDG APIs'>
+Addressed an issue for UDG APIs where caching led to the forwarding of stale values for headers that contained content variables towards the upstream of the UDG apis.
+</Accordion>
+
+<Accordion title='Improved Route Matching Logic for API Requests'>
+Resolved an issue where requests could be routed incorrectly due to inverted prioritisation of dynamically declared paths over those with similar static paths. Now, statically declared paths take priority in the path matching algorithm, so if API1 has listen path `/path/{param}/endpoint` and API2 has listen path `/path/specific/endpoint` a request to `/path/specific/endpoint/resource` will be correctly routed to API2.
+</Accordion>
+
+<Accordion title='Resolved Issue With Default Enforced Request Timeout'>
+Fixed an issue where an [enforced timeout](/planning-for-production/ensure-high-availability/enforced-timeouts) set for a specific API endpoint could be overruled by the configured [proxy_default_timeout](/tyk-oss-gateway/configuration#proxy_default_timeout). Now if an endpoint-level timeout is set then this will be honoured, regardless of any default timeout that is configured.
+</Accordion>
+
+<Accordion title='Fixed Issue With Tyk Self-Managed Gateways Claiming Licenses'>
+Resolved a race condition in self-managed deployments which occasionally lead to fewer Gateways registering with the Dashboard than the number that had been licensed. Now Tyk Self-Managed deployments will allow the licensed number of Gateways to register and serve traffic.
+</Accordion>
+
+<Accordion title='Resolved merging issue in field-based policy permissions'>
+Resolved a bug where `allowed_types` from multiple policies were incorrectly merged using intersection logic. Policies now correctly merge fields to allow access to any fields listed across the applied policies.
+</Accordion>
+</AccordionGroup>
+
+
+
+### 5.8.0 Release Notes
+
+#### Release Date 28 March 2025
+
+#### Release Highlights
+
+With Tyk 5.8.0 we are delighted to unlock the power and flexibility of Tyk OAS for all users, with full feature parity with the legacy Tyk Classic API definition. We are also bringing other updates and improvements, delivering more control, flexibility, and performance. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.8.0) below.
+
+##### Full support for Gateway configuration using Tyk OAS
+
+We have completed the journey with Tyk OAS that started in Tyk 4.1 - and now anything that you can configure using the Tyk Classic API definition is also available in the Tyk OAS API definition. Tyk OAS is now the recommended API style for all REST services, with Tyk Classic recommended for use only for GraphQL and TCP services.
+
+With Tyk OAS we combine the industry standard OpenAPI description with the Tyk Vendor Extension, which encapsulates all of the Tyk Gateway settings that cannot be inferred from the OpenAPI Specification (OAS). You can keep your service description (OAS) as source of truth and update the OpenAPI description part of a Tyk OAS API independently from the Tyk Vendor Extension - no need to unpick distributed vendor extensions from your OAS. For more details, please see the [documentation](/api-management/gateway-config-introduction).
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.8.0 | MDCB v2.8.0     | MDCB v2.8.0 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.23  |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.8.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.8.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.8.0
+    ``` 
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.8.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.8.0)
+
+#### Changelog
+<a id="Changelog-v5.8.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Tyk OAS Feature Parity'>
+In Tyk 5.8.0, we have added configuration of the following features into the Tyk OAS API definition, so that anything you can configure for a REST API via Tyk Classic you can also configure using Tyk OAS:
+
+- IP access control
+- API-Level request size limit
+- API-level ignore endpoint case
+- Skip rate limit middleware
+- Skip quota middleware
+- Skip quota reset on key creation
+- Custom analytics tags
+- Custom analytics retention period
+- Custom analytics plugins
+- Preserve client Host header
+- Gateway HTTP settings
+- Upstream uptime testing
+- Upstream load balancing
+- Upstream SSL configuration
+- Upstream authentication: HMAC request signing
+- Event handling: custom JS handler
+- Event handling: custom log Handler
+- Batch requests
+</Accordion>
+
+<Accordion title='Transaction Logs for Better API Request Visibility'>
+Tyk Gateway now supports transaction logs, providing structured access logs for API requests. This improves debugging and observability without the overhead of enabling debug mode in production. Logs can be output in JSON format and customized via a template, ensuring flexibility while maintaining performance. Find more details in our [Transaction Logs documentation](/api-management/logs/access-logs).
+</Accordion>
+
+<Accordion title='Added GODEBUG Flags for Backward Compatibility with Deprecated Ciphers'>
+We have added GODEBUG flags to enable deprecated insecure ciphers by default for backward compatibility. Existing users will not be affected. New users or those who wish to override these settings can do so at runtime using environment variables.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Changed
+
+
+
+<AccordionGroup>
+<Accordion title='Upgraded to Golang 1.23'>
+Tyk Gateway now runs on Golang 1.23, bringing security and performance improvements. Key changes include:
+
+- unbuffered Timer/Ticker channels
+- removal of 3DES cipher suites
+- updates to X509KeyPair handling.
+
+**You may need to adjust your setup for compatibility**. For more detail please see the official Go [release notes](https://go.dev/doc/go1.23).
+</Accordion>
+
+<Accordion title='Support for the Latest JSON Schema Version for Tyk Classic Request Validation'>
+We have updated the library that supports JSON schema validation in the Tyk Classic Validate JSON middleware. This introduces improved error messaging when a request does not match the expected schema, reporting where the error exists in the request payload.
+</Accordion>
+
+<Accordion title='Updated Default Configuration for Tyk Operator and Sync Compatibility'>
+Modified the default values of allow_explicit_policy_id and enable_duplicate_slugs to true in all example configuration files, ensuring consistency and alignment with recommended settings.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Resolved API Authentication Issue when Performing Internal Looping using URL Rewrite'>
+We have fixed an issue where authentication was incorrectly handled for the Internal API when URL Rewrite middleware was used to redirect a request using the `tyk://` protocol. This fix ensures that when API A redirects to API B, authentication with API B will use the method configured for API B, improving access control and preventing access denials. Users can now rely on the expected authentication flow, providing a predictable experience when routing to internal APIs.
+</Accordion>
+
+<Accordion title='Reduced False Alarms in Gateway Startup Logging'>
+Resolved initialization errors that caused unnecessary error logging during gateway startup, improving PID file handling and Redis connection state management.
+</Accordion>
+
+<Accordion title='Resolved gateway not entering "emergency" mode'>
+Fixed an issue where the gateway stopped processing traffic when restarted while MDCB was unavailable. Instead of entering “emergency” mode and loading APIs and policies from the Redis backup, the gateway remained unresponsive, continuously attempting to reconnect. With this fix, the gateway detects connection failure and enters emergency mode, ensuring traffic processing resumes even when MDCB is down.
+</Accordion>
+
+<Accordion title='Optimized ctx.GetOASDefinition() for Improved Performance'>
+Improved the performance of ctx.GetOASDefinition() in custom plugins by replacing the deep copy operation with a more efficient cloning method. This optimization reduces memory usage by 95% and CPU consumption by 46%, significantly speeding up API definition retrieval.
+
+Thanks to @sebkehr for identifying this issue and providing valuable feedback to enhance Tyk's performance.
+</Accordion>
+
+<Accordion title='Multi-Value Response Headers in Coprocess Middleware'>
+Multi-value response headers were previously lost after synchronization with coprocess middleware, as only the first value was retained. This has been resolved, ensuring all response headers are properly synchronized and preserved
+</Accordion>
+
+<Accordion title='Fixed Incorrect OAuth Upstream Flow Selection'>
+Resolved an issue where the gateway incorrectly selected the OAuth upstream authentication flow when both client credentials and password flows were configured. The gateway now correctly respects the allowedAuthorizeTypes setting, ensuring the intended authentication flow is used.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+## 5.7 Release Notes
+
+### 5.7.3 Release Notes
+
+#### Release Date 05 June 2025
+
+#### Release Highlights
+
+This patch release contains a bug fix. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.7.3) below.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.7.3 | MDCB v2.7.2     | MDCB v2.4.2 |
+|         | Operator v1.1.0  | Operator v0.17 |
+|         | Sync v2.0.2    | Sync v1.4.3 |
+|         | Helm Chart v2.2  | Helm all versions |
+| | EDP v1.12 | EDP all versions |
+| | Pump v1.11.1 | Pump all versions |
+| | TIB (if using standalone) v1.6.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.22  |  1.22  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.7.3, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.7.3)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.7.3
+    ``` 
+- Helm charts
+  - [tyk-charts v2.2.0](/developer-support/release-notes/helm-chart#2-2-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.7.3](https://github.com/TykTechnologies/tyk/releases/tag/v5.7.3)
+
+#### Changelog
+<a id="Changelog-v5.7.3" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Gateways in distributed Data Planes now cache certificates correctly in Redis'>
+Resolved an issue introduced in Tyk 5.7.1 where Gateways in distributed Data Planes failed to cache TLS certificates correctly in the local Redis, resulting in potential service disruptions if MDCB became unavailable. Data plane gateways now reliably serve HTTPS and mTLS traffic even if MDCB is unavailable.
+</Expandable>
+
+
+
+---
+
+### 5.7.2 Release Notes
+
+#### Release Date 19 February 2025
+
+#### Release Highlights
+
+This patch release contains a bug fix. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.7.2) below.
+
+#### Breaking Changes
+There are no breaking changes in this release.
+
+#### Dependencies
+
+
+##### Compatibility Matrix For Tyk Components
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.7.2 | MDCB v2.7.2     | MDCB v2.4.2 |
+|         | Operator v1.1.0  | Operator v0.17 |
+|         | Sync v2.0.2    | Sync v1.4.3 |
+|         | Helm Chart v2.2  | Helm all versions |
+| | EDP v1.12 | EDP all versions |
+| | Pump v1.11.1 | Pump all versions |
+| | TIB (if using standalone) v1.6.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.22  |  1.22  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+
+#### Upgrade instructions
+If you are upgrading to 5.7.2, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.7.2)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.7.2
+    ``` 
+- Helm charts
+  - [tyk-charts v2.2.0](/developer-support/release-notes/helm-chart#2-2-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.7.2](https://github.com/TykTechnologies/tyk/releases/tag/v5.7.2)
+
+#### Changelog
+<a id="Changelog-v5.7.2" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Resolved gateway not entering "emergency" mode'>
+Fixed an issue where the gateway stopped processing traffic when restarted while MDCB was unavailable. Instead of entering “emergency” mode and loading APIs and policies from the Redis backup, the gateway remained unresponsive, continuously attempting to reconnect. With this fix, the gateway detects connection failure and enters emergency mode, ensuring traffic processing resumes even when MDCB is down.
+</Expandable>
+
+
+
+---
+
+### 5.7.1 Release Notes
+
+#### Release Date 31 December 2024
+
+#### Release Highlights
+
+This release focuses mainly on bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.7.1) below.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.7.1 | MDCB v2.7.2     | MDCB v2.4.2 |
+|         | Operator v1.1.0  | Operator v0.17 |
+|         | Sync v2.0.1    | Sync v1.4.3 |
+|         | Helm Chart v2.2  | Helm all versions |
+| | EDP v1.12 | EDP all versions |
+| | Pump v1.11.1 | Pump all versions |
+| | TIB (if using standalone) v1.6.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.22  |  1.22  | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+
+
+#### Upgrade instructions
+If you are upgrading to 5.7.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.7.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.7.1
+    ``` 
+- Helm charts
+  - [tyk-charts v2.2.0](/developer-support/release-notes/helm-chart#2-2-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.7.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.7.1)
+
+#### Changelog
+<a id="Changelog-v5.7.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Incomplete traffic logs generated if custom response plugin adjusts the payload length'>
+Resolved an issue where the response body could be only partially recorded in the traffic log if a custom response plugin modified the payload. This was due to Tyk using the original, rather than the modified, content-length of the response when identifying the data to include in the traffic log.
+</Accordion>
+
+<Accordion title='Fixed OAuth client creation issue for custom plugin APIs in multi-data plane deployments'>
+Fixed a bug that prevented the control plane Gateway from loading APIs that use custom plugin bundles. The control plane Gateway is used to register OAuth clients and generate access tokens so this could result in an API being loaded to the data plane Gateways but clients unable to obtain access tokens. This issue was introduced in v5.3.1 as a side-effect of a change to address a potential security issue where APIs could be loaded without their custom plugins.
+</Accordion>
+
+<Accordion title='Accurate debug logging restored for middleware'>
+Addressed an issue where shared loggers caused debug logs to misidentify the middleware source, complicating debugging. Log entries now correctly indicate which middleware generated the log, ensuring clearer and more reliable diagnostics
+</Accordion>
+
+<Accordion title='Improved Stability for APIs with Malformed Listen Paths'>
+Fixed an issue where a malformed listen path could cause the Gateway to crash. Now, such listen paths are properly validated, and if validation fails, an error is logged, and the API is skipped—preventing Gateway instability.
+</Accordion>
+
+<Accordion title='Fixed Gateway panic and SSE streaming issue with OpenTelemetry'>
+Resolved a bug that prevented upstream server-sent events (SSE) from being sent when OpenTelemetry was enabled, and fixed a gateway panic that occurred when detailed recording was active while SSE was in use. This ensures stable SSE streaming in configurations with OpenTelemetry.
+</Accordion>
+
+<Accordion title='API Keys remain active after all linked partitioned policies are deleted'>
+Resolved an issue where API access keys remained valid even if all associated policies were deleted. The Gateway now attempts to apply all linked policies to the key when it is presented with a request. Warning logs are generated if any policies cannot be applied (for example, if they are missing). If no linked policy can be applied, the Gateway will reject the key to ensure no unauthorized access.
+</Accordion>
+
+<Accordion title='Fixed Payload Issue with Transfer-Encoding: chunked Header'>
+Resolved an issue where APIs using the Transfer-Encoding: chunked header alongside URL Rewrite or Validate Request middleware would lose the response payload body. The payload now processes correctly, ensuring seamless functionality regardless of header configuration.
+</Accordion>
+
+<Accordion title='Fixed an issue where OAuth 2.0 access tokens would not be issued if the data plane was disconnected from the control plane'>
+OAuth 2.0 access tokens can now be issued even when data plane gateways are disconnected from the control plane. This is achieved by saving OAuth clients locally within the data plane when they are pulled from RPC.
+</Accordion>
+
+<Accordion title='Tyk Now Supports RSA-PSS Signed JWTs'>
+Tyk now supports RSA-PSS signed JWTs (PS256, PS384, PS512), enhancing security while maintaining backward compatibility with RS256. No configuration changes are needed—just use RSA public keys, and Tyk will validate both algorithms seamlessly.
+</Accordion>
+
+<Accordion title='Request size limit middleware would block any request without a payload (for example GET, DELETE)'>
+Resolved a problem in the request size limit middleware that caused GET and DELETE requests to fail validation.The middleware incorrectly expected a request body (payload) for these methods and blocked them when none was present.
+</Accordion>
+
+<Accordion title='Resolved Variable Input Handling for Custom Scalars in GraphQL Queries'>
+Fixed an issue where GraphQL queries using variables for custom scalar types, such as UUID, failed due to incorrect input handling. Previously, the query would return an error when a variable was used but worked when the value was directly embedded in the query. This update ensures that variables for custom scalar types are correctly inferred and processed, enabling seamless query execution.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.7.0 Release Notes
+
+#### Release Date 03 December 2024
+
+#### Release Highlights
+
+We are thrilled to announce new updates and improvements in Tyk 5.7.0, bringing more control, flexibility, and performance.  For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.7.0) below.
+
+##### Tyk Streams - asynchronous API management with Tyk
+
+Tyk is now entering the asynchronous API management space with a bang by delivering Tyk Streams to our users!
+Many API management solutions fail to fully support event-driven architectures, causing fragmented management, inconsistent security practices, and increased operational complexity. With event-driven architectures on the rise recently, keeping everything under control and enforcing standards at the organizational level has become a challenge.
+
+**Tyk Streams** is an event streaming solution available within the Tyk API Management Platform, which applies proven API management principles to simplify event and streams handling. 
+This release brings capabilities to stream data and events using Kafka, Websocket, SSE and HTTP protocols. It also becomes possible to mediate the message format between Avro and JSON on the fly.
+
+- Merge together various sources of events to present to consumers as a unified stream.
+- Apply authentication and authorization to streams of messages, just as you do for your RESTful APIs
+- Expose async APIs via Tyk Portal, so that they are easily discoverable
+
+All of this possible in self-managed and k8s deployments of Tyk!
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.7.0 | MDCB v2.7.2     | MDCB v2.4.2 |
+|         | Operator v1.1.0  | Operator v0.17 |
+|         | Sync v2.0.1    | Sync v1.4.3 |
+|         | Helm Chart v2.2  | Helm all versions |
+| | EDP v1.12 | EDP all versions |
+| | Pump v1.11.1 | Pump all versions |
+| | TIB (if using standalone) v1.6.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.22  |  1.22  | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+In 5.7.0, we have deprecated the dedicated [External OAuth](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated)  (Tyk Classic: `external_oauth`, Tyk OAS: `server.authentication.securitySchemes.externalOAuth`) and [OpenID Connect](/api-management/client-authentication#integrate-with-openid-connect-deprecated)  (Tyk Classic: `auth_configs.oidc`, Tyk OAS: `server.authentication.oidc`) authentication methods. We advise users to switch to [JWT Authentication](/basic-config-and-security/security/authentication-authorization/json-web-tokens).
+
+
+#### Upgrade instructions
+If you are upgrading to 5.7.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.7.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.7.0
+    ``` 
+- Helm charts
+  - [tyk-charts v2.2.0](/developer-support/release-notes/helm-chart#2-2-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.7.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.7.0)
+
+#### Changelog
+<a id="Changelog-v5.7.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Added Stream Analytics Error Handling'>
+Added to Streams analytics capability to capture and report common error scenarios, including broker connectivity issues and standard HTTP errors, ensuring comprehensive request tracking for Streams-processed requests.
+</Accordion>
+
+<Accordion title='Integrated Streams Validator with Streams API'>
+Connected the new OAS validator to the /streams endpoint, adding proper error handling and validation responses for invalid stream configurations.
+</Accordion>
+
+<Accordion title='Extended Streams Configuration Validation'>
+Extended the OAS validator to include Streams configuration validation, enforcing allowlisted components and validating nested broker configurations while implementing schema validation for Streams configurations.
+</Accordion>
+
+<Accordion title='New Streams Configuration Validator'>
+Introduced a new validator derived from the existing OAS schema, adapting it for Streams validation with modified requirements for upstreamURL and x-tyk-streaming fields. This validator is now used by both the Dashboard API streams endpoint and streams configuration validator.
+</Accordion>
+
+<Accordion title='Added Logging for Streams'>
+Refined streams logging behavior to match Tyk's logging patterns, reducing unnecessary log output and improving log clarity.
+</Accordion>
+
+<Accordion title='Simplified Streams Configuration Support'>
+Implemented allowlist-based validation for components in streams configurations, replacing the previous blocklist approach. Supported components now include Kafka, WebSocket, SSE, and HTTP for both inputs and outputs (including broker combinations), along with JSON-Avro bidirectional conversion processors, while other components like scanners, caches, and buffers are blocked by default. This validation is enforced consistently across Gateway, Dashboard API, and UI.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Resolved HTTP Input Timeout in Tyk Streams'>
+When using Tyk Streams and sending input via http, the requests sometimes timed out causing a problem for the consumers. The issue has been fixed and now inputs via http for Tyk Streams work as intended.
+</Accordion>
+
+<Accordion title='Improved backwards compatibility when working with Tyk OAS APIs'>
+Fixed a backwards compatibility issue with Tyk OAS API schema validation. When downgrading from a Tyk version, schema validation could fail if new fields had been added to the Tyk OAS API definition. This change relaxes the strictness of validation to allow additional properties.
+</Accordion>
+
+<Accordion title='Fixed Policy Merge Issue with Path-Based Permissions'>
+Resolved a bug where path-based permissions in policies were not preserved when policies were combined, potentially omitting URL values and incorrectly restricting access. The updated behavior ensures that URL access rights from all applicable policies are merged, regardless of policy order, allowing seamless enforcement of combined permissions.
+</Accordion>
+
+<Accordion title='Resolved API Routing Issue with Trailing Slashes and Overlapping Listen Paths'>
+Fixed a routing issue that caused incorrect API matching when dealing with APIs that lacked a trailing slash, used custom domains, or had similar listen path patterns. Previously, the router prioritized APIs with longer subdomains and shorter listen paths, leading to incorrect matches when listen paths shared prefixes. This fix ensures accurate API matching, even when subdomains and listen paths overlap.
+</Accordion>
+
+<Accordion title='Optimized Gateway Handling for Large Payloads'>
+Fixed an issue that caused increased memory consumption when proxying large response payloads. The Gateway now handles large payloads more efficiently in terms of speed and memory usage.
+</Accordion>
+</AccordionGroup>
+
+
+
+## 5.6 Release Notes
+
+### 5.6.1 Release Notes
+
+#### Release Date 18 October 2024
+
+#### Release Highlights
+
+{/* Required. Use similar ToV to previous release notes. For example for a patch release:
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-vX.Y.0) below. */}
+
+This patch release for Tyk Gateway addresses critical stability issues for users running Tyk Gateway within the data
+plane, connecting to the control plane or Tyk Hybrid. Affected users should upgrade immediately to version 5.6.1 to
+avoid service interruptions and ensure reliable operations with the control plane or Tyk Hybrid.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.6.1) below.
+
+#### Breaking Changes
+
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases             | Backwards Compatibility |
+| :--------------- | :-------------------------------- | :----------------------- |
+| 5.6.1           | MDCB v2.7.1                      | MDCB v2.4.2             |
+|                 | Operator v1.0.0                  | Operator v0.17          |
+|                 | Sync v2.0                        | Sync v1.4.3             |
+|                 | Helm Chart v2.1                  | Helm all versions       |
+|                 | EDP v1.11                        | EDP all versions        |
+|                 | Pump v1.11                       | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1 | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions | Compatible Versions | Comments                                                                                    |
+| :------------------------------------------------------------- | :--------------- | :------------------- | :------------------------------------------------------------------------------------------- |
+| [Go](https://go.dev/dl/)                                      | 1.22            | 1.22                | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x      | 6.2.x, 7.x          | Used by Tyk Gateway                                                                         |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x          | v3.0.x              | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+
+There are no deprecations in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc.
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+
+#### Upgrade instructions
+
+If you are upgrading to 5.6.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.6.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.6.1
+    ```
+- Helm charts
+
+  - [tyk-charts v2.1.0](/developer-support/release-notes/helm-chart#2-1-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.6.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.6.1)
+
+#### Changelog
+<a id="Changelog-v5.6.1" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Fixed
+
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Resolved gateway panic on reconnecting to MDCB control plane or Tyk Cloud'>
+In version 5.6.0, Tyk Gateway could encounter a panic when attempting to reconnect to the control plane after it was
+restarted. This patch version has resolved this issue, ensuring stable connectivity between the gateway and control
+plane following reconnections and reducing the need for manual intervention.
+</Expandable>
+
+
+
+{/* ##### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082)
+
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Gateway, providing increased protection against security vulnerabilities:
+- [CVE-2024-6104](https://nvd.nist.gov/vuln/detail/CVE-2024-6104)
+</Expandable>
+
+ */}
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+
+### 5.6.0 Release Notes
+
+#### Release Date 10 October 2024
+
+
+<Note>
+**Important Update**<br /> <br /> <b>Date</b>: 12 October 2024<br /> <b>Topic</b>: Gateway panic when
+reconnecting to MDCB control plane or Tyk Cloud<br /> <b>Workaround</b>: Restart Gateway<br /> <b>Affected Product</b>: Tyk
+Gateway as an Edge Gateway<br /> <b>Affected versions</b>: v5.6.0, v5.3.6, and v5.0.14<br /> <b>Issue Description:</b><br />
+
+<p>We have identified an issue affecting Tyk Gateway deployed as a data plane connecting to the Multi-Data Center Bridge (MDCB) control plane or Tyk Cloud. In the above mentioned Gateway versions a panic may occur when gateway reconnect to the control plane after the control plane is restarted.</p>
+
+<p>Our engineering team is actively working on a fix, and a patch (versions 5.6.1, 5.3.7, and 5.0.15) will be released soon.<br /></p>
+
+<b>Recommendations:</b><br />
+
+<b>For users on versions 5.5.0, 5.3.5, and 5.0.13</b><br />
+We advise you to delay upgrading to the affected versions (5.6.0, 5.3.6, or 5.0.14) until the patch is available.
+
+<b>For users who have already upgraded to 5.6.0, 5.3.6, or 5.0.14 and are experiencing a panic in the gateway:</b><br />
+Restarting the gateway process will restore it to a healthy state. If you are operating in a *Kubernetes* environment, Tyk Gateway instance should automatically restart, which ultimately resolves the issue.<br />
+
+
+<p>We appreciate your understanding and patience as we work to resolve this. Please stay tuned for the upcoming patch release, which will address this issue.</p>
+</Note>
+
+
+
+#### Release Highlights
+
+{/* Required. Use similar ToV to previous release notes. For example for a patch release:
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-vX.Y.0) below. */}
+
+We are thrilled to announce new updates and improvements in Tyk 5.6.0, bringing more control, flexibility, and
+performance. For a comprehensive list of changes, please refer to the detailed
+[changelog](#Changelog-v5.6.0) below.
+
+##### Per endpoint Rate Limiting for clients
+
+Building on the [per-endpoint upstream rate
+limits](/api-management/rate-limit#api-level-rate-limiting) introduced in Tyk 5.5.0 we have
+now added [per-endpoint client
+rate limits](/api-management/rate-limit#key-level-rate-limiting). This new feature allows
+for more granular control over client consumption of API resources by associating the rate limit with the access key,
+enabling you to manage and optimize API usage more effectively.
+
+##### Gateway logs in JSON format
+
+You can now output Tyk Gateway system logs in JSON format. This allows for easier integration with logging systems and
+more structured log data.
+
+##### Go upgrade to 1.22
+
+We’ve upgraded the Tyk Gateway to Golang 1.22, bringing improved performance, better security, and enhanced stability to
+the core system.
+
+#### Breaking Changes
+
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases             | Backwards Compatibility |
+| :--------------- | :-------------------------------- | :----------------------- |
+| 5.6.0           | MDCB v2.7.1                      | MDCB v2.4.2             |
+|                 | Operator v1.0.0                  | Operator v0.17          |
+|                 | Sync v2.0                        | Sync v1.4.3             |
+|                 | Helm Chart v2.1                  | Helm all versions       |
+|                 | EDP v1.11                        | EDP all versions        |
+|                 | Pump v1.11                       | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1 | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions | Compatible Versions | Comments                                                                                    |
+| :------------------------------------------------------------- | :--------------- | :------------------- | :------------------------------------------------------------------------------------------- |
+| [Go](https://go.dev/dl/)                                      | 1.22            | 1.22                | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x      | 6.2.x, 7.x          | Used by Tyk Gateway                                                                         |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x          | v3.0.x              | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+
+There are no deprecations in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc.
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+
+#### Upgrade instructions
+
+If you are upgrading to 5.6.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.6.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.6.0
+    ```
+- Helm charts
+
+  - [tyk-charts v2.1.0](/developer-support/release-notes/helm-chart#2-1-0-release-notes)
+
+- [Source code tarball of Tyk Gateway v5.6.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.6.0)
+
+#### Changelog
+<a id="Changelog-v5.6.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Per endpoint client rate limiting'>
+Building on the [per-endpoint upstream rate
+limits](/api-management/rate-limit#api-level-rate-limiting) introduced in Tyk 5.5.0 we have
+added [per-endpoint client
+rate limits](/api-management/rate-limit#key-level-rate-limiting). This new feature
+provided users with more precise control over API resource consumption by linking rate limits to access keys, allowing
+for better management and optimization of API usage.
+</Expandable>
+
+
+<Expandable title='New option to generate Gateway system logs in JSON format'>
+The Tyk Gateway now supports logging in JSON format. To enable this feature, set the environment variable
+`TYK_GW_LOGFORMAT` to `json`. If a different value is provided, the logs will default to the standard format. This
+enhancement allows for improved log processing and integration with various monitoring tools.
+</Expandable>
+
+
+
+##### Changed
+
+{/* This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Upgrade to Go 1.22 for Tyk Dashboard'>
+The Tyk Gateway and Tyk Dashboard have been upgraded from Golang 1.21 to Golang 1.22, bringing enhanced performance,
+strengthened security, and access to the latest features available in the new Golang release.
+</Expandable>
+
+
+
+##### Fixed
+
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title="Data plane gateways sometimes didn't synchronise policies and APIs on start-up">
+We have enhanced the initial synchronization of Data Plane gateways with the Control Plane to ensure more reliable
+loading of policies and APIs on start-up. A synchronous initialization process has been implemented to avoid sync
+failures and reduce the risk of service disruptions caused by failed loads. This update ensures smoother and more
+consistent syncing of policies and APIs in distributed deployments.
+</Accordion>
+
+<Accordion title="Quota wasn't respected under extreme load">
+We have fixed an issue where the quota limit was not being consistently respected during request spikes, especially in
+deployments with multiple gateways. The problem occurred when multiple gateways cached the current and remaining quota
+counters at the end of quota periods. To address this, a distributed lock mechanism has been implemented, ensuring
+coordinated quota resets and preventing discrepancies across gateways.
+</Accordion>
+
+<Accordion title='Rate limits were incorrectly combined when multiple policies were applied to a key'>
+We have fixed an issue where API-level rate limits set in multiple policies were not correctly applied to the same key.
+With this update, when multiple policies configure rate limits for a key, the key will now receive the highest rate
+limit from the combined policies, ensuring proper enforcement of limits.
+</Accordion>
+
+<Accordion title='Restored key creation performance to Gateway 4.0.12/4.3.3 levels'>
+We have addressed a performance regression where key creation for policies with a large number of APIs (100+) became
+significantly slower in Tyk 4.0.13/5.0.1. The operation, which previously took around 1.5 seconds, has been taking over
+20 seconds since versions 4.0.13/5.0.1. This issue has been resolved by optimizing Redis operations during key creation,
+restoring the process to the previous duration, even with a large number of APIs in the policy.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Security Fixes
+
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Gateway, providing increased protection against security
+vulnerabilities:
+
+- [CVE-2024-6104](https://nvd.nist.gov/vuln/detail/CVE-2024-6104)
+</Expandable>
+
+
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 5.5 Release Notes
+
+### 5.5.2 Release Notes
+
+#### Release Date 03 October 2024
+
+#### Release Highlights
+This release replaces Tyk Gateway 5.5.1 which was accidentally released as a non-distroless image.
+
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.5.2 | MDCB v2.7     | MDCB v2.4.2 |
+|         | Operator v0.18 | Operator v0.17 |
+|         | Sync v1.5   | Sync v1.4.3 |
+|         | Helm Chart v2.0.0 | Helm all versions |
+| | EDP v1.10 | EDP all versions |
+| | Pump v1.11 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.21  |  1.21  | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 5.5.2, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.5.2)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.5.2
+    ``` 
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.5.2](https://github.com/TykTechnologies/tyk/releases/tag/v5.5.2)
+
+---
+
+### 5.5.1 Release Notes
+
+#### Release Date 26 September 2024
+
+#### Release Highlights
+This release fixes some issues related to the way that Tyk performs URL path matching, introducing two new Gateway configuration options to control path matching strictness.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.5.1) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.5.1 | MDCB v2.7     | MDCB v2.4.2 |
+|         | Operator v0.18 | Operator v0.17 |
+|         | Sync v1.5   | Sync v1.4.3 |
+|         | Helm Chart v2.0.0 | Helm all versions |
+| | EDP v1.10 | EDP all versions |
+| | Pump v1.11 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.21  |  1.21  | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 5.5.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.5.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.5.1
+    ``` 
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.5.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.5.1)
+
+#### Changelog
+<a id="Changelog-v5.5.1" data-scroll-offset></a>
+
+##### Added
+
+
+
+<Expandable title='Implemented Gateway configuration options to set URL path matching strictness'>
+We have introduced two new options in the `http_server_options` [Gateway configuration](/tyk-oss-gateway/configuration#http_server_options) that will enforce prefix and/or suffix matching when Tyk performs checks on whether middleware or other logic should be applied to a request:
+
+- `enable_path_prefix_matching` ensures that the start of the request path must match the path defined in the API definition
+- `enable_path_suffix_matching` ensures that the end of the request path must match the path defined in the API definition
+- combining `enable_path_prefix_matching` and `enable_path_suffix_matching` will ensure an exact (explicit) match is performed
+
+These configuration options provide control to avoid unintended matching of paths from Tyk's default *wildcard* match. Use of regex special characters when declaring the endpoint path in the API definition will automatically override these settings for that endpoint.
+
+Tyk recommends that exact matching is employed, but both options default to `false` to avoid introducing a breaking change for existing users.
+
+The example Gateway configuration file `tyk.conf.example` has been updated to set the recommended *exact matching* with:
+
+ - `http_server_options.enable_path_prefix_matching = true`
+ - `http_server_options.enable_path_suffix_matching = true`
+ - `http_server_options.enable_strict_routes = true`
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Incorrectly configured regex in Policy affected Granular Endpoint Access authorization'>
+Fixed an issue when using [granular endpoint](/api-management/access-control/sessions-and-keys/access-rights#granular-endpoint-access) in access Policies and keys that led to authorization incorrectly being granted to endpoints if an invalid regular expression was configured in the key/Policy. Also fixed an issue where path-based parameters were not correctly handled by Path-Based Permissions. Now Tyk's authorization check correctly handles both of these scenarios granting access only to the expected resources.
+</Expandable>
+
+
+<Expandable title='Missing path parameter can direct to the wrong endpoint'>
+Fixed an issue where a parameterized endpoint URL (e.g. `/user/{id}`) would be invoked if a request is made that omits the parameter. For example, a request to `/user/` will now be interpreted as a request to `/user` and not to `/user/{id}`.
+</Expandable>
+
+
+
+---
+
+### 5.5.0 Release Notes
+
+#### Release Date 12 August 2024
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release:
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-vX.Y.0) below. */}
+We are thrilled to introduce Tyk Gateway 5.5, bringing advanced rate-limiting capabilities, enhanced certificate authentication, and performance optimizations. For a comprehensive list of changes, please refer to the [changelog](#Changelog-v5.5.0) below.
+
+##### Per Endpoint Rate Limiting
+
+Now configure rate limits at the endpoint level for both [Tyk OAS](/api-management/rate-limit#tyk-oas-api-definition) and [Tyk Classic APIs](/api-management/rate-limit#tyk-classic-api-definition), providing granular protection for upstream services against overloading and abuse.
+
+##### Root CA Support for Client Certificates
+
+Simplify certificate management with support for root Certificate Authority (CA) certificates, enabling clients to authenticate using certificates signed by the [configured root CA](/api-management/implement-tls#frequently-asked-questions).
+
+##### Optimised AST Document Handling
+
+Experience improved performance with optimised creation and usage of Abstract Syntax Tree (AST) documents in our GQL library, reducing memory usage and enhancing efficiency.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+Docker images are now based on [distroless](https://github.com/GoogleContainerTools/distroless). No shell is shipped in the image.
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.5.0 | MDCB v2.7     | MDCB v2.4.2 |
+|         | Operator v0.18 | Operator v0.17 |
+|         | Sync v1.5   | Sync v1.4.3 |
+|         | Helm Chart v1.6 | Helm all versions |
+| | EDP v1.10 | EDP all versions |
+| | Pump v1.11 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.21  |  1.21  | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+
+#### Upgrade instructions
+If you are upgrading to 5.5.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.5.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.5.0
+    ``` 
+- Helm charts
+  - [tyk-charts v1.6](/developer-support/release-notes/helm-chart#1-6-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.5.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.5.0)
+
+#### Changelog
+<a id="Changelog-v5.5.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Added root CA support for client certificate authentication'>
+We've added support for you to register Certificate Authority (CA) certificates in your API definitions when using static mutual TLS (mTLS). Tyk can now authenticate clients presenting certificates signed by the registered root CA, simplifying certificate management for multiple clients sharing a common CA.
+</Accordion>
+
+<Accordion title='Optimised creation and usage of AST documents in GQL library'>
+Optimised the creation and usage of AST documents in our GQL library to reduce significant memory allocations caused by pre-allocations during initial creation. These optimizations free up resources more efficiently, minimising performance penalties with increased requests to the Gateway.
+</Accordion>
+
+<Accordion title='Implemented upstream endpoint rate limits'>
+Introduced new more granular controls for request rate limiting. Rate limits can now be configured at the endpoint level in Tyk OAS and Tyk Classic API definitions.
+</Accordion>
+
+<Accordion title='Improved handling of requests to non-existent versions of APIs when using URL path versioning'>
+When using the URL path to indicate the API version (for example `/v1/my-api`) it is common to strip the version identifier (e.g. `/v1`) from the path before proxying the request to the upstream. If the client doesn't provide any version identifier this could lead to an invalid target URL and failed requests, rather than correctly redirecting to the default version. We have introduced an optional configuration `url_versioning_pattern` where you can specify a regex that Tyk will use to identify if the URL contains a version identifier and avoiding the accidental stripping of valid upstream path.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Fixed an issue where transformation middleware could incorrectly be applied to Tyk OAS API endpoints with nested paths'>
+Fixed an issue when using Tyk OAS APIs where nested API endpoints, such as '/test' and '/test/abc', might incorrectly apply middleware from the parent path to the nested path. The fix ensures that API endpoint definitions are correctly ordered so that the standard behaviour of Tyk is followed, whereby path matching is performed starting from the longest path, preventing middleware misapplication and ensuring both the HTTP method and URL match accurately.
+</Accordion>
+
+<Accordion title='Optimised key creation process to avoid unnecessary Redis `DeleteRawKey` commands'>
+Previously, key creation or reset led to an exponential number of Redis `DeleteRawKey` commands; this was especially problematic for access lists with over 100 entries. The key creation sequence now runs only once, eliminating redundant deletion of non-existent keys in Redis. This optimization significantly reduces deletion events, enhancing performance and stability for larger access lists.
+</Accordion>
+
+<Accordion title='Resolved SSE streaming issue'>
+Addressed a bug that caused Server Side Event (SSE) streaming responses to be considered for caching, which required buffering the response and prevented SSE from being correctly proxied.
+</Accordion>
+
+<Accordion title='Fixed analytics latency reporting for MDCB setups'>
+Resolved an issue where Host and Latency fields (Total and Upstream) were not correctly reported for Tyk Gateways in MDCB data planes. The fix ensures accurate Host values and Latency measurements are now captured and displayed in the generated traffic logs.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Security Fixes
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Gateway, providing increased protection against security vulnerabilities:
+- [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
+- [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
+</Expandable>
+
+
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+## 5.4 Release Notes
+### 5.4.0 Release Notes
+
+#### Release Date 2 July 2024
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+**Attention: Please read this section carefully**
+
+We have fixed a bug in the way that Tyk calculates the [key-level rate limit](/api-management/rate-limit#key-level-rate-limiting) when multiple policies are applied to the same key. This fix alters the logic used to calculate the effective rate limit and so may lead to a different rate limit being applied to keys generated from your existing policies. See the [change log](#fixed) for details of the change.
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.4.0 | MDCB v2.6     | MDCB v2.4.2 |
+|         | Operator v0.18 | Operator v0.17 |
+|         | Sync v1.5   | Sync v1.4.3 |
+|         | Helm Chart v1.5.0 | Helm all versions |
+| | EDP v1.9 | EDP all versions |
+| | Pump v1.10.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+The above table needs reviewing and updating if necessary
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.19 (GQL), 1.21 (GW)  | 1.19 (GQL), 1.21 (GW)  | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+**The above table needs reviewing and updating if necessary**
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+
+#### Upgrade instructions
+If you are upgrading to 5.4.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+Add upgrade steps here if necessary.
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release:
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-vX.Y.0) below. */}
+We're thrilled to introduce exciting enhancements in Tyk Gateway 5.4, aimed at improving your experience with Tyk Gateway. For a comprehensive list of changes, please refer to the change log below.
+
+##### Enhanced Rate Limiting Strategies
+
+We've introducing a [Rate Limit Smoothing](/api-management/rate-limit#rate-limit-smoothing) option for the spike arresting Redis Rate Limiter to give the upstream time to scale in response to increased request rates.
+
+##### Fixed MDCB Issue Relating To Replication Of Custom Keys To Dataplanes
+
+Resolved an issue encountered in MDCB environments where changes to custom keys made via the Dashboard were not properly replicated to data planes. The issue impacted both key data and associated quotas, in the following versions:
+
+- 5.0.4 to 5.0.12
+- 5.1.1 and 5.1.2
+- 5.2.0 to 5.2.6
+- 5.3.0 to 5.3.2
+
+###### Action Required
+Customers should clear their edge Redis instances of any potentially affected keys to maintain data consistency and ensure proper synchronization across their environments. Please refer to the item in the [fixed](#fixed) section of the changelog for recommended actions.
+
+##### Fixed Window Rate Limiter
+
+Ideal for persistent connections with load-balanced gateways, the [Fixed Window Rate Limiter](/api-management/rate-limit#fixed-window-rate-limiter) algorithm mechanism ensures fair handling of requests by allowing only a predefined number to pass per rate limit window. It uses a simple shared counter in Redis so requests do not need to be evenly balanced across the gateways.
+
+##### Event handling with Tyk OAS
+
+We’ve added support for you to [register webhooks](/api-management/gateway-events#event-handling-with-webhooks) with your Tyk OAS APIs so that you can handle events triggered by the Gateway, including circuit breaker and quota expiry. You can also assign webhooks to be fired when using the new [smoothing rate limiter](/api-management/rate-limit#rate-limit-smoothing) to notify your systems of ongoing traffic spikes.
+
+##### Enhanced Header Handling in GraphQL APIs
+
+Introduced a features object in API definitions for GQL APIs, including the `use_immutable_headers` attribute. This allows advanced header control, enabling users to add new headers, rewrite existing ones, and selectively remove specific headers. Existing APIs will have this attribute set to `false` by default, ensuring no change in behavior. For new APIs, this attribute is true by default, facilitating smoother migration and maintaining backward compatibility.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.4.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.4.0
+    ``` 
+- Helm charts
+  - [tyk-charts v1.5](/developer-support/release-notes/helm-chart#1-5-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.4.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.4.0)
+
+#### Changelog
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Implemented Fixed Window Rate Limiting for load balancers with keep-alives'>
+Introduced a [Fixed Window Rate Limiting](/api-management/rate-limit#fixed-window-rate-limiter) mechanism to handle rate limiting for load balancers with keep-alives. This algorithm allows the defined number of requests to pass for every rate limit window and blocks any excess requests. It uses a simple shared counter in Redis to count requests. It is suitable for situations where traffic towards Gateways is not balanced fairly. To enable this rate limiter, set `enable_fixed_window_rate_limiter` in the gateway config or set the environment variable `TYK_GW_ENABLEFIXEDWINDOWRATELIMITER=true`.
+</Accordion>
+
+<Accordion title='Introduced Rate Limit Smoothing for scaling'>
+Implemented [Rate Limit Smoothing](/api-management/rate-limit#rate-limit-smoothing) as an extension to the existing Redis Rate Limiter to gradually adjust the rate based on smoothing configuration. Two new Gateway events have been created  (`RateLimitSmoothingUp` and `RateLimitSmoothingDown`) which will be triggered as smoothing occurs. These can be used to assist with auto-scaling of upstream capacity during traffic spikes.
+</Accordion>
+
+<Accordion title='Introduced ‘use_immutable_headers’ for Advanced Header Control in GraphQL APIs'>
+We've added the `use_immutable_headers` option to the GraphQL API configuration, offering advanced header transformation capabilities. When enabled, users can add new headers, rewrite existing ones, and selectively remove specific headers, allowing granular control without altering the original request. Existing APIs will default to `false`, maintaining current behavior until ready for upgrade.
+</Accordion>
+
+<Accordion title='Enhanced manual schema addition for GQL APIs'>
+Introduced an option for users to manually provide GQL schemas when creating APIs in Tyk, eliminating the dependency on upstream introspection. This feature enables the creation and editing of GQL APIs in Tyk even when upstream introspection is unavailable, providing flexibility for schema management as upstream configurations evolve over time.
+</Accordion>
+
+<Accordion title='Introduced Tyk v3 GraphQL Engine in Gateway'>
+The new GraphQL engine, version 3-preview, is now available in Tyk Gateway. It can be used for any GQL API by using the following enum in raw API definition: *"version": "3-preview"*. This experimental version offers optimized GQL operation resolution, faster response times, and a more efficient data loader. It is currently not recommended for production use and will be stabilised in future releases, eventually becoming the default for new GQL APIs in Tyk.
+</Accordion>
+
+<Accordion title='Introduced features Object in API Definition for GQL APIs'>
+Enhanced request headers handling in API definitions for GQL APIs by introducing a *features* object. Users can now set the `use_immutable_headers` attribute, which defaults to false for existing APIs, ensuring no change in header behavior. For new APIs, this attribute is `true` by default, facilitating smoother migration and maintaining backwards compatibility.
+</Accordion>
+
+<Accordion title='New Tyk OAS features'>
+We’ve added some more features to the Tyk OAS API, moving closer to full parity with Tyk Classic. In this release we’ve added controls that allow you: to enable or prevent generation of traffic logs at the API-level and to enable or prevent the availability of session context to middleware. We’ve also added the facility to register webhooks that will be fired in response to Gateway events.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Resolved an issue where changes to custom keys were not properly replicated to data planes'>
+Resolved a critical issue affecting MDCB environments, where changes to custom keys made via the dashboard were not properly replicated to data planes. This affected both the key data and associated quotas. This issue was present in versions:
+- 5.0.4 to 5.0.12
+- 5.1.1 and 5.1.2
+- 5.2.0 to 5.2.6
+- 5.3.0 to 5.3.2
+
+**Action Required**
+
+Customers are advised to clear their edge Redis instances of any keys that might have been affected by this bug to ensure data consistency and proper synchronization across their environments. There are several methods available to address this issue:
+
+1. **Specific Key Deletion via API**: To remove individual buggy keys, you can use the following API call:
+
+```bash
+curl --location --request DELETE 'http://tyk-gateway:{tyk-hybrid-port}/tyk/keys/my-custom-key' \ --header 'X-Tyk-Authorization: {dashboard-key}'
+```
+
+Replace `{tyk-hybrid-port}`, `my-custom-key` and `{dashboard-key}` with your specific configuration details. This method is safe and recommended for targeted removals without affecting other keys.
+
+2. **Bulk Key Deletion Using Redis CLI**: For environments with numerous affected keys, you might consider using the Redis CLI to remove keys en masse:
+
+```bash
+redis-cli --scan --pattern 'apikey-*' | xargs -L 1 redis-cli del
+redis-cli --scan --pattern 'quota-*' | xargs -L 1 redis-cli del
+```
+
+This method can temporarily impact the performance of the Redis server, so it should be executed during a maintenance window or when the impact on production traffic is minimal.
+
+3. **Complete Redis Database Flush**: If feasible, flushing the entire Redis database offers a clean slate:
+
+```bash
+redis-cli FLUSHALL ASYNC
+```
+
+**Implications**
+Regardless of the chosen method, be aware that quotas will be reset and will need to resynchronize across the system. This may temporarily affect reporting and rate limiting capabilities.
+</Accordion>
+
+<Accordion title='Resolved service discovery issue when using Consul'>
+Addressed an issue with service discovery where an IP returned by Consul wasn't parsed correctly on the Gateway side, leading to unexpected errors when proxying requests to the service. Typically, service discovery returns valid domain names, which did not trigger the issue.
+</Accordion>
+
+<Accordion title='Corrected naming for semantic conventions attributes in GQL Spans'>
+Fixed an issue where GQL Open Telemetry semantic conventions attribute names that lacked the 'graphql' prefix, deviating from the community standard. All attributes now have the correct prefix.
+</Accordion>
+
+<Accordion title='Fixed missing GraphQL OTel attributes in spans on request validation failure'>
+Corrected an issue where GraphQL OTel attributes were missing from spans when request validation failed in cases where `detailed_tracing` was set to `false`. Traces now include GraphQL attributes (operation name, type, and document), improving debugging for users.
+</Accordion>
+
+<Accordion title='Resolved Gateway panic with Persist GraphQL Middleware'>
+Fixed a gateway panic issue observed by users when using the *Persist GQL* middleware without defined arguments. The gateway will no longer throw panics in these cases.
+</Accordion>
+
+<Accordion title='Resolved issue with GraphQL APIs handling OPTIONS requests'>
+Fixed an issue with GraphQL API's Cross-Origin Resource Sharing (CORS) configuration, which previously caused the API to fail in respecting CORS settings. This resulted in an inability to proxy requests to upstream servers and handle OPTIONS/CORS requests correctly. With this fix, users can now seamlessly make requests, including OPTIONS method requests, without encountering the previously reported error.
+</Accordion>
+
+<Accordion title='Resolved conflict with multiple APIs sharing listen path on different domains'>
+Fixed an issue where the Gateway did not respect API domain settings when there was another API with the same listen path but no domain. This could lead to the custom domain API not functioning correctly, depending on the order in which APIs were loaded. APIs with custom domains are now prioritised before those without custom domains to ensure that the custom domain is not ignored.
+</Accordion>
+
+<Accordion title='Resolved nested field mapping issue in Universal Data Graph'>
+Addressed a problem with nested field mapping in UDG for GraphQL (GQL) operations. Previously, querying a single nested field caused an error, while including another *normal* field from the same level allowed the query to succeed. This issue has been fixed to ensure consistent behavior regardless of the query composition.
+</Accordion>
+
+<Accordion title='Fixed an error in the calculation of effective rate limit from multiple policies'>
+Fixed a long-standing bug in the algorithm used to determine the effective rate limit when multiple policies are applied to a key. If more than one policy is applied to a key then Tyk will apply the highest request rate permitted by any of the policies that defines a rate limit.
+
+Rate limits in Tyk are defined using two elements: `rate`, which is the number of requests and `per`, which is the period over which those requests can be sent. So, if `rate` is 90 and `per` is 30 seconds for a key, Tyk will permit a maximum of 90 requests to be made using the key in a 30 second period, giving an effective maximum of 180 requests per minute (or 3 rps).
+
+Previously, Tyk would take the highest `rate` and the highest `per` from the policies applied to a key when determining the effective rate limit. So, if policy A had `rate` set to 90 and `per` set to 30 seconds (3rps) while policy B had `rate` set to 100 and `per` set to 10 seconds (10rps) and both were applied to a key, the rate limit configured in the key would be: `rate = 100` and `per = 30` giving a rate of 3.33rps.
+
+With the fix applied in Tyk 5.4.0, the Gateway will now apply the highest effective rate to the key - so in this example, the key would take the rate limit from policy B: `rate = 100` and `per = 10` (10rps).
+
+Note that this corrected logic is applied when access keys are presented in API requests. If you are applying multiple policies to keys, there may be a change in the effective rate limit when using Tyk 5.4.0 compared with pre-5.4.0 versions.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Security Fixes
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Gateway, providing increased protection against security vulnerabilities:
+- [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
+- [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
+</Expandable>
+
+
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 5.3 Release Notes
+
+
+### 5.3.13 Release Notes
+
+#### Release Date 18 May 2026
+
+#### Release Highlights
+
+This release resolves a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an **unlimited node license**, where mass registrations or rolling upgrades could leave Gateways stuck in registration loops.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.13) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.13 | MDCB v2.11.0     | MDCB v2.11.0 |
+|         | Operator v1.4.0  | Operator v0.17 |
+|         | Sync v2.1.6    | Sync v2.1.0 |
+|         | Helm Chart v5.2  | Helm all versions |
+| | Pump v1.13.3| Pump all versions |
+| | TIB (if using standalone) v1.7.1 | TIB all versions |
+
+##### Third-party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.24       | 1.24       | [Go plugins](/api-management/plugins/golang) must be built using Go 1.24 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x      | v3.0.x          | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas#tyk-vendor-extension-reference)|
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.3.13, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.13)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.13
+    ``` 
+
+- Helm charts
+  - [tyk-charts v5.2.0](/developer-support/release-notes/helm-chart#5-2-0-release-notes)
+
+- [Source code tarball for OSS projects](https://github.com/TykTechnologies/tyk/releases)
+
+<Note>
+Tyk Helm Charts are configured to install the LTS version of Tyk Gateway. You will need to modify them to install v5.3.13.
+</Note>
+
+#### Changelog
+<a id="Changelog-v5.3.13"></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated Tyk Gateway to Golang 1.24'>
+Updated the Tyk Gateway to use Golang 1.24, reducing exposure to potential security vulnerabilities in older versions.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Resolve Gateway registration failures at scale on unlimited node licenses'>
+We have resolved a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an **unlimited node license**. During mass registrations or rolling upgrades, a combination of lock contention, excessive Redis load, and incorrect handling of `409 Conflict` responses could leave Gateways stuck in registration loops without the credentials needed to serve traffic.
+
+Gateway registration is now significantly more robust at scale: registration requests are no longer serialized across the fleet, Gateways recover cleanly from transient `409 Conflict` responses instead of looping, and the Redis load generated during registration storms is substantially reduced.
+
+
+</Accordion>
+
+</AccordionGroup>
+
+### 5.3.12 Release Notes
+
+#### Release Date 12th September 2025
+
+#### Release Highlights
+
+This patch release contains bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.12) below.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.12 | MDCB v2.8.4     | MDCB v2.8.0 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.23  |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.3.12, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.12)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.12
+    ``` 
+
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+- [Source code tarball for OSS projects](https://github.com/TykTechnologies/tyk/releases)
+
+#### Changelog
+<a id="Changelog-v5.3.12" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+
+<AccordionGroup>
+<Accordion title='Gateways in distributed Data Planes now cache certificates correctly in Redis'>
+Resolved an issue introduced in Tyk 5.3.10 where Gateways in distributed Data Planes failed to cache TLS certificates correctly in the local Redis, resulting in potential service disruptions if MDCB became unavailable. Data plane gateways now reliably serve HTTPS and mTLS traffic even if MDCB is unavailable.
+</Accordion>
+
+<Accordion title='Fixed Stale RPC Connections After DNS Changes'>
+We’ve fixed an issue where RPC connections remained stale when DNS records changed (such as ELB IP updates), leading to timeout errors. Based on direct customer reports, we’ve enhanced DNS resolution so all connections in the RPC pool now properly reconnect when endpoint IPs change. This eliminates service disruptions during infrastructure updates and ensures more resilient connectivity.
+</Accordion>
+
+<Accordion title='Resolved MDCB Policy Sync Issue Caused by RPC Timeouts'>
+Fixed a bug where a timeout in an RPC call to MDCB would lead to policies not being synchronised to the data plane.
+</Accordion>
+
+<Accordion title='Improved Gateway Registration Reliability During Upgrades'>
+We’ve resolved an issue that could cause Gateways to fail re-registration when restarting under certain licensing configurations during upgrades. This fix introduces support for new “Unlimited Gateway” licenses, enhances Gateway's Dashboard authentication retry logic, and ensures a smoother upgrade experience for large-scale deployments. Gateways now register reliably without entering failure loops, even under heavy churn or rolling upgrades.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+
+---
+
+### 5.3.11 Release Notes
+
+#### Release Date 7 May 2025
+
+#### Release Highlights
+
+This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.11) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3.11 | MDCB v2.8.0     | MDCB v2.8.0 |
+|         | Operator v1.2.0  | Operator v0.17 |
+|         | Sync v2.1.0    | Sync v2.1.0 |
+|         | Helm Chart v3.0  | Helm all versions |
+| | EDP v1.13 | EDP all versions |
+| | Pump v1.12.0 | Pump all versions |
+| | TIB (if using standalone) v1.7.0 | TIB all versions |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                       | Tested Versions        | Compatible Versions    | Comments | 
+| :------------------------------------------------------------ | :---------------------- | :---------------------- | :-------- | 
+| [Go](https://go.dev/dl/)                                     | 1.23  |  1.23  | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by Tyk Gateway | 
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3)| v3.0.x                 | v3.0.x                 | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas) |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are upgrading to 5.3.11, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.11)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.11
+    ``` 
+- Helm charts
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+- [Source code tarball of Tyk Gateway 5.3.11](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.11)
+
+#### Changelog
+<a id="Changelog-v5.3.11" data-scroll-offset></a>
+
+##### Added 
+
+
+
+<Expandable title='Added GODEBUG Flags for Backward Compatibility with Deprecated Ciphers'>
+We have added GODEBUG flags to enable deprecated insecure ciphers by default for backward compatibility. Existing users will not be affected. New users or those who wish to override these settings can do so at runtime using environment variables.
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed Inconsistent Context Behavior in UDG APIs'>
+Addressed an issue for UDG APIs where caching led to the forwarding of stale values for headers that contained content variables towards the upstream of the UDG apis.
+</Accordion>
+
+<Accordion title='Improved Route Matching Logic for API Requests'>
+Resolved an issue where requests could be routed incorrectly due to inverted prioritisation of dynamically declared paths over those with similar static paths. Now, statically declared paths take priority in the path matching algorithm, so if API1 has listen path `/path/{param}/endpoint` and API2 has listen path `/path/specific/endpoint` a request to `/path/specific/endpoint/resource` will be correctly routed to API2.
+</Accordion>
+
+<Accordion title='Resolved Issue With Default Enforced Request Timeout'>
+Fixed an issue where an [enforced timeout](/planning-for-production/ensure-high-availability/enforced-timeouts) set for a specific API endpoint could be overruled by the configured [proxy_default_timeout](/tyk-oss-gateway/configuration#proxy_default_timeout). Now if an endpoint-level timeout is set then this will be honoured, regardless of any default timeout that is configured.
+</Accordion>
+
+<Accordion title='Fixed Issue With Tyk Self-Managed Gateways Claiming Licenses'>
+Resolved a race condition in self-managed deployments which occasionally lead to fewer Gateways registering with the Dashboard than the number that had been licensed. Now Tyk Self-Managed deployments will allow the licensed number of Gateways to register and serve traffic.
+</Accordion>
+
+<Accordion title='Fixed Gateway crash loop on restart without MDCB in Kubernetes'>
+Resolved a bug where Gateway pods in Kubernetes would enter a crash loop on restart if MDCB was down. The issue occurred due to the HTTP router failing to initialize properly during cold start. This fix ensures stable Gateway recovery even when MDCB is offline.
+</Accordion>
+
+<Accordion title='Multi-Value Response Headers in Coprocess Middleware'>
+Multi-value response headers were previously lost after synchronization with coprocess middleware, as only the first value was retained. This has been resolved, ensuring all response headers are properly synchronized and preserved
+</Accordion>
+</AccordionGroup>
+
+
+
+
+### 5.3.10 Release Notes
+
+#### Release Date 19 February 2025
+
+#### Release Highlights
+
+In this release, we upgraded the Golang version to `v1.23` for security enhancement and fixed an API authentication issue with redirects. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.10) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.10           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                        | Tested Versions       | Compatible Versions   | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      |  1.23 (GW)            |  1.23 (GW)            | [Go plugins](/api-management/plugins/golang) must be built using Go 1.23 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x            | 6.2.x, 7.x            | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x                | v3.0.x                | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release 
+
+#### Upgrade Instructions
+
+If you are upgrading to 5.3.10, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.10)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.10
+    ```
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+- [Source code tarball of Tyk Gateway 5.3.10](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.10)
+
+#### Changelog
+<a id="Changelog-v5.3.10" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Resolved gateway not entering "emergency" mode'>
+Fixed an issue where the gateway stopped processing traffic when restarted while MDCB was unavailable. Instead of entering "emergency" mode and loading APIs and policies from the Redis backup, the gateway remained unresponsive, continuously attempting to reconnect.
+With this fix, the gateway detects connection failure and enters `emergency` mode, ensuring traffic processing resumes even when MDCB is down.
+</Accordion>
+
+<Accordion title='Upgraded to Golang 1.23'>
+Tyk Gateway now runs on Golang 1.23, bringing security and performance improvements. Key changes include unbuffered Timer/Ticker channels, removal of 3DES cipher suites, and updates to X509KeyPair handling. Users may need to adjust their setup for compatibility.
+</Accordion>
+
+<Accordion title='Resolved API authentication issue while handling redirects using "tyk://" Scheme'>
+This fix ensures that when API A redirects to API B using the tyk:// scheme, API B will now correctly authenticate using its own credentials, improving access control and preventing access denials. Users can now rely on the expected authentication flow without workarounds, providing a smoother experience when integrating APIs.
+</Accordion>
+</AccordionGroup>
+
+
+
+### 5.3.9 Release Notes
+
+#### Release Date 31 December 2024
+
+#### Release Highlights
+
+This release contains bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.9) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### Compatibility Matrix For Tyk Components
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.9           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                        | Tested Versions       | Compatible Versions   | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      |  1.22 (GW)            |  1.22 (GW)            | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x            | 6.2.x, 7.x            | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x                | v3.0.x                | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release 
+
+#### Upgrade Instructions
+
+If you are upgrading to 5.3.9, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.9)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.9
+    ```
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.9](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.9)
+
+#### Changelog
+<a id="Changelog-v5.3.9" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Incomplete traffic logs generated if custom response plugin adjusts the payload length'>
+Resolved an issue where the response body could be only partially recorded in the traffic log if a custom response plugin modified the payload. This was due to Tyk using the original, rather than the modified, content-length of the response when identifying the data to include in the traffic log.
+</Accordion>
+
+<Accordion title='Fixed OAuth client creation issue for custom plugin APIs in multi-data plane deployments'>
+Fixed a bug that prevented the control plane Gateway from loading APIs that use custom plugin bundles. The control plane Gateway is used to register OAuth clients and generate access tokens so this could result in an API being loaded to the data plane Gateways but clients unable to obtain access tokens. This issue was introduced in v5.3.1 as a side-effect of a change to address a potential security issue where APIs could be loaded without their custom plugins.
+</Accordion>
+
+<Accordion title='Accurate debug logging restored for middleware'>
+Addressed an issue where shared loggers caused debug logs to misidentify the middleware source, complicating debugging. Log entries now correctly indicate which middleware generated the log, ensuring clearer and more reliable diagnostics
+</Accordion>
+
+<Accordion title='Fixed Payload Issue with Transfer-Encoding: chunked Header'>
+Resolved an issue where APIs using the Transfer-Encoding: chunked header alongside URL Rewrite or Validate Request middleware would lose the response payload body. The payload now processes correctly, ensuring seamless functionality regardless of header configuration.
+</Accordion>
+
+<Accordion title='API Keys remain active after all linked partitioned policies are deleted'>
+Resolved an issue where API access keys remained valid even if all associated policies were deleted. The Gateway now attempts to apply all linked policies to the key when it is presented with a request. Warning logs are generated if any policies cannot be applied (for example, if they are missing). If no linked policy can be applied, the Gateway will reject the key to ensure no unauthorized access.
+</Accordion>
+
+<Accordion title='Resolved API routing issue with trailing slashes and overlapping listen paths'>
+Fixed a routing issue that caused incorrect API matching when dealing with APIs that lacked a trailing slash, used custom domains, or had similar listen path patterns. Previously, the router prioritized APIs with longer subdomains and shorter listen paths, leading to incorrect matches when listen paths shared prefixes. This fix ensures accurate API matching, even when subdomains and listen paths overlap.
+</Accordion>
+
+<Accordion title='Improved Stability for APIs with Malformed Listen Paths'>
+Fixed an issue where a malformed listen path could cause the Gateway to crash. Now, such listen paths are properly validated, and if validation fails, an error is logged, and the API is skipped—preventing Gateway instability.
+</Accordion>
+
+<Accordion title='Resolved Variable Input Handling for Custom Scalars in GraphQL Queries'>
+Fixed an issue where GraphQL queries using variables for custom scalar types, such as UUID, failed due to incorrect input handling. Previously, the query would return an error when a variable was used but worked when the value was directly embedded in the query. This update ensures that variables for custom scalar types are correctly inferred and processed, enabling seamless query execution.
+</Accordion>
+
+<Accordion title='Fixed Gateway panic and SSE streaming issue with OpenTelemetry'>
+Resolved a bug that prevented upstream server-sent events (SSE) from being sent when OpenTelemetry was enabled, and fixed a gateway panic that occurred when detailed recording was active while SSE was in use. This ensures stable SSE streaming in configurations with OpenTelemetry.
+</Accordion>
+
+<Accordion title='Fixed an issue where OAuth 2.0 access tokens would not be issued if the data plane was disconnected from the control plane'>
+OAuth 2.0 access tokens can now be issued even when data plane gateways are disconnected from the control plane. This is achieved by saving OAuth clients locally within the data plane when they are pulled from RPC.
+</Accordion>
+
+<Accordion title='Tyk Now Supports RSA-PSS Signed JWTs'>
+Tyk now supports RSA-PSS signed JWTs (PS256, PS384, PS512), enhancing security while maintaining backward compatibility with RS256. No configuration changes are needed—just use RSA public keys, and Tyk will validate both algorithms seamlessly.
+</Accordion>
+
+<Accordion title='Request size limit middleware would block any request without a payload (for example GET, DELETE)'>
+Resolved a problem in the request size limit middleware that caused GET and DELETE requests to fail validation.The middleware incorrectly expected a request body (payload) for these methods and blocked them when none was present.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.3.8 Release Notes
+
+#### Release Date 07 November 2024
+
+#### Release Highlights
+
+This release focuses mainly on bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.8) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.8           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions       | Compatible Versions   | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      |  1.22 (GW)            |  1.22 (GW)            | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x            | 6.2.x, 7.x            | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x                | v3.0.x                | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+This is an advanced notice that the dedicated External OAuth, OpenID Connect (OIDC) authentication options, and SQLite support will be deprecated starting in version 5.7.0. We recommend that users of the [External OAuth](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated) and [OpenID Connect](/api-management/client-authentication#integrate-with-openid-connect-deprecated) methods migrate to Tyk's dedicated [JWT Auth](/basic-config-and-security/security/authentication-authorization/json-web-tokens) method. Please review your API configurations, as the Gateway logs will provide notifications for any APIs utilizing these methods.
+
+
+#### Upgrade Instructions
+
+If you are upgrading to 5.3.8, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.8)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.8
+    ```
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.8](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.8)
+
+#### Changelog
+<a id="Changelog-v5.3.8" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+
+
+<Expandable title='Deprecation notice of External OAuth and OpenID Connect options'>
+A deprecation notice for External OAuth and OpenID Connect (OIDC) authentication mechanisms has been implemented in the Gateway logs starting from version 5.3.8. This provides advanced notification to users regarding any APIs configured with these authentication methods in preparation for future upgrades where these middleware options may be removed in version 5.7.0.
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Memory consumption reduced in Gateway for large payloads'>
+This update fixes a bug that caused increased memory usage when proxying large response payloads that was introduced in version 5.3.1, restoring memory requirements to the levels seen in version 5.0.6. Users experiencing out-of-memory errors with 1GB+ file downloads will notice improved performance and reduced latency.
+</Accordion>
+
+<Accordion title='Path-based permissions in combined policies not preserved'>
+We resolved an issue that caused path-based permissions in policies to be lost when policies were combined, potentially omitting URL values and restricting access based on the merge order. It ensures that all applicable policies merge their allowed URL access rights, regardless of the order in which they are applied.
+</Accordion>
+
+<Accordion title='Enhanced flexibility in Tyk OAS schema validation'>
+A backwards compatibility issue in the way that the Gateway handles Tyk OAS API definitions has been addressed by reducing the strictness of validation against the expected schema. Since Tyk version 5.3, the Gateway has enforced strict validation, potentially causing problems for users downgrading from newer versions. With this change, Tyk customers can move between versions seamlessly, ensuring their APIs remain functional and avoiding system performance issues.
+</Accordion>
+
+<Accordion title='Fix for API key loss on worker Gateways due to keyspace sync interruption'>
+This update resolves an issue where API keys could be lost if the [keyspace synchronization](/api-management/mdcb#mdcb-synchroniser) between control and data planes was interrupted. The solution now enforces a resynchronization whenever a connection is re-established between MDCB and the data plane, ensuring key data integrity and seamless API access.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.3.7 Release Notes
+
+#### Release Date 22 October 2024
+
+#### Release Highlights
+
+This patch release for Tyk Gateway addresses critical stability issues for users running Tyk Gateway within the data
+plane, connecting to the control plane or Tyk Hybrid. Affected users should upgrade immediately to version 5.3.7 to
+avoid service interruptions and ensure reliable operations with the control plane or Tyk Hybrid.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.7) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+
+When upgrading to 5.3.7 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.7           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions | Compatible Versions | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------- | :------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      | 1.22            | 1.22                | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x      | 6.2.x, 7.x          | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x          | v3.0.x              | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.7)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.7
+    ```
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.7](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.7)
+
+#### Changelog
+<a id="Changelog-v5.3.7" data-scroll-offset></a>
+
+##### Fixed
+
+ {/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+ - What problem the issue caused
+ - How was the issue fixed
+ - Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+ - For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+ Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+ 
+ 
+ <Expandable title='Resolved gateway panic on reconnecting to MDCB control plane or Tyk Cloud'>
+In version 5.3.6, Tyk Gateway could encounter a panic when attempting to reconnect to the control plane after it was restarted. This patch version has resolved this issue, ensuring stable connectivity between the gateway and control plane following reconnections and reducing the need for manual intervention.
+</Expandable>
+ 
+ 
+
+{/* ##### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+---
+
+### 5.3.6 Release Notes
+
+#### Release Date 04 October 2024
+
+
+<Note>
+**Important Update**<br /> <br /> <b>Date</b>: 12 October 2024<br /> <b>Topic</b>: Gateway panic when
+reconnecting to MDCB control plane or Tyk Cloud<br /> <b>Workaround</b>: Restart Gateway<br /> <b>Affected Product</b>: Tyk
+Gateway as an Edge Gateway<br /> <b>Affected versions</b>: v5.6.0, v5.3.6, and v5.0.14<br /> <b>Issue Description:</b><br />
+
+<p>We have identified an issue affecting Tyk Gateway deployed as a data plane connecting to the Multi-Data Center Bridge (MDCB) control plane or Tyk Cloud. In the above mentioned Gateway versions a panic may occur when gateway reconnect to the control plane after the control plane is restarted.</p>
+
+<p>Our engineering team is actively working on a fix, and a patch (versions 5.6.1, 5.3.7, and 5.0.15) will be released soon.<br /></p>
+
+<b>Recommendations:</b><br />
+
+<b>For users on versions 5.5.0, 5.3.5, and 5.0.13</b><br />
+We advise you to delay upgrading to the affected versions (5.6.0, 5.3.6, or 5.0.14) until the patch is available.
+
+<b>For users who have already upgraded to 5.6.0, 5.3.6, or 5.0.14 and are experiencing a panic in the gateway:</b><br />
+Restarting the gateway process will restore it to a healthy state. If you are operating in a *Kubernetes* environment, Tyk Gateway instance should automatically restart, which ultimately resolves the issue.<br />
+
+
+<p>We appreciate your understanding and patience as we work to resolve this. Please stay tuned for the upcoming patch release, which will address this issue.</p>
+</Note>
+
+
+
+#### Release Highlights
+
+This release primarily focuses on bug fixes. For a comprehensive list of changes, please refer to the detailed
+[changelog](#Changelog-v5.3.6) below.
+
+#### Breaking Changes
+
+Docker images are now based on [distroless](https://github.com/GoogleContainerTools/distroless). No shell is shipped in
+the image.
+
+If moving from an version of Tyk older than 5.3.0 please read the explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+
+When upgrading to 5.3.6 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.6           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions | Compatible Versions | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------- | :------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      | 1.22            | 1.22                | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.22 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x      | 6.2.x, 7.x          | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x          | v3.0.x              | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.6)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.6
+    ```
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.6](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.6)
+
+#### Changelog
+<a id="Changelog-v5.3.6" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Changed
+
+{/* This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Upgrade to Go 1.22 for Tyk Gateway'>
+The Tyk Gateway has been upgraded from Golang 1.21 to Golang 1.22, bringing enhanced performance, strengthened security,
+and access to the latest features available in the new Golang release.
+</Expandable>
+
+
+
+<Expandable title='Introducing Distroless Containers for Tyk Gateway (2024 LTS)'>
+In this release, we've enhanced the security of the Tyk Gateway image by changing the build process to support
+[distroless](https://github.com/GoogleContainerTools/distroless) containers. This significant update addresses critical
+CVEs associated with Debian, ensuring a more secure and minimal runtime environment. Distroless containers reduce the
+attack surface by eliminating unnecessary packages, which bolsters the security of your deployments.
+</Expandable>
+
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Custom Response Plugins not working for Tyk OAS APIs'>
+We have resolved an issue where custom [response plugins](/api-management/plugins/plugin-types#response-plugins) were not being
+triggered for Tyk OAS APIs. This fix ensures that all custom plugins are invoked as expected when using Tyk OAS APIs.
+</Accordion>
+
+<Accordion title="Data plane gateways sometimes didn't synchronise policies and APIs on start-up">
+We have enhanced the initial synchronization of Data Plane gateways with the Control Plane to ensure more reliable
+loading of policies and APIs on start-up. A synchronous initialization process has been implemented to avoid sync
+failures and reduce the risk of service disruptions caused by failed loads. This update ensures smoother and more
+consistent syncing of policies and APIs in distributed deployments.
+</Accordion>
+
+<Accordion title="Quota wasn't respected under extreme load">
+We have fixed an issue where the quota limit was not being consistently respected during request spikes, especially in
+deployments with multiple gateways. The problem occurred when multiple gateways cached the current and remaining quota
+counters at the end of quota periods. To address this, a distributed lock mechanism has been implemented, ensuring
+coordinated quota resets and preventing discrepancies across gateways.
+</Accordion>
+
+<Accordion title='Restored Key Creation Speed in Gateway 4.0.13 and Later'>
+We have addressed a performance regression identified in Tyk Gateway versions 4.0.13 and later, where key creation for
+policies with a large number of APIs (100+) became significantly slower. The operation, which previously took around 1.5
+seconds in versions 4.0.0 to 4.0.12, was taking over 20 seconds in versions 4.0.13 and beyond. This issue has been
+resolved by optimizing Redis operations during key creation, restoring the process to its expected speed of
+approximately 1.5 seconds, even with a large number of APIs in the policy.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Security Fixes
+
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Gateway, providing increased protection against security
+vulnerabilities:
+
+- [CVE-2024-6104](https://nvd.nist.gov/vuln/detail/CVE-2024-6104)
+</Expandable>
+
+
+
+---
+
+### 5.3.5 Release Notes
+
+#### Release Date 26 September 2024
+
+#### Release Highlights
+
+This release fixes some issues related to the way that Tyk performs URL path matching, introducing two new Gateway
+configuration options to control path matching strictness. For a comprehensive list of changes, please refer to the
+detailed [changelog](#Changelog-v5.3.5) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release, however if moving from an version of Tyk older than 5.3.0 please read the
+explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+
+When upgrading to 5.3.5 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.5           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v2.0.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions       | Compatible Versions   | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      | 1.19 (GQL), 1.21 (GW) | 1.19 (GQL), 1.21 (GW) | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x            | 6.2.x, 7.x            | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x                | v3.0.x                | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.5)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.5
+    ```
+- Helm charts
+  - [tyk-charts v2.0.0](/developer-support/release-notes/helm-chart#2-0-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.5](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.5)
+
+#### Changelog
+<a id="Changelog-v5.3.5" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+
+
+
+<Expandable title='Implemented Gateway configuration options to set URL path matching strictness'>
+We have introduced two new options in the `http_server_options` [Gateway
+configuration](/tyk-oss-gateway/configuration#http_server_options) that will enforce prefix and/or suffix matching
+when Tyk performs checks on whether middleware or other logic should be applied to a request:
+
+- `enable_path_prefix_matching` ensures that the start of the request path must match the path defined in the API
+  definition
+- `enable_path_suffix_matching` ensures that the end of the request path must match the path defined in the API
+  definition
+- combining `enable_path_prefix_matching` and `enable_path_suffix_matching` will ensure an exact (explicit) match is
+  performed
+
+These configuration options provide control to avoid unintended matching of paths from Tyk's default _wildcard_ match.
+Use of regex special characters when declaring the endpoint path in the API definition will automatically override these
+settings for that endpoint. Tyk recommends that exact matching is employed, but both options default to `false` to avoid
+introducing a breaking change for existing users.
+
+The example Gateway configuration file `tyk.conf.example` has been updated to set the recommended exact matching with:
+
+- `http_server_options.enable_path_prefix_matching = true`
+- `http_server_options.enable_path_suffix_matching = true`
+- `http_server_options.enable_strict_routes = true`
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Incorrectly configured regex in Policy affected Granular Endpoint Access authorization'>
+Fixed an issue when using [granular endpoint](/api-management/access-control/sessions-and-keys/access-rights#granular-endpoint-access) in access Policies and keys that led to authorization incorrectly being granted to endpoints if an invalid regular expression was configured in the key/Policy. Also fixed an issue where path-based parameters were not correctly handled by Path-Based Permissions. Now Tyk's authorization check correctly handles both of these scenarios granting access only to the expected resources.
+</Expandable>
+
+
+<Expandable title='Missing path parameter could direct to the wrong endpoint'>
+Fixed an issue where a parameterized endpoint URL (e.g. `/user/{id}`) would be invoked if a request is made that omits
+the parameter. For example, a request to `/user/` will now be interpreted as a request to `/user` and not to
+`/user/{id}`.
+</Expandable>
+
+
+
+---
+
+### 5.3.4 Release Notes
+
+#### Release Date August 26th 2024
+
+#### Release Highlights
+
+Gateway 5.3.4 was version bumped only, to align with Dashboard 5.3.4. Subsequently, no changes were encountered in
+release 5.3.4. For further information please see the release notes for Dashboard
+[v5.3.4](/developer-support/release-notes/dashboard#5-3-0-release-notes)
+
+#### Breaking Changes
+
+**Attention**: Please read this section carefully.
+
+There are no breaking changes in this release, however if moving from an version of Tyk older than 5.3.0 please read the
+explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+
+When upgrading to 5.3.4 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.4           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.4.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions       | Compatible Versions   | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      | 1.19 (GQL), 1.21 (GW) | 1.19 (GQL), 1.21 (GW) | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x            | 6.2.x, 7.x            | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x                | v3.0.x                | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.4)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.4
+    ```
+- Helm charts
+  - [tyk-charts v1.4](/developer-support/release-notes/helm-chart#1-4-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.4](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.4)
+
+#### Changelog
+<a id="Changelog-v5.3.4" data-scroll-offset></a>
+
+Since this release was version bumped only to align with Dashboard v5.3.4, no changes were encountered in this release.
+
+---
+
+### 5.3.3 Release Notes
+
+#### Release Date August 2nd 2024
+
+#### Breaking Changes
+
+**Attention**: Please read this section carefully.
+
+There are no breaking changes in this release, however if moving from an version of Tyk older than 5.3.0 please read the
+explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+
+When upgrading to 5.3.3 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+#### Release Highlights
+
+##### Bug Fixes
+
+This release primarily focuses on bug fixes. For a comprehensive list of changes, please refer to the detailed
+[changelog](#Changelog-v5.3.3) below.
+
+##### FIPS Compliance
+
+Tyk Gateway now offers [FIPS 140-2](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf) compliance. For further
+details please consult [Tyk API Management
+FIPS support](/developer-support/release-types/fips-release).
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.3           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.4.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions       | Compatible Versions   | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      | 1.19 (GQL), 1.21 (GW) | 1.19 (GQL), 1.21 (GW) | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x            | 6.2.x, 7.x            | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x                | v3.0.x                | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.3)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.3
+    ```
+- Helm charts
+  - [tyk-charts v1.4](/developer-support/release-notes/helm-chart#1-4-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.3](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.3)
+
+#### Changelog
+<a id="Changelog-v5.3.3" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Added FIPS compliance'>
+Added [FIPS compliance](/developer-support/release-types/fips-release) for Tyk Gateway.
+</Expandable>
+
+
+
+<Expandable title='Corrected ordering of Tyk OAS API paths to prevent middleware misapplication'>
+Fixed an issue where nested API endpoints, such as '/test' and '/test/abc', might incorrectly apply middleware from the
+parent path to the nested path. The fix ensures that API endpoint definitions are correctly ordered, preventing this
+middleware misapplication and ensuring both the HTTP method and URL match accurately.
+</Expandable>
+
+
+
+---
+
+##### Fixed
+
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+ <AccordionGroup>
+<Accordion title='Optimised key creation to reduce redundant Redis commands'>
+Addressed an issue where creating or resetting a key caused an exponential number of Redis DeleteRawKey commands.
+Previously, the key creation sequence repeated for every API in the access list, leading to excessive deletion events,
+especially problematic for access lists with over 100 entries. Now, the key creation sequence executes only once, and
+redundant deletion of non-existent keys in Redis has been eliminated, significantly improving performance and stability
+for larger access lists.
+</Accordion>
+
+<Accordion title='Resolved SSE streaming issue'>
+Fixed a bug that caused Server Side Event (SSE) streaming responses to be considered for caching, which required
+buffering the response and prevented SSE from being correctly proxied.
+</Accordion>
+
+<Accordion title='Fixed Analytics Latency Reporting for MDCB Setups'>
+Resolved an issue where Host and Latency fields (Total and Upstream) were not correctly reported for edge gateways in
+MDCB setups. The fix ensures accurate Host values and Latency measurements are now captured and displayed in analytics
+data.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.3.2 Release Notes
+
+#### Release Date 5th June 2024
+
+#### Breaking Changes
+
+**Attention**: Please read this section carefully.
+
+There are no breaking changes in this release, however if moving from an version of Tyk older than 5.3.0 please read the
+explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+
+When upgrading to 5.3.2 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+#### Release Highlights
+
+This release primarily focuses on bug fixes. For a comprehensive list of changes, please refer to the detailed
+[changelog](#Changelog-v5.3.2) below.
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.2           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.4.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions       | Compatible Versions   | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      | 1.19 (GQL), 1.21 (GW) | 1.19 (GQL), 1.21 (GW) | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x            | 6.2.x, 7.x            | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x                | v3.0.x                | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.2)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.2
+    ```
+- Helm charts
+  - [tyk-charts v1.4](/developer-support/release-notes/helm-chart#1-4-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.2](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.2)
+
+#### Changelog
+<a id="Changelog-v5.3.2" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Fixed
+
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+ <AccordionGroup>
+<Accordion title='Remove sensitive information leaked from OpenTelemetry traces'>
+In Gateway version 5.2+ and 5.3+, we discovered a bug within the OpenTelemetry tracing feature that inadvertently
+transmits sensitive information. Specifically, `tyk.api.apikey` and `tyk.api.oauthid` attributes were exposing API keys.
+We have fixed the issue to ensure that only the hashed version of the API key is transmitted in traces.
+</Accordion>
+
+<Accordion title='APIs with common listen paths but different custom domains'>
+Addressed an issue where an API with a custom domain might not be invoked if another API with the same listen path but
+no custom domain was also deployed on the Gateway. Now APIs with custom domain names are loaded first, so requests will
+be checked against these first before falling back to APIs without custom domains.
+</Accordion>
+
+<Accordion title='Gateway service discovery issue with consul'>
+Addressed an issue in service discovery where an IP:port returned by Consul wasn't parsed correctly on the Gateway side,
+leading to errors when proxying requests to the service. The issue primarily occurred with IP:port responses, while
+valid domain names were unaffected.
+</Accordion>
+
+<Accordion title='Resolved Universal Data Graph Nested Field Mapping Issue'>
+Fixed an issue with nested field mapping in UDG when used with GraphQL (GQL) operations for a field's data source.
+Previously, querying only the mentioned field resulted in an error, but querying alongside another 'normal' field from
+the same level worked without issue.
+</Accordion>
+
+<Accordion title='Added control over access to context variables from middleware when using Tyk OAS APIs'>
+Addressed a potential issue when working with Tyk OAS APIs where request context variables are automatically made
+available to relevant Tyk and custom middleware. We have introduced a control in the Tyk OAS API definition to disable
+this access if required.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.3.1 Release Notes
+
+#### Release Date 24 April 2024
+
+#### Breaking Changes
+
+**Attention**: Please read this section carefully.
+
+There are no breaking changes in this release, however if moving from an version of Tyk older than 5.3.0 please read the
+explanation provided with [5.3.0 release](#TykOAS-v5.3.0).
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+
+When upgrading to 5.3.1 please follow the [detailed upgrade instructions](#upgrading-tyk).
+
+#### Release Highlights
+
+This release primarily focuses on bug fixes. For a comprehensive list of changes, please refer to the detailed
+[changelog](#Changelog-v5.3.1) below.
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.1           | MDCB v2.5.1                                                        | MDCB v2.5.1             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.3.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions       | Compatible Versions   | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      | 1.19 (GQL), 1.21 (GW) | 1.19 (GQL), 1.21 (GW) | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x            | 6.2.x, 7.x            | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x                | v3.0.x                | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.1)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.1
+    ```
+- Helm charts
+  - [tyk-charts v1.3](/developer-support/release-notes/helm-chart#1-3-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.1](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.1)
+
+#### Changelog
+<a id="Changelog-v5.3.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title="Improved security: don't load APIs into Gateway if custom plugin bundle fails to load">
+Issues were addressed where Tyk failed to properly reject custom plugin bundles with signature verification failures,
+allowing APIs to load without necessary plugins, potentially exposing upstream services. With the fix, if the plugin
+bundle fails to load (for example, due to failed signature verification) the API will not be loaded and an error will be
+logged in the Gateway.
+</Accordion>
+
+<Accordion title='Stability: fixed a Gateway panic that could occur when using custom JavaScript plugins with the Ignore Authentication middleware'>
+Fixed a panic scenario that occurred when a custom JavaScript plugin that requests access to the session metadata
+(`require_session:true`) is assigned to the same endpoint as the Ignore Authentication middleware. While the custom
+plugin expects access to a valid session, the configuration flag doesn't guarantee its presence, only that it's passed
+if available. As such, the custom plugin should be coded to verify that the session metadata is present before
+attempting to use it.
+</Accordion>
+
+<Accordion title='Stability: Gateway could crash when custom Python plugins attempted to access storage'>
+Fixed a bug where the Gateway could crash when using custom Python plugins that access the Redis storage. The Tyk Python
+API methods `store_data` and `get_data` could fail due to connection issues with the Redis. With this fix, the Redis
+connection will be created if required, avoiding the crash.
+</Accordion>
+
+<Accordion title='Stability: Gateway panics when arguments are missing in persist GraphQL endpoints'>
+In some instances users were noticing gateway panics when using the **Persist GQL** middleware without arguments
+defined. This issue has been fixed and the gateway will not throw panics in these cases anymore.
+</Accordion>
+
+<Accordion title='Headers for GraphQL headers were not properly forwarded upstream for GQL/UDG subscriptions'>
+Fixed an issue with GraphQL APIs, where [headers](/api-management/graphql#graphql-apis-headers) were not properly forwarded upstream for [GQL/UDG subscriptions](/api-management/graphql#graphql-subscriptions).
+</Accordion>
+
+<Accordion title='Missing GraphQL OTel attributes in spans when requests fail validation'>
+In cases where `detailed_tracing` was set to `false` and the client was sending a malformed request to a GraphQL API,
+the traces were missing GraphQL attributes (operation name, type and document). This has been corrected and debugging
+GraphQL with OTel will be easier for users.
+</Accordion>
+
+<Accordion title='Incorrect naming for semantic conventions attributes in GQL spans'>
+GQL Open Telemetry semantic conventions attribute names were missing `graphql` prefix and therefore were not in line
+with the community standard. This has been fixed and all attributes have the correct prefix.
+</Accordion>
+
+<Accordion title='URL Rewrite middleware did not always correctly observe quotas for requests using keys created from policies'>
+Fixed two bugs in the handling of usage quotas by the URL rewrite middleware when it was configured to rewrite to itself
+(e.g. to `tyk://self`). Quota limits were not observed and the quota related response headers always contained `0`.
+</Accordion>
+
+<Accordion title='Tyk Dashboard License Statistics page could display incorrect number of data plane gateways'>
+Resolved an issue in distributed deployments where the MDCB data plane gateway counter was inaccurately incremented when
+a Gateway was stopped and restarted.
+</Accordion>
+
+<Accordion title='Unable to clear the API cache in distributed data plane Gateways from the control plane Dashboard'>
+Addressed a bug where clearing the API cache from the Tyk Dashboard failed to invalidate the cache in distributed data
+plane gateways. This fix requires MDCB 2.5.1.
+</Accordion>
+
+<Accordion title='Unable to load custom Go plugins compiled in RHEL 8'>
+Fixed a bug where custom Go plugins compiled in RHEL8 environments were unable to load into Tyk Gateway due to a
+discrepancy in base images between the Gateway and Plugin Compiler environments. This fix aligns the plugin compiler
+base image with the gateway build environment, enabling seamless plugin functionality on RHEL8 environments.
+</Accordion>
+
+<Accordion title='Removed unused packages from plugin compiler image'>
+Removed several unused packages from the plugin compiler image. The packages include: docker, buildkit, ruc, sqlite, curl, wget, and other build tooling. The removal was done in order to address invalid CVE reporting, none of the removed dependencies are used to provide plugin compiler functionality.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.3.0 Release Notes
+
+#### Release Date 5 April 2024
+
+#### Breaking Changes
+
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+
+**Attention: Please read this section carefully**
+
+##### Tyk OAS APIs Compatibility Caveats - Tyk OSS
+<a id="TykOAS-v5.3.0"></a>
+
+This upgrade transitions Tyk OAS APIs out of [Early Access](/developer-support/release-types/early-access-feature).
+
+For licensed deployments (Tyk Cloud, Self Managed including MDCB), please refer to the [release notes of Tyk Dashboard 5.3.0](/developer-support/release-notes/dashboard#5-3-0-release-notes).
+
+- **Out of Early Access**
+  - This means that from now on, all Tyk OAS APIs will be backwards compatible and in case of a downgrade from v5.3.X to
+    v5.3.0, the Tyk OAS API definitions will always work.
+- **Not Backwards Compatible**
+  - Tyk OAS APIs in Tyk Gateway v5.3.0 are not [backwards compatible](https://tinyurl.com/3xy966xn). This means that the
+    new Tyk OAS API format created by Tyk Gateway v5.3.X does not work with older versions of Tyk Gateway, i.e. you
+    cannot export these API definitions from a v5.3.X Tyk Gateway and import them to an earlier version.
+  - The upgrade is **not reversible**, i.e. you cannot use version 5.3.X Tyk OAS API definitions with an older version
+    of Tyk Dashboard.
+  - This means that if you wish to downgrade or revert to your previous version of Tyk, you will need to restore these
+    API definitions from a backup. Please go to the [backup](#upgrade-instructions) section for detailed
+    instructions on backup before upgrading to v5.3.0.
+  - If you are not using Tyk OAS APIs, Tyk will maintain backward compatibility standards.
+- **Not Forward Compatible**
+  - Tyk OAS API Definitions prior to v5.3.0 are not [forward compatible](https://tinyurl.com/t3zz88ep) with Tyk Gateway
+    v5.3.X.
+  - This means that any Tyk OAS APIs created in any previous release (4.1.0-5.2.x) cannot work with the new Tyk Gateway
+    v5.3.X without being migrated to its latest format.
+- **After upgrade (the good news)**
+  - Tyk OAS API definitions that are part of the file system **are not automatically converted** to the new
+    format. Subsequently, users will have to manually update their
+    OAS API Definitions to the new format.
+  - If users upgrade to 5.3.0, create new Tyk OAS APIs and then decide to rollback then the upgrade is non-reversible.
+    Reverting to your previous version requires restoring from a backup.
+
+**Important:** Please go to the [backup](#upgrade-instructions) section for detailed instructions on
+backup before upgrading to v5.3.0
+
+##### Python plugin support
+
+Starting from Tyk Gateway version v5.3.0, Python is no longer bundled with the official Tyk Gateway Docker image to
+reduce exposure to security vulnerabilities in the Python libraries.
+
+Whilst the Gateway still supports Python plugins, you must [extend
+the image](/api-management/plugins/rich-plugins#install-the-python-development-packages)
+to add the language support.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention in the changelog section ALL changes in our application log messages. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates etc. */}
+{/* ##### Planned Breaking Changes */}
+
+#### Dependencies
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+##### Compatibility Matrix For Tyk Components
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. */}
+
+| Gateway Version | Recommended Releases                                               | Backwards Compatibility |
+| :--------------- | :------------------------------------------------------------------ | :----------------------- |
+| 5.3.0           | MDCB v2.5                                                          | MDCB v2.4.2             |
+|                 | Operator v0.17                                                     | Operator v0.16          |
+|                 | Sync v1.4.3                                                        | Sync v1.4.3             |
+|                 | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.3.0 | Helm all versions       |
+|                 | EDP v1.8.3                                                         | EDP all versions        |
+|                 | Pump v1.9.0                                                        | Pump all versions       |
+|                 | TIB (if using standalone) v1.5.1                                   | TIB all versions        |
+
+##### 3rd Party Dependencies & Tools
+
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                        | Tested Versions       | Compatible Versions   | Comments                                                                                   |
+| :------------------------------------------------------------- | :--------------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
+| [Go](https://go.dev/dl/)                                      | 1.19 (GQL), 1.21 (GW) | 1.19 (GQL), 1.21 (GW) | [Go plugins](/api-management/plugins/golang#) must be built using Go 1.21 |
+| [Redis](https://redis.io/download/)                           | 6.2.x, 7.x            | 6.2.x, 7.x            | Used by Tyk Gateway                                                                        |
+| [OpenAPI Specification](https://spec.openapis.org/oas/v3.0.3) | v3.0.x                | v3.0.x                | Supported by [Tyk OAS](/api-management/gateway-config-tyk-oas)           |
+
+Given the potential time difference between your upgrade and the release of this version, we recommend users verify the
+ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+
+In 5.3.0, we have simplified the configuration of response transform middleware. We encourage users to embrace the
+`global_headers` mechanism as the `response_processors.header_injector` is now an optional setting and will be removed
+in a future release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc.
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+
+#### Upgrade instructions
+
+If you are upgrading to 5.3.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+**The following steps are essential to follow before upgrading** Tyk Cloud (including Hybrid Gateways) and Self Managed
+users - Please refer to the [release notes of Tyk Dashboard 5.3.0](/developer-support/release-notes/dashboard#5-3-0-release-notes).
+
+For OSS deployments -
+
+1. Backup Your environment using the [usual guidance](/developer-support/upgrading) documented with every release (this includes
+   backup config file and database).
+2. Backup all your API definitions (Tyk OAS API and Classic Definitions) by saving your API and policy files or by
+   exporting them using the `GET /tyk/apis` and `Get /tyk/policies`
+3. Performing the upgrade - follow the instructions in the [upgrade
+   guide](/developer-support/upgrading) when upgrading Tyk.
+
+#### Release Highlights
+
+{/* Required. Use similar ToV to previous release notes. For example for a patch release:
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-vX.Y.0) below. */}
+
+We’re thrilled to announce the release of 5.3.0, an update packed with exciting features and significant fixes to
+elevate your experience with Tyk Gateway. For a comprehensive list of changes, please refer to the detailed
+[changelog](#Changelog-v5.3.0) below.
+
+##### Tyk OAS Feature Maturity
+
+Tyk OAS is now out of [Early
+Access](/developer-support/release-types/early-access-feature) as we have reached feature maturity.
+You are now able to make use of the majority of Tyk Gateway's features from your Tyk OAS APIs, so they are a credible alternative
+to the legacy Tyk Classic APIs.
+
+From Tyk 5.3.0 we support the following features when using Tyk OAS APIs with Tyk Gateway:
+
+- Security
+
+  - All Tyk-supported client-gateway authentication methods including custom auth plugins
+  - Automatic configuration of authentication from the OpenAPI description
+  - Gateway-upstream mTLS
+  - CORS
+
+- API-level (global) middleware including:
+
+  - Response caching
+  - Custom plugins for PreAuth, Auth, PostAuth, Post and Response hooks
+  - API-level rate limits
+  - Request transformation - headers
+  - Response transformation - headers
+  - Service discovery
+  - Internal API
+
+- Endpoint-level (per-path) middleware including:
+
+  - Request validation - headers and body (automatically configurable from the OpenAPI description)
+  - Request transformation - method, headers and body
+  - Response transformation - headers and body
+  - URL rewrite and internal endpoints
+  - Mock responses (automatically configurable from the OpenAPI description)
+  - Response caching
+  - Custom Go Post-Plugin
+  - Request size limit
+  - Virtual endpoint
+  - Allow and block listing
+  - Do-not-track
+  - Circuit breakers
+  - Enforced timeouts
+  - Ignore authentication
+
+- Observability
+
+  - Open Telemetry tracing
+  - Detailed log recording (include payload in the logs)
+  - Do-not-track endpoint
+
+- Governance
+  - API Versioning
+
+##### Enhanced KV storage of API Definition Fields
+
+Tyk is able to store configuration data from the API definition in KV systems, such as Vault and Consul, and then
+reference these values during configuration of the Tyk Gateway or APIs deployed on the Gateway. Previously this was
+limited to the Target URL and Listen Path but from 5.3.0 you are able to store any `string` type field from your API
+definition, unlocking the ability to store sensitive information in a centralised location. For full details check out
+the [documentation](/tyk-configuration-reference/kv-store) of this powerful feature.
+
+##### Redis v7.x Compatibility
+
+We have upgraded Redis driver [go-redis](https://github.com/redis/go-redis) to v9. Subsequently, Tyk 5.3 is compatible
+with Redis v7.x.
+
+##### Gateway and Component Upgrades
+
+We've raised the bar with significant upgrades to our Gateway and components. Leveraging the power and security of Go 1.21, upgrading [Sarama](https://github.com/Shopify/sarama), a widly used Kafka client in Go, to version 1.41.0 and enhancing the GQL engine with Go version 1.19, we ensure improved
+functionality and performance to support your evolving needs seamlessly.
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=&page_size=&ordering=&name=v5.3.0)
+  - ```bash
+    docker pull tykio/tyk-gateway:v5.3.0
+    ```
+- Helm charts
+  - [tyk-charts v1.3](/developer-support/release-notes/helm-chart#1-3-0-release-notes)
+- [Source code tarball of Tyk Gateway v5.3.0](https://github.com/TykTechnologies/tyk/releases/tag/v5.3.0)
+
+#### Changelog
+<a id="Changelog-v5.3.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Additional features now supported when working with Tyk OAS APIs'>
+The following features have been added in 5.3.0 to bring Tyk OAS to feature maturity:
+
+- Detailed log recording (include payload in the logs)
+- Enable Open Telemetry tracing
+- Context variables available to middleware chain
+- API-level header transforms (request and response)
+- Endpoint-level cache
+- Circuit breakers
+- Track endpoint logs for inclusion in Dashboard aggregated data
+- Do-not-track endpoint
+- Enforced upstream timeouts
+- Configure endpoint as Internal, not available externally
+- URL rewrite
+- Per-endpoint request size limit
+- Request transformation - method, header
+- Response transformation - header
+- Custom domain certificates
+</Accordion>
+
+<Accordion title='Enhanced KV storage for API Definition fields'>
+We have implemented support for all `string` type fields in the Tyk OAS and Tyk Classic API Definitions to be stored in
+separate KV storage, including Hashicorp Consul and Vault.
+</Accordion>
+
+<Accordion title='Support for Redis v7.0.x'>
+Tyk 5.3 refactors Redis connection logic by using
+[storage v1.2.2](https://github.com/TykTechnologies/storage/releases/tag/v1.2.2), which integrates with
+[go-redis](https://github.com/redis/go-redis) v9. Subsequently, Tyk 5.3 supports Redis v7.0.x.
+</Accordion>
+
+<Accordion title='Clearer error messages from GQL engine for invalid variables (JSON Schema)'>
+Some of the error messages generated by the GQL engine were unclear for users, especially relating to variable
+validation. The errors have been changed and are now much more clearer and helpful in cases where engine processing
+fails.
+</Accordion>
+
+<Accordion title="Upgraded GQL Engine's Go version to 1.19">
+Upgraded Go version for GraphQL engine to [1.19](https://go.dev/doc/go1.19).
+</Accordion>
+
+<Accordion title='Enhanced semantic conventions for GraphQL spans in Gateway'>
+We've added OpenTelemetry semantic conventions for GraphQL spans. Spans will now incorporate `<operation.type>`,
+`<operation.name>` and `<document>` tags.
+</Accordion>
+
+<Accordion title='Added support for detailed_tracing to be configured via GQL API definitions'>
+GraphQL APIs can now use the `detailed_tracing` setting in an API definition. With that property set to `true` any call
+to a GraphQL API will create a span for each middleware involved in request processing. While it is set to `false`, only
+two spans encapsulating the entire request lifecycle will be generated. This setting helps to reduce the size of traces,
+which can get large for GraphQL APIs. Furthermore, this gives users an option to customize the level of tracing detail
+to suit their monitoring needs.
+</Accordion>
+
+<Accordion title='Enhanced OpenTelemetry trace generation for UDG with mixed data sources'>
+This release introduces an enhanced trace generation system for Universal Data Graph (UDG). It consolidates all spans
+from both Tyk-managed and external data source executions into a single trace when used together. Furthermore, when UDG
+solely utilizes Tyk-managed data sources, trace management is simplified and operational visibility is improved.
+</Accordion>
+
+<Accordion title='Disabled normalize and validate in GraphQL Engine'>
+For GraphQL requests normalization and validation has been disabled in the GraphQL engine. Both of those actions were
+performed in the Tyk Gateway and were unnecessary to be done again in the engine. This enhances performance slightly and
+makes detailed OTel traces concise and easier to read.
+</Accordion>
+
+<Accordion title='Enhanced OAS-to-UDG converter handling of arrays of objects in OpenAPI Documents'>
+The Tyk Dashboard API endpoint _/api/data-graphs/data-sources/import_ now handles OpenAPI schemas with arrays of
+objects. This addition means users can now import more complex OpenAPI documents and transform them into UDG
+configurations.
+</Accordion>
+
+<Accordion title='OAS-to-UDG converter support for allOf/anyOf/oneOf keywords'>
+The OAS-to-UDG converter now seamlessly handles OpenAPI descriptions that utilize the _allOf_, _anyOf_ and _oneOf_
+keywords, ensuring accurate and comprehensive conversion to a Tyk API definition. The feature expands the scope of
+OpenAPI documents that the converter can handle and allows our users to import REST API data sources defined in OAS in
+more complex cases.
+</Accordion>
+
+<Accordion title="Improved UDG's handling of unnamed object definitions in OpenAPI descriptions">
+The OAS-to-UDG converter can now create GraphQL types even if an object's definition doesn’t have an explicit name.
+</Accordion>
+
+<Accordion title='Refined handling of arrays of objects in endpoint responses by OAS-to-UDG Converter'>
+The OAS-to-UDG converter was unable to handle a document properly if an object within the OpenAPI description had no
+properties defined. This limitation resulted in unexpected behavior and errors during the conversion process. The tool
+will now handle such cases seamlessly, ensuring a smoother and more predictable conversion process.
+</Accordion>
+
+<Accordion title='OAS-to-UDG converter support for enumerated types in OpenAPI descriptions'>
+Previously OAS-to-UDG converter had limitations in handling enums from OpenAPI descriptions, leading to discrepancies
+and incomplete conversions. With the inclusion of enum support, the OAS converter now seamlessly processes enums defined
+in your OpenAPI descriptions, ensuring accurate and complete conversion to GraphQL schemas.
+</Accordion>
+
+<Accordion title='Expanded handling of HTTP Status Code ranges by OAS-to-GQL converter'>
+OAS-to-UDG converter can now handle HTTP status code ranges that are defined by the OpenAPI Specification. This means
+that code ranges defined as 1XX, 2XX, etc will be correctly converted by the tool.
+</Accordion>
+
+<Accordion title='Added support for custom rate limit keys'>
+We have added the capability for users to define a [custom rate limit
+key](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/configuring-custom-rate-limit-keys)
+within session metadata. This increases flexibility with rate limiting, as the rate limit can be assigned to different entities
+identifiable from the session metadata (such as a client app or organization) and is particularly useful for users of Tyk's
+Enterprise Developer Portal.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Changed
+
+{/* This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='Prefetch session expiry information from MDCB to reduce API call duration in case Gateway is temporarily disconnected from MDCB'>
+Previously, when operating in a worker configuration (in the data plane), the Tyk Gateway fetched session expiry
+information from the control plane the first time an API was accessed for a given organization. This approach led to a
+significant issue: if the MDCB connection was lost, the next attempt to consume the API would incur a long response
+time. This delay, typically around 30 seconds, was caused by the Gateway waiting for the session-fetching operation to
+time out, as it tried to communicate with the now-inaccessible control plane.
+
+<br />Now, the worker gateway fetches the session expiry information up front, while there is an active connection to
+MDCB. This ensures that this data is already available locally in the event of an MDCB disconnection.
+
+<br />This change significantly improves the API response time under MDCB disconnection scenarios by removing the need for
+the Gateway to wait for a timeout when attempting to fetch session information from the control plane, avoiding the
+previous 30-second delay. This optimization enhances the resilience and efficiency of Tyk Gateway in distributed
+environments.
+</Accordion>
+
+<Accordion title='Changes to the Tyk OAS API Definition'>
+We have made some changes to the Tyk OAS API Definition to provide a stable contract that will now be under
+breaking-change control for future patches and releases as Tyk OAS moves out of Early Access. Changes include the
+removal of the unnecessary `slug` field and simplification of the custom plugin contract.
+</Accordion>
+
+<Accordion title='Optimized Gateway memory usage and reduced network request payload with Redis Rate Limiter'>
+We have optimized the allocation behavior of our sliding window log rate limiter implementation ([Redis
+Rate Limiter](/api-management/rate-limit#redis-rate-limiter)). Previously the complete
+request log would be retrieved from Redis. With this enhancement only the count of the requests in the window is
+retrieved, optimizing the interaction with Redis and decreasing the Gateway memory usage.
+</Accordion>
+</AccordionGroup>
+
+
+ 
+##### Fixed
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been
+  introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to
+expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example
+below. */}
+
+
+
+<AccordionGroup>
+<Accordion title='Improved OAuth token management in Redis'>
+In this release, we fixed automated token trimming in Redis, ensuring efficient management of OAuth tokens by
+implementing a new hourly job within the Gateway and providing a manual trigger endpoint.
+</Accordion>
+
+<Accordion title='Tyk Gateway now validates RFC3339 Date-Time Formats'>
+We fixed a bug in the Tyk OAS Validate Request middleware where we were not correctly validating date-time format
+schema, which could lead to invalid date-time values reaching the upstream services.
+</Accordion>
+
+<Accordion title='Inaccurate Distributed Rate Limiting (DRL) behavior on Gateway startup'>
+Fixed an issue when using the Distributed Rate Limiter (DRL) where the Gateway did not apply any rate limit until a DRL
+notification was received. Now the rate of requests will be limited at 100% of the configured rate limit until the DRL
+notification is received, after which the limit will be reduced to an even share of the total (i.e. 100% divided by the
+number of Gateways) per the rate limit algorithm design.
+</Accordion>
+
+<Accordion title='Duplicate fields added by OAS-to-UDG converter'>
+Fixed an issue where the OAS-to-UDG converter was sometimes adding the same field to an object type many times. This
+caused issues with the resulting GQL schema and made it non-compliant with GQL specification.
+</Accordion>
+
+<Accordion title='Gateway issue processing queries with GQL Engine'>
+Fixed an issue where the Gateway attempted to execute a query with GQL engine version 1 (which lacks OTel support),
+while simultaneously trying to validate the same query with the OpenTelemetry (OTel) supported engine. It caused the API
+to fail with an error message "Error socket hang up". Right now with OTel enabled, the gateway will enforce GQL engine
+to default to version 2, so that this problem doesn't occur anymore.
+</Accordion>
+
+<Accordion title='Handling arrays of objects in endpoint responses by OAS-to-UDG converter'>
+The OAS-to-UDG converter now effectively handles array of objects within POST paths. Previously, there were instances
+where the converter failed to accurately interpret and represent these structures in the generated UDG configuration.
+</Accordion>
+
+<Accordion title='GQL Playground issues related to encoding of request response'>
+An issue was identified where the encoding from the GQL upstream cache was causing readability problems in the response body. Specifically, the upstream GQL cache was utilizing [brotli compression](https://www.ietf.org/rfc/rfc7932.txt) and not respecting the Accept-Encoding header. Consequently, larger response bodies became increasingly unreadable for the GQL engine due to compression, leading to usability issues for users accessing affected content. The issue has now been fixed by adding the brotli encoder to the GQL engine.
+</Accordion>
+
+<Accordion title='OAS-to-UDG converter issue with "JSON" return type'>
+OAS-to-UDG converter was unable to correctly process Tyk OAS API definitions where "JSON" was used as one of enum
+values. This issue is now fixed and whenever "JSON" is used as one of enums in the OpenAPI description, it will get
+correctly transformed into a custom scalar in GQL schema.
+</Accordion>
+
+<Accordion title='Gateway Panic during API Edit with Virtual Endpoint'>
+Fixed an issue where the Gateway could panic while updating a Tyk OAS API with the Virtual Endpoint middleware
+configured.
+</Accordion>
+
+<Accordion title='Gateway panics during API Reload with JavaScript middleware bundle'>
+Fixed an issue where reloading a bundle containing JS plugins could cause the Gateway to panic.
+</Accordion>
+
+<Accordion title='GraphQL introspection issue when Allow/Block List enabled'>
+Fixed an issue where the _Disable introspection_ setting was not working correctly in cases where field-based
+permissions were set (allow or block list). It was not possible to introspect the GQL schema while introspection was
+technically allowed but field-based permissions were enabled. Currently, Allow/Block list settings are ignored only for
+introspection queries and introspection is only controlled by the _Disable introspection_ setting.
+</Accordion>
+
+<Accordion title='Handling of objects without properties in OAS-to-UDG converter'>
+The OAS-to-UDG converter was unable to handle a document properly if an object within the OpenAPI description had no
+properties defined. This limitation resulted in unexpected behavior and errors during the conversion process. The tool
+will now handle such cases seamlessly, ensuring a smoother and more predictable conversion process
+</Accordion>
+
+<Accordion title='Fixed memory leak issue in Tyk Gateway v5.2.4'>
+Addressed a memory leak issue in Tyk Gateway linked to a logger mutex change introduced in v5.2.4. Reverting these
+changes has improved connection management and enhanced system performance.
+</Accordion>
+
+<Accordion title='Fixed unintended external access to internal endpoints'>
+Resolved an issue where in certain conditions external clients could access internal endpoints. This was caused by incorrect combination of middleware which could lead to internal endpoints proxying traffic from external sources. This has now been addressed, so that an endpoint with the internal middleware configured will not be reachable from external requests.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Security Fixes
+
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Gateway, providing increased protection against security
+vulnerabilities:
+
+- [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
+- [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
+</Expandable>
+
+
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 5.2 Release Notes
+
+### 5.2.5 Release Notes
+
+#### Release Date 19 Dec 2023
+
+#### Breaking Changes
+
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are using a 5.2.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade instructions.
+
+#### Release Highlights
+This release implements a bug fix.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.5) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.2.5/images/sha256-c09cb03dd491e18bb84a0d9d4e71177eb1396cd5debef694f1c86962dbee10c6?context=explore)
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.2.5)
+
+#### Changelog
+<a id="Changelog-v5.2.5" data-scroll-offset></a>
+
+##### Fixed
+
+ 
+ <Expandable title='Long custom keys not maintained in distributed Data Planes'>
+Fixed an issue where custom keys over 24 characters in length were deleted from Redis in the Data Plane when key update action signalled in distributed (MDCB) setups.
+</Expandable>
+ 
+ 
+
+---
+
+### 5.2.4 Release Notes
+
+#### Release Date 7 Dec 2023
+
+#### Breaking Changes
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are using a 5.2.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade instructions.
+
+#### Release Highlights
+This release enhances security, stability, and performance.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.4) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.2.4/images/sha256-c0d9e91e4397bd09c85adf4df6bc401b530ed90c8774714bdafc55db395c9aa5?context=explore)
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.2.4)
+
+#### Changelog
+<a id="Changelog-v5.2.4" data-scroll-offset></a>
+
+##### Fixed
+
+ 
+ <AccordionGroup>
+<Accordion title='Output from Tyk OAS request validation schema failure is too verbose'>
+Fixed an issue where the Validate Request middleware provided too much information when reporting a schema validation failure in a request to a Tyk OAS API.
+</Accordion>
+
+<Accordion title='Gateway incorrectly applying policy Path-Based Permissions in certain circumstances'>
+Fixed a bug where the gateway didn't correctly apply Path-Based Permissions from different policies when using the same `sub` claim but different scopes in each policy. Now the session will be correctly configured for the claims provided in the policy used for each API request.
+</Accordion>
+
+<Accordion title='Plugin compiler not correctly supporting build_id to differentiate between different builds of the same plugin'>
+Fixed a bug when using the build_id argument with the Tyk Plugin Compiler that prevents users from hot-reloading different versions of the same plugin compiled with different build_ids. The bug was introduced with the plugin module build change implemented in the upgrade to Go version 1.19 in Tyk 5.1.0.
+</Accordion>
+
+<Accordion title='URL Rewrite fails to handle escaped character in query parameter'>
+Fixed a bug that was introduced in the fix applied to the URL Rewrite middleware in Tyk 5.0.5/5.1.2. The previous fix did not correctly handle escaped characters in the query parameters. Now you can safely include escaped characters in your query parameters and Tyk will not modify them in the URL Rewrite middleware.
+</Accordion>
+</AccordionGroup>
+ 
+ 
+
+---
+
+### 5.2.3 Release Notes
+
+#### Release Date 21 Nov 2023
+
+#### Breaking Changes
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are using a 5.2.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade instructions.
+
+#### Release Highlights
+This release enhances security, stability, and performance.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.3) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.2.3/images/sha256-8a94658c8c52ddfe30f78c5438dd4308c4d019655d8af7773a33fdffda097992?context=explore)
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.2.3)
+
+#### Changelog
+<a id="Changelog-v5.2.3" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Python version not always correctly autodetected'>
+Fixed an issue where Tyk was not auto-detecting the installed Python version if it had multiple digits in the minor version (e.g. Python 3.11). The regular expression was updated to correctly identify Python versions 3.x and 3.xx, improving compatibility and functionality.
+</Accordion>
+
+<Accordion title='Gateway blocked trying to retrieve keys via MDCB when using JWT auth'>
+Improved the behavior when using JWTs and the MDCB (Multi Data Center Bridge) link is down; the Gateway will no longer be blocked attempting to fetch OAuth client info. We’ve also enhanced the error messages to specify which type of resource (API key, certificate, OAuth client) the data plane Gateway failed to retrieve due to a lost connection with the control plane.
+</Accordion>
+
+<Accordion title='Custom Authentication Plugin not working correctly with policies'>
+Fixed an issue where the session object generated when creating a Custom Key in a Go Plugin did not inherit parameters correctly from the Security Policy.
+</Accordion>
+
+<Accordion title='Attaching a public key to an API definition for mTLS brings down the Gateway'>
+Fixed an issue where uploading a public key instead of a certificate into the certificate store, and using that key for mTLS, caused all the Gateways that the APIs are published on to cease negotiating TLS. This fix improves the stability of the gateways and the successful negotiation of TLS.
+</Accordion>
+</AccordionGroup>
+ 
+ 
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Implemented a `tyk version` command that provides more details about the Tyk Gateway build'>
+This prints the release version, git commit, Go version used, architecture and other build details.
+</Accordion>
+
+<Accordion title='Added option to fallback to default API version'>
+Added new option for Tyk to use the default version of an API if the requested version does not exist. This is referred to as falling back to default and is enabled using a [configuration](/api-management/gateway-config-tyk-oas#versioning) flag in the API definition; for Tyk OAS APIs the flag is `fallbackToDefault`, for Tyk Classic APIs it is `fallback_to_default`.
+</Accordion>
+
+<Accordion title='Implemented a backoff limit for GraphQL subscription connection retry'>
+Added a backoff limit for GraphQL subscription connection retry to prevent excessive error messages when the upstream stops working. The connection retries and linked error messages now occur in progressively longer intervals, improving error handling and user experience.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Community Contributions
+
+Special thanks to the following member of the Tyk community for their contribution to this release:
+
+
+
+<Expandable title='Runtime log error incorrectly produced when using Go Plugin Virtual Endpoints'>
+Fixed a minor issue with Go Plugin virtual endpoints where a runtime log error was produced from a request, even if the response was successful. Thanks to [uddmorningsun](https://github.com/uddmorningsun) for highlighting the [issue](https://github.com/TykTechnologies/tyk/issues/4197) and proposing a fix.
+</Expandable>
+
+
+
+---
+
+### 5.2.2 Release Notes
+
+#### Release Date 31 Oct 2023
+
+#### Breaking Changes
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are using a 5.2.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade instructions.
+
+#### Release Highlights
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.2) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.2.2/images/sha256-84d9e083872c78d854d3b469734ce40b7e77b9963297fe7945e214a0e6ccc614?context=explore)
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.2.2)
+
+#### Changelog
+<a id="Changelog-v5.2.2" data-scroll-offset></a>
+
+##### Security
+
+The following CVEs have been resolved in this release:
+
+- [CVE-2022-40897](https://nvd.nist.gov/vuln/detail/CVE-2022-40897)
+- [CVE-2022-1941](https://nvd.nist.gov/vuln/detail/CVE-2022-1941)
+- [CVE-2021-23409](https://nvd.nist.gov/vuln/detail/CVE-2021-23409)
+- [CVE-2021-23351](https://nvd.nist.gov/vuln/detail/CVE-2021-23351)
+- [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)
+- [CVE-2018-5709](https://nvd.nist.gov/vuln/detail/CVE-2018-5709)
+- [CVE-2010-0928](https://nvd.nist.gov/vuln/detail/CVE-2010-0928)
+- [CVE-2007-6755](https://nvd.nist.gov/vuln/detail/CVE-2007-6755)
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Enforced timeouts were incorrect on a per-request basis'>
+Fixed an issue where [enforced timeouts](/planning-for-production/ensure-high-availability/enforced-timeouts) values were incorrect on a per-request basis. Since we enforced timeouts only at the transport level and created the transport only once within the value set by [max_conn_time](/tyk-oss-gateway/configuration#max_conn_time), the timeout in effect was not deterministic. Timeouts larger than 0 seconds are now enforced for each request.
+</Accordion>
+
+<Accordion title='Incorrect access privileges were granted in security policies'>
+Fixed an issue when using MongoDB and [Policies](/api-management/policies) where Tyk could incorrectly grant access to an API after that API had been deleted from the associated Policy. This was due to the Policy cleaning operation that is triggered when an API is deleted from a Policy in a MongoDB installation. With this fix, the Policy cleaning operation will not remove the final (deleted) API from the Policy; Tyk recognizes that the API record is invalid and denies granting access rights to the key.
+</Accordion>
+
+<Accordion title='Logstash formatter timestamp was not in RFC3339 Nano format'>
+The [Logstash](/api-management/logs#log-output) formatter timestamp is now in [RFC3339Nano](https://www.rfc-editor.org/rfc/rfc3339) format.
+</Accordion>
+
+<Accordion title='In high load scenarios the DRL Manager was not protected against concurrent read and write operations'>
+Fixed a potential race condition where the *DRL Manager* was not properly protected against concurrent read/write operations in some high-load scenarios.
+</Accordion>
+
+<Accordion title='Performance issue encountered when Tyk Gateway retrieves a key via MDCB for a JWT API'>
+Fixed a performance issue encountered when Tyk Gateway retrieves a key via MDCB for a JWT API. The token is now validated against [JWKS or the public key](/basic-config-and-security/security/authentication-authorization/json-web-tokens) in the API Definition.
+</Accordion>
+
+<Accordion title='JWT middleware introduced latency which reduced overall request/response throughput'>
+Fixed a performance issue where JWT middleware introduced latency which significantly reduced the overall request/response throughput.
+</Accordion>
+
+<Accordion title='UDG examples were not displayed when Open Policy Agent (OPA) was enabled'>
+Fixed an issue that prevented *UDG* examples from being displayed in the dashboard when the *Open Policy Agent(OPA)* is enabled.
+</Accordion>
+
+<Accordion title='Sensitive information logged when incorrect signature provided for APIs protected by HMAC authentication'>
+Fixed an issue where the Tyk Gateway logs would include sensitive information when the incorrect signature is provided in a request to an API protected by HMAC authentication.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Community Contributions
+
+Special thanks to the following members of the Tyk community for their contributions to this release:
+
+
+
+<Expandable title='ULID Normalization implemented'>
+- Implemented *ULID Normalization*, replacing valid ULID identifiers in the URL with a `{ulid}` placeholder for analytics. This matches the existing UUID normalization. Thanks to [Mohammad Abdolirad](https://github.com/atkrad) for the contribution.
+</Expandable>
+
+
+<Expandable title='Duplicate error message incorrectly reported when a custom Go plugin returned an error'>
+Fixed an issue where a duplicate error message was reported when a custom Go plugin returned an error. Thanks to [@PatrickTaibel](https://github.com/PatrickTaibel) for highlighting the issue and suggesting a fix.
+</Expandable>
+
+
+
+
+---
+
+### 5.2.1 Release Notes
+
+#### Release Date 10 Oct 2023
+
+#### Breaking Changes
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+If you are on a 5.2.0 we advise you to upgrade ASAP and if you are on an older version skip 5.2.0 and upgrade directly to this release. Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade instructions.
+
+#### Release Highlights
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.0) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.2.1/images/sha256-47cfffda64ba492f79e8cad013a476f198011f5a97cef32464f1f47e1a9be9a2?context=explore)
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.1.2)
+
+#### Changelog
+
+##### Changed
+
+
+
+<AccordionGroup>
+<Accordion title='Log messaging quality enhanced'>
+Enhance log message quality by eliminating unnecessary messages
+</Accordion>
+
+<Accordion title='Configurable retry for resource loading introduced'>
+Fixed a bug that occurs during Gateway reload where the Gateway would continue to load new API definitions even if policies failed to load. This led to a risk that an API could be invoked without the associated policies (for example, describing access control or rate limits) having been loaded. Now Tyk offers a configurable retry for resource loading, ensuring that a specified number of attempts will be made to load resources (APIs and policies). If a resource fails to load, an error will be logged and the Gateway reverts to its last working configuration.
+
+We have introduced two new variables to configure this behavior:
+- `resource_sync.retry_attempts` - defines the number of [retries](/tyk-oss-gateway/configuration#resource_sync-retry_attempts) that the Gateway should perform during a resource sync (APIs or policies), defaulting to zero which means no retries are attempted
+- `resource_sync.interval` - setting the [fixed interval](/tyk-oss-gateway/configuration#resource_sync-interval) between retry attempts (in seconds)
+</Accordion>
+
+<Accordion title='Added http.response.body.size and http.request.body.size for OpenTelemetry users'>
+For OpenTelemetry users, we've included much-needed attributes, `http.response.body.size` and `http.request.body.size`, in both Tyk HTTP spans and upstream HTTP spans. This addition enables users to gain better insight into incoming/outgoing request/response sizes within their traces.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Memory leak was encountered if OpenTelemetry enabled'>
+Fixed a memory leak issue in Gateway 5.2.0 if [OpenTelemetry](https://opentelemetry.io/) (abbreviated "OTel") is [enabled](/api-management/traces). It was caused by multiple `otelhttp` handlers being created. We have updated the code to use a single instance of `otelhttp` handler in 5.2.1 to improve performance under high traffic load.
+</Accordion>
+
+<Accordion title='Memory leak encountered when enabling the strict routes option'>
+Fixed a memory leak that occurred when enabling the [strict routes option](/tyk-oss-gateway/configuration#http_server_options-enable_strict_routes) to change the routing to avoid nearest-neighbor requests on overlapping routes (`TYK_GW_HTTPSERVEROPTIONS_ENABLESTRICTROUTES`)
+</Accordion>
+
+<Accordion title='High rates of Tyk Gateway reloads were encountered'>
+Fixed a potential performance issue related to high rates of *Tyk Gateway* reloads (when the Gateway is updated due to a change in APIs and/or policies). The gateway uses a timer that ensures there's at least one second between reloads, however in some scenarios this could lead to poor performance (for example overloading Redis). We have introduced a new [configuration option](/tyk-oss-gateway/configuration#reload_interval), `reload_interval` (`TYK_GW_RELOADINTERVAL`), that can be used to adjust the duration between reloads and hence optimize the performance of your Tyk deployment.
+</Accordion>
+
+<Accordion title='Idle upstream connections were incorrectly closed'>
+Fixed a bug where the Gateway did not correctly close idle upstream connections (sockets) when configured to generate a new connection after a configurable period of time (using the [max_conn_time](/tyk-oss-gateway/configuration#max_conn_time) configuration option). This could lead to the Gateway eventually running out of sockets under heavy load, impacting performance.
+</Accordion>
+
+<Accordion title='Extra chunked transfer encoding was unnecessarily added to rawResponse analytics'>
+Removed the extra chunked transfer encoding that was added unnecessarily to `rawResponse` analytics
+</Accordion>
+
+<Accordion title='Reponse body transformation not execute when Persist GraphQL middleware used'>
+Resolved a bug with HTTP GraphQL APIs where, when the [Persist GraphQL middleware](/api-management/graphql#persisting-graphql-queries) was used in combination with [Response Body Transform](/api-management/traffic-transformation/response-body), the response's body transformation was not being executed.
+<img src="/img/bugs/bug-persistent-gql.png" alt="Bug in persistent gql and response body transform" width="400" />
+</Accordion>
+
+<Accordion title='Unable to modify a key that provides access to an inactive or draft API'>
+Fixed a bug where, if you created a key which provided access to an inactive or draft API, you would be unable to subsequently modify that key (via the Tyk Dashboard UI, Tyk Dashboard API or Tyk Gateway API)
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Dependencies
+- Updated TykTechnologies/gorm to v1.21 in Tyk Gateway
+
+---
+
+### 5.2.0 Release Notes
+
+#### Release Date 29 Sep 2023
+
+#### Breaking Changes
+**Attention**: Please read carefully this section. We have two topics to report:
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backwards-compatible. Downgrading or reverting an upgrade may not be possible resulting in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Release Highlights
+
+We're thrilled to bring you some exciting enhancements and crucial fixes to improve your experience with Tyk Gateway. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.0) below.
+
+##### Added Body Transform Middleware to Tyk OAS API Definition
+
+With this release, we are adding the much requested *Body Transformations* to *Tyk OAS API Definition*. You can now [configure](/api-management/gateway-config-tyk-oas#transformbody) middleware for both [request](/api-management/traffic-transformation/request-body) and [response](/api-management/traffic-transformation/response-body) body transformations and - as a Tyk Dashboard user - you’ll be able to do so from within our simple and elegant API Designer tool.
+
+##### Reference Tyk OAS API Definition From Within Your Custom Go Plugins
+
+Reference the *Tyk OAS API definition* from within your custom *Go Plugins*, bringing them up to standard alongside those you might use with a *Tyk Classic API*.
+
+##### Configure Caching For Each API Endpoint
+
+We’ve added the ability to [configure](/api-management/response-caching#configuring-the-middleware-in-the-tyk-oas-api-definition) per-endpoint timeouts for Tyk’s response cache, giving you increased flexibility to tailor your APIs to your upstream services.
+
+##### Added Header Management in Universal Data Graph
+
+With this release we are adding a concept of [header management](/api-management/data-graph#header-management) in *Universal Data Graph*. With multiple upstream data sources, data graphs need to be sending the right headers upstream, so that our users can effectively track the usage and be able to enforce security rules at each stage. All *Universal Data Graph* headers now have access to *request context* variables like *JWT claims*, *IP address* of the connecting client or *request ID*. This provides extensive configurability of customizable information that can be sent upstream.
+
+##### Added Further Support For GraphQL WebSocket Protocols
+
+Support for [WebSocket](/api-management/graphql#graphql-websockets) protocols between client and the *Gateway* has also been expanded. Instead of only supporting the *graphql-ws protocol*, which is becoming deprecated, we now also support [graphql-transport-ws](https://github.com/enisdenjo/graphql-ws/blob/master/PROTOCOL.md) by setting the *Sec-WebSocket-Protocol* header to *graphql-transport-ws*.
+
+##### Added OpenTelemetry Tracing
+
+In this version, we're introducing the support for *OpenTelemetry Tracing*, the new [open standard](https://opentelemetry.io/) for exposing observability data. This addition gives you improved visibility into how API requests are processed, with no additional license required. It is designed to help you with monitoring and troubleshooting APIs, identify bottlenecks, latency issues and errors in your API calls. For detailed information and guidance, you can check out our [OpenTelemetry Tracing](/api-management/traces) resource.
+
+*OpenTelemetry* makes it possible to isolate faults within the request lifetime through inspecting API and Gateway meta-data. Additionally, performance bottlenecks can be identified within the request lifetime. API owners and developers can use this feature to understand how their APIs are being used or processed within the Gateway.
+
+*OpenTelemetry* functionality is also available in [Go Plugins](/api-management/plugins/advance-config#instrumenting-plugins-with-opentelemetry). Developers can write code to add the ability to preview *OpenTelemetry* trace attributes, error status codes etc., for their Go Plugins.
+
+We offer support for integrating *OpenTelemetry* traces with supported open source tools such [Jaeger](/api-management/traces/jaeger), [Dynatrace](/api-management/traces/dynatrace) or [New Relic](/api-management/traces#new-relic). This allows API owners and developers to gain troubleshooting and performance insights from error logs, response times etc.
+You can also find a direct link to our docs in the official [OpenTelemetry Integration page](https://opentelemetry.io/ecosystem/integrations/)
+
+
+<Warning>
+*Tyk Gateway 5.2* now includes *OpenTelemetry Tracing*. Over the next year, we'll be deprecating *OpenTracing*. We recommend migrating to *OpenTelemetry* for better trace insights and more comprehensive support. This change will offer you significant advantages in managing your distributed tracing needs.
+</Warning>
+
+
+#### Downloads
+
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.2.0/images/sha256-cf0c57619e8285b1985bd5e4bf86b8feb42abec56cbc241d315cc7f8c0d43025?context=explore)
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.2.0)
+
+#### Changelog
+<a id="Changelog-v5.2.0" data-scroll-offset></a>
+
+##### Added:
+
+
+
+<AccordionGroup>
+<Accordion title='Added support for configuring distributed tracing behavior'>
+Added support for [configuring](/tyk-oss-gateway/configuration#opentelemetry) distributed tracing behavior of *Tyk Gateway*. This includes enabling tracing, configuring exporter types, setting the URL of the tracing backend to which data is to be sent, customizing headers, and specifying enhanced connectivity for *HTTP*, *HTTPS* and *gRPC*. Subsequently, users have precise control over tracing behavior in *Tyk Gateway*.
+</Accordion>
+
+<Accordion title='Added support for configuring OpenTelemetry'>
+Added support to configure *OpenTelemetry* [sampling types and rates](/tyk-oss-gateway/configuration#opentelemetry-sampling) in the *Tyk Gateway*. This allows users to manage the need for collected detailed tracing information against performance and resource usage requirements.
+</Accordion>
+
+<Accordion title='Added span attributes to simplify identifying Tyk API and request meta-data per request'>
+Added span attributes to simplify identifying Tyk API and request meta-data per request. Example span attributes include: *tyk.api.id*, *tyk.api.name*, *tyk.api.orgid*, *tyk.api.tags*, *tyk.api.path*, *tyk.api.version*, *tyk.api.apikey*, *tyk.api.apikey.alias* and *tyk.api.oauthid*. This allows users to use *OpenTelemetry* [semantic conventions](https://github.com/open-telemetry/opentelemetry-specification/blob/v1.25.0/specification/trace/semantic_conventions/README.md) to filter and create metrics for increased insight and observability.
+</Accordion>
+
+<Accordion title='Add custom resource attributes to allow process information to be available in traces'>
+Added custom resource attributes: *service.name*, *service.instance.id*, *service.version*, *tyk.gw.id*, *tyk.gw.dataplane*, *tyk.gw.group.id*, *tyk.gw.tags* to allow process information to be available in traces.
+</Accordion>
+
+<Accordion title='Allow clients to retrieve the trace ID from response headers when OpenTelemetry enabled'>
+Added a new feature that allows clients to retrieve the trace ID from response headers. This feature is available when *OpenTelemetry* is [enabled](/tyk-oss-gateway/configuration#opentelemetry-enabled) and simplifies debugging API requests, empowering users to seamlessly correlate and analyze data for a specific trace in any *OpenTelemetry* backend like [Jaeger](https://www.jaegertracing.io/).
+</Accordion>
+
+<Accordion title='Allow detailed tracing to be enabled/disabled at API level'>
+Added configuration parameter to enable/disable [detailed_tracing](/api-management/logs/traffic-logs#detailed-recording) for *Tyk Classic API*.
+</Accordion>
+
+<Accordion title='Add OpenTelemetry support for GraphQL'>
+Added *OpenTelemetry* support for GraphQL. This is activated by setting [opentelemetry.enabled](/tyk-oss-gateway/configuration#opentelemetry-enabled) to *true*. This integration enhances observability by enabling GQL traces in any OpenTelemetry backend, like [Jaeger](https://www.jaegertracing.io/), granting users comprehensive insights into the execution process, such as request times.
+</Accordion>
+
+<Accordion title='Add support for configuring granular control over cache timeouts at the endpoint level'>
+Added a new [timeout option](/api-management/response-caching#configuring-the-middleware-in-the-tyk-oas-api-definition), offering granular control over cache timeout at the endpoint level.
+</Accordion>
+
+<Accordion title='Enable request context variables in UDG global or data source headers'>
+Added support for using [request context variables](/api-management/traffic-transformation/request-context-variables) in *UDG* global or data source headers. This feature enables much more advanced [header management](/api-management/data-graph#header-management) for UDG and allows users to extract header information from an incoming request and pass it to upstream data sources.
+</Accordion>
+
+<Accordion title='Add support for configuration of global headers for any UDG'>
+Added support for configuration of [global headers](/api-management/data-graph#header-management) for any *UDG*. These headers will be forwarded to all data sources by default, enhancing control over data flow.
+</Accordion>
+
+<Accordion title='Add ability for Custom GoPlugin developers using Tyk OAS APIs to access the API Definition'>
+Added the ability for Custom GoPlugin developers using *Tyk OAS APIs* to access the *API Definition* from within their plugin. The newly introduced *ctx.getOASDefinition* function provides read-only access to the *OAS API Definition* and enhances the flexibility of plugins.
+</Accordion>
+
+<Accordion title='Add support for graphql-transport-ws websocket protocol'>
+Added support for the websocket protocol, *graphql-transport-ws protocol*, enhancing communication between the client and *Gateway*. Users [connecting](/api-management/graphql#graphql-websockets) with the header *Sec-WebSocket-Protocol* set to *graphql-transport-ws* can now utilize messages from this [protocol](https://github.com/enisdenjo/graphql-ws/blob/master/PROTOCOL.md) for more versatile interaction.
+</Accordion>
+
+<Accordion title='Developers using Tyk OAS API Definition can configure body transform middleware for API reponses'>
+Added support for API Developers using *Tyk OAS API Definition* to [configure](/api-management/gateway-config-tyk-oas#transformbody) a body transform middleware that operates on API responses. This enhancement ensures streamlined and selective loading of the middleware based on configuration, enabling precise response data customization at the per-endpoint level.
+</Accordion>
+
+<Accordion title='Enhanced Gateway usage reporting, allowing reporting of number of connected gateways and data planes'>
+- Added support for enhanced *Gateway* usage reporting. *MDCB v2.4* and *Gateway v5.2* can now report the number of connected gateways and data planes. Features such as data plane gateway visualisation are available in *Tyk Dashboard* for enhanced monitoring of your deployment.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Changed:
+
+
+<Expandable title='Response Body Transform middleware updated to remove unnecessary entries in Tyk Classic API Definition'>
+Updated *Response Body Transform* middleware for *Tyk Classic APIs* to remove unnecessary entries in the *API definition*. The dependency on the *response_processor.response_body_transform* configuration has been removed to streamline middleware usage, simplifying API setup.
+</Expandable>
+
+
+
+##### Fixed:
+
+
+<AccordionGroup>
+<Accordion title='UDG was dropping array type parameter in certain circumstances from final request URL sent upstream'>
+Fixed an issue with querying a *UDG* API containing a query parameter of array type in a REST data source. The *UDG* was dropping the array type parameter from the final request URL sent upstream.
+</Accordion>
+
+<Accordion title='Introspection of GraphQL schemas raised an error when dealing with some custom root types'>
+Fixed an issue with introspecting GraphQL schemas that previously raised an error when dealing with custom root types other than *Query*, *Mutation* or *Subscription*.
+</Accordion>
+
+<Accordion title='Enforced Timeout configuration parameter of an API endpoint was not validated'>
+Fixed an issue where the [Enforced Timeout](/planning-for-production/ensure-high-availability/enforced-timeouts) configuration parameter of an API endpoint accepted negative values, without displaying validation errors. With this fix, users receive clear feedback and prevent unintended configurations.
+</Accordion>
+
+<Accordion title='allowedIPs validation failures were causing the loss of other error types reported'>
+Fixed an issue where *allowedIPs* validation failures replaced the reported errors list, causing the loss of other error types. This fix appends IP validation errors to the list, providing users with a comprehensive overview of encountered errors. Subsequently, this enhances the clarity and completeness of validation reporting.
+</Accordion>
+
+<Accordion title='The Data Plane Gateway for versions < v5.1 crashed with panic error when creating a Tyk OAS API'>
+Fixed a critical issue in MDCB v2.3 deployments, relating to *Data Plane* stability. The *Data Plane* Gateway with versions older than v5.1 was found to crash with a panic when creating a Tyk OAS API. The bug has been addressed, ensuring stability and reliability in such deployments.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+---
+
+## 5.1 Release Notes
+
+### Release Date 23 June 2023
+
+### Breaking Changes
+
+**Attention warning*: Please read carefully this section.
+
+#### Golang Version upgrade
+Our Gateway is using [Golang 1.19](https://tip.golang.org/doc/go1.19) programming language starting with the 5.1 release. This brings improvements to the code base and allows us to benefit from the latest features and security enhancements in Go. Don’t forget that, if you’re using GoPlugins, you'll need to [recompile](/api-management/plugins/golang#upgrading-your-tyk-gateway) these to maintain compatibility with the latest Gateway.
+
+#### Early Access Features:
+Please note that the `Tyk OAS APIs` feature, currently marked as *Early Access*, is subject to breaking changes in subsequent releases. Please refer to our [Early Access guide](/developer-support/release-types/early-access-feature) for specific details. Upgrading to a new version may introduce changes that are not backward-compatible. Downgrading to a previous version after upgrading may result in a broken installation.
+
+Users are strongly advised to follow the recommended upgrade instructions provided by Tyk before applying any updates.
+
+### Deprecations
+There are no deprecations in this release.
+
+### Upgrade Instructions
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade instructions.
+
+### Release Highlights
+ 
+#### Request Body Size Limits
+
+We have introduced a new Gateway-level option to limit the size of requests made
+to your APIs. You can use this as a first line of defense against overly large
+requests that might affect your Tyk Gateways or upstream services. Of course,
+being Tyk, we also provide the flexibility to configure API-level and
+per-endpoint size limits so you can be as granular as you need to protect and
+optimize your services. Check out our improved documentation for full
+description of how to use these powerful [features](/api-management/traffic-transformation/request-size-limits).
+
+#### Changed default RPC pool size for MDCB deployments
+
+We have reduced the default RPC pool size from 20 to 5. This can reduce the CPU and
+memory footprint in high throughput scenarios. Please monitor the CPU and memory
+allocation of your environment and adjust accordingly. You can change the pool
+size using [slave_options.rpc_pool_size](/tyk-oss-gateway/configuration#slave_options-rpc_pool_size)
+
+### Downloads
+
+- [docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.1/images/sha256-3d1e64722be1a983d4bc4be9321ca1cdad10af9bb3662fd6824901d5f22820f1?context=explore)
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.1.0)
+
+
+### Changelog
+
+#### Added
+
+- Added `HasOperation`, `Operation` and `Variables` to GraphQL data source API definition for easier nesting
+- Added abstractions/interfaces for ExecutionEngineV2 and ExecutionEngine2Executor with respect to graphql-go-tools
+- Added support for the `:authority` header when making GRPC requests. If the `:authority` header is not present then some GRPC servers return PROTOCOL_ERROR which prevents custom GRPC plugins from running. Thanks to [vanhtuan0409](https://github.com/vanhtuan0409) from the Tyk Community for his contribution!
+
+#### Changed
+
+- Tyk Gateway updated to use Go 1.19
+- Updated [_kin-openapi_](https://github.com/getkin/kin-openapi) dependency to the version [v0.114.0](https://github.com/getkin/kin-openapi/releases/tag/v0.114.0)
+- Enhanced the UDG parser to comprehensively extract all necessary information for UDG configuration when users import to Tyk their OpenAPI document as an API definition
+- Reduced default CPU and memory footprint by changing the default RPC pool size from 20 to 5 connections.
+
+#### Fixed
+
+- Fixed an issue where invalid IP addresses could be added to the IP allow list
+- Fixed an issue when using custom authentication with multiple authentication methods, custom authentication could not be selected to provide the base identity
+- Fixed an issue where OAuth access keys were physically removed from Redis on expiry. Behavior for OAuth is now the same as for other authorization methods
+- Fixed an issue where the `global_size_limit` setting didn't enable request size limit middleware. Thanks to [PatrickTaibel](https://github.com/PatrickTaibel) for the contribution!
+- Fixed minor versioning, URL and field mapping issues when importing OpenAPI document as an API definition to UDG
+- When the control API is not protected with mTLS we now do not ask for a cert, even if all the APIs registered have mTLS as an authorization mechanism
+
+### Tyk Classic Portal Changelog
+
+#### Changed
+
+- Improved performance when opening the Portal page by optimizing the pre-fetching of required data
+
+
+
+## 5.0 Release Notes
+
+### 5.0.15 Release Notes
+
+#### Release Date 24 October 2024
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Upgrade Instructions
+
+Go to the [Upgrading Tyk](/developer-support/release-notes/gateway#upgrading-tyk)
+section for detailed upgrade instructions.
+
+#### Release Highlights
+
+This patch release for Tyk Gateway addresses critical stability issues for users running Tyk Gateway within the data
+plane, connecting to the control plane or Tyk Hybrid. Affected users should upgrade immediately to version 5.0.15 to
+avoid service interruptions and ensure reliable operations with the control plane or Tyk Hybrid.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.0.15) below.
+
+#### Changelog
+<a id="Changelog-v5.0.15" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Resolved gateway panic on reconnecting to MDCB control plane or Tyk Cloud'>
+In version 5.0.14, Tyk Gateway could encounter panic when attempting to reconnect to the control plane after it was restarted. This patch version has resolved this issue, ensuring stable connectivity between the gateway and control plane following reconnections and reducing the need for manual intervention.
+</Expandable>
+
+
+
+---
+
+### 5.0.14 Release Notes
+
+#### Release Date 18th September 2024
+
+
+<Note>
+**Important Update**<br /> <br /> <b>Date</b>: 12 October 2024<br /> <b>Topic</b>: Gateway panic when
+reconnecting to MDCB control plane or Tyk Cloud<br /> <b>Workaround</b>: Restart Gateway<br /> <b>Affected Product</b>: Tyk
+Gateway as an Edge Gateway<br /> <b>Affected versions</b>: v5.6.0, v5.3.6, and v5.0.14<br /> <b>Issue Description:</b><br />
+
+<p>We have identified an issue affecting Tyk Gateway deployed as a data plane connecting to the Multi-Data Center Bridge (MDCB) control plane or Tyk Cloud. In the above mentioned Gateway versions a panic may occur when gateway reconnect to the control plane after the control plane is restarted.</p>
+
+<p>Our engineering team is actively working on a fix, and a patch (versions 5.6.1, 5.3.7, and 5.0.15) will be released soon.<br /></p>
+
+<b>Recommendations:</b><br />
+
+<b>For users on versions 5.5.0, 5.3.5, and 5.0.13</b><br />
+We advise you to delay upgrading to the affected versions (5.6.0, 5.3.6, or 5.0.14) until the patch is available.
+
+<b>For users who have already upgraded to 5.6.0, 5.3.6, or 5.0.14 and are experiencing a panic in the gateway:</b><br />
+Restarting the gateway process will restore it to a healthy state. If you are operating in a *Kubernetes* environment, Tyk Gateway instance should automatically restart, which ultimately resolves the issue.<br />
+
+
+<p>We appreciate your understanding and patience as we work to resolve this. Please stay tuned for the upcoming patch release, which will address this issue.</p>
+</Note>
+
+
+
+#### Breaking Changes
+
+**Attention:** Please read this section carefully.
+
+There are no breaking changes in this release.
+
+#### Upgrade Instructions
+
+This release is not tightly coupled with Tyk Dashboard v5.0.14, so you do not have to upgrade both together.
+
+Go to the [Upgrading Tyk](/developer-support/release-notes/gateway#upgrading-tyk)
+section for detailed upgrade instructions.
+
+#### Release Highlights
+
+This release fixes some issues related to the way that Tyk performs URL path matching, introducing two new Gateway
+configuration options to control path matching strictness.
+
+#### Changelog
+
+##### Added
+
+
+
+<Expandable title='Implemented Gateway configuration options to set URL path matching strictness'>
+We have introduced two new options in the `http_server_options` [Gateway
+configuration](/tyk-oss-gateway/configuration#http_server_options) that will enforce prefix and/or suffix matching
+when Tyk performs checks on whether middleware or other logic should be applied to a request:
+
+- `enable_path_prefix_matching` ensures that the start of the request path must match the path defined in the API
+  definition
+- `enable_path_suffix_matching` ensures that the end of the request path must match the path defined in the API
+  definition
+- combining `enable_path_prefix_matching` and `enable_path_suffix_matching` will ensure an exact (explicit) match is
+  performed
+
+These configuration options provide control to avoid unintended matching of paths from Tyk's default _wildcard_ match.
+Use of regex special characters when declaring the endpoint path in the API definition will automatically override these
+settings for that endpoint.
+
+**Tyk recommends that exact matching is employed, but both options default to `false` to avoid introducing a breaking
+change for existing users.**
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Incorrectly configured regex in Policy affected Granular Endpoint Access authorization'>
+Fixed an issue when using [granular endpoint](/api-management/access-control/sessions-and-keys/access-rights#granular-endpoint-access) in access Policies and keys that led to authorization incorrectly being granted to endpoints if an invalid regular expression was configured in the key/Policy. Also fixed an issue where path-based parameters were not correctly handled by Path-Based Permissions. Now Tyk's authorization check correctly handles both of these scenarios granting access only to the expected resources.
+
+</Accordion>
+
+<Accordion title='Missing path parameter can direct to the wrong endpoint'>
+Fixed an issue where a parameterized endpoint URL (e.g. `/user/{id}`) would be invoked if a request is made that omits
+the parameter. For example, a request to `/user/` will now be interpreted as a request to `/user` and not to
+`/user/{id}`.
+</Accordion>
+
+<Accordion title='Improved Gateway Synchronization with MDCB for Policies and APIs'>
+We have enhanced the Tyk Gateway's synchronization with MDCB to ensure more reliable loading of policies and APIs. A
+synchronous initialization process has been implemented to prevent startup failures and reduce the risk of service
+disruptions caused by asynchronous operations. This update ensures smoother and more consistent syncing of policies and
+APIs from MDCB.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+### 5.0.13 Release Notes
+
+#### Release Date 4 July 2024
+
+#### Release Highlights
+
+Resolved an issue encountered in MDCB environments where changes to custom keys made via the Dashboard were not properly
+replicated to data planes. The issue impacted both key data and associated quotas, in the following versions:
+
+- 5.0.4 to 5.0.12
+- 5.1.1 and 5.1.2
+- 5.2.0 to 5.2.6
+- 5.3.0 to 5.3.2
+
+###### Action Required
+
+Customers should clear their edge Redis instances of any potentially affected keys to maintain data consistency and
+ensure proper synchronization across their environments. Please refer to the item in the [fixed](#fixed) section of the
+changelog for recommended actions.
+
+#### Changelog
+
+##### Fixed
+
+
+
+<Expandable title='Resolved an issue where changes to custom keys were not properly replicated to data planes'>
+Resolved a critical issue affecting MDCB environments, where changes to custom keys made via the dashboard were not
+properly replicated to data planes. This affected both the key data and associated quotas. This issue was present in
+versions:
+
+- 5.0.4 to 5.0.12
+- 5.1.1 and 5.1.2
+- 5.2.0 to 5.2.6
+- 5.3.0 to 5.3.2
+
+**Action Required**
+
+Customers are advised to clear their edge Redis instances of any keys that might have been affected by this bug to
+ensure data consistency and proper synchronization across their environments. There are several methods available to
+address this issue:
+
+1. **Specific Key Deletion via API**: To remove individual buggy keys, you can use the following API call:
+
+```bash
+curl --location --request DELETE 'http://tyk-gateway:{tyk-hybrid-port}/tyk/keys/my-custom-key' \ --header 'X-Tyk-Authorization: {dashboard-key}'
+```
+
+Replace `{tyk-hybrid-port}`, `my-custom-key` and `{dashboard-key}` with your specific configuration details. This method
+is safe and recommended for targeted removals without affecting other keys.
+
+2. **Bulk Key Deletion Using Redis CLI**: For environments with numerous affected keys, you might consider using the
+   Redis CLI to remove keys en masse:
+
+```bash
+redis-cli --scan --pattern 'apikey-*' | xargs -L 1 redis-cli del
+redis-cli --scan --pattern 'quota-*' | xargs -L 1 redis-cli del
+```
+
+This method can temporarily impact the performance of the Redis server, so it should be executed during a maintenance
+window or when the impact on production traffic is minimal.
+
+3. **Complete Redis Database Flush**: If feasible, flushing the entire Redis database offers a clean slate:
+
+```bash
+redis-cli FLUSHALL ASYNC
+```
+
+**Implications** Regardless of the chosen method, be aware that quotas will be reset and will need to resynchronize
+across the system. This may temporarily affect reporting and rate limiting capabilities.
+</Expandable>
+
+
+
+---
+
+### 5.0.12 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.12).
+
+---
+
+### 5.0.11 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.11).
+
+---
+
+### 5.0.10 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.10).
+
+---
+
+### 5.0.9 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.9).
+
+---
+
+### 5.0.8 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.8).
+
+---
+
+### 5.0.7 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.7).
+
+---
+
+### 5.0.6 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.6).
+
+---
+
+### 5.0.5 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.5).
+
+---
+
+### 5.0.4 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.4).
+
+---
+
+### 5.0.3 Release Notes
+
+Please refer to our GitHub [release notes](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.3).
+
+---
+
+### 5.0.2 Release Notes
+
+#### Release Date 29 May 2023
+
+#### Release Highlights
+
+This release primarily focuses on bug fixes. For a comprehensive list of changes, please refer to the detailed
+[changelog](#Changelog-v5.0.2) below.
+
+#### Downloads
+
+- [docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.0.2/images/sha256-5e126d64571989f9e4b746544cf7a4a53add036a68fe0df4502f1e62f29627a7?context=explore)
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.2)
+
+#### Changelog
+<a id="Changelog-v5.0.2" data-scroll-offset></a>
+
+##### Updated
+
+- Internal refactoring to make storage related parts more stable and less affected by potential race issues
+
+---
+
+### 5.0.1 Release Notes
+
+#### Release Date 25 Apr 2023
+
+#### Release Highlights
+
+This release primarily focuses on bug fixes. For a comprehensive list of changes, please refer to the detailed
+[changelog](#Changelog-v5.0.1) below.
+
+#### Downloads
+
+- [docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.0.1/images/sha256-5fa7aa910d62a7ed2c1cfbc68c69a988b4b0e9420d7a52018f80f9a45cadb083?context=explore
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.1)
+
+#### Changelog
+<a id="Changelog-v5.0.1" data-scroll-offset></a>
+
+##### Added
+
+- Added a new `enable_distributed_tracing` option to the NewRelic config to enable support for Distributed Tracer
+
+##### Fixed
+
+- Fixed panic when JWK method was used for JWT authentication and the token didn't include kid
+- Fixed an issue where failure to load GoPlugin middleware didn’t prevent the API from proxying traffic to the upstream:
+  now Gateway logs an error when the plugin fails to load (during API creation/update) and responds with HTTP 500 if the
+  API is called; at the moment this is fixed only for file based plugins
+- Fixed MutualTLS issue causing leak of allowed CAs during TLS handshake when there are multiple mTLS APIs
+- Fixed a bug during hot reload of Tyk Gateway where APIs with JSVM plugins stored in filesystem were not reloaded
+- Fixed a bug where the gateway would remove the trailing `/`at the end of a URL
+- Fixed a bug where nested field-mappings in UDG weren't working as intended
+- Fixed a bug when using Tyk OAuth 2.0 flow on Tyk Cloud where a request for an Authorization Code would fail with a 404
+  error
+- Fixed a bug where mTLS negotiation could fail when there are a large number of certificates and CAs; added an option
+  (`http_server_options.skip_client_ca_announcement`) to use the alternative method for certificate transfer
+- Fixed CVE issue with go.uuid package
+- Fixed a bug where rate limits were not correctly applied when policies are partitioned to separate access rights and
+  rate limits into different scopes
+
+---
+
+### 5.0.0 Release Notes
+
+#### Release Date 28 Mar 2023
+
+#### Deprecations
+
+- Tyk Gateway no longer natively supports **LetsEncrypt** integration. You still can use LetsEncrypt CLI tooling to
+  generate certificates and use them with Tyk.
+
+#### Release Highlights
+
+##### Improved OpenAPI support
+
+We have added some great features to the Tyk OAS API definition bringing it closer to parity with our Tyk Classic API
+and to make it easier to get on board with Tyk using your Open API workflows.
+
+Tyk’s OSS users can now make use of extensive [custom middleware](/api-management/plugins/overview) options with your OAS
+APIs, to transform API requests and responses, exposing your upstream services in the way that suits your users and
+internal API governance rules. We’ve enhanced the Request Validation for Tyk OAS APIs to include parameter validation
+(path, query, headers, cookie) as well as the body validation that was introduced in Tyk 4.1.
+
+[Versioning your Tyk OAS APIs](/api-management/api-versioning) is easier than ever, with the
+Tyk OSS Gateway now looking after the maintenance of the list of versions associated with the base API for you; we’ve
+also added a new endpoint on the Tyk API that will return details of the versions for a given API.
+
+We’ve improved support for [Mock Responses](/api-management/traffic-transformation/mock-response#mock-response), with the Tyk OAS API
+definition now allowing you to register multiple Mock Responses in a single API, providing you with increased testing
+flexibility.
+
+Of course, we’ve also addressed some bugs and usability issues as part of our ongoing ambition to make Tyk OAS API the
+best way for you to create and manage your APIs.
+
+Thanks to our community contributors [armujahid](https://github.com/armujahid),
+[JordyBottelier](https://github.com/JordyBottelier) and [ls-michal-dabrowski](https://github.com/ls-michal-dabrowski)
+for your PRs that further improve the quality of Tyk OSS Gateway!
+
+#### Downloads
+
+- [docker image to pull](https://hub.docker.com/layers/tykio/tyk-gateway/v5.0.0/images/sha256-196815adff2805ccc14c267b14032f23913321b24ea86c052b62a7b1568b6725?context=explore)
+- [source code](https://github.com/TykTechnologies/tyk/releases/tag/v5.0.0)
+
+#### Changelog
+
+##### Added
+
+- Support for request validation (including query params, headers and the rest of OAS rules) with Tyk OAS APIs
+- Transform request/response middleware for Tyk OAS APIs
+- Custom middleware for Tyk OAS APIs
+- Added a new API endpoint to manage versions for Tyk OAS APIs
+- Improved Mock API plugin for Tyk OAS APIs
+- Universal Data Graph and GraphQL APIs now support using context variables in request headers, allowing passing
+  information it to your subgraphs
+- Now you can control access to introspection on policy and key level
+
+#### Fixed
+
+- Fixed potential race condition when using distributed rate limiter
+
+---
+
+## 4.3 Release Notes
+
+### 4.3.0 Release Notes
+
+#### Release Highlights
+
+##### Mock Responses with Tyk OAS API Definitions
+
+Does your Tyk OAS API Definition define examples or a schema for your path responses? If so, starting with Tyk v4.3, Tyk can use those configurations to mock your API responses, enabling your teams to integrate easily without being immediately dependent on each other. Check it out! [Mock Responses Documentation](/api-management/traffic-transformation/mock-response#mock-response)
+
+##### External OAuth - 3rd party OAuth IDP integration
+
+If you’re using a 3rd party IDP to generate tokens for your OAuth applications, Tyk can now validate the generated tokens by either performing JWT validation or by communicating with the authorization server and executing token introspection. 
+
+This can be achieved by configuring the new External OAuth authentication mechanism. Find out more here [External OAuth Integration](/api-management/client-authentication#integrate-with-external-authorization-server-deprecated)
+
+##### Updated the Tyk Gateway version of Golang, to 1.16.
+
+**Our Gateway is using Golang 1.16 version starting with 4.3 release. This version of the Golang release deprecates x509 commonName certificates usage. This will be the last release where it's still possible to use commonName, users need to explicitly re-enable it with an environment variable.**
+
+The deprecated, legacy behavior of treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is now disabled by default. It can be temporarily re-enabled by adding the value x509ignoreCN=0 to the GODEBUG environment variable.
+
+Note that if the CommonName is an invalid host name, it's always ignored, regardless of GODEBUG settings. Invalid names include those with any characters other than letters, digits, hyphens and underscores, and those with empty labels or trailing dots.
+
+##### Improved GQL security
+
+4.3 adds two important features that improve security settings for GraphQL APIs in Tyk.
+
+1. Ability to turn on/off introspection - this feature allows much more control over what consumers are able to do when interacting with a GraphQL API. In cases where introspection is not desirable, API managers can now disallow it. The setting is done on API key level, which means API providers will have very granular control over who can and who cannot introspect the API.
+2. Support for allow list in field-based permissions - so far Tyk was offering field-based permissions as a “block list” only. That meant that any new field/query added to a graph was by default accessible for all consumers until API manager explicitly blocked it on key/policy level. Adding support for “allow list” gives API managers much more control over changing schemas and reduces the risk of unintentionally exposing part of the graph that are not ready for usage. See [Introspection](/api-management/graphql#introspection) for more details.
+
+
+#### Changelog
+
+##### Tyk Gateway
+
+###### Added
+- Minor modifications to the Gateway needed for enabling support for Graph Mongo Pump.
+- Added header `X-Tyk-Sub-Request-Id` to each request dispatched by federated supergraph and Universal Data Graph, so that those requests can be distinguished from requests directly sent by consumers.
+- Added a functionality that allows to block introspection for any GraphQL API, federated supergraph and Universal Data Graph (currently only supported via Gateway, UI support coming in the next release).
+- Added an option to use allow list in field-based permissions. Implemented for full types and individual fields. (currently only supported via Gateway, UI support coming in the next release)
+- Added new middleware that can be used with HTTP APIs to set up persisted queries for GraphQL upstreams.
+- Added support for two additional subscription protocols for GraphQL subscriptions. Default protocol used between the gateway and upstream remains to be `graphql-ws`, two additional protocols are possible to configure and use: `graphql-transport-ws` and `SSE`.
+
+###### Changed
+
+Updated the Tyk Gateway version of Golang, to 1.16. 
+
+**SECURITY: The release deprecates x509 commonName certificates usage. This will be the last release where it's still possible to use commonName, users need to explicitly re-enable it with an environment variable.**
+
+The deprecated, legacy behavior of treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is now disabled by default. It can be temporarily re-enabled by adding the value x509ignoreCN=0 to the GODEBUG environment variable.
+
+Note that if the CommonName is an invalid host name, it's always ignored, regardless of GODEBUG settings. Invalid names include those with any characters other than letters, digits, hyphens and underscores, and those with empty labels or trailing dots.
+
+###### Fixed
+
+- Fixed an issue where introspection query was returning a wrong response in cases where introspection query had additional objects.
+- Fixed an issue where gateway was crashing when a subscription was started while no datasource was connected to it.
+- Fixed a problem with missing configuration in the GraphQL config adapter that caused issues with batching requests to subgraphs in GraphQL API federation setting.
+- A HTTP OAS API version lifetime respects now the date value of the expiration field from Tyk OAS API Definition.
+- Now it is possible to proxy traffic from a HTTP API (using Tyk Classic API Definition) to a HTTP OAS API (using Tyk OAS API Definition) and vice versa.
+
+
+#### Updated Versions
+
+Tyk Gateway 4.3 ([docker images](https://hub.docker.com/r/tykio/tyk-gateway/tags?page=1&name=4.3.0)
+
+#### Upgrade process
+
+Follow the [standard upgrade guide](/developer-support/upgrading), there are no breaking changes in this release.
+
+If you want switch from MongoDB to SQL, you can [use our migration tool](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance), but keep in mind that it does not yet support the migration of your analytics data.
+
+
+<Note>
+Note: Upgrading the Golang version implies that all the Golang custom plugins that you are using need to be recompiled before migrating to 4.3 version of the Gateway. Check our docs for more details [Golang Plugins](/api-management/plugins/golang).
+</Note>
+
+
+## 4.2 Release Notes
+
+### 4.2.0 Release Notes
+
+#### Release Highlights
+
+##### GraphQL Federation improvements
+
+###### Changed GUI in Universal Data Graph configuration section.
+
+A new GUI introduces enhancements to the user experience and more consistent user journey for UDG. 
+This change does not yet cover all possible use cases and is released with a feature flag. To enable the new GUI, analytics.conf needs the following setting:
+
+```
+"ui": {
+  "dev": true
+}
+```
+
+What’s possible with this change:
+- Importing GraphQL schema created outside of Tyk (formats accepted .json, .graphql, .grahqls)
+- Creating GraphQL schema in Tyk using schema editor
+- Hide/Unhide schema editor to focus on graphical representation of the schema
+- Resizing schema editor to adjust workspace look & feel to user preferences
+- Improved search in schema editor (search and search & replace available)
+- Quick link to UDG documentation from schema editor
+
+> Note: Full configuration of new Universal Data Graph is not yet possible in the GUI, however any UDGs created earlier will not be broken and will work as previously. 
+
+##### Changes to federation entities
+###### Defining the base entity
+Entities must be defined with the `@key` directive. The fields argument must reference a field by which the entity can be uniquely identified. Multiple primary keys are possible. For example:
+
+Subgraph 1 (base entity):
+```
+type MyEntity @key(fields: "id") @key(fields: "name") {
+  id: ID!
+  name: String!
+}
+```
+ Attempting to extend a non-entity with an extension that includes the @key directive or attempting to extend a base entity with an extension that does not include the @key directive will both result in errors.
+
+###### Entity stubs
+
+Entities cannot be shared types (be defined in more than one single subgraph).
+If one subgraph references a base entity (an entity defined in another subgraph), that reference must be declared as a stub (stubs look like an extension without any new fields in federation v1). This stub would contain the minimal amount of information to identify the entity (referencing exactly one of the primary keys on the base entity regardless of whether there are multiple primary keys on the base entity). For example, a stub for MyEntity from Subgraph 1 (defined above):
+
+Subgraph 2 (stub)
+```
+extend type MyEntity @key(fields: "id") {
+  id: ID! @external
+}
+```
+
+###### Supergraph extension orphans
+It is now possible to define an extension for a type in a subgraph that does not define the base type.
+However, if an extension is unresolved (an extension orphan) after an attempted federation, the federation will fail and produce an error.
+
+###### Improved Dashboard UI and error messages
+GraphQL-related (for example when federating subgraphs into a supergraph) errors in the Dashboard UI will show a lean error message with no irrelevant prefixes or suffixes.
+
+Changed the look & feel of request logs in Playground tab for GraphQL APIs. New component presents all logs in a clearer way and is easier to read for the user
+
+###### Shared types
+Types of the same name can be defined in more than one subgraph (a shared type). This will no longer produce an error if each definition is identical.
+Shared types cannot be extended outside of the current subgraph, and the resolved extension must be identical to the resolved extension of the shared type in all other subgraphs (see subgraph normalization notes). Attempting to extend a shared type will result in an error.
+The federated supergraph will include a single definition of a shared type, regardless of how many times it has been identically defined in its subgraphs.
+
+###### Subgraph normalization before federation
+Extensions of types whose base type is defined in the same subgraph will be resolved before an attempt at federation. A valid example involving a shared type:
+
+Subgraph 1:
+```
+enum Example {
+  A,
+  B
+}
+
+extend enum Example {
+  C  
+}
+```
+
+Subgraph 2:
+```
+enum Example {
+  A,
+  B,
+  C
+}
+```
+ 
+The enum named “Example” defined in Subgraph 1 would resolve to be identical to the same-named enum defined in Subgraph 2 before federation takes place. The resulting supergraph would include a single definition of this enum.
+
+###### Validation
+Union members must be both unique and defined.
+Types must have bodies, e.g., enums must contain at least one value; inputs, interfaces, or objects must contain at least one field
+
+##### OpenAPI 
+Added support for the Request Body Transform middleware, for new Tyk OAS API Definitions.
+
+##### Universal Data Graph
+
+Added support for Kafka as a data source in Universal Data Graph. Configuration allows the user to provide multiple topics and broker addresses.
+
+#### Changelog
+
+##### Tyk Gateway
+###### Added
+- Added support for Kafka as a data source in Universal Data Graph.
+- Adding a way to defining the base GraphQL entity via @key directive
+- It is now possible to define an extension for a type in a subgraph that does not define the base type.
+- Added support for the Request Body Transform middleware, for the new Tyk OAS API Definition
+- Session lifetime now can be controlled by Key expiration, e.g. key removed when it is expired. Enabled by setting `session_lifetime_respects_key_expiration` to `true`
+###### Changed
+- Generate API ID when API ID is not provided while creating API. 
+- Updated the Go plugin loader to load the most appropriate plugin bundle, honoring the Tyk version, architecture and OS
+- When GraphQL query with a @skip directive is sent to the upstream it will no longer return “null” for the skipped field, but remove the field completely from the response
+- Added validation to Union members - must be both unique and defined.
+###### Fixed
+- Fixed an issue where the Gateway would not create the circuit breaker events (BreakerTripped and BreakerReset) for which the Tyk Dashboard offers webhooks.
+- Types of the same name can be defined in more than one subgraph (a shared type). This will no longer produce an error if each definition is exactly identical.
+- Apply Federation Subgraph normalization do avoid merge errors. Extensions of types whose base type is defined in the same subgraph will be resolved before an attempt at federation.
+
+#### Updated Versions
+Tyk Gateway 4.2
+
+#### Upgrade process
+
+Follow the [standard upgrade guide](/developer-support/upgrading), there are no breaking changes in this release.
+
+If you want switch from MongoDB to SQL, you can [use our migration tool](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance), but keep in mind that it does not yet support the migration of your analytics data.
+
+## 4.1 Release Notes
+
+### 4.1.0 Release Notes
+
+#### Release Highlights
+
+##### OpenAPI as a native API definition format
+Tyk has always had a proprietary specification for defining APIs. From Tyk v4.1 we now support defining APIs using the Open API Specification (OAS) as well, which can offer significant time and complexity savings. [This is an early access capability](/developer-support/release-types/early-access-feature).
+
+As we extend our OAS support, we would very much like your feedback on how we can extend and update to best meet your needs: .
+
+This capability is available in both the open source and paid versions of Tyk. See our [Tyk OAS documentation](/api-management/gateway-config-tyk-oas) for more details.
+
+
+##### MDCB Synchroniser
+
+Tyk Gateway v4.1 enables an improved synchroniser functionality within Multi Data Center Bridge (MDCB) v2.0. Prior to this release, the API keys, certificates and OAuth clients required by worker Gateways were synchronised from the controller Gateway on-demand. With Gateway v4.1 and MDCB v2.0 we introduce proactive synchronisation of these resources to the worker Gateways when they start up.
+ 
+This change improves resilience in case the MDCB link or controller Gateway is unavailable, because the worker Gateways can continue to operate independently using the resources stored locally. There is also a performance improvement, with the worker Gateways not having to retrieve resources from the controller Gateway when an API is first called.
+ 
+Changes to keys, certificates and OAuth clients are still synchronised to the worker Gateways from the controller when there are changes and following any failure in the MDCB link.
+
+##### Go Plugin Loader
+When upgrading your Tyk Installation you need to re-compile your plugin with the new version. At the moment of loading a plugin, the Gateway will try to find a plugin with the name provided in the API definition. If none is found then it will fallback to search the plugin file with the name: `{plugin-name}_{Gw-version}_{OS}_{arch}.so`
+
+From v4.1.0 the plugin compiler automatically names plugins with the above naming convention. It enables you to have one directory with different versions of the same plugin. For example:
+
+- `plugin_v4.1.0_linux_amd64.so`
+- `plugin_v4.2.0_linux_amd64.so`
+
+So, if you upgrade from Tyk v4.1.0 to v4.2.0 you only need to have the plugins compiled for v4.2.0 before performing the upgrade.
+
+#### Changelog
+
+##### Tyk Gateway
+###### Added
+- Added support for new OAS API definition format
+- Added support for headers on subgraph level for federated GraphQL APIs
+- Added support for interfaces implementing interfaces in GQL schema editor
+- Added support for passing authorization header in GQL API Playgrounds for subscription APIs
+- Added TYK_GW_OMITCONFIGFILE option for Tyk Gateway to ignore the values in the config file and load its configuration only from environment variables and default values
+- Added a way to modify Tyk analytics record via Go plugins [configurable with API definition](/api-management/plugins/plugin-types#analytics-plugins). Can be used to sanitise analytics data. 
+- Added new policy API REST endpoints
+- Added option to configure certificates for Tyk Gateway using [environment variable](/tyk-oss-gateway/configuration#http_server_options-certificates)
+- Added support for Python 3.9 plugins
+- Added support for headers on subgraph level for federated GraphQL APIs
+- Added support for introspecting schemas with interfaces implementing interfaces for proxy only GQL
+- Added support for input coercion in lists for GraphQL
+- Added support for repeatable directives for GraphQL
+###### Changed
+- Generate API ID when API ID is not provided while creating API. 
+- Updated the Go plugin loader to load the most appropriate plugin bundle, honoring Tyk version, architecture and OS
+- When a GraphQL query with a @skip directive is sent to the upstream it will no longer return “null” for the skipped field, but remove the field completely from the response
+###### Fixed
+- Fixed a bug where the MDCB worker Gateway could become unresponsive when a certificate is added in the Tyk Dashboard
+- Fixed an issue with the calculation of TTL for keys in an MDCB deployment such that TTL could be different between worker and controller Gateways
+- Fixed a bug when using Open ID where quota was not tracked correctly
+- Fixed multiple issues with schema merging in GraphQL federation. Federation subgraphs with the same name shared types like objects, interfaces, inputs, enums, unions and scalars will no longer cause errors when users are merging schemas into a federated supergraph.
+- Fixed an issue where schema merging in GraphQL federation could fail depending on the order or resolving subgraph schemas and only first instance of a type and its extension would be valid. Subgraphs are now individually normalized before a merge is attempted and all extensions that are possible in the federated schema are applied.
+- Fixed an issue with accessing child properties of an object query variable for GraphQL where query `{{.arguments.arg.foo}}` would return `{ "foo":"123456" }` instead of "123456"
+
+#### Updated Versions
+Tyk Gateway 4.1
+Tyk MDCB 2.0.1
+
+#### Upgrade process
+
+Follow the [standard upgrade guide](/developer-support/upgrading), there are no breaking changes in this release.
+
+If you want switch from MongoDB to SQL, you can [use our migration tool](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance), but keep in mind that it does not yet support the migration of your analytics data.
+ 
+## 4.0 Release Notes
+
+### 4.0.0 Release Notes
+
+#### Release Highlights
+
+##### GraphQL federation
+
+As we know, ease-of-use is an important factor when adopting GraphQL. Modern enterprises have dozens of backend services and need a way to provide a unified interface for querying them. Building a single, monolithic GraphQL server is not the best option. It is hard to maintain and leads to a lot of dependencies and over-complication.
+
+To remedy this, Tyk 4.0 offers GraphQL federation that allows the division of GraphQL implementation across multiple backend services, while still exposing them all as a single graph for the consumers. Subgraphs represent backend services and define a distinct GraphQL schema. A subgraph can be queried directly, as a separate service or federated in the Tyk Gateway into a larger schema of a supergraph – a composition of several subgraphs that allows execution of a query across multiple services in the backend.
+
+[Federation docs](/api-management/graphql#overview-1)
+
+[Subgraphs and Supergraphs docs](/api-management/graphql#subgraphs-and-supergraphs)
+
+##### GraphQL subscriptions
+
+Subscriptions are a way to push data from the server to the clients that choose to listen to real-time messages from the server, using the WebSocket protocol. There is no need to enable subscriptions separately; Tyk supports them alongside GraphQL as standard.
+
+With release 4.0, users can federate GraphQL APIs that support subscriptions. Federating subscriptions means that events pushed to consumers can be enriched with information from other federated graphs.
+
+[Subscriptions docs](/api-management/graphql#graphql-subscriptions)
+
+#### Changelog
+
+- Now it is possible to configure GraphQL upstream authentification, in order for Tyk to work with its schema
+- JWT scopes now support array and comma delimiters
+- Go plugins can be attached on per-endpoint level, similar to virtual endpoints
+
+#### Updated Versions
+
+Tyk Gateway 4.0
+Tyk Pump 1.5
+
+#### Upgrade process
+
+Follow the [standard upgrade guide](/developer-support/upgrading), there are no breaking changes in this release.
+
+If you want switch from MongoDB to SQL, you can [use our migration tool](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance), but keep in mind that it does not yet support the migration of your analytics data.
+ 
+## 3.2 Release Notes
+
+### 3.2.0 Release Notes
+
+#### Release Highlights
+
+##### GraphQL and UDG improvements
+
+We've updated the GraphQL functionality of our [Universal Data Graph](/api-management/data-graph#overview). You’re now able to deeply nest GraphQL & REST APIs and stitch them together in any possible way.
+
+Queries are now possible via WebSockets and Subscriptions are coming in the next Release (3.3.0).
+
+You're also able to configure [upstream Headers dynamically](/api-management/data-graph#header-forwarding), that is, you’re able to inject Headers from the client request into UDG upstream requests. For example, it can be used to access protected upstreams. 
+
+We've added an easy to use URL-Builder to make it easier for you to inject object fields into REST API URLs when stitching REST APIs within UDG.
+
+Query-depth limits can now be configured on a per-field level.
+
+If you’re using GraphQL upstream services with UDG, you’re now able to forward upstream error objects through UDG so that they can be exposed to the client.
+
+##### Go response plugins
+
+With Go response plugins you are now able to modify and create a full request round trip made through the Tyk Gateway. 
+Find out more about [plugins](/api-management/plugins/overview#) and how to write [Go response plugins](/api-management/plugins/golang#creating-a-custom-response-plugin).
+
+#### Changelog
+
+In addition to the above, version 3.2 includes all the fixes that are part of 3.0.5
+https://github.com/TykTechnologies/tyk/releases/tag/v3.0.5
+
+#### Updated Versions
+Tyk Gateway 3.2
+
+#### Upgrade process
+If you already have GraphQL or UDG APIs you need to follow this [upgrade guide](/api-management/graphql#migrating-to-3-2)
+
+## 3.1 Release Notes
+
+### 3.1.0 Release Notes
+
+#### Release Highlights
+
+##### Identity Management UX and SAML support
+You will notice that the experience for creating a new profile in the Identity management section of the dashboard was changed to a ‘wizard’ approach which reduces the time it takes to get started and configure a profile. 
+In addition, users are now able to use SAML for the dashboard and portal login, whether you use TIB(Tyk Identity Broker) internally or externally of the dashboard.
+
+This follows the recent changes that we have made to embed TIB (Tyk Identity Broker)in the dashboard. See 3.0 [release notes](/developer-support/release-notes/dashboard#tyk-identity-broker-now-built-in-to-the-dashboard) for more information regarding this. 
+
+To learn more [see the documentation](/tyk-identity-broker/overview)
+
+##### UDG (Universal Data Graph) & GraphQL
+###### Schema Validation
+
+For any GraphQL API that is created via Dashboard or through our API, the GraphQL schema is now validated before saving the definition. Instant feedback is returned in case of error.
+
+###### Sync / Update schema with upstream API (Proxy Only Mode)
+
+If you’ve configured just a proxy GraphQL API, you can now keep in sync the upstream schema with the one from the API definition, just by clicking on the `Get latest version` button on the `Schema` tab from API Designer
+
+Docs [here](/api-management/graphql#syncing-gql-schema)
+
+###### Debug logs
+
+You can now see what responses are being returned by the data sources used while configuring a UDG (universal data graph). These can be seen by calling the `/api/debug` API or using the playground tab within API designer.
+
+The data that will be displayed will show information on the query before and after the request to a data source happens, as follows:
+
+Before the request is sent:
+
+Example log message: "Query.countries: preSendHttpHook executed”. Along with this message, the log entry will contain the following set of fields: Typename, Fieldname and Upstream url;
+
+
+After the request is sent:
+
+Example log message: "Query.countries: postReceiveHttpHook executed”. Along with this message, the log entry will contain the following set of fields: Typename, Filename, response body, status code.
+
+Example: 
+
+```{"typename": "Query", "fielname": "countries", "response_body": "{\"data\":{}}", "status_code": 200}```
+
+Docs [here](/api-management/graphql#graphql-playground)
+
+##### Portal
+###### GraphQL Documentation
+
+Documentation for the GraphQL APIs that you are exposing to the portal is available now through a GraphQL Playground UI component, same as on the playground tab of API Designer.
+
+Also to overcome the CORS issues that you might encounter while testing documentation pages on the portal, we have pre-filled the CORS settings section in API Designer with explicit values from the start. All you need to do is to check the “Enable CORS” option.
+
+###### Portal - API key is hidden in email
+You now have the option to hide the API key in the email generated after you approve the key request for a developer.
+
+[Docs here](/tyk-developer-portal/tyk-portal-classic/key-requests)
+
+#### Changelog
+The 3.1 version includes the fixes that are part of 3.0.1. 
+https://github.com/TykTechnologies/tyk/releases/tag/v3.0.1
+
+
+#### Updated Versions
+
+- Tyk Gateway 3.1
+
+## 3.0 Release Notes
+
+### 3.0.0 Release Notes
+
+#### Release Highlights
+
+##### Version changes and LTS releases
+
+We have bumped our major Tyk Gateway version from 2 to 3, a long overdue change as we’ve been on version 2 for 3 years. We have also changed our Tyk Dashboard major version from 1 to 3, and from now on it will always be aligned with the Tyk Gateway for major and minor releases. The Tyk Pump has also now updated to 1.0, so we can better indicate major changes in future. 
+
+Importantly, such a big change in versions does not mean that we going to break backward compatibility. More-over we are restructuring our internal release strategy to guarantee more stability and to allow us to deliver all Tyk products at a faster pace. We aim to bring more clarity to our users on the stability criteria they can expect, based on the version number.
+Additionally we are introducing Long Term Releases (also known as LTS).
+
+Read more about this changes in our blog post: https://tyk.io/blog/introducing-long-term-support-some-changes-to-our-release-process-product-versioning/
+
+
+##### Universal Data Graph and GraphQL
+
+Tyk now supports GraphQL **natively**. This means Tyk doesn’t have to use any external services or process for any GraphQL middleware. You can securely expose existing GraphQL APIs using our GraphQL core functionality.
+
+In addition to this you can also use Tyk’s integrated GraphQL engine to build a Universal Data Graph. The Universal Data Graph (UDG) lets you expose existing services as one single combined GraphQL API.
+
+All this without even have to build your own GraphQL server. If you have existing REST APIs all you have to do is configure the UDG and Tyk has done the work for you.
+
+With the Universal Data Graph (UDG), Tyk becomes the central integration point for all your internal and external APIs.
+It also benefits from the full set of capabilities included with your Tyk installation—meaning your data graph is secure from the start and can take advantage of a wide range of out-of-the-box middleware to power your graph.
+
+Read more about the [GraphQL](/api-management/graphql) and [Universal Data Graph](/api-management/data-graph#overview)
+
+##### Using external secret management services
+
+Want to reference secrets from a KV store in your API definitions? We now have native Vault & Consul integration. You can even pull from a tyk.conf dictionary or environment variable file.
+
+[Read more](/tyk-configuration-reference/kv-store)
+
+##### Co-Process Response Plugins
+
+We added a new middleware hook allowing middleware to modify the response from the upstream. Using response middleware you can transform, inspect or obfuscate parts of the response body or response headers, or fire an event or webhook based on information received by the upstream service.
+
+At the moment the Response hook is supported for [Python and gRPC plugins](/api-management/plugins/rich-plugins#coprocess-dispatcher-hooks).
+
+
+##### Enhanced Gateway health check API
+
+Now the standard Health Check API response include information about health of the dashboard, redis and mdcb connections.
+You can configure notifications or load balancer rules, based on new data. For example, you can be notified if your Tyk Gateway can’t connect to the Dashboard (or even if it was working correctly with the last known configuration).
+
+[Read More](/planning-for-production/ensure-high-availability/health-check)
+
+##### Enhanced Detailed logging
+Detailed logging is used in a lot of the cases for debugging issues. Now as well as enabling detailed logging globally (which can cause a huge overhead with lots of traffic), you can enable it for a single key, or specific APIs. 
+
+New detailed logging changes are available only to our Self-Managed customers currently.
+
+[Read More](/api-management/troubleshooting-debugging#capturing-detailed-logs)
+
+##### Ability to shard analytics to different data-sinks
+
+In a multi-org deployment, each organization, team, or environment might have their preferred analytics tooling. At present, when sending analytics to the Tyk Pump, we do not discriminate analytics by org - meaning that we have to send all analytics to the same database - e.g. MongoDB. Now the Tyk Pump can be configured to send analytics for different organizations to different places. E.g. Org A can send their analytics to MongoDB + DataDog. But Org B can send their analytics to DataDog + expose the Prometheus metrics endpoint.
+
+It also becomes possible to put a <Tooltip tip="A list of blocked or denied items or entries">blocklist</Tooltip> in-place, meaning that some data sinks can receive information for all orgs, whereas others will not receive OrgA’s analytics if blocked.
+
+This change requires updating to new Tyk Pump 1.0
+
+[Read More](/api-management/tyk-pump#configuring-tyk-pump)
+
+##### 404 Error logging - unmatched paths
+
+Concerned that client’s are getting a 404 response? Could it be that the API definition or URL rewrites have been misconfigured? Telling Tyk to track 404 logs, will cause the Tyk Gateway to produce error logs showing that a particular resource has not been found. 
+
+The feature can be enabled by setting the config `track_404_logs` to `true` in the gateway's config file.
+
+#### Changelog
+
+##### Fixes
+
+- Fixed the bug when tokens created with non empty quota, and quota expiration set to `Never`, were treated as having unlimited quota. Now such tokens will stop working, once initial quota is reached. 
+
+#### Updated Versions
+
+- Tyk Gateway 3.0
+- Tyk Pump 1.0
+
+#### Upgrading From Version 2.9
+
+No specific actions required.
+If you are upgrading from version 2.8, please [read this guide](/developer-support/release-notes/archived#2-9-0-release-notes)
+
+## Further Information
+
+### Upgrading Tyk
+Please refer to the [upgrading Tyk](/developer-support/upgrading) page for further guidance on the upgrade strategy.
+
+### API Documentation
+{/* Required. Update the link to the Gateway "tyk-gateway-api" or dashboard "tyk-dashboard-api" and the Postman collection
+
+If there were changes in any of Tyk’s API docs:
+
+- Have API endpoints been documented in the release note summary and changelog?				
+- Has a link to the endpoint documentation being included?
+- Has the benefit of the new/updated endpoint been explained in the release highlights and changelog? */}
+- [OpenAPI Document](/tyk-dashboard-api)
+- [Postman Collection](https://www.postman.com/tyk-technologies/workspace/tyk-public-workspace/overview)
+
+### FAQ
+
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
diff --git a/developer-support/release-notes/helm-chart.mdx b/developer-support/release-notes/helm-chart.mdx
new file mode 100644
index 0000000000..dfec9e0487
--- /dev/null
+++ b/developer-support/release-notes/helm-chart.mdx
@@ -0,0 +1,2472 @@
+---
+title: "Tyk Charts Release Notes"
+description: "Release notes documenting updates, enhancements and changes for Tyk Charts."
+keywords: "Tyk Charts, Release notes, changelog"
+sidebarTitle: "Tyk Charts"
+---
+
+****Open Source** ([Mozilla Public License](https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md))**
+
+
+**This page contains all release notes for Tyk Charts displayed in reverse chronological order**
+
+## Support Lifetime
+Only the most recent Tyk Charts release is supported. We recommend staying current to minimise exposure to security vulnerabilities from third party dependencies.
+
+---
+
+## 5.3 Release Notes
+
+### 5.3.0 Release Notes
+
+#### Release Date 09 July 2026
+
+#### Release Highlights
+
+Tyk Charts 5.3.0 completes enterprise support for private container registries by adding `imagePullSecrets` configuration to the tyk-bootstrap chart's bootstrap jobs. The Developer Portal bootstrap job's image is now also configurable and respects the `global.imageRegistry` prefix.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.3.0) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-5.3.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency  | Tested Versions  | Compatible Versions  | Comments |
+| ------------------------| ---------------- | -------------------- | -------- |
+| [Kubernetes](https://kubernetes.io)   | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+ | |
+| [Helm](https://helm.sh)               | 3.14.x              | 3.x  | |
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.4) | 5.x, 6.x, 7.x, 8.x (up to 8.4) | |
+| [Valkey](https://valkey.io/download/) | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8 | 5, 6, 7, 8 | Used by Tyk Dashboard, Pump, and MDCB |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x | 13.x - 17.x | Used by Tyk Dashboard, Pump, and MDCB |
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v5.3.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/5.3.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/5.3.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/5.3.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/5.3.0)
+
+#### Changelog
+<a id="Changelog-v5.3.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Add `imagePullSecrets` support for tyk-bootstrap jobs'>
+You can now configure `imagePullSecrets` for the tyk-bootstrap chart's bootstrap jobs via the new `bootstrap.imagePullSecrets` value (default: `[]`, opt-in, backward-compatible). Setting this value automatically propagates the secret to all bootstrap hook jobs (pre-install, post-install, and pre-delete) via the job's ServiceAccount.
+
+The Developer Portal bootstrap job's image is also now configurable through the new `bootstrapJob.image.repository` and `bootstrapJob.image.tag` values, and respects the `global.imageRegistry` prefix, replacing the previously hardcoded `curlimages/curl` image. Together, these changes enable Tyk Charts to be deployed in air-gapped or private-registry environments.
+</Accordion>
+ 
+</AccordionGroup>
+
+## 5.2 Release Notes
+
+### 5.2.0 Release Notes
+
+#### Release Date 21 May 2026
+
+#### Release Highlights
+In this release, we have enhanced Helm chart customization capabilities by adding pod labeling support for the Tyk Operator.
+
+This version aligns with Tyk LTS release 5.8.14.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.2.0) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-5.2.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency  | Tested Versions  | Compatible Versions  | Comments |
+| ------------------------| ---------------- | -------------------- | -------- |
+| [Kubernetes](https://kubernetes.io)   | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+ | |
+| [Helm](https://helm.sh)               | 3.14.x              | 3.x  | |
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.4) | 5.x, 6.x, 7.x, 8.x (up to 8.4) | |
+| [Valkey](https://valkey.io/download/) | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8 | 5, 6, 7, 8 | Used by Tyk Dashboard, Pump, and MDCB |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x | 13.x - 17.x | Used by Tyk Dashboard, Pump, and MDCB |
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v5.2.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/5.2.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/5.2.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/5.2.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/5.2.0)
+
+#### Changelog
+<a id="Changelog-v5.2.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Add `podLabels` support for Tyk Operator'>
+You can now attach custom labels to Tyk Operator pods using the `podLabels` map. This functionality is already available for Tyk Dashboard, Tyk Gateway, the Developer Portal, and Tyk Pump.
+</Accordion>
+
+</AccordionGroup>
+
+## 5.1 Release Notes
+
+### 5.1.1 Release Notes
+
+#### Release Date 31 March 2026
+
+#### Release Highlights
+Tyk Charts v5.1.1 resolves a blocking installation issue introduced in v5.1.0. This release fixes the Helm chart template error that prevented users from successfully installing the operator via Helm charts.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.1.1) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-5.1.1"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency  | Tested Versions  | Compatible Versions  | Comments |
+| ------------------------| ---------------- | -------------------- | -------- |
+| [Kubernetes](https://kubernetes.io)   | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+ | |
+| [Helm](https://helm.sh)               | 3.14.x              | 3.x  | |
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.4) | 5.x, 6.x, 7.x, 8.x (up to 8.4) | |
+| [Valkey](https://valkey.io/download/) | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8 | 5, 6, 7, 8 | Used by Tyk Dashboard, Pump, and MDCB |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x | 13.x - 17.x | Used by Tyk Dashboard, Pump, and MDCB |
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/releases)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/5.1.1)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/5.1.1)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/5.1.1)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/5.1.1)
+
+#### Changelog
+<a id="Changelog-v5.1.1" data-scroll-offset></a>
+
+##### Fixed
+
+<Accordion title='Fixed Tyk Operator Helm chart installation failure'>
+Resolved an issue introduced in v5.1.0 where installing the Tyk Operator via Helm failed due to an incorrect webhook annotation reference in the Helm template. Users can now successfully install the Tyk Operator using Helm without encountering template rendering errors.
+</Accordion>
+
+### 5.1.0 Release Notes
+
+#### Release Date 11 March 2026
+
+#### Release Highlights
+Tyk Charts 5.1.0 enhances Kubernetes deployment flexibility with support for priority classes across all components, ensuring API Gateway services maintain scheduling priority during resource pressure. This release also renews the default certificate in Gateway Docker images to prevent March 2026 expiration and completes the migration to Bitnami Legacy registry for continued chart compatibility. Additionally, the release fixes secret reference handling in bootstrap jobs for improved custom secret management.
+
+This version aligns with Tyk LTS release 5.8.12.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.1.0) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-5.1.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency  | Tested Versions  | Compatible Versions  | Comments |
+| ------------------------| ---------------- | -------------------- | -------- |
+| [Kubernetes](https://kubernetes.io)   | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+ | |
+| [Helm](https://helm.sh)               | 3.14.x              | 3.x  | |
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.4) | 5.x, 6.x, 7.x, 8.x (up to 8.4) | |
+| [Valkey](https://valkey.io/download/) | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8 | 5, 6, 7, 8 | Used by Tyk Dashboard, Pump, and MDCB |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x | 13.x - 17.x | Used by Tyk Dashboard, Pump, and MDCB |
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/releases)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/5.1.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/5.1.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/5.1.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/5.1.0)
+
+#### Changelog
+<a id="Changelog-v5.1.0" data-scroll-offset></a>
+
+##### Changed
+<AccordionGroup>
+
+<Accordion title='Renewed Default Certificate in Gateway Docker Images'>
+Updated the default self-signed certificate shipped with Gateway Docker images to prevent expiration in March 2026. This certificate is only intended for initial bootstrapping and testing purposes when `global.tls.gateway=true` is enabled in Helm deployments and must not be used in production environments
+</Accordion>
+
+<Accordion title='Completed Migration to Bitnami Legacy Registry'>
+Updated all remaining references to use the Bitnami Legacy registry following Bitnami's distribution model changes. This completes the migration from the standard Bitnami registry to the `bitnamilegacy` registry for PostgreSQL and Redis chart dependencies used in Helm deployment examples and testing infrastructure.
+</Accordion>
+
+</AccordionGroup>
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Enhanced Pod Scheduling Control with Kubernetes Priority Classes Support'>
+Added support for configuring Kubernetes `priorityClassName` across all Tyk components in Helm charts to prevent API Gateway services from being preempted during cluster resource pressure. Users can now assign appropriate priority levels to Tyk Gateway, Dashboard, Pump, Bootstrap jobs, Dev Portal, Operator, and MDCB components through their respective chart values. 
+
+This enhancement ensures that essential Tyk infrastructure maintains a higher scheduling priority than default workloads, improving service availability and preventing unexpected downtime when Kubernetes nodes experience resource constraints.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed Secret Reference Handling for Admin Credentials in Portal Bootstrap Job'>
+Fixed an issue where the Developer Portal bootstrap job incorrectly handled secret references for admin email and password configuration. The bootstrap job now properly respects custom secret names for both admin email and password, allowing users to successfully deploy with their own secret management solutions.
+</Accordion> 
+
+</AccordionGroup>
+
+
+### 5.0.0 Release Notes
+
+#### Release Date 19 December 2025
+
+#### Release Highlights
+Tyk Charts 5.0.0 introduces a more secure default for client IP detection by setting the XFF depth to 1 for all new deployments. This release also adds the ability to configure Redis max idle connections directly through Helm values. the release aligns with the most recent Tyk LTS release [5.8.9](/developer-support/release-notes/dashboard#5-8-9-release-notes).
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v5.0.0) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-5.0.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency  | Tested Versions  | Compatible Versions  | Comments |
+| ------------------------| ---------------- | -------------------- | -------- |
+| [Kubernetes](https://kubernetes.io)   | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+ | |
+| [Helm](https://helm.sh)               | 3.14.x              | 3.x  | |
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.4) | 5.x, 6.x, 7.x, 8.x (up to 8.4) | |
+| [Valkey](https://valkey.io/download/) | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8 | 5, 6, 7, 8 | Used by Tyk Dashboard, Pump, and MDCB |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x | 13.x - 17.x | Used by Tyk Dashboard, Pump, and MDCB |
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/releases)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/5.0.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/5.0.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/5.0.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/5.0.0)
+
+#### Changelog
+<a id="Changelog-v5.0.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Default XFF Depth Now Set to Most Secure Value in Tyk Charts'>
+We have updated the default configuration in the Tyk Helm Charts to set the X-Forwarded-For (XFF) depth to 1, ensuring that new deployments use the most secure and accurate client IP selection.
+</Accordion>
+
+<Accordion title='Redis Max Idle Connections Now Configurable in Tyk Charts'>
+You can now configure the maximum number of idle Redis connections (`TYK_GW_STORAGE_MAXIDLE`) directly through the Helm Charts using the new `global.redis.maxIdle` parameter. This eliminates the previous limitation where setting this value would cause deployment errors, requiring manual post-deployment configuration changes.
+</Accordion>
+
+</AccordionGroup>
+
+## 4.1 Release Notes
+
+### 4.1.1 Release Notes
+
+#### Release Date 12 December 2025
+
+#### Release Highlights
+This release addresses an issue from Tyk Charts 4.1.0 where the new Kubernetes tolerations features was not functioning correctly for Tyk Operator deployments. No further changes have been implemented in this release.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-4.1.1"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency  | Tested Versions  | Compatible Versions  | Comments | 
+| ------------------------| ---------------- | -------------------- | -------- | 
+| [Kubernetes](https://kubernetes.io)   | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+ | | 
+| [Helm](https://helm.sh)               | 3.14.x              | 3.x  | | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | |
+| [Valkey](https://valkey.io/download/) | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8 | 5, 6, 7, 8 | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x | 13.x - 17.x | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/releases)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/4.1.1)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/4.1.1)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/4.1.1)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/4.1.1)
+
+#### Changelog
+<a id="Changelog-v4.1.1" data-scroll-offset></a>
+
+No Changes in this release
+
+### 4.1.0 Release Notes
+
+#### Release Date 26th November 2025
+
+#### Release Highlights
+Tyk Charts 4.1.0 is a version alignment release that ensures compatibility with the most recent Tyk LTS release [5.8.8](/developer-support/release-notes/dashboard#5-8-8-release-notes). Moreover, this release includes support for Kubernetes tolerations across all Tyk workloads and a new configuration option for Pod Topology Spread Constraints.
+
+For more information, please refer to the [changelog](#Changelog-v4.1.0) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-4.1.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency  | Tested Versions  | Compatible Versions  | Comments | 
+| ------------------------| ---------------- | -------------------- | -------- | 
+| [Kubernetes](https://kubernetes.io)   | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+ | | 
+| [Helm](https://helm.sh)               | 3.14.x              | 3.x  | | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | |
+| [Valkey](https://valkey.io/download/) | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8 | 5, 6, 7, 8 | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x | 13.x - 17.x | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v4.1.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/4.1.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/4.1.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/4.1.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/4.1.0)
+
+#### Changelog
+<a id="Changelog-v4.1.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Support for Kubernetes Tolerations in Tyk Helm Charts'>
+Added full support for configuring Kubernetes tolerations across all Tyk components (Gateway, Dashboard, MDCB, Pump, etc.) through Helm values.yaml. This enhancement allows teams to deploy Tyk workloads on their controlled node pools for improved compliance and performance.
+</Accordion>
+
+<Accordion title='Support for Pod Topology Spread Constraints in Tyk Gateway Helm Chart'>
+You can now configure Kubernetes Pod Topology Spread Constraints directly through the Tyk Gateway Helm Chart, allowing you to control how Gateway pods are distributed across availability zones or topology domains.
+
+This enables more resilient, highly available deployments and helps prevent all Gateway replicas from being scheduled in the same zone or node group. Existing users are unaffected, as the feature is disabled by default unless explicitly configured.
+</Accordion>
+
+</AccordionGroup>
+
+## 4.0 Release Notes
+
+### 4.0.1 Release Notes
+
+#### Release Date 21st October 2025
+
+#### Release Highlights
+Tyk Charts 4.0.1 is a version alignment release that ensures compatibility with the most recent Tyk LTS release [5.8.6](/developer-support/release-notes/dashboard#5-8-6-release-notes) and Developer Portal [1.14.1](/developer-support/release-notes/portal#1-14-1-release-notes). No functional changes have been implemented in this release.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-4.0.1"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency  | Tested Versions  | Compatible Versions  | Comments | 
+| :------------------------ | :---------------- | :-------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)   | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+ | | 
+| [Helm](https://helm.sh)               | 3.14.x              | 3.x  | | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | |
+| [Valkey](https://valkey.io/download/) | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8 | 5, 6, 7, 8 | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x | 13.x - 17.x | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/releases)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/4.0.1)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/4.0.1)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/4.0.1)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/4.0.1)
+
+#### Changelog
+<a id="Changelog-v4.0.1" data-scroll-offset></a>
+
+No changes in this release.
+
+### 4.0.0 Release Notes
+
+#### Release Date 26th September 2025
+
+#### Release Highlights
+
+This release includes improvements to support for Redis Sentinel deployments and updates the default charts to install the most recent Tyk LTS release [5.8.5](/developer-support/release-notes/dashboard#5-8-5-release-notes) and Developer Portal [1.14.0](/developer-support/release-notes/portal#1-14-0-release-notes).
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v4.0.0) below.
+
+#### Breaking Changes
+
+In this release, the MongoDB GraphQL Pump is not enabled by default. If you are using this Tyk Pump then you will need to enable it explicitly in your charts.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency  | Tested Versions  | Compatible Versions  | Comments | 
+| :------------------------ | :---------------- | :-------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)   | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+ | | 
+| [Helm](https://helm.sh)               | 3.14.x              | 3.x  | | 
+| [Redis](https://redis.io/download/)   | 5.x, 6.x, 7.x, 8.x (up to 8.2) | 5.x, 6.x, 7.x, 8.x (up to 8.2) | |
+| [Valkey](https://valkey.io/download/) | 7.2.x, 8.0.x, 8.1.x | 7.2.x, 8.0.x, 8.1.x | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 6, 7, 8 | 5, 6, 7, 8 | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x | 13.x - 17.x | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecation in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v4.0.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/4.0.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/4.0.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/4.0.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/4.0.0)
+
+#### Changelog
+<a id="Changelog-v4.0.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<Expandable title='Add Redis Sentinel Global Config Handler for Dashboard and MDCB Charts'>
+Added Helm Chart support for Redis Sentinel configurations using global values for both the Tyk Dashboard and MDCB charts to match the existing support in Tyk Gateway and Pump charts.
+</Expandable>
+
+
+
+##### Changed
+
+
+
+<Expandable title='Updated default versions of Tyk components'>
+Tyk Charts 4.0 will install the following Tyk components:
+
+- Tyk Gateway v5.8.5
+- Tyk Dashboard v5.8.5
+- Tyk Pump v1.12.0
+- Tyk MDCB v2.8.4
+- Tyk Developer Portal v1.14.0
+- Tyk Operator v1.2.0
+</Expandable>
+
+
+<Expandable title='Tyk Pump Helm Chart: GraphQL Pump disabled by default'>
+The Tyk Pump Helm Chart has been updated to disable the GraphQL Pump configuration by default for both MongoDB and PostgreSQL backends. This change provides users with explicit control to enable the pump via Helm values (e.g., `pump.mongoGraph.enabled`), addressing concerns about rapid storage increase. Users currently relying on the GraphQL Pump will need to enable it explicitly after this update.
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed Helm Charts bootstrap failure'>
+Resolved an issue where the Helm Charts bootstrap post-install job for tyk-stack failed due to an unnecessary requirement for an operator license, even when the operator was disabled by default. The bootstrap process now completes successfully without requiring the operator license.
+</Accordion>
+
+<Accordion title='Incorrect fsGroup Placement in Tyk Helm Chart'>
+Corrected the placement of the `fsGroup` field in the `tyk-stack` chart's `values.yaml` from `containerSecurityContext` to `podSecurityContext` to resolve pre-install job failures.
+</Accordion>
+
+<Accordion title='Fixed Redis Sentinel Password Configuration in Helm Charts'>
+Resolved an issue where the Redis Sentinel password ([TYK_GW_STORAGE_SENTINELPASSWORD](/tyk-oss-gateway/configuration#storage-sentinel_password)) was not correctly picked up by Helm charts. Previously, both Redis and Sentinel passwords referenced the same secret key, leading to the Sentinel password defaulting to the regular Redis password. This fix ensures correct handling of distinct Sentinel passwords.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+## 3.0 Release Notes
+
+### 3.0.0 Release Notes
+
+#### Release Date 02 April 2025
+
+#### Release Highlights
+
+Tyk Charts 3.0 significantly improves configurability, reliability, and support for Tyk 5.8. This release enhances monitoring capabilities, expands Helm chart flexibility, and resolves key issues related to service availability and configuration management.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v3.0.0) below.
+
+#### Breaking Changes
+Tyk Charts 3.0 introduces a breaking configuration changes for Tyk Dashboard: To provide a default secure configuration, `security.forbid_admin_view_access_token` and `security.forbid_admin_reset_access_token` are set to `true` to restrict admin users from being able to view and reset other users' Dashboard API Access Credentials.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 1.31.x, 1.32.x | 1.19+          |          | 
+| [Helm](https://helm.sh)                                    | 3.14.x                 | 3.x                    |          | 
+| [Redis](https://redis.io)                                  | 6.2.x, 7.x    | 6.2.x, 7.x    | Used by Tyk Gateway and Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 5.0.x, 6.0.x, 7.0.x | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecation in this release.
+
+#### Upgrade instructions
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v3.0.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/3.0.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/3.0.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/3.0.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/3.0.0)
+
+#### Changelog
+<a id="Changelog-v3.0.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+
+<AccordionGroup>
+<Accordion title='Pump: Readiness and liveness probes'>
+Added readiness and liveness probes using Tyk Pump's health check service, allowing proactive monitoring to detect failures and improve system reliability.
+</Accordion>
+
+<Accordion title='Global: imageRegistry configuration'>
+Added support for a global image registry, making it easier for users to configure private registries and streamline container image management.
+</Accordion>
+
+<Accordion title='Gateway: Tyk Gateway startup probes'>
+Added configurable startup probes for Tyk Gateway, improving readiness checks to prevent premature traffic routing during initialization.
+</Accordion>
+
+<Accordion title='Gateway: Tyk Gateway access/transaction logs'>
+Added support for configuring access logs in Tyk Gateway 5.8, allowing users to track API transaction logs for enhanced monitoring and debugging.
+</Accordion>
+
+<Accordion title='Gateway: OpenTelemetry header from Kubernetes secrets'>
+Added support for retrieving a single OpenTelemetry Authorization header from a Kubernetes secret, enhancing security by preventing exposure of sensitive credentials in Helm values or Kubernetes manifests.
+</Accordion>
+
+<Accordion title='Helm chart parameterization'>
+Replaced hardcoded values in Helm charts with configurable parameters, providing greater flexibility in deployment customization.
+</Accordion>
+
+<Accordion title='Operator and tyk-bootstrap: Tolerations, affinity, and node selector'>
+Added support for tolerations, affinity, and node selector configurations, enabling users to fine-tune Kubernetes scheduling for better resource allocation and workload distribution.
+</Accordion>
+
+<Accordion title='Configurable test pod execution'>
+Added support to enable or disable test pods, allowing users to optimize resource utilization based on their environment needs.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Changed
+
+
+
+
+<Expandable title='Support for restricting admin access token actions in Tyk Dashboard'>
+Improved security by setting security.forbid_admin_view_access_token and security.forbid_admin_reset_access_token to true by default, preventing admin users from viewing or resetting other users’ Dashboard API access credentials unless explicitly allowed.
+</Expandable>
+
+
+
+<Expandable title='Updated default versions of Tyk components'>
+Tyk Charts 3.0 will install the following Tyk component versions by default.
+
+  - Tyk Gateway v5.3.10
+  - Tyk Dashboard v5.3.10
+  - Tyk Pump v1.12.0
+  - Tyk MDCB v2.8.0
+  - Tyk Developer Portal v1.13.0
+  - Tyk Operator v1.2.0
+</Expandable>
+
+
+
+
+##### Fixed
+
+
+
+
+<AccordionGroup>
+<Accordion title='Pump: Pump service annotation issue'>
+Fixed an issue where service annotations for Tyk Pump were not being applied correctly, which caused misconfigurations in Kubernetes deployments. This has been resolved by ensuring annotations are properly processed.
+</Accordion>
+
+<Accordion title='Operator liveness and readiness probe failure'>
+Fixed an issue where the Operator’s liveness and readiness probes were failing, causing the service to enter a CrashLoopBackOff state. This has been resolved by adjusting configurations to ensure proper startup and health checks.
+</Accordion>
+
+<Accordion title='Incorrect TYK_DB_TYKAPI_HOST and TYK_DB_TYKAPI_PORT values'>
+Fixed an issue where TYK_DB_TYKAPI_HOST and TYK_DB_TYKAPI_PORT environment variables were incorrectly set when the Control API was enabled, leading to connectivity issues. This has been resolved by ensuring the correct values are assigned during configuration.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+{/* ##### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+## 2.2 Release Notes
+
+### 2.2.0 Release Notes
+
+#### Release Date 09 December 2024
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release: */}
+
+The Tyk Helm Charts v2.2.0 release brings exciting new features, improvements, and crucial fixes to enhance deployment flexibility, customization, and reliability. Here are the highlights:
+* Sidecar containers support
+* Dashboard enhancements: Configurable audit log storage, Open Policy Agent (OPA) settings
+* Gateway enhancements: Custom liveness and readiness probes, enhanced logging configuration, customizable HPA behavior
+* Operator updates: Custom deployment annotations, 
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.2.0) below.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention in the changelog section ALL changes in our application log messages. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates etc.
+##### Planned Breaking Changes */}
+
+{/* ##### Dependencies
+Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+{/* ###### Compatibility Matrix For Tyk Components
+Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. 
+| Gateway Version | Recommended Compatibility | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3 LTS | Helm v2.2     | Helm vX - vY |
+|         | MDCB v2.5     | MDCB v1.7 - v2.4 |
+|         | Operator v1.8 | Operator vX - vY |
+|         | Sync v2.4.1   | Sync vX - vY |
+| | | EDP vX - vY |
+| | | Pump vX - vY |
+| | | TIB vX - vY | */}
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x | 1.19+          |          | 
+| [Helm](https://helm.sh)                                    | 3.14.x                 | 3.x                    |          | 
+| [Redis](https://redis.io)                                  | 6.2.x, 7.x    | 6.2.x, 7.x    | Used by Tyk Gateway and Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 5.0.x, 6.0.x, 7.0.x | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecation in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens
+###### Future deprecations. */}
+
+#### Upgrade instructions
+{/* Required. For patches release (Z>0) use this: 
+For users currently on v2.1.x, we strongly recommend promptly upgrading to the latest release. 
+<br/> */}
+{/* Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions. */}
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v2.2.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/2.2.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/2.2.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/2.2.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/2.2.0)
+
+#### Changelog
+<a id="Changelog-v2.2.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+
+<AccordionGroup>
+<Accordion title='Global: Configurable Tyk streams setting'>
+User can enable or disable Tyk Streams feature via `global.streaming.enabled`. This option is enabled by default.
+</Accordion>
+
+<Accordion title='Dashboard: Configurable audit log storage'>
+Introduced new configuration options to manage audit logging for the Tyk Dashboard. This enhancement allows users to enable, customize, and specify how audit logs are stored and formatted.
+
+To configure, see [Tyk Stack](/product-stack/tyk-charts/tyk-stack-chart#audit-log-configurations) documentation.
+</Accordion>
+
+<Accordion title='Dashboard: Configurable Open Policy Agent (OPA) settings'>
+Introduced new options to enable and manage Open Policy Agent (OPA) support directly from the Helm chart. This feature simplifies the configuration process, guiding users to use the correct settings without relying on extraEnvs.
+
+To configure, see [Tyk Stack](/product-stack/tyk-charts/tyk-stack-chart#opa-configurations) documentation.
+</Accordion>
+
+<Accordion title='Gateway: Configurable liveness and readiness probes'>
+Support for configuring liveness and readiness probes for the Tyk Gateway via Helm charts.
+
+Users can now define custom configurations for these probes, providing more flexibility and control over health checks in Kubernetes deployments. Defaults are provided if custom configurations are not specified.
+
+This enhancement improves deployment reliability and ensures better integration with Kubernetes health monitoring systems.
+
+To configure, see [Tyk Stack](/product-stack/tyk-charts/tyk-stack-chart#gateway-probes) documentation.
+</Accordion>
+
+<Accordion title='Gateway: Enhanced log configuration'>
+Support for configuring the Tyk Gateway logging level and format through new fields under `.Values.gateway.log` in the Helm chart values.yaml.
+
+This enhancement enables fine-tuned control over logging behavior directly from the Helm chart, simplifying deployment customization.
+</Accordion>
+
+<Accordion title='Gateway: Customizable HPA behavior'>
+Users can now define custom HPA behavior settings directly in the Helm values file via a new field a new field: `.Values.gateway.autoscaling.behavior`.
+
+This enhancement provides more flexibility in configuring HPA scaling behavior, allowing tailored performance tuning for Gateway deployments.
+</Accordion>
+
+<Accordion title='Operator: Support for adding custom annotations to the Tyk Operator deployment'>
+Users can now specify annotations directly in the Helm values field `.Values.annotations`, enabling better integration with external tools and systems that rely on metadata annotations.
+</Accordion>
+
+<Accordion title='Configurable sidecar containers'>
+Support for adding sidecar containers for Tyk components, enhancing flexibility and integration capabilities. This feature allows for the addition of auxiliary containers through `extraContainers` field to the following components:
+
+- Tyk Gateway
+- Tyk Dashboard
+- Tyk MDCB
+- Tyk Pump
+- Tyk Enterprise Developer Portal
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Changed
+
+
+
+
+<Expandable title='Updated default versions of Tyk components'>
+Tyk Charts 2.2 will install the following Tyk component versions by default.
+
+  - Tyk Gateway v5.3.8
+  - Tyk Dashboard v5.3.8
+  - Tyk Pump v1.11.1
+  - Tyk MDCB v2.7.2
+  - Tyk Developer Portal v1.12.0
+  - Tyk Operator v1.1.0
+</Expandable>
+
+
+
+
+##### Fixed
+
+
+
+
+<AccordionGroup>
+<Accordion title='Gateway: Corrected template name for OpenTelemetry caFilePath'>
+Corrected the template name for the OpenTelemetry caFilePath in the Gateway configuration.
+Updated template reference from `otel-CAPath` to `otel-tlsCAPath` to ensure proper functionality.
+This fix addresses misconfigurations related to the OpenTelemetry TLS CA path and ensures accurate rendering of Gateway templates.
+</Accordion>
+
+<Accordion title='MDCB: Fixed MDCB service configuration when using LoadBalancer as the service type'>
+The `externalTrafficPolicy` field is now correctly set under the spec section instead of selectors.
+This fix ensures proper functionality and alignment with Kubernetes service configuration requirements.
+</Accordion>
+
+<Accordion title='Tyk Operator license key handling in tyk-oss chart'>
+Resolved an issue where the Tyk OSS chart did not set the Operator license key in the secret created for the Operator. This fix ensures seamless configuration of the license key when deploying Tyk Operator.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+{/* ##### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 2.1 Release Notes
+### 2.1.0 Release Notes
+
+#### Release Date 10 Oct 2024
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release: */}
+
+Added the ability to specify a static IP for Kubernetes LoadBalancer services, giving users more control over network configurations for the Tyk Gateway and Dashboard. Added an option to configure the Dashboard container port, addressing issues with restricted port permissions. Updated the default versions of Tyk components.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.1.0) below.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+However, if you are upgrading to [Tyk Operator v1.0](/developer-support/release-notes/operator#1-0-0-release-notes) using the Helm Chart, please read the [license requirement](/developer-support/release-notes/operator#breaking-changesv1.0.0) and Tyk Operator [installation and upgrade instructions](/tyk-stack/tyk-operator/installing-tyk-operator) carefully.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention in the changelog section ALL changes in our application log messages. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates etc.
+##### Planned Breaking Changes */}
+
+{/* ##### Dependencies
+Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+{/* ###### Compatibility Matrix For Tyk Components
+Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. 
+| Gateway Version | Recommended Compatibility | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3 LTS | Helm v2.2     | Helm vX - vY |
+|         | MDCB v2.5     | MDCB v1.7 - v2.4 |
+|         | Operator v1.8 | Operator vX - vY |
+|         | Sync v2.4.1   | Sync vX - vY |
+| | | EDP vX - vY |
+| | | Pump vX - vY |
+| | | TIB vX - vY | */}
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x | 1.19+          |          | 
+| [Helm](https://helm.sh)                                    | 3.14.x                 | 3.x                    |          | 
+| [Redis](https://redis.io)                                  | 6.2.x, 7.x    | 6.2.x, 7.x    | Used by Tyk Gateway and Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 5.0.x, 6.0.x, 7.0.x | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecation in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens
+###### Future deprecations. */}
+
+#### Upgrade instructions
+{/* Required. For patches release (Z>0) use this: */}
+For users currently on v2.0.x, we strongly recommend promptly upgrading to the latest release. 
+<br/>
+{/* Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions. */}
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v2.1.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/2.1.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/2.1.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/2.1.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/2.1.0)
+
+#### Changelog
+<a id="Changelog-v2.1.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+
+<AccordionGroup>
+<Accordion title='Ability to specify static IP for Kubernetes LoadBalancer service'>
+Added an optional `loadBalancerIP` parameter in the chart that allows users to set a static IP for Tyk Gateway and Dashboard services when using the `LoadBalancer` service type. This update provides enhanced control over IP configuration, useful for network stability in environments with multiple load balancers.
+
+Tyk gateway service configuration:
+- `tyk-gateway.gateway.service.loadBalancerIP` (default to "")
+
+Tyk Dashboard service configuration:
+- `tyk-dashboard.dashboard.service.loadBalancerIP` (default to "")
+</Accordion>
+
+<Accordion title='Ability to configure Dashboard container port'>
+Enables specifying an alternate port for the container while using standard ports in the service. This option resolves permission issues associated with restricted ports, such as port 443, within containers.
+</Accordion>
+
+<Accordion title='From v1.0 Tyk Operator Requires License Key'>
+Starting from Tyk Operator v1.0, a license key is required to use the Tyk Operator. You can provide it while installing Tyk Stack, Tyk Control Plane, or Tyk OSS helm chart by setting `global.license.operator` field. You can also set license key via a Kubernetes secret using `global.secrets.useSecretName` field. The secret should contain a key called `OperatorLicense`.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Changed
+
+
+
+
+<Expandable title='Updated default versions of Tyk components'>
+Tyk Charts 2.1 will install the following Tyk component versions by default.
+- Tyk Gateway v5.3.6
+- Tyk Dashboard v5.3.6
+- Tyk Pump v1.11.0
+- Tyk MDCB v2.7.1
+- Tyk Developer Portal v1.10.0
+- Tyk Operator v1.0.0
+</Expandable>
+
+
+
+
+{/* ##### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 2.0 Release Notes
+### 2.0.0 Release Notes
+
+#### Release Date 26 September 2024
+
+#### Breaking Changes
+
+##### 1. URL Path Matching Configuration Changes
+
+Tyk Charts v2.0 introduces a **breaking change** related to URL path matching behavior in the Tyk Gateway. If you are using Tyk Gateway versions 5.0.14 (2023 LTS), 5.3.5 (2024 LTS), or 5.5.1 (latest feature branch) or above, two new configuration options have been added to the Gateway:
+
+- `http_server_options.enable_path_prefix_matching`
+- `http_server_options.enable_path_suffix_matching`
+
+These options allow more restrictive URL path matching by controlling whether the request path matches the start or end of the specified pattern. If both are set to `true`, Tyk enforces "exact" path matching. By default, these options are set to `false` in the Gateway to avoid breaking existing configurations.
+
+However, starting with **Tyk Charts v2.0**, these options will be set to `true` by default, enforcing stricter security by requiring precise path matches. This change applies to new installations or upgrades via Tyk Charts v2.0 and above.
+
+From this version of Tyk Charts we also set the following configuration option to `true` by default as part of the stricter path matching:
+
+- `http_server_options.enable_strict_routes`
+
+**Impact on existing users:**
+
+- The change is **backward-compatible** for users upgrading their Tyk Gateway directly (i.e. not via Helm Chart), because by default, these features will not be active. This ensures that existing configurations are not affected if you update the Gateway manually.
+- However, **if you install or upgrade via Tyk Charts v2.0**, these options will be set to `true` by default. This means stricter URL path matching will be enforced automatically, which could impact your existing routes or configurations if you're not prepared for it. Please ensure you understand and test these new configurations before upgrading your production environment.
+
+**Action required:**
+
+- Familiarize yourself with Request Matching in Tyk [here](/getting-started/key-concepts/url-matching).
+- For production setup guidance, see [this guide](/planning-for-production#ensure-you-are-matching-only-the-url-paths-that-you-want-to-match).
+- Configure the new options via the Helm chart, and test the changes in a non-production environment before upgrading.
+
+##### 2. Default Tyk Component Versions
+
+This release changes the default component versions in Tyk Charts v2.0 to **Long-Term Support (LTS)** versions for greater stability in production environments. The new defaults are:
+
+|Tyk Component|Default Version|Customization Parameter|
+| :--- | :--- | :--- |
+|Tyk Gateway|5.3.5 LTS|`--set tyk-gateway.gateway.image.tag=<desired-version>`|
+|Tyk Dashboard|5.3.5 LTS|`--set tyk-dashboard.dashboard.image.tag=<desired-version>`|
+|Tyk Pump|1.11.0|`--set tyk-pump.pump.image.tag=<desired-version>`|
+|Tyk MDCB|2.7.0|`--set tyk-mdcb.mdcb.image.tag=<desired-version>`|
+|Tyk Developer Portal|1.10.0|`--set tyk-dev-portal.image.tag=<desired-version>`|
+|Tyk Operator|0.18.0|`--set tyk-operator.image.tag=<desired-version>`|
+
+If you need to use a different version for any component, adjust the Helm chart parameters during installation or upgrade.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention in the changelog section ALL changes in our application log messages. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates etc.
+##### Planned Breaking Changes */}
+
+{/* ##### Dependencies
+Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+{/* ###### Compatibility Matrix For Tyk Components
+Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. 
+| Gateway Version | Recommended Compatibility | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3 LTS | Helm v2.2     | Helm vX - vY |
+|         | MDCB v2.5     | MDCB v1.7 - v2.4 |
+|         | Operator v1.8 | Operator vX - vY |
+|         | Sync v2.4.1   | Sync vX - vY |
+| | | EDP vX - vY |
+| | | Pump vX - vY |
+| | | TIB vX - vY | */}
+
+#### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x | 1.19+          |          | 
+| [Helm](https://helm.sh)                                    | 3.14.x                 | 3.x                    |          | 
+| [Redis](https://redis.io)                                  | 6.2.x, 7.x    | 6.2.x, 7.x    | Used by Tyk Gateway and Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 5.0.x, 6.0.x, 7.0.x | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecation in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens
+###### Future deprecations. */}
+
+#### Upgrade instructions
+{/* Required. For patches release (Z>0) use this: */}
+For users currently on v1.x.x, we strongly recommend promptly upgrading to the latest release. 
+<br/>
+{/* Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions. */}
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release: */}
+
+##### Support Gateway configuration for URL path matching
+The default Gateway configuration in the Helm chart will set Tyk's URL path matching to **exact** mode. This ensures that the request URL must exactly match the listen path and endpoint patterns configured in the API definition. 
+
+##### Updated default Tyk versions
+Tyk Charts 2.0 will install the following Tyk component versions by default.
+- Tyk Gateway v5.3.5
+- Tyk Dashboard v5.3.5
+- Tyk Pump v1.11.0
+- Tyk MDCB v2.7.0
+- Tyk Developer Portal v1.10.0
+- Tyk Operator v0.18.0
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v2.0.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/2.0.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/2.0.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/2.0.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/2.0.0)
+
+#### Changelog
+<a id="Changelog-v2.0.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+
+
+<Expandable title='Support for New Path Matching Configuration Options'>
+Tyk Charts v2.0 introduces support for the newly added Tyk Gateway configuration options: `enable_path_prefix_matching` and `enable_path_suffix_matching`. These settings allow more secure and explicit URL matching by restricting path pattern matching to the start or end of the request path. This enhancement benefits customers who need more precise route matching to ensure that only intended paths are matched in production environments, reducing the risk of unintentional routing.
+
+URL path matching mode is configurable using these `tyk-gateway` chart parameters:
+
+- `gateway.enablePathPrefixMatching` (default to `true`)
+- `gateway.enablePathSuffixMatching` (default to `true`)
+- `gateway.enableStrictRoutes` (default to `true`)
+
+Learn more about the settings in the [Request Matching](/getting-started/key-concepts/url-matching) documentation.
+</Expandable>
+
+
+
+<Expandable title='Configuration for Extra Volume Mounts in Tyk-Bootstrap'>
+This release adds support for `extraVolumes` and `extraVolumeMounts` parameters in the `tyk-bootstrap` charts, enabling users to mount additional volumes. This is especially useful for users with custom storage or configuration needs in their deployments, offering more flexibility in managing their Tyk installation.
+
+The options are configurable using these `tyk-bootstrap` chart's parameters:
+
+- `bootstrap.extraVolumes` (default to empty list)
+- `bootstrap.extraVolumeMounts` (default to empty list)
+</Expandable>
+
+
+
+
+{/* ###### Changed
+<!-- This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+##### Changed
+
+
+
+
+<Expandable title='Default to Long-Term Support (LTS) Versions for Components'>
+Tyk Charts v2.0 now defaults to Long-Term Support (LTS) versions for Tyk Gateway and Tyk Dashboard. This change ensures greater stability and long-term support for customers deploying Tyk in production environments, reducing the risk of issues due to feature branch releases. Users can still override these versions if needed, but the default will provide a more predictable upgrade path for most use cases.
+</Expandable>
+
+
+
+
+{/* ##### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 1.6 Release Notes
+### 1.6.0 Release Notes
+
+#### Release Date 14 August 2024
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention in the changelog section ALL changes in our application log messages. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates etc.
+##### Planned Breaking Changes */}
+
+{/* ##### Dependencies
+Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+{/* ###### Compatibility Matrix For Tyk Components
+Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. 
+| Gateway Version | Recommended Compatibility | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3 LTS | Helm v2.2     | Helm vX - vY |
+|         | MDCB v2.5     | MDCB v1.7 - v2.4 |
+|         | Operator v1.8 | Operator vX - vY |
+|         | Sync v2.4.1   | Sync vX - vY |
+| | | EDP vX - vY |
+| | | Pump vX - vY |
+| | | TIB vX - vY | */}
+
+#### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x | 1.19+          |          | 
+| [Helm](https://helm.sh)                                    | 3.14.x                 | 3.x                    |          | 
+| [Redis](https://redis.io)                                  | 6.2.x, 7.x    | 6.2.x, 7.x    | Used by Tyk Gateway and Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 5.0.x, 6.0.x, 7.0.x | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecation in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens
+###### Future deprecations. */}
+
+#### Upgrade instructions
+{/* Required. For patches release (Z>0) use this: */}
+For users currently on v1.4.x, we strongly recommend promptly upgrading to the latest release. 
+<br/>
+{/* Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions. */}
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release: */}
+
+##### Updated MDCB Health check probes
+MDCB v2.7.0 release introduces `/liveness` and `/readiness` probes which give more accurate and detail health check information. MDCB deployment has been updated to use the new endpoints. See [MDCB Health Check](/api-management/mdcb#health-check) section for information about the new probes.
+
+##### Updated default Tyk versions
+Tyk Charts 1.6 will install the following Tyk component versions by default.
+- Tyk Gateway v5.5.0
+- Tyk Dashboard v5.5.0
+- Tyk Pump v1.11.0
+- Tyk MDCB v2.7.0
+- Tyk Developer Portal v1.10.0
+- Tyk Operator v0.18.0
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v1.6.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/1.6.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/1.6.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/1.6.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/1.6.0)
+
+#### Changelog
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+
+
+<Expandable title='MDCB: Added option to configure healthcheck cache renewal period'>
+Added `mdcb.healthcheck.cache_renewal_period` which configures the time interval (in seconds) at which the healthchecker refreshes its cached health status information (Redis and DB). Default to 10 (seconds).
+</Expandable>
+
+
+
+<Expandable title='MDCB: Added Ingress to HTTP services'>
+Added Ingress resource for MDCB HTTP service at port `http_port`.
+
+```yaml
+tyk-mdcb:
+  mdcb:
+   # New HTTP ingress for port 8181
+   http_ingress:
+     enabled: false
+     # className specifies your ingress controller class name below
+     className: ""
+     # annotations specifies annotations to be added on Ingress resource.
+     annotations: { }
+       # kubernetes.io/ingress.class: nginx
+       # kubernetes.io/tls-acme: "true"
+     # hosts corresponds to the rules to be added on Ingress rules.
+     hosts:
+       - host: mdcb-http.example.com
+         paths:
+           - path: /
+             pathType: ImplementationSpecific
+     # tls corresponds to the tls configuration if Ingress rules use TLS
+     tls: []
+     #  - secretName: chart-example-tls
+     #    hosts:
+     #      - chart-example.local
+```
+</Expandable>
+
+
+
+
+{/* ###### Changed
+<!-- This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+
+
+<Expandable title='MDCB: Updated liveness and readiness probes'>
+Updated MDCB liveness and readiness probes to `/liveness` and `/readiness` respectively. These endpoints are available from MDCB v2.7.0. If you are deploying an earlier version of MDCB, please update the paths to `/health` in values.yaml file.
+For more details about new endpoints, check [MDCB Health check](/api-management/mdcb#health-check) section.
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Portal: Ingress resource should not be created if not enabled'>
+Fixed the issue that when Developer Portal component is enabled, an Ingress resource is being created, although Portal Ingress is not enabled.
+</Expandable>
+
+
+
+
+
+
+{/* ##### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 1.5 Release Notes
+### 1.5.0 Release Notes
+
+#### Release Date 4 July 2024
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention in the changelog section ALL changes in our application log messages. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates etc.
+##### Planned Breaking Changes */}
+
+{/* ##### Dependencies
+Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+{/* ###### Compatibility Matrix For Tyk Components
+Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. 
+| Gateway Version | Recommended Compatibility | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3 LTS | Helm v2.2     | Helm vX - vY |
+|         | MDCB v2.5     | MDCB v1.7 - v2.4 |
+|         | Operator v1.8 | Operator vX - vY |
+|         | Sync v2.4.1   | Sync vX - vY |
+| | | EDP vX - vY |
+| | | Pump vX - vY |
+| | | TIB vX - vY | */}
+
+#### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+With PostgreSQL v11 has reach [EOL](https://www.postgresql.org/support/versioning/) on November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated below.
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x, 1.27.x, 1.28.x, 1.29.x | 1.19+          |          | 
+| [Helm](https://helm.sh)                                    | 3.14.x                 | 3.x                    |          | 
+| [Redis](https://redis.io)                                  | 6.2.x, 7.x    | 6.2.x, 7.x    | Used by Tyk Gateway and Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 5.0.x, 6.0.x, 7.0.x | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x        | 12.x - 16.x            | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+###### MDCB: Deprecated healthcheck_port and replaced with http_port
+
+Starting with MDCB v2.6.0, the configuration parameter `http_port` has been introduced to replace the original `healthcheck_port`. This new HTTP port is designed to expose various endpoints for monitoring and debugging MDCB. For consistency and future compatibility, it is recommended to use `mdcb.httpPort`.
+
+####### Backward compatibility:
+
+The `mdcb.httpPort` parameter is backward compatible, meaning it will function correctly with all existing MDCB versions, ensuring a smooth transition.
+
+####### Recommendations for users:
+
+- **Helm Chart Adjustments**: Update your Helm chart configurations to use `mdcb.httpPort` instead of `mdcb.probes.healthcheckPort` to define the HTTP port.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens
+###### Future deprecations. */}
+
+#### Upgrade instructions
+{/* Required. For patches release (Z>0) use this: */}
+For users currently on v1.4.x, we strongly recommend promptly upgrading to the latest release. 
+<br/>
+{/* Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions. */}
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release: */}
+
+###### Updated default Tyk versions
+Tyk Charts 1.5 will install the following Tyk component versions by default.
+- Tyk Gateway v5.4.0
+- Tyk Dashboard v5.4.0
+- Tyk Pump v1.10.0
+- Tyk MDCB v2.6.0
+- Tyk Developer Portal v1.9.0
+- Tyk Operator v0.18.0
+
+###### Tyk Operator is covered under the same umbrella
+Tyk Operator can now be installed as an optional component alongside any of the following Tyk umbrella charts:
+- tyk-oss
+- tyk-stack
+- tyk-control-plane
+
+With bootstrapping, the `tyk-operator-conf` secret will be automatically configured during the bootstrapping process. This means that the Tyk Operator will be ready for use with just one command, simplifying the deployment and configuration process.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.5.0) below.
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v1.5.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/1.5.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/1.5.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/1.5.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/1.5.0)
+
+#### Changelog
+<a id="Changelog-v1.5.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+
+
+<AccordionGroup>
+<Accordion title='Gateway: Add option to enable fixed window rate limiter'>
+New field `gateway.enableFixedWindowRateLimiter` added to `tyk-gateway` chart.
+
+This feature allows users to enable fixed window rate limiter in the Gateway. The fixed window rate limiter feature permits requests up to the configured rate limit within a specified time window, after which any additional requests are blocked until the next window. This method has minimal impact on Redis and is straightforward to implement. However, it should be noted that it does not protect against traffic spikes as it lacks spike arrest behavior. The default value for this setting is `false`.
+</Accordion>
+
+<Accordion title='Dashboard and Gateway: Add init containers resources parameters'>
+Optional parameters `dashboard.initContainers.initAnalyticsConf.resources` and `gateway.initContainers.setupDirectories.resources` added to set resources for init containers in Dashboard and Gateway charts respectively.
+
+This feature is introduced to allow the definition of resource parameters for init containers, which is particularly useful in environments with namespace quotas that require specific resource definitions. Users can now specify the resources for init containers to comply with namespace resource quotas, ensuring that the init containers operate within the defined resource limits. The resource parameters can be defined at below locations.
+
+Tyk Dashboard chart
+
+```yaml
+dashboard:
+  initContainers:
+    initAnalyticsConf:
+      resources: {}
+      # If you do want to specify resources, uncomment the following
+      # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+      # requests:
+      #   cpu: 100m
+      #   memory: 128Mi
+```
+
+Tyk Gateway chart
+
+```yaml
+gateway:
+  initContainers:
+    setupDirectories:
+	    resources: {}
+      # If you do want to specify resources, uncomment the following
+      # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+      # requests:
+      #   cpu: 100m
+      #   memory: 128Mi
+```
+</Accordion>
+
+<Accordion title='MDCB: Added SSL configurations for MDCB HTTP server'>
+Added `mdcb.httpServerOptions` for SSL configuration of the MDCB HTTP server.
+
+This feature allows users to enable SSL for the MDCB HTTP server by configuring SSL-specific options. Users can enhance the security of their MDCB HTTP server by enabling SSL. The configuration includes settings such as `useSSL`, `certificateKeyFile`, `certificateCertFile`, and `minVersion`. For other HTTP server options, users can utilize `extraEnvs` to configure additional parameters.
+
+```yaml
+mdcb:
+  # defines the SSL/TLS settings for the http server where the healthcheck is exposed
+  httpServerOptions:
+    # if enabled then the endpoints will be served over https
+    useSSL: true
+    certificateKeyFile: /path-to-cert-keyfile
+    certificateCertFile: /path-to-certfile
+    
+    # For TLS 1.0 use 769, for TLS 1.1 use 770, for TLS 1.2 use 771, for TLS 1.3 use 772
+    minVersion: 771
+```
+</Accordion>
+
+<Accordion title='MDCB: Deprecated Healthcheck Port and added HTTP Port'>
+`mdcb.httpPort` added to define the port used for accessing MDCB HTTP endpoints.
+
+This change deprecates the previous healthcheck port in favor of using a defined HTTP port for accessing MDCB HTTP endpoints. This update streamlines the configuration by consolidating the HTTP endpoints under a single port setting, making it simpler to manage and configure the MDCB health checks.
+
+```yaml
+mdcb:
+  # This is the preferred port setting for MDCB >= v2.6.0.
+  # Users should use httpPort instead of probes.healthCheckPort for newer versions.
+  httpPort: 8181
+
+  probes:
+    # This port lets MDCB allow standard health checks.
+    # It also defines the path for liveness and readiness probes.
+    # It is used to set TYK_MDCB_HEALTHCHECKPORT and TYK_MDCB_HTTPPORT when mdcb >= v2.6.0
+    # This field will be deprecated in upcoming release. Use `httpPort` instead.
+    # healthCheckPort: 8181
+```
+</Accordion>
+
+<Accordion title='Add tyk-operator dependency to umbrella charts'>
+`global.components.operator` added to determine whether the Tyk Operator component should be installed.
+
+This feature adds a dependency on the Tyk Operator to the umbrella charts, facilitating the installation of the Tyk Operator component. Users can now easily install the Tyk Operator component by setting the `global.components.operator` parameter. Note that the Tyk Operator requires `cert-manager` to be installed beforehand. It also expects secret `tyk-operator-conf` is present in the installation namespace. You can enable bootstrapping at `global.components.bootstrap` if you are working on a new installation to have this secret created for you. Refer to the Tyk Operator [installation guide](/tyk-stack/tyk-operator/installing-tyk-operator) for detailed information on pre-requisites.
+
+```yaml
+global:
+  components:
+    # operator determines whether Tyk Operator component should be installed or not.
+    # Tyk Operator needs cert-manager to be installed beforehand. Make sure that cert-manager is installed.
+    # For further details, please refer to https://tyk.io/docs/api-management/automations#install-and-configure-tyk-operator/
+    operator: false
+```
+</Accordion>
+
+<Accordion title='Add annotations to Tyk Stack and component Helm Charts'>
+Introduced `annotations` values to the Tyk stack and component Helm charts to define annotations for Deployments or StatefulSets.
+
+This enhancement allows users to define custom annotations for the Deployments or StatefulSets of Tyk components. Annotations are useful for supporting automated reloading of the Gateway or other components using tools like reloader. Previously, the Helm charts did not support any annotations at the deployment level.
+
+Users can now add custom annotations to facilitate automation and improve the management of Tyk components. The following annotations have been added:
+- Dashboard: `dashboard.annotations` for Tyk Dashboard Deployment/StatefulSet
+- Dev Portal: `annotations` for Tyk Developer Portal Deployment/StatefulSet
+- Gateway: `gateway.annotations` for Tyk Gateway Deployment/StatefulSet
+- MDCB: `mdcb.annotations` for MDCB Deployment/StatefulSet
+- Pump: `pump.annotations` for Tyk Pump Deployment
+</Accordion>
+</AccordionGroup>
+
+
+
+
+{/* ###### Changed
+<!-- This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+##### Fixed
+
+
+
+
+<AccordionGroup>
+<Accordion title='Dashboard: Fix misconfiguration preventing detail log display with Mongo Pump'>
+This fix addresses a misconfiguration in the Dashboard chart that was causing the Log Browser not showing API activity logs for users utilizing Mongo Pump. The default configuration `dashboard.useShardedAnalytics` is now set to `true`, ensuring proper log visibility. Users who use Mongo Pump will now be able to view the API activity log as expected. Additionally, the correct Dashboard environment variable `TYK_DB_USESHARDEDANLAYTICS` is now set using `dashboard.useShardedAnalytics`. This enhancement ensures accurate log visibility and improves the overall user experience with the Dashboard by properly configuring sharded analytics.
+</Accordion>
+
+<Accordion title='Gateway: Fix issue with control port and `latest` container image tag'>
+Resolved an issue in the Gateway chart that prevented the use of a container image with the `latest` tag when `gateway.control.enabled` is set to `true`.
+
+This fix addresses a problem in the Gateway chart where enabling the control port (`gateway.control.enabled`) would cause an error if the container image tag was set to `latest`. The helm chart template previously assumed that all images would use semantic versioning.
+
+Users can now use the `latest` tag for container images even when the control port is enabled. This enhancement removes the restriction and assumption of semantic versioning, providing more flexibility in specifying container image tags.
+</Accordion>
+
+<Accordion title='Dev Portal: Fix issue that prevent bootstrap and developer portal to be enabled at the same time'>
+Resolved an issue in `tyk-stack` and `tyk-control-plane` chart that prevented bootstrap and devPortal components to be enabled at the same time.
+
+When user deploy Developer Portal using `tyk-stack` or `tyk-control-plane` Helm Chart, there was a problem before that bootstrapping and devPortal cannot be enabled at the same time. It was because dev portal was depending on secret `tyk-dev-portal-conf` to start up but the secret can only be created after all pods has been created successfully via the bootstrapping job. This problem arises when user use `--wait` flag in helm install or use ArgoCD for installation.
+
+We have fixed this issue by not passing required org ID and API key as command option during portal startup. The dev portal is configured after Pod creation via Dev Portal API.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+
+{/* ##### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 1.4 Release Notes
+### 1.4.0 Release Notes
+
+#### Release Date -- 6 May 2024
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention in the changelog section ALL changes in our application log messages. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates etc.
+##### Planned Breaking Changes */}
+
+{/* ##### Dependencies
+Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+{/* ###### Compatibility Matrix For Tyk Components
+Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. 
+| Gateway Version | Recommended Compatibility | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3 LTS | Helm v2.2     | Helm vX - vY |
+|         | MDCB v2.5     | MDCB v1.7 - v2.4 |
+|         | Operator v1.8 | Operator vX - vY |
+|         | Sync v2.4.1   | Sync vX - vY |
+| | | EDP vX - vY |
+| | | Pump vX - vY |
+| | | TIB vX - vY | */}
+
+#### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x, 1.27.x, 1.28.x, 1.29.x | 1.19+          |          | 
+| [Helm](https://helm.sh)                                    | 3.14.x                 | 3.x                    |          | 
+| [Redis](https://redis.io)                                  | 6.2.x, 7.x    | 6.2.x, 7.x    | Used by Tyk Gateway and Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by Tyk Dashboard, Pump, and MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 11.x - 15.x LTS        | 11.x - 15.x            | Used by Tyk Dashboard, Pump, and MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+- In the `tyk-dashboard` chart, the `dashboard.hashKeys` field is deprecated and has been replaced with `.global.hashKeys`. This is to ensure Dashboard, Gateway, and MDCB always get the same hashKeys configurations. Setting `dashboard.hashKeys` will no longer take effect. Please only use `.global.hashKeys` field.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens
+###### Future deprecations. */}
+
+#### Upgrade instructions
+{/* Required. For patches release (Z>0) use this: */}
+For users currently on v1.3.x, we strongly recommend promptly upgrading to the latest release. 
+<br/>
+{/* Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions. */}
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release: */}
+
+##### General availability release of tyk-control-plane chart and tyk-mdcb chart
+We're pleased to announce the official release of the Tyk Helm Charts for Tyk Control Plane and MDCB! Following a successful beta phase, these charts are now stable and ready for production use. 
+
+With this release, we aim to provide a straightforward solution for deploying and managing Tyk Control Plane and Multi-Data Center Bridge (MDCB) using Helm Charts. Whether you're looking for our recommended setup configurations or need flexibility to adapt to your architectural requirements, our Helm Charts have you covered.
+
+To leverage this stable release and simplify your Tyk deployments, we invite you to explore our example setup for MDCB Control Plane using Helm Chart. Simply follow our [MDCB Control Plane setup guide](/api-management/mdcb#setup-mdcb-control-plane) to get started.
+
+##### Updated default Tyk versions
+Tyk Charts 1.4 will install the following Tyk component versions by default.
+- Tyk Gateway v5.3.1
+- Tyk Dashboard v5.3.1
+- Tyk Pump v1.9.0
+- Tyk MDCB v2.5.1
+- Tyk Developer Portal v1.8.5
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.4.0) below.
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v1.4.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/1.4.0)
+- [ArtifactHub - tyk-control-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-control-plane/1.4.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/1.4.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/1.4.0)
+
+#### Changelog
+<a id="Changelog-v1.4.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+
+
+<AccordionGroup>
+<Accordion title='OSS: Simplify Tyk Operator setup with Kubernetes Secret creation'>
+When you set `operatorSecret.enabled` to `true` in the `tyk-oss` chart, a Kubernetes Secret named `tyk-operator-conf` will be automatically created in the same namespace. This secret is essential for connecting Tyk Operator to the Gateway, enabling seamless management of Tyk API resources. To learn more about setting up Tyk Operator, check out [Tyk Operator installation](/tyk-stack/tyk-operator/installing-tyk-operator).
+</Accordion>
+
+<Accordion title='MDCB: Enhanced analytics configuration options'>
+We have introduced new configuration options for handling analytics data flow in MDCB deployments. By default, MDCB stores aggregated analytics data from the data plane pump to SQL/Mongo. Additionally, users have the flexibility to enable Pump in the control plane, allowing MDCB to send analytics to Redis instead.
+
+Here are the default configurations:
+```yaml 
+mdcb:
+  # When it is set to true, instead of sending analytics directly to MongoDB / SQL,
+  # MDCB can send analytics to Redis. This will allow tyk-pump to pull
+  # analytics from Redis and send to your own data sinks.
+  # It is used to set TYK_MDCB_FORWARDANALYTICSTOPUMP
+  forwardAnalyticsToPump: false
+
+  # This enables saving analytics in multiple keys as oppose to just having one.
+  # It is useful when using a Redis cluster.
+  # It also only works when TYK_MDCB_FORWARDANALYTICSTOPUMP is set to true.
+  enableMultipleAnalyticsKey: true
+
+  # This should be set to true if you choose not to store selective analytics
+  dontStoreSelective: false
+
+  # This should be set to true if you choose not to store aggregate analytics
+  dontStoreAggregate: false
+
+  # If set to true then it will not store analytics for tags having prefix specified in the list.
+  # NB: Prefix “key-” is added in the list by default. This tag is added by gateway for keys.
+  ignoreTagPrefixList: []
+
+  # If enabled, it will store analytics for all the endpoints, irrespective of Track Endpoint plugin.
+  trackAllPaths: false
+
+  # If enabled, aggregate data will be generated per minute.
+  storeAnalyticsPerMinute: false   
+```
+</Accordion>
+
+<Accordion title='Tyk Control Plane: Added option to enable Dashboard hybrid organization'>
+We've added a convenient option to enable dashboard hybrid organization during bootstrapping. This eliminates the manual step of calling the Dashboard Admin API post-deployment to enable hybrid organization, which is essential for MDCB deployment.
+</Accordion>
+
+<Accordion title='Enhanced security with customizable Pod or Container security context'>
+To harden security, we have made security context of all Pods and Containers customizable. Also, we have set `runAsNonRoot: true` in all Pod's `securityContext`. This prevents the Pods from running as root users, ensuring compatibility with the [*Restricted* Pod Security Policy](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted).
+</Accordion>
+
+<Accordion title='Gateway: Allow Gateway to be updated if secret value is updated'>
+We've introduced an annotation with a checksum of the secret as a value, triggering a deployment change when the secret is updated. This ensures that pods are replaced promptly, immediately utilizing the new values from the secret. This logic applies if `global.secrets.useSecretName` is not set, as the secret is then not part of the chart.
+</Accordion>
+
+<Accordion title='Customizable Pod Labels Across All Components'>
+Now, you have the flexibility to customize Pod labels in all component charts. Simply populate the `podLabels` field with your desired content, and it will be added as pod labels.
+</Accordion>
+
+<Accordion title='Portal: Customizable Pod annotations in tyk-dev-portal'>
+We've added a `podAnnotations` field to the `tyk-dev-portal` chart, allowing you to customize pod annotations. Fill in the `podAnnotations` field with your specific content, and it will be added as pod annotations.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+###### Changed
+{/* This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+
+<AccordionGroup>
+<Accordion title='Gateway/Pump: Removed the command in Gateway and Pump pod templates'>
+We've removed unnecessary commands from the Gateway and Pump pod templates, allowing for the utilization of entrypoint scripts.
+</Accordion>
+
+<Accordion title='Dashboard: Allow arbitary image tags in tyk-dashboard'>
+Now, you can use arbitrary image tags, including non-Semantic Versioning tags like `latest` for Dashboard. We've bypassed version checking in the Dashboard Deployment template to accommodate this flexibility.
+</Accordion>
+
+<Accordion title='Dashboard: Classic portal bootstrapping disabled by default'>
+To avoid confusion with the latest Developer Portal, Classic Portal bootstrapping is now disabled by default in the Dashboard. If you wish to utilize the Classic Portal, simply enable it by setting `tyk-bootstrap.bootstrap.portal` to `true` in either the Tyk Stack or Tyk Control Plane chart.
+</Accordion>
+
+<Accordion title='Dashboard: Deprecation of `hashKeys` field'>
+The `dashboard.hashKeys` field is now deprecated. Instead, users should utilize the `global.hashKeys` field to set key hashing. This ensures configuration alignment across Gateway, Dashboard, and MDCB components.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Global: Redis TLS version specification'>
+We've corrected a typo in the values.yaml file within the "global.redis" section. The fields `sslMinVersion` and `sslMaxVersion` have been updated to `tlsMinVersion` and `tlsMaxVersion`, respectively. This ensures accurate specification of the Redis TLS version for enhanced security.
+</Expandable>
+
+
+
+
+
+{/* ##### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 1.3. Release Notes
+### 1.3.0 Release Notes
+
+#### Release Date 05 Apr 2024
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+For MongoDB users: Tyk Charts 1.3.0 uses `mongo-go` as the default driver to connect to MongoDB. `mongo-go` driver is compatible with MongoDB 4.4.x and above. For MongoDB versions prior to 4.4, please set `global.mongo.driver` to `mgo`. We recommend reading [Choose a MongoDB driver](/planning-for-production/database-settings#mongodb) when you need to change driver setting.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention in the changelog section ALL changes in our application log messages. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates etc.
+##### Planned Breaking Changes */}
+
+{/* ##### Dependencies
+Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+{/* ###### Compatibility Matrix For Tyk Components
+Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+An illustrative example is shown below. 
+| Gateway Version | Recommended Compatibility | Backwards Compatibility |
+| :---- | :---- | :---- |
+| 5.3 LTS | Helm v2.2     | Helm vX - vY |
+|         | MDCB v2.5     | MDCB v1.7 - v2.4 |
+|         | Operator v1.8 | Operator vX - vY |
+|         | Sync v2.4.1   | Sync vX - vY |
+| | | EDP vX - vY |
+| | | Pump vX - vY |
+| | | TIB vX - vY | */}
+
+#### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x, 1.27.x, 1.28.x, 1.29.x | 1.19+          |          | 
+| [Helm](https://helm.sh)                                    | 3.14.x                 | 3.x                    |          | 
+| [Redis](https://redis.io)                                  | 6.2.x, 7.x    | 6.2.x, 7.x    | Used by Tyk Gateway and Dashboard | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by Tyk Dashboard | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 11.x - 15.x LTS        | 11.x - 15.x            | Used by Tyk Dashboard | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+##### Future deprecations
+- In `tyk-dashboard` chart, `dashboard.hashKeys` field will be deprecated in future and be replaced with `.global.hashKeys`. This is to ensure Dashboard, Gateway, and MDCB always get the same hashKeys configurations. It is recommended users do not set `dashboard.hashKeys` and only use `.global.hashKeys` field.
+
+#### Upgrade instructions
+{/* Required. For patches release (Z>0) use this: */}
+For users currently on v1.2.x, we strongly recommend promptly upgrading to the latest release. 
+<br/>
+{/* Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions. */}
+You can use helm upgrade to upgrade your release
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade [RELEASE_NAME] tyk-helm/[CHART_NAME]
+```
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release: */}
+This release primarily focuses on adding support for Tyk v5.3 configurations.
+
+Tyk Charts 1.3 will install the following Tyk component versions by default.
+- Tyk Gateway v5.3.0
+- Tyk Dashboard v5.3.0
+- Tyk Pump v1.9.0
+- Tyk MDCB v2.5.0
+- Tyk Developer Portal v1.8.3
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.3.0) below.
+
+##### Support new features available from Tyk v5.3.0
+Tyk Charts 1.3 adds support for a number of new Tyk features available from Tyk 5.3.0. These include: Support use of SSL certificates when connecting to Redis, Configurations for OAS Validate examples and OAS Validate Schema defaults.
+
+##### Graph Pump
+Tyk Charts 1.3 adds support for Graph MongoDB Pump, Graph SQL Pump and Graph SQL Aggregate Pump. see [Graph Pump setup](/api-management/dashboard-analytics/control-plane-pumps#mongodb) to learn more about the GraphQL-specific metrics available.
+
+##### Enable Tyk Identity Broker (TIB) in Tyk Dashboard
+Tyk Charts 1.3 adds a field to enable Internal [Tyk Identity Broker (TIB)](/tyk-identity-broker/overview) in Tyk Dashboard by field `tyk-dashboard.tib.enabled` to `true`.
+
+#### Downloads
+- [Source code](https://github.com/TykTechnologies/tyk-charts/archive/refs/tags/v1.3.0.tar.gz)
+- [ArtifactHub - tyk-stack](https://artifacthub.io/packages/helm/tyk-helm/tyk-stack/1.3.0)
+- [ArtifactHub - tyk-data-plane](https://artifacthub.io/packages/helm/tyk-helm/tyk-data-plane/1.3.0)
+- [ArtifactHub - tyk-oss](https://artifacthub.io/packages/helm/tyk-helm/tyk-oss/1.3.0)
+
+#### Changelog
+<a id="Changelog-v1.3.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+
+
+<AccordionGroup>
+<Accordion title='Global config: Support use of SSL certificates when connecting to Redis'>
+Added following fields in `global.redis` to support use of SSL certificates when connecting to Redis.
+
+```yaml
+    # Allows usage of self-signed certificates when connecting to an encrypted Redis database.
+    # sslInsecureSkipVerify: false
+
+    # Path to the CA file.
+    # sslCAFile: ""
+
+    # The Volume mount path
+    # Default value: /etc/certs
+    # certificatesMountPath: ""
+
+    # Path to the cert file.
+    # sslCertFile: ""
+
+    # Path to the key file.
+    # sslKeyFile: ""
+
+    # Maximum supported TLS version. Valid values are TLS 1.0, 1.1, 1.2, 1.3.
+    # Default value: 1.3
+    # sslMaxVersion: "1.3"
+
+    # Minimum supported TLS version. Valid values are TLS 1.0, 1.1, 1.2, 1.3.
+    # Default value: 1.2
+    # sslMinVersion: "1.2"
+
+    # Name of the tls secret. A secret needs to be created for this manually using the name as specified here
+    # secretName: ""
+
+    # Name of the volume where the secret will be mounted
+    # volumeName: ""
+```
+</Accordion>
+
+<Accordion title='Global config: Added OAS Validate Examples'>
+Added field `global.oasValidateExamples`. When set to true, it enables validation of examples in the OAS spec. 
+It is used to set `TYK_DB_OAS_VALIDATE_EXAMPLES` and `TYK_GW_OAS_VALIDATE_EXAMPLES`.
+</Accordion>
+
+<Accordion title='Global config: Added OAS Validate Schema Defaults'>
+Added field `global.oasValidateSchemaDefaults`. When set to true, it enables validation of schema defaults in the OAS spec. 
+It is used to set `TYK_DB_OAS_VALIDATE_SCHEMA_DEFAULTS` and `TYK_GW_OAS_VALIDATE_SCHEMA_DEFAULTS`.
+</Accordion>
+
+<Accordion title='Global config: Enable/Disable key hashing'>
+Added field `global.hashKeys`. When set to true, it enables key hashing in Gateway. Dashboard will
+also operate in a mode that is compatible with key hashing. Please do not set `dashboard.hashKeys`
+or make sure `dashboard.hashKeys` is set to the same value or else `dashboard.hashKeys` will take precedence.
+
+Note: `dashboard.hashKeys` will be deprecated in future release.
+</Accordion>
+
+<Accordion title='Gateway: Added support for PodDisruptionBudget resource'>
+Added built-in support for [PodDisruptionBudget](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) resource for Tyk Gateway. This will enhance the reliability and availability of your applications, giving you some control over the disruption caused by scaling operations, updates or maintenance on your pods. 
+To enable it, set `gateway.pdb.enabled` to `true` and configure `gateway.pdb.minAvailable` or `gateway.pdb.maxUnavailable`.
+</Accordion>
+
+<Accordion title='Gateway: Added Ingress template for gateway control service'>
+When enabled at `gateway.control.ingress.enabled`, an Ingress resource will be created to allow external access to gateway's [control service](/planning-for-production#change-your-control-port).
+</Accordion>
+
+<Accordion title='Gateway: Configure Gateway to work with MDCB synchroniser'>
+Allow users to configure worker gateway to work with [Tyk MDCB synchroniser](/api-management/mdcb#mdcb-synchroniser) easily by setting `global.mdcbSynchronizer.enabled` in `tyk-data-plane`.
+The control plane should be deployed with same `global.mdcbSynchronizer.enabled` value too.
+</Accordion>
+
+<Accordion title='Gateway: Customize ServiceAccount to be used'>
+Allow users to customize `serviceAccountName` for gateway, the name of the [Service Account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) that is going to be used by the Pods.
+</Accordion>
+
+<Accordion title='Gateway: Make service port name configurable'>
+Users can configure Tyk Gateway service port name and Tyk Gateway control service port name. Default is `http`.
+</Accordion>
+
+<Accordion title='Gateway: Make initContainer image configurable'>
+Users can configure Tyk Gateway initContainer image so that it is possible to load busybox image from preferred registry.
+</Accordion>
+
+<Accordion title='Dashboard: Added option to enable Tyk Identity Broker (TIB) in Tyk Dashboard'>
+You can enable Internal [Tyk Identity Broker (TIB)](/tyk-identity-broker/overview) in Tyk Dashboard by field `tyk-dashboard.tib.enabled` to `true`.
+</Accordion>
+
+<Accordion title='Dashboard: Customize ServiceAccount to be used'>
+Allow users to customize `serviceAccountName` for dashboard, the name of the [Service Account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) that is going to be used by the Pods.
+</Accordion>
+
+<Accordion title='Dashboard: Make service port name configurable'>
+Users can configure Tyk Dashboard service port name. Default is `http`.
+</Accordion>
+
+<Accordion title='Pump: Added Graph pump support'>
+[Graph Pumps](/api-management/dashboard-analytics/control-plane-pumps#mongodb) will be added when the user adds `mongo` or `postgres` to `pump.backend`. When `mongo` is added to `pump.backend` the Graph MongoDB Pump will be enabled. When `postgres` is added to `pump.backend` the Graph SQL Pump and Graph SQL Aggregate Pump will be enabled.
+</Accordion>
+
+<Accordion title='Pump: Customize ServiceAccount to be used'>
+Allow users to customize `serviceAccountName` for pump, the name of the [Service Account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) that is going to be used by the Pods.
+</Accordion>
+
+<Accordion title='Pump: Make service port name configurable'>
+Users can configure Tyk Pump service port name. Default is `http`.
+</Accordion>
+
+<Accordion title='Portal: Customize ServiceAccount to be used'>
+Allow users to customize `serviceAccountName` for portal, the name of the [Service Account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) that is going to be used by the Pods.
+</Accordion>
+
+<Accordion title='Portal: Make service port name configurable'>
+Users can configure Tyk Developer Portal service port name. Default is `http`.
+</Accordion>
+
+<Accordion title='New component chart to deploy MDCB'>
+A new [MDCB component chart](https://github.com/TykTechnologies/tyk-charts/tree/main/components/tyk-mdcb) has been added to deploy MDCB. 
+It is currently in Beta. For installation instructions and configurations, please
+read [Tyk Control Plane chart](/product-stack/tyk-charts/tyk-control-plane-chart).
+</Accordion>
+
+<Accordion title='New umbrella chart to deploy Tyk Control Plane'>
+A new [Tyk Control Plane umbrella chart](https://github.com/TykTechnologies/tyk-charts/tree/main/tyk-control-plane) has been added to deploy Tyk Control Plane. 
+It is currently in Beta. For installation instructions and configurations, please
+read [Tyk Control Plane chart](/product-stack/tyk-charts/tyk-control-plane-chart).
+</Accordion>
+</AccordionGroup>
+
+
+
+
+  
+##### Changed
+{/* This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Global config: Update default MongoDB driver to `mongo-go`'>
+Tyk Charts 1.3.0 uses `mongo-go` as the default driver to connect to MongoDB. `mongo-go` driver is compatible with MongoDB 4.4.x and above. For MongoDB versions prior to 4.4, please change `global.mongo.driver` to `mgo`. We recommend reading [Choose a MongoDB driver](/planning-for-production/database-settings#mongodb) when you need to change driver setting.
+</Expandable>
+
+
+
+{/* #### Security Fixes
+This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+
+## Further Information
+
+### Upgrading Tyk
+Please refer to the [upgrading Tyk](/developer-support/upgrading) page for further guidance on the upgrade strategy.
+
+### FAQ
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
diff --git a/developer-support/release-notes/mdcb.mdx b/developer-support/release-notes/mdcb.mdx
new file mode 100644
index 0000000000..aabce76bd0
--- /dev/null
+++ b/developer-support/release-notes/mdcb.mdx
@@ -0,0 +1,1822 @@
+---
+title: "Tyk MDCB Release Notes"
+description: "Release notes documenting updates, enhancements and changes for Tyk Multi Data Center Bridge (MDCB)."
+keywords: "release notes, MDCB, Tyk Multi Data Center, changelog"
+sidebarTitle: "Tyk MDCB"
+canonical: "https://tyk.io/docs/developer-support/release-notes/mdcb"
+---
+
+Licensed Protected Product
+
+**This page contains all release notes for Tyk MDCB displayed in reverse chronological order**
+
+## Support Lifetime
+Only the most recent Tyk MDCB release is supported. We recommend staying current to minimise exposure to security vulnerabilities from third party dependencies.
+
+---
+
+## 2.13 Release Notes
+
+### 2.13.0 Release Notes
+
+#### Release Date xx August 2026
+
+#### Release Highlights
+
+This release adds [Secrets Management](/tyk-configuration-reference/kv-store) to the Tyk MDCB configuration file for the first time, letting you reference values from external secrets stores in place of plain-text values.
+
+MDCB now supports IAM-based authentication for Google Cloud Memorystore for Redis Cluster and Valkey, as an alternative to a static password.
+
+The RPC connection pool is now configurable to limit both the maximum number of active connections from Data Plane Gateways and maximum connection idle time.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.13.0).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.13.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments |
+| :------------------------------- | :--------------- | :------------------- | :-------- |
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | |
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.13.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.13.0](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.13.0)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.13.0
+    ```
+#### Changelog
+<a id="Changelog-v2.13.0" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+<Accordion title='Updated Golang version to 1.26'>
+{/* TT-17868 */}
+Tyk MDCB has been updated to build with Go 1.26, keeping the toolchain current with upstream Go security and performance updates.
+</Accordion>
+</AccordionGroup>
+
+##### Added
+ 
+<AccordionGroup>
+<Accordion title='Secrets Management'>
+{/* TT-16268, TT-17699 */}
+Tyk MDCB now supports Secrets Management, letting you reference values from external secrets stores: the Tyk config file, environment variables, local files (including Kubernetes-mounted secrets), Consul, Vault, AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager, in place of plain-text values in MDCB's configuration, using a consistent reference syntax:
+
+- `kv://<store>/<path>[#fragment]` for whole-value references.
+- `$kv{<store>:<path>[#fragment]}` for embedding a reference inside a larger string.
+
+The secrets management configuration block (`kv`) can itself contain references, for example pulling a Vault token from an environment variable.
+
+References are resolved once, at startup. Individual secrets stores can be marked as `required` and, if they cannot be reached or initialized, MDCB will fail to start with a clear error rather than starting with that store silently unavailable.
+
+See [Secrets Management](/tyk-configuration-reference/kv-store) for full details.
+</Accordion>
+ 
+<Accordion title='Added GCP IAM authentication for Redis/Valkey'>
+{/* TT-17611 */}
+Tyk MDCB can now authenticate to Google Cloud Memorystore for Redis/Valkey using GCP IAM-based authentication, as an alternative to a static Redis password.
+
+MDCB obtains a Google OAuth2 access token from the workload's identity, using Application Default Credentials (ADC) and authenticates with the Memorystore using this token.
+
+This is supported for use with Memorystore for Valkey and Memorystore for Redis Cluster. The legacy non-cluster Memorystore for Redis has no IAM support from Google and continues to use a static password.
+
+
+The IAM configuration is set in the new `iam_auth` section of MDCB's storage config.
+</Accordion>
+
+<Accordion title='Configurable RPC connection pool'>
+{/* TT-17967 */}
+New configuration options have been introduced to manage the behavior of RPC connections from Data Plane Gateways.
+
+- `max_connections` sets the maximum number of concurrent RPC connections MDCB will accept from Data Plane Gateways. 
+- `max_connection_idle_time` sets the maximum time an idle RPC connection is kept open before MDCB closes it; this is configured with a readable duration (e.g. "5m").
+
+For both settings, the default (`0` or omitted) means unlimited - this is the existing behavior to avoid any breaking change.
+</Accordion>
+</AccordionGroup>
+
+##### Security Fixes
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+We have addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39822" target="_blank">CVE-2026-39822</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42505" target="_blank">CVE-2026-42505</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46600" target="_blank">CVE-2026-46600</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-56852" target="_blank">CVE-2026-56852</a>
+- <a href="https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf" target="_blank">GHSA-hrxh-6v49-42gf</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41178" target="_blank">CVE-2026-41178</a>
+- <a href="https://osv.dev/vulnerability/GHSA-r277-6w6q-xmqw" target="_blank">GHSA-r277-6w6q-xmqw</a>
+- <a href="https://osv.dev/vulnerability/GHSA-jpcw-4wr7-c3vq" target="_blank">GHSA-jpcw-4wr7-c3vq</a>
+</Accordion>
+
+</AccordionGroup>
+
+
+## 2.12 Release Notes
+
+### 2.12.0 Release Notes
+
+#### Release Date 7 July 2026
+
+#### Release Highlights
+
+In this release, we have added support for the Client Identity Provider (IdP) registry, introduced in [Tyk 5.14.0](/developer-support/release-notes/dashboard#5-14-0-release-notes). This feature provides centralized management of IdPs and scope-to-policy mappings used with [JWT Auth](/basic-config-and-security/security/authentication-authorization/json-web-tokens). Adding support to Tyk MDCB allows the use of the new Client IdP resource in distributed deployments.
+
+We have also addressed a long-standing issue that could cause MDCB memory usage to climb unbound until the process could run out of memory. Deployments with many Tyk OAS APIs, frequent Dashboard updates, or a large number of connected Data Plane Gateways were most exposed. 
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.12.0).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.12.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments |
+| :------------------------------- | :--------------- | :------------------- | :-------- |
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4)      | |
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.12.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.12.0](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.12.0)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.12.0
+    ```
+#### Changelog
+<a id="Changelog-v2.12.0" data-scroll-offset></a>
+
+##### Added
+ 
+<AccordionGroup>
+<Accordion title='Distribute the Client IdP registry to Data Plane Gateways'>
+The Client IdP registry is now distributed to Data Planes, allowing the use of this powerful capability in distributed deployments.
+
+Each Data Plane receives only the Client IdP registry data required by the APIs it serves, filtered by its segment tags. As a result, no Data Plane Gateway sees Identity Provider details (JWKS URIs, issuers, or scope-to-policy mappings) for APIs it does not serve. MDCB propagates changes made on the Control Plane to the appropriate connected Data Planes automatically in the usual way.
+</Accordion>
+ 
+</AccordionGroup>
+
+##### Fixed
+ 
+<AccordionGroup>
+<Accordion title='Fixed unbounded memory growth and out-of-memory crashes on API sync'>
+Resolved an issue where MDCB memory usage rose sharply each time an API was updated on Tyk Dashboard and was never released, with every subsequent update driving it higher until MDCB could exhaust available memory and crash.
+
+Deployments with a large number of Tyk OAS APIs, a busy Dashboard, or many connected Data Plane Gateways were most affected. MDCB now releases memory between updates and only reprocesses what has actually changed. As a result, memory usage stays stable and substantially lower under sustained load.
+</Accordion>
+
+<Accordion title='Fixed pre-aggregated analytics not being written to sharded PostgreSQL tables'>
+Resolved an issue when using the Hybrid Pump to store aggregated analytics in a sharded PostgreSQL database.
+
+Hybrid Pump aggregated analytics with MDCB PostgreSQL table sharding previously would create the aggregate shard table but fail to write rows into it, leaving Tyk Dashboard aggregate analytics views empty for the affected traffic.
+
+This has been fixed so the aggregated records are now correctly written to the relevant date shard, whether or not the base aggregate table exists. The previously recommended workaround of disabling analytics table sharding is no longer required.
+</Accordion>
+ 
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-2303" target="_blank">CVE-2026-2303</a>
+- <a href="https://osv.dev/vulnerability/GHSA-xmrv-pmrh-hhx2" target="_blank">GHSA-xmrv-pmrh-hhx2</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+## 2.11 Release Notes
+
+### 2.11.0 Release Notes
+
+#### Release Date 19 May 2026
+
+#### Release Highlights
+
+MDCB 2.11.0 adds support for routing MCP analytics from Data Plane deployments to the Control Plane. In distributed deployments, MCP analytics records are routed separately from standard API analytics, so MCP traffic does not mix with existing analytics data. No additional MDCB configuration is required — upgrading to 2.11.0 enables this automatically once Tyk Gateway 5.13.0 and Tyk Pump 1.15.0 are also running.
+
+In this release, we have addressed CVEs for enhanced security and performance.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.11.0).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.11.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments |
+| :------------------------------- | :--------------- | :------------------- | :-------- |
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | |
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.11.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+For distributed deployments, deploy MDCB 2.11.0 before upgrading Tyk Pump to 1.15.0 and Tyk Gateway to 5.13.0. MCP analytics support is additive and does not affect existing Pump or Gateway versions until they are also upgraded. See [MCP Gateway upgrade considerations](/developer-support/upgrading#mcp-upgrade-considerations) for the full deployment order.
+
+#### Downloads
+- [Docker image v2.11.0](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.11.0)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.11.0
+    ```
+#### Changelog
+<a id="Changelog-v2.11.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Add support for MCP Proxy analytics'>
+MDCB 2.11.0 introduces support for routing MCP analytics to the Control Plane in distributed deployments. MCP analytics records — both raw and pre-aggregated — are routed separately from standard API analytics, keeping MCP traffic isolated in your analytics storage backend.
+
+No additional MDCB configuration is required. For details, see the [MCP analytics documentation](/ai-management/mcp-gateway/mcp-observability).
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+
+Addressed the following CVEs, providing increased protection against security 
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33811" target="_blank">CVE-2026-33811</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39820" target="_blank">CVE-2026-39820</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39836" target="_blank">CVE-2026-39836</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42499" target="_blank">CVE-2026-42499</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39823" target="_blank">CVE-2026-39823</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39826" target="_blank">CVE-2026-39826</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39825" target="_blank">CVE-2026-39825</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+## 2.10 Release Notes
+
+### 2.10.0 Release Notes
+
+#### Release Date 23 April 2026
+
+#### Release Highlights
+
+Tyk MDCB has been updated to Go 1.25 for enhanced security and performance. This release also addresses some CVEs and exposes more controls to configure the transfer of aggregated traffic logs to the Control Plane data store.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.10.0).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.10.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments |
+| :------------------------------- | :--------------- | :------------------- | :-------- |
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | |
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.10.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.10.0](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.10.0)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.10.0
+    ```
+#### Changelog
+<a id="Changelog-v2.10.0" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated Go version to 1.25'>
+The Tyk MDCB has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
+</Accordion>
+
+</AccordionGroup>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Extended existing MongoDB option to avoid database contention when using PostgreSQL data store in the Control Plane'>
+The [`omit_analytics_index_creation`](/tyk-multi-data-centre/mdcb-configuration-options#omit_analytics_index_creation) configuration option is used to prevent deadlocks in horizontally scaled deployments that could occur if multiple MDCB instances created the same index concurrently.
+When this option is enabled, MDCB does not [automatically create indexes](/api-management/dashboard-analytics/control-plane-pumps#standard-mongo-pump), eliminating database contention issues, while maintaining full analytics functionality.
+This control was previously only applied when targeting a MongoDB data store in the Control Plane. Now it can also be used with a PostgreSQL data store.
+</Accordion>
+
+<Accordion title='Added options to allow better control of high cardinality data when using MongoDB store in the Control Plane'>
+We have added additional configuration options when using a MongoDB data store in the Control Plane. These allow better control of high cardinality data, such as per-key analytics, which helps prevent performance degradation and reduces database storage costs.
+
+- `ignore_aggregations` accepts a list of aggregations that should not be passed to the Control Plane
+- `enable_aggregate_self_healing` automatically creates a new document in MongoDB when the maximum document size is reached.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33186" target="_blank">CVE-2026-33186</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25679" target="_blank">CVE-2026-25679</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32285" target="_blank">CVE-2026-32285</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32286" target="_blank">CVE-2026-32286</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32280" target="_blank">CVE-2026-32280</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39883" target="_blank">CVE-2026-39883</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32282" target="_blank">CVE-2026-32282</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32283" target="_blank">CVE-2026-32283</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27139" target="_blank">CVE-2026-27139</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27142" target="_blank">CVE-2026-27142</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32281" target="_blank">CVE-2026-32281</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32288" target="_blank">CVE-2026-32288</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32289" target="_blank">CVE-2026-32289</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39882" target="_blank">CVE-2026-39882</a>
+</Accordion>
+
+</AccordionGroup>
+
+## 2.9 Release Notes
+
+### 2.9.1 Release Notes
+
+#### Release Date 29 June 2026
+
+#### Release Highlights
+
+This release resolves an issue that caused MDCB memory usage to climb sharply every time an API was updated and never recover, with each further update pushing it higher until the process could run out of memory. Deployments with many Tyk OAS APIs, frequent Dashboard updates, or a large number of connected Data Plane Gateways were most exposed. This release also fixes high-priority CVEs. 
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.9.1).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.9.1"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments |
+| :------------------------------- | :--------------- | :------------------- | :-------- |
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | |
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.9.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.9.1](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.9.1)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.9.1
+    ```
+#### Changelog
+<a id="Changelog-v2.9.1" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fix unbounded memory growth and out-of-memory crashes on API updates'>
+
+Resolved an issue where MDCB memory usage rose sharply each time an API was updated from the Dashboard and was never released, with every subsequent update driving it higher until MDCB could exhaust available memory and crash. Deployments with a large number of Tyk OAS APIs, a busy Dashboard, or many connected Data Plane Gateways were most affected.
+MDCB now releases memory between updates and only reprocesses what has actually changed. As a result, memory usage stays stable and substantially lower under sustained load.
+</Accordion>
+
+</AccordionGroup>
+
+### 2.9.0 Release Notes
+
+#### Release Date 6 March 2026
+
+#### Release Highlights
+
+In this release, we've added visibility of the lists of APIs and Policies loaded by each Data Plane Gateway connected to MDCB.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.9.0).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.9.0"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments |
+| :------------------------------- | :--------------- | :------------------- | :-------- |
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | |
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | |
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.9.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.9.0](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.9.0)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.9.0
+    ```
+#### Changelog
+<a id="Changelog-v2.9.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Visibility of the APIs and Policies loaded by each Data Plane Gateway'>
+The `GET /dataplanes` endpoint has been extended to provide enhanced visibility of your Tyk deployment. It now returns a list of the APIs and policies loaded on each connected Data Plane Gateway. You can retrieve the results for a specific Gateway using the `node_id` query parameter.
+
+This update provides a clear picture of what is running on each Gateway, simplifying the monitoring and troubleshooting of your Tyk deployment.
+</Accordion>
+
+</AccordionGroup>
+
+## 2.8 Release Notes
+
+### 2.8.8 Release Notes
+
+#### Release Date 12 February 2026
+
+#### Release Highlights
+
+In this release, we have fixed some priority CVEs. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.8.8). 
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.8.8"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments | 
+| :------------------------------- | :--------------- | :------------------- | :-------- | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.8.8, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.8.8](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.8.8)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.8.8
+    ```
+#### Changelog
+<a id="Changelog-v2.8.8" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61726" target="_blank">CVE-2025-61726</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61728" target="_blank">CVE-2025-61728</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68121" target="_blank">CVE-2025-68121</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+
+### 2.8.7 Release Notes
+
+#### Release Date 12 December 2025
+
+#### Release Highlights
+
+In this patch release, we've resolved MongoDB connection leaks, and faster gateway recovery after Redis outages. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.8.7).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.8.7"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments | 
+| :------------------------------- | :--------------- | :------------------- | :-------- | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.8.7, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.8.7](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.8.7)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.8.7
+    ```
+#### Changelog
+<a id="Changelog-v2.8.7" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed MDCB MongoDB Connection Leak During Error-Triggered Reconnects'>
+Fixed an issue where MDCB could perform unnecessary re-connections in response to server errors reported by MongoDB, failing to disconnect the client, leaving the old client’s connection pool orphaned and connected to the server forever until the application is terminated (manifesting as a connection leak). We have fixed the connection leak, preventing unnecessarily high connection counts and the associated costs.
+</Accordion>
+
+<Accordion title='MDCB Gateway Recovery After Control Plane Redis Outage'>
+Fixed an issue where Data Plane Gateways remained disconnected for 3-5 minutes after Control Plane Redis recovered from an outage. Previously, when Redis went down and came back up, gateways couldn't receive API updates, policy changes, or other configuration changes until a fixed cache timeout expired.
+With this fix, gateways now reconnect and sync updated assets (APIs, policies) within 30 seconds of Redis recovery instead of waiting several minutes.
+</Accordion>
+
+</AccordionGroup>
+
+### 2.8.6 Release Notes
+
+#### Release Date 20th November 2025
+
+#### Release Highlights
+
+In this patch release, we fixed high-priority CVEs. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.8.6).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.8.6"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments | 
+| :------------------------------- | :--------------- | :------------------- | :-------- | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.8.6, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.8.6](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.8.6)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.8.6
+    ```
+#### Changelog
+<a id="Changelog-v2.8.6" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following high-priority CVEs, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-47912" target="_blank">CVE-2025-47912</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58183" target="_blank">CVE-2025-58183</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58185" target="_blank">CVE-2025-58185</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58186" target="_blank">CVE-2025-58186</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58187" target="_blank">CVE-2025-58187</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58188" target="_blank">CVE-2025-58188</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58189" target="_blank">CVE-2025-58189</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61723" target="_blank">CVE-2025-61723</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61724" target="_blank">CVE-2025-61724</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61725" target="_blank">CVE-2025-61725</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+
+### 2.8.5 Release Notes
+
+#### Release Date 13th October 2025
+
+#### Release Highlights
+
+This release enhances the operational reliability of MDCB. We've resolved a synchronization issue where MDCB would permanently stop syncing with Gateways after Redis connection failures by implementing intelligent exponential backoff retry logic, ensuring continuous operation during Redis outages and network disruptions.
+Additionally, we've upgraded the platform to Golang 1.24, strengthening security through the latest language improvements and maintaining our commitment to using current, supported runtime environments.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.8.5).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+<a id="dependencies-2.8.5"></a>
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments | 
+| :------------------------------- | :--------------- | :------------------- | :-------- | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.8.5, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.8.5](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.8.5)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.8.5
+    ```
+#### Changelog
+<a id="Changelog-v2.8.5" data-scroll-offset></a>
+
+##### Changed
+
+
+
+<Expandable title='Upgrade Tyk MDCB to Golang 1.24'>
+Tyk MDCB has been upgraded to [Golang 1.24](https://tip.golang.org/doc/go1.24), improving security by staying current with the latest Go versions.
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Enhanced Redis Connection Resilience with Intelligent Retry Logic'>
+We've resolved a synchronization issue where MDCB would permanently stop syncing with Gateways after Redis connection failures. The system now implements robust exponential backoff retry logic that continues indefinitely until a successful reconnection is achieved, ensuring your API infrastructure maintains continuous operation during Redis outages, network disruptions, or server restarts. 
+
+Previously, MDCB would attempt only a single reconnection before silently abandoning the sync process while appearing healthy, leaving Gateways without updates. 
+
+With this enhancement, both pub/sub and keyspace listeners automatically recover from transient Redis issues, provide clear logging of retry attempts for improved observability, and eliminate the need for manual MDCB restarts to restore synchronization.
+</Expandable>
+
+
+
+### 2.8.4 Release Notes
+
+#### Release Date 18th August 2025
+
+#### Release Highlights
+
+This release fixes a compatibility issue between MDCB and Dashboard where APIs containing dots (.) in their paths were not handled correctly in MDCB. API definitions are now processed consistently with the Dashboard, ensuring middleware works as expected across all gateways.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.8.4).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments | 
+| :------------------------------- | :--------------- | :------------------- | :-------- | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+To resolve the compatibility issue between MDCB and Tyk Dashboard when OAS API definition paths contain dot (.) characters, you can choose **one** of the following upgrade paths:
+
+##### Recommended Upgrade Paths
+
+1. **Upgrade Dashboard (Preferred)**
+
+   * Upgrade to Dashboard v5.8.5 to resolve the issue.
+   * In this version, `escape_dots_in_oas_paths` defaults to `false`, and the Dashboard automatically unescapes dots in all API definitions.
+   * **No MDCB upgrade is required.**
+
+2. **Upgrade MDCB to v2.8.4 (Alternative if you cannot upgrade the Dashboard)**
+
+    - Enable `escape_dots_in_oas_paths` in both Dashboard and MDCB configurations.
+    - This ensures consistent escaping/decoding of dots across all components.
+
+If you are upgrading to 2.8.4, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.8.4](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.8.4)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.8.4
+    ```
+#### Changelog
+<a id="Changelog-v2.8.4" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Consistent Handling of Escaped Dots in OAS Paths'>
+Resolved a compatibility issue introduced in Dashboard v5.8.3, where MDCB failed to unescape dot characters (e.g., `\u002e`) in OAS API definition paths when reading from the database. This caused the [request validation](/api-management/traffic-transformation/request-validation) and [mock response](/api-management/traffic-transformation/mock-response#mock-response) middleware configured on affected endpoints not to be applied. 
+
+To align MDCB's dot handling mechanism with Tyk Dashboard, a new configuration option, `escape_dots_in_oas_paths`, has been introduced in both Dashboard and MDCB:
+
+* By Default, `escape_dots_in_oas_paths` is set to `false` in both MDCB and Dashboard, restoring the Dashboard behaviour before v5.8.3, where dots are unescaped.
+* When `escape_dots_in_oas_paths` is set to `true`, Dots are escaped for compatibility with specific databases. With this config set to true, MDCB and Dashboard encode/decode these paths consistently.
+
+Check the [Upgrade and Compatibility section](#upgrade-instructions) for details on the recommended upgrade path.
+</Expandable>
+
+
+
+
+### 2.8.3 Release Notes
+
+#### Release Date 13th August 2025
+
+#### Release Highlights
+
+This release updates MDCB to maintain compatibility with recent changes to the [URL Rewrite Middleware schema](/developer-support/release-notes/gateway#release-highlights-1), ensuring seamless interoperability with the latest Gateway and Dashboard versions.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.8.3).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments | 
+| :------------------------------- | :--------------- | :------------------- | :-------- | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.8.3, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.8.3](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.8.3)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.8.3
+    ```
+#### Changelog
+<a id="Changelog-v2.8.3" data-scroll-offset></a>
+
+##### Changed
+
+
+
+<Expandable title='MDCB Compatibility Update for URL Rewrite Middleware Changes'>
+We have updated MDCB to align with the recent [URL Rewrite Middleware schema](/developer-support/release-notes/gateway#release-highlights-1). This update ensures that MDCB remains fully compatible and behaves consistently with the latest Gateway and Dashboard releases.
+</Expandable>
+
+
+
+
+### 2.8.2 Release Notes
+
+#### Release Date 4th August 2025
+
+#### Release Highlights
+
+This release contains a bump to the API definitions to align with changes in Gateway and Dashboard v5.9.0; no functional changes have been implemented to MDCB in this release.
+
+##### Compatibility with Valkey
+
+Tyk is now fully compatible with [Valkey](https://valkey.io/), the open-source (BSD) high-performance key/value datastore backed by the Linux Foundation, as an alternative to Redis.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency          | Tested Versions | Compatible Versions | Comments | 
+| :------------------------------- | :--------------- | :------------------- | :-------- | 
+| [Redis](https://redis.io/download/)    | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2)      | | 
+| [Valkey](https://valkey.io/download/)  | 7.2.x, 8.0.x, 8.1.x    | 7.2.x, 8.0.x, 8.1.x    | | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.8.2, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.8.2](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.8.2)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.8.2
+    ```
+#### Changelog
+
+##### Added
+
+
+
+<Expandable title='Valkey Database Compatibility'>
+Added compatibility with Valkey database as an alternative to Redis. This is for fresh environments, with no migration support from Redis.
+</Expandable>
+
+
+
+##### Changed
+
+
+
+<Expandable title='Updated to use latest kin-openapi'>
+Upgraded to use the latest upstream version of kin-openapi (v0.132.0). This ensures improved compatibility, full stack interoperability, and continued support for existing OpenAPI 3.0.x specifications.
+</Expandable>
+
+
+
+### 2.8.1 Release Notes
+
+#### Release Date 9 May 2025
+
+#### Release Highlights
+
+This is a version bump to align with Gateway and Dashboard v5.8.1; no changes have been implemented in this release.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by MDCB | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | Used by MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are upgrading to 2.8.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+- [Docker image v2.8.1](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.8.1)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.8.1
+    ```
+#### Changelog
+
+No changes in this release.
+
+
+### 2.8.0 Release Notes
+
+#### Release Date 28 March 2025
+
+#### Release Highlights
+
+This release brings enhanced database compatibility and improved system stability. MDCB now fully supports PostgreSQL 17, ensuring seamless integration with the latest database version, while SQLite support has been removed to streamline maintenance. Additionally, we have resolved the "Key Not Found" error spam in MDCB logs, reducing unnecessary resource consumption and improving performance in customer environments.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.8.0) below.
+
+#### Breaking Changes
+This release removes support for SQLite in MDCB, aligning with the broader removal of SQLite from the Tyk Dashboard. This change improves compatibility with enterprise environments and addresses implementation issues related to SQLite.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by MDCB | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 13.x - 17.x        | 13.x - 17.x            | Used by MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.7.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower minor), it is advisable to bypass version 2.7.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.8.0](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.8.0)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.8.0
+    ```
+#### Changelog
+<a id="Changelog-v2.8.0" data-scroll-offset></a>
+
+##### Changed
+
+
+
+<Expandable title='Support for PostgreSQL 17'>
+MDCB now supports PostgreSQL 17, ensuring compatibility with the latest database version.
+</Expandable>
+
+
+
+<Expandable title='Removal of SQLite Support in MDCB'>
+SQLite support has been fully removed from MDCB.
+</Expandable>
+
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Resolved "Key Not Found" Errors Spamming MDCB Logs'>
+We've addressed an issue where MDCB logs were flooded with "Key Not Found" errors, causing performance degradation in customer environments.
+With this fix, MDCB now handles these cases more efficiently, reducing log noise, preventing unnecessary resource consumption, and improving overall system stability.
+</Expandable>
+    
+
+  
+
+
+---
+## 2.7 Release Notes
+### 2.7.2 Release Notes
+
+#### Release Date 03 December 2024
+
+#### Release Highlights
+
+##### Support Tyk 5.7
+Tyk MDCB 2.7.2 has been updated to support API configurations from Tyk 5.7.0.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by MDCB | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x LTS        | 12.x - 16.x            | Used by MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.7.1, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower minor), it is advisable to bypass version 2.7.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.7.2](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.7.2)
+  - ```bash
+    docker pull tykio/tyk-mdcb-docker:v2.7.2
+    ```
+
+#### Changelog
+
+##### Updated
+
+ 
+ 
+ <Expandable title='Update for compatibility with API definitions for Tyk v5.7'>
+MDCB 2.7.2 supports Tyk API definitions up to Tyk Gateway v5.7.0. Please use MDCB 2.7.2+ with Tyk Gateway v5.7.0+.
+</Expandable>
+ 
+ 
+
+##### Security Fixes
+
+ 
+ 
+ <Expandable title='Fixed the following CVEs:'>
+- [GHSA-7jwh-3vrq-q3m8](https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8)
+  - [GHSA-mrww-27vc-gghv](https://github.com/advisories/GHSA-mrww-27vc-gghv)
+  - [GO-2024-2611](https://pkg.go.dev/vuln/GO-2024-2611)
+</Expandable>
+ 
+ 
+
+---
+
+### 2.7.1 Release Notes
+
+#### Release date 10 October 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by MDCB | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x LTS        | 12.x - 16.x            | Used by MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Release Highlights
+
+##### Support GraphQL analytics records
+MDCB (Multi-Data Center Bridge) has been enhanced to support the storage of GraphQL aggregate analytics directly. This allows for better tracking and analysis of GraphQL usage across distributed environments. This enhancement simplifies the storage and management of GraphQL analytics within MDCB, improving efficiency and ease of use.
+
+#### Downloads
+- [Docker image v2.7.1](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.7.1)
+- ```bash
+  docker pull tykio/tyk-mdcb-docker:v2.7.1
+  ```
+
+
+#### Changelog
+
+##### Added
+
+   
+ <Expandable title='Support the storage of GraphQL aggregate analytics'>
+MDCB (Multi-Data Center Bridge) has been enhanced to support the storage of GraphQL aggregate analytics directly. This allows for better tracking and analysis of GraphQL usage across distributed environments when Gateway send analytics data directly to MDCB, which processes and sends the data to the analytics storage. This enhancement simplifies the storage and management of GraphQL analytics without Tyk Pump, improving efficiency and ease of use.
+</Expandable>
+  
+
+
+
+##### Updated
+
+ 
+ 
+ <Expandable title='Update for compatibility with API definitions for Tyk v5.6'>
+MDCB 2.7.1 supports Tyk API definitions up to Tyk Gateway v5.6.0. Please use MDCB 2.7.1+ with Tyk Gateway v5.6.0+.
+</Expandable>
+ 
+ 
+---
+
+### 2.7.0 Release Notes
+
+#### Release date 12 August 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by MDCB | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x LTS        | 12.x - 16.x            | Used by MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release, however with the introduction of new healthcheck endpoints we encourage customers to start using the new `/liveness` and `/readiness` endpoints and avoid using the old `/health` endpoint.
+
+##### Recommendations for users:
+
+- Migrate to new [health check](/api-management/mdcb#health-check) endpoints in order to get more detailed information. For Kubernetes users, use Helm Charts v1.6 to upgrade MDCB to set liveness and readiness probes of MDCB deployment to the new health check endpoints.
+
+#### Upgrade instructions
+If you are using a 2.6.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 2.6.0 and upgrade directly to this release.
+
+#### Release Highlights
+
+##### New Health check probes
+Two new [health check](/api-management/mdcb#health-check) endpoints have been added to improve monitoring and diagnostics:
+
+1. `/liveness`: This endpoint provides a quick check to determine if the MDCB application is alive and running.
+2. `/readiness`: This endpoint offers a detailed status of components and dependencies required for MDCB to serve traffic. It includes status checks for:
+    - Database connectivity
+    - Redis connectivity
+    - RPC server status
+
+These new endpoints allow for more granular monitoring of MDCB's operational status, enabling quicker identification and resolution of potential issues.
+
+##### New Configuration Access Endpoint
+Two new `/config` and `/env` [endpoints](/api-management/mdcb#check-mdcb-configurations) have been implemented, allowing developers to access the current configuration state of the MDCB instance in real-time. This feature provides:
+
+- Secure access to configuration data
+- Automatic redaction of sensitive information
+- Up-to-date view of the running configuration
+
+This addition enhances debugging capabilities and provides valuable insights into the MDCB instance's current settings.
+
+Please refer to the [changelog](#Changelog-v2.7.0) below.
+
+#### Downloads
+- [Docker image v2.7.0](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.7.0)
+- ```bash
+  docker pull tykio/tyk-mdcb-docker:v2.7.0
+  ``` 
+
+#### Changelog
+<a id="Changelog-v2.7.0" data-scroll-offset></a>
+
+##### Added
+
+   
+ <AccordionGroup>
+<Accordion title='Added `/liveness` endpoint for quick checks on MDCB application status'>
+Added `/liveness` endpoint that reports if MDCB is running. It returns status 200 if MDCB is alive. It returns status 503 if MDCB is not operational. In that case, a restart is recommended.
+</Accordion>
+
+<Accordion title='Implemented `/readiness` endpoint to detail status of critical components and dependencies'>
+Added `/readiness` endpoint that reports if MDCB is ready to serve request. It returns status 200 if MDCB is ready. It returns status 503 if MDCB or one of the dependencies is not ready.
+</Accordion>
+
+<Accordion title='Introduced `/config` endpoint for secure, real-time access to MDCB instance configuration'>
+Added `/config` endpoint that returns MDCB instance configuration in JSON format. It requires an administrative key provided in the `x-tyk-authorization` header for access, ensuring secure and controlled usage. Successful requests return MDCB JSON configurations with passwords and sensitive information redacted.
+</Accordion>
+
+<Accordion title='Introduced `/env` endpoint for secure, real-time access to MDCB instance configuration'>
+Added `/env` endpoint that returns MDCB instance configuration as a list of environment variable keys and values. It requires an administrative key provided in the `x-tyk-authorization` header for access, ensuring secure and controlled usage. Successful requests returns a list of environment variable keys and values with passwords and sensitive information redacted.
+</Accordion>
+</AccordionGroup>
+  
+ 
+
+
+##### Updated
+
+ 
+ 
+ <Expandable title='Update for compatibility with API definitions for Tyk v5.5'>
+MDCB 2.7.0 supports Tyk API definitions up to Tyk Gateway v5.5.0. Please use MDCB 2.7.x with Tyk Gateway v5.5.0+.
+</Expandable>
+ 
+ 
+---
+
+## 2.6 Release Notes
+### 2.6.0 Release Notes
+
+#### Release date 2 July 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by MDCB | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 12.x - 16.x LTS        | 12.x - 16.x            | Used by MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+Starting with MDCB v2.6.0, the configuration parameter `http_port` has been introduced to replace the original `healthcheck_port`. This new HTTP port is designed to expose various endpoints for monitoring and debugging MDCB.
+
+##### Changes in MDCB v2.6.0:
+- **New Configuration**: `http_port` is the new parameter for defining the HTTP port, with a default value of `8181`.
+- **Deprecation**: The `healthcheck_port` parameter is deprecated and will no longer be used in future MDCB versions.
+- **Helm Chart Update**: The MDCB Helm chart now includes the option `mdcb.probes.httpPort`, which takes precedence over `mdcb.probes.healthcheckPort`. For consistency and future compatibility, it is recommended to use `mdcb.probes.httpPort`.
+
+##### Backward compatibility:
+
+The `http_port` parameter is backward compatible, meaning it will function correctly with all existing MDCB versions, ensuring a smooth transition.
+
+##### Recommendations for users:
+
+- **Update Configurations**: Modify your MDCB configurations to use the new `http_port` parameter.
+
+#### Upgrade instructions
+If you are using a 2.5.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 2.5.0 and upgrade directly to this release.
+
+#### Release Highlights
+
+##### Tyk v5.4 Compatibility
+MDCB 2.6.0 is an update for compatibility for synchronisation with Tyk v5.4 API Definitions.
+
+##### Comprehensive Data Plane Node Information
+MDCB 2.6 introduces a new `/dataplanes` endpoint that provides a comprehensive view of all data plane nodes connected to MDCB, including crucial metadata and status information for each node. The admin secret is required in the header to access these information.
+
+Please refer to the [changelog](#Changelog-v2.6.0) below.
+
+#### Downloads
+- [Docker image v2.6.0](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.6.0)
+- ```bash
+  docker pull tykio/tyk-mdcb-docker:v2.6.0
+  ``` 
+
+#### Changelog
+<a id="Changelog-v2.6.0" data-scroll-offset></a>
+
+##### Security
+
+The following CVEs have been resolved in this release:
+
+- [PRISMA-2021-0108](https://github.com/influxdata/influxdb/issues/10292)
+- [CVE-2024-27304](https://nvd.nist.gov/vuln/detail/CVE-2024-27304)
+- [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
+
+##### Fixed
+
+ 
+ <Expandable title='Fixed MDCB failure when Tyk Dashboard is upgraded from v4 to v5'>
+Fixed a bug where upgrading Tyk Dashboard from version 4 to version 5 caused an MDCB failure when using the default PostgreSQL protocol. Resolved the issue in MDCB by detecting cached plan errors, then reconnecting to the storage and rerunning the query to ensure proper functionality.
+</Expandable>
+ 
+ 
+ 
+
+##### Added
+
+   
+ <Expandable title='Retrieve information of all the connected data plane nodes'>
+Adding a `/dataplanes` endpoint that offers a comprehensive view of all data plane nodes connected to MDCB. This endpoint provides crucial metadata and status information for each connected node, enabling efficient monitoring and troubleshooting. It requires an administrative key provided in the `x-tyk-authorization` header for access, ensuring secure and controlled usage. Successful requests return an array of node details, including node ID, API key, group ID, version, TTL, tags, health status, API statistics, and host details.
+</Expandable>
+ 
+ 
+
+
+##### Updated
+
+ 
+ 
+ <Expandable title='Update for compatibility with API definitions for Tyk v5.4'>
+MDCB 2.6.0 supports Tyk API definitions up to Tyk Gateway v5.4.0. Please use MDCB 2.6.x with Tyk Gateway v5.4.0+.
+</Expandable>
+ 
+ 
+ 
+ <Expandable title='Updated to Go 1.22'>
+MDCB has been updated to use Go 1.22 to benefit from fixed security issues, linkers, compilers etc.
+</Expandable>
+ 
+ 
+
+---
+
+## 2.5 Release Notes
+### 2.5.1 Release Notes
+
+#### Release date 24 Apr 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by MDCB | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 11.x - 15.x LTS        | 11.x - 15.x            | Used by MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are using a 2.4.x or 2.5.0 version, we advise you to upgrade as soon as possible to this latest release. If you are on an older version, you should skip 2.5.0 and upgrade directly to this release.
+
+#### Release Highlights
+This release contains bug fixes as detailed in the [changelog](#Changelog-v2.5.1) below.
+
+#### Downloads
+- [Docker image v2.5.1](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.5.1)
+- ```bash
+  docker pull tykio/tyk-mdcb-docker:v2.5.1
+  ``` 
+
+#### Changelog
+<a id="Changelog-v2.5.1" data-scroll-offset></a>
+
+##### Fixed
+
+ 
+ <AccordionGroup>
+<Accordion title='Fixed a bug where the TYK_MDCB_HEALTHCHECKPORT was not used when MDCB was configured with TLS enabled'>
+When MDCB was configured with TLS enabled, traffic was served over HTTPS on the listen port that was configured. However, the healthcheck endpoint was exposed on the standard HTTPS port of 443 and TYK_MDCB_HEALTHCHECKPORT was not being respected.
+</Accordion>
+
+<Accordion title='Fixed a bug where clearing the API cache from the Tyk Dashboard UI failed to invalidate the cache in distributed data plane gateways'>
+When clearing the API cache from the Tyk Dashboard UI, the cache in distributed data plane gateways was not being invalidated. *Please note that this fix requires Tyk Gateway version 5.3.1.*
+</Accordion>
+
+<Accordion title='Fixed a bug where PostgreSQL could not be used with MDCB 2.4.2/2.4.3 if APIs were created with version 4.0.X of the Dashboard'>
+MDCB v2.4.2/2.4.3 was unable to retrieve APIs when they were created using a 4.0.x Dashboard and PostgreSQL
+</Accordion>
+</AccordionGroup>
+ 
+ 
+ 
+
+---
+
+### 2.5.0 Release Notes
+
+##### Release date 5 Apr 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Redis](https://redis.io/download/)  | 6.2.x, 7.x  | 6.2.x, 7.x  | Used by MDCB | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 11.x - 15.x LTS        | 11.x - 15.x            | Used by MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are using a 2.4.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 2.4.0 and upgrade directly to this release.
+
+#### Release Highlights
+
+##### Tyk v5.3 Compatibility
+MDCB 2.5.0 is an update for compatibility for synchronisation with Tyk v5.3 API Definitions.
+
+##### Redis v7.x Compatibility
+We have upgraded Redis driver [go-redis](https://github.com/redis/go-redis) to v9. Subsequently, Tyk 5.3 is compatible with Redis v7.x.
+
+##### MongoDB v7.0.x Compatibility
+We have upgraded mongo-go driver to [mongo-go v1.13.1](https://github.com/mongodb/mongo-go-driver/releases/tag/v1.13.1). It allows us to benefit from the bug fixes and enhancements released by MongoDB. We have also tested that both Tyk 5.0.x+ and Tyk 5.3 are compatible with MongoDB v7.0.x.
+
+##### Security Fixes
+We have fixed a security issue affecting MDCB v2.2.0 to v2.4.x, where certain per-API access rights from policies are not properly relayed to edge gateways. We strongly recommend upgrading to MDCB version 2.5.0 to ensure the proper enforcement of per-API access rights across all gateways in your deployment.
+
+Please refer to the [changelog](#Changelog-v2.5.0) below.
+
+#### Downloads
+- [Docker image v2.5.0](https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=&page_size=&ordering=&name=v2.5.0)
+- ```bash
+  docker pull tykio/tyk-mdcb-docker:v2.5.0
+  ``` 
+
+#### Changelog
+<a id="Changelog-v2.5.0" data-scroll-offset></a>
+
+##### Fixed
+
+ 
+ <AccordionGroup>
+<Accordion title='Fixed relaying per-API access rights to gateways for MongoDB deployments'>
+Fixed a security issue affecting MDCB v2.2.0 to v2.4.x, where certain per-API access rights from policies are not properly relayed to edge gateways. This issue exists only when using MongoDB as storage engine.
+
+It affected GraphQL's field-based permissions, query depth, per query depth limits, and disable introspection settings. Also it affected usage quota of both HTTP and GraphQL APIs. However, "Set per API limits and quotas" and global policy settings (e.g. query depth) are not affected by this issue.
+</Accordion>
+
+<Accordion title='Fixed CVE-2023-3978 (NVD)'>
+Update embedded Tyk Pump to v1.9 to address [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) (NVD)
+</Accordion>
+
+<Accordion title='Fixed CVE-2023-39325 (NVD)'>
+Update embedded Tyk Pump to v1.9 to address [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) (NVD)
+</Accordion>
+
+<Accordion title='Fixed CVE-2020-26160 (NVD)'>
+Migrate MDCB JWT library to golang-jwt v4.5.0 to address [CVE-2020-26160](https://nvd.nist.gov/vuln/detail/CVE-2020-26160) (NVD)
+</Accordion>
+
+<Accordion title='Fixed MDCB stuck in crash loop during startup if tyk_sink.config is missing'>
+Fix the sample MDCB configuration to stop a crash loop to allow MDCB to run without a tyk_sink.conf file
+</Accordion>
+</AccordionGroup>
+ 
+ 
+
+##### Added
+
+   
+ <Expandable title='Support Redis v7.0.x'>
+MDCB 2.5.0 refactors Redis connection logic by using [storage v1.2.2](https://github.com/TykTechnologies/storage/releases/tag/v1.2.2), 
+   which integrates with [go-redis](https://github.com/redis/go-redis) v9. Subsequently, this fix adds support for 
+   Redis v7.0.x.
+</Expandable>
+ 
+ 
+
+
+##### Updated
+
+ 
+ 
+ <AccordionGroup>
+<Accordion title='Update for compatibility with API definitions for Tyk v5.3'>
+MDCB 2.4.x supports Tyk API definitions up to Tyk Gateway v5.3.0. Please use MDCB 2.5.x with Tyk Gateway v5.3.0+.
+</Accordion>
+
+<Accordion title='Set default MongoDB driver to mongo-go'>
+MDCB uses `mongo-go` as the default MongoDB driver from v2.5.0. This provides support for MongoDB 4.4.x, 
+5.0.x, 6.0.x, 7.0.x. If you are using older MongoDB versions e.g. 3.x, please set MongoDB driver to `mgo`. 
+[MongoDB supported versions](/planning-for-production/database-settings#supported-versions) 
+page provides details on how to configure MongoDB drivers in Tyk.
+</Accordion>
+
+<Accordion title='Support MongoDB v7.0.x'>
+MDCB integrates with [storage v1.2.2](https://github.com/TykTechnologies/storage), which updated mongo-go 
+driver we use from v1.11.2 to [mongo-go v1.13.1](https://github.com/mongodb/mongo-go-driver/releases/tag/v1.13.1). 
+It allows us to benefit from the bug fixes and enhancements released by MongoDB.
+</Accordion>
+
+<Accordion title='Updated to Go 1.21'>
+MDCB updated to Go 1.21 to benefit from fixed security issues, linkers, compilers etc.
+</Accordion>
+</AccordionGroup>
+ 
+ 
+
+---
+
+## 2.4 Release Notes
+### 2.4.3 Release Notes
+
+#### Release date 27 Feb 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### 3rd Party Dependencies & Tools
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 4.4.x, 5.0.x, 6.0.x, 7.0.x | 4.4.x, 5.0.x, 6.0.x, 7.0.x | Used by MDCB | 
+| [PostgreSQL](https://www.postgresql.org/download/)         | 11.x - 15.x LTS        | 11.x - 15.x            | Used by MDCB | 
+| [Redis](https://redis.io/download/)         | 6.0.x, 6.2.x        | 6.0.x, 6.2.x            | Used by MDCB | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are using a 2.4.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 2.4.0 and upgrade directly to this release.
+
+#### Release Highlights
+This release resolved an issue causing partial outages in Tyk Cloud Hybrid gateways due to a blocked stats channel, affecting login RPC calls and gateway operations.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-mdcb-docker/v2.4.3/images/sha256-832f461782fbc6182382798a89025b0489f529427521f92683f33df1ebbd4218?context=explore)
+
+#### Changelog
+
+##### Fixed
+
+ 
+ <Expandable title='Fixed a blockage in the stats channel which causes partial outages in Tyk Cloud Hybrid gateways'>
+Fixed a blockage in the stats channel of Tyk Cloud Hybrid gateways, improving login RPC calls and gateway operations.
+</Expandable>
+ 
+ 
+
+---
+
+### 2.4.2 Release Notes
+
+#### Release date 9 Jan 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are using a 2.4.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 2.4.0 and upgrade directly to this release.
+
+#### Release Highlights
+This release enhances compatibility as detailed in the [changelog](#Changelog-v2.4.2) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-mdcb-docker/v2.4.2/images/sha256-bdd708718153fdc25d13573d280fb5a715f11b1d2c97c6d59837d8dd83bf3c6c?context=explore)
+
+#### Changelog
+<a id="Changelog-v2.4.2" data-scroll-offset></a>
+
+##### Fixed
+
+ 
+ <Expandable title='Fix backward compatibility with Tyk v3.x and v4.x'>
+Fixed an issue where MDCB cannot pickup APIs created on Dashboard v3.x and v4.x.
+</Expandable>
+ 
+ 
+
+---
+
+### 2.4.1 Release Notes
+
+#### Release date 21 Nov 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are using a 2.4.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 2.4.0 and upgrade directly to this release.
+
+#### Release Highlights
+This release enhances compatibility as detailed in the [changelog](#Changelog-v2.4.1) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-mdcb-docker/v2.4.1/images/sha256-2debf08c95c46a4662a00b2193ee142998826ed7c5e2bb4a4633737c0a4de2e3?context=explore)
+
+#### Changelog
+<a id="Changelog-v2.4.1" data-scroll-offset></a>
+
+##### Changed
+- Update for compatibility with API definitions for Tyk v5.2.3
+
+---
+
+### 2.4.0 Release Notes
+
+#### Release Date 14 November 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are using a 2.4.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, you should skip 2.4.0 and upgrade directly to this release.
+
+#### Release Highlights
+MDCB 2.4.0 is an update for compatibility for synchronisation with Tyk v5.2 API Definitions. It also enables gateway information visualisation on Tyk Dashboard v5.2+. Please refer to the [changelog](#Changelog-v2.4.0) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-mdcb-docker/v2.4.0/images/sha256-b5fad5b4c1c8b912999816ab51ff51e62fdd733fc43256187f22e1218b287f26?context=explore)
+
+#### Changelog
+<a id="Changelog-v2.4.0" data-scroll-offset></a>
+
+##### Added
+- Track number of connected gateways and gateway info. The connection statistics can be queried from Tyk Dashboard v5.2+. This allow greater visibility for Operation teams on the number of gateways they are using.
+
+##### Updated
+- Update for compatibility with API definitions for Tyk v5.1
+
+---
+
+## 2.3 Release Notes
+### 2.3.1 Release Notes
+
+Release date: 2023-08-31
+
+#### Fixed
+
+- In MDCB 2.3, the embedded OAS API Definition introduced in 5.1 is not backward compatible. It causes Gateway panic when MDCB is connecting to Tyk 5.0.x or earlier releases. In this fix, MDCB will transform the old API Definition to new format to avoid panic.
+- Users should use URL-encoded values in username and password of a MongoDB connection string if it contains following characters - "?", "@". The same connection string should always be accepted by both mgo and mongo-go drivers. (Note: Same fix for Dashboard will be available in upcoming release Tyk Dashboard v5.0.6 and v5.2.0)
+
+
+### 2.3.0 Release Notes
+
+Release date: 2023-06-28
+
+MDCB 2.3.0 is an update for compatibility for synchronisation with Tyk v5.1 API Definitions.
+
+#### Updated
+
+- Update MDCB to Go 1.19
+- Update for compatibility with API definitions for Tyk v5.1
+
+## 2.2 Release Notes
+### 2.2.0 Release Notes
+Release date: 2023-05-26
+
+MDCB 2.2.0 brings support for using the official [MongoDB go driver](https://www.mongodb.com/docs/drivers/go/current/?_ga=2.196564399.289488302.1688466439-526957880.1688466345#mongodb-go-driver), as well as some performance fixes.
+
+From MDCB 2.2.0, we added support for MongoDB 5.0.x and 6.0.x. To enable this, you have to set the new *MDCB* config option driver to `mongo-go`.
+
+The driver setting defines the driver type to use for MongoDB. It can be one of the following values:
+* [mgo](https://github.com/go-mgo/mgo) (default): Uses the `mgo` driver which is the existing one Tyk has been using till now. This driver supports *MongoDB* versions up to v4 (lower or equal to v4, `<=v4`). You can get more information about this driver [here](https://github.com/go-mgo/mgo). This driver will stay the default till the next release, to allow users more time for migration. After that, the default driver will be `mongo-go`.
+* [mongo-go](https://github.com/mongodb/mongo-go-driver): Uses the official *MongoDB driver*. This driver supports MongoDB v4 or newer (greater or equal to v4, >=v4).
+
+Tyk 5.0.2 and Tyk Pump 1.8.0 also support the new driver option.
+
+We have also worked on performance improvement and fixes like preventing successive frequent reloads, handling storage errors gracefully, retry connection to storage during startup. If ownership is enabled, gateways will also load APIs that are not associated with any user or group.
+
+#### Added
+- Support for `mongo-go` driver option
+- Support for the `+srv` connection string with `mongo-go` driver option
+- Support for SCRAM-SHA-256 with “mongo-go” driver option
+- Performance Enhancement: MDCB enqueue APIs and Policies for reload to reduce multiple reloads
+#### Fixed
+- MDCB handles errors from storage gracefully and prevents sending an empty list of APIs to gateways which would cause an outage
+- MDCB will retry the connection to storage to prevent startup failure
+#### Updated
+- If both mongo_url and connection_type + connection_string are set, Mongo will be loaded by default.
+- When ownership is enabled, gateways should only load APIs that are associated with the user or group. Additionally, APIs with no association with any users or groups are also loaded.
+
+## 2.1 Release Notes
+### 2.1.1 Release Notes
+Release date: 2023-03-29
+
+#### Fixed
+- Updated API Definition to support 5.0.0 Gateways. 
+- Fixed one critical CVE issue with go.uuid package.
+
+
+### 2.1.0 Release Notes
+Release date: 2023-02-20
+
+#### Added
+- Added a new configuration option [enable_ownership](/tyk-multi-data-centre/mdcb-configuration-options#enable_ownership) that allows MDCB filter APIs by API Ownership. 
+- MDCB works without group id. This means that when an Edge Gateway doesn’t have a group, it will defaults to the `ungrouped` group. This has some fallbacks, as we can’t use the synchroniser for the ungrouped gateways.
+
+
+#### Fixed
+- Updated API Definition to support 4.3.3 Gateways. 
+
+## 2.0 Release Notes
+### 2.0.5 Release Notes
+Release date: 2023-01-31
+
+#### Added
+- Added a new configuration option (`group_key_ttl`) that specifies the group key TTL in seconds. This key is used to prevent a group of gateways from re-syncing when is not required. On login (GroupLogin call), if the key doesn't exist then the sync process is triggered. If the key exists then the TTL just gets renewed. In case the cluster of gateways is down, the key will expire and get removed and if they connect again a sync process will be triggered. Default value: 180 seconds. Min value: 30 seconds.
+
+#### Fixed
+- Fixed an issue where gateways in the data plane couldn't re-sync with MDCB (in the control plane) after their Redis (in the data plane) has been reset. The only way was to change the `group_id`. The fix means that MDCB can overcome this situation independently and there's no need for the users to do anything (changing `group_id` or any other curing action). Check `group_key_ttl` for [more details](#added)
+
+### 2.0.4 Release Notes
+Release date: 2022-12-06
+
+#### Added
+- Changes in the API definition introduced in Tyk Gateway 4.3 
+- Update to Go 1.16 
+- Update the embedded Pump to the latest (v1.7.0)
+
+#### Fixed
+- Fixed a minor security issue when logging Mongo URL 
+
+### 2.0.3 Release Notes
+Release date: 2022-08-12
+
+#### Fixed
+- Fixed a bug when using MDCB with Tyk Gateway versions prior to 4.1 where an error could be reported when querying an API from a worker gateway.
+- Fixed an incompatibility with MDCB logging format changes
+- Fixed an issue where, with the MDCB Synchroniser disabled, all API resources were still pushed out to workers upon creation in the controller; the behavior should be as it was pre-synchroniser.
+
+### 2.0.2 Release Notes
+Release date: 2022-08-12
+
+#### Fixed
+- Fixed a bug when using MDCB with Tyk Gateway versions prior to 4.1 where an error could be reported when querying an API from a worker gateway.
+
+### 2.0.1 Release Notes
+Release date: 2022-07-20
+
+#### Added
+- Updated MDCB to support Tyk Gateway v4.1
+- Added a new configuration option (`omit_analytics_index_creation`) that supresses the creation of indexes in Mongo pumps (to match Pump 1.6)
+- Added the option to configure MDCB certificates using environment variables.
+
+#### Fixed
+- Fixed a bug when using MDCB to transfer analytics to MongoDB, where the indexes Tyk created in the MongoDB did not correctly include a time stamp.
+
+#### Changed
+- Updated the pump embedded in MDCB to the latest version (Pump v1.6)
+
+
+### 2.0.0 Release Notes
+Release date: 2022-05-17
+
+#### Added
+
+##### SQL support
+Since Tyk v4.0, the dashboard supports SQL engine natively. This means that Tyk has support for an SQL relational database to be used instead of the default MongoDB and lets users decide which DB type is the best for their usage. MDCB 2.0 introduces support for SQL to the multi data center bridge, enabling MDCB orchestrated deployments using SQL databases.
+MDCB now uses embedded Tyk Mongo and SQL pumps to write analytics. 
+
+#### Fixed
+- Fixed a security risk where API keys could be logged in plain text in MDCB logs.
+
+#### Changed
+- Improved the formatting of debug logs to align with the rest of the Tyk product suite.
+- Hide innocent and unhelpful error messages related to the RPC connection that were spamming the logs
+
+
+## Further Information
+
+### Upgrading Tyk
+
+Please refer to the [upgrading Tyk](/developer-support/upgrading) page for further guidance with respect to the upgrade strategy.
+
+### FAQ
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
diff --git a/developer-support/release-notes/operator.mdx b/developer-support/release-notes/operator.mdx
new file mode 100644
index 0000000000..f5421dcc21
--- /dev/null
+++ b/developer-support/release-notes/operator.mdx
@@ -0,0 +1,1047 @@
+---
+title: "Tyk Operator Release Notes"
+description: "Release notes documenting updates, enhancements, fixes and changes for Tyk Operator."
+keywords: "Tyk Operator, Release notes, changelog"
+sidebarTitle: "Tyk Operator"
+---
+
+**Licensed Protected Product**
+
+**This page contains all release notes for Tyk Operator displayed in reverse chronological order**
+
+## Support Lifetime
+Only the most recent Tyk Operator release is supported. We recommend staying current to minimise exposure to security vulnerabilities from third party dependencies.
+
+---
+
+## 1.4 Release Notes
+
+### 1.4.2 Release Notes
+
+#### Release Date 9 July 2026
+
+#### Release Highlights
+
+In this release, we have fixed issues with the reliability of SecurityPolicy reconciliation under high load that could lead to infinite reconciliation loops, orphaned Dashboard policies, and inconsistent state between Kubernetes and Dashboard. The fix also introduces new configuration options that enable tuning of Tyk Operator's HTTP connection pool for different deployments.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.4.2) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :--------------------------------------------------------- | :--------------------- | :--------------------- | :------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.28.x to 1.35.x       | 1.19.x to 1.35.x       |          | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator) section for detailed upgrade instructions.
+
+
+#### Downloads
+- [Docker image v1.4.2](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v1.4.2)
+  - ```bash
+    docker pull tykio/tyk-operator:v1.4.2
+    ```
+- Helm chart
+  - [tyk-charts v5.3.0](/developer-support/release-notes/helm-chart#5-3-release-notes)
+
+#### Changelog
+<a id="Changelog-v1.4.2" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+<Accordion title='Fix SecurityPolicy reconciliation race conditions and connection leaks under load'>
+Resolved a set of related issues that prevented `SecurityPolicy` resources from reconciling reliably, particularly under high load or when a policy referenced a large number of APIs.
+
+Affected Operators could enter continuous reconciliation loops (most commonly with policies referencing nine or more APIs), leave a policy in the Dashboard after its Kubernetes resource had been deleted, repeatedly try to recreate a policy and fail with a "policy name already used" error, and steadily leak HTTP connections and file descriptors until the host exhausted its available ports.
+
+SecurityPolicy reconciliation is now idempotent and converges reliably: Kubernetes and Dashboard state stay consistent across create, update, and delete, the Operator recovers cleanly from partial failures, and HTTP connections are reused correctly so file descriptors no longer accumulate under sustained load. The same reconciliation improvements have been applied to Tyk OAS API definition resources.
+ 
+This release also introduces a set of environment variables for tuning the Operator's HTTP client to the Dashboard: `TYK_OPERATOR_HTTPCLIENTCONFIG_MAXIDLECONNS`, `TYK_OPERATOR_HTTPCLIENTCONFIG_MAXIDLECONNSPERHOST`, `TYK_OPERATOR_HTTPCLIENTCONFIG_MAXCONNSPERHOST`, `TYK_OPERATOR_HTTPCLIENTCONFIG_IDLECONNTIMEOUT`, `TYK_OPERATOR_HTTPCLIENTCONFIG_TLSHANDSHAKETIMEOUT`, and `TYK_OPERATOR_HTTPCLIENTCONFIG_TIMEOUT`. Each ships with a sensible built-in default, and Tyk recommends leaving them unchanged unless your infrastructure has specific constraints, such as file descriptor exhaustion, that require tuning.
+</Accordion>
+ 
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.4.1 Release Notes
+
+#### Release Date 21 May 2026
+
+#### Release Highlights
+
+In this release, we have addressed CVEs for enhanced security and performance.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.4.1) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.28.x to 1.32.x       | 1.19.x to 1.32.x       |          | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator) section for detailed upgrade instructions.
+
+
+#### Downloads
+- [Docker image v1.4.1](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v1.4.1)
+  - ```bash
+    docker pull tykio/tyk-operator:v1.4.1
+    ```
+- Helm chart
+  - [tyk-charts v5.2.0](/developer-support/release-notes/helm-chart#5-2-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v1.4.1" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+
+Addressed the following CVEs, providing increased protection against security 
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33811" target="_blank">CVE-2026-33811</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39820" target="_blank">CVE-2026-39820</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39836" target="_blank">CVE-2026-39836</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42499" target="_blank">CVE-2026-42499</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39823" target="_blank">CVE-2026-39823</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39826" target="_blank">CVE-2026-39826</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39825" target="_blank">CVE-2026-39825</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.4.0 Release Notes
+
+#### Release Date 20 May 2026
+
+#### Release Highlights
+
+Tyk Operator 1.4.0 introduces support for managing [MCP (Model Context Protocol) Proxy](/ai-management/mcp-gateway/managing-proxies) definitions through Kubernetes custom resources. The new `TykMcpProxyDefinition` CRD allows you to manage MCP Proxies declaratively, and the `SecurityPolicy` CRD has been extended with MCP access rights for tool-based access control and per-primitive rate limiting.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.4.0).
+
+<Note>
+The initial Helm chart for Operator 1.4.0 contained an installation bug. Please ensure you use [Tyk Charts 5.2.0](/developer-support/release-notes/helm-chart#5-2-0-release-notes) or later to install Operator 1.4.0.
+</Note>
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.28.x to 1.32.x       | 1.19.x to 1.32.x       |          | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+The MCP Proxy support in Tyk Operator 1.4.0 requires Tyk Gateway 5.13.0 and Tyk Dashboard 5.13.0 (or newer)
+
+Attempting to use `TykMcpProxyDefinition` resources with Operator  1.4.0 prior to upgrading Gateway and Dashboard to a version supporting MCP Proxies will cause reconciliation failures.
+
+See [MCP Gateway upgrade considerations](/developer-support/upgrading#mcp-upgrade-considerations) for details.
+
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator) section for detailed upgrade instructions.
+
+
+#### Downloads
+- [Docker image v1.4.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v1.4.0)
+  - ```bash
+    docker pull tykio/tyk-operator:v1.4.0
+    ```
+- Helm chart
+  - [tyk-charts v5.2.0](/developer-support/release-notes/helm-chart#5-2-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v1.4.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Add MCP Proxy support'>
+This release adds support for MCP (Model Context Protocol) Proxies with a new TykMcpProxyDefinition CRD and an extension to the SecurityPolicy CRD.
+
+**TykMcpProxyDefinition CRD**
+
+A new `TykMcpProxyDefinition` CRD allows you to manage MCP Proxy definitions declaratively in Kubernetes. 
+
+The CRD status surface exposes three hashes — `CRDSpecHash`, `ConfigMapHash`, and `TykSpecHash` — to track synchronisation state between the Kubernetes resource, the ConfigMap, and the Tyk Gateway definition.
+
+**SecurityPolicy CRD — MCP access rights**
+
+The `SecurityPolicy` CRD has been extended to support MCP-specific access rights:
+- Per-tool, per-resource, and per-prompt allow/deny lists (`mcp_access_rights`)
+- Per-JSON-RPC-method allow/deny lists (`json_rpc_methods_access_rights`)
+- Per-primitive rate limits (`mcp_primitives`) and per-method rate limits (`json_rpc_methods`)
+
+For details, see the [MCP proxy policies documentation](/ai-management/mcp-gateway/policies).
+</Accordion>
+
+</AccordionGroup>
+
+## 1.3 Release Notes
+
+### 1.3.0 Release Notes
+
+#### Release Date 11 March 2026
+
+#### Release Highlights
+
+Tyk Operator v1.3.0 delivers improvements for API monitoring and ingress management in Kubernetes environments. This release adds native uptime test configuration support for both Tyk OAS and Tyk Classic API definitions, eliminating the need for manual Dashboard configuration.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.3.0) below.
+
+<Note>
+The initial `Helm chart` for Operator 1.3.0 contained an installation bug. Please ensure you use tyk-charts version [5.1.1](/developer-support/release-notes/helm-chart#5-1-1-release-notes) or later to install Operator 1.3.0.
+</Note>
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.28.x to 1.32.x       | 1.19.x to 1.32.x       |          | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator) section for detailed upgrade instructions.
+
+
+#### Downloads
+- [Docker image v1.3.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v1.3.0)
+  - ```bash
+    docker pull tykio/tyk-operator:v1.3.0
+    ```
+- Helm chart
+  - [tyk-charts v5.1.0](/developer-support/release-notes/helm-chart#5-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v1.3.0" data-scroll-offset></a>
+
+##### Changed 
+
+<AccordionGroup>
+<Accordion title='Golang 1.25 Update'>
+The Tyk Operator now runs on Golang 1.25, providing improved performance, enhanced security, and access to the latest language features. 
+
+This update ensures the Operator remains current with supported Go versions and reduces exposure to security vulnerabilities found in older runtime versions.
+</Accordion>
+
+</AccordionGroup>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Added Uptime Test Configuration Support'>
+The Tyk Operator now supports configuration of [upstream uptime tests](/planning-for-production/ensure-high-availability/uptime-tests) directly in your API definitions through both Tyk OAS and Tyk Classic CRDs.
+</Accordion>
+
+</AccordionGroup>
+
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Tyk Operator Ingress Controller Now Respects Strip Listen Path Configuration'>
+The ingress controller now respects the [`listenPath.strip`](/api-management/gateway-config-tyk-oas#listenpath) configuration defined in your Tyk OAS API templates. This fix ensures that template configurations are preserved while maintaining backward compatibility, as templates without an explicit strip setting will continue to default to `true`, and ACME challenge paths will still force `strip: false` as required.
+</Accordion>
+
+</AccordionGroup>
+
+
+## 1.2 Release Notes
+
+### 1.2.0 Release Notes
+
+#### Release Date 02 April 2025
+
+#### Release Highlights
+
+##### Support for Tyk 5.8
+
+Tyk Operator v1.2 introduces key enhancements and critical fixes to improve API management in Kubernetes environments. This release adds support for HMAC request signing and YAML-based OAS definitions, aligning with Tyk Gateway 5.8.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.2.0) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.28.x to 1.32.x       | 1.19.x to 1.32.x       |          | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+Tyk Operator v1.2 introduced new Custom Resource Definitions (CRDs). Before upgrading to Tyk Operator v1.2 with Helm Chart, please run the following commands to install the CRDs:
+
+```bash
+$ kubectl apply -f https://raw.githubusercontent.com/TykTechnologies/tyk-charts/refs/heads/main/tyk-operator-crds/crd-v1.2.0.yaml
+```
+
+
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator) section for detailed upgrade instructions.
+
+
+#### Downloads
+- [Docker image v1.2.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v1.2.0)
+  - ```bash
+    docker pull tykio/tyk-operator:v1.2.0
+    ```
+- Helm chart
+  - [tyk-charts v3.0.0](/developer-support/release-notes/helm-chart#3-0-0-release-notes)
+
+#### Changelog
+<a id="Changelog-v1.2.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='HMAC request signing support'>
+Tyk Operator now supports HMAC request signing, enabling enhanced security and integrity for API requests. This feature aligns with Tyk 5.8 capabilities.
+
+[Learn More](/api-management/upstream-authentication/request-signing)
+</Accordion>
+
+<Accordion title='YAML-based OAS API definitions'>
+Tyk Operator now allows OAS API definitions in YAML format, increasing flexibility in API configurations.
+</Accordion>
+
+<Accordion title='JWT OAS API policy linking'>
+Tyk Operator now supports linking of policies for JWT default policies and JWT scope-to-policy mappings using kubernetes names. They can set these fields in TykOASApiDefinition CRD.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Updated
+
+
+
+<Expandable title='Removed dependency on kube-rbac-proxy'>
+Tyk Operator removed dependency on kubebuilder's `rbac-proxy` for authentication/authorization of metrics server.
+`WithAuthenticationAndAuthorization` feature provided by Controller-Runtime will be used instead.
+
+Users are encouraged to update to Tyk Operator v1.2 to benefit from this change.
+
+For users who cannot immediately update, there is an alternative option: modifying the Operator's Helm chart configuration to replace the image `gcr.io/kubebuilder/kube-rbac-proxy` with another trusted source. For details, please see [Issue 365](https://github.com/TykTechnologies/tyk-charts/issues/365).
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Operator reconciliation error handling'>
+Fixed an issue where reconciliation conflicts appeared as errors in logs, which occurred because an outdated copy of the Kubernetes resource was being processed. This has been resolved by fetching the latest copy of the object from the cluster and retrying the operation.
+</Accordion>
+
+<Accordion title='Cert-manager dependency'>
+Users can now disable cert-manager, making it optional rather than mandatory for onboarding. This enhances flexibility in deployment configurations.
+</Accordion>
+
+<Accordion title='Circuit breaker schema validation'>
+Fixed an issue where user was getting validation error while setting `threshold_precent` field of classic API Definition CRD starting from Operator v1.0.0, which blocked users from upgrading.
+</Accordion>
+
+<Accordion title='Portal API Catalog infinite loop'>
+Resolved an issue where the Operator could enter an infinite loop when a PortalAPICatalogue CR was created.
+</Accordion>
+
+<Accordion title='Leader election flag'>
+Because of some issue in Operator helm chart, configurations options were not getting read correctly.
+Helm chart has been fixed and leader election works by default again.
+</Accordion>
+</AccordionGroup>
+
+
+
+---
+
+## 1.1 Release Notes
+### 1.1.0 Release Notes
+
+#### Release Date 09 December 2024
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release:
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-vX.Y.0) below. */}
+###### Support for Tyk Streams API
+Tyk Operator v1.1 supports management of Tyk Streams APIs through the new **`TykStreamsApiDefinition`** custom resource. This allows you to have declarative, versioned, and fully automated control to your streaming APIs.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+#### Dependencies
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x to 1.30.x       | 1.19.x to 1.30.x       |          | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+Tyk Operator v1.1 introduced new Custom Resource Definitions (CRDs). Before upgrading to Tyk Operator v1.1 with Helm Chart, please run the following commands to install the CRDs:
+
+```bash
+$ kubectl apply -f https://raw.githubusercontent.com/TykTechnologies/tyk-charts/refs/heads/main/tyk-operator-crds/crd-v1.1.0.yaml
+```
+
+
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator) section for detailed upgrade instructions.
+
+
+#### Downloads
+- [Docker image v1.1.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v1.1.0)
+  - ```bash
+    docker pull tykio/tyk-operator:v1.1.0
+    ```
+- Helm chart
+  - tyk-charts v2.2.0 {/* This is the link to the Helm charts links. Please be mindful that this URL is only available a few hours or day/s after we release the main release, so this link needs to be updated in a separate iteration */}
+{/* source code tarball for oss projects */}
+
+#### Changelog
+
+##### Added
+
+
+
+<Expandable title='TykStreamsApiDefinition: new Custom Resource for Tyk Streams'>
+The `TykStreamsApiDefinition` custom resource allows you to manage Tyk Streams APIs directly within your Kubernetes environment. This enhancement offers a Kubernetes-native approach to managing Tyk APIs, streamlining operations and ensure single source of truth in Kubernetes.
+
+[Learn More](/tyk-stack/tyk-operator/create-an-api#create-a-tykstreamsapidefinition-custom-resource)
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='SecurityPolicy: kind of referenced API definitions should have a default value'>
+With `TykOasApiDefinition` support, we expect API references in SecurityPolicy to have `kind` field which can be either `ApiDefinition` or `TykOasApiDefinition`. However, the validation was failing if users were upgrading from v0.18 to v1.0 since the `kind` field is empty in the CR.
+
+Updated CRD rules to add default value for the `kind` field.
+</Expandable>
+
+
+
+---
+
+## 1.0 Release Notes
+### 1.0.0 Release Notes
+
+We are excited to announce the release of **Tyk Operator v1.0**, marking a significant milestone with new features, enhancements, and critical changes. This release introduces support for Tyk OAS APIs, extended capabilities for managing Classic APIs and security policies, and includes **license changes** that you must be aware of before upgrading.
+
+#### Release Date 10 Oct 2024
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release:
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-vX.Y.0) below. */}
+##### Support for Tyk OAS API
+The Tyk Operator v1.0 release introduces powerful new features designed to enhance how you manage APIs in Kubernetes environments. One of the key highlights is the full support for Tyk OAS APIs, allowing you to define and manage APIs through the new **`TykOasApiDefinition`** custom resource. This integration extends GitOps API Management to Tyk OAS, allowing you to have declarative, versioned, and fully automated control to your APIs in Kubernetes environments.
+
+Key features:
+
+- **Define and Manage Tyk OAS APIs** using the TykOasApiDefinition custom resource.
+- **Manage API Definitions in ConfigMaps**: Any changes are automatically tracked and synced to Tyk.
+- **Configure Tyk OAS in a Kubernetes-native way**: You can organize APIs by categories or manage multiple API versions easily with the new CRD.
+- **Simplify certificate management** by referencing Kubernetes secrets.
+- **Use the Tyk Ingress controller** to create Tyk OAS APIs from Ingress specs.
+
+With this release, users benefit from seamless GitOps workflows, ensuring a Kubernetes-native operation workflow. Security is also made simpler with automated certificate synchronization, removing the hassle of manual certificate management.
+
+##### Enhanced Classic API and Security Policy Features
+Enhanced support for Tyk Classic APIs continues, with improvements to security policies and new capabilities for setting API and endpoint-specific rate limits, making it easier than ever to customize API usage policies.
+
+This release represents a significant upgrade for both API management and security, offering a more efficient, scalable, and Kubernetes-native way to operate Tyk. Whether you're leveraging Tyk OAS APIs or continuing with Tyk Classic, this version brings the tools and features you need to streamline your workflows and enhance operational efficiency.
+
+For details please refer to the [changelog](#Changelog-v1.0.0) below.
+
+
+#### Breaking Changes
+<a id="breaking-changesv1.0.0"></a>
+
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+{/* This release has no breaking changes. */}
+**License Requirement:** Tyk Operator is now a closed-source product and requires a valid license key to operate. Please follow our [Installation and Upgrade Guide](/tyk-stack/tyk-operator/installing-tyk-operator) to set your license key before installation or upgrade.
+
+If the license is missing, invalid, or expired, Tyk Operator will exit with an error message. Ensure that you carefully review the setup steps to avoid any issues during the upgrade or installation process.
+
+**Admission Webhook Removal:** The admission webhook for security policy (`validate-tyk-tyk-io-v1alpha1-securitypolicy`) has been removed. No action is required from users, and existing `SecurityPolicy` CRDs and resources remain fully supported and unaffected.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention ALL changes in our application log messages in the changelog section. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log, etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates, etc. */}
+{/* ##### Planned Breaking Changes */}
+
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+##### Dependencies
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+
+{/* Required. Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+###### Compatibility Matrix For Tyk Components
+An illustrative example is shown below. */}
+{/* TBP - to be published. Helm chart, MDCB, operator and sync versions are the new versions and as such will be published only a few hours after the main release of 
+the dashboard and gateway. We must clarify this at the time of publishing this RN and remove TBP later, once the Helm charts are released 
+
+| Gateway Version | Recommended Compatibility | Backwards Compatibility |
+| :--------------- | :------------------------- | :----------------------- |
+| 5.3 LTS         | Helm v2.2 - TBP           | Helm vX - vY            |
+|                 | MDCB v2.5 - TBP           | MDCB v1.7 - v2.4        |
+|                 | Operator v1.8 - TBP       | Operator vX - vY        |
+|                 | Sync v2.4.1 - TBP         | Sync vX - vY            |
+|                 |                           | EDP vX - vY             |
+|                 |                           | Pump vX - vY            |
+|                 |                           | TIB vX - vY             | */}
+
+#### Dependencies
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [Kubernetes](https://kubernetes.io)                        | 1.26.x to 1.30.x       | 1.19.x to 1.30.x       |          | 
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+
+#### Upgrade instructions
+{/* Required. For patches release (Z>0) use this:
+For users currently on vX.Y.Z, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version X.Y.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions. */}
+Tyk Operator v1.0 introduced new Custom Resource Definitions (CRDs). Before upgrading to Tyk Operator v1.0 with Helm Chart, please run the following commands to install the CRDs:
+
+```bash
+$ kubectl apply -f https://raw.githubusercontent.com/TykTechnologies/tyk-charts/refs/heads/main/tyk-operator-crds/crd-v1.0.0.yaml
+```
+
+
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator#upgrading-tyk-operator) section for detailed upgrade instructions.
+
+
+#### Downloads
+- [Docker image v1.0.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v1.0.0)
+  - ```bash
+    docker pull tykio/tyk-operator:v1.0.0
+    ```
+- Helm chart
+  - [tyk-charts v2.1.0](/developer-support/release-notes/helm-chart#2-1-0-release-notes) {/* This is the link to the Helm charts links. Please be mindful that this URL is only available a few hours or day/s after we release the main release, so this link needs to be updated in a separate iteration */}
+{/* source code tarball for oss projects */}
+
+#### Changelog
+<a id="Changelog-v1.0.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<AccordionGroup>
+<Accordion title='TykOasApiDefinition: new Custom Resource for Tyk OAS'>
+The `TykOasApiDefinition` custom resource allows you to manage Tyk OAS APIs directly within your Kubernetes environment. You can now categorize APIs, manage multiple versions, and simplify SSL certificate management by referencing Kubernetes secrets. This enhancement offers a Kubernetes-native approach to managing Tyk APIs, streamlining operations and reducing the complexity of versioning and certificate handling across different environments.
+
+Learn More: [Create Tyk OAS API](/tyk-stack/tyk-operator/create-an-api#set-up-tyk-oas-api)
+</Accordion>
+
+<Accordion title='Ingress Controller: Support Tyk OAS API as an Ingress Template'>
+With this release, you can use the TykOasApiDefinition resource as a template for automatically creating Tyk OAS APIs based on Kubernetes Ingress specs. This simplifies the process of generating APIs by leveraging Ingress controller annotations, reducing manual intervention, and automating API creation workflows for better scalability and operational efficiency.
+
+Learn More: [Tyk Ingress Controller](/product-stack/tyk-operator/tyk-ingress-controller)
+</Accordion>
+
+<Accordion title='SecurityPolicy: Support for Key-Level Per-API Rate Limits and Quota'>
+This release introduces the ability to configure specific rate limits, quotas, and throttling rules at the API level using the `access_rights_array` in the security policy. Each API now has the flexibility to inherit global limit settings or apply custom limits, making it easier to control API usage on a per-API basis. This provides enhanced granularity in managing traffic, ensuring optimal resource allocation and improved performance under heavy loads.
+
+Learn More: [Key-Level Per-API Rate Limits and Quota](/tyk-stack/tyk-operator/create-an-api#security-policy-example)
+</Accordion>
+
+<Accordion title='SecurityPolicy: Support for Key-Level Per-Endpoint Rate Limits'>
+By configuring key-level per-endpoint limits, you can restrict the request rate for specific API clients to a specific endpoint of an API.
+
+Learn More: [Key-Level Per-Endpoint Rate Limits](/tyk-stack/tyk-operator/create-an-api#security-policy-example)
+</Accordion>
+
+<Accordion title='SecurityPolicy: Support for TykOasApiDefinition'>
+This update extends the security policy to include TykOasApiDefinition resources within the `access_rights_array`, allowing you to manage security policies for both Tyk Classic APIs and Tyk OAS APIs. By specifying the API kind, you can now apply rate limits, quotas, and other access controls to Tyk OAS APIs, streamlining security management in mixed environments.
+
+Learn More: [TykOasApiDefinition in Security Policy](/tyk-stack/tyk-operator/create-an-api#add-a-security-policy-to-your-api)
+</Accordion>
+
+<Accordion title='ApiDefinition: Support for Event Handler'>
+Tyk Operator now supports event handler integration for ApiDefinition, enabling webhooks to be triggered by specific API events. This allows for real-time, event-driven automation between Tyk and other systems, sending notifications or executing actions as events occur in the API lifecycle. The event_handlers field in the ApiDefinition CRD makes it easy to set up webhook-driven processes for better control and automation across your services.
+
+Learn More: [Event Webhook with Tyk Classic](/api-management/gateway-events#webhook-event-handlers-with-tyk-classic-apis)
+</Accordion>
+
+<Accordion title='ApiDefinition: Support timeout Field in Advanced Cache Control'>
+The advanced cache configuration for ApiDefinition now supports a timeout field, providing greater control over cache behavior. You can define specific cache timeouts for different API paths, allowing for more fine-tuned control over caching strategies. This feature helps optimize API performance, particularly for high-traffic endpoints requiring precise cache management.
+```yaml
+extended_paths:
+  advance_cache_config:
+    - path: "/json"    
+      method: "GET"
+      cache_response_codes: [200, 204]
+      timeout: 120
+```
+</Accordion>
+
+<Accordion title='ApiDefinition: Support new Fields in `VersionDefinition`'>
+`VersionDefinition` within `ApiDefinition` has been expanded to include additional fields, offering more granular control over API versioning and path management. These new fields allow you to configure version handling more flexibly, enhancing your ability to manage API versions and customize how version data is processed in API paths.
+</Accordion>
+</AccordionGroup>
+
+
+
+  
+##### Changed
+{/* This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Go Version Updated to 1.22'>
+The underlying Go runtime for Tyk Operator has been updated to version 1.22. This upgrade brings performance improvements, enhanced security, and compatibility with the latest Go libraries, ensuring Tyk Operator remains efficient and secure in production environments.
+</Expandable>
+
+<Expandable title='Admission Webhook for SecurityPolicy Removed'>
+The admission webhook for the security policy (`validate-tyk-tyk-io-v1alpha1-securitypolicy`) has been removed because it did not perform any functional validation. This change simplifies deployment of Tyk Operator and reduces webhook overhead.
+</Expandable>
+
+
+
+{/* ###### Fixed
+This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. 
+
+
+<Expandable title='Changelog item summary'>
+The actual changelog item text should go here. It should be no more than three or four sentences. It should link to a content page for further explanation where applicable. There should be a blank line between the summary tags and this paragraph, otherwise, links will not be rendered.
+</Expandable>
+
+
+<Expandable title='Another changelog item summary'>
+The actual changelog item text should go here. It should be no more than three or four sentences. It should link to the content page for further explanation where applicable. There should be a blank line between the summary tags and this paragraph, otherwise, links will not be rendered.
+</Expandable>
+
+ */}
+
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+##### Security Fixes
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 0.18 Release Notes
+### 0.18.0 Release Notes
+
+#### Release date 4 Jul 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator#upgrading-tyk-operator) section for detailed upgrade instructions.
+
+#### Release Highlights
+This release added support for Tyk 5.4 API definition.
+
+For details please refer to the [changelog](#Changelog-v0.18.0) below.
+
+#### Downloads
+- [Docker image v0.18.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v0.18.0)
+  - ```bash
+    docker pull tykio/tyk-operator:v0.18.0
+    ```
+- Source code tarball - [Tyk Operator Repo](https://github.com/TykTechnologies/tyk-operator/releases/tag/v0.18.0)
+
+#### Changelog
+<a id="Changelog-v0.18.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<Expandable title='Added support of Tyk 5.4 API definition CRD'>
+Added to ApiDefinition [Custom Resource Definition (CRD)](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/): 
+
+- [introspection](/api-management/graphql#turning-off-introspection) option to enable/disable GraphQL introspection
+- [graphql.proxy.auth_headers](/api-management/graphql#creating-a-graphql-api-via-the-dashboard-ui)
+- [graphql.proxy.subscription_type](/api-management/graphql#graphql-subscriptions)
+- [graphql.proxy.request_headers](/api-management/graphql#request-headers)
+- graphql.proxy.use_response_extensions
+- graphql.proxy.request_headers_rewrite
+- graphql.proxy.features
+</Expandable>
+
+
+
+
+## 0.17 Release Notes
+### 0.17.1 Release Notes
+
+#### Release date 6 May 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator#upgrading-tyk-operator) section for detailed upgrade instructions.
+
+#### Release Highlights
+This release is focused on bug fixes. For details please refer to the [changelog](#Changelog-v0.17.1) below.
+
+#### Downloads
+- [Docker image v0.17](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v0.17.1)
+  - ```bash
+    docker pull tykio/tyk-operator:v0.17.1
+    ```
+- Source code tarball - [Tyk Operator Repo](https://github.com/TykTechnologies/tyk-operator/releases/tag/v0.17.1)
+
+#### Changelog
+<a id="Changelog-v0.17.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Fixed ApiDefinition Custom Resources generated by the Ingress Controller used a wrong certificate'>
+When using Tyk as an Ingress Controller with TLS enabled, the ApiDefinition Custom Resources generated by the Ingress Controller is missing the OrgID field. As a result, Tyk Gateway used a wrong certificate when serving a request. It is fixed by adding back OrgID field to ApiDefinition CRs created by Ingress Controller.
+</Accordion>
+
+<Accordion title='Added Webhook and RBAC port configurations in Tyk Operator Helm chart'>
+Users can configure Tyk Operator webhook and RBAC port via helm chart values `.Values.webhookPort` and `.Values.rbac.port` respectively.
+</Accordion>
+
+<Accordion title='Addressed security vulnerabilities CVE-2023-45288'>
+Addressed security vulnerabilities [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288) where an attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
+</Accordion>
+
+<Accordion title='Addressed security vulnerabilities CVE-2024-24786'>
+Addressed security vulnerabilities [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786) where the `protojson.Unmarshal` function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a `google.protobuf.Any` value, or when the `UnmarshalOptions.DiscardUnknown` option is set.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+### 0.17.0 Release Notes
+
+#### Release date 05 Apr 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+Go to the [Upgrading Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator#upgrading-tyk-operator) section for detailed upgrade Instructions.
+
+#### Release Highlights
+This release added support for `GraphQLIntrospectionConfig` in API definition and fixed an issue where the Tyk Operator creates duplicate APIs on Tyk.
+
+For details please refer to the [changelog](#Changelog-v0.17.0) below.
+
+#### Downloads
+- [Docker image v0.17](https://hub.docker.com/r/tykio/tyk-operator/tags?page=&page_size=&ordering=&name=v0.17.0)
+  - ```bash
+    docker pull tykio/tyk-operator:v0.17.0
+    ```
+- Source code tarball - [Tyk Operator Repo](https://github.com/TykTechnologies/tyk-operator/releases/tag/v0.17.0)
+
+#### Changelog
+<a id="Changelog-v0.17.0" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Fixed creating duplicated API definitions on Tyk'>
+Fix creating duplicated API definitions on Tyk in case of cluster failures. If network errors happen while updating the API definition, the Tyk Operator retries the reconciliation based on the underlying error type.
+</Expandable>
+
+
+
+##### Added
+
+
+
+<Expandable title='Added support of GraphQLIntrospectionConfig in API definition CRD'>
+Added to ApiDefinition CRD: support of `GraphQLIntrospectionConfig` field at `graphql.introspection.disabled`. This feature will be enabled in future Tyk releases.
+</Expandable>
+
+
+
+## 0.16 Release Notes
+### 0.16.0 Release Notes
+
+#### Release date 12 Jan 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade Instructions
+While upgrading Tyk Operator release via Helm, please make sure that the latest CRDs are also applied on the cluster, as follows:
+```bash
+kubectl apply -f https://raw.githubusercontent.com/TykTechnologies/tyk-operator/v0.16.0/helm/crds/crds.yaml
+```
+
+#### Release Highlights
+This release added support for analytics plugin, UDG global header, and detailed tracing setting in ApiDefinition as detailed in the [changelog](#Changelog-v0.16.0) below.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-operator/v0.16.0/images/sha256-7c5b526af96ef772e8e53b8817538f41585c4ad641388609b349368219bb3d7d?context=explore)
+- [Source code](https://github.com/TykTechnologies/tyk-operator/releases/tag/v0.16.0)
+
+#### Changelog
+<a id="Changelog-v0.16.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Added imagePullSecrets configuration for ServiceAccount in Tyk Operator Helm chart'>
+Added [imagePullSecrets](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) configuration for ServiceAccount in Tyk Operator Helm chart. It allows user to pull image from a private registry.
+</Accordion>
+
+<Accordion title='Added tyk to categories field of CRDs'>
+Added tyk to categories field of CRDs. So, from now on, all CRs related to Tyk Operator is grouped into tyk category and can be displayed via kubectl get tyk.
+</Accordion>
+
+<Accordion title='Added support of analytics plugin in ApiDefinition CRD'>
+Added to ApiDefinition CRD: support of analytics plugin at [spec.analytics_plugin](https://doc.crds.dev/github.com/TykTechnologies/tyk-operator/tyk.tyk.io/ApiDefinition/v1alpha1@v0.16.0#spec-analytics_plugin). See [Example CRD with Analytics Plugin](https://github.com/TykTechnologies/tyk-operator/tree/master/config/samples/analytics_plugin.yaml) for details.
+</Accordion>
+
+<Accordion title='Added support of UDG Global Header in ApiDefinition CRD'>
+Added to ApiDefinition CRD: support for UDG Global Header at [spec.graphql.engine.global_headers](https://doc.crds.dev/github.com/TykTechnologies/tyk-operator/tyk.tyk.io/ApiDefinition/v1alpha1@v0.16.0#spec-graphql-engine-global_headers) object in ApiDefinition CRD. This feature is compatible with Tyk 5.2 or above.
+</Accordion>
+
+<Accordion title='Added support of detail tracing in ApiDefinition CRD'>
+Added to ApiDefinition CRD: support for detail tracing configuration at [spec.detailed_tracing](https://doc.crds.dev/github.com/TykTechnologies/tyk-operator/tyk.tyk.io/ApiDefinition/v1alpha1@v0.16.0#spec-detailed_tracing) field in ApiDefinition CRD. Enable it for the API if you want to get detail span for each middleware involved in request processing.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Updated
+
+
+
+
+<Expandable title='Updated Go version to 1.21'>
+Updated Go version to 1.21
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Fixed CVE-2023-39325 (NVD)'>
+Fixed [CVE-2023-39325 (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
+</Expandable>
+
+
+
+
+
+<Expandable title='Fixed security policy handling in OSS mode'>
+Fixed a bug that prevents Tyk Operator to work with SecurityPolicy in OSS Mode. Now, SecurityPolicy controller will not modify spec.MID (_id) field in SecurityPolicy
+</Expandable>
+
+
+
+
+## Further Information
+
+### Upgrading Tyk
+Please refer to the [upgrading Tyk](/developer-support/upgrading) page for further guidance on the upgrade strategy.
+
+{/* ### API Documentation
+Required. Update the link to the Gateway "tyk-gateway-api" or dashboard "tyk-dashboard-api" and the Postman collection
+
+If there were changes in any of Tyk’s API docs:
+
+- Have API endpoints been documented in the release note summary and changelog?				
+- Has a link to the endpoint documentation being included?
+- Has the benefit of the new/updated endpoint been explained in the release highlights and changelog?
+- [OpenAPI Document]()
+- [Postman Collection](https://www.postman.com/tyk-technologies/workspace/tyk-public-workspace/collection/<collection-id />) */}
+
+### FAQ
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
+
+{/* ### Miscellaneous (Optional)
+For each specific release if there is additional miscellaneous information or announcements that will be helpful to the customer then squads
+should add additional sections to their release notes. */}
diff --git a/developer-support/release-notes/overview.mdx b/developer-support/release-notes/overview.mdx
new file mode 100644
index 0000000000..a69611cf98
--- /dev/null
+++ b/developer-support/release-notes/overview.mdx
@@ -0,0 +1,147 @@
+---
+title: "Latest Tyk Releases"
+description: "Explore Tyk's latest releases. Here you will find latest releases and access to docker images and release notes for all our platforms."
+---
+
+export const releaseData = {
+  "licensed": [
+    {
+      "home": "tyk-dashboard",
+      "name": "Tyk Dashboard",
+      "licensed": true,
+      "latest": "5.14.0",
+      "releaseNotesPath": "developer-support/release-notes/dashboard",
+      "lts": "5.13.2",
+      "latestData": {
+        "name": "5.14.0",
+        "date": "07/07/2026",
+        "docker": "https://hub.docker.com/r/tykio/tyk-dashboard/tags?page=1&name=v5.14.0"
+      }
+    },
+    {
+      "home": "tyk-stack/tyk-operator/installing-tyk-operator",
+      "name": "Tyk Operator",
+      "licensed": true,
+      "latest": "1.4.2",
+      "releaseNotesPath": "developer-support/release-notes/operator",
+      "latestData": {
+        "name": "1.4.2",
+        "date": "21/05/2026",
+        "docker": "https://hub.docker.com/r/tykio/tyk-operator/tags?page=1&name=1.4.2"
+      }
+    },
+    {
+      "home": "product-stack/tyk-sync/installing-tyk-sync",
+      "name": "Tyk Sync",
+      "licensed": true,
+      "latest": "2.2.0",
+      "releaseNotesPath": "developer-support/release-notes/sync",
+      "latestData": {
+        "name": "2.2.0",
+        "date": "21/05/2026",
+        "docker": "https://hub.docker.com/r/tykio/tyk-sync/tags?page=1&name=v2.2.0"
+      }
+    },
+    {
+      "home": "tyk-multi-data-centre",
+      "name": "Tyk MDCB",
+      "licensed": true,
+      "latest": "2.13.0",
+      "releaseNotesPath": "developer-support/release-notes/mdcb",
+      "latestData": {
+        "name": "2.13.0",
+        "date": "19/05/2026",
+        "docker": "https://hub.docker.com/r/tykio/tyk-mdcb-docker/tags?page=1&name=v2.13.0"
+      }
+    },
+    {
+      "home": "tyk-developer-portal/tyk-enterprise-developer-portal",
+      "name": "Tyk Enterprise Developer Portal",
+      "licensed": true,
+      "latest": "1.18.0",
+      "releaseNotesPath": "developer-support/release-notes/portal",
+      "latestData": {
+        "name": "1.18.0",
+        "date": "4/06/2026",
+        "docker": "https://hub.docker.com/r/tykio/portal/tags?page=1&name=1.18.0"
+      }
+    }
+  ],
+  "opensource": [
+    {
+      "home": "tyk-oss-gateway",
+      "name": "Tyk Gateway",
+      "licensed": false,
+      "latest": "5.14.0",
+      "releaseNotesPath": "developer-support/release-notes/gateway",
+      "lts": "5.13.2",
+      "latestData": {
+        "name": "5.14.0",
+        "date": "07/07/2026",
+        "docker": "https://hub.docker.com/r/tykio/tyk-gateway/tags?page=1&name=v5.14.0",
+        "tag": "https://github.com/TykTechnologies/tyk/releases/tag/v5.14.0"
+      }
+    },
+    {
+      "home": "tyk-pump",
+      "name": "Tyk Pump",
+      "licensed": false,
+      "latest": "1.16.0",
+      "releaseNotesPath": "developer-support/release-notes/pump",
+      "latestData": {
+        "name": "1.16.0",
+        "date": "19/05/2026",
+        "docker": "https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=1&name=v1.16.0",
+        "tag": "https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.16.0"
+      }
+    },
+    {
+      "home": "tyk-identity-broker",
+      "name": "Tyk Identity Broker",
+      "licensed": false,
+      "latest": "1.7.3",
+      "releaseNotesPath": "developer-support/release-notes/tib",
+      "latestData": {
+        "name": "1.7.3",
+        "date": "23/06/2026",
+        "docker": "https://hub.docker.com/r/tykio/tyk-identity-broker/tags?page=1&name=1.7.3",
+        "tag": "https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.7.3"
+      }
+    },
+    {
+      "home": "product-stack/tyk-charts/overview",
+      "name": "Tyk Helm Charts",
+      "licensed": false,
+      "latest": "5.3.0",
+      "releaseNotesPath": "developer-support/release-notes/helm-chart",
+      "latestData": {
+        "name": "5.3.0",
+        "date": "21/05/2026",
+        "docker": "",
+        "tag": "https://github.com/TykTechnologies/tyk-charts/releases"
+      }
+    },
+    {
+      "home": "ai-management/ai-studio/overview",
+      "name": "Tyk AI Studio",
+      "licensed": false,
+      "latest": "2.1.0",
+      "releaseNotesPath": "developer-support/release-notes/ai-studio",
+      "latestData": {
+        "name": "2.1.0",
+        "date": "14/05/2026",
+        "docker": "https://hub.docker.com/r/tykio/tyk-ai-studio/tags?page=1&name=v2.1.0",
+        "tag": "https://github.com/TykTechnologies/ai-studio/releases/tag/v2.1.0"
+      }
+    }
+  ]
+};
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+import { ReleaseSummaryComponent } from '/snippets/ReleaseSummaryComponent.mdx';
+
+View the release notes for both our licensed and open source components. The notes contain detailed insights about features, enhancements and bug fixes, and are a vital resource for developers evaluating upgrades.
+
+Please consult our [LTS policy](/developer-support/release-types/long-term-support) for information and guidelines relating to Long Term Support releases.
+
+<ReleaseSummaryComponent releaseData={releaseData} />
diff --git a/developer-support/release-notes/portal.mdx b/developer-support/release-notes/portal.mdx
new file mode 100644
index 0000000000..6d61b79361
--- /dev/null
+++ b/developer-support/release-notes/portal.mdx
@@ -0,0 +1,2420 @@
+---
+title: "Tyk Developer Portal Release Notes"
+description: "Release notes documenting updates, enhancements and changes for Tyk Developer Portal"
+keywords: "Developer Portal, Enterprise Developer Portal, EDP, Release notes, changelog"
+order: 7
+sidebarTitle: "Release Notes"
+---
+
+**Licensed Protected Product**
+
+**This page contains all release notes for Tyk Developer Portal displayed in reverse chronological order**
+
+## Support Lifetime
+Only the most recent Tyk Developer Portal release is supported. We recommend staying current to minimise exposure to security vulnerabilities from third party dependencies.
+
+---
+
+## 1.18 Release Notes
+
+### 1.18.0 Release Notes 
+
+#### Release Date 7 July 2026
+
+#### Release Highlights
+
+In this release, we have implemented support for the Client IdP registry introduced in [Tyk 5.14.0](/developer-support/release-notes/dashboard#5-14-0-release-notes). This feature provides centralized management of IdPs and scope-to-policy mappings used with API Products secured with [JWT Authentication](/basic-config-and-security/security/authentication-authorization/json-web-tokens), resolving a historical issue with Dynamic Client Registration configuration not being properly cleaned up when associated API Products or Plans are deleted.
+
+<Note>
+This feature is available only from Tyk Gateway 5.14.0 and Tyk Dashboard 5.14.0 and must be enabled in the Developer Portal by setting the new configuration option [`TYK_PORTAL_ENABLEIDPREGISTRY`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#tyk_portal_enableidpregistry) to `true`.
+</Note>
+
+This release also fixes some issues in the Developer Portal API and when searching in the Admin Portal. We have also resolved several recent CVEs to strengthen security.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.18.0) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-1.18.0"></a>
+
+If you are upgrading to 1.18.0, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.18.0)
+  - ```bash
+    docker pull tykio/portal:v1.18.0
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+#### Changelog
+<a id="Changelog-v1.18.0" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Updated embedded Tyk Identity Broker to version 1.7.3'>
+{/* TT-17453 */}
+Tyk Developer Portal embeds Tyk Identity Broker. This has been updated to [version 1.7.3](/developer-support/release-notes/tib#1-7-3-release-notes).
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Deleting DCR Products or Plans did not remove IdP details from API definition'>
+With the introduction of the new Client IdP registry in Tyk Dashboard (from Tyk 5.14.0) we have resolved an issue seen when deleting an API Product that uses Dynamic Client Registration (DCR). When deleting the API Product, the associated policy is correctly deleted from the Dashboard, but the JWKS endpoint and scope-to-policy mappings are not deleted from the associated API definitions. This limitation is caused by uncertainty over the provenance of that configuration in the API definition.
+
+The Client IdP registry removes this uncertainty through central management of Identity Provider configuration.
+
+The Developer Portal will use the Client IdP Registry to manage associations between OAuth 2.0 Providers (Identity Providers) and the APIs included in an API Product under the following circumstances:
+
+- Tyk Gateway version 5.14.0 or later
+- Tyk Dashboard version 5.14.0 or later
+- Tyk Developer Portal version 1.18.0 or later with [`TYK_PORTAL_ENABLEIDPREGISTRY`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#tyk_portal_enableidpregistry) set to `true`
+
+If [`TYK_PORTAL_ENABLEIDPREGISTRY`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#tyk_portal_enableidpregistry) is not set, then the Portal will continue to manage the Identity Provider details in the API definitions and is unable to remove these if the API Product is deleted.
+</Accordion>
+
+<Accordion title='Fix error when searching Teams by name or Organisation in Admin Portal'>
+Resolved an issue where searching on the Teams page (**API Consumers > Teams**) in the Admin Portal returned a database error whenever the search term was not numeric, such as a Team or Organisation name.
+
+Team search now works for both numeric IDs and text: a numeric value matches teams by ID, text matches team names with a case-insensitive substring search, and non-numeric input is handled safely instead of producing an error. The Organisation filter is unaffected.
+</Accordion>
+
+<Accordion title='Fields missing from Portal API response'>
+Resolved an issue seen when retrieving an API Plan using the `GET /portal-api/plans/{plan_id}` endpoint. The data returned by this call omitted the `Catalogues` field but now correctly returns the list of IDs for the catalogues associated with the API Plan, so that plan-to-catalogue associations can be verified directly without extra API calls.
+
+Resolved an issue seen when retrieving a Catalogue using the `GET /portal-api/catalogues/{id}` endpoint. The data returned by this call omitted the `NameWithSlug` field but now correctly returns this in the response payload.
+</Accordion>
+
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33813" target="_blank">CVE-2026-33813</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46599" target="_blank">CVE-2026-46599</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45447" target="_blank">CVE-2026-45447</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34180" target="_blank">CVE-2026-34180</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45445" target="_blank">CVE-2026-45445</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-7383" target="_blank">CVE-2026-7383</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-9076" target="_blank">CVE-2026-9076</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46602" target="_blank">CVE-2026-46602</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46604" target="_blank">CVE-2026-46604</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42500" target="_blank">CVE-2026-42500</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42766" target="_blank">CVE-2026-42766</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42767" target="_blank">CVE-2026-42767</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45446" target="_blank">CVE-2026-45446</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34182" target="_blank">CVE-2026-34182</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-2303" target="_blank">CVE-2026-2303</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46601" target="_blank">CVE-2026-46601</a>
+- <a href="https://osv.dev/vulnerability/GHSA-xmrv-pmrh-hhx2" target="_blank">GHSA-xmrv-pmrh-hhx2</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34181" target="_blank">CVE-2026-34181</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34183" target="_blank">CVE-2026-34183</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42764" target="_blank">CVE-2026-42764</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42768" target="_blank">CVE-2026-42768</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42769" target="_blank">CVE-2026-42769</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42770" target="_blank">CVE-2026-42770</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+## 1.17 Release Notes
+
+### 1.17.3 Release Notes 
+
+#### Release Date 4 June 2026
+
+#### Release Highlights
+
+This release restores the environment variable behaviour that changed in 1.17.1 and 1.17.2, where some `PORTAL_*` variables were no longer recognised. Every legacy `PORTAL_*` variable now works exactly as it did in 1.17.0, and Portal also gains a new `TYK_PORTAL_` prefix with a consistent naming style that matches the convention used across other Tyk components.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.17.3) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-1.17.3"></a>
+
+If you are upgrading to 1.17.3, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.17.3)
+  - ```bash
+    docker pull tykio/portal:v1.17.3
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+#### Changelog
+<a id="Changelog-v1.17.3" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fix Portal environment variables no longer being recognised'>
+Resolved a regression introduced in 1.17.1 where some configuration environment variables stopped taking effect. The most visible symptom was that `PORTAL_DISABLE_CSRF_CHECK` was silently ignored, causing a "bad request" error when users tried to log in. All legacy `PORTAL_*` variable names now work exactly as they did in 1.17.0. 
+
+This release also introduces a new `TYK_PORTAL_` prefix for configuration environment variables, using a single consistent naming style that matches the convention used by other Tyk components such as the Dashboard (`TYK_DB_*`). When the same setting is provided under both prefixes, the `TYK_PORTAL_` value takes precedence over the `PORTAL_` value.
+</Accordion>
+
+</AccordionGroup>
+
+
+### 1.17.2 Release Notes 
+
+#### Release Date 20 May 2026
+
+#### Release Highlights
+
+This release implements a fix to avoid the unintentional visibility of MCP proxy access policies on the Developer Portal.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.17.2) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-1.17.2"></a>
+
+If you are upgrading to 1.17.2, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+<Note>
+**If you are upgrading Tyk Dashboard to v5.13.0, we strongly recommend that you upgrade to Developer Portal v1.17.2 at the same time.**
+
+Tyk Dashboard v5.13.0 introduces [MCP Proxy](/ai-management/mcp-gateway/managing-proxies) support. Products granting access to MCP Proxies are not currently supported from Developer Portal.
+
+With the introduction of MCP Proxy support in the Gateway and Dashboard, however, Policies may be created on the Dashboard that grant access to MCP proxies. Prior to Developer Portal v1.17.2, such Policies would be visible in the Developer Portal and could be inadvertently published to Portal users.
+
+See [MCP Gateway upgrade considerations](/developer-support/upgrading#mcp-upgrade-considerations) for the full component deployment order.
+</Note>
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.17.2)
+  - ```bash
+    docker pull tykio/portal:v1.17.2
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+#### Changelog
+<a id="Changelog-v1.17.2" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Avoid accidental exposure of MCP Proxies'>
+Tyk Gateway and Dashboard 5.13.0 introduce support for MCP proxies to be deployed and managed on the MCP Gateway.
+
+Developer Portal does not currently support the publication of Products granting access to MCP proxies, but prior to 1.17.2 the MCP proxy access policies created in the Dashboard will automatically be exposed as API Products.
+
+From this release, those policies are no longer exposed on the Developer Portal, avoiding the risk of accidental publication of unsupported API Products in Catalogs.
+
+First-class support for MCP Products will be introduced to the Developer Portal in a subsequent release.
+</Accordion>
+
+</AccordionGroup>
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33813" target="_blank">CVE-2026-33813</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33811" target="_blank">CVE-2026-33811</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39820" target="_blank">CVE-2026-39820</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39836" target="_blank">CVE-2026-39836</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42499" target="_blank">CVE-2026-42499</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32952" target="_blank">CVE-2026-32952</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39823" target="_blank">CVE-2026-39823</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39826" target="_blank">CVE-2026-39826</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39825" target="_blank">CVE-2026-39825</a>
+
+
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.17.1 Release Notes 
+
+#### Release Date 24 April 2026
+
+#### Release Highlights
+
+Tyk Developer Portal has been updated to Golang 1.25 and Debian 13 (Trixie) for enhanced security and performance. This patch also resolves some issues with the Portal API and synchronization of assets with the Tyk Dashboard.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.17.1) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+<a id="upgrade-1.17.1"></a>
+
+If you are upgrading to 1.17.1, please follow the detailed [upgrade instructions](#upgrading-tyk).
+
+#### Downloads
+
+- [Docker Image to pull](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.17.1)
+  - ```bash
+    docker pull tykio/portal:v1.17.1
+    ```
+- Helm charts
+  - [tyk-charts](/developer-support/release-notes/helm-chart)
+
+#### Changelog
+<a id="Changelog-v1.17.1" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Update Developer Portal to Golang 1.25'>
+Updated the Tyk Developer Portal to use Golang 1.25, ensuring compatibility with the latest Golang runtime features and reducing exposure to potential security vulnerabilities in older versions.
+</Accordion>
+
+<Accordion title='Update base images to Debian 13 (Trixie)'>
+Updated the base Docker images for Tyk Portal to Debian 13 (Trixie) to address multiple vulnerabilities in the underlying operating system.
+</Accordion>
+
+<Accordion title='MCP Proxies excluded from the Developer Portal'>
+MCP Proxies are not surfaced in the Developer Portal as the Portal has no native MCP support.
+
+Full support for MCP Proxies in the Developer Portal will be available in a future release.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed Portal API Endpoints Returning Incorrect `Content-Type` Headers'>
+Resolved an issue where several Portal API endpoints returned incorrect `Content-Type` headers. Previously, endpoints that didn't explicitly write a response body would default to `text/plain` instead of the expected `application/json`, potentially causing client applications to misinterpret API responses.
+
+The fix addresses this issue across all affected Portal API endpoints, including product management endpoints (documentation, logos, previews, OpenAPI specs, GraphQL schemas, tags), user management endpoints, and other Portal API operations. All Portal API endpoints now return the correct `Content-Type` header that matches their actual response content.
+</Accordion>
+
+<Accordion title='Fixed Portal API Enum Field Handling for Null Values'>
+Resolved an issue where the Portal API returned empty strings (`""`) instead of `null` values for optional enum fields when their values were not set. Previously, endpoints such as `/api/posts` and `/api/catalogues` would incorrectly serialize null enum values as empty strings, violating the API contract and potentially causing client-side parsing issues.
+
+The Portal API now properly omits optional enum fields from responses when they are empty, ensuring consistent and correct API behavior across all endpoints, including posts, catalogues, access requests, and providers.
+</Accordion>
+
+<Accordion title='Fixed Plan Field Updates Not Propagating to Dashboard Policies'>
+Resolved an issue where updates to certain Plan fields in the Developer Portal were not properly propagating to their corresponding Dashboard Policies. Previously, when administrators updated only the `KeyExpiresIn` (key expiration time) or `MetaData` fields through either the Portal UI or API, these changes would not sync to the Dashboard unless other fields such as rate limits or quotas were modified simultaneously. This occurred due to an incomplete change detection mechanism that omitted these fields from its validation checks. 
+
+The Portal now correctly detects and propagates all plan field changes to Dashboard Policies, ensuring that updates to key expiration settings and metadata are immediately reflected in the Dashboard regardless of whether other fields are modified at the same time.
+</Accordion>
+
+<Accordion title='Fixed policy reference inconsistency in API definitions'>
+Resolved an issue where the Portal incorrectly used database object IDs (_id) instead of custom Policy IDs (id) when linking policies to APIs through Products or Plans. This caused "policy not found" errors during JWT validation as the Gateway prioritizes custom Policy IDs. The Portal now consistently uses Policy IDs for all scope-to-policy mappings and properly cleans up old mappings during updates.
+
+</Accordion>
+
+</AccordionGroup>
+
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33186" target="_blank">CVE-2026-33186</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25679" target="_blank">CVE-2026-25679</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33487" target="_blank">CVE-2026-33487</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32285" target="_blank">CVE-2026-32285</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27587" target="_blank">CVE-2026-27587</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34986" target="_blank">CVE-2026-34986</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39883" target="_blank">CVE-2026-39883</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33815" target="_blank">CVE-2026-33815</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33816" target="_blank">CVE-2026-33816</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32282" target="_blank">CVE-2026-32282</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32283" target="_blank">CVE-2026-32283</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32280" target="_blank">CVE-2026-32280</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32281" target="_blank">CVE-2026-32281</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32288" target="_blank">CVE-2026-32288</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39882" target="_blank">CVE-2026-39882</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32289" target="_blank">CVE-2026-32289</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27139" target="_blank">CVE-2026-27139</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27142" target="_blank">CVE-2026-27142</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33809" target="_blank">CVE-2026-33809</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+
+---
+
+### 1.17.0 Release Notes
+
+#### Release Date 13 March 2026
+
+#### Release Highlights
+
+Developer Portal 1.17 brings enhanced experience and security when using mTLS secured API Products.
+
+The new Auth Token-Certificate binding option enhances security by preventing the use of mismatched tokens and certificates. When client access to APIs in a Product are secured using Auth Token with mTLS, you can now link specific client certificates to each issued token. Tyk Gateway will only authorise access requests with matched tokens and certificates, mitigating against the risk of token theft.
+
+We've added a new Certificate Management function in the Admin Portal, where you can upload client certificates, retrieve existing certificates from the [Tyk Certificate Store](/api-management/certificates#tyk-certificate-store), and associate certificates with Organisations.
+
+When an Auth Token ([API Key](/portal/overview/concepts#access-credentials)) is issued to a Developer App, the appropriate certificate or certificates will automatically be linked to that token to ensure that the API Consumer can access the Product's APIs using a combination of the token with their client certificate.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.17.0) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are on version 1.16.0 or an older version, we recommend upgrading to this release ASAP.
+
+To upgrade the Portal's theme, please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes).
+
+#### Download
+- [Docker image v1.17.0](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.17.0)
+  - ```bash
+    docker pull tykio/portal:v1.17.0
+    ```
+
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.17.0)
+
+#### Changelog
+<a id="Changelog-v1.17.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Enhanced Security and Certificate Management with mTLS Secured Products'>
+When client access to APIs in a Product is secured using Auth Token with mTLS, you can now link specific client certificates to each issued token. Tyk Gateway will only authorise access requests with matched tokens and certificates, mitigating against the risk of token theft.
+
+To support this, the Admin Portal now has a dedicated certificate management interface to upload new certificates, synchronize them from Tyk Dashboard providers, and associate them with specific Organisations.
+
+API Owners can now enable certificate-token binding on a per-Product basis for APIs using mTLS. When enabled, the system automatically binds the appropriate certificate to an access token upon approval, ensuring that only the correct token-certificate pair can be used to gain API access.
+
+For Managed mTLS Products, the certificates associated with the API Consumer's Organisation will be bound to their token. For Self-Serve mTLS Products, the certificate provided by the API Consumer will be bound to the token.
+</Accordion>
+
+
+
+
+</AccordionGroup>
+
+##### Fixed
+<AccordionGroup>
+
+<Accordion title='Custom Credential Rotation and Revocation'>
+The Developer Portal now properly supports rotation and revocation operations for [Tyk Managed Custom Credentials](/tyk-developer-portal/import-custom-credentials). Custom credentials now support the same lifecycle management as standard Tyk tokens.
+</Accordion>
+
+<Accordion title='API Selection Display and Filter Persistence in API Products'>
+Fixed two issues affecting API selection when editing API Products:
+
+First, when multiple APIs shared the same name, the Portal would incorrectly display which API was selected, potentially causing data corruption if users saved without noticing the error.
+
+Second, applying search or category filters would cause all pending selections to be lost, forcing users to restart their selection process. Both issues have been resolved, ensuring accurate API selection display and persistent selection state during filtering operations.
+</Accordion>
+
+<Accordion title='mTLS Certificate Re-attachment Option Missing After Detachment'>
+Fixed an issue where the "Attach Certificate" option could disappear after detaching a certificate from the Developer App, leaving the API Consumer unable to register their client certificate for access to the API Product. Developers can now properly re-attach certificates to their apps.
+</Accordion>
+
+<Accordion title='mTLS Certificate Attachment Visibility in App Details'>
+Fixed an issue where the option to "Attach Mutual TLS Certificate" section was incorrectly displayed on the App Details page for Managed mTLS Products. This is now only displayed for Self-Serve mTLS Products, allowing the API Consumer to register their client certificate. For Managed mTLS Products, the permitted client certificates are registered by the API Owner in the Admin Portal.
+</Accordion>
+
+</AccordionGroup>
+
+
+
+## 1.16 Release Notes
+
+### 1.16.0 Release Notes
+
+#### Release Date 19 December 2025
+
+#### Release Highlights
+
+Developer Portal v1.16.0 addresses credential sprawl that impacts large-scale API programs. Developers can now reuse a single credential across multiple API products. We've also streamlined the access request flow from 5 steps to 2. For admins, you get instant central control: add or remove access to API product from any credential in seconds, change plans without generating new keys, and manage mTLS certificates centrally for compliance.
+
+**Key benefits:**
+- **One key, multiple APIs:** Reuse credentials when auth requirements match
+- **Streamlined access requests:** Direct access flow eliminates the need to add API products to shopping cart
+- **Change plans on existing OAuth 2.0 credentials:** Upgrade rate limits without regenerating keys or redeploying apps
+- **Central credential management:** Add/remove products or revoke access via Portal admin, without need to contact developers
+- **Managed mTLS certificates:** Centralize certificate control for compliance while developers self-serve access requests
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.16.0) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are on version 1.15.0 or an older version, we recommend upgrading to this release ASAP.
+
+To upgrade the Portal's theme, please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes).
+
+#### Download
+- [Docker image v1.16.0](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.16.0)
+  - ```bash
+    docker pull tykio/portal:v1.16.0
+    ```
+
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.16.0)
+
+#### Changelog
+<a id="Changelog-v1.16.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Direct Access Flow for API Products'>
+The Developer Portal now offers a streamlined Direct Access Flow that can substitute (if enabled in Admin General Settings) the Cart-based flow for API product access requests. This new flow allows developers to request access to API products immediately without adding them to a cart, reducing friction and improving the developer experience.
+
+For more information, please visit [Requesting Access to an API Product](/tyk-developer-portal/direct-access-flow)
+</Accordion>
+
+<Accordion title='Single Credential for Multiple API Products'>
+Developers can now add multiple API products to a single credential, eliminating credential sprawl and simplifying key management. This feature allows for simpler credential management while maintaining security and access control.
+
+For more information, please visit [Credential Management and Reusability](/tyk-developer-portal/single-credentials-multiple-api-products)
+</Accordion>
+
+<Accordion title='Plan Management for Existing Credentials'>
+Both API consumers and portal admins can now change plans for products on active OAuth 2.0 credentials within an app, allowing access level updates without regenerating keys or redeploying apps.
+</Accordion>
+
+<Accordion title='Custom SSO Login URL Configuration'>
+The Developer Portal now supports configuring a custom SSO login URL that redirects users to your identity provider's login page instead of the default Portal login page. When configured, all authentication flows automatically redirect to the specified external login system. This can be configured by adding the `SSOCustomLoginURL` setting to your portal configuration or setting the environment variable `PORTAL_SSO_CUSTOM_LOGIN_URL` when starting the portal.
+</Accordion>
+
+<Accordion title='Centralized Management for mTLS APIs'>
+API owners can now configure how client certificates are managed for mTLS-secured APIs in their API Products. Instead of always requiring developers to upload certificates during access requests, API owners can choose between self-serve certificate management (current behavior) or centralised managed certificates, where certificates are pre-configured via the Dashboard, and API Consumers will not be requested (nor able) to provide a certificate when requesting access.
+</Accordion>
+
+<Accordion title='Exposed Developer App Credentials Access on Product Pages'>
+Exposed developer app credentials on product detail and documentation pages, making it possible to inject approved credentials to OpenAPI and GraphQL playground. Integrating the credentials to your templates could eliminate the need for users to navigate away from documentation to retrieve their API keys, significantly reducing friction when testing APIs.
+</Accordion>
+
+<Accordion title='Added Auto-Population of GraphQL Server URL in API Product Documentation'>
+Enhanced the API Product creation workflow by automatically pre-populating the GraphQL server URL field when a GraphQL API is selected. The system now combines the baseline URL of the provider with the API's listen path to generate the correct URL, while keeping the field editable for custom configurations.
+
+If the BaselineURL of the provider is not configured, `<< gateway url>>` will be used as placeholder.
+</Accordion>
+
+</AccordionGroup>
+
+##### Changed
+<AccordionGroup>
+
+<Accordion title='Updated External Portal UI Design and Branding'>
+The External Developer Portal now features a refreshed visual design with updated brand colors, modern typography, and improved spacing. Users will experience a cleaner, more professional interface with enhanced readability and consistent design elements across all portal pages, while maintaining full functionality and accessibility standards. Furthermore, the API catalogue has been redesigned with new card layouts for users to experience a cleaner and more professional interface.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+<AccordionGroup>
+
+<Accordion title='Fixed Organization Request Creation for Duplicate Names'>
+Resolved an issue where API consumers attempting to create organizations with existing names would have their request created in the system despite receiving an error message. Users can now retry with different organization names without requiring administrator intervention to clear failed requests.
+</Accordion>
+
+<Accordion title='Hidden Plan Section for Documentation-Only Products'>
+The portal now correctly hides the plan selection and access request options for documentation-only products. Users viewing docs-only products will no longer see confusing plan sections or be able to mistakenly request API access for products that don't require it.
+</Accordion>
+
+<Accordion title='Editable SSO Profile URLs'>
+Fixed an issue where `CallbackBaseURL` and `ReturnURL` fields in SSO profiles appeared editable but would revert to auto-generated values after saving. These fields are now properly editable and will persist user-defined values.
+</Accordion>
+
+<Accordion title='Editable Redirect URLs in App Settings'>
+Fixed an issue where redirect URLs could only be set during app creation and became locked afterward, forcing users to delete and recreate entire apps whenever URL changes were needed. Redirect URLs can now be edited directly from the app details page, just like app names and descriptions.
+</Accordion>
+
+<Accordion title='GraphQL Documentation and Playground Support for UDG APIs'>
+Fixed Developer Portal to properly handle Universal Data Graph (UDG) APIs as GraphQL APIs. Portal admins can now upload SDL (Schema Definition Language) files and configure GraphQL server URLs for UDG APIs instead of being forced to use OpenAPI Specification (OAS) documentation. API consumers can now access the GraphQL playground when enabled, allowing proper interaction with UDG APIs through the native GraphQL interface.
+</Accordion>
+
+<Accordion title='Fixed Policy Override Issue When Updating Products in Developer Portal'>
+Resolved issue where the Developer Portal was overriding or reverting policy changes made through the Tyk Dashboard when updating API Products. The Portal now preserves existing policy configurations, including Path-Based Permissions and ACL settings, instead of overwriting the entire policy object.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following high-priority CVEs, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-47912" target="_blank">CVE-2025-47912</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58183" target="_blank">CVE-2025-58183</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58185" target="_blank">CVE-2025-58185</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58186" target="_blank">CVE-2025-58186</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58187" target="_blank">CVE-2025-58187</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58188" target="_blank">CVE-2025-58188</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58189" target="_blank">CVE-2025-58189</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61723" target="_blank">CVE-2025-61723</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61724" target="_blank">CVE-2025-61724</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61725" target="_blank">CVE-2025-61725</a>
+</Accordion>
+
+</AccordionGroup>
+
+## 1.15 Release Notes
+
+### 1.15.0 Release Notes
+
+#### Release Date 14th November 2025
+
+#### Release Highlights
+
+In this release, we’ve introduced a fully integrated GraphQL Playground in the Developer Portal, upgraded the Tyk Portal to Golang 1.24 for improved security and performance, and addressed both a priority CVE and a Portal API stability issue.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.15.0) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Known Issue
+
+**Documentation-Only Products**
+
+When viewing a documentation-only product, API specifications whose alias contains a hyphen (-) may not appear correctly in the API Specifications tab. This does not affect runtime functionality, or API Product docs in the Catalogue. We recommend not using a hyphen in the specification alias of a documentation-only product. The issue will be fixed in a future release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are on version 1.14.0 or an older version, we recommend upgrading to this release ASAP.
+
+To upgrade the Portal's theme, please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes).
+
+#### Download
+- [Docker image v1.15.0](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.15.0)
+  - ```bash
+    docker pull tykio/portal:v1.15.0
+    ```
+
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.15.0)
+
+#### Changelog
+<a id="Changelog-v1.15.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Tyk Portal now runs on Golang 1.24'>
+The Tyk Portal has been updated to Golang 1.24, improving security by staying current with the latest Go versions.
+
+</Accordion>
+
+<Accordion title='GraphQL Playground'>
+We've introduced a comprehensive GraphQL Playground experience in the Developer Portal, providing developers with a seamless way to explore, test, and interact with GraphQL APIs directly within the portal environment.
+
+**Key Highlights:**
+
+- **Interactive GraphQL Playground**: Developers can now explore schemas, run queries and mutations, and test API behavior without leaving the Live Portal.
+- **Schema Documentation**: Admins can upload GraphQL Schema Definition Language (SDL) files (.graphql, .graphqls, .gql or JSON format) to provide rich documentation and enable full playground functionality.
+- **Documentation-Only GraphQL Products**: Create standalone GraphQL documentation products by uploading SDL files without requiring live API access, perfect for pre-release documentation or educational purposes.
+
+This feature is available only for APIs explicitly marked as GraphQL, and does not affect existing REST API behavior.
+
+Learn more about managing [API products with GraphQL documentation](/portal/api-products#api-reference-documentation)
+
+</Accordion>
+
+<Accordion title='New GraphQL Schema Management Endpoints for API Products and Specifications'>
+New API endpoints that allow managing GraphQL schema files for both API Products and Documentation Products have been introduced.
+The new endpoints include:
+- `/products/{product_id}/api-details/{api_id}/graphql/schema`
+- `/products/{product_id}/spec-details/{spec-id}/graphql/schema`
+- `/products/{product_id}/spec-details/graphql/schema`
+
+For more information, please visit [Tyk Developer Portal API](https://tyk.io/docs/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api)
+
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+<AccordionGroup>
+
+<Accordion title='Fixed Portal Panic When Using `Accept: application/graphql` Header'>
+Resolved an issue where the Portal API would panic when requests were made with the `Accept:application/graphql` header. The portal now correctly returns a `400 Bad Request` response in such cases.
+
+</Accordion>
+
+</AccordionGroup>
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following CVE identified in the Tyk Portal, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://nvd.nist.gov/vuln/detail/cve-2020-8911" target="_blank">CVE-2020-8911</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+## 1.14 Release Notes
+
+### 1.14.1 Release Notes
+
+#### Release Date 4th September 2025
+
+#### Release Highlights
+
+This release delivers key bug fixes to improve stability in the Developer Portal. Updates include better handling of SSO user assignments and Organisation persistence, safeguards against cross-Organisation visibility in auto-approved registrations, and improved resilience when Teams are deleted. We’ve also fixed issues with API Product transitions and policy persistence, ensuring existing tokens remain valid.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.14.1) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are on version 1.14.0 or an older version, we recommend upgrading to this release ASAP.
+
+To upgrade the Portal's theme, please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes).
+
+#### Download
+- [Docker image v1.14.1](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.14.1)
+  - ```bash
+    docker pull tykio/portal:v1.14.1
+    ```
+
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.14.1)
+
+#### Changelog
+<a id="Changelog-v1.14.1" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+<Accordion title='Improved SSO User Assignment and Login Behavior'>
+We have resolved issues where SSO users could lose their Team assignments or the system could incorrectly reassign them to the default Organisation and Team after logging in. SSO now correctly links returning users to their existing profiles, preserving Team and Organisation memberships and preventing duplicate accounts. We have also improved the SSO configuration UI to make default and group-based Team assignments clearer.
+</Accordion>
+
+<Accordion title='Saving and Updating Documentation-Only Products'>
+We fixed an issue where the Portal could report an error when users added API access to a documentation-only API Product. This fix ensures seamless transitions between documentation-only and regular products, and correctly manages associated policies in Tyk Dashboard.
+</Accordion>
+
+<Accordion title='Corrected User Assignment in Auto-Approved Organisation Registrations'>
+Fixed an issue where auto-approved Organisation (Org) registrations could incorrectly assign a user to multiple Orgs, causing cross-Organisation visibility. Users are now always placed only in their new Org's default Team, ensuring proper isolation across both auto-approved and manual approval flows.
+</Accordion>
+
+<Accordion title='Improved Handling of SSO Profiles When Teams Are Deleted'>
+Fixed an issue where deleting a Team referenced in an SSO profile’s `UserGroupMapping` caused validation errors and prevented the profile form from loading or being updated. SSO profiles now gracefully handle deleted Team references, allowing administrators to view, edit, and save changes.
+</Accordion>
+
+<Accordion title='Improved Persistence of Access Token Validity'>
+Resolved an issue where removing all API access from a Product would delete the associated access policy, causing previously issued tokens to stop working when access was later re-added. Now, access policies are preserved in draft status, temporarily invalidating tokens. When users add API access back to the API Product, the existing tokens will become valid again. Note that if the authentication method of the APIs within the Product is changed, all previously issued access tokens will remain invalid.
+</Accordion>
+</AccordionGroup>
+
+### 1.14.0 Release Notes
+
+#### Release Date 23 July 2025
+
+#### Release Highlights
+
+##### Tyk Streams APIs Come To Developer Portal
+
+We’ve added support for [Tyk Streams APIs](/api-management/event-driven-apis) in the Developer Portal, allowing API Providers to expose access to event-driven APIs alongside traditional REST APIs.
+Developers can now subscribe to Products that enable webhook delivery for specific events,
+receiving real-time messages routed through Tyk Streams. 
+This opens up new integration patterns for async APIs, such as push notifications, system alerts, or data change events.
+
+
+##### New Developer App Visibility Controls
+
+We have added more flexible Developer App visibility controls, giving team members the ability to limit the visibility of their apps to themselves (Personal), their Team, or their Organisation (Org). This means that when logged into the Developer Portal, team members will only see their apps, apps shared within their teams, and apps marked as visible to the entire organization. Org Admin users will continue to have visibility of all developer apps created in their Organisation. The exceptions to this rule are for the Default Team, where team-level visibility is not implemented, and the Default Org, where all apps are treated as personal (private).
+
+##### Enhanced Team Management
+
+We have also enhanced the user and team management experience. Now, users can be removed from the default team (which should only be used for inactive users). This allows platform teams to ensure that users can only see the other members of their team, rather than all users in their Organisation. We've also fixed a bug where Org Admins could add users to other Organisations deployed on the Portal.
+
+##### Prevent Web Crawlers From Indexing Your Portal
+
+We have added a `/robots.txt` endpoint, allowing administrators to define crawler directives in a plain text entry form in the Portal Admin UI.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.14.0) below.
+
+#### Breaking Changes
+
+There are no breaking changes in this release.
+
+For the complete API specification, see [Tyk EDP API documentation](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api).
+
+#### Deprecations
+
+SQLite has reached its End of Life in this release, aligning with the Tyk Dashboard. SQLite was previously recommended for use only in basic proofs of concept. Now, for such scenarios and in production, we recommend using PostgreSQL or MySQL for improved scalability and support.
+
+#### Upgrade instructions
+
+If you are on version 1.13.0 or an older version, we recommend upgrading to this release ASAP.
+
+To upgrade the portal's theme, please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+#### Download
+- [Docker image v1.14.0](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.14.0)
+  - ```bash
+    docker pull tykio/portal:v1.14.0
+    ```
+
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.14.0)
+
+#### Changelog
+<a id="Changelog-v1.14.0" data-scroll-offset></a>
+
+##### Added
+<AccordionGroup>
+<Accordion title='New Application Visibility Controls'>
+Added the facility to limit the visibility of developer apps to the user, team, or Organisation (org). Org Admin users will continue to have visibility of all developer apps created in their Organisation. To minimize the risk of unintentional visibility when users are members of the default teams and/or organization, team-level visibility is not implemented in the Default Team for each organization, and all apps are treated as personal (private) in the default organization. To avoid breaking existing setups, all current apps will default to organisation visibility.
+</Accordion>
+
+<Accordion title='Added Support for Asynchronous APIs'>
+The Developer Portal now supports Tyk Streams, enabling developers to request access to event-driven APIs. Developers can authenticate with portal tokens and receive real-time webhook notifications.
+</Accordion>
+
+<Accordion title='API Product Tag Access in Theme Templates'>
+Portal theme templates now have access to API product tags, allowing for the dynamic display or categorization of API products based on these tags.
+</Accordion>
+
+<Accordion title='Configurable Robots.txt Support'>
+Added native support for serving a configurable `robots.txt` file via a new `/robots.txt` endpoint. Portal admins can now define and manage crawler directives directly from the Portal Admin UI.
+</Accordion>
+
+<Accordion title='Improved Team and User Management'>
+We have enhanced team and user access controls by restricting team members from viewing other users' details, limiting Admin Users to adding users only to teams to which they belong, automatically assigning users to the default organization team if no team is selected during invitation, and allowing Admin Users to assign users to multiple teams.
+</Accordion>
+</AccordionGroup>
+
+##### Changed 
+
+<Expandable title='Upgrade to Go 1.23'>
+The Developer Portal has been upgraded from Golang 1.22 to Golang 1.23, bringing enhanced performance, strengthened security, and access to the latest features available in the new Golang release.
+</Expandable>
+
+##### Fixed
+
+<AccordionGroup>
+<Accordion title='API Product Metadata Loss when Updating the Developer Portal Catalog'>
+Fixed an issue where API Product metadata could be lost when modifying the product in the Developer Portal. This was due to incorrect manipulation of the underlying Tyk policy object.
+</Accordion>
+
+<Accordion title='API Product Synchronization Fixes'>
+Fixed an issue where associations with APIs or even entire Products could be lost during synchronization with the Tyk Dashboard. The synchronization logic has been improved to ensure that all associated APIs and product details are consistently preserved.
+</Accordion>
+
+<Accordion title='Scope-to-Policy Mapping Lost when Configuring DCR'>
+Fixed an issue where existing scope-to-policy mapping for an API could be lost when DCR is enabled via the Developer Portal. The logic has been improved to ensure that scope-to-policy mapping is preserved.
+</Accordion>
+</AccordionGroup>
+
+---
+
+## 1.13 Release Notes
+
+### 1.13.2 Release Notes
+
+#### Release Date 20 June 2025
+
+#### Release Highlights
+
+This patch release contains a bug fix. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.13.2) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+If you are on 1.13.1 or an older version, we advise you to upgrade ASAP to this release.
+
+To upgrade the portal's theme please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+#### Download
+- [Docker image v1.13.2](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.13.2)
+  - ```bash
+    docker pull tykio/portal:v1.13.2
+    ```
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.13.2)
+
+#### Changelog
+<a id="Changelog-v1.13.2" data-scroll-offset></a>
+
+#### Fixed 
+
+<Expandable title='Preserved JWT scope mappings when enabling DCR'>
+Fixed an issue where enabling DCR for an API would delete scope-to-policy mappings from the API definition, invalidating access tokens containing the expected scopes. Scope-to-policy mappings are now correctly managed when modified on Tyk Portal or Tyk Dashboard, with the source of truth being the API definition registered with the Dashboard.
+</Expandable>
+
+<Expandable title='Fixed API middleware error from dashboard–portal mismatch'>
+Fixed an issue where middleware configuration for an API could be corrupted (for example, [Request header transform middleware](/api-management/traffic-transformation#request-header-transform) settings were changed in Developer Portal. This was due to a misalignment between Dashboard and Developer Portal in their interpretation of the API definition and has now been corrected.
+</Expandable>
+
+### 1.13.1 Release Notes
+
+#### Release Date 19 April 2025
+
+#### Release Highlights
+This release is focused mainly on bug fixes. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.13.1) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on 1.13.0 or an older version, we advise you to upgrade ASAP to this release.
+
+To upgrade the portal's theme please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+#### Download
+- [Docker image v1.13.1](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.13.1)
+  - ```bash
+    docker pull tykio/portal:v1.13.1
+    ```
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.13.1)
+
+#### Changelog
+<a id="Changelog-v1.13.1" data-scroll-offset></a>
+
+#### Fixed 
+
+<AccordionGroup>
+<Accordion title='Revoking one client credential no longer deletes all from Keycloak'>
+Fixed an issue where all client credentials associated with an app would be incorrectly removed from Keycloak when credentials are revoked in the Tyk Portal. This would lead to credentials existing in the Tyk Developer Portal but not in Keycloak. Now, when an app with multiple client credentials has one set of credentials revoked in the Tyk Developer Portal, only those credentials will be removed from Keycloak, with the others remaining valid.
+</Accordion>
+
+<Accordion title='SSO now works properly with multiple portal replicas'>
+Fixed an issue where users couldn't log in via SSO when multiple instances (replicas) of Portal were deployed
+</Accordion>
+
+<Accordion title='Password no longer overwritten on user profile updates'>
+Addressed an issue where editing and saving a user’s profile in the admin portal would unintentionally change their password due to double encryption. Admins can now safely update user details without affecting login credentials. Passwords will only change when explicitly updated.
+</Accordion>
+
+<Accordion title='API description field restored'>
+Resolved a regression introduced in v1.13.0 that removed the ability to view or edit API descriptions on the API Product page. The API description field is now visible and editable again, restoring parity with earlier versions and ensuring API documentation remains complete and user-friendly.
+</Accordion>
+</AccordionGroup>
+
+---
+
+### 1.13.0 Release Notes
+
+#### Release Date 31 Jan 2025
+
+#### Release Highlights
+The v1.13.0 release includes the following new features and improvements:
+- Improved UX for Products and Plan listing.
+- Added the ability to create, edit, and remove `Products` from the portal.
+- Added the ability to create, edit, and remove `Plan` from the portal.
+- EDP Resources now support custom IDs that allow the migration of elements between environments.
+- Security: 4 CVEs fixed.
+- Bugfixes: 5 bugs fixed.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.13.0) below.
+
+#### Breaking Changes
+<a id="breaking-changes-v1.13.0"></a>
+
+The `Plans` API object includes two changes:
+- The data type of the **RateLimit** field has been changed from string to integer.
+- The data type of the **Quota** field has been changed from string to integer.
+
+For the complete API specification, see [Tyk EDP API documentation](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api).
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on 1.12.0 or an older version, we advise you to upgrade ASAP to this release.
+
+While upgrading to 1.13.0, 
+1. Portal will automatically migrate the new Custom IDs to most of the existing resources. For more information, please refer to the [changelog](#Changelog-v1.13.0).
+2. Users are advised to take appropriate actions in their system regarding the `Plans` API object changes as described in the [breaking changes section](#breaking-changes-v1.13.0).
+
+To upgrade the portal's theme, please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+#### Download
+- [Docker image v1.13.0](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.13.0)
+  - ```bash
+    docker pull tykio/portal:v1.13.0
+    ```
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.13.0)
+
+#### Changelog
+<a id="Changelog-v1.13.0" data-scroll-offset></a>
+
+##### Added
+<AccordionGroup>
+<Accordion title='Improved UX for products and plan listing'>
+The portal now provides an enhanced UI for browsing and managing products and plans, making it easier for administrators to organize and maintain their API offerings.
+</Accordion>
+
+<Accordion title='Product and plan management'>
+Administrators can now create, edit, and remove `Products` and `Plans` directly from the portal admin UI, eliminating the need to manage these through the Tyk Dashboard. The new features include the following:
+
+- Product creation with full configuration options.
+- Plan management with pricing and quota settings.
+- Direct editing of existing `Products` and `Plans`.
+- Removal of deprecated offerings.
+
+With the added features, Portal provides greater control over the API lifecycle management process.
+</Accordion>
+
+<Accordion title='Documentation-only products'>
+Added support for creating documentation-only products in the Enterprise Developer Portal. This feature allows API Providers to:
+
+- Create products that serve purely as documentation repositories.
+- Share API documentation without exposing actual API endpoints.
+- Preview API documentation before making APIs available.
+
+This is particularly useful for scenarios where APIs are in development or when you want to share documentation with a limited audience before making the APIs publicly available.
+</Accordion>
+
+<Accordion title='Custom ID support for resources'>
+EDP Resources now supports custom IDs (in addition to auto-increment integer IDs) to facilitate migration and reference between environments. This feature covers:
+
+- API Resources: Products, plans, tutorials, OAS documents, OAuth providers, and client types
+- Organizational Entities: Organizations, Users, Groups, and Catalogs
+- Content/Resources: Pages, content blocks, tags, menus, and menu items
+
+This enhancement makes it easier to maintain consistency across different environments and simplifies the migration process between environments.
+</Accordion>
+
+<Accordion title='Enhanced login controls'>
+Admins can now configure more enhanced login controls, such as limits, expiration and intervals.
+
+These settings can be adjusted in the General Settings section of the portal admin UI to help maintain secure access to the portal.
+</Accordion>
+
+<Accordion title='SSO profile management APIs'>
+Added new APIs for managing SSO profiles, enabling programmatic control over SSO configurations. These APIs allow administrators to:
+
+- Create SSO profiles
+- List all SSO profiles
+- Get details of a specific profile
+- Update existing profiles
+- Delete profiles 
+
+These endpoints enable the automation of SSO setup and management through CI/CD pipelines. Use cases include:
+
+- Automated deployment of SSO configurations across environments
+- Integration with identity management systems
+- Automated testing of SSO configurations
+
+This addition complements the embedded Tyk Identity Broker functionality introduced in v1.12.0, providing a complete programmatic interface for SSO management.
+</Accordion>
+
+<Accordion title='Product and plan management APIs'>
+Added new APIs for managing Products and Plans programmatically, enabling automation of the product lifecycle. These APIs include:
+
+**Products:**
+- Create products 
+- List all products 
+- Get product details 
+- Update products
+- Delete products
+
+**Plans:**
+- Create plans
+- Update plans
+- Delete plans
+
+
+
+    <Note>
+    The Plans API object has schema changes; please refer to the [breaking changes section](#breaking-changes-v1.13.0) for details.
+    </Note>
+
+
+These APIs complement the UI-based product management capabilities, enabling automated workflows and CI/CD integration for product lifecycle management.
+</Accordion>
+</AccordionGroup>
+
+##### Fixed
+<AccordionGroup>
+<Accordion title='App edit CSRF token validation'>
+Fixed an issue where CSRF token validation was failing during application edits, which prevented users from saving changes to their applications. This has been resolved by implementing proper token lifecycle management and validation.
+</Accordion>
+
+<Accordion title='Fixed MySQL SSO profile handling'>
+Fixed an issue where EDP embedded Tyk Identity Broker profiles weren't being properly handled in MySQL environments, which caused storing SSO profiles failures. This has been resolved by correcting the database query handling for SSO profile data.
+</Accordion>
+
+<Accordion title='Custom attribute deletion'>
+Fixed an issue where deleting a single custom attribute would inadvertently remove all user custom attributes, which caused loss of user profile data. This has been resolved by implementing proper scoping for attribute deletion operations.
+</Accordion>
+
+<Accordion title='Catalog deletion impact'>
+Fixed an issue where removing an active catalog would cause UI rendering problems for developers, which resulted in a poor user experience. This has been resolved by implementing proper cascading deletion of catalog resources.
+</Accordion>
+
+<Accordion title='Theme upload validation'>
+Fixed an issue where uploading themes containing nested theme directories would corrupt the original theme, which caused theme installation failures. This has been resolved by implementing validation to detect and prevent nested theme uploads.
+</Accordion>
+</AccordionGroup>
+
+##### Security Fixes
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Enterprise Developer Portal:
+
+- [CVE-2022-24785](https://nvd.nist.gov/vuln/detail/CVE-2022-24785)
+- [CVE-2022-31129](https://nvd.nist.gov/vuln/detail/CVE-2022-31129)
+- [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337)
+- [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338)
+</Expandable>
+
+{/* Previous release notes sections follow */}
+
+## 1.12 Release Notes
+### 1.12.0 Release Notes
+
+#### Release Date 13 Nov 2024
+
+#### Release Highlights
+The v1.12.0 release includes the following new features and improvements:
+- Embedded Tyk Identity Broker. From this release, you don't need to deploy a separate Tyk Identity Broker to SSO into the portal.
+- Now admins can create Apps and Credentials for developers directly from the portal admin UI.
+- Credentials notifications. Now admins can configure email notifications for credential expiration and credential expiration warnings.
+- Stronger passwords. Now admins can configure the password policy from the portal admin UI.
+- Security: 3 new high CVEs fixed.
+- Bugfixes: 4 bugs fixed.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.12.0) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+
+#### Deprecations
+There are no deprecations in this release.
+
+
+#### Upgrade instructions
+If you are on 1.11.0 or an older version we advise you to upgrade ASAP directly to this release.
+
+To upgrade the portal's theme please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+#### Download
+- [Docker image v1.12.0](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.12.0)
+  - ```bash
+    docker pull tykio/portal:v1.12.0
+    ```
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.12.0)
+
+#### Changelog
+<a id="Changelog-v1.12.0" data-scroll-offset></a>
+
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+<AccordionGroup>
+<Accordion title='Embedded Tyk Identity Broker (TIB)'>
+From this release, you can configure the portal to serve an internal Tyk Identity Broker. This means that you don't need to deploy a separate Tyk Identity Broker service to SSO into the portal.
+This enables a new section under the portal admin UI where admins can manage SSO profiles for admins and developers.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.12.0-embedded-tib.png" alt="SSO profiles" />
+
+We support out of the box integration with the following SSO providers type:
+- Open ID Connect: Support for OpenID Connect (OIDC) Identity Tokens provided by any standards compliant OIDC provider such as Auth0.
+- LDAP: Bind users to an LDAP server such as Azure Active Directory, using their username and password.
+- Social: The social provider should provide seamless integration with Google+ Github, Facebook, Salesforce, Digital Ocean and more.
+
+You can read more about the supported SSO providers [here](/tyk-identity-broker/overview).
+</Accordion>
+
+<Accordion title='Creation of apps and credentials'>
+Admins now have enhanced control over application and credential creation in the portal, streamlining the onboarding process and reducing the need for API-based setups. With this update, admins can create applications and assign them to specific users, making it easier to onboard developers who aren't using self-service options.
+
+For custom authorization scenarios —like when using an external OAuth2.0 provider— admins can now issue credentials directly in the portal. These credentials are stored as key-value pairs that developers can view, providing a more seamless alternative to manual credential sharing.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.12.0-non-tyk-managed-credential.png" alt="Non-Tyk managed credential" />
+
+
+Admins can also generate auth token credentials, with added flexibility to define custom token values if needed for compatibility with other systems. Additionally, OAuth2.0 credentials can now be created within the portal, ensuring stable, secure access for developers with the added benefit of immutability after creation.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.12.0-custom-credential.png" alt="Custom credential" />
+
+Overall, these improvements simplify the process for managing applications and credentials, offering a more streamlined experience for admins and developers alike.
+</Accordion>
+
+<Accordion title='Password policy'>
+Admins can now configure the password policy from the portal admin UI. This includes setting the minimum password length, reused passwords, multi case, and more.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.12.0-password-policy.png" alt="Password policy" />
+</Accordion>
+
+<Accordion title='Credentials notifications'>
+Admins can now configure two types of notifications:
+- Credential expiration: This notification is sent to developers when their credentials expire. You can modify the email template in the `keyexpired.tmpl` file included in the theme package.
+- Credential expiration warnings: This notification is sent to developers when their credentials are about to expire. Admins can set the number of days before the expiration in the portal admin UI. You can modify the email template in the `keytoexpire.tmpl` file included in the theme package.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/1.12.0-credential-expiration.png" alt="Credentials notifications" />
+</Accordion>
+</AccordionGroup>
+
+##### Changed
+
+{/* This should be a bullet-point list of updated features. Explain:
+
+- Why was the update necessary?
+- How does the update benefit users?
+- Link to documentation of the updated feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+<Expandable title='Upgrade to Go 1.22'>
+The Enterprise Developer Portal has been upgraded from Golang 1.21 to Golang 1.22, bringing enhanced performance,
+strengthened security, and access to the latest features available in the new Golang release.
+</Expandable>
+
+##### Fixed
+
+{/* This section should be a bullet point list that describes the issues fixed in the release. For each fixed issue explain:
+
+- What problem the issue caused
+- How was the issue fixed
+- Link to (new) documentation created as a result of a fix. For example, a new configuration parameter may have been introduced and documented for the fix
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+<AccordionGroup>
+<Accordion title="Fixed a bug where values of dropdown custom attributes weren't removed correctly">
+Fixed a bug where values of dropdown custom attributes weren't removed correctly preventing admins from updating User custom attributes.
+</Accordion>
+
+<Accordion title='Fixed a certificate upload issue in Kubernetes environments'>
+Fixed an issue that was causing certificate uploads to fail when the file size exceeded 2KB in Kubernetes environments.
+</Accordion>
+
+<Accordion title='Fixed a bug that prevented to load OAS files from S3 storage'>
+We have addressed a bug that was causing the portal to fail loading OAS files from S3 storage.
+</Accordion>
+
+<Accordion title='Fixed typos in email subjects'>
+We have fixed typos in email subjects that were causing notifications to be sent with incorrect information.
+</Accordion>
+</AccordionGroup>
+
+##### Security Fixes
+
+{/* This section should be a bullet point list that should be included when any security fixes have been made in the release, e.g. CVEs. For CVE fixes, consideration needs to be made as follows:
+1. Dependency-tracked CVEs - External-tracked CVEs should be included on the release note.
+2. Internal scanned CVEs - Refer to the relevant engineering and delivery policy.
+
+For agreed CVE security fixes, provide a link to the corresponding entry on the NIST website. For example:
+
+- Fixed the following CVEs:
+    - [CVE-2022-33082](https://nvd.nist.gov/vuln/detail/CVE-2022-33082) */}
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high priority CVEs identified in the Tyk Enterprise Developer Portal, providing increased protection against security
+vulnerabilities:
+
+- [CVE-2024-34158](https://nvd.nist.gov/vuln/detail/CVE-2024-34158)
+- [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-2024-34156)
+- [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635)
+</Expandable>
+
+{/* Required. use 3 hyphens --- between release notes of every patch (minors will be on a separate page) */}
+
+{/* Repeat the release notes section above for every patch here */}
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## 1.11 Release Notes
+### 1.11.0 Release Notes
+
+#### Release Date 25 Sept 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Release Highlights
+The v1.11.0 release includes the following new features and improvements:
+- New Portal admin UI.
+- Closer to API Parity: APIs for Tags, blog posts, Product images, Webhooks, and rotate credentials. A total of 23 new endpoints.
+- [22 bugs fixed](#fixed)
+- [19 CVEs fixed](#fixed)
+- CSRF protection, new TLS configuration and better recovery link security.
+
+
+##### Performance Optimizations
+To improve stability under high loads, we conducted performance testing and identified that improper database configurations can cause unexpected portal restarts. To prevent this and ensure optimal performance, we recommend the following database settings:
+
+**Recommended Configuration:**
+- [PORTAL_DATABASE_MAX_OPEN_CONNECTIONS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_database_max_open_connections): Set this value based on your database's maximum connection limit divided by the number of portal instances. For example, if your database allows 200 connections and you are running 4 portal instances, set PORTAL_DATABASE_MAX_OPEN_CONNECTIONS to 50 per instance. This ensures that all instances can share the available connections without exceeding the database's limit, which could otherwise lead to performance degradation or errors.
+- [PORTAL_DATABASE_MAX_IDLE_CONNECTIONS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_database_max_idle_connections): Set to 15 or a lower value based on your expected load. This setting keeps a reasonable number of connections readily available without tying up resources unnecessarily.
+
+For reference, with 2 portal instances, `PORTAL_DATABASE_MAX_OPEN_CONNECTIONS` set to 30 and `PORTAL_DATABASE_MAX_IDLE_CONNECTIONS` set to 15, we could handle 90 active users.
+
+#### Upgrade instructions
+If you are on 1.10.0 or an older version we advise you to upgrade ASAP directly to this release.
+
+To upgrade the portal's theme please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+#### Download
+- [Docker image v1.11.0](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.11.0)
+  - ```bash
+    docker pull tykio/portal:v1.11.0
+    ```
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.11.0)
+
+#### Changelog
+
+##### Added
+- New Portal admin UI.
+- Added CRUD APIs for Tags.
+- Added CRUD APIs for Webhooks.
+- Added CRUD APIs for Product images.
+- Added APIs to manage blog posts along with their tags and categories.
+- Added a new API endpoint that allows the rotation of API credentials.
+- UI and API for themes soft delete. Soft deleted themes are not shown in the UI and API, but are kept in the database for future reference.
+- Added new TLS variables to set MinVersion ([portal_tls_min_version](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_tls_min_version), MaxVersion ([PORTAL_TLSCONFIG_MAXVERSION](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_tls_max_version), and CipherSuites ([PORTAL_TLS_CIPHER_SUITES](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_tls_cipher_suites).
+- Added a new configuration to manage the idle timeout of the portal's session ([PORTAL_SESSION_IDLE_TIMEOUT](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_session_idle_timeout).
+- Added CSRF protection injection to portal's form. Now you don't need to add it manually to your templates.
+
+##### Changed
+- Changed passwordrecovery links to be valid for 24 hours.
+- Changed password recovery links to be unique and valid for one use only.
+- Changed the default value of [PORTAL_DATABASE_CONNECTION_MAX_LIFETIME](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_database_connection_max_lifetime) to 1800000 milliseconds.
+- Changed session token queries for better performance.
+- Introduced new indexes for better performance.
+
+##### Fixed
+- Fixed sensitive information leak on password recovery links.
+- Fixed the wrong permission list for super admin in the external portal dashboard.
+- Fixed deletion of related APIDetail records when a Product is deleted.
+- Fixed a bug that caused the portal to panic when users sent a PUT request to the/API/pages/ endpoint without a template.
+- Fixed a bug where markdown content wasn't adding IDs attribute automatically to sections.
+- Fixed an issue where the OAS file was not attached to the API resource associated with an API product when multiple API resources were linked.
+- Fixed SSO issues when SameSite Header is set to Strict.
+- Fixed issues where certain files might not have been unpacked correctly due to conflicts or incorrect path resolution, particularly when themes with similar names were involved.
+- Fixed an issue with how PostgreSQL connection strings, specifically the sslmode configuration, were being handled. Portal now fully conforms to PostgreSQL documentation and standards, ensuring that SSL certificates are correctly utilized without causing connection errors.
+- Fixed a bug where sessions were expiring independently if users were active or not.
+- Fixed distroless image bootstrapping issue.
+- Fixed an issue where fetching a theme by its ID returned empty field values due to whitespace characters being stripped from the ID.
+- Fixed deleting and rotating shared credentials within an organization. 
+- Fixed a rendering error while deleting credentials. Now, it shows an error page instead of a blank page.
+- Fixed a bug where product content was truncated after 255 characters in MySQL and MariaDB. This update ensures that full-length product content is now stored and displayed without truncation.
+- Fixed the portal API behavior to handle cases where the "Accept" header is absent. Previously, such requests resulted in a 500 Internal Server Error with no response body, causing the portal to panic.
+- Fixed a duplicated 404 error page when there is a not found error.
+- Fixed credential revocation error when OAuth2.0 provider is deleted. 
+- Fixed an issue where credentials weren't deleted with OAuth2.0 provider removal.
+- Fixed an issue where the graph only displayed the peak value of 100, even when the average error rate was below 100.
+- Fixed several errors in the portal API specification.
+- Fixed the 19 CVEs, among which are:
+    - CVE-2024-28834
+    - CVE-2024-28835
+    - CVE-2023-5678
+    - CVE-2023-6129
+    - CVE-2023-6237
+    - CVE-2024-0727
+    - CVE-2023-50387
+    - CVE-2023-50868
+    - CVE-2023-5678
+    - CVE-2023-6129
+    - CVE-2023-6237
+    - CVE-2024-0727
+    - CVE-2024-24792
+    - CVE-2023-45288
+    - CVE-2023-5678
+    - CVE-2023-6129
+    - CVE-2023-6237
+    - CVE-2024-0727
+    - CVE-2024-24792
+    - CVE-2023-45288
+
+## 1.10 Release Notes
+### 1.10.0 Release Notes
+
+#### Release Date 27 Jun 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Release Highlights
+The 1.10.0 addresses twenty high-priority bugs and vulnerabilities and introduces three new features:
+- OAS APIs support.
+- Theme cache. 
+- Configuration options for database connections.
+
+#### Upgrade instructions
+If you are on 1.9.0 or an older version we advise you to upgrade ASAP directly to this release.
+
+To upgrade the portal's theme please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+#### Download
+- [Docker image v1.10.0](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.10.0)
+  - ```bash
+    docker pull tykio/portal:v1.10.0
+    ```
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.10.0)
+
+#### Changelog
+##### Added
+- Added OAS APIs support. 
+- Added an assets cache for improved performance on database-backed themes. This speeds up the portal's pages loading time by 30%. It's enabled by default and you can disable using [PORTAL_ASSETS_CACHE_DISABLE](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_assets_cache_disable).
+- Added three new configuration options to manage database connections lifecycle: [PORTAL_DATABASE_MAX_OPEN_CONNECTIONS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_database_max_open_connections), [PORTAL_DATABASE_MAX_IDLE_CONNECTIONS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_database_max_idle_connections), and [PORTAL_DATABASE_CONNECTION_MAX_LIFETIME](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_database_connection_max_lifetime).
+
+##### Fixed
+- Fixed the bug where `PORTAL_SESSION_LIFETIME` was calculated in minutes instead of seconds.
+- Fixed the bug where access requests were not removed when an application is deleted.
+- Fixed the bug where stoplight library was blocking the portal's startup if it's not available.
+- Fixed the bug where browsing into API Product throws an error when Baseline URL is provided in provider section.
+- Fixed the bug where it was possible to create new access requests from the admin dashboard.
+- Fixed the bug where the portal was not displaying the quota renewal rate when a custom renewal rate was set in a policy.
+- Fixed the bug where the first user is always created under Organization 0 when the `/portal-api/users` endpoint is invoked for the first time.
+- Fixed the bug where the portal `/ready` probe was not taking into consideration the bootstrap and tables automigration process.
+- Fixed the bug where sometimes, the plan added to the cart was not updated after a product change.
+- Fixed the bug where it was not possible to delete an application that was provisioned with an access request created through the API.
+- Fixed the bug where users where not able to submit the cart from parallel submission (two different tabs or browsers). 
+- Fixed the bug where creating an app was not possible when there was no DCR scope specified for the Product but there was a scope specified for the Plan.
+- Fixed the bug where the portal logout was not clearing browser user data and logging the user out completely.
+- Fixed the bug where it was not possible to delete non authToken apps from the developer portal when approved products and plans are removed.
+- Fixed the bug where it was not possible to download the theme without adding an extra `/` to the URL.
+- Fixed the bug where carts submissions where emptying other users carts if they have the same content in it.
+- Fixed the bug where it was not possible to delete an application after making an API call to update it and associate it to a different user.
+- Fixed the bug where the portal was exposing technical details on error messages on the `Forgot password` page.
+- Fixed the bug where sometimes, content blocks where not being displayed correctly on the portal admin page.
+- Fixed the bug where stoplight was not rendered correctly in mobile devices.
+- Fixed the bug where editing current developer password was causing a panic.
+
+## 1.9 Release Notes
+### 1.9.0 Release Notes
+
+#### Release Date 27 Apr 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+In 2.0.0 release (the next after the next release) we will introduce the capability to create products and plans in the portal instead of creating policies for products and plans in the dashboard.
+
+To achieve that, we will need to change the plans and products architecture. The main change is that plans will include access rights to APIs and endpoint.
+
+As a result of this, 2.0.0 won't be backwards compatible with the previous versions. We will provide migration scripts and instructions before that release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Release Highlights
+The 1.9.0 release addresses several security vulnerability and bugs and introduces two new capabilities:
+- [Webhooks](/portal/customization) for events that happen in the portal.
+- [Admin APIs](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) for OAuth2.0 configuration. 
+
+#### Upgrade instructions
+If you are on 1.8.5 or an older version we advise you to upgrade ASAP directly to this release.
+
+This release doesn't introduce any changes to the theme, so a theme upgrade is not required.
+
+#### Download
+- [Docker image v1.9.0](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.9.0)
+  - ```bash
+    docker pull tykio/portal:v1.9.0
+    ```
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.8.4)
+
+#### Changelog
+##### Added
+- Added [the webhooks](/portal/customization) capability that  enable real-time, automated data updates between the portal and 3rd party applications.
+- Added [admin APIs](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) for managing OAuth2.0 configuration. 
+
+##### Fixed
+- Fixed the error where the admin APIs returned 500 instead of 422 when an incorrectly formatted json is passed in the request body.
+- Fixed the error where missing DCR registration access token caused crash during DCR client revocation.
+- Fixed the error where API-created Access Requests were always auto-approved.
+- Fixed the following vulnerabilities related to Go 1.19 by upgrading Go version to 1.21:
+  - [CVE-2023-45287](https://scout.docker.com/vulnerabilities/id/CVE-2023-45287).
+  - [CVE-2023-39325](https://scout.docker.com/vulnerabilities/id/CVE-2023-39325).
+  - [CVE-2023-39319](https://scout.docker.com/vulnerabilities/id/CVE-2023-39319).
+  - [CVE-2023-39318](https://scout.docker.com/vulnerabilities/id/CVE-2023-39318).
+  - [CVE-2023-45284](https://scout.docker.com/vulnerabilities/id/CVE-2023-45284).
+  - [CVE-2023-48795](https://scout.docker.com/vulnerabilities/id/CVE-2023-48795).
+  - [CVE-2023-39326](https://scout.docker.com/vulnerabilities/id/CVE-2023-39326).
+  - [CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094).
+
+## 1.8 Release Notes
+### 1.8.5 Release Notes
+
+#### Release Date 5 Apr 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+Currently, there are no planned breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Release Highlights
+The 1.8.5 release addresses [CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094) vulnerability that was introduced in the 1.8.4 release.
+If you are not on v1.8.4 then there's no urgency in updating.
+
+#### Upgrade instructions
+If you are on 1.8.4 you should **upgrade ASAP** directly to this release. This release doesn't introduce any changes to the theme, so a theme upgrade is not required.
+
+If you are on 1.8.3 or older version please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) to upgrade the portal's themes.
+
+#### Download
+- [Docker image v1.8.5](https://hub.docker.com/r/tykio/portal/tags?page=&page_size=&ordering=&name=v1.8.5)
+  - ```bash
+    docker pull tykio/portal:v1.8.5
+    ```
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.8.4)
+
+#### Changelog
+
+##### Fixed
+- Fixed [CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094) by replacing Debian base image.
+
+### 1.8.4 Release Notes
+
+#### Release Date 5 Mar 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on 1.8.1 or an older version we advise you to upgrade ASAP directly to this release.
+
+To upgrade the portal's theme please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+
+#### Release Highlights
+The 1.8.4 release addresses ten high-priority bugs and vulnerabilities, and introduces multiple improvements to experience of admins in the portal's admin app.
+
+#### Download
+- [Docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.8.4/images/sha256-4dd01c11b79f46a06934b0b0ea8d3bbb63835bd31953eccd896481aa4d9cfe56?context=explore)
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.8.4)
+
+#### Changelog
+##### Added
+- Added [new configuration option](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) for setting the `SameSite` attribute on the portal's cookie.
+- Added [new welcome email for admin users](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) that is sent when new admin account is created.
+- Added [new welcome email for developers](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) that is sent when new developer account is created.
+- Added a fallback mechanism for referencing assets. This searches for assets, such as images, referenced in the rich text editor or markdown editor. It searches the container's filesystem whenever the portal can't find the referenced asset in the `PORTAL_STORAGE`.
+
+##### Changed
+- Changed the title for the subject of the new developer registration request from "Registering email - subject" in the settings UI to "Developer Registration Approval Request - Subject" to better reflect the context in which this email is used.
+- Adjusted the portal's behavior for saving pages through the admin API or the Pages UI. Now, if a content block referenced in a template is absent in the page using that template, the portal will ignore this issue instead of preventing the page from being saved. When rendering the respective page, any missing content blocks will be filled with empty strings.
+- Changed title for the portal's private pages for better SEO performance:
+
+| URL                          | Page title             |
+| :------------------------------ | :------------------------ |
+| /portal/private/analytics    | Analytics              |
+| /portal/private/dashboard    | Dashboard              |
+| /portal/private/apps/        | Create an application  |
+| /portal/private/apps/:id     | Applications           |
+| /portal/private/users        | Users                  |
+| /portal/private/organisation | Create an organization |
+| /portal/private/users/invite | Invite a user          |
+| /portal/private/users        | Users                  |
+| /portal/private/users/:id    | Users                  |
+| /portal/private/profile      | Profile                |
+| /auth/password/login         | Developer portal login |
+| /auth/password/new           | Password reset         |
+- Changed the credential provisioning flow to automatically include DeveloperID, OrganizationID, ApplicationID, and TeamIDs in [the credential metadata](/portal/customization/user-model).
+- Added warning regarding potential PII exposure to the [custom attributes menu](/portal/customization/user-model).
+- Changed the behavior of the portal for 404 errors. Now whenever a user requests non-existing page both private (e.i. requiring sign-in to access) or public, the portal now always renders the `not_found.tmpl` template.
+- Changed the behavior of the `Secure` cookie attribute that is set by [PORTAL_SESSION_SECURE](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_session_secure) so that the `Secure` attribute is always add to the `Set-Cookie` header whenever `PORTAL_SESSION_SECURE` is set to `true` or when TLS is enabled.
+- Changed the behavior of removing a developer profile within the developers UI in the admin app. Now, when an admin tries to remove a developer profile and some of their credentials have been removed from the credentials provider, or if the provider itself is down or unreachable, the portal asks the admin if they still want to remove the developer profile by displaying a modal window.
+- Extended the `DELETE /users/:id` API endpoint by adding the [?force](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) query parameter to force removal of a user even if some of their credentials have been removed from the credentials provider, or if the provider itself is down or unreachable.
+- Extended the `GET /pages/:id/content-blocks/:id:` API endpoint by adding additional fields in the response body: `Content`, `MarkdownContent`, `MarkdownEnabled`, `Name`, and `PageID`.
+- Extended [filesize limit](/portal/customization/themes#create-a-theme) for individual files in themes to 5 MB.
+- Made the organization invite email's subject configurable via [the emails settings section](/portal/customization/email-notifications#supported-email-notifications).
+
+##### Fixed
+- Fixed the bug where it was impossible to create an ordered list in the rich text editor in the admin app due to CSS issues.
+- Fixed the bug where it was possible to copy the 'portal-session' cookie and use it with different IP address or browser.
+- Fixed the bug where the audit log didn't reflect some actions initiated by admin users and developers.
+- Fixed the bug where sensitive data such as hashed API tokens and passwords were exposed in the audit log.
+- Fixed the bug where menu items were still persistent after deletion.
+- Fixed the bug where admin users couldn't edit custom attributes created after a user profile is created.
+- Fixed the bug where the UI errors when uploading theme were not consistent with the API error messages.
+- Fixed the bug where scroll appeared in the API description box in the API Product page when the API description was longer than 50 symbols.
+
+### 1.8.3 Release Notes
+
+#### Release Date 22 Jan 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on 1.8.1 or an older version we advise you to upgrade ASAP directly to this release.
+
+To upgrade the portal's theme please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+
+#### Release Highlights
+The 1.8.3 release addresses ten high-priority bugs and introduces new admin APIs for managing tags and OAuth2.0 client types attached to API Products.
+
+#### Download
+- [Docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.8.3/images/sha256-3693065546348105a693a1ed5402c93bfecd480c900e1efea4a6dea674263df3?context=explore)
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.8.3)
+
+#### Changelog
+##### Added
+- Added [new admin API](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) for managing tags attached to API Products.
+- Added [new admin API](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) for managing OAuth2.0 client types attached to API Products.
+
+##### Fixed
+- Fixed the bug where the search bar in the My Apps section of the Developer dashboard didn't search for an application.
+- Fixed the bug where it was possible to update read-only details of an API Product via an API call.
+- Fixed the bug where deleting an access request credentials also deleted the access request.
+- Fixed the bug where the button to save a link when editing a hyperlink in the admin UI in the text editor wasn't displayed.
+- Fixed the bug where the Exports function didn't export analytics to a CSV file under the Error rate(average) tab in the developer Dashboard.
+- Fixed the bug where the portal did not accept themes with names containing dots and displayed a not found error when uploading a theme with a dot in its name.
+- Fixed the bug in a multi-pod deployment where, when a theme is uploaded, only the pod that uploaded it updates its theme list, while the other pods remain unaware of the new theme.
+- Fixed the bug where the Portal allowed pages to be created with duplicate content block names. Subsequently, only the last content block with the duplicate name was displayed.
+- Fixed the bug where the portal's page renderer ignored content-blocks under the `if` statement with references to multiple content-blocks (e.g. `{{ if and .blocks.Block1.Content .blocks.Block2.Content .blocks.Block3.Content }}`). Subsequently, content that depended on these conditional blocks would not be rendered.
+- Fixed the bug where the product auth type is removed after a product is updated.
+
+### 1.8.2 Release Notes
+
+#### Release Date 22 Dec 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on 1.8.1 or an older version we advise you to upgrade ASAP directly to this release.
+
+To upgrade the portal's theme please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+
+#### Release Highlights
+The 1.8.2 release addresses multiple high-priority bugs:
+- Fixed the bug where an API Consumer could add incompatible products to a cart making its state inconsistent.
+- Fixed the bug where it was possible to use the same session cookie from different IP addresses making the portal vulnerable to the [Cross-Site Request Forgery (CSRF) attack](https://en.wikipedia.org/wiki/Cross-site_request_forgery).
+- Fixed the bug where an admin user couldn't create a new team in Kubernetes environment.
+- Fixed the bug where the navigation in the API documentation was broken when Redoc is selected as a documentation rendering engine.
+- Fixed the bug where an API Consumer could bypass the access request rate limit by creating additional applications.
+- Fixed the bug where the page rendering fails if the page refers to a template that has no template/layout pair definition in the theme manifest.
+- Fixed the bug where creating new content blocks in non-default themes led to duplication of those content blocks in the admin UI.
+- Fixed the bug where `.Markdown` content blocks where not shown.
+
+#### Download
+- [Docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.8.2/images/sha256-944b6fd5bead39b77cbfa50706098d52ce4c003b483b1f5e20456c65ede40fb2?context=explore)
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.8.2)
+
+#### Changelog
+
+##### Fixed
+- Fixed the bug where an API Consumer could add incompatible products to a cart making its state inconsistent.
+- Fixed the bug where it was possible to use the same session cookie from different IP addresses making the portal vulnerable to the [Cross-Site Request Forgery (CSRF) attack](https://en.wikipedia.org/wiki/Cross-site_request_forgery).
+- Fixed the bug where an admin user couldn't create a new team in Kubernetes environment.
+- Fixed the bug where the navigation in the API documentation was broken when Redoc is selected as a documentation rendering engine.
+- Fixed the bug where an API Consumer could bypass the access request rate limit by creating additional applications.
+- Fixed the bug where the page rendering fails if the page refers to a template that has no template/layout pair definition in the theme manifest.
+- Fixed the bug where creating new content blocks in non-default themes led to duplication of those content blocks in the admin UI.
+- Fixed the bug where `.Markdown` content blocks where not shown.
+
+### 1.8.1 Release Notes
+
+#### Release Date 5 Dec 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on 1.8.0 or an older version we advise you to upgrade ASAP directly to this release.
+Unlike 1.8.0, 1.8.1 fixes the broken backward compatability for the default visual theme. Therefore, the upgrade path from earlier versions are straightforward. It is enough to just pull the latest version of the portal's container.
+
+To upgrade the portal's theme please follow the [upgrade instructions](/portal/customization/themes#upgrading-themes) for the portal's themes.
+
+
+#### Release Highlights
+The 1.8.1 release addresses multiple high-priority bugs:
+- Restored backward compatibility for the default visual theme which was broken in the previous release.
+- Fixed the bug where the live portal UI was broken when there is more than one OpenAPI specification attached to an API Product.
+- Fixed the bug where the collapsible components in the admin application of the portal didn't open.
+- Fixed the bug where the client type wasn't a required field when creating OAuth2.0 clients via the DCR flow.
+- Fixed the bug where CPU usage unexpectedly increased in Kubernetes without external traffic.
+- Fixed the bug where admin users were not able to approve access requests in Kubernetes environment.
+- Fixed the bug where the usage analytics didn't show in the Developer Dashboard.
+- Upgraded the version of Stoplight to the latest available version in the default theme.
+
+#### Download
+- [Docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.8.1/images/sha256-3b7ef4572cad8f6f5cddfa921514a07b43ba46bacf5eb89b735c45863863f13f?context=explore)
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.8.1)
+
+#### Changelog
+
+##### Added
+- Add a [config option](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_enable_http_profiler) to expose the Golang profiling information which allows for debugging issues related to resource consumption.
+
+##### Changed
+- Upgraded the version of Stoplight to the latest available version in the default theme.
+
+##### Fixed
+- Restored backward compatibility for the default visual theme which was broken in the previous release.
+- Fixed the bug where CPU usage unexpectedly increased in Kubernetes without external traffic.
+- Fixed the bug where admin users were not able to approve access requests in Kubernetes environment.
+- Fixed the bug where the usage analytics didn't show in the Developer Dashboard.
+- Fixed the bug where the live portal UI was broken when there is more than one OpenAPI specification attached to an API Product.
+- Fixed the bug where the collapsible components in the admin application of the portal didn't open.
+- Fixed the bug where the client type wasn't a required field when creating OAuth2.0 clients via the DCR flow.
+
+### 1.8.0 Release Notes
+
+#### Release Date 24 Nov 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on 1.7.0 or an older version we advise you to upgrade ASAP directly to this release.
+When upgrading from 1.6.0 or earlier versions, customers may experience problems when starting the portal. One of the possible issues is the following:
+- When the portal theme [manifest](/portal/customization/themes#manifest-file) has a reference to a template that is not present in the theme then the theme won't be loaded. This check that prevents admin users from uploading themes with potential errors was introduced in version [1.7.0](#content-blocks-validation).
+- At the same time, the default theme in version 1.6.0 of the portal had a reference in the theme manifest to the `portal_home` template that didn't exist in the theme.
+- The portal doesn't update the theme automatically because in that case any customer-made changes will be lost. Subsequently, upgrading from 1.6.0 to 1.8.0 may result in the following error when loading the theme:
+```yaml
+{"level":"info","time":"2023-11-23T12:25:35.646Z","caller":"application/themes.go:121","message":"Failed to initialize theme '/themes/default': loading theme templates code references: getting template portal_home: portal_home.tmpl not found"}
+{"level":"info","time":"2023-11-23T12:25:35.646Z","caller":"application/themes.go:135","message":"0 themes loaded."}
+panic: theme 'default' not found
+```
+- Moreover, when there was a single theme in the portal, it wouldn't start because it didn't recognize the theme as valid.
+
+To overcome the issue, please follow our upgrade instructions for your storage type as outlined in the sections below.
+
+The following instructions explain the easiest way to upgrade the default theme when upgrading from 1.6.0 to 1.8.0.
+
+In order to upgrade the theme, you will need to remove the existing default theme and let the portal unpack the current default theme that is compatible with v1.8.0 release. Therefore, the update is performed in four steps:
+1. (Optionally) Save a copy of the current default theme if there are any changes to it that you want to save.
+2. Remove the existing default theme that prevents the portal from starting.
+3. Start the portal so that it will unpack the compatible theme.
+4. (Optionally) Apply changes from the saved theme.
+
+In later releases, we will publish the theme within a public git repository. This way you can apply git-flow when upgrading the theme.
+
+
+<Note>
+If your current active theme is not the default theme, downgrade to v1.6.0 and activate the default theme first before implementing the below steps.
+</Note>
+
+
+###### Upgrade default theme within filesystem storage type
+To upgrade the default theme that is stored in a filesystem (fileSystem mounted by localhost or PVC or csi-driver) you will need a shell to access that specific file system. Execute the following steps to upgrade the theme:
+1. **Navigate to the theme directory**. Locate the theming directory used for the portal application defined by `Theming.Path` in the portal config file or `PORTAL_THEMING_PATH` environment variable. By default, the theming path is `./themes`. So, it will be placed in the `themes` directory relative to wherever the portal app is run from.
+2. *(Optional)* Save a copy of the current default theme if there are changes that you want to keep. 
+3. **Remove the default theme**. To remove the existing version of the default theme from a filesystem, navigate to the theme directory and remove the default theme:
+```shell
+rm -rf ./default
+```
+4. **Start the portal.** Once the default theme is deleted, start the portal v1.8.0 again, and it will start with the upgraded default theme.
+5. *(Optional)* Once the portal is operational again, you can download the correct default theme and apply any changes from the existing theme that was saved in step 2.
+
+###### Upgrade default theme within S3 storage type
+To upgrade the default theme that is stored in an S3 bucket you will access to the S3 console with read-write rights. Execute the following steps to upgrade the theme:
+
+1. **Navigate to the S3 bucket that is used to store themes**. This bucket is defined by `S3.Bucket` in the portal config file or `PORTAL_S3_BUCKET` environment variable. The default theme should be present in the theming directory that is defined by `Theming.Path` in the portal config or `PORTAL_THEMING_PATH` environment variable. By default, the theming path is set to `/themes`.
+2. *(Optional)* Save a copy of the current default theme if there are changes that you want to keep. 
+3. **Remove the default theme** by deleting the default directory from the theming directory.
+4. **Start the portal.** Once the default theme is deleted, start the portal v1.8.0 again and it will start with the upgraded default theme.
+5. *(Optional)* Once the portal is operational again, you can download the correct default theme and apply any changes from the existing theme that was saved in step 2.
+
+###### Upgrade default theme within DB storage type
+To upgrade the default theme that is stored in a database bucket (the `db` storage type) you should be able to run SQL commands on the database that the portal is using. Execute the following steps to upgrade the theme:
+1. *(Optional)* If you need to save changes to the existing default theme, downgrade to 1.6.0, start the portal and download the theme either via the UI or the admin APIs.
+2. **Remove the default theme**. The portal stores its themes in the `Assets` table. Run the following SQL command to remove the default theme from the database:
+```sql
+delete from assets where path like "%<theming-path>/default%";
+```
+Before executing the command be sure to replace the `<theming-path>` with the path defined by `Theming.Path` in the portal config or `PORTAL_THEMING_PATH` environment variable. By default, it is `/themes`, so if you have not explicitly changed this, your command should be as follows:
+```sql
+delete from assets where path like "%/themes/default%";
+```
+3. **Start the portal.** Once the default theme is deleted, start the portal v1.8.0 again and it will start with the upgraded default theme.
+4. *(Optional)* Once the portal is operational again, you can download the correct default theme and apply any changes from the existing theme that was saved in step 1.
+
+
+
+    <Note>
+    For PVC, if you are stuck with a crashing issue on a newer portal release (version > v1.7.0) running in k8s with PVC storage that contains an older theme (from version < v1.7.0), roll back to v1.6.0 or start a temporary pod with the same PVC mounted to it. Then delete all the existing themes as stated above and deploy the new release.
+    </Note>
+
+
+
+#### Release Highlights
+##### Custom attributes for the User model and the sign-up form customization
+We added the capability to add additional data fields to the User model and set their behavior. This way API Providers can:
+Extend the User model with additional fields of one of four types:
+  - String
+  - Number
+  - List of strings
+  - Boolean
+- Configure the behavior of these fields:
+  - Add the new data fields to the user sign-up form
+  - Force the portal to add the fields to the key metadata to make them available to custom plugins during API calls
+  - Make the fields required or optional and lock them once a user profile is created
+- Set visibility and access rights for the custom data fields:
+  - Determine if developers can view the fields or are they restricted to only admin users?
+  - Can developers edit the fields?
+
+All settings are available via the [admin API](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) and the UI.
+
+To create a custom attribute, define it in the custom attributes menu:
+<img src="/img/dashboard/portal-management/enterprise-portal/1.8.0-create-custom-attribute.png" alt="Create a custom attribute for the User model" />
+
+This is how it looks like in the user sign-up form:
+<img src="/img/dashboard/portal-management/enterprise-portal/1.8.0-sign-up-form.png" alt="The user sign-up form with the custom attribute" />
+
+##### CORS settings
+In this release, we introduced the config options to set up CORS settings such as:
+- Allowed origins
+- Allowed headers
+- Allowed methods
+- Are credentials (cookie or client-side certificates) allowed?
+- max-age of the preflight request cache
+
+These settings are useful when the portal sits behind a proxy or a CDN and the portal admin needs to configure the CORS settings on the portal side so that the incoming call from a third-party origin (e.g. a CDN or a proxy) are not rejected by the browser.
+To set the CORS configuration please refer to the Portal's [configuration documentation](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#cors-settings).
+
+##### Connection testing to OAuth2.0 Identity providers
+We enhanced our OAuth2.0 support by adding the capability to test connections to OAuth2.0 Identity providers (IdPs) when setting up OAuth2.0 with the Tyk Enterprise Developer Portal.
+This way, you can make sure the Portal has connectivity with the IdP before saving the OAuth2.0 settings and creating the first OAuth2.0 client.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/1.8.0-test-idp-connectivity.png" alt="Test connectivity to an IdP" />
+
+##### Verbose logs for the DCR flow
+In addition to the new connection testing functionality, we added one more tool to help customers resolve complex integration issues when integrating with OAuth2.0 providers.
+Now when the [PORTAL_DCR_LOG_ENABLED](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_dcr_log_enabled) environment variable is set to `true`, the portal will output not only the status and status code of the request to the IdP, but also actual payload returned by the IdP: 
+```yaml
+{"level":"error","time":"2023-10-10T17:02:27.484+0200","caller":"client/dcr-helpers.go:152","message":"IdPResponse: {\"error\":\"insufficient_scope\",\"error_description\":\"Policy 'Allowed Client Scopes' rejected request to client-registration service. Details: Not permitted to use specified clientScope\"}
+```
+
+#### Download
+- [Docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.8.0/images/sha256-d93fcfbbcc4a72d3f6abf49ce65f234e6e65915a43cca3a30d5376e5fab2d644?context=explore)
+- [The default theme package](https://github.com/TykTechnologies/portal-default-theme/releases/tag/1.8.0)
+
+#### Changelog
+
+##### Added
+- Added the custom attributes to the User model so that the portal admins can extend the data stored in the user profile and customize the user sign-up form.
+- Added the capability to test the connection to OAuth2.0 Identity providers menu to help the portal admin troubleshoot connectivity issues when configuring OAuth2.0 with the portal.
+- Added the config options for configuring the CORS settings.
+
+##### Changed
+- Display an actual item title instead of a generic iterative name in the Pages and the Providers UI (e.g. "HeaderButtonLabel" instead of "ContentBlock 1" in the Pages menu).
+- When [PORTAL_DCR_LOG_ENABLED](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_dcr_log_enabled) is enabled the portal now returns not only the status and status code of the request to the IdP but also actual payload returned by the IdP
+
+##### Fixed
+- Fixed the bug where the database credentials were printed in the logs when bootstrapping the portal.
+- Fixed the bug where the session cookie was disclosing the username and role.
+- Fixed the bug where the [Forgot Password page](/tyk-developer-portal/tyk-enterprise-developer-portal/api-consumer-portal/reset-password) did not reflect the current theme.
+- Fixed the bug where the DCR flow failed to create a client with policies managed by Tyk Operator.
+- Fixed the bug where an admin user couldn't upload a new theme file in Kubernetes environment.
+- Fixed the bug where the portal application went down after running for several hours in Kubernetes environment.
+- Fixed the bug where it was possible to remove the default organization which resulted in the portal being non-operational.
+- Fixed the bug where the portal panicked when an IdP was not available while creating a new OAuth2.0 client.
+- Fixed the bug where a developer could access API Products regardless of the access rights set by catalogs.
+- Fixed the bug where it wasn't possible to change a team for a user.
+- Fixed the bug where the error wasn't displayed to an admin user when the theme validation failed while uploading a theme package.
+- Fixed the bug where the rich text editor added extra `<p>` tags to the text.
+- Fixed the bug where the live portal UI was broken when there is more than one OpenAPI specification attached to an API Product.
+- Fixed the bug where it wasn't possible to remove an API from an API Product.
+
+
+## 1.7 Release Notes
+### 1.7.0 Release Notes
+
+#### Release Date 6 Oct 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on a 1.6.0 or an older version we advise you to upgrade ASAP directly to this release.
+
+#### Release Highlights
+##### Content blocks validation
+We added validation to the content pages. Now when an admin user tries to delete a content block that is necessary to render the page, the portal won't let them to save the page.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.7.0-content-block-validation.png" alt="Content-block validation" />
+
+##### Audit log capability 
+We added capability to enable audit log for any action that changes state of the portal or queries data from the portal. When the audit log is enabled, every action of admin users or developers performed via the UI or an API (only for admin users) will be noted in the audit log. 
+To enable the audit log, just specify path to the audit log file and enable it.
+
+To configure the audit log with environment variables, use PORTAL_AUDIT_LOG_ENABLE to enable the audit log and PORTAL_AUDIT_LOG_PATH to specify path to the audit log file:
+```shell
+PORTAL_AUDIT_LOG_ENABLE=true
+PORTAL_AUDIT_LOG_PATH=./audit.log
+```
+
+To configure the audit log with the config file, use AuditLog.Enable to enable the audit log and AuditLog.Path to specify path to the audit log file:
+```json
+  "AuditLog": {
+    "Enable": true,
+    "Path": "./audit"
+  }
+```
+
+When specifying path ot the audit file make sure it's mapped to a file on the host machine.
+
+##### Capability to limit frequency of access requests
+Now admin users can specify how often developers can request access to a specific plan. This way the admins can prevent developers from creating too many keys and abusing their free plan.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.7.0-rate-limit-for-access-requests.png" alt="Access requests frequency limit" />
+
+#### Download
+- [docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.7.0/images/sha256-1204c9f2d53ac8cbf7230f7c73bd2edb117b33ec11547d595c58264301c9172b?context=explore)
+
+#### Changelog
+
+##### Added
+- Added content blocks validation for content pages to avoid changes to content pages that result in page render errors.
+- Added the audit log capability to track any action that changes state of the portal or queries data from the portal.
+- Added the capability to limit frequency of access requests to block any abuse of free plans. 
+
+##### Changed
+- Disable autocomplete for passwords in the default theme to prevent the access credentials from being stored on the local computer. The stored credentials can be captured by an attacker who gains control over the user's computer.
+
+##### Fixed
+- Fixed the bug where developers could get access to applications of other developers if they know the app ID.
+- Fixed the bug where developers and apps of an organization were not deleted when the organization was deleted.
+- Fixed the bug where it was possible to remove the default organization with resulted in the portal being non-operational.
+
+## 1.6 Release Notes
+### 1.6.0 Release Notes
+
+#### Release Date 5 Sep 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on a 1.5.0 or an older version we advise you to upgrade ASAP directly to this release.
+
+#### Release Highlights
+##### OAuth2.0 flow now supports multiple identity providers
+Now the Tyk Enterprise Developer portal can use multiple identity providers (IdPs) for OAuth2.0 via the Dynamic Client Registration flow. If your company has multiple OAuth2.0 providers now you can utilize them all for OAuth2.0 authentication. For instance, if your company uses different IdPs for different products (e.g. one for the U.S. and another for the EU) you can now achieve that with Tyk.
+
+Just create multiple IdPs in the App registration menu:
+<img src="/img/dashboard/portal-management/enterprise-portal/1.6.0-multiple-idps-index.png" alt="OAuth2.0 providers page" />
+
+And then use them to enable OAuth2.0 authentication for API Products:
+<img src="/img/dashboard/portal-management/enterprise-portal/1.6.0-multiple-idps-edit.png" alt="OAuth2.0 provider overview" />
+
+##### New Admin API for all content-blocks 
+You can download all CMS content with just one API call with the brand new API endpoint *GET* */pages/all/content-blocks* that returns all content blocks for all pages. Now migration between environments and deployment is much easier.
+
+##### Support for Mutual TLS
+For customers who need extra security for their APIs such financial institutions and payment providers we introduced an ability for the portal to surface Mutual TLS APIs. Now you can configure API Key and OAuth2.0 API to support Mutual TLS. Just create an API that supports multiple authentication mechanisms in the Dashboard and publish it to the portal:
+<img src="/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-dashboard.png" alt="Mutual TLS auth API in the Tyk Dashboard" />
+
+Now your developers can discover and request access to them in the portal:
+<img src="/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-published.png" alt="Mutual TLS auth API Product is published in the portal" />
+
+<img src="/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-checkout.png" alt="Mutual TLS auth API Product in the checkout flow" />
+
+##### Display-only support for API Products with custom authentication
+This new capability allows you to display on the portal the APIs that use your own custom authentication mechanisms. We appreciate that many customer use their own auth mechanisms and even though at the moment we cannot create credentials for custom authentication schemas, we still want to support customers using these.
+
+To display API Products that support custom authentication, you need simply to create an API Product that include APIs with custom authentication and synchronize it to the portal:
+<img src="/img/dashboard/portal-management/enterprise-portal/1.6.0-display-custom-auth-apis.png" alt="Custom auth API Product is published in the portal" />
+
+#### Download
+- [docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.6.0/images/sha256-5a7ada35df1817f9b44c5f725c77cd8548a4e094505ba0f0d4ed611f85edad7f?context=explore)
+
+#### Changelog
+
+##### Added
+- Added support for multiple IdPs of the OAuth2.0 flow. If a customer has multiple OAuth2.0 providers now they can utilize them all for OAuth2.0 authentication with Tyk.
+- Added new admins APIs for querying all content-blocks to improve data migration capabilities of the portal. 
+- Added support for API Products that use Mutual TLS. Now API Providers can surface their API Products that use Mutual TLS authentication on the portal and developer can request access to them.
+- Added display-only support for API Products with custom authentication. This allows API Providers to expose on the portal their APIs that use custom authentication for documentation purposes. 
+
+##### Changed
+- Simplified the connection settings to the portal assets storage (where all images, themes, and other CMS files are stored) to help our customers get up to speed quicker. We are well aware that installing and configuring on-premise software can be tricky, especially when it comes to infrastructure, storage and databases. Hence, we have decided to ease this burden for you:
+  - By default, the portal uses the `db` [storage type](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_storage) for storing its themes and other CMS assets and it doesn't require any additional configuration. This means, you can start the portal right away without specifying any additional setting for the assets storage.
+  - We also simplified setting up S3 storage: now you need only to configure connection settings to the bucket and the portal will handle the rest.
+
+
+##### Fixed
+- In 1.6.0 multiple important security bugs are fixed:
+  - Added the ability to disable the theme upload capability. Since we don't validate the theme content it might have viruses and other malicious software. So, to provide super secure environments, we added a setting to disable the theme upload via the UI and API:
+    <img src="/img/dashboard/portal-management/enterprise-portal/1.6.0-theme-upload-is-disabled.png" alt="Mutual TLS auth API Product in the checkout flow" />
+  - Fixed the bug where the session is not invalidated after a user logs out.
+  - Fixed the role permission issue where a provider-admin can deactivate and delete a super-admin.
+  - Fixed the Users API resource which allowed any value to be entered into the Provider and Role fields.
+- In addition to the security fixes, several bugs related to the theme management are fixed:
+  - The list of available templates is now automatically updated when a new theme is loaded.
+ - Fixed the bug where theme unpacking required unnecessary write permission to the */tmp* folder.
+  - Fixed icon alignment in the UI on the main page of the default theme.
+
+## 1.5 Release Notes
+### 1.5.0 Release Notes
+
+#### Release Date 17 Jul 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on a 1.4.0 or an older version we advise you to upgrade ASAP directly to this release.
+
+#### Release Highlights
+##### Improved API Providers page
+Now the API Provider page has the Status and Last synced columns that help to digest the current status of an API Provider (Up, Down, or Unknown) and the last time it was synchronized. Now it's much easier to digest the current status of API Providers connected to the portal.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.5.0-provider-page.png" alt="Improved provider page" />
+
+##### Add the SSL insecure skip verify flag for API Providers
+With this new option, Tyk Enterprise Developer portal can be configured to use untrusted certificates when connecting the Tyk Dashboard which helps run local PoCs, quickly and easily.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.5.0-skip-ssl-verify.png" alt="SSL skip verify" />
+
+##### New admin APIs
+In 1.5.0 we introduced the following APIs:
+- CRUD API for Get started guides.
+- CRUD API for OpenAPI Spec for APIs included in API products.
+- CRUD API for API Providers.
+
+##### Better OAuth2.0 flow without the scope to policy mapping
+
+<Note>
+This feature requires a patch to the gateway. In the 1.3.0 version of the portal, it's disabled. Once the 5.2 version of the gateway is released, we can confirm that the feature is fully functional. Stay tuned for updates!
+</Note>
+
+The improved OAuth2.0 allows API Providers to configure OAuth2.0 with scope to policy mapping and default No-Operation policies reducing the number of steps configure OAuth2.0 product in the Dashboard in the IdP by 17 steps from 19 to just 2 actions.
+
+It also allows adding access to API Products to existing credentials. This way, if an API Consumer wants to add a new API Product to an existing credential, they can simply do it without the need to recreate them from scratch.
+
+#### Download
+- [docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.5.0/images/sha256-169ba9584bc31add666cebb1b9231a47f5d9f78ccb086adf7d0ff8810c611a67?context=explore)
+
+#### Changelog
+##### Added
+- Added the Status and Last synced columns to the API Provider page to make easier to digest status of each API Provider.
+- Added the Skip SSL Verify flag for the API Providers. It's now possible to use self-signed certificates for PoCs.
+- Added new admin APIs for the Get started guides, Open API Specifications and API Providers to enable migration of configurations between different environments of the portal. 
+- Added improved OAuth2.0 flow without the scope to policy mapping which makes it much easier to configure OAuth2.0 with Tyk.
+- Enable API Providers to set security response headers in the portal config to make API Providers flexible in configuring their UI security settings.
+
+##### Fixed
+- In 1.5.0 multiple important security bugs are fixed:
+  - Add secure and httpOnly flags to enhance the security of session cookies.
+  - Fixed the bug with the role permission issue when a provider-admin can deactivate and delete a super-admin.
+  - Fixed the bug with the Users API resource where it was possible to enter any value in the Provider and Role fields.
+- In addition to the security fixes, several bugs related to the theme management are fixed:
+  - The list of available templates is now automatically updated when a new theme is loaded.
+  - The issue encountered with theme unpacking requiring write permission to the /tmp folder is now resolved. Write permission is no longer required.
+  - Fixed the icon issue alignment on the main page of the default theme.
+
+## 1.4 Release Notes
+### 1.4.0 Release Notes
+
+#### Release Date 2 June 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on a 1.3.0 or an older version we advise you to upgrade ASAP directly to this release.
+
+#### Release Highlights
+##### SQL support for the portal's assets
+Until recently, SQL storage was not supported for the portal's assets: OAS files, themes, images, etc. Therefore, customers had to use at least two types of storage:
+- SQL for the portal's metadata (users, products, access requests, etc).
+- Filesystem or S3 for assets (pictures, themes, etc).
+
+This is especially inconvenient in Kubernetes environment when customers had to use persistent volumes.
+With this new feature, customers can simply use the same SQL database (MySQL, MariaDB and PostgreSQL) for both assets and metadata. To use the `db` [storage type](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_storage) just set the `PORTAL_STORAGE=db` for environment variables or `"Storage": "db"` in a config file and you are good to go!
+
+##### Response status code added to API analytics filters
+API Consumers now can filter API analytics by response status codes. This allows them to analyze traffic and error rate for specific response code for their API Products.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.4.0-response-code-filters.png" alt="API Analytics UI - Response code filters" width="500px" />
+
+##### Displaying Basic Auth APIs
+We introduced display-only support for basic APIs. That means API Providers can publish documentation for the basic auth APIs. However, developers cannot use the portal to get access to the basic auth APIs.
+
+#### Download
+- [docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.4.0/images/sha256-11af93300ae91962e9af84ecec0e78b6cf5972521f0655273b48a7e551df3c84?context=explore)
+
+#### Changelog
+##### Added
+- Added SQL support for the portal's assets to simplify the storage configuration. Now our customers can store all data in one database.
+- Added response status code filters in the API analytics for developers to enhance self-service capabilities for developers.
+- Added displaying Basic Auth APIs so that API Providers can expose on the portal their APIs that use basic auth for documentation purposes.
+- Added input validation for organization name to prevent organization with empty names from being created.
+
+##### Fixed
+- Fixed typo in the name of the demo user.
+- Rewritten labels for Auth token credentials to remove customers' confusion with opaque names of fields.
+
+#### Security Fixes
+- [ZipSlip vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2023-27475) in the theme upload flow is now resolved.
+- Added input validation for preventing XSS attacks for catalogs and organizations in the admin app.
+
+## 1.3 Release Notes
+### 1.3.0 Release Notes
+
+#### Release Date 17 Apr 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on a 1.2.0 or an older version we advise you to upgrade ASAP directly to this release.
+
+#### Release Highlights
+##### API Analytics UI for developers
+We added the new **API Analytics UI** which extends self-service capabilities for developers. This provides developers with an ability to analyze performance of the APIs which they consume, in addition to traffic composition for their apps. 
+The **API Analytics UI** has four tabs that help developers to navigate different analytical views:
+- **The overview tab** provides an overarching view on the API Products consumed by a developer. This tab has all information needed to quickly digest the current state of API Products, including: total traffic, number of errors, error breakdown by response code and top APIs by error code.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-overview.png" alt="API Analytics UI - Overview tab" width="500px" />
+- **The Total API Calls** tab enables developers to analyze traffic from their application to the APIs they consume and how it's changing over time.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-total-calls.png" alt="API Analytics UI - Total API Calls tab" width="500px" />
+- **The Errors** tab provides developers with information relating to total errors and error rates. Here developers can identify any issues with the APIs which they consume without filling any support tickets. Developers can switch between the total number of error and error rates.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-errors.png" alt="API Analytics UI - Errors tab" width="500px" />
+- **The Latency tab** helps developers to analyze response time of the APIs they consume so that they can factor for it in their applications.
+<img src="/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-latency.png" alt="API Analytics UI - Latency tab" width="500px" />
+
+##### Theme management API
+The theme management API enables SDLC for the theme management in the portal. Admin users can leverage this API to programmatically:
+- Create new themes.
+- Update existing themes.
+- Select the currently active theme.
+
+##### Enhanced error logging for DCR and SSO flows
+We introduced more verbose error logging for the DCR flow and for Single Sign-On to help customers set up the SSO and DCR faster. This is especially important for complex environments with highly customized or non-standard IdPs.
+
+#### Download
+- [docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.3.0/images/sha256-87bc071b93e2fa4970e5ec512a4b0601f139ac9cbb73baf35662d4b5f3a0f290?context=explore)
+
+#### Changelog
+##### Added
+- Added API Consumer Analytics to digest summary analytics for developers' applications so that developers can analyze performance of the APIs which they consume.
+- Added enhanced error logging in all places where the DCR flow is used. A log structure is now provided, including the status code from an IdP to help API Providers to debug DCR integrations.
+- Added enhanced error logging to the SSO flow to facilitate setting up SSO.
+- Added the Theme management API to enable API Providers to update themes using CI/CD pipelines. 
+
+##### Fixed
+- Fixed grammar in the Provider menu UI.
+- Fixed broken link to the Access requests menu item in the portal admin dashboard.
+- Fixes to the shopping cart flow were made as follows:
+  - Fixed the bug where the 'Add to cart' button in the API Product page were not clickable; 
+  - Added form validation in the checkout flow.
+- Fixed the API Product page to show only catalogs available to a developer.
+
+## 1.2 Release Notes
+### 1.2.0 Release Notes
+
+#### Release Date 21 Mar 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are on a 1.1.0 or an older version we advise you to upgrade ASAP directly to this release.
+
+#### Release Highlights
+This release is primarily focused on improved deployment support for Kubernetes and a variety of features to achieve better developer experience.
+
+##### Full Kubernetes support
+The Tyk Enterprise Developer Portal is now available in Kubernetes and customer can launch it using our [helm charts](/portal/install/kubernetes#legacy-helm-chart). This feature makes the portal Kubernetes friendly by adding liveness, readiness probes, graceful shutdown and changing the portal lifecycle so that it's possible to set an initial user and bootstrap the portal via APIs.
+
+##### SSO for API Consumers and admins
+API Providers can [configure Single Sign-on](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) for the Enterprise developer portal so that it's possible to login developers and admins to the portal user 3rd party IdP.
+
+##### API Analytics for API Consumers
+This capability enables API Providers to get aggregated statistics about consumption of their APIs using Tyk Pump. In 1.2.0, we enabled the portal to attach the following tags to API Keys and oAuth clients:
+- Application (app-XXX, where XXX is the app ID); 
+- Organization (org-XXX, where XXX is the org ID).
+
+##### Admin API for API Products
+This feature provides an API to make it easier for admin users to manage their API Products:
+- List available API Products.
+- Change the content and description.
+- Add link to Open API specification for APIs.
+
+##### Add TLS support
+This feature enables API Provides to secure the portal with [HTTPs](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_tls_enable).
+
+##### Add enhanced logging configuration
+This new setting allows API Providers to set the logging [level](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_log_level) and [format](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_log_format). This offers API Providers more control over the logging behavior of their APIs.
+
+#### Download
+- [docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.2.0/images/sha256-1dda1c17a9acc5bc51a9650dc22c6116156b8eb302d8cba7f7e2b31dea570d27?context=explore)
+
+#### Changelog
+
+##### Added
+- Added Kubernetes support and [helm charts](/portal/install/kubernetes#legacy-helm-chart).
+- Added [Single Sign-on](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) for API Consumers and admin users so that they can use their IdPs for managing admin users and developers.
+- Added organization and application metadata to auth tokens and OAuth2.0 clients so that API Providers can use Tyk Pump to create aggregated reports based on the metadata from tokens and OAuth2.0 clients.
+- Added Admin APIs for API Products to enable API Providers to update API Products using CI/CD pipelines.
+- Added [TLS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_tls_enable) support for the portal's UI.
+- Added config options to set the logging [level](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_log_level) and [format](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_log_format). This offers API Providers more control over the logging behavior of their APIs.
+
+
+##### Fixed
+- Fixed grammar in the copy section of the admin application on the Application page.
+- Fixes an issue with DCR that was encountered when a developer deletes an app with two DCR products from different catalogs.  In that case, the client was deleted from IdP but the app was not deleted from the Portal.
+
+## 1.1 Release Notes
+### 1.1.0 Release Notes
+
+#### Release Date 20 Jan 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Future breaking changes
+This release doesn't introduce future breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+We advise you to upgrade ASAP directly to this release.
+ 
+#### Release Highlights
+This release introduce a variety of features to improve developer experience. Additionally, we've included support for the S3 storage type as well as some bug fixes.
+
+##### Organization management for API Consumers
+Now API Consumers can [create organizations](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations) and securely share credentials between their teammates. In greater detail:
+- API Consumers can request to upgrade their account to an organizational account.
+- API Consumers can invite teammates to their organization and manage their roles.
+- API Consumers in the same organization share access credentials so that the API Consumer team will still have access to API credentials even if an admin user is on vacation or left the organization.
+- API Providers can configure whether they allow API consumers to request an upgrade to their accounts for an organizational account. 
+- API Providers can manually accept, reject or configure to accept all such request to accepted by default.
+ 
+##### Get started guides
+API Providers can add [Get started guides](/portal/api-products#documentation-only-products) to API Products for better developer experiences:
+- API Providers can add the **Get started guides** to API Products to speed-up onboarding of API Consumers.
+- API Providers can use HTML or Markdown editors for authoring content for API Consumers such as the Get started guides and blog posts.
+
+##### Tags for API Products and blog posts
+API Providers can select which blogs posts to display on an API Product page using [the tags feature](/portal/api-products#documentation-only-products). To achieve that, an API Provider can specify tags for both API Products and blog posts. Blog posts that match tags with an API Product are displayed in the 'Related blog content' section in the API Product page. This offers API Providers greater control over what blog posts to display on their API Product page.
+
+##### S3 support
+We added [S3 support](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_storage) for the portal assets storage (themes, images, OAS files). This update enhances the extensibility of our platform, allowing you to choose different storage solutions to better align with your specific needs.
+
+#### Download
+- [docker image to pull](https://hub.docker.com/layers/tykio/portal/v1.1/images/sha256-a5ef5360f5bea6433a3c6675707470a2e380257804c2cb033305da3b04c28ae7?context=explore)
+
+#### Changelog
+
+##### Added
+- Added the [organization management capability](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations) for API Consumers to safely share API access credentials between team members.
+- Added the [Get started guides](/portal/api-products#documentation-only-products) for API Products so that admins can explain to their consumers how use their API Products.
+- Added support for [S3 storage](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_storage) for the portal's assets storage. Now our customers can use `s3` storage in addition to the filesystem which is especially important in Kubernetes environments.
+- Added [tags](/portal/api-products#documentation-only-products) for API Products and blog posts so that API Providers have greater control over which blog posts to display on their API Product page.
+
+
+##### Fixed
+- Fixed a bug in the DCR flow where scopes from an API Product were not assigned to the OAuth2.0 client when creating a new OAuth2.0 client.
+- Fixed a bug with the bootstrap process to print _JWT_ instead of the portal's internal auth token when bootstrapping the portal.
+- Fixed a bug where plans and products were not removed for Tyk Dashboard instances that were disconnected from the portal instance. Subsequently, after this fix plans and products are only displayed for available Tyk Dashboard instances.
+
+
+
+## Further Information
+
+### Upgrading Tyk
+Please refer to the [upgrading Tyk](/developer-support/upgrading) page for further guidance with respect to the upgrade strategy.
+
+### FAQ
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
+
diff --git a/developer-support/release-notes/pump.mdx b/developer-support/release-notes/pump.mdx
new file mode 100644
index 0000000000..de7f5fefd4
--- /dev/null
+++ b/developer-support/release-notes/pump.mdx
@@ -0,0 +1,1398 @@
+---
+title: "Tyk Pump Release Notes"
+description: "Release notes documenting updates, enhancements and changes for Tyk Pump."
+keywords: "Tyk Pump, Release notes, changelog"
+sidebarTitle: "Tyk Pump"
+---
+
+**Open Source** ([Mozilla Public License](https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md))
+
+**This page contains all release notes for Tyk Pump displayed in reverse chronological order**
+
+## Support Lifetime
+
+Only the most recent Tyk Pump release is supported. We recommend staying current to minimise exposure to security vulnerabilities from third party dependencies.
+
+---
+
+## 1.16 Release Notes
+
+### 1.16.0 Release Notes
+
+#### Release Date 7 July 2026
+
+#### Release Highlights
+
+In this patch we fix inconsistencies in the application log format, introducing a `legacy` option for any users whose observability tooling relies on the specific format of those logs. We have also fixed a bug when using the Hybrid Pump and PostgreSQL.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.16.0).
+
+#### Breaking Changes
+
+**Changes to Tyk Pump application logs**
+
+This release makes [changes](#Changelog-v1.16.0) to the format of Tyk Pump application logs so that output is consistent with other Tyk components and aligned with industry observability standards.
+
+<Note>
+This is only a breaking change if you specifically rely on the current Tyk Pump log format: for example, if your monitoring, parsing, or alerting tools are built around the existing timestamp format or the `msg` log field.
+</Note>
+
+**Mitigation:** A new `legacy` option has been added to the [`log_format`](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#log_format) configuration. This setting preserves the format used prior to Pump 1.16.0, with the historical timestamp format and the `msg` field name.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      |
+| :-------------------------------------------------------- | :---------------- | :----------------------- | 
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x       | 13.x - 17.x              | 
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.4) | 6.x - 7.x, 8.x (up to 8.4) | 
+| [Valkey](https://valkey.io/download/)                     | 8.0.x, 8.1.x      | 7.2.x, 8.0.x, 8.1.x      |                            
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+For users currently on v1.15.0, we strongly recommend promptly upgrading to the latest release.
+
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.16.0](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.16.0)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.16.0
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.16.0)
+
+#### Changelog
+<a id="Changelog-v1.16.0" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+<Accordion title='Standardize application log format'>
+We have made changes to the format of Tyk Pump application logs to make them consistent with logs generated by other Tyk components and aligned with industry observability standards.
+
+- **RFC3339 timestamps:** Log entries now use the industry-standard RFC3339 timestamp format (e.g. `2024-12-12T13:59:08Z`), replacing the previous default `logrus` timestamp format.
+- **Log message field renamed:** The log message field is renamed from `msg` to `message`, for consistency with other Tyk components.
+
+**Configuration**
+
+The [`log_format`](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#log_format) configuration option now accepts three explicit values:
+ 
+- `text`: plain-text logs in the new format introduced in this release (**new default**).
+- `json`: JSON logs in the new format.
+- `legacy`: preserves the format used prior to Pump 1.16.0, with the historical timestamp format and the `msg` field name.
+ 
+This is a **breaking change** for any user whose monitoring or log-parsing tools rely on the specific format of the Tyk Pump application logs. If you require the previous timestamp format or the `msg` field name, you should set `log_format` to `legacy`.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+ 
+<Accordion title='Fix pre-aggregated analytics not being written to sharded PostgreSQL tables'>
+Resolved an issue when using the Hybrid Pump to store aggregated analytics in a sharded PostgreSQL database.
+
+Tyk Pump did not correctly write already-aggregated analytics to the correct date-specific (sharded) PostgreSQL table when table sharding was enabled. The date shard remained empty, errors were logged for the missing aggregate table, and Dashboard aggregate views such as *Activity by API* showed no traffic for the affected period.
+
+Tyk Pump now writes aggregated records to the relevant date shard, whether or not the base aggregate table exists. The previously recommended workaround of disabling analytics table sharding is no longer required.
+</Accordion>
+ 
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41889" target="_blank">CVE-2026-41889</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-2303" target="_blank">CVE-2026-2303</a>
+- <a href="https://osv.dev/vulnerability/GHSA-xmrv-pmrh-hhx2" target="_blank">GHSA-xmrv-pmrh-hhx2</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.15.0 Release Notes
+
+#### Release Date 19 May 2026
+
+#### Release Highlights
+
+Tyk Pump 1.15.0 introduces **MCP analytics support**, bringing full observability to [MCP Proxy](/ai-management/mcp-gateway/managing-proxies) traffic. MCP analytics records are captured and processed across MongoDB, PostgreSQL, Elasticsearch, and Prometheus backends, with no changes required to existing Pump configurations.
+
+This release also improves **Stdout Pump** output with cleaner, more readable JSON logs by properly formatting escaped characters in request and response fields.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.15.0).
+
+#### Breaking Changes
+
+**Stdout Pump JSON log formatting has changed by default**
+
+The **Stdout Pump** now outputs cleaner JSON logs. Newline (`\n`), tab (`\t`), and carriage return (`\r`) characters are no longer escaped in the `raw_request` and `raw_response` fields.
+
+Users whose log-processing pipelines, dashboards, or alerting rules rely on the previous escaped-character format will need to either update their tooling to handle the new format or set the new [`pumps.stdout.meta.use_legacy_payload_format`](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#pumps-stdout-meta-use_legacy_payload_format) option to `true` in their Pump configuration.
+
+
+When `pumps.stdout.use_legacy_payload_format: true`, the Stdout Pump output is identical to previous releases. When unset or set to `false`, the new clean formatting is applied.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | 
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x       | 13.x - 17.x              | 
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.4) | 6.x - 7.x, 8.x (up to 8.4) | 
+| [Valkey](https://valkey.io/download/)                     | 8.0.x, 8.1.x      | 7.2.x, 8.0.x, 8.1.x      |                            
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+For users currently on v1.14.1, we strongly recommend promptly upgrading to the latest release.
+
+In distributed deployments, MDCB 2.11.0 must be deployed before upgrading Pump to 1.15.0. Keep `enable_mcp_aggregation` set to `false` during the upgrade — only set it to `true` once MDCB, Pump, Gateway, and Dashboard are all on their new versions. Setting it before MDCB is upgraded will cause RPC failures and silent loss of MCP analytics data. See [MCP Gateway upgrade considerations](/developer-support/upgrading#mcp-upgrade-considerations) for the full enablement sequence.
+
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.15.0](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.15.0)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.15.0
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.15.0)
+
+#### Changelog
+<a id="Changelog-v1.15.0" data-scroll-offset></a>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Cleaner JSON formatting for Stdout Pump logs'>
+The **Stdout Pump** now outputs cleaner JSON logs, making the logs significantly easier to read and analyze. Newline (`\n`), tab (`\t`), and carriage return (`\r`) characters are no longer escaped in the `raw_request` and `raw_response` fields.
+
+This is a breaking change for any user whose downstream tooling depends on the original format. A new `pumps.stdout.use_legacy_payload_format` configuration option (default `false`) is available if you need to continue to use the previous escaped-character output..
+</Accordion>
+
+</AccordionGroup>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Add MCP analytics support'>
+This release adds support for the storing and processing of MCP (Model Context Protocol) Gateway analytics records:
+
+- **Storage backends**: MCP analytics records are supported across MongoDB, PostgreSQL, Elasticsearch, and Prometheus backends. Each record includes MCP-specific fields: `mcp_method`, `mcp_primitive_type`, `mcp_primitive_name`, and `mcp_error_code`.
+- **Hybrid Pump aggregation**: A new [`pumps.hybrid.meta.enable_mcp_aggregation`](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#pumps-hybrid-meta-enable_mcp_aggregation) configuration option on the Hybrid Pump enables pre-aggregation of MCP records before they are forwarded to the Control Plane, reducing data volume for high-traffic distributed deployments.
+- **Prometheus labels**: Three new Prometheus labels are emitted for MCP traffic: `mcp_method`, `mcp_primitive_type`, and `mcp_primitive_name`, aligned with the OpenTelemetry `mcp.*` semantic conventions. A new `mcp_only` filter restricts Prometheus output to MCP records exclusively.
+
+
+For details, see the [MCP analytics documentation](/ai-management/mcp-gateway/mcp-observability).
+</Accordion>
+
+</AccordionGroup>
+
+## 1.14 Release Notes
+
+### 1.14.1 Release Notes
+
+#### Release Date 20th April 2026
+
+#### Release Highlights
+
+In this release, we have updated Tyk Pump to Golang 1.25 and addressed CVEs for enhanced security and performance.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.14.1). 
+
+#### Breaking Changes
+
+This release has no breaking changes, however a misconfiguration that previously caused a silent failure is now surfaced and causes the Pump to crash on startup, see [known issues](#known-issues).
+
+#### Known Issues
+
+**Pump can crash on startup when using environment variables without setting `TYK_PMP_OMITCONFIGFILE=true`**
+
+Tyk Pump can be configured using either a configuration file or environment variables.
+
+When using environment variables it is important to set [`TYK_PMP_OMITCONFIGFILE=true`](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#omit_config_file). If this is not set, Pump will attempt to load the default configuration file (`tyk_pump.conf`).
+
+Prior to v1.14.1 if this file was missing, there was a silent failure from which Pump automatically recovered. With the update to Go 1.25, however, changes in the underlying libraries mean that the missing file will cause Pump to fail to start.
+
+Failing to set `TYK_PMP_OMITCONFIGFILE=true` when using environment variables is a misconfiguration and must be corrected.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | 
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x       | 13.x - 17.x              | 
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.4) | 6.x - 7.x, 8.x (up to 8.4) | 
+| [Valkey](https://valkey.io/download/)                     | 8.0.x, 8.1.x      | 7.2.x, 8.0.x, 8.1.x      |                            
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+For users currently on v1.14.0, we strongly recommend promptly upgrading to the latest release. 
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.14.1](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.14.1)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.14.1
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.14.1)
+
+#### Changelog
+<a id="Changelog-v1.14.1" data-scroll-offset></a>
+
+<AccordionGroup>
+
+<Accordion title='Updated Go version to 1.25'>
+Pump has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25679" target="_blank">CVE-2026-25679</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-32286" target="_blank">CVE-2025-32286</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27139" target="_blank">CVE-2026-27139</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32280" target="_blank">CVE-2026-32280</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32281" target="_blank">CVE-2026-32281</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32288" target="_blank">CVE-2026-32288</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32289" target="_blank">CVE-2026-32289</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32282" target="_blank">CVE-2026-32282</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32283" target="_blank">CVE-2026-32283</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.14.0 Release Notes
+
+#### Release Date 06 March 2026
+
+#### Release Highlights
+
+In this release, we've enhanced Tyk Pump's security capabilities by introducing support for custom CA certificates for Kafka, Elasticsearch, and Splunk pumps. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.14.0). 
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | 
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x       | 13.x - 17.x              | 
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.4) | 6.x - 7.x, 8.x (up to 8.4) | 
+| [Valkey](https://valkey.io/download/)                     | 8.0.x, 8.1.x      | 7.2.x, 8.0.x, 8.1.x      |                            
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+For users currently on v1.13.3, we strongly recommend promptly upgrading to the latest release. 
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.14.0](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.14.0)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.14.0
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.14.0)
+
+#### Changelog
+<a id="Changelog-v1.14.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='Enhance Pump Security with Custom CA Certificates'>
+You can now establish fully trusted and secure TLS connections from Tyk Pump to Kafka, Elasticsearch, and Splunk services that use certificates signed by specific Certificate Authorities.
+
+To configure this, set the path to the PEM file containing the CA certificate using the `ssl_ca_file` option or the `TYK_PMP_PUMPS_<PUMP_NAME>_META_SSLCAFILE` environment variable.
+</Accordion>
+
+</AccordionGroup>
+
+## 1.13 Release Notes
+
+### 1.13.3 Release Notes
+
+#### Release Date 12 February 2026
+
+#### Release Highlights
+
+In this release, we have fixed some priority CVEs. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.13.3). 
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | 
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x       | 13.x - 17.x              | 
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.2) | 6.x - 7.x, 8.x (up to 8.2) | 
+| [Valkey](https://valkey.io/download/)                     | 8.0.x, 8.1.x      | 7.2.x, 8.0.x, 8.1.x      |                            
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+For users currently on v1.13.2, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.13.2 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.13.3](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.13.3)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.13.3
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.13.3)
+
+#### Changelog
+<a id="Changelog-v1.13.3" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed CVEs reported in dependent libraries, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61726" target="_blank">CVE-2025-61726</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-61728" target="_blank">CVE-2025-61728</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68121" target="_blank">CVE-2025-68121</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.13.2 Release Notes
+
+#### Release Date 18 December 2025
+
+#### Release Highlights
+
+In this patch release, we've resolved SQL Pump schema migration issues for sharded tables. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.13.2).
+
+#### Breaking Changes
+
+No breaking changes. However, please note that first startup may be slower due to database schema migration if the new `migrate_sharded_tables` configuration is set. See changelog for details.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | 
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x       | 13.x - 17.x              | 
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.2) | 6.x - 7.x, 8.x (up to 8.2) | 
+| [Valkey](https://valkey.io/download/)                     | 8.0.x, 8.1.x      | 7.2.x, 8.0.x, 8.1.x      |                            
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+For further information, please check the [changelog](#Changelog-v1.13.2) below.
+
+#### Upgrade instructions
+
+For users currently on v1.13.1, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.13.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.13.2](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.13.2)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.13.2
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.13.2)
+
+#### Changelog
+<a id="Changelog-v1.13.2" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fixed SQL Pump table sharding schema migration issues'>
+Fixed an issue when using table sharding with the SQL pumps (creating new tables for each day), where the Pump would generate error messages in the application logs due to missing columns in the tables. This would only occur when upgrading to a newer version of Pump that added columns (e.g., to Pump 1.11.0, which added some GraphQL-related columns). Now, when Pump is upgraded, the current day's table will automatically be updated to include the new columns, so the error messages will not be generated.
+
+We have added a new configuration option `migrate_sharded_tables`, which will update all pre-existing tables in the SQL database to match the latest schema. This will be a one-time operation when the Pump starts up, but could take some time to complete if there is a large history in the database, so it has been made an optional activity via this configuration option.
+</Accordion>
+
+</AccordionGroup>
+
+
+### 1.13.1 Release Notes
+
+#### Release Date 27 November 2025
+
+#### Release Highlights
+
+In this patch release, we fixed high-priority CVEs. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.13.1).
+
+#### Breaking Changes
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | 
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x       | 13.x - 17.x              | 
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.2) | 6.x - 7.x, 8.x (up to 8.2) | 
+| [Valkey](https://valkey.io/download/)                     | 8.0.x, 8.1.x      | 7.2.x, 8.0.x, 8.1.x      |                            
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+For further information, please check the [changelog](#Changelog-v1.13.1) below.
+
+#### Upgrade instructions
+
+For users currently on v1.13.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.13.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.13.1](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.13.1)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.13.1
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.13.1)
+
+#### Changelog
+<a id="Changelog-v1.13.1" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Fixed the following high-priority CVEs, providing increased protection against security
+vulnerabilities:
+
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-47912" target="_blank">CVE-2025-47912</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58183" target="_blank">CVE-2025-58183</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58185" target="_blank">CVE-2025-58185</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58186" target="_blank">CVE-2025-58186</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58187" target="_blank">CVE-2025-58187</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58188" target="_blank">CVE-2025-58188</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-58189" target="_blank">CVE-2025-58189</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61723" target="_blank">CVE-2025-61723</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61724" target="_blank">CVE-2025-61724</a>
+- <a href="https://www.cve.org/CVERecord?id=CVE-2025-61725" target="_blank">CVE-2025-61725</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.13.0 Release Notes
+
+#### Release Date 29 October 2025
+
+#### Breaking Changes
+
+This release has no breaking changes, but does include the deprecation of two global configuration options ([DecodeRawRequest](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#raw_request_decoded) and [DecodeRawResponse](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#raw_response_decoded)) that did not previously work. There is no change to functionality from these deprecations.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | 
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x       | 13.x - 17.x              | 
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.2) | 6.x - 7.x, 8.x (up to 8.2) | 
+| [Valkey](https://valkey.io/download/)                     | 8.0.x, 8.1.x      | 7.2.x, 8.0.x, 8.1.x      |                            
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+Deprecated the global configuration options [DecodeRawRequest](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#raw_request_decoded) and [DecodeRawResponse](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#raw_response_decoded).
+For further information, please check the [changelog](#Changelog-v1.13.0) below.
+
+#### Upgrade instructions
+
+For users currently on v1.12.2, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.12.2 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.13.0](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.13.0)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.13.0
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.13.0)
+
+#### Changelog
+<a id="Changelog-v1.13.0" data-scroll-offset></a>
+
+##### Changed
+
+
+
+<Expandable title='Deprecated payload decoding global configuration options'>
+We have deprecated the global `DecodeRawRequest` and `DecodeRawResponse` configuration options, which were never correctly implemented and led to confusion when combined with the Pump-specific options. Now, if you want a Pump to decode the base64 encoded request and/or response payloads when transferring traffic logs to your data sink, you should set the options in the configuration for that Pump.
+</Expandable>
+
+
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Added support for encrypted Kinesis streams in Pump'>
+Added support for server-side encryption in the Kinesis Pump by introducing a new configuration option [TYK_PMP_PUMPS_KINESIS_META_KMSKEYID](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#pumps-kinesis-meta-kmskeyid) that allows users to specify an AWS KMS key for encrypting data at rest in Kinesis Data Streams.
+
+This enhancement enables compliance with strict regulatory requirements and security needs by automatically encrypting data before it's written to Kinesis storage and decrypting it when retrieved. The feature is backward compatible, with server-side encryption disabled by default for existing deployments.
+</Accordion>
+
+<Accordion title='Added "Latency.Total" and "Latency.Upstream" fields to InfluxDB2 Pump'>
+Added two new fields to the traffic logs transferred using the InfluxDB2 pump. 
+
+1. `Latency.Total`: Represents the total time taken to process a request.
+2. `Latency.Upstream`: Represents the time taken to communicate with the upstream.
+
+These metrics can be used to calculate the Gateway processing time (`Latency.Total` - `Latency.Upstream`), which is essential for monitoring API performance and diagnosing bottlenecks. This enhancement enables customers to perform comprehensive latency analysis and identify performance bottlenecks in their API infrastructure.
+</Accordion>
+
+<Accordion title='Added "batchbytes" configuration option for Kafka pump'>
+Added a new configuration option [TYK_PMP_PUMPS_KAFKA_META_BATCHBYTES](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#pumps-kafka-meta-batch_bytes) to the Kafka pump that allows users to configure the maximum size (in bytes) of a batch before it is sent to a Kafka partition. 
+
+This enhancement resolves issues where batched analytics data exceeded Kafka's default 1MB message size limit, causing "Message Size Too Large" errors and resulting in missing analytics data. Users can now optimize the batch size to match their Kafka topic configurations, with backward compatibility maintained through the default 1MB limit.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+## 1.12 Release Notes
+
+### 1.12.2 Release Notes
+
+#### Release 15th October 2025
+
+#### Release Highlights
+
+This release strengthens Tyk Pump's security foundation with updates, including an upgrade to Golang 1.24 for enhanced runtime security and the resolution of two CVEs (CVE-2025-22871 and CVE-2025-22869), ensuring robust protection against identified security vulnerabilities.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.12.2) below.
+
+#### Breaking Changes
+This release has no breaking changes
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      | Comments                   |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | :-------------------------- |
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 | Used by Tyk Pump and Tyk Dashboard      |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x    | 13.x - 17.x              | Used by Tyk Pump and Tyk Dashboard      |
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.2) | 6.x - 7.x, 8.x (up to 8.2) | Used by all Tyk components |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v1.12.1, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.12.1 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.12.2](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.12.2)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.12.2
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.12.2)
+
+#### Changelog
+<a id="Changelog-v1.12.2" data-scroll-offset></a>
+
+##### Changed
+
+
+
+<Expandable title='Upgrade Tyk Pump to Golang 1.24'>
+Tyk Pump has been upgraded to [Golang 1.24](https://tip.golang.org/doc/go1.24), improving security by staying current with the latest Go versions.
+</Expandable>
+
+
+
+##### Security Fixes
+
+
+
+<Expandable title='High priority CVEs fixed'>
+Fixed the following high-priority CVEs identified in Tyk Pump, providing increased protection against security vulnerabilities:<br />
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-22871" target="_blank">CVE-2025-22871</a><br />
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-22869" target="_blank">CVE-2025-22869</a>
+</Expandable>
+
+
+
+
+### 1.12.1 Release Notes
+
+#### Release Date 18 August 2025
+
+#### Release Highlights
+
+This release improves log reliability in the Syslog Pump by ensuring that raw request and response data are no longer fragmented into multiple entries. Logs are now consolidated into a single entry per API request, making analysis easier while preserving compatibility with existing log parsers.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.12.1) below.
+
+#### Breaking Changes
+This release has no breaking changes
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      | Comments                   |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | :-------------------------- |
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 | Used by Tyk Pump and Tyk Dashboard      |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x    | 13.x - 17.x              | Used by Tyk Pump and Tyk Dashboard      |
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.2) | 6.x - 7.x, 8.x (up to 8.2) | Used by all Tyk components |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v1.12.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.12.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.12.1](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.12.1)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.12.1
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.12.1)
+
+#### Changelog
+<a id="Changelog-v1.12.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='Consolidated Syslog Log Entries'>
+Resolved an issue in the Syslog Pump where enabling `Decode Raw Request` and `Decode Raw Response` caused log entries to fragment into multiple messages due to unescaped newline characters. The fix ensures a single consolidated log entry by escaping newlines (\n) in raw request and response fields, maintaining backward compatibility with existing log parsers.
+</Expandable>
+
+
+
+
+### 1.12.0 Release Notes
+
+#### Release Date 28 March 2025
+
+#### Release Highlights
+
+This release enhances Pump's database compatibility and security by adding support for PostgreSQL 17, removing SQLite support, and addressing critical security vulnerabilities (CVEs). These improvements ensure better performance, long-term stability, and overall enhanced security.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.12.0) below.
+
+#### Breaking Changes
+This release removes support for SQLite in Pump, aligning with the broader removal of SQLite from the Tyk Dashboard. This change improves compatibility with enterprise environments and addresses implementation issues related to SQLite.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated below.
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      | Comments                   |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | :-------------------------- |
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 | Used by Tyk Pump and Tyk Dashboard      |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 13.x - 17.x    | 13.x - 17.x              | Used by Tyk Pump and Tyk Dashboard      |
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0         | 6.x - 7.x                | Used by all Tyk components |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v1.11.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.11.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.12.0](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.12.0)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.12.0
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.12.0)
+
+#### Changelog
+<a id="Changelog-v1.12.0" data-scroll-offset></a>
+
+##### Changed
+
+
+
+
+<Expandable title='Support for PostgreSQL 17'>
+Pump now supports PostgreSQL 17, ensuring compatibility with the latest database version.
+</Expandable>
+
+
+
+<Expandable title='Removal of SQLite Support in Pump'>
+SQLite support has been fully removed from Pump.
+</Expandable>
+
+
+
+
+
+##### Security Fixes
+
+
+<Expandable title='Fixed the following CVE'>
+- [GHSA-v778-237x](https://github.com/advisories/GHSA-v778-237x-gjrc)
+</Expandable>
+
+
+
+---
+
+## 1.11 Release Notes
+
+### 1.11.2 Release Notes
+
+#### Release Date 10 January 2025
+
+#### Release Highlights
+
+This patch release focuses on improving the robustness of SQL-Pump in scenarios involving table sharding and analytics data, ensuring smoother operations and better compatibility with PostgreSQL-based environments.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated below.
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      | Comments                   |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | :-------------------------- |
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 | Used by Tyk Pump and Tyk Dashboard      |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 12.x - 16.x    | 12.x - 16.x              | Used by Tyk Pump and Tyk Dashboard      |
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0         | 6.x - 7.x                | Used by all Tyk components |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v1.11.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.11.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.11.2](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.11.2)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.11.2
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.11.2)
+
+#### Changelog
+  
+##### Fixed
+
+
+
+<Expandable title='SQL-Pump Crashes When `tablesharding=true` and Analytics Are Skipped for Certain APIs'>
+The issue causing a runtime error when writing analytics data for skipped APIs has been addressed. SQL-Pump now processes these scenarios gracefully, ensuring stability in table-sharded configurations.
+</Expandable>
+
+
+
+<Expandable title='Indices Not Created in Sharded `tyk_analytics` Tables if Indices with Same Names Exist in Earlier Tables'>
+Fixed the index creation logic to ensure indices are generated correctly for all sharded tables, regardless of whether indices with the same names exist in earlier tables. This ensures proper query performance and data integrity in environments with table sharding.
+</Expandable>
+
+
+ 
+---
+
+### 1.11.1 Release Notes
+
+#### Release Date 04 December 2024
+
+#### Release Highlights
+
+This patch release focuses on critical dependency updates to address security vulnerabilities and maintain compatibility with the latest tools. Users are encouraged to upgrade to benefit from enhanced security and improved stability.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated below.
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      | Comments                   |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | :-------------------------- |
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 | Used by Tyk Dashboard      |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 12.x - 16.x    | 12.x - 16.x              | Used by Tyk Dashboard      |
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0         | 6.x - 7.x                | Used by all Tyk components |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v1.11.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.11.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker Image v1.11.1](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.11.1)
+  - ```bash
+    docker pull tykio/tyk-pump-docker-pub:v1.11.1
+    ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.11.1)
+
+#### Changelog
+  
+##### Changed
+
+
+
+<Expandable title='Upgraded Golang to v1.22.7'>
+Updated to the [Go v1.22.7](https://go.dev/doc/devel/release#go1.22) to leverage its performance improvements, bug fixes, and security patches.
+</Expandable>
+
+
+
+##### Security Fixes
+- Fixed the following CVEs:
+    - [GHSA-7jwh-3vrq-q3m8](https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8)
+    - [GHSA-mrww-27vc-gghv](https://github.com/advisories/GHSA-mrww-27vc-gghv)
+    - [GO-2024-2611](https://pkg.go.dev/vuln/GO-2024-2611)
+ 
+---
+
+### 1.11.0 Release Notes
+
+#### Release Date 13 August 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated below.
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      | Comments                   |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | :-------------------------- |
+| [GoLang](https://go.dev/dl/)                              | 1.19, 1.20, 1.21  | 1.19, 1.20, 1.21         | All our binaries           |
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 | Used by Tyk Dashboard      |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 12.x - 16.x    | 12.x - 16.x              | Used by Tyk Dashboard      |
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0         | 6.x - 7.x                | Used by all Tyk components |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+
+There are no deprecations in this release.
+
+#### Upgrade instructions
+
+For users currently on v1.10.X, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 1.10 and proceed directly to this latest release.
+
+#### Release Highlights
+
+##### Security fixes
+This release focuses on improving security and compliance, enhancing integration capabilities, and ensuring robust performance in secure environments.
+
+#### Downloads
+- [Docker Image v1.11.0](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.11)
+- ```bash
+  docker pull tykio/tyk-pump-docker-pub:v1.11.0
+  ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.11.0)
+
+#### Changelog
+
+
+##### Added
+
+
+
+<Expandable title='Add Kinesis backend support'>
+Tyk Pump now supports Kinesis as a backend to push analytics to a data lake efficiently.
+</Expandable>
+
+
+
+
+---
+
+## 1.10 Release Notes
+
+### Release Date 3 July 2024
+
+### Breaking Changes
+This release has no breaking changes.
+
+### Dependencies
+
+#### 3rd Party Dependencies & Tools
+
+With PostgreSQL v11 reaching [EOL](https://www.postgresql.org/support/versioning/) in November 2023, we can no longer guarantee full compatibility with this version of the database. If you are [using PostgreSQL](/planning-for-production/database-settings#postgresql) we recommend that you upgrade to a version that we have tested with, as indicated below.
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      | Comments                   |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | :-------------------------- |
+| [GoLang](https://go.dev/dl/)                              | 1.19, 1.20, 1.21  | 1.19, 1.20, 1.21         | All our binaries           |
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 | Used by Tyk Dashboard      |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 12.x - 16.x    | 12.x - 16.x              | Used by Tyk Dashboard      |
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.2) | 6.x - 7.x, 8.x (up to 8.2) | Used by all Tyk components |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+### Deprecations
+
+There are no deprecations in this release.
+
+### Upgrade instructions
+
+For users currently on v1.9.X, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 1.9 and proceed directly to this latest release.
+
+### Release Highlights
+
+#### FIPS Compliance
+
+Tyk Pump now offers [FIPS 140-2](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf) compliance. For further details please consult [Tyk API Management FIPS support](/developer-support/release-types/fips-release)
+
+#### Security fixes
+This release focuses on improving security and compliance, enhancing integration capabilities, and ensuring robust performance in secure environments.
+
+### Downloads
+- [Docker Image v1.10.0](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.10)
+- ```bash
+  docker pull tykio/tyk-pump-docker-pub:v1.10.0
+  ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.10.0)
+
+### Changelog
+
+#### Added
+
+
+
+<Expandable title='Added FIPS compliance'>
+Added [FIPS compliance](/developer-support/release-types/fips-release) for Tyk Pump.
+</Expandable>
+
+
+
+
+#### Fixed
+
+
+
+<Expandable title='Fixed Tyk Pump Splunk Integration using http_proxy and https_proxy Environment Variables'>
+Resolved an issue where `http_proxy` and `https_proxy` environment variables were not being respected in the Tyk Pump pod for Splunk connections.
+</Expandable>
+
+
+
+
+#### Security Fixes
+
+
+
+<Expandable title='Fixed the following CVEs'>
+
+PRISMA-2021-0108
+PRISMA-2023-0056
+[CVE-2024-27304](https://nvd.nist.gov/vuln/detail/CVE-2024-27304)
+[CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
+
+</Expandable>
+
+
+
+---
+
+## 1.9 Release Notes
+
+### Release Date 5 Apr 2024
+
+### Breaking Changes
+
+#### Attention: Please read this section carefully
+
+MongoDB v4.4 will reach its [end of life support](https://www.mongodb.com/legal/support-policy/lifecycles) at the end of February 2024. In order to support newer versions of MongoDB and align with newer versions of Tyk, we have changed the default MongoDB driver from [mgo](https://github.com/go-mgo/mgo) to [mongo-go](https://github.com/mongodb/mongo-go-driver). The `mongo-go` driver supports MongoDB versions greater or equal to v4. **If you are using a version of MongoDB less than v4, please [follow this guide](https://github.com/TykTechnologies/tyk-pump#driver-type) to update the driver type to `mgo`.**
+
+Users are strongly advised to follow the recommended [upgrade instructions](#upgrading-tyk) provided by Tyk before applying any updates.
+
+### Dependencies
+
+#### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                    | Tested Versions   | Compatible Versions      | Comments                   |
+| :--------------------------------------------------------- | :----------------- | :------------------------ | :-------------------------- |
+| [GoLang](https://go.dev/dl/)                              | 1.19, 1.20, 1.21  | 1.19, 1.20, 1.21         | All our binaries           |
+| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, and 7.0 | 4.4.x, 5.x, 6.x, and 7.0 | Used by Tyk Dashboard      |
+| [PostgreSQL](https://www.postgresql.org/download/)        | 11.x - 15.x LTS   | 11.x - 15.x              | Used by Tyk Dashboard      |
+| [Redis](https://redis.io/download/)                       | 6.x - 7.0, 8.x (up to 8.2) | 6.x - 7.x, 8.x (up to 8.2) | Used by all Tyk components |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+### Deprecations
+
+There are no deprecations in this release.
+
+### Upgrade instructions
+
+For users currently on v1.8.X, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 1.8 and proceed directly to this latest release.
+
+### Release Highlights
+
+#### Redis 7 and storage library
+
+Tyk Pump now supports Redis v7, utilizing our [storage library v1.2.0](https://github.com/TykTechnologies/storage).
+
+#### MongoDB Driver
+
+As of v1.9, the default MongoDB driver has been changed from `mgo` to `mongo-go`.
+
+#### AWS Simple Queue Service Support
+
+Thanks to a community contribution by [masoudhaghbin](https://github.com/masoudhaghbin), Tyk Pump can now pump logs to an AWS SQS instance.
+
+#### Tyk Graph Pump
+
+There has been a significant enhancement in Tyk Graph Pump with the removal of the dependency on the `enable_detailed_recording` setting. This change is designed to streamline operations, reduce storage requirements and enhance overall performance in production environments. By decoupling detailed recording from specific configuration options, Tyk Graph Pump now provides greater flexibility and control over data storage.
+
+
+### Downloads
+- [Docker Image v1.9.0](https://hub.docker.com/r/tykio/tyk-pump-docker-pub/tags?page=&page_size=&ordering=&name=v1.9.0)
+- ```bash
+  docker pull tykio/tyk-pump-docker-pub:v1.9.0
+  ```
+- Source code tarball for OSS - [GH Tyk Pump Repo](https://github.com/TykTechnologies/tyk-pump/releases/tag/v1.9.0)
+
+### Changelog
+
+#### Added
+
+
+
+<Expandable title='Redis 7 Support'>
+Tyk Pump now support Redis v7 utilizing our [storage library v1.2.0](https://github.com/TykTechnologies/storage).
+</Expandable>
+
+
+<Expandable title='Added AWS Simple Queue Service pump support'>
+Pump can now send logs to an Amazon SQS instance. This was a [community contribution](https://github.com/TykTechnologies/tyk-pump/pull/740) co-authored by [masoudhaghbin](https://github.com/masoudhaghbin). Please follow [this guide](https://github.com/TykTechnologies/tyk-pump#SQS-config) to set up an SQS pump.
+</Expandable>
+
+
+
+
+#### Changed
+
+
+
+<Expandable title='Updated Go version to v1.21'>
+Tyk Pump now uses Go v1.21
+</Expandable>
+
+
+
+<Expandable title='Resurface Pump Updated'>
+The Resurface Pump has been updated with the [following improvements](https://github.com/TykTechnologies/tyk-pump/pull/731).
+
+- Upgrade `logger-go` dependency to version 3.3.1, which includes improvements in goroutine management, as well as a new `Stop` method for graceful shutdown.
+- Add support for async data writing, by adding a bounded channel to buffer data records and process them concurrently in the background.
+- Add `Shutdown` method for graceful shutdown of `ResurfacePump` backend.
+
+Thanks to community member [Ramón Márquez](https://github.com/monrax) for updating this pump.
+</Expandable>
+
+
+ 
+#### Fixed
+
+
+
+<AccordionGroup>
+<Accordion title='Added backoff retry mechanism for Splunk Pump'>
+Tyk Pump now has an expontential backoff retry mechanism for sending logs to Splunk. This mechanism mitigates the chance of losing logs if Pump should fail to send logs to Splunk. This fixes a bug where Splunk responses were not being checked correctly and fixes a bug where Pump was not closing connections after receiving responses.
+</Accordion>
+
+<Accordion title='Added a field so that GraphQL aggregated analytics will display correctly for SQL databases'>
+For SQL databases, the GraphQL aggregated analytics record will now have a new `api_value` field so that analytics will be shown in the Dashboard correctly.
+</Accordion>
+
+<Accordion title='Environment variables TYK_PMP_PUMPS_AGGREGATE_* now correctly correspond to definitions in pump.conf'>
+Fixed a bug where any `TYK_PMP_PUMPS_AGGREGATE_*` environment variables didn't correctly correspond to definitions in the pump.conf file.
+</Accordion>
+
+<Accordion title='Added an api_id field so that GraphQL aggregated analytics will display correctly'>
+For SQL databases, the GraphQL aggregated analytics record will now have a new `api_id` field so that analytics will be shown in the Dashboard correctly.
+</Accordion>
+
+<Accordion title='Fixed a bug where Tyk Pump could not connect to Redis Sentinel when TLS is enabled'>
+Fixed a bug causing Tyk Pump not to connect when Redis Sentinel was deployed using TLS.
+</Accordion>
+</AccordionGroup>
+
+
+
+#### Security Fixes
+
+
+
+<Expandable title='Fixed the following CVEs'>
+
+
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-39325">CVE-2022-39325</a>
+
+
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-3978">CVE-2022-3978</a>
+
+
+</Expandable>
+
+
+
+#### Community Contributions
+
+Special thanks to the following members of the Tyk community for their contributions to this release:
+
+
+
+<Expandable title='Added Simple Queue Service pump support'>
+Pump can now [send logs](https://github.com/TykTechnologies/tyk-pump/pull/740) to an Amazon SQS instance.
+Thanks to [masoudhaghbin](https://github.com/masoudhaghbin) for creating this pump. Please follow [this guide](https://github.com/asdf) to set up an SQS pump.
+</Expandable>
+
+
+
+
+<Expandable title='Resurface Pump Updated'>
+The Resurface Pump has been updated with the [following improvements](https://github.com/TykTechnologies/tyk-pump/pull/731).
+
+- Upgrade `logger-go` dependency to version 3.3.1, which includes improvements in goroutine management, as well as a new `Stop` method for graceful shutdown.
+- Add support for async data writing, by adding a bounded channel to buffer data records and process them concurrently in the background.
+- Add `Shutdown` method for graceful shutdown of `ResurfacePump` backend.
+
+Thanks to community member [Ramón Márquez](https://github.com/monrax) for updating this pump.
+</Expandable>
+
+
+
+---
+
+## 1.8 Release Notes
+
+### 1.8.3 Release Notes
+
+#### Changelog
+
+##### Fixed
+- Corrected configuration for _pumps.kafka.meta.timeout_ to be interpreted as the number of seconds (_Type: int_) instead of a duration requiring a unit (_Type: Duration_).
+- Fixed an issue where _Graph SQL Pump_ couldn't restart correctly when analytics storage table name was changed in Pump config. Some relations were not torn down and migrated correctly.
+
+### 1.8.2 Release Notes
+
+#### Changelog
+
+##### Fixed
+- Resolved performance issue where _SQL Aggregate_ analytics failed to load on the _Dashboard_ during heavy traffic by introducing a new index on the _sql_aggregate_ Pump called _idx_dimension_.
+- Fixed _Prometheus Pump_ crashes on non UTF-8 URLs by updating to _prometheus-client_ v1.16.
+- Fixed _MongoDB_ connection string issues related to certain characters ("?" and "@"), recommending URL-encoded values in usernames and passwords. This ensures compatibility with both _mgo_ and _mongo-go_ drivers.
+- Fixed security vulnerabilities: _CVE-2022-36640_, _CVE-2022-21698_, _GO-2022-0322_ and _GHSA-cg3q-j54f-5p7p_.
+
+##### Added
+- Add `track_all_paths` configuration for _Prometheus Pump_. If enabled, all APIs will have path in the `tyk_http_status_per_path` metric. Otherwise, only endpoint that have "track" plugin set with have path shown in the metric. Endpoints without “track” plugin set will have “unknown” path shown in the metric.
+
+##### Updated
+- Improved security by obfuscating _Mongo Pump_ credentials in log outputs.
+
+### 1.8.1 Release Notes
+
+
+<Note>
+#### Notes on MongoDB v5 and v6 compatibility
+
+For MongoDB v5 and v6 users, please [set mongo driver type](https://github.com/TykTechnologies/tyk-pump#driver-type) to `mongo-go`.
+
+From pump v1.8.1, the default MongoDB driver it uses is [mgo](https://github.com/go-mgo/mgo). This is to align with the default MongoDB driver of other Tyk components. This driver supports MongoDB versions up to v4. If you are using a later version of MongoDB v5 or MongoDB v6, please [follow this guide to update the driver type](https://github.com/TykTechnologies/tyk-pump#driver-type) to [mongo-go](https://github.com/mongodb/mongo-go-driver).
+</Note>
+
+
+#### Changelog
+
+##### Fixed
+- GraphQL analytics records were being excluded from the _tyk_analytics_ collection for Mongo Pump. This has been fixed so that GraphQL analytic records are now included as expected.
+- Fixed MongoDB connection issue when using a password with URL escape characters (with mongo-go driver)
+- Fixed an issue in Prometheus pump when filtering fields , e.g. _API Name_, that contain `--` in their value. For example, `test--name`. Prometheus Pump filtered the field as two separate instances, e.g. `test` & `name`, instead of the expected `test--name`.
+- When [`omit_configfile`](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#omit_config_file) is set to `true`, Pump will not try to load the config file and spit out error logs
+
+##### Updated
+- Updated the default Hybrid Pump RPC pool size from 20 to 5 connections in order to reduce default CPU and memory footprint. See [Pump configurations](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#pumps-hybrid-meta-rpcpoolsize)
+- Import and use latest [storage library v1.0.5](https://github.com/TykTechnologies/storage/releases/tag/v1.0.5)
+- Updated default MongoDB driver to `mgo`. [Follow this guide to update the driver type](https://github.com/TykTechnologies/tyk-pump#driver-type)
+- Pump name is now case-insensitive. It will override two or more pumps with the same name but in different cases (e.g. _Mongo_ / _mongo_)
+
+
+### 1.8.0 Release Notes
+Release date: 2023-05-04
+
+#### Major features
+Pump 1.8 introduces two new pumps: The GraphQL SQL Aggregate Pump - which allows you to transfer GraphQL transaction logs to SQL; and Resurface Pump - which allows you to transfer data to [Resurface.io](http://resurface.io/) for context based security analysis. 
+
+We have changed the default MongoDB driver from [mgo](https://github.com/go-mgo/mgo) to [mongo-go](https://github.com/mongodb/mongo-go-driver). The new driver supports MongoDB versions greater or equal to v4. If you are using older version of MongoDB v3.x, please [follow this guide to update the driver type](https://github.com/TykTechnologies/tyk-pump#driver-type).
+
+We have also added a config option that allow you to decode the raw requests and responses for all pumps so you don't need to worry about processing them in your data pipeline. For demo mode, there is now an option to generate future data for your convenience.
+
+In this release, we are using a new Tyk storage library to connect to Mongo DB. This would allow us to switch to use the official Mongo Driver very easily in the future.
+
+
+<Note>
+#### Notes on MongoDB v3.x compatibility
+
+In 1.8.0, the default MongoDB driver it use is [mongo-go](https://github.com/mongodb/mongo-go-driver). This driver supports MongoDB versions greater or equal to v4. If you are using older version of MongoDB v3.x, please [follow this guide to update the driver type](https://github.com/TykTechnologies/tyk-pump#driver-type).
+</Note>
+
+
+#### Changelog
+
+##### Added
+- Added GraphQL SQL Aggregate Pump.
+- Added Resurface Pump - Resurface can provide context-based security analysis for attack and failure triage, root cause, threat and risk identification based on detailed API logs sent from Tyk Pump.
+- Add config option raw_request_decoded and raw_response_decoded for decoding from base64 the raw requests/responses fields before writing to Pump. This is useful if you want to search for specific values in the raw request/response. Both are disabled by default. This setting is not available for Mongo and SQL pumps, since the dashboard will decode the raw request/response.
+- Add the ability to generate future data in demo mode using --demo-future-data flag. 
+- Remove critical CVE go.uuid vulnerability 
+- Use the latest Tyk storage library to connect to Mongo 
+- Hybrid Pump refactoring - we now have better RPC connection control, testability, and documentation 
+
+##### Fixed
+- Std pump does not log accurate time when set to json format 
+- GraphPump doesn’t include names of queries/mutation and subscriptions called 
+- Mongo Pump’s connection hangs forever if misconfigured 
+
+## Further Information
+
+### Upgrading Tyk
+
+Please refer to the [upgrading Tyk](/developer-support/upgrading) page for further guidance on the upgrade strategy.
+
+### FAQ
+
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
diff --git a/developer-support/release-notes/sync.mdx b/developer-support/release-notes/sync.mdx
new file mode 100644
index 0000000000..62a10e5240
--- /dev/null
+++ b/developer-support/release-notes/sync.mdx
@@ -0,0 +1,999 @@
+---
+title: "Tyk Sync Release Notes"
+description: "Release notes documenting updates, enhancements, fixes and changes for Tyk Sync."
+keywords: "Tyk Sync, Release notes, changelog"
+sidebarTitle: "Tyk Sync"
+---
+
+**Licensed Protected Product**
+
+**This page contains all release notes for Tyk Sync displayed in reverse chronological order**
+
+## Support Lifetime
+Only the most recent Tyk Sync release is supported. We recommend staying current to minimise exposure to security vulnerabilities from third party dependencies.
+
+---
+
+<Note>
+**Note on Tyk Sync version 2.2.1**  
+
+Tyk Sync 2.1.1 was accidentally also released to [DockerHub](https://hub.docker.com/layers/tykio/tyk-sync/v2.2.1/images/sha256-cf21fef955add971a9bdfeadd2674fc1f22fbee2d0bf12dab38a78bfae5b7716) as Tyk Sync v2.2.1.
+<br />That version should not be used.
+<br />We recommend the most recent version of Tyk Sync, which is first in the following list.
+</Note>
+
+## 2.2 Release Notes
+
+### 2.2.0 Release Notes
+
+#### Release Date 8 July 2026
+
+#### Release Highlights
+
+In this release, we have added support for the Client Identity Provider (IdP) registry, introduced in [Tyk 5.14.0](/developer-support/release-notes/dashboard#5-14-0-release-notes). This feature provides centralized management of IdPs and scope-to-policy mappings used with [JWT Auth](/basic-config-and-security/security/authentication-authorization/json-web-tokens). Adding support to Tyk Sync allows GitOps management of the new Client IdP resource.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.2.0) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.1.8, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 2.1.8 and proceed directly to this latest release.
+
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.2.0](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.2.0)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.2.0
+    ```
+
+#### Changelog
+<a id="Changelog-v2.2.0" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+<Accordion title='Add Client IdP resource support to dump, publish, and sync operations'>
+Tyk Sync can now manage Client IdP registry entries as a first-class resource, alongside APIs, policies, and other assets.
+
+- `tyk-sync dump` now exports each Client IdP registry resource to its own `clientidp-{id}.json` file and records them under a new `client_idps` section in `.tyk.json`, with an optional `--idps` flag to export a specific subset.
+- `tyk-sync publish` (and `update`) recreates them on Tyk Dashboard.
+- `tyk-sync sync` reconciles the full create, update, and delete lifecycle.
+
+Required fields (`org_id`, `name`, and `jwks_uri`) are validated before any request is sent, and Tyk Dashboard versions that do not support the Client IdP registry are handled gracefully so existing workflows continue to run unchanged.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+<Accordion title='Fix MCP policy fields being omitted during policy dump'>
+Resolved an issue where policies using Model Context Protocol (MCP) access control and rate limiting were not fully exported by `tyk-sync dump`, causing the `mcp_primitives`, `mcp_access_rights`, `json_rpc_methods`, and `json_rpc_methods_access_rights` fields to be silently dropped from the dumped definition.
+
+Tyk Sync now preserves these MCP and JSON-RPC method fields, so policies can be dumped and synced without losing their MCP usage limits or primitive-based access rules.
+
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-41506" target="_blank">CVE-2026-41506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+
+## 2.1 Release Notes
+
+### 2.1.8 Release Notes
+
+#### Release Date 21 May 2026
+
+#### Release Highlights
+This release refreshes the embedded Tyk Classic, Tyk OAS API, and Policy definitions so that all fields introduced in Tyk Gateway 5.13.0 are correctly transferred during sync operations. It also ensures compatibility with the most recent Tyk LTS release [5.8.14](/developer-support/release-notes/dashboard#5-8-14-release-notes).
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.1.8) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.1.7, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 2.1.7 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.1.8](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.1.8)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.1.8
+    ```
+
+#### Changelog
+<a id="Changelog-v2.1.8" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fix Tyk OAS API and Policy fields being silently stripped during sync'>
+Resolved an issue where elements of Tyk OAS APIs and Policies introduced in newer Tyk Gateway releases were not transferred by Tyk Sync, causing those fields to be silently nulled when deploying the same definitions that work when posted directly to the Dashboard. Tyk Sync now includes the latest Tyk Classic, Tyk OAS API, and Policy definitions aligned with Tyk Gateway 5.13.0, so all supported fields are correctly preserved end-to-end.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+
+Addressed the following CVEs, providing increased protection against security 
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33811" target="_blank">CVE-2026-33811</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39820" target="_blank">CVE-2026-39820</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39836" target="_blank">CVE-2026-39836</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42499" target="_blank">CVE-2026-42499</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39823" target="_blank">CVE-2026-39823</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39826" target="_blank">CVE-2026-39826</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39825" target="_blank">CVE-2026-39825</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-45022" target="_blank">CVE-2026-45022</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 2.1.7 Release Notes
+
+#### Release Date 23 April 2026
+
+#### Release Highlights
+Tyk Sync 2.1.7 has updated the Golang version to 1.25, fixed CVEs and a performance issue, and ensures compatibility with the most recent Tyk LTS release [5.8.13](/developer-support/release-notes/dashboard#5-8-13-release-notes).
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v2.1.7) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.1.6, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 2.1.6 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.1.7](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.1.7)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.1.7
+    ```
+
+#### Changelog
+<a id="Changelog-v2.1.7" data-scroll-offset></a>
+
+##### Added
+
+<AccordionGroup>
+
+<Accordion title='MCP Proxy support'>
+Tyk Sync recognises [MCP proxies](/ai-management/mcp-gateway/managing-proxies) as a distinct resource type.
+
+The `dump` and `sync` commands have been extended to handle MCP proxies:
+
+- Dump writes MCP proxies to `mcp-{id}.json` files.
+- Command output reports a separate count for MCP proxies.
+- Create, update, and delete operations are routed to the dedicated `/api/mcps` endpoint.
+
+No changes to your existing workflow are required — MCP proxies are handled using the same `tyk-sync` commands.
+</Accordion>
+
+</AccordionGroup>
+
+##### Changed
+
+<AccordionGroup>
+
+<Accordion title='Update Golang version to 1.25'>
+We have updated Tyk Sync to Golang 1.25, improving security by staying up-to-date with Golang versions.
+</Accordion>
+
+</AccordionGroup>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Fix severe performance degradation in large-scale sync operations'>
+Resolved an issue where syncing large numbers of policies and APIs could take hours instead of minutes. Tyk Sync will now correctly sync large deployments at the performance levels similar to those seen in v1.5.0.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Fix multiple CVEs'>
+Addressed the following CVEs, providing increased protection against security vulnerabilities.
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33186" target="_blank">CVE-2026-33186</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25679" target="_blank">CVE-2026-25679</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32285" target="_blank">CVE-2026-32285</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-1229" target="_blank">CVE-2026-1229</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32280" target="_blank">CVE-2026-32280</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39883" target="_blank">CVE-2026-39883</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32282" target="_blank">CVE-2026-32282</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32283" target="_blank">CVE-2026-32283</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32281" target="_blank">CVE-2026-32281</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32288" target="_blank">CVE-2026-32288</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39882" target="_blank">CVE-2026-39882</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32289" target="_blank">CVE-2026-32289</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27139" target="_blank">CVE-2026-27139</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27142" target="_blank">CVE-2026-27142</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33762" target="_blank">CVE-2026-33762</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34165" target="_blank">CVE-2026-34165</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 2.1.6 Release Notes
+
+#### Release Date 10 March 2026
+
+#### Release Highlights
+Tyk Sync 2.1.6 is a version alignment release that ensures compatibility with the most recent Tyk LTS release [5.8.12](/developer-support/release-notes/dashboard#5-8-12-release-notes).
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.1.5, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 2.1.5 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.1.6](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.1.6)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.1.6
+    ```
+
+#### Changelog
+<a id="Changelog-v2.1.6" data-scroll-offset></a>
+
+No changes implemented in this release.
+
+
+
+### 2.1.5 Release Notes
+
+#### Release Date 18 December 2025
+
+#### Release Highlights
+Tyk Sync 2.1.5 is a version alignment release that ensures compatibility with the most recent Tyk LTS release [5.8.9](/developer-support/release-notes/dashboard#5-8-9-release-notes). It contains one bug fix.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.1.4, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 2.1.4 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.1.5](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.1.5)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.1.5
+    ```
+
+#### Changelog
+<a id="Changelog-v2.1.5" data-scroll-offset></a>
+
+##### Fixed
+
+<Expandable title='Fixed error when deleting policies'>
+Fixed an issue introduced in v2.1.0 where Tyk Sync would not successfully delete a policy that has been removed from `.tyk.json`. The Dashboard would return an error reporting `invalid doc id` when the `sync` operation was triggered. Now Tyk Sync identifies the policy to be deleted and correctly deletes it from the Dashboard.
+</Expandable>
+
+
+### 2.1.4 Release Notes
+
+#### Release Date 15th October 2025
+
+#### Release Highlights
+Tyk Sync 2.1.4 is a version alignment release that ensures compatibility with the most recent Tyk LTS release [5.8.6](/developer-support/release-notes/dashboard#5-8-6-release-notes). No functional changes have been implemented in this release.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.1.3, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 2.1.3 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.1.4](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.1.4)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.1.4
+    ```
+
+#### Changelog
+<a id="Changelog-v2.1.4" data-scroll-offset></a>
+
+No changes in this release.
+
+### 2.1.3 Release Notes
+
+#### Release Date 4 September 2025
+
+#### Release Highlights
+
+This patch release upgrades Tyk Sync to use Go 1.24 for enhanced security and stability.
+
+Please refer to the [changelog](#Changelog-v2.1.3) below for detailed explanation.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.1.2, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 2.1.2 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.1.3](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.1.3)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.1.3
+    ```
+
+#### Changelog
+<a id="Changelog-v2.1.3" data-scroll-offset></a>
+
+##### Updated
+
+
+<Expandable title='Upgraded to Golang 1.24'>
+Tyk Sync now runs on Golang 1.24, bringing:
+
+  - Improved build performance and runtime efficiency
+  - Enhanced security with latest Go security patches
+  - Better dependency management and module support
+</Expandable>
+
+
+
+### 2.1.2 Release Notes
+
+#### Release Date 27 June 2025
+
+#### Release Highlights
+
+This patch release uplifts a dependent library for better interoperability with the rest of the Tyk stack. Please refer to the [changelog](#Changelog-v2.1.2) below for detailed explanation.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.1.1, we strongly recommend promptly upgrading to the latest release. If you are working with an older version, it is advisable to bypass version 2.1.1 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.1.2](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.1.2)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.1.2
+    ```
+
+#### Changelog
+<a id="Changelog-v2.1.2" data-scroll-offset></a>
+
+##### Updated
+
+
+<Expandable title='Updated to use latest kin-openapi'>
+Upgraded to use the latest version of kin-openapi (v0.132.0). This ensures improved compatibility, full stack interoperability, and continued support for existing OpenAPI 3.0.x specifications.
+</Expandable>
+
+
+
+### 2.1.1 Release Notes
+
+#### Release Date 13 May 2025
+
+#### Release Highlights
+
+This patch release contains a bug fix. Please refer to the [changelog](#Changelog-v2.1.1) below for detailed explanation.
+
+
+<Note>
+This release was accidentally also released to [DockerHub](https://hub.docker.com/layers/tykio/tyk-sync/v2.2.1/images/sha256-cf21fef955add971a9bdfeadd2674fc1f22fbee2d0bf12dab38a78bfae5b7716) as Tyk Sync v2.2.1. That version should not be used.
+</Note>
+
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.1.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 2.1.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.1.1](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.1.1)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.1.1
+    ```
+
+#### Changelog
+<a id="Changelog-v2.1.1" data-scroll-offset></a>
+
+##### Fixed
+
+
+<Expandable title='Fixed incorrect API-level rate limits from dump command'>
+Fixed an issue where the Tyk Sync dump command incorrectly set API-level rate limits in a policy that did not have such limits. This problem arose from Sync trying to add a default value when no rate limit is set in the policy, which led to unintended rate limiting. The issue has been resolved by ensuring that Sync respects the original policy when no API-level rate limit is set.
+</Expandable>
+
+
+
+### 2.1.0 Release Notes
+
+#### Release Date 28 March 2025
+
+#### Release Highlights
+
+Tyk Sync 2.1 introduces performance improvements and enhanced control over API synchronization. This release optimizes resource updates, adds support for partial synchronization, and ensures compatibility with Tyk 5.8.
+
+Please refer to the [changelog](#Changelog-v2.1.0) below for detailed explanation.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.0.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 2.0.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.1.0](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.1.0)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.1.0
+    ```
+
+#### Changelog
+<a id="Changelog-v2.1.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<Expandable title='--no-delete flag for partial synchronization'>
+Added a --no-delete flag to prevent resource deletion during partial sync, giving users more control over API synchronization.
+</Expandable>
+
+
+<Expandable title='Parallel processing for improved performance'>
+Improved synchronization speed by adding parallel processing, allowing faster execution of sync operations in large environments.
+</Expandable>
+
+
+
+##### Changed
+
+
+
+<AccordionGroup>
+<Accordion title='Updated API definitions'>
+Updated API definitions for full compatibility with Tyk 5.8, ensuring seamless integration with the latest Gateway and Dashboard features.
+</Accordion>
+
+<Accordion title='Distroless Docker Image'>
+Changed the Tyk Sync Docker image to a distroless base starting from version 2.1.0, reducing potential security vulnerabilities and minimizing the image size.
+</Accordion>
+
+<Accordion title='Tyk Sync updated to use Golang 1.23'>
+Tyk Sync is using [Golang 1.23](https://tip.golang.org/doc/go1.23) Programming Language starting with the 2.1.0 release. This brings improvements to the code base and allows us to benefit from the latest features and security enhancements in Go.
+</Accordion>
+</AccordionGroup>
+
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Optimized API update requests'>
+Fixed an issue where API synchronization was unnecessarily sending update or create requests to the Dashboard even when no changes were detected. This caused redundant operations and inefficiencies in large-scale deployments. The system now intelligently detects actual changes before making requests, optimizing performance.
+</Expandable>
+
+
+
+
+## 2.0 Release Notes
+
+### 2.0.4 Release Notes
+
+#### Release Date 14 February 2025
+
+#### Release Highlights
+
+Tyk Sync 2.0.4 has been updated to fix a critical security vulnerability.
+
+Please refer to the [changelog](#Changelog-v2.0.4) below for detailed explanation.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.0.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 2.0.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.0.4](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.0.4)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.0.4
+    ```
+
+#### Changelog
+<a id="Changelog-v2.0.4" data-scroll-offset></a>
+
+##### Fixed
+
+
+
+<Expandable title='CVE-2025-21613 resolved in Tyk Sync'>
+Resolved CVE-2025-21613 by updating the go-git library to v5.13.2. go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.
+</Expandable>
+
+
+
+### 2.0.1 Release Notes
+
+#### Release Date 05 December 2024
+
+#### Release Highlights
+
+Tyk Sync 2.0.1 has been updated to support API configurations from Tyk 5.7.0.
+
+Please refer to the [changelog](#Changelog-v2.0.1) below for detailed explanation.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v2.0.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 2.0.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.0.1](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.0.1)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.0.1
+    ```
+
+#### Changelog
+<a id="Changelog-v2.0.1" data-scroll-offset></a>
+
+###### Changed
+
+
+
+<Expandable title='API definitions and policies supported up to Tyk Gateway v5.7.0'>
+Tyk Sync 2.0.1 supports API definitions and policies up to Tyk Gateway v5.7.0. This update ensures that Tyk Sync can manage API definitions and policies compatible with Tyk Gateway v5.7.0.
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Improved Error Handling for Invalid MongoDB Object IDs in Tyk Sync'>
+Addressed an issue where Tyk Sync did not properly validate MongoDB Object IDs during API synchronization. Previously, invalid IDs would result in silent failures, causing APIs to remain unpublished without error logs, creating confusion for users. Tyk Sync now logs meaningful error messages and exits with an error if invalid IDs are detected. This fix enhances the reliability and transparency of the synchronization process, ensuring consistent behavior with the Tyk Dashboard API.
+</Expandable>
+
+
+
+---
+
+### 2.0.0 Release Notes
+
+From Tyk Sync v2.0, Tyk Sync will be closed source and we will only support use of Tyk Sync with licensed Tyk Dashboard.
+
+#### Release Date 10 Oct 2024
+
+#### Release Highlights
+
+Tyk Sync 2.0 has been updated to support API configurations from Tyk 5.6.0.
+
+Please refer to the [changelog](#Changelog-v2.0.0) below for detailed explanation.
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+##### Deprecation of `--gateway` Flag
+
+As of Tyk Sync v2.0, support for the **Open Source Tyk Gateway** has been removed. Tyk Sync v2.0 is now compatible exclusively with licensed Tyk Dashboard. This change means that Tyk Sync can no longer be used with the Open Source (OSS) version of the Tyk Gateway.
+
+The `--gateway` flag, previously used to sync with the OSS Tyk Gateway, is **deprecated** and will be fully **removed in a future release**. Users should prepare to transition their Tyk Sync workflows to licensed Tyk Dashboard environments to ensure continued functionality.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+##### Future deprecations
+As part of our ongoing efforts to streamline and improve Tyk Sync, we plan to deprecate the following options in future releases:
+
+- `--apis` for the `tyk-sync sync` command.
+- `--policies` for the `tyk-sync sync` command.
+
+We recommend users update their workflows to use the `publish` and `update` commands for managing individual API and Policy IDs. To continue using the `sync` command, ensure all required resources are listed in the `.tyk.json` index file. This file will serve as the source of truth for API configuration states, and Tyk Sync will create or update all specified resources while removing any others from Tyk Dashboard.
+
+#### Upgrade instructions
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v2.0.0](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v2.0.0)
+  - ```bash
+    docker pull tykio/tyk-sync:v2.0.0
+    ```
+
+#### Changelog
+<a id="Changelog-v2.0.0" data-scroll-offset></a>
+
+##### Updated
+
+
+
+<Expandable title='API definitions and policies supported up to Tyk Gateway v5.6.0'>
+Tyk Sync 2.0.0 supports API definitions and policies up to Tyk Gateway v5.6.0. This update ensures that Tyk Sync can manage API definitions and policies compatible with Tyk Gateway v5.6.0.
+</Expandable>
+
+
+
+<Expandable title='Deprecated --gateway flag'>
+As of Tyk Sync v2.0, support for the **Open Source Tyk Gateway** has been removed. Tyk Sync v2.0 is now compatible exclusively with licensed Tyk Dashboard. This change means that Tyk Sync can no longer be used with the Open Source (OSS) version of the Tyk Gateway.
+
+The `--gateway` flag, previously used to sync with the OSS Tyk Gateway, is **deprecated** and will be fully **removed in a future release**. Users should prepare to transition their Tyk Sync workflows to licensed Tyk Dashboard environments to ensure continued functionality.
+</Expandable>
+
+
+
+
+## 1.5 Release Notes
+
+### 1.5.1 Release Notes
+
+#### Release date 13 August 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image v1.5.1](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v1.5.1)
+  - ```bash
+    docker pull tykio/tyk-sync:v1.5.1
+    ```
+
+#### Changelog
+
+##### Fixed
+
+
+
+<Expandable title='Fixed problem in synchronizing APIs with duplicate slugs'>
+In previous versions, the `sync` command in Tyk Sync checked for duplicate slugs among APIs. As slugs are now deprecated and APIs will have identical slugs by default starting from Tyk v5.3, this check became problematic. To resolve this, the checks for duplicate slugs have been removed in this version, ensuring compatibility with both Tyk Cloud and Tyk v5.3+.
+</Expandable>
+
+
+
+
+##### Changed
+
+
+
+<Expandable title='API definitions supported up to Tyk Gateway v5.5.0'>
+Tyk Sync 1.5.1 supports API definitions up to Tyk Gateway v5.5.0. This update ensures that Tyk Sync can manage API definitions compatible with Tyk Gateway v5.5.0.
+</Expandable>
+
+
+
+### 1.5.0 Release Notes
+
+#### Release date 4 July 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+##### Removed --allow-unsafe-oas flag
+
+With native support of Tyk OAS APIs in Sync v1.5, we have removed the `--allow-unsafe-oas` flag from all commands as this flag is no longer required. Users can manage OAS APIs with Tyk Gateway and Dashboard (v5.3.2+) without specifying this flag or setting configurations in the Dashboard. The synchronisation of OAS API Definitions with the Dashboard is now safer and more straightforward.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+##### Future deprecations
+As part of our ongoing efforts to streamline and improve Tyk Sync, we plan to deprecate the following options in future releases:
+
+- `--apis` for the `tyk-sync sync` command.
+- `--policies` for the `tyk-sync sync` command.
+
+We recommend users update their workflows to use the `publish` and `update` commands for managing individual API and Policy IDs. To continue using the `sync` command, ensure all required resources are listed in the `.tyk.json` index file. This file will serve as the source of truth for API configuration states, and Tyk Sync will create or update all specified resources while removing any others from the Gateway or Dashboard.
+
+#### Upgrade instructions
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Release Highlights
+##### Full support for OAS APIs and API templates
+Tyk Sync 1.5 now fully supports Tyk OpenAPI Specification (OAS) APIs and API Templates. This release is compatible with Tyk Gateway or Dashboard version 5.4.0 and above, enabling seamless management of OAS APIs and API templates, and also supports all Tyk API definitions (Tyk OAS APIs and Tyk Classic APIs) for Tyk Gateway and Tyk Dashboard v5.4.0.
+
+For Tyk Gateway v5.4.1+ make sure to use the latest Tyk Sync available and also check Tyk Gateway release notes in the section "Compatibility Matrix For Tyk Components" for further instructions.
+
+Please refer to the [changelog](#Changelog-v1.5.0) below for detailed explanation.
+
+#### Downloads
+- [Docker image v1.5.0](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v1.5.0)
+  - ```bash
+    docker pull tykio/tyk-sync:v1.5.0
+    ```
+- [Source code](https://github.com/TykTechnologies/tyk-sync/releases/tag/v1.5.0)
+
+#### Changelog
+<a id="Changelog-v1.5.0" data-scroll-offset></a>
+
+##### Added
+
+
+
+<AccordionGroup>
+<Accordion title='Support for OAS APIs'>
+Added native support for OAS APIs. Tyk Sync 1.5 now fully supports OpenAPI Specification (OAS) APIs and API Templates. This release is compatible with Tyk Gateway or Dashboard version 5.3.2 and above, enabling seamless management of OAS APIs and API templates. The `--allow-unsafe-oas` flag is not required anymore for managing OAS APIs.
+</Accordion>
+
+<Accordion title='Support for API Templates'>
+Added support for API templates in `dump`, `sync`, `update`, and `publish` commands. Tyk Sync now supports managing API template resources in Tyk dashboard. Users can use these commands to manage API templates effectively.
+</Accordion>
+
+<Accordion title='Support for API Categories of OAS APIs'>
+Added support for API categories in OAS APIs. Users can now include API Category in the API Definition file. Tyk Sync will update the categories of the API accordingly. It improved organization and categorization of APIs, making management more intuitive.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Updated
+
+
+
+<Expandable title='API definitions supported up to Tyk Gateway v5.4.0'>
+Tyk Sync 1.5 supports API definitions up to Tyk Gateway v5.4.0. This update ensures that Tyk Sync can manage API definitions compatible with Tyk Gateway v5.4.0.
+</Expandable>
+
+
+
+<Expandable title='Removed --allow-unsafe-oas flag'>
+With native support of Tyk OAS APIs in Sync v1.5, we have removed the `--allow-unsafe-oas` flag from all commands as this flag is no longer required. Users can manage OAS APIs with Tyk Gateway and Dashboard (v5.3.2+) without specifying this flag or setting configurations in the Dashboard. The synchronisation of OAS API Definitions with the Dashboard is now safer and more straightforward.
+</Expandable>
+
+
+
+##### Fixed
+
+
+
+<Expandable title='Improved CI/CD integration by returning non-zero exit codes on failure'>
+Previously, users had to parse `stdout` to detect failures, making it difficult to integrate with CI/CD tools. This fix ensures that failure cases return non-zero exit codes, allowing CI/CD pipeline tools to automatically detect and flag errors. This change will streamline CI/CD workflows and improved error detection and handling.
+</Expandable>
+
+
+
+<Expandable title='Fixed endpoint issue in update command'>
+Fixed an issue with the `update` command where extra slashes in the endpoint caused PUT requests to be misinterpreted as GET requests. Due to extra slashes at the end of the endpoint, PUT calls were being converted to GET calls, resulting in a 200 OK response without actual updates. This issue occurred when the gateway URL was provided instead of the dashboard URL for `sync` and `update` commands. The fix now ensured accurate updates and improved reliability of the `update` command.
+</Expandable>
+
+
+
+## 1.4 Release Notes
+
+### 1.4.3 Release Notes
+
+#### Release date 5 Apr 2024
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are using a 1.4.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, **you should skip 1.4.0** and upgrade directly to this release.
+
+#### Release Highlights
+This release works with Tyk Dashboard and Tyk Gateway v5.3.0. As such it supports all Tyk API definitions (Tyk OAS APIs and Tyk Classic APIs) for [Tyk Gateway v5.3.0](/developer-support/release-notes/gateway#compatibility-matrix-for-tyk-components-14) and [Tyk Dashboard](/developer-support/release-notes/dashboard#compatibility-matrix-for-tyk-components-14)
+ 
+For Tyk Gateway v5.3.1+ make sure to use the latest Tyk Sync available and also check Tyk Gateway release notes in the section "Compatibility Matrix For Tyk Components" for further instructions.
+
+Please refer to the [changelog](#Changelog-v1.4.3) below for detailed explanation.
+
+#### Downloads
+- [Docker image v1.4.3](https://hub.docker.com/r/tykio/tyk-sync/tags?page=&page_size=&ordering=-name&name=v1.4.3)
+  - ```bash
+    docker pull tykio/tyk-sync:v1.4.3
+    ```
+- [Source code](https://github.com/TykTechnologies/tyk-sync/releases/tag/v1.4.3)
+
+#### Changelog
+<a id="Changelog-v1.4.3" data-scroll-offset></a>
+
+##### Updated
+
+
+
+<Expandable title='API definitions supported up to Tyk Gateway v5.3.0'>
+Tyk Sync supports both Tyk OAS APIs and Tyk Classic APIs when working with Tyk Dashboard. However, to use Tyk Sync to migrate Tyk OAS APIs you would need to set a special config field in Tyk Dashboard and an argument for Tyk Sync. This is a temporary measure provided for early adopters and will be **deprecated** later when Tyk Sync is updated in a future release to bring you the full Tyk OAS API experience as soon as possible.
+
+Recommended usage:
+Tyk Dashboard setting: [allow-unsafe-oas](/tyk-dashboard/configuration#allow_unsafe_oas)
+Tyk Sync: use the [--allow-unsafe-oas](/api-management/automations/sync) when invoking the CLI
+
+####### API Category is not yet supported
+API Categories are a new capability with v5.3.0 of Tyk Dashboard. API Categories are currently not supported in Tyk Sync for Tyk OAS APIs. This means that Tyk Sync will not be able to save the category definition set for the Tyk OAS API. Until we update Tyk Sync you would need to manually recreate the categories in the new environment.
+</Expandable>
+
+
+
+
+
+<Expandable title='Tyk Sync updated to use [Golang 1.21](https://tip.golang.org/doc/go1.21)'>
+Tyk Sync is using Golang 1.21 Programming Language starting with the 1.4.3 release. This brings improvements to the code base and allows us to benefit from the latest features and security enhancements in Go.
+</Expandable>
+
+
+
+##### Security
+
+The following CVEs have been resolved in this release:
+
+- [CVE-2023-48795](https://nvd.nist.gov/vuln/detail/CVE-2023-48795)
+- [CVE-2023-49569](https://nvd.nist.gov/vuln/detail/CVE-2023-49569)
+- [GHSA-9763-4f94-gfch](https://github.com/advisories/GHSA-9763-4f94-gfch)
+
+---
+
+### 1.4.2 Release Notes
+
+##### Release date 07 Dec 2023
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+If you are using a 1.4.x version, we advise you to upgrade ASAP to this latest release. If you are on an older version, **you should skip 1.4.0** and upgrade directly to this release.
+
+#### Release Highlights
+This release enhances compatibility as detailed in the [changelog](#Changelog-v1.4.2) below.
+
+#### Downloads
+- [Docker image v1.4.2](https://hub.docker.com/layers/tykio/tyk-sync/v1.4.2/images/sha256-3a6473aedeb4963bc19b218b52c4649fffc6ad46113799e9c1055004d5dc754a?context=explore)
+  - ```bash
+    docker pull tykio/tyk-sync:v1.4.2
+    ```
+- [Source code](https://github.com/TykTechnologies/tyk-sync/releases/tag/v1.4.2)
+
+#### Changelog
+<a id="Changelog-v1.4.2" data-scroll-offset></a>
+
+##### Updated
+
+
+
+<Expandable title='API definitions supported up to Tyk Gateway v5.2.3'>
+Tyk Sync supports Tyk API definitions up to Tyk Gateway v5.2.3. Please use this version with Tyk Gateway v5.2.0+.
+</Expandable>
+
+
+
+
+
+## Further Information
+
+### Upgrading Tyk
+Please refer to the [upgrading Tyk](/developer-support/upgrading) page for further guidance with respect to the upgrade strategy.
+
+### FAQ
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
+
+## Earlier Versions Release Notes
+Release Notes for Tyk Sync v1.4.1 and earlier can we found in [Tyk Sync GitHub](https://github.com/TykTechnologies/tyk-sync/releases)
+
diff --git a/developer-support/release-notes/tib.mdx b/developer-support/release-notes/tib.mdx
new file mode 100644
index 0000000000..d64fce3398
--- /dev/null
+++ b/developer-support/release-notes/tib.mdx
@@ -0,0 +1,450 @@
+---
+title: "Tyk Identity Broker Release Notes"
+description: "Release notes documenting updates, enhancements, and changes for Tyk Identity Broker."
+keywords: "Tyk Identity Broker, Release notes, changelog"
+sidebarTitle: "Tyk Identity Broker"
+---
+
+****Open Source** ([Mozilla Public License](https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md))**
+
+**This page contains all release notes for Tyk Identity Broker displayed in reverse chronological order**
+
+## Support Lifetime
+Only the most recent Tyk Identity Broker release is supported. We recommend staying current to minimise exposure to security vulnerabilities from third party dependencies.
+
+---
+
+## 1.7 Release Notes
+
+### 1.7.3 Release Notes
+
+#### Release Date 23 June 2026
+
+#### Release Highlights
+
+In this patch, we have fixed an issue where Tyk Identity Broker (TIB) did not honor the host application's configured log verbosity when embedded in Tyk Dashboard or Tyk Developer Portal. We have also resolved several CVEs to strengthen security.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.7.3) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- |
+| [GoLang](https://go.dev/dl/)                               | 1.25       | 1.25       | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.x, 6.x, 7.0 | 4.4.x, 5.x, 6.x and 7.0.x |
+| [Redis](https://redis.io/download/)         | 6.x - 7.0        | 6.x - 7.0            |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v1.7.2, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.7.2 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.7.3)
+  ```
+  docker pull tykio/tyk-identity-broker:v1.7.3
+  ```
+- source code tarball for oss projects - [TIB v1.7.3](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.7.3)
+
+#### Changelog
+<a id="Changelog-v1.7.3" data-scroll-offset></a>
+
+##### Fixed
+
+<AccordionGroup>
+
+<Accordion title='Inherit Log Verbosity When Embedded'>
+When Embedded in Tyk Dashboard or Tyk Developer Portal, TIB now inherits the host application's configured application log verbosity.
+
+Previously, TIB emitted its log output at a fixed verbosity regardless of the Dashboard or Portal setting, so TIB messages could appear even when the Dashboard was configured to a less verbose level.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='Resolved CVEs'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.7.2 Release Notes
+
+#### Release Date 19 May 2026
+
+#### Release Highlights
+
+In this release, we have addressed CVEs to strengthen security.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.7.2) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- |
+| [GoLang](https://go.dev/dl/)                               | 1.25       | 1.25       | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.x, 6.x, 7.0 | 4.4.x, 5.x, 6.x and 7.0.x |
+| [Redis](https://redis.io/download/)         | 6.x - 7.0        | 6.x - 7.0            |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v1.7.1, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.7.1 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.7.2)
+  ```
+  docker pull tykio/tyk-identity-broker:v1.7.2
+  ```
+- source code tarball for oss projects - [TIB v1.7.2](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.7.2)
+
+#### Changelog
+<a id="Changelog-v1.7.2" data-scroll-offset></a>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33811" target="_blank">CVE-2026-33811</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39820" target="_blank">CVE-2026-39820</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39836" target="_blank">CVE-2026-39836</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42499" target="_blank">CVE-2026-42499</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32952" target="_blank">CVE-2026-32952</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39823" target="_blank">CVE-2026-39823</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39826" target="_blank">CVE-2026-39826</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39825" target="_blank">CVE-2026-39825</a>
+
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.7.1 Release Notes
+
+#### Release Date 20th April 2026
+
+#### Release Highlights
+
+In this release, we have updated Tyk Identity Broker (TIB) to Golang 1.25 for enhanced security and performance.
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.7.1) below.
+
+#### Breaking Changes
+
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- |
+| [GoLang](https://go.dev/dl/)                               | 1.25       | 1.25       | 
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.x, 6.x, 7.0 | 4.4.x, 5.x, 6.x and 7.0.x |
+| [Redis](https://redis.io/download/)         | 6.x - 7.0        | 6.x - 7.0            |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v1.7.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.7.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.7.1)
+  ```
+  docker pull tykio/tyk-identity-broker:v1.7.1
+  ```
+- source code tarball for oss projects - [TIB v1.7.1](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.7.1)
+
+#### Changelog
+<a id="Changelog-v1.7.1" data-scroll-offset></a>
+
+##### Changed
+<AccordionGroup>
+
+<Accordion title='Updated Go version to 1.25'>
+The Tyk Identity Broker (TIB) has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
+</Accordion>
+
+</AccordionGroup>
+
+##### Security Fixes
+
+<AccordionGroup>
+
+<Accordion title='CVE fixed'>
+Addressed the following CVEs, providing increased protection against security
+vulnerabilities, including, but not limited to:
+
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33186" target="_blank">CVE-2026-33186</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33487" target="_blank">CVE-2026-33487</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32285" target="_blank">CVE-2026-32285</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-22868" target="_blank">CVE-2025-22868</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-30204" target="_blank">CVE-2025-30204</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-45338" target="_blank">CVE-2024-45338</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-10543" target="_blank">CVE-2025-10543</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-22870" target="_blank">CVE-2025-22870</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-22872" target="_blank">CVE-2025-22872</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-27144" target="_blank">CVE-2025-27144</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-47911" target="_blank">CVE-2025-47911</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-58181" target="_blank">CVE-2025-58181</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-58190" target="_blank">CVE-2025-58190</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34986" target="_blank">CVE-2026-34986</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39883" target="_blank">CVE-2026-39883</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39882" target="_blank">CVE-2026-39882</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-51744" target="_blank">CVE-2024-51744</a>
+- <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-29923" target="_blank">CVE-2025-29923</a>
+
+</Accordion>
+
+</AccordionGroup>
+
+### 1.7.0 Release Notes
+
+#### Release Date 28 March 2025
+
+#### Release Highlights
+
+This release introduces enhancements to TIB, improving group-based permission mapping, adding support for proxy settings from environment variables, and allowing dynamic state values in the OAuth2 flow. 
+
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.7.0) below.
+
+#### Breaking Changes
+This release has no breaking changes.
+
+#### Dependencies
+
+##### 3rd Party Dependencies & Tools
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | All our binaries |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.x, 6.x, 7.0 | 4.4.x, 5.x, 6.x and 7.0.x | Used by Tyk Identity Broker |
+| [Redis](https://redis.io/download/)         | 6.x - 7.0        | 6.x - 7.0            | Used by Tyk Identity Broker |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+There are no deprecations in this release.
+
+#### Upgrade instructions
+For users currently on v1.6.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.6.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.7.0)
+  ```
+  docker pull tykio/tyk-identity-broker:v1.7.0
+  ```
+- source code tarball for oss projects - [TIB v1.7.0](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.7.0)
+
+#### Changelog
+<a id="Changelog-v1.7.0" data-scroll-offset></a>
+
+##### Added
+
+
+<AccordionGroup>
+<Accordion title='Load Proxy Settings from Environment Variables'>
+TIB now respects `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables when making outbound connections. This change ensures compatibility with air-gapped Kubernetes environments where external services can only be accessed via an HTTP proxy.
+</Accordion>
+
+<Accordion title='Dynamic State Query Support in OAuth2 Flow'>
+The OAuth2 "state" field can now be dynamically set via the URL or form-encoded body. This improvement allows integration with external APIs that require custom state values, ensuring compliance with various regulatory and enterprise authentication requirements.
+</Accordion>
+
+<Accordion title='Improved Multi-Group Permission Mapping for Identity Providers'>
+Previously, TIB assigned a user to the last matched group when multiple groups were mapped, regardless of the identity provider (SAML, LDAP, OAuth, OIDC, etc.). The new functionality introduces support for multi-group mapping, allowing permissions to be merged. This update is backward compatible and ensures that multi-group rights (combined permissions) are only applied if the user does not have a `groupId` assigned via the Dashboard.
+</Accordion>
+</AccordionGroup>
+
+
+
+##### Security Fixes
+
+
+<Expandable title='Fixed the following CVE'>
+- [GHSA-v778-237x](https://github.com/advisories/GHSA-v778-237x-gjrc)
+</Expandable>
+
+
+
+---
+
+## 1.6 Release Notes
+
+### 1.6.1 Release Notes
+
+#### Release Date 5 Nov 2024
+
+#### Release Highlights
+{/* Required. Use similar ToV to previous release notes. For example for a patch release:
+This release primarily focuses on bug fixes.
+For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-vX.Y.0) below. */}
+###### Enhanced Security with JWE Support for OIDC SSO
+This release introduces JSON Web Encryption (JWE) support for OpenID Connect (OIDC) Single Sign-On (SSO) in the Tyk Identity Broker (TIB). With this enhancement, organizations can achieve greater security for token handling during authentication flows. JWE token validation and processing are now seamlessly integrated, offering configurable private key support for decryption.
+
+
+#### Breaking Changes
+{/* Required. Use the following statement if there are no breaking changes, or explain if there are */}
+This release has no breaking changes.
+
+{/* The following "Changed error log messages" section is Optional!
+Instructions: We should mention ALL changes in our application log messages in the changelog section. In case we made such changes, this section should also be added, to make sure the users don't miss this notice among other changelog lines. */}
+{/* ##### Changed error log messages
+Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log, etc.).
+We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}
+
+{/* The following "|Planned Breaking Changes" section is optional!
+Announce future scheduled breaking changes, e.g. Go version updates, DB driver updates, etc. */}
+{/* ##### Planned Breaking Changes */}
+
+#### Dependencies
+{/* Required. Use this section to announce the following types of dependencies compatible with the release:
+
+Version compatibility with other components in the Tyk stack. This takes the form of a compatibility matrix and is only required for Gateway and Portal.
+
+3rd party dependencies and tools */}
+      
+##### 3rd Party Dependencies & Tools
+{/* Required. Third-party dependencies encompass tools (GoLang, Helm etc.), databases (PostgreSQL, MongoDB etc.) and external software libraries. This section should be a table that presents the third-party dependencies and tools compatible with the release. Compatible is used in the sense of those versions tested with the releases. Such information assists customers considering upgrading to a specific release.
+
+Additionally, a disclaimer statement was added below the table, for customers to check that the third-party dependency they decide to install remains in support.
+
+An example is given below for illustrative purposes only. Tested Versions and Compatible Versions information will require discussion with relevant squads and QA. */}
+
+| Third Party Dependency                                     | Tested Versions        | Compatible Versions    | Comments | 
+| :---------------------------------------------------------- | :---------------------- | :---------------------- | :-------- | 
+| [GoLang](https://go.dev/dl/)                               | 1.21       | 1.21       | All our binaries |
+| [MongoDB](https://www.mongodb.com/try/download/community)  | 5.x, 6.x, 7.0 | 4.4.x, 5.x, 6.x and 7.0.x | Used by Tyk Identity Broker |
+| [Redis](https://redis.io/download/)         | 6.x - 7.0        | 6.x - 7.0            | Used by Tyk Identity Broker |
+
+Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.
+
+#### Deprecations
+{/* Required. Use the following statement if there are no deprecations, or explain if there are */}
+There are no deprecations in this release.
+
+{/* Optional section!
+Used to share and notify users about our plan to deprecate features, configs etc. 
+Once you put an item in this section, we must keep this item listed in all the following releases till the deprecation happens. */}
+{/* ###### Future deprecations */}
+
+#### Upgrade instructions
+{/* Required. For patches release (Z>0) use this: */}
+For users currently on v1.6.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.6.0 and proceed directly to this latest patch release.
+<br/>
+Go to the [Upgrading Tyk](#upgrading-tyk) section for detailed upgrade Instructions.
+
+
+#### Downloads
+- [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.6.1)
+  ```
+  docker pull tykio/tyk-identity-broker:v1.6.1
+  ```
+- source code tarball for oss projects - [TIB v1.6.1](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.6.1)
+
+#### Changelog
+{/* Required. The change log should include the following ordered set of sections below that briefly summarise the features, updates and fixed issues of the release.
+
+Here it is important to explain the benefit of each changelog item. As mentioned by James in a previous Slack message (https://tyktech.slack.com/archives/C044R3ZTN6L/p1686812207060839?thread_ts=1686762128.651249&cid=C044R3ZTN6L):
+"...it is important to document the customer impact for the work delivered, so we can share it with prospects/install base. For example:
+"New Chart delivers x and y benefit to a and b customer use cases. The business impact for them will be this and that" */}
+
+##### Added
+{/* This section should be a bullet point list of new features. Explain:
+
+- The purpose of the new feature
+- How does the new feature benefit users?
+- Link to documentation of the new feature
+- For OSS - Link to the corresponding issue if possible on GitHub to allow the users to see further info.
+
+Each change log item should be expandable. The first line summarises the changelog entry. It should be then possible to expand this to reveal further details about the changelog item. This is achieved using HTML as shown in the example below. */}
+
+
+<Expandable title='Support for JSON Web Encryption (JWE) in OIDC SSO with TIB'>
+This release adds support for JSON Web Encryption (JWE) in OIDC Single Sign-On (SSO) with TIB, providing enhanced security for token handling in authentication flows. This feature enables processing and validation of JWE tokens, with configuration options for setting the private key required for decryption.
+
+For more details, refer to the [OIDC SSO with JWE](/api-management/single-sign-on-social-idp#json-web-encryption-jwe) documentation.
+</Expandable>
+
+
+
+
+---
+
+{/* Repeat the release notes section above for every patch here */}
+
+
+{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
+links to API documentation and FAQs. You can copy it from the previous release. */}
+
+## Further Information
+
+### Upgrading Tyk
+Please refer to the [upgrading Tyk](/developer-support/upgrading) page for further guidance on the upgrade strategy.
+
+### FAQ
+Please visit our [Developer Support](/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.
diff --git a/developer-support/release-types/early-access-feature.mdx b/developer-support/release-types/early-access-feature.mdx
new file mode 100644
index 0000000000..60341a733c
--- /dev/null
+++ b/developer-support/release-types/early-access-feature.mdx
@@ -0,0 +1,16 @@
+---
+title: "Early Access Features"
+description: "Explain what Early Access Features means and what to expect"
+keywords: "Release FAQ, Early access\""
+sidebarTitle: "Early Access Feature"
+---
+
+Early Access features are fully tested Tyk features. However, please note that your access to these features is on an "early access" basis and as a result they may not support the functionality of similar features or functionality that you would otherwise expect. 
+
+As we extend the capabilities of our Early Access features we may make changes that are not backwards compatible. Please ensure that you consider these limitations before using an Early Access feature. 
+
+Early Access features are provided "as is" and Tyk disclaims and excludes to the fullest extent permitted by applicable laws all warranties, representations, conditions and all other terms, express or implied, including, but not limited to, implied warranties of merchantability and fitness for a particular purpose. 
+
+By accessing the Early Access features, you agree that Tyk will not be liable for any losses or damages caused in connection with Early Access features, unless the relevant losses or damages are due to our fraud, willful misconduct or gross negligence. 
+
+This limitation does not apply to limitations that cannot be limited by law.
diff --git a/developer-support/release-types/fips-release.mdx b/developer-support/release-types/fips-release.mdx
new file mode 100644
index 0000000000..dd6dee0d77
--- /dev/null
+++ b/developer-support/release-types/fips-release.mdx
@@ -0,0 +1,108 @@
+---
+title: "FIPS 140-3 Compliance"
+description: "How Tyk supports regulated organizations, such as government, healthcare, and financial sectors, in achieving FIPS 140-3 compliant deployments using validated cryptographic modules and hardened container images"
+keywords: "FIPS, FIPS 140-3, compliance, cryptography, security, federal, government, regulated"
+sidebarTitle: "FIPS Compliance"
+---
+
+## What is FIPS?
+
+The [Federal Information Processing Standards](https://csrc.nist.gov/glossary/term/federal_information_processing_standard) (FIPS) are U.S. government standards for cryptographic modules, defined by the [National Institute of Standards and Technology](https://www.nist.gov/) (NIST).
+
+FIPS compliance is often required for organizations in:
+
+* Government and defence
+* Healthcare and life sciences
+* Financial services
+* Critical infrastructure
+
+For API management in regulated sectors, FIPS matters because it ensures that only approved cryptographic algorithms are used for data in transit, that token signing and key hashing operations use validated methods, and that your deployment meets regulatory requirements when FIPS is mandated.
+
+---
+
+## Tyk FIPS Offering
+
+Tyk's FIPS-compliant products are available as a paid **Enterprise Edition FIPS add-on (EE-FIPS)**. Please speak to your account manager for access.
+
+Subject to the terms of this policy, and our wider FIPS terms, the following components are available in FIPS-compliant form (the “**FIPS Products**”):
+
+* Tyk Gateway
+* Tyk Dashboard
+* Tyk Pump
+* MDCB
+* Tyk Sync
+* Tyk Operator (images only; packages are not generated for Operator)
+* Kubernetes bootstraps
+* Tyk Enterprise Developer Portal
+
+FIPS Products are distributed separately and are identifiable by the `-fips` suffix (e.g. `tyk-gateway-fips`, `tyk-pump-fips`).
+
+FIPS Products are available on the **current LTS**, **LTS-1**, and **latest feature branch**. We recommend staying on the current LTS for the most stable and regularly patched FIPS releases. See the [LTS policy](https://tyk.io/docs/developer-support/release-types/long-term-support) for details.
+
+---
+
+## FIPS Standard by Version
+
+Compliance posture depends on the software version. See below for version-specific details.
+
+**5.13.x is our current LTS release. Please refer to this [page](/developer-support/release-types/long-term-support) for exact timelines**
+
+* Targets **FIPS 140-3** compliance
+* Available as **Docker Hardened Images (DHI)** or **native OS packages (RPM/DEB)**
+* Both formats deliver the same FIPS 140-3 compliant application-layer cryptography
+* DHI builds additionally use a FIPS-validated base image, are STIG-compliant, and include enterprise supply chain security controls (SLSA Level 3 build provenance, signed SBOMs, and cryptographic image signatures)
+* Native packages deliver the core FIPS-compliant cryptographic binaries but do not include a certified base image or supply chain attestations
+
+**Version 5.8.x (LTS-1, now in Maintenance Support)**
+
+
+* Targets **FIPS 140-2** compliance
+* Available as **RPM/DEB packages only** using the BoringCrypto cryptographic module
+* Not built on a FIPS-certified base image
+* Compliance applies to the packaged binaries only; it does not extend to the container image, plug-ins, or surrounding environment
+* Does not include DHI supply chain attestations (SLSA/SBOMs)
+
+> **If your organisation has regulatory obligations requiring FIPS 140-3, a certified base image, or supply chain attestations, you should be on version 5.13.x or later using Docker Hardened Images.** Contact your Tyk account team for upgrade planning support.
+
+---
+
+## What "FIPS-compliant" means
+
+Please note that the FIPS Products have not been submitted to a [NIST](https://www.nist.gov/federal-information-processing-standards-fips) testing lab for validation and Tyk is not FIPS certified.
+
+**FIPS-compliant** means that the FIPS Products only use FIPS 140-3 approved cryptographic algorithms when running in FIPS mode, and are built on a FIPS-certified base image. This is only available to specific Tyk-built products as detailed in this policy. In particular:
+
+* The FIPS Products use Go 1.25's native FIPS implementation to provide FIPS 140-3 validated cryptographic operations. See [Go FIPS 140-3 documentation](#) for more details.
+* These packages are distributed separately, identifiable by the `-fips` suffix (e.g., `tyk-gateway-fips`, `tyk-pump-fips`).
+* The FIPS Products **have not been submitted to a NIST testing lab**. They are therefore *FIPS-compliant*, as per the above definition, but are not *FIPS-certified*.
+* Tyk’s FIPS-compliant packages are only available to customers who have purchased the right to access and use Tyk’s FIPS Products via an Enterprise Edition FIPS add-on (a “**EE-FIPS add-on**”). Tyk’s EE-FIPS add-on is provided via a Tyk Global Order Form and is subject to Tyk’s latest FIPS policy.
+* **At all times, customers remain responsible for ensuring compliance with their overall deployment, configuration, infrastructure, and the use of the FIPS Tyk Products.**
+
+In addition to being FIPS-compliant, our DHI is also STIG-compliant (Security Technical Implementation Guide). Alongside, we’ve introduced Enterprise-grade supply chain security, including SLSA Level 3 build provenance, signed SBOMs, and cryptographic signatures for the base image.
+
+---
+
+## Important Notes
+
+Use of Tyk's FIPS Products is conditional on:
+
+* A signed **EE-FIPS add-on** via a Tyk Global Order Form
+* Acceptance of any additional terms specific to FIPS releases
+
+---
+
+## FAQ
+
+<AccordionGroup>
+<Accordion title="Are All Tyk FIPS Products Equivalent in Their Compliance Posture?">
+No. Version 5.8.x targets FIPS 140-2 using BoringCrypto and is not built on a certified base image. Version 5.13.x and later targets FIPS 140-3 using Go’s native cryptographic implementation, is delivered as Docker Hardened Images with a FIPS-validated base layer, and includes supply chain attestations. If your requirements specify FIPS 140-3, a certified base image, or SBOMs, you need 5.13.x or later.
+</Accordion>
+
+<Accordion title="Is Tyk FIPS-Certified?">
+No. Tyk’s products have not been submitted to a NIST testing laboratory. They are FIPS-compliant, by Tyk’s definition. See [What "FIPS-compliant" means](#what-fips-compliant-means) for further information.
+</Accordion>
+
+<Accordion title="Can I Use FIPS Builds Without an EE-FIPS Add-On?">
+No. Access to FIPS Products requires a signed EE-FIPS add-on. Please contact your account manager.
+</Accordion>
+</AccordionGroup>
diff --git a/developer-support/release-types/lab-release.mdx b/developer-support/release-types/lab-release.mdx
new file mode 100644
index 0000000000..1d33a6247c
--- /dev/null
+++ b/developer-support/release-types/lab-release.mdx
@@ -0,0 +1,35 @@
+---
+title: "Lab Release"
+description: "Explain what Lab Release means, what it includes, and what to expect"
+keywords: "FAQ, Lab Releases, Special Release"
+sidebarTitle: "Lab Release"
+---
+
+*Lab Release* is a release for a product still in the lab phase, during which features are still under active development and testing.
+Lab phase releases are crucial in our product discovery and proving. They bring our customers, prospects, and the open-source community to the
+heart of our product design. This collaboration provides valuable feedback, helping us refine and improve the product while giving you early
+access to some key ideas we are testing. We really value your feedback - we want to learn what works for you, new use cases we've missed,
+or things that can be improved before we release the capability as production-ready.
+
+## Important information when using products in a *Lab Release* phase
+Lab phase releases are not intended for production use and there are a few things you need to be aware of if you are 
+helping us prove a lab release:
+- **They are not ready for production use:** they have not been through our normal software development lifecycle of build and test so are 
+not suitable for production use
+- **You may find bugs:** these are very early iterations of the code - bugs will be present
+- **They may be insecure:** the code has not gone through any security testing, so you may find exposure risk; comprehensive security test 
+will be conducted before production release.
+- **They are unstable:** we will be iterating this code frequently, responding to your feedback. This might lead to instability
+- **Data Integrity:** there is a small risk of data loss or corruption. We strongly recommend backing up important information regularly
+- **APIs and Configuration Changes:** the lab release product may undergo interface and configuration changes, as well as API contract alterations, 
+as part of ongoing development and refinement efforts
+- **Documentation could be limited:** we will endeavor to document the proof of concepts, but we may miss things
+- **User Experience:** The user experience might not be finalized. Some features might only be accessible through API calls
+- **Limited Support:** official support is not available for lab products. We encourage reporting any issues or feedback directly through any of the following channels: 
+  - [Tyk Public Issues Tracker](https://github.com/TykTechnologies/tyk/issues/new/choose)
+  - [Tyk Community Forum](https://community.tyk.io/)
+  - Contact your Account Manager directly.
+ 
+Your insight and feedback are paramount to us, that is why we make lab releases available. But, by using Tyk Lab Release, (a product that is in a lab phase) you acknowledge these conditions. You also agree that Tyk will not be liable for any losses or damages caused in connection with the usage of Lab Release unless the relevant losses or damages are due to our fraud, willful misconduct or gross negligence. This limitation does not apply to limitations that cannot be limited by law.
+
+**Thank you for your understanding and cooperation**
diff --git a/developer-support/release-types/long-term-support.mdx b/developer-support/release-types/long-term-support.mdx
new file mode 100644
index 0000000000..c8a38485e1
--- /dev/null
+++ b/developer-support/release-types/long-term-support.mdx
@@ -0,0 +1,208 @@
+---
+title: "Long Term Support Release"
+description: "Long Term Releases and how we support them"
+keywords: "Long Term Support, LTS, Special Release"
+sidebarTitle: "Long Term Support Release"
+---
+
+Welcome to Tyk's Long Term Support (LTS) Releases section. Here, we'll walk you through the practical aspects of how LTS benefits your business. Explore our approach to stability, understand semantic versioning and learn about our compatibility policies. We'll also cover support for non-LTS components and provide links on upgrading and staying informed about new LTS releases.
+
+### What Makes Long-Term Support (LTS) So Valuable to Our Customers?
+
+Long Term Support describes a release of our Gateway and Dashboard which offers our customers, stability over a 1-2 year period. It also means we are committed to ensuring you have uninterrupted service for the lifetime of the long term release. There are many customer benefits in keeping pace with our long term release:
+
+1. **Stability**: Tyk will always strive to avoid issuing its latest release as a long term support release. Instead, we prefer to let the release be proven in a production setting before it becomes LTS so we can iron out any rare issues.
+2. **Security**: Tyk commits that the latest LTS will be secure at the point of release by containing the latest available Go version. This ensures Go related security issues are minimized.
+3. **Functional Richness**: There will always be great capability contained in out latest LTS which moves your game on in terms of workflows.
+4. **Continuation of Service**: We will patch the LTS version every 8 weeks for the period it remains in full support.
+
+In summary, LTS releases are stable minor or patch releases that are suitable for production use.
+
+
+<Note>
+Our current long term support release is 5.13 LTS. This is in full support from June 2026 to July 2027. This release will enter maintenance support from July 2027 to June 2028. Our next long term support release will be announced end of June 2027.
+</Note>
+
+
+---
+
+### What Is Our LTS Offering?
+
+We provide [full support](#full-support) for the first 12 months, including regular maintenance intervals every eight weeks. Following this period, we transition to [maintenance support](#maintenance-support) for an additional 12 months, focusing on critical fixes and essential security patching as needed.
+
+We release a new Gateway LTS version every 12 months, which includes the [latest stable Golang version](https://go.dev/dl/).
+
+#### Advantages of a 12-Month Long-Term Support (LTS) Cycle
+1. It allows us to keep pace with Golang versions and other key dependency upgrades, which keeps both our customers and your customers safe (low CVE).
+2. It allows us to bring you the best capability whilst offering stability.
+3. It allows us to get great product insight and use that to improve the product.
+
+In case there's a need to operate on a version beyond the established LTS policy, potential assistance may be available. However, this requires a discussion with your designated *Account Manager*.
+
+#### Support Definitions
+
+##### Full Support
+<a id="full-support"></a>
+
+During the full support period, we patch the LTS branch on a regular eight-week cadence. 
+These patches may include any of the following:
+- Security updates
+- Bug fixes
+- UX and UI improvements
+- Any other necessary changes, regardless of severity level.
+
+##### Maintenance Support
+<a id="maintenance-support"></a>
+
+After the initial 12 months of full support, Tyk will release a new LTS version. This means that the previous LTS version now enters maintenance support. In maintenance support, we do not offer regular planned patching. Instead, we will only fix bugs and security issues deemed critical, and this will be a reactive process based on need. If your internal upgrade processes are heavily governed, this may be something you want to take advantage of
+If we find something critical we will react immediately and invoke our critical fix process. Generally critical fixes are expressed as a system down with no workaround, or an urgent security issue.
+
+### Current LTS releases Timeline
+
+| Version | Full Support Window | Maintenance Support Window | Completely Unsupported From |
+| :------ | :------------------ | :------------------------- | :-------------------------- |
+| 5.3 Maintenance LTS | May 2024 - May 2025   | June 2025 - July 2026 | August 2026 |
+| 5.8 Maintenance LTS | May 2025 - June 2026  | July 2026 - June 2027 | July 2027 |
+| 5.13 LTS            | July 2026 - June 2027 | July 2027 - June 2028 | July 2028 |
+| LTS+1 (version TBC) | July 2027 - June 2028 | July 2028 - June 2029 | July 2029 |
+
+---
+
+### What About Non-LTS Gateway Releases?
+
+While these releases are fully supported, their support window is limited. A non-LTS minor version reaches its End-of-Life (EOL) as soon as the next minor version is released.
+
+**For example:**
+- Tyk `v5.1.x` is fully supported until `v5.2.0` is released.
+- Once `v5.2.0` is available, `v5.1.x` is considered End-of-Life and will no longer receive patches or security fixes.
+
+For users who require a longer support window and predictable patching, we strongly recommend using our [LTS releases](#current-lts-releases-timeline).
+
+---
+
+### Major / Minor / Patch - How Do We Decide?
+
+We know that an LTS release that has a major semantic version is not a desirable practice.
+
+So, we will always endeavor to avoid shipping major versions, especially major versions as LTS releases. However, sometimes it is unavoidable and we have to ship a major version. 
+
+Our first commitment to you is to make our definitions of major / minor / patch are transparent:
+
+#### Major Version
+
+The major version is designated as X.0 and is defined by one or more of the following:
+
+1. Breaking changes to Tyk APIs, including Tyk Gateway API, Tyk Dashboard API, MDCB, Tyk EDP, and any other component that exposes APIs. Changes include not just the endpoints, but also behavior and functionality, schemas, input parameters, return error codes, and messages. The APIs are documented and published as an OpenAPI Spec document. In case we need to introduce breaking changes, we will create a new version of the API. However, currently, none of Tyk APIs are versioned.
+2. Breaking changes to Tyk custom plugins interfaces, breaking plugin compiler for customer Go plugins after plugins have been recompiled.
+3. Breaking changes in the config files in all Tyk components, fields in the config files, environment variables used by Tyk components, APIs (function calls) of Tyk middleware, Go template interface.
+4. Deprecation of existing functionalities or engines that break a key business process.
+5. Crypto deprecations.
+6. Changes to common names in certificates.
+
+In summary, breaking changes involves anything with which a user interacts with a Tyk product and might have to make changes to maintain functionality in response to a change we implement. Subsequently, breaking changes are introduced in a major version, in accordance with the *Semantic Versioning* [specification](https://semver.org/).
+
+#### Minor Version
+
+According to the *Semantic Versioning* [specification](https://semver.org/), a MINOR version is incremented when you add functionality in a backward compatible manner. In other words, if Tyk makes changes to your software that do not break any existing functionality, you can increment the MINOR version number. For example, if you add new features or capabilities to your software without changing any existing functionality, you can increase the MINOR version number.
+
+#### Patch Version
+
+A patch, sometimes just called a fix, is a small piece of code that's used to correct a problem, usually called a bug, with an operating system or software program.
+
+Patches are software and Operating System (OS) updates that address security vulnerabilities within a program or product. Tyk may choose to release updates to fix performance bugs, as well as to provide enhanced security features.
+
+---
+
+### Compatibility
+
+Tyk has a few different components that can drive questions on what version of X goes with what version of Y.
+
+When we release a new Gateway version, it triggers us to be clear on version compatibility with other areas of the Tyk stack.
+
+As part of the release of the new Gateway LTS version we will commit to showing everyone two compatibility dimensions:
+
+1. **Recommended releases** - To ensure you get the most out of the latest Tyk experience, we'll provide information on which versions of different components across the entire stack you need.
+2. **Backwards Compatibility** - We'll provide information on what components and versions remain backward compatible with the new Tyk Dashboard and Tyk Gateway versions.
+
+Our next LTS version will be announced in June 2027.
+
+{/* COMMENTED OUT UNTIL LTS ANNOUNCED
+
+The table below shows the recommended compatibility:
+
+| Gateway Version | Recommended Releases | Backwards Compatibility |
+| :---- | :---- | :---- |
+| x.x LTS | MDCB v2.5     | MDCB v2.4.2 |
+|         | Operator v0.17 | Operator v0.16 |
+|         | Sync v1.4.3   | Sync v1.4.3 |
+|         | Helm Chart (tyk-stack, tyk-oss, tyk-dashboard, tyk-gateway) v1.3.0 | Helm all versions |
+| | EDP v1.8.3 | EDP all versions |
+| | Pump v1.9.0 | Pump all versions |
+| | TIB (if using standalone) v1.5.1 | TIB all versions |
+
+The compatibility matrix table shown above will be part of upcoming [Gateway release notes](/developer-support/release-notes/gateway) for versions x.x and beyond. Additionally, these release notes will list tested third-party dependencies like *PostgreSQL, MongoDB, Redis* and more. */}
+
+--- 
+
+### Available Gateway Versions on Cloud
+
+To ensure a consistent and high-quality user experience, we have updated the way Gateway (GW) versions are displayed and supported in the Cloud console. This aligns with our Long-Term Support (LTS) policy and aims to encourage users to stay current with supported versions while reducing operational overhead for our team.
+
+**Version Availability in the Cloud Console**
+When selecting the "Latest" option, users can only choose the latest feature branch ([Gateway Release Notes](/developer-support/release-notes/gateway)).
+
+When selecting the "LTS" option, users will be able to choose from the following:
+- Current LTS version (e.g., 5.13.x): Full support provided, with the latest patch marked as `Recommended`.
+- Extended Support (e.g., 5.8.x): Maintenance support only.
+
+Older versions (e.g., 5.7.x and below) are marked as "Unsupported" and will be greyed out. 
+
+**Implications for Unsupported Versions**
+Users with deployments on unsupported versions (e.g., 5.7.x) will see a notice informing them that their version is "Unsupported".
+
+Unsupported versions are not eligible for bug fixes or feature updates. Users encountering issues will be advised to upgrade to a supported version.
+
+While Tyk Cloud deployments may remain on unsupported versions without a specific upgrade timeline, we may automatically upgrade such deployments in case internal reasons (e.g., infrastructure dependencies, security, or performance risks) require such an action. In this case, Tyk will communicate a timeline for upgrading in advance.
+
+**Upgrade Recommendations**
+Users running deployments on a supported but non-latest version within a branch (e.g., 5.13.0) will see a notice encouraging an upgrade to the "Recommended" version (e.g., 5.13.1).
+
+This ensures users benefit from the latest security patches and improvements within the supported branch.
+
+---
+
+### How Do I Upgrade and How Can Tyk Help?
+
+We have step-by-step install guides for various architectures and installation types. Refer to [upgrading tyk](/developer-support/upgrading) for further details.
+
+And don't forget, our brilliant Customer Success Teams and Account Managers are here to assist you with any issues - pleases refer to your SLA on the specifics of how we can help!
+
+---
+
+### Keep Me Informed!
+
+We release a new LTS version every 12 months. If you want to be alerted about our next LTS release and what capabilities will be released within it, please sign up to our [mailing list](https://pages.tyk.io/long-term-support).
+
+We will release our preliminary communications a month before the new LTS version gets released.
+
+---
+
+### Support Arrangements for Other Tyk Components
+
+We have established a detailed LTS structure for Tyk Gateway and Tyk Dashboard due to their foundational role in our customers’ infrastructure. However, our support strategy for Tyk Pump, Tyk Identity Broker (TIB), MDCB, and Tyk Operator is tailored to reflect their distinct operational aspects and risk profiles, and is deeply integrated with our LTS model.
+
+These components are often more standalone in nature and are subject to infrequent and minor changes compared to the core products. Therefore, aligning them with the same LTS versioning isn’t necessary or practical. Instead, we employ a continuous delivery model that ensures these components are always updated with the latest improvements and security patches. Our commitment extends beyond version numbers, as we ensure each of these components is thoroughly tested for quality assurance with all active LTS releases of the Gateway and Dashboard.
+
+Ultimately, our diversified support approach aims to balance agility with assurance, offering the most appropriate level of support for each component while minimizing risk and maximizing value for our customers.
+To provide the most secure and efficient environment, we advise the following with the release of a new LTS version:
+
+#### Developer Portal
+Continually evolves with frequent updates. We recommend adopting the latest release for optimal performance and feature set, ensuring consistent user experience and accessibility to the newest enhancements.
+
+#### MDCB and Helm
+Receive updates synchronized with the core Gateway and Dashboard to support new features and capabilities. These components are mature and updates typically consist of minor iterations.
+
+#### Pump, TIB, Sync and Operator
+We recommend staying up to date with these components because they are rigorously tested to operate smoothly with the active LTS versions of Tyk Gateway and Tyk Dashboard.
+
+With new releases of Tyk Gateway and Tyk Dashboard LTS versions, our customers should follow the above guidelines to ensure the most secure, stable and efficient environment.
diff --git a/developer-support/support.mdx b/developer-support/support.mdx
new file mode 100644
index 0000000000..d18a3ed423
--- /dev/null
+++ b/developer-support/support.mdx
@@ -0,0 +1,32 @@
+---
+title: "Support SLA"
+description: "Learn about Tyk's flexible support offerings and how your specific entitlements are defined."
+keywords: "Support, SLA, Contract, Order Form, Entitlements"
+sidebarTitle: "Support SLA Policy"
+---
+
+## Commitment to Your Success
+
+At Tyk, we understand that reliable, accessible support is crucial for your operational success when running our API Management platform. We are committed to providing timely and effective assistance to our valued customers.
+
+## Flexible Support Tailored to Your Needs
+
+Tyk provides flexible support options designed to align with varying customer requirements. Our offerings range from standard business hours coverage to comprehensive 24x7x365 support, featuring rapid response Service Level Agreements (SLAs) and dedicated communication channels tailored to the criticality of your deployment.
+
+## Finding Your Specific Entitlements
+
+Because our support packages are designed for flexibility and are often customized, the specific details of your support plan are outlined in your commercial agreement with Tyk.
+
+**Specific entitlements, including:**
+
+- Guaranteed response times based on severity
+- Support coverage hours (e.g., 9x5, 24x7)
+- Available communication channels (e.g., Support Portal, dedicated Slack, phone)
+
+These entitlements will be detailed in your individual Tyk Order Form or Master Services Agreement (MSA).
+
+## Next Steps
+
+- **Prospective Customers / Upgrades:** If you are evaluating Tyk or wish to discuss the available support packages, please contact our [team](https://tyk.io/contact/). They can provide detailed information on the options best suited to your requirements.
+
+---
\ No newline at end of file
diff --git a/developer-support/upgrading.mdx b/developer-support/upgrading.mdx
new file mode 100644
index 0000000000..748ef3e8ad
--- /dev/null
+++ b/developer-support/upgrading.mdx
@@ -0,0 +1,1303 @@
+---
+title: "Tyk Upgrading Guide"
+description: "Tyk upgrade guide for different deployment models and installation types"
+keywords: "configuration files backup, backup tyk, tyk.conf, upgrade tyk, database backup"
+sidebarTitle: "Upgrading Guide"
+---
+
+## Overview
+
+This section provides guides and recommendations for upgrading your Tyk installation.
+
+When upgrading Tyk, consider the following:
+
+1. **Deployment model**: SaaS, Self-Managed, Hybrid, or OSS.
+2. **Installation type**: Docker, Helm, K8S, or various Linux distributions.
+3. **Components**: Depending on your model, upgrade relevant components such as Gateway, Pump, Dashboard, or Go Plugins.
+
+These considerations are reflected in our structured upgrade guides, ensuring you have all the necessary information in one place.
+
+### Tyk Upgrade Standards and Recommendations
+Our upgrade process adheres to the following standards:
+
+- **Breaking changes:** Breaking changes are rare and will be explicitly stated in the release notes.
+- **Configuration files:** Upgrades do not overwrite your configuration files. However, it’s good practice to routinely back up these files (using git or another tool) before upgrading, so any customizations are saved.
+- **Migration scripts:** Migration scripts for your APIs, policies, or other assets are generally not required unless specified in the release notes.
+- **Long Term Support:** Refer to our [versioning and long-term support policies](/developer-support/release-types/long-term-support) for details on major and minor releases, patches, and support dates.
+- **Preparations:** Review the [preparation guidelines](#upgrade-guidelines) before starting the upgrade.
+- **Release notes:** Always check the "Upgrade Instructions" section in the relevant release notes.
+- **Backups:** Follow our [comprehensive backup guide](/developer-support/faq#tyk-configuration) before starting the upgrade.
+- **Docker:** Upgrading with Docker is straightforward - pull the new images from public repositories. Refer to the following links for our releases:
+    - Docker & Kubernetes - Docker Hub - https://hub.docker.com/u/tykio
+    - Helm install - Artifact Hub - https://artifacthub.io/packages/search?repo=tyk-helm
+    - Linux - Packagecloud - https://packagecloud.io/tyk
+
+   The above repositories will be updated when new versions are released.
+- If you experience issues with the new version you pulled, contact Tyk Support or visit [Tyk community forum](https://community.tyk.io/).
+
+### Tyk Upgrade Guides for Different Deployment Models
+Use the table below to find the appropriate upgrade guide for your platform:
+
+| Platform             | Guide            | Description |
+| :---------------------- | :---------------- | :----------- |
+| **Tyk Cloud**        | [Cloud SaaS](#tyk-cloud) | Guide to Tyk Cloud SaaS |
+|                      | [Hybrid](#tyk-hybrid) | Guide for Hybrid environments with Gateway Data Plane(s) deployed locally or with a third-party cloud provider |
+|                      | [Go plugin](#go-plugin) | Guide for upgrading Go plugin on the Tyk Cloud |
+| **Tyk Self-Managed** | [RHEL and CentOS](#upgrade-linux-redhat-centos) | Guide for RPM-based Linux distributions |
+|                      | [Debian and Ubuntu](#upgrade-linux-debian) | Guide for DEB-based Linux distributions |
+|                      | [Docker](#docker) | Guide for upgrading Docker images |
+|                      | [Helm](#helm) | Guide for upgrading Helm Charts |
+|                      | [Kubernetes](#kubernetes) | Guide for upgrading Kubernetes environment |
+| **Tyk MDCB Self-Managed** | [MDCB](#upgrade-mdcb) | Guide for upgrading Multi Data Center Bridge (MDCB) |
+| **Tyk Open-Source**  | [Tyk Gateway](#open-source-upgrade-guide) | Guide for upgrading Tyk open-source environment |
+
+### Supporting Tools
+Tyk offers supporting tools for database migration and backing up APIs and policies.
+
+##### Migrating from MongoDB to SQL
+
+Use our [migration tool](/planning-for-production/database-settings#migrating-from-an-existing-mongodb-instance) to manage the switch from MongoDB to SQL.
+
+##### Backup APIs Script
+
+Utilize our bash [backup script](/developer-support/upgrading#backup-apis-and-policies) to export and restore all Tyk API Definitions and Policies.
+
+## Preparations
+
+### Upgrade Guidelines
+
+When considering upgrading your current configuration to a new Tyk release, we recommend you consider the following:
+
+#### Upgrade strategy
+
+Which strategy do you intend to use?
+
+  - If following the [Blue-Green upgrade](#blue-green-upgrade) strategy, has the green environment been configured and verified as production-ready?
+  - If pursuing the [Rolling upgrade](#rolling-upgrade) strategy, do all Tyk components have a second instance?
+  - If you'll have downtime, estimate the expected duration of the upgrade process and plan for potential downtime.
+
+#### Backups
+Have backups been performed?
+
+  - Databases: Have databases been properly backed up?
+  - configuration files: Have you safely backed up these files (using version control system such as *git*)?
+  - Testing: Have you tested the backups to verify they can be successfully restored in a separate environment?
+  - Backup guide: Have you checked our [comprehensive guide for backing up Tyk](/developer-support/faq#tyk-configuration)?
+
+#### Go plugins
+Do you use custom Go plugins with your APIs?
+
+  - Go plugin must be [recompiled](#go-plugins-upgrade-guide) for the new version.
+  - Identify all Go plugins in use with all your API definitions.
+  - Allow sufficient time for testing and troubleshooting Go plugins after the upgrade.
+
+#### Linux users
+Which Linux distributions are currently in use?
+
+- Was Tyk deployed via a repository or a local package file `.rpm` (used be *CentOS* and *RHEL*) or `.deb` (*Debian*
+    and its derivative *Ubuntu*)?
+- Is the targeted version available on [packagecloud.io/tyk](https://packagecloud.io/tyk) or in an intended repository?
+
+#### Communication
+Communicate with stakeholders and users about the upgrade schedule and expected impact on services.
+
+#### Upgrade Checklist:
+
+  - Choose an upgrade strategy or manage downtime
+  - Check Linux distribution and Tyk version availability
+  - Perform and test backups
+  - Identify and plan for custom Go plugin recompilation and testing
+  - Communicate with stakeholders
+
+#### Next Steps
+
+Use the [Upgrade Guides ToC](#tyk-upgrade-guides-for-different-deployment-models) to choose the appropriate upgrade guide for
+your platform.
+
+### Upgrade Strategies
+
+Tyk is compatible with both rolling and blue-green upgrade strategies.
+
+#### Rolling Upgrade
+
+A rolling upgrade updates servers incrementally rather than simultaneously. This approach helps reduce application downtime and mitigates the risk of unforeseen consequences or errors during software updates.
+
+**Steps for Rolling Upgrade:**
+1. **Redundancy:** Ensure there are at least two instances of each Tyk component that needs upgrading.
+2. **Load Balancer:** Use a load balancer to distribute traffic for the Dashboard and Gateway components, ensuring continuous availability during the upgrade process. Note that the Pump operates with one-way traffic and does not require load balancing.
+3. **Upgrade Process:**
+   - Direct traffic to one instance while upgrading the other.
+   - Once the first instance is upgraded, switch traffic to it and upgrade the remaining instance.
+   - After both instances are upgraded, configure the load balancer to route traffic to both instances simultaneously.
+
+#### Blue-Green Upgrade
+
+A blue-green deployment involves two identical production environments, labeled blue and green. At any time, only one environment is live and serving traffic, while the other is inactive. For example, if the blue environment is live, the green environment will be inactive, and vice versa.
+
+**Steps for Blue-Green Upgrade:**
+1. **Replication:** Replicate the entire environment into a separate environment.
+2. **Traffic Routing:** Use a load balancer or DNS to route traffic to the green environment (current production) while the blue environment undergoes the upgrade.
+3. **Upgrade Process:**
+   - A VM snapshot is a recommended method for replication, but other methods, such as a new deployment process, can also be used.
+   - If using a new deployment process, follow the [deployment instructions](/tyk-self-managed) appropriate for your platform.
+4. **Switch Environments:** Once the upgrade is complete, switch the traffic to the upgraded environment.
+
+<Warning>
+**Use the Same License Across All Tyk Dashboard Instances**
+
+During rolling and blue-green upgrades, you can temporarily run more than one Tyk Dashboard instance against the same Redis and database backend. Every Dashboard instance connected to a shared Redis or database **must use the same license key**.
+
+A Tyk Dashboard license defines the pool of gateway nodes that the Dashboard is allowed to register. If two instances share the same Redis but run different licenses, one Dashboard can reject gateways that were registered against the other license. Gateway registration then fails with an HTTP 404 response, and the Dashboard logs `level=error msg="GetSpareNode returned node not allowed by this dashboard's license"`. As a result, gateways cannot register, which causes 404 responses and prevents API creation.
+
+Before you upgrade, confirm that the old and new Dashboard instances use the same license, and apply any license change to every instance at the same time. For more detail, see [Connecting Multiple Gateways to a Single Dashboard](/planning-for-production#connecting-multiple-gateways-to-a-single-dashboard) and [Troubleshooting](/api-management/troubleshooting-debugging#dashboard).
+</Warning>
+
+
+## Deployment Model
+
+### Tyk Cloud Upgrade Guide
+
+#### Tyk Cloud
+
+**Preparations**
+
+Before proceeding with the upgrade process, ensure that you have thoroughly reviewed and completed the steps outlined in
+the [upgrade guidelines](#upgrade-guidelines).
+Once you have adequately prepared, follow the instructions below to upgrade your Tyk components and plugins in this specified order. Adhering to the provided sequence is crucial for a smooth and successful upgrade.
+
+**Step 1. Upgrade Control Plane**
+
+Follow our guide for [upgrading Cloud Control Planes](/tyk-cloud/environments-deployments/managing-control-planes#upgrade-cloud-control-planes).
+
+**Step 2. Upgrade Go Plugins**
+
+Follow our guide for deploying your [Go plugins on Tyk Cloud](#go-plugin). Subsequently, follow the steps below according to the target upgrade version of the Gateway.
+
+**Gateway Versions < 4.1.0.**
+
+1. Proceed with [upgrading your Tyk Data Plane (Gateway)](#upgrading-cloud-data-planes)
+2. Update the [custom_middleware_bundle](/api-management/plugins/overview#plugin-bundles) field in the API Definitions of all APIs that use your plugin. The field should be updated to use the new bundle file containing your upgrade plugin.
+3. Validate that your plugin is working per your expectations.
+
+**Gateway Versions >= 4.1.0**
+
+1. Update the [custom_middleware_bundle](/api-management/plugins/overview#plugin-bundles) field in the API Definitions of all APIs that use your plugin. The field should be updated to use the new bundle file containing your upgraded plugin.
+
+2. Validate that your plugin is working per your expectations as at this stage, your Gateway will be running the plugin for your current version still.
+
+  
+
+    <Note>
+    This step is a sanity check to catch any potential issues with the bundle for the current version and will ensure that any requests that your Gateway processes prior to being upgraded are able to invoke the plugin as you expect.
+    </Note>
+
+
+3. Proceed with [upgrading your Tyk Data Plane (Gateway)](#upgrading-cloud-data-planes). Given that you loaded your target version plugin in step 1, this version will be loaded automatically once you upgrade.
+4. Validate that your plugin is working per your expectations, as the Gateway now should have loaded the plugin for the target version automatically.
+
+###### Step 3. Upgrade Cloud Data Plane
+<a id="upgrading-cloud-data-planes"></a>
+
+Follow our guide for [upgrading Cloud Data Planes](/tyk-cloud/environments-deployments/managing-gateways).
+
+**Upgrade Guide Video**
+Please refer to our [upgrade guide video](https://youtu.be/2rzU8YdKKFM) below for visual guidance:
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/2rzU8YdKKFM" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+#### Tyk Hybrid
+
+A Hybrid SaaS deployment is a shared responsibility model where Tyk is responsible for hosting the Control Plane while the client is responsible for hosting their Data Plane, be it hosted on a public cloud provider or on their own infrastructure.
+
+The **control plane** includes the following components:
+- Tyk Dashboard
+- Tyk Control Plane
+- MDCB
+- MongoDB
+- Redis (Master Instance)
+
+The **self-managed data plane** includes the following components:
+- Hybrid Gateway(s) 
+- Redis instance 
+- Tyk Pump (optional)
+
+After following the guidelines for [preparing for upgrade](#upgrade-guidelines),
+follow the instructions below to upgrade your self-managed Tyk components and plugins.
+
+
+**Upgrade Order**
+
+1. Upgrade the control plane on Tyk Cloud
+2. Upgrade your Tyk self-managed data plane. When upgrading your data plane, upgrade the components in the
+following order:
+   1. Go Plugins (if applicable)
+   2. Hybrid Pump (if applicable)
+   3. Hybrid Gateway(s)
+
+**Step 1. Upgrade your control plane**
+
+See Tyk Guide for how to [upgrade Control Planes](/tyk-cloud/environments-deployments/managing-control-planes#upgrade-cloud-control-planes)
+
+**Step 2 Upgrade Go plugins**
+
+Follow our guide for [upgrading your Go plugins on Tyk Cloud](#go-plugin). Subsequently, follow the steps below according to the target upgrade version of the Gateway.
+
+**Gateway Versions < 4.1.0**
+
+1. Proceed with upgrading your [Tyk Data Plane Hybrid Gateways](#upgrading-data-plane-hybrid-gateways).
+2. Update the [custom_middleware_bundle](/api-management/plugins/overview#plugin-bundles)
+field in the API Definitions of all APIs that use your plugin. The field should be updated to use the new bundle file
+containing your upgrade plugin.
+3. Validate that your plugin is working per your expectations.
+
+**Gateway Versions >= 4.1.0**
+
+1. Update the [custom_middleware_bundle](/api-management/plugins/overview#plugin-bundles)
+field in the API Definitions of all APIs that use your plugin. The field should be updated to use the new bundle file
+containing your upgraded plugin.
+2. Validate that your plugin is working per your expectations as at this stage, your Gateway will be running the plugin
+for your current version still.
+
+  
+<Note>
+This step is a sanity check to catch any potential issues with the bundle for the current version and will ensure that any requests that your Gateway processes prior to being upgraded are able to invoke the plugin as you expect.
+</Note>
+
+
+3. Proceed with upgrading your [Tyk Data Plane Hybrid Gateways](#upgrading-data-plane-hybrid-gateways). Given that you
+loaded your target version plugin in step 1, this version will be loaded automatically once you upgrade.
+4. Validate that your plugin is working per your expectations.
+
+###### Step 3. Upgrade your Tyk Data Plane Hybrid Gateway(s)
+<a id="upgrading-data-plane-hybrid-gateways"></a>
+
+Follow the instructions for the component deployment type:
+
+- [Docker](#docker)
+- [Helm](#helm)
+- [Linux Debian](#upgrade-linux-debian)
+- [Linux RHEL/CENTOS](#upgrade-linux-redhat-centos)
+
+**Upgrade Guide Video**
+
+Please refer to our [video](https://youtu.be/HfiLSRBdrfs) for further support with upgrading Tyk Self-Managed (RPM).
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/HfiLSRBdrfs" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+#### Go Plugin
+
+This guide explains how to deploy your custom Go plugins on Tyk Cloud:
+1. Navigate into the plugins directory that contains your Go module
+2. [Compile your custom Go plugins](#go-plugins-upgrade-guide).
+3. Use the table below to follow the deployment process for the version of Tyk you are upgrading to:
+
+| Path | Current Version | Target Version |
+| :--- | :--- | :--- |
+| [Path 1](#path-1)    | < 4.1.0 | < 4.1.0 |
+| [Path 2](#path-2)    | >= 4.1.0 | >= 4.2.0 |
+
+**Path 1 - Current Version < 4.1.0 and Target Version < 4.1.0**
+
+1. [Create a plugin bundle](/api-management/plugins/overview#plugin-bundles) that includes the newly compiled version
+
+    <img src="/img/developer-support/path1-step5-bundle-contents.png" alt="Bundle ZIP example" width="800" />
+
+    Your manifest.json will look something like this:
+
+    ```json
+    {
+      "file_list": [
+          "CustomGoPlugin.so"
+      ],
+      "custom_middleware": {
+        "pre": [
+        {
+          "name": "AddHeader",
+          "path": "CustomGoPlugin.so",
+          "require_session": false,
+          "raw_body_only": false
+        }],
+        "driver": "goplugin",
+        "id_extractor": {
+        "extract_from": "",
+        "extract_with": "", 
+        "extractor_config": {}}
+      },
+      "checksum": "",
+      "signature": ""
+    }
+    ```
+
+2. [Upload this bundle](/tyk-cloud/using-plugins#uploading-your-bundle) to your configured S3 bucket if using Cloud SaaS. If you're using Hybrid SaaS, upload this bundle to your bundle server.
+
+
+**Path 2 - Current `Version >= 4`.1.0 and Target `Version >= 4`.2.0**
+
+1. [Create a plugin bundle](/api-management/plugins/overview#plugin-bundles) that includes both your current version’s plugin along with the newly compiled version
+
+    <img src="/img/developer-support/path2-step5-bundle-contents.png" alt="Bundle ZIP example" width="800" />
+    
+    Your `manifest.json` will look something like this:
+
+    ```json
+    {
+      "file_list": [
+          "CustomGoPlugin.so",
+          "CustomGoPlugin_v4.3.3_linux_amd64.so"
+      ],
+      "custom_middleware": {
+        "pre": [
+        {
+          "name": "AddHeader",
+          "path": "CustomGoPlugin.so",
+          "require_session": false,
+          "raw_body_only": false
+        }],
+        "driver": "goplugin",
+        "id_extractor": {
+          "extract_from": "",
+          "extract_with": "", 
+          "extractor_config": {}
+        }
+      },
+      "checksum": "",
+      "signature": ""
+    }
+    ```
+    In this example -
+    - the *CustomGoPlugin.so* in the file list would be the filename of the plugin you're using with your
+    current version.  You will already have this file available as this is what has been running in your environment.
+    - The *CustomGoPlugin_v4.3.3_linux_amd64.so* file represents the plugin compiled for the target version.
+    - *“_v4.3.3_linux_amd64”* postfix is generated automatically by the compiler. If your target version was 5.2.0,
+    then *“_v5.2.0_linux_amd64”* would be appended to the shared object filename that the compiler creates
+    - Your bundle zip file should include both the current version and target versions of the plugin.
+
+2. [Upload this bundle](/tyk-cloud/using-plugins#uploading-your-bundle) to your configured S3 bucket if using Cloud SaaS. If you're using Hybrid SaaS, upload this bundle to your bundle server.
+
+
+### Tyk Self-Managed Upgrade Guide 
+
+**Preparations**
+
+Before proceeding with the upgrade process, ensure that you have thoroughly reviewed and completed the steps outlined in
+the [upgrade guidelines](#upgrade-guidelines).
+Once you have adequately prepared, follow the instructions below to upgrade your Tyk components and plugins in this specified order. Adhering to the provided sequence is crucial for a smooth and successful upgrade.
+
+**Upgrade Order**
+
+In a production environment where the Dashboard, Gateway, and Pump are installed on separate machines, you should always upgrade components in the following sequence:
+
+1. Tyk Dashboard
+2. Tyk Gateway
+3. Tyk Pump
+
+###### Upgrade order with Multi Data Center Bridge (MDCB)
+<a id="upgrade-mdcb"></a>
+
+For Enterprise customers, the Tyk control plane contains all the standard components of a Self-Managed installation with
+the addition of the [Multi Data Center Bridge](/api-management/mdcb) (MDCB).
+
+Our recommended sequence for upgrading a self-managed MDCB installation is as follows:
+
+**Stage 1: Upgrade the components of the **Tyk control plane** in this order:**
+
+1. MDCB
+2. Tyk Pump (if applicable)
+3. Tyk Dashboard
+4. Tyk Gateway
+
+**Stage 2: Next, upgrade the components in **Tyk data planes**, in this order:**
+
+1. Go Plugins (if applicable)
+2. Tyk Pump (if applicable)
+3. Tyk Gateway
+
+This sequence of control plane first and data plane second ensures:
+1. Forward compatibility - that we don't have [forward-compatibility](https://en.wikipedia.org/wiki/Forward_compatibility#:~:text=Forward%20compatibility%20for%20the%20older,format%20of%20the%20older%20system.)
+issues of the new Gateway using the old MDCB.
+2. Connectivity issues - It's extremely fast to see if there are connectivity issues and gateways (in Hybrid mode) will
+continue to function even if disconnected from their control plane.
+
+###### MCP Gateway (v5.13+)
+<a id="mcp-upgrade-considerations"></a>
+
+Tyk v5.13 introduces MCP Gateway, which adds specific ordering requirements on top of the standard upgrade sequence above. These apply only to deployments that will use MCP Gateway functionality.
+
+**Self-managed (no MDCB)**
+
+No additional ordering requirements. Tyk Pump writes MCP analytics directly to your configured storage backend (MongoDB or SQL). The standard Dashboard → Gateway → Pump upgrade order applies.
+
+**Distributed deployments**
+
+The standard MDCB-first ordering applies with one additional requirement: the `enable_mcp_aggregation` flag on Tyk Pump must remain `false` during the upgrade and only be enabled once all components are on the new version.
+
+This flag tells the Hybrid Pump to send MCP analytics to MDCB using the new `PurgeAnalyticsDataMCPAggregated` RPC. If you enable it before MDCB is running the new version, the RPC calls will fail and MCP analytics records will be silently dropped.
+
+The correct sequence for upgrading distributed deployments is:
+
+1. Upgrade MDCB.
+2. Upgrade Tyk Pump — with `enable_mcp_aggregation` still set to `false`.
+3. Upgrade Tyk Gateway and Tyk Dashboard.
+4. Only now set `enable_mcp_aggregation: true` on every Hybrid Pump and restart.
+
+<Warning>
+Do not set `enable_mcp_aggregation: true` before MDCB is running the new version. Doing so in a distributed deployment will cause RPC failures and silent loss of MCP analytics data.
+</Warning>
+
+The `enable_mcp_aggregation` flag is **not required** for single-DC self-managed deployments (no MDCB in the analytics path) or for Tyk Cloud (no customer-side Pump).
+
+**Tyk Operator**
+
+If you use [Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator) to manage API definitions via `TykMCPProxyDefinition` custom resources, deploy the new Operator version only *after* Tyk Dashboard and Tyk Gateway are running the new version. The Operator controller calls the Dashboard `/api/mcps` endpoint, which only exists from v5.13 onwards. Deploying the Operator first will cause reconciliation failures on all MCP custom resources.
+
+**Tyk Developer Portal**
+
+If your deployment includes the [Tyk Developer Portal](/portal/overview/getting-started), upgrade Portal before or at the same time as Tyk Dashboard, and definitely before creating any MCP Proxy policies in the Dashboard. From v1.17.2, Portal prevents MCP Proxy policies from appearing as API Products in the Developer Portal so that they cannot accidentally be exposed in Catalogs. An older Portal version running against a new Dashboard with MCP Proxy policies configured will surface those policies which could then be exposed to API Consumers who will not be able to consume them.
+
+**Tyk Cloud**
+
+Tyk Cloud does not run a customer-side Pump — MCP analytics are written directly by the Gateway and MDCB to the managed store. The deployment order is:
+
+1. MDCB
+2. Tyk Gateway and Tyk Dashboard
+3. Tyk Operator (if used) — after Dashboard is running
+4. Tyk Developer Portal — before MCP Proxy policies are created in Dashboard
+
+There is no `enable_mcp_aggregation` flag to configure in a Cloud deployment.
+
+#### Upgrade guides
+We provide upgrade guides for Linux, Docker, Helm and K8S. To continue the upgrade process, please refer to the relevant installation guide under this section.
+
+#### Docker
+
+**Step 1. Upgrade Tyk Dashboard**
+
+Upgrading *Tyk Dashboard* is the same as *Tyk Gateway* just with the name of the docker image of tyk dashboard `tykio/tyk-dashboard`. Please check the instructions for Tyk Gateway in the next section.
+
+**Step 2. Upgrade Tyk Gateway and Tyk Pump**
+
+Follow our [Tyk OSS guide](#go-plugins-upgrade-guide) for upgrading Tyk Gateway and Tyk Pump
+
+#### Helm
+
+
+<Note>
+**Upgrade instructions for *Tyk Dashboard*, *Tyk Pump* and *MDCB***
+
+The instruction below refer to upgrading *Tyk Gateway*. You can follow the same steps for *Tyk Dashboard*, *Tyk Pump*
+and *MDCB*.
+</Note>
+
+
+**Upgrade Tyk Gateway**
+
+1. Backup your gateway config file (`tyk.conf` or the name you chose for it), `.env` and `values.yaml`. Even if you’re using the environment variables from the `values.yaml` to define your configuration, there still might be a config
+file used and loaded with field values you rely on.
+2. Backup your `.env` and `values.yaml`
+3. Update the image version in your values.yaml
+   <br />
+   For example, in this [values.yaml](https://github.com/TykTechnologies/tyk-charts/blob/83de0a184014cd027ec6294b77d034d6dcaa2a10/components/tyk-gateway/values.yaml#L142)
+   change the version of the tag `tag: v5.3` to the version you want.
+4. Run `Helm upgrade` with your relevant `values.yaml` file/s.
+   <br />
+   Check the [helm upgrade docs](https://helm.sh/docs/helm/helm_upgrade/) for more details on the `upgrade` command.
+
+#### Kubernetes
+
+
+<Note>
+**Upgrade instructions for *Tyk Dashboard*, *Tyk Pump* and *MDCB***
+
+The instruction below refer to upgrading *Tyk Gateway*. You can follow the same steps for *Tyk Dashboard*, *Tyk Pump*
+and *MDCB*.
+</Note>
+
+
+
+**Simple Kubernetes Environment Upgrade**
+
+When upgrading a non-production environment, where it's okay to have a brief downtime and you can simply restart your
+gateways, the upgrade is trivial as with any other image you want to upgrade in Kubernetes:
+
+In a similar way to docker:
+1. Backup your gateway config file (`tyk.conf` or the name you chose for it)
+2. Update the image version in the manifest file.
+3. Apply the file/s using kubectl
+
+```console
+$ kubectl apply -f .
+``` 
+You will see that the deployment has changed.
+
+Now you can check the gateway pod to see the latest events (do `kubectl get pods` to get the pod name):
+    
+```console
+$ kubectl describe pods <gateway pod name>
+```
+You should see that the image was pulled, the container got created and the gateway started running again, similar to the following output:
+
+```bash
+Events:
+  Type    Reason     Age   From               Message
+  ----    ------     ----  ----               -------
+  Normal  Scheduled  118s  default-scheduler  Successfully assigned tyk/tyk-gtw-89dc9f554-5487c to docker-desktop
+  Normal  Pulling    117s  kubelet            Pulling image "tykio/tyk-gateway:v5.0"
+  Normal  Pulled     70s   kubelet            Successfully pulled image "tykio/tyk-gateway:v5.0" in 47.245940479s
+  Normal  Created    70s   kubelet            Created container tyk-gtw
+  Normal  Started    70s   kubelet            Started container tyk-gtw
+```
+
+4. Check the log to see that the new version is used and if the gateway is up and running
+```console
+$ kubectl logs service/gateway-svc-tyk-gateway-tyk-headless --tail=100 --follow 
+Defaulted container "gateway-tyk-headless" out of: gateway-tyk-headless, setup-directories (init)
+time="Jul 17 20:58:27" level=info msg="Tyk API Gateway 5.1.0" prefix=main
+...
+```
+5. Check the gateway is healthy
+```console
+$ curl  localhost:8080/hello | jq .
+{
+  "status": "pass",
+  "version": "5.1.0",
+  "description": "Tyk GW",
+  "details": {
+    "redis": {
+      "status": "pass",
+      "componentType": "datastore",
+      "time": "2023-07-17T21:07:27Z"
+    }
+  }
+}
+```
+
+**Production Kubernetes Environment Upgrade**
+
+For production environments, it is recommended to use [Helm charts](#helm) to manage upgrades with zero downtime.
+
+When upgrading Kubernetes Deployments, you should use a `RollingUpdate` strategy to ensure zero downtime. For more information on upgrade strategies, see the [Upgrade Strategies](#upgrade-strategies) section.
+
+**Upgrade Tyk K8S Demo deployment**
+
+1. In the [Tyk k8s Demo](https://github.com/TykTechnologies/tyk-k8s-demo/blob/main/README.md) repo, change the version in [.env file](https://github.com/TykTechnologies/tyk-k8s-demo/blob/893ce2ac8b13b4de600003cfb1d3d8d1625125c3/.env.example#L2), `GATEWAY_VERSION=v5.1` to the version you want
+2. Restart the deployment
+3. Check the log file
+
+#### Linux - Debian
+<a id="upgrade-linux-debian"></a>
+
+The following guide explains how to upgrade Tyk Self-Managed running on Debian
+
+**Upgrade Guide Video**
+
+Please refer to our [upgrade guide video](https://youtu.be/dx1tcsbo3F8) below for visual guidance of
+upgrading Tyk Self-Managed (DEB).
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/dx1tcsbo3F8" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+**Preparations**
+
+After reviewing guidelines for [preparing for upgrade](#upgrade-guidelines),
+follow the instructions below to upgrade your Tyk components and plugins.
+
+**Upgrade order:**
+
+Please note that upgrade order is as explained in the upgrade [overview](#tyk-self-managed-upgrade-guide)
+
+**Distro versions**
+
+Tyk supports the following version for *Debian* and its derivative *Ubuntu*:
+
+| Distribution | Version | 
+| :-------------- | :--------- |
+| Debian       | 11      |
+| Ubuntu       | 20      |
+| Ubuntu       | 18      |
+| Ubuntu       | 16      | 
+
+Our repositories will be updated at https://packagecloud.io/tyk when new versions are released.
+
+During the initial deployment of Tyk, your team may have utilized APT repositories or directly downloaded the .deb files. To verify the presence of APT repositories on the server, inspect the following locations:
+
+- Dashboard: `/etc/apt/sources.list.d/tyk_tyk-dashboard.list`
+- Gateway: `/etc/apt/sources.list.d/tyk_tyk-gateway.list`
+- Pump: `/etc/apt/sources.list.d/tyk_tyk-pump.list`
+
+If the above files are not present, it could be worth checking internally that the initial deployment was done by manually downloading and installing the .deb files. This is common in airtight environments without internet access.
+
+**Verify Target Package Availability**
+
+Depending on the Linux distribution that you are using, ensure that you are pulling the correct version and distribution
+from the [packagecloud.io/tyk](https://packagecloud.io/tyk) repository.
+
+The package name contains the version number and the distro/version column displays the specific distribution release.
+
+<img src="/img/upgrade-guides/deb_packages.png" alt="Package names" />
+
+##### Backups
+
+**Configuration files:**
+
+Please take a backup of the below configuration files of each Tyk component. This will be useful in case you need to cross-reference configuration changes or need to roll back your deployment. 
+
+- Dashboard Configuration File: `/opt/tyk-dashboard/tyk_analytics.conf`
+- Gateway Configuration File: `/opt/tyk-gateway/tyk.conf`
+- Pump Configuration File: `/opt/tyk-pump/pump.conf`
+
+**Databases**
+
+
+<Note>
+Redis and MongoDB are not Tyk products and what we provide here are basic backup and restore instructions. It is advisable to consult the official documentation for Redis and MongoDB on backups.
+</Note>
+
+
+**Redis**
+
+For more detailed instructions on managing Redis backups, please refer to the official Redis documentation:
+https://redis.io/docs/management/persistence/
+
+The Redis SAVE command is used to create a backup of the current redis database. The SAVE command performs a synchronous save of the dataset producing a point-in-time snapshot of all the data inside the Redis instance, in the form of an RDB file.
+
+```bash
+# Using SAVE, if the previous dump.rdb file exists in the working directory, it will be overwritten with the new snapshot
+
+SAVE
+```
+
+**Example - SAVE**
+
+<img src="/img/upgrade-guides/redis_save.png" alt="Redis SAVE example" width="600" height="auto" />
+
+To restore Redis data, follow these steps:
+
+- Move the Redis backup file (dump.rdb) to your Redis directory.
+- Start the Redis server
+
+To locate your Redis directory, you can use the CONFIG command. Specifically, the CONFIG GET command allows you to read
+the configuration parameters of a running Redis server.
+
+**Example - CONFIG**
+
+<img src="/img/upgrade-guides/redis_config.png" alt="Redis CONFIG example" width="600" height="auto" />
+
+**MongoDB**
+
+For detailed instructions on performing backups in MongoDB, please refer to the official MongoDB documentation:
+https://www.mongodb.com/docs/manual/core/backups/
+
+To capture a snapshot of a MongoDB database from a remote machine and store it locally, utilize the mongodump command on the primary node. Specify the host and port number (default is 27017) of the remote server, along with additional parameters such as the database name, user credentials and password. Lastly, designate the directory where the snapshot should be created.
+
+```bash
+mongodump --db tyk_analytics --out /path/to/dump/directory
+```
+
+**Example**
+
+<img src="/img/upgrade-guides/mongo_dump.png" alt="Mongo DUMP example" height="600" />
+
+To restore a database using a previously saved snapshot, simply employ the mongorestore command.
+
+```bash
+mongorestore --host <hostname> --port <port> --username <username> --password <password> /path/to/dump/directory
+```
+
+**Steps for Upgrading Tyk Packages**
+
+Before executing the upgrade, ensure that you have consulted and performed all the necessary steps in the [pre-upgrade checklist](#upgrade-guidelines).
+
+**Step 1. Update Tyk Repositories**
+
+Fetch and update information about the available packages from the specified repositories. 
+
+```bash
+sudo apt-get update
+```
+
+**Step 2. Verify availability of target upgrade packages**
+
+List current versions of Tyk using the command below:
+
+```bash
+dpkg -l | grep -i tyk
+```
+
+**Example**
+
+<img src="/img/upgrade-guides/check_packages.png" alt="Check packages" height="600" />
+
+List available versions of upgradable packages of Tyk components and ensure that the version you are planning to upgrade to is listed in the output of the above command.
+
+```bash
+apt list -a 'tyk*'
+```
+
+**Example**
+
+<img src="/img/upgrade-guides/list_packages.png" alt="List packages example" width="600" />
+
+**Step 3. Upgrade Tyk Components**
+
+**Note:** Please specify the exact version you are upgrading into.
+
+```bash
+sudo apt-get install tyk-dashboard=<desired-version>
+```
+
+```bash
+sudo apt-get install tyk-gateway=<desired-version>
+```
+
+```bash
+sudo apt-get install tyk-pump=<desired-version>
+```
+
+**Example**
+
+<img src="/img/upgrade-guides/install_deb.png" alt="apt-get install example" width="600" height="auto" />
+
+**Step 4. Restart Components**
+
+After upgrading Tyk, restart the services
+
+```bash
+# Restart Services
+systemctl restart tyk-dashboard
+systemctl restart tyk-gateway
+systemctl restart tyk-pump
+
+# Check status of Tyk Components
+systemctl status tyk-dashboard
+systemctl status tyk-gateway
+systemctl status tyk-pump
+```
+
+**Step 5. Health check on upgraded Tyk components**
+
+Perform a health-check on all 3 Tyk Components. The host and port number varies on your setup.
+
+**Tyk Dashboard**
+
+```curl
+curl http://localhost:3000/hello
+```
+
+**Tyk Gateway**
+
+```curl
+curl http://localhost:8080/hello
+```
+
+**Tyk Pump**
+
+```curl
+curl http://localhost:8083/health
+```
+
+##### Reverting the Upgrade
+
+If the upgrade fails you can revert to the old version by following the steps below.
+
+**Step 1. Inspect package logs**
+
+In case the upgrade fails for some reason, you can use the command below to check your history of package installs:
+
+```bash
+cat /var/log/apt/history.log
+```
+
+**Step 2. Revert**
+
+Manually reverting to a previous version can be done by installing or uninstalling a package. For instance, to roll back to the previous version, you can use this command:
+
+```bash
+sudo apt-get install tyk-dashboard=<previous version>
+```
+
+
+<Note>
+These commands are provided as general guidelines and should be used with caution. It's advisable to consult with your system administrator or seek assistance from a qualified professional before executing any system-level commands
+</Note>
+
+
+#### Linux - RedHat (CentOS)
+<a id="upgrade-linux-redhat-centos"></a>
+
+The following guide explains how to upgrade Tyk Self-Managed running on RHEL
+
+
+**Upgrade guide video**
+
+Please refer to our [upgrade guide video](https://youtu.be/Dm_lboEOm6w) below for visual guidance of
+upgrading Tyk Self-Managed (RPM).
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/Dm_lboEOm6w" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+---
+
+**Preparations**
+
+After reviewing guidelines for [preparing for upgrade](#upgrade-guidelines),
+follow the instructions below to upgrade your Tyk components and plugins.
+
+**Upgrade order:**
+Please note that upgrade order is as explained in the upgrade [overview](#tyk-self-managed-upgrade-guide)
+
+**Distro versions**
+
+Tyk supports the following Centos and Rhel distributions:
+
+| Distribution | Version |
+| :-------------- | :--------- |
+| Centos       | 7       |
+| Rhel         | 9       |
+| Rhel         | 8       |
+| Rhel         | 7       |
+
+Our repositories will be updated at https://packagecloud.io/tyk when new versions are released.
+
+During the initial deployment of Tyk, your team may have utilized YUM repositories or directly downloaded the .rpm files. To verify the presence of YUM repositories on the server, inspect the following locations:
+
+- Dashboard: `/etc/yum.repos.d/tyk_tyk-dashboard.repo`
+- Gateway: `/etc/yum.repos.d/tyk_tyk-gateway.repo`
+- Pump: `/etc/yum.repos.d/tyk_tyk-pump.repo`
+
+If the above files are not present, it is worthwhile checking internally that the initial deployment was done by manually downloading and installing the .rpm files. This is common in airtight environments without internet access.
+
+**Verify Target Package Availability**
+
+Depending on the Linux distribution that you are using, ensure that you are pulling the correct version and distribution from the [packagecloud.io/tyk](https://packagecloud.io/tyk) repository.
+
+The package name contains the version number and the distro/version column displays the specific distribution release.
+
+<img src="/img/upgrade-guides/rpm_packages.png" alt="Package names" />
+
+##### Backups
+
+Before upgrading, ensure that the configuration files and databases are backed up.
+
+**Configuration files**
+
+Please take a backup of the following configuration files for each Tyk component. This will be useful in case you need to cross-reference configuration changes or need to roll back your deployment. 
+
+- Dashboard Configuration File: `/opt/tyk-dashboard/tyk_analytics.conf`
+- Gateway Configuration File: `/opt/tyk-gateway/tyk.conf`
+- Pump Configuration File: `/opt/tyk-pump/pump.conf`
+
+**Databases**
+
+
+<Note>
+Redis and MongoDB are not Tyk products and what we provide here are basic backup and restore instructions. It is advisable to consult the official documentation for Redis and MongoDB on backups.
+</Note>
+
+
+**Redis**
+
+For more detailed instructions on managing Redis backups, please refer to the official Redis documentation:
+https://redis.io/docs/management/persistence/
+
+The Redis SAVE command is used to create a backup of the current Redis database. The SAVE command performs a synchronous save of the dataset producing a point-in-time snapshot of all the data inside the Redis instance, in the form of an RDB file.
+
+```bash
+# Using SAVE, if the previous dump.rdb file exists in the working directory, it will be overwritten with the new snapshot
+
+SAVE
+```
+
+**Example**
+
+<img src="/img/upgrade-guides/redis_save.png" alt="Redis SAVE example" width="600" height="auto" />
+
+To restore Redis data, follow these steps:
+
+- Move the Redis backup file (dump.rdb) to your Redis directory.
+- Start the Redis server
+
+To locate your Redis directory, you can use the CONFIG command. Specifically, the CONFIG GET command allows you to read the configuration parameters of a running Redis server.
+Example:
+<img src="/img/upgrade-guides/redis_config.png" alt="Redis CONFIG example" width="600" height="auto" />
+
+**MongoDB**
+
+For detailed instructions on performing backups in MongoDB, please refer to the official MongoDB documentation:
+https://www.mongodb.com/docs/manual/core/backups/
+
+To capture a snapshot of a MongoDB database from a remote machine and store it locally, utilize the mongodump command on the primary node. Specify the host and port number (default is 27017) of the remote server, along with additional parameters such as the database name, user credentials and password. Lastly, designate the directory where the snapshot should be created.
+
+```bash
+mongodump --db tyk_analytics --out /path/to/dump/directory
+```
+
+**Example**
+
+<img src="/img/upgrade-guides/mongo_dump.png" alt="Mongo DUMP example" height="600" />
+
+To restore a database using a previously saved snapshot, simply employ the mongorestore command.
+
+```bash
+mongorestore --host <hostname> --port <port> --username <username> --password <password> /path/to/dump/directory
+```
+
+##### Upgrade Tyk Packages
+
+Before executing the upgrade, ensure that you have consulted and performed all the necessary steps in the [pre-upgrade checklist](#upgrade-guidelines).
+
+**Step 1. Update Tyk Repositories**
+
+Fetch and update information about the available packages from the specified repositories. 
+
+```bash
+sudo yum -q makecache -y --disablerepo='*' --enablerepo='tyk_tyk-dashboard'
+sudo yum -q makecache -y --disablerepo='*' --enablerepo='tyk_tyk-gateway'
+sudo yum -q makecache -y --disablerepo='*' --enablerepo='tyk_tyk-pump'
+
+Or
+# To update ALL repositories in your system instead
+
+sudo yum -q makecache -y
+```
+
+**Step 2. Verify availability of target upgrade packages**
+
+List current versions of Tyk using the command below:
+
+```bash
+rpm -qa | grep -i tyk
+```
+
+**Example**
+
+<img src="/img/upgrade-guides/list_rpm.png" alt="List RPM packages example" width="600" height="auto" />
+
+List available versions of upgradable packages of Tyk components and ensure that the version you are planning to upgrade to is listed in the output of the above command.
+
+```bash
+yum --showduplicates list tyk*
+```
+
+Example:
+<img src="/img/upgrade-guides/list_package.png" alt="List version example" width="600" height="auto" />
+<img src="/img/upgrade-guides/list_package_2.png" alt="List version example" width="600" height="auto" />
+
+**Step 3. Upgrade Tyk Components**
+
+**Note:** Please specify the exact version you are upgrading into.
+
+```bash
+yum update tyk-dashboard-<desired-version>
+yum update tyk-gateway-<desired-version>
+yum update tyk-pump-<desired-version>
+```
+
+**Example**
+
+<img src="/img/upgrade-guides/yum_update.png" alt="Update example" width="auto" height="600" />
+
+**Step 4. Restart Tyk Components**
+
+After upgrading Tyk, restart the services
+
+```bash
+# Restart Services
+systemctl restart tyk-dashboard
+systemctl restart tyk-gateway
+systemctl restart tyk-pump
+
+# Check status of Tyk Components
+systemctl status tyk-dashboard
+systemctl status tyk-gateway
+systemctl status tyk-pump
+```
+
+**Step 5. Health check on upgraded Tyk components**
+
+Perform a health-check on all 3 Tyk Components. The host and port number varies on your setup.
+
+**Tyk Dashboard**
+
+```curl
+curl http://localhost:3000/hello
+```
+
+**Tyk Gateway**
+
+```curl
+curl http://localhost:8080/hello
+```
+
+**Tyk Pump**
+
+```curl
+curl http://localhost:8083/health
+```
+
+##### Reverting the Upgrade
+
+If the upgrade fails you can revert to the old version by following the steps below.
+
+**Step 1. Inspect package logs**
+
+Use the command below to fetch information for all updates, noting the ID for the specific “update” action to revert to allow verifying the packages:
+
+```bash
+yum history
+```
+
+**Step 2. Verify update**
+
+Display details of the specific "`update" transaction, replacing ID noted in the previous step
+
+```bash
+yum history info <ID>
+```
+
+**Example**
+
+<img src="/img/upgrade-guides/yum_history.png" alt="Update example" width="auto" height="600" />
+
+**Step 3. Revert**
+
+If you encounter difficulties after an upgrade and wish to revert the changes, you can use the following commands as a guide.
+
+If you're experiencing issues specifically related to the upgrade and want to undo those changes only, you can use the *yum history undo* command. This will undo the changes for a specific update transaction only.
+
+```bash
+yum history undo <ID>
+```
+
+If you encounter issues after the upgrade and wish to revert your system to its previous state entirely, you can use the *yum history rollback* command. This command will rollback the system to a specific point in time, undoing all transactions that occurred after that point. 
+
+```bash
+yum history rollback <ID>
+```
+
+
+<Note>
+These commands are provided as general guidelines and should be used with caution. It's advisable to consult with your system administrator or seek assistance from a qualified professional before executing any system-level commands
+</Note>
+
+
+
+
+### Open-Source Upgrade Guide 
+
+The following guide explains how to upgrade Tyk Gateway when using Docker. For guides of other installation types check
+the [self-managed](#tyk-self-managed-upgrade-guide) section, and look for the instruction regarding Tyk Gateway.
+
+Before proceeding with the upgrade process, ensure that you have thoroughly reviewed and completed the steps outlined in
+the [pre-upgrade guidelines](#upgrade-guidelines). Once you
+have adequately prepared, follow the instructions below to upgrade your Tyk components and plugins in this specified
+order. Adhering to the provided sequence is crucial for a smooth and successful upgrade.
+
+**Upgrade Order**
+
+In a production environment, where we recommend installing the Dashboard, Gateway, and Pump on separate machines, you
+should upgrade components in the following sequence:
+
+1. Tyk Gateway
+2. Tyk Pump
+
+**Steps for Upgrading Tyk Gateway**
+
+**Development Environment Upgrade**
+
+In a development environment where you can simply restart your gateways, follow these steps:
+
+1. Backup your gateway config file (`tyk.conf` or the name you chose for it)
+2. Update the image version in the docker command or script
+3. Restart the gateway. For example, update the following command to `v5.1` and run it as follows:
+
+```docker
+$ docker run \
+  --name tyk_gateway \
+  --network tyk \
+  -p 8080:8080 \
+  -v $(pwd)/tyk.standalone.conf:/opt/tyk-gateway/tyk.conf \
+  -v $(pwd)/apps:/opt/tyk-gateway/apps \
+  docker.tyk.io/tyk-gateway/tyk-gateway:v5.3
+```
+
+For full installation details, check the usual [installation page](/apim/open-source/installation).
+
+**Docker compose upgrade in a simple environment**
+
+For non-production environments where brief downtime is acceptable, you can upgrade by simply restarting your gateways.
+Follow these steps:
+
+1. Backup your gateway config file (`tyk.conf` or the name you chose for it)
+2. Update the image version in the `docker-compose.yaml` file.
+   <br />
+   For example, Tyk Gateway version `4.3.3` is defined in your `docker-compose.yaml` as `image: docker.tyk.io/tyk-gateway/tyk-gateway:v4.3.3`. Change `4.3.3` to the version you want to use.
+3. Restart the gateway (or stop and start it)
+```console
+$ docker compose restart
+```
+4. Check the log to see that the new version is used and if the gateway is up and running
+5. Check that the gateway is healthy
+```console
+$ curl  localhost:8080/hello | jq .
+{
+  "status": "pass",
+  "version": "5.3.0",
+  "description": "Tyk GW",
+  "details": {
+    "redis": {
+      "status": "pass",
+      "componentType": "datastore",
+      "time": "2023-07-17T21:07:27Z"
+    }
+  }
+}
+```
+
+**Production Environment Upgrade**
+
+1. Backup your Gateway config file
+2. Use Docker's best practices for a [rolling update](https://docs.docker.com/engine/swarm/swarm-tutorial/rolling-update/)
+3. Review and complete the steps outlined in the [pre-upgrade guidelines](#upgrade-guidelines).
+4. Define the version in your setup script (for example in `.env` file). The new image will be pulled once it's executed.
+If your script is doing `docker pull`, update the version of the gateway in that command to the target version.
+5. Check the log to see that the new version is used and if the gateway is up and running
+6. Check that the Gateway is healthy using the open */hello* API ( run `curl  localhost:8080/hello | jq .`)
+
+**Upgrade Tyk Pump**
+
+Docker Instructions for upgrading *Tyk Pump* is the same as the above for *Tyk Gateway* just with
+the name of the docker image of Tyk Pump `tykio/tyk-pump-docker-pub`
+
+
+### Go-Plugins Upgrade Guide
+
+This guide shows you how to compile your custom Go plugins for upgrade.
+
+The table below links you to the upgrade steps for the version of Tyk you are upgrading from and to:
+
+| Upgrade process | Current Version | Target Version |
+| :----------------- | :----------------- | :---------------- |
+| [Path 1](#path-1)    | < 4.1.0         | < 4.1.0        |
+| [Path 2](#path-2)    | < 4.1.0         | >= 4.1.0       |
+| [Path 3](#path-3)    | >= 4.1.0        | >= 5.1.0       |
+
+#### Path 1 - Current Version < 4.1.0 and Target Version < 4.1.0
+<a id="path-1"></a>
+
+ 1. Open a terminal/command prompt in the directory of your plugin source file(s)
+ 2. Run the following commands to initialise your plugin:
+
+```bash
+go get 
+github.com/TykTechnologies/tyk@6c76e802a29838d058588ff924358706a078d0c5
+
+# Tyk Gateway versions < 4.2 have a dependency on graphql-go-tools
+go mod edit -replace github.com/jensneuse/graphql-go-tools=github.com/TykTechnologies/graphql-go-tools@v1.6.2-0.20220426094453-0cc35471c1ca
+
+go mod tidy
+go mod vendor
+```
+
+#### Path 2 - Current Version < 4.1.0 and Target Version >= 4.1.0
+<a id="path-2"></a>
+
+1. Open a terminal/command prompt in the directory of your plugin source file(s)  
+2. Based on your Target Version run the appropriate commands to initialize your plugin:
+
+- **`Target Version <= v4.2.0`**  
+    ```bash
+    go get github.com/TykTechnologies/tyk@6c76e802a29838d058588ff924358706a078d0c5
+    # Tyk Gateway versions < 4.2 have a dependency on graphql-go-tools
+    go mod edit -replace github.com/jensneuse/graphql-go-tools=github.com/TykTechnologies/graphql-go-tools@v1.6.2-0.20220426094453-0cc35471c1ca
+    go mod tidy
+    go mod vendor
+    ```
+- **Target Version > v4.2.0 and < v5.1**
+    ```bash
+    go get github.com/TykTechnologies/tyk@54e1072a6a9918e29606edf6b60def437b273d0a
+    # For Gateway versions earlier than 5.1 using the go mod vendor tool is required
+    go mod tidy
+    go mod vendor
+    ```
+- **Target Version >= v5.1.0**
+    ```bash
+    go get github.com/TykTechnologies/tyk@ffa83a27d3bf793aa27e5f6e4c7106106286699d
+    # In Gateway version 5.1, the Gateway and plugins transitioned to using Go modules builds and don't use Go mod vendor anymore
+    go mod tidy
+    ```
+
+
+#### Path 3 - Current `Version >= 4`.1.0 and Target `Version >= 5`.1.0
+<a id="path-3"></a>
+
+1. Open a terminal/command prompt in the directory of your plugin source file(s)  
+2. Based on your Target Version run the appropriate commands to initialise your plugin:
+
+- **Target Version > v4.2.0 and < v5.1.0**
+    ```bash
+    go get github.com/TykTechnologies/tyk@54e1072a6a9918e29606edf6b60def437b273d0a
+    # For Gateway versions earlier than 5.1 using the go mod vendor tool is required
+    go mod tidy
+    go mod vendor
+    ```
+    - **Target Version >= v5.1.0**
+    ```bash
+    go get github.com/TykTechnologies/tyk@ffa83a27d3bf793aa27e5f6e4c7106106286699d
+    # In Gateway version 5.1, the Gateway and plugins transitioned to using
+    # Go modules builds and don't use Go mod vendor anymore
+    go mod tidy
+    ```
+
+#### Compile the plugins
+
+Download the plugin compiler for the target Gateway version you’re upgrading to (e.g. 5.2.5). Docker images for plugin compiler versions are available in the [Tyk Docker Hub](https://hub.docker.com/r/tykio/tyk-plugin-compiler/tags). 
+
+```bash
+docker pull tykio/tyk-plugin-compiler:v5.2.5
+```
+
+Recompile your plugin with this version
+
+```bash
+docker run --rm -v "$(pwd)":/plugin-source \
+           --platform=linux/amd64 \
+           tykio/tyk-plugin-compiler:v5.2.5 plugin.so
+```
+
+Example:
+<img src="/img/upgrade-guides/recompile_plugin.png" alt="Recompile plugin example" width="600" height="auto" />
+
+You can remove the plugin compiler images once your plugin has been successfully recompiled:
+
+```bash
+docker rmi plugin_compiler_image_name_or_id
+```
+
+
+## Backup APIs and Policies 
+
+Backing up Tyk APIs and Policies is crucial for ensuring business continuity and data integrity. It safeguards against accidental data loss, system failures or corruption. This provides the opportunity to roll back to a stable state during upgrades or migrations, allowing you to restore configurations to a previous state to prevent disruptions with your API infrastructure.
+If you are using Self-Managed deployment then we recommend that you use [Tyk Sync](/api-management/automations/sync) to backup your Tyk APIs and policies. 
+
+### Export and Restore APIs and Policies
+
+To facilitate backing up APIs and policies we have provided a Bash script [backup](https://github.com/TykTechnologies/backup) that can be used to export and restore all Tyk API definitions and Policies from Tyk Dashboard. This will be done by the *export* and *import* commands respectively. The script can be used on both Tyk Cloud and Self Managed deployments.
+
+#### Export APIs and Policies
+
+To export all APIs and Policies use the *export* command:
+
+```bash
+./backup.sh export --url https://my-tyk-dashboard.com --secret mysecretkey --api-output apis.json --policy-output policies.json
+```
+
+This will export all your API definitions and policies to *apis.json* and *policies.json* files.
+
+#### Import APIs and Policies
+
+To import all your APIs and Policies, use the *import* command:
+
+```bash
+./backup.sh import --url https://my-tyk-dashboard.com --secret mysecretkey --api-file apis.json --policy-file policies.json
+```
+
+This will restore the API definitions and policies from the apis.json and policies.json files.
+
diff --git a/docs.json b/docs.json
new file mode 100644
index 0000000000..adb6c70a3c
--- /dev/null
+++ b/docs.json
@@ -0,0 +1,1251 @@
+{
+  "name": "Tyk Documentation",
+  "theme": "aspen",
+  "logo": {
+    "light": "/logo/light.svg",
+    "dark": "/logo/dark.svg"
+  },
+  "favicon": "/favicon.png",
+  "colors": {
+    "primary": "#8438FA",
+    "light": "#8438FA",
+    "dark": "#8438FA"
+  },
+  "integrations": {
+    "gtm": {
+      "tagId": "GTM-K5PPWPH7"
+    }
+  },
+  "contextual": {
+    "options": [
+      "copy",
+      "view",
+      "chatgpt",
+      "claude",
+      "add-mcp",
+      "cursor",
+      "vscode"
+    ]
+  },
+  "seo": {
+    "metatags": {
+      "image": "/img/logos/tyk-docs-logo-dark.svg",
+      "author": "Tyk Technologies",
+      "language": "en-US",
+      "copyright": "Tyk Technologies",
+      "reply-to": "info@tyk.io",
+      "category": "Technology"
+    }
+  },
+  "navbar": {
+    "links": [
+      {
+        "label": "Community",
+        "href": "https://tyk.io/community/"
+      },
+      {
+        "label": "24/7 Support",
+        "href": "https://support.tyk.io/"
+      },
+      {
+        "label": "Tyk YouTube",
+        "href": "https://www.youtube.com/@TykAPIM/videos"
+      }
+    ],
+    "primary": {
+      "type": "button",
+      "label": "Start for Free",
+      "href": "https://tyk.io/sign-up/"
+    }
+  },
+  "navigation": {
+    "tabs": [
+      {
+        "tab": "Home",
+        "pages": [
+          "index"
+        ]
+      },
+      {
+        "tab": "Overview",
+        "groups": [
+          {
+            "group": "Platform",
+            "pages": [
+              "tyk-overview",
+              "tyk-components",
+              "apim",
+              "plan-your-api-integration"
+            ]
+          },
+          {
+            "group": "Releases Policy",
+            "pages": [
+              "developer-support/release-types/long-term-support",
+              "developer-support/release-types/early-access-feature",
+              "developer-support/release-types/lab-release",
+              {
+                "group": "FIPS Policy",
+                "pages": [
+                  "developer-support/release-types/fips-release",
+                  "api-management/fips-implementation"
+                ]
+              },
+              "developer-support/deprecation"
+            ]
+          },
+          {
+            "group": "Community and Support",
+            "pages": [
+              "developer-support/support",
+              "developer-support/community"
+            ]
+          },
+          {
+            "group": "Docs Contribution",
+            "pages": [
+              "developer-support/contributing",
+              "developer-support/contribution-guides",
+              "developer-support/documentation-projects/inclusive-naming"
+            ]
+          }
+        ]
+      },
+      {
+        "tab": "API Management",
+        "groups": [
+          {
+            "group": "Getting Started",
+            "pages": [
+              "getting-started/quick-start",
+              "getting-started/secure-api"
+            ]
+          },
+          {
+            "group": "Deploy Tyk",
+            "pages": [
+              "tyk-stack",
+              {
+                "group": "Tyk Open Source",
+                "pages": [
+                  "tyk-open-source",
+                  "tyk-oss-gateway",
+                  "deployment-and-operations/tyk-open-source-api-gateway/quick-start",
+                  "apim/open-source/installation"
+                ]
+              },
+              {
+                "group": "Tyk Self Managed",
+                "pages": [
+                  "tyk-self-managed",
+                  {
+                    "group": "Installation Options",
+                    "pages": [
+                      "tyk-self-managed/install",
+                      "tyk-self-managed/install/docker",
+                      "tyk-self-managed/install/kubernetes",
+                      "tyk-self-managed/install/linux",
+                      "tyk-self-managed/install/methods"
+                    ]
+                  },
+                  {
+                    "group": "Configuration",
+                    "pages": [
+                      "planning-for-production",
+                      "planning-for-production/database-settings",
+                      "planning-for-production/ensure-high-availability/circuit-breakers",
+                      "planning-for-production/ensure-high-availability/enforced-timeouts",
+                      "planning-for-production/ensure-high-availability/health-check",
+                      "planning-for-production/ensure-high-availability/config-inspection",
+                      "planning-for-production/ensure-high-availability/uptime-tests",
+                      "configure/external-service",
+                      "tyk-configuration-reference/kv-store",
+                      "planning-for-production/monitoring/tyk-components",
+                      "tyk-configuration-reference/redis-cluster-sentinel",
+                      "planning-for-production/ensure-high-availability/graceful-shutdown",
+                      "deployment-and-operations/container-runtimes",
+                      "api-management/gateway-events",
+                      "api-management/api-sharding"
+                    ]
+                  }
+                ]
+              },
+              {
+                "group": "Tyk Helm Charts",
+                "pages": [
+                  "product-stack/tyk-charts/overview",
+                  "product-stack/tyk-charts/tyk-stack-chart",
+                  "product-stack/tyk-charts/tyk-control-plane-chart",
+                  "product-stack/tyk-charts/tyk-data-plane-chart",
+                  "product-stack/tyk-charts/tyk-oss-chart"
+                ]
+              },
+              "api-management/mdcb",
+              "api-management/tyk-pump"
+            ]
+          },
+          {
+            "group": "Design & Create APIs",
+            "pages": [
+              {
+                "group": "API Definitions",
+                "pages": [
+                  "api-management/gateway-config-introduction",
+                  "api-management/gateway-config-tyk-oas",
+                  "api-management/gateway-config-managing-oas",
+                  "api-management/gateway-config-tyk-classic",
+                  "api-management/gateway-config-managing-classic",
+                  "api-management/migrate-from-tyk-classic",
+                  "api-management/manage-apis/deploy-apis/deploy-apis-overview",
+                  "tyk-stack/tyk-gateway/important-prerequisites"
+                ]
+              },
+              {
+                "group": "GraphQL & Universal Data Graph",
+                "pages": [
+                  "api-management/graphql",
+                  "api-management/graphql/graphql-schema-types",
+                  "api-management/data-graph"
+                ]
+              },
+              {
+                "group": "Event Driven APIs",
+                "pages": [
+                  "api-management/event-driven-apis",
+                  "api-management/stream-config",
+                  "api-management/streams-end-to-end-example"
+                ]
+              },
+              {
+                "group": "Advanced Protocols",
+                "pages": [
+                  "advanced-configuration/other-protocols",
+                  "key-concepts/tcp-proxy",
+                  "key-concepts/grpc-proxy",
+                  "advanced-configuration/sse-proxy",
+                  "advanced-configuration/websockets"
+                ]
+              }
+            ]
+          },
+          {
+            "group": "Secure APIs",
+            "pages": [
+              {
+                "group": "Client Authentication",
+                "pages": [
+                  "api-management/client-authentication",
+                  "api-management/authentication/bearer-token",
+                  "api-management/authentication/basic-authentication",
+                  "api-management/authentication/oauth-2",
+                  {
+                    "group": "OAuth 2.0 (External IdP)",
+                    "pages": [
+                      "api-management/authentication/oauth2-authentication",
+                      "api-management/authentication/token-exchange"
+                    ]
+                  },
+                  {
+                    "group": "JSON Web Tokens",
+                    "pages": [
+                      "basic-config-and-security/security/authentication-authorization/json-web-tokens",
+                      "api-management/authentication/jwt-quick-start",
+                      "api-management/authentication/jwt-signature-validation",
+                      "api-management/authentication/jwt-claim-validation",
+                      "api-management/authentication/jwt-authorization",
+                      {
+                        "group": "Guides",
+                        "pages": [
+                          "api-management/authentication/jwt-split-token"
+                        ]
+                      }
+                    ]
+                  },
+                  "basic-config-and-security/security/authentication-authorization/hmac-signatures",
+                  "api-management/authentication/certificate-auth",
+                  "api-management/authentication/custom-auth",
+                  "basic-config-and-security/security/authentication-authorization/open-keyless",
+                  "basic-config-and-security/security/authentication-authorization/multiple-auth"
+                ]
+              },
+              {
+                "group": "Upstream Authentication",
+                "pages": [
+                  "api-management/upstream-authentication",
+                  "api-management/upstream-authentication/auth-token",
+                  "api-management/upstream-authentication/basic-auth",
+                  "api-management/upstream-authentication/oauth",
+                  "api-management/upstream-authentication/mtls",
+                  "api-management/upstream-authentication/request-signing"
+                ]
+              },
+              {
+                "group": "Access Control",
+                "pages": [
+                  "api-management/access-control/overview",
+                  {
+                    "group": "Sessions and Keys",
+                    "pages": [
+                      "api-management/access-control/sessions-and-keys/understanding-sessions",
+                      "api-management/access-control/sessions-and-keys/access-rights",
+                      "api-management/access-control/sessions-and-keys/session-metadata",
+                      "api-management/access-control/sessions-and-keys/session-lifecycle",
+                      "api-management/access-control/sessions-and-keys/key-hashing",
+                      "api-management/access-control/sessions-and-keys/issuing-tokens-via-tib"
+                    ]
+                  },
+                  {
+                    "group": "Policies",
+                    "pages": [
+                      "api-management/policies",
+                      "api-management/access-control/policies/applying-policies",
+                      "api-management/access-control/policies/managing-policies"
+                    ]
+                  }
+                ]
+              },
+              "api-management/certificates",
+              "api-management/implement-tls",
+              "api-management/client-idp-registry",
+              "api-management/security-best-practices",
+              "api-management/security-features"
+            ]
+          },
+          {
+            "group": "Control Traffic",
+            "pages": [
+              {
+                "group": "Rate Limiting & Quotas",
+                "pages": [
+                  "api-management/rate-limit",
+                  "api-management/request-quotas",
+                  "api-management/request-throttling"
+                ]
+              },
+              {
+                "group": "Request Optimization",
+                "pages": [
+                  "api-management/response-caching",
+                  "api-management/batch-processing"
+                ]
+              }
+            ]
+          },
+          {
+            "group": "Routing Traffic",
+            "pages": [
+              "api-management/routing-traffic/overview",
+              "getting-started/key-concepts/url-matching",
+              "planning-for-production/ensure-high-availability/load-balancing",
+              "transform-traffic/url-rewriting",
+              "advanced-configuration/transform-traffic/looping",
+              "api-management/traffic-transformation/mock-response",
+              "planning-for-production/ensure-high-availability/service-discovery"
+            ]
+          },
+          {
+            "group": "Transform Traffic",
+            "pages": [
+              {
+                "group": "Traffic Transformation",
+                "pages": [
+                  "api-management/traffic-transformation",
+                  "api-management/traffic-transformation/allow-list",
+                  "api-management/traffic-transformation/block-list",
+                  "api-management/traffic-transformation/do-not-track",
+                  "api-management/traffic-transformation/ignore-authentication",
+                  "api-management/traffic-transformation/request-method",
+                  "api-management/traffic-transformation/request-body",
+                  "api-management/traffic-transformation/request-headers",
+                  "api-management/traffic-transformation/request-size-limits",
+                  "api-management/traffic-transformation/response-body",
+                  "api-management/custom-error-responses",
+                  "api-management/traffic-transformation/response-headers",
+                  "api-management/traffic-transformation/request-validation",
+                  "api-management/traffic-transformation/virtual-endpoints",
+                  "api-management/traffic-transformation/go-templates",
+                  "api-management/traffic-transformation/jq-transforms",
+                  "api-management/traffic-transformation/request-context-variables",
+                  "advanced-configuration/transform-traffic/soap-rest"
+                ]
+              },
+              {
+                "group": "Custom Plugins",
+                "pages": [
+                  "api-management/plugins/overview",
+                  "api-management/plugins/plugin-types",
+                  "api-management/plugins/golang",
+                  "api-management/plugins/javascript",
+                  "api-management/plugins/rich-plugins",
+                  "api-management/plugins/advance-config"
+                ]
+              }
+            ]
+          },
+          {
+            "group": "Observe APIs",
+            "pages": [
+              {
+                "group": "Observability",
+                "pages": [
+                  "api-management/observability",
+                  "api-management/observability-getting-started",
+                  {
+                    "group": "Metrics",
+                    "pages": [
+                      "api-management/logs-metrics",
+                      "api-management/metrics/default-metrics",
+                      "api-management/metrics/custom-metrics",
+                      "api-management/metrics/metrics-pumps"
+                    ]
+                  },
+                  "api-management/traces",
+                  {
+                    "group": "Logs",
+                    "pages": [
+                      "api-management/logs",
+                      "api-management/logs/application-logs",
+                      "api-management/logs/access-logs",
+                      "api-management/logs/audit-logs",
+                      "api-management/logs/traffic-logs",
+                      "api-management/logs/external-data-sinks"
+                    ]
+                  }
+                ]
+              },
+              "api-management/performance-monitoring",
+              {
+                "group": "Guides",
+                "pages": [
+                  "api-management/observability/guides/best-practices",
+                  "api-management/observability/guides/gateway-playbook",
+                  {
+                    "group": "Tracing Backends",
+                    "pages": [
+                      "api-management/traces/datadog",
+                      "api-management/traces/dynatrace",
+                      "api-management/traces/elasticsearch",
+                      "api-management/traces/new-relic",
+                      "api-management/traces/jaeger"
+                    ]
+                  }
+                ]
+              }
+            ]
+          },
+          {
+            "group": "Maintain APIs",
+            "pages": [
+              "api-management/api-versioning",
+              {
+                "group": "Automation Tools",
+                "pages": [
+                  "api-management/automations",
+                  {
+                    "group": "API Management in Kubernetes",
+                    "pages": [
+                      "api-management/automations/operator",
+                      "tyk-stack/tyk-operator/installing-tyk-operator",
+                      "tyk-stack/tyk-operator/create-an-api",
+                      "tyk-stack/tyk-operator/publish-an-api",
+                      "product-stack/tyk-operator/tyk-ingress-controller",
+                      "product-stack/tyk-operator/mcp-proxy",
+                      "product-stack/tyk-operator/crd-reference",
+                      "product-stack/tyk-operator/advanced-configurations/graphql-federation",
+                      "product-stack/tyk-operator/advanced-configurations/custom-plugins",
+                      "product-stack/tyk-operator/advanced-configurations/internal-looping",
+                      "product-stack/tyk-operator/getting-started/tyk-operator-multiple-organisations"
+                    ]
+                  },
+                  {
+                    "group": "Synchronizing Tyk Configuration",
+                    "pages": [
+                      "api-management/automations/sync",
+                      "product-stack/tyk-sync/installing-tyk-sync",
+                      "api-management/sync/quick-start",
+                      "api-management/sync/use-cases",
+                      "product-stack/tyk-sync/commands"
+                    ]
+                  }
+                ]
+              }
+            ]
+          },
+          {
+            "group": "Use Cases",
+            "pages": [
+              "use-cases/open-banking"
+            ]
+          },
+          {
+            "group": "Guides",
+            "pages": [
+              "api-management/collecting-gateway-logs-otel-kubernetes",
+              "api-management/air-gapped-deployment"
+            ]
+          },
+          {
+            "group": "Reference",
+            "pages": [
+              {
+                "group": "Environment Variables and Configs",
+                "pages": [
+                  "tyk-oss-gateway/configuration",
+                  "tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables",
+                  "tyk-multi-data-centre/mdcb-configuration-options",
+                  "tyk-configuration-reference/tyk-identity-broker-configuration"
+                ]
+              },
+              {
+                "group": "API Documentation",
+                "pages": [
+                  "tyk-apis",
+                  {
+                    "group": "Gateway API",
+                    "pages": [
+                      "tyk-gateway-api"
+                    ],
+                    "openapi": "swagger/gateway-swagger.yml"
+                  },
+                  {
+                    "group": "MDCB API",
+                    "pages": [
+                      "tyk-mdcb-api"
+                    ],
+                    "openapi": "swagger/mdcb-swagger.yml"
+                  },
+                  {
+                    "group": "Identity Broker API",
+                    "pages": [
+                      "tyk-identity-broker/tib-rest-api"
+                    ],
+                    "openapi": "swagger/identity-broker-swagger.yml"
+                  }
+                ]
+              }
+            ]
+          },
+          {
+            "group": "Developer Support",
+            "pages": [
+              {
+                "group": "Release Notes",
+                "pages": [
+                  "developer-support/release-notes/overview",
+                  "developer-support/release-notes/gateway",
+                  "developer-support/release-notes/dashboard",
+                  "developer-support/release-notes/pump",
+                  "developer-support/release-notes/sync",
+                  "developer-support/release-notes/mdcb",
+                  "developer-support/release-notes/operator",
+                  "developer-support/release-notes/helm-chart",
+                  "developer-support/release-notes/tib",
+                  "developer-support/release-notes/archived"
+                ]
+              },
+              "developer-support/upgrading",
+              "api-management/troubleshooting-debugging",
+              "developer-support/faq"
+            ]
+          }
+        ]
+      },
+      {
+        "tab": "Platform Management",
+        "groups": [
+          {
+            "group": "Overview",
+            "pages": [
+              "api-management/dashboard-configuration",
+              "getting-started/using-tyk-dashboard"
+            ]
+          },
+          {
+            "group": "API Governance",
+            "pages": [
+              {
+                "group": "Tyk Governance",
+                "pages": [
+                  "tyk-governance/overview",
+                  "tyk-governance/core-concepts",
+                  "tyk-governance/installation",
+                  "tyk-governance/api-repository",
+                  "tyk-governance/api-labeling",
+                  "tyk-governance/governance-rulesets",
+                  "tyk-governance/api-evaluation",
+                  "tyk-governance/agent-management"
+                ]
+              },
+              "platform-management/api-categories",
+              "platform-management/api-templates"
+            ]
+          },
+          {
+            "group": "Dashboard Analytics",
+            "pages": [
+              "api-management/dashboard-analytics",
+              "api-management/dashboard-analytics/control-plane-pumps",
+              "api-management/dashboard-analytics/data-plane-pump",
+              "api-management/dashboard-analytics/analytics-storage-management"
+            ]
+          },
+          {
+            "group": "User Management",
+            "pages": [
+              "api-management/user-management",
+              "platform-management/dashboard-users",
+              "platform-management/user-groups",
+              "platform-management/user-permissions",
+              "platform-management/api-ownership",
+              "platform-management/open-policy-agent"
+            ]
+          },
+          {
+            "group": "Tyk Identity Broker (TIB)",
+            "pages": [
+              "tyk-identity-broker/overview",
+              "tyk-identity-broker/dashboard-sso",
+              {
+                "group": "Identity Providers",
+                "pages": [
+                  "tyk-identity-broker/sso-entra-id",
+                  "tyk-identity-broker/sso-okta",
+                  "tyk-identity-broker/sso-auth0",
+                  "tyk-identity-broker/sso-keycloak",
+                  "api-management/single-sign-on-ldap",
+                  "api-management/single-sign-on-social-idp",
+                  "api-management/custom-auth-with-proxy-identity-provider"
+                ]
+              },
+              "tyk-identity-broker/standalone-tib"
+            ]
+          },
+          {
+            "group": "Guides",
+            "pages": [
+              "api-management/enable-audit-logs-dashboard",
+              "api-management/multiple-environments",
+              "api-management/endpoint-designer"
+            ]
+          },
+          {
+            "group": "Reference",
+            "pages": [
+              "tyk-dashboard/configuration",
+              {
+                "group": "API Documentation",
+                "pages": [
+                  {
+                    "group": "Dashboard",
+                    "pages": [
+                      "tyk-dashboard-api"
+                    ],
+                    "openapi": "swagger/dashboard-swagger.yml"
+                  },
+                  {
+                    "group": "Dashboard Admin",
+                    "pages": [
+                      "dashboard-admin-api"
+                    ],
+                    "openapi": "swagger/dashboard-admin-swagger.yml"
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "tab": "API Publishing",
+        "groups": [
+          {
+            "group": "Overview",
+            "pages": [
+              "portal/overview/intro",
+              "portal/overview/concepts"
+            ]
+          },
+          {
+            "group": "Getting Started",
+            "pages": [
+              "portal/overview/getting-started",
+              "portal/publish-api-catalog",
+              "portal/request-access"
+            ]
+          },
+          {
+            "group": "Installation",
+            "pages": [
+              "portal/install",
+              "portal/install/docker",
+              "portal/install/kubernetes",
+              "portal/install/linux",
+              "portal/install/upgrade-guide"
+            ]
+          },
+          {
+            "group": "Publishing APIs",
+            "pages": [
+              {
+                "group": "API Products",
+                "pages": [
+                  "portal/api-products",
+                  "portal/api-products/documentation-only-products",
+                  "tyk-developer-portal/graphql-playground"
+                ]
+              },
+              "portal/api-plans",
+              "tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues"
+            ]
+          },
+          {
+            "group": "Consuming APIs",
+            "pages": [
+              "portal/developer-app",
+              "tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/approve-requests",
+              {
+                "group": "Guides",
+                "pages": [
+                  "tyk-developer-portal/import-custom-credentials",
+                  "tyk-developer-portal/direct-access-flow",
+                  "tyk-developer-portal/single-credentials-multiple-api-products"
+                ]
+              }
+            ]
+          },
+          {
+            "group": "User Management",
+            "pages": [
+              "portal/api-owner",
+              "portal/api-consumer",
+              "tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations",
+              "tyk-developer-portal/tyk-enterprise-developer-portal/api-consumer-portal/reset-password"
+            ]
+          },
+          {
+            "group": "Portal Administration",
+            "pages": [
+              "portal/api-provider",
+              "tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration",
+              "portal/certificates",
+              "tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/configuring-custom-rate-limit-keys",
+              "tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso",
+              "product-stack/tyk-enterprise-developer-portal/getting-started/setup-email-notifications",
+              "portal/webcrawlers",
+              "portal/resource-migration",
+              {
+                "group": "Events and Notifications",
+                "pages": [
+                  "portal/customization/webhooks",
+                  "portal/customization/email-notifications"
+                ]
+              },
+              {
+                "group": "Customizing Developer Portal",
+                "pages": [
+                  "portal/customization",
+                  "portal/customization/themes",
+                  "portal/customization/templates",
+                  "portal/customization/pages",
+                  "portal/customization/markdown",
+                  "portal/customization/menus",
+                  "portal/customization/branding",
+                  "portal/customization/sign-up",
+                  "portal/customization/user-model"
+                ]
+              },
+              {
+                "group": "Guides",
+                "pages": [
+                  "tyk-developer-portal/enable-audit-logs-portal"
+                ]
+              }
+            ]
+          },
+          {
+            "group": "Reference",
+            "pages": [
+              "product-stack/tyk-enterprise-developer-portal/deploy/configuration",
+              {
+                "group": "Developer Portal API",
+                "pages": [
+                  "product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api"
+                ],
+                "openapi": "swagger/enterprise-developer-portal-swagger.yaml"
+              },
+              "product-stack/tyk-enterprise-developer-portal/api-documentation/list-of-endpoints/portal-api-list-of-endpoints",
+              "developer-support/release-notes/portal"
+            ]
+          },
+          {
+            "group": "How-To Guides",
+            "pages": [
+              "portal/how-to-guides/configure-cors"
+            ]
+          },
+          {
+            "group": "Troubleshooting",
+            "pages": [
+              "portal/troubleshooting/upgrade-failures",
+              "portal/troubleshooting/kubernetes-bootstrap-failures",
+              "portal/troubleshooting/cors-issues"
+            ]
+          },
+          {
+            "group": "Legacy Products",
+            "pages": [
+              {
+                "group": "Tyk Classic Developer Portal",
+                "pages": [
+                  "tyk-developer-portal/tyk-portal-classic",
+                  "tyk-developer-portal/tyk-portal-classic/portal-concepts",
+                  "getting-started/key-concepts/api-catalogue",
+                  "getting-started/tutorials/publish-api",
+                  {
+                    "group": "Advanced configurations",
+                    "pages": [
+                      "tyk-developer-portal/tyk-portal-classic/key-requests",
+                      "tyk-developer-portal/tyk-portal-classic/developer-profiles",
+                      {
+                        "group": "Dynamic Client Registration (DCR)",
+                        "pages": [
+                          "tyk-developer-portal/tyk-portal-classic/dynamic-client-registration",
+                          "tyk-developer-portal/tyk-portal-classic/gluu-dcr",
+                          "tyk-developer-portal/tyk-portal-classic/keycloak-dcr",
+                          "tyk-developer-portal/tyk-portal-classic/okta-dcr",
+                          "tyk-developer-portal/tyk-portal-classic/curity-dcr"
+                        ]
+                      },
+                      "tyk-developer-portal/tyk-portal-classic/portal-oauth-clients",
+                      "tyk-developer-portal/tyk-portal-classic/graphql",
+                      "tyk-developer-portal/tyk-portal-classic/monetise",
+                      "tyk-developer-portal/tyk-portal-classic/portal-events-notifications",
+                      "configure/outbound-email-configuration"
+                    ]
+                  },
+                  {
+                    "group": "Portal customisation",
+                    "pages": [
+                      "tyk-developer-portal/customise",
+                      "tyk-developer-portal/customise/customize-api-visibility",
+                      "tyk-developer-portal/tyk-portal-classic/customise/changing-the-navigation",
+                      "tyk-developer-portal/tyk-portal-classic/customise/custom-developer-portal",
+                      "tyk-developer-portal/tyk-portal-classic/customise/customise-documentation",
+                      "tyk-developer-portal/tyk-portal-classic/customise/customising-using-dashboard",
+                      "tyk-developer-portal/tyk-portal-classic/customise/customize-with-jquery",
+                      "tyk-developer-portal/tyk-portal-classic/customise/developer-meta-data",
+                      "tyk-developer-portal/tyk-portal-classic/tyk-portal-classic/customise/customise-with-templates"
+                    ]
+                  },
+                  {
+                    "group": "API documentation",
+                    "pages": [
+                      "tyk-portal-api",
+                      "tyk-apis/tyk-portal-api/portal-configuration",
+                      "tyk-apis/tyk-portal-api/portal-developers",
+                      "tyk-apis/tyk-portal-api/portal-documentation",
+                      "tyk-apis/tyk-portal-api/portal-keys"
+                    ]
+                  },
+                  {
+                    "group": "Troubleshooting",
+                    "pages": [
+                      "frequently-asked-questions/add-list-delete-developer-using-api",
+                      "frequently-asked-questions/alerts-new-developer-key-requests",
+                      "frequently-asked-questions/custom-developer-portal-options",
+                      "troubleshooting/tyk-dashboard/api-catalogue-not-found-error-developer-portal",
+                      "troubleshooting/tyk-dashboard/cors-issues-on-developer-portal",
+                      "troubleshooting/tyk-dashboard/not-found-error-developer-portal",
+                      "troubleshooting/tyk-dashboard/receive-csrf-error-developer-portal"
+                    ]
+                  },
+                  {
+                    "group": "Dashboard API",
+                    "pages": [
+                      {
+                        "group": "Classic Portal",
+                        "pages": [
+                          "tyk-apis/tyk-dashboard-api/manage-key-requests",
+                          "tyk-apis/tyk-dashboard-api/portal-policies"
+                        ]
+                      }
+                    ]
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "tab": "AI Management",
+        "groups": [
+          {
+            "group": "Overview",
+            "pages": [
+              "ai-management/overview"
+            ]
+          },
+          {
+            "group": "MCP Gateway",
+            "pages": [
+              "ai-management/mcp-gateway/overview",
+              "ai-management/mcp-gateway/quickstart",
+              "ai-management/mcp-gateway/core-concepts",
+              "ai-management/mcp-gateway/managing-proxies",
+              "ai-management/mcp-gateway/policies",
+              "ai-management/mcp-gateway/mcp-proxy-definitions",
+              "ai-management/mcp-gateway/mcp-middleware",
+              "ai-management/mcp-gateway/mcp-api-extensions",
+              "ai-management/mcp-gateway/oauth-2-1",
+              "ai-management/mcp-gateway/mcp-analytics",
+              {
+                "group": "Observability",
+                "pages": [
+                  "ai-management/mcp-gateway/mcp-observability",
+                  "ai-management/mcp-gateway/mcp-metrics",
+                  "ai-management/mcp-gateway/mcp-access-logs"
+                ]
+              },
+              "ai-management/mcp-gateway/faq",
+              {
+                "group": "Guides",
+                "pages": [
+                  "ai-management/mcp-gateway/how-to-proxy-remote-mcp",
+                  "ai-management/mcp-gateway/how-to-mcp-rbac",
+                  "ai-management/mcp-gateway/how-to-rate-limit-tools-per-consumer",
+                  "ai-management/mcp-gateway/how-to-block-tool",
+                  "ai-management/mcp-gateway/how-to-grafana-mcp-dashboard"
+                ]
+              }
+            ]
+          },
+          {
+            "group": "AI Studio",
+            "pages": [
+              "ai-management/ai-studio/overview",
+              "ai-management/ai-studio/core-concepts",
+              "ai-management/ai-studio/configuration",
+              {
+                "group": "Architecture",
+                "pages": [
+                  "ai-management/ai-studio/architecture",
+                  "ai-management/ai-studio/ai-studio",
+                  "ai-management/ai-studio/proxy"
+                ]
+              },
+              {
+                "group": "Installation",
+                "pages": [
+                  "ai-management/ai-studio/installation/overview",
+                  "ai-management/ai-studio/quickstart",
+                  "ai-management/ai-studio/deployment-k8s",
+                  "ai-management/ai-studio/installation/linux",
+                  {
+                    "group": "Configuration",
+                    "pages": [
+                      "ai-management/ai-studio/installation/nats",
+                      "ai-management/ai-studio/telemetry"
+                    ]
+                  }
+                ]
+              },
+              {
+                "group": "AI Studio User",
+                "pages": [
+                  "ai-management/ai-studio/ai-studio-user",
+                  {
+                    "group": "AI Portal",
+                    "pages": [
+                      "ai-management/ai-studio/ai-portal",
+                      "ai-management/ai-studio/ai-portal-app",
+                      "ai-management/ai-studio/ai-cli-app"
+                    ]
+                  },
+                  "ai-management/ai-studio/chat-interface"
+                ]
+              },
+              {
+                "group": "AI Studio Administrator",
+                "pages": [
+                  "ai-management/ai-studio/studio-admin",
+                  "ai-management/ai-studio/catalogs",
+                  {
+                    "group": "User Management",
+                    "pages": [
+                      "ai-management/ai-studio/user-management",
+                      "ai-management/ai-studio/users",
+                      "ai-management/ai-studio/teams",
+                      "ai-management/ai-studio/sso"
+                    ]
+                  },
+                  {
+                    "group": "Resource Management",
+                    "pages": [
+                      {
+                        "group": "LLM Management",
+                        "pages": [
+                          "ai-management/ai-studio/llm-management",
+                          "ai-management/ai-studio/model-prices",
+                          "ai-management/ai-studio/model-router"
+                        ]
+                      },
+                      {
+                        "group": "Chat Management",
+                        "pages": [
+                          "ai-management/ai-studio/chats",
+                          "ai-management/ai-studio/call-settings"
+                        ]
+                      },
+                      "ai-management/ai-studio/admin-apps",
+                      "ai-management/ai-studio/tools",
+                      "ai-management/ai-studio/datasources-rag",
+                      "ai-management/ai-studio/secrets"
+                    ]
+                  },
+                  {
+                    "group": "Plugins",
+                    "pages": [
+                      "ai-management/ai-studio/plugins/overview",
+                      "ai-management/ai-studio/plugins/development-workflow",
+                      "ai-management/ai-studio/plugins/manifests",
+                      "ai-management/ai-studio/plugins/sdk",
+                      {
+                        "group": "Plugin Types",
+                        "pages": [
+                          "ai-management/ai-studio/plugins/studio-ui",
+                          "ai-management/ai-studio/plugins/portal-ui",
+                          "ai-management/ai-studio/plugins/studio-agent",
+                          "ai-management/ai-studio/plugins/edge-gateway",
+                          "ai-management/ai-studio/plugins/object-hooks"
+                        ]
+                      },
+                      {
+                        "group": "Advanced Capabilities",
+                        "pages": [
+                          "ai-management/ai-studio/plugins/resource-types",
+                          "ai-management/ai-studio/plugins/custom-endpoints",
+                          "ai-management/ai-studio/plugins/edge-to-control"
+                        ]
+                      },
+                      "ai-management/ai-studio/plugins/service-api",
+                      "ai-management/ai-studio/plugins/deployment",
+                      "ai-management/ai-studio/plugins/examples",
+                      "ai-management/ai-studio/plugins/best-practices"
+                    ]
+                  },
+                  {
+                    "group": "Governance",
+                    "pages": [
+                      "ai-management/ai-studio/filters",
+                      "ai-management/ai-studio/compliance-events",
+                      "ai-management/ai-studio/budgeting"
+                    ]
+                  },
+                  {
+                    "group": "Monitoring",
+                    "pages": [
+                      "ai-management/ai-studio/analytics",
+                      "ai-management/ai-studio/notifications"
+                    ]
+                  },
+                  "ai-management/ai-studio/manage-edge-gateway"
+                ]
+              },
+              {
+                "group": "Reference",
+                "pages": [
+                  {
+                    "group": "Environment Variables and Configs",
+                    "pages": [
+                      "ai-management/ai-studio/ai-studio-env",
+                      "ai-management/ai-studio/edge-gateway-env"
+                    ]
+                  },
+                  {
+                    "group": "AI Studio API",
+                    "pages": [
+                      "ai-management/ai-studio/ai-studio-swagger"
+                    ],
+                    "openapi": "swagger/ai-studio-swagger.yml"
+                  },
+                  "developer-support/release-notes/ai-studio"
+                ]
+              }
+            ]
+          },
+          {
+            "group": "Tyk MCP Servers",
+            "pages": [
+              "ai-management/mcps/overview",
+              "ai-management/mcps/api-to-mcp",
+              "ai-management/mcps/dashboard-api-to-mcp",
+              "ai-management/mcps/tyk-docs-mcp"
+            ]
+          }
+        ]
+      },
+      {
+        "tab": "Cloud",
+        "groups": [
+          {
+            "group": "Overview",
+            "pages": [
+              "tyk-cloud"
+            ]
+          },
+          {
+            "group": "Getting Started",
+            "pages": [
+              "getting-started/create-account",
+              "getting-started/configure-first-api"
+            ]
+          },
+          {
+            "group": "Management",
+            "pages": [
+              "tyk-cloud/environments-deployments/managing-organisations",
+              "tyk-cloud/teams-users",
+              "tyk-cloud/environments-deployments/managing-environments",
+              "tyk-cloud/environments-deployments/managing-control-planes",
+              "tyk-cloud/environments-deployments/managing-gateways",
+              "tyk-cloud/account-billing",
+              "tyk-cloud/environments-deployments/hybrid-gateways",
+              "tyk-cloud/securing-your-apis"
+            ]
+          },
+          {
+            "group": "Configuration",
+            "pages": [
+              "tyk-cloud/initial-portal-config",
+              "tyk-cloud/using-plugins",
+              "tyk-cloud/using-custom-domains",
+              "api-management/cloud/audit-logs",
+              "tyk-cloud/environments-deployments/monitoring-how-it-works",
+              "tyk-cloud/telemetry",
+              "tyk-cloud/teams-users/single-sign-on"
+            ]
+          },
+          {
+            "group": "Developer Support",
+            "pages": [
+              "developer-support/release-notes/cloud",
+              "tyk-cloud/troubleshooting-support"
+            ]
+          }
+        ]
+      }
+    ]
+  },
+  "footer": {
+    "socials": {
+      "github": "https://github.com/TykTechnologies",
+      "linkedin": "https://www.linkedin.com/company/tyk",
+      "x": "https://twitter.com/tyk_io",
+      "facebook": "https://www.facebook.com/Tyk.API.Management",
+      "podcast": "https://tyk.io/all-about-apis-podcast"
+    },
+    "links": [
+      {
+        "header": "Extra",
+        "items": [
+          {
+            "label": "About Tyk",
+            "href": "https://tyk.io/company/",
+            "blank": true
+          },
+          {
+            "label": "Blog",
+            "href": "https://tyk.io/blog/",
+            "blank": true
+          },
+          {
+            "label": "Careers",
+            "href": "https://tyk.io/current-vacancies/",
+            "blank": true
+          },
+          {
+            "label": "Pricing",
+            "href": "https://tyk.io/pricing-cloud/",
+            "blank": true
+          }
+        ]
+      },
+      {
+        "header": "Help",
+        "items": [
+          {
+            "label": "Cloud Status",
+            "href": "https://status.tyk.io/",
+            "blank": true
+          },
+          {
+            "label": "Raise Bug",
+            "href": "https://github.com/TykTechnologies/tyk/",
+            "blank": true
+          }
+        ]
+      },
+      {
+        "header": "Legal",
+        "items": [
+          {
+            "label": "Terms & Conditions",
+            "href": "https://tyk.io/terms-conditions/",
+            "blank": true
+          },
+          {
+            "label": "Privacy Policy",
+            "href": "https://tyk.io/privacy-policy/",
+            "blank": true
+          },
+          {
+            "label": "GDPR",
+            "href": "https://tyk.io/gdpr/",
+            "blank": true
+          },
+          {
+            "label": "© Tyk Technologies 2025",
+            "href": "https://tyk.io/terms-conditions/",
+            "blank": true
+          },
+          {
+            "label": "Responsible Disclosure",
+            "href": "https://app.zerocopter.com/en/cvd/261e0379-9eb8-4de6-b45d-48e30891a8bb",
+            "blank": true
+          }
+        ]
+      }
+    ]
+  },
+  "redirects": [
+    {
+      "source": "/api-management/manage-apis/api-operations/api-observability",
+      "destination": "/api-management/observability"
+    },
+    {
+      "source": "/basic-config-and-security/security/mutual-tls/client-mtls",
+      "destination": "/api-management/implement-tls"
+    },
+    {
+      "source": "/api-management/traffic-transformation/internal-endpoint",
+      "destination": "/advanced-configuration/transform-traffic/looping"
+    },
+    {
+      "source": "/deployment-and-operations/tyk-self-managed/tyk-demos-and-pocs/overview",
+      "destination": "/tyk-self-managed/install"
+    },
+    {
+      "source": "/api-management/external-service-integration",
+      "destination": "/tyk-identity-broker/overview"
+    },
+    {
+      "source": "/api-management/single-sign-on-oidc",
+      "destination": "/tyk-identity-broker/overview"
+    },
+    {
+      "source": "/api-management/single-sign-on-saml",
+      "destination": "/tyk-identity-broker/overview"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/favicon.png b/favicon.png
new file mode 100644
index 0000000000..04507afcfc
Binary files /dev/null and b/favicon.png differ
diff --git a/frequently-asked-questions/add-list-delete-developer-using-api.mdx b/frequently-asked-questions/add-list-delete-developer-using-api.mdx
new file mode 100644
index 0000000000..d67f97f180
--- /dev/null
+++ b/frequently-asked-questions/add-list-delete-developer-using-api.mdx
@@ -0,0 +1,15 @@
+---
+title: "How to add, list or delete a developer using the API"
+order: 0
+robots: "noindex, nofollow"
+sidebarTitle: "How to add, list or delete a developer using the API"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+Please refer to the [Portal Developer API endpoints documentation](/tyk-apis/tyk-portal-api/portal-developers).
+
+
+
diff --git a/frequently-asked-questions/alerts-new-developer-key-requests.mdx b/frequently-asked-questions/alerts-new-developer-key-requests.mdx
new file mode 100644
index 0000000000..eccc8ff00a
--- /dev/null
+++ b/frequently-asked-questions/alerts-new-developer-key-requests.mdx
@@ -0,0 +1,14 @@
+---
+title: "Alerts on new developer key requests"
+order: 0
+robots: "noindex, nofollow"
+sidebarTitle: "Alerts on new developer key requests"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+* Cloud users: If you are a paying customer and you don't use webhooks then you would need to contact us and we will set this up for you.
+
+* Self-Managed users: You can set this up using alerts and webhooks.
\ No newline at end of file
diff --git a/frequently-asked-questions/custom-developer-portal-options.mdx b/frequently-asked-questions/custom-developer-portal-options.mdx
new file mode 100644
index 0000000000..b87c6ccb45
--- /dev/null
+++ b/frequently-asked-questions/custom-developer-portal-options.mdx
@@ -0,0 +1,16 @@
+---
+title: "Custom Developer Portal Options"
+order: 0
+robots: "noindex, nofollow"
+sidebarTitle: "Custom Developer Portal Options"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+Use case: What if your developer portal is not exactly what I need?
+
+Sometimes our Tyk Gateway won't suit your exact needs.  Maybe you want to combine multiple Tyk installations under the same portal, or use your existing portal and add our functionality, or maybe customize the portal's branding per organization?
+
+We have the ability to configure the portal to suit your needs. For details, including a video tutorial, see [Create a Custom Developer Portal](/tyk-developer-portal/tyk-portal-classic/customise/custom-developer-portal).
diff --git a/getting-started/configure-first-api.mdx b/getting-started/configure-first-api.mdx
new file mode 100644
index 0000000000..55c21cf777
--- /dev/null
+++ b/getting-started/configure-first-api.mdx
@@ -0,0 +1,171 @@
+---
+title: "Tyk QuickStart: Configure Your First API"
+description: "Configure your first API on Tyk Cloud"
+keywords: "Tyk API Management, Open Source, Self-Managed, Tyk Cloud, API Gateway"
+sidebarTitle: "Configure Your First API"
+---
+
+## Overview
+This guide helps you get started with Tyk by covering the basics:
+
+- **Set up your API**: Create and configure a new API in the Tyk Dashboard.
+- **Create API keys**: Generate API keys and assign them to your APIs for secure access.
+- **Monitor API performance**: Track traffic, logs, and performance analytics.
+
+Follow these steps to quickly and easily create and manage your APIs with Tyk.
+
+> This page focuses on getting started with Tyk Cloud, If you are looking for information on Tyk Self-Managed, please refer to the [Getting Started with Tyk Self-Managed Guide](/getting-started/quick-start).
+
+## Prerequisites
+
+To start quickly, we'll use Tyk Cloud in this guide.
+
+Before you begin, make sure you have:
+- [A Tyk Cloud account](https://tyk.io/sign-up/#cloud).
+- Admin access to the Tyk Dashboard.
+- (optional) A backend service that your API will proxy (e.g., a RESTful API) - or you can use the httpbin service.
+
+
+## Set Up Your API
+
+Start by creating a new API in Tyk Cloud:
+
+1. **Log in to the Tyk Dashboard.**.
+2. **Navigate to APIs** and click **Add New API** or **Design From Scratch** button.
+
+  <img src="/img/getting-started/create-account-design-from-scratch.png" alt="Create New API" />
+
+3. **Configure API Details**:
+  - **API Name**: Name your API (e.g., `My First API`).
+  - **API Type**: Choose from HTTP, TCP, GraphQL, UDG, or Federation, depending on your use case.
+  - **API Style**: Select OpenAPI for standardized HTTP APIs or Classic for flexible configurations and non-HTTP APIs.
+  - **Target URL**: Provide the URL of your backend service (e.g., `http://httpbin.org`).
+
+  <img src="/img/getting-started/create-new-api.png" alt="Create New API" />
+
+4. **Connect to Your Desired Gateway**:
+
+  You will be prompted to choose between a Gateway and an Edge Gateway, which are already created for you.
+  - `Edge Gateways` generally provide low-latency, regionally distributed API processing, ideal for a global user base.
+  - `Regular Gateways` centralize API management, offering comprehensive API processing without additional edge optimizations.
+
+  <img src="/img/getting-started/apis-connect-gateways.png" alt="Connect Gateways" />
+
+5. **Configure your API Settings**:
+
+  - **Expiration Date**: An optional config that allows you to set an expiry date for this API, where access will expire after this date. This can be edited at any time.
+  - **Gateway Status**: Setting this to `Active` will publish your API and make it public. When in the `Disabled` state, your API will stay in a draft state until you are ready to publish it. This is a required field; for this guide, we will set it to `Active`.
+  - **Access**: Your API can be set to either `Internal` or `External`, determining whether you want to keep your API accessible only through Tyk or to external services, respectively. This is a required field; for this guide, we will set it to `External`.
+
+<img src="/img/getting-started/apis-configure-settings-1.png" alt="Configure Settings" />
+
+Scrolling down, in the **Upstream** section, you can configure settings to control the behaviour of your upstream APIs. 
+
+<Note>
+These are not necessary to add now, but they are good to explore.
+</Note>
+
+
+  - **API Rate Limiting**: Set limits on the number of requests (e.g., 100 requests per minute) to control usage and prevent abuse.
+  - **Service Discovery**: Enable dynamic backend discovery with tools like Consul or Kubernetes, ensuring traffic is directed to healthy instances.
+  - **Upstream Client Certificates**: Use client certificates for secure backend connections via mutual TLS (mTLS), adding an extra layer of security.
+  - **Certificate Public Key Pinning**: Pin specific public keys to validate certificate authenticity and prevent unauthorized access.
+
+  <img src="/img/getting-started/apis-configure-settings-2.png" alt="Configure Settings cont" />
+
+6. **Configuring the Server section**:
+
+  In this section, you can configure Tyk Gateway related settings. Below are some important configurations.
+  - **Listen Path**: This is the `path` Tyk API will use to proxy your API requests. So a request made to this URL `https://<tyk-clou-url>/<listen-path>` will be proxied to the upstream URL configured above.
+  - **Authentication**: Choose the desired authentication method (e.g., **API Key**).
+
+    <img src="/img/getting-started/create-api-select-authentication.png" alt="Add Authentication" />
+
+Save your API configuration once complete.
+
+7. **Copy the API URL**
+  - When you save the API configuration, Tyk generates a unique Gateway URL that can be used to access your API. Copy this URL, we will use it later during testing.
+
+    <img src="/img/getting-started/api-url-provided-by-tyk.png" alt="Tyk API Gateway URL" />
+
+## Create an API Key
+
+The Tyk Dashboard provides the simplest way to generate a new API key. Follow these steps:
+
+1. **Select "Keys"** from the **API Security** section and **Click "Add Key"** to generate a new key.
+   
+   <img src="/img/getting-started/create-api-security-key.png" alt="Create API Key" />
+
+2. **Add a Policy or API to Your Key**:
+   - You can either add your key to an existing **Policy** or assign it to an individual **API**.
+   - For this guide, we will assign the key to the `My First API`, which we created in the previous step. You can:
+     - Scroll through your **API Name list**,
+     - Use the **Search field** or **Group by Authentication Type** to filter APIs.
+   - Leave all other options at their default settings.
+
+   <img src="/img/getting-started/configure-api-key.png" alt="Configure API Key" />
+
+4. Click on the **Configuration Tab** and add the below details.
+   - **Enable Detailed Logging**: This is optional and disabled by default.
+   - **Key Alias**: Assign an alias to your key for easier identification.
+   - **Key Expiry**: Set an expiry time from the drop-down list. This is required.
+   - **Tags**: Add tags for filtering data in Analytics. Tags are case-sensitive.
+   - **Metadata**: Add metadata such as user IDs, which can be used by middleware components.
+
+5. Click **CREATE**:
+   - Once the key is created, a **Key successfully generated** pop-up will be displayed showing your key. **Copy the key ID** to your clipboard and save it for future reference, as it will not be shown again. And that should result in a successfully generated key!
+
+   <img src="/img/getting-started/apis-keys-success.png" alt="Key Success" />
+  
+
+  
+<Note>
+When creating a key in Tyk, you should copy the key ID. This is the identifier you’ll need for referencing the key in your API requests or configurations. The hash is generally used internally by Tyk and is not required for most user-facing tasks.
+</Note>
+
+  
+
+## Test Your API
+
+After configuring and deploying your API, it’s essential to test it to ensure it performs as expected. Follow these steps to verify your API setup:
+
+1. **Retrieve Your API Key**:
+   - Copy the **API Key ID** from the previous step as you'll need it to authenticate requests to your API.
+
+2. **Make a Test Request**:
+   - Use a tool like [Postman](https://www.postman.com/) or `curl` to send a request to your API endpoint.
+   - Example request using `curl`:
+     ```bash
+     curl -H "Authorization: {YOUR_API_KEY_ID}" https://{YOUR_TYK_GATEWAY_URL}/my-first-api/
+     ```
+   - Replace `{YOUR_API_KEY_ID}` with the actual key ID and `{YOUR_TYK_GATEWAY_URL}` with your gateway's URL.
+   - Send the request and you should get HTML output with `200` status code.
+
+
+## Monitor Traffic and Analyze API Performance
+
+With your API live, monitor its traffic and analyze performance:
+
+### View Traffic Analytics
+
+1. **Navigate to the Monitoring Section** in the dashboard. And click on **Activity Overview**.
+2. **View Traffic Metrics**: Review metrics such as request count, response times, and error rates.
+3. **Analyze Data**: Use traffic trends to identify performance issues or optimize API behavior.
+
+<img src="/img/getting-started/apis-analytics.png" alt="APIs Analytics" />
+
+
+### View Log Data
+
+1. **Go to the Activity Logs Section** of your API.
+2. **Search and Filter Logs**: Use filters to drill down by response status, endpoint, or client IP.
+3. **Review Detailed Logs**: View full request and response data to troubleshoot issues.
+
+<img src="/img/getting-started/api-activity-logs.png" alt="APIs Logs" />
+
+
+## Next Steps
+
+Congratulations! You've successfully created, secured, and deployed your first API in Tyk Cloud. Next, explore more advanced features such as adding [rate limiting](/api-management/rate-limit#introduction) to protect your API from abuse.
+
+Explore more features in your [dashboard](/getting-started/using-tyk-dashboard) to optimize and scale your API offerings.
diff --git a/getting-started/create-account.mdx b/getting-started/create-account.mdx
new file mode 100644
index 0000000000..da3567fbda
--- /dev/null
+++ b/getting-started/create-account.mdx
@@ -0,0 +1,129 @@
+---
+title: "Create Tyk Cloud Account"
+description: "Create your account on Tyk Cloud"
+keywords: "Tyk API Management, Open Source, Self-Managed, Tyk Cloud, API Gateway"
+sidebarTitle: "Create Account"
+---
+
+Welcome to Tyk! This guide will walk you through the process of creating your account and getting started with our powerful API management platform.
+
+## Choosing Your Tyk Solution
+
+Tyk offers multiple deployment options to suit your needs:
+
+- **Tyk Cloud**: A fully managed service for easy API management at any scale.
+- **Tyk Self-Managed**: Install the full lifecycle API management solution in your own infrastructure.
+
+    > This page focuses on getting started with Tyk Cloud, If you are looking for information on Tyk Self-Managed, please refer to the [Getting Started with Tyk Self-Managed Guide](/getting-started/quick-start).
+
+- **Tyk Open Source**: The core API Gateway, freely available and open source.
+
+For this guide, we'll focus on creating an account for Tyk Cloud, which offers a free 48 hour trial.
+
+## Creating Your Tyk Cloud Account
+
+### Step 1: Visit the Sign-Up Page
+
+Navigate to the Tyk sign-up page at [https://tyk.io/sign-up/](https://tyk.io/sign-up/).
+
+### Step 2: Choose "Start Your 48-hour Free Trial"
+
+On the sign-up page, select the "Start your 48-hour free trial" option to begin your Tyk Cloud experience.
+
+<img src="/img/getting-started/create-account-start-trial.png" alt="Start Trial" />
+
+
+### Step 3: Complete the Account Creation Form
+
+Fill out the account creation form with your details:
+
+- First Name
+- Last Name
+- Email Address
+- Password
+- Company Name (if applicable)
+- Work Role and How We Can Help
+
+
+<img src="/img/getting-started/create-account-free-trial-info.png" alt="Create Account Free Trial" />
+
+
+### Step 4: Check Your Email
+Check your email inbox for a verification message from Tyk. Click the verification link to confirm your email address.
+
+<img src="/img/getting-started/create-account-resend-email.png" alt="Create Account Resend Email" />
+
+
+In your inbox, you should find this email (press "Log in"):
+
+<img src="/img/getting-started/create-account-view-email.png" alt="Create Account View Email" />
+
+
+
+### Step 5: Create Password
+After finding the email and logging in, set your password, organization name (any name which you want to represent your environment), and control plane region (select the control plane which is closest to your location).
+
+<img src="/img/getting-started/create-account-set-password.png" alt="Create Account Set Password" />
+
+
+
+### Step 6: Deploy and Take Tutorial
+Once your password, organization, and control plane are setup, continue to the next page where your environment will be deployed. This may take 2-5 minutes, you can peruse the tutorial to learn how to use the dashboard while you wait.
+
+<img src="/img/getting-started/create-account-deploy-tutorial.png" alt="Create Account Deploy Tutorial" />
+
+
+After a few minutes, the "Add API" button should appear. Select it and you will be taken to the dashboard.
+
+<img src="/img/getting-started/create-account-add-api.png" alt="Create Account Add API" />
+
+
+### Step 7: Start Creating APIs
+Finally, you will be taken to the Tyk Dashboard. Select "Design From Scratch" and continue on to [our tutorial](/getting-started/configure-first-api) to learn how to setup and secure your APIs.
+
+<img src="/img/getting-started/create-account-design-from-scratch.png" alt="Create Account Design From Scratch" />
+
+## What Happens Next?
+
+Once you've created your account, Tyk will automatically:
+
+- **Assigns Billing Admin Role**: You are designated as the Billing Admin for your organization, granting you full access to manage billing details and subscription plans.
+
+- **Activates 48-Hour Free Trial**: Your account is enrolled in a 48-hour free trial of Tyk Cloud, allowing you to explore its features and capabilities without immediate commitment.
+
+- **Creates Initial Organization**: An organization is automatically established, serving as the primary entity for managing your environments, APIs, and users.
+
+- **Establishes Default Team**: A default team is set up within your organization, providing a collaborative space for managing APIs and related resources.
+
+- **Deploys Control Plane**: A control plane is deployed in your selected home region, centralizing the management of your APIs, policies, and configurations.
+
+- **Deploys Gateway**: A Tyk Gateway is deployed to manage and route incoming API traffic, handling authentication, rate limiting, and analytics to ensure secure, reliable access.
+
+For certain Tyk Cloud configurations, you may also get an Edge Gateway deployment option, allowing gateways to be positioned closer to users for lower latency and optimized routing. This is ideal for multi-region or global API setups but may require additional configuration or regional deployment options through Tyk’s Multi Data Centre Bridge (MDCB) if set up manually.
+
+
+
+
+<Note>
+After the 48-hour free trial of Tyk Cloud ends, your infrastructure (control plane, gateway, and organization settings) will be deactivated unless you upgrade to a paid plan. Here’s what happens:
+
+- Limited Access: Control plane access and API traffic routing through the gateway will be suspended.
+- Data Retention: Your configurations (APIs, policies, user settings) are temporarily retained, allowing you to pick up where you left off if you upgrade within a grace period.
+- Billing Admin Role: You’ll still be able to manage billing and subscription options.
+
+Upgrading restores full functionality, letting you continue from where you paused. To avoid disruption, consider exploring paid plans before your trial ends.
+</Note>
+
+
+## Next Steps
+
+Now that you have your Tyk account set up, here are some recommended next steps:
+
+- **Create Your First API**: Follow our guide on [setting up and securing your first API](/getting-started/configure-first-api).
+- **Explore the Dashboard**: Familiarize yourself with the [Tyk Cloud interface](/api-management/dashboard-configuration).
+
+## Need Help?
+
+If you encounter any issues or have questions during the setup process, don't hesitate to reach out to our support team at support@tyk.io.
+
+Remember, Tyk offers powerful features for API management, security, and performance. Take advantage of your trial period to explore all that Tyk has to offer!
diff --git a/getting-started/key-concepts/api-catalogue.mdx b/getting-started/key-concepts/api-catalogue.mdx
new file mode 100644
index 0000000000..fcf1ec10a2
--- /dev/null
+++ b/getting-started/key-concepts/api-catalogue.mdx
@@ -0,0 +1,22 @@
+---
+title: "Portal API Catalog"
+order: 90
+robots: "noindex, nofollow"
+sidebarTitle: "Portal API Catalogue"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+The API Catalog is part of the API Developer Portal of the Dashboard. It is the central place for you to manage which APIs your registered developers have access to.
+
+The API catalog is completely separate from the regular API list section of the dashboard, as you may only wish to expose some of those APIs managed by Tyk to end users.
+
+API Catalog entries are not actual directly tied to APIs in any way, they are connected to policies.
+
+The reason for this is that policies can give access to a bundle of underlying APIs and therefore can represent a facade of services exposed as a single interface.
+
+The concept of the API Catalog is that you publish what you wish your external APIs to appear as. So, for example, if you have a widgets API that is composed of 4 microservices (i.e. `/comments`, `/pricing`, `/details`, and `/SKU`), which are managed as four separate APIs in your Dashboard, but combined under a single Security Policy (so one token can access all four APIs), then you may not wish to have your users know these are microservices, they are just endpoints in your widgets API.
+
+This approach allows you to separate "management" from "consumption" using a simple CMS-based bundling approach.
diff --git a/getting-started/key-concepts/url-matching.mdx b/getting-started/key-concepts/url-matching.mdx
new file mode 100644
index 0000000000..e40c1ff991
--- /dev/null
+++ b/getting-started/key-concepts/url-matching.mdx
@@ -0,0 +1,271 @@
+---
+title: "Request Matching"
+description: "Learn how Tyk Gateway identifies which API and endpoint owns an incoming request"
+keywords: "URL path matching, listen path, endpoint path, routing, pattern matching, path ordering, regex"
+sidebarTitle: "Request Matching"
+---
+
+Request matching is the first stage in Tyk Gateway's routing pipeline. Before any other processing occurs, it must determine which API definition and which endpoint owns the incoming request. Only when a match is found does further processing take place.
+
+Matching happens at two levels:
+
+- **API-level:** Tyk Gateway compares the request URL against the listen paths of all registered APIs to identify which API definition to use.
+- **Endpoint-level:** Within the matched API, Tyk Gateway compares the remainder of the request path against the endpoint patterns defined in the API definition to identify which endpoint configuration applies.
+
+## The Request URL
+
+When a client sends a request to an API hosted on Tyk Gateway, the URL follows this structure:
+
+```
+<protocol>://<domain>/<listenPath>/<endpointPath>
+```
+
+With reference to [RFC 3986](https://www.ietf.org/rfc/rfc3986.txt), `protocol` is the scheme, `domain` is the authority, and `listenPath/endpointPath` together form the path.
+
+- The **listen path** is defined in the API definition. Tyk Gateway compares the incoming URL (after stripping the domain) against all registered listen paths to identify the correct API definition.
+- The **endpoint path** is the remainder of the URL after the listen path (and any version identifier). This is compared against the endpoint patterns in the matched API definition.
+
+If no API listen path matches the request, Tyk Gateway returns `HTTP 404 Not Found`.
+
+<Note>
+Tyk Gateway acts as a reverse proxy. When forwarding a request upstream, it replaces its own hostname with the upstream [target URL](/api-management/gateway-config-tyk-oas#upstream) configured in the API definition. The [strip listen path](/api-management/gateway-config-tyk-oas#listenpath) option removes the listen path from the upstream request, allowing a cleaner public API facade over a legacy upstream service.
+</Note>
+
+## API-Level Matching: The Listen Path
+
+Tyk Gateway treats the listen path configured in an API definition as a regular expression, enabling advanced users to perform complex listen path matching.
+
+### Path Ordering
+
+Before attempting to match an incoming request against registered listen paths, all loaded API definitions are sorted into a priority order. The Gateway tests each listen path in turn and uses the first match it finds. Understanding this ordering is important when multiple APIs have similar or overlapping listen paths.
+
+The ordering rules are:
+
+1. APIs are divided into two groups: those with a [custom domain](/api-management/implement-tls#configure-server-certificates-for-api-custom-domains) configured, and those without. APIs with a custom domain take priority.
+2. Within each group, APIs are ordered by their *effective path length*, from longest to shortest.
+    - Effective path length counts all characters in the listen path except the characters inside dynamic segments such as `{id}` or `{id:regex}`.
+    - Slashes count towards the total, so paths with more segments score higher than structurally equivalent paths with fewer segments.
+    - However, character length within static segments is the dominant factor. A long single-segment path outranks a short multi-segment path when the total character count is higher.
+
+<Warning>
+When two listen paths have the same effective length, the ordering between them is non-deterministic. Avoid deploying APIs with listen paths of identical effective length if they could overlap, as the routing outcome will be unpredictable.
+</Warning>
+
+For example:
+- `/books/fiction` (effective length 14) ranks above `/books/{category}` (effective length 7, since `{category}` is excluded).
+- `/users/{id}/profile` (effective length 15) ranks above `/users/{id}` (effective length 7).
+- `/books/non-fiction` (effective length 18) ranks above `/books` (effective length 6).
+- `/books/new-releases` (effective length 19) ranks above `/books/by/author` (effective length 16), despite having fewer path segments.
+
+### Strict Routes
+
+The [http_server_options.enable_strict_routes](/tyk-oss-gateway/configuration#http_server_options-enable_strict_routes) configuration option prevents listen paths from matching requests that only share a common prefix. When enabled, Tyk Gateway performs an exact match against the listen path including the trailing `/`.
+
+For example, with a listen path of `/app`:
+- **Strict Routes Enabled:** matches `/app`, `/app/`, and `/app/*` but not `/app1/*` or `/apple/`
+- **Strict Routes Disabled:** all of the above match
+
+**Tyk recommends enabling exact path matching with strict routes for most use cases.**
+
+### Dynamic Listen Paths
+
+Listen paths support dynamic segments using the `{paramName:regex}` syntax. Tyk Gateway uses the regex constraint when matching the listen path, so the path will only match requests where the dynamic segment satisfies the constraint.
+
+| Listen Path Pattern | Regular Expression Used in Match |
+| :--- | :--- |
+| `/users/{id}/profile/{type:[a-zA-Z]+}` | `^/users/([^/]+)/profile/([a-zA-Z]+)$` |
+| `/items/{itemID:[0-9]+}/details/{detail}` | `^/items/([0-9]+)/details/([^/]+)$` |
+| `/products/{productId}/reviews/{rating:\d+}` | `^/products/([^/]+)/reviews/(\d+)$` |
+
+For example, a listen path of `/items/{itemID:[0-9]+}/details/{detail}` matches `/items/42/details/colour` because `42` satisfies the `[0-9]+` constraint, but does not match `/items/widget/details/colour` because `widget` does not.
+
+A request that fails the constraint falls through to the next listen path in the ordered list rather than being rejected immediately.
+
+### The API ID Prefix
+
+Tyk Gateway also registers every API at `/{APIID}/` in addition to its configured listen path. This can be useful during development or in automation scripts where the API ID is already known from a management API response and a quick test call is needed without looking up the listen path. **This prefix is not suitable for production traffic.** 
+
+When a request arrives via `/{APIID}/`, `strip_listen_path` has no effect - the upstream receives the full path including the API ID rather than the stripped endpoint path. **Use the configured listen path for all production routing.**
+
+
+## Endpoint-Level Matching: URL Patterns
+
+Once Tyk Gateway has identified the API definition, it compares the endpoint path against patterns defined in the API's endpoint configuration. These patterns are treated as regular expressions.
+
+### Versioning
+
+If the API uses [URL path versioning](/api-management/api-versioning#request-url-path), Tyk Gateway extracts the version identifier from the first path segment after the listen path before performing endpoint matching. See [API Versioning](/api-management/api-versioning) for configuration detail.
+
+### Basic Patterns
+
+A fixed pattern such as `/users` matches requests whose endpoint path is (or contains, depending on [matching mode](#matching-modes)) that exact string.
+
+### Dynamic Path Parameters
+
+Path parameters allow a pattern to match variable segments in the request path. Tyk Gateway converts each `{paramName}` into a capturing regex group (`([^/]+)`), which matches any non-slash sequence.
+
+| Path Pattern | Regular Expression Used in Match |
+| :--- | :--- |
+| `/users/{id}` | `^/users/([^/]+)$` |
+| `/static/{path}/assets/{file}` | `^/static/([^/]+)/assets/([^/]+)$` |
+| `/orders/{orderId}/items/{itemId}` | `^/orders/([^/]+)/items/([^/]+)$` |
+
+Two wildcard forms are also supported:
+
+| Wildcard | Matches |
+| :--- | :--- |
+| `{*}` or `*` mid-path | one path segment, equivalent to a named parameter |
+| `*` end of path | remainder of path, including slashes |
+
+For example, `/files/*` matches both `/files/report.pdf` and `/files/documents/report.pdf`, whereas `/files/{name}` matches only `/files/report.pdf`.
+
+#### Validating Path Parameters
+
+Define parameter constraints in the OpenAPI parameter schema using standard fields such as `type`, `pattern`, `format`, and `enum`. Enable the [Validate Request](/api-management/traffic-transformation/request-validation) middleware to have Tyk Gateway enforce these constraints on incoming requests, rejecting any request where a parameter value does not match. Where multiple endpoints share the same path structure, Tyk Gateway also uses schema constraints to identify the correct endpoint.
+
+For example, to accept only [ULID](https://github.com/ulid/spec) values for the `id` parameter:
+
+```yaml
+paths:
+  /users/{id}:
+    get:
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+            pattern: '^[0-7][0-9A-HJKMNP-TV-Z]{25}$'
+```
+
+If using Tyk Classic, write the endpoint as a full regular expression in the `path` field of the extended paths entry rather than using `{paramName}` syntax. For example, to accept only [ULID](https://github.com/ulid/spec) values:
+
+```json
+"extended_paths": {
+  "track_endpoints": [
+    {
+      "path": "^/users/(?i)[0-7][0-9A-HJKMNP-TV-Z]{25}$",
+      "method": "GET"
+    }
+  ]
+}
+```
+
+### When No Endpoint Matches
+
+If a request matches the API's listen path but no endpoint pattern in the API definition matches the request path, Tyk Gateway proxies the request upstream and applies only API-level middleware. Endpoint-specific middleware does not fire.
+
+This default pass-through behavior means that paths not declared in the API definition are accessible unless explicitly restricted. Two middleware options control this:
+
+- **Allow List:** Configures a list of permitted endpoint patterns. Any request that does not match an entry is rejected with `HTTP 403`. This changes the default from allow-by-default to deny-by-default and is the recommended approach for locking down an API to only its declared endpoints. See [Allow List](/api-management/traffic-transformation/allow-list).
+- **Block List:** Configures a list of explicitly forbidden endpoint patterns. Matching requests are rejected with `HTTP 403`; all other requests pass through. See [Block List](/api-management/traffic-transformation/block-list).
+
+### Matching Modes
+
+The matching mode controls how Tyk Gateway anchors endpoint patterns when testing them against the request path. Tyk recommends enabling **exact** matching for most production use cases. In the default wildcard mode, a pattern such as `/user` matches not only `/my-api/user` but also `/my-api/users` and `/my-api/groups/12/username/abc`, which is rarely the intended behavior.
+
+The mode is determined by two independent settings, which can be enabled in any combination:
+
+- [http_server_options.enable_path_prefix_matching](/tyk-oss-gateway/configuration#http_server_options-enable_path_prefix_matching)
+- [http_server_options.enable_path_suffix_matching](/tyk-oss-gateway/configuration#http_server_options-enable_path_suffix_matching)
+
+| Mode   | Prefix Setting | Suffix Setting | Pattern Matches On |
+| :----- | :------------- | :------------- | :----------------- |
+| Wildcard (default) | `false` | `false` | any substring of the path |
+| Prefix | `true`  | `false` | from the start of the path |
+| Suffix | `false` | `true`  | at the end of the path     |
+| Exact  | `true`  | `true`  | the full path              |
+
+In **exact** mode, `/user` is anchored at both ends. Tyk Gateway tests the pattern against three path forms in sequence, accepting the first match:
+- Endpoint path only: `/user`
+- Full path without version: `/listen-path/user`
+- Full path including listen path and version: `/listen-path/v4/user`
+
+In **prefix** mode, `/user` must appear at the start of the path but can be followed by anything, so it matches `/user`, `/user/profile`, and `/user/123`. Tyk Gateway tests against the same three path forms as exact mode.
+
+In **suffix** mode, `/user` must appear at the end of the path, so it matches `/my-api/user` and `/api/v2/user` but not `/my-api/user/profile`.
+
+In **wildcard** mode, `/user` can match anywhere in the path, including as a substring, so it also matches `/my-api/users` and `/my-api/groups/12/username/abc`.
+
+#### Overriding the Matching Mode
+
+The gateway-wide matching mode can be overridden for individual patterns using `^` and `$` anchors in the pattern itself:
+
+- Adding `^` to the start of a pattern applies prefix matching for that pattern, regardless of the global setting.
+- Adding `$` to the end of a pattern applies suffix matching for that pattern, regardless of the global setting.
+- Omitting the leading `/` suppresses prefix matching for that pattern, even if enabled globally.
+
+If suffix matching is globally enabled, it cannot be disabled per-pattern. To achieve an explicit exact match in this case, write a full regular expression starting with `^/` and ending with `$`.
+
+The following table shows the effective matching mode for combinations of gateway settings and pattern forms:
+
+| Prefix Mode | Suffix Mode | Pattern | Effective Mode |
+| :--- | :--- | :--- | :--- |
+| ❌ | ❌ | `/my-api/my-endpoint/{my-param}` | wildcard |
+| ✅ | ❌ | `/my-api/my-endpoint/{my-param}` | prefix |
+| ❌ | ✅ | `/my-api/my-endpoint/{my-param}` | suffix |
+| ✅ | ✅ | `/my-api/my-endpoint/{my-param}` | exact |
+| ❌ | ❌ | `^/my-api/my-endpoint/{my-param}` | prefix |
+| ✅ | ❌ | `^/my-api/my-endpoint/{my-param}` | prefix |
+| ❌ | ✅ | `^/my-api/my-endpoint/{my-param}` | exact |
+| ✅ | ✅ | `^/my-api/my-endpoint/{my-param}` | exact |
+| ❌ | ❌ | `/my-api/my-endpoint/{my-param}$` | suffix |
+| ✅ | ❌ | `/my-api/my-endpoint/{my-param}$` | exact |
+| ❌ | ✅ | `/my-api/my-endpoint/{my-param}$` | suffix |
+| ✅ | ❌ | `/my-api/my-endpoint/{my-param}$` | exact |
+| ❌ | ❌ | `^/my-api/my-endpoint/{my-param}$` | exact |
+| ✅ | ❌ | `^/my-api/my-endpoint/{my-param}$` | exact |
+| ❌ | ✅ | `^/my-api/my-endpoint/{my-param}$` | exact |
+| ✅ | ✅ | `^/my-api/my-endpoint/{my-param}$` | exact |
+| ❌ | ❌ | `my-api/my-endpoint/{my-param}` | wildcard |
+| ✅ | ❌ | `my-api/my-endpoint/{my-param}` | wildcard |
+| ❌ | ✅ | `my-api/my-endpoint/{my-param}` | suffix |
+| ✅ | ✅ | `my-api/my-endpoint/{my-param}` | suffix |
+| ❌ | ❌ | `/my-api/my-endpoint/*` | wildcard |
+| ✅ | ❌ | `/my-api/my-endpoint/*` | prefix |
+| ❌ | ✅ | `/my-api/my-endpoint/*` | wildcard |
+| ✅ | ✅ | `/my-api/my-endpoint/*` | prefix |
+| ❌ | ❌ | `my-api/my-endpoint/*` | wildcard |
+| ✅ | ❌ | `my-api/my-endpoint/*` | wildcard |
+| ❌ | ✅ | `my-api/my-endpoint/*` | wildcard |
+| ✅ | ✅ | `my-api/my-endpoint/*` | wildcard |
+
+## Protocol-Specific Matching
+
+The matching behavior described above applies to standard HTTP APIs. Two protocols have specific requirements.
+
+**gRPC:** The listen path must match the gRPC service name. gRPC method routing follows the path structure `/{ServiceName}/{MethodName}`, where the service name corresponds to the listen path. See [gRPC Proxy](/key-concepts/grpc-proxy) for configuration detail.
+
+**TCP/TLS:** Where multiple TCP APIs share the same port, Tyk Gateway uses Server Name Indication (SNI) to route connections to the correct API. See [TCP Proxy](/key-concepts/tcp-proxy) for configuration detail.
+
+## Migrating Endpoint Patterns from Tyk Classic
+
+The following behaviors are available in Tyk Classic endpoint patterns that cannot be carried over directly to Tyk OAS.
+
+**Routing vs. Validation Semantics:** In Tyk Classic, the endpoint pattern is a regex applied at routing time. A request that does not match any endpoint pattern is not associated with that endpoint. Its middleware does not fire and the request is proxied upstream without error, with only API-level middleware applied. See [When No Endpoint Matches](#when-no-endpoint-matches).
+
+In Tyk OAS, routing is determined by the path template structure. All requests matching the template shape reach the endpoint regardless of parameter values. To enforce parameter value constraints, you must enable the [Validate Request](/api-management/traffic-transformation/request-validation) middleware explicitly. A validation failure returns `HTTP 422`.
+
+**Path Patterns with No Template Equivalent:** Some Tyk Classic regex patterns cannot be expressed as a single OpenAPI path template and require redesign. The most common case is alternation: a pattern such as `^/(users|groups)/[0-9]+$` matches two distinct path shapes and must be split into two separate operations in Tyk OAS.
+
+**Parameter Schema Anchoring:** When migrating parameter constraints to a Tyk OAS parameter schema, note that the `pattern` field is not anchored by default. Without explicit `^` and `$`, a pattern matches any parameter value containing the expression rather than the full value. For example, `[0-9]+` matches `abc123` as well as `123`. Write patterns as `^[0-9]+$` to enforce full-value matching. This is distinct from the routing-level anchoring described in [Matching Modes](#matching-modes), which applies equally to both Tyk OAS and Tyk Classic.
+
+**Regex Engine:** Tyk Classic endpoint patterns use [Go RE2](https://pkg.go.dev/regexp). Although the OpenAPI Specification defines the `pattern` field as ECMA 262 regex, Tyk Gateway validates Tyk OAS patterns using Go RE2 as well. Lookaheads, lookbehinds, and backreferences are not available in either context.
+
+## Gateway Versions Prior to 5.0.14
+
+Gateway-level configuration of URL path matching behavior was introduced in:
+
+- Tyk Gateway 5.0.14
+- Tyk Gateway 5.3.5
+- Tyk Gateway 5.5.1
+
+Prior to these versions, path matching was performed against the full request path in wildcard mode. To achieve prefix or suffix matching in older versions, write the endpoint pattern as a full regular expression. For example:
+
+- `^/[^/]+/v4/json$` - exact match for any listen path with `/v4/json` below it
+- `^/listen-path/users` - prefix match for a known listen path
+- `^/{*}/json` - prefix match with a wildcard listen path segment
+
+<Warning>
+In versions prior to 5.0.14, an invalid regular expression in an endpoint pattern could cause unexpected matching behavior. Validate all regular expressions before deployment.
+</Warning>
diff --git a/getting-started/quick-start.mdx b/getting-started/quick-start.mdx
new file mode 100644
index 0000000000..f35360c08a
--- /dev/null
+++ b/getting-started/quick-start.mdx
@@ -0,0 +1,334 @@
+---
+title: "Getting Started with Tyk"
+description: "Quickly set up Tyk Self-Managed with our comprehensive guide, including installation options and demo environments."
+sidebarTitle: "Install & Explore"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+## Introduction
+
+Tyk Self-Managed is a full-featured API management platform that you deploy and control on-premise, within your own infrastructure. This page will guide you through setting up and exploring your Self-Managed Tyk environment.
+
+### What's included in your trial
+
+Your Tyk Self-Managed trial includes:
+
+- **[Tyk Gateway](/tyk-oss-gateway)**: The core API Gateway that handles all your API traffic
+- **[Tyk Dashboard](/api-management/dashboard-configuration)**: A [REST API](/tyk-dashboard-api) with a [web interface](/getting-started/using-tyk-dashboard) for managing your APIs, policies, and monitoring
+- **[Developer Portal](/portal/overview/intro)**: A customizable API portal to securely publish and manage API access for your consumers.
+- **Monitoring**: Detailed insights into API usage and performance
+- **Sample APIs**: Pre-configured APIs to help you explore Tyk's capabilities
+
+### System Requirements
+
+- **Docker**: [Docker Engine](https://docs.docker.com/engine/install/) 24.0 or newer
+- **Docker Compose**: [Docker Compose](https://docs.docker.com/compose/install/) v2.20 or later
+- **CPU & Memory**: Minimum 4 GB RAM and 2 CPU cores
+- **License Key**: A valid Tyk Self-Managed license key.
+
+    You can quickly get started with a self-managed trial license by completing the registration on our [website](https://tyk.io/self-managed-trial). After registering, you’ll receive an email containing your license key.
+
+    If you’d rather have guided assistance, we recommend checking out our [Tyk Technical PoC Guide](https://tyk.io/customer-engineering/poc/technical-guide/).
+
+### Trial Duration and Limitations
+
+Your trial license is valid for **14 days from activation**. During this period, you have access to all Enterprise features. After the trial period, you’ll need to purchase a license to continue using Tyk Self-Managed.
+
+To continue using Tyk Self-Managed after your trial, please contact our [team](https://tyk.io/contact/) to discuss licensing options.
+
+<ButtonLeft href="https://tyk.io/contact/" color="green" content="Contact us" />
+
+<br />
+<br />
+
+## Quick Setup
+
+This section provides a step-by-step guide to quickly set up Tyk Self-Managed using Docker.
+
+### Prerequisites
+
+1. Install [Docker Engine](https://docs.docker.com/engine/install/) 24.0 or newer and [Docker Compose](https://docs.docker.com/compose/install/) v2.20 or later
+2. Install the following CLI tools:
+    - [Jq](https://stedolan.github.io/jq/download/) (for JSON processing)
+    - [Git](https://git-scm.com/downloads) (for cloning Github repository)
+    - [curl](https://curl.se/download.html) (for making API requests)
+3. Tyk Self-Managed license key (from your trial email) 
+    - If you are having issues with your trial license, please contact info@tyk.io
+
+### Installation
+
+1. Clone the repository and navigate to the self-managed Docker directory:
+
+    ```bash
+    git clone https://github.com/TykTechnologies/tyk-install
+    cd tyk-install/docker/self-managed
+    ```
+
+2. Copy the example environment file and add your license keys:
+
+    ```bash
+    cp .env.example .env
+    ```
+
+    Open `.env` and set your license keys:
+
+    ```bash
+    TYK_LICENSE_KEY=<your-tyk-license-key>
+    TYK_PORTAL_LICENSE=<your-tyk-license-key>
+    ```
+
+3. Start the Tyk stack:
+
+    ```bash
+    cd ../getting-started
+    bash start.sh
+    ```
+
+    This command starts all the necessary containers and automatically bootstraps the environment with pre-configured APIs, policies, and portal setup. The process may take up to 60 seconds on first run.
+
+    Containers started:
+    - Tyk Gateway
+    - Tyk Dashboard
+    - Developer Portal
+    - Redis (caching and session storage)
+    - PostgreSQL (data storage)
+    - Tyk Pump (analytics)
+    - Sample API service (httpbin)
+
+4. Once all containers are running, you can verify their status with:
+
+    ```bash
+    docker ps
+    ```
+
+    You should see all services listed as "Up".
+
+    <img src="/img/self-managed/self-managed-trial-docker-status.png" alt="Docker Container Status of Tyk Self Managed Trial" />
+
+### Default Credentials and Access Points
+
+Once the installation is complete, you can access the following components:
+
+```
+---------------------------
+Your Tyk Dashboard URL is http://localhost:3000
+
+user: developer@tyk.io
+pw: specialpassword
+---------------------------
+Your Tyk Gateway URL is http://localhost:8080
+---------------------------
+Your Developer Portal URL is http://localhost:3001
+
+admin user: portaladmin@tyk.io
+admin pw: specialpassword
+---------------------------
+```
+
+### Verifying Your Installation
+
+1. **Verify Dashboard Access**:
+    1. Open your browser and navigate to `http://localhost:3000`
+    2. Log in with the default credentials (developer@tyk.io / specialpassword)
+    3. You should see the Tyk Dashboard with pre-configured APIs and monitoring
+
+    <img src="/img/self-managed/self-managed-trial-dashboard.png" alt="Self Managed Tyk Dashbaord" />
+
+2. **Verify Gateway Access**:
+    1. Open a terminal and run:
+    ```
+    curl -s http://localhost:8080/hello | jq
+    ```
+    2. You should receive a JSON response from the API, confirming that the Tyk Gateway is functioning correctly.
+
+    ```json
+   {
+      "status": "pass",
+      "version": "5.8.2",
+      "description": "Tyk GW",
+      "details": {
+         "dashboard": {
+            "status": "pass",
+            "componentType": "system",
+            "time": "2025-08-06T10:10:46Z"
+         },
+         "redis": {
+            "status": "pass",
+            "componentType": "datastore",
+            "time": "2025-08-06T10:10:46Z"
+         }
+      }
+   }
+    ```
+
+3. **Verify Developer Portal Access**:
+    1. Open your browser and navigate to `http://localhost:3001`
+    2. Log in with the default credentials (portaladmin@tyk.io / specialpassword)
+    3. You should see the `Overview` section of the Developer Portal.
+
+    <img src="/img/self-managed/self-managed-trial-portal.png" alt="Developer Portal" />
+
+## Exploring Your Pre-Configured Environment
+
+When you run the Docker Compose command in the previous section, several interconnected components are deployed to create a complete Tyk API Management ecosystem. Let's explore what's installed and how these components work together.
+
+The following diagram illustrates the components of your Tyk Self-Managed installation and how they interact:
+
+<img src="/img/self-managed/self-managed-trial-architecture.png" alt="Self Managed Tyk Architecture" />
+
+{/* ```mermaid
+graph TD
+    User[External User/API Consumer] -/->|API Requests| Gateway
+    Developer[API Developer] -/->|Manages APIs| Dashboard
+    PortalUser[Portal User/Developer] -/->|Browses & Subscribes| Portal
+    
+    subgraph "Tyk Self-Managed Environment"
+        Gateway[Tyk Gateway<br/>:8080] -/->|Forwards Requests| HttpBin[HttpBin Service<br/>:8081]
+        Gateway -/->|Stores Data| Redis[Redis<br/>:6379]
+        Gateway -/->|Reports Analytics| Pump[Tyk Pump]
+        
+        Dashboard[Tyk Dashboard<br/>:3000] -/->|Configures| Gateway
+        Dashboard -/->|Reads/Writes| Redis
+        Dashboard -/->|Stores Config & Analytics| Postgres[PostgreSQL<br/>:5432]
+        
+        Portal[Enterprise Portal<br/>:3001] -/->|Gets API Products| Dashboard
+        Portal -/->|Stores Data| Postgres
+        
+        Pump -/->|Processes Analytics| Postgres
+    end
+    
+    style Gateway fill:#f9f,stroke:#333,stroke-width:2px
+    style Dashboard fill:#bbf,stroke:#333,stroke-width:2px
+    style Portal fill:#bfb,stroke:#333,stroke-width:2px 
+``` */}
+
+**Key Components:**
+
+1. **Tyk Gateway (tyk-gateway)**: The core API Gateway that processes all API requests, applies policies, and enforces security. Exposed on port 8080.
+
+2. **Tyk Dashboard (tyk-dashboard)**: The management interface for configuring APIs, policies, and viewing monitoring data. Exposed on port 3000.
+
+3. **Developer Portal (tyk-ent-portal)**: A customizable portal for API consumers to discover, test, and subscribe to APIs. Exposed on port 3001.
+
+4. **Redis (tyk-redis)**: Used for caching, session management, and real-time communication between components. Exposed on port 6379.
+
+5. **PostgreSQL (tyk-postgres)**: Stores configuration data, user information, and analytics. Exposed on port 5432.
+
+6. **Tyk Pump (tyk-pump)**: Processes and transfers analytics data from the Gateway to the database for reporting.
+
+7. **HttpBin (httpbin)**: A sample API service that provides various endpoints for testing. Exposed on port 8081.
+
+With these components, you have a fully functional Tyk Self-Managed environment that allows you to manage APIs, monitor usage, and provide a developer portal for your API consumers. Let's explore how to navigate the Dashboard, understand the pre-loaded APIs, and preview the Developer Portal.
+
+### Dashboard Tour
+
+The Tyk Dashboard is your central hub for managing APIs, monitoring performance, and configuring security settings.
+
+<img src="/img/self-managed/self-managed-trial-dashboard.png" alt="Self Managed Tyk Dashbaord" />
+
+Let's explore the main sections available in the sidebar:
+
+#### Navigating the Tyk Dashboard
+
+Dashboard is organized into a few key categories:
+* **API Management**: In API Management, you can access and edit all your APIs, create [data graphs](/api-management/data-graph), and add webhooks.
+* **API Security**: In API Security, you can manage [keys](/api-management/access-control/sessions-and-keys/understanding-sessions), [Policies](/api-management/policies), and [certificates](/api-management/certificates) to customize your security settings. 
+* **User Management**: In [User Management](/api-management/user-management), you can control permissions and access for users and user groups. You can also create profiles that help you manage third party identity providers for specific Tyk actions like signing into the portal or logging into the dashboard.
+* **Monitoring**: In [Monitoring](/api-management/dashboard-analytics#traffic-analytics), you can view activity reports, logs, and analytics related to your APIs.
+* **System Management**: In [System Management](/platform-management/open-policy-agent), you can affect OPA rules that define fine-grained access control for managing and enforcing permissions on various actions and resources in Tyk’s API management system.
+{/* TODO: Remove this when we upgrade this guide to 5.9.0: In 5.9.0 the Classic Portal will be hidden in the Dashboard */}
+* **Classic Portal**: In Classic Portal, you can affect permissions and configurations related to your developer portal. The Tyk Developer Portal is a platform that enables you to publish, manage, and promote your APIs to external developers.
+
+
+For a comprehensive guide to the Dashboard, refer to the [using Tyk Dashboard](/getting-started/using-tyk-dashboard#dashboard-organization) guide.
+
+#### Understanding the Pre-loaded APIs
+
+Your trial environment comes with pre-configured sample APIs to help you explore Tyk's capabilities:
+
+**1. httpbingo API Overview:**
+
+- **Purpose**: A test API with various endpoints for exploring API management features
+- **Base URL**: `http://localhost:8080/httpbingo`
+- **Authentication**: API Key authentication (via Authorization header)
+- **Rate Limiting**: Configured through policies (Sandbox and Production plans)
+
+**Key Endpoints:**
+
+- `/get`: Returns request data (headers, query parameters)
+- `/headers`: Shows all request headers
+- `/ip`: Returns the client's IP address
+- `/xml`: Demonstrates response transformation (XML to JSON)
+- `/status/{code}`: Returns specified HTTP status code
+- `/mock`: Returns a mock response generated by Tyk
+
+**2. F1 API Overview:**
+
+- **Purpose**: Demonstrates JWT authentication with a real-world API providing Formula 1 racing data
+- **Base URL**: `http://localhost:8080/f1-api` (proxies to https://f1api.dev/api/)
+- **Authentication**: JWT HMAC authentication
+
+   JWT Authentication Details:
+
+   - **Shared Secret**: `topspecial256sharedbitlongsecret`
+   - **JWT Generation**: You can use [jwt.io](https://jwt.io) to generate valid tokens
+   - **Header Format**: `Authorization: Bearer <your_jwt_token>`
+- **Rate Limiting**: 4 requests per 15 seconds (configured through policy)
+
+**Key Endpoints:**
+
+- `/drivers`: Information about F1 drivers
+- `/seasons`: Data about F1 racing seasons
+- `/circuits`: Details about F1 racing circuits
+- `/teams`: Information about F1 teams
+
+To explore these APIs in detail:
+
+1. In the Dashboard, go to the "APIs" section
+2. Click on either "httpbingo API" or "F1 API"
+3. Navigate through the tabs to see the various configuration options
+4. Pay special attention to the `Endpoints` tab to see how individual endpoints are configured
+
+### Developer Portal Preview
+
+The [Developer Portal](/portal/overview/intro) provides a dedicated space for API consumers to discover, learn about, and subscribe to your APIs. It bridges the gap between API providers and consumers.
+
+<img src="/img/self-managed/self-managed-trial-portal.png" alt="Developer Portal" />
+
+As an administrator, you can customize the portal's appearance, content, and behavior to match your brand and requirements.
+
+#### Exploring Available API Products and Catalogs
+
+Login into the portal as an Admin user with credentials provided in the [previous section](/getting-started/quick-start#default-credentials-and-access-points) to explore the resources created in the portal. 
+
+The Developer Portal organizes APIs into a structured hierarchy:
+
+**Products, Plans, and Catalogs:**
+
+- **[Products](/portal/api-products)**: API offerings that developers can consume. In your trial, there's a pre-configured product for the [httpbingo API](http://localhost:3001/admin/api_products).
+
+- **[Plans](/portal/api-plans)**: Subscription tiers with different access levels and rate limits. [Your trial includes](http://localhost:3001/admin/plans):
+  - **Sandbox Plan**: Limited rate (3 requests per 10 seconds) for testing and development
+  - **Production Plan**: Higher capacity (100 requests per 60 seconds) for production use
+
+- **[Catalogs](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues)**: Collections of products and plans that can be made available to different audiences. Your trial has a public catalog containing the httpbingo API product and both plans.
+
+#### Understanding the developer experience
+
+To experience the portal from a developer's perspective:
+
+1. You can access the [live portal](http://localhost:3001/) using the admin account. This is the public-facing interface for API consumers.
+2. From here the API consumer can:
+   1. Browse the [API catalog](http://localhost:3001/portal/catalogue-products) to see available products
+   2. View the [API documentation](http://localhost:3001/portal/catalogue-products/httpbin-api-access-1), which is automatically generated from the API definition
+   3. Create [apps](http://localhost:3001/portal/private/dashboard) and then Subscribe to a [plan](http://localhost:3001/portal/catalogue-products/httpbin-api-access-1) to get access credentials
+   4. Test the API using the provided examples and your credentials
+
+The Developer Portal streamlines the onboarding process for API consumers, making it easy for them to find, understand, and use your APIs.
+
+## Next Steps
+
+Now that you've set up your Tyk Self-Managed environment and explored the pre-configured components, you're ready to try the core API management capabilities in action.
+
+Continue to the [Core API Management Capabilities](/getting-started/secure-api) guide to explore API security, monitoring, and traffic transformation using the pre-configured APIs.
diff --git a/getting-started/secure-api.mdx b/getting-started/secure-api.mdx
new file mode 100644
index 0000000000..cc03a39d64
--- /dev/null
+++ b/getting-started/secure-api.mdx
@@ -0,0 +1,309 @@
+---
+title: "Create and Secure APIs with Tyk"
+description: "Explore API security, monitoring, and traffic transformation using your Tyk Self-Managed trial environment."
+sidebarTitle: "Create and Secure APIs"
+---
+
+<Note>
+  **Prerequisite:** Complete the [Getting Started](/getting-started/quick-start) guide to set up your Tyk Self-Managed environment before continuing.
+</Note>
+
+In this section, we will explore the core API management capabilities of Tyk Self-Managed using the pre-configured APIs.
+
+We will explore how to your secure APIs, manage API traffic, and monitor your API usage. The following sections will guide you through the key features of Tyk API Management platform.
+
+## API Security in Action
+
+API security is an important aspect of API management. Tyk provides [multiple authentication methods](/api-management/client-authentication#what-does-tyk-support) to secure your APIs and control access. In this section, we'll explore the security features available in your trial environment.
+
+### Exploring Authentication Methods
+
+Tyk supports various authentication methods including [Auth Token](/api-management/authentication/bearer-token), [JWT](/basic-config-and-security/security/authentication-authorization/json-web-tokens), [OAuth 2.0](/api-management/authentication/oauth-2), and [more](/api-management/client-authentication#what-does-tyk-support). In your trial environment, the httpbingo API is pre-configured with Auth Token authentication.
+
+[Auth Tokens](/api-management/authentication/bearer-token) are the simplest form of authentication. They're easy to implement and understand, making them perfect for your first exploration of Tyk.
+
+1. **Create an API Key:**
+   - In the Dashboard, navigate to the "Keys" section in the left menu
+   - Click the "ADD KEY" button
+
+      <img src="/img/self-managed/self-managed-trial-add-key.png" alt="Click on Add Key" />
+
+   - Under "Access Rights," select the `HTTPBIN API Access` policy
+   - Now under the "Configuration" tab, add an alias `httpbin`
+   - Click "Create Key" to generate your API key
+   
+      <img src="/img/self-managed/self-managed-trial-create-key.png" alt="Click on Create Key" />
+
+   - Copy the displayed API `key ID` for testing
+      
+      > **Note:** This key will be used in the upcoming sections to authenticate requests to the httpbingo API.
+
+2. **Test API Access with Your Key:**
+   - Open a terminal or API client like Postman
+   - Make a request to the API including your key in the Authorization header:
+     ```
+     curl -H "Authorization: <your-api-key>" http://localhost:8080/httpbingo/get
+     ```
+   - You should receive a successful response with details about your request
+
+      ```json
+      {
+         "args": {},
+         "headers": {
+            "Accept": [
+               "*/*"
+            ],
+            "Accept-Encoding": [
+               "gzip"
+            ],
+            "Authorization": [
+               "eyJvcmciOiI2ODkxYTllMzExZDY2NTAwMDE4M2M5Y2MiLCJpZCI6ImM4MmNiYzRhY2Q4NTQyMGZiZGNiZjViN2U2NjY1MWU3IiwiaCI6Im11cm11cjY0In0="
+            ],
+            "Host": [
+               "httpbin:8080"
+            ],
+            "User-Agent": [
+               "curl/8.7.1"
+            ],
+            "X-Forwarded-For": [
+               "192.168.65.1"
+            ]
+         },
+         "method": "GET",
+         "origin": "192.168.65.1",
+         "url": "http://httpbin:8080/get"
+      }
+      ```
+
+3. **Try Without Authentication:**
+   - Make the same request without the Authorization header:
+     ```
+     curl -H "Authorization: invalid-key" http://localhost:8080/httpbingo/get
+     ```
+   - You should receive an error, confirming that authentication is working
+
+      ```json
+      {
+         "error": "Access to this API has been disallowed"
+      }
+      ```
+
+### Rate Limiting and Quota Management
+
+[Rate limiting](/api-management/rate-limit) is a technique that allows you to control the rate at which clients can consume your APIs and is one of the fundamental aspects of managing traffic to your services. It serves as a safeguard against abuse, overloading, and denial-of-service attacks by limiting the rate at which an API can be accessed.
+
+In this section we will implement and test rate limiting in Tyk.
+
+**Testing Rate Limiting:**
+
+1. **Create an API Key:**
+   - In the Dashboard, navigate to the "Keys" section in the left menu
+   - Click the "ADD KEY" button
+   - Under "Access Rights," select the `HTTPBIN API Access` policy
+   - Under "Key Global Limits and Quota" set the following:
+     - **Requests**: 3 requests
+     - **Per (seconds):**: 10 seconds
+   - Now under the "Configuration" tab, add an alias `httpbin rate limit`
+   - Click "CREATE" to generate your API key
+   
+      <img src="/img/self-managed/self-managed-trial-rate-limit-key.png" alt="Docker Container Status of Tyk Self Managed Trial" />
+
+   - Copy the displayed API `key ID` for testing
+
+2. **Observe Rate Limiting in Action:**
+   - Open a terminal and run multiple requests in quick succession:
+     ```bash
+      for i in {1..5}; do
+         curl -H "Authorization: <your-api-key>" http://localhost:8080/httpbingo/get
+         echo -e "\n--- Request $i completed ---\n"
+      done
+     ```
+   - After the third request within 10 seconds, you should see a rate limit exceeded error
+       ```json
+         {
+            "error": "Rate Limit Exceeded"
+         }
+       ```
+
+3. **Compare with a Higher Limit:**
+   - Now update the `httpbin rate limit` key and set a value of `100` in the "requests" section of rate limiting.
+   - Run the same test and observe that you can make more requests before hitting limits
+
+4. **Clean Up**
+   - After testing, you can delete the `httpbin rate limit` API key from the Dashboard.
+
+      <img src="/img/self-managed/self-managed-trial-delete-key.png" alt="Delete API Key" />
+
+By exploring these security features, you'll gain a solid understanding of how Tyk helps protect your APIs while providing the right level of access to authorized consumers.
+
+## API Monitoring
+
+Understanding how your APIs are performing is important for optimizing performance, planning capacity, and ensuring security. Tyk provides comprehensive monitoring capabilities to give you visibility into your API traffic.
+
+### Generating Test Traffic
+
+To explore Tyk's monitoring capabilities, you'll need to generate some API traffic that simulates real-world usage patterns and populates the monitoring dashboard.
+
+**Creating Test Traffic:**
+
+1. **Using Command Line Tools:**
+   - You can use simple bash loops to generate multiple requests:
+     ```
+     for i in {1..20}; do curl -H "Authorization: <your-api-key>" http://localhost:8080/httpbingo/get; sleep 0.5; done
+     ```
+   - This sends 20 requests with a half-second delay between each
+
+2. **Generating Diverse Traffic:**
+   - Try accessing different endpoints to create a more realistic traffic pattern:
+     ```
+     curl -H "Authorization: <your-api-key>" http://localhost:8080/httpbingo/headers
+     curl -H "Authorization: <your-api-key>" http://localhost:8080/httpbingo/ip
+     curl -H "Authorization: <your-api-key>" http://localhost:8080/httpbingo/user-agent
+     ```
+   - Include some errors by attempting to exceed rate limits or access without authentication
+
+      ```bash
+      curl -H "Authorization: invalid-key" http://localhost:8080/httpbingo/headers
+      ```
+### Exploring Real-time Analytics
+
+Once you've generated some traffic, you can explore Tyk's analytics capabilities to gain insights into API usage.
+
+**Accessing Monitoring Dashboard:**
+
+1. **View the Main Dashboard:**
+   - In the Tyk Dashboard, go to the [Activity Overview](http://localhost:3000/activity-overview) section under "Monitoring"
+   - This provides an overview of API usage, errors, and performance metrics
+   - The dashboard updates in near real-time as new requests are processed
+
+      <img src="/img/self-managed/self-managed-trial-monitoring-overview.png" alt="Docker Container Status of Tyk Self Managed Trial" />
+   - Explore Key Metrics:
+      - **Request Volume**: See how many requests are being processed
+      - **Error Rates**: Monitor authentication failures and other errors
+      - **Response Times**: Track API performance and identify slow endpoints
+
+
+2. **View Detailed Logs:**
+   - In the [Activity Logs](http://localhost:3000/logs) section, you can view detailed logs of all API requests
+   - Filter by API, status code, or time range to focus on specific events
+   - This is useful for troubleshooting and understanding user behavior
+
+      <img src="/img/self-managed/self-managed-trial-log-browser.png" alt="Docker Container Status of Tyk Self Managed Trial" />
+
+3. **Multiple Analytics Views:**
+   Tyk provides multiple views to analyze API traffic:
+   - **[By API](http://localhost:3000/activity-api)**: See metrics for individual APIs
+   - **[By Endpoint](http://localhost:3000/endpoint-popularity)**: Analyze performance and usage of specific endpoints
+   - **[By Key](http://localhost:3000/activity-key)**: Understand how different API keys are being used
+   - **[By Error](http://localhost:3000/error-listing)**: Identify common errors and their causes
+
+**Using Analytics for Decision Making:**
+
+The monitoring dashboard helps you answer important questions about your APIs:
+
+- Which endpoints are most popular?
+- Are there performance bottlenecks?
+- Are users experiencing errors?
+- How is usage changing over time?
+
+These insights can guide your API development priorities, capacity planning, and troubleshooting efforts.
+
+Tyk's monitoring capabilities provide the visibility you need to manage your APIs effectively, ensuring they meet the needs of your users while maintaining performance and security standards.
+
+## Traffic Control & Transformation
+
+Tyk API [Gateway](/tyk-oss-gateway) can control and transform incoming API traffic. It provides [various mechanisms](/api-management/traffic-transformation) to modify requests and responses, control traffic flow, and optimize performance. Let's explore these capabilities in your trial environment.
+
+### Testing Request/Response Transformations
+
+Transformations allow you to modify API requests and responses without changing your backend services. This is useful for adapting legacy APIs, standardizing formats, or enhancing responses.
+
+The httpbingo API in your trial includes a pre-configured transformation on the `/xml` endpoint that converts XML responses to JSON format.
+
+**Testing the XML to JSON Transformation:**
+
+1. **Access the XML Endpoint Directly:**
+   - Before testing the transformation, you can access the XML endpoint (httpbin) directly to see the raw XML response:
+     ```
+     curl http://localhost:8081/xml
+     ```
+   - You should see an XML response from the backend service
+
+1. **Make a Request to the XML Endpoint:**
+   - Using your API key from the [previous section](/getting-started/secure-api#exploring-authentication-methods), make a request to the XML endpoint (on the Tyk Gateway):
+     ```
+     curl -s -H "Authorization: <your-api-key>" http://localhost:8080/httpbingo/xml | jq
+     ```
+   - Notice that even though the backend returns XML, you receive a JSON response
+   - This transformation happens in the gateway, not in the backend service
+
+2. **Examine the Transformation Configuration:**
+   - In the Dashboard, go to the "APIs" section
+   - Click on the httpbingo API
+   - Navigate to the "Endpoints" tab
+   - Find the `/xml` path and click on it
+   - You'll see the response transformation that converts XML to JSON
+
+   <img src="/img/self-managed/self-managed-trial-xml-endpoint.png" alt="XML endpoint in Tyk OAS API" />
+
+Transformations are a powerful way to adapt APIs to your needs without modifying backend code, making them ideal for modernizing legacy services or standardizing API responses across different systems.
+
+### Exploring Caching Configurations
+
+Caching improves API performance by storing responses and serving them without hitting your backend services for every request. This reduces latency and backend load.
+
+**Understanding API Caching:**
+
+The httpbingo API includes a caching example on the `/get` endpoint with a 10-second cache lifetime. This means that repeated requests within 10 seconds will receive the same cached response.
+
+**Testing Caching Behavior:**
+
+1. **Make an Initial Request with a Unique Value:**
+   - Using your API key, make a request to the endpoint with a unique Unique-Header:
+     ```
+     curl -s -H "Authorization: <your-api-key>" \
+          -H "Unique-Header: $(uuidgen)" \
+          http://localhost:8080/httpbingo/get | jq '.headers["Unique-Header"]'
+     ```
+   - You'll see the Unique-Header value in the response, for example:
+     ```
+     [
+       "62ACF2DD-9116-4B4B-B80E-5F8538C12957"
+     ]
+     ```
+   - The httpbingo service echoes back the headers it receives, including your unique Unique-Header
+
+2. **Make an Immediate Second Request with a Different Header Value:**
+   - Immediately make another request with a new unique header value:
+     ```
+     curl -s -H "Authorization: <your-api-key>" \
+          -H "Unique-Header: $(uuidgen)" \
+          http://localhost:8080/httpbingo/get | jq '.headers["Unique-Header"]'
+     ```
+   - Notice that the Unique-Header value in the response is identical to the first request
+   - This confirms you're receiving a cached response, not a new one from the backend
+   - Even though you sent a different header value in your request, you got back the same header value from the first request because the response was cached
+
+3. **Wait and Test Again:**
+   - Wait 11 seconds (just past the 10-second cache lifetime)
+   - Make another request with a new unique value
+     ```
+     curl -s -H "Authorization: <your-api-key>" \
+          -H "Unique-Header: $(uuidgen)" \
+          http://localhost:8080/httpbingo/get | jq '.headers["Unique-Header"]'
+     ```
+   - You should see a different Unique-Header value in the response, matching your new request
+   - This indicates the cache has expired and you're getting a fresh response from the backend
+
+   {/* Add this note: Could also mention that X-Tyk-Cached-Response header is set when a cached response is returned */}
+      > **Note:** You can also check the `X-Tyk-Cached-Response` header in the response to confirm whether the response was served from cache or not.
+
+Caching is particularly valuable for responses that are expensive to generate but don't change frequently. By implementing appropriate caching strategies, you can significantly improve API performance and reduce backend load.
+
+## Next Steps
+
+Now that you have a basic understanding of Tyk Self-Managed and have set up your trial environment, you can explore more advanced features and capabilities.
+
+- [Creating and Managing APIs](/api-management/gateway-config-managing-oas#creating-an-api),
+- [JWT Authentication](/basic-config-and-security/security/authentication-authorization/json-web-tokens),
+- [Publishing APIs to Developer Portal](/portal/publish-api-catalog),
diff --git a/getting-started/tutorials/publish-api.mdx b/getting-started/tutorials/publish-api.mdx
new file mode 100644
index 0000000000..03330877df
--- /dev/null
+++ b/getting-started/tutorials/publish-api.mdx
@@ -0,0 +1,99 @@
+---
+title: "Publish an API"
+description: "Publishing your API in the Tyk Developer Portal"
+keywords: "Tyk Tutorials, Getting Started, Publish API, Tyk Cloud, Tyk Self-Managed, Developer Portal"
+order: 6
+robots: "noindex, nofollow"
+sidebarTitle: "Publish an API"
+---
+
+import CreatePortalEntryInclude from '/snippets/create-portal-entry-include.mdx';
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+This is for the closed source [Tyk Developer Portal](/portal/overview/intro) only
+
+<Tabs>
+<Tab title="Cloud">
+
+<CreatePortalEntryInclude/>
+
+</Tab>
+<Tab title="Self-Managed">
+
+## Add an API and Swagger based Docs to your Portal Catalog
+
+Managing your portal is a key part of Tyk Dashboard, this tutorial helps you get started working with your portal and publishing your APIs to your developers.
+
+### Step 1: Create your first API
+
+If you haven't already, create an API in your Dashboard, your Portal will not be visible or live until you have at least one live API being managed by Tyk. This tutorial assumes you've created your first API using the Dashboard and called it "Test API".
+
+### Step 2: Initialise all your portal settings
+
+By default there is no Portal configured, you need to configure from the Portal settings screen, **even if you don't want to change the options**. Select **Portal Management > Settings**. The notification view on the right will say that no configuration was detected so it was created. Your Portal won't work without this step, so it's important.
+
+That's it, now you need to create the home page.
+
+### Step 3: Create the home page
+
+<img src="/img/2.10/home_page_template.png" alt="Create Page One" />
+
+From **Pages**" click **Add Page** and give it any title you like (e.g. "Welcome") and select **Default Home Page Template** from the **Page Type** drop-down list. Ensure **Check to make this page the home page** is selected.
+
+Save the page.
+
+### Step 4: Create a Policy
+
+When you publish an API to the Portal, Tyk actually publishes a way for developers to enroll in a policy, not the API directly.
+
+> **Why?**: A Tyk policy can grant access to multiple APIs (so long as they all use the same access control mechanism) and set a template for any keys that are generated for the portal for things such as Tags, Rate Limits and Quotas. Another useful feature with a policy and the Portal is that when the key is generated for a developer, it can be made to expire after a certain time - e.g. a trial key.
+
+To create a policy for your test API, select **New Policy** from the **Policies** menu. You can leave all the defaults as is, except:
+
+1.  Name the policy **Default**
+2.  Select **Test API** API in the **Access Rights > Add access rule** drop-down list and click **Add** so it appears in the list
+3.  Select **Activate Policy**
+
+Save the policy by clicking **Create**.
+
+### Step 5: Publish the API to the Portal
+
+The API that you defined earlier is active and will work as you've seen in the previous tutorial, this time we want to use the Portal to generate a token for a named developer.
+
+Not all APIs are visible to the Portal, only the ones you tell it about, so from the **Catalog** menu, select **Add API** then:
+
+1.  Select your **Default** policy
+2.  Fill in the description fields
+3.  Ensure the **Enable this API** is selected
+
+Save the API Catalog entry by clicking **Update**.
+
+<img src="/img/2.10/portal_confirmation_on_prem.png" alt="Catalog Entry" />
+
+### Step 6: Set your Portal hostname
+
+When you set up your Tyk installation, you will have had to, at some point, define a hostname for your portal, either as a `/etc/hosts` file entry, or as a qualified hostname such as `portal.domain.com`. To make the Dashboard aware of this, from the **Your Developer portal > Set Your Portal Domain** enter the hostname and wait for Tyk to refresh.
+
+This process will bind your organizations' Portal to the domain name you've specified.
+
+
+<Note>
+You need to restart your Dashboard service for the changes to take effect.
+</Note>
+
+
+
+### Step 7: Log into your Portal
+
+Select **Open Your Portal** from the **Your Developer Portal** menu drop-down, a new page will open with your new (most likely empty) Portal home page.
+
+
+<Note>
+If you are using Docker, do not use the drop-down, instead, use the domain name you defined when you set up the forward proxy for your domains - if you followed the Docker setup guide, your Dashboard will be on: `www.tyk-portal-test.com`.
+</Note>
+
+
+</Tab>
+</Tabs>
diff --git a/getting-started/using-tyk-dashboard.mdx b/getting-started/using-tyk-dashboard.mdx
new file mode 100644
index 0000000000..2d990be3d2
--- /dev/null
+++ b/getting-started/using-tyk-dashboard.mdx
@@ -0,0 +1,130 @@
+---
+title: "Using Tyk Dashboard"
+description: "An overview of the Tyk Dashboard, your central hub for managing APIs, monitoring performance, and configuring security settings"
+keywords: "Tyk API Management, Open Source, Self-Managed, Tyk Cloud, API Gateway"
+sidebarTitle: "Using Tyk Dashboard"
+---
+
+The Tyk Dashboard is your central hub for managing APIs, monitoring performance, and configuring security settings. This guide will walk you through the key features available on the Tyk Dashboard.
+
+## Access the Dashboard
+
+Log in to your **Tyk Dashboard** using your credentials. Familiarize yourself with the interface, where the main navigation menu is located on the left side, and the top bar provides quick access to user settings and notifications.
+
+## Dashboard Organization
+<img src="/img/getting-started/apis-front-page.png" alt="Front Page" />
+
+
+Welcome to the Tyk Dashboard! Let's zoom into the side bar and take a look at the features that are made available to you.
+
+### Side Bar
+Tyk is organized into a few key categories:
+* **API Management**: In API Management, you can access and edit all your APIs, create data graphs, and add webhooks.
+* **API Security**: In API Security, you can manage keys, policies, and certificates to customize your security settings. 
+* **User Management**: In User Management, you can control permissions and access for users and user groups. You can also create profiles that help you manage third party identity providers for specific Tyk actions like signing into the portal or logging into the dashboard.
+* **Monitoring**: In Monitoring, you can view activity reports, logs, and analytics related to your APIs.
+* **System Management**: In System Management, you can affect OPA rules that define fine-grained access control for managing and enforcing permissions on various actions and resources in Tyk’s API management system.
+* **Classic Portal**: In Classic Portal, you can affect permissions and configurations related to your developer portal. The Tyk Developer Portal is a platform that enables you to publish, manage, and promote your APIs to external developers.
+
+
+#### Overview
+<img src="/img/getting-started/overview-options.png" alt="Overview options" />
+
+From the overview options, you can start adding APIs immediately. 
+If you are new here, we suggest that you start with an example API and see how our pre-configured APIs are setup- we have examples for GraphQL, Tyk OAS, and UDG (Universal Data Graph) APIs. If you have a specific API that you that you have already setup, you can import it using an OpenAPI document, a Tyk API document, or through a WSDL/XML file. 
+Otherwise, you can design an API from scratch or a template if you have configured a Tyk template previously.
+
+
+
+#### API Management
+<img src="/img/getting-started/tabs-api-management.png" alt="API Management Side Bar" />
+
+* **APIs**: The APIs setup allows you to create and access your APIs. If this is your first time setting up an API, we suggest you use an example to learn more or you can go to [Configure your First API](/getting-started/configure-first-api) to learn more.
+<img src="/img/getting-started/api-management-apis.png" alt="API Management APIs" />
+
+* **API Templates**: API Templates allow you to create APIs with preconfigured settings quickly. You can set these up manually or save them from an API which you've already created. You can learn more about API Templates [here](/platform-management/api-templates).
+
+* **Examples**: In Examples, you will find a few sample projects we put together to help you in your journey. We suggest you start with the Tyk OAS APIs and move on to GraphQL and UDG APIs to supplement learning how to setup your API.
+
+* **Data Graphs**: Universal Data Graphs (UDGs) are a way for you to combine APIs into one usable interface. Using GraphQL, you can access multiple APIs in a single query. In this tab, you can configure your UDGs. You can learn more about Data Graph concepts and how to use them in Tyk, [here](/api-management/data-graph).
+
+* **Webhooks**: Webhooks allow you to define redirects to handle specific events. For instance, you can configure a webhook to handle a RateLimitExceeded event to send a notification to your admin. Webhooks are very powerful tools to allow you to customize event handling, to learn more, find more information [here](/api-management/gateway-events#event-handling-with-webhooks).
+
+#### API Security
+<img src="/img/getting-started/tabs-api-security.png" alt="API Security Side Bar" />
+
+* **Keys**: [Keys](/api-management/access-control/sessions-and-keys/understanding-sessions) are central to securing your APIs through Tyk. In this tab, you can handle the permissions, rate and throttling limits, and quotas associated with a given key. 
+* **Policies**: [Policies](/api-management/policies) expand on key level security, allowing you to configure granular control over API access. Using policies, you govern which users or applications can access particular endpoints and what they're allowed to do. 
+* **TLS/SSL Certificates**:  [TLS and SSL](/api-management/certificates) is supported in Tyk. You can upload your certificates via `.pem` file to verify the identity of whoever presents the certificate during a secure connection.
+
+
+#### User Management
+<img src="/img/getting-started/tabs-user-management.png" alt="User Management Side Bar" />
+
+* **Users**: Here, you can add, revoke, delete, or edit the details of users that need admin access to your Tyk dashboard. 'Revoking' a user will suspend their access without deleting their account. You can learn more about users [here](https://tyk.io/docs/api-reference/users/list-users).
+* **User Groups**: Similar as a **policy** is to a **key**, a **user group** is to a **user**. By defining user groups, you aggregate the permissions and access controls for multiple users. When you setup a user with a user group, they inherit the user groups' permissions. You can learn more about user groups [here](https://tyk.io/docs/api-reference/usergroup/list-user-groups).
+* **User Settings**: In User Settings, you can setup [TIB profiles](/tyk-identity-broker/overview#profile). This allows your users to access Tyk-managed APIs using their existing credentials.
+
+#### Monitoring
+<img src="/img/getting-started/tabs-monitoring.png" alt="Monitoring Side Bar" />
+
+* **Activity Overview**: In the Activity Overview Tab, you will get a high-level view of requests sent to your APIs, the error breakdown, and your most popular endpoints. You can filter this to view per API statistics and to see the breakdown per hour, day, or month.
+* **Activity logs**: Here, you can view all the activity logs from your APIs, giving you details on user activity or error logs. 
+* **Activity by X**: There are several tabs that allow you to view your activity reports per API, Key, Endpoint, Graph, and Errors. We provide these tools for you so that you can quickly visit the analytics you're interested in and gain insights on your APIs. 
+* **Service Uptime**: Here, you can view the service uptime statistics, getting a detailed view of your uptime per version of your API. You can also view the errors associated with your API and if you are hitting your uptime targets.
+* **Uptime Targets**: You can view uptime by target endpoint here, this is particularly useful if you have configured [uptime tests](/planning-for-production/ensure-high-availability/uptime-tests) to gain visibility into the uptime of your underlying services.
+
+
+
+#### System Management
+<img src="/img/getting-started/tabs-system-management.png" alt="System Management Side Bar" />
+
+* **OPA Rules**: You can use this tab to edit your [OPA Rules](/platform-management/open-policy-agent)- you can use these custom rules to control the behavior of all of your dashboard APIs. For example, you can restrict regular users to GET requests only, while allowing POST requests for admin roles. 
+
+* **Nodes & Licenses**: This page provides an overview of the Tyk installation, including license usage metrics and Gateway status. This is available only for `Tyk Self Managed` installations.
+
+    <img src="/img/getting-started/tabs-system-management-license.png" alt="System Management Side Bar" />
+
+    1. **License Information**:
+
+        - **Active Gateways**: Shows the number of available active gateways. An active gateway refers to a Tyk Gateway instance currently connected to a [Control Plane](/api-management/mdcb#control-plane) and actively processing API requests. 
+            
+            **Note:** It doesn't count the [Data Plane](/api-management/mdcb#data-plane).
+        
+        - **Total Gateways Available**: Total number of Gateways available per the license.
+        - **Remaining Gateways**: Unused license slots.
+        - **License Expiry**: Indicates the remaining time until the license expires (e.g., 'in 8 days').
+
+    2. **Active Gateways**:
+
+        - The number of currently active gateways connected to the dashboard. This section lists the currently active gateways along with their hostnames and includes a status indicator (green dot) to signify active connections.
+
+    3. **API License Usage**:
+    
+        - The number of APIs configured in the dashboard compared to the limit allowed by your license. It provides a visual representation of the number of APIs loaded in the gateway and displays the minimum, maximum, and average.
+
+    4. **Data Plane License Usage**:
+    
+        - The number of Data Planes connected compared to the limit allowed by your license. It visually represents the maximum, minimum, and average number of [Data Planes](/api-management/mdcb#data-plane) per day. The x-axis is the dates, while the Y axis is the number of data planes connected; for example, if we execute one cluster with groupID "A" and another with groupID "B," we will get two as max, without caring how many gateways running inside each cluster.
+
+    5. **Gateway License Usage**:
+
+        - The number of Gateways connected compared to the limit allowed by your license. This provides a visual representation of the maximum, minimum, and average number of total gateways (all deployed gateways, whether they are part of a data plane or control plane).
+
+    6. **Total API Traffic**:
+
+        - The total traffic across all APIs. Provides a visual representation of Total API Traffic across all Gateways in the installation. This can be viewed over the past month or day.
+
+#### Classic Portal
+<img src="/img/getting-started/tabs-classic-portal.png" alt="Classic Portal Side Bar" />
+
+* **Open Portal**: By clicking this, you will be redirected to the Developer Portal, where developers can access your APIs. This acts as a self-service gateway where developers can discover, request access to, and manage their API Keys, view documentation, and monitor usage reports. You can learn more about the developer portal and how to customize it [here](/tyk-developer-portal/customise).
+
+* **Settings**: Tyk allows you to customize your portal however you like. The first level of customization occurs through configuring your settings. Here, you can setup your portal domain name, establish an admin to be notified whenever you get an API subscription, affect access and permissions to your portal, and enable email notifications to be sent to the developers using your portal. You can learn more about customizing your settings [here](/tyk-developer-portal/customise/customize-api-visibility).
+* **Catalogue**: Your catalogue is the full list of APIs made available in your portal. You can add APIs to your catalogue in this tab. You can learn more about how to affect your catalogues [here](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues).
+* **Key Requests**: For the APIs listed in your catalogue, you developers will submit key requests to gain access to them. This page allows you to view the full list of key requests, you can use it to see what APIs are gaining popularity, you can also approve or decline key requests here. You can learn more about key requests [here](/tyk-developer-portal/tyk-portal-classic/key-requests).
+* **Developers**: Developers are the people consuming your APIs. You can [add developers](/tyk-developer-portal/tyk-portal-classic/developer-profiles) to your portal in this tab.
+* **Pages**: As mentioned earlier, your portal is completely customizable. This tab makes it easy to add or edit the pages available in your portal. You can make this as simple or complicated as you want, you just have to add a title and URL for each page. You can learn more about adding pages to your portal [here](/portal/customization/pages#edit-page-content).
+* **Menus**: Next, if you want to configure the navigation of your site, you can [customize your menus](/tyk-developer-portal/tyk-portal-classic/customise/changing-the-navigation).
+* **CSS**: In this tab, you can customize your site using CSS. Just write a custom CSS script and press the "update" button in the top right corner to publish your custom styling. For inspiration, take a look at this [tutorial](/tyk-developer-portal/tyk-portal-classic/customise/customising-using-dashboard).
+
diff --git a/google407269a3a12bf5e5.html b/google407269a3a12bf5e5.html
new file mode 100644
index 0000000000..517ba750c9
--- /dev/null
+++ b/google407269a3a12bf5e5.html
@@ -0,0 +1 @@
+google-site-verification: google407269a3a12bf5e5.html
diff --git a/images/algolia-logo.jpg b/images/algolia-logo.jpg
new file mode 100644
index 0000000000..ddb390efaf
Binary files /dev/null and b/images/algolia-logo.jpg differ
diff --git a/images/favicon/favicon-16x16.png b/images/favicon/favicon-16x16.png
new file mode 100644
index 0000000000..d4bdc6451c
Binary files /dev/null and b/images/favicon/favicon-16x16.png differ
diff --git a/images/favicon/favicon-32x32.png b/images/favicon/favicon-32x32.png
new file mode 100644
index 0000000000..54b65b3a55
Binary files /dev/null and b/images/favicon/favicon-32x32.png differ
diff --git a/images/favicon/favicon.ico b/images/favicon/favicon.ico
new file mode 100644
index 0000000000..8da56e47b7
Binary files /dev/null and b/images/favicon/favicon.ico differ
diff --git a/images/icon-documentation.svg b/images/icon-documentation.svg
new file mode 100644
index 0000000000..a31cbff763
--- /dev/null
+++ b/images/icon-documentation.svg
@@ -0,0 +1 @@
+<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 55.41 55.37"><defs><style>.cls-1{fill:#fff;}</style></defs><title>icon-documentation</title><path class="cls-1" d="M1995.95,557h-4V511.6h45.41v4h-41.44Z" transform="translate(-1991.97 -511.6)"/><path class="cls-1" d="M2029.7,521.6H2002V567h45.41V521.6ZM2043.38,563H2006V525.6h37.41Z" transform="translate(-1991.97 -511.6)"/><path class="cls-1" d="M2037.38,545.6H2025V543h12.43Zm0-9.19H2025V539h12.43Zm0,13.13H2012v2.63h25.41Zm-16.22-13.13H2012v9.19h9.19Z" transform="translate(-1991.97 -511.6)"/></svg>
\ No newline at end of file
diff --git a/images/tree/corner.gif b/images/tree/corner.gif
new file mode 100644
index 0000000000..d3dc48d178
Binary files /dev/null and b/images/tree/corner.gif differ
diff --git a/images/tree/file.gif b/images/tree/file.gif
new file mode 100644
index 0000000000..448efb40ea
Binary files /dev/null and b/images/tree/file.gif differ
diff --git a/images/tree/folder.gif b/images/tree/folder.gif
new file mode 100644
index 0000000000..49cc3c2c12
Binary files /dev/null and b/images/tree/folder.gif differ
diff --git a/images/tree/minus.gif b/images/tree/minus.gif
new file mode 100644
index 0000000000..9e052d6932
Binary files /dev/null and b/images/tree/minus.gif differ
diff --git a/images/tree/plus.gif b/images/tree/plus.gif
new file mode 100644
index 0000000000..d7cbb250e4
Binary files /dev/null and b/images/tree/plus.gif differ
diff --git a/images/tree/vdot.gif b/images/tree/vdot.gif
new file mode 100644
index 0000000000..cb3bb2f14a
Binary files /dev/null and b/images/tree/vdot.gif differ
diff --git a/images/tyk_docs_arrow_down_icon.svg b/images/tyk_docs_arrow_down_icon.svg
new file mode 100644
index 0000000000..9f44c42343
--- /dev/null
+++ b/images/tyk_docs_arrow_down_icon.svg
@@ -0,0 +1,3 @@
+<svg width="14" height="8" viewBox="0 0 14 8" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M6.91382 7.75464L0.313847 1.75464C-0.0861527 1.35464 -0.0861589 0.75464 0.213841 0.35464C0.613841 -0.0453603 1.21384 -0.0453602 1.61384 0.25464L6.91382 5.05464L12.2138 0.25464C12.6138 -0.14536 13.2138 -0.0453603 13.6138 0.35464C14.0138 0.75464 13.9138 1.35464 13.5138 1.75464L6.91382 7.75464Z" fill="#BDBDDF"/>
+</svg>
diff --git a/images/tyk_docs_arrow_up_icon.svg b/images/tyk_docs_arrow_up_icon.svg
new file mode 100644
index 0000000000..2aef376576
--- /dev/null
+++ b/images/tyk_docs_arrow_up_icon.svg
@@ -0,0 +1,3 @@
+<svg width="14" height="8" viewBox="0 0 14 8" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M12.9546 7.8C12.7547 7.8 12.4546 7.7 12.2546 7.5L6.95465 2.7L1.65463 7.5C1.25463 7.9 0.654637 7.8 0.254637 7.4C-0.145363 7 -0.0453566 6.4 0.354643 6L6.95465 0L13.5547 6C13.9547 6.4 13.9546 7 13.6546 7.4C13.4546 7.7 13.2547 7.8 12.9546 7.8Z" fill="#505071"/>
+</svg>
diff --git a/images/tyk_docs_nav_apim_icon.svg b/images/tyk_docs_nav_apim_icon.svg
new file mode 100644
index 0000000000..59d8ee5400
--- /dev/null
+++ b/images/tyk_docs_nav_apim_icon.svg
@@ -0,0 +1,14 @@
+<svg width="22" height="26" viewBox="0 0 22 26" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M5.49813 4.46516C4.33195 4.46516 3.38234 5.29378 3.34069 6.3484V6.42373L3.26572 6.45386C1.90796 6.92844 1 8.12618 1 9.44444C1 11.2147 2.591 12.661 4.55685 12.661H16.3103C17.1516 12.661 17.9763 12.4576 18.6843 12.081C20.1087 11.3277 21 9.92655 21 8.42749C21 6.09228 18.9009 4.19397 16.3103 4.19397H16.227L16.1853 4.11864C15.4273 2.258 13.4365 1 11.2457 1C8.91337 1 6.8309 2.4162 6.1895 4.44256L6.14785 4.54802L6.03124 4.52542C5.86464 4.48776 5.68971 4.46516 5.49813 4.46516Z" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M15.4357 13.7156C15.4357 15.8475 13.4449 17.58 10.9875 17.58C8.53024 17.58 6.5394 15.8475 6.5394 13.7156" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M10.9875 19.9228V23.1921" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M7.9971 19.3503V21.5574" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M13.9446 19.3578V21.5122" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M10.9876 25C11.5373 25 11.9871 24.5932 11.9871 24.096C11.9871 23.5989 11.5373 23.1921 10.9876 23.1921C10.4378 23.1921 9.98798 23.5989 9.98798 24.096C9.98798 24.5932 10.4378 25 10.9876 25Z" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M7.99708 23.3653C8.54685 23.3653 8.99666 22.9586 8.99666 22.4614C8.99666 21.9642 8.54685 21.5574 7.99708 21.5574C7.44731 21.5574 6.9975 21.9642 6.9975 22.4614C6.9975 22.9586 7.44731 23.3653 7.99708 23.3653Z" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M13.9446 23.3201C14.4944 23.3201 14.9442 22.9134 14.9442 22.4162C14.9442 21.919 14.4944 21.5122 13.9446 21.5122C13.3948 21.5122 12.945 21.919 12.945 22.4162C12.945 22.9134 13.3948 23.3201 13.9446 23.3201Z" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M13.953 19.3578C16.4186 18.3785 18.1263 16.2166 18.1263 13.7081" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M7.9971 19.3503C8.90506 19.7119 9.9213 19.9153 10.9875 19.9153" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M3.84888 13.7157C3.84888 15.6818 4.89844 17.437 6.53942 18.5669" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M16.3019 5.24859H15.4856L15.1024 4.53296L15.0774 4.48023C14.5027 3.07157 13.0283 2.11488 11.379 2.06215C11.8454 2.38607 12.2703 2.77025 12.6201 3.19963C13.4614 4.23164 13.9029 5.53484 13.8363 6.81544C15.4273 6.38607 17.2015 6.55932 18.6509 7.29002C19.0591 7.49341 19.4423 7.74953 19.7921 8.03578C19.5756 6.4614 18.1012 5.24859 16.3019 5.24859Z" fill="#A2A2CC"/>
+</svg>
diff --git a/images/tyk_docs_nav_faq_icion.svg b/images/tyk_docs_nav_faq_icion.svg
new file mode 100644
index 0000000000..5b4df93f83
--- /dev/null
+++ b/images/tyk_docs_nav_faq_icion.svg
@@ -0,0 +1,17 @@
+<svg width="23" height="24" viewBox="0 0 23 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0)">
+<path d="M19.5225 21.6847L21.4955 15.0541C21.7117 14.3243 21.1712 13.5946 20.4054 13.5946H11.2613H2.1081C1.35135 13.5946 0.801798 14.3243 1.01801 15.0541L2.99099 21.6847H11.2883" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1.60361 20.2973L0.54956 22.2793C0.243253 22.8559 0.657668 23.5495 1.31533 23.5495H11.2613H21.2072C21.8559 23.5495 22.2793 22.8559 21.973 22.2793L20.9189 20.2973" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M13.8018 7.95496C13.8018 7.95496 16.3243 9.32433 17.3063 10.1081C17.5406 10.2973 17.7388 10.5225 17.8919 10.7748C18.1892 11.2432 18.3243 11.8018 18.3243 12.3604V13.5946" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M8.72074 7.95496C8.72074 7.95496 6.19821 9.32433 5.21623 10.1081C4.982 10.2973 4.7838 10.5225 4.63064 10.7748C4.33335 11.2432 4.19821 11.8018 4.19821 12.3604V13.5946" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M11.2613 9.27928C13.2266 9.27928 14.8198 7.30288 14.8198 4.86487C14.8198 2.42685 13.2266 0.450451 11.2613 0.450451C9.29595 0.450451 7.70273 2.42685 7.70273 4.86487C7.70273 7.30288 9.29595 9.27928 11.2613 9.27928Z" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M20.4415 14.7027C20.4324 14.6847 20.4234 14.6847 20.4144 14.6847H11.2613H2.10812C2.09911 14.6847 2.0901 14.6847 2.08109 14.7027C2.07208 14.7207 2.07208 14.7297 2.07208 14.7387L3.09911 18.2072C3.10812 18.1982 3.10812 18.1892 3.11713 18.1802C3.78379 17.045 4.991 16.3514 6.30632 16.3514H19.973L20.4505 14.7387C20.4505 14.7297 20.4505 14.7207 20.4415 14.7027Z" fill="#258B80"/>
+<path d="M18.973 5.74775V5.12613C18.973 4.61261 19.2613 4.14415 19.7207 3.90991C20.2072 3.66667 20.5315 3.18018 20.5406 2.63964C20.5406 2.61261 20.5406 2.58559 20.5406 2.54955C20.5045 1.75676 19.8649 1.0991 19.0631 1.05406C18.1622 1.00901 17.4144 1.72072 17.4144 2.61261" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M19.6397 7.74775C19.6397 8.11712 19.3424 8.4054 18.982 8.4054C18.6216 8.4054 18.3243 8.10811 18.3243 7.74775C18.3243 7.38739 18.6216 7.09009 18.982 7.09009C19.3424 7.08108 19.6397 7.37838 19.6397 7.74775Z" fill="#505071"/>
+</g>
+<defs>
+<clipPath id="clip0">
+<rect width="22.5225" height="24" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/images/tyk_docs_nav_getstarted_icon.svg b/images/tyk_docs_nav_getstarted_icon.svg
new file mode 100644
index 0000000000..205860ac3f
--- /dev/null
+++ b/images/tyk_docs_nav_getstarted_icon.svg
@@ -0,0 +1,21 @@
+<svg width="23" height="24" viewBox="0 0 23 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0)">
+<path d="M12.1344 10.1952C11.952 10.1952 11.7984 10.0416 11.7984 9.8592C11.7984 8.976 11.0784 8.256 10.1952 8.256C9.31201 8.256 8.59201 8.976 8.59201 9.8592C8.59201 10.0416 8.43841 10.1952 8.25601 10.1952C8.07361 10.1952 7.92001 10.0416 7.92001 9.8592C7.92001 8.6016 8.93761 7.584 10.1952 7.584C11.4528 7.584 12.4704 8.6016 12.4704 9.8592C12.4704 10.0512 12.3168 10.1952 12.1344 10.1952Z" fill="#258B80"/>
+<path d="M14.9088 16.2144C14.9088 16.2144 14.88 17.3184 14.3808 18.2208C13.7184 19.44 13.056 20.352 13.056 21.8784" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M12.288 14.4576C12.3456 12.864 12.4224 12.4512 12.0864 12.2304C11.7024 11.9712 11.3184 12.288 11.0208 12.5856" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M13.6032 15.2256C13.6608 13.632 13.7376 13.2192 13.4016 12.9984C13.0176 12.7392 12.6336 13.056 12.336 13.3536" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M14.9088 16.2144C14.9664 14.6208 15.0432 14.208 14.7072 13.9872C14.3232 13.728 13.9392 14.0448 13.6416 14.3424" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M7.62241 23.52V22.368C7.62241 22.0992 7.83361 21.888 8.10241 21.888H13.4496C13.7184 21.888 13.9296 22.0992 13.9296 22.368V23.52" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M8.5536 21.888V20.304C8.5536 17.8464 7.8624 17.136 6.9888 16.08C6.9888 16.08 6.384 15.2544 6.4512 14.2944C6.5088 13.4688 7.6896 13.3824 7.872 14.1792C7.8912 14.256 7.9008 14.3328 7.9104 14.4288C7.9488 14.8416 8.1792 15.216 8.5536 15.3984C9.0336 15.6384 9.5904 15.2928 9.5904 14.7552V14.5248V10.0224C9.5904 9.6576 9.888 9.3504 10.2624 9.3504C10.6272 9.3504 10.9344 9.648 10.9344 10.0224V13.9776" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M5.45281 17.808H1.87201C1.10401 17.808 0.480011 17.184 0.480011 16.416V1.6224C0.480011 0.9984 0.988811 0.48 1.62241 0.48H20.5344C21.1584 0.48 21.6768 0.9888 21.6768 1.6224V16.416C21.6768 17.184 21.0528 17.808 20.2848 17.808H16.8864" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M0.480011 5.0112H21.6672" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M2.88001 2.4C2.88001 2.13506 2.66495 1.92 2.40001 1.92C2.13508 1.92 1.92001 2.13506 1.92001 2.4C1.92001 2.66493 2.13508 2.88 2.40001 2.88C2.66495 2.88 2.88001 2.66493 2.88001 2.4Z" fill="#505071"/>
+<path d="M4.8 2.4C4.8 2.13506 4.58493 1.92 4.32 1.92C4.05506 1.92 3.84 2.13506 3.84 2.4C3.84 2.66493 4.05506 2.88 4.32 2.88C4.58493 2.88 4.8 2.66493 4.8 2.4Z" fill="#505071"/>
+<path d="M6.72001 2.4C6.72001 2.13506 6.50495 1.92 6.24001 1.92C5.97508 1.92 5.76001 2.13506 5.76001 2.4C5.76001 2.66493 5.97508 2.88 6.24001 2.88C6.50495 2.88 6.72001 2.66493 6.72001 2.4Z" fill="#505071"/>
+</g>
+<defs>
+<clipPath id="clip0">
+<rect width="22.1472" height="24" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/images/tyk_docs_nav_home_icon.svg b/images/tyk_docs_nav_home_icon.svg
new file mode 100644
index 0000000000..3723a22e46
--- /dev/null
+++ b/images/tyk_docs_nav_home_icon.svg
@@ -0,0 +1,10 @@
+<svg width="24" height="22" viewBox="0 0 24 22" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M7.60001 13C7.60001 12.4477 8.04772 12 8.60001 12H15.4C15.9523 12 16.4 12.4477 16.4 13V21.9H7.60001V13Z" fill="#D6B218"/>
+<path d="M11.9994 1L1 9.2756" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M3.06349 9.40155V21.2622" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M3.06349 21.2622H20.9352" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M11.9994 5.97465L7.79605 9.13731" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M11.9994 1L23 9.2756" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M20.9352 9.40155V21.2622" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M11.9994 5.97465L16.2027 9.13731" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/images/tyk_docs_nav_keyc_icon.svg b/images/tyk_docs_nav_keyc_icon.svg
new file mode 100644
index 0000000000..998aafe5b1
--- /dev/null
+++ b/images/tyk_docs_nav_keyc_icon.svg
@@ -0,0 +1,20 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0)">
+<path d="M13.2296 18.3994H2.05534C1.16679 18.3994 0.448761 17.6814 0.448761 16.7928V1.62454C0.448761 0.969337 0.978305 0.448769 1.62453 0.448769H21.2266C21.8818 0.448769 22.4024 0.978312 22.4024 1.62454V15.8145" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M0.448761 5.15184H22.4114" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M17.0262 6.15707L21.4061 10.528V6.15707H17.0262Z" fill="#A2A2CC"/>
+<path d="M17.816 17.2236C19.0815 16.5595 20.6791 16.7569 21.7472 17.825C23.0576 19.1354 23.0576 21.2625 21.7472 22.5729C20.4368 23.8833 18.3096 23.8833 16.9992 22.5729C15.6888 21.2625 15.6888 19.1354 16.9992 17.825" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M17.816 17.2236L13.9656 13.3643L11.4525 10.8512L8.34705 13.9566L9.21765 14.8272L10.4293 13.6066L11.2191 14.3964L10.6088 14.9978L11.4705 15.8594L12.5744 14.7554L16.4159 18.5969" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M19.7906 20.1945C19.7906 21.0023 19.4405 21.7293 18.893 22.2408C19.0546 22.2767 19.2072 22.2947 19.3687 22.2947C19.9072 22.2947 20.4458 22.0883 20.8586 21.6844C21.6754 20.8676 21.6754 19.5303 20.8586 18.7135C20.4547 18.3097 19.9162 18.0942 19.3777 18.0942C19.2161 18.0942 19.0546 18.1122 18.893 18.1481C19.4495 18.6597 19.7906 19.3867 19.7906 20.1945Z" fill="#FFE280"/>
+<path d="M1.93866 7.0905H12.1256" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1.93866 9.26254H12.1256" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+</g>
+<path d="M3 2.5C3 2.22403 2.77598 2 2.5 2C2.22403 2 2 2.22403 2 2.5C2 2.77597 2.22403 3 2.5 3C2.77598 3 3 2.77597 3 2.5Z" fill="#505071"/>
+<path d="M5 2.5C5 2.22403 4.77598 2 4.5 2C4.22403 2 4 2.22403 4 2.5C4 2.77597 4.22403 3 4.5 3C4.77598 3 5 2.77597 5 2.5Z" fill="#505071"/>
+<path d="M7 2.5C7 2.22403 6.77598 2 6.5 2C6.22403 2 6 2.22403 6 2.5C6 2.77597 6.22403 3 6.5 3C6.77598 3 7 2.77597 7 2.5Z" fill="#505071"/>
+<defs>
+<clipPath id="clip0">
+<rect width="23.1743" height="24" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/images/tyk_docs_nav_tykstack_icon.svg b/images/tyk_docs_nav_tykstack_icon.svg
new file mode 100644
index 0000000000..ec05ea1392
--- /dev/null
+++ b/images/tyk_docs_nav_tykstack_icon.svg
@@ -0,0 +1,25 @@
+<svg width="24" height="22" viewBox="0 0 24 22" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0)">
+<path d="M23.5677 13.4611V14.4294C23.5677 14.7925 23.317 15.121 22.9625 15.2161C19.9453 16.0202 16.781 16.0202 13.7637 15.2161C13.4092 15.121 13.1585 14.8012 13.1585 14.4294V13.4611" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M23.5677 16.1412V17.1095C23.5677 17.4726 23.317 17.8012 22.9625 17.8963C19.9453 18.7003 16.781 18.7003 13.7637 17.8963C13.4092 17.8012 13.1585 17.4813 13.1585 17.1095V16.1412" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M23.5677 18.83V19.7983C23.5677 20.1614 23.317 20.4899 22.9625 20.585C19.9453 21.389 16.781 21.389 13.7637 20.585C13.4092 20.4899 13.1585 20.17 13.1585 19.7983V18.83" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M20.6888 10.3746C22.4006 10.6167 23.5764 11.1182 23.5764 11.6974C23.5764 12.5101 21.2507 13.1671 18.3718 13.1671C15.5014 13.1671 13.1671 12.5101 13.1671 11.6974C13.1671 11.1182 14.3429 10.6167 16.0548 10.3746" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M18.6311 5.5245V1.77234C18.6311 1.02882 18.0346 0.432278 17.291 0.432278H16.0374" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M16.0288 0.432278H1.98846C1.24495 0.432278 0.648407 1.02882 0.648407 1.77234V12.4409C0.648407 13.1844 1.24495 13.781 1.98846 13.781H11.8962" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M5.04898 13.781L4.2363 15.8473H9.63976H12.0951" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M12.4928 21.1816H9.63112H1.07204C0.587892 21.1816 0.276653 20.6628 0.518728 20.2392L2.08357 17.4121H12.0951" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M19.6002 10.375C19.6836 9.69735 19.2019 9.08035 18.5243 8.99691C17.8466 8.91347 17.2296 9.3952 17.1461 10.0729C17.0627 10.7505 17.5444 11.3676 18.2221 11.451C18.8998 11.5344 19.5168 11.0527 19.6002 10.375Z" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M13.4092 6.76081C13.4092 7.44381 12.8559 7.99712 12.1729 7.99712C11.4899 7.99712 10.9366 7.44381 10.9366 6.76081C10.9366 6.07781 11.4899 5.5245 12.1729 5.5245C12.8472 5.5245 13.4092 6.07781 13.4092 6.76081Z" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M7.77234 10.0288C7.77234 10.7118 7.21902 11.2651 6.53602 11.2651C5.85303 11.2651 5.29971 10.7118 5.29971 10.0288C5.29971 9.34582 5.85303 8.79251 6.53602 8.79251C7.21902 8.78386 7.77234 9.34582 7.77234 10.0288Z" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M6.46685 4.5389C6.46685 5.2219 5.91354 5.77522 5.23054 5.77522C4.54755 5.77522 3.99423 5.2219 3.99423 4.5389C3.99423 3.85591 4.54755 3.30259 5.23054 3.30259C5.91354 3.30259 6.46685 3.85591 6.46685 4.5389Z" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M18.3718 8.99135V6.76081H13.4006" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M6.39771 4.94524L10.9885 6.38905" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M7.634 9.3804L11.0836 7.35735" stroke="#505071" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M1.81555 20.1009H8.2997L9.90777 18.4928H2.71469L1.81555 20.1009Z" fill="#FFC524"/>
+</g>
+<defs>
+<clipPath id="clip0">
+<rect width="24" height="21.6138" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/img/2.10/add_api.png b/img/2.10/add_api.png
new file mode 100644
index 0000000000..aa86ca5c17
Binary files /dev/null and b/img/2.10/add_api.png differ
diff --git a/img/2.10/add_catalogue_entry.png b/img/2.10/add_catalogue_entry.png
new file mode 100644
index 0000000000..1641f4155b
Binary files /dev/null and b/img/2.10/add_catalogue_entry.png differ
diff --git a/img/2.10/add_developer.png b/img/2.10/add_developer.png
new file mode 100644
index 0000000000..a56f87acbc
Binary files /dev/null and b/img/2.10/add_developer.png differ
diff --git a/img/2.10/add_developer_details.png b/img/2.10/add_developer_details.png
new file mode 100644
index 0000000000..cbca5258d2
Binary files /dev/null and b/img/2.10/add_developer_details.png differ
diff --git a/img/2.10/add_header_type.png b/img/2.10/add_header_type.png
new file mode 100644
index 0000000000..2f0e136da5
Binary files /dev/null and b/img/2.10/add_header_type.png differ
diff --git a/img/2.10/add_key.png b/img/2.10/add_key.png
new file mode 100644
index 0000000000..22d6fc09ea
Binary files /dev/null and b/img/2.10/add_key.png differ
diff --git a/img/2.10/add_policy.png b/img/2.10/add_policy.png
new file mode 100644
index 0000000000..db7ff53c36
Binary files /dev/null and b/img/2.10/add_policy.png differ
diff --git a/img/2.10/add_user.png b/img/2.10/add_user.png
new file mode 100644
index 0000000000..5d54992b72
Binary files /dev/null and b/img/2.10/add_user.png differ
diff --git a/img/2.10/add_user_group.png b/img/2.10/add_user_group.png
new file mode 100644
index 0000000000..db3496bead
Binary files /dev/null and b/img/2.10/add_user_group.png differ
diff --git a/img/2.10/add_webhook.png b/img/2.10/add_webhook.png
new file mode 100644
index 0000000000..f73afe6fc7
Binary files /dev/null and b/img/2.10/add_webhook.png differ
diff --git a/img/2.10/advanced_options_designer.png b/img/2.10/advanced_options_designer.png
new file mode 100644
index 0000000000..0e62eaec37
Binary files /dev/null and b/img/2.10/advanced_options_designer.png differ
diff --git a/img/2.10/analytics_overview2.png b/img/2.10/analytics_overview2.png
new file mode 100644
index 0000000000..90a59e062a
Binary files /dev/null and b/img/2.10/analytics_overview2.png differ
diff --git a/img/2.10/api_id.png b/img/2.10/api_id.png
new file mode 100644
index 0000000000..341c2f3b7d
Binary files /dev/null and b/img/2.10/api_id.png differ
diff --git a/img/2.10/api_url.png b/img/2.10/api_url.png
new file mode 100644
index 0000000000..794ae82da2
Binary files /dev/null and b/img/2.10/api_url.png differ
diff --git a/img/2.10/apis_list.png b/img/2.10/apis_list.png
new file mode 100644
index 0000000000..4ea84a1960
Binary files /dev/null and b/img/2.10/apis_list.png differ
diff --git a/img/2.10/apis_menu.png b/img/2.10/apis_menu.png
new file mode 100644
index 0000000000..551193a50b
Binary files /dev/null and b/img/2.10/apis_menu.png differ
diff --git a/img/2.10/authentication.png b/img/2.10/authentication.png
new file mode 100644
index 0000000000..3ebd8c7d43
Binary files /dev/null and b/img/2.10/authentication.png differ
diff --git a/img/2.10/average_use_api.png b/img/2.10/average_use_api.png
new file mode 100644
index 0000000000..473f41898b
Binary files /dev/null and b/img/2.10/average_use_api.png differ
diff --git a/img/2.10/blacklist.png b/img/2.10/blacklist.png
new file mode 100644
index 0000000000..3d772df6f4
Binary files /dev/null and b/img/2.10/blacklist.png differ
diff --git a/img/2.10/body_trans_response_input.png b/img/2.10/body_trans_response_input.png
new file mode 100644
index 0000000000..8fa1f46349
Binary files /dev/null and b/img/2.10/body_trans_response_input.png differ
diff --git a/img/2.10/body_transforms.png b/img/2.10/body_transforms.png
new file mode 100644
index 0000000000..c060781d9a
Binary files /dev/null and b/img/2.10/body_transforms.png differ
diff --git a/img/2.10/cache_options.png b/img/2.10/cache_options.png
new file mode 100644
index 0000000000..d1de397247
Binary files /dev/null and b/img/2.10/cache_options.png differ
diff --git a/img/2.10/cache_plugin.png b/img/2.10/cache_plugin.png
new file mode 100644
index 0000000000..b30f793b9c
Binary files /dev/null and b/img/2.10/cache_plugin.png differ
diff --git a/img/2.10/catalogue_description.png b/img/2.10/catalogue_description.png
new file mode 100644
index 0000000000..fc35db4b83
Binary files /dev/null and b/img/2.10/catalogue_description.png differ
diff --git a/img/2.10/catalogue_menu.png b/img/2.10/catalogue_menu.png
new file mode 100644
index 0000000000..b60db45d5a
Binary files /dev/null and b/img/2.10/catalogue_menu.png differ
diff --git a/img/2.10/circuit_breaker.png b/img/2.10/circuit_breaker.png
new file mode 100644
index 0000000000..a34bfeea4b
Binary files /dev/null and b/img/2.10/circuit_breaker.png differ
diff --git a/img/2.10/ciruit_breaker_settings.png b/img/2.10/ciruit_breaker_settings.png
new file mode 100644
index 0000000000..f5077cd3c4
Binary files /dev/null and b/img/2.10/ciruit_breaker_settings.png differ
diff --git a/img/2.10/context_variables.png b/img/2.10/context_variables.png
new file mode 100644
index 0000000000..3264319658
Binary files /dev/null and b/img/2.10/context_variables.png differ
diff --git a/img/2.10/create_key.png b/img/2.10/create_key.png
new file mode 100644
index 0000000000..bb415cb3b6
Binary files /dev/null and b/img/2.10/create_key.png differ
diff --git a/img/2.10/custom_auth_python.png b/img/2.10/custom_auth_python.png
new file mode 100644
index 0000000000..d49eab0b45
Binary files /dev/null and b/img/2.10/custom_auth_python.png differ
diff --git a/img/2.10/dashboard_login.png b/img/2.10/dashboard_login.png
new file mode 100644
index 0000000000..61fa1a7dd2
Binary files /dev/null and b/img/2.10/dashboard_login.png differ
diff --git a/img/2.10/debugging_logs.png b/img/2.10/debugging_logs.png
new file mode 100644
index 0000000000..64b00a8499
Binary files /dev/null and b/img/2.10/debugging_logs.png differ
diff --git a/img/2.10/debugging_request.png b/img/2.10/debugging_request.png
new file mode 100644
index 0000000000..646884b5f5
Binary files /dev/null and b/img/2.10/debugging_request.png differ
diff --git a/img/2.10/debugging_results.png b/img/2.10/debugging_results.png
new file mode 100644
index 0000000000..b142b1e0ce
Binary files /dev/null and b/img/2.10/debugging_results.png differ
diff --git a/img/2.10/developer_details.png b/img/2.10/developer_details.png
new file mode 100644
index 0000000000..b2d08726f7
Binary files /dev/null and b/img/2.10/developer_details.png differ
diff --git a/img/2.10/developer_graph.png b/img/2.10/developer_graph.png
new file mode 100644
index 0000000000..77b30c1223
Binary files /dev/null and b/img/2.10/developer_graph.png differ
diff --git a/img/2.10/developer_keys.png b/img/2.10/developer_keys.png
new file mode 100644
index 0000000000..b5fd3b35f4
Binary files /dev/null and b/img/2.10/developer_keys.png differ
diff --git a/img/2.10/developer_new_key.png b/img/2.10/developer_new_key.png
new file mode 100644
index 0000000000..64d9efc16e
Binary files /dev/null and b/img/2.10/developer_new_key.png differ
diff --git a/img/2.10/developers_menu.png b/img/2.10/developers_menu.png
new file mode 100644
index 0000000000..ea3dcca1ed
Binary files /dev/null and b/img/2.10/developers_menu.png differ
diff --git a/img/2.10/edge-dropdown.png b/img/2.10/edge-dropdown.png
new file mode 100644
index 0000000000..99457a991c
Binary files /dev/null and b/img/2.10/edge-dropdown.png differ
diff --git a/img/2.10/edge_custom_domain.png b/img/2.10/edge_custom_domain.png
new file mode 100644
index 0000000000..df6ded86c0
Binary files /dev/null and b/img/2.10/edge_custom_domain.png differ
diff --git a/img/2.10/edit_developer_details.png b/img/2.10/edit_developer_details.png
new file mode 100644
index 0000000000..328fc3b73e
Binary files /dev/null and b/img/2.10/edit_developer_details.png differ
diff --git a/img/2.10/enforced_breakout.png b/img/2.10/enforced_breakout.png
new file mode 100644
index 0000000000..4f35dc7f08
Binary files /dev/null and b/img/2.10/enforced_breakout.png differ
diff --git a/img/2.10/enforced_timeouts_settings.png b/img/2.10/enforced_timeouts_settings.png
new file mode 100644
index 0000000000..8dd4341189
Binary files /dev/null and b/img/2.10/enforced_timeouts_settings.png differ
diff --git a/img/2.10/error_breakdown.png b/img/2.10/error_breakdown.png
new file mode 100644
index 0000000000..7f281dbee4
Binary files /dev/null and b/img/2.10/error_breakdown.png differ
diff --git a/img/2.10/error_breakdown_api.png b/img/2.10/error_breakdown_api.png
new file mode 100644
index 0000000000..752ad529f2
Binary files /dev/null and b/img/2.10/error_breakdown_api.png differ
diff --git a/img/2.10/error_by_key.png b/img/2.10/error_by_key.png
new file mode 100644
index 0000000000..3fc9ec475d
Binary files /dev/null and b/img/2.10/error_by_key.png differ
diff --git a/img/2.10/errors_overview.png b/img/2.10/errors_overview.png
new file mode 100644
index 0000000000..572be9fccd
Binary files /dev/null and b/img/2.10/errors_overview.png differ
diff --git a/img/2.10/export_api_button.png b/img/2.10/export_api_button.png
new file mode 100644
index 0000000000..4fa0c9f526
Binary files /dev/null and b/img/2.10/export_api_button.png differ
diff --git a/img/2.10/geographic_dist.png b/img/2.10/geographic_dist.png
new file mode 100644
index 0000000000..2468246546
Binary files /dev/null and b/img/2.10/geographic_dist.png differ
diff --git a/img/2.10/global_limits_policies.png b/img/2.10/global_limits_policies.png
new file mode 100644
index 0000000000..d84ad9f4c9
Binary files /dev/null and b/img/2.10/global_limits_policies.png differ
diff --git a/img/2.10/global_settings_modify_headers.png b/img/2.10/global_settings_modify_headers.png
new file mode 100644
index 0000000000..fc20a345f4
Binary files /dev/null and b/img/2.10/global_settings_modify_headers.png differ
diff --git a/img/2.10/home_page_template.png b/img/2.10/home_page_template.png
new file mode 100644
index 0000000000..62c8b8ee85
Binary files /dev/null and b/img/2.10/home_page_template.png differ
diff --git a/img/2.10/identity_profile2.png b/img/2.10/identity_profile2.png
new file mode 100644
index 0000000000..8f6bcf711b
Binary files /dev/null and b/img/2.10/identity_profile2.png differ
diff --git a/img/2.10/ignore.png b/img/2.10/ignore.png
new file mode 100644
index 0000000000..0cde554449
Binary files /dev/null and b/img/2.10/ignore.png differ
diff --git a/img/2.10/import_api_button.png b/img/2.10/import_api_button.png
new file mode 100644
index 0000000000..0c23604e6c
Binary files /dev/null and b/img/2.10/import_api_button.png differ
diff --git a/img/2.10/import_api_json.png b/img/2.10/import_api_json.png
new file mode 100644
index 0000000000..d7aeec6e67
Binary files /dev/null and b/img/2.10/import_api_json.png differ
diff --git a/img/2.10/import_api_wsdl.png b/img/2.10/import_api_wsdl.png
new file mode 100644
index 0000000000..853f11c742
Binary files /dev/null and b/img/2.10/import_api_wsdl.png differ
diff --git a/img/2.10/import_tyk_definition.png b/img/2.10/import_tyk_definition.png
new file mode 100644
index 0000000000..bd76a50e53
Binary files /dev/null and b/img/2.10/import_tyk_definition.png differ
diff --git a/img/2.10/kafka0.png b/img/2.10/kafka0.png
new file mode 100644
index 0000000000..a4765ded79
Binary files /dev/null and b/img/2.10/kafka0.png differ
diff --git a/img/2.10/key_approval_email_config.png b/img/2.10/key_approval_email_config.png
new file mode 100644
index 0000000000..805e9c5216
Binary files /dev/null and b/img/2.10/key_approval_email_config.png differ
diff --git a/img/2.10/key_approval_image_link.png b/img/2.10/key_approval_image_link.png
new file mode 100644
index 0000000000..e2fc712ba6
Binary files /dev/null and b/img/2.10/key_approval_image_link.png differ
diff --git a/img/2.10/key_success.png b/img/2.10/key_success.png
new file mode 100644
index 0000000000..09fb6ccc8f
Binary files /dev/null and b/img/2.10/key_success.png differ
diff --git a/img/2.10/keys_menu.png b/img/2.10/keys_menu.png
new file mode 100644
index 0000000000..65ec566be3
Binary files /dev/null and b/img/2.10/keys_menu.png differ
diff --git a/img/2.10/log_browser.png b/img/2.10/log_browser.png
new file mode 100644
index 0000000000..7e96902a90
Binary files /dev/null and b/img/2.10/log_browser.png differ
diff --git a/img/2.10/log_browser_selected.png b/img/2.10/log_browser_selected.png
new file mode 100644
index 0000000000..d2c0435cca
Binary files /dev/null and b/img/2.10/log_browser_selected.png differ
diff --git a/img/2.10/method_transform.png b/img/2.10/method_transform.png
new file mode 100644
index 0000000000..c0e7fdf358
Binary files /dev/null and b/img/2.10/method_transform.png differ
diff --git a/img/2.10/method_transform2.png b/img/2.10/method_transform2.png
new file mode 100644
index 0000000000..e21b0589ab
Binary files /dev/null and b/img/2.10/method_transform2.png differ
diff --git a/img/2.10/modify-header-response.png b/img/2.10/modify-header-response.png
new file mode 100644
index 0000000000..0c6dd1641e
Binary files /dev/null and b/img/2.10/modify-header-response.png differ
diff --git a/img/2.10/modify_headers.png b/img/2.10/modify_headers.png
new file mode 100644
index 0000000000..974335f46e
Binary files /dev/null and b/img/2.10/modify_headers.png differ
diff --git a/img/2.10/modify_headers1.png b/img/2.10/modify_headers1.png
new file mode 100644
index 0000000000..2fbfa7b5c1
Binary files /dev/null and b/img/2.10/modify_headers1.png differ
diff --git a/img/2.10/modify_headers2.png b/img/2.10/modify_headers2.png
new file mode 100644
index 0000000000..b0a01649ac
Binary files /dev/null and b/img/2.10/modify_headers2.png differ
diff --git a/img/2.10/mtls_auth_cert.png b/img/2.10/mtls_auth_cert.png
new file mode 100644
index 0000000000..02ea3776b6
Binary files /dev/null and b/img/2.10/mtls_auth_cert.png differ
diff --git a/img/2.10/numberservice_api.png b/img/2.10/numberservice_api.png
new file mode 100644
index 0000000000..b110d50770
Binary files /dev/null and b/img/2.10/numberservice_api.png differ
diff --git a/img/2.10/numberservice_endpoints.png b/img/2.10/numberservice_endpoints.png
new file mode 100644
index 0000000000..a6a24e6476
Binary files /dev/null and b/img/2.10/numberservice_endpoints.png differ
diff --git a/img/2.10/opa-floating.png b/img/2.10/opa-floating.png
new file mode 100644
index 0000000000..b016eb715f
Binary files /dev/null and b/img/2.10/opa-floating.png differ
diff --git a/img/2.10/opa.png b/img/2.10/opa.png
new file mode 100644
index 0000000000..5a7200a062
Binary files /dev/null and b/img/2.10/opa.png differ
diff --git a/img/2.10/partitioned_policy_settings.png b/img/2.10/partitioned_policy_settings.png
new file mode 100644
index 0000000000..d54e4f8a4c
Binary files /dev/null and b/img/2.10/partitioned_policy_settings.png differ
diff --git a/img/2.10/path_and_method.png b/img/2.10/path_and_method.png
new file mode 100644
index 0000000000..ed1e33545b
Binary files /dev/null and b/img/2.10/path_and_method.png differ
diff --git a/img/2.10/plugin_bundle_id.png b/img/2.10/plugin_bundle_id.png
new file mode 100644
index 0000000000..64b9182472
Binary files /dev/null and b/img/2.10/plugin_bundle_id.png differ
diff --git a/img/2.10/policies_menu.png b/img/2.10/policies_menu.png
new file mode 100644
index 0000000000..919d2b2467
Binary files /dev/null and b/img/2.10/policies_menu.png differ
diff --git a/img/2.10/policy_id_after.png b/img/2.10/policy_id_after.png
new file mode 100644
index 0000000000..235115d3a2
Binary files /dev/null and b/img/2.10/policy_id_after.png differ
diff --git a/img/2.10/policy_id_before.png b/img/2.10/policy_id_before.png
new file mode 100644
index 0000000000..006187f572
Binary files /dev/null and b/img/2.10/policy_id_before.png differ
diff --git a/img/2.10/policy_list.png b/img/2.10/policy_list.png
new file mode 100644
index 0000000000..c7503aad4e
Binary files /dev/null and b/img/2.10/policy_list.png differ
diff --git a/img/2.10/portal_confirmation_on_prem.png b/img/2.10/portal_confirmation_on_prem.png
new file mode 100644
index 0000000000..578f863da1
Binary files /dev/null and b/img/2.10/portal_confirmation_on_prem.png differ
diff --git a/img/2.10/portal_manager_email_config.png b/img/2.10/portal_manager_email_config.png
new file mode 100644
index 0000000000..69ebe5b05d
Binary files /dev/null and b/img/2.10/portal_manager_email_config.png differ
diff --git a/img/2.10/postman_soap_rest.png b/img/2.10/postman_soap_rest.png
new file mode 100644
index 0000000000..af76fb9607
Binary files /dev/null and b/img/2.10/postman_soap_rest.png differ
diff --git a/img/2.10/protocol_and_port.png b/img/2.10/protocol_and_port.png
new file mode 100644
index 0000000000..e5c9271f94
Binary files /dev/null and b/img/2.10/protocol_and_port.png differ
diff --git a/img/2.10/public_name_catalogue.png b/img/2.10/public_name_catalogue.png
new file mode 100644
index 0000000000..7c421ab561
Binary files /dev/null and b/img/2.10/public_name_catalogue.png differ
diff --git a/img/2.10/request_size_limit.png b/img/2.10/request_size_limit.png
new file mode 100644
index 0000000000..3bc3fe9cf2
Binary files /dev/null and b/img/2.10/request_size_limit.png differ
diff --git a/img/2.10/request_size_settings.png b/img/2.10/request_size_settings.png
new file mode 100644
index 0000000000..88cc9348c8
Binary files /dev/null and b/img/2.10/request_size_settings.png differ
diff --git a/img/2.10/round_robin.png b/img/2.10/round_robin.png
new file mode 100644
index 0000000000..50ed31730a
Binary files /dev/null and b/img/2.10/round_robin.png differ
diff --git a/img/2.10/save.png b/img/2.10/save.png
new file mode 100644
index 0000000000..254c450253
Binary files /dev/null and b/img/2.10/save.png differ
diff --git a/img/2.10/save_redeploy.png b/img/2.10/save_redeploy.png
new file mode 100644
index 0000000000..f8a6ac1647
Binary files /dev/null and b/img/2.10/save_redeploy.png differ
diff --git a/img/2.10/search_developers.png b/img/2.10/search_developers.png
new file mode 100644
index 0000000000..2c3ad3a63c
Binary files /dev/null and b/img/2.10/search_developers.png differ
diff --git a/img/2.10/segment_tags.png b/img/2.10/segment_tags.png
new file mode 100644
index 0000000000..8744af9461
Binary files /dev/null and b/img/2.10/segment_tags.png differ
diff --git a/img/2.10/select_api_policy.png b/img/2.10/select_api_policy.png
new file mode 100644
index 0000000000..a1165994db
Binary files /dev/null and b/img/2.10/select_api_policy.png differ
diff --git a/img/2.10/service_discovery_settings.png b/img/2.10/service_discovery_settings.png
new file mode 100644
index 0000000000..2e4b523455
Binary files /dev/null and b/img/2.10/service_discovery_settings.png differ
diff --git a/img/2.10/service_discovery_settings2.png b/img/2.10/service_discovery_settings2.png
new file mode 100644
index 0000000000..dd3c661b0d
Binary files /dev/null and b/img/2.10/service_discovery_settings2.png differ
diff --git a/img/2.10/split_token2.png b/img/2.10/split_token2.png
new file mode 100644
index 0000000000..ed99d3e360
Binary files /dev/null and b/img/2.10/split_token2.png differ
diff --git a/img/2.10/traffic_api.png b/img/2.10/traffic_api.png
new file mode 100644
index 0000000000..a93dc8365c
Binary files /dev/null and b/img/2.10/traffic_api.png differ
diff --git a/img/2.10/traffic_by_key.png b/img/2.10/traffic_by_key.png
new file mode 100644
index 0000000000..15bbd16020
Binary files /dev/null and b/img/2.10/traffic_by_key.png differ
diff --git a/img/2.10/update_number_conversion.png b/img/2.10/update_number_conversion.png
new file mode 100644
index 0000000000..795092ea27
Binary files /dev/null and b/img/2.10/update_number_conversion.png differ
diff --git a/img/2.10/uptime_test_add.png b/img/2.10/uptime_test_add.png
new file mode 100644
index 0000000000..281a70acd0
Binary files /dev/null and b/img/2.10/uptime_test_add.png differ
diff --git a/img/2.10/uptime_test_path_details.png b/img/2.10/uptime_test_path_details.png
new file mode 100644
index 0000000000..a2b1931934
Binary files /dev/null and b/img/2.10/uptime_test_path_details.png differ
diff --git a/img/2.10/uptime_tests.png b/img/2.10/uptime_tests.png
new file mode 100644
index 0000000000..4ec7bc2d66
Binary files /dev/null and b/img/2.10/uptime_tests.png differ
diff --git a/img/2.10/url_re-write_advanced.png b/img/2.10/url_re-write_advanced.png
new file mode 100644
index 0000000000..0b91bb6be5
Binary files /dev/null and b/img/2.10/url_re-write_advanced.png differ
diff --git a/img/2.10/url_rewrite-advanced-edit.png b/img/2.10/url_rewrite-advanced-edit.png
new file mode 100644
index 0000000000..b27a74b0fd
Binary files /dev/null and b/img/2.10/url_rewrite-advanced-edit.png differ
diff --git a/img/2.10/url_rewrite.png b/img/2.10/url_rewrite.png
new file mode 100644
index 0000000000..b58241b7a0
Binary files /dev/null and b/img/2.10/url_rewrite.png differ
diff --git a/img/2.10/url_rewrite_settings.png b/img/2.10/url_rewrite_settings.png
new file mode 100644
index 0000000000..86151cd4fa
Binary files /dev/null and b/img/2.10/url_rewrite_settings.png differ
diff --git a/img/2.10/user_api_credentials.png b/img/2.10/user_api_credentials.png
new file mode 100644
index 0000000000..628c89553b
Binary files /dev/null and b/img/2.10/user_api_credentials.png differ
diff --git a/img/2.10/user_api_id.png b/img/2.10/user_api_id.png
new file mode 100644
index 0000000000..c20c7a0eb5
Binary files /dev/null and b/img/2.10/user_api_id.png differ
diff --git a/img/2.10/user_basic_details.png b/img/2.10/user_basic_details.png
new file mode 100644
index 0000000000..0cbeda94d9
Binary files /dev/null and b/img/2.10/user_basic_details.png differ
diff --git a/img/2.10/user_credentials.png b/img/2.10/user_credentials.png
new file mode 100644
index 0000000000..1ac97c80b9
Binary files /dev/null and b/img/2.10/user_credentials.png differ
diff --git a/img/2.10/user_group_details.png b/img/2.10/user_group_details.png
new file mode 100644
index 0000000000..7db53ad4ac
Binary files /dev/null and b/img/2.10/user_group_details.png differ
diff --git a/img/2.10/user_group_permissions.png b/img/2.10/user_group_permissions.png
new file mode 100644
index 0000000000..f1bf70a62c
Binary files /dev/null and b/img/2.10/user_group_permissions.png differ
diff --git a/img/2.10/user_group_save.png b/img/2.10/user_group_save.png
new file mode 100644
index 0000000000..897f8b673e
Binary files /dev/null and b/img/2.10/user_group_save.png differ
diff --git a/img/2.10/user_groups_menu.png b/img/2.10/user_groups_menu.png
new file mode 100644
index 0000000000..f2b1524237
Binary files /dev/null and b/img/2.10/user_groups_menu.png differ
diff --git a/img/2.10/user_permissions.png b/img/2.10/user_permissions.png
new file mode 100644
index 0000000000..5f92c8cb8a
Binary files /dev/null and b/img/2.10/user_permissions.png differ
diff --git a/img/2.10/user_reset_password.png b/img/2.10/user_reset_password.png
new file mode 100644
index 0000000000..98ca5700f2
Binary files /dev/null and b/img/2.10/user_reset_password.png differ
diff --git a/img/2.10/user_search.png b/img/2.10/user_search.png
new file mode 100644
index 0000000000..7167de849f
Binary files /dev/null and b/img/2.10/user_search.png differ
diff --git a/img/2.10/user_select_group.png b/img/2.10/user_select_group.png
new file mode 100644
index 0000000000..d3d8cdc1cd
Binary files /dev/null and b/img/2.10/user_select_group.png differ
diff --git a/img/2.10/users_menu.png b/img/2.10/users_menu.png
new file mode 100644
index 0000000000..a12b3067c7
Binary files /dev/null and b/img/2.10/users_menu.png differ
diff --git a/img/2.10/users_save.png b/img/2.10/users_save.png
new file mode 100644
index 0000000000..dc72293041
Binary files /dev/null and b/img/2.10/users_save.png differ
diff --git a/img/2.10/validate_json.png b/img/2.10/validate_json.png
new file mode 100644
index 0000000000..c052c555c0
Binary files /dev/null and b/img/2.10/validate_json.png differ
diff --git a/img/2.10/versioning.png b/img/2.10/versioning.png
new file mode 100644
index 0000000000..1b037387f8
Binary files /dev/null and b/img/2.10/versioning.png differ
diff --git a/img/2.10/webhook_details.png b/img/2.10/webhook_details.png
new file mode 100644
index 0000000000..d40b477978
Binary files /dev/null and b/img/2.10/webhook_details.png differ
diff --git a/img/2.10/webhooks_designer_settings.png b/img/2.10/webhooks_designer_settings.png
new file mode 100644
index 0000000000..b9bc952cee
Binary files /dev/null and b/img/2.10/webhooks_designer_settings.png differ
diff --git a/img/2.10/webhooks_menu.png b/img/2.10/webhooks_menu.png
new file mode 100644
index 0000000000..259bfd95dc
Binary files /dev/null and b/img/2.10/webhooks_menu.png differ
diff --git a/img/2.10/welcome_email_config.png b/img/2.10/welcome_email_config.png
new file mode 100644
index 0000000000..4df3e10721
Binary files /dev/null and b/img/2.10/welcome_email_config.png differ
diff --git a/img/2.10/whitelist.png b/img/2.10/whitelist.png
new file mode 100644
index 0000000000..e8edfbd611
Binary files /dev/null and b/img/2.10/whitelist.png differ
diff --git a/img/GitHub-Mark-64px.png b/img/GitHub-Mark-64px.png
new file mode 100644
index 0000000000..eeac312dd6
Binary files /dev/null and b/img/GitHub-Mark-64px.png differ
diff --git a/img/admin/billing-admins.png b/img/admin/billing-admins.png
new file mode 100644
index 0000000000..795addb7ed
Binary files /dev/null and b/img/admin/billing-admins.png differ
diff --git a/img/admin/cp-edge-upgrade-channel.png b/img/admin/cp-edge-upgrade-channel.png
new file mode 100644
index 0000000000..a5c1cadc77
Binary files /dev/null and b/img/admin/cp-edge-upgrade-channel.png differ
diff --git a/img/admin/cp-edge-upgrade-deployed.png b/img/admin/cp-edge-upgrade-deployed.png
new file mode 100644
index 0000000000..54515e8d47
Binary files /dev/null and b/img/admin/cp-edge-upgrade-deployed.png differ
diff --git a/img/admin/cp-edge-upgrade-deploying.png b/img/admin/cp-edge-upgrade-deploying.png
new file mode 100644
index 0000000000..ea4f869fa7
Binary files /dev/null and b/img/admin/cp-edge-upgrade-deploying.png differ
diff --git a/img/admin/cp-edge-upgrade-version.png b/img/admin/cp-edge-upgrade-version.png
new file mode 100644
index 0000000000..fa45e66cbc
Binary files /dev/null and b/img/admin/cp-edge-upgrade-version.png differ
diff --git a/img/admin/cp-edit.png b/img/admin/cp-edit.png
new file mode 100644
index 0000000000..87df7793cd
Binary files /dev/null and b/img/admin/cp-edit.png differ
diff --git a/img/admin/invite-billing-admin.png b/img/admin/invite-billing-admin.png
new file mode 100644
index 0000000000..bcbb06f133
Binary files /dev/null and b/img/admin/invite-billing-admin.png differ
diff --git a/img/admin/org_admin_environments.png b/img/admin/org_admin_environments.png
new file mode 100644
index 0000000000..ef6f13ac12
Binary files /dev/null and b/img/admin/org_admin_environments.png differ
diff --git a/img/admin/tyk-cloud-account-billing-menu.png b/img/admin/tyk-cloud-account-billing-menu.png
new file mode 100644
index 0000000000..b003d695b6
Binary files /dev/null and b/img/admin/tyk-cloud-account-billing-menu.png differ
diff --git a/img/admin/tyk-cloud-edit-env.png b/img/admin/tyk-cloud-edit-env.png
new file mode 100644
index 0000000000..697da756f9
Binary files /dev/null and b/img/admin/tyk-cloud-edit-env.png differ
diff --git a/img/admin/tyk-cloud-env-screen.png b/img/admin/tyk-cloud-env-screen.png
new file mode 100644
index 0000000000..878e02fab0
Binary files /dev/null and b/img/admin/tyk-cloud-env-screen.png differ
diff --git a/img/admin/tyk-cloud-org-deployments.png b/img/admin/tyk-cloud-org-deployments.png
new file mode 100644
index 0000000000..6455e5bf57
Binary files /dev/null and b/img/admin/tyk-cloud-org-deployments.png differ
diff --git a/img/admin/tyk-cloud-org-overview.png b/img/admin/tyk-cloud-org-overview.png
new file mode 100644
index 0000000000..60f281f78d
Binary files /dev/null and b/img/admin/tyk-cloud-org-overview.png differ
diff --git a/img/admin/tyk-cloud-org-teams.png b/img/admin/tyk-cloud-org-teams.png
new file mode 100644
index 0000000000..dd8204831b
Binary files /dev/null and b/img/admin/tyk-cloud-org-teams.png differ
diff --git a/img/admin/tyk-cloud-rename-delete.png b/img/admin/tyk-cloud-rename-delete.png
new file mode 100644
index 0000000000..8db3dbcbe1
Binary files /dev/null and b/img/admin/tyk-cloud-rename-delete.png differ
diff --git a/img/ai-management/MCP Handshake.png b/img/ai-management/MCP Handshake.png
new file mode 100644
index 0000000000..9c12113845
Binary files /dev/null and b/img/ai-management/MCP Handshake.png differ
diff --git a/img/ai-management/activity-by-mcp.png b/img/ai-management/activity-by-mcp.png
new file mode 100644
index 0000000000..3690f5f2ad
Binary files /dev/null and b/img/ai-management/activity-by-mcp.png differ
diff --git a/img/ai-management/activity-per-mcp.png b/img/ai-management/activity-per-mcp.png
new file mode 100644
index 0000000000..b5921e608c
Binary files /dev/null and b/img/ai-management/activity-per-mcp.png differ
diff --git a/img/ai-management/add-mcp-proxy.png b/img/ai-management/add-mcp-proxy.png
new file mode 100644
index 0000000000..b3d69c20f0
Binary files /dev/null and b/img/ai-management/add-mcp-proxy.png differ
diff --git a/img/ai-management/ai-admin-data-source-catalog.png b/img/ai-management/ai-admin-data-source-catalog.png
new file mode 100644
index 0000000000..1da3b36051
Binary files /dev/null and b/img/ai-management/ai-admin-data-source-catalog.png differ
diff --git a/img/ai-management/ai-admin-llm-catalog.png b/img/ai-management/ai-admin-llm-catalog.png
new file mode 100644
index 0000000000..39f1d3fed5
Binary files /dev/null and b/img/ai-management/ai-admin-llm-catalog.png differ
diff --git a/img/ai-management/ai-admin-team.png b/img/ai-management/ai-admin-team.png
new file mode 100644
index 0000000000..cf8ad9f66e
Binary files /dev/null and b/img/ai-management/ai-admin-team.png differ
diff --git a/img/ai-management/ai-admin-tool-catalog.png b/img/ai-management/ai-admin-tool-catalog.png
new file mode 100644
index 0000000000..8c19797d92
Binary files /dev/null and b/img/ai-management/ai-admin-tool-catalog.png differ
diff --git a/img/ai-management/ai-admin-user.png b/img/ai-management/ai-admin-user.png
new file mode 100644
index 0000000000..da63a32978
Binary files /dev/null and b/img/ai-management/ai-admin-user.png differ
diff --git a/img/ai-management/ai-portal-app-llm-access.png b/img/ai-management/ai-portal-app-llm-access.png
new file mode 100644
index 0000000000..3e4a871a4f
Binary files /dev/null and b/img/ai-management/ai-portal-app-llm-access.png differ
diff --git a/img/ai-management/ai-portal-app-secret.png b/img/ai-management/ai-portal-app-secret.png
new file mode 100644
index 0000000000..a03d7579f3
Binary files /dev/null and b/img/ai-management/ai-portal-app-secret.png differ
diff --git a/img/ai-management/ai-portal-configuration.png b/img/ai-management/ai-portal-configuration.png
new file mode 100644
index 0000000000..c92c0203f3
Binary files /dev/null and b/img/ai-management/ai-portal-configuration.png differ
diff --git a/img/ai-management/ai-portal-create-app.png b/img/ai-management/ai-portal-create-app.png
new file mode 100644
index 0000000000..03f6052714
Binary files /dev/null and b/img/ai-management/ai-portal-create-app.png differ
diff --git a/img/ai-management/ai-portal-dashboard.png b/img/ai-management/ai-portal-dashboard.png
new file mode 100644
index 0000000000..813b536a9e
Binary files /dev/null and b/img/ai-management/ai-portal-dashboard.png differ
diff --git a/img/ai-management/ai-portal-llm-call-setting.png b/img/ai-management/ai-portal-llm-call-setting.png
new file mode 100644
index 0000000000..b2268baa7b
Binary files /dev/null and b/img/ai-management/ai-portal-llm-call-setting.png differ
diff --git a/img/ai-management/analytics-dashboard.png b/img/ai-management/analytics-dashboard.png
new file mode 100644
index 0000000000..620b4eac80
Binary files /dev/null and b/img/ai-management/analytics-dashboard.png differ
diff --git a/img/ai-management/budget-config-ui.png b/img/ai-management/budget-config-ui.png
new file mode 100644
index 0000000000..f7dc7abe7b
Binary files /dev/null and b/img/ai-management/budget-config-ui.png differ
diff --git a/img/ai-management/chat-experience-config.png b/img/ai-management/chat-experience-config.png
new file mode 100644
index 0000000000..2dd6a998ae
Binary files /dev/null and b/img/ai-management/chat-experience-config.png differ
diff --git a/img/ai-management/chat-interface-ui.png b/img/ai-management/chat-interface-ui.png
new file mode 100644
index 0000000000..1609ef7fef
Binary files /dev/null and b/img/ai-management/chat-interface-ui.png differ
diff --git a/img/ai-management/client-credentials-flow.png b/img/ai-management/client-credentials-flow.png
new file mode 100644
index 0000000000..2d32685654
Binary files /dev/null and b/img/ai-management/client-credentials-flow.png differ
diff --git a/img/ai-management/create-mcp-proxy-stage-2.png b/img/ai-management/create-mcp-proxy-stage-2.png
new file mode 100644
index 0000000000..08e059df2a
Binary files /dev/null and b/img/ai-management/create-mcp-proxy-stage-2.png differ
diff --git a/img/ai-management/create-mcp-stage-1.png b/img/ai-management/create-mcp-stage-1.png
new file mode 100644
index 0000000000..a4f6bfa05c
Binary files /dev/null and b/img/ai-management/create-mcp-stage-1.png differ
diff --git a/img/ai-management/data-sources-catalog-config.png b/img/ai-management/data-sources-catalog-config.png
new file mode 100644
index 0000000000..721d165e2b
Binary files /dev/null and b/img/ai-management/data-sources-catalog-config.png differ
diff --git a/img/ai-management/data-sources-config.png b/img/ai-management/data-sources-config.png
new file mode 100644
index 0000000000..0452e3219a
Binary files /dev/null and b/img/ai-management/data-sources-config.png differ
diff --git a/img/ai-management/error-status-code-by-primitive.png b/img/ai-management/error-status-code-by-primitive.png
new file mode 100644
index 0000000000..a4f463b650
Binary files /dev/null and b/img/ai-management/error-status-code-by-primitive.png differ
diff --git a/img/ai-management/errors-per-mcp.png b/img/ai-management/errors-per-mcp.png
new file mode 100644
index 0000000000..d892a3c358
Binary files /dev/null and b/img/ai-management/errors-per-mcp.png differ
diff --git a/img/ai-management/filters.png b/img/ai-management/filters.png
new file mode 100644
index 0000000000..8d77ae995b
Binary files /dev/null and b/img/ai-management/filters.png differ
diff --git a/img/ai-management/grafana-dashboard-settings.png b/img/ai-management/grafana-dashboard-settings.png
new file mode 100644
index 0000000000..d9cfafa9d9
Binary files /dev/null and b/img/ai-management/grafana-dashboard-settings.png differ
diff --git a/img/ai-management/grafana-data-source-variable.png b/img/ai-management/grafana-data-source-variable.png
new file mode 100644
index 0000000000..f8e8ca8cbf
Binary files /dev/null and b/img/ai-management/grafana-data-source-variable.png differ
diff --git a/img/ai-management/grafana-new-dashboard.png b/img/ai-management/grafana-new-dashboard.png
new file mode 100644
index 0000000000..2367e8516e
Binary files /dev/null and b/img/ai-management/grafana-new-dashboard.png differ
diff --git a/img/ai-management/grafana.png b/img/ai-management/grafana.png
new file mode 100644
index 0000000000..255f9e80be
Binary files /dev/null and b/img/ai-management/grafana.png differ
diff --git a/img/ai-management/group-management-ui.png b/img/ai-management/group-management-ui.png
new file mode 100644
index 0000000000..e420f9ac0f
Binary files /dev/null and b/img/ai-management/group-management-ui.png differ
diff --git a/img/ai-management/initial-configuration-llm-config-ui.png b/img/ai-management/initial-configuration-llm-config-ui.png
new file mode 100644
index 0000000000..70bc0fab6a
Binary files /dev/null and b/img/ai-management/initial-configuration-llm-config-ui.png differ
diff --git a/img/ai-management/llm-budget-config.png b/img/ai-management/llm-budget-config.png
new file mode 100644
index 0000000000..af0e1c0a15
Binary files /dev/null and b/img/ai-management/llm-budget-config.png differ
diff --git a/img/ai-management/llm-model-price-config.png b/img/ai-management/llm-model-price-config.png
new file mode 100644
index 0000000000..a99bb18599
Binary files /dev/null and b/img/ai-management/llm-model-price-config.png differ
diff --git a/img/ai-management/llm-provider-config.png b/img/ai-management/llm-provider-config.png
new file mode 100644
index 0000000000..c659bbffae
Binary files /dev/null and b/img/ai-management/llm-provider-config.png differ
diff --git a/img/ai-management/login-screen.png b/img/ai-management/login-screen.png
new file mode 100644
index 0000000000..876efbb722
Binary files /dev/null and b/img/ai-management/login-screen.png differ
diff --git a/img/ai-management/mcp-create-mcp.png b/img/ai-management/mcp-create-mcp.png
new file mode 100644
index 0000000000..faa4a61b20
Binary files /dev/null and b/img/ai-management/mcp-create-mcp.png differ
diff --git a/img/ai-management/mcp-designer-tabs.png b/img/ai-management/mcp-designer-tabs.png
new file mode 100644
index 0000000000..3ddd8878a3
Binary files /dev/null and b/img/ai-management/mcp-designer-tabs.png differ
diff --git a/img/ai-management/mcp-designer.png b/img/ai-management/mcp-designer.png
new file mode 100644
index 0000000000..cd1d3e9709
Binary files /dev/null and b/img/ai-management/mcp-designer.png differ
diff --git a/img/ai-management/mcp-gateway-header.png b/img/ai-management/mcp-gateway-header.png
new file mode 100644
index 0000000000..59e3e9e0a0
Binary files /dev/null and b/img/ai-management/mcp-gateway-header.png differ
diff --git a/img/ai-management/mcp-handshake.png b/img/ai-management/mcp-handshake.png
new file mode 100644
index 0000000000..9c12113845
Binary files /dev/null and b/img/ai-management/mcp-handshake.png differ
diff --git a/img/ai-management/mcp-hot-too-block-add-primitive.png b/img/ai-management/mcp-hot-too-block-add-primitive.png
new file mode 100644
index 0000000000..d67376f2f5
Binary files /dev/null and b/img/ai-management/mcp-hot-too-block-add-primitive.png differ
diff --git a/img/ai-management/mcp-how-to-block-primitive-middleware.png b/img/ai-management/mcp-how-to-block-primitive-middleware.png
new file mode 100644
index 0000000000..930283630c
Binary files /dev/null and b/img/ai-management/mcp-how-to-block-primitive-middleware.png differ
diff --git a/img/ai-management/mcp-how-to-circuit-breaker-config.png b/img/ai-management/mcp-how-to-circuit-breaker-config.png
new file mode 100644
index 0000000000..0500929054
Binary files /dev/null and b/img/ai-management/mcp-how-to-circuit-breaker-config.png differ
diff --git a/img/ai-management/mcp-how-to-circuitbreaker-primitives.png b/img/ai-management/mcp-how-to-circuitbreaker-primitives.png
new file mode 100644
index 0000000000..93a12684e7
Binary files /dev/null and b/img/ai-management/mcp-how-to-circuitbreaker-primitives.png differ
diff --git a/img/ai-management/mcp-how-to-limited-agent.png b/img/ai-management/mcp-how-to-limited-agent.png
new file mode 100644
index 0000000000..41c618656d
Binary files /dev/null and b/img/ai-management/mcp-how-to-limited-agent.png differ
diff --git a/img/ai-management/mcp-how-to-rate-limit-tool.png b/img/ai-management/mcp-how-to-rate-limit-tool.png
new file mode 100644
index 0000000000..d6ae54d936
Binary files /dev/null and b/img/ai-management/mcp-how-to-rate-limit-tool.png differ
diff --git a/img/ai-management/mcp-how-to-rbac-keys.png b/img/ai-management/mcp-how-to-rbac-keys.png
new file mode 100644
index 0000000000..6ea7c9d02e
Binary files /dev/null and b/img/ai-management/mcp-how-to-rbac-keys.png differ
diff --git a/img/ai-management/mcp-how-to-rbac-primitive.png b/img/ai-management/mcp-how-to-rbac-primitive.png
new file mode 100644
index 0000000000..55671c22a8
Binary files /dev/null and b/img/ai-management/mcp-how-to-rbac-primitive.png differ
diff --git a/img/ai-management/mcp-how-to-rbac-reader.png b/img/ai-management/mcp-how-to-rbac-reader.png
new file mode 100644
index 0000000000..62a2bad8eb
Binary files /dev/null and b/img/ai-management/mcp-how-to-rbac-reader.png differ
diff --git a/img/ai-management/mcp-how-to-rbac-set-alias.png b/img/ai-management/mcp-how-to-rbac-set-alias.png
new file mode 100644
index 0000000000..9058f1f738
Binary files /dev/null and b/img/ai-management/mcp-how-to-rbac-set-alias.png differ
diff --git a/img/ai-management/mcp-how-to-secure-add-header.png b/img/ai-management/mcp-how-to-secure-add-header.png
new file mode 100644
index 0000000000..0f1a1bbfac
Binary files /dev/null and b/img/ai-management/mcp-how-to-secure-add-header.png differ
diff --git a/img/ai-management/mcp-how-to-secure-add-key.png b/img/ai-management/mcp-how-to-secure-add-key.png
new file mode 100644
index 0000000000..b20c66c9d5
Binary files /dev/null and b/img/ai-management/mcp-how-to-secure-add-key.png differ
diff --git a/img/ai-management/mcp-how-to-secure-mcp-inspector.png b/img/ai-management/mcp-how-to-secure-mcp-inspector.png
new file mode 100644
index 0000000000..80e818525f
Binary files /dev/null and b/img/ai-management/mcp-how-to-secure-mcp-inspector.png differ
diff --git a/img/ai-management/mcp-how-to-timeout.png b/img/ai-management/mcp-how-to-timeout.png
new file mode 100644
index 0000000000..56c28e9365
Binary files /dev/null and b/img/ai-management/mcp-how-to-timeout.png differ
diff --git a/img/ai-management/mcp-listen-path.png b/img/ai-management/mcp-listen-path.png
new file mode 100644
index 0000000000..e84e16b55e
Binary files /dev/null and b/img/ai-management/mcp-listen-path.png differ
diff --git a/img/ai-management/mcp-permission.png b/img/ai-management/mcp-permission.png
new file mode 100644
index 0000000000..97ca94b4c3
Binary files /dev/null and b/img/ai-management/mcp-permission.png differ
diff --git a/img/ai-management/mcp-policy-list.png b/img/ai-management/mcp-policy-list.png
new file mode 100644
index 0000000000..cc0af61a2f
Binary files /dev/null and b/img/ai-management/mcp-policy-list.png differ
diff --git a/img/ai-management/mcp-proxy-deploy-gateway.png b/img/ai-management/mcp-proxy-deploy-gateway.png
new file mode 100644
index 0000000000..8d48eb3eaf
Binary files /dev/null and b/img/ai-management/mcp-proxy-deploy-gateway.png differ
diff --git a/img/ai-management/mcp-proxy-list.png b/img/ai-management/mcp-proxy-list.png
new file mode 100644
index 0000000000..8552bb715e
Binary files /dev/null and b/img/ai-management/mcp-proxy-list.png differ
diff --git a/img/ai-management/mcp-proxy-name-description.png b/img/ai-management/mcp-proxy-name-description.png
new file mode 100644
index 0000000000..1dc671996e
Binary files /dev/null and b/img/ai-management/mcp-proxy-name-description.png differ
diff --git a/img/ai-management/mcp-proxy-server-url.png b/img/ai-management/mcp-proxy-server-url.png
new file mode 100644
index 0000000000..2505498b2f
Binary files /dev/null and b/img/ai-management/mcp-proxy-server-url.png differ
diff --git a/img/ai-management/mcp-quickstart-deploy-gateways.png b/img/ai-management/mcp-quickstart-deploy-gateways.png
new file mode 100644
index 0000000000..4879b9a7dc
Binary files /dev/null and b/img/ai-management/mcp-quickstart-deploy-gateways.png differ
diff --git a/img/ai-management/mcp-quickstart-mcp-inspector-connect.png b/img/ai-management/mcp-quickstart-mcp-inspector-connect.png
new file mode 100644
index 0000000000..65b8a7afe1
Binary files /dev/null and b/img/ai-management/mcp-quickstart-mcp-inspector-connect.png differ
diff --git a/img/ai-management/mcp-quickstart-name-server.png b/img/ai-management/mcp-quickstart-name-server.png
new file mode 100644
index 0000000000..a1e4fcf7d1
Binary files /dev/null and b/img/ai-management/mcp-quickstart-name-server.png differ
diff --git a/img/ai-management/mcp-quickstart-proxy-url.png b/img/ai-management/mcp-quickstart-proxy-url.png
new file mode 100644
index 0000000000..df073ad3d9
Binary files /dev/null and b/img/ai-management/mcp-quickstart-proxy-url.png differ
diff --git a/img/ai-management/mcp-quickstart-server-url.png b/img/ai-management/mcp-quickstart-server-url.png
new file mode 100644
index 0000000000..ca165fb49b
Binary files /dev/null and b/img/ai-management/mcp-quickstart-server-url.png differ
diff --git a/img/ai-management/most-failing-primitive.png b/img/ai-management/most-failing-primitive.png
new file mode 100644
index 0000000000..d24804ba4f
Binary files /dev/null and b/img/ai-management/most-failing-primitive.png differ
diff --git a/img/ai-management/most-used-primitive.png b/img/ai-management/most-used-primitive.png
new file mode 100644
index 0000000000..55a0ed039d
Binary files /dev/null and b/img/ai-management/most-used-primitive.png differ
diff --git a/img/ai-management/notification-preferences.png b/img/ai-management/notification-preferences.png
new file mode 100644
index 0000000000..29f6367fe4
Binary files /dev/null and b/img/ai-management/notification-preferences.png differ
diff --git a/img/ai-management/oauth21-discovery-flow.png b/img/ai-management/oauth21-discovery-flow.png
new file mode 100644
index 0000000000..daa1ce3a9a
Binary files /dev/null and b/img/ai-management/oauth21-discovery-flow.png differ
diff --git a/img/ai-management/secrets-management-ui.png b/img/ai-management/secrets-management-ui.png
new file mode 100644
index 0000000000..5fce75c70c
Binary files /dev/null and b/img/ai-management/secrets-management-ui.png differ
diff --git a/img/ai-management/slowest-primitive.png b/img/ai-management/slowest-primitive.png
new file mode 100644
index 0000000000..5ead5c2941
Binary files /dev/null and b/img/ai-management/slowest-primitive.png differ
diff --git a/img/ai-management/sso-config-ui.png b/img/ai-management/sso-config-ui.png
new file mode 100644
index 0000000000..b6c82ec3c9
Binary files /dev/null and b/img/ai-management/sso-config-ui.png differ
diff --git a/img/ai-management/tool-catalog-config.png b/img/ai-management/tool-catalog-config.png
new file mode 100644
index 0000000000..71483ac006
Binary files /dev/null and b/img/ai-management/tool-catalog-config.png differ
diff --git a/img/ai-management/tool-configuration.png b/img/ai-management/tool-configuration.png
new file mode 100644
index 0000000000..46d1aea6cd
Binary files /dev/null and b/img/ai-management/tool-configuration.png differ
diff --git a/img/ai-management/tyk-how-to-rbac-select-api.png b/img/ai-management/tyk-how-to-rbac-select-api.png
new file mode 100644
index 0000000000..5635840088
Binary files /dev/null and b/img/ai-management/tyk-how-to-rbac-select-api.png differ
diff --git a/img/ai-management/tyk-mcp-diagram.png b/img/ai-management/tyk-mcp-diagram.png
new file mode 100644
index 0000000000..062a05c385
Binary files /dev/null and b/img/ai-management/tyk-mcp-diagram.png differ
diff --git a/img/ai-management/tyk-mcp-session-lifecycle.png b/img/ai-management/tyk-mcp-session-lifecycle.png
new file mode 100644
index 0000000000..062a05c385
Binary files /dev/null and b/img/ai-management/tyk-mcp-session-lifecycle.png differ
diff --git a/img/ai-management/user-management-ui.png b/img/ai-management/user-management-ui.png
new file mode 100644
index 0000000000..997bac1fca
Binary files /dev/null and b/img/ai-management/user-management-ui.png differ
diff --git a/img/ai-management/view-mcp-proxy-definition.png b/img/ai-management/view-mcp-proxy-definition.png
new file mode 100644
index 0000000000..157ad78fc0
Binary files /dev/null and b/img/ai-management/view-mcp-proxy-definition.png differ
diff --git a/img/ai-management/where tyk mcp gateway fits.png b/img/ai-management/where tyk mcp gateway fits.png
new file mode 100644
index 0000000000..2cef9a21ba
Binary files /dev/null and b/img/ai-management/where tyk mcp gateway fits.png differ
diff --git a/img/ai-management/where-tyk-mcp-gateway-fits.png b/img/ai-management/where-tyk-mcp-gateway-fits.png
new file mode 100644
index 0000000000..2cef9a21ba
Binary files /dev/null and b/img/ai-management/where-tyk-mcp-gateway-fits.png differ
diff --git a/img/ai-mcp/ask-dashboard-howto-create-apis-screenshot.png b/img/ai-mcp/ask-dashboard-howto-create-apis-screenshot.png
new file mode 100644
index 0000000000..931e38cc21
Binary files /dev/null and b/img/ai-mcp/ask-dashboard-howto-create-apis-screenshot.png differ
diff --git a/img/ai-mcp/ask-dashboard-to-create-user-screenshot.png b/img/ai-mcp/ask-dashboard-to-create-user-screenshot.png
new file mode 100644
index 0000000000..9dec847468
Binary files /dev/null and b/img/ai-mcp/ask-dashboard-to-create-user-screenshot.png differ
diff --git a/img/ai-mcp/tyk-docs-mcp-q1-screenshot.png b/img/ai-mcp/tyk-docs-mcp-q1-screenshot.png
new file mode 100644
index 0000000000..699a96d37e
Binary files /dev/null and b/img/ai-mcp/tyk-docs-mcp-q1-screenshot.png differ
diff --git a/img/ai-mcp/tyk-docs-mcp-q2-screenshot.png b/img/ai-mcp/tyk-docs-mcp-q2-screenshot.png
new file mode 100644
index 0000000000..ace88e7ae5
Binary files /dev/null and b/img/ai-mcp/tyk-docs-mcp-q2-screenshot.png differ
diff --git a/img/ansible.png b/img/ansible.png
new file mode 100644
index 0000000000..5ef43aad90
Binary files /dev/null and b/img/ansible.png differ
diff --git a/img/api-management/security/auth-token-method.png b/img/api-management/security/auth-token-method.png
new file mode 100644
index 0000000000..451ffaf5ab
Binary files /dev/null and b/img/api-management/security/auth-token-method.png differ
diff --git a/img/api-management/security/auth-token-mtls-add-key.png b/img/api-management/security/auth-token-mtls-add-key.png
new file mode 100644
index 0000000000..69dce56a10
Binary files /dev/null and b/img/api-management/security/auth-token-mtls-add-key.png differ
diff --git a/img/api-management/security/auth-token-mtls-bind-cert1.png b/img/api-management/security/auth-token-mtls-bind-cert1.png
new file mode 100644
index 0000000000..095d856325
Binary files /dev/null and b/img/api-management/security/auth-token-mtls-bind-cert1.png differ
diff --git a/img/api-management/security/auth-token-mtls-bind-cert2.png b/img/api-management/security/auth-token-mtls-bind-cert2.png
new file mode 100644
index 0000000000..e5ba732320
Binary files /dev/null and b/img/api-management/security/auth-token-mtls-bind-cert2.png differ
diff --git a/img/api-management/security/auth-token-mtls-bind-cert3.png b/img/api-management/security/auth-token-mtls-bind-cert3.png
new file mode 100644
index 0000000000..0d02c15735
Binary files /dev/null and b/img/api-management/security/auth-token-mtls-bind-cert3.png differ
diff --git a/img/api-management/security/auth-token-mtls-update-key.png b/img/api-management/security/auth-token-mtls-update-key.png
new file mode 100644
index 0000000000..99b9a968db
Binary files /dev/null and b/img/api-management/security/auth-token-mtls-update-key.png differ
diff --git a/img/api-management/security/basic-auth-api-setup.png b/img/api-management/security/basic-auth-api-setup.png
new file mode 100644
index 0000000000..26d1ccf9c7
Binary files /dev/null and b/img/api-management/security/basic-auth-api-setup.png differ
diff --git a/img/api-management/security/client-mtls-api-setup.png b/img/api-management/security/client-mtls-api-setup.png
new file mode 100644
index 0000000000..7a6295ba18
Binary files /dev/null and b/img/api-management/security/client-mtls-api-setup.png differ
diff --git a/img/api-management/security/client-secret-oauth.png b/img/api-management/security/client-secret-oauth.png
new file mode 100644
index 0000000000..736644f8d5
Binary files /dev/null and b/img/api-management/security/client-secret-oauth.png differ
diff --git a/img/api-management/security/create-oauth-from-api-list.png b/img/api-management/security/create-oauth-from-api-list.png
new file mode 100644
index 0000000000..cac0bcd09a
Binary files /dev/null and b/img/api-management/security/create-oauth-from-api-list.png differ
diff --git a/img/api-management/security/fill-out-client-details-oauth.png b/img/api-management/security/fill-out-client-details-oauth.png
new file mode 100644
index 0000000000..f0ebf68e68
Binary files /dev/null and b/img/api-management/security/fill-out-client-details-oauth.png differ
diff --git a/img/api-management/security/graphql-query-data.jpeg b/img/api-management/security/graphql-query-data.jpeg
new file mode 100644
index 0000000000..e144ec61b0
Binary files /dev/null and b/img/api-management/security/graphql-query-data.jpeg differ
diff --git a/img/api-management/security/multiple-auth-compliant.png b/img/api-management/security/multiple-auth-compliant.png
new file mode 100644
index 0000000000..f9d41c454c
Binary files /dev/null and b/img/api-management/security/multiple-auth-compliant.png differ
diff --git a/img/api-management/security/multiple-auth-configure_compliant.png b/img/api-management/security/multiple-auth-configure_compliant.png
new file mode 100644
index 0000000000..e927c3689d
Binary files /dev/null and b/img/api-management/security/multiple-auth-configure_compliant.png differ
diff --git a/img/api-management/security/multiple-auth-configure_legacy.png b/img/api-management/security/multiple-auth-configure_legacy.png
new file mode 100644
index 0000000000..115e892105
Binary files /dev/null and b/img/api-management/security/multiple-auth-configure_legacy.png differ
diff --git a/img/api-management/security/multiple-auth-legacy.png b/img/api-management/security/multiple-auth-legacy.png
new file mode 100644
index 0000000000..0acb69c54e
Binary files /dev/null and b/img/api-management/security/multiple-auth-legacy.png differ
diff --git a/img/api-management/security/rest-api-read-data.jpeg b/img/api-management/security/rest-api-read-data.jpeg
new file mode 100644
index 0000000000..76a62f127c
Binary files /dev/null and b/img/api-management/security/rest-api-read-data.jpeg differ
diff --git a/img/api-management/security/rest-api-write-data.jpeg b/img/api-management/security/rest-api-write-data.jpeg
new file mode 100644
index 0000000000..2dcf6ab303
Binary files /dev/null and b/img/api-management/security/rest-api-write-data.jpeg differ
diff --git a/img/arrows.png b/img/arrows.png
new file mode 100644
index 0000000000..e9e03ba8de
Binary files /dev/null and b/img/arrows.png differ
diff --git a/img/auth0/api-details.png b/img/auth0/api-details.png
new file mode 100644
index 0000000000..ee94e45fb3
Binary files /dev/null and b/img/auth0/api-details.png differ
diff --git a/img/aws.png b/img/aws.png
new file mode 100644
index 0000000000..962999d0ab
Binary files /dev/null and b/img/aws.png differ
diff --git a/img/azure-2.png b/img/azure-2.png
new file mode 100644
index 0000000000..4861dd14e6
Binary files /dev/null and b/img/azure-2.png differ
diff --git a/img/azureAD/additional-options.png b/img/azureAD/additional-options.png
new file mode 100644
index 0000000000..0385a02ed0
Binary files /dev/null and b/img/azureAD/additional-options.png differ
diff --git a/img/azureAD/dashboard.png b/img/azureAD/dashboard.png
new file mode 100644
index 0000000000..caa0608f54
Binary files /dev/null and b/img/azureAD/dashboard.png differ
diff --git a/img/azureAD/endpoints-11.png b/img/azureAD/endpoints-11.png
new file mode 100644
index 0000000000..d6582c2522
Binary files /dev/null and b/img/azureAD/endpoints-11.png differ
diff --git a/img/azureAD/openid_connect/access_redirect_urls.png b/img/azureAD/openid_connect/access_redirect_urls.png
new file mode 100644
index 0000000000..0fb6a895d5
Binary files /dev/null and b/img/azureAD/openid_connect/access_redirect_urls.png differ
diff --git a/img/azureAD/openid_connect/additional_redirect_url.png b/img/azureAD/openid_connect/additional_redirect_url.png
new file mode 100644
index 0000000000..12692cff1c
Binary files /dev/null and b/img/azureAD/openid_connect/additional_redirect_url.png differ
diff --git a/img/azureAD/openid_connect/client_id_client_secret.png b/img/azureAD/openid_connect/client_id_client_secret.png
new file mode 100644
index 0000000000..48ac1053b5
Binary files /dev/null and b/img/azureAD/openid_connect/client_id_client_secret.png differ
diff --git a/img/azureAD/openid_connect/custom_dropdown.png b/img/azureAD/openid_connect/custom_dropdown.png
new file mode 100644
index 0000000000..0725fc7d30
Binary files /dev/null and b/img/azureAD/openid_connect/custom_dropdown.png differ
diff --git a/img/azureAD/openid_connect/discovery_document.png b/img/azureAD/openid_connect/discovery_document.png
new file mode 100644
index 0000000000..af697d7313
Binary files /dev/null and b/img/azureAD/openid_connect/discovery_document.png differ
diff --git a/img/azureAD/openid_connect/edit_button.png b/img/azureAD/openid_connect/edit_button.png
new file mode 100644
index 0000000000..83e686c2d4
Binary files /dev/null and b/img/azureAD/openid_connect/edit_button.png differ
diff --git a/img/azureAD/openid_connect/step-2.png b/img/azureAD/openid_connect/step-2.png
new file mode 100644
index 0000000000..f8d09de172
Binary files /dev/null and b/img/azureAD/openid_connect/step-2.png differ
diff --git a/img/azureAD/openid_connect/step-3.png b/img/azureAD/openid_connect/step-3.png
new file mode 100644
index 0000000000..7e8f8053f8
Binary files /dev/null and b/img/azureAD/openid_connect/step-3.png differ
diff --git a/img/azureAD/openid_connect/step-4.png b/img/azureAD/openid_connect/step-4.png
new file mode 100644
index 0000000000..c6fd1a2d80
Binary files /dev/null and b/img/azureAD/openid_connect/step-4.png differ
diff --git a/img/azureAD/openid_connect/step-5.png b/img/azureAD/openid_connect/step-5.png
new file mode 100644
index 0000000000..f0db8c228b
Binary files /dev/null and b/img/azureAD/openid_connect/step-5.png differ
diff --git a/img/azureAD/openid_connect/step-6.png b/img/azureAD/openid_connect/step-6.png
new file mode 100644
index 0000000000..9b486d697a
Binary files /dev/null and b/img/azureAD/openid_connect/step-6.png differ
diff --git a/img/azureAD/overview-1.png b/img/azureAD/overview-1.png
new file mode 100644
index 0000000000..b28074d59a
Binary files /dev/null and b/img/azureAD/overview-1.png differ
diff --git a/img/azureAD/password.png b/img/azureAD/password.png
new file mode 100644
index 0000000000..3884e17674
Binary files /dev/null and b/img/azureAD/password.png differ
diff --git a/img/azureAD/profile-configuration-1.png b/img/azureAD/profile-configuration-1.png
new file mode 100644
index 0000000000..cab02f0692
Binary files /dev/null and b/img/azureAD/profile-configuration-1.png differ
diff --git a/img/azureAD/raw-editor.png b/img/azureAD/raw-editor.png
new file mode 100644
index 0000000000..65623bdbe6
Binary files /dev/null and b/img/azureAD/raw-editor.png differ
diff --git a/img/azureAD/redirect-URL-1.png b/img/azureAD/redirect-URL-1.png
new file mode 100644
index 0000000000..eeaa9e60d4
Binary files /dev/null and b/img/azureAD/redirect-URL-1.png differ
diff --git a/img/azureAD/username.png b/img/azureAD/username.png
new file mode 100644
index 0000000000..ae65b4d56f
Binary files /dev/null and b/img/azureAD/username.png differ
diff --git a/img/bugs/bug-persistent-gql.png b/img/bugs/bug-persistent-gql.png
new file mode 100644
index 0000000000..1e994d62a2
Binary files /dev/null and b/img/bugs/bug-persistent-gql.png differ
diff --git a/img/cloud/Onboarding_Diagram_2-1_Ara.png b/img/cloud/Onboarding_Diagram_2-1_Ara.png
new file mode 100644
index 0000000000..fe753b8e9d
Binary files /dev/null and b/img/cloud/Onboarding_Diagram_2-1_Ara.png differ
diff --git a/img/cloud/cloud-sso-add-config-details.png b/img/cloud/cloud-sso-add-config-details.png
new file mode 100644
index 0000000000..cbc98d0d50
Binary files /dev/null and b/img/cloud/cloud-sso-add-config-details.png differ
diff --git a/img/cloud/cloud-sso-add-profile-form.png b/img/cloud/cloud-sso-add-profile-form.png
new file mode 100644
index 0000000000..6f193a81bd
Binary files /dev/null and b/img/cloud/cloud-sso-add-profile-form.png differ
diff --git a/img/cloud/cloud-sso-delete-click.png b/img/cloud/cloud-sso-delete-click.png
new file mode 100644
index 0000000000..314e6f1f2d
Binary files /dev/null and b/img/cloud/cloud-sso-delete-click.png differ
diff --git a/img/cloud/cloud-sso-delete-confirm.png b/img/cloud/cloud-sso-delete-confirm.png
new file mode 100644
index 0000000000..a68e5da1a5
Binary files /dev/null and b/img/cloud/cloud-sso-delete-confirm.png differ
diff --git a/img/cloud/cloud-sso-delete-select.png b/img/cloud/cloud-sso-delete-select.png
new file mode 100644
index 0000000000..254ff8a54b
Binary files /dev/null and b/img/cloud/cloud-sso-delete-select.png differ
diff --git a/img/cloud/cloud-sso-edit-select.png b/img/cloud/cloud-sso-edit-select.png
new file mode 100644
index 0000000000..254ff8a54b
Binary files /dev/null and b/img/cloud/cloud-sso-edit-select.png differ
diff --git a/img/cloud/cloud-sso-profile-list.png b/img/cloud/cloud-sso-profile-list.png
new file mode 100644
index 0000000000..69572913f3
Binary files /dev/null and b/img/cloud/cloud-sso-profile-list.png differ
diff --git a/img/cloud/cloud-sso-save-edit.png b/img/cloud/cloud-sso-save-edit.png
new file mode 100644
index 0000000000..6835ff41f8
Binary files /dev/null and b/img/cloud/cloud-sso-save-edit.png differ
diff --git a/img/cloud/edge_segment_tags.png b/img/cloud/edge_segment_tags.png
new file mode 100644
index 0000000000..e2a77ea00e
Binary files /dev/null and b/img/cloud/edge_segment_tags.png differ
diff --git a/img/cloud/hybrid-data-plane-added.png b/img/cloud/hybrid-data-plane-added.png
new file mode 100644
index 0000000000..c872784cd1
Binary files /dev/null and b/img/cloud/hybrid-data-plane-added.png differ
diff --git a/img/cloud/telemetry-custom.png b/img/cloud/telemetry-custom.png
new file mode 100644
index 0000000000..3c54ddcdc1
Binary files /dev/null and b/img/cloud/telemetry-custom.png differ
diff --git a/img/cloud/telemetry-datadog.png b/img/cloud/telemetry-datadog.png
new file mode 100644
index 0000000000..e7c9a7e79c
Binary files /dev/null and b/img/cloud/telemetry-datadog.png differ
diff --git a/img/cloud/telemetry-dynatrace.png b/img/cloud/telemetry-dynatrace.png
new file mode 100644
index 0000000000..f7887ce289
Binary files /dev/null and b/img/cloud/telemetry-dynatrace.png differ
diff --git a/img/cloud/telemetry-elastic.png b/img/cloud/telemetry-elastic.png
new file mode 100644
index 0000000000..0637bcb441
Binary files /dev/null and b/img/cloud/telemetry-elastic.png differ
diff --git a/img/cloud/telemetry-enable.png b/img/cloud/telemetry-enable.png
new file mode 100644
index 0000000000..893db75e78
Binary files /dev/null and b/img/cloud/telemetry-enable.png differ
diff --git a/img/cloud/telemetry-exports.png b/img/cloud/telemetry-exports.png
new file mode 100644
index 0000000000..a022567b71
Binary files /dev/null and b/img/cloud/telemetry-exports.png differ
diff --git a/img/cloud/telemetry-newrelic.png b/img/cloud/telemetry-newrelic.png
new file mode 100644
index 0000000000..9c94a41700
Binary files /dev/null and b/img/cloud/telemetry-newrelic.png differ
diff --git a/img/cloud/tyk-cloud-auto-upgrade.png b/img/cloud/tyk-cloud-auto-upgrade.png
new file mode 100644
index 0000000000..e6a4d0cabe
Binary files /dev/null and b/img/cloud/tyk-cloud-auto-upgrade.png differ
diff --git a/img/cloud/tyk-cloud-data-plane-enable-telemetry.png b/img/cloud/tyk-cloud-data-plane-enable-telemetry.png
new file mode 100644
index 0000000000..5c722be508
Binary files /dev/null and b/img/cloud/tyk-cloud-data-plane-enable-telemetry.png differ
diff --git a/img/cloud/tyk-cloud-monitoring-break-down.png b/img/cloud/tyk-cloud-monitoring-break-down.png
new file mode 100644
index 0000000000..4665ad98c1
Binary files /dev/null and b/img/cloud/tyk-cloud-monitoring-break-down.png differ
diff --git a/img/cloud/tyk-cloud-monitoring-filtering-by-date.png b/img/cloud/tyk-cloud-monitoring-filtering-by-date.png
new file mode 100644
index 0000000000..74069c4910
Binary files /dev/null and b/img/cloud/tyk-cloud-monitoring-filtering-by-date.png differ
diff --git a/img/cloud/tyk-cloud-monitoring-priced-traffic.png b/img/cloud/tyk-cloud-monitoring-priced-traffic.png
new file mode 100644
index 0000000000..5f41817228
Binary files /dev/null and b/img/cloud/tyk-cloud-monitoring-priced-traffic.png differ
diff --git a/img/cloud/tyk-cloud-monitoring-storage.png b/img/cloud/tyk-cloud-monitoring-storage.png
new file mode 100644
index 0000000000..752c820864
Binary files /dev/null and b/img/cloud/tyk-cloud-monitoring-storage.png differ
diff --git a/img/cloud/tyk-cloud-monitoring-throughput.png b/img/cloud/tyk-cloud-monitoring-throughput.png
new file mode 100644
index 0000000000..cc744bc01e
Binary files /dev/null and b/img/cloud/tyk-cloud-monitoring-throughput.png differ
diff --git a/img/custom-analytics-tags/log-browser.png b/img/custom-analytics-tags/log-browser.png
new file mode 100644
index 0000000000..a5355b8b8a
Binary files /dev/null and b/img/custom-analytics-tags/log-browser.png differ
diff --git a/img/custom-analytics-tags/tag-headers.png b/img/custom-analytics-tags/tag-headers.png
new file mode 100644
index 0000000000..de165327f6
Binary files /dev/null and b/img/custom-analytics-tags/tag-headers.png differ
diff --git a/img/dashboard/4.1-updates/create-api.png b/img/dashboard/4.1-updates/create-api.png
new file mode 100644
index 0000000000..416dda3c76
Binary files /dev/null and b/img/dashboard/4.1-updates/create-api.png differ
diff --git a/img/dashboard/analytics/classic_track_endpoint.png b/img/dashboard/analytics/classic_track_endpoint.png
new file mode 100644
index 0000000000..21f83b62b1
Binary files /dev/null and b/img/dashboard/analytics/classic_track_endpoint.png differ
diff --git a/img/dashboard/analytics/endpoint_popularity.png b/img/dashboard/analytics/endpoint_popularity.png
new file mode 100644
index 0000000000..1602144eb7
Binary files /dev/null and b/img/dashboard/analytics/endpoint_popularity.png differ
diff --git a/img/dashboard/analytics/owned_analytics.png b/img/dashboard/analytics/owned_analytics.png
new file mode 100644
index 0000000000..46d432ffb7
Binary files /dev/null and b/img/dashboard/analytics/owned_analytics.png differ
diff --git a/img/dashboard/api-assets/api-templates/api-templates-menu.png b/img/dashboard/api-assets/api-templates/api-templates-menu.png
new file mode 100644
index 0000000000..44ffc91e0a
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/api-templates-menu.png differ
diff --git a/img/dashboard/api-assets/api-templates/create-api-from-template.png b/img/dashboard/api-assets/api-templates/create-api-from-template.png
new file mode 100644
index 0000000000..8a64e91a07
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/create-api-from-template.png differ
diff --git a/img/dashboard/api-assets/api-templates/create-api-from-template2.png b/img/dashboard/api-assets/api-templates/create-api-from-template2.png
new file mode 100644
index 0000000000..585589cd08
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/create-api-from-template2.png differ
diff --git a/img/dashboard/api-assets/api-templates/create-api-template.png b/img/dashboard/api-assets/api-templates/create-api-template.png
new file mode 100644
index 0000000000..f196e0c977
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/create-api-template.png differ
diff --git a/img/dashboard/api-assets/api-templates/create-from-api.png b/img/dashboard/api-assets/api-templates/create-from-api.png
new file mode 100644
index 0000000000..124fcdeffb
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/create-from-api.png differ
diff --git a/img/dashboard/api-assets/api-templates/created-api.png b/img/dashboard/api-assets/api-templates/created-api.png
new file mode 100644
index 0000000000..875f719751
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/created-api.png differ
diff --git a/img/dashboard/api-assets/api-templates/delete-template.png b/img/dashboard/api-assets/api-templates/delete-template.png
new file mode 100644
index 0000000000..b60c71827e
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/delete-template.png differ
diff --git a/img/dashboard/api-assets/api-templates/edit-template.png b/img/dashboard/api-assets/api-templates/edit-template.png
new file mode 100644
index 0000000000..f77b4f18d5
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/edit-template.png differ
diff --git a/img/dashboard/api-assets/api-templates/import-select-source.png b/img/dashboard/api-assets/api-templates/import-select-source.png
new file mode 100644
index 0000000000..8f26dc4847
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/import-select-source.png differ
diff --git a/img/dashboard/api-assets/api-templates/import-select-template.png b/img/dashboard/api-assets/api-templates/import-select-template.png
new file mode 100644
index 0000000000..46b4be901c
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/import-select-template.png differ
diff --git a/img/dashboard/api-assets/api-templates/second-template-cache.png b/img/dashboard/api-assets/api-templates/second-template-cache.png
new file mode 100644
index 0000000000..559460e8d6
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/second-template-cache.png differ
diff --git a/img/dashboard/api-assets/api-templates/second-template-created.png b/img/dashboard/api-assets/api-templates/second-template-created.png
new file mode 100644
index 0000000000..0addd48398
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/second-template-created.png differ
diff --git a/img/dashboard/api-assets/api-templates/second-template-endpoints.png b/img/dashboard/api-assets/api-templates/second-template-endpoints.png
new file mode 100644
index 0000000000..91e6544399
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/second-template-endpoints.png differ
diff --git a/img/dashboard/api-assets/api-templates/second-template.png b/img/dashboard/api-assets/api-templates/second-template.png
new file mode 100644
index 0000000000..f0e3da29d7
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/second-template.png differ
diff --git a/img/dashboard/api-assets/api-templates/template-created.png b/img/dashboard/api-assets/api-templates/template-created.png
new file mode 100644
index 0000000000..b6caf870bf
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/template-created.png differ
diff --git a/img/dashboard/api-assets/api-templates/template-editor.png b/img/dashboard/api-assets/api-templates/template-editor.png
new file mode 100644
index 0000000000..6c37e3576b
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/template-editor.png differ
diff --git a/img/dashboard/api-assets/api-templates/template-raw-editor.png b/img/dashboard/api-assets/api-templates/template-raw-editor.png
new file mode 100644
index 0000000000..ea85a95502
Binary files /dev/null and b/img/dashboard/api-assets/api-templates/template-raw-editor.png differ
diff --git a/img/dashboard/api-designer/certificate-auth-register-cert.png b/img/dashboard/api-designer/certificate-auth-register-cert.png
new file mode 100644
index 0000000000..8aadca6972
Binary files /dev/null and b/img/dashboard/api-designer/certificate-auth-register-cert.png differ
diff --git a/img/dashboard/api-designer/certificate-auth.png b/img/dashboard/api-designer/certificate-auth.png
new file mode 100644
index 0000000000..f8b41ff026
Binary files /dev/null and b/img/dashboard/api-designer/certificate-auth.png differ
diff --git a/img/dashboard/api-designer/migrate-classic-actions.png b/img/dashboard/api-designer/migrate-classic-actions.png
new file mode 100644
index 0000000000..f6d649431b
Binary files /dev/null and b/img/dashboard/api-designer/migrate-classic-actions.png differ
diff --git a/img/dashboard/api-designer/migrate-classic-choose.png b/img/dashboard/api-designer/migrate-classic-choose.png
new file mode 100644
index 0000000000..0fa443574f
Binary files /dev/null and b/img/dashboard/api-designer/migrate-classic-choose.png differ
diff --git a/img/dashboard/api-designer/migrate-classic-confirm.png b/img/dashboard/api-designer/migrate-classic-confirm.png
new file mode 100644
index 0000000000..a674bea225
Binary files /dev/null and b/img/dashboard/api-designer/migrate-classic-confirm.png differ
diff --git a/img/dashboard/api-designer/migrate-classic-filter.png b/img/dashboard/api-designer/migrate-classic-filter.png
new file mode 100644
index 0000000000..12b39ab96e
Binary files /dev/null and b/img/dashboard/api-designer/migrate-classic-filter.png differ
diff --git a/img/dashboard/api-designer/migrate-classic-oas.png b/img/dashboard/api-designer/migrate-classic-oas.png
new file mode 100644
index 0000000000..c4f1cb513e
Binary files /dev/null and b/img/dashboard/api-designer/migrate-classic-oas.png differ
diff --git a/img/dashboard/api-designer/migrate-classic-promote.png b/img/dashboard/api-designer/migrate-classic-promote.png
new file mode 100644
index 0000000000..f57c12ac80
Binary files /dev/null and b/img/dashboard/api-designer/migrate-classic-promote.png differ
diff --git a/img/dashboard/api-designer/migrate-classic-staged.png b/img/dashboard/api-designer/migrate-classic-staged.png
new file mode 100644
index 0000000000..61995cd2d8
Binary files /dev/null and b/img/dashboard/api-designer/migrate-classic-staged.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-add-endpoint.png b/img/dashboard/api-designer/tyk-oas-add-endpoint.png
new file mode 100644
index 0000000000..89e362151f
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-add-endpoint.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-add-response-header.png b/img/dashboard/api-designer/tyk-oas-add-response-header.png
new file mode 100644
index 0000000000..8dab5ce1e1
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-add-response-header.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-add-url-rewrite.png b/img/dashboard/api-designer/tyk-oas-add-url-rewrite.png
new file mode 100644
index 0000000000..d7ec76997e
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-add-url-rewrite.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-allow-added.png b/img/dashboard/api-designer/tyk-oas-allow-added.png
new file mode 100644
index 0000000000..765baae92b
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-allow-added.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-allow-config.png b/img/dashboard/api-designer/tyk-oas-allow-config.png
new file mode 100644
index 0000000000..02b4cf8dd8
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-allow-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-allow.png b/img/dashboard/api-designer/tyk-oas-allow.png
new file mode 100644
index 0000000000..2e4ff37d9f
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-allow.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-block-added.png b/img/dashboard/api-designer/tyk-oas-block-added.png
new file mode 100644
index 0000000000..e7e5955cfe
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-block-added.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-block-config.png b/img/dashboard/api-designer/tyk-oas-block-config.png
new file mode 100644
index 0000000000..22045088cf
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-block-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-block.png b/img/dashboard/api-designer/tyk-oas-block.png
new file mode 100644
index 0000000000..1dc8c75563
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-block.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-body-transform-test.png b/img/dashboard/api-designer/tyk-oas-body-transform-test.png
new file mode 100644
index 0000000000..27dfb7d221
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-body-transform-test.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-cache-config.png b/img/dashboard/api-designer/tyk-oas-cache-config.png
new file mode 100644
index 0000000000..d350cdc1d8
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-cache-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-cache.png b/img/dashboard/api-designer/tyk-oas-cache.png
new file mode 100644
index 0000000000..14fec9f4dc
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-cache.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-certificate-attach.png b/img/dashboard/api-designer/tyk-oas-certificate-attach.png
new file mode 100644
index 0000000000..8fc353d10e
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-certificate-attach.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-circuit-breaker-config.png b/img/dashboard/api-designer/tyk-oas-circuit-breaker-config.png
new file mode 100644
index 0000000000..c4bee2ebb1
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-circuit-breaker-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-circuit-breaker.png b/img/dashboard/api-designer/tyk-oas-circuit-breaker.png
new file mode 100644
index 0000000000..7b8abd6827
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-circuit-breaker.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-detailed-logs.png b/img/dashboard/api-designer/tyk-oas-detailed-logs.png
new file mode 100644
index 0000000000..a40ea58d5c
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-detailed-logs.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-do-not-track.png b/img/dashboard/api-designer/tyk-oas-do-not-track.png
new file mode 100644
index 0000000000..b814be9d4a
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-do-not-track.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-enforce-timeout-config.png b/img/dashboard/api-designer/tyk-oas-enforce-timeout-config.png
new file mode 100644
index 0000000000..81afecb3fc
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-enforce-timeout-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-enforce-timeout.png b/img/dashboard/api-designer/tyk-oas-enforce-timeout.png
new file mode 100644
index 0000000000..3e351e9b5f
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-enforce-timeout.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-go-plugin-config.png b/img/dashboard/api-designer/tyk-oas-go-plugin-config.png
new file mode 100644
index 0000000000..a591f057b3
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-go-plugin-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-go-plugin.png b/img/dashboard/api-designer/tyk-oas-go-plugin.png
new file mode 100644
index 0000000000..6fec2e3fac
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-go-plugin.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-hmac-auth-settings.png b/img/dashboard/api-designer/tyk-oas-hmac-auth-settings.png
new file mode 100644
index 0000000000..e00d022c7c
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-hmac-auth-settings.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-ignore-added.png b/img/dashboard/api-designer/tyk-oas-ignore-added.png
new file mode 100644
index 0000000000..9364609a02
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-ignore-added.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-ignore-config.png b/img/dashboard/api-designer/tyk-oas-ignore-config.png
new file mode 100644
index 0000000000..5c39df2e69
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-ignore-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-ignore.png b/img/dashboard/api-designer/tyk-oas-ignore.png
new file mode 100644
index 0000000000..0c8abe86bf
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-ignore.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-internal.png b/img/dashboard/api-designer/tyk-oas-internal.png
new file mode 100644
index 0000000000..554294e9ff
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-internal.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-manual-mock-response-config.png b/img/dashboard/api-designer/tyk-oas-manual-mock-response-config.png
new file mode 100644
index 0000000000..e900af8960
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-manual-mock-response-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-manual-mock-response.png b/img/dashboard/api-designer/tyk-oas-manual-mock-response.png
new file mode 100644
index 0000000000..12f9aee781
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-manual-mock-response.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-manual-step-2.png b/img/dashboard/api-designer/tyk-oas-manual-step-2.png
new file mode 100644
index 0000000000..2a5468b7e6
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-manual-step-2.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-method-transform-config.png b/img/dashboard/api-designer/tyk-oas-method-transform-config.png
new file mode 100644
index 0000000000..8fd8927ad3
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-method-transform-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-method-transform.png b/img/dashboard/api-designer/tyk-oas-method-transform.png
new file mode 100644
index 0000000000..d2e138a1ee
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-method-transform.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-mock-auto-options.png b/img/dashboard/api-designer/tyk-oas-mock-auto-options.png
new file mode 100644
index 0000000000..b131613c78
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-mock-auto-options.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-mock-auto-select.png b/img/dashboard/api-designer/tyk-oas-mock-auto-select.png
new file mode 100644
index 0000000000..237bb3c73b
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-mock-auto-select.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-mock.png b/img/dashboard/api-designer/tyk-oas-mock.png
new file mode 100644
index 0000000000..6cd0a3959a
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-mock.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-no-endpoints.png b/img/dashboard/api-designer/tyk-oas-no-endpoints.png
new file mode 100644
index 0000000000..47455f2541
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-no-endpoints.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-no-middleware.png b/img/dashboard/api-designer/tyk-oas-no-middleware.png
new file mode 100644
index 0000000000..43fbd1a7b8
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-no-middleware.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-rate-limit-config.png b/img/dashboard/api-designer/tyk-oas-rate-limit-config.png
new file mode 100644
index 0000000000..76a3c46711
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-rate-limit-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-rate-limit.png b/img/dashboard/api-designer/tyk-oas-rate-limit.png
new file mode 100644
index 0000000000..e66e643793
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-rate-limit.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-request-body-config.png b/img/dashboard/api-designer/tyk-oas-request-body-config.png
new file mode 100644
index 0000000000..5309e1b5cd
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-request-body-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-request-body.png b/img/dashboard/api-designer/tyk-oas-request-body.png
new file mode 100644
index 0000000000..d842e995d5
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-request-body.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-request-header-added.png b/img/dashboard/api-designer/tyk-oas-request-header-added.png
new file mode 100644
index 0000000000..fdea92a5b4
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-request-header-added.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-request-header-api-level.png b/img/dashboard/api-designer/tyk-oas-request-header-api-level.png
new file mode 100644
index 0000000000..c3d327d884
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-request-header-api-level.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-request-header-api-new-header.png b/img/dashboard/api-designer/tyk-oas-request-header-api-new-header.png
new file mode 100644
index 0000000000..02e46c42ce
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-request-header-api-new-header.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-request-header-new.png b/img/dashboard/api-designer/tyk-oas-request-header-new.png
new file mode 100644
index 0000000000..8c8699aaf7
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-request-header-new.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-request-header.png b/img/dashboard/api-designer/tyk-oas-request-header.png
new file mode 100644
index 0000000000..84ee26ff3b
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-request-header.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-request-size-limit-config.png b/img/dashboard/api-designer/tyk-oas-request-size-limit-config.png
new file mode 100644
index 0000000000..44fa035b5b
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-request-size-limit-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-request-size-limit.png b/img/dashboard/api-designer/tyk-oas-request-size-limit.png
new file mode 100644
index 0000000000..294062d779
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-request-size-limit.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-response-body-config.png b/img/dashboard/api-designer/tyk-oas-response-body-config.png
new file mode 100644
index 0000000000..9ca0726265
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-response-body-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-response-body.png b/img/dashboard/api-designer/tyk-oas-response-body.png
new file mode 100644
index 0000000000..51217b831a
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-response-body.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-response-header-api-level.png b/img/dashboard/api-designer/tyk-oas-response-header-api-level.png
new file mode 100644
index 0000000000..776159bae9
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-response-header-api-level.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-response-header-api-new-header.png b/img/dashboard/api-designer/tyk-oas-response-header-api-new-header.png
new file mode 100644
index 0000000000..1ba19052aa
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-response-header-api-new-header.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-response-header-new.png b/img/dashboard/api-designer/tyk-oas-response-header-new.png
new file mode 100644
index 0000000000..43b447a7c0
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-response-header-new.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-response-header.png b/img/dashboard/api-designer/tyk-oas-response-header.png
new file mode 100644
index 0000000000..db1c797394
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-response-header.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-switch-version.png b/img/dashboard/api-designer/tyk-oas-switch-version.png
new file mode 100644
index 0000000000..503566cfe1
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-switch-version.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-track.png b/img/dashboard/api-designer/tyk-oas-track.png
new file mode 100644
index 0000000000..40df404bb5
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-track.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-upstream-mtls-client.png b/img/dashboard/api-designer/tyk-oas-upstream-mtls-client.png
new file mode 100644
index 0000000000..1cf73f1d98
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-upstream-mtls-client.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-upstream-mtls-public.png b/img/dashboard/api-designer/tyk-oas-upstream-mtls-public.png
new file mode 100644
index 0000000000..3db8e28333
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-upstream-mtls-public.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-url-rewrite-advanced.png b/img/dashboard/api-designer/tyk-oas-url-rewrite-advanced.png
new file mode 100644
index 0000000000..4556e8ae43
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-url-rewrite-advanced.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-url-rewrite-basic.png b/img/dashboard/api-designer/tyk-oas-url-rewrite-basic.png
new file mode 100644
index 0000000000..b1a45d8a68
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-url-rewrite-basic.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-validate-request-added.png b/img/dashboard/api-designer/tyk-oas-validate-request-added.png
new file mode 100644
index 0000000000..6a7dacc681
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-validate-request-added.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-validate-request-config.png b/img/dashboard/api-designer/tyk-oas-validate-request-config.png
new file mode 100644
index 0000000000..86f9f83326
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-validate-request-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-validate-request-import.png b/img/dashboard/api-designer/tyk-oas-validate-request-import.png
new file mode 100644
index 0000000000..566a5f4a67
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-validate-request-import.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-validate-request.png b/img/dashboard/api-designer/tyk-oas-validate-request.png
new file mode 100644
index 0000000000..256d011080
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-validate-request.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-version-change-base.png b/img/dashboard/api-designer/tyk-oas-version-change-base.png
new file mode 100644
index 0000000000..5b54c2c5c8
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-version-change-base.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-version-create-new.png b/img/dashboard/api-designer/tyk-oas-version-create-new.png
new file mode 100644
index 0000000000..759c6f87d3
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-version-create-new.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-version-empty.png b/img/dashboard/api-designer/tyk-oas-version-empty.png
new file mode 100644
index 0000000000..4406a71c55
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-version-empty.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-version-list.png b/img/dashboard/api-designer/tyk-oas-version-list.png
new file mode 100644
index 0000000000..62c9531ec2
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-version-list.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-version-manage.png b/img/dashboard/api-designer/tyk-oas-version-manage.png
new file mode 100644
index 0000000000..8d1dce90cb
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-version-manage.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-version-modal-configure-identifier.png b/img/dashboard/api-designer/tyk-oas-version-modal-configure-identifier.png
new file mode 100644
index 0000000000..8fd907506b
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-version-modal-configure-identifier.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-version-modal-identifier-configured.png b/img/dashboard/api-designer/tyk-oas-version-modal-identifier-configured.png
new file mode 100644
index 0000000000..8c6336f81e
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-version-modal-identifier-configured.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-version-modal-set-status.png b/img/dashboard/api-designer/tyk-oas-version-modal-set-status.png
new file mode 100644
index 0000000000..27d475f88d
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-version-modal-set-status.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-virtual-endpoint-config.png b/img/dashboard/api-designer/tyk-oas-virtual-endpoint-config.png
new file mode 100644
index 0000000000..35a7ca3558
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-virtual-endpoint-config.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-virtual-endpoint.png b/img/dashboard/api-designer/tyk-oas-virtual-endpoint.png
new file mode 100644
index 0000000000..b7e23c1527
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-virtual-endpoint.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-webhook-event-trigger.png b/img/dashboard/api-designer/tyk-oas-webhook-event-trigger.png
new file mode 100644
index 0000000000..82f283614a
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-webhook-event-trigger.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-webhook-global-complete.png b/img/dashboard/api-designer/tyk-oas-webhook-global-complete.png
new file mode 100644
index 0000000000..1f2166f457
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-webhook-global-complete.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-webhook-global.png b/img/dashboard/api-designer/tyk-oas-webhook-global.png
new file mode 100644
index 0000000000..50eb25314e
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-webhook-global.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-webhook-local-complete.png b/img/dashboard/api-designer/tyk-oas-webhook-local-complete.png
new file mode 100644
index 0000000000..bff8a60fd1
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-webhook-local-complete.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-webhook-local.png b/img/dashboard/api-designer/tyk-oas-webhook-local.png
new file mode 100644
index 0000000000..cc575b9176
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-webhook-local.png differ
diff --git a/img/dashboard/api-designer/tyk-oas-webhook-server.png b/img/dashboard/api-designer/tyk-oas-webhook-server.png
new file mode 100644
index 0000000000..4464dce3b0
Binary files /dev/null and b/img/dashboard/api-designer/tyk-oas-webhook-server.png differ
diff --git a/img/dashboard/api-designer/upstream-basic-auth.png b/img/dashboard/api-designer/upstream-basic-auth.png
new file mode 100644
index 0000000000..4c9795d902
Binary files /dev/null and b/img/dashboard/api-designer/upstream-basic-auth.png differ
diff --git a/img/dashboard/api-designer/upstream-oauth-client-credentials.png b/img/dashboard/api-designer/upstream-oauth-client-credentials.png
new file mode 100644
index 0000000000..c0808cbd1b
Binary files /dev/null and b/img/dashboard/api-designer/upstream-oauth-client-credentials.png differ
diff --git a/img/dashboard/api-designer/upstream-oauth-password-grant.png b/img/dashboard/api-designer/upstream-oauth-password-grant.png
new file mode 100644
index 0000000000..3d5ac1f4d0
Binary files /dev/null and b/img/dashboard/api-designer/upstream-oauth-password-grant.png differ
diff --git a/img/dashboard/certificate-manager/adding-certificate.gif b/img/dashboard/certificate-manager/adding-certificate.gif
new file mode 100644
index 0000000000..4c856bf318
Binary files /dev/null and b/img/dashboard/certificate-manager/adding-certificate.gif differ
diff --git a/img/dashboard/certificate-manager/certificates-cert-details.png b/img/dashboard/certificate-manager/certificates-cert-details.png
new file mode 100644
index 0000000000..56747df5b8
Binary files /dev/null and b/img/dashboard/certificate-manager/certificates-cert-details.png differ
diff --git a/img/dashboard/certificate-manager/certificates-tyk-certificate-store.png b/img/dashboard/certificate-manager/certificates-tyk-certificate-store.png
new file mode 100644
index 0000000000..078a9133ec
Binary files /dev/null and b/img/dashboard/certificate-manager/certificates-tyk-certificate-store.png differ
diff --git a/img/dashboard/certificate-manager/certificates-upload-cert.png b/img/dashboard/certificate-manager/certificates-upload-cert.png
new file mode 100644
index 0000000000..7a757476e6
Binary files /dev/null and b/img/dashboard/certificate-manager/certificates-upload-cert.png differ
diff --git a/img/dashboard/dashboard-audit-logs.png b/img/dashboard/dashboard-audit-logs.png
new file mode 100644
index 0000000000..326528e2dc
Binary files /dev/null and b/img/dashboard/dashboard-audit-logs.png differ
diff --git a/img/dashboard/endpoint-designer/advanced-cache-config.png b/img/dashboard/endpoint-designer/advanced-cache-config.png
new file mode 100644
index 0000000000..188f059d63
Binary files /dev/null and b/img/dashboard/endpoint-designer/advanced-cache-config.png differ
diff --git a/img/dashboard/endpoint-designer/advanced-cache.png b/img/dashboard/endpoint-designer/advanced-cache.png
new file mode 100644
index 0000000000..48e26ac765
Binary files /dev/null and b/img/dashboard/endpoint-designer/advanced-cache.png differ
diff --git a/img/dashboard/endpoint-designer/body-transform-request.png b/img/dashboard/endpoint-designer/body-transform-request.png
new file mode 100644
index 0000000000..cb577244df
Binary files /dev/null and b/img/dashboard/endpoint-designer/body-transform-request.png differ
diff --git a/img/dashboard/endpoint-designer/body-transform-response.png b/img/dashboard/endpoint-designer/body-transform-response.png
new file mode 100644
index 0000000000..83a04d44b8
Binary files /dev/null and b/img/dashboard/endpoint-designer/body-transform-response.png differ
diff --git a/img/dashboard/endpoint-designer/body-transform-test.png b/img/dashboard/endpoint-designer/body-transform-test.png
new file mode 100644
index 0000000000..b5fd1dd66c
Binary files /dev/null and b/img/dashboard/endpoint-designer/body-transform-test.png differ
diff --git a/img/dashboard/endpoint-designer/cache-options.png b/img/dashboard/endpoint-designer/cache-options.png
new file mode 100644
index 0000000000..963afdc340
Binary files /dev/null and b/img/dashboard/endpoint-designer/cache-options.png differ
diff --git a/img/dashboard/endpoint-designer/categories-classic-add.png b/img/dashboard/endpoint-designer/categories-classic-add.png
new file mode 100644
index 0000000000..4d15f5db58
Binary files /dev/null and b/img/dashboard/endpoint-designer/categories-classic-add.png differ
diff --git a/img/dashboard/endpoint-designer/categories-classic.png b/img/dashboard/endpoint-designer/categories-classic.png
new file mode 100644
index 0000000000..41e38db163
Binary files /dev/null and b/img/dashboard/endpoint-designer/categories-classic.png differ
diff --git a/img/dashboard/endpoint-designer/categories-filter.png b/img/dashboard/endpoint-designer/categories-filter.png
new file mode 100644
index 0000000000..d70dbc76fb
Binary files /dev/null and b/img/dashboard/endpoint-designer/categories-filter.png differ
diff --git a/img/dashboard/endpoint-designer/categories-oas-add.png b/img/dashboard/endpoint-designer/categories-oas-add.png
new file mode 100644
index 0000000000..a54b96753a
Binary files /dev/null and b/img/dashboard/endpoint-designer/categories-oas-add.png differ
diff --git a/img/dashboard/endpoint-designer/categories-oas.png b/img/dashboard/endpoint-designer/categories-oas.png
new file mode 100644
index 0000000000..a1e6581906
Binary files /dev/null and b/img/dashboard/endpoint-designer/categories-oas.png differ
diff --git a/img/dashboard/endpoint-designer/classic-detailed-logging.png b/img/dashboard/endpoint-designer/classic-detailed-logging.png
new file mode 100644
index 0000000000..4da54b197c
Binary files /dev/null and b/img/dashboard/endpoint-designer/classic-detailed-logging.png differ
diff --git a/img/dashboard/endpoint-designer/classic-endpoint-designer-advanced.png b/img/dashboard/endpoint-designer/classic-endpoint-designer-advanced.png
new file mode 100644
index 0000000000..ab4d52ca58
Binary files /dev/null and b/img/dashboard/endpoint-designer/classic-endpoint-designer-advanced.png differ
diff --git a/img/dashboard/endpoint-designer/classic-endpoint-designer-core.png b/img/dashboard/endpoint-designer/classic-endpoint-designer-core.png
new file mode 100644
index 0000000000..7641217c8a
Binary files /dev/null and b/img/dashboard/endpoint-designer/classic-endpoint-designer-core.png differ
diff --git a/img/dashboard/endpoint-designer/classic-endpoint-designer-debugging.png b/img/dashboard/endpoint-designer/classic-endpoint-designer-debugging.png
new file mode 100644
index 0000000000..35c4cf1197
Binary files /dev/null and b/img/dashboard/endpoint-designer/classic-endpoint-designer-debugging.png differ
diff --git a/img/dashboard/endpoint-designer/classic-endpoint-designer-endpoint.png b/img/dashboard/endpoint-designer/classic-endpoint-designer-endpoint.png
new file mode 100644
index 0000000000..cd3ca06f30
Binary files /dev/null and b/img/dashboard/endpoint-designer/classic-endpoint-designer-endpoint.png differ
diff --git a/img/dashboard/endpoint-designer/classic-endpoint-designer-uptime.png b/img/dashboard/endpoint-designer/classic-endpoint-designer-uptime.png
new file mode 100644
index 0000000000..0529ccd506
Binary files /dev/null and b/img/dashboard/endpoint-designer/classic-endpoint-designer-uptime.png differ
diff --git a/img/dashboard/endpoint-designer/classic-endpoint-designer-versions.png b/img/dashboard/endpoint-designer/classic-endpoint-designer-versions.png
new file mode 100644
index 0000000000..75bb3c9be1
Binary files /dev/null and b/img/dashboard/endpoint-designer/classic-endpoint-designer-versions.png differ
diff --git a/img/dashboard/endpoint-designer/endpointplugin.png b/img/dashboard/endpoint-designer/endpointplugin.png
new file mode 100644
index 0000000000..9d8a946f7f
Binary files /dev/null and b/img/dashboard/endpoint-designer/endpointplugin.png differ
diff --git a/img/dashboard/endpoint-designer/endpointplugin_config.png b/img/dashboard/endpoint-designer/endpointplugin_config.png
new file mode 100644
index 0000000000..e779e8ede7
Binary files /dev/null and b/img/dashboard/endpoint-designer/endpointplugin_config.png differ
diff --git a/img/dashboard/endpoint-designer/endpointplugin_search.png b/img/dashboard/endpoint-designer/endpointplugin_search.png
new file mode 100644
index 0000000000..1017a684ef
Binary files /dev/null and b/img/dashboard/endpoint-designer/endpointplugin_search.png differ
diff --git a/img/dashboard/endpoint-designer/ignore-authentication.png b/img/dashboard/endpoint-designer/ignore-authentication.png
new file mode 100644
index 0000000000..b2e3a3a045
Binary files /dev/null and b/img/dashboard/endpoint-designer/ignore-authentication.png differ
diff --git a/img/dashboard/endpoint-designer/internal-endpoint.png b/img/dashboard/endpoint-designer/internal-endpoint.png
new file mode 100644
index 0000000000..943d792f55
Binary files /dev/null and b/img/dashboard/endpoint-designer/internal-endpoint.png differ
diff --git a/img/dashboard/endpoint-designer/mock-response-config.png b/img/dashboard/endpoint-designer/mock-response-config.png
new file mode 100644
index 0000000000..a4a14c0c76
Binary files /dev/null and b/img/dashboard/endpoint-designer/mock-response-config.png differ
diff --git a/img/dashboard/endpoint-designer/mock-response.png b/img/dashboard/endpoint-designer/mock-response.png
new file mode 100644
index 0000000000..3868e76350
Binary files /dev/null and b/img/dashboard/endpoint-designer/mock-response.png differ
diff --git a/img/dashboard/endpoint-designer/modify-headers-plugin.png b/img/dashboard/endpoint-designer/modify-headers-plugin.png
new file mode 100644
index 0000000000..4c3c90ba3e
Binary files /dev/null and b/img/dashboard/endpoint-designer/modify-headers-plugin.png differ
diff --git a/img/dashboard/endpoint-designer/ownership-oas.png b/img/dashboard/endpoint-designer/ownership-oas.png
new file mode 100644
index 0000000000..f2697db00e
Binary files /dev/null and b/img/dashboard/endpoint-designer/ownership-oas.png differ
diff --git a/img/dashboard/endpoint-designer/response-header-added.png b/img/dashboard/endpoint-designer/response-header-added.png
new file mode 100644
index 0000000000..2c55fad7b6
Binary files /dev/null and b/img/dashboard/endpoint-designer/response-header-added.png differ
diff --git a/img/dashboard/endpoint-designer/response-header-details.png b/img/dashboard/endpoint-designer/response-header-details.png
new file mode 100644
index 0000000000..3cc06d0041
Binary files /dev/null and b/img/dashboard/endpoint-designer/response-header-details.png differ
diff --git a/img/dashboard/endpoint-designer/response-header-global.png b/img/dashboard/endpoint-designer/response-header-global.png
new file mode 100644
index 0000000000..0e43b6dc85
Binary files /dev/null and b/img/dashboard/endpoint-designer/response-header-global.png differ
diff --git a/img/dashboard/endpoint-designer/testapi-allowlist.png b/img/dashboard/endpoint-designer/testapi-allowlist.png
new file mode 100644
index 0000000000..bd121bd587
Binary files /dev/null and b/img/dashboard/endpoint-designer/testapi-allowlist.png differ
diff --git a/img/dashboard/endpoint-designer/tyk-classic-version-add.png b/img/dashboard/endpoint-designer/tyk-classic-version-add.png
new file mode 100644
index 0000000000..f329ea62f3
Binary files /dev/null and b/img/dashboard/endpoint-designer/tyk-classic-version-add.png differ
diff --git a/img/dashboard/endpoint-designer/tyk-classic-version-endpoint.png b/img/dashboard/endpoint-designer/tyk-classic-version-endpoint.png
new file mode 100644
index 0000000000..eca933cdeb
Binary files /dev/null and b/img/dashboard/endpoint-designer/tyk-classic-version-endpoint.png differ
diff --git a/img/dashboard/endpoint-designer/tyk-classic-version-no-versioning.png b/img/dashboard/endpoint-designer/tyk-classic-version-no-versioning.png
new file mode 100644
index 0000000000..c13daa8c16
Binary files /dev/null and b/img/dashboard/endpoint-designer/tyk-classic-version-no-versioning.png differ
diff --git a/img/dashboard/endpoint-designer/tyk-classic-version-set-default.png b/img/dashboard/endpoint-designer/tyk-classic-version-set-default.png
new file mode 100644
index 0000000000..c8623334af
Binary files /dev/null and b/img/dashboard/endpoint-designer/tyk-classic-version-set-default.png differ
diff --git a/img/dashboard/endpoint-designer/tyk-classic-version-start.png b/img/dashboard/endpoint-designer/tyk-classic-version-start.png
new file mode 100644
index 0000000000..6ddc4f9b2a
Binary files /dev/null and b/img/dashboard/endpoint-designer/tyk-classic-version-start.png differ
diff --git a/img/dashboard/endpoint-designer/validate-json-schema.png b/img/dashboard/endpoint-designer/validate-json-schema.png
new file mode 100644
index 0000000000..9ba450c6a3
Binary files /dev/null and b/img/dashboard/endpoint-designer/validate-json-schema.png differ
diff --git a/img/dashboard/endpoint-designer/virtual-endpoint-file.png b/img/dashboard/endpoint-designer/virtual-endpoint-file.png
new file mode 100644
index 0000000000..047e1351bb
Binary files /dev/null and b/img/dashboard/endpoint-designer/virtual-endpoint-file.png differ
diff --git a/img/dashboard/endpoint-designer/virtual-endpoint-inline.png b/img/dashboard/endpoint-designer/virtual-endpoint-inline.png
new file mode 100644
index 0000000000..b3c5d7492c
Binary files /dev/null and b/img/dashboard/endpoint-designer/virtual-endpoint-inline.png differ
diff --git a/img/dashboard/endpoint-designer/virtual-endpoint-middleware.png b/img/dashboard/endpoint-designer/virtual-endpoint-middleware.png
new file mode 100644
index 0000000000..2d23708a60
Binary files /dev/null and b/img/dashboard/endpoint-designer/virtual-endpoint-middleware.png differ
diff --git a/img/dashboard/graphql/add-subgraph-api.png b/img/dashboard/graphql/add-subgraph-api.png
new file mode 100644
index 0000000000..9a4869c606
Binary files /dev/null and b/img/dashboard/graphql/add-subgraph-api.png differ
diff --git a/img/dashboard/graphql/add-supergraph-api.png b/img/dashboard/graphql/add-supergraph-api.png
new file mode 100644
index 0000000000..fc99940c5a
Binary files /dev/null and b/img/dashboard/graphql/add-supergraph-api.png differ
diff --git a/img/dashboard/graphql/choose-gql-api.png b/img/dashboard/graphql/choose-gql-api.png
new file mode 100644
index 0000000000..02252d291e
Binary files /dev/null and b/img/dashboard/graphql/choose-gql-api.png differ
diff --git a/img/dashboard/graphql/create_graphql.png b/img/dashboard/graphql/create_graphql.png
new file mode 100644
index 0000000000..7b8b42d798
Binary files /dev/null and b/img/dashboard/graphql/create_graphql.png differ
diff --git a/img/dashboard/graphql/diagram_graphql-federation-B.png b/img/dashboard/graphql/diagram_graphql-federation-B.png
new file mode 100644
index 0000000000..06df4156d9
Binary files /dev/null and b/img/dashboard/graphql/diagram_graphql-federation-B.png differ
diff --git a/img/dashboard/graphql/disable-introspection.png b/img/dashboard/graphql/disable-introspection.png
new file mode 100644
index 0000000000..e5ad98e54e
Binary files /dev/null and b/img/dashboard/graphql/disable-introspection.png differ
diff --git a/img/dashboard/graphql/enable-playground.png b/img/dashboard/graphql/enable-playground.png
new file mode 100644
index 0000000000..609564b5c7
Binary files /dev/null and b/img/dashboard/graphql/enable-playground.png differ
diff --git a/img/dashboard/graphql/global-header1.png b/img/dashboard/graphql/global-header1.png
new file mode 100644
index 0000000000..6d11d9a1eb
Binary files /dev/null and b/img/dashboard/graphql/global-header1.png differ
diff --git a/img/dashboard/graphql/global-header2.png b/img/dashboard/graphql/global-header2.png
new file mode 100644
index 0000000000..e5558580cc
Binary files /dev/null and b/img/dashboard/graphql/global-header2.png differ
diff --git a/img/dashboard/graphql/gql-playground-new.png b/img/dashboard/graphql/gql-playground-new.png
new file mode 100644
index 0000000000..8edd4ed9cd
Binary files /dev/null and b/img/dashboard/graphql/gql-playground-new.png differ
diff --git a/img/dashboard/graphql/gql_upstream_header.png b/img/dashboard/graphql/gql_upstream_header.png
new file mode 100644
index 0000000000..2b5972364f
Binary files /dev/null and b/img/dashboard/graphql/gql_upstream_header.png differ
diff --git a/img/dashboard/graphql/headers-gql-request.png b/img/dashboard/graphql/headers-gql-request.png
new file mode 100644
index 0000000000..8973e1964b
Binary files /dev/null and b/img/dashboard/graphql/headers-gql-request.png differ
diff --git a/img/dashboard/graphql/introspection-auth.png b/img/dashboard/graphql/introspection-auth.png
new file mode 100644
index 0000000000..d788ad60dd
Binary files /dev/null and b/img/dashboard/graphql/introspection-auth.png differ
diff --git a/img/dashboard/graphql/introspection-headers.png b/img/dashboard/graphql/introspection-headers.png
new file mode 100644
index 0000000000..be615179e6
Binary files /dev/null and b/img/dashboard/graphql/introspection-headers.png differ
diff --git a/img/dashboard/graphql/schema_sync.png b/img/dashboard/graphql/schema_sync.png
new file mode 100644
index 0000000000..b882849880
Binary files /dev/null and b/img/dashboard/graphql/schema_sync.png differ
diff --git a/img/dashboard/graphql/select-subgraphs.png b/img/dashboard/graphql/select-subgraphs.png
new file mode 100644
index 0000000000..bdcbaa2f41
Binary files /dev/null and b/img/dashboard/graphql/select-subgraphs.png differ
diff --git a/img/dashboard/graphql/subgraph-api-listing.png b/img/dashboard/graphql/subgraph-api-listing.png
new file mode 100644
index 0000000000..153b78915e
Binary files /dev/null and b/img/dashboard/graphql/subgraph-api-listing.png differ
diff --git a/img/dashboard/graphql/subgraph-upstream-url.png b/img/dashboard/graphql/subgraph-upstream-url.png
new file mode 100644
index 0000000000..6668817446
Binary files /dev/null and b/img/dashboard/graphql/subgraph-upstream-url.png differ
diff --git a/img/dashboard/graphql/supergraph-api-listing.png b/img/dashboard/graphql/supergraph-api-listing.png
new file mode 100644
index 0000000000..28b0cdf512
Binary files /dev/null and b/img/dashboard/graphql/supergraph-api-listing.png differ
diff --git a/img/dashboard/graphql/tyk-subscriptions-workflow.png b/img/dashboard/graphql/tyk-subscriptions-workflow.png
new file mode 100644
index 0000000000..f23819f15e
Binary files /dev/null and b/img/dashboard/graphql/tyk-subscriptions-workflow.png differ
diff --git a/img/dashboard/portal-management/add_developer_2.5.png b/img/dashboard/portal-management/add_developer_2.5.png
new file mode 100644
index 0000000000..cc960de91d
Binary files /dev/null and b/img/dashboard/portal-management/add_developer_2.5.png differ
diff --git a/img/dashboard/portal-management/add_portal_menu_2.5.png b/img/dashboard/portal-management/add_portal_menu_2.5.png
new file mode 100644
index 0000000000..c30bbd025c
Binary files /dev/null and b/img/dashboard/portal-management/add_portal_menu_2.5.png differ
diff --git a/img/dashboard/portal-management/catalogue_entry.png b/img/dashboard/portal-management/catalogue_entry.png
new file mode 100644
index 0000000000..d5e2072a3a
Binary files /dev/null and b/img/dashboard/portal-management/catalogue_entry.png differ
diff --git a/img/dashboard/portal-management/change_key_policy.png b/img/dashboard/portal-management/change_key_policy.png
new file mode 100644
index 0000000000..186344787c
Binary files /dev/null and b/img/dashboard/portal-management/change_key_policy.png differ
diff --git a/img/dashboard/portal-management/create_portal_oauth_client.png b/img/dashboard/portal-management/create_portal_oauth_client.png
new file mode 100644
index 0000000000..5f63f1c3b9
Binary files /dev/null and b/img/dashboard/portal-management/create_portal_oauth_client.png differ
diff --git a/img/dashboard/portal-management/cssEditor.png b/img/dashboard/portal-management/cssEditor.png
new file mode 100755
index 0000000000..21419d8beb
Binary files /dev/null and b/img/dashboard/portal-management/cssEditor.png differ
diff --git a/img/dashboard/portal-management/cssNav.png b/img/dashboard/portal-management/cssNav.png
new file mode 100755
index 0000000000..a7c75125c3
Binary files /dev/null and b/img/dashboard/portal-management/cssNav.png differ
diff --git a/img/dashboard/portal-management/custom_page_dynamic.png b/img/dashboard/portal-management/custom_page_dynamic.png
new file mode 100644
index 0000000000..32b3c5e468
Binary files /dev/null and b/img/dashboard/portal-management/custom_page_dynamic.png differ
diff --git a/img/dashboard/portal-management/dcr-okta-grant-types.png b/img/dashboard/portal-management/dcr-okta-grant-types.png
new file mode 100644
index 0000000000..46f800a332
Binary files /dev/null and b/img/dashboard/portal-management/dcr-okta-grant-types.png differ
diff --git a/img/dashboard/portal-management/dev_cusomise_2.5.png b/img/dashboard/portal-management/dev_cusomise_2.5.png
new file mode 100644
index 0000000000..94dba468da
Binary files /dev/null and b/img/dashboard/portal-management/dev_cusomise_2.5.png differ
diff --git a/img/dashboard/portal-management/dev_logged_in_external.jpg b/img/dashboard/portal-management/dev_logged_in_external.jpg
new file mode 100644
index 0000000000..d7f7af1798
Binary files /dev/null and b/img/dashboard/portal-management/dev_logged_in_external.jpg differ
diff --git a/img/dashboard/portal-management/dev_logged_in_internal.jpg b/img/dashboard/portal-management/dev_logged_in_internal.jpg
new file mode 100644
index 0000000000..f9c68d08f8
Binary files /dev/null and b/img/dashboard/portal-management/dev_logged_in_internal.jpg differ
diff --git a/img/dashboard/portal-management/dev_portal_homev1.8.png b/img/dashboard/portal-management/dev_portal_homev1.8.png
new file mode 100644
index 0000000000..b9e41ec836
Binary files /dev/null and b/img/dashboard/portal-management/dev_portal_homev1.8.png differ
diff --git a/img/dashboard/portal-management/developer_details_2.5.png b/img/dashboard/portal-management/developer_details_2.5.png
new file mode 100644
index 0000000000..e7e92a7841
Binary files /dev/null and b/img/dashboard/portal-management/developer_details_2.5.png differ
diff --git a/img/dashboard/portal-management/developer_edit_2.5.png b/img/dashboard/portal-management/developer_edit_2.5.png
new file mode 100644
index 0000000000..91fe284d53
Binary files /dev/null and b/img/dashboard/portal-management/developer_edit_2.5.png differ
diff --git a/img/dashboard/portal-management/developer_manage_profile.png b/img/dashboard/portal-management/developer_manage_profile.png
new file mode 100644
index 0000000000..ff66c11a6b
Binary files /dev/null and b/img/dashboard/portal-management/developer_manage_profile.png differ
diff --git a/img/dashboard/portal-management/developer_menu_2.5.png b/img/dashboard/portal-management/developer_menu_2.5.png
new file mode 100644
index 0000000000..59f1c1e90d
Binary files /dev/null and b/img/dashboard/portal-management/developer_menu_2.5.png differ
diff --git a/img/dashboard/portal-management/developer_overview_2.5.png b/img/dashboard/portal-management/developer_overview_2.5.png
new file mode 100644
index 0000000000..2be65816a5
Binary files /dev/null and b/img/dashboard/portal-management/developer_overview_2.5.png differ
diff --git a/img/dashboard/portal-management/developer_search_2.5.png b/img/dashboard/portal-management/developer_search_2.5.png
new file mode 100644
index 0000000000..e22c25c4ef
Binary files /dev/null and b/img/dashboard/portal-management/developer_search_2.5.png differ
diff --git a/img/dashboard/portal-management/developer_subs_2.5.png b/img/dashboard/portal-management/developer_subs_2.5.png
new file mode 100644
index 0000000000..a4a0e1ce72
Binary files /dev/null and b/img/dashboard/portal-management/developer_subs_2.5.png differ
diff --git a/img/dashboard/portal-management/developer_usage_2.5.png b/img/dashboard/portal-management/developer_usage_2.5.png
new file mode 100644
index 0000000000..926fe26e64
Binary files /dev/null and b/img/dashboard/portal-management/developer_usage_2.5.png differ
diff --git a/img/dashboard/portal-management/deveoper_field_group.png b/img/dashboard/portal-management/deveoper_field_group.png
new file mode 100644
index 0000000000..1cc0538f04
Binary files /dev/null and b/img/dashboard/portal-management/deveoper_field_group.png differ
diff --git a/img/dashboard/portal-management/email_password_request.png b/img/dashboard/portal-management/email_password_request.png
new file mode 100644
index 0000000000..2a9fc5b00c
Binary files /dev/null and b/img/dashboard/portal-management/email_password_request.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.12.0-credential-expiration.png b/img/dashboard/portal-management/enterprise-portal/1.12.0-credential-expiration.png
new file mode 100644
index 0000000000..4c1adbb656
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.12.0-credential-expiration.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.12.0-custom-credential.png b/img/dashboard/portal-management/enterprise-portal/1.12.0-custom-credential.png
new file mode 100644
index 0000000000..81d8f8f561
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.12.0-custom-credential.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.12.0-embedded-tib.png b/img/dashboard/portal-management/enterprise-portal/1.12.0-embedded-tib.png
new file mode 100644
index 0000000000..5dfdb130b1
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.12.0-embedded-tib.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.12.0-non-tyk-managed-credential.png b/img/dashboard/portal-management/enterprise-portal/1.12.0-non-tyk-managed-credential.png
new file mode 100644
index 0000000000..9db8ddacc2
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.12.0-non-tyk-managed-credential.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.12.0-password-policy.png b/img/dashboard/portal-management/enterprise-portal/1.12.0-password-policy.png
new file mode 100644
index 0000000000..09d6141397
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.12.0-password-policy.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-errors.png b/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-errors.png
new file mode 100644
index 0000000000..f7b3853ead
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-errors.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-latency.png b/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-latency.png
new file mode 100644
index 0000000000..35c0d84b35
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-latency.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-overview.png b/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-overview.png
new file mode 100644
index 0000000000..a07cd99c78
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-overview.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-total-calls.png b/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-total-calls.png
new file mode 100644
index 0000000000..9581ea7571
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.3.0-analytics-for-api-consumers-total-calls.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.4.0-response-code-filters.png b/img/dashboard/portal-management/enterprise-portal/1.4.0-response-code-filters.png
new file mode 100644
index 0000000000..c746f02b11
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.4.0-response-code-filters.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.5.0-provider-page.png b/img/dashboard/portal-management/enterprise-portal/1.5.0-provider-page.png
new file mode 100644
index 0000000000..ff0d1a071b
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.5.0-provider-page.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.5.0-skip-ssl-verify.png b/img/dashboard/portal-management/enterprise-portal/1.5.0-skip-ssl-verify.png
new file mode 100644
index 0000000000..cb25d51064
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.5.0-skip-ssl-verify.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.6.0-display-custom-auth-apis.png b/img/dashboard/portal-management/enterprise-portal/1.6.0-display-custom-auth-apis.png
new file mode 100644
index 0000000000..ae9b15198d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.6.0-display-custom-auth-apis.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-checkout.png b/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-checkout.png
new file mode 100644
index 0000000000..286331efef
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-checkout.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-dashboard.png b/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-dashboard.png
new file mode 100644
index 0000000000..3fbc46a716
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-dashboard.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-published.png b/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-published.png
new file mode 100644
index 0000000000..046c8ee92b
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.6.0-mtl-support-published.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.6.0-multiple-idps-edit.png b/img/dashboard/portal-management/enterprise-portal/1.6.0-multiple-idps-edit.png
new file mode 100644
index 0000000000..884d8b2f7b
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.6.0-multiple-idps-edit.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.6.0-multiple-idps-index.png b/img/dashboard/portal-management/enterprise-portal/1.6.0-multiple-idps-index.png
new file mode 100644
index 0000000000..21fe70cfc2
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.6.0-multiple-idps-index.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.6.0-theme-upload-is-disabled.png b/img/dashboard/portal-management/enterprise-portal/1.6.0-theme-upload-is-disabled.png
new file mode 100644
index 0000000000..631e2781b8
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.6.0-theme-upload-is-disabled.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.7.0-content-block-validation.png b/img/dashboard/portal-management/enterprise-portal/1.7.0-content-block-validation.png
new file mode 100644
index 0000000000..a12fadd640
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.7.0-content-block-validation.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.7.0-rate-limit-for-access-requests.png b/img/dashboard/portal-management/enterprise-portal/1.7.0-rate-limit-for-access-requests.png
new file mode 100644
index 0000000000..2a44c96a0a
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.7.0-rate-limit-for-access-requests.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.8.0-create-custom-attribute.png b/img/dashboard/portal-management/enterprise-portal/1.8.0-create-custom-attribute.png
new file mode 100644
index 0000000000..aab432a61d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.8.0-create-custom-attribute.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.8.0-sign-up-form.png b/img/dashboard/portal-management/enterprise-portal/1.8.0-sign-up-form.png
new file mode 100644
index 0000000000..7f318652e2
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.8.0-sign-up-form.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/1.8.0-test-idp-connectivity.png b/img/dashboard/portal-management/enterprise-portal/1.8.0-test-idp-connectivity.png
new file mode 100644
index 0000000000..1b6d669357
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/1.8.0-test-idp-connectivity.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/account-email-popup.png b/img/dashboard/portal-management/enterprise-portal/account-email-popup.png
new file mode 100644
index 0000000000..b2660cae21
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/account-email-popup.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/account-registered.png b/img/dashboard/portal-management/enterprise-portal/account-registered.png
new file mode 100644
index 0000000000..45d495f1c7
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/account-registered.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/activate-a-theme.png b/img/dashboard/portal-management/enterprise-portal/activate-a-theme.png
new file mode 100644
index 0000000000..69ad985470
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/activate-a-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/activate-theme.png b/img/dashboard/portal-management/enterprise-portal/activate-theme.png
new file mode 100644
index 0000000000..598f517c74
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/activate-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-a-content-page-using-an-existing-template.png b/img/dashboard/portal-management/enterprise-portal/add-a-content-page-using-an-existing-template.png
new file mode 100644
index 0000000000..64ef9a096e
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-a-content-page-using-an-existing-template.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-a-new-theme.png b/img/dashboard/portal-management/enterprise-portal/add-a-new-theme.png
new file mode 100644
index 0000000000..fbb578cbb5
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-a-new-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-a-scope-to-policy-mapping-for-the-plan-scope.png b/img/dashboard/portal-management/enterprise-portal/add-a-scope-to-policy-mapping-for-the-plan-scope.png
new file mode 100644
index 0000000000..8441251e6e
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-a-scope-to-policy-mapping-for-the-plan-scope.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-a-scope-to-policy-mapping-for-the-product-scope.png b/img/dashboard/portal-management/enterprise-portal/add-a-scope-to-policy-mapping-for-the-product-scope.png
new file mode 100644
index 0000000000..1b8d6aadd1
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-a-scope-to-policy-mapping-for-the-product-scope.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-invite-code.png b/img/dashboard/portal-management/enterprise-portal/add-invite-code.png
new file mode 100644
index 0000000000..df7d8429d6
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-invite-code.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-new-attribute-to-user-model.png b/img/dashboard/portal-management/enterprise-portal/add-new-attribute-to-user-model.png
new file mode 100644
index 0000000000..e62db38c03
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-new-attribute-to-user-model.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-org2.png b/img/dashboard/portal-management/enterprise-portal/add-org2.png
new file mode 100644
index 0000000000..44d506d372
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-org2.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-orgs.png b/img/dashboard/portal-management/enterprise-portal/add-orgs.png
new file mode 100644
index 0000000000..85df90cb75
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-orgs.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-page-details.png b/img/dashboard/portal-management/enterprise-portal/add-page-details.png
new file mode 100644
index 0000000000..db12c06982
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-page-details.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-theme-file-to-existing-theme.png b/img/dashboard/portal-management/enterprise-portal/add-theme-file-to-existing-theme.png
new file mode 100644
index 0000000000..3795782ac4
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-theme-file-to-existing-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/add-theme-file.png b/img/dashboard/portal-management/enterprise-portal/add-theme-file.png
new file mode 100644
index 0000000000..69fd403e55
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/add-theme-file.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/admin_email_settings.png b/img/dashboard/portal-management/enterprise-portal/admin_email_settings.png
new file mode 100644
index 0000000000..5ac0b1dc1a
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/admin_email_settings.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/api_consumer_org_registration_settings.png b/img/dashboard/portal-management/enterprise-portal/api_consumer_org_registration_settings.png
new file mode 100644
index 0000000000..62be8f260b
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/api_consumer_org_registration_settings.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/approve-dcr-access-request.png b/img/dashboard/portal-management/enterprise-portal/approve-dcr-access-request.png
new file mode 100644
index 0000000000..dcb0b7faf9
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/approve-dcr-access-request.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/auto-approve-requests.png b/img/dashboard/portal-management/enterprise-portal/auto-approve-requests.png
new file mode 100644
index 0000000000..1204afb36f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/auto-approve-requests.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/auto-approve-users.png b/img/dashboard/portal-management/enterprise-portal/auto-approve-users.png
new file mode 100644
index 0000000000..14f2ba3c38
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/auto-approve-users.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/background-colors.png b/img/dashboard/portal-management/enterprise-portal/background-colors.png
new file mode 100644
index 0000000000..058ba37457
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/background-colors.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/become_an_organisation_navbar.png b/img/dashboard/portal-management/enterprise-portal/become_an_organisation_navbar.png
new file mode 100644
index 0000000000..bd39519fa5
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/become_an_organisation_navbar.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/borders.png b/img/dashboard/portal-management/enterprise-portal/borders.png
new file mode 100644
index 0000000000..545c172856
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/borders.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/buttons.png b/img/dashboard/portal-management/enterprise-portal/buttons.png
new file mode 100644
index 0000000000..8ddb9fd4b0
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/buttons.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/compress-a-theme.png b/img/dashboard/portal-management/enterprise-portal/compress-a-theme.png
new file mode 100644
index 0000000000..e2875ef547
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/compress-a-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/configure-api-products-for-the-dcr-flow-okta.png b/img/dashboard/portal-management/enterprise-portal/configure-api-products-for-the-dcr-flow-okta.png
new file mode 100644
index 0000000000..322dd8ec1d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/configure-api-products-for-the-dcr-flow-okta.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/configure-api-products-for-the-dcr-flow.png b/img/dashboard/portal-management/enterprise-portal/configure-api-products-for-the-dcr-flow.png
new file mode 100644
index 0000000000..405d6ed9c5
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/configure-api-products-for-the-dcr-flow.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/configure-plan-for-the-dcr-flow.png b/img/dashboard/portal-management/enterprise-portal/configure-plan-for-the-dcr-flow.png
new file mode 100644
index 0000000000..db679afe06
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/configure-plan-for-the-dcr-flow.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/configure-type-of-client-okta.png b/img/dashboard/portal-management/enterprise-portal/configure-type-of-client-okta.png
new file mode 100644
index 0000000000..04a49f0875
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/configure-type-of-client-okta.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/configure-type-of-client.png b/img/dashboard/portal-management/enterprise-portal/configure-type-of-client.png
new file mode 100644
index 0000000000..7d38e67a58
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/configure-type-of-client.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/configuring-custom-rate-limit-keys.png b/img/dashboard/portal-management/enterprise-portal/configuring-custom-rate-limit-keys.png
new file mode 100644
index 0000000000..9959f111b9
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/configuring-custom-rate-limit-keys.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/copy-oauth-credentials.png b/img/dashboard/portal-management/enterprise-portal/copy-oauth-credentials.png
new file mode 100644
index 0000000000..75b8eec834
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/copy-oauth-credentials.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/create-account.png b/img/dashboard/portal-management/enterprise-portal/create-account.png
new file mode 100644
index 0000000000..ab70e51f52
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/create-account.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/create-b2b-customer-org.png b/img/dashboard/portal-management/enterprise-portal/create-b2b-customer-org.png
new file mode 100644
index 0000000000..d7dfd86133
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/create-b2b-customer-org.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/create-jwt-policy-for-plan.png b/img/dashboard/portal-management/enterprise-portal/create-jwt-policy-for-plan.png
new file mode 100644
index 0000000000..edd5994b33
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/create-jwt-policy-for-plan.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/create-jwt-policy-for-product.png b/img/dashboard/portal-management/enterprise-portal/create-jwt-policy-for-product.png
new file mode 100644
index 0000000000..689c205d2c
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/create-jwt-policy-for-product.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/create-new-page1.png b/img/dashboard/portal-management/enterprise-portal/create-new-page1.png
new file mode 100644
index 0000000000..dbf7451f36
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/create-new-page1.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/create-noop-api.png b/img/dashboard/portal-management/enterprise-portal/create-noop-api.png
new file mode 100644
index 0000000000..e4fea60463
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/create-noop-api.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/create-noop-policy.png b/img/dashboard/portal-management/enterprise-portal/create-noop-policy.png
new file mode 100644
index 0000000000..64cb01ab77
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/create-noop-policy.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/credential-metadata.png b/img/dashboard/portal-management/enterprise-portal/credential-metadata.png
new file mode 100644
index 0000000000..4827aa03d0
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/credential-metadata.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/curity-add-scope.jpg b/img/dashboard/portal-management/enterprise-portal/curity-add-scope.jpg
new file mode 100644
index 0000000000..03e20f1734
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/curity-add-scope.jpg differ
diff --git a/img/dashboard/portal-management/enterprise-portal/curity-client-type.jpg b/img/dashboard/portal-management/enterprise-portal/curity-client-type.jpg
new file mode 100644
index 0000000000..fa4d32e6b6
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/curity-client-type.jpg differ
diff --git a/img/dashboard/portal-management/enterprise-portal/curity-enable-product-dcr.jpg b/img/dashboard/portal-management/enterprise-portal/curity-enable-product-dcr.jpg
new file mode 100644
index 0000000000..4d41040cd4
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/curity-enable-product-dcr.jpg differ
diff --git a/img/dashboard/portal-management/enterprise-portal/curity-name-scope-plan.jpg b/img/dashboard/portal-management/enterprise-portal/curity-name-scope-plan.jpg
new file mode 100644
index 0000000000..2c0cf5b82d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/curity-name-scope-plan.jpg differ
diff --git a/img/dashboard/portal-management/enterprise-portal/curity-name-scope-product.jpg b/img/dashboard/portal-management/enterprise-portal/curity-name-scope-product.jpg
new file mode 100644
index 0000000000..6bb312f980
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/curity-name-scope-product.jpg differ
diff --git a/img/dashboard/portal-management/enterprise-portal/curity-oauth-provider.jpg b/img/dashboard/portal-management/enterprise-portal/curity-oauth-provider.jpg
new file mode 100644
index 0000000000..94a91d6424
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/curity-oauth-provider.jpg differ
diff --git a/img/dashboard/portal-management/enterprise-portal/custom-attribute-in-the-sign-up-form.png b/img/dashboard/portal-management/enterprise-portal/custom-attribute-in-the-sign-up-form.png
new file mode 100644
index 0000000000..489f5b810d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/custom-attribute-in-the-sign-up-form.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/default-theme-is-current.png b/img/dashboard/portal-management/enterprise-portal/default-theme-is-current.png
new file mode 100644
index 0000000000..ec1c918375
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/default-theme-is-current.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/default_from_email_settings.png b/img/dashboard/portal-management/enterprise-portal/default_from_email_settings.png
new file mode 100644
index 0000000000..96001bc9da
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/default_from_email_settings.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/delete-a-menu-item.png b/img/dashboard/portal-management/enterprise-portal/delete-a-menu-item.png
new file mode 100644
index 0000000000..fc565b6df5
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/delete-a-menu-item.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/download-a-theme.png b/img/dashboard/portal-management/enterprise-portal/download-a-theme.png
new file mode 100644
index 0000000000..6ab88371ad
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/download-a-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/download-default-theme.png b/img/dashboard/portal-management/enterprise-portal/download-default-theme.png
new file mode 100644
index 0000000000..485407f731
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/download-default-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/dropdown-menu-item.png b/img/dashboard/portal-management/enterprise-portal/dropdown-menu-item.png
new file mode 100644
index 0000000000..7a5073dff1
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/dropdown-menu-item.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/edit-menu-item.png b/img/dashboard/portal-management/enterprise-portal/edit-menu-item.png
new file mode 100644
index 0000000000..8e75657f7e
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/edit-menu-item.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/edit-menu.png b/img/dashboard/portal-management/enterprise-portal/edit-menu.png
new file mode 100644
index 0000000000..baebdc4bf1
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/edit-menu.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/edp-configure-webhook-channel.png b/img/dashboard/portal-management/enterprise-portal/edp-configure-webhook-channel.png
new file mode 100644
index 0000000000..ceea287ee3
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/edp-configure-webhook-channel.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/edp-select-webhook-events-for-channel.png b/img/dashboard/portal-management/enterprise-portal/edp-select-webhook-events-for-channel.png
new file mode 100644
index 0000000000..92a85bf914
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/edp-select-webhook-events-for-channel.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/email_subjects_settings.png b/img/dashboard/portal-management/enterprise-portal/email_subjects_settings.png
new file mode 100644
index 0000000000..4e8078b5f9
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/email_subjects_settings.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/enable-scope-to-policy-mapping.png b/img/dashboard/portal-management/enterprise-portal/enable-scope-to-policy-mapping.png
new file mode 100644
index 0000000000..52b93269e8
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/enable-scope-to-policy-mapping.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/example-portal-content-block.png b/img/dashboard/portal-management/enterprise-portal/example-portal-content-block.png
new file mode 100644
index 0000000000..50eb00dabc
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/example-portal-content-block.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/forgot-password-email.png b/img/dashboard/portal-management/enterprise-portal/forgot-password-email.png
new file mode 100644
index 0000000000..8e130ad9ec
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/forgot-password-email.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/forgot-password.png b/img/dashboard/portal-management/enterprise-portal/forgot-password.png
new file mode 100644
index 0000000000..9134a57e58
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/forgot-password.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/fork-portal-theme-repo.png b/img/dashboard/portal-management/enterprise-portal/fork-portal-theme-repo.png
new file mode 100644
index 0000000000..6fa9e6d663
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/fork-portal-theme-repo.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/go-template-ui.png b/img/dashboard/portal-management/enterprise-portal/go-template-ui.png
new file mode 100644
index 0000000000..ee8f5ad71f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/go-template-ui.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/invite-code-dialog.png b/img/dashboard/portal-management/enterprise-portal/invite-code-dialog.png
new file mode 100644
index 0000000000..ec2824d709
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/invite-code-dialog.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/invite-codes.png b/img/dashboard/portal-management/enterprise-portal/invite-codes.png
new file mode 100644
index 0000000000..434986742a
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/invite-codes.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/jwt.png b/img/dashboard/portal-management/enterprise-portal/jwt.png
new file mode 100644
index 0000000000..0cf55699c8
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/jwt.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/login-page-after-bootstrapping.png b/img/dashboard/portal-management/enterprise-portal/login-page-after-bootstrapping.png
new file mode 100644
index 0000000000..d97f04f90e
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/login-page-after-bootstrapping.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/login-portal-forgot.png b/img/dashboard/portal-management/enterprise-portal/login-portal-forgot.png
new file mode 100644
index 0000000000..a3c4671e48
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/login-portal-forgot.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/mailers-folder.png b/img/dashboard/portal-management/enterprise-portal/mailers-folder.png
new file mode 100644
index 0000000000..1bccf067b7
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/mailers-folder.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/menu-item.png b/img/dashboard/portal-management/enterprise-portal/menu-item.png
new file mode 100644
index 0000000000..96fdb55ccb
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/menu-item.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/modified-theme-is-active.png b/img/dashboard/portal-management/enterprise-portal/modified-theme-is-active.png
new file mode 100644
index 0000000000..d5c163cc97
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/modified-theme-is-active.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/my-first-page-example.png b/img/dashboard/portal-management/enterprise-portal/my-first-page-example.png
new file mode 100644
index 0000000000..eea17508b7
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/my-first-page-example.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/navigate-to-catalogues.png b/img/dashboard/portal-management/enterprise-portal/navigate-to-catalogues.png
new file mode 100644
index 0000000000..76ab9f42c5
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/navigate-to-catalogues.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/navigate-to-organisations.png b/img/dashboard/portal-management/enterprise-portal/navigate-to-organisations.png
new file mode 100644
index 0000000000..269d435c32
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/navigate-to-organisations.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/navigate-to-the-api-menu-in-the-tyk-dashboard.png b/img/dashboard/portal-management/enterprise-portal/navigate-to-the-api-menu-in-the-tyk-dashboard.png
new file mode 100644
index 0000000000..9cb29ce678
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/navigate-to-the-api-menu-in-the-tyk-dashboard.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/navigate-to-the-api.png b/img/dashboard/portal-management/enterprise-portal/navigate-to-the-api.png
new file mode 100644
index 0000000000..dfbf71636d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/navigate-to-the-api.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/navigate-to-the-login-page.png b/img/dashboard/portal-management/enterprise-portal/navigate-to-the-login-page.png
new file mode 100644
index 0000000000..012b84ea68
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/navigate-to-the-login-page.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/navigate-to-the-policies-menu.png b/img/dashboard/portal-management/enterprise-portal/navigate-to-the-policies-menu.png
new file mode 100644
index 0000000000..6a55e1209f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/navigate-to-the-policies-menu.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/navigate-to-user-attributes.png b/img/dashboard/portal-management/enterprise-portal/navigate-to-user-attributes.png
new file mode 100644
index 0000000000..68d819cba4
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/navigate-to-user-attributes.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/navigation-to-menus-section.png b/img/dashboard/portal-management/enterprise-portal/navigation-to-menus-section.png
new file mode 100644
index 0000000000..c2e228e817
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/navigation-to-menus-section.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/new-menu-item-on-the-live-portal.png b/img/dashboard/portal-management/enterprise-portal/new-menu-item-on-the-live-portal.png
new file mode 100644
index 0000000000..2b73d691d0
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/new-menu-item-on-the-live-portal.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/new-theme-is-created.png b/img/dashboard/portal-management/enterprise-portal/new-theme-is-created.png
new file mode 100644
index 0000000000..cded1da455
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/new-theme-is-created.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/new_org_request_email.png b/img/dashboard/portal-management/enterprise-portal/new_org_request_email.png
new file mode 100644
index 0000000000..79a4ed3ce2
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/new_org_request_email.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/okta-api-page.png b/img/dashboard/portal-management/enterprise-portal/okta-api-page.png
new file mode 100644
index 0000000000..d8d55ef994
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/okta-api-page.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/okta-free-plan-scope.png b/img/dashboard/portal-management/enterprise-portal/okta-free-plan-scope.png
new file mode 100644
index 0000000000..b9f43fbc8f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/okta-free-plan-scope.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/okta-product-payment.png b/img/dashboard/portal-management/enterprise-portal/okta-product-payment.png
new file mode 100644
index 0000000000..547667f255
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/okta-product-payment.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/old-keycloak-version-client-scope.png b/img/dashboard/portal-management/enterprise-portal/old-keycloak-version-client-scope.png
new file mode 100644
index 0000000000..47e574daa1
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/old-keycloak-version-client-scope.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/org_registration_is_approved.png b/img/dashboard/portal-management/enterprise-portal/org_registration_is_approved.png
new file mode 100644
index 0000000000..60300fd699
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/org_registration_is_approved.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/org_registration_is_pending.png b/img/dashboard/portal-management/enterprise-portal/org_registration_is_pending.png
new file mode 100644
index 0000000000..6486d54dea
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/org_registration_is_pending.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/page-content-edit.png b/img/dashboard/portal-management/enterprise-portal/page-content-edit.png
new file mode 100644
index 0000000000..ccfb0bdd6a
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/page-content-edit.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/pending_org_registration_admin.png b/img/dashboard/portal-management/enterprise-portal/pending_org_registration_admin.png
new file mode 100644
index 0000000000..0eb0130ca7
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/pending_org_registration_admin.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-add-api-product.png b/img/dashboard/portal-management/enterprise-portal/portal-add-api-product.png
new file mode 100644
index 0000000000..3e4c3dd926
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-add-api-product.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-add-plan.png b/img/dashboard/portal-management/enterprise-portal/portal-add-plan.png
new file mode 100644
index 0000000000..6e9c2c507d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-add-plan.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-apps-structure.png b/img/dashboard/portal-management/enterprise-portal/portal-apps-structure.png
new file mode 100644
index 0000000000..145d34c676
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-apps-structure.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-bootstrap-successful.png b/img/dashboard/portal-management/enterprise-portal/portal-bootstrap-successful.png
new file mode 100644
index 0000000000..94f4eb24cb
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-bootstrap-successful.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-bootstrap-ui-empty.png b/img/dashboard/portal-management/enterprise-portal/portal-bootstrap-ui-empty.png
new file mode 100644
index 0000000000..47dae18070
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-bootstrap-ui-empty.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-catalogue-sample-set-up.png b/img/dashboard/portal-management/enterprise-portal/portal-catalogue-sample-set-up.png
new file mode 100644
index 0000000000..7ab1d3b764
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-catalogue-sample-set-up.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-content-manager-flow.png b/img/dashboard/portal-management/enterprise-portal/portal-content-manager-flow.png
new file mode 100644
index 0000000000..ed3a7df05d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-content-manager-flow.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-deployment-diagram.png b/img/dashboard/portal-management/enterprise-portal/portal-deployment-diagram.png
new file mode 100644
index 0000000000..000020d7e2
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-deployment-diagram.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-diagram-api-providers.png b/img/dashboard/portal-management/enterprise-portal/portal-diagram-api-providers.png
new file mode 100644
index 0000000000..e18a11528e
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-diagram-api-providers.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-doc-only-product.png b/img/dashboard/portal-management/enterprise-portal/portal-doc-only-product.png
new file mode 100644
index 0000000000..49ef868a9f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-doc-only-product.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-fe-develop-flow.png b/img/dashboard/portal-management/enterprise-portal/portal-fe-develop-flow.png
new file mode 100644
index 0000000000..1015b57e75
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-fe-develop-flow.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-menu-live.png b/img/dashboard/portal-management/enterprise-portal/portal-menu-live.png
new file mode 100644
index 0000000000..cd3543eac2
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-menu-live.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-plan-advanced-settings.png b/img/dashboard/portal-management/enterprise-portal/portal-plan-advanced-settings.png
new file mode 100644
index 0000000000..5978a6faa6
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-plan-advanced-settings.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-plan-details.png b/img/dashboard/portal-management/enterprise-portal/portal-plan-details.png
new file mode 100644
index 0000000000..2e93cc5c96
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-plan-details.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-plan-limits.png b/img/dashboard/portal-management/enterprise-portal/portal-plan-limits.png
new file mode 100644
index 0000000000..7739a3f397
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-plan-limits.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-product-api-specs.png b/img/dashboard/portal-management/enterprise-portal/portal-product-api-specs.png
new file mode 100644
index 0000000000..81c4cb02cf
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-product-api-specs.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-product-apis.png b/img/dashboard/portal-management/enterprise-portal/portal-product-apis.png
new file mode 100644
index 0000000000..af37d6ee0f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-product-apis.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-product-customize.png b/img/dashboard/portal-management/enterprise-portal/portal-product-customize.png
new file mode 100644
index 0000000000..fa4b3fc446
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-product-customize.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-product-dcr.png b/img/dashboard/portal-management/enterprise-portal/portal-product-dcr.png
new file mode 100644
index 0000000000..93043eec3a
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-product-dcr.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-product-details.png b/img/dashboard/portal-management/enterprise-portal/portal-product-details.png
new file mode 100644
index 0000000000..cfee44b9b9
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-product-details.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-product-guides.png b/img/dashboard/portal-management/enterprise-portal/portal-product-guides.png
new file mode 100644
index 0000000000..41bbb76981
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-product-guides.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-provisioning-flow.png b/img/dashboard/portal-management/enterprise-portal/portal-provisioning-flow.png
new file mode 100644
index 0000000000..bd837cd82f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-provisioning-flow.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-login.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-login.png
new file mode 100644
index 0000000000..1bd2946530
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-login.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor-admin.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor-admin.png
new file mode 100644
index 0000000000..8c4c777c70
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor-admin.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor-dev.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor-dev.png
new file mode 100644
index 0000000000..087bb16d5f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor-dev.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor.png
new file mode 100644
index 0000000000..9c02b0b9b0
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-admin-1.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-admin-1.png
new file mode 100644
index 0000000000..c8bc7450d7
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-admin-1.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-admin-4.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-admin-4.png
new file mode 100644
index 0000000000..f9f9148f1b
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-admin-4.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-1.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-1.png
new file mode 100644
index 0000000000..7911b861e4
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-1.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-2.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-2.png
new file mode 100644
index 0000000000..f73c71cd98
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-2.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-3.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-3.png
new file mode 100644
index 0000000000..d8924e68aa
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-3.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-4.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-4.png
new file mode 100644
index 0000000000..7999f78bc1
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-4.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-profile-config.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-profile-config.png
new file mode 100644
index 0000000000..431b39c024
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-profile-config.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-provider.png b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-provider.png
new file mode 100644
index 0000000000..e828d703ff
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-provider.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/portal-template-layout.png b/img/dashboard/portal-management/enterprise-portal/portal-template-layout.png
new file mode 100644
index 0000000000..f0d2d83b43
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/portal-template-layout.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/preview-theme-button.png b/img/dashboard/portal-management/enterprise-portal/preview-theme-button.png
new file mode 100644
index 0000000000..7f186ef82d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/preview-theme-button.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/quit-theme-preview.png b/img/dashboard/portal-management/enterprise-portal/quit-theme-preview.png
new file mode 100644
index 0000000000..0cd4aeef74
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/quit-theme-preview.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/regular-menu-item.png b/img/dashboard/portal-management/enterprise-portal/regular-menu-item.png
new file mode 100644
index 0000000000..866cb75ab5
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/regular-menu-item.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/rename-a-theme.png b/img/dashboard/portal-management/enterprise-portal/rename-a-theme.png
new file mode 100644
index 0000000000..44a65f279d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/rename-a-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/request-access-to-the-dcr-enabled-product.png b/img/dashboard/portal-management/enterprise-portal/request-access-to-the-dcr-enabled-product.png
new file mode 100644
index 0000000000..182028ee72
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/request-access-to-the-dcr-enabled-product.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/reset-done.png b/img/dashboard/portal-management/enterprise-portal/reset-done.png
new file mode 100644
index 0000000000..51c804fbba
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/reset-done.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/reset-password-request.png b/img/dashboard/portal-management/enterprise-portal/reset-password-request.png
new file mode 100644
index 0000000000..ce52171cc0
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/reset-password-request.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/save-changes-to-theme.png b/img/dashboard/portal-management/enterprise-portal/save-changes-to-theme.png
new file mode 100644
index 0000000000..858d85cdf5
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/save-changes-to-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/save-new-menu-item.png b/img/dashboard/portal-management/enterprise-portal/save-new-menu-item.png
new file mode 100644
index 0000000000..0d80c10e1f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/save-new-menu-item.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/save-new-theme.png b/img/dashboard/portal-management/enterprise-portal/save-new-theme.png
new file mode 100644
index 0000000000..4b5a7dee98
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/save-new-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/save-the-noop-api.png b/img/dashboard/portal-management/enterprise-portal/save-the-noop-api.png
new file mode 100644
index 0000000000..5940f14f27
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/save-the-noop-api.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/save-the-noop-policy.png b/img/dashboard/portal-management/enterprise-portal/save-the-noop-policy.png
new file mode 100644
index 0000000000..e2553a7c94
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/save-the-noop-policy.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/scenario-correlation-diagram.png b/img/dashboard/portal-management/enterprise-portal/scenario-correlation-diagram.png
new file mode 100644
index 0000000000..eb01b1c245
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/scenario-correlation-diagram.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/select-a-menu.png b/img/dashboard/portal-management/enterprise-portal/select-a-menu.png
new file mode 100644
index 0000000000..aa0ac3755e
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/select-a-menu.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/select-a-modified-theme.png b/img/dashboard/portal-management/enterprise-portal/select-a-modified-theme.png
new file mode 100644
index 0000000000..c709cbd355
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/select-a-modified-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/select-a-theme-file.png b/img/dashboard/portal-management/enterprise-portal/select-a-theme-file.png
new file mode 100644
index 0000000000..ade6c489d8
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/select-a-theme-file.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/select-signing-method.png b/img/dashboard/portal-management/enterprise-portal/select-signing-method.png
new file mode 100644
index 0000000000..1da2243a27
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/select-signing-method.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/select-the-default-policy.png b/img/dashboard/portal-management/enterprise-portal/select-the-default-policy.png
new file mode 100644
index 0000000000..976ea69938
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/select-the-default-policy.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/share-invite-codes.png b/img/dashboard/portal-management/enterprise-portal/share-invite-codes.png
new file mode 100644
index 0000000000..61caaed8c1
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/share-invite-codes.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/smtp_settings.png b/img/dashboard/portal-management/enterprise-portal/smtp_settings.png
new file mode 100644
index 0000000000..77d6e2ef32
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/smtp_settings.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/specify-connection-setting-to-your-idp-okta.png b/img/dashboard/portal-management/enterprise-portal/specify-connection-setting-to-your-idp-okta.png
new file mode 100644
index 0000000000..1bd4ff691e
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/specify-connection-setting-to-your-idp-okta.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/specify-connection-setting-to-your-idp.png b/img/dashboard/portal-management/enterprise-portal/specify-connection-setting-to-your-idp.png
new file mode 100644
index 0000000000..7257e6d466
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/specify-connection-setting-to-your-idp.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/specify-name-of-catalogue.png b/img/dashboard/portal-management/enterprise-portal/specify-name-of-catalogue.png
new file mode 100644
index 0000000000..f4260b0ddc
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/specify-name-of-catalogue.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/specify_name_of_an_organisation.png b/img/dashboard/portal-management/enterprise-portal/specify_name_of_an_organisation.png
new file mode 100644
index 0000000000..d54b8f077c
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/specify_name_of_an_organisation.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/step-1-navigate-to-the-client-scopes-menu.png b/img/dashboard/portal-management/enterprise-portal/step-1-navigate-to-the-client-scopes-menu.png
new file mode 100644
index 0000000000..fef327591d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/step-1-navigate-to-the-client-scopes-menu.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/step-2-create-a-scope-for-an-api-product.png b/img/dashboard/portal-management/enterprise-portal/step-2-create-a-scope-for-an-api-product.png
new file mode 100644
index 0000000000..108adbb128
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/step-2-create-a-scope-for-an-api-product.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/step-3-create-a-scope-for-a-plan.png b/img/dashboard/portal-management/enterprise-portal/step-3-create-a-scope-for-a-plan.png
new file mode 100644
index 0000000000..e3318c7f88
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/step-3-create-a-scope-for-a-plan.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/tags-diagram.png b/img/dashboard/portal-management/enterprise-portal/tags-diagram.png
new file mode 100644
index 0000000000..50bb8c3b4b
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/tags-diagram.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/text-colors.png b/img/dashboard/portal-management/enterprise-portal/text-colors.png
new file mode 100644
index 0000000000..3c77a9478d
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/text-colors.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/theme-file-structure.png b/img/dashboard/portal-management/enterprise-portal/theme-file-structure.png
new file mode 100644
index 0000000000..570ee3f487
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/theme-file-structure.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/theme-preview.png b/img/dashboard/portal-management/enterprise-portal/theme-preview.png
new file mode 100644
index 0000000000..a550a1b59f
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/theme-preview.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/top-nav-menu.png b/img/dashboard/portal-management/enterprise-portal/top-nav-menu.png
new file mode 100644
index 0000000000..b6e555be2c
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/top-nav-menu.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/upload-a-theme.png b/img/dashboard/portal-management/enterprise-portal/upload-a-theme.png
new file mode 100644
index 0000000000..e66644e7ea
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/upload-a-theme.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/user-group-mapping-algorithm.png b/img/dashboard/portal-management/enterprise-portal/user-group-mapping-algorithm.png
new file mode 100644
index 0000000000..0a81442bcd
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/user-group-mapping-algorithm.png differ
diff --git a/img/dashboard/portal-management/enterprise-portal/user-group-mapping.png b/img/dashboard/portal-management/enterprise-portal/user-group-mapping.png
new file mode 100644
index 0000000000..8c8bdce99a
Binary files /dev/null and b/img/dashboard/portal-management/enterprise-portal/user-group-mapping.png differ
diff --git a/img/dashboard/portal-management/keys_dev_profile.png b/img/dashboard/portal-management/keys_dev_profile.png
new file mode 100644
index 0000000000..12971b23c6
Binary files /dev/null and b/img/dashboard/portal-management/keys_dev_profile.png differ
diff --git a/img/dashboard/portal-management/login_screen.png b/img/dashboard/portal-management/login_screen.png
new file mode 100644
index 0000000000..89673784ac
Binary files /dev/null and b/img/dashboard/portal-management/login_screen.png differ
diff --git a/img/dashboard/portal-management/multi-api-per-request.png b/img/dashboard/portal-management/multi-api-per-request.png
new file mode 100644
index 0000000000..b44175e4ac
Binary files /dev/null and b/img/dashboard/portal-management/multi-api-per-request.png differ
diff --git a/img/dashboard/portal-management/multi-api-setting.png b/img/dashboard/portal-management/multi-api-setting.png
new file mode 100644
index 0000000000..f0039c9e63
Binary files /dev/null and b/img/dashboard/portal-management/multi-api-setting.png differ
diff --git a/img/dashboard/portal-management/new_custom_page.png b/img/dashboard/portal-management/new_custom_page.png
new file mode 100644
index 0000000000..0f6524e7df
Binary files /dev/null and b/img/dashboard/portal-management/new_custom_page.png differ
diff --git a/img/dashboard/portal-management/new_key_request.png b/img/dashboard/portal-management/new_key_request.png
new file mode 100644
index 0000000000..3e8098cc64
Binary files /dev/null and b/img/dashboard/portal-management/new_key_request.png differ
diff --git a/img/dashboard/portal-management/no_user_logged_in.jpg b/img/dashboard/portal-management/no_user_logged_in.jpg
new file mode 100644
index 0000000000..8c6311b050
Binary files /dev/null and b/img/dashboard/portal-management/no_user_logged_in.jpg differ
diff --git a/img/dashboard/portal-management/oauth_client_secrets.png b/img/dashboard/portal-management/oauth_client_secrets.png
new file mode 100644
index 0000000000..7ebaa69c92
Binary files /dev/null and b/img/dashboard/portal-management/oauth_client_secrets.png differ
diff --git a/img/dashboard/portal-management/page_settings_2.5.png b/img/dashboard/portal-management/page_settings_2.5.png
new file mode 100644
index 0000000000..0e3856a7a3
Binary files /dev/null and b/img/dashboard/portal-management/page_settings_2.5.png differ
diff --git a/img/dashboard/portal-management/password_confirmation.png b/img/dashboard/portal-management/password_confirmation.png
new file mode 100644
index 0000000000..8b744f12d5
Binary files /dev/null and b/img/dashboard/portal-management/password_confirmation.png differ
diff --git a/img/dashboard/portal-management/password_request.png b/img/dashboard/portal-management/password_request.png
new file mode 100644
index 0000000000..50ffcaf54b
Binary files /dev/null and b/img/dashboard/portal-management/password_request.png differ
diff --git a/img/dashboard/portal-management/portal_catalogue_field_group.png b/img/dashboard/portal-management/portal_catalogue_field_group.png
new file mode 100644
index 0000000000..bbd8cd0a89
Binary files /dev/null and b/img/dashboard/portal-management/portal_catalogue_field_group.png differ
diff --git a/img/dashboard/portal-management/portal_email_css.png b/img/dashboard/portal-management/portal_email_css.png
new file mode 100644
index 0000000000..268965002e
Binary files /dev/null and b/img/dashboard/portal-management/portal_email_css.png differ
diff --git a/img/dashboard/portal-management/portal_first-oauth_client.png b/img/dashboard/portal-management/portal_first-oauth_client.png
new file mode 100644
index 0000000000..8bbe1386c3
Binary files /dev/null and b/img/dashboard/portal-management/portal_first-oauth_client.png differ
diff --git a/img/dashboard/portal-management/portal_man_css.png b/img/dashboard/portal-management/portal_man_css.png
new file mode 100644
index 0000000000..da0c3a2122
Binary files /dev/null and b/img/dashboard/portal-management/portal_man_css.png differ
diff --git a/img/dashboard/portal-management/portal_menu_dropdown_2.5.png b/img/dashboard/portal-management/portal_menu_dropdown_2.5.png
new file mode 100644
index 0000000000..abc9f83ee5
Binary files /dev/null and b/img/dashboard/portal-management/portal_menu_dropdown_2.5.png differ
diff --git a/img/dashboard/portal-management/portal_menus_2.5.png b/img/dashboard/portal-management/portal_menus_2.5.png
new file mode 100644
index 0000000000..876ffe5029
Binary files /dev/null and b/img/dashboard/portal-management/portal_menus_2.5.png differ
diff --git a/img/dashboard/portal-management/portal_nav_menus_2.5.png b/img/dashboard/portal-management/portal_nav_menus_2.5.png
new file mode 100644
index 0000000000..7ca00632e3
Binary files /dev/null and b/img/dashboard/portal-management/portal_nav_menus_2.5.png differ
diff --git a/img/dashboard/portal-management/portal_oauth_connected_api2.png b/img/dashboard/portal-management/portal_oauth_connected_api2.png
new file mode 100644
index 0000000000..ecdd89a0e1
Binary files /dev/null and b/img/dashboard/portal-management/portal_oauth_connected_api2.png differ
diff --git a/img/dashboard/portal-management/portal_oauth_select_api2.png b/img/dashboard/portal-management/portal_oauth_select_api2.png
new file mode 100644
index 0000000000..3d592c0f0a
Binary files /dev/null and b/img/dashboard/portal-management/portal_oauth_select_api2.png differ
diff --git a/img/dashboard/portal-management/portal_redirect_2.5.png b/img/dashboard/portal-management/portal_redirect_2.5.png
new file mode 100644
index 0000000000..a19cb1ab92
Binary files /dev/null and b/img/dashboard/portal-management/portal_redirect_2.5.png differ
diff --git a/img/dashboard/portal-management/portal_site_css.png b/img/dashboard/portal-management/portal_site_css.png
new file mode 100644
index 0000000000..3be94a66c6
Binary files /dev/null and b/img/dashboard/portal-management/portal_site_css.png differ
diff --git a/img/dashboard/portal-management/redoc-petstore-tyk.png b/img/dashboard/portal-management/redoc-petstore-tyk.png
new file mode 100644
index 0000000000..b0449c52fa
Binary files /dev/null and b/img/dashboard/portal-management/redoc-petstore-tyk.png differ
diff --git a/img/dashboard/portal-management/secure_key_approval_email.png b/img/dashboard/portal-management/secure_key_approval_email.png
new file mode 100644
index 0000000000..664a17fdd4
Binary files /dev/null and b/img/dashboard/portal-management/secure_key_approval_email.png differ
diff --git a/img/dashboard/portal-management/secure_key_approval_generate.png b/img/dashboard/portal-management/secure_key_approval_generate.png
new file mode 100644
index 0000000000..a9bf8bb3da
Binary files /dev/null and b/img/dashboard/portal-management/secure_key_approval_generate.png differ
diff --git a/img/dashboard/portal-management/secure_key_approval_setting.png b/img/dashboard/portal-management/secure_key_approval_setting.png
new file mode 100644
index 0000000000..43a5e52b9d
Binary files /dev/null and b/img/dashboard/portal-management/secure_key_approval_setting.png differ
diff --git a/img/dashboard/system-management/add_webhook.png b/img/dashboard/system-management/add_webhook.png
new file mode 100644
index 0000000000..f9f50b96de
Binary files /dev/null and b/img/dashboard/system-management/add_webhook.png differ
diff --git a/img/dashboard/system-management/api-protocol.png b/img/dashboard/system-management/api-protocol.png
new file mode 100644
index 0000000000..8acc0cacd6
Binary files /dev/null and b/img/dashboard/system-management/api-protocol.png differ
diff --git a/img/dashboard/system-management/api_limits_query_depth.png b/img/dashboard/system-management/api_limits_query_depth.png
new file mode 100644
index 0000000000..0536264c8c
Binary files /dev/null and b/img/dashboard/system-management/api_limits_query_depth.png differ
diff --git a/img/dashboard/system-management/api_ownership.png b/img/dashboard/system-management/api_ownership.png
new file mode 100644
index 0000000000..ee2dd0cd04
Binary files /dev/null and b/img/dashboard/system-management/api_ownership.png differ
diff --git a/img/dashboard/system-management/api_settings.png b/img/dashboard/system-management/api_settings.png
new file mode 100644
index 0000000000..31c1797622
Binary files /dev/null and b/img/dashboard/system-management/api_settings.png differ
diff --git a/img/dashboard/system-management/bootstrap_screen.png b/img/dashboard/system-management/bootstrap_screen.png
new file mode 100644
index 0000000000..9f36e1d08c
Binary files /dev/null and b/img/dashboard/system-management/bootstrap_screen.png differ
diff --git a/img/dashboard/system-management/context_variables.png b/img/dashboard/system-management/context_variables.png
new file mode 100644
index 0000000000..ea42f86baa
Binary files /dev/null and b/img/dashboard/system-management/context_variables.png differ
diff --git a/img/dashboard/system-management/context_variables_ui.jpg b/img/dashboard/system-management/context_variables_ui.jpg
new file mode 100644
index 0000000000..641ff6402e
Binary files /dev/null and b/img/dashboard/system-management/context_variables_ui.jpg differ
diff --git a/img/dashboard/system-management/create-access-key-for-request-throttling.png b/img/dashboard/system-management/create-access-key-for-request-throttling.png
new file mode 100644
index 0000000000..80d96f1d4d
Binary files /dev/null and b/img/dashboard/system-management/create-access-key-for-request-throttling.png differ
diff --git a/img/dashboard/system-management/custom_grpc_authentication.png b/img/dashboard/system-management/custom_grpc_authentication.png
new file mode 100644
index 0000000000..82dd31387d
Binary files /dev/null and b/img/dashboard/system-management/custom_grpc_authentication.png differ
diff --git a/img/dashboard/system-management/dashboard_login.png b/img/dashboard/system-management/dashboard_login.png
new file mode 100644
index 0000000000..7023166097
Binary files /dev/null and b/img/dashboard/system-management/dashboard_login.png differ
diff --git a/img/dashboard/system-management/debugging_request.png b/img/dashboard/system-management/debugging_request.png
new file mode 100644
index 0000000000..7f70155c52
Binary files /dev/null and b/img/dashboard/system-management/debugging_request.png differ
diff --git a/img/dashboard/system-management/field-based-permissions-allowlist.png b/img/dashboard/system-management/field-based-permissions-allowlist.png
new file mode 100644
index 0000000000..0545d340a4
Binary files /dev/null and b/img/dashboard/system-management/field-based-permissions-allowlist.png differ
diff --git a/img/dashboard/system-management/field-based-permissions-blocklist.png b/img/dashboard/system-management/field-based-permissions-blocklist.png
new file mode 100644
index 0000000000..b43f0370d5
Binary files /dev/null and b/img/dashboard/system-management/field-based-permissions-blocklist.png differ
diff --git a/img/dashboard/system-management/global_limits_query_depth.png b/img/dashboard/system-management/global_limits_query_depth.png
new file mode 100644
index 0000000000..436803c8f8
Binary files /dev/null and b/img/dashboard/system-management/global_limits_query_depth.png differ
diff --git a/img/dashboard/system-management/import_tyk_definition.png b/img/dashboard/system-management/import_tyk_definition.png
new file mode 100644
index 0000000000..908b4a6573
Binary files /dev/null and b/img/dashboard/system-management/import_tyk_definition.png differ
diff --git a/img/dashboard/system-management/list-api-urls.png b/img/dashboard/system-management/list-api-urls.png
new file mode 100644
index 0000000000..5ad9f53bc7
Binary files /dev/null and b/img/dashboard/system-management/list-api-urls.png differ
diff --git a/img/dashboard/system-management/list-gateways.png b/img/dashboard/system-management/list-gateways.png
new file mode 100644
index 0000000000..1c5a86a390
Binary files /dev/null and b/img/dashboard/system-management/list-gateways.png differ
diff --git a/img/dashboard/system-management/list-segment-tags.png b/img/dashboard/system-management/list-segment-tags.png
new file mode 100644
index 0000000000..d6cd246193
Binary files /dev/null and b/img/dashboard/system-management/list-segment-tags.png differ
diff --git a/img/dashboard/system-management/modify_key_approval.png b/img/dashboard/system-management/modify_key_approval.png
new file mode 100644
index 0000000000..ef7a9f6348
Binary files /dev/null and b/img/dashboard/system-management/modify_key_approval.png differ
diff --git a/img/dashboard/system-management/oauth-auth-mode-new.png b/img/dashboard/system-management/oauth-auth-mode-new.png
new file mode 100644
index 0000000000..35a96db4a7
Binary files /dev/null and b/img/dashboard/system-management/oauth-auth-mode-new.png differ
diff --git a/img/dashboard/system-management/oauthClientAnalytics.png b/img/dashboard/system-management/oauthClientAnalytics.png
new file mode 100755
index 0000000000..f095898671
Binary files /dev/null and b/img/dashboard/system-management/oauthClientAnalytics.png differ
diff --git a/img/dashboard/system-management/oauthClientNav.png b/img/dashboard/system-management/oauthClientNav.png
new file mode 100755
index 0000000000..a180b60222
Binary files /dev/null and b/img/dashboard/system-management/oauthClientNav.png differ
diff --git a/img/dashboard/system-management/opa-rules-menu.png b/img/dashboard/system-management/opa-rules-menu.png
new file mode 100644
index 0000000000..e0ca4db043
Binary files /dev/null and b/img/dashboard/system-management/opa-rules-menu.png differ
diff --git a/img/dashboard/system-management/plugin_auth_mode.png b/img/dashboard/system-management/plugin_auth_mode.png
new file mode 100644
index 0000000000..aaab573985
Binary files /dev/null and b/img/dashboard/system-management/plugin_auth_mode.png differ
diff --git a/img/dashboard/system-management/plugin_auth_mode_2.5.png b/img/dashboard/system-management/plugin_auth_mode_2.5.png
new file mode 100644
index 0000000000..8cce2e8e84
Binary files /dev/null and b/img/dashboard/system-management/plugin_auth_mode_2.5.png differ
diff --git a/img/dashboard/system-management/plugin_options.png b/img/dashboard/system-management/plugin_options.png
new file mode 100644
index 0000000000..d014f41386
Binary files /dev/null and b/img/dashboard/system-management/plugin_options.png differ
diff --git a/img/dashboard/system-management/plugin_options_2.5.png b/img/dashboard/system-management/plugin_options_2.5.png
new file mode 100644
index 0000000000..6fda900c25
Binary files /dev/null and b/img/dashboard/system-management/plugin_options_2.5.png differ
diff --git a/img/dashboard/system-management/portal_cert_request.png b/img/dashboard/system-management/portal_cert_request.png
new file mode 100644
index 0000000000..5c2ce75889
Binary files /dev/null and b/img/dashboard/system-management/portal_cert_request.png differ
diff --git a/img/dashboard/system-management/postman-websocket-request.png b/img/dashboard/system-management/postman-websocket-request.png
new file mode 100644
index 0000000000..5ecbf4c9c4
Binary files /dev/null and b/img/dashboard/system-management/postman-websocket-request.png differ
diff --git a/img/dashboard/system-management/postman-websocket-test.png b/img/dashboard/system-management/postman-websocket-test.png
new file mode 100644
index 0000000000..ecc5452aa5
Binary files /dev/null and b/img/dashboard/system-management/postman-websocket-test.png differ
diff --git a/img/dashboard/system-management/query_limits_query_depth.png b/img/dashboard/system-management/query_limits_query_depth.png
new file mode 100644
index 0000000000..d9d3c88bc1
Binary files /dev/null and b/img/dashboard/system-management/query_limits_query_depth.png differ
diff --git a/img/dashboard/system-management/rate-limit-in-policy.png b/img/dashboard/system-management/rate-limit-in-policy.png
new file mode 100644
index 0000000000..26b22e972a
Binary files /dev/null and b/img/dashboard/system-management/rate-limit-in-policy.png differ
diff --git a/img/dashboard/system-management/raw_or_designer_mode.png b/img/dashboard/system-management/raw_or_designer_mode.png
new file mode 100644
index 0000000000..cf4b8dd442
Binary files /dev/null and b/img/dashboard/system-management/raw_or_designer_mode.png differ
diff --git a/img/dashboard/system-management/rename_headers.png b/img/dashboard/system-management/rename_headers.png
new file mode 100644
index 0000000000..d998d939f1
Binary files /dev/null and b/img/dashboard/system-management/rename_headers.png differ
diff --git a/img/dashboard/system-management/request-quotas-in-key.png b/img/dashboard/system-management/request-quotas-in-key.png
new file mode 100644
index 0000000000..13d76ccbfe
Binary files /dev/null and b/img/dashboard/system-management/request-quotas-in-key.png differ
diff --git a/img/dashboard/system-management/request-quotas-in-policy.png b/img/dashboard/system-management/request-quotas-in-policy.png
new file mode 100644
index 0000000000..6f4e8a9d56
Binary files /dev/null and b/img/dashboard/system-management/request-quotas-in-policy.png differ
diff --git a/img/dashboard/system-management/request-quotas-policy-quick-start.png b/img/dashboard/system-management/request-quotas-policy-quick-start.png
new file mode 100644
index 0000000000..b33c0dd975
Binary files /dev/null and b/img/dashboard/system-management/request-quotas-policy-quick-start.png differ
diff --git a/img/dashboard/system-management/throttling-in-policy.png b/img/dashboard/system-management/throttling-in-policy.png
new file mode 100644
index 0000000000..84cf1b098a
Binary files /dev/null and b/img/dashboard/system-management/throttling-in-policy.png differ
diff --git a/img/dashboard/system-management/tyk-bootstrap.png b/img/dashboard/system-management/tyk-bootstrap.png
new file mode 100644
index 0000000000..4675f18c83
Binary files /dev/null and b/img/dashboard/system-management/tyk-bootstrap.png differ
diff --git a/img/dashboard/system-management/userAdditionalPermission.png b/img/dashboard/system-management/userAdditionalPermission.png
new file mode 100644
index 0000000000..667aeb3b44
Binary files /dev/null and b/img/dashboard/system-management/userAdditionalPermission.png differ
diff --git a/img/dashboard/system-management/validate-json-schema.png b/img/dashboard/system-management/validate-json-schema.png
new file mode 100644
index 0000000000..c9bacb6a1d
Binary files /dev/null and b/img/dashboard/system-management/validate-json-schema.png differ
diff --git a/img/dashboard/system-management/webhook-breaker.png b/img/dashboard/system-management/webhook-breaker.png
new file mode 100644
index 0000000000..5cd89b1050
Binary files /dev/null and b/img/dashboard/system-management/webhook-breaker.png differ
diff --git a/img/dashboard/system-management/webhooks_menu.png b/img/dashboard/system-management/webhooks_menu.png
new file mode 100644
index 0000000000..f46f189e9e
Binary files /dev/null and b/img/dashboard/system-management/webhooks_menu.png differ
diff --git a/img/dashboard/system-management/websocket-auth-token.png b/img/dashboard/system-management/websocket-auth-token.png
new file mode 100644
index 0000000000..dca78868f7
Binary files /dev/null and b/img/dashboard/system-management/websocket-auth-token.png differ
diff --git a/img/dashboard/udg/concepts/field-mapping-new.png b/img/dashboard/udg/concepts/field-mapping-new.png
new file mode 100644
index 0000000000..d86dc418da
Binary files /dev/null and b/img/dashboard/udg/concepts/field-mapping-new.png differ
diff --git a/img/dashboard/udg/concepts/object_placeholder.png b/img/dashboard/udg/concepts/object_placeholder.png
new file mode 100644
index 0000000000..43c9a04087
Binary files /dev/null and b/img/dashboard/udg/concepts/object_placeholder.png differ
diff --git a/img/dashboard/udg/concepts/parameter_dropdown.png b/img/dashboard/udg/concepts/parameter_dropdown.png
new file mode 100644
index 0000000000..76a9e6f153
Binary files /dev/null and b/img/dashboard/udg/concepts/parameter_dropdown.png differ
diff --git a/img/dashboard/udg/datasources/add_gql_operation.png b/img/dashboard/udg/datasources/add_gql_operation.png
new file mode 100644
index 0000000000..6ed9a51ef9
Binary files /dev/null and b/img/dashboard/udg/datasources/add_gql_operation.png differ
diff --git a/img/dashboard/udg/datasources/datasources-list.png b/img/dashboard/udg/datasources/datasources-list.png
new file mode 100644
index 0000000000..278b57749f
Binary files /dev/null and b/img/dashboard/udg/datasources/datasources-list.png differ
diff --git a/img/dashboard/udg/datasources/external-rest-config.png b/img/dashboard/udg/datasources/external-rest-config.png
new file mode 100644
index 0000000000..cbbdd3f26a
Binary files /dev/null and b/img/dashboard/udg/datasources/external-rest-config.png differ
diff --git a/img/dashboard/udg/datasources/graph-fieldmapping.png b/img/dashboard/udg/datasources/graph-fieldmapping.png
new file mode 100644
index 0000000000..d17140462b
Binary files /dev/null and b/img/dashboard/udg/datasources/graph-fieldmapping.png differ
diff --git a/img/dashboard/udg/datasources/kafka-config.png b/img/dashboard/udg/datasources/kafka-config.png
new file mode 100644
index 0000000000..63b305bcf5
Binary files /dev/null and b/img/dashboard/udg/datasources/kafka-config.png differ
diff --git a/img/dashboard/udg/datasources/kafka-list.png b/img/dashboard/udg/datasources/kafka-list.png
new file mode 100644
index 0000000000..158be564f2
Binary files /dev/null and b/img/dashboard/udg/datasources/kafka-list.png differ
diff --git a/img/dashboard/udg/datasources/rest-datasource.png b/img/dashboard/udg/datasources/rest-datasource.png
new file mode 100644
index 0000000000..5fc41e055e
Binary files /dev/null and b/img/dashboard/udg/datasources/rest-datasource.png differ
diff --git a/img/dashboard/udg/datasources/rest-internal-config.png b/img/dashboard/udg/datasources/rest-internal-config.png
new file mode 100644
index 0000000000..6b1061ab9e
Binary files /dev/null and b/img/dashboard/udg/datasources/rest-internal-config.png differ
diff --git a/img/dashboard/udg/datasources/tyk-rest-datasource.png b/img/dashboard/udg/datasources/tyk-rest-datasource.png
new file mode 100644
index 0000000000..3fd7983a59
Binary files /dev/null and b/img/dashboard/udg/datasources/tyk-rest-datasource.png differ
diff --git a/img/dashboard/udg/getting-started/data graph example new graph menu.png b/img/dashboard/udg/getting-started/data graph example new graph menu.png
new file mode 100644
index 0000000000..f44cf32ecb
Binary files /dev/null and b/img/dashboard/udg/getting-started/data graph example new graph menu.png differ
diff --git a/img/dashboard/udg/getting-started/example data graph.png b/img/dashboard/udg/getting-started/example data graph.png
new file mode 100644
index 0000000000..f9cf74fd57
Binary files /dev/null and b/img/dashboard/udg/getting-started/example data graph.png differ
diff --git a/img/dashboard/udg/getting-started/headers.png b/img/dashboard/udg/getting-started/headers.png
new file mode 100644
index 0000000000..a3ee021eab
Binary files /dev/null and b/img/dashboard/udg/getting-started/headers.png differ
diff --git a/img/dashboard/udg/getting-started/logs.png b/img/dashboard/udg/getting-started/logs.png
new file mode 100644
index 0000000000..018c9d0744
Binary files /dev/null and b/img/dashboard/udg/getting-started/logs.png differ
diff --git a/img/dashboard/udg/getting-started/logs_bar.png b/img/dashboard/udg/getting-started/logs_bar.png
new file mode 100644
index 0000000000..e3d8ef0f90
Binary files /dev/null and b/img/dashboard/udg/getting-started/logs_bar.png differ
diff --git a/img/dashboard/udg/getting-started/logs_empty.png b/img/dashboard/udg/getting-started/logs_empty.png
new file mode 100644
index 0000000000..6d2ad4cab6
Binary files /dev/null and b/img/dashboard/udg/getting-started/logs_empty.png differ
diff --git a/img/dashboard/udg/getting-started/logs_navigation.png b/img/dashboard/udg/getting-started/logs_navigation.png
new file mode 100644
index 0000000000..72e969297e
Binary files /dev/null and b/img/dashboard/udg/getting-started/logs_navigation.png differ
diff --git a/img/dashboard/udg/getting-started/logs_table.png b/img/dashboard/udg/getting-started/logs_table.png
new file mode 100644
index 0000000000..07bce529c7
Binary files /dev/null and b/img/dashboard/udg/getting-started/logs_table.png differ
diff --git a/img/dashboard/udg/getting-started/playground.png b/img/dashboard/udg/getting-started/playground.png
new file mode 100644
index 0000000000..313124455d
Binary files /dev/null and b/img/dashboard/udg/getting-started/playground.png differ
diff --git a/img/dashboard/udg/getting-started/request-forward-syntax.png b/img/dashboard/udg/getting-started/request-forward-syntax.png
new file mode 100644
index 0000000000..3ae30f7178
Binary files /dev/null and b/img/dashboard/udg/getting-started/request-forward-syntax.png differ
diff --git a/img/dashboard/udg/getting-started/step1.png b/img/dashboard/udg/getting-started/step1.png
new file mode 100644
index 0000000000..5d25794b0b
Binary files /dev/null and b/img/dashboard/udg/getting-started/step1.png differ
diff --git a/img/dashboard/udg/getting-started/step2.png b/img/dashboard/udg/getting-started/step2.png
new file mode 100644
index 0000000000..04882c05f7
Binary files /dev/null and b/img/dashboard/udg/getting-started/step2.png differ
diff --git a/img/dashboard/udg/getting-started/step3.png b/img/dashboard/udg/getting-started/step3.png
new file mode 100644
index 0000000000..220046bbb2
Binary files /dev/null and b/img/dashboard/udg/getting-started/step3.png differ
diff --git a/img/dashboard/udg/getting-started/step4.png b/img/dashboard/udg/getting-started/step4.png
new file mode 100644
index 0000000000..fdf21943a5
Binary files /dev/null and b/img/dashboard/udg/getting-started/step4.png differ
diff --git a/img/dashboard/udg/getting-started/step5.png b/img/dashboard/udg/getting-started/step5.png
new file mode 100644
index 0000000000..241bb9805a
Binary files /dev/null and b/img/dashboard/udg/getting-started/step5.png differ
diff --git a/img/dashboard/usage-data/test_alias_key.png b/img/dashboard/usage-data/test_alias_key.png
new file mode 100644
index 0000000000..0e46987af3
Binary files /dev/null and b/img/dashboard/usage-data/test_alias_key.png differ
diff --git a/img/dashboard/user-management/create-ldap-profile.png b/img/dashboard/user-management/create-ldap-profile.png
new file mode 100644
index 0000000000..baa765e55c
Binary files /dev/null and b/img/dashboard/user-management/create-ldap-profile.png differ
diff --git a/img/dashboard_admin_swagger_image.png b/img/dashboard_admin_swagger_image.png
new file mode 100644
index 0000000000..af23f54f17
Binary files /dev/null and b/img/dashboard_admin_swagger_image.png differ
diff --git a/img/dcr/curity/1-curity-admin-ui-dcr.png b/img/dcr/curity/1-curity-admin-ui-dcr.png
new file mode 100644
index 0000000000..b06053ebbc
Binary files /dev/null and b/img/dcr/curity/1-curity-admin-ui-dcr.png differ
diff --git a/img/dcr/curity/10-jwt-curity-application-details.png b/img/dcr/curity/10-jwt-curity-application-details.png
new file mode 100644
index 0000000000..b50f5fa7ae
Binary files /dev/null and b/img/dcr/curity/10-jwt-curity-application-details.png differ
diff --git a/img/dcr/curity/10-split-curity-application-details.png b/img/dcr/curity/10-split-curity-application-details.png
new file mode 100644
index 0000000000..b50f5fa7ae
Binary files /dev/null and b/img/dcr/curity/10-split-curity-application-details.png differ
diff --git a/img/dcr/curity/11-jwt-curity-dcr-client-details.png b/img/dcr/curity/11-jwt-curity-dcr-client-details.png
new file mode 100644
index 0000000000..a4872fcca6
Binary files /dev/null and b/img/dcr/curity/11-jwt-curity-dcr-client-details.png differ
diff --git a/img/dcr/curity/11-split-curity-dcr-client-details.png b/img/dcr/curity/11-split-curity-dcr-client-details.png
new file mode 100644
index 0000000000..a4872fcca6
Binary files /dev/null and b/img/dcr/curity/11-split-curity-dcr-client-details.png differ
diff --git a/img/dcr/curity/12-jwt-curity-oauth-tools.png b/img/dcr/curity/12-jwt-curity-oauth-tools.png
new file mode 100644
index 0000000000..dc26511b74
Binary files /dev/null and b/img/dcr/curity/12-jwt-curity-oauth-tools.png differ
diff --git a/img/dcr/curity/12-split-curity-oauth-tools.png b/img/dcr/curity/12-split-curity-oauth-tools.png
new file mode 100644
index 0000000000..347c7b3c33
Binary files /dev/null and b/img/dcr/curity/12-split-curity-oauth-tools.png differ
diff --git a/img/dcr/curity/13-jwt-curity-external-api-flow.png b/img/dcr/curity/13-jwt-curity-external-api-flow.png
new file mode 100644
index 0000000000..03777b9ae7
Binary files /dev/null and b/img/dcr/curity/13-jwt-curity-external-api-flow.png differ
diff --git a/img/dcr/curity/13-split-curity-external-api-flow.png b/img/dcr/curity/13-split-curity-external-api-flow.png
new file mode 100644
index 0000000000..331e04a94a
Binary files /dev/null and b/img/dcr/curity/13-split-curity-external-api-flow.png differ
diff --git a/img/dcr/curity/2-curity-dcr-endpoint.png b/img/dcr/curity/2-curity-dcr-endpoint.png
new file mode 100644
index 0000000000..3b3b090f81
Binary files /dev/null and b/img/dcr/curity/2-curity-dcr-endpoint.png differ
diff --git a/img/dcr/curity/3-curity-create-api.png b/img/dcr/curity/3-curity-create-api.png
new file mode 100644
index 0000000000..7965851853
Binary files /dev/null and b/img/dcr/curity/3-curity-create-api.png differ
diff --git a/img/dcr/curity/4-jwt-curity-configure-api.png b/img/dcr/curity/4-jwt-curity-configure-api.png
new file mode 100644
index 0000000000..b8f0f8c2e0
Binary files /dev/null and b/img/dcr/curity/4-jwt-curity-configure-api.png differ
diff --git a/img/dcr/curity/4-split-curity-configure-api.png b/img/dcr/curity/4-split-curity-configure-api.png
new file mode 100644
index 0000000000..0e6c83d8c0
Binary files /dev/null and b/img/dcr/curity/4-split-curity-configure-api.png differ
diff --git a/img/dcr/curity/5-jwt-curity-configure-policy.png b/img/dcr/curity/5-jwt-curity-configure-policy.png
new file mode 100644
index 0000000000..4d327a6d13
Binary files /dev/null and b/img/dcr/curity/5-jwt-curity-configure-policy.png differ
diff --git a/img/dcr/curity/5-split-facade-curity-configure-api.png.png b/img/dcr/curity/5-split-facade-curity-configure-api.png.png
new file mode 100644
index 0000000000..1772e40f0e
Binary files /dev/null and b/img/dcr/curity/5-split-facade-curity-configure-api.png.png differ
diff --git a/img/dcr/curity/6-jwt-dcr-key-curity.png b/img/dcr/curity/6-jwt-dcr-key-curity.png
new file mode 100644
index 0000000000..4756c42de9
Binary files /dev/null and b/img/dcr/curity/6-jwt-dcr-key-curity.png differ
diff --git a/img/dcr/curity/6-split-dcr-key-curity.png b/img/dcr/curity/6-split-dcr-key-curity.png
new file mode 100644
index 0000000000..4756c42de9
Binary files /dev/null and b/img/dcr/curity/6-split-dcr-key-curity.png differ
diff --git a/img/dcr/curity/7-jwt-curity-publish-api.png b/img/dcr/curity/7-jwt-curity-publish-api.png
new file mode 100644
index 0000000000..b6103052c7
Binary files /dev/null and b/img/dcr/curity/7-jwt-curity-publish-api.png differ
diff --git a/img/dcr/curity/7-split-curity-publish-api.png b/img/dcr/curity/7-split-curity-publish-api.png
new file mode 100644
index 0000000000..043884e977
Binary files /dev/null and b/img/dcr/curity/7-split-curity-publish-api.png differ
diff --git a/img/dcr/curity/8-jwt-curity-configure-dcr.png b/img/dcr/curity/8-jwt-curity-configure-dcr.png
new file mode 100644
index 0000000000..8531a0639b
Binary files /dev/null and b/img/dcr/curity/8-jwt-curity-configure-dcr.png differ
diff --git a/img/dcr/curity/8-split-curity-configure-dcr.png b/img/dcr/curity/8-split-curity-configure-dcr.png
new file mode 100644
index 0000000000..8531a0639b
Binary files /dev/null and b/img/dcr/curity/8-split-curity-configure-dcr.png differ
diff --git a/img/dcr/curity/9-jwt-curity-create-oauth-client-wizard.png b/img/dcr/curity/9-jwt-curity-create-oauth-client-wizard.png
new file mode 100644
index 0000000000..6b92d05658
Binary files /dev/null and b/img/dcr/curity/9-jwt-curity-create-oauth-client-wizard.png differ
diff --git a/img/dcr/curity/9-split-curity-create-oauth-client-wizard.png b/img/dcr/curity/9-split-curity-create-oauth-client-wizard.png
new file mode 100644
index 0000000000..e80554fde7
Binary files /dev/null and b/img/dcr/curity/9-split-curity-create-oauth-client-wizard.png differ
diff --git a/img/dcr/gluu/step_1.png b/img/dcr/gluu/step_1.png
new file mode 100644
index 0000000000..895e962c29
Binary files /dev/null and b/img/dcr/gluu/step_1.png differ
diff --git a/img/dcr/gluu/step_10.png b/img/dcr/gluu/step_10.png
new file mode 100644
index 0000000000..18aa0b8aa8
Binary files /dev/null and b/img/dcr/gluu/step_10.png differ
diff --git a/img/dcr/gluu/step_11.png b/img/dcr/gluu/step_11.png
new file mode 100644
index 0000000000..e32134200c
Binary files /dev/null and b/img/dcr/gluu/step_11.png differ
diff --git a/img/dcr/gluu/step_12.png b/img/dcr/gluu/step_12.png
new file mode 100644
index 0000000000..3610a77581
Binary files /dev/null and b/img/dcr/gluu/step_12.png differ
diff --git a/img/dcr/gluu/step_13.png b/img/dcr/gluu/step_13.png
new file mode 100644
index 0000000000..547a53794f
Binary files /dev/null and b/img/dcr/gluu/step_13.png differ
diff --git a/img/dcr/gluu/step_14.png b/img/dcr/gluu/step_14.png
new file mode 100644
index 0000000000..fc852f367b
Binary files /dev/null and b/img/dcr/gluu/step_14.png differ
diff --git a/img/dcr/gluu/step_2.png b/img/dcr/gluu/step_2.png
new file mode 100644
index 0000000000..d602f856c1
Binary files /dev/null and b/img/dcr/gluu/step_2.png differ
diff --git a/img/dcr/gluu/step_3.png b/img/dcr/gluu/step_3.png
new file mode 100644
index 0000000000..fa41e16aeb
Binary files /dev/null and b/img/dcr/gluu/step_3.png differ
diff --git a/img/dcr/gluu/step_4.png b/img/dcr/gluu/step_4.png
new file mode 100644
index 0000000000..0f51bf3cc6
Binary files /dev/null and b/img/dcr/gluu/step_4.png differ
diff --git a/img/dcr/gluu/step_5.png b/img/dcr/gluu/step_5.png
new file mode 100644
index 0000000000..3c1cd25366
Binary files /dev/null and b/img/dcr/gluu/step_5.png differ
diff --git a/img/dcr/gluu/step_6.png b/img/dcr/gluu/step_6.png
new file mode 100644
index 0000000000..d8bb1b0a39
Binary files /dev/null and b/img/dcr/gluu/step_6.png differ
diff --git a/img/dcr/gluu/step_7.png b/img/dcr/gluu/step_7.png
new file mode 100644
index 0000000000..be71588dc1
Binary files /dev/null and b/img/dcr/gluu/step_7.png differ
diff --git a/img/dcr/gluu/step_8.png b/img/dcr/gluu/step_8.png
new file mode 100644
index 0000000000..d65deea199
Binary files /dev/null and b/img/dcr/gluu/step_8.png differ
diff --git a/img/dcr/gluu/step_9.png b/img/dcr/gluu/step_9.png
new file mode 100644
index 0000000000..3e8143608b
Binary files /dev/null and b/img/dcr/gluu/step_9.png differ
diff --git a/img/dcr/keycloak/step_1.png b/img/dcr/keycloak/step_1.png
new file mode 100644
index 0000000000..e7b10425ff
Binary files /dev/null and b/img/dcr/keycloak/step_1.png differ
diff --git a/img/dcr/keycloak/step_10.png b/img/dcr/keycloak/step_10.png
new file mode 100644
index 0000000000..ce96c54aaf
Binary files /dev/null and b/img/dcr/keycloak/step_10.png differ
diff --git a/img/dcr/keycloak/step_11.png b/img/dcr/keycloak/step_11.png
new file mode 100644
index 0000000000..bc31c4e1cc
Binary files /dev/null and b/img/dcr/keycloak/step_11.png differ
diff --git a/img/dcr/keycloak/step_12.png b/img/dcr/keycloak/step_12.png
new file mode 100644
index 0000000000..aeca42d08d
Binary files /dev/null and b/img/dcr/keycloak/step_12.png differ
diff --git a/img/dcr/keycloak/step_13.png b/img/dcr/keycloak/step_13.png
new file mode 100644
index 0000000000..2836371d3f
Binary files /dev/null and b/img/dcr/keycloak/step_13.png differ
diff --git a/img/dcr/keycloak/step_2.png b/img/dcr/keycloak/step_2.png
new file mode 100644
index 0000000000..255ac33214
Binary files /dev/null and b/img/dcr/keycloak/step_2.png differ
diff --git a/img/dcr/keycloak/step_3.png b/img/dcr/keycloak/step_3.png
new file mode 100644
index 0000000000..9fd5fdaadf
Binary files /dev/null and b/img/dcr/keycloak/step_3.png differ
diff --git a/img/dcr/keycloak/step_4.png b/img/dcr/keycloak/step_4.png
new file mode 100644
index 0000000000..42a912c005
Binary files /dev/null and b/img/dcr/keycloak/step_4.png differ
diff --git a/img/dcr/keycloak/step_5.png b/img/dcr/keycloak/step_5.png
new file mode 100644
index 0000000000..6000ad76f3
Binary files /dev/null and b/img/dcr/keycloak/step_5.png differ
diff --git a/img/dcr/keycloak/step_6.png b/img/dcr/keycloak/step_6.png
new file mode 100644
index 0000000000..23656a384b
Binary files /dev/null and b/img/dcr/keycloak/step_6.png differ
diff --git a/img/dcr/keycloak/step_7.png b/img/dcr/keycloak/step_7.png
new file mode 100644
index 0000000000..ab5d71cb5e
Binary files /dev/null and b/img/dcr/keycloak/step_7.png differ
diff --git a/img/dcr/keycloak/step_8.png b/img/dcr/keycloak/step_8.png
new file mode 100644
index 0000000000..3e8143608b
Binary files /dev/null and b/img/dcr/keycloak/step_8.png differ
diff --git a/img/dcr/keycloak/step_9.png b/img/dcr/keycloak/step_9.png
new file mode 100644
index 0000000000..a67dd48e45
Binary files /dev/null and b/img/dcr/keycloak/step_9.png differ
diff --git a/img/dcr/okta/step_1.png b/img/dcr/okta/step_1.png
new file mode 100644
index 0000000000..36584acd94
Binary files /dev/null and b/img/dcr/okta/step_1.png differ
diff --git a/img/dcr/okta/step_10.png b/img/dcr/okta/step_10.png
new file mode 100644
index 0000000000..3e8143608b
Binary files /dev/null and b/img/dcr/okta/step_10.png differ
diff --git a/img/dcr/okta/step_11.png b/img/dcr/okta/step_11.png
new file mode 100644
index 0000000000..45abdc15a8
Binary files /dev/null and b/img/dcr/okta/step_11.png differ
diff --git a/img/dcr/okta/step_12.png b/img/dcr/okta/step_12.png
new file mode 100644
index 0000000000..fd261c0a91
Binary files /dev/null and b/img/dcr/okta/step_12.png differ
diff --git a/img/dcr/okta/step_13.png b/img/dcr/okta/step_13.png
new file mode 100644
index 0000000000..f037738aa4
Binary files /dev/null and b/img/dcr/okta/step_13.png differ
diff --git a/img/dcr/okta/step_14.png b/img/dcr/okta/step_14.png
new file mode 100644
index 0000000000..bd64d7dfe6
Binary files /dev/null and b/img/dcr/okta/step_14.png differ
diff --git a/img/dcr/okta/step_15.png b/img/dcr/okta/step_15.png
new file mode 100644
index 0000000000..3ca0133248
Binary files /dev/null and b/img/dcr/okta/step_15.png differ
diff --git a/img/dcr/okta/step_2.png b/img/dcr/okta/step_2.png
new file mode 100644
index 0000000000..77b4a8e0a6
Binary files /dev/null and b/img/dcr/okta/step_2.png differ
diff --git a/img/dcr/okta/step_3.png b/img/dcr/okta/step_3.png
new file mode 100644
index 0000000000..f924caacd5
Binary files /dev/null and b/img/dcr/okta/step_3.png differ
diff --git a/img/dcr/okta/step_4.png b/img/dcr/okta/step_4.png
new file mode 100644
index 0000000000..6b78cb7d9b
Binary files /dev/null and b/img/dcr/okta/step_4.png differ
diff --git a/img/dcr/okta/step_5.png b/img/dcr/okta/step_5.png
new file mode 100644
index 0000000000..259fba24ef
Binary files /dev/null and b/img/dcr/okta/step_5.png differ
diff --git a/img/dcr/okta/step_6.png b/img/dcr/okta/step_6.png
new file mode 100644
index 0000000000..c4d98844cb
Binary files /dev/null and b/img/dcr/okta/step_6.png differ
diff --git a/img/dcr/okta/step_7.png b/img/dcr/okta/step_7.png
new file mode 100644
index 0000000000..ac695cb6fd
Binary files /dev/null and b/img/dcr/okta/step_7.png differ
diff --git a/img/dcr/okta/step_8.png b/img/dcr/okta/step_8.png
new file mode 100644
index 0000000000..f45514b54d
Binary files /dev/null and b/img/dcr/okta/step_8.png differ
diff --git a/img/dcr/okta/step_9.png b/img/dcr/okta/step_9.png
new file mode 100644
index 0000000000..04bbdf1489
Binary files /dev/null and b/img/dcr/okta/step_9.png differ
diff --git a/img/debian-nd-753.png b/img/debian-nd-753.png
new file mode 100644
index 0000000000..1f2cb7e6f8
Binary files /dev/null and b/img/debian-nd-753.png differ
diff --git a/img/developer-portal/add-custom-credential.png b/img/developer-portal/add-custom-credential.png
new file mode 100644
index 0000000000..62fb0fc5a8
Binary files /dev/null and b/img/developer-portal/add-custom-credential.png differ
diff --git a/img/developer-portal/admin-adding-multiple-api-products.png b/img/developer-portal/admin-adding-multiple-api-products.png
new file mode 100644
index 0000000000..a2c3adda9e
Binary files /dev/null and b/img/developer-portal/admin-adding-multiple-api-products.png differ
diff --git a/img/developer-portal/admin-created-app-multiple-creds.png b/img/developer-portal/admin-created-app-multiple-creds.png
new file mode 100644
index 0000000000..c78f0c6013
Binary files /dev/null and b/img/developer-portal/admin-created-app-multiple-creds.png differ
diff --git a/img/developer-portal/api-product-select-exisiting-credential.png b/img/developer-portal/api-product-select-exisiting-credential.png
new file mode 100644
index 0000000000..949d8573bb
Binary files /dev/null and b/img/developer-portal/api-product-select-exisiting-credential.png differ
diff --git a/img/developer-portal/configure-direct-access-flow.png b/img/developer-portal/configure-direct-access-flow.png
new file mode 100644
index 0000000000..43144bb567
Binary files /dev/null and b/img/developer-portal/configure-direct-access-flow.png differ
diff --git a/img/developer-portal/credential-approved-direct-access-flow.png b/img/developer-portal/credential-approved-direct-access-flow.png
new file mode 100644
index 0000000000..79c9d44741
Binary files /dev/null and b/img/developer-portal/credential-approved-direct-access-flow.png differ
diff --git a/img/developer-portal/custom-credentials-dashboard.png b/img/developer-portal/custom-credentials-dashboard.png
new file mode 100644
index 0000000000..db0b3435ce
Binary files /dev/null and b/img/developer-portal/custom-credentials-dashboard.png differ
diff --git a/img/developer-portal/portal-audit-logs.png b/img/developer-portal/portal-audit-logs.png
new file mode 100644
index 0000000000..d21847fee0
Binary files /dev/null and b/img/developer-portal/portal-audit-logs.png differ
diff --git a/img/developer-portal/single-credential-multiple-products.png b/img/developer-portal/single-credential-multiple-products.png
new file mode 100644
index 0000000000..ac156375d1
Binary files /dev/null and b/img/developer-portal/single-credential-multiple-products.png differ
diff --git a/img/developer-portal/view-apps.png b/img/developer-portal/view-apps.png
new file mode 100644
index 0000000000..ef54faa94d
Binary files /dev/null and b/img/developer-portal/view-apps.png differ
diff --git a/img/developer-portal/view-credentials.png b/img/developer-portal/view-credentials.png
new file mode 100644
index 0000000000..571319d49c
Binary files /dev/null and b/img/developer-portal/view-credentials.png differ
diff --git a/img/developer-support/path1-step5-bundle-contents.png b/img/developer-support/path1-step5-bundle-contents.png
new file mode 100644
index 0000000000..eb24a4af89
Binary files /dev/null and b/img/developer-support/path1-step5-bundle-contents.png differ
diff --git a/img/developer-support/path2-step5-bundle-contents.png b/img/developer-support/path2-step5-bundle-contents.png
new file mode 100644
index 0000000000..e05de28b7f
Binary files /dev/null and b/img/developer-support/path2-step5-bundle-contents.png differ
diff --git a/img/developer_portal_swagger_image.png b/img/developer_portal_swagger_image.png
new file mode 100644
index 0000000000..7176c8208e
Binary files /dev/null and b/img/developer_portal_swagger_image.png differ
diff --git a/img/diagram.png b/img/diagram.png
new file mode 100644
index 0000000000..55be41fab0
Binary files /dev/null and b/img/diagram.png differ
diff --git a/img/diagrams/certificates-add-to-store.png b/img/diagrams/certificates-add-to-store.png
new file mode 100644
index 0000000000..ff39ae014c
Binary files /dev/null and b/img/diagrams/certificates-add-to-store.png differ
diff --git a/img/diagrams/certificates-ca-trust-store.png b/img/diagrams/certificates-ca-trust-store.png
new file mode 100644
index 0000000000..74703fec25
Binary files /dev/null and b/img/diagrams/certificates-ca-trust-store.png differ
diff --git a/img/diagrams/certificates-insecure-secure.png b/img/diagrams/certificates-insecure-secure.png
new file mode 100644
index 0000000000..090654e6f6
Binary files /dev/null and b/img/diagrams/certificates-insecure-secure.png differ
diff --git a/img/diagrams/certificates-mtls-handshake.png b/img/diagrams/certificates-mtls-handshake.png
new file mode 100644
index 0000000000..d59f6eb146
Binary files /dev/null and b/img/diagrams/certificates-mtls-handshake.png differ
diff --git a/img/diagrams/certificates-tls-handshake.png b/img/diagrams/certificates-tls-handshake.png
new file mode 100644
index 0000000000..698a81c59c
Binary files /dev/null and b/img/diagrams/certificates-tls-handshake.png differ
diff --git a/img/diagrams/certificates-trust-chain.png b/img/diagrams/certificates-trust-chain.png
new file mode 100644
index 0000000000..6d66574e3a
Binary files /dev/null and b/img/diagrams/certificates-trust-chain.png differ
diff --git a/img/diagrams/certificates-x509-certificate.png b/img/diagrams/certificates-x509-certificate.png
new file mode 100644
index 0000000000..d758326210
Binary files /dev/null and b/img/diagrams/certificates-x509-certificate.png differ
diff --git a/img/diagrams/dashboardapi2.png b/img/diagrams/dashboardapi2.png
new file mode 100644
index 0000000000..739c8bb124
Binary files /dev/null and b/img/diagrams/dashboardapi2.png differ
diff --git a/img/diagrams/diagram_docs_JSON-web-tokens@2x.png b/img/diagrams/diagram_docs_JSON-web-tokens@2x.png
new file mode 100644
index 0000000000..779648bd0e
Binary files /dev/null and b/img/diagrams/diagram_docs_JSON-web-tokens@2x.png differ
diff --git a/img/diagrams/diagram_docs_authorization-code-grant-type@2x.png b/img/diagrams/diagram_docs_authorization-code-grant-type@2x.png
new file mode 100644
index 0000000000..1c02e2025e
Binary files /dev/null and b/img/diagrams/diagram_docs_authorization-code-grant-type@2x.png differ
diff --git a/img/diagrams/diagram_docs_circuit-breakers@2x.png b/img/diagrams/diagram_docs_circuit-breakers@2x.png
new file mode 100644
index 0000000000..c579397a8f
Binary files /dev/null and b/img/diagrams/diagram_docs_circuit-breakers@2x.png differ
diff --git a/img/diagrams/diagram_docs_client-credentials-grant-type@2x.png b/img/diagrams/diagram_docs_client-credentials-grant-type@2x.png
new file mode 100644
index 0000000000..35e889bc4f
Binary files /dev/null and b/img/diagrams/diagram_docs_client-credentials-grant-type@2x.png differ
diff --git a/img/diagrams/diagram_docs_dashboard-API-security-and-concepts@2x.png b/img/diagrams/diagram_docs_dashboard-API-security-and-concepts@2x.png
new file mode 100644
index 0000000000..6e4dcaa651
Binary files /dev/null and b/img/diagrams/diagram_docs_dashboard-API-security-and-concepts@2x.png differ
diff --git a/img/diagrams/diagram_docs_gRPC-plugins_why-use-it-for-plugins@2x.png b/img/diagrams/diagram_docs_gRPC-plugins_why-use-it-for-plugins@2x.png
new file mode 100644
index 0000000000..213249d5d9
Binary files /dev/null and b/img/diagrams/diagram_docs_gRPC-plugins_why-use-it-for-plugins@2x.png differ
diff --git a/img/diagrams/diagram_docs_looping-example-use-cases@2x.png b/img/diagrams/diagram_docs_looping-example-use-cases@2x.png
new file mode 100644
index 0000000000..33daa2605a
Binary files /dev/null and b/img/diagrams/diagram_docs_looping-example-use-cases@2x.png differ
diff --git a/img/diagrams/diagram_docs_pump-configuration-multi-backend.png b/img/diagrams/diagram_docs_pump-configuration-multi-backend.png
new file mode 100644
index 0000000000..f84235a8c5
Binary files /dev/null and b/img/diagrams/diagram_docs_pump-configuration-multi-backend.png differ
diff --git a/img/diagrams/diagram_docs_pump-data-flow@2x.png b/img/diagrams/diagram_docs_pump-data-flow@2x.png
new file mode 100644
index 0000000000..a5d06568f5
Binary files /dev/null and b/img/diagrams/diagram_docs_pump-data-flow@2x.png differ
diff --git a/img/diagrams/diagram_docs_pump-open-source@2x.png b/img/diagrams/diagram_docs_pump-open-source@2x.png
new file mode 100644
index 0000000000..efda0581e6
Binary files /dev/null and b/img/diagrams/diagram_docs_pump-open-source@2x.png differ
diff --git a/img/diagrams/diagram_docs_refresh-token-grant-type@2x.png b/img/diagrams/diagram_docs_refresh-token-grant-type@2x.png
new file mode 100644
index 0000000000..b28d5bfd17
Binary files /dev/null and b/img/diagrams/diagram_docs_refresh-token-grant-type@2x.png differ
diff --git a/img/diagrams/diagram_docs_username-_-password-grant-type@2x.png b/img/diagrams/diagram_docs_username-_-password-grant-type@2x.png
new file mode 100644
index 0000000000..ea1d50f63a
Binary files /dev/null and b/img/diagrams/diagram_docs_username-_-password-grant-type@2x.png differ
diff --git a/img/diagrams/gateway4.png b/img/diagrams/gateway4.png
new file mode 100644
index 0000000000..d4f009dd9e
Binary files /dev/null and b/img/diagrams/gateway4.png differ
diff --git a/img/diagrams/generate-oauth-token-for-client.png b/img/diagrams/generate-oauth-token-for-client.png
new file mode 100644
index 0000000000..79706a4dcd
Binary files /dev/null and b/img/diagrams/generate-oauth-token-for-client.png differ
diff --git a/img/diagrams/generate-or-login-user-profile.png b/img/diagrams/generate-or-login-user-profile.png
new file mode 100644
index 0000000000..8608a2150c
Binary files /dev/null and b/img/diagrams/generate-or-login-user-profile.png differ
diff --git a/img/diagrams/jwt.png b/img/diagrams/jwt.png
new file mode 100755
index 0000000000..c805281792
Binary files /dev/null and b/img/diagrams/jwt.png differ
diff --git a/img/diagrams/middleware-execution-order@3x.png b/img/diagrams/middleware-execution-order@3x.png
new file mode 100644
index 0000000000..8132eaabb9
Binary files /dev/null and b/img/diagrams/middleware-execution-order@3x.png differ
diff --git a/img/diagrams/oss-architecture.png b/img/diagrams/oss-architecture.png
new file mode 100644
index 0000000000..4dcd042da7
Binary files /dev/null and b/img/diagrams/oss-architecture.png differ
diff --git a/img/diagrams/oss-flow.png b/img/diagrams/oss-flow.png
new file mode 100644
index 0000000000..e00b507a3c
Binary files /dev/null and b/img/diagrams/oss-flow.png differ
diff --git a/img/diagrams/pump-prometheus-1.png b/img/diagrams/pump-prometheus-1.png
new file mode 100644
index 0000000000..edebaa55dd
Binary files /dev/null and b/img/diagrams/pump-prometheus-1.png differ
diff --git a/img/diagrams/pump-prometheus-2.png b/img/diagrams/pump-prometheus-2.png
new file mode 100644
index 0000000000..c09ad1f881
Binary files /dev/null and b/img/diagrams/pump-prometheus-2.png differ
diff --git a/img/diagrams/pump-prometheus-3.png b/img/diagrams/pump-prometheus-3.png
new file mode 100644
index 0000000000..a3cccc9fb0
Binary files /dev/null and b/img/diagrams/pump-prometheus-3.png differ
diff --git a/img/diagrams/pump-prometheus-4.png b/img/diagrams/pump-prometheus-4.png
new file mode 100644
index 0000000000..442f9ea918
Binary files /dev/null and b/img/diagrams/pump-prometheus-4.png differ
diff --git a/img/diagrams/pump-prometheus.png b/img/diagrams/pump-prometheus.png
new file mode 100644
index 0000000000..7054c18d2d
Binary files /dev/null and b/img/diagrams/pump-prometheus.png differ
diff --git a/img/diagrams/pythonHitRate.png b/img/diagrams/pythonHitRate.png
new file mode 100755
index 0000000000..c2648ab7e3
Binary files /dev/null and b/img/diagrams/pythonHitRate.png differ
diff --git a/img/diagrams/pythonResponseTime.png b/img/diagrams/pythonResponseTime.png
new file mode 100755
index 0000000000..1976e20017
Binary files /dev/null and b/img/diagrams/pythonResponseTime.png differ
diff --git a/img/diagrams/tcpHitRate.png b/img/diagrams/tcpHitRate.png
new file mode 100755
index 0000000000..9ce0ba6e16
Binary files /dev/null and b/img/diagrams/tcpHitRate.png differ
diff --git a/img/diagrams/tcpResponseTime.png b/img/diagrams/tcpResponseTime.png
new file mode 100755
index 0000000000..cbfa5091ca
Binary files /dev/null and b/img/diagrams/tcpResponseTime.png differ
diff --git a/img/diagrams/tyk-selfmanaged-architecture-dashboard.png b/img/diagrams/tyk-selfmanaged-architecture-dashboard.png
new file mode 100644
index 0000000000..d3f1894737
Binary files /dev/null and b/img/diagrams/tyk-selfmanaged-architecture-dashboard.png differ
diff --git a/img/diagrams/tyk-selfmanaged-architecture-pump.png b/img/diagrams/tyk-selfmanaged-architecture-pump.png
new file mode 100644
index 0000000000..bf151a0bdf
Binary files /dev/null and b/img/diagrams/tyk-selfmanaged-architecture-pump.png differ
diff --git a/img/diagrams/tyk-selfmanaged-architecture.png b/img/diagrams/tyk-selfmanaged-architecture.png
new file mode 100644
index 0000000000..e7298075b4
Binary files /dev/null and b/img/diagrams/tyk-selfmanaged-architecture.png differ
diff --git a/img/diagrams/universal_datagraph_overview.png b/img/diagrams/universal_datagraph_overview.png
new file mode 100644
index 0000000000..559a41409f
Binary files /dev/null and b/img/diagrams/universal_datagraph_overview.png differ
diff --git a/img/diagrams/unixHitRate.png b/img/diagrams/unixHitRate.png
new file mode 100755
index 0000000000..5fa6fb592e
Binary files /dev/null and b/img/diagrams/unixHitRate.png differ
diff --git a/img/diagrams/unixResponseTime.png b/img/diagrams/unixResponseTime.png
new file mode 100755
index 0000000000..1b58e1320f
Binary files /dev/null and b/img/diagrams/unixResponseTime.png differ
diff --git a/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-datadog-spans.png b/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-datadog-spans.png
new file mode 100644
index 0000000000..cfa0b073f6
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-datadog-spans.png differ
diff --git a/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-datadog.png b/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-datadog.png
new file mode 100644
index 0000000000..d692429cd7
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-datadog.png differ
diff --git a/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger-spans.png b/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger-spans.png
new file mode 100644
index 0000000000..9703f7b77a
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger-spans.png differ
diff --git a/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger.png b/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger.png
new file mode 100644
index 0000000000..811a9c030a
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/api-gateway-trace-tyk-jaeger.png differ
diff --git a/img/distributed-tracing/opentelemetry/api-gateway-tyk-service-monitoring-datadog.png b/img/distributed-tracing/opentelemetry/api-gateway-tyk-service-monitoring-datadog.png
new file mode 100644
index 0000000000..82e7f49ab1
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/api-gateway-tyk-service-monitoring-datadog.png differ
diff --git a/img/distributed-tracing/opentelemetry/detailed-tracing-false.png b/img/distributed-tracing/opentelemetry/detailed-tracing-false.png
new file mode 100644
index 0000000000..2ae2929039
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/detailed-tracing-false.png differ
diff --git a/img/distributed-tracing/opentelemetry/detailed-tracing-oas.png b/img/distributed-tracing/opentelemetry/detailed-tracing-oas.png
new file mode 100644
index 0000000000..21e8fa924a
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/detailed-tracing-oas.png differ
diff --git a/img/distributed-tracing/opentelemetry/detailed-tracing-true.png b/img/distributed-tracing/opentelemetry/detailed-tracing-true.png
new file mode 100644
index 0000000000..5a01b0e74c
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/detailed-tracing-true.png differ
diff --git a/img/distributed-tracing/opentelemetry/dynatrace-metrics.png b/img/distributed-tracing/opentelemetry/dynatrace-metrics.png
new file mode 100644
index 0000000000..356986de85
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/dynatrace-metrics.png differ
diff --git a/img/distributed-tracing/opentelemetry/dynatrace-services.png b/img/distributed-tracing/opentelemetry/dynatrace-services.png
new file mode 100644
index 0000000000..3a3774bf63
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/dynatrace-services.png differ
diff --git a/img/distributed-tracing/opentelemetry/elastic-configure-otel-01.png b/img/distributed-tracing/opentelemetry/elastic-configure-otel-01.png
new file mode 100644
index 0000000000..d7815ca7a9
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/elastic-configure-otel-01.png differ
diff --git a/img/distributed-tracing/opentelemetry/elastic-configure-otel-02.png b/img/distributed-tracing/opentelemetry/elastic-configure-otel-02.png
new file mode 100644
index 0000000000..46491cb045
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/elastic-configure-otel-02.png differ
diff --git a/img/distributed-tracing/opentelemetry/elastic-configure-otel-03.png b/img/distributed-tracing/opentelemetry/elastic-configure-otel-03.png
new file mode 100644
index 0000000000..01dff525c5
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/elastic-configure-otel-03.png differ
diff --git a/img/distributed-tracing/opentelemetry/elastic-configure-otel-04.png b/img/distributed-tracing/opentelemetry/elastic-configure-otel-04.png
new file mode 100644
index 0000000000..976438ac44
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/elastic-configure-otel-04.png differ
diff --git a/img/distributed-tracing/opentelemetry/elastic-configure-otel-05.png b/img/distributed-tracing/opentelemetry/elastic-configure-otel-05.png
new file mode 100644
index 0000000000..fd081f796a
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/elastic-configure-otel-05.png differ
diff --git a/img/distributed-tracing/opentelemetry/elastic-configure-otel-06.png b/img/distributed-tracing/opentelemetry/elastic-configure-otel-06.png
new file mode 100644
index 0000000000..af223fb412
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/elastic-configure-otel-06.png differ
diff --git a/img/distributed-tracing/opentelemetry/elastic-otel.png b/img/distributed-tracing/opentelemetry/elastic-otel.png
new file mode 100644
index 0000000000..cad8e477f7
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/elastic-otel.png differ
diff --git a/img/distributed-tracing/opentelemetry/new-relic-metrics.png b/img/distributed-tracing/opentelemetry/new-relic-metrics.png
new file mode 100644
index 0000000000..53c44b956c
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/new-relic-metrics.png differ
diff --git a/img/distributed-tracing/opentelemetry/new-relic-services.png b/img/distributed-tracing/opentelemetry/new-relic-services.png
new file mode 100644
index 0000000000..a0fc833755
Binary files /dev/null and b/img/distributed-tracing/opentelemetry/new-relic-services.png differ
diff --git a/img/docker.png b/img/docker.png
new file mode 100644
index 0000000000..c9a3a8163e
Binary files /dev/null and b/img/docker.png differ
diff --git a/img/faq/datadog-logs-showup-as-errors/add-processor.png b/img/faq/datadog-logs-showup-as-errors/add-processor.png
new file mode 100644
index 0000000000..4dca96bdb3
Binary files /dev/null and b/img/faq/datadog-logs-showup-as-errors/add-processor.png differ
diff --git a/img/faq/datadog-logs-showup-as-errors/create-grok-parser-processor.png b/img/faq/datadog-logs-showup-as-errors/create-grok-parser-processor.png
new file mode 100644
index 0000000000..d0cbc9070d
Binary files /dev/null and b/img/faq/datadog-logs-showup-as-errors/create-grok-parser-processor.png differ
diff --git a/img/faq/datadog-logs-showup-as-errors/create-pipeline.png b/img/faq/datadog-logs-showup-as-errors/create-pipeline.png
new file mode 100644
index 0000000000..8710340110
Binary files /dev/null and b/img/faq/datadog-logs-showup-as-errors/create-pipeline.png differ
diff --git a/img/faq/datadog-logs-showup-as-errors/create-status-remapper-processor.png b/img/faq/datadog-logs-showup-as-errors/create-status-remapper-processor.png
new file mode 100644
index 0000000000..3b26cc104d
Binary files /dev/null and b/img/faq/datadog-logs-showup-as-errors/create-status-remapper-processor.png differ
diff --git a/img/faq/do-not-track-usage-scenario/dashboard_apis_measured.png b/img/faq/do-not-track-usage-scenario/dashboard_apis_measured.png
new file mode 100644
index 0000000000..2d81b262fa
Binary files /dev/null and b/img/faq/do-not-track-usage-scenario/dashboard_apis_measured.png differ
diff --git a/img/faq/do-not-track-usage-scenario/notrack.png b/img/faq/do-not-track-usage-scenario/notrack.png
new file mode 100644
index 0000000000..33094d590e
Binary files /dev/null and b/img/faq/do-not-track-usage-scenario/notrack.png differ
diff --git a/img/faq/do-not-track-usage-scenario/track.png b/img/faq/do-not-track-usage-scenario/track.png
new file mode 100644
index 0000000000..34455a092d
Binary files /dev/null and b/img/faq/do-not-track-usage-scenario/track.png differ
diff --git a/img/faq/enable-multiple-analytics-keys/redis_distributed.png b/img/faq/enable-multiple-analytics-keys/redis_distributed.png
new file mode 100644
index 0000000000..abd91cabb2
Binary files /dev/null and b/img/faq/enable-multiple-analytics-keys/redis_distributed.png differ
diff --git a/img/faq/enable-multiple-analytics-keys/redis_single.png b/img/faq/enable-multiple-analytics-keys/redis_single.png
new file mode 100644
index 0000000000..5ef864b5fd
Binary files /dev/null and b/img/faq/enable-multiple-analytics-keys/redis_single.png differ
diff --git a/img/gateway-logs-elasticsearch.png b/img/gateway-logs-elasticsearch.png
new file mode 100644
index 0000000000..71a918e96e
Binary files /dev/null and b/img/gateway-logs-elasticsearch.png differ
diff --git a/img/gateway/middleware/classic_do_not_track.png b/img/gateway/middleware/classic_do_not_track.png
new file mode 100644
index 0000000000..b3f1a87f36
Binary files /dev/null and b/img/gateway/middleware/classic_do_not_track.png differ
diff --git a/img/getting-started/api-activity-logs.png b/img/getting-started/api-activity-logs.png
new file mode 100644
index 0000000000..d0982eaee1
Binary files /dev/null and b/img/getting-started/api-activity-logs.png differ
diff --git a/img/getting-started/api-management-apis.png b/img/getting-started/api-management-apis.png
new file mode 100644
index 0000000000..5cd4e29a51
Binary files /dev/null and b/img/getting-started/api-management-apis.png differ
diff --git a/img/getting-started/api-url-provided-by-tyk.png b/img/getting-started/api-url-provided-by-tyk.png
new file mode 100644
index 0000000000..18bb9ad0d9
Binary files /dev/null and b/img/getting-started/api-url-provided-by-tyk.png differ
diff --git a/img/getting-started/apis-analytics.png b/img/getting-started/apis-analytics.png
new file mode 100644
index 0000000000..df15173210
Binary files /dev/null and b/img/getting-started/apis-analytics.png differ
diff --git a/img/getting-started/apis-configure-settings-1.png b/img/getting-started/apis-configure-settings-1.png
new file mode 100644
index 0000000000..d98f17cb24
Binary files /dev/null and b/img/getting-started/apis-configure-settings-1.png differ
diff --git a/img/getting-started/apis-configure-settings-2.png b/img/getting-started/apis-configure-settings-2.png
new file mode 100644
index 0000000000..f42632176e
Binary files /dev/null and b/img/getting-started/apis-configure-settings-2.png differ
diff --git a/img/getting-started/apis-connect-gateways.png b/img/getting-started/apis-connect-gateways.png
new file mode 100644
index 0000000000..dc2db37e15
Binary files /dev/null and b/img/getting-started/apis-connect-gateways.png differ
diff --git a/img/getting-started/apis-front-page.png b/img/getting-started/apis-front-page.png
new file mode 100644
index 0000000000..0b0d795430
Binary files /dev/null and b/img/getting-started/apis-front-page.png differ
diff --git a/img/getting-started/apis-keys-success.png b/img/getting-started/apis-keys-success.png
new file mode 100644
index 0000000000..4b92e3e0fd
Binary files /dev/null and b/img/getting-started/apis-keys-success.png differ
diff --git a/img/getting-started/configure-api-key.png b/img/getting-started/configure-api-key.png
new file mode 100644
index 0000000000..b7625d8d47
Binary files /dev/null and b/img/getting-started/configure-api-key.png differ
diff --git a/img/getting-started/create-account-add-api.png b/img/getting-started/create-account-add-api.png
new file mode 100644
index 0000000000..6534253cee
Binary files /dev/null and b/img/getting-started/create-account-add-api.png differ
diff --git a/img/getting-started/create-account-deploy-tutorial.png b/img/getting-started/create-account-deploy-tutorial.png
new file mode 100644
index 0000000000..7d4d2785c2
Binary files /dev/null and b/img/getting-started/create-account-deploy-tutorial.png differ
diff --git a/img/getting-started/create-account-design-from-scratch.png b/img/getting-started/create-account-design-from-scratch.png
new file mode 100644
index 0000000000..2d7b6d9f5c
Binary files /dev/null and b/img/getting-started/create-account-design-from-scratch.png differ
diff --git a/img/getting-started/create-account-free-trial-info.png b/img/getting-started/create-account-free-trial-info.png
new file mode 100644
index 0000000000..be4f70fbc7
Binary files /dev/null and b/img/getting-started/create-account-free-trial-info.png differ
diff --git a/img/getting-started/create-account-portal-pages.png b/img/getting-started/create-account-portal-pages.png
new file mode 100644
index 0000000000..b2688af78e
Binary files /dev/null and b/img/getting-started/create-account-portal-pages.png differ
diff --git a/img/getting-started/create-account-resend-email.png b/img/getting-started/create-account-resend-email.png
new file mode 100644
index 0000000000..281054b04a
Binary files /dev/null and b/img/getting-started/create-account-resend-email.png differ
diff --git a/img/getting-started/create-account-set-password.png b/img/getting-started/create-account-set-password.png
new file mode 100644
index 0000000000..fce32e7dcd
Binary files /dev/null and b/img/getting-started/create-account-set-password.png differ
diff --git a/img/getting-started/create-account-start-trial.png b/img/getting-started/create-account-start-trial.png
new file mode 100644
index 0000000000..8d53399238
Binary files /dev/null and b/img/getting-started/create-account-start-trial.png differ
diff --git a/img/getting-started/create-account-view-email.png b/img/getting-started/create-account-view-email.png
new file mode 100644
index 0000000000..675ee3d1d0
Binary files /dev/null and b/img/getting-started/create-account-view-email.png differ
diff --git a/img/getting-started/create-api-security-key.png b/img/getting-started/create-api-security-key.png
new file mode 100644
index 0000000000..3d1003520a
Binary files /dev/null and b/img/getting-started/create-api-security-key.png differ
diff --git a/img/getting-started/create-api-select-authentication.png b/img/getting-started/create-api-select-authentication.png
new file mode 100644
index 0000000000..9b504b4990
Binary files /dev/null and b/img/getting-started/create-api-select-authentication.png differ
diff --git a/img/getting-started/create-new-api.png b/img/getting-started/create-new-api.png
new file mode 100644
index 0000000000..66b6f771e8
Binary files /dev/null and b/img/getting-started/create-new-api.png differ
diff --git a/img/getting-started/overview-options.png b/img/getting-started/overview-options.png
new file mode 100644
index 0000000000..3f5df6c82a
Binary files /dev/null and b/img/getting-started/overview-options.png differ
diff --git a/img/getting-started/portal-home-page-settings.png b/img/getting-started/portal-home-page-settings.png
new file mode 100644
index 0000000000..bee47ca875
Binary files /dev/null and b/img/getting-started/portal-home-page-settings.png differ
diff --git a/img/getting-started/portal_menu.png b/img/getting-started/portal_menu.png
new file mode 100644
index 0000000000..9f79455cbf
Binary files /dev/null and b/img/getting-started/portal_menu.png differ
diff --git a/img/getting-started/tabs-api-management.png b/img/getting-started/tabs-api-management.png
new file mode 100644
index 0000000000..a3631d7196
Binary files /dev/null and b/img/getting-started/tabs-api-management.png differ
diff --git a/img/getting-started/tabs-api-security.png b/img/getting-started/tabs-api-security.png
new file mode 100644
index 0000000000..947c2a77fd
Binary files /dev/null and b/img/getting-started/tabs-api-security.png differ
diff --git a/img/getting-started/tabs-classic-portal.png b/img/getting-started/tabs-classic-portal.png
new file mode 100644
index 0000000000..8359ceba96
Binary files /dev/null and b/img/getting-started/tabs-classic-portal.png differ
diff --git a/img/getting-started/tabs-monitoring.png b/img/getting-started/tabs-monitoring.png
new file mode 100644
index 0000000000..a76954cb1b
Binary files /dev/null and b/img/getting-started/tabs-monitoring.png differ
diff --git a/img/getting-started/tabs-system-management-license.png b/img/getting-started/tabs-system-management-license.png
new file mode 100644
index 0000000000..a8aff4ae33
Binary files /dev/null and b/img/getting-started/tabs-system-management-license.png differ
diff --git a/img/getting-started/tabs-system-management.png b/img/getting-started/tabs-system-management.png
new file mode 100644
index 0000000000..c3ff3f758a
Binary files /dev/null and b/img/getting-started/tabs-system-management.png differ
diff --git a/img/getting-started/tabs-user-management.png b/img/getting-started/tabs-user-management.png
new file mode 100644
index 0000000000..ac27b15794
Binary files /dev/null and b/img/getting-started/tabs-user-management.png differ
diff --git a/img/governance/agents-list-2.png b/img/governance/agents-list-2.png
new file mode 100644
index 0000000000..c99a84f942
Binary files /dev/null and b/img/governance/agents-list-2.png differ
diff --git a/img/governance/agents-list.png b/img/governance/agents-list.png
new file mode 100644
index 0000000000..bc4f78dca1
Binary files /dev/null and b/img/governance/agents-list.png differ
diff --git a/img/governance/agents-new-1.png b/img/governance/agents-new-1.png
new file mode 100644
index 0000000000..e2638eec9f
Binary files /dev/null and b/img/governance/agents-new-1.png differ
diff --git a/img/governance/agents-new-2.png b/img/governance/agents-new-2.png
new file mode 100644
index 0000000000..18877e5859
Binary files /dev/null and b/img/governance/agents-new-2.png differ
diff --git a/img/governance/agents-new-3.png b/img/governance/agents-new-3.png
new file mode 100644
index 0000000000..a07b2fe76a
Binary files /dev/null and b/img/governance/agents-new-3.png differ
diff --git a/img/governance/agents-new-4.png b/img/governance/agents-new-4.png
new file mode 100644
index 0000000000..4a1652b22a
Binary files /dev/null and b/img/governance/agents-new-4.png differ
diff --git a/img/governance/api-details.png b/img/governance/api-details.png
new file mode 100644
index 0000000000..ec65061773
Binary files /dev/null and b/img/governance/api-details.png differ
diff --git a/img/governance/api-list.png b/img/governance/api-list.png
new file mode 100644
index 0000000000..8e0461f3ce
Binary files /dev/null and b/img/governance/api-list.png differ
diff --git a/img/governance/architecture.png b/img/governance/architecture.png
new file mode 100644
index 0000000000..3519f65f71
Binary files /dev/null and b/img/governance/architecture.png differ
diff --git a/img/governance/automated-governance.png b/img/governance/automated-governance.png
new file mode 100644
index 0000000000..f6409af4b9
Binary files /dev/null and b/img/governance/automated-governance.png differ
diff --git a/img/governance/governance-overview.png b/img/governance/governance-overview.png
new file mode 100644
index 0000000000..fc7da8a766
Binary files /dev/null and b/img/governance/governance-overview.png differ
diff --git a/img/governance/ruleset-list-2.png b/img/governance/ruleset-list-2.png
new file mode 100644
index 0000000000..349e1e3aa6
Binary files /dev/null and b/img/governance/ruleset-list-2.png differ
diff --git a/img/governance/ruleset-template-1.png b/img/governance/ruleset-template-1.png
new file mode 100644
index 0000000000..fa8f8d2c04
Binary files /dev/null and b/img/governance/ruleset-template-1.png differ
diff --git a/img/governance/ruleset-template-2.png b/img/governance/ruleset-template-2.png
new file mode 100644
index 0000000000..ac3d8ff80a
Binary files /dev/null and b/img/governance/ruleset-template-2.png differ
diff --git a/img/governance/ruleset-template-3.png b/img/governance/ruleset-template-3.png
new file mode 100644
index 0000000000..fb483084c3
Binary files /dev/null and b/img/governance/ruleset-template-3.png differ
diff --git a/img/governance/ruleset-test-1.png b/img/governance/ruleset-test-1.png
new file mode 100644
index 0000000000..f36080c5fb
Binary files /dev/null and b/img/governance/ruleset-test-1.png differ
diff --git a/img/governance/ruleset-test-2.png b/img/governance/ruleset-test-2.png
new file mode 100644
index 0000000000..be0348b6d7
Binary files /dev/null and b/img/governance/ruleset-test-2.png differ
diff --git a/img/governance/ruleset-test-3.png b/img/governance/ruleset-test-3.png
new file mode 100644
index 0000000000..2ac9545a50
Binary files /dev/null and b/img/governance/ruleset-test-3.png differ
diff --git a/img/governance/sync-repository.png b/img/governance/sync-repository.png
new file mode 100644
index 0000000000..64a7120a7d
Binary files /dev/null and b/img/governance/sync-repository.png differ
diff --git a/img/governance/sync.png b/img/governance/sync.png
new file mode 100644
index 0000000000..ce5d660b0c
Binary files /dev/null and b/img/governance/sync.png differ
diff --git a/img/governance/user-profile.png b/img/governance/user-profile.png
new file mode 100644
index 0000000000..41651c79ba
Binary files /dev/null and b/img/governance/user-profile.png differ
diff --git a/img/graphql-api-star-wars-schema.png b/img/graphql-api-star-wars-schema.png
new file mode 100644
index 0000000000..0d3844ce5e
Binary files /dev/null and b/img/graphql-api-star-wars-schema.png differ
diff --git a/img/graphql-docs-live-portal.png b/img/graphql-docs-live-portal.png
new file mode 100644
index 0000000000..8c7e27e15f
Binary files /dev/null and b/img/graphql-docs-live-portal.png differ
diff --git a/img/graphql-docs-tab-playground-setup.png b/img/graphql-docs-tab-playground-setup.png
new file mode 100644
index 0000000000..f9ae740474
Binary files /dev/null and b/img/graphql-docs-tab-playground-setup.png differ
diff --git a/img/graphql-playground-portal.png b/img/graphql-playground-portal.png
new file mode 100644
index 0000000000..dca37f398b
Binary files /dev/null and b/img/graphql-playground-portal.png differ
diff --git a/img/grpc/grpc-class-diagram.svg b/img/grpc/grpc-class-diagram.svg
new file mode 100644
index 0000000000..360d3a89d3
--- /dev/null
+++ b/img/grpc/grpc-class-diagram.svg
@@ -0,0 +1,316 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+ "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<!-- Generated by graphviz version 10.0.1 (20240210.2158)
+ -->
+<!-- Title: Object Pages: 1 -->
+<svg width="605pt" height="645pt"
+ viewBox="0.00 0.00 604.50 644.50" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 640.5)">
+<title>Object</title>
+<!-- Node1 -->
+<g id="Node000001" class="node">
+<title>Node1</title>
+<g id="a_Node000001"><a xlink:title="Main entry point.">
+<polygon fill="#999999" stroke="none" points="330.5,-116 220.5,-116 220.5,0 330.5,0 330.5,-116"/>
+<text text-anchor="start" x="261.25" y="-102.5" font-family="Helvetica,sans-Serif" font-size="10.00">Object</text>
+<text text-anchor="start" x="224.5" y="-87.5" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="234.5" y="-87.5" font-family="Helvetica,sans-Serif" font-size="10.00">HookType hook_type</text>
+<text text-anchor="start" x="224.5" y="-72.5" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="234.5" y="-72.5" font-family="Helvetica,sans-Serif" font-size="10.00">string hook_name</text>
+<text text-anchor="start" x="224.5" y="-57.5" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="234.5" y="-57.5" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, string</text>
+<text text-anchor="start" x="234.5" y="-46.25" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; metadata</text>
+<text text-anchor="start" x="224.5" y="-31.5" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="234.5" y="-31.5" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, string</text>
+<text text-anchor="start" x="234.5" y="-20.25" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; spec</text>
+<text text-anchor="start" x="274" y="-5.5" font-family="Helvetica,sans-Serif" font-size="10.00"> </text>
+<polygon fill="#666666" stroke="#666666" points="220.5,-99 220.5,-99 330.5,-99 330.5,-99 220.5,-99"/>
+<polygon fill="#666666" stroke="#666666" points="220.5,-17 220.5,-17 232.5,-17 232.5,-17 220.5,-17"/>
+<polygon fill="#666666" stroke="#666666" points="232.5,-17 232.5,-17 330.5,-17 330.5,-17 232.5,-17"/>
+<polygon fill="none" stroke="#666666" points="220.5,0 220.5,-116 330.5,-116 330.5,0 220.5,0"/>
+</a>
+</g>
+</g>
+<!-- Node2 -->
+<g id="Node000002" class="node">
+<title>Node2</title>
+<g id="a_Node000002"><a xlink:href="struct_mini_request_object.html" target="_top" xlink:title="Represents a request that can be modified by middleware.">
+<polygon fill="white" stroke="none" points="147,-469.25 36,-469.25 36,-163.25 147,-163.25 147,-469.25"/>
+<text text-anchor="start" x="49.88" y="-455.75" font-family="Helvetica,sans-Serif" font-size="10.00">MiniRequestObject</text>
+<text text-anchor="start" x="40" y="-440.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-440.75" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, string</text>
+<text text-anchor="start" x="50" y="-429.5" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; headers</text>
+<text text-anchor="start" x="40" y="-414.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-414.75" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, string</text>
+<text text-anchor="start" x="50" y="-403.5" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; set_headers</text>
+<text text-anchor="start" x="40" y="-388.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-388.75" font-family="Helvetica,sans-Serif" font-size="10.00">repeated string delete</text>
+<text text-anchor="start" x="50" y="-377.5" font-family="Helvetica,sans-Serif" font-size="10.00">_headers</text>
+<text text-anchor="start" x="40" y="-362.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-362.75" font-family="Helvetica,sans-Serif" font-size="10.00">string body</text>
+<text text-anchor="start" x="40" y="-347.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-347.75" font-family="Helvetica,sans-Serif" font-size="10.00">string url</text>
+<text text-anchor="start" x="40" y="-332.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-332.75" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, string</text>
+<text text-anchor="start" x="50" y="-321.5" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; params</text>
+<text text-anchor="start" x="40" y="-306.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-306.75" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, string</text>
+<text text-anchor="start" x="50" y="-295.5" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; add_params</text>
+<text text-anchor="start" x="40" y="-280.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-280.75" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, string</text>
+<text text-anchor="start" x="50" y="-269.5" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; extended_params</text>
+<text text-anchor="start" x="40" y="-254.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-254.75" font-family="Helvetica,sans-Serif" font-size="10.00">repeated string delete</text>
+<text text-anchor="start" x="50" y="-243.5" font-family="Helvetica,sans-Serif" font-size="10.00">_params</text>
+<text text-anchor="start" x="40" y="-228.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-228.75" font-family="Helvetica,sans-Serif" font-size="10.00">string method</text>
+<text text-anchor="start" x="40" y="-213.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-213.75" font-family="Helvetica,sans-Serif" font-size="10.00">string request_uri</text>
+<text text-anchor="start" x="40" y="-198.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-198.75" font-family="Helvetica,sans-Serif" font-size="10.00">string scheme</text>
+<text text-anchor="start" x="40" y="-183.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="50" y="-183.75" font-family="Helvetica,sans-Serif" font-size="10.00">bytes raw_body</text>
+<text text-anchor="start" x="90" y="-168.75" font-family="Helvetica,sans-Serif" font-size="10.00"> </text>
+<polygon fill="#666666" stroke="#666666" points="36,-452.25 36,-452.25 147,-452.25 147,-452.25 36,-452.25"/>
+<polygon fill="#666666" stroke="#666666" points="36,-180.25 36,-180.25 48,-180.25 48,-180.25 36,-180.25"/>
+<polygon fill="#666666" stroke="#666666" points="48,-180.25 48,-180.25 147,-180.25 147,-180.25 48,-180.25"/>
+<polygon fill="none" stroke="#666666" points="36,-163.25 36,-469.25 147,-469.25 147,-163.25 36,-163.25"/>
+</a>
+</g>
+</g>
+<!-- Node2&#45;&gt;Node1 -->
+<g id="edge1_Node000001_Node000002" class="edge">
+<title>Node2&#45;&gt;Node1</title>
+<g id="a_edge1_Node000001_Node000002"><a xlink:title=" ">
+<path fill="none" stroke="#63b8ff" d="M146.93,-227.85C161.07,-206.45 176.52,-183.8 191.5,-163.25 200.43,-151 210.27,-138.22 219.97,-125.98"/>
+<polygon fill="none" stroke="#63b8ff" points="220.01,-125.93 220.62,-118.75 227.49,-116.56 226.88,-123.74 220.01,-125.93"/>
+</a>
+</g>
+<text text-anchor="middle" x="232.12" y="-135.75" font-family="Helvetica,sans-Serif" font-size="10.00" fill="grey"> +request</text>
+</g>
+<!-- Node3 -->
+<g id="Node000003" class="node">
+<title>Node3</title>
+<g id="a_Node000003"><a xlink:href="struct_return_overrides.html" target="_top" xlink:title="Used to override the response for a given HTTP request.">
+<polygon fill="white" stroke="none" points="111,-636.5 0,-636.5 0,-516.5 111,-516.5 111,-636.5"/>
+<text text-anchor="start" x="19.88" y="-623" font-family="Helvetica,sans-Serif" font-size="10.00">ReturnOverrides</text>
+<text text-anchor="start" x="4" y="-608" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="14" y="-608" font-family="Helvetica,sans-Serif" font-size="10.00">int32 response_code</text>
+<text text-anchor="start" x="4" y="-593" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="14" y="-593" font-family="Helvetica,sans-Serif" font-size="10.00">string response_error</text>
+<text text-anchor="start" x="4" y="-578" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="14" y="-578" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, string</text>
+<text text-anchor="start" x="14" y="-566.75" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; headers</text>
+<text text-anchor="start" x="4" y="-552" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="14" y="-552" font-family="Helvetica,sans-Serif" font-size="10.00">bool override_error</text>
+<text text-anchor="start" x="4" y="-537" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="14" y="-537" font-family="Helvetica,sans-Serif" font-size="10.00">string response_body</text>
+<text text-anchor="start" x="54" y="-522" font-family="Helvetica,sans-Serif" font-size="10.00"> </text>
+<polygon fill="#666666" stroke="#666666" points="0,-619.5 0,-619.5 111,-619.5 111,-619.5 0,-619.5"/>
+<polygon fill="#666666" stroke="#666666" points="0,-533.5 0,-533.5 12,-533.5 12,-533.5 0,-533.5"/>
+<polygon fill="#666666" stroke="#666666" points="12,-533.5 12,-533.5 111,-533.5 111,-533.5 12,-533.5"/>
+<polygon fill="none" stroke="#666666" points="0,-516.5 0,-636.5 111,-636.5 111,-516.5 0,-516.5"/>
+</a>
+</g>
+</g>
+<!-- Node3&#45;&gt;Node2 -->
+<g id="edge2_Node000002_Node000003" class="edge">
+<title>Node3&#45;&gt;Node2</title>
+<g id="a_edge2_Node000002_Node000003"><a xlink:title=" ">
+<path fill="none" stroke="#63b8ff" d="M63.71,-516.58C65.22,-505.8 66.85,-494.09 68.54,-481.93"/>
+<polygon fill="none" stroke="#63b8ff" points="68.55,-481.88 65.42,-475.39 70.21,-470 73.34,-476.49 68.55,-481.88"/>
+</a>
+</g>
+<text text-anchor="middle" x="106.88" y="-489" font-family="Helvetica,sans-Serif" font-size="10.00" fill="grey"> +return_overrides</text>
+</g>
+<!-- Node4 -->
+<g id="Node000004" class="node">
+<title>Node4</title>
+<g id="a_Node000004"><a xlink:href="struct_session_state.html" target="_top" xlink:title="Created for every authenticated request and stored in Redis.">
+<polygon fill="white" stroke="none" points="350,-421.25 201,-421.25 201,-211.25 350,-211.25 350,-421.25"/>
+<text text-anchor="start" x="246.25" y="-407.75" font-family="Helvetica,sans-Serif" font-size="10.00">SessionState</text>
+<text text-anchor="start" x="205" y="-392.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-392.75" font-family="Helvetica,sans-Serif" font-size="10.00">int64 last_check</text>
+<text text-anchor="start" x="205" y="-377.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-377.75" font-family="Helvetica,sans-Serif" font-size="10.00">double allowance</text>
+<text text-anchor="start" x="205" y="-362.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-362.75" font-family="Helvetica,sans-Serif" font-size="10.00">double rate</text>
+<text text-anchor="start" x="205" y="-347.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-347.75" font-family="Helvetica,sans-Serif" font-size="10.00">double per</text>
+<text text-anchor="start" x="205" y="-332.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-332.75" font-family="Helvetica,sans-Serif" font-size="10.00">int64 expires</text>
+<text text-anchor="start" x="205" y="-317.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-317.75" font-family="Helvetica,sans-Serif" font-size="10.00">int64 quota_max</text>
+<text text-anchor="start" x="205" y="-302.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-302.75" font-family="Helvetica,sans-Serif" font-size="10.00">int64 quota_renews</text>
+<text text-anchor="start" x="205" y="-287.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-287.75" font-family="Helvetica,sans-Serif" font-size="10.00">int64 quota_remaining</text>
+<text text-anchor="start" x="205" y="-272.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-272.75" font-family="Helvetica,sans-Serif" font-size="10.00">int64 quota_renewal_rate</text>
+<text text-anchor="start" x="205" y="-257.75" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="215" y="-257.75" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, AccessDefinition</text>
+<text text-anchor="start" x="215" y="-246.5" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; access_rights</text>
+<text text-anchor="start" x="215" y="-231.75" font-family="Helvetica,sans-Serif" font-size="10.00">and 18 more...</text>
+<text text-anchor="start" x="274" y="-216.75" font-family="Helvetica,sans-Serif" font-size="10.00"> </text>
+<polygon fill="#666666" stroke="#666666" points="201,-404.25 201,-404.25 350,-404.25 350,-404.25 201,-404.25"/>
+<polygon fill="#666666" stroke="#666666" points="201,-228.25 201,-228.25 213,-228.25 213,-228.25 201,-228.25"/>
+<polygon fill="#666666" stroke="#666666" points="213,-228.25 213,-228.25 350,-228.25 350,-228.25 213,-228.25"/>
+<polygon fill="none" stroke="#666666" points="201,-211.25 201,-421.25 350,-421.25 350,-211.25 201,-211.25"/>
+</a>
+</g>
+</g>
+<!-- Node4&#45;&gt;Node1 -->
+<g id="edge3_Node000001_Node000004" class="edge">
+<title>Node4&#45;&gt;Node1</title>
+<g id="a_edge3_Node000001_Node000004"><a xlink:title=" ">
+<path fill="none" stroke="#63b8ff" d="M275.5,-211.39C275.5,-183.63 275.5,-154.29 275.5,-128.84"/>
+<polygon fill="none" stroke="#63b8ff" points="275.5,-128.82 271.5,-122.82 275.5,-116.82 279.5,-122.82 275.5,-128.82"/>
+</a>
+</g>
+<text text-anchor="middle" x="296.88" y="-135.75" font-family="Helvetica,sans-Serif" font-size="10.00" fill="grey"> +session</text>
+</g>
+<!-- Node5 -->
+<g id="Node000005" class="node">
+<title>Node5</title>
+<g id="a_Node000005"><a xlink:href="struct_basic_auth_data.html" target="_top" xlink:title="Contains a hashed password and the name of the hashing algorithm used.">
+<polygon fill="white" stroke="none" points="216,-608.5 129,-608.5 129,-544.5 216,-544.5 216,-608.5"/>
+<text text-anchor="start" x="139.5" y="-595" font-family="Helvetica,sans-Serif" font-size="10.00">BasicAuthData</text>
+<text text-anchor="start" x="133" y="-580" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="143" y="-580" font-family="Helvetica,sans-Serif" font-size="10.00">string password</text>
+<text text-anchor="start" x="133" y="-565" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="143" y="-565" font-family="Helvetica,sans-Serif" font-size="10.00">string hash</text>
+<text text-anchor="start" x="171" y="-550" font-family="Helvetica,sans-Serif" font-size="10.00"> </text>
+<polygon fill="#666666" stroke="#666666" points="129,-591.5 129,-591.5 216,-591.5 216,-591.5 129,-591.5"/>
+<polygon fill="#666666" stroke="#666666" points="129,-561.5 129,-561.5 141,-561.5 141,-561.5 129,-561.5"/>
+<polygon fill="#666666" stroke="#666666" points="141,-561.5 141,-561.5 216,-561.5 216,-561.5 141,-561.5"/>
+<polygon fill="none" stroke="#666666" points="129,-544.5 129,-608.5 216,-608.5 216,-544.5 129,-544.5"/>
+</a>
+</g>
+</g>
+<!-- Node5&#45;&gt;Node4 -->
+<g id="edge4_Node000004_Node000005" class="edge">
+<title>Node5&#45;&gt;Node4</title>
+<g id="a_edge4_Node000004_Node000005"><a xlink:title=" ">
+<path fill="none" stroke="#63b8ff" d="M176.62,-544.74C179.44,-527.54 183.84,-505.87 190.25,-487.25 196.47,-469.2 204.23,-450.62 212.51,-432.69"/>
+<polygon fill="none" stroke="#63b8ff" points="212.52,-432.67 211.46,-425.54 217.64,-421.82 218.7,-428.95 212.52,-432.67"/>
+</a>
+</g>
+<text text-anchor="middle" x="230.62" y="-489" font-family="Helvetica,sans-Serif" font-size="10.00" fill="grey"> +basic_auth_data</text>
+</g>
+<!-- Node6 -->
+<g id="Node000006" class="node">
+<title>Node6</title>
+<g id="a_Node000006"><a xlink:href="struct_j_w_t_data.html" target="_top" xlink:title="Added to sessions where a Tyk key (embedding a shared secret) is used as the public key for signing t...">
+<polygon fill="white" stroke="none" points="309.5,-601 237.5,-601 237.5,-552 309.5,-552 309.5,-601"/>
+<text text-anchor="start" x="252.5" y="-587.5" font-family="Helvetica,sans-Serif" font-size="10.00">JWTData</text>
+<text text-anchor="start" x="241.5" y="-572.5" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="251.5" y="-572.5" font-family="Helvetica,sans-Serif" font-size="10.00">string secret</text>
+<text text-anchor="start" x="272" y="-557.5" font-family="Helvetica,sans-Serif" font-size="10.00"> </text>
+<polygon fill="#666666" stroke="#666666" points="237.5,-584 237.5,-584 309.5,-584 309.5,-584 237.5,-584"/>
+<polygon fill="#666666" stroke="#666666" points="237.5,-569 237.5,-569 249.5,-569 249.5,-569 237.5,-569"/>
+<polygon fill="#666666" stroke="#666666" points="249.5,-569 249.5,-569 309.5,-569 309.5,-569 249.5,-569"/>
+<polygon fill="none" stroke="#666666" points="237.5,-552 237.5,-601 309.5,-601 309.5,-552 237.5,-552"/>
+</a>
+</g>
+</g>
+<!-- Node6&#45;&gt;Node4 -->
+<g id="edge5_Node000004_Node000006" class="edge">
+<title>Node6&#45;&gt;Node4</title>
+<g id="a_edge5_Node000004_Node000006"><a xlink:title=" ">
+<path fill="none" stroke="#63b8ff" d="M273.68,-552.13C273.89,-525.06 274.25,-478.46 274.6,-433.87"/>
+<polygon fill="none" stroke="#63b8ff" points="274.6,-433.96 270.64,-427.93 274.69,-421.96 278.64,-427.99 274.6,-433.96"/>
+</a>
+</g>
+<text text-anchor="middle" x="297.38" y="-489" font-family="Helvetica,sans-Serif" font-size="10.00" fill="grey"> +jwt_data</text>
+</g>
+<!-- Node7 -->
+<g id="Node000007" class="node">
+<title>Node7</title>
+<g id="a_Node000007"><a xlink:href="struct_monitor.html" target="_top" xlink:title="Allow API endpoint users, stakeholders or an organisation to be notified by webhook when certain quot...">
+<polygon fill="white" stroke="none" points="445,-606.5 328,-606.5 328,-546.5 445,-546.5 445,-606.5"/>
+<text text-anchor="start" x="370.38" y="-593" font-family="Helvetica,sans-Serif" font-size="10.00">Monitor</text>
+<text text-anchor="start" x="332" y="-578" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="342" y="-578" font-family="Helvetica,sans-Serif" font-size="10.00">repeated double trigger</text>
+<text text-anchor="start" x="342" y="-566.75" font-family="Helvetica,sans-Serif" font-size="10.00">_limits</text>
+<text text-anchor="start" x="385" y="-552" font-family="Helvetica,sans-Serif" font-size="10.00"> </text>
+<polygon fill="#666666" stroke="#666666" points="328,-589.5 328,-589.5 445,-589.5 445,-589.5 328,-589.5"/>
+<polygon fill="#666666" stroke="#666666" points="328,-563.5 328,-563.5 340,-563.5 340,-563.5 328,-563.5"/>
+<polygon fill="#666666" stroke="#666666" points="340,-563.5 340,-563.5 445,-563.5 445,-563.5 340,-563.5"/>
+<polygon fill="none" stroke="#666666" points="328,-546.5 328,-606.5 445,-606.5 445,-546.5 328,-546.5"/>
+</a>
+</g>
+</g>
+<!-- Node7&#45;&gt;Node4 -->
+<g id="edge6_Node000004_Node000007" class="edge">
+<title>Node7&#45;&gt;Node4</title>
+<g id="a_edge6_Node000004_Node000007"><a xlink:title=" ">
+<path fill="none" stroke="#63b8ff" d="M374.2,-546.88C362.25,-519.09 343.32,-475.05 325.22,-432.93"/>
+<polygon fill="none" stroke="#63b8ff" points="325.24,-432.97 319.2,-429.04 320.5,-421.95 326.55,-425.88 325.24,-432.97"/>
+</a>
+</g>
+<text text-anchor="middle" x="372.12" y="-489" font-family="Helvetica,sans-Serif" font-size="10.00" fill="grey"> +monitor</text>
+</g>
+<!-- Node8 -->
+<g id="Node000008" class="node">
+<title>Node8</title>
+<g id="a_Node000008"><a xlink:href="struct_response_object.html" target="_top" xlink:title="Contains the HTTP reponse data received from the upstream.">
+<polygon fill="white" stroke="none" points="519,-368.75 420,-368.75 420,-263.75 519,-263.75 519,-368.75"/>
+<text text-anchor="start" x="433.12" y="-355.25" font-family="Helvetica,sans-Serif" font-size="10.00">ResponseObject</text>
+<text text-anchor="start" x="424" y="-340.25" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="434" y="-340.25" font-family="Helvetica,sans-Serif" font-size="10.00">int32 status_code</text>
+<text text-anchor="start" x="424" y="-325.25" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="434" y="-325.25" font-family="Helvetica,sans-Serif" font-size="10.00">bytes raw_body</text>
+<text text-anchor="start" x="424" y="-310.25" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="434" y="-310.25" font-family="Helvetica,sans-Serif" font-size="10.00">string body</text>
+<text text-anchor="start" x="424" y="-295.25" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="434" y="-295.25" font-family="Helvetica,sans-Serif" font-size="10.00">map&lt; string, string</text>
+<text text-anchor="start" x="434" y="-284" font-family="Helvetica,sans-Serif" font-size="10.00"> &gt; headers</text>
+<text text-anchor="start" x="468" y="-269.25" font-family="Helvetica,sans-Serif" font-size="10.00"> </text>
+<polygon fill="#666666" stroke="#666666" points="420,-351.75 420,-351.75 519,-351.75 519,-351.75 420,-351.75"/>
+<polygon fill="#666666" stroke="#666666" points="420,-280.75 420,-280.75 432,-280.75 432,-280.75 420,-280.75"/>
+<polygon fill="#666666" stroke="#666666" points="432,-280.75 432,-280.75 519,-280.75 519,-280.75 432,-280.75"/>
+<polygon fill="none" stroke="#666666" points="420,-263.75 420,-368.75 519,-368.75 519,-263.75 420,-263.75"/>
+</a>
+</g>
+</g>
+<!-- Node8&#45;&gt;Node1 -->
+<g id="edge7_Node000001_Node000008" class="edge">
+<title>Node8&#45;&gt;Node1</title>
+<g id="a_edge7_Node000001_Node000008"><a xlink:title=" ">
+<path fill="none" stroke="#63b8ff" d="M432.77,-263.84C411.4,-234.21 383.77,-196.38 358.5,-163.25 349.24,-151.11 339.23,-138.29 329.49,-125.96"/>
+<polygon fill="none" stroke="#63b8ff" points="329.4,-125.85 322.53,-123.64 321.94,-116.45 328.8,-118.67 329.4,-125.85"/>
+</a>
+</g>
+<text text-anchor="middle" x="367.88" y="-135.75" font-family="Helvetica,sans-Serif" font-size="10.00" fill="grey"> +response</text>
+</g>
+<!-- Node9 -->
+<g id="Node000009" class="node">
+<title>Node9</title>
+<g id="a_Node000009"><a xlink:href="struct_header.html" target="_top" xlink:title="A reponse header that contains multiple associated values.">
+<polygon fill="white" stroke="none" points="577.5,-608.5 463.5,-608.5 463.5,-544.5 577.5,-544.5 577.5,-608.5"/>
+<text text-anchor="start" x="504.75" y="-595" font-family="Helvetica,sans-Serif" font-size="10.00">Header</text>
+<text text-anchor="start" x="467.5" y="-580" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="477.5" y="-580" font-family="Helvetica,sans-Serif" font-size="10.00">string key</text>
+<text text-anchor="start" x="467.5" y="-565" font-family="Helvetica,sans-Serif" font-size="10.00">+</text>
+<text text-anchor="start" x="477.5" y="-565" font-family="Helvetica,sans-Serif" font-size="10.00">repeated string values</text>
+<text text-anchor="start" x="519" y="-550" font-family="Helvetica,sans-Serif" font-size="10.00"> </text>
+<polygon fill="#666666" stroke="#666666" points="463.5,-591.5 463.5,-591.5 577.5,-591.5 577.5,-591.5 463.5,-591.5"/>
+<polygon fill="#666666" stroke="#666666" points="463.5,-561.5 463.5,-561.5 475.5,-561.5 475.5,-561.5 463.5,-561.5"/>
+<polygon fill="#666666" stroke="#666666" points="475.5,-561.5 475.5,-561.5 577.5,-561.5 577.5,-561.5 475.5,-561.5"/>
+<polygon fill="none" stroke="#666666" points="463.5,-544.5 463.5,-608.5 577.5,-608.5 577.5,-544.5 463.5,-544.5"/>
+</a>
+</g>
+</g>
+<!-- Node9&#45;&gt;Node8 -->
+<g id="edge8_Node000008_Node000009" class="edge">
+<title>Node9&#45;&gt;Node8</title>
+<g id="a_edge8_Node000008_Node000009"><a xlink:title=" ">
+<path fill="none" stroke="#63b8ff" d="M514.4,-544.61C506.48,-504.49 492.45,-433.47 482.18,-381.45"/>
+<polygon fill="none" stroke="#63b8ff" points="482.15,-381.33 477.07,-376.21 479.83,-369.55 484.92,-374.66 482.15,-381.33"/>
+</a>
+</g>
+<text text-anchor="middle" x="550" y="-489" font-family="Helvetica,sans-Serif" font-size="10.00" fill="grey"> +multivalue_headers</text>
+</g>
+</g>
+</svg>
diff --git a/img/heroku-logo.png b/img/heroku-logo.png
new file mode 100644
index 0000000000..a9db646a45
Binary files /dev/null and b/img/heroku-logo.png differ
diff --git a/img/hybrid-gateway/tyk-cloud-hybrid-configuration-home.png b/img/hybrid-gateway/tyk-cloud-hybrid-configuration-home.png
new file mode 100644
index 0000000000..7578ecd529
Binary files /dev/null and b/img/hybrid-gateway/tyk-cloud-hybrid-configuration-home.png differ
diff --git a/img/hybrid-gateway/tyk-cloud-hybrid-confirm-config-removal.png b/img/hybrid-gateway/tyk-cloud-hybrid-confirm-config-removal.png
new file mode 100644
index 0000000000..1f2aa51a5b
Binary files /dev/null and b/img/hybrid-gateway/tyk-cloud-hybrid-confirm-config-removal.png differ
diff --git a/img/hybrid-gateway/tyk-cloud-hybrid-masked-details.png b/img/hybrid-gateway/tyk-cloud-hybrid-masked-details.png
new file mode 100644
index 0000000000..0785c66eee
Binary files /dev/null and b/img/hybrid-gateway/tyk-cloud-hybrid-masked-details.png differ
diff --git a/img/hybrid-gateway/tyk-cloud-hybrid-open-details.png b/img/hybrid-gateway/tyk-cloud-hybrid-open-details.png
new file mode 100644
index 0000000000..553276cea6
Binary files /dev/null and b/img/hybrid-gateway/tyk-cloud-hybrid-open-details.png differ
diff --git a/img/hybrid-gateway/tyk-cloud-hybrid-remove-configs.png b/img/hybrid-gateway/tyk-cloud-hybrid-remove-configs.png
new file mode 100644
index 0000000000..00e2de5723
Binary files /dev/null and b/img/hybrid-gateway/tyk-cloud-hybrid-remove-configs.png differ
diff --git a/img/hybrid-gateway/tyk-cloud-hybrid-revealed-instructions.png b/img/hybrid-gateway/tyk-cloud-hybrid-revealed-instructions.png
new file mode 100644
index 0000000000..43c7696c73
Binary files /dev/null and b/img/hybrid-gateway/tyk-cloud-hybrid-revealed-instructions.png differ
diff --git a/img/hybrid-gateway/tyk-cloud-save-hybrid-configuration.png b/img/hybrid-gateway/tyk-cloud-save-hybrid-configuration.png
new file mode 100644
index 0000000000..332211bbe0
Binary files /dev/null and b/img/hybrid-gateway/tyk-cloud-save-hybrid-configuration.png differ
diff --git a/img/k8s.png b/img/k8s.png
new file mode 100644
index 0000000000..437c0d007a
Binary files /dev/null and b/img/k8s.png differ
diff --git a/img/keycloak-jwt/client-secret.png b/img/keycloak-jwt/client-secret.png
new file mode 100644
index 0000000000..10cdb8aa81
Binary files /dev/null and b/img/keycloak-jwt/client-secret.png differ
diff --git a/img/keycloak-jwt/client.png b/img/keycloak-jwt/client.png
new file mode 100644
index 0000000000..ed88cf4480
Binary files /dev/null and b/img/keycloak-jwt/client.png differ
diff --git a/img/keycloak-jwt/create-client.png b/img/keycloak-jwt/create-client.png
new file mode 100644
index 0000000000..dc61d6995e
Binary files /dev/null and b/img/keycloak-jwt/create-client.png differ
diff --git a/img/keycloak-sso/add-redirectUrl-to-client.png b/img/keycloak-sso/add-redirectUrl-to-client.png
new file mode 100644
index 0000000000..3e27474f98
Binary files /dev/null and b/img/keycloak-sso/add-redirectUrl-to-client.png differ
diff --git a/img/keycloak-sso/copy-callback-url.png b/img/keycloak-sso/copy-callback-url.png
new file mode 100644
index 0000000000..0cf05209f0
Binary files /dev/null and b/img/keycloak-sso/copy-callback-url.png differ
diff --git a/img/keycloak-sso/create-client.png b/img/keycloak-sso/create-client.png
new file mode 100644
index 0000000000..fbed8f08f7
Binary files /dev/null and b/img/keycloak-sso/create-client.png differ
diff --git a/img/keycloak-sso/create-client2.png b/img/keycloak-sso/create-client2.png
new file mode 100644
index 0000000000..649d58863a
Binary files /dev/null and b/img/keycloak-sso/create-client2.png differ
diff --git a/img/keycloak-sso/create-profile.png b/img/keycloak-sso/create-profile.png
new file mode 100644
index 0000000000..27c9c72d6f
Binary files /dev/null and b/img/keycloak-sso/create-profile.png differ
diff --git a/img/keycloak-sso/enable-client-auth.png b/img/keycloak-sso/enable-client-auth.png
new file mode 100644
index 0000000000..90ae725e23
Binary files /dev/null and b/img/keycloak-sso/enable-client-auth.png differ
diff --git a/img/keycloak-sso/identity-management.png b/img/keycloak-sso/identity-management.png
new file mode 100644
index 0000000000..349d247449
Binary files /dev/null and b/img/keycloak-sso/identity-management.png differ
diff --git a/img/keycloak-sso/keycloak-login.png b/img/keycloak-sso/keycloak-login.png
new file mode 100644
index 0000000000..06488854cf
Binary files /dev/null and b/img/keycloak-sso/keycloak-login.png differ
diff --git a/img/keycloak-sso/logged-in.png b/img/keycloak-sso/logged-in.png
new file mode 100644
index 0000000000..1eb1bc7359
Binary files /dev/null and b/img/keycloak-sso/logged-in.png differ
diff --git a/img/keycloak-sso/login-url.png b/img/keycloak-sso/login-url.png
new file mode 100644
index 0000000000..d90d117333
Binary files /dev/null and b/img/keycloak-sso/login-url.png differ
diff --git a/img/keycloak-sso/realm-discovery-endpoint.png b/img/keycloak-sso/realm-discovery-endpoint.png
new file mode 100644
index 0000000000..7d1895aadb
Binary files /dev/null and b/img/keycloak-sso/realm-discovery-endpoint.png differ
diff --git a/img/keycloak-sso/retrieve-client-secret.png b/img/keycloak-sso/retrieve-client-secret.png
new file mode 100644
index 0000000000..e97710d79d
Binary files /dev/null and b/img/keycloak-sso/retrieve-client-secret.png differ
diff --git a/img/keycloak-sso/set-provider-type.png b/img/keycloak-sso/set-provider-type.png
new file mode 100644
index 0000000000..727bef857b
Binary files /dev/null and b/img/keycloak-sso/set-provider-type.png differ
diff --git a/img/linux-icon.svg b/img/linux-icon.svg
new file mode 100644
index 0000000000..c7cbb95bea
--- /dev/null
+++ b/img/linux-icon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="64" height="64" viewBox="0 0 32 32"><style><![CDATA[.B{color-interpolation-filters:sRGB}.C{fill-opacity:1}.D{stroke:none}.E{fill:#020204}.F{stroke-linejoin:miter}.G{stroke-opacity:1}.H{stroke-width:1}.I{stroke-linecap:butt}.J{fill:#7c7c7c}]]></style><defs><radialGradient r="14.572" fy="137.661" fx="223.196" cy="137.661" cx="223.196" gradientTransform="matrix(1.0857794,-0.03431182,0.03943781,1.2479887,-154.54194,-26.542647)" id="A" xlink:href="#Ac"><stop offset="0" stop-color="#fefefc"/><stop offset=".757" stop-color="#fefefc"/><stop offset="1" stop-color="#d4d4d4"/></radialGradient><radialGradient r="14.572" fy="137.661" fx="223.196" cy="137.661" cx="223.196" gradientTransform="matrix(0.81524244,-0.03431182,0.02961133,1.2479887,-129.43743,-26.542647)" id="B" xlink:href="#Ac"><stop offset="0" stop-color="#fefefc"/><stop offset=".757" stop-color="#fefefc"/><stop offset="1" stop-color="#d4d4d4"/></radialGradient><linearGradient id="C" xlink:href="#Ac"><stop offset="0" stop-color="#3e2a06"/><stop offset="1" stop-color="#ad780a"/></linearGradient><linearGradient xlink:href="#C" id="D" x1="447.113" y1="364.09" x2="489.181" y2="300.828"/><linearGradient xlink:href="#C" id="E" x1="442.039" y1="371.544" x2="490.122" y2="293.585"/><clipPath id="F"><path d="M137.577 281.02c1.6-.663 3.398-.784 5.1-.47s3.31 1.05 4.743 2.022c2.864 1.946 4.988 4.778 7.023 7.58 4.672 6.434 9.17 13.002 13.245 19.83 3.306 5.538 6.344 11.257 10.164 16.453 2.494 3.392 5.307 6.54 7.813 9.922s4.728 7.056 5.84 11.117c1.444 5.277.885 11.093-1.627 15.953-1.767 3.42-4.476 6.352-7.772 8.34s-7.17 3.014-11.016 2.87c-6.114-.23-11.7-3.285-17.384-5.55-11.58-4.612-24.16-6.06-36.097-9.652-3.67-1.104-7.276-2.41-10.97-3.426-1.64-.45-3.31-.848-4.86-1.55s-3-1.75-3.862-3.217c-.666-1.134-.948-2.47-.93-3.786s.326-2.615.774-3.852c.896-2.474 2.343-4.714 3.32-7.157 1.595-3.99 1.882-8.388 1.667-12.68s-.91-8.545-1.205-12.83c-.13-1.914-.18-3.853.185-5.736s1.176-3.725 2.558-5.055c1.274-1.227 2.965-1.955 4.696-2.317s3.515-.377 5.284-.338 3.54.134 5.304-.01 3.533-.54 5.07-1.418c1.46-.834 2.654-2.075 3.644-3.434s1.79-2.846 2.61-4.314 1.668-2.932 2.742-4.226 2.39-2.423 3.943-3.067" fill="#402c07" class="C D"/></clipPath><filter id="G" x="-.108" width="1.215" y="-.108" height="1.217" class="B"><feGaussianBlur stdDeviation="3.924"/></filter><filter id="H" class="B"><feGaussianBlur stdDeviation="2.437"/></filter><filter id="I" class="B"><feGaussianBlur stdDeviation=".37"/></filter><clipPath id="J"><path d="M248.06 184.612s-5.106 6.345-7.897 10.247-5.737 6.65-8.587 10.75-7.365 9.432-9.45 13.93-2.32 9.036-4.265 13.85-3.7 10.642-5.97 15.336-5.37 9.685-6.94 13.536-3.81 5.724-4.108 10.22-.577 8.317 3.772 16.772 17.236 22.007 24.242 27.925 9.39 7.225 14.602 8.526 13.856 2.998 16.73-1.27 2.272-5.965-.75-10.666-4.825-5.302-9.796-9.573-18.637-14.873-22.682-19.24-7.107-3.412-5.53-6.284-2.207-4.01-2.658-7.693c-.764-6.245.944-18.7 1.46-22.133s1.224-2.924 3.518-8.04 4.124-8.624 7.05-13.467 8.625-10.128 11.15-15.278 3.504-10.72 4.362-15.318 1.746-12.13 1.746-12.13z" fill="none" stroke="#729fcf" stroke-width=".125" stroke-miterlimit="4" stroke-dasharray="none" class="F G"/></clipPath><filter id="K" x="-.101" width="1.202" y="-.043" height="1.085" class="B"><feGaussianBlur stdDeviation="1.132"/></filter><clipPath id="L"><path d="M386.188 285.328c-.405-1.104-1.118-2.082-1.99-2.87s-1.9-1.392-2.983-1.852c-2.165-.92-4.52-1.26-6.832-1.696l-6.528-1.277c-2.27-.386-4.618-.632-6.865-.125-1.966.443-3.784 1.46-5.272 2.82s-2.65 3.056-3.485 4.9c-1.472 3.23-1.935 6.865-1.654 10.403.21 2.633.875 5.346 2.61 7.34 1.4 1.61 3.387 2.615 5.434 3.22 3.525 1.043 7.367.988 10.86-.155a28.59 28.59 0 0 0 14.33-10.779c1.14-1.65 2.112-3.448 2.553-5.403.336-1.5.348-3.08-.178-4.515" fill="none" stroke="#ce5c00" class="F G H I"/></clipPath><filter id="M" x="-.07" width="1.141" y="-.151" height="1.301" class="B"><feGaussianBlur stdDeviation="1.025"/></filter><clipPath id="N"><path d="M386.188 285.328c-.405-1.104-1.118-2.082-1.99-2.87s-1.9-1.392-2.983-1.852c-2.165-.92-4.52-1.26-6.832-1.696l-6.528-1.277c-2.27-.386-4.618-.632-6.865-.125-1.966.443-3.784 1.46-5.272 2.82s-2.65 3.056-3.485 4.9c-1.472 3.23-1.935 6.865-1.654 10.403.21 2.633.875 5.346 2.61 7.34 1.4 1.61 3.387 2.615 5.434 3.22 3.525 1.043 7.367.988 10.86-.155a28.59 28.59 0 0 0 14.33-10.779c1.14-1.65 2.112-3.448 2.553-5.403.336-1.5.348-3.08-.178-4.515" fill="none" stroke="#ce5c00" class="F G H I"/></clipPath><filter id="O" x="-.201" width="1.401" y="-.234" height="1.468" class="B"><feGaussianBlur stdDeviation="2.844"/></filter><filter id="P" x="-.091" width="1.183" y="-.107" height="1.213" class="B"><feGaussianBlur stdDeviation="1.297"/></filter><filter id="Q" x="-.469" width="1.939" y="-.274" height="1.547" class="B"><feGaussianBlur stdDeviation=".86"/></filter><filter id="R" x="-.604" width="2.208" y="-.482" height="1.965" class="B"><feGaussianBlur stdDeviation="2.64"/></filter><filter id="S" class="B"><feGaussianBlur stdDeviation="2.209"/></filter><clipPath id="T"><path d="M516.006 331.876c.91 1.597-1.57 3.388-2.816 4.738-2.742 2.973-6.45 4.902-9.896 7.02-5.914 3.635-12.62 5.903-18.42 9.717-3.883 2.553-7.328 5.722-10.86 8.742-3.022 2.584-5.482 5.876-8.832 8.018s-7.044 4.154-10.99 4.65c-4.783.6-9.872-.256-14.3-2.164-3.095-1.334-6.16-3.38-7.963-6.23-1.813-2.865-2.06-6.538-2.233-9.924-.307-6.06 1.363-12.06 2.178-18.073.68-5.002 1.853-9.943 2.26-14.975.74-9.142-.78-18.408.32-27.513.355-2.937-.18-6.66 2.012-8.644 2.038-1.845 5.43-1.12 8.18-1.063 3.345.07 6.632.95 9.89 1.717 2.056.483 3.998 1.41 6.072 1.81 3.44.663 6.966 1.066 10.467.952 3.785-.124 7.437-1.796 11.224-1.765 1.552.013 3.124.282 4.586.8 1.483.525 2.988 1.206 4.123 2.295.865.83 1.43 1.957 1.88 3.07.672 1.662.894 3.478 1.167 5.25.242 1.574-.153 3.27.414 4.76 1.83 4.8 5.577 8.727 9.225 12.343 1.743 1.935 4.03 3.534 6.167 4.828 2.27 1.374 4.368 2.45 5.463 4.816.66 1.485-.544 3.76.683 4.826z" fill="url(#E)" class="C D"/></clipPath><clipPath id="U"><path d="M516.006 331.876c.91 1.597-1.57 3.388-2.816 4.738-2.742 2.973-6.45 4.902-9.896 7.02-5.914 3.635-12.62 5.903-18.42 9.717-3.883 2.553-7.328 5.722-10.86 8.742-3.022 2.584-5.482 5.876-8.832 8.018s-7.044 4.154-10.99 4.65c-4.783.6-9.872-.256-14.3-2.164-3.095-1.334-6.16-3.38-7.963-6.23-1.813-2.865-2.06-6.538-2.233-9.924-.307-6.06 1.363-12.06 2.178-18.073.68-5.002 1.853-9.943 2.26-14.975.74-9.142-.78-18.408.32-27.513.355-2.937-.18-6.66 2.012-8.644 2.038-1.845 5.43-1.12 8.18-1.063 3.345.07 6.632.95 9.89 1.717 2.056.483 3.998 1.41 6.072 1.81 3.44.663 6.966 1.066 10.467.952 3.785-.124 7.437-1.796 11.224-1.765 1.552.013 3.124.282 4.586.8 1.483.525 2.988 1.206 4.123 2.295.865.83 1.43 1.957 1.88 3.07.672 1.662.894 3.478 1.167 5.25.242 1.574-.153 3.27.414 4.76 1.83 4.8 5.577 8.727 9.225 12.343 1.743 1.935 4.03 3.534 6.167 4.828 2.27 1.374 4.368 2.45 5.463 4.816.66 1.485-.544 3.76.683 4.826z" fill="url(#E)" class="C D"/></clipPath><filter id="V" x="-.145" width="1.29" y="-.143" height="1.286" class="B"><feGaussianBlur stdDeviation="4.779"/></filter><clipPath id="W"><path d="M511.827 331.9c.795 1.296-1.374 2.75-2.464 3.845-2.4 2.413-5.644 3.978-8.66 5.697-5.174 2.95-11.04 4.8-16.116 7.885-3.397 2.072-6.41 4.644-9.502 7.094-2.644 2.097-4.796 4.77-7.728 6.506s-6.163 3.37-9.616 3.774c-4.185.488-8.637-.208-12.5-1.756-2.708-1.083-5.4-2.744-6.967-5.055-1.586-2.325-1.803-5.305-1.953-8.053-.27-4.918 1.192-9.787 1.906-14.666.594-4.06 1.62-8.07 1.977-12.152.647-7.418-.682-14.938.28-22.327.3-2.383-.158-5.404 1.76-7.014 1.783-1.497 4.75-.9 7.156-.862 2.927.058 5.803.772 8.652 1.393 1.8.392 3.498 1.145 5.313 1.47 3 .538 6.094.865 9.158.772 3.312-.1 6.506-1.458 9.82-1.432 1.358.01 2.733.23 4.013.65 1.297.426 2.614.98 3.607 1.862.757.674 1.25 1.588 1.644 2.5.588 1.35.782 2.822 1.02 4.26.212 1.277-.134 2.655.363 3.862 1.6 3.895 4.88 7.082 8.07 10.016 1.525 1.57 3.526 2.868 5.396 3.918 1.985 1.115 3.82 1.988 4.78 3.908.577 1.205-.476 3.052.598 3.917z" fill="url(#D)" class="C D"/></clipPath><filter id="X" x="-.115" width="1.231" y="-.125" height="1.25" class="B"><feGaussianBlur stdDeviation="3.173"/></filter><filter id="Y" x="-.021" width="1.042" y="-.129" height="1.259" class="B"><feGaussianBlur stdDeviation=".479"/></filter><filter id="Z" x="-.178" width="1.355" y="-.159" height="1.319" class="B"><feGaussianBlur stdDeviation=".901"/></filter><filter height="1.116" y="-.058" width="2.633" x="-.817" id="a" class="B"><feGaussianBlur stdDeviation="1.446"/></filter><linearGradient id="b" xlink:href="#Ac"><stop offset="0"/><stop offset="1" stop-opacity=".25"/></linearGradient><filter id="c" class="B"><feGaussianBlur stdDeviation=".785"/></filter><filter id="d" class="B"><feGaussianBlur stdDeviation="1.138"/></filter><filter id="e" class="B"><feGaussianBlur stdDeviation=".643"/></filter><clipPath id="f"><path d="M304.847 225.45c6.016 4.923 9.777 12.317 10.943 20.003 1.825 12.03-2.346 24.075-6.446 35.533-.817 2.285-1.64 4.6-1.965 6.995s-.12 4.948 1.03 7.086c1.303 2.425 3.732 4.125 6.367 4.923 2.59.784 5.394.76 8.015.092s5.06-1.968 7.187-3.64c5.48-4.3 8.758-10.986 10-17.844s.64-13.93-.55-20.798c-1.623-9.37-4.31-18.54-7.74-27.408-2.518-6.507-5.468-12.91-9.618-18.52-4.046-5.47-9.162-10.1-13.103-15.635-2.732-3.844-4.9-8.13-8.192-11.508-1.646-1.69-3.577-3.135-5.77-4s-4.664-1.124-6.933-.482c-1.505.426-2.892 1.237-4.038 2.3s-2.053 2.376-2.693 3.803c-1.28 2.853-1.477 6.112-.965 9.198.66 3.983 2.444 7.693 4.466 11.19 2.274 3.932 4.918 7.72 8.384 10.654 3.6 3.047 7.962 5.074 11.61 8.06" fill="none" stroke="#c17d11" class="F G H I"/></clipPath><filter id="g" x="-.118" width="1.235" y="-.04" height="1.08" class="B"><feGaussianBlur stdDeviation="1.352"/></filter><clipPath id="h"><path d="M54.232 122.362c-3.792 4.79-8.518 11.69-8.193 17.25s3.86 13.935 8.375 16 5.754.013 8.33-2.5 3.86-7.348 4.006-12.25-3.035-11.92-5.44-15.25-3.287-8.04-7.08-3.25z" fill="url(#B)" class="C D"/></clipPath><filter height="1.43" y="-.215" width="1.31" x="-.155" id="i" class="B"><feGaussianBlur stdDeviation=".899"/></filter><filter id="j" class="B"><feGaussianBlur stdDeviation=".758"/></filter><filter id="k" x="-.161" width="1.322" y="-.13" height="1.261" class="B"><feGaussianBlur stdDeviation=".849"/></filter><linearGradient id="l" xlink:href="#Ac"><stop offset="0" stop-color="#3a2903"/><stop offset=".555" stop-color="#735208"/><stop offset="1" stop-color="#ac8c04"/></linearGradient><filter id="m" class="B"><feGaussianBlur stdDeviation=".11"/></filter><filter id="n" x="-.116" width="1.233" y="-.106" height="1.211" class="B"><feGaussianBlur stdDeviation=".11"/></filter><filter height="1.272" y="-.136" width="1.215" x="-.107" id="o" class="B"><feGaussianBlur stdDeviation=".264"/></filter><filter height="1.292" y="-.146" width="1.469" x="-.234" id="p" class="B"><feGaussianBlur stdDeviation=".513"/></filter><linearGradient id="q" xlink:href="#Ac"><stop offset="0" stop-color="#646464" stop-opacity="0"/><stop offset=".306" stop-color="#646464" stop-opacity=".583"/><stop offset=".47" stop-color="#646464"/><stop offset=".728" stop-color="#646464" stop-opacity=".257"/><stop offset="1" stop-color="#646464" stop-opacity="0"/></linearGradient><filter id="r" class="B"><feGaussianBlur stdDeviation=".135"/></filter><filter id="s" class="B"><feGaussianBlur stdDeviation=".148"/></filter><clipPath id="t"><path d="M85.75 122.362c-2.547 2.127-5.208 4.6-6.25 7.75-1.31 3.96-1.633 8.917.5 12.5 3.92 6.582 12.384 13.85 19.75 11.75 4.875-1.39 6.107-8.5 7-13.5.59-3.307.596-7.193-1.25-10-3.612-5.493-10.427-9.894-17-10-1.044-.017-1.95.83-2.75 1.5z" fill="url(#A)" class="C D"/></clipPath><filter height="1.418" y="-.209" width="1.316" x="-.158" id="u" class="B"><feGaussianBlur stdDeviation=".249"/></filter><filter height="1.363" y="-.181" width="1.357" x="-.179" id="v" class="B"><feGaussianBlur stdDeviation=".519"/></filter><filter id="w" x="-.292" width="1.584" y="-.308" height="1.617" class="B"><feGaussianBlur stdDeviation="1.74"/></filter><filter height="1.215" y="-.107" width="1.108" x="-.054" id="x" class="B"><feGaussianBlur stdDeviation="1.361"/></filter><filter id="y" class="B"><feGaussianBlur stdDeviation=".932"/></filter><filter height="1.258" y="-.129" width="1.153" x="-.076" id="z" class="B"><feGaussianBlur stdDeviation="2.036"/></filter><radialGradient id="AA" gradientTransform="matrix(0.81524244,-0.03431182,0.02961133,1.2479887,-208.43744,-35.542647)" cx="223.196" cy="137.661" fx="223.196" fy="137.661" r="14.572" xlink:href="#Ac"><stop offset="0" stop-color="#fefefc"/><stop offset=".757" stop-color="#fefefc"/><stop offset="1" stop-color="#d4d4d4"/></radialGradient><radialGradient id="AB" gradientTransform="matrix(1.0857794,-0.03431182,0.03943781,1.2479887,-233.54194,-35.542647)" cx="223.196" cy="137.661" fx="223.196" fy="137.661" r="14.572" xlink:href="#Ac"><stop offset="0" stop-color="#fefefc"/><stop offset=".757" stop-color="#fefefc"/><stop offset="1" stop-color="#d4d4d4"/></radialGradient><radialGradient id="AC" gradientTransform="matrix(0.69784558,-0.50717348,0.46034105,0.63340638,-271.10191,183.03011)" cx="275.538" cy="150.651" fx="275.538" fy="150.651" r="15.382" xlink:href="#Ac"><stop offset="0" stop-color="#020204"/><stop offset=".734" stop-color="#020204"/><stop offset="1" stop-color="#5c5c5c"/></radialGradient><linearGradient id="AD" x1="303.016" y1="132.77" x2="309.733" y2="140.725" xlink:href="#Ac"><stop offset="0" stop-color="#949494" stop-opacity=".392"/><stop offset=".5" stop-color="#949494"/><stop offset="1" stop-color="#949494" stop-opacity=".392"/></linearGradient><linearGradient id="AE" x1="87.25" y1="119.987" x2="108.625" y2="132.487" xlink:href="#Ac"><stop offset="0" stop-color="#747474"/><stop offset=".125" stop-color="#8c8c8c"/><stop offset=".25" stop-color="#a4a4a4"/><stop offset=".5" stop-color="#d4d4d4"/><stop offset=".619" stop-color="#d4d4d4"/><stop offset="1" stop-color="#7c7c7c"/></linearGradient><linearGradient xlink:href="#q" id="AF" x1="15.51" y1="105.562" x2="29.741" y2="118.997"/><linearGradient xlink:href="#q" id="AG" x1="-25.773" y1="106.666" x2="-12.373" y2="119.571"/><linearGradient id="AH" x1="164.049" y1="132.063" x2="169.882" y2="142.493" xlink:href="#Ac"><stop offset="0" stop-color="#757574" stop-opacity="0"/><stop offset=".263" stop-color="#757574"/><stop offset=".5" stop-color="#757574"/><stop offset="1" stop-color="#757574" stop-opacity="0"/></linearGradient><radialGradient id="AI" gradientTransform="matrix(0.93618683,-0.38640412,0.27133164,0.65738721,-244.47527,146.7229)" cx="294.485" cy="193.099" fx="294.485" fy="193.099" r="31.111" xlink:href="#Ac"><stop offset="0" stop-color="#d2940a"/><stop offset=".751" stop-color="#d89c08"/><stop offset=".866" stop-color="#b67e07"/><stop offset="1" stop-color="#946106"/></radialGradient><linearGradient id="AJ" x1="46.857" y1="158.314" x2="103.337" y2="157.872" xlink:href="#Ac"><stop offset="0" stop-color="#ad780a"/><stop offset=".12" stop-color="#d89e08"/><stop offset=".255" stop-color="#edb80b"/><stop offset=".392" stop-color="#ebc80d"/><stop offset=".527" stop-color="#f5d838"/><stop offset=".769" stop-color="#f6d811"/><stop offset="1" stop-color="#f5cd31"/></linearGradient><radialGradient xlink:href="#l" id="AK" gradientTransform="matrix(1.0000004,0,0,0.5833264,-3.4574816e-5,61.416192)" cx="77.672" cy="147.093" fx="77.672" fy="147.093" r="3.23"/><radialGradient xlink:href="#l" id="AL" gradientTransform="matrix(1,0,0,1.0751189,0,-11.094161)" cx="63.125" cy="147.441" fx="63.125" fy="147.441" r="1.535"/><linearGradient id="AM" x1="243.031" y1="157.018" x2="243.469" y2="159.768" xlink:href="#Ac"><stop offset="0" stop-color="#f5ce2d"/><stop offset="1" stop-color="#d79b08"/></linearGradient><radialGradient id="AN" gradientTransform="matrix(0.20141143,-0.03316079,0.03065006,0.18616184,-3.1263574,114.03586)" cx="268.07" cy="126.535" fx="268.07" fy="126.535" r="35.511" xlink:href="#Ac"><stop offset="0" stop-color="#c8c8c8"/><stop offset="1" stop-color="#797978"/></radialGradient><radialGradient id="AO" gradientTransform="matrix(-0.69844216,0,0,0.76335815,166.3057,50.219935)" cx="336.224" cy="220.538" fx="336.224" fy="220.538" r="27.391" xlink:href="#Ac"><stop offset="0"/><stop offset="1" stop-opacity=".25"/></radialGradient><radialGradient xlink:href="#b" id="AP" gradientTransform="matrix(1,0,0,0.76335815,-289,41.219938)" cx="312.145" cy="236.366" fx="312.145" fy="236.366" r="27.391"/><radialGradient xlink:href="#b" id="AQ" gradientTransform="matrix(1,0,0,1.0692348,-289,-23.860302)" cx="275.554" cy="225.135" fx="275.554" fy="225.135" r="10.845"/><linearGradient id="AR" x1="28.286" y1="323.901" x2="31.982" y2="351.487" xlink:href="#Ac"><stop offset="0"/><stop offset="1" stop-opacity="0"/></linearGradient><linearGradient id="AS" x1="442.039" y1="371.544" x2="490.122" y2="293.585" xlink:href="#Ac"><stop offset="0" stop-color="#3e2a06"/><stop offset="1" stop-color="#ad780a"/></linearGradient><linearGradient id="AT" x1="45.164" y1="289.589" x2="43.75" y2="302.317" xlink:href="#Ac"><stop offset="0" stop-color="#f3cd0c"/><stop offset="1" stop-color="#f3cd0c" stop-opacity="0"/></linearGradient><radialGradient id="AU" gradientTransform="matrix(1.3082075,0.35053296,-0.36795399,1.3732236,-310.50935,-240.34915)" cx="363.34" cy="303.415" fx="363.34" fy="303.415" r="16.846" xlink:href="#Ac"><stop offset="0" stop-color="#110800"/><stop offset=".591" stop-color="#a65a00" stop-opacity=".8"/><stop offset="1" stop-color="#ff921e" stop-opacity="0"/></radialGradient><radialGradient id="AV" gradientTransform="matrix(1.3082075,0.35053296,-0.36795399,1.3732236,-310.50935,-240.34915)" cx="363.34" cy="303.415" fx="363.34" fy="303.415" r="16.846" xlink:href="#Ac"><stop offset="0" stop-color="#110800"/><stop offset=".591" stop-color="#a65a00" stop-opacity=".8"/><stop offset="1" stop-color="#ff921e" stop-opacity="0"/></radialGradient><radialGradient id="AW" gradientTransform="matrix(0.36025223,0.15680447,-0.07246786,0.16649214,260.61683,181.93825)" cx="382.235" cy="246.858" fx="382.235" fy="246.858" r="20.538" xlink:href="#Ac"><stop offset="0" stop-color="#7c7c7c"/><stop offset="1" stop-color="#7c7c7c" stop-opacity=".33"/></radialGradient><linearGradient id="AX" x1="358.5" y1="279.362" x2="361.5" y2="279.237" xlink:href="#Ac"><stop offset="0" stop-color="#7c7c7c"/><stop offset="1" stop-color="#7c7c7c" stop-opacity=".33"/></linearGradient><linearGradient id="AY" x1="123.134" y1="301.54" x2="170.864" y2="381.62" xlink:href="#Ac"><stop offset="0" stop-color="#b98309"/><stop offset="1" stop-color="#382605"/></linearGradient><linearGradient id="AZ" x1="171.04" y1="322.223" x2="186.066" y2="350.508" xlink:href="#Ac"><stop offset="0" stop-color="#ebc40c"/><stop offset="1" stop-color="#ebc40c" stop-opacity="0"/></linearGradient><path id="Aa" d="M71.484 295.64c-.563-1.102-1.587-1.926-2.73-2.403s-2.397-.63-3.634-.62c-2.475.02-4.935.664-7.4.45-2.083-.18-4.06-.963-6.1-1.457-2.097-.5-4.322-.7-6.405-.143-2.226.606-4.19 2.094-5.42 4.045-1.084 1.72-1.6 3.753-1.76 5.78s.013 4.066.218 6.09c.148 1.464.314 2.93.668 4.36s.904 2.823 1.766 4.015c1.24 1.716 3.083 2.94 5.07 3.675a14.09 14.09 0 0 0 10.132-.177c5.66-2.457 10.45-6.864 13.37-12.3 1.045-1.946 1.857-4.02 2.382-6.165.208-.853.372-1.722.38-2.6s-.147-1.77-.546-2.55z"/><path id="Ab" d="M362.22 276.456a13.48 13.48 0 0 0-1.625.188c-3.47.617-6.647 2.81-8.437 5.844a12.38 12.38 0 0 0-1.656 7.156c.073-1.742.53-3.447 1.375-4.97 1.434-2.582 4.032-4.53 6.938-5.062 1.8-.328 3.632-.13 5.438.094 1.733.216 3.48.443 5.188.813 2.64.572 5.254 1.45 7.47 3 .516.36 1 .77 1.406 1.25s.722 1.038.844 1.656c.178.904-.08 1.853-.53 2.656s-1.065 1.507-1.72 2.156c-.53.526-1.095 1.034-1.656 1.53 2.56-.496 5.152-1.198 7.28-2.687.9-.63 1.715-1.385 2.25-2.344s.762-2.12.5-3.187c-.177-.72-.57-1.382-1.062-1.937s-1.08-1.012-1.687-1.437c-2.68-1.877-5.815-3.08-9.062-3.47-2.08-.383-4.18-.706-6.28-.97-1.643-.206-3.32-.373-4.97-.28z"/><linearGradient id="Ac" gradientUnits="userSpaceOnUse"/></defs><g transform="matrix(.107114 0 0 .107114 16.03457 -7.17531)"><g class="E"><path d="M61.524 172.734c3.256 7.09 6.89 14.003 10.12 21.106 6.216 13.67 10.937 28.103 12.898 42.99S85.65 267.09 81 281.364c-5.258 16.113-15.24 30.448-27.47 42.18-14.468 13.88-33.04 24.58-53.074 25.37-13.054.514-26.05-3.218-37.61-9.303-9.715-5.113-18.584-11.927-25.66-20.32s-12.33-18.387-14.763-29.093c-2.996-13.183-1.64-27.178 2.894-39.914 3.243-9.108 8.05-17.588 11.472-26.63 3.74-9.88 5.828-20.43 10.783-29.76 4.49-8.46 11.226-15.686 14.804-24.57 2.137-5.306 3.064-11.005 4.444-16.557s3.312-11.144 7.07-15.457c4.53-5.197 11.343-8.014 18.19-8.805s13.778.277 20.498 1.81c5.35 1.22 10.635 2.735 15.805 4.574 4.413 1.57 8.786 3.398 12.602 6.114 5.2 3.7 9.16 8.91 12.315 14.458s5.57 11.475 8.234 17.274z"/><path d="M4.036 349.04c5.5.32 10.99.854 16.44 1.677a165.46 165.46 0 0 1 14.26 2.812c7.377 1.788 14.728 4.068 22.316 4.284 1.997.057 4-.032 5.96-.466s3.842-1.225 5.405-2.47c2.33-1.857 3.8-4.658 4.357-7.587s.208-5.976-.65-8.83c-1.715-5.706-5.4-10.575-8.437-15.696-1.745-2.932-3.3-5.98-5.19-8.82s-4.15-5.5-7.02-7.35c-3.968-2.558-8.888-3.392-13.585-2.924s-9.2 2.165-13.392 4.336c-5.876 3.042-11.407 7.22-14.61 13.01-1.115 2.015-1.925 4.18-2.872 6.28s-2.056 4.166-3.66 5.818c-1.79 1.842-4.112 3.084-5.963 4.863-.925.9-1.735 1.925-2.2 3.118s-.592 2.556-.16 3.765c.297.83.84 1.558 1.51 2.13s1.462.99 2.293 1.28c1.66.584 3.45.67 5.207.772z"/><path d="M-12.313 348.685c-4.584.106-9.12.926-13.6 1.854-4.292.887-8.564 1.875-12.804 2.988-7.154 1.878-14.317 4.127-21.712 4.284-1.946.04-3.906-.065-5.803-.504s-3.733-1.22-5.255-2.434c-2.325-1.854-3.803-4.65-4.35-7.572s-.213-5.964.635-8.814c1.697-5.7 5.336-10.58 8.316-15.726 1.693-2.925 3.187-5.966 5.018-8.807s4.036-5.507 6.86-7.364c3.848-2.53 8.647-3.387 13.23-2.936s8.975 2.14 13.017 4.348c5.706 3.117 10.917 7.406 14.216 13 2.315 3.93 3.65 8.425 6.356 12.098 1.457 1.978 3.3 3.686 4.5 5.823.606 1.068 1.05 2.245 1.153 3.47s-.15 2.498-.84 3.515c-.455.673-1.087 1.217-1.793 1.618s-1.485.665-2.28.83c-1.6.332-3.23.28-4.855.32zM-37.927 157.8c-.644-7.75-.5-15.543-.78-23.315-.278-7.473-.966-14.942-.715-22.416.256-7.6 1.53-15.3 4.914-22.13s8.88-12.608 15.585-16.222c6.3-3.4 13.566-4.853 20.734-4.775 9.72.106 19.464 3.042 27.334 8.744C34.08 81.258 38.23 85.863 41.504 91c2.793 4.385 4.963 9.174 6.325 14.2 2.793 10.3 2.13 21.148 2.674 31.796.515 10.092 2.13 20.16 1.58 30.25-.12 2.2-.356 4.434-1.333 6.4-.952 1.915-2.568 3.455-4.425 4.517s-3.947 1.666-6.06 1.992c-4.227.652-8.55.222-12.808.617-6.18.573-12.075 2.865-18.208 3.814-7.3 1.13-14.757.33-22.148.034-2.96-.118-5.93-.155-8.868-.524s-5.87-1.08-8.484-2.474c-1.6-.858-3.093-1.975-4.295-3.35s-2.12-3-2.577-4.777c-.687-2.653-.325-5.446-.315-8.187.01-2.506-.282-5.003-.5-7.5z"/></g><path d="M-26.296 154.814c-1.046 1.31-1.728 2.887-2.14 4.514s-.562 3.308-.627 4.984c-.128 3.353.076 6.77-.81 10.006-.95 3.46-3.076 6.456-5.158 9.378-3.605 5.06-7.25 10.25-9.027 16.202-1.077 3.605-1.436 7.423-1.048 11.165-4.035 5.926-7.53 12.22-10.423 18.78-4.386 9.942-7.396 20.527-8.455 31.34-1.296 13.242.398 26.862 5.627 39.097 3.78 8.846 9.418 16.944 16.686 23.247 3.695 3.205 7.8 5.94 12.2 8.097 15.213 7.477 34.013 7.49 48.973-.48 7.818-4.166 14.418-10.258 20.78-16.422 3.832-3.712 7.644-7.512 10.567-11.976 5.627-8.592 7.587-19.036 8.805-29.234 2.13-17.833 2.198-36.67-5.62-52.838a58.29 58.29 0 0 0-10.581-15.141c-1.145-7.78-3.406-15.397-6.692-22.542-2.37-5.155-5.268-10.062-7.47-15.29-.904-2.147-1.7-4.345-2.693-6.447s-2.24-4.125-3.924-5.735c-1.723-1.65-3.87-2.818-6.136-3.566s-4.65-1.087-7.03-1.207c-4.765-.24-9.54.383-14.306.194-3.795-.15-7.578-.816-11.37-.592-1.896.112-3.79.45-5.55 1.165s-3.382 1.817-4.566 3.3z" fill="#fdfdfb"/><path d="M-28.632 172.6c1.703 4.938 5.13 9.152 9.186 12.444 1.35 1.095 2.782 2.104 4.366 2.817s3.332 1.12 5.062.972c1.695-.144 3.307-.81 4.79-1.646s2.856-1.847 4.293-2.757c2.463-1.56 5.1-2.82 7.657-4.22 3.082-1.687 6.07-3.6 8.665-5.96 1.188-1.085 2.296-2.268 3.608-3.2s2.883-1.606 4.488-1.497c1.204.082 2.333.594 3.512.848.6.127 1.2.19 1.797.098s1.18-.344 1.598-.78c.512-.533.736-1.3.7-2.04s-.284-1.453-.63-2.107c-.69-1.308-1.735-2.435-2.2-3.838-.414-1.25-.33-2.6-.294-3.914s.008-2.69-.6-3.857c-.462-.89-1.236-1.595-2.122-2.064s-1.88-.7-2.876-.804c-1.995-.187-3.994.2-5.994.313-2.656.15-5.322-.182-7.977-.022-3.31.2-6.557 1.16-9.874 1.166-3.786.007-7.568-1.232-11.308-.64-1.605.254-3.135.838-4.676 1.352s-3.133.967-4.757.944c-1.844-.027-3.63-.665-5.47-.797-.92-.066-1.862 0-2.726.323s-1.645.924-2.068 1.743c-.243.47-.363.997-.386 1.525s.05 1.057.178 1.57c.255 1.026.724 1.983 1.1 2.967 1.393 3.554 1.692 7.448 2.937 11.056z" fill-opacity=".26" filter="url(#z)"/><path d="M-54.38 165.474c3.308 2.22 6.277 4.944 8.77 8.052 2.313 2.884 4.28 6.154 7.3 8.29 2.133 1.508 4.695 2.358 7.294 2.616 3.052.303 6.14-.187 9.082-1.052 2.727-.802 5.363-1.93 7.782-3.42 4.598-2.836 8.44-6.993 13.5-8.857 1.107-.407 2.26-.698 3.327-1.2s2.07-1.254 2.58-2.318c.5-1.022.47-2.202.63-3.325.17-1.2.554-2.362.764-3.556s.235-2.472-.28-3.57c-.428-.91-1.205-1.628-2.1-2.085s-1.9-.664-2.904-.714c-2.006-.1-3.988.415-5.988.598-2.65.242-5.318-.1-7.977-.02-3.308.1-6.568.85-9.874 1.005-3.772.178-7.534-.418-11.308-.55-1.632-.058-3.275-.03-4.884.253s-3.188.822-4.55 1.726c-1.32.877-2.397 2.067-3.607 3.09-.605.512-1.248.985-1.954 1.345s-1.48.605-2.27.643c-.407.02-.818-.015-1.22.047a2.59 2.59 0 0 0-2.121 3.005z" transform="matrix(1 0 0 .921106 21 6.107506)" opacity=".3" filter="url(#y)"/><path d="M-24.768 113.362c-1.78.097-3.485.92-4.788 2.137s-2.22 2.812-2.786 4.504c-1.13 3.384-.875 7.052-.62 10.6.233 3.222.47 6.505 1.677 9.502.603 1.498 1.45 2.9 2.58 4.064s2.552 2.042 4.118 2.434c1.47.368 3.038.292 4.483-.162s2.764-1.28 3.846-2.338c1.58-1.545 2.643-3.566 3.253-5.69s.784-4.352.752-6.56c-.04-2.764-.4-5.54-1.266-8.164s-2.246-5.103-4.173-7.086c-.933-.96-1.998-1.805-3.2-2.397s-2.543-.925-3.88-.853z" fill="url(#AA)"/><path d="M6.75 113.362c-2.78 1.9-5.11 4.575-6.25 7.75-1.436 4.002-.886 8.48.5 12.5 1.42 4.117 3.794 8.04 7.38 10.512 1.793 1.236 3.868 2.083 6.03 2.34s4.41-.095 6.34-1.1c2.353-1.226 4.148-3.373 5.262-5.78s1.59-5.07 1.738-7.72c.2-3.375-.14-6.806-1.25-10-1.205-3.47-3.4-6.67-6.473-8.667-1.54-.998-3.292-1.684-5.11-1.935s-3.705-.063-5.416.602c-.975.38-1.887.907-2.75 1.5z" fill="url(#AB)"/><path d="M-25.36 142.154l-5.136 4.685c-.904.91-1.81 1.884-2.215 3.1-.36 1.08-.292 2.253-.47 3.38-.06.386-.15.77-.152 1.16a1.94 1.94 0 0 0 .078.578c.057.187.15.363.285.506.222.237.538.366.856.43s.645.072.968.107c1.456.157 2.798.863 4.004 1.695l3.55 2.585c2.73 1.734 5.993 2.505 9.226 2.628s6.458-.37 9.63-1.005c2.52-.504 5.034-1.1 7.425-2.044 3.663-1.444 6.964-3.667 10.118-6.022 1.433-1.07 2.846-2.173 4.133-3.415.437-.422.86-.86 1.328-1.246s.988-.722 1.566-.908c.88-.283 1.836-.202 2.748-.05.687.115 1.376.27 2.072.24.348-.014.697-.074 1.02-.204s.622-.33.843-.6a2.02 2.02 0 0 0 .442-1.272c.002-.458-.14-.91-.37-1.305-.465-.79-1.268-1.323-2.105-1.695-1.146-.51-2.386-.76-3.606-1.056-3.745-.904-7.385-2.24-10.836-3.954-1.716-.852-3.384-1.796-5.072-2.7-1.736-.93-3.505-1.824-5.39-2.395-4.213-1.277-8.82-.858-12.977.586-4.62 1.604-8.797 4.463-11.966 8.188z" opacity=".3" filter="url(#x)"/><path d="M-16.4 136.862c1.767-1.987 2.976-4.41 4.674-6.457.85-1.023 1.828-1.955 2.982-2.617s2.492-1.04 3.817-.926c1.474.128 2.855.862 3.934 1.875s1.88 2.3 2.52 3.625c.612 1.278 1.098 2.64 1.98 3.75.94 1.184 2.26 1.992 3.45 2.923.596.465 1.167.97 1.638 1.56s.84 1.276.99 2.017a4.21 4.21 0 0 1-.185 2.267c-.262.72-.707 1.372-1.26 1.904-1.106 1.065-2.614 1.64-4.134 1.855-3.04.43-6.115-.476-9.184-.39-3.107.085-6.142 1.184-9.248 1.07-1.553-.057-3.128-.436-4.404-1.323a5.57 5.57 0 0 1-1.596-1.676c-.402-.665-.647-1.43-.673-2.206-.025-.74.148-1.48.444-2.16s.713-1.302 1.182-1.876c.94-1.148 2.087-2.106 3.072-3.214z" fill="url(#AC)"/><path transform="matrix(1.152214 0 0 1.152214 -302.02706 -22.837384)" d="M277.96 90.857c-2.225 1.57-1.253 3.53-.296 5.498s-2.104 7.64-2.137 7.884 6.025-2.875 7.676-4.902c1.95-2.393 6.877 3.238 6.61 2.38.002-1.533-9.627-12.43-11.852-10.86z" filter="url(#w)" class="J"/><g transform="translate(-289 -9)"><path d="M302.162 130.757c-1.045.075-2.064.432-2.95 1s-1.643 1.315-2.237 2.18c-1.187 1.728-1.71 3.847-1.793 5.94-.063 1.572.11 3.165.632 4.65s1.4 2.86 2.613 3.863c1.24 1.027 2.816 1.644 4.425 1.72s3.24-.387 4.56-1.307c1.053-.733 1.902-1.742 2.507-2.873s.97-2.383 1.135-3.655c.294-2.247-.038-4.593-1.077-6.607s-2.8-3.673-4.927-4.456c-.92-.34-1.91-.516-2.888-.446z" class="E"/><path d="M304.656 137.612c-.866.342-2.237.127-2.616.977-.225.504.093 1.333.603 1.54 1.032.42 2.632-.34 3.05-1.375.18-.45-.093-1.16-.54-1.35-.165-.07-.33.14-.496.206z" fill="#141413" filter="url(#u)"/><path d="M308.625 139.862c1.16-1.16-.826-4.24-2.375-5.5-1.122-.913-4.39-1.87-4.25-.875s1.6 2.266 2.595 3.237c1.212 1.195 3.48 3.69 4.03 3.138z" fill="url(#AD)" filter="url(#v)"/></g><path d="M75.25 132.487a23.71 23.71 0 0 1 8.122-4.4c6.086-1.88 13-1.137 18.378 2.275 1.857 1.178 3.512 2.642 5.24 4.004s3.56 2.64 5.636 3.37c1.12.394 2.318.623 3.5.5 1.068-.112 2.1-.512 2.984-1.12s1.625-1.418 2.18-2.337c1.112-1.837 1.47-4.065 1.278-6.203-.383-4.277-2.796-8.053-4.818-11.84-.633-1.186-1.236-2.393-2-3.5-2.343-3.396-6.073-5.636-9.985-6.948s-8.046-1.786-12.14-2.302c-1.826-.23-3.673-.47-5.5-.25-2.1.253-4.076 1.1-6.125 1.625-.973.25-1.964.425-2.928.704s-1.913.67-2.697 1.296c-1.145.916-1.865 2.29-2.177 3.723s-.24 2.924-.012 4.372c.458 2.896 1.54 5.724 1.438 8.654-.07 2.012-.702 3.988-.625 6 .023.6.107 1.177.25 1.75" clip-path="url(#t)" transform="translate(-79 -9)" fill="url(#AE)"/><path d="M16.406 105.125c-.477.6-.908 1.252-1.25 1.97 2.146.462 4.2 1.346 6.03 2.563 3.545 2.354 6.237 5.796 8.125 9.625.44-.488.842-1.012 1.188-1.594-1.898-3.988-4.644-7.595-8.312-10.03-1.762-1.17-3.725-2.054-5.78-2.53z" fill="url(#AF)" filter="url(#s)"/><path d="M-24.97 107.08c-.242-.005-.477.017-.72.028l-.47.028c1.413.128 2.818.508 4.094 1.08 1.74.78 3.274 1.893 4.625 3.16 2.504 2.345 4.365 5.24 5.625 8.31a20.8 20.8 0 0 0-2.062-6.659c-.494-.57-1.006-1.13-1.562-1.65-1.35-1.266-2.886-2.378-4.625-3.16-1.52-.683-3.214-1.108-4.906-1.138z" fill="url(#AG)" filter="url(#r)"/><path d="M-29.06 128.112c-.372 2.246-.386 4.602.386 6.743.5 1.414 1.35 2.697 2.372 3.8.67.722 1.428 1.378 2.316 1.803s1.916.606 2.87.367c.88-.22 1.652-.79 2.22-1.497s.948-1.553 1.218-2.42c.797-2.56.67-5.362-.122-7.924-.577-1.867-1.532-3.668-3.027-4.927-.713-.6-1.548-1.07-2.455-1.287s-1.89-.165-2.738.22c-.942.428-1.672 1.243-2.15 2.16s-.723 1.94-.892 2.96z" class="E"/><path d="M164.688 135.487c.242.634 1.054.864 1.5 1.375.433.497.887 1.01 1.125 1.625.455 1.176-.45 2.92.5 3.75.298.26.895.266 1.188 0 1.145-1.042.89-3.144.438-4.625-.41-1.344-1.427-2.616-2.68-3.255-.58-.295-1.45-.54-1.946-.12-.32.27-.274.86-.125 1.25z" fill="url(#AH)" filter="url(#p)" transform="translate(-189 -9)"/><g transform="translate(-79 -9)"><path d="M45.752 165.032c.06.295.173.58.327.84.266.445.654.806 1.073 1.11s.873.56 1.312.835c2.334 1.467 4.235 3.53 5.925 5.707 2.267 2.922 4.272 6.165 7.3 8.29 2.138 1.5 4.696 2.355 7.294 2.616 3.05.307 6.14-.186 9.082-1.052 2.726-.803 5.363-1.93 7.782-3.42 4.6-2.836 8.44-6.993 13.5-8.857 1.107-.407 2.26-.698 3.326-1.2s2.07-1.254 2.58-2.318c.5-1.022.47-2.202.63-3.325.17-1.2.554-2.362.764-3.556s.235-2.472-.28-3.57c-.428-.91-1.205-1.628-2.1-2.085s-1.9-.664-2.904-.714c-2.006-.1-3.988.415-5.988.598-2.65.242-5.318-.098-7.977-.02-3.308.1-6.568.845-9.874 1.005-3.772.183-7.535-.4-11.308-.55-1.634-.066-3.28-.05-4.892.225s-3.195.824-4.54 1.753c-1.31.906-2.356 2.14-3.56 3.184-.602.522-1.25 1-1.966 1.347s-1.507.564-2.304.547c-.4-.01-.83-.077-1.22.047-.244.077-.46.227-.644.406s-.335.387-.478.6a10.52 10.52 0 0 0-.867 1.558z" fill="url(#AI)"/><path d="M60.557 169.097a6.7 6.7 0 0 0 4.346 7.847c1.978.66 4.207.336 6.055-.628 1.07-.56 2.05-1.346 2.67-2.384a4.51 4.51 0 0 0 .605-1.696c.08-.6.025-1.22-.185-1.785-.23-.62-.64-1.168-1.146-1.596s-1.105-.738-1.733-.946c-1.258-.416-2.61-.424-3.934-.36a38.86 38.86 0 0 0-5.969.753" fill="#d9b30d" filter="url(#i)"/><path d="M54.066 156.68l-3.898 2.563c-.657.466-1.334.97-1.68 1.696-.246.515-.302 1.1-.3 1.67s.03 1.144-.046 1.7c-.05.386-.154.766-.172 1.155-.01.195.005.39.056.58a1.2 1.2 0 0 0 .275.509c.173.183.408.296.65.37s.49.11.736.17c1.175.276 2.197.997 3.094 1.804l2.64 2.476c2.537 2.064 5.9 2.92 9.16 2.973s6.504-.63 9.695-1.35l7.425-2.044c3.703-1.365 7.14-3.432 10.118-6.022 1.35-1.174 2.617-2.464 4.133-3.415 1.34-.842 2.843-1.398 4.206-2.203.122-.072.243-.146.352-.237s.206-.198.27-.325c.11-.22.11-.48.04-.716s-.206-.444-.36-.634c-.17-.21-.363-.402-.57-.578-1.424-1.22-3.357-1.662-5.226-1.81s-3.76-.043-5.6-.352c-1.74-.3-3.393-.94-5.072-1.477a37.34 37.34 0 0 0-5.389-1.31c-4.295-.7-8.717-.566-12.977.32-4.058.845-7.97 2.37-11.54 4.48z" fill="#604405" filter="url(#j)"/><path d="M53.64 152.154c-1.93 1.3-3.666 2.883-5.136 4.685-.84 1.03-1.604 2.15-2.027 3.412-.333.992-.446 2.042-.656 3.067-.08.384-.17.77-.17 1.16.001.196.026.393.086.58s.158.362.294.503c.225.234.54.36.858.426s.644.075.966.112c1.455.165 2.794.872 4 1.702l3.554 2.578c2.734 1.73 5.995 2.498 9.227 2.623s6.457-.366 9.63-1c2.52-.503 5.034-1.1 7.425-2.044 3.662-1.444 6.964-3.667 10.118-6.022 1.433-1.07 2.846-2.173 4.133-3.415.437-.422.86-.86 1.328-1.246s.988-.722 1.566-.908c.88-.283 1.836-.202 2.748-.05.687.115 1.376.27 2.072.24.348-.014.697-.074 1.02-.204s.622-.33.843-.6a2.02 2.02 0 0 0 .442-1.272c.002-.458-.14-.91-.37-1.305-.465-.79-1.268-1.323-2.105-1.695-1.146-.51-2.386-.76-3.606-1.056-3.745-.904-7.385-2.24-10.836-3.954-1.716-.852-3.384-1.796-5.072-2.7-1.736-.93-3.505-1.824-5.39-2.395-4.213-1.277-8.82-.858-12.977.586-4.62 1.604-8.797 4.463-11.966 8.188z" fill="url(#AJ)"/><path d="M83.24 153.08c-.226-.286-.55-.488-.9-.59s-.725-.1-1.084-.05c-.72.123-1.364.5-1.966.925-1.71 1.176-3.22 2.628-4.537 4.23-1.745 2.12-3.185 4.572-3.668 7.275-.08.455-.135.92-.078 1.38s.233.915.56 1.243c.286.288.676.464 1.078.522s.816.002 1.2-.128c.77-.26 1.41-.8 2.014-1.34 3.336-2.985 6.353-6.568 7.56-10.88.12-.433.224-.876.22-1.325s-.12-.91-.398-1.262z" fill="#f6da4a" filter="url(#k)"/><path d="M75.25 146.9c.23.742 1.428.62 2.12.975.607.312 1.094.997 1.777 1.017.65.02 1.664-.225 1.75-.87.112-.853-1.134-1.395-1.935-1.708-1.03-.402-2.353-.606-3.32-.068-.222.123-.464.412-.388.655z" opacity=".8" fill="url(#AK)" filter="url(#m)"/><path d="M63.827 146.47c-.888-.29-2.357 1.277-1.878 2.08.132.22.535.5.806.35.41-.225.744-1.03 1.187-1.345.296-.21.23-.972-.116-1.084z" opacity=".8" fill="url(#AL)" filter="url(#n)"/><ellipse transform="matrix(1.095622 0 -.170179 1.518131 -136.24431 -82.11746)" cx="243.297" cy="158.284" rx="2.608" ry="2.328" fill="url(#AM)" filter="url(#o)"/><path d="M50.392 129.527c2.685-1.6 5.955-1.97 9.067-1.676s6.125 1.208 9.14 2.03c2.212.602 4.452 1.16 6.525 2.138s4 2.416 5.142 4.403l.54.962c.194.312.423.61.716.83s.657.364 1.024.344c.184-.01.366-.06.524-.154s.293-.23.378-.392c.098-.187.128-.404.117-.616a2.94 2.94 0 0 0-.117-.622c-.755-2.753-2.535-5.088-3.89-7.6l-2.298-4.596c-2.818-5.16-7.444-9.216-12.7-11.847s-11.127-3.896-16.997-4.24c-6.8-.398-13.62.41-20.33 1.59-2.91.512-5.86 1.115-8.436 2.562-1.287.723-2.467 1.657-3.388 2.81s-1.576 2.535-1.788 3.997c-.204 1.41.01 2.86.5 4.196s1.258 2.558 2.157 3.662c1.797 2.208 4.1 3.934 6.222 5.83s4.1 3.992 6.463 5.563c1.186.785 2.473 1.435 3.843 1.817s2.83.49 4.224.204c1.445-.296 2.783-1.005 3.954-1.902s2.186-1.98 3.148-3.098c1.925-2.236 3.723-4.686 6.257-6.196z" clip-path="url(#h)" fill="url(#AN)"/></g><path d="M66.102 216.45c6.085 4.895 9.946 12.286 11.14 20.003.932 6.02.326 12.195-1.03 18.132s-3.452 11.676-5.532 17.4c-.83 2.283-1.662 4.587-1.992 6.993s-.12 4.954 1.04 7.088c1.33 2.446 3.813 4.13 6.482 4.923 2.635.783 5.48.766 8.148.102s5.157-1.963 7.328-3.65c5.516-4.283 8.844-10.95 10.132-17.812s.696-13.95-.5-20.83c-1.633-9.38-4.382-18.55-7.88-27.408-2.573-6.515-5.584-12.92-9.79-18.52-4.117-5.48-9.307-10.093-13.34-15.635-2.803-3.85-5.048-8.15-8.406-11.526-1.68-1.688-3.64-3.132-5.86-3.995s-4.713-1.116-7.005-.47c-3.02.85-5.5 3.23-6.803 6.082s-1.543 6.123-1.032 9.22c.66 3.995 2.486 7.703 4.546 11.19 2.327 3.937 5.022 7.727 8.536 10.654 3.667 3.055 8.102 5.07 11.82 8.06z" class="E"/><path transform="matrix(1.018073 0 0 1 -244.25531 -9.000002)" clip-path="url(#f)" d="M290.78 216.018l1.5 1.375c3.667 3.055 5.62 6.485 9.338 9.477 6.085 4.895 12.26 13.344 13.454 21.06.932 6.02-.3 9.29-1.805 16.388s-5.77 17.148-8.074 23.992c-.92 2.73 1.86 1.603 1.496 4.48a17.72 17.72 0 0 0-.035 4.259l.07-.822c.443-3.923 1.623-7.695 2.91-11.395 2.474-7.122 5.314-14.1 7.272-21.408s1.74-12.564.72-18.844c-1.285-7.896-5.797-15.187-12.187-20-4.52-3.403-9.847-5.585-14.656-8.562z" fill="#838384" filter="url(#g)"/><path d="M-61.003 211.593c.88 1.524-.547 6.778 19.964 3.415 0 0-3.602.457-7.153 1.404-5.52 2.133-10.33 4.517-14.04 7.675-3.676 3.122-6.367 7.197-9.74 10.697 0 0 5.462-11.52 6.823-14.987s-.228-3.3.85-8.414 3.713-10.007 3.713-10.007-2.152 7.21-.417 10.216z" transform="matrix(1.154304 0 0 1 27.33247 -9.000002)" opacity=".25" fill="url(#AO)" filter="url(#e)"/><path d="M33.05 201.218c-4.825 3.36-7.652 2.963-13.507 3.62s-21.698.42-21.698.42 2.294-.043 7.378.904 15.453 1.852 21.292 4.075 7.968 2.857 11.517 5.1c5.05 3.194 8.758 8.197 13.587 11.697 0 0 .234-4.644-1.716-8.112s-7.2-8.935-8.732-14.04-2.274-15.132-2.274-15.132-1.02 8.105-5.846 11.466z" opacity=".42" fill="url(#AP)" filter="url(#d)"/><path d="M-12.33 194.04l-.697 4.344c-.14.71-.295 1.42-.56 2.093s-.644 1.312-1.18 1.796c-.47.424-1.044.716-1.62.98-2.248 1.03-4.654 1.713-7.108 2.02l2.935.268c.615.067 1.232.142 1.832.296s1.185.4 1.684.755c.548.4.978.948 1.3 1.546.64 1.192.854 2.563.973 3.9.15 1.723.162 3.46.033 5.184.116-1.154.358-2.296.72-3.398.653-1.986 1.704-3.848 3.12-5.386.562-.61 1.18-1.17 1.86-1.648a10.29 10.29 0 0 1 7.236-1.761 11.24 11.24 0 0 1-7.194-2.233c-1.042-.785-1.95-1.763-2.58-2.905a8.11 8.11 0 0 1-.751-5.861z" opacity=".2" fill="url(#AQ)" filter="url(#c)"/><path d="M-18.5 228.08a88.71 88.71 0 0 0-2.526 14.277c-.637 6.812-.484 13.672-.85 20.505-.3 5.798-.99 11.656.016 17.374.48 2.727 1.343 5.385 2.555 7.875a26.9 26.9 0 0 0 .422-2.876c.427-4.636-.354-9.287-.618-13.935-.462-8.147.666-16.3 1.125-24.438a149.28 149.28 0 0 0-.125-18.781z" opacity=".1" filter="url(#a)"/><path d="M37.688 157.862c-2.162 1.97 1.014 4.928 2.52 8.404.936 2.16 3.527 5.205 6.032 4.718 1.885-.367 3.054-3.08 2.876-4.99-.344-3.69-3.457-4.553-5.717-5.82-1.79-1.004-4.193-3.694-5.71-2.31z" fill="#838384" filter="url(#Z)"/><g transform="translate(21 -9)"><path d="M86.056 328.132a16.61 16.61 0 0 1-2.05 4.411c-1.98 3.012-4.854 5.28-7.727 7.37-4.9 3.566-10.003 6.838-14.563 10.9-3.056 2.715-5.84 5.76-8.423 8.965-2.208 2.74-4.284 5.62-6.8 8.057-2.54 2.46-5.53 4.447-8.752 5.53-3.918 1.317-8.058 1.253-11.832.26-2.645-.696-5.224-1.907-6.862-4.097-1.645-2.198-2.178-5.152-2.368-8.052-.337-5.13.26-10.37.803-15.575.452-4.326.868-8.655 1.04-12.972.3-7.852-.197-15.636-1.232-23.273-.173-1.28-.362-2.568-.257-3.886s.535-2.688 1.436-3.705c.832-.94 1.993-1.496 3.15-1.77s2.33-.3 3.493-.32c2.74-.075 5.496-.24 8.195.006 1.703.156 3.373.475 5.073.643 2.838.28 5.78.133 8.627-.724 3.064-.922 5.986-2.652 9.1-3.127 1.277-.195 2.56-.173 3.8.006 1.267.182 2.528.542 3.502 1.336.74.604 1.282 1.433 1.706 2.317.63 1.317 1.02 2.77 1.24 4.26.197 1.32.266 2.68.598 3.957.545 2.1 1.78 3.886 3.267 5.34s3.225 2.602 4.96 3.734c1.73 1.127 3.468 2.247 5.315 3.176.867.436 1.758.83 2.586 1.333s1.6 1.12 2.15 1.935c.746 1.105 1.046 2.553.822 3.975" transform="matrix(1.026883 0 0 1 -2.313437 0)" opacity=".2" fill="url(#AR)" filter="url(#S)"/><g transform="translate(-410)"><path d="M516.006 331.876c-.67 1.72-1.627 3.327-2.816 4.738-2.624 3.115-6.268 5.17-9.896 7.02-6.19 3.154-12.602 5.922-18.42 9.717-3.898 2.542-7.496 5.527-10.86 8.742-2.877 2.75-5.606 5.687-8.832 8.018-3.256 2.35-7.02 4.054-10.99 4.65-4.83.725-9.82-.213-14.3-2.164-3.138-1.367-6.156-3.323-7.963-6.23-1.814-2.918-2.228-6.488-2.233-9.924-.008-6.077 1.118-12.1 2.178-18.073.88-4.972 1.72-9.955 2.26-14.975.983-9.13.976-18.353.32-27.513-.1-1.534-.238-3.083-.008-4.604s.855-3.037 2.02-4.04c1.077-.927 2.52-1.336 3.94-1.414s2.834.147 4.24.352c3.313.484 6.652.865 9.89 1.717 2.043.537 4.033 1.26 6.072 1.81 3.403.92 6.966 1.36 10.467.952 3.77-.44 7.43-1.857 11.224-1.765 1.557.038 3.1.332 4.586.8 1.515.478 3.01 1.162 4.123 2.295.846.86 1.436 1.945 1.88 3.07.66 1.674 1.015 3.457 1.167 5.25.135 1.588.113 3.194.414 4.76.495 2.575 1.847 4.923 3.528 6.935s3.7 3.72 5.696 5.408c2 1.68 4.01 3.355 6.167 4.828 1.012.692 2.056 1.34 3.017 2.1s1.845 1.647 2.445 2.715c.815 1.45 1.064 3.208.683 4.826z" clip-path="url(#T)" fill="url(#AS)"/><path d="M512.89 328.724a15.31 15.31 0 0 1-2.571 4.26c-2.402 2.814-5.73 4.654-9.038 6.31-5.653 2.83-11.503 5.318-16.82 8.735-3.554 2.284-6.84 4.966-9.918 7.86-2.63 2.473-5.125 5.116-8.066 7.208-2.98 2.12-6.418 3.647-10.037 4.18-4.41.65-8.96-.193-13.058-1.946-2.857-1.222-5.617-2.97-7.272-5.6-1.646-2.617-2.03-5.83-2.04-8.922-.013-5.465 1.018-10.87 1.99-16.248.807-4.47 1.575-8.948 2.064-13.463.89-8.208.848-16.498.292-24.735-.093-1.38-.2-2.774.012-4.14s.778-2.727 1.826-3.63c.983-.847 2.303-1.218 3.6-1.286s2.587.142 3.87.33c3.023.445 6.072.78 9.03 1.543 1.865.482 3.684 1.132 5.545 1.628 3.11.83 6.362 1.225 9.56.856 3.44-.397 6.787-1.67 10.25-1.587 1.42.035 2.83.3 4.19.72 1.382.426 2.75 1.034 3.765 2.063.766.775 1.295 1.754 1.716 2.76.626 1.497 1.033 3.097 1.066 4.72.035 1.694-.336 3.395-.106 5.073.186 1.363.763 2.648 1.5 3.81s1.634 2.21 2.523 3.26c1.717 2.03 3.44 4.097 5.593 5.655 2.452 1.774 5.362 2.81 7.895 4.467.755.494 1.486 1.052 2.018 1.78a4.76 4.76 0 0 1 .624 4.339z" clip-path="url(#U)" fill="#cd8907" filter="url(#V)"/></g><path d="M508.793 327.925c-.602 1.265-1.382 2.444-2.31 3.49-2.153 2.428-5.06 4.1-8.123 5.172-5.042 1.767-10.546 2.004-15.495 4.016-3.016 1.226-5.73 3.073-8.48 4.82-2.222 1.41-4.492 2.77-6.932 3.756-2.755 1.115-5.686 1.74-8.626 2.18-1.87.28-3.763.484-5.652.387s-3.784-.507-5.45-1.4c-1.264-.678-2.4-1.653-3.076-2.918-.75-1.406-.88-3.056-.862-4.65.046-4.246 1.026-8.446.996-12.692-.026-3.696-.815-7.345-1.042-11.034-.437-7.095 1.205-14.313-.24-21.273-.23-1.114-.542-2.227-.527-3.365.008-.57.1-1.14.315-1.667s.563-1.005 1.025-1.338c.39-.28.85-.45 1.323-.527s.957-.062 1.432.007c.948.137 1.852.482 2.775.737 2.642.73 5.433.714 8.117 1.265 1.685.346 3.317.91 4.984 1.334 2.8.7 5.72 1.013 8.592.7 3.09-.335 6.107-1.375 9.213-1.3 1.273.03 2.537.25 3.765.59s2.455.82 3.384 1.69c.67.628 1.15 1.43 1.542 2.26.57 1.212.967 2.53.958 3.868-.005.697-.12 1.388-.187 2.08s-.088 1.404.09 2.077.554 1.287.983 1.84.915 1.06 1.358 1.602c1.242 1.517 2.13 3.285 3.097 4.99s2.052 3.393 3.58 4.62c2.08 1.672 4.778 2.34 7.096 3.66.68.387 1.337.84 1.814 1.46a3.77 3.77 0 0 1 .561 3.556z" transform="matrix(1.142972 0 0 1.232305 -478.99801 -77.126193)" clip-path="url(#W)" fill="#f5c021" filter="url(#X)"/><path d="M27.31 290.65c3.276-.887 6.066 1.597 8.442 3.472 1.535 1.31 3.753.98 5.637 1.042 3.12-.113 6.225.523 9.347.136 6.145-.52 12.168-2.03 18.342-2.3 2.95-.186 6.26-.357 8.808 1.365 1.033.716 2.547 3.74 3.566 2.605-.42-3.178-2.777-6.256-5.94-7.102-2.475-.39-5 .29-7.49.07-7.423-.177-14.793-1.555-22.234-1.16-5.176.045-10.347-.195-15.515-.397-2.03-.415-2.747 1.39-3.85 2.08" fill="url(#AT)" filter="url(#Y)"/></g><g class="J"><path d="M361.75 209.343c.002-1.533-7.565-10.056-9.8-8.486s-.492 3.784-.296 5.498-.945 6.61.238 7.26 3.366-2.52 5.3-4.277c1.558-1.415 4.544 1.54 4.546.006z" transform="matrix(-.095961 -.957009 -.774762 .118534 259.90204 542.60667)" opacity=".75" filter="url(#R)"/><path transform="matrix(-.069919 .957009 -.564507 -.118534 97.56774 -131.0171)" d="M351.96 200.857c-1.452.39-1.23 3.994-.296 5.498.79 1.27 3.072 2.27 3.76 1.005 1.114-2.056-1.472-7.036-3.462-6.503z" opacity=".25" filter="url(#Q)"/></g><g transform="translate(21 -9)"><use xlink:href="#Aa" opacity=".35" fill="url(#AU)" filter="url(#O)"/><use xlink:href="#Aa" transform="matrix(1 0 0 .722925 0 80.758477)" opacity=".35" fill="url(#AV)" filter="url(#P)"/><path d="M76.188 285.328c-.405-1.104-1.118-2.082-1.99-2.87s-1.9-1.392-2.983-1.852c-2.165-.92-4.52-1.26-6.832-1.696l-6.528-1.277c-2.27-.386-4.618-.632-6.865-.125-1.966.443-3.784 1.46-5.272 2.82s-2.65 3.056-3.485 4.9c-1.472 3.23-1.935 6.865-1.654 10.403.21 2.633.875 5.346 2.61 7.34 1.4 1.61 3.387 2.615 5.434 3.22 3.525 1.043 7.367.988 10.86-.155a28.59 28.59 0 0 0 14.33-10.779c1.14-1.65 2.112-3.448 2.553-5.403.336-1.5.348-3.08-.178-4.515z" class="E"/><g transform="translate(-310)"><use xlink:href="#Ab" clip-path="url(#L)" fill="url(#AW)" filter="url(#M)"/><use xlink:href="#Ab" clip-path="url(#N)" fill="url(#AX)" filter="url(#M)"/></g></g><path d="M-40.502 175.425l-16.922 21.186c-3.533 4.38-7.15 8.794-9.45 13.93-1.976 4.413-2.91 9.207-4.265 13.85-1.538 5.272-3.626 10.37-5.97 15.336-2.165 4.585-4.55 9.063-6.94 13.536-1.738 3.254-3.505 6.58-4.108 10.22-.476 2.876-.2 5.844.534 8.666s1.9 5.51 3.238 8.106c5.667 11.075 14.17 20.622 24.242 27.925 4.57 3.314 9.467 6.18 14.602 8.526 2.782 1.27 5.714 2.404 8.772 2.457 1.53.026 3.074-.225 4.474-.84s2.65-1.604 3.483-2.887c1.023-1.578 1.37-3.538 1.165-5.407s-.935-3.653-1.913-5.26c-2.4-3.923-6.165-6.76-9.796-9.573-7.84-6.074-15.425-12.48-22.682-19.24-2.05-1.91-4.098-3.878-5.53-6.284-1.394-2.344-2.148-5.014-2.658-7.693-1.4-7.35-1.04-15.083 1.46-22.133.978-2.758 2.27-5.392 3.518-8.04 2.16-4.59 4.207-9.266 7.05-13.467 3.538-5.23 8.267-9.66 11.15-15.278 2.434-4.74 3.42-10.072 4.362-15.318l2.184-12.318z" class="E"/><path d="M232.33 224.27a33 33 0 0 0-5.953 7.318c-2.668 4.46-4.24 9.468-6.178 14.29-1.444 3.59-3.125 7.193-3.327 11.056-.103 1.984.19 3.966.257 5.952s-.118 4.05-1.1 5.784c-.813 1.45-2.166 2.59-3.733 3.144a11.07 11.07 0 0 1 5.335 3.865c1.115 1.5 1.828 3.254 2.796 4.85.787 1.298 1.753 2.5 2.943 3.445s2.61 1.62 4.117 1.813a7.26 7.26 0 0 0 5.765-1.842c-1.925-18.036-.162-36.457 5.15-53.8.335-1.095.687-2.198.77-3.34s-.13-2.348-.824-3.258c-.37-.485-.868-.87-1.43-1.108s-1.186-.325-1.79-.252-1.19.306-1.68.67-.882.857-1.127 1.415z" clip-path="url(#J)" transform="translate(-289 -9)" opacity=".95" filter="url(#K)" class="J"/><g transform="translate(-219 -9)" clip-path="url(#F)"><path d="M137.577 281.02c1.6-.663 3.398-.784 5.1-.47s3.31 1.05 4.743 2.022c2.864 1.946 4.988 4.778 7.023 7.58 4.672 6.434 9.17 13.002 13.245 19.83 3.306 5.538 6.344 11.257 10.164 16.453 2.494 3.392 5.307 6.54 7.813 9.922s4.728 7.056 5.84 11.117c1.444 5.277.885 11.093-1.627 15.953-1.767 3.42-4.476 6.352-7.772 8.34s-7.17 3.014-11.016 2.87c-6.114-.23-11.7-3.285-17.384-5.55-11.58-4.612-24.16-6.06-36.097-9.652-3.67-1.104-7.276-2.41-10.97-3.426-1.64-.45-3.31-.848-4.86-1.55s-3-1.75-3.862-3.217c-.666-1.134-.948-2.47-.93-3.786s.326-2.615.774-3.852c.896-2.474 2.343-4.714 3.32-7.157 1.595-3.99 1.882-8.388 1.667-12.68s-.91-8.545-1.205-12.83c-.13-1.914-.18-3.853.185-5.736s1.176-3.725 2.558-5.055c1.274-1.227 2.965-1.955 4.696-2.317s3.515-.377 5.284-.338 3.54.134 5.304-.01 3.533-.54 5.07-1.418c1.46-.834 2.654-2.075 3.644-3.434s1.79-2.846 2.61-4.314 1.668-2.932 2.742-4.226 2.39-2.423 3.943-3.067z" fill="url(#AY)"/><path d="M140.1 283.78c1.455-.586 3.094-.65 4.623-.304s2.95 1.1 4.188 2.047c2.478 1.914 4.2 4.614 5.854 7.27 3.97 6.433 7.85 12.934 11.516 19.567 2.777 4.993 5.425 10.093 8.837 14.68 2.264 3.042 4.847 5.83 7.158 8.837s4.37 6.282 5.393 9.933c1.316 4.706.783 9.9-1.495 14.233a18.98 18.98 0 0 1-7.186 7.513 18.5 18.5 0 0 1-10.087 2.488c-5.598-.258-10.71-3.054-15.98-4.95-10.103-3.666-21.053-4.158-31.416-7.02-3.715-1.008-7.337-2.353-11.07-3.294-1.652-.417-3.333-.757-4.902-1.42s-3.047-1.69-3.898-3.165c-.633-1.097-.886-2.388-.847-3.654s.36-2.5.8-3.694c.902-2.367 2.32-4.5 3.23-6.875 1.38-3.574 1.55-7.504 1.294-11.326s-.92-7.61-1.153-11.434c-.104-1.71-.12-3.44.226-5.116s1.076-3.3 2.295-4.512c1.32-1.31 3.14-2.024 4.977-2.304s3.706-.158 5.555.007 3.705.373 5.56.262 3.736-.563 5.27-1.607c1.397-.945 2.446-2.324 3.244-3.798s1.368-3.055 1.976-4.617 1.267-3.122 2.222-4.5 2.236-2.605 3.806-3.235" fill="#d99a03" filter="url(#G)"/><path d="M138.753 281.235c1.41-.712 3.07-.858 4.616-.537s2.978 1.09 4.196 2.096c2.435 2 3.98 4.875 5.42 7.685 3.305 6.455 6.383 13.05 10.338 19.128 2.87 4.4 6.18 8.517 9.082 12.905 3.936 5.95 7.136 12.496 8.456 19.507.888 4.716.86 9.8-1.372 14.058-1.47 2.796-3.85 5.1-6.663 6.525s-6.043 2.017-9.19 1.734c-4.954-.445-9.454-2.925-14.117-4.655-8.275-3.07-17.218-3.803-25.734-6.12-3.592-.977-7.1-2.235-10.75-3-1.606-.342-3.244-.59-4.777-1.18s-2.986-1.566-3.77-3.01c-.55-1.016-.737-2.205-.654-3.357s.42-2.275.865-3.342c.888-2.134 2.2-4.09 2.9-6.296 1.013-3.242.597-6.757-.164-10.068s-1.857-6.56-2.194-9.94c-.15-1.505-.147-3.04.19-4.515s1.027-2.892 2.11-3.95c1.393-1.362 3.344-2.04 5.283-2.23s3.892.07 5.82.35 3.868.6 5.815.5 3.928-.61 5.453-1.824c1.508-1.2 2.456-2.987 3-4.836s.72-3.782.943-5.696.5-3.846 1.23-5.63 1.96-3.428 3.68-4.297z" transform="matrix(1 0 0 .982048 0 3.958973)" fill="#f5bd0c" filter="url(#H)"/><path d="M156.407 295.97c2.606 4.713 4.196 10.122 6.78 14.875 2.378 4.372 5.084 8.874 7.5 12.906 1.075 1.795 3.583 4.555 6.12 8.837 2.298 3.88 4.618 9.297 5.917 11.116-.746-2.13-2.28-7.847-4.11-11.923-1.7-3.81-3.7-5.982-4.927-8.03-2.416-4.032-5.017-7.656-7.5-11.5-3.425-5.302-6.036-11.235-9.78-16.28z" fill="url(#AZ)" filter="url(#I)"/></g></g></svg>
\ No newline at end of file
diff --git a/img/logo.svg b/img/logo.svg
new file mode 100644
index 0000000000..d5eef0179a
--- /dev/null
+++ b/img/logo.svg
@@ -0,0 +1,19 @@
+<svg width="91" height="50" viewBox="0 0 91 50" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g filter="url(#filter0_d)">
+<path d="M40.24 3.19995C39.66 2.61995 38.92 2.31995 38.06 2.31995H12.95V5.30995C12.95 6.11995 13.25 6.80995 13.83 7.36995C14.43 7.96995 15.17 8.26995 16.04 8.26995H24.06V38.2999L26.99 38.3199C27.86 38.3199 28.59 38.0199 29.17 37.4399C29.77 36.8399 30.07 36.1399 30.07 35.3499V8.28995L41.1399 8.26995V5.49995C41.1399 4.70995 40.84 3.79995 40.24 3.19995Z" fill="#505071"/>
+<path d="M56.1801 13.3199C55.3101 13.3199 54.5801 13.6099 54.0001 14.1999C53.4001 14.7999 53.1001 15.4999 53.1001 16.2899V28.2799C52.0401 31.2199 48.8101 32.6499 45.3401 32.6499C42.4701 32.6499 41.0801 31.3299 41.0801 28.6099V16.2799C41.0801 15.4899 40.7801 14.7899 40.1801 14.1899C39.6001 13.6099 38.8601 13.3099 38.0001 13.3099H35.0701V29.1399C35.0701 35.2299 38.2001 38.3199 44.6901 38.3199C47.8801 38.3199 51.3701 37.2199 53.0501 35.0399C52.9201 36.9699 52.7101 37.9599 51.6201 39.3999C50.4001 41.0099 48.0101 41.6299 45.5301 41.6299C43.1601 41.6299 40.8501 41.1599 38.3401 40.2199C37.9101 40.1199 37.5301 40.0699 37.2001 40.0699C35.8301 40.0699 35.0801 40.8199 35.0801 42.1699V44.6099L35.2601 44.7199C38.1401 46.4399 41.4901 47.3199 45.5401 47.3199C53.9701 47.3199 59.1201 42.7599 59.1201 33.7499V13.3199H56.1801Z" fill="#505071"/>
+<path d="M83.8201 27.34C83.3701 26.02 82.8401 25.82 82.2101 25.22C82.4901 24.85 82.8501 24.14 83.3601 22.67L87.1501 13.32H83.7101C81.8301 13.32 80.6201 14.08 80.1201 15.58L77.5301 21.55C77.3401 22.05 76.7401 22.3 75.7701 22.3H70.1301L70.1401 5.25997C70.1401 4.46997 69.8801 3.80997 69.2801 3.21997C68.7001 2.63997 67.9601 2.33997 67.1001 2.33997H64.1201L64.1301 38.33H67.1101C67.9801 38.33 68.7201 38.03 69.3101 37.43C69.9001 36.86 70.1901 36.17 70.1901 35.36L70.1401 28.32H76.8001C77.7401 28.32 77.9901 28.75 78.1001 29.08L81.1901 36.2C81.6601 37.61 82.8501 38.33 84.7301 38.33H88.1501L83.8201 27.34Z" fill="#505071"/>
+<path d="M16 19.5699C15.64 15.5199 12.26 12.3299 8.13 12.2799H1.59H1.38H0V13.6599V14.0699V20.6099H0.01C0.17 24.7999 3.54 28.1599 7.73 28.3099V28.3199H14.44H14.66H16.04V26.9399V19.5999C16.02 19.5899 16.01 19.5799 16 19.5699Z" fill="#00D9BA"/>
+</g>
+<defs>
+<filter id="filter0_d" x="-2" y="0.319946" width="92.1501" height="49" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="1"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/>
+</filter>
+</defs>
+</svg>
diff --git a/img/logos/Postman-logo-vertical-orange-2021.svg b/img/logos/Postman-logo-vertical-orange-2021.svg
new file mode 100644
index 0000000000..251b9e4db8
--- /dev/null
+++ b/img/logos/Postman-logo-vertical-orange-2021.svg
@@ -0,0 +1,19 @@
+<svg width="179" height="183" viewBox="0 0 179 183" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_119:769)">
+<path d="M8.05603 135.742H1.228C0.906982 135.73 0.593394 135.84 0.349366 136.05C0.239687 136.14 0.151415 136.253 0.0909813 136.382C0.0305473 136.51 -0.000544443 136.651 7.21454e-06 136.793V161.14C7.21454e-06 161.303 0.0443231 161.464 0.12823 161.604C0.212138 161.744 0.332494 161.859 0.476394 161.936C0.798251 162.122 1.16335 162.221 1.535 162.221C1.90665 162.221 2.27175 162.122 2.59361 161.936C2.73393 161.858 2.84977 161.742 2.92827 161.601C3.00677 161.46 3.04483 161.301 3.03821 161.14V151.785H7.91841C9.9698 151.88 11.9825 151.203 13.5608 149.885C14.9723 148.611 15.678 146.625 15.678 143.928V143.599C15.678 140.895 14.9723 138.913 13.5608 137.653C12.0273 136.35 10.0642 135.669 8.05603 135.742ZM12.7033 144.077C12.8144 145.475 12.3691 146.861 11.4648 147.931C10.9964 148.377 10.442 148.722 9.83571 148.944C9.22947 149.167 8.58418 149.263 7.93957 149.226H3.08056V138.502H7.96073C8.60413 138.46 9.24941 138.551 9.85603 138.77C10.4627 138.989 11.0176 139.332 11.4859 139.776C12.3903 140.847 12.8355 142.232 12.7245 143.631L12.7033 144.077Z" fill="#FF6C37"/>
+<path d="M28.4871 137.643C27.0791 138.906 26.3699 140.913 26.3699 143.631V154.546C26.3699 157.286 27.0686 159.271 28.4871 160.535C30.1182 161.78 32.1114 162.454 34.1612 162.454C36.211 162.454 38.2042 161.78 39.8353 160.535C41.2468 159.275 41.9526 157.279 41.9526 154.546V143.631C41.9526 140.913 41.2433 138.906 39.8353 137.643C38.2 136.407 36.2084 135.739 34.1612 135.739C32.114 135.739 30.1224 136.407 28.4871 137.643ZM38.9038 154.546C39.0085 155.947 38.5641 157.334 37.6652 158.411C37.1974 158.857 36.6428 159.201 36.0363 159.422C35.4297 159.644 34.7842 159.737 34.1401 159.696C30.9854 159.696 29.4081 157.979 29.4081 154.546V143.631C29.4081 140.212 30.9854 138.492 34.1401 138.492C34.784 138.453 35.429 138.547 36.0353 138.768C36.6416 138.989 37.1963 139.332 37.6652 139.777C38.5696 140.847 39.0149 142.233 38.9038 143.631V154.546Z" fill="#FF6C37"/>
+<path d="M64.0562 147.952C62.8706 147.421 61.7062 146.943 60.5311 146.529C59.4431 146.171 58.4308 145.613 57.5458 144.884C57.1524 144.553 56.8406 144.136 56.6349 143.664C56.4292 143.192 56.3352 142.679 56.3602 142.165C56.3166 141.61 56.4188 141.054 56.6565 140.551C56.8943 140.048 57.2593 139.616 57.7152 139.299C58.7813 138.671 60.0053 138.365 61.2404 138.417C62.3957 138.4 63.5409 138.635 64.5961 139.107C65.124 139.361 65.6688 139.577 66.2264 139.755C66.4219 139.754 66.6134 139.7 66.7797 139.597C66.946 139.493 67.0806 139.346 67.1686 139.171C67.3812 138.856 67.5056 138.489 67.5285 138.109C67.5285 137.387 66.8404 136.793 65.4854 136.347C64.0984 135.909 62.652 135.691 61.1981 135.699C60.2634 135.692 59.3317 135.803 58.4245 136.028C57.5382 136.259 56.6896 136.616 55.905 137.09C55.0712 137.596 54.4019 138.333 53.9783 139.214C53.4773 140.244 53.2304 141.38 53.2585 142.526C53.1961 143.951 53.6261 145.354 54.4759 146.497C55.2653 147.496 56.2916 148.281 57.4611 148.78C58.668 149.29 59.8219 149.747 60.9863 150.182C62.1028 150.587 63.1154 151.236 63.9504 152.082C64.3602 152.513 64.6799 153.021 64.8908 153.577C65.1017 154.133 65.1994 154.726 65.1784 155.321C65.2195 155.946 65.1201 156.571 64.8874 157.152C64.6546 157.733 64.2946 158.254 63.834 158.676C62.7831 159.489 61.4745 159.892 60.15 159.812C59.2475 159.834 58.3492 159.683 57.5035 159.366C56.8652 159.141 56.2836 158.779 55.7991 158.305C55.4286 157.933 55.0793 157.593 54.7405 157.296C54.5263 157.052 54.2345 156.891 53.9148 156.839C53.7365 156.855 53.5643 156.912 53.4118 157.006C53.2593 157.1 53.1307 157.228 53.0362 157.381C52.7797 157.701 52.6347 158.096 52.6233 158.506C52.6233 159.388 53.3643 160.28 54.8887 161.182C56.5394 162.128 58.4196 162.594 60.3194 162.531C62.4011 162.635 64.447 161.958 66.057 160.63C66.8009 159.904 67.3763 159.022 67.7422 158.048C68.1081 157.073 68.2556 156.03 68.1742 154.992C68.2356 153.407 67.8067 151.842 66.9463 150.511C66.2215 149.42 65.2253 148.538 64.0562 147.952Z" fill="#FF6C37"/>
+<path d="M93.0621 135.742H78.3475C78.1913 135.732 78.0354 135.764 77.8958 135.835C77.7562 135.906 77.638 136.013 77.5535 136.145C77.3585 136.418 77.2548 136.745 77.2571 137.08C77.2555 137.444 77.3747 137.799 77.5959 138.089C77.6787 138.222 77.7966 138.331 77.9366 138.402C78.0766 138.473 78.2334 138.504 78.3898 138.492H84.2439V161.14C84.2373 161.301 84.2754 161.461 84.3539 161.601C84.4324 161.742 84.5482 161.858 84.6886 161.936C85.0104 162.123 85.3755 162.221 85.7472 162.221C86.1188 162.221 86.4839 162.123 86.8058 161.936C86.9461 161.858 87.0619 161.742 87.1404 161.601C87.2189 161.461 87.257 161.301 87.2504 161.14V138.492H93.0621C93.2191 138.5 93.3753 138.465 93.5148 138.392C93.6543 138.32 93.772 138.211 93.8561 138.078C94.0491 137.782 94.1487 137.434 94.1419 137.08C94.1432 136.746 94.0435 136.421 93.8561 136.145C93.7715 136.013 93.6534 135.906 93.5138 135.835C93.3742 135.764 93.2183 135.732 93.0621 135.742Z" fill="#FF6C37"/>
+<path d="M122.206 135.742C121.295 135.742 120.491 136.379 119.792 137.664L114.086 148.6L108.412 137.664C107.756 136.379 106.951 135.742 105.988 135.742C105.83 135.721 105.67 135.721 105.511 135.742C105.172 135.809 104.871 136.006 104.674 136.291C104.476 136.577 104.397 136.928 104.453 137.271V161.14C104.443 161.312 104.484 161.484 104.571 161.633C104.657 161.782 104.786 161.902 104.94 161.979C105.257 162.178 105.624 162.281 105.998 162.276C106.377 162.272 106.746 162.154 107.057 161.936C107.197 161.858 107.313 161.742 107.392 161.601C107.47 161.461 107.508 161.301 107.502 161.14V141.932L112.964 152.401C113.04 152.646 113.188 152.862 113.388 153.021C113.588 153.18 113.831 153.275 114.086 153.293C114.35 153.28 114.604 153.188 114.815 153.029C115.026 152.871 115.185 152.652 115.272 152.401L120.724 142.113V161.108C120.723 161.269 120.764 161.428 120.844 161.568C120.924 161.708 121.04 161.824 121.179 161.904C121.501 162.091 121.866 162.189 122.237 162.189C122.609 162.189 122.974 162.091 123.296 161.904C123.437 161.826 123.553 161.71 123.634 161.57C123.714 161.429 123.754 161.27 123.751 161.108V137.228C123.773 137.105 123.773 136.98 123.751 136.857C123.727 136.68 123.667 136.51 123.575 136.357C123.484 136.203 123.362 136.071 123.217 135.966C123.073 135.862 122.908 135.788 122.734 135.75C122.561 135.711 122.381 135.709 122.206 135.742Z" fill="#FF6C37"/>
+<path d="M143.399 135.752C142.34 135.752 141.769 136.113 141.557 136.814L134.147 160.694C134.106 160.785 134.081 160.882 134.073 160.981C134.073 161.181 134.13 161.377 134.237 161.546C134.344 161.715 134.496 161.85 134.676 161.936C135.039 162.172 135.462 162.297 135.894 162.297C136.124 162.322 136.355 162.266 136.549 162.138C136.742 162.01 136.885 161.819 136.952 161.597L138.54 156.288H148.068L149.645 161.597C149.724 161.81 149.87 161.993 150.06 162.117C150.251 162.242 150.477 162.301 150.704 162.287C151.17 162.295 151.629 162.17 152.027 161.926C152.194 161.844 152.337 161.72 152.441 161.565C152.545 161.41 152.607 161.231 152.62 161.044C152.63 161.01 152.63 160.973 152.62 160.938C152.609 160.896 152.609 160.853 152.62 160.811L145.209 136.814C145.029 136.113 144.426 135.752 143.399 135.752ZM139.334 153.718L143.378 140.17L147.422 153.718H139.334Z" fill="#FF6C37"/>
+<path d="M178.545 135.997C178.219 135.821 177.856 135.729 177.486 135.729C177.117 135.729 176.753 135.821 176.428 135.997C176.289 136.073 176.174 136.185 176.094 136.322C176.014 136.458 175.972 136.613 175.972 136.772V155.342L166.974 137.653C166.714 137.104 166.355 136.607 165.916 136.188C165.552 135.89 165.094 135.732 164.624 135.742C163.566 135.742 163.11 136.092 163.11 136.804V161.15C163.104 161.311 163.142 161.471 163.22 161.612C163.299 161.752 163.415 161.868 163.555 161.947C163.877 162.133 164.242 162.231 164.614 162.231C164.985 162.231 165.35 162.133 165.672 161.947C165.813 161.868 165.928 161.752 166.007 161.612C166.085 161.471 166.123 161.311 166.117 161.15V142.622L175.517 160.853C175.672 161.243 175.935 161.579 176.274 161.824C176.614 162.069 177.016 162.211 177.433 162.234C177.808 162.242 178.176 162.139 178.492 161.936C178.633 161.858 178.751 161.743 178.831 161.602C178.911 161.462 178.952 161.302 178.947 161.14V136.772C178.953 136.619 178.919 136.467 178.849 136.331C178.778 136.195 178.673 136.08 178.545 135.997Z" fill="#FF6C37"/>
+<path d="M96.3651 3.06881C85.7854 1.69802 75.0381 3.50532 65.4827 8.26208C55.9273 13.0188 47.9931 20.5113 42.684 29.7917C37.3748 39.0721 34.9291 49.7234 35.6564 60.3981C36.3836 71.0729 40.2511 81.2915 46.7695 89.7613C53.288 98.231 62.1645 104.571 72.2762 107.98C82.3879 111.389 93.2804 111.713 103.576 108.912C113.871 106.11 123.107 100.309 130.115 92.2416C137.122 84.1744 141.587 74.2038 142.944 63.591C144.759 49.3716 140.873 35.0109 132.14 23.6631C123.406 12.3152 110.539 4.90819 96.3651 3.06881Z" fill="white"/>
+<path d="M121.846 28.456C121.769 28.4943 121.7 28.5476 121.644 28.6129C121.587 28.6782 121.544 28.7542 121.518 28.8363C121.491 28.9184 121.481 29.005 121.488 29.0911C121.496 29.1771 121.52 29.2608 121.56 29.3373C121.726 29.6777 121.791 30.0585 121.747 30.4348C121.704 30.811 121.555 31.1671 121.316 31.4609C121.242 31.5568 121.196 31.6714 121.182 31.7921C121.169 31.9128 121.189 32.0348 121.241 32.1447C121.292 32.2546 121.373 32.3481 121.474 32.4148C121.575 32.4815 121.693 32.5188 121.814 32.5227C121.911 32.5216 122.007 32.4992 122.095 32.457C122.183 32.4149 122.26 32.3539 122.322 32.2785C122.727 31.789 122.98 31.1918 123.052 30.5601C123.123 29.9283 123.009 29.2894 122.724 28.7215C122.684 28.6459 122.63 28.579 122.564 28.5247C122.498 28.4703 122.422 28.4296 122.34 28.405C122.259 28.3803 122.173 28.3721 122.088 28.3808C122.003 28.3896 121.921 28.4152 121.846 28.456Z" fill="#F36C3D"/>
+<path d="M96.6933 0.467364C85.6015 -0.959848 74.3368 0.94401 64.3238 5.93818C54.3108 10.9324 45.9992 18.7925 40.44 28.5247C34.8808 38.2569 32.3238 49.424 33.0923 60.6138C33.8608 71.8037 37.9202 82.5136 44.7573 91.3894C51.5944 100.265 60.902 106.908 71.5032 110.478C82.1043 114.048 93.5228 114.385 104.315 111.445C115.107 108.506 124.787 102.423 132.132 93.9658C139.478 85.5082 144.157 75.0559 145.58 63.9307C147.487 49.0127 143.408 33.9457 134.24 22.0441C125.073 10.1425 111.566 2.38113 96.6933 0.467364ZM108.338 35.8463C107.29 35.8652 106.29 36.2871 105.543 37.0249L84.5934 58.0802L80.1155 53.5889C100.758 32.9264 104.485 32.6928 108.338 35.8463ZM85.4192 58.8235L106.348 37.8319C106.895 37.2866 107.635 36.9805 108.407 36.9805C109.178 36.9805 109.918 37.2866 110.466 37.8319C110.747 38.1073 110.969 38.4382 111.116 38.8036C111.264 39.1691 111.334 39.5613 111.323 39.9554C111.313 40.3592 111.219 40.7564 111.048 41.1219C110.876 41.4874 110.631 41.8133 110.328 42.079L88.1927 61.5948L85.4192 58.8235ZM86.9753 62.0938L81.7881 63.2193C81.7264 63.2351 81.6613 63.2299 81.603 63.2043C81.5447 63.1788 81.4966 63.1345 81.4662 63.0785C81.4358 63.0224 81.4249 62.9578 81.4353 62.8948C81.4457 62.8319 81.4767 62.7742 81.5234 62.7309L84.5616 59.6729L86.9753 62.0938ZM73.7639 59.9702L79.2898 54.4277L83.429 58.5793L74.1026 60.5967C74.0239 60.6167 73.9406 60.6086 73.8672 60.5737C73.7938 60.5388 73.7348 60.4794 73.7004 60.4056C73.6731 60.3701 73.6531 60.3295 73.6416 60.2862C73.63 60.243 73.6271 60.1978 73.633 60.1534C73.6389 60.109 73.6535 60.0662 73.6759 60.0275C73.6984 59.9887 73.7283 59.9549 73.7639 59.9277V59.9702ZM56.5826 88.6386C56.5157 88.6335 56.4518 88.6086 56.3991 88.567C56.3463 88.5254 56.307 88.469 56.2863 88.405C56.2647 88.3396 56.2612 88.2695 56.2761 88.2022C56.291 88.1349 56.3238 88.0729 56.371 88.0228L60.8277 83.5526L66.5865 89.3288L56.5826 88.6386ZM68.0156 82.7032C67.8023 82.8115 67.6317 82.989 67.5318 83.2068C67.4318 83.4247 67.4083 83.6701 67.4651 83.903L68.4179 88.0016C68.4456 88.1268 68.4322 88.2578 68.3796 88.3748C68.327 88.4918 68.2381 88.5886 68.1261 88.6507C68.0142 88.7129 67.8851 88.737 67.7584 88.7195C67.6316 88.702 67.5139 88.6438 67.4228 88.5537L61.6428 82.7563L79.3639 64.9819L87.9386 63.1344L92.0566 67.2647C86.1284 72.3826 78.0513 77.5748 68.0156 82.6289V82.7032ZM92.8929 66.5003L88.9337 62.5292L111.059 42.9497C111.264 42.7701 111.452 42.5709 111.62 42.3551C110.932 48.7152 102.071 57.698 92.8929 66.4259V66.5003ZM110.127 35.9525C108.92 34.7508 108.096 33.216 107.76 31.5434C107.425 29.8707 107.593 28.1358 108.243 26.5592C108.893 24.9826 109.996 23.6357 111.412 22.6897C112.828 21.7437 114.492 21.2414 116.193 21.2466C118.207 21.2449 120.159 21.9512 121.708 23.2428L114.107 30.8028C114.001 30.9102 113.94 31.0548 113.938 31.2063C113.938 31.2799 113.953 31.3526 113.982 31.4202C114.012 31.4877 114.054 31.5486 114.107 31.5991L119.983 37.5027C118.377 38.3016 116.562 38.5746 114.794 38.2831C113.026 37.9916 111.393 37.1504 110.127 35.8782V35.9525ZM122.269 35.9525C121.883 36.349 121.457 36.7047 120.999 37.0143L115.293 31.2169L122.523 23.9648C124.019 25.6018 124.827 27.7549 124.777 29.9748C124.728 32.1947 123.826 34.3097 122.259 35.8782L122.269 35.9525Z" fill="#FF6C37"/>
+</g>
+<defs>
+<clipPath id="clip0_119:769">
+<rect width="179" height="183" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/img/logos/tyk-docs-logo-dark.svg b/img/logos/tyk-docs-logo-dark.svg
new file mode 100644
index 0000000000..c255dc1878
--- /dev/null
+++ b/img/logos/tyk-docs-logo-dark.svg
@@ -0,0 +1,17 @@
+<svg width="1006" height="223" viewBox="0 0 1006 223" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_2044_7888)">
+<path d="M195.531 4.86524C192.742 1.96814 189.095 0.573242 184.912 0.573242H62.9604V15.2733C62.9604 19.2434 64.355 22.677 67.2507 25.4668C70.1469 28.3639 73.7937 29.8661 77.9765 29.8661H116.911V177.618L131.176 177.726C135.359 177.726 139.006 176.224 141.795 173.434C144.691 170.536 146.192 166.995 146.192 163.133V29.9734L199.928 29.8661V16.239C199.821 12.3762 198.427 7.86964 195.531 4.86524Z" fill="#03031C"/>
+<path d="M272.97 54.6519C268.787 54.6519 265.141 56.047 262.352 58.9439C259.456 61.8412 257.954 65.3819 257.954 69.2447V128.153C252.806 142.638 237.146 149.613 220.307 149.613C206.364 149.613 199.606 143.067 199.606 129.762V69.2447C199.606 65.3819 198.105 61.9483 195.209 58.9439C192.42 56.047 188.773 54.6519 184.59 54.6519H170.325V132.552C170.325 162.489 185.556 177.725 217.089 177.725C232.641 177.725 249.588 172.253 257.74 161.63C257.096 171.073 256.024 176.008 250.768 183.09C244.869 191.03 233.285 194.035 221.165 194.035C209.581 194.035 198.427 191.781 186.199 187.168C184.161 186.631 182.231 186.416 180.622 186.416C173.972 186.416 170.325 190.064 170.325 196.717V208.735L171.183 209.271C185.127 217.748 201.43 222.04 221.165 222.04C262.137 222.04 287.128 199.614 287.128 155.299V54.6519H272.97Z" fill="#03031C"/>
+<path d="M407.256 123.647C405.111 117.101 402.537 116.136 399.427 113.238C400.821 111.414 402.537 107.981 405.004 100.684L423.453 54.76H406.72C397.603 54.76 391.704 58.5152 389.345 65.8116L376.795 95.1048C375.83 97.5724 372.934 98.753 368.215 98.753H340.864L340.971 14.9514C340.971 11.0886 339.684 7.86964 336.789 4.86524C334 1.96814 330.353 0.573242 326.17 0.573242H311.69V177.618H326.063C330.246 177.618 333.892 176.116 336.789 173.219C339.577 170.429 341.079 166.996 341.079 163.025L340.864 128.368H373.256C377.868 128.368 379.048 130.514 379.584 132.123L394.6 167.21C396.853 174.185 402.645 177.618 411.869 177.618H428.493L407.256 123.647Z" fill="#03031C"/>
+<path d="M77.7618 85.4483C76.0452 65.4905 59.6351 49.825 39.4707 49.6104H7.72253H6.64996H0V56.3703V58.4088V90.5988C0.858059 111.093 17.1612 127.617 37.5401 128.368H70.1463H71.2189H77.8688V121.609V85.5559C77.8688 85.4484 77.7618 85.4483 77.7618 85.4483Z" fill="#20EDBA"/>
+<path d="M619.025 110.897C619.025 131.641 612.457 147.876 599.32 159.601C586.676 170.998 569.82 176.697 548.748 176.697H478.343V66.3738C478.343 45.7112 484.913 29.4763 498.049 17.6691C510.693 6.27186 527.593 0.573242 548.748 0.573242C569.82 0.573242 586.676 6.27186 599.32 17.6691C612.457 29.4763 619.025 45.7112 619.025 66.3738V110.897ZM548.748 156.035C562.793 156.035 574.115 152.181 582.711 144.473C591.632 136.52 596.095 125.656 596.095 111.881V66.3738C596.095 52.5985 591.632 41.6934 582.711 33.658C574.115 25.9505 562.793 22.0968 548.748 22.0968C534.615 22.0968 523.253 25.9505 514.663 33.658C505.737 41.6934 501.274 52.5985 501.274 66.3738V156.035H548.748Z" fill="#8438FA"/>
+<path d="M706.907 68.3419C692.197 68.3419 681.748 72.6877 675.549 81.3788C670.509 88.4305 667.989 98.9666 667.989 112.988C667.989 127.009 670.509 137.586 675.549 144.72C681.748 153.411 692.197 157.757 706.907 157.757C721.618 157.757 732.067 153.411 738.266 144.72C743.227 137.586 745.702 127.009 745.702 112.988C745.702 98.9666 743.227 88.4305 738.266 81.3788C732.067 72.6877 721.618 68.3419 706.907 68.3419ZM706.907 47.8022C747.315 47.8022 767.519 69.5309 767.519 112.988C767.519 156.445 747.315 178.173 706.907 178.173C666.416 178.173 646.173 156.445 646.173 112.988C646.173 69.5309 666.416 47.8022 706.907 47.8022Z" fill="#8438FA"/>
+<path d="M899.403 166.501C886.182 174.373 869.613 178.308 849.7 178.308C809.209 178.308 788.96 156.58 788.96 113.122C788.96 69.6656 809.209 47.937 849.7 47.937C869.613 47.937 886.182 51.8726 899.403 59.7442V70.0756C899.403 74.2571 897.46 76.3483 893.575 76.3483C892.253 76.3483 890.769 76.1431 889.117 75.7331C875.728 70.8136 862.591 68.3539 849.7 68.3539C834.99 68.3539 824.535 72.7406 818.342 81.5135C813.297 88.5652 810.777 99.1013 810.777 113.122C810.777 127.144 813.297 137.68 818.342 144.731C824.535 153.505 834.99 157.891 849.7 157.891C862.591 157.891 875.728 155.432 889.117 150.512C890.769 150.102 892.253 149.897 893.575 149.897C897.46 149.897 899.403 151.988 899.403 156.17V166.501Z" fill="#8438FA"/>
+<path d="M955.675 47.937C973.527 47.937 989.061 51.9135 1002.28 59.867V70.0756C1002.28 74.3395 1000.34 76.4712 996.458 76.4712C995.215 76.4712 993.731 76.225 991.995 75.7331C978.523 70.8955 966.421 68.4767 955.675 68.4767C948.569 68.4767 942.992 70.3213 938.943 74.0114C935.225 77.2911 933.366 81.3088 933.366 86.0645C933.366 91.9682 937.207 96.1088 944.891 98.4867C945.058 98.5686 953.446 100.167 970.055 103.283C981.378 105.333 989.722 108.572 995.092 113C1002.37 118.903 1006 127.636 1006 139.197V140.304C1005.83 150.635 1001.91 159.367 994.224 166.501C985.796 174.373 974.434 178.308 960.138 178.308C942.208 178.308 926.63 174.373 913.409 166.501V156.292C913.409 152.029 915.391 149.897 919.361 149.897C920.599 149.897 922.043 150.102 923.695 150.512C937.168 155.432 949.314 157.891 960.138 157.891C967.244 157.891 973.068 156.047 977.615 152.357C981.748 148.995 983.814 144.977 983.814 140.304C983.814 133.58 980.051 128.825 972.536 126.037C970.302 125.217 961.958 123.495 947.494 120.871C936.177 118.821 927.872 115.828 922.581 111.892C914.977 106.235 911.18 97.6258 911.18 86.0645C911.18 75.6512 914.814 66.9188 922.088 59.867C930.185 51.9135 941.379 47.937 955.675 47.937Z" fill="#8438FA"/>
+</g>
+<defs>
+<clipPath id="clip0_2044_7888">
+<rect width="1006" height="222" fill="white" transform="translate(0 0.573242)"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/img/logos/tyk-logo-opensource.svg b/img/logos/tyk-logo-opensource.svg
new file mode 100644
index 0000000000..9531901b80
--- /dev/null
+++ b/img/logos/tyk-logo-opensource.svg
@@ -0,0 +1,23 @@
+<svg width="401" height="297" viewBox="0 0 401 297" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_2044_7924)">
+<path d="M183.421 3.90244C180.82 1.30081 177.568 0 173.665 0H59.8438V13.6585C59.8438 17.2358 61.1446 20.4878 63.7462 23.0894C66.3479 25.6911 69.925 27.3171 73.8274 27.3171H110.251V163.577H123.584C127.486 163.577 130.738 162.276 133.34 159.675C135.942 157.073 137.568 153.821 137.568 150.244V26.9919H187.649V14.3089C187.649 10.7317 186.348 6.82927 183.421 3.90244Z" fill="#03031C"/>
+<path d="M255.942 49.7563C252.039 49.7563 248.787 51.0571 246.185 53.6588C243.584 56.2604 241.958 59.5124 241.958 63.0897V117.398C237.08 130.732 222.446 137.236 206.836 137.236C193.828 137.236 187.649 131.382 187.649 119.025V63.4149C187.649 59.8376 186.348 56.5856 183.421 53.984C180.82 51.3823 177.568 50.0816 173.665 50.0816H160.007V121.951C160.007 149.594 174.316 163.577 203.584 163.577C217.893 163.577 233.828 158.699 241.633 148.618C240.982 157.399 240.007 161.951 235.129 168.455C229.6 175.61 218.868 178.537 207.486 178.537C196.755 178.537 186.348 176.26 174.966 172.033C173.015 171.707 171.389 171.382 169.763 171.382C163.584 171.382 160.007 174.634 160.007 180.813V191.87L160.982 192.52C173.99 200.325 189.275 204.228 207.486 204.228C245.535 204.228 268.95 183.415 268.95 142.764V49.7563H255.942Z" fill="#03031C"/>
+<path d="M381.145 113.496C379.194 107.642 376.592 106.667 373.99 104.065C375.291 102.439 376.917 99.187 379.194 92.3577L396.429 50.0813H380.82C372.364 50.0813 366.836 53.6585 364.559 60.1626L352.852 87.1545C351.877 89.4309 349.275 90.4065 344.722 90.4065H319.031V13.0081C319.031 9.43089 317.73 6.50407 315.129 3.90244C312.527 1.30081 309.275 0 305.372 0H291.714V163.252H305.372C309.275 163.252 312.527 161.951 315.454 159.35C318.055 156.748 319.356 153.496 319.356 149.919L319.031 118.049H349.275C353.503 118.049 354.803 120 355.129 121.626L369.112 153.821C371.389 160.325 376.592 163.577 385.047 163.577H400.657L381.145 113.496Z" fill="#03031C"/>
+<path d="M73.8275 78.0491C72.2015 59.5125 56.9169 45.2036 38.0551 44.8784H8.4616H7.48599H1.30713V51.0572V53.0085V82.6019C1.95754 101.789 17.2421 117.073 36.1039 117.724H66.3478H67.3234H73.5023V111.545L73.8275 78.0491C73.8275 78.3743 73.8275 78.3743 73.8275 78.0491Z" fill="#20EDBA"/>
+<path d="M54.3152 225.041V230.894C54.3152 232.846 53.3396 233.821 51.7136 233.821C51.0632 233.821 50.0876 233.821 49.4372 233.496C40.9819 230.569 33.5022 228.943 26.9982 228.943C22.4453 228.943 18.5429 230.244 15.9413 232.52C13.3396 234.797 12.364 237.398 12.364 240.65C12.364 244.878 14.9656 247.805 20.1689 249.431C20.1689 249.431 25.3721 250.407 35.7787 252.358C42.6079 253.659 47.486 255.61 50.738 258.211C54.9656 261.789 56.9169 266.667 56.9169 273.496V274.146C56.9169 280.325 54.6404 285.203 50.0876 289.431C45.2095 293.984 38.3803 296.26 29.925 296.26C19.1933 296.26 10.0876 293.984 2.28276 289.431V283.577C2.28276 281.626 3.25837 280.65 4.88438 280.65C5.53479 280.65 6.1852 280.65 7.16081 280.976C15.6161 283.902 23.0957 285.529 29.925 285.529C34.4778 285.529 38.3803 284.228 41.3071 281.951C44.2339 279.675 45.5348 277.073 45.5348 273.821C45.5348 269.268 42.9331 266.016 37.7299 264.065C36.4291 263.415 31.2258 262.439 22.4453 260.813C15.2908 259.512 10.4128 257.886 7.16081 255.61C2.93316 252.358 0.656738 247.155 0.656738 240.65C0.656738 234.472 2.93316 229.268 7.16081 225.366C11.7136 220.488 18.5429 217.886 26.9982 217.886C37.7299 217.886 46.8356 220.163 54.3152 225.041Z" fill="#8438FA"/>
+<path d="M132.039 261.789C132.039 284.878 121.307 296.586 100.169 296.586C78.7053 296.586 68.2988 284.878 68.2988 261.789C68.2988 238.699 79.0305 226.992 100.169 226.992C121.307 226.992 132.039 238.374 132.039 261.789ZM100.169 236.423C92.0387 236.423 85.8598 239.025 82.2826 243.903C79.3557 247.805 78.0549 253.984 78.0549 261.789C78.0549 269.594 79.3557 275.447 82.2826 279.675C85.8598 284.553 91.7135 287.155 100.169 287.155C108.624 287.155 114.478 284.553 118.055 279.675C120.982 275.447 122.283 269.594 122.283 261.789C122.283 253.984 120.982 248.13 118.055 243.903C114.478 238.699 108.299 236.423 100.169 236.423Z" fill="#8438FA"/>
+<path d="M195.454 280.325C190.25 291.057 182.12 296.585 171.063 296.585C155.129 296.585 147.324 289.106 147.324 274.146V227.642H152.202C153.502 227.642 154.803 228.293 155.779 229.268C156.755 230.244 157.405 231.545 157.405 232.846V272.52C157.405 282.276 162.608 287.155 173.015 287.155C184.722 287.155 192.202 282.602 195.454 273.171V232.846C195.454 231.545 196.104 230.244 197.08 229.268C198.055 228.293 199.356 227.642 200.657 227.642H205.535V295.285H200.657C199.356 295.285 198.055 294.959 197.08 293.984C196.104 293.008 195.454 291.707 195.454 290.407V280.325Z" fill="#8438FA"/>
+<path d="M223.096 227.642H227.974C229.275 227.642 230.576 228.293 231.551 229.268C232.527 230.244 233.177 231.545 233.177 232.846V243.252C238.381 232.521 245.21 226.992 253.99 226.992C258.218 226.992 262.446 227.317 266.348 228.293V233.171C266.348 235.447 264.722 236.748 261.795 236.748C259.194 236.423 255.942 236.098 252.364 236.098C243.259 236.098 237.08 240.976 233.503 251.057V290.407C233.503 291.708 232.852 293.008 231.877 293.984C230.901 294.96 229.6 295.285 228.299 295.285H223.421V227.642H223.096Z" fill="#8438FA"/>
+<path d="M333.665 290.407C326.836 294.309 318.381 296.586 307.649 296.586C286.185 296.586 275.779 284.878 275.779 261.789C275.779 238.699 286.511 226.992 307.649 226.992C318.381 226.992 326.836 228.943 333.665 233.171V238.374C333.665 240 333.015 240.976 331.389 240.976C330.738 240.976 330.088 240.976 329.112 240.651C321.958 238.049 314.478 236.748 307.324 236.748C299.194 236.748 293.015 239.35 289.437 244.228C286.511 248.13 285.21 254.309 285.21 262.114C285.21 269.919 286.511 275.773 289.437 280C293.015 285.203 298.868 287.48 307.324 287.48C314.478 287.48 321.633 286.179 329.112 283.577C329.763 283.252 330.738 283.252 331.389 283.252C333.015 283.252 333.665 284.228 333.665 285.854V290.407Z" fill="#8438FA"/>
+<path d="M342.12 261.789C342.12 238.699 352.202 226.992 372.039 226.992C382.771 226.992 390.576 230.244 395.129 237.073C398.706 242.602 400.657 250.732 400.657 261.789C400.657 264.716 399.031 266.342 395.779 266.342H352.527C352.852 280.325 360.007 287.155 374.316 287.155C381.47 287.155 388.624 285.854 396.104 283.252C396.755 282.927 397.73 282.927 398.381 282.927C400.007 282.927 400.657 283.903 400.657 285.529V290.732C393.828 294.634 385.372 296.911 374.641 296.911C352.852 296.26 342.12 284.878 342.12 261.789ZM390.576 256.586C389.925 249.756 388.624 244.878 386.673 241.951C383.746 238.049 378.868 236.098 372.039 236.098C364.885 236.098 360.007 238.049 356.755 241.951C354.153 244.878 352.852 249.756 352.202 256.586H390.576Z" fill="#8438FA"/>
+<path d="M58.5431 193.821C58.5431 197.723 57.2423 200.976 54.9659 202.927C52.6895 205.203 49.4375 206.179 45.2098 206.179C41.3074 206.179 38.0553 205.203 35.4537 202.927C32.8521 200.65 31.8765 197.723 31.8765 193.821V185.366C31.8765 181.463 33.1773 178.211 35.4537 176.26C37.7301 173.984 40.9822 173.008 45.2098 173.008C49.1123 173.008 52.3643 173.984 54.9659 176.26C57.5675 178.537 58.5431 181.463 58.5431 185.366V193.821ZM39.3562 179.512C37.7301 180.813 37.0797 182.764 37.0797 185.366V193.821C37.0797 196.423 37.7301 198.049 39.3562 199.675C40.657 200.976 42.6082 201.626 45.2098 201.626C47.4862 201.626 49.4375 200.976 51.0635 199.675C52.6895 198.374 53.3399 196.423 53.3399 193.821V185.366C53.3399 183.089 52.6895 181.138 51.0635 179.512C49.7627 178.211 47.8114 177.561 45.2098 177.561C42.6082 177.561 40.657 178.211 39.3562 179.512Z" fill="#8438FA"/>
+<path d="M76.429 181.463C83.5835 181.463 87.1607 185.691 87.1607 193.821C87.1607 202.276 83.2583 206.179 75.4534 206.179C72.8517 206.179 70.5753 205.853 68.9493 205.203V212.032C68.9493 212.683 68.6241 213.333 68.2989 213.658C67.9737 213.984 67.3233 214.309 66.3477 214.309H63.7461V181.788H66.3477C66.9981 181.788 67.6485 182.114 68.2989 182.439C68.9493 183.089 68.9493 183.414 68.9493 184.065C70.5753 182.114 72.8517 181.463 76.429 181.463ZM68.9493 200.325C71.2257 200.975 73.177 201.626 75.4534 201.626C77.7298 201.626 79.681 200.975 80.6566 199.675C81.6322 198.374 81.9574 196.423 81.9574 193.821C81.9574 191.219 81.6322 189.268 80.6566 187.967C79.681 186.667 78.055 186.016 75.4534 186.016C71.8761 186.016 69.5997 187.317 68.6241 189.919V200.325H68.9493Z" fill="#8438FA"/>
+<path d="M90.7378 193.821C90.7378 185.366 94.3151 181.463 101.795 181.463C105.698 181.463 108.624 182.764 110.25 185.366C111.551 187.317 112.202 190.244 112.202 194.146C112.202 195.772 111.226 196.423 109.6 196.423H95.9411C95.9411 200 98.2175 201.951 102.446 201.951C104.722 201.951 106.998 201.626 109.275 200.65C109.6 200.65 109.925 200.65 110.25 200.65C111.226 200.65 111.876 201.301 111.876 202.276V204.553C109.275 206.179 106.023 206.829 102.12 206.829C94.6403 206.179 90.7378 201.951 90.7378 193.821ZM106.673 191.219C106.673 189.593 106.023 188.293 105.698 187.642C105.047 186.667 103.421 186.016 101.47 186.016C99.5183 186.016 97.8923 186.667 96.9167 187.642C96.2663 188.618 95.6159 189.919 95.6159 191.219H106.673Z" fill="#8438FA"/>
+<path d="M137.568 205.854H134.966C134.316 205.854 133.665 205.528 133.015 205.203C132.69 204.878 132.364 204.228 132.364 203.577V190.244C132.364 187.317 131.064 186.016 128.137 186.016C124.559 186.016 122.608 187.642 121.307 190.569V203.577C121.307 204.228 120.982 204.878 120.657 205.203C120.007 205.854 119.681 205.854 118.706 205.854H116.104V181.463H118.706C119.356 181.463 120.007 181.789 120.657 182.114C120.982 182.439 121.307 183.089 121.307 183.74C122.933 181.789 125.21 181.138 128.462 181.138C134.316 181.138 137.242 184.065 137.242 189.593V205.854H137.568Z" fill="#8438FA"/>
+</g>
+<defs>
+<clipPath id="clip0_2044_7924">
+<rect width="400" height="297" fill="white" transform="translate(0.656738)"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/img/logos/tyk-logo-selfmanaged.svg b/img/logos/tyk-logo-selfmanaged.svg
new file mode 100644
index 0000000000..7ec4b896d2
--- /dev/null
+++ b/img/logos/tyk-logo-selfmanaged.svg
@@ -0,0 +1,25 @@
+<svg width="401" height="299" viewBox="0 0 401 299" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_2044_7907)">
+<path d="M183.421 3.90244C180.82 1.30081 177.568 0 173.665 0H59.8438V13.6585C59.8438 17.2358 61.1446 20.4878 63.7462 23.0894C66.3478 25.6911 69.925 27.3171 73.8274 27.3171H110.25V163.577H123.584C127.486 163.577 130.738 162.276 133.34 159.675C135.942 157.073 137.568 153.821 137.568 150.244V26.9919H187.649V14.3089C187.649 10.7317 186.348 6.82927 183.421 3.90244Z" fill="#03031C"/>
+<path d="M255.942 49.7563C252.039 49.7563 248.787 51.0571 246.185 53.6588C243.584 56.2604 241.958 59.5124 241.958 63.0897V117.398C237.08 130.732 222.446 137.236 206.836 137.236C193.828 137.236 187.649 131.382 187.649 119.025V63.4149C187.649 59.8376 186.348 56.5856 183.421 53.984C180.82 51.3823 177.568 50.0816 173.665 50.0816H160.007V121.951C160.007 149.594 174.316 163.577 203.584 163.577C217.893 163.577 233.828 158.699 241.633 148.618C240.982 157.399 240.007 161.951 235.129 168.455C229.6 175.61 218.868 178.537 207.486 178.537C196.755 178.537 186.348 176.26 174.966 172.033C173.015 171.707 171.389 171.382 169.763 171.382C163.584 171.382 160.007 174.634 160.007 180.813V191.87L160.982 192.52C173.99 200.325 189.275 204.228 207.486 204.228C245.535 204.228 268.95 183.415 268.95 142.764V49.7563H255.942Z" fill="#03031C"/>
+<path d="M381.145 113.496C379.194 107.642 376.592 106.667 373.99 104.065C375.291 102.439 376.917 99.187 379.194 92.3577L396.429 50.0813H380.82C372.364 50.0813 366.836 53.6585 364.559 60.1626L352.852 87.1545C351.877 89.4309 349.275 90.4065 344.722 90.4065H319.031V13.0081C319.031 9.43089 317.73 6.50406 315.129 3.90244C312.527 1.30081 309.275 0 305.372 0H291.714V163.252H305.372C309.275 163.252 312.527 161.951 315.454 159.35C318.055 156.748 319.356 153.496 319.356 149.919L319.031 118.049H349.275C353.503 118.049 354.803 120 355.129 121.626L369.112 153.821C371.389 160.325 376.592 163.577 385.047 163.577H400.657L381.145 113.496Z" fill="#03031C"/>
+<path d="M73.8274 78.0491C72.2014 59.5125 56.9169 45.2036 38.0551 44.8784H8.4616H7.48599H1.30713V51.0572V53.0085V82.6019C1.95753 101.789 17.2421 117.073 36.1038 117.724H66.3477H67.3234H73.5022V111.545L73.8274 78.0491C73.8274 78.3743 73.8274 78.3743 73.8274 78.0491Z" fill="#20EDBA"/>
+<path d="M112.202 268.293C108.299 276.423 102.446 280.325 93.99 280.325C79.3559 280.325 71.8762 271.87 71.8762 254.634C71.8762 237.398 79.6811 228.943 95.6161 228.943C111.551 228.943 119.356 237.398 119.356 254.634V279.675H115.779C114.803 279.675 113.828 279.35 113.177 278.699C112.527 278.049 112.202 277.073 112.202 276.098V268.293ZM112.202 254.309C112.202 248.455 111.226 244.228 108.95 240.976C106.348 237.073 101.795 235.447 95.6161 235.447C89.4372 235.447 85.2096 237.398 82.2827 240.976C80.0063 243.902 79.0307 248.455 79.0307 254.309C79.0307 260.163 80.0063 264.715 81.9575 267.642C84.5591 271.545 88.7868 273.171 94.9656 273.171C103.421 273.171 108.95 269.594 111.551 262.114V254.309H112.202Z" fill="#8438FA"/>
+<path d="M174.966 279.675H171.389C170.413 279.675 169.437 279.35 168.787 278.699C168.137 278.049 167.811 277.073 167.811 276.098V246.504C167.811 239.35 163.909 235.773 156.104 235.773C147.649 235.773 142.12 239.35 139.519 246.829V276.098C139.519 277.073 139.194 278.049 138.543 278.699C137.893 279.35 136.917 279.675 135.942 279.675H132.364V229.268H135.942C136.917 229.268 137.893 229.594 138.543 230.244C139.194 230.894 139.519 231.87 139.519 232.846V240.651C143.421 232.52 149.275 228.618 157.73 228.618C169.437 228.618 175.291 234.146 175.291 245.203V279.675H174.966Z" fill="#8438FA"/>
+<path d="M225.698 268.293C221.795 276.423 215.942 280.325 207.486 280.325C192.852 280.325 185.372 271.87 185.372 254.634C185.372 237.398 193.177 228.943 209.112 228.943C225.047 228.943 232.852 237.398 232.852 254.634V279.675H229.275C228.299 279.675 227.324 279.35 226.673 278.699C226.023 278.049 225.698 277.073 225.698 276.098V268.293ZM225.698 254.309C225.698 248.455 224.722 244.228 222.446 240.976C219.844 237.073 215.291 235.447 209.112 235.447C202.933 235.447 198.706 237.398 195.779 240.976C193.503 243.902 192.527 248.455 192.527 254.309C192.527 260.163 193.503 264.715 195.454 267.642C198.055 271.545 202.283 273.171 208.462 273.171C216.917 273.171 222.446 269.594 225.047 262.114V254.309H225.698Z" fill="#8438FA"/>
+<path d="M283.259 268.293C279.356 276.423 273.503 280.325 265.047 280.325C250.413 280.325 242.933 271.87 242.933 254.634C242.933 237.398 250.738 228.943 266.673 228.943C282.608 228.943 290.413 237.398 290.413 254.634V273.171C290.413 290.407 282.608 298.862 266.673 298.862C258.868 298.862 252.364 297.236 247.161 294.309V290.407C247.161 289.106 247.811 288.455 248.787 288.455C249.112 288.455 249.763 288.455 250.413 288.781C255.942 290.732 261.145 291.707 266.673 291.707C272.852 291.707 277.08 289.756 280.007 286.179C281.958 283.252 283.259 278.699 283.259 272.846V268.293ZM283.259 254.309C283.259 248.455 282.283 244.228 280.007 240.976C277.405 237.073 272.852 235.447 266.673 235.447C260.494 235.447 256.267 237.398 253.34 240.976C251.063 243.902 250.088 248.455 250.088 254.309C250.088 260.163 251.064 264.715 253.015 267.642C255.616 271.545 259.844 273.171 266.023 273.171C274.478 273.171 280.007 269.594 282.608 262.114V254.309H283.259Z" fill="#8438FA"/>
+<path d="M300.82 254.309C300.82 237.073 308.299 228.618 322.933 228.618C331.063 228.618 336.592 231.22 340.169 236.098C342.771 240 344.397 246.179 344.397 254.309C344.397 256.586 343.096 257.561 340.82 257.561H308.624C308.95 267.968 314.153 273.171 324.885 273.171C330.088 273.171 335.616 272.195 340.82 270.244C341.47 269.919 341.795 269.919 342.446 269.919C343.421 269.919 344.072 270.569 344.072 271.87V275.773C339.194 278.699 332.689 280.325 324.885 280.325C308.95 280.325 300.82 271.545 300.82 254.309ZM336.917 250.732C336.592 245.529 335.616 241.951 333.99 240C332.039 237.073 328.137 235.773 323.259 235.773C318.055 235.773 314.153 237.073 311.876 240C309.925 242.277 308.95 245.854 308.624 251.057H336.917V250.732Z" fill="#8438FA"/>
+<path d="M393.503 268.293C389.6 276.423 383.746 280.325 375.291 280.325C360.657 280.325 353.177 271.87 353.177 254.634C353.177 237.398 360.982 228.943 376.917 228.943C382.446 228.943 387.974 229.919 393.177 231.87V214.309C393.177 213.333 393.502 212.358 394.153 211.707C394.803 211.057 395.779 210.732 396.755 210.732H400.332V279.675H396.755C395.779 279.675 394.803 279.35 394.153 278.699C393.502 278.049 393.177 277.073 393.177 276.098V268.293H393.503ZM393.503 238.699C387.974 236.748 382.446 235.447 377.242 235.447C371.389 235.447 366.836 237.073 364.234 240.651C361.958 243.577 360.982 248.13 360.982 254.309C360.982 260.488 361.958 264.716 364.234 267.968C366.836 271.545 371.063 273.171 376.917 273.171C385.372 273.171 390.901 269.594 393.503 262.114V238.699Z" fill="#8438FA"/>
+<path d="M0.656738 279.025V225.366C0.656738 224.39 0.981941 223.415 1.63235 222.764C2.28276 222.114 3.25837 221.789 4.23398 221.789H8.13641C10.738 221.789 12.364 223.09 13.3396 225.691L31.551 272.521L49.7624 225.691C50.738 223.09 52.6892 221.789 54.9656 221.789H58.8681C59.8437 221.789 60.8193 222.114 61.4697 222.764C62.1201 223.415 62.4453 224.39 62.4453 225.366V279.025H58.8681C57.8925 279.025 56.9169 278.699 56.2665 278.049C55.6161 277.399 55.2908 276.423 55.2908 275.447V229.919L37.7299 275.447C36.7543 277.724 35.4534 279.025 33.177 279.025H30.2502C27.9738 279.025 26.673 277.724 25.6973 275.447L8.13641 229.919V275.122C8.13641 276.098 7.81121 277.073 7.16081 277.724C6.5104 278.374 5.53479 278.699 4.55918 278.699H0.656738V279.025Z" fill="#8438FA"/>
+<path d="M73.5023 204.228C74.8031 203.252 75.4535 202.276 75.4535 200.65C75.4535 199.024 74.4779 197.724 72.8519 197.073C72.2015 196.748 69.9251 196.423 66.9983 195.772C64.0714 195.447 61.795 194.797 60.4942 193.821C58.543 192.52 57.5674 190.244 57.5674 187.317C57.5674 184.39 58.543 182.114 60.8194 180.488C62.7706 178.862 65.3722 178.211 68.2991 178.211C71.5511 178.211 75.1283 178.862 79.0308 180.163V181.789C79.0308 182.439 78.7056 183.089 78.3804 183.415C78.0552 183.74 77.4048 184.065 76.4292 184.065C73.5023 183.089 70.5755 182.764 68.2991 182.764C66.6731 182.764 65.3722 183.089 64.3966 184.065C63.0958 185.041 62.4454 186.016 62.4454 187.642C62.4454 189.268 63.421 190.244 65.047 190.894C65.6974 191.22 67.6487 191.545 71.2259 191.87C74.1527 192.195 76.4292 193.171 77.73 194.146C79.6812 195.447 80.6568 197.724 80.6568 200.65V200.976C80.6568 203.902 79.356 206.179 77.0796 207.805C75.1283 209.431 72.5267 210.081 69.5999 210.081C66.3479 210.081 62.7706 209.431 58.8682 208.13V206.504C58.8682 205.854 59.1934 205.203 59.5186 204.878C59.8438 204.553 60.4942 204.228 61.4698 204.228C64.3966 205.203 67.3235 205.529 69.5999 205.529C70.9007 205.529 72.2015 205.203 73.5023 204.228Z" fill="#8438FA"/>
+<path d="M83.5835 198.374C83.5835 190.569 87.1608 186.667 93.99 186.667C97.8925 186.667 100.494 187.967 102.12 190.244C103.421 192.195 104.072 194.797 104.072 198.374C104.072 199.675 103.421 200.65 101.795 200.65H88.7868C88.7868 204.228 91.0632 205.854 94.9656 205.854C97.2421 205.854 99.1933 205.528 101.47 204.553C101.795 204.553 102.12 204.553 102.446 204.553C103.421 204.553 104.072 205.203 104.072 206.179V208.13C101.47 209.756 98.5429 210.406 94.9656 210.406C87.1608 210.081 83.5835 206.179 83.5835 198.374ZM98.8681 195.772C98.8681 194.146 98.5429 192.845 97.8925 192.195C97.2421 191.219 95.9412 190.569 93.99 190.569C92.0388 190.569 90.738 191.219 89.7624 192.195C89.112 193.171 88.7868 194.146 88.4616 195.772H98.8681Z" fill="#8438FA"/>
+<path d="M107.649 178.537H109.925C110.576 178.537 111.226 178.862 111.551 179.187C111.876 179.512 112.202 180.163 112.202 180.813V201.951C112.202 204.228 112.527 205.203 112.852 205.203C113.177 205.203 113.503 205.203 113.828 205.203C114.153 205.203 114.478 205.203 114.803 205.203C116.429 205.203 117.08 205.854 117.08 207.155V209.431C115.779 209.756 114.478 210.081 113.177 210.081C112.852 210.081 112.527 210.081 112.202 210.081C110.576 210.081 109.275 209.431 108.299 208.13C107.324 206.829 106.998 204.878 106.998 201.951V178.537H107.649Z" fill="#8438FA"/>
+<path d="M130.413 186.667C131.064 186.667 131.714 186.992 132.039 187.317C132.364 187.642 132.69 188.293 132.69 188.943V191.22H125.21V207.48C125.21 208.13 124.885 208.781 124.559 209.106C124.234 209.431 123.584 209.756 122.933 209.756H120.657V191.22H120.007C119.356 191.22 118.706 190.894 118.381 190.569C117.73 189.919 117.73 189.594 117.73 188.943V186.667H120.657C120.657 183.415 121.633 181.463 123.259 180.163C124.559 178.862 127.161 178.537 130.088 178.537C131.389 178.537 133.015 178.862 134.966 179.187V181.463C134.966 182.764 134.316 183.415 132.69 183.415C131.714 183.415 131.064 183.089 130.413 183.089C128.787 183.089 127.486 183.415 126.836 183.74C126.185 184.39 125.535 185.366 125.535 186.992H130.413V186.667Z" fill="#8438FA"/>
+<path d="M137.242 200.325C136.592 200.325 136.267 200 135.616 199.675C135.291 199.35 135.291 198.699 135.291 198.049V196.423H147.324C147.974 196.423 148.299 196.748 148.95 197.073C149.275 197.398 149.275 198.049 149.275 198.699V200.325H137.242Z" fill="#8438FA"/>
+</g>
+<defs>
+<clipPath id="clip0_2044_7907">
+<rect width="400" height="299" fill="white" transform="translate(0.656738)"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/img/mdcb/mdcb-acme-global-bank1.png b/img/mdcb/mdcb-acme-global-bank1.png
new file mode 100644
index 0000000000..28fdb90aa1
Binary files /dev/null and b/img/mdcb/mdcb-acme-global-bank1.png differ
diff --git a/img/mdcb/mdcb-acme-global-bank2.png b/img/mdcb/mdcb-acme-global-bank2.png
new file mode 100644
index 0000000000..0aecd13a56
Binary files /dev/null and b/img/mdcb/mdcb-acme-global-bank2.png differ
diff --git a/img/mdcb/mdcb-acme-telecoms1.png b/img/mdcb/mdcb-acme-telecoms1.png
new file mode 100644
index 0000000000..46655627ea
Binary files /dev/null and b/img/mdcb/mdcb-acme-telecoms1.png differ
diff --git a/img/mdcb/mdcb-acme-telecoms2.png b/img/mdcb/mdcb-acme-telecoms2.png
new file mode 100644
index 0000000000..d43ff76129
Binary files /dev/null and b/img/mdcb/mdcb-acme-telecoms2.png differ
diff --git a/img/mdcb/mdcb-components.png b/img/mdcb/mdcb-components.png
new file mode 100644
index 0000000000..dfa5c6f0ae
Binary files /dev/null and b/img/mdcb/mdcb-components.png differ
diff --git a/img/mdcb/mdcb-control-plane.png b/img/mdcb/mdcb-control-plane.png
new file mode 100644
index 0000000000..27d34fba08
Binary files /dev/null and b/img/mdcb/mdcb-control-plane.png differ
diff --git a/img/mdcb/mdcb-data-plane.png b/img/mdcb/mdcb-data-plane.png
new file mode 100644
index 0000000000..bfcb8921ff
Binary files /dev/null and b/img/mdcb/mdcb-data-plane.png differ
diff --git a/img/mdcb/mdcb-intro1.png b/img/mdcb/mdcb-intro1.png
new file mode 100644
index 0000000000..b83399a65c
Binary files /dev/null and b/img/mdcb/mdcb-intro1.png differ
diff --git a/img/mdcb/mdcb-intro2.png b/img/mdcb/mdcb-intro2.png
new file mode 100644
index 0000000000..9dfe012a64
Binary files /dev/null and b/img/mdcb/mdcb-intro2.png differ
diff --git a/img/mdcb/mdcb-intro3.png b/img/mdcb/mdcb-intro3.png
new file mode 100644
index 0000000000..0d224ee6e1
Binary files /dev/null and b/img/mdcb/mdcb-intro3.png differ
diff --git a/img/mdcb/mdcb-intro4.png b/img/mdcb/mdcb-intro4.png
new file mode 100644
index 0000000000..77f6c4c482
Binary files /dev/null and b/img/mdcb/mdcb-intro4.png differ
diff --git a/img/mdcb/mdcb-poc1-screenshot1.png b/img/mdcb/mdcb-poc1-screenshot1.png
new file mode 100644
index 0000000000..a95b7fe75a
Binary files /dev/null and b/img/mdcb/mdcb-poc1-screenshot1.png differ
diff --git a/img/mdcb/mdcb-poc1-screenshot2.png b/img/mdcb/mdcb-poc1-screenshot2.png
new file mode 100644
index 0000000000..f3f22da9f6
Binary files /dev/null and b/img/mdcb/mdcb-poc1-screenshot2.png differ
diff --git a/img/mdcb/mdcb-poc1-screenshot3.png b/img/mdcb/mdcb-poc1-screenshot3.png
new file mode 100644
index 0000000000..46e700def1
Binary files /dev/null and b/img/mdcb/mdcb-poc1-screenshot3.png differ
diff --git a/img/mdcb/mdcb-poc1-screenshot4.png b/img/mdcb/mdcb-poc1-screenshot4.png
new file mode 100644
index 0000000000..f6d4f0874d
Binary files /dev/null and b/img/mdcb/mdcb-poc1-screenshot4.png differ
diff --git a/img/mdcb/mdcb-poc1-screenshot5.png b/img/mdcb/mdcb-poc1-screenshot5.png
new file mode 100644
index 0000000000..d22219a34b
Binary files /dev/null and b/img/mdcb/mdcb-poc1-screenshot5.png differ
diff --git a/img/mdcb/mdcb-poc1-screenshot6.png b/img/mdcb/mdcb-poc1-screenshot6.png
new file mode 100644
index 0000000000..0582da5ba3
Binary files /dev/null and b/img/mdcb/mdcb-poc1-screenshot6.png differ
diff --git a/img/mdcb/mdcb-poc1-screenshot7.png b/img/mdcb/mdcb-poc1-screenshot7.png
new file mode 100644
index 0000000000..5b0a2443d0
Binary files /dev/null and b/img/mdcb/mdcb-poc1-screenshot7.png differ
diff --git a/img/mdcb/mdcb-poc1-screenshot8.png b/img/mdcb/mdcb-poc1-screenshot8.png
new file mode 100644
index 0000000000..97a31e1c39
Binary files /dev/null and b/img/mdcb/mdcb-poc1-screenshot8.png differ
diff --git a/img/mdcb/mdcb_poc1_overview.png b/img/mdcb/mdcb_poc1_overview.png
new file mode 100644
index 0000000000..d30f7be22f
Binary files /dev/null and b/img/mdcb/mdcb_poc1_overview.png differ
diff --git a/img/mdcb/synchroniser-after.gif b/img/mdcb/synchroniser-after.gif
new file mode 100644
index 0000000000..1e5b569d5a
Binary files /dev/null and b/img/mdcb/synchroniser-after.gif differ
diff --git a/img/mdcb/synchroniser-before.gif b/img/mdcb/synchroniser-before.gif
new file mode 100644
index 0000000000..5400138993
Binary files /dev/null and b/img/mdcb/synchroniser-before.gif differ
diff --git a/img/oas/add-new-api.png b/img/oas/add-new-api.png
new file mode 100644
index 0000000000..10e9a1f964
Binary files /dev/null and b/img/oas/add-new-api.png differ
diff --git a/img/oas/api-actions-menu.png b/img/oas/api-actions-menu.png
new file mode 100644
index 0000000000..f9e62b326b
Binary files /dev/null and b/img/oas/api-actions-menu.png differ
diff --git a/img/oas/api-create-deploy-targets.png b/img/oas/api-create-deploy-targets.png
new file mode 100644
index 0000000000..a8e6be71e0
Binary files /dev/null and b/img/oas/api-create-deploy-targets.png differ
diff --git a/img/oas/api-create-endpoint-list.png b/img/oas/api-create-endpoint-list.png
new file mode 100644
index 0000000000..ed1829ee3b
Binary files /dev/null and b/img/oas/api-create-endpoint-list.png differ
diff --git a/img/oas/api-create-endpoint.png b/img/oas/api-create-endpoint.png
new file mode 100644
index 0000000000..acea4dd8c9
Binary files /dev/null and b/img/oas/api-create-endpoint.png differ
diff --git a/img/oas/api-create-import-auto-options.png b/img/oas/api-create-import-auto-options.png
new file mode 100644
index 0000000000..3aa70edd62
Binary files /dev/null and b/img/oas/api-create-import-auto-options.png differ
diff --git a/img/oas/api-create-import-location.png b/img/oas/api-create-import-location.png
new file mode 100644
index 0000000000..f0d1f5fc19
Binary files /dev/null and b/img/oas/api-create-import-location.png differ
diff --git a/img/oas/api-create-import-manual-options.png b/img/oas/api-create-import-manual-options.png
new file mode 100644
index 0000000000..eaf12ede2c
Binary files /dev/null and b/img/oas/api-create-import-manual-options.png differ
diff --git a/img/oas/api-create-import-template.png b/img/oas/api-create-import-template.png
new file mode 100644
index 0000000000..cd0a8efb04
Binary files /dev/null and b/img/oas/api-create-import-template.png differ
diff --git a/img/oas/api-create-import-tykapi.png b/img/oas/api-create-import-tykapi.png
new file mode 100644
index 0000000000..021d5236a4
Binary files /dev/null and b/img/oas/api-create-import-tykapi.png differ
diff --git a/img/oas/api-create-import.png b/img/oas/api-create-import.png
new file mode 100644
index 0000000000..31139d1a5b
Binary files /dev/null and b/img/oas/api-create-import.png differ
diff --git a/img/oas/api-create-no-endpoints.png b/img/oas/api-create-no-endpoints.png
new file mode 100644
index 0000000000..35afff6530
Binary files /dev/null and b/img/oas/api-create-no-endpoints.png differ
diff --git a/img/oas/api-create-set-status.png b/img/oas/api-create-set-status.png
new file mode 100644
index 0000000000..2c95cfc2f6
Binary files /dev/null and b/img/oas/api-create-set-status.png differ
diff --git a/img/oas/api-create-stepper.png b/img/oas/api-create-stepper.png
new file mode 100644
index 0000000000..d202f60cb5
Binary files /dev/null and b/img/oas/api-create-stepper.png differ
diff --git a/img/oas/api-export-options.png b/img/oas/api-export-options.png
new file mode 100644
index 0000000000..359d29c665
Binary files /dev/null and b/img/oas/api-export-options.png differ
diff --git a/img/oas/api-menu.png b/img/oas/api-menu.png
new file mode 100644
index 0000000000..1ca153a87b
Binary files /dev/null and b/img/oas/api-menu.png differ
diff --git a/img/oas/api-update-options.png b/img/oas/api-update-options.png
new file mode 100644
index 0000000000..3ee3298b4c
Binary files /dev/null and b/img/oas/api-update-options.png differ
diff --git a/img/oas/diagram_oas-flow-2.png b/img/oas/diagram_oas-flow-2.png
new file mode 100644
index 0000000000..8e6b3898ef
Binary files /dev/null and b/img/oas/diagram_oas-flow-2.png differ
diff --git a/img/oas/import-api-button.png b/img/oas/import-api-button.png
new file mode 100644
index 0000000000..a9e8d4c68d
Binary files /dev/null and b/img/oas/import-api-button.png differ
diff --git a/img/oas/import-api-version-config.png b/img/oas/import-api-version-config.png
new file mode 100644
index 0000000000..43f4d92003
Binary files /dev/null and b/img/oas/import-api-version-config.png differ
diff --git a/img/oas/import-api-version.png b/img/oas/import-api-version.png
new file mode 100644
index 0000000000..c4029c600c
Binary files /dev/null and b/img/oas/import-api-version.png differ
diff --git a/img/oas/oas-2-code.png b/img/oas/oas-2-code.png
new file mode 100644
index 0000000000..cf96e39e36
Binary files /dev/null and b/img/oas/oas-2-code.png differ
diff --git a/img/oas/open-api-format.png b/img/oas/open-api-format.png
new file mode 100644
index 0000000000..0462bc18c2
Binary files /dev/null and b/img/oas/open-api-format.png differ
diff --git a/img/oas/response.png b/img/oas/response.png
new file mode 100644
index 0000000000..3d22dfdac3
Binary files /dev/null and b/img/oas/response.png differ
diff --git a/img/oas/status.png b/img/oas/status.png
new file mode 100644
index 0000000000..da9c41ddbc
Binary files /dev/null and b/img/oas/status.png differ
diff --git a/img/oas/upstream-url.png b/img/oas/upstream-url.png
new file mode 100644
index 0000000000..9fc44affef
Binary files /dev/null and b/img/oas/upstream-url.png differ
diff --git a/img/oas/version-endpoints.png b/img/oas/version-endpoints.png
new file mode 100644
index 0000000000..d8c8144ac6
Binary files /dev/null and b/img/oas/version-endpoints.png differ
diff --git a/img/observability/grafana-logs.png b/img/observability/grafana-logs.png
new file mode 100644
index 0000000000..040e51d0f3
Binary files /dev/null and b/img/observability/grafana-logs.png differ
diff --git a/img/observability/grafana-metrics.png b/img/observability/grafana-metrics.png
new file mode 100644
index 0000000000..4dc6091628
Binary files /dev/null and b/img/observability/grafana-metrics.png differ
diff --git a/img/observability/grafana-traces.png b/img/observability/grafana-traces.png
new file mode 100644
index 0000000000..72b0161d56
Binary files /dev/null and b/img/observability/grafana-traces.png differ
diff --git a/img/observability/tyk-observability.png b/img/observability/tyk-observability.png
new file mode 100644
index 0000000000..bcf46a3264
Binary files /dev/null and b/img/observability/tyk-observability.png differ
diff --git a/img/observability/tyk-otel-tracing.png b/img/observability/tyk-otel-tracing.png
new file mode 100644
index 0000000000..d9f147821e
Binary files /dev/null and b/img/observability/tyk-otel-tracing.png differ
diff --git a/img/observability/tyk-prometheus-diagram.png b/img/observability/tyk-prometheus-diagram.png
new file mode 100644
index 0000000000..54e39058ad
Binary files /dev/null and b/img/observability/tyk-prometheus-diagram.png differ
diff --git a/img/okta-sso/Okta-create-app.png b/img/okta-sso/Okta-create-app.png
new file mode 100644
index 0000000000..4a970ce406
Binary files /dev/null and b/img/okta-sso/Okta-create-app.png differ
diff --git a/img/okta-sso/okta-bad-request-wrong-callback.png b/img/okta-sso/okta-bad-request-wrong-callback.png
new file mode 100644
index 0000000000..f7de39372d
Binary files /dev/null and b/img/okta-sso/okta-bad-request-wrong-callback.png differ
diff --git a/img/okta-sso/okta-mfa-download-google-authenticator-2.png b/img/okta-sso/okta-mfa-download-google-authenticator-2.png
new file mode 100644
index 0000000000..d371795aa2
Binary files /dev/null and b/img/okta-sso/okta-mfa-download-google-authenticator-2.png differ
diff --git a/img/okta-sso/okta-mfa-google-auth-approved-3.png b/img/okta-sso/okta-mfa-google-auth-approved-3.png
new file mode 100644
index 0000000000..ac32777d26
Binary files /dev/null and b/img/okta-sso/okta-mfa-google-auth-approved-3.png differ
diff --git a/img/okta-sso/okta-mfa-setup-1.png b/img/okta-sso/okta-mfa-setup-1.png
new file mode 100644
index 0000000000..cd9f54f848
Binary files /dev/null and b/img/okta-sso/okta-mfa-setup-1.png differ
diff --git a/img/operator/tyk-api-ownership.svg b/img/operator/tyk-api-ownership.svg
new file mode 100644
index 0000000000..0b1d4d210c
--- /dev/null
+++ b/img/operator/tyk-api-ownership.svg
@@ -0,0 +1,423 @@
+<svg width="1771" height="1819" viewBox="0 0 1771 1819" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M695.784 827.54V821.091H697.46V832H695.784V830.153H695.67C695.415 830.707 695.017 831.179 694.477 831.567C693.938 831.95 693.256 832.142 692.432 832.142C691.75 832.142 691.144 831.993 690.614 831.695C690.083 831.392 689.667 830.937 689.364 830.331C689.061 829.72 688.909 828.951 688.909 828.023V821.091H690.585V827.909C690.585 828.705 690.808 829.339 691.253 829.812C691.703 830.286 692.276 830.523 692.972 830.523C693.388 830.523 693.812 830.416 694.243 830.203C694.679 829.99 695.043 829.663 695.337 829.223C695.635 828.783 695.784 828.222 695.784 827.54ZM708.257 823.534L706.752 823.96C706.657 823.709 706.517 823.465 706.333 823.229C706.153 822.987 705.907 822.788 705.594 822.632C705.282 822.476 704.882 822.398 704.394 822.398C703.726 822.398 703.17 822.552 702.725 822.859C702.284 823.162 702.064 823.548 702.064 824.017C702.064 824.434 702.216 824.763 702.519 825.004C702.822 825.246 703.295 825.447 703.939 825.608L705.559 826.006C706.534 826.242 707.261 826.605 707.739 827.092C708.217 827.575 708.456 828.198 708.456 828.96C708.456 829.585 708.276 830.144 707.917 830.636C707.561 831.129 707.064 831.517 706.425 831.801C705.786 832.085 705.042 832.227 704.195 832.227C703.082 832.227 702.161 831.986 701.432 831.503C700.703 831.02 700.241 830.314 700.047 829.386L701.638 828.989C701.79 829.576 702.076 830.016 702.498 830.31C702.924 830.603 703.48 830.75 704.167 830.75C704.948 830.75 705.568 830.584 706.027 830.253C706.491 829.917 706.723 829.514 706.723 829.045C706.723 828.667 706.591 828.349 706.326 828.094C706.06 827.833 705.653 827.639 705.104 827.511L703.286 827.085C702.287 826.848 701.553 826.482 701.084 825.984C700.62 825.482 700.388 824.855 700.388 824.102C700.388 823.487 700.561 822.942 700.907 822.469C701.257 821.995 701.733 821.624 702.334 821.354C702.94 821.084 703.627 820.949 704.394 820.949C705.473 820.949 706.321 821.186 706.936 821.659C707.557 822.133 707.997 822.758 708.257 823.534ZM710.979 832V821.091H712.656V832H710.979ZM711.832 819.273C711.505 819.273 711.223 819.161 710.987 818.939C710.754 818.716 710.638 818.449 710.638 818.136C710.638 817.824 710.754 817.556 710.987 817.334C711.223 817.111 711.505 817 711.832 817C712.158 817 712.438 817.111 712.67 817.334C712.906 817.556 713.025 817.824 713.025 818.136C713.025 818.449 712.906 818.716 712.67 818.939C712.438 819.161 712.158 819.273 711.832 819.273ZM717.402 825.438V832H715.725V821.091H717.345V822.795H717.487C717.743 822.241 718.131 821.796 718.652 821.46C719.172 821.119 719.845 820.949 720.669 820.949C721.407 820.949 722.054 821.1 722.608 821.403C723.162 821.702 723.592 822.156 723.9 822.767C724.208 823.373 724.362 824.14 724.362 825.068V832H722.686V825.182C722.686 824.325 722.463 823.657 722.018 823.179C721.573 822.696 720.962 822.455 720.186 822.455C719.651 822.455 719.172 822.571 718.751 822.803C718.334 823.035 718.005 823.373 717.764 823.818C717.522 824.263 717.402 824.803 717.402 825.438ZM731.828 836.318C731.018 836.318 730.322 836.214 729.74 836.006C729.158 835.802 728.672 835.532 728.284 835.196C727.901 834.865 727.595 834.509 727.368 834.131L728.703 833.193C728.855 833.392 729.046 833.619 729.278 833.875C729.51 834.135 729.828 834.36 730.23 834.55C730.637 834.744 731.17 834.841 731.828 834.841C732.709 834.841 733.436 834.628 734.009 834.202C734.581 833.776 734.868 833.108 734.868 832.199V829.983H734.726C734.603 830.182 734.428 830.428 734.2 830.722C733.978 831.01 733.656 831.268 733.234 831.496C732.818 831.718 732.254 831.83 731.544 831.83C730.663 831.83 729.873 831.621 729.172 831.205C728.476 830.788 727.924 830.182 727.517 829.386C727.115 828.591 726.913 827.625 726.913 826.489C726.913 825.371 727.11 824.398 727.503 823.57C727.896 822.736 728.443 822.092 729.143 821.638C729.844 821.179 730.654 820.949 731.572 820.949C732.283 820.949 732.846 821.067 733.263 821.304C733.684 821.536 734.006 821.801 734.229 822.099C734.456 822.393 734.631 822.634 734.754 822.824H734.925V821.091H736.544V832.312C736.544 833.25 736.331 834.012 735.905 834.599C735.483 835.191 734.915 835.625 734.2 835.899C733.49 836.179 732.699 836.318 731.828 836.318ZM731.771 830.324C732.444 830.324 733.012 830.17 733.476 829.862C733.94 829.554 734.293 829.112 734.534 828.534C734.776 827.956 734.896 827.265 734.896 826.46C734.896 825.674 734.778 824.981 734.541 824.379C734.304 823.778 733.954 823.307 733.49 822.966C733.026 822.625 732.453 822.455 731.771 822.455C731.061 822.455 730.469 822.634 729.996 822.994C729.527 823.354 729.174 823.837 728.938 824.443C728.705 825.049 728.589 825.722 728.589 826.46C728.589 827.218 728.708 827.888 728.945 828.47C729.186 829.048 729.541 829.502 730.01 829.834C730.483 830.161 731.071 830.324 731.771 830.324ZM757.737 824.727C757.737 826.261 757.46 827.587 756.906 828.705C756.352 829.822 755.592 830.684 754.626 831.29C753.661 831.896 752.557 832.199 751.317 832.199C750.076 832.199 748.973 831.896 748.007 831.29C747.041 830.684 746.281 829.822 745.727 828.705C745.173 827.587 744.896 826.261 744.896 824.727C744.896 823.193 745.173 821.867 745.727 820.75C746.281 819.633 747.041 818.771 748.007 818.165C748.973 817.559 750.076 817.256 751.317 817.256C752.557 817.256 753.661 817.559 754.626 818.165C755.592 818.771 756.352 819.633 756.906 820.75C757.46 821.867 757.737 823.193 757.737 824.727ZM756.033 824.727C756.033 823.468 755.822 822.405 755.401 821.538C754.984 820.672 754.418 820.016 753.703 819.571C752.993 819.126 752.197 818.903 751.317 818.903C750.436 818.903 749.638 819.126 748.923 819.571C748.213 820.016 747.647 820.672 747.226 821.538C746.809 822.405 746.601 823.468 746.601 824.727C746.601 825.987 746.809 827.05 747.226 827.916C747.647 828.783 748.213 829.438 748.923 829.884C749.638 830.329 750.436 830.551 751.317 830.551C752.197 830.551 752.993 830.329 753.703 829.884C754.418 829.438 754.984 828.783 755.401 827.916C755.822 827.05 756.033 825.987 756.033 824.727ZM760.472 836.091V821.091H762.091V822.824H762.29C762.413 822.634 762.583 822.393 762.801 822.099C763.024 821.801 763.341 821.536 763.753 821.304C764.17 821.067 764.733 820.949 765.443 820.949C766.362 820.949 767.171 821.179 767.872 821.638C768.573 822.097 769.12 822.748 769.513 823.591C769.906 824.434 770.102 825.428 770.102 826.574C770.102 827.729 769.906 828.731 769.513 829.578C769.12 830.421 768.575 831.074 767.879 831.538C767.183 831.998 766.381 832.227 765.472 832.227C764.771 832.227 764.21 832.111 763.788 831.879C763.367 831.643 763.043 831.375 762.815 831.077C762.588 830.774 762.413 830.523 762.29 830.324H762.148V836.091H760.472ZM762.119 826.545C762.119 827.369 762.24 828.096 762.482 828.726C762.723 829.351 763.076 829.841 763.54 830.196C764.004 830.546 764.572 830.722 765.244 830.722C765.945 830.722 766.53 830.537 766.999 830.168C767.472 829.794 767.827 829.292 768.064 828.662C768.305 828.027 768.426 827.322 768.426 826.545C768.426 825.778 768.308 825.087 768.071 824.472C767.839 823.851 767.486 823.361 767.013 823.001C766.544 822.637 765.955 822.455 765.244 822.455C764.563 822.455 763.99 822.627 763.526 822.973C763.062 823.314 762.711 823.792 762.474 824.408C762.238 825.018 762.119 825.731 762.119 826.545ZM777.233 832.227C776.182 832.227 775.275 831.995 774.513 831.531C773.755 831.062 773.17 830.409 772.759 829.571C772.351 828.728 772.148 827.748 772.148 826.631C772.148 825.513 772.351 824.528 772.759 823.676C773.17 822.819 773.743 822.152 774.477 821.673C775.216 821.19 776.078 820.949 777.062 820.949C777.631 820.949 778.192 821.044 778.746 821.233C779.3 821.422 779.804 821.73 780.259 822.156C780.713 822.578 781.075 823.136 781.345 823.832C781.615 824.528 781.75 825.385 781.75 826.403V827.114H773.341V825.665H780.045C780.045 825.049 779.922 824.5 779.676 824.017C779.435 823.534 779.089 823.153 778.639 822.874C778.194 822.594 777.669 822.455 777.062 822.455C776.395 822.455 775.817 822.62 775.33 822.952C774.847 823.278 774.475 823.705 774.214 824.23C773.954 824.756 773.824 825.319 773.824 825.92V826.886C773.824 827.71 773.966 828.409 774.25 828.982C774.539 829.55 774.939 829.983 775.45 830.281C775.962 830.575 776.556 830.722 777.233 830.722C777.673 830.722 778.071 830.66 778.426 830.537C778.786 830.409 779.096 830.22 779.357 829.969C779.617 829.713 779.818 829.396 779.96 829.017L781.58 829.472C781.409 830.021 781.123 830.504 780.72 830.92C780.318 831.332 779.821 831.654 779.229 831.886C778.637 832.114 777.972 832.227 777.233 832.227ZM784.3 832V821.091H785.919V822.739H786.033C786.232 822.199 786.591 821.761 787.112 821.425C787.633 821.089 788.22 820.92 788.874 820.92C788.997 820.92 789.151 820.923 789.335 820.928C789.52 820.932 789.66 820.939 789.754 820.949V822.653C789.697 822.639 789.567 822.618 789.364 822.589C789.165 822.556 788.954 822.54 788.732 822.54C788.201 822.54 787.728 822.651 787.311 822.874C786.899 823.091 786.572 823.394 786.331 823.783C786.094 824.166 785.976 824.604 785.976 825.097V832H784.3ZM794.951 832.256C794.26 832.256 793.633 832.125 793.069 831.865C792.506 831.6 792.058 831.219 791.727 830.722C791.395 830.22 791.23 829.614 791.23 828.903C791.23 828.278 791.353 827.772 791.599 827.384C791.845 826.991 792.174 826.683 792.586 826.46C792.998 826.238 793.453 826.072 793.95 825.963C794.452 825.849 794.956 825.759 795.463 825.693C796.126 825.608 796.663 825.544 797.075 825.501C797.492 825.454 797.795 825.376 797.984 825.267C798.178 825.158 798.275 824.969 798.275 824.699V824.642C798.275 823.941 798.083 823.397 797.7 823.009C797.321 822.62 796.746 822.426 795.974 822.426C795.174 822.426 794.547 822.601 794.092 822.952C793.637 823.302 793.318 823.676 793.133 824.074L791.542 823.506C791.826 822.843 792.205 822.327 792.679 821.957C793.157 821.583 793.678 821.323 794.241 821.176C794.809 821.025 795.368 820.949 795.917 820.949C796.268 820.949 796.67 820.991 797.125 821.077C797.584 821.157 798.027 821.325 798.453 821.581C798.884 821.837 799.241 822.223 799.525 822.739C799.809 823.255 799.951 823.946 799.951 824.812V832H798.275V830.523H798.19C798.076 830.759 797.887 831.013 797.622 831.283C797.357 831.553 797.004 831.782 796.564 831.972C796.123 832.161 795.586 832.256 794.951 832.256ZM795.207 830.75C795.87 830.75 796.429 830.62 796.883 830.359C797.342 830.099 797.688 829.763 797.92 829.351C798.157 828.939 798.275 828.506 798.275 828.051V826.517C798.204 826.602 798.048 826.68 797.806 826.751C797.57 826.818 797.295 826.877 796.983 826.929C796.675 826.976 796.374 827.019 796.081 827.057C795.792 827.09 795.557 827.118 795.377 827.142C794.942 827.199 794.535 827.291 794.156 827.419C793.782 827.542 793.479 827.729 793.247 827.98C793.02 828.226 792.906 828.562 792.906 828.989C792.906 829.571 793.121 830.011 793.552 830.31C793.988 830.603 794.539 830.75 795.207 830.75ZM807.755 821.091V822.511H802.102V821.091H807.755ZM803.749 818.477H805.425V828.875C805.425 829.348 805.494 829.704 805.631 829.94C805.773 830.172 805.953 830.329 806.171 830.409C806.394 830.485 806.628 830.523 806.874 830.523C807.059 830.523 807.21 830.513 807.329 830.494C807.447 830.471 807.542 830.452 807.613 830.438L807.954 831.943C807.84 831.986 807.682 832.028 807.478 832.071C807.274 832.118 807.016 832.142 806.704 832.142C806.23 832.142 805.766 832.04 805.312 831.837C804.862 831.633 804.488 831.323 804.19 830.906C803.896 830.49 803.749 829.964 803.749 829.33V818.477ZM814.591 832.227C813.606 832.227 812.742 831.993 811.999 831.524C811.26 831.055 810.682 830.4 810.266 829.557C809.854 828.714 809.648 827.729 809.648 826.602C809.648 825.466 809.854 824.474 810.266 823.626C810.682 822.779 811.26 822.121 811.999 821.652C812.742 821.183 813.606 820.949 814.591 820.949C815.576 820.949 816.438 821.183 817.176 821.652C817.92 822.121 818.497 822.779 818.909 823.626C819.326 824.474 819.534 825.466 819.534 826.602C819.534 827.729 819.326 828.714 818.909 829.557C818.497 830.4 817.92 831.055 817.176 831.524C816.438 831.993 815.576 832.227 814.591 832.227ZM814.591 830.722C815.339 830.722 815.955 830.53 816.438 830.146C816.92 829.763 817.278 829.259 817.51 828.634C817.742 828.009 817.858 827.331 817.858 826.602C817.858 825.873 817.742 825.194 817.51 824.564C817.278 823.934 816.92 823.425 816.438 823.037C815.955 822.649 815.339 822.455 814.591 822.455C813.843 822.455 813.227 822.649 812.744 823.037C812.261 823.425 811.904 823.934 811.672 824.564C811.44 825.194 811.324 825.873 811.324 826.602C811.324 827.331 811.44 828.009 811.672 828.634C811.904 829.259 812.261 829.763 812.744 830.146C813.227 830.53 813.843 830.722 814.591 830.722ZM822.093 832V821.091H823.712V822.739H823.826C824.025 822.199 824.384 821.761 824.905 821.425C825.426 821.089 826.013 820.92 826.667 820.92C826.79 820.92 826.944 820.923 827.128 820.928C827.313 820.932 827.453 820.939 827.547 820.949V822.653C827.49 822.639 827.36 822.618 827.157 822.589C826.958 822.556 826.747 822.54 826.525 822.54C825.994 822.54 825.521 822.651 825.104 822.874C824.692 823.091 824.365 823.394 824.124 823.783C823.887 824.166 823.769 824.604 823.769 825.097V832H822.093ZM680.021 852H678.259C678.155 851.493 677.973 851.048 677.712 850.665C677.457 850.281 677.144 849.959 676.775 849.699C676.41 849.434 676.005 849.235 675.56 849.102C675.115 848.97 674.651 848.903 674.168 848.903C673.288 848.903 672.49 849.126 671.775 849.571C671.065 850.016 670.499 850.672 670.077 851.538C669.661 852.405 669.452 853.468 669.452 854.727C669.452 855.987 669.661 857.05 670.077 857.916C670.499 858.783 671.065 859.438 671.775 859.884C672.49 860.329 673.288 860.551 674.168 860.551C674.651 860.551 675.115 860.485 675.56 860.352C676.005 860.22 676.41 860.023 676.775 859.763C677.144 859.498 677.457 859.173 677.712 858.79C677.973 858.402 678.155 857.956 678.259 857.455H680.021C679.888 858.198 679.647 858.863 679.296 859.45C678.946 860.037 678.51 860.537 677.989 860.949C677.469 861.356 676.884 861.666 676.235 861.879C675.591 862.092 674.902 862.199 674.168 862.199C672.928 862.199 671.825 861.896 670.859 861.29C669.893 860.684 669.133 859.822 668.579 858.705C668.025 857.587 667.748 856.261 667.748 854.727C667.748 853.193 668.025 851.867 668.579 850.75C669.133 849.633 669.893 848.771 670.859 848.165C671.825 847.559 672.928 847.256 674.168 847.256C674.902 847.256 675.591 847.362 676.235 847.575C676.884 847.788 677.469 848.101 677.989 848.513C678.51 848.92 678.946 849.417 679.296 850.004C679.647 850.587 679.888 851.252 680.021 852ZM687.071 862.227C686.087 862.227 685.222 861.993 684.479 861.524C683.74 861.055 683.163 860.4 682.746 859.557C682.334 858.714 682.128 857.729 682.128 856.602C682.128 855.466 682.334 854.474 682.746 853.626C683.163 852.779 683.74 852.121 684.479 851.652C685.222 851.183 686.087 850.949 687.071 850.949C688.056 850.949 688.918 851.183 689.657 851.652C690.4 852.121 690.978 852.779 691.39 853.626C691.806 854.474 692.015 855.466 692.015 856.602C692.015 857.729 691.806 858.714 691.39 859.557C690.978 860.4 690.4 861.055 689.657 861.524C688.918 861.993 688.056 862.227 687.071 862.227ZM687.071 860.722C687.819 860.722 688.435 860.53 688.918 860.146C689.401 859.763 689.758 859.259 689.99 858.634C690.222 858.009 690.338 857.331 690.338 856.602C690.338 855.873 690.222 855.194 689.99 854.564C689.758 853.934 689.401 853.425 688.918 853.037C688.435 852.649 687.819 852.455 687.071 852.455C686.323 852.455 685.708 852.649 685.225 853.037C684.742 853.425 684.384 853.934 684.152 854.564C683.92 855.194 683.804 855.873 683.804 856.602C683.804 857.331 683.92 858.009 684.152 858.634C684.384 859.259 684.742 859.763 685.225 860.146C685.708 860.53 686.323 860.722 687.071 860.722ZM696.249 855.438V862H694.573V851.091H696.192V852.795H696.335C696.59 852.241 696.978 851.796 697.499 851.46C698.02 851.119 698.692 850.949 699.516 850.949C700.255 850.949 700.901 851.1 701.455 851.403C702.009 851.702 702.44 852.156 702.748 852.767C703.056 853.373 703.21 854.14 703.21 855.068V862H701.533V855.182C701.533 854.325 701.311 853.657 700.866 853.179C700.421 852.696 699.81 852.455 699.033 852.455C698.498 852.455 698.02 852.571 697.599 852.803C697.182 853.035 696.853 853.373 696.612 853.818C696.37 854.263 696.249 854.803 696.249 855.438ZM711.017 851.091V852.511H705.363V851.091H711.017ZM707.011 848.477H708.687V858.875C708.687 859.348 708.756 859.704 708.893 859.94C709.035 860.172 709.215 860.329 709.433 860.409C709.655 860.485 709.89 860.523 710.136 860.523C710.321 860.523 710.472 860.513 710.591 860.494C710.709 860.471 710.804 860.452 710.875 860.438L711.216 861.943C711.102 861.986 710.943 862.028 710.74 862.071C710.536 862.118 710.278 862.142 709.966 862.142C709.492 862.142 709.028 862.04 708.574 861.837C708.124 861.633 707.75 861.323 707.451 860.906C707.158 860.49 707.011 859.964 707.011 859.33V848.477ZM717.995 862.227C716.944 862.227 716.037 861.995 715.275 861.531C714.517 861.062 713.932 860.409 713.52 859.571C713.113 858.728 712.909 857.748 712.909 856.631C712.909 855.513 713.113 854.528 713.52 853.676C713.932 852.819 714.505 852.152 715.239 851.673C715.978 851.19 716.839 850.949 717.824 850.949C718.392 850.949 718.953 851.044 719.507 851.233C720.061 851.422 720.566 851.73 721.02 852.156C721.475 852.578 721.837 853.136 722.107 853.832C722.377 854.528 722.512 855.385 722.512 856.403V857.114H714.103V855.665H720.807C720.807 855.049 720.684 854.5 720.438 854.017C720.196 853.534 719.851 853.153 719.401 852.874C718.956 852.594 718.43 852.455 717.824 852.455C717.157 852.455 716.579 852.62 716.091 852.952C715.608 853.278 715.237 853.705 714.976 854.23C714.716 854.756 714.586 855.319 714.586 855.92V856.886C714.586 857.71 714.728 858.409 715.012 858.982C715.301 859.55 715.701 859.983 716.212 860.281C716.723 860.575 717.318 860.722 717.995 860.722C718.435 860.722 718.833 860.66 719.188 860.537C719.548 860.409 719.858 860.22 720.118 859.969C720.379 859.713 720.58 859.396 720.722 859.017L722.341 859.472C722.171 860.021 721.884 860.504 721.482 860.92C721.079 861.332 720.582 861.654 719.99 861.886C719.399 862.114 718.733 862.227 717.995 862.227ZM726.018 851.091L728.632 855.551L731.246 851.091H733.178L729.655 856.545L733.178 862H731.246L728.632 857.767L726.018 862H724.087L727.553 856.545L724.087 851.091H726.018ZM740.314 851.091V852.511H734.66V851.091H740.314ZM736.308 848.477H737.984V858.875C737.984 859.348 738.053 859.704 738.19 859.94C738.332 860.172 738.512 860.329 738.73 860.409C738.952 860.485 739.187 860.523 739.433 860.523C739.618 860.523 739.769 860.513 739.887 860.494C740.006 860.471 740.1 860.452 740.172 860.438L740.512 861.943C740.399 861.986 740.24 862.028 740.037 862.071C739.833 862.118 739.575 862.142 739.262 862.142C738.789 862.142 738.325 862.04 737.87 861.837C737.421 861.633 737.047 861.323 736.748 860.906C736.455 860.49 736.308 859.964 736.308 859.33V848.477ZM753.545 847.455V862H751.784V849.301H751.699L748.147 851.659V849.869L751.784 847.455H753.545ZM766.592 862.256C765.901 862.256 765.273 862.125 764.71 861.865C764.146 861.6 763.699 861.219 763.368 860.722C763.036 860.22 762.87 859.614 762.87 858.903C762.87 858.278 762.993 857.772 763.24 857.384C763.486 856.991 763.815 856.683 764.227 856.46C764.639 856.238 765.093 856.072 765.591 855.963C766.092 855.849 766.597 855.759 767.103 855.693C767.766 855.608 768.304 855.544 768.716 855.501C769.132 855.454 769.435 855.376 769.625 855.267C769.819 855.158 769.916 854.969 769.916 854.699V854.642C769.916 853.941 769.724 853.397 769.341 853.009C768.962 852.62 768.386 852.426 767.615 852.426C766.815 852.426 766.187 852.601 765.733 852.952C765.278 853.302 764.958 853.676 764.774 854.074L763.183 853.506C763.467 852.843 763.846 852.327 764.319 851.957C764.797 851.583 765.318 851.323 765.882 851.176C766.45 851.025 767.009 850.949 767.558 850.949C767.908 850.949 768.311 850.991 768.765 851.077C769.225 851.157 769.667 851.325 770.093 851.581C770.524 851.837 770.882 852.223 771.166 852.739C771.45 853.255 771.592 853.946 771.592 854.812V862H769.916V860.523H769.831C769.717 860.759 769.528 861.013 769.262 861.283C768.997 861.553 768.645 861.782 768.204 861.972C767.764 862.161 767.226 862.256 766.592 862.256ZM766.848 860.75C767.511 860.75 768.069 860.62 768.524 860.359C768.983 860.099 769.329 859.763 769.561 859.351C769.797 858.939 769.916 858.506 769.916 858.051V856.517C769.845 856.602 769.689 856.68 769.447 856.751C769.21 856.818 768.936 856.877 768.623 856.929C768.315 856.976 768.015 857.019 767.721 857.057C767.432 857.09 767.198 857.118 767.018 857.142C766.583 857.199 766.175 857.291 765.797 857.419C765.422 857.542 765.119 857.729 764.887 857.98C764.66 858.226 764.547 858.562 764.547 858.989C764.547 859.571 764.762 860.011 765.193 860.31C765.628 860.603 766.18 860.75 766.848 860.75ZM779.083 862.227C778.06 862.227 777.18 861.986 776.441 861.503C775.702 861.02 775.134 860.355 774.737 859.507C774.339 858.66 774.14 857.691 774.14 856.602C774.14 855.494 774.344 854.517 774.751 853.669C775.163 852.817 775.736 852.152 776.469 851.673C777.208 851.19 778.07 850.949 779.055 850.949C779.822 850.949 780.513 851.091 781.129 851.375C781.744 851.659 782.248 852.057 782.641 852.568C783.034 853.08 783.278 853.676 783.373 854.358H781.697C781.569 853.861 781.285 853.42 780.844 853.037C780.409 852.649 779.822 852.455 779.083 852.455C778.43 852.455 777.857 852.625 777.364 852.966C776.877 853.302 776.496 853.778 776.221 854.393C775.951 855.004 775.816 855.722 775.816 856.545C775.816 857.388 775.949 858.122 776.214 858.747C776.484 859.372 776.862 859.857 777.35 860.203C777.843 860.549 778.42 860.722 779.083 860.722C779.519 860.722 779.914 860.646 780.269 860.494C780.624 860.343 780.925 860.125 781.171 859.841C781.417 859.557 781.593 859.216 781.697 858.818H783.373C783.278 859.462 783.044 860.042 782.67 860.558C782.3 861.07 781.81 861.477 781.2 861.78C780.594 862.078 779.888 862.227 779.083 862.227ZM790.255 862.227C789.232 862.227 788.352 861.986 787.613 861.503C786.874 861.02 786.306 860.355 785.908 859.507C785.511 858.66 785.312 857.691 785.312 856.602C785.312 855.494 785.515 854.517 785.923 853.669C786.335 852.817 786.907 852.152 787.641 851.673C788.38 851.19 789.242 850.949 790.227 850.949C790.994 850.949 791.685 851.091 792.3 851.375C792.916 851.659 793.42 852.057 793.813 852.568C794.206 853.08 794.45 853.676 794.545 854.358H792.869C792.741 853.861 792.457 853.42 792.016 853.037C791.581 852.649 790.994 852.455 790.255 852.455C789.602 852.455 789.029 852.625 788.536 852.966C788.049 853.302 787.667 853.778 787.393 854.393C787.123 855.004 786.988 855.722 786.988 856.545C786.988 857.388 787.121 858.122 787.386 858.747C787.656 859.372 788.034 859.857 788.522 860.203C789.014 860.549 789.592 860.722 790.255 860.722C790.691 860.722 791.086 860.646 791.441 860.494C791.796 860.343 792.097 860.125 792.343 859.841C792.589 859.557 792.764 859.216 792.869 858.818H794.545C794.45 859.462 794.216 860.042 793.842 860.558C793.472 861.07 792.982 861.477 792.371 861.78C791.765 862.078 791.06 862.227 790.255 862.227ZM801.569 862.227C800.518 862.227 799.611 861.995 798.849 861.531C798.091 861.062 797.506 860.409 797.094 859.571C796.687 858.728 796.484 857.748 796.484 856.631C796.484 855.513 796.687 854.528 797.094 853.676C797.506 852.819 798.079 852.152 798.813 851.673C799.552 851.19 800.414 850.949 801.398 850.949C801.967 850.949 802.528 851.044 803.082 851.233C803.636 851.422 804.14 851.73 804.594 852.156C805.049 852.578 805.411 853.136 805.681 853.832C805.951 854.528 806.086 855.385 806.086 856.403V857.114H797.677V855.665H804.381C804.381 855.049 804.258 854.5 804.012 854.017C803.771 853.534 803.425 853.153 802.975 852.874C802.53 852.594 802.004 852.455 801.398 852.455C800.731 852.455 800.153 852.62 799.665 852.952C799.183 853.278 798.811 853.705 798.55 854.23C798.29 854.756 798.16 855.319 798.16 855.92V856.886C798.16 857.71 798.302 858.409 798.586 858.982C798.875 859.55 799.275 859.983 799.786 860.281C800.298 860.575 800.892 860.722 801.569 860.722C802.009 860.722 802.407 860.66 802.762 860.537C803.122 860.409 803.432 860.22 803.692 859.969C803.953 859.713 804.154 859.396 804.296 859.017L805.915 859.472C805.745 860.021 805.459 860.504 805.056 860.92C804.654 861.332 804.156 861.654 803.565 861.886C802.973 862.114 802.308 862.227 801.569 862.227ZM816.363 853.534L814.857 853.96C814.763 853.709 814.623 853.465 814.438 853.229C814.258 852.987 814.012 852.788 813.7 852.632C813.387 852.476 812.987 852.398 812.499 852.398C811.832 852.398 811.275 852.552 810.83 852.859C810.39 853.162 810.17 853.548 810.17 854.017C810.17 854.434 810.321 854.763 810.624 855.004C810.927 855.246 811.401 855.447 812.045 855.608L813.664 856.006C814.639 856.242 815.366 856.605 815.844 857.092C816.323 857.575 816.562 858.198 816.562 858.96C816.562 859.585 816.382 860.144 816.022 860.636C815.667 861.129 815.17 861.517 814.531 861.801C813.891 862.085 813.148 862.227 812.3 862.227C811.188 862.227 810.267 861.986 809.538 861.503C808.808 861.02 808.347 860.314 808.153 859.386L809.744 858.989C809.895 859.576 810.182 860.016 810.603 860.31C811.029 860.603 811.585 860.75 812.272 860.75C813.053 860.75 813.674 860.584 814.133 860.253C814.597 859.917 814.829 859.514 814.829 859.045C814.829 858.667 814.696 858.349 814.431 858.094C814.166 857.833 813.759 857.639 813.21 857.511L811.391 857.085C810.392 856.848 809.658 856.482 809.19 855.984C808.726 855.482 808.494 854.855 808.494 854.102C808.494 853.487 808.666 852.942 809.012 852.469C809.362 851.995 809.838 851.624 810.44 851.354C811.046 851.084 811.732 850.949 812.499 850.949C813.579 850.949 814.426 851.186 815.042 851.659C815.662 852.133 816.103 852.758 816.363 853.534ZM826.812 853.534L825.306 853.96C825.212 853.709 825.072 853.465 824.887 853.229C824.708 852.987 824.461 852.788 824.149 852.632C823.836 852.476 823.436 852.398 822.949 852.398C822.281 852.398 821.725 852.552 821.279 852.859C820.839 853.162 820.619 853.548 820.619 854.017C820.619 854.434 820.77 854.763 821.074 855.004C821.377 855.246 821.85 855.447 822.494 855.608L824.113 856.006C825.089 856.242 825.815 856.605 826.294 857.092C826.772 857.575 827.011 858.198 827.011 858.96C827.011 859.585 826.831 860.144 826.471 860.636C826.116 861.129 825.619 861.517 824.98 861.801C824.341 862.085 823.597 862.227 822.75 862.227C821.637 862.227 820.716 861.986 819.987 861.503C819.258 861.02 818.796 860.314 818.602 859.386L820.193 858.989C820.344 859.576 820.631 860.016 821.052 860.31C821.478 860.603 822.035 860.75 822.721 860.75C823.502 860.75 824.123 860.584 824.582 860.253C825.046 859.917 825.278 859.514 825.278 859.045C825.278 858.667 825.145 858.349 824.88 858.094C824.615 857.833 824.208 857.639 823.659 857.511L821.841 857.085C820.842 856.848 820.108 856.482 819.639 855.984C819.175 855.482 818.943 854.855 818.943 854.102C818.943 853.487 819.116 852.942 819.461 852.469C819.812 851.995 820.288 851.624 820.889 851.354C821.495 851.084 822.181 850.949 822.949 850.949C824.028 850.949 824.876 851.186 825.491 851.659C826.111 852.133 826.552 852.758 826.812 853.534Z" fill="#03031C"/>
+<path d="M954.409 827.54V821.091H956.085V832H954.409V830.153H954.295C954.04 830.707 953.642 831.179 953.102 831.567C952.563 831.95 951.881 832.142 951.057 832.142C950.375 832.142 949.769 831.993 949.239 831.695C948.708 831.392 948.292 830.937 947.989 830.331C947.686 829.72 947.534 828.951 947.534 828.023V821.091H949.21V827.909C949.21 828.705 949.433 829.339 949.878 829.812C950.328 830.286 950.901 830.523 951.597 830.523C952.013 830.523 952.437 830.416 952.868 830.203C953.304 829.99 953.668 829.663 953.962 829.223C954.26 828.783 954.409 828.222 954.409 827.54ZM966.882 823.534L965.377 823.96C965.282 823.709 965.142 823.465 964.958 823.229C964.778 822.987 964.532 822.788 964.219 822.632C963.907 822.476 963.507 822.398 963.019 822.398C962.351 822.398 961.795 822.552 961.35 822.859C960.909 823.162 960.689 823.548 960.689 824.017C960.689 824.434 960.841 824.763 961.144 825.004C961.447 825.246 961.92 825.447 962.564 825.608L964.184 826.006C965.159 826.242 965.886 826.605 966.364 827.092C966.842 827.575 967.081 828.198 967.081 828.96C967.081 829.585 966.901 830.144 966.542 830.636C966.186 831.129 965.689 831.517 965.05 831.801C964.411 832.085 963.667 832.227 962.82 832.227C961.707 832.227 960.786 831.986 960.057 831.503C959.328 831.02 958.866 830.314 958.672 829.386L960.263 828.989C960.415 829.576 960.701 830.016 961.123 830.31C961.549 830.603 962.105 830.75 962.792 830.75C963.573 830.75 964.193 830.584 964.652 830.253C965.116 829.917 965.348 829.514 965.348 829.045C965.348 828.667 965.216 828.349 964.951 828.094C964.685 827.833 964.278 827.639 963.729 827.511L961.911 827.085C960.912 826.848 960.178 826.482 959.709 825.984C959.245 825.482 959.013 824.855 959.013 824.102C959.013 823.487 959.186 822.942 959.532 822.469C959.882 821.995 960.358 821.624 960.959 821.354C961.565 821.084 962.252 820.949 963.019 820.949C964.098 820.949 964.946 821.186 965.561 821.659C966.182 822.133 966.622 822.758 966.882 823.534ZM969.604 832V821.091H971.281V832H969.604ZM970.457 819.273C970.13 819.273 969.848 819.161 969.612 818.939C969.379 818.716 969.263 818.449 969.263 818.136C969.263 817.824 969.379 817.556 969.612 817.334C969.848 817.111 970.13 817 970.457 817C970.783 817 971.063 817.111 971.295 817.334C971.531 817.556 971.65 817.824 971.65 818.136C971.65 818.449 971.531 818.716 971.295 818.939C971.063 819.161 970.783 819.273 970.457 819.273ZM976.027 825.438V832H974.35V821.091H975.97V822.795H976.112C976.368 822.241 976.756 821.796 977.277 821.46C977.797 821.119 978.47 820.949 979.294 820.949C980.032 820.949 980.679 821.1 981.233 821.403C981.787 821.702 982.217 822.156 982.525 822.767C982.833 823.373 982.987 824.14 982.987 825.068V832H981.311V825.182C981.311 824.325 981.088 823.657 980.643 823.179C980.198 822.696 979.587 822.455 978.811 822.455C978.276 822.455 977.797 822.571 977.376 822.803C976.959 823.035 976.63 823.373 976.389 823.818C976.147 824.263 976.027 824.803 976.027 825.438ZM990.453 836.318C989.643 836.318 988.947 836.214 988.365 836.006C987.783 835.802 987.297 835.532 986.909 835.196C986.526 834.865 986.22 834.509 985.993 834.131L987.328 833.193C987.48 833.392 987.671 833.619 987.903 833.875C988.135 834.135 988.453 834.36 988.855 834.55C989.262 834.744 989.795 834.841 990.453 834.841C991.334 834.841 992.061 834.628 992.634 834.202C993.206 833.776 993.493 833.108 993.493 832.199V829.983H993.351C993.228 830.182 993.053 830.428 992.825 830.722C992.603 831.01 992.281 831.268 991.859 831.496C991.443 831.718 990.879 831.83 990.169 831.83C989.288 831.83 988.498 831.621 987.797 831.205C987.101 830.788 986.549 830.182 986.142 829.386C985.74 828.591 985.538 827.625 985.538 826.489C985.538 825.371 985.735 824.398 986.128 823.57C986.521 822.736 987.068 822.092 987.768 821.638C988.469 821.179 989.279 820.949 990.197 820.949C990.908 820.949 991.471 821.067 991.888 821.304C992.309 821.536 992.631 821.801 992.854 822.099C993.081 822.393 993.256 822.634 993.379 822.824H993.55V821.091H995.169V832.312C995.169 833.25 994.956 834.012 994.53 834.599C994.108 835.191 993.54 835.625 992.825 835.899C992.115 836.179 991.324 836.318 990.453 836.318ZM990.396 830.324C991.069 830.324 991.637 830.17 992.101 829.862C992.565 829.554 992.918 829.112 993.159 828.534C993.401 827.956 993.521 827.265 993.521 826.46C993.521 825.674 993.403 824.981 993.166 824.379C992.929 823.778 992.579 823.307 992.115 822.966C991.651 822.625 991.078 822.455 990.396 822.455C989.686 822.455 989.094 822.634 988.621 822.994C988.152 823.354 987.799 823.837 987.562 824.443C987.33 825.049 987.214 825.722 987.214 826.46C987.214 827.218 987.333 827.888 987.57 828.47C987.811 829.048 988.166 829.502 988.635 829.834C989.108 830.161 989.696 830.324 990.396 830.324ZM1016.36 824.727C1016.36 826.261 1016.09 827.587 1015.53 828.705C1014.98 829.822 1014.22 830.684 1013.25 831.29C1012.29 831.896 1011.18 832.199 1009.94 832.199C1008.7 832.199 1007.6 831.896 1006.63 831.29C1005.67 830.684 1004.91 829.822 1004.35 828.705C1003.8 827.587 1003.52 826.261 1003.52 824.727C1003.52 823.193 1003.8 821.867 1004.35 820.75C1004.91 819.633 1005.67 818.771 1006.63 818.165C1007.6 817.559 1008.7 817.256 1009.94 817.256C1011.18 817.256 1012.29 817.559 1013.25 818.165C1014.22 818.771 1014.98 819.633 1015.53 820.75C1016.09 821.867 1016.36 823.193 1016.36 824.727ZM1014.66 824.727C1014.66 823.468 1014.45 822.405 1014.03 821.538C1013.61 820.672 1013.04 820.016 1012.33 819.571C1011.62 819.126 1010.82 818.903 1009.94 818.903C1009.06 818.903 1008.26 819.126 1007.55 819.571C1006.84 820.016 1006.27 820.672 1005.85 821.538C1005.43 822.405 1005.23 823.468 1005.23 824.727C1005.23 825.987 1005.43 827.05 1005.85 827.916C1006.27 828.783 1006.84 829.438 1007.55 829.884C1008.26 830.329 1009.06 830.551 1009.94 830.551C1010.82 830.551 1011.62 830.329 1012.33 829.884C1013.04 829.438 1013.61 828.783 1014.03 827.916C1014.45 827.05 1014.66 825.987 1014.66 824.727ZM1019.1 836.091V821.091H1020.72V822.824H1020.91C1021.04 822.634 1021.21 822.393 1021.43 822.099C1021.65 821.801 1021.97 821.536 1022.38 821.304C1022.79 821.067 1023.36 820.949 1024.07 820.949C1024.99 820.949 1025.8 821.179 1026.5 821.638C1027.2 822.097 1027.74 822.748 1028.14 823.591C1028.53 824.434 1028.73 825.428 1028.73 826.574C1028.73 827.729 1028.53 828.731 1028.14 829.578C1027.74 830.421 1027.2 831.074 1026.5 831.538C1025.81 831.998 1025.01 832.227 1024.1 832.227C1023.4 832.227 1022.83 832.111 1022.41 831.879C1021.99 831.643 1021.67 831.375 1021.44 831.077C1021.21 830.774 1021.04 830.523 1020.91 830.324H1020.77V836.091H1019.1ZM1020.74 826.545C1020.74 827.369 1020.87 828.096 1021.11 828.726C1021.35 829.351 1021.7 829.841 1022.16 830.196C1022.63 830.546 1023.2 830.722 1023.87 830.722C1024.57 830.722 1025.15 830.537 1025.62 830.168C1026.1 829.794 1026.45 829.292 1026.69 828.662C1026.93 828.027 1027.05 827.322 1027.05 826.545C1027.05 825.778 1026.93 825.087 1026.7 824.472C1026.46 823.851 1026.11 823.361 1025.64 823.001C1025.17 822.637 1024.58 822.455 1023.87 822.455C1023.19 822.455 1022.61 822.627 1022.15 822.973C1021.69 823.314 1021.34 823.792 1021.1 824.408C1020.86 825.018 1020.74 825.731 1020.74 826.545ZM1035.86 832.227C1034.81 832.227 1033.9 831.995 1033.14 831.531C1032.38 831.062 1031.8 830.409 1031.38 829.571C1030.98 828.728 1030.77 827.748 1030.77 826.631C1030.77 825.513 1030.98 824.528 1031.38 823.676C1031.8 822.819 1032.37 822.152 1033.1 821.673C1033.84 821.19 1034.7 820.949 1035.69 820.949C1036.26 820.949 1036.82 821.044 1037.37 821.233C1037.92 821.422 1038.43 821.73 1038.88 822.156C1039.34 822.578 1039.7 823.136 1039.97 823.832C1040.24 824.528 1040.38 825.385 1040.38 826.403V827.114H1031.97V825.665H1038.67C1038.67 825.049 1038.55 824.5 1038.3 824.017C1038.06 823.534 1037.71 823.153 1037.26 822.874C1036.82 822.594 1036.29 822.455 1035.69 822.455C1035.02 822.455 1034.44 822.62 1033.95 822.952C1033.47 823.278 1033.1 823.705 1032.84 824.23C1032.58 824.756 1032.45 825.319 1032.45 825.92V826.886C1032.45 827.71 1032.59 828.409 1032.88 828.982C1033.16 829.55 1033.56 829.983 1034.08 830.281C1034.59 830.575 1035.18 830.722 1035.86 830.722C1036.3 830.722 1036.7 830.66 1037.05 830.537C1037.41 830.409 1037.72 830.22 1037.98 829.969C1038.24 829.713 1038.44 829.396 1038.59 829.017L1040.2 829.472C1040.03 830.021 1039.75 830.504 1039.35 830.92C1038.94 831.332 1038.45 831.654 1037.85 831.886C1037.26 832.114 1036.6 832.227 1035.86 832.227ZM1042.92 832V821.091H1044.54V822.739H1044.66C1044.86 822.199 1045.22 821.761 1045.74 821.425C1046.26 821.089 1046.85 820.92 1047.5 820.92C1047.62 820.92 1047.78 820.923 1047.96 820.928C1048.14 820.932 1048.28 820.939 1048.38 820.949V822.653C1048.32 822.639 1048.19 822.618 1047.99 822.589C1047.79 822.556 1047.58 822.54 1047.36 822.54C1046.83 822.54 1046.35 822.651 1045.94 822.874C1045.52 823.091 1045.2 823.394 1044.96 823.783C1044.72 824.166 1044.6 824.604 1044.6 825.097V832H1042.92ZM1053.58 832.256C1052.89 832.256 1052.26 832.125 1051.69 831.865C1051.13 831.6 1050.68 831.219 1050.35 830.722C1050.02 830.22 1049.85 829.614 1049.85 828.903C1049.85 828.278 1049.98 827.772 1050.22 827.384C1050.47 826.991 1050.8 826.683 1051.21 826.46C1051.62 826.238 1052.08 826.072 1052.57 825.963C1053.08 825.849 1053.58 825.759 1054.09 825.693C1054.75 825.608 1055.29 825.544 1055.7 825.501C1056.12 825.454 1056.42 825.376 1056.61 825.267C1056.8 825.158 1056.9 824.969 1056.9 824.699V824.642C1056.9 823.941 1056.71 823.397 1056.32 823.009C1055.95 822.62 1055.37 822.426 1054.6 822.426C1053.8 822.426 1053.17 822.601 1052.72 822.952C1052.26 823.302 1051.94 823.676 1051.76 824.074L1050.17 823.506C1050.45 822.843 1050.83 822.327 1051.3 821.957C1051.78 821.583 1052.3 821.323 1052.87 821.176C1053.43 821.025 1053.99 820.949 1054.54 820.949C1054.89 820.949 1055.3 820.991 1055.75 821.077C1056.21 821.157 1056.65 821.325 1057.08 821.581C1057.51 821.837 1057.87 822.223 1058.15 822.739C1058.43 823.255 1058.58 823.946 1058.58 824.812V832H1056.9V830.523H1056.81C1056.7 830.759 1056.51 831.013 1056.25 831.283C1055.98 831.553 1055.63 831.782 1055.19 831.972C1054.75 832.161 1054.21 832.256 1053.58 832.256ZM1053.83 830.75C1054.49 830.75 1055.05 830.62 1055.51 830.359C1055.97 830.099 1056.31 829.763 1056.55 829.351C1056.78 828.939 1056.9 828.506 1056.9 828.051V826.517C1056.83 826.602 1056.67 826.68 1056.43 826.751C1056.19 826.818 1055.92 826.877 1055.61 826.929C1055.3 826.976 1055 827.019 1054.71 827.057C1054.42 827.09 1054.18 827.118 1054 827.142C1053.57 827.199 1053.16 827.291 1052.78 827.419C1052.41 827.542 1052.1 827.729 1051.87 827.98C1051.64 828.226 1051.53 828.562 1051.53 828.989C1051.53 829.571 1051.75 830.011 1052.18 830.31C1052.61 830.603 1053.16 830.75 1053.83 830.75ZM1066.38 821.091V822.511H1060.73V821.091H1066.38ZM1062.37 818.477H1064.05V828.875C1064.05 829.348 1064.12 829.704 1064.26 829.94C1064.4 830.172 1064.58 830.329 1064.8 830.409C1065.02 830.485 1065.25 830.523 1065.5 830.523C1065.68 830.523 1065.84 830.513 1065.95 830.494C1066.07 830.471 1066.17 830.452 1066.24 830.438L1066.58 831.943C1066.47 831.986 1066.31 832.028 1066.1 832.071C1065.9 832.118 1065.64 832.142 1065.33 832.142C1064.86 832.142 1064.39 832.04 1063.94 831.837C1063.49 831.633 1063.11 831.323 1062.81 830.906C1062.52 830.49 1062.37 829.964 1062.37 829.33V818.477ZM1073.22 832.227C1072.23 832.227 1071.37 831.993 1070.62 831.524C1069.88 831.055 1069.31 830.4 1068.89 829.557C1068.48 828.714 1068.27 827.729 1068.27 826.602C1068.27 825.466 1068.48 824.474 1068.89 823.626C1069.31 822.779 1069.88 822.121 1070.62 821.652C1071.37 821.183 1072.23 820.949 1073.22 820.949C1074.2 820.949 1075.06 821.183 1075.8 821.652C1076.54 822.121 1077.12 822.779 1077.53 823.626C1077.95 824.474 1078.16 825.466 1078.16 826.602C1078.16 827.729 1077.95 828.714 1077.53 829.557C1077.12 830.4 1076.54 831.055 1075.8 831.524C1075.06 831.993 1074.2 832.227 1073.22 832.227ZM1073.22 830.722C1073.96 830.722 1074.58 830.53 1075.06 830.146C1075.55 829.763 1075.9 829.259 1076.13 828.634C1076.37 828.009 1076.48 827.331 1076.48 826.602C1076.48 825.873 1076.37 825.194 1076.13 824.564C1075.9 823.934 1075.55 823.425 1075.06 823.037C1074.58 822.649 1073.96 822.455 1073.22 822.455C1072.47 822.455 1071.85 822.649 1071.37 823.037C1070.89 823.425 1070.53 823.934 1070.3 824.564C1070.06 825.194 1069.95 825.873 1069.95 826.602C1069.95 827.331 1070.06 828.009 1070.3 828.634C1070.53 829.259 1070.89 829.763 1071.37 830.146C1071.85 830.53 1072.47 830.722 1073.22 830.722ZM1080.72 832V821.091H1082.34V822.739H1082.45C1082.65 822.199 1083.01 821.761 1083.53 821.425C1084.05 821.089 1084.64 820.92 1085.29 820.92C1085.41 820.92 1085.57 820.923 1085.75 820.928C1085.94 820.932 1086.08 820.939 1086.17 820.949V822.653C1086.12 822.639 1085.99 822.618 1085.78 822.589C1085.58 822.556 1085.37 822.54 1085.15 822.54C1084.62 822.54 1084.15 822.651 1083.73 822.874C1083.32 823.091 1082.99 823.394 1082.75 823.783C1082.51 824.166 1082.39 824.604 1082.39 825.097V832H1080.72ZM959.466 852H957.705C957.6 851.493 957.418 851.048 957.158 850.665C956.902 850.281 956.589 849.959 956.22 849.699C955.856 849.434 955.451 849.235 955.006 849.102C954.561 848.97 954.097 848.903 953.614 848.903C952.733 848.903 951.935 849.126 951.22 849.571C950.51 850.016 949.944 850.672 949.523 851.538C949.106 852.405 948.898 853.468 948.898 854.727C948.898 855.987 949.106 857.05 949.523 857.916C949.944 858.783 950.51 859.438 951.22 859.884C951.935 860.329 952.733 860.551 953.614 860.551C954.097 860.551 954.561 860.485 955.006 860.352C955.451 860.22 955.856 860.023 956.22 859.763C956.589 859.498 956.902 859.173 957.158 858.79C957.418 858.402 957.6 857.956 957.705 857.455H959.466C959.333 858.198 959.092 858.863 958.741 859.45C958.391 860.037 957.955 860.537 957.435 860.949C956.914 861.356 956.329 861.666 955.68 861.879C955.036 862.092 954.348 862.199 953.614 862.199C952.373 862.199 951.27 861.896 950.304 861.29C949.338 860.684 948.578 859.822 948.024 858.705C947.47 857.587 947.193 856.261 947.193 854.727C947.193 853.193 947.47 851.867 948.024 850.75C948.578 849.633 949.338 848.771 950.304 848.165C951.27 847.559 952.373 847.256 953.614 847.256C954.348 847.256 955.036 847.362 955.68 847.575C956.329 847.788 956.914 848.101 957.435 848.513C957.955 848.92 958.391 849.417 958.741 850.004C959.092 850.587 959.333 851.252 959.466 852ZM966.517 862.227C965.532 862.227 964.668 861.993 963.924 861.524C963.186 861.055 962.608 860.4 962.191 859.557C961.779 858.714 961.574 857.729 961.574 856.602C961.574 855.466 961.779 854.474 962.191 853.626C962.608 852.779 963.186 852.121 963.924 851.652C964.668 851.183 965.532 850.949 966.517 850.949C967.502 850.949 968.363 851.183 969.102 851.652C969.845 852.121 970.423 852.779 970.835 853.626C971.252 854.474 971.46 855.466 971.46 856.602C971.46 857.729 971.252 858.714 970.835 859.557C970.423 860.4 969.845 861.055 969.102 861.524C968.363 861.993 967.502 862.227 966.517 862.227ZM966.517 860.722C967.265 860.722 967.88 860.53 968.363 860.146C968.846 859.763 969.204 859.259 969.436 858.634C969.668 858.009 969.784 857.331 969.784 856.602C969.784 855.873 969.668 855.194 969.436 854.564C969.204 853.934 968.846 853.425 968.363 853.037C967.88 852.649 967.265 852.455 966.517 852.455C965.769 852.455 965.153 852.649 964.67 853.037C964.187 853.425 963.83 853.934 963.598 854.564C963.366 855.194 963.25 855.873 963.25 856.602C963.25 857.331 963.366 858.009 963.598 858.634C963.83 859.259 964.187 859.763 964.67 860.146C965.153 860.53 965.769 860.722 966.517 860.722ZM975.695 855.438V862H974.018V851.091H975.638V852.795H975.78C976.036 852.241 976.424 851.796 976.945 851.46C977.465 851.119 978.138 850.949 978.962 850.949C979.7 850.949 980.347 851.1 980.901 851.403C981.455 851.702 981.885 852.156 982.193 852.767C982.501 853.373 982.655 854.14 982.655 855.068V862H980.979V855.182C980.979 854.325 980.756 853.657 980.311 853.179C979.866 852.696 979.255 852.455 978.479 852.455C977.944 852.455 977.465 852.571 977.044 852.803C976.627 853.035 976.298 853.373 976.057 853.818C975.815 854.263 975.695 854.803 975.695 855.438ZM990.462 851.091V852.511H984.809V851.091H990.462ZM986.456 848.477H988.132V858.875C988.132 859.348 988.201 859.704 988.338 859.94C988.48 860.172 988.66 860.329 988.878 860.409C989.101 860.485 989.335 860.523 989.581 860.523C989.766 860.523 989.917 860.513 990.036 860.494C990.154 860.471 990.249 860.452 990.32 860.438L990.661 861.943C990.547 861.986 990.389 862.028 990.185 862.071C989.981 862.118 989.723 862.142 989.411 862.142C988.937 862.142 988.473 862.04 988.019 861.837C987.569 861.633 987.195 861.323 986.897 860.906C986.603 860.49 986.456 859.964 986.456 859.33V848.477ZM997.44 862.227C996.389 862.227 995.482 861.995 994.72 861.531C993.962 861.062 993.377 860.409 992.966 859.571C992.558 858.728 992.355 857.748 992.355 856.631C992.355 855.513 992.558 854.528 992.966 853.676C993.377 852.819 993.95 852.152 994.684 851.673C995.423 851.19 996.285 850.949 997.27 850.949C997.838 850.949 998.399 851.044 998.953 851.233C999.507 851.422 1000.01 851.73 1000.47 852.156C1000.92 852.578 1001.28 853.136 1001.55 853.832C1001.82 854.528 1001.96 855.385 1001.96 856.403V857.114H993.548V855.665H1000.25C1000.25 855.049 1000.13 854.5 999.883 854.017C999.642 853.534 999.296 853.153 998.846 852.874C998.401 852.594 997.876 852.455 997.27 852.455C996.602 852.455 996.024 852.62 995.537 852.952C995.054 853.278 994.682 853.705 994.422 854.23C994.161 854.756 994.031 855.319 994.031 855.92V856.886C994.031 857.71 994.173 858.409 994.457 858.982C994.746 859.55 995.146 859.983 995.657 860.281C996.169 860.575 996.763 860.722 997.44 860.722C997.88 860.722 998.278 860.66 998.633 860.537C998.993 860.409 999.303 860.22 999.564 859.969C999.824 859.713 1000.03 859.396 1000.17 859.017L1001.79 859.472C1001.62 860.021 1001.33 860.504 1000.93 860.92C1000.52 861.332 1000.03 861.654 999.436 861.886C998.844 862.114 998.179 862.227 997.44 862.227ZM1005.46 851.091L1008.08 855.551L1010.69 851.091H1012.62L1009.1 856.545L1012.62 862H1010.69L1008.08 857.767L1005.46 862H1003.53L1007 856.545L1003.53 851.091H1005.46ZM1019.76 851.091V852.511H1014.11V851.091H1019.76ZM1015.75 848.477H1017.43V858.875C1017.43 859.348 1017.5 859.704 1017.64 859.94C1017.78 860.172 1017.96 860.329 1018.18 860.409C1018.4 860.485 1018.63 860.523 1018.88 860.523C1019.06 860.523 1019.21 860.513 1019.33 860.494C1019.45 860.471 1019.55 860.452 1019.62 860.438L1019.96 861.943C1019.84 861.986 1019.69 862.028 1019.48 862.071C1019.28 862.118 1019.02 862.142 1018.71 862.142C1018.23 862.142 1017.77 862.04 1017.32 861.837C1016.87 861.633 1016.49 861.323 1016.19 860.906C1015.9 860.49 1015.75 859.964 1015.75 859.33V848.477ZM1027.88 862V860.722L1032.68 855.466C1033.24 854.85 1033.71 854.315 1034.07 853.861C1034.43 853.402 1034.7 852.971 1034.88 852.568C1035.06 852.161 1035.15 851.735 1035.15 851.29C1035.15 850.778 1035.03 850.336 1034.78 849.962C1034.54 849.588 1034.21 849.299 1033.79 849.095C1033.36 848.892 1032.89 848.79 1032.37 848.79C1031.81 848.79 1031.32 848.906 1030.9 849.138C1030.49 849.365 1030.17 849.685 1029.94 850.097C1029.72 850.509 1029.61 850.991 1029.61 851.545H1027.93C1027.93 850.693 1028.13 849.945 1028.52 849.301C1028.92 848.657 1029.45 848.155 1030.13 847.795C1030.81 847.436 1031.57 847.256 1032.42 847.256C1033.27 847.256 1034.03 847.436 1034.69 847.795C1035.35 848.155 1035.86 848.641 1036.24 849.251C1036.61 849.862 1036.8 850.542 1036.8 851.29C1036.8 851.825 1036.7 852.348 1036.51 852.859C1036.32 853.366 1035.99 853.932 1035.51 854.557C1035.04 855.177 1034.39 855.935 1033.56 856.83L1030.29 860.324V860.438H1037.05V862H1027.88ZM1048.85 862.256C1048.16 862.256 1047.53 862.125 1046.97 861.865C1046.4 861.6 1045.96 861.219 1045.63 860.722C1045.29 860.22 1045.13 859.614 1045.13 858.903C1045.13 858.278 1045.25 857.772 1045.5 857.384C1045.74 856.991 1046.07 856.683 1046.48 856.46C1046.9 856.238 1047.35 856.072 1047.85 855.963C1048.35 855.849 1048.85 855.759 1049.36 855.693C1050.02 855.608 1050.56 855.544 1050.97 855.501C1051.39 855.454 1051.69 855.376 1051.88 855.267C1052.08 855.158 1052.17 854.969 1052.17 854.699V854.642C1052.17 853.941 1051.98 853.397 1051.6 853.009C1051.22 852.62 1050.64 852.426 1049.87 852.426C1049.07 852.426 1048.44 852.601 1047.99 852.952C1047.54 853.302 1047.22 853.676 1047.03 854.074L1045.44 853.506C1045.72 852.843 1046.1 852.327 1046.58 851.957C1047.06 851.583 1047.58 851.323 1048.14 851.176C1048.71 851.025 1049.27 850.949 1049.82 850.949C1050.17 850.949 1050.57 850.991 1051.02 851.077C1051.48 851.157 1051.93 851.325 1052.35 851.581C1052.78 851.837 1053.14 852.223 1053.42 852.739C1053.71 853.255 1053.85 853.946 1053.85 854.812V862H1052.17V860.523H1052.09C1051.97 860.759 1051.79 861.013 1051.52 861.283C1051.26 861.553 1050.9 861.782 1050.46 861.972C1050.02 862.161 1049.48 862.256 1048.85 862.256ZM1049.11 860.75C1049.77 860.75 1050.33 860.62 1050.78 860.359C1051.24 860.099 1051.59 859.763 1051.82 859.351C1052.06 858.939 1052.17 858.506 1052.17 858.051V856.517C1052.1 856.602 1051.95 856.68 1051.7 856.751C1051.47 856.818 1051.19 856.877 1050.88 856.929C1050.57 856.976 1050.27 857.019 1049.98 857.057C1049.69 857.09 1049.46 857.118 1049.28 857.142C1048.84 857.199 1048.43 857.291 1048.05 857.419C1047.68 857.542 1047.38 857.729 1047.15 857.98C1046.92 858.226 1046.8 858.562 1046.8 858.989C1046.8 859.571 1047.02 860.011 1047.45 860.31C1047.89 860.603 1048.44 860.75 1049.11 860.75ZM1061.34 862.227C1060.32 862.227 1059.44 861.986 1058.7 861.503C1057.96 861.02 1057.39 860.355 1056.99 859.507C1056.6 858.66 1056.4 857.691 1056.4 856.602C1056.4 855.494 1056.6 854.517 1057.01 853.669C1057.42 852.817 1057.99 852.152 1058.73 851.673C1059.47 851.19 1060.33 850.949 1061.31 850.949C1062.08 850.949 1062.77 851.091 1063.39 851.375C1064 851.659 1064.51 852.057 1064.9 852.568C1065.29 853.08 1065.54 853.676 1065.63 854.358H1063.95C1063.83 853.861 1063.54 853.42 1063.1 853.037C1062.67 852.649 1062.08 852.455 1061.34 852.455C1060.69 852.455 1060.11 852.625 1059.62 852.966C1059.13 853.302 1058.75 853.778 1058.48 854.393C1058.21 855.004 1058.07 855.722 1058.07 856.545C1058.07 857.388 1058.21 858.122 1058.47 858.747C1058.74 859.372 1059.12 859.857 1059.61 860.203C1060.1 860.549 1060.68 860.722 1061.34 860.722C1061.78 860.722 1062.17 860.646 1062.53 860.494C1062.88 860.343 1063.18 860.125 1063.43 859.841C1063.68 859.557 1063.85 859.216 1063.95 858.818H1065.63C1065.54 859.462 1065.3 860.042 1064.93 860.558C1064.56 861.07 1064.07 861.477 1063.46 861.78C1062.85 862.078 1062.15 862.227 1061.34 862.227ZM1072.51 862.227C1071.49 862.227 1070.61 861.986 1069.87 861.503C1069.13 861.02 1068.56 860.355 1068.17 859.507C1067.77 858.66 1067.57 857.691 1067.57 856.602C1067.57 855.494 1067.77 854.517 1068.18 853.669C1068.59 852.817 1069.17 852.152 1069.9 851.673C1070.64 851.19 1071.5 850.949 1072.48 850.949C1073.25 850.949 1073.94 851.091 1074.56 851.375C1075.17 851.659 1075.68 852.057 1076.07 852.568C1076.46 853.08 1076.71 853.676 1076.8 854.358H1075.13C1075 853.861 1074.71 853.42 1074.27 853.037C1073.84 852.649 1073.25 852.455 1072.51 852.455C1071.86 852.455 1071.29 852.625 1070.79 852.966C1070.31 853.302 1069.93 853.778 1069.65 854.393C1069.38 855.004 1069.25 855.722 1069.25 856.545C1069.25 857.388 1069.38 858.122 1069.64 858.747C1069.91 859.372 1070.29 859.857 1070.78 860.203C1071.27 860.549 1071.85 860.722 1072.51 860.722C1072.95 860.722 1073.34 860.646 1073.7 860.494C1074.05 860.343 1074.35 860.125 1074.6 859.841C1074.85 859.557 1075.02 859.216 1075.13 858.818H1076.8C1076.71 859.462 1076.47 860.042 1076.1 860.558C1075.73 861.07 1075.24 861.477 1074.63 861.78C1074.02 862.078 1073.32 862.227 1072.51 862.227ZM1083.83 862.227C1082.78 862.227 1081.87 861.995 1081.11 861.531C1080.35 861.062 1079.76 860.409 1079.35 859.571C1078.95 858.728 1078.74 857.748 1078.74 856.631C1078.74 855.513 1078.95 854.528 1079.35 853.676C1079.76 852.819 1080.34 852.152 1081.07 851.673C1081.81 851.19 1082.67 850.949 1083.66 850.949C1084.22 850.949 1084.79 851.044 1085.34 851.233C1085.89 851.422 1086.4 851.73 1086.85 852.156C1087.31 852.578 1087.67 853.136 1087.94 853.832C1088.21 854.528 1088.34 855.385 1088.34 856.403V857.114H1079.93V855.665H1086.64C1086.64 855.049 1086.52 854.5 1086.27 854.017C1086.03 853.534 1085.68 853.153 1085.23 852.874C1084.79 852.594 1084.26 852.455 1083.66 852.455C1082.99 852.455 1082.41 852.62 1081.92 852.952C1081.44 853.278 1081.07 853.705 1080.81 854.23C1080.55 854.756 1080.42 855.319 1080.42 855.92V856.886C1080.42 857.71 1080.56 858.409 1080.84 858.982C1081.13 859.55 1081.53 859.983 1082.04 860.281C1082.56 860.575 1083.15 860.722 1083.83 860.722C1084.27 860.722 1084.66 860.66 1085.02 860.537C1085.38 860.409 1085.69 860.22 1085.95 859.969C1086.21 859.713 1086.41 859.396 1086.55 859.017L1088.17 859.472C1088 860.021 1087.72 860.504 1087.31 860.92C1086.91 861.332 1086.41 861.654 1085.82 861.886C1085.23 862.114 1084.57 862.227 1083.83 862.227ZM1098.62 853.534L1097.12 853.96C1097.02 853.709 1096.88 853.465 1096.7 853.229C1096.52 852.987 1096.27 852.788 1095.96 852.632C1095.64 852.476 1095.24 852.398 1094.76 852.398C1094.09 852.398 1093.53 852.552 1093.09 852.859C1092.65 853.162 1092.43 853.548 1092.43 854.017C1092.43 854.434 1092.58 854.763 1092.88 855.004C1093.19 855.246 1093.66 855.447 1094.3 855.608L1095.92 856.006C1096.9 856.242 1097.62 856.605 1098.1 857.092C1098.58 857.575 1098.82 858.198 1098.82 858.96C1098.82 859.585 1098.64 860.144 1098.28 860.636C1097.92 861.129 1097.43 861.517 1096.79 861.801C1096.15 862.085 1095.41 862.227 1094.56 862.227C1093.45 862.227 1092.52 861.986 1091.8 861.503C1091.07 861.02 1090.6 860.314 1090.41 859.386L1092 858.989C1092.15 859.576 1092.44 860.016 1092.86 860.31C1093.29 860.603 1093.84 860.75 1094.53 860.75C1095.31 860.75 1095.93 860.584 1096.39 860.253C1096.85 859.917 1097.09 859.514 1097.09 859.045C1097.09 858.667 1096.95 858.349 1096.69 858.094C1096.42 857.833 1096.02 857.639 1095.47 857.511L1093.65 857.085C1092.65 856.848 1091.92 856.482 1091.45 855.984C1090.98 855.482 1090.75 854.855 1090.75 854.102C1090.75 853.487 1090.92 852.942 1091.27 852.469C1091.62 851.995 1092.1 851.624 1092.7 851.354C1093.3 851.084 1093.99 850.949 1094.76 850.949C1095.84 850.949 1096.68 851.186 1097.3 851.659C1097.92 852.133 1098.36 852.758 1098.62 853.534ZM1109.07 853.534L1107.56 853.96C1107.47 853.709 1107.33 853.465 1107.15 853.229C1106.97 852.987 1106.72 852.788 1106.41 852.632C1106.09 852.476 1105.69 852.398 1105.21 852.398C1104.54 852.398 1103.98 852.552 1103.54 852.859C1103.1 853.162 1102.88 853.548 1102.88 854.017C1102.88 854.434 1103.03 854.763 1103.33 855.004C1103.63 855.246 1104.11 855.447 1104.75 855.608L1106.37 856.006C1107.35 856.242 1108.07 856.605 1108.55 857.092C1109.03 857.575 1109.27 858.198 1109.27 858.96C1109.27 859.585 1109.09 860.144 1108.73 860.636C1108.37 861.129 1107.88 861.517 1107.24 861.801C1106.6 862.085 1105.85 862.227 1105.01 862.227C1103.89 862.227 1102.97 861.986 1102.24 861.503C1101.52 861.02 1101.05 860.314 1100.86 859.386L1102.45 858.989C1102.6 859.576 1102.89 860.016 1103.31 860.31C1103.74 860.603 1104.29 860.75 1104.98 860.75C1105.76 860.75 1106.38 860.584 1106.84 860.253C1107.3 859.917 1107.54 859.514 1107.54 859.045C1107.54 858.667 1107.4 858.349 1107.14 858.094C1106.87 857.833 1106.47 857.639 1105.92 857.511L1104.1 857.085C1103.1 856.848 1102.37 856.482 1101.9 855.984C1101.43 855.482 1101.2 854.855 1101.2 854.102C1101.2 853.487 1101.37 852.942 1101.72 852.469C1102.07 851.995 1102.55 851.624 1103.15 851.354C1103.75 851.084 1104.44 850.949 1105.21 850.949C1106.29 850.949 1107.13 851.186 1107.75 851.659C1108.37 852.133 1108.81 852.758 1109.07 853.534Z" fill="#03031C"/>
+<g filter="url(#filter0_bd_12_618)">
+<rect x="159" y="1148" width="210" height="225" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="159.5" y="1148.5" width="209" height="224" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M216.019 1304V1285.82H222.163C223.589 1285.82 224.755 1286.08 225.66 1286.59C226.572 1287.1 227.247 1287.79 227.685 1288.66C228.123 1289.53 228.342 1290.5 228.342 1291.57C228.342 1292.64 228.123 1293.62 227.685 1294.49C227.253 1295.37 226.584 1296.07 225.678 1296.59C224.773 1297.1 223.613 1297.36 222.198 1297.36H217.795V1295.41H222.127C223.104 1295.41 223.888 1295.24 224.48 1294.9C225.072 1294.56 225.501 1294.11 225.767 1293.53C226.039 1292.95 226.175 1292.3 226.175 1291.57C226.175 1290.84 226.039 1290.19 225.767 1289.62C225.501 1289.04 225.069 1288.59 224.471 1288.27C223.873 1287.94 223.08 1287.77 222.092 1287.77H218.221V1304H216.019ZM233.699 1285.82V1304H231.604V1285.82H233.699ZM241.55 1304.32C240.685 1304.32 239.901 1304.16 239.197 1303.83C238.493 1303.5 237.933 1303.02 237.519 1302.4C237.105 1301.77 236.898 1301.02 236.898 1300.13C236.898 1299.35 237.051 1298.71 237.359 1298.23C237.667 1297.74 238.078 1297.35 238.593 1297.08C239.108 1296.8 239.676 1296.59 240.298 1296.45C240.925 1296.31 241.555 1296.2 242.189 1296.12C243.017 1296.01 243.689 1295.93 244.204 1295.88C244.725 1295.82 245.104 1295.72 245.34 1295.58C245.583 1295.45 245.704 1295.21 245.704 1294.87V1294.8C245.704 1293.93 245.465 1293.25 244.985 1292.76C244.512 1292.28 243.793 1292.03 242.828 1292.03C241.828 1292.03 241.044 1292.25 240.475 1292.69C239.907 1293.13 239.508 1293.6 239.277 1294.09L237.288 1293.38C237.643 1292.55 238.117 1291.91 238.709 1291.45C239.306 1290.98 239.957 1290.65 240.662 1290.47C241.372 1290.28 242.07 1290.19 242.757 1290.19C243.195 1290.19 243.698 1290.24 244.266 1290.35C244.84 1290.45 245.394 1290.66 245.926 1290.98C246.465 1291.3 246.912 1291.78 247.267 1292.42C247.622 1293.07 247.8 1293.93 247.8 1295.02V1304H245.704V1302.15H245.598C245.456 1302.45 245.219 1302.77 244.888 1303.1C244.556 1303.44 244.115 1303.73 243.565 1303.96C243.014 1304.2 242.343 1304.32 241.55 1304.32ZM241.869 1302.44C242.698 1302.44 243.396 1302.27 243.964 1301.95C244.538 1301.62 244.97 1301.2 245.26 1300.69C245.556 1300.17 245.704 1299.63 245.704 1299.06V1297.15C245.616 1297.25 245.42 1297.35 245.118 1297.44C244.823 1297.52 244.479 1297.6 244.089 1297.66C243.704 1297.72 243.328 1297.77 242.961 1297.82C242.6 1297.86 242.307 1297.9 242.082 1297.93C241.538 1298 241.029 1298.11 240.555 1298.27C240.088 1298.43 239.709 1298.66 239.419 1298.98C239.135 1299.28 238.993 1299.7 238.993 1300.24C238.993 1300.96 239.262 1301.51 239.801 1301.89C240.345 1302.25 241.035 1302.44 241.869 1302.44ZM257.554 1290.36V1292.14H250.487V1290.36H257.554ZM252.547 1287.1H254.642V1300.09C254.642 1300.69 254.728 1301.13 254.9 1301.43C255.077 1301.72 255.302 1301.91 255.574 1302.01C255.852 1302.11 256.145 1302.15 256.453 1302.15C256.684 1302.15 256.873 1302.14 257.021 1302.12C257.169 1302.09 257.288 1302.06 257.377 1302.05L257.803 1303.93C257.661 1303.98 257.462 1304.04 257.208 1304.09C256.953 1304.15 256.631 1304.18 256.24 1304.18C255.648 1304.18 255.068 1304.05 254.5 1303.8C253.938 1303.54 253.47 1303.15 253.097 1302.63C252.73 1302.11 252.547 1301.46 252.547 1300.66V1287.1ZM266.778 1290.36V1292.14H259.427V1290.36H266.778ZM261.629 1304V1288.48C261.629 1287.7 261.812 1287.05 262.179 1286.53C262.546 1286.01 263.023 1285.62 263.609 1285.36C264.195 1285.1 264.813 1284.97 265.464 1284.97C265.979 1284.97 266.399 1285.01 266.725 1285.09C267.05 1285.17 267.293 1285.25 267.453 1285.32L266.849 1287.13C266.743 1287.1 266.595 1287.05 266.405 1287C266.222 1286.95 265.979 1286.92 265.677 1286.92C264.985 1286.92 264.485 1287.09 264.177 1287.44C263.875 1287.79 263.724 1288.3 263.724 1288.98V1304H261.629ZM274.693 1304.28C273.462 1304.28 272.382 1303.99 271.452 1303.41C270.529 1302.82 269.807 1302 269.286 1300.95C268.771 1299.89 268.514 1298.66 268.514 1297.25C268.514 1295.83 268.771 1294.59 269.286 1293.53C269.807 1292.47 270.529 1291.65 271.452 1291.06C272.382 1290.48 273.462 1290.19 274.693 1290.19C275.924 1290.19 277.001 1290.48 277.924 1291.06C278.853 1291.65 279.576 1292.47 280.09 1293.53C280.611 1294.59 280.872 1295.83 280.872 1297.25C280.872 1298.66 280.611 1299.89 280.09 1300.95C279.576 1302 278.853 1302.82 277.924 1303.41C277.001 1303.99 275.924 1304.28 274.693 1304.28ZM274.693 1302.4C275.628 1302.4 276.397 1302.16 277.001 1301.68C277.605 1301.2 278.052 1300.57 278.342 1299.79C278.632 1299.01 278.777 1298.16 278.777 1297.25C278.777 1296.34 278.632 1295.49 278.342 1294.7C278.052 1293.92 277.605 1293.28 277.001 1292.8C276.397 1292.31 275.628 1292.07 274.693 1292.07C273.758 1292.07 272.988 1292.31 272.384 1292.8C271.781 1293.28 271.334 1293.92 271.044 1294.7C270.754 1295.49 270.609 1296.34 270.609 1297.25C270.609 1298.16 270.754 1299.01 271.044 1299.79C271.334 1300.57 271.781 1301.2 272.384 1301.68C272.988 1302.16 273.758 1302.4 274.693 1302.4ZM284.07 1304V1290.36H286.094V1292.42H286.236C286.485 1291.75 286.935 1291.2 287.586 1290.78C288.237 1290.36 288.971 1290.15 289.787 1290.15C289.941 1290.15 290.134 1290.15 290.364 1290.16C290.595 1290.17 290.77 1290.17 290.888 1290.19V1292.32C290.817 1292.3 290.654 1292.27 290.4 1292.24C290.151 1292.2 289.888 1292.17 289.61 1292.17C288.947 1292.17 288.355 1292.31 287.834 1292.59C287.319 1292.86 286.911 1293.24 286.609 1293.73C286.313 1294.21 286.165 1294.76 286.165 1295.37V1304H284.07ZM293.372 1304V1290.36H295.396V1292.49H295.573C295.858 1291.77 296.316 1291.2 296.949 1290.8C297.583 1290.39 298.343 1290.19 299.231 1290.19C300.131 1290.19 300.879 1290.39 301.477 1290.8C302.081 1291.2 302.551 1291.77 302.889 1292.49H303.031C303.38 1291.79 303.904 1291.23 304.602 1290.82C305.301 1290.4 306.138 1290.19 307.115 1290.19C308.334 1290.19 309.331 1290.57 310.106 1291.33C310.882 1292.09 311.269 1293.27 311.269 1294.87V1304H309.174V1294.87C309.174 1293.87 308.899 1293.15 308.349 1292.72C307.798 1292.28 307.15 1292.07 306.404 1292.07C305.446 1292.07 304.703 1292.36 304.176 1292.94C303.649 1293.51 303.386 1294.24 303.386 1295.12V1304H301.255V1294.66C301.255 1293.89 301.004 1293.26 300.501 1292.79C299.998 1292.31 299.349 1292.07 298.556 1292.07C298.012 1292.07 297.503 1292.21 297.029 1292.5C296.562 1292.79 296.183 1293.2 295.893 1293.71C295.609 1294.22 295.467 1294.81 295.467 1295.48V1304H293.372ZM241.697 1325.36V1327.14H234.63V1325.36H241.697ZM236.69 1322.1H238.785V1335.09C238.785 1335.69 238.871 1336.13 239.043 1336.43C239.22 1336.72 239.445 1336.91 239.717 1337.01C239.996 1337.11 240.289 1337.15 240.596 1337.15C240.827 1337.15 241.016 1337.14 241.164 1337.12C241.312 1337.09 241.431 1337.06 241.52 1337.05L241.946 1338.93C241.804 1338.98 241.605 1339.04 241.351 1339.09C241.096 1339.15 240.774 1339.18 240.383 1339.18C239.791 1339.18 239.211 1339.05 238.643 1338.8C238.081 1338.54 237.613 1338.15 237.24 1337.63C236.874 1337.11 236.69 1336.46 236.69 1335.66V1322.1ZM250.42 1339.28C249.106 1339.28 247.972 1338.99 247.019 1338.41C246.072 1337.83 245.341 1337.01 244.827 1335.96C244.318 1334.91 244.063 1333.69 244.063 1332.29C244.063 1330.89 244.318 1329.66 244.827 1328.6C245.341 1327.52 246.058 1326.69 246.975 1326.09C247.898 1325.49 248.975 1325.19 250.207 1325.19C250.917 1325.19 251.618 1325.3 252.311 1325.54C253.003 1325.78 253.633 1326.16 254.202 1326.7C254.77 1327.22 255.223 1327.92 255.56 1328.79C255.897 1329.66 256.066 1330.73 256.066 1332V1332.89H245.555V1331.08H253.935C253.935 1330.31 253.781 1329.62 253.474 1329.02C253.172 1328.42 252.74 1327.94 252.177 1327.59C251.621 1327.24 250.964 1327.07 250.207 1327.07C249.372 1327.07 248.65 1327.28 248.04 1327.69C247.437 1328.1 246.972 1328.63 246.647 1329.29C246.321 1329.94 246.158 1330.65 246.158 1331.4V1332.61C246.158 1333.64 246.336 1334.51 246.691 1335.23C247.052 1335.94 247.552 1336.48 248.191 1336.85C248.83 1337.22 249.573 1337.4 250.42 1337.4C250.97 1337.4 251.467 1337.33 251.911 1337.17C252.361 1337.01 252.749 1336.77 253.074 1336.46C253.4 1336.14 253.651 1335.74 253.829 1335.27L255.853 1335.84C255.64 1336.53 255.282 1337.13 254.779 1337.65C254.276 1338.17 253.654 1338.57 252.914 1338.86C252.174 1339.14 251.343 1339.28 250.42 1339.28ZM263.266 1339.32C262.402 1339.32 261.618 1339.16 260.913 1338.83C260.209 1338.5 259.65 1338.02 259.235 1337.4C258.821 1336.77 258.614 1336.02 258.614 1335.13C258.614 1334.35 258.768 1333.71 259.076 1333.23C259.383 1332.74 259.795 1332.35 260.31 1332.08C260.824 1331.8 261.393 1331.59 262.014 1331.45C262.641 1331.31 263.272 1331.2 263.905 1331.12C264.734 1331.01 265.405 1330.93 265.92 1330.88C266.441 1330.82 266.82 1330.72 267.057 1330.58C267.299 1330.45 267.421 1330.21 267.421 1329.87V1329.8C267.421 1328.93 267.181 1328.25 266.702 1327.76C266.228 1327.28 265.509 1327.03 264.544 1327.03C263.544 1327.03 262.76 1327.25 262.192 1327.69C261.623 1328.13 261.224 1328.6 260.993 1329.09L259.004 1328.38C259.36 1327.55 259.833 1326.91 260.425 1326.45C261.023 1325.98 261.674 1325.65 262.378 1325.47C263.088 1325.28 263.787 1325.19 264.473 1325.19C264.911 1325.19 265.414 1325.24 265.982 1325.35C266.557 1325.45 267.11 1325.66 267.643 1325.98C268.181 1326.3 268.628 1326.78 268.983 1327.42C269.338 1328.07 269.516 1328.93 269.516 1330.02V1339H267.421V1337.15H267.314C267.172 1337.45 266.935 1337.77 266.604 1338.1C266.272 1338.44 265.832 1338.73 265.281 1338.96C264.731 1339.2 264.059 1339.32 263.266 1339.32ZM263.585 1337.44C264.414 1337.44 265.112 1337.27 265.681 1336.95C266.255 1336.62 266.687 1336.2 266.977 1335.69C267.273 1335.17 267.421 1334.63 267.421 1334.06V1332.15C267.332 1332.25 267.137 1332.35 266.835 1332.44C266.539 1332.52 266.196 1332.6 265.805 1332.66C265.42 1332.72 265.044 1332.77 264.677 1332.82C264.316 1332.86 264.023 1332.9 263.799 1332.93C263.254 1333 262.745 1333.11 262.272 1333.27C261.804 1333.43 261.425 1333.66 261.135 1333.98C260.851 1334.28 260.709 1334.7 260.709 1335.24C260.709 1335.96 260.978 1336.51 261.517 1336.89C262.061 1337.25 262.751 1337.44 263.585 1337.44ZM273.34 1339V1325.36H275.364V1327.49H275.542C275.826 1326.77 276.284 1326.2 276.918 1325.8C277.551 1325.39 278.312 1325.19 279.199 1325.19C280.099 1325.19 280.848 1325.39 281.445 1325.8C282.049 1326.2 282.52 1326.77 282.857 1327.49H282.999C283.348 1326.79 283.872 1326.23 284.57 1325.82C285.269 1325.4 286.106 1325.19 287.083 1325.19C288.302 1325.19 289.299 1325.57 290.075 1326.33C290.85 1327.09 291.238 1328.27 291.238 1329.87V1339H289.143V1329.87C289.143 1328.87 288.867 1328.15 288.317 1327.72C287.766 1327.28 287.118 1327.07 286.373 1327.07C285.414 1327.07 284.671 1327.36 284.144 1327.94C283.618 1328.51 283.354 1329.24 283.354 1330.12V1339H281.223V1329.66C281.223 1328.89 280.972 1328.26 280.469 1327.79C279.966 1327.31 279.318 1327.07 278.525 1327.07C277.98 1327.07 277.471 1327.21 276.998 1327.5C276.53 1327.79 276.151 1328.2 275.861 1328.71C275.577 1329.22 275.435 1329.81 275.435 1330.48V1339H273.34Z" fill="#03031C"/>
+<path d="M253.641 1202.13C253.492 1202.39 253.381 1202.76 253.381 1203.17V1207.89C256.393 1210.12 259.888 1211.27 263.606 1211.27C268.03 1211.27 271.488 1209.6 273.83 1207.89V1203.17C273.83 1202.76 273.756 1202.39 273.57 1202.13C270.707 1204.92 267.249 1206.51 263.568 1206.51C259.962 1206.55 256.504 1204.92 253.641 1202.13Z" fill="#00A3A0"/>
+<path d="M226.35 1249.64C226.201 1249.9 226.09 1250.28 226.09 1250.69V1255.41C229.102 1257.64 232.597 1258.79 236.315 1258.79C240.739 1258.79 244.197 1257.12 246.539 1255.41V1250.69C246.539 1250.28 246.465 1249.9 246.279 1249.64C243.416 1252.43 239.958 1254.03 236.277 1254.03C232.671 1254.07 229.213 1252.43 226.35 1249.64Z" fill="#00A3A0"/>
+<path d="M281.006 1249.64C280.858 1249.9 280.746 1250.28 280.746 1250.69V1255.41C283.758 1257.64 287.253 1258.79 290.971 1258.79C295.395 1258.79 298.853 1257.12 301.196 1255.41V1250.69C301.196 1250.28 301.121 1249.9 300.935 1249.64C298.072 1252.43 294.615 1254.03 290.934 1254.03C287.327 1254.07 283.869 1252.43 281.006 1249.64Z" fill="#00A3A0"/>
+<path d="M263.68 1230.68L254.013 1240.35" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M263.68 1220.01V1230.68L273.236 1240.24" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M241.446 1240.91C241.446 1240.91 246.54 1243.7 248.547 1245.29C249.031 1245.67 249.402 1246.15 249.737 1246.67C250.332 1247.64 250.629 1248.75 250.629 1249.87V1256.52C246.8 1259.87 241.818 1262.03 236.315 1262.03C230.738 1262.03 225.83 1259.94 222 1256.49V1249.83C222 1248.71 222.26 1247.56 222.892 1246.63C223.227 1246.11 223.599 1245.67 224.082 1245.26C226.053 1243.66 231.184 1240.87 231.184 1240.87" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M236.315 1243.58C240.298 1243.58 243.528 1239.57 243.528 1234.62C243.528 1229.67 240.298 1225.66 236.315 1225.66C232.331 1225.66 229.102 1229.67 229.102 1234.62C229.102 1239.57 232.331 1243.58 236.315 1243.58Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M296.176 1240.91C296.176 1240.91 301.27 1243.7 303.278 1245.29C303.761 1245.67 304.133 1246.15 304.468 1246.67C305.062 1247.64 305.36 1248.75 305.36 1249.87V1256.52C301.53 1259.91 296.548 1262.06 291.045 1262.06C285.468 1262.06 280.56 1259.98 276.73 1256.52V1249.87C276.73 1248.75 276.991 1247.6 277.623 1246.67C277.957 1246.15 278.329 1245.7 278.813 1245.29C280.783 1243.7 285.914 1240.91 285.914 1240.91" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M291.008 1243.58C294.992 1243.58 298.221 1239.57 298.221 1234.62C298.221 1229.67 294.992 1225.66 291.008 1225.66C287.024 1225.66 283.795 1229.67 283.795 1234.62C283.795 1239.57 287.024 1243.58 291.008 1243.58Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M268.774 1194.24C268.774 1194.24 273.868 1197.03 275.875 1198.63C276.359 1199 276.731 1199.49 277.065 1200.01C277.66 1200.97 277.958 1202.09 277.958 1203.2V1209.86C274.128 1213.24 269.146 1215.4 263.643 1215.4C258.066 1215.4 253.158 1213.32 249.328 1209.86V1203.17C249.328 1202.05 249.588 1200.9 250.22 1199.97C250.555 1199.45 250.927 1199 251.41 1198.59C253.381 1197 258.512 1194.21 258.512 1194.21" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M263.643 1196.92C267.627 1196.92 270.856 1192.91 270.856 1187.96C270.856 1183.01 267.627 1179 263.643 1179C259.659 1179 256.43 1183.01 256.43 1187.96C256.43 1192.91 259.659 1196.92 263.643 1196.92Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#filter1_bd_12_618)">
+<rect x="159" y="1411" width="210" height="225" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="159.5" y="1411.5" width="209" height="224" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M246.758 1567H244.449L251.125 1548.82H253.398L260.074 1567H257.766L252.333 1551.69H252.191L246.758 1567ZM247.61 1559.9H256.914V1561.85H247.61V1559.9ZM262.906 1567V1548.82H269.05C270.476 1548.82 271.642 1549.08 272.548 1549.59C273.459 1550.1 274.134 1550.79 274.572 1551.66C275.01 1552.53 275.229 1553.5 275.229 1554.57C275.229 1555.64 275.01 1556.62 274.572 1557.49C274.14 1558.37 273.471 1559.07 272.565 1559.59C271.66 1560.1 270.5 1560.36 269.085 1560.36H264.682V1558.41H269.014C269.991 1558.41 270.775 1558.24 271.367 1557.9C271.959 1557.56 272.388 1557.11 272.654 1556.53C272.926 1555.95 273.063 1555.3 273.063 1554.57C273.063 1553.84 272.926 1553.19 272.654 1552.62C272.388 1552.04 271.956 1551.59 271.358 1551.27C270.76 1550.94 269.967 1550.77 268.979 1550.77H265.108V1567H262.906ZM280.977 1548.82V1567H278.775V1548.82H280.977ZM211.778 1602.28C210.641 1602.28 209.638 1602 208.768 1601.42C207.898 1600.84 207.217 1600.03 206.726 1598.97C206.235 1597.91 205.989 1596.66 205.989 1595.22C205.989 1593.79 206.235 1592.54 206.726 1591.49C207.217 1590.44 207.901 1589.62 208.777 1589.05C209.653 1588.47 210.665 1588.19 211.813 1588.19C212.701 1588.19 213.402 1588.33 213.917 1588.63C214.438 1588.92 214.835 1589.25 215.107 1589.62C215.385 1589.99 215.601 1590.29 215.755 1590.53H215.933V1583.82H218.028V1602H216.004V1599.9H215.755C215.601 1600.15 215.382 1600.47 215.098 1600.85C214.814 1601.22 214.408 1601.55 213.882 1601.85C213.355 1602.14 212.654 1602.28 211.778 1602.28ZM212.062 1600.4C212.902 1600.4 213.612 1600.18 214.192 1599.75C214.772 1599.3 215.213 1598.69 215.515 1597.91C215.817 1597.12 215.968 1596.21 215.968 1595.18C215.968 1594.16 215.82 1593.27 215.524 1592.51C215.228 1591.74 214.79 1591.14 214.21 1590.72C213.63 1590.28 212.914 1590.07 212.062 1590.07C211.174 1590.07 210.434 1590.3 209.842 1590.75C209.256 1591.2 208.815 1591.81 208.52 1592.59C208.23 1593.36 208.085 1594.22 208.085 1595.18C208.085 1596.15 208.232 1597.03 208.528 1597.83C208.83 1598.61 209.274 1599.24 209.86 1599.71C210.452 1600.17 211.186 1600.4 212.062 1600.4ZM227.873 1602.28C226.559 1602.28 225.426 1601.99 224.473 1601.41C223.526 1600.83 222.795 1600.01 222.28 1598.96C221.771 1597.91 221.517 1596.69 221.517 1595.29C221.517 1593.89 221.771 1592.66 222.28 1591.6C222.795 1590.52 223.511 1589.69 224.429 1589.09C225.352 1588.49 226.429 1588.19 227.66 1588.19C228.37 1588.19 229.072 1588.3 229.764 1588.54C230.457 1588.78 231.087 1589.16 231.655 1589.7C232.223 1590.22 232.676 1590.92 233.013 1591.79C233.351 1592.66 233.52 1593.73 233.52 1595V1595.89H223.008V1594.08H231.389C231.389 1593.31 231.235 1592.62 230.927 1592.02C230.625 1591.42 230.193 1590.94 229.631 1590.59C229.075 1590.24 228.418 1590.07 227.66 1590.07C226.826 1590.07 226.104 1590.28 225.494 1590.69C224.89 1591.1 224.426 1591.63 224.1 1592.29C223.775 1592.94 223.612 1593.65 223.612 1594.4V1595.61C223.612 1596.64 223.789 1597.51 224.145 1598.23C224.506 1598.94 225.006 1599.48 225.645 1599.85C226.284 1600.22 227.027 1600.4 227.873 1600.4C228.424 1600.4 228.921 1600.33 229.365 1600.17C229.815 1600.01 230.202 1599.77 230.528 1599.46C230.853 1599.14 231.105 1598.74 231.282 1598.27L233.306 1598.84C233.093 1599.53 232.735 1600.13 232.232 1600.65C231.729 1601.17 231.108 1601.57 230.368 1601.86C229.628 1602.14 228.797 1602.28 227.873 1602.28ZM247.442 1588.36L242.4 1602H240.269L235.226 1588.36H237.499L241.263 1599.23H241.405L245.169 1588.36H247.442ZM255.437 1602.28C254.123 1602.28 252.989 1601.99 252.036 1601.41C251.09 1600.83 250.359 1600.01 249.844 1598.96C249.335 1597.91 249.08 1596.69 249.08 1595.29C249.08 1593.89 249.335 1592.66 249.844 1591.6C250.359 1590.52 251.075 1589.69 251.992 1589.09C252.915 1588.49 253.993 1588.19 255.224 1588.19C255.934 1588.19 256.635 1588.3 257.328 1588.54C258.02 1588.78 258.65 1589.16 259.219 1589.7C259.787 1590.22 260.24 1590.92 260.577 1591.79C260.914 1592.66 261.083 1593.73 261.083 1595V1595.89H250.572V1594.08H258.952C258.952 1593.31 258.798 1592.62 258.491 1592.02C258.189 1591.42 257.757 1590.94 257.195 1590.59C256.638 1590.24 255.981 1590.07 255.224 1590.07C254.389 1590.07 253.667 1590.28 253.057 1590.69C252.454 1591.1 251.989 1591.63 251.664 1592.29C251.338 1592.94 251.175 1593.65 251.175 1594.4V1595.61C251.175 1596.64 251.353 1597.51 251.708 1598.23C252.069 1598.94 252.569 1599.48 253.208 1599.85C253.848 1600.22 254.59 1600.4 255.437 1600.4C255.987 1600.4 256.484 1600.33 256.928 1600.17C257.378 1600.01 257.766 1599.77 258.091 1599.46C258.417 1599.14 258.668 1598.74 258.846 1598.27L260.87 1598.84C260.657 1599.53 260.299 1600.13 259.796 1600.65C259.293 1601.17 258.671 1601.57 257.931 1601.86C257.192 1602.14 256.36 1602.28 255.437 1602.28ZM266.365 1583.82V1602H264.27V1583.82H266.365ZM275.743 1602.28C274.511 1602.28 273.431 1601.99 272.502 1601.41C271.579 1600.82 270.857 1600 270.336 1598.95C269.821 1597.89 269.564 1596.66 269.564 1595.25C269.564 1593.83 269.821 1592.59 270.336 1591.53C270.857 1590.47 271.579 1589.65 272.502 1589.06C273.431 1588.48 274.511 1588.19 275.743 1588.19C276.974 1588.19 278.051 1588.48 278.974 1589.06C279.903 1589.65 280.625 1590.47 281.14 1591.53C281.661 1592.59 281.922 1593.83 281.922 1595.25C281.922 1596.66 281.661 1597.89 281.14 1598.95C280.625 1600 279.903 1600.82 278.974 1601.41C278.051 1601.99 276.974 1602.28 275.743 1602.28ZM275.743 1600.4C276.678 1600.4 277.447 1600.16 278.051 1599.68C278.654 1599.2 279.101 1598.57 279.391 1597.79C279.681 1597.01 279.826 1596.16 279.826 1595.25C279.826 1594.34 279.681 1593.49 279.391 1592.7C279.101 1591.92 278.654 1591.28 278.051 1590.8C277.447 1590.31 276.678 1590.07 275.743 1590.07C274.807 1590.07 274.038 1590.31 273.434 1590.8C272.831 1591.28 272.384 1591.92 272.094 1592.7C271.804 1593.49 271.659 1594.34 271.659 1595.25C271.659 1596.16 271.804 1597.01 272.094 1597.79C272.384 1598.57 272.831 1599.2 273.434 1599.68C274.038 1600.16 274.807 1600.4 275.743 1600.4ZM285.12 1607.11V1588.36H287.144V1590.53H287.392C287.546 1590.29 287.759 1589.99 288.032 1589.62C288.31 1589.25 288.706 1588.92 289.221 1588.63C289.742 1588.33 290.446 1588.19 291.334 1588.19C292.482 1588.19 293.495 1588.47 294.37 1589.05C295.246 1589.62 295.93 1590.44 296.421 1591.49C296.912 1592.54 297.158 1593.79 297.158 1595.22C297.158 1596.66 296.912 1597.91 296.421 1598.97C295.93 1600.03 295.249 1600.84 294.379 1601.42C293.509 1602 292.506 1602.28 291.37 1602.28C290.494 1602.28 289.792 1602.14 289.266 1601.85C288.739 1601.55 288.334 1601.22 288.049 1600.85C287.765 1600.47 287.546 1600.15 287.392 1599.9H287.215V1607.11H285.12ZM287.179 1595.18C287.179 1596.21 287.33 1597.12 287.632 1597.91C287.934 1598.69 288.375 1599.3 288.955 1599.75C289.535 1600.18 290.245 1600.4 291.086 1600.4C291.962 1600.4 292.693 1600.17 293.278 1599.71C293.87 1599.24 294.314 1598.61 294.61 1597.83C294.912 1597.03 295.063 1596.15 295.063 1595.18C295.063 1594.22 294.915 1593.36 294.619 1592.59C294.329 1591.81 293.888 1591.2 293.296 1590.75C292.71 1590.3 291.973 1590.07 291.086 1590.07C290.233 1590.07 289.517 1590.28 288.937 1590.72C288.357 1591.14 287.919 1591.74 287.623 1592.51C287.327 1593.27 287.179 1594.16 287.179 1595.18ZM306.071 1602.28C304.758 1602.28 303.624 1601.99 302.671 1601.41C301.724 1600.83 300.993 1600.01 300.478 1598.96C299.969 1597.91 299.715 1596.69 299.715 1595.29C299.715 1593.89 299.969 1592.66 300.478 1591.6C300.993 1590.52 301.709 1589.69 302.627 1589.09C303.55 1588.49 304.627 1588.19 305.858 1588.19C306.569 1588.19 307.27 1588.3 307.962 1588.54C308.655 1588.78 309.285 1589.16 309.853 1589.7C310.422 1590.22 310.874 1590.92 311.212 1591.79C311.549 1592.66 311.718 1593.73 311.718 1595V1595.89H301.206V1594.08H309.587C309.587 1593.31 309.433 1592.62 309.125 1592.02C308.824 1591.42 308.392 1590.94 307.829 1590.59C307.273 1590.24 306.616 1590.07 305.858 1590.07C305.024 1590.07 304.302 1590.28 303.692 1590.69C303.089 1591.1 302.624 1591.63 302.298 1592.29C301.973 1592.94 301.81 1593.65 301.81 1594.4V1595.61C301.81 1596.64 301.988 1597.51 302.343 1598.23C302.704 1598.94 303.204 1599.48 303.843 1599.85C304.482 1600.22 305.225 1600.4 306.071 1600.4C306.622 1600.4 307.119 1600.33 307.563 1600.17C308.013 1600.01 308.4 1599.77 308.726 1599.46C309.051 1599.14 309.303 1598.74 309.481 1598.27L311.505 1598.84C311.292 1599.53 310.934 1600.13 310.43 1600.65C309.927 1601.17 309.306 1601.57 308.566 1601.86C307.826 1602.14 306.995 1602.28 306.071 1602.28ZM314.905 1602V1588.36H316.929V1590.42H317.071C317.32 1589.75 317.77 1589.2 318.421 1588.78C319.072 1588.36 319.805 1588.15 320.622 1588.15C320.776 1588.15 320.968 1588.15 321.199 1588.16C321.43 1588.17 321.605 1588.17 321.723 1588.19V1590.32C321.652 1590.3 321.489 1590.27 321.235 1590.24C320.986 1590.2 320.723 1590.17 320.445 1590.17C319.782 1590.17 319.19 1590.31 318.669 1590.59C318.154 1590.86 317.746 1591.24 317.444 1591.73C317.148 1592.21 317 1592.76 317 1593.37V1602H314.905Z" fill="#03031C"/>
+<g filter="url(#filter2_bd_12_618)">
+<rect x="466" y="110" width="844" height="656" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="467" y="111" width="842" height="654" rx="19" stroke="#8438FA" stroke-width="2" shape-rendering="crispEdges"/>
+</g>
+<path d="M508.065 701.985V698.182H525.984V701.985H519.305V720H514.745V701.985H508.065ZM529.777 726.136C529.202 726.136 528.662 726.09 528.158 725.998C527.661 725.913 527.249 725.803 526.922 725.668L527.945 722.28C528.477 722.443 528.957 722.532 529.383 722.546C529.816 722.56 530.189 722.461 530.501 722.248C530.821 722.035 531.08 721.673 531.279 721.161L531.545 720.469L525.675 703.636H530.448L533.836 715.653H534.006L537.426 703.636H542.231L535.871 721.768C535.565 722.649 535.15 723.416 534.624 724.07C534.106 724.73 533.449 725.238 532.653 725.593C531.858 725.955 530.899 726.136 529.777 726.136ZM548.665 715.291L548.676 709.847H549.337L554.578 703.636H559.788L552.746 711.861H551.67L548.665 715.291ZM544.553 720V698.182H549.092V720H544.553ZM554.781 720L549.965 712.873L552.991 709.666L560.097 720H554.781ZM576.777 720H569.043V698.182H576.841C579.036 698.182 580.925 698.619 582.509 699.492C584.093 700.359 585.311 701.605 586.163 703.232C587.022 704.858 587.452 706.804 587.452 709.07C587.452 711.342 587.022 713.295 586.163 714.929C585.311 716.562 584.085 717.816 582.487 718.69C580.896 719.563 578.993 720 576.777 720ZM573.656 716.048H576.585C577.949 716.048 579.096 715.806 580.026 715.323C580.964 714.833 581.667 714.077 582.136 713.054C582.612 712.024 582.85 710.696 582.85 709.07C582.85 707.457 582.612 706.14 582.136 705.117C581.667 704.094 580.968 703.342 580.037 702.859C579.107 702.376 577.96 702.134 576.596 702.134H573.656V716.048ZM595.45 720.309C594.406 720.309 593.475 720.128 592.659 719.766C591.842 719.396 591.196 718.853 590.72 718.136C590.251 717.411 590.017 716.509 590.017 715.43C590.017 714.521 590.184 713.757 590.517 713.139C590.851 712.521 591.306 712.024 591.881 711.648C592.456 711.271 593.11 710.987 593.841 710.795C594.58 710.604 595.354 710.469 596.164 710.391C597.115 710.291 597.882 710.199 598.465 710.114C599.047 710.021 599.47 709.886 599.733 709.709C599.995 709.531 600.127 709.268 600.127 708.92V708.857C600.127 708.182 599.914 707.66 599.488 707.29C599.069 706.921 598.472 706.737 597.698 706.737C596.881 706.737 596.231 706.918 595.748 707.28C595.265 707.635 594.946 708.082 594.789 708.622L590.592 708.281C590.805 707.287 591.224 706.428 591.849 705.703C592.474 704.972 593.28 704.411 594.267 704.02C595.262 703.622 596.412 703.423 597.719 703.423C598.628 703.423 599.498 703.53 600.329 703.743C601.167 703.956 601.909 704.286 602.556 704.734C603.209 705.181 603.724 705.756 604.1 706.46C604.477 707.156 604.665 707.99 604.665 708.963V720H600.361V717.731H600.233C599.971 718.242 599.619 718.693 599.179 719.084C598.738 719.467 598.209 719.769 597.591 719.989C596.973 720.202 596.26 720.309 595.45 720.309ZM596.75 717.177C597.417 717.177 598.007 717.045 598.518 716.783C599.029 716.513 599.431 716.151 599.722 715.696C600.013 715.241 600.159 714.727 600.159 714.151V712.415C600.017 712.507 599.821 712.592 599.573 712.67C599.331 712.741 599.058 712.809 598.752 712.873C598.447 712.93 598.142 712.983 597.836 713.033C597.531 713.075 597.254 713.114 597.005 713.15C596.473 713.228 596.007 713.352 595.61 713.523C595.212 713.693 594.903 713.924 594.683 714.215C594.463 714.499 594.353 714.854 594.353 715.281C594.353 715.898 594.576 716.371 595.024 716.697C595.478 717.017 596.054 717.177 596.75 717.177ZM621.801 708.303L617.646 708.558C617.575 708.203 617.423 707.884 617.188 707.599C616.954 707.308 616.645 707.077 616.261 706.907C615.885 706.729 615.434 706.641 614.908 706.641C614.205 706.641 613.612 706.79 613.129 707.088C612.646 707.379 612.405 707.77 612.405 708.26C612.405 708.651 612.561 708.981 612.874 709.251C613.186 709.521 613.722 709.737 614.482 709.901L617.444 710.497C619.035 710.824 620.221 711.349 621.002 712.074C621.783 712.798 622.174 713.75 622.174 714.929C622.174 716.001 621.858 716.942 621.226 717.752C620.601 718.562 619.741 719.194 618.648 719.648C617.561 720.096 616.308 720.32 614.887 720.32C612.721 720.32 610.995 719.869 609.71 718.967C608.431 718.058 607.682 716.822 607.462 715.259L611.925 715.025C612.06 715.685 612.387 716.19 612.906 716.538C613.424 716.879 614.088 717.049 614.898 717.049C615.693 717.049 616.332 716.896 616.815 716.591C617.305 716.278 617.554 715.877 617.561 715.387C617.554 714.975 617.38 714.638 617.039 714.375C616.698 714.105 616.173 713.899 615.462 713.757L612.629 713.192C611.031 712.873 609.841 712.319 609.06 711.531C608.286 710.742 607.898 709.737 607.898 708.516C607.898 707.464 608.183 706.559 608.751 705.799C609.326 705.039 610.132 704.453 611.169 704.041C612.213 703.629 613.435 703.423 614.834 703.423C616.901 703.423 618.527 703.86 619.713 704.734C620.906 705.607 621.602 706.797 621.801 708.303ZM629.57 710.54V720H625.032V698.182H629.442V706.523H629.634C630.003 705.558 630.6 704.801 631.424 704.254C632.248 703.7 633.281 703.423 634.524 703.423C635.66 703.423 636.651 703.672 637.496 704.169C638.349 704.659 639.009 705.366 639.478 706.289C639.954 707.205 640.188 708.303 640.181 709.581V720H635.643V710.391C635.65 709.382 635.394 708.597 634.876 708.036C634.364 707.475 633.647 707.195 632.724 707.195C632.106 707.195 631.559 707.326 631.083 707.589C630.614 707.852 630.245 708.235 629.975 708.739C629.712 709.237 629.577 709.837 629.57 710.54ZM643.838 720V698.182H648.376V706.385H648.515C648.713 705.945 649.001 705.497 649.377 705.043C649.761 704.581 650.258 704.197 650.869 703.892C651.487 703.58 652.254 703.423 653.17 703.423C654.363 703.423 655.464 703.736 656.473 704.361C657.481 704.979 658.287 705.913 658.891 707.163C659.495 708.406 659.797 709.964 659.797 711.839C659.797 713.665 659.502 715.206 658.912 716.463C658.33 717.713 657.534 718.661 656.526 719.308C655.525 719.947 654.402 720.266 653.159 720.266C652.279 720.266 651.529 720.121 650.912 719.83C650.301 719.538 649.8 719.173 649.409 718.732C649.019 718.285 648.721 717.834 648.515 717.379H648.312V720H643.838ZM648.28 711.818C648.28 712.791 648.415 713.64 648.685 714.364C648.955 715.089 649.346 715.653 649.857 716.058C650.368 716.456 650.99 716.655 651.721 716.655C652.46 716.655 653.085 716.452 653.596 716.048C654.108 715.636 654.495 715.067 654.757 714.343C655.027 713.612 655.162 712.77 655.162 711.818C655.162 710.874 655.031 710.043 654.768 709.325C654.505 708.608 654.118 708.047 653.607 707.642C653.096 707.237 652.467 707.035 651.721 707.035C650.983 707.035 650.358 707.23 649.846 707.621C649.342 708.011 648.955 708.565 648.685 709.283C648.415 710 648.28 710.845 648.28 711.818ZM670.218 720.32C668.563 720.32 667.132 719.968 665.925 719.265C664.725 718.555 663.798 717.567 663.144 716.303C662.491 715.032 662.164 713.558 662.164 711.882C662.164 710.192 662.491 708.714 663.144 707.45C663.798 706.179 664.725 705.192 665.925 704.489C667.132 703.778 668.563 703.423 670.218 703.423C671.873 703.423 673.301 703.778 674.501 704.489C675.708 705.192 676.639 706.179 677.292 707.45C677.945 708.714 678.272 710.192 678.272 711.882C678.272 713.558 677.945 715.032 677.292 716.303C676.639 717.567 675.708 718.555 674.501 719.265C673.301 719.968 671.873 720.32 670.218 720.32ZM670.24 716.804C670.992 716.804 671.621 716.591 672.125 716.165C672.629 715.732 673.009 715.142 673.265 714.396C673.528 713.651 673.659 712.802 673.659 711.85C673.659 710.898 673.528 710.05 673.265 709.304C673.009 708.558 672.629 707.969 672.125 707.536C671.621 707.102 670.992 706.886 670.24 706.886C669.48 706.886 668.84 707.102 668.322 707.536C667.811 707.969 667.423 708.558 667.161 709.304C666.905 710.05 666.777 710.898 666.777 711.85C666.777 712.802 666.905 713.651 667.161 714.396C667.423 715.142 667.811 715.732 668.322 716.165C668.84 716.591 669.48 716.804 670.24 716.804ZM685.889 720.309C684.845 720.309 683.915 720.128 683.098 719.766C682.281 719.396 681.635 718.853 681.159 718.136C680.691 717.411 680.456 716.509 680.456 715.43C680.456 714.521 680.623 713.757 680.957 713.139C681.291 712.521 681.745 712.024 682.32 711.648C682.896 711.271 683.549 710.987 684.281 710.795C685.019 710.604 685.794 710.469 686.603 710.391C687.555 710.291 688.322 710.199 688.904 710.114C689.487 710.021 689.909 709.886 690.172 709.709C690.435 709.531 690.566 709.268 690.566 708.92V708.857C690.566 708.182 690.353 707.66 689.927 707.29C689.508 706.921 688.911 706.737 688.137 706.737C687.32 706.737 686.671 706.918 686.188 707.28C685.705 707.635 685.385 708.082 685.229 708.622L681.031 708.281C681.244 707.287 681.664 706.428 682.289 705.703C682.914 704.972 683.72 704.411 684.707 704.02C685.701 703.622 686.852 703.423 688.159 703.423C689.068 703.423 689.938 703.53 690.769 703.743C691.607 703.956 692.349 704.286 692.995 704.734C693.649 705.181 694.164 705.756 694.54 706.46C694.916 707.156 695.105 707.99 695.105 708.963V720H690.801V717.731H690.673C690.41 718.242 690.058 718.693 689.618 719.084C689.178 719.467 688.649 719.769 688.031 719.989C687.413 720.202 686.699 720.309 685.889 720.309ZM687.189 717.177C687.857 717.177 688.446 717.045 688.958 716.783C689.469 716.513 689.87 716.151 690.161 715.696C690.453 715.241 690.598 714.727 690.598 714.151V712.415C690.456 712.507 690.261 712.592 690.012 712.67C689.771 712.741 689.497 712.809 689.192 712.873C688.887 712.93 688.581 712.983 688.276 713.033C687.97 713.075 687.693 713.114 687.445 713.15C686.912 713.228 686.447 713.352 686.049 713.523C685.651 713.693 685.343 713.924 685.122 714.215C684.902 714.499 684.792 714.854 684.792 715.281C684.792 715.898 685.016 716.371 685.463 716.697C685.918 717.017 686.493 717.177 687.189 717.177ZM698.626 720V703.636H703.025V706.491H703.196C703.494 705.476 703.995 704.709 704.698 704.19C705.401 703.665 706.211 703.402 707.127 703.402C707.354 703.402 707.599 703.416 707.862 703.445C708.125 703.473 708.356 703.512 708.555 703.562V707.589C708.341 707.525 708.047 707.468 707.67 707.418C707.294 707.369 706.949 707.344 706.637 707.344C705.969 707.344 705.373 707.489 704.847 707.781C704.329 708.065 703.917 708.462 703.611 708.974C703.313 709.485 703.164 710.075 703.164 710.742V720H698.626ZM716.169 720.266C714.926 720.266 713.8 719.947 712.792 719.308C711.79 718.661 710.995 717.713 710.406 716.463C709.823 715.206 709.532 713.665 709.532 711.839C709.532 709.964 709.834 708.406 710.438 707.163C711.041 705.913 711.844 704.979 712.845 704.361C713.854 703.736 714.958 703.423 716.158 703.423C717.075 703.423 717.838 703.58 718.449 703.892C719.067 704.197 719.564 704.581 719.94 705.043C720.324 705.497 720.615 705.945 720.814 706.385H720.952V698.182H725.48V720H721.006V717.379H720.814C720.601 717.834 720.299 718.285 719.908 718.732C719.525 719.173 719.024 719.538 718.406 719.83C717.795 720.121 717.05 720.266 716.169 720.266ZM717.607 716.655C718.339 716.655 718.957 716.456 719.461 716.058C719.972 715.653 720.363 715.089 720.633 714.364C720.91 713.64 721.048 712.791 721.048 711.818C721.048 710.845 720.913 710 720.643 709.283C720.374 708.565 719.983 708.011 719.472 707.621C718.96 707.23 718.339 707.035 717.607 707.035C716.862 707.035 716.233 707.237 715.722 707.642C715.21 708.047 714.823 708.608 714.56 709.325C714.298 710.043 714.166 710.874 714.166 711.818C714.166 712.77 714.298 713.612 714.56 714.343C714.83 715.067 715.217 715.636 715.722 716.048C716.233 716.452 716.862 716.655 717.607 716.655Z" fill="#8438FA"/>
+<g filter="url(#filter3_bd_12_618)">
+<rect x="466" y="913" width="844" height="796" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="467" y="914" width="842" height="794" rx="19" stroke="#335FFD" stroke-width="2" shape-rendering="crispEdges"/>
+</g>
+<path d="M508.896 1668V1646.18H513.509V1655.8H513.797L521.648 1646.18H527.178L519.081 1655.95L527.273 1668H521.755L515.778 1659.03L513.509 1661.8V1668H508.896ZM538.963 1661.03V1651.64H543.501V1668H539.144V1665.03H538.974C538.604 1665.99 537.99 1666.76 537.131 1667.34C536.278 1667.92 535.238 1668.21 534.009 1668.21C532.915 1668.21 531.953 1667.96 531.122 1667.47C530.291 1666.97 529.641 1666.26 529.172 1665.35C528.711 1664.43 528.476 1663.33 528.469 1662.06V1651.64H533.008V1661.25C533.015 1662.21 533.274 1662.98 533.785 1663.54C534.297 1664.1 534.982 1664.38 535.841 1664.38C536.388 1664.38 536.9 1664.25 537.376 1664C537.851 1663.75 538.235 1663.37 538.526 1662.88C538.824 1662.38 538.97 1661.76 538.963 1661.03ZM547.217 1668V1646.18H551.755V1654.38H551.893C552.092 1653.94 552.38 1653.5 552.756 1653.04C553.14 1652.58 553.637 1652.2 554.248 1651.89C554.866 1651.58 555.633 1651.42 556.549 1651.42C557.742 1651.42 558.843 1651.74 559.852 1652.36C560.86 1652.98 561.666 1653.91 562.27 1655.16C562.874 1656.41 563.175 1657.96 563.175 1659.84C563.175 1661.66 562.881 1663.21 562.291 1664.46C561.709 1665.71 560.913 1666.66 559.905 1667.31C558.903 1667.95 557.781 1668.27 556.538 1668.27C555.658 1668.27 554.908 1668.12 554.29 1667.83C553.68 1667.54 553.179 1667.17 552.788 1666.73C552.398 1666.28 552.099 1665.83 551.893 1665.38H551.691V1668H547.217ZM551.659 1659.82C551.659 1660.79 551.794 1661.64 552.064 1662.36C552.334 1663.09 552.724 1663.65 553.236 1664.06C553.747 1664.46 554.369 1664.65 555.1 1664.65C555.839 1664.65 556.464 1664.45 556.975 1664.05C557.487 1663.64 557.874 1663.07 558.136 1662.34C558.406 1661.61 558.541 1660.77 558.541 1659.82C558.541 1658.87 558.41 1658.04 558.147 1657.33C557.884 1656.61 557.497 1656.05 556.986 1655.64C556.474 1655.24 555.846 1655.03 555.1 1655.03C554.362 1655.03 553.737 1655.23 553.225 1655.62C552.721 1656.01 552.334 1656.57 552.064 1657.28C551.794 1658 551.659 1658.85 551.659 1659.82ZM573.661 1668.32C571.978 1668.32 570.529 1667.98 569.314 1667.3C568.107 1666.61 567.177 1665.63 566.523 1664.38C565.87 1663.11 565.543 1661.62 565.543 1659.89C565.543 1658.21 565.87 1656.73 566.523 1655.46C567.177 1654.19 568.096 1653.2 569.282 1652.49C570.476 1651.78 571.875 1651.42 573.48 1651.42C574.559 1651.42 575.564 1651.6 576.495 1651.95C577.432 1652.29 578.249 1652.8 578.945 1653.49C579.648 1654.18 580.195 1655.05 580.586 1656.09C580.976 1657.13 581.172 1658.34 581.172 1659.73V1660.98H567.354V1658.17H576.9C576.9 1657.51 576.758 1656.93 576.474 1656.43C576.189 1655.93 575.795 1655.53 575.291 1655.25C574.794 1654.96 574.215 1654.81 573.555 1654.81C572.866 1654.81 572.255 1654.97 571.722 1655.29C571.197 1655.6 570.785 1656.03 570.486 1656.56C570.188 1657.08 570.035 1657.67 570.028 1658.32V1660.99C570.028 1661.8 570.177 1662.5 570.476 1663.09C570.781 1663.68 571.211 1664.13 571.765 1664.45C572.319 1664.77 572.976 1664.93 573.736 1664.93C574.24 1664.93 574.702 1664.86 575.121 1664.72C575.54 1664.58 575.898 1664.36 576.197 1664.08C576.495 1663.8 576.722 1663.45 576.878 1663.04L581.076 1663.31C580.863 1664.32 580.426 1665.2 579.765 1665.95C579.112 1666.7 578.267 1667.28 577.23 1667.7C576.2 1668.11 575.01 1668.32 573.661 1668.32ZM584.133 1668V1651.64H588.533V1654.49H588.704C589.002 1653.48 589.503 1652.71 590.206 1652.19C590.909 1651.66 591.719 1651.4 592.635 1651.4C592.862 1651.4 593.107 1651.42 593.37 1651.44C593.633 1651.47 593.863 1651.51 594.062 1651.56V1655.59C593.849 1655.52 593.555 1655.47 593.178 1655.42C592.802 1655.37 592.457 1655.34 592.145 1655.34C591.477 1655.34 590.881 1655.49 590.355 1655.78C589.836 1656.06 589.425 1656.46 589.119 1656.97C588.821 1657.49 588.672 1658.07 588.672 1658.74V1668H584.133ZM600.947 1658.54V1668H596.409V1651.64H600.734V1654.52H600.926C601.288 1653.57 601.895 1652.82 602.748 1652.26C603.6 1651.7 604.633 1651.42 605.848 1651.42C606.984 1651.42 607.975 1651.67 608.82 1652.17C609.665 1652.67 610.322 1653.38 610.791 1654.3C611.26 1655.22 611.494 1656.31 611.494 1657.58V1668H606.956V1658.39C606.963 1657.39 606.707 1656.61 606.189 1656.05C605.67 1655.48 604.956 1655.19 604.047 1655.19C603.436 1655.19 602.897 1655.33 602.428 1655.59C601.966 1655.85 601.604 1656.24 601.341 1656.74C601.086 1657.24 600.954 1657.84 600.947 1658.54ZM622.528 1668.32C620.845 1668.32 619.396 1667.98 618.182 1667.3C616.974 1666.61 616.044 1665.63 615.39 1664.38C614.737 1663.11 614.41 1661.62 614.41 1659.89C614.41 1658.21 614.737 1656.73 615.39 1655.46C616.044 1654.19 616.964 1653.2 618.15 1652.49C619.343 1651.78 620.742 1651.42 622.347 1651.42C623.427 1651.42 624.432 1651.6 625.362 1651.95C626.3 1652.29 627.116 1652.8 627.812 1653.49C628.515 1654.18 629.062 1655.05 629.453 1656.09C629.844 1657.13 630.039 1658.34 630.039 1659.73V1660.98H616.221V1658.17H625.767C625.767 1657.51 625.625 1656.93 625.341 1656.43C625.057 1655.93 624.662 1655.53 624.158 1655.25C623.661 1654.96 623.082 1654.81 622.422 1654.81C621.733 1654.81 621.122 1654.97 620.589 1655.29C620.064 1655.6 619.652 1656.03 619.354 1656.56C619.055 1657.08 618.903 1657.67 618.895 1658.32V1660.99C618.895 1661.8 619.045 1662.5 619.343 1663.09C619.648 1663.68 620.078 1664.13 620.632 1664.45C621.186 1664.77 621.843 1664.93 622.603 1664.93C623.107 1664.93 623.569 1664.86 623.988 1664.72C624.407 1664.58 624.765 1664.36 625.064 1664.08C625.362 1663.8 625.589 1663.45 625.746 1663.04L629.943 1663.31C629.73 1664.32 629.293 1665.2 628.633 1665.95C627.979 1666.7 627.134 1667.28 626.097 1667.7C625.067 1668.11 623.878 1668.32 622.528 1668.32ZM641.704 1651.64V1655.05H631.85V1651.64H641.704ZM634.087 1647.72H638.626V1662.97C638.626 1663.39 638.689 1663.72 638.817 1663.95C638.945 1664.18 639.123 1664.34 639.35 1664.43C639.584 1664.52 639.854 1664.57 640.16 1664.57C640.373 1664.57 640.586 1664.55 640.799 1664.52C641.012 1664.47 641.175 1664.44 641.289 1664.42L642.003 1667.8C641.775 1667.87 641.456 1667.95 641.044 1668.04C640.632 1668.14 640.131 1668.2 639.542 1668.22C638.448 1668.27 637.489 1668.12 636.665 1667.79C635.849 1667.45 635.213 1666.93 634.758 1666.23C634.304 1665.53 634.08 1664.64 634.087 1663.57V1647.72ZM651.942 1668.32C650.259 1668.32 648.81 1667.98 647.596 1667.3C646.388 1666.61 645.458 1665.63 644.805 1664.38C644.151 1663.11 643.824 1661.62 643.824 1659.89C643.824 1658.21 644.151 1656.73 644.805 1655.46C645.458 1654.19 646.378 1653.2 647.564 1652.49C648.757 1651.78 650.156 1651.42 651.761 1651.42C652.841 1651.42 653.846 1651.6 654.776 1651.95C655.714 1652.29 656.53 1652.8 657.226 1653.49C657.93 1654.18 658.476 1655.05 658.867 1656.09C659.258 1657.13 659.453 1658.34 659.453 1659.73V1660.98H645.635V1658.17H655.181C655.181 1657.51 655.039 1656.93 654.755 1656.43C654.471 1655.93 654.077 1655.53 653.572 1655.25C653.075 1654.96 652.496 1654.81 651.836 1654.81C651.147 1654.81 650.536 1654.97 650.003 1655.29C649.478 1655.6 649.066 1656.03 648.768 1656.56C648.469 1657.08 648.317 1657.67 648.309 1658.32V1660.99C648.309 1661.8 648.459 1662.5 648.757 1663.09C649.062 1663.68 649.492 1664.13 650.046 1664.45C650.6 1664.77 651.257 1664.93 652.017 1664.93C652.521 1664.93 652.983 1664.86 653.402 1664.72C653.821 1664.58 654.18 1664.36 654.478 1664.08C654.776 1663.8 655.003 1663.45 655.16 1663.04L659.357 1663.31C659.144 1664.32 658.707 1665.2 658.047 1665.95C657.393 1666.7 656.548 1667.28 655.511 1667.7C654.481 1668.11 653.292 1668.32 651.942 1668.32ZM676.03 1656.3L671.875 1656.56C671.804 1656.2 671.651 1655.88 671.417 1655.6C671.182 1655.31 670.873 1655.08 670.49 1654.91C670.113 1654.73 669.662 1654.64 669.137 1654.64C668.434 1654.64 667.841 1654.79 667.358 1655.09C666.875 1655.38 666.633 1655.77 666.633 1656.26C666.633 1656.65 666.79 1656.98 667.102 1657.25C667.415 1657.52 667.951 1657.74 668.711 1657.9L671.672 1658.5C673.263 1658.82 674.449 1659.35 675.231 1660.07C676.012 1660.8 676.403 1661.75 676.403 1662.93C676.403 1664 676.086 1664.94 675.454 1665.75C674.829 1666.56 673.97 1667.19 672.876 1667.65C671.79 1668.1 670.536 1668.32 669.116 1668.32C666.949 1668.32 665.224 1667.87 663.938 1666.97C662.66 1666.06 661.91 1664.82 661.69 1663.26L666.154 1663.02C666.289 1663.69 666.616 1664.19 667.134 1664.54C667.653 1664.88 668.317 1665.05 669.126 1665.05C669.922 1665.05 670.561 1664.9 671.044 1664.59C671.534 1664.28 671.782 1663.88 671.79 1663.39C671.782 1662.98 671.608 1662.64 671.268 1662.38C670.927 1662.11 670.401 1661.9 669.691 1661.76L666.857 1661.19C665.259 1660.87 664.069 1660.32 663.288 1659.53C662.514 1658.74 662.127 1657.74 662.127 1656.52C662.127 1655.46 662.411 1654.56 662.979 1653.8C663.555 1653.04 664.361 1652.45 665.398 1652.04C666.442 1651.63 667.663 1651.42 669.062 1651.42C671.129 1651.42 672.756 1651.86 673.942 1652.73C675.135 1653.61 675.831 1654.8 676.03 1656.3Z" fill="#335FFD"/>
+<g filter="url(#filter4_bd_12_618)">
+<rect x="507" y="141" width="765" height="487" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="507.5" y="141.5" width="764" height="486" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M962.196 501.981C962.738 501.872 963.089 501.345 962.981 500.804L961.216 491.979C961.107 491.437 960.58 491.086 960.039 491.194C959.497 491.303 959.146 491.829 959.254 492.371L960.823 500.216L952.979 501.784C952.437 501.893 952.086 502.42 952.194 502.961C952.303 503.503 952.829 503.854 953.371 503.746L962.196 501.981ZM774.92 372.814L825.42 408.814L826.58 407.186L776.08 371.186L774.92 372.814ZM895.445 457.832L961.445 501.832L962.555 500.168L896.555 456.168L895.445 457.832Z" fill="#EA26A9"/>
+<g filter="url(#filter5_bd_12_618)">
+<rect x="573" y="504" width="109" height="65" rx="10" fill="#5900CB"/>
+<rect x="573.5" y="504.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M884.464 194.091C884.464 196.47 884.013 198.494 883.111 200.163C882.216 201.832 880.994 203.107 879.446 203.988C877.905 204.862 876.172 205.298 874.247 205.298C872.308 205.298 870.568 204.858 869.027 203.977C867.486 203.097 866.268 201.822 865.373 200.153C864.478 198.484 864.03 196.463 864.03 194.091C864.03 191.712 864.478 189.688 865.373 188.018C866.268 186.349 867.486 185.078 869.027 184.205C870.568 183.324 872.308 182.884 874.247 182.884C876.172 182.884 877.905 183.324 879.446 184.205C880.994 185.078 882.216 186.349 883.111 188.018C884.013 189.688 884.464 191.712 884.464 194.091ZM879.787 194.091C879.787 192.55 879.556 191.25 879.094 190.192C878.64 189.134 877.997 188.331 877.166 187.784C876.335 187.237 875.362 186.964 874.247 186.964C873.132 186.964 872.159 187.237 871.328 187.784C870.497 188.331 869.851 189.134 869.389 190.192C868.934 191.25 868.707 192.55 868.707 194.091C868.707 195.632 868.934 196.932 869.389 197.99C869.851 199.048 870.497 199.851 871.328 200.398C872.159 200.945 873.132 201.218 874.247 201.218C875.362 201.218 876.335 200.945 877.166 200.398C877.997 199.851 878.64 199.048 879.094 197.99C879.556 196.932 879.787 195.632 879.787 194.091ZM887.795 205V188.636H892.195V191.491H892.366C892.664 190.476 893.165 189.709 893.868 189.19C894.571 188.665 895.381 188.402 896.297 188.402C896.524 188.402 896.769 188.416 897.032 188.445C897.295 188.473 897.526 188.512 897.724 188.562V192.589C897.511 192.525 897.217 192.468 896.84 192.418C896.464 192.369 896.119 192.344 895.807 192.344C895.139 192.344 894.543 192.489 894.017 192.781C893.499 193.065 893.087 193.462 892.781 193.974C892.483 194.485 892.334 195.075 892.334 195.742V205H887.795ZM906.681 211.477C905.211 211.477 903.95 211.275 902.899 210.87C901.855 210.472 901.024 209.929 900.406 209.24C899.789 208.551 899.387 207.777 899.203 206.918L903.4 206.353C903.528 206.68 903.73 206.985 904.007 207.269C904.284 207.553 904.65 207.781 905.105 207.951C905.566 208.129 906.127 208.217 906.788 208.217C907.775 208.217 908.588 207.976 909.227 207.493C909.874 207.017 910.197 206.218 910.197 205.096V202.102H910.005C909.806 202.557 909.508 202.987 909.11 203.391C908.713 203.796 908.201 204.126 907.576 204.382C906.951 204.638 906.205 204.766 905.339 204.766C904.11 204.766 902.992 204.482 901.983 203.913C900.982 203.338 900.183 202.461 899.586 201.282C898.997 200.096 898.702 198.597 898.702 196.786C898.702 194.933 899.004 193.384 899.607 192.141C900.211 190.898 901.014 189.968 902.015 189.35C903.024 188.732 904.128 188.423 905.328 188.423C906.244 188.423 907.012 188.58 907.629 188.892C908.247 189.197 908.744 189.581 909.121 190.043C909.504 190.497 909.799 190.945 910.005 191.385H910.176V188.636H914.682V205.16C914.682 206.552 914.341 207.717 913.659 208.654C912.977 209.592 912.033 210.295 910.825 210.763C909.625 211.239 908.244 211.477 906.681 211.477ZM906.777 201.357C907.509 201.357 908.127 201.175 908.631 200.813C909.142 200.444 909.533 199.918 909.803 199.237C910.08 198.548 910.218 197.724 910.218 196.765C910.218 195.806 910.083 194.975 909.813 194.272C909.544 193.562 909.153 193.011 908.642 192.621C908.13 192.23 907.509 192.035 906.777 192.035C906.031 192.035 905.403 192.237 904.892 192.642C904.38 193.04 903.993 193.594 903.73 194.304C903.468 195.014 903.336 195.835 903.336 196.765C903.336 197.71 903.468 198.526 903.73 199.215C904 199.897 904.387 200.426 904.892 200.803C905.403 201.172 906.031 201.357 906.777 201.357Z" fill="#03031C"/>
+<path d="M773.462 278.58C782.757 278.58 790.292 269.272 790.292 257.79C790.292 246.308 782.757 237 773.462 237C764.167 237 756.632 246.308 756.632 257.79C756.632 269.272 764.167 278.58 773.462 278.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M786.134 271.848C786.134 271.848 797.111 277.919 801.717 281.696C802.809 282.595 803.747 283.67 804.493 284.878C805.852 287.146 806.556 289.754 806.527 292.406V308.017C797.389 316.317 785.547 320.921 773.264 320.952C760.968 320.99 749.102 316.376 740.001 308.017V292.406C739.972 289.754 740.676 287.146 742.035 284.878C742.781 283.67 743.719 282.595 744.811 281.696C749.417 277.958 760.412 271.452 760.412 271.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M749.699 290.856C749.29 291.577 749.086 292.394 749.11 293.22V304.077C755.976 309.12 764.308 311.844 772.868 311.844C781.427 311.844 789.759 309.12 796.625 304.077V293.295C796.653 292.471 796.454 291.654 796.049 290.932C789.364 297.252 781.423 301.043 772.868 301.043C764.312 301.043 756.372 297.226 749.699 290.856Z" fill="#5900CB"/>
+<path d="M759.411 343.818H761.613V355.857C761.613 357.099 761.32 358.209 760.734 359.186C760.154 360.156 759.334 360.923 758.275 361.485C757.216 362.041 755.973 362.32 754.546 362.32C753.12 362.32 751.877 362.041 750.818 361.485C749.758 360.923 748.936 360.156 748.35 359.186C747.77 358.209 747.48 357.099 747.48 355.857V343.818H749.681V355.679C749.681 356.567 749.877 357.357 750.267 358.049C750.658 358.736 751.214 359.277 751.936 359.674C752.664 360.065 753.534 360.26 754.546 360.26C755.558 360.26 756.428 360.065 757.156 359.674C757.884 359.277 758.441 358.736 758.825 358.049C759.216 357.357 759.411 356.567 759.411 355.679V343.818ZM775.385 351.418L773.503 351.95C773.384 351.637 773.21 351.332 772.979 351.036C772.754 350.734 772.446 350.485 772.056 350.29C771.665 350.095 771.165 349.997 770.555 349.997C769.721 349.997 769.025 350.19 768.469 350.574C767.919 350.953 767.643 351.435 767.643 352.021C767.643 352.542 767.833 352.953 768.212 353.255C768.59 353.557 769.182 353.809 769.987 354.01L772.011 354.507C773.23 354.803 774.139 355.256 774.737 355.865C775.335 356.469 775.633 357.247 775.633 358.2C775.633 358.982 775.408 359.68 774.959 360.295C774.515 360.911 773.893 361.396 773.094 361.751C772.295 362.107 771.366 362.284 770.307 362.284C768.916 362.284 767.765 361.982 766.853 361.379C765.942 360.775 765.365 359.893 765.122 358.733L767.111 358.236C767.3 358.97 767.658 359.52 768.185 359.887C768.718 360.254 769.413 360.438 770.271 360.438C771.248 360.438 772.023 360.23 772.597 359.816C773.177 359.396 773.467 358.893 773.467 358.307C773.467 357.833 773.301 357.437 772.97 357.117C772.639 356.792 772.13 356.549 771.443 356.389L769.17 355.857C767.922 355.561 767.004 355.102 766.418 354.48C765.838 353.853 765.548 353.069 765.548 352.128C765.548 351.358 765.764 350.678 766.196 350.086C766.634 349.494 767.229 349.029 767.981 348.692C768.738 348.355 769.596 348.186 770.555 348.186C771.905 348.186 772.964 348.482 773.734 349.074C774.509 349.666 775.059 350.447 775.385 351.418ZM784.505 362.284C783.191 362.284 782.057 361.994 781.104 361.414C780.157 360.828 779.426 360.011 778.912 358.964C778.403 357.91 778.148 356.685 778.148 355.288C778.148 353.892 778.403 352.661 778.912 351.595C779.426 350.524 780.143 349.689 781.06 349.092C781.983 348.488 783.06 348.186 784.292 348.186C785.002 348.186 785.703 348.304 786.396 348.541C787.088 348.778 787.718 349.163 788.287 349.695C788.855 350.222 789.307 350.92 789.645 351.79C789.982 352.661 790.151 353.732 790.151 355.004V355.892H779.64V354.081H788.02C788.02 353.312 787.866 352.625 787.559 352.021C787.257 351.418 786.825 350.941 786.262 350.592C785.706 350.243 785.049 350.068 784.292 350.068C783.457 350.068 782.735 350.275 782.125 350.69C781.522 351.098 781.057 351.631 780.731 352.288C780.406 352.945 780.243 353.649 780.243 354.401V355.608C780.243 356.638 780.421 357.511 780.776 358.227C781.137 358.937 781.637 359.479 782.276 359.852C782.915 360.219 783.658 360.402 784.505 360.402C785.055 360.402 785.552 360.325 785.996 360.171C786.446 360.011 786.834 359.775 787.159 359.461C787.485 359.141 787.736 358.745 787.914 358.271L789.938 358.839C789.725 359.526 789.367 360.13 788.864 360.651C788.361 361.165 787.739 361.568 786.999 361.858C786.259 362.142 785.428 362.284 784.505 362.284ZM793.338 362V348.364H795.362V350.423H795.504C795.753 349.749 796.203 349.201 796.854 348.781C797.505 348.361 798.239 348.151 799.055 348.151C799.209 348.151 799.402 348.154 799.632 348.159C799.863 348.165 800.038 348.174 800.156 348.186V350.317C800.085 350.299 799.922 350.272 799.668 350.237C799.419 350.195 799.156 350.175 798.878 350.175C798.215 350.175 797.623 350.314 797.102 350.592C796.587 350.864 796.179 351.243 795.877 351.728C795.581 352.208 795.433 352.755 795.433 353.371V362H793.338Z" fill="#03031C"/>
+<path d="M615.803 544.32C614.939 544.32 614.155 544.157 613.451 543.831C612.747 543.5 612.187 543.023 611.773 542.402C611.359 541.775 611.151 541.017 611.151 540.129C611.151 539.348 611.305 538.715 611.613 538.229C611.921 537.738 612.332 537.353 612.847 537.075C613.362 536.797 613.93 536.59 614.552 536.454C615.179 536.312 615.809 536.199 616.443 536.116C617.271 536.01 617.943 535.93 618.458 535.877C618.979 535.818 619.358 535.72 619.594 535.584C619.837 535.448 619.958 535.211 619.958 534.874V534.803C619.958 533.927 619.719 533.246 619.239 532.761C618.766 532.275 618.047 532.033 617.082 532.033C616.082 532.033 615.297 532.252 614.729 532.69C614.161 533.128 613.762 533.595 613.531 534.092L611.542 533.382C611.897 532.554 612.371 531.908 612.963 531.447C613.56 530.979 614.211 530.654 614.916 530.47C615.626 530.281 616.324 530.186 617.011 530.186C617.449 530.186 617.952 530.239 618.52 530.346C619.094 530.446 619.648 530.657 620.18 530.976C620.719 531.296 621.166 531.778 621.521 532.423C621.876 533.068 622.053 533.933 622.053 535.016V544H619.958V542.153H619.852C619.71 542.449 619.473 542.766 619.142 543.103C618.81 543.441 618.369 543.728 617.819 543.964C617.268 544.201 616.597 544.32 615.803 544.32ZM616.123 542.438C616.952 542.438 617.65 542.275 618.218 541.949C618.792 541.624 619.224 541.203 619.514 540.689C619.81 540.174 619.958 539.632 619.958 539.064V537.146C619.869 537.253 619.674 537.35 619.372 537.439C619.076 537.522 618.733 537.596 618.343 537.661C617.958 537.72 617.582 537.774 617.215 537.821C616.854 537.862 616.561 537.898 616.336 537.928C615.792 537.999 615.283 538.114 614.809 538.274C614.342 538.428 613.963 538.661 613.673 538.975C613.389 539.283 613.247 539.703 613.247 540.236C613.247 540.964 613.516 541.514 614.055 541.887C614.599 542.254 615.289 542.438 616.123 542.438ZM625.878 549.114V530.364H627.902V532.53H628.15C628.304 532.293 628.517 531.991 628.79 531.624C629.068 531.251 629.464 530.92 629.979 530.63C630.5 530.334 631.204 530.186 632.092 530.186C633.24 530.186 634.252 530.473 635.128 531.047C636.004 531.621 636.688 532.435 637.179 533.489C637.67 534.542 637.916 535.785 637.916 537.217C637.916 538.661 637.67 539.913 637.179 540.973C636.688 542.026 636.007 542.843 635.137 543.423C634.267 543.997 633.264 544.284 632.128 544.284C631.252 544.284 630.55 544.139 630.024 543.849C629.497 543.553 629.091 543.219 628.807 542.846C628.523 542.467 628.304 542.153 628.15 541.905H627.973V549.114H625.878ZM627.937 537.182C627.937 538.212 628.088 539.12 628.39 539.907C628.692 540.689 629.133 541.301 629.713 541.745C630.293 542.183 631.003 542.402 631.843 542.402C632.719 542.402 633.45 542.171 634.036 541.71C634.628 541.242 635.072 540.615 635.368 539.827C635.67 539.034 635.821 538.152 635.821 537.182C635.821 536.223 635.673 535.359 635.377 534.589C635.087 533.814 634.646 533.202 634.054 532.752C633.468 532.296 632.731 532.068 631.843 532.068C630.991 532.068 630.275 532.284 629.695 532.716C629.115 533.142 628.677 533.74 628.381 534.51C628.085 535.273 627.937 536.164 627.937 537.182ZM641.112 544V530.364H643.207V544H641.112ZM642.177 528.091C641.769 528.091 641.417 527.952 641.121 527.674C640.831 527.395 640.686 527.061 640.686 526.67C640.686 526.28 640.831 525.945 641.121 525.667C641.417 525.389 641.769 525.25 642.177 525.25C642.586 525.25 642.935 525.389 643.225 525.667C643.521 525.945 643.669 526.28 643.669 526.67C643.669 527.061 643.521 527.395 643.225 527.674C642.935 527.952 642.586 528.091 642.177 528.091Z" fill="white"/>
+<g filter="url(#filter6_bd_12_618)">
+<rect x="565" y="1236" width="286" height="65" rx="10" fill="#5900CB"/>
+<rect x="565.5" y="1236.5" width="285" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M612.799 1266.91C612.799 1268.83 612.453 1270.48 611.76 1271.88C611.068 1273.28 610.118 1274.35 608.91 1275.11C607.703 1275.87 606.324 1276.25 604.773 1276.25C603.223 1276.25 601.844 1275.87 600.636 1275.11C599.429 1274.35 598.479 1273.28 597.787 1271.88C597.094 1270.48 596.748 1268.83 596.748 1266.91C596.748 1264.99 597.094 1263.33 597.787 1261.94C598.479 1260.54 599.429 1259.46 600.636 1258.71C601.844 1257.95 603.223 1257.57 604.773 1257.57C606.324 1257.57 607.703 1257.95 608.91 1258.71C610.118 1259.46 611.068 1260.54 611.76 1261.94C612.453 1263.33 612.799 1264.99 612.799 1266.91ZM610.668 1266.91C610.668 1265.33 610.405 1264.01 609.878 1262.92C609.357 1261.84 608.65 1261.02 607.756 1260.46C606.869 1259.91 605.874 1259.63 604.773 1259.63C603.673 1259.63 602.675 1259.91 601.782 1260.46C600.894 1261.02 600.187 1261.84 599.66 1262.92C599.139 1264.01 598.879 1265.33 598.879 1266.91C598.879 1268.48 599.139 1269.81 599.66 1270.9C600.187 1271.98 600.894 1272.8 601.782 1273.35C602.675 1273.91 603.673 1274.19 604.773 1274.19C605.874 1274.19 606.869 1273.91 607.756 1273.35C608.65 1272.8 609.357 1271.98 609.878 1270.9C610.405 1269.81 610.668 1268.48 610.668 1266.91ZM616.217 1281.11V1262.36H618.241V1264.53H618.49C618.644 1264.29 618.857 1263.99 619.129 1263.62C619.407 1263.25 619.804 1262.92 620.318 1262.63C620.839 1262.33 621.544 1262.19 622.431 1262.19C623.58 1262.19 624.592 1262.47 625.468 1263.05C626.344 1263.62 627.027 1264.44 627.518 1265.49C628.01 1266.54 628.255 1267.79 628.255 1269.22C628.255 1270.66 628.01 1271.91 627.518 1272.97C627.027 1274.03 626.347 1274.84 625.477 1275.42C624.606 1276 623.603 1276.28 622.467 1276.28C621.591 1276.28 620.89 1276.14 620.363 1275.85C619.836 1275.55 619.431 1275.22 619.147 1274.85C618.863 1274.47 618.644 1274.15 618.49 1273.9H618.312V1281.11H616.217ZM618.277 1269.18C618.277 1270.21 618.428 1271.12 618.729 1271.91C619.031 1272.69 619.472 1273.3 620.052 1273.75C620.632 1274.18 621.342 1274.4 622.183 1274.4C623.059 1274.4 623.79 1274.17 624.376 1273.71C624.968 1273.24 625.411 1272.61 625.707 1271.83C626.009 1271.03 626.16 1270.15 626.16 1269.18C626.16 1268.22 626.012 1267.36 625.716 1266.59C625.426 1265.81 624.985 1265.2 624.393 1264.75C623.807 1264.3 623.071 1264.07 622.183 1264.07C621.331 1264.07 620.614 1264.28 620.034 1264.72C619.454 1265.14 619.016 1265.74 618.72 1266.51C618.425 1267.27 618.277 1268.16 618.277 1269.18ZM637.169 1276.28C635.855 1276.28 634.721 1275.99 633.768 1275.41C632.821 1274.83 632.091 1274.01 631.576 1272.96C631.067 1271.91 630.812 1270.69 630.812 1269.29C630.812 1267.89 631.067 1266.66 631.576 1265.6C632.091 1264.52 632.807 1263.69 633.724 1263.09C634.647 1262.49 635.725 1262.19 636.956 1262.19C637.666 1262.19 638.367 1262.3 639.06 1262.54C639.752 1262.78 640.382 1263.16 640.951 1263.7C641.519 1264.22 641.972 1264.92 642.309 1265.79C642.646 1266.66 642.815 1267.73 642.815 1269V1269.89H632.304V1268.08H640.684C640.684 1267.31 640.53 1266.62 640.223 1266.02C639.921 1265.42 639.489 1264.94 638.926 1264.59C638.37 1264.24 637.713 1264.07 636.956 1264.07C636.121 1264.07 635.399 1264.28 634.789 1264.69C634.186 1265.1 633.721 1265.63 633.396 1266.29C633.07 1266.94 632.907 1267.65 632.907 1268.4V1269.61C632.907 1270.64 633.085 1271.51 633.44 1272.23C633.801 1272.94 634.301 1273.48 634.94 1273.85C635.58 1274.22 636.322 1274.4 637.169 1274.4C637.719 1274.4 638.216 1274.33 638.66 1274.17C639.11 1274.01 639.498 1273.77 639.823 1273.46C640.149 1273.14 640.4 1272.74 640.578 1272.27L642.602 1272.84C642.389 1273.53 642.031 1274.13 641.528 1274.65C641.025 1275.17 640.403 1275.57 639.663 1275.86C638.923 1276.14 638.092 1276.28 637.169 1276.28ZM646.002 1276V1262.36H648.026V1264.42H648.168C648.417 1263.75 648.867 1263.2 649.518 1262.78C650.169 1262.36 650.903 1262.15 651.719 1262.15C651.873 1262.15 652.066 1262.15 652.296 1262.16C652.527 1262.17 652.702 1262.17 652.82 1262.19V1264.32C652.749 1264.3 652.586 1264.27 652.332 1264.24C652.083 1264.2 651.82 1264.17 651.542 1264.17C650.879 1264.17 650.287 1264.31 649.766 1264.59C649.251 1264.86 648.843 1265.24 648.541 1265.73C648.245 1266.21 648.097 1266.76 648.097 1267.37V1276H646.002ZM659.317 1276.32C658.453 1276.32 657.668 1276.16 656.964 1275.83C656.26 1275.5 655.7 1275.02 655.286 1274.4C654.872 1273.77 654.665 1273.02 654.665 1272.13C654.665 1271.35 654.819 1270.71 655.126 1270.23C655.434 1269.74 655.845 1269.35 656.36 1269.08C656.875 1268.8 657.443 1268.59 658.065 1268.45C658.692 1268.31 659.323 1268.2 659.956 1268.12C660.784 1268.01 661.456 1267.93 661.971 1267.88C662.492 1267.82 662.871 1267.72 663.107 1267.58C663.35 1267.45 663.471 1267.21 663.471 1266.87V1266.8C663.471 1265.93 663.232 1265.25 662.752 1264.76C662.279 1264.28 661.56 1264.03 660.595 1264.03C659.595 1264.03 658.811 1264.25 658.242 1264.69C657.674 1265.13 657.275 1265.6 657.044 1266.09L655.055 1265.38C655.41 1264.55 655.884 1263.91 656.476 1263.45C657.073 1262.98 657.725 1262.65 658.429 1262.47C659.139 1262.28 659.837 1262.19 660.524 1262.19C660.962 1262.19 661.465 1262.24 662.033 1262.35C662.607 1262.45 663.161 1262.66 663.693 1262.98C664.232 1263.3 664.679 1263.78 665.034 1264.42C665.389 1265.07 665.567 1265.93 665.567 1267.02V1276H663.471V1274.15H663.365C663.223 1274.45 662.986 1274.77 662.655 1275.1C662.323 1275.44 661.882 1275.73 661.332 1275.96C660.781 1276.2 660.11 1276.32 659.317 1276.32ZM659.636 1274.44C660.465 1274.44 661.163 1274.27 661.731 1273.95C662.306 1273.62 662.738 1273.2 663.028 1272.69C663.323 1272.17 663.471 1271.63 663.471 1271.06V1269.15C663.383 1269.25 663.187 1269.35 662.886 1269.44C662.59 1269.52 662.246 1269.6 661.856 1269.66C661.471 1269.72 661.095 1269.77 660.728 1269.82C660.367 1269.86 660.074 1269.9 659.849 1269.93C659.305 1270 658.796 1270.11 658.322 1270.27C657.855 1270.43 657.476 1270.66 657.186 1270.98C656.902 1271.28 656.76 1271.7 656.76 1272.24C656.76 1272.96 657.029 1273.51 657.568 1273.89C658.112 1274.25 658.802 1274.44 659.636 1274.44ZM675.321 1262.36V1264.14H668.254V1262.36H675.321ZM670.314 1259.1H672.409V1272.09C672.409 1272.69 672.495 1273.13 672.667 1273.43C672.844 1273.72 673.069 1273.91 673.341 1274.01C673.62 1274.11 673.913 1274.15 674.22 1274.15C674.451 1274.15 674.641 1274.14 674.788 1274.12C674.936 1274.09 675.055 1274.06 675.144 1274.05L675.57 1275.93C675.428 1275.98 675.229 1276.04 674.975 1276.09C674.72 1276.15 674.398 1276.18 674.007 1276.18C673.415 1276.18 672.835 1276.05 672.267 1275.8C671.705 1275.54 671.237 1275.15 670.864 1274.63C670.498 1274.11 670.314 1273.46 670.314 1272.66V1259.1ZM683.866 1276.28C682.635 1276.28 681.555 1275.99 680.626 1275.41C679.702 1274.82 678.98 1274 678.459 1272.95C677.945 1271.89 677.687 1270.66 677.687 1269.25C677.687 1267.83 677.945 1266.59 678.459 1265.53C678.98 1264.47 679.702 1263.65 680.626 1263.06C681.555 1262.48 682.635 1262.19 683.866 1262.19C685.097 1262.19 686.174 1262.48 687.098 1263.06C688.027 1263.65 688.749 1264.47 689.264 1265.53C689.785 1266.59 690.045 1267.83 690.045 1269.25C690.045 1270.66 689.785 1271.89 689.264 1272.95C688.749 1274 688.027 1274.82 687.098 1275.41C686.174 1275.99 685.097 1276.28 683.866 1276.28ZM683.866 1274.4C684.801 1274.4 685.571 1274.16 686.174 1273.68C686.778 1273.2 687.225 1272.57 687.515 1271.79C687.805 1271.01 687.95 1270.16 687.95 1269.25C687.95 1268.34 687.805 1267.49 687.515 1266.7C687.225 1265.92 686.778 1265.28 686.174 1264.8C685.571 1264.31 684.801 1264.07 683.866 1264.07C682.931 1264.07 682.162 1264.31 681.558 1264.8C680.954 1265.28 680.507 1265.92 680.217 1266.7C679.927 1267.49 679.782 1268.34 679.782 1269.25C679.782 1270.16 679.927 1271.01 680.217 1271.79C680.507 1272.57 680.954 1273.2 681.558 1273.68C682.162 1274.16 682.931 1274.4 683.866 1274.4ZM693.243 1276V1262.36H695.267V1264.42H695.409C695.658 1263.75 696.108 1263.2 696.759 1262.78C697.41 1262.36 698.144 1262.15 698.961 1262.15C699.115 1262.15 699.307 1262.15 699.538 1262.16C699.769 1262.17 699.943 1262.17 700.061 1262.19V1264.32C699.99 1264.3 699.828 1264.27 699.573 1264.24C699.325 1264.2 699.061 1264.17 698.783 1264.17C698.12 1264.17 697.528 1264.31 697.008 1264.59C696.493 1264.86 696.084 1265.24 695.782 1265.73C695.486 1266.21 695.338 1266.76 695.338 1267.37V1276H693.243ZM724.491 1263.5H722.289C722.159 1262.87 721.931 1262.31 721.606 1261.83C721.286 1261.35 720.896 1260.95 720.434 1260.62C719.978 1260.29 719.472 1260.04 718.916 1259.88C718.359 1259.71 717.779 1259.63 717.176 1259.63C716.075 1259.63 715.078 1259.91 714.184 1260.46C713.296 1261.02 712.589 1261.84 712.062 1262.92C711.541 1264.01 711.281 1265.33 711.281 1266.91C711.281 1268.48 711.541 1269.81 712.062 1270.9C712.589 1271.98 713.296 1272.8 714.184 1273.35C715.078 1273.91 716.075 1274.19 717.176 1274.19C717.779 1274.19 718.359 1274.11 718.916 1273.94C719.472 1273.77 719.978 1273.53 720.434 1273.2C720.896 1272.87 721.286 1272.47 721.606 1271.99C721.931 1271.5 722.159 1270.95 722.289 1270.32H724.491C724.325 1271.25 724.024 1272.08 723.586 1272.81C723.148 1273.55 722.603 1274.17 721.952 1274.69C721.301 1275.2 720.57 1275.58 719.759 1275.85C718.954 1276.12 718.093 1276.25 717.176 1276.25C715.625 1276.25 714.246 1275.87 713.039 1275.11C711.831 1274.35 710.881 1273.28 710.189 1271.88C709.496 1270.48 709.15 1268.83 709.15 1266.91C709.15 1264.99 709.496 1263.33 710.189 1261.94C710.881 1260.54 711.831 1259.46 713.039 1258.71C714.246 1257.95 715.625 1257.57 717.176 1257.57C718.093 1257.57 718.954 1257.7 719.759 1257.97C720.57 1258.24 721.301 1258.63 721.952 1259.14C722.603 1259.65 723.148 1260.27 723.586 1261.01C724.024 1261.73 724.325 1262.56 724.491 1263.5ZM733.305 1276.28C732.073 1276.28 730.993 1275.99 730.064 1275.41C729.141 1274.82 728.419 1274 727.898 1272.95C727.383 1271.89 727.126 1270.66 727.126 1269.25C727.126 1267.83 727.383 1266.59 727.898 1265.53C728.419 1264.47 729.141 1263.65 730.064 1263.06C730.993 1262.48 732.073 1262.19 733.305 1262.19C734.536 1262.19 735.613 1262.48 736.536 1263.06C737.465 1263.65 738.187 1264.47 738.702 1265.53C739.223 1266.59 739.484 1267.83 739.484 1269.25C739.484 1270.66 739.223 1271.89 738.702 1272.95C738.187 1274 737.465 1274.82 736.536 1275.41C735.613 1275.99 734.536 1276.28 733.305 1276.28ZM733.305 1274.4C734.24 1274.4 735.009 1274.16 735.613 1273.68C736.216 1273.2 736.663 1272.57 736.953 1271.79C737.243 1271.01 737.388 1270.16 737.388 1269.25C737.388 1268.34 737.243 1267.49 736.953 1266.7C736.663 1265.92 736.216 1265.28 735.613 1264.8C735.009 1264.31 734.24 1264.07 733.305 1264.07C732.369 1264.07 731.6 1264.31 730.996 1264.8C730.393 1265.28 729.946 1265.92 729.656 1266.7C729.366 1267.49 729.221 1268.34 729.221 1269.25C729.221 1270.16 729.366 1271.01 729.656 1271.79C729.946 1272.57 730.393 1273.2 730.996 1273.68C731.6 1274.16 732.369 1274.4 733.305 1274.4ZM744.777 1267.8V1276H742.682V1262.36H744.706V1264.49H744.883C745.203 1263.8 745.688 1263.25 746.339 1262.83C746.99 1262.4 747.831 1262.19 748.861 1262.19C749.784 1262.19 750.592 1262.38 751.284 1262.75C751.977 1263.13 752.515 1263.7 752.9 1264.46C753.285 1265.22 753.477 1266.18 753.477 1267.34V1276H751.382V1267.48C751.382 1266.41 751.104 1265.57 750.548 1264.97C749.991 1264.37 749.228 1264.07 748.257 1264.07C747.588 1264.07 746.99 1264.21 746.464 1264.5C745.943 1264.79 745.532 1265.22 745.23 1265.77C744.928 1266.33 744.777 1267 744.777 1267.8ZM763.236 1262.36V1264.14H756.169V1262.36H763.236ZM758.229 1259.1H760.324V1272.09C760.324 1272.69 760.41 1273.13 760.582 1273.43C760.759 1273.72 760.984 1273.91 761.256 1274.01C761.535 1274.11 761.828 1274.15 762.135 1274.15C762.366 1274.15 762.556 1274.14 762.704 1274.12C762.851 1274.09 762.97 1274.06 763.059 1274.05L763.485 1275.93C763.343 1275.98 763.144 1276.04 762.89 1276.09C762.635 1276.15 762.313 1276.18 761.922 1276.18C761.33 1276.18 760.75 1276.05 760.182 1275.8C759.62 1275.54 759.152 1275.15 758.78 1274.63C758.413 1274.11 758.229 1273.46 758.229 1272.66V1259.1ZM771.959 1276.28C770.645 1276.28 769.511 1275.99 768.558 1275.41C767.611 1274.83 766.881 1274.01 766.366 1272.96C765.857 1271.91 765.602 1270.69 765.602 1269.29C765.602 1267.89 765.857 1266.66 766.366 1265.6C766.881 1264.52 767.597 1263.69 768.514 1263.09C769.437 1262.49 770.515 1262.19 771.746 1262.19C772.456 1262.19 773.157 1262.3 773.85 1262.54C774.542 1262.78 775.172 1263.16 775.741 1263.7C776.309 1264.22 776.762 1264.92 777.099 1265.79C777.436 1266.66 777.605 1267.73 777.605 1269V1269.89H767.094V1268.08H775.474C775.474 1267.31 775.32 1266.62 775.013 1266.02C774.711 1265.42 774.279 1264.94 773.716 1264.59C773.16 1264.24 772.503 1264.07 771.746 1264.07C770.911 1264.07 770.189 1264.28 769.579 1264.69C768.976 1265.1 768.511 1265.63 768.186 1266.29C767.86 1266.94 767.697 1267.65 767.697 1268.4V1269.61C767.697 1270.64 767.875 1271.51 768.23 1272.23C768.591 1272.94 769.091 1273.48 769.73 1273.85C770.37 1274.22 771.112 1274.4 771.959 1274.4C772.509 1274.4 773.006 1274.33 773.45 1274.17C773.9 1274.01 774.288 1273.77 774.613 1273.46C774.939 1273.14 775.19 1272.74 775.368 1272.27L777.392 1272.84C777.179 1273.53 776.821 1274.13 776.318 1274.65C775.815 1275.17 775.193 1275.57 774.453 1275.86C773.714 1276.14 772.882 1276.28 771.959 1276.28ZM781.988 1262.36L785.255 1267.94L788.523 1262.36H790.937L786.534 1269.18L790.937 1276H788.523L785.255 1270.71L781.988 1276H779.574L783.906 1269.18L779.574 1262.36H781.988ZM799.857 1262.36V1264.14H792.791V1262.36H799.857ZM794.85 1259.1H796.945V1272.09C796.945 1272.69 797.031 1273.13 797.203 1273.43C797.38 1273.72 797.605 1273.91 797.878 1274.01C798.156 1274.11 798.449 1274.15 798.756 1274.15C798.987 1274.15 799.177 1274.14 799.325 1274.12C799.473 1274.09 799.591 1274.06 799.68 1274.05L800.106 1275.93C799.964 1275.98 799.766 1276.04 799.511 1276.09C799.257 1276.15 798.934 1276.18 798.543 1276.18C797.952 1276.18 797.371 1276.05 796.803 1275.8C796.241 1275.54 795.773 1275.15 795.401 1274.63C795.034 1274.11 794.85 1273.46 794.85 1272.66V1259.1ZM816.397 1257.82V1276H814.195V1260.13H814.088L809.65 1263.07V1260.84L814.195 1257.82H816.397Z" fill="white"/>
+<g filter="url(#filter7_bd_12_618)">
+<rect x="925" y="1236" width="286" height="65" rx="10" fill="#FFC743"/>
+<rect x="925.5" y="1236.5" width="285" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M971.041 1266.91C971.041 1268.83 970.695 1270.48 970.002 1271.88C969.31 1273.28 968.36 1274.35 967.153 1275.11C965.945 1275.87 964.566 1276.25 963.016 1276.25C961.465 1276.25 960.086 1275.87 958.879 1275.11C957.671 1274.35 956.721 1273.28 956.029 1271.88C955.336 1270.48 954.99 1268.83 954.99 1266.91C954.99 1264.99 955.336 1263.33 956.029 1261.94C956.721 1260.54 957.671 1259.46 958.879 1258.71C960.086 1257.95 961.465 1257.57 963.016 1257.57C964.566 1257.57 965.945 1257.95 967.153 1258.71C968.36 1259.46 969.31 1260.54 970.002 1261.94C970.695 1263.33 971.041 1264.99 971.041 1266.91ZM968.91 1266.91C968.91 1265.33 968.647 1264.01 968.12 1262.92C967.6 1261.84 966.892 1261.02 965.999 1260.46C965.111 1259.91 964.116 1259.63 963.016 1259.63C961.915 1259.63 960.917 1259.91 960.024 1260.46C959.136 1261.02 958.429 1261.84 957.902 1262.92C957.381 1264.01 957.121 1265.33 957.121 1266.91C957.121 1268.48 957.381 1269.81 957.902 1270.9C958.429 1271.98 959.136 1272.8 960.024 1273.35C960.917 1273.91 961.915 1274.19 963.016 1274.19C964.116 1274.19 965.111 1273.91 965.999 1273.35C966.892 1272.8 967.6 1271.98 968.12 1270.9C968.647 1269.81 968.91 1268.48 968.91 1266.91ZM974.459 1281.11V1262.36H976.483V1264.53H976.732C976.886 1264.29 977.099 1263.99 977.371 1263.62C977.649 1263.25 978.046 1262.92 978.561 1262.63C979.082 1262.33 979.786 1262.19 980.674 1262.19C981.822 1262.19 982.834 1262.47 983.71 1263.05C984.586 1263.62 985.269 1264.44 985.761 1265.49C986.252 1266.54 986.497 1267.79 986.497 1269.22C986.497 1270.66 986.252 1271.91 985.761 1272.97C985.269 1274.03 984.589 1274.84 983.719 1275.42C982.849 1276 981.845 1276.28 980.709 1276.28C979.833 1276.28 979.132 1276.14 978.605 1275.85C978.078 1275.55 977.673 1275.22 977.389 1274.85C977.105 1274.47 976.886 1274.15 976.732 1273.9H976.554V1281.11H974.459ZM976.519 1269.18C976.519 1270.21 976.67 1271.12 976.972 1271.91C977.273 1272.69 977.714 1273.3 978.294 1273.75C978.874 1274.18 979.585 1274.4 980.425 1274.4C981.301 1274.4 982.032 1274.17 982.618 1273.71C983.21 1273.24 983.654 1272.61 983.95 1271.83C984.251 1271.03 984.402 1270.15 984.402 1269.18C984.402 1268.22 984.254 1267.36 983.958 1266.59C983.668 1265.81 983.227 1265.2 982.636 1264.75C982.05 1264.3 981.313 1264.07 980.425 1264.07C979.573 1264.07 978.857 1264.28 978.277 1264.72C977.697 1265.14 977.259 1265.74 976.963 1266.51C976.667 1267.27 976.519 1268.16 976.519 1269.18ZM995.411 1276.28C994.097 1276.28 992.963 1275.99 992.011 1275.41C991.064 1274.83 990.333 1274.01 989.818 1272.96C989.309 1271.91 989.054 1270.69 989.054 1269.29C989.054 1267.89 989.309 1266.66 989.818 1265.6C990.333 1264.52 991.049 1263.69 991.966 1263.09C992.89 1262.49 993.967 1262.19 995.198 1262.19C995.908 1262.19 996.609 1262.3 997.302 1262.54C997.994 1262.78 998.625 1263.16 999.193 1263.7C999.761 1264.22 1000.21 1264.92 1000.55 1265.79C1000.89 1266.66 1001.06 1267.73 1001.06 1269V1269.89H990.546V1268.08H998.926C998.926 1267.31 998.773 1266.62 998.465 1266.02C998.163 1265.42 997.731 1264.94 997.169 1264.59C996.612 1264.24 995.955 1264.07 995.198 1264.07C994.363 1264.07 993.641 1264.28 993.032 1264.69C992.428 1265.1 991.963 1265.63 991.638 1266.29C991.312 1266.94 991.149 1267.65 991.149 1268.4V1269.61C991.149 1270.64 991.327 1271.51 991.682 1272.23C992.043 1272.94 992.543 1273.48 993.182 1273.85C993.822 1274.22 994.564 1274.4 995.411 1274.4C995.961 1274.4 996.458 1274.33 996.902 1274.17C997.352 1274.01 997.74 1273.77 998.065 1273.46C998.391 1273.14 998.642 1272.74 998.82 1272.27L1000.84 1272.84C1000.63 1273.53 1000.27 1274.13 999.77 1274.65C999.267 1275.17 998.645 1275.57 997.905 1275.86C997.166 1276.14 996.334 1276.28 995.411 1276.28ZM1004.24 1276V1262.36H1006.27V1264.42H1006.41C1006.66 1263.75 1007.11 1263.2 1007.76 1262.78C1008.41 1262.36 1009.14 1262.15 1009.96 1262.15C1010.12 1262.15 1010.31 1262.15 1010.54 1262.16C1010.77 1262.17 1010.94 1262.17 1011.06 1262.19V1264.32C1010.99 1264.3 1010.83 1264.27 1010.57 1264.24C1010.33 1264.2 1010.06 1264.17 1009.78 1264.17C1009.12 1264.17 1008.53 1264.31 1008.01 1264.59C1007.49 1264.86 1007.09 1265.24 1006.78 1265.73C1006.49 1266.21 1006.34 1266.76 1006.34 1267.37V1276H1004.24ZM1017.56 1276.32C1016.69 1276.32 1015.91 1276.16 1015.21 1275.83C1014.5 1275.5 1013.94 1275.02 1013.53 1274.4C1013.11 1273.77 1012.91 1273.02 1012.91 1272.13C1012.91 1271.35 1013.06 1270.71 1013.37 1270.23C1013.68 1269.74 1014.09 1269.35 1014.6 1269.08C1015.12 1268.8 1015.69 1268.59 1016.31 1268.45C1016.93 1268.31 1017.56 1268.2 1018.2 1268.12C1019.03 1268.01 1019.7 1267.93 1020.21 1267.88C1020.73 1267.82 1021.11 1267.72 1021.35 1267.58C1021.59 1267.45 1021.71 1267.21 1021.71 1266.87V1266.8C1021.71 1265.93 1021.47 1265.25 1020.99 1264.76C1020.52 1264.28 1019.8 1264.03 1018.84 1264.03C1017.84 1264.03 1017.05 1264.25 1016.48 1264.69C1015.92 1265.13 1015.52 1265.6 1015.29 1266.09L1013.3 1265.38C1013.65 1264.55 1014.13 1263.91 1014.72 1263.45C1015.32 1262.98 1015.97 1262.65 1016.67 1262.47C1017.38 1262.28 1018.08 1262.19 1018.77 1262.19C1019.2 1262.19 1019.71 1262.24 1020.28 1262.35C1020.85 1262.45 1021.4 1262.66 1021.94 1262.98C1022.47 1263.3 1022.92 1263.78 1023.28 1264.42C1023.63 1265.07 1023.81 1265.93 1023.81 1267.02V1276H1021.71V1274.15H1021.61C1021.47 1274.45 1021.23 1274.77 1020.9 1275.1C1020.57 1275.44 1020.12 1275.73 1019.57 1275.96C1019.02 1276.2 1018.35 1276.32 1017.56 1276.32ZM1017.88 1274.44C1018.71 1274.44 1019.41 1274.27 1019.97 1273.95C1020.55 1273.62 1020.98 1273.2 1021.27 1272.69C1021.57 1272.17 1021.71 1271.63 1021.71 1271.06V1269.15C1021.62 1269.25 1021.43 1269.35 1021.13 1269.44C1020.83 1269.52 1020.49 1269.6 1020.1 1269.66C1019.71 1269.72 1019.34 1269.77 1018.97 1269.82C1018.61 1269.86 1018.32 1269.9 1018.09 1269.93C1017.55 1270 1017.04 1270.11 1016.56 1270.27C1016.1 1270.43 1015.72 1270.66 1015.43 1270.98C1015.14 1271.28 1015 1271.7 1015 1272.24C1015 1272.96 1015.27 1273.51 1015.81 1273.89C1016.35 1274.25 1017.04 1274.44 1017.88 1274.44ZM1033.56 1262.36V1264.14H1026.5V1262.36H1033.56ZM1028.56 1259.1H1030.65V1272.09C1030.65 1272.69 1030.74 1273.13 1030.91 1273.43C1031.09 1273.72 1031.31 1273.91 1031.58 1274.01C1031.86 1274.11 1032.15 1274.15 1032.46 1274.15C1032.69 1274.15 1032.88 1274.14 1033.03 1274.12C1033.18 1274.09 1033.3 1274.06 1033.39 1274.05L1033.81 1275.93C1033.67 1275.98 1033.47 1276.04 1033.22 1276.09C1032.96 1276.15 1032.64 1276.18 1032.25 1276.18C1031.66 1276.18 1031.08 1276.05 1030.51 1275.8C1029.95 1275.54 1029.48 1275.15 1029.11 1274.63C1028.74 1274.11 1028.56 1273.46 1028.56 1272.66V1259.1ZM1042.11 1276.28C1040.88 1276.28 1039.8 1275.99 1038.87 1275.41C1037.94 1274.82 1037.22 1274 1036.7 1272.95C1036.19 1271.89 1035.93 1270.66 1035.93 1269.25C1035.93 1267.83 1036.19 1266.59 1036.7 1265.53C1037.22 1264.47 1037.94 1263.65 1038.87 1263.06C1039.8 1262.48 1040.88 1262.19 1042.11 1262.19C1043.34 1262.19 1044.42 1262.48 1045.34 1263.06C1046.27 1263.65 1046.99 1264.47 1047.51 1265.53C1048.03 1266.59 1048.29 1267.83 1048.29 1269.25C1048.29 1270.66 1048.03 1271.89 1047.51 1272.95C1046.99 1274 1046.27 1274.82 1045.34 1275.41C1044.42 1275.99 1043.34 1276.28 1042.11 1276.28ZM1042.11 1274.4C1043.04 1274.4 1043.81 1274.16 1044.42 1273.68C1045.02 1273.2 1045.47 1272.57 1045.76 1271.79C1046.05 1271.01 1046.19 1270.16 1046.19 1269.25C1046.19 1268.34 1046.05 1267.49 1045.76 1266.7C1045.47 1265.92 1045.02 1265.28 1044.42 1264.8C1043.81 1264.31 1043.04 1264.07 1042.11 1264.07C1041.17 1264.07 1040.4 1264.31 1039.8 1264.8C1039.2 1265.28 1038.75 1265.92 1038.46 1266.7C1038.17 1267.49 1038.02 1268.34 1038.02 1269.25C1038.02 1270.16 1038.17 1271.01 1038.46 1271.79C1038.75 1272.57 1039.2 1273.2 1039.8 1273.68C1040.4 1274.16 1041.17 1274.4 1042.11 1274.4ZM1051.49 1276V1262.36H1053.51V1264.42H1053.65C1053.9 1263.75 1054.35 1263.2 1055 1262.78C1055.65 1262.36 1056.39 1262.15 1057.2 1262.15C1057.36 1262.15 1057.55 1262.15 1057.78 1262.16C1058.01 1262.17 1058.19 1262.17 1058.3 1262.19V1264.32C1058.23 1264.3 1058.07 1264.27 1057.82 1264.24C1057.57 1264.2 1057.3 1264.17 1057.03 1264.17C1056.36 1264.17 1055.77 1264.31 1055.25 1264.59C1054.73 1264.86 1054.33 1265.24 1054.02 1265.73C1053.73 1266.21 1053.58 1266.76 1053.58 1267.37V1276H1051.49ZM1082.73 1263.5H1080.53C1080.4 1262.87 1080.17 1262.31 1079.85 1261.83C1079.53 1261.35 1079.14 1260.95 1078.68 1260.62C1078.22 1260.29 1077.71 1260.04 1077.16 1259.88C1076.6 1259.71 1076.02 1259.63 1075.42 1259.63C1074.32 1259.63 1073.32 1259.91 1072.43 1260.46C1071.54 1261.02 1070.83 1261.84 1070.3 1262.92C1069.78 1264.01 1069.52 1265.33 1069.52 1266.91C1069.52 1268.48 1069.78 1269.81 1070.3 1270.9C1070.83 1271.98 1071.54 1272.8 1072.43 1273.35C1073.32 1273.91 1074.32 1274.19 1075.42 1274.19C1076.02 1274.19 1076.6 1274.11 1077.16 1273.94C1077.71 1273.77 1078.22 1273.53 1078.68 1273.2C1079.14 1272.87 1079.53 1272.47 1079.85 1271.99C1080.17 1271.5 1080.4 1270.95 1080.53 1270.32H1082.73C1082.57 1271.25 1082.27 1272.08 1081.83 1272.81C1081.39 1273.55 1080.85 1274.17 1080.19 1274.69C1079.54 1275.2 1078.81 1275.58 1078 1275.85C1077.2 1276.12 1076.34 1276.25 1075.42 1276.25C1073.87 1276.25 1072.49 1275.87 1071.28 1275.11C1070.07 1274.35 1069.12 1273.28 1068.43 1271.88C1067.74 1270.48 1067.39 1268.83 1067.39 1266.91C1067.39 1264.99 1067.74 1263.33 1068.43 1261.94C1069.12 1260.54 1070.07 1259.46 1071.28 1258.71C1072.49 1257.95 1073.87 1257.57 1075.42 1257.57C1076.34 1257.57 1077.2 1257.7 1078 1257.97C1078.81 1258.24 1079.54 1258.63 1080.19 1259.14C1080.85 1259.65 1081.39 1260.27 1081.83 1261.01C1082.27 1261.73 1082.57 1262.56 1082.73 1263.5ZM1091.55 1276.28C1090.32 1276.28 1089.24 1275.99 1088.31 1275.41C1087.38 1274.82 1086.66 1274 1086.14 1272.95C1085.63 1271.89 1085.37 1270.66 1085.37 1269.25C1085.37 1267.83 1085.63 1266.59 1086.14 1265.53C1086.66 1264.47 1087.38 1263.65 1088.31 1263.06C1089.24 1262.48 1090.32 1262.19 1091.55 1262.19C1092.78 1262.19 1093.85 1262.48 1094.78 1263.06C1095.71 1263.65 1096.43 1264.47 1096.94 1265.53C1097.47 1266.59 1097.73 1267.83 1097.73 1269.25C1097.73 1270.66 1097.47 1271.89 1096.94 1272.95C1096.43 1274 1095.71 1274.82 1094.78 1275.41C1093.85 1275.99 1092.78 1276.28 1091.55 1276.28ZM1091.55 1274.4C1092.48 1274.4 1093.25 1274.16 1093.85 1273.68C1094.46 1273.2 1094.91 1272.57 1095.2 1271.79C1095.49 1271.01 1095.63 1270.16 1095.63 1269.25C1095.63 1268.34 1095.49 1267.49 1095.2 1266.7C1094.91 1265.92 1094.46 1265.28 1093.85 1264.8C1093.25 1264.31 1092.48 1264.07 1091.55 1264.07C1090.61 1264.07 1089.84 1264.31 1089.24 1264.8C1088.63 1265.28 1088.19 1265.92 1087.9 1266.7C1087.61 1267.49 1087.46 1268.34 1087.46 1269.25C1087.46 1270.16 1087.61 1271.01 1087.9 1271.79C1088.19 1272.57 1088.63 1273.2 1089.24 1273.68C1089.84 1274.16 1090.61 1274.4 1091.55 1274.4ZM1103.02 1267.8V1276H1100.92V1262.36H1102.95V1264.49H1103.13C1103.45 1263.8 1103.93 1263.25 1104.58 1262.83C1105.23 1262.4 1106.07 1262.19 1107.1 1262.19C1108.03 1262.19 1108.83 1262.38 1109.53 1262.75C1110.22 1263.13 1110.76 1263.7 1111.14 1264.46C1111.53 1265.22 1111.72 1266.18 1111.72 1267.34V1276H1109.62V1267.48C1109.62 1266.41 1109.35 1265.57 1108.79 1264.97C1108.23 1264.37 1107.47 1264.07 1106.5 1264.07C1105.83 1264.07 1105.23 1264.21 1104.71 1264.5C1104.19 1264.79 1103.77 1265.22 1103.47 1265.77C1103.17 1266.33 1103.02 1267 1103.02 1267.8ZM1121.48 1262.36V1264.14H1114.41V1262.36H1121.48ZM1116.47 1259.1H1118.57V1272.09C1118.57 1272.69 1118.65 1273.13 1118.82 1273.43C1119 1273.72 1119.23 1273.91 1119.5 1274.01C1119.78 1274.11 1120.07 1274.15 1120.38 1274.15C1120.61 1274.15 1120.8 1274.14 1120.95 1274.12C1121.09 1274.09 1121.21 1274.06 1121.3 1274.05L1121.73 1275.93C1121.58 1275.98 1121.39 1276.04 1121.13 1276.09C1120.88 1276.15 1120.56 1276.18 1120.16 1276.18C1119.57 1276.18 1118.99 1276.05 1118.42 1275.8C1117.86 1275.54 1117.39 1275.15 1117.02 1274.63C1116.65 1274.11 1116.47 1273.46 1116.47 1272.66V1259.1ZM1130.2 1276.28C1128.89 1276.28 1127.75 1275.99 1126.8 1275.41C1125.85 1274.83 1125.12 1274.01 1124.61 1272.96C1124.1 1271.91 1123.84 1270.69 1123.84 1269.29C1123.84 1267.89 1124.1 1266.66 1124.61 1265.6C1125.12 1264.52 1125.84 1263.69 1126.76 1263.09C1127.68 1262.49 1128.76 1262.19 1129.99 1262.19C1130.7 1262.19 1131.4 1262.3 1132.09 1262.54C1132.78 1262.78 1133.41 1263.16 1133.98 1263.7C1134.55 1264.22 1135 1264.92 1135.34 1265.79C1135.68 1266.66 1135.85 1267.73 1135.85 1269V1269.89H1125.34V1268.08H1133.72C1133.72 1267.31 1133.56 1266.62 1133.25 1266.02C1132.95 1265.42 1132.52 1264.94 1131.96 1264.59C1131.4 1264.24 1130.75 1264.07 1129.99 1264.07C1129.15 1264.07 1128.43 1264.28 1127.82 1264.69C1127.22 1265.1 1126.75 1265.63 1126.43 1266.29C1126.1 1266.94 1125.94 1267.65 1125.94 1268.4V1269.61C1125.94 1270.64 1126.12 1271.51 1126.47 1272.23C1126.83 1272.94 1127.33 1273.48 1127.97 1273.85C1128.61 1274.22 1129.35 1274.4 1130.2 1274.4C1130.75 1274.4 1131.25 1274.33 1131.69 1274.17C1132.14 1274.01 1132.53 1273.77 1132.86 1273.46C1133.18 1273.14 1133.43 1272.74 1133.61 1272.27L1135.63 1272.84C1135.42 1273.53 1135.06 1274.13 1134.56 1274.65C1134.06 1275.17 1133.44 1275.57 1132.7 1275.86C1131.96 1276.14 1131.12 1276.28 1130.2 1276.28ZM1140.23 1262.36L1143.5 1267.94L1146.76 1262.36H1149.18L1144.78 1269.18L1149.18 1276H1146.76L1143.5 1270.71L1140.23 1276H1137.82L1142.15 1269.18L1137.82 1262.36H1140.23ZM1158.1 1262.36V1264.14H1151.03V1262.36H1158.1ZM1153.09 1259.1H1155.19V1272.09C1155.19 1272.69 1155.27 1273.13 1155.45 1273.43C1155.62 1273.72 1155.85 1273.91 1156.12 1274.01C1156.4 1274.11 1156.69 1274.15 1157 1274.15C1157.23 1274.15 1157.42 1274.14 1157.57 1274.12C1157.71 1274.09 1157.83 1274.06 1157.92 1274.05L1158.35 1275.93C1158.21 1275.98 1158.01 1276.04 1157.75 1276.09C1157.5 1276.15 1157.18 1276.18 1156.79 1276.18C1156.19 1276.18 1155.61 1276.05 1155.05 1275.8C1154.48 1275.54 1154.02 1275.15 1153.64 1274.63C1153.28 1274.11 1153.09 1273.46 1153.09 1272.66V1259.1ZM1168.25 1276V1274.4L1174.25 1267.83C1174.95 1267.06 1175.53 1266.39 1175.99 1265.83C1176.44 1265.25 1176.78 1264.71 1177 1264.21C1177.23 1263.7 1177.34 1263.17 1177.34 1262.61C1177.34 1261.97 1177.18 1261.42 1176.88 1260.95C1176.57 1260.48 1176.16 1260.12 1175.63 1259.87C1175.11 1259.61 1174.51 1259.49 1173.86 1259.49C1173.16 1259.49 1172.55 1259.63 1172.03 1259.92C1171.51 1260.21 1171.11 1260.61 1170.83 1261.12C1170.55 1261.64 1170.41 1262.24 1170.41 1262.93H1168.32C1168.32 1261.87 1168.56 1260.93 1169.05 1260.13C1169.55 1259.32 1170.21 1258.69 1171.06 1258.24C1171.91 1257.79 1172.87 1257.57 1173.93 1257.57C1174.99 1257.57 1175.94 1257.79 1176.76 1258.24C1177.58 1258.69 1178.23 1259.3 1178.7 1260.06C1179.16 1260.83 1179.4 1261.68 1179.4 1262.61C1179.4 1263.28 1179.28 1263.94 1179.03 1264.57C1178.8 1265.21 1178.38 1265.91 1177.79 1266.7C1177.2 1267.47 1176.39 1268.42 1175.35 1269.54L1171.27 1273.9V1274.05H1179.72V1276H1168.25Z" fill="#03031C"/>
+<g filter="url(#filter8_bd_12_618)">
+<rect x="700" y="504" width="109" height="65" rx="10" fill="#5900CB"/>
+<rect x="700.5" y="504.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M742.803 544.32C741.939 544.32 741.155 544.157 740.451 543.831C739.747 543.5 739.187 543.023 738.773 542.402C738.359 541.775 738.151 541.017 738.151 540.129C738.151 539.348 738.305 538.715 738.613 538.229C738.921 537.738 739.332 537.353 739.847 537.075C740.362 536.797 740.93 536.59 741.552 536.454C742.179 536.312 742.809 536.199 743.443 536.116C744.271 536.01 744.943 535.93 745.458 535.877C745.979 535.818 746.358 535.72 746.594 535.584C746.837 535.448 746.958 535.211 746.958 534.874V534.803C746.958 533.927 746.719 533.246 746.239 532.761C745.766 532.275 745.047 532.033 744.082 532.033C743.082 532.033 742.297 532.252 741.729 532.69C741.161 533.128 740.762 533.595 740.531 534.092L738.542 533.382C738.897 532.554 739.371 531.908 739.963 531.447C740.56 530.979 741.211 530.654 741.916 530.47C742.626 530.281 743.324 530.186 744.011 530.186C744.449 530.186 744.952 530.239 745.52 530.346C746.094 530.446 746.648 530.657 747.18 530.976C747.719 531.296 748.166 531.778 748.521 532.423C748.876 533.068 749.053 533.933 749.053 535.016V544H746.958V542.153H746.852C746.71 542.449 746.473 542.766 746.142 543.103C745.81 543.441 745.369 543.728 744.819 543.964C744.268 544.201 743.597 544.32 742.803 544.32ZM743.123 542.438C743.952 542.438 744.65 542.275 745.218 541.949C745.792 541.624 746.224 541.203 746.514 540.689C746.81 540.174 746.958 539.632 746.958 539.064V537.146C746.869 537.253 746.674 537.35 746.372 537.439C746.076 537.522 745.733 537.596 745.343 537.661C744.958 537.72 744.582 537.774 744.215 537.821C743.854 537.862 743.561 537.898 743.336 537.928C742.792 537.999 742.283 538.114 741.809 538.274C741.342 538.428 740.963 538.661 740.673 538.975C740.389 539.283 740.247 539.703 740.247 540.236C740.247 540.964 740.516 541.514 741.055 541.887C741.599 542.254 742.289 542.438 743.123 542.438ZM752.878 549.114V530.364H754.902V532.53H755.15C755.304 532.293 755.517 531.991 755.79 531.624C756.068 531.251 756.464 530.92 756.979 530.63C757.5 530.334 758.204 530.186 759.092 530.186C760.24 530.186 761.252 530.473 762.128 531.047C763.004 531.621 763.688 532.435 764.179 533.489C764.67 534.542 764.916 535.785 764.916 537.217C764.916 538.661 764.67 539.913 764.179 540.973C763.688 542.026 763.007 542.843 762.137 543.423C761.267 543.997 760.264 544.284 759.128 544.284C758.252 544.284 757.55 544.139 757.024 543.849C756.497 543.553 756.091 543.219 755.807 542.846C755.523 542.467 755.304 542.153 755.15 541.905H754.973V549.114H752.878ZM754.937 537.182C754.937 538.212 755.088 539.12 755.39 539.907C755.692 540.689 756.133 541.301 756.713 541.745C757.293 542.183 758.003 542.402 758.843 542.402C759.719 542.402 760.45 542.171 761.036 541.71C761.628 541.242 762.072 540.615 762.368 539.827C762.67 539.034 762.821 538.152 762.821 537.182C762.821 536.223 762.673 535.359 762.377 534.589C762.087 533.814 761.646 533.202 761.054 532.752C760.468 532.296 759.731 532.068 758.843 532.068C757.991 532.068 757.275 532.284 756.695 532.716C756.115 533.142 755.677 533.74 755.381 534.51C755.085 535.273 754.937 536.164 754.937 537.182ZM768.112 544V530.364H770.207V544H768.112ZM769.177 528.091C768.769 528.091 768.417 527.952 768.121 527.674C767.831 527.395 767.686 527.061 767.686 526.67C767.686 526.28 767.831 525.945 768.121 525.667C768.417 525.389 768.769 525.25 769.177 525.25C769.586 525.25 769.935 525.389 770.225 525.667C770.521 525.945 770.669 526.28 770.669 526.67C770.669 527.061 770.521 527.395 770.225 527.674C769.935 527.952 769.586 528.091 769.177 528.091Z" fill="white"/>
+<path d="M587.996 343.818H590.198V355.857C590.198 357.099 589.905 358.209 589.319 359.186C588.739 360.156 587.919 360.923 586.86 361.485C585.801 362.041 584.558 362.32 583.131 362.32C581.705 362.32 580.462 362.041 579.403 361.485C578.343 360.923 577.52 360.156 576.935 359.186C576.355 358.209 576.064 357.099 576.064 355.857V343.818H578.266V355.679C578.266 356.567 578.462 357.357 578.852 358.049C579.243 358.736 579.799 359.277 580.521 359.674C581.249 360.065 582.119 360.26 583.131 360.26C584.143 360.26 585.013 360.065 585.741 359.674C586.469 359.277 587.026 358.736 587.41 358.049C587.801 357.357 587.996 356.567 587.996 355.679V343.818ZM603.97 351.418L602.088 351.95C601.969 351.637 601.795 351.332 601.564 351.036C601.339 350.734 601.031 350.485 600.641 350.29C600.25 350.095 599.75 349.997 599.14 349.997C598.306 349.997 597.61 350.19 597.054 350.574C596.504 350.953 596.228 351.435 596.228 352.021C596.228 352.542 596.418 352.953 596.796 353.255C597.175 353.557 597.767 353.809 598.572 354.01L600.596 354.507C601.815 354.803 602.724 355.256 603.322 355.865C603.919 356.469 604.218 357.247 604.218 358.2C604.218 358.982 603.993 359.68 603.544 360.295C603.1 360.911 602.478 361.396 601.679 361.751C600.88 362.107 599.951 362.284 598.892 362.284C597.501 362.284 596.35 361.982 595.438 361.379C594.527 360.775 593.95 359.893 593.707 358.733L595.696 358.236C595.885 358.97 596.243 359.52 596.77 359.887C597.303 360.254 597.998 360.438 598.856 360.438C599.833 360.438 600.608 360.23 601.182 359.816C601.762 359.396 602.052 358.893 602.052 358.307C602.052 357.833 601.886 357.437 601.555 357.117C601.224 356.792 600.715 356.549 600.028 356.389L597.755 355.857C596.506 355.561 595.589 355.102 595.003 354.48C594.423 353.853 594.133 353.069 594.133 352.128C594.133 351.358 594.349 350.678 594.781 350.086C595.219 349.494 595.814 349.029 596.566 348.692C597.323 348.355 598.181 348.186 599.14 348.186C600.49 348.186 601.549 348.482 602.318 349.074C603.094 349.666 603.644 350.447 603.97 351.418ZM613.09 362.284C611.776 362.284 610.642 361.994 609.689 361.414C608.742 360.828 608.011 360.011 607.496 358.964C606.987 357.91 606.733 356.685 606.733 355.288C606.733 353.892 606.987 352.661 607.496 351.595C608.011 350.524 608.728 349.689 609.645 349.092C610.568 348.488 611.645 348.186 612.876 348.186C613.587 348.186 614.288 348.304 614.981 348.541C615.673 348.778 616.303 349.163 616.871 349.695C617.44 350.222 617.892 350.92 618.23 351.79C618.567 352.661 618.736 353.732 618.736 355.004V355.892H608.224V354.081H616.605C616.605 353.312 616.451 352.625 616.144 352.021C615.842 351.418 615.41 350.941 614.847 350.592C614.291 350.243 613.634 350.068 612.876 350.068C612.042 350.068 611.32 350.275 610.71 350.69C610.107 351.098 609.642 351.631 609.316 352.288C608.991 352.945 608.828 353.649 608.828 354.401V355.608C608.828 356.638 609.006 357.511 609.361 358.227C609.722 358.937 610.222 359.479 610.861 359.852C611.5 360.219 612.243 360.402 613.09 360.402C613.64 360.402 614.137 360.325 614.581 360.171C615.031 360.011 615.418 359.775 615.744 359.461C616.07 359.141 616.321 358.745 616.499 358.271L618.523 358.839C618.31 359.526 617.952 360.13 617.449 360.651C616.945 361.165 616.324 361.568 615.584 361.858C614.844 362.142 614.013 362.284 613.09 362.284ZM621.923 362V348.364H623.947V350.423H624.089C624.338 349.749 624.788 349.201 625.439 348.781C626.09 348.361 626.824 348.151 627.64 348.151C627.794 348.151 627.987 348.154 628.217 348.159C628.448 348.165 628.623 348.174 628.741 348.186V350.317C628.67 350.299 628.507 350.272 628.253 350.237C628.004 350.195 627.741 350.175 627.463 350.175C626.8 350.175 626.208 350.314 625.687 350.592C625.172 350.864 624.764 351.243 624.462 351.728C624.166 352.208 624.018 352.755 624.018 353.371V362H621.923ZM643.76 367.398C642.748 367.398 641.878 367.268 641.15 367.007C640.422 366.753 639.816 366.415 639.33 365.995C638.851 365.581 638.469 365.137 638.185 364.663L639.854 363.491C640.043 363.74 640.283 364.024 640.573 364.344C640.863 364.669 641.26 364.95 641.763 365.187C642.272 365.43 642.938 365.551 643.76 365.551C644.861 365.551 645.77 365.285 646.486 364.752C647.202 364.219 647.56 363.385 647.56 362.249V359.479H647.382C647.229 359.727 647.01 360.035 646.725 360.402C646.447 360.763 646.045 361.086 645.518 361.37C644.997 361.648 644.293 361.787 643.405 361.787C642.304 361.787 641.316 361.527 640.44 361.006C639.57 360.485 638.88 359.727 638.371 358.733C637.868 357.739 637.617 356.531 637.617 355.111C637.617 353.714 637.862 352.498 638.354 351.462C638.845 350.42 639.528 349.615 640.404 349.047C641.28 348.473 642.292 348.186 643.441 348.186C644.328 348.186 645.033 348.334 645.554 348.63C646.08 348.92 646.483 349.251 646.761 349.624C647.045 349.991 647.264 350.293 647.418 350.53H647.631V348.364H649.655V362.391C649.655 363.562 649.389 364.515 648.856 365.249C648.329 365.989 647.619 366.531 646.725 366.874C645.838 367.223 644.849 367.398 643.76 367.398ZM643.689 359.905C644.53 359.905 645.24 359.712 645.82 359.328C646.4 358.943 646.841 358.39 647.143 357.668C647.445 356.946 647.595 356.081 647.595 355.075C647.595 354.093 647.448 353.226 647.152 352.474C646.856 351.722 646.418 351.134 645.838 350.707C645.258 350.281 644.542 350.068 643.689 350.068C642.801 350.068 642.062 350.293 641.47 350.743C640.884 351.193 640.443 351.796 640.147 352.554C639.857 353.312 639.712 354.152 639.712 355.075C639.712 356.022 639.86 356.86 640.156 357.588C640.458 358.31 640.902 358.878 641.488 359.292C642.079 359.701 642.813 359.905 643.689 359.905ZM653.49 362V348.364H655.515V350.423H655.657C655.905 349.749 656.355 349.201 657.006 348.781C657.657 348.361 658.391 348.151 659.208 348.151C659.362 348.151 659.554 348.154 659.785 348.159C660.016 348.165 660.19 348.174 660.309 348.186V350.317C660.238 350.299 660.075 350.272 659.82 350.237C659.572 350.195 659.308 350.175 659.03 350.175C658.367 350.175 657.775 350.314 657.255 350.592C656.74 350.864 656.331 351.243 656.029 351.728C655.734 352.208 655.586 352.755 655.586 353.371V362H653.49ZM667.917 362.284C666.686 362.284 665.606 361.991 664.676 361.405C663.753 360.819 663.031 360 662.51 358.946C661.995 357.893 661.738 356.661 661.738 355.253C661.738 353.832 661.995 352.592 662.51 351.533C663.031 350.474 663.753 349.651 664.676 349.065C665.606 348.479 666.686 348.186 667.917 348.186C669.148 348.186 670.225 348.479 671.148 349.065C672.078 349.651 672.8 350.474 673.315 351.533C673.835 352.592 674.096 353.832 674.096 355.253C674.096 356.661 673.835 357.893 673.315 358.946C672.8 360 672.078 360.819 671.148 361.405C670.225 361.991 669.148 362.284 667.917 362.284ZM667.917 360.402C668.852 360.402 669.621 360.162 670.225 359.683C670.829 359.203 671.276 358.573 671.566 357.792C671.856 357.011 672.001 356.164 672.001 355.253C672.001 354.341 671.856 353.492 671.566 352.705C671.276 351.918 670.829 351.281 670.225 350.796C669.621 350.311 668.852 350.068 667.917 350.068C666.982 350.068 666.212 350.311 665.609 350.796C665.005 351.281 664.558 351.918 664.268 352.705C663.978 353.492 663.833 354.341 663.833 355.253C663.833 356.164 663.978 357.011 664.268 357.792C664.558 358.573 665.005 359.203 665.609 359.683C666.212 360.162 666.982 360.402 667.917 360.402ZM685.888 356.425V348.364H687.983V362H685.888V359.692H685.746C685.426 360.384 684.929 360.973 684.254 361.458C683.58 361.938 682.727 362.178 681.697 362.178C680.845 362.178 680.088 361.991 679.425 361.618C678.762 361.239 678.241 360.671 677.862 359.914C677.483 359.15 677.294 358.188 677.294 357.028V348.364H679.389V356.886C679.389 357.881 679.667 358.674 680.224 359.266C680.786 359.857 681.502 360.153 682.372 360.153C682.893 360.153 683.423 360.02 683.961 359.754C684.506 359.488 684.962 359.079 685.329 358.529C685.701 357.978 685.888 357.277 685.888 356.425ZM691.82 367.114V348.364H693.845V350.53H694.093C694.247 350.293 694.46 349.991 694.732 349.624C695.011 349.251 695.407 348.92 695.922 348.63C696.443 348.334 697.147 348.186 698.035 348.186C699.183 348.186 700.195 348.473 701.071 349.047C701.947 349.621 702.631 350.435 703.122 351.489C703.613 352.542 703.859 353.785 703.859 355.217C703.859 356.661 703.613 357.913 703.122 358.973C702.631 360.026 701.95 360.843 701.08 361.423C700.21 361.997 699.207 362.284 698.07 362.284C697.194 362.284 696.493 362.139 695.966 361.849C695.44 361.553 695.034 361.219 694.75 360.846C694.466 360.467 694.247 360.153 694.093 359.905H693.916V367.114H691.82ZM693.88 355.182C693.88 356.212 694.031 357.12 694.333 357.907C694.635 358.689 695.076 359.301 695.656 359.745C696.236 360.183 696.946 360.402 697.786 360.402C698.662 360.402 699.393 360.171 699.979 359.71C700.571 359.242 701.015 358.615 701.311 357.827C701.613 357.034 701.764 356.152 701.764 355.182C701.764 354.223 701.616 353.359 701.32 352.589C701.03 351.814 700.589 351.202 699.997 350.752C699.411 350.296 698.674 350.068 697.786 350.068C696.934 350.068 696.218 350.284 695.638 350.716C695.058 351.142 694.62 351.74 694.324 352.51C694.028 353.273 693.88 354.164 693.88 355.182Z" fill="#03031C"/>
+<path d="M629.281 260.126C629.133 260.387 629.021 260.759 629.021 261.168V265.89C632.033 268.12 635.528 269.273 639.246 269.273C643.67 269.273 647.128 267.6 649.471 265.89V261.168C649.471 260.759 649.396 260.387 649.21 260.126C646.347 262.915 642.89 264.514 639.209 264.514C635.602 264.551 632.144 262.915 629.281 260.126Z" fill="#5900CB"/>
+<path d="M601.99 307.644C601.842 307.904 601.73 308.276 601.73 308.685V313.407C604.742 315.638 608.237 316.791 611.955 316.791C616.379 316.791 619.837 315.117 622.18 313.407V308.685C622.18 308.276 622.105 307.904 621.919 307.644C619.056 310.433 615.599 312.031 611.918 312.031C608.311 312.069 604.853 310.433 601.99 307.644Z" fill="#5900CB"/>
+<path d="M656.646 307.644C656.498 307.904 656.386 308.276 656.386 308.685V313.407C659.398 315.638 662.893 316.791 666.611 316.791C671.036 316.791 674.493 315.117 676.836 313.407V308.685C676.836 308.276 676.761 307.904 676.576 307.644C673.713 310.433 670.255 312.031 666.574 312.031C662.967 312.069 659.509 310.433 656.646 307.644Z" fill="#5900CB"/>
+<path d="M639.32 288.682L629.653 298.349" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M639.32 278.011V288.681L648.876 298.237" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M617.086 298.907C617.086 298.907 622.18 301.695 624.187 303.294C624.671 303.666 625.043 304.149 625.377 304.67C625.972 305.636 626.27 306.752 626.27 307.867V314.523C622.44 317.869 617.458 320.025 611.955 320.025C606.378 320.025 601.47 317.943 597.64 314.485V307.83C597.64 306.715 597.9 305.562 598.532 304.632C598.867 304.112 599.239 303.666 599.722 303.257C601.693 301.658 606.824 298.869 606.824 298.869" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M611.955 301.584C615.939 301.584 619.168 297.572 619.168 292.623C619.168 287.674 615.939 283.662 611.955 283.662C607.971 283.662 604.742 287.674 604.742 292.623C604.742 297.572 607.971 301.584 611.955 301.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M671.816 298.907C671.816 298.907 676.91 301.695 678.918 303.294C679.401 303.666 679.773 304.149 680.108 304.67C680.703 305.636 681 306.752 681 307.867V314.523C677.17 317.906 672.188 320.063 666.685 320.063C661.108 320.063 656.2 317.981 652.371 314.523V307.867C652.371 306.752 652.631 305.599 653.263 304.67C653.598 304.149 653.969 303.703 654.453 303.294C656.423 301.695 661.554 298.907 661.554 298.907" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M666.648 301.584C670.632 301.584 673.861 297.572 673.861 292.623C673.861 287.674 670.632 283.662 666.648 283.662C662.664 283.662 659.435 287.674 659.435 292.623C659.435 297.572 662.664 301.584 666.648 301.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M644.414 252.244C644.414 252.244 649.508 255.033 651.516 256.632C651.999 257.003 652.371 257.487 652.705 258.007C653.3 258.974 653.598 260.089 653.598 261.205V267.86C649.768 271.244 644.786 273.4 639.283 273.4C633.706 273.4 628.798 271.318 624.968 267.86V261.168C624.968 260.052 625.229 258.9 625.861 257.97C626.195 257.45 626.567 257.003 627.05 256.594C629.021 254.996 634.152 252.207 634.152 252.207" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M639.283 254.921C643.267 254.921 646.496 250.909 646.496 245.961C646.496 241.012 643.267 237 639.283 237C635.299 237 632.07 241.012 632.07 245.961C632.07 250.909 635.299 254.921 639.283 254.921Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#filter9_bd_12_618)">
+<rect x="968" y="503" width="109" height="65" rx="10" fill="#FFC743"/>
+<rect x="968.5" y="503.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M994.462 278.58C1003.76 278.58 1011.29 269.272 1011.29 257.79C1011.29 246.308 1003.76 237 994.462 237C985.167 237 977.632 246.308 977.632 257.79C977.632 269.272 985.167 278.58 994.462 278.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1007.13 271.848C1007.13 271.848 1018.11 277.919 1022.72 281.696C1023.81 282.595 1024.75 283.67 1025.49 284.878C1026.85 287.146 1027.56 289.754 1027.53 292.406V308.017C1018.39 316.317 1006.55 320.921 994.264 320.952C981.968 320.99 970.102 316.376 961.001 308.017V292.406C960.972 289.754 961.676 287.146 963.035 284.878C963.781 283.67 964.719 282.595 965.811 281.696C970.417 277.958 981.412 271.452 981.412 271.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M970.699 290.856C970.29 291.577 970.086 292.394 970.11 293.22V304.077C976.976 309.12 985.308 311.844 993.868 311.844C1002.43 311.844 1010.76 309.12 1017.63 304.077V293.295C1017.65 292.471 1017.45 291.654 1017.05 290.932C1010.36 297.252 1002.42 301.043 993.868 301.043C985.312 301.043 977.372 297.226 970.699 290.856Z" fill="#FFC743"/>
+<path d="M980.411 343.818H982.613V355.857C982.613 357.099 982.32 358.209 981.734 359.186C981.154 360.156 980.334 360.923 979.275 361.485C978.216 362.041 976.973 362.32 975.546 362.32C974.12 362.32 972.877 362.041 971.818 361.485C970.758 360.923 969.936 360.156 969.35 359.186C968.77 358.209 968.48 357.099 968.48 355.857V343.818H970.681V355.679C970.681 356.567 970.877 357.357 971.267 358.049C971.658 358.736 972.214 359.277 972.936 359.674C973.664 360.065 974.534 360.26 975.546 360.26C976.558 360.26 977.428 360.065 978.156 359.674C978.884 359.277 979.441 358.736 979.825 358.049C980.216 357.357 980.411 356.567 980.411 355.679V343.818ZM996.385 351.418L994.503 351.95C994.384 351.637 994.21 351.332 993.979 351.036C993.754 350.734 993.446 350.485 993.056 350.29C992.665 350.095 992.165 349.997 991.555 349.997C990.721 349.997 990.025 350.19 989.469 350.574C988.919 350.953 988.643 351.435 988.643 352.021C988.643 352.542 988.833 352.953 989.212 353.255C989.59 353.557 990.182 353.809 990.987 354.01L993.011 354.507C994.23 354.803 995.139 355.256 995.737 355.865C996.335 356.469 996.633 357.247 996.633 358.2C996.633 358.982 996.408 359.68 995.959 360.295C995.515 360.911 994.893 361.396 994.094 361.751C993.295 362.107 992.366 362.284 991.307 362.284C989.916 362.284 988.765 361.982 987.853 361.379C986.942 360.775 986.365 359.893 986.122 358.733L988.111 358.236C988.3 358.97 988.658 359.52 989.185 359.887C989.718 360.254 990.413 360.438 991.271 360.438C992.248 360.438 993.023 360.23 993.597 359.816C994.177 359.396 994.467 358.893 994.467 358.307C994.467 357.833 994.301 357.437 993.97 357.117C993.639 356.792 993.13 356.549 992.443 356.389L990.17 355.857C988.922 355.561 988.004 355.102 987.418 354.48C986.838 353.853 986.548 353.069 986.548 352.128C986.548 351.358 986.764 350.678 987.196 350.086C987.634 349.494 988.229 349.029 988.981 348.692C989.738 348.355 990.596 348.186 991.555 348.186C992.905 348.186 993.964 348.482 994.734 349.074C995.509 349.666 996.059 350.447 996.385 351.418ZM1005.5 362.284C1004.19 362.284 1003.06 361.994 1002.1 361.414C1001.16 360.828 1000.43 360.011 999.912 358.964C999.403 357.91 999.148 356.685 999.148 355.288C999.148 353.892 999.403 352.661 999.912 351.595C1000.43 350.524 1001.14 349.689 1002.06 349.092C1002.98 348.488 1004.06 348.186 1005.29 348.186C1006 348.186 1006.7 348.304 1007.4 348.541C1008.09 348.778 1008.72 349.163 1009.29 349.695C1009.85 350.222 1010.31 350.92 1010.64 351.79C1010.98 352.661 1011.15 353.732 1011.15 355.004V355.892H1000.64V354.081H1009.02C1009.02 353.312 1008.87 352.625 1008.56 352.021C1008.26 351.418 1007.82 350.941 1007.26 350.592C1006.71 350.243 1006.05 350.068 1005.29 350.068C1004.46 350.068 1003.73 350.275 1003.13 350.69C1002.52 351.098 1002.06 351.631 1001.73 352.288C1001.41 352.945 1001.24 353.649 1001.24 354.401V355.608C1001.24 356.638 1001.42 357.511 1001.78 358.227C1002.14 358.937 1002.64 359.479 1003.28 359.852C1003.92 360.219 1004.66 360.402 1005.5 360.402C1006.05 360.402 1006.55 360.325 1007 360.171C1007.45 360.011 1007.83 359.775 1008.16 359.461C1008.48 359.141 1008.74 358.745 1008.91 358.271L1010.94 358.839C1010.72 359.526 1010.37 360.13 1009.86 360.651C1009.36 361.165 1008.74 361.568 1008 361.858C1007.26 362.142 1006.43 362.284 1005.5 362.284ZM1014.34 362V348.364H1016.36V350.423H1016.5C1016.75 349.749 1017.2 349.201 1017.85 348.781C1018.5 348.361 1019.24 348.151 1020.06 348.151C1020.21 348.151 1020.4 348.154 1020.63 348.159C1020.86 348.165 1021.04 348.174 1021.16 348.186V350.317C1021.09 350.299 1020.92 350.272 1020.67 350.237C1020.42 350.195 1020.16 350.175 1019.88 350.175C1019.21 350.175 1018.62 350.314 1018.1 350.592C1017.59 350.864 1017.18 351.243 1016.88 351.728C1016.58 352.208 1016.43 352.755 1016.43 353.371V362H1014.34Z" fill="#03031C"/>
+<path d="M1010.8 543.32C1009.94 543.32 1009.16 543.157 1008.45 542.831C1007.75 542.5 1007.19 542.023 1006.77 541.402C1006.36 540.775 1006.15 540.017 1006.15 539.129C1006.15 538.348 1006.31 537.715 1006.61 537.229C1006.92 536.738 1007.33 536.353 1007.85 536.075C1008.36 535.797 1008.93 535.59 1009.55 535.454C1010.18 535.312 1010.81 535.199 1011.44 535.116C1012.27 535.01 1012.94 534.93 1013.46 534.877C1013.98 534.818 1014.36 534.72 1014.59 534.584C1014.84 534.448 1014.96 534.211 1014.96 533.874V533.803C1014.96 532.927 1014.72 532.246 1014.24 531.761C1013.77 531.275 1013.05 531.033 1012.08 531.033C1011.08 531.033 1010.3 531.252 1009.73 531.69C1009.16 532.128 1008.76 532.595 1008.53 533.092L1006.54 532.382C1006.9 531.554 1007.37 530.908 1007.96 530.447C1008.56 529.979 1009.21 529.654 1009.92 529.47C1010.63 529.281 1011.32 529.186 1012.01 529.186C1012.45 529.186 1012.95 529.239 1013.52 529.346C1014.09 529.446 1014.65 529.657 1015.18 529.976C1015.72 530.296 1016.17 530.778 1016.52 531.423C1016.88 532.068 1017.05 532.933 1017.05 534.016V543H1014.96V541.153H1014.85C1014.71 541.449 1014.47 541.766 1014.14 542.103C1013.81 542.441 1013.37 542.728 1012.82 542.964C1012.27 543.201 1011.6 543.32 1010.8 543.32ZM1011.12 541.438C1011.95 541.438 1012.65 541.275 1013.22 540.949C1013.79 540.624 1014.22 540.203 1014.51 539.689C1014.81 539.174 1014.96 538.632 1014.96 538.064V536.146C1014.87 536.253 1014.67 536.35 1014.37 536.439C1014.08 536.522 1013.73 536.596 1013.34 536.661C1012.96 536.72 1012.58 536.774 1012.22 536.821C1011.85 536.862 1011.56 536.898 1011.34 536.928C1010.79 536.999 1010.28 537.114 1009.81 537.274C1009.34 537.428 1008.96 537.661 1008.67 537.975C1008.39 538.283 1008.25 538.703 1008.25 539.236C1008.25 539.964 1008.52 540.514 1009.05 540.887C1009.6 541.254 1010.29 541.438 1011.12 541.438ZM1020.88 548.114V529.364H1022.9V531.53H1023.15C1023.3 531.293 1023.52 530.991 1023.79 530.624C1024.07 530.251 1024.46 529.92 1024.98 529.63C1025.5 529.334 1026.2 529.186 1027.09 529.186C1028.24 529.186 1029.25 529.473 1030.13 530.047C1031 530.621 1031.69 531.435 1032.18 532.489C1032.67 533.542 1032.92 534.785 1032.92 536.217C1032.92 537.661 1032.67 538.913 1032.18 539.973C1031.69 541.026 1031.01 541.843 1030.14 542.423C1029.27 542.997 1028.26 543.284 1027.13 543.284C1026.25 543.284 1025.55 543.139 1025.02 542.849C1024.5 542.553 1024.09 542.219 1023.81 541.846C1023.52 541.467 1023.3 541.153 1023.15 540.905H1022.97V548.114H1020.88ZM1022.94 536.182C1022.94 537.212 1023.09 538.12 1023.39 538.907C1023.69 539.689 1024.13 540.301 1024.71 540.745C1025.29 541.183 1026 541.402 1026.84 541.402C1027.72 541.402 1028.45 541.171 1029.04 540.71C1029.63 540.242 1030.07 539.615 1030.37 538.827C1030.67 538.034 1030.82 537.152 1030.82 536.182C1030.82 535.223 1030.67 534.359 1030.38 533.589C1030.09 532.814 1029.65 532.202 1029.05 531.752C1028.47 531.296 1027.73 531.068 1026.84 531.068C1025.99 531.068 1025.28 531.284 1024.7 531.716C1024.12 532.142 1023.68 532.74 1023.38 533.51C1023.09 534.273 1022.94 535.164 1022.94 536.182ZM1036.11 543V529.364H1038.21V543H1036.11ZM1037.18 527.091C1036.77 527.091 1036.42 526.952 1036.12 526.674C1035.83 526.395 1035.69 526.061 1035.69 525.67C1035.69 525.28 1035.83 524.945 1036.12 524.667C1036.42 524.389 1036.77 524.25 1037.18 524.25C1037.59 524.25 1037.93 524.389 1038.22 524.667C1038.52 524.945 1038.67 525.28 1038.67 525.67C1038.67 526.061 1038.52 526.395 1038.22 526.674C1037.93 526.952 1037.59 527.091 1037.18 527.091Z" fill="#03031C"/>
+<g filter="url(#filter10_bd_12_618)">
+<rect x="1095" y="503" width="109" height="65" rx="10" fill="#FFC743"/>
+<rect x="1095.5" y="503.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M1137.8 543.32C1136.94 543.32 1136.16 543.157 1135.45 542.831C1134.75 542.5 1134.19 542.023 1133.77 541.402C1133.36 540.775 1133.15 540.017 1133.15 539.129C1133.15 538.348 1133.31 537.715 1133.61 537.229C1133.92 536.738 1134.33 536.353 1134.85 536.075C1135.36 535.797 1135.93 535.59 1136.55 535.454C1137.18 535.312 1137.81 535.199 1138.44 535.116C1139.27 535.01 1139.94 534.93 1140.46 534.877C1140.98 534.818 1141.36 534.72 1141.59 534.584C1141.84 534.448 1141.96 534.211 1141.96 533.874V533.803C1141.96 532.927 1141.72 532.246 1141.24 531.761C1140.77 531.275 1140.05 531.033 1139.08 531.033C1138.08 531.033 1137.3 531.252 1136.73 531.69C1136.16 532.128 1135.76 532.595 1135.53 533.092L1133.54 532.382C1133.9 531.554 1134.37 530.908 1134.96 530.447C1135.56 529.979 1136.21 529.654 1136.92 529.47C1137.63 529.281 1138.32 529.186 1139.01 529.186C1139.45 529.186 1139.95 529.239 1140.52 529.346C1141.09 529.446 1141.65 529.657 1142.18 529.976C1142.72 530.296 1143.17 530.778 1143.52 531.423C1143.88 532.068 1144.05 532.933 1144.05 534.016V543H1141.96V541.153H1141.85C1141.71 541.449 1141.47 541.766 1141.14 542.103C1140.81 542.441 1140.37 542.728 1139.82 542.964C1139.27 543.201 1138.6 543.32 1137.8 543.32ZM1138.12 541.438C1138.95 541.438 1139.65 541.275 1140.22 540.949C1140.79 540.624 1141.22 540.203 1141.51 539.689C1141.81 539.174 1141.96 538.632 1141.96 538.064V536.146C1141.87 536.253 1141.67 536.35 1141.37 536.439C1141.08 536.522 1140.73 536.596 1140.34 536.661C1139.96 536.72 1139.58 536.774 1139.22 536.821C1138.85 536.862 1138.56 536.898 1138.34 536.928C1137.79 536.999 1137.28 537.114 1136.81 537.274C1136.34 537.428 1135.96 537.661 1135.67 537.975C1135.39 538.283 1135.25 538.703 1135.25 539.236C1135.25 539.964 1135.52 540.514 1136.05 540.887C1136.6 541.254 1137.29 541.438 1138.12 541.438ZM1147.88 548.114V529.364H1149.9V531.53H1150.15C1150.3 531.293 1150.52 530.991 1150.79 530.624C1151.07 530.251 1151.46 529.92 1151.98 529.63C1152.5 529.334 1153.2 529.186 1154.09 529.186C1155.24 529.186 1156.25 529.473 1157.13 530.047C1158 530.621 1158.69 531.435 1159.18 532.489C1159.67 533.542 1159.92 534.785 1159.92 536.217C1159.92 537.661 1159.67 538.913 1159.18 539.973C1158.69 541.026 1158.01 541.843 1157.14 542.423C1156.27 542.997 1155.26 543.284 1154.13 543.284C1153.25 543.284 1152.55 543.139 1152.02 542.849C1151.5 542.553 1151.09 542.219 1150.81 541.846C1150.52 541.467 1150.3 541.153 1150.15 540.905H1149.97V548.114H1147.88ZM1149.94 536.182C1149.94 537.212 1150.09 538.12 1150.39 538.907C1150.69 539.689 1151.13 540.301 1151.71 540.745C1152.29 541.183 1153 541.402 1153.84 541.402C1154.72 541.402 1155.45 541.171 1156.04 540.71C1156.63 540.242 1157.07 539.615 1157.37 538.827C1157.67 538.034 1157.82 537.152 1157.82 536.182C1157.82 535.223 1157.67 534.359 1157.38 533.589C1157.09 532.814 1156.65 532.202 1156.05 531.752C1155.47 531.296 1154.73 531.068 1153.84 531.068C1152.99 531.068 1152.28 531.284 1151.7 531.716C1151.12 532.142 1150.68 532.74 1150.38 533.51C1150.09 534.273 1149.94 535.164 1149.94 536.182ZM1163.11 543V529.364H1165.21V543H1163.11ZM1164.18 527.091C1163.77 527.091 1163.42 526.952 1163.12 526.674C1162.83 526.395 1162.69 526.061 1162.69 525.67C1162.69 525.28 1162.83 524.945 1163.12 524.667C1163.42 524.389 1163.77 524.25 1164.18 524.25C1164.59 524.25 1164.93 524.389 1165.22 524.667C1165.52 524.945 1165.67 525.28 1165.67 525.67C1165.67 526.061 1165.52 526.395 1165.22 526.674C1164.93 526.952 1164.59 527.091 1164.18 527.091Z" fill="#03031C"/>
+<path d="M1098 343.818H1100.2V355.857C1100.2 357.099 1099.91 358.209 1099.32 359.186C1098.74 360.156 1097.92 360.923 1096.86 361.485C1095.8 362.041 1094.56 362.32 1093.13 362.32C1091.7 362.32 1090.46 362.041 1089.4 361.485C1088.34 360.923 1087.52 360.156 1086.93 359.186C1086.35 358.209 1086.06 357.099 1086.06 355.857V343.818H1088.27V355.679C1088.27 356.567 1088.46 357.357 1088.85 358.049C1089.24 358.736 1089.8 359.277 1090.52 359.674C1091.25 360.065 1092.12 360.26 1093.13 360.26C1094.14 360.26 1095.01 360.065 1095.74 359.674C1096.47 359.277 1097.03 358.736 1097.41 358.049C1097.8 357.357 1098 356.567 1098 355.679V343.818ZM1113.97 351.418L1112.09 351.95C1111.97 351.637 1111.79 351.332 1111.56 351.036C1111.34 350.734 1111.03 350.485 1110.64 350.29C1110.25 350.095 1109.75 349.997 1109.14 349.997C1108.31 349.997 1107.61 350.19 1107.05 350.574C1106.5 350.953 1106.23 351.435 1106.23 352.021C1106.23 352.542 1106.42 352.953 1106.8 353.255C1107.18 353.557 1107.77 353.809 1108.57 354.01L1110.6 354.507C1111.82 354.803 1112.72 355.256 1113.32 355.865C1113.92 356.469 1114.22 357.247 1114.22 358.2C1114.22 358.982 1113.99 359.68 1113.54 360.295C1113.1 360.911 1112.48 361.396 1111.68 361.751C1110.88 362.107 1109.95 362.284 1108.89 362.284C1107.5 362.284 1106.35 361.982 1105.44 361.379C1104.53 360.775 1103.95 359.893 1103.71 358.733L1105.7 358.236C1105.89 358.97 1106.24 359.52 1106.77 359.887C1107.3 360.254 1108 360.438 1108.86 360.438C1109.83 360.438 1110.61 360.23 1111.18 359.816C1111.76 359.396 1112.05 358.893 1112.05 358.307C1112.05 357.833 1111.89 357.437 1111.55 357.117C1111.22 356.792 1110.71 356.549 1110.03 356.389L1107.76 355.857C1106.51 355.561 1105.59 355.102 1105 354.48C1104.42 353.853 1104.13 353.069 1104.13 352.128C1104.13 351.358 1104.35 350.678 1104.78 350.086C1105.22 349.494 1105.81 349.029 1106.57 348.692C1107.32 348.355 1108.18 348.186 1109.14 348.186C1110.49 348.186 1111.55 348.482 1112.32 349.074C1113.09 349.666 1113.64 350.447 1113.97 351.418ZM1123.09 362.284C1121.78 362.284 1120.64 361.994 1119.69 361.414C1118.74 360.828 1118.01 360.011 1117.5 358.964C1116.99 357.91 1116.73 356.685 1116.73 355.288C1116.73 353.892 1116.99 352.661 1117.5 351.595C1118.01 350.524 1118.73 349.689 1119.64 349.092C1120.57 348.488 1121.65 348.186 1122.88 348.186C1123.59 348.186 1124.29 348.304 1124.98 348.541C1125.67 348.778 1126.3 349.163 1126.87 349.695C1127.44 350.222 1127.89 350.92 1128.23 351.79C1128.57 352.661 1128.74 353.732 1128.74 355.004V355.892H1118.22V354.081H1126.61C1126.61 353.312 1126.45 352.625 1126.14 352.021C1125.84 351.418 1125.41 350.941 1124.85 350.592C1124.29 350.243 1123.63 350.068 1122.88 350.068C1122.04 350.068 1121.32 350.275 1120.71 350.69C1120.11 351.098 1119.64 351.631 1119.32 352.288C1118.99 352.945 1118.83 353.649 1118.83 354.401V355.608C1118.83 356.638 1119.01 357.511 1119.36 358.227C1119.72 358.937 1120.22 359.479 1120.86 359.852C1121.5 360.219 1122.24 360.402 1123.09 360.402C1123.64 360.402 1124.14 360.325 1124.58 360.171C1125.03 360.011 1125.42 359.775 1125.74 359.461C1126.07 359.141 1126.32 358.745 1126.5 358.271L1128.52 358.839C1128.31 359.526 1127.95 360.13 1127.45 360.651C1126.95 361.165 1126.32 361.568 1125.58 361.858C1124.84 362.142 1124.01 362.284 1123.09 362.284ZM1131.92 362V348.364H1133.95V350.423H1134.09C1134.34 349.749 1134.79 349.201 1135.44 348.781C1136.09 348.361 1136.82 348.151 1137.64 348.151C1137.79 348.151 1137.99 348.154 1138.22 348.159C1138.45 348.165 1138.62 348.174 1138.74 348.186V350.317C1138.67 350.299 1138.51 350.272 1138.25 350.237C1138 350.195 1137.74 350.175 1137.46 350.175C1136.8 350.175 1136.21 350.314 1135.69 350.592C1135.17 350.864 1134.76 351.243 1134.46 351.728C1134.17 352.208 1134.02 352.755 1134.02 353.371V362H1131.92ZM1153.76 367.398C1152.75 367.398 1151.88 367.268 1151.15 367.007C1150.42 366.753 1149.82 366.415 1149.33 365.995C1148.85 365.581 1148.47 365.137 1148.18 364.663L1149.85 363.491C1150.04 363.74 1150.28 364.024 1150.57 364.344C1150.86 364.669 1151.26 364.95 1151.76 365.187C1152.27 365.43 1152.94 365.551 1153.76 365.551C1154.86 365.551 1155.77 365.285 1156.49 364.752C1157.2 364.219 1157.56 363.385 1157.56 362.249V359.479H1157.38C1157.23 359.727 1157.01 360.035 1156.73 360.402C1156.45 360.763 1156.04 361.086 1155.52 361.37C1155 361.648 1154.29 361.787 1153.41 361.787C1152.3 361.787 1151.32 361.527 1150.44 361.006C1149.57 360.485 1148.88 359.727 1148.37 358.733C1147.87 357.739 1147.62 356.531 1147.62 355.111C1147.62 353.714 1147.86 352.498 1148.35 351.462C1148.84 350.42 1149.53 349.615 1150.4 349.047C1151.28 348.473 1152.29 348.186 1153.44 348.186C1154.33 348.186 1155.03 348.334 1155.55 348.63C1156.08 348.92 1156.48 349.251 1156.76 349.624C1157.05 349.991 1157.26 350.293 1157.42 350.53H1157.63V348.364H1159.66V362.391C1159.66 363.562 1159.39 364.515 1158.86 365.249C1158.33 365.989 1157.62 366.531 1156.73 366.874C1155.84 367.223 1154.85 367.398 1153.76 367.398ZM1153.69 359.905C1154.53 359.905 1155.24 359.712 1155.82 359.328C1156.4 358.943 1156.84 358.39 1157.14 357.668C1157.44 356.946 1157.6 356.081 1157.6 355.075C1157.6 354.093 1157.45 353.226 1157.15 352.474C1156.86 351.722 1156.42 351.134 1155.84 350.707C1155.26 350.281 1154.54 350.068 1153.69 350.068C1152.8 350.068 1152.06 350.293 1151.47 350.743C1150.88 351.193 1150.44 351.796 1150.15 352.554C1149.86 353.312 1149.71 354.152 1149.71 355.075C1149.71 356.022 1149.86 356.86 1150.16 357.588C1150.46 358.31 1150.9 358.878 1151.49 359.292C1152.08 359.701 1152.81 359.905 1153.69 359.905ZM1163.49 362V348.364H1165.51V350.423H1165.66C1165.91 349.749 1166.35 349.201 1167.01 348.781C1167.66 348.361 1168.39 348.151 1169.21 348.151C1169.36 348.151 1169.55 348.154 1169.78 348.159C1170.02 348.165 1170.19 348.174 1170.31 348.186V350.317C1170.24 350.299 1170.07 350.272 1169.82 350.237C1169.57 350.195 1169.31 350.175 1169.03 350.175C1168.37 350.175 1167.78 350.314 1167.25 350.592C1166.74 350.864 1166.33 351.243 1166.03 351.728C1165.73 352.208 1165.59 352.755 1165.59 353.371V362H1163.49ZM1177.92 362.284C1176.69 362.284 1175.61 361.991 1174.68 361.405C1173.75 360.819 1173.03 360 1172.51 358.946C1172 357.893 1171.74 356.661 1171.74 355.253C1171.74 353.832 1172 352.592 1172.51 351.533C1173.03 350.474 1173.75 349.651 1174.68 349.065C1175.61 348.479 1176.69 348.186 1177.92 348.186C1179.15 348.186 1180.23 348.479 1181.15 349.065C1182.08 349.651 1182.8 350.474 1183.31 351.533C1183.84 352.592 1184.1 353.832 1184.1 355.253C1184.1 356.661 1183.84 357.893 1183.31 358.946C1182.8 360 1182.08 360.819 1181.15 361.405C1180.23 361.991 1179.15 362.284 1177.92 362.284ZM1177.92 360.402C1178.85 360.402 1179.62 360.162 1180.23 359.683C1180.83 359.203 1181.28 358.573 1181.57 357.792C1181.86 357.011 1182 356.164 1182 355.253C1182 354.341 1181.86 353.492 1181.57 352.705C1181.28 351.918 1180.83 351.281 1180.23 350.796C1179.62 350.311 1178.85 350.068 1177.92 350.068C1176.98 350.068 1176.21 350.311 1175.61 350.796C1175 351.281 1174.56 351.918 1174.27 352.705C1173.98 353.492 1173.83 354.341 1173.83 355.253C1173.83 356.164 1173.98 357.011 1174.27 357.792C1174.56 358.573 1175 359.203 1175.61 359.683C1176.21 360.162 1176.98 360.402 1177.92 360.402ZM1195.89 356.425V348.364H1197.98V362H1195.89V359.692H1195.75C1195.43 360.384 1194.93 360.973 1194.25 361.458C1193.58 361.938 1192.73 362.178 1191.7 362.178C1190.85 362.178 1190.09 361.991 1189.42 361.618C1188.76 361.239 1188.24 360.671 1187.86 359.914C1187.48 359.15 1187.29 358.188 1187.29 357.028V348.364H1189.39V356.886C1189.39 357.881 1189.67 358.674 1190.22 359.266C1190.79 359.857 1191.5 360.153 1192.37 360.153C1192.89 360.153 1193.42 360.02 1193.96 359.754C1194.51 359.488 1194.96 359.079 1195.33 358.529C1195.7 357.978 1195.89 357.277 1195.89 356.425ZM1201.82 367.114V348.364H1203.84V350.53H1204.09C1204.25 350.293 1204.46 349.991 1204.73 349.624C1205.01 349.251 1205.41 348.92 1205.92 348.63C1206.44 348.334 1207.15 348.186 1208.03 348.186C1209.18 348.186 1210.2 348.473 1211.07 349.047C1211.95 349.621 1212.63 350.435 1213.12 351.489C1213.61 352.542 1213.86 353.785 1213.86 355.217C1213.86 356.661 1213.61 357.913 1213.12 358.973C1212.63 360.026 1211.95 360.843 1211.08 361.423C1210.21 361.997 1209.21 362.284 1208.07 362.284C1207.19 362.284 1206.49 362.139 1205.97 361.849C1205.44 361.553 1205.03 361.219 1204.75 360.846C1204.47 360.467 1204.25 360.153 1204.09 359.905H1203.92V367.114H1201.82ZM1203.88 355.182C1203.88 356.212 1204.03 357.12 1204.33 357.907C1204.63 358.689 1205.08 359.301 1205.66 359.745C1206.24 360.183 1206.95 360.402 1207.79 360.402C1208.66 360.402 1209.39 360.171 1209.98 359.71C1210.57 359.242 1211.01 358.615 1211.31 357.827C1211.61 357.034 1211.76 356.152 1211.76 355.182C1211.76 354.223 1211.62 353.359 1211.32 352.589C1211.03 351.814 1210.59 351.202 1210 350.752C1209.41 350.296 1208.67 350.068 1207.79 350.068C1206.93 350.068 1206.22 350.284 1205.64 350.716C1205.06 351.142 1204.62 351.74 1204.32 352.51C1204.03 353.273 1203.88 354.164 1203.88 355.182Z" fill="#03031C"/>
+<path d="M1139.28 260.126C1139.13 260.387 1139.02 260.759 1139.02 261.168V265.89C1142.03 268.12 1145.53 269.273 1149.25 269.273C1153.67 269.273 1157.13 267.6 1159.47 265.89V261.168C1159.47 260.759 1159.4 260.387 1159.21 260.126C1156.35 262.915 1152.89 264.514 1149.21 264.514C1145.6 264.551 1142.14 262.915 1139.28 260.126Z" fill="#FFC743"/>
+<path d="M1111.99 307.644C1111.84 307.904 1111.73 308.276 1111.73 308.685V313.407C1114.74 315.638 1118.24 316.791 1121.95 316.791C1126.38 316.791 1129.84 315.117 1132.18 313.407V308.685C1132.18 308.276 1132.11 307.904 1131.92 307.644C1129.06 310.433 1125.6 312.031 1121.92 312.031C1118.31 312.069 1114.85 310.433 1111.99 307.644Z" fill="#FFC743"/>
+<path d="M1166.65 307.644C1166.5 307.904 1166.39 308.276 1166.39 308.685V313.407C1169.4 315.638 1172.89 316.791 1176.61 316.791C1181.04 316.791 1184.49 315.117 1186.84 313.407V308.685C1186.84 308.276 1186.76 307.904 1186.58 307.644C1183.71 310.433 1180.25 312.031 1176.57 312.031C1172.97 312.069 1169.51 310.433 1166.65 307.644Z" fill="#FFC743"/>
+<path d="M1149.32 288.682L1139.65 298.349" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1149.32 278.011V288.681L1158.88 298.237" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1127.09 298.907C1127.09 298.907 1132.18 301.695 1134.19 303.294C1134.67 303.666 1135.04 304.149 1135.38 304.67C1135.97 305.636 1136.27 306.752 1136.27 307.867V314.523C1132.44 317.869 1127.46 320.025 1121.95 320.025C1116.38 320.025 1111.47 317.943 1107.64 314.485V307.83C1107.64 306.715 1107.9 305.562 1108.53 304.632C1108.87 304.112 1109.24 303.666 1109.72 303.257C1111.69 301.658 1116.82 298.869 1116.82 298.869" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1121.95 301.584C1125.94 301.584 1129.17 297.572 1129.17 292.623C1129.17 287.674 1125.94 283.662 1121.95 283.662C1117.97 283.662 1114.74 287.674 1114.74 292.623C1114.74 297.572 1117.97 301.584 1121.95 301.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1181.82 298.907C1181.82 298.907 1186.91 301.695 1188.92 303.294C1189.4 303.666 1189.77 304.149 1190.11 304.67C1190.7 305.636 1191 306.752 1191 307.867V314.523C1187.17 317.906 1182.19 320.063 1176.69 320.063C1171.11 320.063 1166.2 317.981 1162.37 314.523V307.867C1162.37 306.752 1162.63 305.599 1163.26 304.67C1163.6 304.149 1163.97 303.703 1164.45 303.294C1166.42 301.695 1171.55 298.907 1171.55 298.907" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1176.65 301.584C1180.63 301.584 1183.86 297.572 1183.86 292.623C1183.86 287.674 1180.63 283.662 1176.65 283.662C1172.66 283.662 1169.44 287.674 1169.44 292.623C1169.44 297.572 1172.66 301.584 1176.65 301.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1154.41 252.244C1154.41 252.244 1159.51 255.033 1161.52 256.632C1162 257.003 1162.37 257.487 1162.71 258.007C1163.3 258.974 1163.6 260.089 1163.6 261.205V267.86C1159.77 271.244 1154.79 273.4 1149.28 273.4C1143.71 273.4 1138.8 271.318 1134.97 267.86V261.168C1134.97 260.052 1135.23 258.9 1135.86 257.97C1136.2 257.45 1136.57 257.003 1137.05 256.594C1139.02 254.996 1144.15 252.207 1144.15 252.207" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1149.28 254.921C1153.27 254.921 1156.5 250.909 1156.5 245.961C1156.5 241.012 1153.27 237 1149.28 237C1145.3 237 1142.07 241.012 1142.07 245.961C1142.07 250.909 1145.3 254.921 1149.28 254.921Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#filter11_bd_12_618)">
+<rect x="745" y="979" width="286" height="197" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="745.5" y="979.5" width="285" height="196" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M793.118 1116.99V1113.18H811.037V1116.99H804.357V1135H799.798V1116.99H793.118ZM814.83 1141.14C814.254 1141.14 813.715 1141.09 813.21 1141C812.713 1140.91 812.301 1140.8 811.975 1140.67L812.997 1137.28C813.53 1137.44 814.009 1137.53 814.436 1137.55C814.869 1137.56 815.242 1137.46 815.554 1137.25C815.874 1137.03 816.133 1136.67 816.332 1136.16L816.598 1135.47L810.728 1118.64H815.501L818.889 1130.65H819.059L822.479 1118.64H827.284L820.923 1136.77C820.618 1137.65 820.203 1138.42 819.677 1139.07C819.159 1139.73 818.502 1140.24 817.706 1140.59C816.911 1140.96 815.952 1141.14 814.83 1141.14ZM833.718 1130.29L833.729 1124.85H834.389L839.631 1118.64H844.84L837.798 1126.86H836.722L833.718 1130.29ZM829.606 1135V1113.18H834.144V1135H829.606ZM839.833 1135L835.018 1127.87L838.044 1124.67L845.149 1135H839.833ZM874.145 1124.09C874.145 1126.47 873.694 1128.49 872.792 1130.16C871.897 1131.83 870.676 1133.11 869.127 1133.99C867.586 1134.86 865.853 1135.3 863.929 1135.3C861.99 1135.3 860.25 1134.86 858.708 1133.98C857.167 1133.1 855.949 1131.82 855.054 1130.15C854.159 1128.48 853.712 1126.46 853.712 1124.09C853.712 1121.71 854.159 1119.69 855.054 1118.02C855.949 1116.35 857.167 1115.08 858.708 1114.2C860.25 1113.32 861.99 1112.88 863.929 1112.88C865.853 1112.88 867.586 1113.32 869.127 1114.2C870.676 1115.08 871.897 1116.35 872.792 1118.02C873.694 1119.69 874.145 1121.71 874.145 1124.09ZM869.468 1124.09C869.468 1122.55 869.238 1121.25 868.776 1120.19C868.321 1119.13 867.679 1118.33 866.848 1117.78C866.017 1117.24 865.044 1116.96 863.929 1116.96C862.814 1116.96 861.841 1117.24 861.01 1117.78C860.179 1118.33 859.532 1119.13 859.071 1120.19C858.616 1121.25 858.389 1122.55 858.389 1124.09C858.389 1125.63 858.616 1126.93 859.071 1127.99C859.532 1129.05 860.179 1129.85 861.01 1130.4C861.841 1130.94 862.814 1131.22 863.929 1131.22C865.044 1131.22 866.017 1130.94 866.848 1130.4C867.679 1129.85 868.321 1129.05 868.776 1127.99C869.238 1126.93 869.468 1125.63 869.468 1124.09ZM877.477 1141.14V1118.64H881.952V1121.38H882.154C882.353 1120.94 882.64 1120.5 883.017 1120.04C883.4 1119.58 883.898 1119.2 884.508 1118.89C885.126 1118.58 885.893 1118.42 886.809 1118.42C888.003 1118.42 889.104 1118.74 890.112 1119.36C891.121 1119.98 891.927 1120.91 892.53 1122.16C893.134 1123.41 893.436 1124.96 893.436 1126.84C893.436 1128.66 893.141 1130.21 892.552 1131.46C891.969 1132.71 891.174 1133.66 890.165 1134.31C889.164 1134.95 888.042 1135.27 886.799 1135.27C885.918 1135.27 885.169 1135.12 884.551 1134.83C883.94 1134.54 883.439 1134.17 883.049 1133.73C882.658 1133.28 882.36 1132.83 882.154 1132.38H882.015V1141.14H877.477ZM881.92 1126.82C881.92 1127.79 882.055 1128.64 882.324 1129.36C882.594 1130.09 882.985 1130.65 883.496 1131.06C884.008 1131.46 884.629 1131.65 885.361 1131.65C886.099 1131.65 886.724 1131.45 887.236 1131.05C887.747 1130.64 888.134 1130.07 888.397 1129.34C888.667 1128.61 888.802 1127.77 888.802 1126.82C888.802 1125.87 888.67 1125.04 888.407 1124.33C888.145 1123.61 887.758 1123.05 887.246 1122.64C886.735 1122.24 886.106 1122.03 885.361 1122.03C884.622 1122.03 883.997 1122.23 883.486 1122.62C882.981 1123.01 882.594 1123.57 882.324 1124.28C882.055 1125 881.92 1125.85 881.92 1126.82ZM903.919 1135.32C902.236 1135.32 900.787 1134.98 899.572 1134.3C898.365 1133.61 897.434 1132.63 896.781 1131.38C896.128 1130.11 895.801 1128.62 895.801 1126.89C895.801 1125.21 896.128 1123.73 896.781 1122.46C897.434 1121.19 898.354 1120.2 899.54 1119.49C900.733 1118.78 902.133 1118.42 903.738 1118.42C904.817 1118.42 905.822 1118.6 906.753 1118.95C907.69 1119.29 908.507 1119.8 909.203 1120.49C909.906 1121.18 910.453 1122.05 910.844 1123.09C911.234 1124.13 911.43 1125.34 911.43 1126.73V1127.98H897.612V1125.17H907.157C907.157 1124.51 907.015 1123.93 906.731 1123.43C906.447 1122.93 906.053 1122.53 905.549 1122.25C905.052 1121.96 904.473 1121.81 903.812 1121.81C903.123 1121.81 902.513 1121.97 901.98 1122.29C901.454 1122.6 901.042 1123.03 900.744 1123.56C900.446 1124.08 900.293 1124.67 900.286 1125.32V1127.99C900.286 1128.8 900.435 1129.5 900.733 1130.09C901.039 1130.68 901.469 1131.13 902.023 1131.45C902.577 1131.77 903.233 1131.93 903.993 1131.93C904.498 1131.93 904.959 1131.86 905.378 1131.72C905.797 1131.58 906.156 1131.36 906.454 1131.08C906.753 1130.8 906.98 1130.45 907.136 1130.04L911.334 1130.31C911.121 1131.32 910.684 1132.2 910.023 1132.95C909.37 1133.7 908.525 1134.28 907.488 1134.7C906.458 1135.11 905.268 1135.32 903.919 1135.32ZM914.391 1135V1118.64H918.791V1121.49H918.961C919.26 1120.48 919.76 1119.71 920.464 1119.19C921.167 1118.66 921.976 1118.4 922.893 1118.4C923.12 1118.4 923.365 1118.42 923.628 1118.44C923.89 1118.47 924.121 1118.51 924.32 1118.56V1122.59C924.107 1122.52 923.812 1122.47 923.436 1122.42C923.059 1122.37 922.715 1122.34 922.403 1122.34C921.735 1122.34 921.138 1122.49 920.613 1122.78C920.094 1123.06 919.682 1123.46 919.377 1123.97C919.079 1124.49 918.93 1125.07 918.93 1125.74V1135H914.391ZM930.864 1135.31C929.82 1135.31 928.89 1135.13 928.073 1134.77C927.256 1134.4 926.61 1133.85 926.134 1133.14C925.665 1132.41 925.431 1131.51 925.431 1130.43C925.431 1129.52 925.598 1128.76 925.931 1128.14C926.265 1127.52 926.72 1127.02 927.295 1126.65C927.87 1126.27 928.524 1125.99 929.255 1125.8C929.994 1125.6 930.768 1125.47 931.578 1125.39C932.529 1125.29 933.297 1125.2 933.879 1125.11C934.461 1125.02 934.884 1124.89 935.147 1124.71C935.409 1124.53 935.541 1124.27 935.541 1123.92V1123.86C935.541 1123.18 935.328 1122.66 934.902 1122.29C934.483 1121.92 933.886 1121.74 933.112 1121.74C932.295 1121.74 931.645 1121.92 931.162 1122.28C930.679 1122.63 930.36 1123.08 930.203 1123.62L926.006 1123.28C926.219 1122.29 926.638 1121.43 927.263 1120.7C927.888 1119.97 928.694 1119.41 929.681 1119.02C930.676 1118.62 931.826 1118.42 933.133 1118.42C934.042 1118.42 934.912 1118.53 935.743 1118.74C936.581 1118.96 937.324 1119.29 937.97 1119.73C938.623 1120.18 939.138 1120.76 939.515 1121.46C939.891 1122.16 940.079 1122.99 940.079 1123.96V1135H935.775V1132.73H935.647C935.385 1133.24 935.033 1133.69 934.593 1134.08C934.152 1134.47 933.623 1134.77 933.005 1134.99C932.387 1135.2 931.674 1135.31 930.864 1135.31ZM932.164 1132.18C932.831 1132.18 933.421 1132.05 933.932 1131.78C934.444 1131.51 934.845 1131.15 935.136 1130.7C935.427 1130.24 935.573 1129.73 935.573 1129.15V1127.41C935.431 1127.51 935.235 1127.59 934.987 1127.67C934.745 1127.74 934.472 1127.81 934.167 1127.87C933.861 1127.93 933.556 1127.98 933.25 1128.03C932.945 1128.08 932.668 1128.11 932.419 1128.15C931.887 1128.23 931.422 1128.35 931.024 1128.52C930.626 1128.69 930.317 1128.92 930.097 1129.22C929.877 1129.5 929.767 1129.85 929.767 1130.28C929.767 1130.9 929.99 1131.37 930.438 1131.7C930.892 1132.02 931.468 1132.18 932.164 1132.18ZM952.304 1118.64V1122.05H942.45V1118.64H952.304ZM944.687 1114.72H949.225V1129.97C949.225 1130.39 949.289 1130.72 949.417 1130.95C949.545 1131.18 949.722 1131.34 949.95 1131.43C950.184 1131.52 950.454 1131.57 950.759 1131.57C950.972 1131.57 951.185 1131.55 951.398 1131.52C951.612 1131.47 951.775 1131.44 951.888 1131.42L952.602 1134.8C952.375 1134.87 952.055 1134.95 951.643 1135.04C951.232 1135.14 950.731 1135.2 950.141 1135.22C949.048 1135.27 948.089 1135.12 947.265 1134.79C946.448 1134.45 945.813 1133.93 945.358 1133.23C944.903 1132.53 944.68 1131.64 944.687 1130.57V1114.72ZM962.478 1135.32C960.823 1135.32 959.392 1134.97 958.185 1134.26C956.984 1133.55 956.058 1132.57 955.404 1131.3C954.751 1130.03 954.424 1128.56 954.424 1126.88C954.424 1125.19 954.751 1123.71 955.404 1122.45C956.058 1121.18 956.984 1120.19 958.185 1119.49C959.392 1118.78 960.823 1118.42 962.478 1118.42C964.133 1118.42 965.56 1118.78 966.761 1119.49C967.968 1120.19 968.898 1121.18 969.552 1122.45C970.205 1123.71 970.532 1125.19 970.532 1126.88C970.532 1128.56 970.205 1130.03 969.552 1131.3C968.898 1132.57 967.968 1133.55 966.761 1134.26C965.56 1134.97 964.133 1135.32 962.478 1135.32ZM962.499 1131.8C963.252 1131.8 963.881 1131.59 964.385 1131.16C964.889 1130.73 965.269 1130.14 965.525 1129.4C965.788 1128.65 965.919 1127.8 965.919 1126.85C965.919 1125.9 965.788 1125.05 965.525 1124.3C965.269 1123.56 964.889 1122.97 964.385 1122.54C963.881 1122.1 963.252 1121.89 962.499 1121.89C961.739 1121.89 961.1 1122.1 960.582 1122.54C960.07 1122.97 959.683 1123.56 959.42 1124.3C959.165 1125.05 959.037 1125.9 959.037 1126.85C959.037 1127.8 959.165 1128.65 959.42 1129.4C959.683 1130.14 960.07 1130.73 960.582 1131.16C961.1 1131.59 961.739 1131.8 962.499 1131.8ZM973.483 1135V1118.64H977.883V1121.49H978.053C978.352 1120.48 978.852 1119.71 979.555 1119.19C980.259 1118.66 981.068 1118.4 981.984 1118.4C982.212 1118.4 982.457 1118.42 982.719 1118.44C982.982 1118.47 983.213 1118.51 983.412 1118.56V1122.59C983.199 1122.52 982.904 1122.47 982.528 1122.42C982.151 1122.37 981.807 1122.34 981.494 1122.34C980.827 1122.34 980.23 1122.49 979.705 1122.78C979.186 1123.06 978.774 1123.46 978.469 1123.97C978.17 1124.49 978.021 1125.07 978.021 1125.74V1135H973.483Z" fill="#03031C"/>
+<g filter="url(#filter12_bd_12_618)">
+<rect x="565" y="1361" width="286" height="221" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="565.5" y="1361.5" width="285" height="220" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M629.286 1528.54V1538H624.748V1521.64H629.073V1524.52H629.265C629.627 1523.57 630.234 1522.82 631.086 1522.26C631.939 1521.7 632.972 1521.42 634.187 1521.42C635.323 1521.42 636.314 1521.67 637.159 1522.17C638.004 1522.67 638.661 1523.38 639.13 1524.3C639.598 1525.22 639.833 1526.31 639.833 1527.58V1538H635.294V1528.39C635.302 1527.39 635.046 1526.61 634.527 1526.05C634.009 1525.48 633.295 1525.19 632.386 1525.19C631.775 1525.19 631.236 1525.33 630.767 1525.59C630.305 1525.85 629.943 1526.24 629.68 1526.74C629.424 1527.24 629.293 1527.84 629.286 1528.54ZM648.076 1538.31C647.032 1538.31 646.101 1538.13 645.285 1537.77C644.468 1537.4 643.822 1536.85 643.346 1536.14C642.877 1535.41 642.643 1534.51 642.643 1533.43C642.643 1532.52 642.81 1531.76 643.143 1531.14C643.477 1530.52 643.932 1530.02 644.507 1529.65C645.082 1529.27 645.736 1528.99 646.467 1528.8C647.206 1528.6 647.98 1528.47 648.79 1528.39C649.741 1528.29 650.508 1528.2 651.091 1528.11C651.673 1528.02 652.096 1527.89 652.359 1527.71C652.621 1527.53 652.753 1527.27 652.753 1526.92V1526.86C652.753 1526.18 652.54 1525.66 652.114 1525.29C651.695 1524.92 651.098 1524.74 650.324 1524.74C649.507 1524.74 648.857 1524.92 648.374 1525.28C647.891 1525.63 647.572 1526.08 647.415 1526.62L643.218 1526.28C643.431 1525.29 643.85 1524.43 644.475 1523.7C645.1 1522.97 645.906 1522.41 646.893 1522.02C647.888 1521.62 649.038 1521.42 650.345 1521.42C651.254 1521.42 652.124 1521.53 652.955 1521.74C653.793 1521.96 654.535 1522.29 655.182 1522.73C655.835 1523.18 656.35 1523.76 656.726 1524.46C657.103 1525.16 657.291 1525.99 657.291 1526.96V1538H652.987V1535.73H652.859C652.597 1536.24 652.245 1536.69 651.805 1537.08C651.364 1537.47 650.835 1537.77 650.217 1537.99C649.599 1538.2 648.886 1538.31 648.076 1538.31ZM649.376 1535.18C650.043 1535.18 650.633 1535.05 651.144 1534.78C651.655 1534.51 652.057 1534.15 652.348 1533.7C652.639 1533.24 652.785 1532.73 652.785 1532.15V1530.41C652.643 1530.51 652.447 1530.59 652.199 1530.67C651.957 1530.74 651.684 1530.81 651.378 1530.87C651.073 1530.93 650.768 1530.98 650.462 1531.03C650.157 1531.08 649.88 1531.11 649.631 1531.15C649.099 1531.23 648.633 1531.35 648.236 1531.52C647.838 1531.69 647.529 1531.92 647.309 1532.22C647.089 1532.5 646.979 1532.85 646.979 1533.28C646.979 1533.9 647.202 1534.37 647.65 1534.7C648.104 1535.02 648.68 1535.18 649.376 1535.18ZM660.812 1538V1521.64H665.137V1524.52H665.329C665.67 1523.56 666.238 1522.81 667.034 1522.25C667.829 1521.7 668.781 1521.42 669.889 1521.42C671.011 1521.42 671.966 1521.7 672.755 1522.26C673.543 1522.82 674.068 1523.57 674.331 1524.52H674.502C674.835 1523.59 675.439 1522.84 676.313 1522.28C677.193 1521.71 678.234 1521.42 679.434 1521.42C680.961 1521.42 682.201 1521.91 683.152 1522.88C684.111 1523.85 684.59 1525.22 684.59 1527V1538H680.063V1527.89C680.063 1526.98 679.821 1526.3 679.338 1525.84C678.855 1525.39 678.252 1525.16 677.527 1525.16C676.703 1525.16 676.061 1525.43 675.599 1525.95C675.137 1526.47 674.907 1527.15 674.907 1528.01V1538H670.507V1527.79C670.507 1526.99 670.276 1526.35 669.814 1525.88C669.36 1525.4 668.759 1525.16 668.014 1525.16C667.509 1525.16 667.055 1525.29 666.65 1525.55C666.252 1525.79 665.936 1526.15 665.702 1526.6C665.468 1527.05 665.35 1527.57 665.35 1528.18V1538H660.812ZM695.633 1538.32C693.949 1538.32 692.501 1537.98 691.286 1537.3C690.079 1536.61 689.148 1535.63 688.495 1534.38C687.842 1533.11 687.515 1531.62 687.515 1529.89C687.515 1528.21 687.842 1526.73 688.495 1525.46C689.148 1524.19 690.068 1523.2 691.254 1522.49C692.447 1521.78 693.847 1521.42 695.452 1521.42C696.531 1521.42 697.536 1521.6 698.467 1521.95C699.404 1522.29 700.221 1522.8 700.917 1523.49C701.62 1524.18 702.167 1525.05 702.557 1526.09C702.948 1527.13 703.143 1528.34 703.143 1529.73V1530.98H689.326V1528.17H698.871C698.871 1527.51 698.729 1526.93 698.445 1526.43C698.161 1525.93 697.767 1525.53 697.263 1525.25C696.766 1524.96 696.187 1524.81 695.526 1524.81C694.837 1524.81 694.226 1524.97 693.694 1525.29C693.168 1525.6 692.756 1526.03 692.458 1526.56C692.16 1527.08 692.007 1527.67 692 1528.32V1530.99C692 1531.8 692.149 1532.5 692.447 1533.09C692.753 1533.68 693.182 1534.13 693.736 1534.45C694.29 1534.77 694.947 1534.93 695.707 1534.93C696.212 1534.93 696.673 1534.86 697.092 1534.72C697.511 1534.58 697.87 1534.36 698.168 1534.08C698.467 1533.8 698.694 1533.45 698.85 1533.04L703.047 1533.31C702.834 1534.32 702.398 1535.2 701.737 1535.95C701.084 1536.7 700.239 1537.28 699.202 1537.7C698.172 1538.11 696.982 1538.32 695.633 1538.32ZM719.72 1526.3L715.565 1526.56C715.494 1526.2 715.342 1525.88 715.107 1525.6C714.873 1525.31 714.564 1525.08 714.18 1524.91C713.804 1524.73 713.353 1524.64 712.827 1524.64C712.124 1524.64 711.531 1524.79 711.048 1525.09C710.565 1525.38 710.324 1525.77 710.324 1526.26C710.324 1526.65 710.48 1526.98 710.793 1527.25C711.105 1527.52 711.641 1527.74 712.401 1527.9L715.363 1528.5C716.954 1528.82 718.14 1529.35 718.921 1530.07C719.702 1530.8 720.093 1531.75 720.093 1532.93C720.093 1534 719.777 1534.94 719.145 1535.75C718.52 1536.56 717.66 1537.19 716.567 1537.65C715.48 1538.1 714.226 1538.32 712.806 1538.32C710.64 1538.32 708.914 1537.87 707.628 1536.97C706.35 1536.06 705.601 1534.82 705.381 1533.26L709.844 1533.02C709.979 1533.69 710.306 1534.19 710.824 1534.54C711.343 1534.88 712.007 1535.05 712.817 1535.05C713.612 1535.05 714.251 1534.9 714.734 1534.59C715.224 1534.28 715.473 1533.88 715.48 1533.39C715.473 1532.98 715.299 1532.64 714.958 1532.38C714.617 1532.11 714.092 1531.9 713.381 1531.76L710.547 1531.19C708.949 1530.87 707.76 1530.32 706.979 1529.53C706.204 1528.74 705.817 1527.74 705.817 1526.52C705.817 1525.46 706.101 1524.56 706.67 1523.8C707.245 1523.04 708.051 1522.45 709.088 1522.04C710.132 1521.63 711.354 1521.42 712.753 1521.42C714.82 1521.42 716.446 1521.86 717.632 1522.73C718.825 1523.61 719.521 1524.8 719.72 1526.3ZM722.951 1544.14V1521.64H727.425V1524.38H727.628C727.826 1523.94 728.114 1523.5 728.491 1523.04C728.874 1522.58 729.371 1522.2 729.982 1521.89C730.6 1521.58 731.367 1521.42 732.283 1521.42C733.476 1521.42 734.577 1521.74 735.586 1522.36C736.594 1522.98 737.4 1523.91 738.004 1525.16C738.608 1526.41 738.91 1527.96 738.91 1529.84C738.91 1531.66 738.615 1533.21 738.025 1534.46C737.443 1535.71 736.647 1536.66 735.639 1537.31C734.638 1537.95 733.515 1538.27 732.272 1538.27C731.392 1538.27 730.642 1538.12 730.025 1537.83C729.414 1537.54 728.913 1537.17 728.522 1536.73C728.132 1536.28 727.834 1535.83 727.628 1535.38H727.489V1544.14H722.951ZM727.393 1529.82C727.393 1530.79 727.528 1531.64 727.798 1532.36C728.068 1533.09 728.459 1533.65 728.97 1534.06C729.481 1534.46 730.103 1534.65 730.834 1534.65C731.573 1534.65 732.198 1534.45 732.709 1534.05C733.221 1533.64 733.608 1533.07 733.87 1532.34C734.14 1531.61 734.275 1530.77 734.275 1529.82C734.275 1528.87 734.144 1528.04 733.881 1527.33C733.618 1526.61 733.231 1526.05 732.72 1525.64C732.209 1525.24 731.58 1525.03 730.834 1525.03C730.096 1525.03 729.471 1525.23 728.959 1525.62C728.455 1526.01 728.068 1526.57 727.798 1527.28C727.528 1528 727.393 1528.85 727.393 1529.82ZM746.601 1538.31C745.557 1538.31 744.627 1538.13 743.81 1537.77C742.993 1537.4 742.347 1536.85 741.871 1536.14C741.402 1535.41 741.168 1534.51 741.168 1533.43C741.168 1532.52 741.335 1531.76 741.669 1531.14C742.003 1530.52 742.457 1530.02 743.032 1529.65C743.608 1529.27 744.261 1528.99 744.993 1528.8C745.731 1528.6 746.505 1528.47 747.315 1528.39C748.267 1528.29 749.034 1528.2 749.616 1528.11C750.199 1528.02 750.621 1527.89 750.884 1527.71C751.147 1527.53 751.278 1527.27 751.278 1526.92V1526.86C751.278 1526.18 751.065 1525.66 750.639 1525.29C750.22 1524.92 749.623 1524.74 748.849 1524.74C748.032 1524.74 747.383 1524.92 746.9 1525.28C746.417 1525.63 746.097 1526.08 745.941 1526.62L741.743 1526.28C741.956 1525.29 742.375 1524.43 743 1523.7C743.625 1522.97 744.432 1522.41 745.419 1522.02C746.413 1521.62 747.564 1521.42 748.87 1521.42C749.78 1521.42 750.65 1521.53 751.481 1521.74C752.319 1521.96 753.061 1522.29 753.707 1522.73C754.361 1523.18 754.875 1523.76 755.252 1524.46C755.628 1525.16 755.816 1525.99 755.816 1526.96V1538H751.513V1535.73H751.385C751.122 1536.24 750.77 1536.69 750.33 1537.08C749.89 1537.47 749.361 1537.77 748.743 1537.99C748.125 1538.2 747.411 1538.31 746.601 1538.31ZM747.901 1535.18C748.569 1535.18 749.158 1535.05 749.669 1534.78C750.181 1534.51 750.582 1534.15 750.873 1533.7C751.165 1533.24 751.31 1532.73 751.31 1532.15V1530.41C751.168 1530.51 750.973 1530.59 750.724 1530.67C750.483 1530.74 750.209 1530.81 749.904 1530.87C749.598 1530.93 749.293 1530.98 748.988 1531.03C748.682 1531.08 748.405 1531.11 748.157 1531.15C747.624 1531.23 747.159 1531.35 746.761 1531.52C746.363 1531.69 746.054 1531.92 745.834 1532.22C745.614 1532.5 745.504 1532.85 745.504 1533.28C745.504 1533.9 745.728 1534.37 746.175 1534.7C746.63 1535.02 747.205 1535.18 747.901 1535.18ZM766.731 1538.32C765.055 1538.32 763.613 1537.96 762.406 1537.25C761.205 1536.54 760.282 1535.54 759.636 1534.27C758.997 1533 758.677 1531.54 758.677 1529.88C758.677 1528.21 759 1526.74 759.646 1525.47C760.3 1524.2 761.227 1523.21 762.427 1522.5C763.627 1521.78 765.055 1521.42 766.71 1521.42C768.137 1521.42 769.387 1521.68 770.46 1522.2C771.532 1522.72 772.381 1523.45 773.006 1524.38C773.631 1525.32 773.975 1526.42 774.039 1527.69H769.756C769.636 1526.87 769.316 1526.21 768.798 1525.72C768.286 1525.21 767.615 1524.96 766.784 1524.96C766.081 1524.96 765.467 1525.15 764.941 1525.54C764.423 1525.91 764.018 1526.46 763.727 1527.19C763.435 1527.91 763.29 1528.79 763.29 1529.82C763.29 1530.86 763.432 1531.75 763.716 1532.48C764.007 1533.21 764.416 1533.77 764.941 1534.15C765.467 1534.54 766.081 1534.73 766.784 1534.73C767.303 1534.73 767.768 1534.62 768.18 1534.41C768.599 1534.2 768.943 1533.89 769.213 1533.48C769.49 1533.07 769.671 1532.58 769.756 1532H774.039C773.968 1533.25 773.627 1534.35 773.016 1535.3C772.413 1536.25 771.578 1536.99 770.513 1537.52C769.448 1538.05 768.187 1538.32 766.731 1538.32ZM784.402 1538.32C782.719 1538.32 781.27 1537.98 780.056 1537.3C778.848 1536.61 777.918 1535.63 777.264 1534.38C776.611 1533.11 776.284 1531.62 776.284 1529.89C776.284 1528.21 776.611 1526.73 777.264 1525.46C777.918 1524.19 778.838 1523.2 780.024 1522.49C781.217 1521.78 782.616 1521.42 784.221 1521.42C785.301 1521.42 786.306 1521.6 787.236 1521.95C788.174 1522.29 788.99 1522.8 789.686 1523.49C790.389 1524.18 790.936 1525.05 791.327 1526.09C791.718 1527.13 791.913 1528.34 791.913 1529.73V1530.98H778.095V1528.17H787.641C787.641 1527.51 787.499 1526.93 787.215 1526.43C786.931 1525.93 786.536 1525.53 786.032 1525.25C785.535 1524.96 784.956 1524.81 784.296 1524.81C783.607 1524.81 782.996 1524.97 782.463 1525.29C781.938 1525.6 781.526 1526.03 781.228 1526.56C780.929 1527.08 780.777 1527.67 780.769 1528.32V1530.99C780.769 1531.8 780.919 1532.5 781.217 1533.09C781.522 1533.68 781.952 1534.13 782.506 1534.45C783.06 1534.77 783.717 1534.93 784.477 1534.93C784.981 1534.93 785.443 1534.86 785.862 1534.72C786.281 1534.58 786.639 1534.36 786.938 1534.08C787.236 1533.8 787.463 1533.45 787.62 1533.04L791.817 1533.31C791.604 1534.32 791.167 1535.2 790.507 1535.95C789.853 1536.7 789.008 1537.28 787.971 1537.7C786.941 1538.11 785.752 1538.32 784.402 1538.32Z" fill="#03031C"/>
+<path d="M773.207 641.793C772.817 641.402 772.183 641.402 771.793 641.793L765.429 648.157C765.038 648.547 765.038 649.181 765.429 649.571C765.819 649.962 766.453 649.962 766.843 649.571L772.5 643.914L778.157 649.571C778.547 649.962 779.181 649.962 779.571 649.571C779.962 649.181 779.962 648.547 779.571 648.157L773.207 641.793ZM772.5 711.5H771.5V712.5H772.5V711.5ZM842.5 711.5H843.5V710.5H842.5V711.5ZM771.5 642.5V648.25H773.5V642.5H771.5ZM771.5 659.75V671.25H773.5V659.75H771.5ZM771.5 682.75V694.25H773.5V682.75H771.5ZM771.5 705.75V711.5H773.5V705.75H771.5ZM772.5 712.5H776.875V710.5H772.5V712.5ZM785.625 712.5H794.375V710.5H785.625V712.5ZM803.125 712.5H811.875V710.5H803.125V712.5ZM820.625 712.5H829.375V710.5H820.625V712.5ZM838.125 712.5H842.5V710.5H838.125V712.5ZM841.5 711.5V716.365H843.5V711.5H841.5ZM841.5 726.096V735.827H843.5V726.096H841.5ZM841.5 745.558V755.288H843.5V745.558H841.5ZM841.5 765.019V774.75H843.5V765.019H841.5ZM841.5 784.481V794.212H843.5V784.481H841.5ZM841.5 803.942V813.673H843.5V803.942H841.5ZM841.5 823.404V833.135H843.5V823.404H841.5ZM841.5 842.865V852.596H843.5V842.865H841.5ZM841.5 862.327V872.058H843.5V862.327H841.5ZM841.5 881.788V891.519H843.5V881.788H841.5ZM841.5 901.25V910.981H843.5V901.25H841.5ZM841.5 920.712V930.442H843.5V920.712H841.5ZM841.5 940.173V949.904H843.5V940.173H841.5ZM841.5 959.635V964.5H843.5V959.635H841.5Z" fill="#03031C"/>
+<path d="M1002.29 641.793C1002.68 641.402 1003.32 641.402 1003.71 641.793L1010.07 648.157C1010.46 648.547 1010.46 649.181 1010.07 649.571C1009.68 649.962 1009.05 649.962 1008.66 649.571L1003 643.914L997.343 649.571C996.953 649.962 996.319 649.962 995.929 649.571C995.538 649.181 995.538 648.547 995.929 648.157L1002.29 641.793ZM1003 711.5H1004V712.5H1003V711.5ZM933 711.5H932V710.5H933V711.5ZM1004 642.5V648.25H1002V642.5H1004ZM1004 659.75V671.25H1002V659.75H1004ZM1004 682.75V694.25H1002V682.75H1004ZM1004 705.75V711.5H1002V705.75H1004ZM1003 712.5H998.625V710.5H1003V712.5ZM989.875 712.5H981.125V710.5H989.875V712.5ZM972.375 712.5H963.625V710.5H972.375V712.5ZM954.875 712.5H946.125V710.5H954.875V712.5ZM937.375 712.5H933V710.5H937.375V712.5ZM934 711.5V716.365H932V711.5H934ZM934 726.096V735.827H932V726.096H934ZM934 745.558V755.288H932V745.558H934ZM934 765.019V774.75H932V765.019H934ZM934 784.481V794.212H932V784.481H934ZM934 803.942V813.673H932V803.942H934ZM934 823.404V833.135H932V823.404H934ZM934 842.865V852.596H932V842.865H934ZM934 862.327V872.058H932V862.327H934ZM934 881.788V891.519H932V881.788H934ZM934 901.25V910.981H932V901.25H934ZM934 920.712V930.442H932V920.712H934ZM934 940.173V949.904H932V940.173H934ZM934 959.635V964.5H932V959.635H934Z" fill="#03031C"/>
+<g filter="url(#filter13_bd_12_618)">
+<rect x="593" y="1390" width="109" height="89" rx="10" fill="#5900CB"/>
+<rect x="593.5" y="1390.5" width="108" height="88" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M632.288 1427.32C631.424 1427.32 630.64 1427.16 629.935 1426.83C629.231 1426.5 628.672 1426.02 628.257 1425.4C627.843 1424.77 627.636 1424.02 627.636 1423.13C627.636 1422.35 627.79 1421.71 628.097 1421.23C628.405 1420.74 628.817 1420.35 629.331 1420.08C629.846 1419.8 630.415 1419.59 631.036 1419.45C631.663 1419.31 632.294 1419.2 632.927 1419.12C633.756 1419.01 634.427 1418.93 634.942 1418.88C635.463 1418.82 635.842 1418.72 636.079 1418.58C636.321 1418.45 636.443 1418.21 636.443 1417.87V1417.8C636.443 1416.93 636.203 1416.25 635.724 1415.76C635.25 1415.28 634.531 1415.03 633.566 1415.03C632.566 1415.03 631.782 1415.25 631.214 1415.69C630.645 1416.13 630.246 1416.6 630.015 1417.09L628.026 1416.38C628.382 1415.55 628.855 1414.91 629.447 1414.45C630.045 1413.98 630.696 1413.65 631.4 1413.47C632.11 1413.28 632.809 1413.19 633.495 1413.19C633.933 1413.19 634.436 1413.24 635.004 1413.35C635.579 1413.45 636.132 1413.66 636.665 1413.98C637.203 1414.3 637.65 1414.78 638.005 1415.42C638.36 1416.07 638.538 1416.93 638.538 1418.02V1427H636.443V1425.15H636.336C636.194 1425.45 635.957 1425.77 635.626 1426.1C635.294 1426.44 634.854 1426.73 634.303 1426.96C633.753 1427.2 633.081 1427.32 632.288 1427.32ZM632.607 1425.44C633.436 1425.44 634.134 1425.27 634.703 1424.95C635.277 1424.62 635.709 1424.2 635.999 1423.69C636.295 1423.17 636.443 1422.63 636.443 1422.06V1420.15C636.354 1420.25 636.159 1420.35 635.857 1420.44C635.561 1420.52 635.218 1420.6 634.827 1420.66C634.442 1420.72 634.066 1420.77 633.699 1420.82C633.338 1420.86 633.045 1420.9 632.82 1420.93C632.276 1421 631.767 1421.11 631.294 1421.27C630.826 1421.43 630.447 1421.66 630.157 1421.98C629.873 1422.28 629.731 1422.7 629.731 1423.24C629.731 1423.96 630 1424.51 630.539 1424.89C631.083 1425.25 631.773 1425.44 632.607 1425.44ZM642.362 1432.11V1413.36H644.386V1415.53H644.635C644.789 1415.29 645.002 1414.99 645.274 1414.62C645.552 1414.25 645.949 1413.92 646.464 1413.63C646.984 1413.33 647.689 1413.19 648.576 1413.19C649.725 1413.19 650.737 1413.47 651.613 1414.05C652.489 1414.62 653.172 1415.44 653.663 1416.49C654.155 1417.54 654.4 1418.79 654.4 1420.22C654.4 1421.66 654.155 1422.91 653.663 1423.97C653.172 1425.03 652.492 1425.84 651.622 1426.42C650.752 1427 649.748 1427.28 648.612 1427.28C647.736 1427.28 647.035 1427.14 646.508 1426.85C645.981 1426.55 645.576 1426.22 645.292 1425.85C645.008 1425.47 644.789 1425.15 644.635 1424.9H644.457V1432.11H642.362ZM644.422 1420.18C644.422 1421.21 644.573 1422.12 644.874 1422.91C645.176 1423.69 645.617 1424.3 646.197 1424.75C646.777 1425.18 647.487 1425.4 648.328 1425.4C649.204 1425.4 649.935 1425.17 650.521 1424.71C651.113 1424.24 651.556 1423.61 651.852 1422.83C652.154 1422.03 652.305 1421.15 652.305 1420.18C652.305 1419.22 652.157 1418.36 651.861 1417.59C651.571 1416.81 651.13 1416.2 650.538 1415.75C649.953 1415.3 649.216 1415.07 648.328 1415.07C647.476 1415.07 646.759 1415.28 646.179 1415.72C645.599 1416.14 645.161 1416.74 644.866 1417.51C644.57 1418.27 644.422 1419.16 644.422 1420.18ZM657.596 1427V1413.36H659.691V1427H657.596ZM658.662 1411.09C658.253 1411.09 657.901 1410.95 657.605 1410.67C657.315 1410.4 657.17 1410.06 657.17 1409.67C657.17 1409.28 657.315 1408.95 657.605 1408.67C657.901 1408.39 658.253 1408.25 658.662 1408.25C659.07 1408.25 659.419 1408.39 659.709 1408.67C660.005 1408.95 660.153 1409.28 660.153 1409.67C660.153 1410.06 660.005 1410.4 659.709 1410.67C659.419 1410.95 659.07 1411.09 658.662 1411.09ZM638.258 1449.5H636.056C635.926 1448.87 635.698 1448.31 635.373 1447.83C635.053 1447.35 634.663 1446.95 634.201 1446.62C633.745 1446.29 633.239 1446.04 632.683 1445.88C632.127 1445.71 631.547 1445.63 630.943 1445.63C629.842 1445.63 628.845 1445.91 627.951 1446.46C627.063 1447.02 626.356 1447.84 625.829 1448.92C625.308 1450.01 625.048 1451.33 625.048 1452.91C625.048 1454.48 625.308 1455.81 625.829 1456.9C626.356 1457.98 627.063 1458.8 627.951 1459.35C628.845 1459.91 629.842 1460.19 630.943 1460.19C631.547 1460.19 632.127 1460.11 632.683 1459.94C633.239 1459.77 633.745 1459.53 634.201 1459.2C634.663 1458.87 635.053 1458.47 635.373 1457.99C635.698 1457.5 635.926 1456.95 636.056 1456.32H638.258C638.092 1457.25 637.791 1458.08 637.353 1458.81C636.915 1459.55 636.37 1460.17 635.719 1460.69C635.068 1461.2 634.337 1461.58 633.526 1461.85C632.721 1462.12 631.86 1462.25 630.943 1462.25C629.392 1462.25 628.013 1461.87 626.806 1461.11C625.598 1460.35 624.648 1459.28 623.956 1457.88C623.263 1456.48 622.917 1454.83 622.917 1452.91C622.917 1450.99 623.263 1449.33 623.956 1447.94C624.648 1446.54 625.598 1445.46 626.806 1444.71C628.013 1443.95 629.392 1443.57 630.943 1443.57C631.86 1443.57 632.721 1443.7 633.526 1443.97C634.337 1444.24 635.068 1444.63 635.719 1445.14C636.37 1445.65 636.915 1446.27 637.353 1447.01C637.791 1447.73 638.092 1448.56 638.258 1449.5ZM641.816 1462V1443.82H647.959C649.38 1443.82 650.546 1444.06 651.457 1444.55C652.369 1445.03 653.043 1445.69 653.481 1446.53C653.919 1447.37 654.138 1448.32 654.138 1449.39C654.138 1450.46 653.919 1451.41 653.481 1452.24C653.043 1453.07 652.372 1453.72 651.466 1454.2C650.561 1454.66 649.404 1454.9 647.995 1454.9H643.023V1452.91H647.924C648.895 1452.91 649.676 1452.77 650.268 1452.48C650.865 1452.2 651.297 1451.8 651.564 1451.28C651.836 1450.75 651.972 1450.12 651.972 1449.39C651.972 1448.67 651.836 1448.03 651.564 1447.48C651.292 1446.94 650.857 1446.52 650.259 1446.22C649.661 1445.92 648.871 1445.77 647.888 1445.77H644.018V1462H641.816ZM650.374 1453.83L654.849 1462H652.292L647.888 1453.83H650.374ZM663.418 1462H657.807V1443.82H663.667C665.43 1443.82 666.94 1444.18 668.194 1444.91C669.449 1445.63 670.411 1446.67 671.08 1448.03C671.748 1449.38 672.083 1450.99 672.083 1452.87C672.083 1454.77 671.745 1456.4 671.071 1457.77C670.396 1459.13 669.413 1460.17 668.123 1460.91C666.833 1461.64 665.265 1462 663.418 1462ZM660.009 1460.05H663.276C664.779 1460.05 666.025 1459.76 667.013 1459.18C668.002 1458.6 668.739 1457.77 669.224 1456.7C669.709 1455.63 669.952 1454.35 669.952 1452.87C669.952 1451.41 669.712 1450.14 669.233 1449.08C668.754 1448.02 668.037 1447.2 667.085 1446.63C666.132 1446.06 664.945 1445.77 663.525 1445.77H660.009V1460.05Z" fill="white"/>
+<g filter="url(#filter14_bd_12_618)">
+<rect x="714" y="1390" width="109" height="89" rx="10" fill="#5900CB"/>
+<rect x="714.5" y="1390.5" width="108" height="88" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M753.288 1427.32C752.424 1427.32 751.64 1427.16 750.935 1426.83C750.231 1426.5 749.672 1426.02 749.257 1425.4C748.843 1424.77 748.636 1424.02 748.636 1423.13C748.636 1422.35 748.79 1421.71 749.097 1421.23C749.405 1420.74 749.817 1420.35 750.331 1420.08C750.846 1419.8 751.415 1419.59 752.036 1419.45C752.663 1419.31 753.294 1419.2 753.927 1419.12C754.756 1419.01 755.427 1418.93 755.942 1418.88C756.463 1418.82 756.842 1418.72 757.079 1418.58C757.321 1418.45 757.443 1418.21 757.443 1417.87V1417.8C757.443 1416.93 757.203 1416.25 756.724 1415.76C756.25 1415.28 755.531 1415.03 754.566 1415.03C753.566 1415.03 752.782 1415.25 752.214 1415.69C751.645 1416.13 751.246 1416.6 751.015 1417.09L749.026 1416.38C749.382 1415.55 749.855 1414.91 750.447 1414.45C751.045 1413.98 751.696 1413.65 752.4 1413.47C753.11 1413.28 753.809 1413.19 754.495 1413.19C754.933 1413.19 755.436 1413.24 756.004 1413.35C756.579 1413.45 757.132 1413.66 757.665 1413.98C758.203 1414.3 758.65 1414.78 759.005 1415.42C759.36 1416.07 759.538 1416.93 759.538 1418.02V1427H757.443V1425.15H757.336C757.194 1425.45 756.957 1425.77 756.626 1426.1C756.294 1426.44 755.854 1426.73 755.303 1426.96C754.753 1427.2 754.081 1427.32 753.288 1427.32ZM753.607 1425.44C754.436 1425.44 755.134 1425.27 755.703 1424.95C756.277 1424.62 756.709 1424.2 756.999 1423.69C757.295 1423.17 757.443 1422.63 757.443 1422.06V1420.15C757.354 1420.25 757.159 1420.35 756.857 1420.44C756.561 1420.52 756.218 1420.6 755.827 1420.66C755.442 1420.72 755.066 1420.77 754.699 1420.82C754.338 1420.86 754.045 1420.9 753.82 1420.93C753.276 1421 752.767 1421.11 752.294 1421.27C751.826 1421.43 751.447 1421.66 751.157 1421.98C750.873 1422.28 750.731 1422.7 750.731 1423.24C750.731 1423.96 751 1424.51 751.539 1424.89C752.083 1425.25 752.773 1425.44 753.607 1425.44ZM763.362 1432.11V1413.36H765.386V1415.53H765.635C765.789 1415.29 766.002 1414.99 766.274 1414.62C766.552 1414.25 766.949 1413.92 767.464 1413.63C767.984 1413.33 768.689 1413.19 769.576 1413.19C770.725 1413.19 771.737 1413.47 772.613 1414.05C773.489 1414.62 774.172 1415.44 774.663 1416.49C775.155 1417.54 775.4 1418.79 775.4 1420.22C775.4 1421.66 775.155 1422.91 774.663 1423.97C774.172 1425.03 773.492 1425.84 772.622 1426.42C771.752 1427 770.748 1427.28 769.612 1427.28C768.736 1427.28 768.035 1427.14 767.508 1426.85C766.981 1426.55 766.576 1426.22 766.292 1425.85C766.008 1425.47 765.789 1425.15 765.635 1424.9H765.457V1432.11H763.362ZM765.422 1420.18C765.422 1421.21 765.573 1422.12 765.874 1422.91C766.176 1423.69 766.617 1424.3 767.197 1424.75C767.777 1425.18 768.487 1425.4 769.328 1425.4C770.204 1425.4 770.935 1425.17 771.521 1424.71C772.113 1424.24 772.556 1423.61 772.852 1422.83C773.154 1422.03 773.305 1421.15 773.305 1420.18C773.305 1419.22 773.157 1418.36 772.861 1417.59C772.571 1416.81 772.13 1416.2 771.538 1415.75C770.953 1415.3 770.216 1415.07 769.328 1415.07C768.476 1415.07 767.759 1415.28 767.179 1415.72C766.599 1416.14 766.161 1416.74 765.866 1417.51C765.57 1418.27 765.422 1419.16 765.422 1420.18ZM778.596 1427V1413.36H780.691V1427H778.596ZM779.662 1411.09C779.253 1411.09 778.901 1410.95 778.605 1410.67C778.315 1410.4 778.17 1410.06 778.17 1409.67C778.17 1409.28 778.315 1408.95 778.605 1408.67C778.901 1408.39 779.253 1408.25 779.662 1408.25C780.07 1408.25 780.419 1408.39 780.709 1408.67C781.005 1408.95 781.153 1409.28 781.153 1409.67C781.153 1410.06 781.005 1410.4 780.709 1410.67C780.419 1410.95 780.07 1411.09 779.662 1411.09ZM759.258 1449.5H757.056C756.926 1448.87 756.698 1448.31 756.373 1447.83C756.053 1447.35 755.663 1446.95 755.201 1446.62C754.745 1446.29 754.239 1446.04 753.683 1445.88C753.127 1445.71 752.547 1445.63 751.943 1445.63C750.842 1445.63 749.845 1445.91 748.951 1446.46C748.063 1447.02 747.356 1447.84 746.829 1448.92C746.308 1450.01 746.048 1451.33 746.048 1452.91C746.048 1454.48 746.308 1455.81 746.829 1456.9C747.356 1457.98 748.063 1458.8 748.951 1459.35C749.845 1459.91 750.842 1460.19 751.943 1460.19C752.547 1460.19 753.127 1460.11 753.683 1459.94C754.239 1459.77 754.745 1459.53 755.201 1459.2C755.663 1458.87 756.053 1458.47 756.373 1457.99C756.698 1457.5 756.926 1456.95 757.056 1456.32H759.258C759.092 1457.25 758.791 1458.08 758.353 1458.81C757.915 1459.55 757.37 1460.17 756.719 1460.69C756.068 1461.2 755.337 1461.58 754.526 1461.85C753.721 1462.12 752.86 1462.25 751.943 1462.25C750.392 1462.25 749.013 1461.87 747.806 1461.11C746.598 1460.35 745.648 1459.28 744.956 1457.88C744.263 1456.48 743.917 1454.83 743.917 1452.91C743.917 1450.99 744.263 1449.33 744.956 1447.94C745.648 1446.54 746.598 1445.46 747.806 1444.71C749.013 1443.95 750.392 1443.57 751.943 1443.57C752.86 1443.57 753.721 1443.7 754.526 1443.97C755.337 1444.24 756.068 1444.63 756.719 1445.14C757.37 1445.65 757.915 1446.27 758.353 1447.01C758.791 1447.73 759.092 1448.56 759.258 1449.5ZM762.816 1462V1443.82H768.959C770.38 1443.82 771.546 1444.06 772.457 1444.55C773.369 1445.03 774.043 1445.69 774.481 1446.53C774.919 1447.37 775.138 1448.32 775.138 1449.39C775.138 1450.46 774.919 1451.41 774.481 1452.24C774.043 1453.07 773.372 1453.72 772.466 1454.2C771.561 1454.66 770.404 1454.9 768.995 1454.9H764.023V1452.91H768.924C769.895 1452.91 770.676 1452.77 771.268 1452.48C771.865 1452.2 772.297 1451.8 772.564 1451.28C772.836 1450.75 772.972 1450.12 772.972 1449.39C772.972 1448.67 772.836 1448.03 772.564 1447.48C772.292 1446.94 771.857 1446.52 771.259 1446.22C770.661 1445.92 769.871 1445.77 768.888 1445.77H765.018V1462H762.816ZM771.374 1453.83L775.849 1462H773.292L768.888 1453.83H771.374ZM784.418 1462H778.807V1443.82H784.667C786.43 1443.82 787.94 1444.18 789.194 1444.91C790.449 1445.63 791.411 1446.67 792.08 1448.03C792.748 1449.38 793.083 1450.99 793.083 1452.87C793.083 1454.77 792.745 1456.4 792.071 1457.77C791.396 1459.13 790.413 1460.17 789.123 1460.91C787.833 1461.64 786.265 1462 784.418 1462ZM781.009 1460.05H784.276C785.779 1460.05 787.025 1459.76 788.013 1459.18C789.002 1458.6 789.739 1457.77 790.224 1456.7C790.709 1455.63 790.952 1454.35 790.952 1452.87C790.952 1451.41 790.712 1450.14 790.233 1449.08C789.754 1448.02 789.037 1447.2 788.085 1446.63C787.132 1446.06 785.945 1445.77 784.525 1445.77H781.009V1460.05Z" fill="white"/>
+<g filter="url(#filter15_bd_12_618)">
+<rect x="925" y="1361.5" width="286" height="221" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="925.5" y="1362" width="285" height="220" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M989.286 1529.04V1538.5H984.748V1522.14H989.073V1525.02H989.265C989.627 1524.07 990.234 1523.32 991.086 1522.76C991.939 1522.2 992.972 1521.92 994.187 1521.92C995.323 1521.92 996.314 1522.17 997.159 1522.67C998.004 1523.17 998.661 1523.88 999.13 1524.8C999.598 1525.72 999.833 1526.81 999.833 1528.08V1538.5H995.294V1528.89C995.302 1527.89 995.046 1527.11 994.527 1526.55C994.009 1525.98 993.295 1525.69 992.386 1525.69C991.775 1525.69 991.236 1525.83 990.767 1526.09C990.305 1526.35 989.943 1526.74 989.68 1527.24C989.424 1527.74 989.293 1528.34 989.286 1529.04ZM1008.08 1538.81C1007.03 1538.81 1006.1 1538.63 1005.28 1538.27C1004.47 1537.9 1003.82 1537.35 1003.35 1536.64C1002.88 1535.91 1002.64 1535.01 1002.64 1533.93C1002.64 1533.02 1002.81 1532.26 1003.14 1531.64C1003.48 1531.02 1003.93 1530.52 1004.51 1530.15C1005.08 1529.77 1005.74 1529.49 1006.47 1529.3C1007.21 1529.1 1007.98 1528.97 1008.79 1528.89C1009.74 1528.79 1010.51 1528.7 1011.09 1528.61C1011.67 1528.52 1012.1 1528.39 1012.36 1528.21C1012.62 1528.03 1012.75 1527.77 1012.75 1527.42V1527.36C1012.75 1526.68 1012.54 1526.16 1012.11 1525.79C1011.69 1525.42 1011.1 1525.24 1010.32 1525.24C1009.51 1525.24 1008.86 1525.42 1008.37 1525.78C1007.89 1526.13 1007.57 1526.58 1007.42 1527.12L1003.22 1526.78C1003.43 1525.79 1003.85 1524.93 1004.48 1524.2C1005.1 1523.47 1005.91 1522.91 1006.89 1522.52C1007.89 1522.12 1009.04 1521.92 1010.35 1521.92C1011.25 1521.92 1012.12 1522.03 1012.96 1522.24C1013.79 1522.46 1014.54 1522.79 1015.18 1523.23C1015.84 1523.68 1016.35 1524.26 1016.73 1524.96C1017.1 1525.66 1017.29 1526.49 1017.29 1527.46V1538.5H1012.99V1536.23H1012.86C1012.6 1536.74 1012.24 1537.19 1011.8 1537.58C1011.36 1537.97 1010.84 1538.27 1010.22 1538.49C1009.6 1538.7 1008.89 1538.81 1008.08 1538.81ZM1009.38 1535.68C1010.04 1535.68 1010.63 1535.55 1011.14 1535.28C1011.66 1535.01 1012.06 1534.65 1012.35 1534.2C1012.64 1533.74 1012.78 1533.23 1012.78 1532.65V1530.91C1012.64 1531.01 1012.45 1531.09 1012.2 1531.17C1011.96 1531.24 1011.68 1531.31 1011.38 1531.37C1011.07 1531.43 1010.77 1531.48 1010.46 1531.53C1010.16 1531.58 1009.88 1531.61 1009.63 1531.65C1009.1 1531.73 1008.63 1531.85 1008.24 1532.02C1007.84 1532.19 1007.53 1532.42 1007.31 1532.72C1007.09 1533 1006.98 1533.35 1006.98 1533.78C1006.98 1534.4 1007.2 1534.87 1007.65 1535.2C1008.1 1535.52 1008.68 1535.68 1009.38 1535.68ZM1020.81 1538.5V1522.14H1025.14V1525.02H1025.33C1025.67 1524.06 1026.24 1523.31 1027.03 1522.75C1027.83 1522.2 1028.78 1521.92 1029.89 1521.92C1031.01 1521.92 1031.97 1522.2 1032.75 1522.76C1033.54 1523.32 1034.07 1524.07 1034.33 1525.02H1034.5C1034.84 1524.09 1035.44 1523.34 1036.31 1522.78C1037.19 1522.21 1038.23 1521.92 1039.43 1521.92C1040.96 1521.92 1042.2 1522.41 1043.15 1523.38C1044.11 1524.35 1044.59 1525.72 1044.59 1527.5V1538.5H1040.06V1528.39C1040.06 1527.48 1039.82 1526.8 1039.34 1526.34C1038.86 1525.89 1038.25 1525.66 1037.53 1525.66C1036.7 1525.66 1036.06 1525.93 1035.6 1526.45C1035.14 1526.97 1034.91 1527.65 1034.91 1528.51V1538.5H1030.51V1528.29C1030.51 1527.49 1030.28 1526.85 1029.81 1526.38C1029.36 1525.9 1028.76 1525.66 1028.01 1525.66C1027.51 1525.66 1027.05 1525.79 1026.65 1526.05C1026.25 1526.29 1025.94 1526.65 1025.7 1527.1C1025.47 1527.55 1025.35 1528.07 1025.35 1528.68V1538.5H1020.81ZM1055.63 1538.82C1053.95 1538.82 1052.5 1538.48 1051.29 1537.8C1050.08 1537.11 1049.15 1536.13 1048.49 1534.88C1047.84 1533.61 1047.51 1532.12 1047.51 1530.39C1047.51 1528.71 1047.84 1527.23 1048.49 1525.96C1049.15 1524.69 1050.07 1523.7 1051.25 1522.99C1052.45 1522.28 1053.85 1521.92 1055.45 1521.92C1056.53 1521.92 1057.54 1522.1 1058.47 1522.45C1059.4 1522.79 1060.22 1523.3 1060.92 1523.99C1061.62 1524.68 1062.17 1525.55 1062.56 1526.59C1062.95 1527.63 1063.14 1528.84 1063.14 1530.23V1531.48H1049.33V1528.67H1058.87C1058.87 1528.01 1058.73 1527.43 1058.45 1526.93C1058.16 1526.43 1057.77 1526.03 1057.26 1525.75C1056.77 1525.46 1056.19 1525.31 1055.53 1525.31C1054.84 1525.31 1054.23 1525.47 1053.69 1525.79C1053.17 1526.1 1052.76 1526.53 1052.46 1527.06C1052.16 1527.58 1052.01 1528.17 1052 1528.82V1531.49C1052 1532.3 1052.15 1533 1052.45 1533.59C1052.75 1534.18 1053.18 1534.63 1053.74 1534.95C1054.29 1535.27 1054.95 1535.43 1055.71 1535.43C1056.21 1535.43 1056.67 1535.36 1057.09 1535.22C1057.51 1535.08 1057.87 1534.86 1058.17 1534.58C1058.47 1534.3 1058.69 1533.95 1058.85 1533.54L1063.05 1533.81C1062.83 1534.82 1062.4 1535.7 1061.74 1536.45C1061.08 1537.2 1060.24 1537.78 1059.2 1538.2C1058.17 1538.61 1056.98 1538.82 1055.63 1538.82ZM1079.72 1526.8L1075.57 1527.06C1075.49 1526.7 1075.34 1526.38 1075.11 1526.1C1074.87 1525.81 1074.56 1525.58 1074.18 1525.41C1073.8 1525.23 1073.35 1525.14 1072.83 1525.14C1072.12 1525.14 1071.53 1525.29 1071.05 1525.59C1070.57 1525.88 1070.32 1526.27 1070.32 1526.76C1070.32 1527.15 1070.48 1527.48 1070.79 1527.75C1071.11 1528.02 1071.64 1528.24 1072.4 1528.4L1075.36 1529C1076.95 1529.32 1078.14 1529.85 1078.92 1530.57C1079.7 1531.3 1080.09 1532.25 1080.09 1533.43C1080.09 1534.5 1079.78 1535.44 1079.14 1536.25C1078.52 1537.06 1077.66 1537.69 1076.57 1538.15C1075.48 1538.6 1074.23 1538.82 1072.81 1538.82C1070.64 1538.82 1068.91 1538.37 1067.63 1537.47C1066.35 1536.56 1065.6 1535.32 1065.38 1533.76L1069.84 1533.52C1069.98 1534.19 1070.31 1534.69 1070.82 1535.04C1071.34 1535.38 1072.01 1535.55 1072.82 1535.55C1073.61 1535.55 1074.25 1535.4 1074.73 1535.09C1075.22 1534.78 1075.47 1534.38 1075.48 1533.89C1075.47 1533.48 1075.3 1533.14 1074.96 1532.88C1074.62 1532.61 1074.09 1532.4 1073.38 1532.26L1070.55 1531.69C1068.95 1531.37 1067.76 1530.82 1066.98 1530.03C1066.2 1529.24 1065.82 1528.24 1065.82 1527.02C1065.82 1525.96 1066.1 1525.06 1066.67 1524.3C1067.24 1523.54 1068.05 1522.95 1069.09 1522.54C1070.13 1522.13 1071.35 1521.92 1072.75 1521.92C1074.82 1521.92 1076.45 1522.36 1077.63 1523.23C1078.83 1524.11 1079.52 1525.3 1079.72 1526.8ZM1082.95 1544.64V1522.14H1087.43V1524.88H1087.63C1087.83 1524.44 1088.11 1524 1088.49 1523.54C1088.87 1523.08 1089.37 1522.7 1089.98 1522.39C1090.6 1522.08 1091.37 1521.92 1092.28 1521.92C1093.48 1521.92 1094.58 1522.24 1095.59 1522.86C1096.59 1523.48 1097.4 1524.41 1098 1525.66C1098.61 1526.91 1098.91 1528.46 1098.91 1530.34C1098.91 1532.16 1098.61 1533.71 1098.03 1534.96C1097.44 1536.21 1096.65 1537.16 1095.64 1537.81C1094.64 1538.45 1093.52 1538.77 1092.27 1538.77C1091.39 1538.77 1090.64 1538.62 1090.02 1538.33C1089.41 1538.04 1088.91 1537.67 1088.52 1537.23C1088.13 1536.78 1087.83 1536.33 1087.63 1535.88H1087.49V1544.64H1082.95ZM1087.39 1530.32C1087.39 1531.29 1087.53 1532.14 1087.8 1532.86C1088.07 1533.59 1088.46 1534.15 1088.97 1534.56C1089.48 1534.96 1090.1 1535.15 1090.83 1535.15C1091.57 1535.15 1092.2 1534.95 1092.71 1534.55C1093.22 1534.14 1093.61 1533.57 1093.87 1532.84C1094.14 1532.11 1094.28 1531.27 1094.28 1530.32C1094.28 1529.37 1094.14 1528.54 1093.88 1527.83C1093.62 1527.11 1093.23 1526.55 1092.72 1526.14C1092.21 1525.74 1091.58 1525.53 1090.83 1525.53C1090.1 1525.53 1089.47 1525.73 1088.96 1526.12C1088.45 1526.51 1088.07 1527.07 1087.8 1527.78C1087.53 1528.5 1087.39 1529.35 1087.39 1530.32ZM1106.6 1538.81C1105.56 1538.81 1104.63 1538.63 1103.81 1538.27C1102.99 1537.9 1102.35 1537.35 1101.87 1536.64C1101.4 1535.91 1101.17 1535.01 1101.17 1533.93C1101.17 1533.02 1101.33 1532.26 1101.67 1531.64C1102 1531.02 1102.46 1530.52 1103.03 1530.15C1103.61 1529.77 1104.26 1529.49 1104.99 1529.3C1105.73 1529.1 1106.51 1528.97 1107.32 1528.89C1108.27 1528.79 1109.03 1528.7 1109.62 1528.61C1110.2 1528.52 1110.62 1528.39 1110.88 1528.21C1111.15 1528.03 1111.28 1527.77 1111.28 1527.42V1527.36C1111.28 1526.68 1111.07 1526.16 1110.64 1525.79C1110.22 1525.42 1109.62 1525.24 1108.85 1525.24C1108.03 1525.24 1107.38 1525.42 1106.9 1525.78C1106.42 1526.13 1106.1 1526.58 1105.94 1527.12L1101.74 1526.78C1101.96 1525.79 1102.38 1524.93 1103 1524.2C1103.63 1523.47 1104.43 1522.91 1105.42 1522.52C1106.41 1522.12 1107.56 1521.92 1108.87 1521.92C1109.78 1521.92 1110.65 1522.03 1111.48 1522.24C1112.32 1522.46 1113.06 1522.79 1113.71 1523.23C1114.36 1523.68 1114.88 1524.26 1115.25 1524.96C1115.63 1525.66 1115.82 1526.49 1115.82 1527.46V1538.5H1111.51V1536.23H1111.38C1111.12 1536.74 1110.77 1537.19 1110.33 1537.58C1109.89 1537.97 1109.36 1538.27 1108.74 1538.49C1108.12 1538.7 1107.41 1538.81 1106.6 1538.81ZM1107.9 1535.68C1108.57 1535.68 1109.16 1535.55 1109.67 1535.28C1110.18 1535.01 1110.58 1534.65 1110.87 1534.2C1111.16 1533.74 1111.31 1533.23 1111.31 1532.65V1530.91C1111.17 1531.01 1110.97 1531.09 1110.72 1531.17C1110.48 1531.24 1110.21 1531.31 1109.9 1531.37C1109.6 1531.43 1109.29 1531.48 1108.99 1531.53C1108.68 1531.58 1108.41 1531.61 1108.16 1531.65C1107.62 1531.73 1107.16 1531.85 1106.76 1532.02C1106.36 1532.19 1106.05 1532.42 1105.83 1532.72C1105.61 1533 1105.5 1533.35 1105.5 1533.78C1105.5 1534.4 1105.73 1534.87 1106.18 1535.2C1106.63 1535.52 1107.2 1535.68 1107.9 1535.68ZM1126.73 1538.82C1125.05 1538.82 1123.61 1538.46 1122.41 1537.75C1121.21 1537.04 1120.28 1536.04 1119.64 1534.77C1119 1533.5 1118.68 1532.04 1118.68 1530.38C1118.68 1528.71 1119 1527.24 1119.65 1525.97C1120.3 1524.7 1121.23 1523.71 1122.43 1523C1123.63 1522.28 1125.05 1521.92 1126.71 1521.92C1128.14 1521.92 1129.39 1522.18 1130.46 1522.7C1131.53 1523.22 1132.38 1523.95 1133.01 1524.88C1133.63 1525.82 1133.98 1526.92 1134.04 1528.19H1129.76C1129.64 1527.37 1129.32 1526.71 1128.8 1526.22C1128.29 1525.71 1127.62 1525.46 1126.78 1525.46C1126.08 1525.46 1125.47 1525.65 1124.94 1526.04C1124.42 1526.41 1124.02 1526.96 1123.73 1527.69C1123.44 1528.41 1123.29 1529.29 1123.29 1530.32C1123.29 1531.36 1123.43 1532.25 1123.72 1532.98C1124.01 1533.71 1124.42 1534.27 1124.94 1534.65C1125.47 1535.04 1126.08 1535.23 1126.78 1535.23C1127.3 1535.23 1127.77 1535.12 1128.18 1534.91C1128.6 1534.7 1128.94 1534.39 1129.21 1533.98C1129.49 1533.57 1129.67 1533.08 1129.76 1532.5H1134.04C1133.97 1533.75 1133.63 1534.85 1133.02 1535.8C1132.41 1536.75 1131.58 1537.49 1130.51 1538.02C1129.45 1538.55 1128.19 1538.82 1126.73 1538.82ZM1144.4 1538.82C1142.72 1538.82 1141.27 1538.48 1140.06 1537.8C1138.85 1537.11 1137.92 1536.13 1137.26 1534.88C1136.61 1533.61 1136.28 1532.12 1136.28 1530.39C1136.28 1528.71 1136.61 1527.23 1137.26 1525.96C1137.92 1524.69 1138.84 1523.7 1140.02 1522.99C1141.22 1522.28 1142.62 1521.92 1144.22 1521.92C1145.3 1521.92 1146.31 1522.1 1147.24 1522.45C1148.17 1522.79 1148.99 1523.3 1149.69 1523.99C1150.39 1524.68 1150.94 1525.55 1151.33 1526.59C1151.72 1527.63 1151.91 1528.84 1151.91 1530.23V1531.48H1138.1V1528.67H1147.64C1147.64 1528.01 1147.5 1527.43 1147.21 1526.93C1146.93 1526.43 1146.54 1526.03 1146.03 1525.75C1145.54 1525.46 1144.96 1525.31 1144.3 1525.31C1143.61 1525.31 1143 1525.47 1142.46 1525.79C1141.94 1526.1 1141.53 1526.53 1141.23 1527.06C1140.93 1527.58 1140.78 1528.17 1140.77 1528.82V1531.49C1140.77 1532.3 1140.92 1533 1141.22 1533.59C1141.52 1534.18 1141.95 1534.63 1142.51 1534.95C1143.06 1535.27 1143.72 1535.43 1144.48 1535.43C1144.98 1535.43 1145.44 1535.36 1145.86 1535.22C1146.28 1535.08 1146.64 1534.86 1146.94 1534.58C1147.24 1534.3 1147.46 1533.95 1147.62 1533.54L1151.82 1533.81C1151.6 1534.82 1151.17 1535.7 1150.51 1536.45C1149.85 1537.2 1149.01 1537.78 1147.97 1538.2C1146.94 1538.61 1145.75 1538.82 1144.4 1538.82Z" fill="#03031C"/>
+<g filter="url(#filter16_bd_12_618)">
+<rect x="953" y="1390.5" width="109" height="89" rx="10" fill="#FFC743"/>
+<rect x="953.5" y="1391" width="108" height="88" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M992.288 1427.82C991.424 1427.82 990.64 1427.66 989.935 1427.33C989.231 1427 988.672 1426.52 988.257 1425.9C987.843 1425.27 987.636 1424.52 987.636 1423.63C987.636 1422.85 987.79 1422.21 988.097 1421.73C988.405 1421.24 988.817 1420.85 989.331 1420.58C989.846 1420.3 990.415 1420.09 991.036 1419.95C991.663 1419.81 992.294 1419.7 992.927 1419.62C993.756 1419.51 994.427 1419.43 994.942 1419.38C995.463 1419.32 995.842 1419.22 996.079 1419.08C996.321 1418.95 996.443 1418.71 996.443 1418.37V1418.3C996.443 1417.43 996.203 1416.75 995.724 1416.26C995.25 1415.78 994.531 1415.53 993.566 1415.53C992.566 1415.53 991.782 1415.75 991.214 1416.19C990.645 1416.63 990.246 1417.1 990.015 1417.59L988.026 1416.88C988.382 1416.05 988.855 1415.41 989.447 1414.95C990.045 1414.48 990.696 1414.15 991.4 1413.97C992.11 1413.78 992.809 1413.69 993.495 1413.69C993.933 1413.69 994.436 1413.74 995.004 1413.85C995.579 1413.95 996.132 1414.16 996.665 1414.48C997.203 1414.8 997.65 1415.28 998.005 1415.92C998.36 1416.57 998.538 1417.43 998.538 1418.52V1427.5H996.443V1425.65H996.336C996.194 1425.95 995.957 1426.27 995.626 1426.6C995.294 1426.94 994.854 1427.23 994.303 1427.46C993.753 1427.7 993.081 1427.82 992.288 1427.82ZM992.607 1425.94C993.436 1425.94 994.134 1425.77 994.703 1425.45C995.277 1425.12 995.709 1424.7 995.999 1424.19C996.295 1423.67 996.443 1423.13 996.443 1422.56V1420.65C996.354 1420.75 996.159 1420.85 995.857 1420.94C995.561 1421.02 995.218 1421.1 994.827 1421.16C994.442 1421.22 994.066 1421.27 993.699 1421.32C993.338 1421.36 993.045 1421.4 992.82 1421.43C992.276 1421.5 991.767 1421.61 991.294 1421.77C990.826 1421.93 990.447 1422.16 990.157 1422.48C989.873 1422.78 989.731 1423.2 989.731 1423.74C989.731 1424.46 990 1425.01 990.539 1425.39C991.083 1425.75 991.773 1425.94 992.607 1425.94ZM1002.36 1432.61V1413.86H1004.39V1416.03H1004.63C1004.79 1415.79 1005 1415.49 1005.27 1415.12C1005.55 1414.75 1005.95 1414.42 1006.46 1414.13C1006.98 1413.83 1007.69 1413.69 1008.58 1413.69C1009.72 1413.69 1010.74 1413.97 1011.61 1414.55C1012.49 1415.12 1013.17 1415.94 1013.66 1416.99C1014.15 1418.04 1014.4 1419.29 1014.4 1420.72C1014.4 1422.16 1014.15 1423.41 1013.66 1424.47C1013.17 1425.53 1012.49 1426.34 1011.62 1426.92C1010.75 1427.5 1009.75 1427.78 1008.61 1427.78C1007.74 1427.78 1007.03 1427.64 1006.51 1427.35C1005.98 1427.05 1005.58 1426.72 1005.29 1426.35C1005.01 1425.97 1004.79 1425.65 1004.63 1425.4H1004.46V1432.61H1002.36ZM1004.42 1420.68C1004.42 1421.71 1004.57 1422.62 1004.87 1423.41C1005.18 1424.19 1005.62 1424.8 1006.2 1425.25C1006.78 1425.68 1007.49 1425.9 1008.33 1425.9C1009.2 1425.9 1009.93 1425.67 1010.52 1425.21C1011.11 1424.74 1011.56 1424.11 1011.85 1423.33C1012.15 1422.53 1012.31 1421.65 1012.31 1420.68C1012.31 1419.72 1012.16 1418.86 1011.86 1418.09C1011.57 1417.31 1011.13 1416.7 1010.54 1416.25C1009.95 1415.8 1009.22 1415.57 1008.33 1415.57C1007.48 1415.57 1006.76 1415.78 1006.18 1416.22C1005.6 1416.64 1005.16 1417.24 1004.87 1418.01C1004.57 1418.77 1004.42 1419.66 1004.42 1420.68ZM1017.6 1427.5V1413.86H1019.69V1427.5H1017.6ZM1018.66 1411.59C1018.25 1411.59 1017.9 1411.45 1017.61 1411.17C1017.32 1410.9 1017.17 1410.56 1017.17 1410.17C1017.17 1409.78 1017.32 1409.45 1017.61 1409.17C1017.9 1408.89 1018.25 1408.75 1018.66 1408.75C1019.07 1408.75 1019.42 1408.89 1019.71 1409.17C1020.01 1409.45 1020.15 1409.78 1020.15 1410.17C1020.15 1410.56 1020.01 1410.9 1019.71 1411.17C1019.42 1411.45 1019.07 1411.59 1018.66 1411.59ZM998.258 1450H996.056C995.926 1449.37 995.698 1448.81 995.373 1448.33C995.053 1447.85 994.663 1447.45 994.201 1447.12C993.745 1446.79 993.239 1446.54 992.683 1446.38C992.127 1446.21 991.547 1446.13 990.943 1446.13C989.842 1446.13 988.845 1446.41 987.951 1446.96C987.063 1447.52 986.356 1448.34 985.829 1449.42C985.308 1450.51 985.048 1451.83 985.048 1453.41C985.048 1454.98 985.308 1456.31 985.829 1457.4C986.356 1458.48 987.063 1459.3 987.951 1459.85C988.845 1460.41 989.842 1460.69 990.943 1460.69C991.547 1460.69 992.127 1460.61 992.683 1460.44C993.239 1460.27 993.745 1460.03 994.201 1459.7C994.663 1459.37 995.053 1458.97 995.373 1458.49C995.698 1458 995.926 1457.45 996.056 1456.82H998.258C998.092 1457.75 997.791 1458.58 997.353 1459.31C996.915 1460.05 996.37 1460.67 995.719 1461.19C995.068 1461.7 994.337 1462.08 993.526 1462.35C992.721 1462.62 991.86 1462.75 990.943 1462.75C989.392 1462.75 988.013 1462.37 986.806 1461.61C985.598 1460.85 984.648 1459.78 983.956 1458.38C983.263 1456.98 982.917 1455.33 982.917 1453.41C982.917 1451.49 983.263 1449.83 983.956 1448.44C984.648 1447.04 985.598 1445.96 986.806 1445.21C988.013 1444.45 989.392 1444.07 990.943 1444.07C991.86 1444.07 992.721 1444.2 993.526 1444.47C994.337 1444.74 995.068 1445.13 995.719 1445.64C996.37 1446.15 996.915 1446.77 997.353 1447.51C997.791 1448.23 998.092 1449.06 998.258 1450ZM1001.82 1462.5V1444.32H1007.96C1009.38 1444.32 1010.55 1444.56 1011.46 1445.05C1012.37 1445.53 1013.04 1446.19 1013.48 1447.03C1013.92 1447.87 1014.14 1448.82 1014.14 1449.89C1014.14 1450.96 1013.92 1451.91 1013.48 1452.74C1013.04 1453.57 1012.37 1454.22 1011.47 1454.7C1010.56 1455.16 1009.4 1455.4 1007.99 1455.4H1003.02V1453.41H1007.92C1008.89 1453.41 1009.68 1453.27 1010.27 1452.98C1010.87 1452.7 1011.3 1452.3 1011.56 1451.78C1011.84 1451.25 1011.97 1450.62 1011.97 1449.89C1011.97 1449.17 1011.84 1448.53 1011.56 1447.98C1011.29 1447.44 1010.86 1447.02 1010.26 1446.72C1009.66 1446.42 1008.87 1446.27 1007.89 1446.27H1004.02V1462.5H1001.82ZM1010.37 1454.33L1014.85 1462.5H1012.29L1007.89 1454.33H1010.37ZM1023.42 1462.5H1017.81V1444.32H1023.67C1025.43 1444.32 1026.94 1444.68 1028.19 1445.41C1029.45 1446.13 1030.41 1447.17 1031.08 1448.53C1031.75 1449.88 1032.08 1451.49 1032.08 1453.37C1032.08 1455.27 1031.75 1456.9 1031.07 1458.27C1030.4 1459.63 1029.41 1460.67 1028.12 1461.41C1026.83 1462.14 1025.26 1462.5 1023.42 1462.5ZM1020.01 1460.55H1023.28C1024.78 1460.55 1026.03 1460.26 1027.01 1459.68C1028 1459.1 1028.74 1458.27 1029.22 1457.2C1029.71 1456.13 1029.95 1454.85 1029.95 1453.37C1029.95 1451.91 1029.71 1450.64 1029.23 1449.58C1028.75 1448.52 1028.04 1447.7 1027.08 1447.13C1026.13 1446.56 1024.94 1446.27 1023.52 1446.27H1020.01V1460.55Z" fill="#03031C"/>
+<g filter="url(#filter17_bd_12_618)">
+<rect x="1074" y="1390.5" width="109" height="89" rx="10" fill="#FFC743"/>
+<rect x="1074.5" y="1391" width="108" height="88" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M1113.29 1427.82C1112.42 1427.82 1111.64 1427.66 1110.94 1427.33C1110.23 1427 1109.67 1426.52 1109.26 1425.9C1108.84 1425.27 1108.64 1424.52 1108.64 1423.63C1108.64 1422.85 1108.79 1422.21 1109.1 1421.73C1109.41 1421.24 1109.82 1420.85 1110.33 1420.58C1110.85 1420.3 1111.41 1420.09 1112.04 1419.95C1112.66 1419.81 1113.29 1419.7 1113.93 1419.62C1114.76 1419.51 1115.43 1419.43 1115.94 1419.38C1116.46 1419.32 1116.84 1419.22 1117.08 1419.08C1117.32 1418.95 1117.44 1418.71 1117.44 1418.37V1418.3C1117.44 1417.43 1117.2 1416.75 1116.72 1416.26C1116.25 1415.78 1115.53 1415.53 1114.57 1415.53C1113.57 1415.53 1112.78 1415.75 1112.21 1416.19C1111.65 1416.63 1111.25 1417.1 1111.02 1417.59L1109.03 1416.88C1109.38 1416.05 1109.86 1415.41 1110.45 1414.95C1111.04 1414.48 1111.7 1414.15 1112.4 1413.97C1113.11 1413.78 1113.81 1413.69 1114.5 1413.69C1114.93 1413.69 1115.44 1413.74 1116 1413.85C1116.58 1413.95 1117.13 1414.16 1117.66 1414.48C1118.2 1414.8 1118.65 1415.28 1119.01 1415.92C1119.36 1416.57 1119.54 1417.43 1119.54 1418.52V1427.5H1117.44V1425.65H1117.34C1117.19 1425.95 1116.96 1426.27 1116.63 1426.6C1116.29 1426.94 1115.85 1427.23 1115.3 1427.46C1114.75 1427.7 1114.08 1427.82 1113.29 1427.82ZM1113.61 1425.94C1114.44 1425.94 1115.13 1425.77 1115.7 1425.45C1116.28 1425.12 1116.71 1424.7 1117 1424.19C1117.29 1423.67 1117.44 1423.13 1117.44 1422.56V1420.65C1117.35 1420.75 1117.16 1420.85 1116.86 1420.94C1116.56 1421.02 1116.22 1421.1 1115.83 1421.16C1115.44 1421.22 1115.07 1421.27 1114.7 1421.32C1114.34 1421.36 1114.05 1421.4 1113.82 1421.43C1113.28 1421.5 1112.77 1421.61 1112.29 1421.77C1111.83 1421.93 1111.45 1422.16 1111.16 1422.48C1110.87 1422.78 1110.73 1423.2 1110.73 1423.74C1110.73 1424.46 1111 1425.01 1111.54 1425.39C1112.08 1425.75 1112.77 1425.94 1113.61 1425.94ZM1123.36 1432.61V1413.86H1125.39V1416.03H1125.63C1125.79 1415.79 1126 1415.49 1126.27 1415.12C1126.55 1414.75 1126.95 1414.42 1127.46 1414.13C1127.98 1413.83 1128.69 1413.69 1129.58 1413.69C1130.72 1413.69 1131.74 1413.97 1132.61 1414.55C1133.49 1415.12 1134.17 1415.94 1134.66 1416.99C1135.15 1418.04 1135.4 1419.29 1135.4 1420.72C1135.4 1422.16 1135.15 1423.41 1134.66 1424.47C1134.17 1425.53 1133.49 1426.34 1132.62 1426.92C1131.75 1427.5 1130.75 1427.78 1129.61 1427.78C1128.74 1427.78 1128.03 1427.64 1127.51 1427.35C1126.98 1427.05 1126.58 1426.72 1126.29 1426.35C1126.01 1425.97 1125.79 1425.65 1125.63 1425.4H1125.46V1432.61H1123.36ZM1125.42 1420.68C1125.42 1421.71 1125.57 1422.62 1125.87 1423.41C1126.18 1424.19 1126.62 1424.8 1127.2 1425.25C1127.78 1425.68 1128.49 1425.9 1129.33 1425.9C1130.2 1425.9 1130.93 1425.67 1131.52 1425.21C1132.11 1424.74 1132.56 1424.11 1132.85 1423.33C1133.15 1422.53 1133.31 1421.65 1133.31 1420.68C1133.31 1419.72 1133.16 1418.86 1132.86 1418.09C1132.57 1417.31 1132.13 1416.7 1131.54 1416.25C1130.95 1415.8 1130.22 1415.57 1129.33 1415.57C1128.48 1415.57 1127.76 1415.78 1127.18 1416.22C1126.6 1416.64 1126.16 1417.24 1125.87 1418.01C1125.57 1418.77 1125.42 1419.66 1125.42 1420.68ZM1138.6 1427.5V1413.86H1140.69V1427.5H1138.6ZM1139.66 1411.59C1139.25 1411.59 1138.9 1411.45 1138.61 1411.17C1138.32 1410.9 1138.17 1410.56 1138.17 1410.17C1138.17 1409.78 1138.32 1409.45 1138.61 1409.17C1138.9 1408.89 1139.25 1408.75 1139.66 1408.75C1140.07 1408.75 1140.42 1408.89 1140.71 1409.17C1141.01 1409.45 1141.15 1409.78 1141.15 1410.17C1141.15 1410.56 1141.01 1410.9 1140.71 1411.17C1140.42 1411.45 1140.07 1411.59 1139.66 1411.59ZM1119.26 1450H1117.06C1116.93 1449.37 1116.7 1448.81 1116.37 1448.33C1116.05 1447.85 1115.66 1447.45 1115.2 1447.12C1114.75 1446.79 1114.24 1446.54 1113.68 1446.38C1113.13 1446.21 1112.55 1446.13 1111.94 1446.13C1110.84 1446.13 1109.84 1446.41 1108.95 1446.96C1108.06 1447.52 1107.36 1448.34 1106.83 1449.42C1106.31 1450.51 1106.05 1451.83 1106.05 1453.41C1106.05 1454.98 1106.31 1456.31 1106.83 1457.4C1107.36 1458.48 1108.06 1459.3 1108.95 1459.85C1109.84 1460.41 1110.84 1460.69 1111.94 1460.69C1112.55 1460.69 1113.13 1460.61 1113.68 1460.44C1114.24 1460.27 1114.75 1460.03 1115.2 1459.7C1115.66 1459.37 1116.05 1458.97 1116.37 1458.49C1116.7 1458 1116.93 1457.45 1117.06 1456.82H1119.26C1119.09 1457.75 1118.79 1458.58 1118.35 1459.31C1117.91 1460.05 1117.37 1460.67 1116.72 1461.19C1116.07 1461.7 1115.34 1462.08 1114.53 1462.35C1113.72 1462.62 1112.86 1462.75 1111.94 1462.75C1110.39 1462.75 1109.01 1462.37 1107.81 1461.61C1106.6 1460.85 1105.65 1459.78 1104.96 1458.38C1104.26 1456.98 1103.92 1455.33 1103.92 1453.41C1103.92 1451.49 1104.26 1449.83 1104.96 1448.44C1105.65 1447.04 1106.6 1445.96 1107.81 1445.21C1109.01 1444.45 1110.39 1444.07 1111.94 1444.07C1112.86 1444.07 1113.72 1444.2 1114.53 1444.47C1115.34 1444.74 1116.07 1445.13 1116.72 1445.64C1117.37 1446.15 1117.91 1446.77 1118.35 1447.51C1118.79 1448.23 1119.09 1449.06 1119.26 1450ZM1122.82 1462.5V1444.32H1128.96C1130.38 1444.32 1131.55 1444.56 1132.46 1445.05C1133.37 1445.53 1134.04 1446.19 1134.48 1447.03C1134.92 1447.87 1135.14 1448.82 1135.14 1449.89C1135.14 1450.96 1134.92 1451.91 1134.48 1452.74C1134.04 1453.57 1133.37 1454.22 1132.47 1454.7C1131.56 1455.16 1130.4 1455.4 1128.99 1455.4H1124.02V1453.41H1128.92C1129.89 1453.41 1130.68 1453.27 1131.27 1452.98C1131.87 1452.7 1132.3 1452.3 1132.56 1451.78C1132.84 1451.25 1132.97 1450.62 1132.97 1449.89C1132.97 1449.17 1132.84 1448.53 1132.56 1447.98C1132.29 1447.44 1131.86 1447.02 1131.26 1446.72C1130.66 1446.42 1129.87 1446.27 1128.89 1446.27H1125.02V1462.5H1122.82ZM1131.37 1454.33L1135.85 1462.5H1133.29L1128.89 1454.33H1131.37ZM1144.42 1462.5H1138.81V1444.32H1144.67C1146.43 1444.32 1147.94 1444.68 1149.19 1445.41C1150.45 1446.13 1151.41 1447.17 1152.08 1448.53C1152.75 1449.88 1153.08 1451.49 1153.08 1453.37C1153.08 1455.27 1152.75 1456.9 1152.07 1458.27C1151.4 1459.63 1150.41 1460.67 1149.12 1461.41C1147.83 1462.14 1146.26 1462.5 1144.42 1462.5ZM1141.01 1460.55H1144.28C1145.78 1460.55 1147.03 1460.26 1148.01 1459.68C1149 1459.1 1149.74 1458.27 1150.22 1457.2C1150.71 1456.13 1150.95 1454.85 1150.95 1453.37C1150.95 1451.91 1150.71 1450.64 1150.23 1449.58C1149.75 1448.52 1149.04 1447.7 1148.08 1447.13C1147.13 1446.56 1145.94 1446.27 1144.52 1446.27H1141.01V1460.55Z" fill="#03031C"/>
+<path d="M648.207 1310.79C647.817 1310.4 647.183 1310.4 646.793 1310.79L640.429 1317.16C640.038 1317.55 640.038 1318.18 640.429 1318.57C640.819 1318.96 641.453 1318.96 641.843 1318.57L647.5 1312.91L653.157 1318.57C653.547 1318.96 654.181 1318.96 654.571 1318.57C654.962 1318.18 654.962 1317.55 654.571 1317.16L648.207 1310.79ZM646.5 1358.12V1363.84H648.5V1358.12H646.5ZM646.5 1375.28V1381H648.5V1375.28H646.5ZM646.5 1311.5V1316.5H648.5V1311.5H646.5ZM646.5 1326.5V1331.5H648.5V1326.5H646.5Z" fill="#03031C"/>
+<path d="M858.293 1476.29C857.902 1476.68 857.902 1477.32 858.293 1477.71L864.657 1484.07C865.047 1484.46 865.681 1484.46 866.071 1484.07C866.462 1483.68 866.462 1483.05 866.071 1482.66L860.414 1477L866.071 1471.34C866.462 1470.95 866.462 1470.32 866.071 1469.93C865.681 1469.54 865.047 1469.54 864.657 1469.93L858.293 1476.29ZM915.207 1477.71C915.598 1477.32 915.598 1476.68 915.207 1476.29L908.843 1469.93C908.453 1469.54 907.819 1469.54 907.429 1469.93C907.038 1470.32 907.038 1470.95 907.429 1471.34L913.086 1477L907.429 1482.66C907.038 1483.05 907.038 1483.68 907.429 1484.07C907.819 1484.46 908.453 1484.46 908.843 1484.07L915.207 1477.71ZM886.5 1476H859V1478H886.5V1476ZM886.5 1478H914.5V1476H886.5V1478ZM885.5 1189.5V1317.5H887.5V1189.5H885.5ZM885.5 1352V1477H887.5V1352H885.5Z" fill="#03031C"/>
+<path d="M294.83 1522.17L302.181 1497.43C302.997 1494.73 300.955 1491.99 298.138 1491.99H264.04H229.902C227.084 1491.99 225.043 1494.73 225.859 1497.43L233.21 1522.17H264.163" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M227.983 1516.99L224.063 1524.38C222.919 1526.54 224.471 1529.11 226.921 1529.11H264H301.078C303.528 1529.11 305.08 1526.54 303.937 1524.38L300.016 1516.99" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M264 1475.91C271.33 1475.91 277.271 1468.54 277.271 1459.45C277.271 1450.36 271.33 1442.99 264 1442.99C256.67 1442.99 250.729 1450.36 250.729 1459.45C250.729 1468.54 256.67 1475.91 264 1475.91Z" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M273.474 1470.96C273.474 1470.96 282.866 1476.07 286.541 1479.01C287.398 1479.7 288.134 1480.56 288.746 1481.5C289.849 1483.26 290.339 1485.34 290.339 1487.38V1491.99" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M254.526 1470.96C254.526 1470.96 245.134 1476.07 241.459 1479.01C240.601 1479.7 239.866 1480.56 239.254 1481.5C238.151 1483.26 237.62 1485.34 237.62 1487.38V1491.99" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M467 1422L467 1469" stroke="white" stroke-width="2"/>
+<path d="M467 1197L467 1225" stroke="white" stroke-width="2"/>
+<path d="M467 1220L467 1285" stroke="white" stroke-width="2"/>
+<path d="M425.464 1521V1522H426.464V1521H425.464ZM425.464 1456V1455H424.464V1456H425.464ZM559.707 1456.71C560.098 1456.32 560.098 1455.68 559.707 1455.29L553.343 1448.93C552.953 1448.54 552.319 1448.54 551.929 1448.93C551.538 1449.32 551.538 1449.95 551.929 1450.34L557.586 1456L551.929 1461.66C551.538 1462.05 551.538 1462.68 551.929 1463.07C552.319 1463.46 552.953 1463.46 553.343 1463.07L559.707 1456.71ZM376.5 1522H425.464V1520H376.5V1522ZM426.464 1521V1456H424.464V1521H426.464ZM425.464 1457H559V1455H425.464V1457Z" fill="#03031C"/>
+<path d="M378 1212H874" stroke="#03031C" stroke-width="2"/>
+<path d="M1066 1212H1067V1211H1066V1212ZM1065.29 1227.71C1065.68 1228.1 1066.32 1228.1 1066.71 1227.71L1073.07 1221.34C1073.46 1220.95 1073.46 1220.32 1073.07 1219.93C1072.68 1219.54 1072.05 1219.54 1071.66 1219.93L1066 1225.59L1060.34 1219.93C1059.95 1219.54 1059.32 1219.54 1058.93 1219.93C1058.54 1220.32 1058.54 1220.95 1058.93 1221.34L1065.29 1227.71ZM897.5 1213H1066V1211H897.5V1213ZM1065 1212V1227H1067V1212H1065Z" fill="#03031C"/>
+<path d="M560.707 1269.71C561.098 1269.32 561.098 1268.68 560.707 1268.29L554.343 1261.93C553.953 1261.54 553.319 1261.54 552.929 1261.93C552.538 1262.32 552.538 1262.95 552.929 1263.34L558.586 1269L552.929 1274.66C552.538 1275.05 552.538 1275.68 552.929 1276.07C553.319 1276.46 553.953 1276.46 554.343 1276.07L560.707 1269.71ZM378 1270L560 1270L560 1268L378 1268L378 1270Z" fill="#03031C"/>
+<path d="M450.085 1445V1434.09H451.704V1435.8H451.846C452.074 1435.21 452.44 1434.76 452.947 1434.44C453.454 1434.11 454.062 1433.95 454.772 1433.95C455.492 1433.95 456.091 1434.11 456.569 1434.44C457.052 1434.76 457.429 1435.21 457.699 1435.8H457.812C458.092 1435.23 458.511 1434.78 459.069 1434.45C459.628 1434.12 460.298 1433.95 461.079 1433.95C462.055 1433.95 462.852 1434.25 463.473 1434.87C464.093 1435.47 464.403 1436.42 464.403 1437.7V1445H462.727V1437.7C462.727 1436.89 462.507 1436.32 462.066 1435.97C461.626 1435.63 461.108 1435.45 460.511 1435.45C459.744 1435.45 459.15 1435.69 458.728 1436.15C458.307 1436.61 458.096 1437.19 458.096 1437.9V1445H456.392V1437.53C456.392 1436.91 456.19 1436.41 455.788 1436.03C455.386 1435.65 454.867 1435.45 454.233 1435.45C453.797 1435.45 453.39 1435.57 453.011 1435.8C452.637 1436.03 452.334 1436.36 452.102 1436.77C451.875 1437.18 451.761 1437.65 451.761 1438.18V1445H450.085ZM470.678 1445.26C469.987 1445.26 469.359 1445.13 468.796 1444.87C468.232 1444.6 467.785 1444.22 467.453 1443.72C467.122 1443.22 466.956 1442.61 466.956 1441.9C466.956 1441.28 467.079 1440.77 467.326 1440.38C467.572 1439.99 467.901 1439.68 468.313 1439.46C468.725 1439.24 469.179 1439.07 469.676 1438.96C470.178 1438.85 470.683 1438.76 471.189 1438.69C471.852 1438.61 472.39 1438.54 472.801 1438.5C473.218 1438.45 473.521 1438.38 473.711 1438.27C473.905 1438.16 474.002 1437.97 474.002 1437.7V1437.64C474.002 1436.94 473.81 1436.4 473.426 1436.01C473.048 1435.62 472.472 1435.43 471.701 1435.43C470.9 1435.43 470.273 1435.6 469.819 1435.95C469.364 1436.3 469.044 1436.68 468.86 1437.07L467.269 1436.51C467.553 1435.84 467.932 1435.33 468.405 1434.96C468.883 1434.58 469.404 1434.32 469.968 1434.18C470.536 1434.02 471.095 1433.95 471.644 1433.95C471.994 1433.95 472.397 1433.99 472.851 1434.08C473.31 1434.16 473.753 1434.33 474.179 1434.58C474.61 1434.84 474.968 1435.22 475.252 1435.74C475.536 1436.25 475.678 1436.95 475.678 1437.81V1445H474.002V1443.52H473.917C473.803 1443.76 473.614 1444.01 473.348 1444.28C473.083 1444.55 472.73 1444.78 472.29 1444.97C471.85 1445.16 471.312 1445.26 470.678 1445.26ZM470.934 1443.75C471.596 1443.75 472.155 1443.62 472.61 1443.36C473.069 1443.1 473.415 1442.76 473.647 1442.35C473.883 1441.94 474.002 1441.51 474.002 1441.05V1439.52C473.931 1439.6 473.775 1439.68 473.533 1439.75C473.296 1439.82 473.022 1439.88 472.709 1439.93C472.401 1439.98 472.101 1440.02 471.807 1440.06C471.518 1440.09 471.284 1440.12 471.104 1440.14C470.668 1440.2 470.261 1440.29 469.882 1440.42C469.508 1440.54 469.205 1440.73 468.973 1440.98C468.746 1441.23 468.632 1441.56 468.632 1441.99C468.632 1442.57 468.848 1443.01 469.279 1443.31C469.714 1443.6 470.266 1443.75 470.934 1443.75ZM480.413 1438.44V1445H478.737V1434.09H480.357V1435.8H480.499C480.754 1435.24 481.143 1434.8 481.663 1434.46C482.184 1434.12 482.857 1433.95 483.68 1433.95C484.419 1433.95 485.065 1434.1 485.619 1434.4C486.173 1434.7 486.604 1435.16 486.912 1435.77C487.22 1436.37 487.374 1437.14 487.374 1438.07V1445H485.697V1438.18C485.697 1437.32 485.475 1436.66 485.03 1436.18C484.585 1435.7 483.974 1435.45 483.197 1435.45C482.662 1435.45 482.184 1435.57 481.763 1435.8C481.346 1436.03 481.017 1436.37 480.776 1436.82C480.534 1437.26 480.413 1437.8 480.413 1438.44ZM493.647 1445.26C492.955 1445.26 492.328 1445.13 491.765 1444.87C491.201 1444.6 490.754 1444.22 490.422 1443.72C490.091 1443.22 489.925 1442.61 489.925 1441.9C489.925 1441.28 490.048 1440.77 490.294 1440.38C490.541 1439.99 490.87 1439.68 491.282 1439.46C491.694 1439.24 492.148 1439.07 492.645 1438.96C493.147 1438.85 493.651 1438.76 494.158 1438.69C494.821 1438.61 495.358 1438.54 495.77 1438.5C496.187 1438.45 496.49 1438.38 496.679 1438.27C496.873 1438.16 496.971 1437.97 496.971 1437.7V1437.64C496.971 1436.94 496.779 1436.4 496.395 1436.01C496.016 1435.62 495.441 1435.43 494.669 1435.43C493.869 1435.43 493.242 1435.6 492.787 1435.95C492.333 1436.3 492.013 1436.68 491.828 1437.07L490.238 1436.51C490.522 1435.84 490.9 1435.33 491.374 1434.96C491.852 1434.58 492.373 1434.32 492.936 1434.18C493.505 1434.02 494.063 1433.95 494.613 1433.95C494.963 1433.95 495.365 1433.99 495.82 1434.08C496.279 1434.16 496.722 1434.33 497.148 1434.58C497.579 1434.84 497.936 1435.22 498.221 1435.74C498.505 1436.25 498.647 1436.95 498.647 1437.81V1445H496.971V1443.52H496.885C496.772 1443.76 496.582 1444.01 496.317 1444.28C496.052 1444.55 495.699 1444.78 495.259 1444.97C494.819 1445.16 494.281 1445.26 493.647 1445.26ZM493.902 1443.75C494.565 1443.75 495.124 1443.62 495.578 1443.36C496.038 1443.1 496.383 1442.76 496.615 1442.35C496.852 1441.94 496.971 1441.51 496.971 1441.05V1439.52C496.9 1439.6 496.743 1439.68 496.502 1439.75C496.265 1439.82 495.99 1439.88 495.678 1439.93C495.37 1439.98 495.069 1440.02 494.776 1440.06C494.487 1440.09 494.253 1440.12 494.073 1440.14C493.637 1440.2 493.23 1440.29 492.851 1440.42C492.477 1440.54 492.174 1440.73 491.942 1440.98C491.715 1441.23 491.601 1441.56 491.601 1441.99C491.601 1442.57 491.817 1443.01 492.248 1443.31C492.683 1443.6 493.235 1443.75 493.902 1443.75ZM506.109 1449.32C505.3 1449.32 504.604 1449.21 504.021 1449.01C503.439 1448.8 502.954 1448.53 502.565 1448.2C502.182 1447.86 501.876 1447.51 501.649 1447.13L502.984 1446.19C503.136 1446.39 503.328 1446.62 503.56 1446.88C503.792 1447.14 504.109 1447.36 504.511 1447.55C504.919 1447.74 505.451 1447.84 506.109 1447.84C506.99 1447.84 507.717 1447.63 508.29 1447.2C508.863 1446.78 509.149 1446.11 509.149 1445.2V1442.98H509.007C508.884 1443.18 508.709 1443.43 508.482 1443.72C508.259 1444.01 507.937 1444.27 507.516 1444.5C507.099 1444.72 506.536 1444.83 505.825 1444.83C504.945 1444.83 504.154 1444.62 503.453 1444.2C502.757 1443.79 502.205 1443.18 501.798 1442.39C501.396 1441.59 501.195 1440.62 501.195 1439.49C501.195 1438.37 501.391 1437.4 501.784 1436.57C502.177 1435.74 502.724 1435.09 503.425 1434.64C504.125 1434.18 504.935 1433.95 505.854 1433.95C506.564 1433.95 507.127 1434.07 507.544 1434.3C507.965 1434.54 508.287 1434.8 508.51 1435.1C508.737 1435.39 508.912 1435.63 509.036 1435.82H509.206V1434.09H510.825V1445.31C510.825 1446.25 510.612 1447.01 510.186 1447.6C509.765 1448.19 509.196 1448.62 508.482 1448.9C507.771 1449.18 506.981 1449.32 506.109 1449.32ZM506.053 1443.32C506.725 1443.32 507.293 1443.17 507.757 1442.86C508.221 1442.55 508.574 1442.11 508.815 1441.53C509.057 1440.96 509.178 1440.27 509.178 1439.46C509.178 1438.67 509.059 1437.98 508.822 1437.38C508.586 1436.78 508.235 1436.31 507.771 1435.97C507.307 1435.62 506.734 1435.45 506.053 1435.45C505.342 1435.45 504.75 1435.63 504.277 1435.99C503.808 1436.35 503.455 1436.84 503.219 1437.44C502.987 1438.05 502.871 1438.72 502.871 1439.46C502.871 1440.22 502.989 1440.89 503.226 1441.47C503.467 1442.05 503.822 1442.5 504.291 1442.83C504.765 1443.16 505.352 1443.32 506.053 1443.32ZM518.467 1445.23C517.416 1445.23 516.509 1445 515.747 1444.53C514.99 1444.06 514.405 1443.41 513.993 1442.57C513.586 1441.73 513.382 1440.75 513.382 1439.63C513.382 1438.51 513.586 1437.53 513.993 1436.68C514.405 1435.82 514.978 1435.15 515.712 1434.67C516.45 1434.19 517.312 1433.95 518.297 1433.95C518.865 1433.95 519.426 1434.04 519.98 1434.23C520.534 1434.42 521.038 1434.73 521.493 1435.16C521.947 1435.58 522.31 1436.14 522.58 1436.83C522.849 1437.53 522.984 1438.39 522.984 1439.4V1440.11H514.575V1438.66H521.28C521.28 1438.05 521.157 1437.5 520.911 1437.02C520.669 1436.53 520.323 1436.15 519.874 1435.87C519.429 1435.59 518.903 1435.45 518.297 1435.45C517.629 1435.45 517.052 1435.62 516.564 1435.95C516.081 1436.28 515.709 1436.7 515.449 1437.23C515.188 1437.76 515.058 1438.32 515.058 1438.92V1439.89C515.058 1440.71 515.2 1441.41 515.484 1441.98C515.773 1442.55 516.173 1442.98 516.685 1443.28C517.196 1443.57 517.79 1443.72 518.467 1443.72C518.908 1443.72 519.305 1443.66 519.661 1443.54C520.02 1443.41 520.33 1443.22 520.591 1442.97C520.851 1442.71 521.053 1442.4 521.195 1442.02L522.814 1442.47C522.643 1443.02 522.357 1443.5 521.955 1443.92C521.552 1444.33 521.055 1444.65 520.463 1444.89C519.871 1445.11 519.206 1445.23 518.467 1445.23ZM533.261 1436.53L531.756 1436.96C531.661 1436.71 531.521 1436.47 531.337 1436.23C531.157 1435.99 530.911 1435.79 530.598 1435.63C530.286 1435.48 529.885 1435.4 529.398 1435.4C528.73 1435.4 528.174 1435.55 527.729 1435.86C527.288 1436.16 527.068 1436.55 527.068 1437.02C527.068 1437.43 527.22 1437.76 527.523 1438C527.826 1438.25 528.299 1438.45 528.943 1438.61L530.562 1439.01C531.538 1439.24 532.265 1439.6 532.743 1440.09C533.221 1440.58 533.46 1441.2 533.46 1441.96C533.46 1442.59 533.28 1443.14 532.92 1443.64C532.565 1444.13 532.068 1444.52 531.429 1444.8C530.79 1445.09 530.046 1445.23 529.199 1445.23C528.086 1445.23 527.165 1444.99 526.436 1444.5C525.707 1444.02 525.245 1443.31 525.051 1442.39L526.642 1441.99C526.794 1442.58 527.08 1443.02 527.501 1443.31C527.928 1443.6 528.484 1443.75 529.17 1443.75C529.952 1443.75 530.572 1443.58 531.031 1443.25C531.495 1442.92 531.727 1442.51 531.727 1442.05C531.727 1441.67 531.595 1441.35 531.33 1441.09C531.064 1440.83 530.657 1440.64 530.108 1440.51L528.29 1440.09C527.291 1439.85 526.557 1439.48 526.088 1438.98C525.624 1438.48 525.392 1437.86 525.392 1437.1C525.392 1436.49 525.565 1435.94 525.911 1435.47C526.261 1435 526.737 1434.62 527.338 1434.35C527.944 1434.08 528.631 1433.95 529.398 1433.95C530.477 1433.95 531.325 1434.19 531.94 1434.66C532.561 1435.13 533.001 1435.76 533.261 1436.53Z" fill="#03031C"/>
+<path d="M427.085 1255V1244.09H428.704V1245.8H428.846C429.074 1245.21 429.44 1244.76 429.947 1244.44C430.454 1244.11 431.062 1243.95 431.772 1243.95C432.492 1243.95 433.091 1244.11 433.569 1244.44C434.052 1244.76 434.429 1245.21 434.699 1245.8H434.812C435.092 1245.23 435.511 1244.78 436.069 1244.45C436.628 1244.12 437.298 1243.95 438.079 1243.95C439.055 1243.95 439.852 1244.25 440.473 1244.87C441.093 1245.47 441.403 1246.42 441.403 1247.7V1255H439.727V1247.7C439.727 1246.89 439.507 1246.32 439.066 1245.97C438.626 1245.63 438.108 1245.45 437.511 1245.45C436.744 1245.45 436.15 1245.69 435.728 1246.15C435.307 1246.61 435.096 1247.19 435.096 1247.9V1255H433.392V1247.53C433.392 1246.91 433.19 1246.41 432.788 1246.03C432.386 1245.65 431.867 1245.45 431.233 1245.45C430.797 1245.45 430.39 1245.57 430.011 1245.8C429.637 1246.03 429.334 1246.36 429.102 1246.77C428.875 1247.18 428.761 1247.65 428.761 1248.18V1255H427.085ZM447.678 1255.26C446.987 1255.26 446.359 1255.13 445.796 1254.87C445.232 1254.6 444.785 1254.22 444.453 1253.72C444.122 1253.22 443.956 1252.61 443.956 1251.9C443.956 1251.28 444.079 1250.77 444.326 1250.38C444.572 1249.99 444.901 1249.68 445.313 1249.46C445.725 1249.24 446.179 1249.07 446.676 1248.96C447.178 1248.85 447.683 1248.76 448.189 1248.69C448.852 1248.61 449.39 1248.54 449.801 1248.5C450.218 1248.45 450.521 1248.38 450.711 1248.27C450.905 1248.16 451.002 1247.97 451.002 1247.7V1247.64C451.002 1246.94 450.81 1246.4 450.426 1246.01C450.048 1245.62 449.472 1245.43 448.701 1245.43C447.9 1245.43 447.273 1245.6 446.819 1245.95C446.364 1246.3 446.044 1246.68 445.86 1247.07L444.269 1246.51C444.553 1245.84 444.932 1245.33 445.405 1244.96C445.883 1244.58 446.404 1244.32 446.968 1244.18C447.536 1244.02 448.095 1243.95 448.644 1243.95C448.994 1243.95 449.397 1243.99 449.851 1244.08C450.31 1244.16 450.753 1244.33 451.179 1244.58C451.61 1244.84 451.968 1245.22 452.252 1245.74C452.536 1246.25 452.678 1246.95 452.678 1247.81V1255H451.002V1253.52H450.917C450.803 1253.76 450.614 1254.01 450.348 1254.28C450.083 1254.55 449.73 1254.78 449.29 1254.97C448.85 1255.16 448.312 1255.26 447.678 1255.26ZM447.934 1253.75C448.596 1253.75 449.155 1253.62 449.61 1253.36C450.069 1253.1 450.415 1252.76 450.647 1252.35C450.883 1251.94 451.002 1251.51 451.002 1251.05V1249.52C450.931 1249.6 450.775 1249.68 450.533 1249.75C450.296 1249.82 450.022 1249.88 449.709 1249.93C449.401 1249.98 449.101 1250.02 448.807 1250.06C448.518 1250.09 448.284 1250.12 448.104 1250.14C447.668 1250.2 447.261 1250.29 446.882 1250.42C446.508 1250.54 446.205 1250.73 445.973 1250.98C445.746 1251.23 445.632 1251.56 445.632 1251.99C445.632 1252.57 445.848 1253.01 446.279 1253.31C446.714 1253.6 447.266 1253.75 447.934 1253.75ZM457.413 1248.44V1255H455.737V1244.09H457.357V1245.8H457.499C457.754 1245.24 458.143 1244.8 458.663 1244.46C459.184 1244.12 459.857 1243.95 460.68 1243.95C461.419 1243.95 462.065 1244.1 462.619 1244.4C463.173 1244.7 463.604 1245.16 463.912 1245.77C464.22 1246.37 464.374 1247.14 464.374 1248.07V1255H462.697V1248.18C462.697 1247.32 462.475 1246.66 462.03 1246.18C461.585 1245.7 460.974 1245.45 460.197 1245.45C459.662 1245.45 459.184 1245.57 458.763 1245.8C458.346 1246.03 458.017 1246.37 457.776 1246.82C457.534 1247.26 457.413 1247.8 457.413 1248.44ZM470.647 1255.26C469.955 1255.26 469.328 1255.13 468.765 1254.87C468.201 1254.6 467.754 1254.22 467.422 1253.72C467.091 1253.22 466.925 1252.61 466.925 1251.9C466.925 1251.28 467.048 1250.77 467.294 1250.38C467.541 1249.99 467.87 1249.68 468.282 1249.46C468.694 1249.24 469.148 1249.07 469.645 1248.96C470.147 1248.85 470.651 1248.76 471.158 1248.69C471.821 1248.61 472.358 1248.54 472.77 1248.5C473.187 1248.45 473.49 1248.38 473.679 1248.27C473.873 1248.16 473.971 1247.97 473.971 1247.7V1247.64C473.971 1246.94 473.779 1246.4 473.395 1246.01C473.016 1245.62 472.441 1245.43 471.669 1245.43C470.869 1245.43 470.242 1245.6 469.787 1245.95C469.333 1246.3 469.013 1246.68 468.828 1247.07L467.238 1246.51C467.522 1245.84 467.9 1245.33 468.374 1244.96C468.852 1244.58 469.373 1244.32 469.936 1244.18C470.505 1244.02 471.063 1243.95 471.613 1243.95C471.963 1243.95 472.365 1243.99 472.82 1244.08C473.279 1244.16 473.722 1244.33 474.148 1244.58C474.579 1244.84 474.936 1245.22 475.221 1245.74C475.505 1246.25 475.647 1246.95 475.647 1247.81V1255H473.971V1253.52H473.885C473.772 1253.76 473.582 1254.01 473.317 1254.28C473.052 1254.55 472.699 1254.78 472.259 1254.97C471.819 1255.16 471.281 1255.26 470.647 1255.26ZM470.902 1253.75C471.565 1253.75 472.124 1253.62 472.578 1253.36C473.038 1253.1 473.383 1252.76 473.615 1252.35C473.852 1251.94 473.971 1251.51 473.971 1251.05V1249.52C473.9 1249.6 473.743 1249.68 473.502 1249.75C473.265 1249.82 472.99 1249.88 472.678 1249.93C472.37 1249.98 472.069 1250.02 471.776 1250.06C471.487 1250.09 471.253 1250.12 471.073 1250.14C470.637 1250.2 470.23 1250.29 469.851 1250.42C469.477 1250.54 469.174 1250.73 468.942 1250.98C468.715 1251.23 468.601 1251.56 468.601 1251.99C468.601 1252.57 468.817 1253.01 469.248 1253.31C469.683 1253.6 470.235 1253.75 470.902 1253.75ZM483.109 1259.32C482.3 1259.32 481.604 1259.21 481.021 1259.01C480.439 1258.8 479.954 1258.53 479.565 1258.2C479.182 1257.86 478.876 1257.51 478.649 1257.13L479.984 1256.19C480.136 1256.39 480.328 1256.62 480.56 1256.88C480.792 1257.14 481.109 1257.36 481.511 1257.55C481.919 1257.74 482.451 1257.84 483.109 1257.84C483.99 1257.84 484.717 1257.63 485.29 1257.2C485.863 1256.78 486.149 1256.11 486.149 1255.2V1252.98H486.007C485.884 1253.18 485.709 1253.43 485.482 1253.72C485.259 1254.01 484.937 1254.27 484.516 1254.5C484.099 1254.72 483.536 1254.83 482.825 1254.83C481.945 1254.83 481.154 1254.62 480.453 1254.2C479.757 1253.79 479.205 1253.18 478.798 1252.39C478.396 1251.59 478.195 1250.62 478.195 1249.49C478.195 1248.37 478.391 1247.4 478.784 1246.57C479.177 1245.74 479.724 1245.09 480.425 1244.64C481.125 1244.18 481.935 1243.95 482.854 1243.95C483.564 1243.95 484.127 1244.07 484.544 1244.3C484.965 1244.54 485.287 1244.8 485.51 1245.1C485.737 1245.39 485.912 1245.63 486.036 1245.82H486.206V1244.09H487.825V1255.31C487.825 1256.25 487.612 1257.01 487.186 1257.6C486.765 1258.19 486.196 1258.62 485.482 1258.9C484.771 1259.18 483.981 1259.32 483.109 1259.32ZM483.053 1253.32C483.725 1253.32 484.293 1253.17 484.757 1252.86C485.221 1252.55 485.574 1252.11 485.815 1251.53C486.057 1250.96 486.178 1250.27 486.178 1249.46C486.178 1248.67 486.059 1247.98 485.822 1247.38C485.586 1246.78 485.235 1246.31 484.771 1245.97C484.307 1245.62 483.734 1245.45 483.053 1245.45C482.342 1245.45 481.75 1245.63 481.277 1245.99C480.808 1246.35 480.455 1246.84 480.219 1247.44C479.987 1248.05 479.871 1248.72 479.871 1249.46C479.871 1250.22 479.989 1250.89 480.226 1251.47C480.467 1252.05 480.822 1252.5 481.291 1252.83C481.765 1253.16 482.352 1253.32 483.053 1253.32ZM495.467 1255.23C494.416 1255.23 493.509 1255 492.747 1254.53C491.99 1254.06 491.405 1253.41 490.993 1252.57C490.586 1251.73 490.382 1250.75 490.382 1249.63C490.382 1248.51 490.586 1247.53 490.993 1246.68C491.405 1245.82 491.978 1245.15 492.712 1244.67C493.45 1244.19 494.312 1243.95 495.297 1243.95C495.865 1243.95 496.426 1244.04 496.98 1244.23C497.534 1244.42 498.038 1244.73 498.493 1245.16C498.947 1245.58 499.31 1246.14 499.58 1246.83C499.849 1247.53 499.984 1248.39 499.984 1249.4V1250.11H491.575V1248.66H498.28C498.28 1248.05 498.157 1247.5 497.911 1247.02C497.669 1246.53 497.323 1246.15 496.874 1245.87C496.429 1245.59 495.903 1245.45 495.297 1245.45C494.629 1245.45 494.052 1245.62 493.564 1245.95C493.081 1246.28 492.709 1246.7 492.449 1247.23C492.188 1247.76 492.058 1248.32 492.058 1248.92V1249.89C492.058 1250.71 492.2 1251.41 492.484 1251.98C492.773 1252.55 493.173 1252.98 493.685 1253.28C494.196 1253.57 494.79 1253.72 495.467 1253.72C495.908 1253.72 496.305 1253.66 496.661 1253.54C497.02 1253.41 497.33 1253.22 497.591 1252.97C497.851 1252.71 498.053 1252.4 498.195 1252.02L499.814 1252.47C499.643 1253.02 499.357 1253.5 498.955 1253.92C498.552 1254.33 498.055 1254.65 497.463 1254.89C496.871 1255.11 496.206 1255.23 495.467 1255.23ZM510.261 1246.53L508.756 1246.96C508.661 1246.71 508.521 1246.47 508.337 1246.23C508.157 1245.99 507.911 1245.79 507.598 1245.63C507.286 1245.48 506.885 1245.4 506.398 1245.4C505.73 1245.4 505.174 1245.55 504.729 1245.86C504.288 1246.16 504.068 1246.55 504.068 1247.02C504.068 1247.43 504.22 1247.76 504.523 1248C504.826 1248.25 505.299 1248.45 505.943 1248.61L507.562 1249.01C508.538 1249.24 509.265 1249.6 509.743 1250.09C510.221 1250.58 510.46 1251.2 510.46 1251.96C510.46 1252.59 510.28 1253.14 509.92 1253.64C509.565 1254.13 509.068 1254.52 508.429 1254.8C507.79 1255.09 507.046 1255.23 506.199 1255.23C505.086 1255.23 504.165 1254.99 503.436 1254.5C502.707 1254.02 502.245 1253.31 502.051 1252.39L503.642 1251.99C503.794 1252.58 504.08 1253.02 504.501 1253.31C504.928 1253.6 505.484 1253.75 506.17 1253.75C506.952 1253.75 507.572 1253.58 508.031 1253.25C508.495 1252.92 508.727 1252.51 508.727 1252.05C508.727 1251.67 508.595 1251.35 508.33 1251.09C508.064 1250.83 507.657 1250.64 507.108 1250.51L505.29 1250.09C504.291 1249.85 503.557 1249.48 503.088 1248.98C502.624 1248.48 502.392 1247.86 502.392 1247.1C502.392 1246.49 502.565 1245.94 502.911 1245.47C503.261 1245 503.737 1244.62 504.338 1244.35C504.944 1244.08 505.631 1243.95 506.398 1243.95C507.477 1243.95 508.325 1244.19 508.94 1244.66C509.561 1245.13 510.001 1245.76 510.261 1246.53Z" fill="#03031C"/>
+<path d="M624.085 1197V1186.09H625.704V1187.8H625.846C626.074 1187.21 626.44 1186.76 626.947 1186.44C627.454 1186.11 628.062 1185.95 628.772 1185.95C629.492 1185.95 630.091 1186.11 630.569 1186.44C631.052 1186.76 631.429 1187.21 631.699 1187.8H631.812C632.092 1187.23 632.511 1186.78 633.069 1186.45C633.628 1186.12 634.298 1185.95 635.079 1185.95C636.055 1185.95 636.852 1186.25 637.473 1186.87C638.093 1187.47 638.403 1188.42 638.403 1189.7V1197H636.727V1189.7C636.727 1188.89 636.507 1188.32 636.066 1187.97C635.626 1187.63 635.108 1187.45 634.511 1187.45C633.744 1187.45 633.15 1187.69 632.728 1188.15C632.307 1188.61 632.096 1189.19 632.096 1189.9V1197H630.392V1189.53C630.392 1188.91 630.19 1188.41 629.788 1188.03C629.386 1187.65 628.867 1187.45 628.233 1187.45C627.797 1187.45 627.39 1187.57 627.011 1187.8C626.637 1188.03 626.334 1188.36 626.102 1188.77C625.875 1189.18 625.761 1189.65 625.761 1190.18V1197H624.085ZM644.678 1197.26C643.987 1197.26 643.359 1197.13 642.796 1196.87C642.232 1196.6 641.785 1196.22 641.453 1195.72C641.122 1195.22 640.956 1194.61 640.956 1193.9C640.956 1193.28 641.079 1192.77 641.326 1192.38C641.572 1191.99 641.901 1191.68 642.313 1191.46C642.725 1191.24 643.179 1191.07 643.676 1190.96C644.178 1190.85 644.683 1190.76 645.189 1190.69C645.852 1190.61 646.39 1190.54 646.801 1190.5C647.218 1190.45 647.521 1190.38 647.711 1190.27C647.905 1190.16 648.002 1189.97 648.002 1189.7V1189.64C648.002 1188.94 647.81 1188.4 647.426 1188.01C647.048 1187.62 646.472 1187.43 645.701 1187.43C644.9 1187.43 644.273 1187.6 643.819 1187.95C643.364 1188.3 643.044 1188.68 642.86 1189.07L641.269 1188.51C641.553 1187.84 641.932 1187.33 642.405 1186.96C642.883 1186.58 643.404 1186.32 643.968 1186.18C644.536 1186.02 645.095 1185.95 645.644 1185.95C645.994 1185.95 646.397 1185.99 646.851 1186.08C647.31 1186.16 647.753 1186.33 648.179 1186.58C648.61 1186.84 648.968 1187.22 649.252 1187.74C649.536 1188.25 649.678 1188.95 649.678 1189.81V1197H648.002V1195.52H647.917C647.803 1195.76 647.614 1196.01 647.348 1196.28C647.083 1196.55 646.73 1196.78 646.29 1196.97C645.85 1197.16 645.312 1197.26 644.678 1197.26ZM644.934 1195.75C645.596 1195.75 646.155 1195.62 646.61 1195.36C647.069 1195.1 647.415 1194.76 647.647 1194.35C647.883 1193.94 648.002 1193.51 648.002 1193.05V1191.52C647.931 1191.6 647.775 1191.68 647.533 1191.75C647.296 1191.82 647.022 1191.88 646.709 1191.93C646.401 1191.98 646.101 1192.02 645.807 1192.06C645.518 1192.09 645.284 1192.12 645.104 1192.14C644.668 1192.2 644.261 1192.29 643.882 1192.42C643.508 1192.54 643.205 1192.73 642.973 1192.98C642.746 1193.23 642.632 1193.56 642.632 1193.99C642.632 1194.57 642.848 1195.01 643.279 1195.31C643.714 1195.6 644.266 1195.75 644.934 1195.75ZM654.413 1190.44V1197H652.737V1186.09H654.357V1187.8H654.499C654.754 1187.24 655.143 1186.8 655.663 1186.46C656.184 1186.12 656.857 1185.95 657.68 1185.95C658.419 1185.95 659.065 1186.1 659.619 1186.4C660.173 1186.7 660.604 1187.16 660.912 1187.77C661.22 1188.37 661.374 1189.14 661.374 1190.07V1197H659.697V1190.18C659.697 1189.32 659.475 1188.66 659.03 1188.18C658.585 1187.7 657.974 1187.45 657.197 1187.45C656.662 1187.45 656.184 1187.57 655.763 1187.8C655.346 1188.03 655.017 1188.37 654.776 1188.82C654.534 1189.26 654.413 1189.8 654.413 1190.44ZM667.647 1197.26C666.955 1197.26 666.328 1197.13 665.765 1196.87C665.201 1196.6 664.754 1196.22 664.422 1195.72C664.091 1195.22 663.925 1194.61 663.925 1193.9C663.925 1193.28 664.048 1192.77 664.294 1192.38C664.541 1191.99 664.87 1191.68 665.282 1191.46C665.694 1191.24 666.148 1191.07 666.645 1190.96C667.147 1190.85 667.651 1190.76 668.158 1190.69C668.821 1190.61 669.358 1190.54 669.77 1190.5C670.187 1190.45 670.49 1190.38 670.679 1190.27C670.873 1190.16 670.971 1189.97 670.971 1189.7V1189.64C670.971 1188.94 670.779 1188.4 670.395 1188.01C670.016 1187.62 669.441 1187.43 668.669 1187.43C667.869 1187.43 667.242 1187.6 666.787 1187.95C666.333 1188.3 666.013 1188.68 665.828 1189.07L664.238 1188.51C664.522 1187.84 664.9 1187.33 665.374 1186.96C665.852 1186.58 666.373 1186.32 666.936 1186.18C667.505 1186.02 668.063 1185.95 668.613 1185.95C668.963 1185.95 669.365 1185.99 669.82 1186.08C670.279 1186.16 670.722 1186.33 671.148 1186.58C671.579 1186.84 671.936 1187.22 672.221 1187.74C672.505 1188.25 672.647 1188.95 672.647 1189.81V1197H670.971V1195.52H670.885C670.772 1195.76 670.582 1196.01 670.317 1196.28C670.052 1196.55 669.699 1196.78 669.259 1196.97C668.819 1197.16 668.281 1197.26 667.647 1197.26ZM667.902 1195.75C668.565 1195.75 669.124 1195.62 669.578 1195.36C670.038 1195.1 670.383 1194.76 670.615 1194.35C670.852 1193.94 670.971 1193.51 670.971 1193.05V1191.52C670.9 1191.6 670.743 1191.68 670.502 1191.75C670.265 1191.82 669.99 1191.88 669.678 1191.93C669.37 1191.98 669.069 1192.02 668.776 1192.06C668.487 1192.09 668.253 1192.12 668.073 1192.14C667.637 1192.2 667.23 1192.29 666.851 1192.42C666.477 1192.54 666.174 1192.73 665.942 1192.98C665.715 1193.23 665.601 1193.56 665.601 1193.99C665.601 1194.57 665.817 1195.01 666.248 1195.31C666.683 1195.6 667.235 1195.75 667.902 1195.75ZM680.109 1201.32C679.3 1201.32 678.604 1201.21 678.021 1201.01C677.439 1200.8 676.954 1200.53 676.565 1200.2C676.182 1199.86 675.876 1199.51 675.649 1199.13L676.984 1198.19C677.136 1198.39 677.328 1198.62 677.56 1198.88C677.792 1199.14 678.109 1199.36 678.511 1199.55C678.919 1199.74 679.451 1199.84 680.109 1199.84C680.99 1199.84 681.717 1199.63 682.29 1199.2C682.863 1198.78 683.149 1198.11 683.149 1197.2V1194.98H683.007C682.884 1195.18 682.709 1195.43 682.482 1195.72C682.259 1196.01 681.937 1196.27 681.516 1196.5C681.099 1196.72 680.536 1196.83 679.825 1196.83C678.945 1196.83 678.154 1196.62 677.453 1196.2C676.757 1195.79 676.205 1195.18 675.798 1194.39C675.396 1193.59 675.195 1192.62 675.195 1191.49C675.195 1190.37 675.391 1189.4 675.784 1188.57C676.177 1187.74 676.724 1187.09 677.425 1186.64C678.125 1186.18 678.935 1185.95 679.854 1185.95C680.564 1185.95 681.127 1186.07 681.544 1186.3C681.965 1186.54 682.287 1186.8 682.51 1187.1C682.737 1187.39 682.912 1187.63 683.036 1187.82H683.206V1186.09H684.825V1197.31C684.825 1198.25 684.612 1199.01 684.186 1199.6C683.765 1200.19 683.196 1200.62 682.482 1200.9C681.771 1201.18 680.981 1201.32 680.109 1201.32ZM680.053 1195.32C680.725 1195.32 681.293 1195.17 681.757 1194.86C682.221 1194.55 682.574 1194.11 682.815 1193.53C683.057 1192.96 683.178 1192.27 683.178 1191.46C683.178 1190.67 683.059 1189.98 682.822 1189.38C682.586 1188.78 682.235 1188.31 681.771 1187.97C681.307 1187.62 680.734 1187.45 680.053 1187.45C679.342 1187.45 678.75 1187.63 678.277 1187.99C677.808 1188.35 677.455 1188.84 677.219 1189.44C676.987 1190.05 676.871 1190.72 676.871 1191.46C676.871 1192.22 676.989 1192.89 677.226 1193.47C677.467 1194.05 677.822 1194.5 678.291 1194.83C678.765 1195.16 679.352 1195.32 680.053 1195.32ZM692.467 1197.23C691.416 1197.23 690.509 1197 689.747 1196.53C688.99 1196.06 688.405 1195.41 687.993 1194.57C687.586 1193.73 687.382 1192.75 687.382 1191.63C687.382 1190.51 687.586 1189.53 687.993 1188.68C688.405 1187.82 688.978 1187.15 689.712 1186.67C690.45 1186.19 691.312 1185.95 692.297 1185.95C692.865 1185.95 693.426 1186.04 693.98 1186.23C694.534 1186.42 695.038 1186.73 695.493 1187.16C695.947 1187.58 696.31 1188.14 696.58 1188.83C696.849 1189.53 696.984 1190.39 696.984 1191.4V1192.11H688.575V1190.66H695.28C695.28 1190.05 695.157 1189.5 694.911 1189.02C694.669 1188.53 694.323 1188.15 693.874 1187.87C693.429 1187.59 692.903 1187.45 692.297 1187.45C691.629 1187.45 691.052 1187.62 690.564 1187.95C690.081 1188.28 689.709 1188.7 689.449 1189.23C689.188 1189.76 689.058 1190.32 689.058 1190.92V1191.89C689.058 1192.71 689.2 1193.41 689.484 1193.98C689.773 1194.55 690.173 1194.98 690.685 1195.28C691.196 1195.57 691.79 1195.72 692.467 1195.72C692.908 1195.72 693.305 1195.66 693.661 1195.54C694.02 1195.41 694.33 1195.22 694.591 1194.97C694.851 1194.71 695.053 1194.4 695.195 1194.02L696.814 1194.47C696.643 1195.02 696.357 1195.5 695.955 1195.92C695.552 1196.33 695.055 1196.65 694.463 1196.89C693.871 1197.11 693.206 1197.23 692.467 1197.23ZM707.261 1188.53L705.756 1188.96C705.661 1188.71 705.521 1188.47 705.337 1188.23C705.157 1187.99 704.911 1187.79 704.598 1187.63C704.286 1187.48 703.885 1187.4 703.398 1187.4C702.73 1187.4 702.174 1187.55 701.729 1187.86C701.288 1188.16 701.068 1188.55 701.068 1189.02C701.068 1189.43 701.22 1189.76 701.523 1190C701.826 1190.25 702.299 1190.45 702.943 1190.61L704.562 1191.01C705.538 1191.24 706.265 1191.6 706.743 1192.09C707.221 1192.58 707.46 1193.2 707.46 1193.96C707.46 1194.59 707.28 1195.14 706.92 1195.64C706.565 1196.13 706.068 1196.52 705.429 1196.8C704.79 1197.09 704.046 1197.23 703.199 1197.23C702.086 1197.23 701.165 1196.99 700.436 1196.5C699.707 1196.02 699.245 1195.31 699.051 1194.39L700.642 1193.99C700.794 1194.58 701.08 1195.02 701.501 1195.31C701.928 1195.6 702.484 1195.75 703.17 1195.75C703.952 1195.75 704.572 1195.58 705.031 1195.25C705.495 1194.92 705.727 1194.51 705.727 1194.05C705.727 1193.67 705.595 1193.35 705.33 1193.09C705.064 1192.83 704.657 1192.64 704.108 1192.51L702.29 1192.09C701.291 1191.85 700.557 1191.48 700.088 1190.98C699.624 1190.48 699.392 1189.86 699.392 1189.1C699.392 1188.49 699.565 1187.94 699.911 1187.47C700.261 1187 700.737 1186.62 701.338 1186.35C701.944 1186.08 702.631 1185.95 703.398 1185.95C704.477 1185.95 705.325 1186.19 705.94 1186.66C706.561 1187.13 707.001 1187.76 707.261 1188.53Z" fill="#03031C"/>
+<path d="M670.485 436.227C669.501 436.227 668.636 435.993 667.893 435.524C667.154 435.055 666.577 434.4 666.16 433.557C665.748 432.714 665.542 431.729 665.542 430.602C665.542 429.466 665.748 428.474 666.16 427.626C666.577 426.779 667.154 426.121 667.893 425.652C668.636 425.183 669.501 424.949 670.485 424.949C671.47 424.949 672.332 425.183 673.071 425.652C673.814 426.121 674.392 426.779 674.804 427.626C675.22 428.474 675.429 429.466 675.429 430.602C675.429 431.729 675.22 432.714 674.804 433.557C674.392 434.4 673.814 435.055 673.071 435.524C672.332 435.993 671.47 436.227 670.485 436.227ZM670.485 434.722C671.234 434.722 671.849 434.53 672.332 434.146C672.815 433.763 673.172 433.259 673.404 432.634C673.636 432.009 673.752 431.331 673.752 430.602C673.752 429.873 673.636 429.194 673.404 428.564C673.172 427.934 672.815 427.425 672.332 427.037C671.849 426.649 671.234 426.455 670.485 426.455C669.737 426.455 669.122 426.649 668.639 427.037C668.156 427.425 667.798 427.934 667.566 428.564C667.334 429.194 667.218 429.873 667.218 430.602C667.218 431.331 667.334 432.009 667.566 432.634C667.798 433.259 668.156 433.763 668.639 434.146C669.122 434.53 669.737 434.722 670.485 434.722ZM680.088 436L676.764 425.091H678.525L680.883 433.443H680.997L683.326 425.091H685.116L687.417 433.415H687.531L689.889 425.091H691.65L688.326 436H686.679L684.292 427.619H684.122L681.735 436H680.088ZM695.542 429.438V436H693.866V425.091H695.485V426.795H695.627C695.883 426.241 696.271 425.796 696.792 425.46C697.313 425.119 697.985 424.949 698.809 424.949C699.548 424.949 700.194 425.1 700.748 425.403C701.302 425.702 701.733 426.156 702.041 426.767C702.349 427.373 702.502 428.14 702.502 429.068V436H700.826V429.182C700.826 428.325 700.604 427.657 700.159 427.179C699.714 426.696 699.103 426.455 698.326 426.455C697.791 426.455 697.313 426.571 696.892 426.803C696.475 427.035 696.146 427.373 695.904 427.818C695.663 428.263 695.542 428.803 695.542 429.438ZM713.293 427.534L711.787 427.96C711.692 427.709 711.553 427.465 711.368 427.229C711.188 426.987 710.942 426.788 710.629 426.632C710.317 426.476 709.917 426.398 709.429 426.398C708.761 426.398 708.205 426.552 707.76 426.859C707.32 427.162 707.099 427.548 707.099 428.017C707.099 428.434 707.251 428.763 707.554 429.004C707.857 429.246 708.33 429.447 708.974 429.608L710.594 430.006C711.569 430.242 712.296 430.605 712.774 431.092C713.252 431.575 713.491 432.198 713.491 432.96C713.491 433.585 713.312 434.144 712.952 434.636C712.597 435.129 712.099 435.517 711.46 435.801C710.821 436.085 710.078 436.227 709.23 436.227C708.117 436.227 707.196 435.986 706.467 435.503C705.738 435.02 705.277 434.314 705.082 433.386L706.673 432.989C706.825 433.576 707.111 434.016 707.533 434.31C707.959 434.603 708.515 434.75 709.202 434.75C709.983 434.75 710.603 434.584 711.062 434.253C711.527 433.917 711.759 433.514 711.759 433.045C711.759 432.667 711.626 432.349 711.361 432.094C711.096 431.833 710.688 431.639 710.139 431.511L708.321 431.085C707.322 430.848 706.588 430.482 706.119 429.984C705.655 429.482 705.423 428.855 705.423 428.102C705.423 427.487 705.596 426.942 705.942 426.469C706.292 425.995 706.768 425.624 707.369 425.354C707.975 425.084 708.662 424.949 709.429 424.949C710.509 424.949 711.356 425.186 711.972 425.659C712.592 426.133 713.032 426.758 713.293 427.534Z" fill="#03031C"/>
+<path d="M834.168 421.256C833.477 421.256 832.849 421.125 832.286 420.865C831.723 420.6 831.275 420.219 830.944 419.722C830.612 419.22 830.447 418.614 830.447 417.903C830.447 417.278 830.57 416.772 830.816 416.384C831.062 415.991 831.391 415.683 831.803 415.46C832.215 415.238 832.67 415.072 833.167 414.963C833.669 414.849 834.173 414.759 834.68 414.693C835.342 414.608 835.88 414.544 836.292 414.501C836.708 414.454 837.011 414.376 837.201 414.267C837.395 414.158 837.492 413.969 837.492 413.699V413.642C837.492 412.941 837.3 412.397 836.917 412.009C836.538 411.62 835.963 411.426 835.191 411.426C834.391 411.426 833.763 411.601 833.309 411.952C832.854 412.302 832.535 412.676 832.35 413.074L830.759 412.506C831.043 411.843 831.422 411.327 831.895 410.957C832.374 410.583 832.894 410.323 833.458 410.176C834.026 410.025 834.585 409.949 835.134 409.949C835.484 409.949 835.887 409.991 836.341 410.077C836.801 410.157 837.243 410.325 837.67 410.581C838.1 410.837 838.458 411.223 838.742 411.739C839.026 412.255 839.168 412.946 839.168 413.812V421H837.492V419.523H837.407C837.293 419.759 837.104 420.013 836.839 420.283C836.573 420.553 836.221 420.782 835.78 420.972C835.34 421.161 834.803 421.256 834.168 421.256ZM834.424 419.75C835.087 419.75 835.645 419.62 836.1 419.359C836.559 419.099 836.905 418.763 837.137 418.351C837.374 417.939 837.492 417.506 837.492 417.051V415.517C837.421 415.602 837.265 415.68 837.023 415.751C836.787 415.818 836.512 415.877 836.199 415.929C835.892 415.976 835.591 416.019 835.297 416.057C835.009 416.09 834.774 416.118 834.594 416.142C834.159 416.199 833.751 416.291 833.373 416.419C832.999 416.542 832.696 416.729 832.464 416.98C832.236 417.226 832.123 417.562 832.123 417.989C832.123 418.571 832.338 419.011 832.769 419.31C833.205 419.603 833.756 419.75 834.424 419.75ZM846.659 421.227C845.637 421.227 844.756 420.986 844.017 420.503C843.279 420.02 842.71 419.355 842.313 418.507C841.915 417.66 841.716 416.691 841.716 415.602C841.716 414.494 841.92 413.517 842.327 412.669C842.739 411.817 843.312 411.152 844.046 410.673C844.784 410.19 845.646 409.949 846.631 409.949C847.398 409.949 848.089 410.091 848.705 410.375C849.32 410.659 849.825 411.057 850.218 411.568C850.61 412.08 850.854 412.676 850.949 413.358H849.273C849.145 412.861 848.861 412.42 848.421 412.037C847.985 411.649 847.398 411.455 846.659 411.455C846.006 411.455 845.433 411.625 844.941 411.966C844.453 412.302 844.072 412.778 843.797 413.393C843.527 414.004 843.392 414.722 843.392 415.545C843.392 416.388 843.525 417.122 843.79 417.747C844.06 418.372 844.439 418.857 844.926 419.203C845.419 419.549 845.996 419.722 846.659 419.722C847.095 419.722 847.49 419.646 847.845 419.494C848.2 419.343 848.501 419.125 848.747 418.841C848.994 418.557 849.169 418.216 849.273 417.818H850.949C850.854 418.462 850.62 419.042 850.246 419.558C849.877 420.07 849.387 420.477 848.776 420.78C848.17 421.078 847.464 421.227 846.659 421.227ZM857.831 421.227C856.808 421.227 855.928 420.986 855.189 420.503C854.45 420.02 853.882 419.355 853.485 418.507C853.087 417.66 852.888 416.691 852.888 415.602C852.888 414.494 853.092 413.517 853.499 412.669C853.911 411.817 854.484 411.152 855.218 410.673C855.956 410.19 856.818 409.949 857.803 409.949C858.57 409.949 859.261 410.091 859.877 410.375C860.492 410.659 860.996 411.057 861.389 411.568C861.782 412.08 862.026 412.676 862.121 413.358H860.445C860.317 412.861 860.033 412.42 859.593 412.037C859.157 411.649 858.57 411.455 857.831 411.455C857.178 411.455 856.605 411.625 856.112 411.966C855.625 412.302 855.244 412.778 854.969 413.393C854.699 414.004 854.564 414.722 854.564 415.545C854.564 416.388 854.697 417.122 854.962 417.747C855.232 418.372 855.61 418.857 856.098 419.203C856.591 419.549 857.168 419.722 857.831 419.722C858.267 419.722 858.662 419.646 859.017 419.494C859.372 419.343 859.673 419.125 859.919 418.841C860.165 418.557 860.341 418.216 860.445 417.818H862.121C862.026 418.462 861.792 419.042 861.418 419.558C861.048 420.07 860.558 420.477 859.948 420.78C859.342 421.078 858.636 421.227 857.831 421.227ZM869.145 421.227C868.094 421.227 867.187 420.995 866.425 420.531C865.667 420.062 865.083 419.409 864.671 418.571C864.263 417.728 864.06 416.748 864.06 415.631C864.06 414.513 864.263 413.528 864.671 412.676C865.083 411.819 865.655 411.152 866.389 410.673C867.128 410.19 867.99 409.949 868.975 409.949C869.543 409.949 870.104 410.044 870.658 410.233C871.212 410.422 871.716 410.73 872.171 411.156C872.625 411.578 872.987 412.136 873.257 412.832C873.527 413.528 873.662 414.385 873.662 415.403V416.114H865.253V414.665H871.958C871.958 414.049 871.834 413.5 871.588 413.017C871.347 412.534 871.001 412.153 870.551 411.874C870.106 411.594 869.581 411.455 868.975 411.455C868.307 411.455 867.729 411.62 867.242 411.952C866.759 412.278 866.387 412.705 866.127 413.23C865.866 413.756 865.736 414.319 865.736 414.92V415.886C865.736 416.71 865.878 417.409 866.162 417.982C866.451 418.55 866.851 418.983 867.362 419.281C867.874 419.575 868.468 419.722 869.145 419.722C869.585 419.722 869.983 419.66 870.338 419.537C870.698 419.409 871.008 419.22 871.269 418.969C871.529 418.713 871.73 418.396 871.872 418.017L873.492 418.472C873.321 419.021 873.035 419.504 872.632 419.92C872.23 420.332 871.733 420.654 871.141 420.886C870.549 421.114 869.884 421.227 869.145 421.227ZM883.939 412.534L882.433 412.96C882.339 412.709 882.199 412.465 882.014 412.229C881.834 411.987 881.588 411.788 881.276 411.632C880.963 411.476 880.563 411.398 880.075 411.398C879.408 411.398 878.852 411.552 878.406 411.859C877.966 412.162 877.746 412.548 877.746 413.017C877.746 413.434 877.897 413.763 878.2 414.004C878.503 414.246 878.977 414.447 879.621 414.608L881.24 415.006C882.216 415.242 882.942 415.605 883.421 416.092C883.899 416.575 884.138 417.198 884.138 417.96C884.138 418.585 883.958 419.144 883.598 419.636C883.243 420.129 882.746 420.517 882.107 420.801C881.468 421.085 880.724 421.227 879.877 421.227C878.764 421.227 877.843 420.986 877.114 420.503C876.385 420.02 875.923 419.314 875.729 418.386L877.32 417.989C877.471 418.576 877.758 419.016 878.179 419.31C878.605 419.603 879.162 419.75 879.848 419.75C880.629 419.75 881.25 419.584 881.709 419.253C882.173 418.917 882.405 418.514 882.405 418.045C882.405 417.667 882.272 417.349 882.007 417.094C881.742 416.833 881.335 416.639 880.786 416.511L878.968 416.085C877.968 415.848 877.235 415.482 876.766 414.984C876.302 414.482 876.07 413.855 876.07 413.102C876.07 412.487 876.243 411.942 876.588 411.469C876.939 410.995 877.414 410.624 878.016 410.354C878.622 410.084 879.308 409.949 880.075 409.949C881.155 409.949 882.003 410.186 882.618 410.659C883.238 411.133 883.679 411.758 883.939 412.534ZM894.388 412.534L892.883 412.96C892.788 412.709 892.648 412.465 892.464 412.229C892.284 411.987 892.037 411.788 891.725 411.632C891.412 411.476 891.012 411.398 890.525 411.398C889.857 411.398 889.301 411.552 888.856 411.859C888.415 412.162 888.195 412.548 888.195 413.017C888.195 413.434 888.347 413.763 888.65 414.004C888.953 414.246 889.426 414.447 890.07 414.608L891.689 415.006C892.665 415.242 893.392 415.605 893.87 416.092C894.348 416.575 894.587 417.198 894.587 417.96C894.587 418.585 894.407 419.144 894.047 419.636C893.692 420.129 893.195 420.517 892.556 420.801C891.917 421.085 891.173 421.227 890.326 421.227C889.213 421.227 888.292 420.986 887.563 420.503C886.834 420.02 886.372 419.314 886.178 418.386L887.769 417.989C887.921 418.576 888.207 419.016 888.628 419.31C889.055 419.603 889.611 419.75 890.297 419.75C891.079 419.75 891.699 419.584 892.158 419.253C892.622 418.917 892.854 418.514 892.854 418.045C892.854 417.667 892.722 417.349 892.456 417.094C892.191 416.833 891.784 416.639 891.235 416.511L889.417 416.085C888.418 415.848 887.684 415.482 887.215 414.984C886.751 414.482 886.519 413.855 886.519 413.102C886.519 412.487 886.692 411.942 887.037 411.469C887.388 410.995 887.864 410.624 888.465 410.354C889.071 410.084 889.758 409.949 890.525 409.949C891.604 409.949 892.452 410.186 893.067 410.659C893.688 411.133 894.128 411.758 894.388 412.534ZM835.868 451.227C834.959 451.227 834.157 450.998 833.461 450.538C832.765 450.074 832.22 449.421 831.827 448.578C831.434 447.731 831.238 446.729 831.238 445.574C831.238 444.428 831.434 443.434 831.827 442.591C832.22 441.748 832.767 441.097 833.468 440.638C834.168 440.179 834.978 439.949 835.897 439.949C836.607 439.949 837.168 440.067 837.58 440.304C837.997 440.536 838.314 440.801 838.532 441.099C838.754 441.393 838.927 441.634 839.05 441.824H839.192V436.455H840.868V451H839.249V449.324H839.05C838.927 449.523 838.752 449.774 838.525 450.077C838.297 450.375 837.973 450.643 837.551 450.879C837.13 451.111 836.569 451.227 835.868 451.227ZM836.096 449.722C836.768 449.722 837.336 449.546 837.8 449.196C838.264 448.841 838.617 448.351 838.858 447.726C839.1 447.096 839.221 446.369 839.221 445.545C839.221 444.731 839.102 444.018 838.865 443.408C838.629 442.792 838.278 442.314 837.814 441.973C837.35 441.627 836.777 441.455 836.096 441.455C835.385 441.455 834.793 441.637 834.32 442.001C833.851 442.361 833.498 442.851 833.262 443.472C833.03 444.087 832.914 444.778 832.914 445.545C832.914 446.322 833.032 447.027 833.269 447.662C833.51 448.292 833.865 448.794 834.334 449.168C834.808 449.537 835.395 449.722 836.096 449.722ZM848.745 451.227C847.694 451.227 846.787 450.995 846.025 450.531C845.267 450.062 844.682 449.409 844.27 448.571C843.863 447.728 843.659 446.748 843.659 445.631C843.659 444.513 843.863 443.528 844.27 442.676C844.682 441.819 845.255 441.152 845.989 440.673C846.728 440.19 847.589 439.949 848.574 439.949C849.142 439.949 849.703 440.044 850.257 440.233C850.811 440.422 851.316 440.73 851.77 441.156C852.225 441.578 852.587 442.136 852.857 442.832C853.127 443.528 853.262 444.385 853.262 445.403V446.114H844.853V444.665H851.557C851.557 444.049 851.434 443.5 851.188 443.017C850.946 442.534 850.601 442.153 850.151 441.874C849.706 441.594 849.18 441.455 848.574 441.455C847.907 441.455 847.329 441.62 846.841 441.952C846.358 442.278 845.987 442.705 845.726 443.23C845.466 443.756 845.336 444.319 845.336 444.92V445.886C845.336 446.71 845.478 447.409 845.762 447.982C846.051 448.55 846.451 448.983 846.962 449.281C847.473 449.575 848.068 449.722 848.745 449.722C849.185 449.722 849.583 449.66 849.938 449.537C850.298 449.409 850.608 449.22 850.868 448.969C851.129 448.713 851.33 448.396 851.472 448.017L853.091 448.472C852.921 449.021 852.634 449.504 852.232 449.92C851.829 450.332 851.332 450.654 850.74 450.886C850.149 451.114 849.483 451.227 848.745 451.227ZM857.488 444.438V451H855.811V440.091H857.431V441.795H857.573C857.828 441.241 858.217 440.796 858.738 440.46C859.258 440.119 859.931 439.949 860.755 439.949C861.493 439.949 862.14 440.1 862.694 440.403C863.248 440.702 863.678 441.156 863.986 441.767C864.294 442.373 864.448 443.14 864.448 444.068V451H862.772V444.182C862.772 443.325 862.549 442.657 862.104 442.179C861.659 441.696 861.048 441.455 860.272 441.455C859.737 441.455 859.258 441.571 858.837 441.803C858.42 442.035 858.091 442.373 857.85 442.818C857.608 443.263 857.488 443.803 857.488 444.438ZM867.511 451V440.091H869.187V451H867.511ZM868.363 438.273C868.036 438.273 867.754 438.161 867.518 437.939C867.286 437.716 867.17 437.449 867.17 437.136C867.17 436.824 867.286 436.556 867.518 436.334C867.754 436.111 868.036 436 868.363 436C868.69 436 868.969 436.111 869.201 436.334C869.438 436.556 869.556 436.824 869.556 437.136C869.556 437.449 869.438 437.716 869.201 437.939C868.969 438.161 868.69 438.273 868.363 438.273ZM876.831 451.227C875.779 451.227 874.873 450.995 874.11 450.531C873.353 450.062 872.768 449.409 872.356 448.571C871.949 447.728 871.745 446.748 871.745 445.631C871.745 444.513 871.949 443.528 872.356 442.676C872.768 441.819 873.341 441.152 874.075 440.673C874.814 440.19 875.675 439.949 876.66 439.949C877.228 439.949 877.789 440.044 878.343 440.233C878.897 440.422 879.402 440.73 879.856 441.156C880.311 441.578 880.673 442.136 880.943 442.832C881.213 443.528 881.348 444.385 881.348 445.403V446.114H872.939V444.665H879.643C879.643 444.049 879.52 443.5 879.274 443.017C879.032 442.534 878.687 442.153 878.237 441.874C877.792 441.594 877.266 441.455 876.66 441.455C875.993 441.455 875.415 441.62 874.927 441.952C874.444 442.278 874.073 442.705 873.812 443.23C873.552 443.756 873.422 444.319 873.422 444.92V445.886C873.422 446.71 873.564 447.409 873.848 447.982C874.136 448.55 874.537 448.983 875.048 449.281C875.559 449.575 876.154 449.722 876.831 449.722C877.271 449.722 877.669 449.66 878.024 449.537C878.384 449.409 878.694 449.22 878.954 448.969C879.215 448.713 879.416 448.396 879.558 448.017L881.177 448.472C881.007 449.021 880.72 449.504 880.318 449.92C879.915 450.332 879.418 450.654 878.826 450.886C878.234 451.114 877.569 451.227 876.831 451.227ZM888.017 451.227C887.108 451.227 886.305 450.998 885.609 450.538C884.913 450.074 884.368 449.421 883.975 448.578C883.583 447.731 883.386 446.729 883.386 445.574C883.386 444.428 883.583 443.434 883.975 442.591C884.368 441.748 884.915 441.097 885.616 440.638C886.317 440.179 887.127 439.949 888.045 439.949C888.755 439.949 889.316 440.067 889.728 440.304C890.145 440.536 890.462 440.801 890.68 441.099C890.903 441.393 891.075 441.634 891.199 441.824H891.341V436.455H893.017V451H891.397V449.324H891.199C891.075 449.523 890.9 449.774 890.673 450.077C890.446 450.375 890.121 450.643 889.7 450.879C889.279 451.111 888.717 451.227 888.017 451.227ZM888.244 449.722C888.916 449.722 889.484 449.546 889.949 449.196C890.413 448.841 890.765 448.351 891.007 447.726C891.248 447.096 891.369 446.369 891.369 445.545C891.369 444.731 891.251 444.018 891.014 443.408C890.777 442.792 890.427 442.314 889.963 441.973C889.499 441.627 888.926 441.455 888.244 441.455C887.534 441.455 886.942 441.637 886.468 442.001C886 442.361 885.647 442.851 885.41 443.472C885.178 444.087 885.062 444.778 885.062 445.545C885.062 446.322 885.181 447.027 885.417 447.662C885.659 448.292 886.014 448.794 886.483 449.168C886.956 449.537 887.543 449.722 888.244 449.722Z" fill="#EA26A9"/>
+<path d="M1066.49 436.227C1065.5 436.227 1064.64 435.993 1063.89 435.524C1063.15 435.055 1062.58 434.4 1062.16 433.557C1061.75 432.714 1061.54 431.729 1061.54 430.602C1061.54 429.466 1061.75 428.474 1062.16 427.626C1062.58 426.779 1063.15 426.121 1063.89 425.652C1064.64 425.183 1065.5 424.949 1066.49 424.949C1067.47 424.949 1068.33 425.183 1069.07 425.652C1069.81 426.121 1070.39 426.779 1070.8 427.626C1071.22 428.474 1071.43 429.466 1071.43 430.602C1071.43 431.729 1071.22 432.714 1070.8 433.557C1070.39 434.4 1069.81 435.055 1069.07 435.524C1068.33 435.993 1067.47 436.227 1066.49 436.227ZM1066.49 434.722C1067.23 434.722 1067.85 434.53 1068.33 434.146C1068.81 433.763 1069.17 433.259 1069.4 432.634C1069.64 432.009 1069.75 431.331 1069.75 430.602C1069.75 429.873 1069.64 429.194 1069.4 428.564C1069.17 427.934 1068.81 427.425 1068.33 427.037C1067.85 426.649 1067.23 426.455 1066.49 426.455C1065.74 426.455 1065.12 426.649 1064.64 427.037C1064.16 427.425 1063.8 427.934 1063.57 428.564C1063.33 429.194 1063.22 429.873 1063.22 430.602C1063.22 431.331 1063.33 432.009 1063.57 432.634C1063.8 433.259 1064.16 433.763 1064.64 434.146C1065.12 434.53 1065.74 434.722 1066.49 434.722ZM1076.09 436L1072.76 425.091H1074.53L1076.88 433.443H1077L1079.33 425.091H1081.12L1083.42 433.415H1083.53L1085.89 425.091H1087.65L1084.33 436H1082.68L1080.29 427.619H1080.12L1077.74 436H1076.09ZM1091.54 429.438V436H1089.87V425.091H1091.49V426.795H1091.63C1091.88 426.241 1092.27 425.796 1092.79 425.46C1093.31 425.119 1093.99 424.949 1094.81 424.949C1095.55 424.949 1096.19 425.1 1096.75 425.403C1097.3 425.702 1097.73 426.156 1098.04 426.767C1098.35 427.373 1098.5 428.14 1098.5 429.068V436H1096.83V429.182C1096.83 428.325 1096.6 427.657 1096.16 427.179C1095.71 426.696 1095.1 426.455 1094.33 426.455C1093.79 426.455 1093.31 426.571 1092.89 426.803C1092.48 427.035 1092.15 427.373 1091.9 427.818C1091.66 428.263 1091.54 428.803 1091.54 429.438ZM1109.29 427.534L1107.79 427.96C1107.69 427.709 1107.55 427.465 1107.37 427.229C1107.19 426.987 1106.94 426.788 1106.63 426.632C1106.32 426.476 1105.92 426.398 1105.43 426.398C1104.76 426.398 1104.21 426.552 1103.76 426.859C1103.32 427.162 1103.1 427.548 1103.1 428.017C1103.1 428.434 1103.25 428.763 1103.55 429.004C1103.86 429.246 1104.33 429.447 1104.97 429.608L1106.59 430.006C1107.57 430.242 1108.3 430.605 1108.77 431.092C1109.25 431.575 1109.49 432.198 1109.49 432.96C1109.49 433.585 1109.31 434.144 1108.95 434.636C1108.6 435.129 1108.1 435.517 1107.46 435.801C1106.82 436.085 1106.08 436.227 1105.23 436.227C1104.12 436.227 1103.2 435.986 1102.47 435.503C1101.74 435.02 1101.28 434.314 1101.08 433.386L1102.67 432.989C1102.82 433.576 1103.11 434.016 1103.53 434.31C1103.96 434.603 1104.52 434.75 1105.2 434.75C1105.98 434.75 1106.6 434.584 1107.06 434.253C1107.53 433.917 1107.76 433.514 1107.76 433.045C1107.76 432.667 1107.63 432.349 1107.36 432.094C1107.1 431.833 1106.69 431.639 1106.14 431.511L1104.32 431.085C1103.32 430.848 1102.59 430.482 1102.12 429.984C1101.66 429.482 1101.42 428.855 1101.42 428.102C1101.42 427.487 1101.6 426.942 1101.94 426.469C1102.29 425.995 1102.77 425.624 1103.37 425.354C1103.98 425.084 1104.66 424.949 1105.43 424.949C1106.51 424.949 1107.36 425.186 1107.97 425.659C1108.59 426.133 1109.03 426.758 1109.29 427.534Z" fill="#03031C"/>
+<path d="M850.633 1343L847.309 1332.09H849.07L851.428 1340.44H851.542L853.871 1332.09H855.661L857.962 1340.41H858.076L860.434 1332.09H862.195L858.871 1343H857.224L854.837 1334.62H854.667L852.28 1343H850.633ZM867.621 1343.26C866.93 1343.26 866.303 1343.13 865.739 1342.87C865.176 1342.6 864.728 1342.22 864.397 1341.72C864.065 1341.22 863.9 1340.61 863.9 1339.9C863.9 1339.28 864.023 1338.77 864.269 1338.38C864.515 1337.99 864.844 1337.68 865.256 1337.46C865.668 1337.24 866.123 1337.07 866.62 1336.96C867.122 1336.85 867.626 1336.76 868.133 1336.69C868.796 1336.61 869.333 1336.54 869.745 1336.5C870.162 1336.45 870.465 1336.38 870.654 1336.27C870.848 1336.16 870.945 1335.97 870.945 1335.7V1335.64C870.945 1334.94 870.753 1334.4 870.37 1334.01C869.991 1333.62 869.416 1333.43 868.644 1333.43C867.844 1333.43 867.216 1333.6 866.762 1333.95C866.307 1334.3 865.988 1334.68 865.803 1335.07L864.212 1334.51C864.496 1333.84 864.875 1333.33 865.349 1332.96C865.827 1332.58 866.348 1332.32 866.911 1332.18C867.479 1332.02 868.038 1331.95 868.587 1331.95C868.938 1331.95 869.34 1331.99 869.795 1332.08C870.254 1332.16 870.697 1332.33 871.123 1332.58C871.554 1332.84 871.911 1333.22 872.195 1333.74C872.479 1334.25 872.621 1334.95 872.621 1335.81V1343H870.945V1341.52H870.86C870.746 1341.76 870.557 1342.01 870.292 1342.28C870.027 1342.55 869.674 1342.78 869.233 1342.97C868.793 1343.16 868.256 1343.26 867.621 1343.26ZM867.877 1341.75C868.54 1341.75 869.099 1341.62 869.553 1341.36C870.012 1341.1 870.358 1340.76 870.59 1340.35C870.827 1339.94 870.945 1339.51 870.945 1339.05V1337.52C870.874 1337.6 870.718 1337.68 870.476 1337.75C870.24 1337.82 869.965 1337.88 869.653 1337.93C869.345 1337.98 869.044 1338.02 868.751 1338.06C868.462 1338.09 868.227 1338.12 868.047 1338.14C867.612 1338.2 867.205 1338.29 866.826 1338.42C866.452 1338.54 866.149 1338.73 865.917 1338.98C865.689 1339.23 865.576 1339.56 865.576 1339.99C865.576 1340.57 865.791 1341.01 866.222 1341.31C866.658 1341.6 867.209 1341.75 867.877 1341.75ZM880.425 1332.09V1333.51H874.771V1332.09H880.425ZM876.419 1329.48H878.095V1339.88C878.095 1340.35 878.164 1340.7 878.301 1340.94C878.443 1341.17 878.623 1341.33 878.841 1341.41C879.064 1341.48 879.298 1341.52 879.544 1341.52C879.729 1341.52 879.88 1341.51 879.999 1341.49C880.117 1341.47 880.212 1341.45 880.283 1341.44L880.624 1342.94C880.51 1342.99 880.352 1343.03 880.148 1343.07C879.944 1343.12 879.686 1343.14 879.374 1343.14C878.9 1343.14 878.436 1343.04 877.982 1342.84C877.532 1342.63 877.158 1342.32 876.86 1341.91C876.566 1341.49 876.419 1340.96 876.419 1340.33V1329.48ZM887.261 1343.23C886.238 1343.23 885.357 1342.99 884.619 1342.5C883.88 1342.02 883.312 1341.35 882.914 1340.51C882.517 1339.66 882.318 1338.69 882.318 1337.6C882.318 1336.49 882.521 1335.52 882.928 1334.67C883.34 1333.82 883.913 1333.15 884.647 1332.67C885.386 1332.19 886.248 1331.95 887.232 1331.95C887.999 1331.95 888.691 1332.09 889.306 1332.38C889.922 1332.66 890.426 1333.06 890.819 1333.57C891.212 1334.08 891.456 1334.68 891.551 1335.36H889.874C889.747 1334.86 889.463 1334.42 889.022 1334.04C888.587 1333.65 887.999 1333.45 887.261 1333.45C886.607 1333.45 886.035 1333.62 885.542 1333.97C885.054 1334.3 884.673 1334.78 884.399 1335.39C884.129 1336 883.994 1336.72 883.994 1337.55C883.994 1338.39 884.126 1339.12 884.392 1339.75C884.661 1340.37 885.04 1340.86 885.528 1341.2C886.02 1341.55 886.598 1341.72 887.261 1341.72C887.696 1341.72 888.092 1341.65 888.447 1341.49C888.802 1341.34 889.103 1341.12 889.349 1340.84C889.595 1340.56 889.77 1340.22 889.874 1339.82H891.551C891.456 1340.46 891.222 1341.04 890.847 1341.56C890.478 1342.07 889.988 1342.48 889.377 1342.78C888.771 1343.08 888.066 1343.23 887.261 1343.23ZM895.677 1336.44V1343H894.001V1328.45H895.677V1333.8H895.819C896.075 1333.23 896.458 1332.78 896.97 1332.45C897.486 1332.12 898.172 1331.95 899.029 1331.95C899.773 1331.95 900.424 1332.1 900.982 1332.4C901.541 1332.69 901.974 1333.14 902.282 1333.75C902.595 1334.36 902.751 1335.13 902.751 1336.07V1343H901.075V1336.18C901.075 1335.32 900.85 1334.65 900.4 1334.17C899.955 1333.69 899.337 1333.45 898.546 1333.45C897.997 1333.45 897.505 1333.57 897.069 1333.8C896.638 1334.03 896.297 1334.37 896.046 1334.82C895.8 1335.26 895.677 1335.8 895.677 1336.44ZM910.391 1343.23C909.34 1343.23 908.433 1343 907.671 1342.53C906.913 1342.06 906.329 1341.41 905.917 1340.57C905.51 1339.73 905.306 1338.75 905.306 1337.63C905.306 1336.51 905.51 1335.53 905.917 1334.68C906.329 1333.82 906.902 1333.15 907.635 1332.67C908.374 1332.19 909.236 1331.95 910.221 1331.95C910.789 1331.95 911.35 1332.04 911.904 1332.23C912.458 1332.42 912.962 1332.73 913.417 1333.16C913.871 1333.58 914.233 1334.14 914.503 1334.83C914.773 1335.53 914.908 1336.39 914.908 1337.4V1338.11H906.499V1336.66H913.204C913.204 1336.05 913.081 1335.5 912.834 1335.02C912.593 1334.53 912.247 1334.15 911.797 1333.87C911.352 1333.59 910.827 1333.45 910.221 1333.45C909.553 1333.45 908.975 1333.62 908.488 1333.95C908.005 1334.28 907.633 1334.7 907.373 1335.23C907.112 1335.76 906.982 1336.32 906.982 1336.92V1337.89C906.982 1338.71 907.124 1339.41 907.408 1339.98C907.697 1340.55 908.097 1340.98 908.608 1341.28C909.12 1341.57 909.714 1341.72 910.391 1341.72C910.831 1341.72 911.229 1341.66 911.584 1341.54C911.944 1341.41 912.254 1341.22 912.515 1340.97C912.775 1340.71 912.976 1340.4 913.118 1340.02L914.738 1340.47C914.567 1341.02 914.281 1341.5 913.878 1341.92C913.476 1342.33 912.979 1342.65 912.387 1342.89C911.795 1343.11 911.13 1343.23 910.391 1343.23ZM925.185 1334.53L923.68 1334.96C923.585 1334.71 923.445 1334.47 923.26 1334.23C923.081 1333.99 922.834 1333.79 922.522 1333.63C922.209 1333.48 921.809 1333.4 921.322 1333.4C920.654 1333.4 920.098 1333.55 919.653 1333.86C919.212 1334.16 918.992 1334.55 918.992 1335.02C918.992 1335.43 919.144 1335.76 919.447 1336C919.75 1336.25 920.223 1336.45 920.867 1336.61L922.486 1337.01C923.462 1337.24 924.189 1337.6 924.667 1338.09C925.145 1338.58 925.384 1339.2 925.384 1339.96C925.384 1340.59 925.204 1341.14 924.844 1341.64C924.489 1342.13 923.992 1342.52 923.353 1342.8C922.714 1343.09 921.97 1343.23 921.123 1343.23C920.01 1343.23 919.089 1342.99 918.36 1342.5C917.631 1342.02 917.169 1341.31 916.975 1340.39L918.566 1339.99C918.717 1340.58 919.004 1341.02 919.425 1341.31C919.851 1341.6 920.408 1341.75 921.094 1341.75C921.876 1341.75 922.496 1341.58 922.955 1341.25C923.419 1340.92 923.651 1340.51 923.651 1340.05C923.651 1339.67 923.519 1339.35 923.253 1339.09C922.988 1338.83 922.581 1338.64 922.032 1338.51L920.214 1338.09C919.215 1337.85 918.481 1337.48 918.012 1336.98C917.548 1336.48 917.316 1335.86 917.316 1335.1C917.316 1334.49 917.489 1333.94 917.834 1333.47C918.185 1333 918.661 1332.62 919.262 1332.35C919.868 1332.08 920.555 1331.95 921.322 1331.95C922.401 1331.95 923.249 1332.19 923.864 1332.66C924.484 1333.13 924.925 1333.76 925.185 1334.53Z" fill="#03031C"/>
+<path d="M636.056 1351V1340.09H637.675V1341.74H637.789C637.987 1341.2 638.347 1340.76 638.868 1340.42C639.389 1340.09 639.976 1339.92 640.629 1339.92C640.753 1339.92 640.906 1339.92 641.091 1339.93C641.276 1339.93 641.415 1339.94 641.51 1339.95V1341.65C641.453 1341.64 641.323 1341.62 641.119 1341.59C640.921 1341.56 640.71 1341.54 640.487 1341.54C639.957 1341.54 639.484 1341.65 639.067 1341.87C638.655 1342.09 638.328 1342.39 638.087 1342.78C637.85 1343.17 637.732 1343.6 637.732 1344.1V1351H636.056ZM647.739 1351.23C646.688 1351.23 645.781 1351 645.019 1350.53C644.261 1350.06 643.676 1349.41 643.264 1348.57C642.857 1347.73 642.654 1346.75 642.654 1345.63C642.654 1344.51 642.857 1343.53 643.264 1342.68C643.676 1341.82 644.249 1341.15 644.983 1340.67C645.722 1340.19 646.584 1339.95 647.568 1339.95C648.137 1339.95 648.698 1340.04 649.252 1340.23C649.806 1340.42 650.31 1340.73 650.764 1341.16C651.219 1341.58 651.581 1342.14 651.851 1342.83C652.121 1343.53 652.256 1344.39 652.256 1345.4V1346.11H643.847V1344.66H650.551C650.551 1344.05 650.428 1343.5 650.182 1343.02C649.941 1342.53 649.595 1342.15 649.145 1341.87C648.7 1341.59 648.174 1341.45 647.568 1341.45C646.901 1341.45 646.323 1341.62 645.835 1341.95C645.352 1342.28 644.981 1342.7 644.72 1343.23C644.46 1343.76 644.33 1344.32 644.33 1344.92V1345.89C644.33 1346.71 644.472 1347.41 644.756 1347.98C645.045 1348.55 645.445 1348.98 645.956 1349.28C646.468 1349.57 647.062 1349.72 647.739 1349.72C648.179 1349.72 648.577 1349.66 648.932 1349.54C649.292 1349.41 649.602 1349.22 649.862 1348.97C650.123 1348.71 650.324 1348.4 650.466 1348.02L652.085 1348.47C651.915 1349.02 651.628 1349.5 651.226 1349.92C650.824 1350.33 650.326 1350.65 649.735 1350.89C649.143 1351.11 648.477 1351.23 647.739 1351.23ZM659.664 1340.09V1341.51H653.783V1340.09H659.664ZM655.544 1351V1338.59C655.544 1337.96 655.691 1337.44 655.985 1337.02C656.278 1336.61 656.659 1336.29 657.128 1336.09C657.597 1335.88 658.092 1335.77 658.612 1335.77C659.024 1335.77 659.36 1335.81 659.621 1335.87C659.881 1335.94 660.075 1336 660.203 1336.06L659.72 1337.51C659.635 1337.48 659.517 1337.44 659.365 1337.4C659.218 1337.36 659.024 1337.34 658.783 1337.34C658.229 1337.34 657.829 1337.47 657.583 1337.75C657.341 1338.03 657.22 1338.44 657.22 1338.98V1351H655.544Z" fill="#03031C"/>
+<path d="M769.207 1310.79C768.817 1310.4 768.183 1310.4 767.793 1310.79L761.429 1317.16C761.038 1317.55 761.038 1318.18 761.429 1318.57C761.819 1318.96 762.453 1318.96 762.843 1318.57L768.5 1312.91L774.157 1318.57C774.547 1318.96 775.181 1318.96 775.571 1318.57C775.962 1318.18 775.962 1317.55 775.571 1317.16L769.207 1310.79ZM767.5 1358.12V1363.84H769.5V1358.12H767.5ZM767.5 1375.28V1381H769.5V1375.28H767.5ZM767.5 1311.5V1316.5H769.5V1311.5H767.5ZM767.5 1326.5V1331.5H769.5V1326.5H767.5Z" fill="#03031C"/>
+<path d="M757.056 1351V1340.09H758.675V1341.74H758.789C758.987 1341.2 759.347 1340.76 759.868 1340.42C760.389 1340.09 760.976 1339.92 761.629 1339.92C761.753 1339.92 761.906 1339.92 762.091 1339.93C762.276 1339.93 762.415 1339.94 762.51 1339.95V1341.65C762.453 1341.64 762.323 1341.62 762.119 1341.59C761.921 1341.56 761.71 1341.54 761.487 1341.54C760.957 1341.54 760.484 1341.65 760.067 1341.87C759.655 1342.09 759.328 1342.39 759.087 1342.78C758.85 1343.17 758.732 1343.6 758.732 1344.1V1351H757.056ZM768.739 1351.23C767.688 1351.23 766.781 1351 766.019 1350.53C765.261 1350.06 764.676 1349.41 764.264 1348.57C763.857 1347.73 763.654 1346.75 763.654 1345.63C763.654 1344.51 763.857 1343.53 764.264 1342.68C764.676 1341.82 765.249 1341.15 765.983 1340.67C766.722 1340.19 767.584 1339.95 768.568 1339.95C769.137 1339.95 769.698 1340.04 770.252 1340.23C770.806 1340.42 771.31 1340.73 771.764 1341.16C772.219 1341.58 772.581 1342.14 772.851 1342.83C773.121 1343.53 773.256 1344.39 773.256 1345.4V1346.11H764.847V1344.66H771.551C771.551 1344.05 771.428 1343.5 771.182 1343.02C770.941 1342.53 770.595 1342.15 770.145 1341.87C769.7 1341.59 769.174 1341.45 768.568 1341.45C767.901 1341.45 767.323 1341.62 766.835 1341.95C766.352 1342.28 765.981 1342.7 765.72 1343.23C765.46 1343.76 765.33 1344.32 765.33 1344.92V1345.89C765.33 1346.71 765.472 1347.41 765.756 1347.98C766.045 1348.55 766.445 1348.98 766.956 1349.28C767.468 1349.57 768.062 1349.72 768.739 1349.72C769.179 1349.72 769.577 1349.66 769.932 1349.54C770.292 1349.41 770.602 1349.22 770.862 1348.97C771.123 1348.71 771.324 1348.4 771.466 1348.02L773.085 1348.47C772.915 1349.02 772.628 1349.5 772.226 1349.92C771.824 1350.33 771.326 1350.65 770.735 1350.89C770.143 1351.11 769.477 1351.23 768.739 1351.23ZM780.664 1340.09V1341.51H774.783V1340.09H780.664ZM776.544 1351V1338.59C776.544 1337.96 776.691 1337.44 776.985 1337.02C777.278 1336.61 777.659 1336.29 778.128 1336.09C778.597 1335.88 779.092 1335.77 779.612 1335.77C780.024 1335.77 780.36 1335.81 780.621 1335.87C780.881 1335.94 781.075 1336 781.203 1336.06L780.72 1337.51C780.635 1337.48 780.517 1337.44 780.365 1337.4C780.218 1337.36 780.024 1337.34 779.783 1337.34C779.229 1337.34 778.829 1337.47 778.583 1337.75C778.341 1338.03 778.22 1338.44 778.22 1338.98V1351H776.544Z" fill="#03031C"/>
+<path d="M1008.21 1310.79C1007.82 1310.4 1007.18 1310.4 1006.79 1310.79L1000.43 1317.16C1000.04 1317.55 1000.04 1318.18 1000.43 1318.57C1000.82 1318.96 1001.45 1318.96 1001.84 1318.57L1007.5 1312.91L1013.16 1318.57C1013.55 1318.96 1014.18 1318.96 1014.57 1318.57C1014.96 1318.18 1014.96 1317.55 1014.57 1317.16L1008.21 1310.79ZM1006.5 1358.12V1363.84H1008.5V1358.12H1006.5ZM1006.5 1375.28V1381H1008.5V1375.28H1006.5ZM1006.5 1311.5V1316.5H1008.5V1311.5H1006.5ZM1006.5 1326.5V1331.5H1008.5V1326.5H1006.5Z" fill="#03031C"/>
+<path d="M996.056 1351V1340.09H997.675V1341.74H997.789C997.987 1341.2 998.347 1340.76 998.868 1340.42C999.389 1340.09 999.976 1339.92 1000.63 1339.92C1000.75 1339.92 1000.91 1339.92 1001.09 1339.93C1001.28 1339.93 1001.42 1339.94 1001.51 1339.95V1341.65C1001.45 1341.64 1001.32 1341.62 1001.12 1341.59C1000.92 1341.56 1000.71 1341.54 1000.49 1341.54C999.957 1341.54 999.484 1341.65 999.067 1341.87C998.655 1342.09 998.328 1342.39 998.087 1342.78C997.85 1343.17 997.732 1343.6 997.732 1344.1V1351H996.056ZM1007.74 1351.23C1006.69 1351.23 1005.78 1351 1005.02 1350.53C1004.26 1350.06 1003.68 1349.41 1003.26 1348.57C1002.86 1347.73 1002.65 1346.75 1002.65 1345.63C1002.65 1344.51 1002.86 1343.53 1003.26 1342.68C1003.68 1341.82 1004.25 1341.15 1004.98 1340.67C1005.72 1340.19 1006.58 1339.95 1007.57 1339.95C1008.14 1339.95 1008.7 1340.04 1009.25 1340.23C1009.81 1340.42 1010.31 1340.73 1010.76 1341.16C1011.22 1341.58 1011.58 1342.14 1011.85 1342.83C1012.12 1343.53 1012.26 1344.39 1012.26 1345.4V1346.11H1003.85V1344.66H1010.55C1010.55 1344.05 1010.43 1343.5 1010.18 1343.02C1009.94 1342.53 1009.59 1342.15 1009.15 1341.87C1008.7 1341.59 1008.17 1341.45 1007.57 1341.45C1006.9 1341.45 1006.32 1341.62 1005.84 1341.95C1005.35 1342.28 1004.98 1342.7 1004.72 1343.23C1004.46 1343.76 1004.33 1344.32 1004.33 1344.92V1345.89C1004.33 1346.71 1004.47 1347.41 1004.76 1347.98C1005.04 1348.55 1005.44 1348.98 1005.96 1349.28C1006.47 1349.57 1007.06 1349.72 1007.74 1349.72C1008.18 1349.72 1008.58 1349.66 1008.93 1349.54C1009.29 1349.41 1009.6 1349.22 1009.86 1348.97C1010.12 1348.71 1010.32 1348.4 1010.47 1348.02L1012.09 1348.47C1011.91 1349.02 1011.63 1349.5 1011.23 1349.92C1010.82 1350.33 1010.33 1350.65 1009.73 1350.89C1009.14 1351.11 1008.48 1351.23 1007.74 1351.23ZM1019.66 1340.09V1341.51H1013.78V1340.09H1019.66ZM1015.54 1351V1338.59C1015.54 1337.96 1015.69 1337.44 1015.98 1337.02C1016.28 1336.61 1016.66 1336.29 1017.13 1336.09C1017.6 1335.88 1018.09 1335.77 1018.61 1335.77C1019.02 1335.77 1019.36 1335.81 1019.62 1335.87C1019.88 1335.94 1020.08 1336 1020.2 1336.06L1019.72 1337.51C1019.64 1337.48 1019.52 1337.44 1019.37 1337.4C1019.22 1337.36 1019.02 1337.34 1018.78 1337.34C1018.23 1337.34 1017.83 1337.47 1017.58 1337.75C1017.34 1338.03 1017.22 1338.44 1017.22 1338.98V1351H1015.54Z" fill="#03031C"/>
+<path d="M1129.21 1310.79C1128.82 1310.4 1128.18 1310.4 1127.79 1310.79L1121.43 1317.16C1121.04 1317.55 1121.04 1318.18 1121.43 1318.57C1121.82 1318.96 1122.45 1318.96 1122.84 1318.57L1128.5 1312.91L1134.16 1318.57C1134.55 1318.96 1135.18 1318.96 1135.57 1318.57C1135.96 1318.18 1135.96 1317.55 1135.57 1317.16L1129.21 1310.79ZM1127.5 1358.12V1363.84H1129.5V1358.12H1127.5ZM1127.5 1375.28V1381H1129.5V1375.28H1127.5ZM1127.5 1311.5V1316.5H1129.5V1311.5H1127.5ZM1127.5 1326.5V1331.5H1129.5V1326.5H1127.5Z" fill="#03031C"/>
+<path d="M1117.06 1351V1340.09H1118.67V1341.74H1118.79C1118.99 1341.2 1119.35 1340.76 1119.87 1340.42C1120.39 1340.09 1120.98 1339.92 1121.63 1339.92C1121.75 1339.92 1121.91 1339.92 1122.09 1339.93C1122.28 1339.93 1122.42 1339.94 1122.51 1339.95V1341.65C1122.45 1341.64 1122.32 1341.62 1122.12 1341.59C1121.92 1341.56 1121.71 1341.54 1121.49 1341.54C1120.96 1341.54 1120.48 1341.65 1120.07 1341.87C1119.66 1342.09 1119.33 1342.39 1119.09 1342.78C1118.85 1343.17 1118.73 1343.6 1118.73 1344.1V1351H1117.06ZM1128.74 1351.23C1127.69 1351.23 1126.78 1351 1126.02 1350.53C1125.26 1350.06 1124.68 1349.41 1124.26 1348.57C1123.86 1347.73 1123.65 1346.75 1123.65 1345.63C1123.65 1344.51 1123.86 1343.53 1124.26 1342.68C1124.68 1341.82 1125.25 1341.15 1125.98 1340.67C1126.72 1340.19 1127.58 1339.95 1128.57 1339.95C1129.14 1339.95 1129.7 1340.04 1130.25 1340.23C1130.81 1340.42 1131.31 1340.73 1131.76 1341.16C1132.22 1341.58 1132.58 1342.14 1132.85 1342.83C1133.12 1343.53 1133.26 1344.39 1133.26 1345.4V1346.11H1124.85V1344.66H1131.55C1131.55 1344.05 1131.43 1343.5 1131.18 1343.02C1130.94 1342.53 1130.59 1342.15 1130.15 1341.87C1129.7 1341.59 1129.17 1341.45 1128.57 1341.45C1127.9 1341.45 1127.32 1341.62 1126.84 1341.95C1126.35 1342.28 1125.98 1342.7 1125.72 1343.23C1125.46 1343.76 1125.33 1344.32 1125.33 1344.92V1345.89C1125.33 1346.71 1125.47 1347.41 1125.76 1347.98C1126.04 1348.55 1126.44 1348.98 1126.96 1349.28C1127.47 1349.57 1128.06 1349.72 1128.74 1349.72C1129.18 1349.72 1129.58 1349.66 1129.93 1349.54C1130.29 1349.41 1130.6 1349.22 1130.86 1348.97C1131.12 1348.71 1131.32 1348.4 1131.47 1348.02L1133.09 1348.47C1132.91 1349.02 1132.63 1349.5 1132.23 1349.92C1131.82 1350.33 1131.33 1350.65 1130.73 1350.89C1130.14 1351.11 1129.48 1351.23 1128.74 1351.23ZM1140.66 1340.09V1341.51H1134.78V1340.09H1140.66ZM1136.54 1351V1338.59C1136.54 1337.96 1136.69 1337.44 1136.98 1337.02C1137.28 1336.61 1137.66 1336.29 1138.13 1336.09C1138.6 1335.88 1139.09 1335.77 1139.61 1335.77C1140.02 1335.77 1140.36 1335.81 1140.62 1335.87C1140.88 1335.94 1141.08 1336 1141.2 1336.06L1140.72 1337.51C1140.64 1337.48 1140.52 1337.44 1140.37 1337.4C1140.22 1337.36 1140.02 1337.34 1139.78 1337.34C1139.23 1337.34 1138.83 1337.47 1138.58 1337.75C1138.34 1338.03 1138.22 1338.44 1138.22 1338.98V1351H1136.54Z" fill="#03031C"/>
+<path d="M875.871 1033.34C880.975 1025.78 878.983 1015.51 871.421 1010.4C863.859 1005.3 853.59 1007.29 848.486 1014.85C843.381 1022.41 845.374 1032.68 852.936 1037.79C860.498 1042.89 870.766 1040.9 875.871 1033.34Z" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M871.142 1028.67C873.664 1023.71 871.696 1017.66 866.745 1015.13C861.793 1012.61 855.735 1014.58 853.212 1019.53C850.689 1024.48 852.658 1030.54 857.609 1033.06C862.56 1035.59 868.619 1033.62 871.142 1028.67Z" fill="#EA26A9"/>
+<path d="M923.089 1089.46C930.651 1084.35 932.643 1074.09 927.539 1066.52C922.434 1058.96 912.166 1056.97 904.604 1062.07C897.041 1067.18 895.049 1077.45 900.154 1085.01C905.258 1092.57 915.527 1094.56 923.089 1089.46Z" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M918.412 1084.73C923.363 1082.21 925.331 1076.15 922.809 1071.2C920.286 1066.25 914.227 1064.28 909.276 1066.8C904.325 1069.33 902.356 1075.39 904.879 1080.34C907.402 1085.29 913.46 1087.26 918.412 1084.73Z" fill="#8438FA"/>
+<path d="M888 1013.92C897.452 1013.92 906.517 1017.72 913.201 1024.49C919.885 1031.25 923.64 1040.43 923.64 1050" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M852.36 1050C852.36 1054.68 853.282 1059.31 855.073 1063.64C856.864 1067.96 859.489 1071.89 862.799 1075.2C869.482 1081.89 878.548 1085.64 888 1085.64" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M845.32 1054.4L851.92 1047.8L858.52 1054.4" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M930.24 1043.84L923.64 1050.44L917.04 1043.84" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#filter18_bd_12_618)">
+<rect x="1403" y="569" width="210" height="197" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="1403.5" y="569.5" width="209" height="196" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M1459.56 724.284C1458.43 724.284 1457.42 723.997 1456.55 723.423C1455.68 722.843 1455 722.026 1454.51 720.973C1454.02 719.913 1453.77 718.661 1453.77 717.217C1453.77 715.785 1454.02 714.542 1454.51 713.489C1455 712.435 1455.69 711.621 1456.56 711.047C1457.44 710.473 1458.45 710.186 1459.6 710.186C1460.49 710.186 1461.19 710.334 1461.7 710.63C1462.22 710.92 1462.62 711.251 1462.89 711.624C1463.17 711.991 1463.39 712.293 1463.54 712.53H1463.72V705.818H1465.81V724H1463.79V721.905H1463.54C1463.39 722.153 1463.17 722.467 1462.88 722.846C1462.6 723.219 1462.19 723.553 1461.67 723.849C1461.14 724.139 1460.44 724.284 1459.56 724.284ZM1459.85 722.402C1460.69 722.402 1461.4 722.183 1461.98 721.745C1462.56 721.301 1463 720.689 1463.3 719.907C1463.6 719.12 1463.75 718.212 1463.75 717.182C1463.75 716.164 1463.6 715.273 1463.31 714.51C1463.01 713.74 1462.57 713.142 1461.99 712.716C1461.41 712.284 1460.7 712.068 1459.85 712.068C1458.96 712.068 1458.22 712.296 1457.63 712.752C1457.04 713.202 1456.6 713.814 1456.3 714.589C1456.01 715.359 1455.87 716.223 1455.87 717.182C1455.87 718.152 1456.02 719.034 1456.31 719.827C1456.61 720.615 1457.06 721.242 1457.64 721.71C1458.24 722.171 1458.97 722.402 1459.85 722.402ZM1473.95 724.32C1473.09 724.32 1472.3 724.157 1471.6 723.831C1470.9 723.5 1470.34 723.023 1469.92 722.402C1469.51 721.775 1469.3 721.017 1469.3 720.129C1469.3 719.348 1469.45 718.715 1469.76 718.229C1470.07 717.738 1470.48 717.353 1471 717.075C1471.51 716.797 1472.08 716.59 1472.7 716.454C1473.33 716.312 1473.96 716.199 1474.59 716.116C1475.42 716.01 1476.09 715.93 1476.61 715.877C1477.13 715.818 1477.51 715.72 1477.74 715.584C1477.99 715.448 1478.11 715.211 1478.11 714.874V714.803C1478.11 713.927 1477.87 713.246 1477.39 712.761C1476.92 712.275 1476.2 712.033 1475.23 712.033C1474.23 712.033 1473.45 712.252 1472.88 712.69C1472.31 713.128 1471.91 713.595 1471.68 714.092L1469.69 713.382C1470.05 712.554 1470.52 711.908 1471.11 711.447C1471.71 710.979 1472.36 710.654 1473.07 710.47C1473.78 710.281 1474.47 710.186 1475.16 710.186C1475.6 710.186 1476.1 710.239 1476.67 710.346C1477.24 710.446 1477.8 710.657 1478.33 710.976C1478.87 711.296 1479.32 711.778 1479.67 712.423C1480.03 713.068 1480.2 713.933 1480.2 715.016V724H1478.11V722.153H1478C1477.86 722.449 1477.62 722.766 1477.29 723.103C1476.96 723.441 1476.52 723.728 1475.97 723.964C1475.42 724.201 1474.75 724.32 1473.95 724.32ZM1474.27 722.438C1475.1 722.438 1475.8 722.275 1476.37 721.949C1476.94 721.624 1477.37 721.203 1477.66 720.689C1477.96 720.174 1478.11 719.632 1478.11 719.064V717.146C1478.02 717.253 1477.82 717.35 1477.52 717.439C1477.23 717.522 1476.88 717.596 1476.49 717.661C1476.11 717.72 1475.73 717.774 1475.36 717.821C1475 717.862 1474.71 717.898 1474.49 717.928C1473.94 717.999 1473.43 718.114 1472.96 718.274C1472.49 718.428 1472.11 718.661 1471.82 718.975C1471.54 719.283 1471.4 719.703 1471.4 720.236C1471.4 720.964 1471.67 721.514 1472.2 721.887C1472.75 722.254 1473.44 722.438 1474.27 722.438ZM1489.96 710.364V712.139H1482.89V710.364H1489.96ZM1484.95 707.097H1487.05V720.094C1487.05 720.686 1487.13 721.129 1487.3 721.425C1487.48 721.715 1487.71 721.911 1487.98 722.011C1488.26 722.106 1488.55 722.153 1488.86 722.153C1489.09 722.153 1489.28 722.142 1489.42 722.118C1489.57 722.088 1489.69 722.065 1489.78 722.047L1490.21 723.929C1490.06 723.982 1489.87 724.036 1489.61 724.089C1489.36 724.148 1489.03 724.178 1488.64 724.178C1488.05 724.178 1487.47 724.05 1486.9 723.796C1486.34 723.541 1485.87 723.154 1485.5 722.633C1485.13 722.112 1484.95 721.455 1484.95 720.662V707.097ZM1497.12 724.32C1496.26 724.32 1495.47 724.157 1494.77 723.831C1494.06 723.5 1493.51 723.023 1493.09 722.402C1492.68 721.775 1492.47 721.017 1492.47 720.129C1492.47 719.348 1492.62 718.715 1492.93 718.229C1493.24 717.738 1493.65 717.353 1494.17 717.075C1494.68 716.797 1495.25 716.59 1495.87 716.454C1496.5 716.312 1497.13 716.199 1497.76 716.116C1498.59 716.01 1499.26 715.93 1499.78 715.877C1500.3 715.818 1500.68 715.72 1500.91 715.584C1501.16 715.448 1501.28 715.211 1501.28 714.874V714.803C1501.28 713.927 1501.04 713.246 1500.56 712.761C1500.08 712.275 1499.36 712.033 1498.4 712.033C1497.4 712.033 1496.62 712.252 1496.05 712.69C1495.48 713.128 1495.08 713.595 1494.85 714.092L1492.86 713.382C1493.22 712.554 1493.69 711.908 1494.28 711.447C1494.88 710.979 1495.53 710.654 1496.23 710.47C1496.94 710.281 1497.64 710.186 1498.33 710.186C1498.77 710.186 1499.27 710.239 1499.84 710.346C1500.41 710.446 1500.97 710.657 1501.5 710.976C1502.04 711.296 1502.48 711.778 1502.84 712.423C1503.19 713.068 1503.37 713.933 1503.37 715.016V724H1501.28V722.153H1501.17C1501.03 722.449 1500.79 722.766 1500.46 723.103C1500.13 723.441 1499.69 723.728 1499.14 723.964C1498.59 724.201 1497.91 724.32 1497.12 724.32ZM1497.44 722.438C1498.27 722.438 1498.97 722.275 1499.54 721.949C1500.11 721.624 1500.54 721.203 1500.83 720.689C1501.13 720.174 1501.28 719.632 1501.28 719.064V717.146C1501.19 717.253 1500.99 717.35 1500.69 717.439C1500.39 717.522 1500.05 717.596 1499.66 717.661C1499.28 717.72 1498.9 717.774 1498.53 717.821C1498.17 717.862 1497.88 717.898 1497.65 717.928C1497.11 717.999 1496.6 718.114 1496.13 718.274C1495.66 718.428 1495.28 718.661 1494.99 718.975C1494.71 719.283 1494.56 719.703 1494.56 720.236C1494.56 720.964 1494.83 721.514 1495.37 721.887C1495.92 722.254 1496.61 722.438 1497.44 722.438ZM1507.48 724V705.818H1509.58V712.53H1509.75C1509.91 712.293 1510.12 711.991 1510.39 711.624C1510.67 711.251 1511.07 710.92 1511.58 710.63C1512.1 710.334 1512.81 710.186 1513.69 710.186C1514.84 710.186 1515.85 710.473 1516.73 711.047C1517.61 711.621 1518.29 712.435 1518.78 713.489C1519.27 714.542 1519.52 715.785 1519.52 717.217C1519.52 718.661 1519.27 719.913 1518.78 720.973C1518.29 722.026 1517.61 722.843 1516.74 723.423C1515.87 723.997 1514.87 724.284 1513.73 724.284C1512.85 724.284 1512.15 724.139 1511.63 723.849C1511.1 723.553 1510.69 723.219 1510.41 722.846C1510.13 722.467 1509.91 722.153 1509.75 721.905H1509.5V724H1507.48ZM1509.54 717.182C1509.54 718.212 1509.69 719.12 1509.99 719.907C1510.29 720.689 1510.74 721.301 1511.32 721.745C1511.9 722.183 1512.61 722.402 1513.45 722.402C1514.32 722.402 1515.05 722.171 1515.64 721.71C1516.23 721.242 1516.67 720.615 1516.97 719.827C1517.27 719.034 1517.42 718.152 1517.42 717.182C1517.42 716.223 1517.28 715.359 1516.98 714.589C1516.69 713.814 1516.25 713.202 1515.66 712.752C1515.07 712.296 1514.33 712.068 1513.45 712.068C1512.59 712.068 1511.88 712.284 1511.3 712.716C1510.72 713.142 1510.28 713.74 1509.98 714.51C1509.69 715.273 1509.54 716.164 1509.54 717.182ZM1526.74 724.32C1525.87 724.32 1525.09 724.157 1524.38 723.831C1523.68 723.5 1523.12 723.023 1522.71 722.402C1522.29 721.775 1522.08 721.017 1522.08 720.129C1522.08 719.348 1522.24 718.715 1522.55 718.229C1522.85 717.738 1523.26 717.353 1523.78 717.075C1524.29 716.797 1524.86 716.59 1525.48 716.454C1526.11 716.312 1526.74 716.199 1527.38 716.116C1528.2 716.01 1528.88 715.93 1529.39 715.877C1529.91 715.818 1530.29 715.72 1530.53 715.584C1530.77 715.448 1530.89 715.211 1530.89 714.874V714.803C1530.89 713.927 1530.65 713.246 1530.17 712.761C1529.7 712.275 1528.98 712.033 1528.01 712.033C1527.01 712.033 1526.23 712.252 1525.66 712.69C1525.09 713.128 1524.69 713.595 1524.46 714.092L1522.47 713.382C1522.83 712.554 1523.3 711.908 1523.9 711.447C1524.49 710.979 1525.14 710.654 1525.85 710.47C1526.56 710.281 1527.26 710.186 1527.94 710.186C1528.38 710.186 1528.88 710.239 1529.45 710.346C1530.03 710.446 1530.58 710.657 1531.11 710.976C1531.65 711.296 1532.1 711.778 1532.45 712.423C1532.81 713.068 1532.99 713.933 1532.99 715.016V724H1530.89V722.153H1530.78C1530.64 722.449 1530.41 722.766 1530.07 723.103C1529.74 723.441 1529.3 723.728 1528.75 723.964C1528.2 724.201 1527.53 724.32 1526.74 724.32ZM1527.06 722.438C1527.88 722.438 1528.58 722.275 1529.15 721.949C1529.72 721.624 1530.16 721.203 1530.45 720.689C1530.74 720.174 1530.89 719.632 1530.89 719.064V717.146C1530.8 717.253 1530.61 717.35 1530.3 717.439C1530.01 717.522 1529.67 717.596 1529.28 717.661C1528.89 717.72 1528.51 717.774 1528.15 717.821C1527.79 717.862 1527.49 717.898 1527.27 717.928C1526.72 717.999 1526.22 718.114 1525.74 718.274C1525.27 718.428 1524.9 718.661 1524.61 718.975C1524.32 719.283 1524.18 719.703 1524.18 720.236C1524.18 720.964 1524.45 721.514 1524.99 721.887C1525.53 722.254 1526.22 722.438 1527.06 722.438ZM1546.47 713.418L1544.59 713.95C1544.47 713.637 1544.29 713.332 1544.06 713.036C1543.84 712.734 1543.53 712.485 1543.14 712.29C1542.75 712.095 1542.25 711.997 1541.64 711.997C1540.81 711.997 1540.11 712.19 1539.55 712.574C1539 712.953 1538.73 713.435 1538.73 714.021C1538.73 714.542 1538.92 714.953 1539.3 715.255C1539.67 715.557 1540.27 715.809 1541.07 716.01L1543.1 716.507C1544.31 716.803 1545.22 717.256 1545.82 717.865C1546.42 718.469 1546.72 719.247 1546.72 720.2C1546.72 720.982 1546.49 721.68 1546.04 722.295C1545.6 722.911 1544.98 723.396 1544.18 723.751C1543.38 724.107 1542.45 724.284 1541.39 724.284C1540 724.284 1538.85 723.982 1537.94 723.379C1537.03 722.775 1536.45 721.893 1536.21 720.733L1538.2 720.236C1538.38 720.97 1538.74 721.52 1539.27 721.887C1539.8 722.254 1540.5 722.438 1541.36 722.438C1542.33 722.438 1543.11 722.23 1543.68 721.816C1544.26 721.396 1544.55 720.893 1544.55 720.307C1544.55 719.833 1544.39 719.437 1544.05 719.117C1543.72 718.792 1543.21 718.549 1542.53 718.389L1540.25 717.857C1539.01 717.561 1538.09 717.102 1537.5 716.48C1536.92 715.853 1536.63 715.069 1536.63 714.128C1536.63 713.358 1536.85 712.678 1537.28 712.086C1537.72 711.494 1538.31 711.029 1539.07 710.692C1539.82 710.355 1540.68 710.186 1541.64 710.186C1542.99 710.186 1544.05 710.482 1544.82 711.074C1545.59 711.666 1546.14 712.447 1546.47 713.418ZM1555.59 724.284C1554.28 724.284 1553.14 723.994 1552.19 723.414C1551.24 722.828 1550.51 722.011 1550 720.964C1549.49 719.91 1549.23 718.685 1549.23 717.288C1549.23 715.892 1549.49 714.661 1550 713.595C1550.51 712.524 1551.23 711.689 1552.14 711.092C1553.07 710.488 1554.14 710.186 1555.38 710.186C1556.09 710.186 1556.79 710.304 1557.48 710.541C1558.17 710.778 1558.8 711.163 1559.37 711.695C1559.94 712.222 1560.39 712.92 1560.73 713.79C1561.07 714.661 1561.24 715.732 1561.24 717.004V717.892H1550.72V716.081H1559.1C1559.1 715.312 1558.95 714.625 1558.64 714.021C1558.34 713.418 1557.91 712.941 1557.35 712.592C1556.79 712.243 1556.13 712.068 1555.38 712.068C1554.54 712.068 1553.82 712.275 1553.21 712.69C1552.61 713.098 1552.14 713.631 1551.82 714.288C1551.49 714.945 1551.33 715.649 1551.33 716.401V717.608C1551.33 718.638 1551.51 719.511 1551.86 720.227C1552.22 720.937 1552.72 721.479 1553.36 721.852C1554 722.219 1554.74 722.402 1555.59 722.402C1556.14 722.402 1556.64 722.325 1557.08 722.171C1557.53 722.011 1557.92 721.775 1558.24 721.461C1558.57 721.141 1558.82 720.745 1559 720.271L1561.02 720.839C1560.81 721.526 1560.45 722.13 1559.95 722.651C1559.44 723.165 1558.82 723.568 1558.08 723.858C1557.34 724.142 1556.51 724.284 1555.59 724.284Z" fill="#03031C"/>
+<path d="M1320 668H1396" stroke="#03031C" stroke-width="2"/>
+<path d="M1508 620.704C1527.3 620.704 1542.94 616.893 1542.94 612.192C1542.94 607.491 1527.3 603.68 1508 603.68C1488.7 603.68 1473.06 607.491 1473.06 612.192C1473.06 616.893 1488.7 620.704 1508 620.704Z" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1542.94 663.264V676.176C1542.94 680.923 1527.3 684.768 1508 684.768C1488.7 684.768 1473.06 680.946 1473.06 676.176V663.264" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1542.94 642.208V654.851C1542.94 659.499 1527.3 663.264 1508 663.264C1488.7 663.264 1473.06 659.521 1473.06 654.851V642.208" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1542.94 620.704V633.614C1542.94 638.358 1527.3 642.208 1508 642.208C1488.7 642.208 1473.06 638.388 1473.06 633.614V620.704" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1521.51 677.403C1524.11 677.403 1526.63 677.342 1529.06 677.211L1528.51 677.319C1521.71 678.469 1514.82 679.011 1507.93 678.937C1491.89 678.937 1478.88 676.46 1478.88 673.407V666.771C1478.87 666.642 1478.9 666.513 1478.95 666.396C1479 666.279 1479.09 666.178 1479.19 666.101C1479.29 666.025 1479.41 665.976 1479.54 665.959C1479.66 665.942 1479.79 665.957 1479.91 666.004C1483.99 667.274 1488.2 668.097 1492.46 668.459V671.88C1492.46 674.926 1505.47 677.403 1521.51 677.403Z" fill="#8438FA"/>
+<path d="M1521.59 656.348C1524.17 656.348 1526.68 656.286 1529.06 656.163L1528.56 656.263C1521.76 657.412 1514.88 657.953 1507.99 657.882C1491.91 657.882 1478.88 655.404 1478.88 652.351V645.715C1478.87 645.586 1478.9 645.457 1478.95 645.34C1479 645.223 1479.09 645.122 1479.19 645.045C1479.29 644.969 1479.41 644.92 1479.54 644.903C1479.66 644.886 1479.79 644.901 1479.91 644.948C1484.01 646.201 1488.22 647.011 1492.49 647.365V650.794C1492.49 653.87 1505.51 656.348 1521.59 656.348Z" fill="#8438FA"/>
+<path d="M1521.59 634.898C1524.17 634.898 1526.68 634.838 1529.06 634.72L1528.56 634.816C1521.76 635.924 1514.88 636.447 1507.99 636.378C1491.91 636.378 1478.88 633.987 1478.88 631.041V624.631C1478.87 624.506 1478.9 624.382 1478.95 624.269C1479 624.156 1479.09 624.058 1479.19 623.984C1479.29 623.91 1479.41 623.863 1479.54 623.846C1479.66 623.83 1479.79 623.845 1479.91 623.89C1484.01 625.099 1488.22 625.881 1492.49 626.222V629.523C1492.49 632.507 1505.51 634.898 1521.59 634.898Z" fill="#8438FA"/>
+<path d="M626.293 493.207C626.683 493.598 627.317 493.598 627.707 493.207L634.071 486.843C634.462 486.453 634.462 485.819 634.071 485.429C633.681 485.038 633.047 485.038 632.657 485.429L627 491.086L621.343 485.429C620.953 485.038 620.319 485.038 619.929 485.429C619.538 485.819 619.538 486.453 619.929 486.843L626.293 493.207ZM626 378V492.5H628V378H626Z" fill="#03031C"/>
+<path d="M751 451H752V450H751V451ZM750.293 493.207C750.683 493.598 751.317 493.598 751.707 493.207L758.071 486.843C758.462 486.453 758.462 485.819 758.071 485.429C757.681 485.038 757.047 485.038 756.657 485.429L751 491.086L745.343 485.429C744.953 485.038 744.319 485.038 743.929 485.429C743.538 485.819 743.538 486.453 743.929 486.843L750.293 493.207ZM628.5 452H751V450H628.5V452ZM750 451V492.5H752V451H750Z" fill="#03031C"/>
+<path d="M1149.71 493.207C1149.32 493.598 1148.68 493.598 1148.29 493.207L1141.93 486.843C1141.54 486.453 1141.54 485.819 1141.93 485.429C1142.32 485.038 1142.95 485.038 1143.34 485.429L1149 491.086L1154.66 485.429C1155.05 485.038 1155.68 485.038 1156.07 485.429C1156.46 485.819 1156.46 486.453 1156.07 486.843L1149.71 493.207ZM1150 378V492.5H1148V378H1150Z" fill="#03031C"/>
+<path d="M1025 451H1024V450H1025V451ZM1025.71 493.207C1025.32 493.598 1024.68 493.598 1024.29 493.207L1017.93 486.843C1017.54 486.453 1017.54 485.819 1017.93 485.429C1018.32 485.038 1018.95 485.038 1019.34 485.429L1025 491.086L1030.66 485.429C1031.05 485.038 1031.68 485.038 1032.07 485.429C1032.46 485.819 1032.46 486.453 1032.07 486.843L1025.71 493.207ZM1147.5 452H1025V450H1147.5V452ZM1026 451V492.5H1024V451H1026Z" fill="#03031C"/>
+<defs>
+<filter id="filter0_bd_12_618" x="134" y="1127" width="260" height="275" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter1_bd_12_618" x="134" y="1390" width="260" height="275" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter2_bd_12_618" x="441" y="89" width="894" height="706" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter3_bd_12_618" x="441" y="892" width="894" height="846" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter4_bd_12_618" x="482" y="120" width="815" height="537" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter5_bd_12_618" x="553" y="484" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter6_bd_12_618" x="545" y="1216" width="326" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter7_bd_12_618" x="905" y="1216" width="326" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter8_bd_12_618" x="680" y="484" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter9_bd_12_618" x="948" y="483" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter10_bd_12_618" x="1075" y="483" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter11_bd_12_618" x="720" y="958" width="336" height="247" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter12_bd_12_618" x="540" y="1340" width="336" height="271" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter13_bd_12_618" x="573" y="1370" width="149" height="129" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter14_bd_12_618" x="694" y="1370" width="149" height="129" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter15_bd_12_618" x="900" y="1340.5" width="336" height="271" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter16_bd_12_618" x="933" y="1370.5" width="149" height="129" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter17_bd_12_618" x="1054" y="1370.5" width="149" height="129" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+<filter id="filter18_bd_12_618" x="1378" y="548" width="260" height="247" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_618"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_618" result="effect2_dropShadow_12_618"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_618" result="shape"/>
+</filter>
+</defs>
+</svg>
diff --git a/img/operator/tyk-operator-context.svg b/img/operator/tyk-operator-context.svg
new file mode 100644
index 0000000000..dc6e2885db
--- /dev/null
+++ b/img/operator/tyk-operator-context.svg
@@ -0,0 +1,432 @@
+<svg width="1706" height="1698" viewBox="0 0 1706 1698" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M662.784 717.54V711.091H664.46V722H662.784V720.153H662.67C662.415 720.707 662.017 721.179 661.477 721.567C660.938 721.95 660.256 722.142 659.432 722.142C658.75 722.142 658.144 721.993 657.614 721.695C657.083 721.392 656.667 720.937 656.364 720.331C656.061 719.72 655.909 718.951 655.909 718.023V711.091H657.585V717.909C657.585 718.705 657.808 719.339 658.253 719.812C658.703 720.286 659.276 720.523 659.972 720.523C660.388 720.523 660.812 720.416 661.243 720.203C661.679 719.99 662.043 719.663 662.337 719.223C662.635 718.783 662.784 718.222 662.784 717.54ZM675.257 713.534L673.752 713.96C673.657 713.709 673.517 713.465 673.333 713.229C673.153 712.987 672.907 712.788 672.594 712.632C672.282 712.476 671.882 712.398 671.394 712.398C670.726 712.398 670.17 712.552 669.725 712.859C669.284 713.162 669.064 713.548 669.064 714.017C669.064 714.434 669.216 714.763 669.519 715.004C669.822 715.246 670.295 715.447 670.939 715.608L672.559 716.006C673.534 716.242 674.261 716.605 674.739 717.092C675.217 717.575 675.456 718.198 675.456 718.96C675.456 719.585 675.276 720.144 674.917 720.636C674.561 721.129 674.064 721.517 673.425 721.801C672.786 722.085 672.042 722.227 671.195 722.227C670.082 722.227 669.161 721.986 668.432 721.503C667.703 721.02 667.241 720.314 667.047 719.386L668.638 718.989C668.79 719.576 669.076 720.016 669.498 720.31C669.924 720.603 670.48 720.75 671.167 720.75C671.948 720.75 672.568 720.584 673.027 720.253C673.491 719.917 673.723 719.514 673.723 719.045C673.723 718.667 673.591 718.349 673.326 718.094C673.06 717.833 672.653 717.639 672.104 717.511L670.286 717.085C669.287 716.848 668.553 716.482 668.084 715.984C667.62 715.482 667.388 714.855 667.388 714.102C667.388 713.487 667.561 712.942 667.907 712.469C668.257 711.995 668.733 711.624 669.334 711.354C669.94 711.084 670.627 710.949 671.394 710.949C672.473 710.949 673.321 711.186 673.936 711.659C674.557 712.133 674.997 712.758 675.257 713.534ZM677.979 722V711.091H679.656V722H677.979ZM678.832 709.273C678.505 709.273 678.223 709.161 677.987 708.939C677.754 708.716 677.638 708.449 677.638 708.136C677.638 707.824 677.754 707.556 677.987 707.334C678.223 707.111 678.505 707 678.832 707C679.158 707 679.438 707.111 679.67 707.334C679.906 707.556 680.025 707.824 680.025 708.136C680.025 708.449 679.906 708.716 679.67 708.939C679.438 709.161 679.158 709.273 678.832 709.273ZM684.402 715.438V722H682.725V711.091H684.345V712.795H684.487C684.743 712.241 685.131 711.796 685.652 711.46C686.172 711.119 686.845 710.949 687.669 710.949C688.407 710.949 689.054 711.1 689.608 711.403C690.162 711.702 690.592 712.156 690.9 712.767C691.208 713.373 691.362 714.14 691.362 715.068V722H689.686V715.182C689.686 714.325 689.463 713.657 689.018 713.179C688.573 712.696 687.962 712.455 687.186 712.455C686.651 712.455 686.172 712.571 685.751 712.803C685.334 713.035 685.005 713.373 684.764 713.818C684.522 714.263 684.402 714.803 684.402 715.438ZM698.828 726.318C698.018 726.318 697.322 726.214 696.74 726.006C696.158 725.802 695.672 725.532 695.284 725.196C694.901 724.865 694.595 724.509 694.368 724.131L695.703 723.193C695.855 723.392 696.046 723.619 696.278 723.875C696.51 724.135 696.828 724.36 697.23 724.55C697.637 724.744 698.17 724.841 698.828 724.841C699.709 724.841 700.436 724.628 701.009 724.202C701.581 723.776 701.868 723.108 701.868 722.199V719.983H701.726C701.603 720.182 701.428 720.428 701.2 720.722C700.978 721.01 700.656 721.268 700.234 721.496C699.818 721.718 699.254 721.83 698.544 721.83C697.663 721.83 696.873 721.621 696.172 721.205C695.476 720.788 694.924 720.182 694.517 719.386C694.115 718.591 693.913 717.625 693.913 716.489C693.913 715.371 694.11 714.398 694.503 713.57C694.896 712.736 695.443 712.092 696.143 711.638C696.844 711.179 697.654 710.949 698.572 710.949C699.283 710.949 699.846 711.067 700.263 711.304C700.684 711.536 701.006 711.801 701.229 712.099C701.456 712.393 701.631 712.634 701.754 712.824H701.925V711.091H703.544V722.312C703.544 723.25 703.331 724.012 702.905 724.599C702.483 725.191 701.915 725.625 701.2 725.899C700.49 726.179 699.699 726.318 698.828 726.318ZM698.771 720.324C699.444 720.324 700.012 720.17 700.476 719.862C700.94 719.554 701.293 719.112 701.534 718.534C701.776 717.956 701.896 717.265 701.896 716.46C701.896 715.674 701.778 714.981 701.541 714.379C701.304 713.778 700.954 713.307 700.49 712.966C700.026 712.625 699.453 712.455 698.771 712.455C698.061 712.455 697.469 712.634 696.996 712.994C696.527 713.354 696.174 713.837 695.938 714.443C695.705 715.049 695.589 715.722 695.589 716.46C695.589 717.218 695.708 717.888 695.945 718.47C696.186 719.048 696.541 719.502 697.01 719.834C697.483 720.161 698.071 720.324 698.771 720.324ZM724.737 714.727C724.737 716.261 724.46 717.587 723.906 718.705C723.352 719.822 722.592 720.684 721.626 721.29C720.661 721.896 719.557 722.199 718.317 722.199C717.076 722.199 715.973 721.896 715.007 721.29C714.041 720.684 713.281 719.822 712.727 718.705C712.173 717.587 711.896 716.261 711.896 714.727C711.896 713.193 712.173 711.867 712.727 710.75C713.281 709.633 714.041 708.771 715.007 708.165C715.973 707.559 717.076 707.256 718.317 707.256C719.557 707.256 720.661 707.559 721.626 708.165C722.592 708.771 723.352 709.633 723.906 710.75C724.46 711.867 724.737 713.193 724.737 714.727ZM723.033 714.727C723.033 713.468 722.822 712.405 722.401 711.538C721.984 710.672 721.418 710.016 720.703 709.571C719.993 709.126 719.197 708.903 718.317 708.903C717.436 708.903 716.638 709.126 715.923 709.571C715.213 710.016 714.647 710.672 714.226 711.538C713.809 712.405 713.601 713.468 713.601 714.727C713.601 715.987 713.809 717.05 714.226 717.916C714.647 718.783 715.213 719.438 715.923 719.884C716.638 720.329 717.436 720.551 718.317 720.551C719.197 720.551 719.993 720.329 720.703 719.884C721.418 719.438 721.984 718.783 722.401 717.916C722.822 717.05 723.033 715.987 723.033 714.727ZM727.472 726.091V711.091H729.091V712.824H729.29C729.413 712.634 729.583 712.393 729.801 712.099C730.024 711.801 730.341 711.536 730.753 711.304C731.17 711.067 731.733 710.949 732.443 710.949C733.362 710.949 734.171 711.179 734.872 711.638C735.573 712.097 736.12 712.748 736.513 713.591C736.906 714.434 737.102 715.428 737.102 716.574C737.102 717.729 736.906 718.731 736.513 719.578C736.12 720.421 735.575 721.074 734.879 721.538C734.183 721.998 733.381 722.227 732.472 722.227C731.771 722.227 731.21 722.111 730.788 721.879C730.367 721.643 730.043 721.375 729.815 721.077C729.588 720.774 729.413 720.523 729.29 720.324H729.148V726.091H727.472ZM729.119 716.545C729.119 717.369 729.24 718.096 729.482 718.726C729.723 719.351 730.076 719.841 730.54 720.196C731.004 720.546 731.572 720.722 732.244 720.722C732.945 720.722 733.53 720.537 733.999 720.168C734.472 719.794 734.827 719.292 735.064 718.662C735.305 718.027 735.426 717.322 735.426 716.545C735.426 715.778 735.308 715.087 735.071 714.472C734.839 713.851 734.486 713.361 734.013 713.001C733.544 712.637 732.955 712.455 732.244 712.455C731.563 712.455 730.99 712.627 730.526 712.973C730.062 713.314 729.711 713.792 729.474 714.408C729.238 715.018 729.119 715.731 729.119 716.545ZM744.233 722.227C743.182 722.227 742.275 721.995 741.513 721.531C740.755 721.062 740.17 720.409 739.759 719.571C739.351 718.728 739.148 717.748 739.148 716.631C739.148 715.513 739.351 714.528 739.759 713.676C740.17 712.819 740.743 712.152 741.477 711.673C742.216 711.19 743.078 710.949 744.062 710.949C744.631 710.949 745.192 711.044 745.746 711.233C746.3 711.422 746.804 711.73 747.259 712.156C747.713 712.578 748.075 713.136 748.345 713.832C748.615 714.528 748.75 715.385 748.75 716.403V717.114H740.341V715.665H747.045C747.045 715.049 746.922 714.5 746.676 714.017C746.435 713.534 746.089 713.153 745.639 712.874C745.194 712.594 744.669 712.455 744.062 712.455C743.395 712.455 742.817 712.62 742.33 712.952C741.847 713.278 741.475 713.705 741.214 714.23C740.954 714.756 740.824 715.319 740.824 715.92V716.886C740.824 717.71 740.966 718.409 741.25 718.982C741.539 719.55 741.939 719.983 742.45 720.281C742.962 720.575 743.556 720.722 744.233 720.722C744.673 720.722 745.071 720.66 745.426 720.537C745.786 720.409 746.096 720.22 746.357 719.969C746.617 719.713 746.818 719.396 746.96 719.017L748.58 719.472C748.409 720.021 748.123 720.504 747.72 720.92C747.318 721.332 746.821 721.654 746.229 721.886C745.637 722.114 744.972 722.227 744.233 722.227ZM751.3 722V711.091H752.919V712.739H753.033C753.232 712.199 753.591 711.761 754.112 711.425C754.633 711.089 755.22 710.92 755.874 710.92C755.997 710.92 756.151 710.923 756.335 710.928C756.52 710.932 756.66 710.939 756.754 710.949V712.653C756.697 712.639 756.567 712.618 756.364 712.589C756.165 712.556 755.954 712.54 755.732 712.54C755.201 712.54 754.728 712.651 754.311 712.874C753.899 713.091 753.572 713.394 753.331 713.783C753.094 714.166 752.976 714.604 752.976 715.097V722H751.3ZM761.951 722.256C761.26 722.256 760.633 722.125 760.069 721.865C759.506 721.6 759.058 721.219 758.727 720.722C758.395 720.22 758.23 719.614 758.23 718.903C758.23 718.278 758.353 717.772 758.599 717.384C758.845 716.991 759.174 716.683 759.586 716.46C759.998 716.238 760.453 716.072 760.95 715.963C761.452 715.849 761.956 715.759 762.463 715.693C763.126 715.608 763.663 715.544 764.075 715.501C764.492 715.454 764.795 715.376 764.984 715.267C765.178 715.158 765.275 714.969 765.275 714.699V714.642C765.275 713.941 765.083 713.397 764.7 713.009C764.321 712.62 763.746 712.426 762.974 712.426C762.174 712.426 761.547 712.601 761.092 712.952C760.637 713.302 760.318 713.676 760.133 714.074L758.542 713.506C758.826 712.843 759.205 712.327 759.679 711.957C760.157 711.583 760.678 711.323 761.241 711.176C761.809 711.025 762.368 710.949 762.917 710.949C763.268 710.949 763.67 710.991 764.125 711.077C764.584 711.157 765.027 711.325 765.453 711.581C765.884 711.837 766.241 712.223 766.525 712.739C766.809 713.255 766.951 713.946 766.951 714.812V722H765.275V720.523H765.19C765.076 720.759 764.887 721.013 764.622 721.283C764.357 721.553 764.004 721.782 763.564 721.972C763.123 722.161 762.586 722.256 761.951 722.256ZM762.207 720.75C762.87 720.75 763.429 720.62 763.883 720.359C764.342 720.099 764.688 719.763 764.92 719.351C765.157 718.939 765.275 718.506 765.275 718.051V716.517C765.204 716.602 765.048 716.68 764.806 716.751C764.57 716.818 764.295 716.877 763.983 716.929C763.675 716.976 763.374 717.019 763.081 717.057C762.792 717.09 762.557 717.118 762.377 717.142C761.942 717.199 761.535 717.291 761.156 717.419C760.782 717.542 760.479 717.729 760.247 717.98C760.02 718.226 759.906 718.562 759.906 718.989C759.906 719.571 760.121 720.011 760.552 720.31C760.988 720.603 761.539 720.75 762.207 720.75ZM774.755 711.091V712.511H769.102V711.091H774.755ZM770.749 708.477H772.425V718.875C772.425 719.348 772.494 719.704 772.631 719.94C772.773 720.172 772.953 720.329 773.171 720.409C773.394 720.485 773.628 720.523 773.874 720.523C774.059 720.523 774.21 720.513 774.329 720.494C774.447 720.471 774.542 720.452 774.613 720.438L774.954 721.943C774.84 721.986 774.682 722.028 774.478 722.071C774.274 722.118 774.016 722.142 773.704 722.142C773.23 722.142 772.766 722.04 772.312 721.837C771.862 721.633 771.488 721.323 771.19 720.906C770.896 720.49 770.749 719.964 770.749 719.33V708.477ZM781.591 722.227C780.606 722.227 779.742 721.993 778.999 721.524C778.26 721.055 777.682 720.4 777.266 719.557C776.854 718.714 776.648 717.729 776.648 716.602C776.648 715.466 776.854 714.474 777.266 713.626C777.682 712.779 778.26 712.121 778.999 711.652C779.742 711.183 780.606 710.949 781.591 710.949C782.576 710.949 783.438 711.183 784.176 711.652C784.92 712.121 785.497 712.779 785.909 713.626C786.326 714.474 786.534 715.466 786.534 716.602C786.534 717.729 786.326 718.714 785.909 719.557C785.497 720.4 784.92 721.055 784.176 721.524C783.438 721.993 782.576 722.227 781.591 722.227ZM781.591 720.722C782.339 720.722 782.955 720.53 783.438 720.146C783.92 719.763 784.278 719.259 784.51 718.634C784.742 718.009 784.858 717.331 784.858 716.602C784.858 715.873 784.742 715.194 784.51 714.564C784.278 713.934 783.92 713.425 783.438 713.037C782.955 712.649 782.339 712.455 781.591 712.455C780.843 712.455 780.227 712.649 779.744 713.037C779.261 713.425 778.904 713.934 778.672 714.564C778.44 715.194 778.324 715.873 778.324 716.602C778.324 717.331 778.44 718.009 778.672 718.634C778.904 719.259 779.261 719.763 779.744 720.146C780.227 720.53 780.843 720.722 781.591 720.722ZM789.093 722V711.091H790.712V712.739H790.826C791.025 712.199 791.384 711.761 791.905 711.425C792.426 711.089 793.013 710.92 793.667 710.92C793.79 710.92 793.944 710.923 794.128 710.928C794.313 710.932 794.453 710.939 794.547 710.949V712.653C794.49 712.639 794.36 712.618 794.157 712.589C793.958 712.556 793.747 712.54 793.525 712.54C792.994 712.54 792.521 712.651 792.104 712.874C791.692 713.091 791.365 713.394 791.124 713.783C790.887 714.166 790.769 714.604 790.769 715.097V722H789.093ZM647.021 742H645.259C645.155 741.493 644.973 741.048 644.712 740.665C644.457 740.281 644.144 739.959 643.775 739.699C643.41 739.434 643.005 739.235 642.56 739.102C642.115 738.97 641.651 738.903 641.168 738.903C640.288 738.903 639.49 739.126 638.775 739.571C638.065 740.016 637.499 740.672 637.077 741.538C636.661 742.405 636.452 743.468 636.452 744.727C636.452 745.987 636.661 747.05 637.077 747.916C637.499 748.783 638.065 749.438 638.775 749.884C639.49 750.329 640.288 750.551 641.168 750.551C641.651 750.551 642.115 750.485 642.56 750.352C643.005 750.22 643.41 750.023 643.775 749.763C644.144 749.498 644.457 749.173 644.712 748.79C644.973 748.402 645.155 747.956 645.259 747.455H647.021C646.888 748.198 646.647 748.863 646.296 749.45C645.946 750.037 645.51 750.537 644.989 750.949C644.469 751.356 643.884 751.666 643.235 751.879C642.591 752.092 641.902 752.199 641.168 752.199C639.928 752.199 638.825 751.896 637.859 751.29C636.893 750.684 636.133 749.822 635.579 748.705C635.025 747.587 634.748 746.261 634.748 744.727C634.748 743.193 635.025 741.867 635.579 740.75C636.133 739.633 636.893 738.771 637.859 738.165C638.825 737.559 639.928 737.256 641.168 737.256C641.902 737.256 642.591 737.362 643.235 737.575C643.884 737.788 644.469 738.101 644.989 738.513C645.51 738.92 645.946 739.417 646.296 740.004C646.647 740.587 646.888 741.252 647.021 742ZM654.071 752.227C653.087 752.227 652.222 751.993 651.479 751.524C650.74 751.055 650.163 750.4 649.746 749.557C649.334 748.714 649.128 747.729 649.128 746.602C649.128 745.466 649.334 744.474 649.746 743.626C650.163 742.779 650.74 742.121 651.479 741.652C652.222 741.183 653.087 740.949 654.071 740.949C655.056 740.949 655.918 741.183 656.657 741.652C657.4 742.121 657.978 742.779 658.39 743.626C658.806 744.474 659.015 745.466 659.015 746.602C659.015 747.729 658.806 748.714 658.39 749.557C657.978 750.4 657.4 751.055 656.657 751.524C655.918 751.993 655.056 752.227 654.071 752.227ZM654.071 750.722C654.819 750.722 655.435 750.53 655.918 750.146C656.401 749.763 656.758 749.259 656.99 748.634C657.222 748.009 657.338 747.331 657.338 746.602C657.338 745.873 657.222 745.194 656.99 744.564C656.758 743.934 656.401 743.425 655.918 743.037C655.435 742.649 654.819 742.455 654.071 742.455C653.323 742.455 652.708 742.649 652.225 743.037C651.742 743.425 651.384 743.934 651.152 744.564C650.92 745.194 650.804 745.873 650.804 746.602C650.804 747.331 650.92 748.009 651.152 748.634C651.384 749.259 651.742 749.763 652.225 750.146C652.708 750.53 653.323 750.722 654.071 750.722ZM663.249 745.438V752H661.573V741.091H663.192V742.795H663.335C663.59 742.241 663.978 741.796 664.499 741.46C665.02 741.119 665.692 740.949 666.516 740.949C667.255 740.949 667.901 741.1 668.455 741.403C669.009 741.702 669.44 742.156 669.748 742.767C670.056 743.373 670.21 744.14 670.21 745.068V752H668.533V745.182C668.533 744.325 668.311 743.657 667.866 743.179C667.421 742.696 666.81 742.455 666.033 742.455C665.498 742.455 665.02 742.571 664.599 742.803C664.182 743.035 663.853 743.373 663.612 743.818C663.37 744.263 663.249 744.803 663.249 745.438ZM678.017 741.091V742.511H672.363V741.091H678.017ZM674.011 738.477H675.687V748.875C675.687 749.348 675.756 749.704 675.893 749.94C676.035 750.172 676.215 750.329 676.433 750.409C676.655 750.485 676.89 750.523 677.136 750.523C677.321 750.523 677.472 750.513 677.591 750.494C677.709 750.471 677.804 750.452 677.875 750.438L678.216 751.943C678.102 751.986 677.943 752.028 677.74 752.071C677.536 752.118 677.278 752.142 676.966 752.142C676.492 752.142 676.028 752.04 675.574 751.837C675.124 751.633 674.75 751.323 674.451 750.906C674.158 750.49 674.011 749.964 674.011 749.33V738.477ZM684.995 752.227C683.944 752.227 683.037 751.995 682.275 751.531C681.517 751.062 680.932 750.409 680.52 749.571C680.113 748.728 679.909 747.748 679.909 746.631C679.909 745.513 680.113 744.528 680.52 743.676C680.932 742.819 681.505 742.152 682.239 741.673C682.978 741.19 683.839 740.949 684.824 740.949C685.392 740.949 685.953 741.044 686.507 741.233C687.061 741.422 687.566 741.73 688.02 742.156C688.475 742.578 688.837 743.136 689.107 743.832C689.377 744.528 689.512 745.385 689.512 746.403V747.114H681.103V745.665H687.807C687.807 745.049 687.684 744.5 687.438 744.017C687.196 743.534 686.851 743.153 686.401 742.874C685.956 742.594 685.43 742.455 684.824 742.455C684.157 742.455 683.579 742.62 683.091 742.952C682.608 743.278 682.237 743.705 681.976 744.23C681.716 744.756 681.586 745.319 681.586 745.92V746.886C681.586 747.71 681.728 748.409 682.012 748.982C682.301 749.55 682.701 749.983 683.212 750.281C683.723 750.575 684.318 750.722 684.995 750.722C685.435 750.722 685.833 750.66 686.188 750.537C686.548 750.409 686.858 750.22 687.118 749.969C687.379 749.713 687.58 749.396 687.722 749.017L689.341 749.472C689.171 750.021 688.884 750.504 688.482 750.92C688.079 751.332 687.582 751.654 686.99 751.886C686.399 752.114 685.733 752.227 684.995 752.227ZM693.018 741.091L695.632 745.551L698.246 741.091H700.178L696.655 746.545L700.178 752H698.246L695.632 747.767L693.018 752H691.087L694.553 746.545L691.087 741.091H693.018ZM707.314 741.091V742.511H701.66V741.091H707.314ZM703.308 738.477H704.984V748.875C704.984 749.348 705.053 749.704 705.19 749.94C705.332 750.172 705.512 750.329 705.73 750.409C705.952 750.485 706.187 750.523 706.433 750.523C706.618 750.523 706.769 750.513 706.887 750.494C707.006 750.471 707.1 750.452 707.172 750.438L707.512 751.943C707.399 751.986 707.24 752.028 707.037 752.071C706.833 752.118 706.575 752.142 706.262 752.142C705.789 752.142 705.325 752.04 704.87 751.837C704.421 751.633 704.047 751.323 703.748 750.906C703.455 750.49 703.308 749.964 703.308 749.33V738.477ZM720.545 737.455V752H718.784V739.301H718.699L715.147 741.659V739.869L718.784 737.455H720.545ZM733.592 752.256C732.901 752.256 732.273 752.125 731.71 751.865C731.146 751.6 730.699 751.219 730.368 750.722C730.036 750.22 729.87 749.614 729.87 748.903C729.87 748.278 729.993 747.772 730.24 747.384C730.486 746.991 730.815 746.683 731.227 746.46C731.639 746.238 732.093 746.072 732.591 745.963C733.092 745.849 733.597 745.759 734.103 745.693C734.766 745.608 735.304 745.544 735.716 745.501C736.132 745.454 736.435 745.376 736.625 745.267C736.819 745.158 736.916 744.969 736.916 744.699V744.642C736.916 743.941 736.724 743.397 736.341 743.009C735.962 742.62 735.386 742.426 734.615 742.426C733.815 742.426 733.187 742.601 732.733 742.952C732.278 743.302 731.958 743.676 731.774 744.074L730.183 743.506C730.467 742.843 730.846 742.327 731.319 741.957C731.797 741.583 732.318 741.323 732.882 741.176C733.45 741.025 734.009 740.949 734.558 740.949C734.908 740.949 735.311 740.991 735.765 741.077C736.225 741.157 736.667 741.325 737.093 741.581C737.524 741.837 737.882 742.223 738.166 742.739C738.45 743.255 738.592 743.946 738.592 744.812V752H736.916V750.523H736.831C736.717 750.759 736.528 751.013 736.262 751.283C735.997 751.553 735.645 751.782 735.204 751.972C734.764 752.161 734.226 752.256 733.592 752.256ZM733.848 750.75C734.511 750.75 735.069 750.62 735.524 750.359C735.983 750.099 736.329 749.763 736.561 749.351C736.797 748.939 736.916 748.506 736.916 748.051V746.517C736.845 746.602 736.689 746.68 736.447 746.751C736.21 746.818 735.936 746.877 735.623 746.929C735.315 746.976 735.015 747.019 734.721 747.057C734.432 747.09 734.198 747.118 734.018 747.142C733.583 747.199 733.175 747.291 732.797 747.419C732.422 747.542 732.119 747.729 731.887 747.98C731.66 748.226 731.547 748.562 731.547 748.989C731.547 749.571 731.762 750.011 732.193 750.31C732.628 750.603 733.18 750.75 733.848 750.75ZM746.083 752.227C745.06 752.227 744.18 751.986 743.441 751.503C742.702 751.02 742.134 750.355 741.737 749.507C741.339 748.66 741.14 747.691 741.14 746.602C741.14 745.494 741.344 744.517 741.751 743.669C742.163 742.817 742.736 742.152 743.469 741.673C744.208 741.19 745.07 740.949 746.055 740.949C746.822 740.949 747.513 741.091 748.129 741.375C748.744 741.659 749.248 742.057 749.641 742.568C750.034 743.08 750.278 743.676 750.373 744.358H748.697C748.569 743.861 748.285 743.42 747.844 743.037C747.409 742.649 746.822 742.455 746.083 742.455C745.43 742.455 744.857 742.625 744.364 742.966C743.877 743.302 743.496 743.778 743.221 744.393C742.951 745.004 742.816 745.722 742.816 746.545C742.816 747.388 742.949 748.122 743.214 748.747C743.484 749.372 743.862 749.857 744.35 750.203C744.843 750.549 745.42 750.722 746.083 750.722C746.519 750.722 746.914 750.646 747.269 750.494C747.624 750.343 747.925 750.125 748.171 749.841C748.417 749.557 748.593 749.216 748.697 748.818H750.373C750.278 749.462 750.044 750.042 749.67 750.558C749.3 751.07 748.81 751.477 748.2 751.78C747.594 752.078 746.888 752.227 746.083 752.227ZM757.255 752.227C756.232 752.227 755.352 751.986 754.613 751.503C753.874 751.02 753.306 750.355 752.908 749.507C752.511 748.66 752.312 747.691 752.312 746.602C752.312 745.494 752.515 744.517 752.923 743.669C753.335 742.817 753.907 742.152 754.641 741.673C755.38 741.19 756.242 740.949 757.227 740.949C757.994 740.949 758.685 741.091 759.3 741.375C759.916 741.659 760.42 742.057 760.813 742.568C761.206 743.08 761.45 743.676 761.545 744.358H759.869C759.741 743.861 759.457 743.42 759.016 743.037C758.581 742.649 757.994 742.455 757.255 742.455C756.602 742.455 756.029 742.625 755.536 742.966C755.049 743.302 754.667 743.778 754.393 744.393C754.123 745.004 753.988 745.722 753.988 746.545C753.988 747.388 754.121 748.122 754.386 748.747C754.656 749.372 755.034 749.857 755.522 750.203C756.014 750.549 756.592 750.722 757.255 750.722C757.691 750.722 758.086 750.646 758.441 750.494C758.796 750.343 759.097 750.125 759.343 749.841C759.589 749.557 759.764 749.216 759.869 748.818H761.545C761.45 749.462 761.216 750.042 760.842 750.558C760.472 751.07 759.982 751.477 759.371 751.78C758.765 752.078 758.06 752.227 757.255 752.227ZM768.569 752.227C767.518 752.227 766.611 751.995 765.849 751.531C765.091 751.062 764.506 750.409 764.094 749.571C763.687 748.728 763.484 747.748 763.484 746.631C763.484 745.513 763.687 744.528 764.094 743.676C764.506 742.819 765.079 742.152 765.813 741.673C766.552 741.19 767.414 740.949 768.398 740.949C768.967 740.949 769.528 741.044 770.082 741.233C770.636 741.422 771.14 741.73 771.594 742.156C772.049 742.578 772.411 743.136 772.681 743.832C772.951 744.528 773.086 745.385 773.086 746.403V747.114H764.677V745.665H771.381C771.381 745.049 771.258 744.5 771.012 744.017C770.771 743.534 770.425 743.153 769.975 742.874C769.53 742.594 769.004 742.455 768.398 742.455C767.731 742.455 767.153 742.62 766.665 742.952C766.183 743.278 765.811 743.705 765.55 744.23C765.29 744.756 765.16 745.319 765.16 745.92V746.886C765.16 747.71 765.302 748.409 765.586 748.982C765.875 749.55 766.275 749.983 766.786 750.281C767.298 750.575 767.892 750.722 768.569 750.722C769.009 750.722 769.407 750.66 769.762 750.537C770.122 750.409 770.432 750.22 770.692 749.969C770.953 749.713 771.154 749.396 771.296 749.017L772.915 749.472C772.745 750.021 772.459 750.504 772.056 750.92C771.654 751.332 771.156 751.654 770.565 751.886C769.973 752.114 769.308 752.227 768.569 752.227ZM783.363 743.534L781.857 743.96C781.763 743.709 781.623 743.465 781.438 743.229C781.258 742.987 781.012 742.788 780.7 742.632C780.387 742.476 779.987 742.398 779.499 742.398C778.832 742.398 778.275 742.552 777.83 742.859C777.39 743.162 777.17 743.548 777.17 744.017C777.17 744.434 777.321 744.763 777.624 745.004C777.927 745.246 778.401 745.447 779.045 745.608L780.664 746.006C781.639 746.242 782.366 746.605 782.844 747.092C783.323 747.575 783.562 748.198 783.562 748.96C783.562 749.585 783.382 750.144 783.022 750.636C782.667 751.129 782.17 751.517 781.531 751.801C780.891 752.085 780.148 752.227 779.3 752.227C778.188 752.227 777.267 751.986 776.538 751.503C775.808 751.02 775.347 750.314 775.153 749.386L776.744 748.989C776.895 749.576 777.182 750.016 777.603 750.31C778.029 750.603 778.585 750.75 779.272 750.75C780.053 750.75 780.674 750.584 781.133 750.253C781.597 749.917 781.829 749.514 781.829 749.045C781.829 748.667 781.696 748.349 781.431 748.094C781.166 747.833 780.759 747.639 780.21 747.511L778.391 747.085C777.392 746.848 776.658 746.482 776.19 745.984C775.726 745.482 775.494 744.855 775.494 744.102C775.494 743.487 775.666 742.942 776.012 742.469C776.362 741.995 776.838 741.624 777.44 741.354C778.046 741.084 778.732 740.949 779.499 740.949C780.579 740.949 781.426 741.186 782.042 741.659C782.662 742.133 783.103 742.758 783.363 743.534ZM793.812 743.534L792.306 743.96C792.212 743.709 792.072 743.465 791.887 743.229C791.708 742.987 791.461 742.788 791.149 742.632C790.836 742.476 790.436 742.398 789.949 742.398C789.281 742.398 788.725 742.552 788.279 742.859C787.839 743.162 787.619 743.548 787.619 744.017C787.619 744.434 787.77 744.763 788.074 745.004C788.377 745.246 788.85 745.447 789.494 745.608L791.113 746.006C792.089 746.242 792.815 746.605 793.294 747.092C793.772 747.575 794.011 748.198 794.011 748.96C794.011 749.585 793.831 750.144 793.471 750.636C793.116 751.129 792.619 751.517 791.98 751.801C791.341 752.085 790.597 752.227 789.75 752.227C788.637 752.227 787.716 751.986 786.987 751.503C786.258 751.02 785.796 750.314 785.602 749.386L787.193 748.989C787.344 749.576 787.631 750.016 788.052 750.31C788.478 750.603 789.035 750.75 789.721 750.75C790.502 750.75 791.123 750.584 791.582 750.253C792.046 749.917 792.278 749.514 792.278 749.045C792.278 748.667 792.145 748.349 791.88 748.094C791.615 747.833 791.208 747.639 790.659 747.511L788.841 747.085C787.842 746.848 787.108 746.482 786.639 745.984C786.175 745.482 785.943 744.855 785.943 744.102C785.943 743.487 786.116 742.942 786.461 742.469C786.812 741.995 787.288 741.624 787.889 741.354C788.495 741.084 789.181 740.949 789.949 740.949C791.028 740.949 791.876 741.186 792.491 741.659C793.111 742.133 793.552 742.758 793.812 743.534Z" fill="#03031C"/>
+<path d="M921.409 717.54V711.091H923.085V722H921.409V720.153H921.295C921.04 720.707 920.642 721.179 920.102 721.567C919.563 721.95 918.881 722.142 918.057 722.142C917.375 722.142 916.769 721.993 916.239 721.695C915.708 721.392 915.292 720.937 914.989 720.331C914.686 719.72 914.534 718.951 914.534 718.023V711.091H916.21V717.909C916.21 718.705 916.433 719.339 916.878 719.812C917.328 720.286 917.901 720.523 918.597 720.523C919.013 720.523 919.437 720.416 919.868 720.203C920.304 719.99 920.668 719.663 920.962 719.223C921.26 718.783 921.409 718.222 921.409 717.54ZM933.882 713.534L932.377 713.96C932.282 713.709 932.142 713.465 931.958 713.229C931.778 712.987 931.532 712.788 931.219 712.632C930.907 712.476 930.507 712.398 930.019 712.398C929.351 712.398 928.795 712.552 928.35 712.859C927.909 713.162 927.689 713.548 927.689 714.017C927.689 714.434 927.841 714.763 928.144 715.004C928.447 715.246 928.92 715.447 929.564 715.608L931.184 716.006C932.159 716.242 932.886 716.605 933.364 717.092C933.842 717.575 934.081 718.198 934.081 718.96C934.081 719.585 933.901 720.144 933.542 720.636C933.186 721.129 932.689 721.517 932.05 721.801C931.411 722.085 930.667 722.227 929.82 722.227C928.707 722.227 927.786 721.986 927.057 721.503C926.328 721.02 925.866 720.314 925.672 719.386L927.263 718.989C927.415 719.576 927.701 720.016 928.123 720.31C928.549 720.603 929.105 720.75 929.792 720.75C930.573 720.75 931.193 720.584 931.652 720.253C932.116 719.917 932.348 719.514 932.348 719.045C932.348 718.667 932.216 718.349 931.951 718.094C931.685 717.833 931.278 717.639 930.729 717.511L928.911 717.085C927.912 716.848 927.178 716.482 926.709 715.984C926.245 715.482 926.013 714.855 926.013 714.102C926.013 713.487 926.186 712.942 926.532 712.469C926.882 711.995 927.358 711.624 927.959 711.354C928.565 711.084 929.252 710.949 930.019 710.949C931.098 710.949 931.946 711.186 932.561 711.659C933.182 712.133 933.622 712.758 933.882 713.534ZM936.604 722V711.091H938.281V722H936.604ZM937.457 709.273C937.13 709.273 936.848 709.161 936.612 708.939C936.379 708.716 936.263 708.449 936.263 708.136C936.263 707.824 936.379 707.556 936.612 707.334C936.848 707.111 937.13 707 937.457 707C937.783 707 938.063 707.111 938.295 707.334C938.531 707.556 938.65 707.824 938.65 708.136C938.65 708.449 938.531 708.716 938.295 708.939C938.063 709.161 937.783 709.273 937.457 709.273ZM943.027 715.438V722H941.35V711.091H942.97V712.795H943.112C943.368 712.241 943.756 711.796 944.277 711.46C944.797 711.119 945.47 710.949 946.294 710.949C947.032 710.949 947.679 711.1 948.233 711.403C948.787 711.702 949.217 712.156 949.525 712.767C949.833 713.373 949.987 714.14 949.987 715.068V722H948.311V715.182C948.311 714.325 948.088 713.657 947.643 713.179C947.198 712.696 946.587 712.455 945.811 712.455C945.276 712.455 944.797 712.571 944.376 712.803C943.959 713.035 943.63 713.373 943.389 713.818C943.147 714.263 943.027 714.803 943.027 715.438ZM957.453 726.318C956.643 726.318 955.947 726.214 955.365 726.006C954.783 725.802 954.297 725.532 953.909 725.196C953.526 724.865 953.22 724.509 952.993 724.131L954.328 723.193C954.48 723.392 954.671 723.619 954.903 723.875C955.135 724.135 955.453 724.36 955.855 724.55C956.262 724.744 956.795 724.841 957.453 724.841C958.334 724.841 959.061 724.628 959.634 724.202C960.206 723.776 960.493 723.108 960.493 722.199V719.983H960.351C960.228 720.182 960.053 720.428 959.825 720.722C959.603 721.01 959.281 721.268 958.859 721.496C958.443 721.718 957.879 721.83 957.169 721.83C956.288 721.83 955.498 721.621 954.797 721.205C954.101 720.788 953.549 720.182 953.142 719.386C952.74 718.591 952.538 717.625 952.538 716.489C952.538 715.371 952.735 714.398 953.128 713.57C953.521 712.736 954.068 712.092 954.768 711.638C955.469 711.179 956.279 710.949 957.197 710.949C957.908 710.949 958.471 711.067 958.888 711.304C959.309 711.536 959.631 711.801 959.854 712.099C960.081 712.393 960.256 712.634 960.379 712.824H960.55V711.091H962.169V722.312C962.169 723.25 961.956 724.012 961.53 724.599C961.108 725.191 960.54 725.625 959.825 725.899C959.115 726.179 958.324 726.318 957.453 726.318ZM957.396 720.324C958.069 720.324 958.637 720.17 959.101 719.862C959.565 719.554 959.918 719.112 960.159 718.534C960.401 717.956 960.521 717.265 960.521 716.46C960.521 715.674 960.403 714.981 960.166 714.379C959.929 713.778 959.579 713.307 959.115 712.966C958.651 712.625 958.078 712.455 957.396 712.455C956.686 712.455 956.094 712.634 955.621 712.994C955.152 713.354 954.799 713.837 954.562 714.443C954.33 715.049 954.214 715.722 954.214 716.46C954.214 717.218 954.333 717.888 954.57 718.47C954.811 719.048 955.166 719.502 955.635 719.834C956.108 720.161 956.696 720.324 957.396 720.324ZM983.362 714.727C983.362 716.261 983.085 717.587 982.531 718.705C981.977 719.822 981.217 720.684 980.251 721.29C979.286 721.896 978.182 722.199 976.942 722.199C975.701 722.199 974.598 721.896 973.632 721.29C972.666 720.684 971.906 719.822 971.352 718.705C970.798 717.587 970.521 716.261 970.521 714.727C970.521 713.193 970.798 711.867 971.352 710.75C971.906 709.633 972.666 708.771 973.632 708.165C974.598 707.559 975.701 707.256 976.942 707.256C978.182 707.256 979.286 707.559 980.251 708.165C981.217 708.771 981.977 709.633 982.531 710.75C983.085 711.867 983.362 713.193 983.362 714.727ZM981.658 714.727C981.658 713.468 981.447 712.405 981.026 711.538C980.609 710.672 980.043 710.016 979.328 709.571C978.618 709.126 977.822 708.903 976.942 708.903C976.061 708.903 975.263 709.126 974.548 709.571C973.838 710.016 973.272 710.672 972.851 711.538C972.434 712.405 972.226 713.468 972.226 714.727C972.226 715.987 972.434 717.05 972.851 717.916C973.272 718.783 973.838 719.438 974.548 719.884C975.263 720.329 976.061 720.551 976.942 720.551C977.822 720.551 978.618 720.329 979.328 719.884C980.043 719.438 980.609 718.783 981.026 717.916C981.447 717.05 981.658 715.987 981.658 714.727ZM986.097 726.091V711.091H987.716V712.824H987.915C988.038 712.634 988.208 712.393 988.426 712.099C988.649 711.801 988.966 711.536 989.378 711.304C989.795 711.067 990.358 710.949 991.068 710.949C991.987 710.949 992.796 711.179 993.497 711.638C994.198 712.097 994.745 712.748 995.138 713.591C995.531 714.434 995.727 715.428 995.727 716.574C995.727 717.729 995.531 718.731 995.138 719.578C994.745 720.421 994.2 721.074 993.504 721.538C992.808 721.998 992.006 722.227 991.097 722.227C990.396 722.227 989.835 722.111 989.413 721.879C988.992 721.643 988.668 721.375 988.44 721.077C988.213 720.774 988.038 720.523 987.915 720.324H987.773V726.091H986.097ZM987.744 716.545C987.744 717.369 987.865 718.096 988.107 718.726C988.348 719.351 988.701 719.841 989.165 720.196C989.629 720.546 990.197 720.722 990.869 720.722C991.57 720.722 992.155 720.537 992.624 720.168C993.097 719.794 993.452 719.292 993.689 718.662C993.93 718.027 994.051 717.322 994.051 716.545C994.051 715.778 993.933 715.087 993.696 714.472C993.464 713.851 993.111 713.361 992.638 713.001C992.169 712.637 991.58 712.455 990.869 712.455C990.188 712.455 989.615 712.627 989.151 712.973C988.687 713.314 988.336 713.792 988.099 714.408C987.863 715.018 987.744 715.731 987.744 716.545ZM1002.86 722.227C1001.81 722.227 1000.9 721.995 1000.14 721.531C999.38 721.062 998.795 720.409 998.384 719.571C997.976 718.728 997.773 717.748 997.773 716.631C997.773 715.513 997.976 714.528 998.384 713.676C998.795 712.819 999.368 712.152 1000.1 711.673C1000.84 711.19 1001.7 710.949 1002.69 710.949C1003.26 710.949 1003.82 711.044 1004.37 711.233C1004.92 711.422 1005.43 711.73 1005.88 712.156C1006.34 712.578 1006.7 713.136 1006.97 713.832C1007.24 714.528 1007.38 715.385 1007.38 716.403V717.114H998.966V715.665H1005.67C1005.67 715.049 1005.55 714.5 1005.3 714.017C1005.06 713.534 1004.71 713.153 1004.26 712.874C1003.82 712.594 1003.29 712.455 1002.69 712.455C1002.02 712.455 1001.44 712.62 1000.95 712.952C1000.47 713.278 1000.1 713.705 999.839 714.23C999.579 714.756 999.449 715.319 999.449 715.92V716.886C999.449 717.71 999.591 718.409 999.875 718.982C1000.16 719.55 1000.56 719.983 1001.08 720.281C1001.59 720.575 1002.18 720.722 1002.86 720.722C1003.3 720.722 1003.7 720.66 1004.05 720.537C1004.41 720.409 1004.72 720.22 1004.98 719.969C1005.24 719.713 1005.44 719.396 1005.59 719.017L1007.2 719.472C1007.03 720.021 1006.75 720.504 1006.35 720.92C1005.94 721.332 1005.45 721.654 1004.85 721.886C1004.26 722.114 1003.6 722.227 1002.86 722.227ZM1009.92 722V711.091H1011.54V712.739H1011.66C1011.86 712.199 1012.22 711.761 1012.74 711.425C1013.26 711.089 1013.85 710.92 1014.5 710.92C1014.62 710.92 1014.78 710.923 1014.96 710.928C1015.14 710.932 1015.28 710.939 1015.38 710.949V712.653C1015.32 712.639 1015.19 712.618 1014.99 712.589C1014.79 712.556 1014.58 712.54 1014.36 712.54C1013.83 712.54 1013.35 712.651 1012.94 712.874C1012.52 713.091 1012.2 713.394 1011.96 713.783C1011.72 714.166 1011.6 714.604 1011.6 715.097V722H1009.92ZM1020.58 722.256C1019.89 722.256 1019.26 722.125 1018.69 721.865C1018.13 721.6 1017.68 721.219 1017.35 720.722C1017.02 720.22 1016.85 719.614 1016.85 718.903C1016.85 718.278 1016.98 717.772 1017.22 717.384C1017.47 716.991 1017.8 716.683 1018.21 716.46C1018.62 716.238 1019.08 716.072 1019.57 715.963C1020.08 715.849 1020.58 715.759 1021.09 715.693C1021.75 715.608 1022.29 715.544 1022.7 715.501C1023.12 715.454 1023.42 715.376 1023.61 715.267C1023.8 715.158 1023.9 714.969 1023.9 714.699V714.642C1023.9 713.941 1023.71 713.397 1023.32 713.009C1022.95 712.62 1022.37 712.426 1021.6 712.426C1020.8 712.426 1020.17 712.601 1019.72 712.952C1019.26 713.302 1018.94 713.676 1018.76 714.074L1017.17 713.506C1017.45 712.843 1017.83 712.327 1018.3 711.957C1018.78 711.583 1019.3 711.323 1019.87 711.176C1020.43 711.025 1020.99 710.949 1021.54 710.949C1021.89 710.949 1022.3 710.991 1022.75 711.077C1023.21 711.157 1023.65 711.325 1024.08 711.581C1024.51 711.837 1024.87 712.223 1025.15 712.739C1025.43 713.255 1025.58 713.946 1025.58 714.812V722H1023.9V720.523H1023.81C1023.7 720.759 1023.51 721.013 1023.25 721.283C1022.98 721.553 1022.63 721.782 1022.19 721.972C1021.75 722.161 1021.21 722.256 1020.58 722.256ZM1020.83 720.75C1021.49 720.75 1022.05 720.62 1022.51 720.359C1022.97 720.099 1023.31 719.763 1023.55 719.351C1023.78 718.939 1023.9 718.506 1023.9 718.051V716.517C1023.83 716.602 1023.67 716.68 1023.43 716.751C1023.19 716.818 1022.92 716.877 1022.61 716.929C1022.3 716.976 1022 717.019 1021.71 717.057C1021.42 717.09 1021.18 717.118 1021 717.142C1020.57 717.199 1020.16 717.291 1019.78 717.419C1019.41 717.542 1019.1 717.729 1018.87 717.98C1018.64 718.226 1018.53 718.562 1018.53 718.989C1018.53 719.571 1018.75 720.011 1019.18 720.31C1019.61 720.603 1020.16 720.75 1020.83 720.75ZM1033.38 711.091V712.511H1027.73V711.091H1033.38ZM1029.37 708.477H1031.05V718.875C1031.05 719.348 1031.12 719.704 1031.26 719.94C1031.4 720.172 1031.58 720.329 1031.8 720.409C1032.02 720.485 1032.25 720.523 1032.5 720.523C1032.68 720.523 1032.84 720.513 1032.95 720.494C1033.07 720.471 1033.17 720.452 1033.24 720.438L1033.58 721.943C1033.47 721.986 1033.31 722.028 1033.1 722.071C1032.9 722.118 1032.64 722.142 1032.33 722.142C1031.86 722.142 1031.39 722.04 1030.94 721.837C1030.49 721.633 1030.11 721.323 1029.81 720.906C1029.52 720.49 1029.37 719.964 1029.37 719.33V708.477ZM1040.22 722.227C1039.23 722.227 1038.37 721.993 1037.62 721.524C1036.88 721.055 1036.31 720.4 1035.89 719.557C1035.48 718.714 1035.27 717.729 1035.27 716.602C1035.27 715.466 1035.48 714.474 1035.89 713.626C1036.31 712.779 1036.88 712.121 1037.62 711.652C1038.37 711.183 1039.23 710.949 1040.22 710.949C1041.2 710.949 1042.06 711.183 1042.8 711.652C1043.54 712.121 1044.12 712.779 1044.53 713.626C1044.95 714.474 1045.16 715.466 1045.16 716.602C1045.16 717.729 1044.95 718.714 1044.53 719.557C1044.12 720.4 1043.54 721.055 1042.8 721.524C1042.06 721.993 1041.2 722.227 1040.22 722.227ZM1040.22 720.722C1040.96 720.722 1041.58 720.53 1042.06 720.146C1042.55 719.763 1042.9 719.259 1043.13 718.634C1043.37 718.009 1043.48 717.331 1043.48 716.602C1043.48 715.873 1043.37 715.194 1043.13 714.564C1042.9 713.934 1042.55 713.425 1042.06 713.037C1041.58 712.649 1040.96 712.455 1040.22 712.455C1039.47 712.455 1038.85 712.649 1038.37 713.037C1037.89 713.425 1037.53 713.934 1037.3 714.564C1037.06 715.194 1036.95 715.873 1036.95 716.602C1036.95 717.331 1037.06 718.009 1037.3 718.634C1037.53 719.259 1037.89 719.763 1038.37 720.146C1038.85 720.53 1039.47 720.722 1040.22 720.722ZM1047.72 722V711.091H1049.34V712.739H1049.45C1049.65 712.199 1050.01 711.761 1050.53 711.425C1051.05 711.089 1051.64 710.92 1052.29 710.92C1052.41 710.92 1052.57 710.923 1052.75 710.928C1052.94 710.932 1053.08 710.939 1053.17 710.949V712.653C1053.12 712.639 1052.99 712.618 1052.78 712.589C1052.58 712.556 1052.37 712.54 1052.15 712.54C1051.62 712.54 1051.15 712.651 1050.73 712.874C1050.32 713.091 1049.99 713.394 1049.75 713.783C1049.51 714.166 1049.39 714.604 1049.39 715.097V722H1047.72ZM926.466 742H924.705C924.6 741.493 924.418 741.048 924.158 740.665C923.902 740.281 923.589 739.959 923.22 739.699C922.856 739.434 922.451 739.235 922.006 739.102C921.561 738.97 921.097 738.903 920.614 738.903C919.733 738.903 918.935 739.126 918.22 739.571C917.51 740.016 916.944 740.672 916.523 741.538C916.106 742.405 915.898 743.468 915.898 744.727C915.898 745.987 916.106 747.05 916.523 747.916C916.944 748.783 917.51 749.438 918.22 749.884C918.935 750.329 919.733 750.551 920.614 750.551C921.097 750.551 921.561 750.485 922.006 750.352C922.451 750.22 922.856 750.023 923.22 749.763C923.589 749.498 923.902 749.173 924.158 748.79C924.418 748.402 924.6 747.956 924.705 747.455H926.466C926.333 748.198 926.092 748.863 925.741 749.45C925.391 750.037 924.955 750.537 924.435 750.949C923.914 751.356 923.329 751.666 922.68 751.879C922.036 752.092 921.348 752.199 920.614 752.199C919.373 752.199 918.27 751.896 917.304 751.29C916.338 750.684 915.578 749.822 915.024 748.705C914.47 747.587 914.193 746.261 914.193 744.727C914.193 743.193 914.47 741.867 915.024 740.75C915.578 739.633 916.338 738.771 917.304 738.165C918.27 737.559 919.373 737.256 920.614 737.256C921.348 737.256 922.036 737.362 922.68 737.575C923.329 737.788 923.914 738.101 924.435 738.513C924.955 738.92 925.391 739.417 925.741 740.004C926.092 740.587 926.333 741.252 926.466 742ZM933.517 752.227C932.532 752.227 931.668 751.993 930.924 751.524C930.186 751.055 929.608 750.4 929.191 749.557C928.779 748.714 928.574 747.729 928.574 746.602C928.574 745.466 928.779 744.474 929.191 743.626C929.608 742.779 930.186 742.121 930.924 741.652C931.668 741.183 932.532 740.949 933.517 740.949C934.502 740.949 935.363 741.183 936.102 741.652C936.845 742.121 937.423 742.779 937.835 743.626C938.252 744.474 938.46 745.466 938.46 746.602C938.46 747.729 938.252 748.714 937.835 749.557C937.423 750.4 936.845 751.055 936.102 751.524C935.363 751.993 934.502 752.227 933.517 752.227ZM933.517 750.722C934.265 750.722 934.88 750.53 935.363 750.146C935.846 749.763 936.204 749.259 936.436 748.634C936.668 748.009 936.784 747.331 936.784 746.602C936.784 745.873 936.668 745.194 936.436 744.564C936.204 743.934 935.846 743.425 935.363 743.037C934.88 742.649 934.265 742.455 933.517 742.455C932.769 742.455 932.153 742.649 931.67 743.037C931.187 743.425 930.83 743.934 930.598 744.564C930.366 745.194 930.25 745.873 930.25 746.602C930.25 747.331 930.366 748.009 930.598 748.634C930.83 749.259 931.187 749.763 931.67 750.146C932.153 750.53 932.769 750.722 933.517 750.722ZM942.695 745.438V752H941.018V741.091H942.638V742.795H942.78C943.036 742.241 943.424 741.796 943.945 741.46C944.465 741.119 945.138 740.949 945.962 740.949C946.7 740.949 947.347 741.1 947.901 741.403C948.455 741.702 948.885 742.156 949.193 742.767C949.501 743.373 949.655 744.14 949.655 745.068V752H947.979V745.182C947.979 744.325 947.756 743.657 947.311 743.179C946.866 742.696 946.255 742.455 945.479 742.455C944.944 742.455 944.465 742.571 944.044 742.803C943.627 743.035 943.298 743.373 943.057 743.818C942.815 744.263 942.695 744.803 942.695 745.438ZM957.462 741.091V742.511H951.809V741.091H957.462ZM953.456 738.477H955.132V748.875C955.132 749.348 955.201 749.704 955.338 749.94C955.48 750.172 955.66 750.329 955.878 750.409C956.101 750.485 956.335 750.523 956.581 750.523C956.766 750.523 956.917 750.513 957.036 750.494C957.154 750.471 957.249 750.452 957.32 750.438L957.661 751.943C957.547 751.986 957.389 752.028 957.185 752.071C956.981 752.118 956.723 752.142 956.411 752.142C955.937 752.142 955.473 752.04 955.019 751.837C954.569 751.633 954.195 751.323 953.897 750.906C953.603 750.49 953.456 749.964 953.456 749.33V738.477ZM964.44 752.227C963.389 752.227 962.482 751.995 961.72 751.531C960.962 751.062 960.377 750.409 959.966 749.571C959.558 748.728 959.355 747.748 959.355 746.631C959.355 745.513 959.558 744.528 959.966 743.676C960.377 742.819 960.95 742.152 961.684 741.673C962.423 741.19 963.285 740.949 964.27 740.949C964.838 740.949 965.399 741.044 965.953 741.233C966.507 741.422 967.011 741.73 967.466 742.156C967.92 742.578 968.282 743.136 968.552 743.832C968.822 744.528 968.957 745.385 968.957 746.403V747.114H960.548V745.665H967.252C967.252 745.049 967.129 744.5 966.883 744.017C966.642 743.534 966.296 743.153 965.846 742.874C965.401 742.594 964.876 742.455 964.27 742.455C963.602 742.455 963.024 742.62 962.537 742.952C962.054 743.278 961.682 743.705 961.422 744.23C961.161 744.756 961.031 745.319 961.031 745.92V746.886C961.031 747.71 961.173 748.409 961.457 748.982C961.746 749.55 962.146 749.983 962.657 750.281C963.169 750.575 963.763 750.722 964.44 750.722C964.88 750.722 965.278 750.66 965.633 750.537C965.993 750.409 966.303 750.22 966.564 749.969C966.824 749.713 967.025 749.396 967.167 749.017L968.787 749.472C968.616 750.021 968.33 750.504 967.927 750.92C967.525 751.332 967.028 751.654 966.436 751.886C965.844 752.114 965.179 752.227 964.44 752.227ZM972.464 741.091L975.077 745.551L977.691 741.091H979.623L976.1 746.545L979.623 752H977.691L975.077 747.767L972.464 752H970.532L973.998 746.545L970.532 741.091H972.464ZM986.759 741.091V742.511H981.105V741.091H986.759ZM982.753 738.477H984.429V748.875C984.429 749.348 984.498 749.704 984.635 749.94C984.777 750.172 984.957 750.329 985.175 750.409C985.398 750.485 985.632 750.523 985.878 750.523C986.063 750.523 986.214 750.513 986.333 750.494C986.451 750.471 986.546 750.452 986.617 750.438L986.958 751.943C986.844 751.986 986.685 752.028 986.482 752.071C986.278 752.118 986.02 752.142 985.708 752.142C985.234 752.142 984.77 752.04 984.316 751.837C983.866 751.633 983.492 751.323 983.194 750.906C982.9 750.49 982.753 749.964 982.753 749.33V738.477ZM994.877 752V750.722L999.678 745.466C1000.24 744.85 1000.71 744.315 1001.07 743.861C1001.43 743.402 1001.7 742.971 1001.88 742.568C1002.06 742.161 1002.15 741.735 1002.15 741.29C1002.15 740.778 1002.03 740.336 1001.78 739.962C1001.54 739.588 1001.21 739.299 1000.79 739.095C1000.36 738.892 999.891 738.79 999.365 738.79C998.807 738.79 998.319 738.906 997.902 739.138C997.49 739.365 997.171 739.685 996.944 740.097C996.721 740.509 996.61 740.991 996.61 741.545H994.934C994.934 740.693 995.13 739.945 995.523 739.301C995.916 738.657 996.451 738.155 997.128 737.795C997.81 737.436 998.575 737.256 999.422 737.256C1000.27 737.256 1001.03 737.436 1001.69 737.795C1002.35 738.155 1002.86 738.641 1003.24 739.251C1003.61 739.862 1003.8 740.542 1003.8 741.29C1003.8 741.825 1003.7 742.348 1003.51 742.859C1003.32 743.366 1002.99 743.932 1002.51 744.557C1002.04 745.177 1001.39 745.935 1000.56 746.83L997.292 750.324V750.438H1004.05V752H994.877ZM1015.85 752.256C1015.16 752.256 1014.53 752.125 1013.97 751.865C1013.4 751.6 1012.96 751.219 1012.63 750.722C1012.29 750.22 1012.13 749.614 1012.13 748.903C1012.13 748.278 1012.25 747.772 1012.5 747.384C1012.74 746.991 1013.07 746.683 1013.48 746.46C1013.9 746.238 1014.35 746.072 1014.85 745.963C1015.35 745.849 1015.85 745.759 1016.36 745.693C1017.02 745.608 1017.56 745.544 1017.97 745.501C1018.39 745.454 1018.69 745.376 1018.88 745.267C1019.08 745.158 1019.17 744.969 1019.17 744.699V744.642C1019.17 743.941 1018.98 743.397 1018.6 743.009C1018.22 742.62 1017.64 742.426 1016.87 742.426C1016.07 742.426 1015.44 742.601 1014.99 742.952C1014.54 743.302 1014.22 743.676 1014.03 744.074L1012.44 743.506C1012.72 742.843 1013.1 742.327 1013.58 741.957C1014.06 741.583 1014.58 741.323 1015.14 741.176C1015.71 741.025 1016.27 740.949 1016.82 740.949C1017.17 740.949 1017.57 740.991 1018.02 741.077C1018.48 741.157 1018.93 741.325 1019.35 741.581C1019.78 741.837 1020.14 742.223 1020.42 742.739C1020.71 743.255 1020.85 743.946 1020.85 744.812V752H1019.17V750.523H1019.09C1018.97 750.759 1018.79 751.013 1018.52 751.283C1018.26 751.553 1017.9 751.782 1017.46 751.972C1017.02 752.161 1016.48 752.256 1015.85 752.256ZM1016.11 750.75C1016.77 750.75 1017.33 750.62 1017.78 750.359C1018.24 750.099 1018.59 749.763 1018.82 749.351C1019.06 748.939 1019.17 748.506 1019.17 748.051V746.517C1019.1 746.602 1018.95 746.68 1018.7 746.751C1018.47 746.818 1018.19 746.877 1017.88 746.929C1017.57 746.976 1017.27 747.019 1016.98 747.057C1016.69 747.09 1016.46 747.118 1016.28 747.142C1015.84 747.199 1015.43 747.291 1015.05 747.419C1014.68 747.542 1014.38 747.729 1014.15 747.98C1013.92 748.226 1013.8 748.562 1013.8 748.989C1013.8 749.571 1014.02 750.011 1014.45 750.31C1014.89 750.603 1015.44 750.75 1016.11 750.75ZM1028.34 752.227C1027.32 752.227 1026.44 751.986 1025.7 751.503C1024.96 751.02 1024.39 750.355 1023.99 749.507C1023.6 748.66 1023.4 747.691 1023.4 746.602C1023.4 745.494 1023.6 744.517 1024.01 743.669C1024.42 742.817 1024.99 742.152 1025.73 741.673C1026.47 741.19 1027.33 740.949 1028.31 740.949C1029.08 740.949 1029.77 741.091 1030.39 741.375C1031 741.659 1031.51 742.057 1031.9 742.568C1032.29 743.08 1032.54 743.676 1032.63 744.358H1030.95C1030.83 743.861 1030.54 743.42 1030.1 743.037C1029.67 742.649 1029.08 742.455 1028.34 742.455C1027.69 742.455 1027.11 742.625 1026.62 742.966C1026.13 743.302 1025.75 743.778 1025.48 744.393C1025.21 745.004 1025.07 745.722 1025.07 746.545C1025.07 747.388 1025.21 748.122 1025.47 748.747C1025.74 749.372 1026.12 749.857 1026.61 750.203C1027.1 750.549 1027.68 750.722 1028.34 750.722C1028.78 750.722 1029.17 750.646 1029.53 750.494C1029.88 750.343 1030.18 750.125 1030.43 749.841C1030.68 749.557 1030.85 749.216 1030.95 748.818H1032.63C1032.54 749.462 1032.3 750.042 1031.93 750.558C1031.56 751.07 1031.07 751.477 1030.46 751.78C1029.85 752.078 1029.15 752.227 1028.34 752.227ZM1039.51 752.227C1038.49 752.227 1037.61 751.986 1036.87 751.503C1036.13 751.02 1035.56 750.355 1035.17 749.507C1034.77 748.66 1034.57 747.691 1034.57 746.602C1034.57 745.494 1034.77 744.517 1035.18 743.669C1035.59 742.817 1036.17 742.152 1036.9 741.673C1037.64 741.19 1038.5 740.949 1039.48 740.949C1040.25 740.949 1040.94 741.091 1041.56 741.375C1042.17 741.659 1042.68 742.057 1043.07 742.568C1043.46 743.08 1043.71 743.676 1043.8 744.358H1042.13C1042 743.861 1041.71 743.42 1041.27 743.037C1040.84 742.649 1040.25 742.455 1039.51 742.455C1038.86 742.455 1038.29 742.625 1037.79 742.966C1037.31 743.302 1036.93 743.778 1036.65 744.393C1036.38 745.004 1036.25 745.722 1036.25 746.545C1036.25 747.388 1036.38 748.122 1036.64 748.747C1036.91 749.372 1037.29 749.857 1037.78 750.203C1038.27 750.549 1038.85 750.722 1039.51 750.722C1039.95 750.722 1040.34 750.646 1040.7 750.494C1041.05 750.343 1041.35 750.125 1041.6 749.841C1041.85 749.557 1042.02 749.216 1042.13 748.818H1043.8C1043.71 749.462 1043.47 750.042 1043.1 750.558C1042.73 751.07 1042.24 751.477 1041.63 751.78C1041.02 752.078 1040.32 752.227 1039.51 752.227ZM1050.83 752.227C1049.78 752.227 1048.87 751.995 1048.11 751.531C1047.35 751.062 1046.76 750.409 1046.35 749.571C1045.95 748.728 1045.74 747.748 1045.74 746.631C1045.74 745.513 1045.95 744.528 1046.35 743.676C1046.76 742.819 1047.34 742.152 1048.07 741.673C1048.81 741.19 1049.67 740.949 1050.66 740.949C1051.22 740.949 1051.79 741.044 1052.34 741.233C1052.89 741.422 1053.4 741.73 1053.85 742.156C1054.31 742.578 1054.67 743.136 1054.94 743.832C1055.21 744.528 1055.34 745.385 1055.34 746.403V747.114H1046.93V745.665H1053.64C1053.64 745.049 1053.52 744.5 1053.27 744.017C1053.03 743.534 1052.68 743.153 1052.23 742.874C1051.79 742.594 1051.26 742.455 1050.66 742.455C1049.99 742.455 1049.41 742.62 1048.92 742.952C1048.44 743.278 1048.07 743.705 1047.81 744.23C1047.55 744.756 1047.42 745.319 1047.42 745.92V746.886C1047.42 747.71 1047.56 748.409 1047.84 748.982C1048.13 749.55 1048.53 749.983 1049.04 750.281C1049.56 750.575 1050.15 750.722 1050.83 750.722C1051.27 750.722 1051.66 750.66 1052.02 750.537C1052.38 750.409 1052.69 750.22 1052.95 749.969C1053.21 749.713 1053.41 749.396 1053.55 749.017L1055.17 749.472C1055 750.021 1054.72 750.504 1054.31 750.92C1053.91 751.332 1053.41 751.654 1052.82 751.886C1052.23 752.114 1051.57 752.227 1050.83 752.227ZM1065.62 743.534L1064.12 743.96C1064.02 743.709 1063.88 743.465 1063.7 743.229C1063.52 742.987 1063.27 742.788 1062.96 742.632C1062.64 742.476 1062.24 742.398 1061.76 742.398C1061.09 742.398 1060.53 742.552 1060.09 742.859C1059.65 743.162 1059.43 743.548 1059.43 744.017C1059.43 744.434 1059.58 744.763 1059.88 745.004C1060.19 745.246 1060.66 745.447 1061.3 745.608L1062.92 746.006C1063.9 746.242 1064.62 746.605 1065.1 747.092C1065.58 747.575 1065.82 748.198 1065.82 748.96C1065.82 749.585 1065.64 750.144 1065.28 750.636C1064.92 751.129 1064.43 751.517 1063.79 751.801C1063.15 752.085 1062.41 752.227 1061.56 752.227C1060.45 752.227 1059.52 751.986 1058.8 751.503C1058.07 751.02 1057.6 750.314 1057.41 749.386L1059 748.989C1059.15 749.576 1059.44 750.016 1059.86 750.31C1060.29 750.603 1060.84 750.75 1061.53 750.75C1062.31 750.75 1062.93 750.584 1063.39 750.253C1063.85 749.917 1064.09 749.514 1064.09 749.045C1064.09 748.667 1063.95 748.349 1063.69 748.094C1063.42 747.833 1063.02 747.639 1062.47 747.511L1060.65 747.085C1059.65 746.848 1058.92 746.482 1058.45 745.984C1057.98 745.482 1057.75 744.855 1057.75 744.102C1057.75 743.487 1057.92 742.942 1058.27 742.469C1058.62 741.995 1059.1 741.624 1059.7 741.354C1060.3 741.084 1060.99 740.949 1061.76 740.949C1062.84 740.949 1063.68 741.186 1064.3 741.659C1064.92 742.133 1065.36 742.758 1065.62 743.534ZM1076.07 743.534L1074.56 743.96C1074.47 743.709 1074.33 743.465 1074.15 743.229C1073.97 742.987 1073.72 742.788 1073.41 742.632C1073.09 742.476 1072.69 742.398 1072.21 742.398C1071.54 742.398 1070.98 742.552 1070.54 742.859C1070.1 743.162 1069.88 743.548 1069.88 744.017C1069.88 744.434 1070.03 744.763 1070.33 745.004C1070.63 745.246 1071.11 745.447 1071.75 745.608L1073.37 746.006C1074.35 746.242 1075.07 746.605 1075.55 747.092C1076.03 747.575 1076.27 748.198 1076.27 748.96C1076.27 749.585 1076.09 750.144 1075.73 750.636C1075.37 751.129 1074.88 751.517 1074.24 751.801C1073.6 752.085 1072.85 752.227 1072.01 752.227C1070.89 752.227 1069.97 751.986 1069.24 751.503C1068.52 751.02 1068.05 750.314 1067.86 749.386L1069.45 748.989C1069.6 749.576 1069.89 750.016 1070.31 750.31C1070.74 750.603 1071.29 750.75 1071.98 750.75C1072.76 750.75 1073.38 750.584 1073.84 750.253C1074.3 749.917 1074.54 749.514 1074.54 749.045C1074.54 748.667 1074.4 748.349 1074.14 748.094C1073.87 747.833 1073.47 747.639 1072.92 747.511L1071.1 747.085C1070.1 746.848 1069.37 746.482 1068.9 745.984C1068.43 745.482 1068.2 744.855 1068.2 744.102C1068.2 743.487 1068.37 742.942 1068.72 742.469C1069.07 741.995 1069.55 741.624 1070.15 741.354C1070.75 741.084 1071.44 740.949 1072.21 740.949C1073.29 740.949 1074.13 741.186 1074.75 741.659C1075.37 742.133 1075.81 742.758 1076.07 743.534Z" fill="#03031C"/>
+<g filter="url(#filter0_bd_12_480)">
+<rect x="126" y="1038" width="210" height="225" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="126.5" y="1038.5" width="209" height="224" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M183.019 1194V1175.82H189.163C190.589 1175.82 191.755 1176.08 192.66 1176.59C193.572 1177.1 194.247 1177.79 194.685 1178.66C195.123 1179.53 195.342 1180.5 195.342 1181.57C195.342 1182.64 195.123 1183.62 194.685 1184.49C194.253 1185.37 193.584 1186.07 192.678 1186.59C191.773 1187.1 190.613 1187.36 189.198 1187.36H184.795V1185.41H189.127C190.104 1185.41 190.888 1185.24 191.48 1184.9C192.072 1184.56 192.501 1184.11 192.767 1183.53C193.039 1182.95 193.175 1182.3 193.175 1181.57C193.175 1180.84 193.039 1180.19 192.767 1179.62C192.501 1179.04 192.069 1178.59 191.471 1178.27C190.873 1177.94 190.08 1177.77 189.092 1177.77H185.221V1194H183.019ZM200.699 1175.82V1194H198.604V1175.82H200.699ZM208.55 1194.32C207.685 1194.32 206.901 1194.16 206.197 1193.83C205.493 1193.5 204.933 1193.02 204.519 1192.4C204.105 1191.77 203.898 1191.02 203.898 1190.13C203.898 1189.35 204.051 1188.71 204.359 1188.23C204.667 1187.74 205.078 1187.35 205.593 1187.08C206.108 1186.8 206.676 1186.59 207.298 1186.45C207.925 1186.31 208.555 1186.2 209.189 1186.12C210.017 1186.01 210.689 1185.93 211.204 1185.88C211.725 1185.82 212.104 1185.72 212.34 1185.58C212.583 1185.45 212.704 1185.21 212.704 1184.87V1184.8C212.704 1183.93 212.465 1183.25 211.985 1182.76C211.512 1182.28 210.793 1182.03 209.828 1182.03C208.828 1182.03 208.044 1182.25 207.475 1182.69C206.907 1183.13 206.508 1183.6 206.277 1184.09L204.288 1183.38C204.643 1182.55 205.117 1181.91 205.709 1181.45C206.306 1180.98 206.957 1180.65 207.662 1180.47C208.372 1180.28 209.07 1180.19 209.757 1180.19C210.195 1180.19 210.698 1180.24 211.266 1180.35C211.84 1180.45 212.394 1180.66 212.926 1180.98C213.465 1181.3 213.912 1181.78 214.267 1182.42C214.622 1183.07 214.8 1183.93 214.8 1185.02V1194H212.704V1192.15H212.598C212.456 1192.45 212.219 1192.77 211.888 1193.1C211.556 1193.44 211.115 1193.73 210.565 1193.96C210.014 1194.2 209.343 1194.32 208.55 1194.32ZM208.869 1192.44C209.698 1192.44 210.396 1192.27 210.964 1191.95C211.538 1191.62 211.97 1191.2 212.26 1190.69C212.556 1190.17 212.704 1189.63 212.704 1189.06V1187.15C212.616 1187.25 212.42 1187.35 212.118 1187.44C211.823 1187.52 211.479 1187.6 211.089 1187.66C210.704 1187.72 210.328 1187.77 209.961 1187.82C209.6 1187.86 209.307 1187.9 209.082 1187.93C208.538 1188 208.029 1188.11 207.555 1188.27C207.088 1188.43 206.709 1188.66 206.419 1188.98C206.135 1189.28 205.993 1189.7 205.993 1190.24C205.993 1190.96 206.262 1191.51 206.801 1191.89C207.345 1192.25 208.035 1192.44 208.869 1192.44ZM224.554 1180.36V1182.14H217.487V1180.36H224.554ZM219.547 1177.1H221.642V1190.09C221.642 1190.69 221.728 1191.13 221.9 1191.43C222.077 1191.72 222.302 1191.91 222.574 1192.01C222.852 1192.11 223.145 1192.15 223.453 1192.15C223.684 1192.15 223.873 1192.14 224.021 1192.12C224.169 1192.09 224.288 1192.06 224.377 1192.05L224.803 1193.93C224.661 1193.98 224.462 1194.04 224.208 1194.09C223.953 1194.15 223.631 1194.18 223.24 1194.18C222.648 1194.18 222.068 1194.05 221.5 1193.8C220.938 1193.54 220.47 1193.15 220.097 1192.63C219.73 1192.11 219.547 1191.46 219.547 1190.66V1177.1ZM233.778 1180.36V1182.14H226.427V1180.36H233.778ZM228.629 1194V1178.48C228.629 1177.7 228.812 1177.05 229.179 1176.53C229.546 1176.01 230.023 1175.62 230.609 1175.36C231.195 1175.1 231.813 1174.97 232.464 1174.97C232.979 1174.97 233.399 1175.01 233.725 1175.09C234.05 1175.17 234.293 1175.25 234.453 1175.32L233.849 1177.13C233.743 1177.1 233.595 1177.05 233.405 1177C233.222 1176.95 232.979 1176.92 232.677 1176.92C231.985 1176.92 231.485 1177.09 231.177 1177.44C230.875 1177.79 230.724 1178.3 230.724 1178.98V1194H228.629ZM241.693 1194.28C240.462 1194.28 239.382 1193.99 238.452 1193.41C237.529 1192.82 236.807 1192 236.286 1190.95C235.771 1189.89 235.514 1188.66 235.514 1187.25C235.514 1185.83 235.771 1184.59 236.286 1183.53C236.807 1182.47 237.529 1181.65 238.452 1181.06C239.382 1180.48 240.462 1180.19 241.693 1180.19C242.924 1180.19 244.001 1180.48 244.924 1181.06C245.853 1181.65 246.576 1182.47 247.09 1183.53C247.611 1184.59 247.872 1185.83 247.872 1187.25C247.872 1188.66 247.611 1189.89 247.09 1190.95C246.576 1192 245.853 1192.82 244.924 1193.41C244.001 1193.99 242.924 1194.28 241.693 1194.28ZM241.693 1192.4C242.628 1192.4 243.397 1192.16 244.001 1191.68C244.605 1191.2 245.052 1190.57 245.342 1189.79C245.632 1189.01 245.777 1188.16 245.777 1187.25C245.777 1186.34 245.632 1185.49 245.342 1184.7C245.052 1183.92 244.605 1183.28 244.001 1182.8C243.397 1182.31 242.628 1182.07 241.693 1182.07C240.758 1182.07 239.988 1182.31 239.384 1182.8C238.781 1183.28 238.334 1183.92 238.044 1184.7C237.754 1185.49 237.609 1186.34 237.609 1187.25C237.609 1188.16 237.754 1189.01 238.044 1189.79C238.334 1190.57 238.781 1191.2 239.384 1191.68C239.988 1192.16 240.758 1192.4 241.693 1192.4ZM251.07 1194V1180.36H253.094V1182.42H253.236C253.485 1181.75 253.935 1181.2 254.586 1180.78C255.237 1180.36 255.971 1180.15 256.787 1180.15C256.941 1180.15 257.134 1180.15 257.364 1180.16C257.595 1180.17 257.77 1180.17 257.888 1180.19V1182.32C257.817 1182.3 257.654 1182.27 257.4 1182.24C257.151 1182.2 256.888 1182.17 256.61 1182.17C255.947 1182.17 255.355 1182.31 254.834 1182.59C254.319 1182.86 253.911 1183.24 253.609 1183.73C253.313 1184.21 253.165 1184.76 253.165 1185.37V1194H251.07ZM260.372 1194V1180.36H262.396V1182.49H262.573C262.858 1181.77 263.316 1181.2 263.949 1180.8C264.583 1180.39 265.343 1180.19 266.231 1180.19C267.131 1180.19 267.879 1180.39 268.477 1180.8C269.081 1181.2 269.551 1181.77 269.889 1182.49H270.031C270.38 1181.79 270.904 1181.23 271.602 1180.82C272.301 1180.4 273.138 1180.19 274.115 1180.19C275.334 1180.19 276.331 1180.57 277.106 1181.33C277.882 1182.09 278.269 1183.27 278.269 1184.87V1194H276.174V1184.87C276.174 1183.87 275.899 1183.15 275.349 1182.72C274.798 1182.28 274.15 1182.07 273.404 1182.07C272.446 1182.07 271.703 1182.36 271.176 1182.94C270.649 1183.51 270.386 1184.24 270.386 1185.12V1194H268.255V1184.66C268.255 1183.89 268.004 1183.26 267.501 1182.79C266.998 1182.31 266.349 1182.07 265.556 1182.07C265.012 1182.07 264.503 1182.21 264.029 1182.5C263.562 1182.79 263.183 1183.2 262.893 1183.71C262.609 1184.22 262.467 1184.81 262.467 1185.48V1194H260.372ZM208.697 1215.36V1217.14H201.63V1215.36H208.697ZM203.69 1212.1H205.785V1225.09C205.785 1225.69 205.871 1226.13 206.043 1226.43C206.22 1226.72 206.445 1226.91 206.717 1227.01C206.996 1227.11 207.289 1227.15 207.596 1227.15C207.827 1227.15 208.016 1227.14 208.164 1227.12C208.312 1227.09 208.431 1227.06 208.52 1227.05L208.946 1228.93C208.804 1228.98 208.605 1229.04 208.351 1229.09C208.096 1229.15 207.774 1229.18 207.383 1229.18C206.791 1229.18 206.211 1229.05 205.643 1228.8C205.081 1228.54 204.613 1228.15 204.24 1227.63C203.874 1227.11 203.69 1226.46 203.69 1225.66V1212.1ZM217.42 1229.28C216.106 1229.28 214.972 1228.99 214.019 1228.41C213.072 1227.83 212.341 1227.01 211.827 1225.96C211.318 1224.91 211.063 1223.69 211.063 1222.29C211.063 1220.89 211.318 1219.66 211.827 1218.6C212.341 1217.52 213.058 1216.69 213.975 1216.09C214.898 1215.49 215.975 1215.19 217.207 1215.19C217.917 1215.19 218.618 1215.3 219.311 1215.54C220.003 1215.78 220.633 1216.16 221.202 1216.7C221.77 1217.22 222.223 1217.92 222.56 1218.79C222.897 1219.66 223.066 1220.73 223.066 1222V1222.89H212.555V1221.08H220.935C220.935 1220.31 220.781 1219.62 220.474 1219.02C220.172 1218.42 219.74 1217.94 219.177 1217.59C218.621 1217.24 217.964 1217.07 217.207 1217.07C216.372 1217.07 215.65 1217.28 215.04 1217.69C214.437 1218.1 213.972 1218.63 213.647 1219.29C213.321 1219.94 213.158 1220.65 213.158 1221.4V1222.61C213.158 1223.64 213.336 1224.51 213.691 1225.23C214.052 1225.94 214.552 1226.48 215.191 1226.85C215.83 1227.22 216.573 1227.4 217.42 1227.4C217.97 1227.4 218.467 1227.33 218.911 1227.17C219.361 1227.01 219.749 1226.77 220.074 1226.46C220.4 1226.14 220.651 1225.74 220.829 1225.27L222.853 1225.84C222.64 1226.53 222.282 1227.13 221.779 1227.65C221.276 1228.17 220.654 1228.57 219.914 1228.86C219.174 1229.14 218.343 1229.28 217.42 1229.28ZM230.266 1229.32C229.402 1229.32 228.618 1229.16 227.913 1228.83C227.209 1228.5 226.65 1228.02 226.235 1227.4C225.821 1226.77 225.614 1226.02 225.614 1225.13C225.614 1224.35 225.768 1223.71 226.076 1223.23C226.383 1222.74 226.795 1222.35 227.31 1222.08C227.824 1221.8 228.393 1221.59 229.014 1221.45C229.641 1221.31 230.272 1221.2 230.905 1221.12C231.734 1221.01 232.405 1220.93 232.92 1220.88C233.441 1220.82 233.82 1220.72 234.057 1220.58C234.299 1220.45 234.421 1220.21 234.421 1219.87V1219.8C234.421 1218.93 234.181 1218.25 233.702 1217.76C233.228 1217.28 232.509 1217.03 231.544 1217.03C230.544 1217.03 229.76 1217.25 229.192 1217.69C228.623 1218.13 228.224 1218.6 227.993 1219.09L226.004 1218.38C226.36 1217.55 226.833 1216.91 227.425 1216.45C228.023 1215.98 228.674 1215.65 229.378 1215.47C230.088 1215.28 230.787 1215.19 231.473 1215.19C231.911 1215.19 232.414 1215.24 232.982 1215.35C233.557 1215.45 234.11 1215.66 234.643 1215.98C235.181 1216.3 235.628 1216.78 235.983 1217.42C236.338 1218.07 236.516 1218.93 236.516 1220.02V1229H234.421V1227.15H234.314C234.172 1227.45 233.935 1227.77 233.604 1228.1C233.272 1228.44 232.832 1228.73 232.281 1228.96C231.731 1229.2 231.059 1229.32 230.266 1229.32ZM230.585 1227.44C231.414 1227.44 232.112 1227.27 232.681 1226.95C233.255 1226.62 233.687 1226.2 233.977 1225.69C234.273 1225.17 234.421 1224.63 234.421 1224.06V1222.15C234.332 1222.25 234.137 1222.35 233.835 1222.44C233.539 1222.52 233.196 1222.6 232.805 1222.66C232.42 1222.72 232.044 1222.77 231.677 1222.82C231.316 1222.86 231.023 1222.9 230.799 1222.93C230.254 1223 229.745 1223.11 229.272 1223.27C228.804 1223.43 228.425 1223.66 228.135 1223.98C227.851 1224.28 227.709 1224.7 227.709 1225.24C227.709 1225.96 227.978 1226.51 228.517 1226.89C229.061 1227.25 229.751 1227.44 230.585 1227.44ZM240.34 1229V1215.36H242.364V1217.49H242.542C242.826 1216.77 243.284 1216.2 243.918 1215.8C244.551 1215.39 245.312 1215.19 246.199 1215.19C247.099 1215.19 247.848 1215.39 248.445 1215.8C249.049 1216.2 249.52 1216.77 249.857 1217.49H249.999C250.348 1216.79 250.872 1216.23 251.57 1215.82C252.269 1215.4 253.106 1215.19 254.083 1215.19C255.302 1215.19 256.299 1215.57 257.075 1216.33C257.85 1217.09 258.238 1218.27 258.238 1219.87V1229H256.143V1219.87C256.143 1218.87 255.867 1218.15 255.317 1217.72C254.766 1217.28 254.118 1217.07 253.373 1217.07C252.414 1217.07 251.671 1217.36 251.144 1217.94C250.618 1218.51 250.354 1219.24 250.354 1220.12V1229H248.223V1219.66C248.223 1218.89 247.972 1218.26 247.469 1217.79C246.966 1217.31 246.318 1217.07 245.525 1217.07C244.98 1217.07 244.471 1217.21 243.998 1217.5C243.53 1217.79 243.151 1218.2 242.861 1218.71C242.577 1219.22 242.435 1219.81 242.435 1220.48V1229H240.34Z" fill="#03031C"/>
+<path d="M220.641 1092.13C220.492 1092.39 220.381 1092.76 220.381 1093.17V1097.89C223.393 1100.12 226.888 1101.27 230.606 1101.27C235.03 1101.27 238.488 1099.6 240.83 1097.89V1093.17C240.83 1092.76 240.756 1092.39 240.57 1092.13C237.707 1094.92 234.249 1096.51 230.568 1096.51C226.962 1096.55 223.504 1094.92 220.641 1092.13Z" fill="#00A3A0"/>
+<path d="M193.35 1139.64C193.201 1139.9 193.09 1140.28 193.09 1140.69V1145.41C196.102 1147.64 199.597 1148.79 203.315 1148.79C207.739 1148.79 211.197 1147.12 213.539 1145.41V1140.69C213.539 1140.28 213.465 1139.9 213.279 1139.64C210.416 1142.43 206.958 1144.03 203.277 1144.03C199.671 1144.07 196.213 1142.43 193.35 1139.64Z" fill="#00A3A0"/>
+<path d="M248.006 1139.64C247.858 1139.9 247.746 1140.28 247.746 1140.69V1145.41C250.758 1147.64 254.253 1148.79 257.971 1148.79C262.395 1148.79 265.853 1147.12 268.196 1145.41V1140.69C268.196 1140.28 268.121 1139.9 267.935 1139.64C265.072 1142.43 261.615 1144.03 257.934 1144.03C254.327 1144.07 250.869 1142.43 248.006 1139.64Z" fill="#00A3A0"/>
+<path d="M230.68 1120.68L221.013 1130.35" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M230.68 1110.01V1120.68L240.235 1130.24" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M208.446 1130.91C208.446 1130.91 213.54 1133.7 215.547 1135.29C216.031 1135.67 216.402 1136.15 216.737 1136.67C217.332 1137.64 217.629 1138.75 217.629 1139.87V1146.52C213.8 1149.87 208.818 1152.03 203.315 1152.03C197.738 1152.03 192.83 1149.94 189 1146.49V1139.83C189 1138.71 189.26 1137.56 189.892 1136.63C190.227 1136.11 190.599 1135.67 191.082 1135.26C193.053 1133.66 198.184 1130.87 198.184 1130.87" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M203.314 1133.58C207.298 1133.58 210.528 1129.57 210.528 1124.62C210.528 1119.67 207.298 1115.66 203.314 1115.66C199.331 1115.66 196.101 1119.67 196.101 1124.62C196.101 1129.57 199.331 1133.58 203.314 1133.58Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M263.176 1130.91C263.176 1130.91 268.27 1133.7 270.278 1135.29C270.761 1135.67 271.133 1136.15 271.468 1136.67C272.062 1137.64 272.36 1138.75 272.36 1139.87V1146.52C268.53 1149.91 263.548 1152.06 258.045 1152.06C252.468 1152.06 247.56 1149.98 243.73 1146.52V1139.87C243.73 1138.75 243.991 1137.6 244.623 1136.67C244.957 1136.15 245.329 1135.7 245.813 1135.29C247.783 1133.7 252.914 1130.91 252.914 1130.91" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M258.008 1133.58C261.992 1133.58 265.221 1129.57 265.221 1124.62C265.221 1119.67 261.992 1115.66 258.008 1115.66C254.024 1115.66 250.795 1119.67 250.795 1124.62C250.795 1129.57 254.024 1133.58 258.008 1133.58Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M235.774 1084.24C235.774 1084.24 240.868 1087.03 242.875 1088.63C243.359 1089 243.731 1089.49 244.065 1090.01C244.66 1090.97 244.958 1092.09 244.958 1093.2V1099.86C241.128 1103.24 236.146 1105.4 230.643 1105.4C225.066 1105.4 220.158 1103.32 216.328 1099.86V1093.17C216.328 1092.05 216.588 1090.9 217.22 1089.97C217.555 1089.45 217.927 1089 218.41 1088.59C220.381 1087 225.512 1084.21 225.512 1084.21" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M230.643 1086.92C234.627 1086.92 237.856 1082.91 237.856 1077.96C237.856 1073.01 234.627 1069 230.643 1069C226.659 1069 223.43 1073.01 223.43 1077.96C223.43 1082.91 226.659 1086.92 230.643 1086.92Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#filter1_bd_12_480)">
+<rect x="126" y="1301" width="210" height="225" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="126.5" y="1301.5" width="209" height="224" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M213.758 1457H211.449L218.125 1438.82H220.398L227.074 1457H224.766L219.333 1441.69H219.191L213.758 1457ZM214.61 1449.9H223.914V1451.85H214.61V1449.9ZM229.906 1457V1438.82H236.05C237.476 1438.82 238.642 1439.08 239.548 1439.59C240.459 1440.1 241.134 1440.79 241.572 1441.66C242.01 1442.53 242.229 1443.5 242.229 1444.57C242.229 1445.64 242.01 1446.62 241.572 1447.49C241.14 1448.37 240.471 1449.07 239.565 1449.59C238.66 1450.1 237.5 1450.36 236.085 1450.36H231.682V1448.41H236.014C236.991 1448.41 237.775 1448.24 238.367 1447.9C238.959 1447.56 239.388 1447.11 239.654 1446.53C239.926 1445.95 240.063 1445.3 240.063 1444.57C240.063 1443.84 239.926 1443.19 239.654 1442.62C239.388 1442.04 238.956 1441.59 238.358 1441.27C237.76 1440.94 236.967 1440.77 235.979 1440.77H232.108V1457H229.906ZM247.977 1438.82V1457H245.775V1438.82H247.977ZM178.778 1492.28C177.641 1492.28 176.638 1492 175.768 1491.42C174.898 1490.84 174.217 1490.03 173.726 1488.97C173.235 1487.91 172.989 1486.66 172.989 1485.22C172.989 1483.79 173.235 1482.54 173.726 1481.49C174.217 1480.44 174.901 1479.62 175.777 1479.05C176.653 1478.47 177.665 1478.19 178.813 1478.19C179.701 1478.19 180.402 1478.33 180.917 1478.63C181.438 1478.92 181.835 1479.25 182.107 1479.62C182.385 1479.99 182.601 1480.29 182.755 1480.53H182.933V1473.82H185.028V1492H183.004V1489.9H182.755C182.601 1490.15 182.382 1490.47 182.098 1490.85C181.814 1491.22 181.408 1491.55 180.882 1491.85C180.355 1492.14 179.654 1492.28 178.778 1492.28ZM179.062 1490.4C179.902 1490.4 180.612 1490.18 181.192 1489.75C181.772 1489.3 182.213 1488.69 182.515 1487.91C182.817 1487.12 182.968 1486.21 182.968 1485.18C182.968 1484.16 182.82 1483.27 182.524 1482.51C182.228 1481.74 181.79 1481.14 181.21 1480.72C180.63 1480.28 179.914 1480.07 179.062 1480.07C178.174 1480.07 177.434 1480.3 176.842 1480.75C176.256 1481.2 175.815 1481.81 175.52 1482.59C175.23 1483.36 175.085 1484.22 175.085 1485.18C175.085 1486.15 175.232 1487.03 175.528 1487.83C175.83 1488.61 176.274 1489.24 176.86 1489.71C177.452 1490.17 178.186 1490.4 179.062 1490.4ZM194.873 1492.28C193.559 1492.28 192.426 1491.99 191.473 1491.41C190.526 1490.83 189.795 1490.01 189.28 1488.96C188.771 1487.91 188.517 1486.69 188.517 1485.29C188.517 1483.89 188.771 1482.66 189.28 1481.6C189.795 1480.52 190.511 1479.69 191.429 1479.09C192.352 1478.49 193.429 1478.19 194.66 1478.19C195.37 1478.19 196.072 1478.3 196.764 1478.54C197.457 1478.78 198.087 1479.16 198.655 1479.7C199.223 1480.22 199.676 1480.92 200.013 1481.79C200.351 1482.66 200.52 1483.73 200.52 1485V1485.89H190.008V1484.08H198.389C198.389 1483.31 198.235 1482.62 197.927 1482.02C197.625 1481.42 197.193 1480.94 196.631 1480.59C196.075 1480.24 195.418 1480.07 194.66 1480.07C193.826 1480.07 193.104 1480.28 192.494 1480.69C191.89 1481.1 191.426 1481.63 191.1 1482.29C190.775 1482.94 190.612 1483.65 190.612 1484.4V1485.61C190.612 1486.64 190.789 1487.51 191.145 1488.23C191.506 1488.94 192.006 1489.48 192.645 1489.85C193.284 1490.22 194.027 1490.4 194.873 1490.4C195.424 1490.4 195.921 1490.33 196.365 1490.17C196.815 1490.01 197.202 1489.77 197.528 1489.46C197.853 1489.14 198.105 1488.74 198.282 1488.27L200.306 1488.84C200.093 1489.53 199.735 1490.13 199.232 1490.65C198.729 1491.17 198.108 1491.57 197.368 1491.86C196.628 1492.14 195.797 1492.28 194.873 1492.28ZM214.442 1478.36L209.4 1492H207.269L202.226 1478.36H204.499L208.263 1489.23H208.405L212.169 1478.36H214.442ZM222.437 1492.28C221.123 1492.28 219.989 1491.99 219.036 1491.41C218.09 1490.83 217.359 1490.01 216.844 1488.96C216.335 1487.91 216.08 1486.69 216.08 1485.29C216.08 1483.89 216.335 1482.66 216.844 1481.6C217.359 1480.52 218.075 1479.69 218.992 1479.09C219.915 1478.49 220.993 1478.19 222.224 1478.19C222.934 1478.19 223.635 1478.3 224.328 1478.54C225.02 1478.78 225.65 1479.16 226.219 1479.7C226.787 1480.22 227.24 1480.92 227.577 1481.79C227.914 1482.66 228.083 1483.73 228.083 1485V1485.89H217.572V1484.08H225.952C225.952 1483.31 225.798 1482.62 225.491 1482.02C225.189 1481.42 224.757 1480.94 224.195 1480.59C223.638 1480.24 222.981 1480.07 222.224 1480.07C221.389 1480.07 220.667 1480.28 220.057 1480.69C219.454 1481.1 218.989 1481.63 218.664 1482.29C218.338 1482.94 218.175 1483.65 218.175 1484.4V1485.61C218.175 1486.64 218.353 1487.51 218.708 1488.23C219.069 1488.94 219.569 1489.48 220.208 1489.85C220.848 1490.22 221.59 1490.4 222.437 1490.4C222.987 1490.4 223.484 1490.33 223.928 1490.17C224.378 1490.01 224.766 1489.77 225.091 1489.46C225.417 1489.14 225.668 1488.74 225.846 1488.27L227.87 1488.84C227.657 1489.53 227.299 1490.13 226.796 1490.65C226.293 1491.17 225.671 1491.57 224.931 1491.86C224.192 1492.14 223.36 1492.28 222.437 1492.28ZM233.365 1473.82V1492H231.27V1473.82H233.365ZM242.743 1492.28C241.511 1492.28 240.431 1491.99 239.502 1491.41C238.579 1490.82 237.857 1490 237.336 1488.95C236.821 1487.89 236.564 1486.66 236.564 1485.25C236.564 1483.83 236.821 1482.59 237.336 1481.53C237.857 1480.47 238.579 1479.65 239.502 1479.06C240.431 1478.48 241.511 1478.19 242.743 1478.19C243.974 1478.19 245.051 1478.48 245.974 1479.06C246.903 1479.65 247.625 1480.47 248.14 1481.53C248.661 1482.59 248.922 1483.83 248.922 1485.25C248.922 1486.66 248.661 1487.89 248.14 1488.95C247.625 1490 246.903 1490.82 245.974 1491.41C245.051 1491.99 243.974 1492.28 242.743 1492.28ZM242.743 1490.4C243.678 1490.4 244.447 1490.16 245.051 1489.68C245.654 1489.2 246.101 1488.57 246.391 1487.79C246.681 1487.01 246.826 1486.16 246.826 1485.25C246.826 1484.34 246.681 1483.49 246.391 1482.7C246.101 1481.92 245.654 1481.28 245.051 1480.8C244.447 1480.31 243.678 1480.07 242.743 1480.07C241.807 1480.07 241.038 1480.31 240.434 1480.8C239.831 1481.28 239.384 1481.92 239.094 1482.7C238.804 1483.49 238.659 1484.34 238.659 1485.25C238.659 1486.16 238.804 1487.01 239.094 1487.79C239.384 1488.57 239.831 1489.2 240.434 1489.68C241.038 1490.16 241.807 1490.4 242.743 1490.4ZM252.12 1497.11V1478.36H254.144V1480.53H254.392C254.546 1480.29 254.759 1479.99 255.032 1479.62C255.31 1479.25 255.706 1478.92 256.221 1478.63C256.742 1478.33 257.446 1478.19 258.334 1478.19C259.482 1478.19 260.495 1478.47 261.37 1479.05C262.246 1479.62 262.93 1480.44 263.421 1481.49C263.912 1482.54 264.158 1483.79 264.158 1485.22C264.158 1486.66 263.912 1487.91 263.421 1488.97C262.93 1490.03 262.249 1490.84 261.379 1491.42C260.509 1492 259.506 1492.28 258.37 1492.28C257.494 1492.28 256.792 1492.14 256.266 1491.85C255.739 1491.55 255.334 1491.22 255.049 1490.85C254.765 1490.47 254.546 1490.15 254.392 1489.9H254.215V1497.11H252.12ZM254.179 1485.18C254.179 1486.21 254.33 1487.12 254.632 1487.91C254.934 1488.69 255.375 1489.3 255.955 1489.75C256.535 1490.18 257.245 1490.4 258.086 1490.4C258.962 1490.4 259.693 1490.17 260.278 1489.71C260.87 1489.24 261.314 1488.61 261.61 1487.83C261.912 1487.03 262.063 1486.15 262.063 1485.18C262.063 1484.22 261.915 1483.36 261.619 1482.59C261.329 1481.81 260.888 1481.2 260.296 1480.75C259.71 1480.3 258.973 1480.07 258.086 1480.07C257.233 1480.07 256.517 1480.28 255.937 1480.72C255.357 1481.14 254.919 1481.74 254.623 1482.51C254.327 1483.27 254.179 1484.16 254.179 1485.18ZM273.071 1492.28C271.758 1492.28 270.624 1491.99 269.671 1491.41C268.724 1490.83 267.993 1490.01 267.478 1488.96C266.969 1487.91 266.715 1486.69 266.715 1485.29C266.715 1483.89 266.969 1482.66 267.478 1481.6C267.993 1480.52 268.709 1479.69 269.627 1479.09C270.55 1478.49 271.627 1478.19 272.858 1478.19C273.569 1478.19 274.27 1478.3 274.962 1478.54C275.655 1478.78 276.285 1479.16 276.853 1479.7C277.422 1480.22 277.874 1480.92 278.212 1481.79C278.549 1482.66 278.718 1483.73 278.718 1485V1485.89H268.206V1484.08H276.587C276.587 1483.31 276.433 1482.62 276.125 1482.02C275.824 1481.42 275.392 1480.94 274.829 1480.59C274.273 1480.24 273.616 1480.07 272.858 1480.07C272.024 1480.07 271.302 1480.28 270.692 1480.69C270.089 1481.1 269.624 1481.63 269.298 1482.29C268.973 1482.94 268.81 1483.65 268.81 1484.4V1485.61C268.81 1486.64 268.988 1487.51 269.343 1488.23C269.704 1488.94 270.204 1489.48 270.843 1489.85C271.482 1490.22 272.225 1490.4 273.071 1490.4C273.622 1490.4 274.119 1490.33 274.563 1490.17C275.013 1490.01 275.4 1489.77 275.726 1489.46C276.051 1489.14 276.303 1488.74 276.481 1488.27L278.505 1488.84C278.292 1489.53 277.934 1490.13 277.43 1490.65C276.927 1491.17 276.306 1491.57 275.566 1491.86C274.826 1492.14 273.995 1492.28 273.071 1492.28ZM281.905 1492V1478.36H283.929V1480.42H284.071C284.32 1479.75 284.77 1479.2 285.421 1478.78C286.072 1478.36 286.805 1478.15 287.622 1478.15C287.776 1478.15 287.968 1478.15 288.199 1478.16C288.43 1478.17 288.605 1478.17 288.723 1478.19V1480.32C288.652 1480.3 288.489 1480.27 288.235 1480.24C287.986 1480.2 287.723 1480.17 287.445 1480.17C286.782 1480.17 286.19 1480.31 285.669 1480.59C285.154 1480.86 284.746 1481.24 284.444 1481.73C284.148 1482.21 284 1482.76 284 1483.37V1492H281.905Z" fill="#03031C"/>
+<g filter="url(#filter2_bd_12_480)">
+<rect x="433" y="98" width="844" height="558" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="434" y="99" width="842" height="556" rx="19" stroke="#8438FA" stroke-width="2" shape-rendering="crispEdges"/>
+</g>
+<path d="M475.065 591.985V588.182H492.984V591.985H486.305V610H481.745V591.985H475.065ZM496.777 616.136C496.202 616.136 495.662 616.09 495.158 615.998C494.661 615.913 494.249 615.803 493.922 615.668L494.945 612.28C495.477 612.443 495.957 612.532 496.383 612.546C496.816 612.56 497.189 612.461 497.501 612.248C497.821 612.035 498.08 611.673 498.279 611.161L498.545 610.469L492.675 593.636H497.448L500.836 605.653H501.006L504.426 593.636H509.231L502.871 611.768C502.565 612.649 502.15 613.416 501.624 614.07C501.106 614.73 500.449 615.238 499.653 615.593C498.858 615.955 497.899 616.136 496.777 616.136ZM515.665 605.291L515.676 599.847H516.337L521.578 593.636H526.788L519.746 601.861H518.67L515.665 605.291ZM511.553 610V588.182H516.092V610H511.553ZM521.781 610L516.965 602.873L519.991 599.666L527.097 610H521.781ZM543.777 610H536.043V588.182H543.841C546.036 588.182 547.925 588.619 549.509 589.492C551.093 590.359 552.311 591.605 553.163 593.232C554.022 594.858 554.452 596.804 554.452 599.07C554.452 601.342 554.022 603.295 553.163 604.929C552.311 606.562 551.085 607.816 549.487 608.69C547.896 609.563 545.993 610 543.777 610ZM540.656 606.048H543.585C544.949 606.048 546.096 605.806 547.026 605.323C547.964 604.833 548.667 604.077 549.136 603.054C549.612 602.024 549.85 600.696 549.85 599.07C549.85 597.457 549.612 596.14 549.136 595.117C548.667 594.094 547.968 593.342 547.037 592.859C546.107 592.376 544.96 592.134 543.596 592.134H540.656V606.048ZM562.45 610.309C561.406 610.309 560.475 610.128 559.659 609.766C558.842 609.396 558.196 608.853 557.72 608.136C557.251 607.411 557.017 606.509 557.017 605.43C557.017 604.521 557.184 603.757 557.517 603.139C557.851 602.521 558.306 602.024 558.881 601.648C559.456 601.271 560.11 600.987 560.841 600.795C561.58 600.604 562.354 600.469 563.164 600.391C564.115 600.291 564.882 600.199 565.465 600.114C566.047 600.021 566.47 599.886 566.733 599.709C566.995 599.531 567.127 599.268 567.127 598.92V598.857C567.127 598.182 566.914 597.66 566.488 597.29C566.069 596.921 565.472 596.737 564.698 596.737C563.881 596.737 563.231 596.918 562.748 597.28C562.265 597.635 561.946 598.082 561.789 598.622L557.592 598.281C557.805 597.287 558.224 596.428 558.849 595.703C559.474 594.972 560.28 594.411 561.267 594.02C562.262 593.622 563.412 593.423 564.719 593.423C565.628 593.423 566.498 593.53 567.329 593.743C568.167 593.956 568.909 594.286 569.556 594.734C570.209 595.181 570.724 595.756 571.1 596.46C571.477 597.156 571.665 597.99 571.665 598.963V610H567.361V607.731H567.233C566.971 608.242 566.619 608.693 566.179 609.084C565.738 609.467 565.209 609.769 564.591 609.989C563.973 610.202 563.26 610.309 562.45 610.309ZM563.75 607.177C564.417 607.177 565.007 607.045 565.518 606.783C566.029 606.513 566.431 606.151 566.722 605.696C567.013 605.241 567.159 604.727 567.159 604.151V602.415C567.017 602.507 566.821 602.592 566.573 602.67C566.331 602.741 566.058 602.809 565.752 602.873C565.447 602.93 565.142 602.983 564.836 603.033C564.531 603.075 564.254 603.114 564.005 603.15C563.473 603.228 563.007 603.352 562.61 603.523C562.212 603.693 561.903 603.924 561.683 604.215C561.463 604.499 561.353 604.854 561.353 605.281C561.353 605.898 561.576 606.371 562.024 606.697C562.478 607.017 563.054 607.177 563.75 607.177ZM588.801 598.303L584.646 598.558C584.575 598.203 584.423 597.884 584.188 597.599C583.954 597.308 583.645 597.077 583.261 596.907C582.885 596.729 582.434 596.641 581.908 596.641C581.205 596.641 580.612 596.79 580.129 597.088C579.646 597.379 579.405 597.77 579.405 598.26C579.405 598.651 579.561 598.981 579.874 599.251C580.186 599.521 580.722 599.737 581.482 599.901L584.444 600.497C586.035 600.824 587.221 601.349 588.002 602.074C588.783 602.798 589.174 603.75 589.174 604.929C589.174 606.001 588.858 606.942 588.226 607.752C587.601 608.562 586.741 609.194 585.648 609.648C584.561 610.096 583.308 610.32 581.887 610.32C579.721 610.32 577.995 609.869 576.71 608.967C575.431 608.058 574.682 606.822 574.462 605.259L578.925 605.025C579.06 605.685 579.387 606.19 579.906 606.538C580.424 606.879 581.088 607.049 581.898 607.049C582.693 607.049 583.332 606.896 583.815 606.591C584.305 606.278 584.554 605.877 584.561 605.387C584.554 604.975 584.38 604.638 584.039 604.375C583.698 604.105 583.173 603.899 582.462 603.757L579.629 603.192C578.031 602.873 576.841 602.319 576.06 601.531C575.286 600.742 574.898 599.737 574.898 598.516C574.898 597.464 575.183 596.559 575.751 595.799C576.326 595.039 577.132 594.453 578.169 594.041C579.213 593.629 580.435 593.423 581.834 593.423C583.901 593.423 585.527 593.86 586.713 594.734C587.906 595.607 588.602 596.797 588.801 598.303ZM596.57 600.54V610H592.032V588.182H596.442V596.523H596.634C597.003 595.558 597.6 594.801 598.424 594.254C599.248 593.7 600.281 593.423 601.524 593.423C602.66 593.423 603.651 593.672 604.496 594.169C605.349 594.659 606.009 595.366 606.478 596.289C606.954 597.205 607.188 598.303 607.181 599.581V610H602.643V600.391C602.65 599.382 602.394 598.597 601.876 598.036C601.364 597.475 600.647 597.195 599.724 597.195C599.106 597.195 598.559 597.326 598.083 597.589C597.614 597.852 597.245 598.235 596.975 598.739C596.712 599.237 596.577 599.837 596.57 600.54ZM610.838 610V588.182H615.376V596.385H615.515C615.713 595.945 616.001 595.497 616.377 595.043C616.761 594.581 617.258 594.197 617.869 593.892C618.487 593.58 619.254 593.423 620.17 593.423C621.363 593.423 622.464 593.736 623.473 594.361C624.481 594.979 625.287 595.913 625.891 597.163C626.495 598.406 626.797 599.964 626.797 601.839C626.797 603.665 626.502 605.206 625.912 606.463C625.33 607.713 624.534 608.661 623.526 609.308C622.525 609.947 621.402 610.266 620.159 610.266C619.279 610.266 618.529 610.121 617.912 609.83C617.301 609.538 616.8 609.173 616.409 608.732C616.019 608.285 615.721 607.834 615.515 607.379H615.312V610H610.838ZM615.28 601.818C615.28 602.791 615.415 603.64 615.685 604.364C615.955 605.089 616.346 605.653 616.857 606.058C617.368 606.456 617.99 606.655 618.721 606.655C619.46 606.655 620.085 606.452 620.596 606.048C621.108 605.636 621.495 605.067 621.757 604.343C622.027 603.612 622.162 602.77 622.162 601.818C622.162 600.874 622.031 600.043 621.768 599.325C621.505 598.608 621.118 598.047 620.607 597.642C620.096 597.237 619.467 597.035 618.721 597.035C617.983 597.035 617.358 597.23 616.846 597.621C616.342 598.011 615.955 598.565 615.685 599.283C615.415 600 615.28 600.845 615.28 601.818ZM637.218 610.32C635.563 610.32 634.132 609.968 632.925 609.265C631.725 608.555 630.798 607.567 630.144 606.303C629.491 605.032 629.164 603.558 629.164 601.882C629.164 600.192 629.491 598.714 630.144 597.45C630.798 596.179 631.725 595.192 632.925 594.489C634.132 593.778 635.563 593.423 637.218 593.423C638.873 593.423 640.301 593.778 641.501 594.489C642.708 595.192 643.639 596.179 644.292 597.45C644.945 598.714 645.272 600.192 645.272 601.882C645.272 603.558 644.945 605.032 644.292 606.303C643.639 607.567 642.708 608.555 641.501 609.265C640.301 609.968 638.873 610.32 637.218 610.32ZM637.24 606.804C637.992 606.804 638.621 606.591 639.125 606.165C639.629 605.732 640.009 605.142 640.265 604.396C640.528 603.651 640.659 602.802 640.659 601.85C640.659 600.898 640.528 600.05 640.265 599.304C640.009 598.558 639.629 597.969 639.125 597.536C638.621 597.102 637.992 596.886 637.24 596.886C636.48 596.886 635.84 597.102 635.322 597.536C634.811 597.969 634.423 598.558 634.161 599.304C633.905 600.05 633.777 600.898 633.777 601.85C633.777 602.802 633.905 603.651 634.161 604.396C634.423 605.142 634.811 605.732 635.322 606.165C635.84 606.591 636.48 606.804 637.24 606.804ZM652.889 610.309C651.845 610.309 650.915 610.128 650.098 609.766C649.281 609.396 648.635 608.853 648.159 608.136C647.691 607.411 647.456 606.509 647.456 605.43C647.456 604.521 647.623 603.757 647.957 603.139C648.291 602.521 648.745 602.024 649.32 601.648C649.896 601.271 650.549 600.987 651.281 600.795C652.019 600.604 652.794 600.469 653.603 600.391C654.555 600.291 655.322 600.199 655.904 600.114C656.487 600.021 656.909 599.886 657.172 599.709C657.435 599.531 657.566 599.268 657.566 598.92V598.857C657.566 598.182 657.353 597.66 656.927 597.29C656.508 596.921 655.911 596.737 655.137 596.737C654.32 596.737 653.671 596.918 653.188 597.28C652.705 597.635 652.385 598.082 652.229 598.622L648.031 598.281C648.244 597.287 648.664 596.428 649.289 595.703C649.914 594.972 650.72 594.411 651.707 594.02C652.701 593.622 653.852 593.423 655.159 593.423C656.068 593.423 656.938 593.53 657.769 593.743C658.607 593.956 659.349 594.286 659.995 594.734C660.649 595.181 661.164 595.756 661.54 596.46C661.916 597.156 662.105 597.99 662.105 598.963V610H657.801V607.731H657.673C657.41 608.242 657.058 608.693 656.618 609.084C656.178 609.467 655.649 609.769 655.031 609.989C654.413 610.202 653.699 610.309 652.889 610.309ZM654.189 607.177C654.857 607.177 655.446 607.045 655.958 606.783C656.469 606.513 656.87 606.151 657.161 605.696C657.453 605.241 657.598 604.727 657.598 604.151V602.415C657.456 602.507 657.261 602.592 657.012 602.67C656.771 602.741 656.497 602.809 656.192 602.873C655.887 602.93 655.581 602.983 655.276 603.033C654.97 603.075 654.693 603.114 654.445 603.15C653.912 603.228 653.447 603.352 653.049 603.523C652.651 603.693 652.343 603.924 652.122 604.215C651.902 604.499 651.792 604.854 651.792 605.281C651.792 605.898 652.016 606.371 652.463 606.697C652.918 607.017 653.493 607.177 654.189 607.177ZM665.626 610V593.636H670.025V596.491H670.196C670.494 595.476 670.995 594.709 671.698 594.19C672.401 593.665 673.211 593.402 674.127 593.402C674.354 593.402 674.599 593.416 674.862 593.445C675.125 593.473 675.356 593.512 675.555 593.562V597.589C675.341 597.525 675.047 597.468 674.67 597.418C674.294 597.369 673.949 597.344 673.637 597.344C672.969 597.344 672.373 597.489 671.847 597.781C671.329 598.065 670.917 598.462 670.611 598.974C670.313 599.485 670.164 600.075 670.164 600.742V610H665.626ZM683.169 610.266C681.926 610.266 680.8 609.947 679.792 609.308C678.79 608.661 677.995 607.713 677.406 606.463C676.823 605.206 676.532 603.665 676.532 601.839C676.532 599.964 676.834 598.406 677.438 597.163C678.041 595.913 678.844 594.979 679.845 594.361C680.854 593.736 681.958 593.423 683.158 593.423C684.075 593.423 684.838 593.58 685.449 593.892C686.067 594.197 686.564 594.581 686.94 595.043C687.324 595.497 687.615 595.945 687.814 596.385H687.952V588.182H692.48V610H688.006V607.379H687.814C687.601 607.834 687.299 608.285 686.908 608.732C686.525 609.173 686.024 609.538 685.406 609.83C684.795 610.121 684.05 610.266 683.169 610.266ZM684.607 606.655C685.339 606.655 685.957 606.456 686.461 606.058C686.972 605.653 687.363 605.089 687.633 604.364C687.91 603.64 688.048 602.791 688.048 601.818C688.048 600.845 687.913 600 687.643 599.283C687.374 598.565 686.983 598.011 686.472 597.621C685.96 597.23 685.339 597.035 684.607 597.035C683.862 597.035 683.233 597.237 682.722 597.642C682.21 598.047 681.823 598.608 681.56 599.325C681.298 600.043 681.166 600.874 681.166 601.818C681.166 602.77 681.298 603.612 681.56 604.343C681.83 605.067 682.217 605.636 682.722 606.048C683.233 606.452 683.862 606.655 684.607 606.655Z" fill="#8438FA"/>
+<g filter="url(#filter3_bd_12_480)">
+<rect x="433" y="803" width="844" height="796" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="434" y="804" width="842" height="794" rx="19" stroke="#335FFD" stroke-width="2" shape-rendering="crispEdges"/>
+</g>
+<path d="M475.896 1558V1536.18H480.509V1545.8H480.797L488.648 1536.18H494.178L486.081 1545.95L494.273 1558H488.755L482.778 1549.03L480.509 1551.8V1558H475.896ZM505.963 1551.03V1541.64H510.501V1558H506.144V1555.03H505.974C505.604 1555.99 504.99 1556.76 504.131 1557.34C503.278 1557.92 502.238 1558.21 501.009 1558.21C499.915 1558.21 498.953 1557.96 498.122 1557.47C497.291 1556.97 496.641 1556.26 496.172 1555.35C495.711 1554.43 495.476 1553.33 495.469 1552.06V1541.64H500.008V1551.25C500.015 1552.21 500.274 1552.98 500.785 1553.54C501.297 1554.1 501.982 1554.38 502.841 1554.38C503.388 1554.38 503.9 1554.25 504.376 1554C504.851 1553.75 505.235 1553.37 505.526 1552.88C505.824 1552.38 505.97 1551.76 505.963 1551.03ZM514.217 1558V1536.18H518.755V1544.38H518.893C519.092 1543.94 519.38 1543.5 519.756 1543.04C520.14 1542.58 520.637 1542.2 521.248 1541.89C521.866 1541.58 522.633 1541.42 523.549 1541.42C524.742 1541.42 525.843 1541.74 526.852 1542.36C527.86 1542.98 528.666 1543.91 529.27 1545.16C529.874 1546.41 530.175 1547.96 530.175 1549.84C530.175 1551.66 529.881 1553.21 529.291 1554.46C528.709 1555.71 527.913 1556.66 526.905 1557.31C525.903 1557.95 524.781 1558.27 523.538 1558.27C522.658 1558.27 521.908 1558.12 521.29 1557.83C520.68 1557.54 520.179 1557.17 519.788 1556.73C519.398 1556.28 519.099 1555.83 518.893 1555.38H518.691V1558H514.217ZM518.659 1549.82C518.659 1550.79 518.794 1551.64 519.064 1552.36C519.334 1553.09 519.724 1553.65 520.236 1554.06C520.747 1554.46 521.369 1554.65 522.1 1554.65C522.839 1554.65 523.464 1554.45 523.975 1554.05C524.487 1553.64 524.874 1553.07 525.136 1552.34C525.406 1551.61 525.541 1550.77 525.541 1549.82C525.541 1548.87 525.41 1548.04 525.147 1547.33C524.884 1546.61 524.497 1546.05 523.986 1545.64C523.474 1545.24 522.846 1545.03 522.1 1545.03C521.362 1545.03 520.737 1545.23 520.225 1545.62C519.721 1546.01 519.334 1546.57 519.064 1547.28C518.794 1548 518.659 1548.85 518.659 1549.82ZM540.661 1558.32C538.978 1558.32 537.529 1557.98 536.314 1557.3C535.107 1556.61 534.177 1555.63 533.523 1554.38C532.87 1553.11 532.543 1551.62 532.543 1549.89C532.543 1548.21 532.87 1546.73 533.523 1545.46C534.177 1544.19 535.096 1543.2 536.282 1542.49C537.476 1541.78 538.875 1541.42 540.48 1541.42C541.559 1541.42 542.564 1541.6 543.495 1541.95C544.432 1542.29 545.249 1542.8 545.945 1543.49C546.648 1544.18 547.195 1545.05 547.586 1546.09C547.976 1547.13 548.172 1548.34 548.172 1549.73V1550.98H534.354V1548.17H543.9C543.9 1547.51 543.758 1546.93 543.474 1546.43C543.189 1545.93 542.795 1545.53 542.291 1545.25C541.794 1544.96 541.215 1544.81 540.555 1544.81C539.866 1544.81 539.255 1544.97 538.722 1545.29C538.197 1545.6 537.785 1546.03 537.486 1546.56C537.188 1547.08 537.035 1547.67 537.028 1548.32V1550.99C537.028 1551.8 537.177 1552.5 537.476 1553.09C537.781 1553.68 538.211 1554.13 538.765 1554.45C539.319 1554.77 539.976 1554.93 540.736 1554.93C541.24 1554.93 541.702 1554.86 542.121 1554.72C542.54 1554.58 542.898 1554.36 543.197 1554.08C543.495 1553.8 543.722 1553.45 543.878 1553.04L548.076 1553.31C547.863 1554.32 547.426 1555.2 546.765 1555.95C546.112 1556.7 545.267 1557.28 544.23 1557.7C543.2 1558.11 542.01 1558.32 540.661 1558.32ZM551.133 1558V1541.64H555.533V1544.49H555.704C556.002 1543.48 556.503 1542.71 557.206 1542.19C557.909 1541.66 558.719 1541.4 559.635 1541.4C559.862 1541.4 560.107 1541.42 560.37 1541.44C560.633 1541.47 560.863 1541.51 561.062 1541.56V1545.59C560.849 1545.52 560.555 1545.47 560.178 1545.42C559.802 1545.37 559.457 1545.34 559.145 1545.34C558.477 1545.34 557.881 1545.49 557.355 1545.78C556.836 1546.06 556.425 1546.46 556.119 1546.97C555.821 1547.49 555.672 1548.07 555.672 1548.74V1558H551.133ZM567.947 1548.54V1558H563.409V1541.64H567.734V1544.52H567.926C568.288 1543.57 568.895 1542.82 569.748 1542.26C570.6 1541.7 571.633 1541.42 572.848 1541.42C573.984 1541.42 574.975 1541.67 575.82 1542.17C576.665 1542.67 577.322 1543.38 577.791 1544.3C578.26 1545.22 578.494 1546.31 578.494 1547.58V1558H573.956V1548.39C573.963 1547.39 573.707 1546.61 573.189 1546.05C572.67 1545.48 571.956 1545.19 571.047 1545.19C570.436 1545.19 569.897 1545.33 569.428 1545.59C568.966 1545.85 568.604 1546.24 568.341 1546.74C568.086 1547.24 567.954 1547.84 567.947 1548.54ZM589.528 1558.32C587.845 1558.32 586.396 1557.98 585.182 1557.3C583.974 1556.61 583.044 1555.63 582.39 1554.38C581.737 1553.11 581.41 1551.62 581.41 1549.89C581.41 1548.21 581.737 1546.73 582.39 1545.46C583.044 1544.19 583.964 1543.2 585.15 1542.49C586.343 1541.78 587.742 1541.42 589.347 1541.42C590.427 1541.42 591.432 1541.6 592.362 1541.95C593.3 1542.29 594.116 1542.8 594.812 1543.49C595.515 1544.18 596.062 1545.05 596.453 1546.09C596.844 1547.13 597.039 1548.34 597.039 1549.73V1550.98H583.221V1548.17H592.767C592.767 1547.51 592.625 1546.93 592.341 1546.43C592.057 1545.93 591.662 1545.53 591.158 1545.25C590.661 1544.96 590.082 1544.81 589.422 1544.81C588.733 1544.81 588.122 1544.97 587.589 1545.29C587.064 1545.6 586.652 1546.03 586.354 1546.56C586.055 1547.08 585.903 1547.67 585.895 1548.32V1550.99C585.895 1551.8 586.045 1552.5 586.343 1553.09C586.648 1553.68 587.078 1554.13 587.632 1554.45C588.186 1554.77 588.843 1554.93 589.603 1554.93C590.107 1554.93 590.569 1554.86 590.988 1554.72C591.407 1554.58 591.765 1554.36 592.064 1554.08C592.362 1553.8 592.589 1553.45 592.746 1553.04L596.943 1553.31C596.73 1554.32 596.293 1555.2 595.633 1555.95C594.979 1556.7 594.134 1557.28 593.097 1557.7C592.067 1558.11 590.878 1558.32 589.528 1558.32ZM608.704 1541.64V1545.05H598.85V1541.64H608.704ZM601.087 1537.72H605.626V1552.97C605.626 1553.39 605.689 1553.72 605.817 1553.95C605.945 1554.18 606.123 1554.34 606.35 1554.43C606.584 1554.52 606.854 1554.57 607.16 1554.57C607.373 1554.57 607.586 1554.55 607.799 1554.52C608.012 1554.47 608.175 1554.44 608.289 1554.42L609.003 1557.8C608.775 1557.87 608.456 1557.95 608.044 1558.04C607.632 1558.14 607.131 1558.2 606.542 1558.22C605.448 1558.27 604.489 1558.12 603.665 1557.79C602.849 1557.45 602.213 1556.93 601.758 1556.23C601.304 1555.53 601.08 1554.64 601.087 1553.57V1537.72ZM618.942 1558.32C617.259 1558.32 615.81 1557.98 614.596 1557.3C613.388 1556.61 612.458 1555.63 611.805 1554.38C611.151 1553.11 610.824 1551.62 610.824 1549.89C610.824 1548.21 611.151 1546.73 611.805 1545.46C612.458 1544.19 613.378 1543.2 614.564 1542.49C615.757 1541.78 617.156 1541.42 618.761 1541.42C619.841 1541.42 620.846 1541.6 621.776 1541.95C622.714 1542.29 623.53 1542.8 624.226 1543.49C624.93 1544.18 625.476 1545.05 625.867 1546.09C626.258 1547.13 626.453 1548.34 626.453 1549.73V1550.98H612.635V1548.17H622.181C622.181 1547.51 622.039 1546.93 621.755 1546.43C621.471 1545.93 621.077 1545.53 620.572 1545.25C620.075 1544.96 619.496 1544.81 618.836 1544.81C618.147 1544.81 617.536 1544.97 617.003 1545.29C616.478 1545.6 616.066 1546.03 615.768 1546.56C615.469 1547.08 615.317 1547.67 615.309 1548.32V1550.99C615.309 1551.8 615.459 1552.5 615.757 1553.09C616.062 1553.68 616.492 1554.13 617.046 1554.45C617.6 1554.77 618.257 1554.93 619.017 1554.93C619.521 1554.93 619.983 1554.86 620.402 1554.72C620.821 1554.58 621.18 1554.36 621.478 1554.08C621.776 1553.8 622.003 1553.45 622.16 1553.04L626.357 1553.31C626.144 1554.32 625.707 1555.2 625.047 1555.95C624.393 1556.7 623.548 1557.28 622.511 1557.7C621.481 1558.11 620.292 1558.32 618.942 1558.32ZM643.03 1546.3L638.875 1546.56C638.804 1546.2 638.651 1545.88 638.417 1545.6C638.182 1545.31 637.873 1545.08 637.49 1544.91C637.113 1544.73 636.662 1544.64 636.137 1544.64C635.434 1544.64 634.841 1544.79 634.358 1545.09C633.875 1545.38 633.633 1545.77 633.633 1546.26C633.633 1546.65 633.79 1546.98 634.102 1547.25C634.415 1547.52 634.951 1547.74 635.711 1547.9L638.672 1548.5C640.263 1548.82 641.449 1549.35 642.231 1550.07C643.012 1550.8 643.403 1551.75 643.403 1552.93C643.403 1554 643.086 1554.94 642.454 1555.75C641.829 1556.56 640.97 1557.19 639.876 1557.65C638.79 1558.1 637.536 1558.32 636.116 1558.32C633.949 1558.32 632.224 1557.87 630.938 1556.97C629.66 1556.06 628.91 1554.82 628.69 1553.26L633.154 1553.02C633.289 1553.69 633.616 1554.19 634.134 1554.54C634.653 1554.88 635.317 1555.05 636.126 1555.05C636.922 1555.05 637.561 1554.9 638.044 1554.59C638.534 1554.28 638.782 1553.88 638.79 1553.39C638.782 1552.98 638.608 1552.64 638.268 1552.38C637.927 1552.11 637.401 1551.9 636.691 1551.76L633.857 1551.19C632.259 1550.87 631.069 1550.32 630.288 1549.53C629.514 1548.74 629.127 1547.74 629.127 1546.52C629.127 1545.46 629.411 1544.56 629.979 1543.8C630.555 1543.04 631.361 1542.45 632.398 1542.04C633.442 1541.63 634.663 1541.42 636.062 1541.42C638.129 1541.42 639.756 1541.86 640.942 1542.73C642.135 1543.61 642.831 1544.8 643.03 1546.3Z" fill="#335FFD"/>
+<g filter="url(#filter4_bd_12_480)">
+<rect x="474" y="145" width="367" height="373" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="474.5" y="145.5" width="366" height="372" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<g filter="url(#filter5_bd_12_480)">
+<rect x="540" y="413" width="109" height="65" rx="10" fill="#5900CB"/>
+<rect x="540.5" y="413.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M637.771 201.091C637.771 203.47 637.32 205.494 636.418 207.163C635.523 208.832 634.302 210.107 632.753 210.988C631.212 211.862 629.479 212.298 627.555 212.298C625.616 212.298 623.876 211.858 622.334 210.977C620.793 210.097 619.575 208.822 618.68 207.153C617.785 205.484 617.338 203.463 617.338 201.091C617.338 198.712 617.785 196.688 618.68 195.018C619.575 193.349 620.793 192.078 622.334 191.205C623.876 190.324 625.616 189.884 627.555 189.884C629.479 189.884 631.212 190.324 632.753 191.205C634.302 192.078 635.523 193.349 636.418 195.018C637.32 196.688 637.771 198.712 637.771 201.091ZM633.094 201.091C633.094 199.55 632.864 198.25 632.402 197.192C631.947 196.134 631.305 195.331 630.474 194.784C629.643 194.237 628.67 193.964 627.555 193.964C626.44 193.964 625.467 194.237 624.636 194.784C623.805 195.331 623.158 196.134 622.697 197.192C622.242 198.25 622.015 199.55 622.015 201.091C622.015 202.632 622.242 203.932 622.697 204.99C623.158 206.048 623.805 206.851 624.636 207.398C625.467 207.945 626.44 208.218 627.555 208.218C628.67 208.218 629.643 207.945 630.474 207.398C631.305 206.851 631.947 206.048 632.402 204.99C632.864 203.932 633.094 202.632 633.094 201.091ZM641.103 212V195.636H645.503V198.491H645.673C645.972 197.476 646.472 196.709 647.176 196.19C647.879 195.665 648.688 195.402 649.604 195.402C649.832 195.402 650.077 195.416 650.34 195.445C650.602 195.473 650.833 195.512 651.032 195.562V199.589C650.819 199.525 650.524 199.468 650.148 199.418C649.771 199.369 649.427 199.344 649.114 199.344C648.447 199.344 647.85 199.489 647.325 199.781C646.806 200.065 646.394 200.462 646.089 200.974C645.791 201.485 645.641 202.075 645.641 202.742V212H641.103ZM659.989 218.477C658.519 218.477 657.258 218.275 656.207 217.87C655.163 217.472 654.332 216.929 653.714 216.24C653.096 215.551 652.695 214.777 652.51 213.918L656.708 213.353C656.835 213.68 657.038 213.985 657.315 214.269C657.592 214.553 657.958 214.781 658.412 214.951C658.874 215.129 659.435 215.217 660.095 215.217C661.083 215.217 661.896 214.976 662.535 214.493C663.181 214.017 663.505 213.218 663.505 212.096V209.102H663.313C663.114 209.557 662.816 209.987 662.418 210.391C662.02 210.796 661.509 211.126 660.884 211.382C660.259 211.638 659.513 211.766 658.647 211.766C657.418 211.766 656.299 211.482 655.291 210.913C654.289 210.338 653.49 209.461 652.894 208.282C652.304 207.096 652.009 205.597 652.009 203.786C652.009 201.933 652.311 200.384 652.915 199.141C653.519 197.898 654.321 196.968 655.323 196.35C656.331 195.732 657.436 195.423 658.636 195.423C659.552 195.423 660.319 195.58 660.937 195.892C661.555 196.197 662.052 196.581 662.429 197.043C662.812 197.497 663.107 197.945 663.313 198.385H663.483V195.636H667.99V212.16C667.99 213.552 667.649 214.717 666.967 215.654C666.285 216.592 665.34 217.295 664.133 217.763C662.933 218.239 661.551 218.477 659.989 218.477ZM660.085 208.357C660.816 208.357 661.434 208.175 661.938 207.813C662.45 207.444 662.84 206.918 663.11 206.237C663.387 205.548 663.526 204.724 663.526 203.765C663.526 202.806 663.391 201.975 663.121 201.272C662.851 200.562 662.46 200.011 661.949 199.621C661.438 199.23 660.816 199.035 660.085 199.035C659.339 199.035 658.71 199.237 658.199 199.642C657.688 200.04 657.301 200.594 657.038 201.304C656.775 202.014 656.644 202.835 656.644 203.765C656.644 204.71 656.775 205.526 657.038 206.215C657.308 206.897 657.695 207.426 658.199 207.803C658.71 208.172 659.339 208.357 660.085 208.357ZM682.39 212H677.447L684.979 190.182H690.924L698.445 212H693.502L688.037 195.168H687.866L682.39 212ZM682.081 203.424H693.758V207.025H682.081V203.424Z" fill="#03031C"/>
+<path d="M566.462 291.58C575.757 291.58 583.292 282.272 583.292 270.79C583.292 259.308 575.757 250 566.462 250C557.167 250 549.632 259.308 549.632 270.79C549.632 282.272 557.167 291.58 566.462 291.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M579.134 284.848C579.134 284.848 590.111 290.919 594.717 294.696C595.809 295.595 596.747 296.67 597.493 297.878C598.852 300.146 599.556 302.754 599.527 305.406V321.017C590.389 329.317 578.547 333.921 566.264 333.952C553.968 333.99 542.102 329.376 533.001 321.017V305.406C532.972 302.754 533.676 300.146 535.035 297.878C535.781 296.67 536.719 295.595 537.811 294.696C542.417 290.958 553.412 284.452 553.412 284.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M542.699 303.856C542.29 304.577 542.086 305.394 542.11 306.22V317.077C548.976 322.12 557.308 324.844 565.868 324.844C574.427 324.844 582.759 322.12 589.625 317.077V306.295C589.653 305.471 589.454 304.654 589.049 303.932C582.364 310.252 574.423 314.043 565.868 314.043C557.312 314.043 549.372 310.226 542.699 303.856Z" fill="#5900CB"/>
+<path d="M552.411 356.818H554.613V368.857C554.613 370.099 554.32 371.209 553.734 372.186C553.154 373.156 552.334 373.923 551.275 374.485C550.216 375.041 548.973 375.32 547.546 375.32C546.12 375.32 544.877 375.041 543.818 374.485C542.758 373.923 541.936 373.156 541.35 372.186C540.77 371.209 540.48 370.099 540.48 368.857V356.818H542.681V368.679C542.681 369.567 542.877 370.357 543.267 371.049C543.658 371.736 544.214 372.277 544.936 372.674C545.664 373.065 546.534 373.26 547.546 373.26C548.558 373.26 549.428 373.065 550.156 372.674C550.884 372.277 551.441 371.736 551.825 371.049C552.216 370.357 552.411 369.567 552.411 368.679V356.818ZM568.385 364.418L566.503 364.95C566.384 364.637 566.21 364.332 565.979 364.036C565.754 363.734 565.446 363.485 565.056 363.29C564.665 363.095 564.165 362.997 563.555 362.997C562.721 362.997 562.025 363.19 561.469 363.574C560.919 363.953 560.643 364.435 560.643 365.021C560.643 365.542 560.833 365.953 561.212 366.255C561.59 366.557 562.182 366.809 562.987 367.01L565.011 367.507C566.23 367.803 567.139 368.256 567.737 368.865C568.335 369.469 568.633 370.247 568.633 371.2C568.633 371.982 568.408 372.68 567.959 373.295C567.515 373.911 566.893 374.396 566.094 374.751C565.295 375.107 564.366 375.284 563.307 375.284C561.916 375.284 560.765 374.982 559.853 374.379C558.942 373.775 558.365 372.893 558.122 371.733L560.111 371.236C560.3 371.97 560.658 372.52 561.185 372.887C561.718 373.254 562.413 373.438 563.271 373.438C564.248 373.438 565.023 373.23 565.597 372.816C566.177 372.396 566.467 371.893 566.467 371.307C566.467 370.833 566.301 370.437 565.97 370.117C565.639 369.792 565.13 369.549 564.443 369.389L562.17 368.857C560.922 368.561 560.004 368.102 559.418 367.48C558.838 366.853 558.548 366.069 558.548 365.128C558.548 364.358 558.764 363.678 559.196 363.086C559.634 362.494 560.229 362.029 560.981 361.692C561.738 361.355 562.596 361.186 563.555 361.186C564.905 361.186 565.964 361.482 566.734 362.074C567.509 362.666 568.059 363.447 568.385 364.418ZM577.505 375.284C576.191 375.284 575.057 374.994 574.104 374.414C573.157 373.828 572.426 373.011 571.912 371.964C571.403 370.91 571.148 369.685 571.148 368.288C571.148 366.892 571.403 365.661 571.912 364.595C572.426 363.524 573.143 362.689 574.06 362.092C574.983 361.488 576.06 361.186 577.292 361.186C578.002 361.186 578.703 361.304 579.396 361.541C580.088 361.778 580.718 362.163 581.287 362.695C581.855 363.222 582.307 363.92 582.645 364.79C582.982 365.661 583.151 366.732 583.151 368.004V368.892H572.64V367.081H581.02C581.02 366.312 580.866 365.625 580.559 365.021C580.257 364.418 579.825 363.941 579.262 363.592C578.706 363.243 578.049 363.068 577.292 363.068C576.457 363.068 575.735 363.275 575.125 363.69C574.522 364.098 574.057 364.631 573.731 365.288C573.406 365.945 573.243 366.649 573.243 367.401V368.608C573.243 369.638 573.421 370.511 573.776 371.227C574.137 371.937 574.637 372.479 575.276 372.852C575.915 373.219 576.658 373.402 577.505 373.402C578.055 373.402 578.552 373.325 578.996 373.171C579.446 373.011 579.834 372.775 580.159 372.461C580.485 372.141 580.736 371.745 580.914 371.271L582.938 371.839C582.725 372.526 582.367 373.13 581.864 373.651C581.361 374.165 580.739 374.568 579.999 374.858C579.259 375.142 578.428 375.284 577.505 375.284ZM586.338 375V361.364H588.362V363.423H588.504C588.753 362.749 589.203 362.201 589.854 361.781C590.505 361.361 591.239 361.151 592.055 361.151C592.209 361.151 592.402 361.154 592.632 361.159C592.863 361.165 593.038 361.174 593.156 361.186V363.317C593.085 363.299 592.922 363.272 592.668 363.237C592.419 363.195 592.156 363.175 591.878 363.175C591.215 363.175 590.623 363.314 590.102 363.592C589.587 363.864 589.179 364.243 588.877 364.728C588.581 365.208 588.433 365.755 588.433 366.371V375H586.338Z" fill="#03031C"/>
+<path d="M582.803 453.32C581.939 453.32 581.155 453.157 580.451 452.831C579.747 452.5 579.187 452.023 578.773 451.402C578.359 450.775 578.151 450.017 578.151 449.129C578.151 448.348 578.305 447.715 578.613 447.229C578.921 446.738 579.332 446.353 579.847 446.075C580.362 445.797 580.93 445.59 581.552 445.454C582.179 445.312 582.809 445.199 583.443 445.116C584.271 445.01 584.943 444.93 585.458 444.877C585.979 444.818 586.358 444.72 586.594 444.584C586.837 444.448 586.958 444.211 586.958 443.874V443.803C586.958 442.927 586.719 442.246 586.239 441.761C585.766 441.275 585.047 441.033 584.082 441.033C583.082 441.033 582.297 441.252 581.729 441.69C581.161 442.128 580.762 442.595 580.531 443.092L578.542 442.382C578.897 441.554 579.371 440.908 579.963 440.447C580.56 439.979 581.211 439.654 581.916 439.47C582.626 439.281 583.324 439.186 584.011 439.186C584.449 439.186 584.952 439.239 585.52 439.346C586.094 439.446 586.648 439.657 587.18 439.976C587.719 440.296 588.166 440.778 588.521 441.423C588.876 442.068 589.053 442.933 589.053 444.016V453H586.958V451.153H586.852C586.71 451.449 586.473 451.766 586.142 452.103C585.81 452.441 585.369 452.728 584.819 452.964C584.268 453.201 583.597 453.32 582.803 453.32ZM583.123 451.438C583.952 451.438 584.65 451.275 585.218 450.949C585.792 450.624 586.224 450.203 586.514 449.689C586.81 449.174 586.958 448.632 586.958 448.064V446.146C586.869 446.253 586.674 446.35 586.372 446.439C586.076 446.522 585.733 446.596 585.343 446.661C584.958 446.72 584.582 446.774 584.215 446.821C583.854 446.862 583.561 446.898 583.336 446.928C582.792 446.999 582.283 447.114 581.809 447.274C581.342 447.428 580.963 447.661 580.673 447.975C580.389 448.283 580.247 448.703 580.247 449.236C580.247 449.964 580.516 450.514 581.055 450.887C581.599 451.254 582.289 451.438 583.123 451.438ZM592.878 458.114V439.364H594.902V441.53H595.15C595.304 441.293 595.517 440.991 595.79 440.624C596.068 440.251 596.464 439.92 596.979 439.63C597.5 439.334 598.204 439.186 599.092 439.186C600.24 439.186 601.252 439.473 602.128 440.047C603.004 440.621 603.688 441.435 604.179 442.489C604.67 443.542 604.916 444.785 604.916 446.217C604.916 447.661 604.67 448.913 604.179 449.973C603.688 451.026 603.007 451.843 602.137 452.423C601.267 452.997 600.264 453.284 599.128 453.284C598.252 453.284 597.55 453.139 597.024 452.849C596.497 452.553 596.091 452.219 595.807 451.846C595.523 451.467 595.304 451.153 595.15 450.905H594.973V458.114H592.878ZM594.937 446.182C594.937 447.212 595.088 448.12 595.39 448.907C595.692 449.689 596.133 450.301 596.713 450.745C597.293 451.183 598.003 451.402 598.843 451.402C599.719 451.402 600.45 451.171 601.036 450.71C601.628 450.242 602.072 449.615 602.368 448.827C602.67 448.034 602.821 447.152 602.821 446.182C602.821 445.223 602.673 444.359 602.377 443.589C602.087 442.814 601.646 442.202 601.054 441.752C600.468 441.296 599.731 441.068 598.843 441.068C597.991 441.068 597.275 441.284 596.695 441.716C596.115 442.142 595.677 442.74 595.381 443.51C595.085 444.273 594.937 445.164 594.937 446.182ZM608.112 453V439.364H610.207V453H608.112ZM609.177 437.091C608.769 437.091 608.417 436.952 608.121 436.674C607.831 436.395 607.686 436.061 607.686 435.67C607.686 435.28 607.831 434.945 608.121 434.667C608.417 434.389 608.769 434.25 609.177 434.25C609.586 434.25 609.935 434.389 610.225 434.667C610.521 434.945 610.669 435.28 610.669 435.67C610.669 436.061 610.521 436.395 610.225 436.674C609.935 436.952 609.586 437.091 609.177 437.091Z" fill="white"/>
+<g filter="url(#filter6_bd_12_480)">
+<rect x="532" y="1126" width="286" height="65" rx="10" fill="#5900CB"/>
+<rect x="532.5" y="1126.5" width="285" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M579.799 1156.91C579.799 1158.83 579.453 1160.48 578.76 1161.88C578.068 1163.28 577.118 1164.35 575.91 1165.11C574.703 1165.87 573.324 1166.25 571.773 1166.25C570.223 1166.25 568.844 1165.87 567.636 1165.11C566.429 1164.35 565.479 1163.28 564.787 1161.88C564.094 1160.48 563.748 1158.83 563.748 1156.91C563.748 1154.99 564.094 1153.33 564.787 1151.94C565.479 1150.54 566.429 1149.46 567.636 1148.71C568.844 1147.95 570.223 1147.57 571.773 1147.57C573.324 1147.57 574.703 1147.95 575.91 1148.71C577.118 1149.46 578.068 1150.54 578.76 1151.94C579.453 1153.33 579.799 1154.99 579.799 1156.91ZM577.668 1156.91C577.668 1155.33 577.405 1154.01 576.878 1152.92C576.357 1151.84 575.65 1151.02 574.756 1150.46C573.869 1149.91 572.874 1149.63 571.773 1149.63C570.673 1149.63 569.675 1149.91 568.782 1150.46C567.894 1151.02 567.187 1151.84 566.66 1152.92C566.139 1154.01 565.879 1155.33 565.879 1156.91C565.879 1158.48 566.139 1159.81 566.66 1160.9C567.187 1161.98 567.894 1162.8 568.782 1163.35C569.675 1163.91 570.673 1164.19 571.773 1164.19C572.874 1164.19 573.869 1163.91 574.756 1163.35C575.65 1162.8 576.357 1161.98 576.878 1160.9C577.405 1159.81 577.668 1158.48 577.668 1156.91ZM583.217 1171.11V1152.36H585.241V1154.53H585.49C585.644 1154.29 585.857 1153.99 586.129 1153.62C586.407 1153.25 586.804 1152.92 587.318 1152.63C587.839 1152.33 588.544 1152.19 589.431 1152.19C590.58 1152.19 591.592 1152.47 592.468 1153.05C593.344 1153.62 594.027 1154.44 594.518 1155.49C595.01 1156.54 595.255 1157.79 595.255 1159.22C595.255 1160.66 595.01 1161.91 594.518 1162.97C594.027 1164.03 593.347 1164.84 592.477 1165.42C591.606 1166 590.603 1166.28 589.467 1166.28C588.591 1166.28 587.89 1166.14 587.363 1165.85C586.836 1165.55 586.431 1165.22 586.147 1164.85C585.863 1164.47 585.644 1164.15 585.49 1163.9H585.312V1171.11H583.217ZM585.277 1159.18C585.277 1160.21 585.428 1161.12 585.729 1161.91C586.031 1162.69 586.472 1163.3 587.052 1163.75C587.632 1164.18 588.342 1164.4 589.183 1164.4C590.059 1164.4 590.79 1164.17 591.376 1163.71C591.968 1163.24 592.411 1162.61 592.707 1161.83C593.009 1161.03 593.16 1160.15 593.16 1159.18C593.16 1158.22 593.012 1157.36 592.716 1156.59C592.426 1155.81 591.985 1155.2 591.393 1154.75C590.807 1154.3 590.071 1154.07 589.183 1154.07C588.331 1154.07 587.614 1154.28 587.034 1154.72C586.454 1155.14 586.016 1155.74 585.72 1156.51C585.425 1157.27 585.277 1158.16 585.277 1159.18ZM604.169 1166.28C602.855 1166.28 601.721 1165.99 600.768 1165.41C599.821 1164.83 599.091 1164.01 598.576 1162.96C598.067 1161.91 597.812 1160.69 597.812 1159.29C597.812 1157.89 598.067 1156.66 598.576 1155.6C599.091 1154.52 599.807 1153.69 600.724 1153.09C601.647 1152.49 602.725 1152.19 603.956 1152.19C604.666 1152.19 605.367 1152.3 606.06 1152.54C606.752 1152.78 607.382 1153.16 607.951 1153.7C608.519 1154.22 608.972 1154.92 609.309 1155.79C609.646 1156.66 609.815 1157.73 609.815 1159V1159.89H599.304V1158.08H607.684C607.684 1157.31 607.53 1156.62 607.223 1156.02C606.921 1155.42 606.489 1154.94 605.926 1154.59C605.37 1154.24 604.713 1154.07 603.956 1154.07C603.121 1154.07 602.399 1154.28 601.789 1154.69C601.186 1155.1 600.721 1155.63 600.396 1156.29C600.07 1156.94 599.907 1157.65 599.907 1158.4V1159.61C599.907 1160.64 600.085 1161.51 600.44 1162.23C600.801 1162.94 601.301 1163.48 601.94 1163.85C602.58 1164.22 603.322 1164.4 604.169 1164.4C604.719 1164.4 605.216 1164.33 605.66 1164.17C606.11 1164.01 606.498 1163.77 606.823 1163.46C607.149 1163.14 607.4 1162.74 607.578 1162.27L609.602 1162.84C609.389 1163.53 609.031 1164.13 608.528 1164.65C608.025 1165.17 607.403 1165.57 606.663 1165.86C605.923 1166.14 605.092 1166.28 604.169 1166.28ZM613.002 1166V1152.36H615.026V1154.42H615.168C615.417 1153.75 615.867 1153.2 616.518 1152.78C617.169 1152.36 617.903 1152.15 618.719 1152.15C618.873 1152.15 619.066 1152.15 619.296 1152.16C619.527 1152.17 619.702 1152.17 619.82 1152.19V1154.32C619.749 1154.3 619.586 1154.27 619.332 1154.24C619.083 1154.2 618.82 1154.17 618.542 1154.17C617.879 1154.17 617.287 1154.31 616.766 1154.59C616.251 1154.86 615.843 1155.24 615.541 1155.73C615.245 1156.21 615.097 1156.76 615.097 1157.37V1166H613.002ZM626.317 1166.32C625.453 1166.32 624.668 1166.16 623.964 1165.83C623.26 1165.5 622.7 1165.02 622.286 1164.4C621.872 1163.77 621.665 1163.02 621.665 1162.13C621.665 1161.35 621.819 1160.71 622.126 1160.23C622.434 1159.74 622.845 1159.35 623.36 1159.08C623.875 1158.8 624.443 1158.59 625.065 1158.45C625.692 1158.31 626.323 1158.2 626.956 1158.12C627.784 1158.01 628.456 1157.93 628.971 1157.88C629.492 1157.82 629.871 1157.72 630.107 1157.58C630.35 1157.45 630.471 1157.21 630.471 1156.87V1156.8C630.471 1155.93 630.232 1155.25 629.752 1154.76C629.279 1154.28 628.56 1154.03 627.595 1154.03C626.595 1154.03 625.811 1154.25 625.242 1154.69C624.674 1155.13 624.275 1155.6 624.044 1156.09L622.055 1155.38C622.41 1154.55 622.884 1153.91 623.476 1153.45C624.073 1152.98 624.725 1152.65 625.429 1152.47C626.139 1152.28 626.837 1152.19 627.524 1152.19C627.962 1152.19 628.465 1152.24 629.033 1152.35C629.607 1152.45 630.161 1152.66 630.693 1152.98C631.232 1153.3 631.679 1153.78 632.034 1154.42C632.389 1155.07 632.567 1155.93 632.567 1157.02V1166H630.471V1164.15H630.365C630.223 1164.45 629.986 1164.77 629.655 1165.1C629.323 1165.44 628.882 1165.73 628.332 1165.96C627.781 1166.2 627.11 1166.32 626.317 1166.32ZM626.636 1164.44C627.465 1164.44 628.163 1164.27 628.731 1163.95C629.306 1163.62 629.738 1163.2 630.028 1162.69C630.323 1162.17 630.471 1161.63 630.471 1161.06V1159.15C630.383 1159.25 630.187 1159.35 629.886 1159.44C629.59 1159.52 629.246 1159.6 628.856 1159.66C628.471 1159.72 628.095 1159.77 627.728 1159.82C627.367 1159.86 627.074 1159.9 626.849 1159.93C626.305 1160 625.796 1160.11 625.322 1160.27C624.855 1160.43 624.476 1160.66 624.186 1160.98C623.902 1161.28 623.76 1161.7 623.76 1162.24C623.76 1162.96 624.029 1163.51 624.568 1163.89C625.112 1164.25 625.802 1164.44 626.636 1164.44ZM642.321 1152.36V1154.14H635.254V1152.36H642.321ZM637.314 1149.1H639.409V1162.09C639.409 1162.69 639.495 1163.13 639.667 1163.43C639.844 1163.72 640.069 1163.91 640.341 1164.01C640.62 1164.11 640.913 1164.15 641.22 1164.15C641.451 1164.15 641.641 1164.14 641.788 1164.12C641.936 1164.09 642.055 1164.06 642.144 1164.05L642.57 1165.93C642.428 1165.98 642.229 1166.04 641.975 1166.09C641.72 1166.15 641.398 1166.18 641.007 1166.18C640.415 1166.18 639.835 1166.05 639.267 1165.8C638.705 1165.54 638.237 1165.15 637.864 1164.63C637.498 1164.11 637.314 1163.46 637.314 1162.66V1149.1ZM650.866 1166.28C649.635 1166.28 648.555 1165.99 647.626 1165.41C646.702 1164.82 645.98 1164 645.459 1162.95C644.945 1161.89 644.687 1160.66 644.687 1159.25C644.687 1157.83 644.945 1156.59 645.459 1155.53C645.98 1154.47 646.702 1153.65 647.626 1153.06C648.555 1152.48 649.635 1152.19 650.866 1152.19C652.097 1152.19 653.174 1152.48 654.098 1153.06C655.027 1153.65 655.749 1154.47 656.264 1155.53C656.785 1156.59 657.045 1157.83 657.045 1159.25C657.045 1160.66 656.785 1161.89 656.264 1162.95C655.749 1164 655.027 1164.82 654.098 1165.41C653.174 1165.99 652.097 1166.28 650.866 1166.28ZM650.866 1164.4C651.801 1164.4 652.571 1164.16 653.174 1163.68C653.778 1163.2 654.225 1162.57 654.515 1161.79C654.805 1161.01 654.95 1160.16 654.95 1159.25C654.95 1158.34 654.805 1157.49 654.515 1156.7C654.225 1155.92 653.778 1155.28 653.174 1154.8C652.571 1154.31 651.801 1154.07 650.866 1154.07C649.931 1154.07 649.162 1154.31 648.558 1154.8C647.954 1155.28 647.507 1155.92 647.217 1156.7C646.927 1157.49 646.782 1158.34 646.782 1159.25C646.782 1160.16 646.927 1161.01 647.217 1161.79C647.507 1162.57 647.954 1163.2 648.558 1163.68C649.162 1164.16 649.931 1164.4 650.866 1164.4ZM660.243 1166V1152.36H662.267V1154.42H662.409C662.658 1153.75 663.108 1153.2 663.759 1152.78C664.41 1152.36 665.144 1152.15 665.961 1152.15C666.115 1152.15 666.307 1152.15 666.538 1152.16C666.769 1152.17 666.943 1152.17 667.061 1152.19V1154.32C666.99 1154.3 666.828 1154.27 666.573 1154.24C666.325 1154.2 666.061 1154.17 665.783 1154.17C665.12 1154.17 664.528 1154.31 664.008 1154.59C663.493 1154.86 663.084 1155.24 662.782 1155.73C662.486 1156.21 662.338 1156.76 662.338 1157.37V1166H660.243ZM691.491 1153.5H689.289C689.159 1152.87 688.931 1152.31 688.606 1151.83C688.286 1151.35 687.896 1150.95 687.434 1150.62C686.978 1150.29 686.472 1150.04 685.916 1149.88C685.359 1149.71 684.779 1149.63 684.176 1149.63C683.075 1149.63 682.078 1149.91 681.184 1150.46C680.296 1151.02 679.589 1151.84 679.062 1152.92C678.541 1154.01 678.281 1155.33 678.281 1156.91C678.281 1158.48 678.541 1159.81 679.062 1160.9C679.589 1161.98 680.296 1162.8 681.184 1163.35C682.078 1163.91 683.075 1164.19 684.176 1164.19C684.779 1164.19 685.359 1164.11 685.916 1163.94C686.472 1163.77 686.978 1163.53 687.434 1163.2C687.896 1162.87 688.286 1162.47 688.606 1161.99C688.931 1161.5 689.159 1160.95 689.289 1160.32H691.491C691.325 1161.25 691.024 1162.08 690.586 1162.81C690.148 1163.55 689.603 1164.17 688.952 1164.69C688.301 1165.2 687.57 1165.58 686.759 1165.85C685.954 1166.12 685.093 1166.25 684.176 1166.25C682.625 1166.25 681.246 1165.87 680.039 1165.11C678.831 1164.35 677.881 1163.28 677.189 1161.88C676.496 1160.48 676.15 1158.83 676.15 1156.91C676.15 1154.99 676.496 1153.33 677.189 1151.94C677.881 1150.54 678.831 1149.46 680.039 1148.71C681.246 1147.95 682.625 1147.57 684.176 1147.57C685.093 1147.57 685.954 1147.7 686.759 1147.97C687.57 1148.24 688.301 1148.63 688.952 1149.14C689.603 1149.65 690.148 1150.27 690.586 1151.01C691.024 1151.73 691.325 1152.56 691.491 1153.5ZM700.305 1166.28C699.073 1166.28 697.993 1165.99 697.064 1165.41C696.141 1164.82 695.419 1164 694.898 1162.95C694.383 1161.89 694.126 1160.66 694.126 1159.25C694.126 1157.83 694.383 1156.59 694.898 1155.53C695.419 1154.47 696.141 1153.65 697.064 1153.06C697.993 1152.48 699.073 1152.19 700.305 1152.19C701.536 1152.19 702.613 1152.48 703.536 1153.06C704.465 1153.65 705.187 1154.47 705.702 1155.53C706.223 1156.59 706.484 1157.83 706.484 1159.25C706.484 1160.66 706.223 1161.89 705.702 1162.95C705.187 1164 704.465 1164.82 703.536 1165.41C702.613 1165.99 701.536 1166.28 700.305 1166.28ZM700.305 1164.4C701.24 1164.4 702.009 1164.16 702.613 1163.68C703.216 1163.2 703.663 1162.57 703.953 1161.79C704.243 1161.01 704.388 1160.16 704.388 1159.25C704.388 1158.34 704.243 1157.49 703.953 1156.7C703.663 1155.92 703.216 1155.28 702.613 1154.8C702.009 1154.31 701.24 1154.07 700.305 1154.07C699.369 1154.07 698.6 1154.31 697.996 1154.8C697.393 1155.28 696.946 1155.92 696.656 1156.7C696.366 1157.49 696.221 1158.34 696.221 1159.25C696.221 1160.16 696.366 1161.01 696.656 1161.79C696.946 1162.57 697.393 1163.2 697.996 1163.68C698.6 1164.16 699.369 1164.4 700.305 1164.4ZM711.777 1157.8V1166H709.682V1152.36H711.706V1154.49H711.883C712.203 1153.8 712.688 1153.25 713.339 1152.83C713.99 1152.4 714.831 1152.19 715.861 1152.19C716.784 1152.19 717.592 1152.38 718.284 1152.75C718.977 1153.13 719.515 1153.7 719.9 1154.46C720.285 1155.22 720.477 1156.18 720.477 1157.34V1166H718.382V1157.48C718.382 1156.41 718.104 1155.57 717.548 1154.97C716.991 1154.37 716.228 1154.07 715.257 1154.07C714.588 1154.07 713.99 1154.21 713.464 1154.5C712.943 1154.79 712.532 1155.22 712.23 1155.77C711.928 1156.33 711.777 1157 711.777 1157.8ZM730.236 1152.36V1154.14H723.169V1152.36H730.236ZM725.229 1149.1H727.324V1162.09C727.324 1162.69 727.41 1163.13 727.582 1163.43C727.759 1163.72 727.984 1163.91 728.256 1164.01C728.535 1164.11 728.828 1164.15 729.135 1164.15C729.366 1164.15 729.556 1164.14 729.704 1164.12C729.851 1164.09 729.97 1164.06 730.059 1164.05L730.485 1165.93C730.343 1165.98 730.144 1166.04 729.89 1166.09C729.635 1166.15 729.313 1166.18 728.922 1166.18C728.33 1166.18 727.75 1166.05 727.182 1165.8C726.62 1165.54 726.152 1165.15 725.78 1164.63C725.413 1164.11 725.229 1163.46 725.229 1162.66V1149.1ZM738.959 1166.28C737.645 1166.28 736.511 1165.99 735.558 1165.41C734.611 1164.83 733.881 1164.01 733.366 1162.96C732.857 1161.91 732.602 1160.69 732.602 1159.29C732.602 1157.89 732.857 1156.66 733.366 1155.6C733.881 1154.52 734.597 1153.69 735.514 1153.09C736.437 1152.49 737.515 1152.19 738.746 1152.19C739.456 1152.19 740.157 1152.3 740.85 1152.54C741.542 1152.78 742.172 1153.16 742.741 1153.7C743.309 1154.22 743.762 1154.92 744.099 1155.79C744.436 1156.66 744.605 1157.73 744.605 1159V1159.89H734.094V1158.08H742.474C742.474 1157.31 742.32 1156.62 742.013 1156.02C741.711 1155.42 741.279 1154.94 740.716 1154.59C740.16 1154.24 739.503 1154.07 738.746 1154.07C737.911 1154.07 737.189 1154.28 736.579 1154.69C735.976 1155.1 735.511 1155.63 735.186 1156.29C734.86 1156.94 734.697 1157.65 734.697 1158.4V1159.61C734.697 1160.64 734.875 1161.51 735.23 1162.23C735.591 1162.94 736.091 1163.48 736.73 1163.85C737.37 1164.22 738.112 1164.4 738.959 1164.4C739.509 1164.4 740.006 1164.33 740.45 1164.17C740.9 1164.01 741.288 1163.77 741.613 1163.46C741.939 1163.14 742.19 1162.74 742.368 1162.27L744.392 1162.84C744.179 1163.53 743.821 1164.13 743.318 1164.65C742.815 1165.17 742.193 1165.57 741.453 1165.86C740.714 1166.14 739.882 1166.28 738.959 1166.28ZM748.988 1152.36L752.255 1157.94L755.523 1152.36H757.937L753.534 1159.18L757.937 1166H755.523L752.255 1160.71L748.988 1166H746.574L750.906 1159.18L746.574 1152.36H748.988ZM766.857 1152.36V1154.14H759.791V1152.36H766.857ZM761.85 1149.1H763.945V1162.09C763.945 1162.69 764.031 1163.13 764.203 1163.43C764.38 1163.72 764.605 1163.91 764.878 1164.01C765.156 1164.11 765.449 1164.15 765.756 1164.15C765.987 1164.15 766.177 1164.14 766.325 1164.12C766.473 1164.09 766.591 1164.06 766.68 1164.05L767.106 1165.93C766.964 1165.98 766.766 1166.04 766.511 1166.09C766.257 1166.15 765.934 1166.18 765.543 1166.18C764.952 1166.18 764.371 1166.05 763.803 1165.8C763.241 1165.54 762.773 1165.15 762.401 1164.63C762.034 1164.11 761.85 1163.46 761.85 1162.66V1149.1ZM783.397 1147.82V1166H781.195V1150.13H781.088L776.65 1153.07V1150.84L781.195 1147.82H783.397Z" fill="white"/>
+<g filter="url(#filter7_bd_12_480)">
+<rect x="892" y="1126" width="286" height="65" rx="10" fill="#FFC743"/>
+<rect x="892.5" y="1126.5" width="285" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M938.041 1156.91C938.041 1158.83 937.695 1160.48 937.002 1161.88C936.31 1163.28 935.36 1164.35 934.153 1165.11C932.945 1165.87 931.566 1166.25 930.016 1166.25C928.465 1166.25 927.086 1165.87 925.879 1165.11C924.671 1164.35 923.721 1163.28 923.029 1161.88C922.336 1160.48 921.99 1158.83 921.99 1156.91C921.99 1154.99 922.336 1153.33 923.029 1151.94C923.721 1150.54 924.671 1149.46 925.879 1148.71C927.086 1147.95 928.465 1147.57 930.016 1147.57C931.566 1147.57 932.945 1147.95 934.153 1148.71C935.36 1149.46 936.31 1150.54 937.002 1151.94C937.695 1153.33 938.041 1154.99 938.041 1156.91ZM935.91 1156.91C935.91 1155.33 935.647 1154.01 935.12 1152.92C934.6 1151.84 933.892 1151.02 932.999 1150.46C932.111 1149.91 931.116 1149.63 930.016 1149.63C928.915 1149.63 927.917 1149.91 927.024 1150.46C926.136 1151.02 925.429 1151.84 924.902 1152.92C924.381 1154.01 924.121 1155.33 924.121 1156.91C924.121 1158.48 924.381 1159.81 924.902 1160.9C925.429 1161.98 926.136 1162.8 927.024 1163.35C927.917 1163.91 928.915 1164.19 930.016 1164.19C931.116 1164.19 932.111 1163.91 932.999 1163.35C933.892 1162.8 934.6 1161.98 935.12 1160.9C935.647 1159.81 935.91 1158.48 935.91 1156.91ZM941.459 1171.11V1152.36H943.483V1154.53H943.732C943.886 1154.29 944.099 1153.99 944.371 1153.62C944.649 1153.25 945.046 1152.92 945.561 1152.63C946.082 1152.33 946.786 1152.19 947.674 1152.19C948.822 1152.19 949.834 1152.47 950.71 1153.05C951.586 1153.62 952.269 1154.44 952.761 1155.49C953.252 1156.54 953.497 1157.79 953.497 1159.22C953.497 1160.66 953.252 1161.91 952.761 1162.97C952.269 1164.03 951.589 1164.84 950.719 1165.42C949.849 1166 948.845 1166.28 947.709 1166.28C946.833 1166.28 946.132 1166.14 945.605 1165.85C945.078 1165.55 944.673 1165.22 944.389 1164.85C944.105 1164.47 943.886 1164.15 943.732 1163.9H943.554V1171.11H941.459ZM943.519 1159.18C943.519 1160.21 943.67 1161.12 943.972 1161.91C944.273 1162.69 944.714 1163.3 945.294 1163.75C945.874 1164.18 946.585 1164.4 947.425 1164.4C948.301 1164.4 949.032 1164.17 949.618 1163.71C950.21 1163.24 950.654 1162.61 950.95 1161.83C951.251 1161.03 951.402 1160.15 951.402 1159.18C951.402 1158.22 951.254 1157.36 950.958 1156.59C950.668 1155.81 950.227 1155.2 949.636 1154.75C949.05 1154.3 948.313 1154.07 947.425 1154.07C946.573 1154.07 945.857 1154.28 945.277 1154.72C944.697 1155.14 944.259 1155.74 943.963 1156.51C943.667 1157.27 943.519 1158.16 943.519 1159.18ZM962.411 1166.28C961.097 1166.28 959.963 1165.99 959.011 1165.41C958.064 1164.83 957.333 1164.01 956.818 1162.96C956.309 1161.91 956.054 1160.69 956.054 1159.29C956.054 1157.89 956.309 1156.66 956.818 1155.6C957.333 1154.52 958.049 1153.69 958.966 1153.09C959.89 1152.49 960.967 1152.19 962.198 1152.19C962.908 1152.19 963.609 1152.3 964.302 1152.54C964.994 1152.78 965.625 1153.16 966.193 1153.7C966.761 1154.22 967.214 1154.92 967.551 1155.79C967.888 1156.66 968.057 1157.73 968.057 1159V1159.89H957.546V1158.08H965.926C965.926 1157.31 965.773 1156.62 965.465 1156.02C965.163 1155.42 964.731 1154.94 964.169 1154.59C963.612 1154.24 962.955 1154.07 962.198 1154.07C961.363 1154.07 960.641 1154.28 960.032 1154.69C959.428 1155.1 958.963 1155.63 958.638 1156.29C958.312 1156.94 958.149 1157.65 958.149 1158.4V1159.61C958.149 1160.64 958.327 1161.51 958.682 1162.23C959.043 1162.94 959.543 1163.48 960.182 1163.85C960.822 1164.22 961.564 1164.4 962.411 1164.4C962.961 1164.4 963.458 1164.33 963.902 1164.17C964.352 1164.01 964.74 1163.77 965.065 1163.46C965.391 1163.14 965.642 1162.74 965.82 1162.27L967.844 1162.84C967.631 1163.53 967.273 1164.13 966.77 1164.65C966.267 1165.17 965.645 1165.57 964.905 1165.86C964.166 1166.14 963.334 1166.28 962.411 1166.28ZM971.244 1166V1152.36H973.268V1154.42H973.41C973.659 1153.75 974.109 1153.2 974.76 1152.78C975.411 1152.36 976.145 1152.15 976.962 1152.15C977.115 1152.15 977.308 1152.15 977.539 1152.16C977.769 1152.17 977.944 1152.17 978.062 1152.19V1154.32C977.991 1154.3 977.829 1154.27 977.574 1154.24C977.326 1154.2 977.062 1154.17 976.784 1154.17C976.121 1154.17 975.529 1154.31 975.008 1154.59C974.494 1154.86 974.085 1155.24 973.783 1155.73C973.487 1156.21 973.339 1156.76 973.339 1157.37V1166H971.244ZM984.559 1166.32C983.695 1166.32 982.91 1166.16 982.206 1165.83C981.502 1165.5 980.943 1165.02 980.528 1164.4C980.114 1163.77 979.907 1163.02 979.907 1162.13C979.907 1161.35 980.061 1160.71 980.368 1160.23C980.676 1159.74 981.088 1159.35 981.602 1159.08C982.117 1158.8 982.686 1158.59 983.307 1158.45C983.934 1158.31 984.565 1158.2 985.198 1158.12C986.027 1158.01 986.698 1157.93 987.213 1157.88C987.734 1157.82 988.113 1157.72 988.35 1157.58C988.592 1157.45 988.714 1157.21 988.714 1156.87V1156.8C988.714 1155.93 988.474 1155.25 987.995 1154.76C987.521 1154.28 986.802 1154.03 985.837 1154.03C984.837 1154.03 984.053 1154.25 983.485 1154.69C982.916 1155.13 982.517 1155.6 982.286 1156.09L980.297 1155.38C980.653 1154.55 981.126 1153.91 981.718 1153.45C982.316 1152.98 982.967 1152.65 983.671 1152.47C984.381 1152.28 985.08 1152.19 985.766 1152.19C986.204 1152.19 986.707 1152.24 987.275 1152.35C987.85 1152.45 988.403 1152.66 988.936 1152.98C989.474 1153.3 989.921 1153.78 990.276 1154.42C990.631 1155.07 990.809 1155.93 990.809 1157.02V1166H988.714V1164.15H988.607C988.465 1164.45 988.228 1164.77 987.897 1165.1C987.565 1165.44 987.125 1165.73 986.574 1165.96C986.024 1166.2 985.352 1166.32 984.559 1166.32ZM984.878 1164.44C985.707 1164.44 986.405 1164.27 986.974 1163.95C987.548 1163.62 987.98 1163.2 988.27 1162.69C988.566 1162.17 988.714 1161.63 988.714 1161.06V1159.15C988.625 1159.25 988.43 1159.35 988.128 1159.44C987.832 1159.52 987.489 1159.6 987.098 1159.66C986.713 1159.72 986.337 1159.77 985.97 1159.82C985.609 1159.86 985.316 1159.9 985.091 1159.93C984.547 1160 984.038 1160.11 983.564 1160.27C983.097 1160.43 982.718 1160.66 982.428 1160.98C982.144 1161.28 982.002 1161.7 982.002 1162.24C982.002 1162.96 982.271 1163.51 982.81 1163.89C983.354 1164.25 984.044 1164.44 984.878 1164.44ZM1000.56 1152.36V1154.14H993.497V1152.36H1000.56ZM995.556 1149.1H997.651V1162.09C997.651 1162.69 997.737 1163.13 997.909 1163.43C998.086 1163.72 998.311 1163.91 998.584 1164.01C998.862 1164.11 999.155 1164.15 999.462 1164.15C999.693 1164.15 999.883 1164.14 1000.03 1164.12C1000.18 1164.09 1000.3 1164.06 1000.39 1164.05L1000.81 1165.93C1000.67 1165.98 1000.47 1166.04 1000.22 1166.09C999.963 1166.15 999.64 1166.18 999.249 1166.18C998.658 1166.18 998.078 1166.05 997.509 1165.8C996.947 1165.54 996.48 1165.15 996.107 1164.63C995.74 1164.11 995.556 1163.46 995.556 1162.66V1149.1ZM1009.11 1166.28C1007.88 1166.28 1006.8 1165.99 1005.87 1165.41C1004.94 1164.82 1004.22 1164 1003.7 1162.95C1003.19 1161.89 1002.93 1160.66 1002.93 1159.25C1002.93 1157.83 1003.19 1156.59 1003.7 1155.53C1004.22 1154.47 1004.94 1153.65 1005.87 1153.06C1006.8 1152.48 1007.88 1152.19 1009.11 1152.19C1010.34 1152.19 1011.42 1152.48 1012.34 1153.06C1013.27 1153.65 1013.99 1154.47 1014.51 1155.53C1015.03 1156.59 1015.29 1157.83 1015.29 1159.25C1015.29 1160.66 1015.03 1161.89 1014.51 1162.95C1013.99 1164 1013.27 1164.82 1012.34 1165.41C1011.42 1165.99 1010.34 1166.28 1009.11 1166.28ZM1009.11 1164.4C1010.04 1164.4 1010.81 1164.16 1011.42 1163.68C1012.02 1163.2 1012.47 1162.57 1012.76 1161.79C1013.05 1161.01 1013.19 1160.16 1013.19 1159.25C1013.19 1158.34 1013.05 1157.49 1012.76 1156.7C1012.47 1155.92 1012.02 1155.28 1011.42 1154.8C1010.81 1154.31 1010.04 1154.07 1009.11 1154.07C1008.17 1154.07 1007.4 1154.31 1006.8 1154.8C1006.2 1155.28 1005.75 1155.92 1005.46 1156.7C1005.17 1157.49 1005.02 1158.34 1005.02 1159.25C1005.02 1160.16 1005.17 1161.01 1005.46 1161.79C1005.75 1162.57 1006.2 1163.2 1006.8 1163.68C1007.4 1164.16 1008.17 1164.4 1009.11 1164.4ZM1018.49 1166V1152.36H1020.51V1154.42H1020.65C1020.9 1153.75 1021.35 1153.2 1022 1152.78C1022.65 1152.36 1023.39 1152.15 1024.2 1152.15C1024.36 1152.15 1024.55 1152.15 1024.78 1152.16C1025.01 1152.17 1025.19 1152.17 1025.3 1152.19V1154.32C1025.23 1154.3 1025.07 1154.27 1024.82 1154.24C1024.57 1154.2 1024.3 1154.17 1024.03 1154.17C1023.36 1154.17 1022.77 1154.31 1022.25 1154.59C1021.73 1154.86 1021.33 1155.24 1021.02 1155.73C1020.73 1156.21 1020.58 1156.76 1020.58 1157.37V1166H1018.49ZM1049.73 1153.5H1047.53C1047.4 1152.87 1047.17 1152.31 1046.85 1151.83C1046.53 1151.35 1046.14 1150.95 1045.68 1150.62C1045.22 1150.29 1044.71 1150.04 1044.16 1149.88C1043.6 1149.71 1043.02 1149.63 1042.42 1149.63C1041.32 1149.63 1040.32 1149.91 1039.43 1150.46C1038.54 1151.02 1037.83 1151.84 1037.3 1152.92C1036.78 1154.01 1036.52 1155.33 1036.52 1156.91C1036.52 1158.48 1036.78 1159.81 1037.3 1160.9C1037.83 1161.98 1038.54 1162.8 1039.43 1163.35C1040.32 1163.91 1041.32 1164.19 1042.42 1164.19C1043.02 1164.19 1043.6 1164.11 1044.16 1163.94C1044.71 1163.77 1045.22 1163.53 1045.68 1163.2C1046.14 1162.87 1046.53 1162.47 1046.85 1161.99C1047.17 1161.5 1047.4 1160.95 1047.53 1160.32H1049.73C1049.57 1161.25 1049.27 1162.08 1048.83 1162.81C1048.39 1163.55 1047.85 1164.17 1047.19 1164.69C1046.54 1165.2 1045.81 1165.58 1045 1165.85C1044.2 1166.12 1043.34 1166.25 1042.42 1166.25C1040.87 1166.25 1039.49 1165.87 1038.28 1165.11C1037.07 1164.35 1036.12 1163.28 1035.43 1161.88C1034.74 1160.48 1034.39 1158.83 1034.39 1156.91C1034.39 1154.99 1034.74 1153.33 1035.43 1151.94C1036.12 1150.54 1037.07 1149.46 1038.28 1148.71C1039.49 1147.95 1040.87 1147.57 1042.42 1147.57C1043.34 1147.57 1044.2 1147.7 1045 1147.97C1045.81 1148.24 1046.54 1148.63 1047.19 1149.14C1047.85 1149.65 1048.39 1150.27 1048.83 1151.01C1049.27 1151.73 1049.57 1152.56 1049.73 1153.5ZM1058.55 1166.28C1057.32 1166.28 1056.24 1165.99 1055.31 1165.41C1054.38 1164.82 1053.66 1164 1053.14 1162.95C1052.63 1161.89 1052.37 1160.66 1052.37 1159.25C1052.37 1157.83 1052.63 1156.59 1053.14 1155.53C1053.66 1154.47 1054.38 1153.65 1055.31 1153.06C1056.24 1152.48 1057.32 1152.19 1058.55 1152.19C1059.78 1152.19 1060.85 1152.48 1061.78 1153.06C1062.71 1153.65 1063.43 1154.47 1063.94 1155.53C1064.47 1156.59 1064.73 1157.83 1064.73 1159.25C1064.73 1160.66 1064.47 1161.89 1063.94 1162.95C1063.43 1164 1062.71 1164.82 1061.78 1165.41C1060.85 1165.99 1059.78 1166.28 1058.55 1166.28ZM1058.55 1164.4C1059.48 1164.4 1060.25 1164.16 1060.85 1163.68C1061.46 1163.2 1061.91 1162.57 1062.2 1161.79C1062.49 1161.01 1062.63 1160.16 1062.63 1159.25C1062.63 1158.34 1062.49 1157.49 1062.2 1156.7C1061.91 1155.92 1061.46 1155.28 1060.85 1154.8C1060.25 1154.31 1059.48 1154.07 1058.55 1154.07C1057.61 1154.07 1056.84 1154.31 1056.24 1154.8C1055.63 1155.28 1055.19 1155.92 1054.9 1156.7C1054.61 1157.49 1054.46 1158.34 1054.46 1159.25C1054.46 1160.16 1054.61 1161.01 1054.9 1161.79C1055.19 1162.57 1055.63 1163.2 1056.24 1163.68C1056.84 1164.16 1057.61 1164.4 1058.55 1164.4ZM1070.02 1157.8V1166H1067.92V1152.36H1069.95V1154.49H1070.13C1070.45 1153.8 1070.93 1153.25 1071.58 1152.83C1072.23 1152.4 1073.07 1152.19 1074.1 1152.19C1075.03 1152.19 1075.83 1152.38 1076.53 1152.75C1077.22 1153.13 1077.76 1153.7 1078.14 1154.46C1078.53 1155.22 1078.72 1156.18 1078.72 1157.34V1166H1076.62V1157.48C1076.62 1156.41 1076.35 1155.57 1075.79 1154.97C1075.23 1154.37 1074.47 1154.07 1073.5 1154.07C1072.83 1154.07 1072.23 1154.21 1071.71 1154.5C1071.19 1154.79 1070.77 1155.22 1070.47 1155.77C1070.17 1156.33 1070.02 1157 1070.02 1157.8ZM1088.48 1152.36V1154.14H1081.41V1152.36H1088.48ZM1083.47 1149.1H1085.57V1162.09C1085.57 1162.69 1085.65 1163.13 1085.82 1163.43C1086 1163.72 1086.23 1163.91 1086.5 1164.01C1086.78 1164.11 1087.07 1164.15 1087.38 1164.15C1087.61 1164.15 1087.8 1164.14 1087.95 1164.12C1088.09 1164.09 1088.21 1164.06 1088.3 1164.05L1088.73 1165.93C1088.58 1165.98 1088.39 1166.04 1088.13 1166.09C1087.88 1166.15 1087.56 1166.18 1087.16 1166.18C1086.57 1166.18 1085.99 1166.05 1085.42 1165.8C1084.86 1165.54 1084.39 1165.15 1084.02 1164.63C1083.65 1164.11 1083.47 1163.46 1083.47 1162.66V1149.1ZM1097.2 1166.28C1095.89 1166.28 1094.75 1165.99 1093.8 1165.41C1092.85 1164.83 1092.12 1164.01 1091.61 1162.96C1091.1 1161.91 1090.84 1160.69 1090.84 1159.29C1090.84 1157.89 1091.1 1156.66 1091.61 1155.6C1092.12 1154.52 1092.84 1153.69 1093.76 1153.09C1094.68 1152.49 1095.76 1152.19 1096.99 1152.19C1097.7 1152.19 1098.4 1152.3 1099.09 1152.54C1099.78 1152.78 1100.41 1153.16 1100.98 1153.7C1101.55 1154.22 1102 1154.92 1102.34 1155.79C1102.68 1156.66 1102.85 1157.73 1102.85 1159V1159.89H1092.34V1158.08H1100.72C1100.72 1157.31 1100.56 1156.62 1100.25 1156.02C1099.95 1155.42 1099.52 1154.94 1098.96 1154.59C1098.4 1154.24 1097.75 1154.07 1096.99 1154.07C1096.15 1154.07 1095.43 1154.28 1094.82 1154.69C1094.22 1155.1 1093.75 1155.63 1093.43 1156.29C1093.1 1156.94 1092.94 1157.65 1092.94 1158.4V1159.61C1092.94 1160.64 1093.12 1161.51 1093.47 1162.23C1093.83 1162.94 1094.33 1163.48 1094.97 1163.85C1095.61 1164.22 1096.35 1164.4 1097.2 1164.4C1097.75 1164.4 1098.25 1164.33 1098.69 1164.17C1099.14 1164.01 1099.53 1163.77 1099.86 1163.46C1100.18 1163.14 1100.43 1162.74 1100.61 1162.27L1102.63 1162.84C1102.42 1163.53 1102.06 1164.13 1101.56 1164.65C1101.06 1165.17 1100.44 1165.57 1099.7 1165.86C1098.96 1166.14 1098.12 1166.28 1097.2 1166.28ZM1107.23 1152.36L1110.5 1157.94L1113.76 1152.36H1116.18L1111.78 1159.18L1116.18 1166H1113.76L1110.5 1160.71L1107.23 1166H1104.82L1109.15 1159.18L1104.82 1152.36H1107.23ZM1125.1 1152.36V1154.14H1118.03V1152.36H1125.1ZM1120.09 1149.1H1122.19V1162.09C1122.19 1162.69 1122.27 1163.13 1122.45 1163.43C1122.62 1163.72 1122.85 1163.91 1123.12 1164.01C1123.4 1164.11 1123.69 1164.15 1124 1164.15C1124.23 1164.15 1124.42 1164.14 1124.57 1164.12C1124.71 1164.09 1124.83 1164.06 1124.92 1164.05L1125.35 1165.93C1125.21 1165.98 1125.01 1166.04 1124.75 1166.09C1124.5 1166.15 1124.18 1166.18 1123.79 1166.18C1123.19 1166.18 1122.61 1166.05 1122.05 1165.8C1121.48 1165.54 1121.02 1165.15 1120.64 1164.63C1120.28 1164.11 1120.09 1163.46 1120.09 1162.66V1149.1ZM1135.25 1166V1164.4L1141.25 1157.83C1141.95 1157.06 1142.53 1156.39 1142.99 1155.83C1143.44 1155.25 1143.78 1154.71 1144 1154.21C1144.23 1153.7 1144.34 1153.17 1144.34 1152.61C1144.34 1151.97 1144.18 1151.42 1143.88 1150.95C1143.57 1150.48 1143.16 1150.12 1142.63 1149.87C1142.11 1149.61 1141.51 1149.49 1140.86 1149.49C1140.16 1149.49 1139.55 1149.63 1139.03 1149.92C1138.51 1150.21 1138.11 1150.61 1137.83 1151.12C1137.55 1151.64 1137.41 1152.24 1137.41 1152.93H1135.32C1135.32 1151.87 1135.56 1150.93 1136.05 1150.13C1136.55 1149.32 1137.21 1148.69 1138.06 1148.24C1138.91 1147.79 1139.87 1147.57 1140.93 1147.57C1141.99 1147.57 1142.94 1147.79 1143.76 1148.24C1144.58 1148.69 1145.23 1149.3 1145.7 1150.06C1146.16 1150.83 1146.4 1151.68 1146.4 1152.61C1146.4 1153.28 1146.28 1153.94 1146.03 1154.57C1145.8 1155.21 1145.38 1155.91 1144.79 1156.7C1144.2 1157.47 1143.39 1158.42 1142.35 1159.54L1138.27 1163.9V1164.05H1146.72V1166H1135.25Z" fill="#03031C"/>
+<g filter="url(#filter8_bd_12_480)">
+<rect x="667" y="413" width="109" height="65" rx="10" fill="#5900CB"/>
+<rect x="667.5" y="413.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M709.803 453.32C708.939 453.32 708.155 453.157 707.451 452.831C706.747 452.5 706.187 452.023 705.773 451.402C705.359 450.775 705.151 450.017 705.151 449.129C705.151 448.348 705.305 447.715 705.613 447.229C705.921 446.738 706.332 446.353 706.847 446.075C707.362 445.797 707.93 445.59 708.552 445.454C709.179 445.312 709.809 445.199 710.443 445.116C711.271 445.01 711.943 444.93 712.458 444.877C712.979 444.818 713.358 444.72 713.594 444.584C713.837 444.448 713.958 444.211 713.958 443.874V443.803C713.958 442.927 713.719 442.246 713.239 441.761C712.766 441.275 712.047 441.033 711.082 441.033C710.082 441.033 709.297 441.252 708.729 441.69C708.161 442.128 707.762 442.595 707.531 443.092L705.542 442.382C705.897 441.554 706.371 440.908 706.963 440.447C707.56 439.979 708.211 439.654 708.916 439.47C709.626 439.281 710.324 439.186 711.011 439.186C711.449 439.186 711.952 439.239 712.52 439.346C713.094 439.446 713.648 439.657 714.18 439.976C714.719 440.296 715.166 440.778 715.521 441.423C715.876 442.068 716.053 442.933 716.053 444.016V453H713.958V451.153H713.852C713.71 451.449 713.473 451.766 713.142 452.103C712.81 452.441 712.369 452.728 711.819 452.964C711.268 453.201 710.597 453.32 709.803 453.32ZM710.123 451.438C710.952 451.438 711.65 451.275 712.218 450.949C712.792 450.624 713.224 450.203 713.514 449.689C713.81 449.174 713.958 448.632 713.958 448.064V446.146C713.869 446.253 713.674 446.35 713.372 446.439C713.076 446.522 712.733 446.596 712.343 446.661C711.958 446.72 711.582 446.774 711.215 446.821C710.854 446.862 710.561 446.898 710.336 446.928C709.792 446.999 709.283 447.114 708.809 447.274C708.342 447.428 707.963 447.661 707.673 447.975C707.389 448.283 707.247 448.703 707.247 449.236C707.247 449.964 707.516 450.514 708.055 450.887C708.599 451.254 709.289 451.438 710.123 451.438ZM719.878 458.114V439.364H721.902V441.53H722.15C722.304 441.293 722.517 440.991 722.79 440.624C723.068 440.251 723.464 439.92 723.979 439.63C724.5 439.334 725.204 439.186 726.092 439.186C727.24 439.186 728.252 439.473 729.128 440.047C730.004 440.621 730.688 441.435 731.179 442.489C731.67 443.542 731.916 444.785 731.916 446.217C731.916 447.661 731.67 448.913 731.179 449.973C730.688 451.026 730.007 451.843 729.137 452.423C728.267 452.997 727.264 453.284 726.128 453.284C725.252 453.284 724.55 453.139 724.024 452.849C723.497 452.553 723.091 452.219 722.807 451.846C722.523 451.467 722.304 451.153 722.15 450.905H721.973V458.114H719.878ZM721.937 446.182C721.937 447.212 722.088 448.12 722.39 448.907C722.692 449.689 723.133 450.301 723.713 450.745C724.293 451.183 725.003 451.402 725.843 451.402C726.719 451.402 727.45 451.171 728.036 450.71C728.628 450.242 729.072 449.615 729.368 448.827C729.67 448.034 729.821 447.152 729.821 446.182C729.821 445.223 729.673 444.359 729.377 443.589C729.087 442.814 728.646 442.202 728.054 441.752C727.468 441.296 726.731 441.068 725.843 441.068C724.991 441.068 724.275 441.284 723.695 441.716C723.115 442.142 722.677 442.74 722.381 443.51C722.085 444.273 721.937 445.164 721.937 446.182ZM735.112 453V439.364H737.207V453H735.112ZM736.177 437.091C735.769 437.091 735.417 436.952 735.121 436.674C734.831 436.395 734.686 436.061 734.686 435.67C734.686 435.28 734.831 434.945 735.121 434.667C735.417 434.389 735.769 434.25 736.177 434.25C736.586 434.25 736.935 434.389 737.225 434.667C737.521 434.945 737.669 435.28 737.669 435.67C737.669 436.061 737.521 436.395 737.225 436.674C736.935 436.952 736.586 437.091 736.177 437.091Z" fill="white"/>
+<path d="M680.996 356.818H683.198V368.857C683.198 370.099 682.905 371.209 682.319 372.186C681.739 373.156 680.919 373.923 679.86 374.485C678.801 375.041 677.558 375.32 676.131 375.32C674.705 375.32 673.462 375.041 672.403 374.485C671.343 373.923 670.52 373.156 669.935 372.186C669.355 371.209 669.064 370.099 669.064 368.857V356.818H671.266V368.679C671.266 369.567 671.462 370.357 671.852 371.049C672.243 371.736 672.799 372.277 673.521 372.674C674.249 373.065 675.119 373.26 676.131 373.26C677.143 373.26 678.013 373.065 678.741 372.674C679.469 372.277 680.026 371.736 680.41 371.049C680.801 370.357 680.996 369.567 680.996 368.679V356.818ZM696.97 364.418L695.088 364.95C694.969 364.637 694.795 364.332 694.564 364.036C694.339 363.734 694.031 363.485 693.641 363.29C693.25 363.095 692.75 362.997 692.14 362.997C691.306 362.997 690.61 363.19 690.054 363.574C689.504 363.953 689.228 364.435 689.228 365.021C689.228 365.542 689.418 365.953 689.796 366.255C690.175 366.557 690.767 366.809 691.572 367.01L693.596 367.507C694.815 367.803 695.724 368.256 696.322 368.865C696.919 369.469 697.218 370.247 697.218 371.2C697.218 371.982 696.993 372.68 696.544 373.295C696.1 373.911 695.478 374.396 694.679 374.751C693.88 375.107 692.951 375.284 691.892 375.284C690.501 375.284 689.35 374.982 688.438 374.379C687.527 373.775 686.95 372.893 686.707 371.733L688.696 371.236C688.885 371.97 689.243 372.52 689.77 372.887C690.303 373.254 690.998 373.438 691.856 373.438C692.833 373.438 693.608 373.23 694.182 372.816C694.762 372.396 695.052 371.893 695.052 371.307C695.052 370.833 694.886 370.437 694.555 370.117C694.224 369.792 693.715 369.549 693.028 369.389L690.755 368.857C689.506 368.561 688.589 368.102 688.003 367.48C687.423 366.853 687.133 366.069 687.133 365.128C687.133 364.358 687.349 363.678 687.781 363.086C688.219 362.494 688.814 362.029 689.566 361.692C690.323 361.355 691.181 361.186 692.14 361.186C693.49 361.186 694.549 361.482 695.318 362.074C696.094 362.666 696.644 363.447 696.97 364.418ZM706.09 375.284C704.776 375.284 703.642 374.994 702.689 374.414C701.742 373.828 701.011 373.011 700.496 371.964C699.987 370.91 699.733 369.685 699.733 368.288C699.733 366.892 699.987 365.661 700.496 364.595C701.011 363.524 701.728 362.689 702.645 362.092C703.568 361.488 704.645 361.186 705.876 361.186C706.587 361.186 707.288 361.304 707.981 361.541C708.673 361.778 709.303 362.163 709.871 362.695C710.44 363.222 710.892 363.92 711.23 364.79C711.567 365.661 711.736 366.732 711.736 368.004V368.892H701.224V367.081H709.605C709.605 366.312 709.451 365.625 709.144 365.021C708.842 364.418 708.41 363.941 707.847 363.592C707.291 363.243 706.634 363.068 705.876 363.068C705.042 363.068 704.32 363.275 703.71 363.69C703.107 364.098 702.642 364.631 702.316 365.288C701.991 365.945 701.828 366.649 701.828 367.401V368.608C701.828 369.638 702.006 370.511 702.361 371.227C702.722 371.937 703.222 372.479 703.861 372.852C704.5 373.219 705.243 373.402 706.09 373.402C706.64 373.402 707.137 373.325 707.581 373.171C708.031 373.011 708.418 372.775 708.744 372.461C709.07 372.141 709.321 371.745 709.499 371.271L711.523 371.839C711.31 372.526 710.952 373.13 710.449 373.651C709.945 374.165 709.324 374.568 708.584 374.858C707.844 375.142 707.013 375.284 706.09 375.284ZM714.923 375V361.364H716.947V363.423H717.089C717.338 362.749 717.788 362.201 718.439 361.781C719.09 361.361 719.824 361.151 720.64 361.151C720.794 361.151 720.987 361.154 721.217 361.159C721.448 361.165 721.623 361.174 721.741 361.186V363.317C721.67 363.299 721.507 363.272 721.253 363.237C721.004 363.195 720.741 363.175 720.463 363.175C719.8 363.175 719.208 363.314 718.687 363.592C718.172 363.864 717.764 364.243 717.462 364.728C717.166 365.208 717.018 365.755 717.018 366.371V375H714.923ZM736.76 380.398C735.748 380.398 734.878 380.268 734.15 380.007C733.422 379.753 732.816 379.415 732.33 378.995C731.851 378.581 731.469 378.137 731.185 377.663L732.854 376.491C733.043 376.74 733.283 377.024 733.573 377.344C733.863 377.669 734.26 377.95 734.763 378.187C735.272 378.43 735.938 378.551 736.76 378.551C737.861 378.551 738.77 378.285 739.486 377.752C740.202 377.219 740.56 376.385 740.56 375.249V372.479H740.382C740.229 372.727 740.01 373.035 739.725 373.402C739.447 373.763 739.045 374.086 738.518 374.37C737.997 374.648 737.293 374.787 736.405 374.787C735.304 374.787 734.316 374.527 733.44 374.006C732.57 373.485 731.88 372.727 731.371 371.733C730.868 370.739 730.617 369.531 730.617 368.111C730.617 366.714 730.862 365.498 731.354 364.462C731.845 363.42 732.528 362.615 733.404 362.047C734.28 361.473 735.292 361.186 736.441 361.186C737.328 361.186 738.033 361.334 738.554 361.63C739.08 361.92 739.483 362.251 739.761 362.624C740.045 362.991 740.264 363.293 740.418 363.53H740.631V361.364H742.655V375.391C742.655 376.562 742.389 377.515 741.856 378.249C741.329 378.989 740.619 379.531 739.725 379.874C738.838 380.223 737.849 380.398 736.76 380.398ZM736.689 372.905C737.53 372.905 738.24 372.712 738.82 372.328C739.4 371.943 739.841 371.39 740.143 370.668C740.445 369.946 740.595 369.081 740.595 368.075C740.595 367.093 740.448 366.226 740.152 365.474C739.856 364.722 739.418 364.134 738.838 363.707C738.258 363.281 737.542 363.068 736.689 363.068C735.801 363.068 735.062 363.293 734.47 363.743C733.884 364.193 733.443 364.796 733.147 365.554C732.857 366.312 732.712 367.152 732.712 368.075C732.712 369.022 732.86 369.86 733.156 370.588C733.458 371.31 733.902 371.878 734.488 372.292C735.079 372.701 735.813 372.905 736.689 372.905ZM746.49 375V361.364H748.515V363.423H748.657C748.905 362.749 749.355 362.201 750.006 361.781C750.657 361.361 751.391 361.151 752.208 361.151C752.362 361.151 752.554 361.154 752.785 361.159C753.016 361.165 753.19 361.174 753.309 361.186V363.317C753.238 363.299 753.075 363.272 752.82 363.237C752.572 363.195 752.308 363.175 752.03 363.175C751.367 363.175 750.775 363.314 750.255 363.592C749.74 363.864 749.331 364.243 749.029 364.728C748.734 365.208 748.586 365.755 748.586 366.371V375H746.49ZM760.917 375.284C759.686 375.284 758.606 374.991 757.676 374.405C756.753 373.819 756.031 373 755.51 371.946C754.995 370.893 754.738 369.661 754.738 368.253C754.738 366.832 754.995 365.592 755.51 364.533C756.031 363.474 756.753 362.651 757.676 362.065C758.606 361.479 759.686 361.186 760.917 361.186C762.148 361.186 763.225 361.479 764.148 362.065C765.078 362.651 765.8 363.474 766.315 364.533C766.835 365.592 767.096 366.832 767.096 368.253C767.096 369.661 766.835 370.893 766.315 371.946C765.8 373 765.078 373.819 764.148 374.405C763.225 374.991 762.148 375.284 760.917 375.284ZM760.917 373.402C761.852 373.402 762.621 373.162 763.225 372.683C763.829 372.203 764.276 371.573 764.566 370.792C764.856 370.011 765.001 369.164 765.001 368.253C765.001 367.341 764.856 366.492 764.566 365.705C764.276 364.918 763.829 364.281 763.225 363.796C762.621 363.311 761.852 363.068 760.917 363.068C759.982 363.068 759.212 363.311 758.609 363.796C758.005 364.281 757.558 364.918 757.268 365.705C756.978 366.492 756.833 367.341 756.833 368.253C756.833 369.164 756.978 370.011 757.268 370.792C757.558 371.573 758.005 372.203 758.609 372.683C759.212 373.162 759.982 373.402 760.917 373.402ZM778.888 369.425V361.364H780.983V375H778.888V372.692H778.746C778.426 373.384 777.929 373.973 777.254 374.458C776.58 374.938 775.727 375.178 774.697 375.178C773.845 375.178 773.088 374.991 772.425 374.618C771.762 374.239 771.241 373.671 770.862 372.914C770.483 372.15 770.294 371.188 770.294 370.028V361.364H772.389V369.886C772.389 370.881 772.667 371.674 773.224 372.266C773.786 372.857 774.502 373.153 775.372 373.153C775.893 373.153 776.423 373.02 776.961 372.754C777.506 372.488 777.962 372.079 778.329 371.529C778.701 370.978 778.888 370.277 778.888 369.425ZM784.82 380.114V361.364H786.845V363.53H787.093C787.247 363.293 787.46 362.991 787.732 362.624C788.011 362.251 788.407 361.92 788.922 361.63C789.443 361.334 790.147 361.186 791.035 361.186C792.183 361.186 793.195 361.473 794.071 362.047C794.947 362.621 795.631 363.435 796.122 364.489C796.613 365.542 796.859 366.785 796.859 368.217C796.859 369.661 796.613 370.913 796.122 371.973C795.631 373.026 794.95 373.843 794.08 374.423C793.21 374.997 792.207 375.284 791.07 375.284C790.194 375.284 789.493 375.139 788.966 374.849C788.44 374.553 788.034 374.219 787.75 373.846C787.466 373.467 787.247 373.153 787.093 372.905H786.916V380.114H784.82ZM786.88 368.182C786.88 369.212 787.031 370.12 787.333 370.907C787.635 371.689 788.076 372.301 788.656 372.745C789.236 373.183 789.946 373.402 790.786 373.402C791.662 373.402 792.393 373.171 792.979 372.71C793.571 372.242 794.015 371.615 794.311 370.827C794.613 370.034 794.764 369.152 794.764 368.182C794.764 367.223 794.616 366.359 794.32 365.589C794.03 364.814 793.589 364.202 792.997 363.752C792.411 363.296 791.674 363.068 790.786 363.068C789.934 363.068 789.218 363.284 788.638 363.716C788.058 364.142 787.62 364.74 787.324 365.51C787.028 366.273 786.88 367.164 786.88 368.182Z" fill="#03031C"/>
+<path d="M722.281 273.127C722.133 273.387 722.021 273.759 722.021 274.168V278.89C725.033 281.12 728.528 282.273 732.246 282.273C736.67 282.273 740.128 280.6 742.471 278.89V274.168C742.471 273.759 742.396 273.387 742.21 273.127C739.347 275.915 735.89 277.514 732.209 277.514C728.602 277.551 725.144 275.915 722.281 273.127Z" fill="#5900CB"/>
+<path d="M694.99 320.644C694.842 320.904 694.73 321.276 694.73 321.685V326.407C697.742 328.638 701.237 329.791 704.955 329.791C709.379 329.791 712.837 328.117 715.18 326.407V321.685C715.18 321.276 715.105 320.904 714.919 320.644C712.056 323.433 708.599 325.031 704.918 325.031C701.311 325.069 697.853 323.433 694.99 320.644Z" fill="#5900CB"/>
+<path d="M749.646 320.644C749.498 320.904 749.386 321.276 749.386 321.685V326.407C752.398 328.638 755.893 329.791 759.611 329.791C764.036 329.791 767.493 328.117 769.836 326.407V321.685C769.836 321.276 769.761 320.904 769.576 320.644C766.713 323.433 763.255 325.031 759.574 325.031C755.967 325.069 752.509 323.433 749.646 320.644Z" fill="#5900CB"/>
+<path d="M732.32 301.682L722.653 311.349" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M732.32 291.011V301.681L741.876 311.237" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M710.086 311.907C710.086 311.907 715.18 314.695 717.187 316.294C717.671 316.666 718.043 317.149 718.377 317.67C718.972 318.636 719.27 319.752 719.27 320.867V327.523C715.44 330.869 710.458 333.025 704.955 333.025C699.378 333.025 694.47 330.943 690.64 327.485V320.83C690.64 319.715 690.9 318.562 691.532 317.632C691.867 317.112 692.239 316.666 692.722 316.257C694.693 314.658 699.824 311.869 699.824 311.869" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M704.955 314.584C708.938 314.584 712.168 310.572 712.168 305.623C712.168 300.674 708.938 296.662 704.955 296.662C700.971 296.662 697.741 300.674 697.741 305.623C697.741 310.572 700.971 314.584 704.955 314.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M764.816 311.907C764.816 311.907 769.91 314.695 771.918 316.294C772.401 316.666 772.773 317.149 773.108 317.67C773.703 318.636 774 319.752 774 320.867V327.523C770.17 330.906 765.188 333.063 759.685 333.063C754.108 333.063 749.2 330.981 745.371 327.523V320.867C745.371 319.752 745.631 318.599 746.263 317.67C746.598 317.149 746.969 316.703 747.453 316.294C749.423 314.695 754.554 311.907 754.554 311.907" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M759.648 314.584C763.632 314.584 766.861 310.572 766.861 305.623C766.861 300.674 763.632 296.662 759.648 296.662C755.664 296.662 752.435 300.674 752.435 305.623C752.435 310.572 755.664 314.584 759.648 314.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M737.414 265.244C737.414 265.244 742.508 268.033 744.516 269.632C744.999 270.003 745.371 270.487 745.705 271.007C746.3 271.974 746.598 273.089 746.598 274.205V280.86C742.768 284.244 737.786 286.4 732.283 286.4C726.706 286.4 721.798 284.318 717.968 280.86V274.168C717.968 273.052 718.229 271.9 718.861 270.97C719.195 270.45 719.567 270.003 720.05 269.594C722.021 267.996 727.152 265.207 727.152 265.207" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M732.283 267.921C736.267 267.921 739.496 263.909 739.496 258.961C739.496 254.012 736.267 250 732.283 250C728.299 250 725.07 254.012 725.07 258.961C725.07 263.909 728.299 267.921 732.283 267.921Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#filter9_bd_12_480)">
+<rect x="869" y="145" width="367" height="373" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="869.5" y="145.5" width="366" height="372" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<g filter="url(#filter10_bd_12_480)">
+<rect x="935" y="413" width="109" height="65" rx="10" fill="#FFC743"/>
+<rect x="935.5" y="413.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M1034.07 201.091C1034.07 203.47 1033.62 205.494 1032.72 207.163C1031.83 208.832 1030.61 210.107 1029.06 210.988C1027.52 211.862 1025.78 212.298 1023.86 212.298C1021.92 212.298 1020.18 211.858 1018.64 210.977C1017.1 210.097 1015.88 208.822 1014.98 207.153C1014.09 205.484 1013.64 203.463 1013.64 201.091C1013.64 198.712 1014.09 196.688 1014.98 195.018C1015.88 193.349 1017.1 192.078 1018.64 191.205C1020.18 190.324 1021.92 189.884 1023.86 189.884C1025.78 189.884 1027.52 190.324 1029.06 191.205C1030.61 192.078 1031.83 193.349 1032.72 195.018C1033.62 196.688 1034.07 198.712 1034.07 201.091ZM1029.4 201.091C1029.4 199.55 1029.17 198.25 1028.71 197.192C1028.25 196.134 1027.61 195.331 1026.78 194.784C1025.95 194.237 1024.97 193.964 1023.86 193.964C1022.74 193.964 1021.77 194.237 1020.94 194.784C1020.11 195.331 1019.46 196.134 1019 197.192C1018.55 198.25 1018.32 199.55 1018.32 201.091C1018.32 202.632 1018.55 203.932 1019 204.99C1019.46 206.048 1020.11 206.851 1020.94 207.398C1021.77 207.945 1022.74 208.218 1023.86 208.218C1024.97 208.218 1025.95 207.945 1026.78 207.398C1027.61 206.851 1028.25 206.048 1028.71 204.99C1029.17 203.932 1029.4 202.632 1029.4 201.091ZM1037.41 212V195.636H1041.81V198.491H1041.98C1042.28 197.476 1042.78 196.709 1043.48 196.19C1044.18 195.665 1044.99 195.402 1045.91 195.402C1046.14 195.402 1046.38 195.416 1046.64 195.445C1046.91 195.473 1047.14 195.512 1047.34 195.562V199.589C1047.12 199.525 1046.83 199.468 1046.45 199.418C1046.08 199.369 1045.73 199.344 1045.42 199.344C1044.75 199.344 1044.15 199.489 1043.63 199.781C1043.11 200.065 1042.7 200.462 1042.39 200.974C1042.09 201.485 1041.95 202.075 1041.95 202.742V212H1037.41ZM1056.29 218.477C1054.82 218.477 1053.56 218.275 1052.51 217.87C1051.47 217.472 1050.64 216.929 1050.02 216.24C1049.4 215.551 1049 214.777 1048.81 213.918L1053.01 213.353C1053.14 213.68 1053.34 213.985 1053.62 214.269C1053.9 214.553 1054.26 214.781 1054.72 214.951C1055.18 215.129 1055.74 215.217 1056.4 215.217C1057.39 215.217 1058.2 214.976 1058.84 214.493C1059.49 214.017 1059.81 213.218 1059.81 212.096V209.102H1059.62C1059.42 209.557 1059.12 209.987 1058.72 210.391C1058.32 210.796 1057.81 211.126 1057.19 211.382C1056.56 211.638 1055.82 211.766 1054.95 211.766C1053.72 211.766 1052.6 211.482 1051.59 210.913C1050.59 210.338 1049.79 209.461 1049.2 208.282C1048.61 207.096 1048.31 205.597 1048.31 203.786C1048.31 201.933 1048.62 200.384 1049.22 199.141C1049.82 197.898 1050.63 196.968 1051.63 196.35C1052.63 195.732 1053.74 195.423 1054.94 195.423C1055.86 195.423 1056.62 195.58 1057.24 195.892C1057.86 196.197 1058.36 196.581 1058.73 197.043C1059.12 197.497 1059.41 197.945 1059.62 198.385H1059.79V195.636H1064.29V212.16C1064.29 213.552 1063.95 214.717 1063.27 215.654C1062.59 216.592 1061.64 217.295 1060.44 217.763C1059.24 218.239 1057.86 218.477 1056.29 218.477ZM1056.39 208.357C1057.12 208.357 1057.74 208.175 1058.24 207.813C1058.75 207.444 1059.14 206.918 1059.41 206.237C1059.69 205.548 1059.83 204.724 1059.83 203.765C1059.83 202.806 1059.69 201.975 1059.42 201.272C1059.15 200.562 1058.76 200.011 1058.25 199.621C1057.74 199.23 1057.12 199.035 1056.39 199.035C1055.64 199.035 1055.01 199.237 1054.5 199.642C1053.99 200.04 1053.6 200.594 1053.34 201.304C1053.08 202.014 1052.95 202.835 1052.95 203.765C1052.95 204.71 1053.08 205.526 1053.34 206.215C1053.61 206.897 1054 207.426 1054.5 207.803C1055.01 208.172 1055.64 208.357 1056.39 208.357ZM1074.93 212V190.182H1083.67C1085.27 190.182 1086.61 190.42 1087.69 190.896C1088.76 191.371 1089.56 192.032 1090.1 192.877C1090.64 193.715 1090.91 194.681 1090.91 195.775C1090.91 196.627 1090.74 197.376 1090.4 198.023C1090.06 198.662 1089.59 199.187 1089 199.599C1088.41 200.004 1087.73 200.292 1086.97 200.462V200.675C1087.8 200.711 1088.58 200.945 1089.3 201.379C1090.04 201.812 1090.63 202.419 1091.08 203.2C1091.54 203.974 1091.77 204.898 1091.77 205.97C1091.77 207.128 1091.48 208.161 1090.9 209.07C1090.33 209.972 1089.49 210.686 1088.38 211.212C1087.26 211.737 1085.89 212 1084.26 212H1074.93ZM1079.55 208.229H1083.31C1084.59 208.229 1085.53 207.984 1086.12 207.494C1086.71 206.996 1087 206.336 1087 205.512C1087 204.908 1086.86 204.376 1086.57 203.914C1086.28 203.452 1085.86 203.09 1085.32 202.827C1084.79 202.565 1084.15 202.433 1083.41 202.433H1079.55V208.229ZM1079.55 199.312H1082.97C1083.6 199.312 1084.16 199.202 1084.65 198.982C1085.15 198.754 1085.54 198.435 1085.82 198.023C1086.11 197.611 1086.26 197.117 1086.26 196.542C1086.26 195.754 1085.98 195.118 1085.42 194.635C1084.86 194.152 1084.07 193.911 1083.05 193.911H1079.55V199.312Z" fill="#03031C"/>
+<path d="M961.462 291.58C970.757 291.58 978.292 282.272 978.292 270.79C978.292 259.308 970.757 250 961.462 250C952.167 250 944.632 259.308 944.632 270.79C944.632 282.272 952.167 291.58 961.462 291.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M974.134 284.848C974.134 284.848 985.111 290.919 989.717 294.696C990.809 295.595 991.747 296.67 992.493 297.878C993.852 300.146 994.556 302.754 994.527 305.406V321.017C985.389 329.317 973.547 333.921 961.264 333.952C948.968 333.99 937.102 329.376 928.001 321.017V305.406C927.972 302.754 928.676 300.146 930.035 297.878C930.781 296.67 931.719 295.595 932.811 294.696C937.417 290.958 948.412 284.452 948.412 284.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M937.699 303.856C937.29 304.577 937.086 305.394 937.11 306.22V317.077C943.976 322.12 952.308 324.844 960.868 324.844C969.427 324.844 977.759 322.12 984.625 317.077V306.295C984.653 305.471 984.454 304.654 984.049 303.932C977.364 310.252 969.423 314.043 960.868 314.043C952.312 314.043 944.372 310.226 937.699 303.856Z" fill="#FFC743"/>
+<path d="M947.411 356.818H949.613V368.857C949.613 370.099 949.32 371.209 948.734 372.186C948.154 373.156 947.334 373.923 946.275 374.485C945.216 375.041 943.973 375.32 942.546 375.32C941.12 375.32 939.877 375.041 938.818 374.485C937.758 373.923 936.936 373.156 936.35 372.186C935.77 371.209 935.48 370.099 935.48 368.857V356.818H937.681V368.679C937.681 369.567 937.877 370.357 938.267 371.049C938.658 371.736 939.214 372.277 939.936 372.674C940.664 373.065 941.534 373.26 942.546 373.26C943.558 373.26 944.428 373.065 945.156 372.674C945.884 372.277 946.441 371.736 946.825 371.049C947.216 370.357 947.411 369.567 947.411 368.679V356.818ZM963.385 364.418L961.503 364.95C961.384 364.637 961.21 364.332 960.979 364.036C960.754 363.734 960.446 363.485 960.056 363.29C959.665 363.095 959.165 362.997 958.555 362.997C957.721 362.997 957.025 363.19 956.469 363.574C955.919 363.953 955.643 364.435 955.643 365.021C955.643 365.542 955.833 365.953 956.212 366.255C956.59 366.557 957.182 366.809 957.987 367.01L960.011 367.507C961.23 367.803 962.139 368.256 962.737 368.865C963.335 369.469 963.633 370.247 963.633 371.2C963.633 371.982 963.408 372.68 962.959 373.295C962.515 373.911 961.893 374.396 961.094 374.751C960.295 375.107 959.366 375.284 958.307 375.284C956.916 375.284 955.765 374.982 954.853 374.379C953.942 373.775 953.365 372.893 953.122 371.733L955.111 371.236C955.3 371.97 955.658 372.52 956.185 372.887C956.718 373.254 957.413 373.438 958.271 373.438C959.248 373.438 960.023 373.23 960.597 372.816C961.177 372.396 961.467 371.893 961.467 371.307C961.467 370.833 961.301 370.437 960.97 370.117C960.639 369.792 960.13 369.549 959.443 369.389L957.17 368.857C955.922 368.561 955.004 368.102 954.418 367.48C953.838 366.853 953.548 366.069 953.548 365.128C953.548 364.358 953.764 363.678 954.196 363.086C954.634 362.494 955.229 362.029 955.981 361.692C956.738 361.355 957.596 361.186 958.555 361.186C959.905 361.186 960.964 361.482 961.734 362.074C962.509 362.666 963.059 363.447 963.385 364.418ZM972.505 375.284C971.191 375.284 970.057 374.994 969.104 374.414C968.157 373.828 967.426 373.011 966.912 371.964C966.403 370.91 966.148 369.685 966.148 368.288C966.148 366.892 966.403 365.661 966.912 364.595C967.426 363.524 968.143 362.689 969.06 362.092C969.983 361.488 971.06 361.186 972.292 361.186C973.002 361.186 973.703 361.304 974.396 361.541C975.088 361.778 975.718 362.163 976.287 362.695C976.855 363.222 977.307 363.92 977.645 364.79C977.982 365.661 978.151 366.732 978.151 368.004V368.892H967.64V367.081H976.02C976.02 366.312 975.866 365.625 975.559 365.021C975.257 364.418 974.825 363.941 974.262 363.592C973.706 363.243 973.049 363.068 972.292 363.068C971.457 363.068 970.735 363.275 970.125 363.69C969.522 364.098 969.057 364.631 968.731 365.288C968.406 365.945 968.243 366.649 968.243 367.401V368.608C968.243 369.638 968.421 370.511 968.776 371.227C969.137 371.937 969.637 372.479 970.276 372.852C970.915 373.219 971.658 373.402 972.505 373.402C973.055 373.402 973.552 373.325 973.996 373.171C974.446 373.011 974.834 372.775 975.159 372.461C975.485 372.141 975.736 371.745 975.914 371.271L977.938 371.839C977.725 372.526 977.367 373.13 976.864 373.651C976.361 374.165 975.739 374.568 974.999 374.858C974.259 375.142 973.428 375.284 972.505 375.284ZM981.338 375V361.364H983.362V363.423H983.504C983.753 362.749 984.203 362.201 984.854 361.781C985.505 361.361 986.239 361.151 987.055 361.151C987.209 361.151 987.402 361.154 987.632 361.159C987.863 361.165 988.038 361.174 988.156 361.186V363.317C988.085 363.299 987.922 363.272 987.668 363.237C987.419 363.195 987.156 363.175 986.878 363.175C986.215 363.175 985.623 363.314 985.102 363.592C984.587 363.864 984.179 364.243 983.877 364.728C983.581 365.208 983.433 365.755 983.433 366.371V375H981.338Z" fill="#03031C"/>
+<path d="M977.803 453.32C976.939 453.32 976.155 453.157 975.451 452.831C974.747 452.5 974.187 452.023 973.773 451.402C973.359 450.775 973.151 450.017 973.151 449.129C973.151 448.348 973.305 447.715 973.613 447.229C973.921 446.738 974.332 446.353 974.847 446.075C975.362 445.797 975.93 445.59 976.552 445.454C977.179 445.312 977.809 445.199 978.443 445.116C979.271 445.01 979.943 444.93 980.458 444.877C980.979 444.818 981.358 444.72 981.594 444.584C981.837 444.448 981.958 444.211 981.958 443.874V443.803C981.958 442.927 981.719 442.246 981.239 441.761C980.766 441.275 980.047 441.033 979.082 441.033C978.082 441.033 977.297 441.252 976.729 441.69C976.161 442.128 975.762 442.595 975.531 443.092L973.542 442.382C973.897 441.554 974.371 440.908 974.963 440.447C975.56 439.979 976.211 439.654 976.916 439.47C977.626 439.281 978.324 439.186 979.011 439.186C979.449 439.186 979.952 439.239 980.52 439.346C981.094 439.446 981.648 439.657 982.18 439.976C982.719 440.296 983.166 440.778 983.521 441.423C983.876 442.068 984.053 442.933 984.053 444.016V453H981.958V451.153H981.852C981.71 451.449 981.473 451.766 981.142 452.103C980.81 452.441 980.369 452.728 979.819 452.964C979.268 453.201 978.597 453.32 977.803 453.32ZM978.123 451.438C978.952 451.438 979.65 451.275 980.218 450.949C980.792 450.624 981.224 450.203 981.514 449.689C981.81 449.174 981.958 448.632 981.958 448.064V446.146C981.869 446.253 981.674 446.35 981.372 446.439C981.076 446.522 980.733 446.596 980.343 446.661C979.958 446.72 979.582 446.774 979.215 446.821C978.854 446.862 978.561 446.898 978.336 446.928C977.792 446.999 977.283 447.114 976.809 447.274C976.342 447.428 975.963 447.661 975.673 447.975C975.389 448.283 975.247 448.703 975.247 449.236C975.247 449.964 975.516 450.514 976.055 450.887C976.599 451.254 977.289 451.438 978.123 451.438ZM987.878 458.114V439.364H989.902V441.53H990.15C990.304 441.293 990.517 440.991 990.79 440.624C991.068 440.251 991.464 439.92 991.979 439.63C992.5 439.334 993.204 439.186 994.092 439.186C995.24 439.186 996.252 439.473 997.128 440.047C998.004 440.621 998.688 441.435 999.179 442.489C999.67 443.542 999.916 444.785 999.916 446.217C999.916 447.661 999.67 448.913 999.179 449.973C998.688 451.026 998.007 451.843 997.137 452.423C996.267 452.997 995.264 453.284 994.128 453.284C993.252 453.284 992.55 453.139 992.024 452.849C991.497 452.553 991.091 452.219 990.807 451.846C990.523 451.467 990.304 451.153 990.15 450.905H989.973V458.114H987.878ZM989.937 446.182C989.937 447.212 990.088 448.12 990.39 448.907C990.692 449.689 991.133 450.301 991.713 450.745C992.293 451.183 993.003 451.402 993.843 451.402C994.719 451.402 995.45 451.171 996.036 450.71C996.628 450.242 997.072 449.615 997.368 448.827C997.67 448.034 997.821 447.152 997.821 446.182C997.821 445.223 997.673 444.359 997.377 443.589C997.087 442.814 996.646 442.202 996.054 441.752C995.468 441.296 994.731 441.068 993.843 441.068C992.991 441.068 992.275 441.284 991.695 441.716C991.115 442.142 990.677 442.74 990.381 443.51C990.085 444.273 989.937 445.164 989.937 446.182ZM1003.11 453V439.364H1005.21V453H1003.11ZM1004.18 437.091C1003.77 437.091 1003.42 436.952 1003.12 436.674C1002.83 436.395 1002.69 436.061 1002.69 435.67C1002.69 435.28 1002.83 434.945 1003.12 434.667C1003.42 434.389 1003.77 434.25 1004.18 434.25C1004.59 434.25 1004.93 434.389 1005.22 434.667C1005.52 434.945 1005.67 435.28 1005.67 435.67C1005.67 436.061 1005.52 436.395 1005.22 436.674C1004.93 436.952 1004.59 437.091 1004.18 437.091Z" fill="#03031C"/>
+<g filter="url(#filter11_bd_12_480)">
+<rect x="1062" y="413" width="109" height="65" rx="10" fill="#FFC743"/>
+<rect x="1062.5" y="413.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M1104.8 453.32C1103.94 453.32 1103.16 453.157 1102.45 452.831C1101.75 452.5 1101.19 452.023 1100.77 451.402C1100.36 450.775 1100.15 450.017 1100.15 449.129C1100.15 448.348 1100.31 447.715 1100.61 447.229C1100.92 446.738 1101.33 446.353 1101.85 446.075C1102.36 445.797 1102.93 445.59 1103.55 445.454C1104.18 445.312 1104.81 445.199 1105.44 445.116C1106.27 445.01 1106.94 444.93 1107.46 444.877C1107.98 444.818 1108.36 444.72 1108.59 444.584C1108.84 444.448 1108.96 444.211 1108.96 443.874V443.803C1108.96 442.927 1108.72 442.246 1108.24 441.761C1107.77 441.275 1107.05 441.033 1106.08 441.033C1105.08 441.033 1104.3 441.252 1103.73 441.69C1103.16 442.128 1102.76 442.595 1102.53 443.092L1100.54 442.382C1100.9 441.554 1101.37 440.908 1101.96 440.447C1102.56 439.979 1103.21 439.654 1103.92 439.47C1104.63 439.281 1105.32 439.186 1106.01 439.186C1106.45 439.186 1106.95 439.239 1107.52 439.346C1108.09 439.446 1108.65 439.657 1109.18 439.976C1109.72 440.296 1110.17 440.778 1110.52 441.423C1110.88 442.068 1111.05 442.933 1111.05 444.016V453H1108.96V451.153H1108.85C1108.71 451.449 1108.47 451.766 1108.14 452.103C1107.81 452.441 1107.37 452.728 1106.82 452.964C1106.27 453.201 1105.6 453.32 1104.8 453.32ZM1105.12 451.438C1105.95 451.438 1106.65 451.275 1107.22 450.949C1107.79 450.624 1108.22 450.203 1108.51 449.689C1108.81 449.174 1108.96 448.632 1108.96 448.064V446.146C1108.87 446.253 1108.67 446.35 1108.37 446.439C1108.08 446.522 1107.73 446.596 1107.34 446.661C1106.96 446.72 1106.58 446.774 1106.22 446.821C1105.85 446.862 1105.56 446.898 1105.34 446.928C1104.79 446.999 1104.28 447.114 1103.81 447.274C1103.34 447.428 1102.96 447.661 1102.67 447.975C1102.39 448.283 1102.25 448.703 1102.25 449.236C1102.25 449.964 1102.52 450.514 1103.05 450.887C1103.6 451.254 1104.29 451.438 1105.12 451.438ZM1114.88 458.114V439.364H1116.9V441.53H1117.15C1117.3 441.293 1117.52 440.991 1117.79 440.624C1118.07 440.251 1118.46 439.92 1118.98 439.63C1119.5 439.334 1120.2 439.186 1121.09 439.186C1122.24 439.186 1123.25 439.473 1124.13 440.047C1125 440.621 1125.69 441.435 1126.18 442.489C1126.67 443.542 1126.92 444.785 1126.92 446.217C1126.92 447.661 1126.67 448.913 1126.18 449.973C1125.69 451.026 1125.01 451.843 1124.14 452.423C1123.27 452.997 1122.26 453.284 1121.13 453.284C1120.25 453.284 1119.55 453.139 1119.02 452.849C1118.5 452.553 1118.09 452.219 1117.81 451.846C1117.52 451.467 1117.3 451.153 1117.15 450.905H1116.97V458.114H1114.88ZM1116.94 446.182C1116.94 447.212 1117.09 448.12 1117.39 448.907C1117.69 449.689 1118.13 450.301 1118.71 450.745C1119.29 451.183 1120 451.402 1120.84 451.402C1121.72 451.402 1122.45 451.171 1123.04 450.71C1123.63 450.242 1124.07 449.615 1124.37 448.827C1124.67 448.034 1124.82 447.152 1124.82 446.182C1124.82 445.223 1124.67 444.359 1124.38 443.589C1124.09 442.814 1123.65 442.202 1123.05 441.752C1122.47 441.296 1121.73 441.068 1120.84 441.068C1119.99 441.068 1119.28 441.284 1118.7 441.716C1118.12 442.142 1117.68 442.74 1117.38 443.51C1117.09 444.273 1116.94 445.164 1116.94 446.182ZM1130.11 453V439.364H1132.21V453H1130.11ZM1131.18 437.091C1130.77 437.091 1130.42 436.952 1130.12 436.674C1129.83 436.395 1129.69 436.061 1129.69 435.67C1129.69 435.28 1129.83 434.945 1130.12 434.667C1130.42 434.389 1130.77 434.25 1131.18 434.25C1131.59 434.25 1131.93 434.389 1132.22 434.667C1132.52 434.945 1132.67 435.28 1132.67 435.67C1132.67 436.061 1132.52 436.395 1132.22 436.674C1131.93 436.952 1131.59 437.091 1131.18 437.091Z" fill="#03031C"/>
+<path d="M1076 356.818H1078.2V368.857C1078.2 370.099 1077.91 371.209 1077.32 372.186C1076.74 373.156 1075.92 373.923 1074.86 374.485C1073.8 375.041 1072.56 375.32 1071.13 375.32C1069.7 375.32 1068.46 375.041 1067.4 374.485C1066.34 373.923 1065.52 373.156 1064.93 372.186C1064.35 371.209 1064.06 370.099 1064.06 368.857V356.818H1066.27V368.679C1066.27 369.567 1066.46 370.357 1066.85 371.049C1067.24 371.736 1067.8 372.277 1068.52 372.674C1069.25 373.065 1070.12 373.26 1071.13 373.26C1072.14 373.26 1073.01 373.065 1073.74 372.674C1074.47 372.277 1075.03 371.736 1075.41 371.049C1075.8 370.357 1076 369.567 1076 368.679V356.818ZM1091.97 364.418L1090.09 364.95C1089.97 364.637 1089.79 364.332 1089.56 364.036C1089.34 363.734 1089.03 363.485 1088.64 363.29C1088.25 363.095 1087.75 362.997 1087.14 362.997C1086.31 362.997 1085.61 363.19 1085.05 363.574C1084.5 363.953 1084.23 364.435 1084.23 365.021C1084.23 365.542 1084.42 365.953 1084.8 366.255C1085.18 366.557 1085.77 366.809 1086.57 367.01L1088.6 367.507C1089.82 367.803 1090.72 368.256 1091.32 368.865C1091.92 369.469 1092.22 370.247 1092.22 371.2C1092.22 371.982 1091.99 372.68 1091.54 373.295C1091.1 373.911 1090.48 374.396 1089.68 374.751C1088.88 375.107 1087.95 375.284 1086.89 375.284C1085.5 375.284 1084.35 374.982 1083.44 374.379C1082.53 373.775 1081.95 372.893 1081.71 371.733L1083.7 371.236C1083.89 371.97 1084.24 372.52 1084.77 372.887C1085.3 373.254 1086 373.438 1086.86 373.438C1087.83 373.438 1088.61 373.23 1089.18 372.816C1089.76 372.396 1090.05 371.893 1090.05 371.307C1090.05 370.833 1089.89 370.437 1089.55 370.117C1089.22 369.792 1088.71 369.549 1088.03 369.389L1085.76 368.857C1084.51 368.561 1083.59 368.102 1083 367.48C1082.42 366.853 1082.13 366.069 1082.13 365.128C1082.13 364.358 1082.35 363.678 1082.78 363.086C1083.22 362.494 1083.81 362.029 1084.57 361.692C1085.32 361.355 1086.18 361.186 1087.14 361.186C1088.49 361.186 1089.55 361.482 1090.32 362.074C1091.09 362.666 1091.64 363.447 1091.97 364.418ZM1101.09 375.284C1099.78 375.284 1098.64 374.994 1097.69 374.414C1096.74 373.828 1096.01 373.011 1095.5 371.964C1094.99 370.91 1094.73 369.685 1094.73 368.288C1094.73 366.892 1094.99 365.661 1095.5 364.595C1096.01 363.524 1096.73 362.689 1097.64 362.092C1098.57 361.488 1099.65 361.186 1100.88 361.186C1101.59 361.186 1102.29 361.304 1102.98 361.541C1103.67 361.778 1104.3 362.163 1104.87 362.695C1105.44 363.222 1105.89 363.92 1106.23 364.79C1106.57 365.661 1106.74 366.732 1106.74 368.004V368.892H1096.22V367.081H1104.61C1104.61 366.312 1104.45 365.625 1104.14 365.021C1103.84 364.418 1103.41 363.941 1102.85 363.592C1102.29 363.243 1101.63 363.068 1100.88 363.068C1100.04 363.068 1099.32 363.275 1098.71 363.69C1098.11 364.098 1097.64 364.631 1097.32 365.288C1096.99 365.945 1096.83 366.649 1096.83 367.401V368.608C1096.83 369.638 1097.01 370.511 1097.36 371.227C1097.72 371.937 1098.22 372.479 1098.86 372.852C1099.5 373.219 1100.24 373.402 1101.09 373.402C1101.64 373.402 1102.14 373.325 1102.58 373.171C1103.03 373.011 1103.42 372.775 1103.74 372.461C1104.07 372.141 1104.32 371.745 1104.5 371.271L1106.52 371.839C1106.31 372.526 1105.95 373.13 1105.45 373.651C1104.95 374.165 1104.32 374.568 1103.58 374.858C1102.84 375.142 1102.01 375.284 1101.09 375.284ZM1109.92 375V361.364H1111.95V363.423H1112.09C1112.34 362.749 1112.79 362.201 1113.44 361.781C1114.09 361.361 1114.82 361.151 1115.64 361.151C1115.79 361.151 1115.99 361.154 1116.22 361.159C1116.45 361.165 1116.62 361.174 1116.74 361.186V363.317C1116.67 363.299 1116.51 363.272 1116.25 363.237C1116 363.195 1115.74 363.175 1115.46 363.175C1114.8 363.175 1114.21 363.314 1113.69 363.592C1113.17 363.864 1112.76 364.243 1112.46 364.728C1112.17 365.208 1112.02 365.755 1112.02 366.371V375H1109.92ZM1131.76 380.398C1130.75 380.398 1129.88 380.268 1129.15 380.007C1128.42 379.753 1127.82 379.415 1127.33 378.995C1126.85 378.581 1126.47 378.137 1126.18 377.663L1127.85 376.491C1128.04 376.74 1128.28 377.024 1128.57 377.344C1128.86 377.669 1129.26 377.95 1129.76 378.187C1130.27 378.43 1130.94 378.551 1131.76 378.551C1132.86 378.551 1133.77 378.285 1134.49 377.752C1135.2 377.219 1135.56 376.385 1135.56 375.249V372.479H1135.38C1135.23 372.727 1135.01 373.035 1134.73 373.402C1134.45 373.763 1134.04 374.086 1133.52 374.37C1133 374.648 1132.29 374.787 1131.41 374.787C1130.3 374.787 1129.32 374.527 1128.44 374.006C1127.57 373.485 1126.88 372.727 1126.37 371.733C1125.87 370.739 1125.62 369.531 1125.62 368.111C1125.62 366.714 1125.86 365.498 1126.35 364.462C1126.84 363.42 1127.53 362.615 1128.4 362.047C1129.28 361.473 1130.29 361.186 1131.44 361.186C1132.33 361.186 1133.03 361.334 1133.55 361.63C1134.08 361.92 1134.48 362.251 1134.76 362.624C1135.05 362.991 1135.26 363.293 1135.42 363.53H1135.63V361.364H1137.66V375.391C1137.66 376.562 1137.39 377.515 1136.86 378.249C1136.33 378.989 1135.62 379.531 1134.73 379.874C1133.84 380.223 1132.85 380.398 1131.76 380.398ZM1131.69 372.905C1132.53 372.905 1133.24 372.712 1133.82 372.328C1134.4 371.943 1134.84 371.39 1135.14 370.668C1135.44 369.946 1135.6 369.081 1135.6 368.075C1135.6 367.093 1135.45 366.226 1135.15 365.474C1134.86 364.722 1134.42 364.134 1133.84 363.707C1133.26 363.281 1132.54 363.068 1131.69 363.068C1130.8 363.068 1130.06 363.293 1129.47 363.743C1128.88 364.193 1128.44 364.796 1128.15 365.554C1127.86 366.312 1127.71 367.152 1127.71 368.075C1127.71 369.022 1127.86 369.86 1128.16 370.588C1128.46 371.31 1128.9 371.878 1129.49 372.292C1130.08 372.701 1130.81 372.905 1131.69 372.905ZM1141.49 375V361.364H1143.51V363.423H1143.66C1143.91 362.749 1144.35 362.201 1145.01 361.781C1145.66 361.361 1146.39 361.151 1147.21 361.151C1147.36 361.151 1147.55 361.154 1147.78 361.159C1148.02 361.165 1148.19 361.174 1148.31 361.186V363.317C1148.24 363.299 1148.07 363.272 1147.82 363.237C1147.57 363.195 1147.31 363.175 1147.03 363.175C1146.37 363.175 1145.78 363.314 1145.25 363.592C1144.74 363.864 1144.33 364.243 1144.03 364.728C1143.73 365.208 1143.59 365.755 1143.59 366.371V375H1141.49ZM1155.92 375.284C1154.69 375.284 1153.61 374.991 1152.68 374.405C1151.75 373.819 1151.03 373 1150.51 371.946C1150 370.893 1149.74 369.661 1149.74 368.253C1149.74 366.832 1150 365.592 1150.51 364.533C1151.03 363.474 1151.75 362.651 1152.68 362.065C1153.61 361.479 1154.69 361.186 1155.92 361.186C1157.15 361.186 1158.23 361.479 1159.15 362.065C1160.08 362.651 1160.8 363.474 1161.31 364.533C1161.84 365.592 1162.1 366.832 1162.1 368.253C1162.1 369.661 1161.84 370.893 1161.31 371.946C1160.8 373 1160.08 373.819 1159.15 374.405C1158.23 374.991 1157.15 375.284 1155.92 375.284ZM1155.92 373.402C1156.85 373.402 1157.62 373.162 1158.23 372.683C1158.83 372.203 1159.28 371.573 1159.57 370.792C1159.86 370.011 1160 369.164 1160 368.253C1160 367.341 1159.86 366.492 1159.57 365.705C1159.28 364.918 1158.83 364.281 1158.23 363.796C1157.62 363.311 1156.85 363.068 1155.92 363.068C1154.98 363.068 1154.21 363.311 1153.61 363.796C1153 364.281 1152.56 364.918 1152.27 365.705C1151.98 366.492 1151.83 367.341 1151.83 368.253C1151.83 369.164 1151.98 370.011 1152.27 370.792C1152.56 371.573 1153 372.203 1153.61 372.683C1154.21 373.162 1154.98 373.402 1155.92 373.402ZM1173.89 369.425V361.364H1175.98V375H1173.89V372.692H1173.75C1173.43 373.384 1172.93 373.973 1172.25 374.458C1171.58 374.938 1170.73 375.178 1169.7 375.178C1168.85 375.178 1168.09 374.991 1167.42 374.618C1166.76 374.239 1166.24 373.671 1165.86 372.914C1165.48 372.15 1165.29 371.188 1165.29 370.028V361.364H1167.39V369.886C1167.39 370.881 1167.67 371.674 1168.22 372.266C1168.79 372.857 1169.5 373.153 1170.37 373.153C1170.89 373.153 1171.42 373.02 1171.96 372.754C1172.51 372.488 1172.96 372.079 1173.33 371.529C1173.7 370.978 1173.89 370.277 1173.89 369.425ZM1179.82 380.114V361.364H1181.84V363.53H1182.09C1182.25 363.293 1182.46 362.991 1182.73 362.624C1183.01 362.251 1183.41 361.92 1183.92 361.63C1184.44 361.334 1185.15 361.186 1186.03 361.186C1187.18 361.186 1188.2 361.473 1189.07 362.047C1189.95 362.621 1190.63 363.435 1191.12 364.489C1191.61 365.542 1191.86 366.785 1191.86 368.217C1191.86 369.661 1191.61 370.913 1191.12 371.973C1190.63 373.026 1189.95 373.843 1189.08 374.423C1188.21 374.997 1187.21 375.284 1186.07 375.284C1185.19 375.284 1184.49 375.139 1183.97 374.849C1183.44 374.553 1183.03 374.219 1182.75 373.846C1182.47 373.467 1182.25 373.153 1182.09 372.905H1181.92V380.114H1179.82ZM1181.88 368.182C1181.88 369.212 1182.03 370.12 1182.33 370.907C1182.63 371.689 1183.08 372.301 1183.66 372.745C1184.24 373.183 1184.95 373.402 1185.79 373.402C1186.66 373.402 1187.39 373.171 1187.98 372.71C1188.57 372.242 1189.01 371.615 1189.31 370.827C1189.61 370.034 1189.76 369.152 1189.76 368.182C1189.76 367.223 1189.62 366.359 1189.32 365.589C1189.03 364.814 1188.59 364.202 1188 363.752C1187.41 363.296 1186.67 363.068 1185.79 363.068C1184.93 363.068 1184.22 363.284 1183.64 363.716C1183.06 364.142 1182.62 364.74 1182.32 365.51C1182.03 366.273 1181.88 367.164 1181.88 368.182Z" fill="#03031C"/>
+<path d="M1117.28 273.127C1117.13 273.387 1117.02 273.759 1117.02 274.168V278.89C1120.03 281.12 1123.53 282.273 1127.25 282.273C1131.67 282.273 1135.13 280.6 1137.47 278.89V274.168C1137.47 273.759 1137.4 273.387 1137.21 273.127C1134.35 275.915 1130.89 277.514 1127.21 277.514C1123.6 277.551 1120.14 275.915 1117.28 273.127Z" fill="#FFC743"/>
+<path d="M1089.99 320.644C1089.84 320.904 1089.73 321.276 1089.73 321.685V326.407C1092.74 328.638 1096.24 329.791 1099.95 329.791C1104.38 329.791 1107.84 328.117 1110.18 326.407V321.685C1110.18 321.276 1110.11 320.904 1109.92 320.644C1107.06 323.433 1103.6 325.031 1099.92 325.031C1096.31 325.069 1092.85 323.433 1089.99 320.644Z" fill="#FFC743"/>
+<path d="M1144.65 320.644C1144.5 320.904 1144.39 321.276 1144.39 321.685V326.407C1147.4 328.638 1150.89 329.791 1154.61 329.791C1159.04 329.791 1162.49 328.117 1164.84 326.407V321.685C1164.84 321.276 1164.76 320.904 1164.58 320.644C1161.71 323.433 1158.25 325.031 1154.57 325.031C1150.97 325.069 1147.51 323.433 1144.65 320.644Z" fill="#FFC743"/>
+<path d="M1127.32 301.682L1117.65 311.349" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1127.32 291.011V301.681L1136.88 311.237" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1105.09 311.907C1105.09 311.907 1110.18 314.695 1112.19 316.294C1112.67 316.666 1113.04 317.149 1113.38 317.67C1113.97 318.636 1114.27 319.752 1114.27 320.867V327.523C1110.44 330.869 1105.46 333.025 1099.95 333.025C1094.38 333.025 1089.47 330.943 1085.64 327.485V320.83C1085.64 319.715 1085.9 318.562 1086.53 317.632C1086.87 317.112 1087.24 316.666 1087.72 316.257C1089.69 314.658 1094.82 311.869 1094.82 311.869" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1099.95 314.584C1103.94 314.584 1107.17 310.572 1107.17 305.623C1107.17 300.674 1103.94 296.662 1099.95 296.662C1095.97 296.662 1092.74 300.674 1092.74 305.623C1092.74 310.572 1095.97 314.584 1099.95 314.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1159.82 311.907C1159.82 311.907 1164.91 314.695 1166.92 316.294C1167.4 316.666 1167.77 317.149 1168.11 317.67C1168.7 318.636 1169 319.752 1169 320.867V327.523C1165.17 330.906 1160.19 333.063 1154.69 333.063C1149.11 333.063 1144.2 330.981 1140.37 327.523V320.867C1140.37 319.752 1140.63 318.599 1141.26 317.67C1141.6 317.149 1141.97 316.703 1142.45 316.294C1144.42 314.695 1149.55 311.907 1149.55 311.907" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1154.65 314.584C1158.63 314.584 1161.86 310.572 1161.86 305.623C1161.86 300.674 1158.63 296.662 1154.65 296.662C1150.66 296.662 1147.44 300.674 1147.44 305.623C1147.44 310.572 1150.66 314.584 1154.65 314.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1132.41 265.244C1132.41 265.244 1137.51 268.033 1139.52 269.632C1140 270.003 1140.37 270.487 1140.71 271.007C1141.3 271.974 1141.6 273.089 1141.6 274.205V280.86C1137.77 284.244 1132.79 286.4 1127.28 286.4C1121.71 286.4 1116.8 284.318 1112.97 280.86V274.168C1112.97 273.052 1113.23 271.9 1113.86 270.97C1114.2 270.45 1114.57 270.003 1115.05 269.594C1117.02 267.996 1122.15 265.207 1122.15 265.207" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1127.28 267.921C1131.27 267.921 1134.5 263.909 1134.5 258.961C1134.5 254.012 1131.27 250 1127.28 250C1123.3 250 1120.07 254.012 1120.07 258.961C1120.07 263.909 1123.3 267.921 1127.28 267.921Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#filter12_bd_12_480)">
+<rect x="712" y="869" width="286" height="197" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="712.5" y="869.5" width="285" height="196" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M760.118 1006.99V1003.18H778.037V1006.99H771.357V1025H766.798V1006.99H760.118ZM781.83 1031.14C781.254 1031.14 780.715 1031.09 780.21 1031C779.713 1030.91 779.301 1030.8 778.975 1030.67L779.997 1027.28C780.53 1027.44 781.009 1027.53 781.436 1027.55C781.869 1027.56 782.242 1027.46 782.554 1027.25C782.874 1027.03 783.133 1026.67 783.332 1026.16L783.598 1025.47L777.728 1008.64H782.501L785.889 1020.65H786.059L789.479 1008.64H794.284L787.923 1026.77C787.618 1027.65 787.203 1028.42 786.677 1029.07C786.159 1029.73 785.502 1030.24 784.706 1030.59C783.911 1030.96 782.952 1031.14 781.83 1031.14ZM800.718 1020.29L800.729 1014.85H801.389L806.631 1008.64H811.84L804.798 1016.86H803.722L800.718 1020.29ZM796.606 1025V1003.18H801.144V1025H796.606ZM806.833 1025L802.018 1017.87L805.044 1014.67L812.149 1025H806.833ZM841.145 1014.09C841.145 1016.47 840.694 1018.49 839.792 1020.16C838.897 1021.83 837.676 1023.11 836.127 1023.99C834.586 1024.86 832.853 1025.3 830.929 1025.3C828.99 1025.3 827.25 1024.86 825.708 1023.98C824.167 1023.1 822.949 1021.82 822.054 1020.15C821.159 1018.48 820.712 1016.46 820.712 1014.09C820.712 1011.71 821.159 1009.69 822.054 1008.02C822.949 1006.35 824.167 1005.08 825.708 1004.2C827.25 1003.32 828.99 1002.88 830.929 1002.88C832.853 1002.88 834.586 1003.32 836.127 1004.2C837.676 1005.08 838.897 1006.35 839.792 1008.02C840.694 1009.69 841.145 1011.71 841.145 1014.09ZM836.468 1014.09C836.468 1012.55 836.238 1011.25 835.776 1010.19C835.321 1009.13 834.679 1008.33 833.848 1007.78C833.017 1007.24 832.044 1006.96 830.929 1006.96C829.814 1006.96 828.841 1007.24 828.01 1007.78C827.179 1008.33 826.532 1009.13 826.071 1010.19C825.616 1011.25 825.389 1012.55 825.389 1014.09C825.389 1015.63 825.616 1016.93 826.071 1017.99C826.532 1019.05 827.179 1019.85 828.01 1020.4C828.841 1020.94 829.814 1021.22 830.929 1021.22C832.044 1021.22 833.017 1020.94 833.848 1020.4C834.679 1019.85 835.321 1019.05 835.776 1017.99C836.238 1016.93 836.468 1015.63 836.468 1014.09ZM844.477 1031.14V1008.64H848.952V1011.38H849.154C849.353 1010.94 849.64 1010.5 850.017 1010.04C850.4 1009.58 850.898 1009.2 851.508 1008.89C852.126 1008.58 852.893 1008.42 853.809 1008.42C855.003 1008.42 856.104 1008.74 857.112 1009.36C858.121 1009.98 858.927 1010.91 859.53 1012.16C860.134 1013.41 860.436 1014.96 860.436 1016.84C860.436 1018.66 860.141 1020.21 859.552 1021.46C858.969 1022.71 858.174 1023.66 857.165 1024.31C856.164 1024.95 855.042 1025.27 853.799 1025.27C852.918 1025.27 852.169 1025.12 851.551 1024.83C850.94 1024.54 850.439 1024.17 850.049 1023.73C849.658 1023.28 849.36 1022.83 849.154 1022.38H849.015V1031.14H844.477ZM848.92 1016.82C848.92 1017.79 849.055 1018.64 849.324 1019.36C849.594 1020.09 849.985 1020.65 850.496 1021.06C851.008 1021.46 851.629 1021.65 852.361 1021.65C853.099 1021.65 853.724 1021.45 854.236 1021.05C854.747 1020.64 855.134 1020.07 855.397 1019.34C855.667 1018.61 855.802 1017.77 855.802 1016.82C855.802 1015.87 855.67 1015.04 855.407 1014.33C855.145 1013.61 854.758 1013.05 854.246 1012.64C853.735 1012.24 853.106 1012.03 852.361 1012.03C851.622 1012.03 850.997 1012.23 850.486 1012.62C849.981 1013.01 849.594 1013.57 849.324 1014.28C849.055 1015 848.92 1015.85 848.92 1016.82ZM870.919 1025.32C869.236 1025.32 867.787 1024.98 866.572 1024.3C865.365 1023.61 864.434 1022.63 863.781 1021.38C863.128 1020.11 862.801 1018.62 862.801 1016.89C862.801 1015.21 863.128 1013.73 863.781 1012.46C864.434 1011.19 865.354 1010.2 866.54 1009.49C867.733 1008.78 869.133 1008.42 870.738 1008.42C871.817 1008.42 872.822 1008.6 873.753 1008.95C874.69 1009.29 875.507 1009.8 876.203 1010.49C876.906 1011.18 877.453 1012.05 877.844 1013.09C878.234 1014.13 878.43 1015.34 878.43 1016.73V1017.98H864.612V1015.17H874.157C874.157 1014.51 874.015 1013.93 873.731 1013.43C873.447 1012.93 873.053 1012.53 872.549 1012.25C872.052 1011.96 871.473 1011.81 870.812 1011.81C870.123 1011.81 869.513 1011.97 868.98 1012.29C868.454 1012.6 868.042 1013.03 867.744 1013.56C867.446 1014.08 867.293 1014.67 867.286 1015.32V1017.99C867.286 1018.8 867.435 1019.5 867.733 1020.09C868.039 1020.68 868.469 1021.13 869.023 1021.45C869.577 1021.77 870.233 1021.93 870.993 1021.93C871.498 1021.93 871.959 1021.86 872.378 1021.72C872.797 1021.58 873.156 1021.36 873.454 1021.08C873.753 1020.8 873.98 1020.45 874.136 1020.04L878.334 1020.31C878.121 1021.32 877.684 1022.2 877.023 1022.95C876.37 1023.7 875.525 1024.28 874.488 1024.7C873.458 1025.11 872.268 1025.32 870.919 1025.32ZM881.391 1025V1008.64H885.791V1011.49H885.961C886.26 1010.48 886.76 1009.71 887.464 1009.19C888.167 1008.66 888.976 1008.4 889.893 1008.4C890.12 1008.4 890.365 1008.42 890.628 1008.44C890.89 1008.47 891.121 1008.51 891.32 1008.56V1012.59C891.107 1012.52 890.812 1012.47 890.436 1012.42C890.059 1012.37 889.715 1012.34 889.403 1012.34C888.735 1012.34 888.138 1012.49 887.613 1012.78C887.094 1013.06 886.682 1013.46 886.377 1013.97C886.079 1014.49 885.93 1015.07 885.93 1015.74V1025H881.391ZM897.864 1025.31C896.82 1025.31 895.89 1025.13 895.073 1024.77C894.256 1024.4 893.61 1023.85 893.134 1023.14C892.665 1022.41 892.431 1021.51 892.431 1020.43C892.431 1019.52 892.598 1018.76 892.931 1018.14C893.265 1017.52 893.72 1017.02 894.295 1016.65C894.87 1016.27 895.524 1015.99 896.255 1015.8C896.994 1015.6 897.768 1015.47 898.578 1015.39C899.529 1015.29 900.297 1015.2 900.879 1015.11C901.461 1015.02 901.884 1014.89 902.147 1014.71C902.409 1014.53 902.541 1014.27 902.541 1013.92V1013.86C902.541 1013.18 902.328 1012.66 901.902 1012.29C901.483 1011.92 900.886 1011.74 900.112 1011.74C899.295 1011.74 898.645 1011.92 898.162 1012.28C897.679 1012.63 897.36 1013.08 897.203 1013.62L893.006 1013.28C893.219 1012.29 893.638 1011.43 894.263 1010.7C894.888 1009.97 895.694 1009.41 896.681 1009.02C897.676 1008.62 898.826 1008.42 900.133 1008.42C901.042 1008.42 901.912 1008.53 902.743 1008.74C903.581 1008.96 904.324 1009.29 904.97 1009.73C905.623 1010.18 906.138 1010.76 906.515 1011.46C906.891 1012.16 907.079 1012.99 907.079 1013.96V1025H902.775V1022.73H902.647C902.385 1023.24 902.033 1023.69 901.593 1024.08C901.152 1024.47 900.623 1024.77 900.005 1024.99C899.387 1025.2 898.674 1025.31 897.864 1025.31ZM899.164 1022.18C899.831 1022.18 900.421 1022.05 900.932 1021.78C901.444 1021.51 901.845 1021.15 902.136 1020.7C902.427 1020.24 902.573 1019.73 902.573 1019.15V1017.41C902.431 1017.51 902.235 1017.59 901.987 1017.67C901.745 1017.74 901.472 1017.81 901.167 1017.87C900.861 1017.93 900.556 1017.98 900.25 1018.03C899.945 1018.08 899.668 1018.11 899.419 1018.15C898.887 1018.23 898.422 1018.35 898.024 1018.52C897.626 1018.69 897.317 1018.92 897.097 1019.22C896.877 1019.5 896.767 1019.85 896.767 1020.28C896.767 1020.9 896.99 1021.37 897.438 1021.7C897.892 1022.02 898.468 1022.18 899.164 1022.18ZM919.304 1008.64V1012.05H909.45V1008.64H919.304ZM911.687 1004.72H916.225V1019.97C916.225 1020.39 916.289 1020.72 916.417 1020.95C916.545 1021.18 916.722 1021.34 916.95 1021.43C917.184 1021.52 917.454 1021.57 917.759 1021.57C917.972 1021.57 918.185 1021.55 918.398 1021.52C918.612 1021.47 918.775 1021.44 918.888 1021.42L919.602 1024.8C919.375 1024.87 919.055 1024.95 918.643 1025.04C918.232 1025.14 917.731 1025.2 917.141 1025.22C916.048 1025.27 915.089 1025.12 914.265 1024.79C913.448 1024.45 912.813 1023.93 912.358 1023.23C911.903 1022.53 911.68 1021.64 911.687 1020.57V1004.72ZM929.478 1025.32C927.823 1025.32 926.392 1024.97 925.185 1024.26C923.984 1023.55 923.058 1022.57 922.404 1021.3C921.751 1020.03 921.424 1018.56 921.424 1016.88C921.424 1015.19 921.751 1013.71 922.404 1012.45C923.058 1011.18 923.984 1010.19 925.185 1009.49C926.392 1008.78 927.823 1008.42 929.478 1008.42C931.133 1008.42 932.56 1008.78 933.761 1009.49C934.968 1010.19 935.898 1011.18 936.552 1012.45C937.205 1013.71 937.532 1015.19 937.532 1016.88C937.532 1018.56 937.205 1020.03 936.552 1021.3C935.898 1022.57 934.968 1023.55 933.761 1024.26C932.56 1024.97 931.133 1025.32 929.478 1025.32ZM929.499 1021.8C930.252 1021.8 930.881 1021.59 931.385 1021.16C931.889 1020.73 932.269 1020.14 932.525 1019.4C932.788 1018.65 932.919 1017.8 932.919 1016.85C932.919 1015.9 932.788 1015.05 932.525 1014.3C932.269 1013.56 931.889 1012.97 931.385 1012.54C930.881 1012.1 930.252 1011.89 929.499 1011.89C928.739 1011.89 928.1 1012.1 927.582 1012.54C927.07 1012.97 926.683 1013.56 926.42 1014.3C926.165 1015.05 926.037 1015.9 926.037 1016.85C926.037 1017.8 926.165 1018.65 926.42 1019.4C926.683 1020.14 927.07 1020.73 927.582 1021.16C928.1 1021.59 928.739 1021.8 929.499 1021.8ZM940.483 1025V1008.64H944.883V1011.49H945.053C945.352 1010.48 945.852 1009.71 946.555 1009.19C947.259 1008.66 948.068 1008.4 948.984 1008.4C949.212 1008.4 949.457 1008.42 949.719 1008.44C949.982 1008.47 950.213 1008.51 950.412 1008.56V1012.59C950.199 1012.52 949.904 1012.47 949.528 1012.42C949.151 1012.37 948.807 1012.34 948.494 1012.34C947.827 1012.34 947.23 1012.49 946.705 1012.78C946.186 1013.06 945.774 1013.46 945.469 1013.97C945.17 1014.49 945.021 1015.07 945.021 1015.74V1025H940.483Z" fill="#03031C"/>
+<g filter="url(#filter13_bd_12_480)">
+<rect x="532" y="1251" width="286" height="221" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="532.5" y="1251.5" width="285" height="220" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M596.286 1418.54V1428H591.748V1411.64H596.073V1414.52H596.265C596.627 1413.57 597.234 1412.82 598.086 1412.26C598.939 1411.7 599.972 1411.42 601.187 1411.42C602.323 1411.42 603.314 1411.67 604.159 1412.17C605.004 1412.67 605.661 1413.38 606.13 1414.3C606.598 1415.22 606.833 1416.31 606.833 1417.58V1428H602.294V1418.39C602.302 1417.39 602.046 1416.61 601.527 1416.05C601.009 1415.48 600.295 1415.19 599.386 1415.19C598.775 1415.19 598.236 1415.33 597.767 1415.59C597.305 1415.85 596.943 1416.24 596.68 1416.74C596.424 1417.24 596.293 1417.84 596.286 1418.54ZM615.076 1428.31C614.032 1428.31 613.101 1428.13 612.285 1427.77C611.468 1427.4 610.822 1426.85 610.346 1426.14C609.877 1425.41 609.643 1424.51 609.643 1423.43C609.643 1422.52 609.81 1421.76 610.143 1421.14C610.477 1420.52 610.932 1420.02 611.507 1419.65C612.082 1419.27 612.736 1418.99 613.467 1418.8C614.206 1418.6 614.98 1418.47 615.79 1418.39C616.741 1418.29 617.508 1418.2 618.091 1418.11C618.673 1418.02 619.096 1417.89 619.359 1417.71C619.621 1417.53 619.753 1417.27 619.753 1416.92V1416.86C619.753 1416.18 619.54 1415.66 619.114 1415.29C618.695 1414.92 618.098 1414.74 617.324 1414.74C616.507 1414.74 615.857 1414.92 615.374 1415.28C614.891 1415.63 614.572 1416.08 614.415 1416.62L610.218 1416.28C610.431 1415.29 610.85 1414.43 611.475 1413.7C612.1 1412.97 612.906 1412.41 613.893 1412.02C614.888 1411.62 616.038 1411.42 617.345 1411.42C618.254 1411.42 619.124 1411.53 619.955 1411.74C620.793 1411.96 621.535 1412.29 622.182 1412.73C622.835 1413.18 623.35 1413.76 623.726 1414.46C624.103 1415.16 624.291 1415.99 624.291 1416.96V1428H619.987V1425.73H619.859C619.597 1426.24 619.245 1426.69 618.805 1427.08C618.364 1427.47 617.835 1427.77 617.217 1427.99C616.599 1428.2 615.886 1428.31 615.076 1428.31ZM616.376 1425.18C617.043 1425.18 617.633 1425.05 618.144 1424.78C618.655 1424.51 619.057 1424.15 619.348 1423.7C619.639 1423.24 619.785 1422.73 619.785 1422.15V1420.41C619.643 1420.51 619.447 1420.59 619.199 1420.67C618.957 1420.74 618.684 1420.81 618.378 1420.87C618.073 1420.93 617.768 1420.98 617.462 1421.03C617.157 1421.08 616.88 1421.11 616.631 1421.15C616.099 1421.23 615.633 1421.35 615.236 1421.52C614.838 1421.69 614.529 1421.92 614.309 1422.22C614.089 1422.5 613.979 1422.85 613.979 1423.28C613.979 1423.9 614.202 1424.37 614.65 1424.7C615.104 1425.02 615.68 1425.18 616.376 1425.18ZM627.812 1428V1411.64H632.137V1414.52H632.329C632.67 1413.56 633.238 1412.81 634.034 1412.25C634.829 1411.7 635.781 1411.42 636.889 1411.42C638.011 1411.42 638.966 1411.7 639.755 1412.26C640.543 1412.82 641.068 1413.57 641.331 1414.52H641.502C641.835 1413.59 642.439 1412.84 643.313 1412.28C644.193 1411.71 645.234 1411.42 646.434 1411.42C647.961 1411.42 649.201 1411.91 650.152 1412.88C651.111 1413.85 651.59 1415.22 651.59 1417V1428H647.063V1417.89C647.063 1416.98 646.821 1416.3 646.338 1415.84C645.855 1415.39 645.252 1415.16 644.527 1415.16C643.703 1415.16 643.061 1415.43 642.599 1415.95C642.137 1416.47 641.907 1417.15 641.907 1418.01V1428H637.507V1417.79C637.507 1416.99 637.276 1416.35 636.814 1415.88C636.36 1415.4 635.759 1415.16 635.014 1415.16C634.509 1415.16 634.055 1415.29 633.65 1415.55C633.252 1415.79 632.936 1416.15 632.702 1416.6C632.468 1417.05 632.35 1417.57 632.35 1418.18V1428H627.812ZM662.633 1428.32C660.949 1428.32 659.501 1427.98 658.286 1427.3C657.079 1426.61 656.148 1425.63 655.495 1424.38C654.842 1423.11 654.515 1421.62 654.515 1419.89C654.515 1418.21 654.842 1416.73 655.495 1415.46C656.148 1414.19 657.068 1413.2 658.254 1412.49C659.447 1411.78 660.847 1411.42 662.452 1411.42C663.531 1411.42 664.536 1411.6 665.467 1411.95C666.404 1412.29 667.221 1412.8 667.917 1413.49C668.62 1414.18 669.167 1415.05 669.557 1416.09C669.948 1417.13 670.143 1418.34 670.143 1419.73V1420.98H656.326V1418.17H665.871C665.871 1417.51 665.729 1416.93 665.445 1416.43C665.161 1415.93 664.767 1415.53 664.263 1415.25C663.766 1414.96 663.187 1414.81 662.526 1414.81C661.837 1414.81 661.226 1414.97 660.694 1415.29C660.168 1415.6 659.756 1416.03 659.458 1416.56C659.16 1417.08 659.007 1417.67 659 1418.32V1420.99C659 1421.8 659.149 1422.5 659.447 1423.09C659.753 1423.68 660.182 1424.13 660.736 1424.45C661.29 1424.77 661.947 1424.93 662.707 1424.93C663.212 1424.93 663.673 1424.86 664.092 1424.72C664.511 1424.58 664.87 1424.36 665.168 1424.08C665.467 1423.8 665.694 1423.45 665.85 1423.04L670.047 1423.31C669.834 1424.32 669.398 1425.2 668.737 1425.95C668.084 1426.7 667.239 1427.28 666.202 1427.7C665.172 1428.11 663.982 1428.32 662.633 1428.32ZM686.72 1416.3L682.565 1416.56C682.494 1416.2 682.342 1415.88 682.107 1415.6C681.873 1415.31 681.564 1415.08 681.18 1414.91C680.804 1414.73 680.353 1414.64 679.827 1414.64C679.124 1414.64 678.531 1414.79 678.048 1415.09C677.565 1415.38 677.324 1415.77 677.324 1416.26C677.324 1416.65 677.48 1416.98 677.793 1417.25C678.105 1417.52 678.641 1417.74 679.401 1417.9L682.363 1418.5C683.954 1418.82 685.14 1419.35 685.921 1420.07C686.702 1420.8 687.093 1421.75 687.093 1422.93C687.093 1424 686.777 1424.94 686.145 1425.75C685.52 1426.56 684.66 1427.19 683.567 1427.65C682.48 1428.1 681.226 1428.32 679.806 1428.32C677.64 1428.32 675.914 1427.87 674.628 1426.97C673.35 1426.06 672.601 1424.82 672.381 1423.26L676.844 1423.02C676.979 1423.69 677.306 1424.19 677.824 1424.54C678.343 1424.88 679.007 1425.05 679.817 1425.05C680.612 1425.05 681.251 1424.9 681.734 1424.59C682.224 1424.28 682.473 1423.88 682.48 1423.39C682.473 1422.98 682.299 1422.64 681.958 1422.38C681.617 1422.11 681.092 1421.9 680.381 1421.76L677.547 1421.19C675.949 1420.87 674.76 1420.32 673.979 1419.53C673.204 1418.74 672.817 1417.74 672.817 1416.52C672.817 1415.46 673.101 1414.56 673.67 1413.8C674.245 1413.04 675.051 1412.45 676.088 1412.04C677.132 1411.63 678.354 1411.42 679.753 1411.42C681.82 1411.42 683.446 1411.86 684.632 1412.73C685.825 1413.61 686.521 1414.8 686.72 1416.3ZM689.951 1434.14V1411.64H694.425V1414.38H694.628C694.826 1413.94 695.114 1413.5 695.491 1413.04C695.874 1412.58 696.371 1412.2 696.982 1411.89C697.6 1411.58 698.367 1411.42 699.283 1411.42C700.476 1411.42 701.577 1411.74 702.586 1412.36C703.594 1412.98 704.4 1413.91 705.004 1415.16C705.608 1416.41 705.91 1417.96 705.91 1419.84C705.91 1421.66 705.615 1423.21 705.025 1424.46C704.443 1425.71 703.647 1426.66 702.639 1427.31C701.638 1427.95 700.515 1428.27 699.272 1428.27C698.392 1428.27 697.642 1428.12 697.025 1427.83C696.414 1427.54 695.913 1427.17 695.522 1426.73C695.132 1426.28 694.834 1425.83 694.628 1425.38H694.489V1434.14H689.951ZM694.393 1419.82C694.393 1420.79 694.528 1421.64 694.798 1422.36C695.068 1423.09 695.459 1423.65 695.97 1424.06C696.481 1424.46 697.103 1424.65 697.834 1424.65C698.573 1424.65 699.198 1424.45 699.709 1424.05C700.221 1423.64 700.608 1423.07 700.87 1422.34C701.14 1421.61 701.275 1420.77 701.275 1419.82C701.275 1418.87 701.144 1418.04 700.881 1417.33C700.618 1416.61 700.231 1416.05 699.72 1415.64C699.209 1415.24 698.58 1415.03 697.834 1415.03C697.096 1415.03 696.471 1415.23 695.959 1415.62C695.455 1416.01 695.068 1416.57 694.798 1417.28C694.528 1418 694.393 1418.85 694.393 1419.82ZM713.601 1428.31C712.557 1428.31 711.627 1428.13 710.81 1427.77C709.993 1427.4 709.347 1426.85 708.871 1426.14C708.402 1425.41 708.168 1424.51 708.168 1423.43C708.168 1422.52 708.335 1421.76 708.669 1421.14C709.003 1420.52 709.457 1420.02 710.032 1419.65C710.608 1419.27 711.261 1418.99 711.993 1418.8C712.731 1418.6 713.505 1418.47 714.315 1418.39C715.267 1418.29 716.034 1418.2 716.616 1418.11C717.199 1418.02 717.621 1417.89 717.884 1417.71C718.147 1417.53 718.278 1417.27 718.278 1416.92V1416.86C718.278 1416.18 718.065 1415.66 717.639 1415.29C717.22 1414.92 716.623 1414.74 715.849 1414.74C715.032 1414.74 714.383 1414.92 713.9 1415.28C713.417 1415.63 713.097 1416.08 712.941 1416.62L708.743 1416.28C708.956 1415.29 709.375 1414.43 710 1413.7C710.625 1412.97 711.432 1412.41 712.419 1412.02C713.413 1411.62 714.564 1411.42 715.87 1411.42C716.78 1411.42 717.65 1411.53 718.481 1411.74C719.319 1411.96 720.061 1412.29 720.707 1412.73C721.361 1413.18 721.875 1413.76 722.252 1414.46C722.628 1415.16 722.816 1415.99 722.816 1416.96V1428H718.513V1425.73H718.385C718.122 1426.24 717.77 1426.69 717.33 1427.08C716.89 1427.47 716.361 1427.77 715.743 1427.99C715.125 1428.2 714.411 1428.31 713.601 1428.31ZM714.901 1425.18C715.569 1425.18 716.158 1425.05 716.669 1424.78C717.181 1424.51 717.582 1424.15 717.873 1423.7C718.165 1423.24 718.31 1422.73 718.31 1422.15V1420.41C718.168 1420.51 717.973 1420.59 717.724 1420.67C717.483 1420.74 717.209 1420.81 716.904 1420.87C716.598 1420.93 716.293 1420.98 715.988 1421.03C715.682 1421.08 715.405 1421.11 715.157 1421.15C714.624 1421.23 714.159 1421.35 713.761 1421.52C713.363 1421.69 713.054 1421.92 712.834 1422.22C712.614 1422.5 712.504 1422.85 712.504 1423.28C712.504 1423.9 712.728 1424.37 713.175 1424.7C713.63 1425.02 714.205 1425.18 714.901 1425.18ZM733.731 1428.32C732.055 1428.32 730.613 1427.96 729.406 1427.25C728.205 1426.54 727.282 1425.54 726.636 1424.27C725.997 1423 725.677 1421.54 725.677 1419.88C725.677 1418.21 726 1416.74 726.646 1415.47C727.3 1414.2 728.227 1413.21 729.427 1412.5C730.627 1411.78 732.055 1411.42 733.71 1411.42C735.137 1411.42 736.387 1411.68 737.46 1412.2C738.532 1412.72 739.381 1413.45 740.006 1414.38C740.631 1415.32 740.975 1416.42 741.039 1417.69H736.756C736.636 1416.87 736.316 1416.21 735.798 1415.72C735.286 1415.21 734.615 1414.96 733.784 1414.96C733.081 1414.96 732.467 1415.15 731.941 1415.54C731.423 1415.91 731.018 1416.46 730.727 1417.19C730.435 1417.91 730.29 1418.79 730.29 1419.82C730.29 1420.86 730.432 1421.75 730.716 1422.48C731.007 1423.21 731.416 1423.77 731.941 1424.15C732.467 1424.54 733.081 1424.73 733.784 1424.73C734.303 1424.73 734.768 1424.62 735.18 1424.41C735.599 1424.2 735.943 1423.89 736.213 1423.48C736.49 1423.07 736.671 1422.58 736.756 1422H741.039C740.968 1423.25 740.627 1424.35 740.016 1425.3C739.413 1426.25 738.578 1426.99 737.513 1427.52C736.448 1428.05 735.187 1428.32 733.731 1428.32ZM751.402 1428.32C749.719 1428.32 748.27 1427.98 747.056 1427.3C745.848 1426.61 744.918 1425.63 744.264 1424.38C743.611 1423.11 743.284 1421.62 743.284 1419.89C743.284 1418.21 743.611 1416.73 744.264 1415.46C744.918 1414.19 745.838 1413.2 747.024 1412.49C748.217 1411.78 749.616 1411.42 751.221 1411.42C752.301 1411.42 753.306 1411.6 754.236 1411.95C755.174 1412.29 755.99 1412.8 756.686 1413.49C757.389 1414.18 757.936 1415.05 758.327 1416.09C758.718 1417.13 758.913 1418.34 758.913 1419.73V1420.98H745.095V1418.17H754.641C754.641 1417.51 754.499 1416.93 754.215 1416.43C753.931 1415.93 753.536 1415.53 753.032 1415.25C752.535 1414.96 751.956 1414.81 751.296 1414.81C750.607 1414.81 749.996 1414.97 749.463 1415.29C748.938 1415.6 748.526 1416.03 748.228 1416.56C747.929 1417.08 747.777 1417.67 747.769 1418.32V1420.99C747.769 1421.8 747.919 1422.5 748.217 1423.09C748.522 1423.68 748.952 1424.13 749.506 1424.45C750.06 1424.77 750.717 1424.93 751.477 1424.93C751.981 1424.93 752.443 1424.86 752.862 1424.72C753.281 1424.58 753.639 1424.36 753.938 1424.08C754.236 1423.8 754.463 1423.45 754.62 1423.04L758.817 1423.31C758.604 1424.32 758.167 1425.2 757.507 1425.95C756.853 1426.7 756.008 1427.28 754.971 1427.7C753.941 1428.11 752.752 1428.32 751.402 1428.32Z" fill="#03031C"/>
+<path d="M740.207 531.793C739.817 531.402 739.183 531.402 738.793 531.793L732.429 538.157C732.038 538.547 732.038 539.181 732.429 539.571C732.819 539.962 733.453 539.962 733.843 539.571L739.5 533.914L745.157 539.571C745.547 539.962 746.181 539.962 746.571 539.571C746.962 539.181 746.962 538.547 746.571 538.157L740.207 531.793ZM739.5 601.5H738.5V602.5H739.5V601.5ZM809.5 601.5H810.5V600.5H809.5V601.5ZM738.5 532.5V538.25H740.5V532.5H738.5ZM738.5 549.75V561.25H740.5V549.75H738.5ZM738.5 572.75V584.25H740.5V572.75H738.5ZM738.5 595.75V601.5H740.5V595.75H738.5ZM739.5 602.5H743.875V600.5H739.5V602.5ZM752.625 602.5H761.375V600.5H752.625V602.5ZM770.125 602.5H778.875V600.5H770.125V602.5ZM787.625 602.5H796.375V600.5H787.625V602.5ZM805.125 602.5H809.5V600.5H805.125V602.5ZM808.5 601.5V606.365H810.5V601.5H808.5ZM808.5 616.096V625.827H810.5V616.096H808.5ZM808.5 635.558V645.288H810.5V635.558H808.5ZM808.5 655.019V664.75H810.5V655.019H808.5ZM808.5 674.481V684.212H810.5V674.481H808.5ZM808.5 693.942V703.673H810.5V693.942H808.5ZM808.5 713.404V723.135H810.5V713.404H808.5ZM808.5 732.865V742.596H810.5V732.865H808.5ZM808.5 752.327V762.058H810.5V752.327H808.5ZM808.5 771.788V781.519H810.5V771.788H808.5ZM808.5 791.25V800.981H810.5V791.25H808.5ZM808.5 810.712V820.442H810.5V810.712H808.5ZM808.5 830.173V839.904H810.5V830.173H808.5ZM808.5 849.635V854.5H810.5V849.635H808.5Z" fill="#03031C"/>
+<path d="M969.293 531.793C969.683 531.402 970.317 531.402 970.707 531.793L977.071 538.157C977.462 538.547 977.462 539.181 977.071 539.571C976.681 539.962 976.047 539.962 975.657 539.571L970 533.914L964.343 539.571C963.953 539.962 963.319 539.962 962.929 539.571C962.538 539.181 962.538 538.547 962.929 538.157L969.293 531.793ZM970 601.5H971V602.5H970V601.5ZM900 601.5H899V600.5H900V601.5ZM971 532.5V538.25H969V532.5H971ZM971 549.75V561.25H969V549.75H971ZM971 572.75V584.25H969V572.75H971ZM971 595.75V601.5H969V595.75H971ZM970 602.5H965.625V600.5H970V602.5ZM956.875 602.5H948.125V600.5H956.875V602.5ZM939.375 602.5H930.625V600.5H939.375V602.5ZM921.875 602.5H913.125V600.5H921.875V602.5ZM904.375 602.5H900V600.5H904.375V602.5ZM901 601.5V606.365H899V601.5H901ZM901 616.096V625.827H899V616.096H901ZM901 635.558V645.288H899V635.558H901ZM901 655.019V664.75H899V655.019H901ZM901 674.481V684.212H899V674.481H901ZM901 693.942V703.673H899V693.942H901ZM901 713.404V723.135H899V713.404H901ZM901 732.865V742.596H899V732.865H901ZM901 752.327V762.058H899V752.327H901ZM901 771.788V781.519H899V771.788H901ZM901 791.25V800.981H899V791.25H901ZM901 810.712V820.442H899V810.712H901ZM901 830.173V839.904H899V830.173H901ZM901 849.635V854.5H899V849.635H901Z" fill="#03031C"/>
+<g filter="url(#filter14_bd_12_480)">
+<rect x="560" y="1280" width="109" height="89" rx="10" fill="#5900CB"/>
+<rect x="560.5" y="1280.5" width="108" height="88" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M599.288 1317.32C598.424 1317.32 597.64 1317.16 596.935 1316.83C596.231 1316.5 595.672 1316.02 595.257 1315.4C594.843 1314.77 594.636 1314.02 594.636 1313.13C594.636 1312.35 594.79 1311.71 595.097 1311.23C595.405 1310.74 595.817 1310.35 596.331 1310.08C596.846 1309.8 597.415 1309.59 598.036 1309.45C598.663 1309.31 599.294 1309.2 599.927 1309.12C600.756 1309.01 601.427 1308.93 601.942 1308.88C602.463 1308.82 602.842 1308.72 603.079 1308.58C603.321 1308.45 603.443 1308.21 603.443 1307.87V1307.8C603.443 1306.93 603.203 1306.25 602.724 1305.76C602.25 1305.28 601.531 1305.03 600.566 1305.03C599.566 1305.03 598.782 1305.25 598.214 1305.69C597.645 1306.13 597.246 1306.6 597.015 1307.09L595.026 1306.38C595.382 1305.55 595.855 1304.91 596.447 1304.45C597.045 1303.98 597.696 1303.65 598.4 1303.47C599.11 1303.28 599.809 1303.19 600.495 1303.19C600.933 1303.19 601.436 1303.24 602.004 1303.35C602.579 1303.45 603.132 1303.66 603.665 1303.98C604.203 1304.3 604.65 1304.78 605.005 1305.42C605.36 1306.07 605.538 1306.93 605.538 1308.02V1317H603.443V1315.15H603.336C603.194 1315.45 602.957 1315.77 602.626 1316.1C602.294 1316.44 601.854 1316.73 601.303 1316.96C600.753 1317.2 600.081 1317.32 599.288 1317.32ZM599.607 1315.44C600.436 1315.44 601.134 1315.27 601.703 1314.95C602.277 1314.62 602.709 1314.2 602.999 1313.69C603.295 1313.17 603.443 1312.63 603.443 1312.06V1310.15C603.354 1310.25 603.159 1310.35 602.857 1310.44C602.561 1310.52 602.218 1310.6 601.827 1310.66C601.442 1310.72 601.066 1310.77 600.699 1310.82C600.338 1310.86 600.045 1310.9 599.82 1310.93C599.276 1311 598.767 1311.11 598.294 1311.27C597.826 1311.43 597.447 1311.66 597.157 1311.98C596.873 1312.28 596.731 1312.7 596.731 1313.24C596.731 1313.96 597 1314.51 597.539 1314.89C598.083 1315.25 598.773 1315.44 599.607 1315.44ZM609.362 1322.11V1303.36H611.386V1305.53H611.635C611.789 1305.29 612.002 1304.99 612.274 1304.62C612.552 1304.25 612.949 1303.92 613.464 1303.63C613.984 1303.33 614.689 1303.19 615.576 1303.19C616.725 1303.19 617.737 1303.47 618.613 1304.05C619.489 1304.62 620.172 1305.44 620.663 1306.49C621.155 1307.54 621.4 1308.79 621.4 1310.22C621.4 1311.66 621.155 1312.91 620.663 1313.97C620.172 1315.03 619.492 1315.84 618.622 1316.42C617.752 1317 616.748 1317.28 615.612 1317.28C614.736 1317.28 614.035 1317.14 613.508 1316.85C612.981 1316.55 612.576 1316.22 612.292 1315.85C612.008 1315.47 611.789 1315.15 611.635 1314.9H611.457V1322.11H609.362ZM611.422 1310.18C611.422 1311.21 611.573 1312.12 611.874 1312.91C612.176 1313.69 612.617 1314.3 613.197 1314.75C613.777 1315.18 614.487 1315.4 615.328 1315.4C616.204 1315.4 616.935 1315.17 617.521 1314.71C618.113 1314.24 618.556 1313.61 618.852 1312.83C619.154 1312.03 619.305 1311.15 619.305 1310.18C619.305 1309.22 619.157 1308.36 618.861 1307.59C618.571 1306.81 618.13 1306.2 617.538 1305.75C616.953 1305.3 616.216 1305.07 615.328 1305.07C614.476 1305.07 613.759 1305.28 613.179 1305.72C612.599 1306.14 612.161 1306.74 611.866 1307.51C611.57 1308.27 611.422 1309.16 611.422 1310.18ZM624.596 1317V1303.36H626.691V1317H624.596ZM625.662 1301.09C625.253 1301.09 624.901 1300.95 624.605 1300.67C624.315 1300.4 624.17 1300.06 624.17 1299.67C624.17 1299.28 624.315 1298.95 624.605 1298.67C624.901 1298.39 625.253 1298.25 625.662 1298.25C626.07 1298.25 626.419 1298.39 626.709 1298.67C627.005 1298.95 627.153 1299.28 627.153 1299.67C627.153 1300.06 627.005 1300.4 626.709 1300.67C626.419 1300.95 626.07 1301.09 625.662 1301.09ZM605.258 1339.5H603.056C602.926 1338.87 602.698 1338.31 602.373 1337.83C602.053 1337.35 601.663 1336.95 601.201 1336.62C600.745 1336.29 600.239 1336.04 599.683 1335.88C599.127 1335.71 598.547 1335.63 597.943 1335.63C596.842 1335.63 595.845 1335.91 594.951 1336.46C594.063 1337.02 593.356 1337.84 592.829 1338.92C592.308 1340.01 592.048 1341.33 592.048 1342.91C592.048 1344.48 592.308 1345.81 592.829 1346.9C593.356 1347.98 594.063 1348.8 594.951 1349.35C595.845 1349.91 596.842 1350.19 597.943 1350.19C598.547 1350.19 599.127 1350.11 599.683 1349.94C600.239 1349.77 600.745 1349.53 601.201 1349.2C601.663 1348.87 602.053 1348.47 602.373 1347.99C602.698 1347.5 602.926 1346.95 603.056 1346.32H605.258C605.092 1347.25 604.791 1348.08 604.353 1348.81C603.915 1349.55 603.37 1350.17 602.719 1350.69C602.068 1351.2 601.337 1351.58 600.526 1351.85C599.721 1352.12 598.86 1352.25 597.943 1352.25C596.392 1352.25 595.013 1351.87 593.806 1351.11C592.598 1350.35 591.648 1349.28 590.956 1347.88C590.263 1346.48 589.917 1344.83 589.917 1342.91C589.917 1340.99 590.263 1339.33 590.956 1337.94C591.648 1336.54 592.598 1335.46 593.806 1334.71C595.013 1333.95 596.392 1333.57 597.943 1333.57C598.86 1333.57 599.721 1333.7 600.526 1333.97C601.337 1334.24 602.068 1334.63 602.719 1335.14C603.37 1335.65 603.915 1336.27 604.353 1337.01C604.791 1337.73 605.092 1338.56 605.258 1339.5ZM608.816 1352V1333.82H614.959C616.38 1333.82 617.546 1334.06 618.457 1334.55C619.369 1335.03 620.043 1335.69 620.481 1336.53C620.919 1337.37 621.138 1338.32 621.138 1339.39C621.138 1340.46 620.919 1341.41 620.481 1342.24C620.043 1343.07 619.372 1343.72 618.466 1344.2C617.561 1344.66 616.404 1344.9 614.995 1344.9H610.023V1342.91H614.924C615.895 1342.91 616.676 1342.77 617.268 1342.48C617.865 1342.2 618.297 1341.8 618.564 1341.28C618.836 1340.75 618.972 1340.12 618.972 1339.39C618.972 1338.67 618.836 1338.03 618.564 1337.48C618.292 1336.94 617.857 1336.52 617.259 1336.22C616.661 1335.92 615.871 1335.77 614.888 1335.77H611.018V1352H608.816ZM617.374 1343.83L621.849 1352H619.292L614.888 1343.83H617.374ZM630.418 1352H624.807V1333.82H630.667C632.43 1333.82 633.94 1334.18 635.194 1334.91C636.449 1335.63 637.411 1336.67 638.08 1338.03C638.748 1339.38 639.083 1340.99 639.083 1342.87C639.083 1344.77 638.745 1346.4 638.071 1347.77C637.396 1349.13 636.413 1350.17 635.123 1350.91C633.833 1351.64 632.265 1352 630.418 1352ZM627.009 1350.05H630.276C631.779 1350.05 633.025 1349.76 634.013 1349.18C635.002 1348.6 635.739 1347.77 636.224 1346.7C636.709 1345.63 636.952 1344.35 636.952 1342.87C636.952 1341.41 636.712 1340.14 636.233 1339.08C635.754 1338.02 635.037 1337.2 634.085 1336.63C633.132 1336.06 631.945 1335.77 630.525 1335.77H627.009V1350.05Z" fill="white"/>
+<g filter="url(#filter15_bd_12_480)">
+<rect x="681" y="1280" width="109" height="89" rx="10" fill="#5900CB"/>
+<rect x="681.5" y="1280.5" width="108" height="88" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M720.288 1317.32C719.424 1317.32 718.64 1317.16 717.935 1316.83C717.231 1316.5 716.672 1316.02 716.257 1315.4C715.843 1314.77 715.636 1314.02 715.636 1313.13C715.636 1312.35 715.79 1311.71 716.097 1311.23C716.405 1310.74 716.817 1310.35 717.331 1310.08C717.846 1309.8 718.415 1309.59 719.036 1309.45C719.663 1309.31 720.294 1309.2 720.927 1309.12C721.756 1309.01 722.427 1308.93 722.942 1308.88C723.463 1308.82 723.842 1308.72 724.079 1308.58C724.321 1308.45 724.443 1308.21 724.443 1307.87V1307.8C724.443 1306.93 724.203 1306.25 723.724 1305.76C723.25 1305.28 722.531 1305.03 721.566 1305.03C720.566 1305.03 719.782 1305.25 719.214 1305.69C718.645 1306.13 718.246 1306.6 718.015 1307.09L716.026 1306.38C716.382 1305.55 716.855 1304.91 717.447 1304.45C718.045 1303.98 718.696 1303.65 719.4 1303.47C720.11 1303.28 720.809 1303.19 721.495 1303.19C721.933 1303.19 722.436 1303.24 723.004 1303.35C723.579 1303.45 724.132 1303.66 724.665 1303.98C725.203 1304.3 725.65 1304.78 726.005 1305.42C726.36 1306.07 726.538 1306.93 726.538 1308.02V1317H724.443V1315.15H724.336C724.194 1315.45 723.957 1315.77 723.626 1316.1C723.294 1316.44 722.854 1316.73 722.303 1316.96C721.753 1317.2 721.081 1317.32 720.288 1317.32ZM720.607 1315.44C721.436 1315.44 722.134 1315.27 722.703 1314.95C723.277 1314.62 723.709 1314.2 723.999 1313.69C724.295 1313.17 724.443 1312.63 724.443 1312.06V1310.15C724.354 1310.25 724.159 1310.35 723.857 1310.44C723.561 1310.52 723.218 1310.6 722.827 1310.66C722.442 1310.72 722.066 1310.77 721.699 1310.82C721.338 1310.86 721.045 1310.9 720.82 1310.93C720.276 1311 719.767 1311.11 719.294 1311.27C718.826 1311.43 718.447 1311.66 718.157 1311.98C717.873 1312.28 717.731 1312.7 717.731 1313.24C717.731 1313.96 718 1314.51 718.539 1314.89C719.083 1315.25 719.773 1315.44 720.607 1315.44ZM730.362 1322.11V1303.36H732.386V1305.53H732.635C732.789 1305.29 733.002 1304.99 733.274 1304.62C733.552 1304.25 733.949 1303.92 734.464 1303.63C734.984 1303.33 735.689 1303.19 736.576 1303.19C737.725 1303.19 738.737 1303.47 739.613 1304.05C740.489 1304.62 741.172 1305.44 741.663 1306.49C742.155 1307.54 742.4 1308.79 742.4 1310.22C742.4 1311.66 742.155 1312.91 741.663 1313.97C741.172 1315.03 740.492 1315.84 739.622 1316.42C738.752 1317 737.748 1317.28 736.612 1317.28C735.736 1317.28 735.035 1317.14 734.508 1316.85C733.981 1316.55 733.576 1316.22 733.292 1315.85C733.008 1315.47 732.789 1315.15 732.635 1314.9H732.457V1322.11H730.362ZM732.422 1310.18C732.422 1311.21 732.573 1312.12 732.874 1312.91C733.176 1313.69 733.617 1314.3 734.197 1314.75C734.777 1315.18 735.487 1315.4 736.328 1315.4C737.204 1315.4 737.935 1315.17 738.521 1314.71C739.113 1314.24 739.556 1313.61 739.852 1312.83C740.154 1312.03 740.305 1311.15 740.305 1310.18C740.305 1309.22 740.157 1308.36 739.861 1307.59C739.571 1306.81 739.13 1306.2 738.538 1305.75C737.953 1305.3 737.216 1305.07 736.328 1305.07C735.476 1305.07 734.759 1305.28 734.179 1305.72C733.599 1306.14 733.161 1306.74 732.866 1307.51C732.57 1308.27 732.422 1309.16 732.422 1310.18ZM745.596 1317V1303.36H747.691V1317H745.596ZM746.662 1301.09C746.253 1301.09 745.901 1300.95 745.605 1300.67C745.315 1300.4 745.17 1300.06 745.17 1299.67C745.17 1299.28 745.315 1298.95 745.605 1298.67C745.901 1298.39 746.253 1298.25 746.662 1298.25C747.07 1298.25 747.419 1298.39 747.709 1298.67C748.005 1298.95 748.153 1299.28 748.153 1299.67C748.153 1300.06 748.005 1300.4 747.709 1300.67C747.419 1300.95 747.07 1301.09 746.662 1301.09ZM726.258 1339.5H724.056C723.926 1338.87 723.698 1338.31 723.373 1337.83C723.053 1337.35 722.663 1336.95 722.201 1336.62C721.745 1336.29 721.239 1336.04 720.683 1335.88C720.127 1335.71 719.547 1335.63 718.943 1335.63C717.842 1335.63 716.845 1335.91 715.951 1336.46C715.063 1337.02 714.356 1337.84 713.829 1338.92C713.308 1340.01 713.048 1341.33 713.048 1342.91C713.048 1344.48 713.308 1345.81 713.829 1346.9C714.356 1347.98 715.063 1348.8 715.951 1349.35C716.845 1349.91 717.842 1350.19 718.943 1350.19C719.547 1350.19 720.127 1350.11 720.683 1349.94C721.239 1349.77 721.745 1349.53 722.201 1349.2C722.663 1348.87 723.053 1348.47 723.373 1347.99C723.698 1347.5 723.926 1346.95 724.056 1346.32H726.258C726.092 1347.25 725.791 1348.08 725.353 1348.81C724.915 1349.55 724.37 1350.17 723.719 1350.69C723.068 1351.2 722.337 1351.58 721.526 1351.85C720.721 1352.12 719.86 1352.25 718.943 1352.25C717.392 1352.25 716.013 1351.87 714.806 1351.11C713.598 1350.35 712.648 1349.28 711.956 1347.88C711.263 1346.48 710.917 1344.83 710.917 1342.91C710.917 1340.99 711.263 1339.33 711.956 1337.94C712.648 1336.54 713.598 1335.46 714.806 1334.71C716.013 1333.95 717.392 1333.57 718.943 1333.57C719.86 1333.57 720.721 1333.7 721.526 1333.97C722.337 1334.24 723.068 1334.63 723.719 1335.14C724.37 1335.65 724.915 1336.27 725.353 1337.01C725.791 1337.73 726.092 1338.56 726.258 1339.5ZM729.816 1352V1333.82H735.959C737.38 1333.82 738.546 1334.06 739.457 1334.55C740.369 1335.03 741.043 1335.69 741.481 1336.53C741.919 1337.37 742.138 1338.32 742.138 1339.39C742.138 1340.46 741.919 1341.41 741.481 1342.24C741.043 1343.07 740.372 1343.72 739.466 1344.2C738.561 1344.66 737.404 1344.9 735.995 1344.9H731.023V1342.91H735.924C736.895 1342.91 737.676 1342.77 738.268 1342.48C738.865 1342.2 739.297 1341.8 739.564 1341.28C739.836 1340.75 739.972 1340.12 739.972 1339.39C739.972 1338.67 739.836 1338.03 739.564 1337.48C739.292 1336.94 738.857 1336.52 738.259 1336.22C737.661 1335.92 736.871 1335.77 735.888 1335.77H732.018V1352H729.816ZM738.374 1343.83L742.849 1352H740.292L735.888 1343.83H738.374ZM751.418 1352H745.807V1333.82H751.667C753.43 1333.82 754.94 1334.18 756.194 1334.91C757.449 1335.63 758.411 1336.67 759.08 1338.03C759.748 1339.38 760.083 1340.99 760.083 1342.87C760.083 1344.77 759.745 1346.4 759.071 1347.77C758.396 1349.13 757.413 1350.17 756.123 1350.91C754.833 1351.64 753.265 1352 751.418 1352ZM748.009 1350.05H751.276C752.779 1350.05 754.025 1349.76 755.013 1349.18C756.002 1348.6 756.739 1347.77 757.224 1346.7C757.709 1345.63 757.952 1344.35 757.952 1342.87C757.952 1341.41 757.712 1340.14 757.233 1339.08C756.754 1338.02 756.037 1337.2 755.085 1336.63C754.132 1336.06 752.945 1335.77 751.525 1335.77H748.009V1350.05Z" fill="white"/>
+<g filter="url(#filter16_bd_12_480)">
+<rect x="892" y="1251.5" width="286" height="221" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="892.5" y="1252" width="285" height="220" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M956.286 1419.04V1428.5H951.748V1412.14H956.073V1415.02H956.265C956.627 1414.07 957.234 1413.32 958.086 1412.76C958.939 1412.2 959.972 1411.92 961.187 1411.92C962.323 1411.92 963.314 1412.17 964.159 1412.67C965.004 1413.17 965.661 1413.88 966.13 1414.8C966.598 1415.72 966.833 1416.81 966.833 1418.08V1428.5H962.294V1418.89C962.302 1417.89 962.046 1417.11 961.527 1416.55C961.009 1415.98 960.295 1415.69 959.386 1415.69C958.775 1415.69 958.236 1415.83 957.767 1416.09C957.305 1416.35 956.943 1416.74 956.68 1417.24C956.424 1417.74 956.293 1418.34 956.286 1419.04ZM975.076 1428.81C974.032 1428.81 973.101 1428.63 972.285 1428.27C971.468 1427.9 970.822 1427.35 970.346 1426.64C969.877 1425.91 969.643 1425.01 969.643 1423.93C969.643 1423.02 969.81 1422.26 970.143 1421.64C970.477 1421.02 970.932 1420.52 971.507 1420.15C972.082 1419.77 972.736 1419.49 973.467 1419.3C974.206 1419.1 974.98 1418.97 975.79 1418.89C976.741 1418.79 977.508 1418.7 978.091 1418.61C978.673 1418.52 979.096 1418.39 979.359 1418.21C979.621 1418.03 979.753 1417.77 979.753 1417.42V1417.36C979.753 1416.68 979.54 1416.16 979.114 1415.79C978.695 1415.42 978.098 1415.24 977.324 1415.24C976.507 1415.24 975.857 1415.42 975.374 1415.78C974.891 1416.13 974.572 1416.58 974.415 1417.12L970.218 1416.78C970.431 1415.79 970.85 1414.93 971.475 1414.2C972.1 1413.47 972.906 1412.91 973.893 1412.52C974.888 1412.12 976.038 1411.92 977.345 1411.92C978.254 1411.92 979.124 1412.03 979.955 1412.24C980.793 1412.46 981.535 1412.79 982.182 1413.23C982.835 1413.68 983.35 1414.26 983.726 1414.96C984.103 1415.66 984.291 1416.49 984.291 1417.46V1428.5H979.987V1426.23H979.859C979.597 1426.74 979.245 1427.19 978.805 1427.58C978.364 1427.97 977.835 1428.27 977.217 1428.49C976.599 1428.7 975.886 1428.81 975.076 1428.81ZM976.376 1425.68C977.043 1425.68 977.633 1425.55 978.144 1425.28C978.655 1425.01 979.057 1424.65 979.348 1424.2C979.639 1423.74 979.785 1423.23 979.785 1422.65V1420.91C979.643 1421.01 979.447 1421.09 979.199 1421.17C978.957 1421.24 978.684 1421.31 978.378 1421.37C978.073 1421.43 977.768 1421.48 977.462 1421.53C977.157 1421.58 976.88 1421.61 976.631 1421.65C976.099 1421.73 975.633 1421.85 975.236 1422.02C974.838 1422.19 974.529 1422.42 974.309 1422.72C974.089 1423 973.979 1423.35 973.979 1423.78C973.979 1424.4 974.202 1424.87 974.65 1425.2C975.104 1425.52 975.68 1425.68 976.376 1425.68ZM987.812 1428.5V1412.14H992.137V1415.02H992.329C992.67 1414.06 993.238 1413.31 994.034 1412.75C994.829 1412.2 995.781 1411.92 996.889 1411.92C998.011 1411.92 998.966 1412.2 999.755 1412.76C1000.54 1413.32 1001.07 1414.07 1001.33 1415.02H1001.5C1001.84 1414.09 1002.44 1413.34 1003.31 1412.78C1004.19 1412.21 1005.23 1411.92 1006.43 1411.92C1007.96 1411.92 1009.2 1412.41 1010.15 1413.38C1011.11 1414.35 1011.59 1415.72 1011.59 1417.5V1428.5H1007.06V1418.39C1007.06 1417.48 1006.82 1416.8 1006.34 1416.34C1005.86 1415.89 1005.25 1415.66 1004.53 1415.66C1003.7 1415.66 1003.06 1415.93 1002.6 1416.45C1002.14 1416.97 1001.91 1417.65 1001.91 1418.51V1428.5H997.507V1418.29C997.507 1417.49 997.276 1416.85 996.814 1416.38C996.36 1415.9 995.759 1415.66 995.014 1415.66C994.509 1415.66 994.055 1415.79 993.65 1416.05C993.252 1416.29 992.936 1416.65 992.702 1417.1C992.468 1417.55 992.35 1418.07 992.35 1418.68V1428.5H987.812ZM1022.63 1428.82C1020.95 1428.82 1019.5 1428.48 1018.29 1427.8C1017.08 1427.11 1016.15 1426.13 1015.49 1424.88C1014.84 1423.61 1014.51 1422.12 1014.51 1420.39C1014.51 1418.71 1014.84 1417.23 1015.49 1415.96C1016.15 1414.69 1017.07 1413.7 1018.25 1412.99C1019.45 1412.28 1020.85 1411.92 1022.45 1411.92C1023.53 1411.92 1024.54 1412.1 1025.47 1412.45C1026.4 1412.79 1027.22 1413.3 1027.92 1413.99C1028.62 1414.68 1029.17 1415.55 1029.56 1416.59C1029.95 1417.63 1030.14 1418.84 1030.14 1420.23V1421.48H1016.33V1418.67H1025.87C1025.87 1418.01 1025.73 1417.43 1025.45 1416.93C1025.16 1416.43 1024.77 1416.03 1024.26 1415.75C1023.77 1415.46 1023.19 1415.31 1022.53 1415.31C1021.84 1415.31 1021.23 1415.47 1020.69 1415.79C1020.17 1416.1 1019.76 1416.53 1019.46 1417.06C1019.16 1417.58 1019.01 1418.17 1019 1418.82V1421.49C1019 1422.3 1019.15 1423 1019.45 1423.59C1019.75 1424.18 1020.18 1424.63 1020.74 1424.95C1021.29 1425.27 1021.95 1425.43 1022.71 1425.43C1023.21 1425.43 1023.67 1425.36 1024.09 1425.22C1024.51 1425.08 1024.87 1424.86 1025.17 1424.58C1025.47 1424.3 1025.69 1423.95 1025.85 1423.54L1030.05 1423.81C1029.83 1424.82 1029.4 1425.7 1028.74 1426.45C1028.08 1427.2 1027.24 1427.78 1026.2 1428.2C1025.17 1428.61 1023.98 1428.82 1022.63 1428.82ZM1046.72 1416.8L1042.57 1417.06C1042.49 1416.7 1042.34 1416.38 1042.11 1416.1C1041.87 1415.81 1041.56 1415.58 1041.18 1415.41C1040.8 1415.23 1040.35 1415.14 1039.83 1415.14C1039.12 1415.14 1038.53 1415.29 1038.05 1415.59C1037.57 1415.88 1037.32 1416.27 1037.32 1416.76C1037.32 1417.15 1037.48 1417.48 1037.79 1417.75C1038.11 1418.02 1038.64 1418.24 1039.4 1418.4L1042.36 1419C1043.95 1419.32 1045.14 1419.85 1045.92 1420.57C1046.7 1421.3 1047.09 1422.25 1047.09 1423.43C1047.09 1424.5 1046.78 1425.44 1046.14 1426.25C1045.52 1427.06 1044.66 1427.69 1043.57 1428.15C1042.48 1428.6 1041.23 1428.82 1039.81 1428.82C1037.64 1428.82 1035.91 1428.37 1034.63 1427.47C1033.35 1426.56 1032.6 1425.32 1032.38 1423.76L1036.84 1423.52C1036.98 1424.19 1037.31 1424.69 1037.82 1425.04C1038.34 1425.38 1039.01 1425.55 1039.82 1425.55C1040.61 1425.55 1041.25 1425.4 1041.73 1425.09C1042.22 1424.78 1042.47 1424.38 1042.48 1423.89C1042.47 1423.48 1042.3 1423.14 1041.96 1422.88C1041.62 1422.61 1041.09 1422.4 1040.38 1422.26L1037.55 1421.69C1035.95 1421.37 1034.76 1420.82 1033.98 1420.03C1033.2 1419.24 1032.82 1418.24 1032.82 1417.02C1032.82 1415.96 1033.1 1415.06 1033.67 1414.3C1034.24 1413.54 1035.05 1412.95 1036.09 1412.54C1037.13 1412.13 1038.35 1411.92 1039.75 1411.92C1041.82 1411.92 1043.45 1412.36 1044.63 1413.23C1045.83 1414.11 1046.52 1415.3 1046.72 1416.8ZM1049.95 1434.64V1412.14H1054.43V1414.88H1054.63C1054.83 1414.44 1055.11 1414 1055.49 1413.54C1055.87 1413.08 1056.37 1412.7 1056.98 1412.39C1057.6 1412.08 1058.37 1411.92 1059.28 1411.92C1060.48 1411.92 1061.58 1412.24 1062.59 1412.86C1063.59 1413.48 1064.4 1414.41 1065 1415.66C1065.61 1416.91 1065.91 1418.46 1065.91 1420.34C1065.91 1422.16 1065.61 1423.71 1065.03 1424.96C1064.44 1426.21 1063.65 1427.16 1062.64 1427.81C1061.64 1428.45 1060.52 1428.77 1059.27 1428.77C1058.39 1428.77 1057.64 1428.62 1057.02 1428.33C1056.41 1428.04 1055.91 1427.67 1055.52 1427.23C1055.13 1426.78 1054.83 1426.33 1054.63 1425.88H1054.49V1434.64H1049.95ZM1054.39 1420.32C1054.39 1421.29 1054.53 1422.14 1054.8 1422.86C1055.07 1423.59 1055.46 1424.15 1055.97 1424.56C1056.48 1424.96 1057.1 1425.15 1057.83 1425.15C1058.57 1425.15 1059.2 1424.95 1059.71 1424.55C1060.22 1424.14 1060.61 1423.57 1060.87 1422.84C1061.14 1422.11 1061.28 1421.27 1061.28 1420.32C1061.28 1419.37 1061.14 1418.54 1060.88 1417.83C1060.62 1417.11 1060.23 1416.55 1059.72 1416.14C1059.21 1415.74 1058.58 1415.53 1057.83 1415.53C1057.1 1415.53 1056.47 1415.73 1055.96 1416.12C1055.45 1416.51 1055.07 1417.07 1054.8 1417.78C1054.53 1418.5 1054.39 1419.35 1054.39 1420.32ZM1073.6 1428.81C1072.56 1428.81 1071.63 1428.63 1070.81 1428.27C1069.99 1427.9 1069.35 1427.35 1068.87 1426.64C1068.4 1425.91 1068.17 1425.01 1068.17 1423.93C1068.17 1423.02 1068.33 1422.26 1068.67 1421.64C1069 1421.02 1069.46 1420.52 1070.03 1420.15C1070.61 1419.77 1071.26 1419.49 1071.99 1419.3C1072.73 1419.1 1073.51 1418.97 1074.32 1418.89C1075.27 1418.79 1076.03 1418.7 1076.62 1418.61C1077.2 1418.52 1077.62 1418.39 1077.88 1418.21C1078.15 1418.03 1078.28 1417.77 1078.28 1417.42V1417.36C1078.28 1416.68 1078.07 1416.16 1077.64 1415.79C1077.22 1415.42 1076.62 1415.24 1075.85 1415.24C1075.03 1415.24 1074.38 1415.42 1073.9 1415.78C1073.42 1416.13 1073.1 1416.58 1072.94 1417.12L1068.74 1416.78C1068.96 1415.79 1069.38 1414.93 1070 1414.2C1070.63 1413.47 1071.43 1412.91 1072.42 1412.52C1073.41 1412.12 1074.56 1411.92 1075.87 1411.92C1076.78 1411.92 1077.65 1412.03 1078.48 1412.24C1079.32 1412.46 1080.06 1412.79 1080.71 1413.23C1081.36 1413.68 1081.88 1414.26 1082.25 1414.96C1082.63 1415.66 1082.82 1416.49 1082.82 1417.46V1428.5H1078.51V1426.23H1078.38C1078.12 1426.74 1077.77 1427.19 1077.33 1427.58C1076.89 1427.97 1076.36 1428.27 1075.74 1428.49C1075.12 1428.7 1074.41 1428.81 1073.6 1428.81ZM1074.9 1425.68C1075.57 1425.68 1076.16 1425.55 1076.67 1425.28C1077.18 1425.01 1077.58 1424.65 1077.87 1424.2C1078.16 1423.74 1078.31 1423.23 1078.31 1422.65V1420.91C1078.17 1421.01 1077.97 1421.09 1077.72 1421.17C1077.48 1421.24 1077.21 1421.31 1076.9 1421.37C1076.6 1421.43 1076.29 1421.48 1075.99 1421.53C1075.68 1421.58 1075.41 1421.61 1075.16 1421.65C1074.62 1421.73 1074.16 1421.85 1073.76 1422.02C1073.36 1422.19 1073.05 1422.42 1072.83 1422.72C1072.61 1423 1072.5 1423.35 1072.5 1423.78C1072.5 1424.4 1072.73 1424.87 1073.18 1425.2C1073.63 1425.52 1074.2 1425.68 1074.9 1425.68ZM1093.73 1428.82C1092.05 1428.82 1090.61 1428.46 1089.41 1427.75C1088.21 1427.04 1087.28 1426.04 1086.64 1424.77C1086 1423.5 1085.68 1422.04 1085.68 1420.38C1085.68 1418.71 1086 1417.24 1086.65 1415.97C1087.3 1414.7 1088.23 1413.71 1089.43 1413C1090.63 1412.28 1092.05 1411.92 1093.71 1411.92C1095.14 1411.92 1096.39 1412.18 1097.46 1412.7C1098.53 1413.22 1099.38 1413.95 1100.01 1414.88C1100.63 1415.82 1100.98 1416.92 1101.04 1418.19H1096.76C1096.64 1417.37 1096.32 1416.71 1095.8 1416.22C1095.29 1415.71 1094.62 1415.46 1093.78 1415.46C1093.08 1415.46 1092.47 1415.65 1091.94 1416.04C1091.42 1416.41 1091.02 1416.96 1090.73 1417.69C1090.44 1418.41 1090.29 1419.29 1090.29 1420.32C1090.29 1421.36 1090.43 1422.25 1090.72 1422.98C1091.01 1423.71 1091.42 1424.27 1091.94 1424.65C1092.47 1425.04 1093.08 1425.23 1093.78 1425.23C1094.3 1425.23 1094.77 1425.12 1095.18 1424.91C1095.6 1424.7 1095.94 1424.39 1096.21 1423.98C1096.49 1423.57 1096.67 1423.08 1096.76 1422.5H1101.04C1100.97 1423.75 1100.63 1424.85 1100.02 1425.8C1099.41 1426.75 1098.58 1427.49 1097.51 1428.02C1096.45 1428.55 1095.19 1428.82 1093.73 1428.82ZM1111.4 1428.82C1109.72 1428.82 1108.27 1428.48 1107.06 1427.8C1105.85 1427.11 1104.92 1426.13 1104.26 1424.88C1103.61 1423.61 1103.28 1422.12 1103.28 1420.39C1103.28 1418.71 1103.61 1417.23 1104.26 1415.96C1104.92 1414.69 1105.84 1413.7 1107.02 1412.99C1108.22 1412.28 1109.62 1411.92 1111.22 1411.92C1112.3 1411.92 1113.31 1412.1 1114.24 1412.45C1115.17 1412.79 1115.99 1413.3 1116.69 1413.99C1117.39 1414.68 1117.94 1415.55 1118.33 1416.59C1118.72 1417.63 1118.91 1418.84 1118.91 1420.23V1421.48H1105.1V1418.67H1114.64C1114.64 1418.01 1114.5 1417.43 1114.21 1416.93C1113.93 1416.43 1113.54 1416.03 1113.03 1415.75C1112.54 1415.46 1111.96 1415.31 1111.3 1415.31C1110.61 1415.31 1110 1415.47 1109.46 1415.79C1108.94 1416.1 1108.53 1416.53 1108.23 1417.06C1107.93 1417.58 1107.78 1418.17 1107.77 1418.82V1421.49C1107.77 1422.3 1107.92 1423 1108.22 1423.59C1108.52 1424.18 1108.95 1424.63 1109.51 1424.95C1110.06 1425.27 1110.72 1425.43 1111.48 1425.43C1111.98 1425.43 1112.44 1425.36 1112.86 1425.22C1113.28 1425.08 1113.64 1424.86 1113.94 1424.58C1114.24 1424.3 1114.46 1423.95 1114.62 1423.54L1118.82 1423.81C1118.6 1424.82 1118.17 1425.7 1117.51 1426.45C1116.85 1427.2 1116.01 1427.78 1114.97 1428.2C1113.94 1428.61 1112.75 1428.82 1111.4 1428.82Z" fill="#03031C"/>
+<g filter="url(#filter17_bd_12_480)">
+<rect x="920" y="1280.5" width="109" height="89" rx="10" fill="#FFC743"/>
+<rect x="920.5" y="1281" width="108" height="88" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M959.288 1317.82C958.424 1317.82 957.64 1317.66 956.935 1317.33C956.231 1317 955.672 1316.52 955.257 1315.9C954.843 1315.27 954.636 1314.52 954.636 1313.63C954.636 1312.85 954.79 1312.21 955.097 1311.73C955.405 1311.24 955.817 1310.85 956.331 1310.58C956.846 1310.3 957.415 1310.09 958.036 1309.95C958.663 1309.81 959.294 1309.7 959.927 1309.62C960.756 1309.51 961.427 1309.43 961.942 1309.38C962.463 1309.32 962.842 1309.22 963.079 1309.08C963.321 1308.95 963.443 1308.71 963.443 1308.37V1308.3C963.443 1307.43 963.203 1306.75 962.724 1306.26C962.25 1305.78 961.531 1305.53 960.566 1305.53C959.566 1305.53 958.782 1305.75 958.214 1306.19C957.645 1306.63 957.246 1307.1 957.015 1307.59L955.026 1306.88C955.382 1306.05 955.855 1305.41 956.447 1304.95C957.045 1304.48 957.696 1304.15 958.4 1303.97C959.11 1303.78 959.809 1303.69 960.495 1303.69C960.933 1303.69 961.436 1303.74 962.004 1303.85C962.579 1303.95 963.132 1304.16 963.665 1304.48C964.203 1304.8 964.65 1305.28 965.005 1305.92C965.36 1306.57 965.538 1307.43 965.538 1308.52V1317.5H963.443V1315.65H963.336C963.194 1315.95 962.957 1316.27 962.626 1316.6C962.294 1316.94 961.854 1317.23 961.303 1317.46C960.753 1317.7 960.081 1317.82 959.288 1317.82ZM959.607 1315.94C960.436 1315.94 961.134 1315.77 961.703 1315.45C962.277 1315.12 962.709 1314.7 962.999 1314.19C963.295 1313.67 963.443 1313.13 963.443 1312.56V1310.65C963.354 1310.75 963.159 1310.85 962.857 1310.94C962.561 1311.02 962.218 1311.1 961.827 1311.16C961.442 1311.22 961.066 1311.27 960.699 1311.32C960.338 1311.36 960.045 1311.4 959.82 1311.43C959.276 1311.5 958.767 1311.61 958.294 1311.77C957.826 1311.93 957.447 1312.16 957.157 1312.48C956.873 1312.78 956.731 1313.2 956.731 1313.74C956.731 1314.46 957 1315.01 957.539 1315.39C958.083 1315.75 958.773 1315.94 959.607 1315.94ZM969.362 1322.61V1303.86H971.386V1306.03H971.635C971.789 1305.79 972.002 1305.49 972.274 1305.12C972.552 1304.75 972.949 1304.42 973.464 1304.13C973.984 1303.83 974.689 1303.69 975.576 1303.69C976.725 1303.69 977.737 1303.97 978.613 1304.55C979.489 1305.12 980.172 1305.94 980.663 1306.99C981.155 1308.04 981.4 1309.29 981.4 1310.72C981.4 1312.16 981.155 1313.41 980.663 1314.47C980.172 1315.53 979.492 1316.34 978.622 1316.92C977.752 1317.5 976.748 1317.78 975.612 1317.78C974.736 1317.78 974.035 1317.64 973.508 1317.35C972.981 1317.05 972.576 1316.72 972.292 1316.35C972.008 1315.97 971.789 1315.65 971.635 1315.4H971.457V1322.61H969.362ZM971.422 1310.68C971.422 1311.71 971.573 1312.62 971.874 1313.41C972.176 1314.19 972.617 1314.8 973.197 1315.25C973.777 1315.68 974.487 1315.9 975.328 1315.9C976.204 1315.9 976.935 1315.67 977.521 1315.21C978.113 1314.74 978.556 1314.11 978.852 1313.33C979.154 1312.53 979.305 1311.65 979.305 1310.68C979.305 1309.72 979.157 1308.86 978.861 1308.09C978.571 1307.31 978.13 1306.7 977.538 1306.25C976.953 1305.8 976.216 1305.57 975.328 1305.57C974.476 1305.57 973.759 1305.78 973.179 1306.22C972.599 1306.64 972.161 1307.24 971.866 1308.01C971.57 1308.77 971.422 1309.66 971.422 1310.68ZM984.596 1317.5V1303.86H986.691V1317.5H984.596ZM985.662 1301.59C985.253 1301.59 984.901 1301.45 984.605 1301.17C984.315 1300.9 984.17 1300.56 984.17 1300.17C984.17 1299.78 984.315 1299.45 984.605 1299.17C984.901 1298.89 985.253 1298.75 985.662 1298.75C986.07 1298.75 986.419 1298.89 986.709 1299.17C987.005 1299.45 987.153 1299.78 987.153 1300.17C987.153 1300.56 987.005 1300.9 986.709 1301.17C986.419 1301.45 986.07 1301.59 985.662 1301.59ZM965.258 1340H963.056C962.926 1339.37 962.698 1338.81 962.373 1338.33C962.053 1337.85 961.663 1337.45 961.201 1337.12C960.745 1336.79 960.239 1336.54 959.683 1336.38C959.127 1336.21 958.547 1336.13 957.943 1336.13C956.842 1336.13 955.845 1336.41 954.951 1336.96C954.063 1337.52 953.356 1338.34 952.829 1339.42C952.308 1340.51 952.048 1341.83 952.048 1343.41C952.048 1344.98 952.308 1346.31 952.829 1347.4C953.356 1348.48 954.063 1349.3 954.951 1349.85C955.845 1350.41 956.842 1350.69 957.943 1350.69C958.547 1350.69 959.127 1350.61 959.683 1350.44C960.239 1350.27 960.745 1350.03 961.201 1349.7C961.663 1349.37 962.053 1348.97 962.373 1348.49C962.698 1348 962.926 1347.45 963.056 1346.82H965.258C965.092 1347.75 964.791 1348.58 964.353 1349.31C963.915 1350.05 963.37 1350.67 962.719 1351.19C962.068 1351.7 961.337 1352.08 960.526 1352.35C959.721 1352.62 958.86 1352.75 957.943 1352.75C956.392 1352.75 955.013 1352.37 953.806 1351.61C952.598 1350.85 951.648 1349.78 950.956 1348.38C950.263 1346.98 949.917 1345.33 949.917 1343.41C949.917 1341.49 950.263 1339.83 950.956 1338.44C951.648 1337.04 952.598 1335.96 953.806 1335.21C955.013 1334.45 956.392 1334.07 957.943 1334.07C958.86 1334.07 959.721 1334.2 960.526 1334.47C961.337 1334.74 962.068 1335.13 962.719 1335.64C963.37 1336.15 963.915 1336.77 964.353 1337.51C964.791 1338.23 965.092 1339.06 965.258 1340ZM968.816 1352.5V1334.32H974.959C976.38 1334.32 977.546 1334.56 978.457 1335.05C979.369 1335.53 980.043 1336.19 980.481 1337.03C980.919 1337.87 981.138 1338.82 981.138 1339.89C981.138 1340.96 980.919 1341.91 980.481 1342.74C980.043 1343.57 979.372 1344.22 978.466 1344.7C977.561 1345.16 976.404 1345.4 974.995 1345.4H970.023V1343.41H974.924C975.895 1343.41 976.676 1343.27 977.268 1342.98C977.865 1342.7 978.297 1342.3 978.564 1341.78C978.836 1341.25 978.972 1340.62 978.972 1339.89C978.972 1339.17 978.836 1338.53 978.564 1337.98C978.292 1337.44 977.857 1337.02 977.259 1336.72C976.661 1336.42 975.871 1336.27 974.888 1336.27H971.018V1352.5H968.816ZM977.374 1344.33L981.849 1352.5H979.292L974.888 1344.33H977.374ZM990.418 1352.5H984.807V1334.32H990.667C992.43 1334.32 993.94 1334.68 995.194 1335.41C996.449 1336.13 997.411 1337.17 998.08 1338.53C998.748 1339.88 999.083 1341.49 999.083 1343.37C999.083 1345.27 998.745 1346.9 998.071 1348.27C997.396 1349.63 996.413 1350.67 995.123 1351.41C993.833 1352.14 992.265 1352.5 990.418 1352.5ZM987.009 1350.55H990.276C991.779 1350.55 993.025 1350.26 994.013 1349.68C995.002 1349.1 995.739 1348.27 996.224 1347.2C996.709 1346.13 996.952 1344.85 996.952 1343.37C996.952 1341.91 996.712 1340.64 996.233 1339.58C995.754 1338.52 995.037 1337.7 994.085 1337.13C993.132 1336.56 991.945 1336.27 990.525 1336.27H987.009V1350.55Z" fill="#03031C"/>
+<g filter="url(#filter18_bd_12_480)">
+<rect x="1041" y="1280.5" width="109" height="89" rx="10" fill="#FFC743"/>
+<rect x="1041.5" y="1281" width="108" height="88" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M1080.29 1317.82C1079.42 1317.82 1078.64 1317.66 1077.94 1317.33C1077.23 1317 1076.67 1316.52 1076.26 1315.9C1075.84 1315.27 1075.64 1314.52 1075.64 1313.63C1075.64 1312.85 1075.79 1312.21 1076.1 1311.73C1076.41 1311.24 1076.82 1310.85 1077.33 1310.58C1077.85 1310.3 1078.41 1310.09 1079.04 1309.95C1079.66 1309.81 1080.29 1309.7 1080.93 1309.62C1081.76 1309.51 1082.43 1309.43 1082.94 1309.38C1083.46 1309.32 1083.84 1309.22 1084.08 1309.08C1084.32 1308.95 1084.44 1308.71 1084.44 1308.37V1308.3C1084.44 1307.43 1084.2 1306.75 1083.72 1306.26C1083.25 1305.78 1082.53 1305.53 1081.57 1305.53C1080.57 1305.53 1079.78 1305.75 1079.21 1306.19C1078.65 1306.63 1078.25 1307.1 1078.02 1307.59L1076.03 1306.88C1076.38 1306.05 1076.86 1305.41 1077.45 1304.95C1078.04 1304.48 1078.7 1304.15 1079.4 1303.97C1080.11 1303.78 1080.81 1303.69 1081.5 1303.69C1081.93 1303.69 1082.44 1303.74 1083 1303.85C1083.58 1303.95 1084.13 1304.16 1084.66 1304.48C1085.2 1304.8 1085.65 1305.28 1086.01 1305.92C1086.36 1306.57 1086.54 1307.43 1086.54 1308.52V1317.5H1084.44V1315.65H1084.34C1084.19 1315.95 1083.96 1316.27 1083.63 1316.6C1083.29 1316.94 1082.85 1317.23 1082.3 1317.46C1081.75 1317.7 1081.08 1317.82 1080.29 1317.82ZM1080.61 1315.94C1081.44 1315.94 1082.13 1315.77 1082.7 1315.45C1083.28 1315.12 1083.71 1314.7 1084 1314.19C1084.29 1313.67 1084.44 1313.13 1084.44 1312.56V1310.65C1084.35 1310.75 1084.16 1310.85 1083.86 1310.94C1083.56 1311.02 1083.22 1311.1 1082.83 1311.16C1082.44 1311.22 1082.07 1311.27 1081.7 1311.32C1081.34 1311.36 1081.05 1311.4 1080.82 1311.43C1080.28 1311.5 1079.77 1311.61 1079.29 1311.77C1078.83 1311.93 1078.45 1312.16 1078.16 1312.48C1077.87 1312.78 1077.73 1313.2 1077.73 1313.74C1077.73 1314.46 1078 1315.01 1078.54 1315.39C1079.08 1315.75 1079.77 1315.94 1080.61 1315.94ZM1090.36 1322.61V1303.86H1092.39V1306.03H1092.63C1092.79 1305.79 1093 1305.49 1093.27 1305.12C1093.55 1304.75 1093.95 1304.42 1094.46 1304.13C1094.98 1303.83 1095.69 1303.69 1096.58 1303.69C1097.72 1303.69 1098.74 1303.97 1099.61 1304.55C1100.49 1305.12 1101.17 1305.94 1101.66 1306.99C1102.15 1308.04 1102.4 1309.29 1102.4 1310.72C1102.4 1312.16 1102.15 1313.41 1101.66 1314.47C1101.17 1315.53 1100.49 1316.34 1099.62 1316.92C1098.75 1317.5 1097.75 1317.78 1096.61 1317.78C1095.74 1317.78 1095.03 1317.64 1094.51 1317.35C1093.98 1317.05 1093.58 1316.72 1093.29 1316.35C1093.01 1315.97 1092.79 1315.65 1092.63 1315.4H1092.46V1322.61H1090.36ZM1092.42 1310.68C1092.42 1311.71 1092.57 1312.62 1092.87 1313.41C1093.18 1314.19 1093.62 1314.8 1094.2 1315.25C1094.78 1315.68 1095.49 1315.9 1096.33 1315.9C1097.2 1315.9 1097.93 1315.67 1098.52 1315.21C1099.11 1314.74 1099.56 1314.11 1099.85 1313.33C1100.15 1312.53 1100.31 1311.65 1100.31 1310.68C1100.31 1309.72 1100.16 1308.86 1099.86 1308.09C1099.57 1307.31 1099.13 1306.7 1098.54 1306.25C1097.95 1305.8 1097.22 1305.57 1096.33 1305.57C1095.48 1305.57 1094.76 1305.78 1094.18 1306.22C1093.6 1306.64 1093.16 1307.24 1092.87 1308.01C1092.57 1308.77 1092.42 1309.66 1092.42 1310.68ZM1105.6 1317.5V1303.86H1107.69V1317.5H1105.6ZM1106.66 1301.59C1106.25 1301.59 1105.9 1301.45 1105.61 1301.17C1105.32 1300.9 1105.17 1300.56 1105.17 1300.17C1105.17 1299.78 1105.32 1299.45 1105.61 1299.17C1105.9 1298.89 1106.25 1298.75 1106.66 1298.75C1107.07 1298.75 1107.42 1298.89 1107.71 1299.17C1108.01 1299.45 1108.15 1299.78 1108.15 1300.17C1108.15 1300.56 1108.01 1300.9 1107.71 1301.17C1107.42 1301.45 1107.07 1301.59 1106.66 1301.59ZM1086.26 1340H1084.06C1083.93 1339.37 1083.7 1338.81 1083.37 1338.33C1083.05 1337.85 1082.66 1337.45 1082.2 1337.12C1081.75 1336.79 1081.24 1336.54 1080.68 1336.38C1080.13 1336.21 1079.55 1336.13 1078.94 1336.13C1077.84 1336.13 1076.84 1336.41 1075.95 1336.96C1075.06 1337.52 1074.36 1338.34 1073.83 1339.42C1073.31 1340.51 1073.05 1341.83 1073.05 1343.41C1073.05 1344.98 1073.31 1346.31 1073.83 1347.4C1074.36 1348.48 1075.06 1349.3 1075.95 1349.85C1076.84 1350.41 1077.84 1350.69 1078.94 1350.69C1079.55 1350.69 1080.13 1350.61 1080.68 1350.44C1081.24 1350.27 1081.75 1350.03 1082.2 1349.7C1082.66 1349.37 1083.05 1348.97 1083.37 1348.49C1083.7 1348 1083.93 1347.45 1084.06 1346.82H1086.26C1086.09 1347.75 1085.79 1348.58 1085.35 1349.31C1084.91 1350.05 1084.37 1350.67 1083.72 1351.19C1083.07 1351.7 1082.34 1352.08 1081.53 1352.35C1080.72 1352.62 1079.86 1352.75 1078.94 1352.75C1077.39 1352.75 1076.01 1352.37 1074.81 1351.61C1073.6 1350.85 1072.65 1349.78 1071.96 1348.38C1071.26 1346.98 1070.92 1345.33 1070.92 1343.41C1070.92 1341.49 1071.26 1339.83 1071.96 1338.44C1072.65 1337.04 1073.6 1335.96 1074.81 1335.21C1076.01 1334.45 1077.39 1334.07 1078.94 1334.07C1079.86 1334.07 1080.72 1334.2 1081.53 1334.47C1082.34 1334.74 1083.07 1335.13 1083.72 1335.64C1084.37 1336.15 1084.91 1336.77 1085.35 1337.51C1085.79 1338.23 1086.09 1339.06 1086.26 1340ZM1089.82 1352.5V1334.32H1095.96C1097.38 1334.32 1098.55 1334.56 1099.46 1335.05C1100.37 1335.53 1101.04 1336.19 1101.48 1337.03C1101.92 1337.87 1102.14 1338.82 1102.14 1339.89C1102.14 1340.96 1101.92 1341.91 1101.48 1342.74C1101.04 1343.57 1100.37 1344.22 1099.47 1344.7C1098.56 1345.16 1097.4 1345.4 1095.99 1345.4H1091.02V1343.41H1095.92C1096.89 1343.41 1097.68 1343.27 1098.27 1342.98C1098.87 1342.7 1099.3 1342.3 1099.56 1341.78C1099.84 1341.25 1099.97 1340.62 1099.97 1339.89C1099.97 1339.17 1099.84 1338.53 1099.56 1337.98C1099.29 1337.44 1098.86 1337.02 1098.26 1336.72C1097.66 1336.42 1096.87 1336.27 1095.89 1336.27H1092.02V1352.5H1089.82ZM1098.37 1344.33L1102.85 1352.5H1100.29L1095.89 1344.33H1098.37ZM1111.42 1352.5H1105.81V1334.32H1111.67C1113.43 1334.32 1114.94 1334.68 1116.19 1335.41C1117.45 1336.13 1118.41 1337.17 1119.08 1338.53C1119.75 1339.88 1120.08 1341.49 1120.08 1343.37C1120.08 1345.27 1119.75 1346.9 1119.07 1348.27C1118.4 1349.63 1117.41 1350.67 1116.12 1351.41C1114.83 1352.14 1113.26 1352.5 1111.42 1352.5ZM1108.01 1350.55H1111.28C1112.78 1350.55 1114.03 1350.26 1115.01 1349.68C1116 1349.1 1116.74 1348.27 1117.22 1347.2C1117.71 1346.13 1117.95 1344.85 1117.95 1343.37C1117.95 1341.91 1117.71 1340.64 1117.23 1339.58C1116.75 1338.52 1116.04 1337.7 1115.08 1337.13C1114.13 1336.56 1112.94 1336.27 1111.52 1336.27H1108.01V1350.55Z" fill="#03031C"/>
+<path d="M615.207 1200.79C614.817 1200.4 614.183 1200.4 613.793 1200.79L607.429 1207.16C607.038 1207.55 607.038 1208.18 607.429 1208.57C607.819 1208.96 608.453 1208.96 608.843 1208.57L614.5 1202.91L620.157 1208.57C620.547 1208.96 621.181 1208.96 621.571 1208.57C621.962 1208.18 621.962 1207.55 621.571 1207.16L615.207 1200.79ZM613.5 1248.12V1253.84H615.5V1248.12H613.5ZM613.5 1265.28V1271H615.5V1265.28H613.5ZM613.5 1201.5V1206.5H615.5V1201.5H613.5ZM613.5 1216.5V1221.5H615.5V1216.5H613.5Z" fill="#03031C"/>
+<path d="M825.293 1366.29C824.902 1366.68 824.902 1367.32 825.293 1367.71L831.657 1374.07C832.047 1374.46 832.681 1374.46 833.071 1374.07C833.462 1373.68 833.462 1373.05 833.071 1372.66L827.414 1367L833.071 1361.34C833.462 1360.95 833.462 1360.32 833.071 1359.93C832.681 1359.54 832.047 1359.54 831.657 1359.93L825.293 1366.29ZM882.207 1367.71C882.598 1367.32 882.598 1366.68 882.207 1366.29L875.843 1359.93C875.453 1359.54 874.819 1359.54 874.429 1359.93C874.038 1360.32 874.038 1360.95 874.429 1361.34L880.086 1367L874.429 1372.66C874.038 1373.05 874.038 1373.68 874.429 1374.07C874.819 1374.46 875.453 1374.46 875.843 1374.07L882.207 1367.71ZM853.5 1366H826V1368H853.5V1366ZM853.5 1368H881.5V1366H853.5V1368ZM852.5 1079.5V1207.5H854.5V1079.5H852.5ZM852.5 1242V1367H854.5V1242H852.5Z" fill="#03031C"/>
+<path d="M261.831 1412.17L269.181 1387.43C269.998 1384.73 267.956 1381.99 265.138 1381.99H231.041H196.903C194.085 1381.99 192.043 1384.73 192.86 1387.43L200.21 1412.17H231.163" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M194.983 1406.99L191.063 1414.38C189.92 1416.54 191.471 1419.11 193.921 1419.11H231H268.078C270.528 1419.11 272.08 1416.54 270.937 1414.38L267.017 1406.99" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M231 1365.91C238.33 1365.91 244.272 1358.54 244.272 1349.45C244.272 1340.36 238.33 1332.99 231 1332.99C223.671 1332.99 217.729 1340.36 217.729 1349.45C217.729 1358.54 223.671 1365.91 231 1365.91Z" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M240.474 1360.96C240.474 1360.96 249.866 1366.07 253.541 1369.01C254.399 1369.7 255.134 1370.56 255.746 1371.5C256.849 1373.26 257.339 1375.34 257.339 1377.38V1381.99" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M221.526 1360.96C221.526 1360.96 212.134 1366.07 208.459 1369.01C207.602 1369.7 206.867 1370.56 206.254 1371.5C205.151 1373.26 204.621 1375.34 204.621 1377.38V1381.99" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M434 1312L434 1359" stroke="white" stroke-width="2"/>
+<path d="M434 1087L434 1115" stroke="white" stroke-width="2"/>
+<path d="M434 1110L434 1175" stroke="white" stroke-width="2"/>
+<path d="M392.464 1411V1412H393.464V1411H392.464ZM392.464 1346V1345H391.464V1346H392.464ZM526.707 1346.71C527.098 1346.32 527.098 1345.68 526.707 1345.29L520.343 1338.93C519.953 1338.54 519.319 1338.54 518.929 1338.93C518.538 1339.32 518.538 1339.95 518.929 1340.34L524.586 1346L518.929 1351.66C518.538 1352.05 518.538 1352.68 518.929 1353.07C519.319 1353.46 519.953 1353.46 520.343 1353.07L526.707 1346.71ZM343.5 1412H392.464V1410H343.5V1412ZM393.464 1411V1346H391.464V1411H393.464ZM392.464 1347H526V1345H392.464V1347Z" fill="#03031C"/>
+<path d="M345 1102H841" stroke="#03031C" stroke-width="2"/>
+<path d="M1033 1102H1034V1101H1033V1102ZM1032.29 1117.71C1032.68 1118.1 1033.32 1118.1 1033.71 1117.71L1040.07 1111.34C1040.46 1110.95 1040.46 1110.32 1040.07 1109.93C1039.68 1109.54 1039.05 1109.54 1038.66 1109.93L1033 1115.59L1027.34 1109.93C1026.95 1109.54 1026.32 1109.54 1025.93 1109.93C1025.54 1110.32 1025.54 1110.95 1025.93 1111.34L1032.29 1117.71ZM864.5 1103H1033V1101H864.5V1103ZM1032 1102V1117H1034V1102H1032Z" fill="#03031C"/>
+<path d="M527.707 1159.71C528.098 1159.32 528.098 1158.68 527.707 1158.29L521.343 1151.93C520.953 1151.54 520.319 1151.54 519.929 1151.93C519.538 1152.32 519.538 1152.95 519.929 1153.34L525.586 1159L519.929 1164.66C519.538 1165.05 519.538 1165.68 519.929 1166.07C520.319 1166.46 520.953 1166.46 521.343 1166.07L527.707 1159.71ZM345 1160L527 1160L527 1158L345 1158L345 1160Z" fill="#03031C"/>
+<path d="M417.085 1335V1324.09H418.704V1325.8H418.846C419.074 1325.21 419.44 1324.76 419.947 1324.44C420.454 1324.11 421.062 1323.95 421.772 1323.95C422.492 1323.95 423.091 1324.11 423.569 1324.44C424.052 1324.76 424.429 1325.21 424.699 1325.8H424.812C425.092 1325.23 425.511 1324.78 426.069 1324.45C426.628 1324.12 427.298 1323.95 428.079 1323.95C429.055 1323.95 429.852 1324.25 430.473 1324.87C431.093 1325.47 431.403 1326.42 431.403 1327.7V1335H429.727V1327.7C429.727 1326.89 429.507 1326.32 429.066 1325.97C428.626 1325.63 428.108 1325.45 427.511 1325.45C426.744 1325.45 426.15 1325.69 425.728 1326.15C425.307 1326.61 425.096 1327.19 425.096 1327.9V1335H423.392V1327.53C423.392 1326.91 423.19 1326.41 422.788 1326.03C422.386 1325.65 421.867 1325.45 421.233 1325.45C420.797 1325.45 420.39 1325.57 420.011 1325.8C419.637 1326.03 419.334 1326.36 419.102 1326.77C418.875 1327.18 418.761 1327.65 418.761 1328.18V1335H417.085ZM437.678 1335.26C436.987 1335.26 436.359 1335.13 435.796 1334.87C435.232 1334.6 434.785 1334.22 434.453 1333.72C434.122 1333.22 433.956 1332.61 433.956 1331.9C433.956 1331.28 434.079 1330.77 434.326 1330.38C434.572 1329.99 434.901 1329.68 435.313 1329.46C435.725 1329.24 436.179 1329.07 436.676 1328.96C437.178 1328.85 437.683 1328.76 438.189 1328.69C438.852 1328.61 439.39 1328.54 439.801 1328.5C440.218 1328.45 440.521 1328.38 440.711 1328.27C440.905 1328.16 441.002 1327.97 441.002 1327.7V1327.64C441.002 1326.94 440.81 1326.4 440.426 1326.01C440.048 1325.62 439.472 1325.43 438.701 1325.43C437.9 1325.43 437.273 1325.6 436.819 1325.95C436.364 1326.3 436.044 1326.68 435.86 1327.07L434.269 1326.51C434.553 1325.84 434.932 1325.33 435.405 1324.96C435.883 1324.58 436.404 1324.32 436.968 1324.18C437.536 1324.02 438.095 1323.95 438.644 1323.95C438.994 1323.95 439.397 1323.99 439.851 1324.08C440.31 1324.16 440.753 1324.33 441.179 1324.58C441.61 1324.84 441.968 1325.22 442.252 1325.74C442.536 1326.25 442.678 1326.95 442.678 1327.81V1335H441.002V1333.52H440.917C440.803 1333.76 440.614 1334.01 440.348 1334.28C440.083 1334.55 439.73 1334.78 439.29 1334.97C438.85 1335.16 438.312 1335.26 437.678 1335.26ZM437.934 1333.75C438.596 1333.75 439.155 1333.62 439.61 1333.36C440.069 1333.1 440.415 1332.76 440.647 1332.35C440.883 1331.94 441.002 1331.51 441.002 1331.05V1329.52C440.931 1329.6 440.775 1329.68 440.533 1329.75C440.296 1329.82 440.022 1329.88 439.709 1329.93C439.401 1329.98 439.101 1330.02 438.807 1330.06C438.518 1330.09 438.284 1330.12 438.104 1330.14C437.668 1330.2 437.261 1330.29 436.882 1330.42C436.508 1330.54 436.205 1330.73 435.973 1330.98C435.746 1331.23 435.632 1331.56 435.632 1331.99C435.632 1332.57 435.848 1333.01 436.279 1333.31C436.714 1333.6 437.266 1333.75 437.934 1333.75ZM447.413 1328.44V1335H445.737V1324.09H447.357V1325.8H447.499C447.754 1325.24 448.143 1324.8 448.663 1324.46C449.184 1324.12 449.857 1323.95 450.68 1323.95C451.419 1323.95 452.065 1324.1 452.619 1324.4C453.173 1324.7 453.604 1325.16 453.912 1325.77C454.22 1326.37 454.374 1327.14 454.374 1328.07V1335H452.697V1328.18C452.697 1327.32 452.475 1326.66 452.03 1326.18C451.585 1325.7 450.974 1325.45 450.197 1325.45C449.662 1325.45 449.184 1325.57 448.763 1325.8C448.346 1326.03 448.017 1326.37 447.776 1326.82C447.534 1327.26 447.413 1327.8 447.413 1328.44ZM460.647 1335.26C459.955 1335.26 459.328 1335.13 458.765 1334.87C458.201 1334.6 457.754 1334.22 457.422 1333.72C457.091 1333.22 456.925 1332.61 456.925 1331.9C456.925 1331.28 457.048 1330.77 457.294 1330.38C457.541 1329.99 457.87 1329.68 458.282 1329.46C458.694 1329.24 459.148 1329.07 459.645 1328.96C460.147 1328.85 460.651 1328.76 461.158 1328.69C461.821 1328.61 462.358 1328.54 462.77 1328.5C463.187 1328.45 463.49 1328.38 463.679 1328.27C463.873 1328.16 463.971 1327.97 463.971 1327.7V1327.64C463.971 1326.94 463.779 1326.4 463.395 1326.01C463.016 1325.62 462.441 1325.43 461.669 1325.43C460.869 1325.43 460.242 1325.6 459.787 1325.95C459.333 1326.3 459.013 1326.68 458.828 1327.07L457.238 1326.51C457.522 1325.84 457.9 1325.33 458.374 1324.96C458.852 1324.58 459.373 1324.32 459.936 1324.18C460.505 1324.02 461.063 1323.95 461.613 1323.95C461.963 1323.95 462.365 1323.99 462.82 1324.08C463.279 1324.16 463.722 1324.33 464.148 1324.58C464.579 1324.84 464.936 1325.22 465.221 1325.74C465.505 1326.25 465.647 1326.95 465.647 1327.81V1335H463.971V1333.52H463.885C463.772 1333.76 463.582 1334.01 463.317 1334.28C463.052 1334.55 462.699 1334.78 462.259 1334.97C461.819 1335.16 461.281 1335.26 460.647 1335.26ZM460.902 1333.75C461.565 1333.75 462.124 1333.62 462.578 1333.36C463.038 1333.1 463.383 1332.76 463.615 1332.35C463.852 1331.94 463.971 1331.51 463.971 1331.05V1329.52C463.9 1329.6 463.743 1329.68 463.502 1329.75C463.265 1329.82 462.99 1329.88 462.678 1329.93C462.37 1329.98 462.069 1330.02 461.776 1330.06C461.487 1330.09 461.253 1330.12 461.073 1330.14C460.637 1330.2 460.23 1330.29 459.851 1330.42C459.477 1330.54 459.174 1330.73 458.942 1330.98C458.715 1331.23 458.601 1331.56 458.601 1331.99C458.601 1332.57 458.817 1333.01 459.248 1333.31C459.683 1333.6 460.235 1333.75 460.902 1333.75ZM473.109 1339.32C472.3 1339.32 471.604 1339.21 471.021 1339.01C470.439 1338.8 469.954 1338.53 469.565 1338.2C469.182 1337.86 468.876 1337.51 468.649 1337.13L469.984 1336.19C470.136 1336.39 470.328 1336.62 470.56 1336.88C470.792 1337.14 471.109 1337.36 471.511 1337.55C471.919 1337.74 472.451 1337.84 473.109 1337.84C473.99 1337.84 474.717 1337.63 475.29 1337.2C475.863 1336.78 476.149 1336.11 476.149 1335.2V1332.98H476.007C475.884 1333.18 475.709 1333.43 475.482 1333.72C475.259 1334.01 474.937 1334.27 474.516 1334.5C474.099 1334.72 473.536 1334.83 472.825 1334.83C471.945 1334.83 471.154 1334.62 470.453 1334.2C469.757 1333.79 469.205 1333.18 468.798 1332.39C468.396 1331.59 468.195 1330.62 468.195 1329.49C468.195 1328.37 468.391 1327.4 468.784 1326.57C469.177 1325.74 469.724 1325.09 470.425 1324.64C471.125 1324.18 471.935 1323.95 472.854 1323.95C473.564 1323.95 474.127 1324.07 474.544 1324.3C474.965 1324.54 475.287 1324.8 475.51 1325.1C475.737 1325.39 475.912 1325.63 476.036 1325.82H476.206V1324.09H477.825V1335.31C477.825 1336.25 477.612 1337.01 477.186 1337.6C476.765 1338.19 476.196 1338.62 475.482 1338.9C474.771 1339.18 473.981 1339.32 473.109 1339.32ZM473.053 1333.32C473.725 1333.32 474.293 1333.17 474.757 1332.86C475.221 1332.55 475.574 1332.11 475.815 1331.53C476.057 1330.96 476.178 1330.27 476.178 1329.46C476.178 1328.67 476.059 1327.98 475.822 1327.38C475.586 1326.78 475.235 1326.31 474.771 1325.97C474.307 1325.62 473.734 1325.45 473.053 1325.45C472.342 1325.45 471.75 1325.63 471.277 1325.99C470.808 1326.35 470.455 1326.84 470.219 1327.44C469.987 1328.05 469.871 1328.72 469.871 1329.46C469.871 1330.22 469.989 1330.89 470.226 1331.47C470.467 1332.05 470.822 1332.5 471.291 1332.83C471.765 1333.16 472.352 1333.32 473.053 1333.32ZM485.467 1335.23C484.416 1335.23 483.509 1335 482.747 1334.53C481.99 1334.06 481.405 1333.41 480.993 1332.57C480.586 1331.73 480.382 1330.75 480.382 1329.63C480.382 1328.51 480.586 1327.53 480.993 1326.68C481.405 1325.82 481.978 1325.15 482.712 1324.67C483.45 1324.19 484.312 1323.95 485.297 1323.95C485.865 1323.95 486.426 1324.04 486.98 1324.23C487.534 1324.42 488.038 1324.73 488.493 1325.16C488.947 1325.58 489.31 1326.14 489.58 1326.83C489.849 1327.53 489.984 1328.39 489.984 1329.4V1330.11H481.575V1328.66H488.28C488.28 1328.05 488.157 1327.5 487.911 1327.02C487.669 1326.53 487.323 1326.15 486.874 1325.87C486.429 1325.59 485.903 1325.45 485.297 1325.45C484.629 1325.45 484.052 1325.62 483.564 1325.95C483.081 1326.28 482.709 1326.7 482.449 1327.23C482.188 1327.76 482.058 1328.32 482.058 1328.92V1329.89C482.058 1330.71 482.2 1331.41 482.484 1331.98C482.773 1332.55 483.173 1332.98 483.685 1333.28C484.196 1333.57 484.79 1333.72 485.467 1333.72C485.908 1333.72 486.305 1333.66 486.661 1333.54C487.02 1333.41 487.33 1333.22 487.591 1332.97C487.851 1332.71 488.053 1332.4 488.195 1332.02L489.814 1332.47C489.643 1333.02 489.357 1333.5 488.955 1333.92C488.552 1334.33 488.055 1334.65 487.463 1334.89C486.871 1335.11 486.206 1335.23 485.467 1335.23ZM500.261 1326.53L498.756 1326.96C498.661 1326.71 498.521 1326.47 498.337 1326.23C498.157 1325.99 497.911 1325.79 497.598 1325.63C497.286 1325.48 496.885 1325.4 496.398 1325.4C495.73 1325.4 495.174 1325.55 494.729 1325.86C494.288 1326.16 494.068 1326.55 494.068 1327.02C494.068 1327.43 494.22 1327.76 494.523 1328C494.826 1328.25 495.299 1328.45 495.943 1328.61L497.562 1329.01C498.538 1329.24 499.265 1329.6 499.743 1330.09C500.221 1330.58 500.46 1331.2 500.46 1331.96C500.46 1332.59 500.28 1333.14 499.92 1333.64C499.565 1334.13 499.068 1334.52 498.429 1334.8C497.79 1335.09 497.046 1335.23 496.199 1335.23C495.086 1335.23 494.165 1334.99 493.436 1334.5C492.707 1334.02 492.245 1333.31 492.051 1332.39L493.642 1331.99C493.794 1332.58 494.08 1333.02 494.501 1333.31C494.928 1333.6 495.484 1333.75 496.17 1333.75C496.952 1333.75 497.572 1333.58 498.031 1333.25C498.495 1332.92 498.727 1332.51 498.727 1332.05C498.727 1331.67 498.595 1331.35 498.33 1331.09C498.064 1330.83 497.657 1330.64 497.108 1330.51L495.29 1330.09C494.291 1329.85 493.557 1329.48 493.088 1328.98C492.624 1328.48 492.392 1327.86 492.392 1327.1C492.392 1326.49 492.565 1325.94 492.911 1325.47C493.261 1325 493.737 1324.62 494.338 1324.35C494.944 1324.08 495.631 1323.95 496.398 1323.95C497.477 1323.95 498.325 1324.19 498.94 1324.66C499.561 1325.13 500.001 1325.76 500.261 1326.53Z" fill="#03031C"/>
+<path d="M394.085 1145V1134.09H395.704V1135.8H395.846C396.074 1135.21 396.44 1134.76 396.947 1134.44C397.454 1134.11 398.062 1133.95 398.772 1133.95C399.492 1133.95 400.091 1134.11 400.569 1134.44C401.052 1134.76 401.429 1135.21 401.699 1135.8H401.812C402.092 1135.23 402.511 1134.78 403.069 1134.45C403.628 1134.12 404.298 1133.95 405.079 1133.95C406.055 1133.95 406.852 1134.25 407.473 1134.87C408.093 1135.47 408.403 1136.42 408.403 1137.7V1145H406.727V1137.7C406.727 1136.89 406.507 1136.32 406.066 1135.97C405.626 1135.63 405.108 1135.45 404.511 1135.45C403.744 1135.45 403.15 1135.69 402.728 1136.15C402.307 1136.61 402.096 1137.19 402.096 1137.9V1145H400.392V1137.53C400.392 1136.91 400.19 1136.41 399.788 1136.03C399.386 1135.65 398.867 1135.45 398.233 1135.45C397.797 1135.45 397.39 1135.57 397.011 1135.8C396.637 1136.03 396.334 1136.36 396.102 1136.77C395.875 1137.18 395.761 1137.65 395.761 1138.18V1145H394.085ZM414.678 1145.26C413.987 1145.26 413.359 1145.13 412.796 1144.87C412.232 1144.6 411.785 1144.22 411.453 1143.72C411.122 1143.22 410.956 1142.61 410.956 1141.9C410.956 1141.28 411.079 1140.77 411.326 1140.38C411.572 1139.99 411.901 1139.68 412.313 1139.46C412.725 1139.24 413.179 1139.07 413.676 1138.96C414.178 1138.85 414.683 1138.76 415.189 1138.69C415.852 1138.61 416.39 1138.54 416.801 1138.5C417.218 1138.45 417.521 1138.38 417.711 1138.27C417.905 1138.16 418.002 1137.97 418.002 1137.7V1137.64C418.002 1136.94 417.81 1136.4 417.426 1136.01C417.048 1135.62 416.472 1135.43 415.701 1135.43C414.9 1135.43 414.273 1135.6 413.819 1135.95C413.364 1136.3 413.044 1136.68 412.86 1137.07L411.269 1136.51C411.553 1135.84 411.932 1135.33 412.405 1134.96C412.883 1134.58 413.404 1134.32 413.968 1134.18C414.536 1134.02 415.095 1133.95 415.644 1133.95C415.994 1133.95 416.397 1133.99 416.851 1134.08C417.31 1134.16 417.753 1134.33 418.179 1134.58C418.61 1134.84 418.968 1135.22 419.252 1135.74C419.536 1136.25 419.678 1136.95 419.678 1137.81V1145H418.002V1143.52H417.917C417.803 1143.76 417.614 1144.01 417.348 1144.28C417.083 1144.55 416.73 1144.78 416.29 1144.97C415.85 1145.16 415.312 1145.26 414.678 1145.26ZM414.934 1143.75C415.596 1143.75 416.155 1143.62 416.61 1143.36C417.069 1143.1 417.415 1142.76 417.647 1142.35C417.883 1141.94 418.002 1141.51 418.002 1141.05V1139.52C417.931 1139.6 417.775 1139.68 417.533 1139.75C417.296 1139.82 417.022 1139.88 416.709 1139.93C416.401 1139.98 416.101 1140.02 415.807 1140.06C415.518 1140.09 415.284 1140.12 415.104 1140.14C414.668 1140.2 414.261 1140.29 413.882 1140.42C413.508 1140.54 413.205 1140.73 412.973 1140.98C412.746 1141.23 412.632 1141.56 412.632 1141.99C412.632 1142.57 412.848 1143.01 413.279 1143.31C413.714 1143.6 414.266 1143.75 414.934 1143.75ZM424.413 1138.44V1145H422.737V1134.09H424.357V1135.8H424.499C424.754 1135.24 425.143 1134.8 425.663 1134.46C426.184 1134.12 426.857 1133.95 427.68 1133.95C428.419 1133.95 429.065 1134.1 429.619 1134.4C430.173 1134.7 430.604 1135.16 430.912 1135.77C431.22 1136.37 431.374 1137.14 431.374 1138.07V1145H429.697V1138.18C429.697 1137.32 429.475 1136.66 429.03 1136.18C428.585 1135.7 427.974 1135.45 427.197 1135.45C426.662 1135.45 426.184 1135.57 425.763 1135.8C425.346 1136.03 425.017 1136.37 424.776 1136.82C424.534 1137.26 424.413 1137.8 424.413 1138.44ZM437.647 1145.26C436.955 1145.26 436.328 1145.13 435.765 1144.87C435.201 1144.6 434.754 1144.22 434.422 1143.72C434.091 1143.22 433.925 1142.61 433.925 1141.9C433.925 1141.28 434.048 1140.77 434.294 1140.38C434.541 1139.99 434.87 1139.68 435.282 1139.46C435.694 1139.24 436.148 1139.07 436.645 1138.96C437.147 1138.85 437.651 1138.76 438.158 1138.69C438.821 1138.61 439.358 1138.54 439.77 1138.5C440.187 1138.45 440.49 1138.38 440.679 1138.27C440.873 1138.16 440.971 1137.97 440.971 1137.7V1137.64C440.971 1136.94 440.779 1136.4 440.395 1136.01C440.016 1135.62 439.441 1135.43 438.669 1135.43C437.869 1135.43 437.242 1135.6 436.787 1135.95C436.333 1136.3 436.013 1136.68 435.828 1137.07L434.238 1136.51C434.522 1135.84 434.9 1135.33 435.374 1134.96C435.852 1134.58 436.373 1134.32 436.936 1134.18C437.505 1134.02 438.063 1133.95 438.613 1133.95C438.963 1133.95 439.365 1133.99 439.82 1134.08C440.279 1134.16 440.722 1134.33 441.148 1134.58C441.579 1134.84 441.936 1135.22 442.221 1135.74C442.505 1136.25 442.647 1136.95 442.647 1137.81V1145H440.971V1143.52H440.885C440.772 1143.76 440.582 1144.01 440.317 1144.28C440.052 1144.55 439.699 1144.78 439.259 1144.97C438.819 1145.16 438.281 1145.26 437.647 1145.26ZM437.902 1143.75C438.565 1143.75 439.124 1143.62 439.578 1143.36C440.038 1143.1 440.383 1142.76 440.615 1142.35C440.852 1141.94 440.971 1141.51 440.971 1141.05V1139.52C440.9 1139.6 440.743 1139.68 440.502 1139.75C440.265 1139.82 439.99 1139.88 439.678 1139.93C439.37 1139.98 439.069 1140.02 438.776 1140.06C438.487 1140.09 438.253 1140.12 438.073 1140.14C437.637 1140.2 437.23 1140.29 436.851 1140.42C436.477 1140.54 436.174 1140.73 435.942 1140.98C435.715 1141.23 435.601 1141.56 435.601 1141.99C435.601 1142.57 435.817 1143.01 436.248 1143.31C436.683 1143.6 437.235 1143.75 437.902 1143.75ZM450.109 1149.32C449.3 1149.32 448.604 1149.21 448.021 1149.01C447.439 1148.8 446.954 1148.53 446.565 1148.2C446.182 1147.86 445.876 1147.51 445.649 1147.13L446.984 1146.19C447.136 1146.39 447.328 1146.62 447.56 1146.88C447.792 1147.14 448.109 1147.36 448.511 1147.55C448.919 1147.74 449.451 1147.84 450.109 1147.84C450.99 1147.84 451.717 1147.63 452.29 1147.2C452.863 1146.78 453.149 1146.11 453.149 1145.2V1142.98H453.007C452.884 1143.18 452.709 1143.43 452.482 1143.72C452.259 1144.01 451.937 1144.27 451.516 1144.5C451.099 1144.72 450.536 1144.83 449.825 1144.83C448.945 1144.83 448.154 1144.62 447.453 1144.2C446.757 1143.79 446.205 1143.18 445.798 1142.39C445.396 1141.59 445.195 1140.62 445.195 1139.49C445.195 1138.37 445.391 1137.4 445.784 1136.57C446.177 1135.74 446.724 1135.09 447.425 1134.64C448.125 1134.18 448.935 1133.95 449.854 1133.95C450.564 1133.95 451.127 1134.07 451.544 1134.3C451.965 1134.54 452.287 1134.8 452.51 1135.1C452.737 1135.39 452.912 1135.63 453.036 1135.82H453.206V1134.09H454.825V1145.31C454.825 1146.25 454.612 1147.01 454.186 1147.6C453.765 1148.19 453.196 1148.62 452.482 1148.9C451.771 1149.18 450.981 1149.32 450.109 1149.32ZM450.053 1143.32C450.725 1143.32 451.293 1143.17 451.757 1142.86C452.221 1142.55 452.574 1142.11 452.815 1141.53C453.057 1140.96 453.178 1140.27 453.178 1139.46C453.178 1138.67 453.059 1137.98 452.822 1137.38C452.586 1136.78 452.235 1136.31 451.771 1135.97C451.307 1135.62 450.734 1135.45 450.053 1135.45C449.342 1135.45 448.75 1135.63 448.277 1135.99C447.808 1136.35 447.455 1136.84 447.219 1137.44C446.987 1138.05 446.871 1138.72 446.871 1139.46C446.871 1140.22 446.989 1140.89 447.226 1141.47C447.467 1142.05 447.822 1142.5 448.291 1142.83C448.765 1143.16 449.352 1143.32 450.053 1143.32ZM462.467 1145.23C461.416 1145.23 460.509 1145 459.747 1144.53C458.99 1144.06 458.405 1143.41 457.993 1142.57C457.586 1141.73 457.382 1140.75 457.382 1139.63C457.382 1138.51 457.586 1137.53 457.993 1136.68C458.405 1135.82 458.978 1135.15 459.712 1134.67C460.45 1134.19 461.312 1133.95 462.297 1133.95C462.865 1133.95 463.426 1134.04 463.98 1134.23C464.534 1134.42 465.038 1134.73 465.493 1135.16C465.947 1135.58 466.31 1136.14 466.58 1136.83C466.849 1137.53 466.984 1138.39 466.984 1139.4V1140.11H458.575V1138.66H465.28C465.28 1138.05 465.157 1137.5 464.911 1137.02C464.669 1136.53 464.323 1136.15 463.874 1135.87C463.429 1135.59 462.903 1135.45 462.297 1135.45C461.629 1135.45 461.052 1135.62 460.564 1135.95C460.081 1136.28 459.709 1136.7 459.449 1137.23C459.188 1137.76 459.058 1138.32 459.058 1138.92V1139.89C459.058 1140.71 459.2 1141.41 459.484 1141.98C459.773 1142.55 460.173 1142.98 460.685 1143.28C461.196 1143.57 461.79 1143.72 462.467 1143.72C462.908 1143.72 463.305 1143.66 463.661 1143.54C464.02 1143.41 464.33 1143.22 464.591 1142.97C464.851 1142.71 465.053 1142.4 465.195 1142.02L466.814 1142.47C466.643 1143.02 466.357 1143.5 465.955 1143.92C465.552 1144.33 465.055 1144.65 464.463 1144.89C463.871 1145.11 463.206 1145.23 462.467 1145.23ZM477.261 1136.53L475.756 1136.96C475.661 1136.71 475.521 1136.47 475.337 1136.23C475.157 1135.99 474.911 1135.79 474.598 1135.63C474.286 1135.48 473.885 1135.4 473.398 1135.4C472.73 1135.4 472.174 1135.55 471.729 1135.86C471.288 1136.16 471.068 1136.55 471.068 1137.02C471.068 1137.43 471.22 1137.76 471.523 1138C471.826 1138.25 472.299 1138.45 472.943 1138.61L474.562 1139.01C475.538 1139.24 476.265 1139.6 476.743 1140.09C477.221 1140.58 477.46 1141.2 477.46 1141.96C477.46 1142.59 477.28 1143.14 476.92 1143.64C476.565 1144.13 476.068 1144.52 475.429 1144.8C474.79 1145.09 474.046 1145.23 473.199 1145.23C472.086 1145.23 471.165 1144.99 470.436 1144.5C469.707 1144.02 469.245 1143.31 469.051 1142.39L470.642 1141.99C470.794 1142.58 471.08 1143.02 471.501 1143.31C471.928 1143.6 472.484 1143.75 473.17 1143.75C473.952 1143.75 474.572 1143.58 475.031 1143.25C475.495 1142.92 475.727 1142.51 475.727 1142.05C475.727 1141.67 475.595 1141.35 475.33 1141.09C475.064 1140.83 474.657 1140.64 474.108 1140.51L472.29 1140.09C471.291 1139.85 470.557 1139.48 470.088 1138.98C469.624 1138.48 469.392 1137.86 469.392 1137.1C469.392 1136.49 469.565 1135.94 469.911 1135.47C470.261 1135 470.737 1134.62 471.338 1134.35C471.944 1134.08 472.631 1133.95 473.398 1133.95C474.477 1133.95 475.325 1134.19 475.94 1134.66C476.561 1135.13 477.001 1135.76 477.261 1136.53Z" fill="#03031C"/>
+<path d="M591.085 1087V1076.09H592.704V1077.8H592.846C593.074 1077.21 593.44 1076.76 593.947 1076.44C594.454 1076.11 595.062 1075.95 595.772 1075.95C596.492 1075.95 597.091 1076.11 597.569 1076.44C598.052 1076.76 598.429 1077.21 598.699 1077.8H598.812C599.092 1077.23 599.511 1076.78 600.069 1076.45C600.628 1076.12 601.298 1075.95 602.079 1075.95C603.055 1075.95 603.852 1076.25 604.473 1076.87C605.093 1077.47 605.403 1078.42 605.403 1079.7V1087H603.727V1079.7C603.727 1078.89 603.507 1078.32 603.066 1077.97C602.626 1077.63 602.108 1077.45 601.511 1077.45C600.744 1077.45 600.15 1077.69 599.728 1078.15C599.307 1078.61 599.096 1079.19 599.096 1079.9V1087H597.392V1079.53C597.392 1078.91 597.19 1078.41 596.788 1078.03C596.386 1077.65 595.867 1077.45 595.233 1077.45C594.797 1077.45 594.39 1077.57 594.011 1077.8C593.637 1078.03 593.334 1078.36 593.102 1078.77C592.875 1079.18 592.761 1079.65 592.761 1080.18V1087H591.085ZM611.678 1087.26C610.987 1087.26 610.359 1087.13 609.796 1086.87C609.232 1086.6 608.785 1086.22 608.453 1085.72C608.122 1085.22 607.956 1084.61 607.956 1083.9C607.956 1083.28 608.079 1082.77 608.326 1082.38C608.572 1081.99 608.901 1081.68 609.313 1081.46C609.725 1081.24 610.179 1081.07 610.676 1080.96C611.178 1080.85 611.683 1080.76 612.189 1080.69C612.852 1080.61 613.39 1080.54 613.801 1080.5C614.218 1080.45 614.521 1080.38 614.711 1080.27C614.905 1080.16 615.002 1079.97 615.002 1079.7V1079.64C615.002 1078.94 614.81 1078.4 614.426 1078.01C614.048 1077.62 613.472 1077.43 612.701 1077.43C611.9 1077.43 611.273 1077.6 610.819 1077.95C610.364 1078.3 610.044 1078.68 609.86 1079.07L608.269 1078.51C608.553 1077.84 608.932 1077.33 609.405 1076.96C609.883 1076.58 610.404 1076.32 610.968 1076.18C611.536 1076.02 612.095 1075.95 612.644 1075.95C612.994 1075.95 613.397 1075.99 613.851 1076.08C614.31 1076.16 614.753 1076.33 615.179 1076.58C615.61 1076.84 615.968 1077.22 616.252 1077.74C616.536 1078.25 616.678 1078.95 616.678 1079.81V1087H615.002V1085.52H614.917C614.803 1085.76 614.614 1086.01 614.348 1086.28C614.083 1086.55 613.73 1086.78 613.29 1086.97C612.85 1087.16 612.312 1087.26 611.678 1087.26ZM611.934 1085.75C612.596 1085.75 613.155 1085.62 613.61 1085.36C614.069 1085.1 614.415 1084.76 614.647 1084.35C614.883 1083.94 615.002 1083.51 615.002 1083.05V1081.52C614.931 1081.6 614.775 1081.68 614.533 1081.75C614.296 1081.82 614.022 1081.88 613.709 1081.93C613.401 1081.98 613.101 1082.02 612.807 1082.06C612.518 1082.09 612.284 1082.12 612.104 1082.14C611.668 1082.2 611.261 1082.29 610.882 1082.42C610.508 1082.54 610.205 1082.73 609.973 1082.98C609.746 1083.23 609.632 1083.56 609.632 1083.99C609.632 1084.57 609.848 1085.01 610.279 1085.31C610.714 1085.6 611.266 1085.75 611.934 1085.75ZM621.413 1080.44V1087H619.737V1076.09H621.357V1077.8H621.499C621.754 1077.24 622.143 1076.8 622.663 1076.46C623.184 1076.12 623.857 1075.95 624.68 1075.95C625.419 1075.95 626.065 1076.1 626.619 1076.4C627.173 1076.7 627.604 1077.16 627.912 1077.77C628.22 1078.37 628.374 1079.14 628.374 1080.07V1087H626.697V1080.18C626.697 1079.32 626.475 1078.66 626.03 1078.18C625.585 1077.7 624.974 1077.45 624.197 1077.45C623.662 1077.45 623.184 1077.57 622.763 1077.8C622.346 1078.03 622.017 1078.37 621.776 1078.82C621.534 1079.26 621.413 1079.8 621.413 1080.44ZM634.647 1087.26C633.955 1087.26 633.328 1087.13 632.765 1086.87C632.201 1086.6 631.754 1086.22 631.422 1085.72C631.091 1085.22 630.925 1084.61 630.925 1083.9C630.925 1083.28 631.048 1082.77 631.294 1082.38C631.541 1081.99 631.87 1081.68 632.282 1081.46C632.694 1081.24 633.148 1081.07 633.645 1080.96C634.147 1080.85 634.651 1080.76 635.158 1080.69C635.821 1080.61 636.358 1080.54 636.77 1080.5C637.187 1080.45 637.49 1080.38 637.679 1080.27C637.873 1080.16 637.971 1079.97 637.971 1079.7V1079.64C637.971 1078.94 637.779 1078.4 637.395 1078.01C637.016 1077.62 636.441 1077.43 635.669 1077.43C634.869 1077.43 634.242 1077.6 633.787 1077.95C633.333 1078.3 633.013 1078.68 632.828 1079.07L631.238 1078.51C631.522 1077.84 631.9 1077.33 632.374 1076.96C632.852 1076.58 633.373 1076.32 633.936 1076.18C634.505 1076.02 635.063 1075.95 635.613 1075.95C635.963 1075.95 636.365 1075.99 636.82 1076.08C637.279 1076.16 637.722 1076.33 638.148 1076.58C638.579 1076.84 638.936 1077.22 639.221 1077.74C639.505 1078.25 639.647 1078.95 639.647 1079.81V1087H637.971V1085.52H637.885C637.772 1085.76 637.582 1086.01 637.317 1086.28C637.052 1086.55 636.699 1086.78 636.259 1086.97C635.819 1087.16 635.281 1087.26 634.647 1087.26ZM634.902 1085.75C635.565 1085.75 636.124 1085.62 636.578 1085.36C637.038 1085.1 637.383 1084.76 637.615 1084.35C637.852 1083.94 637.971 1083.51 637.971 1083.05V1081.52C637.9 1081.6 637.743 1081.68 637.502 1081.75C637.265 1081.82 636.99 1081.88 636.678 1081.93C636.37 1081.98 636.069 1082.02 635.776 1082.06C635.487 1082.09 635.253 1082.12 635.073 1082.14C634.637 1082.2 634.23 1082.29 633.851 1082.42C633.477 1082.54 633.174 1082.73 632.942 1082.98C632.715 1083.23 632.601 1083.56 632.601 1083.99C632.601 1084.57 632.817 1085.01 633.248 1085.31C633.683 1085.6 634.235 1085.75 634.902 1085.75ZM647.109 1091.32C646.3 1091.32 645.604 1091.21 645.021 1091.01C644.439 1090.8 643.954 1090.53 643.565 1090.2C643.182 1089.86 642.876 1089.51 642.649 1089.13L643.984 1088.19C644.136 1088.39 644.328 1088.62 644.56 1088.88C644.792 1089.14 645.109 1089.36 645.511 1089.55C645.919 1089.74 646.451 1089.84 647.109 1089.84C647.99 1089.84 648.717 1089.63 649.29 1089.2C649.863 1088.78 650.149 1088.11 650.149 1087.2V1084.98H650.007C649.884 1085.18 649.709 1085.43 649.482 1085.72C649.259 1086.01 648.937 1086.27 648.516 1086.5C648.099 1086.72 647.536 1086.83 646.825 1086.83C645.945 1086.83 645.154 1086.62 644.453 1086.2C643.757 1085.79 643.205 1085.18 642.798 1084.39C642.396 1083.59 642.195 1082.62 642.195 1081.49C642.195 1080.37 642.391 1079.4 642.784 1078.57C643.177 1077.74 643.724 1077.09 644.425 1076.64C645.125 1076.18 645.935 1075.95 646.854 1075.95C647.564 1075.95 648.127 1076.07 648.544 1076.3C648.965 1076.54 649.287 1076.8 649.51 1077.1C649.737 1077.39 649.912 1077.63 650.036 1077.82H650.206V1076.09H651.825V1087.31C651.825 1088.25 651.612 1089.01 651.186 1089.6C650.765 1090.19 650.196 1090.62 649.482 1090.9C648.771 1091.18 647.981 1091.32 647.109 1091.32ZM647.053 1085.32C647.725 1085.32 648.293 1085.17 648.757 1084.86C649.221 1084.55 649.574 1084.11 649.815 1083.53C650.057 1082.96 650.178 1082.27 650.178 1081.46C650.178 1080.67 650.059 1079.98 649.822 1079.38C649.586 1078.78 649.235 1078.31 648.771 1077.97C648.307 1077.62 647.734 1077.45 647.053 1077.45C646.342 1077.45 645.75 1077.63 645.277 1077.99C644.808 1078.35 644.455 1078.84 644.219 1079.44C643.987 1080.05 643.871 1080.72 643.871 1081.46C643.871 1082.22 643.989 1082.89 644.226 1083.47C644.467 1084.05 644.822 1084.5 645.291 1084.83C645.765 1085.16 646.352 1085.32 647.053 1085.32ZM659.467 1087.23C658.416 1087.23 657.509 1087 656.747 1086.53C655.99 1086.06 655.405 1085.41 654.993 1084.57C654.586 1083.73 654.382 1082.75 654.382 1081.63C654.382 1080.51 654.586 1079.53 654.993 1078.68C655.405 1077.82 655.978 1077.15 656.712 1076.67C657.45 1076.19 658.312 1075.95 659.297 1075.95C659.865 1075.95 660.426 1076.04 660.98 1076.23C661.534 1076.42 662.038 1076.73 662.493 1077.16C662.947 1077.58 663.31 1078.14 663.58 1078.83C663.849 1079.53 663.984 1080.39 663.984 1081.4V1082.11H655.575V1080.66H662.28C662.28 1080.05 662.157 1079.5 661.911 1079.02C661.669 1078.53 661.323 1078.15 660.874 1077.87C660.429 1077.59 659.903 1077.45 659.297 1077.45C658.629 1077.45 658.052 1077.62 657.564 1077.95C657.081 1078.28 656.709 1078.7 656.449 1079.23C656.188 1079.76 656.058 1080.32 656.058 1080.92V1081.89C656.058 1082.71 656.2 1083.41 656.484 1083.98C656.773 1084.55 657.173 1084.98 657.685 1085.28C658.196 1085.57 658.79 1085.72 659.467 1085.72C659.908 1085.72 660.305 1085.66 660.661 1085.54C661.02 1085.41 661.33 1085.22 661.591 1084.97C661.851 1084.71 662.053 1084.4 662.195 1084.02L663.814 1084.47C663.643 1085.02 663.357 1085.5 662.955 1085.92C662.552 1086.33 662.055 1086.65 661.463 1086.89C660.871 1087.11 660.206 1087.23 659.467 1087.23ZM674.261 1078.53L672.756 1078.96C672.661 1078.71 672.521 1078.47 672.337 1078.23C672.157 1077.99 671.911 1077.79 671.598 1077.63C671.286 1077.48 670.885 1077.4 670.398 1077.4C669.73 1077.4 669.174 1077.55 668.729 1077.86C668.288 1078.16 668.068 1078.55 668.068 1079.02C668.068 1079.43 668.22 1079.76 668.523 1080C668.826 1080.25 669.299 1080.45 669.943 1080.61L671.562 1081.01C672.538 1081.24 673.265 1081.6 673.743 1082.09C674.221 1082.58 674.46 1083.2 674.46 1083.96C674.46 1084.59 674.28 1085.14 673.92 1085.64C673.565 1086.13 673.068 1086.52 672.429 1086.8C671.79 1087.09 671.046 1087.23 670.199 1087.23C669.086 1087.23 668.165 1086.99 667.436 1086.5C666.707 1086.02 666.245 1085.31 666.051 1084.39L667.642 1083.99C667.794 1084.58 668.08 1085.02 668.501 1085.31C668.928 1085.6 669.484 1085.75 670.17 1085.75C670.952 1085.75 671.572 1085.58 672.031 1085.25C672.495 1084.92 672.727 1084.51 672.727 1084.05C672.727 1083.67 672.595 1083.35 672.33 1083.09C672.064 1082.83 671.657 1082.64 671.108 1082.51L669.29 1082.09C668.291 1081.85 667.557 1081.48 667.088 1080.98C666.624 1080.48 666.392 1079.86 666.392 1079.1C666.392 1078.49 666.565 1077.94 666.911 1077.47C667.261 1077 667.737 1076.62 668.338 1076.35C668.944 1076.08 669.631 1075.95 670.398 1075.95C671.477 1075.95 672.325 1076.19 672.94 1076.66C673.561 1077.13 674.001 1077.76 674.261 1078.53Z" fill="#03031C"/>
+<path d="M817.633 1233L814.309 1222.09H816.07L818.428 1230.44H818.542L820.871 1222.09H822.661L824.962 1230.41H825.076L827.434 1222.09H829.195L825.871 1233H824.224L821.837 1224.62H821.667L819.28 1233H817.633ZM834.621 1233.26C833.93 1233.26 833.303 1233.13 832.739 1232.87C832.176 1232.6 831.728 1232.22 831.397 1231.72C831.065 1231.22 830.9 1230.61 830.9 1229.9C830.9 1229.28 831.023 1228.77 831.269 1228.38C831.515 1227.99 831.844 1227.68 832.256 1227.46C832.668 1227.24 833.123 1227.07 833.62 1226.96C834.122 1226.85 834.626 1226.76 835.133 1226.69C835.796 1226.61 836.333 1226.54 836.745 1226.5C837.162 1226.45 837.465 1226.38 837.654 1226.27C837.848 1226.16 837.945 1225.97 837.945 1225.7V1225.64C837.945 1224.94 837.753 1224.4 837.37 1224.01C836.991 1223.62 836.416 1223.43 835.644 1223.43C834.844 1223.43 834.216 1223.6 833.762 1223.95C833.307 1224.3 832.988 1224.68 832.803 1225.07L831.212 1224.51C831.496 1223.84 831.875 1223.33 832.349 1222.96C832.827 1222.58 833.348 1222.32 833.911 1222.18C834.479 1222.02 835.038 1221.95 835.587 1221.95C835.938 1221.95 836.34 1221.99 836.795 1222.08C837.254 1222.16 837.697 1222.33 838.123 1222.58C838.554 1222.84 838.911 1223.22 839.195 1223.74C839.479 1224.25 839.621 1224.95 839.621 1225.81V1233H837.945V1231.52H837.86C837.746 1231.76 837.557 1232.01 837.292 1232.28C837.027 1232.55 836.674 1232.78 836.233 1232.97C835.793 1233.16 835.256 1233.26 834.621 1233.26ZM834.877 1231.75C835.54 1231.75 836.099 1231.62 836.553 1231.36C837.012 1231.1 837.358 1230.76 837.59 1230.35C837.827 1229.94 837.945 1229.51 837.945 1229.05V1227.52C837.874 1227.6 837.718 1227.68 837.476 1227.75C837.24 1227.82 836.965 1227.88 836.653 1227.93C836.345 1227.98 836.044 1228.02 835.751 1228.06C835.462 1228.09 835.227 1228.12 835.047 1228.14C834.612 1228.2 834.205 1228.29 833.826 1228.42C833.452 1228.54 833.149 1228.73 832.917 1228.98C832.689 1229.23 832.576 1229.56 832.576 1229.99C832.576 1230.57 832.791 1231.01 833.222 1231.31C833.658 1231.6 834.209 1231.75 834.877 1231.75ZM847.425 1222.09V1223.51H841.771V1222.09H847.425ZM843.419 1219.48H845.095V1229.88C845.095 1230.35 845.164 1230.7 845.301 1230.94C845.443 1231.17 845.623 1231.33 845.841 1231.41C846.064 1231.48 846.298 1231.52 846.544 1231.52C846.729 1231.52 846.88 1231.51 846.999 1231.49C847.117 1231.47 847.212 1231.45 847.283 1231.44L847.624 1232.94C847.51 1232.99 847.352 1233.03 847.148 1233.07C846.944 1233.12 846.686 1233.14 846.374 1233.14C845.9 1233.14 845.436 1233.04 844.982 1232.84C844.532 1232.63 844.158 1232.32 843.86 1231.91C843.566 1231.49 843.419 1230.96 843.419 1230.33V1219.48ZM854.261 1233.23C853.238 1233.23 852.357 1232.99 851.619 1232.5C850.88 1232.02 850.312 1231.35 849.914 1230.51C849.517 1229.66 849.318 1228.69 849.318 1227.6C849.318 1226.49 849.521 1225.52 849.928 1224.67C850.34 1223.82 850.913 1223.15 851.647 1222.67C852.386 1222.19 853.248 1221.95 854.232 1221.95C854.999 1221.95 855.691 1222.09 856.306 1222.38C856.922 1222.66 857.426 1223.06 857.819 1223.57C858.212 1224.08 858.456 1224.68 858.551 1225.36H856.874C856.747 1224.86 856.463 1224.42 856.022 1224.04C855.587 1223.65 854.999 1223.45 854.261 1223.45C853.607 1223.45 853.035 1223.62 852.542 1223.97C852.054 1224.3 851.673 1224.78 851.399 1225.39C851.129 1226 850.994 1226.72 850.994 1227.55C850.994 1228.39 851.126 1229.12 851.392 1229.75C851.661 1230.37 852.04 1230.86 852.528 1231.2C853.02 1231.55 853.598 1231.72 854.261 1231.72C854.696 1231.72 855.092 1231.65 855.447 1231.49C855.802 1231.34 856.103 1231.12 856.349 1230.84C856.595 1230.56 856.77 1230.22 856.874 1229.82H858.551C858.456 1230.46 858.222 1231.04 857.847 1231.56C857.478 1232.07 856.988 1232.48 856.377 1232.78C855.771 1233.08 855.066 1233.23 854.261 1233.23ZM862.677 1226.44V1233H861.001V1218.45H862.677V1223.8H862.819C863.075 1223.23 863.458 1222.78 863.97 1222.45C864.486 1222.12 865.172 1221.95 866.029 1221.95C866.773 1221.95 867.424 1222.1 867.982 1222.4C868.541 1222.69 868.974 1223.14 869.282 1223.75C869.595 1224.36 869.751 1225.13 869.751 1226.07V1233H868.075V1226.18C868.075 1225.32 867.85 1224.65 867.4 1224.17C866.955 1223.69 866.337 1223.45 865.546 1223.45C864.997 1223.45 864.505 1223.57 864.069 1223.8C863.638 1224.03 863.297 1224.37 863.046 1224.82C862.8 1225.26 862.677 1225.8 862.677 1226.44ZM877.391 1233.23C876.34 1233.23 875.433 1233 874.671 1232.53C873.913 1232.06 873.329 1231.41 872.917 1230.57C872.51 1229.73 872.306 1228.75 872.306 1227.63C872.306 1226.51 872.51 1225.53 872.917 1224.68C873.329 1223.82 873.902 1223.15 874.635 1222.67C875.374 1222.19 876.236 1221.95 877.221 1221.95C877.789 1221.95 878.35 1222.04 878.904 1222.23C879.458 1222.42 879.962 1222.73 880.417 1223.16C880.871 1223.58 881.233 1224.14 881.503 1224.83C881.773 1225.53 881.908 1226.39 881.908 1227.4V1228.11H873.499V1226.66H880.204C880.204 1226.05 880.081 1225.5 879.834 1225.02C879.593 1224.53 879.247 1224.15 878.797 1223.87C878.352 1223.59 877.827 1223.45 877.221 1223.45C876.553 1223.45 875.975 1223.62 875.488 1223.95C875.005 1224.28 874.633 1224.7 874.373 1225.23C874.112 1225.76 873.982 1226.32 873.982 1226.92V1227.89C873.982 1228.71 874.124 1229.41 874.408 1229.98C874.697 1230.55 875.097 1230.98 875.608 1231.28C876.12 1231.57 876.714 1231.72 877.391 1231.72C877.831 1231.72 878.229 1231.66 878.584 1231.54C878.944 1231.41 879.254 1231.22 879.515 1230.97C879.775 1230.71 879.976 1230.4 880.118 1230.02L881.738 1230.47C881.567 1231.02 881.281 1231.5 880.878 1231.92C880.476 1232.33 879.979 1232.65 879.387 1232.89C878.795 1233.11 878.13 1233.23 877.391 1233.23ZM892.185 1224.53L890.68 1224.96C890.585 1224.71 890.445 1224.47 890.26 1224.23C890.081 1223.99 889.834 1223.79 889.522 1223.63C889.209 1223.48 888.809 1223.4 888.322 1223.4C887.654 1223.4 887.098 1223.55 886.653 1223.86C886.212 1224.16 885.992 1224.55 885.992 1225.02C885.992 1225.43 886.144 1225.76 886.447 1226C886.75 1226.25 887.223 1226.45 887.867 1226.61L889.486 1227.01C890.462 1227.24 891.189 1227.6 891.667 1228.09C892.145 1228.58 892.384 1229.2 892.384 1229.96C892.384 1230.59 892.204 1231.14 891.844 1231.64C891.489 1232.13 890.992 1232.52 890.353 1232.8C889.714 1233.09 888.97 1233.23 888.123 1233.23C887.01 1233.23 886.089 1232.99 885.36 1232.5C884.631 1232.02 884.169 1231.31 883.975 1230.39L885.566 1229.99C885.717 1230.58 886.004 1231.02 886.425 1231.31C886.851 1231.6 887.408 1231.75 888.094 1231.75C888.876 1231.75 889.496 1231.58 889.955 1231.25C890.419 1230.92 890.651 1230.51 890.651 1230.05C890.651 1229.67 890.519 1229.35 890.253 1229.09C889.988 1228.83 889.581 1228.64 889.032 1228.51L887.214 1228.09C886.215 1227.85 885.481 1227.48 885.012 1226.98C884.548 1226.48 884.316 1225.86 884.316 1225.1C884.316 1224.49 884.489 1223.94 884.834 1223.47C885.185 1223 885.661 1222.62 886.262 1222.35C886.868 1222.08 887.555 1221.95 888.322 1221.95C889.401 1221.95 890.249 1222.19 890.864 1222.66C891.484 1223.13 891.925 1223.76 892.185 1224.53Z" fill="#03031C"/>
+<path d="M603.056 1241V1230.09H604.675V1231.74H604.789C604.987 1231.2 605.347 1230.76 605.868 1230.42C606.389 1230.09 606.976 1229.92 607.629 1229.92C607.753 1229.92 607.906 1229.92 608.091 1229.93C608.276 1229.93 608.415 1229.94 608.51 1229.95V1231.65C608.453 1231.64 608.323 1231.62 608.119 1231.59C607.921 1231.56 607.71 1231.54 607.487 1231.54C606.957 1231.54 606.484 1231.65 606.067 1231.87C605.655 1232.09 605.328 1232.39 605.087 1232.78C604.85 1233.17 604.732 1233.6 604.732 1234.1V1241H603.056ZM614.739 1241.23C613.688 1241.23 612.781 1241 612.019 1240.53C611.261 1240.06 610.676 1239.41 610.264 1238.57C609.857 1237.73 609.654 1236.75 609.654 1235.63C609.654 1234.51 609.857 1233.53 610.264 1232.68C610.676 1231.82 611.249 1231.15 611.983 1230.67C612.722 1230.19 613.584 1229.95 614.568 1229.95C615.137 1229.95 615.698 1230.04 616.252 1230.23C616.806 1230.42 617.31 1230.73 617.764 1231.16C618.219 1231.58 618.581 1232.14 618.851 1232.83C619.121 1233.53 619.256 1234.39 619.256 1235.4V1236.11H610.847V1234.66H617.551C617.551 1234.05 617.428 1233.5 617.182 1233.02C616.941 1232.53 616.595 1232.15 616.145 1231.87C615.7 1231.59 615.174 1231.45 614.568 1231.45C613.901 1231.45 613.323 1231.62 612.835 1231.95C612.352 1232.28 611.981 1232.7 611.72 1233.23C611.46 1233.76 611.33 1234.32 611.33 1234.92V1235.89C611.33 1236.71 611.472 1237.41 611.756 1237.98C612.045 1238.55 612.445 1238.98 612.956 1239.28C613.468 1239.57 614.062 1239.72 614.739 1239.72C615.179 1239.72 615.577 1239.66 615.932 1239.54C616.292 1239.41 616.602 1239.22 616.862 1238.97C617.123 1238.71 617.324 1238.4 617.466 1238.02L619.085 1238.47C618.915 1239.02 618.628 1239.5 618.226 1239.92C617.824 1240.33 617.326 1240.65 616.735 1240.89C616.143 1241.11 615.477 1241.23 614.739 1241.23ZM626.664 1230.09V1231.51H620.783V1230.09H626.664ZM622.544 1241V1228.59C622.544 1227.96 622.691 1227.44 622.985 1227.02C623.278 1226.61 623.659 1226.29 624.128 1226.09C624.597 1225.88 625.092 1225.77 625.612 1225.77C626.024 1225.77 626.36 1225.81 626.621 1225.87C626.881 1225.94 627.075 1226 627.203 1226.06L626.72 1227.51C626.635 1227.48 626.517 1227.44 626.365 1227.4C626.218 1227.36 626.024 1227.34 625.783 1227.34C625.229 1227.34 624.829 1227.47 624.583 1227.75C624.341 1228.03 624.22 1228.44 624.22 1228.98V1241H622.544Z" fill="#03031C"/>
+<path d="M736.207 1200.79C735.817 1200.4 735.183 1200.4 734.793 1200.79L728.429 1207.16C728.038 1207.55 728.038 1208.18 728.429 1208.57C728.819 1208.96 729.453 1208.96 729.843 1208.57L735.5 1202.91L741.157 1208.57C741.547 1208.96 742.181 1208.96 742.571 1208.57C742.962 1208.18 742.962 1207.55 742.571 1207.16L736.207 1200.79ZM734.5 1248.12V1253.84H736.5V1248.12H734.5ZM734.5 1265.28V1271H736.5V1265.28H734.5ZM734.5 1201.5V1206.5H736.5V1201.5H734.5ZM734.5 1216.5V1221.5H736.5V1216.5H734.5Z" fill="#03031C"/>
+<path d="M724.056 1241V1230.09H725.675V1231.74H725.789C725.987 1231.2 726.347 1230.76 726.868 1230.42C727.389 1230.09 727.976 1229.92 728.629 1229.92C728.753 1229.92 728.906 1229.92 729.091 1229.93C729.276 1229.93 729.415 1229.94 729.51 1229.95V1231.65C729.453 1231.64 729.323 1231.62 729.119 1231.59C728.921 1231.56 728.71 1231.54 728.487 1231.54C727.957 1231.54 727.484 1231.65 727.067 1231.87C726.655 1232.09 726.328 1232.39 726.087 1232.78C725.85 1233.17 725.732 1233.6 725.732 1234.1V1241H724.056ZM735.739 1241.23C734.688 1241.23 733.781 1241 733.019 1240.53C732.261 1240.06 731.676 1239.41 731.264 1238.57C730.857 1237.73 730.654 1236.75 730.654 1235.63C730.654 1234.51 730.857 1233.53 731.264 1232.68C731.676 1231.82 732.249 1231.15 732.983 1230.67C733.722 1230.19 734.584 1229.95 735.568 1229.95C736.137 1229.95 736.698 1230.04 737.252 1230.23C737.806 1230.42 738.31 1230.73 738.764 1231.16C739.219 1231.58 739.581 1232.14 739.851 1232.83C740.121 1233.53 740.256 1234.39 740.256 1235.4V1236.11H731.847V1234.66H738.551C738.551 1234.05 738.428 1233.5 738.182 1233.02C737.941 1232.53 737.595 1232.15 737.145 1231.87C736.7 1231.59 736.174 1231.45 735.568 1231.45C734.901 1231.45 734.323 1231.62 733.835 1231.95C733.352 1232.28 732.981 1232.7 732.72 1233.23C732.46 1233.76 732.33 1234.32 732.33 1234.92V1235.89C732.33 1236.71 732.472 1237.41 732.756 1237.98C733.045 1238.55 733.445 1238.98 733.956 1239.28C734.468 1239.57 735.062 1239.72 735.739 1239.72C736.179 1239.72 736.577 1239.66 736.932 1239.54C737.292 1239.41 737.602 1239.22 737.862 1238.97C738.123 1238.71 738.324 1238.4 738.466 1238.02L740.085 1238.47C739.915 1239.02 739.628 1239.5 739.226 1239.92C738.824 1240.33 738.326 1240.65 737.735 1240.89C737.143 1241.11 736.477 1241.23 735.739 1241.23ZM747.664 1230.09V1231.51H741.783V1230.09H747.664ZM743.544 1241V1228.59C743.544 1227.96 743.691 1227.44 743.985 1227.02C744.278 1226.61 744.659 1226.29 745.128 1226.09C745.597 1225.88 746.092 1225.77 746.612 1225.77C747.024 1225.77 747.36 1225.81 747.621 1225.87C747.881 1225.94 748.075 1226 748.203 1226.06L747.72 1227.51C747.635 1227.48 747.517 1227.44 747.365 1227.4C747.218 1227.36 747.024 1227.34 746.783 1227.34C746.229 1227.34 745.829 1227.47 745.583 1227.75C745.341 1228.03 745.22 1228.44 745.22 1228.98V1241H743.544Z" fill="#03031C"/>
+<path d="M975.207 1200.79C974.817 1200.4 974.183 1200.4 973.793 1200.79L967.429 1207.16C967.038 1207.55 967.038 1208.18 967.429 1208.57C967.819 1208.96 968.453 1208.96 968.843 1208.57L974.5 1202.91L980.157 1208.57C980.547 1208.96 981.181 1208.96 981.571 1208.57C981.962 1208.18 981.962 1207.55 981.571 1207.16L975.207 1200.79ZM973.5 1248.12V1253.84H975.5V1248.12H973.5ZM973.5 1265.28V1271H975.5V1265.28H973.5ZM973.5 1201.5V1206.5H975.5V1201.5H973.5ZM973.5 1216.5V1221.5H975.5V1216.5H973.5Z" fill="#03031C"/>
+<path d="M963.056 1241V1230.09H964.675V1231.74H964.789C964.987 1231.2 965.347 1230.76 965.868 1230.42C966.389 1230.09 966.976 1229.92 967.629 1229.92C967.753 1229.92 967.906 1229.92 968.091 1229.93C968.276 1229.93 968.415 1229.94 968.51 1229.95V1231.65C968.453 1231.64 968.323 1231.62 968.119 1231.59C967.921 1231.56 967.71 1231.54 967.487 1231.54C966.957 1231.54 966.484 1231.65 966.067 1231.87C965.655 1232.09 965.328 1232.39 965.087 1232.78C964.85 1233.17 964.732 1233.6 964.732 1234.1V1241H963.056ZM974.739 1241.23C973.688 1241.23 972.781 1241 972.019 1240.53C971.261 1240.06 970.676 1239.41 970.264 1238.57C969.857 1237.73 969.654 1236.75 969.654 1235.63C969.654 1234.51 969.857 1233.53 970.264 1232.68C970.676 1231.82 971.249 1231.15 971.983 1230.67C972.722 1230.19 973.584 1229.95 974.568 1229.95C975.137 1229.95 975.698 1230.04 976.252 1230.23C976.806 1230.42 977.31 1230.73 977.764 1231.16C978.219 1231.58 978.581 1232.14 978.851 1232.83C979.121 1233.53 979.256 1234.39 979.256 1235.4V1236.11H970.847V1234.66H977.551C977.551 1234.05 977.428 1233.5 977.182 1233.02C976.941 1232.53 976.595 1232.15 976.145 1231.87C975.7 1231.59 975.174 1231.45 974.568 1231.45C973.901 1231.45 973.323 1231.62 972.835 1231.95C972.352 1232.28 971.981 1232.7 971.72 1233.23C971.46 1233.76 971.33 1234.32 971.33 1234.92V1235.89C971.33 1236.71 971.472 1237.41 971.756 1237.98C972.045 1238.55 972.445 1238.98 972.956 1239.28C973.468 1239.57 974.062 1239.72 974.739 1239.72C975.179 1239.72 975.577 1239.66 975.932 1239.54C976.292 1239.41 976.602 1239.22 976.862 1238.97C977.123 1238.71 977.324 1238.4 977.466 1238.02L979.085 1238.47C978.915 1239.02 978.628 1239.5 978.226 1239.92C977.824 1240.33 977.326 1240.65 976.735 1240.89C976.143 1241.11 975.477 1241.23 974.739 1241.23ZM986.664 1230.09V1231.51H980.783V1230.09H986.664ZM982.544 1241V1228.59C982.544 1227.96 982.691 1227.44 982.985 1227.02C983.278 1226.61 983.659 1226.29 984.128 1226.09C984.597 1225.88 985.092 1225.77 985.612 1225.77C986.024 1225.77 986.36 1225.81 986.621 1225.87C986.881 1225.94 987.075 1226 987.203 1226.06L986.72 1227.51C986.635 1227.48 986.517 1227.44 986.365 1227.4C986.218 1227.36 986.024 1227.34 985.783 1227.34C985.229 1227.34 984.829 1227.47 984.583 1227.75C984.341 1228.03 984.22 1228.44 984.22 1228.98V1241H982.544Z" fill="#03031C"/>
+<path d="M1096.21 1200.79C1095.82 1200.4 1095.18 1200.4 1094.79 1200.79L1088.43 1207.16C1088.04 1207.55 1088.04 1208.18 1088.43 1208.57C1088.82 1208.96 1089.45 1208.96 1089.84 1208.57L1095.5 1202.91L1101.16 1208.57C1101.55 1208.96 1102.18 1208.96 1102.57 1208.57C1102.96 1208.18 1102.96 1207.55 1102.57 1207.16L1096.21 1200.79ZM1094.5 1248.12V1253.84H1096.5V1248.12H1094.5ZM1094.5 1265.28V1271H1096.5V1265.28H1094.5ZM1094.5 1201.5V1206.5H1096.5V1201.5H1094.5ZM1094.5 1216.5V1221.5H1096.5V1216.5H1094.5Z" fill="#03031C"/>
+<path d="M1084.06 1241V1230.09H1085.67V1231.74H1085.79C1085.99 1231.2 1086.35 1230.76 1086.87 1230.42C1087.39 1230.09 1087.98 1229.92 1088.63 1229.92C1088.75 1229.92 1088.91 1229.92 1089.09 1229.93C1089.28 1229.93 1089.42 1229.94 1089.51 1229.95V1231.65C1089.45 1231.64 1089.32 1231.62 1089.12 1231.59C1088.92 1231.56 1088.71 1231.54 1088.49 1231.54C1087.96 1231.54 1087.48 1231.65 1087.07 1231.87C1086.66 1232.09 1086.33 1232.39 1086.09 1232.78C1085.85 1233.17 1085.73 1233.6 1085.73 1234.1V1241H1084.06ZM1095.74 1241.23C1094.69 1241.23 1093.78 1241 1093.02 1240.53C1092.26 1240.06 1091.68 1239.41 1091.26 1238.57C1090.86 1237.73 1090.65 1236.75 1090.65 1235.63C1090.65 1234.51 1090.86 1233.53 1091.26 1232.68C1091.68 1231.82 1092.25 1231.15 1092.98 1230.67C1093.72 1230.19 1094.58 1229.95 1095.57 1229.95C1096.14 1229.95 1096.7 1230.04 1097.25 1230.23C1097.81 1230.42 1098.31 1230.73 1098.76 1231.16C1099.22 1231.58 1099.58 1232.14 1099.85 1232.83C1100.12 1233.53 1100.26 1234.39 1100.26 1235.4V1236.11H1091.85V1234.66H1098.55C1098.55 1234.05 1098.43 1233.5 1098.18 1233.02C1097.94 1232.53 1097.59 1232.15 1097.15 1231.87C1096.7 1231.59 1096.17 1231.45 1095.57 1231.45C1094.9 1231.45 1094.32 1231.62 1093.84 1231.95C1093.35 1232.28 1092.98 1232.7 1092.72 1233.23C1092.46 1233.76 1092.33 1234.32 1092.33 1234.92V1235.89C1092.33 1236.71 1092.47 1237.41 1092.76 1237.98C1093.04 1238.55 1093.44 1238.98 1093.96 1239.28C1094.47 1239.57 1095.06 1239.72 1095.74 1239.72C1096.18 1239.72 1096.58 1239.66 1096.93 1239.54C1097.29 1239.41 1097.6 1239.22 1097.86 1238.97C1098.12 1238.71 1098.32 1238.4 1098.47 1238.02L1100.09 1238.47C1099.91 1239.02 1099.63 1239.5 1099.23 1239.92C1098.82 1240.33 1098.33 1240.65 1097.73 1240.89C1097.14 1241.11 1096.48 1241.23 1095.74 1241.23ZM1107.66 1230.09V1231.51H1101.78V1230.09H1107.66ZM1103.54 1241V1228.59C1103.54 1227.96 1103.69 1227.44 1103.98 1227.02C1104.28 1226.61 1104.66 1226.29 1105.13 1226.09C1105.6 1225.88 1106.09 1225.77 1106.61 1225.77C1107.02 1225.77 1107.36 1225.81 1107.62 1225.87C1107.88 1225.94 1108.08 1226 1108.2 1226.06L1107.72 1227.51C1107.64 1227.48 1107.52 1227.44 1107.37 1227.4C1107.22 1227.36 1107.02 1227.34 1106.78 1227.34C1106.23 1227.34 1105.83 1227.47 1105.58 1227.75C1105.34 1228.03 1105.22 1228.44 1105.22 1228.98V1241H1103.54Z" fill="#03031C"/>
+<path d="M842.871 923.338C847.975 915.776 845.983 905.507 838.421 900.403C830.859 895.298 820.59 897.29 815.486 904.852C810.381 912.415 812.374 922.683 819.936 927.788C827.498 932.892 837.766 930.9 842.871 923.338Z" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M838.141 918.666C840.664 913.714 838.695 907.656 833.744 905.133C828.793 902.61 822.734 904.579 820.212 909.53C817.689 914.481 819.658 920.54 824.609 923.063C829.56 925.585 835.619 923.617 838.141 918.666Z" fill="#EA26A9"/>
+<path d="M890.089 979.459C897.651 974.355 899.643 964.086 894.539 956.524C889.434 948.962 879.166 946.97 871.604 952.074C864.041 957.179 862.049 967.447 867.154 975.01C872.258 982.572 882.527 984.564 890.089 979.459Z" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M885.412 974.734C890.363 972.211 892.332 966.152 889.809 961.201C887.286 956.25 881.227 954.281 876.276 956.804C871.325 959.327 869.356 965.385 871.879 970.337C874.402 975.288 880.461 977.256 885.412 974.734Z" fill="#8438FA"/>
+<path d="M855 903.92C864.452 903.92 873.517 907.721 880.201 914.488C886.885 921.254 890.64 930.431 890.64 940" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M819.36 940C819.36 944.68 820.282 949.315 822.073 953.639C823.864 957.963 826.489 961.892 829.799 965.201C836.483 971.885 845.548 975.64 855 975.64" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M812.32 944.4L818.92 937.8L825.52 944.4" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M897.24 933.84L890.64 940.44L884.04 933.84" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#filter19_bd_12_480)">
+<rect x="1370" y="459" width="210" height="197" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="1370.5" y="459.5" width="209" height="196" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M1426.56 614.284C1425.43 614.284 1424.42 613.997 1423.55 613.423C1422.68 612.843 1422 612.026 1421.51 610.973C1421.02 609.913 1420.77 608.661 1420.77 607.217C1420.77 605.785 1421.02 604.542 1421.51 603.489C1422 602.435 1422.69 601.621 1423.56 601.047C1424.44 600.473 1425.45 600.186 1426.6 600.186C1427.49 600.186 1428.19 600.334 1428.7 600.63C1429.22 600.92 1429.62 601.251 1429.89 601.624C1430.17 601.991 1430.39 602.293 1430.54 602.53H1430.72V595.818H1432.81V614H1430.79V611.905H1430.54C1430.39 612.153 1430.17 612.467 1429.88 612.846C1429.6 613.219 1429.19 613.553 1428.67 613.849C1428.14 614.139 1427.44 614.284 1426.56 614.284ZM1426.85 612.402C1427.69 612.402 1428.4 612.183 1428.98 611.745C1429.56 611.301 1430 610.689 1430.3 609.907C1430.6 609.12 1430.75 608.212 1430.75 607.182C1430.75 606.164 1430.6 605.273 1430.31 604.51C1430.01 603.74 1429.57 603.142 1428.99 602.716C1428.41 602.284 1427.7 602.068 1426.85 602.068C1425.96 602.068 1425.22 602.296 1424.63 602.752C1424.04 603.202 1423.6 603.814 1423.3 604.589C1423.01 605.359 1422.87 606.223 1422.87 607.182C1422.87 608.152 1423.02 609.034 1423.31 609.827C1423.61 610.615 1424.06 611.242 1424.64 611.71C1425.24 612.171 1425.97 612.402 1426.85 612.402ZM1440.95 614.32C1440.09 614.32 1439.3 614.157 1438.6 613.831C1437.9 613.5 1437.34 613.023 1436.92 612.402C1436.51 611.775 1436.3 611.017 1436.3 610.129C1436.3 609.348 1436.45 608.715 1436.76 608.229C1437.07 607.738 1437.48 607.353 1438 607.075C1438.51 606.797 1439.08 606.59 1439.7 606.454C1440.33 606.312 1440.96 606.199 1441.59 606.116C1442.42 606.01 1443.09 605.93 1443.61 605.877C1444.13 605.818 1444.51 605.72 1444.74 605.584C1444.99 605.448 1445.11 605.211 1445.11 604.874V604.803C1445.11 603.927 1444.87 603.246 1444.39 602.761C1443.92 602.275 1443.2 602.033 1442.23 602.033C1441.23 602.033 1440.45 602.252 1439.88 602.69C1439.31 603.128 1438.91 603.595 1438.68 604.092L1436.69 603.382C1437.05 602.554 1437.52 601.908 1438.11 601.447C1438.71 600.979 1439.36 600.654 1440.07 600.47C1440.78 600.281 1441.47 600.186 1442.16 600.186C1442.6 600.186 1443.1 600.239 1443.67 600.346C1444.24 600.446 1444.8 600.657 1445.33 600.976C1445.87 601.296 1446.32 601.778 1446.67 602.423C1447.03 603.068 1447.2 603.933 1447.2 605.016V614H1445.11V612.153H1445C1444.86 612.449 1444.62 612.766 1444.29 613.103C1443.96 613.441 1443.52 613.728 1442.97 613.964C1442.42 614.201 1441.75 614.32 1440.95 614.32ZM1441.27 612.438C1442.1 612.438 1442.8 612.275 1443.37 611.949C1443.94 611.624 1444.37 611.203 1444.66 610.689C1444.96 610.174 1445.11 609.632 1445.11 609.064V607.146C1445.02 607.253 1444.82 607.35 1444.52 607.439C1444.23 607.522 1443.88 607.596 1443.49 607.661C1443.11 607.72 1442.73 607.774 1442.36 607.821C1442 607.862 1441.71 607.898 1441.49 607.928C1440.94 607.999 1440.43 608.114 1439.96 608.274C1439.49 608.428 1439.11 608.661 1438.82 608.975C1438.54 609.283 1438.4 609.703 1438.4 610.236C1438.4 610.964 1438.67 611.514 1439.2 611.887C1439.75 612.254 1440.44 612.438 1441.27 612.438ZM1456.96 600.364V602.139H1449.89V600.364H1456.96ZM1451.95 597.097H1454.05V610.094C1454.05 610.686 1454.13 611.129 1454.3 611.425C1454.48 611.715 1454.71 611.911 1454.98 612.011C1455.26 612.106 1455.55 612.153 1455.86 612.153C1456.09 612.153 1456.28 612.142 1456.42 612.118C1456.57 612.088 1456.69 612.065 1456.78 612.047L1457.21 613.929C1457.06 613.982 1456.87 614.036 1456.61 614.089C1456.36 614.148 1456.03 614.178 1455.64 614.178C1455.05 614.178 1454.47 614.05 1453.9 613.796C1453.34 613.541 1452.87 613.154 1452.5 612.633C1452.13 612.112 1451.95 611.455 1451.95 610.662V597.097ZM1464.12 614.32C1463.26 614.32 1462.47 614.157 1461.77 613.831C1461.06 613.5 1460.51 613.023 1460.09 612.402C1459.68 611.775 1459.47 611.017 1459.47 610.129C1459.47 609.348 1459.62 608.715 1459.93 608.229C1460.24 607.738 1460.65 607.353 1461.17 607.075C1461.68 606.797 1462.25 606.59 1462.87 606.454C1463.5 606.312 1464.13 606.199 1464.76 606.116C1465.59 606.01 1466.26 605.93 1466.78 605.877C1467.3 605.818 1467.68 605.72 1467.91 605.584C1468.16 605.448 1468.28 605.211 1468.28 604.874V604.803C1468.28 603.927 1468.04 603.246 1467.56 602.761C1467.08 602.275 1466.36 602.033 1465.4 602.033C1464.4 602.033 1463.62 602.252 1463.05 602.69C1462.48 603.128 1462.08 603.595 1461.85 604.092L1459.86 603.382C1460.22 602.554 1460.69 601.908 1461.28 601.447C1461.88 600.979 1462.53 600.654 1463.23 600.47C1463.94 600.281 1464.64 600.186 1465.33 600.186C1465.77 600.186 1466.27 600.239 1466.84 600.346C1467.41 600.446 1467.97 600.657 1468.5 600.976C1469.04 601.296 1469.48 601.778 1469.84 602.423C1470.19 603.068 1470.37 603.933 1470.37 605.016V614H1468.28V612.153H1468.17C1468.03 612.449 1467.79 612.766 1467.46 613.103C1467.13 613.441 1466.69 613.728 1466.14 613.964C1465.59 614.201 1464.91 614.32 1464.12 614.32ZM1464.44 612.438C1465.27 612.438 1465.97 612.275 1466.54 611.949C1467.11 611.624 1467.54 611.203 1467.83 610.689C1468.13 610.174 1468.28 609.632 1468.28 609.064V607.146C1468.19 607.253 1467.99 607.35 1467.69 607.439C1467.39 607.522 1467.05 607.596 1466.66 607.661C1466.28 607.72 1465.9 607.774 1465.53 607.821C1465.17 607.862 1464.88 607.898 1464.65 607.928C1464.11 607.999 1463.6 608.114 1463.13 608.274C1462.66 608.428 1462.28 608.661 1461.99 608.975C1461.71 609.283 1461.56 609.703 1461.56 610.236C1461.56 610.964 1461.83 611.514 1462.37 611.887C1462.92 612.254 1463.61 612.438 1464.44 612.438ZM1474.48 614V595.818H1476.58V602.53H1476.75C1476.91 602.293 1477.12 601.991 1477.39 601.624C1477.67 601.251 1478.07 600.92 1478.58 600.63C1479.1 600.334 1479.81 600.186 1480.69 600.186C1481.84 600.186 1482.85 600.473 1483.73 601.047C1484.61 601.621 1485.29 602.435 1485.78 603.489C1486.27 604.542 1486.52 605.785 1486.52 607.217C1486.52 608.661 1486.27 609.913 1485.78 610.973C1485.29 612.026 1484.61 612.843 1483.74 613.423C1482.87 613.997 1481.87 614.284 1480.73 614.284C1479.85 614.284 1479.15 614.139 1478.63 613.849C1478.1 613.553 1477.69 613.219 1477.41 612.846C1477.13 612.467 1476.91 612.153 1476.75 611.905H1476.5V614H1474.48ZM1476.54 607.182C1476.54 608.212 1476.69 609.12 1476.99 609.907C1477.29 610.689 1477.74 611.301 1478.32 611.745C1478.9 612.183 1479.61 612.402 1480.45 612.402C1481.32 612.402 1482.05 612.171 1482.64 611.71C1483.23 611.242 1483.67 610.615 1483.97 609.827C1484.27 609.034 1484.42 608.152 1484.42 607.182C1484.42 606.223 1484.28 605.359 1483.98 604.589C1483.69 603.814 1483.25 603.202 1482.66 602.752C1482.07 602.296 1481.33 602.068 1480.45 602.068C1479.59 602.068 1478.88 602.284 1478.3 602.716C1477.72 603.142 1477.28 603.74 1476.98 604.51C1476.69 605.273 1476.54 606.164 1476.54 607.182ZM1493.74 614.32C1492.87 614.32 1492.09 614.157 1491.38 613.831C1490.68 613.5 1490.12 613.023 1489.71 612.402C1489.29 611.775 1489.08 611.017 1489.08 610.129C1489.08 609.348 1489.24 608.715 1489.55 608.229C1489.85 607.738 1490.26 607.353 1490.78 607.075C1491.29 606.797 1491.86 606.59 1492.48 606.454C1493.11 606.312 1493.74 606.199 1494.38 606.116C1495.2 606.01 1495.88 605.93 1496.39 605.877C1496.91 605.818 1497.29 605.72 1497.53 605.584C1497.77 605.448 1497.89 605.211 1497.89 604.874V604.803C1497.89 603.927 1497.65 603.246 1497.17 602.761C1496.7 602.275 1495.98 602.033 1495.01 602.033C1494.01 602.033 1493.23 602.252 1492.66 602.69C1492.09 603.128 1491.69 603.595 1491.46 604.092L1489.47 603.382C1489.83 602.554 1490.3 601.908 1490.9 601.447C1491.49 600.979 1492.14 600.654 1492.85 600.47C1493.56 600.281 1494.26 600.186 1494.94 600.186C1495.38 600.186 1495.88 600.239 1496.45 600.346C1497.03 600.446 1497.58 600.657 1498.11 600.976C1498.65 601.296 1499.1 601.778 1499.45 602.423C1499.81 603.068 1499.99 603.933 1499.99 605.016V614H1497.89V612.153H1497.78C1497.64 612.449 1497.41 612.766 1497.07 613.103C1496.74 613.441 1496.3 613.728 1495.75 613.964C1495.2 614.201 1494.53 614.32 1493.74 614.32ZM1494.06 612.438C1494.88 612.438 1495.58 612.275 1496.15 611.949C1496.72 611.624 1497.16 611.203 1497.45 610.689C1497.74 610.174 1497.89 609.632 1497.89 609.064V607.146C1497.8 607.253 1497.61 607.35 1497.3 607.439C1497.01 607.522 1496.67 607.596 1496.28 607.661C1495.89 607.72 1495.51 607.774 1495.15 607.821C1494.79 607.862 1494.49 607.898 1494.27 607.928C1493.72 607.999 1493.22 608.114 1492.74 608.274C1492.27 608.428 1491.9 608.661 1491.61 608.975C1491.32 609.283 1491.18 609.703 1491.18 610.236C1491.18 610.964 1491.45 611.514 1491.99 611.887C1492.53 612.254 1493.22 612.438 1494.06 612.438ZM1513.47 603.418L1511.59 603.95C1511.47 603.637 1511.29 603.332 1511.06 603.036C1510.84 602.734 1510.53 602.485 1510.14 602.29C1509.75 602.095 1509.25 601.997 1508.64 601.997C1507.81 601.997 1507.11 602.19 1506.55 602.574C1506 602.953 1505.73 603.435 1505.73 604.021C1505.73 604.542 1505.92 604.953 1506.3 605.255C1506.67 605.557 1507.27 605.809 1508.07 606.01L1510.1 606.507C1511.31 606.803 1512.22 607.256 1512.82 607.865C1513.42 608.469 1513.72 609.247 1513.72 610.2C1513.72 610.982 1513.49 611.68 1513.04 612.295C1512.6 612.911 1511.98 613.396 1511.18 613.751C1510.38 614.107 1509.45 614.284 1508.39 614.284C1507 614.284 1505.85 613.982 1504.94 613.379C1504.03 612.775 1503.45 611.893 1503.21 610.733L1505.2 610.236C1505.38 610.97 1505.74 611.52 1506.27 611.887C1506.8 612.254 1507.5 612.438 1508.36 612.438C1509.33 612.438 1510.11 612.23 1510.68 611.816C1511.26 611.396 1511.55 610.893 1511.55 610.307C1511.55 609.833 1511.39 609.437 1511.05 609.117C1510.72 608.792 1510.21 608.549 1509.53 608.389L1507.25 607.857C1506.01 607.561 1505.09 607.102 1504.5 606.48C1503.92 605.853 1503.63 605.069 1503.63 604.128C1503.63 603.358 1503.85 602.678 1504.28 602.086C1504.72 601.494 1505.31 601.029 1506.07 600.692C1506.82 600.355 1507.68 600.186 1508.64 600.186C1509.99 600.186 1511.05 600.482 1511.82 601.074C1512.59 601.666 1513.14 602.447 1513.47 603.418ZM1522.59 614.284C1521.28 614.284 1520.14 613.994 1519.19 613.414C1518.24 612.828 1517.51 612.011 1517 610.964C1516.49 609.91 1516.23 608.685 1516.23 607.288C1516.23 605.892 1516.49 604.661 1517 603.595C1517.51 602.524 1518.23 601.689 1519.14 601.092C1520.07 600.488 1521.14 600.186 1522.38 600.186C1523.09 600.186 1523.79 600.304 1524.48 600.541C1525.17 600.778 1525.8 601.163 1526.37 601.695C1526.94 602.222 1527.39 602.92 1527.73 603.79C1528.07 604.661 1528.24 605.732 1528.24 607.004V607.892H1517.72V606.081H1526.1C1526.1 605.312 1525.95 604.625 1525.64 604.021C1525.34 603.418 1524.91 602.941 1524.35 602.592C1523.79 602.243 1523.13 602.068 1522.38 602.068C1521.54 602.068 1520.82 602.275 1520.21 602.69C1519.61 603.098 1519.14 603.631 1518.82 604.288C1518.49 604.945 1518.33 605.649 1518.33 606.401V607.608C1518.33 608.638 1518.51 609.511 1518.86 610.227C1519.22 610.937 1519.72 611.479 1520.36 611.852C1521 612.219 1521.74 612.402 1522.59 612.402C1523.14 612.402 1523.64 612.325 1524.08 612.171C1524.53 612.011 1524.92 611.775 1525.24 611.461C1525.57 611.141 1525.82 610.745 1526 610.271L1528.02 610.839C1527.81 611.526 1527.45 612.13 1526.95 612.651C1526.44 613.165 1525.82 613.568 1525.08 613.858C1524.34 614.142 1523.51 614.284 1522.59 614.284Z" fill="#03031C"/>
+<path d="M1287 558H1363" stroke="#03031C" stroke-width="2"/>
+<path d="M1475 510.704C1494.3 510.704 1509.94 506.893 1509.94 502.192C1509.94 497.491 1494.3 493.68 1475 493.68C1455.7 493.68 1440.06 497.491 1440.06 502.192C1440.06 506.893 1455.7 510.704 1475 510.704Z" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1509.94 553.264V566.176C1509.94 570.923 1494.3 574.768 1475 574.768C1455.7 574.768 1440.06 570.946 1440.06 566.176V553.264" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1509.94 532.208V544.851C1509.94 549.499 1494.3 553.264 1475 553.264C1455.7 553.264 1440.06 549.521 1440.06 544.851V532.208" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1509.94 510.704V523.614C1509.94 528.358 1494.3 532.208 1475 532.208C1455.7 532.208 1440.06 528.388 1440.06 523.614V510.704" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1488.51 567.403C1491.11 567.403 1493.63 567.342 1496.06 567.211L1495.51 567.319C1488.71 568.469 1481.82 569.011 1474.93 568.937C1458.89 568.937 1445.88 566.46 1445.88 563.407V556.771C1445.87 556.642 1445.9 556.513 1445.95 556.396C1446 556.279 1446.09 556.178 1446.19 556.101C1446.29 556.025 1446.41 555.976 1446.54 555.959C1446.66 555.942 1446.79 555.957 1446.91 556.004C1450.99 557.274 1455.2 558.097 1459.46 558.459V561.88C1459.46 564.926 1472.47 567.403 1488.51 567.403Z" fill="#8438FA"/>
+<path d="M1488.59 546.348C1491.17 546.348 1493.68 546.286 1496.06 546.163L1495.56 546.263C1488.76 547.412 1481.88 547.953 1474.99 547.882C1458.91 547.882 1445.88 545.404 1445.88 542.351V535.715C1445.87 535.586 1445.9 535.457 1445.95 535.34C1446 535.223 1446.09 535.122 1446.19 535.045C1446.29 534.969 1446.41 534.92 1446.54 534.903C1446.66 534.886 1446.79 534.901 1446.91 534.948C1451.01 536.201 1455.22 537.011 1459.49 537.365V540.794C1459.49 543.87 1472.51 546.348 1488.59 546.348Z" fill="#8438FA"/>
+<path d="M1488.59 524.898C1491.17 524.898 1493.68 524.838 1496.06 524.72L1495.56 524.816C1488.76 525.924 1481.88 526.447 1474.99 526.378C1458.91 526.378 1445.88 523.987 1445.88 521.041V514.631C1445.87 514.506 1445.9 514.382 1445.95 514.269C1446 514.156 1446.09 514.058 1446.19 513.984C1446.29 513.91 1446.41 513.863 1446.54 513.846C1446.66 513.83 1446.79 513.845 1446.91 513.89C1451.01 515.099 1455.22 515.881 1459.49 516.222V519.523C1459.49 522.507 1472.51 524.898 1488.59 524.898Z" fill="#8438FA"/>
+<defs>
+<filter id="filter0_bd_12_480" x="101" y="1017" width="260" height="275" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter1_bd_12_480" x="101" y="1280" width="260" height="275" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter2_bd_12_480" x="408" y="77" width="894" height="608" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter3_bd_12_480" x="408" y="782" width="894" height="846" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter4_bd_12_480" x="449" y="124" width="417" height="423" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter5_bd_12_480" x="520" y="393" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter6_bd_12_480" x="512" y="1106" width="326" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter7_bd_12_480" x="872" y="1106" width="326" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter8_bd_12_480" x="647" y="393" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter9_bd_12_480" x="844" y="124" width="417" height="423" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter10_bd_12_480" x="915" y="393" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter11_bd_12_480" x="1042" y="393" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter12_bd_12_480" x="687" y="848" width="336" height="247" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter13_bd_12_480" x="507" y="1230" width="336" height="271" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter14_bd_12_480" x="540" y="1260" width="149" height="129" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter15_bd_12_480" x="661" y="1260" width="149" height="129" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter16_bd_12_480" x="867" y="1230.5" width="336" height="271" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter17_bd_12_480" x="900" y="1260.5" width="149" height="129" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter18_bd_12_480" x="1021" y="1260.5" width="149" height="129" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+<filter id="filter19_bd_12_480" x="1345" y="438" width="260" height="247" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_480"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_480" result="effect2_dropShadow_12_480"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_480" result="shape"/>
+</filter>
+</defs>
+</svg>
diff --git a/img/operator/tyk-operator.svg b/img/operator/tyk-operator.svg
new file mode 100644
index 0000000000..2b889a1c26
--- /dev/null
+++ b/img/operator/tyk-operator.svg
@@ -0,0 +1,133 @@
+<svg width="1500" height="985" viewBox="0 0 1500 985" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g filter="url(#filter0_bd_12_284)">
+<rect x="401" y="74" width="677" height="838" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="402" y="75" width="675" height="836" rx="19" stroke="#335FFD" stroke-width="2" shape-rendering="crispEdges"/>
+</g>
+<g filter="url(#filter1_bd_12_284)">
+<rect x="480" y="176" width="513" height="196" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="480.5" y="176.5" width="512" height="195" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<g filter="url(#filter2_bd_12_284)">
+<rect x="480" y="523" width="513" height="238" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="480.5" y="523.5" width="512" height="237" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<rect x="718.65" y="534.65" width="263.7" height="215.7" rx="14.35" fill="white" fill-opacity="0.85" stroke="#8438FA" stroke-width="1.3" stroke-dasharray="10 10"/>
+<path d="M771.432 674.988V671.818H786.364V674.988H780.798V690H776.998V674.988H771.432ZM789.525 695.114C789.045 695.114 788.596 695.075 788.175 694.998C787.761 694.927 787.418 694.835 787.146 694.723L787.998 691.9C788.442 692.036 788.841 692.11 789.196 692.122C789.557 692.134 789.868 692.051 790.128 691.873C790.395 691.696 790.611 691.394 790.777 690.968L790.998 690.391L786.107 676.364H790.084L792.907 686.378H793.049L795.899 676.364H799.903L794.603 691.474C794.348 692.208 794.002 692.847 793.564 693.391C793.132 693.942 792.585 694.365 791.922 694.661C791.259 694.963 790.46 695.114 789.525 695.114ZM805.265 686.076L805.274 681.539H805.824L810.192 676.364H814.534L808.665 683.217H807.769L805.265 686.076ZM801.838 690V671.818H805.62V690H801.838ZM810.361 690L806.348 684.061L808.87 681.388L814.791 690H810.361ZM838.954 680.909C838.954 682.892 838.579 684.579 837.827 685.969C837.081 687.36 836.063 688.423 834.773 689.157C833.489 689.885 832.044 690.249 830.441 690.249C828.825 690.249 827.375 689.882 826.09 689.148C824.806 688.414 823.791 687.351 823.045 685.961C822.3 684.57 821.927 682.886 821.927 680.909C821.927 678.926 822.3 677.24 823.045 675.849C823.791 674.458 824.806 673.398 826.09 672.67C827.375 671.937 828.825 671.57 830.441 671.57C832.044 671.57 833.489 671.937 834.773 672.67C836.063 673.398 837.081 674.458 837.827 675.849C838.579 677.24 838.954 678.926 838.954 680.909ZM835.057 680.909C835.057 679.625 834.865 678.542 834.48 677.66C834.101 676.778 833.566 676.109 832.873 675.653C832.181 675.198 831.37 674.97 830.441 674.97C829.511 674.97 828.7 675.198 828.008 675.653C827.316 676.109 826.777 676.778 826.392 677.66C826.013 678.542 825.824 679.625 825.824 680.909C825.824 682.193 826.013 683.277 826.392 684.158C826.777 685.04 827.316 685.709 828.008 686.165C828.7 686.621 829.511 686.848 830.441 686.848C831.37 686.848 832.181 686.621 832.873 686.165C833.566 685.709 834.101 685.04 834.48 684.158C834.865 683.277 835.057 682.193 835.057 680.909ZM841.731 695.114V676.364H845.46V678.654H845.628C845.794 678.287 846.034 677.914 846.347 677.536C846.667 677.151 847.081 676.831 847.59 676.577C848.105 676.316 848.744 676.186 849.508 676.186C850.502 676.186 851.42 676.446 852.26 676.967C853.1 677.482 853.772 678.261 854.275 679.302C854.778 680.338 855.03 681.637 855.03 683.2C855.03 684.721 854.784 686.005 854.293 687.053C853.808 688.094 853.145 688.884 852.304 689.423C851.47 689.956 850.535 690.222 849.499 690.222C848.765 690.222 848.141 690.101 847.626 689.858C847.117 689.615 846.7 689.31 846.374 688.944C846.049 688.571 845.8 688.195 845.628 687.816H845.513V695.114H841.731ZM845.433 683.182C845.433 683.993 845.545 684.7 845.77 685.304C845.995 685.907 846.321 686.378 846.747 686.715C847.173 687.047 847.691 687.212 848.301 687.212C848.916 687.212 849.437 687.044 849.863 686.706C850.289 686.363 850.612 685.89 850.831 685.286C851.056 684.676 851.168 683.975 851.168 683.182C851.168 682.395 851.059 681.702 850.84 681.104C850.621 680.507 850.298 680.039 849.872 679.702C849.446 679.364 848.922 679.196 848.301 679.196C847.685 679.196 847.164 679.358 846.738 679.684C846.318 680.009 845.995 680.471 845.77 681.069C845.545 681.667 845.433 682.371 845.433 683.182ZM863.766 690.266C862.363 690.266 861.156 689.982 860.144 689.414C859.137 688.84 858.362 688.029 857.818 686.982C857.273 685.928 857.001 684.682 857.001 683.244C857.001 681.841 857.273 680.61 857.818 679.551C858.362 678.491 859.129 677.666 860.117 677.074C861.111 676.482 862.277 676.186 863.615 676.186C864.514 676.186 865.352 676.331 866.127 676.621C866.908 676.905 867.589 677.334 868.169 677.908C868.755 678.482 869.211 679.205 869.536 680.075C869.862 680.939 870.025 681.951 870.025 683.111V684.15H858.51V681.806H866.465C866.465 681.261 866.346 680.779 866.109 680.359C865.873 679.938 865.544 679.61 865.124 679.373C864.71 679.131 864.227 679.009 863.677 679.009C863.103 679.009 862.594 679.142 862.15 679.409C861.712 679.669 861.369 680.021 861.12 680.465C860.872 680.903 860.744 681.391 860.738 681.93V684.158C860.738 684.833 860.863 685.416 861.111 685.907C861.366 686.399 861.724 686.777 862.185 687.044C862.647 687.31 863.195 687.443 863.828 687.443C864.248 687.443 864.633 687.384 864.982 687.266C865.331 687.147 865.63 686.97 865.879 686.733C866.127 686.496 866.317 686.206 866.447 685.863L869.945 686.094C869.767 686.934 869.403 687.668 868.853 688.295C868.308 688.917 867.604 689.402 866.74 689.751C865.882 690.095 864.89 690.266 863.766 690.266ZM872.493 690V676.364H876.159V678.743H876.301C876.55 677.897 876.967 677.257 877.553 676.825C878.139 676.387 878.814 676.168 879.577 676.168C879.767 676.168 879.971 676.18 880.19 676.204C880.409 676.228 880.601 676.26 880.767 676.301V679.657C880.589 679.604 880.344 679.557 880.03 679.515C879.716 679.474 879.429 679.453 879.169 679.453C878.612 679.453 878.115 679.574 877.677 679.817C877.245 680.054 876.902 680.385 876.647 680.811C876.399 681.238 876.275 681.729 876.275 682.285V690H872.493ZM886.22 690.257C885.35 690.257 884.575 690.107 883.894 689.805C883.213 689.497 882.675 689.044 882.278 688.446C881.888 687.843 881.692 687.091 881.692 686.191C881.692 685.434 881.831 684.798 882.11 684.283C882.388 683.768 882.767 683.353 883.246 683.04C883.725 682.726 884.27 682.489 884.879 682.33C885.495 682.17 886.14 682.057 886.815 681.992C887.608 681.909 888.247 681.832 888.732 681.761C889.218 681.684 889.57 681.572 889.789 681.424C890.008 681.276 890.117 681.057 890.117 680.767V680.714C890.117 680.152 889.94 679.717 889.585 679.409C889.235 679.101 888.738 678.947 888.093 678.947C887.413 678.947 886.871 679.098 886.469 679.4C886.066 679.696 885.8 680.069 885.67 680.518L882.172 680.234C882.349 679.406 882.698 678.69 883.219 678.086C883.74 677.476 884.412 677.009 885.235 676.683C886.063 676.352 887.022 676.186 888.111 676.186C888.869 676.186 889.594 676.275 890.286 676.452C890.984 676.63 891.603 676.905 892.142 677.278C892.686 677.651 893.115 678.13 893.429 678.716C893.742 679.296 893.899 679.992 893.899 680.803V690H890.313V688.109H890.206C889.987 688.535 889.694 688.911 889.327 689.237C888.96 689.556 888.519 689.808 888.004 689.991C887.49 690.169 886.895 690.257 886.22 690.257ZM887.303 687.647C887.859 687.647 888.351 687.538 888.777 687.319C889.203 687.094 889.537 686.792 889.78 686.413C890.023 686.035 890.144 685.605 890.144 685.126V683.679C890.026 683.756 889.863 683.827 889.656 683.892C889.454 683.951 889.227 684.007 888.972 684.061C888.718 684.108 888.463 684.152 888.209 684.194C887.954 684.229 887.723 684.262 887.516 684.292C887.072 684.357 886.685 684.46 886.353 684.602C886.022 684.744 885.764 684.937 885.581 685.179C885.397 685.416 885.306 685.712 885.306 686.067C885.306 686.582 885.492 686.976 885.865 687.248C886.244 687.514 886.723 687.647 887.303 687.647ZM904.087 676.364V679.205H895.875V676.364H904.087ZM897.739 673.097H901.521V685.81C901.521 686.159 901.574 686.431 901.681 686.626C901.787 686.816 901.935 686.949 902.125 687.026C902.32 687.103 902.545 687.141 902.799 687.141C902.977 687.141 903.154 687.127 903.332 687.097C903.51 687.061 903.646 687.035 903.74 687.017L904.335 689.831C904.146 689.891 903.879 689.959 903.536 690.036C903.193 690.118 902.776 690.169 902.284 690.186C901.373 690.222 900.574 690.101 899.887 689.822C899.207 689.544 898.677 689.112 898.298 688.526C897.92 687.94 897.733 687.201 897.739 686.307V673.097ZM912.565 690.266C911.186 690.266 909.993 689.973 908.987 689.387C907.987 688.796 907.215 687.973 906.67 686.919C906.126 685.86 905.853 684.632 905.853 683.235C905.853 681.826 906.126 680.595 906.67 679.542C907.215 678.482 907.987 677.66 908.987 677.074C909.993 676.482 911.186 676.186 912.565 676.186C913.944 676.186 915.134 676.482 916.134 677.074C917.14 677.66 917.915 678.482 918.46 679.542C919.004 680.595 919.277 681.826 919.277 683.235C919.277 684.632 919.004 685.86 918.46 686.919C917.915 687.973 917.14 688.796 916.134 689.387C915.134 689.973 913.944 690.266 912.565 690.266ZM912.583 687.337C913.21 687.337 913.734 687.159 914.154 686.804C914.574 686.443 914.891 685.952 915.104 685.33C915.323 684.709 915.433 684.002 915.433 683.208C915.433 682.415 915.323 681.708 915.104 681.087C914.891 680.465 914.574 679.974 914.154 679.613C913.734 679.252 913.21 679.071 912.583 679.071C911.949 679.071 911.417 679.252 910.985 679.613C910.559 679.974 910.236 680.465 910.017 681.087C909.804 681.708 909.697 682.415 909.697 683.208C909.697 684.002 909.804 684.709 910.017 685.33C910.236 685.952 910.559 686.443 910.985 686.804C911.417 687.159 911.949 687.337 912.583 687.337ZM921.736 690V676.364H925.402V678.743H925.544C925.793 677.897 926.21 677.257 926.796 676.825C927.382 676.387 928.057 676.168 928.82 676.168C929.01 676.168 929.214 676.18 929.433 676.204C929.652 676.228 929.844 676.26 930.01 676.301V679.657C929.832 679.604 929.587 679.557 929.273 679.515C928.959 679.474 928.672 679.453 928.412 679.453C927.856 679.453 927.358 679.574 926.92 679.817C926.488 680.054 926.145 680.385 925.891 680.811C925.642 681.238 925.518 681.729 925.518 682.285V690H921.736ZM806.562 713.184H802.674C802.603 712.681 802.458 712.234 802.239 711.843C802.02 711.446 801.739 711.109 801.396 710.831C801.052 710.553 800.656 710.34 800.206 710.192C799.762 710.044 799.28 709.97 798.759 709.97C797.818 709.97 796.998 710.204 796.3 710.671C795.601 711.133 795.06 711.808 794.675 712.695C794.29 713.577 794.098 714.648 794.098 715.909C794.098 717.205 794.29 718.294 794.675 719.176C795.066 720.058 795.61 720.724 796.309 721.174C797.007 721.623 797.815 721.848 798.732 721.848C799.247 721.848 799.724 721.78 800.162 721.644C800.605 721.508 800.999 721.31 801.342 721.049C801.686 720.783 801.97 720.46 802.195 720.082C802.425 719.703 802.585 719.271 802.674 718.786L806.562 718.803C806.462 719.638 806.21 720.443 805.808 721.218C805.411 721.987 804.876 722.677 804.201 723.287C803.532 723.89 802.733 724.37 801.804 724.725C800.881 725.074 799.836 725.249 798.67 725.249C797.048 725.249 795.598 724.882 794.32 724.148C793.047 723.414 792.041 722.351 791.301 720.961C790.568 719.57 790.201 717.886 790.201 715.909C790.201 713.926 790.573 712.24 791.319 710.849C792.065 709.458 793.077 708.398 794.355 707.67C795.634 706.937 797.072 706.57 798.67 706.57C799.724 706.57 800.7 706.718 801.6 707.013C802.505 707.309 803.307 707.741 804.006 708.31C804.704 708.872 805.272 709.561 805.71 710.378C806.154 711.195 806.438 712.13 806.562 713.184ZM815.409 725.266C814.03 725.266 812.838 724.973 811.831 724.387C810.831 723.796 810.059 722.973 809.514 721.919C808.97 720.86 808.698 719.632 808.698 718.235C808.698 716.826 808.97 715.595 809.514 714.542C810.059 713.482 810.831 712.66 811.831 712.074C812.838 711.482 814.03 711.186 815.409 711.186C816.788 711.186 817.978 711.482 818.978 712.074C819.984 712.66 820.76 713.482 821.304 714.542C821.849 715.595 822.121 716.826 822.121 718.235C822.121 719.632 821.849 720.86 821.304 721.919C820.76 722.973 819.984 723.796 818.978 724.387C817.978 724.973 816.788 725.266 815.409 725.266ZM815.427 722.337C816.054 722.337 816.578 722.159 816.998 721.804C817.419 721.443 817.735 720.952 817.948 720.33C818.167 719.709 818.277 719.002 818.277 718.208C818.277 717.415 818.167 716.708 817.948 716.087C817.735 715.465 817.419 714.974 816.998 714.613C816.578 714.252 816.054 714.071 815.427 714.071C814.794 714.071 814.261 714.252 813.829 714.613C813.403 714.974 813.08 715.465 812.861 716.087C812.648 716.708 812.542 717.415 812.542 718.208C812.542 719.002 812.648 719.709 812.861 720.33C813.08 720.952 813.403 721.443 813.829 721.804C814.261 722.159 814.794 722.337 815.427 722.337ZM828.362 717.116V725H824.58V711.364H828.184V713.77H828.344C828.646 712.976 829.152 712.349 829.862 711.887C830.573 711.42 831.434 711.186 832.446 711.186C833.393 711.186 834.218 711.393 834.923 711.808C835.627 712.222 836.174 712.814 836.565 713.583C836.956 714.347 837.151 715.258 837.151 716.317V725H833.369V716.992C833.375 716.158 833.162 715.507 832.73 715.039C832.298 714.566 831.703 714.329 830.945 714.329C830.436 714.329 829.987 714.438 829.596 714.657C829.211 714.876 828.909 715.196 828.69 715.616C828.477 716.03 828.368 716.531 828.362 717.116ZM847.385 711.364V714.205H839.173V711.364H847.385ZM841.037 708.097H844.819V720.81C844.819 721.159 844.873 721.431 844.979 721.626C845.086 721.816 845.234 721.949 845.423 722.026C845.618 722.103 845.843 722.141 846.098 722.141C846.275 722.141 846.453 722.127 846.63 722.097C846.808 722.061 846.944 722.035 847.039 722.017L847.634 724.831C847.444 724.891 847.178 724.959 846.835 725.036C846.491 725.118 846.074 725.169 845.583 725.186C844.671 725.222 843.872 725.101 843.186 724.822C842.505 724.544 841.975 724.112 841.597 723.526C841.218 722.94 841.031 722.201 841.037 721.307V708.097ZM849.849 725V711.364H853.515V713.743H853.657C853.906 712.897 854.323 712.257 854.909 711.825C855.495 711.387 856.17 711.168 856.933 711.168C857.122 711.168 857.327 711.18 857.546 711.204C857.765 711.228 857.957 711.26 858.123 711.301V714.657C857.945 714.604 857.7 714.557 857.386 714.515C857.072 714.474 856.785 714.453 856.525 714.453C855.968 714.453 855.471 714.574 855.033 714.817C854.601 715.054 854.258 715.385 854.003 715.811C853.755 716.238 853.631 716.729 853.631 717.285V725H849.849ZM865.605 725.266C864.226 725.266 863.033 724.973 862.027 724.387C861.027 723.796 860.254 722.973 859.71 721.919C859.165 720.86 858.893 719.632 858.893 718.235C858.893 716.826 859.165 715.595 859.71 714.542C860.254 713.482 861.027 712.66 862.027 712.074C863.033 711.482 864.226 711.186 865.605 711.186C866.984 711.186 868.173 711.482 869.173 712.074C870.18 712.66 870.955 713.482 871.499 714.542C872.044 715.595 872.316 716.826 872.316 718.235C872.316 719.632 872.044 720.86 871.499 721.919C870.955 722.973 870.18 723.796 869.173 724.387C868.173 724.973 866.984 725.266 865.605 725.266ZM865.622 722.337C866.25 722.337 866.773 722.159 867.194 721.804C867.614 721.443 867.931 720.952 868.144 720.33C868.363 719.709 868.472 719.002 868.472 718.208C868.472 717.415 868.363 716.708 868.144 716.087C867.931 715.465 867.614 714.974 867.194 714.613C866.773 714.252 866.25 714.071 865.622 714.071C864.989 714.071 864.456 714.252 864.024 714.613C863.598 714.974 863.276 715.465 863.057 716.087C862.844 716.708 862.737 717.415 862.737 718.208C862.737 719.002 862.844 719.709 863.057 720.33C863.276 720.952 863.598 721.443 864.024 721.804C864.456 722.159 864.989 722.337 865.622 722.337ZM878.557 706.818V725H874.775V706.818H878.557ZM885.369 706.818V725H881.587V706.818H885.369ZM894.613 725.266C893.21 725.266 892.003 724.982 890.991 724.414C889.985 723.84 889.209 723.029 888.665 721.982C888.12 720.928 887.848 719.682 887.848 718.244C887.848 716.841 888.12 715.61 888.665 714.551C889.209 713.491 889.976 712.666 890.964 712.074C891.958 711.482 893.124 711.186 894.462 711.186C895.362 711.186 896.199 711.331 896.974 711.621C897.756 711.905 898.436 712.334 899.016 712.908C899.602 713.482 900.058 714.205 900.383 715.075C900.709 715.939 900.872 716.951 900.872 718.111V719.15H889.357V716.806H897.312C897.312 716.261 897.193 715.779 896.957 715.359C896.72 714.938 896.391 714.61 895.971 714.373C895.557 714.131 895.075 714.009 894.524 714.009C893.95 714.009 893.441 714.142 892.997 714.409C892.559 714.669 892.216 715.021 891.967 715.465C891.719 715.903 891.591 716.391 891.586 716.93V719.158C891.586 719.833 891.71 720.416 891.958 720.907C892.213 721.399 892.571 721.777 893.033 722.044C893.494 722.31 894.042 722.443 894.675 722.443C895.095 722.443 895.48 722.384 895.829 722.266C896.178 722.147 896.477 721.97 896.726 721.733C896.974 721.496 897.164 721.206 897.294 720.863L900.792 721.094C900.614 721.934 900.25 722.668 899.7 723.295C899.155 723.917 898.451 724.402 897.587 724.751C896.729 725.095 895.737 725.266 894.613 725.266ZM903.34 725V711.364H907.006V713.743H907.148C907.397 712.897 907.814 712.257 908.4 711.825C908.986 711.387 909.661 711.168 910.424 711.168C910.614 711.168 910.818 711.18 911.037 711.204C911.256 711.228 911.448 711.26 911.614 711.301V714.657C911.436 714.604 911.191 714.557 910.877 714.515C910.563 714.474 910.276 714.453 910.016 714.453C909.46 714.453 908.962 714.574 908.524 714.817C908.092 715.054 907.749 715.385 907.495 715.811C907.246 716.238 907.122 716.729 907.122 717.285V725H903.34Z" fill="#03031C"/>
+<path d="M544.844 720V706.364H548.511V708.743H548.653C548.901 707.897 549.319 707.257 549.905 706.825C550.491 706.387 551.165 706.168 551.929 706.168C552.118 706.168 552.322 706.18 552.541 706.204C552.76 706.228 552.953 706.26 553.118 706.301V709.657C552.941 709.604 552.695 709.557 552.381 709.515C552.068 709.474 551.781 709.453 551.52 709.453C550.964 709.453 550.467 709.574 550.029 709.817C549.597 710.054 549.254 710.385 548.999 710.811C548.75 711.238 548.626 711.729 548.626 712.285V720H544.844ZM560.653 720.266C559.251 720.266 558.043 719.982 557.031 719.414C556.025 718.84 555.25 718.029 554.705 716.982C554.161 715.928 553.888 714.682 553.888 713.244C553.888 711.841 554.161 710.61 554.705 709.551C555.25 708.491 556.016 707.666 557.005 707.074C557.999 706.482 559.165 706.186 560.502 706.186C561.402 706.186 562.24 706.331 563.015 706.621C563.796 706.905 564.477 707.334 565.057 707.908C565.643 708.482 566.098 709.205 566.424 710.075C566.75 710.939 566.912 711.951 566.912 713.111V714.15H555.398V711.806H563.352C563.352 711.261 563.234 710.779 562.997 710.359C562.76 709.938 562.432 709.61 562.012 709.373C561.597 709.131 561.115 709.009 560.565 709.009C559.991 709.009 559.482 709.142 559.038 709.409C558.6 709.669 558.256 710.021 558.008 710.465C557.759 710.903 557.632 711.391 557.626 711.93V714.158C557.626 714.833 557.75 715.416 557.999 715.907C558.253 716.399 558.612 716.777 559.073 717.044C559.535 717.31 560.082 717.443 560.716 717.443C561.136 717.443 561.52 717.384 561.87 717.266C562.219 717.147 562.518 716.97 562.766 716.733C563.015 716.496 563.204 716.206 563.335 715.863L566.832 716.094C566.655 716.934 566.291 717.668 565.74 718.295C565.196 718.917 564.492 719.402 563.627 719.751C562.769 720.095 561.778 720.266 560.653 720.266ZM575.542 720.266C574.145 720.266 572.943 719.97 571.937 719.379C570.937 718.781 570.167 717.952 569.629 716.893C569.096 715.833 568.83 714.614 568.83 713.235C568.83 711.838 569.099 710.613 569.638 709.56C570.182 708.5 570.955 707.675 571.955 707.083C572.955 706.485 574.145 706.186 575.524 706.186C576.713 706.186 577.755 706.402 578.649 706.834C579.542 707.266 580.25 707.873 580.771 708.654C581.291 709.435 581.578 710.353 581.632 711.406H578.063C577.962 710.726 577.696 710.178 577.264 709.764C576.838 709.344 576.278 709.134 575.586 709.134C575 709.134 574.488 709.293 574.05 709.613C573.618 709.927 573.281 710.385 573.038 710.989C572.795 711.593 572.674 712.324 572.674 713.182C572.674 714.052 572.792 714.792 573.029 715.401C573.272 716.011 573.612 716.475 574.05 716.795C574.488 717.115 575 717.275 575.586 717.275C576.018 717.275 576.406 717.186 576.749 717.008C577.098 716.831 577.385 716.573 577.61 716.236C577.841 715.893 577.992 715.481 578.063 715.002H581.632C581.573 716.043 581.288 716.961 580.779 717.754C580.276 718.541 579.581 719.157 578.693 719.6C577.805 720.044 576.755 720.266 575.542 720.266ZM590.214 720.266C588.835 720.266 587.643 719.973 586.637 719.387C585.636 718.796 584.864 717.973 584.32 716.919C583.775 715.86 583.503 714.632 583.503 713.235C583.503 711.826 583.775 710.595 584.32 709.542C584.864 708.482 585.636 707.66 586.637 707.074C587.643 706.482 588.835 706.186 590.214 706.186C591.593 706.186 592.783 706.482 593.783 707.074C594.789 707.66 595.565 708.482 596.109 709.542C596.654 710.595 596.926 711.826 596.926 713.235C596.926 714.632 596.654 715.86 596.109 716.919C595.565 717.973 594.789 718.796 593.783 719.387C592.783 719.973 591.593 720.266 590.214 720.266ZM590.232 717.337C590.86 717.337 591.383 717.159 591.804 716.804C592.224 716.443 592.54 715.952 592.753 715.33C592.972 714.709 593.082 714.002 593.082 713.208C593.082 712.415 592.972 711.708 592.753 711.087C592.54 710.465 592.224 709.974 591.804 709.613C591.383 709.252 590.86 709.071 590.232 709.071C589.599 709.071 589.066 709.252 588.634 709.613C588.208 709.974 587.885 710.465 587.666 711.087C587.453 711.708 587.347 712.415 587.347 713.208C587.347 714.002 587.453 714.709 587.666 715.33C587.885 715.952 588.208 716.443 588.634 716.804C589.066 717.159 589.599 717.337 590.232 717.337ZM603.167 712.116V720H599.385V706.364H602.99V708.77H603.149C603.451 707.976 603.957 707.349 604.668 706.887C605.378 706.42 606.239 706.186 607.251 706.186C608.198 706.186 609.024 706.393 609.728 706.808C610.432 707.222 610.98 707.814 611.37 708.583C611.761 709.347 611.956 710.258 611.956 711.317V720H608.174V711.992C608.18 711.158 607.967 710.507 607.535 710.039C607.103 709.566 606.508 709.329 605.751 709.329C605.242 709.329 604.792 709.438 604.401 709.657C604.016 709.876 603.715 710.196 603.496 710.616C603.283 711.03 603.173 711.531 603.167 712.116ZM621.098 720.266C619.701 720.266 618.5 719.97 617.494 719.379C616.494 718.781 615.724 717.952 615.186 716.893C614.653 715.833 614.387 714.614 614.387 713.235C614.387 711.838 614.656 710.613 615.194 709.56C615.739 708.5 616.511 707.675 617.512 707.083C618.512 706.485 619.701 706.186 621.08 706.186C622.27 706.186 623.312 706.402 624.205 706.834C625.099 707.266 625.806 707.873 626.327 708.654C626.848 709.435 627.135 710.353 627.188 711.406H623.619C623.519 710.726 623.253 710.178 622.82 709.764C622.394 709.344 621.835 709.134 621.143 709.134C620.557 709.134 620.045 709.293 619.607 709.613C619.175 709.927 618.837 710.385 618.595 710.989C618.352 711.593 618.231 712.324 618.231 713.182C618.231 714.052 618.349 714.792 618.586 715.401C618.828 716.011 619.169 716.475 619.607 716.795C620.045 717.115 620.557 717.275 621.143 717.275C621.575 717.275 621.962 717.186 622.306 717.008C622.655 716.831 622.942 716.573 623.167 716.236C623.398 715.893 623.548 715.481 623.619 715.002H627.188C627.129 716.043 626.845 716.961 626.336 717.754C625.833 718.541 625.138 719.157 624.25 719.6C623.362 720.044 622.311 720.266 621.098 720.266ZM629.61 720V706.364H633.392V720H629.61ZM631.51 704.606C630.947 704.606 630.465 704.419 630.063 704.047C629.666 703.668 629.468 703.215 629.468 702.688C629.468 702.167 629.666 701.721 630.063 701.348C630.465 700.969 630.947 700.779 631.51 700.779C632.072 700.779 632.551 700.969 632.948 701.348C633.35 701.721 633.552 702.167 633.552 702.688C633.552 703.215 633.35 703.668 632.948 704.047C632.551 704.419 632.072 704.606 631.51 704.606ZM640.203 701.818V720H636.421V701.818H640.203ZM649.447 720.266C648.045 720.266 646.837 719.982 645.825 719.414C644.819 718.84 644.044 718.029 643.499 716.982C642.955 715.928 642.682 714.682 642.682 713.244C642.682 711.841 642.955 710.61 643.499 709.551C644.044 708.491 644.81 707.666 645.799 707.074C646.793 706.482 647.959 706.186 649.296 706.186C650.196 706.186 651.034 706.331 651.809 706.621C652.59 706.905 653.271 707.334 653.851 707.908C654.437 708.482 654.892 709.205 655.218 710.075C655.543 710.939 655.706 711.951 655.706 713.111V714.15H644.192V711.806H652.146C652.146 711.261 652.028 710.779 651.791 710.359C651.554 709.938 651.226 709.61 650.806 709.373C650.391 709.131 649.909 709.009 649.359 709.009C648.784 709.009 648.275 709.142 647.832 709.409C647.394 709.669 647.05 710.021 646.802 710.465C646.553 710.903 646.426 711.391 646.42 711.93V714.158C646.42 714.833 646.544 715.416 646.793 715.907C647.047 716.399 647.405 716.777 647.867 717.044C648.329 717.31 648.876 717.443 649.509 717.443C649.93 717.443 650.314 717.384 650.664 717.266C651.013 717.147 651.312 716.97 651.56 716.733C651.809 716.496 651.998 716.206 652.128 715.863L655.626 716.094C655.449 716.934 655.085 717.668 654.534 718.295C653.99 718.917 653.286 719.402 652.421 719.751C651.563 720.095 650.572 720.266 649.447 720.266Z" fill="#03031C"/>
+<g filter="url(#filter3_bd_12_284)">
+<rect x="1161" y="523" width="279" height="238" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="1161.5" y="523.5" width="278" height="237" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M431.896 133V111.182H436.509V120.802H436.797L444.648 111.182H450.178L442.081 120.951L450.273 133H444.755L438.778 124.03L436.509 126.8V133H431.896ZM461.963 126.033V116.636H466.501V133H462.144V130.028H461.974C461.604 130.987 460.99 131.757 460.131 132.339C459.278 132.922 458.238 133.213 457.009 133.213C455.915 133.213 454.953 132.964 454.122 132.467C453.291 131.97 452.641 131.263 452.172 130.347C451.711 129.431 451.476 128.334 451.469 127.055V116.636H456.008V126.246C456.015 127.212 456.274 127.975 456.785 128.536C457.297 129.097 457.982 129.378 458.841 129.378C459.388 129.378 459.9 129.254 460.376 129.005C460.851 128.749 461.235 128.373 461.526 127.876C461.824 127.379 461.97 126.764 461.963 126.033ZM470.217 133V111.182H474.755V119.385H474.893C475.092 118.945 475.38 118.497 475.756 118.043C476.14 117.581 476.637 117.197 477.248 116.892C477.866 116.58 478.633 116.423 479.549 116.423C480.742 116.423 481.843 116.736 482.852 117.361C483.86 117.979 484.666 118.913 485.27 120.163C485.874 121.406 486.175 122.964 486.175 124.839C486.175 126.665 485.881 128.206 485.291 129.463C484.709 130.713 483.913 131.661 482.905 132.308C481.903 132.947 480.781 133.266 479.538 133.266C478.658 133.266 477.908 133.121 477.29 132.83C476.68 132.538 476.179 132.173 475.788 131.732C475.398 131.285 475.099 130.834 474.893 130.379H474.691V133H470.217ZM474.659 124.818C474.659 125.791 474.794 126.64 475.064 127.364C475.334 128.089 475.724 128.653 476.236 129.058C476.747 129.456 477.369 129.655 478.1 129.655C478.839 129.655 479.464 129.452 479.975 129.048C480.487 128.636 480.874 128.067 481.136 127.343C481.406 126.612 481.541 125.77 481.541 124.818C481.541 123.874 481.41 123.043 481.147 122.325C480.884 121.608 480.497 121.047 479.986 120.642C479.474 120.237 478.846 120.035 478.1 120.035C477.362 120.035 476.737 120.23 476.225 120.621C475.721 121.011 475.334 121.565 475.064 122.283C474.794 123 474.659 123.845 474.659 124.818ZM496.661 133.32C494.978 133.32 493.529 132.979 492.314 132.297C491.107 131.608 490.177 130.635 489.523 129.378C488.87 128.114 488.543 126.619 488.543 124.893C488.543 123.21 488.87 121.732 489.523 120.461C490.177 119.19 491.096 118.199 492.282 117.489C493.476 116.778 494.875 116.423 496.48 116.423C497.559 116.423 498.564 116.597 499.495 116.945C500.432 117.286 501.249 117.801 501.945 118.49C502.648 119.179 503.195 120.045 503.586 121.089C503.976 122.126 504.172 123.341 504.172 124.733V125.979H490.354V123.167H499.9C499.9 122.513 499.758 121.935 499.474 121.43C499.189 120.926 498.795 120.532 498.291 120.248C497.794 119.957 497.215 119.811 496.555 119.811C495.866 119.811 495.255 119.971 494.722 120.29C494.197 120.603 493.785 121.026 493.486 121.558C493.188 122.084 493.035 122.67 493.028 123.316V125.99C493.028 126.8 493.177 127.499 493.476 128.089C493.781 128.678 494.211 129.133 494.765 129.452C495.319 129.772 495.976 129.932 496.736 129.932C497.24 129.932 497.702 129.861 498.121 129.719C498.54 129.577 498.898 129.364 499.197 129.08C499.495 128.795 499.722 128.447 499.878 128.036L504.076 128.312C503.863 129.321 503.426 130.202 502.765 130.955C502.112 131.7 501.267 132.283 500.23 132.702C499.2 133.114 498.01 133.32 496.661 133.32ZM507.133 133V116.636H511.533V119.491H511.704C512.002 118.476 512.503 117.709 513.206 117.19C513.909 116.665 514.719 116.402 515.635 116.402C515.862 116.402 516.107 116.416 516.37 116.445C516.633 116.473 516.863 116.512 517.062 116.562V120.589C516.849 120.525 516.555 120.468 516.178 120.418C515.802 120.369 515.457 120.344 515.145 120.344C514.477 120.344 513.881 120.489 513.355 120.781C512.836 121.065 512.425 121.462 512.119 121.974C511.821 122.485 511.672 123.075 511.672 123.742V133H507.133ZM523.947 123.54V133H519.409V116.636H523.734V119.523H523.926C524.288 118.572 524.895 117.819 525.748 117.265C526.6 116.704 527.633 116.423 528.848 116.423C529.984 116.423 530.975 116.672 531.82 117.169C532.665 117.666 533.322 118.376 533.791 119.3C534.26 120.216 534.494 121.31 534.494 122.581V133H529.956V123.391C529.963 122.389 529.707 121.608 529.189 121.047C528.67 120.479 527.956 120.195 527.047 120.195C526.436 120.195 525.897 120.326 525.428 120.589C524.966 120.852 524.604 121.235 524.341 121.739C524.086 122.237 523.954 122.837 523.947 123.54ZM545.528 133.32C543.845 133.32 542.396 132.979 541.182 132.297C539.974 131.608 539.044 130.635 538.39 129.378C537.737 128.114 537.41 126.619 537.41 124.893C537.41 123.21 537.737 121.732 538.39 120.461C539.044 119.19 539.964 118.199 541.15 117.489C542.343 116.778 543.742 116.423 545.347 116.423C546.427 116.423 547.432 116.597 548.362 116.945C549.3 117.286 550.116 117.801 550.812 118.49C551.515 119.179 552.062 120.045 552.453 121.089C552.844 122.126 553.039 123.341 553.039 124.733V125.979H539.221V123.167H548.767C548.767 122.513 548.625 121.935 548.341 121.43C548.057 120.926 547.662 120.532 547.158 120.248C546.661 119.957 546.082 119.811 545.422 119.811C544.733 119.811 544.122 119.971 543.589 120.29C543.064 120.603 542.652 121.026 542.354 121.558C542.055 122.084 541.903 122.67 541.895 123.316V125.99C541.895 126.8 542.045 127.499 542.343 128.089C542.648 128.678 543.078 129.133 543.632 129.452C544.186 129.772 544.843 129.932 545.603 129.932C546.107 129.932 546.569 129.861 546.988 129.719C547.407 129.577 547.765 129.364 548.064 129.08C548.362 128.795 548.589 128.447 548.746 128.036L552.943 128.312C552.73 129.321 552.293 130.202 551.633 130.955C550.979 131.7 550.134 132.283 549.097 132.702C548.067 133.114 546.878 133.32 545.528 133.32ZM564.704 116.636V120.045H554.85V116.636H564.704ZM557.087 112.716H561.626V127.972C561.626 128.391 561.689 128.717 561.817 128.952C561.945 129.179 562.123 129.339 562.35 129.431C562.584 129.523 562.854 129.57 563.16 129.57C563.373 129.57 563.586 129.552 563.799 129.516C564.012 129.474 564.175 129.442 564.289 129.42L565.003 132.798C564.775 132.869 564.456 132.95 564.044 133.043C563.632 133.142 563.131 133.202 562.542 133.224C561.448 133.266 560.489 133.121 559.665 132.787C558.849 132.453 558.213 131.935 557.758 131.232C557.304 130.528 557.08 129.641 557.087 128.568V112.716ZM574.942 133.32C573.259 133.32 571.81 132.979 570.596 132.297C569.388 131.608 568.458 130.635 567.805 129.378C567.151 128.114 566.824 126.619 566.824 124.893C566.824 123.21 567.151 121.732 567.805 120.461C568.458 119.19 569.378 118.199 570.564 117.489C571.757 116.778 573.156 116.423 574.761 116.423C575.841 116.423 576.846 116.597 577.776 116.945C578.714 117.286 579.53 117.801 580.226 118.49C580.93 119.179 581.476 120.045 581.867 121.089C582.258 122.126 582.453 123.341 582.453 124.733V125.979H568.635V123.167H578.181C578.181 122.513 578.039 121.935 577.755 121.43C577.471 120.926 577.077 120.532 576.572 120.248C576.075 119.957 575.496 119.811 574.836 119.811C574.147 119.811 573.536 119.971 573.003 120.29C572.478 120.603 572.066 121.026 571.768 121.558C571.469 122.084 571.317 122.67 571.309 123.316V125.99C571.309 126.8 571.459 127.499 571.757 128.089C572.062 128.678 572.492 129.133 573.046 129.452C573.6 129.772 574.257 129.932 575.017 129.932C575.521 129.932 575.983 129.861 576.402 129.719C576.821 129.577 577.18 129.364 577.478 129.08C577.776 128.795 578.003 128.447 578.16 128.036L582.357 128.312C582.144 129.321 581.707 130.202 581.047 130.955C580.393 131.7 579.548 132.283 578.511 132.702C577.481 133.114 576.292 133.32 574.942 133.32ZM599.03 121.303L594.875 121.558C594.804 121.203 594.651 120.884 594.417 120.599C594.182 120.308 593.873 120.077 593.49 119.907C593.113 119.729 592.662 119.641 592.137 119.641C591.434 119.641 590.841 119.79 590.358 120.088C589.875 120.379 589.633 120.77 589.633 121.26C589.633 121.651 589.79 121.981 590.102 122.251C590.415 122.521 590.951 122.737 591.711 122.901L594.672 123.497C596.263 123.824 597.449 124.349 598.231 125.074C599.012 125.798 599.403 126.75 599.403 127.929C599.403 129.001 599.086 129.942 598.454 130.752C597.829 131.562 596.97 132.194 595.876 132.648C594.79 133.096 593.536 133.32 592.116 133.32C589.949 133.32 588.224 132.869 586.938 131.967C585.66 131.058 584.91 129.822 584.69 128.259L589.154 128.025C589.289 128.685 589.616 129.19 590.134 129.538C590.653 129.879 591.317 130.049 592.126 130.049C592.922 130.049 593.561 129.896 594.044 129.591C594.534 129.278 594.782 128.877 594.79 128.387C594.782 127.975 594.608 127.638 594.268 127.375C593.927 127.105 593.401 126.899 592.691 126.757L589.857 126.192C588.259 125.873 587.069 125.319 586.288 124.531C585.514 123.742 585.127 122.737 585.127 121.516C585.127 120.464 585.411 119.559 585.979 118.799C586.555 118.039 587.361 117.453 588.398 117.041C589.442 116.629 590.663 116.423 592.062 116.423C594.129 116.423 595.756 116.86 596.942 117.734C598.135 118.607 598.831 119.797 599.03 121.303Z" fill="#335FFD"/>
+<path d="M836.871 591.338C841.976 583.776 839.983 573.507 832.421 568.403C824.859 563.298 814.591 565.29 809.486 572.852C804.381 580.415 806.374 590.683 813.936 595.788C821.498 600.892 831.766 598.9 836.871 591.338Z" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M832.141 586.666C834.664 581.714 832.695 575.656 827.744 573.133C822.793 570.61 816.734 572.579 814.212 577.53C811.689 582.481 813.657 588.54 818.609 591.063C823.56 593.585 829.619 591.617 832.141 586.666Z" fill="#EA26A9"/>
+<path d="M884.089 647.459C891.651 642.355 893.643 632.086 888.539 624.524C883.434 616.962 873.166 614.97 865.604 620.074C858.041 625.179 856.049 635.447 861.154 643.01C866.258 650.572 876.527 652.564 884.089 647.459Z" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M879.412 642.734C884.363 640.211 886.331 634.152 883.809 629.201C881.286 624.25 875.227 622.281 870.276 624.804C865.325 627.327 863.356 633.385 865.879 638.337C868.402 643.288 874.46 645.256 879.412 642.734Z" fill="#8438FA"/>
+<path d="M849 571.92C858.452 571.92 867.517 575.721 874.201 582.488C880.885 589.254 884.64 598.431 884.64 608" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M813.36 608C813.36 612.68 814.282 617.315 816.073 621.639C817.864 625.963 820.489 629.892 823.799 633.201C830.483 639.885 839.548 643.64 849 643.64" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M806.32 612.4L812.92 605.8L819.52 612.4" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M891.24 601.84L884.64 608.44L878.04 601.84" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<rect x="1170.65" y="531.65" width="259.7" height="219.7" rx="14.35" fill="white" fill-opacity="0.85" stroke="#8438FA" stroke-width="1.3" stroke-dasharray="10 10"/>
+<path d="M1310.86 609.893C1311.65 607.53 1310.86 605.168 1309.09 603.79C1308.3 603.002 1308.1 601.821 1308.69 600.837C1310.07 598.474 1311.84 596.505 1313.81 594.733C1314.6 593.946 1315.78 593.946 1316.76 594.733C1318.54 596.111 1320.9 596.308 1323.06 595.324C1325.03 594.143 1326.21 592.174 1326.02 589.811C1326.02 588.63 1326.61 587.646 1327.79 587.449C1330.35 586.858 1333.11 586.661 1335.67 586.661C1336.85 586.661 1337.83 587.449 1337.83 588.63C1338.03 590.796 1339.6 592.765 1341.77 593.552C1344.13 594.34 1346.49 593.552 1347.87 591.78C1348.66 590.993 1349.84 590.796 1350.82 591.386C1353.19 592.764 1355.16 594.536 1356.93 596.505C1357.72 597.293 1357.72 598.474 1356.93 599.458C1355.55 601.23 1355.35 603.593 1356.34 605.759C1357.52 607.727 1359.68 608.909 1361.85 608.712C1363.03 608.712 1364.02 609.302 1364.21 610.484C1364.8 613.043 1365 615.799 1365 618.359C1365 619.54 1364.21 620.524 1363.03 620.524C1360.87 620.721 1358.7 622.296 1358.11 624.462C1357.32 626.824 1358.31 629.187 1359.88 630.565C1360.67 631.353 1360.87 632.534 1360.27 633.518C1358.9 635.881 1357.12 637.85 1355.16 639.621C1354.37 640.409 1353.19 640.409 1352.2 639.621C1350.43 638.243 1348.07 638.046 1345.9 639.031C1343.93 640.212 1342.75 642.378 1342.95 644.543C1342.95 645.725 1342.36 646.709 1341.18 646.906C1338.62 647.497 1335.86 647.694 1333.3 647.694C1332.12 647.694 1331.14 646.906 1331.14 645.725C1330.94 643.559 1329.37 641.393 1327.2 640.803C1324.84 640.015 1322.47 641 1321.1 642.772C1320.51 643.559 1319.13 643.756 1318.14 643.165C1315.78 641.787 1313.81 640.015 1312.04 638.046C1311.25 637.259 1311.25 635.881 1312.04 635.093C1313.42 633.321 1313.61 630.959 1312.63 628.793C1311.45 626.824 1309.28 625.643 1307.12 625.84C1305.94 625.84 1304.95 625.249 1304.76 624.068C1304.16 621.509 1303.97 618.752 1303.97 616.193C1303.97 615.012 1304.76 614.027 1305.94 614.027C1308.1 613.83 1310.07 612.255 1310.86 609.893ZM1325.62 622.493C1333.5 632.731 1348.07 625.053 1343.93 612.846C1343.93 612.649 1343.74 612.255 1343.54 612.059C1335.67 601.427 1320.9 609.302 1325.23 621.706C1325.43 622.099 1325.43 622.296 1325.62 622.493Z" fill="#8438FA"/>
+<path d="M1282.21 637.711C1282.58 636.61 1282.21 635.51 1281.38 634.867C1281.02 634.5 1280.93 633.95 1281.2 633.491C1281.84 632.391 1282.67 631.473 1283.59 630.648C1283.95 630.281 1284.5 630.281 1284.96 630.648C1285.79 631.29 1286.89 631.382 1287.9 630.923C1288.81 630.373 1289.37 629.455 1289.27 628.355C1289.27 627.804 1289.55 627.346 1290.1 627.254C1291.29 626.979 1292.58 626.887 1293.77 626.887C1294.32 626.887 1294.78 627.254 1294.78 627.804C1294.87 628.813 1295.6 629.731 1296.61 630.098C1297.71 630.464 1298.81 630.098 1299.46 629.272C1299.82 628.905 1300.37 628.813 1300.83 629.089C1301.93 629.731 1302.85 630.556 1303.67 631.473C1304.04 631.84 1304.04 632.391 1303.67 632.849C1303.03 633.675 1302.94 634.776 1303.4 635.785C1303.95 636.702 1304.96 637.252 1305.97 637.161C1306.52 637.161 1306.98 637.436 1307.07 637.986C1307.34 639.179 1307.44 640.463 1307.44 641.655C1307.44 642.206 1307.07 642.664 1306.52 642.664C1305.51 642.756 1304.5 643.49 1304.23 644.499C1303.86 645.6 1304.32 646.7 1305.05 647.342C1305.42 647.709 1305.51 648.26 1305.23 648.718C1304.59 649.819 1303.77 650.736 1302.85 651.562C1302.48 651.929 1301.93 651.929 1301.47 651.562C1300.65 650.92 1299.55 650.828 1298.54 651.287C1297.62 651.837 1297.07 652.846 1297.16 653.855C1297.16 654.405 1296.89 654.864 1296.34 654.956C1295.14 655.231 1293.86 655.323 1292.67 655.323C1292.12 655.323 1291.66 654.956 1291.66 654.405C1291.57 653.396 1290.83 652.387 1289.82 652.112C1288.72 651.745 1287.62 652.204 1286.98 653.029C1286.71 653.396 1286.06 653.488 1285.6 653.213C1284.5 652.571 1283.59 651.745 1282.76 650.828C1282.39 650.461 1282.39 649.819 1282.76 649.452C1283.4 648.626 1283.49 647.526 1283.04 646.517C1282.49 645.599 1281.48 645.049 1280.47 645.141C1279.92 645.141 1279.46 644.866 1279.37 644.315C1279.09 643.123 1279 641.839 1279 640.646C1279 640.096 1279.37 639.637 1279.92 639.637C1280.93 639.545 1281.84 638.812 1282.21 637.711ZM1289.09 643.582C1292.76 648.351 1299.55 644.774 1297.62 639.087C1297.62 638.995 1297.53 638.812 1297.44 638.72C1293.77 633.767 1286.89 637.436 1288.91 643.215C1289 643.398 1289 643.49 1289.09 643.582Z" fill="#8438FA"/>
+<path d="M1299.77 601.246C1299.01 604.148 1297.85 606.932 1296.33 609.517C1296.14 609.831 1295.84 610.057 1295.48 610.149C1295.13 610.241 1294.75 610.191 1294.44 610.01C1293.12 609.356 1291.63 609.133 1290.17 609.372C1288.72 609.61 1287.38 610.298 1286.34 611.339C1285.3 612.38 1284.61 613.721 1284.37 615.173C1284.13 616.626 1284.36 618.116 1285.01 619.435C1285.2 619.753 1285.25 620.132 1285.16 620.49C1285.07 620.848 1284.85 621.156 1284.53 621.349C1281.94 622.862 1279.16 624.012 1276.26 624.767C1275.9 624.853 1275.53 624.797 1275.21 624.61C1274.9 624.424 1274.67 624.122 1274.57 623.768C1274.1 622.371 1273.21 621.157 1272.01 620.296C1270.81 619.436 1269.38 618.973 1267.9 618.973C1266.43 618.973 1264.99 619.436 1263.8 620.296C1262.6 621.157 1261.7 622.371 1261.23 623.768C1261.14 624.122 1260.91 624.424 1260.59 624.61C1260.28 624.797 1259.9 624.853 1259.55 624.767C1256.64 624.013 1253.85 622.858 1251.26 621.335C1250.95 621.14 1250.73 620.833 1250.64 620.479C1250.56 620.124 1250.61 619.75 1250.8 619.435C1251.45 618.118 1251.67 616.63 1251.43 615.18C1251.19 613.73 1250.5 612.391 1249.47 611.352C1248.43 610.312 1247.09 609.624 1245.64 609.383C1244.19 609.142 1242.7 609.361 1241.38 610.01C1241.07 610.192 1240.69 610.245 1240.34 610.155C1239.98 610.066 1239.68 609.842 1239.49 609.532C1237.96 606.941 1236.8 604.153 1236.04 601.246C1235.96 600.89 1236.02 600.516 1236.21 600.204C1236.4 599.891 1236.7 599.664 1237.05 599.571C1238.45 599.102 1239.66 598.206 1240.52 597.01C1241.38 595.813 1241.85 594.377 1241.85 592.903C1241.85 591.43 1241.38 589.993 1240.52 588.797C1239.66 587.6 1238.45 586.704 1237.05 586.235C1236.7 586.142 1236.39 585.913 1236.2 585.598C1236.01 585.282 1235.95 584.905 1236.04 584.547C1236.8 581.644 1237.96 578.86 1239.49 576.275C1239.68 575.964 1239.98 575.74 1240.34 575.651C1240.69 575.562 1241.07 575.614 1241.38 575.797C1242.7 576.445 1244.19 576.664 1245.64 576.424C1247.09 576.183 1248.43 575.494 1249.47 574.455C1250.5 573.415 1251.19 572.076 1251.43 570.626C1251.67 569.177 1251.45 567.689 1250.8 566.371C1250.61 566.056 1250.56 565.682 1250.64 565.328C1250.73 564.973 1250.95 564.667 1251.26 564.472C1253.85 562.949 1256.64 561.793 1259.55 561.039C1259.9 560.953 1260.28 561.01 1260.59 561.196C1260.91 561.383 1261.14 561.685 1261.23 562.038C1261.7 563.435 1262.6 564.65 1263.8 565.51C1264.99 566.371 1266.43 566.833 1267.9 566.833C1269.38 566.833 1270.81 566.371 1272.01 565.51C1273.21 564.65 1274.1 563.435 1274.57 562.038C1274.67 561.685 1274.9 561.383 1275.21 561.196C1275.53 561.01 1275.9 560.953 1276.26 561.039C1279.16 561.794 1281.94 562.944 1284.53 564.458C1284.84 564.65 1285.07 564.956 1285.16 565.311C1285.24 565.665 1285.19 566.04 1285.01 566.357C1284.35 567.676 1284.12 569.169 1284.36 570.625C1284.6 572.08 1285.28 573.425 1286.33 574.468C1287.37 575.512 1288.71 576.202 1290.17 576.44C1291.62 576.678 1293.11 576.453 1294.44 575.797C1294.75 575.614 1295.13 575.562 1295.48 575.651C1295.84 575.74 1296.14 575.964 1296.33 576.275C1297.85 578.863 1299.01 581.646 1299.77 584.547C1299.85 584.903 1299.8 585.278 1299.61 585.594C1299.42 585.909 1299.12 586.139 1298.77 586.235C1297.37 586.704 1296.16 587.6 1295.3 588.797C1294.44 589.993 1293.97 591.43 1293.97 592.903C1293.97 594.377 1294.44 595.813 1295.3 597.01C1296.16 598.206 1297.37 599.102 1298.77 599.571C1299.12 599.667 1299.42 599.895 1299.6 600.207C1299.79 600.519 1299.85 600.891 1299.77 601.246Z" stroke="#03031C" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<circle cx="1267.56" cy="592.556" r="10.3435" stroke="#03031C" stroke-width="2.2"/>
+<line x1="402" y1="234" x2="402" y2="286" stroke="white" stroke-width="2"/>
+<line x1="1077" y1="611" x2="1077" y2="663" stroke="white" stroke-width="2"/>
+<rect x="489.65" y="184.65" width="492.7" height="177.7" rx="14.35" fill="white" fill-opacity="0.85" stroke="#8438FA" stroke-width="1.3" stroke-dasharray="10 10"/>
+<path d="M749.957 247.29H722.043" stroke="#03031C" stroke-width="2.2" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M749.957 239.496H722.043" stroke="#03031C" stroke-width="2.2" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M749.957 262.587H722.043" stroke="#03031C" stroke-width="2.2" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M749.957 254.794H722.043" stroke="#03031C" stroke-width="2.2" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M744.422 207.359H727.585C727.234 207.359 726.898 207.498 726.65 207.745C726.402 207.992 726.262 208.328 726.262 208.677V215.891C726.262 216.631 726.557 217.34 727.082 217.863C727.606 218.386 728.318 218.68 729.06 218.68H729.099C729.67 218.675 730.227 218.5 730.698 218.178C731.169 217.857 731.533 217.402 731.745 216.873C732.088 216.017 732.681 215.282 733.447 214.765C734.214 214.247 735.118 213.971 736.043 213.971C736.968 213.971 737.873 214.247 738.639 214.765C739.405 215.282 739.998 216.017 740.341 216.873C740.553 217.402 740.917 217.857 741.388 218.178C741.859 218.5 742.416 218.675 742.987 218.68H743.026C743.769 218.68 744.481 218.386 745.007 217.864C745.532 217.341 745.829 216.631 745.83 215.891V208.684C745.832 208.503 745.795 208.323 745.724 208.157C745.653 207.99 745.548 207.84 745.415 207.716C745.283 207.591 745.127 207.495 744.956 207.434C744.785 207.373 744.603 207.347 744.422 207.359Z" stroke="#03031C" stroke-width="2.2" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M721.772 207.359H708.229C707.781 207.359 707.352 207.536 707.036 207.851C706.72 208.167 706.542 208.594 706.542 209.04V274.904C706.542 275.779 706.891 276.617 707.511 277.236C708.131 277.854 708.972 278.201 709.849 278.201H761.536C762.588 278.201 763.598 277.784 764.342 277.043C765.086 276.301 765.504 275.294 765.504 274.245V209.04C765.504 208.816 765.459 208.594 765.372 208.387C765.285 208.181 765.157 207.994 764.996 207.837C764.835 207.68 764.644 207.557 764.435 207.475C764.226 207.393 764.003 207.353 763.778 207.359H750.234" stroke="#03031C" stroke-width="2.2" stroke-miterlimit="10" stroke-linecap="round"/>
+<path d="M749.276 227.76H722.731C721.354 227.76 720.238 228.873 720.238 230.245V230.707C720.238 232.08 721.354 233.193 722.731 233.193H749.276C750.653 233.193 751.769 232.08 751.769 230.707V230.245C751.769 228.873 750.653 227.76 749.276 227.76Z" fill="#8438FA"/>
+<path d="M642.33 298.184H638.442C638.371 297.681 638.226 297.234 638.007 296.843C637.788 296.446 637.506 296.109 637.163 295.831C636.82 295.553 636.423 295.34 635.973 295.192C635.53 295.044 635.047 294.97 634.526 294.97C633.585 294.97 632.766 295.204 632.067 295.671C631.369 296.133 630.827 296.808 630.443 297.695C630.058 298.577 629.866 299.648 629.866 300.909C629.866 302.205 630.058 303.294 630.443 304.176C630.833 305.058 631.378 305.724 632.076 306.174C632.775 306.623 633.582 306.848 634.5 306.848C635.015 306.848 635.491 306.78 635.929 306.644C636.373 306.508 636.767 306.31 637.11 306.049C637.453 305.783 637.737 305.46 637.962 305.082C638.193 304.703 638.353 304.271 638.442 303.786L642.33 303.803C642.229 304.638 641.978 305.443 641.575 306.218C641.179 306.987 640.643 307.677 639.969 308.287C639.3 308.89 638.501 309.37 637.572 309.725C636.648 310.074 635.604 310.249 634.438 310.249C632.816 310.249 631.366 309.882 630.087 309.148C628.815 308.414 627.809 307.351 627.069 305.961C626.335 304.57 625.968 302.886 625.968 300.909C625.968 298.926 626.341 297.24 627.087 295.849C627.833 294.458 628.845 293.398 630.123 292.67C631.401 291.937 632.84 291.57 634.438 291.57C635.491 291.57 636.468 291.718 637.367 292.013C638.273 292.309 639.075 292.741 639.773 293.31C640.472 293.872 641.04 294.561 641.478 295.378C641.922 296.195 642.206 297.13 642.33 298.184ZM653.76 304.194V296.364H657.542V310H653.911V307.523H653.769C653.461 308.322 652.949 308.964 652.233 309.45C651.523 309.935 650.656 310.178 649.632 310.178C648.721 310.178 647.919 309.97 647.226 309.556C646.534 309.142 645.992 308.553 645.602 307.789C645.217 307.026 645.021 306.112 645.016 305.046V296.364H648.798V304.371C648.803 305.176 649.019 305.813 649.446 306.28C649.872 306.748 650.443 306.982 651.159 306.982C651.615 306.982 652.041 306.878 652.437 306.671C652.834 306.458 653.154 306.144 653.396 305.73C653.645 305.315 653.766 304.804 653.76 304.194ZM671.913 300.252L668.451 300.465C668.392 300.169 668.264 299.903 668.069 299.666C667.874 299.424 667.616 299.231 667.297 299.089C666.983 298.941 666.607 298.867 666.169 298.867C665.583 298.867 665.089 298.991 664.687 299.24C664.284 299.483 664.083 299.808 664.083 300.217C664.083 300.542 664.213 300.817 664.474 301.042C664.734 301.267 665.181 301.448 665.814 301.584L668.282 302.081C669.608 302.353 670.596 302.791 671.247 303.395C671.898 303.999 672.224 304.792 672.224 305.774C672.224 306.668 671.961 307.452 671.434 308.127C670.913 308.801 670.197 309.328 669.285 309.707C668.38 310.08 667.335 310.266 666.152 310.266C664.346 310.266 662.908 309.891 661.837 309.139C660.772 308.381 660.147 307.351 659.964 306.049L663.683 305.854C663.796 306.404 664.068 306.825 664.5 307.115C664.932 307.399 665.486 307.541 666.16 307.541C666.823 307.541 667.356 307.414 667.758 307.159C668.167 306.899 668.374 306.564 668.38 306.156C668.374 305.813 668.229 305.531 667.945 305.312C667.661 305.088 667.223 304.916 666.631 304.798L664.269 304.327C662.938 304.061 661.946 303.599 661.295 302.942C660.65 302.285 660.328 301.448 660.328 300.43C660.328 299.554 660.564 298.799 661.038 298.166C661.517 297.533 662.189 297.044 663.053 296.701C663.923 296.358 664.941 296.186 666.107 296.186C667.829 296.186 669.185 296.55 670.173 297.278C671.167 298.006 671.747 298.997 671.913 300.252ZM681.859 296.364V299.205H673.647V296.364H681.859ZM675.511 293.097H679.293V305.81C679.293 306.159 679.346 306.431 679.453 306.626C679.559 306.816 679.707 306.949 679.897 307.026C680.092 307.103 680.317 307.141 680.571 307.141C680.749 307.141 680.926 307.127 681.104 307.097C681.282 307.061 681.418 307.035 681.512 307.017L682.107 309.831C681.918 309.891 681.651 309.959 681.308 310.036C680.965 310.118 680.548 310.169 680.056 310.186C679.145 310.222 678.346 310.101 677.659 309.822C676.979 309.544 676.449 309.112 676.07 308.526C675.691 307.94 675.505 307.201 675.511 306.307V293.097ZM690.337 310.266C688.958 310.266 687.765 309.973 686.759 309.387C685.759 308.796 684.987 307.973 684.442 306.919C683.898 305.86 683.625 304.632 683.625 303.235C683.625 301.826 683.898 300.595 684.442 299.542C684.987 298.482 685.759 297.66 686.759 297.074C687.765 296.482 688.958 296.186 690.337 296.186C691.716 296.186 692.906 296.482 693.906 297.074C694.912 297.66 695.687 298.482 696.232 299.542C696.776 300.595 697.049 301.826 697.049 303.235C697.049 304.632 696.776 305.86 696.232 306.919C695.687 307.973 694.912 308.796 693.906 309.387C692.906 309.973 691.716 310.266 690.337 310.266ZM690.355 307.337C690.982 307.337 691.506 307.159 691.926 306.804C692.346 306.443 692.663 305.952 692.876 305.33C693.095 304.709 693.205 304.002 693.205 303.208C693.205 302.415 693.095 301.708 692.876 301.087C692.663 300.465 692.346 299.974 691.926 299.613C691.506 299.252 690.982 299.071 690.355 299.071C689.721 299.071 689.189 299.252 688.757 299.613C688.331 299.974 688.008 300.465 687.789 301.087C687.576 301.708 687.469 302.415 687.469 303.208C687.469 304.002 687.576 304.709 687.789 305.33C688.008 305.952 688.331 306.443 688.757 306.804C689.189 307.159 689.721 307.337 690.355 307.337ZM699.508 310V296.364H703.112V298.77H703.272C703.556 297.971 704.03 297.34 704.692 296.879C705.355 296.417 706.148 296.186 707.072 296.186C708.007 296.186 708.803 296.42 709.46 296.887C710.117 297.349 710.555 297.976 710.774 298.77H710.916C711.194 297.988 711.697 297.364 712.425 296.896C713.159 296.423 714.026 296.186 715.026 296.186C716.299 296.186 717.332 296.592 718.125 297.402C718.924 298.207 719.323 299.35 719.323 300.829V310H715.55V301.575C715.55 300.817 715.349 300.249 714.946 299.87C714.544 299.492 714.041 299.302 713.437 299.302C712.751 299.302 712.215 299.521 711.83 299.959C711.446 300.391 711.253 300.962 711.253 301.673V310H707.587V301.495C707.587 300.826 707.394 300.294 707.01 299.897C706.631 299.5 706.131 299.302 705.509 299.302C705.089 299.302 704.71 299.409 704.373 299.622C704.041 299.829 703.778 300.122 703.583 300.501C703.387 300.874 703.29 301.312 703.29 301.815V310H699.508ZM728.097 310V296.364H731.763V298.743H731.905C732.154 297.897 732.571 297.257 733.157 296.825C733.743 296.387 734.418 296.168 735.181 296.168C735.371 296.168 735.575 296.18 735.794 296.204C736.013 296.228 736.205 296.26 736.371 296.301V299.657C736.193 299.604 735.948 299.557 735.634 299.515C735.32 299.474 735.033 299.453 734.773 299.453C734.216 299.453 733.719 299.574 733.281 299.817C732.849 300.054 732.506 300.385 732.251 300.811C732.003 301.238 731.879 301.729 731.879 302.285V310H728.097ZM743.906 310.266C742.503 310.266 741.296 309.982 740.284 309.414C739.278 308.84 738.502 308.029 737.958 306.982C737.413 305.928 737.141 304.682 737.141 303.244C737.141 301.841 737.413 300.61 737.958 299.551C738.502 298.491 739.269 297.666 740.257 297.074C741.251 296.482 742.417 296.186 743.755 296.186C744.655 296.186 745.492 296.331 746.267 296.621C747.049 296.905 747.729 297.334 748.309 297.908C748.895 298.482 749.351 299.205 749.676 300.075C750.002 300.939 750.165 301.951 750.165 303.111V304.15H738.65V301.806H746.605C746.605 301.261 746.486 300.779 746.25 300.359C746.013 299.938 745.684 299.61 745.264 299.373C744.85 299.131 744.367 299.009 743.817 299.009C743.243 299.009 742.734 299.142 742.29 299.409C741.852 299.669 741.509 300.021 741.26 300.465C741.012 300.903 740.884 301.391 740.879 301.93V304.158C740.879 304.833 741.003 305.416 741.251 305.907C741.506 306.399 741.864 306.777 742.326 307.044C742.787 307.31 743.335 307.443 743.968 307.443C744.388 307.443 744.773 307.384 745.122 307.266C745.471 307.147 745.77 306.97 746.019 306.733C746.267 306.496 746.457 306.206 746.587 305.863L750.085 306.094C749.907 306.934 749.543 307.668 748.993 308.295C748.448 308.917 747.744 309.402 746.88 309.751C746.022 310.095 745.03 310.266 743.906 310.266ZM763.979 300.252L760.516 300.465C760.457 300.169 760.33 299.903 760.135 299.666C759.939 299.424 759.682 299.231 759.362 299.089C759.048 298.941 758.673 298.867 758.235 298.867C757.649 298.867 757.155 298.991 756.752 299.24C756.35 299.483 756.148 299.808 756.148 300.217C756.148 300.542 756.279 300.817 756.539 301.042C756.799 301.267 757.246 301.448 757.88 301.584L760.348 302.081C761.673 302.353 762.662 302.791 763.313 303.395C763.964 303.999 764.289 304.792 764.289 305.774C764.289 306.668 764.026 307.452 763.499 308.127C762.978 308.801 762.262 309.328 761.351 309.707C760.445 310.08 759.401 310.266 758.217 310.266C756.412 310.266 754.974 309.891 753.902 309.139C752.837 308.381 752.213 307.351 752.029 306.049L755.749 305.854C755.861 306.404 756.134 306.825 756.566 307.115C756.998 307.399 757.551 307.541 758.226 307.541C758.889 307.541 759.421 307.414 759.824 307.159C760.232 306.899 760.439 306.564 760.445 306.156C760.439 305.813 760.294 305.531 760.01 305.312C759.726 305.088 759.288 304.916 758.696 304.798L756.335 304.327C755.003 304.061 754.012 303.599 753.361 302.942C752.716 302.285 752.393 301.448 752.393 300.43C752.393 299.554 752.63 298.799 753.103 298.166C753.583 297.533 754.254 297.044 755.119 296.701C755.989 296.358 757.007 296.186 758.173 296.186C759.895 296.186 761.25 296.55 762.239 297.278C763.233 298.006 763.813 298.997 763.979 300.252ZM772.832 310.266C771.453 310.266 770.26 309.973 769.254 309.387C768.254 308.796 767.482 307.973 766.937 306.919C766.393 305.86 766.12 304.632 766.12 303.235C766.12 301.826 766.393 300.595 766.937 299.542C767.482 298.482 768.254 297.66 769.254 297.074C770.26 296.482 771.453 296.186 772.832 296.186C774.211 296.186 775.401 296.482 776.401 297.074C777.407 297.66 778.182 298.482 778.727 299.542C779.271 300.595 779.544 301.826 779.544 303.235C779.544 304.632 779.271 305.86 778.727 306.919C778.182 307.973 777.407 308.796 776.401 309.387C775.401 309.973 774.211 310.266 772.832 310.266ZM772.85 307.337C773.477 307.337 774.001 307.159 774.421 306.804C774.841 306.443 775.158 305.952 775.371 305.33C775.59 304.709 775.7 304.002 775.7 303.208C775.7 302.415 775.59 301.708 775.371 301.087C775.158 300.465 774.841 299.974 774.421 299.613C774.001 299.252 773.477 299.071 772.85 299.071C772.217 299.071 771.684 299.252 771.252 299.613C770.826 299.974 770.503 300.465 770.284 301.087C770.071 301.708 769.965 302.415 769.965 303.208C769.965 304.002 770.071 304.709 770.284 305.33C770.503 305.952 770.826 306.443 771.252 306.804C771.684 307.159 772.217 307.337 772.85 307.337ZM790.748 304.194V296.364H794.53V310H790.898V307.523H790.756C790.449 308.322 789.937 308.964 789.221 309.45C788.51 309.935 787.643 310.178 786.619 310.178C785.708 310.178 784.906 309.97 784.213 309.556C783.521 309.142 782.979 308.553 782.589 307.789C782.204 307.026 782.009 306.112 782.003 305.046V296.364H785.785V304.371C785.791 305.176 786.007 305.813 786.433 306.28C786.859 306.748 787.43 306.982 788.146 306.982C788.602 306.982 789.028 306.878 789.425 306.671C789.821 306.458 790.141 306.144 790.384 305.73C790.632 305.315 790.753 304.804 790.748 304.194ZM797.555 310V296.364H801.221V298.743H801.363C801.612 297.897 802.029 297.257 802.615 296.825C803.201 296.387 803.876 296.168 804.639 296.168C804.829 296.168 805.033 296.18 805.252 296.204C805.471 296.228 805.663 296.26 805.829 296.301V299.657C805.651 299.604 805.406 299.557 805.092 299.515C804.778 299.474 804.491 299.453 804.231 299.453C803.674 299.453 803.177 299.574 802.739 299.817C802.307 300.054 801.964 300.385 801.709 300.811C801.461 301.238 801.337 301.729 801.337 302.285V310H797.555ZM813.311 310.266C811.914 310.266 810.712 309.97 809.706 309.379C808.706 308.781 807.937 307.952 807.398 306.893C806.865 305.833 806.599 304.614 806.599 303.235C806.599 301.838 806.868 300.613 807.407 299.56C807.951 298.5 808.724 297.675 809.724 297.083C810.724 296.485 811.914 296.186 813.293 296.186C814.482 296.186 815.524 296.402 816.418 296.834C817.312 297.266 818.019 297.873 818.54 298.654C819.06 299.435 819.348 300.353 819.401 301.406H815.832C815.731 300.726 815.465 300.178 815.033 299.764C814.607 299.344 814.047 299.134 813.355 299.134C812.769 299.134 812.257 299.293 811.819 299.613C811.387 299.927 811.05 300.385 810.807 300.989C810.564 301.593 810.443 302.324 810.443 303.182C810.443 304.052 810.561 304.792 810.798 305.401C811.041 306.011 811.381 306.475 811.819 306.795C812.257 307.115 812.769 307.275 813.355 307.275C813.787 307.275 814.175 307.186 814.518 307.008C814.867 306.831 815.154 306.573 815.379 306.236C815.61 305.893 815.761 305.481 815.832 305.002H819.401C819.342 306.043 819.058 306.961 818.549 307.754C818.045 308.541 817.35 309.157 816.462 309.6C815.574 310.044 814.524 310.266 813.311 310.266ZM828.037 310.266C826.634 310.266 825.427 309.982 824.415 309.414C823.408 308.84 822.633 308.029 822.089 306.982C821.544 305.928 821.272 304.682 821.272 303.244C821.272 301.841 821.544 300.61 822.089 299.551C822.633 298.491 823.4 297.666 824.388 297.074C825.382 296.482 826.548 296.186 827.886 296.186C828.785 296.186 829.623 296.331 830.398 296.621C831.179 296.905 831.86 297.334 832.44 297.908C833.026 298.482 833.482 299.205 833.807 300.075C834.133 300.939 834.296 301.951 834.296 303.111V304.15H822.781V301.806H830.736C830.736 301.261 830.617 300.779 830.38 300.359C830.144 299.938 829.815 299.61 829.395 299.373C828.981 299.131 828.498 299.009 827.948 299.009C827.374 299.009 826.865 299.142 826.421 299.409C825.983 299.669 825.64 300.021 825.391 300.465C825.143 300.903 825.015 301.391 825.009 301.93V304.158C825.009 304.833 825.134 305.416 825.382 305.907C825.637 306.399 825.995 306.777 826.456 307.044C826.918 307.31 827.466 307.443 828.099 307.443C828.519 307.443 828.904 307.384 829.253 307.266C829.602 307.147 829.901 306.97 830.15 306.733C830.398 306.496 830.588 306.206 830.718 305.863L834.216 306.094C834.038 306.934 833.674 307.668 833.124 308.295C832.579 308.917 831.875 309.402 831.011 309.751C830.153 310.095 829.161 310.266 828.037 310.266ZM848.11 300.252L844.647 300.465C844.588 300.169 844.461 299.903 844.265 299.666C844.07 299.424 843.813 299.231 843.493 299.089C843.179 298.941 842.804 298.867 842.366 298.867C841.78 298.867 841.285 298.991 840.883 299.24C840.48 299.483 840.279 299.808 840.279 300.217C840.279 300.542 840.409 300.817 840.67 301.042C840.93 301.267 841.377 301.448 842.01 301.584L844.478 302.081C845.804 302.353 846.793 302.791 847.444 303.395C848.095 303.999 848.42 304.792 848.42 305.774C848.42 306.668 848.157 307.452 847.63 308.127C847.109 308.801 846.393 309.328 845.482 309.707C844.576 310.08 843.532 310.266 842.348 310.266C840.543 310.266 839.104 309.891 838.033 309.139C836.968 308.381 836.343 307.351 836.16 306.049L839.88 305.854C839.992 306.404 840.264 306.825 840.697 307.115C841.129 307.399 841.682 307.541 842.357 307.541C843.02 307.541 843.552 307.414 843.955 307.159C844.363 306.899 844.57 306.564 844.576 306.156C844.57 305.813 844.425 305.531 844.141 305.312C843.857 305.088 843.419 304.916 842.827 304.798L840.466 304.327C839.134 304.061 838.143 303.599 837.492 302.942C836.846 302.285 836.524 301.448 836.524 300.43C836.524 299.554 836.761 298.799 837.234 298.166C837.714 297.533 838.385 297.044 839.249 296.701C840.119 296.358 841.137 296.186 842.303 296.186C844.026 296.186 845.381 296.55 846.369 297.278C847.364 298.006 847.944 298.997 848.11 300.252Z" fill="#03031C"/>
+<g filter="url(#filter4_bd_12_284)">
+<rect x="31" y="175" width="282" height="196" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="31.5" y="175.5" width="281" height="195" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<rect x="39.65" y="183.65" width="265.7" height="177.7" rx="14.35" fill="white" fill-opacity="0.85" stroke="#8438FA" stroke-width="1.3" stroke-dasharray="10 10"/>
+<path d="M84.4778 338H80.3585L86.6351 319.818H91.589L97.8567 338H93.7374L89.1831 323.973H89.041L84.4778 338ZM84.2203 330.853H93.9505V333.854H84.2203V330.853ZM100.045 338V319.818H107.218C108.597 319.818 109.772 320.082 110.743 320.608C111.714 321.129 112.453 321.854 112.962 322.783C113.477 323.707 113.735 324.772 113.735 325.979C113.735 327.187 113.474 328.252 112.953 329.175C112.433 330.099 111.678 330.818 110.69 331.333C109.707 331.848 108.518 332.105 107.121 332.105H102.549V329.025H106.499C107.239 329.025 107.849 328.897 108.328 328.643C108.813 328.382 109.174 328.024 109.411 327.569C109.654 327.107 109.775 326.577 109.775 325.979C109.775 325.376 109.654 324.849 109.411 324.399C109.174 323.943 108.813 323.591 108.328 323.343C107.843 323.088 107.227 322.961 106.482 322.961H103.889V338H100.045ZM120.076 319.818V338H116.232V319.818H120.076ZM133.978 338.222C132.943 338.222 132.005 337.956 131.164 337.423C130.33 336.884 129.667 336.094 129.176 335.053C128.69 334.005 128.448 332.721 128.448 331.2C128.448 329.637 128.699 328.338 129.202 327.302C129.705 326.261 130.374 325.482 131.209 324.967C132.049 324.446 132.969 324.186 133.97 324.186C134.733 324.186 135.369 324.316 135.878 324.577C136.393 324.831 136.807 325.151 137.121 325.536C137.441 325.914 137.683 326.287 137.849 326.654H137.965V319.818H141.738V338H138.009V335.816H137.849C137.672 336.195 137.42 336.571 137.095 336.944C136.775 337.31 136.358 337.615 135.843 337.858C135.334 338.101 134.712 338.222 133.978 338.222ZM135.177 335.212C135.787 335.212 136.301 335.047 136.722 334.715C137.148 334.378 137.473 333.907 137.698 333.304C137.929 332.7 138.044 331.993 138.044 331.182C138.044 330.371 137.932 329.667 137.707 329.069C137.482 328.471 137.157 328.009 136.731 327.684C136.304 327.358 135.787 327.196 135.177 327.196C134.555 327.196 134.032 327.364 133.606 327.702C133.179 328.039 132.857 328.507 132.638 329.104C132.419 329.702 132.309 330.395 132.309 331.182C132.309 331.975 132.419 332.676 132.638 333.286C132.863 333.89 133.185 334.363 133.606 334.706C134.032 335.044 134.555 335.212 135.177 335.212ZM151.062 338.266C149.659 338.266 148.452 337.982 147.439 337.414C146.433 336.84 145.658 336.029 145.113 334.982C144.569 333.928 144.297 332.682 144.297 331.244C144.297 329.841 144.569 328.61 145.113 327.551C145.658 326.491 146.424 325.666 147.413 325.074C148.407 324.482 149.573 324.186 150.911 324.186C151.81 324.186 152.648 324.331 153.423 324.621C154.204 324.905 154.885 325.334 155.465 325.908C156.051 326.482 156.507 327.205 156.832 328.075C157.158 328.939 157.32 329.951 157.32 331.111V332.15H145.806V329.806H153.76C153.76 329.261 153.642 328.779 153.405 328.359C153.169 327.938 152.84 327.61 152.42 327.373C152.006 327.131 151.523 327.009 150.973 327.009C150.399 327.009 149.89 327.142 149.446 327.409C149.008 327.669 148.665 328.021 148.416 328.465C148.167 328.903 148.04 329.391 148.034 329.93V332.158C148.034 332.833 148.159 333.416 148.407 333.907C148.662 334.399 149.02 334.777 149.481 335.044C149.943 335.31 150.49 335.443 151.124 335.443C151.544 335.443 151.929 335.384 152.278 335.266C152.627 335.147 152.926 334.97 153.175 334.733C153.423 334.496 153.613 334.206 153.743 333.863L157.241 334.094C157.063 334.934 156.699 335.668 156.149 336.295C155.604 336.917 154.9 337.402 154.036 337.751C153.177 338.095 152.186 338.266 151.062 338.266ZM172.135 324.364L167.368 338H163.107L158.339 324.364H162.334L165.166 334.12H165.308L168.131 324.364H172.135ZM179.846 338.266C178.443 338.266 177.236 337.982 176.224 337.414C175.217 336.84 174.442 336.029 173.898 334.982C173.353 333.928 173.081 332.682 173.081 331.244C173.081 329.841 173.353 328.61 173.898 327.551C174.442 326.491 175.209 325.666 176.197 325.074C177.191 324.482 178.357 324.186 179.695 324.186C180.594 324.186 181.432 324.331 182.207 324.621C182.989 324.905 183.669 325.334 184.249 325.908C184.835 326.482 185.291 327.205 185.616 328.075C185.942 328.939 186.105 329.951 186.105 331.111V332.15H174.59V329.806H182.545C182.545 329.261 182.426 328.779 182.19 328.359C181.953 327.938 181.624 327.61 181.204 327.373C180.79 327.131 180.307 327.009 179.757 327.009C179.183 327.009 178.674 327.142 178.23 327.409C177.792 327.669 177.449 328.021 177.2 328.465C176.952 328.903 176.824 329.391 176.818 329.93V332.158C176.818 332.833 176.943 333.416 177.191 333.907C177.446 334.399 177.804 334.777 178.266 335.044C178.727 335.31 179.275 335.443 179.908 335.443C180.328 335.443 180.713 335.384 181.062 335.266C181.411 335.147 181.71 334.97 181.959 334.733C182.207 334.496 182.397 334.206 182.527 333.863L186.025 334.094C185.847 334.934 185.483 335.668 184.933 336.295C184.388 336.917 183.684 337.402 182.82 337.751C181.962 338.095 180.97 338.266 179.846 338.266ZM192.355 319.818V338H188.573V319.818H192.355ZM201.545 338.266C200.166 338.266 198.974 337.973 197.968 337.387C196.967 336.796 196.195 335.973 195.651 334.919C195.106 333.86 194.834 332.632 194.834 331.235C194.834 329.826 195.106 328.595 195.651 327.542C196.195 326.482 196.967 325.66 197.968 325.074C198.974 324.482 200.166 324.186 201.545 324.186C202.924 324.186 204.114 324.482 205.114 325.074C206.121 325.66 206.896 326.482 207.44 327.542C207.985 328.595 208.257 329.826 208.257 331.235C208.257 332.632 207.985 333.86 207.44 334.919C206.896 335.973 206.121 336.796 205.114 337.387C204.114 337.973 202.924 338.266 201.545 338.266ZM201.563 335.337C202.191 335.337 202.714 335.159 203.135 334.804C203.555 334.443 203.871 333.952 204.085 333.33C204.304 332.709 204.413 332.002 204.413 331.208C204.413 330.415 204.304 329.708 204.085 329.087C203.871 328.465 203.555 327.974 203.135 327.613C202.714 327.252 202.191 327.071 201.563 327.071C200.93 327.071 200.397 327.252 199.965 327.613C199.539 327.974 199.217 328.465 198.998 329.087C198.784 329.708 198.678 330.415 198.678 331.208C198.678 332.002 198.784 332.709 198.998 333.33C199.217 333.952 199.539 334.443 199.965 334.804C200.397 335.159 200.93 335.337 201.563 335.337ZM210.716 343.114V324.364H214.445V326.654H214.614C214.779 326.287 215.019 325.914 215.333 325.536C215.652 325.151 216.067 324.831 216.576 324.577C217.091 324.316 217.73 324.186 218.493 324.186C219.488 324.186 220.405 324.446 221.245 324.967C222.086 325.482 222.758 326.261 223.261 327.302C223.764 328.338 224.015 329.637 224.015 331.2C224.015 332.721 223.77 334.005 223.278 335.053C222.793 336.094 222.13 336.884 221.29 337.423C220.455 337.956 219.52 338.222 218.484 338.222C217.75 338.222 217.126 338.101 216.611 337.858C216.102 337.615 215.685 337.31 215.359 336.944C215.034 336.571 214.785 336.195 214.614 335.816H214.498V343.114H210.716ZM214.418 331.182C214.418 331.993 214.531 332.7 214.756 333.304C214.981 333.907 215.306 334.378 215.732 334.715C216.158 335.047 216.676 335.212 217.286 335.212C217.901 335.212 218.422 335.044 218.848 334.706C219.275 334.363 219.597 333.89 219.816 333.286C220.041 332.676 220.153 331.975 220.153 331.182C220.153 330.395 220.044 329.702 219.825 329.104C219.606 328.507 219.283 328.039 218.857 327.702C218.431 327.364 217.907 327.196 217.286 327.196C216.67 327.196 216.15 327.358 215.723 327.684C215.303 328.009 214.981 328.471 214.756 329.069C214.531 329.667 214.418 330.371 214.418 331.182ZM232.751 338.266C231.348 338.266 230.141 337.982 229.129 337.414C228.123 336.84 227.347 336.029 226.803 334.982C226.258 333.928 225.986 332.682 225.986 331.244C225.986 329.841 226.258 328.61 226.803 327.551C227.347 326.491 228.114 325.666 229.102 325.074C230.097 324.482 231.263 324.186 232.6 324.186C233.5 324.186 234.337 324.331 235.113 324.621C235.894 324.905 236.574 325.334 237.154 325.908C237.74 326.482 238.196 327.205 238.522 328.075C238.847 328.939 239.01 329.951 239.01 331.111V332.15H227.495V329.806H235.45C235.45 329.261 235.332 328.779 235.095 328.359C234.858 327.938 234.53 327.61 234.109 327.373C233.695 327.131 233.213 327.009 232.662 327.009C232.088 327.009 231.579 327.142 231.135 327.409C230.697 327.669 230.354 328.021 230.105 328.465C229.857 328.903 229.73 329.391 229.724 329.93V332.158C229.724 332.833 229.848 333.416 230.097 333.907C230.351 334.399 230.709 334.777 231.171 335.044C231.632 335.31 232.18 335.443 232.813 335.443C233.233 335.443 233.618 335.384 233.967 335.266C234.317 335.147 234.615 334.97 234.864 334.733C235.113 334.496 235.302 334.206 235.432 333.863L238.93 334.094C238.752 334.934 238.388 335.668 237.838 336.295C237.294 336.917 236.589 337.402 235.725 337.751C234.867 338.095 233.876 338.266 232.751 338.266ZM241.478 338V324.364H245.145V326.743H245.287C245.535 325.897 245.952 325.257 246.538 324.825C247.124 324.387 247.799 324.168 248.562 324.168C248.752 324.168 248.956 324.18 249.175 324.204C249.394 324.228 249.586 324.26 249.752 324.301V327.657C249.575 327.604 249.329 327.557 249.015 327.515C248.702 327.474 248.415 327.453 248.154 327.453C247.598 327.453 247.101 327.574 246.663 327.817C246.231 328.054 245.887 328.385 245.633 328.811C245.384 329.238 245.26 329.729 245.26 330.285V338H241.478ZM263.053 328.252L259.591 328.465C259.532 328.169 259.405 327.903 259.209 327.666C259.014 327.424 258.756 327.231 258.437 327.089C258.123 326.941 257.747 326.867 257.309 326.867C256.723 326.867 256.229 326.991 255.827 327.24C255.424 327.483 255.223 327.808 255.223 328.217C255.223 328.542 255.353 328.817 255.614 329.042C255.874 329.267 256.321 329.448 256.954 329.584L259.422 330.081C260.748 330.353 261.736 330.791 262.388 331.395C263.039 331.999 263.364 332.792 263.364 333.774C263.364 334.668 263.101 335.452 262.574 336.127C262.053 336.801 261.337 337.328 260.426 337.707C259.52 338.08 258.475 338.266 257.292 338.266C255.486 338.266 254.048 337.891 252.977 337.139C251.912 336.381 251.287 335.351 251.104 334.049L254.824 333.854C254.936 334.404 255.208 334.825 255.64 335.115C256.072 335.399 256.626 335.541 257.301 335.541C257.963 335.541 258.496 335.414 258.899 335.159C259.307 334.899 259.514 334.564 259.52 334.156C259.514 333.813 259.369 333.531 259.085 333.312C258.801 333.088 258.363 332.916 257.771 332.798L255.41 332.327C254.078 332.061 253.086 331.599 252.435 330.942C251.79 330.285 251.468 329.448 251.468 328.43C251.468 327.554 251.705 326.799 252.178 326.166C252.657 325.533 253.329 325.044 254.193 324.701C255.063 324.358 256.081 324.186 257.247 324.186C258.97 324.186 260.325 324.55 261.313 325.278C262.308 326.006 262.888 326.997 263.053 328.252Z" fill="#03031C"/>
+<path d="M599.267 330.727C599.267 328.937 599.499 327.292 599.963 325.791C600.432 324.286 601.1 322.901 601.966 321.636H603.444C603.103 322.105 602.783 322.683 602.485 323.369C602.191 324.051 601.933 324.802 601.711 325.621C601.488 326.435 601.313 327.278 601.185 328.149C601.062 329.02 601 329.88 601 330.727C601 331.854 601.109 332.998 601.327 334.158C601.545 335.318 601.838 336.395 602.208 337.389C602.577 338.384 602.989 339.193 603.444 339.818H601.966C601.1 338.554 600.432 337.171 599.963 335.67C599.499 334.165 599.267 332.517 599.267 330.727ZM606.741 338H604.894L610.235 323.455H612.053L617.394 338H615.548L611.201 325.756H611.087L606.741 338ZM607.423 332.318H614.866V333.881H607.423V332.318ZM619.66 338V323.455H624.575C625.716 323.455 626.648 323.661 627.373 324.072C628.102 324.48 628.642 325.031 628.992 325.727C629.343 326.423 629.518 327.2 629.518 328.057C629.518 328.914 629.343 329.693 628.992 330.393C628.647 331.094 628.112 331.653 627.387 332.07C626.663 332.482 625.735 332.688 624.603 332.688H621.08V331.125H624.546C625.327 331.125 625.955 330.99 626.428 330.72C626.902 330.45 627.245 330.086 627.458 329.626C627.676 329.162 627.785 328.639 627.785 328.057C627.785 327.474 627.676 326.954 627.458 326.494C627.245 326.035 626.899 325.675 626.421 325.415C625.943 325.15 625.308 325.017 624.518 325.017H621.421V338H619.66ZM634.116 323.455V338H632.355V323.455H634.116ZM647.165 338.227C646.256 338.227 645.453 337.998 644.757 337.538C644.061 337.074 643.517 336.421 643.124 335.578C642.731 334.731 642.534 333.729 642.534 332.574C642.534 331.428 642.731 330.434 643.124 329.591C643.517 328.748 644.064 328.097 644.765 327.638C645.465 327.179 646.275 326.949 647.194 326.949C647.904 326.949 648.465 327.067 648.877 327.304C649.293 327.536 649.611 327.801 649.828 328.099C650.051 328.393 650.224 328.634 650.347 328.824H650.489V323.455H652.165V338H650.546V336.324H650.347C650.224 336.523 650.049 336.774 649.821 337.077C649.594 337.375 649.27 337.643 648.848 337.879C648.427 338.111 647.866 338.227 647.165 338.227ZM647.392 336.722C648.065 336.722 648.633 336.546 649.097 336.196C649.561 335.841 649.914 335.351 650.155 334.726C650.397 334.096 650.517 333.369 650.517 332.545C650.517 331.731 650.399 331.018 650.162 330.408C649.926 329.792 649.575 329.314 649.111 328.973C648.647 328.627 648.074 328.455 647.392 328.455C646.682 328.455 646.09 328.637 645.617 329.001C645.148 329.361 644.795 329.851 644.559 330.472C644.327 331.087 644.211 331.778 644.211 332.545C644.211 333.322 644.329 334.027 644.566 334.662C644.807 335.292 645.162 335.794 645.631 336.168C646.105 336.537 646.692 336.722 647.392 336.722ZM660.042 338.227C658.99 338.227 658.084 337.995 657.321 337.531C656.564 337.062 655.979 336.409 655.567 335.571C655.16 334.728 654.956 333.748 654.956 332.631C654.956 331.513 655.16 330.528 655.567 329.676C655.979 328.819 656.552 328.152 657.286 327.673C658.025 327.19 658.886 326.949 659.871 326.949C660.439 326.949 661 327.044 661.554 327.233C662.108 327.422 662.613 327.73 663.067 328.156C663.522 328.578 663.884 329.136 664.154 329.832C664.424 330.528 664.559 331.385 664.559 332.403V333.114H656.15V331.665H662.854C662.854 331.049 662.731 330.5 662.485 330.017C662.243 329.534 661.898 329.153 661.448 328.874C661.003 328.594 660.477 328.455 659.871 328.455C659.203 328.455 658.626 328.62 658.138 328.952C657.655 329.278 657.283 329.705 657.023 330.23C656.763 330.756 656.632 331.319 656.632 331.92V332.886C656.632 333.71 656.775 334.409 657.059 334.982C657.347 335.55 657.748 335.983 658.259 336.281C658.77 336.575 659.364 336.722 660.042 336.722C660.482 336.722 660.88 336.66 661.235 336.537C661.595 336.409 661.905 336.22 662.165 335.969C662.426 335.713 662.627 335.396 662.769 335.017L664.388 335.472C664.218 336.021 663.931 336.504 663.529 336.92C663.126 337.332 662.629 337.654 662.037 337.886C661.445 338.114 660.78 338.227 660.042 338.227ZM671.966 327.091V328.511H666.086V327.091H671.966ZM667.847 338V325.585C667.847 324.96 667.994 324.439 668.287 324.023C668.581 323.606 668.962 323.294 669.431 323.085C669.9 322.877 670.394 322.773 670.915 322.773C671.327 322.773 671.663 322.806 671.924 322.872C672.184 322.938 672.378 323 672.506 323.057L672.023 324.506C671.938 324.477 671.819 324.442 671.668 324.399C671.521 324.357 671.327 324.335 671.086 324.335C670.532 324.335 670.132 324.475 669.885 324.754C669.644 325.034 669.523 325.443 669.523 325.983V338H667.847ZM674.315 338V327.091H675.991V338H674.315ZM675.168 325.273C674.841 325.273 674.559 325.161 674.322 324.939C674.09 324.716 673.974 324.449 673.974 324.136C673.974 323.824 674.09 323.556 674.322 323.334C674.559 323.111 674.841 323 675.168 323C675.494 323 675.774 323.111 676.006 323.334C676.242 323.556 676.361 323.824 676.361 324.136C676.361 324.449 676.242 324.716 676.006 324.939C675.774 325.161 675.494 325.273 675.168 325.273ZM680.738 331.438V338H679.061V327.091H680.681V328.795H680.823C681.078 328.241 681.467 327.796 681.988 327.46C682.508 327.119 683.181 326.949 684.005 326.949C684.743 326.949 685.39 327.1 685.944 327.403C686.498 327.702 686.928 328.156 687.236 328.767C687.544 329.373 687.698 330.14 687.698 331.068V338H686.022V331.182C686.022 330.325 685.799 329.657 685.354 329.179C684.909 328.696 684.298 328.455 683.522 328.455C682.987 328.455 682.508 328.571 682.087 328.803C681.67 329.035 681.341 329.373 681.1 329.818C680.858 330.263 680.738 330.803 680.738 331.438ZM690.761 338V327.091H692.437V338H690.761ZM691.613 325.273C691.286 325.273 691.004 325.161 690.768 324.939C690.536 324.716 690.42 324.449 690.42 324.136C690.42 323.824 690.536 323.556 690.768 323.334C691.004 323.111 691.286 323 691.613 323C691.94 323 692.219 323.111 692.451 323.334C692.688 323.556 692.806 323.824 692.806 324.136C692.806 324.449 692.688 324.716 692.451 324.939C692.219 325.161 691.94 325.273 691.613 325.273ZM700.251 327.091V328.511H694.598V327.091H700.251ZM696.245 324.477H697.922V334.875C697.922 335.348 697.99 335.704 698.127 335.94C698.27 336.172 698.449 336.329 698.667 336.409C698.89 336.485 699.124 336.523 699.37 336.523C699.555 336.523 699.707 336.513 699.825 336.494C699.943 336.471 700.038 336.452 700.109 336.438L700.45 337.943C700.336 337.986 700.178 338.028 699.974 338.071C699.77 338.118 699.512 338.142 699.2 338.142C698.726 338.142 698.262 338.04 697.808 337.837C697.358 337.633 696.984 337.323 696.686 336.906C696.392 336.49 696.245 335.964 696.245 335.33V324.477ZM702.772 338V327.091H704.449V338H702.772ZM703.625 325.273C703.298 325.273 703.016 325.161 702.779 324.939C702.547 324.716 702.431 324.449 702.431 324.136C702.431 323.824 702.547 323.556 702.779 323.334C703.016 323.111 703.298 323 703.625 323C703.951 323 704.231 323.111 704.463 323.334C704.699 323.556 704.818 323.824 704.818 324.136C704.818 324.449 704.699 324.716 704.463 324.939C704.231 325.161 703.951 325.273 703.625 325.273ZM711.95 338.227C710.965 338.227 710.101 337.993 709.358 337.524C708.619 337.055 708.042 336.4 707.625 335.557C707.213 334.714 707.007 333.729 707.007 332.602C707.007 331.466 707.213 330.474 707.625 329.626C708.042 328.779 708.619 328.121 709.358 327.652C710.101 327.183 710.965 326.949 711.95 326.949C712.935 326.949 713.797 327.183 714.536 327.652C715.279 328.121 715.857 328.779 716.268 329.626C716.685 330.474 716.893 331.466 716.893 332.602C716.893 333.729 716.685 334.714 716.268 335.557C715.857 336.4 715.279 337.055 714.536 337.524C713.797 337.993 712.935 338.227 711.95 338.227ZM711.95 336.722C712.698 336.722 713.314 336.53 713.797 336.146C714.28 335.763 714.637 335.259 714.869 334.634C715.101 334.009 715.217 333.331 715.217 332.602C715.217 331.873 715.101 331.194 714.869 330.564C714.637 329.934 714.28 329.425 713.797 329.037C713.314 328.649 712.698 328.455 711.95 328.455C711.202 328.455 710.587 328.649 710.104 329.037C709.621 329.425 709.263 329.934 709.031 330.564C708.799 331.194 708.683 331.873 708.683 332.602C708.683 333.331 708.799 334.009 709.031 334.634C709.263 335.259 709.621 335.763 710.104 336.146C710.587 336.53 711.202 336.722 711.95 336.722ZM721.128 331.438V338H719.452V327.091H721.071V328.795H721.213C721.469 328.241 721.857 327.796 722.378 327.46C722.899 327.119 723.571 326.949 724.395 326.949C725.134 326.949 725.78 327.1 726.334 327.403C726.888 327.702 727.319 328.156 727.627 328.767C727.935 329.373 728.088 330.14 728.088 331.068V338H726.412V331.182C726.412 330.325 726.19 329.657 725.745 329.179C725.3 328.696 724.689 328.455 723.912 328.455C723.377 328.455 722.899 328.571 722.478 328.803C722.061 329.035 721.732 329.373 721.49 329.818C721.249 330.263 721.128 330.803 721.128 331.438ZM738.879 329.534L737.373 329.96C737.278 329.709 737.138 329.465 736.954 329.229C736.774 328.987 736.528 328.788 736.215 328.632C735.903 328.476 735.503 328.398 735.015 328.398C734.347 328.398 733.791 328.552 733.346 328.859C732.906 329.162 732.685 329.548 732.685 330.017C732.685 330.434 732.837 330.763 733.14 331.004C733.443 331.246 733.916 331.447 734.56 331.608L736.18 332.006C737.155 332.242 737.882 332.605 738.36 333.092C738.838 333.575 739.077 334.198 739.077 334.96C739.077 335.585 738.897 336.144 738.538 336.636C738.183 337.129 737.685 337.517 737.046 337.801C736.407 338.085 735.664 338.227 734.816 338.227C733.703 338.227 732.782 337.986 732.053 337.503C731.324 337.02 730.862 336.314 730.668 335.386L732.259 334.989C732.411 335.576 732.697 336.016 733.119 336.31C733.545 336.603 734.101 336.75 734.788 336.75C735.569 336.75 736.189 336.584 736.648 336.253C737.112 335.917 737.344 335.514 737.344 335.045C737.344 334.667 737.212 334.349 736.947 334.094C736.682 333.833 736.274 333.639 735.725 333.511L733.907 333.085C732.908 332.848 732.174 332.482 731.705 331.984C731.241 331.482 731.009 330.855 731.009 330.102C731.009 329.487 731.182 328.942 731.528 328.469C731.878 327.995 732.354 327.624 732.955 327.354C733.561 327.084 734.248 326.949 735.015 326.949C736.094 326.949 736.942 327.186 737.558 327.659C738.178 328.133 738.618 328.758 738.879 329.534ZM744.1 336.011L743.987 336.778C743.906 337.318 743.783 337.896 743.618 338.511C743.457 339.127 743.288 339.707 743.113 340.251C742.938 340.796 742.794 341.229 742.68 341.551H741.402C741.463 341.248 741.544 340.848 741.643 340.351C741.743 339.854 741.842 339.297 741.941 338.682C742.046 338.071 742.131 337.446 742.197 336.807L742.282 336.011H744.1ZM752.831 342.091V327.091H754.45V328.824H754.649C754.772 328.634 754.943 328.393 755.161 328.099C755.383 327.801 755.7 327.536 756.112 327.304C756.529 327.067 757.092 326.949 757.803 326.949C758.721 326.949 759.531 327.179 760.232 327.638C760.932 328.097 761.479 328.748 761.872 329.591C762.265 330.434 762.462 331.428 762.462 332.574C762.462 333.729 762.265 334.731 761.872 335.578C761.479 336.421 760.935 337.074 760.239 337.538C759.543 337.998 758.74 338.227 757.831 338.227C757.13 338.227 756.569 338.111 756.148 337.879C755.726 337.643 755.402 337.375 755.175 337.077C754.947 336.774 754.772 336.523 754.649 336.324H754.507V342.091H752.831ZM754.479 332.545C754.479 333.369 754.599 334.096 754.841 334.726C755.082 335.351 755.435 335.841 755.899 336.196C756.363 336.546 756.931 336.722 757.604 336.722C758.304 336.722 758.889 336.537 759.358 336.168C759.831 335.794 760.187 335.292 760.423 334.662C760.665 334.027 760.786 333.322 760.786 332.545C760.786 331.778 760.667 331.087 760.43 330.472C760.198 329.851 759.846 329.361 759.372 329.001C758.903 328.637 758.314 328.455 757.604 328.455C756.922 328.455 756.349 328.627 755.885 328.973C755.421 329.314 755.071 329.792 754.834 330.408C754.597 331.018 754.479 331.731 754.479 332.545ZM769.45 338.227C768.465 338.227 767.601 337.993 766.858 337.524C766.119 337.055 765.542 336.4 765.125 335.557C764.713 334.714 764.507 333.729 764.507 332.602C764.507 331.466 764.713 330.474 765.125 329.626C765.542 328.779 766.119 328.121 766.858 327.652C767.601 327.183 768.465 326.949 769.45 326.949C770.435 326.949 771.297 327.183 772.036 327.652C772.779 328.121 773.357 328.779 773.768 329.626C774.185 330.474 774.393 331.466 774.393 332.602C774.393 333.729 774.185 334.714 773.768 335.557C773.357 336.4 772.779 337.055 772.036 337.524C771.297 337.993 770.435 338.227 769.45 338.227ZM769.45 336.722C770.198 336.722 770.814 336.53 771.297 336.146C771.78 335.763 772.137 335.259 772.369 334.634C772.601 334.009 772.717 333.331 772.717 332.602C772.717 331.873 772.601 331.194 772.369 330.564C772.137 329.934 771.78 329.425 771.297 329.037C770.814 328.649 770.198 328.455 769.45 328.455C768.702 328.455 768.087 328.649 767.604 329.037C767.121 329.425 766.763 329.934 766.531 330.564C766.299 331.194 766.183 331.873 766.183 332.602C766.183 333.331 766.299 334.009 766.531 334.634C766.763 335.259 767.121 335.763 767.604 336.146C768.087 336.53 768.702 336.722 769.45 336.722ZM778.628 323.455V338H776.952V323.455H778.628ZM781.698 338V327.091H783.374V338H781.698ZM782.55 325.273C782.224 325.273 781.942 325.161 781.705 324.939C781.473 324.716 781.357 324.449 781.357 324.136C781.357 323.824 781.473 323.556 781.705 323.334C781.942 323.111 782.224 323 782.55 323C782.877 323 783.156 323.111 783.388 323.334C783.625 323.556 783.744 323.824 783.744 324.136C783.744 324.449 783.625 324.716 783.388 324.939C783.156 325.161 782.877 325.273 782.55 325.273ZM790.876 338.227C789.853 338.227 788.973 337.986 788.234 337.503C787.495 337.02 786.927 336.355 786.529 335.507C786.132 334.66 785.933 333.691 785.933 332.602C785.933 331.494 786.136 330.517 786.544 329.669C786.956 328.817 787.529 328.152 788.262 327.673C789.001 327.19 789.863 326.949 790.848 326.949C791.615 326.949 792.306 327.091 792.922 327.375C793.537 327.659 794.041 328.057 794.434 328.568C794.827 329.08 795.071 329.676 795.166 330.358H793.49C793.362 329.861 793.078 329.42 792.637 329.037C792.202 328.649 791.615 328.455 790.876 328.455C790.223 328.455 789.65 328.625 789.157 328.966C788.67 329.302 788.288 329.778 788.014 330.393C787.744 331.004 787.609 331.722 787.609 332.545C787.609 333.388 787.742 334.122 788.007 334.747C788.277 335.372 788.655 335.857 789.143 336.203C789.636 336.549 790.213 336.722 790.876 336.722C791.312 336.722 791.707 336.646 792.062 336.494C792.417 336.343 792.718 336.125 792.964 335.841C793.21 335.557 793.386 335.216 793.49 334.818H795.166C795.071 335.462 794.837 336.042 794.463 336.558C794.093 337.07 793.603 337.477 792.993 337.78C792.386 338.078 791.681 338.227 790.876 338.227ZM797.616 338V327.091H799.292V338H797.616ZM798.468 325.273C798.142 325.273 797.86 325.161 797.623 324.939C797.391 324.716 797.275 324.449 797.275 324.136C797.275 323.824 797.391 323.556 797.623 323.334C797.86 323.111 798.142 323 798.468 323C798.795 323 799.074 323.111 799.306 323.334C799.543 323.556 799.662 323.824 799.662 324.136C799.662 324.449 799.543 324.716 799.306 324.939C799.074 325.161 798.795 325.273 798.468 325.273ZM806.936 338.227C805.885 338.227 804.978 337.995 804.216 337.531C803.458 337.062 802.874 336.409 802.462 335.571C802.054 334.728 801.851 333.748 801.851 332.631C801.851 331.513 802.054 330.528 802.462 329.676C802.874 328.819 803.446 328.152 804.18 327.673C804.919 327.19 805.781 326.949 806.766 326.949C807.334 326.949 807.895 327.044 808.449 327.233C809.003 327.422 809.507 327.73 809.962 328.156C810.416 328.578 810.778 329.136 811.048 329.832C811.318 330.528 811.453 331.385 811.453 332.403V333.114H803.044V331.665H809.749C809.749 331.049 809.625 330.5 809.379 330.017C809.138 329.534 808.792 329.153 808.342 328.874C807.897 328.594 807.372 328.455 806.766 328.455C806.098 328.455 805.52 328.62 805.033 328.952C804.55 329.278 804.178 329.705 803.918 330.23C803.657 330.756 803.527 331.319 803.527 331.92V332.886C803.527 333.71 803.669 334.409 803.953 334.982C804.242 335.55 804.642 335.983 805.153 336.281C805.665 336.575 806.259 336.722 806.936 336.722C807.376 336.722 807.774 336.66 808.129 336.537C808.489 336.409 808.799 336.22 809.06 335.969C809.32 335.713 809.521 335.396 809.663 335.017L811.283 335.472C811.112 336.021 810.826 336.504 810.423 336.92C810.021 337.332 809.524 337.654 808.932 337.886C808.34 338.114 807.675 338.227 806.936 338.227ZM821.73 329.534L820.224 329.96C820.13 329.709 819.99 329.465 819.805 329.229C819.625 328.987 819.379 328.788 819.067 328.632C818.754 328.476 818.354 328.398 817.866 328.398C817.199 328.398 816.643 328.552 816.197 328.859C815.757 329.162 815.537 329.548 815.537 330.017C815.537 330.434 815.688 330.763 815.991 331.004C816.295 331.246 816.768 331.447 817.412 331.608L819.031 332.006C820.007 332.242 820.733 332.605 821.212 333.092C821.69 333.575 821.929 334.198 821.929 334.96C821.929 335.585 821.749 336.144 821.389 336.636C821.034 337.129 820.537 337.517 819.898 337.801C819.259 338.085 818.515 338.227 817.668 338.227C816.555 338.227 815.634 337.986 814.905 337.503C814.176 337.02 813.714 336.314 813.52 335.386L815.111 334.989C815.262 335.576 815.549 336.016 815.97 336.31C816.396 336.603 816.953 336.75 817.639 336.75C818.42 336.75 819.041 336.584 819.5 336.253C819.964 335.917 820.196 335.514 820.196 335.045C820.196 334.667 820.063 334.349 819.798 334.094C819.533 333.833 819.126 333.639 818.577 333.511L816.759 333.085C815.759 332.848 815.026 332.482 814.557 331.984C814.093 331.482 813.861 330.855 813.861 330.102C813.861 329.487 814.034 328.942 814.379 328.469C814.73 327.995 815.205 327.624 815.807 327.354C816.413 327.084 817.099 326.949 817.866 326.949C818.946 326.949 819.794 327.186 820.409 327.659C821.029 328.133 821.47 328.758 821.73 329.534ZM826.952 336.011L826.838 336.778C826.758 337.318 826.635 337.896 826.469 338.511C826.308 339.127 826.14 339.707 825.965 340.251C825.79 340.796 825.645 341.229 825.532 341.551H824.253C824.315 341.248 824.395 340.848 824.495 340.351C824.594 339.854 824.694 339.297 824.793 338.682C824.897 338.071 824.982 337.446 825.049 336.807L825.134 336.011H826.952ZM840.256 338.227C839.205 338.227 838.299 337.995 837.536 337.531C836.779 337.062 836.194 336.409 835.782 335.571C835.375 334.728 835.171 333.748 835.171 332.631C835.171 331.513 835.375 330.528 835.782 329.676C836.194 328.819 836.767 328.152 837.501 327.673C838.239 327.19 839.101 326.949 840.086 326.949C840.654 326.949 841.215 327.044 841.769 327.233C842.323 327.422 842.827 327.73 843.282 328.156C843.737 328.578 844.099 329.136 844.369 329.832C844.638 330.528 844.773 331.385 844.773 332.403V333.114H836.364V331.665H843.069C843.069 331.049 842.946 330.5 842.7 330.017C842.458 329.534 842.112 329.153 841.663 328.874C841.218 328.594 840.692 328.455 840.086 328.455C839.418 328.455 838.841 328.62 838.353 328.952C837.87 329.278 837.498 329.705 837.238 330.23C836.978 330.756 836.847 331.319 836.847 331.92V332.886C836.847 333.71 836.989 334.409 837.273 334.982C837.562 335.55 837.962 335.983 838.474 336.281C838.985 336.575 839.579 336.722 840.256 336.722C840.697 336.722 841.094 336.66 841.45 336.537C841.809 336.409 842.12 336.22 842.38 335.969C842.64 335.713 842.842 335.396 842.984 335.017L844.603 335.472C844.433 336.021 844.146 336.504 843.744 336.92C843.341 337.332 842.844 337.654 842.252 337.886C841.66 338.114 840.995 338.227 840.256 338.227ZM852.067 327.091V328.511H846.414V327.091H852.067ZM848.062 324.477H849.738V334.875C849.738 335.348 849.807 335.704 849.944 335.94C850.086 336.172 850.266 336.329 850.484 336.409C850.706 336.485 850.941 336.523 851.187 336.523C851.371 336.523 851.523 336.513 851.641 336.494C851.76 336.471 851.854 336.452 851.925 336.438L852.266 337.943C852.153 337.986 851.994 338.028 851.79 338.071C851.587 338.118 851.329 338.142 851.016 338.142C850.543 338.142 850.079 338.04 849.624 337.837C849.174 337.633 848.8 337.323 848.502 336.906C848.209 336.49 848.062 335.964 848.062 335.33V324.477ZM858.903 338.227C857.881 338.227 857 337.986 856.261 337.503C855.523 337.02 854.955 336.355 854.557 335.507C854.159 334.66 853.96 333.691 853.96 332.602C853.96 331.494 854.164 330.517 854.571 329.669C854.983 328.817 855.556 328.152 856.29 327.673C857.028 327.19 857.89 326.949 858.875 326.949C859.642 326.949 860.333 327.091 860.949 327.375C861.564 327.659 862.069 328.057 862.462 328.568C862.855 329.08 863.098 329.676 863.193 330.358H861.517C861.389 329.861 861.105 329.42 860.665 329.037C860.229 328.649 859.642 328.455 858.903 328.455C858.25 328.455 857.677 328.625 857.185 328.966C856.697 329.302 856.316 329.778 856.041 330.393C855.771 331.004 855.636 331.722 855.636 332.545C855.636 333.388 855.769 334.122 856.034 334.747C856.304 335.372 856.683 335.857 857.17 336.203C857.663 336.549 858.241 336.722 858.903 336.722C859.339 336.722 859.734 336.646 860.089 336.494C860.445 336.343 860.745 336.125 860.991 335.841C861.238 335.557 861.413 335.216 861.517 334.818H863.193C863.098 335.462 862.864 336.042 862.49 336.558C862.121 337.07 861.631 337.477 861.02 337.78C860.414 338.078 859.708 338.227 858.903 338.227ZM866.865 338.114C866.515 338.114 866.214 337.988 865.963 337.737C865.712 337.486 865.587 337.186 865.587 336.835C865.587 336.485 865.712 336.184 865.963 335.933C866.214 335.682 866.515 335.557 866.865 335.557C867.215 335.557 867.516 335.682 867.767 335.933C868.018 336.184 868.143 336.485 868.143 336.835C868.143 337.067 868.084 337.28 867.966 337.474C867.852 337.669 867.698 337.825 867.504 337.943C867.315 338.057 867.102 338.114 866.865 338.114ZM874.731 331.864C874.731 333.653 874.496 335.301 874.028 336.807C873.564 338.308 872.898 339.69 872.032 340.955H870.555C870.896 340.486 871.213 339.908 871.506 339.222C871.805 338.54 872.065 337.792 872.288 336.977C872.51 336.158 872.683 335.313 872.806 334.442C872.934 333.566 872.998 332.706 872.998 331.864C872.998 330.737 872.889 329.593 872.671 328.433C872.453 327.273 872.16 326.196 871.79 325.202C871.421 324.207 871.009 323.398 870.555 322.773H872.032C872.898 324.037 873.564 325.422 874.028 326.928C874.496 328.429 874.731 330.074 874.731 331.864Z" fill="#03031C"/>
+<path d="M334.048 258V247.091H335.667V248.795H335.809C336.036 248.213 336.403 247.761 336.91 247.439C337.417 247.112 338.025 246.949 338.735 246.949C339.455 246.949 340.054 247.112 340.532 247.439C341.015 247.761 341.392 248.213 341.661 248.795H341.775C342.054 248.232 342.473 247.785 343.032 247.453C343.591 247.117 344.261 246.949 345.042 246.949C346.017 246.949 346.815 247.254 347.436 247.865C348.056 248.471 348.366 249.416 348.366 250.699V258H346.69V250.699C346.69 249.894 346.47 249.319 346.029 248.973C345.589 248.627 345.07 248.455 344.474 248.455C343.707 248.455 343.113 248.687 342.691 249.151C342.27 249.61 342.059 250.192 342.059 250.898V258H340.355V250.528C340.355 249.908 340.153 249.409 339.751 249.03C339.348 248.646 338.83 248.455 338.195 248.455C337.76 248.455 337.353 248.571 336.974 248.803C336.6 249.035 336.297 249.357 336.065 249.768C335.838 250.176 335.724 250.647 335.724 251.182V258H334.048ZM355.862 258.227C354.878 258.227 354.013 257.993 353.27 257.524C352.531 257.055 351.954 256.4 351.537 255.557C351.125 254.714 350.919 253.729 350.919 252.602C350.919 251.466 351.125 250.474 351.537 249.626C351.954 248.779 352.531 248.121 353.27 247.652C354.013 247.183 354.878 246.949 355.862 246.949C356.847 246.949 357.709 247.183 358.448 247.652C359.191 248.121 359.769 248.779 360.181 249.626C360.597 250.474 360.806 251.466 360.806 252.602C360.806 253.729 360.597 254.714 360.181 255.557C359.769 256.4 359.191 257.055 358.448 257.524C357.709 257.993 356.847 258.227 355.862 258.227ZM355.862 256.722C356.61 256.722 357.226 256.53 357.709 256.146C358.192 255.763 358.549 255.259 358.781 254.634C359.013 254.009 359.129 253.331 359.129 252.602C359.129 251.873 359.013 251.194 358.781 250.564C358.549 249.934 358.192 249.425 357.709 249.037C357.226 248.649 356.61 248.455 355.862 248.455C355.114 248.455 354.499 248.649 354.016 249.037C353.533 249.425 353.175 249.934 352.943 250.564C352.711 251.194 352.595 251.873 352.595 252.602C352.595 253.331 352.711 254.009 352.943 254.634C353.175 255.259 353.533 255.763 354.016 256.146C354.499 256.53 355.114 256.722 355.862 256.722ZM367.483 258.227C366.574 258.227 365.772 257.998 365.076 257.538C364.38 257.074 363.835 256.421 363.442 255.578C363.049 254.731 362.853 253.729 362.853 252.574C362.853 251.428 363.049 250.434 363.442 249.591C363.835 248.748 364.382 248.097 365.083 247.638C365.784 247.179 366.593 246.949 367.512 246.949C368.222 246.949 368.783 247.067 369.195 247.304C369.612 247.536 369.929 247.801 370.147 248.099C370.369 248.393 370.542 248.634 370.665 248.824H370.807V243.455H372.483V258H370.864V256.324H370.665C370.542 256.523 370.367 256.774 370.14 257.077C369.912 257.375 369.588 257.643 369.167 257.879C368.745 258.111 368.184 258.227 367.483 258.227ZM367.711 256.722C368.383 256.722 368.951 256.546 369.415 256.196C369.879 255.841 370.232 255.351 370.474 254.726C370.715 254.096 370.836 253.369 370.836 252.545C370.836 251.731 370.717 251.018 370.481 250.408C370.244 249.792 369.894 249.314 369.43 248.973C368.965 248.627 368.393 248.455 367.711 248.455C367.001 248.455 366.409 248.637 365.935 249.001C365.466 249.361 365.114 249.851 364.877 250.472C364.645 251.087 364.529 251.778 364.529 252.545C364.529 253.322 364.647 254.027 364.884 254.662C365.126 255.292 365.481 255.794 365.949 256.168C366.423 256.537 367.01 256.722 367.711 256.722ZM375.786 258V247.091H377.462V258H375.786ZM376.638 245.273C376.312 245.273 376.03 245.161 375.793 244.939C375.561 244.716 375.445 244.449 375.445 244.136C375.445 243.824 375.561 243.556 375.793 243.334C376.03 243.111 376.312 243 376.638 243C376.965 243 377.244 243.111 377.476 243.334C377.713 243.556 377.831 243.824 377.831 244.136C377.831 244.449 377.713 244.716 377.476 244.939C377.244 245.161 376.965 245.273 376.638 245.273ZM385.39 247.091V248.511H379.509V247.091H385.39ZM381.271 258V245.585C381.271 244.96 381.418 244.439 381.711 244.023C382.005 243.606 382.386 243.294 382.855 243.085C383.323 242.877 383.818 242.773 384.339 242.773C384.751 242.773 385.087 242.806 385.347 242.872C385.608 242.938 385.802 243 385.93 243.057L385.447 244.506C385.362 244.477 385.243 244.442 385.092 244.399C384.945 244.357 384.751 244.335 384.509 244.335C383.955 244.335 383.555 244.475 383.309 244.754C383.068 245.034 382.947 245.443 382.947 245.983V258H381.271ZM387.739 258V247.091H389.415V258H387.739ZM388.591 245.273C388.265 245.273 387.983 245.161 387.746 244.939C387.514 244.716 387.398 244.449 387.398 244.136C387.398 243.824 387.514 243.556 387.746 243.334C387.983 243.111 388.265 243 388.591 243C388.918 243 389.198 243.111 389.43 243.334C389.666 243.556 389.785 243.824 389.785 244.136C389.785 244.449 389.666 244.716 389.43 244.939C389.198 245.161 388.918 245.273 388.591 245.273ZM396.917 258.227C395.894 258.227 395.014 257.986 394.275 257.503C393.536 257.02 392.968 256.355 392.57 255.507C392.173 254.66 391.974 253.691 391.974 252.602C391.974 251.494 392.177 250.517 392.585 249.669C392.997 248.817 393.57 248.152 394.303 247.673C395.042 247.19 395.904 246.949 396.889 246.949C397.656 246.949 398.347 247.091 398.963 247.375C399.578 247.659 400.082 248.057 400.475 248.568C400.868 249.08 401.112 249.676 401.207 250.358H399.531C399.403 249.861 399.119 249.42 398.678 249.037C398.243 248.649 397.656 248.455 396.917 248.455C396.264 248.455 395.691 248.625 395.198 248.966C394.711 249.302 394.329 249.778 394.055 250.393C393.785 251.004 393.65 251.722 393.65 252.545C393.65 253.388 393.783 254.122 394.048 254.747C394.318 255.372 394.696 255.857 395.184 256.203C395.677 256.549 396.254 256.722 396.917 256.722C397.353 256.722 397.748 256.646 398.103 256.494C398.458 256.343 398.759 256.125 399.005 255.841C399.251 255.557 399.427 255.216 399.531 254.818H401.207C401.112 255.462 400.878 256.042 400.504 256.558C400.134 257.07 399.644 257.477 399.034 257.78C398.427 258.078 397.722 258.227 396.917 258.227ZM406.867 258.256C406.176 258.256 405.549 258.125 404.985 257.865C404.422 257.6 403.974 257.219 403.643 256.722C403.311 256.22 403.146 255.614 403.146 254.903C403.146 254.278 403.269 253.772 403.515 253.384C403.761 252.991 404.09 252.683 404.502 252.46C404.914 252.238 405.369 252.072 405.866 251.963C406.368 251.849 406.872 251.759 407.379 251.693C408.042 251.608 408.579 251.544 408.991 251.501C409.408 251.454 409.711 251.376 409.9 251.267C410.094 251.158 410.191 250.969 410.191 250.699V250.642C410.191 249.941 409.999 249.397 409.616 249.009C409.237 248.62 408.662 248.426 407.89 248.426C407.09 248.426 406.463 248.601 406.008 248.952C405.553 249.302 405.234 249.676 405.049 250.074L403.458 249.506C403.742 248.843 404.121 248.327 404.595 247.957C405.073 247.583 405.594 247.323 406.157 247.176C406.725 247.025 407.284 246.949 407.833 246.949C408.184 246.949 408.586 246.991 409.041 247.077C409.5 247.157 409.943 247.325 410.369 247.581C410.8 247.837 411.157 248.223 411.441 248.739C411.725 249.255 411.867 249.946 411.867 250.812V258H410.191V256.523H410.106C409.992 256.759 409.803 257.013 409.538 257.283C409.273 257.553 408.92 257.782 408.48 257.972C408.039 258.161 407.502 258.256 406.867 258.256ZM407.123 256.75C407.786 256.75 408.345 256.62 408.799 256.359C409.258 256.099 409.604 255.763 409.836 255.351C410.073 254.939 410.191 254.506 410.191 254.051V252.517C410.12 252.602 409.964 252.68 409.722 252.751C409.486 252.818 409.211 252.877 408.899 252.929C408.591 252.976 408.29 253.019 407.997 253.057C407.708 253.09 407.473 253.118 407.294 253.142C406.858 253.199 406.451 253.291 406.072 253.419C405.698 253.542 405.395 253.729 405.163 253.98C404.936 254.226 404.822 254.562 404.822 254.989C404.822 255.571 405.037 256.011 405.468 256.31C405.904 256.603 406.455 256.75 407.123 256.75ZM419.671 247.091V248.511H414.018V247.091H419.671ZM415.665 244.477H417.341V254.875C417.341 255.348 417.41 255.704 417.547 255.94C417.689 256.172 417.869 256.329 418.087 256.409C418.31 256.485 418.544 256.523 418.79 256.523C418.975 256.523 419.126 256.513 419.245 256.494C419.363 256.471 419.458 256.452 419.529 256.438L419.87 257.943C419.756 257.986 419.598 258.028 419.394 258.071C419.19 258.118 418.932 258.142 418.62 258.142C418.146 258.142 417.682 258.04 417.228 257.837C416.778 257.633 416.404 257.323 416.106 256.906C415.812 256.49 415.665 255.964 415.665 255.33V244.477ZM422.192 258V247.091H423.868V258H422.192ZM423.045 245.273C422.718 245.273 422.436 245.161 422.199 244.939C421.967 244.716 421.851 244.449 421.851 244.136C421.851 243.824 421.967 243.556 422.199 243.334C422.436 243.111 422.718 243 423.045 243C423.371 243 423.651 243.111 423.883 243.334C424.119 243.556 424.238 243.824 424.238 244.136C424.238 244.449 424.119 244.716 423.883 244.939C423.651 245.161 423.371 245.273 423.045 245.273ZM431.37 258.227C430.385 258.227 429.521 257.993 428.778 257.524C428.039 257.055 427.462 256.4 427.045 255.557C426.633 254.714 426.427 253.729 426.427 252.602C426.427 251.466 426.633 250.474 427.045 249.626C427.462 248.779 428.039 248.121 428.778 247.652C429.521 247.183 430.385 246.949 431.37 246.949C432.355 246.949 433.217 247.183 433.955 247.652C434.699 248.121 435.276 248.779 435.688 249.626C436.105 250.474 436.313 251.466 436.313 252.602C436.313 253.729 436.105 254.714 435.688 255.557C435.276 256.4 434.699 257.055 433.955 257.524C433.217 257.993 432.355 258.227 431.37 258.227ZM431.37 256.722C432.118 256.722 432.734 256.53 433.217 256.146C433.7 255.763 434.057 255.259 434.289 254.634C434.521 254.009 434.637 253.331 434.637 252.602C434.637 251.873 434.521 251.194 434.289 250.564C434.057 249.934 433.7 249.425 433.217 249.037C432.734 248.649 432.118 248.455 431.37 248.455C430.622 248.455 430.007 248.649 429.524 249.037C429.041 249.425 428.683 249.934 428.451 250.564C428.219 251.194 428.103 251.873 428.103 252.602C428.103 253.331 428.219 254.009 428.451 254.634C428.683 255.259 429.041 255.763 429.524 256.146C430.007 256.53 430.622 256.722 431.37 256.722ZM440.548 251.438V258H438.872V247.091H440.491V248.795H440.633C440.889 248.241 441.277 247.796 441.798 247.46C442.319 247.119 442.991 246.949 443.815 246.949C444.554 246.949 445.2 247.1 445.754 247.403C446.308 247.702 446.739 248.156 447.047 248.767C447.354 249.373 447.508 250.14 447.508 251.068V258H445.832V251.182C445.832 250.325 445.61 249.657 445.165 249.179C444.72 248.696 444.109 248.455 443.332 248.455C442.797 248.455 442.319 248.571 441.898 248.803C441.481 249.035 441.152 249.373 440.91 249.818C440.669 250.263 440.548 250.803 440.548 251.438ZM458.298 249.534L456.793 249.96C456.698 249.709 456.558 249.465 456.374 249.229C456.194 248.987 455.948 248.788 455.635 248.632C455.323 248.476 454.923 248.398 454.435 248.398C453.767 248.398 453.211 248.552 452.766 248.859C452.325 249.162 452.105 249.548 452.105 250.017C452.105 250.434 452.257 250.763 452.56 251.004C452.863 251.246 453.336 251.447 453.98 251.608L455.6 252.006C456.575 252.242 457.302 252.605 457.78 253.092C458.258 253.575 458.497 254.198 458.497 254.96C458.497 255.585 458.317 256.144 457.958 256.636C457.602 257.129 457.105 257.517 456.466 257.801C455.827 258.085 455.084 258.227 454.236 258.227C453.123 258.227 452.202 257.986 451.473 257.503C450.744 257.02 450.282 256.314 450.088 255.386L451.679 254.989C451.831 255.576 452.117 256.016 452.539 256.31C452.965 256.603 453.521 256.75 454.208 256.75C454.989 256.75 455.609 256.584 456.068 256.253C456.532 255.917 456.764 255.514 456.764 255.045C456.764 254.667 456.632 254.349 456.367 254.094C456.102 253.833 455.694 253.639 455.145 253.511L453.327 253.085C452.328 252.848 451.594 252.482 451.125 251.984C450.661 251.482 450.429 250.855 450.429 250.102C450.429 249.487 450.602 248.942 450.948 248.469C451.298 247.995 451.774 247.624 452.375 247.354C452.981 247.084 453.668 246.949 454.435 246.949C455.514 246.949 456.362 247.186 456.977 247.659C457.598 248.133 458.038 248.758 458.298 249.534Z" fill="#03031C"/>
+<path d="M548.448 439.091V440.511H542.795V439.091H548.448ZM544.443 436.477H546.119V446.875C546.119 447.348 546.187 447.704 546.325 447.94C546.467 448.172 546.647 448.329 546.865 448.409C547.087 448.485 547.321 448.523 547.568 448.523C547.752 448.523 547.904 448.513 548.022 448.494C548.141 448.471 548.235 448.452 548.306 448.438L548.647 449.943C548.534 449.986 548.375 450.028 548.171 450.071C547.968 450.118 547.71 450.142 547.397 450.142C546.924 450.142 546.46 450.04 546.005 449.837C545.555 449.633 545.181 449.323 544.883 448.906C544.589 448.49 544.443 447.964 544.443 447.33V436.477ZM550.97 450V439.091H552.589V440.739H552.703C552.901 440.199 553.261 439.761 553.782 439.425C554.303 439.089 554.89 438.92 555.544 438.92C555.667 438.92 555.82 438.923 556.005 438.928C556.19 438.932 556.329 438.939 556.424 438.949V440.653C556.367 440.639 556.237 440.618 556.034 440.589C555.835 440.556 555.624 440.54 555.401 440.54C554.871 440.54 554.398 440.651 553.981 440.874C553.569 441.091 553.242 441.394 553.001 441.783C552.764 442.166 552.646 442.604 552.646 443.097V450H550.97ZM561.621 450.256C560.93 450.256 560.303 450.125 559.739 449.865C559.176 449.6 558.728 449.219 558.397 448.722C558.065 448.22 557.9 447.614 557.9 446.903C557.9 446.278 558.023 445.772 558.269 445.384C558.515 444.991 558.844 444.683 559.256 444.46C559.668 444.238 560.123 444.072 560.62 443.963C561.122 443.849 561.626 443.759 562.133 443.693C562.796 443.608 563.333 443.544 563.745 443.501C564.162 443.454 564.465 443.376 564.654 443.267C564.848 443.158 564.945 442.969 564.945 442.699V442.642C564.945 441.941 564.753 441.397 564.37 441.009C563.991 440.62 563.416 440.426 562.644 440.426C561.844 440.426 561.216 440.601 560.762 440.952C560.307 441.302 559.988 441.676 559.803 442.074L558.212 441.506C558.496 440.843 558.875 440.327 559.349 439.957C559.827 439.583 560.348 439.323 560.911 439.176C561.479 439.025 562.038 438.949 562.587 438.949C562.938 438.949 563.34 438.991 563.795 439.077C564.254 439.157 564.697 439.325 565.123 439.581C565.554 439.837 565.911 440.223 566.195 440.739C566.479 441.255 566.621 441.946 566.621 442.812V450H564.945V448.523H564.86C564.746 448.759 564.557 449.013 564.292 449.283C564.027 449.553 563.674 449.782 563.233 449.972C562.793 450.161 562.256 450.256 561.621 450.256ZM561.877 448.75C562.54 448.75 563.099 448.62 563.553 448.359C564.012 448.099 564.358 447.763 564.59 447.351C564.827 446.939 564.945 446.506 564.945 446.051V444.517C564.874 444.602 564.718 444.68 564.476 444.751C564.24 444.818 563.965 444.877 563.653 444.929C563.345 444.976 563.044 445.019 562.751 445.057C562.462 445.09 562.227 445.118 562.047 445.142C561.612 445.199 561.205 445.291 560.826 445.419C560.452 445.542 560.149 445.729 559.917 445.98C559.689 446.226 559.576 446.562 559.576 446.989C559.576 447.571 559.791 448.011 560.222 448.31C560.658 448.603 561.209 448.75 561.877 448.75ZM574.112 450.227C573.09 450.227 572.209 449.986 571.47 449.503C570.732 449.02 570.164 448.355 569.766 447.507C569.368 446.66 569.169 445.691 569.169 444.602C569.169 443.494 569.373 442.517 569.78 441.669C570.192 440.817 570.765 440.152 571.499 439.673C572.237 439.19 573.099 438.949 574.084 438.949C574.851 438.949 575.542 439.091 576.158 439.375C576.773 439.659 577.278 440.057 577.671 440.568C578.064 441.08 578.307 441.676 578.402 442.358H576.726C576.598 441.861 576.314 441.42 575.874 441.037C575.438 440.649 574.851 440.455 574.112 440.455C573.459 440.455 572.886 440.625 572.394 440.966C571.906 441.302 571.525 441.778 571.25 442.393C570.98 443.004 570.845 443.722 570.845 444.545C570.845 445.388 570.978 446.122 571.243 446.747C571.513 447.372 571.892 447.857 572.379 448.203C572.872 448.549 573.45 448.722 574.112 448.722C574.548 448.722 574.943 448.646 575.298 448.494C575.654 448.343 575.954 448.125 576.2 447.841C576.447 447.557 576.622 447.216 576.726 446.818H578.402C578.307 447.462 578.073 448.042 577.699 448.558C577.33 449.07 576.84 449.477 576.229 449.78C575.623 450.078 574.917 450.227 574.112 450.227ZM582.415 446.023L582.387 443.949H582.727L587.5 439.091H589.574L584.489 444.233H584.347L582.415 446.023ZM580.852 450V435.455H582.529V450H580.852ZM587.784 450L583.523 444.602L584.716 443.438L589.915 450H587.784ZM591.731 450V439.091H593.407V450H591.731ZM592.584 437.273C592.257 437.273 591.975 437.161 591.738 436.939C591.506 436.716 591.39 436.449 591.39 436.136C591.39 435.824 591.506 435.556 591.738 435.334C591.975 435.111 592.257 435 592.584 435C592.91 435 593.19 435.111 593.422 435.334C593.658 435.556 593.777 435.824 593.777 436.136C593.777 436.449 593.658 436.716 593.422 436.939C593.19 437.161 592.91 437.273 592.584 437.273ZM598.154 443.438V450H596.477V439.091H598.097V440.795H598.239C598.494 440.241 598.883 439.796 599.404 439.46C599.924 439.119 600.597 438.949 601.421 438.949C602.159 438.949 602.806 439.1 603.36 439.403C603.914 439.702 604.344 440.156 604.652 440.767C604.96 441.373 605.114 442.14 605.114 443.068V450H603.438V443.182C603.438 442.325 603.215 441.657 602.77 441.179C602.325 440.696 601.714 440.455 600.938 440.455C600.403 440.455 599.924 440.571 599.503 440.803C599.086 441.035 598.757 441.373 598.516 441.818C598.274 442.263 598.154 442.803 598.154 443.438ZM612.58 454.318C611.77 454.318 611.074 454.214 610.492 454.006C609.91 453.802 609.424 453.532 609.036 453.196C608.653 452.865 608.347 452.509 608.12 452.131L609.455 451.193C609.607 451.392 609.798 451.619 610.03 451.875C610.262 452.135 610.58 452.36 610.982 452.55C611.389 452.744 611.922 452.841 612.58 452.841C613.461 452.841 614.188 452.628 614.76 452.202C615.333 451.776 615.62 451.108 615.62 450.199V447.983H615.478C615.355 448.182 615.18 448.428 614.952 448.722C614.73 449.01 614.408 449.268 613.986 449.496C613.57 449.718 613.006 449.83 612.296 449.83C611.415 449.83 610.625 449.621 609.924 449.205C609.228 448.788 608.676 448.182 608.269 447.386C607.867 446.591 607.665 445.625 607.665 444.489C607.665 443.371 607.862 442.398 608.255 441.57C608.648 440.736 609.195 440.092 609.895 439.638C610.596 439.179 611.406 438.949 612.324 438.949C613.035 438.949 613.598 439.067 614.015 439.304C614.436 439.536 614.758 439.801 614.981 440.099C615.208 440.393 615.383 440.634 615.506 440.824H615.677V439.091H617.296V450.312C617.296 451.25 617.083 452.012 616.657 452.599C616.235 453.191 615.667 453.625 614.952 453.899C614.242 454.179 613.451 454.318 612.58 454.318ZM612.523 448.324C613.196 448.324 613.764 448.17 614.228 447.862C614.692 447.554 615.045 447.112 615.286 446.534C615.528 445.956 615.648 445.265 615.648 444.46C615.648 443.674 615.53 442.981 615.293 442.379C615.056 441.778 614.706 441.307 614.242 440.966C613.778 440.625 613.205 440.455 612.523 440.455C611.813 440.455 611.221 440.634 610.748 440.994C610.279 441.354 609.926 441.837 609.689 442.443C609.457 443.049 609.341 443.722 609.341 444.46C609.341 445.218 609.46 445.888 609.697 446.47C609.938 447.048 610.293 447.502 610.762 447.834C611.235 448.161 611.823 448.324 612.523 448.324Z" fill="#03031C"/>
+<path d="M862.966 435.227C861.943 435.227 861.063 434.986 860.324 434.503C859.585 434.02 859.017 433.355 858.619 432.507C858.222 431.66 858.023 430.691 858.023 429.602C858.023 428.494 858.226 427.517 858.634 426.669C859.045 425.817 859.618 425.152 860.352 424.673C861.091 424.19 861.953 423.949 862.938 423.949C863.705 423.949 864.396 424.091 865.011 424.375C865.627 424.659 866.131 425.057 866.524 425.568C866.917 426.08 867.161 426.676 867.256 427.358H865.58C865.452 426.861 865.168 426.42 864.727 426.037C864.292 425.649 863.705 425.455 862.966 425.455C862.313 425.455 861.74 425.625 861.247 425.966C860.759 426.302 860.378 426.778 860.104 427.393C859.834 428.004 859.699 428.722 859.699 429.545C859.699 430.388 859.831 431.122 860.097 431.747C860.366 432.372 860.745 432.857 861.233 433.203C861.725 433.549 862.303 433.722 862.966 433.722C863.402 433.722 863.797 433.646 864.152 433.494C864.507 433.343 864.808 433.125 865.054 432.841C865.3 432.557 865.475 432.216 865.58 431.818H867.256C867.161 432.462 866.927 433.042 866.553 433.558C866.183 434.07 865.693 434.477 865.082 434.78C864.476 435.078 863.771 435.227 862.966 435.227ZM871.382 428.438V435H869.706V420.455H871.382V425.795H871.524C871.78 425.232 872.163 424.785 872.675 424.453C873.191 424.117 873.877 423.949 874.734 423.949C875.478 423.949 876.129 424.098 876.688 424.396C877.246 424.69 877.679 425.142 877.987 425.753C878.3 426.359 878.456 427.131 878.456 428.068V435H876.78V428.182C876.78 427.315 876.555 426.645 876.105 426.172C875.66 425.694 875.042 425.455 874.251 425.455C873.702 425.455 873.21 425.571 872.774 425.803C872.343 426.035 872.002 426.373 871.751 426.818C871.505 427.263 871.382 427.803 871.382 428.438ZM884.733 435.256C884.041 435.256 883.414 435.125 882.85 434.865C882.287 434.6 881.84 434.219 881.508 433.722C881.177 433.22 881.011 432.614 881.011 431.903C881.011 431.278 881.134 430.772 881.38 430.384C881.627 429.991 881.956 429.683 882.368 429.46C882.779 429.238 883.234 429.072 883.731 428.963C884.233 428.849 884.737 428.759 885.244 428.693C885.907 428.608 886.444 428.544 886.856 428.501C887.273 428.454 887.576 428.376 887.765 428.267C887.959 428.158 888.056 427.969 888.056 427.699V427.642C888.056 426.941 887.865 426.397 887.481 426.009C887.102 425.62 886.527 425.426 885.755 425.426C884.955 425.426 884.328 425.601 883.873 425.952C883.419 426.302 883.099 426.676 882.914 427.074L881.324 426.506C881.608 425.843 881.986 425.327 882.46 424.957C882.938 424.583 883.459 424.323 884.022 424.176C884.591 424.025 885.149 423.949 885.699 423.949C886.049 423.949 886.451 423.991 886.906 424.077C887.365 424.157 887.808 424.325 888.234 424.581C888.665 424.837 889.022 425.223 889.306 425.739C889.591 426.255 889.733 426.946 889.733 427.812V435H888.056V433.523H887.971C887.858 433.759 887.668 434.013 887.403 434.283C887.138 434.553 886.785 434.782 886.345 434.972C885.904 435.161 885.367 435.256 884.733 435.256ZM884.988 433.75C885.651 433.75 886.21 433.62 886.664 433.359C887.124 433.099 887.469 432.763 887.701 432.351C887.938 431.939 888.056 431.506 888.056 431.051V429.517C887.985 429.602 887.829 429.68 887.588 429.751C887.351 429.818 887.076 429.877 886.764 429.929C886.456 429.976 886.155 430.019 885.862 430.057C885.573 430.09 885.339 430.118 885.159 430.142C884.723 430.199 884.316 430.291 883.937 430.419C883.563 430.542 883.26 430.729 883.028 430.98C882.801 431.226 882.687 431.562 882.687 431.989C882.687 432.571 882.903 433.011 883.333 433.31C883.769 433.603 884.321 433.75 884.988 433.75ZM894.468 428.438V435H892.792V424.091H894.411V425.795H894.553C894.809 425.241 895.197 424.796 895.718 424.46C896.239 424.119 896.911 423.949 897.735 423.949C898.474 423.949 899.12 424.1 899.674 424.403C900.228 424.702 900.659 425.156 900.967 425.767C901.274 426.373 901.428 427.14 901.428 428.068V435H899.752V428.182C899.752 427.325 899.53 426.657 899.085 426.179C898.639 425.696 898.029 425.455 897.252 425.455C896.717 425.455 896.239 425.571 895.817 425.803C895.401 426.035 895.072 426.373 894.83 426.818C894.589 427.263 894.468 427.803 894.468 428.438ZM908.895 439.318C908.085 439.318 907.389 439.214 906.806 439.006C906.224 438.802 905.739 438.532 905.35 438.196C904.967 437.865 904.662 437.509 904.434 437.131L905.77 436.193C905.921 436.392 906.113 436.619 906.345 436.875C906.577 437.135 906.894 437.36 907.297 437.55C907.704 437.744 908.236 437.841 908.895 437.841C909.775 437.841 910.502 437.628 911.075 437.202C911.648 436.776 911.934 436.108 911.934 435.199V432.983H911.792C911.669 433.182 911.494 433.428 911.267 433.722C911.044 434.01 910.722 434.268 910.301 434.496C909.884 434.718 909.321 434.83 908.61 434.83C907.73 434.83 906.939 434.621 906.238 434.205C905.542 433.788 904.991 433.182 904.583 432.386C904.181 431.591 903.98 430.625 903.98 429.489C903.98 428.371 904.176 427.398 904.569 426.57C904.962 425.736 905.509 425.092 906.21 424.638C906.911 424.179 907.72 423.949 908.639 423.949C909.349 423.949 909.913 424.067 910.329 424.304C910.751 424.536 911.073 424.801 911.295 425.099C911.522 425.393 911.698 425.634 911.821 425.824H911.991V424.091H913.61V435.312C913.61 436.25 913.397 437.012 912.971 437.599C912.55 438.191 911.982 438.625 911.267 438.899C910.556 439.179 909.766 439.318 908.895 439.318ZM908.838 433.324C909.51 433.324 910.078 433.17 910.542 432.862C911.006 432.554 911.359 432.112 911.6 431.534C911.842 430.956 911.963 430.265 911.963 429.46C911.963 428.674 911.844 427.981 911.608 427.379C911.371 426.778 911.02 426.307 910.556 425.966C910.092 425.625 909.52 425.455 908.838 425.455C908.127 425.455 907.536 425.634 907.062 425.994C906.593 426.354 906.241 426.837 906.004 427.443C905.772 428.049 905.656 428.722 905.656 429.46C905.656 430.218 905.774 430.888 906.011 431.47C906.252 432.048 906.608 432.502 907.076 432.834C907.55 433.161 908.137 433.324 908.838 433.324ZM921.252 435.227C920.201 435.227 919.295 434.995 918.532 434.531C917.775 434.062 917.19 433.409 916.778 432.571C916.371 431.728 916.167 430.748 916.167 429.631C916.167 428.513 916.371 427.528 916.778 426.676C917.19 425.819 917.763 425.152 918.497 424.673C919.235 424.19 920.097 423.949 921.082 423.949C921.65 423.949 922.211 424.044 922.765 424.233C923.319 424.422 923.824 424.73 924.278 425.156C924.733 425.578 925.095 426.136 925.365 426.832C925.635 427.528 925.77 428.385 925.77 429.403V430.114H917.36V428.665H924.065C924.065 428.049 923.942 427.5 923.696 427.017C923.454 426.534 923.109 426.153 922.659 425.874C922.214 425.594 921.688 425.455 921.082 425.455C920.414 425.455 919.837 425.62 919.349 425.952C918.866 426.278 918.494 426.705 918.234 427.23C917.974 427.756 917.843 428.319 917.843 428.92V429.886C917.843 430.71 917.985 431.409 918.27 431.982C918.558 432.55 918.958 432.983 919.47 433.281C919.981 433.575 920.575 433.722 921.252 433.722C921.693 433.722 922.091 433.66 922.446 433.537C922.806 433.409 923.116 433.22 923.376 432.969C923.636 432.713 923.838 432.396 923.98 432.017L925.599 432.472C925.429 433.021 925.142 433.504 924.74 433.92C924.337 434.332 923.84 434.654 923.248 434.886C922.656 435.114 921.991 435.227 921.252 435.227ZM863.108 465.227C862.057 465.227 861.15 464.995 860.388 464.531C859.63 464.062 859.045 463.409 858.634 462.571C858.226 461.728 858.023 460.748 858.023 459.631C858.023 458.513 858.226 457.528 858.634 456.676C859.045 455.819 859.618 455.152 860.352 454.673C861.091 454.19 861.953 453.949 862.938 453.949C863.506 453.949 864.067 454.044 864.621 454.233C865.175 454.422 865.679 454.73 866.134 455.156C866.588 455.578 866.95 456.136 867.22 456.832C867.49 457.528 867.625 458.385 867.625 459.403V460.114H859.216V458.665H865.92C865.92 458.049 865.797 457.5 865.551 457.017C865.31 456.534 864.964 456.153 864.514 455.874C864.069 455.594 863.544 455.455 862.938 455.455C862.27 455.455 861.692 455.62 861.205 455.952C860.722 456.278 860.35 456.705 860.089 457.23C859.829 457.756 859.699 458.319 859.699 458.92V459.886C859.699 460.71 859.841 461.409 860.125 461.982C860.414 462.55 860.814 462.983 861.325 463.281C861.837 463.575 862.431 463.722 863.108 463.722C863.548 463.722 863.946 463.66 864.301 463.537C864.661 463.409 864.971 463.22 865.232 462.969C865.492 462.713 865.693 462.396 865.835 462.017L867.455 462.472C867.284 463.021 866.998 463.504 866.595 463.92C866.193 464.332 865.696 464.654 865.104 464.886C864.512 465.114 863.847 465.227 863.108 465.227ZM878.763 454.091L874.729 465H873.025L868.99 454.091H870.809L873.82 462.784H873.934L876.945 454.091H878.763ZM885.159 465.227C884.108 465.227 883.201 464.995 882.439 464.531C881.681 464.062 881.096 463.409 880.684 462.571C880.277 461.728 880.074 460.748 880.074 459.631C880.074 458.513 880.277 457.528 880.684 456.676C881.096 455.819 881.669 455.152 882.403 454.673C883.142 454.19 884.003 453.949 884.988 453.949C885.556 453.949 886.118 454.044 886.672 454.233C887.225 454.422 887.73 454.73 888.184 455.156C888.639 455.578 889.001 456.136 889.271 456.832C889.541 457.528 889.676 458.385 889.676 459.403V460.114H881.267V458.665H887.971C887.971 458.049 887.848 457.5 887.602 457.017C887.36 456.534 887.015 456.153 886.565 455.874C886.12 455.594 885.594 455.455 884.988 455.455C884.321 455.455 883.743 455.62 883.255 455.952C882.772 456.278 882.401 456.705 882.14 457.23C881.88 457.756 881.75 458.319 881.75 458.92V459.886C881.75 460.71 881.892 461.409 882.176 461.982C882.465 462.55 882.865 462.983 883.376 463.281C883.887 463.575 884.482 463.722 885.159 463.722C885.599 463.722 885.997 463.66 886.352 463.537C886.712 463.409 887.022 463.22 887.282 462.969C887.543 462.713 887.744 462.396 887.886 462.017L889.505 462.472C889.335 463.021 889.048 463.504 888.646 463.92C888.243 464.332 887.746 464.654 887.154 464.886C886.563 465.114 885.897 465.227 885.159 465.227ZM893.902 458.438V465H892.225V454.091H893.845V455.795H893.987C894.243 455.241 894.631 454.796 895.152 454.46C895.672 454.119 896.345 453.949 897.169 453.949C897.907 453.949 898.554 454.1 899.108 454.403C899.662 454.702 900.092 455.156 900.4 455.767C900.708 456.373 900.862 457.14 900.862 458.068V465H899.186V458.182C899.186 457.325 898.963 456.657 898.518 456.179C898.073 455.696 897.462 455.455 896.686 455.455C896.151 455.455 895.672 455.571 895.251 455.803C894.834 456.035 894.505 456.373 894.264 456.818C894.022 457.263 893.902 457.803 893.902 458.438ZM908.669 454.091V455.511H903.016V454.091H908.669ZM904.663 451.477H906.339V461.875C906.339 462.348 906.408 462.704 906.545 462.94C906.688 463.172 906.867 463.329 907.085 463.409C907.308 463.485 907.542 463.523 907.788 463.523C907.973 463.523 908.125 463.513 908.243 463.494C908.361 463.471 908.456 463.452 908.527 463.438L908.868 464.943C908.754 464.986 908.596 465.028 908.392 465.071C908.188 465.118 907.93 465.142 907.618 465.142C907.144 465.142 906.68 465.04 906.226 464.837C905.776 464.633 905.402 464.323 905.104 463.906C904.81 463.49 904.663 462.964 904.663 462.33V451.477ZM918.722 456.534L917.217 456.96C917.122 456.709 916.982 456.465 916.798 456.229C916.618 455.987 916.371 455.788 916.059 455.632C915.746 455.476 915.346 455.398 914.859 455.398C914.191 455.398 913.635 455.552 913.19 455.859C912.749 456.162 912.529 456.548 912.529 457.017C912.529 457.434 912.681 457.763 912.984 458.004C913.287 458.246 913.76 458.447 914.404 458.608L916.023 459.006C916.999 459.242 917.726 459.605 918.204 460.092C918.682 460.575 918.921 461.198 918.921 461.96C918.921 462.585 918.741 463.144 918.381 463.636C918.026 464.129 917.529 464.517 916.89 464.801C916.251 465.085 915.507 465.227 914.66 465.227C913.547 465.227 912.626 464.986 911.897 464.503C911.168 464.02 910.706 463.314 910.512 462.386L912.103 461.989C912.254 462.576 912.541 463.016 912.962 463.31C913.388 463.603 913.945 463.75 914.631 463.75C915.413 463.75 916.033 463.584 916.492 463.253C916.956 462.917 917.188 462.514 917.188 462.045C917.188 461.667 917.056 461.349 916.79 461.094C916.525 460.833 916.118 460.639 915.569 460.511L913.751 460.085C912.752 459.848 912.018 459.482 911.549 458.984C911.085 458.482 910.853 457.855 910.853 457.102C910.853 456.487 911.026 455.942 911.371 455.469C911.722 454.995 912.198 454.624 912.799 454.354C913.405 454.084 914.092 453.949 914.859 453.949C915.938 453.949 916.786 454.186 917.401 454.659C918.022 455.133 918.462 455.758 918.722 456.534Z" fill="#03031C"/>
+<path d="M1228.86 675.988V672.818H1243.8V675.988H1238.23V691H1234.43V675.988H1228.86ZM1246.96 696.114C1246.48 696.114 1246.03 696.075 1245.61 695.998C1245.19 695.927 1244.85 695.835 1244.58 695.723L1245.43 692.9C1245.87 693.036 1246.27 693.11 1246.63 693.122C1246.99 693.134 1247.3 693.051 1247.56 692.873C1247.83 692.696 1248.04 692.394 1248.21 691.968L1248.43 691.391L1243.54 677.364H1247.52L1250.34 687.378H1250.48L1253.33 677.364H1257.34L1252.04 692.474C1251.78 693.208 1251.44 693.847 1251 694.391C1250.57 694.942 1250.02 695.365 1249.35 695.661C1248.69 695.963 1247.89 696.114 1246.96 696.114ZM1262.7 687.076L1262.71 682.539H1263.26L1267.63 677.364H1271.97L1266.1 684.217H1265.2L1262.7 687.076ZM1259.27 691V672.818H1263.05V691H1259.27ZM1267.79 691L1263.78 685.061L1266.3 682.388L1272.22 691H1267.79ZM1295.72 679.184H1291.83C1291.76 678.681 1291.62 678.234 1291.4 677.843C1291.18 677.446 1290.9 677.109 1290.55 676.831C1290.21 676.553 1289.81 676.34 1289.37 676.192C1288.92 676.044 1288.44 675.97 1287.92 675.97C1286.98 675.97 1286.16 676.204 1285.46 676.671C1284.76 677.133 1284.22 677.808 1283.83 678.695C1283.45 679.577 1283.26 680.648 1283.26 681.909C1283.26 683.205 1283.45 684.294 1283.83 685.176C1284.22 686.058 1284.77 686.724 1285.47 687.174C1286.17 687.623 1286.97 687.848 1287.89 687.848C1288.41 687.848 1288.88 687.78 1289.32 687.644C1289.76 687.508 1290.16 687.31 1290.5 687.049C1290.84 686.783 1291.13 686.46 1291.35 686.082C1291.58 685.703 1291.74 685.271 1291.83 684.786L1295.72 684.803C1295.62 685.638 1295.37 686.443 1294.97 687.218C1294.57 687.987 1294.03 688.677 1293.36 689.287C1292.69 689.89 1291.89 690.37 1290.96 690.725C1290.04 691.074 1289 691.249 1287.83 691.249C1286.21 691.249 1284.76 690.882 1283.48 690.148C1282.21 689.414 1281.2 688.351 1280.46 686.961C1279.73 685.57 1279.36 683.886 1279.36 681.909C1279.36 679.926 1279.73 678.24 1280.48 676.849C1281.22 675.458 1282.24 674.398 1283.51 673.67C1284.79 672.937 1286.23 672.57 1287.83 672.57C1288.88 672.57 1289.86 672.718 1290.76 673.013C1291.66 673.309 1292.47 673.741 1293.16 674.31C1293.86 674.872 1294.43 675.561 1294.87 676.378C1295.31 677.195 1295.6 678.13 1295.72 679.184ZM1304.57 691.266C1303.19 691.266 1302 690.973 1300.99 690.387C1299.99 689.796 1299.22 688.973 1298.67 687.919C1298.13 686.86 1297.86 685.632 1297.86 684.235C1297.86 682.826 1298.13 681.595 1298.67 680.542C1299.22 679.482 1299.99 678.66 1300.99 678.074C1302 677.482 1303.19 677.186 1304.57 677.186C1305.95 677.186 1307.14 677.482 1308.14 678.074C1309.14 678.66 1309.92 679.482 1310.46 680.542C1311.01 681.595 1311.28 682.826 1311.28 684.235C1311.28 685.632 1311.01 686.86 1310.46 687.919C1309.92 688.973 1309.14 689.796 1308.14 690.387C1307.14 690.973 1305.95 691.266 1304.57 691.266ZM1304.59 688.337C1305.21 688.337 1305.74 688.159 1306.16 687.804C1306.58 687.443 1306.89 686.952 1307.11 686.33C1307.33 685.709 1307.44 685.002 1307.44 684.208C1307.44 683.415 1307.33 682.708 1307.11 682.087C1306.89 681.465 1306.58 680.974 1306.16 680.613C1305.74 680.252 1305.21 680.071 1304.59 680.071C1303.95 680.071 1303.42 680.252 1302.99 680.613C1302.56 680.974 1302.24 681.465 1302.02 682.087C1301.81 682.708 1301.7 683.415 1301.7 684.208C1301.7 685.002 1301.81 685.709 1302.02 686.33C1302.24 686.952 1302.56 687.443 1302.99 687.804C1303.42 688.159 1303.95 688.337 1304.59 688.337ZM1317.52 683.116V691H1313.74V677.364H1317.34V679.77H1317.5C1317.81 678.976 1318.31 678.349 1319.02 677.887C1319.73 677.42 1320.59 677.186 1321.6 677.186C1322.55 677.186 1323.38 677.393 1324.08 677.808C1324.79 678.222 1325.33 678.814 1325.72 679.583C1326.11 680.347 1326.31 681.258 1326.31 682.317V691H1322.53V682.992C1322.53 682.158 1322.32 681.507 1321.89 681.039C1321.46 680.566 1320.86 680.329 1320.1 680.329C1319.6 680.329 1319.15 680.438 1318.76 680.657C1318.37 680.876 1318.07 681.196 1317.85 681.616C1317.64 682.03 1317.53 682.531 1317.52 683.116ZM1336.54 677.364V680.205H1328.33V677.364H1336.54ZM1330.2 674.097H1333.98V686.81C1333.98 687.159 1334.03 687.431 1334.14 687.626C1334.24 687.816 1334.39 687.949 1334.58 688.026C1334.78 688.103 1335 688.141 1335.26 688.141C1335.43 688.141 1335.61 688.127 1335.79 688.097C1335.97 688.061 1336.1 688.035 1336.2 688.017L1336.79 690.831C1336.6 690.891 1336.34 690.959 1335.99 691.036C1335.65 691.118 1335.23 691.169 1334.74 691.186C1333.83 691.222 1333.03 691.101 1332.34 690.822C1331.66 690.544 1331.13 690.112 1330.76 689.526C1330.38 688.94 1330.19 688.201 1330.2 687.307V674.097ZM1339.01 691V677.364H1342.67V679.743H1342.82C1343.06 678.897 1343.48 678.257 1344.07 677.825C1344.65 677.387 1345.33 677.168 1346.09 677.168C1346.28 677.168 1346.49 677.18 1346.7 677.204C1346.92 677.228 1347.12 677.26 1347.28 677.301V680.657C1347.1 680.604 1346.86 680.557 1346.55 680.515C1346.23 680.474 1345.94 680.453 1345.68 680.453C1345.13 680.453 1344.63 680.574 1344.19 680.817C1343.76 681.054 1343.42 681.385 1343.16 681.811C1342.91 682.238 1342.79 682.729 1342.79 683.285V691H1339.01ZM1354.76 691.266C1353.38 691.266 1352.19 690.973 1351.19 690.387C1350.19 689.796 1349.41 688.973 1348.87 687.919C1348.32 686.86 1348.05 685.632 1348.05 684.235C1348.05 682.826 1348.32 681.595 1348.87 680.542C1349.41 679.482 1350.19 678.66 1351.19 678.074C1352.19 677.482 1353.38 677.186 1354.76 677.186C1356.14 677.186 1357.33 677.482 1358.33 678.074C1359.34 678.66 1360.11 679.482 1360.66 680.542C1361.2 681.595 1361.48 682.826 1361.48 684.235C1361.48 685.632 1361.2 686.86 1360.66 687.919C1360.11 688.973 1359.34 689.796 1358.33 690.387C1357.33 690.973 1356.14 691.266 1354.76 691.266ZM1354.78 688.337C1355.41 688.337 1355.93 688.159 1356.35 687.804C1356.77 687.443 1357.09 686.952 1357.3 686.33C1357.52 685.709 1357.63 685.002 1357.63 684.208C1357.63 683.415 1357.52 682.708 1357.3 682.087C1357.09 681.465 1356.77 680.974 1356.35 680.613C1355.93 680.252 1355.41 680.071 1354.78 680.071C1354.15 680.071 1353.62 680.252 1353.18 680.613C1352.76 680.974 1352.43 681.465 1352.22 682.087C1352 682.708 1351.9 683.415 1351.9 684.208C1351.9 685.002 1352 685.709 1352.22 686.33C1352.43 686.952 1352.76 687.443 1353.18 687.804C1353.62 688.159 1354.15 688.337 1354.78 688.337ZM1367.72 672.818V691H1363.93V672.818H1367.72ZM1269.08 726V707.818H1276.26C1277.64 707.818 1278.81 708.082 1279.78 708.608C1280.75 709.129 1281.49 709.854 1282 710.783C1282.52 711.707 1282.77 712.772 1282.77 713.979C1282.77 715.187 1282.51 716.252 1281.99 717.175C1281.47 718.099 1280.72 718.818 1279.73 719.333C1278.75 719.848 1277.56 720.105 1276.16 720.105H1271.59V717.025H1275.54C1276.28 717.025 1276.89 716.897 1277.37 716.643C1277.85 716.382 1278.21 716.024 1278.45 715.569C1278.69 715.107 1278.81 714.577 1278.81 713.979C1278.81 713.376 1278.69 712.849 1278.45 712.399C1278.21 711.943 1277.85 711.591 1277.37 711.343C1276.88 711.088 1276.27 710.961 1275.52 710.961H1272.93V726H1269.08ZM1288.98 707.818V726H1285.2V707.818H1288.98ZM1295.9 726.257C1295.03 726.257 1294.25 726.107 1293.57 725.805C1292.89 725.497 1292.35 725.044 1291.96 724.446C1291.57 723.843 1291.37 723.091 1291.37 722.191C1291.37 721.434 1291.51 720.798 1291.79 720.283C1292.07 719.768 1292.45 719.353 1292.93 719.04C1293.4 718.726 1293.95 718.489 1294.56 718.33C1295.17 718.17 1295.82 718.057 1296.49 717.992C1297.29 717.909 1297.93 717.832 1298.41 717.761C1298.9 717.684 1299.25 717.572 1299.47 717.424C1299.69 717.276 1299.8 717.057 1299.8 716.767V716.714C1299.8 716.152 1299.62 715.717 1299.26 715.409C1298.91 715.101 1298.42 714.947 1297.77 714.947C1297.09 714.947 1296.55 715.098 1296.15 715.4C1295.75 715.696 1295.48 716.069 1295.35 716.518L1291.85 716.234C1292.03 715.406 1292.38 714.69 1292.9 714.086C1293.42 713.476 1294.09 713.009 1294.91 712.683C1295.74 712.352 1296.7 712.186 1297.79 712.186C1298.55 712.186 1299.27 712.275 1299.97 712.452C1300.66 712.63 1301.28 712.905 1301.82 713.278C1302.37 713.651 1302.79 714.13 1303.11 714.716C1303.42 715.296 1303.58 715.992 1303.58 716.803V726H1299.99V724.109H1299.89C1299.67 724.535 1299.37 724.911 1299.01 725.237C1298.64 725.556 1298.2 725.808 1297.68 725.991C1297.17 726.169 1296.57 726.257 1295.9 726.257ZM1296.98 723.647C1297.54 723.647 1298.03 723.538 1298.46 723.319C1298.88 723.094 1299.22 722.792 1299.46 722.413C1299.7 722.035 1299.82 721.605 1299.82 721.126V719.679C1299.7 719.756 1299.54 719.827 1299.33 719.892C1299.13 719.951 1298.91 720.007 1298.65 720.061C1298.4 720.108 1298.14 720.152 1297.89 720.194C1297.63 720.229 1297.4 720.262 1297.2 720.292C1296.75 720.357 1296.36 720.46 1296.03 720.602C1295.7 720.744 1295.44 720.937 1295.26 721.179C1295.08 721.416 1294.98 721.712 1294.98 722.067C1294.98 722.582 1295.17 722.976 1295.54 723.248C1295.92 723.514 1296.4 723.647 1296.98 723.647ZM1310.29 718.116V726H1306.51V712.364H1310.12V714.77H1310.28C1310.58 713.976 1311.08 713.349 1311.79 712.887C1312.51 712.42 1313.37 712.186 1314.38 712.186C1315.33 712.186 1316.15 712.393 1316.86 712.808C1317.56 713.222 1318.11 713.814 1318.5 714.583C1318.89 715.347 1319.08 716.258 1319.08 717.317V726H1315.3V717.992C1315.31 717.158 1315.09 716.507 1314.66 716.039C1314.23 715.566 1313.64 715.329 1312.88 715.329C1312.37 715.329 1311.92 715.438 1311.53 715.657C1311.14 715.876 1310.84 716.196 1310.62 716.616C1310.41 717.03 1310.3 717.531 1310.29 718.116ZM1328.28 726.266C1326.88 726.266 1325.67 725.982 1324.66 725.414C1323.65 724.84 1322.88 724.029 1322.33 722.982C1321.79 721.928 1321.51 720.682 1321.51 719.244C1321.51 717.841 1321.79 716.61 1322.33 715.551C1322.88 714.491 1323.64 713.666 1324.63 713.074C1325.62 712.482 1326.79 712.186 1328.13 712.186C1329.03 712.186 1329.87 712.331 1330.64 712.621C1331.42 712.905 1332.1 713.334 1332.68 713.908C1333.27 714.482 1333.72 715.205 1334.05 716.075C1334.38 716.939 1334.54 717.951 1334.54 719.111V720.15H1323.02V717.806H1330.98C1330.98 717.261 1330.86 716.779 1330.62 716.359C1330.39 715.938 1330.06 715.61 1329.64 715.373C1329.22 715.131 1328.74 715.009 1328.19 715.009C1327.62 715.009 1327.11 715.142 1326.66 715.409C1326.23 715.669 1325.88 716.021 1325.63 716.465C1325.38 716.903 1325.26 717.391 1325.25 717.93V720.158C1325.25 720.833 1325.38 721.416 1325.62 721.907C1325.88 722.399 1326.24 722.777 1326.7 723.044C1327.16 723.31 1327.71 723.443 1328.34 723.443C1328.76 723.443 1329.15 723.384 1329.5 723.266C1329.84 723.147 1330.14 722.97 1330.39 722.733C1330.64 722.496 1330.83 722.206 1330.96 721.863L1334.46 722.094C1334.28 722.934 1333.92 723.668 1333.37 724.295C1332.82 724.917 1332.12 725.402 1331.25 725.751C1330.39 726.095 1329.4 726.266 1328.28 726.266Z" fill="#03031C"/>
+<path d="M469.707 272.707C470.098 272.317 470.098 271.683 469.707 271.293L463.343 264.929C462.953 264.538 462.319 264.538 461.929 264.929C461.538 265.319 461.538 265.953 461.929 266.343L467.586 272L461.929 277.657C461.538 278.047 461.538 278.681 461.929 279.071C462.319 279.462 462.953 279.462 463.343 279.071L469.707 272.707ZM321 273L469 273L469 271L321 271L321 273Z" fill="#03031C"/>
+<path d="M1050.86 638.256C1050.17 638.256 1049.54 638.125 1048.98 637.865C1048.41 637.6 1047.96 637.219 1047.63 636.722C1047.3 636.22 1047.14 635.614 1047.14 634.903C1047.14 634.278 1047.26 633.772 1047.51 633.384C1047.75 632.991 1048.08 632.683 1048.49 632.46C1048.9 632.238 1049.36 632.072 1049.86 631.963C1050.36 631.849 1050.86 631.759 1051.37 631.693C1052.03 631.608 1052.57 631.544 1052.98 631.501C1053.4 631.454 1053.7 631.376 1053.89 631.267C1054.08 631.158 1054.18 630.969 1054.18 630.699V630.642C1054.18 629.941 1053.99 629.397 1053.61 629.009C1053.23 628.62 1052.65 628.426 1051.88 628.426C1051.08 628.426 1050.45 628.601 1050 628.952C1049.54 629.302 1049.22 629.676 1049.04 630.074L1047.45 629.506C1047.73 628.843 1048.11 628.327 1048.58 627.957C1049.06 627.583 1049.58 627.323 1050.15 627.176C1050.72 627.025 1051.27 626.949 1051.82 626.949C1052.17 626.949 1052.58 626.991 1053.03 627.077C1053.49 627.157 1053.93 627.325 1054.36 627.581C1054.79 627.837 1055.15 628.223 1055.43 628.739C1055.72 629.255 1055.86 629.946 1055.86 630.812V638H1054.18V636.523H1054.1C1053.98 636.759 1053.79 637.013 1053.53 637.283C1053.26 637.553 1052.91 637.782 1052.47 637.972C1052.03 638.161 1051.49 638.256 1050.86 638.256ZM1051.11 636.75C1051.78 636.75 1052.33 636.62 1052.79 636.359C1053.25 636.099 1053.59 635.763 1053.83 635.351C1054.06 634.939 1054.18 634.506 1054.18 634.051V632.517C1054.11 632.602 1053.95 632.68 1053.71 632.751C1053.48 632.818 1053.2 632.877 1052.89 632.929C1052.58 632.976 1052.28 633.019 1051.99 633.057C1051.7 633.09 1051.46 633.118 1051.28 633.142C1050.85 633.199 1050.44 633.291 1050.06 633.419C1049.69 633.542 1049.39 633.729 1049.15 633.98C1048.93 634.226 1048.81 634.562 1048.81 634.989C1048.81 635.571 1049.03 636.011 1049.46 636.31C1049.89 636.603 1050.45 636.75 1051.11 636.75ZM1063.04 638.227C1062.13 638.227 1061.32 637.998 1060.63 637.538C1059.93 637.074 1059.39 636.421 1059 635.578C1058.6 634.731 1058.41 633.729 1058.41 632.574C1058.41 631.428 1058.6 630.434 1059 629.591C1059.39 628.748 1059.93 628.097 1060.64 627.638C1061.34 627.179 1062.15 626.949 1063.06 626.949C1063.77 626.949 1064.34 627.067 1064.75 627.304C1065.16 627.536 1065.48 627.801 1065.7 628.099C1065.92 628.393 1066.09 628.634 1066.22 628.824H1066.36V623.455H1068.04V638H1066.42V636.324H1066.22C1066.09 636.523 1065.92 636.774 1065.69 637.077C1065.47 637.375 1065.14 637.643 1064.72 637.879C1064.3 638.111 1063.74 638.227 1063.04 638.227ZM1063.26 636.722C1063.94 636.722 1064.5 636.546 1064.97 636.196C1065.43 635.841 1065.78 635.351 1066.03 634.726C1066.27 634.096 1066.39 633.369 1066.39 632.545C1066.39 631.731 1066.27 631.018 1066.03 630.408C1065.8 629.792 1065.45 629.314 1064.98 628.973C1064.52 628.627 1063.95 628.455 1063.26 628.455C1062.55 628.455 1061.96 628.637 1061.49 629.001C1061.02 629.361 1060.67 629.851 1060.43 630.472C1060.2 631.087 1060.08 631.778 1060.08 632.545C1060.08 633.322 1060.2 634.027 1060.44 634.662C1060.68 635.292 1061.03 635.794 1061.5 636.168C1061.98 636.537 1062.56 636.722 1063.26 636.722ZM1071.34 627.091H1073.01V638.795C1073.01 639.468 1072.9 640.05 1072.67 640.543C1072.44 641.035 1072.09 641.416 1071.63 641.686C1071.17 641.956 1070.59 642.091 1069.89 642.091C1069.83 642.091 1069.78 642.091 1069.72 642.091C1069.66 642.091 1069.61 642.091 1069.55 642.091V640.528C1069.61 640.528 1069.66 640.528 1069.71 640.528C1069.75 640.528 1069.8 640.528 1069.86 640.528C1070.37 640.528 1070.75 640.377 1070.98 640.074C1071.22 639.776 1071.34 639.349 1071.34 638.795V627.091ZM1072.16 625.273C1071.84 625.273 1071.55 625.161 1071.32 624.939C1071.09 624.716 1070.97 624.449 1070.97 624.136C1070.97 623.824 1071.09 623.556 1071.32 623.334C1071.55 623.111 1071.84 623 1072.16 623C1072.49 623 1072.77 623.111 1073 623.334C1073.24 623.556 1073.36 623.824 1073.36 624.136C1073.36 624.449 1073.24 624.716 1073 624.939C1072.77 625.161 1072.49 625.273 1072.16 625.273ZM1082.96 633.54V627.091H1084.64V638H1082.96V636.153H1082.85C1082.59 636.707 1082.19 637.179 1081.65 637.567C1081.11 637.95 1080.43 638.142 1079.61 638.142C1078.93 638.142 1078.32 637.993 1077.79 637.695C1077.26 637.392 1076.84 636.937 1076.54 636.331C1076.24 635.72 1076.08 634.951 1076.08 634.023V627.091H1077.76V633.909C1077.76 634.705 1077.98 635.339 1078.43 635.812C1078.88 636.286 1079.45 636.523 1080.15 636.523C1080.56 636.523 1080.99 636.416 1081.42 636.203C1081.85 635.99 1082.22 635.663 1082.51 635.223C1082.81 634.783 1082.96 634.222 1082.96 633.54ZM1095.43 629.534L1093.93 629.96C1093.83 629.709 1093.69 629.465 1093.51 629.229C1093.33 628.987 1093.08 628.788 1092.77 628.632C1092.46 628.476 1092.06 628.398 1091.57 628.398C1090.9 628.398 1090.35 628.552 1089.9 628.859C1089.46 629.162 1089.24 629.548 1089.24 630.017C1089.24 630.434 1089.39 630.763 1089.69 631.004C1090 631.246 1090.47 631.447 1091.12 631.608L1092.73 632.006C1093.71 632.242 1094.44 632.605 1094.91 633.092C1095.39 633.575 1095.63 634.198 1095.63 634.96C1095.63 635.585 1095.45 636.144 1095.09 636.636C1094.74 637.129 1094.24 637.517 1093.6 637.801C1092.96 638.085 1092.22 638.227 1091.37 638.227C1090.26 638.227 1089.34 637.986 1088.61 637.503C1087.88 637.02 1087.42 636.314 1087.22 635.386L1088.81 634.989C1088.97 635.576 1089.25 636.016 1089.67 636.31C1090.1 636.603 1090.66 636.75 1091.34 636.75C1092.12 636.75 1092.74 636.584 1093.2 636.253C1093.67 635.917 1093.9 635.514 1093.9 635.045C1093.9 634.667 1093.77 634.349 1093.5 634.094C1093.24 633.833 1092.83 633.639 1092.28 633.511L1090.46 633.085C1089.46 632.848 1088.73 632.482 1088.26 631.984C1087.8 631.482 1087.56 630.855 1087.56 630.102C1087.56 629.487 1087.74 628.942 1088.08 628.469C1088.43 627.995 1088.91 627.624 1089.51 627.354C1090.12 627.084 1090.8 626.949 1091.57 626.949C1092.65 626.949 1093.5 627.186 1094.11 627.659C1094.73 628.133 1095.17 628.758 1095.43 629.534ZM1102.9 627.091V628.511H1097.25V627.091H1102.9ZM1098.89 624.477H1100.57V634.875C1100.57 635.348 1100.64 635.704 1100.78 635.94C1100.92 636.172 1101.1 636.329 1101.32 636.409C1101.54 636.485 1101.77 636.523 1102.02 636.523C1102.2 636.523 1102.35 636.513 1102.47 636.494C1102.59 636.471 1102.69 636.452 1102.76 636.438L1103.1 637.943C1102.98 637.986 1102.83 638.028 1102.62 638.071C1102.42 638.118 1102.16 638.142 1101.85 638.142C1101.37 638.142 1100.91 638.04 1100.46 637.837C1100.01 637.633 1099.63 637.323 1099.33 636.906C1099.04 636.49 1098.89 635.964 1098.89 635.33V624.477Z" fill="#03031C"/>
+<path d="M666.755 846V835.091H668.431V846H666.755ZM667.607 833.273C667.28 833.273 666.999 833.161 666.762 832.939C666.53 832.716 666.414 832.449 666.414 832.136C666.414 831.824 666.53 831.556 666.762 831.334C666.999 831.111 667.28 831 667.607 831C667.934 831 668.213 831.111 668.445 831.334C668.682 831.556 668.8 831.824 668.8 832.136C668.8 832.449 668.682 832.716 668.445 832.939C668.213 833.161 667.934 833.273 667.607 833.273ZM673.177 839.438V846H671.501V835.091H673.12V836.795H673.262C673.518 836.241 673.906 835.796 674.427 835.46C674.948 835.119 675.62 834.949 676.444 834.949C677.183 834.949 677.829 835.1 678.383 835.403C678.937 835.702 679.368 836.156 679.676 836.767C679.983 837.373 680.137 838.14 680.137 839.068V846H678.461V839.182C678.461 838.325 678.239 837.657 677.794 837.179C677.348 836.696 676.738 836.455 675.961 836.455C675.426 836.455 674.948 836.571 674.526 836.803C674.11 837.035 673.781 837.373 673.539 837.818C673.298 838.263 673.177 838.803 673.177 839.438ZM693.257 846.227C692.234 846.227 691.354 845.986 690.615 845.503C689.876 845.02 689.308 844.355 688.91 843.507C688.513 842.66 688.314 841.691 688.314 840.602C688.314 839.494 688.517 838.517 688.925 837.669C689.336 836.817 689.909 836.152 690.643 835.673C691.382 835.19 692.244 834.949 693.229 834.949C693.996 834.949 694.687 835.091 695.302 835.375C695.918 835.659 696.422 836.057 696.815 836.568C697.208 837.08 697.452 837.676 697.547 838.358H695.871C695.743 837.861 695.459 837.42 695.018 837.037C694.583 836.649 693.996 836.455 693.257 836.455C692.604 836.455 692.031 836.625 691.538 836.966C691.05 837.302 690.669 837.778 690.395 838.393C690.125 839.004 689.99 839.722 689.99 840.545C689.99 841.388 690.122 842.122 690.388 842.747C690.657 843.372 691.036 843.857 691.524 844.203C692.016 844.549 692.594 844.722 693.257 844.722C693.693 844.722 694.088 844.646 694.443 844.494C694.798 844.343 695.099 844.125 695.345 843.841C695.591 843.557 695.766 843.216 695.871 842.818H697.547C697.452 843.462 697.218 844.042 696.844 844.558C696.474 845.07 695.984 845.477 695.373 845.78C694.767 846.078 694.062 846.227 693.257 846.227ZM703.207 846.256C702.516 846.256 701.889 846.125 701.325 845.865C700.762 845.6 700.314 845.219 699.983 844.722C699.651 844.22 699.486 843.614 699.486 842.903C699.486 842.278 699.609 841.772 699.855 841.384C700.101 840.991 700.43 840.683 700.842 840.46C701.254 840.238 701.709 840.072 702.206 839.963C702.708 839.849 703.212 839.759 703.719 839.693C704.381 839.608 704.919 839.544 705.331 839.501C705.747 839.454 706.05 839.376 706.24 839.267C706.434 839.158 706.531 838.969 706.531 838.699V838.642C706.531 837.941 706.339 837.397 705.956 837.009C705.577 836.62 705.002 836.426 704.23 836.426C703.43 836.426 702.802 836.601 702.348 836.952C701.893 837.302 701.574 837.676 701.389 838.074L699.798 837.506C700.082 836.843 700.461 836.327 700.934 835.957C701.413 835.583 701.934 835.323 702.497 835.176C703.065 835.025 703.624 834.949 704.173 834.949C704.523 834.949 704.926 834.991 705.381 835.077C705.84 835.157 706.282 835.325 706.709 835.581C707.14 835.837 707.497 836.223 707.781 836.739C708.065 837.255 708.207 837.946 708.207 838.812V846H706.531V844.523H706.446C706.332 844.759 706.143 845.013 705.878 845.283C705.613 845.553 705.26 845.782 704.819 845.972C704.379 846.161 703.842 846.256 703.207 846.256ZM703.463 844.75C704.126 844.75 704.684 844.62 705.139 844.359C705.598 844.099 705.944 843.763 706.176 843.351C706.413 842.939 706.531 842.506 706.531 842.051V840.517C706.46 840.602 706.304 840.68 706.062 840.751C705.826 840.818 705.551 840.877 705.238 840.929C704.931 840.976 704.63 841.019 704.336 841.057C704.048 841.09 703.813 841.118 703.633 841.142C703.198 841.199 702.791 841.291 702.412 841.419C702.038 841.542 701.735 841.729 701.503 841.98C701.275 842.226 701.162 842.562 701.162 842.989C701.162 843.571 701.377 844.011 701.808 844.31C702.244 844.603 702.795 844.75 703.463 844.75ZM718.994 837.534L717.488 837.96C717.393 837.709 717.254 837.465 717.069 837.229C716.889 836.987 716.643 836.788 716.33 836.632C716.018 836.476 715.618 836.398 715.13 836.398C714.463 836.398 713.906 836.552 713.461 836.859C713.021 837.162 712.801 837.548 712.801 838.017C712.801 838.434 712.952 838.763 713.255 839.004C713.558 839.246 714.032 839.447 714.676 839.608L716.295 840.006C717.27 840.242 717.997 840.605 718.475 841.092C718.954 841.575 719.193 842.198 719.193 842.96C719.193 843.585 719.013 844.144 718.653 844.636C718.298 845.129 717.801 845.517 717.161 845.801C716.522 846.085 715.779 846.227 714.931 846.227C713.819 846.227 712.898 845.986 712.169 845.503C711.439 845.02 710.978 844.314 710.784 843.386L712.374 842.989C712.526 843.576 712.812 844.016 713.234 844.31C713.66 844.603 714.216 844.75 714.903 844.75C715.684 844.75 716.304 844.584 716.764 844.253C717.228 843.917 717.46 843.514 717.46 843.045C717.46 842.667 717.327 842.349 717.062 842.094C716.797 841.833 716.39 841.639 715.84 841.511L714.022 841.085C713.023 840.848 712.289 840.482 711.82 839.984C711.356 839.482 711.124 838.855 711.124 838.102C711.124 837.487 711.297 836.942 711.643 836.469C711.993 835.995 712.469 835.624 713.07 835.354C713.677 835.084 714.363 834.949 715.13 834.949C716.21 834.949 717.057 835.186 717.673 835.659C718.293 836.133 718.733 836.758 718.994 837.534ZM726.29 846.227C725.238 846.227 724.332 845.995 723.569 845.531C722.812 845.062 722.227 844.409 721.815 843.571C721.408 842.728 721.204 841.748 721.204 840.631C721.204 839.513 721.408 838.528 721.815 837.676C722.227 836.819 722.8 836.152 723.534 835.673C724.273 835.19 725.134 834.949 726.119 834.949C726.687 834.949 727.248 835.044 727.802 835.233C728.356 835.422 728.861 835.73 729.315 836.156C729.77 836.578 730.132 837.136 730.402 837.832C730.672 838.528 730.807 839.385 730.807 840.403V841.114H722.398V839.665H729.102C729.102 839.049 728.979 838.5 728.733 838.017C728.491 837.534 728.146 837.153 727.696 836.874C727.251 836.594 726.725 836.455 726.119 836.455C725.452 836.455 724.874 836.62 724.386 836.952C723.903 837.278 723.532 837.705 723.271 838.23C723.011 838.756 722.881 839.319 722.881 839.92V840.886C722.881 841.71 723.023 842.409 723.307 842.982C723.595 843.55 723.996 843.983 724.507 844.281C725.018 844.575 725.613 844.722 726.29 844.722C726.73 844.722 727.128 844.66 727.483 844.537C727.843 844.409 728.153 844.22 728.413 843.969C728.674 843.713 728.875 843.396 729.017 843.017L730.636 843.472C730.466 844.021 730.179 844.504 729.777 844.92C729.374 845.332 728.877 845.654 728.285 845.886C727.693 846.114 727.028 846.227 726.29 846.227ZM743.413 846.227C742.428 846.227 741.564 845.993 740.821 845.524C740.082 845.055 739.505 844.4 739.088 843.557C738.676 842.714 738.47 841.729 738.47 840.602C738.47 839.466 738.676 838.474 739.088 837.626C739.505 836.779 740.082 836.121 740.821 835.652C741.564 835.183 742.428 834.949 743.413 834.949C744.398 834.949 745.26 835.183 745.998 835.652C746.742 836.121 747.319 836.779 747.731 837.626C748.148 838.474 748.356 839.466 748.356 840.602C748.356 841.729 748.148 842.714 747.731 843.557C747.319 844.4 746.742 845.055 745.998 845.524C745.26 845.993 744.398 846.227 743.413 846.227ZM743.413 844.722C744.161 844.722 744.777 844.53 745.26 844.146C745.743 843.763 746.1 843.259 746.332 842.634C746.564 842.009 746.68 841.331 746.68 840.602C746.68 839.873 746.564 839.194 746.332 838.564C746.1 837.934 745.743 837.425 745.26 837.037C744.777 836.649 744.161 836.455 743.413 836.455C742.665 836.455 742.05 836.649 741.567 837.037C741.084 837.425 740.726 837.934 740.494 838.564C740.262 839.194 740.146 839.873 740.146 840.602C740.146 841.331 740.262 842.009 740.494 842.634C740.726 843.259 741.084 843.763 741.567 844.146C742.05 844.53 742.665 844.722 743.413 844.722ZM755.773 835.091V836.511H749.892V835.091H755.773ZM751.654 846V833.585C751.654 832.96 751.8 832.439 752.094 832.023C752.387 831.606 752.769 831.294 753.237 831.085C753.706 830.877 754.201 830.773 754.722 830.773C755.134 830.773 755.47 830.806 755.73 830.872C755.991 830.938 756.185 831 756.313 831.057L755.83 832.506C755.744 832.477 755.626 832.442 755.475 832.399C755.328 832.357 755.134 832.335 754.892 832.335C754.338 832.335 753.938 832.475 753.692 832.754C753.45 833.034 753.33 833.443 753.33 833.983V846H751.654ZM768.321 846.227C767.27 846.227 766.363 845.995 765.601 845.531C764.843 845.062 764.258 844.409 763.846 843.571C763.439 842.728 763.236 841.748 763.236 840.631C763.236 839.513 763.439 838.528 763.846 837.676C764.258 836.819 764.831 836.152 765.565 835.673C766.304 835.19 767.166 834.949 768.15 834.949C768.719 834.949 769.28 835.044 769.834 835.233C770.388 835.422 770.892 835.73 771.346 836.156C771.801 836.578 772.163 837.136 772.433 837.832C772.703 838.528 772.838 839.385 772.838 840.403V841.114H764.429V839.665H771.133C771.133 839.049 771.01 838.5 770.764 838.017C770.523 837.534 770.177 837.153 769.727 836.874C769.282 836.594 768.756 836.455 768.15 836.455C767.483 836.455 766.905 836.62 766.417 836.952C765.934 837.278 765.563 837.705 765.302 838.23C765.042 838.756 764.912 839.319 764.912 839.92V840.886C764.912 841.71 765.054 842.409 765.338 842.982C765.627 843.55 766.027 843.983 766.538 844.281C767.05 844.575 767.644 844.722 768.321 844.722C768.761 844.722 769.159 844.66 769.514 844.537C769.874 844.409 770.184 844.22 770.444 843.969C770.705 843.713 770.906 843.396 771.048 843.017L772.667 843.472C772.497 844.021 772.211 844.504 771.808 844.92C771.406 845.332 770.908 845.654 770.317 845.886C769.725 846.114 769.059 846.227 768.321 846.227ZM775.388 846V835.091H777.007V836.739H777.121C777.319 836.199 777.679 835.761 778.2 835.425C778.721 835.089 779.308 834.92 779.961 834.92C780.085 834.92 780.238 834.923 780.423 834.928C780.608 834.932 780.747 834.939 780.842 834.949V836.653C780.785 836.639 780.655 836.618 780.452 836.589C780.253 836.556 780.042 836.54 779.819 836.54C779.289 836.54 778.816 836.651 778.399 836.874C777.987 837.091 777.66 837.394 777.419 837.783C777.182 838.166 777.064 838.604 777.064 839.097V846H775.388ZM782.829 846V835.091H784.448V836.739H784.562C784.761 836.199 785.121 835.761 785.642 835.425C786.162 835.089 786.749 834.92 787.403 834.92C787.526 834.92 787.68 834.923 787.865 834.928C788.049 834.932 788.189 834.939 788.284 834.949V836.653C788.227 836.639 788.097 836.618 787.893 836.589C787.694 836.556 787.483 836.54 787.261 836.54C786.731 836.54 786.257 836.651 785.84 836.874C785.428 837.091 785.102 837.394 784.86 837.783C784.624 838.166 784.505 838.604 784.505 839.097V846H782.829ZM794.37 846.227C793.385 846.227 792.521 845.993 791.778 845.524C791.039 845.055 790.462 844.4 790.045 843.557C789.633 842.714 789.427 841.729 789.427 840.602C789.427 839.466 789.633 838.474 790.045 837.626C790.462 836.779 791.039 836.121 791.778 835.652C792.521 835.183 793.385 834.949 794.37 834.949C795.355 834.949 796.217 835.183 796.955 835.652C797.699 836.121 798.276 836.779 798.688 837.626C799.105 838.474 799.313 839.466 799.313 840.602C799.313 841.729 799.105 842.714 798.688 843.557C798.276 844.4 797.699 845.055 796.955 845.524C796.217 845.993 795.355 846.227 794.37 846.227ZM794.37 844.722C795.118 844.722 795.734 844.53 796.217 844.146C796.7 843.763 797.057 843.259 797.289 842.634C797.521 842.009 797.637 841.331 797.637 840.602C797.637 839.873 797.521 839.194 797.289 838.564C797.057 837.934 796.7 837.425 796.217 837.037C795.734 836.649 795.118 836.455 794.37 836.455C793.622 836.455 793.007 836.649 792.524 837.037C792.041 837.425 791.683 837.934 791.451 838.564C791.219 839.194 791.103 839.873 791.103 840.602C791.103 841.331 791.219 842.009 791.451 842.634C791.683 843.259 792.041 843.763 792.524 844.146C793.007 844.53 793.622 844.722 794.37 844.722ZM801.872 846V835.091H803.491V836.739H803.605C803.804 836.199 804.164 835.761 804.684 835.425C805.205 835.089 805.792 834.92 806.446 834.92C806.569 834.92 806.723 834.923 806.907 834.928C807.092 834.932 807.232 834.939 807.327 834.949V836.653C807.27 836.639 807.14 836.618 806.936 836.589C806.737 836.556 806.526 836.54 806.304 836.54C805.773 836.54 805.3 836.651 804.883 836.874C804.471 837.091 804.145 837.394 803.903 837.783C803.666 838.166 803.548 838.604 803.548 839.097V846H801.872Z" fill="#03031C"/>
+<path d="M1148.71 652.707C1149.1 652.317 1149.1 651.683 1148.71 651.293L1142.34 644.929C1141.95 644.538 1141.32 644.538 1140.93 644.929C1140.54 645.319 1140.54 645.953 1140.93 646.343L1146.59 652L1140.93 657.657C1140.54 658.047 1140.54 658.681 1140.93 659.071C1141.32 659.462 1141.95 659.462 1142.34 659.071L1148.71 652.707ZM1000 653L1148 653L1148 651L1000 651L1000 653Z" fill="#03031C"/>
+<path d="M629.707 388.293C629.317 387.902 628.683 387.902 628.293 388.293L621.929 394.657C621.538 395.047 621.538 395.681 621.929 396.071C622.319 396.462 622.953 396.462 623.343 396.071L629 390.414L634.657 396.071C635.047 396.462 635.681 396.462 636.071 396.071C636.462 395.681 636.462 395.047 636.071 394.657L629.707 388.293ZM630 506V389H628V506H630Z" fill="#03031C"/>
+<path d="M849.707 506.707C849.317 507.098 848.683 507.098 848.293 506.707L841.929 500.343C841.538 499.953 841.538 499.319 841.929 498.929C842.319 498.538 842.953 498.538 843.343 498.929L849 504.586L854.657 498.929C855.047 498.538 855.681 498.538 856.071 498.929C856.462 499.319 856.462 499.953 856.071 500.343L849.707 506.707ZM850 389V506H848V389H850Z" fill="#03031C"/>
+<path d="M586.138 768.01C585.591 767.933 585.086 768.315 585.01 768.862L583.766 777.775C583.69 778.322 584.071 778.828 584.618 778.904C585.165 778.98 585.67 778.599 585.747 778.052L586.852 770.129L594.775 771.234C595.322 771.31 595.828 770.929 595.904 770.382C595.98 769.835 595.599 769.33 595.052 769.253L586.138 768.01ZM886.5 769C885.682 768.424 885.683 768.424 885.683 768.424C885.683 768.424 885.683 768.424 885.683 768.424C885.682 768.425 885.681 768.426 885.68 768.428C885.677 768.432 885.672 768.439 885.664 768.45C885.65 768.47 885.627 768.501 885.595 768.544C885.531 768.63 885.432 768.761 885.297 768.933C885.026 769.278 884.61 769.791 884.035 770.446C882.886 771.758 881.104 773.645 878.595 775.915C873.577 780.454 865.646 786.53 854.036 792.614C830.82 804.781 792.858 817 734 817V819C793.142 819 831.43 806.719 854.964 794.386C866.729 788.22 874.798 782.046 879.936 777.398C882.505 775.074 884.341 773.132 885.539 771.764C886.138 771.081 886.578 770.54 886.871 770.167C887.017 769.981 887.126 769.837 887.2 769.737C887.237 769.687 887.265 769.649 887.285 769.622C887.295 769.608 887.302 769.597 887.308 769.59C887.31 769.586 887.313 769.583 887.314 769.581C887.315 769.579 887.316 769.578 887.316 769.578C887.317 769.577 887.318 769.576 886.5 769ZM734 817C678.653 817 641.815 804.785 618.843 792.616C607.354 786.53 599.325 780.451 594.177 775.907C591.603 773.634 589.75 771.745 588.544 770.43C587.941 769.772 587.5 769.258 587.212 768.911C587.068 768.738 586.962 768.607 586.894 768.52C586.859 768.477 586.834 768.444 586.818 768.424C586.81 768.414 586.805 768.406 586.801 768.402C586.8 768.4 586.799 768.398 586.798 768.397C586.798 768.397 586.798 768.397 586.798 768.397C586.798 768.397 586.798 768.397 586 769C585.202 769.603 585.203 769.603 585.203 769.604C585.204 769.605 585.205 769.606 585.205 769.607C585.207 769.609 585.209 769.612 585.212 769.616C585.218 769.623 585.226 769.634 585.236 769.647C585.257 769.674 585.286 769.712 585.325 769.761C585.404 769.86 585.519 770.004 585.673 770.189C585.982 770.56 586.444 771.099 587.07 771.781C588.321 773.146 590.225 775.085 592.854 777.406C598.112 782.049 606.271 788.22 617.907 794.384C641.185 806.715 678.347 819 734 819V817Z" fill="#03031C"/>
+<path d="M203.151 287.18L210.501 262.433C211.318 259.738 209.276 257.002 206.458 257.002H172.361H138.223C135.405 257.002 133.363 259.738 134.18 262.433L141.53 287.18H172.483" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M136.303 281.993L132.383 289.385C131.24 291.549 132.791 294.121 135.242 294.121H172.32H209.398C211.849 294.121 213.4 291.549 212.257 289.385L208.337 281.993" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M172.32 240.913C179.65 240.913 185.592 233.545 185.592 224.457C185.592 215.368 179.65 208 172.32 208C164.991 208 159.049 215.368 159.049 224.457C159.049 233.545 164.991 240.913 172.32 240.913Z" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M181.794 235.972C181.794 235.972 191.186 241.077 194.861 244.017C195.719 244.711 196.454 245.568 197.066 246.508C198.169 248.264 198.659 250.346 198.659 252.388V257.002" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M162.846 235.972C162.846 235.972 153.454 241.077 149.779 244.017C148.922 244.711 148.187 245.569 147.574 246.508C146.472 248.264 145.941 250.346 145.941 252.388V257.002" stroke="#03031C" stroke-width="1.92" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M579.944 657.471L585.331 667.766L574.995 673.1" stroke="#03031C" stroke-width="3.18" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M582.926 667.175C574.973 664.657 567.942 659.848 562.722 653.356C557.502 646.865 554.327 638.983 553.599 630.706C552.871 622.429 554.623 614.129 558.632 606.857C562.642 599.584 568.729 593.665 576.125 589.848C583.521 586.031 591.893 584.488 600.182 585.413C608.471 586.339 616.305 589.691 622.693 595.046C629.081 600.402 633.737 607.52 636.072 615.501C638.406 623.481 638.315 631.966 635.808 639.882" stroke="#03031C" stroke-width="2.2" stroke-miterlimit="10" stroke-linecap="round"/>
+<defs>
+<filter id="filter0_bd_12_284" x="376" y="53" width="727" height="888" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_284"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_284" result="effect2_dropShadow_12_284"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_284" result="shape"/>
+</filter>
+<filter id="filter1_bd_12_284" x="465" y="165" width="543" height="226" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_284"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="7.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_284" result="effect2_dropShadow_12_284"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_284" result="shape"/>
+</filter>
+<filter id="filter2_bd_12_284" x="465" y="512" width="543" height="268" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_284"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="7.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_284" result="effect2_dropShadow_12_284"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_284" result="shape"/>
+</filter>
+<filter id="filter3_bd_12_284" x="1136" y="502" width="329" height="288" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_284"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_284" result="effect2_dropShadow_12_284"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_284" result="shape"/>
+</filter>
+<filter id="filter4_bd_12_284" x="16" y="164" width="312" height="226" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_284"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="7.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_284" result="effect2_dropShadow_12_284"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_284" result="shape"/>
+</filter>
+</defs>
+</svg>
diff --git a/img/operator/tyk-organisations.svg b/img/operator/tyk-organisations.svg
new file mode 100644
index 0000000000..36e7963f61
--- /dev/null
+++ b/img/operator/tyk-organisations.svg
@@ -0,0 +1,286 @@
+<svg width="1652" height="1097" viewBox="0 0 1652 1097" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g filter="url(#filter0_bd_12_348)">
+<rect x="404" y="461" width="844" height="577" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="405" y="462" width="842" height="575" rx="19" stroke="#8438FA" stroke-width="2" shape-rendering="crispEdges"/>
+</g>
+<path d="M446.065 988.985V985.182H463.984V988.985H457.305V1007H452.745V988.985H446.065ZM467.777 1013.14C467.202 1013.14 466.662 1013.09 466.158 1013C465.661 1012.91 465.249 1012.8 464.922 1012.67L465.945 1009.28C466.477 1009.44 466.957 1009.53 467.383 1009.55C467.816 1009.56 468.189 1009.46 468.501 1009.25C468.821 1009.03 469.08 1008.67 469.279 1008.16L469.545 1007.47L463.675 990.636H468.448L471.836 1002.65H472.006L475.426 990.636H480.231L473.871 1008.77C473.565 1009.65 473.15 1010.42 472.624 1011.07C472.106 1011.73 471.449 1012.24 470.653 1012.59C469.858 1012.96 468.899 1013.14 467.777 1013.14ZM486.665 1002.29L486.676 996.847H487.337L492.578 990.636H497.788L490.746 998.861H489.67L486.665 1002.29ZM482.553 1007V985.182H487.092V1007H482.553ZM492.781 1007L487.965 999.873L490.991 996.666L498.097 1007H492.781ZM514.777 1007H507.043V985.182H514.841C517.036 985.182 518.925 985.619 520.509 986.492C522.093 987.359 523.311 988.605 524.163 990.232C525.022 991.858 525.452 993.804 525.452 996.07C525.452 998.342 525.022 1000.3 524.163 1001.93C523.311 1003.56 522.085 1004.82 520.487 1005.69C518.896 1006.56 516.993 1007 514.777 1007ZM511.656 1003.05H514.585C515.949 1003.05 517.096 1002.81 518.026 1002.32C518.964 1001.83 519.667 1001.08 520.136 1000.05C520.612 999.024 520.85 997.696 520.85 996.07C520.85 994.457 520.612 993.14 520.136 992.117C519.667 991.094 518.968 990.342 518.037 989.859C517.107 989.376 515.96 989.134 514.596 989.134H511.656V1003.05ZM533.45 1007.31C532.406 1007.31 531.475 1007.13 530.659 1006.77C529.842 1006.4 529.196 1005.85 528.72 1005.14C528.251 1004.41 528.017 1003.51 528.017 1002.43C528.017 1001.52 528.184 1000.76 528.517 1000.14C528.851 999.521 529.306 999.024 529.881 998.648C530.456 998.271 531.11 997.987 531.841 997.795C532.58 997.604 533.354 997.469 534.164 997.391C535.115 997.291 535.882 997.199 536.465 997.114C537.047 997.021 537.47 996.886 537.733 996.709C537.995 996.531 538.127 996.268 538.127 995.92V995.857C538.127 995.182 537.914 994.66 537.488 994.29C537.069 993.921 536.472 993.737 535.698 993.737C534.881 993.737 534.231 993.918 533.748 994.28C533.265 994.635 532.946 995.082 532.789 995.622L528.592 995.281C528.805 994.287 529.224 993.428 529.849 992.703C530.474 991.972 531.28 991.411 532.267 991.02C533.262 990.622 534.412 990.423 535.719 990.423C536.628 990.423 537.498 990.53 538.329 990.743C539.167 990.956 539.909 991.286 540.556 991.734C541.209 992.181 541.724 992.756 542.1 993.46C542.477 994.156 542.665 994.99 542.665 995.963V1007H538.361V1004.73H538.233C537.971 1005.24 537.619 1005.69 537.179 1006.08C536.738 1006.47 536.209 1006.77 535.591 1006.99C534.973 1007.2 534.26 1007.31 533.45 1007.31ZM534.75 1004.18C535.417 1004.18 536.007 1004.05 536.518 1003.78C537.029 1003.51 537.431 1003.15 537.722 1002.7C538.013 1002.24 538.159 1001.73 538.159 1001.15V999.415C538.017 999.507 537.821 999.592 537.573 999.67C537.331 999.741 537.058 999.809 536.752 999.873C536.447 999.93 536.142 999.983 535.836 1000.03C535.531 1000.08 535.254 1000.11 535.005 1000.15C534.473 1000.23 534.007 1000.35 533.61 1000.52C533.212 1000.69 532.903 1000.92 532.683 1001.22C532.463 1001.5 532.353 1001.85 532.353 1002.28C532.353 1002.9 532.576 1003.37 533.024 1003.7C533.478 1004.02 534.054 1004.18 534.75 1004.18ZM559.801 995.303L555.646 995.558C555.575 995.203 555.423 994.884 555.188 994.599C554.954 994.308 554.645 994.077 554.261 993.907C553.885 993.729 553.434 993.641 552.908 993.641C552.205 993.641 551.612 993.79 551.129 994.088C550.646 994.379 550.405 994.77 550.405 995.26C550.405 995.651 550.561 995.981 550.874 996.251C551.186 996.521 551.722 996.737 552.482 996.901L555.444 997.497C557.035 997.824 558.221 998.349 559.002 999.074C559.783 999.798 560.174 1000.75 560.174 1001.93C560.174 1003 559.858 1003.94 559.226 1004.75C558.601 1005.56 557.741 1006.19 556.648 1006.65C555.561 1007.1 554.308 1007.32 552.887 1007.32C550.721 1007.32 548.995 1006.87 547.71 1005.97C546.431 1005.06 545.682 1003.82 545.462 1002.26L549.925 1002.02C550.06 1002.69 550.387 1003.19 550.906 1003.54C551.424 1003.88 552.088 1004.05 552.898 1004.05C553.693 1004.05 554.332 1003.9 554.815 1003.59C555.305 1003.28 555.554 1002.88 555.561 1002.39C555.554 1001.98 555.38 1001.64 555.039 1001.38C554.698 1001.11 554.173 1000.9 553.462 1000.76L550.629 1000.19C549.031 999.873 547.841 999.319 547.06 998.531C546.286 997.742 545.898 996.737 545.898 995.516C545.898 994.464 546.183 993.559 546.751 992.799C547.326 992.039 548.132 991.453 549.169 991.041C550.213 990.629 551.435 990.423 552.834 990.423C554.901 990.423 556.527 990.86 557.713 991.734C558.906 992.607 559.602 993.797 559.801 995.303ZM567.57 997.54V1007H563.032V985.182H567.442V993.523H567.634C568.003 992.558 568.6 991.801 569.424 991.254C570.248 990.7 571.281 990.423 572.524 990.423C573.66 990.423 574.651 990.672 575.496 991.169C576.349 991.659 577.009 992.366 577.478 993.289C577.954 994.205 578.188 995.303 578.181 996.581V1007H573.643V997.391C573.65 996.382 573.394 995.597 572.876 995.036C572.364 994.475 571.647 994.195 570.724 994.195C570.106 994.195 569.559 994.326 569.083 994.589C568.614 994.852 568.245 995.235 567.975 995.739C567.712 996.237 567.577 996.837 567.57 997.54ZM581.838 1007V985.182H586.376V993.385H586.515C586.713 992.945 587.001 992.497 587.377 992.043C587.761 991.581 588.258 991.197 588.869 990.892C589.487 990.58 590.254 990.423 591.17 990.423C592.363 990.423 593.464 990.736 594.473 991.361C595.481 991.979 596.287 992.913 596.891 994.163C597.495 995.406 597.797 996.964 597.797 998.839C597.797 1000.66 597.502 1002.21 596.912 1003.46C596.33 1004.71 595.534 1005.66 594.526 1006.31C593.525 1006.95 592.402 1007.27 591.159 1007.27C590.279 1007.27 589.529 1007.12 588.912 1006.83C588.301 1006.54 587.8 1006.17 587.409 1005.73C587.019 1005.28 586.721 1004.83 586.515 1004.38H586.312V1007H581.838ZM586.28 998.818C586.28 999.791 586.415 1000.64 586.685 1001.36C586.955 1002.09 587.346 1002.65 587.857 1003.06C588.368 1003.46 588.99 1003.65 589.721 1003.65C590.46 1003.65 591.085 1003.45 591.596 1003.05C592.108 1002.64 592.495 1002.07 592.757 1001.34C593.027 1000.61 593.162 999.77 593.162 998.818C593.162 997.874 593.031 997.043 592.768 996.325C592.505 995.608 592.118 995.047 591.607 994.642C591.096 994.237 590.467 994.035 589.721 994.035C588.983 994.035 588.358 994.23 587.846 994.621C587.342 995.011 586.955 995.565 586.685 996.283C586.415 997 586.28 997.845 586.28 998.818ZM608.218 1007.32C606.563 1007.32 605.132 1006.97 603.925 1006.26C602.725 1005.55 601.798 1004.57 601.144 1003.3C600.491 1002.03 600.164 1000.56 600.164 998.882C600.164 997.192 600.491 995.714 601.144 994.45C601.798 993.179 602.725 992.192 603.925 991.489C605.132 990.778 606.563 990.423 608.218 990.423C609.873 990.423 611.301 990.778 612.501 991.489C613.708 992.192 614.639 993.179 615.292 994.45C615.945 995.714 616.272 997.192 616.272 998.882C616.272 1000.56 615.945 1002.03 615.292 1003.3C614.639 1004.57 613.708 1005.55 612.501 1006.26C611.301 1006.97 609.873 1007.32 608.218 1007.32ZM608.24 1003.8C608.992 1003.8 609.621 1003.59 610.125 1003.16C610.629 1002.73 611.009 1002.14 611.265 1001.4C611.528 1000.65 611.659 999.802 611.659 998.85C611.659 997.898 611.528 997.05 611.265 996.304C611.009 995.558 610.629 994.969 610.125 994.536C609.621 994.102 608.992 993.886 608.24 993.886C607.48 993.886 606.84 994.102 606.322 994.536C605.811 994.969 605.423 995.558 605.161 996.304C604.905 997.05 604.777 997.898 604.777 998.85C604.777 999.802 604.905 1000.65 605.161 1001.4C605.423 1002.14 605.811 1002.73 606.322 1003.16C606.84 1003.59 607.48 1003.8 608.24 1003.8ZM623.889 1007.31C622.845 1007.31 621.915 1007.13 621.098 1006.77C620.281 1006.4 619.635 1005.85 619.159 1005.14C618.691 1004.41 618.456 1003.51 618.456 1002.43C618.456 1001.52 618.623 1000.76 618.957 1000.14C619.291 999.521 619.745 999.024 620.32 998.648C620.896 998.271 621.549 997.987 622.281 997.795C623.019 997.604 623.794 997.469 624.603 997.391C625.555 997.291 626.322 997.199 626.904 997.114C627.487 997.021 627.909 996.886 628.172 996.709C628.435 996.531 628.566 996.268 628.566 995.92V995.857C628.566 995.182 628.353 994.66 627.927 994.29C627.508 993.921 626.911 993.737 626.137 993.737C625.32 993.737 624.671 993.918 624.188 994.28C623.705 994.635 623.385 995.082 623.229 995.622L619.031 995.281C619.244 994.287 619.664 993.428 620.289 992.703C620.914 991.972 621.72 991.411 622.707 991.02C623.701 990.622 624.852 990.423 626.159 990.423C627.068 990.423 627.938 990.53 628.769 990.743C629.607 990.956 630.349 991.286 630.995 991.734C631.649 992.181 632.164 992.756 632.54 993.46C632.916 994.156 633.105 994.99 633.105 995.963V1007H628.801V1004.73H628.673C628.41 1005.24 628.058 1005.69 627.618 1006.08C627.178 1006.47 626.649 1006.77 626.031 1006.99C625.413 1007.2 624.699 1007.31 623.889 1007.31ZM625.189 1004.18C625.857 1004.18 626.446 1004.05 626.958 1003.78C627.469 1003.51 627.87 1003.15 628.161 1002.7C628.453 1002.24 628.598 1001.73 628.598 1001.15V999.415C628.456 999.507 628.261 999.592 628.012 999.67C627.771 999.741 627.497 999.809 627.192 999.873C626.887 999.93 626.581 999.983 626.276 1000.03C625.97 1000.08 625.693 1000.11 625.445 1000.15C624.912 1000.23 624.447 1000.35 624.049 1000.52C623.651 1000.69 623.343 1000.92 623.122 1001.22C622.902 1001.5 622.792 1001.85 622.792 1002.28C622.792 1002.9 623.016 1003.37 623.463 1003.7C623.918 1004.02 624.493 1004.18 625.189 1004.18ZM636.626 1007V990.636H641.025V993.491H641.196C641.494 992.476 641.995 991.709 642.698 991.19C643.401 990.665 644.211 990.402 645.127 990.402C645.354 990.402 645.599 990.416 645.862 990.445C646.125 990.473 646.356 990.512 646.555 990.562V994.589C646.341 994.525 646.047 994.468 645.67 994.418C645.294 994.369 644.949 994.344 644.637 994.344C643.969 994.344 643.373 994.489 642.847 994.781C642.329 995.065 641.917 995.462 641.611 995.974C641.313 996.485 641.164 997.075 641.164 997.742V1007H636.626ZM654.169 1007.27C652.926 1007.27 651.8 1006.95 650.792 1006.31C649.79 1005.66 648.995 1004.71 648.406 1003.46C647.823 1002.21 647.532 1000.66 647.532 998.839C647.532 996.964 647.834 995.406 648.438 994.163C649.041 992.913 649.844 991.979 650.845 991.361C651.854 990.736 652.958 990.423 654.158 990.423C655.075 990.423 655.838 990.58 656.449 990.892C657.067 991.197 657.564 991.581 657.94 992.043C658.324 992.497 658.615 992.945 658.814 993.385H658.952V985.182H663.48V1007H659.006V1004.38H658.814C658.601 1004.83 658.299 1005.28 657.908 1005.73C657.525 1006.17 657.024 1006.54 656.406 1006.83C655.795 1007.12 655.05 1007.27 654.169 1007.27ZM655.607 1003.65C656.339 1003.65 656.957 1003.46 657.461 1003.06C657.972 1002.65 658.363 1002.09 658.633 1001.36C658.91 1000.64 659.048 999.791 659.048 998.818C659.048 997.845 658.913 997 658.643 996.283C658.374 995.565 657.983 995.011 657.472 994.621C656.96 994.23 656.339 994.035 655.607 994.035C654.862 994.035 654.233 994.237 653.722 994.642C653.21 995.047 652.823 995.608 652.56 996.325C652.298 997.043 652.166 997.874 652.166 998.818C652.166 999.77 652.298 1000.61 652.56 1001.34C652.83 1002.07 653.217 1002.64 653.722 1003.05C654.233 1003.45 654.862 1003.65 655.607 1003.65Z" fill="#8438FA"/>
+<g filter="url(#filter1_bd_12_348)">
+<rect x="206" y="59" width="568" height="281" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="206.5" y="59.5" width="567" height="280" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<g filter="url(#filter2_bd_12_348)">
+<rect x="100" y="582" width="210" height="225" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="100.5" y="582.5" width="209" height="224" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M305.462 209.58C314.757 209.58 322.292 200.272 322.292 188.79C322.292 177.308 314.757 168 305.462 168C296.167 168 288.632 177.308 288.632 188.79C288.632 200.272 296.167 209.58 305.462 209.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M318.134 202.848C318.134 202.848 329.111 208.919 333.717 212.696C334.809 213.595 335.747 214.67 336.493 215.878C337.852 218.146 338.556 220.754 338.527 223.406V239.017C329.389 247.317 317.547 251.921 305.264 251.952C292.968 251.99 281.102 247.376 272.001 239.017V223.406C271.972 220.754 272.676 218.146 274.035 215.878C274.781 214.67 275.719 213.595 276.811 212.696C281.417 208.958 292.412 202.452 292.412 202.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M281.699 221.856C281.29 222.577 281.086 223.394 281.11 224.22V235.077C287.977 240.12 296.308 242.844 304.868 242.844C313.427 242.844 321.759 240.12 328.626 235.077V224.295C328.653 223.471 328.454 222.654 328.049 221.932C321.364 228.252 313.423 232.043 304.868 232.043C296.312 232.043 288.372 228.226 281.699 221.856Z" fill="#5900CB"/>
+<path d="M428.462 209.58C437.757 209.58 445.292 200.272 445.292 188.79C445.292 177.308 437.757 168 428.462 168C419.167 168 411.632 177.308 411.632 188.79C411.632 200.272 419.167 209.58 428.462 209.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M441.134 202.848C441.134 202.848 452.111 208.919 456.717 212.696C457.809 213.595 458.747 214.67 459.493 215.878C460.852 218.146 461.556 220.754 461.527 223.406V239.017C452.389 247.317 440.547 251.921 428.264 251.952C415.968 251.99 404.102 247.376 395.001 239.017V223.406C394.972 220.754 395.676 218.146 397.035 215.878C397.781 214.67 398.719 213.595 399.811 212.696C404.417 208.958 415.412 202.452 415.412 202.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M404.699 221.856C404.29 222.577 404.086 223.394 404.11 224.22V235.077C410.977 240.12 419.308 242.844 427.868 242.844C436.427 242.844 444.759 240.12 451.626 235.077V224.295C451.653 223.471 451.454 222.654 451.049 221.932C444.364 228.252 436.423 232.043 427.868 232.043C419.312 232.043 411.372 228.226 404.699 221.856Z" fill="#5900CB"/>
+<path d="M551.462 209.58C560.757 209.58 568.292 200.272 568.292 188.79C568.292 177.308 560.757 168 551.462 168C542.167 168 534.632 177.308 534.632 188.79C534.632 200.272 542.167 209.58 551.462 209.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M564.134 202.848C564.134 202.848 575.111 208.919 579.717 212.696C580.809 213.595 581.747 214.67 582.493 215.878C583.852 218.146 584.556 220.754 584.527 223.406V239.017C575.389 247.317 563.547 251.921 551.264 251.952C538.968 251.99 527.102 247.376 518.001 239.017V223.406C517.972 220.754 518.676 218.146 520.035 215.878C520.781 214.67 521.719 213.595 522.811 212.696C527.417 208.958 538.412 202.452 538.412 202.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M527.699 221.856C527.29 222.577 527.086 223.394 527.11 224.22V235.077C533.977 240.12 542.308 242.844 550.868 242.844C559.427 242.844 567.759 240.12 574.626 235.077V224.295C574.653 223.471 574.454 222.654 574.049 221.932C567.364 228.252 559.423 232.043 550.868 232.043C542.312 232.043 534.372 228.226 527.699 221.856Z" fill="#5900CB"/>
+<path d="M674.462 209.58C683.757 209.58 691.292 200.272 691.292 188.79C691.292 177.308 683.757 168 674.462 168C665.167 168 657.632 177.308 657.632 188.79C657.632 200.272 665.167 209.58 674.462 209.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M687.134 202.848C687.134 202.848 698.111 208.919 702.717 212.696C703.809 213.595 704.747 214.67 705.493 215.878C706.852 218.146 707.556 220.754 707.527 223.406V239.017C698.389 247.317 686.547 251.921 674.264 251.952C661.968 251.99 650.102 247.376 641.001 239.017V223.406C640.972 220.754 641.676 218.146 643.035 215.878C643.781 214.67 644.719 213.595 645.811 212.696C650.417 208.958 661.412 202.452 661.412 202.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M650.699 221.856C650.29 222.577 650.086 223.394 650.11 224.22V235.077C656.977 240.12 665.308 242.844 673.868 242.844C682.427 242.844 690.759 240.12 697.626 235.077V224.295C697.653 223.471 697.454 222.654 697.049 221.932C690.364 228.252 682.423 232.043 673.868 232.043C665.312 232.043 657.372 228.226 650.699 221.856Z" fill="#5900CB"/>
+<path d="M399.946 104.182H404.559V118.351C404.559 119.942 404.179 121.334 403.419 122.527C402.666 123.72 401.612 124.651 400.255 125.318C398.899 125.979 397.318 126.309 395.514 126.309C393.703 126.309 392.119 125.979 390.763 125.318C389.406 124.651 388.352 123.72 387.599 122.527C386.846 121.334 386.47 119.942 386.47 118.351V104.182H391.082V117.957C391.082 118.788 391.264 119.526 391.626 120.173C391.995 120.819 392.514 121.327 393.181 121.696C393.849 122.065 394.627 122.25 395.514 122.25C396.409 122.25 397.187 122.065 397.847 121.696C398.515 121.327 399.03 120.819 399.392 120.173C399.761 119.526 399.946 118.788 399.946 117.957V104.182ZM421.884 114.303L417.729 114.558C417.658 114.203 417.506 113.884 417.271 113.599C417.037 113.308 416.728 113.077 416.344 112.907C415.968 112.729 415.517 112.641 414.991 112.641C414.288 112.641 413.695 112.79 413.212 113.088C412.729 113.379 412.488 113.77 412.488 114.26C412.488 114.651 412.644 114.981 412.957 115.251C413.269 115.521 413.805 115.737 414.565 115.901L417.527 116.497C419.118 116.824 420.304 117.349 421.085 118.074C421.866 118.798 422.257 119.75 422.257 120.929C422.257 122.001 421.941 122.942 421.309 123.752C420.684 124.562 419.824 125.194 418.731 125.648C417.644 126.096 416.391 126.32 414.97 126.32C412.804 126.32 411.078 125.869 409.793 124.967C408.514 124.058 407.765 122.822 407.545 121.259L412.008 121.025C412.143 121.685 412.47 122.19 412.989 122.538C413.507 122.879 414.171 123.049 414.981 123.049C415.776 123.049 416.415 122.896 416.898 122.591C417.388 122.278 417.637 121.877 417.644 121.387C417.637 120.975 417.463 120.638 417.122 120.375C416.781 120.105 416.256 119.899 415.545 119.757L412.712 119.192C411.114 118.873 409.924 118.319 409.143 117.531C408.369 116.742 407.981 115.737 407.981 114.516C407.981 113.464 408.266 112.559 408.834 111.799C409.409 111.039 410.215 110.453 411.252 110.041C412.296 109.629 413.518 109.423 414.917 109.423C416.984 109.423 418.61 109.86 419.796 110.734C420.989 111.607 421.685 112.797 421.884 114.303ZM432.572 126.32C430.889 126.32 429.44 125.979 428.226 125.297C427.018 124.608 426.088 123.635 425.434 122.378C424.781 121.114 424.454 119.619 424.454 117.893C424.454 116.21 424.781 114.732 425.434 113.461C426.088 112.19 427.008 111.199 428.194 110.489C429.387 109.778 430.786 109.423 432.391 109.423C433.471 109.423 434.476 109.597 435.406 109.945C436.343 110.286 437.16 110.801 437.856 111.49C438.559 112.179 439.106 113.045 439.497 114.089C439.888 115.126 440.083 116.341 440.083 117.733V118.979H426.265V116.167H435.811C435.811 115.513 435.669 114.935 435.385 114.43C435.101 113.926 434.706 113.532 434.202 113.248C433.705 112.957 433.126 112.811 432.466 112.811C431.777 112.811 431.166 112.971 430.633 113.29C430.108 113.603 429.696 114.026 429.397 114.558C429.099 115.084 428.946 115.67 428.939 116.316V118.99C428.939 119.8 429.089 120.499 429.387 121.089C429.692 121.678 430.122 122.133 430.676 122.452C431.23 122.772 431.887 122.932 432.647 122.932C433.151 122.932 433.613 122.861 434.032 122.719C434.451 122.577 434.809 122.364 435.108 122.08C435.406 121.795 435.633 121.447 435.79 121.036L439.987 121.312C439.774 122.321 439.337 123.202 438.677 123.955C438.023 124.7 437.178 125.283 436.141 125.702C435.111 126.114 433.922 126.32 432.572 126.32ZM443.044 126V109.636H447.444V112.491H447.615C447.913 111.476 448.414 110.709 449.117 110.19C449.82 109.665 450.63 109.402 451.546 109.402C451.773 109.402 452.018 109.416 452.281 109.445C452.544 109.473 452.775 109.512 452.973 109.562V113.589C452.76 113.525 452.466 113.468 452.089 113.418C451.713 113.369 451.368 113.344 451.056 113.344C450.388 113.344 449.792 113.489 449.266 113.781C448.748 114.065 448.336 114.462 448.03 114.974C447.732 115.485 447.583 116.075 447.583 116.742V126H443.044ZM468.935 114.303L464.78 114.558C464.709 114.203 464.556 113.884 464.322 113.599C464.088 113.308 463.779 113.077 463.395 112.907C463.019 112.729 462.568 112.641 462.042 112.641C461.339 112.641 460.746 112.79 460.263 113.088C459.78 113.379 459.539 113.77 459.539 114.26C459.539 114.651 459.695 114.981 460.007 115.251C460.32 115.521 460.856 115.737 461.616 115.901L464.578 116.497C466.169 116.824 467.355 117.349 468.136 118.074C468.917 118.798 469.308 119.75 469.308 120.929C469.308 122.001 468.992 122.942 468.36 123.752C467.735 124.562 466.875 125.194 465.782 125.648C464.695 126.096 463.441 126.32 462.021 126.32C459.855 126.32 458.129 125.869 456.843 124.967C455.565 124.058 454.816 122.822 454.595 121.259L459.059 121.025C459.194 121.685 459.521 122.19 460.039 122.538C460.558 122.879 461.222 123.049 462.032 123.049C462.827 123.049 463.466 122.896 463.949 122.591C464.439 122.278 464.688 121.877 464.695 121.387C464.688 120.975 464.514 120.638 464.173 120.375C463.832 120.105 463.306 119.899 462.596 119.757L459.762 119.192C458.164 118.873 456.975 118.319 456.193 117.531C455.419 116.742 455.032 115.737 455.032 114.516C455.032 113.464 455.316 112.559 455.884 111.799C456.46 111.039 457.266 110.453 458.303 110.041C459.347 109.629 460.568 109.423 461.968 109.423C464.034 109.423 465.661 109.86 466.847 110.734C468.04 111.607 468.736 112.797 468.935 114.303ZM479.109 126V109.636H483.647V126H479.109ZM481.389 107.527C480.714 107.527 480.135 107.303 479.652 106.856C479.176 106.401 478.938 105.858 478.938 105.226C478.938 104.601 479.176 104.065 479.652 103.617C480.135 103.163 480.714 102.935 481.389 102.935C482.063 102.935 482.639 103.163 483.115 103.617C483.598 104.065 483.839 104.601 483.839 105.226C483.839 105.858 483.598 106.401 483.115 106.856C482.639 107.303 482.063 107.527 481.389 107.527ZM491.821 116.54V126H487.283V109.636H491.608V112.523H491.8C492.162 111.572 492.769 110.819 493.622 110.265C494.474 109.704 495.507 109.423 496.722 109.423C497.858 109.423 498.849 109.672 499.694 110.169C500.539 110.666 501.196 111.376 501.665 112.3C502.134 113.216 502.368 114.31 502.368 115.581V126H497.83V116.391C497.837 115.389 497.581 114.608 497.063 114.047C496.544 113.479 495.83 113.195 494.921 113.195C494.31 113.195 493.771 113.326 493.302 113.589C492.84 113.852 492.478 114.235 492.215 114.739C491.96 115.237 491.828 115.837 491.821 116.54ZM533.023 115.091C533.023 117.47 532.572 119.494 531.67 121.163C530.775 122.832 529.554 124.107 528.005 124.988C526.464 125.862 524.731 126.298 522.807 126.298C520.868 126.298 519.128 125.858 517.586 124.977C516.045 124.097 514.827 122.822 513.932 121.153C513.037 119.484 512.59 117.463 512.59 115.091C512.59 112.712 513.037 110.688 513.932 109.018C514.827 107.349 516.045 106.078 517.586 105.205C519.128 104.324 520.868 103.884 522.807 103.884C524.731 103.884 526.464 104.324 528.005 105.205C529.554 106.078 530.775 107.349 531.67 109.018C532.572 110.688 533.023 112.712 533.023 115.091ZM528.346 115.091C528.346 113.55 528.116 112.25 527.654 111.192C527.199 110.134 526.557 109.331 525.726 108.784C524.895 108.237 523.922 107.964 522.807 107.964C521.691 107.964 520.718 108.237 519.888 108.784C519.057 109.331 518.41 110.134 517.949 111.192C517.494 112.25 517.267 113.55 517.267 115.091C517.267 116.632 517.494 117.932 517.949 118.99C518.41 120.048 519.057 120.851 519.888 121.398C520.718 121.945 521.691 122.218 522.807 122.218C523.922 122.218 524.895 121.945 525.726 121.398C526.557 120.851 527.199 120.048 527.654 118.99C528.116 117.932 528.346 116.632 528.346 115.091ZM536.355 126V109.636H540.755V112.491H540.925C541.224 111.476 541.724 110.709 542.427 110.19C543.131 109.665 543.94 109.402 544.856 109.402C545.084 109.402 545.329 109.416 545.592 109.445C545.854 109.473 546.085 109.512 546.284 109.562V113.589C546.071 113.525 545.776 113.468 545.4 113.418C545.023 113.369 544.679 113.344 544.366 113.344C543.699 113.344 543.102 113.489 542.577 113.781C542.058 114.065 541.646 114.462 541.341 114.974C541.043 115.485 540.893 116.075 540.893 116.742V126H536.355ZM555.241 132.477C553.771 132.477 552.51 132.275 551.459 131.87C550.415 131.472 549.584 130.929 548.966 130.24C548.348 129.551 547.947 128.777 547.762 127.918L551.96 127.353C552.087 127.68 552.29 127.985 552.567 128.269C552.844 128.553 553.21 128.781 553.664 128.951C554.126 129.129 554.687 129.217 555.347 129.217C556.335 129.217 557.148 128.976 557.787 128.493C558.433 128.017 558.756 127.218 558.756 126.096V123.102H558.565C558.366 123.557 558.068 123.987 557.67 124.391C557.272 124.796 556.761 125.126 556.136 125.382C555.511 125.638 554.765 125.766 553.899 125.766C552.67 125.766 551.551 125.482 550.543 124.913C549.541 124.338 548.742 123.461 548.146 122.282C547.556 121.096 547.261 119.597 547.261 117.786C547.261 115.933 547.563 114.384 548.167 113.141C548.771 111.898 549.573 110.968 550.575 110.35C551.583 109.732 552.688 109.423 553.888 109.423C554.804 109.423 555.571 109.58 556.189 109.892C556.807 110.197 557.304 110.581 557.68 111.043C558.064 111.497 558.359 111.945 558.565 112.385H558.735V109.636H563.242V126.16C563.242 127.552 562.901 128.717 562.219 129.654C561.537 130.592 560.592 131.295 559.385 131.763C558.185 132.239 556.803 132.477 555.241 132.477ZM555.337 122.357C556.068 122.357 556.686 122.175 557.19 121.813C557.702 121.444 558.092 120.918 558.362 120.237C558.639 119.548 558.778 118.724 558.778 117.765C558.778 116.806 558.643 115.975 558.373 115.272C558.103 114.562 557.712 114.011 557.201 113.621C556.69 113.23 556.068 113.035 555.337 113.035C554.591 113.035 553.962 113.237 553.451 113.642C552.94 114.04 552.553 114.594 552.29 115.304C552.027 116.014 551.896 116.835 551.896 117.765C551.896 118.71 552.027 119.526 552.29 120.215C552.56 120.897 552.947 121.426 553.451 121.803C553.962 122.172 554.591 122.357 555.337 122.357ZM577.642 126H572.699L580.231 104.182H586.176L593.697 126H588.754L583.289 109.168H583.118L577.642 126ZM577.333 117.424H589.01V121.025H577.333V117.424Z" fill="#03031C"/>
+<g filter="url(#filter3_bd_12_348)">
+<rect x="445" y="508" width="367" height="373" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="445.5" y="508.5" width="366" height="372" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<g filter="url(#filter4_bd_12_348)">
+<rect x="511" y="776" width="109" height="65" rx="10" fill="#5900CB"/>
+<rect x="511.5" y="776.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M608.771 564.091C608.771 566.47 608.32 568.494 607.418 570.163C606.523 571.832 605.302 573.107 603.753 573.988C602.212 574.862 600.479 575.298 598.555 575.298C596.616 575.298 594.876 574.858 593.334 573.977C591.793 573.097 590.575 571.822 589.68 570.153C588.785 568.484 588.338 566.463 588.338 564.091C588.338 561.712 588.785 559.688 589.68 558.018C590.575 556.349 591.793 555.078 593.334 554.205C594.876 553.324 596.616 552.884 598.555 552.884C600.479 552.884 602.212 553.324 603.753 554.205C605.302 555.078 606.523 556.349 607.418 558.018C608.32 559.688 608.771 561.712 608.771 564.091ZM604.094 564.091C604.094 562.55 603.864 561.25 603.402 560.192C602.947 559.134 602.305 558.331 601.474 557.784C600.643 557.237 599.67 556.964 598.555 556.964C597.44 556.964 596.467 557.237 595.636 557.784C594.805 558.331 594.158 559.134 593.697 560.192C593.242 561.25 593.015 562.55 593.015 564.091C593.015 565.632 593.242 566.932 593.697 567.99C594.158 569.048 594.805 569.851 595.636 570.398C596.467 570.945 597.44 571.218 598.555 571.218C599.67 571.218 600.643 570.945 601.474 570.398C602.305 569.851 602.947 569.048 603.402 567.99C603.864 566.932 604.094 565.632 604.094 564.091ZM612.103 575V558.636H616.503V561.491H616.673C616.972 560.476 617.472 559.709 618.176 559.19C618.879 558.665 619.688 558.402 620.604 558.402C620.832 558.402 621.077 558.416 621.34 558.445C621.602 558.473 621.833 558.512 622.032 558.562V562.589C621.819 562.525 621.524 562.468 621.148 562.418C620.771 562.369 620.427 562.344 620.114 562.344C619.447 562.344 618.85 562.489 618.325 562.781C617.806 563.065 617.394 563.462 617.089 563.974C616.791 564.485 616.641 565.075 616.641 565.742V575H612.103ZM630.989 581.477C629.519 581.477 628.258 581.275 627.207 580.87C626.163 580.472 625.332 579.929 624.714 579.24C624.096 578.551 623.695 577.777 623.51 576.918L627.708 576.353C627.835 576.68 628.038 576.985 628.315 577.269C628.592 577.553 628.958 577.781 629.412 577.951C629.874 578.129 630.435 578.217 631.095 578.217C632.083 578.217 632.896 577.976 633.535 577.493C634.181 577.017 634.505 576.218 634.505 575.096V572.102H634.313C634.114 572.557 633.816 572.987 633.418 573.391C633.02 573.796 632.509 574.126 631.884 574.382C631.259 574.638 630.513 574.766 629.647 574.766C628.418 574.766 627.299 574.482 626.291 573.913C625.289 573.338 624.49 572.461 623.894 571.282C623.304 570.096 623.009 568.597 623.009 566.786C623.009 564.933 623.311 563.384 623.915 562.141C624.519 560.898 625.321 559.968 626.323 559.35C627.331 558.732 628.436 558.423 629.636 558.423C630.552 558.423 631.319 558.58 631.937 558.892C632.555 559.197 633.052 559.581 633.429 560.043C633.812 560.497 634.107 560.945 634.313 561.385H634.483V558.636H638.99V575.16C638.99 576.552 638.649 577.717 637.967 578.654C637.285 579.592 636.34 580.295 635.133 580.763C633.933 581.239 632.551 581.477 630.989 581.477ZM631.085 571.357C631.816 571.357 632.434 571.175 632.938 570.813C633.45 570.444 633.84 569.918 634.11 569.237C634.387 568.548 634.526 567.724 634.526 566.765C634.526 565.806 634.391 564.975 634.121 564.272C633.851 563.562 633.46 563.011 632.949 562.621C632.438 562.23 631.816 562.035 631.085 562.035C630.339 562.035 629.71 562.237 629.199 562.642C628.688 563.04 628.301 563.594 628.038 564.304C627.775 565.014 627.644 565.835 627.644 566.765C627.644 567.71 627.775 568.526 628.038 569.215C628.308 569.897 628.695 570.426 629.199 570.803C629.71 571.172 630.339 571.357 631.085 571.357ZM653.39 575H648.447L655.979 553.182H661.924L669.445 575H664.502L659.037 558.168H658.866L653.39 575ZM653.081 566.424H664.758V570.025H653.081V566.424Z" fill="#03031C"/>
+<path d="M289.802 293H284.191V274.818H290.051C291.815 274.818 293.324 275.182 294.579 275.91C295.833 276.632 296.795 277.671 297.464 279.026C298.133 280.376 298.467 281.991 298.467 283.874C298.467 285.768 298.13 287.398 297.455 288.765C296.78 290.127 295.798 291.174 294.508 291.908C293.217 292.636 291.649 293 289.802 293ZM286.393 291.047H289.66C291.164 291.047 292.409 290.757 293.398 290.177C294.386 289.597 295.123 288.771 295.608 287.7C296.094 286.629 296.336 285.353 296.336 283.874C296.336 282.406 296.097 281.142 295.617 280.083C295.138 279.017 294.422 278.201 293.469 277.632C292.516 277.058 291.329 276.771 289.909 276.771H286.393V291.047ZM307.593 293.284C306.28 293.284 305.146 292.994 304.193 292.414C303.246 291.828 302.515 291.011 302 289.964C301.491 288.91 301.237 287.685 301.237 286.288C301.237 284.892 301.491 283.661 302 282.595C302.515 281.524 303.231 280.689 304.149 280.092C305.072 279.488 306.149 279.186 307.38 279.186C308.091 279.186 308.792 279.304 309.484 279.541C310.177 279.778 310.807 280.163 311.375 280.695C311.944 281.222 312.396 281.92 312.734 282.79C313.071 283.661 313.24 284.732 313.24 286.004V286.892H302.728V285.081H311.109C311.109 284.312 310.955 283.625 310.647 283.021C310.346 282.418 309.914 281.941 309.351 281.592C308.795 281.243 308.138 281.068 307.38 281.068C306.546 281.068 305.824 281.275 305.214 281.69C304.61 282.098 304.146 282.631 303.82 283.288C303.495 283.945 303.332 284.649 303.332 285.401V286.608C303.332 287.638 303.51 288.511 303.865 289.227C304.226 289.937 304.726 290.479 305.365 290.852C306.004 291.219 306.747 291.402 307.593 291.402C308.144 291.402 308.641 291.325 309.085 291.171C309.535 291.011 309.922 290.775 310.248 290.461C310.573 290.141 310.825 289.745 311.003 289.271L313.027 289.839C312.814 290.526 312.456 291.13 311.952 291.651C311.449 292.165 310.828 292.568 310.088 292.858C309.348 293.142 308.517 293.284 307.593 293.284ZM327.162 279.364L322.12 293H319.989L314.947 279.364H317.219L320.983 290.23H321.125L324.89 279.364H327.162Z" fill="#03031C"/>
+<path d="M537.462 654.58C546.757 654.58 554.292 645.272 554.292 633.79C554.292 622.308 546.757 613 537.462 613C528.167 613 520.632 622.308 520.632 633.79C520.632 645.272 528.167 654.58 537.462 654.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M550.134 647.848C550.134 647.848 561.111 653.919 565.717 657.696C566.809 658.595 567.747 659.67 568.493 660.878C569.852 663.146 570.556 665.754 570.527 668.406V684.017C561.389 692.317 549.547 696.921 537.264 696.952C524.968 696.99 513.102 692.376 504.001 684.017V668.406C503.972 665.754 504.676 663.146 506.035 660.878C506.781 659.67 507.719 658.595 508.811 657.696C513.417 653.958 524.412 647.452 524.412 647.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M513.699 666.856C513.29 667.577 513.086 668.394 513.11 669.22V680.077C519.977 685.12 528.308 687.844 536.868 687.844C545.427 687.844 553.759 685.12 560.626 680.077V669.295C560.653 668.471 560.454 667.654 560.049 666.932C553.364 673.252 545.423 677.043 536.868 677.043C528.312 677.043 520.372 673.226 513.699 666.856Z" fill="#5900CB"/>
+<path d="M523.411 719.818H525.613V731.857C525.613 733.099 525.32 734.209 524.734 735.186C524.154 736.156 523.334 736.923 522.275 737.485C521.216 738.041 519.973 738.32 518.546 738.32C517.12 738.32 515.877 738.041 514.818 737.485C513.758 736.923 512.936 736.156 512.35 735.186C511.77 734.209 511.48 733.099 511.48 731.857V719.818H513.681V731.679C513.681 732.567 513.877 733.357 514.267 734.049C514.658 734.736 515.214 735.277 515.936 735.674C516.664 736.065 517.534 736.26 518.546 736.26C519.558 736.26 520.428 736.065 521.156 735.674C521.884 735.277 522.441 734.736 522.825 734.049C523.216 733.357 523.411 732.567 523.411 731.679V719.818ZM539.385 727.418L537.503 727.95C537.384 727.637 537.21 727.332 536.979 727.036C536.754 726.734 536.446 726.485 536.056 726.29C535.665 726.095 535.165 725.997 534.555 725.997C533.721 725.997 533.025 726.19 532.469 726.574C531.919 726.953 531.643 727.435 531.643 728.021C531.643 728.542 531.833 728.953 532.212 729.255C532.59 729.557 533.182 729.809 533.987 730.01L536.011 730.507C537.23 730.803 538.139 731.256 538.737 731.865C539.335 732.469 539.633 733.247 539.633 734.2C539.633 734.982 539.408 735.68 538.959 736.295C538.515 736.911 537.893 737.396 537.094 737.751C536.295 738.107 535.366 738.284 534.307 738.284C532.916 738.284 531.765 737.982 530.853 737.379C529.942 736.775 529.365 735.893 529.122 734.733L531.111 734.236C531.3 734.97 531.658 735.52 532.185 735.887C532.718 736.254 533.413 736.438 534.271 736.438C535.248 736.438 536.023 736.23 536.597 735.816C537.177 735.396 537.467 734.893 537.467 734.307C537.467 733.833 537.301 733.437 536.97 733.117C536.639 732.792 536.13 732.549 535.443 732.389L533.17 731.857C531.922 731.561 531.004 731.102 530.418 730.48C529.838 729.853 529.548 729.069 529.548 728.128C529.548 727.358 529.764 726.678 530.196 726.086C530.634 725.494 531.229 725.029 531.981 724.692C532.738 724.355 533.596 724.186 534.555 724.186C535.905 724.186 536.964 724.482 537.734 725.074C538.509 725.666 539.059 726.447 539.385 727.418ZM548.505 738.284C547.191 738.284 546.057 737.994 545.104 737.414C544.157 736.828 543.426 736.011 542.912 734.964C542.403 733.91 542.148 732.685 542.148 731.288C542.148 729.892 542.403 728.661 542.912 727.595C543.426 726.524 544.143 725.689 545.06 725.092C545.983 724.488 547.06 724.186 548.292 724.186C549.002 724.186 549.703 724.304 550.396 724.541C551.088 724.778 551.718 725.163 552.287 725.695C552.855 726.222 553.307 726.92 553.645 727.79C553.982 728.661 554.151 729.732 554.151 731.004V731.892H543.64V730.081H552.02C552.02 729.312 551.866 728.625 551.559 728.021C551.257 727.418 550.825 726.941 550.262 726.592C549.706 726.243 549.049 726.068 548.292 726.068C547.457 726.068 546.735 726.275 546.125 726.69C545.522 727.098 545.057 727.631 544.731 728.288C544.406 728.945 544.243 729.649 544.243 730.401V731.608C544.243 732.638 544.421 733.511 544.776 734.227C545.137 734.937 545.637 735.479 546.276 735.852C546.915 736.219 547.658 736.402 548.505 736.402C549.055 736.402 549.552 736.325 549.996 736.171C550.446 736.011 550.834 735.775 551.159 735.461C551.485 735.141 551.736 734.745 551.914 734.271L553.938 734.839C553.725 735.526 553.367 736.13 552.864 736.651C552.361 737.165 551.739 737.568 550.999 737.858C550.259 738.142 549.428 738.284 548.505 738.284ZM557.338 738V724.364H559.362V726.423H559.504C559.753 725.749 560.203 725.201 560.854 724.781C561.505 724.361 562.239 724.151 563.055 724.151C563.209 724.151 563.402 724.154 563.632 724.159C563.863 724.165 564.038 724.174 564.156 724.186V726.317C564.085 726.299 563.922 726.272 563.668 726.237C563.419 726.195 563.156 726.175 562.878 726.175C562.215 726.175 561.623 726.314 561.102 726.592C560.587 726.864 560.179 727.243 559.877 727.728C559.581 728.208 559.433 728.755 559.433 729.371V738H557.338Z" fill="#03031C"/>
+<path d="M553.803 816.32C552.939 816.32 552.155 816.157 551.451 815.831C550.747 815.5 550.187 815.023 549.773 814.402C549.359 813.775 549.151 813.017 549.151 812.129C549.151 811.348 549.305 810.715 549.613 810.229C549.921 809.738 550.332 809.353 550.847 809.075C551.362 808.797 551.93 808.59 552.552 808.454C553.179 808.312 553.809 808.199 554.443 808.116C555.271 808.01 555.943 807.93 556.458 807.877C556.979 807.818 557.358 807.72 557.594 807.584C557.837 807.448 557.958 807.211 557.958 806.874V806.803C557.958 805.927 557.719 805.246 557.239 804.761C556.766 804.275 556.047 804.033 555.082 804.033C554.082 804.033 553.297 804.252 552.729 804.69C552.161 805.128 551.762 805.595 551.531 806.092L549.542 805.382C549.897 804.554 550.371 803.908 550.963 803.447C551.56 802.979 552.211 802.654 552.916 802.47C553.626 802.281 554.324 802.186 555.011 802.186C555.449 802.186 555.952 802.239 556.52 802.346C557.094 802.446 557.648 802.657 558.18 802.976C558.719 803.296 559.166 803.778 559.521 804.423C559.876 805.068 560.053 805.933 560.053 807.016V816H557.958V814.153H557.852C557.71 814.449 557.473 814.766 557.142 815.103C556.81 815.441 556.369 815.728 555.819 815.964C555.268 816.201 554.597 816.32 553.803 816.32ZM554.123 814.438C554.952 814.438 555.65 814.275 556.218 813.949C556.792 813.624 557.224 813.203 557.514 812.689C557.81 812.174 557.958 811.632 557.958 811.064V809.146C557.869 809.253 557.674 809.35 557.372 809.439C557.076 809.522 556.733 809.596 556.343 809.661C555.958 809.72 555.582 809.774 555.215 809.821C554.854 809.862 554.561 809.898 554.336 809.928C553.792 809.999 553.283 810.114 552.809 810.274C552.342 810.428 551.963 810.661 551.673 810.975C551.389 811.283 551.247 811.703 551.247 812.236C551.247 812.964 551.516 813.514 552.055 813.887C552.599 814.254 553.289 814.438 554.123 814.438ZM563.878 821.114V802.364H565.902V804.53H566.15C566.304 804.293 566.517 803.991 566.79 803.624C567.068 803.251 567.464 802.92 567.979 802.63C568.5 802.334 569.204 802.186 570.092 802.186C571.24 802.186 572.252 802.473 573.128 803.047C574.004 803.621 574.688 804.435 575.179 805.489C575.67 806.542 575.916 807.785 575.916 809.217C575.916 810.661 575.67 811.913 575.179 812.973C574.688 814.026 574.007 814.843 573.137 815.423C572.267 815.997 571.264 816.284 570.128 816.284C569.252 816.284 568.55 816.139 568.024 815.849C567.497 815.553 567.091 815.219 566.807 814.846C566.523 814.467 566.304 814.153 566.15 813.905H565.973V821.114H563.878ZM565.937 809.182C565.937 810.212 566.088 811.12 566.39 811.907C566.692 812.689 567.133 813.301 567.713 813.745C568.293 814.183 569.003 814.402 569.843 814.402C570.719 814.402 571.45 814.171 572.036 813.71C572.628 813.242 573.072 812.615 573.368 811.827C573.67 811.034 573.821 810.152 573.821 809.182C573.821 808.223 573.673 807.359 573.377 806.589C573.087 805.814 572.646 805.202 572.054 804.752C571.468 804.296 570.731 804.068 569.843 804.068C568.991 804.068 568.275 804.284 567.695 804.716C567.115 805.142 566.677 805.74 566.381 806.51C566.085 807.273 565.937 808.164 565.937 809.182ZM579.112 816V802.364H581.207V816H579.112ZM580.177 800.091C579.769 800.091 579.417 799.952 579.121 799.674C578.831 799.395 578.686 799.061 578.686 798.67C578.686 798.28 578.831 797.945 579.121 797.667C579.417 797.389 579.769 797.25 580.177 797.25C580.586 797.25 580.935 797.389 581.225 797.667C581.521 797.945 581.669 798.28 581.669 798.67C581.669 799.061 581.521 799.395 581.225 799.674C580.935 799.952 580.586 800.091 580.177 800.091Z" fill="white"/>
+<g filter="url(#filter5_bd_12_348)">
+<rect x="638" y="776" width="109" height="65" rx="10" fill="#5900CB"/>
+<rect x="638.5" y="776.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M680.803 816.32C679.939 816.32 679.155 816.157 678.451 815.831C677.747 815.5 677.187 815.023 676.773 814.402C676.359 813.775 676.151 813.017 676.151 812.129C676.151 811.348 676.305 810.715 676.613 810.229C676.921 809.738 677.332 809.353 677.847 809.075C678.362 808.797 678.93 808.59 679.552 808.454C680.179 808.312 680.809 808.199 681.443 808.116C682.271 808.01 682.943 807.93 683.458 807.877C683.979 807.818 684.358 807.72 684.594 807.584C684.837 807.448 684.958 807.211 684.958 806.874V806.803C684.958 805.927 684.719 805.246 684.239 804.761C683.766 804.275 683.047 804.033 682.082 804.033C681.082 804.033 680.297 804.252 679.729 804.69C679.161 805.128 678.762 805.595 678.531 806.092L676.542 805.382C676.897 804.554 677.371 803.908 677.963 803.447C678.56 802.979 679.211 802.654 679.916 802.47C680.626 802.281 681.324 802.186 682.011 802.186C682.449 802.186 682.952 802.239 683.52 802.346C684.094 802.446 684.648 802.657 685.18 802.976C685.719 803.296 686.166 803.778 686.521 804.423C686.876 805.068 687.053 805.933 687.053 807.016V816H684.958V814.153H684.852C684.71 814.449 684.473 814.766 684.142 815.103C683.81 815.441 683.369 815.728 682.819 815.964C682.268 816.201 681.597 816.32 680.803 816.32ZM681.123 814.438C681.952 814.438 682.65 814.275 683.218 813.949C683.792 813.624 684.224 813.203 684.514 812.689C684.81 812.174 684.958 811.632 684.958 811.064V809.146C684.869 809.253 684.674 809.35 684.372 809.439C684.076 809.522 683.733 809.596 683.343 809.661C682.958 809.72 682.582 809.774 682.215 809.821C681.854 809.862 681.561 809.898 681.336 809.928C680.792 809.999 680.283 810.114 679.809 810.274C679.342 810.428 678.963 810.661 678.673 810.975C678.389 811.283 678.247 811.703 678.247 812.236C678.247 812.964 678.516 813.514 679.055 813.887C679.599 814.254 680.289 814.438 681.123 814.438ZM690.878 821.114V802.364H692.902V804.53H693.15C693.304 804.293 693.517 803.991 693.79 803.624C694.068 803.251 694.464 802.92 694.979 802.63C695.5 802.334 696.204 802.186 697.092 802.186C698.24 802.186 699.252 802.473 700.128 803.047C701.004 803.621 701.688 804.435 702.179 805.489C702.67 806.542 702.916 807.785 702.916 809.217C702.916 810.661 702.67 811.913 702.179 812.973C701.688 814.026 701.007 814.843 700.137 815.423C699.267 815.997 698.264 816.284 697.128 816.284C696.252 816.284 695.55 816.139 695.024 815.849C694.497 815.553 694.091 815.219 693.807 814.846C693.523 814.467 693.304 814.153 693.15 813.905H692.973V821.114H690.878ZM692.937 809.182C692.937 810.212 693.088 811.12 693.39 811.907C693.692 812.689 694.133 813.301 694.713 813.745C695.293 814.183 696.003 814.402 696.843 814.402C697.719 814.402 698.45 814.171 699.036 813.71C699.628 813.242 700.072 812.615 700.368 811.827C700.67 811.034 700.821 810.152 700.821 809.182C700.821 808.223 700.673 807.359 700.377 806.589C700.087 805.814 699.646 805.202 699.054 804.752C698.468 804.296 697.731 804.068 696.843 804.068C695.991 804.068 695.275 804.284 694.695 804.716C694.115 805.142 693.677 805.74 693.381 806.51C693.085 807.273 692.937 808.164 692.937 809.182ZM706.112 816V802.364H708.207V816H706.112ZM707.177 800.091C706.769 800.091 706.417 799.952 706.121 799.674C705.831 799.395 705.686 799.061 705.686 798.67C705.686 798.28 705.831 797.945 706.121 797.667C706.417 797.389 706.769 797.25 707.177 797.25C707.586 797.25 707.935 797.389 708.225 797.667C708.521 797.945 708.669 798.28 708.669 798.67C708.669 799.061 708.521 799.395 708.225 799.674C707.935 799.952 707.586 800.091 707.177 800.091Z" fill="white"/>
+<path d="M651.996 719.818H654.198V731.857C654.198 733.099 653.905 734.209 653.319 735.186C652.739 736.156 651.919 736.923 650.86 737.485C649.801 738.041 648.558 738.32 647.131 738.32C645.705 738.32 644.462 738.041 643.403 737.485C642.343 736.923 641.52 736.156 640.935 735.186C640.355 734.209 640.064 733.099 640.064 731.857V719.818H642.266V731.679C642.266 732.567 642.462 733.357 642.852 734.049C643.243 734.736 643.799 735.277 644.521 735.674C645.249 736.065 646.119 736.26 647.131 736.26C648.143 736.26 649.013 736.065 649.741 735.674C650.469 735.277 651.026 734.736 651.41 734.049C651.801 733.357 651.996 732.567 651.996 731.679V719.818ZM667.97 727.418L666.088 727.95C665.969 727.637 665.795 727.332 665.564 727.036C665.339 726.734 665.031 726.485 664.641 726.29C664.25 726.095 663.75 725.997 663.14 725.997C662.306 725.997 661.61 726.19 661.054 726.574C660.504 726.953 660.228 727.435 660.228 728.021C660.228 728.542 660.418 728.953 660.796 729.255C661.175 729.557 661.767 729.809 662.572 730.01L664.596 730.507C665.815 730.803 666.724 731.256 667.322 731.865C667.919 732.469 668.218 733.247 668.218 734.2C668.218 734.982 667.993 735.68 667.544 736.295C667.1 736.911 666.478 737.396 665.679 737.751C664.88 738.107 663.951 738.284 662.892 738.284C661.501 738.284 660.35 737.982 659.438 737.379C658.527 736.775 657.95 735.893 657.707 734.733L659.696 734.236C659.885 734.97 660.243 735.52 660.77 735.887C661.303 736.254 661.998 736.438 662.856 736.438C663.833 736.438 664.608 736.23 665.182 735.816C665.762 735.396 666.052 734.893 666.052 734.307C666.052 733.833 665.886 733.437 665.555 733.117C665.224 732.792 664.715 732.549 664.028 732.389L661.755 731.857C660.506 731.561 659.589 731.102 659.003 730.48C658.423 729.853 658.133 729.069 658.133 728.128C658.133 727.358 658.349 726.678 658.781 726.086C659.219 725.494 659.814 725.029 660.566 724.692C661.323 724.355 662.181 724.186 663.14 724.186C664.49 724.186 665.549 724.482 666.318 725.074C667.094 725.666 667.644 726.447 667.97 727.418ZM677.09 738.284C675.776 738.284 674.642 737.994 673.689 737.414C672.742 736.828 672.011 736.011 671.496 734.964C670.987 733.91 670.733 732.685 670.733 731.288C670.733 729.892 670.987 728.661 671.496 727.595C672.011 726.524 672.728 725.689 673.645 725.092C674.568 724.488 675.645 724.186 676.876 724.186C677.587 724.186 678.288 724.304 678.981 724.541C679.673 724.778 680.303 725.163 680.871 725.695C681.44 726.222 681.892 726.92 682.23 727.79C682.567 728.661 682.736 729.732 682.736 731.004V731.892H672.224V730.081H680.605C680.605 729.312 680.451 728.625 680.144 728.021C679.842 727.418 679.41 726.941 678.847 726.592C678.291 726.243 677.634 726.068 676.876 726.068C676.042 726.068 675.32 726.275 674.71 726.69C674.107 727.098 673.642 727.631 673.316 728.288C672.991 728.945 672.828 729.649 672.828 730.401V731.608C672.828 732.638 673.006 733.511 673.361 734.227C673.722 734.937 674.222 735.479 674.861 735.852C675.5 736.219 676.243 736.402 677.09 736.402C677.64 736.402 678.137 736.325 678.581 736.171C679.031 736.011 679.418 735.775 679.744 735.461C680.07 735.141 680.321 734.745 680.499 734.271L682.523 734.839C682.31 735.526 681.952 736.13 681.449 736.651C680.945 737.165 680.324 737.568 679.584 737.858C678.844 738.142 678.013 738.284 677.09 738.284ZM685.923 738V724.364H687.947V726.423H688.089C688.338 725.749 688.788 725.201 689.439 724.781C690.09 724.361 690.824 724.151 691.64 724.151C691.794 724.151 691.987 724.154 692.217 724.159C692.448 724.165 692.623 724.174 692.741 724.186V726.317C692.67 726.299 692.507 726.272 692.253 726.237C692.004 726.195 691.741 726.175 691.463 726.175C690.8 726.175 690.208 726.314 689.687 726.592C689.172 726.864 688.764 727.243 688.462 727.728C688.166 728.208 688.018 728.755 688.018 729.371V738H685.923ZM707.76 743.398C706.748 743.398 705.878 743.268 705.15 743.007C704.422 742.753 703.816 742.415 703.33 741.995C702.851 741.581 702.469 741.137 702.185 740.663L703.854 739.491C704.043 739.74 704.283 740.024 704.573 740.344C704.863 740.669 705.26 740.95 705.763 741.187C706.272 741.43 706.938 741.551 707.76 741.551C708.861 741.551 709.77 741.285 710.486 740.752C711.202 740.219 711.56 739.385 711.56 738.249V735.479H711.382C711.229 735.727 711.01 736.035 710.725 736.402C710.447 736.763 710.045 737.086 709.518 737.37C708.997 737.648 708.293 737.787 707.405 737.787C706.304 737.787 705.316 737.527 704.44 737.006C703.57 736.485 702.88 735.727 702.371 734.733C701.868 733.739 701.617 732.531 701.617 731.111C701.617 729.714 701.862 728.498 702.354 727.462C702.845 726.42 703.528 725.615 704.404 725.047C705.28 724.473 706.292 724.186 707.441 724.186C708.328 724.186 709.033 724.334 709.554 724.63C710.08 724.92 710.483 725.251 710.761 725.624C711.045 725.991 711.264 726.293 711.418 726.53H711.631V724.364H713.655V738.391C713.655 739.562 713.389 740.515 712.856 741.249C712.329 741.989 711.619 742.531 710.725 742.874C709.838 743.223 708.849 743.398 707.76 743.398ZM707.689 735.905C708.53 735.905 709.24 735.712 709.82 735.328C710.4 734.943 710.841 734.39 711.143 733.668C711.445 732.946 711.595 732.081 711.595 731.075C711.595 730.093 711.448 729.226 711.152 728.474C710.856 727.722 710.418 727.134 709.838 726.707C709.258 726.281 708.542 726.068 707.689 726.068C706.801 726.068 706.062 726.293 705.47 726.743C704.884 727.193 704.443 727.796 704.147 728.554C703.857 729.312 703.712 730.152 703.712 731.075C703.712 732.022 703.86 732.86 704.156 733.588C704.458 734.31 704.902 734.878 705.488 735.292C706.079 735.701 706.813 735.905 707.689 735.905ZM717.49 738V724.364H719.515V726.423H719.657C719.905 725.749 720.355 725.201 721.006 724.781C721.657 724.361 722.391 724.151 723.208 724.151C723.362 724.151 723.554 724.154 723.785 724.159C724.016 724.165 724.19 724.174 724.309 724.186V726.317C724.238 726.299 724.075 726.272 723.82 726.237C723.572 726.195 723.308 726.175 723.03 726.175C722.367 726.175 721.775 726.314 721.255 726.592C720.74 726.864 720.331 727.243 720.029 727.728C719.734 728.208 719.586 728.755 719.586 729.371V738H717.49ZM731.917 738.284C730.686 738.284 729.606 737.991 728.676 737.405C727.753 736.819 727.031 736 726.51 734.946C725.995 733.893 725.738 732.661 725.738 731.253C725.738 729.832 725.995 728.592 726.51 727.533C727.031 726.474 727.753 725.651 728.676 725.065C729.606 724.479 730.686 724.186 731.917 724.186C733.148 724.186 734.225 724.479 735.148 725.065C736.078 725.651 736.8 726.474 737.315 727.533C737.835 728.592 738.096 729.832 738.096 731.253C738.096 732.661 737.835 733.893 737.315 734.946C736.8 736 736.078 736.819 735.148 737.405C734.225 737.991 733.148 738.284 731.917 738.284ZM731.917 736.402C732.852 736.402 733.621 736.162 734.225 735.683C734.829 735.203 735.276 734.573 735.566 733.792C735.856 733.011 736.001 732.164 736.001 731.253C736.001 730.341 735.856 729.492 735.566 728.705C735.276 727.918 734.829 727.281 734.225 726.796C733.621 726.311 732.852 726.068 731.917 726.068C730.982 726.068 730.212 726.311 729.609 726.796C729.005 727.281 728.558 727.918 728.268 728.705C727.978 729.492 727.833 730.341 727.833 731.253C727.833 732.164 727.978 733.011 728.268 733.792C728.558 734.573 729.005 735.203 729.609 735.683C730.212 736.162 730.982 736.402 731.917 736.402ZM749.888 732.425V724.364H751.983V738H749.888V735.692H749.746C749.426 736.384 748.929 736.973 748.254 737.458C747.58 737.938 746.727 738.178 745.697 738.178C744.845 738.178 744.088 737.991 743.425 737.618C742.762 737.239 742.241 736.671 741.862 735.914C741.483 735.15 741.294 734.188 741.294 733.028V724.364H743.389V732.886C743.389 733.881 743.667 734.674 744.224 735.266C744.786 735.857 745.502 736.153 746.372 736.153C746.893 736.153 747.423 736.02 747.961 735.754C748.506 735.488 748.962 735.079 749.329 734.529C749.701 733.978 749.888 733.277 749.888 732.425ZM755.82 743.114V724.364H757.845V726.53H758.093C758.247 726.293 758.46 725.991 758.732 725.624C759.011 725.251 759.407 724.92 759.922 724.63C760.443 724.334 761.147 724.186 762.035 724.186C763.183 724.186 764.195 724.473 765.071 725.047C765.947 725.621 766.631 726.435 767.122 727.489C767.613 728.542 767.859 729.785 767.859 731.217C767.859 732.661 767.613 733.913 767.122 734.973C766.631 736.026 765.95 736.843 765.08 737.423C764.21 737.997 763.207 738.284 762.07 738.284C761.194 738.284 760.493 738.139 759.966 737.849C759.44 737.553 759.034 737.219 758.75 736.846C758.466 736.467 758.247 736.153 758.093 735.905H757.916V743.114H755.82ZM757.88 731.182C757.88 732.212 758.031 733.12 758.333 733.907C758.635 734.689 759.076 735.301 759.656 735.745C760.236 736.183 760.946 736.402 761.786 736.402C762.662 736.402 763.393 736.171 763.979 735.71C764.571 735.242 765.015 734.615 765.311 733.827C765.613 733.034 765.764 732.152 765.764 731.182C765.764 730.223 765.616 729.359 765.32 728.589C765.03 727.814 764.589 727.202 763.997 726.752C763.411 726.296 762.674 726.068 761.786 726.068C760.934 726.068 760.218 726.284 759.638 726.716C759.058 727.142 758.62 727.74 758.324 728.51C758.028 729.273 757.88 730.164 757.88 731.182Z" fill="#03031C"/>
+<path d="M157.019 738V719.818H163.163C164.589 719.818 165.755 720.076 166.66 720.591C167.572 721.1 168.247 721.789 168.685 722.659C169.123 723.529 169.342 724.5 169.342 725.571C169.342 726.642 169.123 727.616 168.685 728.492C168.253 729.368 167.584 730.066 166.678 730.587C165.773 731.102 164.613 731.359 163.198 731.359H158.795V729.406H163.127C164.104 729.406 164.888 729.238 165.48 728.9C166.072 728.563 166.501 728.107 166.767 727.533C167.039 726.953 167.175 726.299 167.175 725.571C167.175 724.843 167.039 724.192 166.767 723.618C166.501 723.044 166.069 722.594 165.471 722.268C164.873 721.937 164.08 721.771 163.092 721.771H159.221V738H157.019ZM174.699 719.818V738H172.604V719.818H174.699ZM182.55 738.32C181.685 738.32 180.901 738.157 180.197 737.831C179.493 737.5 178.933 737.023 178.519 736.402C178.105 735.775 177.898 735.017 177.898 734.129C177.898 733.348 178.051 732.715 178.359 732.229C178.667 731.738 179.078 731.353 179.593 731.075C180.108 730.797 180.676 730.59 181.298 730.454C181.925 730.312 182.555 730.199 183.189 730.116C184.017 730.01 184.689 729.93 185.204 729.877C185.725 729.818 186.104 729.72 186.34 729.584C186.583 729.448 186.704 729.211 186.704 728.874V728.803C186.704 727.927 186.465 727.246 185.985 726.761C185.512 726.275 184.793 726.033 183.828 726.033C182.828 726.033 182.044 726.252 181.475 726.69C180.907 727.128 180.508 727.595 180.277 728.092L178.288 727.382C178.643 726.554 179.117 725.908 179.709 725.447C180.306 724.979 180.957 724.654 181.662 724.47C182.372 724.281 183.07 724.186 183.757 724.186C184.195 724.186 184.698 724.239 185.266 724.346C185.84 724.446 186.394 724.657 186.926 724.976C187.465 725.296 187.912 725.778 188.267 726.423C188.622 727.068 188.8 727.933 188.8 729.016V738H186.704V736.153H186.598C186.456 736.449 186.219 736.766 185.888 737.103C185.556 737.441 185.115 737.728 184.565 737.964C184.014 738.201 183.343 738.32 182.55 738.32ZM182.869 736.438C183.698 736.438 184.396 736.275 184.964 735.949C185.538 735.624 185.97 735.203 186.26 734.689C186.556 734.174 186.704 733.632 186.704 733.064V731.146C186.616 731.253 186.42 731.35 186.118 731.439C185.823 731.522 185.479 731.596 185.089 731.661C184.704 731.72 184.328 731.774 183.961 731.821C183.6 731.862 183.307 731.898 183.082 731.928C182.538 731.999 182.029 732.114 181.555 732.274C181.088 732.428 180.709 732.661 180.419 732.975C180.135 733.283 179.993 733.703 179.993 734.236C179.993 734.964 180.262 735.514 180.801 735.887C181.345 736.254 182.035 736.438 182.869 736.438ZM198.554 724.364V726.139H191.487V724.364H198.554ZM193.547 721.097H195.642V734.094C195.642 734.686 195.728 735.129 195.9 735.425C196.077 735.715 196.302 735.911 196.574 736.011C196.852 736.106 197.145 736.153 197.453 736.153C197.684 736.153 197.873 736.142 198.021 736.118C198.169 736.088 198.288 736.065 198.377 736.047L198.803 737.929C198.661 737.982 198.462 738.036 198.208 738.089C197.953 738.148 197.631 738.178 197.24 738.178C196.648 738.178 196.068 738.05 195.5 737.796C194.938 737.541 194.47 737.154 194.097 736.633C193.73 736.112 193.547 735.455 193.547 734.662V721.097ZM207.778 724.364V726.139H200.427V724.364H207.778ZM202.629 738V722.482C202.629 721.7 202.812 721.049 203.179 720.528C203.546 720.008 204.023 719.617 204.609 719.357C205.195 719.096 205.813 718.966 206.464 718.966C206.979 718.966 207.399 719.007 207.725 719.09C208.05 719.173 208.293 719.25 208.453 719.321L207.849 721.132C207.743 721.097 207.595 721.052 207.405 720.999C207.222 720.946 206.979 720.919 206.677 720.919C205.985 720.919 205.485 721.094 205.177 721.443C204.875 721.792 204.724 722.304 204.724 722.979V738H202.629ZM215.693 738.284C214.462 738.284 213.382 737.991 212.452 737.405C211.529 736.819 210.807 736 210.286 734.946C209.771 733.893 209.514 732.661 209.514 731.253C209.514 729.832 209.771 728.592 210.286 727.533C210.807 726.474 211.529 725.651 212.452 725.065C213.382 724.479 214.462 724.186 215.693 724.186C216.924 724.186 218.001 724.479 218.924 725.065C219.853 725.651 220.576 726.474 221.09 727.533C221.611 728.592 221.872 729.832 221.872 731.253C221.872 732.661 221.611 733.893 221.09 734.946C220.576 736 219.853 736.819 218.924 737.405C218.001 737.991 216.924 738.284 215.693 738.284ZM215.693 736.402C216.628 736.402 217.397 736.162 218.001 735.683C218.605 735.203 219.052 734.573 219.342 733.792C219.632 733.011 219.777 732.164 219.777 731.253C219.777 730.341 219.632 729.492 219.342 728.705C219.052 727.918 218.605 727.281 218.001 726.796C217.397 726.311 216.628 726.068 215.693 726.068C214.758 726.068 213.988 726.311 213.384 726.796C212.781 727.281 212.334 727.918 212.044 728.705C211.754 729.492 211.609 730.341 211.609 731.253C211.609 732.164 211.754 733.011 212.044 733.792C212.334 734.573 212.781 735.203 213.384 735.683C213.988 736.162 214.758 736.402 215.693 736.402ZM225.07 738V724.364H227.094V726.423H227.236C227.485 725.749 227.935 725.201 228.586 724.781C229.237 724.361 229.971 724.151 230.787 724.151C230.941 724.151 231.134 724.154 231.364 724.159C231.595 724.165 231.77 724.174 231.888 724.186V726.317C231.817 726.299 231.654 726.272 231.4 726.237C231.151 726.195 230.888 726.175 230.61 726.175C229.947 726.175 229.355 726.314 228.834 726.592C228.319 726.864 227.911 727.243 227.609 727.728C227.313 728.208 227.165 728.755 227.165 729.371V738H225.07ZM234.372 738V724.364H236.396V726.494H236.573C236.858 725.766 237.316 725.201 237.949 724.799C238.583 724.39 239.343 724.186 240.231 724.186C241.131 724.186 241.879 724.39 242.477 724.799C243.081 725.201 243.551 725.766 243.889 726.494H244.031C244.38 725.79 244.904 725.231 245.602 724.816C246.301 724.396 247.138 724.186 248.115 724.186C249.334 724.186 250.331 724.568 251.106 725.331C251.882 726.089 252.269 727.27 252.269 728.874V738H250.174V728.874C250.174 727.867 249.899 727.148 249.349 726.716C248.798 726.284 248.15 726.068 247.404 726.068C246.446 726.068 245.703 726.358 245.176 726.938C244.649 727.512 244.386 728.24 244.386 729.122V738H242.255V728.661C242.255 727.885 242.004 727.261 241.501 726.787C240.998 726.308 240.349 726.068 239.556 726.068C239.012 726.068 238.503 726.213 238.029 726.503C237.562 726.793 237.183 727.196 236.893 727.711C236.609 728.22 236.467 728.808 236.467 729.477V738H234.372ZM182.697 759.364V761.139H175.63V759.364H182.697ZM177.69 756.097H179.785V769.094C179.785 769.686 179.871 770.129 180.043 770.425C180.22 770.715 180.445 770.911 180.717 771.011C180.996 771.106 181.289 771.153 181.596 771.153C181.827 771.153 182.016 771.142 182.164 771.118C182.312 771.088 182.431 771.065 182.52 771.047L182.946 772.929C182.804 772.982 182.605 773.036 182.351 773.089C182.096 773.148 181.774 773.178 181.383 773.178C180.791 773.178 180.211 773.05 179.643 772.796C179.081 772.541 178.613 772.154 178.24 771.633C177.874 771.112 177.69 770.455 177.69 769.662V756.097ZM191.42 773.284C190.106 773.284 188.972 772.994 188.019 772.414C187.072 771.828 186.341 771.011 185.827 769.964C185.318 768.91 185.063 767.685 185.063 766.288C185.063 764.892 185.318 763.661 185.827 762.595C186.341 761.524 187.058 760.689 187.975 760.092C188.898 759.488 189.975 759.186 191.207 759.186C191.917 759.186 192.618 759.304 193.311 759.541C194.003 759.778 194.633 760.163 195.202 760.695C195.77 761.222 196.223 761.92 196.56 762.79C196.897 763.661 197.066 764.732 197.066 766.004V766.892H186.555V765.081H194.935C194.935 764.312 194.781 763.625 194.474 763.021C194.172 762.418 193.74 761.941 193.177 761.592C192.621 761.243 191.964 761.068 191.207 761.068C190.372 761.068 189.65 761.275 189.04 761.69C188.437 762.098 187.972 762.631 187.647 763.288C187.321 763.945 187.158 764.649 187.158 765.401V766.608C187.158 767.638 187.336 768.511 187.691 769.227C188.052 769.937 188.552 770.479 189.191 770.852C189.83 771.219 190.573 771.402 191.42 771.402C191.97 771.402 192.467 771.325 192.911 771.171C193.361 771.011 193.749 770.775 194.074 770.461C194.4 770.141 194.651 769.745 194.829 769.271L196.853 769.839C196.64 770.526 196.282 771.13 195.779 771.651C195.276 772.165 194.654 772.568 193.914 772.858C193.174 773.142 192.343 773.284 191.42 773.284ZM204.266 773.32C203.402 773.32 202.618 773.157 201.913 772.831C201.209 772.5 200.65 772.023 200.235 771.402C199.821 770.775 199.614 770.017 199.614 769.129C199.614 768.348 199.768 767.715 200.076 767.229C200.383 766.738 200.795 766.353 201.31 766.075C201.824 765.797 202.393 765.59 203.014 765.454C203.641 765.312 204.272 765.199 204.905 765.116C205.734 765.01 206.405 764.93 206.92 764.877C207.441 764.818 207.82 764.72 208.057 764.584C208.299 764.448 208.421 764.211 208.421 763.874V763.803C208.421 762.927 208.181 762.246 207.702 761.761C207.228 761.275 206.509 761.033 205.544 761.033C204.544 761.033 203.76 761.252 203.192 761.69C202.623 762.128 202.224 762.595 201.993 763.092L200.004 762.382C200.36 761.554 200.833 760.908 201.425 760.447C202.023 759.979 202.674 759.654 203.378 759.47C204.088 759.281 204.787 759.186 205.473 759.186C205.911 759.186 206.414 759.239 206.982 759.346C207.557 759.446 208.11 759.657 208.643 759.976C209.181 760.296 209.628 760.778 209.983 761.423C210.338 762.068 210.516 762.933 210.516 764.016V773H208.421V771.153H208.314C208.172 771.449 207.935 771.766 207.604 772.103C207.272 772.441 206.832 772.728 206.281 772.964C205.731 773.201 205.059 773.32 204.266 773.32ZM204.585 771.438C205.414 771.438 206.112 771.275 206.681 770.949C207.255 770.624 207.687 770.203 207.977 769.689C208.273 769.174 208.421 768.632 208.421 768.064V766.146C208.332 766.253 208.137 766.35 207.835 766.439C207.539 766.522 207.196 766.596 206.805 766.661C206.42 766.72 206.044 766.774 205.677 766.821C205.316 766.862 205.023 766.898 204.799 766.928C204.254 766.999 203.745 767.114 203.272 767.274C202.804 767.428 202.425 767.661 202.135 767.975C201.851 768.283 201.709 768.703 201.709 769.236C201.709 769.964 201.978 770.514 202.517 770.887C203.061 771.254 203.751 771.438 204.585 771.438ZM214.34 773V759.364H216.364V761.494H216.542C216.826 760.766 217.284 760.201 217.918 759.799C218.551 759.39 219.312 759.186 220.199 759.186C221.099 759.186 221.848 759.39 222.445 759.799C223.049 760.201 223.52 760.766 223.857 761.494H223.999C224.348 760.79 224.872 760.231 225.57 759.816C226.269 759.396 227.106 759.186 228.083 759.186C229.302 759.186 230.299 759.568 231.075 760.331C231.85 761.089 232.238 762.27 232.238 763.874V773H230.143V763.874C230.143 762.867 229.867 762.148 229.317 761.716C228.766 761.284 228.118 761.068 227.373 761.068C226.414 761.068 225.671 761.358 225.144 761.938C224.618 762.512 224.354 763.24 224.354 764.122V773H222.223V763.661C222.223 762.885 221.972 762.261 221.469 761.787C220.966 761.308 220.318 761.068 219.525 761.068C218.98 761.068 218.471 761.213 217.998 761.503C217.53 761.793 217.151 762.196 216.861 762.711C216.577 763.22 216.435 763.808 216.435 764.477V773H214.34Z" fill="#03031C"/>
+<g filter="url(#filter6_bd_12_348)">
+<rect x="1341" y="841" width="210" height="197" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="1341.5" y="841.5" width="209" height="196" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M1397.56 996.284C1396.43 996.284 1395.42 995.997 1394.55 995.423C1393.68 994.843 1393 994.026 1392.51 992.973C1392.02 991.913 1391.77 990.661 1391.77 989.217C1391.77 987.785 1392.02 986.542 1392.51 985.489C1393 984.435 1393.69 983.621 1394.56 983.047C1395.44 982.473 1396.45 982.186 1397.6 982.186C1398.49 982.186 1399.19 982.334 1399.7 982.63C1400.22 982.92 1400.62 983.251 1400.89 983.624C1401.17 983.991 1401.39 984.293 1401.54 984.53H1401.72V977.818H1403.81V996H1401.79V993.905H1401.54C1401.39 994.153 1401.17 994.467 1400.88 994.846C1400.6 995.219 1400.19 995.553 1399.67 995.849C1399.14 996.139 1398.44 996.284 1397.56 996.284ZM1397.85 994.402C1398.69 994.402 1399.4 994.183 1399.98 993.745C1400.56 993.301 1401 992.689 1401.3 991.907C1401.6 991.12 1401.75 990.212 1401.75 989.182C1401.75 988.164 1401.6 987.273 1401.31 986.51C1401.01 985.74 1400.57 985.142 1399.99 984.716C1399.41 984.284 1398.7 984.068 1397.85 984.068C1396.96 984.068 1396.22 984.296 1395.63 984.752C1395.04 985.202 1394.6 985.814 1394.3 986.589C1394.01 987.359 1393.87 988.223 1393.87 989.182C1393.87 990.152 1394.02 991.034 1394.31 991.827C1394.61 992.615 1395.06 993.242 1395.64 993.71C1396.24 994.171 1396.97 994.402 1397.85 994.402ZM1411.95 996.32C1411.09 996.32 1410.3 996.157 1409.6 995.831C1408.9 995.5 1408.34 995.023 1407.92 994.402C1407.51 993.775 1407.3 993.017 1407.3 992.129C1407.3 991.348 1407.45 990.715 1407.76 990.229C1408.07 989.738 1408.48 989.353 1409 989.075C1409.51 988.797 1410.08 988.59 1410.7 988.454C1411.33 988.312 1411.96 988.199 1412.59 988.116C1413.42 988.01 1414.09 987.93 1414.61 987.877C1415.13 987.818 1415.51 987.72 1415.74 987.584C1415.99 987.448 1416.11 987.211 1416.11 986.874V986.803C1416.11 985.927 1415.87 985.246 1415.39 984.761C1414.92 984.275 1414.2 984.033 1413.23 984.033C1412.23 984.033 1411.45 984.252 1410.88 984.69C1410.31 985.128 1409.91 985.595 1409.68 986.092L1407.69 985.382C1408.05 984.554 1408.52 983.908 1409.11 983.447C1409.71 982.979 1410.36 982.654 1411.07 982.47C1411.78 982.281 1412.47 982.186 1413.16 982.186C1413.6 982.186 1414.1 982.239 1414.67 982.346C1415.24 982.446 1415.8 982.657 1416.33 982.976C1416.87 983.296 1417.32 983.778 1417.67 984.423C1418.03 985.068 1418.2 985.933 1418.2 987.016V996H1416.11V994.153H1416C1415.86 994.449 1415.62 994.766 1415.29 995.103C1414.96 995.441 1414.52 995.728 1413.97 995.964C1413.42 996.201 1412.75 996.32 1411.95 996.32ZM1412.27 994.438C1413.1 994.438 1413.8 994.275 1414.37 993.949C1414.94 993.624 1415.37 993.203 1415.66 992.689C1415.96 992.174 1416.11 991.632 1416.11 991.064V989.146C1416.02 989.253 1415.82 989.35 1415.52 989.439C1415.23 989.522 1414.88 989.596 1414.49 989.661C1414.11 989.72 1413.73 989.774 1413.36 989.821C1413 989.862 1412.71 989.898 1412.49 989.928C1411.94 989.999 1411.43 990.114 1410.96 990.274C1410.49 990.428 1410.11 990.661 1409.82 990.975C1409.54 991.283 1409.4 991.703 1409.4 992.236C1409.4 992.964 1409.67 993.514 1410.2 993.887C1410.75 994.254 1411.44 994.438 1412.27 994.438ZM1427.96 982.364V984.139H1420.89V982.364H1427.96ZM1422.95 979.097H1425.05V992.094C1425.05 992.686 1425.13 993.129 1425.3 993.425C1425.48 993.715 1425.71 993.911 1425.98 994.011C1426.26 994.106 1426.55 994.153 1426.86 994.153C1427.09 994.153 1427.28 994.142 1427.42 994.118C1427.57 994.088 1427.69 994.065 1427.78 994.047L1428.21 995.929C1428.06 995.982 1427.87 996.036 1427.61 996.089C1427.36 996.148 1427.03 996.178 1426.64 996.178C1426.05 996.178 1425.47 996.05 1424.9 995.796C1424.34 995.541 1423.87 995.154 1423.5 994.633C1423.13 994.112 1422.95 993.455 1422.95 992.662V979.097ZM1435.12 996.32C1434.26 996.32 1433.47 996.157 1432.77 995.831C1432.06 995.5 1431.51 995.023 1431.09 994.402C1430.68 993.775 1430.47 993.017 1430.47 992.129C1430.47 991.348 1430.62 990.715 1430.93 990.229C1431.24 989.738 1431.65 989.353 1432.17 989.075C1432.68 988.797 1433.25 988.59 1433.87 988.454C1434.5 988.312 1435.13 988.199 1435.76 988.116C1436.59 988.01 1437.26 987.93 1437.78 987.877C1438.3 987.818 1438.68 987.72 1438.91 987.584C1439.16 987.448 1439.28 987.211 1439.28 986.874V986.803C1439.28 985.927 1439.04 985.246 1438.56 984.761C1438.08 984.275 1437.36 984.033 1436.4 984.033C1435.4 984.033 1434.62 984.252 1434.05 984.69C1433.48 985.128 1433.08 985.595 1432.85 986.092L1430.86 985.382C1431.22 984.554 1431.69 983.908 1432.28 983.447C1432.88 982.979 1433.53 982.654 1434.23 982.47C1434.94 982.281 1435.64 982.186 1436.33 982.186C1436.77 982.186 1437.27 982.239 1437.84 982.346C1438.41 982.446 1438.97 982.657 1439.5 982.976C1440.04 983.296 1440.48 983.778 1440.84 984.423C1441.19 985.068 1441.37 985.933 1441.37 987.016V996H1439.28V994.153H1439.17C1439.03 994.449 1438.79 994.766 1438.46 995.103C1438.13 995.441 1437.69 995.728 1437.14 995.964C1436.59 996.201 1435.91 996.32 1435.12 996.32ZM1435.44 994.438C1436.27 994.438 1436.97 994.275 1437.54 993.949C1438.11 993.624 1438.54 993.203 1438.83 992.689C1439.13 992.174 1439.28 991.632 1439.28 991.064V989.146C1439.19 989.253 1438.99 989.35 1438.69 989.439C1438.39 989.522 1438.05 989.596 1437.66 989.661C1437.28 989.72 1436.9 989.774 1436.53 989.821C1436.17 989.862 1435.88 989.898 1435.65 989.928C1435.11 989.999 1434.6 990.114 1434.13 990.274C1433.66 990.428 1433.28 990.661 1432.99 990.975C1432.71 991.283 1432.56 991.703 1432.56 992.236C1432.56 992.964 1432.83 993.514 1433.37 993.887C1433.92 994.254 1434.61 994.438 1435.44 994.438ZM1445.48 996V977.818H1447.58V984.53H1447.75C1447.91 984.293 1448.12 983.991 1448.39 983.624C1448.67 983.251 1449.07 982.92 1449.58 982.63C1450.1 982.334 1450.81 982.186 1451.69 982.186C1452.84 982.186 1453.85 982.473 1454.73 983.047C1455.61 983.621 1456.29 984.435 1456.78 985.489C1457.27 986.542 1457.52 987.785 1457.52 989.217C1457.52 990.661 1457.27 991.913 1456.78 992.973C1456.29 994.026 1455.61 994.843 1454.74 995.423C1453.87 995.997 1452.87 996.284 1451.73 996.284C1450.85 996.284 1450.15 996.139 1449.63 995.849C1449.1 995.553 1448.69 995.219 1448.41 994.846C1448.13 994.467 1447.91 994.153 1447.75 993.905H1447.5V996H1445.48ZM1447.54 989.182C1447.54 990.212 1447.69 991.12 1447.99 991.907C1448.29 992.689 1448.74 993.301 1449.32 993.745C1449.9 994.183 1450.61 994.402 1451.45 994.402C1452.32 994.402 1453.05 994.171 1453.64 993.71C1454.23 993.242 1454.67 992.615 1454.97 991.827C1455.27 991.034 1455.42 990.152 1455.42 989.182C1455.42 988.223 1455.28 987.359 1454.98 986.589C1454.69 985.814 1454.25 985.202 1453.66 984.752C1453.07 984.296 1452.33 984.068 1451.45 984.068C1450.59 984.068 1449.88 984.284 1449.3 984.716C1448.72 985.142 1448.28 985.74 1447.98 986.51C1447.69 987.273 1447.54 988.164 1447.54 989.182ZM1464.74 996.32C1463.87 996.32 1463.09 996.157 1462.38 995.831C1461.68 995.5 1461.12 995.023 1460.71 994.402C1460.29 993.775 1460.08 993.017 1460.08 992.129C1460.08 991.348 1460.24 990.715 1460.55 990.229C1460.85 989.738 1461.26 989.353 1461.78 989.075C1462.29 988.797 1462.86 988.59 1463.48 988.454C1464.11 988.312 1464.74 988.199 1465.38 988.116C1466.2 988.01 1466.88 987.93 1467.39 987.877C1467.91 987.818 1468.29 987.72 1468.53 987.584C1468.77 987.448 1468.89 987.211 1468.89 986.874V986.803C1468.89 985.927 1468.65 985.246 1468.17 984.761C1467.7 984.275 1466.98 984.033 1466.01 984.033C1465.01 984.033 1464.23 984.252 1463.66 984.69C1463.09 985.128 1462.69 985.595 1462.46 986.092L1460.47 985.382C1460.83 984.554 1461.3 983.908 1461.9 983.447C1462.49 982.979 1463.14 982.654 1463.85 982.47C1464.56 982.281 1465.26 982.186 1465.94 982.186C1466.38 982.186 1466.88 982.239 1467.45 982.346C1468.03 982.446 1468.58 982.657 1469.11 982.976C1469.65 983.296 1470.1 983.778 1470.45 984.423C1470.81 985.068 1470.99 985.933 1470.99 987.016V996H1468.89V994.153H1468.78C1468.64 994.449 1468.41 994.766 1468.07 995.103C1467.74 995.441 1467.3 995.728 1466.75 995.964C1466.2 996.201 1465.53 996.32 1464.74 996.32ZM1465.06 994.438C1465.88 994.438 1466.58 994.275 1467.15 993.949C1467.72 993.624 1468.16 993.203 1468.45 992.689C1468.74 992.174 1468.89 991.632 1468.89 991.064V989.146C1468.8 989.253 1468.61 989.35 1468.3 989.439C1468.01 989.522 1467.67 989.596 1467.28 989.661C1466.89 989.72 1466.51 989.774 1466.15 989.821C1465.79 989.862 1465.49 989.898 1465.27 989.928C1464.72 989.999 1464.22 990.114 1463.74 990.274C1463.27 990.428 1462.9 990.661 1462.61 990.975C1462.32 991.283 1462.18 991.703 1462.18 992.236C1462.18 992.964 1462.45 993.514 1462.99 993.887C1463.53 994.254 1464.22 994.438 1465.06 994.438ZM1484.47 985.418L1482.59 985.95C1482.47 985.637 1482.29 985.332 1482.06 985.036C1481.84 984.734 1481.53 984.485 1481.14 984.29C1480.75 984.095 1480.25 983.997 1479.64 983.997C1478.81 983.997 1478.11 984.19 1477.55 984.574C1477 984.953 1476.73 985.435 1476.73 986.021C1476.73 986.542 1476.92 986.953 1477.3 987.255C1477.67 987.557 1478.27 987.809 1479.07 988.01L1481.1 988.507C1482.31 988.803 1483.22 989.256 1483.82 989.865C1484.42 990.469 1484.72 991.247 1484.72 992.2C1484.72 992.982 1484.49 993.68 1484.04 994.295C1483.6 994.911 1482.98 995.396 1482.18 995.751C1481.38 996.107 1480.45 996.284 1479.39 996.284C1478 996.284 1476.85 995.982 1475.94 995.379C1475.03 994.775 1474.45 993.893 1474.21 992.733L1476.2 992.236C1476.38 992.97 1476.74 993.52 1477.27 993.887C1477.8 994.254 1478.5 994.438 1479.36 994.438C1480.33 994.438 1481.11 994.23 1481.68 993.816C1482.26 993.396 1482.55 992.893 1482.55 992.307C1482.55 991.833 1482.39 991.437 1482.05 991.117C1481.72 990.792 1481.21 990.549 1480.53 990.389L1478.25 989.857C1477.01 989.561 1476.09 989.102 1475.5 988.48C1474.92 987.853 1474.63 987.069 1474.63 986.128C1474.63 985.358 1474.85 984.678 1475.28 984.086C1475.72 983.494 1476.31 983.029 1477.07 982.692C1477.82 982.355 1478.68 982.186 1479.64 982.186C1480.99 982.186 1482.05 982.482 1482.82 983.074C1483.59 983.666 1484.14 984.447 1484.47 985.418ZM1493.59 996.284C1492.28 996.284 1491.14 995.994 1490.19 995.414C1489.24 994.828 1488.51 994.011 1488 992.964C1487.49 991.91 1487.23 990.685 1487.23 989.288C1487.23 987.892 1487.49 986.661 1488 985.595C1488.51 984.524 1489.23 983.689 1490.14 983.092C1491.07 982.488 1492.14 982.186 1493.38 982.186C1494.09 982.186 1494.79 982.304 1495.48 982.541C1496.17 982.778 1496.8 983.163 1497.37 983.695C1497.94 984.222 1498.39 984.92 1498.73 985.79C1499.07 986.661 1499.24 987.732 1499.24 989.004V989.892H1488.72V988.081H1497.1C1497.1 987.312 1496.95 986.625 1496.64 986.021C1496.34 985.418 1495.91 984.941 1495.35 984.592C1494.79 984.243 1494.13 984.068 1493.38 984.068C1492.54 984.068 1491.82 984.275 1491.21 984.69C1490.61 985.098 1490.14 985.631 1489.82 986.288C1489.49 986.945 1489.33 987.649 1489.33 988.401V989.608C1489.33 990.638 1489.51 991.511 1489.86 992.227C1490.22 992.937 1490.72 993.479 1491.36 993.852C1492 994.219 1492.74 994.402 1493.59 994.402C1494.14 994.402 1494.64 994.325 1495.08 994.171C1495.53 994.011 1495.92 993.775 1496.24 993.461C1496.57 993.141 1496.82 992.745 1497 992.271L1499.02 992.839C1498.81 993.526 1498.45 994.13 1497.95 994.651C1497.44 995.165 1496.82 995.568 1496.08 995.858C1495.34 996.142 1494.51 996.284 1493.59 996.284Z" fill="#03031C"/>
+<path d="M412.802 293H407.191V274.818H413.051C414.815 274.818 416.324 275.182 417.579 275.91C418.833 276.632 419.795 277.671 420.464 279.026C421.133 280.376 421.467 281.991 421.467 283.874C421.467 285.768 421.13 287.398 420.455 288.765C419.78 290.127 418.798 291.174 417.508 291.908C416.217 292.636 414.649 293 412.802 293ZM409.393 291.047H412.66C414.164 291.047 415.409 290.757 416.398 290.177C417.386 289.597 418.123 288.771 418.608 287.7C419.094 286.629 419.336 285.353 419.336 283.874C419.336 282.406 419.097 281.142 418.617 280.083C418.138 279.017 417.422 278.201 416.469 277.632C415.516 277.058 414.329 276.771 412.909 276.771H409.393V291.047ZM430.593 293.284C429.28 293.284 428.146 292.994 427.193 292.414C426.246 291.828 425.515 291.011 425 289.964C424.491 288.91 424.237 287.685 424.237 286.288C424.237 284.892 424.491 283.661 425 282.595C425.515 281.524 426.231 280.689 427.149 280.092C428.072 279.488 429.149 279.186 430.38 279.186C431.091 279.186 431.792 279.304 432.484 279.541C433.177 279.778 433.807 280.163 434.375 280.695C434.944 281.222 435.396 281.92 435.734 282.79C436.071 283.661 436.24 284.732 436.24 286.004V286.892H425.728V285.081H434.109C434.109 284.312 433.955 283.625 433.647 283.021C433.346 282.418 432.914 281.941 432.351 281.592C431.795 281.243 431.138 281.068 430.38 281.068C429.546 281.068 428.824 281.275 428.214 281.69C427.61 282.098 427.146 282.631 426.82 283.288C426.495 283.945 426.332 284.649 426.332 285.401V286.608C426.332 287.638 426.51 288.511 426.865 289.227C427.226 289.937 427.726 290.479 428.365 290.852C429.004 291.219 429.747 291.402 430.593 291.402C431.144 291.402 431.641 291.325 432.085 291.171C432.535 291.011 432.922 290.775 433.248 290.461C433.573 290.141 433.825 289.745 434.003 289.271L436.027 289.839C435.814 290.526 435.456 291.13 434.952 291.651C434.449 292.165 433.828 292.568 433.088 292.858C432.348 293.142 431.517 293.284 430.593 293.284ZM450.162 279.364L445.12 293H442.989L437.947 279.364H440.219L443.983 290.23H444.125L447.89 279.364H450.162Z" fill="#03031C"/>
+<path d="M534.147 293V274.818H540.29C541.716 274.818 542.882 275.076 543.788 275.591C544.699 276.1 545.374 276.789 545.812 277.659C546.25 278.529 546.469 279.5 546.469 280.571C546.469 281.642 546.25 282.616 545.812 283.492C545.38 284.368 544.711 285.066 543.806 285.587C542.9 286.102 541.74 286.359 540.326 286.359H535.922V284.406H540.254C541.231 284.406 542.015 284.238 542.607 283.9C543.199 283.563 543.628 283.107 543.894 282.533C544.167 281.953 544.303 281.299 544.303 280.571C544.303 279.843 544.167 279.192 543.894 278.618C543.628 278.044 543.196 277.594 542.598 277.268C542 276.937 541.207 276.771 540.219 276.771H536.348V293H534.147ZM550.016 274.818H552.644L558.822 289.911H559.036L565.215 274.818H567.842V293H565.783V279.186H565.605L559.923 293H557.935L552.253 279.186H552.075V293H550.016V274.818Z" fill="#03031C"/>
+<path d="M665.265 287.318H667.68L669.704 289.982L670.237 290.692L673.255 294.705H670.841L668.852 292.041L668.355 291.366L665.265 287.318ZM674.001 283.909C674.001 285.827 673.655 287.484 672.962 288.881C672.27 290.277 671.32 291.355 670.113 292.112C668.905 292.87 667.526 293.249 665.976 293.249C664.425 293.249 663.046 292.87 661.838 292.112C660.631 291.355 659.681 290.277 658.989 288.881C658.296 287.484 657.95 285.827 657.95 283.909C657.95 281.991 658.296 280.334 658.989 278.938C659.681 277.541 660.631 276.464 661.838 275.706C663.046 274.948 664.425 274.57 665.976 274.57C667.526 274.57 668.905 274.948 670.113 275.706C671.32 276.464 672.27 277.541 672.962 278.938C673.655 280.334 674.001 281.991 674.001 283.909ZM671.87 283.909C671.87 282.335 671.607 281.006 671.08 279.923C670.559 278.84 669.852 278.02 668.958 277.464C668.071 276.907 667.076 276.629 665.976 276.629C664.875 276.629 663.877 276.907 662.984 277.464C662.096 278.02 661.389 278.84 660.862 279.923C660.341 281.006 660.081 282.335 660.081 283.909C660.081 285.483 660.341 286.812 660.862 287.895C661.389 288.978 662.096 289.798 662.984 290.354C663.877 290.911 664.875 291.189 665.976 291.189C667.076 291.189 668.071 290.911 668.958 290.354C669.852 289.798 670.559 288.978 671.08 287.895C671.607 286.812 671.87 285.483 671.87 283.909ZM677.594 293H675.286L681.962 274.818H684.235L690.911 293H688.603L683.17 277.695H683.028L677.594 293ZM678.447 285.898H687.751V287.851H678.447V285.898Z" fill="#03031C"/>
+<g filter="url(#filter7_bd_12_348)">
+<rect x="830" y="59" width="568" height="281" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="830.5" y="59.5" width="567" height="280" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M929.462 209.58C938.757 209.58 946.292 200.272 946.292 188.79C946.292 177.308 938.757 168 929.462 168C920.167 168 912.632 177.308 912.632 188.79C912.632 200.272 920.167 209.58 929.462 209.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M942.134 202.848C942.134 202.848 953.111 208.919 957.717 212.696C958.809 213.595 959.747 214.67 960.493 215.878C961.852 218.146 962.556 220.754 962.527 223.406V239.017C953.389 247.317 941.547 251.921 929.264 251.952C916.968 251.99 905.102 247.376 896.001 239.017V223.406C895.972 220.754 896.676 218.146 898.035 215.878C898.781 214.67 899.719 213.595 900.811 212.696C905.417 208.958 916.412 202.452 916.412 202.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M905.699 221.856C905.29 222.577 905.086 223.394 905.11 224.22V235.077C911.977 240.12 920.308 242.844 928.868 242.844C937.427 242.844 945.759 240.12 952.626 235.077V224.295C952.653 223.471 952.454 222.654 952.049 221.932C945.364 228.252 937.423 232.043 928.868 232.043C920.312 232.043 912.372 228.226 905.699 221.856Z" fill="#FFC743"/>
+<path d="M1052.46 209.58C1061.76 209.58 1069.29 200.272 1069.29 188.79C1069.29 177.308 1061.76 168 1052.46 168C1043.17 168 1035.63 177.308 1035.63 188.79C1035.63 200.272 1043.17 209.58 1052.46 209.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1065.13 202.848C1065.13 202.848 1076.11 208.919 1080.72 212.696C1081.81 213.595 1082.75 214.67 1083.49 215.878C1084.85 218.146 1085.56 220.754 1085.53 223.406V239.017C1076.39 247.317 1064.55 251.921 1052.26 251.952C1039.97 251.99 1028.1 247.376 1019 239.017V223.406C1018.97 220.754 1019.68 218.146 1021.04 215.878C1021.78 214.67 1022.72 213.595 1023.81 212.696C1028.42 208.958 1039.41 202.452 1039.41 202.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1028.7 221.856C1028.29 222.577 1028.09 223.394 1028.11 224.22V235.077C1034.98 240.12 1043.31 242.844 1051.87 242.844C1060.43 242.844 1068.76 240.12 1075.63 235.077V224.295C1075.65 223.471 1075.45 222.654 1075.05 221.932C1068.36 228.252 1060.42 232.043 1051.87 232.043C1043.31 232.043 1035.37 228.226 1028.7 221.856Z" fill="#FFC743"/>
+<path d="M1175.46 209.58C1184.76 209.58 1192.29 200.272 1192.29 188.79C1192.29 177.308 1184.76 168 1175.46 168C1166.17 168 1158.63 177.308 1158.63 188.79C1158.63 200.272 1166.17 209.58 1175.46 209.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1188.13 202.848C1188.13 202.848 1199.11 208.919 1203.72 212.696C1204.81 213.595 1205.75 214.67 1206.49 215.878C1207.85 218.146 1208.56 220.754 1208.53 223.406V239.017C1199.39 247.317 1187.55 251.921 1175.26 251.952C1162.97 251.99 1151.1 247.376 1142 239.017V223.406C1141.97 220.754 1142.68 218.146 1144.04 215.878C1144.78 214.67 1145.72 213.595 1146.81 212.696C1151.42 208.958 1162.41 202.452 1162.41 202.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1151.7 221.856C1151.29 222.577 1151.09 223.394 1151.11 224.22V235.077C1157.98 240.12 1166.31 242.844 1174.87 242.844C1183.43 242.844 1191.76 240.12 1198.63 235.077V224.295C1198.65 223.471 1198.45 222.654 1198.05 221.932C1191.36 228.252 1183.42 232.043 1174.87 232.043C1166.31 232.043 1158.37 228.226 1151.7 221.856Z" fill="#FFC743"/>
+<path d="M1298.46 209.58C1307.76 209.58 1315.29 200.272 1315.29 188.79C1315.29 177.308 1307.76 168 1298.46 168C1289.17 168 1281.63 177.308 1281.63 188.79C1281.63 200.272 1289.17 209.58 1298.46 209.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1311.13 202.848C1311.13 202.848 1322.11 208.919 1326.72 212.696C1327.81 213.595 1328.75 214.67 1329.49 215.878C1330.85 218.146 1331.56 220.754 1331.53 223.406V239.017C1322.39 247.317 1310.55 251.921 1298.26 251.952C1285.97 251.99 1274.1 247.376 1265 239.017V223.406C1264.97 220.754 1265.68 218.146 1267.04 215.878C1267.78 214.67 1268.72 213.595 1269.81 212.696C1274.42 208.958 1285.41 202.452 1285.41 202.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1274.7 221.856C1274.29 222.577 1274.09 223.394 1274.11 224.22V235.077C1280.98 240.12 1289.31 242.844 1297.87 242.844C1306.43 242.844 1314.76 240.12 1321.63 235.077V224.295C1321.65 223.471 1321.45 222.654 1321.05 221.932C1314.36 228.252 1306.42 232.043 1297.87 232.043C1289.31 232.043 1281.37 228.226 1274.7 221.856Z" fill="#FFC743"/>
+<path d="M1025.25 104.182H1029.86V118.351C1029.86 119.942 1029.48 121.334 1028.72 122.527C1027.97 123.72 1026.92 124.651 1025.56 125.318C1024.2 125.979 1022.62 126.309 1020.82 126.309C1019.01 126.309 1017.42 125.979 1016.07 125.318C1014.71 124.651 1013.66 123.72 1012.9 122.527C1012.15 121.334 1011.77 119.942 1011.77 118.351V104.182H1016.39V117.957C1016.39 118.788 1016.57 119.526 1016.93 120.173C1017.3 120.819 1017.82 121.327 1018.48 121.696C1019.15 122.065 1019.93 122.25 1020.82 122.25C1021.71 122.25 1022.49 122.065 1023.15 121.696C1023.82 121.327 1024.33 120.819 1024.7 120.173C1025.07 119.526 1025.25 118.788 1025.25 117.957V104.182ZM1047.19 114.303L1043.03 114.558C1042.96 114.203 1042.81 113.884 1042.57 113.599C1042.34 113.308 1042.03 113.077 1041.65 112.907C1041.27 112.729 1040.82 112.641 1040.3 112.641C1039.59 112.641 1039 112.79 1038.52 113.088C1038.03 113.379 1037.79 113.77 1037.79 114.26C1037.79 114.651 1037.95 114.981 1038.26 115.251C1038.57 115.521 1039.11 115.737 1039.87 115.901L1042.83 116.497C1044.42 116.824 1045.61 117.349 1046.39 118.074C1047.17 118.798 1047.56 119.75 1047.56 120.929C1047.56 122.001 1047.24 122.942 1046.61 123.752C1045.99 124.562 1045.13 125.194 1044.03 125.648C1042.95 126.096 1041.69 126.32 1040.27 126.32C1038.11 126.32 1036.38 125.869 1035.1 124.967C1033.82 124.058 1033.07 122.822 1032.85 121.259L1037.31 121.025C1037.45 121.685 1037.77 122.19 1038.29 122.538C1038.81 122.879 1039.47 123.049 1040.28 123.049C1041.08 123.049 1041.72 122.896 1042.2 122.591C1042.69 122.278 1042.94 121.877 1042.95 121.387C1042.94 120.975 1042.77 120.638 1042.43 120.375C1042.08 120.105 1041.56 119.899 1040.85 119.757L1038.02 119.192C1036.42 118.873 1035.23 118.319 1034.45 117.531C1033.67 116.742 1033.29 115.737 1033.29 114.516C1033.29 113.464 1033.57 112.559 1034.14 111.799C1034.71 111.039 1035.52 110.453 1036.56 110.041C1037.6 109.629 1038.82 109.423 1040.22 109.423C1042.29 109.423 1043.91 109.86 1045.1 110.734C1046.29 111.607 1046.99 112.797 1047.19 114.303ZM1057.88 126.32C1056.19 126.32 1054.74 125.979 1053.53 125.297C1052.32 124.608 1051.39 123.635 1050.74 122.378C1050.08 121.114 1049.76 119.619 1049.76 117.893C1049.76 116.21 1050.08 114.732 1050.74 113.461C1051.39 112.19 1052.31 111.199 1053.5 110.489C1054.69 109.778 1056.09 109.423 1057.69 109.423C1058.77 109.423 1059.78 109.597 1060.71 109.945C1061.65 110.286 1062.46 110.801 1063.16 111.49C1063.86 112.179 1064.41 113.045 1064.8 114.089C1065.19 115.126 1065.39 116.341 1065.39 117.733V118.979H1051.57V116.167H1061.11C1061.11 115.513 1060.97 114.935 1060.69 114.43C1060.4 113.926 1060.01 113.532 1059.51 113.248C1059.01 112.957 1058.43 112.811 1057.77 112.811C1057.08 112.811 1056.47 112.971 1055.94 113.29C1055.41 113.603 1055 114.026 1054.7 114.558C1054.4 115.084 1054.25 115.67 1054.24 116.316V118.99C1054.24 119.8 1054.39 120.499 1054.69 121.089C1055 121.678 1055.43 122.133 1055.98 122.452C1056.53 122.772 1057.19 122.932 1057.95 122.932C1058.45 122.932 1058.92 122.861 1059.34 122.719C1059.75 122.577 1060.11 122.364 1060.41 122.08C1060.71 121.795 1060.94 121.447 1061.09 121.036L1065.29 121.312C1065.08 122.321 1064.64 123.202 1063.98 123.955C1063.33 124.7 1062.48 125.283 1061.44 125.702C1060.41 126.114 1059.23 126.32 1057.88 126.32ZM1068.35 126V109.636H1072.75V112.491H1072.92C1073.22 111.476 1073.72 110.709 1074.42 110.19C1075.12 109.665 1075.93 109.402 1076.85 109.402C1077.08 109.402 1077.32 109.416 1077.58 109.445C1077.85 109.473 1078.08 109.512 1078.28 109.562V113.589C1078.06 113.525 1077.77 113.468 1077.39 113.418C1077.02 113.369 1076.67 113.344 1076.36 113.344C1075.69 113.344 1075.1 113.489 1074.57 113.781C1074.05 114.065 1073.64 114.462 1073.33 114.974C1073.04 115.485 1072.89 116.075 1072.89 116.742V126H1068.35ZM1094.24 114.303L1090.08 114.558C1090.01 114.203 1089.86 113.884 1089.63 113.599C1089.39 113.308 1089.08 113.077 1088.7 112.907C1088.32 112.729 1087.87 112.641 1087.35 112.641C1086.64 112.641 1086.05 112.79 1085.57 113.088C1085.08 113.379 1084.84 113.77 1084.84 114.26C1084.84 114.651 1085 114.981 1085.31 115.251C1085.62 115.521 1086.16 115.737 1086.92 115.901L1089.88 116.497C1091.47 116.824 1092.66 117.349 1093.44 118.074C1094.22 118.798 1094.61 119.75 1094.61 120.929C1094.61 122.001 1094.3 122.942 1093.66 123.752C1093.04 124.562 1092.18 125.194 1091.09 125.648C1090 126.096 1088.75 126.32 1087.32 126.32C1085.16 126.32 1083.43 125.869 1082.15 124.967C1080.87 124.058 1080.12 122.822 1079.9 121.259L1084.36 121.025C1084.5 121.685 1084.82 122.19 1085.34 122.538C1085.86 122.879 1086.53 123.049 1087.34 123.049C1088.13 123.049 1088.77 122.896 1089.25 122.591C1089.74 122.278 1089.99 121.877 1090 121.387C1089.99 120.975 1089.82 120.638 1089.48 120.375C1089.14 120.105 1088.61 119.899 1087.9 119.757L1085.07 119.192C1083.47 118.873 1082.28 118.319 1081.5 117.531C1080.72 116.742 1080.34 115.737 1080.34 114.516C1080.34 113.464 1080.62 112.559 1081.19 111.799C1081.76 111.039 1082.57 110.453 1083.61 110.041C1084.65 109.629 1085.87 109.423 1087.27 109.423C1089.34 109.423 1090.96 109.86 1092.15 110.734C1093.34 111.607 1094.04 112.797 1094.24 114.303ZM1104.41 126V109.636H1108.95V126H1104.41ZM1106.69 107.527C1106.02 107.527 1105.44 107.303 1104.96 106.856C1104.48 106.401 1104.24 105.858 1104.24 105.226C1104.24 104.601 1104.48 104.065 1104.96 103.617C1105.44 103.163 1106.02 102.935 1106.69 102.935C1107.37 102.935 1107.94 103.163 1108.42 103.617C1108.9 104.065 1109.14 104.601 1109.14 105.226C1109.14 105.858 1108.9 106.401 1108.42 106.856C1107.94 107.303 1107.37 107.527 1106.69 107.527ZM1117.12 116.54V126H1112.59V109.636H1116.91V112.523H1117.1C1117.47 111.572 1118.07 110.819 1118.93 110.265C1119.78 109.704 1120.81 109.423 1122.03 109.423C1123.16 109.423 1124.15 109.672 1125 110.169C1125.84 110.666 1126.5 111.376 1126.97 112.3C1127.44 113.216 1127.67 114.31 1127.67 115.581V126H1123.13V116.391C1123.14 115.389 1122.88 114.608 1122.37 114.047C1121.85 113.479 1121.13 113.195 1120.22 113.195C1119.61 113.195 1119.07 113.326 1118.61 113.589C1118.14 113.852 1117.78 114.235 1117.52 114.739C1117.26 115.237 1117.13 115.837 1117.12 116.54ZM1158.33 115.091C1158.33 117.47 1157.88 119.494 1156.97 121.163C1156.08 122.832 1154.86 124.107 1153.31 124.988C1151.77 125.862 1150.03 126.298 1148.11 126.298C1146.17 126.298 1144.43 125.858 1142.89 124.977C1141.35 124.097 1140.13 122.822 1139.24 121.153C1138.34 119.484 1137.89 117.463 1137.89 115.091C1137.89 112.712 1138.34 110.688 1139.24 109.018C1140.13 107.349 1141.35 106.078 1142.89 105.205C1144.43 104.324 1146.17 103.884 1148.11 103.884C1150.03 103.884 1151.77 104.324 1153.31 105.205C1154.86 106.078 1156.08 107.349 1156.97 109.018C1157.88 110.688 1158.33 112.712 1158.33 115.091ZM1153.65 115.091C1153.65 113.55 1153.42 112.25 1152.96 111.192C1152.5 110.134 1151.86 109.331 1151.03 108.784C1150.2 108.237 1149.23 107.964 1148.11 107.964C1147 107.964 1146.02 108.237 1145.19 108.784C1144.36 109.331 1143.71 110.134 1143.25 111.192C1142.8 112.25 1142.57 113.55 1142.57 115.091C1142.57 116.632 1142.8 117.932 1143.25 118.99C1143.71 120.048 1144.36 120.851 1145.19 121.398C1146.02 121.945 1147 122.218 1148.11 122.218C1149.23 122.218 1150.2 121.945 1151.03 121.398C1151.86 120.851 1152.5 120.048 1152.96 118.99C1153.42 117.932 1153.65 116.632 1153.65 115.091ZM1161.66 126V109.636H1166.06V112.491H1166.23C1166.53 111.476 1167.03 110.709 1167.73 110.19C1168.43 109.665 1169.24 109.402 1170.16 109.402C1170.39 109.402 1170.63 109.416 1170.9 109.445C1171.16 109.473 1171.39 109.512 1171.59 109.562V113.589C1171.37 113.525 1171.08 113.468 1170.7 113.418C1170.33 113.369 1169.98 113.344 1169.67 113.344C1169 113.344 1168.41 113.489 1167.88 113.781C1167.36 114.065 1166.95 114.462 1166.64 114.974C1166.35 115.485 1166.2 116.075 1166.2 116.742V126H1161.66ZM1180.54 132.477C1179.07 132.477 1177.81 132.275 1176.76 131.87C1175.72 131.472 1174.89 130.929 1174.27 130.24C1173.65 129.551 1173.25 128.777 1173.07 127.918L1177.26 127.353C1177.39 127.68 1177.59 127.985 1177.87 128.269C1178.15 128.553 1178.51 128.781 1178.97 128.951C1179.43 129.129 1179.99 129.217 1180.65 129.217C1181.64 129.217 1182.45 128.976 1183.09 128.493C1183.74 128.017 1184.06 127.218 1184.06 126.096V123.102H1183.87C1183.67 123.557 1183.37 123.987 1182.97 124.391C1182.58 124.796 1182.06 125.126 1181.44 125.382C1180.81 125.638 1180.07 125.766 1179.2 125.766C1177.97 125.766 1176.85 125.482 1175.85 124.913C1174.84 124.338 1174.05 123.461 1173.45 122.282C1172.86 121.096 1172.57 119.597 1172.57 117.786C1172.57 115.933 1172.87 114.384 1173.47 113.141C1174.07 111.898 1174.88 110.968 1175.88 110.35C1176.89 109.732 1177.99 109.423 1179.19 109.423C1180.11 109.423 1180.87 109.58 1181.49 109.892C1182.11 110.197 1182.61 110.581 1182.98 111.043C1183.37 111.497 1183.66 111.945 1183.87 112.385H1184.04V109.636H1188.55V126.16C1188.55 127.552 1188.2 128.717 1187.52 129.654C1186.84 130.592 1185.9 131.295 1184.69 131.763C1183.49 132.239 1182.11 132.477 1180.54 132.477ZM1180.64 122.357C1181.37 122.357 1181.99 122.175 1182.49 121.813C1183.01 121.444 1183.4 120.918 1183.67 120.237C1183.94 119.548 1184.08 118.724 1184.08 117.765C1184.08 116.806 1183.95 115.975 1183.68 115.272C1183.41 114.562 1183.02 114.011 1182.5 113.621C1181.99 113.23 1181.37 113.035 1180.64 113.035C1179.89 113.035 1179.27 113.237 1178.75 113.642C1178.24 114.04 1177.86 114.594 1177.59 115.304C1177.33 116.014 1177.2 116.835 1177.2 117.765C1177.2 118.71 1177.33 119.526 1177.59 120.215C1177.86 120.897 1178.25 121.426 1178.75 121.803C1179.27 122.172 1179.89 122.357 1180.64 122.357ZM1199.19 126V104.182H1207.92C1209.53 104.182 1210.87 104.42 1211.94 104.896C1213.01 105.371 1213.82 106.032 1214.36 106.877C1214.9 107.715 1215.17 108.681 1215.17 109.775C1215.17 110.627 1215 111.376 1214.65 112.023C1214.31 112.662 1213.84 113.187 1213.25 113.599C1212.66 114.004 1211.98 114.292 1211.22 114.462V114.675C1212.05 114.711 1212.83 114.945 1213.56 115.379C1214.29 115.812 1214.88 116.419 1215.34 117.2C1215.79 117.974 1216.02 118.898 1216.02 119.97C1216.02 121.128 1215.73 122.161 1215.15 123.07C1214.59 123.972 1213.75 124.686 1212.63 125.212C1211.51 125.737 1210.14 126 1208.51 126H1199.19ZM1203.8 122.229H1207.56C1208.84 122.229 1209.78 121.984 1210.37 121.494C1210.96 120.996 1211.26 120.336 1211.26 119.512C1211.26 118.908 1211.11 118.376 1210.82 117.914C1210.53 117.452 1210.11 117.09 1209.57 116.827C1209.04 116.565 1208.4 116.433 1207.67 116.433H1203.8V122.229ZM1203.8 113.312H1207.22C1207.85 113.312 1208.41 113.202 1208.9 112.982C1209.4 112.754 1209.79 112.435 1210.07 112.023C1210.36 111.611 1210.51 111.117 1210.51 110.542C1210.51 109.754 1210.23 109.118 1209.67 108.635C1209.11 108.152 1208.33 107.911 1207.3 107.911H1203.8V113.312Z" fill="#03031C"/>
+<path d="M913.802 293H908.191V274.818H914.051C915.815 274.818 917.324 275.182 918.579 275.91C919.833 276.632 920.795 277.671 921.464 279.026C922.133 280.376 922.467 281.991 922.467 283.874C922.467 285.768 922.13 287.398 921.455 288.765C920.78 290.127 919.798 291.174 918.508 291.908C917.217 292.636 915.649 293 913.802 293ZM910.393 291.047H913.66C915.164 291.047 916.409 290.757 917.398 290.177C918.386 289.597 919.123 288.771 919.608 287.7C920.094 286.629 920.336 285.353 920.336 283.874C920.336 282.406 920.097 281.142 919.617 280.083C919.138 279.017 918.422 278.201 917.469 277.632C916.516 277.058 915.329 276.771 913.909 276.771H910.393V291.047ZM931.593 293.284C930.28 293.284 929.146 292.994 928.193 292.414C927.246 291.828 926.515 291.011 926 289.964C925.491 288.91 925.237 287.685 925.237 286.288C925.237 284.892 925.491 283.661 926 282.595C926.515 281.524 927.231 280.689 928.149 280.092C929.072 279.488 930.149 279.186 931.38 279.186C932.091 279.186 932.792 279.304 933.484 279.541C934.177 279.778 934.807 280.163 935.375 280.695C935.944 281.222 936.396 281.92 936.734 282.79C937.071 283.661 937.24 284.732 937.24 286.004V286.892H926.728V285.081H935.109C935.109 284.312 934.955 283.625 934.647 283.021C934.346 282.418 933.914 281.941 933.351 281.592C932.795 281.243 932.138 281.068 931.38 281.068C930.546 281.068 929.824 281.275 929.214 281.69C928.61 282.098 928.146 282.631 927.82 283.288C927.495 283.945 927.332 284.649 927.332 285.401V286.608C927.332 287.638 927.51 288.511 927.865 289.227C928.226 289.937 928.726 290.479 929.365 290.852C930.004 291.219 930.747 291.402 931.593 291.402C932.144 291.402 932.641 291.325 933.085 291.171C933.535 291.011 933.922 290.775 934.248 290.461C934.573 290.141 934.825 289.745 935.003 289.271L937.027 289.839C936.814 290.526 936.456 291.13 935.952 291.651C935.449 292.165 934.828 292.568 934.088 292.858C933.348 293.142 932.517 293.284 931.593 293.284ZM951.162 279.364L946.12 293H943.989L938.947 279.364H941.219L944.983 290.23H945.125L948.89 279.364H951.162Z" fill="#03031C"/>
+<path d="M1036.8 293H1031.19V274.818H1037.05C1038.81 274.818 1040.32 275.182 1041.58 275.91C1042.83 276.632 1043.8 277.671 1044.46 279.026C1045.13 280.376 1045.47 281.991 1045.47 283.874C1045.47 285.768 1045.13 287.398 1044.45 288.765C1043.78 290.127 1042.8 291.174 1041.51 291.908C1040.22 292.636 1038.65 293 1036.8 293ZM1033.39 291.047H1036.66C1038.16 291.047 1039.41 290.757 1040.4 290.177C1041.39 289.597 1042.12 288.771 1042.61 287.7C1043.09 286.629 1043.34 285.353 1043.34 283.874C1043.34 282.406 1043.1 281.142 1042.62 280.083C1042.14 279.017 1041.42 278.201 1040.47 277.632C1039.52 277.058 1038.33 276.771 1036.91 276.771H1033.39V291.047ZM1054.59 293.284C1053.28 293.284 1052.15 292.994 1051.19 292.414C1050.25 291.828 1049.52 291.011 1049 289.964C1048.49 288.91 1048.24 287.685 1048.24 286.288C1048.24 284.892 1048.49 283.661 1049 282.595C1049.52 281.524 1050.23 280.689 1051.15 280.092C1052.07 279.488 1053.15 279.186 1054.38 279.186C1055.09 279.186 1055.79 279.304 1056.48 279.541C1057.18 279.778 1057.81 280.163 1058.38 280.695C1058.94 281.222 1059.4 281.92 1059.73 282.79C1060.07 283.661 1060.24 284.732 1060.24 286.004V286.892H1049.73V285.081H1058.11C1058.11 284.312 1057.96 283.625 1057.65 283.021C1057.35 282.418 1056.91 281.941 1056.35 281.592C1055.79 281.243 1055.14 281.068 1054.38 281.068C1053.55 281.068 1052.82 281.275 1052.21 281.69C1051.61 282.098 1051.15 282.631 1050.82 283.288C1050.49 283.945 1050.33 284.649 1050.33 285.401V286.608C1050.33 287.638 1050.51 288.511 1050.86 289.227C1051.23 289.937 1051.73 290.479 1052.37 290.852C1053 291.219 1053.75 291.402 1054.59 291.402C1055.14 291.402 1055.64 291.325 1056.08 291.171C1056.53 291.011 1056.92 290.775 1057.25 290.461C1057.57 290.141 1057.82 289.745 1058 289.271L1060.03 289.839C1059.81 290.526 1059.46 291.13 1058.95 291.651C1058.45 292.165 1057.83 292.568 1057.09 292.858C1056.35 293.142 1055.52 293.284 1054.59 293.284ZM1074.16 279.364L1069.12 293H1066.99L1061.95 279.364H1064.22L1067.98 290.23H1068.13L1071.89 279.364H1074.16Z" fill="#03031C"/>
+<path d="M1158.15 293V274.818H1164.29C1165.72 274.818 1166.88 275.076 1167.79 275.591C1168.7 276.1 1169.37 276.789 1169.81 277.659C1170.25 278.529 1170.47 279.5 1170.47 280.571C1170.47 281.642 1170.25 282.616 1169.81 283.492C1169.38 284.368 1168.71 285.066 1167.81 285.587C1166.9 286.102 1165.74 286.359 1164.33 286.359H1159.92V284.406H1164.25C1165.23 284.406 1166.02 284.238 1166.61 283.9C1167.2 283.563 1167.63 283.107 1167.89 282.533C1168.17 281.953 1168.3 281.299 1168.3 280.571C1168.3 279.843 1168.17 279.192 1167.89 278.618C1167.63 278.044 1167.2 277.594 1166.6 277.268C1166 276.937 1165.21 276.771 1164.22 276.771H1160.35V293H1158.15ZM1174.02 274.818H1176.64L1182.82 289.911H1183.04L1189.21 274.818H1191.84V293H1189.78V279.186H1189.61L1183.92 293H1181.93L1176.25 279.186H1176.08V293H1174.02V274.818Z" fill="#03031C"/>
+<path d="M1289.27 287.318H1291.68L1293.7 289.982L1294.24 290.692L1297.26 294.705H1294.84L1292.85 292.041L1292.35 291.366L1289.27 287.318ZM1298 283.909C1298 285.827 1297.65 287.484 1296.96 288.881C1296.27 290.277 1295.32 291.355 1294.11 292.112C1292.91 292.87 1291.53 293.249 1289.98 293.249C1288.42 293.249 1287.05 292.87 1285.84 292.112C1284.63 291.355 1283.68 290.277 1282.99 288.881C1282.3 287.484 1281.95 285.827 1281.95 283.909C1281.95 281.991 1282.3 280.334 1282.99 278.938C1283.68 277.541 1284.63 276.464 1285.84 275.706C1287.05 274.948 1288.42 274.57 1289.98 274.57C1291.53 274.57 1292.91 274.948 1294.11 275.706C1295.32 276.464 1296.27 277.541 1296.96 278.938C1297.65 280.334 1298 281.991 1298 283.909ZM1295.87 283.909C1295.87 282.335 1295.61 281.006 1295.08 279.923C1294.56 278.84 1293.85 278.02 1292.96 277.464C1292.07 276.907 1291.08 276.629 1289.98 276.629C1288.87 276.629 1287.88 276.907 1286.98 277.464C1286.1 278.02 1285.39 278.84 1284.86 279.923C1284.34 281.006 1284.08 282.335 1284.08 283.909C1284.08 285.483 1284.34 286.812 1284.86 287.895C1285.39 288.978 1286.1 289.798 1286.98 290.354C1287.88 290.911 1288.87 291.189 1289.98 291.189C1291.08 291.189 1292.07 290.911 1292.96 290.354C1293.85 289.798 1294.56 288.978 1295.08 287.895C1295.61 286.812 1295.87 285.483 1295.87 283.909ZM1301.59 293H1299.29L1305.96 274.818H1308.24L1314.91 293H1312.6L1307.17 277.695H1307.03L1301.59 293ZM1302.45 285.898H1311.75V287.851H1302.45V285.898Z" fill="#03031C"/>
+<path d="M405 641.5V707.5" stroke="white" stroke-width="2"/>
+<path d="M333.085 670V659.091H334.704V660.795H334.846C335.074 660.213 335.44 659.761 335.947 659.439C336.454 659.112 337.062 658.949 337.772 658.949C338.492 658.949 339.091 659.112 339.569 659.439C340.052 659.761 340.429 660.213 340.699 660.795H340.812C341.092 660.232 341.511 659.785 342.069 659.453C342.628 659.117 343.298 658.949 344.079 658.949C345.055 658.949 345.852 659.254 346.473 659.865C347.093 660.471 347.403 661.416 347.403 662.699V670H345.727V662.699C345.727 661.894 345.507 661.319 345.066 660.973C344.626 660.627 344.108 660.455 343.511 660.455C342.744 660.455 342.15 660.687 341.728 661.151C341.307 661.61 341.096 662.192 341.096 662.898V670H339.392V662.528C339.392 661.908 339.19 661.409 338.788 661.03C338.386 660.646 337.867 660.455 337.233 660.455C336.797 660.455 336.39 660.571 336.011 660.803C335.637 661.035 335.334 661.357 335.102 661.768C334.875 662.176 334.761 662.647 334.761 663.182V670H333.085ZM353.678 670.256C352.987 670.256 352.359 670.125 351.796 669.865C351.232 669.6 350.785 669.219 350.453 668.722C350.122 668.22 349.956 667.614 349.956 666.903C349.956 666.278 350.079 665.772 350.326 665.384C350.572 664.991 350.901 664.683 351.313 664.46C351.725 664.238 352.179 664.072 352.676 663.963C353.178 663.849 353.683 663.759 354.189 663.693C354.852 663.608 355.39 663.544 355.801 663.501C356.218 663.454 356.521 663.376 356.711 663.267C356.905 663.158 357.002 662.969 357.002 662.699V662.642C357.002 661.941 356.81 661.397 356.426 661.009C356.048 660.62 355.472 660.426 354.701 660.426C353.9 660.426 353.273 660.601 352.819 660.952C352.364 661.302 352.044 661.676 351.86 662.074L350.269 661.506C350.553 660.843 350.932 660.327 351.405 659.957C351.883 659.583 352.404 659.323 352.968 659.176C353.536 659.025 354.095 658.949 354.644 658.949C354.994 658.949 355.397 658.991 355.851 659.077C356.31 659.157 356.753 659.325 357.179 659.581C357.61 659.837 357.968 660.223 358.252 660.739C358.536 661.255 358.678 661.946 358.678 662.812V670H357.002V668.523H356.917C356.803 668.759 356.614 669.013 356.348 669.283C356.083 669.553 355.73 669.782 355.29 669.972C354.85 670.161 354.312 670.256 353.678 670.256ZM353.934 668.75C354.596 668.75 355.155 668.62 355.61 668.359C356.069 668.099 356.415 667.763 356.647 667.351C356.883 666.939 357.002 666.506 357.002 666.051V664.517C356.931 664.602 356.775 664.68 356.533 664.751C356.296 664.818 356.022 664.877 355.709 664.929C355.401 664.976 355.101 665.019 354.807 665.057C354.518 665.09 354.284 665.118 354.104 665.142C353.668 665.199 353.261 665.291 352.882 665.419C352.508 665.542 352.205 665.729 351.973 665.98C351.746 666.226 351.632 666.562 351.632 666.989C351.632 667.571 351.848 668.011 352.279 668.31C352.714 668.603 353.266 668.75 353.934 668.75ZM363.413 663.438V670H361.737V659.091H363.357V660.795H363.499C363.754 660.241 364.143 659.796 364.663 659.46C365.184 659.119 365.857 658.949 366.68 658.949C367.419 658.949 368.065 659.1 368.619 659.403C369.173 659.702 369.604 660.156 369.912 660.767C370.22 661.373 370.374 662.14 370.374 663.068V670H368.697V663.182C368.697 662.325 368.475 661.657 368.03 661.179C367.585 660.696 366.974 660.455 366.197 660.455C365.662 660.455 365.184 660.571 364.763 660.803C364.346 661.035 364.017 661.373 363.776 661.818C363.534 662.263 363.413 662.803 363.413 663.438ZM376.647 670.256C375.955 670.256 375.328 670.125 374.765 669.865C374.201 669.6 373.754 669.219 373.422 668.722C373.091 668.22 372.925 667.614 372.925 666.903C372.925 666.278 373.048 665.772 373.294 665.384C373.541 664.991 373.87 664.683 374.282 664.46C374.694 664.238 375.148 664.072 375.645 663.963C376.147 663.849 376.651 663.759 377.158 663.693C377.821 663.608 378.358 663.544 378.77 663.501C379.187 663.454 379.49 663.376 379.679 663.267C379.873 663.158 379.971 662.969 379.971 662.699V662.642C379.971 661.941 379.779 661.397 379.395 661.009C379.016 660.62 378.441 660.426 377.669 660.426C376.869 660.426 376.242 660.601 375.787 660.952C375.333 661.302 375.013 661.676 374.828 662.074L373.238 661.506C373.522 660.843 373.9 660.327 374.374 659.957C374.852 659.583 375.373 659.323 375.936 659.176C376.505 659.025 377.063 658.949 377.613 658.949C377.963 658.949 378.365 658.991 378.82 659.077C379.279 659.157 379.722 659.325 380.148 659.581C380.579 659.837 380.936 660.223 381.221 660.739C381.505 661.255 381.647 661.946 381.647 662.812V670H379.971V668.523H379.885C379.772 668.759 379.582 669.013 379.317 669.283C379.052 669.553 378.699 669.782 378.259 669.972C377.819 670.161 377.281 670.256 376.647 670.256ZM376.902 668.75C377.565 668.75 378.124 668.62 378.578 668.359C379.038 668.099 379.383 667.763 379.615 667.351C379.852 666.939 379.971 666.506 379.971 666.051V664.517C379.9 664.602 379.743 664.68 379.502 664.751C379.265 664.818 378.99 664.877 378.678 664.929C378.37 664.976 378.069 665.019 377.776 665.057C377.487 665.09 377.253 665.118 377.073 665.142C376.637 665.199 376.23 665.291 375.851 665.419C375.477 665.542 375.174 665.729 374.942 665.98C374.715 666.226 374.601 666.562 374.601 666.989C374.601 667.571 374.817 668.011 375.248 668.31C375.683 668.603 376.235 668.75 376.902 668.75ZM389.109 674.318C388.3 674.318 387.604 674.214 387.021 674.006C386.439 673.802 385.954 673.532 385.565 673.196C385.182 672.865 384.876 672.509 384.649 672.131L385.984 671.193C386.136 671.392 386.328 671.619 386.56 671.875C386.792 672.135 387.109 672.36 387.511 672.55C387.919 672.744 388.451 672.841 389.109 672.841C389.99 672.841 390.717 672.628 391.29 672.202C391.863 671.776 392.149 671.108 392.149 670.199V667.983H392.007C391.884 668.182 391.709 668.428 391.482 668.722C391.259 669.01 390.937 669.268 390.516 669.496C390.099 669.718 389.536 669.83 388.825 669.83C387.945 669.83 387.154 669.621 386.453 669.205C385.757 668.788 385.205 668.182 384.798 667.386C384.396 666.591 384.195 665.625 384.195 664.489C384.195 663.371 384.391 662.398 384.784 661.57C385.177 660.736 385.724 660.092 386.425 659.638C387.125 659.179 387.935 658.949 388.854 658.949C389.564 658.949 390.127 659.067 390.544 659.304C390.965 659.536 391.287 659.801 391.51 660.099C391.737 660.393 391.912 660.634 392.036 660.824H392.206V659.091H393.825V670.312C393.825 671.25 393.612 672.012 393.186 672.599C392.765 673.191 392.196 673.625 391.482 673.899C390.771 674.179 389.981 674.318 389.109 674.318ZM389.053 668.324C389.725 668.324 390.293 668.17 390.757 667.862C391.221 667.554 391.574 667.112 391.815 666.534C392.057 665.956 392.178 665.265 392.178 664.46C392.178 663.674 392.059 662.981 391.822 662.379C391.586 661.778 391.235 661.307 390.771 660.966C390.307 660.625 389.734 660.455 389.053 660.455C388.342 660.455 387.75 660.634 387.277 660.994C386.808 661.354 386.455 661.837 386.219 662.443C385.987 663.049 385.871 663.722 385.871 664.46C385.871 665.218 385.989 665.888 386.226 666.47C386.467 667.048 386.822 667.502 387.291 667.834C387.765 668.161 388.352 668.324 389.053 668.324ZM401.467 670.227C400.416 670.227 399.509 669.995 398.747 669.531C397.99 669.062 397.405 668.409 396.993 667.571C396.586 666.728 396.382 665.748 396.382 664.631C396.382 663.513 396.586 662.528 396.993 661.676C397.405 660.819 397.978 660.152 398.712 659.673C399.45 659.19 400.312 658.949 401.297 658.949C401.865 658.949 402.426 659.044 402.98 659.233C403.534 659.422 404.038 659.73 404.493 660.156C404.947 660.578 405.31 661.136 405.58 661.832C405.849 662.528 405.984 663.385 405.984 664.403V665.114H397.575V663.665H404.28C404.28 663.049 404.157 662.5 403.911 662.017C403.669 661.534 403.323 661.153 402.874 660.874C402.429 660.594 401.903 660.455 401.297 660.455C400.629 660.455 400.052 660.62 399.564 660.952C399.081 661.278 398.709 661.705 398.449 662.23C398.188 662.756 398.058 663.319 398.058 663.92V664.886C398.058 665.71 398.2 666.409 398.484 666.982C398.773 667.55 399.173 667.983 399.685 668.281C400.196 668.575 400.79 668.722 401.467 668.722C401.908 668.722 402.305 668.66 402.661 668.537C403.02 668.409 403.33 668.22 403.591 667.969C403.851 667.713 404.053 667.396 404.195 667.017L405.814 667.472C405.643 668.021 405.357 668.504 404.955 668.92C404.552 669.332 404.055 669.654 403.463 669.886C402.871 670.114 402.206 670.227 401.467 670.227ZM416.261 661.534L414.756 661.96C414.661 661.709 414.521 661.465 414.337 661.229C414.157 660.987 413.911 660.788 413.598 660.632C413.286 660.476 412.885 660.398 412.398 660.398C411.73 660.398 411.174 660.552 410.729 660.859C410.288 661.162 410.068 661.548 410.068 662.017C410.068 662.434 410.22 662.763 410.523 663.004C410.826 663.246 411.299 663.447 411.943 663.608L413.562 664.006C414.538 664.242 415.265 664.605 415.743 665.092C416.221 665.575 416.46 666.198 416.46 666.96C416.46 667.585 416.28 668.144 415.92 668.636C415.565 669.129 415.068 669.517 414.429 669.801C413.79 670.085 413.046 670.227 412.199 670.227C411.086 670.227 410.165 669.986 409.436 669.503C408.707 669.02 408.245 668.314 408.051 667.386L409.642 666.989C409.794 667.576 410.08 668.016 410.501 668.31C410.928 668.603 411.484 668.75 412.17 668.75C412.952 668.75 413.572 668.584 414.031 668.253C414.495 667.917 414.727 667.514 414.727 667.045C414.727 666.667 414.595 666.349 414.33 666.094C414.064 665.833 413.657 665.639 413.108 665.511L411.29 665.085C410.291 664.848 409.557 664.482 409.088 663.984C408.624 663.482 408.392 662.855 408.392 662.102C408.392 661.487 408.565 660.942 408.911 660.469C409.261 659.995 409.737 659.624 410.338 659.354C410.944 659.084 411.631 658.949 412.398 658.949C413.477 658.949 414.325 659.186 414.94 659.659C415.561 660.133 416.001 660.758 416.261 661.534Z" fill="#03031C"/>
+<path d="M671.085 929V918.091H672.704V919.795H672.846C673.074 919.213 673.44 918.761 673.947 918.439C674.454 918.112 675.062 917.949 675.772 917.949C676.492 917.949 677.091 918.112 677.569 918.439C678.052 918.761 678.429 919.213 678.699 919.795H678.812C679.092 919.232 679.511 918.785 680.069 918.453C680.628 918.117 681.298 917.949 682.079 917.949C683.055 917.949 683.852 918.254 684.473 918.865C685.093 919.471 685.403 920.416 685.403 921.699V929H683.727V921.699C683.727 920.894 683.507 920.319 683.066 919.973C682.626 919.627 682.108 919.455 681.511 919.455C680.744 919.455 680.15 919.687 679.728 920.151C679.307 920.61 679.096 921.192 679.096 921.898V929H677.392V921.528C677.392 920.908 677.19 920.409 676.788 920.03C676.386 919.646 675.867 919.455 675.233 919.455C674.797 919.455 674.39 919.571 674.011 919.803C673.637 920.035 673.334 920.357 673.102 920.768C672.875 921.176 672.761 921.647 672.761 922.182V929H671.085ZM691.678 929.256C690.987 929.256 690.359 929.125 689.796 928.865C689.232 928.6 688.785 928.219 688.453 927.722C688.122 927.22 687.956 926.614 687.956 925.903C687.956 925.278 688.079 924.772 688.326 924.384C688.572 923.991 688.901 923.683 689.313 923.46C689.725 923.238 690.179 923.072 690.676 922.963C691.178 922.849 691.683 922.759 692.189 922.693C692.852 922.608 693.39 922.544 693.801 922.501C694.218 922.454 694.521 922.376 694.711 922.267C694.905 922.158 695.002 921.969 695.002 921.699V921.642C695.002 920.941 694.81 920.397 694.426 920.009C694.048 919.62 693.472 919.426 692.701 919.426C691.9 919.426 691.273 919.601 690.819 919.952C690.364 920.302 690.044 920.676 689.86 921.074L688.269 920.506C688.553 919.843 688.932 919.327 689.405 918.957C689.883 918.583 690.404 918.323 690.968 918.176C691.536 918.025 692.095 917.949 692.644 917.949C692.994 917.949 693.397 917.991 693.851 918.077C694.31 918.157 694.753 918.325 695.179 918.581C695.61 918.837 695.968 919.223 696.252 919.739C696.536 920.255 696.678 920.946 696.678 921.812V929H695.002V927.523H694.917C694.803 927.759 694.614 928.013 694.348 928.283C694.083 928.553 693.73 928.782 693.29 928.972C692.85 929.161 692.312 929.256 691.678 929.256ZM691.934 927.75C692.596 927.75 693.155 927.62 693.61 927.359C694.069 927.099 694.415 926.763 694.647 926.351C694.883 925.939 695.002 925.506 695.002 925.051V923.517C694.931 923.602 694.775 923.68 694.533 923.751C694.296 923.818 694.022 923.877 693.709 923.929C693.401 923.976 693.101 924.019 692.807 924.057C692.518 924.09 692.284 924.118 692.104 924.142C691.668 924.199 691.261 924.291 690.882 924.419C690.508 924.542 690.205 924.729 689.973 924.98C689.746 925.226 689.632 925.562 689.632 925.989C689.632 926.571 689.848 927.011 690.279 927.31C690.714 927.603 691.266 927.75 691.934 927.75ZM701.413 922.438V929H699.737V918.091H701.357V919.795H701.499C701.754 919.241 702.143 918.796 702.663 918.46C703.184 918.119 703.857 917.949 704.68 917.949C705.419 917.949 706.065 918.1 706.619 918.403C707.173 918.702 707.604 919.156 707.912 919.767C708.22 920.373 708.374 921.14 708.374 922.068V929H706.697V922.182C706.697 921.325 706.475 920.657 706.03 920.179C705.585 919.696 704.974 919.455 704.197 919.455C703.662 919.455 703.184 919.571 702.763 919.803C702.346 920.035 702.017 920.373 701.776 920.818C701.534 921.263 701.413 921.803 701.413 922.438ZM714.647 929.256C713.955 929.256 713.328 929.125 712.765 928.865C712.201 928.6 711.754 928.219 711.422 927.722C711.091 927.22 710.925 926.614 710.925 925.903C710.925 925.278 711.048 924.772 711.294 924.384C711.541 923.991 711.87 923.683 712.282 923.46C712.694 923.238 713.148 923.072 713.645 922.963C714.147 922.849 714.651 922.759 715.158 922.693C715.821 922.608 716.358 922.544 716.77 922.501C717.187 922.454 717.49 922.376 717.679 922.267C717.873 922.158 717.971 921.969 717.971 921.699V921.642C717.971 920.941 717.779 920.397 717.395 920.009C717.016 919.62 716.441 919.426 715.669 919.426C714.869 919.426 714.242 919.601 713.787 919.952C713.333 920.302 713.013 920.676 712.828 921.074L711.238 920.506C711.522 919.843 711.9 919.327 712.374 918.957C712.852 918.583 713.373 918.323 713.936 918.176C714.505 918.025 715.063 917.949 715.613 917.949C715.963 917.949 716.365 917.991 716.82 918.077C717.279 918.157 717.722 918.325 718.148 918.581C718.579 918.837 718.936 919.223 719.221 919.739C719.505 920.255 719.647 920.946 719.647 921.812V929H717.971V927.523H717.885C717.772 927.759 717.582 928.013 717.317 928.283C717.052 928.553 716.699 928.782 716.259 928.972C715.819 929.161 715.281 929.256 714.647 929.256ZM714.902 927.75C715.565 927.75 716.124 927.62 716.578 927.359C717.038 927.099 717.383 926.763 717.615 926.351C717.852 925.939 717.971 925.506 717.971 925.051V923.517C717.9 923.602 717.743 923.68 717.502 923.751C717.265 923.818 716.99 923.877 716.678 923.929C716.37 923.976 716.069 924.019 715.776 924.057C715.487 924.09 715.253 924.118 715.073 924.142C714.637 924.199 714.23 924.291 713.851 924.419C713.477 924.542 713.174 924.729 712.942 924.98C712.715 925.226 712.601 925.562 712.601 925.989C712.601 926.571 712.817 927.011 713.248 927.31C713.683 927.603 714.235 927.75 714.902 927.75ZM727.109 933.318C726.3 933.318 725.604 933.214 725.021 933.006C724.439 932.802 723.954 932.532 723.565 932.196C723.182 931.865 722.876 931.509 722.649 931.131L723.984 930.193C724.136 930.392 724.328 930.619 724.56 930.875C724.792 931.135 725.109 931.36 725.511 931.55C725.919 931.744 726.451 931.841 727.109 931.841C727.99 931.841 728.717 931.628 729.29 931.202C729.863 930.776 730.149 930.108 730.149 929.199V926.983H730.007C729.884 927.182 729.709 927.428 729.482 927.722C729.259 928.01 728.937 928.268 728.516 928.496C728.099 928.718 727.536 928.83 726.825 928.83C725.945 928.83 725.154 928.621 724.453 928.205C723.757 927.788 723.205 927.182 722.798 926.386C722.396 925.591 722.195 924.625 722.195 923.489C722.195 922.371 722.391 921.398 722.784 920.57C723.177 919.736 723.724 919.092 724.425 918.638C725.125 918.179 725.935 917.949 726.854 917.949C727.564 917.949 728.127 918.067 728.544 918.304C728.965 918.536 729.287 918.801 729.51 919.099C729.737 919.393 729.912 919.634 730.036 919.824H730.206V918.091H731.825V929.312C731.825 930.25 731.612 931.012 731.186 931.599C730.765 932.191 730.196 932.625 729.482 932.899C728.771 933.179 727.981 933.318 727.109 933.318ZM727.053 927.324C727.725 927.324 728.293 927.17 728.757 926.862C729.221 926.554 729.574 926.112 729.815 925.534C730.057 924.956 730.178 924.265 730.178 923.46C730.178 922.674 730.059 921.981 729.822 921.379C729.586 920.778 729.235 920.307 728.771 919.966C728.307 919.625 727.734 919.455 727.053 919.455C726.342 919.455 725.75 919.634 725.277 919.994C724.808 920.354 724.455 920.837 724.219 921.443C723.987 922.049 723.871 922.722 723.871 923.46C723.871 924.218 723.989 924.888 724.226 925.47C724.467 926.048 724.822 926.502 725.291 926.834C725.765 927.161 726.352 927.324 727.053 927.324ZM739.467 929.227C738.416 929.227 737.509 928.995 736.747 928.531C735.99 928.062 735.405 927.409 734.993 926.571C734.586 925.728 734.382 924.748 734.382 923.631C734.382 922.513 734.586 921.528 734.993 920.676C735.405 919.819 735.978 919.152 736.712 918.673C737.45 918.19 738.312 917.949 739.297 917.949C739.865 917.949 740.426 918.044 740.98 918.233C741.534 918.422 742.038 918.73 742.493 919.156C742.947 919.578 743.31 920.136 743.58 920.832C743.849 921.528 743.984 922.385 743.984 923.403V924.114H735.575V922.665H742.28C742.28 922.049 742.157 921.5 741.911 921.017C741.669 920.534 741.323 920.153 740.874 919.874C740.429 919.594 739.903 919.455 739.297 919.455C738.629 919.455 738.052 919.62 737.564 919.952C737.081 920.278 736.709 920.705 736.449 921.23C736.188 921.756 736.058 922.319 736.058 922.92V923.886C736.058 924.71 736.2 925.409 736.484 925.982C736.773 926.55 737.173 926.983 737.685 927.281C738.196 927.575 738.79 927.722 739.467 927.722C739.908 927.722 740.305 927.66 740.661 927.537C741.02 927.409 741.33 927.22 741.591 926.969C741.851 926.713 742.053 926.396 742.195 926.017L743.814 926.472C743.643 927.021 743.357 927.504 742.955 927.92C742.552 928.332 742.055 928.654 741.463 928.886C740.871 929.114 740.206 929.227 739.467 929.227ZM754.261 920.534L752.756 920.96C752.661 920.709 752.521 920.465 752.337 920.229C752.157 919.987 751.911 919.788 751.598 919.632C751.286 919.476 750.885 919.398 750.398 919.398C749.73 919.398 749.174 919.552 748.729 919.859C748.288 920.162 748.068 920.548 748.068 921.017C748.068 921.434 748.22 921.763 748.523 922.004C748.826 922.246 749.299 922.447 749.943 922.608L751.562 923.006C752.538 923.242 753.265 923.605 753.743 924.092C754.221 924.575 754.46 925.198 754.46 925.96C754.46 926.585 754.28 927.144 753.92 927.636C753.565 928.129 753.068 928.517 752.429 928.801C751.79 929.085 751.046 929.227 750.199 929.227C749.086 929.227 748.165 928.986 747.436 928.503C746.707 928.02 746.245 927.314 746.051 926.386L747.642 925.989C747.794 926.576 748.08 927.016 748.501 927.31C748.928 927.603 749.484 927.75 750.17 927.75C750.952 927.75 751.572 927.584 752.031 927.253C752.495 926.917 752.727 926.514 752.727 926.045C752.727 925.667 752.595 925.349 752.33 925.094C752.064 924.833 751.657 924.639 751.108 924.511L749.29 924.085C748.291 923.848 747.557 923.482 747.088 922.984C746.624 922.482 746.392 921.855 746.392 921.102C746.392 920.487 746.565 919.942 746.911 919.469C747.261 918.995 747.737 918.624 748.338 918.354C748.944 918.084 749.631 917.949 750.398 917.949C751.477 917.949 752.325 918.186 752.94 918.659C753.561 919.133 754.001 919.758 754.261 920.534Z" fill="#03031C"/>
+<path d="M295.864 380.017V378.455H306.773V380.017H302.2V393H300.438V380.017H295.864ZM309.094 397.091C308.81 397.091 308.557 397.067 308.334 397.02C308.112 396.977 307.958 396.935 307.873 396.892L308.299 395.415C308.706 395.519 309.066 395.557 309.378 395.528C309.691 395.5 309.968 395.36 310.209 395.109C310.455 394.863 310.68 394.463 310.884 393.909L311.196 393.057L307.162 382.091H308.98L311.992 390.784H312.105L315.117 382.091H316.935L312.304 394.591C312.096 395.154 311.838 395.621 311.53 395.99C311.222 396.364 310.865 396.641 310.458 396.821C310.055 397.001 309.601 397.091 309.094 397.091ZM320.71 389.023L320.681 386.949H321.022L325.795 382.091H327.869L322.784 387.233H322.642L320.71 389.023ZM319.147 393V378.455H320.824V393H319.147ZM326.079 393L321.818 387.602L323.011 386.438L328.21 393H326.079ZM340.083 393.227C339.098 393.227 338.234 392.993 337.491 392.524C336.752 392.055 336.174 391.4 335.758 390.557C335.346 389.714 335.14 388.729 335.14 387.602C335.14 386.466 335.346 385.474 335.758 384.626C336.174 383.779 336.752 383.121 337.491 382.652C338.234 382.183 339.098 381.949 340.083 381.949C341.068 381.949 341.93 382.183 342.668 382.652C343.412 383.121 343.989 383.779 344.401 384.626C344.818 385.474 345.026 386.466 345.026 387.602C345.026 388.729 344.818 389.714 344.401 390.557C343.989 391.4 343.412 392.055 342.668 392.524C341.93 392.993 341.068 393.227 340.083 393.227ZM340.083 391.722C340.831 391.722 341.447 391.53 341.93 391.146C342.413 390.763 342.77 390.259 343.002 389.634C343.234 389.009 343.35 388.331 343.35 387.602C343.35 386.873 343.234 386.194 343.002 385.564C342.77 384.934 342.413 384.425 341.93 384.037C341.447 383.649 340.831 383.455 340.083 383.455C339.335 383.455 338.719 383.649 338.237 384.037C337.754 384.425 337.396 384.934 337.164 385.564C336.932 386.194 336.816 386.873 336.816 387.602C336.816 388.331 336.932 389.009 337.164 389.634C337.396 390.259 337.754 390.763 338.237 391.146C338.719 391.53 339.335 391.722 340.083 391.722ZM347.585 393V382.091H349.204V383.739H349.318C349.517 383.199 349.877 382.761 350.397 382.425C350.918 382.089 351.505 381.92 352.159 381.92C352.282 381.92 352.436 381.923 352.62 381.928C352.805 381.932 352.945 381.939 353.039 381.949V383.653C352.983 383.639 352.852 383.618 352.649 383.589C352.45 383.556 352.239 383.54 352.017 383.54C351.486 383.54 351.013 383.651 350.596 383.874C350.184 384.091 349.858 384.394 349.616 384.783C349.379 385.166 349.261 385.604 349.261 386.097V393H347.585ZM359.098 397.318C358.288 397.318 357.592 397.214 357.01 397.006C356.427 396.802 355.942 396.532 355.554 396.196C355.17 395.865 354.865 395.509 354.637 395.131L355.973 394.193C356.124 394.392 356.316 394.619 356.548 394.875C356.78 395.135 357.097 395.36 357.5 395.55C357.907 395.744 358.44 395.841 359.098 395.841C359.978 395.841 360.705 395.628 361.278 395.202C361.851 394.776 362.137 394.108 362.137 393.199V390.983H361.995C361.872 391.182 361.697 391.428 361.47 391.722C361.247 392.01 360.925 392.268 360.504 392.496C360.087 392.718 359.524 392.83 358.814 392.83C357.933 392.83 357.142 392.621 356.441 392.205C355.745 391.788 355.194 391.182 354.787 390.386C354.384 389.591 354.183 388.625 354.183 387.489C354.183 386.371 354.379 385.398 354.772 384.57C355.165 383.736 355.712 383.092 356.413 382.638C357.114 382.179 357.923 381.949 358.842 381.949C359.552 381.949 360.116 382.067 360.532 382.304C360.954 382.536 361.276 382.801 361.498 383.099C361.725 383.393 361.901 383.634 362.024 383.824H362.194V382.091H363.814V393.312C363.814 394.25 363.6 395.012 363.174 395.599C362.753 396.191 362.185 396.625 361.47 396.899C360.76 397.179 359.969 397.318 359.098 397.318ZM359.041 391.324C359.713 391.324 360.281 391.17 360.745 390.862C361.209 390.554 361.562 390.112 361.804 389.534C362.045 388.956 362.166 388.265 362.166 387.46C362.166 386.674 362.047 385.981 361.811 385.379C361.574 384.778 361.224 384.307 360.76 383.966C360.296 383.625 359.723 383.455 359.041 383.455C358.331 383.455 357.739 383.634 357.265 383.994C356.797 384.354 356.444 384.837 356.207 385.443C355.975 386.049 355.859 386.722 355.859 387.46C355.859 388.218 355.977 388.888 356.214 389.47C356.456 390.048 356.811 390.502 357.279 390.834C357.753 391.161 358.34 391.324 359.041 391.324ZM370.092 393.256C369.401 393.256 368.773 393.125 368.21 392.865C367.646 392.6 367.199 392.219 366.868 391.722C366.536 391.22 366.37 390.614 366.37 389.903C366.37 389.278 366.493 388.772 366.74 388.384C366.986 387.991 367.315 387.683 367.727 387.46C368.139 387.238 368.593 387.072 369.091 386.963C369.592 386.849 370.097 386.759 370.603 386.693C371.266 386.608 371.804 386.544 372.216 386.501C372.632 386.454 372.935 386.376 373.125 386.267C373.319 386.158 373.416 385.969 373.416 385.699V385.642C373.416 384.941 373.224 384.397 372.841 384.009C372.462 383.62 371.886 383.426 371.115 383.426C370.315 383.426 369.687 383.601 369.233 383.952C368.778 384.302 368.458 384.676 368.274 385.074L366.683 384.506C366.967 383.843 367.346 383.327 367.819 382.957C368.297 382.583 368.818 382.323 369.382 382.176C369.95 382.025 370.509 381.949 371.058 381.949C371.408 381.949 371.811 381.991 372.265 382.077C372.725 382.157 373.167 382.325 373.593 382.581C374.024 382.837 374.382 383.223 374.666 383.739C374.95 384.255 375.092 384.946 375.092 385.812V393H373.416V391.523H373.331C373.217 391.759 373.028 392.013 372.762 392.283C372.497 392.553 372.145 392.782 371.704 392.972C371.264 393.161 370.726 393.256 370.092 393.256ZM370.348 391.75C371.011 391.75 371.569 391.62 372.024 391.359C372.483 391.099 372.829 390.763 373.061 390.351C373.297 389.939 373.416 389.506 373.416 389.051V387.517C373.345 387.602 373.189 387.68 372.947 387.751C372.71 387.818 372.436 387.877 372.123 387.929C371.815 387.976 371.515 388.019 371.221 388.057C370.932 388.09 370.698 388.118 370.518 388.142C370.083 388.199 369.675 388.291 369.297 388.419C368.922 388.542 368.619 388.729 368.387 388.98C368.16 389.226 368.047 389.562 368.047 389.989C368.047 390.571 368.262 391.011 368.693 391.31C369.128 391.603 369.68 391.75 370.348 391.75ZM379.827 386.438V393H378.151V382.091H379.771V383.795H379.913C380.168 383.241 380.557 382.796 381.077 382.46C381.598 382.119 382.271 381.949 383.094 381.949C383.833 381.949 384.479 382.1 385.033 382.403C385.587 382.702 386.018 383.156 386.326 383.767C386.634 384.373 386.788 385.14 386.788 386.068V393H385.112V386.182C385.112 385.325 384.889 384.657 384.444 384.179C383.999 383.696 383.388 383.455 382.612 383.455C382.076 383.455 381.598 383.571 381.177 383.803C380.76 384.035 380.431 384.373 380.19 384.818C379.948 385.263 379.827 385.803 379.827 386.438ZM389.85 393V382.091H391.527V393H389.85ZM390.703 380.273C390.376 380.273 390.094 380.161 389.858 379.939C389.626 379.716 389.51 379.449 389.51 379.136C389.51 378.824 389.626 378.556 389.858 378.334C390.094 378.111 390.376 378 390.703 378C391.029 378 391.309 378.111 391.541 378.334C391.778 378.556 391.896 378.824 391.896 379.136C391.896 379.449 391.778 379.716 391.541 379.939C391.309 380.161 391.029 380.273 390.703 380.273ZM402.324 384.534L400.818 384.96C400.723 384.709 400.584 384.465 400.399 384.229C400.219 383.987 399.973 383.788 399.661 383.632C399.348 383.476 398.948 383.398 398.46 383.398C397.793 383.398 397.236 383.552 396.791 383.859C396.351 384.162 396.131 384.548 396.131 385.017C396.131 385.434 396.282 385.763 396.585 386.004C396.888 386.246 397.362 386.447 398.006 386.608L399.625 387.006C400.6 387.242 401.327 387.605 401.805 388.092C402.284 388.575 402.523 389.198 402.523 389.96C402.523 390.585 402.343 391.144 401.983 391.636C401.628 392.129 401.131 392.517 400.491 392.801C399.852 393.085 399.109 393.227 398.261 393.227C397.149 393.227 396.228 392.986 395.499 392.503C394.769 392.02 394.308 391.314 394.114 390.386L395.705 389.989C395.856 390.576 396.143 391.016 396.564 391.31C396.99 391.603 397.546 391.75 398.233 391.75C399.014 391.75 399.634 391.584 400.094 391.253C400.558 390.917 400.79 390.514 400.79 390.045C400.79 389.667 400.657 389.349 400.392 389.094C400.127 388.833 399.72 388.639 399.17 388.511L397.352 388.085C396.353 387.848 395.619 387.482 395.151 386.984C394.687 386.482 394.455 385.855 394.455 385.102C394.455 384.487 394.627 383.942 394.973 383.469C395.323 382.995 395.799 382.624 396.401 382.354C397.007 382.084 397.693 381.949 398.46 381.949C399.54 381.949 400.387 382.186 401.003 382.659C401.623 383.133 402.063 383.758 402.324 384.534ZM408.256 393.256C407.565 393.256 406.937 393.125 406.374 392.865C405.81 392.6 405.363 392.219 405.032 391.722C404.7 391.22 404.534 390.614 404.534 389.903C404.534 389.278 404.658 388.772 404.904 388.384C405.15 387.991 405.479 387.683 405.891 387.46C406.303 387.238 406.757 387.072 407.255 386.963C407.757 386.849 408.261 386.759 408.767 386.693C409.43 386.608 409.968 386.544 410.38 386.501C410.796 386.454 411.099 386.376 411.289 386.267C411.483 386.158 411.58 385.969 411.58 385.699V385.642C411.58 384.941 411.388 384.397 411.005 384.009C410.626 383.62 410.051 383.426 409.279 383.426C408.479 383.426 407.851 383.601 407.397 383.952C406.942 384.302 406.623 384.676 406.438 385.074L404.847 384.506C405.131 383.843 405.51 383.327 405.983 382.957C406.462 382.583 406.982 382.323 407.546 382.176C408.114 382.025 408.673 381.949 409.222 381.949C409.572 381.949 409.975 381.991 410.429 382.077C410.889 382.157 411.331 382.325 411.757 382.581C412.188 382.837 412.546 383.223 412.83 383.739C413.114 384.255 413.256 384.946 413.256 385.812V393H411.58V391.523H411.495C411.381 391.759 411.192 392.013 410.926 392.283C410.661 392.553 410.309 392.782 409.868 392.972C409.428 393.161 408.891 393.256 408.256 393.256ZM408.512 391.75C409.175 391.75 409.733 391.62 410.188 391.359C410.647 391.099 410.993 390.763 411.225 390.351C411.462 389.939 411.58 389.506 411.58 389.051V387.517C411.509 387.602 411.353 387.68 411.111 387.751C410.874 387.818 410.6 387.877 410.287 387.929C409.98 387.976 409.679 388.019 409.385 388.057C409.096 388.09 408.862 388.118 408.682 388.142C408.247 388.199 407.839 388.291 407.461 388.419C407.087 388.542 406.783 388.729 406.551 388.98C406.324 389.226 406.211 389.562 406.211 389.989C406.211 390.571 406.426 391.011 406.857 391.31C407.292 391.603 407.844 391.75 408.512 391.75ZM421.06 382.091V383.511H415.406V382.091H421.06ZM417.054 379.477H418.73V389.875C418.73 390.348 418.799 390.704 418.936 390.94C419.078 391.172 419.258 391.329 419.476 391.409C419.698 391.485 419.933 391.523 420.179 391.523C420.364 391.523 420.515 391.513 420.634 391.494C420.752 391.471 420.847 391.452 420.918 391.438L421.259 392.943C421.145 392.986 420.986 393.028 420.783 393.071C420.579 393.118 420.321 393.142 420.009 393.142C419.535 393.142 419.071 393.04 418.616 392.837C418.167 392.633 417.793 392.323 417.494 391.906C417.201 391.49 417.054 390.964 417.054 390.33V379.477ZM423.581 393V382.091H425.257V393H423.581ZM424.433 380.273C424.107 380.273 423.825 380.161 423.588 379.939C423.356 379.716 423.24 379.449 423.24 379.136C423.24 378.824 423.356 378.556 423.588 378.334C423.825 378.111 424.107 378 424.433 378C424.76 378 425.039 378.111 425.271 378.334C425.508 378.556 425.626 378.824 425.626 379.136C425.626 379.449 425.508 379.716 425.271 379.939C425.039 380.161 424.76 380.273 424.433 380.273ZM432.759 393.227C431.774 393.227 430.91 392.993 430.167 392.524C429.428 392.055 428.85 391.4 428.434 390.557C428.022 389.714 427.816 388.729 427.816 387.602C427.816 386.466 428.022 385.474 428.434 384.626C428.85 383.779 429.428 383.121 430.167 382.652C430.91 382.183 431.774 381.949 432.759 381.949C433.744 381.949 434.605 382.183 435.344 382.652C436.087 383.121 436.665 383.779 437.077 384.626C437.494 385.474 437.702 386.466 437.702 387.602C437.702 388.729 437.494 389.714 437.077 390.557C436.665 391.4 436.087 392.055 435.344 392.524C434.605 392.993 433.744 393.227 432.759 393.227ZM432.759 391.722C433.507 391.722 434.123 391.53 434.605 391.146C435.088 390.763 435.446 390.259 435.678 389.634C435.91 389.009 436.026 388.331 436.026 387.602C436.026 386.873 435.91 386.194 435.678 385.564C435.446 384.934 435.088 384.425 434.605 384.037C434.123 383.649 433.507 383.455 432.759 383.455C432.011 383.455 431.395 383.649 430.912 384.037C430.429 384.425 430.072 384.934 429.84 385.564C429.608 386.194 429.492 386.873 429.492 387.602C429.492 388.331 429.608 389.009 429.84 389.634C430.072 390.259 430.429 390.763 430.912 391.146C431.395 391.53 432.011 391.722 432.759 391.722ZM441.937 386.438V393H440.261V382.091H441.88V383.795H442.022C442.278 383.241 442.666 382.796 443.187 382.46C443.708 382.119 444.38 381.949 445.204 381.949C445.942 381.949 446.589 382.1 447.143 382.403C447.697 382.702 448.128 383.156 448.435 383.767C448.743 384.373 448.897 385.14 448.897 386.068V393H447.221V386.182C447.221 385.325 446.998 384.657 446.553 384.179C446.108 383.696 445.497 383.455 444.721 383.455C444.186 383.455 443.708 383.571 443.286 383.803C442.87 384.035 442.54 384.373 442.299 384.818C442.058 385.263 441.937 385.803 441.937 386.438ZM459.687 384.534L458.181 384.96C458.087 384.709 457.947 384.465 457.762 384.229C457.583 383.987 457.336 383.788 457.024 383.632C456.711 383.476 456.311 383.398 455.824 383.398C455.156 383.398 454.6 383.552 454.154 383.859C453.714 384.162 453.494 384.548 453.494 385.017C453.494 385.434 453.645 385.763 453.949 386.004C454.252 386.246 454.725 386.447 455.369 386.608L456.988 387.006C457.964 387.242 458.69 387.605 459.169 388.092C459.647 388.575 459.886 389.198 459.886 389.96C459.886 390.585 459.706 391.144 459.346 391.636C458.991 392.129 458.494 392.517 457.855 392.801C457.216 393.085 456.472 393.227 455.625 393.227C454.512 393.227 453.591 392.986 452.862 392.503C452.133 392.02 451.671 391.314 451.477 390.386L453.068 389.989C453.219 390.576 453.506 391.016 453.927 391.31C454.353 391.603 454.91 391.75 455.596 391.75C456.377 391.75 456.998 391.584 457.457 391.253C457.921 390.917 458.153 390.514 458.153 390.045C458.153 389.667 458.02 389.349 457.755 389.094C457.49 388.833 457.083 388.639 456.534 388.511L454.716 388.085C453.717 387.848 452.983 387.482 452.514 386.984C452.05 386.482 451.818 385.855 451.818 385.102C451.818 384.487 451.991 383.942 452.336 383.469C452.687 382.995 453.163 382.624 453.764 382.354C454.37 382.084 455.056 381.949 455.824 381.949C456.903 381.949 457.751 382.186 458.366 382.659C458.986 383.133 459.427 383.758 459.687 384.534ZM475.761 384.534L474.256 384.96C474.161 384.709 474.021 384.465 473.837 384.229C473.657 383.987 473.411 383.788 473.098 383.632C472.786 383.476 472.385 383.398 471.898 383.398C471.23 383.398 470.674 383.552 470.229 383.859C469.788 384.162 469.568 384.548 469.568 385.017C469.568 385.434 469.72 385.763 470.023 386.004C470.326 386.246 470.799 386.447 471.443 386.608L473.062 387.006C474.038 387.242 474.765 387.605 475.243 388.092C475.721 388.575 475.96 389.198 475.96 389.96C475.96 390.585 475.78 391.144 475.42 391.636C475.065 392.129 474.568 392.517 473.929 392.801C473.29 393.085 472.546 393.227 471.699 393.227C470.586 393.227 469.665 392.986 468.936 392.503C468.207 392.02 467.745 391.314 467.551 390.386L469.142 389.989C469.294 390.576 469.58 391.016 470.001 391.31C470.428 391.603 470.984 391.75 471.67 391.75C472.452 391.75 473.072 391.584 473.531 391.253C473.995 390.917 474.227 390.514 474.227 390.045C474.227 389.667 474.095 389.349 473.83 389.094C473.564 388.833 473.157 388.639 472.608 388.511L470.79 388.085C469.791 387.848 469.057 387.482 468.588 386.984C468.124 386.482 467.892 385.855 467.892 385.102C467.892 384.487 468.065 383.942 468.411 383.469C468.761 382.995 469.237 382.624 469.838 382.354C470.444 382.084 471.131 381.949 471.898 381.949C472.977 381.949 473.825 382.186 474.44 382.659C475.061 383.133 475.501 383.758 475.761 384.534ZM483.057 393.227C482.006 393.227 481.099 392.995 480.337 392.531C479.579 392.062 478.995 391.409 478.583 390.571C478.176 389.728 477.972 388.748 477.972 387.631C477.972 386.513 478.176 385.528 478.583 384.676C478.995 383.819 479.568 383.152 480.301 382.673C481.04 382.19 481.902 381.949 482.887 381.949C483.455 381.949 484.016 382.044 484.57 382.233C485.124 382.422 485.628 382.73 486.083 383.156C486.537 383.578 486.9 384.136 487.169 384.832C487.439 385.528 487.574 386.385 487.574 387.403V388.114H479.165V386.665H485.87C485.87 386.049 485.747 385.5 485.5 385.017C485.259 384.534 484.913 384.153 484.463 383.874C484.018 383.594 483.493 383.455 482.887 383.455C482.219 383.455 481.641 383.62 481.154 383.952C480.671 384.278 480.299 384.705 480.039 385.23C479.778 385.756 479.648 386.319 479.648 386.92V387.886C479.648 388.71 479.79 389.409 480.074 389.982C480.363 390.55 480.763 390.983 481.275 391.281C481.786 391.575 482.38 391.722 483.057 391.722C483.498 391.722 483.895 391.66 484.25 391.537C484.61 391.409 484.92 391.22 485.181 390.969C485.441 390.713 485.642 390.396 485.784 390.017L487.404 390.472C487.233 391.021 486.947 391.504 486.544 391.92C486.142 392.332 485.645 392.654 485.053 392.886C484.461 393.114 483.796 393.227 483.057 393.227ZM494.527 397.318C493.718 397.318 493.022 397.214 492.439 397.006C491.857 396.802 491.372 396.532 490.983 396.196C490.6 395.865 490.294 395.509 490.067 395.131L491.402 394.193C491.554 394.392 491.746 394.619 491.978 394.875C492.21 395.135 492.527 395.36 492.929 395.55C493.337 395.744 493.869 395.841 494.527 395.841C495.408 395.841 496.135 395.628 496.708 395.202C497.281 394.776 497.567 394.108 497.567 393.199V390.983H497.425C497.302 391.182 497.127 391.428 496.9 391.722C496.677 392.01 496.355 392.268 495.934 392.496C495.517 392.718 494.953 392.83 494.243 392.83C493.363 392.83 492.572 392.621 491.871 392.205C491.175 391.788 490.623 391.182 490.216 390.386C489.814 389.591 489.613 388.625 489.613 387.489C489.613 386.371 489.809 385.398 490.202 384.57C490.595 383.736 491.142 383.092 491.843 382.638C492.543 382.179 493.353 381.949 494.272 381.949C494.982 381.949 495.545 382.067 495.962 382.304C496.383 382.536 496.705 382.801 496.928 383.099C497.155 383.393 497.33 383.634 497.453 383.824H497.624V382.091H499.243V393.312C499.243 394.25 499.03 395.012 498.604 395.599C498.183 396.191 497.614 396.625 496.9 396.899C496.189 397.179 495.399 397.318 494.527 397.318ZM494.471 391.324C495.143 391.324 495.711 391.17 496.175 390.862C496.639 390.554 496.992 390.112 497.233 389.534C497.475 388.956 497.596 388.265 497.596 387.46C497.596 386.674 497.477 385.981 497.24 385.379C497.004 384.778 496.653 384.307 496.189 383.966C495.725 383.625 495.152 383.455 494.471 383.455C493.76 383.455 493.168 383.634 492.695 383.994C492.226 384.354 491.873 384.837 491.637 385.443C491.405 386.049 491.289 386.722 491.289 387.46C491.289 388.218 491.407 388.888 491.644 389.47C491.885 390.048 492.24 390.502 492.709 390.834C493.183 391.161 493.77 391.324 494.471 391.324ZM502.311 393V382.091H503.931V383.739H504.044C504.243 383.199 504.603 382.761 505.124 382.425C505.645 382.089 506.232 381.92 506.885 381.92C507.008 381.92 507.162 381.923 507.347 381.928C507.532 381.932 507.671 381.939 507.766 381.949V383.653C507.709 383.639 507.579 383.618 507.375 383.589C507.176 383.556 506.966 383.54 506.743 383.54C506.213 383.54 505.739 383.651 505.323 383.874C504.911 384.091 504.584 384.394 504.343 384.783C504.106 385.166 503.988 385.604 503.988 386.097V393H502.311ZM513.995 393.227C512.944 393.227 512.037 392.995 511.275 392.531C510.517 392.062 509.932 391.409 509.52 390.571C509.113 389.728 508.909 388.748 508.909 387.631C508.909 386.513 509.113 385.528 509.52 384.676C509.932 383.819 510.505 383.152 511.239 382.673C511.978 382.19 512.839 381.949 513.824 381.949C514.392 381.949 514.953 382.044 515.507 382.233C516.061 382.422 516.566 382.73 517.02 383.156C517.475 383.578 517.837 384.136 518.107 384.832C518.377 385.528 518.512 386.385 518.512 387.403V388.114H510.103V386.665H516.807C516.807 386.049 516.684 385.5 516.438 385.017C516.196 384.534 515.851 384.153 515.401 383.874C514.956 383.594 514.43 383.455 513.824 383.455C513.157 383.455 512.579 383.62 512.091 383.952C511.608 384.278 511.237 384.705 510.976 385.23C510.716 385.756 510.586 386.319 510.586 386.92V387.886C510.586 388.71 510.728 389.409 511.012 389.982C511.301 390.55 511.701 390.983 512.212 391.281C512.723 391.575 513.318 391.722 513.995 391.722C514.435 391.722 514.833 391.66 515.188 391.537C515.548 391.409 515.858 391.22 516.118 390.969C516.379 390.713 516.58 390.396 516.722 390.017L518.341 390.472C518.171 391.021 517.884 391.504 517.482 391.92C517.079 392.332 516.582 392.654 515.99 392.886C515.399 393.114 514.733 393.227 513.995 393.227ZM525.465 397.318C524.655 397.318 523.959 397.214 523.377 397.006C522.794 396.802 522.309 396.532 521.921 396.196C521.537 395.865 521.232 395.509 521.005 395.131L522.34 394.193C522.491 394.392 522.683 394.619 522.915 394.875C523.147 395.135 523.464 395.36 523.867 395.55C524.274 395.744 524.807 395.841 525.465 395.841C526.346 395.841 527.072 395.628 527.645 395.202C528.218 394.776 528.505 394.108 528.505 393.199V390.983H528.363C528.239 391.182 528.064 391.428 527.837 391.722C527.614 392.01 527.292 392.268 526.871 392.496C526.454 392.718 525.891 392.83 525.181 392.83C524.3 392.83 523.509 392.621 522.809 392.205C522.113 391.788 521.561 391.182 521.154 390.386C520.751 389.591 520.55 388.625 520.55 387.489C520.55 386.371 520.747 385.398 521.14 384.57C521.533 383.736 522.079 383.092 522.78 382.638C523.481 382.179 524.291 381.949 525.209 381.949C525.919 381.949 526.483 382.067 526.9 382.304C527.321 382.536 527.643 382.801 527.865 383.099C528.093 383.393 528.268 383.634 528.391 383.824H528.561V382.091H530.181V393.312C530.181 394.25 529.968 395.012 529.542 395.599C529.12 396.191 528.552 396.625 527.837 396.899C527.127 397.179 526.336 397.318 525.465 397.318ZM525.408 391.324C526.08 391.324 526.649 391.17 527.113 390.862C527.577 390.554 527.929 390.112 528.171 389.534C528.412 388.956 528.533 388.265 528.533 387.46C528.533 386.674 528.415 385.981 528.178 385.379C527.941 384.778 527.591 384.307 527.127 383.966C526.663 383.625 526.09 383.455 525.408 383.455C524.698 383.455 524.106 383.634 523.632 383.994C523.164 384.354 522.811 384.837 522.574 385.443C522.342 386.049 522.226 386.722 522.226 387.46C522.226 388.218 522.345 388.888 522.581 389.47C522.823 390.048 523.178 390.502 523.647 390.834C524.12 391.161 524.707 391.324 525.408 391.324ZM536.459 393.256C535.768 393.256 535.141 393.125 534.577 392.865C534.014 392.6 533.566 392.219 533.235 391.722C532.903 391.22 532.738 390.614 532.738 389.903C532.738 389.278 532.861 388.772 533.107 388.384C533.353 387.991 533.682 387.683 534.094 387.46C534.506 387.238 534.961 387.072 535.458 386.963C535.96 386.849 536.464 386.759 536.971 386.693C537.633 386.608 538.171 386.544 538.583 386.501C538.999 386.454 539.302 386.376 539.492 386.267C539.686 386.158 539.783 385.969 539.783 385.699V385.642C539.783 384.941 539.591 384.397 539.208 384.009C538.829 383.62 538.254 383.426 537.482 383.426C536.682 383.426 536.054 383.601 535.6 383.952C535.145 384.302 534.826 384.676 534.641 385.074L533.05 384.506C533.334 383.843 533.713 383.327 534.186 382.957C534.665 382.583 535.185 382.323 535.749 382.176C536.317 382.025 536.876 381.949 537.425 381.949C537.775 381.949 538.178 381.991 538.632 382.077C539.092 382.157 539.534 382.325 539.961 382.581C540.391 382.837 540.749 383.223 541.033 383.739C541.317 384.255 541.459 384.946 541.459 385.812V393H539.783V391.523H539.698C539.584 391.759 539.395 392.013 539.13 392.283C538.864 392.553 538.512 392.782 538.071 392.972C537.631 393.161 537.094 393.256 536.459 393.256ZM536.715 391.75C537.378 391.75 537.936 391.62 538.391 391.359C538.85 391.099 539.196 390.763 539.428 390.351C539.665 389.939 539.783 389.506 539.783 389.051V387.517C539.712 387.602 539.556 387.68 539.314 387.751C539.078 387.818 538.803 387.877 538.49 387.929C538.183 387.976 537.882 388.019 537.588 388.057C537.3 388.09 537.065 388.118 536.885 388.142C536.45 388.199 536.042 388.291 535.664 388.419C535.29 388.542 534.987 388.729 534.755 388.98C534.527 389.226 534.414 389.562 534.414 389.989C534.414 390.571 534.629 391.011 535.06 391.31C535.496 391.603 536.047 391.75 536.715 391.75ZM549.263 382.091V383.511H543.609V382.091H549.263ZM545.257 379.477H546.933V389.875C546.933 390.348 547.002 390.704 547.139 390.94C547.281 391.172 547.461 391.329 547.679 391.409C547.902 391.485 548.136 391.523 548.382 391.523C548.567 391.523 548.718 391.513 548.837 391.494C548.955 391.471 549.05 391.452 549.121 391.438L549.462 392.943C549.348 392.986 549.189 393.028 548.986 393.071C548.782 393.118 548.524 393.142 548.212 393.142C547.738 393.142 547.274 393.04 546.82 392.837C546.37 392.633 545.996 392.323 545.697 391.906C545.404 391.49 545.257 390.964 545.257 390.33V379.477ZM556.241 393.227C555.19 393.227 554.283 392.995 553.521 392.531C552.763 392.062 552.178 391.409 551.766 390.571C551.359 389.728 551.156 388.748 551.156 387.631C551.156 386.513 551.359 385.528 551.766 384.676C552.178 383.819 552.751 383.152 553.485 382.673C554.224 382.19 555.085 381.949 556.07 381.949C556.638 381.949 557.2 382.044 557.754 382.233C558.308 382.422 558.812 382.73 559.266 383.156C559.721 383.578 560.083 384.136 560.353 384.832C560.623 385.528 560.758 386.385 560.758 387.403V388.114H552.349V386.665H559.053C559.053 386.049 558.93 385.5 558.684 385.017C558.442 384.534 558.097 384.153 557.647 383.874C557.202 383.594 556.676 383.455 556.07 383.455C555.403 383.455 554.825 383.62 554.337 383.952C553.854 384.278 553.483 384.705 553.222 385.23C552.962 385.756 552.832 386.319 552.832 386.92V387.886C552.832 388.71 552.974 389.409 553.258 389.982C553.547 390.55 553.947 390.983 554.458 391.281C554.969 391.575 555.564 391.722 556.241 391.722C556.681 391.722 557.079 391.66 557.434 391.537C557.794 391.409 558.104 391.22 558.364 390.969C558.625 390.713 558.826 390.396 558.968 390.017L560.587 390.472C560.417 391.021 560.13 391.504 559.728 391.92C559.326 392.332 558.828 392.654 558.237 392.886C557.645 393.114 556.979 393.227 556.241 393.227ZM571.404 393L568.08 382.091H569.842L572.2 390.443H572.313L574.643 382.091H576.433L578.734 390.415H578.847L581.205 382.091H582.967L579.643 393H577.995L575.609 384.619H575.438L573.052 393H571.404ZM586.859 386.438V393H585.183V378.455H586.859V383.795H587.001C587.256 383.232 587.64 382.785 588.151 382.453C588.667 382.117 589.354 381.949 590.211 381.949C590.954 381.949 591.605 382.098 592.164 382.396C592.723 382.69 593.156 383.142 593.464 383.753C593.776 384.359 593.933 385.131 593.933 386.068V393H592.256V386.182C592.256 385.315 592.031 384.645 591.582 384.172C591.137 383.694 590.519 383.455 589.728 383.455C589.179 383.455 588.686 383.571 588.251 383.803C587.82 384.035 587.479 384.373 587.228 384.818C586.982 385.263 586.859 385.803 586.859 386.438ZM600.209 393.256C599.518 393.256 598.891 393.125 598.327 392.865C597.764 392.6 597.316 392.219 596.985 391.722C596.653 391.22 596.488 390.614 596.488 389.903C596.488 389.278 596.611 388.772 596.857 388.384C597.103 387.991 597.432 387.683 597.844 387.46C598.256 387.238 598.711 387.072 599.208 386.963C599.71 386.849 600.214 386.759 600.721 386.693C601.383 386.608 601.921 386.544 602.333 386.501C602.749 386.454 603.052 386.376 603.242 386.267C603.436 386.158 603.533 385.969 603.533 385.699V385.642C603.533 384.941 603.341 384.397 602.958 384.009C602.579 383.62 602.004 383.426 601.232 383.426C600.432 383.426 599.804 383.601 599.35 383.952C598.895 384.302 598.576 384.676 598.391 385.074L596.8 384.506C597.084 383.843 597.463 383.327 597.936 382.957C598.415 382.583 598.935 382.323 599.499 382.176C600.067 382.025 600.626 381.949 601.175 381.949C601.525 381.949 601.928 381.991 602.382 382.077C602.842 382.157 603.284 382.325 603.711 382.581C604.141 382.837 604.499 383.223 604.783 383.739C605.067 384.255 605.209 384.946 605.209 385.812V393H603.533V391.523H603.448C603.334 391.759 603.145 392.013 602.88 392.283C602.614 392.553 602.262 392.782 601.821 392.972C601.381 393.161 600.844 393.256 600.209 393.256ZM600.465 391.75C601.128 391.75 601.686 391.62 602.141 391.359C602.6 391.099 602.946 390.763 603.178 390.351C603.415 389.939 603.533 389.506 603.533 389.051V387.517C603.462 387.602 603.306 387.68 603.064 387.751C602.828 387.818 602.553 387.877 602.24 387.929C601.933 387.976 601.632 388.019 601.338 388.057C601.05 388.09 600.815 388.118 600.635 388.142C600.2 388.199 599.792 388.291 599.414 388.419C599.04 388.542 598.737 388.729 598.505 388.98C598.277 389.226 598.164 389.562 598.164 389.989C598.164 390.571 598.379 391.011 598.81 391.31C599.246 391.603 599.797 391.75 600.465 391.75ZM613.013 382.091V383.511H607.359V382.091H613.013ZM609.007 379.477H610.683V389.875C610.683 390.348 610.752 390.704 610.889 390.94C611.031 391.172 611.211 391.329 611.429 391.409C611.652 391.485 611.886 391.523 612.132 391.523C612.317 391.523 612.468 391.513 612.587 391.494C612.705 391.471 612.8 391.452 612.871 391.438L613.212 392.943C613.098 392.986 612.939 393.028 612.736 393.071C612.532 393.118 612.274 393.142 611.962 393.142C611.488 393.142 611.024 393.04 610.57 392.837C610.12 392.633 609.746 392.323 609.447 391.906C609.154 391.49 609.007 390.964 609.007 390.33V379.477ZM379.186 418.54V412.091H380.863V423H379.186V421.153H379.073C378.817 421.707 378.419 422.179 377.88 422.567C377.34 422.95 376.658 423.142 375.834 423.142C375.152 423.142 374.546 422.993 374.016 422.695C373.486 422.392 373.069 421.937 372.766 421.331C372.463 420.72 372.311 419.951 372.311 419.023V412.091H373.988V418.909C373.988 419.705 374.21 420.339 374.655 420.812C375.105 421.286 375.678 421.523 376.374 421.523C376.791 421.523 377.214 421.416 377.645 421.203C378.081 420.99 378.445 420.663 378.739 420.223C379.037 419.783 379.186 419.222 379.186 418.54ZM391.66 414.534L390.154 414.96C390.059 414.709 389.92 414.465 389.735 414.229C389.555 413.987 389.309 413.788 388.996 413.632C388.684 413.476 388.284 413.398 387.796 413.398C387.129 413.398 386.572 413.552 386.127 413.859C385.687 414.162 385.467 414.548 385.467 415.017C385.467 415.434 385.618 415.763 385.921 416.004C386.224 416.246 386.698 416.447 387.342 416.608L388.961 417.006C389.936 417.242 390.663 417.605 391.141 418.092C391.62 418.575 391.859 419.198 391.859 419.96C391.859 420.585 391.679 421.144 391.319 421.636C390.964 422.129 390.467 422.517 389.827 422.801C389.188 423.085 388.445 423.227 387.597 423.227C386.485 423.227 385.564 422.986 384.835 422.503C384.105 422.02 383.644 421.314 383.45 420.386L385.04 419.989C385.192 420.576 385.478 421.016 385.9 421.31C386.326 421.603 386.882 421.75 387.569 421.75C388.35 421.75 388.97 421.584 389.43 421.253C389.894 420.917 390.126 420.514 390.126 420.045C390.126 419.667 389.993 419.349 389.728 419.094C389.463 418.833 389.056 418.639 388.506 418.511L386.688 418.085C385.689 417.848 384.955 417.482 384.487 416.984C384.022 416.482 383.79 415.855 383.79 415.102C383.79 414.487 383.963 413.942 384.309 413.469C384.659 412.995 385.135 412.624 385.737 412.354C386.343 412.084 387.029 411.949 387.796 411.949C388.876 411.949 389.723 412.186 390.339 412.659C390.959 413.133 391.399 413.758 391.66 414.534ZM398.956 423.227C397.904 423.227 396.998 422.995 396.235 422.531C395.478 422.062 394.893 421.409 394.481 420.571C394.074 419.728 393.87 418.748 393.87 417.631C393.87 416.513 394.074 415.528 394.481 414.676C394.893 413.819 395.466 413.152 396.2 412.673C396.939 412.19 397.8 411.949 398.785 411.949C399.353 411.949 399.914 412.044 400.468 412.233C401.022 412.422 401.527 412.73 401.981 413.156C402.436 413.578 402.798 414.136 403.068 414.832C403.338 415.528 403.473 416.385 403.473 417.403V418.114H395.064V416.665H401.768C401.768 416.049 401.645 415.5 401.399 415.017C401.157 414.534 400.812 414.153 400.362 413.874C399.917 413.594 399.391 413.455 398.785 413.455C398.118 413.455 397.54 413.62 397.052 413.952C396.569 414.278 396.198 414.705 395.937 415.23C395.677 415.756 395.547 416.319 395.547 416.92V417.886C395.547 418.71 395.689 419.409 395.973 419.982C396.261 420.55 396.662 420.983 397.173 421.281C397.684 421.575 398.279 421.722 398.956 421.722C399.396 421.722 399.794 421.66 400.149 421.537C400.509 421.409 400.819 421.22 401.079 420.969C401.34 420.713 401.541 420.396 401.683 420.017L403.302 420.472C403.132 421.021 402.845 421.504 402.443 421.92C402.04 422.332 401.543 422.654 400.951 422.886C400.359 423.114 399.694 423.227 398.956 423.227ZM406.022 423V412.091H407.642V413.739H407.755C407.954 413.199 408.314 412.761 408.835 412.425C409.356 412.089 409.943 411.92 410.596 411.92C410.719 411.92 410.873 411.923 411.058 411.928C411.243 411.932 411.382 411.939 411.477 411.949V413.653C411.42 413.639 411.29 413.618 411.086 413.589C410.887 413.556 410.677 413.54 410.454 413.54C409.924 413.54 409.45 413.651 409.034 413.874C408.622 414.091 408.295 414.394 408.054 414.783C407.817 415.166 407.699 415.604 407.699 416.097V423H406.022ZM421.191 414.534L419.685 414.96C419.591 414.709 419.451 414.465 419.266 414.229C419.086 413.987 418.84 413.788 418.528 413.632C418.215 413.476 417.815 413.398 417.327 413.398C416.66 413.398 416.103 413.552 415.658 413.859C415.218 414.162 414.998 414.548 414.998 415.017C414.998 415.434 415.149 415.763 415.452 416.004C415.755 416.246 416.229 416.447 416.873 416.608L418.492 417.006C419.468 417.242 420.194 417.605 420.673 418.092C421.151 418.575 421.39 419.198 421.39 419.96C421.39 420.585 421.21 421.144 420.85 421.636C420.495 422.129 419.998 422.517 419.359 422.801C418.719 423.085 417.976 423.227 417.129 423.227C416.016 423.227 415.095 422.986 414.366 422.503C413.637 422.02 413.175 421.314 412.981 420.386L414.572 419.989C414.723 420.576 415.01 421.016 415.431 421.31C415.857 421.603 416.414 421.75 417.1 421.75C417.881 421.75 418.502 421.584 418.961 421.253C419.425 420.917 419.657 420.514 419.657 420.045C419.657 419.667 419.524 419.349 419.259 419.094C418.994 418.833 418.587 418.639 418.038 418.511L416.219 418.085C415.22 417.848 414.487 417.482 414.018 416.984C413.554 416.482 413.322 415.855 413.322 415.102C413.322 414.487 413.495 413.942 413.84 413.469C414.191 412.995 414.666 412.624 415.268 412.354C415.874 412.084 416.56 411.949 417.327 411.949C418.407 411.949 419.254 412.186 419.87 412.659C420.49 413.133 420.931 413.758 421.191 414.534ZM433.97 423.227C432.947 423.227 432.066 422.986 431.328 422.503C430.589 422.02 430.021 421.355 429.623 420.507C429.225 419.66 429.027 418.691 429.027 417.602C429.027 416.494 429.23 415.517 429.637 414.669C430.049 413.817 430.622 413.152 431.356 412.673C432.095 412.19 432.957 411.949 433.941 411.949C434.708 411.949 435.4 412.091 436.015 412.375C436.631 412.659 437.135 413.057 437.528 413.568C437.921 414.08 438.165 414.676 438.26 415.358H436.583C436.456 414.861 436.172 414.42 435.731 414.037C435.296 413.649 434.708 413.455 433.97 413.455C433.316 413.455 432.743 413.625 432.251 413.966C431.763 414.302 431.382 414.778 431.108 415.393C430.838 416.004 430.703 416.722 430.703 417.545C430.703 418.388 430.835 419.122 431.1 419.747C431.37 420.372 431.749 420.857 432.237 421.203C432.729 421.549 433.307 421.722 433.97 421.722C434.405 421.722 434.801 421.646 435.156 421.494C435.511 421.343 435.812 421.125 436.058 420.841C436.304 420.557 436.479 420.216 436.583 419.818H438.26C438.165 420.462 437.931 421.042 437.556 421.558C437.187 422.07 436.697 422.477 436.086 422.78C435.48 423.078 434.775 423.227 433.97 423.227ZM443.92 423.256C443.229 423.256 442.601 423.125 442.038 422.865C441.475 422.6 441.027 422.219 440.696 421.722C440.364 421.22 440.199 420.614 440.199 419.903C440.199 419.278 440.322 418.772 440.568 418.384C440.814 417.991 441.143 417.683 441.555 417.46C441.967 417.238 442.422 417.072 442.919 416.963C443.421 416.849 443.925 416.759 444.431 416.693C445.094 416.608 445.632 416.544 446.044 416.501C446.46 416.454 446.763 416.376 446.953 416.267C447.147 416.158 447.244 415.969 447.244 415.699V415.642C447.244 414.941 447.052 414.397 446.669 414.009C446.29 413.62 445.715 413.426 444.943 413.426C444.143 413.426 443.515 413.601 443.061 413.952C442.606 414.302 442.287 414.676 442.102 415.074L440.511 414.506C440.795 413.843 441.174 413.327 441.647 412.957C442.126 412.583 442.646 412.323 443.21 412.176C443.778 412.025 444.337 411.949 444.886 411.949C445.236 411.949 445.639 411.991 446.093 412.077C446.553 412.157 446.995 412.325 447.422 412.581C447.852 412.837 448.21 413.223 448.494 413.739C448.778 414.255 448.92 414.946 448.92 415.812V423H447.244V421.523H447.159C447.045 421.759 446.856 422.013 446.591 422.283C446.325 422.553 445.973 422.782 445.532 422.972C445.092 423.161 444.555 423.256 443.92 423.256ZM444.176 421.75C444.839 421.75 445.397 421.62 445.852 421.359C446.311 421.099 446.657 420.763 446.889 420.351C447.126 419.939 447.244 419.506 447.244 419.051V417.517C447.173 417.602 447.017 417.68 446.775 417.751C446.538 417.818 446.264 417.877 445.951 417.929C445.644 417.976 445.343 418.019 445.049 418.057C444.761 418.09 444.526 418.118 444.346 418.142C443.911 418.199 443.503 418.291 443.125 418.419C442.751 418.542 442.448 418.729 442.216 418.98C441.988 419.226 441.875 419.562 441.875 419.989C441.875 420.571 442.09 421.011 442.521 421.31C442.957 421.603 443.508 421.75 444.176 421.75ZM453.656 416.438V423H451.979V412.091H453.599V413.795H453.741C453.996 413.241 454.385 412.796 454.906 412.46C455.426 412.119 456.099 411.949 456.923 411.949C457.661 411.949 458.308 412.1 458.862 412.403C459.415 412.702 459.846 413.156 460.154 413.767C460.462 414.373 460.616 415.14 460.616 416.068V423H458.94V416.182C458.94 415.325 458.717 414.657 458.272 414.179C457.827 413.696 457.216 413.455 456.44 413.455C455.905 413.455 455.426 413.571 455.005 413.803C454.588 414.035 454.259 414.373 454.018 414.818C453.776 415.263 453.656 415.803 453.656 416.438ZM477.031 414.534L475.525 414.96C475.431 414.709 475.291 414.465 475.106 414.229C474.926 413.987 474.68 413.788 474.368 413.632C474.055 413.476 473.655 413.398 473.167 413.398C472.5 413.398 471.943 413.552 471.498 413.859C471.058 414.162 470.838 414.548 470.838 415.017C470.838 415.434 470.989 415.763 471.292 416.004C471.595 416.246 472.069 416.447 472.713 416.608L474.332 417.006C475.307 417.242 476.034 417.605 476.512 418.092C476.991 418.575 477.23 419.198 477.23 419.96C477.23 420.585 477.05 421.144 476.69 421.636C476.335 422.129 475.838 422.517 475.199 422.801C474.559 423.085 473.816 423.227 472.968 423.227C471.856 423.227 470.935 422.986 470.206 422.503C469.476 422.02 469.015 421.314 468.821 420.386L470.412 419.989C470.563 420.576 470.85 421.016 471.271 421.31C471.697 421.603 472.253 421.75 472.94 421.75C473.721 421.75 474.342 421.584 474.801 421.253C475.265 420.917 475.497 420.514 475.497 420.045C475.497 419.667 475.364 419.349 475.099 419.094C474.834 418.833 474.427 418.639 473.877 418.511L472.059 418.085C471.06 417.848 470.326 417.482 469.858 416.984C469.394 416.482 469.162 415.855 469.162 415.102C469.162 414.487 469.334 413.942 469.68 413.469C470.03 412.995 470.506 412.624 471.108 412.354C471.714 412.084 472.4 411.949 473.167 411.949C474.247 411.949 475.094 412.186 475.71 412.659C476.33 413.133 476.77 413.758 477.031 414.534ZM484.327 423.227C483.276 423.227 482.369 422.995 481.607 422.531C480.849 422.062 480.264 421.409 479.852 420.571C479.445 419.728 479.241 418.748 479.241 417.631C479.241 416.513 479.445 415.528 479.852 414.676C480.264 413.819 480.837 413.152 481.571 412.673C482.31 412.19 483.171 411.949 484.156 411.949C484.724 411.949 485.286 412.044 485.839 412.233C486.393 412.422 486.898 412.73 487.352 413.156C487.807 413.578 488.169 414.136 488.439 414.832C488.709 415.528 488.844 416.385 488.844 417.403V418.114H480.435V416.665H487.139C487.139 416.049 487.016 415.5 486.77 415.017C486.528 414.534 486.183 414.153 485.733 413.874C485.288 413.594 484.762 413.455 484.156 413.455C483.489 413.455 482.911 413.62 482.423 413.952C481.94 414.278 481.569 414.705 481.308 415.23C481.048 415.756 480.918 416.319 480.918 416.92V417.886C480.918 418.71 481.06 419.409 481.344 419.982C481.633 420.55 482.033 420.983 482.544 421.281C483.055 421.575 483.65 421.722 484.327 421.722C484.767 421.722 485.165 421.66 485.52 421.537C485.88 421.409 486.19 421.22 486.45 420.969C486.711 420.713 486.912 420.396 487.054 420.017L488.673 420.472C488.503 421.021 488.216 421.504 487.814 421.92C487.411 422.332 486.914 422.654 486.322 422.886C485.731 423.114 485.065 423.227 484.327 423.227ZM495.967 423.227C494.916 423.227 494.009 422.995 493.247 422.531C492.49 422.062 491.905 421.409 491.493 420.571C491.086 419.728 490.882 418.748 490.882 417.631C490.882 416.513 491.086 415.528 491.493 414.676C491.905 413.819 492.478 413.152 493.212 412.673C493.95 412.19 494.812 411.949 495.797 411.949C496.365 411.949 496.926 412.044 497.48 412.233C498.034 412.422 498.538 412.73 498.993 413.156C499.447 413.578 499.81 414.136 500.08 414.832C500.349 415.528 500.484 416.385 500.484 417.403V418.114H492.075V416.665H498.78C498.78 416.049 498.657 415.5 498.411 415.017C498.169 414.534 497.823 414.153 497.374 413.874C496.929 413.594 496.403 413.455 495.797 413.455C495.129 413.455 494.552 413.62 494.064 413.952C493.581 414.278 493.209 414.705 492.949 415.23C492.688 415.756 492.558 416.319 492.558 416.92V417.886C492.558 418.71 492.7 419.409 492.984 419.982C493.273 420.55 493.673 420.983 494.185 421.281C494.696 421.575 495.29 421.722 495.967 421.722C496.408 421.722 496.805 421.66 497.161 421.537C497.52 421.409 497.83 421.22 498.091 420.969C498.351 420.713 498.553 420.396 498.695 420.017L500.314 420.472C500.143 421.021 499.857 421.504 499.455 421.92C499.052 422.332 498.555 422.654 497.963 422.886C497.371 423.114 496.706 423.227 495.967 423.227ZM511.869 423.256C511.178 423.256 510.551 423.125 509.987 422.865C509.424 422.6 508.976 422.219 508.645 421.722C508.313 421.22 508.148 420.614 508.148 419.903C508.148 419.278 508.271 418.772 508.517 418.384C508.763 417.991 509.092 417.683 509.504 417.46C509.916 417.238 510.371 417.072 510.868 416.963C511.37 416.849 511.874 416.759 512.381 416.693C513.044 416.608 513.581 416.544 513.993 416.501C514.41 416.454 514.713 416.376 514.902 416.267C515.096 416.158 515.193 415.969 515.193 415.699V415.642C515.193 414.941 515.001 414.397 514.618 414.009C514.239 413.62 513.664 413.426 512.892 413.426C512.092 413.426 511.464 413.601 511.01 413.952C510.555 414.302 510.236 414.676 510.051 415.074L508.46 414.506C508.744 413.843 509.123 413.327 509.597 412.957C510.075 412.583 510.596 412.323 511.159 412.176C511.727 412.025 512.286 411.949 512.835 411.949C513.186 411.949 513.588 411.991 514.043 412.077C514.502 412.157 514.945 412.325 515.371 412.581C515.802 412.837 516.159 413.223 516.443 413.739C516.727 414.255 516.869 414.946 516.869 415.812V423H515.193V421.523H515.108C514.994 421.759 514.805 422.013 514.54 422.283C514.275 422.553 513.922 422.782 513.482 422.972C513.041 423.161 512.504 423.256 511.869 423.256ZM512.125 421.75C512.788 421.75 513.347 421.62 513.801 421.359C514.26 421.099 514.606 420.763 514.838 420.351C515.075 419.939 515.193 419.506 515.193 419.051V417.517C515.122 417.602 514.966 417.68 514.724 417.751C514.488 417.818 514.213 417.877 513.901 417.929C513.593 417.976 513.292 418.019 512.999 418.057C512.71 418.09 512.475 418.118 512.295 418.142C511.86 418.199 511.453 418.291 511.074 418.419C510.7 418.542 510.397 418.729 510.165 418.98C509.938 419.226 509.824 419.562 509.824 419.989C509.824 420.571 510.039 421.011 510.47 421.31C510.906 421.603 511.457 421.75 512.125 421.75ZM521.605 416.438V423H519.929V412.091H521.548V413.795H521.69C521.946 413.241 522.334 412.796 522.855 412.46C523.376 412.119 524.048 411.949 524.872 411.949C525.61 411.949 526.257 412.1 526.811 412.403C527.365 412.702 527.796 413.156 528.103 413.767C528.411 414.373 528.565 415.14 528.565 416.068V423H526.889V416.182C526.889 415.325 526.666 414.657 526.221 414.179C525.776 413.696 525.165 413.455 524.389 413.455C523.854 413.455 523.376 413.571 522.954 413.803C522.538 414.035 522.208 414.373 521.967 414.818C521.725 415.263 521.605 415.803 521.605 416.438ZM535.747 423.227C534.838 423.227 534.036 422.998 533.339 422.538C532.643 422.074 532.099 421.421 531.706 420.578C531.313 419.731 531.116 418.729 531.116 417.574C531.116 416.428 531.313 415.434 531.706 414.591C532.099 413.748 532.646 413.097 533.347 412.638C534.047 412.179 534.857 411.949 535.776 411.949C536.486 411.949 537.047 412.067 537.459 412.304C537.875 412.536 538.193 412.801 538.411 413.099C538.633 413.393 538.806 413.634 538.929 413.824H539.071V408.455H540.747V423H539.128V421.324H538.929C538.806 421.523 538.631 421.774 538.403 422.077C538.176 422.375 537.852 422.643 537.43 422.879C537.009 423.111 536.448 423.227 535.747 423.227ZM535.974 421.722C536.647 421.722 537.215 421.546 537.679 421.196C538.143 420.841 538.496 420.351 538.737 419.726C538.979 419.096 539.099 418.369 539.099 417.545C539.099 416.731 538.981 416.018 538.744 415.408C538.508 414.792 538.157 414.314 537.693 413.973C537.229 413.627 536.656 413.455 535.974 413.455C535.264 413.455 534.672 413.637 534.199 414.001C533.73 414.361 533.377 414.851 533.141 415.472C532.909 416.087 532.793 416.778 532.793 417.545C532.793 418.322 532.911 419.027 533.148 419.662C533.389 420.292 533.744 420.794 534.213 421.168C534.687 421.537 535.274 421.722 535.974 421.722ZM554.107 423.227C553.084 423.227 552.203 422.986 551.464 422.503C550.726 422.02 550.158 421.355 549.76 420.507C549.362 419.66 549.163 418.691 549.163 417.602C549.163 416.494 549.367 415.517 549.774 414.669C550.186 413.817 550.759 413.152 551.493 412.673C552.232 412.19 553.093 411.949 554.078 411.949C554.845 411.949 555.536 412.091 556.152 412.375C556.768 412.659 557.272 413.057 557.665 413.568C558.058 414.08 558.302 414.676 558.396 415.358H556.72C556.592 414.861 556.308 414.42 555.868 414.037C555.432 413.649 554.845 413.455 554.107 413.455C553.453 413.455 552.88 413.625 552.388 413.966C551.9 414.302 551.519 414.778 551.244 415.393C550.974 416.004 550.839 416.722 550.839 417.545C550.839 418.388 550.972 419.122 551.237 419.747C551.507 420.372 551.886 420.857 552.374 421.203C552.866 421.549 553.444 421.722 554.107 421.722C554.542 421.722 554.938 421.646 555.293 421.494C555.648 421.343 555.948 421.125 556.195 420.841C556.441 420.557 556.616 420.216 556.72 419.818H558.396C558.302 420.462 558.067 421.042 557.693 421.558C557.324 422.07 556.834 422.477 556.223 422.78C555.617 423.078 554.911 423.227 554.107 423.227ZM565.278 423.227C564.294 423.227 563.429 422.993 562.686 422.524C561.947 422.055 561.37 421.4 560.953 420.557C560.541 419.714 560.335 418.729 560.335 417.602C560.335 416.466 560.541 415.474 560.953 414.626C561.37 413.779 561.947 413.121 562.686 412.652C563.429 412.183 564.294 411.949 565.278 411.949C566.263 411.949 567.125 412.183 567.864 412.652C568.607 413.121 569.185 413.779 569.597 414.626C570.013 415.474 570.222 416.466 570.222 417.602C570.222 418.729 570.013 419.714 569.597 420.557C569.185 421.4 568.607 422.055 567.864 422.524C567.125 422.993 566.263 423.227 565.278 423.227ZM565.278 421.722C566.027 421.722 566.642 421.53 567.125 421.146C567.608 420.763 567.965 420.259 568.197 419.634C568.429 419.009 568.545 418.331 568.545 417.602C568.545 416.873 568.429 416.194 568.197 415.564C567.965 414.934 567.608 414.425 567.125 414.037C566.642 413.649 566.027 413.455 565.278 413.455C564.53 413.455 563.915 413.649 563.432 414.037C562.949 414.425 562.591 414.934 562.359 415.564C562.127 416.194 562.011 416.873 562.011 417.602C562.011 418.331 562.127 419.009 562.359 419.634C562.591 420.259 562.949 420.763 563.432 421.146C563.915 421.53 564.53 421.722 565.278 421.722ZM574.456 416.438V423H572.78V412.091H574.4V413.795H574.542C574.797 413.241 575.185 412.796 575.706 412.46C576.227 412.119 576.9 411.949 577.723 411.949C578.462 411.949 579.108 412.1 579.662 412.403C580.216 412.702 580.647 413.156 580.955 413.767C581.263 414.373 581.417 415.14 581.417 416.068V423H579.74V416.182C579.74 415.325 579.518 414.657 579.073 414.179C578.628 413.696 578.017 413.455 577.24 413.455C576.705 413.455 576.227 413.571 575.806 413.803C575.389 414.035 575.06 414.373 574.819 414.818C574.577 415.263 574.456 415.803 574.456 416.438ZM589.224 412.091V413.511H583.57V412.091H589.224ZM585.218 409.477H586.894V419.875C586.894 420.348 586.963 420.704 587.1 420.94C587.242 421.172 587.422 421.329 587.64 421.409C587.862 421.485 588.097 421.523 588.343 421.523C588.528 421.523 588.679 421.513 588.798 421.494C588.916 421.471 589.011 421.452 589.082 421.438L589.423 422.943C589.309 422.986 589.15 423.028 588.947 423.071C588.743 423.118 588.485 423.142 588.173 423.142C587.699 423.142 587.235 423.04 586.781 422.837C586.331 422.633 585.957 422.323 585.658 421.906C585.365 421.49 585.218 420.964 585.218 420.33V409.477ZM591.745 423V412.091H593.364V413.739H593.478C593.677 413.199 594.037 412.761 594.558 412.425C595.078 412.089 595.665 411.92 596.319 411.92C596.442 411.92 596.596 411.923 596.781 411.928C596.965 411.932 597.105 411.939 597.2 411.949V413.653C597.143 413.639 597.013 413.618 596.809 413.589C596.61 413.556 596.399 413.54 596.177 413.54C595.647 413.54 595.173 413.651 594.756 413.874C594.344 414.091 594.018 414.394 593.776 414.783C593.54 415.166 593.421 415.604 593.421 416.097V423H591.745ZM603.286 423.227C602.301 423.227 601.437 422.993 600.694 422.524C599.955 422.055 599.378 421.4 598.961 420.557C598.549 419.714 598.343 418.729 598.343 417.602C598.343 416.466 598.549 415.474 598.961 414.626C599.378 413.779 599.955 413.121 600.694 412.652C601.437 412.183 602.301 411.949 603.286 411.949C604.271 411.949 605.133 412.183 605.871 412.652C606.615 413.121 607.192 413.779 607.604 414.626C608.021 415.474 608.229 416.466 608.229 417.602C608.229 418.729 608.021 419.714 607.604 420.557C607.192 421.4 606.615 422.055 605.871 422.524C605.133 422.993 604.271 423.227 603.286 423.227ZM603.286 421.722C604.034 421.722 604.65 421.53 605.133 421.146C605.616 420.763 605.973 420.259 606.205 419.634C606.437 419.009 606.553 418.331 606.553 417.602C606.553 416.873 606.437 416.194 606.205 415.564C605.973 414.934 605.616 414.425 605.133 414.037C604.65 413.649 604.034 413.455 603.286 413.455C602.538 413.455 601.923 413.649 601.44 414.037C600.957 414.425 600.599 414.934 600.367 415.564C600.135 416.194 600.019 416.873 600.019 417.602C600.019 418.331 600.135 419.009 600.367 419.634C600.599 420.259 600.957 420.763 601.44 421.146C601.923 421.53 602.538 421.722 603.286 421.722ZM612.464 408.455V423H610.788V408.455H612.464Z" fill="#03031C"/>
+<path d="M832.911 378.455V393H831.206L823.28 381.58H823.138V393H821.377V378.455H823.081L831.036 389.903H831.178V378.455H832.911ZM840.64 393.227C839.655 393.227 838.791 392.993 838.047 392.524C837.309 392.055 836.731 391.4 836.314 390.557C835.903 389.714 835.697 388.729 835.697 387.602C835.697 386.466 835.903 385.474 836.314 384.626C836.731 383.779 837.309 383.121 838.047 382.652C838.791 382.183 839.655 381.949 840.64 381.949C841.625 381.949 842.486 382.183 843.225 382.652C843.968 383.121 844.546 383.779 844.958 384.626C845.375 385.474 845.583 386.466 845.583 387.602C845.583 388.729 845.375 389.714 844.958 390.557C844.546 391.4 843.968 392.055 843.225 392.524C842.486 392.993 841.625 393.227 840.64 393.227ZM840.64 391.722C841.388 391.722 842.003 391.53 842.486 391.146C842.969 390.763 843.327 390.259 843.559 389.634C843.791 389.009 843.907 388.331 843.907 387.602C843.907 386.873 843.791 386.194 843.559 385.564C843.327 384.934 842.969 384.425 842.486 384.037C842.003 383.649 841.388 383.455 840.64 383.455C839.892 383.455 839.276 383.649 838.793 384.037C838.31 384.425 837.953 384.934 837.721 385.564C837.489 386.194 837.373 386.873 837.373 387.602C837.373 388.331 837.489 389.009 837.721 389.634C837.953 390.259 838.31 390.763 838.793 391.146C839.276 391.53 839.892 391.722 840.64 391.722ZM856.977 393.256C856.285 393.256 855.658 393.125 855.095 392.865C854.531 392.6 854.084 392.219 853.752 391.722C853.421 391.22 853.255 390.614 853.255 389.903C853.255 389.278 853.378 388.772 853.624 388.384C853.871 387.991 854.2 387.683 854.612 387.46C855.024 387.238 855.478 387.072 855.975 386.963C856.477 386.849 856.981 386.759 857.488 386.693C858.151 386.608 858.688 386.544 859.1 386.501C859.517 386.454 859.82 386.376 860.009 386.267C860.204 386.158 860.301 385.969 860.301 385.699V385.642C860.301 384.941 860.109 384.397 859.725 384.009C859.347 383.62 858.771 383.426 857.999 383.426C857.199 383.426 856.572 383.601 856.117 383.952C855.663 384.302 855.343 384.676 855.159 385.074L853.568 384.506C853.852 383.843 854.231 383.327 854.704 382.957C855.182 382.583 855.703 382.323 856.267 382.176C856.835 382.025 857.393 381.949 857.943 381.949C858.293 381.949 858.695 381.991 859.15 382.077C859.609 382.157 860.052 382.325 860.478 382.581C860.909 382.837 861.267 383.223 861.551 383.739C861.835 384.255 861.977 384.946 861.977 385.812V393H860.301V391.523H860.215C860.102 391.759 859.912 392.013 859.647 392.283C859.382 392.553 859.029 392.782 858.589 392.972C858.149 393.161 857.611 393.256 856.977 393.256ZM857.232 391.75C857.895 391.75 858.454 391.62 858.909 391.359C859.368 391.099 859.713 390.763 859.945 390.351C860.182 389.939 860.301 389.506 860.301 389.051V387.517C860.23 387.602 860.073 387.68 859.832 387.751C859.595 387.818 859.32 387.877 859.008 387.929C858.7 387.976 858.4 388.019 858.106 388.057C857.817 388.09 857.583 388.118 857.403 388.142C856.967 388.199 856.56 388.291 856.181 388.419C855.807 388.542 855.504 388.729 855.272 388.98C855.045 389.226 854.931 389.562 854.931 389.989C854.931 390.571 855.147 391.011 855.578 391.31C856.013 391.603 856.565 391.75 857.232 391.75ZM869.468 393.227C868.445 393.227 867.564 392.986 866.826 392.503C866.087 392.02 865.519 391.355 865.121 390.507C864.724 389.66 864.525 388.691 864.525 387.602C864.525 386.494 864.728 385.517 865.135 384.669C865.547 383.817 866.12 383.152 866.854 382.673C867.593 382.19 868.455 381.949 869.439 381.949C870.206 381.949 870.898 382.091 871.513 382.375C872.129 382.659 872.633 383.057 873.026 383.568C873.419 384.08 873.663 384.676 873.758 385.358H872.081C871.954 384.861 871.67 384.42 871.229 384.037C870.794 383.649 870.206 383.455 869.468 383.455C868.814 383.455 868.242 383.625 867.749 383.966C867.261 384.302 866.88 384.778 866.606 385.393C866.336 386.004 866.201 386.722 866.201 387.545C866.201 388.388 866.333 389.122 866.599 389.747C866.868 390.372 867.247 390.857 867.735 391.203C868.227 391.549 868.805 391.722 869.468 391.722C869.903 391.722 870.299 391.646 870.654 391.494C871.009 391.343 871.31 391.125 871.556 390.841C871.802 390.557 871.977 390.216 872.081 389.818H873.758C873.663 390.462 873.429 391.042 873.055 391.558C872.685 392.07 872.195 392.477 871.584 392.78C870.978 393.078 870.273 393.227 869.468 393.227ZM880.64 393.227C879.617 393.227 878.736 392.986 877.998 392.503C877.259 392.02 876.691 391.355 876.293 390.507C875.895 389.66 875.697 388.691 875.697 387.602C875.697 386.494 875.9 385.517 876.307 384.669C876.719 383.817 877.292 383.152 878.026 382.673C878.765 382.19 879.626 381.949 880.611 381.949C881.378 381.949 882.07 382.091 882.685 382.375C883.301 382.659 883.805 383.057 884.198 383.568C884.591 384.08 884.835 384.676 884.93 385.358H883.253C883.126 384.861 882.841 384.42 882.401 384.037C881.965 383.649 881.378 383.455 880.64 383.455C879.986 383.455 879.413 383.625 878.921 383.966C878.433 384.302 878.052 384.778 877.778 385.393C877.508 386.004 877.373 386.722 877.373 387.545C877.373 388.388 877.505 389.122 877.77 389.747C878.04 390.372 878.419 390.857 878.907 391.203C879.399 391.549 879.977 391.722 880.64 391.722C881.075 391.722 881.471 391.646 881.826 391.494C882.181 391.343 882.482 391.125 882.728 390.841C882.974 390.557 883.149 390.216 883.253 389.818H884.93C884.835 390.462 884.6 391.042 884.226 391.558C883.857 392.07 883.367 392.477 882.756 392.78C882.15 393.078 881.445 393.227 880.64 393.227ZM891.954 393.227C890.903 393.227 889.996 392.995 889.233 392.531C888.476 392.062 887.891 391.409 887.479 390.571C887.072 389.728 886.868 388.748 886.868 387.631C886.868 386.513 887.072 385.528 887.479 384.676C887.891 383.819 888.464 383.152 889.198 382.673C889.937 382.19 890.798 381.949 891.783 381.949C892.351 381.949 892.912 382.044 893.466 382.233C894.02 382.422 894.525 382.73 894.979 383.156C895.434 383.578 895.796 384.136 896.066 384.832C896.336 385.528 896.471 386.385 896.471 387.403V388.114H888.062V386.665H894.766C894.766 386.049 894.643 385.5 894.397 385.017C894.155 384.534 893.81 384.153 893.36 383.874C892.915 383.594 892.389 383.455 891.783 383.455C891.116 383.455 890.538 383.62 890.05 383.952C889.567 384.278 889.196 384.705 888.935 385.23C888.675 385.756 888.545 386.319 888.545 386.92V387.886C888.545 388.71 888.687 389.409 888.971 389.982C889.26 390.55 889.66 390.983 890.171 391.281C890.682 391.575 891.277 391.722 891.954 391.722C892.394 391.722 892.792 391.66 893.147 391.537C893.507 391.409 893.817 391.22 894.077 390.969C894.338 390.713 894.539 390.396 894.681 390.017L896.3 390.472C896.13 391.021 895.843 391.504 895.441 391.92C895.038 392.332 894.541 392.654 893.949 392.886C893.358 393.114 892.692 393.227 891.954 393.227ZM906.748 384.534L905.242 384.96C905.147 384.709 905.008 384.465 904.823 384.229C904.643 383.987 904.397 383.788 904.084 383.632C903.772 383.476 903.372 383.398 902.884 383.398C902.216 383.398 901.66 383.552 901.215 383.859C900.775 384.162 900.555 384.548 900.555 385.017C900.555 385.434 900.706 385.763 901.009 386.004C901.312 386.246 901.786 386.447 902.43 386.608L904.049 387.006C905.024 387.242 905.751 387.605 906.229 388.092C906.707 388.575 906.947 389.198 906.947 389.96C906.947 390.585 906.767 391.144 906.407 391.636C906.052 392.129 905.555 392.517 904.915 392.801C904.276 393.085 903.533 393.227 902.685 393.227C901.573 393.227 900.652 392.986 899.922 392.503C899.193 392.02 898.732 391.314 898.537 390.386L900.128 389.989C900.28 390.576 900.566 391.016 900.988 391.31C901.414 391.603 901.97 391.75 902.657 391.75C903.438 391.75 904.058 391.584 904.518 391.253C904.982 390.917 905.214 390.514 905.214 390.045C905.214 389.667 905.081 389.349 904.816 389.094C904.551 388.833 904.144 388.639 903.594 388.511L901.776 388.085C900.777 387.848 900.043 387.482 899.574 386.984C899.11 386.482 898.878 385.855 898.878 385.102C898.878 384.487 899.051 383.942 899.397 383.469C899.747 382.995 900.223 382.624 900.824 382.354C901.43 382.084 902.117 381.949 902.884 381.949C903.964 381.949 904.811 382.186 905.427 382.659C906.047 383.133 906.487 383.758 906.748 384.534ZM917.197 384.534L915.691 384.96C915.597 384.709 915.457 384.465 915.272 384.229C915.092 383.987 914.846 383.788 914.534 383.632C914.221 383.476 913.821 383.398 913.333 383.398C912.666 383.398 912.109 383.552 911.664 383.859C911.224 384.162 911.004 384.548 911.004 385.017C911.004 385.434 911.155 385.763 911.458 386.004C911.761 386.246 912.235 386.447 912.879 386.608L914.498 387.006C915.473 387.242 916.2 387.605 916.678 388.092C917.157 388.575 917.396 389.198 917.396 389.96C917.396 390.585 917.216 391.144 916.856 391.636C916.501 392.129 916.004 392.517 915.365 392.801C914.725 393.085 913.982 393.227 913.134 393.227C912.022 393.227 911.101 392.986 910.372 392.503C909.642 392.02 909.181 391.314 908.987 390.386L910.578 389.989C910.729 390.576 911.016 391.016 911.437 391.31C911.863 391.603 912.419 391.75 913.106 391.75C913.887 391.75 914.508 391.584 914.967 391.253C915.431 390.917 915.663 390.514 915.663 390.045C915.663 389.667 915.53 389.349 915.265 389.094C915 388.833 914.593 388.639 914.044 388.511L912.225 388.085C911.226 387.848 910.492 387.482 910.024 386.984C909.56 386.482 909.328 385.855 909.328 385.102C909.328 384.487 909.5 383.942 909.846 383.469C910.196 382.995 910.672 382.624 911.274 382.354C911.88 382.084 912.566 381.949 913.333 381.949C914.413 381.949 915.26 382.186 915.876 382.659C916.496 383.133 916.936 383.758 917.197 384.534Z" fill="#EA26A9"/>
+<path d="M693.281 636.127C693.132 636.387 693.021 636.759 693.021 637.168V641.89C696.033 644.12 699.528 645.273 703.246 645.273C707.67 645.273 711.128 643.6 713.47 641.89V637.168C713.47 636.759 713.396 636.387 713.21 636.127C710.347 638.915 706.889 640.514 703.208 640.514C699.602 640.551 696.144 638.915 693.281 636.127Z" fill="#5900CB"/>
+<path d="M665.99 683.644C665.841 683.904 665.73 684.276 665.73 684.685V689.407C668.742 691.638 672.237 692.791 675.955 692.791C680.379 692.791 683.837 691.117 686.179 689.407V684.685C686.179 684.276 686.105 683.904 685.919 683.644C683.056 686.433 679.598 688.031 675.917 688.031C672.311 688.069 668.853 686.433 665.99 683.644Z" fill="#5900CB"/>
+<path d="M720.646 683.644C720.498 683.904 720.386 684.276 720.386 684.685V689.407C723.398 691.638 726.893 692.791 730.611 692.791C735.036 692.791 738.493 691.117 740.836 689.407V684.685C740.836 684.276 740.761 683.904 740.576 683.644C737.713 686.433 734.255 688.031 730.574 688.031C726.967 688.069 723.509 686.433 720.646 683.644Z" fill="#5900CB"/>
+<path d="M703.32 664.682L693.653 674.349" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M703.32 654.011V664.681L712.876 674.237" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M681.086 674.907C681.086 674.907 686.18 677.695 688.187 679.294C688.671 679.666 689.042 680.149 689.377 680.67C689.972 681.636 690.269 682.752 690.269 683.867V690.523C686.44 693.869 681.458 696.025 675.955 696.025C670.378 696.025 665.47 693.943 661.64 690.485V683.83C661.64 682.715 661.9 681.562 662.532 680.632C662.867 680.112 663.239 679.666 663.722 679.257C665.693 677.658 670.824 674.869 670.824 674.869" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M675.955 677.584C679.938 677.584 683.168 673.572 683.168 668.623C683.168 663.674 679.938 659.662 675.955 659.662C671.971 659.662 668.741 663.674 668.741 668.623C668.741 673.572 671.971 677.584 675.955 677.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M735.816 674.907C735.816 674.907 740.91 677.695 742.918 679.294C743.401 679.666 743.773 680.149 744.108 680.67C744.703 681.636 745 682.752 745 683.867V690.523C741.17 693.906 736.188 696.063 730.685 696.063C725.108 696.063 720.2 693.981 716.371 690.523V683.867C716.371 682.752 716.631 681.599 717.263 680.67C717.598 680.149 717.969 679.703 718.453 679.294C720.423 677.695 725.554 674.907 725.554 674.907" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M730.648 677.584C734.632 677.584 737.861 673.572 737.861 668.623C737.861 663.674 734.632 659.662 730.648 659.662C726.664 659.662 723.435 663.674 723.435 668.623C723.435 673.572 726.664 677.584 730.648 677.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M708.414 628.244C708.414 628.244 713.508 631.033 715.515 632.632C715.999 633.003 716.37 633.487 716.705 634.007C717.3 634.974 717.597 636.089 717.597 637.205V643.86C713.768 647.244 708.786 649.4 703.283 649.4C697.706 649.4 692.798 647.318 688.968 643.86V637.168C688.968 636.052 689.228 634.9 689.86 633.97C690.195 633.45 690.567 633.003 691.05 632.594C693.021 630.996 698.152 628.207 698.152 628.207" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M703.283 630.921C707.266 630.921 710.496 626.909 710.496 621.961C710.496 617.012 707.266 613 703.283 613C699.299 613 696.07 617.012 696.07 621.961C696.07 626.909 699.299 630.921 703.283 630.921Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M194.641 636.127C194.492 636.387 194.381 636.759 194.381 637.168V641.89C197.393 644.12 200.888 645.273 204.606 645.273C209.03 645.273 212.488 643.6 214.83 641.89V637.168C214.83 636.759 214.756 636.387 214.57 636.127C211.707 638.915 208.249 640.514 204.568 640.514C200.962 640.551 197.504 638.915 194.641 636.127Z" fill="#00A3A0"/>
+<path d="M167.35 683.644C167.201 683.904 167.09 684.276 167.09 684.685V689.407C170.102 691.638 173.597 692.791 177.315 692.791C181.739 692.791 185.197 691.117 187.539 689.407V684.685C187.539 684.276 187.465 683.904 187.279 683.644C184.416 686.433 180.958 688.031 177.277 688.031C173.671 688.069 170.213 686.433 167.35 683.644Z" fill="#00A3A0"/>
+<path d="M222.006 683.644C221.858 683.904 221.746 684.276 221.746 684.685V689.407C224.758 691.638 228.253 692.791 231.971 692.791C236.396 692.791 239.853 691.117 242.196 689.407V684.685C242.196 684.276 242.121 683.904 241.936 683.644C239.073 686.433 235.615 688.031 231.934 688.031C228.327 688.069 224.869 686.433 222.006 683.644Z" fill="#00A3A0"/>
+<path d="M204.68 664.682L195.013 674.349" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M204.68 654.011V664.681L214.235 674.237" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M182.446 674.907C182.446 674.907 187.54 677.695 189.547 679.294C190.031 679.666 190.402 680.149 190.737 680.67C191.332 681.636 191.629 682.752 191.629 683.867V690.523C187.8 693.869 182.818 696.025 177.315 696.025C171.738 696.025 166.83 693.943 163 690.485V683.83C163 682.715 163.26 681.562 163.892 680.632C164.227 680.112 164.599 679.666 165.082 679.257C167.053 677.658 172.184 674.869 172.184 674.869" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M177.315 677.584C181.298 677.584 184.528 673.572 184.528 668.623C184.528 663.674 181.298 659.662 177.315 659.662C173.331 659.662 170.101 663.674 170.101 668.623C170.101 673.572 173.331 677.584 177.315 677.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M237.176 674.907C237.176 674.907 242.27 677.695 244.278 679.294C244.761 679.666 245.133 680.149 245.468 680.67C246.063 681.636 246.36 682.752 246.36 683.867V690.523C242.53 693.906 237.548 696.063 232.045 696.063C226.468 696.063 221.56 693.981 217.731 690.523V683.867C217.731 682.752 217.991 681.599 218.623 680.67C218.958 680.149 219.329 679.703 219.813 679.294C221.783 677.695 226.914 674.907 226.914 674.907" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M232.008 677.584C235.992 677.584 239.221 673.572 239.221 668.623C239.221 663.674 235.992 659.662 232.008 659.662C228.024 659.662 224.795 663.674 224.795 668.623C224.795 673.572 228.024 677.584 232.008 677.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M209.774 628.244C209.774 628.244 214.868 631.033 216.875 632.632C217.359 633.003 217.73 633.487 218.065 634.007C218.66 634.974 218.957 636.089 218.957 637.205V643.86C215.128 647.244 210.146 649.4 204.643 649.4C199.066 649.4 194.158 647.318 190.328 643.86V637.168C190.328 636.052 190.588 634.9 191.22 633.97C191.555 633.45 191.927 633.003 192.41 632.594C194.381 630.996 199.512 628.207 199.512 628.207" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M204.643 630.921C208.626 630.921 211.856 626.909 211.856 621.961C211.856 617.012 208.626 613 204.643 613C200.659 613 197.43 617.012 197.43 621.961C197.43 626.909 200.659 630.921 204.643 630.921Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#filter8_bd_12_348)">
+<rect x="840" y="508" width="367" height="373" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="840.5" y="508.5" width="366" height="372" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<g filter="url(#filter9_bd_12_348)">
+<rect x="906" y="776" width="109" height="65" rx="10" fill="#FFC743"/>
+<rect x="906.5" y="776.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M1005.07 564.091C1005.07 566.47 1004.62 568.494 1003.72 570.163C1002.83 571.832 1001.61 573.107 1000.06 573.988C998.516 574.862 996.783 575.298 994.858 575.298C992.919 575.298 991.179 574.858 989.638 573.977C988.097 573.097 986.879 571.822 985.984 570.153C985.089 568.484 984.642 566.463 984.642 564.091C984.642 561.712 985.089 559.688 985.984 558.018C986.879 556.349 988.097 555.078 989.638 554.205C991.179 553.324 992.919 552.884 994.858 552.884C996.783 552.884 998.516 553.324 1000.06 554.205C1001.61 555.078 1002.83 556.349 1003.72 558.018C1004.62 559.688 1005.07 561.712 1005.07 564.091ZM1000.4 564.091C1000.4 562.55 1000.17 561.25 999.706 560.192C999.251 559.134 998.608 558.331 997.777 557.784C996.946 557.237 995.973 556.964 994.858 556.964C993.743 556.964 992.77 557.237 991.939 557.784C991.108 558.331 990.462 559.134 990 560.192C989.546 561.25 989.319 562.55 989.319 564.091C989.319 565.632 989.546 566.932 990 567.99C990.462 569.048 991.108 569.851 991.939 570.398C992.77 570.945 993.743 571.218 994.858 571.218C995.973 571.218 996.946 570.945 997.777 570.398C998.608 569.851 999.251 569.048 999.706 567.99C1000.17 566.932 1000.4 565.632 1000.4 564.091ZM1008.41 575V558.636H1012.81V561.491H1012.98C1013.28 560.476 1013.78 559.709 1014.48 559.19C1015.18 558.665 1015.99 558.402 1016.91 558.402C1017.14 558.402 1017.38 558.416 1017.64 558.445C1017.91 558.473 1018.14 558.512 1018.34 558.562V562.589C1018.12 562.525 1017.83 562.468 1017.45 562.418C1017.08 562.369 1016.73 562.344 1016.42 562.344C1015.75 562.344 1015.15 562.489 1014.63 562.781C1014.11 563.065 1013.7 563.462 1013.39 563.974C1013.09 564.485 1012.95 565.075 1012.95 565.742V575H1008.41ZM1027.29 581.477C1025.82 581.477 1024.56 581.275 1023.51 580.87C1022.47 580.472 1021.64 579.929 1021.02 579.24C1020.4 578.551 1020 577.777 1019.81 576.918L1024.01 576.353C1024.14 576.68 1024.34 576.985 1024.62 577.269C1024.9 577.553 1025.26 577.781 1025.72 577.951C1026.18 578.129 1026.74 578.217 1027.4 578.217C1028.39 578.217 1029.2 577.976 1029.84 577.493C1030.49 577.017 1030.81 576.218 1030.81 575.096V572.102H1030.62C1030.42 572.557 1030.12 572.987 1029.72 573.391C1029.32 573.796 1028.81 574.126 1028.19 574.382C1027.56 574.638 1026.82 574.766 1025.95 574.766C1024.72 574.766 1023.6 574.482 1022.59 573.913C1021.59 573.338 1020.79 572.461 1020.2 571.282C1019.61 570.096 1019.31 568.597 1019.31 566.786C1019.31 564.933 1019.62 563.384 1020.22 562.141C1020.82 560.898 1021.63 559.968 1022.63 559.35C1023.63 558.732 1024.74 558.423 1025.94 558.423C1026.86 558.423 1027.62 558.58 1028.24 558.892C1028.86 559.197 1029.36 559.581 1029.73 560.043C1030.12 560.497 1030.41 560.945 1030.62 561.385H1030.79V558.636H1035.29V575.16C1035.29 576.552 1034.95 577.717 1034.27 578.654C1033.59 579.592 1032.64 580.295 1031.44 580.763C1030.24 581.239 1028.86 581.477 1027.29 581.477ZM1027.39 571.357C1028.12 571.357 1028.74 571.175 1029.24 570.813C1029.75 570.444 1030.14 569.918 1030.41 569.237C1030.69 568.548 1030.83 567.724 1030.83 566.765C1030.83 565.806 1030.69 564.975 1030.42 564.272C1030.15 563.562 1029.76 563.011 1029.25 562.621C1028.74 562.23 1028.12 562.035 1027.39 562.035C1026.64 562.035 1026.01 562.237 1025.5 562.642C1024.99 563.04 1024.6 563.594 1024.34 564.304C1024.08 565.014 1023.95 565.835 1023.95 566.765C1023.95 567.71 1024.08 568.526 1024.34 569.215C1024.61 569.897 1025 570.426 1025.5 570.803C1026.01 571.172 1026.64 571.357 1027.39 571.357ZM1045.93 575V553.182H1054.67C1056.27 553.182 1057.61 553.42 1058.69 553.896C1059.76 554.371 1060.56 555.032 1061.1 555.877C1061.64 556.715 1061.91 557.681 1061.91 558.775C1061.91 559.627 1061.74 560.376 1061.4 561.023C1061.06 561.662 1060.59 562.187 1060 562.599C1059.41 563.004 1058.73 563.292 1057.97 563.462V563.675C1058.8 563.711 1059.58 563.945 1060.3 564.379C1061.04 564.812 1061.63 565.419 1062.08 566.2C1062.54 566.974 1062.77 567.898 1062.77 568.97C1062.77 570.128 1062.48 571.161 1061.9 572.07C1061.33 572.972 1060.49 573.686 1059.38 574.212C1058.26 574.737 1056.89 575 1055.26 575H1045.93ZM1050.55 571.229H1054.31C1055.59 571.229 1056.53 570.984 1057.12 570.494C1057.71 569.996 1058 569.336 1058 568.512C1058 567.908 1057.86 567.376 1057.57 566.914C1057.28 566.452 1056.86 566.09 1056.32 565.827C1055.79 565.565 1055.15 565.433 1054.41 565.433H1050.55V571.229ZM1050.55 562.312H1053.97C1054.6 562.312 1055.16 562.202 1055.65 561.982C1056.15 561.754 1056.54 561.435 1056.82 561.023C1057.11 560.611 1057.26 560.117 1057.26 559.542C1057.26 558.754 1056.98 558.118 1056.42 557.635C1055.86 557.152 1055.07 556.911 1054.05 556.911H1050.55V562.312Z" fill="#03031C"/>
+<path d="M932.462 654.58C941.757 654.58 949.292 645.272 949.292 633.79C949.292 622.308 941.757 613 932.462 613C923.167 613 915.632 622.308 915.632 633.79C915.632 645.272 923.167 654.58 932.462 654.58Z" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M945.134 647.848C945.134 647.848 956.111 653.919 960.717 657.696C961.809 658.595 962.747 659.67 963.493 660.878C964.852 663.146 965.556 665.754 965.527 668.406V684.017C956.389 692.317 944.547 696.921 932.264 696.952C919.968 696.99 908.102 692.376 899.001 684.017V668.406C898.972 665.754 899.676 663.146 901.035 660.878C901.781 659.67 902.719 658.595 903.811 657.696C908.417 653.958 919.412 647.452 919.412 647.452" stroke="#03031C" stroke-width="1.98" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M908.699 666.856C908.29 667.577 908.086 668.394 908.11 669.22V680.077C914.977 685.12 923.308 687.844 931.868 687.844C940.427 687.844 948.759 685.12 955.626 680.077V669.295C955.653 668.471 955.454 667.654 955.049 666.932C948.364 673.252 940.423 677.043 931.868 677.043C923.312 677.043 915.372 673.226 908.699 666.856Z" fill="#FFC743"/>
+<path d="M918.411 719.818H920.613V731.857C920.613 733.099 920.32 734.209 919.734 735.186C919.154 736.156 918.334 736.923 917.275 737.485C916.216 738.041 914.973 738.32 913.546 738.32C912.12 738.32 910.877 738.041 909.818 737.485C908.758 736.923 907.936 736.156 907.35 735.186C906.77 734.209 906.48 733.099 906.48 731.857V719.818H908.681V731.679C908.681 732.567 908.877 733.357 909.267 734.049C909.658 734.736 910.214 735.277 910.936 735.674C911.664 736.065 912.534 736.26 913.546 736.26C914.558 736.26 915.428 736.065 916.156 735.674C916.884 735.277 917.441 734.736 917.825 734.049C918.216 733.357 918.411 732.567 918.411 731.679V719.818ZM934.385 727.418L932.503 727.95C932.384 727.637 932.21 727.332 931.979 727.036C931.754 726.734 931.446 726.485 931.056 726.29C930.665 726.095 930.165 725.997 929.555 725.997C928.721 725.997 928.025 726.19 927.469 726.574C926.919 726.953 926.643 727.435 926.643 728.021C926.643 728.542 926.833 728.953 927.212 729.255C927.59 729.557 928.182 729.809 928.987 730.01L931.011 730.507C932.23 730.803 933.139 731.256 933.737 731.865C934.335 732.469 934.633 733.247 934.633 734.2C934.633 734.982 934.408 735.68 933.959 736.295C933.515 736.911 932.893 737.396 932.094 737.751C931.295 738.107 930.366 738.284 929.307 738.284C927.916 738.284 926.765 737.982 925.853 737.379C924.942 736.775 924.365 735.893 924.122 734.733L926.111 734.236C926.3 734.97 926.658 735.52 927.185 735.887C927.718 736.254 928.413 736.438 929.271 736.438C930.248 736.438 931.023 736.23 931.597 735.816C932.177 735.396 932.467 734.893 932.467 734.307C932.467 733.833 932.301 733.437 931.97 733.117C931.639 732.792 931.13 732.549 930.443 732.389L928.17 731.857C926.922 731.561 926.004 731.102 925.418 730.48C924.838 729.853 924.548 729.069 924.548 728.128C924.548 727.358 924.764 726.678 925.196 726.086C925.634 725.494 926.229 725.029 926.981 724.692C927.738 724.355 928.596 724.186 929.555 724.186C930.905 724.186 931.964 724.482 932.734 725.074C933.509 725.666 934.059 726.447 934.385 727.418ZM943.505 738.284C942.191 738.284 941.057 737.994 940.104 737.414C939.157 736.828 938.426 736.011 937.912 734.964C937.403 733.91 937.148 732.685 937.148 731.288C937.148 729.892 937.403 728.661 937.912 727.595C938.426 726.524 939.143 725.689 940.06 725.092C940.983 724.488 942.06 724.186 943.292 724.186C944.002 724.186 944.703 724.304 945.396 724.541C946.088 724.778 946.718 725.163 947.287 725.695C947.855 726.222 948.307 726.92 948.645 727.79C948.982 728.661 949.151 729.732 949.151 731.004V731.892H938.64V730.081H947.02C947.02 729.312 946.866 728.625 946.559 728.021C946.257 727.418 945.825 726.941 945.262 726.592C944.706 726.243 944.049 726.068 943.292 726.068C942.457 726.068 941.735 726.275 941.125 726.69C940.522 727.098 940.057 727.631 939.731 728.288C939.406 728.945 939.243 729.649 939.243 730.401V731.608C939.243 732.638 939.421 733.511 939.776 734.227C940.137 734.937 940.637 735.479 941.276 735.852C941.915 736.219 942.658 736.402 943.505 736.402C944.055 736.402 944.552 736.325 944.996 736.171C945.446 736.011 945.834 735.775 946.159 735.461C946.485 735.141 946.736 734.745 946.914 734.271L948.938 734.839C948.725 735.526 948.367 736.13 947.864 736.651C947.361 737.165 946.739 737.568 945.999 737.858C945.259 738.142 944.428 738.284 943.505 738.284ZM952.338 738V724.364H954.362V726.423H954.504C954.753 725.749 955.203 725.201 955.854 724.781C956.505 724.361 957.239 724.151 958.055 724.151C958.209 724.151 958.402 724.154 958.632 724.159C958.863 724.165 959.038 724.174 959.156 724.186V726.317C959.085 726.299 958.922 726.272 958.668 726.237C958.419 726.195 958.156 726.175 957.878 726.175C957.215 726.175 956.623 726.314 956.102 726.592C955.587 726.864 955.179 727.243 954.877 727.728C954.581 728.208 954.433 728.755 954.433 729.371V738H952.338Z" fill="#03031C"/>
+<path d="M948.803 816.32C947.939 816.32 947.155 816.157 946.451 815.831C945.747 815.5 945.187 815.023 944.773 814.402C944.359 813.775 944.151 813.017 944.151 812.129C944.151 811.348 944.305 810.715 944.613 810.229C944.921 809.738 945.332 809.353 945.847 809.075C946.362 808.797 946.93 808.59 947.552 808.454C948.179 808.312 948.809 808.199 949.443 808.116C950.271 808.01 950.943 807.93 951.458 807.877C951.979 807.818 952.358 807.72 952.594 807.584C952.837 807.448 952.958 807.211 952.958 806.874V806.803C952.958 805.927 952.719 805.246 952.239 804.761C951.766 804.275 951.047 804.033 950.082 804.033C949.082 804.033 948.297 804.252 947.729 804.69C947.161 805.128 946.762 805.595 946.531 806.092L944.542 805.382C944.897 804.554 945.371 803.908 945.963 803.447C946.56 802.979 947.211 802.654 947.916 802.47C948.626 802.281 949.324 802.186 950.011 802.186C950.449 802.186 950.952 802.239 951.52 802.346C952.094 802.446 952.648 802.657 953.18 802.976C953.719 803.296 954.166 803.778 954.521 804.423C954.876 805.068 955.053 805.933 955.053 807.016V816H952.958V814.153H952.852C952.71 814.449 952.473 814.766 952.142 815.103C951.81 815.441 951.369 815.728 950.819 815.964C950.268 816.201 949.597 816.32 948.803 816.32ZM949.123 814.438C949.952 814.438 950.65 814.275 951.218 813.949C951.792 813.624 952.224 813.203 952.514 812.689C952.81 812.174 952.958 811.632 952.958 811.064V809.146C952.869 809.253 952.674 809.35 952.372 809.439C952.076 809.522 951.733 809.596 951.343 809.661C950.958 809.72 950.582 809.774 950.215 809.821C949.854 809.862 949.561 809.898 949.336 809.928C948.792 809.999 948.283 810.114 947.809 810.274C947.342 810.428 946.963 810.661 946.673 810.975C946.389 811.283 946.247 811.703 946.247 812.236C946.247 812.964 946.516 813.514 947.055 813.887C947.599 814.254 948.289 814.438 949.123 814.438ZM958.878 821.114V802.364H960.902V804.53H961.15C961.304 804.293 961.517 803.991 961.79 803.624C962.068 803.251 962.464 802.92 962.979 802.63C963.5 802.334 964.204 802.186 965.092 802.186C966.24 802.186 967.252 802.473 968.128 803.047C969.004 803.621 969.688 804.435 970.179 805.489C970.67 806.542 970.916 807.785 970.916 809.217C970.916 810.661 970.67 811.913 970.179 812.973C969.688 814.026 969.007 814.843 968.137 815.423C967.267 815.997 966.264 816.284 965.128 816.284C964.252 816.284 963.55 816.139 963.024 815.849C962.497 815.553 962.091 815.219 961.807 814.846C961.523 814.467 961.304 814.153 961.15 813.905H960.973V821.114H958.878ZM960.937 809.182C960.937 810.212 961.088 811.12 961.39 811.907C961.692 812.689 962.133 813.301 962.713 813.745C963.293 814.183 964.003 814.402 964.843 814.402C965.719 814.402 966.45 814.171 967.036 813.71C967.628 813.242 968.072 812.615 968.368 811.827C968.67 811.034 968.821 810.152 968.821 809.182C968.821 808.223 968.673 807.359 968.377 806.589C968.087 805.814 967.646 805.202 967.054 804.752C966.468 804.296 965.731 804.068 964.843 804.068C963.991 804.068 963.275 804.284 962.695 804.716C962.115 805.142 961.677 805.74 961.381 806.51C961.085 807.273 960.937 808.164 960.937 809.182ZM974.112 816V802.364H976.207V816H974.112ZM975.177 800.091C974.769 800.091 974.417 799.952 974.121 799.674C973.831 799.395 973.686 799.061 973.686 798.67C973.686 798.28 973.831 797.945 974.121 797.667C974.417 797.389 974.769 797.25 975.177 797.25C975.586 797.25 975.935 797.389 976.225 797.667C976.521 797.945 976.669 798.28 976.669 798.67C976.669 799.061 976.521 799.395 976.225 799.674C975.935 799.952 975.586 800.091 975.177 800.091Z" fill="#03031C"/>
+<g filter="url(#filter10_bd_12_348)">
+<rect x="1033" y="776" width="109" height="65" rx="10" fill="#FFC743"/>
+<rect x="1033.5" y="776.5" width="108" height="64" rx="9.5" stroke="#E3CEFF"/>
+</g>
+<path d="M1075.8 816.32C1074.94 816.32 1074.16 816.157 1073.45 815.831C1072.75 815.5 1072.19 815.023 1071.77 814.402C1071.36 813.775 1071.15 813.017 1071.15 812.129C1071.15 811.348 1071.31 810.715 1071.61 810.229C1071.92 809.738 1072.33 809.353 1072.85 809.075C1073.36 808.797 1073.93 808.59 1074.55 808.454C1075.18 808.312 1075.81 808.199 1076.44 808.116C1077.27 808.01 1077.94 807.93 1078.46 807.877C1078.98 807.818 1079.36 807.72 1079.59 807.584C1079.84 807.448 1079.96 807.211 1079.96 806.874V806.803C1079.96 805.927 1079.72 805.246 1079.24 804.761C1078.77 804.275 1078.05 804.033 1077.08 804.033C1076.08 804.033 1075.3 804.252 1074.73 804.69C1074.16 805.128 1073.76 805.595 1073.53 806.092L1071.54 805.382C1071.9 804.554 1072.37 803.908 1072.96 803.447C1073.56 802.979 1074.21 802.654 1074.92 802.47C1075.63 802.281 1076.32 802.186 1077.01 802.186C1077.45 802.186 1077.95 802.239 1078.52 802.346C1079.09 802.446 1079.65 802.657 1080.18 802.976C1080.72 803.296 1081.17 803.778 1081.52 804.423C1081.88 805.068 1082.05 805.933 1082.05 807.016V816H1079.96V814.153H1079.85C1079.71 814.449 1079.47 814.766 1079.14 815.103C1078.81 815.441 1078.37 815.728 1077.82 815.964C1077.27 816.201 1076.6 816.32 1075.8 816.32ZM1076.12 814.438C1076.95 814.438 1077.65 814.275 1078.22 813.949C1078.79 813.624 1079.22 813.203 1079.51 812.689C1079.81 812.174 1079.96 811.632 1079.96 811.064V809.146C1079.87 809.253 1079.67 809.35 1079.37 809.439C1079.08 809.522 1078.73 809.596 1078.34 809.661C1077.96 809.72 1077.58 809.774 1077.22 809.821C1076.85 809.862 1076.56 809.898 1076.34 809.928C1075.79 809.999 1075.28 810.114 1074.81 810.274C1074.34 810.428 1073.96 810.661 1073.67 810.975C1073.39 811.283 1073.25 811.703 1073.25 812.236C1073.25 812.964 1073.52 813.514 1074.05 813.887C1074.6 814.254 1075.29 814.438 1076.12 814.438ZM1085.88 821.114V802.364H1087.9V804.53H1088.15C1088.3 804.293 1088.52 803.991 1088.79 803.624C1089.07 803.251 1089.46 802.92 1089.98 802.63C1090.5 802.334 1091.2 802.186 1092.09 802.186C1093.24 802.186 1094.25 802.473 1095.13 803.047C1096 803.621 1096.69 804.435 1097.18 805.489C1097.67 806.542 1097.92 807.785 1097.92 809.217C1097.92 810.661 1097.67 811.913 1097.18 812.973C1096.69 814.026 1096.01 814.843 1095.14 815.423C1094.27 815.997 1093.26 816.284 1092.13 816.284C1091.25 816.284 1090.55 816.139 1090.02 815.849C1089.5 815.553 1089.09 815.219 1088.81 814.846C1088.52 814.467 1088.3 814.153 1088.15 813.905H1087.97V821.114H1085.88ZM1087.94 809.182C1087.94 810.212 1088.09 811.12 1088.39 811.907C1088.69 812.689 1089.13 813.301 1089.71 813.745C1090.29 814.183 1091 814.402 1091.84 814.402C1092.72 814.402 1093.45 814.171 1094.04 813.71C1094.63 813.242 1095.07 812.615 1095.37 811.827C1095.67 811.034 1095.82 810.152 1095.82 809.182C1095.82 808.223 1095.67 807.359 1095.38 806.589C1095.09 805.814 1094.65 805.202 1094.05 804.752C1093.47 804.296 1092.73 804.068 1091.84 804.068C1090.99 804.068 1090.28 804.284 1089.7 804.716C1089.12 805.142 1088.68 805.74 1088.38 806.51C1088.09 807.273 1087.94 808.164 1087.94 809.182ZM1101.11 816V802.364H1103.21V816H1101.11ZM1102.18 800.091C1101.77 800.091 1101.42 799.952 1101.12 799.674C1100.83 799.395 1100.69 799.061 1100.69 798.67C1100.69 798.28 1100.83 797.945 1101.12 797.667C1101.42 797.389 1101.77 797.25 1102.18 797.25C1102.59 797.25 1102.93 797.389 1103.22 797.667C1103.52 797.945 1103.67 798.28 1103.67 798.67C1103.67 799.061 1103.52 799.395 1103.22 799.674C1102.93 799.952 1102.59 800.091 1102.18 800.091Z" fill="#03031C"/>
+<path d="M1047 719.818H1049.2V731.857C1049.2 733.099 1048.91 734.209 1048.32 735.186C1047.74 736.156 1046.92 736.923 1045.86 737.485C1044.8 738.041 1043.56 738.32 1042.13 738.32C1040.7 738.32 1039.46 738.041 1038.4 737.485C1037.34 736.923 1036.52 736.156 1035.93 735.186C1035.35 734.209 1035.06 733.099 1035.06 731.857V719.818H1037.27V731.679C1037.27 732.567 1037.46 733.357 1037.85 734.049C1038.24 734.736 1038.8 735.277 1039.52 735.674C1040.25 736.065 1041.12 736.26 1042.13 736.26C1043.14 736.26 1044.01 736.065 1044.74 735.674C1045.47 735.277 1046.03 734.736 1046.41 734.049C1046.8 733.357 1047 732.567 1047 731.679V719.818ZM1062.97 727.418L1061.09 727.95C1060.97 727.637 1060.79 727.332 1060.56 727.036C1060.34 726.734 1060.03 726.485 1059.64 726.29C1059.25 726.095 1058.75 725.997 1058.14 725.997C1057.31 725.997 1056.61 726.19 1056.05 726.574C1055.5 726.953 1055.23 727.435 1055.23 728.021C1055.23 728.542 1055.42 728.953 1055.8 729.255C1056.18 729.557 1056.77 729.809 1057.57 730.01L1059.6 730.507C1060.82 730.803 1061.72 731.256 1062.32 731.865C1062.92 732.469 1063.22 733.247 1063.22 734.2C1063.22 734.982 1062.99 735.68 1062.54 736.295C1062.1 736.911 1061.48 737.396 1060.68 737.751C1059.88 738.107 1058.95 738.284 1057.89 738.284C1056.5 738.284 1055.35 737.982 1054.44 737.379C1053.53 736.775 1052.95 735.893 1052.71 734.733L1054.7 734.236C1054.89 734.97 1055.24 735.52 1055.77 735.887C1056.3 736.254 1057 736.438 1057.86 736.438C1058.83 736.438 1059.61 736.23 1060.18 735.816C1060.76 735.396 1061.05 734.893 1061.05 734.307C1061.05 733.833 1060.89 733.437 1060.55 733.117C1060.22 732.792 1059.71 732.549 1059.03 732.389L1056.76 731.857C1055.51 731.561 1054.59 731.102 1054 730.48C1053.42 729.853 1053.13 729.069 1053.13 728.128C1053.13 727.358 1053.35 726.678 1053.78 726.086C1054.22 725.494 1054.81 725.029 1055.57 724.692C1056.32 724.355 1057.18 724.186 1058.14 724.186C1059.49 724.186 1060.55 724.482 1061.32 725.074C1062.09 725.666 1062.64 726.447 1062.97 727.418ZM1072.09 738.284C1070.78 738.284 1069.64 737.994 1068.69 737.414C1067.74 736.828 1067.01 736.011 1066.5 734.964C1065.99 733.91 1065.73 732.685 1065.73 731.288C1065.73 729.892 1065.99 728.661 1066.5 727.595C1067.01 726.524 1067.73 725.689 1068.64 725.092C1069.57 724.488 1070.65 724.186 1071.88 724.186C1072.59 724.186 1073.29 724.304 1073.98 724.541C1074.67 724.778 1075.3 725.163 1075.87 725.695C1076.44 726.222 1076.89 726.92 1077.23 727.79C1077.57 728.661 1077.74 729.732 1077.74 731.004V731.892H1067.22V730.081H1075.61C1075.61 729.312 1075.45 728.625 1075.14 728.021C1074.84 727.418 1074.41 726.941 1073.85 726.592C1073.29 726.243 1072.63 726.068 1071.88 726.068C1071.04 726.068 1070.32 726.275 1069.71 726.69C1069.11 727.098 1068.64 727.631 1068.32 728.288C1067.99 728.945 1067.83 729.649 1067.83 730.401V731.608C1067.83 732.638 1068.01 733.511 1068.36 734.227C1068.72 734.937 1069.22 735.479 1069.86 735.852C1070.5 736.219 1071.24 736.402 1072.09 736.402C1072.64 736.402 1073.14 736.325 1073.58 736.171C1074.03 736.011 1074.42 735.775 1074.74 735.461C1075.07 735.141 1075.32 734.745 1075.5 734.271L1077.52 734.839C1077.31 735.526 1076.95 736.13 1076.45 736.651C1075.95 737.165 1075.32 737.568 1074.58 737.858C1073.84 738.142 1073.01 738.284 1072.09 738.284ZM1080.92 738V724.364H1082.95V726.423H1083.09C1083.34 725.749 1083.79 725.201 1084.44 724.781C1085.09 724.361 1085.82 724.151 1086.64 724.151C1086.79 724.151 1086.99 724.154 1087.22 724.159C1087.45 724.165 1087.62 724.174 1087.74 724.186V726.317C1087.67 726.299 1087.51 726.272 1087.25 726.237C1087 726.195 1086.74 726.175 1086.46 726.175C1085.8 726.175 1085.21 726.314 1084.69 726.592C1084.17 726.864 1083.76 727.243 1083.46 727.728C1083.17 728.208 1083.02 728.755 1083.02 729.371V738H1080.92ZM1102.76 743.398C1101.75 743.398 1100.88 743.268 1100.15 743.007C1099.42 742.753 1098.82 742.415 1098.33 741.995C1097.85 741.581 1097.47 741.137 1097.18 740.663L1098.85 739.491C1099.04 739.74 1099.28 740.024 1099.57 740.344C1099.86 740.669 1100.26 740.95 1100.76 741.187C1101.27 741.43 1101.94 741.551 1102.76 741.551C1103.86 741.551 1104.77 741.285 1105.49 740.752C1106.2 740.219 1106.56 739.385 1106.56 738.249V735.479H1106.38C1106.23 735.727 1106.01 736.035 1105.73 736.402C1105.45 736.763 1105.04 737.086 1104.52 737.37C1104 737.648 1103.29 737.787 1102.41 737.787C1101.3 737.787 1100.32 737.527 1099.44 737.006C1098.57 736.485 1097.88 735.727 1097.37 734.733C1096.87 733.739 1096.62 732.531 1096.62 731.111C1096.62 729.714 1096.86 728.498 1097.35 727.462C1097.84 726.42 1098.53 725.615 1099.4 725.047C1100.28 724.473 1101.29 724.186 1102.44 724.186C1103.33 724.186 1104.03 724.334 1104.55 724.63C1105.08 724.92 1105.48 725.251 1105.76 725.624C1106.05 725.991 1106.26 726.293 1106.42 726.53H1106.63V724.364H1108.66V738.391C1108.66 739.562 1108.39 740.515 1107.86 741.249C1107.33 741.989 1106.62 742.531 1105.73 742.874C1104.84 743.223 1103.85 743.398 1102.76 743.398ZM1102.69 735.905C1103.53 735.905 1104.24 735.712 1104.82 735.328C1105.4 734.943 1105.84 734.39 1106.14 733.668C1106.44 732.946 1106.6 732.081 1106.6 731.075C1106.6 730.093 1106.45 729.226 1106.15 728.474C1105.86 727.722 1105.42 727.134 1104.84 726.707C1104.26 726.281 1103.54 726.068 1102.69 726.068C1101.8 726.068 1101.06 726.293 1100.47 726.743C1099.88 727.193 1099.44 727.796 1099.15 728.554C1098.86 729.312 1098.71 730.152 1098.71 731.075C1098.71 732.022 1098.86 732.86 1099.16 733.588C1099.46 734.31 1099.9 734.878 1100.49 735.292C1101.08 735.701 1101.81 735.905 1102.69 735.905ZM1112.49 738V724.364H1114.51V726.423H1114.66C1114.91 725.749 1115.35 725.201 1116.01 724.781C1116.66 724.361 1117.39 724.151 1118.21 724.151C1118.36 724.151 1118.55 724.154 1118.78 724.159C1119.02 724.165 1119.19 724.174 1119.31 724.186V726.317C1119.24 726.299 1119.07 726.272 1118.82 726.237C1118.57 726.195 1118.31 726.175 1118.03 726.175C1117.37 726.175 1116.78 726.314 1116.25 726.592C1115.74 726.864 1115.33 727.243 1115.03 727.728C1114.73 728.208 1114.59 728.755 1114.59 729.371V738H1112.49ZM1126.92 738.284C1125.69 738.284 1124.61 737.991 1123.68 737.405C1122.75 736.819 1122.03 736 1121.51 734.946C1121 733.893 1120.74 732.661 1120.74 731.253C1120.74 729.832 1121 728.592 1121.51 727.533C1122.03 726.474 1122.75 725.651 1123.68 725.065C1124.61 724.479 1125.69 724.186 1126.92 724.186C1128.15 724.186 1129.23 724.479 1130.15 725.065C1131.08 725.651 1131.8 726.474 1132.31 727.533C1132.84 728.592 1133.1 729.832 1133.1 731.253C1133.1 732.661 1132.84 733.893 1132.31 734.946C1131.8 736 1131.08 736.819 1130.15 737.405C1129.23 737.991 1128.15 738.284 1126.92 738.284ZM1126.92 736.402C1127.85 736.402 1128.62 736.162 1129.23 735.683C1129.83 735.203 1130.28 734.573 1130.57 733.792C1130.86 733.011 1131 732.164 1131 731.253C1131 730.341 1130.86 729.492 1130.57 728.705C1130.28 727.918 1129.83 727.281 1129.23 726.796C1128.62 726.311 1127.85 726.068 1126.92 726.068C1125.98 726.068 1125.21 726.311 1124.61 726.796C1124 727.281 1123.56 727.918 1123.27 728.705C1122.98 729.492 1122.83 730.341 1122.83 731.253C1122.83 732.164 1122.98 733.011 1123.27 733.792C1123.56 734.573 1124 735.203 1124.61 735.683C1125.21 736.162 1125.98 736.402 1126.92 736.402ZM1144.89 732.425V724.364H1146.98V738H1144.89V735.692H1144.75C1144.43 736.384 1143.93 736.973 1143.25 737.458C1142.58 737.938 1141.73 738.178 1140.7 738.178C1139.85 738.178 1139.09 737.991 1138.42 737.618C1137.76 737.239 1137.24 736.671 1136.86 735.914C1136.48 735.15 1136.29 734.188 1136.29 733.028V724.364H1138.39V732.886C1138.39 733.881 1138.67 734.674 1139.22 735.266C1139.79 735.857 1140.5 736.153 1141.37 736.153C1141.89 736.153 1142.42 736.02 1142.96 735.754C1143.51 735.488 1143.96 735.079 1144.33 734.529C1144.7 733.978 1144.89 733.277 1144.89 732.425ZM1150.82 743.114V724.364H1152.84V726.53H1153.09C1153.25 726.293 1153.46 725.991 1153.73 725.624C1154.01 725.251 1154.41 724.92 1154.92 724.63C1155.44 724.334 1156.15 724.186 1157.03 724.186C1158.18 724.186 1159.2 724.473 1160.07 725.047C1160.95 725.621 1161.63 726.435 1162.12 727.489C1162.61 728.542 1162.86 729.785 1162.86 731.217C1162.86 732.661 1162.61 733.913 1162.12 734.973C1161.63 736.026 1160.95 736.843 1160.08 737.423C1159.21 737.997 1158.21 738.284 1157.07 738.284C1156.19 738.284 1155.49 738.139 1154.97 737.849C1154.44 737.553 1154.03 737.219 1153.75 736.846C1153.47 736.467 1153.25 736.153 1153.09 735.905H1152.92V743.114H1150.82ZM1152.88 731.182C1152.88 732.212 1153.03 733.12 1153.33 733.907C1153.63 734.689 1154.08 735.301 1154.66 735.745C1155.24 736.183 1155.95 736.402 1156.79 736.402C1157.66 736.402 1158.39 736.171 1158.98 735.71C1159.57 735.242 1160.01 734.615 1160.31 733.827C1160.61 733.034 1160.76 732.152 1160.76 731.182C1160.76 730.223 1160.62 729.359 1160.32 728.589C1160.03 727.814 1159.59 727.202 1159 726.752C1158.41 726.296 1157.67 726.068 1156.79 726.068C1155.93 726.068 1155.22 726.284 1154.64 726.716C1154.06 727.142 1153.62 727.74 1153.32 728.51C1153.03 729.273 1152.88 730.164 1152.88 731.182Z" fill="#03031C"/>
+<path d="M1088.28 636.127C1088.13 636.387 1088.02 636.759 1088.02 637.168V641.89C1091.03 644.12 1094.53 645.273 1098.25 645.273C1102.67 645.273 1106.13 643.6 1108.47 641.89V637.168C1108.47 636.759 1108.4 636.387 1108.21 636.127C1105.35 638.915 1101.89 640.514 1098.21 640.514C1094.6 640.551 1091.14 638.915 1088.28 636.127Z" fill="#FFC743"/>
+<path d="M1060.99 683.644C1060.84 683.904 1060.73 684.276 1060.73 684.685V689.407C1063.74 691.638 1067.24 692.791 1070.95 692.791C1075.38 692.791 1078.84 691.117 1081.18 689.407V684.685C1081.18 684.276 1081.11 683.904 1080.92 683.644C1078.06 686.433 1074.6 688.031 1070.92 688.031C1067.31 688.069 1063.85 686.433 1060.99 683.644Z" fill="#FFC743"/>
+<path d="M1115.65 683.644C1115.5 683.904 1115.39 684.276 1115.39 684.685V689.407C1118.4 691.638 1121.89 692.791 1125.61 692.791C1130.04 692.791 1133.49 691.117 1135.84 689.407V684.685C1135.84 684.276 1135.76 683.904 1135.58 683.644C1132.71 686.433 1129.25 688.031 1125.57 688.031C1121.97 688.069 1118.51 686.433 1115.65 683.644Z" fill="#FFC743"/>
+<path d="M1098.32 664.682L1088.65 674.349" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1098.32 654.011V664.681L1107.88 674.237" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1076.09 674.907C1076.09 674.907 1081.18 677.695 1083.19 679.294C1083.67 679.666 1084.04 680.149 1084.38 680.67C1084.97 681.636 1085.27 682.752 1085.27 683.867V690.523C1081.44 693.869 1076.46 696.025 1070.95 696.025C1065.38 696.025 1060.47 693.943 1056.64 690.485V683.83C1056.64 682.715 1056.9 681.562 1057.53 680.632C1057.87 680.112 1058.24 679.666 1058.72 679.257C1060.69 677.658 1065.82 674.869 1065.82 674.869" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1070.95 677.584C1074.94 677.584 1078.17 673.572 1078.17 668.623C1078.17 663.674 1074.94 659.662 1070.95 659.662C1066.97 659.662 1063.74 663.674 1063.74 668.623C1063.74 673.572 1066.97 677.584 1070.95 677.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1130.82 674.907C1130.82 674.907 1135.91 677.695 1137.92 679.294C1138.4 679.666 1138.77 680.149 1139.11 680.67C1139.7 681.636 1140 682.752 1140 683.867V690.523C1136.17 693.906 1131.19 696.063 1125.69 696.063C1120.11 696.063 1115.2 693.981 1111.37 690.523V683.867C1111.37 682.752 1111.63 681.599 1112.26 680.67C1112.6 680.149 1112.97 679.703 1113.45 679.294C1115.42 677.695 1120.55 674.907 1120.55 674.907" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1125.65 677.584C1129.63 677.584 1132.86 673.572 1132.86 668.623C1132.86 663.674 1129.63 659.662 1125.65 659.662C1121.66 659.662 1118.44 663.674 1118.44 668.623C1118.44 673.572 1121.66 677.584 1125.65 677.584Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1103.41 628.244C1103.41 628.244 1108.51 631.033 1110.52 632.632C1111 633.003 1111.37 633.487 1111.71 634.007C1112.3 634.974 1112.6 636.089 1112.6 637.205V643.86C1108.77 647.244 1103.79 649.4 1098.28 649.4C1092.71 649.4 1087.8 647.318 1083.97 643.86V637.168C1083.97 636.052 1084.23 634.9 1084.86 633.97C1085.2 633.45 1085.57 633.003 1086.05 632.594C1088.02 630.996 1093.15 628.207 1093.15 628.207" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1098.28 630.921C1102.27 630.921 1105.5 626.909 1105.5 621.961C1105.5 617.012 1102.27 613 1098.28 613C1094.3 613 1091.07 617.012 1091.07 621.961C1091.07 626.909 1094.3 630.921 1098.28 630.921Z" stroke="#03031C" stroke-width="1.99339" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M405 933V957.5" stroke="white" stroke-width="2"/>
+<path d="M603 462L648 462" stroke="white" stroke-width="2"/>
+<path d="M998 462L1043 462" stroke="white" stroke-width="2"/>
+<path d="M625.293 498.707C625.683 499.098 626.317 499.098 626.707 498.707L633.071 492.343C633.462 491.953 633.462 491.319 633.071 490.929C632.681 490.538 632.047 490.538 631.657 490.929L626 496.586L620.343 490.929C619.953 490.538 619.319 490.538 618.929 490.929C618.538 491.319 618.538 491.953 618.929 492.343L625.293 498.707ZM625 351L625 498L627 498L627 351L625 351Z" fill="#03031C"/>
+<path d="M715 411.328H714V412.328H715V411.328ZM1021 411.328H1022V410.328H1021V411.328ZM1020.29 498.707C1020.68 499.098 1021.32 499.098 1021.71 498.707L1028.07 492.343C1028.46 491.953 1028.46 491.319 1028.07 490.929C1027.68 490.538 1027.05 490.538 1026.66 490.929L1021 496.586L1015.34 490.929C1014.95 490.538 1014.32 490.538 1013.93 490.929C1013.54 491.319 1013.54 491.953 1013.93 492.343L1020.29 498.707ZM714 352V411.328H716V352H714ZM715 412.328H1021V410.328H715V412.328ZM1020 411.328V498H1022V411.328H1020Z" fill="#EA26A9"/>
+<path d="M354.234 750H355.234V749H354.234V750ZM354.234 946H353.234V947H354.234V946ZM1022 946V947H1023V946H1022ZM1022.71 891.697C1022.32 891.307 1021.68 891.307 1021.29 891.697L1014.93 898.061C1014.54 898.452 1014.54 899.085 1014.93 899.476C1015.32 899.866 1015.95 899.866 1016.34 899.476L1022 893.819L1027.66 899.476C1028.05 899.866 1028.68 899.866 1029.07 899.476C1029.46 899.085 1029.46 898.452 1029.07 898.061L1022.71 891.697ZM323 751H354.234V749H323V751ZM353.234 750V946H355.234V750H353.234ZM354.234 947H1022V945H354.234V947ZM1023 946V892.405H1021V946H1023Z" fill="#03031C"/>
+<path d="M433.207 688.707C433.598 688.317 433.598 687.683 433.207 687.293L426.843 680.929C426.453 680.538 425.819 680.538 425.429 680.929C425.038 681.319 425.038 681.953 425.429 682.343L431.086 688L425.429 693.657C425.038 694.047 425.038 694.681 425.429 695.071C425.819 695.462 426.453 695.462 426.843 695.071L433.207 688.707ZM323 689H432.5V687H323V689Z" fill="#03031C"/>
+<path d="M1258 940H1334" stroke="#03031C" stroke-width="2"/>
+<path d="M1446 892.704C1465.3 892.704 1480.94 888.893 1480.94 884.192C1480.94 879.491 1465.3 875.68 1446 875.68C1426.7 875.68 1411.06 879.491 1411.06 884.192C1411.06 888.893 1426.7 892.704 1446 892.704Z" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1480.94 935.264V948.176C1480.94 952.923 1465.3 956.768 1446 956.768C1426.7 956.768 1411.06 952.946 1411.06 948.176V935.264" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1480.94 914.208V926.851C1480.94 931.499 1465.3 935.264 1446 935.264C1426.7 935.264 1411.06 931.521 1411.06 926.851V914.208" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1480.94 892.704V905.614C1480.94 910.358 1465.3 914.208 1446 914.208C1426.7 914.208 1411.06 910.388 1411.06 905.614V892.704" stroke="#03031C" stroke-width="2.24" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1459.51 949.403C1462.11 949.403 1464.63 949.342 1467.06 949.212L1466.51 949.319C1459.71 950.469 1452.82 951.011 1445.93 950.937C1429.89 950.937 1416.88 948.46 1416.88 945.407V938.771C1416.87 938.642 1416.9 938.513 1416.95 938.396C1417 938.279 1417.09 938.178 1417.19 938.101C1417.29 938.025 1417.41 937.976 1417.54 937.959C1417.66 937.942 1417.79 937.957 1417.91 938.004C1421.99 939.274 1426.2 940.097 1430.46 940.459V943.88C1430.46 946.926 1443.47 949.403 1459.51 949.403Z" fill="#8438FA"/>
+<path d="M1459.59 928.348C1462.17 928.348 1464.68 928.286 1467.06 928.163L1466.56 928.263C1459.76 929.412 1452.88 929.953 1445.99 929.882C1429.91 929.882 1416.88 927.404 1416.88 924.351V917.715C1416.87 917.586 1416.9 917.457 1416.95 917.34C1417 917.223 1417.09 917.122 1417.19 917.045C1417.29 916.969 1417.41 916.92 1417.54 916.903C1417.66 916.886 1417.79 916.901 1417.91 916.948C1422.01 918.201 1426.22 919.011 1430.49 919.365V922.794C1430.49 925.87 1443.51 928.348 1459.59 928.348Z" fill="#8438FA"/>
+<path d="M1459.59 906.898C1462.17 906.898 1464.68 906.838 1467.06 906.72L1466.56 906.816C1459.76 907.924 1452.88 908.447 1445.99 908.378C1429.91 908.378 1416.88 905.987 1416.88 903.041V896.631C1416.87 896.506 1416.9 896.382 1416.95 896.269C1417 896.156 1417.09 896.058 1417.19 895.984C1417.29 895.91 1417.41 895.863 1417.54 895.846C1417.66 895.83 1417.79 895.845 1417.91 895.89C1422.01 897.099 1426.22 897.881 1430.49 898.222V901.523C1430.49 904.507 1443.51 906.898 1459.59 906.898Z" fill="#8438FA"/>
+<defs>
+<filter id="filter0_bd_12_348" x="379" y="440" width="894" height="627" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter1_bd_12_348" x="181" y="38" width="618" height="331" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter2_bd_12_348" x="75" y="561" width="260" height="275" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter3_bd_12_348" x="420" y="487" width="417" height="423" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter4_bd_12_348" x="491" y="756" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter5_bd_12_348" x="618" y="756" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter6_bd_12_348" x="1316" y="820" width="260" height="247" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter7_bd_12_348" x="805" y="38" width="618" height="331" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter8_bd_12_348" x="815" y="487" width="417" height="423" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter9_bd_12_348" x="886" y="756" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+<filter id="filter10_bd_12_348" x="1013" y="756" width="149" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_12_348"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset/>
+<feGaussianBlur stdDeviation="10"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.12 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_12_348" result="effect2_dropShadow_12_348"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_12_348" result="shape"/>
+</filter>
+</defs>
+</svg>
diff --git a/img/page-options.png b/img/page-options.png
new file mode 100644
index 0000000000..5abe37f7c7
Binary files /dev/null and b/img/page-options.png differ
diff --git a/img/performance-benchmarks.png b/img/performance-benchmarks.png
new file mode 100644
index 0000000000..8b6711ca94
Binary files /dev/null and b/img/performance-benchmarks.png differ
diff --git a/img/plugins/apis_menu.png b/img/plugins/apis_menu.png
new file mode 100644
index 0000000000..5d6c17f58c
Binary files /dev/null and b/img/plugins/apis_menu.png differ
diff --git a/img/plugins/control_plane_dashboard_link.png b/img/plugins/control_plane_dashboard_link.png
new file mode 100644
index 0000000000..ddcc0c11b9
Binary files /dev/null and b/img/plugins/control_plane_dashboard_link.png differ
diff --git a/img/plugins/fileserver_settings.png b/img/plugins/fileserver_settings.png
new file mode 100644
index 0000000000..414847cfbc
Binary files /dev/null and b/img/plugins/fileserver_settings.png differ
diff --git a/img/plugins/go-plugin-different-tyk-versions.png b/img/plugins/go-plugin-different-tyk-versions.png
new file mode 100644
index 0000000000..ebb88f2e6d
Binary files /dev/null and b/img/plugins/go-plugin-different-tyk-versions.png differ
diff --git a/img/plugins/multiple_spans.png b/img/plugins/multiple_spans.png
new file mode 100644
index 0000000000..d3820fe161
Binary files /dev/null and b/img/plugins/multiple_spans.png differ
diff --git a/img/plugins/plugin-bundles-overview.png b/img/plugins/plugin-bundles-overview.png
new file mode 100644
index 0000000000..b11c847755
Binary files /dev/null and b/img/plugins/plugin-bundles-overview.png differ
diff --git a/img/plugins/plugins_classic_api_bundles_config.png b/img/plugins/plugins_classic_api_bundles_config.png
new file mode 100644
index 0000000000..214d0b3cf0
Binary files /dev/null and b/img/plugins/plugins_classic_api_bundles_config.png differ
diff --git a/img/plugins/plugins_classic_api_definition_editor.png b/img/plugins/plugins_classic_api_definition_editor.png
new file mode 100644
index 0000000000..4c0bd370d6
Binary files /dev/null and b/img/plugins/plugins_classic_api_definition_editor.png differ
diff --git a/img/plugins/plugins_classic_api_source_config.png b/img/plugins/plugins_classic_api_source_config.png
new file mode 100644
index 0000000000..a05bd72531
Binary files /dev/null and b/img/plugins/plugins_classic_api_source_config.png differ
diff --git a/img/plugins/plugins_enable.png b/img/plugins/plugins_enable.png
new file mode 100644
index 0000000000..a0e105391b
Binary files /dev/null and b/img/plugins/plugins_enable.png differ
diff --git a/img/plugins/plugins_oas_api_bundles_config.png b/img/plugins/plugins_oas_api_bundles_config.png
new file mode 100644
index 0000000000..c73e4480af
Binary files /dev/null and b/img/plugins/plugins_oas_api_bundles_config.png differ
diff --git a/img/plugins/plugins_oas_api_driver_options.png b/img/plugins/plugins_oas_api_driver_options.png
new file mode 100644
index 0000000000..795a550183
Binary files /dev/null and b/img/plugins/plugins_oas_api_driver_options.png differ
diff --git a/img/plugins/plugins_oas_api_source_config.png b/img/plugins/plugins_oas_api_source_config.png
new file mode 100644
index 0000000000..00c5ef14aa
Binary files /dev/null and b/img/plugins/plugins_oas_api_source_config.png differ
diff --git a/img/plugins/plugins_overview.svg b/img/plugins/plugins_overview.svg
new file mode 100644
index 0000000000..7785e23fa9
--- /dev/null
+++ b/img/plugins/plugins_overview.svg
@@ -0,0 +1,96 @@
+<svg width="1128" height="792" viewBox="0 0 1128 792" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g filter="url(#filter0_bd_15_838)">
+<rect x="69" y="71" width="233" height="233" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="69.5" y="71.5" width="232" height="232" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M221.611 199.954L230.34 170.568C231.31 167.367 228.885 164.118 225.539 164.118H185.049H144.509C141.163 164.118 138.739 167.367 139.709 170.568L148.437 199.954H185.194" stroke="#03031C" stroke-width="2.868" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M142.23 193.795L137.575 202.572C136.217 205.142 138.06 208.197 140.969 208.197H185H229.031C231.94 208.197 233.783 205.142 232.425 202.572L227.77 193.795" stroke="#03031C" stroke-width="2.868" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M185 145.012C193.704 145.012 200.76 136.263 200.76 125.47C200.76 114.677 193.704 105.928 185 105.928C176.296 105.928 169.24 114.677 169.24 125.47C169.24 136.263 176.296 145.012 185 145.012Z" stroke="#03031C" stroke-width="2.868" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M196.25 139.145C196.25 139.145 207.403 145.207 211.767 148.698C212.786 149.522 213.659 150.541 214.386 151.656C215.695 153.741 216.277 156.214 216.277 158.639V164.118" stroke="#03031C" stroke-width="2.868" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M173.75 139.145C173.75 139.145 162.597 145.207 158.232 148.698C157.214 149.522 156.341 150.541 155.614 151.656C154.305 153.741 153.674 156.214 153.674 158.639V164.118" stroke="#03031C" stroke-width="2.868" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M166.807 241.184H162.918C162.847 240.681 162.702 240.234 162.483 239.843C162.264 239.446 161.983 239.109 161.64 238.831C161.296 238.553 160.9 238.34 160.45 238.192C160.006 238.044 159.524 237.97 159.003 237.97C158.062 237.97 157.242 238.204 156.544 238.671C155.845 239.133 155.304 239.808 154.919 240.695C154.534 241.577 154.342 242.648 154.342 243.909C154.342 245.205 154.534 246.294 154.919 247.176C155.31 248.058 155.854 248.724 156.553 249.174C157.251 249.623 158.059 249.848 158.976 249.848C159.491 249.848 159.968 249.78 160.406 249.644C160.85 249.508 161.243 249.31 161.586 249.049C161.93 248.783 162.214 248.46 162.439 248.082C162.67 247.703 162.829 247.271 162.918 246.786L166.807 246.803C166.706 247.638 166.454 248.443 166.052 249.218C165.655 249.987 165.12 250.677 164.445 251.287C163.776 251.89 162.977 252.37 162.048 252.725C161.125 253.074 160.08 253.249 158.914 253.249C157.293 253.249 155.842 252.882 154.564 252.148C153.292 251.414 152.285 250.351 151.546 248.961C150.812 247.57 150.445 245.886 150.445 243.909C150.445 241.926 150.818 240.24 151.563 238.849C152.309 237.458 153.321 236.398 154.6 235.67C155.878 234.937 157.316 234.57 158.914 234.57C159.968 234.57 160.944 234.718 161.844 235.013C162.749 235.309 163.551 235.741 164.25 236.31C164.948 236.872 165.516 237.561 165.954 238.378C166.398 239.195 166.682 240.13 166.807 241.184ZM173.274 234.818V253H169.492V234.818H173.274ZM176.304 253V239.364H180.086V253H176.304ZM178.204 237.606C177.641 237.606 177.159 237.419 176.756 237.047C176.36 236.668 176.162 236.215 176.162 235.688C176.162 235.167 176.36 234.721 176.756 234.348C177.159 233.969 177.641 233.779 178.204 233.779C178.766 233.779 179.245 233.969 179.642 234.348C180.044 234.721 180.245 235.167 180.245 235.688C180.245 236.215 180.044 236.668 179.642 237.047C179.245 237.419 178.766 237.606 178.204 237.606ZM189.33 253.266C187.927 253.266 186.72 252.982 185.708 252.414C184.701 251.84 183.926 251.029 183.382 249.982C182.837 248.928 182.565 247.682 182.565 246.244C182.565 244.841 182.837 243.61 183.382 242.551C183.926 241.491 184.692 240.666 185.681 240.074C186.675 239.482 187.841 239.186 189.179 239.186C190.078 239.186 190.916 239.331 191.691 239.621C192.472 239.905 193.153 240.334 193.733 240.908C194.319 241.482 194.775 242.205 195.1 243.075C195.426 243.939 195.589 244.951 195.589 246.111V247.15H184.074V244.806H192.029C192.029 244.261 191.91 243.779 191.673 243.359C191.437 242.938 191.108 242.61 190.688 242.373C190.274 242.131 189.791 242.009 189.241 242.009C188.667 242.009 188.158 242.142 187.714 242.409C187.276 242.669 186.933 243.021 186.684 243.465C186.436 243.903 186.308 244.391 186.302 244.93V247.158C186.302 247.833 186.427 248.416 186.675 248.907C186.93 249.399 187.288 249.777 187.749 250.044C188.211 250.31 188.759 250.443 189.392 250.443C189.812 250.443 190.197 250.384 190.546 250.266C190.895 250.147 191.194 249.97 191.443 249.733C191.691 249.496 191.881 249.206 192.011 248.863L195.509 249.094C195.331 249.934 194.967 250.668 194.417 251.295C193.872 251.917 193.168 252.402 192.304 252.751C191.446 253.095 190.454 253.266 189.33 253.266ZM201.839 245.116V253H198.057V239.364H201.661V241.77H201.821C202.123 240.976 202.629 240.349 203.339 239.887C204.049 239.42 204.91 239.186 205.922 239.186C206.869 239.186 207.695 239.393 208.399 239.808C209.104 240.222 209.651 240.814 210.042 241.583C210.432 242.347 210.628 243.258 210.628 244.317V253H206.846V244.992C206.852 244.158 206.639 243.507 206.206 243.039C205.774 242.566 205.18 242.329 204.422 242.329C203.913 242.329 203.463 242.438 203.073 242.657C202.688 242.876 202.386 243.196 202.167 243.616C201.954 244.03 201.844 244.531 201.839 245.116ZM220.862 239.364V242.205H212.65V239.364H220.862ZM214.514 236.097H218.296V248.81C218.296 249.159 218.349 249.431 218.456 249.626C218.562 249.816 218.71 249.949 218.9 250.026C219.095 250.103 219.32 250.141 219.574 250.141C219.752 250.141 219.929 250.127 220.107 250.097C220.284 250.061 220.421 250.035 220.515 250.017L221.11 252.831C220.921 252.891 220.654 252.959 220.311 253.036C219.968 253.118 219.551 253.169 219.059 253.186C218.148 253.222 217.349 253.101 216.662 252.822C215.982 252.544 215.452 252.112 215.073 251.526C214.694 250.94 214.508 250.201 214.514 249.307V236.097Z" fill="#03031C"/>
+<g filter="url(#filter1_bd_15_838)">
+<rect x="827" y="71" width="233" height="233" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="827.5" y="71.5" width="232" height="232" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M909.752 201.256L909.752 117.744" stroke="#03031C" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M978.392 201.256L978.392 117.744" stroke="#03031C" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M897.74 129.184L909.752 117.744L921.192 129.184" stroke="#03031C" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M966.38 129.184L978.392 117.744L989.832 129.184" stroke="#03031C" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<rect x="929.772" y="122.32" width="28.6" height="48.048" rx="1.144" fill="#EA26A9"/>
+<path d="M929.772 175.516C929.772 174.884 930.284 174.372 930.916 174.372H957.228C957.86 174.372 958.372 174.884 958.372 175.516V181.236C958.372 181.868 957.86 182.38 957.228 182.38H930.916C930.284 182.38 929.772 181.868 929.772 181.236V175.516Z" fill="#EA26A9"/>
+<rect x="929.772" y="186.384" width="28.6" height="6.864" rx="1.144" fill="#EA26A9"/>
+<rect x="929.772" y="197.252" width="28.6" height="4.004" rx="1.144" fill="#EA26A9"/>
+<path d="M896.484 234.818H900.328V246.626C900.328 247.951 900.012 249.112 899.378 250.106C898.751 251.1 897.872 251.875 896.742 252.432C895.611 252.982 894.294 253.257 892.791 253.257C891.282 253.257 889.962 252.982 888.831 252.432C887.701 251.875 886.822 251.1 886.195 250.106C885.567 249.112 885.254 247.951 885.254 246.626V234.818H889.098V246.297C889.098 246.99 889.249 247.605 889.55 248.144C889.858 248.682 890.29 249.106 890.847 249.413C891.403 249.721 892.051 249.875 892.791 249.875C893.537 249.875 894.185 249.721 894.735 249.413C895.291 249.106 895.721 248.682 896.022 248.144C896.33 247.605 896.484 246.99 896.484 246.297V234.818ZM903.42 258.114V239.364H907.149V241.654H907.317C907.483 241.287 907.723 240.914 908.036 240.536C908.356 240.151 908.77 239.831 909.279 239.577C909.794 239.316 910.433 239.186 911.197 239.186C912.191 239.186 913.109 239.446 913.949 239.967C914.789 240.482 915.461 241.261 915.964 242.302C916.467 243.338 916.719 244.637 916.719 246.2C916.719 247.721 916.473 249.005 915.982 250.053C915.497 251.094 914.834 251.884 913.993 252.423C913.159 252.956 912.224 253.222 911.188 253.222C910.454 253.222 909.83 253.101 909.315 252.858C908.806 252.615 908.389 252.31 908.063 251.944C907.737 251.571 907.489 251.195 907.317 250.816H907.202V258.114H903.42ZM907.122 246.182C907.122 246.993 907.234 247.7 907.459 248.304C907.684 248.907 908.01 249.378 908.436 249.715C908.862 250.047 909.38 250.212 909.989 250.212C910.605 250.212 911.126 250.044 911.552 249.706C911.978 249.363 912.301 248.89 912.52 248.286C912.745 247.676 912.857 246.975 912.857 246.182C912.857 245.395 912.748 244.702 912.529 244.104C912.31 243.507 911.987 243.039 911.561 242.702C911.135 242.364 910.611 242.196 909.989 242.196C909.374 242.196 908.853 242.358 908.427 242.684C908.007 243.009 907.684 243.471 907.459 244.069C907.234 244.667 907.122 245.371 907.122 246.182ZM930.586 243.252L927.124 243.465C927.065 243.169 926.937 242.903 926.742 242.666C926.547 242.424 926.289 242.231 925.97 242.089C925.656 241.941 925.28 241.867 924.842 241.867C924.256 241.867 923.762 241.991 923.36 242.24C922.957 242.483 922.756 242.808 922.756 243.217C922.756 243.542 922.886 243.817 923.146 244.042C923.407 244.267 923.854 244.448 924.487 244.584L926.955 245.081C928.281 245.353 929.269 245.791 929.92 246.395C930.571 246.999 930.897 247.792 930.897 248.774C930.897 249.668 930.633 250.452 930.107 251.127C929.586 251.801 928.87 252.328 927.958 252.707C927.053 253.08 926.008 253.266 924.824 253.266C923.019 253.266 921.581 252.891 920.51 252.139C919.444 251.381 918.82 250.351 918.636 249.049L922.356 248.854C922.469 249.404 922.741 249.825 923.173 250.115C923.605 250.399 924.159 250.541 924.833 250.541C925.496 250.541 926.029 250.414 926.431 250.159C926.84 249.899 927.047 249.564 927.053 249.156C927.047 248.813 926.902 248.531 926.618 248.312C926.334 248.088 925.896 247.916 925.304 247.798L922.942 247.327C921.611 247.061 920.619 246.599 919.968 245.942C919.323 245.285 919 244.448 919 243.43C919 242.554 919.237 241.799 919.711 241.166C920.19 240.533 920.862 240.044 921.726 239.701C922.596 239.358 923.614 239.186 924.78 239.186C926.502 239.186 927.858 239.55 928.846 240.278C929.84 241.006 930.42 241.997 930.586 243.252ZM940.531 239.364V242.205H932.319V239.364H940.531ZM934.184 236.097H937.966V248.81C937.966 249.159 938.019 249.431 938.126 249.626C938.232 249.816 938.38 249.949 938.569 250.026C938.765 250.103 938.99 250.141 939.244 250.141C939.422 250.141 939.599 250.127 939.777 250.097C939.954 250.061 940.091 250.035 940.185 250.017L940.78 252.831C940.591 252.891 940.324 252.959 939.981 253.036C939.638 253.118 939.221 253.169 938.729 253.186C937.818 253.222 937.019 253.101 936.332 252.822C935.652 252.544 935.122 252.112 934.743 251.526C934.364 250.94 934.178 250.201 934.184 249.307V236.097ZM942.995 253V239.364H946.662V241.743H946.804C947.052 240.897 947.47 240.257 948.055 239.825C948.641 239.387 949.316 239.168 950.08 239.168C950.269 239.168 950.473 239.18 950.692 239.204C950.911 239.228 951.104 239.26 951.269 239.301V242.657C951.092 242.604 950.846 242.557 950.532 242.515C950.219 242.474 949.932 242.453 949.671 242.453C949.115 242.453 948.618 242.574 948.18 242.817C947.748 243.054 947.404 243.385 947.15 243.811C946.901 244.238 946.777 244.729 946.777 245.285V253H942.995ZM958.804 253.266C957.402 253.266 956.194 252.982 955.182 252.414C954.176 251.84 953.401 251.029 952.856 249.982C952.312 248.928 952.039 247.682 952.039 246.244C952.039 244.841 952.312 243.61 952.856 242.551C953.401 241.491 954.167 240.666 955.155 240.074C956.15 239.482 957.316 239.186 958.653 239.186C959.553 239.186 960.39 239.331 961.166 239.621C961.947 239.905 962.628 240.334 963.208 240.908C963.794 241.482 964.249 242.205 964.575 243.075C964.9 243.939 965.063 244.951 965.063 246.111V247.15H953.549V244.806H961.503C961.503 244.261 961.385 243.779 961.148 243.359C960.911 242.938 960.583 242.61 960.163 242.373C959.748 242.131 959.266 242.009 958.716 242.009C958.141 242.009 957.632 242.142 957.189 242.409C956.751 242.669 956.407 243.021 956.159 243.465C955.91 243.903 955.783 244.391 955.777 244.93V247.158C955.777 247.833 955.901 248.416 956.15 248.907C956.404 249.399 956.762 249.777 957.224 250.044C957.686 250.31 958.233 250.443 958.866 250.443C959.287 250.443 959.671 250.384 960.021 250.266C960.37 250.147 960.669 249.97 960.917 249.733C961.166 249.496 961.355 249.206 961.485 248.863L964.983 249.094C964.806 249.934 964.442 250.668 963.891 251.295C963.347 251.917 962.642 252.402 961.778 252.751C960.92 253.095 959.929 253.266 958.804 253.266ZM971.42 253.257C970.55 253.257 969.774 253.107 969.094 252.805C968.413 252.497 967.874 252.044 967.478 251.446C967.087 250.843 966.892 250.091 966.892 249.191C966.892 248.434 967.031 247.798 967.309 247.283C967.587 246.768 967.966 246.353 968.446 246.04C968.925 245.726 969.47 245.489 970.079 245.33C970.695 245.17 971.34 245.057 972.015 244.992C972.808 244.909 973.447 244.832 973.932 244.761C974.417 244.684 974.77 244.572 974.989 244.424C975.208 244.276 975.317 244.057 975.317 243.767V243.714C975.317 243.152 975.14 242.717 974.784 242.409C974.435 242.101 973.938 241.947 973.293 241.947C972.612 241.947 972.071 242.098 971.668 242.4C971.266 242.696 970.999 243.069 970.869 243.518L967.371 243.234C967.549 242.406 967.898 241.69 968.419 241.086C968.94 240.476 969.612 240.009 970.434 239.683C971.263 239.352 972.222 239.186 973.311 239.186C974.068 239.186 974.793 239.275 975.486 239.452C976.184 239.63 976.803 239.905 977.341 240.278C977.886 240.651 978.315 241.13 978.629 241.716C978.942 242.296 979.099 242.992 979.099 243.803V253H975.512V251.109H975.406C975.187 251.535 974.894 251.911 974.527 252.237C974.16 252.556 973.719 252.808 973.204 252.991C972.689 253.169 972.094 253.257 971.42 253.257ZM972.503 250.647C973.059 250.647 973.55 250.538 973.977 250.319C974.403 250.094 974.737 249.792 974.98 249.413C975.222 249.035 975.344 248.605 975.344 248.126V246.679C975.225 246.756 975.063 246.827 974.855 246.892C974.654 246.951 974.426 247.007 974.172 247.061C973.917 247.108 973.663 247.152 973.408 247.194C973.154 247.229 972.923 247.262 972.716 247.292C972.272 247.357 971.884 247.46 971.553 247.602C971.221 247.744 970.964 247.937 970.78 248.179C970.597 248.416 970.505 248.712 970.505 249.067C970.505 249.582 970.692 249.976 971.065 250.248C971.443 250.514 971.923 250.647 972.503 250.647ZM982.033 253V239.364H985.638V241.77H985.797C986.081 240.971 986.555 240.34 987.218 239.879C987.881 239.417 988.674 239.186 989.597 239.186C990.532 239.186 991.328 239.42 991.985 239.887C992.642 240.349 993.08 240.976 993.299 241.77H993.441C993.719 240.988 994.222 240.364 994.95 239.896C995.684 239.423 996.551 239.186 997.552 239.186C998.824 239.186 999.857 239.592 1000.65 240.402C1001.45 241.207 1001.85 242.35 1001.85 243.829V253H998.075V244.575C998.075 243.817 997.874 243.249 997.472 242.87C997.069 242.492 996.566 242.302 995.962 242.302C995.276 242.302 994.74 242.521 994.356 242.959C993.971 243.391 993.779 243.962 993.779 244.673V253H990.112V244.495C990.112 243.826 989.92 243.294 989.535 242.897C989.156 242.5 988.656 242.302 988.035 242.302C987.614 242.302 987.236 242.409 986.898 242.622C986.567 242.829 986.303 243.122 986.108 243.501C985.913 243.874 985.815 244.312 985.815 244.815V253H982.033Z" fill="#03031C"/>
+<g filter="url(#filter2_bd_15_838)">
+<rect x="448" y="71" width="233" height="233" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="448.5" y="71.5" width="232" height="232" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M519.2 143.4H582.4M593.6 133.539L608.4 143.4H593.6" stroke="#8438FA" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M608.4 154.2L593.4 154.2M539.612 161.004V167.8L519.2 154.2H582.4" stroke="#BB11FF" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M539.6 138.6V115.4C539.6 110.982 543.182 107.4 547.6 107.4H580C584.418 107.4 588 110.982 588 115.4V182.2C588 186.618 584.418 190.2 580 190.2H547.6C543.182 190.2 539.6 186.618 539.6 182.2V173.2" stroke="#03031C" stroke-width="2.86" stroke-linecap="round"/>
+<path d="M516.486 220.988V217.818H531.419V220.988H525.853V236H522.053V220.988H516.486ZM534.579 241.114C534.1 241.114 533.65 241.075 533.23 240.998C532.816 240.927 532.472 240.835 532.2 240.723L533.052 237.9C533.496 238.036 533.896 238.11 534.251 238.122C534.612 238.134 534.923 238.051 535.183 237.873C535.449 237.696 535.666 237.394 535.831 236.968L536.053 236.391L531.161 222.364H535.139L537.962 232.378H538.104L540.954 222.364H544.958L539.658 237.474C539.403 238.208 539.057 238.847 538.619 239.391C538.187 239.942 537.639 240.365 536.976 240.661C536.314 240.963 535.515 241.114 534.579 241.114ZM550.32 232.076L550.329 227.539H550.879L555.247 222.364H559.588L553.72 229.217H552.823L550.32 232.076ZM546.893 236V217.818H550.675V236H546.893ZM555.416 236L551.403 230.061L553.924 227.388L559.846 236H555.416ZM570.435 236H566.316L572.592 217.818H577.546L583.814 236H579.694L575.14 221.973H574.998L570.435 236ZM570.177 228.853H579.907V231.854H570.177V228.853ZM586.002 236V217.818H593.175C594.554 217.818 595.729 218.082 596.7 218.608C597.671 219.129 598.41 219.854 598.919 220.783C599.434 221.707 599.692 222.772 599.692 223.979C599.692 225.187 599.431 226.252 598.911 227.175C598.39 228.099 597.635 228.818 596.647 229.333C595.664 229.848 594.475 230.105 593.078 230.105H588.506V227.025H592.456C593.196 227.025 593.806 226.897 594.285 226.643C594.77 226.382 595.132 226.024 595.368 225.569C595.611 225.107 595.732 224.577 595.732 223.979C595.732 223.376 595.611 222.849 595.368 222.399C595.132 221.943 594.77 221.591 594.285 221.343C593.8 221.088 593.184 220.961 592.439 220.961H589.846V236H586.002ZM606.033 217.818V236H602.189V217.818H606.033ZM524.206 258.695C524.081 258.263 523.907 257.882 523.682 257.55C523.457 257.213 523.182 256.929 522.856 256.698C522.537 256.461 522.17 256.281 521.755 256.156C521.347 256.032 520.894 255.97 520.397 255.97C519.468 255.97 518.651 256.201 517.947 256.662C517.248 257.124 516.704 257.796 516.313 258.678C515.923 259.554 515.727 260.625 515.727 261.891C515.727 263.158 515.92 264.235 516.304 265.123C516.689 266.011 517.234 266.688 517.938 267.156C518.642 267.618 519.474 267.848 520.433 267.848C521.303 267.848 522.045 267.694 522.661 267.387C523.282 267.073 523.756 266.632 524.081 266.064C524.413 265.496 524.579 264.824 524.579 264.049L525.36 264.164H520.672V261.27H528.281V263.56C528.281 265.158 527.943 266.531 527.269 267.68C526.594 268.822 525.665 269.704 524.481 270.325C523.297 270.941 521.942 271.249 520.415 271.249C518.71 271.249 517.213 270.873 515.923 270.121C514.632 269.364 513.626 268.289 512.904 266.898C512.188 265.502 511.83 263.844 511.83 261.927C511.83 260.453 512.043 259.139 512.469 257.985C512.901 256.825 513.505 255.843 514.28 255.038C515.056 254.233 515.958 253.62 516.988 253.2C518.018 252.78 519.133 252.57 520.335 252.57C521.365 252.57 522.324 252.721 523.211 253.022C524.099 253.318 524.886 253.739 525.573 254.283C526.265 254.828 526.831 255.476 527.269 256.227C527.707 256.973 527.988 257.796 528.112 258.695H524.206ZM534.986 271.257C534.116 271.257 533.34 271.107 532.66 270.805C531.979 270.497 531.44 270.044 531.044 269.446C530.653 268.843 530.458 268.091 530.458 267.191C530.458 266.434 530.597 265.798 530.875 265.283C531.153 264.768 531.532 264.353 532.012 264.04C532.491 263.726 533.035 263.489 533.645 263.33C534.261 263.17 534.906 263.057 535.58 262.992C536.374 262.909 537.013 262.832 537.498 262.761C537.983 262.684 538.336 262.572 538.555 262.424C538.773 262.276 538.883 262.057 538.883 261.767V261.714C538.883 261.152 538.705 260.717 538.35 260.409C538.001 260.101 537.504 259.947 536.859 259.947C536.178 259.947 535.637 260.098 535.234 260.4C534.832 260.696 534.565 261.069 534.435 261.518L530.937 261.234C531.115 260.406 531.464 259.69 531.985 259.086C532.506 258.476 533.177 258.009 534 257.683C534.829 257.352 535.788 257.186 536.877 257.186C537.634 257.186 538.359 257.275 539.052 257.452C539.75 257.63 540.369 257.905 540.907 258.278C541.452 258.651 541.881 259.13 542.194 259.716C542.508 260.296 542.665 260.992 542.665 261.803V271H539.078V269.109H538.972C538.753 269.535 538.46 269.911 538.093 270.237C537.726 270.556 537.285 270.808 536.77 270.991C536.255 271.169 535.66 271.257 534.986 271.257ZM536.069 268.647C536.625 268.647 537.116 268.538 537.542 268.319C537.969 268.094 538.303 267.792 538.546 267.413C538.788 267.035 538.91 266.605 538.91 266.126V264.679C538.791 264.756 538.628 264.827 538.421 264.892C538.22 264.951 537.992 265.007 537.738 265.061C537.483 265.108 537.229 265.152 536.974 265.194C536.72 265.229 536.489 265.262 536.282 265.292C535.838 265.357 535.45 265.46 535.119 265.602C534.787 265.744 534.53 265.937 534.346 266.179C534.163 266.416 534.071 266.712 534.071 267.067C534.071 267.582 534.258 267.976 534.631 268.248C535.009 268.514 535.489 268.647 536.069 268.647ZM552.852 257.364V260.205H544.64V257.364H552.852ZM546.505 254.097H550.287V266.81C550.287 267.159 550.34 267.431 550.446 267.626C550.553 267.816 550.701 267.949 550.89 268.026C551.086 268.103 551.31 268.141 551.565 268.141C551.743 268.141 551.92 268.127 552.098 268.097C552.275 268.061 552.411 268.035 552.506 268.017L553.101 270.831C552.911 270.891 552.645 270.959 552.302 271.036C551.959 271.118 551.541 271.169 551.05 271.186C550.139 271.222 549.34 271.101 548.653 270.822C547.972 270.544 547.443 270.112 547.064 269.526C546.685 268.94 546.499 268.201 546.505 267.307V254.097ZM561.384 271.266C559.981 271.266 558.774 270.982 557.762 270.414C556.756 269.84 555.98 269.029 555.436 267.982C554.891 266.928 554.619 265.682 554.619 264.244C554.619 262.841 554.891 261.61 555.436 260.551C555.98 259.491 556.747 258.666 557.735 258.074C558.729 257.482 559.895 257.186 561.233 257.186C562.133 257.186 562.97 257.331 563.745 257.621C564.527 257.905 565.207 258.334 565.787 258.908C566.373 259.482 566.829 260.205 567.154 261.075C567.48 261.939 567.643 262.951 567.643 264.111V265.15H556.128V262.806H564.083C564.083 262.261 563.964 261.779 563.728 261.359C563.491 260.938 563.162 260.61 562.742 260.373C562.328 260.131 561.846 260.009 561.295 260.009C560.721 260.009 560.212 260.142 559.768 260.409C559.33 260.669 558.987 261.021 558.738 261.465C558.49 261.903 558.362 262.391 558.357 262.93V265.158C558.357 265.833 558.481 266.416 558.729 266.907C558.984 267.399 559.342 267.777 559.804 268.044C560.265 268.31 560.813 268.443 561.446 268.443C561.866 268.443 562.251 268.384 562.6 268.266C562.949 268.147 563.248 267.97 563.497 267.733C563.745 267.496 563.935 267.206 564.065 266.863L567.563 267.094C567.385 267.934 567.021 268.668 566.471 269.295C565.926 269.917 565.222 270.402 564.358 270.751C563.5 271.095 562.508 271.266 561.384 271.266ZM572.703 271L568.992 257.364H572.819L574.931 266.526H575.056L577.257 257.364H581.013L583.25 266.472H583.365L585.443 257.364H589.26L585.558 271H581.554L579.211 262.424H579.042L576.698 271H572.703ZM595.166 271.257C594.296 271.257 593.521 271.107 592.84 270.805C592.16 270.497 591.621 270.044 591.225 269.446C590.834 268.843 590.639 268.091 590.639 267.191C590.639 266.434 590.778 265.798 591.056 265.283C591.334 264.768 591.713 264.353 592.192 264.04C592.672 263.726 593.216 263.489 593.826 263.33C594.441 263.17 595.086 263.057 595.761 262.992C596.554 262.909 597.193 262.832 597.679 262.761C598.164 262.684 598.516 262.572 598.735 262.424C598.954 262.276 599.064 262.057 599.064 261.767V261.714C599.064 261.152 598.886 260.717 598.531 260.409C598.182 260.101 597.685 259.947 597.04 259.947C596.359 259.947 595.817 260.098 595.415 260.4C595.012 260.696 594.746 261.069 594.616 261.518L591.118 261.234C591.296 260.406 591.645 259.69 592.166 259.086C592.686 258.476 593.358 258.009 594.181 257.683C595.009 257.352 595.968 257.186 597.057 257.186C597.815 257.186 598.54 257.275 599.232 257.452C599.931 257.63 600.549 257.905 601.088 258.278C601.632 258.651 602.061 259.13 602.375 259.716C602.689 260.296 602.846 260.992 602.846 261.803V271H599.259V269.109H599.152C598.933 269.535 598.64 269.911 598.274 270.237C597.907 270.556 597.466 270.808 596.951 270.991C596.436 271.169 595.841 271.257 595.166 271.257ZM596.249 268.647C596.806 268.647 597.297 268.538 597.723 268.319C598.149 268.094 598.484 267.792 598.726 267.413C598.969 267.035 599.09 266.605 599.09 266.126V264.679C598.972 264.756 598.809 264.827 598.602 264.892C598.401 264.951 598.173 265.007 597.918 265.061C597.664 265.108 597.409 265.152 597.155 265.194C596.9 265.229 596.67 265.262 596.462 265.292C596.019 265.357 595.631 265.46 595.299 265.602C594.968 265.744 594.711 265.937 594.527 266.179C594.344 266.416 594.252 266.712 594.252 267.067C594.252 267.582 594.438 267.976 594.811 268.248C595.19 268.514 595.669 268.647 596.249 268.647ZM607.626 276.114C607.147 276.114 606.697 276.075 606.277 275.998C605.863 275.927 605.519 275.835 605.247 275.723L606.099 272.9C606.543 273.036 606.943 273.11 607.298 273.122C607.659 273.134 607.97 273.051 608.23 272.873C608.496 272.696 608.712 272.394 608.878 271.968L609.1 271.391L604.208 257.364H608.186L611.009 267.378H611.151L614.001 257.364H618.005L612.704 272.474C612.45 273.208 612.104 273.847 611.666 274.391C611.234 274.942 610.686 275.365 610.023 275.661C609.36 275.963 608.561 276.114 607.626 276.114Z" fill="#03031C"/>
+<g filter="url(#filter3_bd_15_838)">
+<rect x="397" y="450" width="334" height="271" rx="20" fill="white" fill-opacity="0.85" shape-rendering="crispEdges"/>
+<rect x="397.5" y="450.5" width="333" height="270" rx="19.5" stroke="#E3CEFF" shape-rendering="crispEdges"/>
+</g>
+<path d="M588.142 503.029H539.75C536.583 503.035 533.547 504.292 531.305 506.525C529.063 508.758 527.799 511.786 527.787 514.947V548.178H600.213V515.076C600.201 511.885 598.926 508.827 596.665 506.57C594.403 504.313 591.34 503.041 588.142 503.029V503.029Z" stroke="#03031C" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M600.213 548.135L579.094 569.255V579.88C579.088 580.296 579.001 580.707 578.836 581.089C578.671 581.471 578.433 581.817 578.134 582.107C577.835 582.397 577.482 582.626 577.095 582.78C576.707 582.934 576.293 583.01 575.876 583.005H552.123C551.289 582.999 550.49 582.666 549.9 582.077C549.31 581.488 548.976 580.691 548.971 579.858V569.234L527.852 548.157L600.213 548.135Z" stroke="#03031C" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M578.878 482.36V502.963" stroke="#03031C" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M549.122 482.36V502.963" stroke="#03031C" stroke-width="2.86" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M510.465 632V613.818H517.638C519.017 613.818 520.192 614.082 521.163 614.608C522.133 615.129 522.873 615.854 523.382 616.783C523.897 617.707 524.155 618.772 524.155 619.979C524.155 621.187 523.894 622.252 523.373 623.175C522.853 624.099 522.098 624.818 521.11 625.333C520.127 625.848 518.937 626.105 517.541 626.105H512.969V623.025H516.919C517.659 623.025 518.269 622.897 518.748 622.643C519.233 622.382 519.594 622.024 519.831 621.569C520.074 621.107 520.195 620.577 520.195 619.979C520.195 619.376 520.074 618.849 519.831 618.399C519.594 617.943 519.233 617.591 518.748 617.343C518.263 617.088 517.647 616.961 516.901 616.961H514.309V632H510.465ZM530.362 613.818V632H526.581V613.818H530.362ZM542.137 626.194V618.364H545.919V632H542.288V629.523H542.146C541.838 630.322 541.326 630.964 540.61 631.45C539.9 631.935 539.032 632.178 538.009 632.178C537.097 632.178 536.295 631.97 535.603 631.556C534.91 631.142 534.369 630.553 533.978 629.789C533.593 629.026 533.398 628.112 533.392 627.046V618.364H537.174V626.371C537.18 627.176 537.396 627.813 537.822 628.28C538.248 628.748 538.819 628.982 539.536 628.982C539.991 628.982 540.417 628.878 540.814 628.671C541.21 628.458 541.53 628.144 541.773 627.73C542.021 627.315 542.143 626.804 542.137 626.194ZM555.087 637.398C553.862 637.398 552.812 637.229 551.936 636.892C551.066 636.56 550.373 636.107 549.858 635.533C549.343 634.959 549.009 634.314 548.855 633.598L552.353 633.127C552.459 633.4 552.628 633.654 552.859 633.891C553.09 634.128 553.395 634.317 553.773 634.459C554.158 634.607 554.626 634.681 555.176 634.681C555.999 634.681 556.676 634.48 557.209 634.077C557.748 633.681 558.017 633.015 558.017 632.08V629.585H557.857C557.691 629.964 557.443 630.322 557.111 630.659C556.78 630.997 556.354 631.272 555.833 631.485C555.312 631.698 554.691 631.805 553.969 631.805C552.945 631.805 552.013 631.568 551.172 631.094C550.338 630.615 549.672 629.884 549.175 628.902C548.683 627.913 548.438 626.664 548.438 625.155C548.438 623.61 548.689 622.32 549.192 621.284C549.695 620.249 550.364 619.473 551.199 618.958C552.039 618.444 552.96 618.186 553.96 618.186C554.723 618.186 555.362 618.316 555.877 618.577C556.392 618.831 556.807 619.151 557.12 619.536C557.44 619.914 557.686 620.287 557.857 620.654H557.999V618.364H561.755V632.133C561.755 633.293 561.47 634.264 560.902 635.045C560.334 635.826 559.547 636.412 558.541 636.803C557.541 637.199 556.389 637.398 555.087 637.398ZM555.167 628.964C555.777 628.964 556.292 628.813 556.712 628.511C557.138 628.203 557.464 627.765 557.688 627.197C557.919 626.623 558.035 625.936 558.035 625.137C558.035 624.338 557.922 623.646 557.697 623.06C557.472 622.468 557.147 622.009 556.721 621.684C556.295 621.358 555.777 621.196 555.167 621.196C554.546 621.196 554.022 621.364 553.596 621.702C553.17 622.033 552.847 622.495 552.628 623.087C552.409 623.679 552.3 624.362 552.3 625.137C552.3 625.925 552.409 626.605 552.628 627.179C552.853 627.748 553.176 628.188 553.596 628.502C554.022 628.81 554.546 628.964 555.167 628.964ZM564.764 632V618.364H568.546V632H564.764ZM566.664 616.606C566.102 616.606 565.619 616.419 565.217 616.047C564.82 615.668 564.622 615.215 564.622 614.688C564.622 614.167 564.82 613.721 565.217 613.348C565.619 612.969 566.102 612.779 566.664 612.779C567.226 612.779 567.706 612.969 568.102 613.348C568.505 613.721 568.706 614.167 568.706 614.688C568.706 615.215 568.505 615.668 568.102 616.047C567.706 616.419 567.226 616.606 566.664 616.606ZM575.358 624.116V632H571.576V618.364H575.18V620.77H575.34C575.642 619.976 576.148 619.349 576.858 618.887C577.568 618.42 578.429 618.186 579.441 618.186C580.388 618.186 581.214 618.393 581.918 618.808C582.623 619.222 583.17 619.814 583.561 620.583C583.951 621.347 584.147 622.258 584.147 623.317V632H580.365V623.992C580.371 623.158 580.158 622.507 579.725 622.039C579.293 621.566 578.699 621.329 577.941 621.329C577.432 621.329 576.982 621.438 576.592 621.657C576.207 621.876 575.905 622.196 575.686 622.616C575.473 623.03 575.364 623.531 575.358 624.116ZM587.962 624.711C587.962 622.51 588.255 620.482 588.841 618.63C589.433 616.777 590.335 615.061 591.549 613.481H595.162C594.7 614.067 594.271 614.783 593.875 615.629C593.478 616.47 593.132 617.393 592.836 618.399C592.54 619.405 592.309 620.447 592.143 621.524C591.978 622.595 591.895 623.658 591.895 624.711C591.895 626.114 592.037 627.531 592.321 628.964C592.611 630.39 593.002 631.716 593.493 632.941C593.99 634.166 594.546 635.169 595.162 635.951H591.549C590.335 634.37 589.433 632.654 588.841 630.801C588.255 628.949 587.962 626.919 587.962 624.711ZM608.703 622.252L605.24 622.465C605.181 622.169 605.054 621.903 604.859 621.666C604.663 621.424 604.406 621.231 604.086 621.089C603.773 620.941 603.397 620.867 602.959 620.867C602.373 620.867 601.879 620.991 601.476 621.24C601.074 621.483 600.873 621.808 600.873 622.217C600.873 622.542 601.003 622.817 601.263 623.042C601.524 623.267 601.97 623.448 602.604 623.584L605.072 624.081C606.397 624.353 607.386 624.791 608.037 625.395C608.688 625.999 609.013 626.792 609.013 627.774C609.013 628.668 608.75 629.452 608.223 630.127C607.703 630.801 606.986 631.328 606.075 631.707C605.169 632.08 604.125 632.266 602.941 632.266C601.136 632.266 599.698 631.891 598.626 631.139C597.561 630.381 596.937 629.351 596.753 628.049L600.473 627.854C600.585 628.404 600.858 628.825 601.29 629.115C601.722 629.399 602.275 629.541 602.95 629.541C603.613 629.541 604.145 629.414 604.548 629.159C604.956 628.899 605.163 628.564 605.169 628.156C605.163 627.813 605.018 627.531 604.734 627.312C604.45 627.088 604.012 626.916 603.42 626.798L601.059 626.327C599.727 626.061 598.736 625.599 598.085 624.942C597.44 624.285 597.117 623.448 597.117 622.43C597.117 621.554 597.354 620.799 597.827 620.166C598.307 619.533 598.979 619.044 599.843 618.701C600.713 618.358 601.731 618.186 602.897 618.186C604.619 618.186 605.974 618.55 606.963 619.278C607.957 620.006 608.537 620.997 608.703 622.252ZM617.769 624.711C617.769 626.919 617.473 628.949 616.881 630.801C616.296 632.654 615.396 634.37 614.183 635.951H610.569C611.031 635.365 611.46 634.649 611.857 633.802C612.253 632.956 612.599 632.033 612.895 631.032C613.191 630.026 613.422 628.984 613.588 627.907C613.754 626.83 613.836 625.765 613.836 624.711C613.836 623.309 613.691 621.894 613.401 620.468C613.117 619.035 612.727 617.71 612.229 616.49C611.738 615.265 611.185 614.262 610.569 613.481H614.183C615.396 615.061 616.296 616.777 616.881 618.63C617.473 620.482 617.769 622.51 617.769 624.711Z" fill="#03031C"/>
+<path d="M439.431 664.864C439.431 663.074 439.663 661.429 440.127 659.928C440.596 658.422 441.264 657.037 442.13 655.773H443.608C443.267 656.241 442.947 656.819 442.649 657.506C442.355 658.187 442.097 658.938 441.875 659.757C441.652 660.571 441.477 661.414 441.349 662.286C441.226 663.157 441.164 664.016 441.164 664.864C441.164 665.991 441.273 667.134 441.491 668.294C441.709 669.454 442.002 670.531 442.372 671.526C442.741 672.52 443.153 673.33 443.608 673.955H442.13C441.264 672.69 440.596 671.308 440.127 669.807C439.663 668.301 439.431 666.653 439.431 664.864ZM450.42 671.227C449.369 671.227 448.463 670.995 447.7 670.531C446.943 670.062 446.358 669.409 445.946 668.571C445.539 667.728 445.335 666.748 445.335 665.631C445.335 664.513 445.539 663.528 445.946 662.676C446.358 661.819 446.931 661.152 447.665 660.673C448.403 660.19 449.265 659.949 450.25 659.949C450.818 659.949 451.379 660.044 451.933 660.233C452.487 660.422 452.991 660.73 453.446 661.156C453.901 661.578 454.263 662.136 454.533 662.832C454.803 663.528 454.938 664.385 454.938 665.403V666.114H446.528V664.665H453.233C453.233 664.049 453.11 663.5 452.864 663.017C452.622 662.534 452.277 662.153 451.827 661.874C451.382 661.594 450.856 661.455 450.25 661.455C449.582 661.455 449.005 661.62 448.517 661.952C448.034 662.278 447.662 662.705 447.402 663.23C447.142 663.756 447.011 664.319 447.011 664.92V665.886C447.011 666.71 447.153 667.409 447.438 667.982C447.726 668.55 448.126 668.983 448.638 669.281C449.149 669.575 449.743 669.722 450.42 669.722C450.861 669.722 451.259 669.66 451.614 669.537C451.973 669.409 452.284 669.22 452.544 668.969C452.804 668.713 453.006 668.396 453.148 668.017L454.767 668.472C454.597 669.021 454.31 669.504 453.908 669.92C453.505 670.332 453.008 670.654 452.416 670.886C451.824 671.114 451.159 671.227 450.42 671.227ZM458.709 671.114C458.358 671.114 458.058 670.988 457.807 670.737C457.556 670.486 457.43 670.186 457.43 669.835C457.43 669.485 457.556 669.184 457.807 668.933C458.058 668.682 458.358 668.557 458.709 668.557C459.059 668.557 459.36 668.682 459.611 668.933C459.862 669.184 459.987 669.485 459.987 669.835C459.987 670.067 459.928 670.28 459.81 670.474C459.696 670.669 459.542 670.825 459.348 670.943C459.159 671.057 458.946 671.114 458.709 671.114ZM467.398 675.318C466.589 675.318 465.893 675.214 465.31 675.006C464.728 674.802 464.243 674.532 463.854 674.196C463.471 673.865 463.165 673.509 462.938 673.131L464.273 672.193C464.425 672.392 464.617 672.619 464.849 672.875C465.081 673.135 465.398 673.36 465.8 673.55C466.208 673.744 466.74 673.841 467.398 673.841C468.279 673.841 469.006 673.628 469.579 673.202C470.152 672.776 470.438 672.108 470.438 671.199V668.983H470.296C470.173 669.182 469.998 669.428 469.771 669.722C469.548 670.01 469.226 670.268 468.805 670.496C468.388 670.718 467.825 670.83 467.114 670.83C466.234 670.83 465.443 670.621 464.742 670.205C464.046 669.788 463.495 669.182 463.087 668.386C462.685 667.591 462.484 666.625 462.484 665.489C462.484 664.371 462.68 663.398 463.073 662.57C463.466 661.736 464.013 661.092 464.714 660.638C465.415 660.179 466.224 659.949 467.143 659.949C467.853 659.949 468.416 660.067 468.833 660.304C469.254 660.536 469.576 660.801 469.799 661.099C470.026 661.393 470.201 661.634 470.325 661.824H470.495V660.091H472.114V671.312C472.114 672.25 471.901 673.012 471.475 673.599C471.054 674.191 470.486 674.625 469.771 674.899C469.06 675.179 468.27 675.318 467.398 675.318ZM467.342 669.324C468.014 669.324 468.582 669.17 469.046 668.862C469.51 668.554 469.863 668.112 470.104 667.534C470.346 666.956 470.467 666.265 470.467 665.46C470.467 664.674 470.348 663.981 470.112 663.379C469.875 662.778 469.524 662.307 469.06 661.966C468.596 661.625 468.023 661.455 467.342 661.455C466.631 661.455 466.04 661.634 465.566 661.994C465.097 662.354 464.745 662.837 464.508 663.443C464.276 664.049 464.16 664.722 464.16 665.46C464.16 666.218 464.278 666.888 464.515 667.47C464.756 668.048 465.112 668.502 465.58 668.834C466.054 669.161 466.641 669.324 467.342 669.324ZM476.404 671.114C476.054 671.114 475.753 670.988 475.502 670.737C475.251 670.486 475.126 670.186 475.126 669.835C475.126 669.485 475.251 669.184 475.502 668.933C475.753 668.682 476.054 668.557 476.404 668.557C476.754 668.557 477.055 668.682 477.306 668.933C477.557 669.184 477.683 669.485 477.683 669.835C477.683 670.067 477.623 670.28 477.505 670.474C477.391 670.669 477.237 670.825 477.043 670.943C476.854 671.057 476.641 671.114 476.404 671.114ZM487.139 671H485.293L490.634 656.455H492.452L497.793 671H495.946L491.599 658.756H491.486L487.139 671ZM487.821 665.318H495.264V666.881H487.821V665.318ZM506.706 666.54V660.091H508.382V671H506.706V669.153H506.592C506.337 669.707 505.939 670.179 505.399 670.567C504.859 670.95 504.178 671.142 503.354 671.142C502.672 671.142 502.066 670.993 501.536 670.695C501.005 670.392 500.589 669.937 500.286 669.331C499.982 668.72 499.831 667.951 499.831 667.023V660.091H501.507V666.909C501.507 667.705 501.73 668.339 502.175 668.812C502.625 669.286 503.197 669.523 503.893 669.523C504.31 669.523 504.734 669.416 505.165 669.203C505.6 668.99 505.965 668.663 506.259 668.223C506.557 667.783 506.706 667.222 506.706 666.54ZM516.196 660.091V661.511H510.543V660.091H516.196ZM512.191 657.477H513.867V667.875C513.867 668.348 513.935 668.704 514.073 668.94C514.215 669.172 514.395 669.329 514.613 669.409C514.835 669.485 515.069 669.523 515.316 669.523C515.5 669.523 515.652 669.513 515.77 669.494C515.889 669.471 515.983 669.452 516.054 669.438L516.395 670.943C516.282 670.986 516.123 671.028 515.919 671.071C515.716 671.118 515.458 671.142 515.145 671.142C514.672 671.142 514.208 671.04 513.753 670.837C513.303 670.633 512.929 670.323 512.631 669.906C512.337 669.49 512.191 668.964 512.191 668.33V657.477ZM520.628 664.438V671H518.952V656.455H520.628V661.795H520.77C521.026 661.232 521.409 660.785 521.921 660.453C522.437 660.117 523.123 659.949 523.98 659.949C524.724 659.949 525.375 660.098 525.934 660.396C526.492 660.69 526.926 661.142 527.233 661.753C527.546 662.359 527.702 663.131 527.702 664.068V671H526.026V664.182C526.026 663.315 525.801 662.645 525.351 662.172C524.906 661.694 524.288 661.455 523.498 661.455C522.948 661.455 522.456 661.571 522.02 661.803C521.589 662.035 521.248 662.373 520.998 662.818C520.751 663.263 520.628 663.803 520.628 664.438ZM533.268 669.011L533.155 669.778C533.074 670.318 532.951 670.896 532.786 671.511C532.625 672.127 532.456 672.707 532.281 673.251C532.106 673.796 531.962 674.229 531.848 674.551H530.57C530.631 674.248 530.712 673.848 530.811 673.351C530.911 672.854 531.01 672.297 531.109 671.682C531.214 671.071 531.299 670.446 531.365 669.807L531.45 669.011H533.268ZM541.431 658.017V656.455H552.34V658.017H547.766V671H546.005V658.017H541.431ZM553.698 671V660.091H555.317V661.739H555.431C555.63 661.199 555.99 660.761 556.511 660.425C557.031 660.089 557.619 659.92 558.272 659.92C558.395 659.92 558.549 659.923 558.734 659.928C558.918 659.932 559.058 659.939 559.153 659.949V661.653C559.096 661.639 558.966 661.618 558.762 661.589C558.563 661.556 558.353 661.54 558.13 661.54C557.6 661.54 557.126 661.651 556.71 661.874C556.298 662.091 555.971 662.394 555.729 662.783C555.493 663.166 555.374 663.604 555.374 664.097V671H553.698ZM564.35 671.256C563.658 671.256 563.031 671.125 562.468 670.865C561.904 670.6 561.457 670.219 561.125 669.722C560.794 669.22 560.628 668.614 560.628 667.903C560.628 667.278 560.751 666.772 560.998 666.384C561.244 665.991 561.573 665.683 561.985 665.46C562.397 665.238 562.851 665.072 563.348 664.963C563.85 664.849 564.355 664.759 564.861 664.693C565.524 664.608 566.061 664.544 566.473 664.501C566.89 664.454 567.193 664.376 567.382 664.267C567.577 664.158 567.674 663.969 567.674 663.699V663.642C567.674 662.941 567.482 662.397 567.098 662.009C566.72 661.62 566.144 661.426 565.373 661.426C564.572 661.426 563.945 661.601 563.49 661.952C563.036 662.302 562.716 662.676 562.532 663.074L560.941 662.506C561.225 661.843 561.604 661.327 562.077 660.957C562.555 660.583 563.076 660.323 563.64 660.176C564.208 660.025 564.766 659.949 565.316 659.949C565.666 659.949 566.069 659.991 566.523 660.077C566.982 660.157 567.425 660.325 567.851 660.581C568.282 660.837 568.64 661.223 568.924 661.739C569.208 662.255 569.35 662.946 569.35 663.812V671H567.674V669.523H567.588C567.475 669.759 567.285 670.013 567.02 670.283C566.755 670.553 566.402 670.782 565.962 670.972C565.522 671.161 564.984 671.256 564.35 671.256ZM564.605 669.75C565.268 669.75 565.827 669.62 566.282 669.359C566.741 669.099 567.087 668.763 567.319 668.351C567.555 667.939 567.674 667.506 567.674 667.051V665.517C567.603 665.602 567.446 665.68 567.205 665.751C566.968 665.818 566.694 665.877 566.381 665.929C566.073 665.976 565.773 666.019 565.479 666.057C565.19 666.09 564.956 666.118 564.776 666.142C564.34 666.199 563.933 666.291 563.554 666.419C563.18 666.542 562.877 666.729 562.645 666.98C562.418 667.226 562.304 667.562 562.304 667.989C562.304 668.571 562.52 669.011 562.951 669.31C563.386 669.603 563.938 669.75 564.605 669.75ZM574.085 664.438V671H572.409V660.091H574.028V661.795H574.17C574.426 661.241 574.814 660.796 575.335 660.46C575.856 660.119 576.528 659.949 577.352 659.949C578.091 659.949 578.737 660.1 579.291 660.403C579.845 660.702 580.276 661.156 580.584 661.767C580.892 662.373 581.045 663.14 581.045 664.068V671H579.369V664.182C579.369 663.325 579.147 662.657 578.702 662.179C578.257 661.696 577.646 661.455 576.869 661.455C576.334 661.455 575.856 661.571 575.435 661.803C575.018 662.035 574.689 662.373 574.447 662.818C574.206 663.263 574.085 663.803 574.085 664.438ZM591.836 662.534L590.33 662.96C590.235 662.709 590.096 662.465 589.911 662.229C589.731 661.987 589.485 661.788 589.172 661.632C588.86 661.476 588.46 661.398 587.972 661.398C587.304 661.398 586.748 661.552 586.303 661.859C585.863 662.162 585.642 662.548 585.642 663.017C585.642 663.434 585.794 663.763 586.097 664.004C586.4 664.246 586.873 664.447 587.517 664.608L589.137 665.006C590.112 665.242 590.839 665.605 591.317 666.092C591.795 666.575 592.034 667.198 592.034 667.96C592.034 668.585 591.855 669.144 591.495 669.636C591.14 670.129 590.642 670.517 590.003 670.801C589.364 671.085 588.621 671.227 587.773 671.227C586.66 671.227 585.739 670.986 585.01 670.503C584.281 670.02 583.819 669.314 583.625 668.386L585.216 667.989C585.368 668.576 585.654 669.016 586.076 669.31C586.502 669.603 587.058 669.75 587.745 669.75C588.526 669.75 589.146 669.584 589.605 669.253C590.069 668.917 590.301 668.514 590.301 668.045C590.301 667.667 590.169 667.349 589.904 667.094C589.639 666.833 589.231 666.639 588.682 666.511L586.864 666.085C585.865 665.848 585.131 665.482 584.662 664.984C584.198 664.482 583.966 663.855 583.966 663.102C583.966 662.487 584.139 661.942 584.485 661.469C584.835 660.995 585.311 660.624 585.912 660.354C586.518 660.084 587.205 659.949 587.972 659.949C589.051 659.949 589.899 660.186 590.515 660.659C591.135 661.133 591.575 661.758 591.836 662.534ZM599.415 660.091V661.511H593.535V660.091H599.415ZM595.296 671V658.585C595.296 657.96 595.443 657.439 595.737 657.023C596.03 656.606 596.411 656.294 596.88 656.085C597.349 655.877 597.844 655.773 598.364 655.773C598.776 655.773 599.112 655.806 599.373 655.872C599.633 655.938 599.827 656 599.955 656.057L599.472 657.506C599.387 657.477 599.269 657.442 599.117 657.399C598.97 657.357 598.776 657.335 598.535 657.335C597.981 657.335 597.581 657.475 597.335 657.754C597.093 658.034 596.972 658.443 596.972 658.983V671H595.296ZM605.747 671.227C604.762 671.227 603.898 670.993 603.155 670.524C602.416 670.055 601.839 669.4 601.422 668.557C601.01 667.714 600.804 666.729 600.804 665.602C600.804 664.466 601.01 663.474 601.422 662.626C601.839 661.779 602.416 661.121 603.155 660.652C603.898 660.183 604.762 659.949 605.747 659.949C606.732 659.949 607.594 660.183 608.332 660.652C609.076 661.121 609.653 661.779 610.065 662.626C610.482 663.474 610.69 664.466 610.69 665.602C610.69 666.729 610.482 667.714 610.065 668.557C609.653 669.4 609.076 670.055 608.332 670.524C607.594 670.993 606.732 671.227 605.747 671.227ZM605.747 669.722C606.495 669.722 607.111 669.53 607.594 669.146C608.077 668.763 608.434 668.259 608.666 667.634C608.898 667.009 609.014 666.331 609.014 665.602C609.014 664.873 608.898 664.194 608.666 663.564C608.434 662.934 608.077 662.425 607.594 662.037C607.111 661.649 606.495 661.455 605.747 661.455C604.999 661.455 604.384 661.649 603.901 662.037C603.418 662.425 603.06 662.934 602.828 663.564C602.596 664.194 602.48 664.873 602.48 665.602C602.48 666.331 602.596 667.009 602.828 667.634C603.06 668.259 603.418 668.763 603.901 669.146C604.384 669.53 604.999 669.722 605.747 669.722ZM613.249 671V660.091H614.868V661.739H614.982C615.181 661.199 615.541 660.761 616.061 660.425C616.582 660.089 617.169 659.92 617.823 659.92C617.946 659.92 618.1 659.923 618.284 659.928C618.469 659.932 618.609 659.939 618.703 659.949V661.653C618.647 661.639 618.516 661.618 618.313 661.589C618.114 661.556 617.903 661.54 617.681 661.54C617.15 661.54 616.677 661.651 616.26 661.874C615.848 662.091 615.522 662.394 615.28 662.783C615.043 663.166 614.925 663.604 614.925 664.097V671H613.249ZM620.69 671V660.091H622.31V661.795H622.452C622.679 661.213 623.046 660.761 623.553 660.439C624.059 660.112 624.668 659.949 625.378 659.949C626.098 659.949 626.696 660.112 627.175 660.439C627.658 660.761 628.034 661.213 628.304 661.795H628.418C628.697 661.232 629.116 660.785 629.675 660.453C630.233 660.117 630.903 659.949 631.685 659.949C632.66 659.949 633.458 660.254 634.078 660.865C634.698 661.471 635.009 662.416 635.009 663.699V671H633.332V663.699C633.332 662.894 633.112 662.319 632.672 661.973C632.232 661.627 631.713 661.455 631.116 661.455C630.349 661.455 629.755 661.687 629.334 662.151C628.912 662.61 628.702 663.192 628.702 663.898V671H626.997V663.528C626.997 662.908 626.796 662.409 626.393 662.03C625.991 661.646 625.473 661.455 624.838 661.455C624.402 661.455 623.995 661.571 623.616 661.803C623.242 662.035 622.939 662.357 622.707 662.768C622.48 663.176 622.366 663.647 622.366 664.182V671H620.69ZM641.283 671.256C640.592 671.256 639.965 671.125 639.401 670.865C638.838 670.6 638.39 670.219 638.059 669.722C637.728 669.22 637.562 668.614 637.562 667.903C637.562 667.278 637.685 666.772 637.931 666.384C638.177 665.991 638.506 665.683 638.918 665.46C639.33 665.238 639.785 665.072 640.282 664.963C640.784 664.849 641.288 664.759 641.795 664.693C642.458 664.608 642.995 664.544 643.407 664.501C643.824 664.454 644.127 664.376 644.316 664.267C644.51 664.158 644.607 663.969 644.607 663.699V663.642C644.607 662.941 644.415 662.397 644.032 662.009C643.653 661.62 643.078 661.426 642.306 661.426C641.506 661.426 640.879 661.601 640.424 661.952C639.969 662.302 639.65 662.676 639.465 663.074L637.874 662.506C638.158 661.843 638.537 661.327 639.011 660.957C639.489 660.583 640.01 660.323 640.573 660.176C641.141 660.025 641.7 659.949 642.249 659.949C642.6 659.949 643.002 659.991 643.457 660.077C643.916 660.157 644.359 660.325 644.785 660.581C645.216 660.837 645.573 661.223 645.857 661.739C646.141 662.255 646.283 662.946 646.283 663.812V671H644.607V669.523H644.522C644.408 669.759 644.219 670.013 643.954 670.283C643.689 670.553 643.336 670.782 642.896 670.972C642.455 671.161 641.918 671.256 641.283 671.256ZM641.539 669.75C642.202 669.75 642.761 669.62 643.215 669.359C643.674 669.099 644.02 668.763 644.252 668.351C644.489 667.939 644.607 667.506 644.607 667.051V665.517C644.536 665.602 644.38 665.68 644.138 665.751C643.902 665.818 643.627 665.877 643.315 665.929C643.007 665.976 642.706 666.019 642.413 666.057C642.124 666.09 641.889 666.118 641.71 666.142C641.274 666.199 640.867 666.291 640.488 666.419C640.114 666.542 639.811 666.729 639.579 666.98C639.352 667.226 639.238 667.562 639.238 667.989C639.238 668.571 639.453 669.011 639.884 669.31C640.32 669.603 640.871 669.75 641.539 669.75ZM654.087 660.091V661.511H648.434V660.091H654.087ZM650.081 657.477H651.757V667.875C651.757 668.348 651.826 668.704 651.963 668.94C652.105 669.172 652.285 669.329 652.503 669.409C652.726 669.485 652.96 669.523 653.206 669.523C653.391 669.523 653.542 669.513 653.661 669.494C653.779 669.471 653.874 669.452 653.945 669.438L654.286 670.943C654.172 670.986 654.014 671.028 653.81 671.071C653.606 671.118 653.348 671.142 653.036 671.142C652.562 671.142 652.098 671.04 651.644 670.837C651.194 670.633 650.82 670.323 650.522 669.906C650.228 669.49 650.081 668.964 650.081 668.33V657.477ZM656.608 671V660.091H658.284V671H656.608ZM657.461 658.273C657.134 658.273 656.852 658.161 656.615 657.939C656.383 657.716 656.267 657.449 656.267 657.136C656.267 656.824 656.383 656.556 656.615 656.334C656.852 656.111 657.134 656 657.461 656C657.787 656 658.067 656.111 658.299 656.334C658.535 656.556 658.654 656.824 658.654 657.136C658.654 657.449 658.535 657.716 658.299 657.939C658.067 658.161 657.787 658.273 657.461 658.273ZM665.786 671.227C664.801 671.227 663.937 670.993 663.194 670.524C662.455 670.055 661.878 669.4 661.461 668.557C661.049 667.714 660.843 666.729 660.843 665.602C660.843 664.466 661.049 663.474 661.461 662.626C661.878 661.779 662.455 661.121 663.194 660.652C663.937 660.183 664.801 659.949 665.786 659.949C666.771 659.949 667.633 660.183 668.371 660.652C669.115 661.121 669.692 661.779 670.104 662.626C670.521 663.474 670.729 664.466 670.729 665.602C670.729 666.729 670.521 667.714 670.104 668.557C669.692 669.4 669.115 670.055 668.371 670.524C667.633 670.993 666.771 671.227 665.786 671.227ZM665.786 669.722C666.534 669.722 667.15 669.53 667.633 669.146C668.116 668.763 668.473 668.259 668.705 667.634C668.937 667.009 669.053 666.331 669.053 665.602C669.053 664.873 668.937 664.194 668.705 663.564C668.473 662.934 668.116 662.425 667.633 662.037C667.15 661.649 666.534 661.455 665.786 661.455C665.038 661.455 664.423 661.649 663.94 662.037C663.457 662.425 663.099 662.934 662.867 663.564C662.635 664.194 662.519 664.873 662.519 665.602C662.519 666.331 662.635 667.009 662.867 667.634C663.099 668.259 663.457 668.763 663.94 669.146C664.423 669.53 665.038 669.722 665.786 669.722ZM674.964 664.438V671H673.288V660.091H674.907V661.795H675.049C675.305 661.241 675.693 660.796 676.214 660.46C676.735 660.119 677.407 659.949 678.231 659.949C678.97 659.949 679.616 660.1 680.17 660.403C680.724 660.702 681.155 661.156 681.463 661.767C681.77 662.373 681.924 663.14 681.924 664.068V671H680.248V664.182C680.248 663.325 680.026 662.657 679.581 662.179C679.136 661.696 678.525 661.455 677.748 661.455C677.213 661.455 676.735 661.571 676.314 661.803C675.897 662.035 675.568 662.373 675.326 662.818C675.085 663.263 674.964 663.803 674.964 664.438ZM688.567 664.864C688.567 666.653 688.332 668.301 687.864 669.807C687.4 671.308 686.734 672.69 685.868 673.955H684.391C684.732 673.486 685.049 672.908 685.342 672.222C685.641 671.54 685.901 670.792 686.124 669.977C686.346 669.158 686.519 668.313 686.642 667.442C686.77 666.566 686.834 665.706 686.834 664.864C686.834 663.737 686.725 662.593 686.507 661.433C686.289 660.273 685.996 659.196 685.626 658.202C685.257 657.207 684.845 656.398 684.391 655.773H685.868C686.734 657.037 687.4 658.422 687.864 659.928C688.332 661.429 688.567 663.074 688.567 664.864Z" fill="#03031C"/>
+<path d="M312.293 187.293C311.902 187.683 311.902 188.317 312.293 188.707L318.657 195.071C319.047 195.462 319.681 195.462 320.071 195.071C320.462 194.681 320.462 194.047 320.071 193.657L314.414 188L320.071 182.343C320.462 181.953 320.462 181.319 320.071 180.929C319.681 180.538 319.047 180.538 318.657 180.929L312.293 187.293ZM437.707 188.707C438.098 188.317 438.098 187.683 437.707 187.293L431.343 180.929C430.953 180.538 430.319 180.538 429.929 180.929C429.538 181.319 429.538 181.953 429.929 182.343L435.586 188L429.929 193.657C429.538 194.047 429.538 194.681 429.929 195.071C430.319 195.462 430.953 195.462 431.343 195.071L437.707 188.707ZM313 189H437V187H313V189Z" fill="#03031C"/>
+<path d="M563.293 439.707C563.683 440.098 564.317 440.098 564.707 439.707L571.071 433.343C571.462 432.953 571.462 432.319 571.071 431.929C570.681 431.538 570.047 431.538 569.657 431.929L564 437.586L558.343 431.929C557.953 431.538 557.319 431.538 556.929 431.929C556.538 432.319 556.538 432.953 556.929 433.343L563.293 439.707ZM564.707 314.293C564.317 313.902 563.683 313.902 563.293 314.293L556.929 320.657C556.538 321.047 556.538 321.681 556.929 322.071C557.319 322.462 557.953 322.462 558.343 322.071L564 316.414L569.657 322.071C570.047 322.462 570.681 322.462 571.071 322.071C571.462 321.681 571.462 321.047 571.071 320.657L564.707 314.293ZM565 439V315H563V439H565Z" fill="#03031C"/>
+<path d="M691.293 187.293C690.902 187.683 690.902 188.317 691.293 188.707L697.657 195.071C698.047 195.462 698.681 195.462 699.071 195.071C699.462 194.681 699.462 194.047 699.071 193.657L693.414 188L699.071 182.343C699.462 181.953 699.462 181.319 699.071 180.929C698.681 180.538 698.047 180.538 697.657 180.929L691.293 187.293ZM816.707 188.707C817.098 188.317 817.098 187.683 816.707 187.293L810.343 180.929C809.953 180.538 809.319 180.538 808.929 180.929C808.538 181.319 808.538 181.953 808.929 182.343L814.586 188L808.929 193.657C808.538 194.047 808.538 194.681 808.929 195.071C809.319 195.462 809.953 195.462 810.343 195.071L816.707 188.707ZM692 189H816V187H692V189Z" fill="#03031C"/>
+<defs>
+<filter id="filter0_bd_15_838" x="44" y="50" width="283" height="283" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_15_838"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_15_838" result="effect2_dropShadow_15_838"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_15_838" result="shape"/>
+</filter>
+<filter id="filter1_bd_15_838" x="802" y="50" width="283" height="283" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_15_838"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_15_838" result="effect2_dropShadow_15_838"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_15_838" result="shape"/>
+</filter>
+<filter id="filter2_bd_15_838" x="423" y="50" width="283" height="283" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_15_838"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_15_838" result="effect2_dropShadow_15_838"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_15_838" result="shape"/>
+</filter>
+<filter id="filter3_bd_15_838" x="372" y="429" width="384" height="321" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feGaussianBlur in="BackgroundImageFix" stdDeviation="5"/>
+<feComposite in2="SourceAlpha" operator="in" result="effect1_backgroundBlur_15_838"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="4"/>
+<feGaussianBlur stdDeviation="12.5"/>
+<feComposite in2="hardAlpha" operator="out"/>
+<feColorMatrix type="matrix" values="0 0 0 0 0.356863 0 0 0 0 0.309804 0 0 0 0 0.403922 0 0 0 0.25 0"/>
+<feBlend mode="normal" in2="effect1_backgroundBlur_15_838" result="effect2_dropShadow_15_838"/>
+<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow_15_838" result="shape"/>
+</filter>
+</defs>
+</svg>
diff --git a/img/plugins/postman_all_get_requests.png b/img/plugins/postman_all_get_requests.png
new file mode 100644
index 0000000000..81008fa369
Binary files /dev/null and b/img/plugins/postman_all_get_requests.png differ
diff --git a/img/plugins/postman_success.png b/img/plugins/postman_success.png
new file mode 100644
index 0000000000..6ccee84629
Binary files /dev/null and b/img/plugins/postman_success.png differ
diff --git a/img/plugins/span_attributes.png b/img/plugins/span_attributes.png
new file mode 100644
index 0000000000..350ff4ac43
Binary files /dev/null and b/img/plugins/span_attributes.png differ
diff --git a/img/plugins/span_error_handling.png b/img/plugins/span_error_handling.png
new file mode 100644
index 0000000000..857c658f50
Binary files /dev/null and b/img/plugins/span_error_handling.png differ
diff --git a/img/plugins/span_from_context.png b/img/plugins/span_from_context.png
new file mode 100644
index 0000000000..fc9a1bae9a
Binary files /dev/null and b/img/plugins/span_from_context.png differ
diff --git a/img/plugins/span_name_and_status.png b/img/plugins/span_name_and_status.png
new file mode 100644
index 0000000000..eafe4f1c66
Binary files /dev/null and b/img/plugins/span_name_and_status.png differ
diff --git a/img/poc.svg b/img/poc.svg
new file mode 100644
index 0000000000..0c1497ba00
--- /dev/null
+++ b/img/poc.svg
@@ -0,0 +1,12 @@
+<svg width="251" height="250" viewBox="0 0 251 250" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M209.706 118.159C205.892 74.2912 169.517 39.8627 124.816 39.3902H37.3164V129.478C39.2291 174.516 75.3677 210.846 120.541 212.5H209.954V118.396C209.954 118.171 209.706 118.171 209.706 118.171V118.159Z" fill="#F7F7FF"/>
+<path d="M213.554 116.28C209.74 72.4122 173.365 37.9725 128.664 37.5H41.1641V127.588C43.0768 172.626 79.2154 208.956 124.389 210.61H213.801V116.505C213.801 116.28 213.554 116.28 213.554 116.28Z" stroke="#505071" stroke-width="3.97" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M142.789 152.214C142.789 153.604 141.667 154.721 140.273 154.721H140.05V154.51H109.44V154.721H109.218C107.833 154.721 106.701 153.604 106.701 152.214C106.701 150.825 107.833 149.717 109.218 149.717H140.283C141.677 149.717 142.799 150.845 142.799 152.214H142.789Z" fill="#D1D1E0"/>
+<path d="M140.05 154.5V165.303C140.05 171.827 134.745 177.103 128.206 177.103H121.274C114.735 177.103 109.43 171.827 109.43 165.303V154.5H140.04H140.05Z" fill="#D1D1E0"/>
+<path d="M159.666 105.478C159.666 118.093 148.579 124.96 142.769 135.199C141.263 137.837 140.464 143.093 140.06 148.6H131.824V133.991C131.824 133.578 132.168 132.742 132.461 132.461L133.926 131.001C134.977 129.943 135.755 128.091 135.755 126.591V107.954C136.483 107.36 136.958 106.454 136.958 105.478C136.958 103.726 135.523 102.316 133.774 102.316C132.026 102.316 130.591 103.736 130.591 105.478C130.591 106.404 131.005 107.27 131.672 107.864V126.591C131.672 126.993 131.329 127.829 131.046 128.121L129.58 129.581C128.519 130.628 127.741 132.491 127.741 133.991V148.6H121.577V133.991C121.577 132.491 120.809 130.638 119.737 129.581L118.272 128.121C117.989 127.829 117.645 127.004 117.645 126.591V107.864C118.312 107.27 118.727 106.404 118.727 105.478C118.727 103.726 117.292 102.316 115.543 102.316C113.795 102.316 112.36 103.736 112.36 105.478C112.36 106.454 112.815 107.36 113.563 107.954V126.591C113.563 128.091 114.331 129.933 115.392 131.001L116.857 132.461C117.15 132.742 117.494 133.568 117.494 133.991V148.6H109.723C109.308 143.103 108.51 137.837 107.014 135.199C101.203 124.96 90.1172 118.093 90.1172 105.478C90.097 86.338 105.68 70.8228 124.881 70.8228C144.082 70.8228 159.676 86.338 159.676 105.478H159.666Z" fill="#FFC743"/>
+<path d="M118.818 151.792H111.037C110.623 146.294 109.834 141.039 108.329 138.401C102.518 128.161 91.4316 121.295 91.4316 108.679C91.4316 89.5396 107.005 74.0245 126.206 74.0245C145.407 74.0245 161 89.5396 161 108.679C161 121.295 149.924 128.161 144.103 138.401C142.597 141.039 141.799 146.294 141.395 151.792H133.149" stroke="#505071" stroke-width="3.97" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M129.075 151.792H122.91" stroke="#505071" stroke-width="3.97" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M143.91 154.288C143.91 155.678 142.788 156.795 141.394 156.795H141.172V156.584H110.561V156.795H110.339C108.954 156.795 107.822 155.678 107.822 154.288C107.822 152.899 108.954 151.792 110.339 151.792H141.404C142.799 151.792 143.92 152.919 143.92 154.288H143.91Z" stroke="#505071" stroke-width="3.97" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M141.172 156.574H110.562V156.785H141.172V156.574Z" stroke="#03031C" stroke-width="2.94" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M141.172 156.574V167.377C141.172 173.901 135.867 179.177 129.328 179.177H122.396C115.857 179.177 110.552 173.901 110.552 167.377V156.574H141.162H141.172Z" stroke="#505071" stroke-width="3.97" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/img/portal/portal-add-certificate-form.png b/img/portal/portal-add-certificate-form.png
new file mode 100644
index 0000000000..fc92cf0bde
Binary files /dev/null and b/img/portal/portal-add-certificate-form.png differ
diff --git a/img/portal/portal-bind-certificate.png b/img/portal/portal-bind-certificate.png
new file mode 100644
index 0000000000..43cda34966
Binary files /dev/null and b/img/portal/portal-bind-certificate.png differ
diff --git a/img/portal/portal-certificate-management-mode.png b/img/portal/portal-certificate-management-mode.png
new file mode 100644
index 0000000000..7a0fb67768
Binary files /dev/null and b/img/portal/portal-certificate-management-mode.png differ
diff --git a/img/portal/portal-certificate-self-serve.png b/img/portal/portal-certificate-self-serve.png
new file mode 100644
index 0000000000..e50b3dc9be
Binary files /dev/null and b/img/portal/portal-certificate-self-serve.png differ
diff --git a/img/portal/portal-certificate-store.png b/img/portal/portal-certificate-store.png
new file mode 100644
index 0000000000..86175fe726
Binary files /dev/null and b/img/portal/portal-certificate-store.png differ
diff --git a/img/portal/portal-doc-only-apis-tab.png b/img/portal/portal-doc-only-apis-tab.png
new file mode 100644
index 0000000000..7c5edfb082
Binary files /dev/null and b/img/portal/portal-doc-only-apis-tab.png differ
diff --git a/img/portal/portal-doc-only-documentation-tab.png b/img/portal/portal-doc-only-documentation-tab.png
new file mode 100644
index 0000000000..c78c09728a
Binary files /dev/null and b/img/portal/portal-doc-only-documentation-tab.png differ
diff --git a/img/portal/portal-doc-only-live-portal.png b/img/portal/portal-doc-only-live-portal.png
new file mode 100644
index 0000000000..5da4a341be
Binary files /dev/null and b/img/portal/portal-doc-only-live-portal.png differ
diff --git a/img/portal/portal-doc-only-openapi-docs.png b/img/portal/portal-doc-only-openapi-docs.png
new file mode 100644
index 0000000000..f71c8f9005
Binary files /dev/null and b/img/portal/portal-doc-only-openapi-docs.png differ
diff --git a/img/portal/portal-graphql-cors.png b/img/portal/portal-graphql-cors.png
new file mode 100644
index 0000000000..59f87b1b19
Binary files /dev/null and b/img/portal/portal-graphql-cors.png differ
diff --git a/img/portal/portal-graphql-header-injection.png b/img/portal/portal-graphql-header-injection.png
new file mode 100644
index 0000000000..adbeff587b
Binary files /dev/null and b/img/portal/portal-graphql-header-injection.png differ
diff --git a/img/portal/portal-graphql-playground-viewdocs.png b/img/portal/portal-graphql-playground-viewdocs.png
new file mode 100644
index 0000000000..1667ad5cb4
Binary files /dev/null and b/img/portal/portal-graphql-playground-viewdocs.png differ
diff --git a/img/portal/portal-graphql-setup.png b/img/portal/portal-graphql-setup.png
new file mode 100644
index 0000000000..802f13f628
Binary files /dev/null and b/img/portal/portal-graphql-setup.png differ
diff --git a/img/portal/portal-graphql.png b/img/portal/portal-graphql.png
new file mode 100644
index 0000000000..1f85192ca8
Binary files /dev/null and b/img/portal/portal-graphql.png differ
diff --git a/img/portal/portal-manage-certificate.png b/img/portal/portal-manage-certificate.png
new file mode 100644
index 0000000000..89f51e8aa9
Binary files /dev/null and b/img/portal/portal-manage-certificate.png differ
diff --git a/img/pump/datadog-tyk-analytics-dashboard.jpeg b/img/pump/datadog-tyk-analytics-dashboard.jpeg
new file mode 100644
index 0000000000..01979b603b
Binary files /dev/null and b/img/pump/datadog-tyk-analytics-dashboard.jpeg differ
diff --git a/img/pump/moesif_step5.png b/img/pump/moesif_step5.png
new file mode 100644
index 0000000000..2b4dce944b
Binary files /dev/null and b/img/pump/moesif_step5.png differ
diff --git a/img/pump/prometheus/tyk_config_prometheus_target.png b/img/pump/prometheus/tyk_config_prometheus_target.png
new file mode 100644
index 0000000000..6c49f53ccc
Binary files /dev/null and b/img/pump/prometheus/tyk_config_prometheus_target.png differ
diff --git a/img/pump/prometheus/tyk_grafana_configuration.png b/img/pump/prometheus/tyk_grafana_configuration.png
new file mode 100644
index 0000000000..3298950394
Binary files /dev/null and b/img/pump/prometheus/tyk_grafana_configuration.png differ
diff --git a/img/pump/prometheus/tyk_prometheus_upstream_time.png b/img/pump/prometheus/tyk_prometheus_upstream_time.png
new file mode 100644
index 0000000000..8a6103b896
Binary files /dev/null and b/img/pump/prometheus/tyk_prometheus_upstream_time.png differ
diff --git a/img/pump/splunk_step1.png b/img/pump/splunk_step1.png
new file mode 100644
index 0000000000..ef3aba2f2a
Binary files /dev/null and b/img/pump/splunk_step1.png differ
diff --git a/img/pump/splunk_step2.png b/img/pump/splunk_step2.png
new file mode 100644
index 0000000000..ea442f57b6
Binary files /dev/null and b/img/pump/splunk_step2.png differ
diff --git a/img/pump/splunk_step2b.png b/img/pump/splunk_step2b.png
new file mode 100644
index 0000000000..9c39142703
Binary files /dev/null and b/img/pump/splunk_step2b.png differ
diff --git a/img/pump/splunk_step3.png b/img/pump/splunk_step3.png
new file mode 100644
index 0000000000..1826ed21a7
Binary files /dev/null and b/img/pump/splunk_step3.png differ
diff --git a/img/pump/splunk_step4.png b/img/pump/splunk_step4.png
new file mode 100644
index 0000000000..b09e7b4949
Binary files /dev/null and b/img/pump/splunk_step4.png differ
diff --git a/img/redhat-logo2.png b/img/redhat-logo2.png
new file mode 100644
index 0000000000..807b244748
Binary files /dev/null and b/img/redhat-logo2.png differ
diff --git a/img/release-notes/apply_policy.png b/img/release-notes/apply_policy.png
new file mode 100644
index 0000000000..d25cc859d7
Binary files /dev/null and b/img/release-notes/apply_policy.png differ
diff --git a/img/release-notes/blacklist_option.png b/img/release-notes/blacklist_option.png
new file mode 100644
index 0000000000..73b6290d26
Binary files /dev/null and b/img/release-notes/blacklist_option.png differ
diff --git a/img/release-notes/certificate_pinning.png b/img/release-notes/certificate_pinning.png
new file mode 100644
index 0000000000..97cc74d8b5
Binary files /dev/null and b/img/release-notes/certificate_pinning.png differ
diff --git a/img/release-notes/dev_list.png b/img/release-notes/dev_list.png
new file mode 100644
index 0000000000..4e0b52fdc0
Binary files /dev/null and b/img/release-notes/dev_list.png differ
diff --git a/img/release-notes/import_api_definition.png b/img/release-notes/import_api_definition.png
new file mode 100644
index 0000000000..046d6db912
Binary files /dev/null and b/img/release-notes/import_api_definition.png differ
diff --git a/img/release-notes/key_request_user.png b/img/release-notes/key_request_user.png
new file mode 100644
index 0000000000..90f1262ca2
Binary files /dev/null and b/img/release-notes/key_request_user.png differ
diff --git a/img/release-notes/live_search.png b/img/release-notes/live_search.png
new file mode 100644
index 0000000000..b4bdf16ee3
Binary files /dev/null and b/img/release-notes/live_search.png differ
diff --git a/img/release-notes/rate_limits.png b/img/release-notes/rate_limits.png
new file mode 100644
index 0000000000..e1de9c75a6
Binary files /dev/null and b/img/release-notes/rate_limits.png differ
diff --git a/img/release-notes/tag_headers.png b/img/release-notes/tag_headers.png
new file mode 100644
index 0000000000..7b4d71d03b
Binary files /dev/null and b/img/release-notes/tag_headers.png differ
diff --git a/img/release-notes/user_list.png b/img/release-notes/user_list.png
new file mode 100644
index 0000000000..27602283eb
Binary files /dev/null and b/img/release-notes/user_list.png differ
diff --git a/img/self-managed/self-managed-trial-add-key.png b/img/self-managed/self-managed-trial-add-key.png
new file mode 100644
index 0000000000..8800c7b034
Binary files /dev/null and b/img/self-managed/self-managed-trial-add-key.png differ
diff --git a/img/self-managed/self-managed-trial-architecture.png b/img/self-managed/self-managed-trial-architecture.png
new file mode 100644
index 0000000000..6fdff17b92
Binary files /dev/null and b/img/self-managed/self-managed-trial-architecture.png differ
diff --git a/img/self-managed/self-managed-trial-create-key.png b/img/self-managed/self-managed-trial-create-key.png
new file mode 100644
index 0000000000..e412c7becc
Binary files /dev/null and b/img/self-managed/self-managed-trial-create-key.png differ
diff --git a/img/self-managed/self-managed-trial-dashboard.png b/img/self-managed/self-managed-trial-dashboard.png
new file mode 100644
index 0000000000..be0f588cee
Binary files /dev/null and b/img/self-managed/self-managed-trial-dashboard.png differ
diff --git a/img/self-managed/self-managed-trial-delete-key.png b/img/self-managed/self-managed-trial-delete-key.png
new file mode 100644
index 0000000000..17a82235d5
Binary files /dev/null and b/img/self-managed/self-managed-trial-delete-key.png differ
diff --git a/img/self-managed/self-managed-trial-docker-status.png b/img/self-managed/self-managed-trial-docker-status.png
new file mode 100644
index 0000000000..2e563b065a
Binary files /dev/null and b/img/self-managed/self-managed-trial-docker-status.png differ
diff --git a/img/self-managed/self-managed-trial-log-browser.png b/img/self-managed/self-managed-trial-log-browser.png
new file mode 100644
index 0000000000..33de285266
Binary files /dev/null and b/img/self-managed/self-managed-trial-log-browser.png differ
diff --git a/img/self-managed/self-managed-trial-monitoring-overview.png b/img/self-managed/self-managed-trial-monitoring-overview.png
new file mode 100644
index 0000000000..ecaa9ab449
Binary files /dev/null and b/img/self-managed/self-managed-trial-monitoring-overview.png differ
diff --git a/img/self-managed/self-managed-trial-portal.png b/img/self-managed/self-managed-trial-portal.png
new file mode 100644
index 0000000000..0ff54d0f9b
Binary files /dev/null and b/img/self-managed/self-managed-trial-portal.png differ
diff --git a/img/self-managed/self-managed-trial-rate-limit-key.png b/img/self-managed/self-managed-trial-rate-limit-key.png
new file mode 100644
index 0000000000..a78648a2fe
Binary files /dev/null and b/img/self-managed/self-managed-trial-rate-limit-key.png differ
diff --git a/img/self-managed/self-managed-trial-xml-endpoint.png b/img/self-managed/self-managed-trial-xml-endpoint.png
new file mode 100644
index 0000000000..84b1a37384
Binary files /dev/null and b/img/self-managed/self-managed-trial-xml-endpoint.png differ
diff --git a/img/sso-auth0/auth0-accept.png b/img/sso-auth0/auth0-accept.png
new file mode 100644
index 0000000000..d4edf0fa0b
Binary files /dev/null and b/img/sso-auth0/auth0-accept.png differ
diff --git a/img/sso-auth0/auth0-app-basic-info.png b/img/sso-auth0/auth0-app-basic-info.png
new file mode 100644
index 0000000000..a6d7c55958
Binary files /dev/null and b/img/sso-auth0/auth0-app-basic-info.png differ
diff --git a/img/sso-auth0/auth0-app-type.png b/img/sso-auth0/auth0-app-type.png
new file mode 100644
index 0000000000..892bb82dbb
Binary files /dev/null and b/img/sso-auth0/auth0-app-type.png differ
diff --git a/img/sso-auth0/auth0-create-app.png b/img/sso-auth0/auth0-create-app.png
new file mode 100644
index 0000000000..820b0b3db6
Binary files /dev/null and b/img/sso-auth0/auth0-create-app.png differ
diff --git a/img/sso-auth0/auth0-create-user.png b/img/sso-auth0/auth0-create-user.png
new file mode 100644
index 0000000000..d2b618a82d
Binary files /dev/null and b/img/sso-auth0/auth0-create-user.png differ
diff --git a/img/sso-auth0/auth0-login.png b/img/sso-auth0/auth0-login.png
new file mode 100644
index 0000000000..e3e1424050
Binary files /dev/null and b/img/sso-auth0/auth0-login.png differ
diff --git a/img/sso-auth0/auth0-tyk-callback-url.png b/img/sso-auth0/auth0-tyk-callback-url.png
new file mode 100644
index 0000000000..116e34ae5a
Binary files /dev/null and b/img/sso-auth0/auth0-tyk-callback-url.png differ
diff --git a/img/sso-auth0/auth0-user-details.png b/img/sso-auth0/auth0-user-details.png
new file mode 100644
index 0000000000..48965e4bcc
Binary files /dev/null and b/img/sso-auth0/auth0-user-details.png differ
diff --git a/img/sso-auth0/tyk-create-profile.png b/img/sso-auth0/tyk-create-profile.png
new file mode 100644
index 0000000000..345802bc15
Binary files /dev/null and b/img/sso-auth0/tyk-create-profile.png differ
diff --git a/img/sso-auth0/tyk-dash-success.png b/img/sso-auth0/tyk-dash-success.png
new file mode 100644
index 0000000000..03a4dec01f
Binary files /dev/null and b/img/sso-auth0/tyk-dash-success.png differ
diff --git a/img/sso-auth0/tyk-id-profile-provider-config.png b/img/sso-auth0/tyk-id-profile-provider-config.png
new file mode 100644
index 0000000000..60a3f62d24
Binary files /dev/null and b/img/sso-auth0/tyk-id-profile-provider-config.png differ
diff --git a/img/sso-auth0/tyk-new-profile-config.png b/img/sso-auth0/tyk-new-profile-config.png
new file mode 100644
index 0000000000..8f0c9c9da1
Binary files /dev/null and b/img/sso-auth0/tyk-new-profile-config.png differ
diff --git a/img/sso-auth0/tyk-new-profile.png b/img/sso-auth0/tyk-new-profile.png
new file mode 100644
index 0000000000..b4d3a77aef
Binary files /dev/null and b/img/sso-auth0/tyk-new-profile.png differ
diff --git a/img/sso-auth0/tyk-openid.png b/img/sso-auth0/tyk-openid.png
new file mode 100644
index 0000000000..8e671a8560
Binary files /dev/null and b/img/sso-auth0/tyk-openid.png differ
diff --git a/img/sso-auth0/tyk-profile-list.png b/img/sso-auth0/tyk-profile-list.png
new file mode 100644
index 0000000000..f2bdd8b978
Binary files /dev/null and b/img/sso-auth0/tyk-profile-list.png differ
diff --git a/img/streams/create-new-api.png b/img/streams/create-new-api.png
new file mode 100644
index 0000000000..ae256ad85e
Binary files /dev/null and b/img/streams/create-new-api.png differ
diff --git a/img/streams/enable-portal-webhooks.png b/img/streams/enable-portal-webhooks.png
new file mode 100644
index 0000000000..5ad5bad21b
Binary files /dev/null and b/img/streams/enable-portal-webhooks.png differ
diff --git a/img/streams/selection.png b/img/streams/selection.png
new file mode 100644
index 0000000000..f08e54ce26
Binary files /dev/null and b/img/streams/selection.png differ
diff --git a/img/streams/streams-option.png b/img/streams/streams-option.png
new file mode 100644
index 0000000000..2080c00bb3
Binary files /dev/null and b/img/streams/streams-option.png differ
diff --git a/img/streams/subscribe-webhooks.png b/img/streams/subscribe-webhooks.png
new file mode 100644
index 0000000000..80dbea805d
Binary files /dev/null and b/img/streams/subscribe-webhooks.png differ
diff --git a/img/streams/tyk-streams-overview.png b/img/streams/tyk-streams-overview.png
new file mode 100644
index 0000000000..0fa05e109e
Binary files /dev/null and b/img/streams/tyk-streams-overview.png differ
diff --git a/img/swagger_dashboard_image.png b/img/swagger_dashboard_image.png
new file mode 100644
index 0000000000..c4bf751549
Binary files /dev/null and b/img/swagger_dashboard_image.png differ
diff --git a/img/swagger_gateway_direction_image.png b/img/swagger_gateway_direction_image.png
new file mode 100644
index 0000000000..d57f2037e6
Binary files /dev/null and b/img/swagger_gateway_direction_image.png differ
diff --git a/img/swagger_gateway_image.png b/img/swagger_gateway_image.png
new file mode 100644
index 0000000000..f74d351d15
Binary files /dev/null and b/img/swagger_gateway_image.png differ
diff --git a/img/tib/profiles/create-tib-profile1.png b/img/tib/profiles/create-tib-profile1.png
new file mode 100644
index 0000000000..1cd7c3417d
Binary files /dev/null and b/img/tib/profiles/create-tib-profile1.png differ
diff --git a/img/tib/profiles/create-tib-profile2.png b/img/tib/profiles/create-tib-profile2.png
new file mode 100644
index 0000000000..33e8b25498
Binary files /dev/null and b/img/tib/profiles/create-tib-profile2.png differ
diff --git a/img/tib/profiles/create-tib-profile3.png b/img/tib/profiles/create-tib-profile3.png
new file mode 100644
index 0000000000..2fe429036c
Binary files /dev/null and b/img/tib/profiles/create-tib-profile3.png differ
diff --git a/img/tib/profiles/create-tib-profile4.png b/img/tib/profiles/create-tib-profile4.png
new file mode 100644
index 0000000000..dc4db5299b
Binary files /dev/null and b/img/tib/profiles/create-tib-profile4.png differ
diff --git a/img/tib/profiles/tib-profile-creation.gif b/img/tib/profiles/tib-profile-creation.gif
new file mode 100644
index 0000000000..d81e4c8d79
Binary files /dev/null and b/img/tib/profiles/tib-profile-creation.gif differ
diff --git a/img/tyk-charts/tyk-cloud-deployment.png b/img/tyk-charts/tyk-cloud-deployment.png
new file mode 100644
index 0000000000..fd5f6c25b1
Binary files /dev/null and b/img/tyk-charts/tyk-cloud-deployment.png differ
diff --git a/img/tyk-cloud.svg b/img/tyk-cloud.svg
new file mode 100644
index 0000000000..cb1f3530f3
--- /dev/null
+++ b/img/tyk-cloud.svg
@@ -0,0 +1,11 @@
+<svg width="69" height="54" viewBox="0 0 69 54" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M31.2926 0.677824C30.8464 0.225941 30.2886 0 29.5634 0H10.0404V2.37238C10.0404 2.99372 10.2635 3.55858 10.7098 4.01046C11.156 4.46234 11.7696 4.74477 12.439 4.74477H18.6863V28.4121H20.9733C21.6427 28.4121 22.2005 28.1862 22.6467 27.7343C23.093 27.2824 23.3719 26.7176 23.3719 26.0962V4.68828H31.962V2.48536C31.962 1.86402 31.7389 1.18619 31.2926 0.677824Z" fill="#505071"/>
+<path d="M43.6758 8.64221C43.0065 8.64221 42.4487 8.86815 42.0024 9.32004C41.5562 9.77192 41.2773 10.3368 41.2773 10.9581V20.3912C40.4406 22.7071 37.9305 23.8368 35.253 23.8368C33.0218 23.8368 31.962 22.82 31.962 20.6736V11.0146C31.962 10.3933 31.7389 9.8284 31.2369 9.37652C30.7906 8.92464 30.2328 8.6987 29.5635 8.6987H27.2765V21.182C27.2765 25.9832 29.7308 28.4121 34.751 28.4121C37.2053 28.4121 39.9386 27.5648 41.2773 25.8138C41.1657 27.3389 40.9984 28.1297 40.1617 29.2594C39.2134 30.502 37.3727 31.0104 35.4204 31.0104C33.5796 31.0104 31.7947 30.615 29.8424 29.8807C29.5077 29.8242 29.2288 29.7677 28.9499 29.7677C27.8901 29.7677 27.2765 30.3326 27.2765 31.4058V33.3263L27.4438 33.4393C29.675 34.7949 32.2967 35.4728 35.4204 35.4728C41.9467 35.4728 45.9628 31.8577 45.9628 24.797V8.64221H43.6758Z" fill="#505071"/>
+<path d="M65.1512 19.7134C64.8165 18.6967 64.3703 18.5272 63.924 18.0753C64.1471 17.7929 64.426 17.228 64.8165 16.0418L67.7728 8.69874H65.0954C63.6451 8.69874 62.6969 9.32008 62.3064 10.4498L60.2983 15.1381C60.131 15.5335 59.6847 15.7029 58.9038 15.7029H54.4972V2.25941C54.4972 1.63808 54.2741 1.12971 53.8278 0.677824C53.3816 0.225941 52.8238 0 52.1544 0H49.8116V28.3556H52.1544C52.8238 28.3556 53.3816 28.1297 53.8836 27.6778C54.3298 27.2259 54.553 26.6611 54.553 26.0397L54.4972 20.5042H59.6847C60.4099 20.5042 60.633 20.8431 60.6888 21.1255L63.0873 26.7176C63.4778 27.8473 64.3703 28.4121 65.8205 28.4121H68.498L65.1512 19.7134Z" fill="#505071"/>
+<path d="M12.439 13.5564C12.1601 10.3368 9.5384 7.85141 6.30315 7.79492H1.22716H1.05982H0V8.86814V9.20706V14.3472C0.11156 17.6799 2.73323 20.3347 6.02425 20.4476H11.2118H11.3791H12.439V19.3744V13.5564C12.439 13.6129 12.439 13.6129 12.439 13.5564Z" fill="#00D9BA"/>
+<path d="M2.28699 41.6297C2.28699 39.3703 3.01213 37.5628 4.40663 36.3201C5.74535 35.0774 7.5861 34.4561 9.87308 34.4561C11.8812 34.4561 14.0008 34.8515 16.1762 35.6422V36.3201C16.1762 36.6025 16.0647 36.8849 15.8416 37.0544C15.6184 37.2803 15.3953 37.3933 15.1164 37.3933C13.1641 36.772 11.4349 36.4895 9.87308 36.4895C8.25546 36.4895 6.97252 36.9414 5.96847 37.8452C4.96443 38.8054 4.46241 40.0481 4.46241 41.6297V46.7699C4.46241 48.4079 4.96443 49.6506 5.96847 50.5544C6.97252 51.4582 8.25546 51.91 9.87308 51.91C11.4349 51.91 13.1641 51.6276 15.1164 51.0063C15.3953 51.0063 15.6184 51.1192 15.8416 51.3452C16.0647 51.5711 16.1762 51.7971 16.1762 52.0795V52.7573C14.0008 53.5481 11.9369 53.9435 9.87308 53.9435C7.5861 53.9435 5.80113 53.3222 4.40663 52.0795C3.01213 50.7803 2.28699 49.0293 2.28699 46.7699V41.6297Z" fill="#00D9BA"/>
+<path d="M18.7421 34.7385H19.7461C20.025 34.7385 20.2481 34.8515 20.4713 35.021C20.6944 35.2469 20.7502 35.4728 20.7502 35.7553V49.2553C20.7502 50.8368 21.0291 51.7406 21.5311 51.8536C21.7542 51.9101 22.0889 51.9666 22.3678 51.9666C22.5909 51.9666 22.814 51.9666 23.0371 51.9101C23.6507 51.9101 23.9854 52.136 23.9854 52.6444V53.6611C23.4276 53.7741 22.7582 53.8871 22.0889 53.8871C21.8658 53.8871 21.6426 53.8871 21.4753 53.8871C20.5828 53.8306 19.9134 53.4917 19.4672 52.8703C19.021 52.249 18.7421 51.0628 18.7421 49.2553V34.7385Z" fill="#00D9BA"/>
+<path d="M38.1536 46.8828C38.1536 51.6276 35.9782 53.9999 31.6831 53.9999C27.3323 53.9999 25.2126 51.6276 25.2126 46.8828C25.2126 42.138 27.3323 39.7656 31.6831 39.7656C35.9782 39.7656 38.1536 42.138 38.1536 46.8828ZM31.6831 41.6861C30.0097 41.6861 28.7826 42.1945 28.0574 43.2112C27.4996 44.0585 27.165 45.2447 27.165 46.8828C27.165 48.5209 27.4439 49.707 28.0574 50.5543C28.7826 51.5711 29.954 52.0794 31.6831 52.0794C33.4123 52.0794 34.5837 51.5711 35.3089 50.5543C35.8667 49.707 36.1456 48.5209 36.1456 46.8828C36.1456 45.2447 35.8667 44.0585 35.3089 43.2112C34.5837 42.1945 33.3565 41.6861 31.6831 41.6861Z" fill="#00D9BA"/>
+<path d="M50.9831 50.6674C49.9233 52.8703 48.3056 54 46.0744 54C42.8392 54 41.2773 52.4749 41.2773 49.4247V39.9352H42.2814C42.5603 39.9352 42.7834 40.0482 43.0065 40.2176C43.2296 40.4435 43.2854 40.6695 43.2854 40.9519V49.0858C43.2854 51.1193 44.3453 52.0795 46.4649 52.0795C48.8634 52.0795 50.3695 51.1193 51.0389 49.2553V40.9519C51.0389 40.6695 51.1504 40.4435 51.3178 40.2176C51.5409 39.9917 51.764 39.9352 52.0429 39.9352H53.0469V53.8306H52.0429C51.764 53.8306 51.5409 53.7176 51.3178 53.5482C51.0946 53.3222 51.0389 53.0963 51.0389 52.8138V50.6674H50.9831Z" fill="#00D9BA"/>
+<path d="M66.992 50.6674C65.9322 52.8703 64.3145 54 62.0833 54C58.0672 54 56.0591 51.6276 56.0591 46.8829C56.0591 42.1381 58.2345 39.7657 62.5296 39.7657C64.0356 39.7657 65.5417 40.0481 66.992 40.613V35.7553C66.992 35.4728 67.1035 35.2469 67.2709 35.021C67.494 34.795 67.7171 34.7385 67.996 34.7385H69.0001V53.8871H67.996C67.7171 53.8871 67.494 53.7741 67.2709 53.6046C67.0478 53.4352 66.992 53.1528 66.992 52.8703V50.6674ZM66.992 42.5335C65.4301 41.9687 63.9241 41.6862 62.5296 41.6862C60.912 41.6862 59.6848 42.1946 58.9596 43.1548C58.3461 44.0021 58.0114 45.2448 58.0114 46.8829C58.0114 48.5774 58.2903 49.8201 58.9039 50.6109C59.629 51.5712 60.7446 52.0795 62.418 52.0795C64.7608 52.0795 66.2668 51.0628 66.992 48.9728V42.5335Z" fill="#00D9BA"/>
+</svg>
diff --git a/img/tyk-sm.svg b/img/tyk-sm.svg
new file mode 100644
index 0000000000..79932b5dbf
--- /dev/null
+++ b/img/tyk-sm.svg
@@ -0,0 +1,11 @@
+<svg width="251" height="250" viewBox="0 0 251 250" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M209.706 118.159C205.892 74.2912 169.517 39.8628 124.816 39.3902H37.3164V129.478C39.2291 174.516 75.3677 210.846 120.541 212.5H209.954V118.396C209.954 118.171 209.706 118.171 209.706 118.171V118.159Z" fill="#00A3A0"/>
+<path d="M213.554 116.28C209.74 72.4122 173.365 37.9725 128.664 37.5H41.1641V127.588C43.0768 172.626 79.2154 208.956 124.389 210.61H213.801V116.505C213.801 116.28 213.554 116.28 213.554 116.28Z" stroke="#505071" stroke-width="3.97" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M176.234 88.6814H75.0191C72.9489 88.6814 71.2725 90.3578 71.2725 92.428V156.121C71.2725 158.191 72.9489 159.867 75.0191 159.867H176.223C178.293 159.867 179.97 158.191 179.97 156.121V92.428C179.97 90.3578 178.293 88.6814 176.223 88.6814H176.234Z" fill="#F7F7FF"/>
+<path d="M71.2725 148.627H179.981V156.121C179.981 158.191 178.304 159.867 176.234 159.867H75.0191C72.9489 159.867 71.2725 158.191 71.2725 156.121V148.627Z" fill="#D1D1E0"/>
+<path d="M138.745 159.867H112.507L106.882 174.854H144.371L138.756 159.867H138.745Z" fill="#D1D1E0"/>
+<path d="M179.744 86.9262H78.5289C76.4586 86.9262 74.7822 88.6026 74.7822 90.6728V154.365C74.7822 156.436 76.4586 158.112 78.5289 158.112H179.733C181.803 158.112 183.479 156.436 183.479 154.365V90.6728C183.479 88.6026 181.803 86.9262 179.733 86.9262H179.744Z" stroke="#505071" stroke-width="3.97" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M74.7822 146.872H183.491V154.365C183.491 156.436 181.814 158.112 179.744 158.112H78.5289C76.4586 158.112 74.7822 156.436 74.7822 154.365V146.872Z" stroke="#505071" stroke-width="3.97" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M142.255 158.112H116.017L110.392 173.099H147.88L142.266 158.112H142.255Z" stroke="#505071" stroke-width="3.97" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M146.869 120.86C146.869 121.703 146.543 122.491 145.946 123.087L131.365 137.635C131.23 137.77 131.083 137.894 130.903 138.018C130.375 138.366 129.767 138.558 129.137 138.558C128.507 138.558 127.899 138.378 127.382 138.018C127.202 137.894 127.056 137.77 126.921 137.635L112.328 123.076C111.732 122.491 111.405 121.703 111.405 120.848C111.405 119.993 111.732 119.217 112.328 118.632C113.554 117.405 115.546 117.405 116.772 118.632L125.987 127.824V100.585C125.987 98.8524 127.404 97.446 129.137 97.446C130.87 97.446 132.287 98.8524 132.287 100.585V127.824L141.502 118.632C142.728 117.405 144.731 117.405 145.957 118.632C146.554 119.217 146.88 120.016 146.88 120.848L146.869 120.86Z" fill="#505071"/>
+</svg>
diff --git a/img/upgrade-guides/check_packages.png b/img/upgrade-guides/check_packages.png
new file mode 100644
index 0000000000..37c206c20d
Binary files /dev/null and b/img/upgrade-guides/check_packages.png differ
diff --git a/img/upgrade-guides/deb_packages.png b/img/upgrade-guides/deb_packages.png
new file mode 100644
index 0000000000..c98869a9a3
Binary files /dev/null and b/img/upgrade-guides/deb_packages.png differ
diff --git a/img/upgrade-guides/install_deb.png b/img/upgrade-guides/install_deb.png
new file mode 100644
index 0000000000..d4b2e3146c
Binary files /dev/null and b/img/upgrade-guides/install_deb.png differ
diff --git a/img/upgrade-guides/list_package.png b/img/upgrade-guides/list_package.png
new file mode 100644
index 0000000000..a790d21c74
Binary files /dev/null and b/img/upgrade-guides/list_package.png differ
diff --git a/img/upgrade-guides/list_package_2.png b/img/upgrade-guides/list_package_2.png
new file mode 100644
index 0000000000..54cfa90b61
Binary files /dev/null and b/img/upgrade-guides/list_package_2.png differ
diff --git a/img/upgrade-guides/list_packages.png b/img/upgrade-guides/list_packages.png
new file mode 100644
index 0000000000..739fb71f6a
Binary files /dev/null and b/img/upgrade-guides/list_packages.png differ
diff --git a/img/upgrade-guides/list_rpm.png b/img/upgrade-guides/list_rpm.png
new file mode 100644
index 0000000000..5d13c54c53
Binary files /dev/null and b/img/upgrade-guides/list_rpm.png differ
diff --git a/img/upgrade-guides/mongo_dump.png b/img/upgrade-guides/mongo_dump.png
new file mode 100644
index 0000000000..2997706178
Binary files /dev/null and b/img/upgrade-guides/mongo_dump.png differ
diff --git a/img/upgrade-guides/recompile_plugin.png b/img/upgrade-guides/recompile_plugin.png
new file mode 100644
index 0000000000..b787a7e9ca
Binary files /dev/null and b/img/upgrade-guides/recompile_plugin.png differ
diff --git a/img/upgrade-guides/redis_config.png b/img/upgrade-guides/redis_config.png
new file mode 100644
index 0000000000..92d0bfe321
Binary files /dev/null and b/img/upgrade-guides/redis_config.png differ
diff --git a/img/upgrade-guides/redis_save.png b/img/upgrade-guides/redis_save.png
new file mode 100644
index 0000000000..f30687b0af
Binary files /dev/null and b/img/upgrade-guides/redis_save.png differ
diff --git a/img/upgrade-guides/rpm_packages.png b/img/upgrade-guides/rpm_packages.png
new file mode 100644
index 0000000000..405d1c6575
Binary files /dev/null and b/img/upgrade-guides/rpm_packages.png differ
diff --git a/img/upgrade-guides/yum_history.png b/img/upgrade-guides/yum_history.png
new file mode 100644
index 0000000000..f1b334088c
Binary files /dev/null and b/img/upgrade-guides/yum_history.png differ
diff --git a/img/upgrade-guides/yum_update.png b/img/upgrade-guides/yum_update.png
new file mode 100644
index 0000000000..ff10aa1ec5
Binary files /dev/null and b/img/upgrade-guides/yum_update.png differ
diff --git a/index.mdx b/index.mdx
new file mode 100644
index 0000000000..06bf513685
--- /dev/null
+++ b/index.mdx
@@ -0,0 +1,243 @@
+---
+mode: "custom"
+title: "Tyk API Gateway Documentation"
+---
+export const mostViewed = [
+  {
+    title: "Tyk Platforms",
+    items: [
+      { title: "Deployment Options",            path: "apim/" },
+      { title: "Self-managed",                  path: "tyk-self-managed/" },
+      { title: "Cloud",                         path: "tyk-cloud/" },
+      { title: "Open Source Gateway",           path: "apim/open-source/" },
+    ],
+  },
+  {
+    title: "API management",
+    items: [
+      { title: "Create API",                    path: "getting-started/quick-start/" },
+      { title: "Access an API",                 path: "getting-started/configure-first-api/" },
+      { title: "Create UDG schema",             path: "api-management/data-graph/" },
+      { title: "Using OAS API definition",      path: "getting-started/quick-start/" },
+    ],
+  },
+  {
+    title: "Product stack",
+    items: [
+      { title: "OSS Tyk Gateway",               path: "tyk-oss-gateway/" },
+      { title: "OSS Tyk gateway configuration", path: "tyk-oss-gateway/configuration/" },
+      { title: "Tyk Gateway API",               path: "tyk-gateway-api/" },
+      { title: "Tyk Dashboard",                 path: "tyk-dashboard/" },
+    ],
+  },
+  {
+    title: "Developer support",
+    items: [
+      { title: "FAQs",                          path: "frequently-asked-questions/" },
+      { title: "Latest Release",                path: "developer-support/release-notes/overview/" },
+      { title: "How to upgrade",                path: "developer-support/upgrading/" },
+      { title: "Contribute to docs",            path: "developer-support/contributing/" },
+    ],
+  },
+];
+
+export const tykStacksCols = [
+  [
+    { title: "Tyk Gateway (Open source)",          desc: "Open source Enterprise API Gateway.",                                         path: "tyk-oss-gateway/" },
+    { title: "Tyk Dashboard",                      desc: "The GUI and analytics platform for Tyk.",                                    path: "tyk-dashboard/" },
+    { title: "Universal Data Graph",               desc: "Combine multiple APIs into one universal interface.",                        path: "api-management/data-graph/" },
+    { title: "Tyk Enterprise Developer Portal",    desc: "Expose APIs for third-party developers to register and use.",                path: "tyk-developer-portal/tyk-enterprise-developer-portal/" },
+    { title: "Tyk Multi Data Center Bridge",       desc: "Control plane that performs management and synchronisation.",                path: "tyk-multi-data-centre/" },
+  ],
+  [
+    { title: "Tyk Pump (Open source)",             desc: "Responsible for moving analytics into a persistent data store.",             path: "tyk-pump/" },
+    { title: "Tyk Operator",                       desc: "Manage your APIs on Tyk Gateway.",                                           path: "tyk-stack/tyk-operator/installing-tyk-operator/" },
+    { title: "Tyk Sync",                           desc: "Command-line tool to manage and synchronise Tyk installation.",              path: "product-stack/tyk-sync/installing-tyk-sync/" },
+    { title: "Tyk Identity Broker (Open source)",  desc: "A bridge between various Identity Management Systems.",                      path: "tyk-identity-broker/" },
+    { title: "Tyk Streams",                        desc: "Expose, manage & monetise real-time event streams, brokers and async APIs.", path: "api-management/event-driven-apis/" },
+  ],
+];
+
+<div className="home-container">
+
+  <div className="banner overflow-hidden">
+    <div className="max-w-7xl mx-auto px-4 lg:px-[1%] py-4 section-padding">
+
+      {/* headline */}
+      <h1
+        id="home-page-title"
+        className="
+        font-bold text-[36px] leading-normal mb-3
+        lh-normal fs-normal
+        text-gray-900 dark:text-white
+      "
+      >
+        Tyk Documentation
+      </h1>
+
+      {/* body copy */}
+      <p className="mb-4 fs-16 font-400 lh-normal text-sec">
+        The hub for Tyk API management. Whether you’re new or experienced, get
+        started with Tyk, explore our product stack and core concepts, access
+        in-depth guides, and actively contribute to our ever-evolving products.
+      </p>
+
+    </div>
+  </div>
+  <section className="home-section mt-10">
+    {/* container-xl with 1 % inline padding ≥ 992 px */}
+    <div className="max-w-7xl mx-auto px-4 lg:px-[1%]">
+
+      {/* section heading */}
+      <div className="component-heading flex flex-col lg:flex-row lg:items-center justify-between mb-5">
+        <div>
+          <h2 className="home-section-heading">Try it out</h2>
+          <p className="fs-16 font-400 text-sec lh-normal">Get started on any of our platforms</p>
+        </div>
+      </div>
+
+      {/* 2-column Card grid */}
+      <div className="grid gap-8 lg:grid-cols-3">
+        {/* ───────── Card 1 ───────── */}
+        <div className="border border-gray-300 p-8 flex flex-col items-center text-center h-full">
+          <div className="parent-container">
+            <div>
+              <div className="image-container mb-6">
+                <img src="/img/tyk-cloud.svg" alt="Guided evaluation" className="home-img" style={{ width: '128px', height: '64px' }} />
+              </div>
+              <p className="fs-18 font-semibold mb-4 text-sec">Try Tyk Cloud</p>
+              <p className="fs-xs mb-3 text-sec">
+                Get 48 hours of free, immediate access to our fully managed SaaS solution. No installation required.
+              </p>
+              <p className="fs-xs mb-3 text-sec">
+                Ideal for quick, hassle-free evaluation
+              </p>
+            </div>
+
+            <div className="py-4">
+              <a href="https://tyk.io/cloud-trial/" className="sec-btn">Cloud Trial</a>
+            </div>
+          </div>
+        </div>
+
+        {/* ───────── Card 2 ───────── */}
+        <div className="border border-gray-300 p-8 flex flex-col items-center text-center h-full">
+          <div className="parent-container">
+            <div>
+              <div className="image-container mb-6">
+                <img src="/img/tyk-sm.svg" alt="48-hour free trial" style={{ width: '128px', height: '64px' }} />
+              </div>
+              <p className="fs-18 font-semibold mb-4 text-sec">Try Tyk Self Managed</p>
+              <p className="fs-xs mb-3 text-sec">Deploy Tyk on your own infrastructure with a free 14-day trial. Full access, full control.</p>
+              <p className="fs-xs mb-3 text-sec">
+                Ideal for on premise environments or custom setups
+              </p>
+            </div>
+
+            <div className="py-4">
+              <a href="https://tyk.io/self-managed-trial/" className="sec-btn">Self Managed Trial</a>
+            </div>
+          </div>
+        </div>
+
+        {/* ───────── Card 3 ───────── */}
+        <div className="border border-gray-300 p-8 flex flex-col items-center text-center h-full">
+          <div className="parent-container">
+            <div>
+              <div className="image-container mb-6">
+                <img src="/img/poc.svg" alt="Guided evaluation" className="home-img" style={{ width: '128px', height: '64px' }} />
+              </div>
+              <p className="fs-18 font-semibold mb-4 text-sec">Proof of Concept</p>
+              <p className="fs-xs mb-3 text-sec">
+                For complex or regulated environments, work with our team on a tailored proof of concept or request an extended, in-depth trial of Tyk.
+              </p>
+              <p className="fs-xs mb-3 text-sec">
+                We’ll map your requirements to Tyk’s architecture.
+              </p>
+            </div>
+
+            <div className="py-4">
+              <a href="https://tyk.io/guided-evaluation/" className="sec-btn">Request PoC</a>
+            </div>
+          </div>
+        </div>
+
+      </div>
+    </div>
+  </section>
+
+  <section className="home-section mt-10">
+    <div className="max-w-7xl mx-auto px-4 lg:px-[1%]">
+
+      {/* heading */}
+      <div className="component-heading mb-5">
+        <h2 className="home-section-heading">Most viewed</h2>
+        <p className="fs-16 font-400 text-sec lh-normal">
+          Quick links to pages our users visit most
+        </p>
+      </div>
+
+      {/* responsive grid */}
+      <div className="grid gap-y-6 sm:grid-cols-2 md:grid-cols-3 lg:grid-cols-4">
+        {mostViewed.map((col) => (
+          <div key={col.title}>
+            {col.items.map((item) => (
+              <div key={item.path} className="mb-2">
+                <a href={`/${item.path}`} className="text-primary fs-xs">
+                  {item.title}
+                </a>
+              </div>
+            ))}
+          </div>
+        ))}
+      </div>
+    </div>
+  </section>
+
+  <section className="home-section explore-section mt-10">
+    <div className="max-w-7xl mx-auto px-4 lg:px-[1%]">
+
+      {/* heading */}
+      <div className="component-heading mb-5">
+        <h2 className="home-section-heading">Explore by Tyk Stack</h2>
+        <p className="fs-16 font-400 text-sec lh-normal">
+          Explore everything Tyk has to offer
+        </p>
+      </div>
+
+      {/* flex row → two vertical lists on md+, one list on mobile */}
+      <div className="flex flex-col md:flex-row md:gap-6 home-bottom">
+        {tykStacksCols.map((col, idx) => (
+          <div key={idx} className="w-full md:w-1/2 space-y-4">
+            {col.map((item) => (
+              <a
+                key={item.path}
+                href={`/${item.path}`}
+                className="
+                stack-box
+                flex items-center
+                border border-gray-300 rounded-md
+                px-4 py-3
+                hover:bg-gray-50 transition
+              "
+              >
+                {/* green leaf icon */}
+                <svg viewBox="0 0 32 32" className="w-8 h-8 flex-none mr-3" fill="#20EDBA">
+                  <path d="M31.956 14.561C31.251 6.452 24.507.087 16.22 0H0v3.575v13.079C.353 24.981 7.052 31.695 15.427 32H32V14.605c0-.044-.044-.044-.044-.044z"/>
+                </svg>
+
+                <div className="stack-text-container">
+                  <div className="stack-heading">{item.title}</div>
+                  <div className="fs-xs text-sec font-400 lh-20">{item.desc}</div>
+                </div>
+              </a>
+            ))}
+          </div>
+        ))}
+      </div>
+    </div>
+  </section>
+
+
+
+</div>
diff --git a/key-concepts/grpc-proxy.mdx b/key-concepts/grpc-proxy.mdx
new file mode 100644
index 0000000000..9b575f0e3d
--- /dev/null
+++ b/key-concepts/grpc-proxy.mdx
@@ -0,0 +1,129 @@
+---
+title: "gRPC Proxy"
+description: "Learn how to proxy gRPC with Tyk"
+keywords: "gRPC, Other Protocol"
+sidebarTitle: "gRPC Proxy"
+---
+
+## Using Tyk as a gRPC Proxy
+
+Tyk supports gRPC passthrough proxying when using HTTP/2 as a transport (the most common way to deploy gRPC services).
+
+The gRPC over HTTP2 specification defines the rules on how the gRPC protocol maps to a HTTP request, for more information [see](https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md). In the context of the API Gateway, we are interested in the following:
+
+- You can target specific methods of the gRPC service using the format: `/{Service-Name}/{method name}`, for example: `/google.pubsub.v2.PublisherService/CreateTopic`. You can use this feature to apply standard ACL rules via Keys and Policies, or use URL rewrite middleware to [transform the upstream path](/transform-traffic/url-rewriting). 
+- HTTP method is always `POST`.
+gRPC custom request metadata is added as HTTP headers, where metadata key is directly mapped to the HTTP header with the same name. 
+
+You can also perform [gRPC load balancing](#grpc-load-balancing).
+
+**Prerequisites**
+- Enable  HTTP/2 support on the Gateway side, for both incoming and upstream connections, by setting `http_server_options.enable_http2` and `proxy_enable_http2` to true in your `tyk.conf` Gateway config file.
+- The `listen path` of the Api should be the same as the gRPC service name, so tyk can route it correctly.
+- Ensure that `strip_listen_path` is set to false in your API, so the route of the gRPC service method is build correctly following the standard: `{service_name}/{service_method}`.
+
+### Secure gRPC Proxy
+Tyk Supports secure gRPC proxy connections, in order to do so you only need to attach a certificate to the API that you want to expose just as you do for regular APIs, after that you can consume the service via HTTPS.
+
+### Insecure gRPC Proxy (H2C)
+For scenarios where you want to connect two services calling each other or just need an insecure connection you can use h2c (that is the non-TLS version of HTTP/2). Tyk supports h2c, this can be enabled at api level by setting `h2c` as protocol in the address of the gRPC server (`target_url`) e.g: `h2c://my-grpc-server.com`.
+
+### gRPC streaming
+Tyk supports all kinds of gRPC streaming (client streaming, server streaming and bidirectional streaming). It requires you to set a low value for `flush_interval`, this is required in order to forward data to the downstream target as soon as the upstream target replies. A high flush interval will delay this communication. We recommend the lowest possible value: 1 (1 millisecond). You set this value in your `tyk.conf` file in the `http_server_options.flush_interval` option.
+
+## Mutual Authentication
+Tyk supports Mutual Authentication in gRPC. See [Mutual TLS](/api-management/implement-tls#secure-hosted-apis-with-mtls) to configure Mutual Authentication in Tyk. 
+
+## Basic Authentication
+Tyk supports Basic Authentication in gRPC. See [Basic Authentication](/api-management/authentication/basic-authentication) to configure Basic Authentication in Tyk. 
+
+After setting your Tyk configuration, all you need to do is to send credentials with the correct base64 format in an `Authorization` header from your gRPC client. 
+
+`Basic base64Encode(username:password)`
+
+## Token Based Authentication
+Tyk supports Token Based Authentication in gRPC. See [Auth Tokens](/api-management/authentication/bearer-token) to configure Token Based Authentication in Tyk. 
+
+After setting your Tyk configuration, all you need to do is to send a token in an `Authorization` header from your gRPC client.
+
+## gRPC load balancing
+
+Tyk is able to perform load balancing on gRPC traffic using an approach similar to our native [Load Balancing](/planning-for-production/ensure-high-availability/load-balancing) functionality.
+
+For both secure and insecure gRPC scenarios, the steps above serve as a starting point.
+
+**In a secure gRPC scenario**
+
+For configuring multiple upstream targets in a secure gRPC scenario, follow these additional steps:
+
+* Check the "Enable round-robin load balancing" flag in the "Core Settings" section of your API.
+* Define each target as `https://grpc.test.example.com:10000`, `https://grpc.test.example.com:10001` and so on.
+
+**In an insecure scenario (H2C)**
+
+Use the same approach but use the H2C scheme instead: `h2c://grpc.test.example.com:10000`, `h2c://grpc.test.example.com:10001`, etc. 
+
+## Example of gRPC proxy using H2C
+This is the simplest way to have a working gRPC proxy setup. You will need:
+
+* A gRPC server. For this example you can use [this server](https://github.com/grpc/grpc-go/tree/master/examples/helloworld)
+* A gRPC client. You can use [grpcurl](https://github.com/fullstorydev/grpcurl) which is basically curl but for gRPC
+* An instance of the Tyk Gateway and Dashboard
+
+**Steps for Configuration:**
+
+* Execute the gRPC server (for this example you can expose it at port `:50051`)
+* Create the API via the Tyk dashboard with the following configuration:
+    * Set HTTP as protocol
+    * Uncheck `strip listen path` in the api
+    * Set listen path: `/helloworld.Greeter`
+    * Now set the `target_url`. In order for Tyk to detect that you will use `h2c` for this API we will need to write the URL with the prefix `h2c://`. For this example the URL can be `h2c://localhost:50051`
+    * Hit save, and once the Gateway finishes reloading you can test the solution
+* From the command line you can consume the service via the Tyk Gateway. To test it, enter `grpcurl -plaintext -proto helloworld.proto -d '{"name": "joe"}' tyk-gateway:8080 helloworld.Greeter/SayHello` and you should get as a response: `{"message": "Hello joe"}` which means that everything is working as it should.
+
+## Example of gRPC proxy using HTTPS
+
+**Prerequisites:**
+
+* a gRPC server. For this example you can use [this server](https://github.com/grpc/grpc-go/tree/master/examples/route_guide) as this example already supports TLS.
+* A gRPC client. You can use [grpcurl](https://github.com/fullstorydev/grpcurl) which is basically curl but for gRPC (or you can use the client application)
+* A certificate to expose the API via HTTPS
+* An instance of Tyk Gateway and Dashboard
+
+**Steps for Configuration:**
+
+1. Execute the gRPC server (for this example we can expose it at port `:10000`), the `route_guide` application receives a flag to use TLS (`go run server.go -tls=true`). It's exposed in `grpc.test.example.com:10000`
+2. Create the API via dashboard with the next configuration:
+    * Set HTTPS as protocol
+    * Uncheck `Strip listen path` in the api
+    * Add the certificate 
+    * Set a custom domain, for this example use `tyk`
+    * Set as listen path: `/routeguide.RouteGuide`
+    * Now in the target URL set the location of the service: `https://grpc.test.example.com:10000`
+    * Click Save
+3. At this point you're ready to test the solution, so, from the command line type: `grpcurl -proto route_guide.proto -d '{"latitude": 1, "longitude":2}' tyk:8080 routeguide.RouteGuide/GetFeature` and you should get a successful response. Note that you are not sending the flag `-plaintext` as the desire is to connect via HTTPS.
+
+## Example of bidirectional data streaming using a gRPC service exposed via HTTPS but communicating Tyk to service via H2C
+
+In this example you will expose a gRPC service via HTTPS using Tyk, but Tyk will consume the upstream via h2c. This situation is very common when using Kubernetes, where the internet traffic going through Tyk are TLS encrypted, but traffic in the inner cluster are in plain HTTP (h2c).
+
+**Prerequisites**
+* a gRPC server. For this example you can use [this server](https://github.com/grpc/grpc-go/tree/master/examples/route_guide).
+* a client application. You can use [this client](https://github.com/grpc/grpc-go/tree/master/examples/route_guide/client).
+* A certificate to expose the API via HTTPS
+* An instance of the Tyk Gateway and Dashboard.
+
+**Steps for Configuration:**
+
+* Execute the gRPC server (for this example expose it at port `:10000`), the `route_guide` application receives a flag to enable/disable TLS (`go run server.go -tls=false`). It's available in `locahost:10000`
+* In the Tyk Gateway config file set `"http_server_options.flush_interval": 1`  and run the Gateway (for this example will be running it in port 8000).
+* Create the API via the Tyk Dashboard with the following configuration:
+    * Set HTTPS as the protocol
+    * Add the certificate 
+    * Set a custom domain, for this example `tyk`
+    * Set as listen path: `/routeguide.RouteGuide`. For testing purposes we will use the `RouteChat` service as this is a bidirectional service.
+    * Now in the target URL set the location of the service: `h2c://localhost:10000`. This way Tyk will communicate with the upstream using h2c
+    * Click Save
+* Ensure that the client application has the server address pointing to Tyk, for this example: `https://tyk.com:8000`.
+* Now you are ready to test the solution. Run the client application and it should send and receive data simultaneously.
+
diff --git a/key-concepts/tcp-proxy.mdx b/key-concepts/tcp-proxy.mdx
new file mode 100644
index 0000000000..402fb5f231
--- /dev/null
+++ b/key-concepts/tcp-proxy.mdx
@@ -0,0 +1,148 @@
+---
+title: "TCP Proxy"
+description: "Learn how to use Tyk as a simple TCP Proxy"
+keywords: "TCP Proxy, TLS"
+sidebarTitle: "TCP Proxy"
+---
+
+## Using Tyk as a TCP Proxy
+
+Tyk can be used as a reverse proxy for your TCP services. It means that you can put Tyk not only on top of your APIs but on top of **any** network application, like databases, services using custom protocols etc.
+
+### Set via your API
+
+To enable TCP proxying, set the `protocol` field either to `tcp` or `tls`. In the case of TLS, you can also specify a `certificate` field with a certificate ID or path to it.
+
+Similar to the above, the proxy target scheme should be set to `tcp://` or `tls://`, depending if your upstream is secured by TLS or not.
+
+The simplest TCP API definition looks like this:
+
+```yaml
+{
+  "listen_port": 30001,
+  "protocol": "tls",
+  "certificate": ["<cert-id>"],
+  "proxy": {
+    "target_url": "tls://upstream:9191"
+  }
+}
+```
+
+### Set via your Dashboard
+
+From the **API Designer > Core Settings** tab, select the appropriate protocol from the Protocol field drop-down list.
+
+Enter the network port number in the **Port** field.
+
+If using TLS you can also add a PEM formatted SSL certificate in the **Upstream Certificates** section from the **Advanced Options** tab.
+
+<img src="/img/2.10/protocol_and_port.png" alt="Protocol" />
+
+Tyk supports multiplexing based on certificate SNI information, which means that you can have multiple TCP services on the **same port**, served on different domains. Additionally, all services on the same port should share the same protocol: either `tcp`, `tls`, `http` or `https`.
+
+If Tyk sits behind another proxy, which has  the PROXY protocol enabled, you can set `enable_proxy_protocol` to `true`. 
+
+As for features such as load balancing, service discovery, Mutual TLS (both authorization and communication with upstream), certificate pinning, etc. All work exactly the same way as for your HTTP APIs. 
+
+## Allowing specific ports
+
+By default, you will not be able to run a service on a custom port, until you allow the required ports. 
+Since TCP services can be configured via the Dashboard, you should be careful who can create such services, and which ports they can use. Below is an example of allowing ports in `tyk.conf`:
+
+```yaml
+{
+  ...
+  "ports_whitelist": {
+    "https": {
+      "ranges": [
+        {
+          "from": 8000,
+          "to": 9000
+        }
+      ]
+    },
+    "tls": {
+      "ports": [
+        6000,
+        6015
+      ]
+    }
+  }
+  ...
+}
+```
+
+As you can see, you can use either `ranges` or `ports` directives (or combine them). 
+
+You can also disable this behavior and allow any TCP port by setting `disable_ports_whitelist` to `true`.
+
+
+## Health checks
+
+TCP health checks are configured the same way as HTTP ones.
+The main difference is that instead of specifying HTTP requests, you should specify a list of commands, which send data or expect some data in response. 
+
+A simple health check which verifies only connectivity (e.g. if a port is open), can be: 
+
+```yaml
+{
+...
+	"uptime_tests": {
+	  "check_list": [
+	    { "url": "127.0.0.1:6379" },
+        "commands": []
+	  ]
+	}
+...
+}
+```
+
+### Complex example
+
+Here is quite a complex example of using health checks, which shows a Redis Sentinel setup. In this configuration, we put a TCP proxy, e.g. Tyk, on top of two or more Redis nodes, and the role of the proxy will always direct the user to Redis master. To do that we will need to perform health checks against each Redis node, to detect if it is a master or not. In other words, Redis clients who communicate with Redis through the proxy will be always directed to the master, even in case of failover.
+
+```yaml
+{
+   "name": "Redis Sentinel",
+   "listen_port": 6379,
+   "protocol": "tcp",
+   "enable_load_balancing": true,
+   "proxy": {
+	   "target_list": ["192.168.10.1:6379", "192.168.10.2:6379"]
+	},
+   "check_host_against_uptime_tests": true,
+   "uptime_tests": {
+       "check_list": [
+          {
+			"url": "192.168.10.1:6379",
+            "commands": [
+              { "name": "send", "message": "PING\r\n" },
+              { "name": "expect", "message": "+PONG" },
+              { "name": "send", "message": "info  replication\r\n" },
+              { "name": "expect", "message": "role:master" },
+              { "name": "send", "message": "QUIT\r\n" }, 
+              { "name": "send", "message": "+OK" }
+            ]
+          },
+          {
+			"url": "192.168.10.2:6379",
+            "commands": [
+              { "name": "send", "message": "PING\r\n" },
+              { "name": "expect", "message": "+PONG" },
+              { "name": "send", "message": "info  replication\r\n" },
+              { "name": "expect", "message": "role:master" },
+              { "name": "send", "message": "QUIT\r\n" }, 
+              { "name": "send", "message": "+OK" }
+            ]
+          }
+       ]
+   }
+}
+```
+
+At the moment Tyk supports only 2 commands:
+ - `send`  send string to server
+- `expect`  expect string from the server
+
+
+[1]: /img/dashboard/system-management/api-protocol.png
diff --git a/logo/dark.svg b/logo/dark.svg
new file mode 100644
index 0000000000..d983d44778
--- /dev/null
+++ b/logo/dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 88.16 45"><defs><style>.cls-1{fill:#fff}</style></defs><g id="Layer_2" data-name="Layer 2"><g id="Layout"><path class="cls-1" d="M40.24.88A3 3 0 0 0 38.06 0H13v3a2.78 2.78 0 0 0 .88 2.06A3 3 0 0 0 16 6h8v30h3a3 3 0 0 0 2.19-.88 2.87 2.87 0 0 0 .9-2.08V6h11.05V3.18a3.34 3.34 0 0 0-.9-2.3z"/><path class="cls-1" d="M56.18 11a3 3 0 0 0-2.19.87 2.91 2.91 0 0 0-.9 2.09V26c-1.06 2.94-4.29 4.37-7.75 4.37-2.87 0-4.26-1.33-4.26-4.05V14a2.87 2.87 0 0 0-.9-2.09A3 3 0 0 0 38 11h-2.93v15.83c0 6.08 3.13 9.17 9.62 9.17 3.19 0 6.68-1.1 8.36-3.28a6.73 6.73 0 0 1-1.43 4.36c-1.23 1.61-3.61 2.23-6.09 2.23a20.38 20.38 0 0 1-7.2-1.4 5.1 5.1 0 0 0-1.14-.16 1.9 1.9 0 0 0-2.12 2.1v2.45l.18.1A19.4 19.4 0 0 0 45.53 45C54 45 59.1 40.44 59.1 31.43V11zm27.64 14a4.05 4.05 0 0 0-1.61-2.11 9.83 9.83 0 0 0 1.15-2.56L87.15 11h-3.44c-1.88 0-3.09.76-3.59 2.25l-2.58 6c-.2.49-.79.75-1.77.75h-5.64V3a2.72 2.72 0 0 0-.86-2 3 3 0 0 0-2.17-1h-3v36h3a3 3 0 0 0 2.2-.9 2.75 2.75 0 0 0 .89-2.1v-7h6.61c.94 0 1.19.43 1.3.76l3.09 7.12c.47 1.41 1.66 2.13 3.54 2.13h3.43z"/><path d="M16 17.25A8 8 0 0 0 8.13 10H0v8.33A8 8 0 0 0 7.72 26H16v-8.73z" style="fill:#00d9ba"/></g></g></svg>
diff --git a/logo/light.svg b/logo/light.svg
new file mode 100644
index 0000000000..fbfc62fb06
--- /dev/null
+++ b/logo/light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 88.16 45"><defs><style>.cls-1{fill:black}</style></defs><g id="Layer_2" data-name="Layer 2"><g id="Layout"><path class="cls-1" d="M40.24.88A3 3 0 0 0 38.06 0H13v3a2.78 2.78 0 0 0 .88 2.06A3 3 0 0 0 16 6h8v30h3a3 3 0 0 0 2.19-.88 2.87 2.87 0 0 0 .9-2.08V6h11.05V3.18a3.34 3.34 0 0 0-.9-2.3z"/><path class="cls-1" d="M56.18 11a3 3 0 0 0-2.19.87 2.91 2.91 0 0 0-.9 2.09V26c-1.06 2.94-4.29 4.37-7.75 4.37-2.87 0-4.26-1.33-4.26-4.05V14a2.87 2.87 0 0 0-.9-2.09A3 3 0 0 0 38 11h-2.93v15.83c0 6.08 3.13 9.17 9.62 9.17 3.19 0 6.68-1.1 8.36-3.28a6.73 6.73 0 0 1-1.43 4.36c-1.23 1.61-3.61 2.23-6.09 2.23a20.38 20.38 0 0 1-7.2-1.4 5.1 5.1 0 0 0-1.14-.16 1.9 1.9 0 0 0-2.12 2.1v2.45l.18.1A19.4 19.4 0 0 0 45.53 45C54 45 59.1 40.44 59.1 31.43V11zm27.64 14a4.05 4.05 0 0 0-1.61-2.11 9.83 9.83 0 0 0 1.15-2.56L87.15 11h-3.44c-1.88 0-3.09.76-3.59 2.25l-2.58 6c-.2.49-.79.75-1.77.75h-5.64V3a2.72 2.72 0 0 0-.86-2 3 3 0 0 0-2.17-1h-3v36h3a3 3 0 0 0 2.2-.9 2.75 2.75 0 0 0 .89-2.1v-7h6.61c.94 0 1.19.43 1.3.76l3.09 7.12c.47 1.41 1.66 2.13 3.54 2.13h3.43z"/><path d="M16 17.25A8 8 0 0 0 8.13 10H0v8.33A8 8 0 0 0 7.72 26H16v-8.73z" style="fill:#00d9ba"/></g></g></svg>
diff --git a/lychee.toml b/lychee.toml
new file mode 100644
index 0000000000..cb2e73fc6a
--- /dev/null
+++ b/lychee.toml
@@ -0,0 +1,74 @@
+# Lychee external link checker configuration
+# Docs: https://lychee.cli.rs/usage/configuration/
+
+# Only check http/https URLs — skips mailto:, file://, etc.
+scheme = ["https", "http"]
+
+# Resolve root-relative links (e.g. /img/..., /page/...) against the live docs
+# base URL. Combined with the tyk.io exclude rule below, these get silently
+# skipped rather than erroring as "cannot convert path to URI".
+base_url = "https://tyk.io"
+
+# Only check external URLs — internal links are validated by validate-docs.yml
+exclude = [
+  # Tyk-owned domains (covers root-relative paths resolved via base above)
+  "https?://(.*\\.)?tyk\\.io",
+  "https?://(.*\\.)?tyktech\\.net",
+
+  # Localhost / private addresses
+  "https?://localhost",
+  "https?://127\\.0\\.0\\.1",
+
+  # Placeholder / example URLs
+  "https?://example\\.com",
+  "https?://your-",
+  "https?://<",
+
+  # Kubernetes cluster-internal service addresses used in operator/k8s examples
+  # These are real k8s DNS names that cannot be reached from CI
+  "https?://[^/]*\\.svc\\.cluster\\.local",
+  "https?://[^/]*\\.svc:[0-9]+",
+  "https?://[^/]*\\.tyk\\.svc",
+
+  # Dead URLs that appear in tutorial code blocks or example output
+  # Excluding rather than removing to preserve the tutorial context
+  "https?://evening-beach-40625\\.herokuapp\\.com",  # dead Heroku demo app used in Heroku deploy tutorial
+  "https?://www\\.cdr\\.gov\\.au",                   # Australian CDR site — HTTP/2 server issue, not a broken link
+
+  # Placeholder hostnames used in code examples and tutorials
+  # These are intentionally fake — not real external URLs
+  "https?://httpbin/",                      # bare 'httpbin' with no TLD (real httpbin.org is still checked)
+  "https?://httpbin\\.ahmet",               # fake hostname used in k8s ingress tutorial
+  "https?://ipaddress/",                    # literal placeholder hostname
+  "https?://dashboard-host",               # placeholder Tyk Dashboard hostname
+  "https?://gluu-server",                   # placeholder Gluu IdP hostname
+  "https?://my-bundle-server\\.com",        # example plugin bundle server
+  "https?://[^/]*\\.do\\.poc\\.tyk",        # Tyk DigitalOcean POC/demo environments
+  "https?://branch-name\\.mintlify\\.app",  # placeholder Mintlify branch preview URL
+
+  # Sites that time out or are otherwise unreachable from CI runners
+  # (valid public docs, not broken links)
+  "https?://helm\\.sh",
+
+  # Known to block bots / return false 403s
+  # These are valid pages but return 403 to automated checkers (not real broken links)
+  "https?://(www\\.)?linkedin\\.com",
+  "https?://(www\\.)?facebook\\.com",
+  "https?://(www\\.)?reddit\\.com",
+  "https?://(www\\.)?medium\\.com",
+  "https?://blog\\.postman\\.com",
+  "https?://dev\\.mysql\\.com",
+  "https?://www\\.cloudflare\\.com",
+]
+
+# Treat these status codes as success (429 = rate-limited but link exists)
+accept = [200, 201, 202, 203, 204, 206, 301, 302, 303, 307, 308, 429]
+
+# Retry up to 3 times before marking a link as broken
+max_retries = 3
+
+# Timeout per request in seconds
+timeout = 30
+
+# Number of concurrent requests
+max_concurrency = 8
diff --git a/plan-your-api-integration.mdx b/plan-your-api-integration.mdx
new file mode 100644
index 0000000000..a2a916f612
--- /dev/null
+++ b/plan-your-api-integration.mdx
@@ -0,0 +1,112 @@
+---
+title: "Plan Your API Integration"
+description: "A guide to planning your first API integration with Tyk"
+keywords: "Tyk API Management, Getting Started, Tutorials"
+order: 5
+sidebarTitle: "Plan Your API Integration"
+---
+
+## Planning Your API Project: A Step-by-Step Guide with Tyk
+
+Creating and managing APIs is essential for modern applications, but if you’re new to APIs, this process might feel complex. This guide walks you through what APIs are, why they matter, and how to plan, design, deploy, and manage them—step by step—with support from Tyk’s API management platform.
+
+---
+
+### 1. What is an API and Why Does It Matter?
+
+An **API (Application Programming Interface)** allows different software systems to talk to each other. Think of it as a bridge that lets applications, websites, or devices interact. For example, when you book a flight or make a payment online, you’re likely interacting with multiple APIs in the background. APIs help create a connected experience, enabling everything from mobile app development to system integrations and data sharing.
+
+**Why use an API?**
+- **Efficiency**: APIs allow applications to reuse functionality (e.g., logins, data storage) instead of building it from scratch.
+- **Flexibility**: They let you connect applications across platforms, such as web, mobile, and IoT.
+- **Scalability**: APIs enable modular application development, making it easier to add or update features over time.
+
+---
+
+### 2. Steps in Creating, Using, and Managing APIs
+
+Let’s break down the steps to design, develop, and manage APIs. By planning each stage, you can create APIs that are reliable, secure, and ready for growth.
+
+#### **Step 1: Define Your API’s Purpose and Scope**
+
+Begin by clarifying why you need an API and what you hope to achieve:
+- **Who will use this API?** Identify whether the API is for internal teams, partners, or external developers.
+- **What problem does it solve?** Define the API’s core functions and the kind of data it will handle.
+- **What resources will be shared?** List out the specific data or services (like user profiles, inventory, or orders) that the API will expose.
+
+**Example:** Imagine you’re creating an API to provide real-time inventory data to an e-commerce app. You’ll need to determine which product details are exposed, who can access them, and any restrictions on data sharing.
+
+#### **Step 2: Design the API Structure**
+
+With your goals in mind, you’ll now design the API:
+- **Choose the API Style**: Decide between REST (easy to implement, flexible) or GraphQL (lets clients query specific data they need). Tyk supports both, so choose based on the complexity and data needs.
+- **Define Endpoints and Methods**: Identify the actions your API should allow (e.g., GET for retrieving data, POST for adding data).
+- **Specify Data Models**: Define the format of data exchanged. For instance, will product data include details like price, description, and availability?
+  
+**Security Consideration:** Plan how users will [authenticate](/api-management/security-best-practices#authentication). Will they use [tokens](/api-management/authentication/bearer-token) or [OAuth](/api-management/authentication/oauth-2) (for user-specific access)? Tyk offers tools to implement any of these methods effectively.
+
+#### **Step 3: Document the API**
+
+Documentation is critical for your API’s usability:
+- **Explain each endpoint**: Describe what each endpoint does, its parameters, and any expected responses.
+- **Provide examples**: Include sample requests and responses to clarify expected use.
+- **Detail errors and edge cases**: Help users understand what happens if they make incorrect requests.
+
+With [Tyk’s developer portal](/tyk-developer-portal/tyk-portal-classic/customise/custom-developer-portal#why-build-a-custom-developer-portal), you can automatically publish your API documentation, making it easier for developers to get started with your API.
+
+#### **Step 4: Develop and Test the API**
+
+Now you’re ready to build and test:
+- **Develop the Backend**: Write the code to implement your [API’s endpoints](/api-management/endpoint-designer) and integrate with your [database](/tyk-self-managed/install#requirements) or service layer.
+- **Functional Testing**: Check each endpoint to ensure it behaves as expected and handles common errors.
+- **Load Testing**: Simulate traffic to see how your API performs under different loads. Tyk offers tools to scale your API seamlessly and track performance metrics.
+
+#### **Step 5: Deploy and Secure the API**
+
+Once your API is tested, deploy it for use:
+- **Deploying to Production**: Decide where your API will be hosted (cloud, on-premises, or a hybrid setup). Tyk supports multiple deployment environments, allowing you to easily transition between development, staging, and production.
+- **Implement Security**: Protect your API with [authentication methods](/api-management/client-authentication), [rate limiting](/api-management/rate-limit#what-is-rate-limiting), and access controls to prevent unauthorized access and misuse.
+
+Tyk’s platform makes security implementation straightforward, offering features like OAuth 2.0, rate limiting, and custom policies to secure your API.
+
+#### **Step 6: Monitor and Maintain the API**
+
+An API isn’t a one-time setup; it needs regular monitoring and updates:
+- **Monitor Performance**: Use [Tyk’s real-time analytics](/api-management/tyk-pump) to track metrics like [latency](/api-management/logs/traffic-logs#param-latency), error rates, and [usage](/tyk-cloud/environments-deployments/monitoring-how-it-works#track-usage). This helps identify any bottlenecks or security risks.
+- **Version and Update**: As you add new features, use [Tyk’s versioning](/api-management/automations/operator#api-versioning) to avoid breaking existing functionality.
+- **Optimize and Scale**: With Tyk, you can adjust your rate limits, caching, and load balancing to handle higher volumes as needed. Optimizing is especially necessary as you [move your workload into production](/planning-for-production).
+
+---
+
+### 3. How Tyk Supports Your API Lifecycle
+
+Tyk provides a comprehensive platform to help you through each stage of API development, from planning to deployment and beyond.
+
+#### **Design and Planning Phase**
+
+Tyk simplifies the early stages of API planning by providing:
+- **Multi-API Support**: Tyk supports REST, GraphQL, and gRPC APIs, so you can choose the best style for your project.
+- **Advanced Security Options**: Easily configure [authentication methods](/api-management/client-authentication) and [permissions](/platform-management/user-permissions) to protect data and control access.
+- **Developer Portals**: [Tyk’s developer portals](/tyk-developer-portal/tyk-portal-classic) allow you to publish documentation and manage developer access, making it easier for teams or external partners to use your APIs.
+
+#### **Deployment and Configuration Phase**
+
+In this stage, Tyk streamlines deployment, whether on the cloud, on-premises, or hybrid:
+- **Kubernetes Integration with Tyk Operator**: If your API runs on Kubernetes, [Tyk Operator](/api-management/automations/operator#what-is-tyk-operator) integrates with Kubernetes to help you manage deployments as Kubernetes resources.
+- **Custom Domain Setup**: Configure custom domains to make your API URLs user-friendly and secure with SSL/TLS certificates.
+- **Deployment Across Multiple Environments**: [Tyk’s gateways](/tyk-oss-gateway) let you deploy, monitor, and secure multiple APIs from a single platform, so you can [manage environments](/api-management/multiple-environments) (development, staging, production) with ease.
+
+#### **Operations and Business as Usual (BAU) Phase**
+
+After deployment, Tyk offers robust tools to ensure smooth API operations and maintenance:
+- **Real-Time Monitoring and Analytics**: [Tyk’s dashboard](/api-management/dashboard-configuration) provides insights into API traffic, usage patterns, and error rates, enabling quick response to issues.
+- **Dynamic Policy Management**: Set up and adjust security policies to control access and usage, such as [IP whitelisting](/api-management/gateway-config-tyk-classic#ip-access-control), [request throttling](/api-management/request-throttling), or [rate limiting](/api-management/rate-limit).
+- **Plugin Support for Customization**: Use [Tyk’s plugin system](/tyk-cloud/using-plugins) to add custom functionality, such as [custom authentication](/tyk-cloud/using-plugins#create-a-python-code-bundle), or [traffic transformations](/api-management/traffic-transformation).
+
+---
+
+### 4. Next Steps with Tyk
+
+Building and managing APIs is a process of continuous improvement. With Tyk, you have a partner that provides the tools to plan, develop, deploy, and maintain APIs with efficiency and security. As you refine your API strategy, you can rely on Tyk’s capabilities to adapt and scale with you, ensuring that your APIs deliver value to users and meet evolving business needs.
+
+To get started in your Tyk journey, [get started on Tyk Cloud](/getting-started/create-account) and learn about [Tyk components](/tyk-components) to further understand how Tyk supports your specific goals.
\ No newline at end of file
diff --git a/planning-for-production.mdx b/planning-for-production.mdx
new file mode 100644
index 0000000000..0277b23a34
--- /dev/null
+++ b/planning-for-production.mdx
@@ -0,0 +1,225 @@
+---
+title: "Planning for Production"
+description: "How to plan for production deployment of Tyk"
+sidebarTitle: "Planning for Production"
+---
+
+So you want to deploy Tyk to production?
+
+There's a few things worth noting that can ensure high performance of your Tyk Gateways. Here are some of the basic things we do for load testing to make sure machines don't run out of resources.
+
+## Performance Expectations
+Tyk is a high-performance API Gateway written in [Go](https://go.dev/), capable of handling significant loads. Our official benchmarks demonstrate that Tyk can handle over **80,000 requests per second**, and over **54,000 requests per second** with a full feature set (including authentication, rate limiting, and analytics) enabled.
+
+<img src="img/performance-benchmarks.png" alt="Tyk Gateway Performance Benchmark"/>
+
+For detailed information on our performance testing and results, please refer to our official performance benchmarks.
+
+- **[Tyk Performance Benchmarks](https://tyk.io/performance-benchmarks/)**: Detailed analysis of Tyk's performance across various scenarios.
+- **[Tyk Performance Tests Repository](https://github.com/TykTechnologies/tyk-ansible-performance-testing)**: Replicate our performance tests yourself using our open-source testing framework.
+- **[Performance Tuning Your Gateway](https://tyk.io/blog/performance-tuning-your-tyk-api-gateway/)**: A step-by-step guide to fine-tuning your Gateway for maximum performance.  
+- **[Manual Performance Testing on AWS](https://tyk.io/blog/a-manual-for-simple-performance-testing-with-tyk-on-aws/)**: Best practices for setting up and running manual performance tests on AWS to ensure your Gateway is optimized.
+
+## Change all the shared secrets
+
+Ensure that these are changed before deploying to production. The main secrets to consider are:
+
+### `tyk.conf`:
+
+*   `secret`
+*   `node_secret`
+
+### `tyk_analytics.conf`:
+
+*   `admin_secret`
+*   `shared_node_secret`
+*   `typ_api_config.secret`
+
+GW `secret` and DB `tyk_api_config.secret` must match
+
+GW `node_secret` and DB `shared_node_secret` must match
+
+### Use the public/private key message security!
+
+Tyk makes use of public-key message verification for messages that are sent from the Dashboard to the Gateways, these messages can include:
+
+*   Zeroconfig Dashboard auto-discovery details
+*   Cluster reload messages
+*   Cluster configuration getters/setters for individual Gateways in a cluster
+
+These keys are also used for plugin security, so it is important to use them if you are deploying code to your Gateway. The public key that ships with your Gateways is used to verify the manifest and files that come with any plugin bundle that gets downloaded by the bundle downloader.
+
+## Change your Control Port
+
+To secure your Tyk installation, you can configure the following settings in your [tyk.conf](/tyk-oss-gateway/configuration):
+
+`control_api_hostname` - Set the hostname to which you want to bind the REST API.
+
+`control_api_port` - This allows you to run the Gateway Control API on a separate port, and protect it behind a firewall if needed.
+
+If you change these values, you need to update the equivalent fields in the dashboard conf file `tyk_analytics.conf`: `tyk_api_config.Host`  and `tyk_api_config.Port`
+
+
+## Recommended Topology
+
+Keep Redis and your persistent database (MongoDB or PostgreSQL) on dedicated infrastructure, separate from the systems running Tyk Gateway and Tyk Dashboard. Both Redis and Tyk Gateway are memory-intensive and CPU-intensive; running them on the same host creates resource contention.
+
+The recommended production topology is:
+
+- Two or more Tyk Gateways, load balanced, each on a separate machine.
+- A separate Redis instance using Redis Sentinel for high availability, or Redis Cluster for horizontal scalability.
+- A separate MongoDB or PostgreSQL cluster.
+- One Tyk Dashboard node on a separate machine.
+- One Tyk Pump node on a separate machine.
+
+Under high traffic, consider isolating Redis workloads across dedicated instances. Tyk Gateway supports a [separate analytics store](/planning-for-production/database-settings#separate-analytics-storage) for traffic log buffering and a [separate cache store](/planning-for-production/database-settings#separate-cache-storage) for API response caching, keeping them isolated from session and rate limiting data.
+
+For guidance on configuring Redis, including clustering, Sentinel, and TLS, see [Configure Redis](/tyk-configuration-reference/redis-cluster-sentinel). For database sizing guidelines and memory management options, see [Database Management](/planning-for-production/database-settings).
+
+## Connecting Multiple Gateways to a Single Dashboard
+
+Please note that, for a Self-Managed installation, the number of gateway nodes you may register with your dashboard concurrently will be subject to the terms of your license.
+
+Each gateway node must be configured in the same way, with the exception being if you want to shard your gateways. Each gateway node in the cluster will need connectivity to the same Redis server and persistent database.
+
+### Use a Consistent License Across Dashboard Instances
+
+When you run more than one Tyk Dashboard instance against the same Redis and database backend, every instance must use the same license key. This matters most during a rolling or blue-green upgrade, or while updating a license, because old and new instances can run side by side with different keys.
+
+A Tyk Dashboard license defines the pool of gateway nodes that the Dashboard is allowed to register, and this node information is shared through Redis. When two instances connect to the same Redis with different licenses, one Dashboard can reject gateways that were registered against the other license. Affected gateways fail to register with an HTTP 404 response, and the Dashboard logs `level=error msg="GetSpareNode returned node not allowed by this dashboard's license"`. Gateways that cannot register lead to 404 responses and prevent API creation.
+
+To avoid this, apply any license change to every Dashboard instance that shares the same backend. See the [Upgrading Guide](/developer-support/upgrading#upgrade-strategies) for upgrade guidance and [Troubleshooting](/api-management/troubleshooting-debugging#dashboard) to resolve the error.
+
+## Other Dashboard Security Considerations
+
+In addition to changing the default secrets (see [Change all the shared secrets](#change-all-the-shared-secrets)) if you change the Control API port (see [Change your Control Port](#change-your-control-port)), you also need to change the connection string settings in your `tyk_analytics.conf` file.
+
+## Ensure you are matching only the URL paths that you want to match
+
+We recommend that you configure Tyk Gateway to use [exact URL path matching](/getting-started/key-concepts/url-matching#matching-modes) and to enforce [strict route matching](/tyk-oss-gateway/configuration#http_server_options-enable_strict_routes) to avoid accidentally invoking your unsecured `/health` endpoint when a request is made to `/customer/{customer_id}/account/health`...
+
+Unless you want to make use of Tyk's flexible *listen path* and *endpoint path* matching modes and understand the need to configure patterns carefully, you should enable `TYK_GW_HTTPSERVEROPTIONS_ENABLESTRICTROUTES`, `TYK_GW_HTTPSERVEROPTIONS_ENABLEPATHPREFIXMATCHING` and `TYK_GW_HTTPSERVEROPTIONS_ENABLEPATHSUFFIXMATCHING`.
+
+## Health checks are expensive
+
+To keep real-time health-check data and make it available to the Health-check API, Tyk needs to record information for every request, in a rolling window - this is an expensive operation and can limit throughput - you have two options: switch it off, or get a box with more cores.
+
+## Selecting the appropriate log level
+
+Tyk provides multiple [log levels](/api-management/logs/application-logs): error, warn, info, debug. Setting higher log levels consumes more computing resources and would have an impact on the Tyk component. Tyk installations default to log level info unless modified by config files or environment variables.
+
+It is recommended to set to debug only for the duration of troubleshooting as it adds heavier resource overheads. In high performance use cases for Tyk Gateway, consider setting a log level lower than info to improve overall throughput.
+
+## Use the optimization settings
+
+The below settings will ensure connections are effectively re-used, removes a transaction from the middleware run that enforces org-level rules, enables the new rate limiter (by disabling sentinel rate limiter) and sets Tyk up to use an in-memory cache for session-state data to save a round-trip to Redis for some other transactions.
+
+Most of the changes below should be already in your `tyk.conf` by default:
+
+```
+"close_connections": false,
+"proxy_close_connections": false,
+"enforce_org_quotas": false,
+"enforce_org_data_detail_logging": false,
+"experimental_process_org_off_thread": true,
+"enable_sentinel_rate_limiter": false,
+"local_session_cache": {
+  "disable_cached_session_state": false
+},
+"max_idle_connections_per_host": 500
+```
+
+In Tyk v2.7 we optimized the connection pool between Tyk and your Upstream. In previous releases `max_idle_connections_per_host` option, was capped at 100. From v2.7 you have been able to set it to any value.
+
+`max_idle_connections_per_host` limits the number of keep-alive connections between clients and Tyk. If you set this value too low, then Tyk will not re-use connections and you will have to open a lot of new connections to your upstream.
+
+If you set this value too high, you may encounter issues when slow clients occupy your connection and you may reach OS limits.
+
+You can calculate the right value using a straightforward formula:
+
+If the latency between Tyk and your Upstream is around 50ms, then a single connection can handle 1s / 50ms = 20 requests. So if you plan to handle 2000 requests per second using Tyk, the size of your connection pool should be at least 2000 / 20 = 100. For example, on low-latency environments (like 5ms), a connection pool of 100 connections will be enough for 20k RPS.
+
+## Protect Redis from overgrowing
+
+Please read carefully through this [doc](/api-management/access-control/sessions-and-keys/session-lifecycle) to make an *aware decision* about the expiration of your keys in Redis, after which they will be removed from Redis. If you don't set the lifetime, a zero default means that keys will stay in Redis until you manually delete them, which is no issue if you have a process outside Tyk Gateway to handle it. If you don't - and especially in scenarios that your flow creates many keys or access tokens for every user or even per call - your Redis can quickly get cluttered with obsolete tokens and eventually affect the performance of the Tyk Gateway.
+
+## Analytics Optimizations
+
+If using a [Redis cluster](https://redis.io/docs/management/scaling/) under high load it is recommended that analytics are distributed among the Redis shards. This can be configured by setting the [analytics_config.enable_multiple_analytics_keys](/tyk-oss-gateway/configuration#analytics_config-enable_multiple_analytics_keys) parameter to true. Furthermore, analytics can also be disabled for an API using the [do_not_track](/api-management/gateway-config-tyk-classic#traffic-logs) configuration parameter. Alternatively, tracking for analytics can be disabled for selected endpoints using the [do not track endpoint plugin](/api-management/traffic-transformation/do-not-track#do-not-track-using-tyk-oas).
+
+### Protobuf Serialisation
+
+In Tyk Gateway, using [protobuf](/tyk-oss-gateway/configuration#analytics_config-serializer_type) serialisation, instead of [msgpack](https://msgpack.org) can increase performance for sending and processing analytics. 
+<br/>
+**Note:** *protobuf* is not currently supported in *MDCB* deployment.
+
+If using Tyk Cloud platform under high load, it is also recommended that analytics are stored within a local region. This means that a local Tyk Pump instance can send the analytics to a localised data sink, such as PostgreSQL or MongoDB (no need for the hybrid pump). This can reduce traffic costs since your analytics would not be sent across regions.
+
+
+## Use the right hardware
+
+Tyk is CPU-bound: you will get exponentially better performance the more cores you throw at Tyk - it's that simple. Tyk will automatically spread itself across all cores to handle traffic, but if expensive operations like health-checks are enabled, then those can cause keyspace contention, so again, while it helps, health-checks do throttle throughput.
+
+## Resource limits
+
+Make sure your host operating system has resource limits set to handle an appropriate number of connections.
+
+You can increase the maximum number of files available to the kernel by modifying `/etc/sysctl.conf`.
+
+```
+fs.file-max=160000
+```
+
+Please note that a single file, with associated inode & dcache consumes approximately 1KB RAM. As such, setting `fs.file-max=160000` will consume a maximum of 160MB ram.
+
+The changes will apply after a system reboot, but if you do not wish to reboot quite yet, you can apply the change for the current session using `echo 160000 > /proc/sys/fs/file-max`.
+
+## File Handles / File Descriptors
+
+Now we need to configure the file handles available to your Tyk services.
+
+### systemd
+
+Override your `systemd` unit files for each of the Tyk services using `systemctl edit {service_name}`.
+
+* Gateway `systemctl edit tyk-gateway.service`
+* Dashboard `systemctl edit tyk-dashboard.service`
+* Pump `systemctl edit tyk-pump.service`
+* Multi Data-Center Bridge `systemctl edit tyk-sink.service`
+
+You may then add `LimitNOFILE=80000` to the `[Service]` directive as follows:
+
+```
+[Service]
+LimitNOFILE=80000
+```
+
+After making these changes, you'll need to restart your service, for example:
+
+```
+systemctl restart tyk-gateway.service
+```
+
+### Docker
+
+You may set *ulimits* in a container using the `--ulimit` option. See *Docker* documentation for detail on [setting *ulimits*](https://docs.docker.com/engine/reference/commandline/run/#set-ulimits-in-container---ulimit)
+
+```
+docker run --ulimit nofile=80000:80000 \
+  -it --name tyk-gateway \
+  tykio/tyk-gateway:latest
+```
+
+
+<Note>
+If you are not using *systemd* or Docker, please consult your Operating System documentation for controlling the number of File Descriptors available for your process.
+</Note>
+
+
+## File modification at runtime
+
+Understanding what files are created or modified by the Dashboard and Gateway during runtime can be important if you are running infrastructure orchestration systems such as Puppet, which may erroneously see such changes as problems that need correcting.
+
+*   Both the Gateway and Dashboard will create a default configuration file if one is not found.
+*   Dashboard will write the license into the configuration file if you add it via the UI.
+*   From Tyk v2.3 onwards it has been possible for a Dashboard to remotely change the config of a Gateway. This will cause the Gateway's configuration file to update.
\ No newline at end of file
diff --git a/planning-for-production/database-settings.mdx b/planning-for-production/database-settings.mdx
new file mode 100644
index 0000000000..e45849efe4
--- /dev/null
+++ b/planning-for-production/database-settings.mdx
@@ -0,0 +1,280 @@
+---
+title: "Database Management"
+description: "How to configure Tyk's data storage for production"
+sidebarTitle: "Database Management"
+---
+
+import MongodbVersionsInclude from '/snippets/mongodb-versions-include.mdx';
+import SqlVersionsInclude from '/snippets/sql-versions-include.mdx';
+import RedisCalculator from '/snippets/RedisCalculator.mdx';
+import DatabaseCalculator from '/snippets/DatabaseCalculator.mdx';
+
+Visit the following sections to see how to configure the Database for Production:
+* [Redis](/planning-for-production/database-settings#redis)
+* [MongoDB](/planning-for-production/database-settings#mongodb-sizing-guidelines)
+* [PostgreSQL](/planning-for-production/database-settings#postgresql)
+
+Please consult the [data storage configuration](/api-management/dashboard-configuration#data-storage-solutions) guide for further information relating to how to configure Tyk's data storage across different database engines.
+
+## Redis
+
+### How Tyk Uses Redis
+
+Redis is central to Tyk's operation. Its role differs depending on whether it is serving a Control Plane or a Data Plane.
+
+**Control Plane Redis** is shared between Tyk Dashboard and the Management Gateway. It stores:
+
+- Tyk Dashboard user sessions.
+- API client [Session](/api-management/access-control/sessions-and-keys/understanding-sessions) data (the source of truth for the deployment).
+- [OAuth tokens issued by Tyk's OAuth 2.0 authorization server](/api-management/authentication/oauth-2#client-application).
+- [Tyk Certificate Store](/api-management/certificates#tyk-certificate-store).
+- Distributed locks, for example to ensure OAuth token purging runs on only one node at a time.
+- The pub/sub channel used to push hot-reload notifications from Tyk Dashboard to connected Data Plane Gateways.
+
+**Data Plane Redis** (used in distributed deployments) is local to each Data Plane cluster. Data Plane Gateways handle API traffic and use their local Redis for:
+
+- Rate limiting counters.
+- API response caching.
+- Webhook deduplication, preventing duplicate events from firing within the configured timeout.
+- [Traffic logs](/api-management/logs/traffic-logs) buffered before Tyk Pump processes them.
+- A local copy of API client Sessions and certificates, synced from the Control Plane.
+- API definition and policy backups, providing resilience when the Control Plane is unavailable.
+
+In deployments without Tyk MDCB, there is no Control Plane / Data Plane split. A single Redis instance covers all of the above, shared between Tyk Gateway, Tyk Dashboard and Tyk Pump.
+
+### Protecting Redis Data
+
+Tyk's Redis usage differs between the Control Plane and Data Plane, and the consequences of losing each are different.
+
+**Control Plane Redis** stores API keys, session data, OAuth tokens, and certificates. This is the source of truth for your deployment and cannot be recovered from any other Tyk component. Deploy it with persistence enabled and a high-availability topology such as Redis Sentinel or Redis Cluster. If you are using Amazon ElastiCache, also configure read replicas and regular snapshots.
+
+**Data Plane Redis** stores rate limiting counters, cached responses, and analytics buffers, plus a local copy of keys, sessions, and API definitions synced from the Control Plane. If Data Plane Redis is lost, the impact is temporary: keys and sessions re-sync from the Control Plane on reconnection, and API definition backups rebuild on the next hot reload. High availability is still recommended to avoid disruption during a node failure, but Data Plane Redis is recoverable in a way that Control Plane Redis is not.
+
+For configuration details, see [Configure Redis](/tyk-configuration-reference/redis-cluster-sentinel).
+
+### Redis Sizing Guidelines
+
+Redis memory requirements depend on what the instance is serving.
+
+**Control Plane Redis** memory is driven primarily by the number and size of API keys, API definitions, and security policies stored. Key size is typically small (around 1KB), but large key counts or large API definition payloads can add up quickly.
+
+**Data Plane Redis** memory is driven by traffic volume and feature usage. The main contributors are:
+
+- **Traffic log buffering**: traffic logs accumulate in Redis between purge intervals. Basic analytics records are typically around 2KB; detailed logging can reach 52KB per request. Logs are processed by Tyk Pump or, in distributed deployments, by Tyk MDCB.
+- **Response caching**: cached API responses are held in Redis for the duration of their TTL. Memory usage depends on cache hit rate, TTL, and average payload size.
+- **API definitions and policies**: a local copy is stored in Data Plane Redis for resilience.
+
+<RedisCalculator />
+
+### Managing Redis Memory
+
+#### Capping Analytics
+
+Tyk Gateways can generate a large volume of analytics data. Be sure to read about [capping your Dashboard analytics](/api-management/dashboard-analytics/analytics-storage-management).
+
+#### Compressing API Definitions and Policies
+
+In [distributed deployments](/api-management/mdcb), Data Plane Gateways store API definition and policy backups in Redis to ensure resilience when the Control Plane is unavailable. For deployments with many or large API definitions, this can consume significant Redis memory.
+
+You can reduce the size of these backups using optional Zstandard compression, which typically achieves around 75% reduction, though results vary depending on the size and complexity of your API definitions and policies.
+
+Set the following fields in your Data Plane Gateway configuration:
+
+```json
+"storage": {
+  "compress_api_definitions": true,
+  "compress_policies": true
+}
+```
+
+- [`storage.compress_api_definitions`](/tyk-oss-gateway/configuration#storage-compress_api_definitions) is available from Tyk 5.12.0.
+- [`storage.compress_policies`](/tyk-oss-gateway/configuration#storage-compress_policies) is available from Tyk 5.13.0.
+
+Tyk Gateway reads uncompressed data already in Redis seamlessly. On the next hot reload, definitions and policies are compressed before being stored.
+
+To mitigate the risk of decompression bombs, the maximum combined uncompressed size is limited to the value of `storage.max_decompressed_size`.
+
+#### Separate Analytics Storage
+
+By default, Tyk Gateway writes traffic logs to the same Redis instance used for rate limiting, session data, and other gateway operations. Under high traffic, this can place significant pressure on your primary Redis. You can offload traffic log buffering to a dedicated Redis instance by enabling a separate analytics store:
+
+```json
+"enable_separate_analytics_store": true,
+"analytics_storage": {
+  "host": "analytics-redis-server",
+  "port": 6379
+}
+```
+
+The `analytics_storage` block accepts the same fields as the main `storage` block. See [Configure Redis](/tyk-configuration-reference/redis-cluster-sentinel) for the full field reference.
+
+#### Separate Cache Storage
+
+API response caching can consume significant Redis memory, particularly for large payloads or high cache hit rates. You can isolate cache storage in a dedicated Redis instance, keeping it separate from session and rate limiting data:
+
+```json
+"enable_separate_cache_store": true,
+"cache_storage": {
+  "host": "cache-redis-server",
+  "port": 6379
+}
+```
+
+The `cache_storage` block accepts the same fields as the main `storage` block. See [Configure Redis](/tyk-configuration-reference/redis-cluster-sentinel) for the full field reference.
+
+
+## MongoDB
+
+### Supported Versions
+
+<MongodbVersionsInclude/>
+
+For recommended deployment topology, see [Planning for Production](/planning-for-production#recommended-topology).
+
+**Special notes for DocumentDB**
+
+<Note>
+If you are using [DocumentDB](https://aws.amazon.com/documentdb/), [capped collections](/api-management/dashboard-analytics/analytics-storage-management) are not supported. See [here](https://docs.aws.amazon.com/documentdb/latest/developerguide/mongo-apis.html) for more details.
+</Note>
+ 
+
+**Special notes for MongoDB Atlas**
+To integrate with [MongoDB Atlas](https://www.mongodb.com/atlas/database), make sure the IP firewall connections are whitelisted on the Atlas side, and then use the following Tyk Dashboard configurations to connect: 
+``` 
+- TYK_DB_MONGOURL=mongodb://admin:password@tykdb-shard-00-00.h42pp.mongodb.net:27017,tykdb-shard-00-01.h42pp.mongodb.net:27017,tykdb-shard-00-02.h42pp.mongodb.net:27017/tyk_analytics?authSource=admin - TYK_DB_ENABLECLUSTER=false - TYK_DB_MONGOUSESSL=true 
+``` 
+
+More information on these configuration variables [here](/tyk-dashboard/configuration). 
+
+
+### MongoDB Sizing Guidelines
+
+The aggregate record size depends on the number of APIs and Keys you have. Each counter size is ~50b, and every aggregated value has its own counter. 
+
+So an hourly aggregate record is computed like this: 50 * active_apis + 50 * api_versions + 50 * active_api_keys  + 50 * oauth_keys, etc. 
+
+The average aggregate record size (created hourly) on our cloud is about ~ 40KB (a single record includes all the aggregate stats mentioned above).
+
+So for 1 million requests per day, it will generate 1KB * 1M request stats (1GB) + 24 * 40KB aggregate stats (~1MB).
+
+Per month: 30GB request logs + 30MB aggregate logs
+
+**MongoDB Working Data**
+
+Working data in terms of MongoDB is the data you query most often. The graphs displayed on the Tyk Dashboard, except for the Log browser, use aggregated data. 
+
+So if you rely only on this kind of analytic data, you will not experience issues with working data and memory issues. It is literally hundreds of MBs. 
+
+Even if you use the Log browser, its usage access is usually quite random, and it is unlikely that you check requests for every request. So it can't be called working data. And it is ok to store it on disk and allow MongoDB to do the disk lookups to fetch the data. 
+
+Note, that in order to do fast queries, even from the disk, MongoDB uses indexes. MongoDB recommends that indexes should fit into memory, and be considered working data, but only the part of the index which is commonly used. For example the last month of data. 
+
+For an aggregate collection, the average index size is 6% of the overall collection. For requests stats, it is around 30%. 
+
+
+**MongoDB Sizing Example**
+If you serve 1 million requests per day, and require fast access to the last seven days of request logs (usually way less, and the performance of the log viewer is not a concern), with 3 months of aggregated logs, the memory requirements for MongoDB can be as follows:
+
+Request_logs_index ( 30% * (1GB * 7) ) + aggregated(3month * 30MB) ~= 2.1GB + 90MB = ~ 2.2GB
+
+In addition to storing working data in memory, MongoDB also requires space for some internal data structures. In general, multiplying the resulting number by 2x should be enough. In the above example, your MongoDB server should have around 4.4GB of available memory.
+
+**Audit Log storage**
+
+From Tyk Dashboard v5.7+,the  audit log can be configured to be stored in the database. If you choose to store the audit logs in the database, you need to account for additional storage for audit logs in the database setup. The size of this table will depend on the number of operations recorded, with each record averaging 1350 to 1450 bytes.
+
+**Audit Log Considerations**
+
+- **Data Generation**: The total size of the audit log table will depend on the number of API operations, administrative actions, and system events that are being logged.
+- **Daily Estimate**: For example, logging 100,000 operations per day results in 135MB to 145MB of additional data daily.
+- **Storage Growth**: Over time, this can significantly impact your storage requirements, especially in high-traffic environments or systems with comprehensive logging enabled.
+
+**Recommendations for Housekeeping the Audit Log Table**
+
+1. **Implement Data Retention Policies:**
+  Define a clear retention period based on business and regulatory requirements, such as 30, 90, or 180 days. Remove older logs that exceed the retention policy to prevent excessive storage growth.
+
+2. **Archive Older Logs:**
+  For long-term storage or compliance purposes, move older logs to external systems such as a data lake, object storage (e.g., S3), or a data warehouse.
+
+3. **Monitor Growth Trends:**
+  Use monitoring tools to track the size and growth rate of the audit log table. Adjust retention policies or resources proactively based on observed trends.
+
+4. **Plan for Resource Scaling:**
+  Audit log storage can significantly impact overall database size, especially in high-traffic environments. Plan for storage and resource scaling based on daily log growth estimates.
+
+**Example Calculation:**
+
+- Daily Logs: 100,000 operations/day
+- Average Record Size: 1400 bytes
+- Storage Growth: 100,000 × 1400 bytes/day = 140MB/day 
+
+For 90 days: 140MB × 90 = ~12.6GB
+
+**MongoDB Database Storage Calculator**
+You can calculate your MongoDB storage requirements by entering your known values in the middle section of the calculator settings below:
+
+<DatabaseCalculator />
+
+
+## PostgreSQL
+
+How you configure your PostgreSQL installation depends on whether you are installing Tyk from fresh using PostgreSQL, or are migrating from an existing MongoDB instance.
+
+**Supported Versions**
+
+<SqlVersionsInclude/>
+
+### Migrating from an existing MongoDB instance
+
+For v4.0 we have provided a migration command that will help you migrate all data from the main storage layer (APIs, Policies, Users, UserGroups, Webhooks, Certificates, Portal Settings, Portal Catalogs, Portal Pages, Portal CSS, etc.).
+
+
+<Note>
+The migration tool will not migrate any Logs, Analytics, or Uptime analytics data.
+</Note>
+
+
+1. Make sure your new SQL platform and the existing MongoDB instance are both running
+2. Configure the `main` part of the  `storage` section of your `tyk-analytics.conf`:
+
+```yaml
+{
+...
+  "storage": {
+    ...
+    "main": {
+      "type": "postgres",
+      "connection_string": "user=root password=admin database=tyk-demo-db host=tyk-db port=5432"
+    }
+  }
+} 
+```
+3. Run the following command:
+
+```console
+./tyk-analytics migrate-sql
+```
+You will see an output listing the transfer of each database table. For example: `Migrating 'tyk_apis' collection. Records found: 7`.
+
+4. You can now remove your `mongo_url` (or `TYK_DB_MONGOURL` environment variable) from your `tyk-analytics.conf`
+5. Restart your Tyk Dashboard
+
+### PostgreSQL Sizing Guidelines
+
+The aggregate record size depends on the number of APIs and Keys you have. Each counter size is ~50b, and every aggregated value has its own counter. 
+
+So an hourly aggregate record is computed like this: 50 * active_apis + 50 * api_versions + 50 * active_api_keys  + 50 * oauth_keys, etc. 
+
+The average aggregate record size (created hourly) on our cloud is about ~ 40KB (a single record includes all the aggregate stats mentioned above).
+
+So for 1 million requests per day, it will generate 1KB * 1M request stats (1GB) + 24 * 40KB aggregate stats (~1MB).
+
+Per month: 30GB request logs + 30MB aggregate logs
+
+**PostgreSQL Database Storage Calculator**
+You can calculate your PostgreSQL storage requirements by entering your known values in the middle section of the calculator settings below:
+
+<DatabaseCalculator />
+
+
diff --git a/planning-for-production/ensure-high-availability/circuit-breakers.mdx b/planning-for-production/ensure-high-availability/circuit-breakers.mdx
new file mode 100644
index 0000000000..7e6b514c2f
--- /dev/null
+++ b/planning-for-production/ensure-high-availability/circuit-breakers.mdx
@@ -0,0 +1,343 @@
+---
+title: "Circuit Breakers"
+description: "How to configure Tyk's circuit breaker middleware to protect your upstream services from repeated failures and overloading."
+sidebarTitle: "Circuit Breakers"
+---
+
+## Introduction
+
+A circuit breaker is a protective mechanism that helps to maintain system stability by preventing repeated failures and overloading of services that are erroring. When a network or service failure occurs, the circuit breaker prevents further calls to that service, allowing the affected service time to recover while ensuring that the overall system remains functional. It is a critical component in ensuring the resilience and reliability of a distributed system.
+
+Tyk's circuit breaker can be configured at the endpoint level, where it monitors the rate of failure responses (HTTP 500 or higher) received from the upstream service. If that failure rate exceeds the configured threshold, the circuit breaker will trip and Tyk will block further requests to that endpoint (returning `HTTP 503 Service temporarily unavailable`) until the end of a recovery (cooldown) time period.
+
+Tyk can trigger events when the circuit breaker trips and when it resets. These events can be used for monitoring, alerting, or automation of recovery processes.
+
+<img src="/img/diagrams/diagram_docs_circuit-breakers@2x.png" alt="Circuit breaker example" />
+
+## When to use a circuit breaker
+
+**Protection of critical API endpoints**
+
+Circuit breakers can be used to safeguard essential API endpoints from overloading, ensuring their availability and performance. By implementing circuit breakers, users can prevent these endpoints from being overwhelmed, maintaining their reliability and responsiveness.
+
+**Handling temporary issues**
+
+Circuit breakers can help handle temporary issues in the system, such as temporary outages or performance degradation, by opening and closing the circuit when conditions are unfavorable, allowing the system to recover and resume normal operation.
+
+**Implementing retry logic**
+
+Circuit breakers can be used to automatically manage the retry of failed requests after a hold-off period, increasing the chances of successful execution.
+
+**Implementing fallback mechanisms**
+
+Circuit breakers can trigger alternative workflows or fallback mechanisms when the primary system fails, ensuring uninterrupted service delivery despite system failures.
+
+## How the circuit breaker works
+
+Similarly to the circuit breaker in an electrical installation, Tyk's circuit breaker middleware monitors the flow and trips (breaks the connection) if it detects errors. Whilst the electrical circuit breaker monitors the flow of electricity and trips if it detects overcurrent (e.g. a short-circuit), Tyk's monitors the responses back from the upstream service and trips if it detects too many failures.
+
+From the perspective of the circuit breaker middleware, a failure is considered any response with HTTP status code `500` or above.
+
+The circuit breaker is rate-based, meaning that it counts the number of failure responses received in a rolling sample window and trips if the failure rate exceeds the configured threshold.
+
+The rolling sample window is set to 10 seconds and the circuit breaker is designed to trip only if a user-configurable minimum number of samples (requests) fail within the window period.
+
+Thus, if the _sample size_ is set to 100 and the _failure rate_ is set to 0.5 (50%) then the circuit breaker will trip only when there have been a minimum of 100 requests made in the past 10 seconds of which at least 50 have failed (returned an `HTTP 500` or higher error).
+
+Once the breaker has been tripped it will remain _open_, blocking calls to the endpoint until a configurable cooldown (or return-to-service) period has elapsed. While the breaker is _open_, requests to the endpoint will return `HTTP 503 Service temporarily unavailable`.
+
+### Half-open mode
+
+In some scenarios the upstream service might recover more quickly than the configured cooldown period. The middleware supports a _half-open_ mode that facilitates an early return-to-service so that API clients do not have to wait until the end of the cooldown before the circuit breaker is reset.
+
+In the _half-open_ mode, Tyk will periodically issue requests to the upstream service to check whether the path has been restored (while continuing to block client requests). If the Gateway detects that the path has been reconnected, the circuit breaker will be automatically reset (following the electrical circuit analogy, the circuit breaker is _closed_) and requests will be passed to the upstream again.
+
+### Configuring the circuit breaker
+
+The circuit breaker is configured using only three parameters:
+- sample size
+- error rate threshold
+- cooldown period
+
+The threshold is a ratio of the number of failures received in the sample window. For example, if the sample window size is 100 requests and you wish to trip the circuit breaker if there are 15 failures in any 100 requests, the threshold should be set to `15/100 = 0.15`.
+
+The cooldown period is the time that the circuit breaker will remain _open_ after the error rate threshold has been met and the breaker has been tripped.
+
+There is also an option to enable or disable the _half-open_ state if this would be damaging to your system.
+
+
+<Note>
+If you are using the Service Discovery module, every time the breaker trips, Tyk will attempt to refresh the Gateway list.
+</Note>
+
+
+### Using the circuit breaker with multiple upstream hosts
+
+The circuit breaker works at the endpoint level independent of the number of upstream hosts are servicing the requests. Thus, if you have multiple upstream targets for an API, the sample and failure counts are accumulated across **all** upstream requests. If the failure rate exceeds the threshold, the circuit breaker will trip even if only some of your upstream hosts are failing. Operating in _half-open_ mode will of course cause the breaker to reset if a responsive upstream receives a request, but the `BreakerTripped` (or `BreakerTriggered`) event should alert you to the fact that at least one host is failing.
+
+### Using the circuit breaker with multiple Tyk Gateways
+
+Circuit breakers operate on a single Tyk Gateway, they do not centralise or pool back-end data. This ensures optimum speed of response and resilience to Gateway failure. Subsequently, in a load balanced environment where multiple Tyk Gateways are used, some traffic can spill through even after the circuit breaker has tripped on one Gateway as other Gateways continue to serve traffic to the upstream before their own breakers trip.
+
+### Circuit breaker events
+
+The circuit breaker automatically controls the flow of requests to the upstream services quickly and efficiently, but it is equally important to alert you to the fact that there is an issue and to confirm when traffic will recommence once the issue is resolved. Tyk's [Event](/api-management/gateway-events#event-categories) system provides the method by which the circuit breaker can alert you to these occurrences.
+
+- When the circuit breaker trips (from closed to open), Tyk will generate a `BreakerTripped` event
+- When the breaker resets (from open to closed), whether at the end of the cooldown period or if connection is restored while in _half-open_ mode, Tyk will generate a `BreakerReset` event
+- In addition to these, whenever the circuit breaker changes state (from closed to open or vice versa), Tyk will generate a `BreakerTriggered` event
+ 
+For the generic `BreakerTriggered` event, the state change will be indicated in the `Status` field in the webhook template as follows:
+- when a breaker trips `CircuitEvent = 0`
+- when a breaker resets `CircuitEvent = 1`
+
+### API-level circuit breaker
+
+Tyk does not have an API-level circuit breaker that can be applied across all endpoints. If you are using the Tyk Dashboard, however, then you are able to use an [Open Policy Agent](/platform-management/open-policy-agent) to append a circuit breaker to every API/Service using the regex `.*` path.
+
+<hr />
+
+{/* proposed "summary box" to be shown graphically on each middleware page
+ ## Circuit Breaker middleware summary
+  - The Circuit Breaker is an optional stage in Tyk's API Request processing chain, activated when the request is proxied to the upstream service.
+  - The Circuit Breaker is configured at the per-endpoint level within the API Definition and is supported by the API Designer within the Tyk Dashboard. */}
+
+
+**Using the Circuit Breaker middleware with Tyk OAS APIs**
+
+
+Tyk's circuit breaker middleware is configured at the endpoint level, where it monitors the rate of failure responses (HTTP 500 or higher) received from the upstream service. If that failure rate exceeds the configured threshold, the circuit breaker will trip and Tyk will block further requests to that endpoint (returning `HTTP 503 Service temporarily unavailable`) until the end of a recovery (cooldown) time period.
+
+When working with Tyk OAS APIs the circuit breaker is configured in the [Tyk OAS API Definition](/api-management/gateway-config-tyk-oas#operation). You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the legacy Tyk Classic APIs, then check out the [Tyk Classic](#configuring-the-circuit-breaker-in-the-tyk-classic-api-definition) page.
+
+## Configuring the Circuit Breaker in the Tyk OAS API Definition
+
+The design of the Tyk OAS API Definition takes advantage of the `operationId` defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint `paths` entries (and the associated `operationId`) can contain wildcards in the form of any string bracketed by curly braces, for example `/status/{code}`. These wildcards are so they are human-readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: `(.*)`.
+
+The circuit breaker middleware (`circuitBreaker`) can be added to the `operations` section of the Tyk OAS Extension (`x-tyk-api-gateway`) in your Tyk OAS API Definition for the appropriate `operationId` (as configured in the `paths` section of your OpenAPI Document).
+
+The `circuitBreaker` object has the following configuration:
+- `enabled`: enable the middleware for the endpoint
+- `threshold`: the proportion of requests that can error before the breaker is tripped, this must be a value between 0.0 and 1.0
+- `sampleSize`: the minimum number of requests that must be received during the rolling sampling window before the circuit breaker can trip
+- `coolDownPeriod`: the period for which the breaker will remain _open_ after being tripped before returning to service (seconds)
+- `halfOpenStateEnabled`: if set to `true` then the circuit breaker will operate in [half-open mode](#half-open-mode) once it has been tripped
+
+```json {hl_lines=["39-45"],linenos=true, linenostart=1}
+{
+    "components": {},
+    "info": {
+        "title": "example-breaker",
+        "version": "1.0.0"
+    },
+    "openapi": "3.0.3",
+    "paths": {
+        "/status/200": {
+            "get": {
+                "operationId": "status/200get",
+                "responses": {
+                    "200": {
+                        "description": ""
+                    }
+                }
+            }
+        }
+    },
+    "x-tyk-api-gateway": {
+        "info": {
+            "name": "example-breaker",
+            "state": {
+                "active": true
+            }
+        },
+        "upstream": {
+            "url": "http://httpbin.org/"
+        },
+        "server": {
+            "listenPath": {
+                "value": "/example-breaker/",
+                "strip": true
+            }
+        },
+        "middleware": {
+            "operations": {
+                "status/200get": {
+                    "circuitBreaker": {
+                        "enabled": true,
+                        "threshold": 0.5,
+                        "sampleSize": 10,
+                        "coolDownPeriod": 60,
+                        "halfOpenStateEnabled": true
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+In this example Tyk OAS API Definition the circuit breaker has been configured to monitor requests to the `GET /status/200` endpoint.
+
+It will configure the circuit breaker so that if a minimum of 10 requests (`sampleSize`) to this endpoint are received during the [rolling sampling window](#how-the-circuit-breaker-works) then it will calculate the ratio of failed requests (those returning `HTTP 500` or above) within that window.
+- if the ratio of failed requests exceeds 50% (`threshold = 0.5`) then the breaker will be tripped
+- after it has tripped, the circuit breaker will remain _open_ for 60 seconds (`coolDownPeriod`)
+- further requests to `GET /status/200` will return `HTTP 503 Service temporarily unavailable`
+- the circuit breaker will operate in _half-open_ mode (`halfOpenStateEnabled = true`) so when the threshold has been reached and the breaker is tripped, Tyk will periodically poll the upstream service to test if it has become available again
+
+The configuration above is a complete and valid Tyk OAS API Definition that you can import into Tyk to try out the circuit breaker.
+
+## Configuring the Circuit Breaker in the API Designer
+
+Adding the circuit breaker to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:
+
+**Step 1: Add an endpoint**
+
+From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+<img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+<img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+<img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+**Step 2: Select the Circuit Breaker middleware**
+
+Select **ADD MIDDLEWARE** and choose the **Circuit Breaker** middleware from the *Add Middleware* screen.
+
+<img src="/img/dashboard/api-designer/tyk-oas-circuit-breaker.png" alt="Adding the Circuit Breaker middleware" />
+
+**Step 3: Configure the middleware**
+
+Set the circuit breaker configuration parameters so that Tyk can protect your upstream service if it experiences failure:
+- threshold failure rate for the proportion of requests that can error before the breaker is tripped (a value between 0.0 and 1.0)
+- the minimum number of requests that must be received during the [rolling sampling window](#how-the-circuit-breaker-works) before the circuit breaker can trip
+- the cooldown period for which the breaker will remain _open_ after being tripped before returning to service (in seconds)
+- optionally enable [half-open mode](#half-open-mode) for upstream services with variable recovery times
+
+<img src="/img/dashboard/api-designer/tyk-oas-circuit-breaker-config.png" alt="Configuring the circuit breaker for the endpoint" />
+
+Select **ADD MIDDLEWARE** to apply the change to the middleware configuration.
+
+**Step 4: Save the API**
+
+Select **SAVE API** to apply the changes to your API.
+
+
+## Using the Circuit Breaker middleware with Tyk Classic APIs
+
+
+Tyk's circuit breaker middleware is configured at the endpoint level, where it monitors the rate of failure responses (HTTP 500 or higher) received from the upstream service. If that failure rate exceeds the configured threshold, the circuit breaker will trip and Tyk will block further requests to that endpoint (returning `HTTP 503 Service temporarily unavailable`) until the end of a recovery (cooldown) time period.
+
+When working with Tyk Classic APIs the circuit breaker is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer.
+
+If you're using the newer Tyk OAS APIs, then check out the [Tyk OAS](#configuring-the-circuit-breaker-in-the-tyk-oas-api-definition) page.
+
+If you're using Tyk Operator then check out the [configuring the Circuit Breaker in Tyk Operator](#configuring-the-circuit-breaker-in-tyk-operator) section below.
+
+## Configuring the Circuit Breaker in the Tyk Classic API Definition
+
+To configure the circuit breaker you must add a new `circuit_breakers` object to the `extended_paths` section of your API definition, with the following configuration:
+- `path`: the endpoint path
+- `method`: the endpoint HTTP method
+- `threshold_percent`: the proportion of requests that can error before the breaker is tripped, this must be a value between 0.0 and 1.0
+- `samples`: the minimum number of requests that must be received during the rolling sampling window before the circuit breaker can trip
+- `return_to_service_after`: the period for which the breaker will remain _open_ after being tripped before returning to service (seconds)
+- `disable_half_open_state`: by default the Tyk circuit breaker will operate in [half-open mode](#half-open-mode) when working with Tyk Classic APIs, set this to `true` if you want Tyk to wait the full cooldown period before closing the circuit
+ 
+For example:
+```json  {linenos=true, linenostart=1}
+{
+    "circuit_breakers": [
+        {
+            "path": "status/200",
+            "method": "GET",
+            "threshold_percent": 0.5,
+            "samples": 10,
+            "return_to_service_after": 60,
+            "disable_half_open_state": false
+        }
+    ]
+}
+```
+In this example the circuit breaker has been configured to monitor HTTP `GET` requests to the `/status/200` endpoint. It will configure a sampling window (`samples`) of 10 requests and calculate the ratio of failed requests (those returning HTTP 500 or above) within that window. If the ratio of failed requests exceeds 50% (`threshold_percent = 0.5`) then the breaker will be tripped. After it has tripped, the circuit breaker will remain _open_ for 60 seconds (`return_to_service_after`). The circuit breaker will operate in _half-open_ mode (`disable_half_open_state = false`) so when _open_, Tyk will periodically poll the upstream service to test if it has become available again.
+
+When the breaker has tripped, it will return `HTTP 503 Service temporarily unavailable` in response to any calls to `GET /status/200`.
+
+## Configuring the Circuit Breaker in the API Designer
+
+You can use the API Designer in the Tyk Dashboard to configure the circuit breaker middleware for your Tyk Classic API by following these steps.
+
+**Step 1: Add an endpoint for the path and select the Circuit Breaker plugin**
+
+From the **Endpoint Designer** add an endpoint that matches the path for which you want to deploy the circuit breaker. Select the **Circuit Breaker** plugin.
+
+<img src="/img/2.10/circuit_breaker.png" alt="Plugin dropdown list" />
+
+**Step 2: Configure the circuit breaker**
+
+You can set up the various configurations options for the breaker in the drawer by clicking on it:
+
+<img src="/img/2.10/ciruit_breaker_settings.png" alt="Circuit breaker configuration form" />
+
+- **Trigger threshold percentage**: The percentage of requests that can error before the breaker is tripped, this must be a value between 0.0 and 1.0
+- **Sample size (requests)**: The number of samples to take for a circuit breaker window
+- **Return to service in (s)**: The cool-down period of the breaker to return to service (seconds)
+
+**Step 3: Save the API**
+
+Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+**Step 4: Optionally configure webhooks to respond to the circuit breaker events**
+
+The Dashboard supports the separate `BreakerTripped` and `BreakerReset` events, but not the combined `BreakerTriggered` [event type](/api-management/gateway-events#event-types). You should use **API Designer > Advanced Options** to add a Webhook plugin to your endpoint for each event.
+
+<img src="/img/dashboard/system-management/webhook-breaker.png" alt="Webhook events" />
+
+## Configuring the Circuit Breaker in Tyk Operator
+
+The example API Definition below configures an API to listen on path `/httpbin-timeout-breaker` and forwards requests upstream to http://httpbin.org. A hard timeout value of 2 seconds is configured for path `/delay/{delay_seconds}`. This will return a `504 Gateway Timeout` response to the client if the upstream response is not received before expiry of the timer.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["30-35"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-timeout-breaker
+spec:
+  name: httpbin-timeout-breaker
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-timeout-breaker
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        paths:
+          black_list: []
+          ignored: []
+          white_list: []
+        extended_paths:
+          hard_timeouts:
+            - method: GET
+              path: /delay/{delay_seconds}
+              timeout: 2
+          circuit_breakers:
+            - method: GET
+              path: /status/500
+              return_to_service_after: 10
+              samples: 4
+              threshold_percent: "0.5"
+```
+
+A circuit breaker has been configured to monitor `HTTP GET` requests to the `/status/500` endpoint. It will configure a sampling window (samples) of 4 requests and calculate the ratio of failed requests (those returning HTTP 500 or above) within that window. If the ratio of failed requests exceeds 50% (threshold_percent = 0.5) then the breaker will be tripped. After it has tripped, the circuit breaker will remain open for 10 seconds (return_to_service_after). The circuit breaker will operate using the default half-open mode so when open, Tyk will periodically poll the upstream service to test if it has become available again.
+
+When the breaker has tripped, it will return HTTP 503 Service temporarily unavailable in response to any calls to GET /status/500.
+
diff --git a/planning-for-production/ensure-high-availability/config-inspection.mdx b/planning-for-production/ensure-high-availability/config-inspection.mdx
new file mode 100644
index 0000000000..5a4da49437
--- /dev/null
+++ b/planning-for-production/ensure-high-availability/config-inspection.mdx
@@ -0,0 +1,148 @@
+---
+title: "Gateway Configuration Inspection"
+description: "How to inspect the live configuration of a running Tyk Gateway using the built-in configuration inspection endpoints."
+sidebarTitle: "Configuration Inspection"
+---
+
+## Availability
+
+| Component | Version | Edition |
+| :-------- | :------ | :------- |
+| Gateway | Available since [v5.12.0](/developer-support/release-notes/gateway#5-12-0-release-notes) | All |
+
+
+To inspect the gateway's live configuration without SSH access, you can enable configuration inspection endpoints on the Control API port.
+
+## Configuration Inspection Endpoints
+
+Gateway offers two endpoints for configuration inspection:
+
+| Endpoint | Query Parameter | Description |
+|----------|----------------|-------------|
+| `GET /config` | `field=<path>` (optional) | Returns the full gateway configuration, or a single field if `field` is specified |
+| `GET /env` | `env=<VAR>` (optional) | Returns all environment variable mappings, or a single mapping if `env` is specified |
+
+Both endpoints are available on the Control API port and require authentication via the `X-Tyk-Authorization` header. Requests without this header return `HTTP 403`.
+
+## Enable Configuration Inspection
+
+By default, configuration inspection endpoints are **disabled** to prevent accidental exposure of sensitive information. When disabled, all configuration inspection endpoints return `HTTP 404`.
+
+To enable it, set `enable_config_inspection` to `true` in your `tyk.conf` or use the equivalent environment variable.
+
+<Warning>
+In production environments, we recommend keeping configuration inspection disabled.
+</Warning>
+
+<Tabs>
+<Tab title="Configuration File">
+
+```json
+{
+  "enable_config_inspection": true
+}
+```
+
+</Tab>
+<Tab title="Environment Variable">
+
+```
+TYK_GW_ENABLECONFIGINSPECTION=true
+```
+
+</Tab>
+</Tabs>
+
+## Examples
+
+### Inspect Full Gateway Configuration
+
+```bash
+curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" http://localhost:8080/config
+```
+
+Response:
+
+```json
+{
+  "hostname": "",
+  "listen_address": "",
+  "listen_port": 8080,
+  "control_api_hostname": "",
+  "control_api_port": 0,
+  "secret": "*REDACTED*",
+  "node_secret": "*REDACTED*",
+  "pid_file_location": "./tyk-gateway.pid",
+  "allow_insecure_configs": true,
+  "public_key_path": "",
+  "allow_remote_config": true,
+  "enable_config_inspection": true,
+  "security": {
+  }
+...
+}
+```
+
+### Inspect a Single Config Field
+
+To retrieve the value of a specific configuration field, use the `field` query parameter with the field name:
+
+```bash
+curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" \
+  "http://localhost:8080/config?field=listen_port"
+```
+
+Response:
+
+```json
+{
+  "config_field": "listen_port",
+  "env": "TYK_GW_LISTENPORT",
+  "value": "8080",
+  "obfuscated": false
+}
+```
+
+#### Sensitive Field Redaction
+
+Fields that contain secrets (for example, `secret`, passwords, and connection strings) are automatically shown as `*REDACTED*` in all responses. The `obfuscated` field in the response indicates whether the value has been redacted.
+
+```json
+{
+  "config_field": "secret",
+  "env": "TYK_GW_SECRET",
+  "value": "*REDACTED*",
+  "obfuscated": true
+}
+```
+
+### Inspect Environment Variables
+
+To view all environment variable mappings:
+
+```bash
+curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" http://localhost:8080/env
+```
+
+<Note>
+Gateway will only return environment variables that are prefixed with `TYK_GW_`.
+</Note>
+
+Response:
+
+```json
+[
+  "TYK_GW_ENABLECONFIGINSPECTION=true",
+  "TYK_GW_EXPERIMENTALPROCESSORGOFFTHREAD=false",
+  "TYK_GW_GRACEFULSHUTDOWNTIMEOUTDURATION=0",
+  "TYK_GW_CONTROLAPIPORT=0",
+  "TYK_GW_TEMPLATEPATH=./templates",
+  "TYK_GW_SSLFORCECOMMONNAMECHECK=false",
+  "TYK_GW_ENABLEBUNDLEDOWNLOADER=false",
+  "TYK_GW_JSVMTIMEOUT=0",
+  "TYK_GW_FORCEGLOBALSESSIONLIFETIME=false",
+  "TYK_GW_DISABLEDASHBOARDZEROCONF=false",
+  "TYK_GW_MANAGEMENTNODE=false",
+...
+]
+```
\ No newline at end of file
diff --git a/planning-for-production/ensure-high-availability/enforced-timeouts.mdx b/planning-for-production/ensure-high-availability/enforced-timeouts.mdx
new file mode 100644
index 0000000000..d419102a18
--- /dev/null
+++ b/planning-for-production/ensure-high-availability/enforced-timeouts.mdx
@@ -0,0 +1,220 @@
+---
+title: "Enforced Timeouts"
+description: "Configure upstream request timeouts in Tyk Gateway at Gateway, API, and endpoint level."
+sidebarTitle: "Enforced Timeouts"
+---
+
+## Overview
+
+Tyk Gateway enforces a maximum wait time for upstream responses. When the timeout expires, Tyk Gateway terminates the request and returns `504 Gateway Timeout` to the client with the response body `{"error": "Upstream service reached hard timeout."}`. This prevents slow or unresponsive upstream services from blocking connections and degrading overall system performance.
+
+<Note>
+If you are using the [Service Discovery](/planning-for-production/ensure-high-availability/load-balancing#service-discovery) option and an enforced timeout is triggered, the service discovery module will refresh the host or host list.
+</Note>
+
+## Timeout Levels
+
+Timeouts can be configured at three levels. The most specific level takes precedence:
+
+| Level | Tyk OAS | Tyk Classic | Scope |
+| :---- | :------ | :---------- | :---- |
+| Gateway | `proxy_default_timeout` in `tyk.conf` | `proxy_default_timeout` in `tyk.conf` | All APIs on the Gateway |
+| API *(from Tyk Gateway 5.14.0)* | `upstream.enforceTimeout` | `global_enforce_timeout` in `version_data` | All endpoints in the API |
+| Endpoint | `enforceTimeout` in `operations` | `hard_timeouts` in `extended_paths` | A specific endpoint |
+
+An endpoint-level timeout overrides the API-level timeout. The API-level timeout overrides the Gateway default.
+
+<Note>
+The Gateway-level `proxy_default_timeout` also acts as an upper bound. It runs concurrently with the API- and endpoint-level timeouts, and the request is terminated by whichever expires first. An API- or endpoint-level timeout can therefore only shorten the effective timeout. To set one longer than the Gateway default, increase [`proxy_default_timeout`](/tyk-oss-gateway/configuration#proxy_default_timeout) accordingly.
+</Note>
+
+## Duration Format
+
+From Tyk Gateway 5.14.0, API-level and endpoint-level timeouts accept human-readable duration strings. Accepted units are `ms`, `s`, and `m` as follows:
+
+| Format         | Example   | Meaning |
+| :------------- | :-------- | :------ |
+| Milliseconds   | `"500ms"` | 500 milliseconds |
+| Seconds        | `"1.5s"`  | 1.5 seconds |
+| Minutes        | `"2m"`    | 2 minutes |
+| Legacy integer | `3`       | 3 seconds (Gateway and endpoint level only) |
+
+At the endpoint level, the legacy integer (seconds) format remains supported for backward compatibility.
+
+The Gateway-level timeout is configured using the legacy integer (seconds) format.
+
+## HTTP Server Write Timeout
+
+Enforced timeouts measure only the time spent waiting for the upstream service to respond. [`http_server_options.write_timeout`](/tyk-oss-gateway/configuration#http_server_options-write_timeout) in the Gateway configuration (default: 120 seconds) covers the entire request lifecycle: Gateway middleware processing, the upstream wait, and writing the response back to the client. Because it includes Gateway-side processing time on top of the upstream wait, it is always the outer bound on any enforced timeout.
+
+If an enforced timeout is set to a value close to or longer than `write_timeout`, the HTTP server may close the connection before the enforced timeout fires. To use enforced timeouts longer than 120 seconds, increase `http_server_options.write_timeout` to at least the same value.
+
+## Configuration
+
+### Gateway Level
+
+The Gateway-level timeout is configured using [`proxy_default_timeout`](/tyk-oss-gateway/configuration#proxy_default_timeout) in `tyk.conf`. It applies to all APIs on the Gateway and accepts an integer value in seconds.
+
+### API Level
+
+<Note>
+Available from Tyk Gateway 5.14.0
+</Note>
+
+An API-level timeout applies to all endpoints in the API that do not have their own endpoint-level timeout configured.
+
+<Tabs>
+<Tab title="Tyk OAS">
+
+Configure `upstream.enforceTimeout` in the Tyk Vendor Extension:
+
+```json
+"upstream": {
+    "url": "http://httpbin.org/",
+    "enforceTimeout": {
+        "enabled": true,
+        "duration": "10s"
+    }
+}
+```
+
+| Field | Description |
+| :---- | :---------- |
+| `enabled` | Enable the API-level timeout. |
+| `duration` | Timeout duration as a human-readable string (for example `"500ms"`, `"1.5s"`, `"30s"`). |
+
+</Tab>
+<Tab title="Tyk Classic">
+
+Configure `global_enforce_timeout` in the `version_data` section of the API definition:
+
+```json
+"version_data": {
+    "versions": {
+        "Default": {
+            "global_enforce_timeout": "10s"
+        }
+    }
+}
+```
+
+`global_enforce_timeout` accepts the same human-readable duration format as the Tyk OAS field.
+
+</Tab>
+</Tabs>
+
+### Endpoint Level
+
+An endpoint-level timeout applies to a specific path and method, overriding any API-level or Gateway-level timeout for that endpoint.
+
+<Tabs>
+<Tab title="Tyk OAS">
+
+Configure `enforceTimeout` in the `operations` section of the Tyk Vendor Extension for the appropriate `operationId`:
+
+```json
+"operations": {
+    "status/200get": {
+        "enforceTimeout": {
+            "enabled": true,
+            "duration": "500ms",
+            "value": 1
+        }
+    }
+}
+```
+
+| Field | Description |
+| :---- | :---------- |
+| `enabled` | Enable the timeout for this endpoint. |
+| `duration` | Timeout duration as a human-readable string (for example `"500ms"`, `"1.5s"`, `"2m"`). Added in Tyk Gateway 5.14.0. |
+| `value` | Timeout in whole seconds. Deprecated in favor of `duration` from Tyk Gateway 5.14.0 but remains fully supported. |
+
+Tyk Dashboard automatically rounds `duration` up to the nearest whole second and stores that in `value` when the API is saved, ensuring that in a distributed (MDCB) deployment the timeout continues to be enforced on older Data Plane Gateways. Tyk Gateway 5.14.0 or later will ignore `value` and apply the more granular `duration`.
+
+</Tab>
+<Tab title="Tyk Classic">
+
+Add a `hard_timeouts` entry to the `extended_paths` section of the API definition:
+
+```json
+"extended_paths": {
+    "hard_timeouts": [
+        {
+            "path": "/status/200",
+            "method": "GET",
+            "duration": "500ms",
+            "timeout": 1
+        }
+    ]
+}
+```
+
+| Field | Description |
+| :---- | :---------- |
+| `path` | The endpoint path. |
+| `method` | The endpoint HTTP method. |
+| `duration` | Timeout duration as a human-readable string (for example `"500ms"`, `"1.5s"`, `"2m"`). Added in Tyk Gateway 5.14.0. |
+| `timeout` | Timeout in whole seconds. Deprecated in favor of `duration` from Tyk Gateway 5.14.0 but remains fully supported. |
+
+<Note>
+Unlike Tyk OAS APIs, Tyk Classic APIs do not automatically synchronize `duration` to the legacy `timeout` field. If you are running a mixed deployment with older Data Plane Gateways, you must set `timeout` manually to ensure the timeout continues to be enforced on those Gateways.
+</Note>
+
+</Tab>
+</Tabs>
+
+### Configuring the Endpoint-Level Timeout in the API Designer
+
+<Tabs>
+<Tab title="Tyk OAS">
+
+**Step 1: Add an Endpoint**
+
+From the **API Designer** add an endpoint that matches the path and method to which you want to apply the middleware.
+
+<img src="/img/dashboard/api-designer/tyk-oas-no-endpoints.png" alt="Tyk OAS API Designer showing no endpoints created" />
+
+<img src="/img/dashboard/api-designer/tyk-oas-add-endpoint.png" alt="Adding an endpoint to an API using the Tyk OAS API Designer" />
+
+<img src="/img/dashboard/api-designer/tyk-oas-no-middleware.png" alt="Tyk OAS API Designer showing no middleware enabled on endpoint" />
+
+**Step 2: Select the Enforce Timeout Middleware**
+
+Select **ADD MIDDLEWARE** and choose the **Enforce Timeout** middleware from the *Add Middleware* screen.
+
+<img src="/img/dashboard/api-designer/tyk-oas-enforce-timeout.png" alt="Adding the Enforce Timeout middleware" />
+
+**Step 3: Configure the Middleware**
+
+Set the timeout duration that you wish to enforce for requests to the endpoint.
+
+<img src="/img/dashboard/api-designer/tyk-oas-enforce-timeout-config.png" alt="Configuring the enforced timeout for the endpoint" />
+
+Select **ADD MIDDLEWARE** to apply the change to the middleware configuration.
+
+**Step 4: Save the API**
+
+Select **SAVE API** to apply the changes to your API.
+
+</Tab>
+<Tab title="Tyk Classic">
+
+**Step 1: Add an Endpoint and Select the Enforced Timeout Plugin**
+
+From the **Endpoint Designer** add an endpoint that matches the path for which you want to deploy the enforced timeout. Select the **Enforced timeout** plugin.
+
+<img src="/img/2.10/enforced_breakout.png" alt="Plugin dropdown" />
+
+**Step 2: Configure the Timeout**
+
+Enter the timeout to be enforced for the endpoint (in seconds):
+
+<img src="/img/2.10/enforced_timeouts_settings.png" alt="Enforced timeout configuration" />
+
+**Step 3: Save the API**
+
+Use the *save* or *create* buttons to save the changes and activate the middleware.
+
+</Tab>
+</Tabs>
diff --git a/planning-for-production/ensure-high-availability/graceful-shutdown.mdx b/planning-for-production/ensure-high-availability/graceful-shutdown.mdx
new file mode 100644
index 0000000000..e8a878916b
--- /dev/null
+++ b/planning-for-production/ensure-high-availability/graceful-shutdown.mdx
@@ -0,0 +1,208 @@
+---
+title: "Graceful Shutdown"
+description: "Configure graceful shutdown for Tyk Gateway and Tyk Pump to drain in-flight requests and achieve zero-downtime restarts in Kubernetes deployments."
+keywords: "graceful shutdown, deployment, stability, Gateway, Pump, data plane"
+sidebarTitle: "Graceful Shutdown"
+---
+
+## Introduction
+
+Tyk components implement **graceful shutdown** mechanisms to ensure data integrity and request completion during restarts or terminations. This feature is valuable during deployments, updates, or when you need to restart your Gateway in production environments. It helps to maintain high availability and reliability during operational changes to your API gateway infrastructure.
+
+## Tyk Gateway
+
+Tyk Gateway includes a graceful shutdown mechanism that ensures clean termination while minimizing disruption to active connections and requests. 
+
+### Configuration
+
+Add the following parameters to your configuration file (or the equivalent environment variables):
+
+```json
+{
+  "graceful_shutdown_delay_seconds": 10,
+  "graceful_shutdown_timeout_duration": 30
+}
+```
+
+| Parameter | Type | Description |
+| :----------- | :------ | :------------- |
+| [`graceful_shutdown_timeout_duration`](/tyk-oss-gateway/configuration#graceful_shutdown_timeout_duration) | integer | The number of seconds Tyk Gateway will wait for in-flight requests to complete before forcing termination. Default: 30 seconds. |
+| [`graceful_shutdown_delay_seconds`](/tyk-oss-gateway/configuration) | integer | **(From Tyk Gateway 5.14.0)** The number of seconds Tyk Gateway will continue accepting new connections after receiving a termination signal, before beginning the graceful shutdown. During this period, the `/ready` endpoint immediately returns `503 Service Unavailable`, signaling to load balancers and orchestrators to remove the Gateway from the active pool. Default: 0 seconds (disabled). |
+
+The two settings work in sequence. The total time from receiving a termination signal to process exit is at most `graceful_shutdown_delay_seconds` + `graceful_shutdown_timeout_duration`.
+
+### How It Works
+
+#### Signal Handling
+
+Tyk Gateway listens for standard termination signals:
+
+- `SIGTERM`: Sent by container orchestrators such as Kubernetes
+- `SIGQUIT`: Manual quit signal
+- `SIGINT`: Interrupt signal (Ctrl+C)
+
+<Note>
+Tyk Gateway will not shut down gracefully if it receives a `SIGKILL` signal and will stop immediately.
+</Note>
+
+#### Shutdown Sequence
+
+When a termination signal is received, Tyk Gateway:
+
+1. Immediately marks itself as shutting down. The `/ready` endpoint (the default readiness endpoint, configurable via `readiness_check_endpoint_name`) begins returning `503 Service Unavailable`.
+2. **(From Tyk Gateway 5.14.0)** If `graceful_shutdown_delay_seconds` is configured, waits for that period while continuing to accept and process new requests. This gives load balancers and orchestrators time to detect the failing readiness probe and remove the Gateway from the active pool before connections are refused.
+3. Stops accepting new connections.
+4. Waits for in-flight requests to complete, up to `graceful_shutdown_timeout_duration`.
+5. Cleans up resources (cache stores, analytics, profiling data).
+6. Deregisters from Tyk Dashboard (if using a database configuration).
+7. Disconnects from MDCB (if deployed in a distributed data plane).
+8. Logs completion and exits.
+
+```mermaid
+sequenceDiagram
+ participant OS as Operating System
+ participant LB as Load Balancer / Ingress
+ participant Gateway as Tyk Gateway
+ participant Connections as Active Connections
+ participant Dashboard as Tyk Dashboard
+ participant MDCB as MDCB
+
+ OS->>Gateway: SIGTERM/SIGINT/SIGQUIT
+ Note over Gateway: /ready returns 503 immediately
+ Gateway->>LB: Readiness probe fails
+ Note over Gateway,LB: graceful_shutdown_delay_seconds<br/>(Gateway continues to accept traffic)
+ LB->>LB: Remove Gateway from active pool
+ Note over Gateway: Delay period elapsed
+ Gateway->>Gateway: Stop accepting new connections
+
+ par Process existing connections
+ Gateway->>Connections: Wait for completion (up to graceful_shutdown_timeout_duration)
+ and Prepare resources for cleanup
+ Gateway->>Gateway: Prepare to release resources
+ end
+
+ Note over Gateway: Timeout or connections completed
+
+ Gateway->>Gateway: Clean up resources
+
+ alt Using Dashboard
+ Gateway->>Dashboard: Deregister node
+ end
+
+ alt Using MDCB
+ Gateway->>MDCB: Disconnect
+ end
+
+ Gateway->>Gateway: Log completion
+ Gateway->>OS: Process terminates
+```
+
+### Kubernetes Deployments
+
+In Kubernetes environments, a pod receiving `SIGTERM` is removed from the Service endpoints list, but the time for that change to propagate to all load balancers and ingress controllers (such as AWS ALB) varies. During this propagation window, traffic can still be routed to a pod that has already stopped accepting connections, resulting in `HTTP 502` errors.
+
+`graceful_shutdown_delay_seconds` addresses this by keeping the Gateway accepting traffic while the `/ready` probe fails, giving the load balancer time to complete deregistration before the Gateway stops accepting connections.
+
+Set `graceful_shutdown_delay_seconds` to be at least as long as it takes your load balancer to detect the failing readiness probe and stop routing traffic to the pod. This depends on your readiness probe configuration (`periodSeconds` and `failureThreshold`) and your load balancer's deregistration delay setting.
+
+For example, with a readiness probe configured as `periodSeconds: 10` and `failureThreshold: 1`, the load balancer may take up to 10 seconds to remove the pod. Setting `graceful_shutdown_delay_seconds: 15` provides a safety margin.
+
+Also ensure that Kubernetes `terminationGracePeriodSeconds` on the pod is greater than `graceful_shutdown_delay_seconds` + `graceful_shutdown_timeout_duration`, otherwise Kubernetes will send `SIGKILL` before the shutdown sequence completes.
+
+### Best Practices
+
+- Adjust the drain timeout for your workloads: If your APIs handle long-running requests, increase `graceful_shutdown_timeout_duration` accordingly.
+- Kubernetes deployments: Set `graceful_shutdown_delay_seconds` to exceed your load balancer's deregistration detection time, and ensure `terminationGracePeriodSeconds` is greater than `graceful_shutdown_delay_seconds` + `graceful_shutdown_timeout_duration`.
+- Monitor shutdown logs: Check for timeout warnings during restarts, which may indicate you need a longer drain timeout.
+
+### Advanced Details
+
+If the drain period exceeds `graceful_shutdown_timeout_duration`, Tyk Gateway logs a warning and forcibly terminates any remaining connections. This prevents the Gateway from hanging indefinitely if connections do not close properly.
+
+The implementation uses Go's context with timeout to manage the shutdown process, ensuring that resources are properly released even in edge cases.
+
+## Tyk Pump
+
+Tyk Pump also includes a graceful shutdown mechanism that ensures clean termination while preserving analytics data integrity. Pump will wait until the current purge cycle completes before flushing the data from all Pumps that have an internal buffer. This feature is particularly important during deployments, updates, or when you need to restart your pump service in production environments.
+
+
+### Configuration
+
+The graceful shutdown behavior in Tyk Pump is primarily controlled by the [purge_delay](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#purge_delay) parameter in your Tyk Pump configuration file (or set the environment variable `TYK_PMP_PURGEDELAY`):
+
+```json
+{
+  "purge_delay": 10
+}
+```
+
+| Parameter | Type | Description |
+| :----------- | :------ | :------------- |
+| `purge_delay` | integer | The number of seconds between each purge loop execution. This also affects the graceful shutdown timing as Tyk Pump will complete the current purge cycle before shutting down. Default: 10 seconds. |
+
+### How It Works
+
+#### Signal Handling
+
+Tyk Pump listens for standard termination signals:
+
+- `SIGTERM`: Sent by container orchestrators such as Kubernetes
+- `SIGINT`: Interrupt signal (Ctrl+C)
+
+
+
+<Note>
+Tyk Pump will not shut down gracefully if it receives a `SIGKILL` signal and will stop immediately.
+</Note>
+
+
+#### Shutdown Sequence
+
+When a termination signal is received, Tyk Pump:
+
+1. Logs that shutdown has begun.
+2. Completes the current purge cycle.
+3. Processes any data already in memory.
+4. Triggers a final flush operation on all configured pumps.
+5. Closes all database and storage connections.
+6. Logs completion and exits.
+
+```mermaid
+sequenceDiagram
+ participant OS as Operating System
+ participant Pump as Tyk Pump
+ participant PurgeLoop as Purge Loop
+ participant Buffers as In-Memory Buffers
+ participant Storage as Storage Systems
+    
+ OS->>Pump: SIGTERM/SIGINT
+ Note over Pump: Begin graceful shutdown
+ Pump->>Pump: Log shutdown initiation
+    
+ alt Purge cycle in progress
+ Pump->>PurgeLoop: Wait for current cycle to complete
+ PurgeLoop->>Pump: Cycle completed
+ end
+    
+ Pump->>Buffers: Process remaining analytics data
+    
+ par Flush buffered data
+ Pump->>Storage: Flush Storage System buffer
+ end
+    
+ Pump->>Pump: Close all database connections
+ Pump->>Pump: Log completion
+ Pump->>OS: Process terminates
+```
+
+These pumps buffer data in-memory before sending the data to the storage and so will flush out those data before the connection is closed:
+- `ElasticSearch`
+- `dogstatd`
+- `Influx2`
+
+### Best Practices
+
+- Adjust `purge_delay` for your workloads: A shorter purge delay means more frequent processing but also faster shutdown. For high-volume environments, finding the right balance is important.
+- Configure orchestration platforms: When using Kubernetes, ensure pod termination grace periods are sufficient to allow for at least one complete purge cycle.
+- Monitor shutdown logs: Check for any warnings during restarts that might indicate data processing issues.
+- Consider redundant instances: For high-availability environments, run multiple Tyk Pump instances to ensure continuous analytics processing.
diff --git a/planning-for-production/ensure-high-availability/health-check.mdx b/planning-for-production/ensure-high-availability/health-check.mdx
new file mode 100644
index 0000000000..715c0c4133
--- /dev/null
+++ b/planning-for-production/ensure-high-availability/health-check.mdx
@@ -0,0 +1,243 @@
+---
+title: "Liveness Health Checks"
+description: "How to set up liveness health checks for the Tyk Gateway to ensure high availability and monitor the status of components like Redis, Dashboard, and RPC."
+sidebarTitle: "Health Checks"
+---
+
+## Set Up Liveness Health Checks
+
+Health checks are extremely important in determining the status of an
+application - in this instance, the Tyk Gateway. Without them, it can be hard to
+know the actual state of the Gateway.
+
+Depending on your configuration, the Gateway could be using a few components:
+
+- The Tyk Dashboard.
+- RPC
+- Redis (compulsory).
+
+Any of these components could go down at any given point and it is useful to
+know if the Gateway is currently usable or not. A good usage of the health
+check endpoint is for the configuration of a load balancer to multiple instances of the Gateway or
+as a Kubernetes liveness probe.
+
+The following component status will not be returned:
+
+* MongDB or SQL
+* Tyk Pump
+
+
+
+    <Note>
+    Health check is implemented as per the [Health Check Response Format for HTTP APIs](https://inadarei.github.io/rfc-healthcheck/) RFC
+    </Note>
+
+
+An example of the response from this API is as follows:
+
+
+```yaml
+{
+  "status": "pass",
+  "version": "v3.1.1",
+  "description": "Tyk GW",
+  "details": {
+    "redis": {
+      "status": "pass",
+      "componentType": "datastore",
+      "time": "2020-05-19T03:42:55+01:00"
+    },
+    "dashboard": {
+      "status": "pass",
+      "componentType": "system",
+      "time": "2020-05-19T03:42:55+01:00"
+    },
+    "rpc": {
+      "status": "pass",
+      "componentType": "system",
+      "time": "2020-05-19T03:42:55+01:00"
+    }
+  }
+}
+```
+
+## Status Levels
+
+The following status levels can be returned in the JSON response.
+
+- **pass**: Indicates that all components required for the Gateway to work 100% are available, and there is no impact on your traffic.
+
+- **warn**: Indicates that one of the components is having an outage but your Gateway is able to keep processing traffic. The impact is medium (i.e. no quotas are applied, no analytics, no RPC connection to MDCB).
+
+- **fail**: Indicates that Redis AND the Tyk Dashboard are unavailable, and can and indicate other failures. The impact is high (i.e. no configuration changes are available for API/policies/keys, no quotas are applied, and no analytics).
+
+## Configure health check
+
+By default, the liveness health check runs on the `/hello` path. But
+it can be configured to run on any path you want to set. For example:
+
+
+```yaml
+health_check_endpoint_name: "status"
+```
+
+This configures the health check to run on `/status` instead of `/hello`.
+
+**Refresh Interval**
+
+The Health check endpoint will refresh every 10 seconds.
+
+**HTTP error code**
+The Health check endpoint will always return a `HTTP 200 OK` response if the polled health check endpoint is available on your Tyk Gateway. If `HTTP 200 OK` is not returned, your Tyk Gateway is in an error state.
+
+
+For MDCB installations the `/hello` endpoint can be polled in either your Management or Worker Gateways. It is recommended to use the `/hello` endpoint behind a load balancer for HA purposes.
+
+## Health check examples
+
+The following examples show how the Health check endpoint returns
+
+
+### Pass Status
+
+The following is returned for a `pass` status level for the Open Source Gateway:
+
+```
+$ http :8080/hello
+HTTP/1.1 200 OK
+Content-Length: 156
+Content-Type: application/json
+Date: Wed, 14 Apr 2021 17:36:09 GMT
+
+{
+  "description": "Tyk GW",
+  "details": {
+    "redis": {
+      "componentType": "datastore",
+      "status": "pass",
+      "time": "2021-04-14T17:36:03Z"
+    }
+  },
+  "status": "pass",
+  "version": "v3.1.1"
+}
+```
+
+### Redis outage
+
+```
+$ http :8080/hello
+HTTP/1.1 200 OK
+Content-Length: 303
+Content-Type: application/json
+Date: Wed, 14 Apr 2021 14:58:06 GMT
+
+{
+  "description": "Tyk GW",
+  "details": {
+    "dashboard": {
+      "componentType": "system",
+      "status": "pass",
+      "time": "2021-04-14T14:58:03Z"
+    },
+    "redis": {
+      "componentType": "datastore",
+      "output": "storage: Redis is either down or was not configured",
+      "status": "fail",
+      "time": "2021-04-14T14:58:03Z"
+    }
+  },
+  "status": "warn",
+  "version": "v3.1.2"
+}
+```
+
+### Dashboard outage
+
+```
+$ http :8080/hello
+HTTP/1.1 200 OK
+Content-Length: 292
+Content-Type: application/json
+Date: Wed, 14 Apr 2021 15:52:47 GMT
+
+{
+  "description": "Tyk GW",
+  "details": {
+    "dashboard": {
+      "componentType": "system",
+      "output": "dashboard is down? Heartbeat is failing",
+      "status": "fail",
+      "time": "2021-04-14T15:52:43Z"
+    },
+    "redis": {
+      "componentType": "datastore",
+      "status": "pass",
+      "time": "2021-04-14T15:52:43Z"
+    }
+  },
+  "status": "warn",
+  "version": "v3.1.2"
+}
+```
+### Dashboard and Redis outage
+
+```
+$ http :8080/hello
+HTTP/1.1 200 OK
+Content-Length: 354
+Content-Type: application/json
+Date: Wed, 14 Apr 2021 17:53:33 GMT
+
+{
+  "description": "Tyk GW",
+  "details": {
+    "dashboard": {
+      "componentType": "system",
+      "output": "dashboard is down? Heartbeat is failing",
+      "status": "fail",
+      "time": "2021-04-14T17:53:33Z"
+    },
+    "redis": {
+      "componentType": "datastore",
+      "output": "storage: Redis is either down or was not configured",
+      "status": "fail",
+      "time": "2021-04-14T17:53:33Z"
+    }
+  },
+  "status": "fail",
+  "version": "v3.1.2"
+}
+```
+
+
+### MDCB Worker Gateway RPC outage
+
+```
+$  http :8080/hello
+HTTP/1.1 200 OK
+Content-Length: 333
+Content-Type: application/json
+Date: Wed, 14 Apr 2021 17:21:24 GMT
+
+{
+  "description": "Tyk GW",
+  "details": {
+    "redis": {
+      "componentType": "datastore",
+      "output": "storage: Redis is either down or was not configured",
+      "status": "fail",
+      "time": "2021-04-14T17:21:16Z"
+    },
+    "rpc": {
+      "componentType": "system",
+      "output": "Could not connect to RPC",
+      "status": "fail",
+      "time": "2021-04-14T17:21:16Z"
+    }
+  },
+  "status": "fail",
+  "version": "v3.1.2"
+}
+```
+
diff --git a/planning-for-production/ensure-high-availability/load-balancing.mdx b/planning-for-production/ensure-high-availability/load-balancing.mdx
new file mode 100644
index 0000000000..16ded6ad94
--- /dev/null
+++ b/planning-for-production/ensure-high-availability/load-balancing.mdx
@@ -0,0 +1,130 @@
+---
+title: "Request Forwarding"
+description: "Learn how Tyk Gateway forwards matched requests to upstream services, including load balancing, service discovery, and protocol-specific configuration"
+keywords: "upstream target, target URL, load balancing, service discovery, gRPC, TCP, HTTP/2, strip listen path, request forwarding"
+sidebarTitle: "Request Forwarding"
+---
+
+Once Tyk Gateway has [matched](/getting-started/key-concepts/url-matching) an incoming request to an API definition and endpoint, it passes the request through the configured middleware chain before forwarding it to the upstream service. This page covers how Tyk resolves the upstream target, how it handles the request path, and how forwarding behavior differs by protocol.
+
+## The Upstream Target
+
+Each API definition includes an upstream *target URL*. Tyk Gateway replaces its own hostname with this URL when forwarding the request.
+
+- **Tyk OAS:** the upstream target is configured in the `upstream` section of the Tyk Vendor Extension. See [Upstream](/api-management/gateway-config-tyk-oas#upstream).
+- **Tyk Classic:** the upstream target is the `proxy.target_url` field in the API definition.
+
+By default, Tyk appends the full request path to the upstream URL. The [strip listen path](/api-management/gateway-config-tyk-oas#listenpath) option removes the listen path prefix from the forwarded path, so the upstream receives only the endpoint path. This is the most common configuration when Tyk presents a different URL structure to clients than the upstream expects - for example, when placing a clean public facade over a legacy service.
+
+For example, given a *Users API* configured with:
+- [`upstream.url`](/api-management/gateway-config-tyk-oas#upstream): `http://acme.service.com/user-service`
+- [`server.listenPath.value`](/api-management/gateway-config-tyk-oas#listenpath): `/users`
+- an endpoint `GET /{id}/profile`
+- hosted on a Tyk Gateway with the domain `acme-gateway.com`
+
+A client request to `GET http://acme-gateway.com/users/1234/profile` is matched to the *Users API* and forwarded to the upstream depending on [`server.listenPath.strip`](/api-management/gateway-config-tyk-oas#listenpath):
+- `true`: forwarded to `http://acme.service.com/user-service/1234/profile`
+- `false`: forwarded to `http://acme.service.com/user-service/users/1234/profile`
+
+## Load Balancing
+
+Tyk supports round-robin load balancing across multiple upstream targets. When load balancing is enabled, Tyk rotates requests through the configured target list on each incoming request. Targets can be weighted so that traffic is distributed in a controlled ratio - for example, directing 90% of traffic to a production environment and 10% to a beta environment.
+
+### Configuration
+
+Configure targets and set weights in the `upstream.loadBalancing` section of the Tyk Vendor Extension:
+
+```yaml
+x-tyk-api-gateway:
+  upstream:
+    loadBalancing:
+      enabled: true
+      targets:
+        - url: "http://10.0.0.1"
+          weight: 9
+        - url: "http://10.0.0.2"
+          weight: 1
+```
+
+Weight values are relative: a target with weight `9` receives nine times as many requests as a target with weight `1`. There is no upper limit on weight values. Weight must be specified for each target - if omitted it defaults to `0`, which excludes the target from the rotation.
+
+<Note>
+Setting a weight of `0` will skip that target; this is useful if you need to remove a target from the load balancing temporarily.
+</Note>
+
+If using Tyk Classic, enable load balancing with `proxy.enable_load_balancing: true` and list the target URLs in `proxy.target_list`:
+
+```json
+"proxy": {
+  "enable_load_balancing": true,
+  "target_list": [
+    "http://10.0.0.1",
+    "http://10.0.0.2",
+    "http://10.0.0.3"
+  ]
+}
+```
+
+Each entry in the `proxy.target_list` will be addressed in turn. To increase the weighting for a target, you must include it multiple times in the list.
+
+### Skipping Unavailable Hosts
+
+Tyk Gateway's uptime tests periodically probe each upstream target and automatically remove failing hosts from the load balancing rotation, so requests are only sent to healthy targets.
+
+Set `upstream.loadBalancing.skipUnavailableHosts: true` in Tyk OAS, or `proxy.check_host_against_uptime_tests: true` in Tyk Classic.
+
+See [Uptime Tests](/planning-for-production/ensure-high-availability/uptime-tests) for more details and how to configure the probes.
+
+## Service Discovery
+
+Rather than a static upstream URL, Tyk can query a service discovery endpoint - such as Consul, etcd, or Eureka - to resolve the current upstream target at request time. This is useful when upstream services are scaled dynamically and their addresses change. The service discovery endpoint returns a list of addresses that Tyk uses as its load balancing target list.
+
+The static upstream URL (`upstream.url` in Tyk OAS, `proxy.target_url` in Tyk Classic) is still required in the API definition. If the service discovery query fails, Tyk falls back to the static URL.
+
+See [Service Discovery](/planning-for-production/ensure-high-availability/service-discovery) for details of how to configure the service discovery feature.
+
+## Upstream TLS
+
+When forwarding to an HTTPS upstream, Tyk Gateway verifies the server's certificate against the system trust store on the host running the Gateway. For upstreams using self-signed or internally issued certificates, add the issuing CA certificate to that trust store.
+
+When the upstream requires mutual TLS (mTLS), Tyk must also present a client certificate during the TLS handshake. Certificates are mapped to upstream domains in the API definition or at the Gateway level, so different client certificates can be used for different upstream hosts within the same API.
+
+For defense against compromised certificate authorities, [certificate pinning](/api-management/upstream-authentication/mtls#certificate-pinning) restricts which public keys Tyk will accept from a given upstream domain, regardless of what a CA has signed.
+
+For non-production environments where the upstream certificate cannot be trusted (such as local development), the `upstream.tlsTransport.insecureSkipVerify` option in the API definition (Tyk Classic: `proxy.transport.ssl_insecure_skip_verify`) disables upstream certificate verification for that API. This should never be enabled in production.
+
+See [Upstream Mutual TLS](/api-management/upstream-authentication/mtls) for full configuration detail.
+
+## gRPC Forwarding
+
+gRPC is an RPC framework that uses HTTP/2 as its transport protocol. Tyk supports gRPC passthrough proxying, including all streaming modes.
+
+gRPC requests follow the path format `/{ServiceName}/{MethodName}`. This path must reach the upstream unchanged, so **strip listen path must be set to `false`** in the API definition.
+
+The upstream target URL format depends on whether the upstream gRPC server requires TLS.
+
+**Secure gRPC (TLS)**
+
+Set the upstream target to an `https://` URL:
+
+```
+upstream.url: "https://my-grpc-server:50051"
+```
+
+**Insecure gRPC (H2C)**
+
+H2C is the non-TLS form of HTTP/2. Prefix the upstream target URL with `h2c://`:
+
+```
+upstream.url: "h2c://my-grpc-server:50051"
+```
+
+The same URL scheme applies when configuring multiple targets for gRPC load balancing.
+
+Tyk Gateway's load balancing, service discovery, and mutual TLS all work with gRPC APIs in the same way as for HTTP APIs. See [gRPC Proxy](/key-concepts/grpc-proxy) for full details on how to configure this feature.
+
+## TCP Forwarding
+
+Tyk can forward raw TCP traffic, acting as a transparent proxy for non-HTTP services such as databases or services using custom binary protocols. Set the upstream target URL scheme to `tcp://` for a plain TCP upstream or `tls://` for a TLS-secured upstream.
+
+See [TCP Proxy](/key-concepts/tcp-proxy) for full configuration detail, including port assignment, SNI-based routing, and health checks.
diff --git a/planning-for-production/ensure-high-availability/service-discovery.mdx b/planning-for-production/ensure-high-availability/service-discovery.mdx
new file mode 100644
index 0000000000..e01c5c921a
--- /dev/null
+++ b/planning-for-production/ensure-high-availability/service-discovery.mdx
@@ -0,0 +1,285 @@
+---
+title: "Service Discovery"
+description: "How to configure service discovery in Tyk"
+sidebarTitle: "Service Discovery"
+---
+
+## Introduction
+
+Service Discovery is a very useful feature for when you have a dynamically changing upstream service set.
+
+For example, you have ten Docker containers that are running the same service, and you are load balancing between them, if one or more fail, a new service will spawn but probably on a different IP address.
+
+Now the Gateway would need to either be manually reconfigured, or, more appropriately, detect the failure and reconfigure itself.
+
+This is what the service discovery module does.
+
+We recommend using the SD module in conjunction with the circuit breaker features, as this makes detection and discovery of failures at the gateway level much more dynamic and responsive.
+
+## Service Discovery: Dashboard
+
+The Service Discovery settings are located in the Core tab from the API Designer.
+
+<img src="/img/2.10/service_discovery_settings.png" alt="Service discovery" />
+
+**Configuring Service Discovery via the Dashboard**
+
+Select **Enable service discovery** to enable the discovery module.
+
+Once enabled, you will have all the options to configure your Service Discovery endpoints:
+
+<img src="/img/2.10/service_discovery_settings2.png" alt="Service discovery configuration" />
+
+The settings are as follows:
+
+*   **Service discovery options**: New Functionality
+
+*   **Query endpoint**: The endpoint to call, this would probably be your Consul, etcd or Eureka K/V store.
+
+*   **Target path**: Use this setting to set a target path to append to the discovered endpoint, since many SD services only provide host and port data, it is important to be able to target a specific resource on that host, setting this value will enable that.
+
+*   **Data path**: The namespace of the data path, so for example if your service responds with:
+
+```
+{ 
+  "action": "get", 
+  "node": { 
+    "key": "/services/single", 
+    "value": "http://httpbin.org:6000", 
+    "modifiedIndex": 6, 
+    "createdIndex": 6 
+  } 
+}
+```
+    
+    Then your namespace would be `node.value`.
+
+*   **Are the values nested?**: Sometimes the data you are retrieving is nested in another JSON object, e.g. this is how etcd responds with a JSON object as a value key:
+
+```
+{
+  "action": "get",
+  "node": {
+    "key": "/services/single",
+    "value": "{"hostname": "http://httpbin.org", "port": "80"}",
+    "modifiedIndex": 6,
+    "createdIndex": 6
+  }
+}
+```
+    
+In this case, the data actually lives within this string-encoded JSON object, so in this case, you set the value to `checked`, and use a combination of the **data path** and **parent data path** (below).
+
+*   **Parent data path**: This is the namespace of the where to find the nested value, in the above example, it would be `node.value`. You would then change the **data path** setting to be `hostname`, since this is where the hostname data resides in the JSON string. Tyk automatically assumes that the data_path in this case is in a string-encoded JSON object and will try to deserialise it.
+    
+Tyk will decode the JSON string and then apply the **data path** namespace to that object in order to find the value.
+
+*   **Port data path**: In the above nested example, we can see that there is a separate `port` value for the service in the nested JSON. In this case you can set the **port data path** value and Tyk will treat **data path** as the hostname and zip them together (this assumes that the hostname element does not end in a slash or resource identifier such as `/widgets/`).
+    
+In the above example, the **port data path** would be `port`.
+
+*  **Is port information separate from the hostname?**: New Functionality
+
+*   **Does the endpoint provide a target list?**: If you are using load balancing, set this value to true and Tyk will treat the data path as a list and inject it into the target list of your API Definition.
+
+*   **Cache timeout**: Tyk caches target data from a discovery service, in order to make this dynamic you can set a cache value when the data expires and new data is loaded. Setting it too low will cause Tyk to call the SD service too often, setting it too high could mean that failures are not recovered from quickly enough.
+
+
+## Service Discovery Config: API Definition
+
+Service discovery is configured on a per-API basis, and is set up in the API Object under the `proxy` section of your API Definition:
+
+```yaml
+enable_load_balancing: true,
+service_discovery: {
+  use_discovery_service: true,
+  query_endpoint: "http://127.0.0.1:4001/v2/keys/services/multiobj",
+  use_nested_query: true,
+  parent_data_path: "node.value",
+  data_path: "array.hostname",
+  port_data_path: "array.port",
+  use_target_list: true,
+  cache_timeout: 10,
+  target_path: "/append-this-api-path/"
+},
+```
+
+Settings are as follows:
+
+*   `service_discovery.use_discovery_service`: Set this to `true` to enable the discovery module.
+*   `service_discovery.query_endpoint`: The endpoint to call, this would probably be your Consul, etcd or Eureka K/V store.
+*   `service_discovery.data_path`: The namespace of the data path so, for example, if your service responds with:
+
+```
+{
+  "action": "get",
+  "node": {
+    "key": "/services/single",
+    "value": "http://httpbin.org:6000",
+    "modifiedIndex": 6,
+    "createdIndex": 6
+  }
+}
+```
+    
+Then your namespace would be `node.value`.
+
+*   `service_discovery.use_nested_query`: Sometimes the data you are retrieving is nested in another JSON object, e.g. this is how etcd responds with a JSON object as a value key:
+
+```
+{
+  "action": "get",
+  "node": {
+    "key": "/services/single",
+    "value": "{"hostname": "http://httpbin.org", "port": "80"}",
+    "modifiedIndex": 6,
+    "createdIndex": 6
+  }
+}
+```
+In this case, the data actually lives within this string-encoded JSON object, so in this case, you set the `use_nested_query` to `true`, and use a combination of the `data_path` and `parent_data_path` (below)
+
+*   `service_discovery.parent_data_path`: This is the namespace of the where to find the nested value, in the above example, it would be `node.value`. You would then change the `data_path` setting to be `hostname`, since this is where the host name data resides in the JSON string. Tyk automatically assumes that the `data_path` in this case is in a string-encoded JSON object and will try to deserialise it.
+    
+Tyk will decode the JSON string and then apply the `data_path` namespace to that object in order to find the value.
+
+*   `service_discovery.port_data_path`: In the above nested example, we can see that there is a separate `port` value for the service in the nested JSON. In this case you can set the `port_data_path` value and Tyk will treat `data_path` as the hostname and zip them together (this assumes that the hostname element does not end in a slash or resource identifier such as `/widgets/`).
+    
+In the above example, the `port_data_path` would be `port`.
+
+*   `service_discovery.use_target_list`: If you are using load balancing, set this value to `true` and Tyk will treat the data path as a list and inject it into the target list of your API Definition.
+
+*   `service_discovery.cache_timeout`: Tyk caches target data from a discovery service, in order to make this dynamic you can set a cache value when the data expires and new data is loaded. Setting it too low will cause Tyk to call the SD service too often, setting it too high could mean that failures are not recovered from quickly enough.
+
+*   `service_discovery.target_path`: Use this setting to set a target path to append to the discovered endpoint, since many SD services only provide host and port data, it is important to be able to target a specific resource on that host, setting this value will enable that.
+
+## Service Discovery Examples
+
+**Mesosphere Example**
+
+For integrating service discovery with Mesosphere, you can use the following configuration parameters:
+
+```yaml
+  isNested = false
+  isTargetList = true
+  endpointReturnsList = false
+  portSeperate = true
+  dataPath = "host"
+  parentPath = "tasks"
+  portPath = "ports"
+```
+
+**Eureka Example**
+
+For integrating service discovery with Eureka, you can use the following configuration parameters (this assumes that the endpoint will return JSON and not XML, this is achieved by creating an API Definition that injects the header that requests the data type and using this API Definition as the endpoint):
+
+```yaml
+  isNested = false
+  isTargetList = true
+  endpointReturnsList = false
+  portSeperate = true
+  dataPath = "hostName"
+  parentPath = "application.instance"
+  portPath = "port.$"
+```
+
+**Etcd Example**
+
+For integrating with etcd, you can use the following configurations:
+
+```yaml
+  isNested = false
+  isTargetList = false
+  endpointReturnsList = false
+  portSeperate = false
+  dataPath = "node.value"
+  parentPath = ""
+  portPath = ""
+```
+
+**Zookeeper Example**
+
+For this, you need to spin up a REST server that communicates with the Zookeeper instance.
+Here is one open source project, ZooREST, that does just that: https://github.com/Difrex/zoorest
+
+With Zookeeper and ZooREST running, test the query endpoint. Don't forget the `+json`:
+```curl
+$ curl http://zoorest:8889/v1/get/zk_tyk+json
+{
+  "data": {
+      "path": "httpbin.org"
+  },
+  "error": "",
+  "path": "/zk_tyk",
+  "state": "OK",
+  "zkstat": {}
+}
+```
+
+Then, you can use the following Tyk SD configurations:
+```yaml
+  isNested = false
+  isTargetList = false
+  endpointReturnsList = false
+  portSeperate = false
+  dataPath = "data.path"
+  parentPath = ""
+  portPath = ""
+```
+
+**Consul Example**
+
+For integrating service discovery with Consul, you can use the following configuration parameters:
+
+```yaml
+  isNested = false
+  isTargetList = true
+  endpointReturnsList = true
+  portSeperate = true
+  dataPath = "Address"
+  parentPath = ""
+  portPath = "ServicePort"
+```
+
+**Linkerd Example**
+
+
+<Note>
+This configuration is a Tyk Community Contribution.
+</Note>
+
+
+To integrate Tyk with Linkerd perform the following:
+
+**Configure Linkerd**
+
+To integrate with Linkerd, you need to add the following configuration to your `linkerd.yaml` file, located in the `config/` directory:
+
+```yaml
+  routers:
+  - protocol: http
+    identifier:
+      kind: io.l5d.header.token
+      header: Custom-Header
+```
+
+Then, in your Tyk Dashboard:
+
+1. Select your API from the **System Management > APIs** section and click **Edit**.
+
+2. From the **Core Settings** tab, set the **Target URL** to the Linkerd HTTP server `host:port` address.
+
+3. From the **Endpoint Designer** tab click **Global Version Settings** and enter `Custom-Header` in the **Add this header**: field and the value of the Linkerd `app-id` in the **Header value** field.
+
+4. Click **Update** to save your changes.
+
+This is needed since Tyk appends a "Host" header when proxying the request and the "Host" header is also the default header expected by Linkerd.
+
+**For further Linkerd information, see:**
+
+[Linkerd - HTTP proxy documentation](https://linkerd.io/2-edge/reference/proxy-configuration/) (Alternatives Section)
+
+[Linkered - Header Token Identifier documentation](https://linkerd.io/config/0.9.1/linkerd/index.html#header-token-identifier)
+
+[The original Community Contribution](https://community.tyk.io/t/using-tyk-gateway-with-linkerd/1568)
+
diff --git a/planning-for-production/ensure-high-availability/uptime-tests.mdx b/planning-for-production/ensure-high-availability/uptime-tests.mdx
new file mode 100644
index 0000000000..f84c53a8d0
--- /dev/null
+++ b/planning-for-production/ensure-high-availability/uptime-tests.mdx
@@ -0,0 +1,267 @@
+---
+title: "Uptime Tests"
+description: "How to configure uptime tests"
+sidebarTitle: "Uptime Tests"
+---
+
+## Introduction
+
+Tyk Gateway has built-in "uptime awareness" of the upstream services it proxies to, by actively polling user-defined endpoints at set intervals.
+
+This isn't meant to replace traditional uptime monitoring tools; it's designed to supplement them, letting Tyk Gateway bypass unhealthy upstream hosts as part of its own request routing.
+
+### Compatibility
+
+Uptime tests are only available for Tyk Self-Managed users. It is not available on Tyk Cloud.
+
+### How Uptime Tests Work
+
+When uptime tests are configured in a Tyk Gateway cluster, a single Gateway elects itself as primary, using a key held in Redis as a dead man's switch: the primary keeps that key alive, and if it stops or fails, another Gateway detects the gap and elects itself instead. Only the primary Gateway actually runs the uptime tests for the cluster (or shard group, if you're using `poller_group`).
+
+The primary Gateway runs tests from a worker pool, executing them simultaneously on a configurable interval. Depending on how many uptime tests you're running, increase or decrease the pool size as needed.
+
+## Initial Configuration
+
+Add an `uptime_tests` section to `tyk.conf`:
+
+```json
+{
+  "uptime_tests": {
+    "disable": false,
+    "poller_group": "",
+    "config": {
+      "enable_uptime_analytics": true,
+      "failure_trigger_sample_size": 3,
+      "time_wait": 300,
+      "checker_pool_size": 50
+    }
+  }
+}
+```
+
+| Field | Description |
+| :-- | :-- |
+| `disable` | If `true`, disables uptime tests on this Gateway node entirely. Useful if you want to run uptime tests only on a dedicated group of Gateway instances. |
+| `poller_group` | Groups Gateways that share the same set of uptime tests. All Gateways with the same `poller_group` are candidates to become the primary for that group; useful if you're running uptime tests across a sharded or segmented cluster. |
+| `config.enable_uptime_analytics` | If `true`, records the results of uptime tests so they can be viewed in Tyk Dashboard. Since uptime tests run continuously, this can generate a lot of data; disable it if you don't need to review results, or see [Monitoring Uptime Tests in Tyk Dashboard](#monitoring-uptime-tests-in-tyk-dashboard) to manage the volume instead. |
+| `config.failure_trigger_sample_size` | Number of consecutive passes or failures required before Tyk Gateway fires a `HostDown` or `HostUp` event. Higher values protect against false positives, at the cost of a slower reaction time. |
+| `config.time_wait` | Seconds between test runs. |
+| `config.checker_pool_size` | Number of idle workers kept in memory to run tests concurrently. |
+
+## Configure with the API Definition
+
+Uptime tests are defined per API, so add an `uptime_tests` section to that API's definition:
+
+```json
+{
+  "uptime_tests": {
+    "check_list": [
+      {
+        "url": "http://internal-service.local/"
+      },
+      {
+        "url": "http://internal-service.local/health",
+        "method": "POST",
+        "headers": {
+          "X-Custom-Header": "value"
+        },
+        "body": "eyJmb28iOiAiYmFyIn0=",
+        "timeout": 1000
+      }
+    ]
+  }
+}
+```
+
+Uptime tests are not versioned. Each entry in `check_list` accepts:
+
+| Field | Description |
+| :-- | :-- |
+| `url` | The endpoint to poll. With no other fields set, this is a quick-form GET request. |
+| `method` | HTTP method to use, for a full-form check. |
+| `headers` | Headers to send with the request. |
+| `body` | Request body, base64-encoded. |
+| `timeout` | Request timeout, in milliseconds. |
+
+## Configure with the Dashboard
+
+To add an uptime test using the Dashboard, make sure you've completed the [Gateway configuration](#initial-configuration) first, then:
+
+**Step 1: Select the Uptime Tests tab**
+
+From the API Designer, select the **Uptime Tests** tab:
+
+<img src="/img/2.10/uptime_tests.png" alt="Uptime tests tab location" />
+
+**Step 2: Click Add**
+
+Click **Add** to add a test:
+
+<img src="/img/2.10/uptime_test_add.png" alt="Add button location" />
+
+**Step 3: Enter Path Details**
+
+From the **Path Details** pop-up, complete the details and click **Add** to add the test:
+
+<img src="/img/2.10/uptime_test_path_details.png" alt="Test details form and add button location" />
+
+## Monitoring Uptime Tests in Tyk Dashboard
+
+Everything above already works on its own: Tyk Gateway detects unhealthy upstream hosts, bypasses them, and fires `HostUp`/`HostDown` events. But none of that is visible in Tyk Dashboard by default. What this section adds is exactly that visibility: a way to see and review uptime test results yourself, rather than relying solely on those events.
+
+To get that visibility, Tyk Dashboard needs the results somewhere it can query them.
+
+If `config.enable_uptime_analytics` is set to `true` then each time Tyk Gateway runs an uptime test, it generates a log containing: the tested URL, the response time, and either the HTTP status code returned or a flag marking a TCP-level or server-level failure, timestamped and tagged with the API and Organisation it belongs to. This result is written to Redis, under its own key, separate from the regular [traffic logs](/api-management/dashboard-analytics#what-data-is-captured) generated for API traffic.
+
+Redis is not intended for long time storage so, as with traffic logs, [Tyk Pump](/api-management/tyk-pump) should be configured to transfer the logs to the persistent storage in the Control Plane, from which they can be accessed by Tyk Dashboard.
+
+Which persistent storage you are using, MongoDB or SQL, determines what is stored:
+
+- for MongoDB, the Uptime Pump stores each test log as a separate document in the collection
+- for SQL, the Uptime Pump aggregates the test results per hour, broken down by URL and response code (hit counts, successes, error counts, average response time), prior to storage in the table
+
+### Combined vs Distributed Deployments
+
+In a combined control and data plane, this works as described above: Tyk Pump reads from the shared Redis and writes directly to persistent storage.
+
+In a distributed deployment, with separate control and data planes connected via Tyk MDCB, uptime test results are handled differently from regular traffic logs and aggregated analytics: they never flow through the Hybrid Pump or Tyk MDCB. Each data plane elects its own primary Gateway and runs its own uptime tests against its own upstream hosts, and results are written only to that data plane's local Redis.
+
+To get this data into Tyk Dashboard, run a Tyk Pump instance directly on each data plane, with an Uptime Pump collecting from that data plane's local Redis, configured to write to a MongoDB or SQL store that Tyk Dashboard, on the control plane, can also reach. This is the same pattern used for [External Data Sink Pumps](/api-management/logs/external-data-sinks#combined-vs-distributed-deployments) running on a data plane.
+
+### Common Configuration
+
+The Uptime Pump is configured through its own `uptime_pump_config` object, at the top level of `pump.conf`, entirely separate from the `pumps` map used for every other pump type. Unlike those pumps, it doesn't accept the [common pump settings](/api-management/tyk-pump#common-pump-settings) such as `filters` or `timeout`: Tyk Pump writes every uptime test result it receives, unconditionally.
+
+```json
+{
+  "uptime_pump_config": {
+    "uptime_type": "mongo"
+  },
+  "dont_purge_uptime_data": false,
+  ...
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `uptime_type` | `mongo` | `mongo` or `sql`. Determines which of the two sections below applies. |
+| `dont_purge_uptime_data` | `false` | Set to true if no uptime pump is configured. |
+
+<Warning>
+If `dont_purge_uptime_data: false`, Tyk Pump tries to start an Uptime Pump on startup regardless of whether you've configured a real `uptime_pump_config` target. It attempts to connect to a persistent store using whatever connection string is present in the `uptime_pump_config`, empty or otherwise.
+
+**If that connection fails, Tyk Pump exits immediately**, taking down every other pump in that instance too, not just the uptime one.
+
+**Set `dont_purge_uptime_data: true` if you're not using the Uptime Pump.**
+</Warning>
+
+
+### MongoDB
+
+By default, the Uptime Pump uses the same implementation as the [Standard Mongo Pump](/api-management/dashboard-analytics/control-plane-pumps#standard-mongo-pump), storing every individual test result as a separate document in one collection.
+
+It accepts the same [Common Mongo Meta](/api-management/dashboard-analytics/control-plane-pumps#common-mongo-meta) as every other Mongo pump, plus these fields, identical to the Standard Mongo Pump's own:
+
+```json
+{
+  "uptime_pump_config": {
+    "collection_name": "tyk_uptime_analytics",
+    "mongo_url": "mongodb://tyk-mongo:27017/tyk_analytics",
+    "max_insert_batch_size_bytes": 10485760,
+    "max_document_size_bytes": 10485760,
+    "collection_cap_enable": false,
+    "collection_cap_max_size_bytes": 5368709120,
+    ...
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `collection_name` | `tyk_uptime_analytics` | The MongoDB collection uptime results are written to. |
+| `mongo_url` | - | MongoDB connection URL. **Required.** |
+| `max_insert_batch_size_bytes` | 10MB | Maximum size of a single insert batch (in bytes); larger batches are split into multiple inserts. |
+| `max_document_size_bytes` | 10MB | Maximum document size (in bytes); documents that would exceed this are skipped rather than written. |
+| `collection_cap_enable` | `false` | If `true`, caps the collection at `collection_cap_max_size_bytes`, turning it into a FIFO buffer. See [Analytics Storage Management](/api-management/dashboard-analytics/analytics-storage-management). |
+| `collection_cap_max_size_bytes` | 5GB | Maximum collection size, in bytes, when `collection_cap_enable` is `true`. |
+
+Because this collection grows with every uptime test, it [should be capped](/api-management/dashboard-analytics/analytics-storage-management).
+
+### SQL
+
+The SQL Uptime Pump generates aggregated data from the uptime test logs, storing them in a table called `tyk_uptime_analytics`, or one table per day if `table_sharding` is enabled (see [Table Sharding](/api-management/dashboard-analytics/analytics-storage-management#table-sharding)).
+
+Set `uptime_type` to `sql` in `uptime_pump_config` to use the SQL Uptime Pump. It accepts the same [Common SQL Meta](/api-management/dashboard-analytics/control-plane-pumps#common-sql-meta) as every other SQL pump.
+
+```json
+{
+  "uptime_pump_config": {
+    "uptime_type": "sql",
+    "type": "postgres",
+    "connection_string": "host=sql_host port=sql_port user=sql_usr dbname=dbname password=sql_pw",
+    "table_sharding": false,
+    ...
+  }
+}
+```
+
+| Field | Default | Description |
+| :-- | :-- | :-- |
+| `uptime_type` | `mongo` | Set to `sql` to use the SQL Uptime Pump. |
+| `type` | - | `postgres` or `mysql`. |
+| `connection_string` | - | Database connection string. **Required.** |
+| `table_sharding` | `false` | If `true`, stores records in one table per day instead of a single table. Must match `storage.uptime.table_sharding` in the Tyk Dashboard configuration below. |
+
+
+### Tyk Dashboard Configuration
+
+In the Tyk Dashboard configuration, set `storage.uptime` to match wherever you've configured the Uptime Pump to write, so that results can be viewed under **Monitoring > Service Uptime** and **Monitoring > Uptime Targets** in Tyk Dashboard.
+
+For MongoDB:
+
+```json
+{
+  "storage": {
+    "uptime": {
+      "type": "mongo",
+      "mongo_url": "mongodb://username:password@{hostname:port}/{db_name}"
+    }
+  }
+}
+```
+
+For SQL:
+
+```json
+{
+  "storage": {
+    "uptime": {
+      "type": "postgres",
+      "connection_string": "user=postgres password=topsecretpassword host=tyk-postgres port=5432 database=tyk_analytics",
+      "table_sharding": false
+    }
+  }
+}
+```
+
+If you've enabled `table_sharding` on the SQL Uptime Pump, set the matching `storage.uptime.table_sharding` here too.
+
+## Events
+
+When Tyk Gateway detects downtime on a test, it fires a `HostDown` event; when the host recovers, it fires `HostUp`. These are ordinary [Tyk Events](/api-management/gateway-events), so you can attach any supported action to them, such as a logger, a webhook, or a custom JavaScript plugin.
+
+Since tests run per URL, a single host with multiple endpoints under test can fire several `HostDown` events at once.
+
+## Load Balancing and Service Discovery
+
+If you're using round-robin load balancing, you can have Tyk Gateway check the outbound request's host against the uptime test results before routing to it, skipping to the next host in the list if it's marked down:
+
+```json
+{
+  "proxy": {
+    "check_host_against_uptime_tests": true
+  }
+}
+```
+
+The host, including port, must exactly match between the uptime test configuration and the load-balanced target list for Tyk Gateway to link the two, for example `www.myapi.com:3000`.
diff --git a/planning-for-production/monitoring/tyk-components.mdx b/planning-for-production/monitoring/tyk-components.mdx
new file mode 100644
index 0000000000..7b169a13f5
--- /dev/null
+++ b/planning-for-production/monitoring/tyk-components.mdx
@@ -0,0 +1,104 @@
+---
+title: "Monitor Tyk Stack"
+description: "How to monitor Tyk components in production"
+sidebarTitle: "Monitoring"
+---
+
+A common question that gets asked is how to monitor the Tyk components.
+
+## Tyk Gateway
+
+The Gateway & Redis are the only components that will have a high on-demand performance requirement, which needs to scale with your API traffic.
+
+### Tyk Gateway CPU Utilization
+
+Tyk Gateway is CPU bound. It will have better performance the more cores you throw at Tyk. Tyk will automatically spread itself across all available cores to handle the traffic. Be sure to limit the cores in a Kubernetes deployment otherwise, the Gateway will attempt to consume all cores in a node.
+
+Performance benchmarks on how Tyk performs across different CPU architectures, environments and sizes [here](https://tyk.io/performance-benchmarks/).
+
+A healthy and performant Tyk Gateway should have a CPU utilization of under 60%. If the average CPU utilization is above 60%, then we recommend you scale your Tyk Gateway services. A higher figure than 60% introduces risk because if one Gateway fails, the traffic spillover to healthy nodes might be overwhelming and result in a cascading failure.
+
+### Liveness Health Check
+
+Health checks are extremely important in determining the status of our Tyk Components. Depending on your setup and configuration, the statuses of the following components will be returned: **Gateway**, **Dashboard**, **Redis** and **RPC**. 
+
+The health check endpoint is an expensive operation and can throttle throughput so it's important to find an optimal plan if you want to take advantage of this endpoint. The endpoint refreshes every 10 seconds and does not return statuses on the primary database (MongoDB or PostgreSQL) and the Tyk Pump component.
+
+
+```yaml
+curl -X GET "http://localhost:8080/hello"
+
+{
+   "status": "pass",
+   "version": "4.2.3",
+   "description": "Tyk GW",
+   "details": {
+       "dashboard": {
+           "status": "pass",
+           "componentType": "system",
+           "time": "2022-11-21T20:03:44Z"
+       },
+       "redis": {
+           "status": "pass",
+           "componentType": "datastore",
+           "time": "2022-11-21T20:03:44Z"
+       },
+       "rpc": {
+           "status": "pass",
+           "componentType": "system",
+           "time": "2022-11-21T20:03:44Z"
+       }
+   }
+}
+```
+
+For information about our health check endpoint, please visit our [Liveness Health Check](#liveness-health-check) documentation.
+
+## Tyk Dashboard & Tyk MDCB
+
+These other Tyk components won’t see load proportional to your API requests.  However, the Dashboard (and MDCB on Global deployments) synchronise the Gateways and need to be given enough resources to manage this process.
+
+The Tyk Dashboard liveness health check endpoint can be configured [here](/tyk-dashboard/configuration#health_check_endpoint_name). 
+
+The Tyk MDCB liveness health check endpoint can be configured [here](/api-management/mdcb#health-check). 
+
+Currently, Tyk Dashboard and MDCB liveness endpoints only report whether the service is operational. It is important to note that the service may not yet be ready for use if it is unable to establish a connection with its dependent components (such as Redis and Datastore) or if they are offline.
+
+## Tyk Pump
+
+The Tyk Pump component offers a built-in Liveness Health Check endpoint [here](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#health-check). 
+
+Currently, the receipt of an HTTP 200 OK response merely indicates that the Pump service is operational. However, it is important to note that the service may not yet be ready for use if it is unable to establish a connection with its dependent components (such as Redis and Datastore) or if they are offline.
+
+### Database Sizing
+
+Based on the Tyk recommended approach for setting up your databases, our team has built tools that will help engineers better understand and plan their infrastructure around their use case:
+
+* [Redis Sizing](/planning-for-production/database-settings#redis-sizing-guidelines)
+* [PostgreSQL Sizing](/planning-for-production/database-settings#postgresql-sizing-guidelines)
+* [MongoDB Sizing](/planning-for-production/database-settings#mongodb-sizing-guidelines)
+
+
+### Database Monitoring
+
+Monitoring guides from our partner:
+
+**Redis**
+1. [How to monitor Redis performance metrics](https://www.datadoghq.com/blog/how-to-monitor-redis-performance-metrics/)
+2. [How to collect Redis Metrics](https://www.datadoghq.com/blog/how-to-collect-redis-metrics/)
+3. [Monitor Redis using Datadog](https://www.datadoghq.com/blog/monitor-redis-using-datadog/)
+
+
+**Postgres**
+1. [Key metrics for PostgreSQL monitoring](https://www.datadoghq.com/blog/postgresql-monitoring/)
+2. [Collecting metrics with PostgreSQL monitoring tools](https://www.datadoghq.com/blog/postgresql-monitoring-tools/)
+3. [How to collect and monitor PostgreSQL data with Datadog](https://www.datadoghq.com/blog/collect-postgresql-data-with-datadog/)
+
+
+**Mongo**
+
+1. [Monitoring MongoDB performance metrics (WiredTiger)](https://www.datadoghq.com/blog/monitoring-mongodb-performance-metrics-wiredtiger/)
+2. [Collecting MongoDB metrics and statistics](https://www.datadoghq.com/blog/collecting-mongodb-metrics-and-statistics/)
+3. [How to monitor MongoDB performance with Datadog](https://www.datadoghq.com/blog/monitor-mongodb-performance-with-datadog/)
+
+
diff --git a/platform-management/api-categories.mdx b/platform-management/api-categories.mdx
new file mode 100644
index 0000000000..79a137496c
--- /dev/null
+++ b/platform-management/api-categories.mdx
@@ -0,0 +1,102 @@
+---
+title: "Governance using API Categories"
+description: "Learn how to use API categories in Tyk Dashboard to group and manage APIs by attributes such as environment, ownership or target consumer"
+keywords: "API Categories, API Governance, Tyk Dashboard, API Management, Categorization"
+sidebarTitle: "API Categories"
+---
+
+
+API categorization is a governance feature provided within the Tyk Dashboard that helps you to manage a portfolio of APIs. You can filter the list of APIs visible in the Dashboard UI or to be returned by the Dashboard API by category. You can assign an API to any number of categories and any number of APIs to a category. All category names are entirely user defined.
+
+## When to use API categories
+### Managing a large portfolio of APIs
+As a platform manager looking after a large portfolio of APIs, if I need to make changes to a sub-set of APIs, it's cumbersome having to identify which APIs they are and then to find them one-by-one in the list. If I have assigned categories to my APIs then I can filter quickly and easily to work with that sub-set. What's really powerful is that an API can appear in as many different categories as I like. 
+
+### Multi-tenant deployment
+Multi-tenant deployments with [role-based access control](/platform-management/user-permissions) enabled allows an admin user to give different users or groups access to a sub-set of the entire API portfolio. Categories can be aligned with the API ownership rules that you have deployed to allow filtering the list of APIs for those visible to each separate user group/team.
+
+## How API categories work
+API categories with Tyk are a very simple concept - you can define any string as a category and then tag the relevant APIs with that string.
+
+Categories might refer to the API's general focus (e.g. 'weather' or 'share prices'); they might relate to geographic location (e.g. 'APAC' or 'EMEA'); they might refer to technical markers (e.g. 'dev', 'test'); or anything else you might need. It's completely up to you.
+
+Categories can be defined, added to and removed from APIs without limitation.
+
+### Tyk OAS APIs
+When a Tyk OAS API is assigned to a category, the category name (string) is appended to a list in the database object where the API definition is stored by Tyk Dashboard. No change is made to the API definition itself.
+
+### Tyk Classic APIs
+When a Tyk Classic API is assigned to a category, the category name (string) is appended to the `name` field in the API definition using a `#` qualifier. For example, let's say you have an API with this (partial) API definition:
+
+```json
+{
+    "name": "my-classic-api"  
+}
+```
+You can add it to the `global` and `staging` categories by updating the API definition to:
+
+```json
+{
+    "name": "my-classic-api #global #staging"  
+}
+```
+When a Tyk Classic API is migrated from one environment to another using Tyk Sync, it will retain any category labels that it has been assigned.
+
+
+<Note>
+The use of the `#` qualifier to identify a category prevents the use of `#` in your API names; this is not an issue when working with Tyk OAS APIs.
+</Note>
+
+
+## Using API categories
+API categories can be added and removed from APIs within the [API Designer](#api-designer), via the [Tyk Dashboard API](#tyk-dashboard-api), or via [Tyk Operator](/api-management/automations/operator#what-is-tyk-operator).
+
+### API Designer
+The API Designer in the Tyk Dashboard UI provides a simple method for assigning APIs to categories, removing categories and filtering the API list by category.
+
+#### Managing categories with Tyk OAS APIs
+When working with Tyk OAS APIs, the API Designer has a separate **Access** tab where you can configure the categories to which the API is assigned.
+<img src="/img/dashboard/endpoint-designer/categories-oas.png" alt="Tyk OAS API Designer" /> 
+
+You can choose existing categories from the drop-down or define new categories simply by typing in the box. You can also remove the API from a category by clicking on the `x` or deleting the category from the box.
+<img src="/img/dashboard/endpoint-designer/categories-oas-add.png" alt="Managing categories for a Tyk OAS API" />
+
+#### Managing categories with Tyk Classic APIs
+When working with Tyk Classic APIs, the API Designer has a box in the **API Settings** section where you can configure the categories to which the API is assigned.
+<img src="/img/dashboard/endpoint-designer/categories-classic.png" alt="Tyk Classic API Designer" /> 
+
+You can choose existing categories from the list that appears when you click in the box or you can define new categories simply by typing in the box. You can also remove the API from a category by clicking on the `x` or deleting the category from the box.
+<img src="/img/dashboard/endpoint-designer/categories-classic-add.png" alt="Managing categories for a Tyk Classic API" />
+
+#### Filtering the API list
+When you have APIs assigned to categories, you can choose to view only the APIs in a specific category by using the **FILTER BY API CATEGORY** drop-down on the **Created APIs** screen.
+<img src="/img/dashboard/endpoint-designer/categories-filter.png" alt="View APIs in a category" /> 
+
+### Tyk Dashboard API
+The [Tyk Dashboard API](/tyk-dashboard-api) provides endpoints to manage categories directly, if you are not using the API Designer.
+
+When working with Tyk OAS APIs, you can manage categories for an API using these endpoints:
+
+| Method | Endpoint path                        | Action                                                                                 |
+| :-------- | :-------------------------------------- | :---------------------------------------------------------------------------------------- |
+| `PUT`  | `/api/apis/oas/{apiID}/categories`   | Assign a list of categories to the specified API   
+| `GET`  | `/api/apis/oas/{apiID}/categories`   | Retrieve the list of categories assigned to the specified API                          |
+
+When working with Tyk Classic APIs, you manage categories for an API by modifying the `name` field in the API definition and then updating the API in Tyk with that using these endpoints:
+
+| Method | Endpoint                             | Action                                                                                 |
+| :-------- | :-------------------------------------- | :---------------------------------------------------------------------------------------- |
+| `PUT`  | `/api/apis/{apiID}`                  | Update the API definition for the specified API - CRUD category tags in the `name` field |
+| `GET`  | `/api/apis/{apiID}`                  | Retrieve the API definition for the specified API - category tags in `name` field      |
+
+These endpoints will return information for categories across all APIs in the system (both Tyk OAS and Tyk Classic):
+
+| Method | Endpoint path                        | Action                                                                                 |
+| :-------- | :-------------------------------------- | :---------------------------------------------------------------------------------------- |
+| `GET`  | `/api/apis/categories`               | Retrieve a list of all categories defined in the system and the number of APIs in each |
+| `GET`  | `/api/apis?category={category_name}` | Retrieve a list of all APIs assigned to the specified category                         |
+
+### Tyk Operator
+
+You can manage categories using Tyk Operator custom resources. Please refer to [Tyk Operator](/api-management/automations/operator#api-categories) documentation to see how to manage API categories for Tyk OAS APIs and Tyk Classic APIs.
+
diff --git a/platform-management/api-ownership.mdx b/platform-management/api-ownership.mdx
new file mode 100644
index 0000000000..054a07b36a
--- /dev/null
+++ b/platform-management/api-ownership.mdx
@@ -0,0 +1,117 @@
+---
+title: "API Ownership"
+description: "Learn how to use API Ownership in Tyk Dashboard to govern API visibility and manageability for specific teams or users in multi-team setups"
+keywords: "API Ownership, Multi Team, RBAC, API Governance, Owned Analytics, Tyk Dashboard"
+sidebarTitle: "API Ownership"
+---
+
+
+API Ownership is the concept of Role Based Access Control applied to the portfolio of APIs deployed on your Tyk Gateways and managed from your Tyk Dashboard. 
+
+If you have multiple teams, where each team maintains its own APIs and you want to limit access of the dashboard to the team level. For each API, you can assign owners, where an owner can be either an individual user or user group. Only owners have access to these APIs, and objects created based on them like policies or analytics.
+
+<Note>
+The availability of this feature [depends on your license](/api-management/user-management).
+</Note>
+ 
+
+## When to use API Ownership
+### Governing a multi-team API portfolio
+API ownership is a key capability when you have multiple API development teams each working on their own suite of APIs. You can use API Ownership to simplify the experience of those developers when accessing Tyk by reducing the "clutter" of APIs that they are not working with, and also to avoid the risk of users accidentally or maliciously interfering with another team's APIs.
+
+### Avoiding data leakage between users
+The [user owned analytics](/platform-management/api-ownership#owned-analytics) feature allows you to prevent users from seeing the traffic to (and existence of) APIs for which they are not responsible. This reduces the opportunity for data leakage within your business.
+
+## How API Ownership works
+By default, APIs and associated objects (such as policies and Dashboard analytics) are visible to all Tyk Dashboard users.
+
+A Dashboard User (or User Group) can be assigned as the *owner* of an API, granting that user (or user group) exclusive visibility of and - given appropriate permissions - the ability to manage all the Tyk objects relating to that API, such as policies, key requests and Dashboard analytics.
+
+Once an API has been assigned an *owner*, all non-owning users will lose visibility of - and access to - that API in the Tyk Dashboard.
+
+Where there is a conflict, for example when a policy is associated with multiple APIs and the user owns only one of those APIs, the user will have access to the object (though not the other APIs themselves). 
+
+### API Ownership example
+Imagine that you have two APIs: API1, API2.
+You have three teams which have different roles and responsibilities as follows:
+- **TeamA** which must have access to configure API1 
+- **TeamB** which must have access to configure API2
+- **TeamAnalytics** which should only have access to view the analytics for both API1 and API2 
+
+To implement this structure, you would create three user groups and assign [permissions](/platform-management/user-permissions) as indicated:
+- **TeamA** requires `"apis": "write"` 
+- **TeamB** requires `"apis": "write"` 
+- **TeamAnalytics** requires `"analytics": "read"` 
+
+Having configured the user groups, you can then assign API ownership as follows:
+- API1 - **TeamA**, **TeamAnalytics** 
+- API2 - **TeamB**, **TeamAnalytics**
+
+Thus:
+**TeamA** will have API `write` access only to API1
+**TeamB** will have API `write` access only to API2
+**TeamAnalytics** will have Analytics `read` access to both APIs
+
+### Enabling API Ownership
+API Ownership must be enabled in your Tyk Dashboard configuration, which you can do using either of the following approaches:
+ - set `enable_ownership` to `true` in your `tyk_analytics.conf`
+ - set the `TYK_DB_ENABLEOWNERSHIP` environment variable to `true`
+
+### Owned Analytics
+Access to Tyk Dashboard's [traffic analytics](/api-management/dashboard-analytics#traffic-analytics) is controlled via the `analytics` permission in the user or user group access control configuration. The default behavior of this control is to grant or restrict access to all traffic analytics and does not take into account API ownership.
+
+The additional `owned_analytics` permission was added in Tyk Dashboard v5.1 (and LTS patches v4.0.14 and v5.0.3) to provide more granular access to traffic analytics. By configuring this permission, the user (or user group) will gain visibility only of those analytics that can be filtered by API (due to the method Tyk Pump uses to aggregate the analytics records).
+
+Currently, only [API Usage](/api-management/dashboard-analytics#activity-by-api) and [Error Counts](/api-management/dashboard-analytics#activity-by-error) are available to users with the `owned_analytics` permission.
+
+Note that the `owned_analytics` permission depends upon the `analytics` permission being granted (set to `read`) - without this, the more granular control is ignored and the user will not have visibility of any Tyk Dashboard analytics.
+
+In the Dashboard UI, the control for `owned_analytics` is implemented as a drop-down option (`all` or `owned`) on the `analytics` permission.
+<img src="/img/dashboard/analytics/owned_analytics.png" alt="Permissions with API Ownership" />
+
+## Managing API owners using the Dashboard UI
+The Dashboard UI provides a simple method for managing *ownership* for your APIs, where you can select from the lists of users and user groups that have been created in the Dashboard. Users and user groups are managed in separate lists for ease of use.
+
+### Using Tyk OAS APIs
+When using Tyk OAS APIs, the option to assign owner(s) to an API is provided on the **Access** tab in the API Designer. You simply select the owner (or owners) that you wish to assign to the API from the drop-down boxes:
+<img src="/img/dashboard/endpoint-designer/ownership-oas.png" alt="API ownership section for Tyk OAS APIs" />
+
+You can remove owners from the API by clicking on the `x` next to their name in the drop-down/selection box.
+
+### Using Tyk Classic APIs
+When using Tyk Classic APIs, the option to assign owner(s) to an API is provided on the **Core Settings** tab in the API Designer. You simply select the owner (or owners) that you wish to assign to the API from the drop-down boxes:
+<img src="/img/dashboard/system-management/api_ownership.png" alt="API ownership section for Tyk Classic APIs" />
+
+You can remove owners from the API by deselecting them from the drop-down.
+
+## Managing API owners using the Dashboard API
+The [Tyk Dashboard API](/tyk-dashboard-api) provides endpoints to manage API ownership directly, if you are not using the API Designer.
+
+### Using Tyk OAS APIs
+When working with Tyk OAS APIs, you can manage owners for an API using these endpoints:
+
+| Method | Endpoint path           | Action                                                                                 |
+| :-------- | :------------------------- | :---------------------------------------------------------------------------------------- |
+| `PUT`  | `/api/apis/{apiID}/access`  | Assign a list of owners to the specified API                                           |
+| `GET`  | `/api/apis/{apiID}/access`  | Retrieve the list of owners of the specified API                                       |
+
+For each of these endpoints, the payload consists of two string lists: one for user IDs, the other for user group IDs.
+```json
+{
+  "userIds": [
+    "string"
+  ],
+  "userGroupIds": [
+    "string"
+  ]
+}
+```
+
+### Using Tyk Classic APIs
+When working with Tyk Classic APIs, you manage owners for an API by modifying the `user_owners` and `user_group_owners` fields in the API definition and then updating the API in Tyk with that using these endpoints:
+
+| Method | Endpoint            | Action                                                                                                                |
+| :-------- | :--------------------- | :----------------------------------------------------------------------------------------------------------------------- |
+| `PUT`  | `/api/apis/{apiID}` | Update the API definition for the specified API - CRUD API owners in the `user_owners` and `user_group_owners` fields |
+| `GET`  | `/api/apis/{apiID}` | Retrieve the API definition for the specified API - ownership details are included in `user_owners` and `user_group_owners` fields |
+
diff --git a/platform-management/api-templates.mdx b/platform-management/api-templates.mdx
new file mode 100644
index 0000000000..89a85f2d9e
--- /dev/null
+++ b/platform-management/api-templates.mdx
@@ -0,0 +1,611 @@
+---
+title: "Governance using API Templates"
+description: "Learn how to use API templates in Tyk Dashboard to standardize API creation with pre-configured baseline settings"
+keywords: "API Templates, API Governance, Template Designer, Tyk OAS, API Standardization"
+sidebarTitle: "API Templates"
+---
+
+API Templates are an API governance feature provided to streamline the process of creating Tyk OAS APIs. An API template is an asset managed by Tyk Dashboard that is used as the starting point - a blueprint - from which you can create a new Tyk OAS API definition.
+
+The default template is a blank API definition; your custom templates will contain some configuration, for example cache configuration or default endpoints with pre-configured middleware. When you create a new API using a custom template, whether importing an OpenAPI document or building the API from scratch in the Tyk API Designer, those elements of the API configuration included in the template will be pre-configured for you.
+
+
+<Note>
+API Templates are exclusive to [Tyk OAS APIs](/api-management/gateway-config-introduction#api-definitions) and can be managed via the Tyk Dashboard API or within the Tyk Dashboard UI.
+</Note>
+
+
+## When to use API templates
+### Gateway agnostic API design
+When working with OpenAPI described upstream service APIs, your service developers do not need to learn about Tyk. You can create and maintain a suitable suite of templates that contain the Tyk-specific configuration (`x-tyk-api-gateway`) that you require for your externally published API portfolio. Creating an API on Tyk is as simple as importing the OpenAPI document and selecting the correct template. Tyk will combine the OpenAPI description with the template to produce a valid Tyk OAS API.
+
+### Standardizing API configuration
+If you have specific requirements for your external facing APIs - for example authentication, caching or even a healthcheck endpoint - you can define the appropriate API templates so that when APIs are created on Tyk these fields are automatically and correctly configured.
+
+## How API templating works
+An API template is a blueprint from which you can build new APIs - it is an incomplete JSON representation of a Tyk OAS API definition that you can use as the starting point when creating a new API on Tyk. There is no limit to how much or how little of the API definition is pre-configured in the template (such that when you choose to create a new API without choosing a template, the blank API definition that you start from is itself a template).
+
+Templates are used only during the creation of an API, they cannot be applied later. Before you can use a template as the basis for an API, you must register the template with Tyk Dashboard.
+
+### Structure of an API template
+An API template asset has the following structure:
+ - `id`: a unique string type identifier for the template
+ - `kind`: the asset type, which is set to `oas-template`
+ - `name`: human-readable name for the template
+ - `description`: a short description of the template, that could be used for example to indicate the configuration held within the template
+ - `data`: a Tyk OAS API definition, the content of which will be used for templating APIs
+ - `_id`: a unique identifier assigned by Tyk when the template is registered in the Dashboard database
+
+### Creating an API from a template
+When you use a template during the [creation](/api-management/gateway-config-managing-oas#creating-an-api) of an API, the fields configured in `data` will be pre-set in your new API. You are able to modify these during and after creation of the template. No link is created between the API and the template, so changes made to the API will not impact the template.
+
+### Merging with an OpenAPI description or Tyk OAS API definition
+When you use a template during the creation of an API where you [import](/api-management/gateway-config-managing-oas#importing-an-openapi-description-to-create-an-api) the OpenAPI document or a full Tyk OAS API definition, the template is combined with the imported OAS description. If the `x-tyk-api-gateway` extension exists in the template, it will be applied to the newly created API.
+
+Where there are clashes between configuration in the OpenAPI description and the template:
+ - for maps, such as `paths` and `components`, new keys will be added alongside any existing ones from the template
+   - if a key in the OpenAPI description matches one in the template, the OpenAPI description takes precedence
+ - for array properties, such as `servers` and `tags`, values in the OpenAPI description will replace those in the template
+
+<hr />
+
+If you're using the API Designer in the Tyk Dashboard UI, then you can find details and examples of how to work with API templates [here](#working-with-api-templates-using-the-template-designer).
+
+If you're using the Tyk Dashboard API, then you can find details and examples of how to work with API templates [here](#working-with-api-templates-using-the-dashboard-api).
+
+## Working with API Templates using the Template Designer
+
+API Templates are an API governance feature provided to streamline the process of creating Tyk OAS APIs. An API template is an asset managed by Tyk Dashboard that is used as the starting point - a blueprint - from which you can create a new Tyk OAS API definition.
+
+The Tyk Dashboard UI provides the following functionality to support working with API templates:
+ - Creating templates
+   - [new template](#creating-a-new-api-template)
+   - [from an existing API](#creating-a-template-from-an-existing-api)
+ - Using templates
+   - [when creating an API](#using-a-template-when-creating-a-new-api)
+   - [when importing an OpenAPI description or API definition](#using-a-template-when-importing-an-openapi-description-or-api-definition)
+ - [Managing templates](#managing-templates)
+
+API Templates can be found in the **API Templates** section of the **API Management** menu in the Tyk Dashboard. This screen lists all the templates currently registered with Tyk and displays their names and short descriptions. It also gives access to options to create and manage templates.
+
+<img src="/img/dashboard/api-assets/api-templates/api-templates-menu.png" alt="API Templates" />
+
+
+<Note>
+API Templates are exclusive to [Tyk OAS APIs](/api-management/gateway-config-introduction#api-definitions).
+</Note>
+
+
+### Creating templates
+API templates can be created starting from a blank template or from an existing API
+
+#### Creating a new API template
+To create a template, simply visit the **API Templates** section of the Tyk Dashboard and select **ADD TEMPLATE**.
+
+This will take you to the **Create API Template** screen, where you can configure all aspects of the template.
+
+The template does not need to be a complete or valid API definition however as a minimum:
+ - you must give the template a **Name**
+ - you must give the template a **Description**
+
+In this example, we have configured just the Name, Description, Gateway Status and Access settings:
+
+<img src="/img/dashboard/api-assets/api-templates/create-api-template.png" alt="Configure the template" />
+ 
+When you have configured all of the API-level and endpoint-level settings you require, select **SAVE TEMPLATE** to create and register the template with Tyk.
+
+Returning to the **API Template** screen you will see your new template has been added to the list and assigned a unique `id` that can be used to access the template from the [Tyk Dashboard API](#structure-of-an-api-template):
+
+<img src="/img/dashboard/api-assets/api-templates/template-created.png" alt="Template has been successfully created" />
+
+#### Creating a template from an existing API
+You can use an existing API deployed on Tyk as the basis for a new API template - this is a great way to build up a portfolio of standardized APIs once you've got your first one correctly configured.
+
+From the **Created APIs** screen within the **APIs** section of the Tyk Dashboard, select the API that you wish to use as your starting point. In the **ACTIONS** drop-down select the **CREATE API TEMPLATE** option.
+
+<img src="/img/dashboard/api-assets/api-templates/create-from-api.png" alt="Select Create API Template" />
+
+This will take you to the **Create API Template** screen, where you can configure all aspects of the template.
+
+The template does not need to be a complete or valid API definition however as a minimum:
+ - you must give the template a **Name**
+ - you must give the template a **Description**
+
+In this example, we have configured the Name and Description. The base API included response header transformation middleware on the `/anything` endpoint and API-level cache configuration, all of which will be configured within the template.
+
+<img src="/img/dashboard/api-assets/api-templates/second-template.png" alt="Configure the template" />
+<img src="/img/dashboard/api-assets/api-templates/second-template-cache.png" alt="Cache settings inherited from base API" />
+<img src="/img/dashboard/api-assets/api-templates/second-template-endpoints.png" alt="Endpoint settings inherited from base API" />
+ 
+When you have configured all of the API-level and endpoint-level settings you require, select **SAVE TEMPLATE** to create and register the template with Tyk.
+
+Returning to the **API Template** screen you will see your new template has been added to the list and assigned a unique `id` that can be used to access the template from the [Tyk Dashboard API](#structure-of-an-api-template).
+
+<img src="/img/dashboard/api-assets/api-templates/second-template-created.png" alt="Template has been successfully created" />
+
+### Using templates
+API templates are used as the starting point during the creation of a new API. They can be applied in all of the methods supported by Tyk for creating new APIs.
+
+#### Using a template when creating a new API
+There are two ways to base a new API, created entirely within the Tyk Dashboard's API Designer, on a template that you've created and registered with Tyk.
+
+You can go from the **API Template** screen - for the template you want to use, select **CREATE API FROM TEMPLATE** from the **ACTIONS** menu:
+<img src="/img/dashboard/api-assets/api-templates/create-api-from-template.png" alt="Select Create API from template" />
+
+Or, from the **Created APIs** screen, select **ADD NEW API** as normal and then select the template you want to use from the **API Template** section:
+<img src="/img/dashboard/api-assets/api-templates/create-api-from-template2.png" alt="Select the template you want to use" />
+
+Both of these routes will take you through to the API Designer, where the settings from your API template will be pre-configured.
+
+In this example, we applied "My first template" that we created [here](#creating-a-new-api-template). You can see that the Gateway Status and Access fields have been configured:
+<img src="/img/dashboard/api-assets/api-templates/created-api.png" alt="The API with template applied" />
+
+#### Using a template when importing an OpenAPI description or API definition
+From the **Import API** screen, if you select the OpenAPI **type** then you can create an API from an OpenAPI description or Tyk OAS API definition; choose the appropriate method to provide this to the Dashboard:
+- paste the JSON into the text editor
+- provide a plain text file containing the JSON
+- provide a URL to the JSON
+<img src="/img/dashboard/api-assets/api-templates/import-select-source.png" alt="Options when importing an OpenAPI description" /> 
+
+After pasting the JSON or locating the file, you can select the template you want to use from the **API Template** section:
+<img src="/img/dashboard/api-assets/api-templates/import-select-template.png" alt="Select the template you want to use" /> 
+
+In this example we used this simple OpenAPI description and selected "My second template" that we created [here](#creating-a-template-from-an-existing-api):
+
+``` json  {linenos=true, linenostart=1}
+{
+  "components": {},
+  "info": {
+    "title": "my-open-api-document",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "servers": [
+    {
+      "url": "http://httpbin.org"
+    }
+  ],
+  "paths": {
+    "/xml": {
+      "get": {
+        "operationId": "xmlget",
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        }
+      }
+    }
+  }
+}
+```
+The API that is created has both `/xml` and `/anything` endpoints defined, with API-level caching configured. You can see the API definition [here](https://gist.github.com/andyo-tyk/5d5cfeda404ce1ba498bbf4b9c105cf0).
+
+### Managing templates
+The Dashboard UI allows you to edit and delete templates after they have been created and registered with the Tyk Dashboard
+
+#### Editing a template
+You can make changes to a template that has been registered with Tyk from the **API Templates** screen. For the template that you want to modify, simply select **EDIT TEMPLATE** from the **ACTIONS** menu:
+<img src="/img/dashboard/api-assets/api-templates/edit-template.png" alt="Accessing the API template" /> 
+
+This will take you to the **API Template Details** screen where you can view the current template configuration. If you want to make changes, simply select **EDIT** to make the fields editable:
+<img src="/img/dashboard/api-assets/api-templates/template-editor.png" alt="Modifying the API template" /> 
+
+Alternatively you can view and modify the raw JSON for the template by selecting **VIEW RAW TEMPLATE** from the **ACTIONS** menu:
+<img src="/img/dashboard/api-assets/api-templates/template-raw-editor.png" alt="Modifying the API template JSON" /> 
+
+You'll need to select **SAVE TEMPLATE** to apply your changes from either screen.
+
+#### Deleting a template
+You can delete a template from your Tyk Dashboard from the **API Template Details** screen. This screen can be accessed by selecting the template from the **API Templates** screen (either by clicking on the template name, or selecting **EDIT TEMPLATE** from the **ACTIONS** menu):
+<img src="/img/dashboard/api-assets/api-templates/edit-template.png" alt="Accessing the API template" /> 
+
+From the **API Template Details** screen you can select **DELETE TEMPLATE** from the **ACTIONS** menu:
+<img src="/img/dashboard/api-assets/api-templates/delete-template.png" alt="Deleting the API template" /> 
+
+
+<Note>
+You will be asked to confirm the deletion, because this is irrevocable. Once confirmed, the template will be removed from the database and cannot be recovered.
+</Note>
+
+
+## Working with API Templates using the Dashboard API
+
+API Templates are an API governance feature provided to streamline the process of creating Tyk OAS APIs. An API template is an asset managed by Tyk Dashboard that is used as the starting point - a blueprint - from which you can create a new Tyk OAS API definition.
+
+The Tyk Dashboard API provides the following functionality to support working with API templates:
+ - [registering a template with Tyk Dashboard](#registering-a-template-with-tyk-dashboard)
+ - [applying a template when creating an API from an OpenAPI document](#applying-a-template-when-creating-an-api-from-an-openapi-document)
+ - [applying a template when creating an API from a Tyk OAS API definition](#applying-a-template-when-creating-an-api-from-a-tyk-oas-api-definition)
+
+
+
+    <Note>
+    API Templates are exclusive to [Tyk OAS APIs](/api-management/gateway-config-introduction#api-definitions).
+    </Note>
+
+
+### Structure of an API template
+An API template asset has the following structure:
+ - `id`: a unique string type identifier for the template
+ - `kind`: the asset type, which is set to `oas-template`
+ - `name`: human-readable name for the template
+ - `description`: a short description of the template, that could be used for example to indicate the configuration held within the template
+ - `data`: a Tyk OAS API definition, the content of which will be used for templating APIs
+ - `_id`: a unique identifier assigned by Tyk when the template is registered in the Dashboard database
+
+### Registering a template with Tyk Dashboard
+To register an API template with Tyk, you pass the asset in the body of a `POST` request to the dashboard's `/api/assets` endpoint.
+
+For example, if you send this command to the endpoint:
+``` bash {linenos=true, linenostart=1}
+curl --location 'http://localhost:3000/api/assets' \
+--header 'Content-Type: application/json' \
+--header 'Authorization: Bearer d9957aff302b4f5e5596c86a685e63d8' \
+--data '{
+  "kind": "oas-template",
+  "name": "my-template",
+  "description": "My first template",
+  "id": "my-unique-template-id",
+  "data": {
+    "info": {
+      "title": "",
+      "version": ""
+    },
+    "openapi": "3.0.3",
+    "paths": {
+      "/anything": {
+        "post": {
+          "operationId": "anythingpost",
+          "responses": {
+            "200": {
+              "description": ""
+            }
+          }
+        }
+      }
+    },
+    "x-tyk-api-gateway": {
+      "middleware": {
+        "global": {
+          "cache": {
+            "enabled": true,
+            "timeout": 5,
+            "cacheAllSafeRequests": true
+          }
+        },
+        "operations": {
+          "anythingpost": {
+            "requestSizeLimit": {
+              "enabled": true,
+              "value": 100
+            }
+          }
+        }
+      }
+    }
+  }
+}'
+```
+
+Tyk will respond with `HTTP 201 Created` and will provide this payload in response:
+``` json
+{
+    "Status": "success",
+    "Message": "asset created",
+    "Meta": "65e8c352cb71918520ff660c",
+    "ID": "my-unique-template-id"
+}
+```
+
+Here `Meta` contains the database ID (where the asset has been registered in the persistent storage) and `ID` contains the unique identifier for the template. This unique identifier will be automatically generated by Tyk if none was provided in the `id` of the template asset provided in the `curl` request.
+
+### Applying a template when creating an API from an OpenAPI document
+When creating an API on Tyk using an OpenAPI document describing your upstream service, you can use the `/apis/oas/import` endpoint to import the OpenAPI description and apply it to your API.
+
+If you have a template registered with your Dashboard, you can use this as the starting point for your new API. Tyk will combine the OpenAPI document with the template, automating the configuration of any element in the Tyk OAS API definition as defined in your chosen template.
+
+You'll need to identify the template to be used during the import. You can use either its unique `id` or the database ID that was assigned when the template was [registered with Tyk Dashboard](#registering-a-template-with-tyk-dashboard). You provide either the `id` or `_id ` in the `templateID` query parameter in the call to `/oapis/oas/import`.
+
+For example:
+``` bash  {linenos=true, linenostart=1}
+curl --location 'http://localhost:3000/api/apis/oas/import?templateID=my-unique-template-id' \
+--header 'Content-Type: application/json' \
+--header 'Authorization: Bearer <DASHBOARD_SECRET>' \
+--data '{
+  "components": {},
+  "info": {
+    "title": "my-open-api-document",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "servers": [
+    {
+      "url": "http://httpbin.org"
+    }
+  ],
+  "paths": {
+    "/xml": {
+      "get": {
+        "operationId": "xmlget",
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        }
+      }
+    }
+  }
+}'
+```
+Tyk will respond with `HTTP 200 OK` and will provide this payload in response:
+``` json
+{
+    "Status": "OK",
+    "Message": "API created",
+    "Meta": "65e8c4f4cb71918520ff660d",
+    "ID": "970560005b564c4755f1db51ca5660e6"
+}
+```
+
+Here `Meta` contains the database ID (where the API has been registered in the persistent storage) and `ID` contains the unique identifier for the API. This unique identifier will be automatically generated by Tyk as none was provided in the `id` field of the `x-tyk-api-gateway.info` field provided in the `curl` request.
+
+The new Tyk OAS API will have this definition, combining the OpenAPI description provided in the body of the `curl` request with the template with Id `my-unique-template-id`:
+``` json  {linenos=true, linenostart=1}
+{
+  "info": {
+    "title": "my-open-api-document",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "servers": [
+    {
+      "url": "http://localhost:8181/"
+    },
+    {
+      "url": "http://httpbin.org"
+    }
+  ],
+  "security": [],
+  "paths": {
+    "/anything": {
+      "post": {
+        "operationId": "anythingpost",
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        }
+      }
+    },
+    "/xml": {
+      "get": {
+        "operationId": "xmlget",
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {}
+  },
+  "x-tyk-api-gateway": {
+    "info": {
+      "dbId": "65e8c4f4cb71918520ff660d",
+      "id": "970560005b564c4755f1db51ca5660e6",
+      "orgId": "65d635966ec69461e0e7ee52",
+      "name": "my-open-api-document",
+      "state": {
+        "active": true,
+        "internal": false
+      }
+    },
+    "middleware": {
+      "global": {
+        "cache": {
+          "cacheResponseCodes": [],
+          "cacheByHeaders": [],
+          "timeout": 5,
+          "cacheAllSafeRequests": true,
+          "enabled": true
+        }
+      },
+      "operations": {
+        "anythingpost": {
+          "requestSizeLimit": {
+            "enabled": true,
+            "value": 100
+          }
+        }
+      }
+    },
+    "server": {
+      "listenPath": {
+        "strip": true,
+        "value": "/"
+      }
+    },
+    "upstream": {
+      "url": "http://httpbin.org"
+    }
+  }
+}
+```
+Note that the `GET /xml` endpoint from the OpenAPI description and the `POST /anything` endpoint from the template (complete with `requestSizeLimit` middleware) have both been defined in the API definition. API-level caching has been enabled, as configured in the template. Tyk has included the `server` entry from the OpenAPI description (which points to the upstream server) and added the API URL on Tyk Gateway ([as explained here](/api-management/gateway-config-tyk-oas#modifying-the-openapi-description)). 
+
+### Applying a template when creating an API from a Tyk OAS API definition
+When creating an API using a complete Tyk OAS API definition (which includes `x-tyk-api-gateway`), you can use the `/apis/oas` endpoint to import the API defintiion.
+
+If you have a template registered with your Dashboard, you can use this as the starting point for your new API. Tyk will combine the API definition with the template, automating the configuration of any element defined in your chosen template.
+
+You'll need to identify the template to be used during the import. You can use either its unique `id` or the database ID that was assigned when the template was [registered with Tyk Dashboard](#registering-a-template-with-tyk-dashboard). You provide either the `id` or `_id` in the `templateID` query parameter in the call to `/apis/oas`.
+
+For example:
+``` bash  {linenos=true, linenostart=1}
+curl --location 'http://localhost:3000/api/apis/oas?templateID=my-unique-template-id' \
+--header 'Content-Type: application/json' \
+--header 'Authorization: Bearer <DASHBOARD_SECRET>' \
+--data '{
+  "components": {},  
+  "info": {
+    "title": "example-api",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "paths": {
+    "/json": {
+      "get": {
+        "operationId": "jsonget",
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        }
+      }
+    }
+  },
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "example-api",
+      "state": {
+        "active": true,
+        "internal": false
+      }
+    },
+    "upstream": {
+      "url": "http://httpbin.org/"
+    },
+    "server": {
+      "listenPath": {
+        "strip": true,
+        "value": "/example-api/"
+      }
+    },    
+    "middleware": {
+      "operations": {
+        "jsonget": {
+          "transformResponseHeaders": {
+            "enabled": true,
+            "add": [
+              {
+                "name": "X-Foo",
+                "value": "bar"
+              }
+            ]
+          }
+        }
+      }
+    }
+  }
+}'
+```
+Tyk will respond with `HTTP 200 OK` and will provide this payload in response:
+``` json
+{
+    "Status": "OK",
+    "Message": "API created",
+    "Meta": "65e98ca5cb71918520ff6616",
+    "ID": "b8b693c5e28a49154659232ca615a7e8"
+}
+```
+
+Here `Meta` contains the database ID (where the API has been registered in the persistent storage) and `ID` contains the unique identifier for the API. This unique identifier will be automatically generated by Tyk as none was provided in the `id` field of the `x-tyk-api-gateway.info` field provided in the `curl` request.
+
+The new Tyk OAS API will have this definition, combining the Tyk OAS API definition provided in the body of the `curl` request with the template with Id `my-unique-template-id`:
+
+``` json  {linenos=true, linenostart=1}
+{
+  "info": {
+    "title": "example-api",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "servers": [
+    {
+      "url": "http://localhost:8181/example-api/"
+    }
+  ],
+  "security": [],
+  "paths": {
+    "/anything": {
+      "post": {
+        "operationId": "anythingpost",
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        }
+      }
+    },
+    "/json": {
+      "get": {
+        "operationId": "jsonget",
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {}
+  },
+  "x-tyk-api-gateway": {
+    "info": {
+      "dbId": "65e98ca5cb71918520ff6616",
+      "id": "b8b693c5e28a49154659232ca615a7e8",
+      "orgId": "65d635966ec69461e0e7ee52",
+      "name": "example-api",
+      "state": {
+        "active": true,
+        "internal": false
+      }
+    },
+    "middleware": {
+      "global": {
+        "cache": {
+          "cacheResponseCodes": [],
+          "cacheByHeaders": [],
+          "timeout": 5,
+          "cacheAllSafeRequests": true,
+          "enabled": true
+        }
+      },
+      "operations": {
+        "anythingpost": {
+          "requestSizeLimit": {
+            "enabled": true,
+            "value": 100
+          }
+        },
+        "jsonget": {
+          "transformResponseHeaders": {
+            "enabled": true,
+            "add": [
+              {
+                "name": "X-Foo",
+                "value": "bar"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "server": {
+      "listenPath": {
+        "strip": true,
+        "value": "/example-api/"
+      }
+    },
+    "upstream": {
+      "url": "http://httpbin.org/"
+    }
+  }
+}
+```
+Note that the `GET /json` endpoint from the OpenAPI description and the `POST /anything` endpoint from the template (complete with `requestSizeLimit` middleware) have both been defined in the API definition. API-level caching has been enabled, as configured in the template.
+
diff --git a/platform-management/dashboard-users.mdx b/platform-management/dashboard-users.mdx
new file mode 100644
index 0000000000..b32733ecb7
--- /dev/null
+++ b/platform-management/dashboard-users.mdx
@@ -0,0 +1,170 @@
+---
+title: "Manage Tyk Dashboard Users"
+description: "Learn how to create and manage Tyk Dashboard users using the UI and API, including passwords, password policy and user search"
+keywords: "Dashboard, User Management, Users, Passwords, Password Policy, Search Users"
+sidebarTitle: "Manage Users"
+---
+
+## Manage Tyk Dashboard Users
+
+Dashboard users have twofold access to the dashboard: they can access both the Dashboard API and the dashboard itself, it is possible to generate users that have read-only access to certain sections of the dashboard and the underlying API.
+
+Dashboard users are not the same as developer portal users (a.k.a. [developers](/tyk-developer-portal/tyk-portal-classic/portal-concepts#developers)). The credentials are stored independently and have different mechanics relating to registration, management and access. For example, it is not possible to log into the developer portal using a dashboard account.
+
+### Using Dashboard UI
+
+To create a dashboard user from the GUI:
+
+1. **Select "Users" from the "System Management" section**
+
+    <img src="/img/2.10/users_menu.png" alt="Users menu" />
+
+2. **Click "ADD USER"**
+
+    <img src="/img/2.10/add_user.png" alt="Add user button location" />
+
+3. **Add the user's basic details**
+
+    <img src="/img/2.10/user_basic_details.png" alt="User form" />
+
+    In this section:
+
+    *   **First Name**: The user's first name.
+    *   **Last Name**: The user's last name.
+    *   **Email**: The email address of the user, this will also be their login username.
+    *   **Password**: The password to assign to the user, this will automatically be hashed and salted before storing in the database. **NOTE** you need to inform the user about the password you have created for them.
+    *   **Active**: Must be true for the user to have access to the dashboard or the dashboard API.
+
+4. **Set the user permissions**
+
+    <img src="/img/2.10/user_permissions.png" alt="Admin checkbox location" />
+
+    You can be very specific with regards to which pages and segments of the Dashboard the user has access to. Some Dashboard pages require access to multiple parts of the API, and so you may get errors if certain related elements are disabled (e.g. APIs + Policies)
+
+    Permissions are set and enforced when they are set on this page. They can either be **read** or **write**. If  set to **deny** then the record is non-existent in the object (there is no explicit "deny"). This means that if you set **deny** on all options it looks as if they have not been written, but they will still be enforced so long as even one read or write option has been set.
+
+5. **Click "Save"**
+
+    <img src="/img/2.10/users_save.png" alt="Save button location" />
+
+    The user will automatically be created, as will their API Access token, which you will be able to retrieve by opening the user listing page again and selecting the user's username.
+
+### Using Dashboard API
+
+To authenticate requests to the Tyk Dashboard API, you will need to provide an API Key in the `Authorization` header.
+
+This is your **Tyk Dashboard API Access Credentials**, which can be found on the user detail page:
+
+<img src="/img/2.10/user_credentials.png" alt="API key and RPC key locations" />
+
+You can [create a user](https://tyk.io/docs/api-reference/users/add-user) with a call to the `POST /api/users` endpoint, for example:
+
+``` bash
+curl -H "Authorization: {YOUR-TYK-DASHBOARD-API-ACCESS-CREDENTIALS}" \
+ -s \
+ -H "Content-Type: application/json" \
+ -X POST \
+ -d '{
+  "first_name": "Test",
+  "last_name": "User",
+  "email_address": "test@testing.com",
+  "active": true,
+  "user_permissions": {
+      "IsAdmin": "admin"
+  },
+  "password": "thisisatest"
+ }' http://{your-dashboard-host}:{port}/api/users | python -mjson.tool
+```
+
+In this example, we have given the user Admin privileges. To see a detailed breakdown of permission objects, please see below.
+
+You will see the following response to confirm that the user has been created:
+
+```json
+{
+  "Message": "User created",
+  "Meta": null,
+  "Status": "OK"
+}
+```
+
+The user is now active.
+
+## Manage User Passwords
+You can change your password in these circumstances:
+
+*  If you have forgotten your password
+*  If you wish to change your password
+
+### Forgotten Your Password?
+If you have forgotten your password, you can request a password reset email from the **Dashboard Login** screen:
+
+<img src="/img/2.10/dashboard_login.png" alt="password reset email" />
+
+Enter your login email address, and you will receive an email with a link that enables you to create a new password.
+
+
+<Note>
+This link will only be valid for 1000 seconds
+<br/>
+You will need to configure your [outbound email settings](/configure/outbound-email-configuration) to enable this feature.
+</Note>
+
+
+### Change Your Password
+If you wish to change your current password, from the **System Management > Users** screen, select **Edit** for your Username.
+
+
+<Note>
+You will not be able to change the password for other Dashboard users.
+</Note>
+
+
+From your user details, click **Reset Password**:
+
+<img src="/img/2.10/user_reset_password.png" alt="reset password button" />
+Enter your current and new password (and confirm it) in the dialog box that is displayed, and click **Reset Password**.
+You will automatically be logged out of the Dashboard and will have to enter your username and new password to log back in.
+
+## Search Users
+
+You can search for a user (by email address) by entering the address in the search field. The user list will automatically refresh with that user being displayed.
+
+<img src="/img/2.10/user_search.png" alt="User Profile Search" />
+
+## Password Policy
+
+Tyk allows you to control password requirements for Dashboard users, developers (i.e. users registered to the developer portal) and basic auth keys. 
+Please note: This configuration is enforced by the Tyk-Dashboard and as such is not available in the Tyk Open Source Edition. Also, since it requires access to the Tyk Dashboard installation folder, it is *currently* not available for Tyk Cloud clients.
+
+There are other security options available from the Dashboard config file. See the [security section](/tyk-dashboard/configuration#security) for more details.
+
+You can find the configuration files in the `schemas` directory of your Tyk Dashboard installation folder, as follows: 
+- For Dashboard users you define policy in `schemas/password.json` 
+- For developers you define policy in `schemas/developer_password.json`
+- For basic auth keys you define policy in `./schemas/basic_auth.json`
+
+
+The following validators are available:
+
+*   `minLength` - sets minimum password length
+*   `multiCase` - boolean, upper and lower case characters are required
+*   `minNumeric` - minimum number of numeric characters
+*   `minSpecial` - minimum number of special characters, like `@`, `$`, `%` etc.
+*   `disableSequential` - boolean, disable passwords which include at least 3 sequential characters. For example: `abc`, `123`, `111`, `xxx` etc.
+
+Below is an example of `password.json` file, with all options turned on:
+
+```{.copyWrapper}
+{
+  "title": "User password schema",
+  "type": "string",
+
+  "minLength": 6,
+  "multiCase": true,
+  "minNumeric": 2,
+  "minSpecial": 2,
+  "disableSequential": true
+}
+```
+
diff --git a/platform-management/open-policy-agent.mdx b/platform-management/open-policy-agent.mdx
new file mode 100644
index 0000000000..56b743be6f
--- /dev/null
+++ b/platform-management/open-policy-agent.mdx
@@ -0,0 +1,485 @@
+---
+title: "Extend Permissions using Open Policy Agent"
+description: "Learn how to extend and customize Tyk Dashboard permissions using Open Policy Agent (OPA) rules"
+keywords: "Open Policy Agent, OPA, Permissions, RBAC, Role Based Access Control, Dashboard Security"
+sidebarTitle: "Open Policy Agent (OPA)"
+---
+
+import OpaRules from '/snippets/opa-rules.mdx';
+
+## Overview
+
+The Tyk Dashboard permission system can be extended by writing custom rules using an Open Policy Agent (OPA). The rules engine works on top of your Dashboard API, which means you can control not only access rules, but also behavior of all Dashboard APIs (except your public developer portal).
+
+To give you some inspiration here are some ideas of the rules you can implement now:
+
+* Enforce HTTP proxy option for all APIs for which the target URL does not point at the internal domain
+* Control access for individual fields. For example, do not allow changing the API "active" status (e.g. deploy), unless you have a specific permission set (and make new permissions to be available to the Dashboard/API). Custom permissions can be creating using the [Additional Permissions API](https://tyk.io/docs/api-reference/additional-permissions/list-additional-permissions)
+* Have a user(or group) which has read access to one APIs and write to another
+
+We have a video that demonstrates how our Open Policy Agent enables you to add custom permissions.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/r7sTaqTtaHk" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+### Configuration
+
+By default the Dashboard OPA engine is turned off, and you need to explicitly enable it via your Dashboard `tyk_analytics.conf` file.
+You can then control OPA functionality on a global level via your `tyk_analytics.conf` file, or at an organization level using either the [OPA API](https://tyk.io/docs/api-reference/open-policy-agent/list-opa-rules) or the [Dashboard](#using-the-open-policy-agent-in-the-dashboard).
+
+|   Key                               	|   Type        	|   Description                                                                                                          	|   Example                   	|
+| :------------------------------------- | :--------------- | :------------------------------------------------------------------------------------------------------------------------ | :----------------------------- |
+|   security.open_policy.enabled      	|   boolean     	|   Toggle support for OPA                                                                                               	|   false                     	|
+|   security.open_policy.debug        	|   boolean     	|   Enable debugging mode, prints a lot of information to the console                                                    	|   false                     	|
+|   security.open_policy.enable_api   	|   boolean     	|   Enable access to the OPA API, even for users with Admin role                                                         	|   false                     	|
+|   security.additional_permissions   	|   string map  	|   Add custom user/user_group permissions. You can use them in your rules, and they will be displayed in the Dashboard  	|   `{"key": "human name"}`   	|
+
+### Example
+
+```json
+"basic-config-and-security/security": {
+  "open_policy": {
+    "enabled":true,
+    "debug": true,
+    "enable_api": true
+  },
+  "additional_permissions": {}
+}
+```
+
+
+With the OPA turned on, the majority of the security rules will be dynamically evaluated based on these rules.
+
+Additionally, users can modify OPA rules, and define their own, through the [OPA API](https://tyk.io/docs/api-reference/additional-permissions/list-additional-permissions). For Self-Managed installations you can access and modify the OPA rules from your Tyk installation directory from [schemas/dashboard.rego](/platform-management/open-policy-agent#dashboard-opa-rules).
+Moreover, using these rules you can also modify request content. Our recommendation is to use those modifications in a development environment and remember to create a backup of the rego rules.
+
+### Language intro
+
+The Open Policy Agent (OPA, pronounced “oh-pa”) is an open source, general-purpose policy engine that unifies policy enforcement across the stack. OPA provides a high-level declarative language (Rego) that lets you specify policy as code and simple APIs to offload policy decision-making from your software. (source: https://www.openpolicyagent.org/docs/latest/)
+
+### Tyk policy primitives
+The main building block which is required for controlling access is a "deny" rule, which should return a detailed error in case of a rejection. You can specify multiple deny rules, and they will all be evaluated. If none of the rules was matched, user will be allowed to access the resource.
+
+A simple deny rule with a static error message can look like:
+
+```javascript
+deny["User is not active"] {
+  not input.user.active
+}
+```
+
+You can also specify a dynamic error message:
+
+```javascript
+# None of the permissions was matched based on path
+deny[x] {
+  count(request_permission) == 0
+  x := sprintf("Unknown action '%v'", [input.request.path])
+}
+```
+
+In addition, to `deny` rules, you can also modify the requests using `patch_request`.
+You should respond with a JSON merge patch format https://tools.ietf.org/html/rfc7396
+For example:
+
+```javascript
+# Example: Enforce http proxy configuration for an APIs with category #external.
+patch_request[x] {
+  request_permission[_] == "apis"
+  request_intent == "write"
+  contains(input.request.body.api_definition.name, "#external")
+
+  x := {"api_definition": {"proxy": {"transport": {"proxy_url": "http://company-proxy:8080"}}}}
+}
+```
+
+
+### Getting Tyk Objects
+In some cases, you may want to write a rule which is based on existing Tyk Object.
+For example, you can write a rule for a policy API, which depends on the metadata of the API inside it.
+The policy engine has access to the `TykAPIGet` function, which essentially just does a GET call to the Tyk Dashboard API.
+
+Example:
+
+```javascript
+api := TykAPIGet("/apis/api/12345")
+contains(api.target_url, "external.com")
+```
+
+Getting changeset of current request
+For requests which modify the content, you can get a changeset (e.g. difference) using the `TykDiff` function, combined with a `TykAPIGet` call to get the original object. 
+
+Example:
+
+```javascript
+# Example of the complex rule which forbids user to change API status, if he has some custom permission
+deny["You are not allowed to change API status"] {
+  input.user.user_permissions["test_disable_deploy"]
+
+  # Intent is to to update API
+  request_permission[_] == "apis"
+  request_intent == "write"
+
+  # Lets get original API object, before update
+  # TykAPIGet accepts API url as argument, e.g. to receive API object call: TykAPIGet("/api/apis/<api-id>")
+  api := TykAPIGet(input.request.path)
+
+  # TykDiff performs Object diff and returns JSON Merge Patch document https://tools.ietf.org/html/rfc7396
+  # For example if only state has changed diff may look like: {"api_definition":{"state": "active"}}
+  diff := TykDiff(api, input.request.body)
+
+  # API state has changed
+  not is_null(diff.api_definition.active)
+}
+```
+
+### Developer guide
+Since Opa rules are declarative, to test them in the majority of the cases, you can test your rules without using the Tyk Dashboard, and using this Rego [playground](https://play.openpolicyagent.org).
+When it comes to the `TykAPIGet` and `TykDiff` functions, you can mock them in your tests.
+
+In order to understand how the Dashboard evaluates the rules, you can enable debugging mode by setting the `security.open_policy.debug` option, and in the Dashboard logs, you will see the detailed output with input and output of the rule engine. It can be useful to copy-paste the Dashboard log output to the Rego playground, fix the issue, and validate it on the Dashboard.
+
+When you modify the `dashboard.opa` file, you will need to restart your tyk Dashboard.
+
+### Using the Open Policy Agent in the Dashboard
+
+As well as configuring OPA rules through the API, admin users can view and edit OPA rules from within the Tyk Dashboard. The advantage of configuring your OPA rules in the Dashboard is that you can use a code editor for it, emulating a proper developer experience. There are two ways you can do this:
+
+1. From the **OPA Rules menu**. From the Dashboard Management menu, select OPA Rules. You can view and make any changes and select whether your OPA rules should be enabled or disabled.
+
+<img src="/img/dashboard/system-management/opa-rules-menu.png" alt="OPA Rules Menu" />
+
+2. From **Developer Tools**. Using the keyboard shortcut `CMD+SHIFT+D` (or `CTRL+SHIFT+D` for PC), you can open the Developer Tools panel on any page in the Dashboard and configure the permissions. Updates are applied in real-time.  
+
+
+
+    <Note>
+    OPA rules can only be accessed by admin role users in the Dashboard.
+    </Note>
+
+
+<img src="/img/2.10/opa-floating.png" alt="OPA Floating UI" />
+<img src="/img/2.10/opa.png" alt="OPA screen" />
+
+### OPA Rule Precedence: Organization-Level Rules Override the File
+
+Tyk Dashboard evaluates OPA rules from one of two sources, with a strict precedence:
+
+1. **Organization-level rules (database)**. If a ruleset is stored at the organization level, Tyk Dashboard uses it and ignores the file.
+2. **File-based default (`schema/dashboard.rego`)**. Used only when no organization-level ruleset exists.
+
+OPA rules are stored at the organization level when:
+
+- the organization is first bootstrapped, where the default ruleset is seeded, or
+- you save rules through the [OPA API](https://tyk.io/docs/api-reference/open-policy-agent/list-opa-rules) (`PUT /api/org/opa`) or the Tyk Dashboard UI.
+
+To check which rules are currently stored at the organization level, use the [List OPA rules and settings](https://tyk.io/docs/api-reference/open-policy-agent/list-opa-rules) endpoint.
+
+<Warning>
+Because organization-level rules take precedence, editing `schema/dashboard.rego` (or its mounted ConfigMap on Kubernetes) has no effect while organization-level rules exist, even after a Tyk Dashboard restart. Setting `security.open_policy.enable_api: false` does not delete rules already stored at the organization level; they continue to load and be enforced.
+</Warning>
+
+#### Revert to the File-Based Ruleset
+
+To make Tyk Dashboard fall back to `schema/dashboard.rego`, clear the organization-level rules:
+
+1. Temporarily enable the OPA API in `tyk_analytics.conf` and restart:
+
+   ```json
+   "security": { "open_policy": { "enabled": true, "enable_api": true } }
+   ```
+
+   On Kubernetes, update the `opa` block in `values.yaml`:
+
+   ```yaml
+   dashboard:
+     opa:
+       enabled: true   # maps to security.open_policy.enabled
+       api: true       # maps to security.open_policy.enable_api
+   ```
+
+2. Back up the current rules:
+
+   ```bash
+   curl -s https://DASHBOARD_HOST/api/org/opa \
+     -H "Authorization: ADMIN_API_KEY" > opa-backup.json
+   ```
+
+3. Clear them with an empty ruleset:
+
+   ```bash
+   curl -s -X PUT https://DASHBOARD_HOST/api/org/opa \
+     -H "Authorization: ADMIN_API_KEY" -H "Content-Type: application/json" \
+     -d '{"open_policy":{"rules":""}}'
+   ```
+
+4. Confirm `GET /api/org/opa` now returns the `schema/dashboard.rego` ruleset. Tyk Dashboard now enforces `schema/dashboard.rego`, so your OPA policies come from the file mount. Set `enable_api: false` again and restart.
+
+To restore the previous rules, enable the API config again and `PUT` the backup:
+
+```bash
+curl -s -X PUT https://DASHBOARD_HOST/api/org/opa \
+  -H "Authorization: ADMIN_API_KEY" -H "Content-Type: application/json" \
+  -d @opa-backup.json
+```
+
+## Dashboard OPA rules
+
+<OpaRules/>
+
+## Configuring Open Policy Agent Rules
+
+This is an end-to-end worked example showing how to configure Open Policy Agent rules with some [additional permissions](https://tyk.io/docs/api-reference/additional-permissions/list-additional-permissions).
+
+### Use Case
+
+Tyk's [RBAC](/api-management/user-management) includes out of the box permissions to Write, Read, and Deny access to API Definitions, but what if we want to distinguish between those users who can create APIs and those users who can edit or update APIs? Essentially, we want to extend Tyk's out of the box RBAC to include more fine grained permissions that prevent an `API Editor` role from creating new APIs, but allow them to edit or update existing APIs.
+
+### High Level Steps
+
+The high level steps to realize this use case are as follows:
+
+1. Create additional permissions using API
+2. Create user
+3. Add Open Policy Agent Rule
+4. Test new rule
+
+
+### Create additional permissions
+
+To include the `API Editor` role with additional permissions, send a PUT Request to the [Dashboard Additional Permissions API endpoint](https://tyk.io/docs/api-reference/additional-permissions/list-additional-permissions) `/api/org/permissions`
+
+**Sample Request**
+
+In order to add the new role/permissions use the following payload.
+
+```console
+PUT /api/org/permissions HTTP/1.1
+Host: localhost:3000
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+
+{
+  "additional_permissions": {
+    "api_editor": "API Editor"
+  }
+}
+```
+
+**Sample Response**
+
+```json
+{
+  "Status": "OK",
+  "Message": "Additional Permissions updated in org level",
+  "Meta": null
+}
+```
+
+<br />
+
+<Note>
+Remember to set the `authorization` header to your Tyk Dashboard API Access Credentials secret, obtained from your user profile on the Dashboard UI.
+
+This assumes no other additional permissions already exist.  If you're adding to existing permissions you'll want to send a GET to `/api/org/permissions` first, and then add the new permission to the existing list.
+</Note>
+
+
+### Create user
+In the Dashboard UI, navigate to System Management -> Users, and hit the `Add User` button.  Create a user that has API `Write` access and the newly created `API Editor` permission, e.g.  
+
+<img src="/img/dashboard/system-management/userAdditionalPermission.png" alt="User with Additional Permission" />
+
+#### Add Open Policy Agent (OPA) Rule
+
+In the Dashboard UI, navigate to Dashboard Management -> OPA Rules
+
+Edit the rules to add the following:
+
+```
+request_intent = "create" { input.request.method == "POST" }
+request_intent = "update" { input.request.method == "PUT" }
+
+
+# Editor and Creator intent
+intent_match("create", "write")
+intent_match("update", "write")
+
+
+# API Editors not allowed to create APIs
+deny[x] {
+  input.user.user_permissions["api_editor"]
+  request_permission[_] == "apis"
+  request_intent == "create"
+  x := "API Editors not allowed to create APIs."
+}
+```
+
+Updated Default OPA Rules incorporating the above rules as follows:
+
+```bash
+# Default OPA rules
+package dashboard_users
+default request_intent = "write"
+request_intent = "read" { input.request.method == "GET" }
+request_intent = "read" { input.request.method == "HEAD" }
+request_intent = "delete" { input.request.method == "DELETE" }
+request_intent = "create" { input.request.method == "POST" }
+request_intent = "update" { input.request.method == "PUT" }
+# Set of rules to define which permission is required for a given request intent.
+# read intent requires, at a minimum, the "read" permission
+intent_match("read", "read")
+intent_match("read", "write")
+intent_match("read", "admin")
+# write intent requires either the "write" or "admin" permission
+intent_match("write", "write")
+intent_match("write", "admin")
+# delete intent requires either the "write" or "admin permission
+intent_match("delete", "write")
+intent_match("delete", "admin")
+# Editor and Creator intent
+intent_match("create", "write")
+intent_match("update", "write")
+# Helper to check if the user has "admin" permissions
+default is_admin = false
+is_admin {
+    input.user.user_permissions["IsAdmin"] == "admin"
+}
+# Check if the request path matches any of the known permissions.
+# input.permissions is an object passed from the Tyk Dashboard containing mapping between user permissions (“read”, “write” and “deny”) and the endpoint associated with the permission. 
+# (eg. If “deny” is the permission for Analytics, it means the user would be denied the ability to make a request to ‘/api/usage’.)
+#
+# Example object:
+#  "permissions": [
+#        {
+#            "permission": "analytics",
+#            "rx": "\\/api\\/usage"
+#        },
+#        {
+#            "permission": "analytics",
+#            "rx": "\\/api\\/uptime"
+#        }
+#        ....
+#  ]
+#
+# The input.permissions object can be extended with additional permissions (eg. you could create a permission called ‘Monitoring’ which gives “read” access to the analytics API ‘/analytics’). 
+# This is can be achieved inside this script using the array.concat function.
+request_permission[role] {
+	perm := input.permissions[_]
+	regex.match(perm.rx, input.request.path)
+	role := perm.permission
+}
+# --------- Start "deny" rules -----------
+# A deny object contains a detailed reason behind the denial.
+default allow = false
+allow { count(deny) == 0 }
+deny["User is not active"] {
+	not input.user.active
+}
+# If a request to an endpoint does not match any defined permissions, the request will be denied.
+deny[x] {
+	count(request_permission) == 0
+	x := sprintf("This action is unknown. You do not have permission to access '%v'.", [input.request.path])
+}
+deny[x] {
+	perm := request_permission[_]
+	perm != "ResetPassword"
+	not is_admin
+	not input.user.user_permissions[perm]
+	x := sprintf("You do not have permission to access '%v'.", [input.request.path])
+}
+# Deny requests for non-admins if the intent does not match or does not exist.
+deny[x] {
+	perm := request_permission[_]
+	not is_admin
+	not intent_match(request_intent, input.user.user_permissions[perm])
+	x := sprintf("You do not have permission to carry out '%v' operation.", [request_intent, input.request.path])
+}
+# If the "deny" rule is found, deny the operation for admins
+deny[x] {
+	perm := request_permission[_]
+	is_admin
+	input.user.user_permissions[perm] == "deny"
+	x := sprintf("You do not have permission to carry out '%v' operation.", [request_intent, input.request.path])
+}
+# Do not allow users (excluding admin users) to reset the password of another user.
+deny[x] {
+	request_permission[_] = "ResetPassword"
+	not is_admin
+	user_id := split(input.request.path, "/")[3]
+	user_id != input.user.id
+	x := sprintf("You do not have permission to reset the password for other users.", [user_id])
+}
+# Do not allow admin users to reset passwords if it is not allowed in the global config
+deny[x] {
+	request_permission[_] == "ResetPassword"
+	is_admin
+	not input.config.security.allow_admin_reset_password
+	not input.user.user_permissions["ResetPassword"]
+	x := "You do not have permission to reset the password for other users. As an admin user, this permission can be modified using OPA rules."
+}
+# API Editors not allowed to create APIs
+deny[x] {
+  input.user.user_permissions["api_editor"]
+  request_permission[_] == "apis"
+  request_intent == "create"
+  x := "API Editors not allowed to create APIs."
+}
+# --------- End "deny" rules ----------
+##################################################################################################################
+# Demo Section: Examples of rule capabilities.                                                                   #
+# The rules below are not executed until additional permissions have been assigned to the user or user group.    #
+##################################################################################################################
+# If you are testing using OPA playground, you can mock Tyk functions like this:
+#
+# TykAPIGet(path) = {}
+# TykDiff(o1,o2) = {}
+#
+# You can use this pre-built playground: https://play.openpolicyagent.org/p/T1Rcz5Ugnb
+# Example: Deny users the ability to change the API status with an additional permission.
+# Note: This rule will not be executed unless the additional permission is set.
+deny["You do not have permission to change the API status."] {
+	# Checks the additional user permission enabled with tyk_analytics config: `"additional_permissions":["test_disable_deploy"]`
+	input.user.user_permissions["test_disable_deploy"]
+	# Checks the request intent is to update the API
+	request_permission[_] == "apis"
+	request_intent == "write"
+	# Checks if the user is attempting to update the field for API status.
+	# TykAPIGet accepts API URL as an argument, e.g. to receive API object call: TykAPIGet("/api/apis/<api-id>")
+	api := TykAPIGet(input.request.path)
+	# TykDiff performs Object diff and returns JSON Merge Patch document https://tools.ietf.org/html/rfc7396
+	# eg. If only the state has changed, the diff may look like: {"active": true}
+	diff := TykDiff(api, input.request.body)
+	# Checks if API state has changed.
+	not is_null(diff.api_definition.active)
+}
+# Using the patch_request helper you can modify the content of the request
+# You should respond with JSON merge patch. 
+# See https://tools.ietf.org/html/rfc7396 for more details
+#
+# Example: Modify data under a certain condition by enforcing http proxy configuration for all APIs with the #external category. 
+patch_request[x] {
+    # Enforce only for users with ["test_patch_request"] permissions.
+    # Remove the ["test_patch_request"] permission to enforce the proxy configuration for all users instead of those with the permission.
+    input.user.user_permissions["test_patch_request"]
+    request_permission[_] == "apis"
+    request_intent == "write"
+    contains(input.request.body.api_definition.name, "#external")
+    x := {"api_definition": {"proxy": {"transport": {"proxy_url": "http://company-proxy:8080"}}}}
+}
+# You can create additional permissions for not only individual users, but also user groups in your rules.
+deny["Only '%v' group has permission to access this API"] {
+    # Checks for the additional user permission enabled with tyk_analytics config: '"additional_permissions":["test_admin_usergroup"]
+    input.user.user_permissions["test_admin_usergroup"]
+    # Checks that the request intent is to access the API.
+    request_permission[_] == "apis"
+    api := TykAPIGet(input.request.path)
+    # Checks that the API being accessed has the category #admin-teamA
+    contains(input.request.body.api_definition.name, "#admin-teamA")
+    # Checks for the user group name.
+    not input.user.group_name == "TeamA-Admin"
+}
+```
+
+### Test
+Login to the Dashboard UI as the new `API Editor` user and try to create a new API.  You should see an `Access Denied` error message.  Now try to update an existing API.  This should be successful!!
+
+
diff --git a/platform-management/user-groups.mdx b/platform-management/user-groups.mdx
new file mode 100644
index 0000000000..8075881d0f
--- /dev/null
+++ b/platform-management/user-groups.mdx
@@ -0,0 +1,77 @@
+---
+title: "Manage Tyk Dashboard User Groups"
+description: "Learn how to organize Tyk Dashboard users into user groups (teams) to simplify role assignment and permissions management"
+keywords: "Dashboard, User Groups, Teams, RBAC, Role Based Access Control, Permissions"
+sidebarTitle: "Manage User Groups"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+
+Tyk has a flexible [user permissions](/platform-management/user-permissions) system that provides Role Based Access Control (RBAC) for your Tyk Dashboard.
+
+When you have a large number of users and teams with different access requirements, instead of setting permissions per *user*, you can create a *user group* and configure the permissions for all users in the group. For example, if you only want certain *users* to access the Tyk Logs, you could create a "Logs Users" *user group*, then give those users the *Logs Read* permission and add them to your *Logs Users* group.
+
+Note that **a user can only belong to one group**.
+
+You must have either *admin* or *user groups* permission to be able to modify user groups.
+
+This also works for Single Sign-On (SSO), as you can specify the user group ID when setting up SSO.
+
+
+<Note>
+The availability of this feature depends on your license.
+<br />
+For further information, please check our [price comparison](https://tyk.io/price-comparison/) or consult our sales and expert engineers:
+<ButtonLeft href="https://tyk.io/contact/" color="green" content="Contact us" />
+</Note>
+
+
+
+## Using Dashboard UI
+
+1. **Select "User Groups" from the "System Management" section**
+
+    <img src="/img/2.10/user_groups_menu.png" alt="User group menu" />
+
+2. **Click "ADD NEW USER GROUP"**
+
+    <img src="/img/2.10/add_user_group.png" alt="Add user group location" />
+
+3. **Add User Group Name**
+
+    Enter the name for your User Group, and an optional Description.
+
+    <img src="/img/2.10/user_group_details.png" alt="Add name" />
+
+4. **Set User Group Permissions**
+
+    Selet the User Group Permissions you want to apply.
+
+    <img src="/img/2.10/user_group_permissions.png" alt="Add permissions" />
+
+5. **Click "Save" to create the Group**
+
+    <img src="/img/2.10/user_group_save.png" alt="Click Save" />
+
+6. **Add Users to your Group**
+
+    1. From the **Users** menu, select **Edit** from the **Actions** drop-down list for a user to add to the group.
+    2. Select your group from the **User group** drop-down list.
+
+    <img src="/img/2.10/user_select_group.png" alt="select user group" />
+
+    Click Update to save the User details
+
+    <img src="/img/2.10/user_reset_password.png" alt="update user" />
+
+## Using Dashboard API
+
+You can also manage User Groups via our [Dashboard API](https://tyk.io/docs/api-reference/usergroup/list-user-groups). The following functions are available:
+
+* [List all User Groups](https://tyk.io/docs/api-reference/usergroup/list-user-groups)
+* [Get a User Group via the User Group ID](https://tyk.io/docs/api-reference/usergroup/get-user-group-details)
+* [Add a User Group](https://tyk.io/docs/api-reference/usergroup/create-user-group)
+* [Update a User Group](https://tyk.io/docs/api-reference/usergroup/update-user-group)
+* [Delete a User Group](https://tyk.io/docs/api-reference/usergroup/delete-user-group)
+
diff --git a/platform-management/user-permissions.mdx b/platform-management/user-permissions.mdx
new file mode 100644
index 0000000000..836ab5ef3a
--- /dev/null
+++ b/platform-management/user-permissions.mdx
@@ -0,0 +1,69 @@
+---
+title: "User Permissions"
+description: "Learn how to configure and enforce role-based access control (RBAC) for Tyk Dashboard users, including admin users and custom permissions"
+keywords: "User Permissions, RBAC, Role Based Access Control, Admin Users, Custom Permissions, Tyk Dashboard"
+sidebarTitle: "User Permissions"
+---
+
+
+The Tyk Dashboard is multi-tenant capable and allows granular, role based user access. Users can be assigned specific permissions to ensure that they only have very specific access to the Dashboard pages, and to the underlying API.
+
+It is important to note that all user roles are defined and enforced **at the Dashboard API level**, and the UI is merely reactive.
+
+## Admin Users
+
+An *admin* user has read and write access to all properties. The initial user created during the dashboard's bootstrapping process is automatically assigned the *admin* role.
+
+There are two configuration parameters that restrict the admin user’s capabilities. For enhanced security, both of these values should be set to `true`:
+
+- [security.forbid_admin_view_access_token](/tyk-dashboard/configuration#security-forbid_admin_view_access_token): This parameter restricts admin users from viewing other users' Dashboard API Access Credentials, both in the API and the UI.
+  
+- [security.forbid_admin_reset_access_token](/tyk-dashboard/configuration#security-forbid_admin_reset_access_token): This parameter prevents admin users from resetting the access tokens of other users.
+## User permissions in the Tyk Dashboard API
+The permissions object, which is provided to the Dashboard API has this structure:
+
+```json
+"user_permissions": {
+  "IsAdmin": "false",
+  "analytics": "read",
+  "apis": "write",
+  "hooks": "write",
+  "idm": "write",
+  "keys": "write",
+  "policy": "write",
+  "portal": "write",
+  "system": "write",
+  "users": "write",
+  "user_groups": "write",
+  "audit_logs": "read"
+ }
+```
+
+Note that the above list may not be complete as more features and flexibility are added to the Tyk Dashboard.
+
+The way the permissions object works is that:
+ - if it contains `"IsAdmin":"true"`, the user is an *admin*
+ - if it contains no properties, the user is assumed to be an *admin*
+ - if it contains even just one property, it acts as an allow-list: only the listed properties are allowed
+ - any non-listed properties are denied
+ - permissable values for each section (other than `IsAdmin`) are: `read` or `write`; to deny access to a property you must remove the property from the `user_permissions` object
+
+An *admin* user can be identified either by setting `IsAdmin` to `true` or by setting no properties in the `user_permissions` object. 
+
+## User permissions in the Tyk Dashboard UI
+
+User permissions are configured in the user detail view:
+
+<img src="/img/2.10/user_permissions.png" alt="Admin account" />
+
+The configuration of each property will affect the dashboard navigation, with `denied` sections or screens hidden or disabled. Note that some side-effects can occur if pages that make use of multiple APIs to fetch configuration data cross over e.g. policies and API Definition listings.
+
+Selecting the **Account is Admin** checkbox from the Dashboard gives the user full access (it has the same [effect](/platform-management/user-permissions#admin-users) as the `IsAdmin` property).
+
+## Custom User Permissions
+
+You can create your own custom permissions for use with the [Open Policy Agent (OPA)](/platform-management/open-policy-agent) using the [Additional Permissions](https://tyk.io/docs/api-reference/additional-permissions/list-additional-permissions) endpoint in the Tyk Dashboard Admin API. This allows you to add and delete (CRUD) a list of additional (custom) permissions for your Dashboard users. Once created, a custom permission will be added to standard list of user permissions. 
+
+You can also configure these custom permissions in the `security.additional_permissions` [map](/tyk-dashboard/configuration#security-additional_permissions) in the Tyk Dashboard configuration file. 
+
+
diff --git a/portal/api-consumer.mdx b/portal/api-consumer.mdx
new file mode 100644
index 0000000000..27fa391ab6
--- /dev/null
+++ b/portal/api-consumer.mdx
@@ -0,0 +1,238 @@
+---
+title: "API Consumers"
+description: "Tyk Developer Portal users"
+keywords: "Developer Portal, Tyk, API Consumer, Developer, Organization, Invite Codes, Consumer Registration"
+sidebarTitle: "API Consumers"
+---
+
+## Introduction
+
+API Consumers are the developers and organizations who discover, access, and use your APIs through the Developer Portal. They represent your API program's audience - the very people for whom you're creating and exposing APIs. Effectively managing API Consumers is essential for creating a thriving API ecosystem that delivers value to both your organization and your developer community.
+
+Unlike [API Owners](/portal/api-owner) who administer the portal, API Consumers interact with your APIs through the Live Portal. They browse catalogs, request access to API Products, create applications, and use the credentials you provide to integrate with your services. The Developer Portal gives you powerful tools to organize these users, control their access, and facilitate collaboration among development teams.
+
+This guide focuses on managing individual API Consumer accounts. For information on organizing users into groups, see the [Organisation and Teams](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations) page.
+
+## API Consumer Roles
+
+The Developer Portal supports two distinct roles for API Consumers:
+
+### API Consumer Admin
+
+API Consumer Admins have elevated privileges within their Organisation, allowing them to:
+
+- Manage Team membership for all users in their Organisation
+- Invite new users to their Organisation (if enabled)
+- View all users within their Organisation
+- Access and manage shared Developer Apps
+
+This role is ideal for team leads, technical managers, or primary contacts at partner organizations who need to manage their developer teams.
+
+### Team Member
+
+Team Members have standard access to discover and use APIs:
+
+- Browse available API catalogs
+- Request access to API Products
+- Create and manage their own Developer Apps
+- View API documentation
+- Monitor their own API usage
+- Collaborate with other members of their Teams
+
+This role is appropriate for most developers who need to consume your APIs.
+
+
+## Creating API Consumer Accounts
+
+The Developer Portal offers multiple ways to create API Consumer accounts, giving you flexibility in how you onboard developers to your API ecosystem. Whether you're manually creating accounts for key partners, enabling team leaders to invite their colleagues, or allowing open self-registration, the Portal provides workflows to support your specific needs.
+
+Each creation method assigns appropriate default settings and permissions based on who initiates the process and where it takes place. Understanding these differences helps you choose the right approach for different user onboarding scenarios.
+
+<br />
+
+<Note>
+**Email Configuration Required**  
+
+Before using invitation workflows or self-registration, you must configure the Developer Portal's email settings. The portal relies on email communication to:
+
+- Send invitations to new API Consumer team members
+- Deliver registration confirmation links
+- Provide password reset functionality
+
+Please refer to the [email server configuration](/product-stack/tyk-enterprise-developer-portal/getting-started/setup-email-notifications) section for setup instructions.
+<br />
+Without proper email configuration, these features will not function correctly. API Owners can still manually create accounts through the Admin Portal without email configuration, but you'll need to communicate credentials to users through alternative channels.
+</Note>
+
+
+### Manual Creation by API Owners
+
+API Owners can create API Consumer Admin users from the Admin Portal as follows:
+
+1. Log in to the Admin Portal as an API Owner
+2. Navigate to **API Consumers > Users**
+3. Select **Add new user**
+4. Enter the required information:
+    - Email address (used for login)
+    - First and last name
+    - Organisation and Team assignments
+    - (optionally) Select the checkbox to activate the user immediately
+    - Initial Password
+    - (optionally) Select the checkbox to force the user to reset their password on first log in
+5. Select **Save changes**
+6. If you did not set an initial password in step 4, you will need to use the "Send Invite" action to send an email to the new user with registration instructions
+
+
+
+    <Note>
+    All API Consumer users created from the Admin Portal are granted the *API Consumer Admin* role.
+    </Note>
+
+
+### Invitation by API Consumer Admins
+
+API Consumer Admin users can invite additional API Consumer users from the Live Portal as follows:
+
+1. Log in to the Live Portal as an API Consumer Admin
+2. Navigate to **My Dashboard > Users**
+3. Select **Invite new user**
+4. Complete their first name, last name and email address
+5. Select the **role** that will be assigned to the new user (Admin or Team Member)
+6. Select which Team(s) to which the new user should be assigned
+7. Select **Send invite**
+8. Invitee receives an email with registration instructions
+
+
+
+    <Note>
+    All API Consumer users invited from the Live Portal will be [inactive](/portal/api-owner#activating-or-deactivating-user-accounts) until they complete the registration process. They will be assigned to the same Organisation as the Admin that invited them, as the Admin's scope is limited to their Organisation.
+    </Note>
+
+
+### Self-Registration
+
+If enabled, developers can register themselves with your Live Portal:
+
+1. Visit the Live Portal
+2. Select **Register**
+3. Complete the registration form
+    <img src="/img/dashboard/portal-management/enterprise-portal/create-account.png" alt="Form to create a developer portal account" />
+4. Select **Register to developer portal**
+5. If the portal requires an admin to [approve registration requests](/portal/api-owner#user-account-status), they will see the following message.
+    <img src="/img/dashboard/portal-management/enterprise-portal/account-email-popup.png" alt="Registration account submitted for admin approval" />
+6. If the portal is configured for [automatic approval](/portal/api-owner#automatically-approve-user-registrations), they will see a message that indicates that their account is active:
+    <img src="/img/dashboard/portal-management/enterprise-portal/account-registered.png" alt="Account registered to allow immediate access to the portal" />
+
+
+
+    <Note>
+    All API Consumer users created from the Self-Registration route are granted the *API Consumer Team Member* role.
+    </Note>
+
+
+#### Invite Codes
+
+Invite codes can be used to simplify user onboarding. Using invite codes, users will be directly assigned to a Team and Organisation, giving them the same access rights as this team. For example you can use invite codes to:
+
+- Run a promotional campaign like a Hackathon and give access to specific plans to the users.
+- Onboard a partner company into the portal by giving them this code for anyone registering.
+
+To generate an Invite Code, or retrieve existing codes to share with prospective developers:
+
+1. Log in to the Admin Portal as an API Owner
+2. Navigate to **API Consumers > Invite Codes**
+3. Select **Add new invite code**
+    <img src="/img/dashboard/portal-management/enterprise-portal/add-invite-code.png" alt="Invite Codes dialog" />
+
+4. Configure the invite code:
+    - **Quota**: this is the maximum number of times the code can be used to create Developer accounts
+    - **Expiry date**: this is the date on which the code will expire and no more users can sign up to it
+    - **Active**: if this option is selected, this means the code is avaliable for use and developers can start using it
+    - **All Teams**: select the Team to which any new users that register with this invite code will be added
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/invite-code-dialog.png" alt="Invite Codes dialog" />
+
+5. Select **Save changes**
+6. Copy and share the code for the Team that you wish the developer to join
+    <img src="/img/dashboard/portal-management/enterprise-portal/share-invite-codes.png" alt="Share Invite Codes dialog" />
+
+
+## Logging In
+
+If you are not using Single Sign On then to access the Developer Portal, simply navigate to the Portal UI in your browser and select the **Log in** button.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/navigate-to-the-login-page.png" alt="Open the login page" />
+<br />
+
+- Note that any Public Catalogs and Blogs will be available to you prior to logging in.
+- You will be taken to the log in page (`/auth/password/login`) where you enter the email address and password registered for your account.
+
+
+
+    <Note>
+    If you are using Single Sign-On (SSO) then Tyk does not provide a log in page and you should [create one](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso#initiating-sso-login).
+    </Note>
+
+
+After completing authentication, as an API Consumer, you will be taken to the [Live Portal](/portal/overview/concepts#developer-portal-views).
+
+
+## Managing API Consumer Users in the Live Portal
+
+In the Live Portal, users have visibility of Team Members and Admins with whom they share one or more Teams via the **Users** section of **My Dashboard** (accessed from the dropdown menu).
+
+- Team Members will see a read-only list of users (both active and inactive)
+- Admins will can edit the details of other users, including switching between Team Member and Admin role, and reassignment to other teams
+  - Admins can only control membership of teams of which they are also members
+  - Admins cannot change the [active](/portal/api-owner#user-account-status) status of other API Consumer users
+
+1. Navigate to **My Dashboard > Users**
+2. Use search to find the user you wish to view or manage (if required)
+3. Select **Edit** from the three dot menu, or **Edit details** after selecting the user's *name*
+4. Edit information as needed:
+    - Personal details
+    - Team assignments
+    - Role (Admin or Team Member)
+5. Select **Save changes**
+6. The user's permissions and details will update immediately
+
+### Deleting Users
+
+When an API Consumer Admin deletes a team member or another admin within an organization, the user is not actually deleted; instead, they are transferred to the `default_org`. The deleted user's apps are reassigned to the admin performing the deletion.
+
+## Access Control and Visibility
+
+### User Visibility Rules
+
+API Consumers can only see other users who are in the same Teams. This ensures appropriate privacy and separation between different developer groups.
+
+### Content Access
+
+A user's Organisation and Team memberships determine:
+
+- Which Catalogs they can access
+- Which API Products they can see
+- Which documentation they can view
+
+### Developer App Visibility
+
+Access to Developer Apps is controlled by the App's visibility setting:
+- Personal: Only visible to the [owner](/portal/developer-app#app-owner) (typically the creator) of the app
+- Team: Visible to all members of the creator's Teams
+- Organisation: Visible to all members of the creator's Organisation
+
+## Best Practices for API Consumer Management
+
+- Clear Onboarding: Create a streamlined onboarding process for new developers
+- Role Assignment: Grant Admin privileges selectively to trusted partners
+- Regular Audits: Periodically review user accounts and [deactivate](/portal/api-owner#user-account-status) or [delete](/portal/api-owner#deleting-users) users as appropriate
+- Documentation: Provide clear documentation about user roles and capabilities
+- Support Channels: Establish clear support channels for API Consumers
+- Feedback Loop: Create mechanisms for API Consumers to provide feedback
+
+## Troubleshooting Common Issues
+
+- Login Problems: Verify email address, check account status
+- Missing API Products: Check Team membership and Catalog visibility
+- Permission Denied: Verify user role and Team assignments
+- Cannot See Other Users: Confirm both users are in the same Team
diff --git a/portal/api-owner.mdx b/portal/api-owner.mdx
new file mode 100644
index 0000000000..35f9772b60
--- /dev/null
+++ b/portal/api-owner.mdx
@@ -0,0 +1,160 @@
+---
+title: "API Owners"
+description: "Tyk Developer Portal administrators"
+keywords: "Developer Portal, Tyk, Reference, API Owner, User Management, User, Admin"
+sidebarTitle: "API Owners"
+---
+
+## Introduction
+
+API Owners are the administrators who configure and manage your Tyk Developer Portal. They control the entire API lifecycle - from defining Products and Plans to managing user access and monitoring usage. With their privileged access to the Admin Portal, API Owners play a crucial role in shaping your API program's success.
+
+Unlike [API Consumers](/portal/api-consumer) who use your APIs, API Owners are responsible for curating the API experience. They make strategic decisions about which APIs to expose, how to package them, who can access them, and under what conditions. Effectively managing your API Owner users is essential for maintaining the security and integrity of your API program.
+
+Whether you're setting up your Developer Portal for the first time or refining your administrative structure, understanding how to properly manage API Owners will help you create a secure, well-governed API program.
+
+### API Owner Roles And Responsibilities
+
+An API Owner's responsibilities typically include:
+
+- API Product Management
+  - [Create and configure API Products](/portal/api-products)
+  - [Define Plans with appropriate rate limits and quotas](/portal/api-plans)
+  - [Organize Products into Catalogs](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues)
+  - [Maintain API documentation and guides](/portal/api-products#documentation)
+- User Administration
+  - [Create and manage API Consumer accounts](/portal/api-consumer)
+  - [Establish Organisations and Teams](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations)
+  - [Control access to Catalogs and API Products](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues#catalog-visibility)
+  - [Approve API access requests](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/approve-requests)
+- Portal Configuration
+  - [Customize the Live Portal experience](/portal/customization)
+  - [Set up email notifications](/product-stack/tyk-enterprise-developer-portal/getting-started/setup-email-notifications)
+  - [Integrate with OAuth 2.0 Identity Providers](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration)
+  - [Integrate with Single Sign On providers](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso)
+
+
+## Creating An API Owner User
+
+When the Developer Portal is first started, you will go through a [bootstrapping](/portal/install#bootstrapping-developer-portal) process during which an initial API Owner user will be created. When the bootstrapped user logs into the Portal, they will reach the Admin Portal. They can create additional API Owners from the **Settings > Admin Users** screen:
+
+1. Select **Add new admin user**
+2. Provide a first and last name for the new API Owner
+3. Provide a unique email address, which will be used when logging in
+4. Select **Active** to activate the user immediately
+5. Select **User must change password at the next login** to force the user to provide a new password when they access the Portal (recommended)
+6. Set an initial password for their first log in
+7. Select **Save changes**
+
+You will observe that the new user is automatically assigned a numeric *Id* and added to the list of **Admin Users**.
+
+<br />
+
+<Note>
+For legacy reasons, the original bootstrapped user is labelled as having the *super-admin* role, whereas subsequent users have the *provider-admin* role. There is no difference in capability between these roles.
+</Note>
+
+
+## Logging In
+
+If you are not using Single Sign On then to access the Developer Portal, simply navigate to the Portal UI in your browser and select the **Log in** button.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/navigate-to-the-login-page.png" alt="Open the login page" />
+<br />
+
+- Note that any Public Catalogs and Blogs will be available to you prior to logging in.
+- You will be taken to the log in page (`/auth/password/login`) where you enter the email address and password registered for your account.
+
+
+
+    <Note>
+    If you are using Single Sign-On (SSO) then Tyk does not provide a log in page and you should [create one](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso#initiating-sso-login).
+    </Note>
+
+
+After completing authentication, as an API Owner, you will be taken to the [Admin Portal](/portal/overview/concepts#developer-portal-views).
+
+## Managing Users in the Admin Portal
+
+In the Admin Portal, API Owners have visibility of and permission to manage all other user accounts created on the Developer Portal. There are two separate lists:
+
+- **API Consumers > Users**: API Consumer Admins and Team Members across all Organisations and Teams
+- **Settings > Admin users**: API Owners
+
+In each section, an API Owner can:
+
+- create new user accounts
+- edit existing user details
+- reassign API Consumers to different Organisations and Teams
+- approve/activate or deactivate users
+- delete users
+
+## User Account Status
+
+Users in the Developer Portal can have their accounts set to either active or inactive status. This status controls their ability to access the portal:
+
+ - Active users can log in and access the Developer Portal
+ - Inactive users cannot log in, even with correct credentials
+
+This status mechanism is also used when approving [self-registered users](/portal/api-consumer#self-registration), who remain inactive until approved by an administrator.
+
+### Activating or Deactivating User Accounts
+
+API Owners can change a user's active status at any time:
+
+1. Navigate to the user's profile in the Admin Portal:
+    - for API Consumers: **API Consumers > Users**
+    - for API Owners: **Settings > Admin users**
+2. Toggle the **active** checkbox to the required state
+3. Click **Save Changes**
+4. Changes take effect immediately - activated users can log in right away, while deactivated users will lose access
+
+**Note**: When users self-register, they appear as inactive until approved. Approving a user registration is the same as activating their account.
+
+### Automatically Approve User Registrations
+
+For trusted environments such as internal developer programs, you can eliminate the manual approval process for self-registered users. When enabled, new API Consumer accounts will be automatically activated upon registration.
+
+To enable this feature:
+
+1. Navigate to **Settings > General** in the Admin Portal
+2. Enable the **Auto-approve API consumers registering to the portal** option
+3. Select **Save changes**
+
+<img src="/img/dashboard/portal-management/enterprise-portal/auto-approve-users.png" alt="" />
+
+This setting is particularly useful for closed ecosystems where all potential users are pre-vetted or when you want to streamline the onboarding experience.
+
+**Note**: When automatic approval is enabled, all new registrations will immediately gain access to the Developer Portal without administrator review.
+
+
+### Deleting Users
+
+The API Owner can permanently remove a user from the Developer Portal as follows:
+
+1. Navigate to the appropriate user list in the Admin Portal:
+    - for API Consumers: **API Consumers > Users**
+    - for API Owners: **Settings > Admin users**
+2. Use search to find the user you wish to view or manage (if required)
+3. Select **Delete** from the three dot menu
+4. Confirm the deletion
+5. All user data will be permanently removed
+
+When an API Owner performs the delete action, both the user and their apps (and credentials) are permanently deleted.
+
+## Security Implications
+
+Given that all API Owners have full administrative access, it's especially important to:
+
+- Limit API Owner Accounts: Only create API Owner accounts for users who genuinely need full administrative access
+- Carefully Vet Administrators: Thoroughly verify the identity and trustworthiness of anyone granted API Owner status
+- Regular Audits: Periodically review the list of API Owners to ensure it remains current and appropriate
+- Prompt Removal: Immediately remove API Owner access when it's no longer needed
+
+## Best Practices for API Owner Management
+
+Since all API Owners have full access, consider these operational approaches:
+- Use External Identity Management: Implement SSO or other external identity solutions to control access
+- Implement Procedural Controls: Create operational procedures and policies for administrative actions
+- Maintain Documentation: Keep detailed records of who has API Owner access and why
+- Regular Training: Ensure all API Owners understand the responsibility that comes with full access
diff --git a/portal/api-plans.mdx b/portal/api-plans.mdx
new file mode 100644
index 0000000000..71a2256d55
--- /dev/null
+++ b/portal/api-plans.mdx
@@ -0,0 +1,247 @@
+---
+title: "API Plans"
+description: "Working with API Plans"
+keywords: "Developer Portal, Tyk, API Plan, Subscription Plan"
+sidebarTitle: "API Plans"
+---
+
+## Introduction
+
+API Plans, sometimes referred to as Subscription Plans, define the terms and conditions under which developers can access your [API Products](/portal/api-products). They establish the usage limits, approval requirements, and commercial tiers that govern API consumption. While API Products define what functionality is available, API Plans determine how much of that functionality can be used and under what conditions.
+
+API Plans transform access policies into business offerings by:
+- Establishing clear usage boundaries through rate limits and quotas
+- Creating tiered access levels that align with different customer segments
+- Supporting various business models from free to premium offerings
+- Enabling controlled API adoption through appropriate usage constraints
+
+In the Tyk Developer Portal, API Plans work alongside API Products to create a complete consumption model. Products define the "what" (functionality, documentation, value proposition), while Plans define the "how much" and "under what terms" aspects of your API strategy.
+
+When developers request access to an API Product, they must select a Plan that defines their usage rights. This separation of concerns allows you to create flexible combinations - offering the same API Product under different Plans for different use cases, or applying consistent Plan tiers across your entire API portfolio.
+
+## Understanding the Relationship Between Portal and Provider
+
+API Plans represent a powerful abstraction layer that sits on top of your underlying API infrastructure. Understanding how the Developer Portal interacts with the Provider (Tyk Dashboard) is essential for effective product management:
+
+### Data Distribution and Management
+
+All metadata relating to the API Product is stored within the Developer Portal, including:
+- Plan name and description
+- Catalog assignments and visibility settings
+- Custom fields
+
+The actual consumption limit policy that configures the API Gateway's rate limit, quota and authorization controls is managed by the Provider. This separation creates a clean division between presentation/discovery (Portal) and access control (Provider).
+
+<br />
+
+<Note>
+Once a consumption limit policy has been linked to an API Plan you are strongly recommended not to make changes to it from the Provider, but to manage the Plan in the Developer Portal.
+</Note>
+
+
+### Creation Workflows
+
+You can create API Plans through two primary workflows:
+
+#### Portal-First Approach (Recommended)
+
+When you create a Plan in the Developer Portal:
+
+- The Portal creates a corresponding consumption limit policy in the Tyk Dashboard
+- This policy defines what rate limits and quota allowances to permit for access keys using the Plan
+- The policy is automatically linked to the Plan in the Portal
+- You can then enhance the Plan with documentation and other metadata
+
+This approach gives you full control over the Plan's presentation and allows you to create a rich developer experience from the start.
+
+#### Dashboard-First Approach
+
+Alternatively, you can:
+
+- Create a partitioned consumption limit policy directly in the Tyk Dashboard
+- When you [synchronize](/portal/api-provider#synchronizing-developer-portal-with-providers) the Developer Portal with the Provider, a new API Plan will be created automatically
+- This Plan will be "bare bones" with a name derived from the Dashboard policy but no description or other metadata
+- You can then enhance this auto-created Plan through the Admin Portal interface
+- This approach is useful when you already have policies defined in your Dashboard
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/XYlaqy3UuNg" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+## Creating a New API Plan
+
+You can create a new API Plan in the Developer Portal by following these simple steps:
+
+1. Log in to the Developer Portal as an [API Owner](/portal/api-owner)
+2. Select the *Provider* that hosts the APIs you want to use
+3. Enter a descriptive **Name** for your Product
+4. Set the *Plan limits* that you wish this Plan to grant
+5. Select **Save Changes**
+
+Your new API Plan will now be available on the **Plans** page. You will need to publish the Plan to a Catalog for it to appear in the Live Portal.
+
+These are the minimal steps to create an Plan. You might want to select the Plan's tile and add some more configuration, such as a consumer friendly name and description, access key lifetime or JWT scopes. Remember to select **Save Changes** when you are done.
+
+## Dynamic Client Registration
+
+[Dynamic Client Registration (DCR)](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration) allows the Tyk Developer Portal to automatically register OAuth 2.0 clients with your Identity Provider when an API Consumer is granted access. Each API Plan used with DCR must have a unique [OAuth 2.0 scope](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration#oauth-2-0-scopes) assigned.
+
+To configure a Plan for DCR:
+
+1. Navigate to **Plans** and open the Plan you want to use with DCR.
+2. Select **Advanced Settings**.
+3. In the **Scopes** field, enter the OAuth 2.0 scope name for this Plan.
+4. Select **Save Changes**.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-plan-advanced-settings.png" alt="DCR scope configuration in Plan advanced settings" />
+
+<Warning>
+The scope must [exist in your Identity Provider](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration#define-oauth-2-0-scopes) when the API Plan is published, so that the IdP is able to issue tokens containing the scope.
+</Warning>
+
+## API Plan Reference Guide
+
+This comprehensive reference guide details all the configurable options and features of API Plans in the Tyk Developer Portal.
+
+### Core Features
+
+#### Plan Name
+
+The primary identifier for your API Plan.
+
+- **Location**: *Plans > Add/Edit Plan > Plan name*
+- **Purpose**: Identifies the Plan within both the Developer Portal and the Provider
+- **Behavior**: Used as the name for the partitioned rate limit/quota policy in the Provider
+- **Synchronization**:
+    - Modifying the name in the Portal immediately updates the policy name in the Provider
+    - Modifying the policy name in the Provider updates the Plan name during the next Portal synchronization
+**Best Practice**: Choose a clear, descriptive name that reflects the Plan's tier or purpose
+
+#### Provider
+
+The Tyk Dashboard instance that will enforce this Plan's rate limits and quotas.
+
+- **Location**: **Plans > Add/Edit Plan > Provider*
+- **Purpose**: Links the Plan to the correct Provider instance (where the policy will reside)
+- **Selection**: Choose from a dropdown list of all registered Providers
+
+### Plan Details
+
+#### Usage Quota
+
+Restricts the total number of requests a consumer can make over a time period, to enforce usage limits for consumption tiers.
+
+- **Location**: *Plans > Add/Edit Plan > Usage quota*
+- **Configuration**: Enter the maximum number of requests and select time frame from dropdown
+- **Unlimited Requests**: Select the checkbox to set an unlimited quota for this Plan
+
+#### Rate Limit
+
+Restricts the maximum rate of requests a consumer can make over a short period, to distribute API capacity fairly across all consumers.
+
+- **Location**: *Plans > Add/Edit Plan > Rate limit*
+- **Configuration**: Enter the maximum number of requests and the time window (in seconds)
+- **Unlimited Requests**: Select the checkbox to set no rate limit for this Plan; note that an [API-level rate limit](/api-management/rate-limit#rate-limiting-scopes-api-level-vs-key-level) would still be applied if configured.
+
+#### Key Lifetime
+
+Configures the lifetime for access credentials (keys) issued when a Developer App subscribes to the Plan.
+
+- **Location**: *Plans > Add/Edit Plan > Key expires after*
+- **Purpose**: Enforces security best practices by requiring periodic credential rotation
+- **Selection**: Choose from a dropdown list of available key lifetimes
+- **Behavior**: When credentials expire, developers must request new ones to maintain access
+
+#### JWT Scopes
+
+JWT scopes that will be used in the OAuth 2.0 flow to apply the Plan
+
+- **Location**: *Plans > Add/Edit Plan > Advanced settings > Scopes*
+- **Purpose**: Defines the JWT scopes that the access token must present to the Gateway to apply this Plan
+- **Configuration**: Space or comma-separated permission strings (e.g., "read:users", "write:data")
+- **Behavior**: This configuration is required when the Plan is used with an API Product for which the [Dynamic Client Registration](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration) flow has been activated
+    - The scope must already exist in your Identity Provider. The Portal associates it with the registered OAuth client when an access request is approved but does not create it.
+    - When an access request is approved, the scope is added to the API's scope-to-policy mapping in the Identity Provider Registry (or directly in the API definition for pre-5.14.0 deployments).
+    - The scope does not appear in the consumption limit policy created on Tyk Dashboard.
+    - When a JWT presenting the Plan's scope is received by Tyk Gateway, the Gateway [applies the Plan to the session](/basic-config-and-security/security/authentication-authorization/json-web-tokens).
+
+#### Additional Metadata
+
+Custom key-value pairs that are attached to all access credentials issued under this Plan.
+
+- **Location**: *Plans > Add/Edit Plan > Advanced settings > Credential metadata*
+- **Purpose**: Provides additional context to the Tyk Gateway for request processing and transformation
+- **Components**:
+    - Metadata Key: The identifier for this metadata (e.g., "plan_tier", "rate_group")
+    - Metadata Value: The corresponding value (e.g., "premium", "high_volume")
+- **Behavior**: This metadata is:
+    - Added to the headers of all requests made using credentials issued under this Plan
+    - Available to middleware in the Tyk Gateway for custom processing
+- **Use Cases**:
+    - Request Transformation: Modify requests based on Plan tier
+    - Routing Logic: Direct traffic to different backend services
+    - Analytics Segmentation: Track API usage by Plan type
+    - Custom Middleware: Enable Plan-specific behaviors in custom plugins
+- **Example**: A metadata pair of `plan_tier:premium` could trigger special handling for premium subscribers
+- **Best Practice**:
+    - Use consistent naming conventions for metadata keys across all Plans
+    - Keys and values should be kept reasonably short to minimize header size
+    - Avoid sensitive information as metadata may be logged
+
+### Live Portal Presence
+
+#### Catalog Assignment
+
+Determines which API Catalogs include this Plan.
+
+- **Location**: *Plans > Add/Edit Plan > Accessible in the following catalogues*
+- **Purpose**: Controls Plan availability for different developer audiences
+- **Options**: Select one or more Catalogs where this Plan should appear
+- **Behavior**: Plan will only be visible to developers with access to the selected Catalogs
+
+#### Catalog Display Name
+
+The Plan name as shown in the Live Portal.
+
+- **Location**: *Plans > Add/Edit Plan > Catalogue display name*
+- **Purpose**: May differ from internal Plan name for marketing purposes
+- **Example**: Internal name "Basic Rate Limit Policy" could have a display name "Bronze Access"
+
+#### Plan Description
+
+A brief summary of the Plan that will be visible to developers.
+
+- **Location**: *Plans > Add/Edit Plan > Plan description*
+- **Purpose**: Helps developers understand what the Plan offers
+- **Format**: Rich text editor supporting basic formatting
+- **Content**: Typically includes key limits, features, and target use cases
+
+### Approval and Access Control
+
+#### Auto-approve Provisioning Requests
+
+Controls whether access requests require manual approval.
+
+- **Location**: *Plans > Add/Edit Plan > Auto approve access request*
+- **Purpose**: Reduce developer friction for safe deployments and free access APIs
+- **Options**:
+    - Enabled: Requests are automatically approved and credentials issued immediately
+    - Disabled: Requests require manual approval by a Portal administrator
+- **Best Practice**: Enable for free or low-tier plans, and for internal developer portal use cases; disable for premium or partner plans
+
+#### Access Request Limits
+
+Control how often API consumers can request access to the plan.
+
+- **Location**: *Plans > Add/Edit Plan > Advanced settings > Access request frequency*
+- **Configuration**:
+    - Access request allowance: The maximum number of access requests allowed
+    - Renewal interval: The period over which the request allowance should be measured
+- **Behavior**: When a user attempts to request access to an API using a Plan that has these limits configured, the system checks if they've already reached their allowance within the current renewal period. If they have, the request is rejected with a "Plan access quota exceeded" error.
+
+
+## API Plan Best Practices
+
+- **Create a clear tier structure**: Design a logical progression of Plans (e.g., Free, Basic, Premium, Enterprise) with meaningful differences in limits and capabilities between tiers.
+- **Align with user journey**: Offer Plans that match different stages of the developer journey - from exploration (free, low limits) to production (higher limits, SLAs) to scale (enterprise-grade).
+- **Balance simplicity and flexibility**: Provide enough Plan options to meet diverse needs without overwhelming developers with too many choices.
+- **Consider usage patterns**: Set rate limits and quotas based on actual API usage patterns rather than arbitrary numbers - analyze typical consumption to establish meaningful thresholds.
+- **Document value clearly**: For each Plan, clearly articulate what the developer gets, not just in terms of technical limits but also business value and use cases supported.
diff --git a/portal/api-products.mdx b/portal/api-products.mdx
new file mode 100644
index 0000000000..926a89502a
--- /dev/null
+++ b/portal/api-products.mdx
@@ -0,0 +1,346 @@
+---
+title: "API Products"
+description: "Working with API Products"
+keywords: "Developer Portal, Tyk, API Products"
+sidebarTitle: "API Products"
+---
+
+## Introduction
+
+API Products are strategic packages of API resources that deliver specific value to API consumers. Rather than exposing raw API endpoints, API Products allow you to bundle related functionality together with appropriate documentation, access controls, and business context.
+
+API Products transform technical APIs into business assets by:
+
+- Grouping related API functionality into coherent offerings
+- Providing context and documentation that explains the business value
+- Establishing clear terms of use through associated plans
+- Creating a consistent developer experience across multiple underlying APIs
+
+In the Tyk Developer Portal, API Products serve as the primary unit of discovery, access control, and [monetization](/portal/overview/intro#api-monetization-with-tyk-developer-portal) of your API portfolio.
+
+Since Tyk 5.7.0, you have been able to create API Products to publish your [Tyk Streams APIs](/api-management/event-driven-apis) on the Developer Portal.
+
+## Understanding the Relationship Between Portal and Provider
+
+API Products in the Tyk Developer Portal represent a powerful abstraction layer that sits on top of your underlying API infrastructure. Understanding how the Developer Portal interacts with the Provider (Tyk Dashboard) is essential for effective product management:
+
+### Data Distribution and Management
+
+All metadata relating to the API Product is stored within the Developer Portal, including:
+- Product name, description, and images
+- Documentation and guides
+- Catalog assignments and visibility settings
+- Custom fields
+
+The actual access policy that defines which APIs are included in the Product is managed by the Provider. This separation creates a clean division between presentation/discovery (Portal) and access control (Provider).
+
+<br />
+
+<Note>
+Once an access policy has been linked to an API Product you are strongly recommended not to make changes to it from the Provider, but to manage the Product in the Developer Portal.
+</Note>
+
+
+### Creation Workflows
+
+You can create API Products through two primary workflows:
+
+#### Portal-First Approach (Recommended)
+
+When you create a Product in the Developer Portal:
+
+- The Portal creates a corresponding access policy in the Tyk Dashboard
+- This policy defines which APIs are included in the product
+- The policy is automatically linked to the Product in the Portal
+- You can then enhance the Product with documentation, images, and other metadata
+
+This approach gives you full control over the Product's presentation and allows you to create a rich developer experience from the start.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-product-customize.png" alt="Customize an API Product" />
+
+#### Dashboard-First Approach
+
+Alternatively, you can:
+
+- Create a partitioned access policy directly in the Tyk Dashboard
+- When you [synchronize](/portal/api-provider#synchronizing-developer-portal-with-providers) the Developer Portal with the Provider, a new API Product will be created automatically
+- This Product will be "bare bones" with a name derived from the Dashboard policy but no description or other metadata
+- You can then enhance this auto-created Product through the Admin Portal interface
+- This approach is useful when you already have policies defined in your Dashboard or when you're migrating existing APIs to the Developer Portal
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/rIGnIQ235As" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+### Best Practice
+
+For the best developer experience, we recommend:
+
+- Planning your API Products from a consumer perspective
+- Creating Products using the Portal-first approach
+- Enriching them with comprehensive documentation and context
+- Regularly reviewing and updating both the Portal metadata and the underlying policies
+
+This ensures that your API Products remain aligned with both your business objectives and the technical implementation of your APIs.
+
+## Creating a New API Product
+
+You can create a new API Product in the Developer Portal by following these simple steps:
+
+1. Log in to the Developer Portal as an [API Owner](/portal/api-owner)
+2. Navigate to **API Products** in the main navigation
+3. Select **Add new API Product**
+4. Navigate to the **APIs** tab
+5. Select the *Provider* that hosts the APIs you want to include
+6. Select the *Authentication method* that covers the APIs you want to include
+7. Select the *APIs* you want to include in the Product
+8. Navigate to the **Details** tab
+9. Enter a descriptive **Name** for your Product
+10. Select **Save Changes**
+
+Your new API Product will now be available on the **API Products** page. You will need to publish the Product to a Catalog for it to appear in the Live Portal.
+
+These are the minimal steps to create an API Product and of course it won't be very appealling to API Consumers if you did publish it. You might want to select the Product's tile and add some description, documentation and user guides. Remember to select **Save Changes** when you are done.
+
+## Dynamic Client Registration
+
+[Dynamic Client Registration (DCR)](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration) allows the Tyk Developer Portal to automatically register OAuth 2.0 clients with your Identity Provider when an API Consumer is granted access. Each API Product used with DCR must have a unique [OAuth 2.0 scope](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration#oauth-2-0-scopes) assigned.
+
+This section covers how to configure an API Product to use DCR.
+
+### Configure APIs for JWT Authentication
+
+For each API you want to expose via DCR, you must enable JWT authentication in Tyk Dashboard and set the signing method (for example, RSA public key). Leave the **Public key** and **default policy** fields blank. The Portal manages these automatically.
+
+Refer to [JWT Signature Validation](/api-management/authentication/jwt-signature-validation) for API configuration details.
+
+### Configure the API Product for DCR
+
+Navigate to **API Products** and open the Product you want to use with DCR. In the **App Registration Configs** section, select the **Dynamic Client Registration** tab:
+
+1. Select **Enable dynamic client registration**.
+2. Enter the OAuth 2.0 scope name for this Product.
+3. Select one or more [Client Profiles](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration#client-profiles) that describe the methods API Consumers will use to obtain access tokens from the IdP.
+4. Select **Save Changes** and then publish the Product to a Catalog to make it available to API Consumers.
+
+<Warning>
+The scope must [exist in your Identity Provider](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration#define-oauth-2-0-scopes) when the API Product is published, so that the IdP is able to issue tokens containing the scope.
+</Warning>
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-product-dcr.png" alt="DCR settings on an API Product" />
+
+## API Product Reference Guide
+
+This comprehensive reference guide details all the configurable options and features of API Products in the Tyk Developer Portal.
+
+### Core Features
+
+#### Product Name
+
+The primary identifier for your API Product.
+
+- **Location**: *API Products > Add/Edit API Product > Details tab > Product name*
+- **Purpose**: Identifies the Product within both the Developer Portal and the Provider
+- **Behavior**: Used as the name for the partitioned access policy in the Provider
+- **Synchronization**:
+    - Modifying the name in the Portal immediately updates the policy name in the Provider
+    - Modifying the policy name in the Provider updates the Product name during the next Portal synchronization
+**Best Practice**: Choose a clear, descriptive name that reflects the Product's purpose
+
+#### Provider
+
+The Tyk Dashboard instance that hosts the APIs included in this Product.
+
+- **Location**: *API Products > Add/Edit API Product > APIs tab > Choose a provider*
+- **Purpose**: Links the Product to the correct Provider instance (where the policy will reside)
+- **Selection**: Choose from a dropdown list of all registered Providers
+- **Note**: The Developer Portal can publish Products from multiple Providers, but each individual Product is limited to one Provider
+
+#### Authentication Method
+
+Defines how API consumers will authenticate when accessing the APIs within this Product.
+
+- **Location**: *API Products > Add/Edit API Product > APIs tab > Choose authentication method*
+- **Purpose**: Ensures you can only select from relevant APIs
+- **Limitation**: Each Product can only include APIs with a compatible authentication method
+- **Behavior**: When a Developer App is approved to consume a Product, credentials (such as an API key or OAuth token) are issued
+    - These credentials must work with all APIs in the Product
+    - For example, an API key would not work with an API expecting a JWT
+- **Selection**: Choose from available authentication methods supported by your Provider
+- **Filter Effect**: The list of available APIs will automatically be filtered to show only those compatible with the selected authentication method
+- **Best Practice**: Consider authentication method compatibility when planning which APIs to group into Products
+
+#### API List
+
+Displays all APIs included in the Product based on the selected Authentication Method.
+
+- **Location**: *API Products > Add/Edit API Product > APIs tab > Select APIs*
+- **Content**: Shows API name, API Id, and category for each available API
+- **Selection**: Select all the APIs to include in the Product
+- **Note**: [Documentation-only Products](/portal/api-products#documentation-only-products) do not require any APIs to be selected
+
+#### Webhooks
+
+For Tyk Streams APIs, configure which events developers can subscribe to.
+
+- **Location**: *API Products > Add/Edit API Product > Webhooks tab > Event types*
+- **Purpose**: Controls which event types are exposed to developers
+- **Options**: Select specific event types or allow access to all events
+- **Prerequisites**: Requires Tyk Streams APIs to be configured in the Provider
+
+### Documentation
+
+#### API Reference Documentation
+
+Detailed technical documentation generated from API specifications. From v1.15.0, we've added GraphQL support alongside OpenAPI specifications.
+
+- **Location**: *API Products > Add/Edit API Product > Documentation tab > Add API specification*
+- **Purpose**: Provides detailed technical reference documentation
+- **Format**: Upload API specification files in multiple formats:
+    - OpenAPI: JSON or YAML format from file or URL - suitable for RESTful (HTTP-based) APIs
+    - GraphQL SDL: Schema Definition Language files (.graphql, .graphqls, .gql, or JSON format) from file - for GraphQL APIs
+- **Display**: Rendered as interactive documentation in the Live Portal
+- **Live Testing**:
+    - **RESTful APIs**: Developers can test API endpoints directly in the Live Portal - the server URL is automatically retrieved from the uploaded OpenAPI specification
+    - **GraphQL APIs**: With a configured GraphQL server URL (set it to the API Gateway URL), developers can write and test queries directly in the Live Portal using the integrated GraphQL Playground. You may need to enable CORS of your GraphQL API to allow request from the Live Portal.
+- **Size Limit**: Configured using the `PORTAL_MAX_UPLOAD_SIZE` configuration (to a maximum of 32MB)
+- **Note**: For a [Documentation-only Product](/portal/api-products#documentation-only-products) the *Specification Alias* will be used as the reference for each OpenAPI document, rather than the API name
+
+#### Getting Started Guide
+
+A series of pages that will be presented in the Get Started tab within the Product on the Live Portal, typically used to provide additional detail or step-by-step instructions for developers.
+
+- **Location**: *API Products > Add/Edit API Product > "Getting started" guides tab > Create new page*
+- **Purpose**: Create additional documentation that helps developers integrate with and use the API Product
+- **Format**: [Markdown](/portal/customization/markdown) or HTML content with multiple pages
+- **Ordering**: Pages can be edited and reordered as required
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-product-guides.png" alt="Add Product Guides" />
+
+#### Related Blog Articles
+
+Links to relevant content from the Portal's blog.
+
+- **Location**: *API Products > Add/Edit API Product > Details tab > Blog tags*
+- **Purpose**: Connects developers with related tutorials, announcements, and use cases
+- **Mechanism**: Blog posts with matching tags are automatically displayed with the Product
+- **Best Practice**: Use consistent tagging strategy across Products and blog content
+
+<img src="/img/dashboard/portal-management/enterprise-portal/tags-diagram.png" alt="Tags diagram" width="600" height="314" />
+
+### Live Portal Presence
+
+#### Catalog Assignment
+
+Determines which API Catalogs include this Product.
+
+- **Location**: *API Products > Add/Edit API Product > Details tab > Publish API product to catalogue*
+- **Purpose**: Controls Product visibility to different developer audiences
+- **Options**: Select one or more Catalogs where this Product should appear
+- **Behavior**: Product will only be visible to developers with access to the selected Catalogs
+
+#### Catalog Display Name
+
+The Product name as shown in the Live Portal.
+
+- **Location**: *API Products > Add/Edit API Product > Details tab > Catalogue display name*
+- **Purpose**: May differ from internal Product name for marketing purposes
+- **Example**: Internal name "Payment Processing API v2" could have a display name "Payment Processing API"
+
+#### Featured Product
+
+Highlights the Product in Catalog listings on the Live Portal.
+
+- **Location**: *API Products > Add/Edit API Product > Details tab > Featured API Product*
+- **Purpose**: Gives the Product prominent placement on Catalog pages
+- **Behavior**: Featured Products typically appear at the top of listings with special styling
+- **Best Practice**: Limit the number of featured Products to maintain impact
+
+#### Product Summary
+
+A short description of the Product visible in the Product's tile in the Catalog, also displayed on the Product's dedicated page in the Live Portal.
+
+- **Location**: *API Products > Add/Edit API Product > Details tab > Description in the catalogue page*
+- **Purpose**: Helps developers quickly understand the Product's value
+- **Format**: Rich text editor supporting basic formatting
+- **Content**: Typically 1-3 sentences (recommended maximum 200 characters)
+- **Format**: Plain text only
+
+#### Product Description
+
+Detailed information about the Product, visible on the **Overview** tab of the Product's dedicated page in the Live Portal.
+
+- **Location**: *API Products > Add/Edit API Product > Details tab > Description in the product details page*
+- **Purpose**: Provides comprehensive information about the Product's features, benefits, and use cases
+- **Format**: Rich text editor supporting basic formatting
+- **Content**: Typically includes overview, features, use cases, and requirements
+- **Best Practice**: Structure content with clear headings and concise paragraphs
+
+#### Product Image
+
+Images to be displayed to enhance the appeal of the Product in the Catalog. Note that currently only the *Product* image is used, not the *Catalogue* image.
+
+- **Location**: *API Products > Add/Edit API Product > Details tab > Product page image*
+- **Purpose**: Enhances visual appeal and recognition in catalog listings
+- **Format**: JPG or PNG
+- **Recommended Size**: 700x400 pixels
+- **Note**: While the maximum file size is 32MB, the image will be resized to fit within 700x400 pixels
+
+## Documentation-only Products
+
+Documentation-only Products let you publish API documentation in the Developer Portal without creating any access policy or issuing credentials. They are useful for pre-release APIs, partner previews, and deprecated API archives.
+
+For full details, step-by-step creation instructions, and known limitations, see [Documentation-Only Products](/portal/api-products/documentation-only-products).
+
+## API Product Best Practices
+
+### Naming and Organization
+
+- Use Clear, Descriptive Names: "Payment Processing API" is better than "API v3"
+- Group Related Functionality: Bundle APIs that solve a common business problem
+- Maintain Consistent Naming: Use a consistent naming convention across Products
+
+### Documentation
+
+- Start with Why: Explain the business value before technical details
+- Include Complete Examples: Provide working code samples in multiple languages
+- Document Error Scenarios: Help developers understand and handle errors
+- Keep Documentation Updated: Ensure documentation reflects the current API behavior
+
+### Product Design
+
+- Focus on Consumer Needs: Design Products around specific use cases
+- Limit Scope: Each Product should have a clear, focused purpose
+- Consider Granularity: Balance between too many small products and too few large ones
+- Plan for Evolution: Design Products with future changes in mind
+
+### Limitations and Considerations
+
+#### Technical Considerations
+
+- Policy Constraints: An API product can only include APIs defined in a single Tyk access policy using the same auth method
+- Cross-Gateway Limitations: APIs must be deployed on the same Tyk Gateway to be included in one Product
+- Documentation Size: Very large OpenAPI specifications may impact portal performance
+
+#### Organizational Considerations
+
+- Ownership: Establish clear ownership for each API Product
+- Lifecycle Management: Define processes for deprecating and retiring Products
+- Feedback Loops: Create mechanisms to gather consumer feedback on Products
+- Metrics and Analytics: Determine how to measure Product success
+
+## Troubleshooting Common Issues
+
+#### APIs Not Appearing in Product
+
+ - Verify the Provider access policy includes the expected APIs
+ - Check that the APIs are active in the Provider
+
+#### Documentation Not Displaying Correctly
+
+- Validate OpenAPI specifications for syntax errors
+- Check for CORS issues if using interactive documentation
+- Verify markdown/HTML formatting in custom documentation
+
+#### Product Not Visible in Catalog
+
+- Confirm the Product is assigned to the Catalog
+- Verify Catalog visibility settings
diff --git a/portal/api-products/documentation-only-products.mdx b/portal/api-products/documentation-only-products.mdx
new file mode 100644
index 0000000000..229fcb22c6
--- /dev/null
+++ b/portal/api-products/documentation-only-products.mdx
@@ -0,0 +1,129 @@
+---
+title: "Documentation-Only API Products"
+description: "Create API Products in the Tyk Developer Portal that publish documentation without exposing live API access or credentials. Useful for pre-release APIs, partner previews, and archived docs."
+sidebarTitle: "Documentation-Only Products"
+keywords: "Developer Portal, Tyk, Documentation-Only, API Products, OpenAPI, GraphQL SDL, pre-release, read-only"
+---
+
+Documentation-Only Products let you publish API documentation in the Developer Portal without creating any access policy or issuing credentials. Consumers can browse your documentation, explore the interactive playground, and review specifications, with no "Request Access" button and no Plan selection.
+
+In this section we will refer to those Products that can be combined with Plans to issue credentials as *Regular Products*.
+
+## When to use a Documentation-Only Product
+
+1. **Pre-release APIs**: publish an OpenAPI spec or GraphQL schema before the API is available for consumption, so developers can plan integrations ahead of launch.
+2. **Partner previews**: share API documentation with external partners in a controlled catalog without opening up live access.
+3. **Deprecated API archives**: keep documentation accessible for consumers on legacy integrations after the API has been retired, without issuing new credentials.
+4. **Conceptual overviews**: provide architectural guides, best practices, or integration patterns that have no corresponding live endpoint.
+5. **Educational resources**: structure learning content about your API ecosystem using Getting Started guides and product descriptions.
+
+## Prerequisites
+
+- Access to the Developer Portal Admin UI with an API Owner role
+- An existing Catalog to publish the product to
+- An OpenAPI Description file in JSON or YAML format, or a GraphQL SDL file (.graphql, .graphqls, .gql, or JSON format)
+
+<Note>
+For an overview of API Products, see [API Products](/portal/api-products). For steps to create a standard API Product with live access, see the API Products page.
+</Note>
+
+## Create a Documentation-Only Product
+
+There is no explicit documentation-only toggle in the Admin UI. A Product becomes documentation-only automatically when no APIs are selected on the APIs tab. No access policy will be created in the connected Tyk Dashboard, so no credentials can be generated for the Product.
+
+1. **Navigate to API Products**
+
+    In the Admin Portal, go to **Developer Portal** > **API Products** and select **Add new API Product**.
+
+2. **Skip API selection**
+
+    Open the **APIs** tab. Do not select any APIs from the list. Skip to the next tab. This is what makes the Product documentation-only.
+
+    ![APIs tab on the Add API Product page, showing the default empty state with no APIs selected and the inline note to skip this tab for documentation-only products](/img/portal/portal-doc-only-apis-tab.png)
+
+3. **Add documentation**
+
+    Open the **Documentation** tab and select **Add API specification**:
+
+    1. For REST APIs: choose **OpenAPI**, then upload a JSON or YAML file or provide a URL.
+    2. For GraphQL APIs (available from v1.15.0): choose **GraphQL SDL**, then upload an SDL file (.graphql, .graphqls, .gql, or JSON). File upload only, URL is not supported for GraphQL SDL.
+
+    In the **Specification Alias** field, enter a label for this document. Use underscores or camelCase, do not use hyphens.
+
+    ![Documentation tab showing an uploaded OpenAPI specification with the Specification Alias field filled in](/img/portal/portal-doc-only-documentation-tab.png)
+
+4. **Provide the Product details**
+
+    Open the **Details** tab and complete the following:
+
+    1. **Product name**: use a clear, descriptive name. Consider a convention such as "[DOCS] Payment Integration Guide" so admins can distinguish documentation-only Products at a glance.
+    2. **Catalog display name** and **Product summary**: the summary appears as the tile description in the Live Portal.
+    3. **Product description**: make clear in the description that this Product is documentation-only and consumers cannot request access.
+    4. **Product image** (optional): JPG or PNG, recommended 700x400 pixels.
+    5. **Publish API Product to catalogue**: select one or more Catalogs.
+
+5. **Add Getting Started Guides (optional)**
+
+    Open the **Getting Started Guides** tab to create Markdown or HTML pages. These appear on the product's **Get Started** tab in the Live Portal and are the right place for tutorials, integration walkthroughs, and conceptual overviews.
+
+6. **Save and verify**
+
+    Select **Save Changes**, then open the Live Portal and confirm:
+
+    1. The Product appears in the assigned Catalog.
+    2. The **API specification** tab renders your uploaded specification.
+
+    ![The API specification tab showing a rendered OpenAPI specification in Redoc, with endpoint navigation on the left and schema details on the right](/img/portal/portal-doc-only-openapi-docs.png)
+
+## What consumers see
+
+Documentation-only Products appear in the Catalog alongside regular Products, but with key differences:
+
+The **Overview**, **API specification**, and **Get Started** tabs are fully accessible, but
+1. There is no **Request Access** button.
+2. There are no Plans available to select.
+3. No credentials can be requested or issued.
+
+![Live Portal page for a documentation-only Product, showing the Overview, API specification, and Get Started tabs with no Request Access button](/img/portal/portal-doc-only-live-portal.png)
+
+This behavior is enforced by the Portal: the Product has no associated access policy in Tyk Dashboard, and the UI hides all access-request components when a Product is documentation-only.
+
+## Convert a Product's type
+
+You do not need to recreate a Product to change its type: this is dynamic, based on whether any API access is configured.
+
+**Convert a documentation-only Product into a regular Product**
+
+1. Open the Product in the Admin Portal and navigate to the **APIs** tab.
+2. Select a Provider, an authentication method, and one or more APIs to which the Product should grant access.
+3. Select **Save Changes**.
+
+The Portal creates a new access policy in Tyk Dashboard so that it becomes a regular Product. Consumers can now request access and receive credentials to consume the APIs in the Product.
+
+**Convert a regular Product to documentation-only**
+
+1. Open the Product and navigate to the **APIs** tab.
+2. Remove all selected APIs.
+3. Select **Save Changes**.
+
+<Warning>
+When you convert a regular Product to documentation-only, the associated access policy in Tyk Dashboard is immediately deactivated. Any existing credentials issued for this Product stop working at that point. If you re-add APIs later, the policy is reactivated and previously issued credentials resume working.
+</Warning>
+
+## Troubleshooting
+
+<AccordionGroup>
+  <Accordion title="Specification does not render on the API Specifications tab">
+    Check whether the Specification Alias contains a hyphen. If it does, rename the alias using underscores or camelCase, then re-upload the file.
+  </Accordion>
+  <Accordion title="Request Access button or Plan selection is visible to consumers">
+    This was a bug in versions prior to v1.16.0. Upgrade to v1.16.0 or later. On older versions, the UI elements appear but are non-functional for documentation-only Products.
+  </Accordion>
+  <Accordion title="Error when adding APIs to convert a documentation-only Product to live">
+    This was a bug in versions prior to v1.14.1. The Portal attempted to update a non-existent access policy. Upgrade to v1.14.1 or later to perform this conversion without errors.
+  </Accordion>
+  <Accordion title="Product is not visible in the Catalog">
+    Confirm the Product is published to at least one Catalog, and that the consumer's Organisation has access to that Catalog. Documentation-only Products follow the same Catalog visibility rules as regular Products.
+  </Accordion>
+</AccordionGroup>
+
diff --git a/portal/api-provider.mdx b/portal/api-provider.mdx
new file mode 100644
index 0000000000..713707be20
--- /dev/null
+++ b/portal/api-provider.mdx
@@ -0,0 +1,225 @@
+---
+title: "API Providers"
+description: "All about API Providers with Tyk Developer Portal"
+keywords: "Developer Portal, Tyk, Provider, Integration, Tyk Dashboard"
+sidebarTitle: "API Providers"
+---
+
+## Introduction
+
+Providers are the connections between your Tyk Developer Portal and your API management infrastructure. They serve as the bridge that makes your APIs, policies, and authentication mechanisms available for exposure through the Developer Portal.
+
+Each Provider represents a connection to a Tyk Dashboard instance, allowing the Developer Portal to discover available APIs, apply access policies, and issue credentials to developers. While the Developer Portal handles the presentation, documentation, and developer experience, the Provider handles the underlying API management functions.
+
+Providers transform your API management infrastructure into developer-ready resources by:
+
+- Making APIs defined in Tyk Dashboard available for inclusion in API Products
+- Supplying the access and rate limit policies used by Products and Plans
+- Generating and managing credentials when developers request API access
+- Enforcing security, rate limits, and quotas on API requests
+
+In the Tyk Developer Portal, Providers are the foundation that enables all other functionality, connecting your API infrastructure to your developer community.
+
+## Key Concepts
+
+### Provider Architecture
+
+The Provider connection works through a secure API integration between the Developer Portal and the Tyk Dashboard. This connection allows the Portal to:
+
+- Discover Resources: Query available APIs and policies from the Dashboard
+- Create Policies: Generate new access and rate limit policies for Products and Plans
+- Issue Credentials: Request creation of API keys, OAuth tokens, or other credentials
+- Synchronize Changes: Maintain consistency between Portal and Dashboard configurations
+
+### Multi-Provider Support
+
+The Tyk Developer Portal supports connections to multiple Providers simultaneously, enabling several powerful scenarios:
+
+- Environment Segregation: Connect to separate development, staging, and production environments
+- Organizational Boundaries: Connect to Dashboards managed by different teams or departments
+- Geographic Distribution: Connect to Dashboards in different regions or data centers
+- Migration Paths: Facilitate transitions between different Tyk deployments
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-diagram-api-providers.png" alt="Relationship between Tyk Developer Portal and two API Providers" />
+
+### Provider Limitations
+
+It is important to understand the boundaries of Provider functionality:
+
+- Each API Product or Plan can only be associated with a single Provider
+- Credentials issued by one Provider cannot be used with APIs from another Provider
+- The same Authentication method must be used to access all APIs within an API Product, so that a single set of credentials can be created and accepted by the Provider.
+
+### Tyk Dashboard API Access Credentials
+
+Tyk Dashboard exposes a management API with a user management system that performs fine-grained Role Based Access Control (RBAC). The Developer Portal uses this API to configure and control security policies on the Dashboard. These policies implement the Developer Portal's API Products and Plans, and are used in the creation and maintenance of access credentials for API Consumers.
+
+The Developer Portal thus needs access to the Tyk Dashboard API, so you will need to create a dedicated user on your Tyk Dashboard, following the steps indicated [here](/platform-management/dashboard-users#manage-tyk-dashboard-users).
+
+The Developer Portal user requires the following permissions:
+
+| Permission   | Access level |
+| :-------------- | :-------------- |
+| APIs         | Write        |
+| Certificates | Write        |
+| Keys         | Write        |
+| Policies     | Write        |
+| Analytics    | Read         |
+| Users        | Read         |
+
+
+## Synchronizing Developer Portal with Providers
+
+The Developer Portal regularly synchronizes with the Provider to ensure it has up-to-date information about available APIs, policies, and other resources. This synchronization process is crucial for maintaining consistency between your API management infrastructure and the developer experience.
+
+### What Happens During Synchronization?
+
+When a synchronization event occurs, for each Provider in turn, the Portal will retrieve all access and limit policies that have matching tags with those configured in the [Provider settings](/portal/api-provider#policy-tags).
+
+- Portal will create placeholder Products and Plans for any new policies.
+- It will hide from the Admin Portal view (and unpublish) any Products or Plans whose access/limit policies were not retrieved from the Dashboard (for example if the tags no longer match, or the Dashboard policy has been deleted).
+- If the policy is successfully retrieved in a future sync event, the Product or Plan will again be displayed with all of its previous configuration.
+
+
+
+    <Note>
+    When an API Product or Plan is created on the Developer Portal, the corresponding access or limit policy is automatically created in the Provider (Dashboard). There is no need to trigger a synchronization event for this to occur.
+    </Note>
+
+
+### Automatic Synchronization
+
+The Portal automatically synchronizes with each Provider based on the [PORTAL_REFRESHINTERVAL](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_refreshinterval) synchronization interval that can be declared in the Portal configuration. The default synchronization interval is 10 minutes starting from an initial sync that occurs when the Portal starts up.
+
+### Manual Synchronization
+
+You can trigger an immediate synchronization when needed as follows:
+
+1. Navigate to the **Providers** section in the Admin Portal
+2. Select the **Synchronize** button
+3. The Portal will now synchronize with each Provider in turn, reporting success or failure on completion
+
+If you want to synchronize a specific Provider, you should select **Synchronize** from the three dots menu for that Provider.
+
+## Reference Guide
+
+### Essential Information
+
+#### Provider Name
+
+An identifier for this Provider connection within the Developer Portal deployment.
+
+- **Location**: *Providers > Add/Edit Provider > Name*
+- **Purpose**: Identifies the Provider within the Developer Portal
+- **Best Practice**: Use a descriptive name that indicates the environment or purpose (e.g., "Production APIs" or "Partner Gateway")
+
+### Connection Details
+
+#### Connection URL
+
+The endpoint URL for the Tyk Dashboard. This is where the Developer Portal will interact with the [Tyk Dashboard API](/tyk-dashboard-api) using its allocated [access credentials](/portal/api-provider#tyk-dashboard-api-access-credentials).
+
+- **Location**: *Providers > Add/Edit Provider > URL*
+- **Format**: Full URL including protocol, host, and port (e.g. `https://dashboard.example.com:3000`)
+- **Note**: Must be accessible from the Developer Portal server
+
+#### Secret
+
+Access credentials that the Developer Portal will use to authenticate with the Tyk Dashboard API.
+
+- **Location**: *Providers > Add/Edit Provider > Secret*
+- **Format**: *Tyk Dashboard API Access Credentials* for a Dashboard user account
+- **Best Practice**: Use a dedicated Dashboard user account with [minimal required permissions](/portal/api-provider#tyk-dashboard-api-access-credentials)
+
+#### Organisation ID
+
+The organization identifier in [multi-tenant Tyk deployments](/tyk-cloud/environments-deployments/managing-organisations).
+
+- **Location**:  *Providers > Add/Edit Provider > Organisation ID*
+- **Purpose**: Identifies which organization's resources to access
+- **Where to Find It**: Tyk Dashboard user profile
+- **Default**: Can be left empty if your deployment has a single Tyk Organization
+- **Note**: This is not the same as a Tyk Developer Portal [Organisation](/portal/overview/concepts#api-consumers)
+
+#### Insecure Skip Verify
+
+Controls whether TLS certificate validation is performed for the Provider connection.
+
+- **Location**: *Providers > Add/Edit Provider > Insecure skip verify*
+- **Purpose**: Allows connections to Providers with self-signed or invalid TLS certificates
+- **Options**:
+  - Enabled: Bypasses TLS certificate validation (not recommended for production)
+  - Disabled: Enforces strict TLS certificate validation (default)
+- **Security Implications**:
+  - When enabled, connections are vulnerable to man-in-the-middle attacks
+  - Disables verification of the Provider's identity through its certificate
+- **Use Cases**:
+  - Development environments with self-signed certificates
+  - Testing environments where proper certificates haven't been configured
+  - Troubleshooting connection issues related to certificate problems
+- **Best Practice**:
+  - Always disable (set to false) in production environments
+  - Use only temporarily for testing if absolutely necessary
+  - Replace with proper certificate configuration as soon as possible
+
+### Developer Portal Resources
+
+#### Policy tags
+
+Controls which policies are synchronized from the Provider and how they're categorized in the Developer Portal.
+
+- **Location**:  *Providers > Add/Edit Provider > Policy tags*
+- **Purpose**: Filters which policies are imported from the Tyk Dashboard
+- **Behavior**:
+  - The *policy tags* are added to all Tyk Dashboard policies created by the Developer Portal (for API Products and Plans)
+  - When policies are synchronized from the Provider, only those policies with the *policy tags* will be retrieved
+  - Adding *policy tags* to a partitioned policy in the Tyk Dashboard will cause it to be synchronized to the Developer Portal, creating a "bare-bones" API Product or Plan
+- **Format**: Comma separated list of text tags without spaces after the comma (e.g. to synchonrize Dashboard policies with the tags `tag1` and `tag2` you must configure *Policy tags* as `tag1,tag2`)
+
+#### Baseline URL
+
+The base address of the Tyk Gateway where API Products from this Provider can be accessed.
+
+- **Location**: Connection tab of the Edit Provider and Add Provider pages
+- **Purpose**: Provides the root URL that developers will use to consume APIs, helping API consumers understand where to direct their API requests
+- **Format**: Full URL including protocol and host (e.g. `https://gateway.example.com`)
+- **Display**: Shown on Product pages in the Live Portal
+
+
+## Best Practices for Providers
+
+- Use dedicated credentials: Create specific Dashboard users or API keys for Portal connections with appropriate permissions
+- Implement secure connections: Always use HTTPS for Provider connections
+- Maintain environment separation: Use different Providers for development, staging, and production
+- Monitor synchronization status: Regularly verify that Providers are successfully synchronizing
+- Document Provider purpose: Maintain clear documentation about what each Provider represents and which APIs it supplies
+
+
+## Troubleshooting Provider Connections
+
+### Common Issues and Solutions
+
+**Connection Failures**
+
+- Verify network connectivity between Portal and Dashboard
+- Confirm URL is correct and includes protocol and port
+- Check that Dashboard API is accessible from Portal server
+
+**Authentication Errors**
+
+- Verify API key or credentials are valid and active
+- Ensure the user account has appropriate [permissions](/portal/api-provider#tyk-dashboard-api-access-credentials)
+- Check for organization ID mismatches
+
+**Missing Products or Plans**
+
+- Verify the corresponding policies exist in the Dashboard
+- Verify policies have the correct [policy tags](/portal/api-provider#policy-tags)
+- Check synchronization status and last sync time
+- Trigger manual synchronization if needed
+
+**Synchronization Problems**
+
+- Check Dashboard API logs for errors
+- Verify Portal has sufficient permissions to access all resources
+- Review network stability between Portal and Dashboard
diff --git a/portal/certificates.mdx b/portal/certificates.mdx
new file mode 100644
index 0000000000..29409d5371
--- /dev/null
+++ b/portal/certificates.mdx
@@ -0,0 +1,118 @@
+---
+title: "TLS Certificates"
+description: "Managing Client Certificates with Developer Portal"
+keywords: "Developer Portal, Tyk, TLS, mTLS, certificate, client certificate, certificate management"
+sidebarTitle: "TLS Certificates"
+---
+
+## Introduction
+
+Mutual TLS (mTLS) can be enforced for APIs on the Provider Gateway, often in combination with another authentication method, such as a JSON Web Token. With mTLS, API clients must present a valid client [certificate](/api-management/certificates) and access token.
+
+APIs secured with `Auth Token + mTLS` or `JWT + mTLS` can be included in API Products on the Developer Portal.
+
+In both of these scenarios, a [static allow list](/api-management/implement-tls#using-a-static-client-certificate-allow-list) of client certificates is registered within the API definition. The certificate presented by the API client must match an entry in that list (or, if an [issuing certificate](/api-management/certificates#certificate-chains-and-trust) is included in the list it must be signed by that authority) for authentication to complete successfully.
+ 
+All client certificates must be pre-registered in the Tyk Certificate Store to be used for authentication.
+
+The client certificate allow list for APIs secured using JWT Auth is managed from the Provider Dashboard; whereas for APIs secured using Auth Token, where the access credential can be issued by the Developer Portal, the association between client certificate and token can be created using the Portal.
+
+## Associating Certificates with Developer Apps
+
+For API Products that use the Auth Token + mTLS authentication method, the Developer Portal manages the association between a developer's app and their client certificates. When access credentials are issued to the app, the associated certificate(s) are automatically added to the allow list for each API in the Product. The API Consumer must then provide one of these registered certificates when making a request to the Gateway to complete authentication.
+
+In **Portal 1.16** an option was added to the API Product configuration for Products that grant access to APIs secured with *Auth Token + mTLS* - **Mutual TLS Certificate Mode**
+
+This has two options:
+
+- [Managed](/portal/certificates#managed-certificates)
+- [Self-Serve (default)](/portal/certificates#self-serve-certificates)
+
+<img src="/img/portal/portal-certificate-management-mode.png" alt="Choosing the certificate management mode for API Products protected by Auth Token with mTLS" />
+
+<Note>
+    It is important to note that for APIs secured using JWT with mTLS, the 'Managed' and 'Self-Serve' certificate modes are not applicable. The association between the client certificate and the token is managed directly in the Provider Dashboard.
+</Note>
+
+### Managed Certificates
+
+In the *Managed* mode, client certificates are centrally managed by the API Owner in the Admin Portal. Certificates are uploaded via the Provider or Portal and can be associated with one or more Organisations.
+
+When access credentials (Auth Tokens) are issued for a Developer App (i.e. when an access request is approved), all certificates associated with the Organisation will be added to the allow list for the APIs to which access has been granted.
+
+### Self-Serve Certificates
+
+In the *Self-Serve* mode, which was the only option prior to **Portal 1.16.0**, the API Consumer must provide a client certificate when they request access to the API Product. When the request is approved, this certificate will be registered with the Provider's Certificate Store and added to the allow list for the APIs to which access has been granted.
+
+<img src="/img/portal/portal-certificate-self-serve.png" alt="Prompted to provide a client certificate when requesting access to an API Product secured in self-serve mode" />
+
+### Certificate-Token Binding
+
+From **Portal 1.17.0**, API Products that use Auth Token + mTLS authentication include an additional option in their settings: **Bind Certificate to Token**. When enabled, the Portal links the access token issued to the API Consumer directly to their client certificate(s), using Tyk's [Certificate-Token Binding](/api-management/authentication/bearer-token#client-certificate-token-binding) feature introduced in Tyk Gateway 5.12.0.
+
+This prevents a valid token from being used with a client certificate belonging to a different consumer, even if that certificate is otherwise on the allow list for the API. At request time, the Tyk Gateway checks whether the presented certificate matches the one bound to the token and rejects the request if they do not match.
+
+To enable it, open the API Product settings and check **Bind Certificate to Token**. The option is only available for Products configured with the Auth Token + mTLS authentication type.
+
+<img src="/img/portal/portal-bind-certificate.png" alt="Binding a TLS certificate to access tokens" />
+
+The certificates that get bound depend on the certificate mode:
+
+- **Self-Serve:** the specific certificate the consumer provided in their access request is bound to their token at approval time.
+- **Managed:** all certificates associated with the consumer's Organisation are bound to their token when the access request is approved.
+
+<Note>
+    Certificate-Token Binding is additive and does not replace the static allow list check. The presented certificate must still appear in the API's allow list, and must also match a certificate bound to the token. If either check fails, the Gateway rejects the request.
+</Note>
+
+
+## Developer Portal Certificate Store
+
+Certificates used for client authentication are primarily stored and managed within the Provider's [Certificate Store](/api-management/certificates#tyk-certificate-store).
+
+From **Portal 1.17.0** the Admin Portal provides a facade to the Provider's Certificate Store. Details of certificates within the Provider's store are exposed to the Admin Portal on the **API Consumers > Certificates** screen.
+
+<img src="/img/portal/portal-certificate-store.png" alt="The Developer Portal's Certificate Store view" />
+
+### Uploading a Certificate
+
+To add a certificate directly from the Admin Portal:
+
+1. Navigate to **API Consumers > Certificates** and select **Add new Certificate**.
+2. Select the **Provider** (Tyk Dashboard instance) the certificate should be registered with, then select **Continue**.
+3. Enter a **Certificate name**. This is used only within the Portal for identification and is not stored in the Tyk Certificate Store.
+4. Upload the certificate in **PEM format**, then select **Continue**.
+5. Optionally, associate the certificate with one or more **Organisations** (required if the certificate will be used with a Product in [Managed](/portal/certificates#managed-certificates) mode), then select **Save**.
+
+<img src="/img/portal/portal-add-certificate-form.png" alt="Step 1 of the Add Certificate wizard — selecting a Provider" />
+
+On save, the certificate is validated and then uploaded directly to the selected Tyk Dashboard. The raw certificate file is not stored by the Portal. Only the Dashboard certificate ID and the parsed metadata are saved to the Portal database.
+
+### Syncing Certificates from the Provider
+
+Certificates added directly to the Tyk Dashboard (via the Dashboard UI or API) are automatically synced to the Portal's **API Consumers > Certificates** screen in the background. No manual action is required.
+
+The sync reconciles what the Portal knows about with the current state of the Tyk Dashboard:
+
+- Certificates present in the Dashboard but not yet in the Portal are added to the Portal's view.
+- Certificates present in the Portal's view but no longer in the Dashboard are soft-deleted and no longer visible in the Portal.
+
+<Note>
+    The sync removes certificates silently, with no warning shown when a certificate is removed from the Portal's view. Removed certificates are soft-deleted (the records are retained in the database) and will reappear if the certificate is added back to the Dashboard.
+</Note>
+
+Certificates synced from the Dashboard can be managed in the same way as uploaded certificates. You can assign them a name and associate them with Organisations.
+
+Selecting a certificate will take you to the Certificate Details screen:
+
+Here you can:
+
+- assign a name for easier recognition within the Portal (note that this is not transferred to the Provider)
+- associate the certificate with one or more Organisations (required for API Products using [Managed Certificates](/portal/certificates#managed-certificates))
+
+<img src="/img/portal/portal-manage-certificate.png" alt="Managing a Certificate's details in the Certificate Store" />
+
+## Configuring mTLS Authentication
+
+{/* TODO: Re-add link to /portal/how-to-guides/configure-mtls once that page is published */}
+For a complete walkthrough covering setup of an API Product with mTLS, choosing a certificate mode, and testing end-to-end access, see Configure mTLS Authentication.
\ No newline at end of file
diff --git a/portal/customization.mdx b/portal/customization.mdx
new file mode 100644
index 0000000000..c084967ad6
--- /dev/null
+++ b/portal/customization.mdx
@@ -0,0 +1,39 @@
+---
+title: "Developer Portal Customization"
+description: "Customization options for enterprise developer portal"
+keywords: "Developer Portal, Tyk, Customization, Webhook, Email, Themes, Templates, Pages, Menus, Branding, User Model"
+sidebarTitle: "Overview"
+---
+
+
+<Note>
+**Tyk Enterprise Developer Portal**
+
+If you are interested in getting access contact us at [support@tyk.io](<mailto:support@tyk.io?subject=Tyk Enterprise Portal Beta>)
+</Note>
+
+
+## Portal Customization Overview
+
+The Tyk Enterprise Developer Portal uses themes for customizing the live portal. We provide an out of the box theme that is using our own branding, it’s called the `default` theme. You are welcome to use it and modify it for your needs, yet if you want to start with a blank page, you can also create a completely new theme.
+
+This section provides a complete guide to full customization from the developer's point of view.
+
+## Workflows for Portal Management
+
+These workflows are designed to help organizations streamline collaboration between developers and content managers in managing the Tyk Developer Portal.
+
+### Developer Workflow
+
+For organizations with developers customizing pages layout and other technical aspects of the portal pages, we are recommending the following workflow.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-fe-develop-flow.png" alt="Developer workflow" />
+
+### Content Manager Workflow
+
+For organizations with content manager(s) managing the developer portal content, we are recommending the following workflow.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-content-manager-flow.png" alt="Content manager workflow" />
+
+The Tyk Developer portal supports the workflow of content managers who're responsible for editing and managing page content.
+The purpose of highlighting this flow is to give recommendations on how to organize effective workflows between front end engineers and content managers. Where front end engineers are building page templates and content managers are managing the pages and the content.
\ No newline at end of file
diff --git a/portal/customization/branding.mdx b/portal/customization/branding.mdx
new file mode 100644
index 0000000000..e0ac2ece7e
--- /dev/null
+++ b/portal/customization/branding.mdx
@@ -0,0 +1,93 @@
+---
+title: "Customize Branding in Developer Portal"
+description: "How to customize branding in developer portal"
+sidebarTitle: "Branding"
+---
+
+In this section we will explain how to apply your branding (styling - CSS) on the portal elements with your own colors and logo within minutes.
+
+**Prerequisites**
+
+- A Tyk Self-Managed [installation](/tyk-self-managed/install)
+- A login for the portal admin app
+- Access to your Tyk portal file system
+
+## Changing Portal Logo
+
+1. Access the file directory for the Developer portal
+2. The default logo is located in `/themes/default/assets/images/` and is called `dev-portal-logo.svg`.
+3. Replace the default image with your own, keeping the same file name and in `.svg` format, ensuring that `xmlns="http://www.w3.org/2000/svg"` is included within your `<svg>` tag.
+
+
+
+    <Note>
+    If you want to use different naming, path reference or extension, the code is `<img src="/assets/images/dev-portal-logo.svg">` and is found on line 6 from the `/themes/default/partials/footer.tmpl` template.
+    </Note>
+
+
+## Changing Brand Colors
+
+Let’s now explain how to manage borders and change the colors of buttons, texts and backgrounds. The file we’ll be looking at is `/themes/default/assets/stylesheets/main.css` which contains some CSS variables that are used throughout the app. Let’s take a closer look.
+You can apply some changes in the portal based on your preferences. For example, you can change the navigation background color, the text color and the different button theme colors. Furthermore, you can change table border color and radius.
+
+If you want to change the navigation background color you need to edit the variable called `--tdp-nav-bg-color` Similarly other variables as you can see where/how each one is used:
+
+
+<Note>
+`tdp` stands for Tyk Developer Portal
+</Note>
+
+
+### Background Colors
+
+<img src="/img/dashboard/portal-management/enterprise-portal/background-colors.png" alt="Background Colour settings Tyk Enterprise Portal" />
+
+- `--tdp-nav-bg-color` navigation background color
+- `--tdp-body-bg-color` App background color
+
+### Text Colors
+
+<img src="/img/dashboard/portal-management/enterprise-portal/text-colors.png" alt="Text Colour settings Tyk Enterprise Portal" />
+
+- `--tdp-text-color` default text color
+- `--tdp-link-color` links (anchor tags)
+- `--tdp-nav-link-color` navigation links
+
+### Borders
+
+<img src="/img/dashboard/portal-management/enterprise-portal/borders.png" alt="Border Colour settings Tyk Enterprise Portal" />
+
+- `--tdp-card-border-radius` Card component
+- `--tdp-border-color-on-error` input color if there’s an error
+- `--tdp-table-border-color` table
+- `--tdp-border-radius` radius
+- `--tdp-primary-border form` elements (such as `<input>` and `<select>`) if active
+- `--tdp-form-element-border` form elements (such as `<input>` and `<select>`)
+
+### Buttons
+
+Buttons have four different concepts and each one of them has two or more variables:
+
+<img src="/img/dashboard/portal-management/enterprise-portal/buttons.png" alt="Button Colour settings Tyk Enterprise Portal" />
+
+**Primary**
+
+- `--tdp-primary-btn-color` background color
+- `--tdp-primary-btn-border` border color
+
+**Secondary**
+
+- `--tdp-secondary-btn-color` background color
+- `--tdp-secondary-btn-border` border color
+
+**Danger**
+
+- `--tdp-danger-btn-color` background color
+- `--tdp-danger-btn-border` border color
+- `--tdp-danger-outline-btn-border` border color of the outline variation
+
+**Warning**
+
+- `--tdp-warning-btn-color` background color
+- `--tdp-warning-btn-border` border color
+- `--tdp-warning-outline-btn-border`  border color of the outline variation
diff --git a/portal/customization/email-notifications.mdx b/portal/customization/email-notifications.mdx
new file mode 100644
index 0000000000..e72affa2ab
--- /dev/null
+++ b/portal/customization/email-notifications.mdx
@@ -0,0 +1,85 @@
+---
+title: "Customize Email Notification in Developer Portal"
+description: "How to customize email notification in developer portal"
+sidebarTitle: "Email Notifications"
+---
+
+The Tyk Enterprise Developer Portal enables admin users to customize emails that are sent to the API consumers and admin users upon certain events that happen on the portal.
+As an admin user, you can fully customize emails that are sent from the  portal.
+
+This section provides a guide to email customization.
+
+## Supported Email Notifications
+
+The Tyk Enterprise Developer Portal sends notifications for the following events:
+
+| Event                                                  | Recipient                     | Email subject                                        | Text template                  | HTML template                  | Default template          |
+| :-------------------------------------------------------- | :------------------------------- | :------------------------------------------------------ | :-------------------------------- | :-------------------------------- | :--------------------------- |
+| Password reset                                         | User who reset their password | Reset password email - subject                       | auth/reset_password.text.tmpl  | auth/reset_password.html.tmpl  | auth/reset_password.tmpl  |
+| New API access request is created                      | All portal admins             | Access request sent for approval (not configurable)  | submitted.text.tmpl            | submitted.html.tmpl            | submitted.tmpl            |
+| API access request approved                            | Developer                     | Approve access request - subject                     | approve.text.tmpl              | approve.html.tmpl              | approve.tmpl              |
+| API access request rejected                            | Developer                     | Reject access request - subject                      | reject.text.tmpl               | reject.html.tmpl               | reject.tmpl               |
+| Pending developer registration request                 | All portal admins             | Invite new admin user - subject                      | newuser.text.tmpl              | newuser.html.tmpl              | newuser.tmpl              |
+| An admin user is invited to register in the portal     | Admin                         | Developer registration approval request - subject    | auth/targeted_invite.text.tmpl | auth/targeted_invite.html.tmpl | auth/targeted_invite.tmpl |
+| A developer is invited to register in the portal       | Developer                     | Invite new user to a consumer organization - subject | auth/targeted_invite.text.tmpl | auth/targeted_invite.html.tmpl | auth/targeted_invite.tmpl |
+| Admin or developer account is activated                | Activated user                | Activate user - subject                              | activate.text.tmpl             | activate.html.tmpl             | activate.tmpl             |
+| Admin or developer account is deactivated              | Deactivated user              | Dectivate user - subject                             | deactivate.text.tmpl           | deactivate.html.tmpl           | deactivate.tmpl           |
+| New consumer organization registration request         | All portal admins             | New organization registration request - subject      | organisation_request.text.tmpl | organisation_request.html.tmpl | organisation_request.tmpl |
+| Consumer organization registration request is approved | Consumer organization admin   | Approve organization registration request - subject  | organisation_approve.text.tmpl | organisation_approve.html.tmpl | organisation_approve.tmpl |
+| Consumer organization registration request is rejected | Consumer organization admin   | Reject organization registration request - subject   | organisation_reject.text.tmpl  | organisation_reject.html.tmpl  | organisation_reject.tmpl  |
+| New admin account is created                           | Admin                         | Welcome email for admins - subject                   | welcome_admin.text.tmpl        | welcome_admin.html.tmpl        | welcome_admin.tmpl        |
+| New developer account is created                       | Developer                     | Welcome email for developers - subject               | welcome_dev.text.tmpl          | welcome_dev.html.tmpl          | welcome_dev.tmpl          |
+| A credential is about to expire                        | Credential owner (developer)  | Your Credential is about to expire (not configurable) | keytoexpire.text.tmpl          | keytoexpire.html.tmpl          | keytoexpire.tmpl          |
+| A credential has expired                               | Credential owner (developer)  | Your Credential has expired (not configurable)       | keyexpired.text.tmpl           | keyexpired.html.tmpl           | keyexpired.tmpl           |
+
+
+## Behavior of Welcome and Activation Emails
+
+When creating a user account from the admin UI or via [the admin APIs](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api), an admin user can create the user account as active or inactive.
+The behavior of activation emails varies depending on whether the user account is activated upon creation:
+- If the user account is created as inactive, the portal will send the welcome email. Then, upon activation of the user account, it will send the activation email.
+- If the user account is created as active, the portal will only send the welcome email and will suppress the activation email.
+
+## Modification of Email Templates
+
+To render an email, the portal uses the email templates that are contained inside `/mailers` directory of your active theme.
+To modify the templates, as an admin user, you need to download and unzip the theme that you want to modify:
+1. Navigate to the Themes menu.
+2. Download the theme that you want to modify:
+   <img src="/img/dashboard/portal-management/enterprise-portal/download-a-theme.png" alt="Download a theme" />
+3. Unzip the theme and navigate to the mailers folder:
+   <img src="/img/dashboard/portal-management/enterprise-portal/mailers-folder.png" alt="Mailers folder" />
+4. Inside the mailer folder there are two types of assets: **layouts** and **templates**:
+- The templates define the content for a specific email notification.
+- The layouts are responsible for displaying the content of the templates.
+
+### Layouts
+
+These are three layouts:
+* **HTML layout**: emails.html.tmpl.
+* **Text layout**: emails.text.tmpl.
+* **The default layout**: emails.tmpl.
+
+The HTML and text layout are used to render HTML and plain text content respectively. If the portal fails to find both the HTML and the text templates, it will use the default one.
+To display the content of a template, the layout use special keyword `yield`: `{{ yield }}`.
+
+### Templates
+
+Each event has three email templates:
+* **HTML template** is used to display the HTML content in email client.
+* **Text template** is used to display the plain text content in email client.
+* **Default template** is used when neither HTML nor text templates is presented.
+
+As an admin user, you can modify any of these templates.
+
+### Applying Changes to Themes
+
+You need to upload the theme to the portal and activate it to make the changes to the email templates effectively:
+1. Navigate to the theme folder. Select all the files and compress them:
+   <img src="/img/dashboard/portal-management/enterprise-portal/compress-a-theme.png" alt="Compress theme" />
+2. As an admin user, navigate to Theme menu. Select the theme you want to update and upload the theme archive:
+   <img src="/img/dashboard/portal-management/enterprise-portal/select-a-theme-file.png" alt="Upload a theme" />
+3. Once the theme archive is selected, click on the Save changes button to upload the archive:
+   <img src="/img/dashboard/portal-management/enterprise-portal/upload-a-theme.png" alt="Upload a theme" />
+4. Finally, you need to activate the theme if it's not already active:
+   <img src="/img/dashboard/portal-management/enterprise-portal/activate-theme.png" alt="Activate a theme" />
diff --git a/portal/customization/markdown.mdx b/portal/customization/markdown.mdx
new file mode 100644
index 0000000000..d0dea27744
--- /dev/null
+++ b/portal/customization/markdown.mdx
@@ -0,0 +1,251 @@
+---
+title: "Markdown in Developer Portal"
+description: "Markdown capabilities, supported features, and known limitations when writing content in the Tyk Enterprise Developer Portal"
+sidebarTitle: "Markdown"
+---
+
+The Tyk Developer Portal supports Markdown for writing content. This page explains where Markdown can be used, which features are supported, and what limitations to be aware of.
+
+## Where Markdown Can Be Used
+
+Markdown is supported in three areas of the portal. All three use the same rendering engine, so content behaves the same in Blog Posts, Pages, and Product Documentation.
+
+### Blog Posts
+
+Blog posts can be written in Markdown. In the Admin UI under **Blog → New Post**, enable the **"Display Markdown"** checkbox to activate Markdown rendering for the post.
+
+<Note>
+When Markdown is enabled for a blog post, the template uses the `markdownify` function to render the content. See the [blog post template data](/portal/customization/templates#blog-detail) for details on `MarkdownEnabled` and `MarkdownContent`.
+</Note>
+
+### Pages
+
+Pages consist of multiple content blocks (e.g. header, text sections, image sections). Each content block can individually be switched to Markdown. This allows you to build landing pages where specific sections use Markdown while others use HTML.
+
+See [Customize Pages](/portal/customization/pages) for how to create and edit pages and their content blocks.
+
+### Product Documentation (Getting Started Guides)
+
+Each API Product has a "Getting started" tab where you can add documentation pages that support Markdown. These entries appear as sidebar navigation in the Live Portal.
+
+This works well for API guides, authentication instructions, and quickstart tutorials. See [Getting Started Guide](/portal/api-products#getting-started-guide) for more details.
+
+### Where Markdown Does Not Work
+
+- **Product "More info"** (Overview tab): Markdown syntax is not rendered
+- **API Description**: No Markdown support
+- **API Specification**: No Markdown support. Uploaded specifications render in dedicated viewers instead. OpenAPI/Swagger specifications use Stoplight Elements. GraphQL SDL is rendered via GraphQL Playground for GraphQL APIs; in the default theme/setup, SDL attached to non-GraphQL APIs may fall back to Stoplight.
+
+## Supported Features
+
+### Text Formatting
+
+| Feature | Syntax | Result |
+|---------|--------|--------|
+| Headings (H1–H6) | `# Title` through `###### Small` | Rendered with automatic anchor IDs |
+| Bold | `**bold**` | **bold** |
+| Italic | `*italic*` | *italic* |
+| Bold and Italic | `***both***` | ***both*** |
+| Strikethrough | `~~strikethrough~~` | ~~strikethrough~~ |
+
+### Links and Images
+
+| Feature | Syntax |
+|---------|--------|
+| Inline link | `[Text](url)` |
+| Reference link | `[Text][ref]` with `[ref]: url` |
+| Autolink | `https://example.com` becomes clickable automatically |
+| Image | `![Alt text](https://example.com/image.png)` |
+| Reference image | `![Alt][ref]` with `[ref]: url` on a separate line |
+| Image as link | `[![Alt](image-url)](link-url)` |
+
+<Note>
+Markdown images (`![alt](https://example.com/image.png)`) do not support specifying width or height. To control image dimensions, use an HTML `<img>` tag instead: `<img src="url" width="400" height="200" alt="description">`.
+
+Reference-style images (`![Alt][ref]`) require a blank line between the image and the reference definition. If they are in the same paragraph, the reference is not resolved.
+</Note>
+
+### Lists
+
+Bullet lists, numbered lists, and task lists are supported, with nesting up to 5 levels:
+
+```markdown
+- Item one
+  - Nested item
+    - Deeply nested
+1. First
+2. Second
+- [x] Completed task
+- [ ] Open task
+```
+
+Task lists render with checkboxes.
+
+### Code
+
+Inline code uses single backticks: `` `code` ``
+
+Fenced code blocks use triple backticks with an optional language tag:
+
+````markdown
+```python
+def hello():
+    print("Hello, World!")
+```
+````
+
+<Note>
+Code blocks render in monospace but without syntax color highlighting in the default theme.
+</Note>
+
+### Blockquotes
+
+```markdown
+> This is a blockquote
+> > Nested blockquotes work too
+```
+
+Blockquotes support formatting inside them (bold, italic, links, code, lists).
+
+<Note>
+The default theme does not apply visual styling (indentation or border) to blockquotes. They may appear as regular text.
+</Note>
+
+### Tables
+
+Standard GitHub Flavored Markdown (GFM) table syntax is supported, including column alignment:
+
+```markdown
+| Left aligned | Center aligned | Right aligned |
+|:-------------|:--------------:|--------------:|
+| Value        | Value          | Value         |
+```
+
+<Note>
+The default theme does not render table borders. See [Table styling workarounds](#table-styling) below for workarounds.
+</Note>
+
+### Horizontal Rules
+
+Any of these syntaxes produce a horizontal rule:
+
+```markdown
+---
+***
+___
+```
+
+### Other Supported Features
+
+| Feature | Details |
+|---------|---------|
+| Escaping | `\*` renders a literal asterisk |
+| HTML entities | `&copy;` renders © |
+| Frontmatter | A YAML block (`---`...`---`) at the start is **not** hidden. The delimiters render as horizontal rules and the YAML content renders as text |
+| Unicode | Umlauts, emojis (😀🚀), CJK characters are all supported |
+| Nesting | Lists in blockquotes, blockquotes in lists, code in lists, etc. |
+
+## Embedding HTML
+
+HTML tags can be used directly within Markdown content for advanced formatting:
+
+### Text Formatting
+
+```html
+<span style="color: red;">Colored text</span>
+<sup>superscript</sup> and <sub>subscript</sub>
+```
+
+### Media Embedding
+
+**YouTube video:**
+```html
+<iframe width="560" height="315"
+  src="https://www.youtube.com/embed/VIDEO_ID"
+  frameborder="0"
+  allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
+  allowfullscreen>
+</iframe>
+```
+
+**Vimeo video:**
+```html
+<iframe src="https://player.vimeo.com/video/VIDEO_ID"
+  width="640" height="360"
+  frameborder="0"
+  allow="autoplay; fullscreen"
+  allowfullscreen>
+</iframe>
+```
+
+**HTML5 video and audio:**
+```html
+<video controls><source src="video.mp4" type="video/mp4"></video>
+<audio controls><source src="audio.ogg" type="audio/ogg"></audio>
+```
+
+### Custom Layouts
+
+```html
+<div style="background: #f0f8ff; padding: 10px; border-radius: 4px;">
+  This is a custom callout box.
+</div>
+
+<img src="image.png" width="400" height="200" alt="Sized image">
+```
+
+## Not Supported
+
+The portal does not render the following Markdown extensions:
+
+| Feature | What Happens |
+|---------|-------------|
+| Footnotes | `[^1]` remains as plain text |
+| Definition Lists | `Term` followed by `: Definition` is not recognized |
+| Emoji shortcodes | `:smile:` remains as text (use Unicode emojis directly instead) |
+| Math/LaTeX | `$E=mc^2$` is not rendered |
+
+## Known Limitations and Workarounds
+
+### Table Styling
+
+Markdown tables are generated correctly but the default theme does not display borders. You can work around this in two ways:
+
+**Option 1: HTML table with Bootstrap class**
+
+```html
+<table class="table">
+  <thead>
+    <tr><th>Column 1</th><th>Column 2</th></tr>
+  </thead>
+  <tbody>
+    <tr><td>Value 1</td><td>Value 2</td></tr>
+  </tbody>
+</table>
+```
+
+**Option 2: Markdown table with style wrapper**
+
+```markdown
+<style>
+.nice-table table { border-collapse: collapse; width: 100%; }
+.nice-table th, .nice-table td { border: 1px solid #ddd; padding: 8px; }
+.nice-table th { background: #f5f5f5; }
+</style>
+
+<div class="nice-table">
+
+| Column 1 | Column 2 |
+|----------|----------|
+| Value 1  | Value 2  |
+
+</div>
+```
+
+### Blockquotes Without Styling
+
+Blockquotes are generated in the HTML output but the default theme does not display any indentation or border. They appear as regular text. Adjust your theme's CSS to style the `blockquote` element if needed.
+
+### Code Without Syntax Highlighting
+
+Code blocks render in monospace font but without syntax color highlighting in the default theme.
\ No newline at end of file
diff --git a/portal/customization/menus.mdx b/portal/customization/menus.mdx
new file mode 100644
index 0000000000..47669d4c2c
--- /dev/null
+++ b/portal/customization/menus.mdx
@@ -0,0 +1,118 @@
+---
+title: "Customize Menus in Developer Portal"
+description: "How to customize menus in developer portal"
+sidebarTitle: "Menus"
+---
+
+The Developer portal has two types of menus:
+1. The main navigation at the top (in the header)
+2. The footer at the bottom.
+
+Both of them are defined as [partials](/portal/customization/themes#file-structure-of-a-theme) in the portal directory in `/themes/default/partials/`.
+
+## Top Navigation Menu
+
+The Enterprise Developer portal enables admin users to customize the navigation menu that appears on the top navigational bar of the live portal. An admin user can create and manage menu items without any code from the admin dashboard of the Developer portal.
+<img src="/img/dashboard/portal-management/enterprise-portal/top-nav-menu.png" alt="The navigation menu" />
+
+Each menu item may:
+- lead to a specific page or URL:
+  <img src="/img/dashboard/portal-management/enterprise-portal/regular-menu-item.png" alt="Regular menu item" />
+- show a dropdown list with possible navigational options:
+  <img src="/img/dashboard/portal-management/enterprise-portal/dropdown-menu-item.png" alt="Dropdown menu item" />
+
+Admin users can create additional navigational menus and render them on any page of the live portal. This customization requires changes to a theme and is covered in the [Full customization section](/portal/customization/menus).
+
+### Manage Menu Items
+
+The management of the menu items is done from the **Menus** section of the Developer portal.
+
+1. Open the admin dashboard. Navigate to the **Menus** section.
+   <img src="/img/dashboard/portal-management/enterprise-portal/navigation-to-menus-section.png" alt="Navigate to the Menus section" />
+
+2. Select a menu that you want to modify. By default, the Developer portal has only one **Primary** menu. If you want to add more menus and render them on the live portal, please refer to [Full customization section](/portal/customization/menus).
+   <img src="/img/dashboard/portal-management/enterprise-portal/select-a-menu.png" alt="Select a menu" />
+
+3. Click on a **menu item** to modify it. You can change the following items:
+    1. **Title** that will be exposed to developers.
+    2. **Path** where developers will be redirected by clicking on that menu item.
+    3. **Children** items that will be exposed in the dropdown list that will appear when hovering mouse over the menu item.
+    4. To make the changes effectively, you need to save the changes by clicking on the **Save changes** button.
+       <img src="/img/dashboard/portal-management/enterprise-portal/menu-item.png" alt="Modify a menu item" />
+
+4. To remove a menu item from the menu click on the **bin** icon and click on the **Save changes** button.
+   <img src="/img/dashboard/portal-management/enterprise-portal/delete-a-menu-item.png" alt="Delete a menu item" />
+
+### Create New Menu Items
+To create a new menu item, you need to:
+
+1. Click on the **Add Menu Item** button.
+2. Fill **Title**, **Path**, and **Children** fields. Save the changes by clicking on the **Save changes** button.
+   <img src="/img/dashboard/portal-management/enterprise-portal/save-new-menu-item.png" alt="Save a menu item" />
+
+The new menu item will appear on the live portal immediately.
+<img src="/img/dashboard/portal-management/enterprise-portal/new-menu-item-on-the-live-portal.png" alt="New menu item on the live portal" />s
+
+### Update Existing Menus
+
+1. Log into your portal
+2. Select **Menus** from the navigation menu
+3. Click **Primary** to edit the menu
+
+<img src="/img/dashboard/portal-management/enterprise-portal/edit-menu.png" alt="Edit Menu dialog" />
+
+**Field Descriptions**
+
+- **Name**: You can give it any name you like, it does not have any effect in the live portal nor the admin app.
+- **Path**: This will be used in the code as a reference in order to render the menu. If you don’t have access to the template files, we recommend that you do not edit this field. Editing the `Path` for the default menus will hide the menu as there will be a mismatch between the Path and the reference in the template.
+- **Menu Items**:
+  1. **Title**: This will be the text that will be displayed in the live portal.
+  2. **Path**: this is where the user will be redirected to.
+  3. **Children**: In this section you add another nested menu item. We have added a dummy item (Product 1) to demonstrate
+
+Below is the menu item from its own view, which is available from the **Menu Items** option in the admin app side menu.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/edit-menu-item.png" alt="Edit Menu item dialog" />
+
+Here's the menu as displayed in the app:
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-menu-live.png" alt="Live menu in app" />
+
+We have mentioned above the relationship between a menu’s `Path` and the code reference in the menu template. Let’s see how the main menu template looks like (the file is `/themes/default/partials/` directory and is called `top_nav.tmpl`) for the part that we are interested in:
+
+```go
+{{ if GetMenus.Primary }}
+  {{ range GetMenus.Primary.Children }}
+    <li class="nav-item {{ if .Children }}dropdown{{end}} mr-2">
+      <a class="nav-link {{ if .Children }}dropdown-toggle{{end}}" href="{{.Path}}" {{ if .Children }}data-toggle="dropdown" aria-haspopup=”true" aria-expanded="false"{{end}}>{{.Tag}}</a>
+      {{ if .Children }}
+        <ul class="dropdown-menu submenu" aria-labelledby="navbarDropdownMenuLink">
+          {{ range .Children }}
+            <li class="nav-item">
+              <a class="dropdown-item" href="{{.Path}}">{{.Tag}}</a>
+            </li>
+          {{ end }}
+        </ul>
+      {{ end }}
+    </li>
+  {{ end }}
+{{ end }}
+```
+Let's pick each line that is used to render the menu attributes and see how they work:
+
+1. `{{ if GetMenus.Primary }}`: This statement calls the “GetMenus” function and checks if there is a menu called `Primary`. If present, it goes into the next line:
+2. `{{ range GetMenus.Primary.Children }}` Each Menu (Primary) has some children (Menu items) so what this code does is loop through all the children and they are rendered as below:
+
+```go
+<li class="nav-item {{ if .Children }}dropdown{{end}} mr-2">
+<a class="nav-link {{ if .Children }}dropdown-toggle{{end}}" href="{{.Path}}" {{ if .Children }}data-toggle="dropdown" aria-haspopup=”true" aria-expanded="false"{{end}}>{{.Tag}}</a>
+```
+Where:
+
+- `{{ .Path }}` is the Path we have defined from the UI and
+- `{{ .Tag }}` is the Name we have defined from the UI.
+
+So this will render all the menu items (Catalogs - as per screenshot) of the menu (Primary - the name we’ve given to the menu).
+
+3. `{{ if .Children }}`: This line checks if the menu item has any submenus. If it does it loops through those children `{{ range .Children }}` and finally renders them `<a class="dropdown-item" href="{{.Path}}">{{.Tag}}</a>` similarly as the main menu items.
+So now the child of **Catalogs** which we named **Product 1** has been rendered.
diff --git a/portal/customization/pages.mdx b/portal/customization/pages.mdx
new file mode 100644
index 0000000000..dd54f7e1d6
--- /dev/null
+++ b/portal/customization/pages.mdx
@@ -0,0 +1,157 @@
+---
+title: "Customize Pages in Developer Portal"
+description: "How to customize pages in developer portal"
+sidebarTitle: "Pages"
+---
+
+We suggest you read the [portal concepts](/portal/overview/concepts) first. If you've already done that, we will show you an example on how to:
+
+- create a new layout.
+- create a new template from the file system.
+- create a new page from the admin dashboard.
+
+**Prerequisites**
+
+- Access to the file system
+- Access to your Tyk Self-Managed installation
+
+## Create a New Page using an Existing Template
+
+Follow the example below to create a new page called “My first page” using an existing template.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/create-new-page1.png" alt="The pages section within the Tyk Enterprise Portal app" />
+
+1. Log in to the Admin Dashboard.
+2. Navigate to Pages from the side bar menu.
+3. Click Add and enter the following values:
+
+<img src="/img/dashboard/portal-management/enterprise-portal/add-a-content-page-using-an-existing-template.png" alt="Add a new content page" />
+
+## Create a New Page
+
+### Create the Layout File
+
+A layout behaves like a component that can be reused to inject templates in order to avoid duplicating elements such as `<head>` and `<link>`.So let’s create one that looks like the one below.
+
+1. From the file system navigate to `/themes/default/layouts`.
+2. Create a new file named `my_layout.tmpl`.
+3. Copy the code below, paste it to your new layout file and save it.
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+
+ <head>
+
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+    <meta name="description" content="">
+    <meta name="author" content="">
+
+   <title>{{ if .page}} {{.page.Title}} {{else}} Developer Portal {{end}}</title>
+
+    {/* Bootstrap core CSS */}
+    <link href="/system/vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet">
+    <link href="/assets/stylesheets/fonts.css" rel="stylesheet">
+    <link href="/assets/stylesheets/main.css" rel="stylesheet">
+
+ </head>
+
+ <body>
+    {{ render "top_nav" . }}
+    <div class="page-wrapper">
+      {/* Page Content */}
+      {{ yield }}
+   </div>
+
+
+   {{ render "footer" . }}
+
+ </body>
+
+</html>
+```
+
+<Note>
+The above snippet is taking into account the default developer portal setup, directories and references of the appropriate styling files.
+</Note>
+
+
+We have also added the top and footer navigation menus for demonstration purposes, `{{ render "top_nav" . }}` and `{{ render "footer" . }}` respectively.
+
+### Create the Template File
+
+
+<Note>
+Only follow this step after creating a new template file in Section 1 above, unless you want to use an existing template.
+</Note>
+
+
+1. From the file system; navigate to `/themes/default/views`.
+2. Create a new file (template)
+3. In this example, we will keep it simple and create a couple of HTML tags. Copy and paste the following code:
+
+```go
+<div class="container">
+  <h1>{{ .page.Title }}</h1>
+  <p> {{ .blocks.Description.Content }}</p>
+</div>
+```
+In this example, we use the code references in the template:
+- Inside the template’s `<h1>` we use `{{ .page.Title }}` to display the page name.
+- Inside the template’s `<p>` we use `{{ .blocks.Description.Content }}` to display the page content.
+
+4. Name this `my_template.tmpl` and save it.
+5. You now need to reference your new layout and template. From your Manifest file (`themes.json`) add a new key to the object that will look like this:
+
+```json
+{
+  "name": "My new Template",
+  "template": "my_template",
+  "layout": "my_layout"
+}
+```
+Alternatively, you can give it your preferred name but reference the template and layout names we created earlier in the manifest file.
+
+6. Now restart your developer portal service and go through the tutorial on how to add a new page. The template dropdown within the add new page form should have a new entry called `My new Template`, so create a page that will look like this:
+
+<img src="/img/dashboard/portal-management/enterprise-portal/add-page-details.png" alt="Add new page details" />
+
+7. Now navigate to the path we have entered on your browser (`my-domain.io/my-first-page`) and you should be able to see your new page with the content added via the UI:
+
+<img src="/img/dashboard/portal-management/enterprise-portal/my-first-page-example.png" alt="Example new UI page" />
+
+Taking as a scenario our above example, let’s see a visual explaining the correlation between the different files and UI.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/scenario-correlation-diagram.png" alt="Scenario correlation" />
+
+
+## Edit Page Content
+
+Content managers or similar roles that are responsible for the content displayed on the developer portal can edit and manage pages within the **Page section** of the Developer Portal.
+
+**Prerequisites**
+
+- Install the Developer portal
+- Log in to the portal dashboard
+- Default pages available or a page created by a developer which has the custom theme linked to it
+
+### Instructions
+
+1. From the Pages section, open an existing page. This could be a page based on the default template or a new page that one of your developers set up when creating a new custom template.
+2. Edit the page meta data. Change the name of the page if needed. Set or change the path URL if needed.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/page-content-edit.png" alt="Edit Portal page content" />
+
+3. Edit the page content within the existing content blocks. Each content block can be switched to Markdown individually. See the [Markdown reference](/portal/customization/markdown) for supported features and limitations.
+
+
+
+    <Note>
+    The content block name is linked to the content block name in the template html file. If this name is changed, and not reflected in the template html, the page will get an error and won’t show.
+    </Note>
+
+
+4. Publish the page and view it from the external portal URL. If you want the page to be published and visible on the external portal, you need to change the state to Published.
+
+
diff --git a/portal/customization/sign-up.mdx b/portal/customization/sign-up.mdx
new file mode 100644
index 0000000000..d4a8084f2f
--- /dev/null
+++ b/portal/customization/sign-up.mdx
@@ -0,0 +1,46 @@
+---
+title: "Customize Sign Up Form in Developer Portal"
+description: "How to customize sign up form in developer portal"
+sidebarTitle: "Sign Up Form"
+---
+
+In this section, you will learn how to customize the sign-up form for your API Consumers and extend the data stored in the user profile.
+To achieve that, you will need to:
+- Add a new attribute to the user profile and make it available in the sign-up form.
+- Optionally, add a description and set other parameters that suit your requirements.
+
+## Navigate to the Custom Attributes menu
+
+To customize the sign-up form, you need to add new data attributes to the user model so that when a user profile is being created, those attributes will be recorded against the user profile.
+To start customizing the user sign-up form, navigate to the **Custom attributes** menu and the select the **User** model. Currently, it is possible to extend only the user model. In future releases we will add the same capabilities to other models.
+<img src="/img/dashboard/portal-management/enterprise-portal/navigate-to-user-attributes.png" alt="Navigate to the User's attributes" />
+
+## Add a new attribute to the user model
+To add a new attribute to the user model, click on the **Add Custom attribute** button and then fill in properties of the new attribute:
+- **Attribute ID**: A string that consists of letters (a-zA-Z), numbers (0-9), dashes, and underscores. This is used to reference the attribute in the [Admin APIs](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) screen.
+- **Attribute Label**: The attribute's name that is displayed in the UI.
+- **Description**: Explains the intended usage of this attribute. It is also displayed in the UI.
+- **Type of attribute**: The type of data that can be stored in this attribute. You cannot change the value of this field once the attribute is created. The following data types are acceptable:
+  - Boolean (true or false).
+  - Dropdown (a list of values).
+  - String.
+  - Number.
+- **Validation Reg Exp**: A regular expression that is used to validate the value of this field. It is available for the **String** data type only.
+- **Enable validation**: Determines if the portal should apply the regular expression defined in the **Validation Reg Exp** to validate the value of this attribute when creating or updating a user profile. It is available for the **String** data type only.
+- **Dropdown Values**: A list of values for the attribute. It is available for the **Dropdown** data type only.
+- Fields that define the attribute's behavior:
+  - **Write once read many**: Determines if the value of the attribute can be changed after a user profile is created.
+  - **Add to the key metadata**: Determines if the value of the attribute should be added to the metadata of Auth keys or OAuth2.0 clients when a user creates them. Keep in mind that credential-level metadata will be accessible in both the gateway runtime and gateway database. Please be cautious when handling personally identifiable information (PII) data.
+  - **Required**: Determines if this attribute is required to create a user profile.
+  - **Show on sign-up form**: Determines if this attribute should be visible in the sing-up form.
+- **Behavior**: Determines if developers can view or edit this attribute. Possible values are:
+  - Developers can view and edit the attribute.
+  - Developers can only view the attribute.
+  - Developers cannot see the attribute.
+
+For the purpose of this guide, make sure to tick the **Required** and **Show on sign-up form** checkboxes and select the **Developers can only view the attribute** option.
+<img src="/img/dashboard/portal-management/enterprise-portal/add-new-attribute-to-user-model.png" alt="Add a new attribute to the user model" />
+
+The new attribute will be added to the user sign-up form, once you have created a new custom attribute and saved changes to the user model by clicking on the **Save** button.
+<img src="/img/dashboard/portal-management/enterprise-portal/custom-attribute-in-the-sign-up-form.png" alt="Customized user sign-up form" />
+
diff --git a/portal/customization/templates.mdx b/portal/customization/templates.mdx
new file mode 100644
index 0000000000..c01f713827
--- /dev/null
+++ b/portal/customization/templates.mdx
@@ -0,0 +1,1936 @@
+---
+title: "Customize Templates in Developer Portal"
+description: "How to customize templates in developer portal"
+sidebarTitle: "Templates"
+---
+
+Templates are a fundamental component of the Tyk Enterprise Developer Portal, enabling dynamic content generation and
+customization. The portal uses Golang templates to render the live portal views, allowing you to generate dynamic HTML
+by embedding directives inside HTML that are replaced with values when the template is executed.
+
+Golang's templates use the following syntax:
+- `{{ . }}` to output a value
+- `{{ .FieldName }}` to access a field of an object
+- `{{ .MethodName }}` to call a method on an object 
+- `{{ if }} {{ else }} {{ end }}` for conditionals
+- `{{ range . }} {{ . }} {{ end }}` to iterate over a slice
+- Functions can be called like `{{ FuncName . }}` or just `{{ FuncName }}`
+
+These templates are part of the default theme that ships with the portal, which can be fully customized by modifying the
+template files. The templates have access to template data which contains dynamic values that can be rendered into the
+HTML. There are also a number of global helper functions available to transform data before output.
+
+The Tyk Enterprise Developer Portal uses several types of templates to render different parts of the portal:
+- Public Pages Templates: Render the portal's publicly accessible pages (such as Home, About Us, and Blog pages),
+forming the foundation of your portal's public-facing content. These can be customized through the Pages
+[section](/portal/customization/pages#edit-page-content)
+of the admin dashboard.
+- Private Pages Templates: Responsible for rendering the portal's authenticated user pages, like Profile settings and
+My Apps.
+- Email Templates: Define the structure and content of emails sent by the portal, such as signup confirmations or access
+request approvals.
+
+Both Public and Private Pages Templates have access to global helper functions (funcmaps) and template-specific data.
+Email templates can include template data and specific template functions, but do not have access to the global helper
+functions.
+
+The following sections provide comprehensive information on the various components of the Tyk Enterprise Developer
+Portal templates:
+
+- [Template Data](#template-data): Detailed explanation of the data structures available in different templates.
+- [Global Helper Functions](#global-helper-functions): A list of global functions that can be used across templates to
+manipulate and display data.
+- [Email Templates](#email-templates): Information about email-specific templates and their available data.
+
+## Template Data
+
+This section outlines the Tyk Enterprise Developer Portal templates that have access to specific template data. 
+It's important to note that data availability varies between templates, depending on their context and purpose.
+For instance, a product detail template has access to product-specific data that may not be available in a blog listing
+template.
+
+### Templates with specific template data
+
+- [Analytics](#analytics)
+- [Application Create](#application-create)
+- [Application Detail](#application-detail)
+- [Blogs](#blogs)
+- [Blog Detail](#blog-detail)
+- [Cart Checkout](#cart-checkout)
+- [Organization User Detail](#organization-user-detail)
+- [Organization User Edit](#organization-user-edit)
+- [Organization Users List](#organization-users-list)
+- [Product Detail](#product-detail)
+- [Product OAS Documentation](#product-oas-documentation)
+
+### Analytics
+
+**Template Path**: `themes/default/views/analytics.tmpl`
+
+This template is used to render the analytics page.
+
+#### Available Objects
+
+- `{{ .errors }}`: Map of template errors (Key: category, Value: error message)
+- `{{ .apps }}`: List of available applications
+
+#### Application Attributes
+
+Accessible via `{{ range .apps }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Application ID |
+| `{{ .Name }}` | Application name |
+| `{{ .Description }}` | Application description |
+| `{{ .RedirectURLs }}` | Application redirect URLs |
+
+##### Example Usage
+```html
+<select id="analytics-overview-select-apps" class="analytics-select-overview">
+  <option value="0" selected>All apps</option>
+  {{ range $app := .apps }}
+    <option value="{{ $app.ID }}">
+      {{ $app.Name }}
+    </option>
+  {{ end }}
+</select>
+```
+
+### Application Create
+
+**Template Path**: `themes/default/views/app_form_create.tmpl`
+
+This template is used to render the application creation form.
+
+#### Available Objects
+
+- `{{ .errors }}`: Map of template errors (Key: category, Value: error message)
+
+##### Example Usage
+```html
+{{ if .errors }}
+{{ range $key, $errs := .errors }}
+<div class="alert alert-warning cart-error" role="alert">
+  <i class="tyk-icon tykon tykon-warning"></i>
+  <div class="alert__content">
+    <strong>{{ $key }}</strong>
+    <ul>
+      {{ range $errs }}
+      <li>{{ . }}</li>
+      {{ end }}
+    </ul>
+  </div>
+</div>
+{{ end }}
+{{ end }}
+```
+
+### Application Detail
+
+**Template Path**: `themes/default/views/app_form_update.tmpl`
+
+This template is used to render the application detail and update form.
+
+#### Available Objects
+
+- `{{ .errors }}`: Map of template errors (Key: category, Value: error message)
+- `{{ .app }}`: Selected application object.
+- `{{ .appCerts }}`: Map of application MTLS certificates if applicable (Key: access request ID, Value: certificate)
+- `{{ .allCerts }}`: Map of all MTLS certificates stored if applicable (Key: cert fingerprint, Value: cert)
+
+#### MTLS Certificate Attributes (appCerts)
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Certificate ID |
+| `{{ .Name }}` | Certificate name |
+| `{{ .Fingerprint }}` | Certificate fingerprint |
+| `{{ .SignatureAlgorithm }}` | Signature algorithm |
+| `{{ .Issuer }}` | Certificate issuer |
+| `{{ .IsValid }}` | Boolean indicating if the certificate is valid |
+| `{{ .ValidNotBefore }}` | Start date of validity |
+| `{{ .ValidNotAfter }}` | End date of validity |
+| `{{ .Subject }}` | Certificate subject |
+
+#### MTLS Certificate Attributes (allCerts)
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Certificate ID |
+| `{{ .Name }}` | Certificate name |
+
+#### Client Attributes
+
+Accessible via `{{ .app }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Client ID |
+| `{{ .Name }}` | Client name |
+| `{{ .Description }}` | Client description |
+| `{{ .RedirectURLs }}` | Client redirect URLs |
+| `{{ .Credentials }}` | Array of client credentials |
+| `{{ .AccessRequests }}` | Array of client access requests |
+
+#### Client Credentials Attributes
+
+Accessible via `{{ range $cred := .app.Credentials }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Credential ID |
+| `{{ .Credential }}` | Credential |
+| `{{ .CredentialHash }}` | Credential hash |
+| `{{ .OAuthClientID }}` | OAuth client ID |
+| `{{ .OAuthClientSecret }}` | OAuth client secret |
+| `{{ .Expires }}` | Credential expiration |
+| `{{ .AccessRequestID }}` | Access request ID associated with the credential |
+
+#### Client Access Requests Attributes
+
+Accessible via `{{ range $acreq := .app.AccessRequests }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Access request ID |
+| `{{ .Status }}` | Access request status |
+| `{{ .UserID }}` | User ID associated with access request |
+| `{{ .AuthType }}` | Access request auth type |
+| `{{ .DCREnabled }}` | true if access request DCR enabled |
+| `{{ .ProvisionImmediately }}` | true if provisioned immediately is enabled |
+| `{{ .CatalogueID }}` | Catalogue ID |
+
+#### Product Attributes (within Access Request)
+
+Accessible via `{{ $product := $acreq.Product }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Product ID |
+| `{{ .Name }}` | Product name |
+| `{{ .DisplayName }}` | Product display name |
+| `{{ .Path }}` | Product path |
+| `{{ .Description }}` | Product description |
+| `{{ .Content }}` | Product content |
+| `{{ .AuthType }}` | Product auth type |
+| `{{ .DCREnabled }}` | true if product DCR enabled |
+
+#### Plan Attributes (within Access Request)
+
+Accessible via `{{ $acreq.Plan }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Name }}` | Plan name |
+| `{{ .DisplayName }}` | Plan display name |
+| `{{ .Description }}` | Plan description |
+| `{{ .AuthType }}` | Plan auth type |
+| `{{ .Rate }}` | Plan rate |
+| `{{ .Per }}` | Plan period |
+| `{{ .QuotaMax }}` | Plan quota maximum |
+| `{{ .QuotaRenewalRate }}` | Plan quota renewal rate |
+| `{{ .AutoApproveAccessRequests }}` | true if auto-approve access requests is enabled |
+
+##### Example Usage
+```html
+<h1>{{ .app.Name >}}</h1>
+<p>{{ .app.Description }}</p>
+<h2>Credentials</h2>
+{{ range $cred := .app.Credentials }}
+<div>
+  <p>ID: {{ $cred.ID }}</p>
+  <p>OAuth Client ID: {{ $cred.OAuthClientID }}</p>
+  <p>Expires: {{ $cred.Expires }}</p>
+</div>
+{{ end }}
+<h2>Access Requests</h2>
+{{ range $acreq := .app.AccessRequests }}
+<div>
+  <p>ID: {{ $acreq.ID }}</p>
+  <p>Status: {{ $acreq.Status }}</p>
+  <p>Product: {{ $acreq.Product.Name }}</p>
+  <p>Plan: {{ $acreq.Plan.Name }}</p>
+</div>
+{{ end }}
+```
+
+### Blogs
+
+**Template Path**: `themes/default/views/blog_listing.tmpl`
+
+This template is used to render the blog listing page.
+
+#### Available Objects
+
+- `{{ .posts }}`: List of all published blog posts
+
+#### Blog Attributes
+
+Accessible via `{{ range .posts }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Title }}` | Blog post title |
+| `{{ .Lede }}` | Blog post summary |
+| `{{ .Content }}` | Blog post content |
+| `{{ .MarkdownContent }}` | Markdown content (see [Markdown reference](/portal/customization/markdown)) |
+| `{{ .MarkdownEnabled }}` | Boolean for Markdown enablement |
+| `{{ .Path }}` | Blog post path |
+| `{{ .HeaderImage.URL }}` | Header image URL |
+| `{{ .BlogSiteID }}` | Blog site ID |
+| `{{ .ProductID }}` | Associated product ID |
+| `{{ .AuthorID }}` | Author ID |
+| `{{ .URL }}` | Full URL of the blog post |
+
+##### Example Usage
+```html
+<h1>Blog Posts</h1>
+{{ range .posts }}
+<div class="blog-post">
+  <h2><a href="{{ .URL }}">{{ .Title }}</a></h2>
+  <img src="{{ .HeaderImage.URL }}" alt="{{ .Title }}">
+  <p>{{ .Lede }}</p>
+</div>
+{{ end }}
+```
+
+### Blog Detail
+
+**Template Path**: `themes/default/views/blog_detail.tmpl`
+
+This template is used to render the blog detail page.
+
+#### Available Objects
+
+- `{{ .post }}`: The selected blog post object. 
+- `{{ .latest_posts }}`: List of 3 latest blog posts.
+
+#### Blog Attributes
+
+Accessible via `{{ .post }}` or `{{ range .latest_posts }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Title }}` | Blog post title |
+| `{{ .Lede }}` | Blog post summary |
+| `{{ .Content }}` | Blog post content |
+| `{{ .MarkdownContent }}` | Markdown content (see [Markdown reference](/portal/customization/markdown)) |
+| `{{ .MarkdownEnabled }}` | Boolean for Markdown enablement |
+| `{{ .Path }}` | Blog post path |
+| `{{ .HeaderImage.URL }}` | Header image URL |
+| `{{ .BlogSiteID }}` | Blog site ID |
+| `{{ .ProductID }}` | Associated product ID |
+| `{{ .AuthorID }}` | Author ID |
+| `{{ .URL }}` | Full URL of the blog post |
+
+##### Example Usage
+```html
+<h1>{{ .post.Title }}</h1>
+<img src="{{ .post.HeaderImage.URL }}" alt="{{ .post.Title }}">
+<p>{{ .post.Lede }}</p>
+{{ if .post.MarkdownEnabled }}
+{{ .post.MarkdownContent | markdownify }}
+{{ else }}
+{{ .post.Content }}
+{{ end }}
+<p>Read more at: <a href="{{ .post.URL }}">{{ .post.URL }}</a></p>
+<h2>Latest Posts</h2>
+{{ range .latest_posts }}
+<div>
+  <h3><a href="{{ .URL }}">{{ .Title }}</a></h3>
+  <p>{{ .Lede }}</p>
+</div>
+{{ end }}
+```
+
+### Cart Checkout 
+
+**Template Path**: `themes/default/views/portal_checkout.tmpl`
+
+This template is used to render the cart checkout page.
+
+#### Available Objects
+
+- `{{ .cart }}`: Map with the cart items for the current user
+- `{{ .apps }}`: List of applications for the current user
+- `{{ .catalogue_count }}`: Cart catalogues count
+- `{{ .certs }}`: List of MTLS certificates if applicable
+- `{{ .errors }}`: Map of template errors (Key: category, Value: error message)
+- `{{ .provisioned }}`: Boolean indicating whether an access request has been provisioned for the cart
+
+#### Application Attributes
+
+Accessible via `{{ range .apps }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Name }}` | Application name |
+| `{{ .Description }}` | Application description |
+| `{{ .RedirectURLs }}` | Application redirect URLs |
+
+#### MTLS Certificate Attributes
+
+Accessible via `{{ range .certs }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Certificate ID |
+| `{{ .Name }}` | Certificate name |
+
+#### Cart Item Attributes
+
+Accessible via `{{ range $key, $value := .cart }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $value.AuthType }}` | Cart item auth type |
+| `{{ $value.Catalogue }}` | Cart item catalogue |
+| `{{ $value.Products }}` | Cart item array of products |
+| `{{ $value.Plan }}` | Cart item plan |
+| `{{ $value.DCREnabled }}` | true if cart order consists of DCR products |
+
+#### Plan Attributes (Within cart item)
+
+Accessible via `{{ $plan := $value.Plan }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Plan ID |
+| `{{ .PlanName }}` | Plan name |
+| `{{ .FormatQuota }}` | Formatted quota information |
+| `{{ .FormatRateLimit }}` | Formatted rate limit information |
+
+#### Catalogue Attributes (Within cart item)
+
+Accessible via `{{ $catalogue := $value.Catalogue }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Catalogue ID |
+
+#### Product Attributes (Within cart item)
+
+Accessible via `{{ range $product := $value.Products }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Product ID |
+| `{{ .Name }}` | Product name |
+| `{{ .DisplayName }}` | Product display name |
+| `{{ .Path }}` | Product path |
+| `{{ .Description }}` | Product description |
+| `{{ .Content }}` | Product content |
+| `{{ .AuthType }}` | Product auth type |
+| `{{ .DCREnabled }}` | true if product DCR enabled |
+| `{{ .AuthTypes }}` | List of product auth types |
+
+#### Auth Type Attributes (Within product)
+
+Accessible via `{{ range $auth_type := $product.AuthTypes }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .AuthType }}` | Auth type |
+
+#### DCR Client Template Attributes (Within product)
+
+Accessible via `{{ range $template := $product.Templates }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Template ID |
+| `{{ .Name }}` | Template name |
+| `{{ .GrantType }}` | Template grant type |
+| `{{ .ResponseTypes }}` | Template response types |
+| `{{ .TokenEndpointAuthMethod }}` | Template token endpoint auth method |
+| `{{ .OktaAppType }}` | Template Okta app type |
+
+<Expandable title='Example Usage'>
+```html
+<h1>Cart Checkout</h1>
+{{ range $key, $value := .cart }}
+<div class="cart-item">
+  <p>Auth Type: {{ $value.AuthType }}</p>
+  <p>Plan: {{ $value.Plan.Name }}</p>
+  {{ range $product := $value.Products }}
+  <div class="product">
+    <h3>{{ $product.DisplayName }}</h3>
+    <p>{{ $product.Description }}</p>
+    <p>Path: {{ $product.Path }}</p>
+  </div>
+  {{ end }}
+</div>
+{{ end }}
+<h2>Your Applications</h2>
+{{ range $app := .apps }}
+<div class="application">
+  <h3>{{ $app.Name }}</h3>
+  <p>{{ $app.Description }}</p>
+</div>
+{{ end }}
+{{ if .certs }}
+<h2>MTLS Certificates</h2>
+{{ range $cert := .certs }}
+<div class="certificate">
+  <p>ID: {{ $cert.ID }}</p>
+  <p>Name: {{ $cert.Name }}</p>
+</div>
+{{ end }}
+{{ end }}
+```
+</Expandable>
+
+
+### Organization User Detail
+
+**Template Path**: `themes/default/views/user_detail.tmpl`
+
+This template is used to render the organization user detail page.
+
+#### Available Objects
+
+- `{{ .errors }}`: Map of template errors (Key: category, Value: error message)
+- `{{ .user }}`: The organization user object.
+
+#### User Attributes
+
+Accessible via `{{ .user }}`
+
+| Attribute/Method | Description |
+| :------------------- | :------------- |
+| `{{ .ID }}` | User ID |
+| `{{ .First }}` | User name |
+| `{{ .Last }}` | User surname |
+| `{{ .Email }}` | User email |
+| `{{ .OrganisationID }}` | User organization ID |
+| `{{ .DisplayName }}` | User complete name |
+| `{{ .IdentityProvider }}` | User provider (Portal or Tyk Identity Broker) |
+| `{{ .GetOrganisationID }}` | User's organization ID |
+| `{{ .IsAdmin }}` | true if user is an admin |
+| `{{ .IsOrgAdmin }}` | true if user is an organization admin |
+| `{{ .DisplayRole }}` | User's role |
+
+
+<Expandable title='Example Usage'>
+```html
+<h1>User Details</h1>
+{{ if .errors }}
+{{ range $key, $errs := .errors }}
+<div class="alert alert-warning cart-error error-wrapper" role="alert">
+  <i class="tyk-icon tykon tykon-warning"></i>
+  <div class="alert__content">
+    <strong>{{ $key }}</strong>
+    <ul>
+      {{ range $errs }}
+      <li>{{ . }}</li>
+      {{ end }}
+    </ul>
+  </div>
+</div>
+{{ end }}
+{{ end }}
+<p>Name: {{ .user.DisplayName }}</p>
+<p>Email: {{ .user.Email }}</p>
+<p>Role: {{ .user.DisplayRole }}</p>
+```
+</Expandable>
+
+### Organization User Edit
+
+**Template Path**: `themes/default/views/user_edit.tmpl`
+
+This template is used to render the edit page for organization user.
+
+#### Available Objects
+
+- `{{ .errors }}`: Map of template errors (Key: category, Value: error message)
+- `{{ .roles }}`: List of possible roles
+- `{{ .user }}`: The organization user object.
+
+#### Role Attributes
+
+Accessible via `{{ range .roles }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Role ID |
+| `{{ .DisplayName }}` | Role display name |
+
+#### User Attributes
+
+Accessible via `{{ .user }}`
+
+| Attribute/Method | Description |
+| :------------------- | :------------- |
+| `{{ .ID }}` | User ID |
+| `{{ .First }}` | User name |
+| `{{ .Last }}` | User surname |
+| `{{ .Email }}` | User email |
+| `{{ .OrganisationID }}` | User organization ID |
+| `{{ .DisplayName }}` | User complete name |
+| `{{ .IdentityProvider }}` | User provider (Portal or Tyk Identity Broker) |
+| `{{ .GetOrganisationID }}` | User's organization ID |
+| `{{ .IsAdmin }}` | true if user is an admin |
+| `{{ .IsOrgAdmin }}` | true if user is an organization admin |
+| `{{ .DisplayRole }}` | User's role |
+
+<Expandable title='Example Usage'>
+```html
+<form action="edit" method="post" id="user-edit">
+  {{ if .error }}
+  <div class="alert alert-danger" role="alert">
+    {{ .error }}
+  </div>
+  {{ end }}
+  <h2>Developer details</h2>
+  <div>
+    <label>Name:</label>
+    <input type="text" name="first" value="{{ .user.First }}" required />
+  </div>
+  <div>
+    <label>Last name:</label>
+    <input type="text" name="last" value="{{ .user.Last }}" required />
+  </div>
+  <div>
+    <label>Email:</label>
+    <input type="email" name="email" value="{{ .user.Email }}" required disabled />
+  </div>
+  {{ if .roles }}
+  <div>
+    <label>Role:</label>
+    <select name="role" required>
+      {{ range $role := .roles }}
+      <option value="{{ $role.ID }}">{{ $role.DisplayName }}</option>
+      {{ end }}
+    </select>
+  </div>
+  {{ end }}
+  <div>
+    <a href="/portal/private/users">Cancel</a>
+    <input type="submit" value="Save Changes" />
+  </div>
+</form>
+```
+</Expandable>
+
+### Organization Users List
+
+**Template Path**: `themes/default/views/user_list.tmpl`
+
+This template is used to render the list of organization users.
+
+#### Available Objects
+
+- `{{ .roles }}`: Map of available roles (Key: role, Value: role display name)
+
+##### Example Usage
+```html
+<td> {{ index $roles $userInvite.Role }} </td>
+{{ end }}
+```
+
+### Product Detail 
+
+**Template Path**: `themes/default/views/portal_product_detail.tmpl`
+
+This template is used to render the product detail page.
+
+#### Available Objects
+
+- `{{ .product }}`: The selected product object
+- `{{ .catalogues }}`: List of catalogue objects including the selected product
+- `{{ .unique_plans }}`: List of plan objects available for the product
+- `{{ .scopes }}`: Product scopes as an array of strings
+- `{{ .posts }}`: List of related blog post objects
+- `{{ .errors }}`: Map of template errors (Key: category, Value: error message)
+- `{{ .added }}`: Boolean indicating if the product is added to the cart
+
+#### Product Attributes
+
+Accessible via `{{ .product }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Product ID |
+| `{{ .Name }}` | Product name |
+| `{{ .DisplayName }}` | Product display name |
+| `{{ .Path }}` | Product path |
+| `{{ .ReferenceID }}` | Product reference ID |
+| `{{ .Description }}` | Product description |
+| `{{ .AuthType }}` | Product auth type |
+| `{{ .Logo.URL }}` | Product logo URL |
+| `{{ .Feature }}` | true if the product is featured |
+| `{{ .DCREnabled }}` | true if DCR is enabled |
+| `{{ .ProviderID }}` | Provider ID |
+| `{{ .Tags }}` | List of tags associated with the product |
+
+#### API Details (Within product)
+
+Accessible via `{{ .product.APIDetails }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Name }}` | API name |
+| `{{ .Description }}` | API description |
+| `{{ .APIType }}` | API type |
+| `{{ .TargetURL }}` | API target URL |
+| `{{ .ListenPath }}` | API listen path |
+| `{{ .OASUrl }}` | API OAS URL |
+| `{{ .Status }}` | "Active" if API status is active, otherwise "Inactive" |
+
+#### Documentation (Within product)
+
+Accessible via `{{ .product.Docs }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Title }}` | Document title |
+| `{{ .ID }}` | Document identifier |
+| `{{ .Content }}` | Document content |
+| `{{ .MarkdownContent }}` | Markdown content (see [Markdown reference](/portal/customization/markdown)) |
+| `{{ .MarkdownEnabled }}` | Boolean for Markdown enablement |
+
+#### Product Tags (Within product)
+
+Accessible via `{{ .product.Tags }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}`	| Tag ID |
+| `{{ .Name }}`	| Tag name |
+
+#### Catalogues
+
+Accessible via `{{ range .catalogues }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Name }}` | Catalogue name |
+| `{{ .VisibilityStatus }}` | Catalogue visibility status |
+
+#### Plans
+
+Accessible via `{{ range .unique_plans }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Name }}` | Plan name |
+| `{{ .ID }}` | Plan ID |
+| `{{ .DisplayName }}` | Plan display name |
+| `{{ .Description }}` | Plan description |
+| `{{ .AuthType }}` | Plan authentication type |
+| `{{ .Rate }}` | Plan rate |
+| `{{ .Per }}` | Plan rate per time unit |
+| `{{ .QuotaMax }}` | Plan maximum quota |
+| `{{ .QuotaRenewalRate }}` | Plan quota renewal rate |
+| `{{ .AutoApproveAccessRequests }}` | Boolean for auto-approval of access requests |
+
+#### Related Posts
+
+Accessible via `{{ range .posts }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Title }}` | Post title |
+| `{{ .Lede }}` | Post summary |
+| `{{ .Content }}` | Post content |
+| `{{ .MarkdownContent }}` | Markdown content (see [Markdown reference](/portal/customization/markdown)) |
+| `{{ .MarkdownEnabled }}` | Boolean for Markdown enablement |
+| `{{ .Path }}` | Post path |
+| `{{ .HeaderImage.URL }}` | Header image URL |
+| `{{ .BlogSiteID }}` | Blog site ID |
+| `{{ .ProductID }}` | Associated product ID |
+| `{{ .AuthorID }}` | Author ID |
+
+<Expandable title='Example Usage'>
+```html
+<div class="product-detail">
+  <h1>{{ .product.DisplayName }}</h1>
+  <img src="{{ .product.Logo.URL }}" alt="{{ .product.Name }} logo">
+  <p>{{ .product.Description }}</p>
+  <h2>API Details</h2>
+  {{ range .product.APIDetails }}
+  <h3>{{ .Name }}</h3>
+  <p>Status: {{ .Status }}</p>
+  <p>Target URL: {{ .TargetURL }}</p>
+  {{ end }}
+  <h2>Documentation</h2>
+  {{ range .product.Docs }}
+  <h3>{{ .Title }}</h3>
+  {{ if .MarkdownEnabled }}
+  {{ .MarkdownContent | markdownify }}
+  {{ else }}
+  {{ .Content }}
+  {{ end }}
+  {{ end }}
+  <h2>Available in Catalogues</h2>
+  <ul>
+    {{ range .catalogues }}
+    <li>{{ .Name }} ({{ .VisibilityStatus }})</li>
+    {{ end }}
+  </ul>
+  <h2>Available Plans</h2>
+  {{ range .unique_plans }}
+  <div class="plan">
+    <h3>{{ .DisplayName }}</h3>
+    <p>{{ .Description }}</p>
+    <p>Rate: {{ .Rate }} per {{ .Per }}</p>
+    <p>Quota: {{ .QuotaMax }}</p>
+  </div>
+  {{ end }}
+  <h2>Related Posts</h2>
+  {{ range .posts }}
+  <div class="related-post">
+    <h3><a href="{{ .Path }}">{{ .Title }}</a></h3>
+    <img src="{{ .HeaderImage.URL }}" alt="{{ .Title }}">
+    <p>{{ .Lede }}</p>
+  </div>
+  {{ end }}
+</div>
+```
+</Expandable>
+
+### Product OAS Documentation 
+
+**Template Paths**: 
+- `themes/default/views/product_doc_stoplight_spec.tmpl`
+- `themes/default/views/product_doc_redoc.tmpl`
+
+These templates are used to render the OpenAPI Specification (OAS) documentation for a product. The Stoplight Spec and
+ReDoc versions are available.
+
+#### Available Attributes
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Name }}` | Product name |
+| `{{ .Description }}` | Product description |
+| `{{ .Path }}` | Product path |
+| `{{ .Url }}` | OAS document URL |
+
+<Expandable title='Example Usage'>
+```html
+<div class="docs-container">
+  <div class="card mt-4">
+    <div class="card-body">
+      <h3 class="card-title">
+        <a href="/portal/catalogue-products/{{ .Path }}">{{ .Name }}</a>
+      </h3>
+      <p class="card-text">
+        {{ .Description }}
+      </p>
+    </div>
+  </div>
+  <div>
+    <elements-api
+      apiDescriptionUrl='{{ .Url }}'
+      router="hash"
+      layout="responsive"
+    />
+  </div>
+</div>
+```
+</Expandable>
+
+## Global Helper Functions
+
+This section provides a detailed overview of the global helper functions available in the Tyk Enterprise Developer
+Portal templates. These functions are accessible across the public and private templates and allow you to perform
+various operations, retrieve specific data, and create dynamic content within your templates.
+
+### Available Functions
+
+- [CanCreateOrganisation](#cancreateorganisation)
+- [Clients](#clients)
+- [Current User](#currentuser)
+- [FeaturedProducts](#featuredproducts)
+- [FilterUserInvites](#filteruserinvites)
+- [FormatTime](#formattime)
+- [GetCart](#getcart)
+- [GetCatalogueList](#getcataloguelist)
+- [GetCataloguesForProduct](#getcataloguesforproduct)
+- [GetClientDescription](#getclientdescription)
+- [GetClientName](#getclientname)
+- [GetMenus](#getmenus)
+- [GetProducts](#getproducts)
+- [IsPortalDisabled](#isportaldisabled)
+- [IsPortalPrivate](#isportalprivate)
+- [ProductDocRenderer](#productdocrenderer)
+- [ProviderUpstreamURL](#providerupstreamurl)
+- [SplitStrings](#splitstrings)
+- [TruncateString](#truncatestring)
+- [TypeOfCredential](#typeofcredential)
+
+#### CanCreateOrganisation
+
+Returns true if user can create an organization.
+
+##### Example Usage
+```
+{{ if CanCreateOrganisation req }}
+  ...
+{{ end }}
+```
+
+#### Clients
+
+Returns the list of applications for the current user. Expects the request as argument.
+
+##### Client Attributes
+
+Accessible via `{{ range $client := Clients req }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $client.ID }}` | Client ID |
+| `{{ $client.Name }}` | Client name |
+| `{{ $client.Description }}` | Client description |
+| `{{ $client.RedirectURLs }}` | Client redirect URLs |
+| `{{ $client.Credentials }}` | Array of client credentials |
+| `{{ $client.AccessRequests }}` | Array of client access requests |
+
+##### Credential Attributes (Within client)
+
+Accessible via `{{ range $cred := $client.Credentials }}` 
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $cred.ID }}` | Credential ID |
+| `{{ $cred.Credential }}` | Credential |
+| `{{ $cred.CredentialHash }}` | Credential hash |
+| `{{ $cred.OAuthClientID }}` | OAuth client ID |
+| `{{ $cred.OAuthClientSecret }}` | OAuth client secret |
+| `{{ $cred.Expires }}` | Credential expiration |
+| `{{ $cred.AccessRequestID }}` | Access request ID associated with the credential |
+
+##### Access Request Attributes (Within client)
+
+Accessible via `{{ range $acreq := $client.AccessRequests }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $acreq.ID }}` | Access request ID |
+| `{{ $acreq.Status }}` | Access request status |
+| `{{ $acreq.UserID }}` | User ID associated with access request |
+| `{{ $acreq.AuthType }}` | Access request auth type |
+| `{{ $acreq.DCREnabled }}` | true if access request DCR enabled |
+| `{{ $acreq.ProvisionImmediately }}` | true if provisioned immediately is enabled |
+| `{{ $acreq.CatalogueID }}` | Catalogue ID |
+
+##### Product Attributes (Within access request)
+
+Accessible via `{{ range $product := $acreq.Products }}` 
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $product.ID }}` | Product ID |
+| `{{ $product.Name }}` | Product name |
+| `{{ $product.DisplayName }}` | Product display name |
+| `{{ $product.Path }}` | Product path |
+| `{{ $product.Description }}` | Product description |
+| `{{ $product.Content }}` | Product content |
+| `{{ $product.AuthType }}` | Product auth type |
+| `{{ $product.DCREnabled }}` | true if product DCR enabled |
+
+##### Plan Attributes (Within access request)
+
+Accessible via `{{ $acreq.Plan }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Name }}` | Plan name |
+| `{{ .DisplayName }}` | Plan display name |
+| `{{ .Description }}` | Plan description |
+| `{{ .AuthType }}` | Plan auth type |
+| `{{ .Rate }}` | Plan rate |
+| `{{ .Per }}` | Plan period |
+| `{{ .QuotaMax }}` | Plan quota maximum |
+| `{{ .QuotaRenewalRate }}` | Plan quota renewal rate |
+| `{{ .AutoApproveAccessRequests }}` | true if auto-approve access requests is enabled |
+
+##### Example Usage
+```html
+{{ range $client := Clients req }}
+<div class="client">
+  <h2>Client: {{ $client.Name }}</h2>
+  {{ range $acreq := $client.AccessRequests }}
+  <h4>Products:</h4>
+  <ul>
+    {{ range $product := $acreq.Products }}
+    <li>
+      <strong>{{ $product.Name }}</strong>
+      {{ $product.Description }}
+    </li>
+    {{ end }}
+  </ul>
+  <h4>Plan:</h4>
+  <p><strong>Name:</strong> {{ $acreq.Plan.Name }}</p>
+  <p><strong>Rate:</strong> {{ $acreq.Plan.Rate }} per {{ $acreq.Plan.Per }}</p>
+  <p><strong>Quota Max:</strong> {{ $acreq.Plan.QuotaMax }}</p>
+  {{ end }}
+</div>
+{{ end }}
+```
+
+#### CurrentUser
+
+The `CurrentUser` function returns the current user object if a user is logged in. It expects the request as an argument.
+
+#### User Attributes
+
+Accessible via `{{ $user := CurrentUser req }}`
+
+| Attribute/Method | Description |
+| :------------------- | :------------- |
+| `{{ $user.ID }}` | User ID |
+| `{{ $user.First }}` | User name |
+| `{{ $user.Last }}` | User surname |
+| `{{ $user.Email }}` | User email |
+| `{{ $user.OrganisationID }}` | User organization ID |
+| `{{ $user.DisplayName }}` | User complete name |
+| `{{ $user.IdentityProvider }}` | User provider (Portal or Tyk Identity Broker) |
+| `{{ $user.GetOrganisationID }}` | User's organization ID |
+| `{{ $user.IsAdmin }}` | true if user is an admin |
+| `{{ $user.IsOrgAdmin }}` | true if user is an organization admin |
+| `{{ $user.DisplayRole }}` | User's role |
+
+##### Example Usage
+```html
+{{ $user := CurrentUser req }}
+{{ if $user }}
+<div class="user-info">
+  <h2>Welcome, {{ $user.DisplayName }}!</h2>
+  <p>Email: {{ $user.Email }}</p>
+  {{ if $user.IsAdmin }}
+  <p>You have admin privileges.</p>
+  {{ else if $user.IsOrgAdmin }}
+  <p>You are an organization admin.</p>
+  {{ else }}
+  <p>Your role: {{ $user.DisplayRole }}</p>
+  {{ end }}
+</div>
+{{ else }}
+<p>Please log in to view your account information.</p>
+{{ end }}
+```
+
+#### FeaturedProducts
+
+Returns a list of featured products.
+
+##### Product Attributes
+
+Accessible via `{{ range FeaturedProducts }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Product ID |
+| `{{ .Name }}` | Product name |
+| `{{ .DisplayName }}` | Product display name |
+| `{{ .Path }}` | Product path |
+| `{{ .ReferenceID }}` | Product reference ID |
+| `{{ .Description }}` | Product description |
+| `{{ .AuthType }}` | Product auth type |
+| `{{ .Scopes }}` | Product scopes |
+| `{{ .Logo.URL }}` | Product logo URL |
+| `{{ .Feature }}` | true if the product is featured |
+| `{{ .DCREnabled }}` | true if DCR is enabled |
+| `{{ .ProviderID }}` | Provider ID |
+| `{{ .APIDetails }}` | Array of API details associated with the product |
+| `{{ .Catalogues }}` | Array of catalogues associated with the product |
+
+##### API Details Attributes (Within product)
+
+Accessible via `{{ range .APIDetails }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Name }}` | API name |
+| `{{ .Description }}` | API description |
+| `{{ .APIType }}` | API type |
+| `{{ .TargetURL }}` | API target URL |
+| `{{ .ListenPath }}` | API listen path |
+| `{{ .OASUrl }}` | API OAS URL |
+| `{{ .Status }}` | "Active" if API status is active, otherwise "Inactive" |
+
+##### Catalogue Attributes (Within product)
+
+Accessible via `{{ range .Catalogues }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .Name }}` | Catalogue name |
+| `{{ .VisibilityStatus }}` | Catalogue visibility status |
+
+<Expandable title='Example Usage'>
+```html
+{{ $featured_products := FeaturedProducts }}
+<h2>Featured API Products</h2>
+<p>Explore our highlighted API offerings</p>
+<div class="featured-products-container">
+  {{ range $featured_products }}
+  <div class="product-card">
+    {{ if .Logo }}
+    <img src="{{ .Logo.URL }}" alt="{{ .Name }} logo">
+    {{ end }}
+    <div class="product-info">
+      <span class="auth-type">{{ .AuthType }}</span>
+      <h3>{{ .Name }}</h3>
+      <p>{{ .Description }}</p>
+    </div>
+    <div class="product-actions">
+      <a href="/portal/catalogue-products/{{ .Path }}" class="btn">More Info</a>
+      <div class="dropdown-content">
+        {{ range .APIDetails }}
+        {{ if or (gt (.OASDocument.Base.Url | trim | length) 0) (gt (.OASUrl | trim | length) 0) }}
+        <a href="/portal/catalogue-products/{{ $.Path }}/{{ .APIID }}/docs" target="blank">
+          {{ .Name }}
+        </a>
+        {{ end }}
+        {{ end }}
+      </div>
+    </div>
+  </div>
+  {{ end }}
+</div>
+```
+</Expandable>
+
+#### FilterUserInvites
+
+Returns a list of users that were invited to the current user's organization, if the user became an organization.
+Expects the request as a parameter.
+
+##### User Attributes
+
+Accessible via `{{ range $invite := FilterUserInvites req }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $invite.ID }}` | User ID |
+| `{{ $invite.Email }}` | User email |
+| `{{ $invite.First }}` | User first name |
+| `{{ $invite.Last }}` | User last name |
+| `{{ $invite.Role }}` | User role |
+| `{{ $invite.JoinedAt }}` | User joined at time |
+| `{{ $invite.Joined }}` | Whether the user has joined |
+| `{{ $invite.Uactive }}` | Whether the user is active |
+
+<Expandable title='Example Usage'>
+```html
+{{ $userInvites := FilterUserInvites req }}
+{{ if $userInvites }}
+<h2>Invited Users</h2>
+<table>
+  <thead>
+    <tr>
+      <th>Name</th>
+      <th>Email</th>
+      <th>Role</th>
+      <th>Status</th>
+    </tr>
+  </thead>
+  <tbody>
+    {{ range $invite := $userInvites }}
+    <tr>
+      <td>{{ $invite.First }} {{ $invite.Last }}</td>
+      <td>{{ $invite.Email }}</td>
+      <td>{{ $invite.Role }}</td>
+      <td>
+        {{ if $invite.Joined }}
+        Joined
+        {{ else if $invite.Uactive }}
+        Pending
+        {{ else }}
+        Inactive
+        {{ end }}
+      </td>
+    </tr>
+    {{ end }}
+  </tbody>
+</table>
+{{ else }}
+<p>No pending invitations.</p>
+{{ end }}
+```
+</Expandable>
+
+#### FormatTime
+
+Formats a given time with a given format.
+
+##### Example Usage
+```html
+{{ $user := CurrentUser req }}
+{{ if $user}}
+{{$time := FormatTime $user.CreatedAt "2 Jan, 2006 at 3:04:00 PM (MST)"}}
+{{/* Use $time or other variables here */}}
+...
+{{end}}
+```
+
+#### GetCart
+
+Returns a map with the cart items for a given user ID. Expects the user ID as an argument. This function is useful for
+retrieving and displaying the contents of a user's cart, including detailed information about the products, their
+authentication types, and associated templates.
+
+##### Cart Item Attributes
+
+Accessible via `{{ range $key, $value := GetCart $user.ID }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $value.AuthType }}` | Cart item auth type |
+| `{{ $value.Catalogue }}` | Cart item catalogue |
+| `{{ $value.DCREnabled }}` | true if cart order consists of DCR products |
+| `{{ $value.Plan }}` | Cart item plan |
+| `{{ $value.Products }}` | Cart item array of products |
+
+#### Plan Attributes (Within cart item)
+
+Accessible via `{{ $plan := $value.Plan }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Plan ID |
+| `{{ .PlanName }}` | Plan name |
+| `{{ .FormatQuota }}` | Formatted quota information |
+| `{{ .FormatRateLimit }}` | Formatted rate limit information |
+
+#### Catalogue Attributes (Within cart item)
+
+Accessible via `{{ $catalogue := $value.Catalogue }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Catalogue ID |
+
+##### Product Attributes (Within cart item)
+
+Accessible via `{{ range $product := $value.Products }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Product ID |
+| `{{ .Name }}` | Product name |
+| `{{ .DisplayName }}` | Product display name |
+| `{{ .Path }}` | Product path |
+| `{{ .Description }}` | Product description |
+| `{{ .Content }}` | Product content |
+| `{{ .AuthType }}` | Product auth type |
+| `{{ .DCREnabled }}` | true if product DCR enabled |
+| `{{ .AuthTypes }}` | List of product auth types |
+
+##### DCR Client Template Attributes (Within product)
+
+Accessible via `{{ range $template := $product.Templates }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .ID }}` | Template ID |
+| `{{ .Name }}` | Template name |
+| `{{ .GrantType }}` | Template grant type |
+| `{{ .ResponseTypes }}` | Template response types |
+| `{{ .TokenEndpointAuthMethod }}` | Template token endpoint auth method |
+| `{{ .OktaAppType }}` | Template Okta app type |
+
+##### Example Usage
+```html
+{{ $user := CurrentUser req }}
+{{ if $user }}
+  {{ $cart := GetCart $user.ID }}
+  {{ if $cart }}
+  <h2>Your Cart</h2>
+  {{ range $key, $value := $cart }}
+  <div class="cart-item">
+    <h3>{{ $value.Catalogue.Name }}</h3>
+    <p>Auth Type: {{ $value.AuthType }}</p>
+    {{ range $product := $value.Products }}
+    <div class="product">
+      <h4>{{ $product.DisplayName }}</h4>
+      <p>{{ $product.Description }}</p>
+    </div>
+    {{ end }}
+  </div>
+  {{ end }}
+  {{ else }}
+  <p>Your cart is empty.</p>
+  {{ end }}
+{{ end }}
+```
+
+#### GetCatalogueList
+
+Returns a list of catalogue names. Expects the request as parameter.
+
+##### Example Usage
+```html
+{{ range $key, $value := GetCatalogueList req }}
+<option value="{{ $key }}" {{ if eq $value.Selected true }} selected {{ end }}>{{ $value.Name }}</option>
+{{ end }}
+```
+
+#### GetCataloguesForProduct
+
+Returns a list of products for a given user and product ID. Expects the request, a user and a product ID as parameters.
+
+##### Catalogue Attributes
+
+Accessible via `{{ range GetCataloguesForProduct req $user $product.ID }}` 
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .VisibilityStatus }}` | Catalogue visibility status |
+| `{{ .Name }}` | Catalogue name |
+
+##### Example Usage
+```html
+{{ $thisProduct := .product }}
+{{ $user := CurrentUser req }}
+{{ $catalogues_for_product := GetCataloguesForProduct req $user $thisProduct.ID }}
+<h3>Catalogues for {{ $thisProduct.Name }}</h3>
+<ul>
+  {{ range $catalogues_for_product }}
+  <li>
+    <strong>{{ .Name }}</strong>
+    (Visibility: {{ .VisibilityStatus }})
+  </li>
+  {{ end }}
+</ul>
+```
+
+#### GetClientDescription
+
+Returns an application description given a credential ID.
+
+##### Example Usage
+```
+{{ range $app.Credentials }}
+...
+{{ GetClientDescription .ID}}
+{{end}}
+```
+
+#### GetClientName
+
+Returns an application name given a credential ID.
+
+##### Example Usage
+```
+{{ range $app.Credentials }}
+...
+{{ GetClientName .ID}}
+{{end}}
+```
+
+#### GetMenus
+
+Returns a map of all [menus](/portal/customization/menus).
+
+##### Example Usage
+```html
+{{ if GetMenus.Primary }}
+  {{ range GetMenus.Primary.Children }}
+    {{ range .Children }}
+    <li class="nav-item">
+      <a class="dropdown-item" href="{{ .Path }}">{{ .Tag }}</a>
+    </li>
+    {{ end }}
+  {{ end }}
+{{ end }}
+```
+
+#### GetProducts
+
+Returns the list of products for the current user. Expects the request as an argument.
+
+##### Product Attributes
+
+Accessible via `{{ range $product := GetProducts req }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $product.ID }}` | Product ID |
+| `{{ $product.Name }}` | Product name |
+| `{{ $product.DisplayName }}` | Product display name |
+| `{{ $product.Path }}` | Product path |
+| `{{ $product.ReferenceID }}` | Product reference ID |
+| `{{ $product.Description }}` | Product description |
+| `{{ $product.AuthType }}` | Product auth type |
+| `{{ $product.Scopes }}` | Product scopes |
+| `{{ $product.Logo.URL }}` | Product logo URL |
+| `{{ $product.Feature }}` | true if the product is featured |
+| `{{ $product.DCREnabled }}` | true if DCR is enabled |
+| `{{ $product.ProviderID }}` | Provider ID |
+| `{{ $product.APIDetails }}` | Array of API details associated with the product |
+| `{{ $product.Catalogues }}` | Array of catalogues associated with the product |
+
+##### API Details Attributes (Within product)
+
+Accessible via `{{ range $api := $product.APIDetails }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $api.Name }}` | API name |
+| `{{ $api.Description }}` | API description |
+| `{{ $api.APIType }}` | API type |
+| `{{ $api.TargetURL }}` | API target URL |
+| `{{ $api.ListenPath }}` | API listen path |
+| `{{ $api.OASUrl }}` | API OAS URL |
+| `{{ $api.Status }}` | "Active" if API status is active, otherwise "Inactive" |
+
+##### Catalogue Attributes (Within product)
+
+Accessible via `{{ range $catalogue := $product.Catalogues }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $catalogue.Name }}` | Catalogue name |
+| `{{ $catalogue.VisibilityStatus }}` | Catalogue visibility status |
+
+<Expandable title='Example Usage'>
+```html
+{{ range GetProducts req }}
+<div class="col-lg-12 card-container">
+  <div class="card d-flex flex-row {{ if .Logo.URL }}has-logo{{ end }}">
+    {{ if .Logo.URL }}
+    <img class="card-img-top img-fluid" src="{{ .Logo.URL }}" alt="">
+    {{ end }}
+    <div class="card-body align-self-center w-100">
+      <div class="card-title d-flex flex-column justify-content-end align-items-baseline">
+        <div class="pill-container">
+          <span class="pill">{{ .AuthType }}</span>
+        </div>
+        <h2>{{ .ProductName }}</h2>
+      </div>
+      {{ if .Description }}
+      <p class="card-text">{{ .Description }}</p>
+      {{ end }}
+    </div>
+    <div class="card-cta d-flex flex-column align-self-center justify-content-between align-items-baseline w-100">
+      <div>
+        <a href="/portal/catalogue-products/{{ .Path }}" class="btn btn-secondary">More Info</a>
+      </div>
+    </div>
+  </div>
+</div>
+{{ end }}
+```
+</Expandable>
+
+#### IsPortalDisabled
+
+Returns true (exception: for admins is always enabled) if portal visibility was set to hidden. Expects the request as
+parameter.
+
+##### Example Usage
+```
+{{ $portalDisabled := IsPortalDisabled req }}
+```
+
+#### IsPortalPrivate
+
+Returns true (exception: for admins is always enabled) if portal visibility was set to private. Expects the request as
+parameter.
+
+##### Example Usage
+```
+{{ $portalPrivate  := IsPortalPrivate req }}
+```
+
+#### ProductDocRenderer
+
+Returns the configured product OAS renderer (redoc or stoplight).
+
+##### Example Usage
+```
+{{ $oas_template := ProductDocRenderer }}
+```
+
+#### ProviderUpstreamURL
+
+Returns the provider upstream URL for a given providerID. Expects the request and a provider ID as parameters.
+
+##### Example Usage
+```
+{{ $upstreamURL := ProviderUpstreamURL req $thisProduct.ProviderID }}
+```
+
+#### SplitStrings
+
+Splits a given string with given separator and returns a slice of split strings.
+
+##### Example Usage
+```
+{{ range $app.Credentials }}
+...
+{{ range SplitStrings .GrantType "," }}
+...
+{{ end }}
+{{ end }}
+```
+
+#### TruncateString
+
+Truncates a given string to a given length, returning the truncated string followed by three dots (…).
+
+##### Example Usage
+```
+{{ TruncateString $api.Description 60 }}
+```
+
+#### TypeOfCredential
+
+Returns the credential type ("oAuth2.0" or "authToken") given the credential.
+
+##### Example Usage
+```
+{{ range $app.Credentials }}
+...
+{{ if eq (TypeOfCredential . ) "oAuth2.0" }}
+...
+{{ end }}
+{{end}}
+```
+
+
+## Email Templates
+
+This section provides a detailed overview of the email template data available in the Tyk Enterprise Developer Portal. 
+The Tyk Enterprise Developer Portal uses a variety of email templates for different purposes, such as user registration
+and access request status or organization status updates. Each template has access to specific data or functions relevant
+to its purpose.
+
+It's important to note that while email templates can include template data or specific template functions, they do not
+have access to the global helper functions available in other portal templates.
+
+Please refer to [email workflow](/portal/customization/email-notifications)
+for additional detail on email notifications sent by the portal.
+
+
+### Available Email Templates
+
+- [Access Request Approve/Reject](#access-request-approvereject)
+- [Access Request Submitted](#access-request-submitted)
+- [Activate and Deactivate](#activate-and-deactivate)
+- [Key Expiration Warning](#key-expiration-warning)
+- [Key Expired](#key-expired)
+- [New User Request](#new-user-request)
+- [Organization Approve](#organization-approve)
+- [Organization Reject](#organization-reject)
+- [Organization Request](#organization-request)
+- [Reset Password](#reset-password)
+- [Targeted Invite](#targeted-invite)
+- [Welcome User](#welcome-user)
+
+#### Access Request Approve/Reject
+
+**Template Paths**: 
+- `themes/default/mailers/approve.tmpl`
+- `themes/default/mailers/reject.tmpl`
+
+These templates are used for sending notifications to users when their access requests are approved or rejected.
+
+##### Available Objects
+
+There's no data sent to these templates.
+
+##### Example Usage
+```
+Hi,
+The API Credentials you provisioned have been rejected.
+Thanks,
+The Team
+```
+
+#### Access Request Submitted
+
+**Template Path**: `themes/default/mailers/submitted.tmpl`
+
+This template is used for notifying administrators about pending access requests.
+
+##### Available Objects
+
+- `{{ .requests }}`: Returns the list of access requests pending approval.
+
+##### Access Request Attributes
+
+Accessible via `{{ range .requests }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ .PlanID }}` | Plan ID associated with access request |
+| `{{ .Status }}` | Request status |
+| `{{ .AuthType }}` | Request authentication type |
+| `{{ .UserID }}` | User ID associated with the request |
+| `{{ .ClientID }}` | Client ID associated with the request |
+| `{{ .DCREnabled }}` | Indicates if DCR (Dynamic Client Registration) is enabled for the request |
+| `{{ .ProvisionImmediately }}` | Indicates if provisioning is immediate for the request |
+| `{{ .CatalogueID }}` | Catalogue ID associated with the request |
+
+##### Product Attributes (within Access Request)
+
+Accessible via `{{ range $product := $acreq.Products }}`
+
+| Attribute | Description |
+| :----------- | :------------- |
+| `{{ $product.ID }}` | Product ID |
+| `{{ $product.Name }}` | Product name |
+| `{{ $product.DisplayName }}` | Product display name |
+| `{{ $product.Description }}` | Product description |
+| `{{ $product.AuthType }}` | Product authentication type |
+| `{{ $product.DCREnabled }}` | Indicates if DCR (Dynamic Client Registration) is enabled for the product |
+
+##### Example Usage
+```html
+<p>A new Access request has been submitted. Please log in to the administration dashboard to view the request.</p>
+<ul>
+  {{ range $acreq := .requests }}
+  <li>
+    <strong>Status:</strong> {{ $acreq.Status }}<br />
+    <strong>User ID:</strong> {{ $acreq.UserID }}<br />
+    <strong>Products:</strong>
+    <ul>
+      {{ range $product := $acreq.Products }}
+      <li>{{ $product.DisplayName }} ({{ $product.AuthType }})</li>
+      {{ end }}
+    </ul>
+  </li>
+  {{ end }}
+</ul>
+```
+
+
+#### Activate and Deactivate
+
+**Template Paths**: 
+- `themes/default/mailers/activate.tmpl`
+- `themes/default/mailers/deactivate.tmpl`
+
+These templates are used for sending activation and deactivation notifications to users.
+
+##### Available Objects
+
+- `{{ .name }}`: Returns the user's full name.
+
+##### Example Usage
+```
+Hi, <strong>{{.name}}</strong><br/>
+Your account has been activated.
+```
+
+#### Key Expiration Warning
+
+**Template Path**: `themes/default/mailers/keytoexpire.tmpl`
+
+This template is used to notify a developer that one of their credentials is about to expire.
+
+##### Available Objects
+
+- `{{ .user }}`: Returns the credential owner. Refer to the User Attributes table below for accessible attributes and methods.
+- `{{ .credential }}`: Returns the credential that is about to expire (for example, `{{ .credential.CredentialHash }}` returns the credential hash).
+
+##### User Attributes
+
+Accessible via `{{ .user }}`
+
+| Attribute/Method | Description |
+| :------------------- | :------------- |
+| `{{ .ID }}` | User ID |
+| `{{ .First }}` | User name |
+| `{{ .Last }}` | User surname |
+| `{{ .Email }}` | User email |
+| `{{ .OrganisationID }}` | User organization ID |
+| `{{ .DisplayName }}` | User complete name |
+| `{{ .IdentityProvider }}` | User provider (Portal or Tyk Identity Broker) |
+| `{{ .GetOrganisationID }}` | User's organization ID |
+| `{{ .IsAdmin }}` | true if user is an admin |
+| `{{ .IsOrgAdmin }}` | true if user is an organization admin |
+| `{{ .DisplayRole }}` | User's role |
+
+##### Example Usage
+```
+<p>Hi {{ .user.First }},</p>
+<p>Your credential {{ .credential.CredentialHash }} is about to expire. Please log in to the developer portal to renew it.</p>
+```
+
+#### Key Expired
+
+**Template Path**: `themes/default/mailers/keyexpired.tmpl`
+
+This template is used to notify a developer that one of their credentials has expired.
+
+##### Available Objects
+
+- `{{ .user }}`: Returns the credential owner. Refer to the Key Expiration Warning section for the available `{{ .user }}` attributes.
+- `{{ .credential }}`: Returns the credential that has expired (for example, `{{ .credential.CredentialHash }}` returns the credential hash).
+
+##### Example Usage
+```
+<p>Hi {{ .user.First }},</p>
+<p>Your credential {{ .credential.CredentialHash }} has expired.</p>
+```
+
+#### New User Request
+
+**Template Path**: `themes/default/mailers/newuser.tmpl`
+
+This template is used for notifying administrators about new user registration requests pending activation.
+
+##### Available Objects
+
+- `{{ .user }}`: Returns the new user pending activation.
+
+#### User Attributes
+
+Accessible via `{{ .user }}`
+
+| Attribute/Method | Description |
+| :------------------- | :------------- |
+| `{{ .ID }}` | User ID |
+| `{{ .First }}` | User name |
+| `{{ .Last }}` | User surname |
+| `{{ .Email }}` | User email |
+| `{{ .OrganisationID }}` | User organization ID |
+| `{{ .DisplayName }}` | User complete name |
+| `{{ .IdentityProvider }}` | User provider (Portal or Tyk Identity Broker) |
+| `{{ .GetOrganisationID }}` | User's organization ID |
+| `{{ .IsAdmin }}` | true if user is an admin |
+| `{{ .IsOrgAdmin }}` | true if user is an organization admin |
+| `{{ .DisplayRole }}` | User's role |
+| `{{ .Organisation.Name }}` | Organization name |
+| `{{ .Teams }}` | Array of user teams |
+| `{{ .Teams.ID }}` | Team ID |
+| `{{ .Teams.Name }}` | Team name |
+| `{{ .Teams.Default }}` | Indicates if the team is the default team (true/false) |
+
+##### Example Usage
+```
+<p>There is a new user request pending. Please approve it from the admin console.</p>
+<p>
+  Id: {{ .user.ID }}<br/>
+  User: {{ .user.DisplayName }} ({{ .user.Email }})<br/>
+  Role: {{ .user.Role }}<br/>
+  {{ if gt .user.OrganisationID 0 }}
+  Organisation: {{ .user.Organisation.Name }}<br/>
+  {{ else }}
+  Organisation: Administrators' organisation<br/>
+  {{ end }}
+  {{ if gt (len .user.Teams) 0 }}
+  Teams:<br/>
+  <ul>
+    {{ range .user.Teams }}
+    <li>{{ .Name }}</li>
+    {{ end }}
+  </ul>
+  {{ else }}
+  Teams: none
+  {{ end }}
+</p>
+```
+
+#### Organization Approve
+
+**Template Path**: `themes/default/mailers/organisation_approve.tmpl`
+
+This template is used for notifying users that their organization creation request has been approved.
+
+##### Available Objects
+
+- `{{ site }}`: Returns the application host.
+
+##### Example Usage
+```
+Hello,
+The organization registration request has been approved. You can now manage your organization in your dashboard here: https://{{.site}}/portal/private/dashboard
+Thanks,
+The team
+```
+
+#### Organization Reject
+
+**Template Path**: `themes/default/mailers/organisation_reject.tmpl`
+
+This template is used for notifying users that their organization creation request has been rejected.
+
+##### Available Objects
+
+There's no data sent to this template.
+
+##### Example Usage
+```
+Hello,
+The organization registration request has been rejected.
+Thanks,
+The team
+```
+
+#### Organization Request
+
+**Template Path**: `themes/default/mailers/organisation_request.tmpl`
+
+This template is used for notifying administrators about new organization creation requests.
+
+##### Available Objects
+
+- `{{ .user }}`: Returns the user who made the request. 
+- `{{ .organisationName }}`: Returns the new organization name.
+
+#### User Attributes
+
+Accessible via `{{ .user }}`
+
+| Attribute/Method | Description |
+| :------------------- | :------------- |
+| `{{ .ID }}` | User ID |
+| `{{ .First }}` | User name |
+| `{{ .Last }}` | User surname |
+| `{{ .Email }}` | User email |
+| `{{ .OrganisationID }}` | User organization ID |
+| `{{ .DisplayName }}` | User complete name |
+| `{{ .IdentityProvider }}` | User provider (Portal or Tyk Identity Broker) |
+| `{{ .GetOrganisationID }}` | User's organization ID |
+| `{{ .IsAdmin }}` | true if user is an admin |
+| `{{ .IsOrgAdmin }}` | true if user is an organization admin |
+| `{{ .DisplayRole }}` | User's role |
+
+##### Example Usage
+```
+There is a new organization registration request pending. Please approve it from the admin console.
+The organization name: {{ .organisationName }}.
+The user: {{ .user.DisplayName }} ({{ .user.Email }}).
+```
+
+#### Reset Password
+
+**Template Path**: `themes/default/mailers/auth/reset_password.tmpl`
+
+This template is used for sending password reset emails to users.
+
+##### Available Functions
+
+- `{{ current_user }}`: Returns the current user object.
+- `{{ reset_password_url }}`: Returns the URL with the token for setting the password.
+- `{{ confirm_url }}`: Alias for `reset_password_url`; returns the same password-setting URL.
+- `{{ login_url }}`: Returns the portal login URL (the custom SSO login URL if configured, otherwise the default login URL).
+
+##### User Attributes
+
+Accessible via `{{ current_user }}`
+
+| Attribute/Method | Description |
+| :------------------- | :------------- |
+| `{{ .ID }}` | User ID |
+| `{{ .First }}` | User name |
+| `{{ .Last }}` | User surname |
+| `{{ .Email }}` | User email |
+| `{{ .Role }}` | User role |
+| `{{ .OrganisationID }}` | User organization ID |
+| `{{ .DisplayName }}` | User complete name |
+| `{{ .IdentityProvider }}` | User provider (Portal or Tyk Identity Broker) |
+| `{{ .GetOrganisationID }}` | User's organization ID |
+| `{{ .IsAdmin }}` | true if user is an admin |
+| `{{ .IsOrgAdmin }}` | true if user is an organization admin |
+| `{{ .DisplayRole }}` | User's role |
+
+##### Example Usage
+```
+{{ $user := current_user}}
+<p>Hello {{ $user.DisplayName }},</p>
+<p>Someone has requested a link to change your password. You can do this through the link below.</p>
+<p>{{reset_password_url}}</p>
+<p>If you didn't request this, please ignore this email.</p>
+<p>Your password won't change until you access the link above and create a new one.</p>
+```
+
+#### Targeted Invite
+
+**Template Path**: `themes/default/mailers/auth/targeted_invite.tmpl`
+
+This template is used for sending targeted invitations to users.
+
+##### Available Functions
+
+- `{{ user }}`: Returns the targeted user object.
+- `{{ team }}`: Returns the team name to which the user is being invited.
+- `{{ invite_url }}`: Returns the URL with the token for setting the password.
+
+##### User Attributes
+
+Accessible via `{{ user }}`
+
+| Attribute/Method | Description |
+| :------------------- | :------------- |
+| `{{ .ID }}` | User ID |
+| `{{ .First }}` | User name |
+| `{{ .Last }}` | User surname |
+| `{{ .Email }}` | User email |
+| `{{ .Role }}` | User role |
+| `{{ .OrganisationID }}` | User organization ID |
+| `{{ .DisplayName }}` | User complete name |
+| `{{ .IdentityProvider }}` | User provider (Portal or Tyk Identity Broker) |
+| `{{ .GetOrganisationID }}` | User's organization ID |
+| `{{ .IsAdmin }}` | true if user is an admin |
+| `{{ .IsOrgAdmin }}` | true if user is an organization admin |
+| `{{ .DisplayRole }}` | User's role |
+
+##### Example Usage
+```html
+{{ $u := user }}
+Hi, <strong>{{ $u.DisplayName }}</strong><br/>
+<p>Someone is inviting you to join {{ if $u.IsAdmin }}as an Administrator{{ else }}the {{ team }} team{{end }}. You can do this through the link below.</p>
+<p>{{ invite_url }}</p>
+<p>If you didn't request this, please ignore this email.</p>
+```
+
+#### Welcome User
+
+**Template Paths**: 
+- `themes/default/mailers/welcome_admin.tmpl`
+- `themes/default/mailers/welcome_dev.tmpl`
+
+These templates are used for sending welcome emails to new users, with separate templates for administrators and developers.
+
+##### Available Objects
+
+- `{{ .user }}`: Returns the user who made the request. Refer to the CurrentUser section for accessible attributes and methods.
+
+#### User Attributes
+
+Accessible via `{{ .user }}`
+
+| Attribute/Method | Description |
+| :------------------- | :------------- |
+| `{{ .ID }}` | User ID |
+| `{{ .First }}` | User name |
+| `{{ .Last }}` | User surname |
+| `{{ .Email }}` | User email |
+| `{{ .OrganisationID }}` | User organization ID |
+| `{{ .DisplayName }}` | User complete name |
+| `{{ .IdentityProvider }}` | User provider (Portal or Tyk Identity Broker) |
+| `{{ .GetOrganisationID }}` | User's organization ID |
+| `{{ .IsAdmin }}` | true if user is an admin |
+| `{{ .IsOrgAdmin }}` | true if user is an organization admin |
+| `{{ .DisplayRole }}` | User's role |
+| `{{ .Organisation.Name }}` | organization name |
+| `{{ .Teams }}` | Array of user teams |
+| `{{ .Teams.ID }}` | Team ID |
+| `{{ .Teams.Name }}` | Team name |
+| `{{ .Teams.Default }}` | Indicates if the team is the default team (true/false) |
+
+<Expandable title='Example Usage'>
+```html
+<h1>Welcome to Tyk Enterprise Developer Portal</h1>
+<p>Hello {{ .user.DisplayName }},</p>
+<p>Your account has been created for the {{ .user.Organisation.Name }} organisation.</p>
+<p>Your assigned teams:</p>
+<ul>
+  {{ range .user.Teams }}
+  <li>{{ .Name }}{{ if .Default }} (Default){{ end }}</li>
+  {{ end }}
+</ul>
+<p>We're excited to have you on board!</p>
+```
+</Expandable>
diff --git a/portal/customization/themes.mdx b/portal/customization/themes.mdx
new file mode 100644
index 0000000000..f73eec8511
--- /dev/null
+++ b/portal/customization/themes.mdx
@@ -0,0 +1,277 @@
+---
+title: "Customize Themes in Developer Portal"
+description: "How to customize themes in developer portal"
+sidebarTitle: "Themes"
+---
+
+## What is a Theme?
+
+The Tyk Enterprise Developer Portal uses **themes** for customizing the live portal. We provide an out of the box theme that is using our own branding, it’s called the `default` theme. You are welcome to use it and modify it for your needs, yet if you want to start with a blank page, you can also create a completely new theme.
+
+The following section explains how they are structured and their main concepts. We recommend you to read this if you are creating your own theme, or making extensive changes to the ones we provide.
+
+## File Structure of a Theme
+
+Generally speaking, a theme defines an application’s styling, templates and scripts.
+In the Tyk Developer Portal a `themes` folder is located in the root of the application and is the directory where each theme folder must be added. If you navigate to `path /themes/` you’ll see our default theme which has the following structure:
+
+<img src="/img/dashboard/portal-management/enterprise-portal/theme-file-structure.png" alt="Default Tyk Enterprise Portal theme structure" />
+
+- Manifest file (`theme.json`): It uses JSON syntax to define theme metadata (name, version and author) as well as a list of templates that are part of the theme.
+- `assets`: It intended for static assets like CSS, JS or images that are used by the theme. All contents from this directory are mounted under the `/assets` path in the portal HTTP server.
+- `layouts`: The layout is the top level view of your theme.
+- `views`: The view is rendered as a part of a layout. Each view can be rendered using a different layout.
+- `partials`: Partials provide an easier way to handle snippets of code that are reused across different views or layouts, for example if you want to inject a JS snippet that’s used in different places, you could set this code in a partial and include it anywhere by using the appropriate 'Go template directive'. In this way you could improve code readability and organize the theme in the most efficient way.
+
+### Manifest File
+
+This file should sit in the root of a theme and hold the theme configuration. You can define a name and your templates along other options such as the version and the author.
+
+You can find an example of the manifest within the `default` theme that is located in `/themes/default`. The syntax looks as follows:
+
+```json
+{
+  "name": "default",
+  "version": "0.0.1",
+  "author": "Tyk Technologies Ltd. <hello@tyk.io>",
+  "templates": [
+      {
+        "name": "Content Page",
+        "template": "page",
+        "layout": "site_layout"
+      },
+      {
+        "name": "Portal Home",
+        "template": "portal_home",
+        "layout": "portal_layout"
+      },
+      {
+        "name": "Home",
+        "template": "home",
+        "layout": "portal_layout"
+      },
+      {
+        "name": "Catalogue",
+        "template": "catalogue",
+        "layout": "portal_layout"
+    }
+  ]
+}
+```
+
+The `templates` field establishes a list of available templates. Every template consists of three fields where `name` is a user-friendly name that will be seen on the Admin app when creating a page. `template` is a reference to the template file itself. `layout` is a reference to the layout that will be used to render the previously set template.
+
+To illustrate the current template hierarchy, this is what a typically rendered page would look like. The `layout` would be the top level template and base structure of the page:
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-template-layout.png" alt="Template structure" />
+
+
+Also note that the Developer Portal will let you use not just multiple `layouts` and `views` but also any combination of them. These combinations are set in your manifest file (`theme.json`).
+
+Regarding `partials`, even though the illustration above shows two partials embedded on the `view` section, `partials` are intended for using in any place. You should be able to embed a `partial` directly into a layout, or even in multiple layouts.
+
+Content blocks are explored more deeply in the next sections. To summarise, its relationship with the above hierarchy is when rendering a particular page, a `layout`, a `view` and potentially a combination of partials get loaded from the theme directory. Content blocks are different because their content gets dynamically populated by database content. These contents are created from the Admin section.
+
+To be Concluded:
+
+- A layout is the wrapper of everything you want to include inside it. So, typically it would consist of tags such as `<!DOCTYPE html>`, `<html>`, `<head>`, `<title>`, and `<body>`.
+- A `template` is what we would inject in a layout and specifically within the `<body>` of a layout.
+- A `partial` can be, for example, the navigation menu so that you can inject it in the layout and it will be visible every time this layout is used
+
+### Go Templates
+
+All theme template files use the Go template syntax. You will find every file in the layouts and views. Partials directory uses the `.tmpl` file extension, which is the default Go template extension. Go templates work in a similar way to ERB or EJS templates by letting the user mix HTML code with dynamic values. Sample syntax is as follows:
+
+`{{ render “top_nav” }}`
+
+The code sample above would execute the `render` template helper, which is a common function that’s used to inject code from other `views` into the current one. You may use this to embed content from other parts of the theme, typically `partials` or `views`. In this case, it will insert a `view` or `partial` named `top_nav` to the template where it’s used.
+
+The same delimiters `{{` and `}}` are used for all Go template directives. We’ll explore some of them in the upcoming sections.
+
+See the [Go package template documentation](https://pkg.go.dev/text/template#pkg-overview) for more information.
+
+### Content Blocks
+
+The Developer Portal themes use content blocks to facilitate content management. A content block is defined as a part of a `view` by using a particular template directive in combination with a name or ID to identify the given block. For example, if you check the `home` template in the default theme (`themes/default/views/home.tmpl`), you will find the following code:
+
+```go
+div class="container">
+  <div class="row">
+    <div class="col-sm-6">
+      <div class="text-container">
+        <h1>{{.page.Title}}</h1>
+        <p>{{.blocks.HeaderDescription.Content}}</p>
+        <a href="{{.blocks.HeaderButtonLink.Content}}" class="btn btn-primary">{{.blocks.HeaderButtonLabel.Content}}</a>
+    </div>
+….
+```
+
+There are four code references in the above snippet. In this example we have a header, some text and then a button that act as a link. Let's see what each one is and how it correlates with the UI.
+
+1. `{{ .page.Title }}`. This is the `Title` input in the form UI (Screenshot #1)
+1. `{{ .blocks.HeaderDescription.Content }}`. This is the `HeaderDescription` input in the form UI (Screenshot #2)
+2. `{{ .blocks.HeaderButtonLink.Content }}`. This is the `HeaderDescription` input in the form UI (Screenshot #3)
+3. `{{ .blocks.HeaderButtonLabel.Content }}`. This is the `HeaderButtonLabel` input in the form UI (Screenshot #4)
+
+<img src="/img/dashboard/portal-management/enterprise-portal/go-template-ui.png" alt="Go template blocks and portal UI" />
+
+This will display in your portal as following:
+
+<img src="/img/dashboard/portal-management/enterprise-portal/example-portal-content-block.png" alt="Example Portal content block" />
+
+In order for a page to render properly the content manager will need to be aware of the content blocks that are required by a particular template.
+
+## Managing Themes
+
+The Tyk Enterprise Developer Portal enables the admin users and developers to manage themes and select which theme is visible in the portal.
+To enable this capability, the portal has theme management UI.
+
+### Create a Theme
+Follow the example below to create a new theme called "TestTheme" using the default theme as a blueprint:
+
+1. As an admin user, navigate to the Theme management UI and download the default theme. The Tyk Enterprise Developer Portal doesn't allow modifications to the default theme so that you will always have access to the vanilla theme.
+   <img src="/img/dashboard/portal-management/enterprise-portal/download-default-theme.png" alt="Download default theme" />
+2. Unzip the theme and rename it by modifying the Manifest file as described above.
+   <img src="/img/dashboard/portal-management/enterprise-portal/rename-a-theme.png" alt="Rename theme" />
+3. You can also modify other assets in the theme as described later in this guide. Once all modifications are done, you need to zip the theme and upload it to the portal.
+   <img src="/img/dashboard/portal-management/enterprise-portal/compress-a-theme.png" alt="Zip theme" />
+4. To upload the theme as an admin user, navigate to **Themes** and click on the **Add new theme** button. Please note that the size of individual files should not exceed 5 MB and the total size of all files in the theme should not exceed `PORTAL_MAX_UPLOAD_SIZE`. This parameter is [configurable](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_max_upload_size).
+   <img src="/img/dashboard/portal-management/enterprise-portal/add-a-new-theme.png" alt="Add new theme" />
+5. Then click on the **Add theme file** button.
+   <img src="/img/dashboard/portal-management/enterprise-portal/add-theme-file.png" alt="Add theme file" />
+6. Select the archive that you've created earlier and click on the **Save** button.
+   <img src="/img/dashboard/portal-management/enterprise-portal/save-new-theme.png" alt="Save new theme" />
+7. Now you should see a success message meaning the theme was successfully created.
+   <img src="/img/dashboard/portal-management/enterprise-portal/new-theme-is-created.png" alt="Theme is created" />
+
+### Preview a Theme
+The Tyk Enterprise Developer Portal enables the admin users to preview the theme before it gets reflected on the public-facing portal. This enables to review the changes that are made to the theme before exposing them to the developer community.
+1. To preview a theme as an admin user, navigate to the **Themes** menu. Select a theme, and click on the **Preview** button.
+   <img src="/img/dashboard/portal-management/enterprise-portal/preview-theme-button.png" alt="Preview theme" />
+2. The previewer will open the selected theme in a new tab. Now you can browse your theme and review the changes. For the demonstration purposes, we've modified the API Catalog page so it displays "Modified catalog" instead of "Product Catalogs".
+   <img src="/img/dashboard/portal-management/enterprise-portal/theme-preview.png" alt="Preview theme" />
+3. Once the review is done, you can quit the preview by clicking on the **Quit preview button**.
+   <img src="/img/dashboard/portal-management/enterprise-portal/quit-theme-preview.png" alt="Quite theme preview" />
+
+### Activate a Theme
+The Tyk Enterprise Developer Portal enables you to have multiple themes at the same time but only one of them is active.
+1. As an admin user, navigate to the **Themes** menu. The current status of each theme is displayed in the **Status** column.
+   <img src="/img/dashboard/portal-management/enterprise-portal/default-theme-is-current.png" alt="Default theme is the current theme" />
+2. To activate the new theme, click on the **Activate** button.
+   <img src="/img/dashboard/portal-management/enterprise-portal/activate-a-theme.png" alt="Activate theme" />
+3. The selected theme is now active and displayed to all API consumers on the Live portal.
+   <img src="/img/dashboard/portal-management/enterprise-portal/modified-theme-is-active.png" alt="Modified theme is activated" />
+
+### Modify an Existing Theme
+The Tyk Enterprise Developer Portal enables modification to any existing theme, except the default one.
+1. To start modification of any existing theme, navigate to the **Themes** menu and download the theme package.
+   <img src="/img/dashboard/portal-management/enterprise-portal/download-a-theme.png" alt="Download existing theme" />
+2. Unzip the package, do any required modification and zip it back. You should keep the name of the theme. If you need to change the name of the theme, you will need to create a new theme as described above.
+3. As an admin user, navigate to the **Themes** menu and select the modified theme.
+   <img src="/img/dashboard/portal-management/enterprise-portal/select-a-modified-theme.png" alt="Select modified theme" />
+4. Click on the **Add Theme File** button and select the theme archive.
+   <img src="/img/dashboard/portal-management/enterprise-portal/add-theme-file-to-existing-theme.png" alt="Add theme file" />
+5. Click on the **Save changes** button to save changes to the theme.
+   <img src="/img/dashboard/portal-management/enterprise-portal/save-changes-to-theme.png" alt="Save changes" />
+6. If the theme is the current changes to the Live portal, it will be applied immediately. Otherwise, you can preview and activate the theme as described above.
+
+## Upgrading Themes
+
+The Tyk Enterprise Developer Portal does not automatically update the default theme with each new release of the product, because doing so could result in the loss of customizations made by customers.
+Therefore, customers are required to manually upgrade their themes to access the latest updates and fixes. We recommend using GitFlow for the latest theme updates.
+
+Alternatively, you can download the theme package from the **Releases** section of the [portal-default-theme](https://github.com/TykTechnologies/portal-default-theme) repository.
+However, we advise against this method, as it requires you to merge your customized theme with the downloaded one, which is much simpler to accomplish via GitFlow.
+Follow the guide below to obtain the latest version of the portal theme and merge it with your customized version.
+
+### Merge Latest Changes using Gitflow
+
+The default theme for the Tyk Enterprise Developer Portal is located in the [portal-default-theme](https://github.com/TykTechnologies/portal-default-theme) repository.
+The `main` branch contains code corresponding to the latest stable release. If you wish to check out a specific release (e.g., v1.8.3), you can use tags:
+
+```console
+git checkout tags/1.8.3 -b my-custom-theme branch
+```
+
+To organize local development in a way that facilitates seamless theme updates using git merge, follow the steps below:
+1. Fork the `portal-default-theme` repo in [github](https://github.com/TykTechnologies/portal-default-theme).
+   <img src="/img/dashboard/portal-management/enterprise-portal/fork-portal-theme-repo.png" alt="Fork the portal-theme repo" />
+
+2. Clone the forked repository:
+```console
+git clone https://github.com/my-github-profile/portal-default-theme && cd ./portal-default-theme
+```
+
+3. If you have an existing repository, check if you already have the `portal-default-theme` repo among your remotes before adding it. Execute the following command to check:
+```console
+git remote -v | grep 'TykTechnologies/portal-default-theme'
+```
+
+Skip the next step if you see the following:
+```console
+# portal-default-theme  https://github.com/TykTechnologies/portal-default-theme (fetch)
+# portal-default-theme  https://github.com/TykTechnologies/portal-default-theme (push)
+```
+
+If the output of the above command is empty, proceed to step 4 to add the `portal-default-theme`.
+
+4. Add the `portal-default-theme` to the remotes by executing the following command:
+```console
+git remote add portal-default-theme https://github.com/TykTechnologies/portal-default-theme
+```
+
+5. Create a new local branch that tracks the remote `main` branch. That branch will mirror the latest changes from the `portal-default-theme` main. You will be using it to import the latest changes from the `portal-default-theme` to your custom theme:
+```console
+git fetch portal-default-theme main:portal-default-theme-main
+```
+
+If you have an existing local branch that tracks the `main` branch in the `portal-default-theme` repo, you can just pull the latest updates:
+```console
+git checkout portal-default-theme-main
+git pull portal-default-theme main
+```
+
+6. To start customizing the theme, create a local develop branch from the `portal-default-theme-main`:
+```console
+git checkout portal-default-theme-main
+git checkout -b dev-branch
+```
+
+7. Once the required customizations are completed, commit the changes to the `dev-branch`.
+
+8. Merge the latest updates from the `portal-default-theme` into the `dev-branch`. Please remember to always pull the latest changes from the `portal-default-theme-main` branch before merging:
+  - Checkout to the portal-default-theme-main and fetch the latest changes.
+    ```console
+    git checkout portal-default-theme-main
+    git pull portal-default-theme main
+    ```
+  - Checkout the dev-branch and merge the changes from the portal-default-theme-main to retrieve the latest changes from the portal-default-theme repo with the customized theme.
+    ```console
+    git checkout dev-branch
+    git merge portal-default-theme-main
+    ```
+
+Finally, address merge conflicts and commit changes.
+
+
+<Note>
+**You have successfully updated your custom theme**
+
+Now you can repeat the above described process when upgrading the portal version to make sure you have incorporated the latest theme changes to your customized theme.
+</Note>
+
+
+### Upload the Theme to the Portal
+Once you have merged your local changes with the latest changes from the `portal-default-theme` repo, you need to create a zip archive with the customized theme and upload it to the portal.
+1. Create a zip archive with the customized theme. Make sure you zip the content of the `src` folder and not the folder itself. To create a zip archive with the customized theme execute the following:
+   - cd to the `src` directory to make sure you:
+    ```console
+    cd ./src
+    ```
+    - zip the content of the `src` directory:
+    ```console
+    zip -r9 default.zip 
+    ```
+
+2. Upload the theme package that is created in the previous step to the portal. You can use the portal's [Admin dashboard](/portal/customization/themes#create-a-theme) or the [admin API](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) to do it.
+
+3. Finally, you need to [activate](/portal/customization/themes#activate-a-theme) the theme so that it will be applied to the portal.
diff --git a/portal/customization/user-model.mdx b/portal/customization/user-model.mdx
new file mode 100644
index 0000000000..2072f04b84
--- /dev/null
+++ b/portal/customization/user-model.mdx
@@ -0,0 +1,70 @@
+---
+title: "Customize User Model in Developer Portal"
+description: "How to customize user model in developer portal"
+sidebarTitle: "User Model"
+---
+
+A **Model** in developer portal represents an physical entity. Currenlty, we only have the User model, which represent a user who will be consuming the API by signing up.
+
+In this section, you will learn how to customize the User model and the sign-up form for your API consumers.
+Customizing the User model enables the storage of custom data attributes in the User profile.
+Additionally, it allows these attributes to be optionally included in the credentials metadata (therefore accessible by the gateway runtime) and exposed in the user sign-up form.
+
+This feature enables the implementation of complex business logic when processing API requests.
+For example, it is particularly useful when the quota for API calls needs to be distributed among all developers of consumer organizations.
+In such cases, both the quota and the rate limit should be applied at the organization level, rather than according to individual credentials.
+In this event, the organization ID should be known to the gateway in runtime. This feature helps to achieve that.
+
+## Add Custom Attributes to the User Model
+
+To customize the User model, navigate to the **Custom attributes** menu and then select the **User** model. Currently, it is possible to extend only the User model. In future releases we will add the same capabilities to other models.
+<img src="/img/dashboard/portal-management/enterprise-portal/navigate-to-user-attributes.png" alt="Navigate to the User's attributes" />
+
+To add a new attribute to the user model, click on the **Add Custom attribute** button and then fill in properties of the new attribute:
+- **Attribute ID**: A string that consists of letters (a-zA-Z), numbers (0-9), dashes, and underscores. This is used to reference the attribute in the [Admin APIs](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) screen.
+- **Attribute Label**: The attribute's name that is displayed in the UI.
+- **Description**: Explains the intended usage of this attribute. It is also displayed in the UI.
+- **Type of attribute**: The type of data that can be stored in this attribute. You cannot change the value of this field once the attribute is created. The following data types are acceptable:
+  - Boolean (true or false).
+  - Dropdown (a list of values).
+  - String.
+  - Number.
+- **Validation Reg Exp**: A regular expression that is used to validate the value of this field. It is available for the **String** data type only.
+- **Enable validation**: Determines if the portal should apply the regular expression defined in the **Validation Reg Exp** to validate the value of this attribute when creating or updating a user profile. It is available for the **String** data type only.
+- **Dropdown Values**: A list of values for the attribute. It is available for the **Dropdown** data type only.
+- Fields that define the attribute's behavior:
+  - **Write once read many**: Determines whether the value of the attribute can be changed after a user profile is created. This means that when **Write once read many** is enabled, the value of this attribute can be set only during the creation of a user profile. After the user profile is created, the value of this attribute cannot be edited, either through the admin APIs or via the Users UI.
+  - **Add to the key metadata**: Determines if the value of the attribute should be added to the metadata of Auth keys or OAuth2.0 clients when a user creates them. Keep in mind that credential-level metadata will be accessible in both the gateway runtime and gateway database. Please be cautious when handling personally identifiable information (PII) data.
+  - **Required**: Determines if this attribute is required to create a user profile.
+  - **Show on sign-up form**: Determines if this attribute should be visible in the sing-up form.
+- **Behavior**: Determines if developers can view or edit this attribute. Possible values are:
+  - Developers can view and edit the attribute.
+  - Developers can only view the attribute.
+  - Developers cannot see the attribute.
+
+For the purpose of this guide, make sure to tick the **Required** and **Show on sign-up form** checkboxes and select the **Developers can only view the attribute** option.
+<img src="/img/dashboard/portal-management/enterprise-portal/add-new-attribute-to-user-model.png" alt="Add a new attribute to the user model" />
+
+The new attribute will be added to the user sign-up form, once you have created a new custom attribute and saved changes to the user model by clicking on the **Save** button.
+<img src="/img/dashboard/portal-management/enterprise-portal/custom-attribute-in-the-sign-up-form.png" alt="Customized user sign-up form" />
+
+## Default Attributes of User Model
+By default, the portal assigns the following attributes to credentials metadata in the gateway when provisioning API credentials:
+| Attribute       | Name of the credential metadata field | Description                                                                       |
+| :----------------- | :--------------------------------------- | :----------------------------------------------------------------------------------- |
+| Developer ID    | DeveloperID                           | ID of the developer who created the credential                                    |
+| Application ID  | ApplicationID                         | ID of the application to which it belongs                                         |
+| Organisation ID | OrganisationID                        | ID of the organization to which the developer who created the application belongs |
+| Team IDs        | TeamIDs                               | Array of team IDs to which the developer, who created the application, belongs    |
+
+Additionally, it is possible to include other default attributes of the User model in the credential metadata fields.
+However, it is important to remember that metadata at the credential level will be accessible both in the gateway runtime and in the gateway database.
+Exercise caution when dealing with personally identifiable information (PII). Additional default attributes include:
+| Attribute         | Name of the credential metadata field | Description                                                                         |
+| :------------------- | :--------------------------------------- | :------------------------------------------------------------------------------------- |
+| First name        | First                                 | First name of the developer who created the credential                              |
+| Last name         | Last                                  | Last name of the developer who created the credential                               |
+| Email             | Email                                 | Email name of the developer who created the credential                              |
+| Role              | Role                                  | Array of team IDs to which the developer, who created the application, belongs      |
+| Organisation name | Organisation                          | Name of the organization to which the developer who created the application belongs |
+| Teams name        | TeamNames                             | Array of team names to which the developer, who created the application, belongs     |
diff --git a/portal/customization/webhooks.mdx b/portal/customization/webhooks.mdx
new file mode 100644
index 0000000000..e9941c2455
--- /dev/null
+++ b/portal/customization/webhooks.mdx
@@ -0,0 +1,357 @@
+---
+title: "Customize Webhooks in Developer Portal"
+description: "How to customize webhooks in developer portal"
+sidebarTitle: "Webhooks"
+---
+
+In this section, you will learn how to configure webhooks for events that occur within the portal.
+Webhooks enable asynchronous integration with the portal by notifying third-party software about an event that has occurred.
+This feature facilitates the implementation of complex business logic when the portal is integrated with third-party systems such as CRMs and ITSM systems.
+Typical use cases for the webhooks include:
+- An asynchronous approval that occurs externally (e.g., in a third-party CRM, ITSM, or another system managing approvals). In this scenario, an access request (such as an API product access request, an organization registration request, or a new developer profile in an inactive state) is created in the portal. The portal then informs the third-party system by calling a registered webhook.
+- A follow-up action that needs to occur after a specific event in the portal. For example, after a developer profile is created, the customer must create a billing profile in their internal billing system (or a profile in a third-party billing engine such as Moesif, Lago, or a similar service) to automatically update and add this information into custom attributes.
+
+## Create a Webhook in Developer Portal
+
+The configuration process consists of two steps:
+- Configure connectivity to the target endpoint by specify the Target URL, HTTP method, timeout, and request headers.
+- Select types of events that should be sent to the target endpoint.
+
+1. **Configure the Target Endpoint**
+
+    Each webhook delivers events to the **Target URL** via the specified **HTTP Method**. Additionally, it's possible to configure timeout header for requests.
+
+    Finally, for each webhook it's possible to define HTTP headers that should be used for requests to the target URL via the **Headers** section.
+    To add a new header, click on the **Add Headers** button, specify **Name** and **Value** of the header.
+
+    Note that you can test connectivity to the **Target URL** by clicking on the **Test Connection** button.
+    For testing connectivity, the portal sends a HEAD request to the specified target endpoint.
+    Please note that the connectivity is tested only with the HEAD method, and the test call does not include any headers defined in the **Headers** section.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/edp-configure-webhook-channel.png" alt="Create new webhook channel" />
+
+    Once the target endpoint is configured, proceed to the next section to select the types of events that should be sent to that endpoint.
+
+2. **Select Event Types for the Webhook**
+
+    To finish configuration, select types of events that should be sent to the **Target URL** and save the changes. Refer the docs below to know more about [supported event types](#supported-portal-events)
+    <img src="/img/dashboard/portal-management/enterprise-portal/edp-select-webhook-events-for-channel.png" alt="Select webhook events" />
+
+
+## Supported Portal Events
+
+The portal fires the following webhook events:
+- [UserRegistered](/portal/customization/webhooks#new-user-registered) when a new user is registered.
+- [UserAccountActivated](/portal/customization/webhooks#user-account-activated) when a user is activated.
+- [UserAccountDeactivated](/portal/customization/webhooks#user-account-deactivated) when a user is deactivated.
+- [PasswordReset](/portal/customization/webhooks#password-reset) when a user tries to reset a password.
+- [ApplicationRegistered](/portal/customization/webhooks#new-application-registered) when a new API consumer application is created.
+- [CredentialRegistered](/portal/customization/webhooks#new-credential-is-created) when a new API credential is created.
+- [AccessRequestCreated](/portal/customization/webhooks#new-access-request-created) when a new API access request is created.
+- [AccessRequestApproved](/portal/customization/webhooks#an-access-request-is-approved) when an API access request is approved.
+- [AccessRequestRejected](/portal/customization/webhooks#an-access-request-is-rejected) when an API access request is rejected.
+- [OrganizationRegistered](/portal/customization/webhooks#new-organization-registered) when an API consumer organization is created.
+- [OrganizationRequestCreated](/portal/customization/webhooks#new-organization-registration-request-created) when a new API consumer organization registration request is created.
+- [OrganizationRequestApproved](/portal/customization/webhooks#organization-registration-request-is-approved) when an API consumer organization registration request is approved.
+- [OrganizationRequestRejected](/portal/customization/webhooks#organization-request-is-rejected) when an API consumer organization registration request is rejected.
+
+The complete list of events and their corresponding payloads is outlined below.
+
+### New User Registered
+This event is fired whenever a new user is created via APIs, the admin UI, and the live portal UI (SSO or invite though the org dashboard or self-registration or invite code). 
+
+Sample payload:
+```json
+{
+    "Event": "UserRegistered",
+    "Message": {
+        "ID": 29,
+        "Email": "developer@user.com",
+        "First": "FirstName",
+        "Last": "Lastname",
+        "OrgID": 1,
+        "Provider": "password",
+        "Status": "active",
+        "CreatedAt": "2024-04-22T16:38:54.068565+02:00",
+        "ByUser": 1,
+        "CustomAttributes": [
+            {
+                "Identifier": "company-name",
+                "Value": "ACME"
+            }
+        ]
+    },
+    "Timestamp": "2024-04-22T16:38:54.082037+02:00"
+}
+```
+
+### User Account Activated
+This event is fired whenever a user (either an admin or a developer) account is activated via APIs or the admin UI.
+
+Sample payload:
+```json
+{
+    "Event": "UserAccountActivated",
+    "Message": {
+        "ID": 7,
+        "Email": "devD1@tyk.io",
+        "First": "Test",
+        "Last": "User",
+        "OrgID": 7,
+        "Provider": "password",
+        "Status": "active",
+        "CreatedAt": "2024-04-22T15:46:40.128398Z",
+        "ByUser": 1,
+        "CustomAttributes": [
+            {
+                "Identifier": "boolean-custom-attribute",
+                "Value": "false"
+            }
+        ]
+    },
+    "Timestamp": "2024-04-22T17:52:22.673077+02:00"
+}
+```
+
+### User Account Deactivated
+
+This event is fired whenever a user account is deactivated via APIs or the admin UI.
+
+Sample payload:
+```json
+{
+  "Event": "UserAccountDeactivated",
+  "Message": {
+    "ID": 7,
+    "Email": "test@user.io",
+    "First": "Test",
+    "Last": "User",
+    "OrgID": 7,
+    "Provider": "password",
+    "Status": "inactive",
+    "CreatedAt": "2024-04-22T15:46:40.128398Z",
+    "ByUser": 1,
+    "CustomAttributes": [
+      {
+        "Identifier": "boolean-custom-attribute",
+        "Value": "false"
+      }
+    ]
+  },
+  "Timestamp": "2024-04-22T17:51:22.24066+02:00"
+}
+```
+
+### Password Reset
+
+This event is fired whenever a user tries to reset their password.
+
+Sample payload:
+```json
+{
+    "Event": "PasswordReset",
+    "Message": {
+        "ID": 7,
+        "Email": "test@user.io",
+        "First": "Test",
+        "Last": "User",
+        "OrgID": 7,
+        "Provider": "password",
+        "Status": "active",
+        "CreatedAt": "2024-04-22T15:46:40.128398Z",
+        "CustomAttributes": [
+            {
+                "Identifier": "boolean-custom-attribute",
+                "Value": "false"
+            }
+        ]
+    },
+    "Timestamp": "2024-04-22T17:58:10.223162+02:00"
+}
+```
+
+### New Application Registered
+
+This event is fired whenever a new app is created via APIs, and the live portal UI (either via the checkout or the create app button in the developer’s dashboard).
+
+Sample payload:
+```json
+{
+    "Event": "ApplicationRegistered",
+    "Message": {
+        "ID": 1,
+        "Name": "New App",
+        "UserID": 1,
+        "CreatedAt": "2024-04-18T13:29:23.738726+02:00"
+    },
+    "Timestamp": "2024-04-18T13:29:23.744826+02:00"
+}
+```
+
+### New Credential Is Created
+
+This event is fired whenever a new credential is created via APIs, the admin UI (creation after approval) and the live portal UI.
+
+Sample payload:
+```json
+{
+    "Event": "CredentialRegistered",
+    "Message": {
+        "ID": 1,
+        "ByUser": 3,
+        "AccessRequestID": 1,
+        "AppID": 3,
+        "CreatedAt": "2024-04-18T13:48:08.489611+02:00"
+    },
+    "Timestamp": "2024-04-18T13:48:08.494266+02:00"
+}
+```
+
+### New Access Request Created
+
+This event is fired whenever a new access request is created via APIs and the live portal UI.
+
+Sample payload:
+```json
+{
+    "Event": "AccessRequestCreated",
+    "Message": {
+        "ID": 0,
+        "AppID": 1,
+        "ByUser": 2,
+        "Status": "approved",
+        "ProductIDs": [
+            1
+        ],
+        "PlanID": 2,
+        "CreatedAt": "0001-01-01T00:00:00Z"
+    },
+    "Timestamp": "2024-04-22T18:09:45.245357+02:00"
+}
+```
+
+### An Access Request Is Approved
+
+This event is fired whenever an access request is approved or auto-approved via the admin APIs or admin UI.
+
+Sample payload:
+```json
+{
+    "Event": "AccessRequestApproved",
+    "Message": {
+        "ID": 1,
+        "AppID": 3,
+        "ByUser": 3,
+        "Status": "approved",
+        "ProductIDs": [
+            1
+        ],
+        "PlanID": 2,
+        "CreatedAt": "2024-04-18T13:36:02.769109+02:00"
+    },
+    "Timestamp": "2024-04-18T13:48:08.508925+02:00"
+}
+```
+
+### An Access Request Is Rejected
+
+This event is fired whenever an access request is rejected via the admin APIs or the admin UI.
+
+Sample payload:
+```json
+{
+    "Event": "AccessRequestRejected",
+    "Message": {
+        "ID": 6,
+        "AppID": 7,
+        "ByUser": 3,
+        "Status": "rejected",
+        "ProductIDs": [],
+        "PlanID": 2,
+        "CreatedAt": "2024-04-18T14:40:15.81038+02:00"
+    },
+    "Timestamp": "2024-04-18T14:40:28.998297+02:00"
+}
+```
+
+### New Organization Registered
+
+This event is fired whenever a new consumer organization is created via the admin APIs, the live portal ([the become an organization flow](/portal/api-consumer)) or the admin UI.
+
+Sample payload:
+```json
+{
+    "Event": "OrganisationRegistered",
+    "Message": {
+        "ID": 8,
+        "Name": "Organisation added from Admin UI",
+        "CreatedAt": "2024-04-18T16:12:09.8437+02:00"
+    },
+    "Timestamp": "2024-04-18T16:12:09.849045+02:00"
+}
+```
+
+### New Organization Registration Request Created
+
+This event is fired whenever a new organization request is created via the live portal ([the become an organization flow](/portal/api-consumer)) or the admin UI.
+
+Sample payload:
+```json
+{
+    "Event": "OrganisationRequestCreated",
+    "Message": {
+        "Name": "Organisation added from Live Portal (the become an org flow)",
+        "AdminEmail": "dev@tyk.io",
+        "AdminID": 3,
+        "ByUser": 3,
+        "TeamIDs": [],
+        "Status": "pending",
+        "CreatedAt": "2024-04-18T16:13:50.766139+02:00"
+    },
+    "Timestamp": "2024-04-18T16:13:50.796234+02:00"
+}
+```
+
+### Organization Registration Request Is Approved
+
+This event is fired whenever an organization registration request is approved by an admin user.
+
+Sample payload:
+```json
+{
+  "Event": "OrganisationRequestApproved",
+  "Message": {
+    "ID": 11,
+    "Email": "dev@tyk.io",
+    "First": "Developer",
+    "Last": "User",
+    "OrgID": 2,
+    "Provider": "password",
+    "Status": "inactive",
+    "CreatedAt": "2024-04-24T15:26:04.312618088Z",
+    "CustomAttributes": []
+  },
+  "Timestamp": "2024-04-24T15:26:04.329072196Z"
+}
+```
+
+### Organization Request Is Rejected
+
+This event is fired whenever a new organization request is rejected by an admin user.
+
+Sample payload:
+```json
+{
+    "Event": "OrganisationRequestRejected",
+    "Message": {
+        "Name": "ACME",
+        "AdminEmail": "dev@tyk.io",
+        "AdminID": 17,
+        "ByUser": 17,
+        "TeamIDs": [],
+        "Status": "rejected",
+        "CreatedAt": "2024-04-18T16:27:34.012613+02:00"
+    },
+    "Timestamp": "2024-04-18T16:27:50.504654+02:00"
+}
+```
diff --git a/portal/developer-app.mdx b/portal/developer-app.mdx
new file mode 100644
index 0000000000..dd3d85f789
--- /dev/null
+++ b/portal/developer-app.mdx
@@ -0,0 +1,168 @@
+---
+title: "Developer Apps"
+description: "All about Developer Apps with Tyk Developer Portal"
+keywords: "Developer Portal, Tyk, API Consumer, Developer App, Developer, Access"
+sidebarTitle: "Developer Apps"
+---
+
+## Introduction
+
+Developer Apps are containers for API access credentials in the Tyk Developer Portal. They represent the applications that API Consumers (developers) build using your APIs and provide a structured way to organize, manage, and monitor API usage.
+
+When developers want to access your APIs, they create Apps to hold the credentials for specific use cases or projects. Each App can contain credentials for multiple API Products, allowing developers to manage related API access in one place.
+
+Developer Apps transform how API consumers interact with your APIs by:
+
+- Organizing API credentials by project or use case
+- Enabling credential management (rotation, revocation)
+- Providing usage analytics for specific applications
+- Supporting different authentication types for various integration scenarios
+
+In the Tyk Developer Portal, Developer Apps serve as the bridge between API Consumers and your API Products, making credential management intuitive and secure.
+
+## Key Concepts
+
+### App Structure
+
+A Developer App consists of:
+
+- Basic Information: Name, description, and other metadata
+- Access Credentials: API keys, OAuth tokens, or other authentication credentials
+- Product Subscriptions: The API Products the App has access to
+- Usage Statistics: Analytics on how the App is consuming APIs
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-apps-structure.png" alt="" />
+
+### App Lifecycle
+
+Developer Apps follow a typical lifecycle:
+
+- Creation: Developer creates a new App in the Live Portal
+- Subscription: Developer requests access to API Products for the App
+- Credential Issuance: Upon approval, credentials are issued to the App
+- Active Usage: Developer uses the credentials to access APIs
+- Management: Developer can rotate credentials, request additional access
+- Retirement: Developer can delete the App when no longer needed
+
+
+
+    <Note>
+    API Owners can create and manage Apps within the Admin Portal from the *API Consumers > Apps* section. From here they can create and delete apps, assign them to different users and issue credentials. In the [Reference Guide](/portal/developer-app#developer-app-reference-guide) below we indicate where fields differ between Admin Portal and Live Portal views.
+    </Note>
+
+
+### App Ownership
+
+Apps are owned by specific developers, but can be configured with different levels of accessibility:
+
+- Personal Apps: Created and managed by a single API Consumer user
+- Team Apps: Accessible to all members of a Team
+- Organisation Apps: Accessible to all members of an Organisation
+
+## Developer App Reference Guide
+
+### Essential Information
+
+#### App Name
+
+The identifier for the Developer App.
+
+- **Location**:
+  - Admin portal: *Apps > Add/Edit App > App name*
+  - Live portal: *My Dashboard > My apps > Create/Edit App > App name*
+- **Purpose**: Helps users identify the App in the Developer Portal
+- **Best Practice**: Use descriptive names that indicate the App's function (e.g., "Mobile Weather App" or "Inventory Integration")
+
+#### Description
+
+A brief explanation of the App's purpose.
+
+- **Location**:
+  - Admin portal: *Apps > Add/Edit App > Description*
+  - Live portal: *My Dashboard > My apps > Create/Edit App > Description*
+- **Purpose**: Provides context about how the App uses the APIs
+- **Best Practice**: Include information about the application's purpose and which APIs it needs
+
+#### App Owner
+
+Only available in the Admin Portal, this gives the facility to reassign an App to a different user.
+
+- **Location**:
+  - Admin portal: *Apps > Add/Edit App > App owner*
+  - Live portal: *Not available*
+- **Purpose**: Associates App ownership with a specific API Consumer
+- **Note**: Reassigning an App may alter which other users of the Live Portal can [view](/portal/developer-app#visibility) it and have access to its credentials
+
+#### Visibility
+
+Controls visibility of the App within the Live Portal. When an App is visible to a user, they can retrieve the Access Credentials and so are able to consume the APIs bundled in the Products that the App has been approved to access.
+
+- **Location**:
+  - Admin portal: *Apps > Add/Edit App > Visibility*
+  - Live portal: *My Dashboard > My apps > Create/Edit App > Visibility*
+- **Options**:
+  - Personal: Only the owner (usually the creator of the App) can view the App
+  - Team: All members of Teams of which the owner is a member can view the App
+  - Organisation: All members of the Organisation of which the owner is a member can view the App
+- **Restrictions**:
+  - When a user is in the [Default Organisation](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#developer-app-visibility), all of their Developer Apps will be restricted to Personal visibility
+  - When a user is *only* in the [Default Team](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#developer-app-visibility-1) of a Custom Organisation, all of their Developer Apps will be restricted to Personal or Organisation level visibility
+- **Best Practice**: Share Apps when multiple developers need access to the same APIs
+
+#### Redirect URL
+
+The login redirect URL used in OAuth 2.0 authentication flows. These are specific to the OAuth client 
+
+- **Location**: Details tab
+  - Admin portal: *Not applicable*
+  - Live portal: *My Dashboard > My apps > Create/Edit App > Redirect URLs*
+- **Purpose**: Required for OAuth 2.0 authorization code and implicit flows
+- **Format**: Valid URL where users will be redirected after authentication, multiple URLs can be provided in a comma separated list
+- **Requirement**: Only required for Apps using OAuth 2.0 authentication
+
+
+### Product Subscriptions
+
+#### Approved Access
+
+API Products to which the App currently has access.
+
+- **Location**:
+  - Admin portal: *Apps > Add/Edit App > Access and credentials*
+  - Live portal: *My Dashboard > My apps > Create/Edit App > Approved access*
+- **Details**:
+ - Admin portal: this section provides the opportunity to *view* or *revoke* the access that has been issued to the App.
+ - Live portal: this section provides access to the Access Credentials that have been issued to the App. It also lists the API Products and gives details of the Plan that governs the credentials. Click **Rotate Credentials** for the Provider to issue new credentials, invalidating the previous token.
+
+#### Pending Approval
+
+API Products for which an access request has been made, but not yet approved.
+
+- **Location**:
+  - Admin portal: *Apps > Add/Edit App > Pending requests*
+  - Live portal: *My Dashboard > My apps > Create/Edit App > Pending access*
+- **Details**:
+ - Admin portal: this section lists any requests pending for the Developer App, with the option to *approve* or *deny* the request.
+ - Live portal: this section lists the API Product and Plan requests pending approval by an API Owner in the Admin Portal.
+
+#### Grant Access
+
+API Owner can grant a Developer App access to a combination of API Product and Plan with a request from the API Consumer.
+
+- **Location**:
+  - Admin portal: *Apps > Add/Edit App > Add credential*
+  - Live portal: *Not available* 
+- **Options**:
+  - *Credential alias*: A name for the credential set, identifying this as credentials assigned by the API Owner
+  - *Type of credential*: Tyk allocated or Custom (manually assigned key:secret pair)
+  - *Authentication method*: The type of credential to be assigned (Auth Token or OAuth 2.0 token)
+  - *Access rights*: Select the API Product and Plan
+
+
+## Best Practices for Developer Apps
+
+- Create purpose-specific Apps: Separate Apps by project or use case rather than combining unrelated API usage
+- Use descriptive names: Make App names clear and specific to aid in organization
+- Rotate credentials regularly: Implement a schedule for credential rotation to enhance security
+- Monitor usage patterns: Regularly review analytics to identify abnormal patterns
+- Document App purpose: Maintain clear descriptions of each App's function and required APIs
diff --git a/portal/how-to-guides/configure-cors.mdx b/portal/how-to-guides/configure-cors.mdx
new file mode 100644
index 0000000000..8ca924867b
--- /dev/null
+++ b/portal/how-to-guides/configure-cors.mdx
@@ -0,0 +1,170 @@
+---
+title: "How to Configure CORS in Developer Portal"
+sidebarTitle: "Configure CORS"
+description: "Configure CORS for the Tyk Developer Portal application and for APIs exposed in the Live Portal, enabling consumers to test APIs from the API Playground."
+keywords: "CORS, cross-origin resource sharing, Developer Portal CORS, Gateway CORS, API Playground, PORTAL_CORS_ENABLE"
+---
+
+Cross-origin request configuration in the Developer Portal involves two independent layers: the Portal application itself and the Tyk Gateway APIs that consumers test via the API Playground. Both layers must be configured for a fully functional cross-origin deployment.
+
+## Prerequisites
+
+- Developer Portal is deployed and accessible
+- Tyk Gateway and Dashboard are running
+- At least one [API product](/portal/api-products) is configured and published in the Portal
+- You know the public URL of your Live Portal (for example, `https://portal.example.com`)
+- You know the public URL of your Tyk Gateway (for example, `https://api.example.com`)
+
+## Configure Portal Application CORS
+
+Portal application CORS controls which external origins may call the Portal's own Admin API and Live Portal routes. It is configured via environment variables on the Portal process.
+
+<Warning>
+[PORTAL_CORS_ENABLE](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_enable) defaults to `false`. All cross-origin requests to the Portal are rejected until you set this to `true`.
+</Warning>
+
+1. **Enable CORS**
+
+   Set [PORTAL_CORS_ENABLE](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_enable) to `true` on the Portal process.
+
+   <Tabs>
+     <Tab title="Environment variable">
+       ```ini
+       PORTAL_CORS_ENABLE=true
+       ```
+     </Tab>
+     <Tab title="Config file">
+       ```json
+       {
+         "CORS": {
+           "Enable": true
+         }
+       }
+       ```
+     </Tab>
+   </Tabs>
+
+2. **Set allowed origins**
+
+   Set [PORTAL_CORS_ALLOWED_ORIGINS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_allowed_origins) to the origins permitted to make cross-origin requests to the Portal. Use the exact scheme and host of each origin, separated by commas. Wildcards are supported.
+
+   When unset, the Portal responds with `Access-Control-Allow-Origin: *`. Because Portal uses cookie-based sessions, browsers block credentialed requests to a wildcard origin. Specify individual origins to restrict access, or set to `http://*,https://*` to allow all origins.
+
+   <Tabs>
+     <Tab title="Environment variable">
+       ```ini
+       PORTAL_CORS_ALLOWED_ORIGINS=https://admin.example.com,https://developer.example.com
+       ```
+     </Tab>
+     <Tab title="Config file">
+       ```json
+       {
+         "CORS": {
+           "AllowedOrigins": [
+             "https://admin.example.com",
+             "https://developer.example.com"
+           ]
+         }
+       }
+       ```
+     </Tab>
+   </Tabs>
+
+   <Warning>
+   Do not leave [PORTAL_CORS_ALLOWED_ORIGINS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_allowed_origins) unset or set it to `*` when credentials are enabled. Both cause the Portal to respond with `Access-Control-Allow-Origin: *`, which browsers reject for credentialed requests. To allow all origins with credentials, use `http://*,https://*` instead.
+   </Warning>
+
+3. **Set allowed headers and methods**
+
+   Set the HTTP headers and methods that cross-origin requests to the Portal may use. No headers are allowed by default. The default allowed methods are `GET` and `POST`.
+
+   <Tabs>
+     <Tab title="Environment variable">
+       ```ini
+       PORTAL_CORS_ALLOWED_HEADERS=Authorization,Content-Type,X-Requested-With
+       PORTAL_CORS_ALLOWED_METHODS=GET,POST,PUT,DELETE,OPTIONS
+       ```
+     </Tab>
+     <Tab title="Config file">
+       ```json
+       {
+         "CORS": {
+           "AllowedHeaders": ["Authorization", "Content-Type", "X-Requested-With"],
+           "AllowedMethods": ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
+         }
+       }
+       ```
+     </Tab>
+   </Tabs>
+
+4. **(Optional) Configure additional CORS settings**
+
+   | Config key | Default | Description |
+   |---|---|---|
+   | [CORS.MaxAge](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_max_age) | `0` | How long, in seconds, browsers may cache the preflight response. A positive value reduces preflight round trips. |
+   | [CORS.AllowCredentials](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_allow_credentials) | `false` | Whether the Portal includes credentials (cookies, HTTP authentication) in CORS responses. |
+
+5. **Restart the Portal**
+
+   Restart the Portal process or pod for the environment variable changes to take effect.
+
+6. **Verify**
+
+   Open your browser developer tools and make a cross-origin request to the Portal from an allowed origin. The response headers should include `Access-Control-Allow-Origin` and the request should succeed.
+
+---
+
+## Configure Gateway CORS for APIs
+
+When a consumer tests an API using the API Playground on the Live Portal, the browser makes requests directly to the Tyk Gateway. The Portal does not proxy these requests and does not inject CORS headers. You must configure CORS on the API definition for each API exposed through the Portal.
+
+<Warning>
+**Tyk Gateway v5.8.6–v5.8.13:** A middleware ordering issue in these versions causes the allow list to run before CORS processing, returning `403 Forbidden` for OPTIONS preflight requests. 
+
+Upgrade to Gateway v5.8.14 or later to resolve this. See [Troubleshoot CORS Issues](/portal/troubleshooting/cors-issues) for diagnosis steps.
+</Warning>
+
+1. **Locate the CORS block**
+
+   In a Tyk OAS API definition, CORS configuration sits under `x-tyk-api-gateway.middleware.global.cors`.
+
+2. **Add the CORS configuration**
+
+   ```yaml expandable
+   x-tyk-api-gateway:
+     middleware:
+       global:
+         cors:
+           enabled: true
+           allowedOrigins:
+             - "https://portal.example.com"
+           allowedMethods:
+             - GET
+             - POST
+             - PUT
+             - DELETE
+             - OPTIONS
+           allowedHeaders:
+             - Origin
+             - Content-Type
+             - Authorization
+           optionsPassthrough: false
+   ```
+
+   Set `optionsPassthrough` to `false` (the default). When `false`, the Gateway intercepts OPTIONS preflight requests, responds with CORS headers, and does not forward the request to the upstream.
+
+3. **Update the API**
+
+   Update the API definition in Tyk Dashboard.
+
+4. **Verify**
+
+   Open the API Playground on your Live Portal and send a test request. The request should complete without CORS errors in the browser console.
+
+<Note>
+If you are using a **Tyk Classic API definition**, configure CORS in Tyk Dashboard under **APIs** > **Advanced Options** > **CORS**. See the [Classic API CORS reference](/api-management/gateway-config-tyk-classic#cross-origin-resource-sharing-cors) for details.
+</Note>
+
+## Related
+
+- [Troubleshoot CORS Issues](/portal/troubleshooting/cors-issues) — diagnose and fix common CORS errors in the Developer Portal and API Playground
diff --git a/portal/install.mdx b/portal/install.mdx
new file mode 100644
index 0000000000..5710feeaec
--- /dev/null
+++ b/portal/install.mdx
@@ -0,0 +1,189 @@
+---
+title: "Install Developer Portal"
+description: "Install Tyk Developer Portal using Docker, Kubernetes, or Linux packages. This page explains the architecture, requirements, and how to install and bootstrap the portal."
+keywords: "Developer Portal, Tyk, Install Tyk Developer Portal, Bootstrap Tyk Developer Portal"
+sidebarTitle: "Overview"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| Enterprise | Self-Managed, Hybrid |
+
+<Note>
+
+This page is for installing the **Tyk Developer Portal** (self-managed). If you are looking to use the Developer Portal as part of **Tyk Cloud**, please refer to [the Tyk Cloud documentation](/tyk-cloud/initial-portal-config).
+
+</Note>
+
+## Architecture
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-deployment-diagram.png" alt="Portal deployment diagram" />
+<br/>
+
+The portal deployment comprises three main components:
+- **Portal application** - The main portal service
+- **Database** - Stores metadata including API products, plans, developers, applications, and more
+- **Asset storage** - Stores CMS assets such as images, themes, and OpenAPI specification files. Assets can reside in the database or separately in an S3 bucket or filesystem volume.
+
+Optionally, there could be three additional components:
+- **3rd party identity provider.** To [enable oAuth2.0 for your API Products](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration), you'll need to utilize an OpenID-compliant third-party identity provider.
+It's essential to note that the [Tyk Stack](/tyk-stack) doesn't include third-party identity providers, so you should refer to your Identity Provider's documentation for instructions on configuring and deploying it.
+This component is optional and required only for enabling oAuth2.0
+- **[Tyk Identity Broker](/tyk-identity-broker/overview)**. You only need this component if you want to configure Single Sign-On for the Tyk Developer Portal.
+For more guidance on this topic, please consult [the Single Sign-On section](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) of the documentation
+- **Email server**. The portal is capable of sending notifications to both admin users and developers when specific events happen within the portal.
+To enable this feature, you need to specify a connection configuration to an email server or service, and configure other email settings.
+You can choose to use a server that is installed on your premises or an SMTP-compatible SaaS product.
+For step-by-step instructions, please refer to [the Email Settings section](/portal/customization/email-notifications)
+
+## Database Requirements
+
+The portal requires a database to store metadata. Supported databases:
+
+| Database Type | Version |
+|---------------|---------|
+| PostgreSQL    | 14.x, 15.x, 16.x, 17.x |
+| MySQL         | 4 or later |
+| MariaDB       | 10.6, 10.11, 11.4, 11.8  |
+
+<Note>
+**Note: SQLite support**
+
+Tyk Developer Portal no longer supports SQLite as of version 1.14.0. Please use PostgreSQL or another supported database.
+</Note>
+
+## Installation Process
+
+The portal installation process comprises two steps:
+1. **Install the portal application.** To install the portal and launch it in the bootstrap mode, you need to configure your portal instance by specifying settings such as TLS, log level, and database connection.
+For further guidance on launching the portal, please refer to one of the installation options: [Docker container](/portal/install/docker#docker), [Docker Compose](/portal/install/docker#docker-compose), [Helm chart](/portal/install/kubernetes#legacy-helm-chart), or [RPM package](/portal/install/linux#red-hat-rhel-%2F-centos).
+2. **[Bootstrap the portal](#bootstrapping-enterprise-developer-portal)** After you've launched the portal, it will wait for you to provide credentials for the super admin user before it starts accepting traffic.
+Once you've created the super admin user, the portal will complete its installation process by creating the necessary database structure and initialising the required assets for its operations. You can [bootstrap](#bootstrapping-enterprise-developer-portal) the portal either through the UI or using the bootstrap API.
+Please refer to [the Bootstrapping section](/portal/install#bootstrapping-developer-portal) for implementing this step.
+
+## Recommended Installation: Docker
+
+For development, testing, and proof of concept purposes, we recommend using our Docker installation, which allows you to quickly spin up developer portal on your local machine.
+
+<ResponsiveGrid>
+
+<Card href="/portal/install/docker#docker" img="/img/docker.png">
+
+Install with Docker
+</Card>
+
+<Card href="/portal/install/docker#docker-compose" img="/img/docker.png">
+
+Install with Docker Compose
+</Card>
+
+</ResponsiveGrid>
+
+## Alternative Installation Methods
+
+<ResponsiveGrid>
+
+<Card href="/portal/install/kubernetes" img="/img/k8s.png">
+Install on Kubernetes
+</Card>
+
+<Card href="/portal/install/linux" img="/img/linux-icon.svg">
+Install on Linux Distributions
+</Card>
+
+</ResponsiveGrid>
+
+
+## Bootstrapping Developer Portal
+
+When launching the Tyk Developer portal for the first time, it starts in a special bootstrap mode, which is required to create the first admin user who will act as the super admin.
+After launching the portal, you can bootstrap it using either the portal UI or the bootstrap API.
+
+This section explains how to bootstrap the portal using both the portal UI and the bootstrap API.
+
+### Bootstrapping the Portal via the UI
+After launching the portal for the first time, you can use its UI to bootstrap it. The portal will display a form that allows you to create a super admin user and set their password. 
+
+Navigate to the portal UI in your browser to start bootstrapping the portal. You should see the following:
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-bootstrap-ui-empty.png" alt="Portal bootstrap UI" />
+
+Enter the admin email, password, first name, and last name. Then click on the `Register to Developer portal` button to complete the bootstrapping process.
+
+The bootstrap process should take no longer than a couple of seconds, so almost instantly the portal will display the following page, which confirms the successful bootstrap.
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-bootstrap-successful.png" alt="Successful bootstrapping" />
+
+Click on the `Login` button to proceed to the login page, where you can use the newly created super admin credentials to log in to the portal.
+
+### Bootstrapping the Portal via the API
+The second approach to bootstrap the portal is through the bootstrap API, which allows you to programmatically bootstrap the portal.
+
+To bootstrap the portal via an API call, call the bootstrap API:
+```shell
+curl --location 'http://<your-portal-host>:<your-portal-port>/portal-api/bootstrap' \
+--header 'Content-Type: application/json' \
+--data-raw '{
+    "username":"super-admin@tyk.io",
+    "password": "tyk123",
+    "first_name":"John",
+    "last_name":"Doe"
+}'
+```
+
+The bootstrap API accepts the following parameters:
+- **username** - email of the super admin, it is also used as their login
+- **password** - the super admin login password
+- **first_name** - first name of the super admin
+- **last_name** - first name of the super admin
+
+The bootstrap process should take no longer than a couple of seconds. You will receive the following response as a confirmation of the successful bootstrapping:
+```json
+{
+    "code": "OK",
+    "message": "Bootstrapped user successfully",
+    "data": {
+        "api_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJQcm92aWRlciI6Im5vbmUiLCJVc2VySUQiOiIkMmEkMTAkREF0czZhZTY0ZEZXSkFTbnR2OS8yLmMxcS91VTFhbTRGYk53RVJhTE1Ed2c0NHFsSXJnMkMifQ.ExTNl6UvjQA6WqrPE-7OkSNCBBixc2NGMnh3dnlk5Nw"
+    }
+}
+```
+
+
+<Note>
+**Take a note of the api_token field**
+
+You will need this to call other Portal APIs.
+</Note>
+
+
+### Login as the super admin
+After you have bootstrapped the portal, either via the UI or the bootstrap API, you can use the super admin's login credentials to log in to the portal.
+Open the portal UI in your browser and click on the 'Login' button to open the login page.
+<img src="/img/dashboard/portal-management/enterprise-portal/navigate-to-the-login-page.png" alt="Open the login page" />
+<br/>
+
+On the login page, enter the super admin credentials for logging into the portal:
+<img src="/img/dashboard/portal-management/enterprise-portal/login-page-after-bootstrapping.png" alt="Open the login page" />
+
+<br/>
+
+
+<Note>
+**Congratulations!**
+
+
+Now you have a fully functional portal.
+</Note>
+
+
+<br/>
+
+You can continue configuring and customizing it either via the UI or the portal admin API. Please refer to [the Tyk Developer Portal Concepts section](/portal/overview/concepts) for further guidance.
+
+## Configuration Reference
+
+For detailed configuration options, see the [Environment Variables Reference](/product-stack/tyk-enterprise-developer-portal/deploy/configuration).
+
+## API Documentation
+
+The Developer Portal exposes an [API](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) for programmatic management.
diff --git a/portal/install/docker.mdx b/portal/install/docker.mdx
new file mode 100644
index 0000000000..2dbc723152
--- /dev/null
+++ b/portal/install/docker.mdx
@@ -0,0 +1,433 @@
+---
+title: "Install Developer Portal on Docker"
+description: "Installation guide for the Tyk Developer Portal on Docker"
+keywords: "Developer Portal, Tyk, Install Tyk Developer Portal, Bootstrap Tyk Developer Portal"
+sidebarTitle: "Docker"
+---
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| Enterprise | Self-Managed, Hybrid, Cloud |
+
+## Prerequisites
+
+- [Docker](https://docs.docker.com/get-docker/)
+- [Enterprise Edition License](/portal/overview/intro#getting-access)
+
+<Note>
+Running on Podman, containerd, or another container runtime? See [Container Runtimes](/deployment-and-operations/container-runtimes).
+</Note>
+
+## Docker
+
+This section explains how to install Tyk Developer Portal in a container using Docker.
+Depending on your preferences, you can use MariaDB, MySQL or PostgreSQL for the database.
+
+In this recipe, the database and the portal container will run on the same network, with the database storing its data on a volume. The portal's CMS assets (images, files and themes) are stored in the database, although this guide provides links to the documentation to use a persistent volume or an S3 bucket as a storage medium for CMS assets.
+Additionally, all settings for the Portal are configured using an env-file.
+
+
+<Warning>
+**Note**  
+
+This document is just an example. Customize all fields, including the username, password, root password, database name and more.
+
+Be sure to update the connection DSN in the env-file accordingly.
+</Warning>
+
+### Using PostgreSQL
+
+1. **Create a network for the portal deployment**
+
+    To start with, you need to create a Docker network for communication between the database and the portal. Execute the following command to create it:
+    ```console
+    docker network create tyk-portal
+    ```
+
+2. **Create an init script for PostgreSQL**
+
+    To initialize a PostgreSQL database, you need to create an init script that will later be used to launch the PostgreSQL instance.
+    Copy the content below to a file named `init.sql`, which you will need in the next step.
+    ```sql
+    -- init.sql
+    -- Creating user
+    CREATE USER admin WITH ENCRYPTED PASSWORD 'secr3t';
+    CREATE DATABASE portal;
+    GRANT ALL PRIVILEGES ON DATABASE portal TO admin;
+    ```
+
+3. **Create the database volume and launch the database**
+
+    The next step is to launch the PostgreSQL database for the portal. To achieve this, create a data volume for the database first:
+    ```console
+    docker volume create tyk-portal-postgres-data
+    ```
+
+    Then launch the PostgreSQL instance by executing the following command:
+    ```container
+    docker run \
+    -d \
+    --name tyk-portal-postgres \
+    --restart on-failure:5 \
+    -e POSTGRES_PASSWORD=secr3t \
+    -e PGDATA=/var/lib/postgresql/data/pgdata \
+    --mount type=volume,source=tyk-portal-postgres-data,target=/var/lib/postgresql/data/pgdata \
+    --mount type=bind,src=$(pwd)/init.sql,dst=/docker-entrypoint-initdb.d/init.sql \
+    --network tyk-portal \
+    -p 5432:5432 \
+    postgres:10-alpine
+    ```
+    **Note**
+
+    
+    <Warning>
+    The above PostgreSQL configuration is an example. You can customize deployment of your PostgreSQL instance. Please refer to [the PostgreSQL documentation](https://www.postgresql.org/docs/current/installation.html) for further guidance.
+    </Warning>
+
+
+4. **Create an environment variables file**
+
+    Creating an environment variables file to specify settings for the portal is the next step.
+    This is optional, as you can alternatively specify all the variables using the -e option when starting your deployment.
+
+    Here is an example of a sample environment file. For a comprehensive reference of environment variables, please refer to the [configuration section](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) in the Tyk Developer Portal documentation.
+    ```ini
+    PORTAL_HOSTPORT=3001
+    PORTAL_DATABASE_DIALECT=postgres
+    PORTAL_DATABASE_CONNECTIONSTRING=host=tyk-portal-postgres port=5432 dbname=portal user=admin password=secr3t sslmode=disable
+    PORTAL_DATABASE_ENABLELOGS=false
+    PORTAL_THEMING_THEME=default
+    PORTAL_STORAGE=db
+    PORTAL_LICENSEKEY=<your-license-here>
+    ```
+
+    Once you have completed this step, you are ready to launch the portal application with PostgreSQL in a Docker container.
+
+5. **Pull and launch the portal container**
+
+    To pull and launch the portal using Docker, use the command provided below.
+    Ensure that you replace `<tag>` with the specific version of the portal you intend to launch before executing the command, e.g. `tykio/portal:v1.7` for the portal v1.7. You can browse all available versions on [Docker Hub](https://hub.docker.com/r/tykio/portal/tags) and in the [release notes section](/developer-support/release-notes/portal#1-7-0-release-notes).
+    ```console
+    docker run -d \
+        -p 3001:3001 \
+        --env-file .env \
+        --network tyk-portal \
+        --name tyk-portal \
+        tykio/portal:<tag>
+    ```
+
+    This command will launch the portal on localhost at port 3001. Now, you can bootstrap the portal and start managing your API products.
+
+6. **Bootstrap the portal**
+
+    Now the portal is running on port 3001, but it needs to be bootstrapped by providing credentials for the super admin user since it's the first time you are launching it.
+    Follow the [bootstrapping section](/portal/install#bootstrapping-developer-portal) of the documentation to bootstrap the portal via the UI or the admin API.
+
+7. **Clean up**
+
+    If you want to clean up your environment or start the installation process from scratch, execute the following commands to stop and remove the portal container:
+    ```console
+    docker stop tyk-portal
+    docker rm tyk-portal
+    docker stop tyk-portal-postgres
+    docker rm tyk-portal-postgres
+    docker volume rm tyk-portal-postgres-data
+    ```
+
+### Using MySQL
+
+1. **Create a network for the portal deployment**
+
+    To start with, you need to create a Docker network for communication between the database and the portal. Execute the following command to create it:
+    ```console
+    docker network create tyk-portal
+    ```
+
+2. **Create the database volume and launch the database**
+
+    The next step is to launch the MySQL database for the portal. To achieve this, create a data volume for the database first:
+    ```console
+    docker volume create tyk-portal-mysql-data
+    ```
+
+    Then launch the MySQL instance by executing the following command:
+    ```console
+    docker run \
+    -d \
+    --name tyk-portal-mysql \
+    --restart on-failure:5 \
+    -e MYSQL_ROOT_PASSWORD=sup3rsecr3t \
+    -e MYSQL_DATABASE=portal \
+    -e MYSQL_USER=admin \
+    -e MYSQL_PASSWORD=secr3t \
+    --mount type=volume,source=tyk-portal-mysql-data,target=/var/lib/mysql \
+    --network tyk-portal \
+    -p 3306:3306 \
+    mysql:5.7 --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci --sql-mode=ALLOW_INVALID_DATES
+    ```
+    
+    <Warning>
+    **Note**  
+
+    The above MySQL configuration is an example. You can customize deployment of your MySQL instance.
+
+    Please refer to the [MySQL documentation](https://dev.mysql.com/doc/refman/5.7/en/charset-applications.html) for further guidance.
+    </Warning>
+
+
+3. **Create an environment variables file**
+
+    Creating an environment variables file to specify settings for the portal is the next step.
+    This is optional, as you can alternatively specify all the variables using the -e option when starting your deployment.
+
+    Here is an example of a sample environment file. For a comprehensive reference of environment variables, please refer to the [configuration](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) section in the Tyk Developer Portal documentation.
+    ```ini
+    MYSQL_ROOT_PASSWORD=sup3rsecr3t
+    MYSQL_DATABASE=portal
+    MYSQL_USER=admin
+    MYSQL_PASSWORD=secr3t
+    PORTAL_HOSTPORT=3001
+    PORTAL_DATABASE_DIALECT=mysql
+    PORTAL_DATABASE_CONNECTIONSTRING=admin:secr3t@tcp(tyk-portal-mysql:3306)/portal?charset=utf8mb4&parseTime=true
+    PORTAL_DATABASE_ENABLELOGS=false
+    PORTAL_THEMING_THEME=default
+    PORTAL_STORAGE=db
+    PORTAL_LICENSEKEY=<your-license-here>
+    ```
+
+    Once you have completed this step, you are ready to launch the portal application with MySQL in a Docker container or via Docker Compose.
+
+4. **Pull and launch the portal container**
+
+    To pull and launch the portal using Docker, use the command provided below.
+    Ensure that you replace `<tag>` with the specific version of the portal you intend to launch before executing the command, e.g. `tykio/portal:v1.7` for the portal v1.7.
+    You can browse all available versions on [Docker Hub](https://hub.docker.com/r/tykio/portal/tags) and in the [release notes](/developer-support/release-notes/portal#1-7-0-release-notes) section.
+    ```console
+    docker run -d \
+        -p 3001:3001 \
+        --env-file .env \
+        --network tyk-portal \
+        --name tyk-portal \
+        --mount type=bind,src=/tmp/portal/themes,dst=/opt/portal/themes \
+        --mount type=bind,src=/tmp/portal/system,dst=/opt/portal/public/system \
+        tykio/portal:<tag>
+    ```
+
+    This command will launch the portal on localhost at port 3001. Now, you can bootstrap the portal and start managing your API products.
+
+5. **Bootstrap the portal**
+
+    Now the portal is running on port 3001, but it needs to be bootstrapped by providing credentials for the super admin user since it's the first time you are launching it. Follow the [bootstrapping](/portal/install#bootstrapping-developer-portal) section of the documentation to bootstrap the portal via the UI or the admin API.
+
+6. **Clean up**
+
+    If you want to clean up your environment or start the installation process from scratch, execute the following commands to stop and remove the portal container:
+    ```console
+    docker stop tyk-portal
+    docker rm tyk-portal
+    docker stop tyk-portal-mysql
+    docker rm tyk-portal-mysql
+    docker volume rm tyk-portal-mysql-data
+    ```
+
+
+## Docker Compose
+
+This section provides a clear and concise, step-by-step recipe for launching the Tyk Developer Portal in a container using Docker Compose.
+Depending on your preferences, you can use MariaDB, MySQL or PostgreSQL for the database.
+
+In this recipe, the database and the portal containers will run on the same network, with the database storing it's data on a volume. The portal's CMS assets (images, files and themes) are stored in the database, although this guide provides links to the documentation to use a persistent volume or an S3 bucket as a storage medium for CMS assets.
+Additionally, all settings for the Portal are configured using an env-file.
+
+
+<Warning>
+**Note**
+
+This document is just an example. Customize all fields, including the username, password, root password, database name and more.
+</Warning>
+
+### Using PostgreSQL
+
+1. **Create an init script for PostgreSQL**
+
+    To initialize a PostgreSQL database, you need to create an init script that will later be used to launch the PostgreSQL instance.
+    Copy the content below to a file named `init.sql`, which you will need in the next step.
+    ```sql
+    -- init.sql
+    -- Creating user
+    CREATE USER admin WITH ENCRYPTED PASSWORD 'secr3t';
+    CREATE DATABASE portal;
+    GRANT ALL PRIVILEGES ON DATABASE portal TO admin;
+    ```
+
+2. **Create an environment variables file for configuring the portal and the database**
+
+    Creating an environment file to specify settings for the portal is the next step.
+
+    Here is an example of a sample environment file. For a comprehensive reference of environment variables, please refer to the [configuration section](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) in the Tyk Developer Portal documentation.
+    ```ini
+    PORTAL_HOSTPORT=3001
+    PORTAL_DATABASE_DIALECT=postgres
+    PORTAL_DATABASE_CONNECTIONSTRING=host=tyk-portal-postgres port=5432 dbname=portal user=admin password=secr3t sslmode=disable
+    PORTAL_DATABASE_ENABLELOGS=false
+    PORTAL_THEMING_THEME=default
+    PORTAL_LICENSEKEY=<your-license-here>
+    PORTAL_STORAGE=db
+    ```
+
+    Once you have completed this step, you are ready to launch the portal application with PostgreSQL via Docker Compose.
+
+3. **Create a docker-compose file**
+
+    Before launching the portal using docker-compose, you will need to create a `docker-compose.yaml` file. An example of the portal's docker-compose file is provided below, which you can use as a starting point and further customize to meet your specific requirements.
+
+    Ensure that you replace `<tag>` with the specific version of the portal you intend to launch before executing the command, e.g. `tykio/portal:v1.7` for the portal v1.7. You can browse all available versions on [Docker Hub](https://hub.docker.com/r/tykio/portal/tags) and in the [release notes section](/developer-support/release-notes/portal#1-7-0-release-notes).
+
+    ```yaml
+    version: '3.6'
+    services:
+    tyk-portal:
+        depends_on:
+        - tyk-portal-postgres
+        image: tykio/portal:<tag>
+        networks:
+        - tyk-portal
+        ports:
+        - 3001:3001
+        environment:
+        - PORTAL_DATABASE_DIALECT=${PORTAL_DATABASE_DIALECT}
+        - PORTAL_DATABASE_CONNECTIONSTRING=${PORTAL_DATABASE_CONNECTIONSTRING}
+        - PORTAL_THEMING_THEME=${PORTAL_THEMING_THEME}
+        - PORTAL_THEMING_PATH=${PORTAL_THEMING_PATH}
+        - PORTAL_LICENSEKEY=${PORTAL_LICENSEKEY}
+        - PORTAL_STORAGE=${PORTAL_STORAGE}
+
+    tyk-portal-postgres:
+        image: postgres:10-alpine
+        volumes:
+        - tyk-portal-postgres-data:/var/lib/postgresql/data/pgdata
+        - ${PWD}/init.sql:/docker-entrypoint-initdb.d/init.sql
+        networks:
+        - tyk-portal
+        environment:
+        - POSTGRES_PASSWORD=secr3t
+        - PGDATA=/var/lib/postgresql/data/pgdata
+
+    volumes:
+    tyk-portal-postgres-data:
+
+    networks:
+    tyk-portal:
+    ```
+
+4. **Pull and launch the portal container using docker-compose**
+
+    To launch the portal using docker-compose, execute the command provided below.
+    ```console
+    docker-compose --env-file .env up -d
+    docker-compose --env-file .env up -d
+    ```
+
+    This command will launch the portal on localhost at port 3001. Now, you can bootstrap the portal and start managing your API products.
+
+5. **Bootstrap the portal**
+
+    Now the portal is running on port 3001, but it needs to be bootstrapped by providing credentials for the super admin user since it's the first time you are launching it. Follow the [bootstrapping section](#bootstrapping-enterprise-developer-portal) of the documentation to bootstrap the portal via the UI or the admin API. 
+
+6. **Clean up**
+
+    If you want to clean up your environment or start the installation process from scratch, execute the following commands to stop and remove the portal container:
+    ```console
+    docker-compose down
+    ```
+
+### Using MySQL
+
+1. **Create an environment variables file for configuring the portal and the database**
+
+    The first step is to create an environment file to specify settings for the portal.
+
+    Here is an example of a sample environment file. For a comprehensive reference of environment variables, please refer the [configuration section](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) in the Tyk Developer Portal documentation.
+    ```ini
+    MYSQL_ROOT_PASSWORD=sup3rsecr3t
+    MYSQL_DATABASE=portal
+    MYSQL_USER=admin
+    MYSQL_PASSWORD=secr3t
+    PORTAL_HOSTPORT=3001
+    PORTAL_DATABASE_DIALECT=mysql
+    PORTAL_DATABASE_CONNECTIONSTRING=admin:secr3t@tcp(tyk-portal-mysql:3306)/portal?charset=utf8mb4&parseTime=true
+    PORTAL_DATABASE_ENABLELOGS=false
+    PORTAL_THEMING_THEME=default
+    PORTAL_STORAGE=db
+    PORTAL_LICENSEKEY=<your-license-here>
+    ```
+
+    Once you have completed this step, you are ready to launch the portal application with MySQL via Docker Compose.
+
+2. **Create a docker-compose file**
+
+    Before launching the portal using docker-compose, you will need to create a `docker-compose.yaml` file.
+    An example of the portal's docker-compose file is provided below, which you can use as a starting point and further customize to meet your specific requirements.
+
+    Ensure that you replace `<tag>` with the specific version of the portal you intend to launch before executing the command, e.g. `tykio/portal:v1.7` for the portal v1.7.
+    You can browse all available versions on [Docker Hub](https://hub.docker.com/r/tykio/portal/tags) and in the [release notes section](/developer-support/release-notes/portal#1-7-0-release-notes).
+
+    ```yaml
+    version: '3.6'
+    services:
+    tyk-portal:
+        depends_on:
+        - tyk-portal-mysql
+        image: tykio/portal:<tag>
+        networks:
+        - tyk-portal
+        ports:
+        - 3001:3001
+        environment:
+        - PORTAL_DATABASE_DIALECT=${PORTAL_DATABASE_DIALECT}
+        - PORTAL_DATABASE_CONNECTIONSTRING=${PORTAL_DATABASE_CONNECTIONSTRING}
+        - PORTAL_THEMING_THEME=${PORTAL_THEMING_THEME}
+        - PORTAL_THEMING_PATH=${PORTAL_THEMING_PATH}
+        - PORTAL_LICENSEKEY=${PORTAL_LICENSEKEY}
+        - PORTAL_STORAGE=${PORTAL_STORAGE}
+
+    tyk-portal-mysql:
+        image: mysql:5.7
+        command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
+        volumes:
+        - tyk-portal-mysql-data:/var/lib/mysql
+        networks:
+        - tyk-portal   
+        environment:
+        - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+        - MYSQL_DATABASE=${MYSQL_DATABASE}
+        - MYSQL_USER=${MYSQL_USER}
+        - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+
+    volumes:
+    tyk-portal-mysql-data:
+
+    networks:
+    tyk-portal:
+    ```
+
+3. **Pull and launch the portal container using docker-compose**
+
+    To launch the portal using docker-compose, execute the command provided below.
+    ```console
+    docker-compose --env-file .env up -d
+    docker-compose --env-file .env up -d
+    ```
+
+    This command will launch the portal on localhost at port 3001. Now, you can bootstrap the portal and start managing your API products.
+
+4. **Bootstrap the portal**
+
+    Now the portal is running on port 3001, but it needs to be bootstrapped by providing credentials for the super admin user since it's the first you are launching it. Follow the [bootstrapping section](#bootstrapping-enterprise-developer-portal) of the documentation to bootstrap the portal via the UI or the admin API.
+
+5. **Clean up**
+
+    If you want to clean up your environment or start the installation process from scratch, execute the following commands to stop and remove the portal container:
+    ```console
+    docker-compose down
+    ```
\ No newline at end of file
diff --git a/portal/install/kubernetes.mdx b/portal/install/kubernetes.mdx
new file mode 100644
index 0000000000..ae5240384b
--- /dev/null
+++ b/portal/install/kubernetes.mdx
@@ -0,0 +1,249 @@
+---
+title: "Install Developer Portal on Kubernetes"
+description: "Installation guide for the Tyk Developer Portal on Kubernetes using Helm charts"
+keywords: "Developer Portal, Tyk, Install Tyk Developer Portal, Bootstrap Tyk Developer Portal"
+sidebarTitle: "Kubernetes"
+---
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| Enterprise | Self-Managed, Hybrid |
+
+## Compatible Kubernetes Versions
+
+1.33.x, 1.34.x, 1.35.x
+
+## Prerequisites
+
+- [Kubernetes](https://kubernetes.io/docs/setup/)
+- [Helm 3+](https://helm.sh/docs/intro/install/)
+- [Enterprise Edition License](/portal/overview/intro#getting-access)
+
+<Note>
+Running on Podman, containerd, or another container runtime? See [Container Runtimes](/deployment-and-operations/container-runtimes).
+</Note>
+
+## Tyk Stack (New Helm Chart)
+
+There are two ways to install the portal on Kubernetes:
+
+1. **As part of Tyk Self-Managed** - Enable `global.components.devPortal` during Tyk Self-Managed deployment using the [tyk-stack chart](/product-stack/tyk-charts/tyk-stack-chart)
+2. **Standalone installation** - Use the [tyk-dev-portal](https://github.com/TykTechnologies/tyk-charts/tree/main/components/tyk-dev-portal) Helm chart (described below)
+
+This section provides a step-by-step instruction for installing the Tyk Developer Portal as standalone component using the new helm chart.
+
+### Instructions
+
+1. **Create the `tyk-dev-portal-conf` secret**
+
+    Make sure the `tyk-dev-portal-conf` secret exists in your namespace. 
+    This secret will automatically be generated if Tyk Dashboard instance was bootstrapped with [tyk-boostrap](https://artifacthub.io/packages/helm/tyk-helm/tyk-bootstrap) component chart 
+    and `bootstrap.devPortal` was set to `true` in the `values.yaml`.
+
+    If the secret does not exist, you can create it by running the following command.
+
+    ```bash
+    kubectl create secret generic tyk-dev-portal-conf -n ${NAMESPACE} \
+    --from-literal=TYK_ORG=${TYK_ORG} \
+    --from-literal=TYK_AUTH=${TYK_AUTH}
+    ```
+
+    The fields `TYK_ORG` and `TYK_AUTH` are the Tyk Dashboard _Organization ID_ and the Tyk Dashboard API _Access Credentials_ respectively. These can be obtained under your profile in the Tyk Dashboard.
+
+2. **Config settings**
+
+    You must set the following values in the `values.yaml` or with `--set {field-name}={field-value}` using the helm upgrade command:
+
+    | Field Name | Description |
+    | ---------- | ----------- |
+    | `global.adminUser.email` and `global.adminUser.password` | Set portal admin username and email for bootstrapping |
+    | `global.secrets.devPortal` | Enable portal bootstrapping by providing secret name |
+    | `license` | Tyk license key for your portal installation |
+    | `storage.type` | Portal storage type, e.g. *fs*, *s3* and *db* |
+    | `image.tag` | Developer Portal version. You can get the latest version image tag from [Docker Hub](https://hub.docker.com/r/tykio/portal/tags) |
+    | `database.dialect` | Portal database dialect, e.g. *mysql*, *postgres* |
+    | `database.connectionString`| Connection string to the Portal's database, e.g. for the *mysql* dialect: `admin:secr3t@tcp(tyk-portal-mysql:3306)/portal?charset=utf8mb4&parseTime=true` |
+
+    In addition to `values.yaml`, you can also define the environment variables described in the [configuration section](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) to further customize your portal deployment. These environment variables can also be listed as a name value list under the `extraEnvs` section of the helm chart.
+
+3. **Launch the portal using the helm chart**
+
+    Run the following command to update your infrastructure and install the developer portal:
+
+    ```bash
+    helm install tyk-dev-portal tyk-helm/tyk-dev-portal -f values.yaml -n tyk
+    ```
+4. **Bootstrapping the Developer Portal**
+
+    Follow the [bootstrapping section](/portal/install#bootstrapping-developer-portal) of the documentation to bootstrap the portal via the UI or the admin API.
+
+### Configuration
+
+For the full list of configurable values, refer to the [tyk-stack chart guide](/product-stack/tyk-charts/tyk-stack-chart). The sections below cover common production configuration scenarios.
+
+> **Note**: Helm chart supports Developer Portal v1.2.0+.
+
+### Pod Security Context
+
+The chart ships with hardened defaults for the Portal pod that satisfy the Kubernetes [Restricted Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted):
+
+```yaml
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+  fsGroup: 2000
+
+containerSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+  allowPrivilegeEscalation: false
+  privileged: false
+  readOnlyRootFilesystem: true
+  seccompProfile:
+    type: RuntimeDefault
+  capabilities:
+    drop:
+      - ALL
+```
+
+Override these in your `values.yaml` to match your cluster's PSS policy.
+
+<Warning>
+**Bootstrap job security context limitation**
+
+The bootstrap job does not inherit `securityContext` or `containerSecurityContext` from `values.yaml`. On clusters enforcing PSS Restricted or Baseline profiles, the job will fail with a security policy violation.
+
+**Workaround:** Disable the automatic bootstrap and run it manually after deployment. See [Bootstrap Job](#bootstrap-job) below.
+</Warning>
+
+### Bootstrap Job
+
+The bootstrap job runs once after `helm install`. It waits for the Portal pod to become ready, then calls `POST /portal-api/bootstrap` to create the bootstrap admin ([API Owner](/portal/api-owner)) user. The Portal blocks its startup sequence until this call succeeds.
+
+**Verify bootstrap completed:**
+
+```bash
+kubectl get jobs -n <namespace>
+kubectl logs job/dev-portal-job-<release-name> -n <namespace>
+```
+
+A successful run logs: `API call completed.`
+
+**To disable automatic bootstrap and bootstrap manually** (required on clusters with strict Pod Security Standards):
+
+1. Set `global.components.bootstrap: false` in your `values.yaml` and deploy.
+2. Wait for the Portal pod to be ready, then send the bootstrap request:
+
+```bash
+curl -X POST http://<portal-service>:<port>/portal-api/bootstrap \
+  -H "Content-Type: application/json" \
+  -d '{
+    "username": "admin@example.com",
+    "password": "your-password",
+    "first_name": "Admin",
+    "last_name": "User"
+  }'
+```
+
+Once the call succeeds, the Portal detects the new user and completes its startup sequence.
+
+### Storage
+
+The `storage.type` setting controls where the portal stores assets (themes, images, OpenAPI specs). Session storage is always backed by the Portal database, regardless of this setting.
+
+| Type | Description | Notes |
+|---|---|---|
+| `db` | Assets stored in the Portal database | Recommended for Kubernetes. No PVC required. |
+| `s3` | Assets stored in an S3-compatible bucket | Suitable for cloud or multi-replica deployments |
+| `fs` | Assets stored on the container filesystem | Requires a PersistentVolumeClaim |
+
+For `fs` storage, configure a PVC using `storage.persistence`:
+
+```yaml
+storage:
+  type: fs
+  persistence:
+    storageClass: "standard"
+    accessModes:
+      - ReadWriteOnce
+    size: 8Gi
+```
+
+<Note>
+`storage.type: fs` with multiple replicas requires a storage class that supports `ReadWriteMany`. Use `db` or `s3` to avoid this constraint.
+</Note>
+
+### Scaling and Replicas
+
+The default `kind: StatefulSet` is suited for single-pod deployments. To run multiple replicas, switch to `Deployment`:
+
+```yaml
+kind: Deployment
+replicaCount: 3
+
+storage:
+  type: db  # or s3; both support concurrent access from multiple replicas
+```
+
+Portal sessions are stored in the Portal database. All replicas share the same session store automatically via the shared database connection. No sticky sessions or additional session store configuration is required.
+
+### Troubleshooting
+
+For bootstrap job failures, crash-loops, database connectivity issues, and license key errors, see [Kubernetes Bootstrap Failures](/portal/troubleshooting/kubernetes-bootstrap-failures).
+
+## Legacy Helm Chart
+
+<Warning>
+**Note**
+
+It is recommended to use new helm charts instead of legacy charts. Guide for new charts can be found [here](/portal/install/kubernetes)
+</Warning>
+
+This section provides a clear and concise, step-by-step recipe for installing the Tyk Developer Portal using [legacy helm chart](https://github.com/TykTechnologies/tyk-helm-chart/tree/master/tyk-pro).
+
+### Instructions
+
+1. **Create the `tyk-enterprise-portal-conf` secret**
+
+    Make sure the `tyk-enterprise-portal-conf` secret exists in your namespace. This secret will automatically be generated during the Tyk Dashboard bootstrap if the `dash.enterprisePortalSecret` value is set to `true` in the `values.yaml`.
+
+    If the secret does not exist, you can create it by running the following command.
+
+    ```bash
+    kubectl create secret generic tyk-enterprise-portal-conf -n ${NAMESPACE} \
+    --from-literal=TYK_ORG=${TYK_ORG} \
+    --from-literal=TYK_AUTH=${TYK_AUTH}
+    ```
+
+    Where `TYK_ORG` and `TYK_AUTH` are the Tyk Dashboard Organization ID and the Tyk Dashboard API Access Credentials respectively. Which can be obtained under your profile in the Tyk Dashboard.
+
+2. **Config settings**
+
+    You must set the following values in the `values.yaml` or with `--set {field-name}={field-value}` with the helm upgrade command:
+
+    | Field Name | Description |
+    | ---------- | ----------- |
+    | `enterprisePortal.enabled` | Enable Portal installation |
+    | `enterprisePortal.bootstrap` | Enable Portal bootstrapping |
+    | `enterprisePortal.license`| Tyk license key for your portal installation |
+    | `enterprisePortal.storage.type`| Portal database dialect, e.g *mysql*, *postgres* |
+    | `enterprisePortal.storage.connectionString` | Connection string to the Portal's database, e.g for the mysql dialect: `admin:secr3t@tcp(tyk-portal-mysql:3306)/portal?charset=utf8mb4&parseTime=true` |
+
+    In addition to values.yaml, you can also define the environment variables described in the [configuration section](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) to further customize your portal deployment. These environment variables can also be listed as a name value list under the `extraEnvs` section of the helm chart.
+
+3. **Launch the portal using the helm chart**
+
+    Run the following command to update your infrastructure and install the developer portal:
+
+    ```bash
+    helm upgrade tyk-pro tyk-helm/tyk-pro -f values.yaml -n tyk
+    ```
+
+
+
+    <Note>
+    In case this is the first time you are launching the portal, it will be necessary to bootstrap it before you can use it. For detailed instructions, please refer to the [bootstrapping documentation](#bootstrapping-enterprise-developer-portal).
+    </Note>
+
+
+> **Note**: Helm chart supports Developer Portal v1.2.0+.
\ No newline at end of file
diff --git a/portal/install/linux.mdx b/portal/install/linux.mdx
new file mode 100644
index 0000000000..9808dc7590
--- /dev/null
+++ b/portal/install/linux.mdx
@@ -0,0 +1,238 @@
+---
+title: "Install Developer Portal on Linux Distributions"
+description: "Installation guide for the Tyk Developer Portal on Linux distributions using Ubuntu, Debian, Red Hat, and CentOS"
+keywords: "Developer Portal, Tyk, Install Tyk Developer Portal, Bootstrap Tyk Developer Portal, Linux, Ubuntu, Debian, Red Hat, CentOS"
+sidebarTitle: "Linux"
+---
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| Enterprise | Self-Managed, Hybrid |
+
+## Compatible Operating Systems
+
+| Operating System | Version |
+|-----------------|---------|
+| Ubuntu | 20.04 (focal), 22.04 (jammy), 24.04 (noble) |
+| Red Hat Enterprise Linux | 7.9, 8.9, 9.3  |
+| CentOS Stream | Stream 9, Stream 10 |
+| Debian | 11 (Bullseye), 12 (Bookworm) |
+| Amazon Linux | 2023.7 |
+
+### Binaries
+
+Installation packages for supported Linux distributions are available on [packagecloud.io](https://packagecloud.io/tyk/portal).
+
+## Prerequisites
+
+- [Enterprise Edition License](/portal/overview/intro#getting-access)
+
+## Red Hat (RHEL / CentOS)
+
+This guide provides a step-by-step recipe for launching the Tyk Developer Portal using an RPM package in Red Hat environment (RHEL / CentOS).
+
+<Warning>
+**Note**
+
+This document is just an example. Customize all fields, including the username, password, root password, database name and more.
+
+Be sure to update the connection DSN in the env-file accordingly.
+</Warning>
+
+
+### Prerequisites
+
+To successfully install the Tyk Developer Portal using RPM, your environment should satisfy the following requirements:
+- Connectivity to [packagecloud.io](https://packagecloud.io/tyk/portal). If your environment doesn't have connectivity to packagecloud, you will need to download the portal package and copy it to the target host.
+- RPM Package Manager should be installed on the host machine.
+
+### Instructions
+
+1. **Download the portal package**
+
+    To start with, you need to download the portal package from [packagecloud.io](https://packagecloud.io/tyk/portal). To keep things organized, first create a directory where all installation assets (packages and config files) will be stored:
+    ```console
+    mkdir ~/portal-install
+    cd ~/portal-install
+    ```
+
+    Next, download the portal package from [packagecloud.io](https://packagecloud.io/tyk/portal) by executing the command below.
+    
+    Ensure to replace `distro-type`, `distro-version` and `package-version` with actual values e.g. https://packagecloud.io/tyk/portal/packages/ubuntu/noble/portal_1.16.0_amd64.deb/download.deb?distro_version_id=284 for the portal v1.16.0 for Ubuntu 24.04 (noble) amd64.
+    ```console
+    wget --content-disposition "https://packagecloud.io/tyk/portal/packages/<distro-type>/<distro-version>/portal_<package-version>_1.x86_64.rpm/download.rpm?distro_version_id=284"
+    ```
+
+2. **Install the portal package**
+
+    Once the package is downloaded, you need to install using RPM. Execute the below command to so. Once again, ensure to replace `portal-1.16.0-1.x86_64.rpm` with an actual filename of the package you have downloaded on the previous step.  
+    ```console
+    sudo rpm -i portal-1.16.0-1.x86_64.rpm
+    ```
+
+3. **Update the configuration file with your license**
+
+    Before starting the portal service, you need to configure the portal. Once the rpm package has been installed, the portal configuration file will be located in `/opt/portal/portal.conf`.
+    Initially, the config file is filled with the default values. The minimal configuration change to start the portal is to add the `LicenseKey` property to the config file.
+    The below sample configuration will start the portal on portal 3001 with PostgreSQL as a database, no TLS enabled, and all CMS assets (images, theme files, etc.) are stored in the filesystem.
+    You can, however, customize the provided example and make more suitable for your need using the [configuration](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) reference.
+    ```json
+    {
+    "HostPort": 3001,
+    "LicenseKey": "<your-license-here>",
+    "Database": {
+        "Dialect": "postgres",
+        "ConnectionString": "host=tyk-portal-postgres port=5432 dbname=portal user=admin password=secr3t sslmode=disable",
+        "EnableLogs": false
+    },
+    "Blog": {
+        "Enable": true
+    },
+    "Site": {
+        "Enable": true
+    },
+    "Forms": {
+        "Enable": false
+    },
+    "StoreSessionName": "portal-store-session-name",
+    "PortalAPISecret": "123456",
+    "Storage": "fs",
+    "S3": {
+        "AccessKey": "your-access-key-here",
+        "SecretKey": "your-secret-key-here",
+        "Region": "s3-region",
+        "Endpoint": "if-any",
+        "Bucket": "your-bucket-here",
+        "ACL": "",
+        "PresignURLs": true
+    },
+    "TLSConfig": {
+        "Enable": false,
+        "InsecureSkipVerify": false,
+        "Certificates":[
+        {
+            "Name": "localhost",
+            "CertFile": "portal.crt",
+            "KeyFile": "portal.key"
+        }
+        ]
+    }
+    }
+    ```
+
+4. **Start the portal service**
+
+    Now when the portal package is installed and the configuration is updated, it is time to start the portal by executing the following command:
+    ```console
+    sudo systemctl start portal.service
+    ```
+
+    To check status and log of the portal execute the following command:
+    ```console
+    systemctl status portal.service
+    ```
+
+5. **Bootstrap the portal**
+
+    Now the portal is running on port 3001, but it needs to be bootstrapped by providing credentials for the super admin user since it's the first you are launching it. Follow the [bootstrapping](#bootstrapping-enterprise-developer-portal) section of the documentation to bootstrap the portal via the UI or the admin API.
+
+## Ubuntu / Debian
+
+This guide provides a step-by-step recipe for launching the Tyk Developer Portal using a DEB package in Ubuntu / Debian environment.
+
+### Prerequisites
+
+To successfully install the Tyk Developer Portal using DEB, your environment should satisfy the following requirements:
+- Connectivity to [packagecloud.io](https://packagecloud.io/tyk/portal). If your environment doesn't have
+connectivity to packagecloud, you will need to download the portal package and copy it to the target host.
+- Debian Package Manager should be installed on the host machine.
+
+### Instructions
+
+1. **Download the portal package**
+
+    To start with, you need to download the portal package from [packagecloud.io](https://packagecloud.io/tyk/portal). To keep things organized, first create a directory where all installation assets (packages and config files) will be stored:
+    ```console
+    mkdir ~/portal-install
+    cd ~/portal-install
+    ```
+
+    Next, download the portal package from [packagecloud.io](https://packagecloud.io/tyk/portal) by executing the command below.
+    
+    Ensure to replace `distro-type`, `distro-version` and `package-version` with actual values e.g. https://packagecloud.io/tyk/portal/packages/ubuntu/noble/portal_1.16.0_amd64.deb/download.deb?distro_version_id=284 for the portal v1.16.0 for Ubuntu 24.04 (noble) amd64.
+    ```console
+    wget --content-disposition "https://packagecloud.io/tyk/portal/packages/<distro-type>/<distro-version>/portal_<package-version>_amd64.deb/download.deb?distro_version_id=284"
+    ```
+2. **Install the portal package**
+
+    Once the package is downloaded, you need to install using DEB. Execute the below command to so. Once again, ensure to replace `portal_1.16.0_amd64.deb` with an actual filename of the package you have downloaded on the previous step.  
+    ```console
+    sudo dpkg -i portal_1.16.0_amd64.deb
+    ```
+3. **Update the configuration file with your license**
+
+    Before starting the portal service, you need to configure the portal. Once the deb package has been installed, the portal configuration file will be located in `/opt/portal/portal.conf`.
+
+    Initially, the config file is filled with the default values. The minimal configuration change to start the portal is to add the `LicenseKey` property to the config file.
+
+    The below sample configuration will start the portal on portal 3001 with PostgreSQL as a database, no TLS enabled, and all CMS assets (images, theme files, etc.) are stored in the filesystem.
+    You can, however, customize the provided example and make more suitable for your need using the [configuration](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) reference.
+    ```json
+    {
+    "HostPort": 3001,
+    "LicenseKey": "<your-license-here>",
+    "Database": {
+        "Dialect": "postgres",
+        "ConnectionString": "host=tyk-portal-postgres port=5432 dbname=portal user=admin password=secr3t sslmode=disable",
+        "EnableLogs": false
+    },
+    "Blog": {
+        "Enable": true
+    },
+    "Site": {
+        "Enable": true
+    },
+    "Forms": {
+        "Enable": false
+    },
+    "StoreSessionName": "portal-store-session-name",
+    "PortalAPISecret": "123456",
+    "Storage": "fs",
+    "S3": {
+        "AccessKey": "your-access-key-here",
+        "SecretKey": "your-secret-key-here",
+        "Region": "s3-region",
+        "Endpoint": "if-any",
+        "Bucket": "your-bucket-here",
+        "ACL": "",
+        "PresignURLs": true
+    },
+    "TLSConfig": {
+        "Enable": false,
+        "InsecureSkipVerify": false,
+        "Certificates":[
+        {
+            "Name": "localhost",
+            "CertFile": "portal.crt",
+            "KeyFile": "portal.key"
+        }
+        ]
+    }
+    }
+    ```
+
+4. **Start the portal service**
+
+    Once the configuration is updated, you can start the portal service using the following command:
+    ```console
+    sudo systemctl start portal.service
+    ```
+
+    To check status and log of the portal execute the following command:
+    ```console
+    systemctl status portal.service
+    ```
+
+5. **Bootstrap the portal**
+
+    Now the portal is running on port 3001, but it needs to be bootstrapped by providing credentials for the super admin user since it's the first you are launching it. Follow the [bootstrapping](/portal/install#bootstrapping-developer-portal) section of the documentation to bootstrap the portal via the UI or the admin API.
diff --git a/portal/install/upgrade-guide.mdx b/portal/install/upgrade-guide.mdx
new file mode 100644
index 0000000000..c7aca13235
--- /dev/null
+++ b/portal/install/upgrade-guide.mdx
@@ -0,0 +1,315 @@
+---
+title: "Developer Portal Upgrade Guide"
+description: "Step-by-step instructions for upgrading the Tyk Developer Portal across Docker, Kubernetes, and Linux deployments."
+sidebarTitle: "Upgrade Guide"
+keywords: "Developer Portal, Tyk, Upgrade Developer Portal, Portal upgrade, Portal version update"
+---
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| Enterprise | Self-Managed, Hybrid, Cloud |
+
+This guide explains how to upgrade the Tyk Developer Portal to a new version. The upgrade process involves replacing the Portal binary or container image, after which the Portal automatically applies any required database migrations on startup. You must also manually upgrade your theme to pick up template changes.
+
+## Before You Upgrade
+
+Complete the following steps before starting the upgrade:
+
+{/* 1. **Check the [Compatibility Matrix](/portal/overview/compatibility-matrix)** to confirm the new Portal version is compatible with your Tyk Dashboard version. */}
+
+2. **Review the release notes** for every version between your current version and the target version. Pay particular attention to the "Breaking Changes" section. See [Portal Release Notes](/developer-support/release-notes/portal).
+
+3. **Back up your database.** The Portal stores its configuration and Product, Plan, and Developer data in the database. Use the native backup utility for your database engine (PostgreSQL, MySQL, or MariaDB).
+
+4. **Back up your theme files.** If you have a custom theme, export it from the Admin Portal or copy the theme directory before upgrading. See [Upgrade Your Theme](#upgrade-your-theme).
+
+    <Warning>
+    Skipping the theme upgrade after a Portal version bump can cause template rendering errors, UI breakages on the Live Portal, or failed authentication flows. Always upgrade your theme as part of the Portal upgrade process.
+    </Warning>
+
+5. **Note your current Portal version.** You can find this in the Admin Portal under the account settings, or by checking the running container image tag.
+
+{/* TODO: Screenshot — Admin Portal showing the current version number */}
+
+## Upgrade Procedure
+
+### Tyk Cloud
+
+On Tyk Cloud, the Developer Portal upgrade is managed through the Tyk Cloud Console. You do not run Docker or Kubernetes commands directly.
+
+1. **Open the Tyk Cloud Console** and navigate to your deployment settings.
+
+2. **Select the target Portal version** from the **version** dropdown.
+
+3. **Apply the update.**
+
+    Tyk Cloud orchestrates the rolling upgrade of the underlying infrastructure on your behalf. Database migrations run automatically during this process.
+
+    After the upgrade completes, proceed to [Post-Upgrade Verification](#post-upgrade-verification).
+
+### Docker
+
+#### Docker Run
+
+1. **Stop and remove the running Portal container.**
+
+    ```console
+    docker stop tyk-portal
+    docker rm tyk-portal
+    ```
+
+2. **Pull the new Portal image.** Replace `<NEW_VERSION>` with the target version, for example `v1.17.1`. You can browse all available versions on [Docker Hub](https://hub.docker.com/r/tykio/portal/tags).
+
+    ```console
+    docker pull tykio/portal:<NEW_VERSION>
+    ```
+
+3. **Start the Portal container using the new image.** Use the same `docker run` command from your initial installation, updating only the image tag. The Portal applies any required database migrations automatically on startup.
+
+    ```console
+    docker run -d \
+        -p 3001:3001 \
+        --env-file .env \
+        --network tyk-portal \
+        --name tyk-portal \
+        tykio/portal:<NEW_VERSION>
+    ```
+
+4. **Verify the Portal has started successfully.** Confirm there are no startup errors before proceeding to post-upgrade verification.
+
+    ```console
+    docker logs tyk-portal
+    ```
+
+#### Docker Compose
+
+1. **Update the Portal image tag** in your `docker-compose.yaml` file:
+
+    ```yaml
+    tyk-portal:
+      image: tykio/portal:<NEW_VERSION>
+    ```
+
+2. **Pull the new image and restart the Portal container.**
+
+    ```console
+    docker-compose pull tyk-portal
+    docker-compose up -d tyk-portal
+    ```
+
+3. **Verify the Portal has started successfully.**
+
+    ```console
+    docker-compose logs tyk-portal
+    ```
+
+### Kubernetes
+
+[Developer Portal Helm Chart](https://github.com/TykTechnologies/tyk-charts/tree/main/components/tyk-dev-portal) (`tyk-dev-portal`)
+
+1. **Update the Portal image tag** in your `values.yaml`:
+
+    ```yaml
+    image:
+      tag: "<NEW_VERSION>"
+    ```
+
+2. **Run the Helm upgrade.**
+
+    ```console
+    helm upgrade tyk-dev-portal tyk-helm/tyk-dev-portal \
+      -f values.yaml \
+      -n tyk
+    ```
+
+    If the Portal is deployed as part of the full [Tyk Stack chart](https://github.com/TykTechnologies/tyk-charts/tree/main/tyk-stack), update `global.components.devPortal.image.tag` and run:
+
+    ```console
+    helm upgrade tyk tyk-helm/tyk-stack \
+      -f values.yaml \
+      -n tyk
+    ```
+
+3. **Watch the rollout.**
+
+    ```console
+    kubectl rollout status deployment/<portal-deployment-name> -n tyk
+    ```
+
+4. **Check the logs for startup errors.**
+
+    ```console
+    kubectl logs -f <portal-pod-name> -n tyk
+    ```
+
+<Note>
+If the Portal pod restarts before startup completes, particularly after a theme upgrade, increase the `initialDelaySeconds` value in your readiness and liveness probe configuration to at least 60 seconds. 
+
+A smaller value may cause Kubernetes to mark the pod as unhealthy and restart it before the application has finished initializing.
+</Note>
+
+### Linux
+
+#### Red Hat / CentOS
+
+1. **Download the new Portal RPM package** from [packagecloud.io](https://packagecloud.io/tyk/portal). Replace `<VERSION>` with the target version.
+
+    ```console
+    wget --content-disposition "https://packagecloud.io/tyk/portal/packages/<distro-type>/<distro-version>/portal_<VERSION>_1.x86_64.rpm/download.rpm?distro_version_id=284"
+    ```
+
+2. **Upgrade the installed package.**
+
+    ```console
+    sudo rpm -Uvh portal-<VERSION>-1.x86_64.rpm
+    ```
+
+3. **Review the Portal configuration file** at `/opt/portal/portal.conf`. Consult the release notes for any changes to configuration options required by the new version.
+
+4. **Restart the Portal service.**
+
+    ```console
+    sudo systemctl restart portal.service
+    ```
+
+5. **Check the service status.**
+
+    ```console
+    systemctl status portal.service
+    ```
+
+#### Ubuntu / Debian
+
+1. **Download the new Portal DEB package** from [packagecloud.io](https://packagecloud.io/tyk/portal). Replace `<VERSION>` with the target version.
+
+    ```console
+    wget --content-disposition "https://packagecloud.io/tyk/portal/packages/<distro-type>/<distro-version>/portal_<VERSION>_amd64.deb/download.deb?distro_version_id=284"
+    ```
+
+2. **Install the new package.** `dpkg -i` replaces the existing installation.
+
+    ```console
+    sudo dpkg -i portal_<VERSION>_amd64.deb
+    ```
+
+3. **Review the Portal configuration file** at `/opt/portal/portal.conf`. Consult the release notes for any changes to configuration options required by the new version.
+
+4. **Restart the Portal service.**
+
+    ```console
+    sudo systemctl restart portal.service
+    ```
+
+5. **Check the service status.**
+
+    ```console
+    systemctl status portal.service
+    ```
+
+## Upgrade Your Theme
+
+To prevent from accidentally overwriting your customizations, the Developer Portal does not automatically update the default theme when the Portal is upgraded. After every Portal upgrade, you must check whether the new version includes theme changes and merge them into your custom theme.
+
+See [Upgrading Themes](/portal/customization/themes#upgrading-themes) for the full procedure.
+
+<Warning>
+Skipping the theme upgrade after a Portal version bump can cause template rendering errors, UI breakages on the Live Portal, or failed authentication flows. Always upgrade your theme as part of the portal upgrade process.
+</Warning>
+
+## Post-Upgrade Verification
+
+After the Portal has started, confirm the following before directing traffic to the upgraded instance:
+
+1. **Admin Portal is accessible.** Log in at `http://<your-portal-host>:<port>/portal-admin`.
+
+{/* TODO: Screenshot — Admin Portal login page */}
+
+2. **Provider sync is working.** Navigate to **Providers** in the Admin Portal and confirm your Providers show a healthy sync status. If sync fails after upgrade, check whether any policies in Tyk Dashboard reference API IDs that no longer exist. A stale policy referencing a deleted API will abort the entire sync. Delete or correct the affected policy and re-trigger sync. See also [Troubleshooting > Upgrade Failures](/portal/troubleshooting/upgrade-failures).
+
+3. **Consumer login works.** Open the Live Portal and verify that existing API Consumer users can log in.
+
+4. **API Catalog is visible.** Confirm that published API Products are visible to users on the Live Portal.
+
+5. **Theme renders correctly.** Check the Live Portal for visual regressions or template errors in the browser console.
+
+6. **Review the Portal logs.** Look for any `ERROR` or `WARN` messages that indicate a migration or configuration issue.
+
+## Rollback Procedure
+
+If the upgrade causes issues that you cannot resolve, roll back to the previous version using the steps below.
+
+<Warning>
+A rollback involves restoring the database backup taken before the upgrade. Any data changes made after the upgrade, including new users, access requests, and configuration updates, will be lost.
+</Warning>
+
+### Docker
+
+1. **Stop and remove the upgraded container.**
+
+    ```console
+    docker stop tyk-portal
+    docker rm tyk-portal
+    ```
+
+2. **Restore the database** from the backup you took before the upgrade.
+
+3. **Start the Portal using the previous image tag.**
+
+    ```console
+    docker run -d \
+        -p 3001:3001 \
+        --env-file .env \
+        --network tyk-portal \
+        --name tyk-portal \
+        tykio/portal:<PREVIOUS_VERSION>
+    ```
+
+### Kubernetes
+
+1. **Restore the database** from the backup you took before the upgrade.
+
+2. **Roll back the Helm release.** First, list available revisions:
+
+    ```console
+    helm history tyk-dev-portal -n tyk
+    ```
+
+    Then roll back to the previous revision:
+
+    ```console
+    helm rollback tyk-dev-portal -n tyk
+    ```
+
+    To roll back to a specific revision number:
+
+    ```console
+    helm rollback tyk-dev-portal <REVISION_NUMBER> -n tyk
+    ```
+
+### Linux
+
+1. **Restore the database** from the backup taken before the upgrade.
+
+2. **Downgrade the package** to the previous version.
+
+    On Ubuntu / Debian:
+
+    ```console
+    sudo apt-get install tyk-portal=<PREVIOUS_VERSION>
+    ```
+
+    On Red Hat / CentOS:
+
+    ```console
+    sudo yum downgrade tyk-portal-<PREVIOUS_VERSION>
+    ```
+
+3. **Restart the Portal service.**
+
+    ```console
+    sudo systemctl restart portal.service
+    ```
+
+## Common Upgrade Issues
+
+For detailed troubleshooting steps for common upgrade failure scenarios, including Admin Portal inaccessible after upgrade, broken Product and Plan sync, and user login failures, see [Troubleshooting > Upgrade Failures](/portal/troubleshooting/upgrade-failures).
diff --git a/portal/overview/concepts.mdx b/portal/overview/concepts.mdx
new file mode 100644
index 0000000000..b8a7f457ca
--- /dev/null
+++ b/portal/overview/concepts.mdx
@@ -0,0 +1,182 @@
+---
+title: "Core Concepts of Tyk Developer Portal"
+description: "Understand the fundamental concepts behind the Tyk Developer Portal, including APIs, access control, and customisation."
+keywords: "Developer Portal, Tyk"
+sidebarTitle: "Core Concepts"
+---
+
+This page provides an overview of the fundamental concepts that form the foundation of the Tyk Developer Portal. Understanding these concepts is crucial for setting up and effectively managing your portal.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/0xlJDXKrbSw" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+## Portal Structure and Roles
+
+User management in the Tyk Developer Portal provides a flexible framework for organizing both the administrators who manage the portal and the developers who consume your APIs. The portal’s hierarchical structure of organizations and teams enables fine-grained access control, collaboration, and visibility management.
+
+The Developer Portal’s user management system allows you to:
+
+- Separate API management from API consumption through distinct user types
+- Create organizational hierarchies that mirror your business relationships
+- Enable collaboration among developer teams while maintaining appropriate boundaries
+- Control access to API Products, documentation, and credentials
+- Delegate administrative responsibilities to trusted partners
+
+This comprehensive approach to user management ensures that each participant in your API ecosystem has exactly the access and capabilities they need—no more, no less.
+
+### API Consumers
+
+API Consumers are the external users who access your APIs through the Live Portal. 
+
+There are two categories of API Consumer:
+
+- **Team Members** are the individual developers who can register, browse catalogs, request access to APIs, and view details of their API consumption. They are restricted to operate within their assigned *Team*.
+- **Administrators** operate within an *Organisation* and in addition to the capabilies of *Team Members* are also user managers. They can invite new users (both team members and admins), assign users to teams within the Organisation, and delete users from the Organisation.
+
+API Consumers exist within a hierarchical structure, allowing for flexible access management:
+
+- **Teams** are groups of users who share access to specific catalogs and can collaborate on API projects. Teams provide a way to organize users within an Organisation. Users can be members of multiple Teams. **All users are members of at least one team**.
+
+- **Organisation** can contain multiple teams and can represent external companies or business units that consume your APIs. **Teams are always  members of only one Organisation**.
+
+### API Owners
+
+API Owners are the internal users who manage the publication of API Catalogs onto the Live Portal. They can configure the visual appearance of the portal, create [Catalogs, Products and Plans](/portal/overview/concepts#api-packaging-and-access-control), and manage the Organisation, Teams, and Users granted access to the Live Portal. They operate within the Admin Portal and have read-only access to the Live Portal.
+
+### Developer Portal Views
+
+When the Tyk Developer Portal is deployed, two separate views are offered depending on the type of user logging in.
+
+The **Live Portal** is the public-facing website where [API Consumers](/portal/overview/concepts#api-consumers) can:
+
+- Discover available API Products
+- Read API documentation
+- Request access to APIs
+- Manage their access credentials
+- Create and manage apps
+
+The Live Portal displays the content for a single Organisation (restricting the API Consumer's view according to their access rights).
+
+The **Admin Portal** is the private administrative view where [API Owners](/portal/overview/concepts#api-owners) can manage the content displayed in the Live Portal, approve access requests, and configure API Products.. It is also where users, Teams, and Organisation are administered.
+
+<br />
+
+<Note>
+The Live Portal will only display content visible to the Team or Teams of which the logged in API Consumer is a member.
+</Note>
+
+
+## API Packaging and Access Control
+
+### API Products
+
+An API Product is a strategic packaging of one or more APIs that delivers specific value to API Consumers. Rather than exposing individual API endpoints, API Products allow you to bundle related functionality together with appropriate documentation and access controls.
+
+For example, a "Weather API" product might combine current weather data, historical weather records, and forecast APIs into a cohesive offering that solves a specific business need.
+
+When creating an API Product, you should focus on:
+
+- Which APIs to include in the product
+- How to document the product's capabilities
+- Which business problems does the product solve
+- Who is the target audience for the product
+
+### API Plans
+
+API or Subscription Plans (usually referred to simply as Plans) define the terms under which API Consumers can access your API Products and control aspects like:
+
+- Rate limits (requests per second/minute/hour)
+- Quotas (total requests allowed in a period)
+
+Different Plans can be attached to the same API Product, allowing you to offer various service tiers (for example, free, basic, and premium)
+
+### API Catalogs
+
+Catalogs organize how API Products and Plans are presented to different audiences. They enable you to create customized views of your API offerings based on:
+
+- Visibility requirements (public or private)
+- Target audience (partners, customers, internal teams)
+- Business domains (finance, marketing, operations)
+
+With catalogs, you can:
+
+- Make some API Products visible only to specific teams
+- Offer different plans to different consumer segments
+- Create specialized marketplaces for different business units
+
+For example, you might create:
+
+- A public catalog with basic API Products for general consumers
+- A partner catalog with enhanced API Products and preferential plans
+- An internal catalog with development and testing APIs
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-catalogue-sample-set-up.png" alt="A sample catalogue set-up" />
+
+## Consumer Access Management
+
+### Consumer Apps
+
+An app serves as a container for access credentials issued to an API Consumer. Apps help organize and manage API access by:
+
+- Grouping related API access credentials together
+- Providing a context for API usage (e.g., "Mobile App", "Website Integration")
+- Enabling credential management (rotation, revocation)
+
+API Consumers can create multiple apps to organize their API usage by project or purpose, and each app can contain credentials for multiple API Products.
+
+### Access Credentials
+
+This is the unified naming for any API Keys, Tokens, or Secrets provisioned for a specific app.
+
+Access credentials are the security tokens that allow API Consumers to authenticate with your APIs. These depend upon the configuration of those APIs in the API definition managed by Tyk Dashboard and may include:
+
+- API keys
+- OAuth tokens
+- JWT tokens
+- Mutual TLS certificates
+
+The Developer Portal manages the lifecycle of these credentials, including:
+
+- Generation upon provisioning request approval
+- Secure delivery to the API Consumer
+- Rotation and revocation as needed
+
+### Provisioning Requests
+
+When an API Consumer requests access to an API Product through a specific Plan, a provisioning request is generated. This request:
+
+- Captures the consumer's intended use case
+- Records the API Product and Plan they've selected
+- Initiates an approval workflow (if required)
+- Triggers credential generation upon approval
+
+Provisioning requests can be configured to require manual approval by an API Owner or to be automatically approved based on the Plan settings.
+
+### Access Flow Types
+Access Flow Types determine how developers request access to API Products in your Developer Portal. There are two core approaches:
+
+- **Direct Access Flow (Recommended)** provides a streamlined, single-product experience where developers can immediately request access to individual APIs without cart management. This eliminates friction with fewer steps and automatic credential handling.
+
+- **Cart-Based Flow** offers a traditional shopping cart experience, allowing developers to bundle multiple API products into a single access request. This supports multi-product selection, cart review capabilities, and consolidated checkout.
+
+The choice between flows shapes your entire developer experience. Direct Access optimizes for speed and simplicity, while Cart-Based supports complex, multi-API integrations.
+## Integration
+
+### API Provider
+
+A Provider is a connection to a Tyk Dashboard instance that supplies APIs, policies, and authentication mechanisms to the Developer Portal. The Provider serves as the bridge between your API management infrastructure and the Developer Portal experience.
+
+- API Source: Providers make APIs defined in the Tyk Dashboard available for inclusion in API Products
+- Policy Management: Providers supply the access and rate limit policies used by Products and Plans
+- Credential Issuance: When developers request access to APIs, the Provider generates and manages the necessary credentials
+- Multi-Provider Support: The Developer Portal can connect to multiple Providers simultaneously, allowing you to expose APIs from different Tyk environments
+
+While the Developer Portal can connect to multiple Providers, each API Product or Plan can only be associated with a single Provider. This is because the access policies that define Products and Plans exist within a specific Provider instance.
+
+### Using Tyk Policies
+
+The Developer Portal leverages Tyk's [partitioned policies](/api-management/access-control/policies/applying-policies#partitioned-policies) in two distinct ways:
+
+- **for API Products** When creating an API Product, Tyk will associate a policy that defines only access rights to APIs, without rate limiting or quota restrictions.
+- **for Plans**: When creating a plan, Tyk will associate a policy that defines only quota and rate limiting settings, which will be applied to the APIs included in the associated API Product.
+
+This separation allows for flexible combinations of API access and usage constraints.
diff --git a/portal/overview/getting-started.mdx b/portal/overview/getting-started.mdx
new file mode 100644
index 0000000000..ab7ee5c3fa
--- /dev/null
+++ b/portal/overview/getting-started.mdx
@@ -0,0 +1,129 @@
+---
+title: "Set up the Developer Portal"
+description: "Get started quickly with setting up and using the Tyk Developer Portal."
+keywords: "Developer Portal, Tyk"
+sidebarTitle: "Set up the Portal"
+---
+
+## Introduction
+
+Once you have [installed](/portal/install#alternative-installation-methods) your Developer Portal, you'll need to connect it to a Provider (Tyk Dashboard) so that it can synchronise API Products and Subscription Plans to appear in your Catalog. You can use a single Developer Portal to publish Catalogs from multiple Providers. In this section we'll take you through the steps to connect to a single Tyk Dashboard installation.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/8KJSVACD-j4" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+## Registering the Developer Portal with Tyk Dashboard
+
+Tyk Dashboard exposes a management API with a user management system that performs fine-grained Role Based Access Control (RBAC). The Developer Portal uses this API to configure and control security policies on the Dashboard. These policies implement the Developer Portal's API Products and Plans, and are used in the creation and maintenance of access credentials for API Consumers.
+
+The Developer Portal thus needs access to the Tyk Dashboard API, so you will need to create a dedicated user on your Tyk Dashboard, following the steps indicated [here](/platform-management/dashboard-users#manage-tyk-dashboard-users).
+
+Ensure that this user has the following permissions:
+
+| Permission   | Access level |
+| :-------------- | :-------------- |
+| APIs         | Write        |
+| Certificates | Write        |
+| Keys         | Write        |
+| Policies     | Write        |
+| Analytics    | Read         |
+| Users        | Read         |
+
+### Locating the Access Credentials in Tyk Dashboard
+
+1.  Select **Users** from the **User Management** section.
+2.  In the users list, click **Edit** for the user you have created for the Developer Portal
+3.  The Secret is the **Tyk Dashboard API Access Credentials**
+4.  If required, the **Organization ID** is underneath **Reset key**
+
+ <img src="/img/2.10/user_api_id.png" alt="API key location" />
+
+
+## Configuring the Provider
+
+1. Go to the **Provider** section in the **Admin Portal**
+2. Click **Add new Provider**
+3. Add your provider details
+
+| Field           | Description                                     |
+| :----------------- | :------------------------------------------------- |
+| Name            | A local name for this Provider; Tyk Developer Portal can publish catalogs for multiple providers  |
+| URL             | The host URL for your Tyk Dashboard installation |
+| Secret          | The access credential that the Developer Portal must present when consuming the provider's management API, for example the [Tyk Dashboard API Access Credential](/portal/overview/getting-started#locating-the-access-credentials-in-tyk-dashboard) |
+| Organization ID | (optional) In some configurations, the Dashboard's [Organization Id](/portal/overview/getting-started#locating-the-access-credentials-in-tyk-dashboard) is required |
+| Policy tags     | (optional) This field can be used to synchronise only a subset of the Products and Plans present on the Provider |
+| Baseline URL    | (optional) The URL of the API Gateway that API Consumers will use to make requests to the published APIs |
+| Insecure skip verify | Check this box to ignore mTLS between the Provider and Developer Portal, often used in test environments |
+
+4. Click **Save Changes**
+
+If a tag is defined here, it needs to also be defined in the [Policy](/api-management/policies) for it to be retrieved during the [synchronization](/portal/api-provider#synchronizing-developer-portal-with-providers). If this field is left empty in the Provider configuration, then all partitioned ([access](/portal/api-products#data-distribution-and-management) and [consumption limit](/portal/api-plans#data-distribution-and-management)) policies will be imported from the Tyk instance. For API Products and Plans created on the Developer Portal, the policy tag will automatically be created for the corresponding policies created on the Tyk Dashboard.
+
+### Testing the Connection
+
+After creating the Provider in your Developer Portal you can test the connection by clicking on **Synchronize** on the **Providers** screen in the Admin Portal. This will display a confirmation message if the connection is made successfully, pulling any policies relating to Products and Plans (with the appropriate Policy tags) over to the Portal.
+
+## Create an Organizational Structure
+
+After connecting your Developer Portal to a Provider, the next step is to set up the organizational structure for your API consumers. This structure determines how external developers will access and interact with your APIs. In this guide, you'll learn how to create Organisation (Orgs), Teams, and API Consumer Admin users, which form the foundation of your Developer Portal's access control system.
+
+When the Portal was [bootstrapped](/portal/install#bootstrapping-developer-portal) a default *org* is created; this is intended to act as a backstop for any API Consumer users that have not been assigned to another *Organisation*; **we do not recommend publishing API Products and Plans in the default Organisation**.
+
+Every Org is automatically provisioned with a default *team* which, again, is intended as a backstop for any user not assigned to another team. **Note** that if you remove a User from all teams in an org, they will automatically be assigned to the default Team.
+
+### Step 1: Create an Organisation
+
+Organisation represent companies or business units that will consume your APIs. Start by creating your first Organisation:
+
+1. Log in to the Developer Portal using your API Owner credentials
+    - this will take you to the Admin Portal view
+2. Navigate to **API Consumers > Organisation**
+3. Click **Add Organisation**
+   <img src="/img/dashboard/portal-management/enterprise-portal/navigate-to-organisations.png" alt="Add a new Organisation" />
+4. Enter a *Name* for the Organisation
+    - this will only be used within the Admin Portal view to identify the org
+   <img src="/img/dashboard/portal-management/enterprise-portal/create-b2b-customer-org.png" alt="Name the new Organisation" />
+5. Click **Save Changes**
+    - note that a *default team* is automatically created within the new org
+
+### Step 2: Create a Team Within the Organisation
+
+Teams allow you to group users within an Organisation who need similar API access:
+
+1. Navigate to **API Consumers > Teams**
+2. Click **Add new team**
+3. Enter the following details:
+    - Name: A descriptive name (e.g., "Mobile Developers")
+    - Organisation: Select the org that you created in [step 1](/portal/overview/getting-started#step-1-create-an-organisation)
+4. Click **Save changes**
+5. Repeat this process to create all the teams you need within the Organisation.
+
+### Step 3: Create an API Consumer Admin User
+
+API Consumer Admin users have special privileges to manage other users within their Organisation:
+
+1. Navigate to **API Consumers > Users**
+2. Click **Add new user**
+3. Enter the user's details:
+    - First Name and Last Name
+    - Email: The user's email address (this will be their login)
+    - Select the **activate developer** checkbox
+    - Select the org that you created in [step 1](/portal/overview/getting-started#step-1-create-an-organisation)
+    - Select the Team that you created in [step 2](/portal/overview/getting-started#step-2-create-a-team-within-the-organisation)
+    - For this tutorial provide an initial password for the user
+4. Click **Save changes**
+
+## What's Next?
+
+**Congratulations**
+
+You have successfully connected your Developer Portal to your Tyk Dashboard provider and created a basic organizational structure for your Developer Portal with an API Consumer Admin user account for your client's use. Next, you probably want to add some content to the Portal for them to consume.
+
+It's time to [create your first API Catalog](/portal/publish-api-catalog).
+
+### Best Practices
+
+- **Plan your hierarchy**: Design your organizational structure before creating Orgs and Teams
+- **Use descriptive names**: Make Organisation and Team names clear and meaningful
+- **Start simple**: Begin with a basic structure and expand as needed
+- **Document your structure**: Keep a record of your Organisation, Teams, and their purposes
+- **Regular review**: Periodically review and clean up unused Organisation and Teams
diff --git a/portal/overview/intro.mdx b/portal/overview/intro.mdx
new file mode 100644
index 0000000000..691b7e8040
--- /dev/null
+++ b/portal/overview/intro.mdx
@@ -0,0 +1,83 @@
+---
+title: "Tyk Developer Portal"
+description: "Learn what the Tyk Developer Portal is, its key features, and how it supports API management."
+keywords: "Developer Portal, Tyk"
+sidebarTitle: "Introduction"
+---
+
+## Introduction
+
+The Tyk Developer Portal is a comprehensive solution designed for API providers who want to publish, monetize, and drive adoption of their APIs. It offers a flexible, full-featured CMS-like system that supports all stages of the API adoption journey, from customizing the look and feel to exposing APIs and enabling third-party developers to register and utilize your APIs.
+
+<br />
+
+<Note>
+**A note on spelling**  
+
+Throughout this documentation, we use specific spelling conventions to help distinguish between product features and general concepts:
+- Organisation (with an 's') refers specifically to the entity within the Tyk Developer Portal (sometimes abbreviated to Org)
+- Organization (with a 'z') refers to real-world businesses or the general concept of organizing
+
+This British/American English distinction helps clarify when we're discussing the Tyk Developer Portal feature versus general organizational concepts.
+</Note>
+
+
+### Key Capabilities
+
+The Developer Portal enables you to:
+
+- **Completely customize the portal's appearance** to match your brand identity
+- **Bundle related APIs into cohesive packages** that deliver specific value to consumers
+- **Provide comprehensive documentation** including OpenAPI specifications, blogs, and tutorials
+- **Segment your developer audience** through multiple Organisation and Teams
+- **Tailor API visibility** with multiple catalogs showing different offerings to different audiences
+- **Integrate with popular Identity Providers** via Dynamic Client Registration
+- **Control the developer experience** with customizable sign-up and enrollment flows
+- **Monitor API usage** with comprehensive analytics
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/UMLkTKMzGXg" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+### API Monetization with Tyk Developer Portal
+
+The Tyk Developer Portal does not include built-in billing or payment processing for monetizing APIs. However, you can implement monetization strategies through:
+
+  - Usage-based billing: The traffic logs generated by Tyk Gateway can be associated with access credentials assigned to Developer Apps, allowing for external calculation and billing based on API usage.
+  - Tiered access plans: Create different API Plans with varying usage limits and capabilities that correspond to different pricing tiers.
+  - Manual subscription management: Track subscriptions to API Plans in an external system and manually approve/revoke access based on payment status.
+
+If you require integrated API monetization, you can implement a custom integration between the Developer Portal and your billing system using the Portal's [webhook](/portal/customization/webhooks) system.
+
+## Where It Fits in the Tyk Ecosystem
+
+The Developer Portal serves as the bridge between your API infrastructure and your developer community. It serves as a central hub where API providers can publish their offerings and API consumers can discover, learn about, and access those APIs.
+
+The Developer Portal connects to one or more instances of the Tyk Dashboard (referred to as "Providers"). Each Tyk Dashboard provides access to:
+
+- API definitions that configure the Gateway to manage traffic to your upstream services
+- Security policies that define access rights and rate limits
+- Authentication mechanisms for securing API access
+
+The API owner bundles API definitions into [API Products](/portal/overview/concepts#api-products), which are then published to specific audiences in [API Catalogs](/portal/overview/concepts#api-catalogs). They create [Subscription Plans](/portal/overview/concepts#api-plans) that use security policies to control granular access, for example, gold, silver, and bronze tiers.
+
+When an API consumer discovers an API Product they want to use, they request access through the Portal via a Subscription Plan. Once approved (either automatically or by an administrator), the Developer Portal issues a provisioning request to the relevant Tyk Dashboard, which then generates the necessary access credentials (API keys, OAuth tokens, etc.).
+
+This separation between the Developer Portal and the Tyk Dashboard creates a clean distinction between:
+
+- **API Management** - how you define, secure, and monitor your APIs (handled by Tyk Dashboard)
+- **API Publishing** - how you present, document, and provide access to your APIs (handled by Developer Portal)
+
+This architecture enables you to maintain a consistent developer experience, even if your backend API infrastructure spans multiple environments or utilizes different configurations.
+
+
+## Getting Started
+
+To begin using the Tyk Developer Portal:
+
+- [Install Tyk Developer Portal](/portal/install)
+- [Connect your Portal to a Provider (Tyk Dashboard)](/portal/overview/getting-started)
+- [Create and publish a Catalog of Products and Plans](/portal/publish-api-catalog)
+- [Access an API from the Catalog](/portal/request-access)
+
+## Getting Access
+
+The Tyk Developer Portal is a licensed product. If you're interested in getting access, [contact our team](https://tyk.io/contact/) to obtain a license or get self-managed trial license by completing the registration on our [website](https://tyk.io/self-managed-trial/).
\ No newline at end of file
diff --git a/portal/publish-api-catalog.mdx b/portal/publish-api-catalog.mdx
new file mode 100644
index 0000000000..9a4de92676
--- /dev/null
+++ b/portal/publish-api-catalog.mdx
@@ -0,0 +1,117 @@
+---
+title: "Publish your first API Catalog"
+description: "Build an API Catalog on the Tyk Developer Portal."
+keywords: "Developer Portal, Tyk, Getting Started"
+sidebarTitle: "Publish an API Catalog"
+---
+
+## Introduction
+
+After installing your Developer Portal and configuring your organizational structure, the next step is to create an API catalog with products and plans. This is where you'll package your APIs into consumable products and define how developers can access them.
+
+In this guide, you'll learn how to create a catalog, add API products, and define access plans - the essential components that enable developers to discover and consume your APIs.
+
+### Prerequisites
+
+Before you begin, ensure you have:
+
+- [Installed](/portal/install) the Developer Portal
+- [Connected](/portal/overview/getting-started#configuring-the-provider) to a Provider (Tyk Dashboard)
+- [Configured](/portal/overview/getting-started#create-an-organizational-structure) at least one Organisation and Team
+- [Created](/getting-started/configure-first-api#set-up-your-api) at least one API in Tyk Dashboard that you will make available to your API consumers, for this tutorial we assume this is secured with the [Auth Token](/api-management/authentication/bearer-token) authentication method
+
+## Step 1: Create the API Catalog
+
+[Catalogs](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues) determine which API products and plans are visible to different developer audiences. You'll need to create a catalog and then later you'll create content to publish to its audience.
+
+1. Log in to the Developer Portal using your API Owner credentials
+    - this will take you to the Admin Portal view, Navigate to Catalogs
+2. Navigate to **Developer Portal > Catalogues**
+  <img src="/img/dashboard/portal-management/enterprise-portal/navigate-to-catalogues.png" alt="Navigate the to catalogues menu" />
+3. Click **Add new catalogue**
+  <img src="/img/dashboard/portal-management/enterprise-portal/specify-name-of-catalogue.png" alt="Create a catalogue" />
+4. Enter the following details:
+    - Name: A descriptive name (e.g., "First APIs")
+    - Path URL: select **Sync URL with Name** to auto-complete this field
+    - Visibility: Choose **Private** from the drop-down to restrict access only to selected audience
+    - Audience: Select the team you created [previously](/portal/overview/getting-started#step-2-create-a-team-within-the-organisation)
+    - Catalogue content: Leave this blank for now, as we don't have any API Products or Plans to publish
+5. Click **Save Changes**
+
+
+## Step 2: Create an API Product
+
+[API Products](/portal/api-products) bundle one or more APIs into a package that delivers value to developers. When you create an API Product in the Developer Portal, a corresponding [access policy](/api-management/access-control/policies/applying-policies#partitioned-policies) will be created in the Tyk Dashboard (Provider) that configures the access controls that will be applied to API Consumer access credentials created from the Product.
+
+1. Navigate to **Developer Portal > API Products**
+2. Click **Add new API Product**
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-add-api-product.png" alt="Add an API Product" />
+3. On the **Details** tab enter the basic product information:
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-product-details.png" alt="Configure API Product details" />
+    - Product name: A unique product name (e.g., "Test product") which will be used by the Provider (Tyk Dashboard) when naming the access policy
+    - Catalogue display name: (optional) Descriptive name that will be used on the Live Portal
+    - Description: (optional) A short summary of the product to engage API consumers
+    - Publish API product to catalogue: Select the catalog you created [previously](/portal/publish-api-catalog#step-1-create-the-api-catalog)
+    - you can leave the other fields empty for now
+4. On the **APIs** tab identify which APIs should be accessible via this Product:
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-product-apis.png" alt="Add APIs" />
+    - Choose a provider: Select your provider from the dropdown
+    - Choose Authentication method: Select the **Authentication Token** option from the dropdown (or the appropriate [authentication method](/api-management/client-authentication) you've used for your API created in Tyk Dashboard)
+    - Select APIs: Choose at least one API (REST or GraphQL) to include in the Product
+5. On the **Documentation** tab optionally upload documentation for the API(s) included in the Product:
+    - REST APIs: Upload an OpenAPI (Swagger) file in JSON or YAML format
+    - GraphQL APIs: Upload a GraphQL SDL file (in .graphql, .graphqls, .gql, or JSON format)
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-product-api-specs.png" alt="Add API Specifications" />
+6. On the **"Getting Started" guides** tab, optionally create Product Guides
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-product-guides.png" alt="Add Product Guides" />
+7. Click **Save Changes**
+
+
+## Step 3: Create an API Plan
+
+[Plans](/portal/api-plans) define the terms under which developers can access your API products. When you create an API Plan in the Developer Portal, a corresponding [limits policy](/api-management/access-control/policies/applying-policies#partitioned-policies) will be created in the Tyk Dashboard (Provider) that configures quotas and rate limits that will be applied to API Consumer access credentials created from the Plan.
+
+1. Navigate to **Developer Portal > Plans**
+2. Click **Add new Plan**
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-add-plan.png" alt="Add a Plan" />
+3. Enter the basic plan information:
+    - Provider: Select your provider from the dropdown
+    - Plan name: A unique plan name (e.g., "Free tier") which will be used by the Provider (Tyk Dashboard) when naming the access policy
+    - Catalogue display name: (optional) Descriptive name that will be used on the Live Portal
+    - Plan description: (optional) A short summary of the plan that will be displayed in the Live Portal
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-plan-details.png" alt="Add Plan Details" />
+4. Configure the consumption rules (limits) that will be applied to Developer Apps using the plan:
+    - Usage quota: Set a total volume of requests that an App will be permitted to make in a time period, for example 25 requests per hour 
+    - Rate limit: Set a maximum frequency of requests that an App will be permitted to make, for example 3 requests per 10 seconds
+    - Key expires after: for this tutorial leave this as **Key never expires**
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-plan-limits.png" alt="Add Plan Limits" />
+5. For this tutorial, select **Auto approve access request**
+6. In the **Accessible in the following catalogues** dropdown, select the catalog you created [previously](/portal/publish-api-catalog#step-1-create-the-api-catalog)
+6. Click **Save Changes**
+
+
+## Step 4: Verify the Catalog
+
+You can now go back to your Catalog to check that the API Product and Plan have been successfully added, ready for your API Consumers to gain access to your service.
+
+1. Navigate to **Developer Portal > Catalogue**
+2. Select the Catalog that you created [previously](/portal/publish-api-catalog#step-1-create-the-api-catalog)
+3. Find the **Catalogue content** section and confirm that your Product and Plan are listed
+4. Click **Cancel** or **Save Changes**
+
+
+## What's Next?
+
+**Congratulations**
+
+You have successfully created an API Product and a Plan and included them in a private Catalog that will only be available to a selected audience in your Developer Portal. Now you're ready to experience the API Consumer side.
+
+It's time to [create your first Developer App](/portal/request-access).
+
+### Best Practices
+
+- **Start simple**: Begin with one catalog, a few products, and basic plans
+- **Use clear naming**: Make product and plan names descriptive and intuitive
+- **Provide complete documentation**: Include comprehensive API documentation for each product
+- **Test the developer experience**: Go through the subscription process as a developer would
+- **Gather feedback**: Ask test users about the clarity and usability of your catalog
diff --git a/portal/request-access.mdx b/portal/request-access.mdx
new file mode 100644
index 0000000000..2f2f118228
--- /dev/null
+++ b/portal/request-access.mdx
@@ -0,0 +1,126 @@
+---
+title: "Request access to an API"
+description: "Create aa App to consume a Product published on the Tyk Developer Portal."
+keywords: "Developer Portal, Tyk, Getting Started"
+sidebarTitle: "Request access to an API"
+---
+
+## Introduction
+
+After setting up your Developer Portal with Organisation, Catalogs, API products, and Plans, it's time to experience the portal from an API Consumer's perspective. In this guide, you'll learn how to log in as an API Consumer, create an application, request API access, and test the API with the provided credentials.
+
+This workflow represents the typical experience your API consumers will have when using your Developer Portal to access your APIs.
+
+### Prerequisites
+
+Before you begin, ensure you have:
+
+- [Installed](/portal/install) the Developer Portal
+- [Connected](/portal/overview/getting-started#configuring-the-provider) to a Provider (Tyk Dashboard)
+- [Configured](/portal/overview/getting-started#create-an-organizational-structure) at least one Organisation and Team
+- [Created](/portal/overview/getting-started#step-3-create-an-api-consumer-admin-user) an API Consumer Admin user
+- [Published](/portal/publish-api-catalog) an API Catalog with at least one API Product and Plan
+
+## Step 1: Log in as an API Consumer
+
+First, access the Developer Portal as an API consumer:
+
+1. Open your Developer Portal's public URL in a web browser
+2. Select **Log In** in the top navigation bar
+3. Enter the email address and password for the API consumer admin user you created [previously](/portal/overview/getting-started#step-3-create-an-api-consumer-admin-user)
+4. Select **Log In**
+
+You should now be logged in to the Live Portal as an API consumer. You'll see the *default theme* provided by Tyk, all of which is [customisable](/portal/customization) for your brand and workflows.
+
+## Step 2: Browse the API Catalog
+
+Next, explore the catalog to find the API product you want to use:
+
+1. Navigate to **Catalogues** in the main navigation
+    - In this tutorial there is only one Catalog, containing a single API Product
+2. Select the API Product you created [previously](/portal/publish-api-catalog#step-2-create-an-api-product)
+    - Note that the Authentication requirements are shown in the Catalog view
+3. You can now view the details from the perspective of an API Consumer:
+    - Product description
+    - APIs to which the Product grants access 
+    - The subscription plans available to you, including their rate limits and quotas
+    - API documentation and Getting Started guides (if you created any)
+
+## Step 3: Create a Developer App
+
+You need to create a [Developer App](/portal/developer-app) to contain your API credentials for any API Products to which you are granted access.
+
+1. Hover over your user name in the main navigation and choose **My Dashboard** from the dropdown menu
+2. Navigate to **My Apps** in the left hand navigation
+3. Select **Create New App**
+4. Enter the following details:
+    - App name: A descriptive name (e.g., "Weather Dashboard")
+    - Description: What the app will do with the API
+    - Visibility: select **Personal** so that the access credentials are not visible to other users in your Org
+    - Redirect URL: leave blank, as we're using Auth Token
+5. Select **Create App**
+6. You will be shown a read-only summary of the App's details; if you want to make changes simply select **Edit details**
+7. Select **Back to Apps overview** to return to your *My Apps* list
+
+## Step 4: Request API Access
+
+Now, we will request access to the API product through your app.
+
+1. Return to the API product page in the catalog, which we did in [Step 2](/portal/request-access#step-2-browse-the-api-catalog).
+2. Select **Access with this plan**
+3. Select **Go to cart**
+4. You are now on the access request form where you can see the API Product and Plan that you've selected. If granted access for this combination, you will be issued access credentials to use in your API requests. These must be associated with a Developer App. We just created an App, so select **Existing app** and choose your App from the dropdown
+5. Select **Submit request**
+
+
+## Step 5: View Your API Access Credentials
+
+When we [created](/portal/publish-api-catalog#step-3-create-an-api-plan) the Plan, we configured it to automatically approve access requests, so Tyk will have created access credentials immediately. If we hadn't selected auto-approve, the request would appear in the Admin Portal for an API Owner to approve.
+
+Let's find the access credentials so that we can start to consume the API:
+
+1. Hover over your user name in the main navigation and choose **My Dashboard** from the dropdown menu
+2. Navigate to **My Apps** in the left hand navigation
+3. Select the app you created [previously](/portal/request-access#step-3-create-a-developer-app)
+4. In the API Credentials section, you'll see your access credentials
+    - Click Show to reveal the API key
+    - Copy the credentials for use in step 6
+
+## Step 6: Test the API
+
+Finally, let's use your credentials to make a test API request:
+
+**REST APIs**
+1. Navigate to the API Product details page, either from the App details or Catalog
+2. You can see the *listen path* for the API and, if you provided API documentation when creating the Product, may have more detail of the available endpoints
+3. Open a terminal or API testing tool (like Postman or cURL)
+4. Construct your API request using the access credentials issued in [Step 5](/portal/request-access#step-5-view-your-api-access-credentials)
+    - For example, with cURL:
+
+    ```
+    curl -X GET "https://your-api-gateway.com/your-api-path" \
+      -H "Authorization: Bearer YOUR_API_KEY" \
+      -H "Content-Type: application/json"
+    ```
+5. Send the request and verify that you receive a successful response
+
+**GraphQL APIs**
+If your API Product contains a GraphQL API and you provided a valid GraphQL server URL, you can test it interactively using the built-in GraphQL Playground in the Developer Portal.
+
+
+## Troubleshooting
+
+If you encounter issues when testing the API:
+
+- Authentication Errors: Verify that you're including the correct API key and using the proper authentication method
+- Rate Limit Exceeded: Check if you've exceeded the rate limits defined in your plan
+- Access Denied: Ensure your access request has been approved
+- Endpoint Not Found: Confirm you're using the correct API endpoint URL
+
+## What's Next?
+
+**Congratulations**
+
+You have successfully created a Developer App, requested access to an API Product and accessed an API using the credentials issued by the Developer Portal. This concludes the Getting Started tutorial for Tyk Developer Portal!
+
+Check out the rest of the documentation for more details on each of the elements we've used in the tutorial and full guidance on how to customise Tyk Developer Portal to give your API consumers the best possible experience.
diff --git a/portal/resource-migration.mdx b/portal/resource-migration.mdx
new file mode 100644
index 0000000000..49d66a61c1
--- /dev/null
+++ b/portal/resource-migration.mdx
@@ -0,0 +1,289 @@
+---
+title: "Migrate Resources Between Environments"
+description: "Learn how to migrate resources between environments in the Tyk Enterprise Developer Portal."
+keywords: "Tyk Developer Portal, Enterprise Portal, Email, Notifications"
+sidebarTitle: "Resource Migration"
+---
+
+## Migrate Resources Between Environments
+
+This guide explains how to migrate Developer Portal resources (API Products, Plans, Tutorials etc.)  between different portal environments. 
+
+This capability was made possible with introduction of [Custom IDs](#custom-ids-in-developer-portal) (more on this later) in v1.13.
+
+## Prerequisites
+
+Before you begin, make sure the following are true:
+
+- Your Tyk Developer Portal version is 1.13 or later.
+- All resources in your source environment have **Custom IDs** (CIDs) assigned. Resources created after version 1.13 automatically include a CID, while resources from earlier versions receive CIDs through the portal's startup process.
+- You have admin access to both the source and target environments.
+
+## Custom IDs in Developer Portal
+
+Starting with Portal 1.13, we introduced **Custom IDs (CIDs)** - additional persistent identifiers that work alongside database IDs to provide stable references across environments and recreations. While database IDs remain the primary internal identifiers, CIDs provide a reliable way to track and maintain relationships between resources across different environments.
+
+### The Role of Database IDs and CIDs
+
+Resources in the Tyk Developer Portal use both types of identifiers:
+- **Database IDs**: Primary internal identifiers that are automatically generated and managed by the database.
+- **Custom IDs (CIDs)**: Additional stable identifiers that remain consistent across environments.
+
+### The Problem with Database-Generated IDs
+
+Before Portal 1.13, resources were identified solely by database-generated IDs. While this worked for single-environment setups, it caused challenges when:
+- Migrating resources between environments.
+- Recreating or restoring resources.
+- Maintaining relationships between connected resources.
+
+For example, if you recreated an API product that was linked to a plan, the product would receive a new database ID. This would break the connection between the product and plan, requiring manual intervention to fix the relationship.
+
+### Benefits of Custom IDs (CIDs)
+
+Custom IDs solve these problems by providing:
+
+- Persistent identification across environments.
+- Stable reference points for resource relationships.
+- Reliable migration and synchronization capabilities.
+
+Resources that now support CIDs include:
+
+- OAuth Providers and Client Types
+- Products, Plans, Tutorials, and OAS Documents
+- Organisations and Teams
+- Pages and Content Blocks
+
+These resources are now easily transferable between environments, with their relationships preserved via CIDs, ensuring smooth migrations and consistent management.
+
+### Automatic CID Assignment
+
+When upgrading to Tyk Portal 1.13 from an earlier version, the portal automatically runs a **background process** to assign CIDs to resources created in previous versions. This process also runs every time the portal starts, ensuring any new resources without CIDs are retroactively assigned one, whether after an upgrade or a fresh installation.
+
+You can fetch a specific organisation using either its database ID or CID. For example, to fetch the "foo" organisation:
+
+**Using database ID:**
+```bash
+curl -X GET 'http://localhost:3001/portal-api/organisations/27' \
+  -H "Authorization: ${TOKEN}" \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json'
+```
+
+**Using CID (recommended):**
+```bash
+curl -X GET 'http://localhost:3001/portal-api/organisations/2sG5umt8rGHMiwjcgaHXxwExt8O' \
+  -H "Authorization: ${TOKEN}" \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json'
+```
+
+While both methods work, using CIDs is recommended as they remain consistent across environments.
+
+
+## Step-by-Step Instructions
+
+In this guide, we'll walk through the process of migrating selected organisations and their teams from one environment (Environment A) to another (Environment B). This involves exporting data from the source environment and importing it into the target environment.
+
+<br />
+
+<Note>
+This guide only migrates the `Organization` and `Teams` resources from the developer portal; the same process must be repeated for other resources.
+</Note>
+
+
+### Example Scenario
+- **Source**: Environment A at `https://portal-env-a.example.com`
+- **Target**: Environment B at `https://portal-env-b.example.com`
+- **Goal**: Migrate organisations and their associated teams
+
+### Setting Up Environment Variables
+
+Before running the migration scripts, you'll need to set up authentication tokens for both environments. You can find these tokens in the Developer Portal UI:
+
+1. Log in to the Developer Portal as an admin
+2. Click on your user profile in the top right corner
+3. Copy **API credential**
+
+```bash
+# For Environment A (source)
+export ENV_A_TOKEN="your-source-environment-token"
+
+# For Environment B (target)
+export ENV_B_TOKEN="your-target-environment-token"
+```
+
+### Export Organisations from Environment A
+
+To start, you'll want to gather the relevant data from Environment A. This ensures you have everything you need for a smooth migration. The data is saved into a JSON file, making it easy to handle during the import process.
+
+Here's an example of how you can export organisations from Environment A:
+
+```bash
+# Fetch organisations from Environment A
+response=$(curl -s -H "Authorization: ${ENV_A_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -H "Accept: application/json" \
+  "https://portal-env-a.example.com/organisations?page=1&per_page=50")
+
+# Process each organisation
+echo "$response" | jq -c '.[] | select(.Name != "Default Organisation") | del(.ID, .CreatedAt, .UpdatedAt, .Teams)' > data/organisations.json
+```
+
+### Export Teams from Environment A
+
+After exporting organisations, the next step is to export the teams associated with each organisation. We exclude default teams since these are created automatically by the portal, and dealing with them could lead to conflicts. The data is saved into JSON files for structured storage and easy access during the import process.
+
+Here's an example of how you can export teams from Environment A:
+
+```bash
+# Read each organisation and fetch its teams
+while IFS= read -r org; do
+  org_cid=$(echo "$org" | jq -r '.CID')
+  echo "Fetching teams for organisation CID: $org_cid..."
+
+  # Fetch teams for the organisation
+  teams_response=$(curl -s -H "Authorization: ${ENV_A_TOKEN}" \
+    -H "Content-Type: application/json" \
+    -H "Accept: application/json" \
+    "https://portal-env-a.example.com/organisations/$org_cid/teams?page=1&per_page=50")
+
+  # Process each team
+  echo "$teams_response" | jq -c '.[] | select(.Name | endswith("All users") | not) | del(.Users)' > "data/teams_${org_cid}.json"
+done < data/organisations.json
+```
+
+### Import Organisations to Environment B
+
+Now, let's move those organisations into Environment B, one by one. The goal here is to recreate the organisational structure in Environment B accurately. By using the JSON files, you ensure that each organisation is imported correctly, keeping the relationships intact from Environment A.
+
+Here's an example of how you can import organisations into Environment B:
+
+```bash
+# Read each organisation and import it
+while IFS= read -r org; do
+  org_cid=$(echo "$org" | jq -r '.CID')
+  echo "Importing organisation CID: $org_cid..."
+
+  # Import the organisation
+  curl -s -o /dev/null -w "%{http_code}" -X POST \
+    -H "Authorization: ${ENV_B_TOKEN}" \
+    -H "Content-Type: application/json" \
+    -H "Accept: application/json" \
+    -d "$org" "https://portal-env-b.example.com/organisations"
+done < data/organisations.json
+```
+
+### Import Teams to Environment B
+
+After importing organisations, the next step is to import the teams associated with each organisation. This ensures that the organisational structure is accurately recreated in Environment B.
+
+Here's an example of how you can import teams into Environment B:
+
+```bash
+# Read each team file and import the teams
+for file in data/teams_*.json; do
+  [[ -e "$file" ]] || continue
+  while IFS= read -r team; do
+    org_cid=$(basename "$file" | sed 's/teams_\(.*\)\.json/\1/')
+    team_cid=$(echo "$team" | jq -r '.CID')
+    echo "Importing team CID: $team_cid for organisation CID: $org_cid..."
+
+    # Import the team
+    curl -s -o /dev/null -w "%{http_code}" -X POST \
+      -H "Authorization: ${ENV_B_TOKEN}" \
+      -H "Content-Type: application/json" \
+      -H "Accept: application/json" \
+      -d "$team" "https://portal-env-b.example.com/organisations/$org_cid/teams"
+  done < "$file"
+done
+```
+
+### Verify the Migration
+
+After completing the migration, follow these steps to verify that everything was imported correctly:
+
+1. **Compare Organisation Counts**
+   - Check that the number of organisations in Environment B matches what you exported from Environment A
+   - Verify that each organisation's details (name, status, etc.) are correct
+
+2. **Verify Team Structure**
+   - Ensure all teams were created under their correct organisations
+   - Check that team configurations (permissions, settings) were preserved
+
+Example of verification script:
+
+```bash
+#!/bin/bash
+
+# Track total number of mismatches found
+errors=0
+echo "Starting verification..."
+
+# === Organisation Verification ===
+echo "Checking organisations..."
+
+# Get organisations from source data file
+# Format: "CID Name" for each organisation, sorted for comparison
+source_orgs=$(jq -r '.[] | .CID + " " + .Name' data/organisations.json | sort)
+
+# Get organisations from target environment via API
+# Exclude default organisation and format same as source
+target_orgs=$(curl -s -H "Authorization: ${ENV_B_TOKEN}" \
+  -H "Accept: application/json" \
+  "https://portal-env-b.example.com/organisations" | \
+  jq -r '.[] | select(.Name != "Default Organisation") | .CID + " " + .Name' | sort)
+
+# Compare organisation lists
+# diff will show: < for missing in target, > for extra in target
+if [ "$source_orgs" != "$target_orgs" ]; then
+    echo "❌ Organisation mismatch!"
+    diff <(echo "$source_orgs") <(echo "$target_orgs") || true
+    ((errors++))
+else
+    echo "✅ Organisations match"
+fi
+
+# === Team Verification ===
+echo -e "\nChecking teams..."
+
+# Iterate through each organisation to check its teams
+while IFS= read -r org; do
+    # Split organisation line into CID and Name
+    org_cid=$(echo "$org" | cut -d' ' -f1)
+    org_name=$(echo "$org" | cut -d' ' -f2-)
+    
+    # Get teams from source data file for this organisation
+    source_teams=$(jq -r '.[] | .Name' "data/teams_${org_cid}.json" | sort)
+
+    # Get teams from target environment for this organisation
+    # Exclude auto-generated "All users" teams
+    target_teams=$(curl -s -H "Authorization: ${ENV_B_TOKEN}" \
+      -H "Accept: application/json" \
+      "https://portal-env-b.example.com/organisations/$org_cid/teams" | \
+      jq -r '.[] | select(.Name | endswith("All users") | not) | .Name' | sort)
+
+    # Compare team lists for this organisation
+    if [ "$source_teams" != "$target_teams" ]; then
+        echo "❌ Team mismatch in '$org_name'"
+        diff <(echo "$source_teams") <(echo "$target_teams") || true
+        ((errors++))
+    else
+        echo "✅ Teams match in '$org_name'"
+    fi
+done <<< "$source_orgs"
+
+# === Final Status ===
+# Exit with appropriate code: 0 for success, 1 for any errors
+if [ $errors -eq 0 ]; then
+    echo -e "\n✅ SUCCESS: Migration verified"
+    exit 0
+else
+    echo -e "\n❌ FAILURE: Found $errors error(s)"
+    exit 1
+fi
+```
+
+If you find any discrepancies, you may need to:
+- Review the migration logs
+- Re-run the import for specific resources
+a
\ No newline at end of file
diff --git a/portal/troubleshooting/cors-issues.mdx b/portal/troubleshooting/cors-issues.mdx
new file mode 100644
index 0000000000..3496aaaa8f
--- /dev/null
+++ b/portal/troubleshooting/cors-issues.mdx
@@ -0,0 +1,117 @@
+---
+title: "Troubleshoot CORS Issues in Developer Portal"
+sidebarTitle: "CORS Issues"
+description: "Diagnose and fix CORS errors in the Tyk Developer Portal and API Playground."
+keywords: "CORS, troubleshooting, Access-Control-Allow-Origin, API Playground, PORTAL_CORS_ENABLE,"
+---
+
+Cross-origin errors in the Developer Portal arise from two independent layers: the Portal application itself and the Tyk Gateway APIs that the API Playground calls directly. Identify which layer is failing before applying a fix.
+
+<AccordionGroup>
+  <Accordion title="Access-Control-Allow-Origin header missing from Portal responses">
+    **Symptom**
+
+    Requests from your application to the Portal Admin API or Live Portal routes fail. The browser console shows:
+
+    ```
+    Access to fetch at 'https://portal.example.com/...' from origin 'https://app.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
+    ```
+
+    Preflight `OPTIONS` requests to the Portal return `404 Not Found` or `405 Method Not Allowed`.
+
+    **Cause**
+
+    [PORTAL_CORS_ENABLE](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_enable) is `false` (the default). The Portal's CORS middleware is disabled, so no `Access-Control-Allow-Origin` header is added to any response and `OPTIONS` preflight requests fall through to the router with no matching handler.
+
+    **Fix**
+
+    Enable Portal CORS and set your allowed origins. See [Configure Portal Application CORS](/portal/how-to-guides/configure-cors#configure-portal-application-cors).
+  </Accordion>
+
+  <Accordion title="API Playground requests fail with 401 Unauthorized or missing CORS headers">
+    **Symptom**
+
+    Test requests in the API Playground fail. The browser console shows one of:
+
+    - `401 Unauthorized` on the `OPTIONS` preflight request
+    - `Access to fetch at 'https://api.example.com/...' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.`
+
+    **Cause**
+
+    The API definition in Tyk Gateway has CORS misconfigured:
+
+    - **CORS disabled entirely**: The Gateway routes the `OPTIONS` preflight through the authentication middleware. Because preflight requests carry no `Authorization` header, the Gateway rejects them with `401 Unauthorized`.
+    - **CORS enabled but Portal origin not in the allowed list**: The Gateway intercepts the preflight and returns `200 OK`, but omits the `Access-Control-Allow-Origin` header because the Portal's origin does not match `allowed_origins`. The browser treats this as a CORS failure.
+
+    **Fix**
+
+    Configure CORS on the API definition and add your Portal URL to the allowed origins. See [Configure Gateway CORS for APIs](/portal/how-to-guides/configure-cors#configure-gateway-cors-for-apis).
+  </Accordion>
+
+  <Accordion title="403 Forbidden on OPTIONS preflight in Gateway v5.8.6–v5.8.13">
+    **Symptom**
+
+    API Playground requests fail on Gateway versions v5.8.6 through v5.8.13, even when CORS is correctly configured and the Portal origin is in `allowed_origins`. The browser console shows:
+
+    ```
+    TypeError: Failed to fetch
+    ```
+
+    The `OPTIONS` preflight returns `403 Forbidden` with one of the following response bodies:
+
+    ```json
+    {"error": "Requested endpoint is forbidden"}
+    ```
+
+    ```json
+    {"error": "Access to this API has been disallowed"}
+    ```
+
+    **Cause**
+
+    A middleware ordering regression in Gateway versions v5.8.6–v5.8.13 caused the allow-list middleware (`VersionCheck`) to run before the CORS middleware. The allow-list evaluates the `OPTIONS` method against endpoint rules and returns `403 Forbidden` before the CORS middleware can intercept and handle the preflight.
+
+    **Fix**
+
+    Upgrade Tyk Gateway to v5.8.14 or later, where the middleware ordering is corrected.
+  </Accordion>
+
+  <Accordion title="CORS error: wildcard origin rejected when credentials are enabled">
+    **Symptom**
+
+    Credentialed cross-origin requests to the Portal fail. The browser console shows:
+
+    ```
+    The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
+    ```
+
+    **Cause**
+
+    [PORTAL_CORS_ALLOW_CREDENTIALS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_allow_credentials)=true is set alongside an unset or wildcard [PORTAL_CORS_ALLOWED_ORIGINS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_allowed_origins). When `PORTAL_CORS_ALLOWED_ORIGINS` is unset or set to `*`, the Portal responds with `Access-Control-Allow-Origin: *`. The CORS specification forbids combining a wildcard origin with `Access-Control-Allow-Credentials: true`, so the browser rejects the response.
+
+    **Fix**
+
+    Set [PORTAL_CORS_ALLOWED_ORIGINS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_cors_allowed_origins) to specific origins or to `http://*,https://*` to allow all. Both prevent the wildcard `*` response that browsers block when credentials are in use:
+
+    ```ini
+    # Restrict to specific origins
+    PORTAL_CORS_ALLOWED_ORIGINS=https://admin.example.com,https://app.example.com
+    PORTAL_CORS_ALLOW_CREDENTIALS=true
+    ```
+
+    ```ini
+    # Allow all origins
+    PORTAL_CORS_ALLOWED_ORIGINS=http://*,https://*
+    PORTAL_CORS_ALLOW_CREDENTIALS=true
+    ```
+
+    See [Configure Portal Application CORS](/portal/how-to-guides/configure-cors#configure-portal-application-cors).
+  </Accordion>
+</AccordionGroup>
+
+---
+
+## Related
+
+- [Configure CORS](/portal/how-to-guides/configure-cors) — set up Portal application CORS and Gateway API CORS
+- [Portal configuration reference](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) — full list of Portal environment variables
diff --git a/portal/troubleshooting/kubernetes-bootstrap-failures.mdx b/portal/troubleshooting/kubernetes-bootstrap-failures.mdx
new file mode 100644
index 0000000000..0526a7ba5b
--- /dev/null
+++ b/portal/troubleshooting/kubernetes-bootstrap-failures.mdx
@@ -0,0 +1,133 @@
+---
+title: "Kubernetes Bootstrap Failures"
+description: "Troubleshoot Helm bootstrap job failures, pod crash-loops, and inaccessible Admin UI after deploying the Tyk Developer Portal on Kubernetes."
+---
+
+This page covers common failures when deploying the Tyk Developer Portal on Kubernetes. For installation steps and configuration, see [Install Developer Portal on Kubernetes](/portal/install/kubernetes).
+
+## Bootstrap Job Fails: Pod Security Standards Violation
+
+**Symptom:** `helm install` completes but the bootstrap job fails with a security policy error, for example:
+
+```
+Error creating: pods "dev-portal-job-..." is forbidden: violates PodSecurity "restricted:latest"
+```
+
+**Cause:** The bootstrap job runs as root and does not support security context configuration via `values.yaml`. Clusters enforcing the Kubernetes PSS [Restricted](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) or [Baseline](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline) profiles will reject it.
+
+**Fix:** Disable the automatic bootstrap job and bootstrap the portal manually:
+
+1. Set `global.components.bootstrap: false` in your `values.yaml` and run `helm upgrade`.
+2. Wait for the Portal pod to be ready:
+   ```bash
+   kubectl rollout status deployment/tyk-dev-portal -n <namespace>
+   ```
+3. Send the bootstrap request to create the bootstrap admin user:
+   ```bash
+   curl -X POST http://<portal-service>:<port>/portal-api/bootstrap \
+     -H "Content-Type: application/json" \
+     -d '{
+       "username": "admin@example.com",
+       "password": "your-password",
+       "first_name": "Admin",
+       "last_name": "User"
+     }'
+   ```
+
+Once the call succeeds, the Portal shuts down the temporary bootstrap server and completes startup.
+
+<Note>
+This is a known limitation in the Helm chart. The bootstrap job template does not yet support security context configuration. Use `global.components.bootstrap: false` and bootstrap manually as described above.
+</Note>
+
+## Portal Pod Crash-Looping
+
+**Symptom:** The Portal pod restarts repeatedly. Inspect the pod state and logs:
+
+```bash
+kubectl get pods -n <namespace>
+kubectl describe pod <pod-name> -n <namespace>
+kubectl logs <pod-name> -n <namespace> --previous
+```
+
+### Probe Timeouts: Pod Killed Before Startup Completes
+
+**Symptom:** Kubernetes terminates the pod before it finishes starting. Logs show:
+
+```
+Readiness probe failed: HTTP probe failed with statuscode: 503
+Liveness probe failed: HTTP probe failed with statuscode: 503
+```
+
+**Cause:** The Portal's `/ready` endpoint performs a live database ping on every probe check. Short-lived database latency (TLS handshake overhead or connection pool delays) can cause the probe to time out, triggering Kubernetes to restart the pod before it has fully initialized.
+
+**Fix:** Increase the probe delays and thresholds in your `values.yaml`:
+
+```yaml
+livenessProbe:
+  initialDelaySeconds: 120
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+readinessProbe:
+  initialDelaySeconds: 120
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+```
+
+If the Portal connects to a database over a high-latency or TLS-secured link, increase `initialDelaySeconds` further (e.g., `300`).
+
+### PostgreSQL Date Format Mismatch
+
+**Symptom:** The pod enters `CrashLoopBackOff` immediately after starting, even though the database is reachable. Logs contain:
+
+```
+{"level":"fatal","message":"checking if bootstrapped: recovering config: convert field 1 failed: parsing time \"15-JAN-26 13:58:19.626098 +05:30\" as \"2006-01-02 15:04:05.999999999Z07:00\""}
+```
+
+**Cause:** The date format returned by the PostgreSQL server does not match the ISO format that the Portal expects. This occurs when the PostgreSQL `DateStyle` is not set to ISO.
+
+**Fix:** Append `datestyle` and `lc_time` options to your `database.connectionString` in `values.yaml`.
+
+For a DSN-format connection string:
+```
+host=<host> user=<user> password=<pass> dbname=<db> port=5432 sslmode=disable options=-c datestyle=ISO,MDY -c lc_time=C
+```
+
+For a URL-format connection string:
+```
+postgres://<user>:<pass>@<host>:5432/<db>?options=-c%20datestyle%3DISO%2CMDY%20-c%20lc_time%3DC
+```
+
+### License Key Not Set
+
+If the Portal is started without a valid Tyk license, it logs the following at startup:
+
+| Log message | Meaning |
+|---|---|
+| `Initializing license: license is empty` | `license` field is missing or empty in `values.yaml` |
+| `Initializing license: token not valid` | License key is set but malformed or expired |
+| `Licensing: license is invalid` | Periodic background check; license failed validation |
+
+**Fix:** Set the `license` field in your `values.yaml`. If using a Kubernetes secret, confirm the secret contains a `DevPortalLicense` key and that `useSecretName` references it:
+
+```bash
+kubectl get secret <secret-name> -n <namespace> -o jsonpath='{.data.DevPortalLicense}' | base64 -d
+```
+
+### Environment Variables Not Taking Effect
+
+**Symptom:** Configuration set via `extraEnvs` (such as `PORTAL_STORAGE` or `PORTAL_DATABASE_DIALECT`) is not reflected at runtime. The Portal continues using previous values.
+
+**Cause:** The Helm chart generates environment variables for certain fields (including storage type and database dialect) from its own templated values. Variables passed through `extraEnvs` may be overridden by these chart-generated values.
+
+**Fix:** Use the chart's native fields in `values.yaml` instead of `extraEnvs` for these settings:
+
+| Instead of `extraEnvs` | Use directly in `values.yaml` |
+|---|---|
+| `PORTAL_STORAGE=db` | `storage.type: db` |
+| `PORTAL_DATABASE_DIALECT=postgres` | `database.dialect: postgres` |
+
+Reserve `extraEnvs` for configuration options that have no direct Helm chart equivalent.
diff --git a/portal/troubleshooting/upgrade-failures.mdx b/portal/troubleshooting/upgrade-failures.mdx
new file mode 100644
index 0000000000..f198176fff
--- /dev/null
+++ b/portal/troubleshooting/upgrade-failures.mdx
@@ -0,0 +1,217 @@
+---
+title: "Troubleshoot Developer Portal Upgrade Failures"
+description: "Troubleshoot Admin Portal inaccessibility, broken API sync, SSO login failures, and invalid access tokens after upgrading the Tyk Developer Portal."
+keywords: "Developer Portal, upgrade, troubleshooting, migration, SSO, access tokens, API sync, portal not starting"
+sidebarTitle: "Upgrade Failures"
+---
+
+Use this page to diagnose and resolve issues that occur after upgrading the Tyk Developer Portal.
+
+<Note>
+Before troubleshooting, ensure you have a database backup taken before the upgrade. If the Portal cannot be recovered, see [Rollback](#rollback) to restore service quickly.
+</Note>
+
+## Prerequisites
+
+- Access to Portal container or pod logs
+- A database backup taken before the upgrade
+- Access to the Portal Admin UI or the host where the Portal is deployed
+
+## Symptoms
+
+<AccordionGroup>
+  <Accordion title="Admin Portal is inaccessible after upgrade">
+
+    **1. Check that the database migration completed**
+
+    The Portal runs database migrations automatically on startup. If a migration fails, the Portal may refuse to start or may start in a broken state.
+
+    First, enable debug logging (see [Enable debug logging](#enable-debug-logging)). Then check the Portal logs for migration errors:
+
+    ```bash
+    # Docker
+    docker logs <portal-container-name> 2>&1 | grep -iE "failed to migrate|failed to connect|AutoMigrate|\[error\]|fatal"
+
+    # Kubernetes
+    kubectl logs <portal-pod-name> -n <namespace> | grep -iE "failed to migrate|failed to connect|AutoMigrate|\[error\]|fatal"
+    ```
+
+    Look for any of the following messages, which indicate a migration or connection failure:
+
+    - `failed to migrate database` — the migration ran but encountered an error
+    - `failed to connect to database` — the Portal could not reach the database before the migration could start
+    - `[error]` — a GORM-level database error during the migration
+    - `AutoMigrate` — any log line containing this string indicates the migration step was reached
+
+    If migration errors are present, check that the Portal has write access to the database and that the database user has the permissions required to run schema changes (`CREATE TABLE`, `ALTER TABLE`, `CREATE INDEX`).
+
+    **2. Check the theme version**
+
+    Each Portal version ships with an updated default theme. If the theme is not upgraded after a Portal upgrade, the Admin UI may fail to render correctly.
+
+    Follow the [theme upgrade instructions](/portal/customization/themes#upgrading-themes) to ensure your theme is compatible with the current Portal version.
+
+    **3. Check required environment variables**
+
+    Newer Portal versions may introduce required configuration options. Review the [Portal Configuration reference](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) and verify that all required variables are present in your deployment.
+
+    If you are upgrading to v1.14.0 or later, the following variables are now mandatory. The Portal will fail to start if either is absent or set to `sqlite`:
+
+    | Environment variable | Config key | Required value |
+    |---|---|---|
+    | `PORTAL_DATABASE_DIALECT` | `Database.Dialect` | `mysql` or `postgres` |
+    | `PORTAL_DATABASE_CONNECTIONSTRING` | `Database.ConnectionString` | Connection string for your database |
+
+    SQLite support was removed in v1.14.0. If your deployment used SQLite, migrate to PostgreSQL or MySQL before upgrading.
+
+  </Accordion>
+
+  <Accordion title="API sync is broken after upgrade">
+
+    After an upgrade, the Portal re-establishes connections with each Provider (Tyk Dashboard). If the Provider connection is broken, APIs do not synchronize and API Products may disappear from the Admin UI.
+
+    **1. Verify the Provider connection**
+
+    In the Admin Portal, go to **Providers** and check the status of each configured Provider. A disconnected or failing Provider will display an error status.
+
+    If the Tyk Dashboard API credentials used by the Portal have changed, update them in the Provider settings.
+
+    **2. Trigger a manual sync**
+
+    To force an immediate synchronization with all Providers:
+
+    1. In the Admin Portal, go to **Providers**.
+    2. Click **Synchronize**.
+
+    To sync a specific Provider only:
+
+    1. Click the three-dot menu next to the Provider.
+    2. Select **Synchronize**.
+
+    The Portal reports success or failure on completion. If the sync fails, verify that the Tyk Dashboard API is accessible from the Portal host and that the Portal user account has the [required permissions](/portal/api-provider#tyk-dashboard-api-access-credentials).
+
+    **3. Verify the sync interval**
+
+    The Portal automatically syncs with Providers every 10 minutes by default. This interval is controlled by [`PORTAL_REFRESHINTERVAL`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_refreshinterval). If automatic sync appears to be stuck, verify this value is set correctly and restart the Portal.
+
+  </Accordion>
+
+  <Accordion title="SSO users cannot log in after upgrade">
+
+    This symptom affects Portal versions earlier than v1.14.1. On login, SSO users could lose their Team assignments or be incorrectly reassigned to the default Organisation and Team, sometimes creating duplicate accounts.
+
+    **Recommended fix: Upgrade to v1.14.1 or later**
+
+    The SSO user assignment issue is resolved in v1.14.1. Upgrading is the recommended fix.
+
+    **If an immediate upgrade is not possible:**
+
+    Check and correct Team assignments manually:
+
+    1. In the Admin Portal, go to **Users** and search for the affected SSO user.
+    2. Check their **Organisation** and **Team** assignments.
+    3. If the user has been moved to the default Organisation or default Team, reassign them to the correct Team.
+
+    Also verify that the SSO profile configuration references Teams that still exist. If a Team referenced in `UserGroupMapping` was deleted, the SSO profile form may fail to load (also fixed in v1.14.1). To check:
+
+    1. Go to **Authentication** > **SSO Profiles**.
+    2. Open the affected SSO profile.
+    3. In the **User Group Mapping** section, confirm that all mapped Teams still exist in the Portal.
+    4. Remove or update any references to deleted Teams.
+
+  </Accordion>
+
+  <Accordion title="Access tokens are invalid after upgrade">
+
+    This symptom occurs when all APIs were removed from an API Product at some point before or during the upgrade. On Portal versions earlier than v1.14.1, removing all API access from a Product deleted the associated access policy, which permanently invalidated all tokens issued under that Product.
+
+    **Recommended fix: Upgrade to v1.14.1 or later**
+
+    This is resolved in v1.14.1. After upgrading, access policies are preserved in draft status when all APIs are removed from a Product. Tokens become valid again when API access is restored to the Product.
+
+    **If tokens remain invalid after upgrading to v1.14.1:**
+
+    1. In the Admin Portal, navigate to the affected API Product.
+    2. Verify that the Product has at least one API associated with it. If not, add the APIs back.
+    3. In Tyk Dashboard, go to the **Policies** list and find the policy associated with the affected Product. If the policy is in an inactive state, it will appear as disabled in the list. You can also check the `is_inactive` flag on the policy via the Tyk Dashboard API.
+
+    Adding APIs back to the Product in the Admin Portal will reactivate the policy and restore token validity.
+
+    <Note>
+    If the authentication method of the APIs in a Product was changed during the upgrade, previously issued tokens remain invalid regardless. In this case, consumers must request new credentials.
+    </Note>
+
+  </Accordion>
+</AccordionGroup>
+
+## Enable Debug Logging
+
+Enable debug logging before investigating to get detailed output from the Portal:
+
+| Environment variable | Config key | Value |
+|---|---|---|
+| `PORTAL_LOG_LEVEL` | `LogLevel` | `debug` |
+| `PORTAL_LOG_FORMAT` | `LogFormat` | `dev` |
+
+Set these in your Docker Compose file, Kubernetes Helm values, or environment configuration and restart the Portal. The `dev` format produces verbose, human-readable log output.
+
+To view Portal logs after enabling debug logging:
+
+```bash
+# Docker
+docker logs <portal-container-name>
+
+# Kubernetes
+kubectl logs <portal-pod-name> -n <namespace>
+```
+
+Disable debug logging after troubleshooting is complete. Verbose logging increases log volume and can impact performance in production environments.
+
+## Rollback
+
+If the Portal cannot be recovered through the steps above, restore the previous version.
+
+<Warning>
+The Portal uses GORM AutoMigrate, which only runs forward (up) migrations. Down-migrations are not supported. You must restore the pre-upgrade database backup before redeploying the old image. Running an older Portal image against a newer database schema may cause startup panics or unpredictable behavior.
+</Warning>
+
+**1. Stop the Portal**
+
+```bash
+# Docker
+docker compose down
+
+# Kubernetes
+kubectl scale deployment <portal-deployment-name> --replicas=0 -n <namespace>
+```
+
+**2. Restore the database backup**
+
+Restore the database to the backup taken before the upgrade. The exact restore command depends on your database:
+
+```bash
+# PostgreSQL
+psql -U <db-user> -d <db-name> < portal-backup.sql
+
+# MySQL
+mysql -u <db-user> -p <db-name> < portal-backup.sql
+```
+
+**3. Redeploy the previous Portal version**
+
+Update the Portal image tag to the previous version and restart:
+
+```bash
+# Docker — update the image tag in docker-compose.yml, then:
+docker compose up -d
+
+# Kubernetes — update the image tag in values.yaml, then:
+helm upgrade <release-name> tyk-charts/portal --values values.yaml -n <namespace>
+```
+
+**4. Verify**
+
+Check the Portal version in the Admin Portal footer or via the Portal API to confirm the rollback was successful. Then verify that consumers can log in and access their credentials.
+
+{/* TODO: Re-add link to /portal/install/upgrade-guide once that page is published */}
+For information on how to upgrade again when ready, see the Upgrade Guide.
diff --git a/portal/webcrawlers.mdx b/portal/webcrawlers.mdx
new file mode 100644
index 0000000000..251b9df38d
--- /dev/null
+++ b/portal/webcrawlers.mdx
@@ -0,0 +1,43 @@
+---
+title: "Managing Webcrawlers"
+description: "Configuring your Live Portal to restrit webcrawlers and bots"
+keywords: "Developer Portal, Tyk, Reference, Live Portal, Webcrawler, Robot, Admin"
+sidebarTitle: "Manage Webcrawlers"
+---
+
+## Configure robots.txt (Built-in Solution)
+
+From version 1.14.0, the Tyk Developer Portal includes built-in support for customizing the `robots.txt` file, which is the standard way to instruct search engines and other well-behaved crawlers about which parts of your site they should not access.
+
+To configure this:
+
+1. Log in to the Admin Portal
+2. Navigate to **Settings > General**
+3. Scroll down to the **robots.txt Settings** section
+4. Edit the content to control crawler access
+
+A restrictive `robots.txt` configuration would look like:
+
+```
+User-agent: *
+Disallow: /
+```
+
+This instructs all crawlers to avoid indexing any part of your site. By default, the Portal already uses a restrictive `robots.txt` configuration.
+
+## Implement Additional HTTP Headers
+
+You can add custom response headers to further discourage crawling:
+
+- `X-Robots-Tag: noindex, nofollow` - Similar to robots.txt but as an HTTP header
+- `Cache-Control: no-store, no-cache, must-revalidate` - Prevents caching
+
+These can be added in your proxy configuration or by customizing your portal theme.
+
+## Best Practices
+
+- Regularly check your server logs for unusual crawling patterns
+- Consider using a CAPTCHA for registration forms to prevent automated sign-ups (not supported natively by Tyk Developer Portal at this time)
+- Use JavaScript-based content rendering for sensitive information, as basic crawlers may not execute JavaScript
+
+Remember that while these methods can deter most crawlers, they cannot provide absolute protection against determined scrapers that deliberately ignore `robots.txt` rules or use sophisticated techniques to mimic human behavior.
\ No newline at end of file
diff --git a/product-stack/tyk-charts/overview.mdx b/product-stack/tyk-charts/overview.mdx
new file mode 100644
index 0000000000..9e538684a5
--- /dev/null
+++ b/product-stack/tyk-charts/overview.mdx
@@ -0,0 +1,24 @@
+---
+title: "Helm Chart Overview"
+description: "Explains an overview of Tyk charts"
+keywords: "Tyk charts, helm charts, helm, charts, kubernetes, k8s"
+sidebarTitle: "Overview"
+---
+
+Tyk is working to provide a new set of helm charts, and will progressively roll them out at [tyk-charts](https://github.com/TykTechnologies/tyk-charts). It will provide component charts for all Tyk Components, as well as umbrella charts as reference configurations for open source and Tyk Self Managed users. Please check out the latest status from our [Github repository](https://github.com/TykTechnologies/tyk-charts).
+
+## Quick start guides
+- [Quick Start with Tyk OSS Chart](/apim/open-source/installation#quick-start-with-helm-chart)
+- [Quick Start with Tyk Data Plane Chart for Cloud Hybrid Gateways](/tyk-cloud/environments-deployments/hybrid-gateways)
+- [Quick Start with Tyk Stack Chart](/tyk-self-managed/install/kubernetes#instructions)
+
+## Which chart is right for you?
+
+| Umbrella Charts | Descriptions |
+| :----------------- | :------------- |
+| [tyk-stack](/product-stack/tyk-charts/tyk-stack-chart)                 | Deploys Tyk stack including Tyk Dashboard, Gateway, Enterprise Portal, and Pump |
+| [tyk-control-plane](/product-stack/tyk-charts/tyk-control-plane-chart) | Deploys Tyk control plane including Tyk Dashboard, MDCB, Management Gateway, Enterprise Portal and Pump. Tyk control plane manages and configures distributed data planes in separate clusters / regions. |
+| [tyk-data-plane](/product-stack/tyk-charts/tyk-data-plane-chart)        | Deploys Tyk data plane including Tyk Gateway and Pump. Data planes are managed by Tyk Dashboard and MDCB in control plane. |
+| [tyk-oss](/product-stack/tyk-charts/tyk-oss-chart)                      | Deploys Open source Tyk Gateway and Pump |
+
+Learn more about [Tyk Licensing and Deployment models](https://tyk.io/pricing/).
diff --git a/product-stack/tyk-charts/tyk-control-plane-chart.mdx b/product-stack/tyk-charts/tyk-control-plane-chart.mdx
new file mode 100644
index 0000000000..55bbb1eb1a
--- /dev/null
+++ b/product-stack/tyk-charts/tyk-control-plane-chart.mdx
@@ -0,0 +1,925 @@
+---
+title: "Tyk Control Plane Chart"
+description: "Explains the Tyk Control Plane Chart"
+keywords: "Tyk Control Plane chart, Control Plane Chart, helm charts, helm, charts, kubernetes, k8s"
+sidebarTitle: "Tyk Control Plane Chart"
+---
+
+The `tyk-control-plane` provides the default deployment of Tyk control plane on a Kubernetes cluster. It will deploy all required Tyk components with the settings provided in the values.yaml file.
+
+## What components are deployed with Tyk Control Plane Chart?
+
+It includes:
+- Tyk Gateway, an Open Source Enterprise API Gateway (supporting REST, GraphQL, TCP and gRPC protocols).
+- Tyk Dashboard, a license based component that provides a graphical management interface and analytics platform for Tyk.
+- Tyk MDCB, a license based component that performs management and synchronisation of distributed clusters of Tyk API Gateways.
+- Tyk Pump, an analytics purger that moves the data generated by your Tyk nodes to any back-end.
+- Tyk Developer Portal, a full-fledged CMS-like system for API providers to publish, monetize and drive the adoption of APIs.
+
+Learn more about Tyk control plane at [MDCB components](/api-management/mdcb#mdcb-components).
+
+By default, this chart installs the following components as sub-charts on a [Kubernetes](https://kubernetes.io/) cluster using the [Helm](https://helm.sh/) package manager.
+
+| Component                       | Enabled by Default | Flag                        |
+| :--------------------------------- | :-------------------- | :----------------------------- |
+| Tyk Gateway                     | true               | n/a                         |
+| Tyk Dashboard                   | true               | n/a                         |
+| Tyk MDCB                        | true               | n/a                         |
+| Tyk Pump                        | false              | global.components.pump      |
+| Tyk Enterprise Developer Portal | false              | global.components.devPortal | 
+| Tyk Operator                    | false              | global.components.operator  |
+
+To enable or disable each component, change the corresponding enabled flag.
+
+Also, you can set the version of each component through `image.tag`. You could find the list of version tags available from [Docker hub](https://hub.docker.com/u/tykio).
+
+## Prerequisites
+
+- [Kubernetes 1.19+](https://kubernetes.io/docs/setup/)
+- [Helm 3+](https://helm.sh/docs/intro/install/)
+- [Redis](/apim/open-source/installation#configure-legacy-tyk-headless-helm-chart) should already be installed or accessible by the gateway and dashboard.
+- [MongoDB](https://www.mongodb.com) or [PostgreSQL](https://www.postgresql.org) should already be installed or accessible by dashboard. Please consult the list of [supported versions](/tyk-self-managed/install#requirements) that are compatible with Tyk.
+
+
+
+    <Note>
+    If you want to enable Tyk Developer Portal, please use PostgreSQL. MongoDB is not supported in Developer Portal.
+    </Note>
+
+
+## Tyk Control Plane Installations
+### Installing The Chart
+
+To install the chart from Helm repository in namespace `tyk` with the release name `tyk-cp`, issue the following commands:
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+helm show values tyk-helm/tyk-control-plane > values.yaml
+```
+
+For further documentation relating to *helm* command usage, please refer to the [helm docs](https://helm.sh/docs/helm/).
+
+At a minimum, modify `values.yaml` for the following settings:
+1. [Set Redis connection details](#set-redis-connection-details-required)
+2. [Set Mongo or PostgreSQL connection details](#set-mongo-or-postgresql-connection-details-required)
+3. [Tyk Dashboard License](#tyk-dashboard-license-required)
+4. [Tyk MDCB License](#tyk-mdcb-license-required)
+5. If you would like to use Developer Portal, an additional license is required: [Tyk Developer Portal License](#tyk-developer-portal-license-required)
+
+By default, the chart would expose MDCB service as ClusterIP. If you would like to access the control plane from outside the cluster, please change the service type `tyk-mdcb.mdcb.service.type` to NodePort or LoadBalancer.
+
+Then just run:
+```bash
+helm install tyk-cp tyk-helm/tyk-control-plane -n tyk --create-namespace -f values.yaml
+```
+
+Follow the installation output to obtain connection details to Tyk MDCB, and use that to configure Tyk Data Planes using [tyk-data-plane](/product-stack/tyk-charts/tyk-data-plane-chart) chart.
+
+### Uninstalling The Chart
+
+```bash
+helm uninstall tyk-cp -n tyk
+```
+This removes all the Kubernetes components associated with the chart and deletes the release.
+
+### Upgrading Chart
+
+```bash
+helm upgrade tyk-cp tyk-helm/tyk-control-plane -n tyk -f values.yaml
+```
+
+## Configuration
+
+To get all configurable options with detailed comments, issue the following command:
+
+```bash
+helm show values tyk-helm/tyk-control-plane > values.yaml
+```
+
+You can update any value in your local `values.yaml` file and use `-f [filename]` flag to override default values during installation. 
+Alternatively, you can use `--set` flag to set it in Tyk installation. See [Using Helm](https://helm.sh/docs/intro/using_helm/) for examples.
+
+To configure Tyk components, users can utilize both config files and [environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/). Notably, environment variables take precedence over config files. To maintain simplicity and consistency, the Tyk Helm Charts deploy components with an empty config file while setting container environment variables based on user-defined [values](https://helm.sh/docs/chart_best_practices/values/). This approach ensures seamless integration with Kubernetes practices, allowing for efficient management of configurations. For a comprehensive overview of available configurations, please refer to the [configuration documentation](/tyk-oss-gateway/configuration). 
+
+### Bootstrapping
+
+By default, the chart executes a [bootstrapping job](https://github.com/TykTechnologies/tyk-k8s-bootstrap) immediately after installation. This process ensures the presence of a valid dashboard license and initializes key components such as tyk-dashboard, tyk-portal, and tyk-operator, enabling them for immediate use.
+
+The bootstrapping job uses three distinct applications acting as Helm chart hooks:
+
+| **Bootstrapping Component** | **Description** |
+| :----------------------------- | :----------------- |
+| `bootstrap-pre-install`     | - Runs as a pre-install hook. <br /> - Validates the Tyk Dashboard license key to ensure proper installation prerequisites. |
+| `bootstrap-post-install`    | - Executes post-installation. <br /> - Sets up an organization and admin user in the Tyk Dashboard. <br /> - Creates Kubernetes secrets required by Tyk Operator and Tyk Enterprise Portal. <br /> **Note**: If an existing organization and admin user are found in the database, the bootstrapping job will not set up a new organization and user. The Kubernetes secrets will not contain the expected Org ID or API key. Please update the Secret with existing credentials in this case. |
+| `bootstrap-pre-delete`      | - Functions as a pre-delete hook. <br /> - Cleans up resources, ensuring no residual configurations remain post-uninstallation. |
+
+Key Notes on Bootstrapping:
+
+- Bootstrapping is triggered **only during** a `helm install` and does not run during a `helm upgrade`.
+- If `global.components.bootstrap` is set to `false`, only the dashboard license check will be performed. 
+
+Handling Bootstrapping Failures:
+
+- If the bootstrapping process fails, check the logs from the bootstrap pods to diagnose the issue.
+- Once reviewed, you can safely delete the bootstrap pods.
+- To re-trigger the bootstrapping process after a failure, you must run `helm uninstall` and start the installation process anew.
+
+### Setting Environment Variables
+Should any environment variables not be set by the Helm Chart, users can easily add them under the `extraEnvs` section within the charts for further customization. Values set under `extraEnvs` would take precedence over all configurations.
+
+Example of setting extra environment variable to gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: TYK_GW_LOGLEVEL
+      value: debug
+```
+
+An example is listed below for setting extra [environment variable using ConfigMap data](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#define-container-environment-variables-using-configmap-data), using gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: CONFIG_USERNAME
+      valueFrom:
+        configMapKeyRef: 
+          name: backend-user
+          key: backend-username
+```
+
+An example is listed below for setting extra [environment variable using secret data](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data), using gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: SECRET_USERNAME
+      valueFrom:
+        secretKeyRef: 
+          name: backend-user
+          key: backend-username
+```
+
+In the above example, an extra environment variable `SECRET_USERNAME` will be added to the Gateway container, with a value of `backend-username` associated with the secret `backend-user`. It is useful if you want to access secret data from [Tyk Gateway configuration file (tyk.conf) or API definitions](/tyk-configuration-reference/kv-store).
+
+### Set Redis Connection Details (Required)
+
+Tyk uses Redis for distributed rate-limiting and token storage. You may use the [Bitnami chart](https://github.com/bitnami/charts/tree/main/bitnami/redis) or Tyk's [simple-redis](https://artifacthub.io/packages/helm/tyk-helm/simple-redis) to install chart for POC purpose.
+
+Set the following values after installing Redis:
+
+| Name | Description | 
+| :------ | :------------- |
+| `global.redis.addrs` | Redis addresses |
+| `global.redis.pass` | Redis password in plain text |
+| `global.redis.passSecret.name` | If global.redis.pass is not provided, you can store it in a secret and provide the secret name here |
+| `global.redis.passSecret.keyName` | key name to retrieve redis password from the secret |
+
+***Recommended: via *Bitnami* chart***
+
+For Redis you can use these rather excellent charts provided by [Bitnami](https://github.com/bitnami/charts/tree/main/bitnami/redis).
+Copy the following commands to add it:
+
+```bash
+helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n tyk --create-namespace --install --version 19.0.2 --set image.repository=bitnamilegacy/redis
+```
+
+
+<Note>
+Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#redis).
+</Note>
+
+
+Follow the notes from the installation output to get connection details and password.
+
+```
+  Redis(TM) can be accessed on the following DNS names from within your cluster:
+
+    tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
+    tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)
+
+  export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)
+```
+
+The Redis address as set by Bitnami is `tyk-redis-master.tyk.svc.cluster.local:6379`
+
+You can reference the password secret generated by Bitnami chart by  `--set global.redis.passSecret.name=tyk-redis` and `--set global.redis.passSecret.keyName=redis-password`, or just set `global.redis.pass=$REDIS_PASSWORD`
+
+***Evaluation only: via *simple-redis* chart***
+
+Another option for Redis, to get started quickly, is to use our [simple-redis](https://artifacthub.io/packages/helm/tyk-helm/simple-redis) chart.
+
+
+<Warning>
+Please note that these provided charts must never be used in production or for anything
+but a quick start evaluation only. Use [Bitnami Redis](https://github.com/bitnami/charts/tree/main/bitnami/redis) or [Redis Enterprise operator](https://docs.redis.com/latest/kubernetes/deployment/) in any other case.
+We provide this chart, so you can quickly deploy *Tyk gateway*, but it is not meant for long term storage of data.
+</Warning>
+
+
+```bash
+helm install redis tyk-helm/simple-redis -n tyk
+```
+
+The Tyk Helm Chart can connect to `simple-redis` in the same namespace by default. You do not need to set Redis address and password in `values.yaml`.
+
+### Set Mongo or PostgreSQL Connection Details (Required)
+If you have already installed MongoDB or PostgreSQL, you can set the connection details in `global.mongo` and `global.postgres` section of values file respectively.
+
+If not, you can use these rather excellent charts provided by Bitnami to install MongoDB or PostgreSQL:
+
+**Mongo Installation**
+
+```bash
+helm install tyk-mongo bitnami/mongodb --set "replicaSet.enabled=true" -n tyk --version 15.1.3 --set image.repository=bitnamilegacy/mongodb
+```
+
+Then follow notes from the installation output to get connection details and update them in `values.yaml` file.
+
+
+<Note>
+Bitnami MongoDB image is not supported on darwin/arm64 architecture.
+</Note>
+
+
+
+<Note>
+Please make sure you are installing MongoDB versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#requirements).
+</Note>
+
+
+
+<Note>
+Important Note regarding MongoDB:
+
+This helm chart enables the `PodDisruptionBudget` for MongoDB with an arbiter replica-count of 1. If you intend to perform system maintenance on the node where the MongoDB pod is running and this maintenance requires the node to be drained, then this action will be prevented due to the the replica count being 1.
+
+Increase the replica count in the helm chart deployment to a minimum of 2 to remedy this issue.
+</Note>
+
+
+Configure `global.mongo.mongoURL` and `global.storageType` as below. You should replace `pass` in the connection string with the MONGODB_ROOT_PASSWORD you obtain from the installation output notes.
+
+```yaml
+global:
+  # Set mongo connection details if you want to configure mongo pump.
+  mongo:
+    # The mongoURL value will allow you to set your MongoDB address.
+    # Default value: mongodb://mongo.{{ .Release.Namespace }}.svc:27017/tyk_analytics
+    # mongoURL: mongodb://mongo.tyk.svc:27017/tyk_analytics
+
+    # If your MongoDB has a password you can add the username and password to the url
+    mongoURL: mongodb://root:pass@tyk-mongo-mongodb.tyk.svc:27017/tyk_analytics?authSource=admin
+
+    # mongo-go driver is supported for Tyk 5.0.2+.
+    # We recommend using the mongo-go driver if you are using MongoDB 4.4.x+.
+    # For MongoDB versions prior to 4.4, please use the mgo driver.
+    # Since Tyk 5.3 the default driver is mongo-go.
+    driver: mongo-go
+
+    # Connection URL can also be set using a secret. Provide the name of the secret and key below.
+    # connectionURLSecret:
+    #   name: ""
+    #   keyName: ""
+
+    # Enables SSL for MongoDB connection. MongoDB instance will have to support that.
+    # Default value: false
+    useSSL: false
+
+  # Choose the storageType for Tyk. [ "mongo", "postgres" ]
+  storageType: &globalStorageType mongo
+```
+
+**PostgreSQL Installation**
+```bash
+helm install tyk-postgres bitnami/postgresql --set "auth.database=tyk_analytics" -n tyk --version 12.12.10 --set image.repository=bitnamilegacy/postgresql
+```
+
+Follow the notes from the installation output to get connection details.
+
+
+<Note>
+Please make sure you are installing PostgreSQL versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#requirements).
+</Note>
+
+
+```yaml
+global:
+  # Postgres connection string parameters.
+  postgres:
+    # host corresponds to the host name of postgres
+    host: tyk-postgres-postgresql.tyk.svc
+    # port corresponds to the port of postgres
+    port: 5432
+    # user corresponds to the user of postgres
+    user: postgres
+    # password corresponds to the password of the given postgres user in selected database
+    password:
+    # database corresponds to the database to be used in postgres
+    database: tyk_analytics
+    # sslmode corresponds to if postgres runs in sslmode (https)
+    sslmode: disable
+    # Connection string can also be set using a secret. Provide the name of the secret and key below.
+    # connectionStringSecret:
+    #   name: ""
+    #   keyName: ""
+```
+
+### Protect Confidential Fields with Kubernetes Secrets
+
+In the `values.yaml` file, some fields are considered confidential, such as `APISecret`, connection strings, etc.
+
+Declaring values for such fields as plain text might not be desired. Instead, for certain fields, Kubernetes secrets can be referenced, and the chart will 
+[define container environment variables using secret data](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data).
+
+This section describes how to use Kubernetes secrets to declare confidential fields.
+
+***Tyk Dashboard and Developer Portal Admin***
+
+If Tyk Dashboard bootstrapping is enabled, the admin user will be created according to the `global.adminUser` field.
+
+All admin credentials can also be set through Kubernetes secret.
+
+
+<Note>
+Once `global.adminUser.useSecretName` is declared, it takes precedence over `global.adminUser.firstName`, 
+`global.adminUser.lastName`, `global.adminUser.email` and `global.adminUser.password`.
+
+If `global.adminUser.useSecretName` is in use, please add all keys mentioned below to the secret.
+</Note>
+
+
+***Tyk Dashboard Admin First Name***
+
+It can be configured via `global.adminUser.firstName` as a plain text or Kubernetes secret which includes `adminUserFirstName` key in it. Then, this secret must be referenced via `global.adminUser.useSecretName`.
+
+
+***Tyk Dashboard Admin Last Name***
+
+It can be configured via `global.adminUser.lastName` as a plain text or Kubernetes secret which includes `adminUserLastName` key in it. Then, this secret must be referenced via `global.adminUser.useSecretName`.
+
+***Tyk Dashboard and Developer Portal Admin Email***
+
+It can be configured via `global.adminUser.email` as a plain text or Kubernetes secret which includes `adminUserEmail` key in it. Then, this secret must be referenced via `global.adminUser.useSecretName`.
+
+***Tyk Dashboard and Developer Portal Admin Password***
+
+It can be configured via `global.adminUser.password` as a plain text or Kubernetes secret which includes `adminUserPassword` key in it. Then, this secret must be referenced via `global.adminUser.useSecretName`.
+
+***APISecret***
+
+The `global.secrets.APISecret` field configures a [header value](/tyk-oss-gateway/configuration#secret) used in every interaction with Tyk Gateway API.
+
+It can be configured via `global.secrets.APISecret` as a plain text or Kubernetes secret which includes `APISecret` key in it. Then, this secret must be referenced via `global.secrets.useSecretName`.
+
+```yaml
+global:
+    secrets:
+        APISecret: CHANGEME
+        useSecretName: "mysecret" # where mysecret includes `APISecret` key with the desired value.
+```
+
+***AdminSecret***
+
+The `global.secrets.AdminSecret` field sets a [secret](/tyk-dashboard/configuration#admin_secret) for Admin API.
+
+It can be configured via `global.secrets.AdminSecret` as a plain text or Kubernetes secret which includes `AdminSecret` key in it. Then, this secret must be referenced via `global.secrets.useSecretName`.
+
+```yaml
+global:
+    secrets:
+        useSecretName: "mysecret" # where mysecret includes `AdminSecret` key with the desired value.
+```
+
+
+<Note>
+Once `global.secrets.useSecretName` is declared, it takes precedence over `global.secrets.APISecret` and `global.secrets.AdminSecret`.
+</Note>
+
+
+***Dashboard License***
+
+In order to refer to a Tyk Dashboard license through a Kubernetes secret, please use `global.secrets.useSecretName`, where the secret should contain a key called `DashLicense`.
+
+***MDCB License***
+
+In order to refer to a Tyk MDCB license through a Kubernetes secret, please use `tyk-mdcb.mdcb.useSecretName`, where the secret should contain a key called `MDCBLicense`.
+
+***MDCB Secret***
+
+In order to set the secret for accessing MDCB secure HTTP endpoints through a Kubernetes secret, please use tyk-`mdcb.mdcb.useSecretName`, where the secret should contain a key called `securitySecret`.
+
+***Tyk Developer Portal License***
+
+In order to refer to a Tyk Developer Portal license through a Kubernetes secret, please use `tyk-dev-portal.useSecretName`, where the secret should contain a key called `DevPortalLicense`.
+
+***Tyk Developer Portal Admin Password***
+
+In order to refer to a Tyk Developer Portal's admin password through a Kubernetes secret, 
+please use `global.adminUser.useSecretName`, where the secret should contain a key called `adminUserPassword`.
+
+***Tyk Developer Portal Storage Connection String***
+
+In order to refer to a Tyk Developer Portal connection string to the selected database through a Kubernetes secret, please use `tyk-dev-portal.useSecretName`, where the secret should contain a key called `DevPortalStorageConnectionString`.
+
+
+<Note>
+If `tyk-dev-portal.useSecretName` is in use, please add all keys mentioned to the secret.
+</Note>
+
+
+***Tyk Developer Portal AWS S3 Access Key ID***
+
+In order to refer to a Tyk Developer Portal AWS S3 Access Key ID through a Kubernetes secret, please use `tyk-dev-portal.useSecretName`, where the secret should contain a key called `DevPortalAwsAccessKeyId`.
+
+
+<Note>
+If `tyk-dev-portal.useSecretName` is in use, please add all keys mentioned to the secret.
+</Note>
+
+
+***Tyk Developer Portal AWS S3 Secret Access Key***
+
+In order to refer Tyk Developer Portal connection string to the selected database through Kubernetes secret,
+please use `tyk-dev-portal.useSecretName`, where the secret should contain a key called 
+`DevPortalAwsSecretAccessKey`.
+
+
+<Note>
+If `tyk-dev-portal.useSecretName` is in use, please add all keys mentioned to the secret.
+</Note>
+
+
+***Redis Password***
+
+The Redis password can also be provided via a secret. Store the Redis password in Kubernetes secret and refer to this secret via `global.redis.passSecret.name` and `global.redis.passSecret.keyName` field, as follows:
+
+```yaml
+global:  
+  redis:
+     passSecret:
+       name: "yourSecret"
+       keyName: "redisPassKey"
+```
+
+***MongoDB or Postgres connection strings***
+
+Storage connection strings can also be provided via a secret. 
+
+For MongoDB, suppose you have a secret named `yourSecret` and you have the mongo connection URL stored in key `mongoConnectionURLkey`. Store the connection string in Kubernetes secret and refer to this secret via `global.mongo.connectionURLSecret.name` and `global.mongo.connectionURLSecret.keyName` field, as follows:
+
+- MongoDB:
+```yaml
+global:  
+  mongo:
+    connectionURLSecret:
+       name: "yourSecret"
+       keyName: "mongoConnectionURLkey"
+```
+
+For Postgres, suppose you have a secret named `yourSecret` and you have the postgres connection string stored in key `postgreConnectionURLkey`. Store the connection string in Kubernetes secret and refer to this secret via `global.postgres.connectionStringSecret.name` and `global.postgres.connectionStringSecret.keyName` field, as follows:
+
+- Postgres:
+```yaml
+global:
+  postgres:
+    connectionStringSecret:
+       name: "yourSecret"
+       keyName: "postgreConnectionURLkey"
+```
+
+**_Tyk Operator License_**
+
+It can be configured via `global.license.operator` as a plain text or Kubernetes secret which includes `OperatorLicense` key in it. Then, this secret must be referenced via `global.secrets.useSecretName`.
+
+Note: If you are using `global.secrets.useSecretName`, you must configure the operator license in the referenced Kubernetes secret. `global.license.operator` will not be used in this case.
+
+### Gateway Configurations
+
+
+<Note>
+In Tyk control plane, Tyk Gateway acts as a management gateway that is used for creation of keys and certificates. It does not service API requests. It is important to ensure there is no public access to it and it must not be sharded (tagged) as it “belongs” to the whole Tyk installation.
+</Note>
+
+
+Configure the following details below, inside the `tyk-gateway` section.
+
+#### Update Tyk Gateway Version
+Set version of gateway at `tyk-gateway.gateway.image.tag`. You can find the list of version tags available from [Docker hub](https://hub.docker.com/r/tykio/tyk-gateway/tags). Please check [Tyk Release notes](/developer-support/release-notes/gateway) carefully while upgrading or downgrading.
+
+#### Enabling TLS
+
+*Enable TLS*
+
+We have provided an easy way to enable TLS via the `global.tls.gateway` flag. Setting this value to true will automatically enable TLS using the certificate provided under tyk-gateway/certs/.
+
+*Configure TLS secret*
+
+If you want to use your own key/cert pair, please perform the following steps:
+1. Create a TLS secret using your cert and key pair.
+2. Set `global.tls.gateway` to true.
+3. Set `global.tls.useDefaultTykCertificate` to false.
+4. Set `tyk-gateway.gateway.tls.secretName` to the name of the newly created secret.
+
+*Add Custom Certificates*
+
+To add your custom Certificate Authority(CA) to your containers, you can mount your CA certificate directly into /etc/ssl/certs folder.
+
+```yaml
+   extraVolumes: 
+     - name: self-signed-ca
+       secret:
+         secretName: self-signed-ca-secret
+   extraVolumeMounts: 
+     - name: self-signed-ca
+       mountPath: "/etc/ssl/certs/myCA.pem"
+       subPath: myCA.pem
+```
+
+#### Enabling gateway autoscaling
+You can enable autoscaling of the gateway by `--set tyk-gateway.gateway.autoscaling.enabled=true`. By default, it will enable the `Horizontal Pod Autoscaler` resource with target average CPU utilization at 60%, scaling between 1 and 3 instances. To customize those values you can modify the `tyk-gateway` section of `values.yaml` as shown below:
+
+```yaml
+tyk-gateway:
+  gateway:
+    autoscaling:
+      enabled: true
+      minReplicas: 3
+      maxReplicas: 30
+```
+
+Built-in rules include `tyk-gateway.gateway.autoscaling.averageCpuUtilization` for CPU utilization (set by default at 60%) and `tyk-gateway.gateway.autoscaling.averageMemoryUtilization` for memory (disabled by default). In addition to that you can define rules for custom metrics using `tyk-gateway.gateway.autoscaling.autoscalingTemplate` list:
+
+```yaml
+tyk-gateway:
+  gateway:
+    autoscaling:
+      autoscalingTemplate:
+        - type: Pods
+          pods:
+            metric:
+              name: nginx_ingress_controller_nginx_process_requests_total
+            target:
+              type: AverageValue
+              averageValue: 10000m
+```
+
+### Pump Configurations
+
+To enable Pump, set `global.components.pump` to true and configure the following parameters included below inside the `tyk-pump` section.
+
+{/* BEGIN import from pump doc */}
+
+| Pump                      | Configuration                                                                                              |
+| :--------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------- | 
+| Prometheus Pump (Default) | Add the value `prometheus` to the `tyk-pump.pump.backend` entry and add connection details for Prometheus under `tyk-pump.pump.prometheusPump`. |
+| Mongo Pump                | Add `mongo` to `tyk-pump.pump.backend` and add connection details for mongo under `global.mongo`.                                               |
+| Mongo Selective Pump      | Add `mongo-selective` to `tyk-pump.pump.backend` and add connection details for mongo under `global.mongo`.                                     |
+| Mongo Aggregate Pump      | Add `mongo-aggregate` to `tyk-pump.pump.backend` and add connection details for mongo under `global.mongo`.                                     |
+| Postgres Pump             | Add `postgres` to `tyk-pump.pump.backend` and add connection details for postgres under `global.postgres`.                                      |
+| Postgres Aggregate Pump   | Add `postgres-aggregate` to `tyk-pump.pump.backend` and add connection details for postgres under `global.postgres`.                            |
+| Uptime Pump               | Set `tyk-pump.pump.uptimePumpBackend` to `mongo` or `postgres` or `""`                                                                           |
+| Other Pumps               | Add the required environment variables in `tyk-pump.pump.extraEnvs`                                                                              |
+
+
+
+<Note>
+For additional information on Tyk Pump configurations, refer to the 
+[Control Plane Pumps](/api-management/dashboard-analytics/control-plane-pumps#choosing-a-pump-type) documentation.
+
+To explore the list of supported backends for Tyk Pump, please visit [Pump Backends](/api-management/logs/external-data-sinks).
+</Note>
+
+
+#### Prometheus Pump
+Add `prometheus` to `tyk-pump.pump.backend` and add connection details for Prometheus under `tyk-pump.pump.prometheusPump`. 
+
+We also support monitoring using Prometheus Operator. All you have to do is set `tyk-pump.pump.prometheusPump.prometheusOperator.enabled` to true.
+
+This will create a _PodMonitor_ resource for your Pump instance.
+
+```yaml
+    # prometheusPump configures Tyk Pump to expose Prometheus metrics.
+    # Please add "prometheus" to .Values.pump.backend in order to enable Prometheus Pump.
+    prometheusPump:
+      # host represents the host without port, where Tyk Pump serve the metrics for Prometheus.
+      host: ""
+      # port represents the port where Tyk Pump serve the metrics for Prometheus.
+      port: 9090
+      # path represents the path to the Prometheus collection. For example /metrics.
+      path: /metrics
+      # customMetrics allows defining custom Prometheus metrics for Tyk Pump.
+      # It accepts a string that represents a JSON object. For instance,
+      #
+      # customMetrics: '[{"name":"tyk_http_requests_total","description":"Total of API requests","metric_type":"counter","labels":["response_code","api_name","method","api_key","alias","path"]},          {              "name":"tyk_http_latency",              "description":"Latency of API requests",              "metric_type":"histogram",              "labels":["type","response_code","api_name","method","api_key","alias","path"]          }]'
+      customMetrics: ""
+      # If you are using prometheus Operator, set the fields in the section below.
+      prometheusOperator:
+        # enabled determines whether the Prometheus Operator is in use or not. By default,
+        # it is disabled.
+        # Tyk Pump can be monitored with PodMonitor Custom Resource of Prometheus Operator.
+        # If enabled, PodMonitor resource is created based on .Values.pump.prometheusPump.prometheusOperator.podMonitorSelector
+        # for Tyk Pump.
+        enabled: false
+        # podMonitorSelector represents a podMonitorSelector of your Prometheus resource. So that
+        # your Prometheus resource can select PodMonitor objects based on selector defined here.
+        # Please set this field to the podMonitorSelector field of your monitoring.coreos.com/v1
+        # Prometheus resource's spec.
+        #
+        # You can check the podMonitorSelector via:
+        #   kubectl describe prometheuses.monitoring.coreos.com <PROMETHEUS_POD>
+        podMonitorSelector:
+          release: prometheus-stack
+```
+
+#### Mongo pump
+To enable Mongo pump, add `mongo` to `tyk-pump.pump.backend` and add connection details for mongo under `global.mongo`. See [Mongo Installation](#set-mongo-or-postgresql-connection-details-required) section above.
+
+By default, it will enable Mongo Aggregate, Mongo Graph Pump and Mongo Selective Pump.
+
+
+#### SQL Pump
+To enable SQL pump, add `postgres` to `tyk-pump.pump.backend` and add connection details for postgres under `global.postgres`. See [PostgresSQL Installation](#set-mongo-or-postgresql-connection-details-required) section above.
+
+By default, it will enable Postgres Aggregate, Postgres Graph Aggregate, SQL Pump and SQL graph pump.
+
+
+#### Uptime Pump
+Uptime Pump can be configured by setting `pump.uptimePumpBackend` in values.yaml file. It supports the following values:
+1. mongo: Used to set mongo pump for uptime analytics. Mongo Pump should be enabled.
+2. postgres: Used to set postgres pump for uptime analytics. Postgres Pump should be enabled.
+3. empty: Used to disable uptime analytics.
+
+```yaml
+    # uptimePumpBackend configures uptime Tyk Pump. ["", "mongo", "postgres"].
+    # Set it to "" for disabling uptime Tyk Pump. By default, uptime pump is disabled.
+    uptimePumpBackend: ""
+```
+
+#### Other Pumps
+To setup other backends for pump, refer to this [document](https://github.com/TykTechnologies/tyk-pump/blob/master/README.md#pumps--back-ends-supported) and add the required environment variables in `pump.extraEnvs`
+
+
+### Tyk Dashboard Configurations
+
+#### Tyk Dashboard License (Required)
+
+Tyk Dashboard License is required. It can be set up in `global.license.dashboard` or through secret `global.secrets.useSecretName`. The secret should contain a key called DashLicense.
+
+```yaml
+global:
+  license:
+    # The license key needed by Tyk Dashboard to work.
+    #
+    # NOTE: If you do not want to store license as a plain text in the file, you can use a Kubernetes secret
+    # that stores the dashboard license. Please see `.global.secrets.useSecretName`.
+    dashboard: ""
+```
+
+#### Enabling Dashboard TLS
+
+Assuming that TLS certificates for the Tyk Dashboard are available in the Kubernetes Secret `tyk-dashboard-tls`, follow these steps to enable TLS:
+
+1. Set `global.tls.dashboard` to `true`.
+2. Set `tyk-dashboard.dashboard.tls.secretName` to the name of the Kubernetes secret containing TLS certificates for the Tyk Dashboard, in this case, `tyk-dashboard-tls`.
+3. Define certificate configurations in `tyk-dashboard.dashboard.tls.certificates`, which generates `TYK_DB_HTTPSERVEROPTIONS_CERTIFICATES` for the Tyk Dashboard.
+
+Optional Steps, if needed:
+- Modify the secret mount path on the Tyk Dashboard Pod via `tyk-dashboard.dashboard.tls.certificatesMountPath`.
+- If necessary, either enable `insecureSkipVerify` via `tyk-dashboard.dashboard.tls.certificates`, or mount CA information through `tyk-dashboard.dashboard.extraVolumes` and `tyk-dashboard.dashboard.extraVolumeMounts`.
+- If the `tyk-bootstrap` chart is used to bootstrap the Tyk Dashboard, ensure that bootstrap app can validate certificate of Tyk Dashboard or enable `insecureSkipVerify` in the `tyk-bootstrap` chart.
+- If the Tyk Gateway connects to the Tyk Dashboard, confirm that the Tyk Gateway has appropriate certificates for connecting to the Tyk Dashboard
+
+#### Audit Log Configurations
+
+You can manage audit logging for Tyk Dashboard via `auditLogs`:
+
+- `auditLogs.enabled`: Enables or disables audit logging. It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_ENABLED`. Disabled by default.
+- `auditLogs.type`: Specifies the storage type for audit logs (`db` or `file`). It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_STORETYPE`. Set to `file` by default.
+- `auditLogs.format`: Defines the format of audit log files (`json` or `text`). It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_FORMAT`. Set to `text` by default.
+- `auditLogs.path`: Sets the path to the audit log file. It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_PATH`. Set to "" by default.
+- `auditLogs.enableDetailedRecording`: Enables detailed logging, including HTTP requests (headers only) and full HTTP responses. It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_DETAILEDRECORDING`. Disabled by default.
+
+#### OPA Configurations
+<a id="opa-configurations"></a>
+
+You can manage OPA (Open Agent Policy) for Tyk Dashboard via `opa`:
+
+- `opa.enabled`: Enables OPA support. It sets corresponding Dashboard environment `TYK_DB_SECURITY_OPENPOLICY_ENABLED`. Disabled by default.
+- `opa.debug`: Activates OPA debug mode for detailed logging of policy execution. It sets corresponding Dashboard environment `TYK_DB_SECURITY_OPENPOLICY_DEBUG`. Disabled by default.
+- `opa.api`: Enables OPA API mode to manage policies via the Dashboard API. It sets corresponding Dashboard environment `TYK_DB_SECURITY_OPENPOLICY_ENABLEAPI`. Disabled by default.
+- `opa.allowAdminPasswordReset`: Required if OPA is enabled with its default policies. It sets corresponding Dashboard environment `TYK_DB_SECURITY_ALLOWADMINRESETPASSWORD`. Enabled by default.
+
+### Tyk MDCB Configurations
+
+#### Tyk MDCB License (Required)
+
+Tyk MDCB requires a license to be set at `tyk-mdcb.mdcb.license`. This field is mandatory and must be configured.
+
+To enhance security and avoid storing plaintext values for the MDCB license directly in the Helm value file, an alternative approach is available. You can store the license in a Kubernetes Secret and reference it externally.
+
+Set the license in the Kubernetes Secret and provide the secret's name through `tyk-mdcb.mdcb.useSecretName`. The Secret must contain a key named `MDCBLicense`.
+
+#### Tyk MDCB Listen Port
+
+The `tyk-mdcb.mdcb.listenPort` field represents a RPC port which worker Tyk Gateways will connect to.
+Setting `tyk-mdcb.mdcb.listenPort` field opens a port on MDCB container and MDCB service targets this port.
+It is used to set `TYK_MDCB_LISTENPORT`
+
+#### Tyk MDCB HTTP Port
+
+The HTTP port for Tyk MDCB is configurable via the `tyk-mdcb.mdcb.httpPort` field.
+This port enables MDCB to accept standard HTTP requests, such as health checks.
+
+It also defines the path for liveness and readiness probes.
+It is used to set `TYK_MDCB_HTTPPORT` in MDCB 2.6.0+ or `TYK_MDCB_HEALTHCHECKPORT` in MDCB 2.5.x or prior.
+
+#### Enabling secured HTTP endpoints
+
+The [MDCB OAS API](/tyk-mdcb-api) has secured HTTP endpoints, like `/dataplanes` which return list of gateway nodes connected. By default, this endpoint is disabled to avoid unintended leakage of data plane information. To enable this endpoint, set `tyk-mdcb.mdcb.security.enableHttpSecureEndpoints` to `true`. It is used to set `TYK_MDCB_SECURITY_ENABLEHTTPSECUREENDPOINTS`. Also, you need to set a secret that can be used to access this endpoint via `tyk-mdcb.mdcb.security.secret` field.
+
+#### Enabling MDCB TLS
+
+Assuming that TLS certificates for the Tyk MDCB are available in the Kubernetes Secret `mdcb-tls-secret`, follow these steps to enable TLS for RPC connection:
+1. Set `tyk-mdcb.mdcb.tls.useSSL` to true.
+2. Set `tyk-mdcb.mdcb.tls.secretName` to the name of the Kubernetes secret containing TLS certificates for the Tyk MDCB, in this case, `mdcb-tls-secret`.
+
+```yaml
+tyk-mdcb:
+  mdcb:
+    tls:
+      # enables ssl for mdcb
+      useSSL: true
+
+      # the path to where the keys will be mounted in the pod
+      certificatesMountPath: "/etc/certs"
+
+      # location to pem encoded private key
+      certificateKeyFile: "/etc/certs/tls.key"
+
+      # location to pem encoded certificate
+      certificateCertFile: "/etc/certs/tls.crt"
+
+      # the name of the secret
+      secretName: "mdcb-tls-secret"
+
+      # the name of the volume
+      volumeName: "mdcb-tls-secret-volume"
+```
+
+To enable TLS for MDCB HTTP connection, use `tyk-mdcb.mdcb.httpServerOptions`. The configuration includes settings such as `useSSL`, `certificateKeyFile`, `certificateCertFile` and `minVersion`. For other [HTTP server options](/tyk-multi-data-centre/mdcb-configuration-options#http_server_options), users can utilize [extraEnvs](#setting-environment-variables) to configure additional parameters.
+
+```yaml
+tyk-mdcb:
+  mdcb:
+    # defines the SSL/TLS settings for the http server where the healthcheck is exposed
+    httpServerOptions:
+      # if enabled then the endpoints will be served over https
+      useSSL: true
+      certificateKeyFile: /path-to-cert-keyfile
+      certificateCertFile: /path-to-certfile
+      
+      # For TLS 1.0 use 769, for TLS 1.1 use 770, for TLS 1.2 use 771, for TLS 1.3 use 772
+      minVersion: 771
+```
+
+### Tyk Bootstrap Configurations
+
+To enable [bootstrapping](#bootstrapping), set `global.components.bootstrap` to `true`. It would run [tyk-k8s-bootstrap](https://github.com/TykTechnologies/tyk-k8s-bootstrap) to bootstrap `tyk-control-plane` and to create Kubernetes secrets that can be utilized in Tyk Operator and Tyk Developer Portal.
+
+
+<Note>
+During bootstrapping, admin user needs to reset its password. It may be denied by Dashboard OPA rules if [OPA](/platform-management/open-policy-agent) was enabled. Please disable OPA during the initial bootstrapping or set Dashboard configuration [TYK_DB_SECURITY_ALLOWADMINRESETPASSWORD](/tyk-dashboard/configuration#security-allow_admin_reset_password) to true.
+</Note>
+
+
+#### Bootstrapped Environments
+
+If Tyk is already bootstrapped, the application will bypass the creation of the Tyk Organization and Admin User, proceeding directly with the creation of Kubernetes Secrets.
+
+Given that the Kubernetes Secrets require values for `TYK_AUTH` and `TYK_ORG`, it is essential to provide these values through the respective environment variables, called `TYK_K8SBOOTSTRAP_TYK_ADMIN_AUTH` for `TYK_AUTH` and `TYK_K8SBOOTSTRAP_TYK_ORG_ID` for `TYK_ORG`.
+
+Ensure that these environment variables are set appropriately to `postInstall` hook for bootstrapped environments.
+
+### Tyk Developer Portal Configurations
+
+To enable Tyk Developer Portal, set `global.components.devPortal` to true, and configure below inside `tyk-dev-portal` section.
+
+#### Tyk Developer Portal License (Required)
+
+Tyk Developer Portal License is required. It can be set up in `tyk-dev-portal.license` or through secret `global.secrets.useSecretName`. The secret should contain a key called `DevPortalLicense`.
+
+```yaml
+tyk-dev-portal:
+  # Tyk Developer Portal license.
+  license: ""
+```
+
+#### Tyk Developer Portal Database
+
+
+<Note>
+Tyk no longer supports SQLite as of Tyk 5.7.0. To avoid disruption, please transition to [PostgreSQL](/planning-for-production/database-settings#postgresql), [MongoDB](/planning-for-production/database-settings#mongodb), or one of the listed compatible alternatives.
+</Note>
+
+
+By default, Tyk Developer Portal use `sqlite3` to store portal metadata. If you want to use a different SQL Database, please modify the section below.
+
+```yaml
+tyk-dev-portal:
+  database:
+    # This selects the SQL dialect to be used
+    # The supported values are mysql, postgres and sqlite3
+    dialect: "sqlite3"
+    connectionString: "db/portal.db"
+    enableLogs: false
+    maxRetries: 3
+    retryDelay: 5000
+```
+
+#### Storage Settings
+
+Tyk Developer Portal supports different storage options for storing the portal's CMS assets such as images, theme files and Open API Specification files. Please see the [Developer Portal Storage settings](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal-settings) page for all the available options. 
+
+If you use the file system as storage, please set `tyk-dev-portal.storage.type` to `fs`, and configure `tyk-dev-portal.storage.persistence` to mount an existing persistent volume to Tyk Developer Portal.
+
+If you use [AWS S3](https://aws.amazon.com/s3/) as storage, please set `tyk-dev-portal.storage.type` to `s3`, and configure `tyk-dev-portal.storage.s3` section with credentials to access AWS S3 bucket.
+
+If you use database as storage, please set `tyk-dev-portal.storage.type` to `db`, and configure `tyk-dev-portal.database` section with database connection details.
+
+```yaml
+tyk-dev-portal:
+  # Sensitive configuration of Portal could be set using k8s secret
+  # You can set following fields:
+  # - DevPortalLicense - Sets LicenseKey for Developer Portal
+  # - DevPortalStorageConnectionString - Sets connectionString for Developer Portal
+  # - DevPortalAwsAccessKeyId - Sets AWS S3 Access Key ID
+  # - DevPortalAwsSecretAccessKey - Sets AWS S3 Secret Access Key
+  useSecretName: ""
+  # The hostname to bind the Developer Portal to.
+  hostName: tyk-dev-portal.org
+  # Developer Portal license.
+  license: ""
+  # Developer portal can be deployed as StatefulSet or as Deployment
+  kind: StatefulSet
+  storage:
+    # User can set the storage type for portal.
+    # Supported types: fs, s3, db
+    type: "db"
+    # Configuration values for using s3 as storage for Tyk Developer Portal
+    # In case you want to provide the key ID and access key via secrets please
+    # refer to the existing secret inside the helm chart or the
+    # .Values.useSecretName field
+    s3:
+      awsAccessKeyid: your-access-key
+      awsSecretAccessKey: your-secret-key
+      region: sa-east-1
+      endpoint: https://s3.sa-east-1.amazonaws.com
+      bucket: your-portal-bucket
+      acl: private
+      presign_urls: true
+    persistence:
+      mountExistingPVC: ""
+      storageClass: ""
+      accessModes:
+        - ReadWriteOnce
+      size: 8Gi
+      annotations: {}
+      labels: {}
+      selector: {}
+  database:
+    # This selects the SQL dialect to be used
+    # The supported values are mysql, postgres and sqlite3
+    dialect: "sqlite3"
+    connectionString: "db/portal.db"
+    enableLogs: false
+    maxRetries: 3
+    retryDelay: 5000
+```
+
+#### Other Configurations
+
+Other [Developer Portal configurations](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) can be set by using environment variables with `extraEnvs` fields, e.g.:
+
+```yaml
+tyk-dev-portal:
+  extraEnvs:
+  - name: PORTAL_LOG_LEVEL
+    value: debug
+```
+
+### Tyk Operator Configurations
+
+Tyk Operator is a licensed component that requires a valid key for operation. 
+Please refer to the [Tyk Operator Installation Guide](/tyk-stack/tyk-operator/installing-tyk-operator)
+for detailed information on the installation and upgrade processes. 
+
+Prior to installing Tyk Operator, ensure that a valid license key is provided by setting `global.license.operator` field in values.yaml file. You can set license key via a Kubernetes secret using `global.secrets.useSecretName` field. The secret should contain a key called `OperatorLicense`.
+
+In order to enable installing Tyk Operator along-side Tyk Control Plane installation, please set `global.components.operator`
+to `true`.
+
+All other configurations related to Tyk Operator are available under `tyk-operator` section of `values.yaml` file.
+
+> Tyk Operator needs a cert-manager to be installed. Ensure that cert-manager is installed as described in the
+> official documentation: [Installing Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator).
diff --git a/product-stack/tyk-charts/tyk-data-plane-chart.mdx b/product-stack/tyk-charts/tyk-data-plane-chart.mdx
new file mode 100644
index 0000000000..968255e077
--- /dev/null
+++ b/product-stack/tyk-charts/tyk-data-plane-chart.mdx
@@ -0,0 +1,510 @@
+---
+title: "Tyk Data Plane Chart"
+description: "Install and configure Tyk Data Plane"
+keywords: "Tyk Data Plane chart, Data Plane Chart, helm charts, helm, charts, kubernetes, k8s"
+sidebarTitle: "Tyk Data Plane Chart"
+---
+
+The `tyk-data-plane` chart provides the default deployment of a Tyk data plane for Tyk Self Managed MDCB or Tyk Cloud users. It will deploy the data plane components that remotely connect to a MDCB control plane.
+
+## What components are deployed with Tyk Data Plane Chart?
+
+It includes the following components:
+- *Tyk Gateway*: An open source Enterprise API Gateway, supporting REST, GraphQL, TCP and gRPC protocols.
+- *Tyk Pump*: An analytics purger that moves the data generated by your Tyk gateways to any back-end storage. 
+
+Furthermore, it has all the required modifications to easily connect to Tyk Cloud or Multi Data Center (MDCB) control plane.
+
+[Supported MDCB versions](/tyk-cloud/environments-deployments/hybrid-gateways#tyk-cloud-mdcb-supported-versions)
+
+By default, this chart installs following components as subcharts on a [Kubernetes](https://kubernetes.io/) cluster using the [Helm](https://helm.sh/) package manager.
+
+| Component | Enabled by Default? | Flag |
+| :--------- | :------------------ | :---- |
+|Tyk Gateway |true  | n/a                    |
+|Tyk Pump    |true | global.components.pump |
+
+To enable or disable each component, change the corresponding enabled flag.
+
+Also, you can set the version of each component through `image.tag`. You can find the list of version tags available from [Docker hub](https://hub.docker.com/u/tykio).
+
+For a quick start guide, please see [deploy hybrid gateway](/tyk-cloud/environments-deployments/hybrid-gateways).
+
+## Prerequisites
+
+- [Kubernetes 1.19+](https://kubernetes.io/docs/setup/)
+- [Helm 3+](https://helm.sh/docs/intro/install/)
+- [Redis](/apim/open-source/installation#configure-legacy-tyk-headless-helm-chart) should already be installed or accessible by the gateway.
+- Connection details to remote control plane. See below for how to obtain them from Tyk Cloud or Tyk Control Plane chart.
+
+## Obtain Remote Control Plane Connection details from Tyk Cloud
+
+For Tyk Cloud users who want to deploy hybrid data planes, you can easily obtain your remote control plane connection details on Tyk Cloud.
+
+1. Go to Deployment tab and create a Hybrid data plane configuration. You can also select from an existing one.
+2. Copy Key, Org ID, and Data Planes Connection String (MDCB) as `global.remoteControlPlane`'s `userApiKey`, `orgId`, and `connectionString` respectively.
+
+<img src="/img/tyk-charts/tyk-cloud-deployment.png" alt="tyk-cloud-deployment" />
+
+## Obtain Remote Control Plane Connection Details from tyk-control-plane Chart
+
+For Tyk Self-Managed MDCB users who want to deploy data planes, you can obtain MDCB connection details from the notes
+of tyk-control-plane installation output, as listed below.
+
+```
+=== Tyk Control Plane Details ===
+Before a worker gateway that is deployed in data plane can connect to MDCB, it is important to set remote control plane options.
+If the worker gateway will be deployed via Helm, tyk-data-plane chart helps to facilitate this process.
+
+1- First obtain required connection details from Tyk MDCB:
+
+    export GROUP_ID=your_group_id # You can use any name for your group.
+    export USER_API_KEY=$(kubectl get secret --namespace tyk tyk-operator-conf -o jsonpath="{.data.TYK_AUTH}" | base64 --decode)
+    export ORG_ID=$(kubectl get secret --namespace tyk tyk-operator-conf -o jsonpath="{.data.TYK_ORG}" | base64 --decode)
+
+
+2- Create a Kubernetes Secret based on credentials in data plane's namespace, e.g. `tyk-dp`.
+    
+    kubectl create namespace tyk-dp
+
+    kubectl create secret generic tyk-data-plane-details \
+    --from-literal "orgId=$ORG_ID" \
+    --from-literal "userApiKey=$USER_API_KEY" \
+    --from-literal "groupID=$GROUP_ID" \
+    --namespace tyk-dp
+
+3- Refer to this Kubernetes secret (tyk-data-plane-details) while installing worker gateways through
+`global.remoteControlPlane.useSecretName` in tyk-data-plane chart.
+
+4- Set `global.remoteControlPlane.connectionString`, `global.remoteControlPlane.useSSL` and 
+`global.remoteControlPlane.sslInsecureSkipVerify` in tyk-data-plane chart to access MDCB service.
+
+If data plane is deployed in the same cluster, it can be accessed via this connection string:
+    export MDCB_CONNECTIONSTRING="mdcb-svc-tyk-control-plane-tyk-mdcb.tyk.svc:9091"
+
+If data plane is not deployed in the same cluster as control plane, get the connection string according 
+to how MDCB service is exposed.
+```
+
+1. Follow installation output to export USER_API_KEY, ORG_ID, and MDCB_CONNECTIONSTRING. The values can be used to set `global.remoteControlPlane`'s `userApiKey`, `orgId`, and `connectionString` respectively.
+
+2. Also verify that the SSL connection configuration is set correctly:
+```yaml
+global:
+  remoteControlPlane:
+    # enable/disable ssl
+    useSSL: false
+    # Disables SSL certificate verification
+    sslInsecureSkipVerify: true
+```
+
+
+## Tyk Data Plane Chart Installations
+### Installing the Chart
+
+To install the chart from the Helm repository in namespace `tyk-dp` with the release name `tyk-data-plane`, issue the following commands:
+
+```bash
+    helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+    helm repo update
+    helm show values tyk-helm/tyk-data-plane > values.yaml
+```
+
+For further documentation relating to *helm* command usage, please refer to the [helm docs](https://helm.sh/docs/helm/).
+
+At a minimum, modify values.yaml for the following settings:
+1. [Set Redis connection details](#set-redis-connection-details-required)
+
+
+Consult the [Configuration](#configuration) section for the available configuration options and modify your local `values.yaml` file accordingly. Then install the chart by issuing the following command below:
+
+```bash
+helm install tyk-data-plane tyk-helm/tyk-data-plane -n tyk-dp --create-namespace -f values.yaml
+```
+
+### Uninstalling the Chart
+
+```bash
+helm uninstall tyk-data-plane -n tyk-dp
+```
+
+This removes all the Kubernetes components associated with the chart and deletes the release.
+
+### Upgrading Chart
+
+```bash
+helm upgrade tyk-data-plane tyk-helm/tyk-data-plane -n tyk-dp
+```
+
+## Configuration
+
+To list all configurable options with detailed comments, issue the following command:
+
+```bash
+helm show values tyk-helm/tyk-data-plane > values.yaml
+```
+
+You can update any value in your local `values.yaml` file and use `-f [filename]` flag to override default values during installation. 
+Alternatively, you can use `--set` flag to set it in Tyk installation.
+
+To configure Tyk components, users can utilize both config files and [environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/). Notably, environment variables take precedence over config files. To maintain simplicity and consistency, the Tyk Helm Charts deploy components with an empty config file while setting container environment variables based on user-defined [values](https://helm.sh/docs/chart_best_practices/values/). This approach ensures seamless integration with Kubernetes practices, allowing for efficient management of configurations. For a comprehensive overview of available configurations, please refer to the [configuration documentation](/tyk-oss-gateway/configuration). 
+
+
+### Setting Environment Variables
+Should any environment variables not be set by the Helm Chart, users can easily add them under the `extraEnvs` section within the charts for further customization. Values set under `extraEnvs` would take precedence over all configurations.
+
+Example of setting extra environment variable to gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: TYK_GW_LOGLEVEL
+      value: debug
+```
+
+An example is listed below for setting extra [environment variable using ConfigMap data](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#define-container-environment-variables-using-configmap-data), using gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: CONFIG_USERNAME
+      valueFrom:
+        configMapKeyRef: 
+          name: backend-user
+          key: backend-username
+```
+
+An example is listed below for setting extra [environment variable using secret data](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data), using gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: SECRET_USERNAME
+      valueFrom:
+        secretKeyRef: 
+          name: backend-user
+          key: backend-username
+```
+
+In the above example, an extra environment variable `SECRET_USERNAME` will be added to the Gateway container, with a value of `backend-username` associated with the secret `backend-user`. It is useful if you want to access secret data from [Tyk Gateway configuration file (tyk.conf) or API definitions](/tyk-configuration-reference/kv-store).
+
+### Set Redis Connection Details (Required)
+
+Tyk uses Redis for distributed rate-limiting and token storage. You may use the [Bitnami chart](https://github.com/bitnami/charts/tree/main/bitnami/redis) to install or Tyk's `simple-redis` chart for POC purpose.
+
+Set the following values after installing Redis:
+
+| Name | Description | 
+| :------ | :------------- |
+| `global.redis.addrs` | Redis addresses |
+| `global.redis.pass` | Redis password in plain text |
+| `global.redis.passSecret.name` | If global.redis.pass is not provided, you can store it in a secret and provide the secret name here |
+| `global.redis.passSecret.keyName` | key name to retrieve Redis password from the secret |
+
+***Recommended: via *Bitnami* chart***
+
+For Redis you can use these rather excellent charts provided by [Bitnami](https://github.com/bitnami/charts/tree/main/bitnami/redis).
+Copy the following commands to add it:
+
+```bash
+helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n tyk --create-namespace --install --version 19.0.2 --set image.repository=bitnamilegacy/redis
+```
+
+
+<Note>
+Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#redis).
+</Note>
+
+
+Follow the notes from the installation output to get connection details and password.
+
+```
+  Redis(TM) can be accessed on the following DNS names from within your cluster:
+
+    tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
+    tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)
+
+  export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)
+```
+
+The Redis address as set by Bitnami is `tyk-redis-master.tyk.svc.cluster.local:6379`
+
+You can reference the password secret generated by Bitnami chart by  `--set global.redis.passSecret.name=tyk-redis` and `--set global.redis.passSecret.keyName=redis-password`, or just set `--set global.redis.pass=$REDIS_PASSWORD`.
+
+```bash
+helm install --set global.redis.passSecret.name=tyk-redis --set global.redis.passSecret.keyName=redis-password tyk-data-plane tyk-helm/tyk-data-plane
+```
+
+or
+
+```bash
+export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)
+
+helm install --set global.redis.pass=$REDIS_PASSWORD tyk-data-plane tyk-helm/tyk-data-plane
+```
+
+***Evaluation only: via *simple-redis* chart***
+
+Another option for Redis, to get started quickly, is to use our [simple-redis](https://artifacthub.io/packages/helm/tyk-helm/simple-redis) chart.
+
+
+<Warning>
+Please note that these provided charts must never be used in production or for anything
+but a quick start evaluation only. Use [Bitnami Redis](https://github.com/bitnami/charts/tree/main/bitnami/redis) or [Official Redis installation guides](https://redis.io/docs/install/) in any other case.
+We provide this chart, so you can quickly deploy *Tyk gateway*, but it is not meant for long term storage of data.
+</Warning>
+
+
+```bash
+helm install redis tyk-helm/simple-redis -n tyk
+```
+
+The Tyk Helm Chart can connect to `simple-redis` in the same namespace by default. You do not need to set Redis address and password in `values.yaml`.
+
+### Protect Confidential Fields with Kubernetes Secrets
+
+In the `values.yaml` file, some fields are considered confidential, such as `APISecret`, connection strings, etc.
+Declaring values for such fields as plain text might not be desired for all use cases. Instead, for certain fields, Kubernetes secrets can be referenced, and the chart will [define container environment variables using secret data](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data).
+
+This section describes how to use Kubernetes secrets to declare confidential fields.
+
+***APISecret***
+
+The `global.secrets.APISecret` field configures a [header value](/tyk-oss-gateway/configuration#secret) used in every interaction with Tyk Gateway API.
+
+It can be configured via `global.secrets.APISecret` as a plain text or Kubernetes secret which includes `APISecret` key in it. Then, this secret must be referenced via `global.secrets.useSecretName`.
+
+```yaml
+global:
+    secrets:
+        APISecret: CHANGEME
+        useSecretName: "mysecret" # where mysecret includes `APISecret` key with the desired value.
+```
+
+***Remote Control Plane Configuration***
+
+All configurations regarding remote control plane (`orgId`, `userApiKey`, and `groupID`) can be set via
+Kubernetes secret.
+
+Instead of explicitly setting them in the values file, just create a Kubernetes secret including `orgId`, `userApiKey` and `groupID` keys and refer to it in `global.remoteControlPlane.useSecretName`.
+
+1. Create a secret that contains `orgId`, `userApiKey` and `groupID` keys in it:
+
+```bash
+kubectl create secret generic foo-secret -n tyk --from-literal=orgId=[ORGID] --from-literal=userApiKey=[APIKEY]--from-literal=groupID=[GROUPID]
+```
+
+2. Refer to it in `global.remoteControlPlane.useSecretName`.
+
+```yaml
+global:
+  remoteControlPlane:
+    useSecretName: "foo-secret"
+```
+
+***Redis Password***
+
+The Redis password can also be provided via a secret. Store Redis password in Kubernetes secret and refer to this secret
+via `global.redis.passSecret.name` and `global.redis.passSecret.keyName` field, as follows:
+
+```yaml
+global:  
+  redis:
+     passSecret:
+       name: "yourSecret"
+       keyName: "redisPassKey"
+```
+
+### Tyk MDCB Synchroniser (Optional)
+
+If control plane MDCB has enabled [Synchroniser feature](/api-management/mdcb#mdcb-synchroniser), the following fields should be set accordingly:
+
+```yaml
+global:
+  mdcbSynchronizer:
+      enabled: true
+      keySpaceSyncInterval: 10
+```
+
+### Gateway Configurations
+
+Configure below inside `tyk-gateway` section.
+
+#### Update Tyk Gateway Version
+Set version of gateway at `tyk-gateway.gateway.image.tag`. You can find the list of version tags available from [Docker hub](https://hub.docker.com/r/tykio/tyk-gateway/tags). Please check [Tyk Release notes](/developer-support/release-notes/gateway) carefully while upgrading or downgrading.
+
+#### Enabling TLS
+
+*Enable TLS*
+
+We have provided an easy way to enable TLS via the `global.tls.gateway` flag. Setting this value to true will
+automatically enable TLS using the certificate provided under tyk-gateway/certs/.
+
+*Configure TLS secret*
+
+If you want to use your own key/cert pair, please follow the following steps:
+1. Create a TLS secret using your cert and key pair.
+2. Set `global.tls.gateway` to true.
+3. Set `global.tls.useDefaultTykCertificate` to false.
+4. Set `tyk-gateway.gateway.tls.secretName` to the name of the newly created secret.
+
+*Add Custom CA Certificates*
+
+To add your custom Certificate Authority(CA) to your containers, you can mount your CA certificate directly into /etc/ssl/certs folder.
+
+```yaml
+   extraVolumes: 
+     - name: self-signed-ca
+       secret:
+         secretName: self-signed-ca-secret
+   extraVolumeMounts: 
+     - name: self-signed-ca
+       mountPath: "/etc/ssl/certs/myCA.pem"
+       subPath: myCA.pem
+```
+
+#### Enabling gateway autoscaling
+You can enable autoscaling of the gateway by `--set tyk-gateway.gateway.autoscaling.enabled=true`. By default, it will enable the `Horizontal Pod Autoscaler` resource with target average CPU utilization at 60%, scaling between 1 and 3 instances. To customize those values you can modify the `tyk-gateway` section of `values.yaml` as shown below:
+
+```yaml
+tyk-gateway:
+  gateway:
+    autoscaling:
+      enabled: true
+      minReplicas: 3
+      maxReplicas: 30
+```
+
+Built-in rules include `tyk-gateway.gateway.autoscaling.averageCpuUtilization` for CPU utilization (set by default at 60%) and `tyk-gateway.gateway.autoscaling.averageMemoryUtilization` for memory (disabled by default). In addition to that you can define rules for custom metrics using `tyk-gateway.gateway.autoscaling.autoscalingTemplate` list:
+
+```yaml
+tyk-gateway:
+  gateway:
+    autoscaling:
+      autoscalingTemplate:
+        - type: Pods
+          pods:
+            metric:
+              name: nginx_ingress_controller_nginx_process_requests_total
+            target:
+              type: AverageValue
+              averageValue: 10000m
+```
+
+#### Accessing Gateway
+
+*Service port*
+
+Default service port of gateway is 8080. You can change this at `global.servicePorts.gateway`.
+
+*Ingress*
+
+An Ingress resource is created if `tyk-gateway.gateway.ingress.enabled` is set to true.
+
+```yaml
+    ingress:
+      # if enabled, creates an ingress resource for the gateway
+      enabled: true
+
+      # specify ingress controller class name
+      className: ""
+
+      # annotations for ingress
+      annotations: {}
+
+      # ingress rules
+      hosts:
+        - host: tyk-gw.local
+          paths:
+            - path: /
+              pathType: ImplementationSpecific
+
+      # tls configuration for ingress
+      #  - secretName: chart-example-tls
+      #    hosts:
+      #      - chart-example.local
+      tls: []
+```
+
+*Control Port*
+
+Set `tyk-gateway.gateway.control.enabled` to true will allow you to run the [Gateway API](/tyk-gateway-api) on a separate port and protect it behind a firewall if needed.
+
+#### Sharding
+
+Configure the gateways to load APIs with specific tags only by enabling `tyk-gateway.gateway.sharding.enabled`, and set `tags` to comma separated lists of matching tags.
+
+```yaml
+    # Sharding gateway allows you to selectively load APIs to specific gateways.
+    # If enabled make sure you have at least one gateway that is not sharded.
+    # Also be sure to match API segmentation tags with the tags selected below.
+    sharding:
+      enabled: true
+      tags: "edge,dc1,product"
+```
+
+#### OpenTelemetry
+To enable OpenTelemetry for Gateway set `gateway.opentelemetry.enabled` flag to true. It is disabled by default.
+
+You can also configure connection settings for it's exporter. By default `grpc` exporter is enabled on `localhost:4317` endpoint.
+
+ To enable TLS settings for the exporter, you can set `gateway.opentelemetry.tls.enabled` to true. 
+
+#### Liveness and readiness probes
+Gateway liveness probes can be customised via `gateway.livenessProbe` field. All fields from PodLivenessProbe object can be added here. If set to empty or nil, the default health check on /health will be performed.
+
+Gateway readiness probes can be customised via `gateway.readinessProbe` field. All fields from PodReadinessProbe object can be added here. If set to empty or nil, the default health check on /health will be performed.
+
+For further details for configuring Tyk Gateway, please consult the [Tyk Gateway Configuration Options](/tyk-oss-gateway/configuration) guide.
+
+### Pump Configurations
+
+To enable Pump, set `global.components.pump` to true, and configure as detailed below inside `tyk-pump` section.
+
+| Pump                      | Configuration                                                                                              |
+| :--------------------------- | :------------------------------------------------------------------------------------------------------------ | 
+| Prometheus Pump (Default) | Add `prometheus` to `tyk-pump.pump.backend`, and add connection details for prometheus under `tyk-pump.pump.prometheusPump`. |
+| Hybrid Pump (Default)     | Add `hybrid` to `tyk-pump.pump.backend`, and add remoteControlPlane details under `global.remoteControlPlane`. |
+| Other Pumps               | Add the required environment variables in `tyk-pump.pump.extraEnvs`                                                |
+
+#### Prometheus Pump
+Add `prometheus` to `tyk-pump.pump.backend`, and add connection details for prometheus under `tyk-pump.pump.prometheusPump`. 
+
+We also support monitoring using Prometheus Operator. All you have to do is set `tyk-pump.pump.prometheusPump.prometheusOperator.enabled` to true.
+This will create a *PodMonitor* resource for your Pump instance.
+
+#### Hybrid Pump
+Add `hybrid` to `tyk-pump.pump.backend`, and add remoteControlPlane details under `global.remoteControlPlane`.
+
+```yaml
+  # Set remoteControlPlane connection details if you want to configure hybrid pump.
+  remoteControlPlane:
+      # connection string used to connect to an MDCB deployment. For Tyk Cloud users, you can get it from Tyk Cloud Console and retrieve the MDCB connection string.
+      connectionString: ""
+      # orgID of your dashboard user
+      orgId: ""
+      # API key of your dashboard user
+      userApiKey: ""
+      # needed in case you want to have multiple data-planes connected to the same redis instance
+      groupID: ""
+      # enable/disable ssl
+      useSSL: true
+      # Disables SSL certificate verification
+      sslInsecureSkipVerify: true
+```
+
+```yaml
+  # hybridPump configures Tyk Pump to forward Tyk metrics to a Tyk Control Plane.
+  # Please add "hybrid" to .Values.pump.backend in order to enable Hybrid Pump.
+  hybridPump: 
+    # Specify the frequency of the aggregation in minutes or simply turn it on by setting it to true
+    enableAggregateAnalytics: true
+    # Hybrid pump RPC calls timeout in seconds.
+    callTimeout: 10
+    # Hybrid pump connection pool size.
+    poolSize: 5
+```
+
+#### Other Pumps
+To setup other backends for Pump, refer to this [document](https://github.com/TykTechnologies/tyk-pump/blob/master/README.md#pumps--back-ends-supported) and add the required environment variables in `tyk-pump.pump.extraEnvs`
+
diff --git a/product-stack/tyk-charts/tyk-oss-chart.mdx b/product-stack/tyk-charts/tyk-oss-chart.mdx
new file mode 100644
index 0000000000..614c9125a8
--- /dev/null
+++ b/product-stack/tyk-charts/tyk-oss-chart.mdx
@@ -0,0 +1,520 @@
+---
+title: "Tyk Open Source Chart"
+description: "Explains the Tyk Open Source Chart"
+keywords: "Tyk Open Source chart, Open Source Chart, helm charts, helm, charts, kubernetes, k8s"
+sidebarTitle: "Tyk Open Source Chart"
+---
+
+`tyk-oss` provides the default deployment of the Tyk Open Source stack.
+
+It includes the following components:
+- *Tyk Gateway*: An open source Enterprise API Gateway, supporting REST, GraphQL, TCP and gRPC protocols.
+- *Tyk Pump*: An analytics purger that moves the data generated by your Tyk gateways to any back-end storage. 
+
+## What components are deployed with Tyk OSS Chart?
+
+By default, this chart installs following components as subcharts on a [Kubernetes](https://kubernetes.io/) cluster using the [Helm](https://helm.sh/) package manager.
+
+| Component    | Enabled by Default | Flag                       |
+| :-------------- | :-------------------- | :---------------------------- |
+| Tyk Gateway  | true               | n/a                        |
+| Tyk Pump     | false              | global.components.pump     |
+| Tyk Operator | false              | global.components.operator |
+
+To enable or disable each component, change the corresponding enabled flag.
+
+Also, you can set the version of each component through `image.tag`. You could find the list of version tags available from [Docker hub](https://hub.docker.com/u/tykio).
+
+For quick start guide, please see [Quick Start with Tyk OSS Helm Chart](/apim/open-source/installation#quick-start-with-helm-chart).
+
+## Prerequisites
+
+* [Kubernetes 1.19+](https://kubernetes.io/docs/setup/)
+* [Helm 3+](https://helm.sh/docs/intro/install/)
+* [Redis](/tyk-configuration-reference/redis-cluster-sentinel) should already be installed or accessible by the gateway. 
+
+## Tyk OSS Installations
+### Installing the Chart
+
+To install the chart from the Helm repository in namespace `tyk` with the release name `tyk-oss`:
+
+First, add our Helm repo and get default values:
+
+```bash
+    helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+    helm repo update
+    helm show values tyk-helm/tyk-oss > values.yaml
+```
+
+For further documentation relating to *helm* command usage, please refer to the [helm docs](https://helm.sh/docs/helm/).
+
+See [Configuration](#configuration) section for the available config options and modify your local `values.yaml` file accordingly. Then install the chart:
+
+```bash
+helm install tyk-oss tyk-helm/tyk-oss -n tyk --create-namespace -f values.yaml
+```
+
+### Uninstalling the Chart
+
+```bash
+helm uninstall tyk-oss -n tyk
+```
+
+This removes all the Kubernetes components associated with the chart and deletes the release.
+
+### Upgrading Chart
+
+```bash
+helm upgrade tyk-oss tyk-helm/tyk-oss -n tyk -f values.yaml
+```
+
+## Configuration
+
+To list all configurable options with detailed comments:
+
+```bash
+helm show values tyk-helm/tyk-oss > values.yaml
+```
+
+You can update any value in your local `values.yaml` file and use `-f [filename]` flag to override default values during installation. 
+Alternatively, you can use `--set` flag to set it in Tyk installation.
+
+To configure Tyk components, users can utilize both config files and [environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/). Notably, environment variables take precedence over config files. To maintain simplicity and consistency, the Tyk Helm Charts deploy components with an empty config file while setting container environment variables based on user-defined [values](https://helm.sh/docs/chart_best_practices/values/). This approach ensures seamless integration with Kubernetes practices, allowing for efficient management of configurations. For a comprehensive overview of available configurations, please refer to the [configuration documentation](/tyk-oss-gateway/configuration). 
+
+### Setting Environment Variables
+Should any environment variables not be set by the Helm Chart, users can easily add them under the `extraEnvs` section within the charts for further customization. Values set under `extraEnvs` would take precedence over all configurations.
+
+Example of setting extra environment variable to gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: TYK_GW_LOGLEVEL
+      value: debug
+```
+
+An example is listed below for setting extra [environment variable using ConfigMap data](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#define-container-environment-variables-using-configmap-data), using gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: CONFIG_USERNAME
+      valueFrom:
+        configMapKeyRef: 
+          name: backend-user
+          key: backend-username
+```
+
+An example is listed below for setting extra [environment variable using secret data](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data), using gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: SECRET_USERNAME
+      valueFrom:
+        secretKeyRef: 
+          name: backend-user
+          key: backend-username
+```
+
+In the above example, an extra environment variable `SECRET_USERNAME` will be added to the Gateway container, with a value of `backend-username` associated with the secret `backend-user`. It is useful if you want to access secret data from [Tyk Gateway configuration file (tyk.conf) or API definitions](/tyk-configuration-reference/kv-store).
+
+### Set Redis Connection Details (Required)
+
+Tyk uses Redis for distributed rate-limiting and token storage. You may use the [Bitnami chart](https://github.com/bitnami/charts/tree/main/bitnami/redis) to install or Tyk's `simple-redis` chart for POC purpose.
+
+Set the following values after installing Redis:
+
+| Name | Description | 
+| :------ | :------------- |
+| `global.redis.addrs` | Redis addresses |
+| `global.redis.pass` | Redis password in plain text |
+| `global.redis.passSecret.name` | If global.redis.pass is not provided, you can store it in a secret and provide the secret name here |
+| `global.redis.passSecret.keyName` | key name to retrieve Redis password from the secret |
+
+***Recommended: via *Bitnami* chart***
+
+For Redis you can use these rather excellent charts provided by [Bitnami](https://github.com/bitnami/charts/tree/main/bitnami/redis).
+Copy the following commands to add it:
+
+```bash
+helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n tyk --create-namespace --install --version 19.0.2 --set image.repository=bitnamilegacy/redis
+```
+
+
+<Note>
+Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#redis).
+</Note>
+
+
+Follow the notes from the installation output to get connection details and password.
+
+```
+  Redis(TM) can be accessed on the following DNS names from within your cluster:
+
+    tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
+    tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)
+
+  export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)
+```
+
+The Redis address as set by Bitnami is `tyk-redis-master.tyk.svc.cluster.local:6379`
+
+You can reference the password secret generated by Bitnami chart by  `--set global.redis.passSecret.name=tyk-redis` and `--set global.redis.passSecret.keyName=redis-password`, or just set `global.redis.pass=$REDIS_PASSWORD`
+
+***Evaluation only: via *simple-redis* chart***
+
+Another option for Redis, to get started quickly, is to use our [simple-redis](https://artifacthub.io/packages/helm/tyk-helm/simple-redis) chart.
+
+
+<Warning>
+Please note that these provided charts must never be used in production or for anything
+but a quick start evaluation only. Use [Bitnami Redis](https://github.com/bitnami/charts/tree/main/bitnami/redis) or [Official Redis installation guides](https://redis.io/docs/install/) in any other case.
+We provide this chart, so you can quickly deploy *Tyk gateway*, but it is not meant for long term storage of data.
+</Warning>
+
+
+```bash
+helm install redis tyk-helm/simple-redis -n tyk
+```
+
+The Tyk Helm Chart can connect to `simple-redis` in the same namespace by default. You do not need to set Redis address and password in `values.yaml`.
+
+### Protect Confidential Fields with Kubernetes Secrets
+
+In the `values.yaml` file, some fields are considered confidential, such as `APISecret`, connection strings, etc.
+Declaring values for such fields as plain text might not be desired for all use cases. Instead, for certain fields, Kubernetes secrets can be referenced and the chart will [define container environment variables using Secret data](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data).
+
+This section describes how to use Kubernetes secrets to declare confidential fields.
+
+***APISecret***
+
+The `global.secrets.APISecret` field configures a [header value](/tyk-oss-gateway/configuration#secret) used in every interaction with Tyk Gateway API.
+
+It can be configured via `global.secrets.APISecret` as a plain text or Kubernetes secret which includes `APISecret` key in it. Then, this secret must be referenced via `global.secrets.useSecretName`.
+
+```yaml
+global:
+    secrets:
+        APISecret: CHANGEME
+        useSecretName: "mysecret" # where mysecret includes `APISecret` key with the desired value.
+```
+
+***Redis Password***
+
+Redis password can also be provided via a secret. Store Redis password in Kubernetes secret and refer to this secret
+via `global.redis.passSecret.name` and `global.redis.passSecret.keyName` field, as follows:
+
+```yaml
+global:  
+  redis:
+     passSecret:
+       name: "yourSecret"
+       keyName: "redisPassKey"
+```
+
+**_Tyk Operator License_**
+
+It can be configured via `global.license.operator` as a plain text or Kubernetes secret which includes `OperatorLicense` key in it. Then, this secret must be referenced via `global.secrets.useSecretName`.
+
+Note: If you are using `global.secrets.useSecretName`, you must configure the operator license in the referenced Kubernetes secret. `global.license.operator` will not be used in this case.
+
+### Create a Kubernetes Secret for Tyk Operator
+
+When `operatorSecret.enabled` is set to `true`, `tyk-oss` chart will create a Kubernetes Secret named `tyk-operator-conf` in the same namespace. It can be used by Tyk Operator to connect to Gateway to manage Tyk API resources.
+
+```yaml
+# operatorSecret controls if a secret needed to connect to Operator will be created
+operatorSecret:
+  # enabled if set to true creates secret
+  enabled: true
+  # OSS doesn't have concept of OrgID. But we need to support some features (eg. basic auth key) in OSS
+  # You can set it to any arbitary value
+  orgID: "orgid"
+```
+
+### Gateway Configurations
+
+Configure below inside `tyk-gateway` section.
+
+#### Update Tyk Gateway Version
+Set version of gateway at `tyk-gateway.gateway.image.tag`. You can find the list of version tags available from [Docker hub](https://hub.docker.com/u/tykio). Please check [Tyk Release notes](/developer-support/release-notes/gateway) carefully while upgrading or downgrading.
+
+#### Enabling TLS
+
+*Enable TLS*
+
+We have provided an easy way to enable TLS via the `global.tls.gateway` flag. Setting this value to true will
+automatically enable TLS using the certificate provided under tyk-gateway/certs/.
+
+*Configure TLS secret*
+
+If you want to use your own key/cert pair, please follow the following steps:
+1. Create a TLS secret using your cert and key pair.
+2. Set `global.tls.gateway` to true.
+3. Set `global.tls.useDefaultTykCertificate` to false.
+4. Set `tyk-gateway.gateway.tls.secretName` to the name of the newly created secret.
+
+*Add Custom Certificates*
+
+To add your custom Certificate Authority(CA) to your containers, you can mount your CA certificate directly into /etc/ssl/certs folder.
+
+```yaml
+   extraVolumes: 
+     - name: self-signed-ca
+       secret:
+         secretName: self-signed-ca-secret
+   extraVolumeMounts: 
+     - name: self-signed-ca
+       mountPath: "/etc/ssl/certs/myCA.pem"
+       subPath: myCA.pem
+```
+
+#### Enabling gateway autoscaling
+You can enable autoscaling of the gateway by `--set tyk-gateway.gateway.autoscaling.enabled=true`. By default, it will enable the `Horizontal Pod Autoscaler` resource with target average CPU utilization at 60%, scaling between 1 and 3 instances. To customize those values you can modify the tyk-gateway section of `values.yaml`, as shown below:
+
+```yaml
+tyk-gateway:
+  gateway:
+    autoscaling:
+      enabled: true
+      minReplicas: 3
+      maxReplicas: 30
+```
+
+Built-in rules include `tyk-gateway.gateway.autoscaling.averageCpuUtilization` for CPU utilization (set by default at 60%) and `tyk-gateway.gateway.autoscaling.averageMemoryUtilization` for memory (disabled by default). In addition to that you can define rules for custom metrics using `tyk-gateway.gateway.autoscaling.autoscalingTemplate` list:
+
+```yaml
+tyk-gateway:
+  gateway:
+    autoscaling:
+      autoscalingTemplate:
+        - type: Pods
+          pods:
+            metric:
+              name: nginx_ingress_controller_nginx_process_requests_total
+            target:
+              type: AverageValue
+              averageValue: 10000m
+```
+
+#### Accessing Gateway
+
+*Service port*
+
+Default service port of gateway is 8080. You can change this at `global.servicePorts.gateway`.
+
+*Ingress*
+
+An Ingress resource is created if `tyk-gateway.gateway.ingress.enabled` is set to true.
+
+```yaml
+tyk-gateway:
+  gateway:
+    ingress:
+      # if enabled, creates an ingress resource for the gateway
+      enabled: true
+
+      # specify ingress controller class name
+      className: ""
+
+      # annotations for ingress
+      annotations: {}
+
+      # ingress rules
+      hosts:
+        - host: tyk-gw.local
+          paths:
+            - path: /
+              pathType: ImplementationSpecific
+
+      # tls configuration for ingress
+      #  - secretName: chart-example-tls
+      #    hosts:
+      #      - chart-example.local
+      tls: []
+```
+
+*Control Port*
+
+Set `tyk-gateway.gateway.control.enabled` to true will allow you to run the [Gateway API](/tyk-gateway-api) on a separate port and protect it behind a firewall if needed.
+
+#### Mounting APIs, Policies, and Middleware
+
+By default, the Gateway stores API configurations at `/mnt/tyk-gateway/apps` inside the Gateway container. There are a a few challenges:
+- Multiple gateways do not share app configs
+- The configuration is not persistent. i.e. it will not be retained whenever a pod restarts.
+
+The same applies to security policies and middleware too, which are stored at `/mnt/tyk-gateway/policies` and `/mnt/tyk-gateway/middleware` respectively.
+
+This can be solved by instantiating a Persistent Volume as shared storage for the gateway instances. As each gateway is reloaded, they would get the API configurations from the same storage, solving the synchronisation issue between gateways. Also, the storage is persistent and can be designed to be resilient to cluster failure, thus your API configurations can be maintained after pod restart.
+
+You can configure persistent volume for APIs, Policies, and middleware using `extraVolumes` and `extraVolumeMounts`:
+
+```yaml
+    extraVolumes:
+    - name: tyk-app-storage
+      persistentVolumeClaim:
+        claimName: tyk-app-claim
+    - name: tyk-policies-storage
+      persistentVolumeClaim:
+        claimName: tyk-policies-claim
+    - name: tyk-middleware-storage
+      persistentVolumeClaim:
+        claimName: tyk-middleware-claim
+
+    extraVolumeMounts: 
+    - name: tyk-app-storage
+      mountPath: /mnt/tyk-gateway/apps
+    - name: tyk-policies-storage
+      mountPath: /mnt/tyk-gateway/policies
+    - name: tyk-middleware-storage
+      mountPath: /mnt/tyk-gateway/middleware
+```
+
+For further details for configuring Tyk Gateway, consult the [Tyk Gateway Configuration Options](/tyk-oss-gateway/configuration) guide.
+
+#### OpenTelemetry
+To enable OpenTelemetry for Gateway set `gateway.opentelemetry.enabled` flag to true. It is disabled by default.
+
+You can also configure connection settings for it's exporter. By default `grpc` exporter is enabled on `localhost:4317` endpoint.
+
+ To enable TLS settings for the exporter, you can set `gateway.opentelemetry.tls.enabled` to true. 
+
+#### Liveness and readiness probes
+Gateway liveness probes can be customised via `gateway.livenessProbe` field. All fields from PodLivenessProbe object can be added here. If set to empty or nil, the default health check on /health will be performed.
+
+Gateway readiness probes can be customised via `gateway.readinessProbe` field. All fields from PodReadinessProbe object can be added here. If set to empty or nil, the default health check on /health will be performed.
+
+### Pump Configurations
+
+To enable Pump, set `global.components.pump` to true, and configure below inside `tyk-pump` section.
+
+| Pump                      | Configuration                                                                                              |
+| :--------------------------- | :------------------------------------------------------------------------------------------------------------ | 
+| Prometheus Pump (Default) | Add `prometheus` to `tyk-pump.pump.backend`, and add connection details for prometheus under `tyk-pump.pump.prometheusPump`. |
+| Mongo Pump                | Add `mongo` to `tyk-pump.pump.backend`, and add connection details for mongo under `global.mongo`.                 |
+| SQL Pump                  | Add `postgres` to `tyk-pump.pump.backend`, and add connection details for postgres under `global.postgres`.        |
+| Uptime Pump               | Set `tyk-pump.pump.uptimePumpBackend` to `'mongo'` or `'postgres'`                                                 |
+| Other Pumps               | Add the required environment variables in `tyk-pump.pump.extraEnvs`                                                |
+
+#### Prometheus Pump
+Add `prometheus` to `tyk-pump.pump.backend`, and add connection details for Prometheus under `tyk-pump.pump.prometheusPump`. 
+
+We also support monitoring using Prometheus Operator. All you have to do is set `tyk-pump.pump.prometheusPump.prometheusOperator.enabled` to true.
+This will create a *PodMonitor* resource for your Pump instance.
+
+See [Prometheus](/api-management/metrics/metrics-pumps#kubernetes) for a guide on setting up the Prometheus pump on Kubernetes.
+
+#### Mongo Pump
+If you are using the MongoDB pumps in the tyk-oss installation you will require MongoDB installed for that as well.
+
+To install MongoDB you can use these rather excellent charts provided by Bitnami:
+
+```bash
+helm install tyk-mongo bitnami/mongodb --set "replicaSet.enabled=true" -n tyk --version 15.1.3 --set image.repository=bitnamilegacy/mongodb
+```
+
+
+<Note>
+Bitnami MongoDB image is not supported on darwin/arm64 architecture.
+</Note>
+
+
+
+<Note>
+Please make sure you are installing MongoDB versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#requirements).
+</Note>
+
+
+Follow notes from the installation output to get connection details and update them in the `values.yaml` file.
+
+*Important Note regarding MongoDB:* This helm chart enables the PodDisruptionBudget for MongoDB with an arbiter replica-count of 1. If you intend to perform system maintenance on the node where the MongoDB pod is running and this maintenance requires for the node to be drained, this action will be prevented due the replica count being 1. Increase the replica count in the helm chart deployment to a minimum of 2 to remedy this issue.
+
+Add the following configuration under the `global` section in `values.yaml`:
+
+```yaml
+global:
+ # Set mongo connection details if you want to configure mongo pump.
+ mongo:
+   # The mongoURL value will allow you to set your MongoDB address.
+   # Default value: mongodb://mongo.{{ .Release.Namespace }}.svc:27017/tyk_analytics
+   # mongoURL: mongodb://mongo.tyk.svc:27017/tyk_analytics
+   # If your MongoDB has a password you can add the username and password to the url
+   # mongoURL: mongodb://root:pass@tyk-mongo-mongodb.tyk.svc:27017/tyk_analytics?authSource=admin
+   mongoURL: <MongoDB address>
+
+   # mongo-go driver is supported for Tyk 5.0.2+.
+   # We recommend using the `mongo-go` driver if you are using MongoDB 4.4.x+.
+   # For MongoDB versions prior to 4.4, please use the `mgo` driver.
+   # Since Tyk 5.3 the default driver is mongo-go.
+   driver: mongo-go
+
+   # Enables SSL for MongoDB connection. MongoDB instance will have to support that.
+   # Default value: false
+   # useSSL: false
+```
+
+#### SQL Pump
+If you are using the SQL Pumps in the tyk-oss installation you will require PostgreSQL installed for that as well.
+
+To install PostgreSQL you can use these rather excellent charts provided by Bitnami:
+
+```bash
+helm install tyk-postgres bitnami/postgresql --set "auth.database=tyk_analytics" -n tyk --version 12.12.10 --set image.repository=bitnamilegacy/postgresql
+```
+
+
+<Note>
+Please make sure you are installing PostgreSQL versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#requirements).
+</Note>
+
+
+Follow the notes from the installation output to get connection details and update them in `values.yaml` file.
+
+Add the following configuration under the `global` section in `values.yaml`:
+
+```yaml
+global:
+  # Postgres connection string parameters.
+  postgres:
+    # host corresponds to the host name of postgres
+    host: tyk-postgres-postgresql.tyk.svc
+    # port corresponds to the port of postgres
+    port: 5432
+    # user corresponds to the user of postgres
+    user: postgres
+    # password corresponds to the password of the given postgres user in selected database
+    password:
+    # database corresponds to the database to be used in postgres
+    database: tyk_analytics
+    # sslmode corresponds to if postgres runs in sslmode (https)
+    sslmode: disable
+    # Connection string can also be set using a secret. Provide the name of the secret and key below.
+    # connectionStringSecret:
+    #   name: ""
+    #   keyName: ""
+```
+
+#### Uptime Pump
+Uptime Pump can be configured by setting `tyk-pump.pump.uptimePumpBackend` in values.yaml file. It supports the following values
+1. mongo: Used to set Mongo Pump for uptime analytics. Mongo Pump should be enabled.
+2. postgres: Used to set Postgres Pump for uptime analytics. Postgres Pump should be enabled.
+3. empty: Used to disable uptime analytics.
+
+#### Other Pumps
+To setup other backends for pump, refer to this [document](https://github.com/TykTechnologies/tyk-pump/blob/master/README.md#pumps--back-ends-supported) and add the required environment variables in `tyk-pump.pump.extraEnvs`
+
+### Tyk Operator Configurations
+
+Tyk Operator is a licensed component that requires a valid key for operation. 
+Please refer to the [Tyk Operator Installation Guide](/tyk-stack/tyk-operator/installing-tyk-operator)
+for detailed information on the installation and upgrade processes. 
+
+Prior to installing Tyk Operator, ensure that a valid license key is provided by setting `global.license.operator` field in values.yaml file. You can set license key via a Kubernetes secret using `global.secrets.useSecretName` field. The secret should contain a key called `OperatorLicense`.
+
+In order to enable installing Tyk Operator along-side Tyk OSS installation, please set `global.components.operator` to `true`.
+
+All other configurations related to Tyk Operator are available under `tyk-operator` section of `values.yaml` file.
+
+> Tyk Operator needs a cert-manager to be installed. Ensure that cert-manager is installed as described in the official documentation: [Installing Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator).
diff --git a/product-stack/tyk-charts/tyk-stack-chart.mdx b/product-stack/tyk-charts/tyk-stack-chart.mdx
new file mode 100644
index 0000000000..8797640a8d
--- /dev/null
+++ b/product-stack/tyk-charts/tyk-stack-chart.mdx
@@ -0,0 +1,954 @@
+---
+title: "Tyk Stack Chart"
+description: "Install and configure Tyk Stack Chart"
+keywords: "Tyk Stack chart, Tyk Stack Chart, helm charts, helm, charts, kubernetes, k8s"
+sidebarTitle: "Tyk Stack Chart"
+---
+
+The `tyk-stack` chart provides the default deployment of Tyk Self Managed on a Kubernetes cluster. It will deploy all required Tyk components with the settings provided in the values.yaml file.
+
+## What components are deployed with Tyk Stack Chart?
+
+It includes:
+- Tyk Gateway, an Open Source Enterprise API Gateway (supporting REST, GraphQL, TCP and gRPC protocols).
+- Tyk Pump, an analytics purger that moves the data generated by your Tyk nodes to any back-end. Furthermore, it has all the required modifications to easily connect to Tyk Cloud or Multi Data Center (MDCB) control plane.
+- Tyk Dashboard, a license based component that provides a graphical management interface and analytics platform for Tyk.
+- Tyk Developer Portal, a full-fledged CMS-like system for API providers to publish, monetize and drive the adoption of APIs.
+
+By default, this chart installs the following components as sub-charts on a [Kubernetes](https://kubernetes.io/) cluster using the [Helm](https://helm.sh/) package manager.
+
+| Component                       | Enabled by Default | Flag                        |
+| :--------------------------------- | :-------------------- | :----------------------------- |
+| Tyk Gateway                     | true               | n/a                         |
+| Tyk Dashboard                   | true               | n/a                         |
+| Tyk Pump                        | true               | global.components.pump      |
+| Tyk Enterprise Developer Portal | false              | global.components.devPortal | 
+| Tyk Operator                    | false              | global.components.operator  |
+
+To enable or disable each component, change the corresponding enabled flag.
+
+Also, you can set the version of each component through `image.tag`. You can find the list of version tags available from [Docker hub](https://hub.docker.com/u/tykio).
+
+For quick start guide, please see [Quick Start with Helm Chart](/tyk-self-managed/install/kubernetes#instructions).
+
+## Prerequisites
+
+* [Kubernetes 1.19+](https://kubernetes.io/docs/setup/)
+* [Helm 3+](https://helm.sh/docs/intro/install/)
+* [Redis](/tyk-configuration-reference/redis-cluster-sentinel) should already be installed or accessible by the gateway and dashboard.
+* [MongoDB](https://www.mongodb.com) or [PostgreSQL](https://www.postgresql.org) should already be installed or accessible by dashboard. Please consult the list of [supported versions](/tyk-self-managed/install#requirements) that are compatible with Tyk.
+
+
+
+    <Note>
+    If you want to enable Tyk Developer Portal, please use PostgreSQL. MongoDB is not supported in Developer Portal.
+    </Note>
+
+
+## Tyk Stack Installations
+### Installing The Chart
+
+To install the chart from Helm repository in namespace `tyk` with the release name `tyk-stack`:
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+helm show values tyk-helm/tyk-stack > values.yaml
+```
+
+For further documentation relating to *helm* command usage, please refer to the [helm docs](https://helm.sh/docs/helm/).
+
+At a minimum, modify values.yaml for the following settings:
+1. [Set Redis connection details](#set-redis-connection-details-required)
+2. [Set Mongo or PostgresSQL connection details](#set-mongo-or-postgressql-connection-details-required)
+3. [Dashboard License](#tyk-dashboard-license-required)
+
+If you would like to use Developer Portal, an additional license is required:
+
+4. [Developer Portal License](#tyk-developer-portal-license-required)
+
+Then just run:
+```bash
+helm install tyk-stack tyk-helm/tyk-stack -n tyk --create-namespace -f values.yaml
+```
+
+### Uninstalling The Chart
+
+```bash
+helm uninstall tyk-stack -n tyk
+```
+This removes all the Kubernetes components associated with the chart and deletes the release.
+
+### Upgrading Chart
+
+```bash
+helm upgrade tyk-stack tyk-helm/tyk-stack -n tyk -f values.yaml
+```
+
+## Configuration
+
+To list all configurable options with detailed comments:
+
+```bash
+helm show values tyk-helm/tyk-stack > values.yaml
+```
+
+You can update any value in your local `values.yaml` file and use `-f [filename]` flag to override default values during installation. 
+Alternatively, you can use `--set` flag to set it in Tyk installation. See [Using Helm](https://helm.sh/docs/intro/using_helm/) for examples.
+
+To configure Tyk components, users can utilize both config files and [environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/). Notably, environment variables take precedence over config files. To maintain simplicity and consistency, the Tyk Helm Charts deploy components with an empty config file while setting container environment variables based on user-defined [values](https://helm.sh/docs/chart_best_practices/values/). This approach ensures seamless integration with Kubernetes practices, allowing for efficient management of configurations. For a comprehensive overview of available configurations, please refer to the [configuration documentation](/tyk-oss-gateway/configuration). 
+
+### Bootstrapping
+
+By default, the chart executes a bootstrapping job immediately after installation. This process ensures the presence of a valid dashboard license and initializes key components such as tyk-dashboard, tyk-portal, and tyk-operator, enabling them for immediate use.
+
+The bootstrapping job uses three distinct applications acting as Helm chart hooks:
+
+| **Bootstrapping Component** | **Description** |
+| :----------------------------- | :----------------- |
+| `bootstrap-pre-install`     | - Runs as a pre-install hook. <br /> - Validates the Tyk Dashboard license key to ensure proper installation prerequisites. |
+| `bootstrap-post-install`    | - Executes post-installation. <br /> - Sets up an organization and admin user in the Tyk Dashboard. <br /> - Creates Kubernetes secrets required by Tyk Operator and Tyk Enterprise Portal. <br /> **Note**: If an existing organization and admin user are found in the database, the bootstrapping job will not set up a new organization and user. The Kubernetes secrets will not contain the expected Org ID or API key. Please update the Secret with existing credentials in this case. |
+| `bootstrap-pre-delete`      | - Functions as a pre-delete hook. <br /> - Cleans up resources, ensuring no residual configurations remain post-uninstallation. |
+
+Key Notes on Bootstrapping:
+
+- Bootstrapping is triggered **only during** a `helm install` and does not run during a `helm upgrade`.
+- If `global.components.bootstrap` is set to `false`, only the dashboard license check will be performed. 
+
+Handling Bootstrapping Failures:
+
+- If the bootstrapping process fails, check the logs from the bootstrap pods to diagnose the issue.
+- Once reviewed, you can safely delete the bootstrap pods.
+- To re-trigger the bootstrapping process after a failure, you must run `helm uninstall` and start the installation process anew.
+
+### Setting Environment Variables
+Should any environment variables not be set by the Helm Chart, users can easily add them under the `extraEnvs` section within the charts for further customization. Values set under `extraEnvs` would take precedence over all configurations.
+
+Example of setting extra environment variable to gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: TYK_GW_LOGLEVEL
+      value: debug
+```
+
+An example is listed below for setting extra [environment variable using ConfigMap data](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#define-container-environment-variables-using-configmap-data), using gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: CONFIG_USERNAME
+      valueFrom:
+        configMapKeyRef: 
+          name: backend-user
+          key: backend-username
+```
+
+An example is listed below for setting extra [environment variable using secret data](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data), using gateway:
+```yaml
+tyk-gateway:
+  gateway:
+    extraEnvs:
+    - name: SECRET_USERNAME
+      valueFrom:
+        secretKeyRef: 
+          name: backend-user
+          key: backend-username
+```
+
+In the above example, an extra environment variable `SECRET_USERNAME` will be added to the Gateway container, with a value of `backend-username` associated with the secret `backend-user`. It is useful if you want to access secret data from [Tyk Gateway configuration file (tyk.conf) or API definitions](/tyk-configuration-reference/kv-store).
+
+### Set Redis Connection Details (Required)
+
+Tyk uses Redis for distributed rate-limiting and token storage. You may use the Bitnami chart to install or Tyk's `simple-redis` chart for POC purpose.
+
+Set the following values after installing Redis:
+
+| Name | Description | 
+| :------ | :------------- |
+| `global.redis.addrs` | Redis addresses |
+| `global.redis.pass` | Redis password in plain text |
+| `global.redis.passSecret.name` | If global.redis.pass is not provided, you can store it in a secret and provide the secret name here |
+| `global.redis.passSecret.keyName` | key name to retrieve redis password from the secret |
+
+***Recommended: via *Bitnami* chart***
+
+For Redis you can use these rather excellent charts provided by [Bitnami](https://github.com/bitnami/charts/tree/main/bitnami/redis).
+Copy the following commands to add it:
+
+```bash
+helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n tyk --create-namespace --install --version 19.0.2 --set image.repository=bitnamilegacy/redis
+```
+
+
+<Note>
+Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#redis).
+</Note>
+
+
+Follow the notes from the installation output to get connection details and password.
+
+```
+  Redis(TM) can be accessed on the following DNS names from within your cluster:
+
+    tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
+    tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)
+
+  export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)
+```
+
+The Redis address as set by Bitnami is `tyk-redis-master.tyk.svc.cluster.local:6379`
+
+You can reference the password secret generated by Bitnami chart by  `--set global.redis.passSecret.name=tyk-redis` and `--set global.redis.passSecret.keyName=redis-password`, or just set `global.redis.pass=$REDIS_PASSWORD`
+
+***Evaluation only: via *simple-redis* chart***
+
+Another option for Redis, to get started quickly, is to use our [simple-redis](https://artifacthub.io/packages/helm/tyk-helm/simple-redis) chart.
+
+
+<Warning>
+Please note that these provided charts must never be used in production or for anything
+but a quick start evaluation only. Use [Bitnami Redis](https://github.com/bitnami/charts/tree/main/bitnami/redis) or [Official Redis installation guides](https://redis.io/docs/install/) in any other case.
+We provide this chart, so you can quickly deploy *Tyk gateway*, but it is not meant for long term storage of data.
+</Warning>
+
+
+```bash
+helm install redis tyk-helm/simple-redis -n tyk
+```
+
+The Tyk Helm Chart can connect to `simple-redis` in the same namespace by default. You do not need to set Redis address and password in `values.yaml`.
+
+### Set Mongo or PostgresSQL Connection Details (Required)
+If you have already installed MongoDB or PostgreSQL, you can set the connection details in the `global.mongo` and `global.postgres` sections of the values.yaml file respectively.
+
+If not, you can use these rather excellent charts provided by Bitnami to install MongoDB or PostgreSQL:
+
+**Mongo Installation**
+
+```bash
+helm repo add bitnami https://charts.bitnami.com/bitnami
+helm install tyk-mongo bitnami/mongodb --set "replicaSet.enabled=true" -n tyk --version 15.1.3 --set image.repository=bitnamilegacy/mongodb
+```
+
+
+<Note>
+Bitnami MongoDB image is not supported on darwin/arm64 architecture.
+</Note>
+
+
+Then follow notes from the installation output to get connection details and update them in `values.yaml` file.
+
+
+<Note>
+Please make sure you are installing MongoDB versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#requirements).
+</Note>
+
+
+
+<Note>
+Important Note regarding MongoDB:
+
+This helm chart enables the `PodDisruptionBudget` for MongoDB with an arbiter replica-count of 1. If you intend to perform system maintenance on the node where the MongoDB pod is running and this maintenance requires the node to be drained, then this action will be prevented due to the the replica count being 1.
+
+Increase the replica count in the helm chart deployment to a minimum of 2 to remedy this issue.
+</Note>
+
+
+Configure `global.mongo.mongoURL` and `global.storageType` as below. You should replace password in the connection string with the MONGODB_ROOT_PASSWORD you obtain from the installation output notes.
+
+```yaml
+global:
+  # Set mongo connection details if you want to configure mongo pump.
+  mongo:
+    # The mongoURL value will allow you to set your MongoDB address.
+    # Default value: mongodb://mongo.{{ .Release.Namespace }}.svc:27017/tyk_analytics
+    # mongoURL: mongodb://mongo.tyk.svc:27017/tyk_analytics
+
+    # If your MongoDB has a password you can add the username and password to the url
+    mongoURL: mongodb://root:pass@tyk-mongo-mongodb.tyk.svc:27017/tyk_analytics?authSource=admin
+
+    # mongo-go driver is supported for Tyk 5.0.2+.
+    # We recommend using the mongo-go driver if you are using MongoDB 4.4.x+.
+    # For MongoDB versions prior to 4.4, please use the mgo driver.
+    # Since Tyk 5.3 the default driver is mongo-go.
+    driver: mongo-go
+
+    # Connection URL can also be set using a secret. Provide the name of the secret and key below.
+    # connectionURLSecret:
+    #   name: ""
+    #   keyName: ""
+
+    # Enables SSL for MongoDB connection. MongoDB instance will have to support that.
+    # Default value: false
+    useSSL: false
+
+  # Choose the storageType for Tyk. [ "mongo", "postgres" ]
+  storageType: &globalStorageType mongo
+```
+
+**PostgresSQL Installation**
+```bash
+helm repo add bitnami https://charts.bitnami.com/bitnami
+helm install tyk-postgres bitnami/postgresql --set "auth.database=tyk_analytics" -n tyk --version 12.12.10 --set image.repository=bitnamilegacy/postgresql
+```
+
+Follow the notes from the installation output to get connection details.
+
+
+<Note>
+Please make sure you are installing PostgreSQL versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#requirements).
+</Note>
+
+
+```yaml
+global:
+  # PostgreSQL connection string parameters.
+  postgres:
+    # host corresponds to the host name of postgreSQL
+    host: tyk-postgres-postgresql.tyk.svc
+    # port corresponds to the port of postgreSQL
+    port: 5432
+    # user corresponds to the user of postgreSQL
+    user: postgres
+    # password corresponds to the password of the given postgres user in selected database
+    password:
+    # database corresponds to the database to be used in postgreSQL
+    database: tyk_analytics
+    # sslmode corresponds to if postgreSQL runs in sslmode (https)
+    sslmode: disable
+    # Connection string can also be set using a secret. Provide the name of the secret and key below.
+    # connectionStringSecret:
+    #   name: ""
+    #   keyName: ""
+```
+
+### Protect Confidential Fields with Kubernetes Secrets
+
+In the `values.yaml` file, some fields are considered confidential, such as `APISecret`, connection strings, etc.
+Declaring values for such fields as plain text might not be desired. Instead, for certain fields,
+Kubernetes secrets can be referenced and the chart will [define container environment variables using secret data](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data).
+
+This section describes how to use Kubernetes secrets to declare confidential fields.
+
+***Tyk Dashboard and Developer Portal Admin***
+
+If Tyk Dashboard bootstrapping is enabled, the admin user will be created according to the `global.adminUser` field.
+
+All admin credentials can also be set through Kubernetes secret.
+
+
+<Note>
+Once `global.adminUser.useSecretName` is declared, it takes precedence over `global.adminUser.firstName`, 
+`global.adminUser.lastName`, `global.adminUser.email` and `global.adminUser.password`.
+
+If `global.adminUser.useSecretName` is in use, please add all keys mentioned below to the secret.
+</Note>
+
+
+***Tyk Dashboard Admin First Name***
+
+It can be configured via `global.adminUser.firstName` as a plain text or Kubernetes secret which includes `adminUserFirstName` key in it. Then, this secret must be referenced via `global.adminUser.useSecretName`.
+
+
+***Tyk Dashboard Admin Last Name***
+
+It can be configured via `global.adminUser.lastName` as a plain text or Kubernetes secret which includes `adminUserLastName` key in it. Then, this secret must be referenced via `global.adminUser.useSecretName`.
+
+***Tyk Dashboard and Developer Portal Admin Email***
+
+It can be configured via `global.adminUser.email` as a plain text or Kubernetes secret which includes `adminUserEmail` key in it. Then, this secret must be referenced via `global.adminUser.useSecretName`.
+
+
+***Tyk Dashboard and Developer Portal Admin Password***
+
+It can be configured via `global.adminUser.password` as a plain text or Kubernetes secret which includes `adminUserPassword` key in it. Then, this secret must be referenced via `global.adminUser.useSecretName`.
+
+***APISecret***
+
+The `global.secrets.APISecret` field configures a [header value](/tyk-oss-gateway/configuration#secret) used in every interaction with Tyk Gateway API.
+
+It can be configured via `global.secrets.APISecret` as a plain text or Kubernetes secret which includes `APISecret` key in it. Then, this secret must be referenced via `global.secrets.useSecretName`.
+
+```yaml
+global:
+    secrets:
+        APISecret: CHANGEME
+        useSecretName: "mysecret" # where mysecret includes `APISecret` key with the desired value.
+```
+
+***AdminSecret***
+
+The `global.secrets.AdminSecret` field sets a [secret](/tyk-dashboard/configuration#admin_secret) for Admin API.
+
+It can be configured via `global.secrets.AdminSecret` as a plain text or Kubernetes secret which includes `AdminSecret` key in it. Then, this secret must be referenced via `global.secrets.useSecretName`.
+
+```yaml
+global:
+    secrets:
+        useSecretName: "mysecret" # where mysecret includes `AdminSecret` key with the desired value.
+```
+
+
+<Note>
+Once `global.secrets.useSecretName` is declared, it takes precedence over `global.secrets.APISecret` and `global.secrets.AdminSecret`.
+</Note>
+
+
+***Dashboard License***
+
+In order to refer Tyk Dashboard license using a Kubernetes secret, please use `global.secrets.useSecretName`, where the secret should contain a key called `DashLicense`.
+
+***Tyk Developer Portal License***
+
+In order to refer Tyk Developer Portal license using a Kubernetes secret, please use 
+`tyk-dev-portal.useSecretName`, where the secret should contain a key called `DevPortalLicense`.
+
+***Tyk Developer Portal Admin Password***
+
+In order to refer Tyk Developer Portal's admin password using a Kubernetes secret, 
+please use `global.adminUser.useSecretName`, where the secret should contain a key called `adminUserPassword`.
+
+***Tyk Developer Portal Storage Connection String***
+
+In order to refer Tyk Developer Portal connection string to the selected database using a Kubernetes secret, please use `tyk-dev-portal.useSecretName`, where the secret should contain a key called 
+`DevPortalStorageConnectionString`.
+
+
+<Note>
+If `tyk-dev-portal.useSecretName` is in use, please add all keys mentioned to the secret.
+</Note>
+
+
+***Tyk Developer Portal AWS S3 Access Key ID***
+
+In order to refer to the Tyk Developer Portal AWS S3 Access Key ID using a Kubernetes secret, please use `tyk-dev-portal.useSecretName`, where the secret should contain a key called `DevPortalAwsAccessKeyId`.
+
+
+<Note>
+If `tyk-dev-portal.useSecretName` is in use, please add all keys mentioned to the secret.
+</Note>
+
+
+***Tyk Developer Portal AWS S3 Secret Access Key***
+
+In order to refer Tyk Developer Portal connection string to the selected database through Kubernetes secret,
+please use `tyk-dev-portal.useSecretName`, where the secret should contain a key called 
+`DevPortalAwsSecretAccessKey`.
+
+
+<Note>
+If `tyk-dev-portal.useSecretName` is in use, please add all keys mentioned to the secret.
+</Note>
+
+
+***Redis Password***
+
+Redis password can also be provided via a secret. Store the Redis password in a Kubernetes secret and refer to this secret as follows:
+
+```yaml
+global:  
+  redis:
+     passSecret:
+       name: "yourSecret"
+       keyName: "redisPassKey"
+```
+
+***MongoDB or PostgreSQL connection strings***
+
+Storage connection strings can also be provided via a secret. Store the connection string in Kubernetes secret and refer to this secret via `global.{mongo,postgres}.connectionURLSecret.name` and `global.{mongo,postgres}.connectionURLSecret.keyName` field, as follows:
+
+- MongoDB:
+```yaml
+global:  
+  mongo:
+    connectionURLSecret:
+       name: "yourSecret"
+       keyName: "mongoConnectionURLkey"
+```
+
+- PostgreSQL:
+```yaml
+global:
+  postgres:
+    connectionStringSecret:
+       name: "yourSecret"
+       keyName: "postgreConnectionURLkey"
+```
+
+***Tyk Operator License***
+
+It can be configured via `global.license.operator` as a plain text or Kubernetes secret which includes `OperatorLicense` key in it. Then, this secret must be referenced via `global.secrets.useSecretName`.
+
+Note: If you are using `global.secrets.useSecretName`, you must configure the operator license in the referenced Kubernetes secret. `global.license.operator` will not be used in this case.
+
+### Gateway Configurations
+
+This section explains how to configure the `tyk-gateway` section for updating the Gateway version, enabling TLS, enabling autoscaling etc.
+
+#### Update Tyk Gateway Version
+Set version of gateway at `tyk-gateway.gateway.image.tag`. You can find the list of version tags available from [Docker hub](https://hub.docker.com/r/tykio/tyk-gateway/tags). Please check [Tyk Release notes](/developer-support/release-notes/gateway) carefully while upgrading or downgrading.
+
+#### Enabling TLS
+
+*Enable TLS*
+
+We have provided an easy way to enable TLS via the `global.tls.gateway` flag. Setting this value to true will
+automatically enable TLS using the certificate provided under tyk-gateway/certs/.
+
+*Configure TLS secret*
+
+If you want to use your own key/cert pair, please follow the following steps:
+1. Create a TLS secret using your cert and key pair.
+2. Set `global.tls.gateway` to true.
+3. Set `global.tls.useDefaultTykCertificate` to false.
+4. Set `tyk-gateway.gateway.tls.secretName` to the name of the newly created secret.
+
+*Add Custom Certificates*
+
+To add your custom Certificate Authority(CA) to your containers, you can mount your CA certificate directly into /etc/ssl/certs folder.
+
+```yaml
+   extraVolumes: 
+     - name: self-signed-ca
+       secret:
+         secretName: self-signed-ca-secret
+   extraVolumeMounts: 
+     - name: self-signed-ca
+       mountPath: "/etc/ssl/certs/myCA.pem"
+       subPath: myCA.pem
+```
+
+#### Enabling gateway autoscaling
+You can enable autoscaling of the gateway by `--set tyk-gateway.gateway.autoscaling.enabled=true`. By default, it will enable the `Horizontal Pod Autoscaler` resource with target average CPU utilization at 60%, scaling between 1 and 3 instances. To customize those values you can modify the tyk-gateway section of the `values.yaml` file as shown below:
+
+```yaml
+tyk-gateway:
+  gateway:
+    autoscaling:
+      enabled: true
+      minReplicas: 3
+      maxReplicas: 30
+```
+
+Built-in rules include `tyk-gateway.gateway.autoscaling.averageCpuUtilization` for CPU utilization (set by default at 60%) and `tyk-gateway.gateway.autoscaling.averageMemoryUtilization` for memory (disabled by default). In addition to that you can define rules for custom metrics using `tyk-gateway.gateway.autoscaling.autoscalingTemplate` list:
+
+```yaml
+tyk-gateway:
+  gateway:
+    autoscaling:
+      autoscalingTemplate:
+        - type: Pods
+          pods:
+            metric:
+              name: nginx_ingress_controller_nginx_process_requests_total
+            target:
+              type: AverageValue
+              averageValue: 10000m
+```
+
+#### Accessing Gateway
+
+*Service port*
+
+Default service port of gateway is 8080. You can change this at `global.servicePorts.gateway`.
+
+*Ingress*
+
+An Ingress resource is created if `tyk-gateway.gateway.ingress.enabled` is set to true.
+
+```yaml
+    ingress:
+      # if enabled, creates an ingress resource for the gateway
+      enabled: true
+
+      # specify ingress controller class name
+      className: ""
+
+      # annotations for ingress
+      annotations: {}
+
+      # ingress rules
+      hosts:
+        - host: tyk-gw.local
+          paths:
+            - path: /
+              pathType: ImplementationSpecific
+
+      # tls configuration for ingress
+      #  - secretName: chart-example-tls
+      #    hosts:
+      #      - chart-example.local
+      tls: []
+```
+
+*Control Port*
+
+Set `tyk-gateway.gateway.control.enabled` to true will allow you to run the [Gateway API](/tyk-gateway-api) on a separate port and protect it behind a firewall if needed.
+
+#### Sharding
+
+Configure the gateways to load APIs with specific tags only by enabling `tyk-gateway.gateway.sharding.enabled`, and set `tags` to comma separated lists of matching tags.
+
+```yaml
+    # Sharding gateway allows you to selectively load APIs to specific gateways.
+    # If enabled make sure you have at least one gateway that is not sharded.
+    # Also be sure to match API segmentation tags with the tags selected below.
+    sharding:
+      enabled: true
+      tags: "edge,dc1,product"
+```
+
+#### Deploy additional gateway groups
+
+The `tyk-stack` chart manages one Gateway deployment in the same namespace as Tyk Dashboard. You can flexibly deploy additional gateways using `tyk-gateway` component chart. With gateway sharding, it is useful for:
+- Deploying Gateways in different networks,
+- Deploying Gateways with different resources and autoscaling parameters,
+- Allow different teams to manage their own Gateway instances in their own namespace.
+
+Here is an example configuration for `tyk-gateway` `values.yaml`.
+```yaml
+global:
+  redis:
+    addrs:
+      - tyk-redis-master.tyk-stack.svc:6379       # New Gateway groups should connect to the same Redis
+    pass: "xxxxxxx"
+
+gateway:
+  # If this option is set to true, it will enable polling the Tyk Dashboard service for API definitions
+  useDashboardAppConfig:
+    enabled: true
+      # Set it to the URL to your Dashboard instance (or a load balanced instance)
+      # The URL needs to be formatted as: http://dashboard_host:port
+      # It is used to set TYK_GW_DBAPPCONFOPTIONS_CONNECTIONSTRING
+      dashboardConnectionString: "http://dashboard-svc-tyk-tyk-dashboard.tyk-stack.svc:3000"
+
+      # This option is required if Policy source is set to Tyk Dashboard (`service`).
+      # Set this to the URL of your Tyk Dashboard installation.
+      # The URL needs to be formatted as: http://dashboard_host:port.
+      # It is used to set TYK_GW_POLICIES_POLICYCONNECTIONSTRING
+      policyConnectionString: "http://dashboard-svc-tyk-tyk-dashboard.tyk-stack.svc:3000"
+
+  ...
+
+  # Sharding gateway allows you to selectively load APIs to specific gateways.
+  # If enabled make sure you have at least one gateway that is not sharded.
+  # Also be sure to match API segmentation tags with the tags selected below.
+  sharding:
+    enabled: true
+    tags: "gw-dmz"
+
+  ...
+
+  # analyticsEnabled property is used to enable/disable analytics.
+  # If set to empty or nil, analytics will be enabled/disabled based on `global.components.pump`.
+  analyticsEnabled: "true"
+
+  # used to decide whether to send the results back directly to Tyk without a hybrid pump
+  # if you want to send analytics to control plane instead of pump, change analyticsConfigType to "rpc"
+  analyticsConfigType: ""
+```
+
+Run the following command to deploy additional Gateways in namespace `another-namespace`.
+```bash
+helm install another-gateway tyk-helm/tyk-gateway --namespace another-namespace -f values.yaml
+```
+
+#### OpenTelemetry
+To enable OpenTelemetry for Gateway set `gateway.opentelemetry.enabled` flag to true. It is disabled by default.
+
+You can also configure connection settings for it's exporter. By default `grpc` exporter is enabled on `localhost:4317` endpoint.
+
+ To enable TLS settings for the exporter, you can set `gateway.opentelemetry.tls.enabled` to true. 
+
+#### Liveness and readiness probes
+<a id="gateway-probes"></a>
+
+Gateway liveness probes can be customised via `gateway.livenessProbe` field. All fields from PodLivenessProbe object can be added here. If set to empty or nil, the default health check on /health will be performed.
+
+Gateway readiness probes can be customised via `gateway.readinessProbe` field. All fields from PodReadinessProbe object can be added here. If set to empty or nil, the default health check on /health will be performed.
+
+### Pump Configurations
+
+To enable Pump, set `global.components.pump` to true, and configure below inside `tyk-pump` section.
+
+| Pump                      | Configuration                                                                                              |
+| :--------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------- | 
+| Prometheus Pump (Default) | Add the value `prometheus` to the `tyk-pump.pump.backend` entry, and add connection details for Prometheus under `tyk-pump.pump.prometheusPump`. |
+| Mongo Pump                | Add `mongo` to `tyk-pump.pump.backend`, and add connection details for mongo under `global.mongo`.                                               |
+| Mongo Selective Pump      | Add `mongo-selective` to `tyk-pump.pump.backend`, and add connection details for mongo under `global.mongo`.                                     |
+| Mongo Aggregate Pump      | Add `mongo-aggregate` to `tyk-pump.pump.backend`, and add connection details for mongo under `global.mongo`.                                     |
+| Postgres Pump             | Add `postgres` to `tyk-pump.pump.backend`, and add connection details for postgres under `global.postgres`.                                      |
+| Postgres Aggregate Pump   | Add `postgres-aggregate` to `tyk-pump.pump.backend`, and add connection details for postgres under `global.postgres`.                            |
+| Uptime Pump               | Set `tyk-pump.pump.uptimePumpBackend` to `mongo` or `postgres` or `""`                                                                           |
+| Other Pumps               | Add the required environment variables in `tyk-pump.pump.extraEnvs`                                                                              |
+
+
+
+<Note>
+For additional information on Tyk Pump configurations, refer to the 
+[Control Plane Pumps](/api-management/dashboard-analytics/control-plane-pumps#choosing-a-pump-type) documentation.
+
+To explore the list of supported backends for Tyk Pump, please visit [Pump Backends](/api-management/logs/external-data-sinks).
+</Note>
+
+
+#### Prometheus Pump
+Add `prometheus` to `tyk-pump.pump.backend`, and add connection details for Prometheus under `tyk-pump.pump.prometheusPump`. 
+
+We also support monitoring using Prometheus Operator. All you have to do is set `tyk-pump.pump.prometheusPump.prometheusOperator.enabled` to true.
+
+This will create a _PodMonitor_ resource for your Pump instance.
+
+```yaml
+    # prometheusPump configures Tyk Pump to expose Prometheus metrics.
+    # Please add "prometheus" to .Values.pump.backend in order to enable Prometheus Pump.
+    prometheusPump:
+      # host represents the host without port, where Tyk Pump serve the metrics for Prometheus.
+      host: ""
+      # port represents the port where Tyk Pump serve the metrics for Prometheus.
+      port: 9090
+      # path represents the path to the Prometheus collection. For example /metrics.
+      path: /metrics
+      # customMetrics allows defining custom Prometheus metrics for Tyk Pump.
+      # It accepts a string that represents a JSON object. For instance,
+      #
+      # customMetrics: '[{"name":"tyk_http_requests_total","description":"Total of API requests","metric_type":"counter","labels":["response_code","api_name","method","api_key","alias","path"]},          {              "name":"tyk_http_latency",              "description":"Latency of API requests",              "metric_type":"histogram",              "labels":["type","response_code","api_name","method","api_key","alias","path"]          }]'
+      customMetrics: ""
+      # If you are using prometheus Operator, set the fields in the section below.
+      prometheusOperator:
+        # enabled determines whether the Prometheus Operator is in use or not. By default,
+        # it is disabled.
+        # Tyk Pump can be monitored with PodMonitor Custom Resource of Prometheus Operator.
+        # If enabled, PodMonitor resource is created based on .Values.pump.prometheusPump.prometheusOperator.podMonitorSelector
+        # for Tyk Pump.
+        enabled: false
+        # podMonitorSelector represents a podMonitorSelector of your Prometheus resource. So that
+        # your Prometheus resource can select PodMonitor objects based on selector defined here.
+        # Please set this field to the podMonitorSelector field of your monitoring.coreos.com/v1
+        # Prometheus resource's spec.
+        #
+        # You can check the podMonitorSelector via:
+        #   kubectl describe prometheuses.monitoring.coreos.com <PROMETHEUS_POD>
+        podMonitorSelector:
+          release: prometheus-stack
+```
+
+#### Mongo pump
+To enable Mongo pump, add `mongo` to `tyk-pump.pump.backend`, and add connection details for mongo under `global.mongo`. See [Mongo Installation](#set-mongo-or-postgressql-connection-details-required) section above.
+
+By default, it will enable Mongo Aggregate, Mongo Graph Pump and Mongo Selective Pump.
+
+
+#### SQL pump
+To enable SQL pump, add `postgres` to `tyk-pump.pump.backend`, and add connection details for postgres under `global.postgres`. See [PostgresSQL Installation](#set-mongo-or-postgressql-connection-details-required) section above.
+
+By default, it will enable Postgres Aggregate, Postgres Graph Aggregate, SQL Pump and SQL graph pump.
+
+#### Uptime Pump
+Uptime Pump can be configured by setting `pump.uptimePumpBackend` in values.yaml file. It supports the following values
+1. mongo: Used to set Mongo Pump for uptime analytics. Mongo Pump should be enabled.
+2. postgres: Used to set Postgres Pump for uptime analytics. Postgres Pump should be enabled.
+3. empty: Used to disable uptime analytics.
+
+```yaml
+    # uptimePumpBackend configures uptime Tyk Pump. ["", "mongo", "postgres"].
+    # Set it to "" for disabling uptime Tyk Pump. By default, uptime pump is disabled.
+    uptimePumpBackend: ""
+```
+
+#### Other Pumps
+To setup other backends for pump, refer to this [document](https://github.com/TykTechnologies/tyk-pump/blob/master/README.md#pumps--back-ends-supported) and add the required environment variables in `pump.extraEnvs`
+
+
+### Tyk Dashboard Configurations
+
+#### Tyk Dashboard License (Required)
+
+Tyk Dashboard License is required. It can be set up in `global.license.dashboard` or through secret `global.secrets.useSecretName`. The secret should contain a key called *DashLicense*.
+
+```yaml
+global:
+  license:
+    # The license key needed by Tyk Dashboard to work.
+    #
+    # NOTE: If you do not want to store license as a plain text in the file, you can use a Kubernetes secret
+    # that stores the dashboard license. Please see `.global.secrets.useSecretName`.
+    dashboard: ""
+```
+
+#### Enabling Dashboard TLS
+
+Assuming that TLS certificates for the Tyk Dashboard are available in the Kubernetes Secret `tyk-dashboard-tls`,
+follow these steps to enable TLS:
+
+1. Set `global.tls.dashboard` to `true`.
+2. Set `tyk-dashboard.dashboard.tls.secretName` to the name of the Kubernetes secret containing TLS certificates for the Tyk Dashboard, in this case, `tyk-dashboard-tls`.
+3. Define certificate configurations in `tyk-dashboard.dashboard.tls.certificates`, which generates `TYK_DB_HTTPSERVEROPTIONS_CERTIFICATES` for the Tyk Dashboard.
+
+Optional Steps, if needed:
+- Modify the secret mount path on the Tyk Dashboard Pod via `tyk-dashboard.dashboard.tls.certificatesMountPath`.
+- If necessary, either enable `insecureSkipVerify` via `tyk-dashboard.dashboard.tls.certificates`, or mount CA information through `tyk-dashboard.dashboard.extraVolumes` and `tyk-dashboard.dashboard.extraVolumeMounts`.
+- If the `tyk-bootstrap` chart is used to bootstrap the Tyk Dashboard, ensure that it has certificates to send requests to the Tyk Dashboard or enable `insecureSkipVerify` in the `tyk-bootstrap` chart.
+- If the Tyk Gateway connects to the Tyk Dashboard, confirm that the Tyk Gateway has appropriate certificates for connecting to the Tyk Dashboard
+
+#### Audit Log Configurations
+
+You can manage audit logging for Tyk Dashboard via `auditLogs`:
+
+- `auditLogs.enabled`: Enables or disables audit logging. It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_ENABLED`. Disabled by default.
+- `auditLogs.type`: Specifies the storage type for audit logs (`db` or `file`). It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_STORETYPE`. Set to `file` by default.
+- `auditLogs.format`: Defines the format of audit log files (`json` or `text`). It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_FORMAT`. Set to `text` by default.
+- `auditLogs.path`: Sets the path to the audit log file. It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_PATH`. Set to "" by default.
+- `auditLogs.enableDetailedRecording`: Enables detailed logging, including HTTP requests (headers only) and full HTTP responses. It sets corresponding Dashboard environment variable `TYK_DB_AUDIT_DETAILEDRECORDING`. Disabled by default.
+
+#### OPA Configurations
+<a id="opa-configurations"></a>
+
+You can manage OPA (Open Agent Policy) for Tyk Dashboard via `opa`:
+
+- `opa.enabled`: Enables OPA support. It sets corresponding Dashboard environment `TYK_DB_SECURITY_OPENPOLICY_ENABLED`. Disabled by default.
+- `opa.debug`: Activates OPA debug mode for detailed logging of policy execution. It sets corresponding Dashboard environment `TYK_DB_SECURITY_OPENPOLICY_DEBUG`. Disabled by default.
+- `opa.api`: Enables OPA API mode to manage policies via the Dashboard API. It sets corresponding Dashboard environment `TYK_DB_SECURITY_OPENPOLICY_ENABLEAPI`. Disabled by default.
+- `opa.allowAdminPasswordReset`: Required if OPA is enabled with its default policies. It sets corresponding Dashboard environment `TYK_DB_SECURITY_ALLOWADMINRESETPASSWORD`. Enabled by default.
+
+### Tyk Bootstrap Configurations
+
+To enable [bootstrapping](#bootstrapping), set `global.components.bootstrap` to `true`. It would run [tyk-k8s-bootstrap](https://github.com/TykTechnologies/tyk-k8s-bootstrap) to bootstrap `tyk-stack` and to create Kubernetes secrets that can be utilized in Tyk Operator and Tyk Developer Portal.
+
+
+<Note>
+During bootstrapping, admin user needs to reset its password. It may be denied by Dashboard OPA rules if [OPA](/platform-management/open-policy-agent) was enabled. Please disable OPA during the initial bootstrapping or set Dashboard configuration [TYK_DB_SECURITY_ALLOWADMINRESETPASSWORD](/tyk-dashboard/configuration#security-allow_admin_reset_password) to true.
+</Note>
+
+
+#### Bootstrapped Environments
+
+If Tyk is already bootstrapped, the application will bypass the creation of the Tyk Organization and Admin User, proceeding directly with the creation of Kubernetes Secrets.
+
+Given that the Kubernetes Secrets require values for `TYK_AUTH` and `TYK_ORG`, it is essential to provide these values through the respective environment variables, called `TYK_K8SBOOTSTRAP_TYK_ADMIN_AUTH` for `TYK_AUTH` and `TYK_K8SBOOTSTRAP_TYK_ORG_ID` for `TYK_ORG`.
+
+Ensure that these environment variables are set appropriately to `postInstall` hook for bootstrapped environments.
+
+### Tyk Developer Portal Configurations
+
+To enable Tyk Developer Portal, set `global.components.devPortal` to true, and configure below inside `tyk-dev-portal` section.
+
+#### Tyk Developer Portal License (Required)
+
+Tyk Developer Portal License is required. It can be set up in `tyk-dev-portal.license` or through secret `global.secrets.useSecretName`. The secret should contain a key called `DevPortalLicense`.
+
+```yaml
+tyk-dev-portal:
+  # Tyk Developer Portal license.
+  license: ""
+```
+
+#### Tyk Developer Portal Database
+
+
+<Note>
+Tyk no longer supports SQLite as of Tyk 5.7.0. To avoid disruption, please transition to [PostgreSQL](/planning-for-production/database-settings#postgresql), [MongoDB](/planning-for-production/database-settings#mongodb), or one of the listed compatible alternatives.
+</Note>
+
+
+By default, Tyk Developer Portal use `sqlite3` to store portal metadata. If you want to use other SQL Database, please modify the section below.
+
+```yaml
+tyk-dev-portal:
+  database:
+    # This selects the SQL dialect to be used
+    # The supported values are mysql, postgres and sqlite3
+    dialect: "sqlite3"
+    connectionString: "db/portal.db"
+    enableLogs: false
+    maxRetries: 3
+    retryDelay: 5000
+```
+
+#### Storage Settings
+
+Tyk Developer Portal supports different storage options for storing the portal's CMS assets such as images, theme files and Open API Specification files. Please see the [Developer Portal storage settings](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal-settings) page for all the available options. 
+
+If you use the file system as storage, please set `tyk-dev-portal.storage.type` to `fs`, and configure `tyk-dev-portal.storage.persistence` to mount an existing persistent volume to Tyk Developer Portal.
+
+If you use [AWS S3](https://aws.amazon.com/s3/) as storage, please set `tyk-dev-portal.storage.type` to `s3`, and configure `tyk-dev-portal.storage.s3` section with credentials to access AWS S3 bucket.
+
+If you use database as storage, please set `tyk-dev-portal.storage.type` to `db`, and configure the `tyk-dev-portal.database` section with database connection details.
+
+```yaml
+tyk-dev-portal:
+  # Sensitive configuration of Portal could be set using k8s secret
+  # You can set following fields:
+  # - DevPortalLicense - Sets LicenseKey for Developer Portal
+  # - DevPortalStorageConnectionString - Sets connectionString for Developer Portal
+  # - DevPortalAwsAccessKeyId - Sets AWS S3 Access Key ID
+  # - DevPortalAwsSecretAccessKey - Sets AWS S3 Secret Access Key
+  useSecretName: ""
+  # The hostname to bind the Developer Portal to.
+  hostName: tyk-dev-portal.org
+  # Developer Portal license.
+  license: ""
+  # Developer portal can be deployed as StatefulSet or as Deployment
+  kind: StatefulSet
+  storage:
+    # User can set the storage type for portal.
+    # Supported types: fs, s3, db
+    type: "db"
+    # Configuration values for using s3 as storage for Tyk Developer Portal
+    # In case you want to provide the key ID and access key via secrets please
+    # refer to the existing secret inside the helm chart or the
+    # .Values.useSecretName field
+    s3:
+      awsAccessKeyid: your-access-key
+      awsSecretAccessKey: your-secret-key
+      region: sa-east-1
+      endpoint: https://s3.sa-east-1.amazonaws.com
+      bucket: your-portal-bucket
+      acl: private
+      presign_urls: true
+    persistence:
+      mountExistingPVC: ""
+      storageClass: ""
+      accessModes:
+        - ReadWriteOnce
+      size: 8Gi
+      annotations: {}
+      labels: {}
+      selector: {}
+  database:
+    # This selects the SQL dialect to be used
+    # The supported values are mysql, postgres and sqlite3
+    dialect: "sqlite3"
+    connectionString: "db/portal.db"
+    enableLogs: false
+    maxRetries: 3
+    retryDelay: 5000
+```
+
+#### Other Configurations
+
+Other [Developer Portal configurations](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) can be set by using environment variables with `extraEnvs` fields, e.g.:
+
+```yaml
+tyk-dev-portal:
+  extraEnvs:
+  - name: PORTAL_LOG_LEVEL
+    value: debug
+```
+
+### Tyk Operator Configurations
+
+Tyk Operator is a licensed component that requires a valid key for operation. 
+Please refer to the [Tyk Operator Installation Guide](/tyk-stack/tyk-operator/installing-tyk-operator)
+for detailed information on the installation and upgrade processes. 
+
+Prior to installing Tyk Operator, ensure that a valid license key is provided by setting `global.license.operator` field in values.yaml file. You can set license key via a Kubernetes secret using `global.secrets.useSecretName` field. The secret should contain a key called `OperatorLicense`.
+
+In order to enable installing Tyk Operator along-side Tyk Stack installation, please set `global.components.operator`
+to `true`.
+
+All other configurations related to Tyk Operator are available under `tyk-operator` section of `values.yaml` file.
+
+> Tyk Operator needs a cert-manager to be installed. Ensure that cert-manager is installed as described in the
+> official documentation: [Installing Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator).
diff --git a/product-stack/tyk-enterprise-developer-portal/api-documentation/list-of-endpoints/portal-api-list-of-endpoints.mdx b/product-stack/tyk-enterprise-developer-portal/api-documentation/list-of-endpoints/portal-api-list-of-endpoints.mdx
new file mode 100644
index 0000000000..5f25136b4d
--- /dev/null
+++ b/product-stack/tyk-enterprise-developer-portal/api-documentation/list-of-endpoints/portal-api-list-of-endpoints.mdx
@@ -0,0 +1,276 @@
+---
+title: "Reference list of Endpoints in the Developer Portal API"
+description: "Internal APIs exposed by Tyk Developer Portal"
+keywords: "Tyk Developer Portal, Enterprise Portal, Endpoints, Firewall, Integration, Portal 1.13.0"
+order: 3
+sidebarTitle: "API Endpoint Reference"
+---
+
+
+<Note>
+**Tyk Enterprise Developer Portal**
+
+If you are interested in getting access, contact us at [support@tyk.io](<mailto:support@tyk.io?subject=Tyk Enterprise Portal Beta>)
+</Note>
+
+
+## Introduction
+
+In highly secure environments, it is often necessary to configure a firewall precisely and to allow only the endpoints exposed for the portal, while banning all other routes.
+
+For this purpose, we have prepared a list of all endpoints exposed by the Tyk Enterprise Developer Portal.
+
+
+<Note>
+Please note that this list only refers to v1.13.0 of the portal. The list of endpoints for other versions might be different.
+</Note>
+
+
+
+## List of the portal endpoints
+
+### Admin APIs
+| **Resource**       | **Endpoint**                                                                           |
+| :------------------ | :-------------------------------------------------------------------------------------- |
+| Providers          | `/providers`                                                                             |
+| Providers          | `/providers/{provider_id}`                                                               |
+| Providers          | `/providers/{provider_id}/synchronize`                                                   |
+| Users              | `/users`                                                                                 |
+| Users              | `/users/{user_id}`                                                                       |
+| Users              | `/users/{user_id}/custom-attributes`                                                     |
+| Users              | `/users/{user_id}/custom-attributes/{custom-attribute_id}`                               |
+| Organisations      | `/organisations`                                                                         |
+| Organisations      | `/organisations/{organisation_id}`                                                       |
+| Teams              | `/organisations/{organisation_id}/teams`                                                 |
+| Teams              | `/organisations/{organisation_id}/teams/{team_id}`                                       |
+| Products           | `/products`                                                                              |
+| Products           | `/products/{product_id}`                                                                 |
+| Product Tags       | `/products/{product_id}/tags`                                                            |
+| Product Tags       | `/products/{product_id}/tags/{tag_name}`                                                 |
+| Product Client Types       | `/products/{product_id}/client_types`                                            |
+| Product Client Types       | `/products/{product_id}/client_types/{client_type_id}`                           |
+| Product Logo Image         | `/products/{product_id}/logo`                                                    |
+| Product Preview Image      | `/products/{product_id}/preview`                                                 |
+| Product Docs       | `/products/{product_id}/docs`                                                            |
+| Product Docs       | `/products/{product_id}/docs/{doc_id}`                                                   |
+| Product Docs       | `/products/{product_id}/docs/reorder`                                                    |
+| API Doc            | `/products/{product_id}/api-details`                                                     |
+| API Doc            | `/products/{product_id}/api-details/{api-id}`                                            |
+| API Doc            | `/products/{product_id}/api-details/{api_id}/oas`                                        |
+| Product Spec       | `/products/{product_id}/spec-details`                                                    |
+| Product Spec       | `/products/{product_id}/spec-details/{spec-id}`                                          |
+| Product Spec       | `/products/{product_id}/spec-details/{spec-id}/oas`                                      |
+| Plans              | `/plans`                                                                                 |
+| Plans              | `/plans/{plan_id}`                                                                       |
+| Catalogues         | `/catalogues`                                                                            |
+| Catalogues         | `/catalogues/{catalogue_id}`                                                             |
+| Catalogues         | `/catalogues/{catalogue_id}/audiences`                                                   |
+| Catalogues         | `/catalogues/{catalogue_id}/audiences/{audience_id}`                                     |
+| Access Requests    | `/access_requests`                                                                       |
+| Access Requests    | `/access_requests/{access_request_id}`                                                   |
+| Access Requests    | `/access_requests/{access_request_id}/approve`                                           |
+| Access Requests    | `/access_requests/{access_request_id}/reject`                                            |
+| Applications       | `/apps`                                                                                  |
+| Applications       | `/apps/{app_id}`                                                                         |
+| Applications       | `/apps/{app_id}/access-requests`                                                         |
+| Applications       | `/apps/{app_id}/access-requests/{access-request_id}`                                     |
+| Credentials        | `/apps/{app_id}/access-requests/{access-request_id}/credentials`                         |
+| Credentials        | `/apps/{app_id}/access-requests/{access-request_id}/credentials/{credential_id}`         |
+| Credentials        | `/apps/{app_id}/access-requests/{access-request_id}/credentials/{credential_id}/rotate`  |
+| Applications       | `/apps/{app_id}/provision`                                                               |
+| Custom Credentials | `/apps/{app_id}/custom_credentials`                                                      |
+| Custom Credentials | `/apps/{app_id}/custom_credentials/{credential_id}`                                      |
+| Config             | `/configs`                                                                               |
+| Pages              | `/pages`                                                                                 |
+| Pages              | `/pages/{page_id}`                                                                       |
+| Pages              | `/pages/{page_id}/content-blocks`                                                        |
+| Pages              | `/pages/{page_id}/content-blocks/{content-block_id}`                                     |
+| Themes             | `/themes`                                                                                |
+| Themes             | `/themes/{theme_id}`                                                                     |
+| Themes             | `/themes/{theme_id}/activate`                                                            |
+| Themes             | `/themes/{theme_id}/download`                                                            |
+| Themes             | `/themes/upload`                                                                         |
+| Custom Attributes  | `/extended_attributes`                                                                   |
+| Custom Attributes  | `/extended_attributes/{extended_attribute_id}`                                           |
+| Custom Attributes  | `/extended_attributes/{extended_attribute_id}/custom-attributes`                         |
+| Custom Attributes  | `/extended_attributes/{extended_attribute_id}/custom-attributes/{custom_attribute_id}`   |
+| Custom Attributes  | `/extended_attributes/{extended_attribute_id}/default-attributes`                        |
+| Custom Attributes  | `/extended_attributes/{extended_attribute_id}/default-attributes/{default_attribute_id}` |
+| OAuth2.0 Providers | `/oauth-providers`                                                                       |
+| OAuth2.0 Providers | `/oauth-providers/{provider_id}`                                                         |
+| OAuth2.0 Providers | `/oauth-providers/{provider_id}/client-types`                                            |
+| OAuth2.0 Providers | `/oauth-providers/{provider_id}/client-types/{client_type_id}`                           |
+| Webhooks           | `/webhooks`                                                                              |
+| Webhooks           | `/webhooks/{webhook_id}`                                                                 |
+| Webhooks           | `/webhooks/{webhook_id}/headers`                                                         |
+| Webhooks           | `/webhooks/{webhook_id}/headers/{header_id}`                                             |
+| Posts              | `/posts`                                                                                 |
+| Posts              | `/posts/{post_id}`                                                                       |
+| Posts Categories   | `/posts/{post_id}/categories`                                                            |
+| Posts Categories   | `/posts/{post_id}/categories/{category_id}`                                              |
+| Posts Tags         | `/posts/{post_id}/tags`                                                                  |
+| Posts Tags         | `/posts/{post_id}/tags/{tag_id}`                                                         |
+| Tags               | `/tags`                                                                                  |
+| Tags               | `/tags/{tag_id}`                                                                         |
+| SSO Profiles       | `/sso_profiles`                                                                          |
+| SSO Profiles       | `/sso_profiles/{sso_profile_id}`                                                         |
+
+### Admin dashboard endpoints
+| **Resource**       | **Endpoint**                                                   |
+| :------------------ | :-------------------------------------------------------------- |
+| Login              | `/auth/password/login`                                           |
+| Logout             | `/auth/password/logout`                                          |
+| Profile            | `/admin/admin_profile`                                           |
+| Profile            | `/admin/admin_profile/rotate`                                    |
+| Providers          | `/admin/providers`                                               |
+| Providers          | `/admin/providers/new`                                           |
+| Providers          | `/admin/providers/{provider_id}`                                 |
+| Providers          | `/admin/providers/{provider_id}/synchronize`                     |
+| Products           | `/admin/api_products`                                            |
+| Products           | `/admin/api_products/new`                                        |
+| Products           | `/admin/api_products/filter`                                     |
+| Products           | `/admin/api_products/apis`                                       |
+| Products           | `/admin/api_products/{api_product_id}`                           |
+| Products           | `/admin/api_products/{api_product_id}/posts/{post_id}/move_up`   |
+| Products           | `/admin/api_products/{api_product_id}/posts/{post_id}/move_down` |
+| Plans              | `/admin/plans`                                                   |
+| Plans              | `/admin/plans/new`                                               |
+| Plans              | `/admin/plans/{plan_id}`                                         |
+| Catalogues         | `/admin/catalogues`                                              |
+| Catalogues         | `/admin/catalogues/new`                                          |
+| Catalogues         | `/admin/catalogues/{catalogue_id}`                               |
+| Product Docs       | `/admin/product_docs`                                            |
+| Product Docs       | `/admin/product_docs/{product_doc_id}`                           |
+| OAuth2.0 Providers | `/admin/oauth2-0-providers`                                      |
+| OAuth2.0 Providers | `/admin/oauth2-0-providers/new`                                  |
+| OAuth2.0 Providers | `/admin/oauth2-0-providers/{oauth2.0-provider_id}`               |
+| OAuth2.0 Providers | `/admin/oauth2-0-providers/ping`                                 |
+| OAuth2.0 Providers | `/admin/dcr_config_templates/filter`                             |
+| Apps               | `/admin/apps`                                                    |
+| Apps               | `/admin/apps/new`                                                |
+| Apps               | `/admin/apps/{app_id}`                                           |
+| Access Requests    | `/admin/access_requests`                                         |
+| Access Requests    | `/admin/access_requests/{access_request_id}`                     |
+| Access Requests    | `/admin/access_requests/{access_request_id}/approve`             |
+| Access Requests    | `/admin/access_requests/{access_request_id}/reject`              |
+| Users              | `/admin/users`                                                   |
+| Users              | `/admin/admin_users`                                              |
+| Users              | `/admin/users/new`                                               |
+| Users              | `/admin/admin_users/new`                                         |
+| Users              | `/admin/users/{user_id}`                                         |
+| Users              | `/admin/admin_users/{user_id}`                                   |
+| Users              | `/admin/users/{user_id}/activate`                                |
+| Users              | `/admin/admin_users/{user_id}/activate`                          |
+| Users              | `/admin/users/{user_id}/send_invite`                             |
+| Users              | `/admin/admin_users/{user_id}/send_invite`                       |
+| Users              | `/admin/users/{user_id}/deactivate`                              |
+| Users              | `/admin/admin_users/{user_id}/deactivate`                        |
+| Organisations      | `/admin/organisations`                                           |
+| Organisations      | `/admin/organisations/new`                                       |
+| Organisations      | `/admin/organisations/org:{organisation_id}`                     |
+| Teams              | `/admin/teams`                                                   |
+| Teams              | `/admin/teams/new`                                               |
+| Teams              | `/admin/teams/filter`                                            |
+| Teams              | `/admin/teams/{team_id}`                                         |
+| Invite Codes       | `/admin/invite_codes`                                            |
+| Invite Codes       | `/admin/invite_codes/new`                                        |
+| Invite Codes       | `/admin/invite_codes/{invite_code_id}`                           |
+| Themes             | `/admin/themes`                                                  |
+| Themes             | `/admin/themes/new`                                              |
+| Themes             | `/admin/themes/{theme_name}`                                     |
+| Themes             | `/admin/themes/{theme_name}/activate`                            |
+| Themes             | `/files/download`                                                |
+| Pages              | `/admin/pages`                                                   |
+| Pages              | `/admin/pages/new`                                               |
+| Pages              | `/admin/pages/{page_id}`                                         |
+| Pages              | `/admin/pages/{page_id}/to_draft`                                |
+| Menus              | `/admin/menus`                                                   |
+| Menus              | `/admin/menus/new`                                               |
+| Menus              | `/admin/menus/{menu_id}`                                         |
+| Menus              | `/admin/menus/{menu_id}/menu_items/{menu_item_id}/move_up`       |
+| Menus              | `/admin/menus/{menu_id}/menu_items/{menu_item_id}/move_down`     |
+| Menu Items         | `/admin/menu_items`                                              |
+| Menu Items         | `/admin/menu_items/new`                                          |
+| Menu Items         | `/admin/menu_items/{menu_item_id}`                               |
+| Custom Attributes  | `/admin/custom_attributes`                                       |
+| Custom Attributes  | `/admin/custom_attributes/{custom_attribute_id}`                 |
+| Posts              | `/admin/posts`                                                   |
+| Posts              | `/admin/posts/new`                                               |
+| Posts              | `/admin/posts/{post_id}`                                         |
+| Categories         | `/admin/categories`                                              |
+| Categories         | `/admin/categories/new`                                          |
+| Categories         | `/admin/categories/{category_id}`                                |
+| Tags               | `/admin/tags`                                                    |
+| Tags               | `/admin/tags/new`                                                |
+| Tags               | `/admin/tags/{tag_id}`                                           |
+| Settings           | `/admin/general`                                                 |
+| About              | `/admin/about`                                                   |
+| About              | `/admin/about/clear-cache`                                       |
+| Webhooks           | `/admin/webhooks`                                                |
+| Webhooks           | `/admin/webhooks/new`                                            |
+| Webhooks           | `/admin/webhooks/{webhook_id}`                                   |
+| Webhooks           | `/admin/webhooks/ping`                                           |
+| SSO Profiles       | `/admin/sso_profiles`                                            |
+| SSO Profiles       | `/admin/sso_profiles/new`                                        |
+| SSO Profiles       | `/admin/sso_profiles/{sso_profile_id}`                           |
+| SSO Profiles       | `/admin/sso_profiles/raw-editor`                                 |
+| SSO Profiles       | `/admin/sso_profiles/{sso_profile_id}/raw-editor`                |
+
+### Live portal endpoints
+| **Resource**      | **Endpoint**                                                  |
+| :----------------- | :------------------------------------------------------------- |
+| Auth              | `/auth/password/login`                                          |
+| Auth              | `/auth/password/register`                                       |
+| Auth              | `/auth/password/logout`                                         |
+| Auth              | `/auth/password/new`                                            |
+| Auth              | `/auth/password/edit`                                           |
+| Auth              | `/auth/password/recover`                                        |
+| Auth              | `/auth/password/update`                                         |
+| Auth              | `/api/sso`                                                      |
+| Auth              | `/api/portal/developers`                                        |
+| Auth              | `/api/portal/developers/ssokey/{id}`                            |
+| Auth              | `/api/portal/developers/{id}`                                   |
+| Auth              | `/sso`                                                          |
+| Auth              | `/tib/auth/{id}/{provider}`                                     |
+| Auth              | `/tib/auth/{id}/{provider}/callback`                            |
+| Posts             | `/blog`                                                         |
+| Posts             | `/blog/category/{category}`                                     |
+| Posts             | `/blog/{year}/{month}/{day}/{path}`                             |
+| Pages             | `/about-us`                                                     |
+| Pages             | `/portal/catalogue-products`                                    |
+| Products          | `/portal/catalogue-products/{product_name}`                     |
+| Products          | `/portal/catalogue-products/{product_name}/{api}/docs`          |
+| Products          | `/portal/catalogue-products/{product_name}/{api}/docs/download` |
+| OAS Spec Render   | `/portal/catalogue-products/{product_name}/*`                  |
+| Cart              | `/portal/private/cart/provision`                                |
+| Cart              | `/portal/private/cart/remove/{catalogue_id}/{product_id}`       |
+| Apps              | `/portal/private/dashboard`                                     |
+| Apps              | `/portal/private/apps`                                          |
+| Apps              | `/portal/private/apps/{app_id}`                                 |
+| Apps              | `/portal/private/apps/{app_id}/cert/{cert_id}`                  |
+| Credentials       | `/portal/private/credentials`                                   |
+| Profile           | `/portal/private/profile`                                       |
+| Organisation Flow | `/portal/private/organisation`                                  |
+| Organisation Flow | `/portal/private/users`                                         |
+| Organisation Flow | `/portal/private/users/{user_id}`                               |
+| Organisation Flow | `/portal/private/users/{user_id}/edit`                          |
+| Organisation Flow | `/portal/private/users/invite`                                  |
+| Analytics         | `/portal/private/analytics`                                     |
+| Analytics         | `/portal/private/analytics/api/chart/overview`                  |
+| Analytics         | `/portal/private/analytics/api/chart/traffic`                   |
+| Analytics         | `/portal/private/analytics/api/chart/error`                     |
+| Analytics         | `/portal/private/analytics/api/chart/latency`                   |
+
+### Assets endpoints
+| **Resource** | **Endpoint**                    |
+| :-------------- | :------------------------------- |
+| Images       | `/admin/assets/images/*`          |
+| Images       | `/assets/images/*`                |
+| Fonts        | `/admin/assets/fonts/*`           |
+| Fonts        | `/assets/fonts/*`                 |
+| Javascripts  | `/admin/assets/javascripts/*`     |
+| Javascripts  | `/assets/javascripts/*`           |
+| Stylesheets  | `/admin/assets/stylesheets/*`     |
+| Stylesheets  | `/assets/stylesheets/*`           |
+| Vendors      | `/assets/vendor/bootstrap/*`      |
+| Vendors      | `/assets/vendor/jquery/*`         |
diff --git a/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api.mdx b/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api.mdx
new file mode 100644
index 0000000000..8ab04e09a7
--- /dev/null
+++ b/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api.mdx
@@ -0,0 +1,50 @@
+---
+title: "Tyk Developer Portal API"
+description: "Tyk Developer Portal API documentation. This page provides details on how to use the Tyk Developer Portal Management API for managing portal resources."
+order: 3
+sidebarTitle: "Overview"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+<img src="https://tyk.io/docs/img/developer_portal_swagger_image.png" width="963" height="250" alt="Tyk Developer Portal"/>
+
+<ButtonLeft href="https://raw.githubusercontent.com/TykTechnologies/tyk-docs/refs/heads/production/swagger/nightly/enterprise-developer-portal-swagger.yaml" color="green" content="Download Swagger" />
+
+## <a name="introduction"></a> Introduction
+
+The Tyk Developer Portal Management API offers programmatic
+access to all portal resources that your instance of the portal manages.
+This API repeats functionality of the user interface and enables APIs
+consumers integrating their portal instances with their other IT systems
+such as billings, CRMs, ITSM systems and other software.
+
+
+## Authentication
+
+This API requires an admin authorisation token that is available for admin
+users of the portal in the profile page.
+
+## Pagination
+
+List endpoints in the Tyk Developer Portal Management API return their results in pages. Control pagination with the following query parameters:
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `page` | The page number to return. Pages are numbered from 1. | `1` |
+| `per_page` | The number of items to return per page. | `20` |
+| `limit` | The maximum number of records to return for this request. It overrides the row count only, not the page offset, so use `per_page` for paging rather than `limit`. | Value of `per_page` |
+
+For example, to return the second page of products with 50 products per page:
+
+```
+GET /products?page=2&per_page=50
+```
+
+To page through an entire collection, start at `page=1` and increase `page` until a response returns fewer items than `per_page`, or an empty list.
+
+<Note>
+The Tyk Developer Portal Management API uses `page` for the page number. The Tyk Dashboard API uses `p` for the same purpose, so check the parameter name when you move between the two APIs.
+</Note>
+
+A few endpoints that return fixed collections, such as listing themes, return all results and ignore these parameters.
diff --git a/product-stack/tyk-enterprise-developer-portal/deploy/configuration.mdx b/product-stack/tyk-enterprise-developer-portal/deploy/configuration.mdx
new file mode 100644
index 0000000000..3c2023315b
--- /dev/null
+++ b/product-stack/tyk-enterprise-developer-portal/deploy/configuration.mdx
@@ -0,0 +1,735 @@
+---
+title: "Environment Variables and Configuration"
+description: "Configuration reference for the Tyk Enterprise Developer Portal"
+keywords: "Configure Tyk Enterprise Developer Portal, Tyk Enterprise Developer Portal"
+sidebarTitle: "Environment Variables and Configs"
+---
+
+import EnvTypeMapping from '/snippets/env-type-mapping.mdx';
+
+To configure the Tyk Enterprise Developer Portal, you can use either a config file or environment variables.
+The table below provides a reference to all options available to you when configuring the portal.
+
+<EnvTypeMapping/>
+
+## Portal settings
+This section explains the general portal settings, including which port it will be listening on, how often it should synchronize API Products and plans with the Tyk Dashboard, and so on.
+Most of these settings are optional, except for the PORTAL_LICENSEKEY. If you don't specify these settings, the default values will be used.
+However, you can leverage the settings below to customize the deployment of your portal.
+
+### Sample storage setting section via config file
+```json
+{
+  "HostPort": 3001,
+  "RefreshInterval": 10,
+  "LicenseKey": "your-license-key",
+  "Theming": {
+    "Theme": "default",
+    "Path": "./themes"
+  },
+  "ProductDocRenderer": "stoplight",
+  "LogLevel": "debug",
+  "LogFormat": "dev",
+  "SSOCustomLoginURL": "https://your-idp.example.com/login",
+  "TLSConfig": {
+    "Enable": true,
+    "InsecureSkipVerify": true,
+    "Certificates": [
+      {
+        "Name": "localhost",
+        "CertFile": "portal.crt",
+        "KeyFile": "portal.key"
+      }
+    ],
+    "MinVersion": "772"
+  },
+  "PortalAPISecret": "your-portal-api-secret"
+}
+```
+
+### Sample storage setting section via environment variables
+```.ini
+PORTAL_HOSTPORT=3001
+PORTAL_REFRESHINTERVAL=10
+PORTAL_LICENSEKEY=your-license-key
+PORTAL_THEMING_THEME=default
+PORTAL_THEMING_PATH=./themes
+PORTAL_DOCRENDERER=stoplight
+PORTAL_LOG_LEVEL=debug
+PORTAL_LOG_FORMAT=dev
+PORTAL_SSO_CUSTOM_LOGIN_URL=https://your-idp.example.com/login
+PORTAL_TLS_ENABLE=true
+PORTAL_TLS_INSECURE_SKIP_VERIFY=true
+PORTAL_TLS_CERTIFICATES = '[{"Name": "localhost","CertFile": "portal.crt","KeyFile": "portal.key"}]'
+PORTAL_API_SECRET=your-portal-api-secret
+```
+
+### PORTAL_HOSTPORT
+**Config file:** HostPort <br/>
+**Type:** `int` <br/>
+**Description**: The port on which the portal will run inside the container. Not required. If it is not specified, the default value is 3001.
+
+### PORTAL_REFRESHINTERVAL
+**Config file:** RefreshInterval <br/>
+**Type:** `int` <br/>
+**Description**: How the portal will synchronise API Products and plans with the Tyk Dashboard. The value is specified in minutes.
+Not required. If it is not specified, the default value is 10.
+
+### PORTAL_LICENSEKEY
+**Config file:** LicenseKey <br/>
+**Type:** `string` <br/>
+**Description**: A license key that Tyk provides. Required to start the portal.
+
+### PORTAL_THEMING_THEME
+**Config file:** Theming.Theme <br/>
+**Type:** `string` <br/>
+**Description**: The name of a theme the portal should use after the start-up. You can change this later via the Themes UI.
+It's not required to specify, as the portal comes with only one theme named `default`;  therefore, PORTAL_THEMING_THEME defaults to `default`.
+However, if you have  already created [a theme](/portal/customization#) and want the portal to use when it starts for the first time, then you can use this setting to achieve that.
+
+### PORTAL_THEMING_PATH
+**Config file:** Theming.Path <br/>
+**Type:** `string` <br/>
+**Description**: Defines a folder where themes are located. Depending on the storage type that you use, you can specify either a relative or an absolute path:
+- If you use the `fs` storage type, you can specify both a relative path (e.g., `./themes`) and an absolute path (e.g., `/themes`)
+- If you use the `s3` or `db` storage type, however, you can only use an absolute path (e.g., `/themes`).
+
+The default value for this variable is `./themes`, so it's important to redefine it if you plan to use the `s3` or `db` storage types.
+
+### PORTAL_THEMING_DISABLE_UPLOAD
+**Config file:** Theming.DisableUpload <br/>
+**Type:** `boolean` <br/>
+**Description**: Disables uploading theme via the UI. The default value is `false`.
+
+### PORTAL_MAX_UPLOAD_SIZE
+**Config file:** MaxUploadSize <br/>
+**Type:** `int` <br/>
+**Description**: Defines the maximum size in bytes of a theme file that can be uploaded via the UI. The default value is 33554432 bytes (32 mb).
+
+Please note that the size of individual files should not exceed 5 MB. If the size of any individual file in a theme exceeds 5 MB, the theme will not be uploaded, even if the total size of all files is less than `PORTAL_MAX_UPLOAD_SIZE`.
+
+### PORTAL_DOCRENDERER
+**Config file:** ProductDocRenderer <br/>
+**Type:** `string` <br/>
+**Options:**
+- `stoplight` to use Stoplight as a documentation renderer;
+- `redoc` to use Redoc as a documentation renderer.
+
+**Description**: Use this setting to specify which OAS documentation renderer to use to render the OpenAPI Specification. Not required. If it is not specified, the default value is `stoplight`.
+
+### TYK_PORTAL_ENABLEIDPREGISTRY
+**Config file:** EnableIDPRegistry <br/>
+**Type:** `boolean` <br/>
+**Description**: Enables the [Identity Provider Registry](/api-management/client-idp-registry) for Dynamic Client Registration. When set to `true`, the Portal stores IdP configuration centrally in the Tyk Dashboard rather than writing it directly into API definitions. Requires Tyk 5.14.0 or later. The default value is `false`.
+
+### PORTAL_DCR_LOG_ENABLED
+**Config file:** DCRLogEnabled <br/>
+**Type:** `boolean` <br/>
+**Description**: When enabled, the portal will print raw responses from the OAuth2.0 Identity Provider for the DCR flow.
+Raw responses from the Identity Providers may contain sensitive information; therefore, we recommend enabling this option only for debugging purposes. Available options are:
+- `true` for enabling the detailed logs;
+- `false` for disabling the detailed logs.
+The default value is `false`.
+
+## Audit log settings
+This section explains how to configure the audit log in the portal. When the audit log is enabled, each admin's action will leave a trace in the *portal.log* file located in the directory specified by the `PORTAL_AUDIT_LOG_ENABLE` setting.
+
+### PORTAL_AUDIT_LOG_ENABLE
+**Config file:** AuditLog.Enable <br/>
+**Type:** `boolean` <br/>
+**Description**: Enables the audit log capability. The default value is `false`.
+
+### PORTAL_AUDIT_LOG_PATH
+**Config file:** AuditLog.Path <br/>
+**Type:** `string` <br/>
+**Description**: Path to a directory with the audit log file. When audit log is enabled, the portal will create a file called `portal.log` in that directory. All admin actions will be reflected in that file.
+
+## Session management
+This section explains how to configure session management for the portal. Using the settings below, you can configure:
+- Name of the portal's session cookie.
+- Various aspects of cookie security, including: should it be sent using a TLS-encrypted connection,and is it accessible by JavaScript API on the client-side?
+- Cookie encryption key.
+- Cookie lifetime.
+
+### PORTAL_SESSION_NAME
+**Config file:** Session.Name <br/>
+**Type:** `string` <br/>
+**Description**: Name of the portal's cookie. The default value is `portal-session`.
+
+### PORTAL_SESSION_SECURE
+**Config file:** Session.Secure <br/>
+**Type:** `boolean` <br/>
+**Description**: Controls whether the portal adds the `Secure` attribute to the `Set-Cookie` header in all responses from the portal's backend, except for the admin APIs. It's important to note that if the connection between the portal and the browser is not secured with TLS, the browser will ignore the `Secure` attribute.
+We recommend enabling TLS and setting this attribute to `true` for all production environments. The default value is `false`.
+
+### PORTAL_SESSION_HTTPONLY
+**Config file:** Session.HttpOnly <br/>
+**Type:** `boolean` <br/>
+**Description**: Controls whether the portal adds the `HttpOnly` attribute to the `Set-Cookie` header in all responses from the portal's backend, except for the admin APIs. This cookie attribute controls if the cookie is only accessible at the server and not by JavaScript on the client side.
+This is a security measure to prevent XSS attacks.
+
+We recommend setting it to `true` in production environments. The default value is `true`.
+
+### PORTAL_SESSION_SAMESITE
+**Config file:** Session.SameSite <br/>
+**Type:** `string` <br/>
+**Description**: Controls the value of the `SameSite` attribute for the portal’s cookie. The portal adds the `SameSite` attribute with the value specified in `PORTAL_SESSION_SAMESITE` to the `Set-Cookie` header in all responses from the portal's backend, except for the admin APIs.
+Available options are:
+- `None`;
+- `Lax`;
+- `Strict`.
+
+The default value is `Strict`. If the value specified in the `PORTAL_SESSION_SAMESITE` setting does not match any of the above-mentioned options, it defaults to `Strict`.
+
+### PORTAL_SESSION_KEY
+**Config file:** Session.Key <br/>
+**Type:** `string` <br/>
+**Description**: The cookie encryption key. The default value is a random 32-bytes string.
+
+### PORTAL_SESSION_LIFETIME
+**Config file:** Session.LifeTime <br/>
+**Type:** `int` <br/>
+**Description**: The lifetime of the portal's session in seconds. The default value is 604800 seconds (7 days).
+
+### PORTAL_SESSION_IDLE_TIMEOUT
+**Config file:** Session.IdleTimeout <br/>
+**Type:** `int` <br/>
+**Description**: The duration in seconds before a portal session is considered idle. A session is deemed idle when there is no user activity, such as clicks, navigation, or input. Once the idle timeout is reached, the session will expire, requiring the user to log in again. The default value is 3600 seconds (1 hour).
+
+### PORTAL_ENABLE_HTTP_PROFILER
+**Config file:** EnableHttpProfiler <br/>
+**Type:** `boolean` <br/>
+**Description**: Enables debugging of the portal by exposing the Golang profiling information at `/debug/pprof/`. The default value is `false`.
+
+
+<Note>
+**Profiling**
+
+We recommend using the profiler only in non-production environments. Be sure to disable it in production by setting `PORTAL_ENABLE_HTTP_PROFILER` to `false`.
+</Note>
+
+
+### PORTAL_LOG_LEVEL
+**Config file:** LogLevel <br/>
+**Type:** `string` <br/>
+**Description**: Defines the log level, available options are:
+- debug
+- info
+- warn
+- error
+- dpanic
+- panic
+- fatal
+
+### PORTAL_LOG_FORMAT
+**Config file:** LogFormat <br/>
+**Type:** `string` <br/>
+**Description**: Defines the log format, available options are:
+- `dev` for verbose human-readable output
+- `prod` for output in json format.
+
+### PORTAL_TLS_ENABLE
+**Config file:** TLSConfig.Enable <br/>
+**Type:** `boolean` <br/>
+**Description**: Enables TLS. The default value is `false`.
+
+### PORTAL_TLS_INSECURE_SKIP_VERIFY
+**Config file:** TLSConfig.InsecureSkipVerify <br/>
+**Type:** `boolean` <br/>
+**Description**: Skip verification of self-signed certificates.
+
+### PORTAL_TLS_MIN_VERSION
+**Config file:** TLSConfig.MinVersion <br/>
+**Type:** `string` <br/>
+**Description**: Minimum TLS version. Defaults to 769 (TLS 1.0).
+
+Values for TLS Versions:
+
+| TLS Version   | Value to Use   |
+| :--------------- | :---------------- |
+|      1.0      |      769       |
+|      1.1      |      770       |
+|      1.2      |      771       |
+|      1.3      |      772       |
+
+### PORTAL_TLS_MAX_VERSION
+**Config file:** TLSConfig.MaxVersion <br/>
+**Type:** `string` <br/>
+**Description**: Maximum TLS version. Defaults to 772 (TLS 1.3).
+
+Values for TLS Versions:
+
+| TLS Version   | Value to Use   |
+| :--------------- | :---------------- |
+|      1.0      |      769       |
+|      1.1      |      770       |
+|      1.2      |      771       |
+|      1.3      |      772       |
+
+### PORTAL_TLS_CIPHER_SUITES
+**Config file:** TLSConfig.CipherSuites <br/>
+**Type:** `[]string` <br/>
+**Description**: Array of allowed cipher suites as defined at https://golang.org/pkg/crypto/tls/#pkg-constants.
+
+### PORTAL_TLS_CERTIFICATES
+**Config file:** TLSConfig.Certificates <br/>
+**Type:** `json` <br/>
+**Description**: JSON (or JSON-formatted string in case of environment variable) containing a list of certificates. Each certificate is defined by three properties:
+- Name
+- CertFile
+- KeyFile
+
+### PORTAL_API_SECRET
+**Config file:** PortalAPISecret <br/>
+**Type:** `string` <br/>
+**Description**: API secret for enabling [Single Sign-on (SSO) flow](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) with the Tyk Identity Broker.
+You can specify any string value in this setting. Omit this setting if you don't require SSO.
+
+### PORTAL_SSO_CUSTOM_LOGIN_URL
+**Config file:** SSOCustomLoginURL <br/>
+**Type:** `string` <br/>
+**Description**: Redirects the portal login page to a custom SSO login URL. When set, GET requests to `/auth/password/login` are automatically redirected to this URL, and the portal's "Log in" button points to it. This is useful when using an Identity Provider (IDP) based login/SSO profile, as it allows you to bypass the default portal password login page and direct users to your external IDP login page instead. This setting only affects the login page redirect; user registration and password reset pages remain unchanged.
+
+## Response Headers Configuration
+This section explains how to configure custom HTTP response headers that will be added to all responses from the Portal.
+
+### PORTAL_RESPONSE_HEADERS
+**Config file:** ResponseHeaders <br/>
+**Type:** `[]{Key: string, Value: string}` <br/>
+**Description**: Configures custom HTTP response headers that will be added to all responses from the Portal. The value must be a JSON array of objects containing Key and Value fields.
+
+**Example configuration via environment variable:**
+```bash
+export PORTAL_RESPONSE_HEADERS='[{"Key":"X-Frame-Options", "Value":"DENY"}, {"Key":"Content-Security-Policy", "Value":"default-src '\''self'\''"}]'
+```
+
+**Example configuration via config file:**
+```json
+{
+  "ResponseHeaders": [
+    {
+      "Key": "X-Frame-Options",
+      "Value": "DENY"
+    },
+    {
+      "Key": "Content-Security-Policy",
+      "Value": "default-src 'self'"
+    }
+  ]
+}
+```
+
+**Common use cases include:**
+- Security headers (`X-Frame-Options`, `Content-Security-Policy`)
+- CORS headers
+- Cache control headers
+- Custom application headers
+
+If the JSON format is invalid, the Portal will return an error message indicating the correct format:
+```
+Invalid value for PORTAL_RESPONSE_HEADERS. Valid Format: '[{"Key": "header-key", "Value": "value-for-given-key"}]'
+```
+
+## Storage settings
+Using variables from this section, you can configure storage for the portal's CMS assets, such as themes, images, and Open API Specification files. The portal supports two types of storage:
+- S3 volume;
+- And filesystem.
+
+### Sample storage setting section via config file
+```json
+{
+  "Storage": "s3",
+  "S3": {
+    "AccessKey": "your-access-key",
+    "SecretKey": "your-secret-key",
+    "Region": "sa-east-1",
+    "Endpoint": "https://s3.sa-east-1.amazonaws.com",
+    "Bucket": "your-portal-bucket",
+    "ACL": "private",
+    "PresignURLs": true
+    }
+}
+```
+
+### Sample storage setting section via environment variables
+```.ini
+PORTAL_STORAGE=s3
+PORTAL_S3_AWS_ACCESS_KEY_ID=your-access-key
+PORTAL_S3_AWS_SECRET_ACCESS_KEY=your-secret-key
+PORTAL_S3_REGION=sa-east-1
+PORTAL_S3_ENDPOINT=your-portal-bucket
+PORTAL_S3_BUCKET=https://s3.sa-east-1.amazonaws.com
+PORTAL_S3_ACL=private
+PORTAL_S3_PRESIGN_URLS=true
+```
+
+### PORTAL_STORAGE
+**Config file:** Storage <br/>
+**Type:** `string` <br/>
+**Options:**
+- `fs` to use file system storage type;
+- `db` to use the portal's main database. If the `db` is selected as a storage type, the portal application will create appropriate structure in the database that 
+- `s3` to use S3 volume for storing the portal assets.
+
+**Description**: Defines which type of storage to use for the portal's CMS assets. Not required. If it is not specified, the default value is `fs`.
+
+### PORTAL_S3_AWS_ACCESS_KEY_ID
+**Config file:** S3.AccessKey <br/>
+**Type:** `string` <br/>
+**Description**: Access key for your S3 bucket. This option is only required for the `s3` storage type and will be ignored for the `fs` and `db` storage types.
+
+### PORTAL_S3_AWS_SECRET_ACCESS_KEY
+**Config file:** S3.SecretKey <br/>
+**Type:** `string` <br/>
+**Description**: Secret access key for your S3 bucket. This option is only required for the `s3` storage type and will be ignored for the `fs` and `db` storage types.
+
+### PORTAL_S3_REGION
+**Config file:** S3.Region <br/>
+**Type:** `string` <br/>
+**Description**: AWS region where the S3 bucket is hosted. E.g., `sa-east-1`. This option is only required for the `s3` storage type and will be ignored for the `fs` and `db` storage types.
+
+### PORTAL_S3_ENDPOINT
+**Config file:** S3.Endpoint <br/>
+**Type:** `string` <br/>
+**Description**: URL to object storage service. E.g., `https://s3.sa-east-1.amazonaws.com` or `https://play.min.io`. This option is only required for the `s3` storage type and will be ignored for the `fs` and `db` storage types.
+
+### PORTAL_S3_BUCKET
+**Config file:** S3.Bucket <br/>
+**Type:** `string` <br/>
+**Description**: Name of the S3 bucket. Required only for the `s3` storage type. This option is only required for the `s3` storage type and will be ignored for the `fs` and `db` storage types.
+
+### PORTAL_S3_ACL
+**Config file:** S3.ACL <br/>
+**Type:** `string` <br/>
+**Description**: ACL permissions are set on the bucket, with options including `private`, `public-read`, `public-read-write`, and `authenticated-read`.
+If the bucket uses a policy to set permissions, you should leave the ACL value empty. This option is only required for the `s3` storage type and will be ignored for the `fs` and `db` storage types.
+
+### PORTAL_S3_PRESIGN_URLS
+**Config file:** S3.PresignURLs <br/>
+**Type:** `string` <br/>
+**Description**: The PresignURLs option instructs the client to retrieve presigned URLs for the objects.
+This is particularly useful if the bucket is private and you need to access the object directly, such as when displaying an image on a web page.
+This option is only required for the `s3` storage type and will be ignored for the `fs` and `db` storage types.
+
+### PORTAL_ASSETS_CACHE_DISABLE
+**Config file:** AssetsCache.Disable <br/>
+**Type:** `boolean` <br/>
+**Description**: If the storage type is set to `db`, an in-memory cache will be used for the themes storage. This configuration disables the assets cache. The default value is `false`.
+
+## TLS configuration
+This section explains the TLS configuration settings to enable connection to the portal's UI over HTTPS.
+
+### PORTAL_TLS_ENABLE
+**Config file:** TLSConfig.Enable <br/>
+**Type:** `boolean` <br/>
+**Description**: Enables or disables connection over HTTPS. When TLS is enabled, the portal will expect a TLS certificate to be provided via *PORTAL_TLS_CERTIFICATES*.
+When TLS is enabled and no certificates are provided, the portal won't start. The default value is `false`.
+
+### PORTAL_TLS_CERTIFICATES
+**Config file:** TLSConfig.Certificates <br/>
+**Type:** `string` <br/>
+**Description**: A JSON-formatted string that provides the hostname, in addition to the paths to a TLS certificate and key file:
+- `Name`: The hostname of the portal. This should match the hostname of the certificate file.
+- `CertFile`: The path to a TLS certificate file in the CRT format for the specified hostname.
+- `KeyFile`: The path to a TLS key file for the specified hostname.
+Example:
+```json
+[{"Name": "tyk.io","CertFile": "portal.crt","KeyFile": "portal.key"}]
+```
+
+
+## Database connection settings
+This section provides a reference for the database connection settings used in the portal.
+### Sample database connection setting section via config file
+```json
+{
+  "Database": {
+    "Dialect": "mysql",
+    "ConnectionString": "admin:secr3t@(localhost:3308)/portal?charset=utf8&parseTime=True&loc=Local",
+    "EnableLogs": true,
+    "MaxRetries": 3,
+    "RetryDelay": 2000,
+    "MaxOpenConnections": 20,
+    "MaxIdleConnections": 2,
+    "ConnectionMaxLifetime": 180000
+
+  }
+}
+```
+
+### Sample database connection setting section via environment variables
+```.ini
+PORTAL_DATABASE_DIALECT="mysql"
+PORTAL_DATABASE_CONNECTIONSTRING="admin:secr3t@(localhost:3308)/portal?charset=utf8&parseTime=True&loc=Local"
+PORTAL_DATABASE_ENABLELOGS=true
+PORTAL_DATABASE_MAXRETRIES=3
+PORTAL_DATABASE_RETRYDELAY=5000
+PORTAL_DATABASE_MAX_OPEN_CONNECTIONS=20
+PORTAL_DATABASE_MAX_IDLE_CONNECTIONS=2
+PORTAL_DATABASE_CONNECTION_MAX_LIFETIME=180000
+```
+
+### PORTAL_DATABASE_DIALECT
+**Config file:** Database.Dialect  <br/>
+**Type:** `string` <br/>
+**Description**: A database will be used to store the portal data. Available dialects are:
+- `mysql`
+- `postgres`
+- `sqlite3`
+
+### PORTAL_DATABASE_CONNECTIONSTRING
+**Config file:** Database.ConnectionString <br/>
+**Type:** `string` <br/>
+**Description**: Connection string to the selected database. This setting must be present if the `PORTAL_DATABASE_DIALECT` is specified.
+
+### PORTAL_DATABASE_ENABLELOGS
+**Config file:** Database.EnableLogs <br/>
+**Type:** `boolean` <br/>
+**Description**: Enables logging connection to the database. We recommend disabling this in production environments.
+
+### PORTAL_DATABASE_MAXRETRIES
+**Config file:** Database.MaxRetries <br/>
+**Type:** `int` <br/>
+**Description**: Defines how many times the portal will retry to connect to the database. Optional, the default value is 3.
+
+### PORTAL_DATABASE_RETRYDELAY
+**Config file:** Database.RetryDelay <br/>
+**Type:** `int` <br/>
+**Description**: Defines the delay between connect attempts (in milliseconds). Optional. Default value: 5000.
+
+### PORTAL_DATABASE_MAX_OPEN_CONNECTIONS
+**Config file:** Database.MaxOpenConnections <br/>
+**Type:** `int` <br/>
+**Description**: Defines the maximum number of concurrent connections that the database can handle from the application. When the number of open connections reaches this limit, new requests will wait until a connection becomes available. Optional. Default value: unlimited.
+
+
+### PORTAL_DATABASE_MAX_IDLE_CONNECTIONS
+**Config file:** Database.MaxIdleConnections <br/>
+**Type:** `int` <br/>
+**Description**: Defines the maximum number of idle connections in the database connection pool. Idle connections are open but not currently being used. Keeping some idle connections can improve performance by reducing the time it takes to establish a new connection when demand increases. Optional. Default value: 2.
+
+### PORTAL_DATABASE_CONNECTION_MAX_LIFETIME
+**Config file:** Database.ConnectionMaxLifetime <br/>
+**Type:** `int` <br/>
+**Description**: Defines the maximum lifetime of a connection in milliseconds. This setting is optional. If not specified, the default value is 1800000 milliseconds (30 minutes). If set to `0`, the connection lifetime is unlimited, meaning connections are reused indefinitely unless closed due to errors or manually by the application.
+
+
+## CORS settings
+This section explains how to configure [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) for the portal.
+
+### PORTAL_CORS_ENABLE
+**Config file:** CORS.Enable <br/>
+**Type:** `boolean` <br/>
+**Description**: Enables or disables the CORS settings for the portal. When disabled, no CORS settings are applied.
+In other words, any cross-origin request will be denied. When enabled, the below defined CORS settings are applied. The default value is `false`.
+
+### PORTAL_CORS_ALLOWED_ORIGINS
+**Config file:** CORS.AllowedOrigins <br/>
+**Type:** `[string]` <br/>
+**Description**: A list of origin domains to allow access from. Wildcards are also supported, e.g. [`*.foo.com`] will allow access from any domain that ends with *.foo.com*.
+When unset, the Portal responds with `Access-Control-Allow-Origin: *`. Because Portal uses cookie-based sessions, browsers block credentialed requests to a wildcard origin. Specify individual origins to restrict access, or set to `http://*,https://*` to allow all origins.
+
+To configure using a configuration file:
+```json
+{
+  "CORS": {
+    "AllowedOrigins": ["*.foo.com","*.bar.com"]
+  }
+}
+```
+To configure using an environment variable:
+```console
+PORTAL_CORS_ALLOWED_ORIGINS=*.foo.com,*.bar.com
+```
+
+### PORTAL_CORS_ALLOWED_HEADERS
+**Config file:** CORS.AllowedHeaders <br/>
+**Type:** `[string]` <br/>
+**Description**: Headers that are allowed within a request. To apply this setting, specify an array of the allowed headers. By default, no headers are allowed.
+
+To configure using a configuration file:
+```json
+{
+  "CORS": {
+    "AllowedHeaders": ["X-Method-Override","X-API-Key"]
+  }
+}
+```
+To configure using an environment variable:
+```console
+PORTAL_CORS_ALLOWED_HEADERS=X-Method-Override,X-API-Key
+```
+
+### PORTAL_CORS_ALLOWED_METHODS
+**Config file:** CORS.AllowedMethods <br/>
+**Type:** `[string]` <br/>
+**Description**: A list of methods that are allowed access. To apply this setting, specify an array of the allowed methods. By default, `GET` and `POST` methods are allowed.
+
+To configure using a configuration file:
+```json
+{
+  "CORS": {
+    "AllowedMethods": ["GET", "POST", "HEAD"]
+  }
+}
+```
+To configure using an environment variable:
+```console
+PORTAL_CORS_ALLOWED_METHODS=GET,POST,HEAD
+```
+
+### PORTAL_CORS_MAX_AGE
+**Config file:** CORS.MaxAge <br/>
+**Type:** `int` <br/>
+**Description**: Indicates how long the results of a preflight request can be cached. The default value is `0`, which stands for no max age.
+
+### PORTAL_DISABLE_CSRF_CHECK
+**Config file:** DisableCSRFCheck <br/>
+**Type:** `bool` <br/>
+**Description**: When set to `true`, disables CSRF protection for all routes. By default, CSRF protection is enabled to prevent cross-site request forgery attacks. Only disable this in development environments or when you have alternative security measures in place.
+
+### PORTAL_CORS_ALLOW_CREDENTIALS
+**Config file:** CORS.AllowCredentials <br/>
+**Type:** `boolean` <br/>
+**Description**: Indicates whether the request can include user credentials like cookies, HTTP authentication, or client-side SSL certificates. The default is `false`.
+
+### PORTAL_TIB_ENABLED
+**Config file:** TIB.Enable <br/>
+**Type:** `boolean` <br/>
+**Description**: Enables or disables the Tyk Identity Broker (TIB) integration. When disabled, it will not appear in the UI. The default value is `false`.
+
+### PORTAL_NOTIFICATIONS_JOB_FREQUENCY
+**Config file:** NotificationsJobFrequency <br/>
+**Type:** `int` <br/>
+**Description**: Defines the frequency of the notifications job that fetches notifications from the portal's database in minutes. The default value is `30` minutes.
+
+
+## Webhooks settings
+
+This section explains how to configure webhooks in the portal.
+
+### PORTAL_WEBHOOKS_SECRET
+
+**Config file:** Webhooks.Secret <br/>
+**Type:** `string` <br/>
+**Description**: The global secret key used to sign all outgoing webhooks.
+
+### PORTAL_WEBHOOKS_PAUSE_DURATION
+
+**Config file:** Webhooks.PauseDuration <br/>
+**Type:** `int` <br/>
+**Description**: The duration (in seconds) to pause a webhook after a failed delivery attempt before retrying. Defaults to 5 seconds.
+
+### PORTAL_WEBHOOKS_CACHE_EXPIRATION
+
+**Config file:** Webhooks.CacheExpiration <br/>
+**Type:** `int` <br/>
+**Description**: The expiration time (in seconds) for the webhook cache.
+
+### PORTAL_WEBHOOKS_CACHE_CLEANUP_INTERVAL
+
+**Config file:** Webhooks.CacheCleanupInterval <br/>
+**Type:** `int` <br/>
+**Description**: The interval (in seconds) at which the webhook cache is cleaned up. Defaults to 5 seconds.
+
+### PORTAL_WEBHOOKS_DISPATCH_TIMEOUT
+
+**Config file:** Webhooks.DispatchTimeout <br/>
+**Type:** `int` <br/>
+**Description**: The timeout (in seconds) for dispatching a single webhook request.
+
+### PORTAL_WEBHOOKS_TOTAL_WORKERS
+
+**Config file:** Webhooks.TotalWorkers <br/>
+**Type:** `int` <br/>
+**Description**: The number of worker goroutines used to process webhooks concurrently. Defaults to 10.
+
+### PORTAL_WEBHOOKS_PROVIDER
+
+**Config file:** Webhooks.Provider <br/>
+**Type:** `string` <br/>
+**Description**: The storage provider used for managing webhooks (for example, `db`).
+
+### PORTAL_WEBHOOKS_DISABLE
+
+**Config file:** Webhooks.Disable <br/>
+**Type:** `bool` <br/>
+**Description**: A boolean flag (`true` or `false`) that disables webhooks entirely when set to `true`.
+
+## Sample config file
+```json
+{
+  "HostPort": 3001,
+  "RefreshInterval": 10,
+  "LicenseKey": "your-license-key",
+  "Theming": {
+    "Theme": "default",
+    "Path": "./themes"
+  },
+  "ProductDocRenderer": "stoplight",
+  "LogLevel": "debug",
+  "LogFormat": "dev",
+  "SSOCustomLoginURL": "https://your-idp.example.com/login",
+  "TLSConfig": {
+    "Enable": true,
+    "InsecureSkipVerify": true,
+    "Certificates": [
+      {
+        "Name": "localhost",
+        "CertFile": "portal.crt",
+        "KeyFile": "portal.key"
+      }
+    ]
+  },
+  "PortalAPISecret": "your-portal-api-secret",
+  "Storage": "s3",
+  "S3": {
+    "AccessKey": "your-access-key",
+    "SecretKey": "your-secret-key",
+    "Region": "sa-east-1",
+    "Endpoint": "https://s3.sa-east-1.amazonaws.com",
+    "Bucket": "your-portal-bucket",
+    "ACL": "private",
+    "PresignURLs": true
+  },
+  "Database": {
+    "Dialect": "mysql",
+    "ConnectionString": "admin:secr3t@(localhost:3308)/portal?charset=utf8&parseTime=True&loc=Local",
+    "EnableLogs": true,
+    "MaxRetries": 3,
+    "RetryDelay": 2000
+  },
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+## Sample .env file
+```ini
+PORTAL_HOSTPORT=3001
+PORTAL_REFRESHINTERVAL=10
+PORTAL_LICENSEKEY=your-license-key
+PORTAL_THEMING_THEME=default
+PORTAL_THEMING_PATH=./themes
+PORTAL_DOCRENDERER=stoplight
+PORTAL_LOG_LEVEL=debug
+PORTAL_LOG_FORMAT=dev
+PORTAL_SSO_CUSTOM_LOGIN_URL=https://your-idp.example.com/login
+PORTAL_TLS_ENABLE=true
+PORTAL_TLS_INSECURE_SKIP_VERIFY=true
+PORTAL_TLS_CERTIFICATES = '[{"Name": "localhost","CertFile": "portal.crt","KeyFile": "portal.key"}]'
+PORTAL_API_SECRET=your-portal-api-secret
+PORTAL_STORAGE=s3
+PORTAL_S3_AWS_ACCESS_KEY_ID=your-access-key
+PORTAL_S3_AWS_SECRET_ACCESS_KEY=your-secret-key
+PORTAL_S3_REGION=sa-east-1
+PORTAL_S3_ENDPOINT=your-portal-bucket
+PORTAL_S3_BUCKET=https://s3.sa-east-1.amazonaws.com
+PORTAL_S3_ACL=private
+PORTAL_S3_PRESIGN_URLS=true
+PORTAL_DATABASE_DIALECT="mysql"
+PORTAL_DATABASE_CONNECTIONSTRING="admin:secr3t@(localhost:3308)/portal?charset=utf8&parseTime=True&loc=Local"
+PORTAL_DATABASE_ENABLELOGS=true
+PORTAL_DATABASE_MAXRETRIES=3
+PORTAL_TIB_ENABLED=true
+```
diff --git a/product-stack/tyk-enterprise-developer-portal/getting-started/setup-email-notifications.mdx b/product-stack/tyk-enterprise-developer-portal/getting-started/setup-email-notifications.mdx
new file mode 100644
index 0000000000..397d7a949a
--- /dev/null
+++ b/product-stack/tyk-enterprise-developer-portal/getting-started/setup-email-notifications.mdx
@@ -0,0 +1,60 @@
+---
+title: "Set up email notification service"
+description: "Learn how to set up email notifications in the Tyk Enterprise Developer Portal."
+keywords: "Tyk Developer Portal, Enterprise Portal, Email, Notifications"
+sidebarTitle: "Email Service"
+---
+
+## Email Configuration
+
+Configuring the emailing settings is necessary for the portal to send notifications to admin users and API consumers.
+Once the configuration is finished, the portal will send emails upon the following events:
+* Password reset;
+* New access request;
+* Access request approved;
+* Access request rejected;
+* Pending user registration request;
+* Invitation to a user to register in the portal;
+* User account is activated;
+* User account is deactivated;
+* New Organisation registration request is created;
+* Organisation registration request is accepted;
+* Organisation registration request is rejected.
+
+
+**Prerequisites**
+
+Before setting up the emailing configuration, you need your email server up and running.
+To complete the email setup, you will need the following information about your SMTP server:
+* Address of your SMTP server;
+* A port on which it accepts connections;
+* Username and password to connect to your SMTP server.
+
+## Portal Admin User Notifications
+
+To start with, you need to configure an email address where the portal will send notifications for admin users: new API Product access requests, new Organisation registration requests, and so on.
+For that, you need to navigate to the General section in the Setting menu, scroll down to the Portal admin notification address, and specify the admin email address in the Portal admin email field.
+<img src="/img/dashboard/portal-management/enterprise-portal/admin_email_settings.png" alt="Portal admin notification address settings" />
+
+## Outbound Mailing 
+
+### The default from email
+
+To enable the portal to send notifications to admin users and API Consumers, you need to specify the outbound email address in the Default Email From field.
+No notifications will be sent until the Default Email From field is specified.
+<img src="/img/dashboard/portal-management/enterprise-portal/default_from_email_settings.png" alt="Default from email settings" />
+
+### Email Subjects
+
+Once the default from email is configured, you can specify subjects for notifications.
+If you don’t, the default subjects will be used for email notifications.
+<img src="/img/dashboard/portal-management/enterprise-portal/email_subjects_settings.png" alt="Email subject settings" />
+
+### SMTP Server Settings
+
+Once the default from email, the admin notification email, and the subjects for outbound emails are configured, you need to configure settings for the SMTP server.
+To do so, navigate to the SMTP setting section in the Settings/General menu and specify:
+* Your SMTP server host and port;
+* The SMTP username and password if authentication is configured for your SMTP server. 
+<img src="/img/dashboard/portal-management/enterprise-portal/smtp_settings.png" alt="SMTP settings" />
+
diff --git a/product-stack/tyk-operator/advanced-configurations/custom-plugins.mdx b/product-stack/tyk-operator/advanced-configurations/custom-plugins.mdx
new file mode 100644
index 0000000000..1c2645d27d
--- /dev/null
+++ b/product-stack/tyk-operator/advanced-configurations/custom-plugins.mdx
@@ -0,0 +1,243 @@
+---
+title: "Custom Plugins with Tyk Operator"
+description: "Learn how to configure custom plugins with Tyk Operator in Kubernetes for API request lifecycle management."
+keywords: "Custom Plugins, Tyk Operator, Kubernetes, API Management"
+sidebarTitle: "Custom Plugins"
+---
+
+## Introduction
+
+Using Tyk Classic APIs, developers can implement API-level custom plugins that can be optionally setup to execute for
+each of the following [hooks](/api-management/plugins/plugin-types#plugin-and-hook-types) in the API request
+lifecycle: [Pre (Request)](/api-management/plugins/plugin-types#request-plugins), [Authentication](/api-management/plugins/plugin-types#authentication-plugins),
+[Post (Request)](/api-management/plugins/plugin-types#request-plugins), [Post
+Authentication](/api-management/plugins/plugin-types#request-plugins), [Response](/api-management/plugins/plugin-types#response-plugins)
+and [Analytics](/api-management/plugins/plugin-types#analytics-plugins). Subsequently, users can execute, or “hook”, their
+plugin into these phases of the API request lifecycle based on their specific use case.
+
+This document explains how to configure the following plugin types with different drivers (plugin languages):
+
+- Pre (Request)
+- Authentication
+- Post-Auth (Request)
+- Post (Request)
+- Response
+
+Please refer to [Analytics Plugins](/api-management/plugins/plugin-types#analytics-plugins) to learn how to configure Analytics
+plugins using Tyk Operator.
+
+<Note>
+This page mounts plugin files directly onto the Gateway's file system. For guidance on when to use this approach instead of a remote plugin bundle, see [Choosing Between Local Plugins And Plugin Bundles](/api-management/plugins/overview#choosing-between-local-plugins-and-plugin-bundles).
+</Note>
+
+## How It Works
+
+In Tyk Classic APIs, the _custom_middleware_ section of the Tyk Classic API Definition is where you configure plugins
+that will run at different points during the lifecycle of an API request.
+
+The table below illustrates the Tyk Classic API configuration parameters that correspond to each phase of the API
+request lifecycle:
+
+| Phase     | Description                                                               | Config Value  |
+| :--------- | :------------------------------------------------------------------------- | :------------- |
+| Pre       | Occurs before main request processing.                                    | pre           |
+| Auth      | Custom authentication can be handled during this phase.                   | auth_check    |
+| Post Auth | Occurs after key authentication                                           | post_key_auth |
+| Post      | Occurs after the main request processing but before the response is sent. | post          |
+| Response  | Occurs after the main request processing but before the response is sent. | response      |
+
+The example configuration below illustrates how to set up multiple plugins for different phases of the request
+lifecycle:
+
+```json {linenos=true, linenostart=1}
+{
+  "custom_middleware": {
+    "pre": [
+      {
+        "name": "PreHook1",
+        "path": "/path/to/plugin1.so",
+        "require_session": false,
+        "raw_body_only": false
+      }
+    ],
+    "auth_check": {
+      "name": "AuthCheck",
+      "path": "/path/to/plugin.so",
+      "require_session": false,
+      "raw_body_only": false
+    },
+    "post_key_auth": [
+      {
+        "name": "PostKeyAuth",
+        "path": "/path/to/plugin.so",
+        "require_session": false,
+        "raw_body_only": false
+      }
+    ],
+    "post": [
+      {
+        "name": "PostHook1",
+        "path": "/path/to/plugin1.so",
+        "require_session": false,
+        "raw_body_only": false
+      },
+      {
+        "name": "PostHook2",
+        "path": "/path/to/plugin2.so",
+        "require_session": false,
+        "raw_body_only": false
+      }
+    ],
+    "response": [
+      {
+        "name": "ResponseHook",
+        "path": "/path/to/plugin.so",
+        "require_session": false,
+        "raw_body_only": false
+      }
+    ],
+    "driver": "goplugin"
+  }
+}
+```
+
+In the `custom_middleware` section of the API definition above we can see that there are Golang custom authentication
+(`auth_check`), post authentication (`post_key_auth`), post, pre and response plugins configured.
+
+It can be seen that each plugin is configured with the specific function name and associated source file path of the
+file that contains the function. Furthermore, each lifecycle phase can have a list of plugins configured, allowing for
+complex processing workflows. For example, you might develop one plugin for logging and another for modifying the
+request in the pre request phase.
+
+The `driver` configuration parameter describes the plugin implementation language. Please refer to the [supported
+languages](/api-management/plugins/overview#plugin-driver-names) section for list of supported plugin driver names.
+
+Each plugin can have additional settings, such as:
+
+- `raw_body_only`: When true, indicates that only the raw body should be processed.
+- `require_session`: When true, indicates that session metadata will be available to the plugin. This is applicable only
+  for post, post authentication and response plugins.
+
+## Unsupported
+
+#### Per-Endpoint Plugins
+
+At the endpoint-level, Tyk provides the facility to attach a custom Golang plugin at the end of the request processing
+chain (immediately before the API-level post-plugin is executed). Please note that
+[per-endpoint](/api-management/plugins/plugin-types#per-endpoint-custom-plugins) level plugins are not currently
+supported by Tyk Operator.
+
+---
+
+## Examples
+
+### Configure Custom Plugins (JavaScript) With Tyk Operator
+
+In this example we will create a JavaScript plugin that will inject a request header _Hello_ with a value of _World_.
+This will be configured as a pre request hook.
+
+1. **Implement Plugin**
+
+    The first step is to create the plugin source code.
+
+    ```javascript
+    var exampleJavaScriptMiddlewarePreHook = new TykJS.TykMiddleware.NewMiddleware({});
+
+    exampleJavaScriptMiddlewarePreHook.NewProcessRequest(function (request, session) {
+      // You can log to Tyk console output by calling the built-in log() function:
+      log("Hello from the Tyk JavaScript middleware pre hook function");
+
+      // Add a request header
+      request.SetHeaders["Hello"] = "World";
+
+      // You must return both the request and session metadata
+      return exampleJavaScriptMiddlewarePreHook.ReturnData(request, {});
+    });
+    ```
+
+    Copy the source code above and save it to the following file on the Gateway file system at
+    `/opt/tyk-gateway/middleware/example-javascript-middleware.js`
+
+2. **Create API Definition Resource**
+
+    The example API Definition resource listed below listens on path _/httpbin_ and forwards requests to upstream
+    *http://httpbin.org*.
+
+    ```yaml {linenos=table,hl_lines=["14-18"],linenostart=1}
+    apiVersion: tyk.tyk.io/v1alpha1
+    kind: ApiDefinition
+    metadata:
+      name: httpbin
+    spec:
+      name: httpbin
+      use_keyless: true
+      protocol: http
+      active: true
+      proxy:
+        target_url: http://httpbin.org
+        listen_path: /httpbin
+        strip_listen_path: true
+      custom_middleware:
+        driver: otto # Javascript driver name
+        pre:
+          - name: "exampleJavaScriptMiddlewarePreHook"
+            path: "middleware/example-javascript-middleware.js"
+    ```
+
+    At lines 14-18 we can see the _custom_middleware_ section contains the configuration for our plugin:
+
+    - The `driver` configuration parameter is set to `otto` at line 15, since our plugin is a Javascript plugin. For other
+      valid values please refer to the [plugins driver page](/api-management/plugins/overview#plugin-driver-names).
+    - A plugin hook configuration block is specified at line 16, containing the `name` and `path` for our plugin. The plugin
+      configuration block identifies the "hook" or phase in the API request lifecycle when Tyk Gateway will execute the
+      plugin. In the example above the configuration block is for a `pre` request plugin that will be executed before any
+      middleware. Valid values are the same as the [Tyk Classic API Definition](#how-it-works) equivalent, i.e.
+      `pre`, `auth_check`, `post`, `post-auth` and `response`. We can see that the following fields are set within the `pre`
+      plugin hook configuration object:
+
+      - The `name` field represents the name of the function that implements the plugin in your source code. For Javascript
+        plugins this must match the name of the middleware object that was created. In the example above we created the
+        middleware object, `exampleJavaScriptMiddlewarePreHook`, by calling
+        `var exampleJavaScriptMiddlewarePreHook = new TykJS.TykMiddleware.NewMiddleware({});`.
+      - The `path` field contains the path to the source file `middleware/example-javascript-middleware.js`, relative to the
+        base installation folder, i.e `/opt/tyk-gateway`.
+
+    Save the API Definition to file and create the APIDefinition resource:
+
+    ```bash
+    $ kubectl apply -f path_to_your_apidefinition.yaml
+    apidefinition.tyk.tyk.io/httpbin created
+    ```
+
+3. **Test Plugin**
+
+    We can test that our plugin injects a _Hello_ header with a corresponding value of _World_ by using the curl command:
+
+    ```bash
+    $ curl http://localhost:8080/httpbin/headers
+      {
+        "headers": {
+          "Accept": "*/*",
+          "Accept-Encoding": "gzip",
+          "Hello": "World",
+          "Host": "httpbin.org"
+        }
+      }
+    ```
+
+    The header `"Hello: World"` should be injected by the custom plugin.
+
+
+### Configure Custom Plugins (Python) using plugin bundles via Tyk Operator
+
+Tyk Operator also supports configuring custom plugins using plugin bundles, where the source code and associated
+configuration is packaged into a zip file and uploaded to a remote webserver. Tyk Gateway will then download, extract,
+cache and execute the plugin bundles for each of the configured phases of the [API
+request lifecycle](/api-management/traffic-transformation#request-middleware-chain).
+
+For a detailed guide, check out our blog post
+[How to Deploy Python Plugins in Tyk Running on Kubernetes](https://tyk.io/blog/how-to-deploy-python-plugins-in-tyk-running-on-kubernetes/),
+which walks you through all the steps required to create Python [plugin
+bundles](/api-management/plugins/overview#plugin-bundles), load them into the Tyk Gateway, and configure an API
+Definition to use them with the Tyk Operator.
+
diff --git a/product-stack/tyk-operator/advanced-configurations/graphql-federation.mdx b/product-stack/tyk-operator/advanced-configurations/graphql-federation.mdx
new file mode 100644
index 0000000000..f916537c94
--- /dev/null
+++ b/product-stack/tyk-operator/advanced-configurations/graphql-federation.mdx
@@ -0,0 +1,573 @@
+---
+title: "GraphQL Federation with Tyk Operator"
+description: "Learn how to implement GraphQL Federation using Tyk Operator in Kubernetes, enabling a unified API from multiple subgraphs."
+keywords: "GraphQL, Federation, Tyk Operator, Kubernetes"
+sidebarTitle: "GraphQL Federation"
+---
+
+## Introduction
+
+Tyk, with release *v4.0* offers [GraphQL federation](/api-management/graphql#federation-version-support) that allows you to divide GraphQL implementation across multiple back-end
+services, while still exposing them all as a single graph for the consumers.
+
+Tyk Operator supports GraphQL Federation subgraph and supergraph with following Custom Resources.
+
+## Custom Resources
+
+GraphQL Federation uses concepts of Subgraph and Supergraph.
+
+**Subgraph** is a representation of a back-end service and defines a distinct GraphQL schema. It can be queried directly as a separate service or it can be federated into a larger schema of a supergraph.
+
+**Supergraph** is a composition of several subgraphs that allows the execution of a query across multiple services in the backend.
+
+Tyk Operator uses Custom Resources called [SubGraph](#subgraph) and [SuperGraph](#supergraph), that allows users to model the relationship between Subgraphs and Supergraphs.
+
+### SubGraph
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SubGraph
+metadata:
+  name: users-subgraph
+spec:
+  schema: |
+    <Schema of your SubGraph>
+  sdl: |
+    <SDL of the SubGraph>
+```
+
+SubGraph Custom Resource Definitions (CRD) takes `schema` and `sdl` values for your subgraph. 
+
+To create a Subgraph API in Tyk, you can reference the subgraph's metadata name through `graphql.graph_ref` field, as follows:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: subgraph-api
+spec:
+  name: Federation - Subgraph
+  ... 
+  graphql:
+    enabled: true
+    execution_mode: subgraph
+    graph_ref: users-subgraph # corresponds to Subgraph resource's metadata name
+    version: "2"
+    playground:
+      enabled: false
+      path: ""
+  proxy:
+    target_url: http://users.default.svc:4001/query
+    listen_path: /users-subgraph/
+    disable_strip_slash: true
+```
+
+An ApiDefinition must adhere to the following rules in order to represent an ApiDefinition for your SubGraph CRDs.
+
+1. ApiDefinition and SubGraph must be in the same namespace,
+2. `graphql.execution_mode` must be set to `subgraph`,
+3. `graphql.graph_ref` must be set to the metdata name of the SubGraph resource that you would like to refer.
+
+### SuperGraph
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SuperGraph
+metadata:
+  name: social-media-supergraph
+spec:
+  subgraph_refs:
+    - name: users-subgraph
+      namespace: default
+  schema: |-
+    <Schema of your Supergraph>
+```
+
+SuperGraph CRD takes `subgraph_refs` and `schema` values for your supergraph. `subgraph_refs` is an array of SubGraph Custom Resource(CR) references which expects the name and namespace of the referenced subgraph. If `namespace` is not specified, Operator will check SubGraphs in the current namespace.
+
+Tyk Operator will update your SuperGraph ApiDefinition when one of the subgraphs that you reference in `subgraph_refs` changes.
+
+To create a SuperGraph API in Tyk, you can reference the supergraph's metadata name through `graphql.graph_ref field`, as follows:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: federation-supergraph
+spec:
+  name: Federated - Social Media APIS
+  ...
+  graphql:
+    execution_mode: supergraph
+    graph_ref: social-media-supergraph # corresponds to SuperGraph resource's metadata name
+    enabled: true
+    version: "2"
+    playground:
+      enabled: true
+      path: /playground
+  proxy:
+    target_url: ""
+    strip_listen_path: true
+    listen_path: /social-media-apis-federated/
+```
+
+An ApiDefinition must adhere to the following rules in order to represent an ApiDefinition for your SuperGraph CRDs.
+
+1. ApiDefinition and SuperGraph must be in the same namespace,
+2. `graphql.execution_mode` must be set to `supergraph`,
+3. `graphql.graph_ref` must be set to the metdata name of the SuperGraph resource that you would like to refer.
+
+## Propagating Subgraph Changes to Supergraph
+
+Tyk Operator will automatically propagate changes in SubGraph CRD to the corresponding Subgraph ApiDefinition. Also, if the SubGraph is referenced by a SuperGraph, the corresponding SuperGraph CR and corresponding supergraph ApiDefinition will be updated too.
+
+Therefore, once you make an update on SubGraph CR, you do not need to update your supergraph. It will be updated by Tyk Operator. With this approach, multiple teams can work on SubGraph CRDs and Tyk Operator will update the relevant SuperGraph ApiDefinition.
+
+### Example
+
+Let's assume that a developer responsible for the [Users SubGraph](#users-subgraph) would like to delete `username` field from the Users SubGraph.
+Also, the [Supergraph](#supergraph-1) called Social Media already uses the Users Subgraph.
+
+To achieve this, the developer should update the Users SubGraph CRD. Once the SubGraph CRD is updated, Tyk Operator will:
+1. Update Users SubGraph CRD,
+2. Update Social Media Supergraph ApiDefinition since it is referencing the Users SubGraph CRD.
+
+### Deleting SubGraph
+
+- **SubGraph without any reference**
+
+    If the subgraph is not referenced in any ApiDefinition CRD or SuperGraph CRD, it is easy to delete SubGraph CRDs as follows:
+    ```bash
+    kubectl delete subgraphs.tyk.tyk.io <SUBGRAPH_NAME>
+    ```
+
+- **SubGraph referenced in ApiDefinition**
+
+    If you have a subgraph which is referenced in any ApiDefinition, Tyk Operator will not delete the SubGraph.
+
+    In order to delete this subgraph, the corresponding ApiDefinition CR must be updated, such that it has no reference to the
+    subgraph in `graph_ref` field.
+
+- **SubGraph referenced in SuperGraph**
+
+    Although the subgraph is not referenced in any ApiDefinition, if it is referenced in the SuperGraph, Tyk Operator will
+    not delete the subgraph again.
+
+    In order to delete this subgraph, SuperGraph CR should not have reference to corresponding subgraph in the `subgraph_ref`.
+
+### Deleting SuperGraph
+
+- **SuperGraph without any reference**
+
+    If the supergraph is not referenced in any ApiDefinition CRD, it can be deleted as follows:
+
+    ```bash
+    kubectl delete supergraphs.tyk.tyk.io <SUPERGRAPH_NAME>
+    ```
+
+- **SuperGraph referenced in ApiDefinition**
+
+    If a supergraph is referenced in any ApiDefinition, the Tyk Operator will not delete the SuperGraph CRD.
+
+    In order to delete this supergraph, the ApiDefinition that has a reference to the supergraph must de-reference the supergraph
+    or be deleted.
+
+### Users Subgraph
+
+```yaml
+# Create Namespace & Service & Deployment for Users API
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: users-ns
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: users
+  namespace: users-ns
+  labels:
+    app: users
+spec:
+  ports:
+    - name: http
+      port: 4201
+      targetPort: 4201
+  selector:
+    app: users
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: users
+  namespace: users-ns
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: users
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: users
+        version: v1
+    spec:
+      containers:
+        - image: zalbiraw/go-api-test-service:v2.0.0
+          imagePullPolicy: Always
+          name: users
+          command: ["./services/graphql-subgraphs/users/server"]
+          env:
+            - name: PORT
+              value: "4201"
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SubGraph
+metadata:
+  name: users-subgraph
+  namespace: users-ns
+spec:
+  schema: |
+    directive @extends on OBJECT | INTERFACE
+    
+    directive @external on FIELD_DEFINITION
+    
+    directive @key(fields: _FieldSet!) on OBJECT | INTERFACE
+    
+    directive @provides(fields: _FieldSet!) on FIELD_DEFINITION
+    
+    directive @requires(fields: _FieldSet!) on FIELD_DEFINITION
+    
+    scalar _Any
+    
+    union _Entity = User
+    
+    scalar _FieldSet
+    
+    type _Service {
+      sdl: String
+    }
+    
+    type Address {
+      street: String!
+      suite: String!
+      city: String!
+      zipcode: String!
+      geo: GeoLocation!
+    }
+    
+    type Company {
+      name: String!
+      catchPhrase: String!
+      bs: String!
+    }
+    
+    type Entity {
+      findUserByID(id: ID!): User!
+    }
+    
+    type GeoLocation {
+      lat: String!
+      lng: String!
+    }
+    
+    type Query {
+      user(id: ID!): User!
+      users: [User!]!
+      _entities(representations: [_Any!]!): [_Entity]!
+      _service: _Service!
+    }
+    
+    type User {
+      id: ID!
+      name: String!
+      username: String!
+      email: String!
+      address: Address!
+      phone: String!
+      website: String!
+      company: Company!
+    }
+  sdl: |
+    extend type Query {
+        user(id: ID!): User!
+        users: [User!]!
+    }
+    
+    type User @key(fields: "id") {
+        id: ID!
+        name: String!
+        username: String!
+        email: String!
+        address: Address!
+        phone: String!
+        website: String!
+        company: Company!
+    }
+    
+    type Address {
+        street: String!
+        suite: String!
+        city: String!
+        zipcode: String!
+        geo: GeoLocation!
+    }
+    
+    type GeoLocation {
+        lat: String!
+        lng: String!
+    }
+    
+    type Company {
+        name: String!
+        catchPhrase: String!
+        bs: String!
+    }
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: federation-users-subgraph
+  namespace: users-ns
+spec:
+  name: Federation - Users Subgraph
+  protocol: "http"
+  do_not_track: false
+  use_keyless: true
+  active: true
+  internal: true
+  graphql:
+    enabled: true
+    execution_mode: subgraph
+    graph_ref: users-subgraph
+    version: "2"
+    playground:
+      enabled: false
+      path: ""
+  proxy:
+    target_url: http://users.users-ns.svc:4201/query
+    listen_path: /users-subgraph/
+    disable_strip_slash: true
+```
+
+### Posts Subgraph
+
+```yaml
+# Create Service & Deployment of Posts API
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: posts
+  labels:
+    app: posts
+spec:
+  ports:
+    - name: http
+      port: 4202
+      targetPort: 4202
+  selector:
+    app: posts
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: posts
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: posts
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: posts
+        version: v1
+    spec:
+      containers:
+        - image: zalbiraw/go-api-test-service:v2.0.0
+          imagePullPolicy: Always
+          name: posts
+          command: ["./services/graphql-subgraphs/posts/server"]
+          env:
+            - name: PORT
+              value: "4202"
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SubGraph
+metadata:
+  name: posts-subgraph
+spec:
+  schema: |
+    directive @extends on OBJECT | INTERFACE
+    
+    directive @external on FIELD_DEFINITION
+    
+    directive @key(fields: _FieldSet!) on OBJECT | INTERFACE
+    
+    directive @provides(fields: _FieldSet!) on FIELD_DEFINITION
+    
+    directive @requires(fields: _FieldSet!) on FIELD_DEFINITION
+    
+    scalar _Any
+    
+    union _Entity = Post | User
+    
+    scalar _FieldSet
+    
+    type _Service {
+      sdl: String
+    }
+    
+    type Entity {
+      findPostByID(id: ID!): Post!
+      findUserByID(id: ID!): User!
+    }
+    
+    type Post {
+      id: ID!
+      userId: ID!
+      title: String!
+      body: String!
+    }
+    
+    type Query {
+      post(id: ID!): Post!
+      posts: [Post!]!
+      _entities(representations: [_Any!]!): [_Entity]!
+      _service: _Service!
+    }
+    
+    type User {
+      id: ID!
+      posts: [Post!]!
+    }
+  sdl: |
+    extend type Query {
+        post(id: ID!): Post!
+        posts: [Post!]!
+    }
+    
+    type Post @key(fields: "id") {
+        id: ID!
+        userId: ID!
+        title: String!
+        body: String!
+    }
+    
+    extend type User @key(fields: "id") {
+        id: ID! @external
+        posts: [Post!]!
+    }
+
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: federation-posts-subgraph
+spec:
+  name: Federation - Posts Subgraph
+  protocol: "http"
+  do_not_track: false
+  use_keyless: true
+  active: true
+  internal: true
+  graphql:
+    enabled: true
+    execution_mode: subgraph
+    graph_ref: posts-subgraph
+    version: "2"
+    playground:
+      enabled: false
+      path: ""
+  proxy:
+    target_url: http://posts.default.svc:4202/query
+    listen_path: /posts-subgraph/
+    disable_strip_slash: true
+```
+
+### Supergraph
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SuperGraph
+metadata:
+  name: social-media-supergraph
+spec:
+  subgraph_refs:
+    - name: users-subgraph
+      namespace: users-ns
+    - name: posts-subgraph # Since namespace is not specified for posts-subgraph, Operator uses the namespace of this SuperGraph CRD which is default for our example.
+  schema: |-
+    type Query {
+      user(id: ID!): User!
+      users: [User!]!
+      post(id: ID!): Post!
+      posts: [Post!]!
+    }
+    
+    type User {
+      id: ID!
+      name: String!
+      username: String!
+      email: String!
+      address: Address!
+      phone: String!
+      website: String!
+      company: Company!
+      posts: [Post!]!
+    }
+    
+    type Address {
+      street: String!
+      suite: String!
+      city: String!
+      zipcode: String!
+      geo: GeoLocation!
+    }
+    
+    type GeoLocation {
+      lat: String!
+      lng: String!
+    }
+    
+    type Company {
+      name: String!
+      catchPhrase: String!
+      bs: String!
+    }
+    
+    type Post {
+      id: ID!
+      userId: ID!
+      title: String!
+      body: String!
+    }
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: federation-supergraph
+spec:
+  name: Federated - Social Media APIS
+  protocol: "http"
+  do_not_track: false
+  use_keyless: true
+  active: true
+  graphql:
+    enabled: true
+    execution_mode: supergraph
+    graph_ref: social-media-supergraph
+    version: "2"
+    playground:
+      enabled: true
+      path: /playground
+  proxy:
+    target_url: ""
+    strip_listen_path: true
+    listen_path: /social-media-apis-federated/
+```
+
diff --git a/product-stack/tyk-operator/advanced-configurations/internal-looping.mdx b/product-stack/tyk-operator/advanced-configurations/internal-looping.mdx
new file mode 100644
index 0000000000..d65b3dd43e
--- /dev/null
+++ b/product-stack/tyk-operator/advanced-configurations/internal-looping.mdx
@@ -0,0 +1,339 @@
+---
+title: "Internal Looping With Tyk Operator"
+description: "Learn how to configure internal looping in Tyk Operator for URL rewrites, triggers, and proxying to internal APIs."
+keywords: "Internal Looping, Tyk Operator, Kubernetes, API Management"
+sidebarTitle: "Internal Looping"
+---
+
+## Introduction
+
+The concept of [internal looping](/advanced-configuration/transform-traffic/looping) allows you to use URL Rewriting to redirect your URL to *another API endpoint* or to *another API* in the Gateway. In Tyk, looping is generally targeted using the `tyk://<API_ID>/<path>` scheme, which requires prior knowledge of the `API_ID`. Tyk Operator simplifies the management and transformation of API traffic within Kubernetes environments by abstracting APIs as objects, managing them and dynamically assigning `API_ID`s by its Kubernetes metedata name and namespace.
+
+## Configuring looping to internal ApiDefinition resources
+
+Looping can be configured within Tyk Operator for [URL Rewrites](#url-rewrites), [URL Rewrite Triggers](#url-rewrite-triggers) and [Proxy to internal APIs](#proxy-to-internal-apis) by configuring the `rewrite_to_internal` in `url_rewrite`, `rewrite_to_internal` in `triggers`, and `proxy.target_internal` fields respectively with these properties:
+
+- **Path**: The `path` property specifies the endpoint on the target API where the request should be directed. This is the portion of the URL that follows the domain and is crucial for ensuring that the request reaches the correct resource. For example, setting a value of `"/myendpoint"` means that the request will be forwarded to the `/myendpoint` path on the target API.
+
+- **Query**: The `query` property allows you to append additional query parameters to the target URL. These parameters can be used to modify the behavior of the target API or to pass along specific request information. For instance, setting `query: "check_limits=true"` will include this query string in the redirected request, potentially triggering special handling by the target API.
+
+- **Target**: The `target` property identifies the API resource to which the request should be routed. It consists of two components: `name` and `namespace`. The `name` is the identifier of the target API, while the `namespace` specifies the Kubernetes namespace where the API resource resides. Together, these elements ensure that Tyk Operator accurately locates and routes the request to the intended API. For example, `name: "proxy-api"` and `namespace: "default"` direct the request to the `proxy-api` resource in the `default` namespace.
+
+Tyk Operator would dynamically update the API definition by generating internal looping URL in the form of `tyk://<API_ID>/<path>`. This mechanism is essential for routing traffic within a microservices architecture or when managing APIs across different namespaces in Kubernetes. Using this object you can effectively manage and optimize API traffic within your Tyk Gateway.
+
+---
+
+## URL Rewrites 
+
+[URL rewriting](/transform-traffic/url-rewriting) enables the transformation of incoming API request paths to align with the expected endpoint format of your backend services.
+
+Assume that we wish to redirect incoming `GET /basic/` requests to an API defined by an ApiDefinition object named `proxy-api` in the `default` namespace. We want the `/basic/` prefix to be stripped from the request path and the redirected path should be of the format `/proxy/$1`, where the context variable `$1` is substituted with the remainder of the path request. For example `GET /basic/456` should become `GET /proxy/456`.
+
+In this case we can use a `rewrite_to_internal` object to instruct Tyk Operator to automatically generate the API rewrite URL on our behalf for the API identified by name `proxy-api` in the `default` namespace:
+
+```yaml
+url_rewrites:
+  - path: "/{id}"
+    match_pattern: "/basic/(.*)"
+    method: GET
+    rewrite_to_internal:
+      target:
+        name: proxy-api
+        namespace: default
+      path: proxy/$1
+```
+
+In the above example an incoming request of `/basic/456` would be matched by the `match_pattern` rule `/basic/(.*)` for `GET` requests specified in the `method` field. The `456` part of the URL will be captured and replaces `{id}` in the `path` field. Tyk Operator will use the `rewrite_to_internal` configuration to generate the URL rewrite for the API named `proxy-api` in the `default` namespace, and update the `rewrite_to` field accordingly:
+
+```yaml
+url_rewrites:
+- match_pattern: /basic/(.*)
+  method: GET
+  path: /{id}
+  rewrite_to: tyk://ZGVmYXVsdC9wcm94eS1hcGk/proxy/$1
+```
+
+Here we can see that the `rewrite_to` field has been generated with the value `tyk://ZGVmYXVsdC9wcm94eS1hcGk/proxy/$1` where `ZGVmYXVsdC9wcm94eS1hcGk` represents the API ID for the `proxy-api` API resource in the `default` namespace. Notice also that path `proxy/$1` is appended to the base URL `tyk://ZGVmYXVsdC9wcm94eS1hcGk` and contains the context variable `$1`. This will be substituted with the value of `{id}` in the `path` configuration parameter.
+
+## URL Rewrite Triggers 
+
+[Triggers](/transform-traffic/url-rewriting#how-it-works) are configurations that specify actions based on certain conditions present in HTTP headers, query parameters, path parameters etc.
+
+Triggers are essential for executing specific actions when particular criteria are met, such as rewriting URLs. They are useful for automating actions based on real-time data received in requests. For example, you might use triggers to:
+
+- Redirect users to different APIs in the Gateway based on their authentication status.
+- Enforce business rules by redirecting requests to different APIs in the Gateway based on certain parameters.
+
+The process for configuring internal looping in triggers to is similar to that explained in section [URL Rewrites](#url-rewrites).
+
+Assume that we wish to instruct Tyk Operator to redirect all *Basic Authentication* requests to the API identified by `basic-auth-internal` within the `default` namespace. Subsequently, we can use a `rewrite_to_internal` object as follows:
+
+```yaml
+triggers:
+  - "on": "all"
+    options:
+      header_matches:
+        "Authorization":
+          match_rx: "^Basic"
+    rewrite_to_internal:
+      target:
+        name: basic-auth-internal
+        namespace: default
+      path: "basic/$2"
+```
+
+Here we we can see that a trigger is configured for all requests that include an `Authorization` header containing `Basic` in the header value.
+
+A `rewrite_to_internal` configuration object is used to instruct Tyk Operator to generate a redirect to the API identified by the `basic-auth-internal` API resource in the `default` namespace. The redirect path will be prefixed with `basic`. For example, a basic authentication request to path `/` will be redirected to `/basic/`.
+
+Tyk Operator will automatically generate a URL Rewrite (`rewrite_to`) to redirect the request to the API identified by `basic-auth-internal` within the `default` namespace as follows:
+
+```yaml
+triggers:
+- "on": all
+  options:
+    header_matches:
+      Authorization:
+        match_rx: ^Basic
+  rewrite_to: tyk://ZGVmYXVsdC9iYXNpYy1hdXRoLWludGVybmFs/basic/$2
+```
+
+Here we can see that the `rewrite_to` field has been generated with the value `tyk://ZGVmYXVsdC9iYXNpYy1hdXRoLWludGVybmFs/proxy/$1` where `ZGVmYXVsdC9iYXNpYy1hdXRoLWludGVybmFs` represents the API ID for the `proxy-api` API resource in the `default` namespace. Notice also that path `basic/$2` is appended to the base URL `tyk://ZGVmYXVsdC9iYXNpYy1hdXRoLWludGVybmFs` and contains the context variable `$2`. This will be substituted with the remainder of the request path.
+
+## Proxy to Internal APIs 
+
+Internal looping can also be used for [proxying to internal APIs](/advanced-configuration/transform-traffic/looping).
+
+Assume that we wish to redirect all incoming requests on listen path `/users` to an API defined by an ApiDefinition object named `users-internal-api` in the `default` namespace.
+
+In this case we can use a `proxy.target_internal` field to instruct Tyk Operator to automatically generate the target URL on our behalf for the API identified by name `users-internal-api` in the `default` namespace:
+
+```yaml {linenos=true, linenostart=1, hl_lines=["12-15"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: users
+spec:
+  name: Users API
+  protocol: http
+  active: true
+  use_keyless: true
+  proxy:
+    target_url: ""
+    target_internal:
+      target:
+        name: users-internal-api
+        namespace: default
+    listen_path: /users
+    strip_listen_path: true
+```
+
+The proxy object’s `target_internal` field references other API resources. This field shares the same properties as those described for `rewrite_to_internal`, ensuring consistent configuration.
+
+Tyk Operator will automatically generate the target URL to redirect the request to the API identified by `users-internal-api` within the `default` namespace as follows:
+
+```yaml
+  target_url: "tyk://ZGVmYXVsdC91c2Vycy1pbnRlcm5hbC1hcGk"
+```
+
+---
+
+## Example
+
+Assume a business has legacy customers who authenticate with a service using *Basic Authentication*. The business also wants to support API Keys, enabling both client types to access the same ingress.
+
+To facilitate this, Tyk must be configured for dynamic authentication, accommodating both *Basic Authentication* and *Auth Token* methods.
+
+This setup requires configuring four API Definitions within Tyk:
+
+1. Entry Point API
+2. BasicAuth Internal API
+3. AuthToken Internal API
+4. Proxy Internal API
+
+When a request arrives at the ingress route, a URL rewrite can direct it to either the *BasicAuth Internal* or *AuthToken Internal* API, depending on the authentication method used.
+
+These internal APIs will authenticate the requests. Assuming successful authentication (the happy path), they will forward the requests to the *Proxy Internal API*, which handles the proxying to the underlying service.
+
+<br />
+
+
+<Note>
+There are no actual HTTP redirects in this scenario, meaning that there is no performance penalty in performing any of these *Internal Redirects*.
+</Note>
+
+
+### Entry Point API
+
+The *Entry Point* API is the first point of entry for a client request. It inspects the header to determine if the incoming client request requires authentication using *Basic Authentication* or *Auth Token*. Consequently, it then redirects the request to the *BasicAuth Internal* or *AuthToken Internal* API depending upon the header included in the client request.
+
+The API definition resource for the *Entry Point* API is listed below. It is configured to listen for requests on the `/entry` path and forward requests upstream to `http://example.com`
+
+We can see that there is a URL Rewrite rule (`url_rewrites`) with two triggers configured to match Basic Authentication and Auth Token requests:
+
+- **Basic Authentication trigger**: Activated for incoming client requests that include an *Authorization* header containing a value starting with *Basic*. In this case a `rewrite_to_internal` configuration object is used to instruct Tyk Operator to redirect the request to the *BasicAuthInternal* API, identified by name `basic-auth-internal` in the `default` namespace. The request URL is rewritten, modifying the path to `/basic/<path>`.
+- **Auth Token trigger**: Activated for incoming client requests that include an *Authorization* header containing a value starting with *Bearer*. In this case a `rewrite_to_internal` configuration object is used to instruct Tyk Operator to redirect the request to the *AuthTokenInternal* API, identified by name `auth-token-internal` in the `default` namespace. The request URL is rewritten, modifying the path to `/token/<path>`.
+
+ ```yaml {linenos=true, linenostart=1, hl_lines=["21-45"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: entrypoint-api
+spec:
+  name: Entrypoint API
+  protocol: http
+  active: true
+  proxy:
+    listen_path: /entry
+    target_url: http://example.com
+  use_keyless: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        extended_paths:
+          url_rewrites:
+            - path: "/{id}"
+              match_pattern: "/(.*)/(.*)"
+              method: GET
+              triggers:
+                - "on": "all"
+                  options:
+                    header_matches:
+                      "Authorization":
+                        match_rx: "^Basic"
+                  rewrite_to_internal:
+                    target:
+                      name: basic-auth-internal
+                      namespace: default
+                    path: "basic/$2"
+                - "on": "all"
+                  options:
+                    header_matches:
+                      "Authorization":
+                        match_rx: "^Bearer"
+                  rewrite_to_internal:
+                    target:
+                      name: auth-token-internal
+                      namespace: default
+                    path: "token/$2"
+```
+
+### BasicAuth Internal API
+
+The *BasicAuth Internal* API listens to requests on path `/basic` and forwards them upstream to `http://example.com`.
+
+The API is configured with a URL rewrite rule in `url_rewrites` to redirect incoming `GET /basic/` requests to the API in the Gateway represented by name `proxy-api` in the `default` namespace. The `/basic/` prefix will be stripped from the request URL and the URL will be rewritten with the format `/proxy/$1`. The context variable `$1` is substituted with the remainder of the path request. For example `GET /basic/456` will become `GET /proxy/456`.
+
+Furthermore, a header transform rule is configured within `transform_headers` to add the header `x-transform-api` with value `basic-auth`, to the request.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["21-35"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: basic-auth-internal
+spec:
+  name: BasicAuth Internal API
+  protocol: http
+  proxy:
+    listen_path: "/basic"
+    target_url: http://example.com
+  active: true
+  use_keyless: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        extended_paths:
+          url_rewrites:
+            - path: "/{id}"
+              match_pattern: "/basic/(.*)"
+              method: GET
+              rewrite_to_internal:
+                target:
+                  name: proxy-api
+                  namespace: default
+                path: proxy/$1
+          transform_headers:
+            - add_headers:
+                x-transform-api: "basic-auth"
+              method: GET
+              path: "/{id}"
+              delete_headers: []
+```
+
+### AuthToken Internal API
+
+The *AuthToken Internal* API listens to requests on path `/token` and forwards them upstream to `http://example.com`.
+
+The API is configured with a URL rewrite rule in `url_rewrites` to redirect incoming `GET /token/` requests to the API in the Gateway represented by name `proxy-api` in the `default` namespace. The `/token/` prefix will be stripped from the request URL and the URL will be rewritten to the format `/proxy/$1`. The context variable `$1` is substituted with the remainder of the path request. For example `GET /token/456` will become `GET /proxy/456`.
+
+Furthermore, a header transform rule is configured within `transform_headers` to add the header `x-transform-api` with value `token-auth`, to the request.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["21-35"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: auth-token-internal
+spec:
+  name: AuthToken Internal API
+  protocol: http
+  proxy:
+    listen_path: "/token"
+    target_url: http://example.com
+  active: true
+  use_keyless: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+        use_extended_paths: true
+        extended_paths:
+          url_rewrites:
+            - path: "/{id}"
+              match_pattern: "/token/(.*)"
+              method: GET
+              rewrite_to_internal:
+                target:
+                  name: proxy-api
+                  namespace: default
+                path: proxy/$1
+          transform_headers:
+            - add_headers:
+                x-transform-api: "token-auth"
+              method: GET
+              path: "/{id}"
+              delete_headers: []
+```
+
+### Proxy Internal API
+
+The *Proxy Internal* API is keyless and responsible for listening to requests on path `/proxy` and forwarding upstream to `http://httpbin.org`. The listen path is stripped from the request before it is sent upstream.
+
+This API receives requests forwarded from the internal *AuthToken Internal* and *BasicAuth Internal APIs*. Requests will contain the header `x-transform-api` with value `token-auth` or `basic-auth`, depending upon which internal API the request originated from.
+
+```yaml {linenos=true, linenostart=1, hl_lines=["10-13"]}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: proxy-api
+spec:
+  name: Proxy API
+  protocol: http
+  active: true
+  internal: true
+  proxy:
+    listen_path: "/proxy"
+    target_url: http://httpbin.org
+    strip_listen_path: true
+  use_keyless: true
+```
+
diff --git a/product-stack/tyk-operator/crd-reference.mdx b/product-stack/tyk-operator/crd-reference.mdx
new file mode 100644
index 0000000000..205f7d3969
--- /dev/null
+++ b/product-stack/tyk-operator/crd-reference.mdx
@@ -0,0 +1,14 @@
+---
+title: "Tyk Operator CRD Reference"
+description: "Field reference for every Tyk Operator Custom Resource Definition (CRD)."
+keywords: "Tyk Operator, CRD, Custom Resource Definition, Kubernetes, Reference, ApiDefinition, SecurityPolicy"
+sidebarTitle: "CRD Reference"
+---
+
+import OperatorCRD from '/snippets/operator-crd-reference.mdx';
+
+<Note>
+  This page lists the fields of every Tyk Operator Custom Resource under its `spec`. Field names use dot notation for nested objects (`proxy.target_url`), `[]` for list items (`tags[]`), and `.{key}` for map entries (`auth_configs.{key}`). Within each group, required fields are listed first. Read-only `status` fields are not listed.
+</Note>
+
+<OperatorCRD />
diff --git a/product-stack/tyk-operator/getting-started/tyk-operator-multiple-organisations.mdx b/product-stack/tyk-operator/getting-started/tyk-operator-multiple-organisations.mdx
new file mode 100644
index 0000000000..18214c8d27
--- /dev/null
+++ b/product-stack/tyk-operator/getting-started/tyk-operator-multiple-organisations.mdx
@@ -0,0 +1,110 @@
+---
+title: "Management Multiple Organization With Tyk Operator"
+description: "Learn how to manage multiple organizations with Tyk Operator by defining OperatorContext and referencing it in API definitions."
+keywords: "Operator, Multi-tenancy, API Management"
+sidebarTitle: "Managing Multiple Organizations"
+---
+
+## Introduction
+
+If you want to set up multi-tenant API management with Tyk, follow these steps to define an OperatorContext for connecting and authenticating with a Tyk Dashboard and reference it in your API definitions for specific configurations.
+
+## Defining OperatorContext
+
+An [OperatorContext](/api-management/automations/operator#multi-tenancy-in-tyk) specifies the parameters for connecting and authenticating with a Tyk Dashboard. Below is an example of how to define an `OperatorContext`:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: OperatorContext
+metadata:
+  name: team-alpha
+  namespace: default
+spec:
+  env:
+    # The mode of the admin api
+    # ce - community edition (open source gateway)
+    # pro - dashboard (requires a license)
+    mode: pro
+    # Org ID to use
+    org: *YOUR_ORGANIZATION_ID*
+    # The authorization token this will be set in x-tyk-authorization header on the
+    # client while talking to the admin api
+    auth: *YOUR_API_ACCESS_KEY*
+    # The url to the Tyk Dashboard API
+    url: http://dashboard.tyk.svc.cluster.local:3000
+    # Set this to true if you want to skip tls certificate and host name verification
+    # this should only be used in testing
+    insecureSkipVerify: true
+    # For ingress the operator creates and manages ApiDefinition resources, use this to configure
+    # which ports the ApiDefinition resources managed by the ingress controller binds to.
+    # Use this to override default ingress http and https port
+    ingress:
+      httpPort: 8000
+      httpsPort: 8443
+```
+
+For better security, you can also replace sensitive data with values contained within a referenced secret with `.spec.secretRef`.
+
+In this example, API access key `auth` and organization ID `org` are not specified in the manifest. They are provided through a Kubernetes secret named `tyk-operator-conf` in `alpha` namespace. The secret contains keys `TYK_AUTH` and `TYK_ORG` which correspond to the `auth` and `org` fields respectively.
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: OperatorContext
+metadata:
+  name: team-alpha
+  namespace: default
+spec:
+  secretRef:
+    name: tyk-operator-conf# Secret containing keys TYK_AUTH and TYK_ORG
+    namespace: alpha
+  env:
+    mode: pro
+    url: http://tyk.tykce-control-plane.svc.cluster.local:8001
+    insecureSkipVerify: true
+    ingress:
+      httpPort: 8000
+      httpsPort: 8443
+    user_owners:
+    - a1b2c3d4f5e6f7
+    user_group_owners:
+    - 1a2b3c4d5f6e7f
+```
+
+You can provide the following fields through secret as referenced by `secretRef`. The table shows mappings between `.spec.env` properties and secret `.spec.data` keys. If a value is configured in both the secret and OperatorContext `spec.env` field, the value from secret will take precedence.
+
+| Secret key | .spec.env |
+| :------------ | :----------- |
+| TYK_MODE	 | mode |
+| TYK_URL    | url |
+| TYK_AUTH	 | auth |
+| TYK_ORG	   | org |
+| TYK_TLS_INSECURE_SKIP_VERIFY | insecureSkipVerify |
+| TYK_USER_OWNERS (comma separated list) | user_owners |
+| TYK_USER_GROUP_OWNERS (comma separated list) | user_group_owners |
+
+## Using contextRef in API Definitions
+
+Once an `OperatorContext` is defined, you can reference it in your API Definition objects using `contextRef`. Below is an example:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+  namespace: alpha
+spec:
+  contextRef:
+    name: team-alpha
+    namespace: default
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+In this example, the `ApiDefinition` object references the `team-alpha` context, ensuring that the configuration is applied within the `alpha` organization.
+
diff --git a/product-stack/tyk-operator/mcp-proxy.mdx b/product-stack/tyk-operator/mcp-proxy.mdx
new file mode 100644
index 0000000000..469ce03e6b
--- /dev/null
+++ b/product-stack/tyk-operator/mcp-proxy.mdx
@@ -0,0 +1,217 @@
+---
+title: "Manage MCP Servers with Tyk Operator"
+description: "Use the TykMcpProxyDefinition CRD in Tyk Operator v1.4.0 to proxy, secure, and apply rate limits to Model Context Protocol (MCP) servers in Kubernetes using a GitOps workflow."
+keywords: "MCP, Model Context Protocol, Tyk Operator, Kubernetes, API Management, Security Policy"
+sidebarTitle: "MCP Proxy"
+---
+
+## Overview
+
+From Tyk Operator v1.4.0, you can manage [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) servers declaratively using the `TykMcpProxyDefinition` custom resource. The Operator reconciles the resource into a Tyk-managed MCP proxy, so the same GitOps workflow you use for `ApiDefinition` and `TykOasApiDefinition` resources also applies to MCP servers.
+
+A `TykMcpProxyDefinition` points at a `ConfigMap` that holds the MCP OAS document. The Operator reads the document from the ConfigMap and synchronizes it to Tyk. Access to tools, resources, prompts, and the underlying JSON-RPC methods is controlled through the existing `SecurityPolicy` resource, extended with MCP-specific fields.
+
+## Prerequisites
+
+- Tyk Operator v1.4.0 or later installed in the cluster.
+- A Tyk Gateway / Dashboard with MCP proxy support enabled.
+- A `ConfigMap` containing the MCP OAS document under a known key (for example `mcp.json`).
+
+## Custom Resource Reference
+
+**Kind:** `TykMcpProxyDefinition`
+
+**Group / Version:** `tyk.tyk.io/v1alpha1`
+
+**Scope:** Namespaced
+
+**Short name:** `tykmcp` (usable as `kubectl get tykmcp`)
+
+### Spec
+
+| Field | Type | Description |
+| :---- | :--- | :---------- |
+| `contextRef` | object (optional) | Reference (`name`, `namespace`) to an [OperatorContext](/api-management/automations/operator#multi-tenancy-in-tyk) used when reconciling this resource. Use this for multi-tenant setups. |
+| `tykMCP.configmapRef.name` | string | Name of the `ConfigMap` that holds the MCP OAS document. |
+| `tykMCP.configmapRef.namespace` | string (optional) | Namespace of the ConfigMap. Defaults to the resource's namespace. |
+| `tykMCP.configmapRef.keyName` | string | Key inside the ConfigMap's `data` map that contains the OAS document. |
+
+### Status
+
+| Field | Description |
+| :---- | :---------- |
+| `id` | Tyk-side API identifier. |
+| `name` | API name as registered in Tyk. |
+| `listenPath` | Base path on Tyk where the MCP proxy is served. |
+| `domain` | Custom domain, if configured in the OAS document. |
+| `enabled` | Whether the API is active. |
+| `latestTransaction.status` | Result of the last reconciliation. |
+| `linkedByPolicies` | Security policies that reference this MCP proxy. |
+
+`kubectl get tykmcp -o wide` surfaces `Domain`, `ListenPath`, `Enabled`, and `SyncStatus` as printed columns.
+
+## Quick Start
+
+The example below proxies a mock MCP server reachable at `http://mock-mcp-server.default.svc.cluster.local:7878`.
+
+### 1. Store the MCP OAS document in a `ConfigMap`
+
+```yaml expandable
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mock-mcp-config
+  namespace: default
+data:
+  mcp.json: |
+    {
+      "info": {
+        "title": "Mock MCP Proxy",
+        "version": "1.0.0"
+      },
+      "openapi": "3.0.3",
+      "components": {},
+      "paths": {},
+      "x-tyk-api-gateway": {
+        "info": {
+          "id": "mock-mcp-api-id-001",
+          "name": "Mock MCP Proxy",
+          "state": {
+            "active": true
+          }
+        },
+        "upstream": {
+          "url": "http://mock-mcp-server.default.svc.cluster.local:7878"
+        },
+        "server": {
+          "listenPath": {
+            "value": "/mock-mcp/",
+            "strip": true
+          }
+        }
+      }
+    }
+```
+
+### 2. Create the `TykMcpProxyDefinition`
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykMcpProxyDefinition
+metadata:
+  name: mock-mcp
+  namespace: default
+spec:
+  tykMCP:
+    configmapRef:
+      name: mock-mcp-config
+      namespace: default
+      keyName: mcp.json
+```
+
+Apply both manifests and verify with:
+
+```bash
+kubectl apply -f mock-mcp-config.yaml -f mock-mcp.yaml
+kubectl get tykmcp -o wide
+```
+
+If you update the `ConfigMap`, the Operator detects the change (via `latestConfigMapHash`) and pushes the new OAS document to Tyk on the next reconciliation.
+
+## Securing an MCP Proxy with a `SecurityPolicy`
+
+The `SecurityPolicy` resource is extended with two MCP-aware blocks inside each entry of `access_rights_array`:
+
+- `mcp_access_rights` — allow/block lists for MCP tools, resources, and prompts.
+- `json_rpc_methods_access_rights` — allow/deny lists keyed by JSON-RPC method.
+- `mcp_primitives` — per-primitive rate limits.
+- `json_rpc_methods` — rate limits keyed by JSON-RPC method (`tools/call`, `tools/list`, `resources/read`, `prompts/get`, ...).
+
+For background on the underlying gateway feature, see the [MCP proxy policies documentation](/ai-management/mcp-gateway/policies).
+
+Reference an MCP proxy by setting `kind: TykMcpProxyDefinition` on the access entry.
+
+### Allow / block lists
+
+```yaml expandable
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: mcp-acl-policy
+  namespace: default
+spec:
+  name: MCP ACL Policy
+  state: active
+  active: true
+  access_rights_array:
+    - name: mock-mcp
+      namespace: default
+      kind: TykMcpProxyDefinition
+      mcp_access_rights:
+        tools:
+          allowed: ["get_users", "get_products", "generate_uuid"]
+          blocked: ["delete_user", "slow_response"]
+        resources:
+          allowed: ["users://list", "products://catalog"]
+        prompts:
+          allowed: ["user_management", "ecommerce_assistant"]
+```
+
+### Per-primitive and JSON-RPC rate limits
+
+```yaml expandable
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: mcp-ratelimit-policy
+  namespace: default
+spec:
+  name: MCP Rate Limit Policy
+  state: active
+  active: true
+  access_rights_array:
+    - name: mock-mcp
+      namespace: default
+      kind: TykMcpProxyDefinition
+      mcp_primitives:
+        - type: tool
+          name: get_users
+          limit:
+            rate: "10"
+            per: "60"
+        - type: resource
+          name: "users://list"
+          limit:
+            rate: "20"
+            per: "60"
+        - type: prompt
+          name: "user_management"
+          limit:
+            rate: "3"
+            per: "60"
+      json_rpc_methods:
+        - name: tools/call
+          limit:
+            rate: "100"
+            per: "60"
+        - name: resources/read
+          limit:
+            rate: "200"
+            per: "60"
+```
+
+<Note>
+`rate` and `per` are declared as `Float64` strings in the CRD schema — quote the values in YAML or `kubectl apply` will reject the manifest.
+</Note>
+
+`type` in `mcp_primitives` accepts `tool`, `resource`, or `prompt`.
+
+## Verifying
+
+```bash
+kubectl get tykmcp -o wide
+kubectl describe tykmcp mock-mcp
+```
+
+The `Status` block reports the reconciled `listenPath`, `domain`, `enabled` flag, and `latestTransaction.status`. Failed reconciliations also surface as Kubernetes events on the resource.
+
diff --git a/product-stack/tyk-operator/tyk-ingress-controller.mdx b/product-stack/tyk-operator/tyk-ingress-controller.mdx
new file mode 100644
index 0000000000..068afc0097
--- /dev/null
+++ b/product-stack/tyk-operator/tyk-ingress-controller.mdx
@@ -0,0 +1,411 @@
+---
+title: "Tyk Operator as Ingress Controller"
+description: "Learn how to use Tyk Operator as an Ingress Controller to manage API traffic in Kubernetes"
+keywords: "Tyk Operator, Ingress Controller, Kubernetes, API Management"
+sidebarTitle: "Kubernetes Ingress"
+---
+
+## Introduction
+
+In Kubernetes, the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) resource defines routing rules for external HTTP/S traffic to services within a cluster, based on domains or paths. An [Ingress Controller](https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/), like NGINX or HAProxy, interprets these rules and configures the network infrastructure to route traffic, handling SSL termination and load balancing.
+
+The Tyk Operator builds upon the idea of Kubernetes Ingress by allowing you to reuse existing Ingress definitions while adding advanced API management features like authentication, rate limiting, and monitoring. This approach provides seamless ingress traffic management with powerful API gateway capabilities in a unified solution.
+
+## How Tyk Operator Works as an Ingress Controller
+When you use Tyk Operator as an Ingress Controller, each "path" defined in your existing Ingress resource is treated as an "API" within Tyk. 
+
+Using this Ingress spec as example:
+
+```yaml{hl_lines=["6-8", "13-13", "15-24"],linenos=true}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: httpbin-ingress
+  annotations:
+    kubernetes.io/ingress.class: tyk # Specify Tyk as Ingress Controller
+    tyk.io/template: myapideftemplate # The metadata name of the ApiDefinition or TykOasApiDefinition resource in the same namespace
+    tyk.io/template-kind: ApiDefinition # Can be "ApiDefinition" (Default) or "TykOasApiDefinition"
+spec:
+  tls:
+    - hosts:
+        - myingress.do.poc.tyk.technology
+      secretName: httpbin-ingress-tls
+  rules:
+  - host: myingress.do.poc.tyk.technology
+    http:
+      paths:
+      - path: /httpbin             # Corresponds to API listen path
+        pathType: Prefix
+        backend:                   # Corresponds to upstream URL
+          service:
+            name: httpbin
+            port:
+              number: 8000
+```
+
+Here's how it works:
+
+- **Path Mapping**: Tyk Operator will automatically create APIs in Tyk for each path for a specific rule defined in Ingress resource. Just as with traditional Ingress, incoming requests are routed to the correct backend service within the cluster based on the host and paths defined in the Ingress rules.
+
+  In the given example, Tyk Operator is designated as the Ingress Controller for this Ingress resource. Tyk Operator reads this Ingress definition and automatically creates a corresponding API in the Tyk Gateway. The API will have:
+    
+    - A **custom domain** set to `myingress.do.poc.tyk.technology`, as defined by the `host` field in the Ingress rule.
+    - The TLS certificate from secret `httpbin-ingress-tls` uploaded to Tyk and **certificates** field set to the resulting certificate ID.
+    - A **listen path** set to `/httpbin`, which is defined by the `path` field in the Ingress rule.
+    - An **upstream URL** set to `http://httpbin.default.svc:8000`, which corresponds to the backend service defined in the Ingress (`httpbin` service running on port `8000`).
+
+- **API Management Through Tyk**: At the same time, Tyk allows you to apply API management features by referencing a configuration template. This template is defined using either an `ApiDefinition` or `TykOasApiDefinition` resource. These resources provide a reference configuration that includes details on how the API should be managed, such as security policies, traffic controls, and transformations.
+
+  In the given example, there are two important annotations in the Ingress metadata:
+
+  ```yaml
+    annotations:
+      tyk.io/template: myapideftemplate
+      tyk.io/template-kind: ApiDefinition
+  ```
+
+  These annotations specify that Tyk Operator should use a resource named `myapideftemplate` in the same namespace as the reference for API configuration. The `tyk.io/template-kind` annotation indicates that this reference is of type `ApiDefinition`. Alternatively, it could be a `TykOasApiDefinition`, depending on the user's choice. Tyk Operator detects these annotations and looks for the specified resource in the same namespace. For each path defined in the Ingress, Tyk Operator creates a corresponding API in Tyk by copying the specification from `myapideftemplate` resource (such as authentication type, rate limiting, etc.) and then updates only the relevant fields like custom domain, certificates, listen path, and upstream URL based on the Ingress spec.
+
+  Note that `ApiDefinition` or `TykOasApiDefinition` created for use as a template for Ingress resources should have a special label set so that Tyk Operator would not manage it as ordinary APIs. Here is the required label for `ApiDefinition` and `TykOasApiDefinition` respectively:
+
+  Label for `ApiDefinition` indicating it is a resource template.
+
+  ```yaml
+    labels:
+      template: "true"
+  ```
+
+  Label for `TykOasApiDefinition` indicating it is a resource template.
+
+  ```yaml
+    labels:
+      tyk.io/ingress-template: "true"
+  ```
+
+  Note that use of `TykStreamsApiDefinition` as resource template is not supported.
+
+- **Automated Resource Handling**: Tyk Operator handles the automatic discovery and management of existing Ingress resources, eliminating the need for manual migration of all Ingress rules into API definitions. You can simply define an API configuration template as a `TykOasApiDefinition` resource or `ApiDefinition` resource and then let Tyk Operator creates all the APIs from your existing Ingress rules using the referenced resource as template, streamlining the transition process.
+
+  Additionally, the Tyk Operator also handles any changes to the Ingress resources it manages. If an Ingress resource is updated — whether through the addition, removal, or modification of paths in the Ingress rules — Tyk Operator automatically reconfigures the corresponding Tyk APIs to ensure they remain in sync with the updated Ingress configuration. This dynamic updating capability ensures that your API management remains consistent and up-to-date with the latest changes in your Kubernetes environment.
+
+This approach enables you to quickly and easily integrate advanced API management functionalities into your existing Kubernetes environment without needing to change your current configurations significantly.
+
+## Configuration Examples
+
+To configure Tyk Operator to handle Ingress resources, specify ingress class as `tyk` in the Ingress resource. You can also optionally create a `ApiDefinition` or `TykOasApiDefinition` resource template that provides default API configurations. This allows Tyk Operator to read the Ingress resource and create API Definition resources based on ingress path and referenced template.
+
+The following sections shows some example of Tyk `ApiDefinition` or `TykOasApiTemplate` template and Ingress specification.
+
+### HTTP host based and/or path based routing
+
+<Expandable title='Click to expand'>
+```yaml {hl_lines=["6-7", "10-48"],linenos=true}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: httpbin-ingress
+  annotations:
+    kubernetes.io/ingress.class: tyk # <----------------- REFERENCES TYK INGRESS CONTROLLER
+spec:
+  rules:
+    - host: httpbin.ahmet
+      http:
+        paths:
+          - path: / # host routing: http://httpbin.ahmet/
+            pathType: Prefix
+            backend:
+              service:
+                name: httpbin1
+                port:
+                  number: 8000
+          - path: /httpbin # host + path routing: http://httpbin.ahmet/httpbin
+            pathType: Prefix
+            backend:
+              service:
+                name: httpbin2
+                port:
+                  number: 8000
+    - http:
+        paths:
+          - path: /pathonly  # path only routing: http://IPADDRESS/pathonly
+            pathType: Prefix
+            backend:
+              service:
+                name: httpbin3
+                port:
+                  number: 8000
+    - host: "*.foo.com" # wildcard
+      # curl http://bar.foo.com/httpbin/get === OK Matches based on shared suffix
+      # curl http://baz.bar.foo.com/httpbin/get === NOK No match, wildcard only covers a single DNS label
+      # curl http://foo.com/httpbin/get === NOK No match, wildcard only covers a single DNS label
+      http:
+        paths:
+          - path: /httpbin
+            pathType: Prefix
+            backend:
+              service:
+                name: httpbin4
+                port:
+                  number: 8000
+```
+
+In this example, 4 APIs will be created by Tyk Operator. It illustrates how different Ingress rules: host based routing, path based routing, host + path based routing, and wildcard hosts are handled by Tyk Operator.
+
+| API Name | Custom Domain | Listen Path | Target URL | Example request that would be handled by this API |
+| :---------- | :--------------- | :------------- | :------------ | :--------------------------------------------------- |
+| default-httpbin-ingress-a1863f096         |  httpbin.ahmet |  /          |  http://httpbin1.default.svc.cluster.local:8000 | http://httpbin.ahmet/  |
+| default-httpbin-ingress-d33713b8b |  httpbin.ahmet |  /httpbin   |  http://httpbin2.default.svc.cluster.local:8000 | http://httpbin.ahmet/httpbin |
+| default-httpbin-ingress-00254eeb0             |                |  /pathonly  |  http://httpbin3.default.svc.cluster.local:8000 | http://IPADDRESS/pathonly |
+| default-httpbin-ingress-3af1fef04 |  `{?:[^.]+}.foo.com`  | /httpbin | http://httpbin4.default.svc:8000 | http://bar.foo.com/httpbin |
+</Expandable>
+
+### HTTPS with cert-manager integration
+
+<Expandable title='Click to expand'>
+```yaml {hl_lines=["7-7", "13-13", "15-24", "58-58"],linenos=true}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: httpbin-ingress-tls
+  annotations:
+    kubernetes.io/ingress.class: tyk # <----------------- REFERENCES TYK INGRESS CONTROLLER
+    cert-manager.io/cluster-issuer: "letsencrypt-staging" # this annotation indicates the issuer to use.
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  tls: 
+    - hosts: # < placing a host in the TLS config will determine what ends up in the cert's subjectAltNames
+        - myingress.do.poc.tyk.technology
+      secretName: httpbin-ingress-tls-secret # < cert-manager will store the created certificate in this secret.
+  rules:
+    - host: myingress.do.poc.tyk.technology
+      http:
+        paths:
+          - path: /httpbin
+            pathType: Prefix
+            backend:
+              service:
+                name: httpbin
+                port:
+                  number: 8000
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: ahmet@tyk.io
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+      - http01:
+          ingress:
+            class: tyk
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ingress-gateway
+  namespace: tyk
+spec:
+  ports:
+    - name: http
+      targetPort: 8000
+      port: 80
+      protocol: TCP
+    - name: https
+      targetPort: 443
+      port: 443
+      protocol: TCP
+  selector:
+    app: gateway-tyk-stack-tyk-gateway
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+```
+
+A common use-case for [cert-manager](https://cert-manager.io/docs/usage/ingress/) is requesting TLS signed certificates to secure your ingress resources. This can be done by simply adding [annotations](https://cert-manager.io/docs/usage/ingress/#supported-annotations), such as `cert-manager.io/cluster-issuer`, to your Ingress resources and cert-manager will facilitate creating the `Certificate` resource for you. 
+
+In this example, cert-manager watches the ingress resource `httpbin-ingress-tls` and ensures a TLS secret named `httpbin-ingress-tls-secret` (provided by the `tls.secretName` field) in the same namespace will be created and configured as described on the Ingress. This example also exposes Tyk Gateway as a `LoadBalancer` service with the `ingress-gateway` resource. This is essential for completing the ACME challenge from [Let\'s Encrypt](https://letsencrypt.org).
+
+With this configuration, Tyk Gateway can serve HTTPS requests via port 443, with a TLS certificate provisioned by cert-manager. An API is created by Tyk Operator to serve the ingress traffic at https://myingress.do.poc.tyk.technology/httpbin, and forwards the request to http://httpbin.default.svc:8000 within the cluster.
+</Expandable>
+
+### ApiDefinition Template
+
+<Expandable title='Click to expand'>
+```yaml{hl_lines=["5-6"],linenos=true}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+ name: myapideftemplate
+ labels:
+  template: "true" # Instructs Tyk Operator to skip reconciliation for this resource
+spec:
+ name: foo
+ protocol: http
+ use_keyless: true
+ proxy:
+  target_url: http://example.com
+```
+
+This example defines an `ApiDefinition` resource that can be used as configuration template for APIs created for Ingresses. It has a label `template: "true"` which let Tyk Operator knows that it is not a real resource, and hence does not require reconciliation. This will allow the ApiDefinition to be stored inside Kubernetes as a resource, but will not reconcile the ApiDefinition inside Tyk. All mandatory fields inside the ApiDefinition spec are still mandatory, but can be replaced with placeholders as they will be overwritten by the Ingress reconciler.
+
+```yaml{hl_lines=["7-8"],linenos=true}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: my-ingress
+  annotations:
+    kubernetes.io/ingress.class: tyk # <----------------- REFERENCES TYK INGRESS CONTROLLER
+    tyk.io/template: myapideftemplate # The metadata name of the ApiDefinition or TykOasApiDefinition resource in the same namespace
+    tyk.io/template-kind: ApiDefinition # Can be "ApiDefinition" (Default) or "TykOasApiDefinition"
+...
+```
+
+To make use of the ApiDefinition template, make sure to add annotations `tyk.io/template` and `tyk.io/template-kind` to your Ingress resource. Here, we specify that the template to be used is named "myapideftemplate", and the resource represents a Tyk Classic API "ApiDefinition".
+</Expandable>
+
+### TykOasApiDefinition Template
+
+<Expandable title='Click to expand'>
+```yaml{hl_lines=["39-40"],linenos=true}
+apiVersion: v1
+data:
+  test_oas.json: |-
+    {
+        "info": {
+          "title": "OAS Template",
+          "version": "1.0.0"
+        },
+        "openapi": "3.0.3",
+        "components": {},
+        "paths": {},
+        "x-tyk-api-gateway": {
+          "info": {
+            "name": "OAS Template",
+            "state": {
+              "active": true
+            }
+          },
+          "upstream": {
+            "url": "http://example"
+          },
+          "server": {
+            "listenPath": {
+              "value": "/example/",
+              "strip": true
+            }
+          }
+        }
+      }
+kind: ConfigMap
+metadata:
+  name: cm
+  namespace: default
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: oasapitemplate
+  labels:
+    tyk.io/ingress-template: "true"
+spec:
+  tykOAS:
+    configmapRef:
+      name: cm
+      namespace: default
+      keyName: test_oas.json
+```
+
+Here provides a minimum template as `TykOasApiDefinition`. The `TykOasApiDefinition` must have a label `tyk.io/ingress-template: "true"` so that Tyk Operator will not reconcile it with Tyk.
+
+```yaml{hl_lines=["7-8"],linenos=true}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: my-ingress
+  annotations:
+    kubernetes.io/ingress.class: tyk # <----------------- REFERENCES TYK INGRESS CONTROLLER
+    tyk.io/template: oasapitemplate # The metadata name of the ApiDefinition or TykOasApiDefinition resource in the same namespace
+    tyk.io/template-kind: TykOasApiDefinition # Can be "ApiDefinition" (Default) or "TykOasApiDefinition"
+...
+```
+
+To make use of the TykOasApiDefinition template, make sure to add annotations `tyk.io/template` and `tyk.io/template-kind` to your Ingress resource. Here, we specify that the template to be used is named "oasapitemplate", and the resource represents a Tyk OAS API "TykOasApiDefinition".
+</Expandable>
+
+## Ingress Class
+
+The value of the `kubernetes.io/ingress.class` annotation identifies the IngressClass that will process Ingress objects.
+
+Tyk Operator by default looks for the value `tyk` and will ignore all other ingress classes. If you wish to override this default behavior,
+ you may do so by setting the environment variable `WATCH_INGRESS_CLASS` in the operator manager deployment. [See Installing Tyk Operator](/tyk-stack/tyk-operator/installing-tyk-operator) for further information.
+
+## API name
+
+Tyk Ingress Controller will create APIs in Tyk for each path defined for a specific rule in Ingress resource. Each API created inside Tyk will follow a special naming convention as follows:
+
+```
+<ingress_namespace>-<ingress_name>-<hash(Host + Path)>
+```
+
+For example, the following ingress resource will create an ApiDefinition called `default-httpbin-ingress-78acd160d` inside Tyk's Gateway.
+ApiDefinition's name comes from:
+
+- `default`: The namespace of this Ingress resource,
+- `httpbin-ingress`: The name of this Ingress resource,
+- `78acd160d`: Short hash (first 9 characters) of Host (`""`) and Path (`/httpbin`). The hash algorithm is SHA256.
+
+```yaml{hl_lines=["4-4"],linenos=true}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+ name: httpbin-ingress
+ annotations:
+  kubernetes.io/ingress.class: tyk # <----------------- REFERENCES TYK INGRESS CONTROLLER
+  tyk.io/template: myapideftemplate # <---------------- REFERENCE TO APIDEFINITION IN SAME NAMESPACE
+spec:
+ rules:
+  - http:
+     paths:
+      - path: /httpbin
+        pathType: Prefix
+        backend:
+         service:
+          name: httpbin
+          port:
+           number: 8000
+```
+
+## Ingress Path Types
+
+Each path in an Ingress must have its own particular path type. Kubernetes offers three types of path types: `ImplementationSpecific`, `Exact`, and `Prefix`. Currently, not all path types are supported. The below table shows the unsupported path types for [Sample HTTP Ingress Resource](/tyk-stack/tyk-operator/create-an-api#set-up-manifest-for-http) based on the examples in the [Kubernetes Ingress documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/#examples).
+
+| Kind   | Path(s)   | Request path(s) | Expected to match?               | Works as Expected                       |
+| :-------- | :----------- | :----------------- | :---------------------------------- | :----------------------------------------- |
+| Exact  | /foo      | /foo/           | No                               | No.                                     |
+| Prefix | /foo/     | /foo, /foo/     | Yes                              | No, /foo/ matches, /foo does not match. |
+| Prefix | /aaa/bb   | /aaa/bbb        | No                               | No, the request forwarded to service.   |
+| Prefix | /aaa/bbb/ | /aaa/bbb        | Yes, ignores trailing slash      | No, /aaa/bbb does not match.            |
+| Prefix | /aaa/bbb  | /aaa/bbbxyz     | No, does not match string prefix | No, the request forwarded to service.   |
+
+Please bear in mind that if `proxy.strip_listen_path` is set to true on API Definition, Tyk strips the listen-path (for example, the listen-path for the Ingress under [Sample HTTP Ingress Resource](/tyk-stack/tyk-operator/create-an-api#set-up-manifest-for-http) is /httpbin) with an empty string.
+
+The following table shows an example of path matching if the listen-path is set to `/httpbin` or `/httpbin/`.
+
+| Kind                   | Path(s)   | Request path(s)           | Matches?                                              |
+| :------------------------ | :----------- | :--------------------------- | :------------------------------------------------------- |
+| Exact                  | /httpbin  | /httpbin, /httpbin/       | Yes. The request forwarded as `/` to your service.    |
+| Prefix                 | /httpbin  | /httpbin, /httpbin/       | Yes. The request forwarded as `/` to your service.    | 
+| ImplementationSpecific | /httpbin  | /httpbin, /httpbin/       | Yes. The request forwarded as `/` to your service.    |
+| Exact                  | /httpbin  | /httpbinget, /httpbin/get | Yes. The request forwarded as `/get` to your service. |
+| Prefix                 | /httpbin  | /httpbinget, /httpbin/get | Yes. The request forwarded as `/get` to your service. | 
+| ImplementationSpecific | /httpbin  | /httpbinget, /httpbin/get | Yes. The request forwarded as `/get` to your service. |
+| Exact                  | /httpbin/ | /httpbin/,  /httpbin/get  | Yes. The request forwarded as `/get` to your service. |
+| Prefix                 | /httpbin/ | /httpbin/,  /httpbin/get  | Yes. The request forwarded as `/get` to your service. | 
+| ImplementationSpecific | /httpbin/ | /httpbin/,  /httpbin/get  | Yes. The request forwarded as `/get` to your service. |
+| Exact                  | /httpbin/ | /httpbin                  | No. Ingress cannot find referenced service.           |
+| Prefix                 | /httpbin/ | /httpbin                  | No. Ingress cannot find referenced service.           |  
+| ImplementationSpecific | /httpbin/ | /httpbin                  | No. Ingress cannot find referenced service.           | 
+
diff --git a/product-stack/tyk-sync/commands.mdx b/product-stack/tyk-sync/commands.mdx
new file mode 100644
index 0000000000..d945bbc1df
--- /dev/null
+++ b/product-stack/tyk-sync/commands.mdx
@@ -0,0 +1,76 @@
+---
+title: "Tyk Sync Commands"
+description: "Learn about the Tyk Sync commands for managing API configurations, examples, and deployments."
+keywords: "Commands, Tyk Sync, API Management, Automations"
+sidebarTitle: "CLI Commands"
+---
+
+In this document, we will cover the various commands available in Tyk Sync.
+
+## Dump Command
+
+| Aspect        | Details                                                                                              |
+| :--------------- | :------------------------------------------------------------------------------------------------------ |
+| **Command**   | `tyk-sync dump`                                                                                       |
+| **Usage**     | ```tyk-sync dump -d DASHBOARD_URL [-s SECRET] [-t PATH]```                                                 |
+| **Flags**     | `-d, --dashboard DASHBOARD_URL`: Tyk Dashboard URL (required)<br />                                    `-h, --help`: Help for the dump command<br />                                   `-t, --target PATH`: Target directory for output files (optional)<br />                                    `-s, --secret SECRET`: API secret for Dashboard access (optional)<br />                                    `--apis IDS`: Specific API IDs to dump<br />                                    `--oas-apis IDS`: Specific OAS API IDs to dump<br />                                    `--policies IDS`: Specific policy IDs to dump<br />                                    `--templates IDS`: Specific template IDs to dump |
+| **Example**   | ```tyk-sync dump --dashboard http://tyk-dashboard:3000 --secret your-secret ```|
+| **Example** | ```tyk-sync dump --dashboard http://tyk-dashboard:3000 --secret your-secret --target /path/to/backup --apis c2ltcGxlLWdyYXBoLWRldi90eWthcGktc2NoZW1h,baa5d2b65f1b45385dac3aeb658fa04c ``` |
+
+## Examples Command
+
+| Aspect        | Details                                                                                              |
+| :--------------- | :------------------------------------------------------------------------------------------------------ |
+| **Command**   | `tyk-sync examples`                                                                                   |
+| **Usage**     | ```tyk-sync examples [flags]```<br />```tyk-sync examples [command]```                                           |
+| **Subcommands**| `publish`: Publish a specific example<br /> `show`: Show details of a specific example              |
+| **Flags**     | `-h, --help`: Help for examples command                                                             |
+| **Example**   | ```tyk-sync examples ```                                                                         |
+
+### Examples Show Command
+
+| Aspect        | Details                                                                                              |
+| :--------------- | :------------------------------------------------------------------------------------------------------ |
+| **Command**   | ```tyk-sync examples show```                                                                              |
+| **Usage**     | ```tyk-sync examples show [flags]```                                                                      |
+| **Flags**     | `-h, --help`: Help for show command<br /> `-l, --location string`: Location of the example           |
+| **Example**   | ```tyk-sync examples show --location="udg/vat-checker" ```                                       |
+
+### Examples Publish Command
+
+| Aspect        | Details                                                                                              |
+| :--------------- | :------------------------------------------------------------------------------------------------------ |
+| **Command**   | ```tyk-sync examples publish```                                                                           |
+| **Usage**     | ```tyk-sync examples publish [flags]```                                                                   |
+| **Flags**     | `-b, --branch string`: Branch to use (default "refs/heads/main")<br /> `-d, --dashboard string`: Dashboard target URL<br /> `-g, --gateway string`: Gateway target URL<br /> `-h, --help`: Help for publish command<br /> `-k, --key string`: Key file location for auth<br /> `-l, --location string`: Location of the example<br /> `-s, --secret string`: API secret<br /> `--test`: Use test publisher, output to stdio |
+| **Example**   | ```tyk-sync examples publish -d="http://localhost:3000" -s="b2d420ca5302442b6f20100f76de7d83" -l="udg/vat-checker" ``` |
+
+## Publish Command
+
+| Aspect        | Details                                                                                              |
+| :--------------- | :------------------------------------------------------------------------------------------------------ |
+| **Command**   | ```tyk-sync publish```                                                                                    |
+| **Usage**     | ```tyk-sync publish {-d DASHBOARD_URL \| -g GATEWAY_URL} [-s SECRET] [-b BRANCH] [-k SSHKEY] [-o ORG_ID] REPOSITORY_URL```<br /><br />```tyk-sync publish {-d DASHBOARD_URL \| -g GATEWAY_URL} [-s SECRET] [-o ORG_ID] -p PATH``` |
+| **Flags**     |  `-b, --branch BRANCH`: Git branch (default "refs/heads/master")<br /> `-d, --dashboard DASHBOARD_URL`: Dashboard URL<br /> `-g, --gateway GATEWAY_URL`: Gateway URL<br /> `-h, --help`: Help for publish command<br /> `-k, --key SSHKEY`: SSH key file location<br /> `-p, --path PATH`: Source file directory<br /> `-s, --secret SECRET`: API secret<br /> `--test`: Use test publisher<br /> `--allow-duplicate-listenpaths`: Allow duplicate listen paths<br /> `--apis IDS`: Specific API IDs to publish<br /> `--oas-apis IDS`: Specific OAS API IDs to publish<br /> `--policies IDS`: Specific policy IDs to publish<br /> `--templates IDS`: Specific template IDs to publish |
+| **Example**   | ```tyk-sync publish -d http://tyk-dashboard:3000 -s your-secret -p /app/data --apis 726e705e6afc432742867e1bd898cb23 ```|
+| **Example** | ```tyk-sync publish -d http://tyk-dashboard:3000 -s your-secret -b develop https://github.com/your-repo/your-apis ``` |
+
+## Sync Command
+
+| Aspect        | Details                                                                                              |
+| :--------------- | :------------------------------------------------------------------------------------------------------ |
+| **Command**   | `tyk-sync sync`                                                                                       |
+| **Usage**     | ```tyk-sync sync {-d DASHBOARD_URL \| -g GATEWAY_URL} [-s SECRET] [-b BRANCH] [-k SSHKEY] [-o ORG_ID] REPOSITORY_URL```<br /><br />```tyk-sync sync {-d DASHBOARD_URL \| -g GATEWAY_URL} [-s SECRET] [-o ORG_ID] -p PATH``` |
+| **Flags**     | `-b, --branch BRANCH`: Git branch (default "refs/heads/master")<br /> `-d, --dashboard DASHBOARD_URL`: Dashboard URL<br /> `-g, --gateway GATEWAY_URL`: Gateway URL<br /> `-h, --help`: Help for sync command<br /> `-k, --key SSHKEY`: SSH key file location<br /> `-o, --org ORG_ID`: Override organization ID<br /> `-p, --path PATH`: Source file directory<br /> `-s, --secret SECRET`: API secret<br /> `--no-delete`: Skip deletion of resources during synchronisation<br /> `--test`: Use test publisher<br /> `--apis IDS`: Specific API IDs to sync (to be deprecated)<br /> `--policies IDS`: Specific policy IDs to sync (to be deprecated) |
+| **Example**   | ```tyk-sync sync -d http://tyk-dashboard:3000 -s your-secret https://github.com/your-repo/your-apis ```|
+| **Example** | ```tyk-sync sync -d http://tyk-dashboard:3000 -s your-secret -p /path/to/your/apis ``` |
+
+## Update Command
+
+| Aspect        | Details                                                                                              |
+| :--------------- | :------------------------------------------------------------------------------------------------------ |
+| **Command**   | `tyk-sync update`                                                                                     |
+| **Usage**     | ```tyk-sync update {-d DASHBOARD_URL \| -g GATEWAY_URL} [-s SECRET] [-b BRANCH] [-k SSHKEY] [-o ORG_ID] REPOSITORY_URL```<br /><br />```tyk-sync update {-d DASHBOARD_URL \| -g GATEWAY_URL} [-s SECRET] [-o ORG_ID] -p PATH``` |
+| **Flags**     | `-b, --branch BRANCH`: Git branch (default "refs/heads/master")<br /> `-d, --dashboard DASHBOARD_URL`: Dashboard URL<br /> `-g, --gateway GATEWAY_URL`: Gateway URL<br /> `-h, --help`: Help for update command<br /> `-k, --key SSHKEY`: SSH key file location<br /> `-p, --path PATH`: Source file directory<br /> `-s, --secret SECRET`: API secret<br /> `--test`: Use test publisher<br /> `--apis IDS`: Specific API IDs to update<br /> `--oas-apis IDS`: Specific OAS API IDs to update<br /> `--policies IDS`: Specific policy IDs to update<br /> `--templates IDS`: Specific template IDs to update |
+| **Example**   | ```tyk-sync update -d http://tyk-dashboard:3000 -s your-secret -p /app/data --apis 726e705e6afc432742867e1bd898cb23```|
+| **Example** | ```tyk-sync update -d http://tyk-dashboard:3000 -s your-secret -b develop https://github.com/your-repo/your-apis ``` |
diff --git a/product-stack/tyk-sync/installing-tyk-sync.mdx b/product-stack/tyk-sync/installing-tyk-sync.mdx
new file mode 100644
index 0000000000..f9ef6044c8
--- /dev/null
+++ b/product-stack/tyk-sync/installing-tyk-sync.mdx
@@ -0,0 +1,79 @@
+---
+title: "Install Tyk Sync"
+description: "Learn how to install Tyk Sync using Docker, Packagecloud, or Homebrew"
+keywords: "Tyk Sync, Installation, Docker, Homebrew, macOS, API Management"
+sidebarTitle: "Installation"
+---
+
+## Overview
+
+**Tyk Sync** is a command line tool and library to manage and synchronise a Tyk installation with your version control system (VCS). It's especially helpful for DevOps teams aiming to automate deployments and manage API configurations efficiently.
+
+On this page, you will find instructions on how to install Tyk Sync using Docker, Packagecloud, or Homebrew.
+
+## Installation Options
+
+| Method           | Description                        |
+| :---------------- | :---------------------------------- |
+| **[Docker](#install-on-docker)**       | Run Tyk Sync in a container |
+| **[Packagecloud](#install-via-package-manager-packagecloud)** | Hosts packages for linux distributions |
+| **[Homebrew](#install-on-macos-homebrew)** | Package manager for macOS |
+
+## Install on Docker
+
+1. **Pull the Docker image**
+
+    Select a specific version from [Docker Hub](https://hub.docker.com/r/tykio/tyk-sync/tags)
+
+    ```bash
+    SYNC_VERSION=v2.1
+    docker pull tykio/tyk-sync:$SYNC_VERSION
+    ```
+
+2. **Run Tyk Sync**
+
+    ```bash
+    docker run tykio/tyk-sync:$SYNC_VERSION version
+    ```
+
+## Install via Package Manager (Packagecloud)
+
+The below instructions are for Debian/Ubuntu systems. For other distributions, refer to the [Packagecloud documentation](https://packagecloud.io/tyk/tyk-sync).
+
+1. **Add the Tyk Sync repository**
+
+    For Debian/Ubuntu systems:
+
+    ```bash
+    curl -s https://packagecloud.io/install/repositories/tyk/tyk-sync/script.deb.sh | sudo bash
+    ```
+
+2. **Install Tyk Sync**
+
+    ```bash
+    sudo apt-get install tyk-sync
+    ```
+
+3. **Verification**
+
+    ```bash
+    tyk-sync version
+    ```
+
+## Install on macOS (Homebrew)
+
+<Note>
+Homebrew installation is available from Tyk Sync **v2.2.0** onwards. For earlier versions, use [Docker](#install-on-docker) instead.
+</Note>
+
+1. **Install Tyk Sync**
+
+    ```bash
+    brew install TykTechnologies/tyk/tyk-sync
+    ```
+
+2. **Verification**
+
+    ```bash
+    tyk-sync version
+    ```
\ No newline at end of file
diff --git a/scripts/README.md b/scripts/README.md
new file mode 100644
index 0000000000..09110151f4
--- /dev/null
+++ b/scripts/README.md
@@ -0,0 +1,109 @@
+# Site Content Analysis Scripts
+
+This directory contains scripts for analyzing the content quality of the Tyk documentation site.
+
+## Browser Site Analyzer
+
+The `browser_site_analyzer.py` script uses a headless browser to analyze documentation pages for content rendering issues, specifically designed for Next.js/Mintlify sites.
+
+### Features
+
+- **Browser-based analysis**: Uses Puppeteer to properly render JavaScript-generated content
+- **Smart content detection**: Waits for `.mdx-content` divs to load with meaningful content
+- **Configurable timing**: Adjustable wait times and timeouts for different site speeds
+- **Comprehensive reporting**: Detailed analysis with statistics and issue identification
+- **Production-ready**: Designed to work with https://tyk.mintlify.app
+
+### Local Usage
+
+```bash
+# Install dependencies
+pip install pyppeteer beautifulsoup4
+
+# Run analysis on production site
+python scripts/browser_site_analyzer.py \
+  --base-url https://tyk.mintlify.app \
+  --docs-json docs.json \
+  --wait-time 3 \
+  --timeout 30
+
+# Run analysis on local development server
+python scripts/browser_site_analyzer.py \
+  --base-url http://localhost:3000 \
+  --docs-json docs.json \
+  --wait-time 1 \
+  --timeout 20
+```
+
+### Parameters
+
+- `--base-url`: Base URL of the website to analyze (default: http://localhost:3000)
+- `--docs-json`: Path to docs.json file (required)
+- `--output-dir`: Directory to save downloaded HTML files (default: site_download)
+- `--report-file`: Output file for detailed JSON report (default: browser_analysis_report.json)
+- `--wait-time`: Time to wait after page load in seconds (default: 4)
+- `--timeout`: Timeout for page operations in seconds (default: 30)
+
+### GitHub Action
+
+The analysis can also be run automatically via GitHub Actions:
+
+1. Go to the **Actions** tab in the repository
+2. Select **"Site Content Analysis"** workflow
+3. Click **"Run workflow"**
+4. Optionally adjust timing parameters:
+   - **Wait time**: 2-4 seconds (recommended for production)
+   - **Timeout**: 30-45 seconds
+5. View results in the action summary
+
+### Output
+
+The script generates:
+
+- **Console output**: Real-time progress and summary statistics
+- **HTML files**: Downloaded pages for manual inspection (in `site_analysis_output/`)
+- **JSON report**: Detailed analysis results (`site_analysis_report.json`)
+- **GitHub summary**: Formatted results in GitHub Actions (when run via workflow)
+
+### Content Quality Criteria
+
+Pages are flagged as having issues if they have:
+- No `.mdx-content` div found
+- Empty `.mdx-content` div
+- Less than 15 meaningful words (>3 characters, alphabetic)
+- Less than 100 total characters in content
+
+### Timing Recommendations
+
+**For localhost development:**
+- `--wait-time 1` (fast local rendering)
+- `--timeout 20` (local network is fast)
+
+**For production sites:**
+- `--wait-time 3` (allow for CDN/network delays)
+- `--timeout 30` (account for slower responses)
+
+**For slow or heavily loaded sites:**
+- `--wait-time 4-6` (extra time for content loading)
+- `--timeout 45-60` (generous timeout for reliability)
+
+### Troubleshooting
+
+**"No URLs found in docs.json"**
+- Verify the docs.json file path is correct
+- Check that docs.json contains a valid navigation structure
+
+**Browser timeout errors**
+- Increase `--timeout` value
+- Check if the target site is accessible
+- Verify network connectivity
+
+**Empty content detected**
+- Increase `--wait-time` to allow more time for content loading
+- Check if the site uses client-side rendering that needs more time
+- Manually verify the page loads correctly in a browser
+
+**Package installation issues**
+- Run: `pip install pyppeteer beautifulsoup4`
+- On first run, pyppeteer will download Chromium automatically
+- Ensure you have sufficient disk space for Chromium download
diff --git a/scripts/add-canonical-urls/index.py b/scripts/add-canonical-urls/index.py
new file mode 100644
index 0000000000..8063908714
--- /dev/null
+++ b/scripts/add-canonical-urls/index.py
@@ -0,0 +1,88 @@
+import os
+import re
+from pathlib import Path
+
+# === CONFIG ===
+ROOT_DIR = Path.cwd()
+BASE_URL = "https://tyk.io/docs"
+
+def find_mdx_files(directory: Path):
+    """Recursively find all .mdx files excluding any folder named 'snippets'."""
+    mdx_files = []
+    for root, dirs, files in os.walk(directory):
+        # Skip any directory named 'snippets'
+        dirs[:] = [d for d in dirs if d != "snippets"]
+
+        for file in files:
+            if file.endswith(".mdx"):
+                full_path = Path(root) / file
+                # Skip if any part of path is 'snippets'
+                if "snippets" in full_path.parts:
+                    print(f"⏩ Skipping file inside snippets: {full_path}")
+                    continue
+                mdx_files.append(full_path)
+    return mdx_files
+
+def build_canonical_url(file_path: Path):
+    """Generate canonical URL, handling index.mdx and stripping version folder."""
+    relative_path = file_path.relative_to(ROOT_DIR).as_posix()
+    clean_path = re.sub(r"\.mdx$", "", relative_path)
+
+    # Remove trailing '/index' if it's an index.mdx
+    canonical_path = re.sub(r"/index$", "", clean_path)
+    if canonical_path == "index":
+        canonical_path = ""  # top-level index
+
+    # Strip version folder if first segment is a number (like 5.8) or "nightly"
+    parts = canonical_path.split("/")
+    if parts and (re.match(r"^\d+(\.\d+)?$", parts[0]) or parts[0] == "nightly"):  # e.g., 5 or 5.8 or nightly
+        parts = parts[1:]  # remove version folder
+    canonical_path = "/".join(parts)
+
+    canonical_url = f"{BASE_URL}{'/' + canonical_path if canonical_path else ''}"
+    return canonical_url
+
+def add_or_update_canonical(file_path: Path):
+    """Add or update the canonical field in the MDX frontmatter."""
+    content = file_path.read_text(encoding="utf-8")
+
+    # Match frontmatter between --- and ---
+    frontmatter_match = re.match(r"^---\n([\s\S]*?)\n---", content)
+    if not frontmatter_match:
+        print(f"⚠️  No frontmatter found in: {file_path}")
+        return
+
+    frontmatter = frontmatter_match.group(1)
+    canonical_url = build_canonical_url(file_path)
+
+    # Add or update canonical field
+    if re.search(r'^["\']?canonical["\']?\s*:', frontmatter, flags=re.MULTILINE):
+        new_frontmatter = re.sub(
+            r'^["\']?canonical["\']?\s*:\s*.*$',
+            f'canonical: "{canonical_url}"',
+            frontmatter,
+            flags=re.MULTILINE
+        )
+        print(f"🔁 Updated canonical in: {file_path}")
+    else:
+        new_frontmatter = frontmatter + f'\ncanonical: "{canonical_url}"'
+        print(f"📝 Added canonical to: {file_path}")
+
+    new_content = re.sub(
+        r"^---\n([\s\S]*?)\n---",
+        f"---\n{new_frontmatter}\n---",
+        content
+    )
+
+    file_path.write_text(new_content, encoding="utf-8")
+
+def main():
+    print("🔍 Searching for .mdx files...")
+    mdx_files = find_mdx_files(ROOT_DIR)
+    print(f"📄 Found {len(mdx_files)} eligible .mdx files")
+
+    for file_path in mdx_files:
+        add_or_update_canonical(file_path)
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/browser_site_analyzer.py b/scripts/browser_site_analyzer.py
new file mode 100644
index 0000000000..2b98939f2f
--- /dev/null
+++ b/scripts/browser_site_analyzer.py
@@ -0,0 +1,495 @@
+#!/usr/bin/env python3
+"""
+Browser-Based Site Content Analyzer
+
+This script uses a headless browser (Puppeteer) to analyze documentation sites
+by visiting each page, waiting for content to render, and examining the final HTML.
+Perfect for Next.js sites with client-side rendering or dynamic content.
+
+USAGE:
+    pip install pyppeteer beautifulsoup4
+    python browser_site_analyzer.py --base-url http://localhost:3000 --docs-json mintlify-poc/docs.json
+    
+FEATURES:
+    - Uses headless browser for accurate content rendering
+    - Waits for .mdx-content divs to load with actual content
+    - Configurable wait times and timeouts
+    - Handles JavaScript-rendered content properly
+    - Same analysis logic as curl version but more reliable
+    - Optional screenshots on failures
+"""
+
+import json
+import os
+import asyncio
+import argparse
+import time
+from pathlib import Path
+from urllib.parse import urlparse, urljoin
+from bs4 import BeautifulSoup
+import re
+
+try:
+    from pyppeteer import launch
+    from pyppeteer.errors import TimeoutError as PuppeteerTimeoutError
+except ImportError:
+    print("❌ pyppeteer not installed. Run: pip install pyppeteer")
+    exit(1)
+
+class BrowserSiteAnalyzer:
+    def __init__(self, base_url, output_dir="site_download", wait_time=4, timeout=30):
+        self.base_url = base_url.rstrip('/')
+        self.output_dir = Path(output_dir)
+        self.output_dir.mkdir(exist_ok=True)
+        self.wait_time = wait_time  # Time to wait after page load
+        self.timeout = timeout * 1000  # Convert to milliseconds for Puppeteer
+        self.browser = None
+        self.results = {
+            'summary': {
+                'total_pages_visited': 0,
+                'total_pages_analyzed': 0,
+                'pages_with_empty_content': 0,
+                'pages_with_sufficient_content': 0,
+                'browser_failures': 0
+            },
+            'empty_pages': [],
+            'healthy_pages': [],
+            'browser_failures': []
+        }
+    
+    def get_urls_from_docs_json(self, docs_json_path):
+        """Extract URLs from docs.json navigation structure."""
+        urls = []
+        
+        try:
+            print(f"Loading navigation from: {docs_json_path}")
+            with open(docs_json_path, 'r') as f:
+                docs_data = json.load(f)
+            
+            def extract_urls_recursive(nav_item, base_url):
+                """Recursively extract URLs from navigation structure."""
+                extracted = []
+                
+                if isinstance(nav_item, dict):
+                    # Check if this item has a page URL
+                    if 'page' in nav_item:
+                        page_url = nav_item['page']
+                        if not page_url.startswith('http'):
+                            page_url = f"{base_url}/{page_url.lstrip('/')}"
+                        extracted.append(page_url)
+                    
+                    # Check for nested navigation
+                    if 'pages' in nav_item:
+                        for sub_item in nav_item['pages']:
+                            extracted.extend(extract_urls_recursive(sub_item, base_url))
+                    
+                elif isinstance(nav_item, str):
+                    # Direct page reference
+                    if not nav_item.startswith('http'):
+                        nav_item = f"{base_url}/{nav_item.lstrip('/')}"
+                    extracted.append(nav_item)
+                
+                return extracted
+            
+            # Extract URLs from navigation
+            if 'navigation' in docs_data:
+                navigation = docs_data['navigation']
+                
+                # Handle different navigation structures
+                if 'tabs' in navigation:
+                    # Mintlify structure with tabs
+                    for tab in navigation['tabs']:
+                        if 'pages' in tab:
+                            for page in tab['pages']:
+                                urls.extend(extract_urls_recursive(page, self.base_url))
+                        if 'groups' in tab:
+                            for group in tab['groups']:
+                                if 'pages' in group:
+                                    for page in group['pages']:
+                                        urls.extend(extract_urls_recursive(page, self.base_url))
+                elif isinstance(navigation, list):
+                    # Direct list of navigation items
+                    for nav_item in navigation:
+                        urls.extend(extract_urls_recursive(nav_item, self.base_url))
+                else:
+                    # Other navigation structures
+                    urls.extend(extract_urls_recursive(navigation, self.base_url))
+            
+            # Also add the home page
+            urls.insert(0, self.base_url)
+            
+            # Remove duplicates while preserving order
+            seen = set()
+            unique_urls = []
+            for url in urls:
+                if url not in seen:
+                    seen.add(url)
+                    unique_urls.append(url)
+            
+            print(f"Found {len(unique_urls)} URLs in docs.json")
+            return unique_urls
+            
+        except Exception as e:
+            print(f"Failed to parse docs.json: {e}")
+            return []
+    
+    def url_to_filename(self, url):
+        """Convert URL to a safe filename."""
+        parsed = urlparse(url)
+        path = parsed.path.strip('/')
+        
+        if not path:
+            return "index.html"
+        
+        # Replace path separators with underscores
+        filename = path.replace('/', '_')
+        
+        # Add .html extension if not present
+        if not filename.endswith('.html'):
+            filename += '.html'
+        
+        # Remove any unsafe characters
+        filename = re.sub(r'[<>:"/\\|?*]', '_', filename)
+        
+        return filename
+    
+    async def init_browser(self):
+        """Initialize the browser instance."""
+        print("🚀 Launching headless browser...")
+        self.browser = await launch(
+            headless=True,
+            args=[
+                '--no-sandbox',
+                '--disable-setuid-sandbox',
+                '--disable-dev-shm-usage',
+                '--disable-gpu',
+                '--no-first-run',
+                '--no-default-browser-check',
+                '--disable-default-apps'
+            ]
+        )
+        print("✅ Browser launched successfully")
+    
+    async def close_browser(self):
+        """Close the browser instance."""
+        if self.browser:
+            await self.browser.close()
+            print("🔒 Browser closed")
+    
+    async def download_page_with_browser(self, url):
+        """Download and render a single page using browser."""
+        filename = self.url_to_filename(url)
+        filepath = self.output_dir / filename
+        
+        print(f"🌐 Visiting: {url} -> {filename}")
+        
+        page = None
+        try:
+            # Create new page
+            page = await self.browser.newPage()
+            
+            # Set viewport and user agent
+            await page.setViewport({'width': 1280, 'height': 720})
+            await page.setUserAgent('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36')
+            
+            # Navigate to the page
+            print(f"   📄 Loading page...")
+            response = await page.goto(url, {'waitUntil': 'networkidle0', 'timeout': self.timeout})
+            
+            if not response or response.status >= 400:
+                error_msg = f"HTTP {response.status if response else 'No response'}"
+                print(f"   ❌ Failed to load: {error_msg}")
+                return filepath, False, error_msg
+            
+            print(f"   ⏳ Waiting for content to render...")
+            
+            # Wait for .mdx-content div to appear
+            try:
+                await page.waitForSelector('div[class*="mdx-content"]', {'timeout': self.timeout})
+                print(f"   ✅ Found .mdx-content div")
+            except PuppeteerTimeoutError:
+                print(f"   ⚠️  No .mdx-content div found within timeout")
+            
+            # Additional wait for content to load
+            if self.wait_time > 0:
+                print(f"   ⏱️  Waiting {self.wait_time}s for content to fully load...")
+                await asyncio.sleep(self.wait_time)
+            
+            # Try to wait for meaningful content in .mdx-content div
+            try:
+                await page.waitForFunction(
+                    '''() => {
+                        const mdxDiv = document.querySelector('div[class*="mdx-content"]');
+                        if (!mdxDiv) return false;
+                        const text = mdxDiv.innerText.trim();
+                        return text.length > 50; // Wait for at least 50 characters
+                    }''',
+                    {'timeout': 5000}  # 5 second timeout for content
+                )
+                print(f"   ✅ Content loaded successfully")
+            except PuppeteerTimeoutError:
+                print(f"   ⚠️  Content may still be loading...")
+            
+            # Get the final HTML content
+            html_content = await page.content()
+            
+            # Save HTML to file
+            with open(filepath, 'w', encoding='utf-8') as f:
+                f.write(html_content)
+            
+            print(f"   ✅ Page saved: {filename}")
+            return filepath, True, None
+            
+        except PuppeteerTimeoutError as e:
+            error_msg = f"Browser timeout: {str(e)}"
+            print(f"   ❌ Timeout: {error_msg}")
+            return filepath, False, error_msg
+            
+        except Exception as e:
+            error_msg = f"Browser error: {str(e)}"
+            print(f"   ❌ Error: {error_msg}")
+            return filepath, False, error_msg
+            
+        finally:
+            if page:
+                await page.close()
+    
+    def analyze_html_content(self, filepath, url):
+        """Analyze downloaded HTML file for content issues."""
+        try:
+            with open(filepath, 'r', encoding='utf-8') as f:
+                html_content = f.read()
+            
+            soup = BeautifulSoup(html_content, 'html.parser')
+            
+            # Get page title
+            title_tag = soup.find('title')
+            page_title = title_tag.get_text().strip() if title_tag else "Unknown"
+            
+            # Look for .mdx-content div specifically
+            mdx_content_div = soup.find('div', class_=lambda x: x and 'mdx-content' in x)
+            
+            page_info = {
+                'url': url,
+                'filename': filepath.name,
+                'title': page_title,
+                'has_mdx_content_div': mdx_content_div is not None,
+                'mdx_content_length': 0,
+                'mdx_content_text': '',
+                'total_body_length': 0,
+                'meaningful_words': 0,
+                'is_empty': False,
+                'issues': []
+            }
+            
+            # Analyze .mdx-content div
+            if mdx_content_div:
+                mdx_text = mdx_content_div.get_text().strip()
+                page_info['mdx_content_length'] = len(mdx_text)
+                page_info['mdx_content_text'] = mdx_text[:200]  # First 200 chars for preview
+                
+                # Count meaningful words in mdx content
+                words = mdx_text.split()
+                meaningful_words = [w for w in words if len(w) > 3 and w.isalpha()]
+                page_info['meaningful_words'] = len(meaningful_words)
+                
+                # Check if content is empty or insufficient
+                if len(mdx_text) == 0:
+                    page_info['is_empty'] = True
+                    page_info['issues'].append("MDX content div is completely empty")
+                elif len(meaningful_words) < 15:
+                    page_info['is_empty'] = True
+                    page_info['issues'].append(f"MDX content has only {len(meaningful_words)} meaningful words (need 15+)")
+                elif len(mdx_text) < 100:
+                    page_info['is_empty'] = True
+                    page_info['issues'].append(f"MDX content is very short ({len(mdx_text)} characters)")
+            else:
+                page_info['is_empty'] = True
+                page_info['issues'].append("No .mdx-content div found")
+            
+            # Also analyze total body content for comparison
+            body = soup.find('body')
+            if body:
+                body_text = body.get_text().strip()
+                page_info['total_body_length'] = len(body_text)
+            
+            return page_info
+            
+        except Exception as e:
+            return {
+                'url': url,
+                'filename': filepath.name,
+                'title': 'Error',
+                'has_mdx_content_div': False,
+                'mdx_content_length': 0,
+                'mdx_content_text': '',
+                'total_body_length': 0,
+                'meaningful_words': 0,
+                'is_empty': True,
+                'issues': [f"Error analyzing HTML: {str(e)}"]
+            }
+    
+    async def visit_and_analyze_site(self, urls):
+        """Visit all pages with browser and analyze their content."""
+        print(f"\n🚀 Starting browser analysis of {len(urls)} pages...")
+        print(f"📁 Saving files to: {self.output_dir}")
+        print(f"⏱️  Wait time per page: {self.wait_time}s")
+        print(f"⏰ Timeout per page: {self.timeout/1000}s")
+        
+        # Initialize browser
+        await self.init_browser()
+        
+        try:
+            for i, url in enumerate(urls, 1):
+                print(f"\n[{i}/{len(urls)}] Processing: {url}")
+                
+                # Visit the page with browser
+                filepath, success, error = await self.download_page_with_browser(url)
+                
+                if success:
+                    self.results['summary']['total_pages_visited'] += 1
+                    
+                    # Analyze the downloaded HTML
+                    page_info = self.analyze_html_content(filepath, url)
+                    self.results['summary']['total_pages_analyzed'] += 1
+                    
+                    # Categorize the results
+                    if page_info['is_empty']:
+                        self.results['empty_pages'].append(page_info)
+                        self.results['summary']['pages_with_empty_content'] += 1
+                        print(f"   ❌ Empty content: {page_info['issues']}")
+                    else:
+                        self.results['healthy_pages'].append(page_info)
+                        self.results['summary']['pages_with_sufficient_content'] += 1
+                        print(f"   ✅ Good content: {page_info['meaningful_words']} words, {page_info['mdx_content_length']} chars")
+                else:
+                    self.results['browser_failures'].append({
+                        'url': url,
+                        'error': error
+                    })
+                    self.results['summary']['browser_failures'] += 1
+        
+        finally:
+            # Close browser
+            await self.close_browser()
+        
+        return self.results
+    
+    def print_summary_report(self):
+        """Print a comprehensive summary of the analysis."""
+        summary = self.results['summary']
+        
+        print("\n" + "="*80)
+        print("BROWSER-BASED SITE CONTENT ANALYSIS SUMMARY")
+        print("="*80)
+        print(f"Total pages visited: {summary['total_pages_visited']}")
+        print(f"Total pages analyzed: {summary['total_pages_analyzed']}")
+        print(f"Pages with empty/insufficient content: {summary['pages_with_empty_content']}")
+        print(f"Pages with sufficient content: {summary['pages_with_sufficient_content']}")
+        print(f"Browser failures: {summary['browser_failures']}")
+        print()
+        
+        if self.results['empty_pages']:
+            print("🚨 PAGES WITH EMPTY OR INSUFFICIENT CONTENT:")
+            print()
+            
+            for page in self.results['empty_pages']:
+                print(f"❌ {page['url']}")
+                print(f"   Title: {page['title']}")
+                print(f"   File: {page['filename']}")
+                print(f"   MDX content length: {page['mdx_content_length']} characters")
+                print(f"   Meaningful words: {page['meaningful_words']}")
+                print(f"   Has .mdx-content div: {page['has_mdx_content_div']}")
+                if page['mdx_content_text']:
+                    print(f"   Content preview: {page['mdx_content_text'][:100]}...")
+                print(f"   Issues: {', '.join(page['issues'])}")
+                print()
+        
+        if self.results['browser_failures']:
+            print("🚨 BROWSER FAILURES:")
+            print()
+            
+            for failure in self.results['browser_failures']:
+                print(f"❌ {failure['url']}")
+                print(f"   Error: {failure['error']}")
+                print()
+        
+        if summary['pages_with_sufficient_content'] > 0:
+            print("✅ PAGES WITH GOOD CONTENT:")
+            print()
+            
+            for page in self.results['healthy_pages'][:5]:  # Show first 5
+                print(f"✅ {page['url']}")
+                print(f"   Title: {page['title']}")
+                print(f"   MDX content: {page['mdx_content_length']} chars, {page['meaningful_words']} words")
+                if page['mdx_content_text']:
+                    print(f"   Preview: {page['mdx_content_text'][:100]}...")
+                print()
+            
+            if len(self.results['healthy_pages']) > 5:
+                print(f"   ... and {len(self.results['healthy_pages']) - 5} more pages with good content")
+                print()
+        
+        print("="*80)
+        print(f"RESULT: {summary['pages_with_empty_content']} pages have content issues out of {summary['total_pages_analyzed']} analyzed")
+        print("="*80)
+    
+    def save_detailed_report(self, output_file="browser_analysis_report.json"):
+        """Save detailed results to JSON file."""
+        with open(output_file, 'w') as f:
+            json.dump(self.results, f, indent=2)
+        print(f"\n📄 Detailed report saved to: {output_file}")
+
+async def main():
+    """Main function to run the browser-based site analyzer."""
+    parser = argparse.ArgumentParser(description='Browser-based site content analyzer')
+    parser.add_argument('--base-url', default='http://localhost:3000', 
+                       help='Base URL of the website to analyze')
+    parser.add_argument('--docs-json', required=True,
+                       help='Path to docs.json file')
+    parser.add_argument('--output-dir', default='site_download',
+                       help='Directory to save downloaded HTML files')
+    parser.add_argument('--report-file', default='browser_analysis_report.json',
+                       help='Output file for detailed JSON report')
+    parser.add_argument('--wait-time', type=int, default=4,
+                       help='Time to wait after page load (seconds)')
+    parser.add_argument('--timeout', type=int, default=30,
+                       help='Timeout for page operations (seconds)')
+    
+    args = parser.parse_args()
+    
+    print("🔍 Browser-Based Site Content Analyzer")
+    print(f"📍 Base URL: {args.base_url}")
+    print(f"📋 Docs JSON: {args.docs_json}")
+    print(f"📁 Output directory: {args.output_dir}")
+    print(f"⏱️  Wait time: {args.wait_time}s")
+    print(f"⏰ Timeout: {args.timeout}s")
+    
+    # Initialize analyzer
+    analyzer = BrowserSiteAnalyzer(
+        args.base_url, 
+        args.output_dir, 
+        args.wait_time, 
+        args.timeout
+    )
+    
+    # Get URLs from docs.json
+    urls = analyzer.get_urls_from_docs_json(args.docs_json)
+    
+    if not urls:
+        print("❌ No URLs found in docs.json. Exiting.")
+        return
+    
+    # Visit and analyze all pages
+    results = await analyzer.visit_and_analyze_site(urls)
+    
+    # Print summary report
+    analyzer.print_summary_report()
+    
+    # Save detailed report
+    analyzer.save_detailed_report(args.report_file)
+    
+    print(f"\n🎯 Analysis complete! Check {args.output_dir}/ for downloaded HTML files.")
+
+if __name__ == "__main__":
+    asyncio.run(main())
diff --git a/scripts/eod-report-generator/github.js b/scripts/eod-report-generator/github.js
new file mode 100644
index 0000000000..d0fd91c87b
--- /dev/null
+++ b/scripts/eod-report-generator/github.js
@@ -0,0 +1,134 @@
+import { Octokit } from "@octokit/rest";
+
+const octokit = new Octokit({
+    auth: "" || process.env.GITHUB_TOKEN,
+});
+
+const org = "TykTechnologies";
+
+export async function isUserInOrg(username) {
+    try {
+        await octokit.rest.orgs.checkMembershipForUser({
+            org,
+            username,
+        });
+        //   console.log(`${username} is a member of ${org}`);
+        return true;
+    } catch (error) {
+        if (error.status === 404) {
+            console.log(`${username} is NOT a member of ${org}`);
+            return false;
+        }
+        console.error("Error checking membership:", error);
+        throw error;
+    }
+}
+
+export async function getOpenNonDraftPRs(owner, repo) {
+    try {
+        const openPRs = await octokit.paginate(octokit.rest.pulls.list, {
+            owner,
+            repo,
+            state: "open",
+            per_page: 1, // This does not work.
+        });
+
+        console.log("Total Open PRs", openPRs.length);
+
+        return openPRs.filter((pr) => pr.draft === false || pr.draft === undefined);
+    } catch (error) {
+        console.error("Error fetching open non-draft PRs:", error);
+        throw error;
+    }
+}
+
+export async function getPROwner(owner, repo, pull_number) {
+    try {
+        const { data } = await octokit.rest.pulls.get({
+            owner,
+            repo,
+            pull_number,
+        });
+
+        return data.user.login;
+    } catch (error) {
+        console.error("Error fetching PR owner:", error);
+        throw error;
+    }
+}
+
+export async function getRequestedReviewers(owner, repo, pullNumber) {
+    try {
+        const response = await octokit.rest.pulls.listRequestedReviewers({
+            owner,
+            repo,
+            pull_number: pullNumber,
+        });
+
+        let reviewers = []
+        for (const user of response.data.users) {
+            const isReviewerFromTykOrg = await isUserInOrg(reviewerName)
+            reviewers.push({
+                name: user.login,
+                status: "not_reviewed",
+                isUserFromTykOrg: isReviewerFromTykOrg
+            })
+        }
+
+        return reviewers
+    } catch (error) {
+        console.error("Error fetching requested reviewers:", error);
+    }
+}
+
+export async function getPRReviews(owner, repo, pull_number) {
+    try {
+        const reviews = await octokit.paginate(octokit.rest.pulls.listReviews, {
+            owner,
+            repo,
+            pull_number,
+            per_page: 100,
+        });
+
+        return reviews;
+    } catch (error) {
+        console.error("Error fetching PR reviews:", error);
+        throw error;
+    }
+}
+
+export async function getMergedPRsAfterDate(owner, repo, startDate, endDate) {
+    try {
+        // Convert the provided merge date to a Date object for comparison
+        const sd = new Date(startDate);
+        const ed = new Date(endDate);
+
+        // Fetch all closed PRs (this includes merged PRs)
+        const allClosedPRs = await octokit.request(`GET /repos/${owner}/${repo}/pulls?state=closed&per_page=100`, {
+            owner: owner,
+            repo: repo,
+            headers: {
+                'X-GitHub-Api-Version': '2022-11-28'
+            }
+        })
+
+        console.log("Total Closed PRs:", allClosedPRs.data.length);
+
+        // Filter merged PRs and only return those merged after the provided mergeDate
+        const mergedPRs = allClosedPRs.data.filter((pr) => {
+
+            if (pr.merged_at) {
+                const mergedAtDate = new Date(pr.merged_at);
+                // console.log("MergedAt Log", pr.title, mergedAtDate.toISOString(), ed.toISOString(), sd.toISOString(), mergedAtDate >= sd, mergedAtDate <= ed);
+                return mergedAtDate >= sd && mergedAtDate <= ed;
+            }
+            return false; // Exclude PRs that are closed but not merged
+        });
+
+        console.log(`Total Closed PRs after date ${startDate}`, mergedPRs.length);
+        return mergedPRs;
+    } catch (error) {
+        console.error("Error fetching merged PRs after the specified date:", error);
+        throw error;
+    }
+}
\ No newline at end of file
diff --git a/scripts/eod-report-generator/helper.js b/scripts/eod-report-generator/helper.js
new file mode 100644
index 0000000000..86d65e683e
--- /dev/null
+++ b/scripts/eod-report-generator/helper.js
@@ -0,0 +1,98 @@
+const githubSlackUserNameMapping = {
+    "sharadregoti": "@sharad",
+    "Eopayemi": "@Elizabeth",
+    "sedkis": "@Sedky",
+    "andrei-tyk": "@Andy",
+    "caroltyk": "@carol",
+    "letzya": "@yaara",
+    "sredxny": "@sredny",
+    "excieve": "@artem",
+    "jeffy-mathew": "@Jeff",
+    "DavidRollins": "@David Rollins",
+    "Arturas-Salivonas": "@Arturas",
+    "buger": "@leo",
+    "tbuchaillot": "@tomas",
+    "carlostyk": "@Carlos",
+    "kofoworola": "@Kofo",
+    "jay-deshmukh": "@Jay",
+    "yurisasuke": "@keith",
+    "buraksezer": "@buraksezer",
+    "titpetric": "@Tit Petric",
+    "umit": "@umit",
+    "andyo-tyk": "@Andy",
+    "munkiat": "@MK",
+    "MFCaballero": "@Flor",
+    "edsonmichaque": "@Edson",
+    "JRWu": "@Jia Wu",
+    "JoanCamosTyk": "@Joan",
+    "LLe27": "@Long Le",
+    "olamilekan000": "@Ola",
+    "brianoh1979": "@brian",
+    "scott-tyk-web": "@scott"
+}
+
+const githubStatusToMessageMapping = {
+    "approved": "approved the pr",
+    "changes_requested": "requested changes in the pr",
+    "not_reviewed": "not reviewed the pr",
+}
+
+const getSlackUserName = (pr) => {
+    if (!pr.isUserFromTykOrg) {
+        return "ExternalUser"
+    }
+    return githubSlackUserNameMapping[pr.prOwner] || githubSlackUserNameMapping[pr.name] || 'undefined';
+}
+
+const peerStatusTemplate = (peer) => {
+    const slackUsername = getSlackUserName(peer)
+    const newStatusImprovedMessage = githubStatusToMessageMapping[peer.status] || peer.status
+
+    return `${slackUsername} has ${newStatusImprovedMessage}`
+}
+
+const thankYouTemplate = (pr) => {
+    const slackUsername = getSlackUserName(pr)
+    return `- [${pr.prName}](${pr.prUrl}) - Thanks ${slackUsername}.`;
+}
+
+const inProgressTemplate = (pr) => {
+    // Check if pr.prOwner exists in the mapping and replace it, otherwise use pr.prOwner or 'undefined'
+    const slackUsername = getSlackUserName(pr)
+
+    const peerReviewMessage = pr.peerReviewers.map(peerStatusTemplate).join("\n");
+
+    const newStatusImprovedMessage = githubStatusToMessageMapping[pr.mainBossStatus] || pr.mainBossStatus
+
+    let finalMessage = `- [${pr.prName}](${pr.prUrl}) - ${slackUsername} - I have ${newStatusImprovedMessage}.`
+    if (peerReviewMessage !== "") {
+        finalMessage += ` Regarding peer review, ${peerReviewMessage}`;
+    }
+    return finalMessage
+}
+
+export const categorizeBulletPoints = (prs, isThankYou) => {
+    // Group the PRs by category
+    const grouped = prs.reduce((acc, pr) => {
+        const category = pr.category || 'Uncategorized'; // Default category if not present
+        if (!acc[category]) {
+            acc[category] = [];
+        }
+        acc[category].push(pr);
+        return acc;
+    }, {});
+
+    // Create the bullet points for each category
+    let result = '';
+    for (const [category, prsInCategory] of Object.entries(grouped)) {
+        result += `*${category}*\n`;
+        let bulletPoints = "";
+        if (isThankYou) {
+            bulletPoints = prsInCategory.map(thankYouTemplate).join("\n");
+        } else {
+            bulletPoints = prsInCategory.map(inProgressTemplate).join("\n");
+        }
+        result += bulletPoints + "\n\n"; // Add bullet points and spacing between categories
+    }
+    return result.trim(); // Trim extra newlines at the end
+}
diff --git a/scripts/eod-report-generator/index.js b/scripts/eod-report-generator/index.js
new file mode 100644
index 0000000000..bb0563577b
--- /dev/null
+++ b/scripts/eod-report-generator/index.js
@@ -0,0 +1,140 @@
+import { formatName } from "./sonet.js";
+import { getOpenNonDraftPRs, getMergedPRsAfterDate,getRequestedReviewers, getPROwner, getPRReviews, isUserInOrg } from "./github.js";
+import { categorizeBulletPoints } from "./helper.js";
+
+const mainBoss = "" || process.env.MAIN_REVIEWER;
+
+let eod_report_result = [];
+
+const labelsToConsiderForGrouping = ["Release Notes", "future-release", "New IA Project"]
+
+async function analyzePR(owner, repo, pr, ignoreBuger) {
+    const pull_number = pr.number;
+    const prName = await formatName(pr.title);
+    const prUrl = pr.html_url;
+    const prOwner = await getPROwner(owner, repo, pull_number);
+    const isUserFromTykOrg = await isUserInOrg(prOwner)
+    const reviews = await getPRReviews(owner, repo, pull_number);
+    // const reviewers = await getRequestedReviewers(owner, repo, 5936)
+
+    if (ignoreBuger && (prOwner === "buger")) {
+        return
+    }
+
+    let mainBossStatus = "not_reviewed";
+    const peerReviewers = [];
+
+    // Get reviewers of a PR
+    for (const review of reviews) {
+        const reviewerName = review.user.login;
+        const reviewStatus = review.state.toLowerCase();
+        const isReviewerFromTykOrg = await isUserInOrg(reviewerName)
+
+        if (reviewStatus === "commented" || reviewStatus === "dismissed") {
+            continue
+        }
+
+        if (reviewerName === mainBoss) {
+            mainBossStatus = reviewStatus;
+        } else {
+            // Check if existing reviewr, if yes update the status
+            const existingReviewer = peerReviewers.find(reviewer => reviewer.name === reviewerName);
+
+            if (existingReviewer) {
+                existingReviewer.status = reviewStatus;
+            } else {
+                peerReviewers.push({
+                    name: reviewerName,
+                    status: reviewStatus,
+                    isUserFromTykOrg: isReviewerFromTykOrg
+                });
+            }
+        }
+    }
+
+    // This are reviewers who were requested
+    // for (const review of reviewers) {
+    // }   
+
+    // Check if part of category
+    const category = labelsToConsiderForGrouping.find(field =>
+        pr.labels.some(label => label.name === field)
+    ) || "Docs";
+
+    eod_report_result.push({
+        prName,
+        prUrl,
+        prOwner,
+        peerReviewers,
+        mainBossStatus,
+        // isMerged: false,
+        isUserFromTykOrg,
+        category
+    });
+}
+
+
+// Example usage
+(async () => {
+    const owner = "TykTechnologies";
+    const repo = "tyk-docs";
+
+    const startDate = process.env.START_DATE || new Date().toISOString();
+    const endDate = process.env.END_DATE || new Date().toISOString();
+    console.log("Start Date:", startDate); // Example output: "2025-02-04T15:30:00Z"
+    console.log("End Date:", endDate); // Example output: "2025-02-04T15:30:00Z"
+
+    try {
+        // ###############################
+        // Get Open Prs - In Making
+        // ###############################
+        console.log("============ Stats ============")
+        const openPrs = await getOpenNonDraftPRs(owner, repo);
+        console.log("Open PRs - Excluding Draft:", openPrs.length)
+
+        // Populate "eod_report_result" variable with our JSON structure
+        for (const pr of openPrs) {
+            await analyzePR(owner, repo, pr, false);
+        }
+
+        // console.log(JSON.stringify(eod_report_result, null, 2));
+        const inMaking = categorizeBulletPoints(eod_report_result);
+        // console.log(inMaking);
+
+        // ###############################
+        // Get Merged PRs
+        // ###############################
+
+        const mergedPrs = await getMergedPRsAfterDate(owner, repo, startDate, endDate);
+
+        eod_report_result = []; //Reset array
+        for (const pr of mergedPrs) {
+            await analyzePR(owner, repo, pr, true);
+        }
+
+        // console.log(JSON.stringify(eod_report_result, null, 2));
+        // return
+        let merged = categorizeBulletPoints(eod_report_result, true);
+        if (merged === "") {
+            merged = "No new pages published."
+        }
+        // console.log(merged);
+
+        console.log("============ Final Print ============")
+
+        console.log(`
+Hi all, EOD status report for ${endDate}, is as follows:
+:white_check_mark: New published pages :partywizard::partywizard::partywizard::partywizard:
+================================
+${merged}
+
+In the making
+================================
+${inMaking}
+`)
+
+
+    } catch (error) {
+        console.error("Error generating EOD report:", error);
+    }
+})();
diff --git a/scripts/eod-report-generator/package-lock.json b/scripts/eod-report-generator/package-lock.json
new file mode 100644
index 0000000000..faf9314dfc
--- /dev/null
+++ b/scripts/eod-report-generator/package-lock.json
@@ -0,0 +1,1562 @@
+{
+  "name": "eod-report-generator",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "eod-report-generator",
+      "version": "1.0.0",
+      "license": "ISC",
+      "dependencies": {
+        "@anthropic-ai/sdk": "^0.32.1",
+        "@octokit/rest": "21.0.2",
+        "case": "^1.6.3",
+        "change-case": "^5.4.4",
+        "gray-matter": "^4.0.3",
+        "js-yaml": "^4.1.0",
+        "markdown-link-extractor": "^4.0.2",
+        "marked": "^14.1.2",
+        "openai": "^4.72.0",
+        "sharp": "0.32.6"
+      }
+    },
+    "node_modules/@anthropic-ai/sdk": {
+      "version": "0.32.1",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.32.1.tgz",
+      "integrity": "sha512-U9JwTrDvdQ9iWuABVsMLj8nJVwAyQz6QXvgLsVhryhCEPkLsbcP/MXxm+jYcAwLoV8ESbaTTjnD4kuAFa+Hyjg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "^18.11.18",
+        "@types/node-fetch": "^2.6.4",
+        "abort-controller": "^3.0.0",
+        "agentkeepalive": "^4.2.1",
+        "form-data-encoder": "1.7.2",
+        "formdata-node": "^4.3.2",
+        "node-fetch": "^2.6.7"
+      }
+    },
+    "node_modules/@octokit/auth-token": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-5.1.2.tgz",
+      "integrity": "sha512-JcQDsBdg49Yky2w2ld20IHAlwr8d/d8N6NiOXbtuoPCqzbsiJgF633mVUw3x4mo0H5ypataQIX7SFu3yy44Mpw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/core": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-6.1.3.tgz",
+      "integrity": "sha512-z+j7DixNnfpdToYsOutStDgeRzJSMnbj8T1C/oQjB6Aa+kRfNjs/Fn7W6c8bmlt6mfy3FkgeKBRnDjxQow5dow==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/auth-token": "^5.0.0",
+        "@octokit/graphql": "^8.1.2",
+        "@octokit/request": "^9.1.4",
+        "@octokit/request-error": "^6.1.6",
+        "@octokit/types": "^13.6.2",
+        "before-after-hook": "^3.0.2",
+        "universal-user-agent": "^7.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/endpoint": {
+      "version": "10.1.3",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-10.1.3.tgz",
+      "integrity": "sha512-nBRBMpKPhQUxCsQQeW+rCJ/OPSMcj3g0nfHn01zGYZXuNDvvXudF/TYY6APj5THlurerpFN4a/dQAIAaM6BYhA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.6.2",
+        "universal-user-agent": "^7.0.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/graphql": {
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-8.2.0.tgz",
+      "integrity": "sha512-gejfDywEml/45SqbWTWrhfwvLBrcGYhOn50sPOjIeVvH6i7D16/9xcFA8dAJNp2HMcd+g4vru41g4E2RBiZvfQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/request": "^9.1.4",
+        "@octokit/types": "^13.8.0",
+        "universal-user-agent": "^7.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/openapi-types": {
+      "version": "23.0.1",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-23.0.1.tgz",
+      "integrity": "sha512-izFjMJ1sir0jn0ldEKhZ7xegCTj/ObmEDlEfpFrx4k/JyZSMRHbO3/rBwgE7f3m2DHt+RrNGIVw4wSmwnm3t/g==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-paginate-rest": {
+      "version": "11.4.3",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-11.4.3.tgz",
+      "integrity": "sha512-tBXaAbXkqVJlRoA/zQVe9mUdb8rScmivqtpv3ovsC5xhje/a+NOCivs7eUhWBwCApJVsR4G5HMeaLbq7PxqZGA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.7.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/plugin-request-log": {
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-5.3.1.tgz",
+      "integrity": "sha512-n/lNeCtq+9ofhC15xzmJCNKP2BWTv8Ih2TTy+jatNCCq/gQP/V7rK3fjIfuz0pDWDALO/o/4QY4hyOF6TQQFUw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "13.3.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-13.3.0.tgz",
+      "integrity": "sha512-LUm44shlmkp/6VC+qQgHl3W5vzUP99ZM54zH6BuqkJK4DqfFLhegANd+fM4YRLapTvPm4049iG7F3haANKMYvQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.7.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/request": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-9.2.2.tgz",
+      "integrity": "sha512-dZl0ZHx6gOQGcffgm1/Sf6JfEpmh34v3Af2Uci02vzUYz6qEN6zepoRtmybWXIGXFIK8K9ylE3b+duCWqhArtg==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/endpoint": "^10.1.3",
+        "@octokit/request-error": "^6.1.7",
+        "@octokit/types": "^13.6.2",
+        "fast-content-type-parse": "^2.0.0",
+        "universal-user-agent": "^7.0.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/request-error": {
+      "version": "6.1.7",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.7.tgz",
+      "integrity": "sha512-69NIppAwaauwZv6aOzb+VVLwt+0havz9GT5YplkeJv7fG7a40qpLt/yZKyiDxAhgz0EtgNdNcb96Z0u+Zyuy2g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.6.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/rest": {
+      "version": "21.0.2",
+      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-21.0.2.tgz",
+      "integrity": "sha512-+CiLisCoyWmYicH25y1cDfCrv41kRSvTq6pPWtRroRJzhsCZWZyCqGyI8foJT5LmScADSwRAnr/xo+eewL04wQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/core": "^6.1.2",
+        "@octokit/plugin-paginate-rest": "^11.0.0",
+        "@octokit/plugin-request-log": "^5.3.1",
+        "@octokit/plugin-rest-endpoint-methods": "^13.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/types": {
+      "version": "13.8.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.8.0.tgz",
+      "integrity": "sha512-x7DjTIbEpEWXK99DMd01QfWy0hd5h4EN+Q7shkdKds3otGQP+oWE/y0A76i1OvH9fygo4ddvNf7ZvF0t78P98A==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^23.0.1"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "18.19.75",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.75.tgz",
+      "integrity": "sha512-UIksWtThob6ZVSyxcOqCLOUNg/dyO1Qvx4McgeuhrEtHTLFTf7BBhEazaE4K806FGTPtzd/2sE90qn4fVr7cyw==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~5.26.4"
+      }
+    },
+    "node_modules/@types/node-fetch": {
+      "version": "2.6.12",
+      "resolved": "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.6.12.tgz",
+      "integrity": "sha512-8nneRWKCg3rMtF69nLQJnOYUcbafYeFSjqkw3jCRLsqkWFlHaoQrr5mXmofFGOx3DKn7UfmBMyov8ySvLRVldA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "form-data": "^4.0.0"
+      }
+    },
+    "node_modules/abort-controller": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
+      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
+      "license": "MIT",
+      "dependencies": {
+        "event-target-shim": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=6.5"
+      }
+    },
+    "node_modules/agentkeepalive": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.6.0.tgz",
+      "integrity": "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==",
+      "license": "MIT",
+      "dependencies": {
+        "humanize-ms": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 8.0.0"
+      }
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "license": "Python-2.0"
+    },
+    "node_modules/asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "license": "MIT"
+    },
+    "node_modules/b4a": {
+      "version": "1.6.7",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.6.7.tgz",
+      "integrity": "sha512-OnAYlL5b7LEkALw87fUVafQw5rVR9RjwGd4KUwNQ6DrrNmaVaUCgLipfVlzrPQ4tWOR9P0IXGNOx50jYCCdSJg==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/bare-events": {
+      "version": "2.5.4",
+      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.5.4.tgz",
+      "integrity": "sha512-+gFfDkR8pj4/TrWCGUGWmJIkBwuxPS5F+a5yWjOHQt2hHvNZd5YLzadjmDUtFmMM4y429bnKLa8bYBMHcYdnQA==",
+      "license": "Apache-2.0",
+      "optional": true
+    },
+    "node_modules/bare-fs": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.0.1.tgz",
+      "integrity": "sha512-ilQs4fm/l9eMfWY2dY0WCIUplSUp7U0CT1vrqMg1MUdeZl4fypu5UP0XcDBK5WBQPJAKP1b7XEodISmekH/CEg==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "bare-events": "^2.0.0",
+        "bare-path": "^3.0.0",
+        "bare-stream": "^2.0.0"
+      },
+      "engines": {
+        "bare": ">=1.7.0"
+      }
+    },
+    "node_modules/bare-os": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/bare-os/-/bare-os-3.4.0.tgz",
+      "integrity": "sha512-9Ous7UlnKbe3fMi7Y+qh0DwAup6A1JkYgPnjvMDNOlmnxNRQvQ/7Nst+OnUQKzk0iAT0m9BisbDVp9gCv8+ETA==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "engines": {
+        "bare": ">=1.6.0"
+      }
+    },
+    "node_modules/bare-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/bare-path/-/bare-path-3.0.0.tgz",
+      "integrity": "sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "bare-os": "^3.0.1"
+      }
+    },
+    "node_modules/bare-stream": {
+      "version": "2.6.5",
+      "resolved": "https://registry.npmjs.org/bare-stream/-/bare-stream-2.6.5.tgz",
+      "integrity": "sha512-jSmxKJNJmHySi6hC42zlZnq00rga4jjxcgNZjY9N5WlOe/iOoGRtdwGsHzQv2RlH2KOYMwGUXhf2zXd32BA9RA==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "streamx": "^2.21.0"
+      },
+      "peerDependencies": {
+        "bare-buffer": "*",
+        "bare-events": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-buffer": {
+          "optional": true
+        },
+        "bare-events": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/before-after-hook": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-3.0.2.tgz",
+      "integrity": "sha512-Nik3Sc0ncrMK4UUdXQmAnRtzmNQTAAXmXIopizwZ1W1t8QmfJj+zL4OA2I7XPTPW5z5TDqv4hRo/JzouDJnX3A==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
+    "node_modules/boolbase": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
+      "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==",
+      "license": "ISC"
+    },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
+    "node_modules/case": {
+      "version": "1.6.3",
+      "resolved": "https://registry.npmjs.org/case/-/case-1.6.3.tgz",
+      "integrity": "sha512-mzDSXIPaFwVDvZAHqZ9VlbyF4yyXRuX6IvB06WvPYkqJVO24kX1PPhv9bfpKNFZyxYFmmgo03HUiD8iklmJYRQ==",
+      "license": "(MIT OR GPL-3.0-or-later)",
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/change-case": {
+      "version": "5.4.4",
+      "resolved": "https://registry.npmjs.org/change-case/-/change-case-5.4.4.tgz",
+      "integrity": "sha512-HRQyTk2/YPEkt9TnUPbOpr64Uw3KOicFWPVBb+xiHvd6eBx/qPr9xqfBFDT8P2vWsvvz4jbEkfDe71W3VyNu2w==",
+      "license": "MIT"
+    },
+    "node_modules/cheerio": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/cheerio/-/cheerio-1.0.0.tgz",
+      "integrity": "sha512-quS9HgjQpdaXOvsZz82Oz7uxtXiy6UIsIQcpBj7HRw2M63Skasm9qlDocAM7jNuaxdhpPU7c4kJN+gA5MCu4ww==",
+      "license": "MIT",
+      "dependencies": {
+        "cheerio-select": "^2.1.0",
+        "dom-serializer": "^2.0.0",
+        "domhandler": "^5.0.3",
+        "domutils": "^3.1.0",
+        "encoding-sniffer": "^0.2.0",
+        "htmlparser2": "^9.1.0",
+        "parse5": "^7.1.2",
+        "parse5-htmlparser2-tree-adapter": "^7.0.0",
+        "parse5-parser-stream": "^7.1.2",
+        "undici": "^6.19.5",
+        "whatwg-mimetype": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=18.17"
+      },
+      "funding": {
+        "url": "https://github.com/cheeriojs/cheerio?sponsor=1"
+      }
+    },
+    "node_modules/cheerio-select": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/cheerio-select/-/cheerio-select-2.1.0.tgz",
+      "integrity": "sha512-9v9kG0LvzrlcungtnJtpGNxY+fzECQKhK4EGJX2vByejiMX84MFNQw4UxPJl3bFbTMw+Dfs37XaIkCwTZfLh4g==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "boolbase": "^1.0.0",
+        "css-select": "^5.1.0",
+        "css-what": "^6.1.0",
+        "domelementtype": "^2.3.0",
+        "domhandler": "^5.0.3",
+        "domutils": "^3.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/fb55"
+      }
+    },
+    "node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC"
+    },
+    "node_modules/color": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/color/-/color-4.2.3.tgz",
+      "integrity": "sha512-1rXeuUUiGGrykh+CeBdu5Ie7OJwinCgQY0bc7GCRxy5xVHy+moaqkpL/jqQq0MtQOeYcrqEz4abc5f0KtU7W4A==",
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1",
+        "color-string": "^1.9.0"
+      },
+      "engines": {
+        "node": ">=12.5.0"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "license": "MIT"
+    },
+    "node_modules/color-string": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/color-string/-/color-string-1.9.1.tgz",
+      "integrity": "sha512-shrVawQFojnZv6xM40anx4CkoDP+fZsw/ZerEMsW/pyzsRbElpsL/DBVW7q3ExxwusdNXI3lXpuhEZkzs8p5Eg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "^1.0.0",
+        "simple-swizzle": "^0.2.2"
+      }
+    },
+    "node_modules/combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "license": "MIT",
+      "dependencies": {
+        "delayed-stream": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/css-select": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/css-select/-/css-select-5.1.0.tgz",
+      "integrity": "sha512-nwoRF1rvRRnnCqqY7updORDsuqKzqYJ28+oSMaJMMgOauh3fvwHqMS7EZpIPqK8GL+g9mKxF1vP/ZjSeNjEVHg==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "boolbase": "^1.0.0",
+        "css-what": "^6.1.0",
+        "domhandler": "^5.0.2",
+        "domutils": "^3.0.1",
+        "nth-check": "^2.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/fb55"
+      }
+    },
+    "node_modules/css-what": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.1.0.tgz",
+      "integrity": "sha512-HTUrgRJ7r4dsZKU6GjmpfRK1O76h97Z8MfS1G0FozR+oF2kG6Vfe8JE6zwrkbxigziPHinCJ+gCPjA9EaBDtRw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">= 6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/fb55"
+      }
+    },
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.3.tgz",
+      "integrity": "sha512-bwy0MGW55bG41VqxxypOsdSdGqLwXPI/focwgTYCFMbdUiBAxLg9CFzG08sz2aqzknwiX7Hkl0bQENjg8iLByw==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/dom-serializer": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-2.0.0.tgz",
+      "integrity": "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==",
+      "license": "MIT",
+      "dependencies": {
+        "domelementtype": "^2.3.0",
+        "domhandler": "^5.0.2",
+        "entities": "^4.2.0"
+      },
+      "funding": {
+        "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
+      }
+    },
+    "node_modules/domelementtype": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
+      "integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fb55"
+        }
+      ],
+      "license": "BSD-2-Clause"
+    },
+    "node_modules/domhandler": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-5.0.3.tgz",
+      "integrity": "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "domelementtype": "^2.3.0"
+      },
+      "engines": {
+        "node": ">= 4"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/domhandler?sponsor=1"
+      }
+    },
+    "node_modules/domutils": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz",
+      "integrity": "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "dom-serializer": "^2.0.0",
+        "domelementtype": "^2.3.0",
+        "domhandler": "^5.0.3"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/domutils?sponsor=1"
+      }
+    },
+    "node_modules/encoding-sniffer": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/encoding-sniffer/-/encoding-sniffer-0.2.0.tgz",
+      "integrity": "sha512-ju7Wq1kg04I3HtiYIOrUrdfdDvkyO9s5XM8QAj/bN61Yo/Vb4vgJxy5vi4Yxk01gWHbrofpPtpxM8bKger9jhg==",
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "^0.6.3",
+        "whatwg-encoding": "^3.1.1"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/encoding-sniffer?sponsor=1"
+      }
+    },
+    "node_modules/end-of-stream": {
+      "version": "1.4.4",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
+      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
+      "license": "MIT",
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/esprima": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "license": "BSD-2-Clause",
+      "bin": {
+        "esparse": "bin/esparse.js",
+        "esvalidate": "bin/esvalidate.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/event-target-shim": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
+      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "license": "(MIT OR WTFPL)",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/extend-shallow": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
+      "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==",
+      "license": "MIT",
+      "dependencies": {
+        "is-extendable": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/fast-content-type-parse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-2.0.1.tgz",
+      "integrity": "sha512-nGqtvLrj5w0naR6tDPfB4cUmYCqouzyQiz6C5y/LtcDllJdrcc6WaWW6iXyIIOErTa/XRybj28aasdn4LkVk6Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
+      "license": "MIT"
+    },
+    "node_modules/form-data": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.1.tgz",
+      "integrity": "sha512-tzN8e4TX8+kkxGPK8D5u0FNmjPUjw3lwC9lSLxxoB/+GtsJG91CO8bSWy73APlgAZzZbXEYZJuxjkHH2w+Ezhw==",
+      "license": "MIT",
+      "dependencies": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "mime-types": "^2.1.12"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/form-data-encoder": {
+      "version": "1.7.2",
+      "resolved": "https://registry.npmjs.org/form-data-encoder/-/form-data-encoder-1.7.2.tgz",
+      "integrity": "sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==",
+      "license": "MIT"
+    },
+    "node_modules/formdata-node": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/formdata-node/-/formdata-node-4.4.1.tgz",
+      "integrity": "sha512-0iirZp3uVDjVGt9p49aTaqjk84TrglENEDuqfdlZQ1roC9CWlPk6Avf8EEnZNcAqPonwkG35x4n3ww/1THYAeQ==",
+      "license": "MIT",
+      "dependencies": {
+        "node-domexception": "1.0.0",
+        "web-streams-polyfill": "4.0.0-beta.3"
+      },
+      "engines": {
+        "node": ">= 12.20"
+      }
+    },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "license": "MIT"
+    },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+      "license": "MIT"
+    },
+    "node_modules/gray-matter": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/gray-matter/-/gray-matter-4.0.3.tgz",
+      "integrity": "sha512-5v6yZd4JK3eMI3FqqCouswVqwugaA9r4dNZB1wwcmrD02QkV5H0y7XBQW8QwQqEaZY1pM9aqORSORhJRdNK44Q==",
+      "license": "MIT",
+      "dependencies": {
+        "js-yaml": "^3.13.1",
+        "kind-of": "^6.0.2",
+        "section-matter": "^1.0.0",
+        "strip-bom-string": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=6.0"
+      }
+    },
+    "node_modules/gray-matter/node_modules/argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "license": "MIT",
+      "dependencies": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "node_modules/gray-matter/node_modules/js-yaml": {
+      "version": "3.14.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
+      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/html-link-extractor": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/html-link-extractor/-/html-link-extractor-1.0.5.tgz",
+      "integrity": "sha512-ADd49pudM157uWHwHQPUSX4ssMsvR/yHIswOR5CUfBdK9g9ZYGMhVSE6KZVHJ6kCkR0gH4htsfzU6zECDNVwyw==",
+      "license": "MIT",
+      "dependencies": {
+        "cheerio": "^1.0.0-rc.10"
+      }
+    },
+    "node_modules/htmlparser2": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-9.1.0.tgz",
+      "integrity": "sha512-5zfg6mHUoaer/97TxnGpxmbR7zJtPwIYFMZ/H5ucTlPZhKvtum05yiPK3Mgai3a0DyVxv7qYqoweaEd2nrYQzQ==",
+      "funding": [
+        "https://github.com/fb55/htmlparser2?sponsor=1",
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fb55"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "domelementtype": "^2.3.0",
+        "domhandler": "^5.0.3",
+        "domutils": "^3.1.0",
+        "entities": "^4.5.0"
+      }
+    },
+    "node_modules/humanize-ms": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz",
+      "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.0.0"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "license": "ISC"
+    },
+    "node_modules/is-arrayish": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.3.2.tgz",
+      "integrity": "sha512-eVRqCvVlZbuw3GrM63ovNSNAeA1K16kaR/LRY/92w0zxQ5/1YzwblUX652i4Xs9RwAGjW9d9y6X88t8OaAJfWQ==",
+      "license": "MIT"
+    },
+    "node_modules/is-extendable": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz",
+      "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/kind-of": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
+      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/markdown-link-extractor": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/markdown-link-extractor/-/markdown-link-extractor-4.0.2.tgz",
+      "integrity": "sha512-5cUOu4Vwx1wenJgxaudsJ8xwLUMN7747yDJX3V/L7+gi3e4MsCm7w5nbrDQQy8nEfnl4r5NV3pDXMAjhGXYXAw==",
+      "license": "ISC",
+      "dependencies": {
+        "html-link-extractor": "^1.0.5",
+        "marked": "^12.0.1"
+      }
+    },
+    "node_modules/markdown-link-extractor/node_modules/marked": {
+      "version": "12.0.2",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-12.0.2.tgz",
+      "integrity": "sha512-qXUm7e/YKFoqFPYPa3Ukg9xlI5cyAtGmyEIzMfW//m6kXwCy2Ps9DYf5ioijFKQ8qyuscrHoY04iJGctu2Kg0Q==",
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/marked": {
+      "version": "14.1.4",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-14.1.4.tgz",
+      "integrity": "sha512-vkVZ8ONmUdPnjCKc5uTRvmkRbx4EAi2OkTOXmfTDhZz3OFqMNBM1oTTWwTr4HY4uAEojhzPf+Fy8F1DWa3Sndg==",
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "license": "MIT"
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/napi-build-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
+      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
+      "license": "MIT"
+    },
+    "node_modules/node-abi": {
+      "version": "3.74.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.74.0.tgz",
+      "integrity": "sha512-c5XK0MjkGBrQPGYG24GBADZud0NCbznxNx0ZkS+ebUTrmV1qTDxPxSL8zEAPURXSbLRWVexxmP4986BziahL5w==",
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/node-addon-api": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-6.1.0.tgz",
+      "integrity": "sha512-+eawOlIgy680F0kBzPUNFhMZGtJ1YmqM6l4+Crf4IkImjYrO/mqPwRMh352g23uIaQKFItcQ64I7KMaJxHgAVA==",
+      "license": "MIT"
+    },
+    "node_modules/node-domexception": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
+      "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/jimmywarting"
+        },
+        {
+          "type": "github",
+          "url": "https://paypal.me/jimmywarting"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.5.0"
+      }
+    },
+    "node_modules/node-fetch": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
+      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
+      "engines": {
+        "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/nth-check": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/nth-check/-/nth-check-2.1.1.tgz",
+      "integrity": "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "boolbase": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/nth-check?sponsor=1"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/openai": {
+      "version": "4.82.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-4.82.0.tgz",
+      "integrity": "sha512-1bTxOVGZuVGsKKUWbh3BEwX1QxIXUftJv+9COhhGGVDTFwiaOd4gWsMynF2ewj1mg6by3/O+U8+EEHpWRdPaJg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/node": "^18.11.18",
+        "@types/node-fetch": "^2.6.4",
+        "abort-controller": "^3.0.0",
+        "agentkeepalive": "^4.2.1",
+        "form-data-encoder": "1.7.2",
+        "formdata-node": "^4.3.2",
+        "node-fetch": "^2.6.7"
+      },
+      "bin": {
+        "openai": "bin/cli"
+      },
+      "peerDependencies": {
+        "ws": "^8.18.0",
+        "zod": "^3.23.8"
+      },
+      "peerDependenciesMeta": {
+        "ws": {
+          "optional": true
+        },
+        "zod": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/parse5": {
+      "version": "7.2.1",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.2.1.tgz",
+      "integrity": "sha512-BuBYQYlv1ckiPdQi/ohiivi9Sagc9JG+Ozs0r7b/0iK3sKmrb0b9FdWdBbOdx6hBCM/F9Ir82ofnBhtZOjCRPQ==",
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^4.5.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
+    "node_modules/parse5-htmlparser2-tree-adapter": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-7.1.0.tgz",
+      "integrity": "sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g==",
+      "license": "MIT",
+      "dependencies": {
+        "domhandler": "^5.0.3",
+        "parse5": "^7.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
+    "node_modules/parse5-parser-stream": {
+      "version": "7.1.2",
+      "resolved": "https://registry.npmjs.org/parse5-parser-stream/-/parse5-parser-stream-7.1.2.tgz",
+      "integrity": "sha512-JyeQc9iwFLn5TbvvqACIF/VXG6abODeB3Fwmv/TGdLk2LfbWkaySGY72at4+Ty7EkPZj854u4CrICqNk2qIbow==",
+      "license": "MIT",
+      "dependencies": {
+        "parse5": "^7.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
+    "node_modules/prebuild-install": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
+      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^2.0.0",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/prebuild-install/node_modules/tar-fs": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
+      "integrity": "sha512-090nwYJDmlhwFwEW3QQl+vaNnxsO2yVsd45eTKRBzSzu+hlb1w2K9inVq5b0ngXuLVqQ4ApvsUHHnu/zQNkWAg==",
+      "license": "MIT",
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/prebuild-install/node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/pump": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.2.tgz",
+      "integrity": "sha512-tUPXtzlGM8FE3P0ZL6DVs/3P58k9nk8/jZeQCurTJylQA8qFYzHFfhBJkuqyE0FifOsQ0uKWekiZ5g8wtr28cw==",
+      "license": "MIT",
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/section-matter": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/section-matter/-/section-matter-1.0.0.tgz",
+      "integrity": "sha512-vfD3pmTzGpufjScBh50YHKzEu2lxBWhVEHsNGoEXmCmn2hKGfeNLYMzCJpe8cD7gqX7TJluOVpBkAequ6dgMmA==",
+      "license": "MIT",
+      "dependencies": {
+        "extend-shallow": "^2.0.1",
+        "kind-of": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/semver": {
+      "version": "7.7.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
+      "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/sharp": {
+      "version": "0.32.6",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.32.6.tgz",
+      "integrity": "sha512-KyLTWwgcR9Oe4d9HwCwNM2l7+J0dUQwn/yf7S0EnTtb0eVS4RxO0eUSvxPtzT4F3SY+C4K6fqdv/DO27sJ/v/w==",
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "color": "^4.2.3",
+        "detect-libc": "^2.0.2",
+        "node-addon-api": "^6.1.0",
+        "prebuild-install": "^7.1.1",
+        "semver": "^7.5.4",
+        "simple-get": "^4.0.1",
+        "tar-fs": "^3.0.4",
+        "tunnel-agent": "^0.6.0"
+      },
+      "engines": {
+        "node": ">=14.15.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
+    "node_modules/simple-swizzle": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/simple-swizzle/-/simple-swizzle-0.2.2.tgz",
+      "integrity": "sha512-JA//kQgZtbuY83m+xT+tXJkmJncGMTFT+C+g2h2R9uxkYIrE2yy9sgmcLhCnw57/WSD+Eh3J97FPEDFnbXnDUg==",
+      "license": "MIT",
+      "dependencies": {
+        "is-arrayish": "^0.3.1"
+      }
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/streamx": {
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.22.0.tgz",
+      "integrity": "sha512-sLh1evHOzBy/iWRiR6d1zRcLao4gGZr3C1kzNz4fopCOKJb6xD9ub8Mpi9Mr1R6id5o43S+d93fI48UC5uM9aw==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      },
+      "optionalDependencies": {
+        "bare-events": "^2.2.0"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/strip-bom-string": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/strip-bom-string/-/strip-bom-string-1.0.0.tgz",
+      "integrity": "sha512-uCC2VHvQRYu+lMh4My/sFNmF2klFymLX1wHJeXnbEJERpV/ZsVuonzerjfrGpIGF7LBVa1O7i9kjiWvJiFck8g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/tar-fs": {
+      "version": "3.0.9",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-3.0.9.tgz",
+      "integrity": "sha512-XF4w9Xp+ZQgifKakjZYmFdkLoSWd34VGKcsTCwlNWM7QG3ZbaxnTsaBwnjFZqHRf/rROxaR8rXnbtwdvaDI+lA==",
+      "license": "MIT",
+      "dependencies": {
+        "pump": "^3.0.0",
+        "tar-stream": "^3.1.5"
+      },
+      "optionalDependencies": {
+        "bare-fs": "^4.0.1",
+        "bare-path": "^3.0.0"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz",
+      "integrity": "sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==",
+      "license": "MIT",
+      "dependencies": {
+        "b4a": "^1.6.4",
+        "fast-fifo": "^1.2.0",
+        "streamx": "^2.15.0"
+      }
+    },
+    "node_modules/text-decoder": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.3.tgz",
+      "integrity": "sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "b4a": "^1.6.4"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
+      "license": "MIT"
+    },
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/undici": {
+      "version": "6.21.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.21.3.tgz",
+      "integrity": "sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "5.26.5",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
+      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
+      "license": "MIT"
+    },
+    "node_modules/universal-user-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.2.tgz",
+      "integrity": "sha512-0JCqzSKnStlRRQfCdowvqy3cy0Dvtlb8xecj/H8JFZuCze4rwjPZQOgvFvn0Ws/usCHQFGpyr+pB9adaGwXn4Q==",
+      "license": "ISC"
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/web-streams-polyfill": {
+      "version": "4.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-4.0.0-beta.3.tgz",
+      "integrity": "sha512-QW95TCTaHmsYfHDybGMwO5IJIM93I/6vTRk+daHTWFPhwh+C8Cg7j7XyKrwrj8Ib6vYXe0ocYNrmzY4xAAN6ug==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
+      "license": "BSD-2-Clause"
+    },
+    "node_modules/whatwg-encoding": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
+      "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "0.6.3"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
+      "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "license": "MIT",
+      "dependencies": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    }
+  }
+}
diff --git a/scripts/eod-report-generator/package.json b/scripts/eod-report-generator/package.json
new file mode 100644
index 0000000000..bda35321b7
--- /dev/null
+++ b/scripts/eod-report-generator/package.json
@@ -0,0 +1,25 @@
+{
+  "name": "eod-report-generator",
+  "version": "1.0.0",
+  "main": "index.js",
+  "type": "module",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "description": "",
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.32.1",
+    "@octokit/rest": "21.0.2",
+    "case": "^1.6.3",
+    "change-case": "^5.4.4",
+    "gray-matter": "^4.0.3",
+    "js-yaml": "^4.1.0",
+    "markdown-link-extractor": "^4.0.2",
+    "marked": "^14.1.2",
+    "openai": "^4.72.0",
+    "sharp": "0.32.6"
+  }
+}
diff --git a/scripts/eod-report-generator/readme.md b/scripts/eod-report-generator/readme.md
new file mode 100644
index 0000000000..6e4569f1c3
--- /dev/null
+++ b/scripts/eod-report-generator/readme.md
@@ -0,0 +1 @@
+This script generates a PR review report.
\ No newline at end of file
diff --git a/scripts/eod-report-generator/sonet.js b/scripts/eod-report-generator/sonet.js
new file mode 100644
index 0000000000..e5e4c69509
--- /dev/null
+++ b/scripts/eod-report-generator/sonet.js
@@ -0,0 +1,39 @@
+import Anthropic from '@anthropic-ai/sdk';
+
+const anthropic = new Anthropic({
+    apiKey: '' || process.env.ANTHROPIC_KEY, 
+});
+
+export async function extractHeadings(combinedString) {
+    const msg = await anthropic.messages.create({
+        model: "claude-sonnet-4-5-20250929",
+        max_tokens: 1024,
+        messages: [{ role: "user", content: `
+Below are some markdown headings. Extract the headings which is using acronyms or shortcodes like K8s for kubernetes in it. 
+
+Exclude the following acronysms ["API"]
+
+The output should be an array of strings. No explanation required.
+
+${combinedString}` }],
+    });
+
+    return msg.content[0].text;
+}
+
+export async function formatName(prName) {
+    const msg = await anthropic.messages.create({
+        model: "claude-sonnet-4-5-20250929",
+        max_tokens: 1024,
+        messages: [{ role: "user", content: `
+    Hello, Claude. 
+    
+    Remove the Jira ticket reference from the below string. Don't include any explanation text. The output will be read by a machine.
+    
+    ${prName}
+    ` }],
+    });
+
+    return msg.content[0].text;
+}
+
diff --git a/merge_docs_configs.py b/scripts/merge_docs_configs.py
similarity index 73%
rename from merge_docs_configs.py
rename to scripts/merge_docs_configs.py
index 13ca290a47..bf09194d35 100644
--- a/merge_docs_configs.py
+++ b/scripts/merge_docs_configs.py
@@ -12,8 +12,8 @@ def __init__(self, output_file: str = "docs.json", subfolder: str = "", addition
         self.output_file = output_file
         self.subfolder = subfolder.strip("/") if subfolder else ""  # Remove leading/trailing slashes
 
-        # Default assets that should always go to root
-        default_assets = {"style.css", "images", "img", "logo", "favicon.ico", "favicon.png", "snippets"}
+        # Default assets that should always go to root (snippets handled separately)
+        default_assets = {"style.css", "images", "img", "logo", "favicon.ico", "favicon.png"}
 
         # Add any additional assets specified by user
         if additional_assets:
@@ -23,8 +23,10 @@ def __init__(self, output_file: str = "docs.json", subfolder: str = "", addition
 
         # Define fallback version priority - will be overridden by branches config
         self.version_priority = []  # Start empty, populate from branches-config.json
-        self.version_labels = {}  # Maps folder -> label
+        self.version_labels = {}  # Maps target_folder -> label
         self.external_versions = {}  # Store external version info
+        self.source_folders = {}  # Maps target_folder -> source_folder
+        self.target_folders = {}  # Maps source_folder -> target_folder
         self.latest_version = None
         self.main_version = None  # Track main branch with most current assets
 
@@ -52,6 +54,8 @@ def load_branches_config(self, branches_config_path: str) -> Dict:
                 self.version_priority = []
                 self.version_labels = {}
                 self.external_versions = {}  # Store external version info
+                self.source_folders = {}  # Maps target_folder -> source_folder
+                self.target_folders = {}  # Maps source_folder -> target_folder
 
                 for version_info in versions:
                     is_external = version_info.get('isExternal', False)
@@ -68,20 +72,41 @@ def load_branches_config(self, branches_config_path: str) -> Dict:
                             }
                             print(f"🔗 External version: {label} → {external_url}")
                     else:
-                        # Handle local versions
-                        folder = version_info.get('folder', '')
-                        label = version_info.get('label', folder)
+                        # Handle local versions with support for separate source/target folders
+                        source_folder = version_info.get('sourceFolder', version_info.get('folder', ''))
+                        target_folder = version_info.get('targetFolder', version_info.get('folder', ''))
+
+                        # Fallback to 'folder' if neither sourceFolder nor targetFolder specified
+                        if not source_folder and not target_folder:
+                            folder = version_info.get('folder', '')
+                            source_folder = target_folder = folder
+                        elif not source_folder:
+                            source_folder = target_folder
+                        elif not target_folder:
+                            target_folder = source_folder
+
+                        label = version_info.get('label', target_folder)
                         is_latest = version_info.get('isLatest', False)
                         is_main = version_info.get('isMain', False)
 
-                        if folder:
-                            self.version_priority.append(folder)
-                            self.version_labels[folder] = label
+                        if source_folder and target_folder:
+                            # Use target_folder for priority and labels (what appears in navigation)
+                            self.version_priority.append(target_folder)
+                            self.version_labels[target_folder] = label
+
+                            # Store folder mappings
+                            self.source_folders[target_folder] = source_folder
+                            self.target_folders[source_folder] = target_folder
 
                             if is_latest:
-                                self.latest_version = folder
+                                self.latest_version = target_folder
                             if is_main:
-                                self.main_version = folder
+                                self.main_version = target_folder
+
+                            if source_folder != target_folder:
+                                print(f"📁 Version {target_folder}: source='{source_folder}' → target='{target_folder}'")
+                            else:
+                                print(f"📁 Version {target_folder}: unified folder='{source_folder}'")
 
                 print(f"📋 Local version priority: {self.version_priority}")
                 print(f"🏷️  Local version labels: {self.version_labels}")
@@ -131,22 +156,21 @@ def collect_from_branches_config(self, branches_config_path: str, base_dir: str
 
         base_path = Path(base_dir)
 
-        # Process each version from the config
-        for version_info in branches_config.get('versions', []):
-            folder = version_info.get('folder', '')
-            if not folder:
-                continue
+        # Process each target version (what appears in navigation)
+        for target_version in self.version_priority:
+            # Get the source folder for this target version
+            source_folder = self.source_folders.get(target_version, target_version)
 
-            version_dir = base_path / folder
+            version_dir = base_path / source_folder
             config_file = version_dir / "docs.json"
 
             if config_file.exists():
-                config = self.load_version_config(str(config_file), folder)
+                config = self.load_version_config(str(config_file), target_version)
                 if config:
-                    configs[folder] = config
+                    configs[target_version] = config
             else:
-                label = self.version_labels.get(folder, folder)
-                print(f"⚠️ Config file not found: {config_file} for {label}")
+                label = self.version_labels.get(target_version, target_version)
+                print(f"⚠️ Config file not found: {config_file} for {label} (source: {source_folder})")
 
         return configs
 
@@ -238,7 +262,9 @@ def merge_assets_from_all_versions(self, version_configs: Dict[str, Dict],
             all_files = {}  # filename -> [(version, filepath, size)]
 
             for version in priority_versions:
-                version_dir = source_path / version
+                # Get the source folder for this target version
+                source_folder = self.source_folders.get(version, version)
+                version_dir = source_path / source_folder
 
                 # Check if asset_type is a directory or individual file
                 asset_path = version_dir / asset_type
@@ -276,7 +302,7 @@ def merge_assets_from_all_versions(self, version_configs: Dict[str, Dict],
                 continue
 
             # Handle individual files (like favicon.png, style.css)
-            is_individual_file = any((source_path / v / asset_type).is_file() for v in priority_versions)
+            is_individual_file = any((source_path / self.source_folders.get(v, v) / asset_type).is_file() for v in priority_versions)
 
             if is_individual_file:
                 # Handle individual files - copy directly to target root
@@ -351,6 +377,116 @@ def merge_assets_from_all_versions(self, version_configs: Dict[str, Dict],
             if files:
                 print(f"   📂 {asset_type}: {len(files)} files")
 
+    def copy_snippets_with_version_structure(self, version_configs: Dict[str, Dict],
+                                             source_dir: str = ".", target_dir: str = ".") -> None:
+        """Copy snippets to version-specific directories with link rewriting."""
+
+        # Build priority order: main -> latest -> others
+        priority_versions = []
+
+        if self.main_version and self.main_version in version_configs:
+            priority_versions.append(self.main_version)
+
+        if self.latest_version and self.latest_version in version_configs and self.latest_version != self.main_version:
+            priority_versions.append(self.latest_version)
+
+        # Add remaining versions in config order
+        for version in self.version_priority:
+            if version in version_configs and version not in priority_versions:
+                priority_versions.append(version)
+
+        if not priority_versions:
+            print("❌ No versions found for snippet processing")
+            return
+
+        print(f"📝 Processing snippets from {len(priority_versions)} versions...")
+        print(f"🎯 Priority order: {' > '.join(priority_versions)}")
+
+        source_path = Path(source_dir)
+        target_root_path = Path(target_dir)
+        snippets_root = target_root_path / "snippets"
+
+        # Track processed snippets for reporting
+        processed_snippets = {}  # version -> {filename: status}
+        total_processed = 0
+
+        # Process each version
+        for version in priority_versions:
+            # Get the source folder for this target version
+            source_folder = self.source_folders.get(version, version)
+            version_source = source_path / source_folder / "snippets"
+
+            if not version_source.exists():
+                print(f"  ⚠️ No snippets directory found in {source_folder} (target: {version})")
+                continue
+
+            is_latest = (version == self.latest_version)
+            version_label = self.version_labels.get(version, version)
+
+            # Create version-specific snippets directory
+            version_snippets_dir = snippets_root / version
+            version_snippets_dir.mkdir(parents=True, exist_ok=True)
+
+            print(f"\n  📂 Processing snippets for {version} ({version_label})...")
+
+            processed_snippets[version] = {}
+            version_count = 0
+
+            # Process all files in the snippets directory
+            for item in version_source.rglob("*"):
+                if item.is_file():
+                    # Get relative path from snippets root
+                    rel_path = item.relative_to(version_source)
+                    target_file = version_snippets_dir / rel_path
+
+                    # Create parent directories if needed
+                    target_file.parent.mkdir(parents=True, exist_ok=True)
+
+                    try:
+                        # Check if this is a content file that needs link rewriting
+                        if item.suffix.lower() in ['.mdx', '.md']:
+                            # Read, rewrite, and write content
+                            with open(item, 'r', encoding='utf-8') as f:
+                                content = f.read()
+
+                            # Rewrite internal links for this version
+                            modified_content = self.rewrite_internal_links(content, version, is_latest)
+
+                            # Write modified content
+                            with open(target_file, 'w', encoding='utf-8') as f:
+                                f.write(modified_content)
+
+                            processed_snippets[version][str(rel_path)] = "rewritten"
+                            print(f"    📝 Processed with link rewriting: {rel_path}")
+                        else:
+                            # For non-content files, just copy
+                            shutil.copy2(item, target_file)
+                            processed_snippets[version][str(rel_path)] = "copied"
+                            print(f"    📄 Copied: {rel_path}")
+
+                        version_count += 1
+                        total_processed += 1
+
+                    except Exception as e:
+                        print(f"    ❌ Error processing {rel_path}: {e}")
+                        processed_snippets[version][str(rel_path)] = f"error: {e}"
+
+            if version_count > 0:
+                print(f"    ✅ Processed {version_count} snippet files for {version}")
+            else:
+                print(f"    ⚠️ No snippet files found in {version}")
+
+        # Generate summary
+        print(f"\n✅ Snippet processing complete:")
+        print(f"   📁 Total files processed: {total_processed}")
+        print(f"   📂 Versions processed: {len([v for v in processed_snippets.keys() if processed_snippets[v]])}")
+
+        for version, files in processed_snippets.items():
+            if files:
+                rewritten_count = len([f for f in files.values() if f == "rewritten"])
+                copied_count = len([f for f in files.values() if f == "copied"])
+                print(f"   📂 {version}: {len(files)} files ({rewritten_count} rewritten, {copied_count} copied)")
+
     def organize_content_files(self, version_configs: Dict[str, Dict],
                                source_dir: str = ".", target_dir: str = ".") -> None:
         """Copy latest version docs to subfolder and merge assets from all versions."""
@@ -369,16 +505,23 @@ def organize_content_files(self, version_configs: Dict[str, Dict],
 
         source_path = Path(source_dir)
         target_root_path = Path(target_dir)
-        latest_source = source_path / latest_version
+        
+        # Get the source folder for the latest version
+        latest_source_folder = self.source_folders.get(latest_version, latest_version)
+        latest_source = source_path / latest_source_folder
 
         if not latest_source.exists():
-            print(f"❌ Latest version directory {latest_source} not found")
+            print(f"❌ Latest version directory {latest_source} not found (target: {latest_version}, source: {latest_source_folder})")
             return
 
         # Step 1: Merge assets from all versions
         print("🎨 Step 1: Merging assets from all versions...")
         self.merge_assets_from_all_versions(version_configs, source_dir, target_dir)
 
+        # Step 1.5: Process snippets with version structure
+        print(f"\n📝 Step 1.5: Processing snippets with version structure...")
+        self.copy_snippets_with_version_structure(version_configs, source_dir, target_dir)
+
         # Step 2: Copy documentation content from all versions
         print(f"\n📚 Step 2: Copying documentation content from all versions...")
 
@@ -389,9 +532,12 @@ def organize_content_files(self, version_configs: Dict[str, Dict],
             if version not in version_configs:
                 continue
 
-            version_source = source_path / version
+            # Get the source folder for this target version
+            source_folder = self.source_folders.get(version, version)
+            version_source = source_path / source_folder
+
             if not version_source.exists():
-                print(f"⚠️ Version directory {version_source} not found")
+                print(f"⚠️ Version directory {version_source} not found (target: {version}, source: {source_folder})")
                 continue
 
             is_latest = (version == latest_version)
@@ -402,10 +548,10 @@ def organize_content_files(self, version_configs: Dict[str, Dict],
             else:
                 print(f"\n  📂 Processing older version ({version} - {version_label})...")
 
-            # Define system files to exclude
-            exclude_items = {"docs.json", ".git", ".gitignore", ".DS_Store", "__pycache__"}
+            # Define system files to exclude (including snippets since they're processed separately)
+            exclude_items = {"docs.json", ".git", ".gitignore", ".DS_Store", "__pycache__", "snippets"}
 
-            # Get list of items to copy (exclude assets since they're already merged)
+            # Get list of items to copy (exclude assets and snippets since they're already processed)
             items_to_process = []
             for item in version_source.iterdir():
                 if item.name not in exclude_items and item.name not in self.assets:
@@ -448,8 +594,10 @@ def organize_content_files(self, version_configs: Dict[str, Dict],
                         if target_item.exists():
                             print(f"    🗑️  Removing existing: {item.name}/")
                             shutil.rmtree(target_item)
-                        shutil.copytree(item, target_item)
-                        print(f"    📂 Copied directory: {item.name}/ → {location_desc}")
+
+                        # Copy directory with recursive link rewriting
+                        self.copy_directory_with_link_rewriting(item, target_item, version, is_latest)
+                        print(f"    📂 Copied directory with link rewriting: {item.name}/ → {location_desc}")
                         version_copied += 1
                     else:
                         # Copy file with link rewriting for content files
@@ -464,8 +612,11 @@ def organize_content_files(self, version_configs: Dict[str, Dict],
                                 with open(item, 'r', encoding='utf-8') as f:
                                     content = f.read()
 
-                                # Rewrite internal links
-                                modified_content = self.rewrite_internal_links(content, version, is_latest)
+                                # First: Rewrite snippet imports (always uses version)
+                                modified_content = self.rewrite_snippet_imports(content, version)
+                                
+                                # Then: Rewrite internal links (uses subfolder logic)
+                                modified_content = self.rewrite_internal_links(modified_content, version, is_latest)
 
                                 # Write modified content
                                 with open(target_item, 'w', encoding='utf-8') as f:
@@ -705,9 +856,9 @@ def add_redirect(source, destination, permanent=False):
         if latest_version:
             # Find a good default page from latest version config
             latest_config = version_configs[latest_version]
-            default_page = "getting-started/"
+            default_page = None
 
-            # Try to find a better default from navigation
+            # Try to find a default from navigation
             nav = latest_config.get("navigation", {})
             if "tabs" in nav and nav["tabs"]:
                 first_tab = nav["tabs"][0]
@@ -718,23 +869,15 @@ def add_redirect(source, destination, permanent=False):
                         if isinstance(first_page, str):
                             default_page = first_page
 
-            # Build the destination path with subfolder prefix
-            destination_path = f"/{self.subfolder}/{default_page}" if self.subfolder else f"/{default_page}"
+            # Only create root redirect if we found a default page
+            if default_page:
+                # Build the destination path with subfolder prefix
+                destination_path = f"/{self.subfolder}/{default_page}" if self.subfolder else f"/{default_page}"
 
-            # Root redirect to default page (with subfolder prefix if applicable)
-            add_redirect("/", destination_path, False)
+                # Root redirect to default page (with subfolder prefix if applicable)
+                add_redirect("/", destination_path, False)
 
-            # Latest alias redirects
-            if self.subfolder:
-                # Redirect /latest/* to /subfolder/:splat
-                add_redirect("/latest/*", f"/{self.subfolder}/:splat", False)
-
-                # Redirect versioned latest URLs to subfolder paths
-                add_redirect(f"/{latest_version}/*", f"/{self.subfolder}/:splat", True)
-            else:
-                # Standard redirects when no subfolder
-                add_redirect("/latest/*", "/:splat", False)
-                add_redirect(f"/{latest_version}/*", "/:splat", True)
+            # No automatic latest/version redirects - keep it simple
 
         # Collect version-specific redirects
         for version, config in version_configs.items():
@@ -797,6 +940,56 @@ def clean_config(self, config: Dict) -> Dict:
                     cleaned[key] = value
         return cleaned
 
+    def rewrite_snippet_imports(self, content, version):
+        """Dedicated function for snippet import rewriting - always uses version"""
+        import re
+        
+        print(f"    📝 Processing snippet imports for version: {version}")
+        changes_made = 0
+        
+        def replace_snippet_import(match):
+            nonlocal changes_made
+            # Extract the import parts
+            import_part = match.group(1)  # "import Something" or "import { Something }"
+            quote = match.group(2)        # Quote character (' or ")
+            snippet_path = match.group(3) # The snippet path
+            
+            print(f"      🔍 Found snippet import: {snippet_path}")
+            
+            # Only process snippet imports that start with /snippets/
+            if not snippet_path.startswith('/snippets/'):
+                print(f"      ⚠️ Skipping non-snippet import: {snippet_path}")
+                return match.group(0)
+            
+            # Check if already has version by looking for known version patterns
+            path_parts = snippet_path.split('/')
+            print(f"      🔍 Path parts: {path_parts} (length: {len(path_parts)})")
+            
+            # Check if the third part (index 2) looks like a version
+            if len(path_parts) >= 4:  # ['', 'snippets', 'potential_version', 'file.mdx']
+                potential_version = path_parts[2]
+                # Check if it looks like a version (contains digits or is 'nightly')
+                if potential_version == 'nightly' or any(char.isdigit() for char in potential_version):
+                    print(f"      ✅ Already has version '{potential_version}', skipping: {snippet_path}")
+                    return match.group(0)  # Already versioned
+            
+            # Extract filename after /snippets/
+            snippet_file = snippet_path[10:]  # Remove '/snippets/' prefix
+            new_snippet_path = f"/snippets/{version}/{snippet_file}"
+            
+            changes_made += 1
+            print(f"      📝 Snippet import: {snippet_path} → {new_snippet_path}")
+            return f'{import_part} from {quote}{new_snippet_path}{quote}'
+        
+        # Match both import patterns:
+        # import Something from '/snippets/...'
+        # import { Something } from '/snippets/...'
+        pattern = r'(import\s+(?:\{[^}]+\}|\w+))\s+from\s+(["\'])(/snippets/[^"\']+)\2'
+        content = re.sub(pattern, replace_snippet_import, content)
+        
+        print(f"    📝 Snippet imports: {changes_made} changes made")
+        return content
+
     def rewrite_internal_links(self, content, version, is_latest):
         """Rewrite internal links to include subfolder and version paths"""
         import re
@@ -865,25 +1058,27 @@ def replace_markdown(match):
             text = match.group(1)
             path = match.group(2)
 
+            # Strip leading/trailing whitespace from path
+            path_stripped = path.strip()
+
             # Skip external links and mailto (including angle bracket wrapped)
-            if (path.startswith('http') or path.startswith('//') or
-                    path.startswith('<mailto:') or 'mailto:' in path):
+            if (path_stripped.startswith('http') or path_stripped.startswith('//') or
+                    path_stripped.startswith('<mailto:') or 'mailto:' in path_stripped):
                 return match.group(0)
 
-            changes_made += 1
-            return f'[{text}]({prefix}{path})'
-
-        content = re.sub(r'\[([^\]]+)\]\((/[^)]*)\)', replace_markdown, content)
+            # Only process actual internal links that start with /
+            if not path_stripped.startswith('/'):
+                return match.group(0)
 
-        # 3. Fix data paths: path: "/path" or path: 'path'
-        def replace_path(match):
-            nonlocal changes_made
-            quote = match.group(1)
-            path = match.group(2)
             changes_made += 1
-            return f'path: {quote}{prefix}/{path.lstrip("/")}{quote}'
+            return f'[{text}]({prefix}{path_stripped})'
+
+        content = re.sub(r'(?<!!)\[([^\]]+)\]\((/[^)]*)\)', replace_markdown, content)
 
-        content = re.sub(r'path:\s*(["\'])/?([^"\']+)\1', replace_path, content)
+        # 3. Skip data paths - keep them clean, let JSX handle prefixing
+        # This prevents double prefixing by not modifying path: "..." declarations
+        # The JSX template literals will add the prefix instead
+        print(f"    ⚠️ Skipping data path prefixing to prevent double prefixes")
 
         # 4. Fix template string hrefs: href={`/${path}`}
         def replace_template(match):
@@ -932,6 +1127,7 @@ def replace_card_href(match):
             changes_made += 1
             return f'<{component}{before_href}href="{new_path}"{after_href}'
 
+        # BadgeCard is not beign used
         content = re.sub(r'<(Card|BadgeCard|Expandable)([^>]*\s+)href="([^"]+)"([^>]*>)', replace_card_href, content)
 
         # 7. Fix relative markdown links without leading slash: [text](path)
@@ -940,16 +1136,23 @@ def replace_relative_markdown(match):
             text = match.group(1)
             path = match.group(2)
 
+            # Strip leading/trailing whitespace from path
+            path_stripped = path.strip()
+
             # Skip external links and already processed absolute paths
-            if (path.startswith('http') or path.startswith('//') or
-                    path.startswith('mailto:') or path.startswith('<mailto:') or
-                    path.startswith('/') or path.startswith(prefix)):
+            if (path_stripped.startswith('http') or path_stripped.startswith('//') or
+                    path_stripped.startswith('mailto:') or path_stripped.startswith('<mailto:') or
+                    path_stripped.startswith('/') or path_stripped.startswith(prefix)):
                 return match.group(0)
 
             changes_made += 1
-            return f'[{text}]({prefix}/{path})'
+            return f'[{text}]({prefix}/{path_stripped})'
 
-        content = re.sub(r'\[([^\]]+)\]\(([^)]+)\)', replace_relative_markdown, content)
+        # This regex is too broad and conflicts with the absolute path regex above
+        # It should only match relative paths (not starting with /)
+        content = re.sub(r'(?<!!)\[([^\]]+)\]\(([^/)][^)]*)\)', replace_relative_markdown, content)
+
+        # Note: Snippet imports are now handled by the dedicated rewrite_snippet_imports function
 
         print(f"    ✅ Link rewriting complete: {changes_made} changes made")
 
@@ -964,6 +1167,39 @@ def replace_relative_markdown(match):
 
         return content
 
+    def copy_directory_with_link_rewriting(self, source_dir: Path, target_dir: Path, version: str, is_latest: bool) -> None:
+        """Recursively copy directory with link rewriting for content files."""
+        target_dir.mkdir(parents=True, exist_ok=True)
+
+        for item in source_dir.iterdir():
+            target_item = target_dir / item.name
+
+            if item.is_dir():
+                # Recursively copy subdirectories
+                self.copy_directory_with_link_rewriting(item, target_item, version, is_latest)
+            else:
+                # Copy file with link rewriting if it's a content file
+                if item.suffix.lower() in ['.mdx', '.md']:
+                    try:
+                        # Read, rewrite, and write content
+                        with open(item, 'r', encoding='utf-8') as f:
+                            content = f.read()
+
+                        # First: Rewrite snippet imports (always uses version)
+                        modified_content = self.rewrite_snippet_imports(content, version)
+                        
+                        # Then: Rewrite internal links (uses subfolder logic)
+                        modified_content = self.rewrite_internal_links(modified_content, version, is_latest)
+
+                        # Write modified content
+                        with open(target_item, 'w', encoding='utf-8') as f:
+                            f.write(modified_content)
+                    except Exception as e:
+                        print(f"      ⚠️ Error processing {item.relative_to(source_dir)}, copying as-is: {e}")
+                        shutil.copy2(item, target_item)
+                else:
+                    # For non-content files, just copy
+                    shutil.copy2(item, target_item)
 
     def create_unified_config(self, version_configs: Dict[str, Dict]) -> Dict:
         """Create unified configuration with version-based navigation."""
@@ -998,7 +1234,8 @@ def create_unified_config(self, version_configs: Dict[str, Dict]) -> Dict:
         optional_fields = [
             "theme", "logo", "favicon", "colors", "description",
             "api", "integrations", "styling", "search", "seo",
-            "background", "fonts", "appearance", "footer", "banner"
+            "background", "fonts", "appearance", "footer", "banner", "navbar", "contextual","thumbnails","icons",
+            "errors"
         ]
 
         for field in optional_fields:
@@ -1142,4 +1379,4 @@ def main():
     )
 
 if __name__ == "__main__":
-    main()
\ No newline at end of file
+    main()
diff --git a/scripts/validate_mintlify_docs.py b/scripts/validate_mintlify_docs.py
new file mode 100644
index 0000000000..16b4d72783
--- /dev/null
+++ b/scripts/validate_mintlify_docs.py
@@ -0,0 +1,1395 @@
+#!/usr/bin/env python3
+"""
+Script to check for broken links in converted Mintlify documentation.
+
+
+WHAT THIS SCRIPT VALIDATES:
+
+1. BROKEN LINKS & IMAGES:
+   - Scans all MDX files for internal links and verifies they exist
+   - Checks image references and verifies image files exist
+   - Handles various file patterns (.mdx extensions, index files, etc.)
+   - Considers redirects when checking link existence
+
+2. DOCS.JSON VALIDATION (--validate-redirects flag):
+   - Self-referencing redirects (source = destination)
+   - Navigation-redirect conflicts (same path in both navigation and redirects)
+   - Invalid redirects (empty source or destination)
+   - Missing navigation files (navigation entries pointing to non-existent files)
+   - Missing redirect destinations (redirect destinations pointing to non-existent files)
+
+3. ANCHOR VALIDATION (--check-anchors flag):
+   - Scans all internal links that contain fragment identifiers (e.g. /page#section)
+   - Resolves the target file and extracts all valid anchors from it:
+     * GFM-slugified headings (Mintlify's default anchor format)
+     * Custom heading IDs via {#id} syntax
+     * HTML <a id="..."> and <a name="..."> elements
+     * <Tab title="..."> elements (slugified title)
+     * <ParamField path="..."> elements → #param-{path} (underscores/dots → hyphens)
+   - Reports links whose anchor does not exist in the target file
+
+4. EXTERNAL LINK VALIDATION (--external-links flag):
+   - Checks all external HTTP/HTTPS URLs return a non-4xx/5xx response
+   - Uses HEAD requests with a GET fallback
+   - Configurable timeout and per-request delay for rate limiting
+
+USAGE:
+   python validate_mintlify_docs.py [directory] [options]
+   make check-redirects    # Validate redirects and navigation only
+   make validate-all       # Full validation with verbose output
+   python scripts/validate_mintlify_docs.py . --external-links --external-timeout 5 --external-delay 0.5
+   python scripts/validate_mintlify_docs.py . --check-anchors
+"""
+
+import os
+import re
+import glob
+import json
+import argparse
+import urllib.parse
+import requests
+import time
+from pathlib import Path
+from typing import Optional, Set, List, Tuple, Dict, Any
+
+def remove_comments_and_code(content: str) -> str:
+    """Remove JSX comments, HTML comments, and code blocks from content."""
+    # Remove JSX comments: {/* ... */} (including multi-line)
+    jsx_comment_pattern = r'\{/\*.*?\*/\}'
+    content = re.sub(jsx_comment_pattern, '', content, flags=re.DOTALL)
+    
+    # Remove HTML comments: <!-- ... --> (including multi-line)
+    html_comment_pattern = r'<!--.*?-->'
+    content = re.sub(html_comment_pattern, '', content, flags=re.DOTALL)
+    
+    # Remove fenced code blocks: ``` ... ``` (including multi-line)
+    fenced_code_pattern = r'```.*?```'
+    content = re.sub(fenced_code_pattern, '', content, flags=re.DOTALL)
+    
+    # Remove inline code: ` ... `
+    inline_code_pattern = r'`[^`\n]*`'
+    content = re.sub(inline_code_pattern, '', content)
+    
+    return content
+
+def slugify_heading(text: str) -> str:
+    """Convert a heading string to a Mintlify-compatible anchor slug.
+
+    Empirically verified Mintlify slugify rules:
+      1. Lowercase and strip whitespace
+      2. Remove HTML tags; strip markdown formatting (* ` ~) — underscore is kept
+      3. ' - ' (space-hyphen-space) collapses to a single '-'
+         e.g. "Dispatcher - Hooks" -> "dispatcher-hooks"
+      4. Context-dependent character processing (char by char):
+         - ( [ ] ! : ?  -> always omitted
+         - )             -> omitted before space/end; '-' before non-space
+                            e.g. "(mTLS):" -> "mtls-"  (')' before ':' -> '-', ':' omitted)
+         - /             -> URL-encoded as '%2F'  (NOT removed)
+                            e.g. "A / B"  -> "a-%2F-b"
+         - .             -> omitted before space/end; '-' between non-space chars
+                            e.g. "2. Auth" -> "2-auth"   (omitted before space)
+                            e.g. "5.3.0"  -> "5-3-0"    (converted between digits)
+         - ,             -> omitted before space/end
+                            e.g. "Orgs, APIs" -> "orgs-apis"
+         - _ and -       -> kept as-is
+      5. Each remaining space -> '-'  (no collapsing of runs)
+      6. Strip leading hyphens only (keep trailing)
+    """
+    slug = text.strip().lower()
+    # Remove inline HTML tags
+    slug = re.sub(r'<[^>]+>', '', slug)
+    # Remove markdown formatting (* ` ~) — underscore is kept (verified: snake_case -> snake_case)
+    slug = re.sub(r'[*`~]', '', slug)
+    # Collapse ' - ' (space-hyphen-space) to a single '-' before space conversion
+    # e.g. "Dispatcher - Hooks" -> "dispatcher-hooks" (NOT "dispatcher---hooks")
+    slug = re.sub(r' - ', '-', slug)
+
+    result = []
+    for i, c in enumerate(slug):
+        next_c = slug[i + 1] if i + 1 < len(slug) else None
+
+        if c in ('(', '[', ']', '!', ':', '?'):
+            pass  # always omit
+        elif c == ')':
+            # omit before space or end; '-' before non-space
+            if next_c is not None and next_c != ' ':
+                result.append('-')
+        elif c == '/':
+            result.append('%2F')
+        elif c == '.':
+            # omit before space or end; also omit when preceded by a space-derived
+            # '-' (e.g. "Sample .env" → "sample-env", not "sample--env")
+            prev_result = result[-1] if result else None
+            if next_c is not None and next_c != ' ' and prev_result != '-':
+                result.append('-')
+        elif c == ',':
+            # omit before space or end
+            if next_c is not None and next_c != ' ':
+                result.append('-')  # unverified edge case
+        elif c == ' ':
+            result.append('-')
+        elif c.isalnum() or c in ('-', '_'):
+            result.append(c)
+        else:
+            result.append('-')  # fallback for any other punctuation
+
+    slug = ''.join(result)
+    # Strip leading hyphens only (keep trailing — they are meaningful in Mintlify)
+    return slug.lstrip('-')
+
+
+def extract_file_anchors(content: str) -> Set[str]:
+    """Return all valid anchor IDs defined within an MDX file.
+
+    Sources considered:
+    - ATX headings (## Heading) → GFM slug, with Mintlify-style duplicate
+      disambiguation: the second occurrence of a slug gets a '-1' suffix,
+      the third gets '-2', etc.
+    - Custom heading IDs: ## Heading {#custom-id} → custom-id (overrides slug,
+      no disambiguation applied)
+    - HTML <a id="..."> and <a name="..."> elements
+    - <Tab title="..."> elements → slugified title
+    - <ParamField path="..."> elements → "param-" + path lowercased with _ and . → -
+      e.g. path="api_id" → #param-api-id, path="auth.header_name" → #param-auth-header-name
+    """
+    anchors: Set[str] = set()
+    # Track how many times each base slug has appeared for disambiguation
+    slug_count: Dict[str, int] = {}
+
+    heading_re = re.compile(
+        r'^[ \t]*(?:\d+\.\s+|[-*+]\s+)?#{1,6}\s+(.+?)(?:\s+\{#([^}]+)\})?\s*$',
+        re.MULTILINE,
+    )
+    for m in heading_re.finditer(content):
+        custom_id = m.group(2)
+        if custom_id:
+            anchors.add(custom_id.strip())
+        else:
+            slug = slugify_heading(m.group(1))
+            if not slug:
+                continue
+            count = slug_count.get(slug, 0)
+            slug_count[slug] = count + 1
+            anchors.add(slug)
+            if count > 0:
+                # Mintlify disambiguates: 2nd occurrence → slug-1, 3rd → slug-2 …
+                anchors.add(f"{slug}-{count}")
+
+    # <a id="..."> and <a name="...">
+    for attr in ('id', 'name'):
+        for m in re.finditer(
+            rf'<a[^>]+{attr}=["\']([^"\']+)["\']', content, re.IGNORECASE
+        ):
+            anchors.add(m.group(1))
+
+    # <Tab title="..."> elements generate anchors from their slugified title
+    for m in re.finditer(r'<Tab\s+title=["\']([^"\']+)["\']', content, re.IGNORECASE):
+        slug = slugify_heading(m.group(1))
+        if slug:
+            anchors.add(slug)
+
+    # <ParamField path="..."> elements generate anchors as #param-{path}
+    # Mintlify lowercases the path and converts underscores and dots to hyphens.
+    # e.g. path="api_id" → #param-api-id, path="auth.header_name" → #param-auth-header-name
+    for m in re.finditer(r'<ParamField\b[^>]+\bpath=["\']([^"\']+)["\']', content, re.IGNORECASE):
+        path = m.group(1).lower().replace('_', '-').replace('.', '-')
+        anchors.add('param-' + path)
+
+    return anchors
+
+
+def build_anchor_map(directory: str) -> Dict[str, Set[str]]:
+    """Build a mapping of normalised file path → set of anchors for every MDX file.
+
+    Also resolves MDX import statements (e.g. ``import X from '/snippets/foo.mdx'``)
+    so that anchors defined inside an imported snippet are visible from the
+    importing file.  Only absolute-path imports rooted at the docs directory are
+    resolved; relative imports are silently ignored.
+    """
+    anchor_map: Dict[str, Set[str]] = {}
+
+    # First pass: extract each file's own anchors.
+    file_contents: Dict[str, str] = {}
+    for mdx_file in glob.glob(os.path.join(directory, '**/*.mdx'), recursive=True):
+        try:
+            with open(mdx_file, encoding='utf-8') as fh:
+                content = fh.read()
+            rel = os.path.relpath(mdx_file, directory)
+            file_contents[rel] = content
+            anchor_map[rel] = extract_file_anchors(content)
+        except Exception as e:
+            print(f"Warning: could not read {mdx_file} for anchor extraction: {e}")
+
+    # Second pass: merge in anchors from imported snippet files.
+    import_re = re.compile(
+        r"^import\s+\w+\s+from\s+['\"](/[^'\"]+\.mdx)['\"]",
+        re.MULTILINE,
+    )
+    for rel, content in file_contents.items():
+        for m in import_re.finditer(content):
+            # Absolute import path is relative to the docs root (starts with /).
+            imported_path = m.group(1).lstrip('/')
+            if imported_path in anchor_map:
+                anchor_map[rel] |= anchor_map[imported_path]
+
+    return anchor_map
+
+
+def find_internal_links_with_anchors(mdx_content: str) -> Set[Tuple[str, str]]:
+    """Extract internal links that contain an anchor fragment.
+
+    Returns a set of (normalised_path, anchor) tuples.  Only links that have
+    a non-empty fragment are included; links without fragments are handled by
+    the existing find_internal_links() function.
+    """
+    clean = remove_comments_and_code(mdx_content)
+    results: Set[Tuple[str, str]] = set()
+
+    patterns = [
+        r'\[[^\]]*\]\(([^)]+)\)',           # [text](url)
+        r'<a[^>]+href=["\']([^"\']+)["\']', # <a href="url">
+        r'<Card[^>]+href=["\']([^"\']+)["\']',  # <Card href="url">
+    ]
+
+    for pattern in patterns:
+        for m in re.finditer(pattern, clean, re.IGNORECASE):
+            raw = m.group(1).strip().strip('"\'')
+
+            # Skip external URLs and pure-anchor links
+            if raw.startswith(('http://', 'https://', 'mailto:', 'tel:', 'ftp://', '#', '<mailto:')):
+                continue
+
+            if '#' not in raw:
+                continue
+
+            path_part, anchor = raw.split('#', 1)
+            if not anchor:
+                continue
+
+            # Normalise the path the same way find_internal_links does
+            path_part = path_part.split('?')[0]  # strip query params
+            if path_part.startswith('/'):
+                path_part = path_part[1:]
+            path_part = path_part.rstrip('/')
+
+            if path_part:  # skip anchor-only refs on the current page
+                results.add((path_part, anchor))
+
+    return results
+
+
+def resolve_file_path(
+    path: str,
+    existing_files: Set[str],
+    redirects: Dict[str, str],
+) -> Optional[str]:
+    """Resolve a normalised link path to a relative file path (with .mdx extension).
+
+    Returns the relative path (e.g. 'api-management/rate-limit.mdx') or None
+    if the file cannot be found even after following redirects.
+    """
+    candidates = [
+        f"{path}.mdx",
+        path,
+        f"{path}/index.mdx",
+        f"{path}/index",
+    ]
+    for c in candidates:
+        if c in existing_files:
+            # Return with .mdx extension if it's a known file
+            return c if c.endswith('.mdx') else f"{c}.mdx"
+
+    # Try redirect
+    for key in (path, f"/{path}"):
+        if key in redirects:
+            dest = redirects[key].lstrip('/')
+            if dest != path:
+                return resolve_file_path(dest, existing_files, redirects)
+
+    return None
+
+
+def check_broken_anchors(
+    base_dir: str,
+    file_anchor_links: Dict[str, Set[Tuple[str, str]]],
+    anchor_map: Dict[str, Set[str]],
+    existing_files: Set[str],
+    redirects: Dict[str, str],
+    anchor_target_excludes: List[str],
+) -> Dict[str, List[Tuple[str, str]]]:
+    """Check that every anchor fragment in internal links resolves in the target file.
+
+    Returns a dict mapping source file → list of (link_with_anchor, reason) tuples.
+    anchor_target_excludes: list of relative file paths (with or without .mdx) whose
+    anchors should not be validated (e.g. files that pull content via MDX imports).
+    """
+    # Normalise excludes to bare paths without extension for comparison
+    excluded = {p.removesuffix('.mdx') for p in anchor_target_excludes}
+
+    broken: Dict[str, List[Tuple[str, str]]] = {}
+
+    for source_file, links in file_anchor_links.items():
+        file_broken: List[Tuple[str, str]] = []
+        for path, anchor in sorted(links):
+            # Skip if the target file is in the exclude list
+            if path.removesuffix('.mdx') in excluded:
+                continue
+
+            rel_file = resolve_file_path(path, existing_files, redirects)
+
+            if rel_file is None:
+                # File itself doesn't exist — already caught by broken-link check
+                continue
+
+            file_anchors = anchor_map.get(rel_file, set())
+            if anchor not in file_anchors:
+                file_broken.append((f"{path}#{anchor}", f"anchor '#{anchor}' not found in {rel_file}"))
+
+        if file_broken:
+            broken[source_file] = file_broken
+
+    return broken
+
+
+def find_internal_links(mdx_content: str) -> Set[str]:
+    """Extract all internal links from MDX content, excluding links in comments and code blocks."""
+    # Remove comments and code blocks first to avoid parsing commented-out or code example links
+    clean_content = remove_comments_and_code(mdx_content)
+    
+    internal_links = set()
+    
+    # Pattern for markdown links: [text](path) - exclude external URLs
+    markdown_pattern = r'\[([^\]]*)\]\(([^)]+)\)'
+    
+    # Pattern for HTML anchor tags: <a href="path">
+    html_pattern = r'<a[^>]+href=["\']([^"\']+)["\']'
+    
+    # Pattern for Card components: <Card href="path" ...>
+    card_pattern = r'<Card[^>]+href=["\']([^"\']+)["\']'
+    
+    # Find all matches
+    for pattern in [markdown_pattern, html_pattern, card_pattern]:
+        matches = re.findall(pattern, clean_content, re.IGNORECASE)
+        for match in matches:
+            # For markdown pattern, match[1] is the URL, for HTML/Card patterns, match is the URL
+            url = match[1] if isinstance(match, tuple) and len(match) > 1 else match
+            
+            # Skip external URLs, anchors, and special protocols (including malformed mailto)
+            if (not url.startswith(('http://', 'https://', 'mailto:', 'tel:', 'ftp://')) and
+                not url.startswith('#') and
+                not url.startswith('<mailto:') and  # Skip malformed mailto links
+                url.strip()):
+                # Clean up the path
+                clean_url = url.strip().strip('"\'')
+                
+                # Skip external URLs after cleaning (handles spaces before URLs)
+                if clean_url.startswith(('http://', 'https://', 'mailto:', 'tel:', 'ftp://')):
+                    continue
+                
+                # Remove URL fragments (anchors)
+                if '#' in clean_url:
+                    clean_url = clean_url.split('#')[0]
+                # Remove query parameters
+                if '?' in clean_url:
+                    clean_url = clean_url.split('?')[0]
+                # Remove leading slash if present (normalize paths)
+                if clean_url.startswith('/'):
+                    clean_url = clean_url[1:]
+                # Remove trailing slash if present (normalize paths)
+                if clean_url.endswith('/'):
+                    clean_url = clean_url[:-1]
+                if clean_url:  # Only add non-empty paths
+                    internal_links.add(clean_url)
+    
+    return internal_links
+
+def find_image_references(mdx_content: str) -> Set[str]:
+    """Extract all image references from MDX content, excluding images in comments and code blocks."""
+    # Remove comments and code blocks first to avoid parsing commented-out or code example images
+    clean_content = remove_comments_and_code(mdx_content)
+    
+    image_refs = set()
+    
+    # Pattern for markdown images: ![alt](path)
+    markdown_pattern = r'!\[.*?\]\(([^)]+)\)'
+    
+    # Pattern for HTML img tags: <img src="path" ...>
+    html_pattern = r'<img[^>]+src=["\']([^"\']+)["\']'
+    
+    # Pattern for JSX img elements: <img src={"/path"} or <img src="/path"
+    jsx_pattern = r'<img[^>]+src=\{?["\']([^"\']+)["\']'
+    
+    # Pattern for Card components: <Card img="path" ...>
+    card_pattern = r'<Card[^>]+img=["\']([^"\']+)["\']'
+    
+    # Find all matches
+    for pattern in [markdown_pattern, html_pattern, jsx_pattern, card_pattern]:
+        matches = re.findall(pattern, clean_content, re.IGNORECASE)
+        for match in matches:
+            # Skip external URLs
+            if not match.startswith(('http://', 'https://', 'data:')):
+                # Clean up the path
+                clean_path = match.strip().strip('"\'')
+                # Remove leading slash if present (normalize paths)
+                if clean_path.startswith('/'):
+                    clean_path = clean_path[1:]
+                image_refs.add(clean_path)
+    
+    return image_refs
+
+def find_external_links(mdx_content: str) -> Set[str]:
+    """Extract all external HTTP/HTTPS links from MDX content, excluding links in comments and code blocks."""
+    # Remove comments and code blocks first to avoid parsing commented-out or code example links
+    clean_content = remove_comments_and_code(mdx_content)
+    
+    external_links = set()
+    
+    # Pattern for markdown links: [text](https://...)
+    markdown_pattern = r'\[([^\]]*)\]\((https?://[^)]+)\)'
+    
+    # Pattern for HTML anchor tags: <a href="https://...">
+    html_pattern = r'<a[^>]+href=["\']?(https?://[^"\'>\s]+)["\']?'
+    
+    # Pattern for Card components: <Card href="https://..." ...>
+    card_pattern = r'<Card[^>]+href=["\']?(https?://[^"\'>\s]+)["\']?'
+    
+    # Find all matches
+    for pattern in [markdown_pattern, html_pattern, card_pattern]:
+        matches = re.findall(pattern, clean_content, re.IGNORECASE)
+        for match in matches:
+            # For markdown pattern, match[1] is the URL, for HTML/Card patterns, match is the URL
+            url = match[1] if isinstance(match, tuple) and len(match) > 1 else match
+            
+            # Clean up the URL
+            clean_url = url.strip().strip('"\'')
+            if clean_url:
+                external_links.add(clean_url)
+    
+    return external_links
+
+def scan_mdx_files(directory: str, check_external: bool = False, check_anchors: bool = False) -> Tuple[Dict[str, Set[str]], Dict[str, Set[str]], Dict[str, Set[str]], Dict[str, Set[Tuple[str, str]]]]:
+    """Scan all MDX files and return links, images, external links, and anchor links by file."""
+    file_links: Dict[str, Set[str]] = {}
+    file_images: Dict[str, Set[str]] = {}
+    file_external_links: Dict[str, Set[str]] = {}
+    file_anchor_links: Dict[str, Set[Tuple[str, str]]] = {}
+    mdx_files = glob.glob(os.path.join(directory, '**/*.mdx'), recursive=True)
+
+    print(f"Scanning {len(mdx_files)} MDX files for links and images...")
+
+    for mdx_file in mdx_files:
+        try:
+            with open(mdx_file, 'r', encoding='utf-8') as f:
+                content = f.read()
+
+            rel_path = os.path.relpath(mdx_file, directory)
+
+            links = find_internal_links(content)
+            images = find_image_references(content)
+
+            if links:
+                file_links[rel_path] = links
+            if images:
+                file_images[rel_path] = images
+
+            if check_external:
+                external_links = find_external_links(content)
+                if external_links:
+                    file_external_links[rel_path] = external_links
+
+            if check_anchors:
+                anchor_links = find_internal_links_with_anchors(content)
+                if anchor_links:
+                    file_anchor_links[rel_path] = anchor_links
+
+        except Exception as e:
+            print(f"Error reading {mdx_file}: {e}")
+
+    return file_links, file_images, file_external_links, file_anchor_links
+
+def load_redirects(directory: str) -> Dict[str, str]:
+    """Load redirects from docs.json or mint.json configuration files."""
+    redirects = {}
+    
+    # Look for configuration files
+    config_files = ['docs.json', 'mint.json']
+    
+    for config_file in config_files:
+        config_path = os.path.join(directory, config_file)
+        if os.path.exists(config_path):
+            try:
+                with open(config_path, 'r', encoding='utf-8') as f:
+                    config = json.load(f)
+                    
+                # Extract redirects if they exist
+                if 'redirects' in config:
+                    for redirect in config['redirects']:
+                        if 'source' in redirect and 'destination' in redirect:
+                            source = redirect['source'].strip('/')
+                            destination = redirect['destination'].strip('/')
+                            redirects[source] = destination
+                            
+                print(f"Loaded {len(redirects)} redirects from {config_file}")
+                break  # Use first config file found
+                        
+            except Exception as e:
+                print(f"Error reading {config_file}: {e}")
+    
+    return redirects
+
+def find_existing_files(directory: str) -> Set[str]:
+    """Find all existing files in the directory."""
+    existing_files = set()
+    
+    for root, dirs, files in os.walk(directory):
+        for file in files:
+            # Get relative path from the base directory
+            rel_path = os.path.relpath(os.path.join(root, file), directory)
+            existing_files.add(rel_path)
+            
+            # Also add without extension for MDX files (common linking pattern)
+            if file.endswith('.mdx'):
+                rel_path_no_ext = rel_path[:-4]  # Remove .mdx
+                existing_files.add(rel_path_no_ext)
+    
+    return existing_files
+
+def check_link_exists(link: str, existing_files: Set[str], redirects: Dict[str, str]) -> bool:
+    """Check if a link exists, considering redirects and various file patterns."""
+    
+    # Check exact match
+    if link in existing_files:
+        return True
+    
+    # Check with .mdx extension
+    if f"{link}.mdx" in existing_files:
+        return True
+    
+    # Check if it's a directory with index file
+    if f"{link}/index.mdx" in existing_files:
+        return True
+    
+    if f"{link}/index" in existing_files:
+        return True
+    
+    # Check if there's a redirect for this link
+    if link in redirects:
+        destination = redirects[link]
+        # Recursively check if the redirect destination exists
+        return check_link_exists(destination, existing_files, redirects)
+    
+    # Check if link with leading slash has a redirect
+    if f"/{link}" in redirects:
+        destination = redirects[f"/{link}"]
+        return check_link_exists(destination.lstrip('/'), existing_files, redirects)
+    
+    return False
+
+def check_external_link(url: str, timeout: int = 10) -> Dict[str, Any]:
+    """Check if an external URL is accessible."""
+    try:
+        # Use HEAD request for faster checking
+        headers = {
+            'User-Agent': 'Mozilla/5.0 (compatible; Mintlify-Link-Checker/1.0)'
+        }
+        response = requests.head(url, timeout=timeout, allow_redirects=True, headers=headers)
+        
+        return {
+            'url': url,
+            'status_code': response.status_code,
+            'accessible': response.status_code < 400,
+            'final_url': response.url if response.url != url else None,
+            'error': None,
+            'response_time': None
+        }
+    except requests.exceptions.Timeout:
+        return {
+            'url': url,
+            'status_code': None,
+            'accessible': False,
+            'final_url': None,
+            'error': f'Timeout after {timeout}s',
+            'response_time': None
+        }
+    except requests.exceptions.ConnectionError:
+        return {
+            'url': url,
+            'status_code': None,
+            'accessible': False,
+            'final_url': None,
+            'error': 'Connection refused',
+            'response_time': None
+        }
+    except Exception as e:
+        return {
+            'url': url,
+            'status_code': None,
+            'accessible': False,
+            'final_url': None,
+            'error': str(e),
+            'response_time': None
+        }
+
+def check_external_links(file_external_links: Dict[str, Set[str]], timeout: int = 10, delay: float = 1.0) -> Dict[str, List[Dict[str, Any]]]:
+    """Check all external links and return results by file."""
+    # Collect all unique URLs to avoid duplicate checking
+    all_urls = set()
+    for urls in file_external_links.values():
+        all_urls.update(urls)
+    
+    if not all_urls:
+        return {}
+    
+    print(f"\n🔍 Checking {len(all_urls)} unique external URLs...")
+    
+    # Check each unique URL
+    url_results = {}
+    for i, url in enumerate(sorted(all_urls), 1):
+        print(f"  [{i}/{len(all_urls)}] {url[:60]}{'...' if len(url) > 60 else ''}", end=' ')
+        
+        start_time = time.time()
+        result = check_external_link(url, timeout)
+        result['response_time'] = time.time() - start_time
+        
+        # Print status
+        if result['accessible']:
+            if result['final_url']:
+                print(f"🔄 {result['status_code']} → {result['final_url'][:40]}{'...' if len(result['final_url']) > 40 else ''}")
+            else:
+                print(f"✅ {result['status_code']}")
+        else:
+            if result['error']:
+                print(f"❌ {result['error']}")
+            else:
+                print(f"❌ {result['status_code']}")
+        
+        url_results[url] = result
+        
+        # Rate limiting
+        if i < len(all_urls):
+            time.sleep(delay)
+    
+    # Map results back to files
+    file_results = {}
+    for file_path, urls in file_external_links.items():
+        file_results[file_path] = [url_results[url] for url in urls]
+    
+    return file_results
+
+def check_broken_links(
+    base_dir: str,
+    check_external: bool = False,
+    external_timeout: int = 10,
+    external_delay: float = 1.0,
+    check_anchors: bool = False,
+    anchor_target_excludes: Optional[List[str]] = None,
+) -> Tuple[
+    Dict[str, List[str]],
+    Dict[str, List[str]],
+    Dict[str, str],
+    Dict[str, List[Dict[str, Any]]],
+    Dict[str, List[Tuple[str, str]]],
+]:
+    """Check for broken internal links, missing images, and optionally external links and anchors."""
+    print(f"Checking for broken links in: {base_dir}")
+
+    redirects = load_redirects(base_dir)
+    file_links, file_images, file_external_links, file_anchor_links = scan_mdx_files(
+        base_dir, check_external, check_anchors
+    )
+    existing_files = find_existing_files(base_dir)
+
+    broken_links: Dict[str, List[str]] = {}
+    broken_images: Dict[str, List[str]] = {}
+
+    for file_path, links in file_links.items():
+        file_broken = [l for l in links if not check_link_exists(l, existing_files, redirects)]
+        if file_broken:
+            broken_links[file_path] = file_broken
+
+    for file_path, images in file_images.items():
+        file_broken = [img for img in images if img not in existing_files]
+        if file_broken:
+            broken_images[file_path] = file_broken
+
+    external_results: Dict[str, List[Dict[str, Any]]] = {}
+    if check_external and file_external_links:
+        external_results = check_external_links(file_external_links, external_timeout, external_delay)
+
+    broken_anchor_results: Dict[str, List[Tuple[str, str]]] = {}
+    if check_anchors and file_anchor_links:
+        print(f"\n🔍 Building anchor map for {base_dir}...")
+        anchor_map = build_anchor_map(base_dir)
+        broken_anchor_results = check_broken_anchors(
+            base_dir, file_anchor_links, anchor_map, existing_files, redirects,
+            anchor_target_excludes=anchor_target_excludes or [],
+        )
+
+    return broken_links, broken_images, redirects, external_results, broken_anchor_results
+
+
+def extract_navigation_links(navigation: Dict[str, Any]) -> Set[str]:
+    """Extract all navigation links from the navigation structure."""
+    links = set()
+    
+    def process_item(item):
+        if isinstance(item, str):
+            # Direct page reference
+            links.add(item)
+        elif isinstance(item, dict):
+            if 'pages' in item:
+                # Group with pages
+                for page in item['pages']:
+                    process_item(page)
+            elif 'groups' in item:
+                # Tab with groups
+                for group in item['groups']:
+                    process_item(group)
+    
+    # Process tabs
+    if 'tabs' in navigation:
+        for tab in navigation['tabs']:
+            if 'pages' in tab:
+                for page in tab['pages']:
+                    process_item(page)
+            if 'groups' in tab:
+                for group in tab['groups']:
+                    process_item(group)
+    
+    return links
+
+
+def validate_navigation_files(directory: str, navigation: Dict[str, Any]) -> List[str]:
+    """Check if all navigation entries point to existing files."""
+    missing_files = []
+    existing_files = find_existing_files(directory)
+    redirects = load_redirects(directory)
+    
+    nav_links = extract_navigation_links(navigation)
+    
+    for link in nav_links:
+        # Clean the link path (remove leading slash if present)
+        clean_link = link.lstrip('/')
+        
+        # Check if the navigation file exists using the same logic as broken link checking
+        if not check_link_exists(clean_link, existing_files, redirects):
+            missing_files.append(link)
+    
+    return missing_files
+
+
+def validate_redirect_destinations(directory: str, redirects_list: List[Dict[str, str]]) -> List[Dict[str, str]]:
+    """Check if all redirect destinations point to existing files."""
+    missing_destinations = []
+    existing_files = find_existing_files(directory)
+    redirects_dict = load_redirects(directory)
+    
+    for redirect in redirects_list:
+        source = redirect.get('source', '')
+        destination = redirect.get('destination', '')
+        
+        if not destination:
+            continue  # Skip invalid redirects (handled elsewhere)
+        
+        # Skip external URLs
+        if destination.startswith(('http://', 'https://', 'mailto:', 'tel:', 'ftp://')):
+            continue
+        
+        # Skip anchor-only links
+        if destination.startswith('#'):
+            continue
+        
+        # Clean the destination path (remove leading slash if present)
+        clean_destination = destination.lstrip('/')
+        
+        # Remove anchor fragments from destination for file existence check
+        if '#' in clean_destination:
+            clean_destination = clean_destination.split('#')[0]
+        
+        # Remove query parameters from destination for file existence check
+        if '?' in clean_destination:
+            clean_destination = clean_destination.split('?')[0]
+        
+        # Skip empty destinations after cleaning
+        if not clean_destination:
+            continue
+        
+        # Check if the redirect destination exists using the same logic as broken link checking
+        if not check_link_exists(clean_destination, existing_files, redirects_dict):
+            missing_destinations.append({
+                'source': source,
+                'destination': destination,
+                'clean_destination': clean_destination
+            })
+    
+    return missing_destinations
+
+
+def validate_docs_json(directory: str) -> Dict[str, Any]:
+    """Validate docs.json for problematic redirects and navigation conflicts."""
+    docs_json_path = os.path.join(directory, 'docs.json')
+    
+    if not os.path.exists(docs_json_path):
+        return {
+            'error': f'docs.json not found in {directory}',
+            'self_referencing_redirects': [],
+            'navigation_redirect_conflicts': [],
+            'invalid_redirects': [],
+            'missing_navigation_files': []
+        }
+    
+    try:
+        with open(docs_json_path, 'r', encoding='utf-8') as f:
+            docs_config = json.load(f)
+    except Exception as e:
+        return {
+            'error': f'Error reading docs.json: {e}',
+            'self_referencing_redirects': [],
+            'navigation_redirect_conflicts': [],
+            'invalid_redirects': [],
+            'missing_navigation_files': []
+        }
+    
+    # Extract navigation and redirects
+    navigation = docs_config.get('navigation', {})
+    redirects = docs_config.get('redirects', [])
+    
+    # Find self-referencing redirects
+    self_referencing = []
+    invalid_redirects = []
+    
+    for redirect in redirects:
+        source = redirect.get('source', '')
+        destination = redirect.get('destination', '')
+        
+        # Check for self-referencing redirects
+        if source == destination:
+            self_referencing.append(redirect)
+        
+        # Check for invalid redirects (empty source or destination)
+        if not source or not destination:
+            invalid_redirects.append(redirect)
+    
+    # Find navigation-redirect conflicts
+    nav_links = extract_navigation_links(navigation)
+    nav_paths = set()
+    
+    # Convert nav links to paths with leading slash
+    for link in nav_links:
+        if not link.startswith('/'):
+            nav_paths.add('/' + link)
+        else:
+            nav_paths.add(link)
+    
+    # Find conflicts
+    conflicts = []
+    for redirect in redirects:
+        source = redirect.get('source', '')
+        if source in nav_paths:
+            conflicts.append({
+                'source': source,
+                'destination': redirect.get('destination', ''),
+                'redirect': redirect
+            })
+    
+    # Check for missing navigation files
+    missing_nav_files = validate_navigation_files(directory, navigation)
+    
+    # Check for missing redirect destinations
+    missing_redirect_destinations = validate_redirect_destinations(directory, redirects)
+    
+    return {
+        'total_redirects': len(redirects),
+        'total_navigation_links': len(nav_links),
+        'self_referencing_redirects': self_referencing,
+        'navigation_redirect_conflicts': conflicts,
+        'invalid_redirects': invalid_redirects,
+        'missing_navigation_files': missing_nav_files,
+        'missing_redirect_destinations': missing_redirect_destinations
+    }
+
+
+def find_internal_link_targets_raw(mdx_content: str) -> Set[str]:
+    """Extract internal link targets WITHOUT normalising trailing slashes.
+
+    Unlike find_internal_links(), this keeps the trailing slash so we can detect
+    links that Mintlify will 308-redirect. Comments and code blocks are stripped
+    so example/illustrative links are not flagged.
+    """
+    clean_content = remove_comments_and_code(mdx_content)
+    targets: Set[str] = set()
+    patterns = [
+        r'\[([^\]]*)\]\(([^)]+)\)',             # markdown [text](path)
+        r'<a[^>]+href=["\']([^"\']+)["\']',      # <a href="path">
+        r'<Card[^>]+href=["\']([^"\']+)["\']',   # <Card href="path">
+    ]
+    for pattern in patterns:
+        for match in re.findall(pattern, clean_content, re.IGNORECASE):
+            url = match[1] if isinstance(match, tuple) and len(match) > 1 else match
+            url = url.strip().strip('"\'')
+            # internal absolute paths only
+            if not url.startswith('/'):
+                continue
+            # drop anchor/query but KEEP any trailing slash
+            path = url.split('#', 1)[0].split('?', 1)[0]
+            if path:
+                targets.add(path)
+    return targets
+
+
+def resolve_redirect_chain(path: str, redirects: Dict[str, str]) -> str:
+    """Follow a redirect chain to its final, non-redirecting target (slash-stripped)."""
+    key = path.strip('/')
+    seen: Set[str] = set()
+    while key in redirects and key not in seen:
+        seen.add(key)
+        key = redirects[key].strip('/')
+    return key
+
+
+def check_redirecting_links(base_dir: str, redirects: Dict[str, str]) -> Dict[str, List[Tuple[str, str, str]]]:
+    """Find internal links that hit a 3xx redirect instead of resolving directly.
+
+    Two cases are flagged:
+      1. Trailing slash: Mintlify serves canonical URLs without a trailing slash
+         and 308-redirects '/foo/' -> '/foo'.
+      2. Redirect source: the link target is the 'source' of a docs.json redirect,
+         so it 30x-redirects to the configured destination.
+
+    Returns {file_path: [(offending_link, reason, suggested_target), ...]}.
+    Links inside comments and code blocks are ignored.
+    """
+    results: Dict[str, List[Tuple[str, str, str]]] = {}
+    mdx_files = glob.glob(os.path.join(base_dir, '**', '*.mdx'), recursive=True)
+    for file_path in mdx_files:
+        try:
+            with open(file_path, 'r', encoding='utf-8') as fh:
+                content = fh.read()
+        except (OSError, UnicodeDecodeError):
+            continue
+
+        findings: Set[Tuple[str, str, str]] = set()
+        for target in find_internal_link_targets_raw(content):
+            if target == '/':
+                continue
+            key = target.strip('/')
+            is_trailing = target.endswith('/')
+            is_redirect_source = key in redirects
+            if not (is_trailing or is_redirect_source):
+                continue
+            suggestion = '/' + resolve_redirect_chain(key, redirects)
+            reason = ('links to a redirect source (3xx)' if is_redirect_source
+                      else 'trailing slash (308 redirect)')
+            findings.add((target, reason, suggestion))
+        if findings:
+            results[file_path] = sorted(findings)
+    return results
+
+
+def find_absolute_links(mdx_content: str) -> Set[str]:
+    """Extract absolute http(s):// link targets (markdown, <a>, <Card>), excluding comments/code."""
+    clean_content = remove_comments_and_code(mdx_content)
+    links: Set[str] = set()
+    patterns = [
+        r'\[[^\]]*\]\((https?://[^)\s]+)\)',       # markdown [text](http://...)
+        r'<a[^>]+href=["\'](https?://[^"\']+)["\']',
+        r'<Card[^>]+href=["\'](https?://[^"\']+)["\']',
+    ]
+    for pattern in patterns:
+        for url in re.findall(pattern, clean_content, re.IGNORECASE):
+            links.add(url.strip())
+    return links
+
+
+# First-party hosts that must always be served over https.
+INSECURE_FIRST_PARTY_RE = re.compile(r'^http://(?:[a-z0-9-]+\.)*tyk\.io(?:[:/?#]|$)', re.IGNORECASE)
+
+
+def check_insecure_links(base_dir: str) -> Dict[str, List[Tuple[str, str]]]:
+    """Find insecure http:// links to first-party (tyk.io) domains.
+
+    An https page linking to http://...tyk.io triggers a 30x upgrade and is a
+    mixed-signal / security smell. Only first-party hosts are flagged so that
+    legitimately http-only third-party links are not false-positives. Links in
+    comments and code blocks are ignored.
+
+    Returns {file_path: [(insecure_link, https_suggestion), ...]}.
+    """
+    results: Dict[str, List[Tuple[str, str]]] = {}
+    for file_path in glob.glob(os.path.join(base_dir, '**', '*.mdx'), recursive=True):
+        try:
+            with open(file_path, 'r', encoding='utf-8') as fh:
+                content = fh.read()
+        except (OSError, UnicodeDecodeError):
+            continue
+        findings = sorted({
+            (url, 'https://' + url[len('http://'):])
+            for url in find_absolute_links(content)
+            if INSECURE_FIRST_PARTY_RE.match(url)
+        })
+        if findings:
+            results[file_path] = findings
+    return results
+
+
+_FENCE_OPEN = re.compile(r'^\s*(`{3,}|~{3,})(.*)$')
+_FENCE_CLOSE = re.compile(r'^\s*(`{3,}|~{3,})\s*$')
+
+
+def find_content_h1s(mdx_content: str) -> List[str]:
+    """Return in-content H1s (markdown '# ' and raw <h1>) that render outside code and comments.
+
+    Uses CommonMark fence rules (a closing fence is bare, same char, length >= opening) so
+    that '#' shell comments and <h1> examples inside code blocks - including blocks that show
+    other ``` fences - are not miscounted. Inline code spans are also stripped.
+    """
+    text = re.sub(r'\{/\*.*?\*/\}', '', mdx_content, flags=re.DOTALL)
+    text = re.sub(r'<!--.*?-->', '', text, flags=re.DOTALL)
+
+    found: List[str] = []
+    in_fence = False
+    fence_char = ''
+    fence_len = 0
+    for line in text.splitlines():
+        if in_fence:
+            close = _FENCE_CLOSE.match(line)
+            if close and close.group(1)[0] == fence_char and len(close.group(1)) >= fence_len:
+                in_fence = False
+            continue
+        opener = _FENCE_OPEN.match(line)
+        if opener:
+            in_fence = True
+            fence_char = opener.group(1)[0]
+            fence_len = len(opener.group(1))
+            continue
+        if re.match(r'^# \S', line):
+            found.append(line.strip())
+        if re.search(r'<h1[ >]', re.sub(r'`[^`]*`', '', line), re.IGNORECASE):
+            found.append('<h1>')
+    return found
+
+
+def has_frontmatter_title(mdx_content: str) -> bool:
+    """True if the MDX frontmatter defines a non-empty title (which Mintlify renders as the H1)."""
+    m = re.match(r'^---\n(.*?)\n---', mdx_content, re.DOTALL)
+    return bool(m and re.search(r'^title:\s*\S', m.group(1), re.MULTILINE))
+
+
+def check_multiple_h1(base_dir: str) -> Dict[str, Tuple[int, List[str]]]:
+    """Flag pages that render more than one H1.
+
+    In Mintlify the frontmatter title is the page H1, so any in-content H1 (or two or more
+    when there is no title) means the page has multiple H1s. Snippet fragments are skipped.
+    Returns {file_path: (total_h1_count, [in_content_h1s])}.
+    """
+    results: Dict[str, Tuple[int, List[str]]] = {}
+    for file_path in glob.glob(os.path.join(base_dir, '**', '*.mdx'), recursive=True):
+        norm = file_path.replace(os.sep, '/')
+        if norm.startswith('snippets/') or '/snippets/' in norm:
+            continue
+        try:
+            with open(file_path, 'r', encoding='utf-8') as fh:
+                content = fh.read()
+        except (OSError, UnicodeDecodeError):
+            continue
+        h1s = find_content_h1s(content)
+        total = len(h1s) + (1 if has_frontmatter_title(content) else 0)
+        if total > 1:
+            results[file_path] = (total, h1s)
+    return results
+
+
+def main():
+    parser = argparse.ArgumentParser(description='Check for broken links in converted documentation')
+    parser.add_argument('directory', nargs='?', default='converted', help='Directory to scan (default: converted)')
+    parser.add_argument('--verbose', '-v', action='store_true', help='Show detailed output')
+    parser.add_argument('--images-only', action='store_true', help='Only check for broken images')
+    parser.add_argument('--links-only', action='store_true', help='Only check for broken links')
+    parser.add_argument('--validate-redirects', action='store_true', help='Validate docs.json for problematic redirects')
+    parser.add_argument('--external-links', action='store_true', help='Check external HTTP/HTTPS links')
+    parser.add_argument('--external-timeout', type=int, default=10, help='Timeout for external link requests (default: 10s)')
+    parser.add_argument('--external-delay', type=float, default=1.0, help='Delay between external link requests (default: 1.0s)')
+    parser.add_argument('--external-only', action='store_true', help='Only check external links')
+    parser.add_argument('--external-errors-only', action='store_true', help='Only show failed external links')
+    parser.add_argument('--check-anchors', action='store_true', help='Validate anchor fragments in internal links')
+    parser.add_argument('--anchor-target-excludes', nargs='*', default=[], metavar='PATH',
+                        help='Relative file paths whose anchors should not be validated (e.g. auto-generated files that use MDX imports)')
+    parser.add_argument('--check-redirecting-links', action='store_true',
+                        help='Flag internal links that hit a 3xx redirect (trailing slashes and links to docs.json redirect sources)')
+    parser.add_argument('--check-insecure-links', action='store_true',
+                        help='Flag insecure http:// links to first-party (tyk.io) domains that should use https')
+    parser.add_argument('--check-multiple-h1', action='store_true',
+                        help='Flag pages that render more than one H1 (frontmatter title + in-content # / <h1>)')
+
+    args = parser.parse_args()
+
+    if not os.path.exists(args.directory):
+        print(f"Error: Directory '{args.directory}' does not exist")
+        return 1
+
+    # Check for broken links and images
+    broken_links, broken_images, redirects, external_results, broken_anchors = check_broken_links(
+        args.directory,
+        check_external=args.external_links or args.external_only,
+        external_timeout=args.external_timeout,
+        external_delay=args.external_delay,
+        check_anchors=args.check_anchors,
+        anchor_target_excludes=args.anchor_target_excludes,
+    )
+    
+    # Validate docs.json if requested
+    validation_results = None
+    if args.validate_redirects:
+        validation_results = validate_docs_json(args.directory)
+
+    # Check for internal links that resolve via a 3xx redirect
+    redirecting_links = None
+    if args.check_redirecting_links:
+        redirecting_links = check_redirecting_links(args.directory, redirects)
+
+    # Check for insecure http:// links to first-party domains
+    insecure_links = None
+    if args.check_insecure_links:
+        insecure_links = check_insecure_links(args.directory)
+
+    # Check for pages with multiple H1 tags
+    multiple_h1 = None
+    if args.check_multiple_h1:
+        multiple_h1 = check_multiple_h1(args.directory)
+    
+    # Report results
+    print(f"\n{'='*60}")
+    print("BROKEN LINK ANALYSIS RESULTS")
+    print(f"{'='*60}")
+    
+    total_broken_links = sum(len(links) for links in broken_links.values())
+    total_broken_images = sum(len(images) for images in broken_images.values())
+    
+    if not args.images_only and not args.external_only and broken_links:
+        print(f"\n🔗 BROKEN INTERNAL LINKS ({total_broken_links} total):")
+        for file_path, links in sorted(broken_links.items()):
+            print(f"\n  📄 {file_path}:")
+            for link in sorted(links):
+                print(f"    ❌ {link}")
+    
+    if not args.links_only and not args.external_only and broken_images:
+        print(f"\n🖼️  BROKEN IMAGE REFERENCES ({total_broken_images} total):")
+        for file_path, images in sorted(broken_images.items()):
+            print(f"\n  📄 {file_path}:")
+            for image in sorted(images):
+                print(f"    ❌ {image}")
+    
+    # Report external link results
+    if external_results:
+        # Count results
+        total_external = sum(len(results) for results in external_results.values())
+        successful_external = sum(1 for results in external_results.values() for result in results if result['accessible'])
+        failed_external = total_external - successful_external
+        redirected_external = sum(1 for results in external_results.values() for result in results if result['final_url'])
+        
+        if args.external_errors_only:
+            # Show only failed external links
+            print(f"\n🌐 FAILED EXTERNAL LINKS ({failed_external} total):")
+            for file_path, results in sorted(external_results.items()):
+                failed_results = [r for r in results if not r['accessible']]
+                if failed_results:
+                    print(f"\n  📄 {file_path}:")
+                    for result in failed_results:
+                        if result['error']:
+                            print(f"    ❌ {result['url']} ({result['error']})")
+                        else:
+                            print(f"    ❌ {result['url']} ({result['status_code']})")
+        else:
+            # Show all external link results
+            print(f"\n🌐 EXTERNAL LINK VALIDATION RESULTS ({total_external} total):")
+            for file_path, results in sorted(external_results.items()):
+                print(f"\n  📄 {file_path}:")
+                for result in results:
+                    if result['accessible']:
+                        if result['final_url']:
+                            print(f"    🔄 {result['url']} ({result['status_code']} → {result['final_url']})")
+                        else:
+                            print(f"    ✅ {result['url']} ({result['status_code']})")
+                    else:
+                        if result['error']:
+                            print(f"    ❌ {result['url']} ({result['error']})")
+                        else:
+                            print(f"    ❌ {result['url']} ({result['status_code']})")
+        
+        # Show external link summary
+        print(f"\n📊 EXTERNAL LINK SUMMARY:")
+        print(f"   ✅ Successful (2xx): {successful_external} links")
+        print(f"   🔄 Redirects (3xx): {redirected_external} links")
+        print(f"   ❌ Failed: {failed_external} links")
+    
+    # Report broken anchor results
+    if broken_anchors:
+        total_broken_anchors = sum(len(v) for v in broken_anchors.values())
+        print(f"\n⚓ BROKEN ANCHOR FRAGMENTS ({total_broken_anchors} total):")
+        for file_path, issues in sorted(broken_anchors.items()):
+            print(f"\n  📄 {file_path}:")
+            for link, reason in sorted(issues):
+                print(f"    ❌ {link}  ({reason})")
+
+    # Report validation results
+    if validation_results:
+        print(f"\n{'='*60}")
+        print("DOCS.JSON VALIDATION RESULTS")
+        print(f"{'='*60}")
+        
+        if 'error' in validation_results:
+            print(f"❌ {validation_results['error']}")
+        else:
+            print(f"📊 Total redirects: {validation_results['total_redirects']}")
+            print(f"📊 Total navigation links: {validation_results['total_navigation_links']}")
+            
+            # Self-referencing redirects
+            self_ref = validation_results['self_referencing_redirects']
+            if self_ref:
+                print(f"\n⚠️  SELF-REFERENCING REDIRECTS ({len(self_ref)} found):")
+                for redirect in self_ref:
+                    print(f"    ❌ {redirect['source']} → {redirect['destination']}")
+            else:
+                print("\n✅ No self-referencing redirects found!")
+            
+            # Navigation-redirect conflicts
+            conflicts = validation_results['navigation_redirect_conflicts']
+            if conflicts:
+                print(f"\n⚠️  NAVIGATION-REDIRECT CONFLICTS ({len(conflicts)} found):")
+                for conflict in conflicts:
+                    print(f"    ❌ {conflict['source']} → {conflict['destination']} (exists in navigation)")
+            else:
+                print("\n✅ No navigation-redirect conflicts found!")
+            
+            # Invalid redirects
+            invalid = validation_results['invalid_redirects']
+            if invalid:
+                print(f"\n⚠️  INVALID REDIRECTS ({len(invalid)} found):")
+                for redirect in invalid:
+                    print(f"    ❌ Source: '{redirect.get('source', '')}' → Destination: '{redirect.get('destination', '')}'")
+            else:
+                print("\n✅ No invalid redirects found!")
+            
+            # Missing navigation files
+            missing_nav = validation_results['missing_navigation_files']
+            if missing_nav:
+                print(f"\n⚠️  MISSING NAVIGATION FILES ({len(missing_nav)} found):")
+                for missing_file in missing_nav:
+                    print(f"    ❌ {missing_file} (referenced in navigation but file doesn't exist)")
+            else:
+                print("\n✅ All navigation files exist!")
+            
+            # Missing redirect destinations
+            missing_destinations = validation_results['missing_redirect_destinations']
+            if missing_destinations:
+                print(f"\n⚠️  MISSING REDIRECT DESTINATIONS ({len(missing_destinations)} found):")
+                for missing_dest in missing_destinations:
+                    print(f"    ❌ {missing_dest['source']} → {missing_dest['destination']} (destination file doesn't exist)")
+            else:
+                print("\n✅ All redirect destinations exist!")
+    
+    # Summary
+    print(f"\n{'='*60}")
+    print("SUMMARY")
+    print(f"{'='*60}")
+    
+    if not args.images_only:
+        if broken_links:
+            print(f"❌ Found {total_broken_links} broken internal links in {len(broken_links)} files")
+        else:
+            print("✅ No broken internal links found!")
+    
+    if not args.links_only:
+        if broken_images:
+            print(f"❌ Found {total_broken_images} broken image references in {len(broken_images)} files")
+        else:
+            print("✅ No broken image references found!")
+
+    if args.external_links or args.external_only:
+        if external_results:
+            failed_count = sum(1 for results in external_results.values() for r in results if not r['accessible'])
+            if failed_count:
+                print(f"❌ Found {failed_count} broken external links")
+            else:
+                print("✅ All external links are reachable!")
+        else:
+            print("✅ No external links found!")
+
+    if args.check_anchors:
+        if broken_anchors:
+            total_broken_anchors = sum(len(v) for v in broken_anchors.values())
+            print(f"❌ Found {total_broken_anchors} broken anchor fragments in {len(broken_anchors)} files")
+        else:
+            print("✅ No broken anchor fragments found!")
+
+    if args.check_redirecting_links:
+        if redirecting_links:
+            total_redirecting = sum(len(v) for v in redirecting_links.values())
+            print(f"\n↪️  INTERNAL LINKS THAT REDIRECT ({total_redirecting} in {len(redirecting_links)} files):")
+            for file_path, items in sorted(redirecting_links.items()):
+                print(f"\n  📄 {file_path}")
+                for link, reason, suggestion in items:
+                    print(f"    - {link}  [{reason}]  ->  use {suggestion}")
+            print("\n  Fix: point each link directly at the suggested target (no trailing slash).")
+        else:
+            print("✅ No internal links pointing to redirects found!")
+
+    if args.check_insecure_links:
+        if insecure_links:
+            total_insecure = sum(len(v) for v in insecure_links.values())
+            print(f"\n🔒 INSECURE (http://) FIRST-PARTY LINKS ({total_insecure} in {len(insecure_links)} files):")
+            for file_path, items in sorted(insecure_links.items()):
+                print(f"\n  📄 {file_path}")
+                for link, suggestion in items:
+                    print(f"    - {link}  ->  use {suggestion}")
+            print("\n  Fix: use https:// for tyk.io links.")
+        else:
+            print("✅ No insecure first-party http:// links found!")
+
+    if args.check_multiple_h1:
+        if multiple_h1:
+            print(f"\n🔠 PAGES WITH MULTIPLE H1 TAGS ({len(multiple_h1)}):")
+            for file_path, (total, h1s) in sorted(multiple_h1.items()):
+                print(f"\n  📄 {file_path}  (H1 count: {total})")
+                for h in h1s:
+                    print(f"    - {h}")
+            print("\n  Fix: the frontmatter title is the page H1 - demote in-content '# ' headings to '##' (or wrap example <h1> in a code block).")
+        else:
+            print("✅ No pages with multiple H1 tags found!")
+
+    if validation_results and 'error' not in validation_results:
+        total_issues = (len(validation_results['self_referencing_redirects']) +
+                       len(validation_results['navigation_redirect_conflicts']) +
+                       len(validation_results['invalid_redirects']))
+        if total_issues > 0:
+            print(f"❌ Found {total_issues} redirect validation issues")
+        else:
+            print("✅ No redirect validation issues found!")
+
+    if args.verbose:
+        print(f"\nScanned files in: {args.directory}")
+        print(f"Total MDX files processed: {len(glob.glob(os.path.join(args.directory, '**/*.mdx'), recursive=True))}")
+
+    # Return non-zero exit code if any issues found
+    has_broken_links = broken_links and not args.images_only
+    has_broken_images = broken_images and not args.links_only
+    has_broken_anchors = bool(broken_anchors) and args.check_anchors
+    has_redirecting_links = bool(redirecting_links) and args.check_redirecting_links
+    has_insecure_links = bool(insecure_links) and args.check_insecure_links
+    has_multiple_h1 = bool(multiple_h1) and args.check_multiple_h1
+    has_broken_external = bool(external_results) and any(
+        not result['accessible']
+        for results in external_results.values()
+        for result in results
+    )
+    has_validation_issues = (validation_results and 'error' not in validation_results and
+                           (validation_results['self_referencing_redirects'] or
+                            validation_results['navigation_redirect_conflicts'] or
+                            validation_results['invalid_redirects'] or
+                            validation_results['missing_navigation_files'] or
+                            validation_results['missing_redirect_destinations']))
+
+    return 1 if (has_broken_links or has_broken_images or has_broken_anchors or has_broken_external or has_validation_issues or has_redirecting_links or has_insecure_links or has_multiple_h1) else 0
+
+if __name__ == '__main__':
+    exit(main())
\ No newline at end of file
diff --git a/scroll-offset.js b/scroll-offset.js
new file mode 100644
index 0000000000..8cc8078e83
--- /dev/null
+++ b/scroll-offset.js
@@ -0,0 +1,54 @@
+/**
+ * Scroll Offset Handler
+ * Enforces custom scroll offsets for anchors with data-scroll-offset attribute
+ * Runs after page load to override any default scroll behavior
+ */
+
+function handleScrollOffset() {
+    // Get the current hash from the URL
+    const hash = window.location.hash;
+
+    if (!hash) return;
+
+    // Find the anchor element
+    const anchorId = hash.substring(1); // Remove the '#'
+    const anchor = document.getElementById(anchorId);
+
+    if (!anchor) return;
+
+    console.log(`Found anchor for hash: ${hash}`);
+
+    // Check if the anchor has the data-scroll-offset attribute
+    const scrollOffsetAttr = anchor.getAttribute('data-scroll-offset');
+
+    if (scrollOffsetAttr === null) return; // No scroll offset attribute
+
+    console.log(`Applying custom scroll offset for anchor: ${anchorId}`);
+
+    // Calculate the scroll position
+    const elementRect = anchor.getBoundingClientRect();
+    const scrollTop = window.scrollY || document.documentElement.scrollTop;
+    const offset = 160; // pixels
+    const targetScrollPosition = scrollTop + elementRect.top - offset;
+
+    // Scroll to the calculated position
+    window.scrollTo({
+        top: targetScrollPosition,
+        behavior: 'auto' // Use auto to match instant behavior of hash navigation
+    });
+}
+
+// Run on page load
+if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', handleScrollOffset);
+} else {
+    // If DOM is already loaded, run immediately
+    handleScrollOffset();
+}
+
+// Also handle hash changes
+window.addEventListener('hashchange', handleScrollOffset);
+
+// Run a delayed version to catch any late-loading content
+setTimeout(handleScrollOffset, 500);
+setTimeout(handleScrollOffset, 1500);
diff --git a/snippets/AIStudioCards.mdx b/snippets/AIStudioCards.mdx
new file mode 100644
index 0000000000..fca2e1b8f1
--- /dev/null
+++ b/snippets/AIStudioCards.mdx
@@ -0,0 +1,26 @@
+import { FeatureCards } from '/snippets/FeatureCards.mdx';
+
+export const components = [
+  {
+    title: "Centralized AI Management",
+    icon: "🗄️",
+    description: "Unify and govern AI usage with role-based access, rate limiting, monitoring, and compliance controls."
+  },
+  {
+    title: "AI Gateway",
+    icon: "🚪",
+    description: "Securely proxy LLMs, integrate custom models, and track usage/costs through a central gateway."
+  },
+  {
+    title: "AI Portal",
+    icon: "🔍",
+    description: "Empower developers with a curated catalog of AI tools and services for faster innovation."
+  },
+  {
+    title: "AI Chat",
+    icon: "💬",
+    description: "Enable direct, secure interaction with AI tools and data sources via intuitive chat interfaces."
+  }
+];
+
+<FeatureCards components={components} />
diff --git a/snippets/ButtonLeft.mdx b/snippets/ButtonLeft.mdx
new file mode 100644
index 0000000000..a4b13db186
--- /dev/null
+++ b/snippets/ButtonLeft.mdx
@@ -0,0 +1,54 @@
+export const ButtonLeft = ({ href, color, content }) => {
+  const buttonStyle = {
+    display: 'inline-block',
+    padding: '5px 16px',
+    fontSize: '14px',
+    fontWeight: '500',
+    textDecoration: 'none',
+    borderRadius: '25px',
+    transition: 'all 0.2s ease',
+    cursor: 'pointer',
+    border: '1.2px solid black'
+  };
+
+  const colorStyles = {
+    green: {
+      backgroundColor: '#20EDBA',
+      color: 'black'
+    },
+    red: {
+      backgroundColor: '#dc2626',
+      color: 'white'
+    },
+    black: {
+      backgroundColor: '#1f2937',
+      color: 'white'
+    }
+  };
+
+  const hoverStyle = {
+    transform: 'translateY(-1px)',
+    boxShadow: '0 4px 8px rgba(0,0,0,0.15)'
+  };
+
+  const finalStyle = {
+    ...buttonStyle,
+    ...(colorStyles[color] || colorStyles.black)
+  };
+
+  return (
+    <a
+      href={href}
+      style={finalStyle}
+      onMouseEnter={(e) => {
+        Object.assign(e.target.style, hoverStyle);
+      }}
+      onMouseLeave={(e) => {
+        e.target.style.transform = 'translateY(0)';
+        e.target.style.boxShadow = 'none';
+      }}
+    >
+      {content}
+    </a>
+  );
+};
diff --git a/snippets/DatabaseCalculator.mdx b/snippets/DatabaseCalculator.mdx
new file mode 100644
index 0000000000..2d93d736ee
--- /dev/null
+++ b/snippets/DatabaseCalculator.mdx
@@ -0,0 +1,5 @@
+#### Database Storage Calculator
+
+Use this calculator to estimate the storage requirements for your database when using Tyk. This tool helps you plan your database infrastructure by calculating storage needs based on your API traffic, analytics retention, and configuration data. The calculator considers factors like requests per second, analytics time-to-live, and the number of APIs and policies you manage. Results show the total storage requirement accounting for your specified utilization threshold.
+
+<iframe src="https://tyktechnologies.github.io/docs-applications/database.html" width="100%" height="1200px"></iframe>
diff --git a/snippets/FeatureCards.mdx b/snippets/FeatureCards.mdx
new file mode 100644
index 0000000000..c5ab0c58e7
--- /dev/null
+++ b/snippets/FeatureCards.mdx
@@ -0,0 +1,18 @@
+export const FeatureCards = ({ components }) => {
+  return (
+    <div className="feature-grid">
+      {components.map((item, index) => (
+        <div key={index} className="feature-item">
+          <div className="feature-icon">{item.icon}</div>
+          <div className="feature-title">{item.title}</div>
+          <p className="feature-description">{item.description}</p>
+          {item.path && (
+            <div className="feature-button">
+              <a href={item.path}>{item.button_text || 'Learn More'}</a>
+            </div>
+          )}
+        </div>
+      ))}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/snippets/Grid.mdx b/snippets/Grid.mdx
new file mode 100644
index 0000000000..b81a18b2d1
--- /dev/null
+++ b/snippets/Grid.mdx
@@ -0,0 +1,19 @@
+export const GridWrapper = ({ children, type = '', next }) => {
+  return (
+    <div className={`grid-container ${type}`}>
+      {children}
+
+      {next && (
+        <a className="badge next" href={next}>
+          View more resources&nbsp;
+          <object
+            data="/images/arrows.png"
+            style={{ display: 'inline', verticalAlign: 'middle', marginTop: '-3px' }}
+          />
+        </a>
+      )}
+
+      <div style={{ clear: 'both' }} />
+    </div>
+  );
+};
diff --git a/snippets/RedisCalculator.mdx b/snippets/RedisCalculator.mdx
new file mode 100644
index 0000000000..1a4f98fba9
--- /dev/null
+++ b/snippets/RedisCalculator.mdx
@@ -0,0 +1,6 @@
+
+#### Redis RAM Calculator
+
+Use this calculator to estimate the RAM requirements for your Redis instance when using Tyk. This tool helps you plan your infrastructure by calculating memory needs based on your expected API traffic, caching requirements, and analytics storage. The calculator considers factors like requests per second, cache hit rates, number of API keys, and analytics settings. Results show the total RAM per host accounting for your specified utilization threshold.
+
+<iframe src="https://tyktechnologies.github.io/docs-applications/redis.html" width="100%" height="1100px"></iframe>
\ No newline at end of file
diff --git a/snippets/ReleaseSummaryComponent.mdx b/snippets/ReleaseSummaryComponent.mdx
new file mode 100644
index 0000000000..51ec73704a
--- /dev/null
+++ b/snippets/ReleaseSummaryComponent.mdx
@@ -0,0 +1,67 @@
+export const ReleaseSummaryComponent = ({ releaseData }) => {
+  const linkStyle = {
+    fontWeight: 'normal', 
+    textDecoration: 'none', 
+    borderBottom: 'none', 
+    color: 'rgb(var(--primary))',
+    transition: 'border-bottom 0.2s ease'
+  };
+
+  const handleMouseEnter = (e) => {
+    e.target.style.borderBottom = '1px solid rgb(var(--primary))';
+  };
+
+  const handleMouseLeave = (e) => {
+    e.target.style.borderBottom = 'none';
+  };
+
+  const renderComponent = (component) => (
+    <Card 
+      key={component.name}
+      title={`${component.name} v${component.latest}${component.lts ? ` | v${component.lts} LTS` : ''}`}
+    >
+      Click to <a href={`/${component.home}`} style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>discover more</a>
+      
+      {component.latestData && (
+        <>
+          <div style={{marginBottom: '4px', marginTop: '8px', fontWeight: 'bold', fontSize: '14px', color: '#333'}}>Docker</div>
+          {component.latestData.docker && (
+            <div style={{fontSize: '13px'}}>- <a href={component.latestData.docker} style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>Latest {component.latest}</a></div>
+          )}
+          {component.ltsData?.docker && (
+            <div style={{fontSize: '13px'}}>- <a href={component.ltsData.docker} style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>LTS {component.lts}</a></div>
+          )}
+          {component.latestData.tag && !component.licensed && (
+            <>
+              <div style={{marginBottom: '4px', marginTop: '8px', fontWeight: 'bold', fontSize: '14px', color: '#333'}}>GitHub</div>
+              <div style={{fontSize: '13px'}}>- <a href={component.latestData.tag} style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>Latest {component.latest}</a></div>
+              {component.ltsData?.tag && (
+                <div style={{fontSize: '13px'}}>- <a href={component.ltsData.tag} style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>LTS {component.lts}</a></div>
+              )}
+            </>
+          )}
+        </>
+      )}
+      
+      <div style={{marginTop: '12px', paddingTop: '8px', borderTop: '1px solid #eee'}}>
+        <a href={`/${component.releaseNotesPath}`} style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>
+          Release Notes →
+        </a>
+      </div>
+    </Card>
+  );
+
+  return (
+    <>
+      <h2>Licensed</h2>
+      <ResponsiveGrid>
+        {releaseData.licensed.map(renderComponent)}
+      </ResponsiveGrid>
+
+      <h2>Open Source</h2>
+      <ResponsiveGrid>
+        {releaseData.opensource.map(renderComponent)}
+      </ResponsiveGrid>
+    </>
+  );
+};
diff --git a/snippets/ResponsiveGrid.mdx b/snippets/ResponsiveGrid.mdx
new file mode 100644
index 0000000000..0749b6aa9d
--- /dev/null
+++ b/snippets/ResponsiveGrid.mdx
@@ -0,0 +1,7 @@
+export const ResponsiveGrid = ({ children }) => {
+  return (
+    <div className="responsive-grid">
+      {children}
+    </div>
+  );
+};
diff --git a/snippets/ai-studio-config.mdx b/snippets/ai-studio-config.mdx
new file mode 100644
index 0000000000..06ba4d44fb
--- /dev/null
+++ b/snippets/ai-studio-config.mdx
@@ -0,0 +1,296 @@
+### SERVER_PORT
+ENV: <b>SERVER_PORT</b><br />
+Type: `string`<br />
+Default: `8080`<br />
+
+The port for the AI Studio server to listen on.
+
+### ALLOW_REGISTRATIONS
+ENV: <b>ALLOW_REGISTRATIONS</b><br />
+Type: `boolean`<br />
+Default: `true`<br />
+
+Allow new users to register.
+
+### SITE_URL
+ENV: <b>SITE_URL</b><br />
+Type: `string`<br />
+
+The public URL of the AI Studio.
+
+### FROM_EMAIL
+ENV: <b>FROM_EMAIL</b><br />
+Type: `string`<br />
+
+The email address to send emails from.
+
+### DEVMODE
+ENV: <b>DEVMODE</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Enable development mode.
+
+### DEBUG_HTTP
+ENV: <b>DEBUG_HTTP</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Enable HTTP debugging.
+
+### DEBUG_HTTP_PROXY
+ENV: <b>DEBUG_HTTP_PROXY</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Enable HTTP proxy debugging.
+
+### DATABASE_URL
+ENV: <b>DATABASE_URL</b><br />
+Type: `string`<br />
+Default: `midsommar.db`<br />
+
+The database connection string.
+
+### DATABASE_TYPE
+ENV: <b>DATABASE_TYPE</b><br />
+Type: `string`<br />
+Default: `sqlite`<br />
+
+The type of database to use (e.g., `sqlite`, `postgres`).
+
+### ECHO_CONVERSATION
+ENV: <b>ECHO_CONVERSATION</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Echo conversation messages for debugging.
+
+### TYK_AI_SECRET_KEY
+ENV: <b>TYK_AI_SECRET_KEY</b><br />
+Type: `string`<br />
+
+A secret key used for encrypting secrets and SSO.
+
+### DOCS_URL
+ENV: <b>DOCS_URL</b><br />
+Type: `string`<br />
+
+The URL for the documentation.
+
+### PROXY_URL
+ENV: <b>PROXY_URL</b><br />
+Type: `string`<br />
+
+The URL for the proxy.
+
+### TOOL_DISPLAY_URL
+ENV: <b>TOOL_DISPLAY_URL</b><br />
+Type: `string`<br />
+
+The display URL for tools in the UI.
+
+### DATASOURCE_DISPLAY_URL
+ENV: <b>DATASOURCE_DISPLAY_URL</b><br />
+Type: `string`<br />
+
+The display URL for datasources in the UI.
+
+### FILTER_SIGNUP_DOMAINS
+ENV: <b>FILTER_SIGNUP_DOMAINS</b><br />
+Type: `string`<br />
+
+A comma-separated list of domains to allow for signup.
+
+### DEFAULT_SIGNUP_MODE
+ENV: <b>DEFAULT_SIGNUP_MODE</b><br />
+Type: `string`<br />
+Default: `both`<br />
+
+The default signup mode.
+
+### AI_STUDIO_OCI_CACHE_DIR
+ENV: <b>AI_STUDIO_OCI_CACHE_DIR</b><br />
+Type: `string`<br />
+
+The directory to cache OCI plugins.
+
+### AI_STUDIO_OCI_MAX_CACHE_SIZE
+ENV: <b>AI_STUDIO_OCI_MAX_CACHE_SIZE</b><br />
+Type: `integer`<br />
+Default: `1073741824`<br />
+
+The maximum size of the OCI cache in bytes.
+
+### AI_STUDIO_OCI_REQUIRE_SIGNATURE
+ENV: <b>AI_STUDIO_OCI_REQUIRE_SIGNATURE</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Require OCI plugins to be signed.
+
+### AI_STUDIO_OCI_ALLOWED_REGISTRIES
+ENV: <b>AI_STUDIO_OCI_ALLOWED_REGISTRIES</b><br />
+Type: `string`<br />
+
+A comma-separated list of allowed OCI registries.
+
+### AI_STUDIO_OCI_TIMEOUT
+ENV: <b>AI_STUDIO_OCI_TIMEOUT</b><br />
+Type: `string`<br />
+Default: `30s`<br />
+
+The timeout for OCI operations.
+
+### AI_STUDIO_OCI_RETRY_ATTEMPTS
+ENV: <b>AI_STUDIO_OCI_RETRY_ATTEMPTS</b><br />
+Type: `integer`<br />
+Default: `3`<br />
+
+The number of retry attempts for OCI operations.
+
+### AI_STUDIO_OCI_GC_INTERVAL
+ENV: <b>AI_STUDIO_OCI_GC_INTERVAL</b><br />
+Type: `string`<br />
+Default: `24h`<br />
+
+The garbage collection interval for the OCI cache.
+
+### AI_STUDIO_OCI_KEEP_VERSIONS
+ENV: <b>AI_STUDIO_OCI_KEEP_VERSIONS</b><br />
+Type: `integer`<br />
+Default: `3`<br />
+
+The number of plugin versions to keep in the OCI cache.
+
+### AI_STUDIO_OCI_INSECURE_REGISTRIES
+ENV: <b>AI_STUDIO_OCI_INSECURE_REGISTRIES</b><br />
+Type: `string`<br />
+
+A comma-separated list of insecure OCI registries.
+
+### OCI_PLUGINS_REGISTRY_*
+ENV: <b>OCI_PLUGINS_REGISTRY_*</b><br />
+Type: `string`<br />
+
+Authentication for private OCI registries. See the `.env.example` file for more details.
+
+### OCI_PLUGINS_PUBKEY_*
+ENV: <b>OCI_PLUGINS_PUBKEY_*</b><br />
+Type: `string`<br />
+
+Public keys for verifying OCI plugin signatures. See the `.env.example` file for more details.
+
+### ALLOW_INTERNAL_NETWORK_ACCESS
+ENV: <b>ALLOW_INTERNAL_NETWORK_ACCESS</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Allow plugins to access internal network addresses.
+
+### LOG_LEVEL
+ENV: <b>LOG_LEVEL</b><br />
+Type: `string`<br />
+Default: `info`<br />
+
+The log level (e.g., `trace`, `debug`, `info`, `warn`, `error`).
+
+### SESSION_DURATION
+ENV: <b>SESSION_DURATION</b><br />
+Type: `string`<br />
+Default: `6h`<br />
+
+The duration of user sessions.
+
+### TYK_AI_LICENSE
+ENV: <b>TYK_AI_LICENSE</b><br />
+Type: `string`<br />
+
+The license key for Enterprise Edition.
+
+### LICENSE_TELEMETRY_URL
+ENV: <b>LICENSE_TELEMETRY_URL</b><br />
+Type: `string`<br />
+Default: `https://telemetry.tyk.technology/api/track`<br />
+
+The URL for license telemetry.
+
+### LICENSE_TELEMETRY_PERIOD
+ENV: <b>LICENSE_TELEMETRY_PERIOD</b><br />
+Type: `string`<br />
+Default: `1h`<br />
+
+The period for sending license telemetry.
+
+### LICENSE_VALIDITY_CHECK_PERIOD
+ENV: <b>LICENSE_VALIDITY_CHECK_PERIOD</b><br />
+Type: `string`<br />
+Default: `24h`<br />
+
+The period for checking license validity.
+
+### LICENSE_DISABLE_TELEMETRY
+ENV: <b>LICENSE_DISABLE_TELEMETRY</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Disable license telemetry.
+
+### LICENSE_TELEMETRY_CONCURRENCY
+ENV: <b>LICENSE_TELEMETRY_CONCURRENCY</b><br />
+Type: `integer`<br />
+Default: `20`<br />
+
+The maximum number of concurrent telemetry requests.
+
+### GATEWAY_MODE
+ENV: <b>GATEWAY_MODE</b><br />
+Type: `string`<br />
+Default: `standalone`<br />
+
+The gateway mode (`standalone` or `control`).
+
+### GRPC_PORT
+ENV: <b>GRPC_PORT</b><br />
+Type: `integer`<br />
+Default: `50051`<br />
+
+The gRPC server port.
+
+### GRPC_HOST
+ENV: <b>GRPC_HOST</b><br />
+Type: `string`<br />
+Default: `0.0.0.0`<br />
+
+The gRPC server host.
+
+### GRPC_TLS_INSECURE
+ENV: <b>GRPC_TLS_INSECURE</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Set to `true` to disable TLS for the gRPC server.
+
+### GRPC_TLS_CERT_PATH
+ENV: <b>GRPC_TLS_CERT_PATH</b><br />
+Type: `string`<br />
+
+The path to the TLS certificate for the gRPC server.
+
+### GRPC_TLS_KEY_PATH
+ENV: <b>GRPC_TLS_KEY_PATH</b><br />
+Type: `string`<br />
+
+The path to the TLS key for the gRPC server.
+
+### GRPC_AUTH_TOKEN
+ENV: <b>GRPC_AUTH_TOKEN</b><br />
+Type: `string`<br />
+
+The authentication token for edge gateways to connect to the control plane.
+
+### GRPC_AUTH_TOKEN_NEXT
+ENV: <b>GRPC_AUTH_TOKEN_NEXT</b><br />
+Type: `string`<br />
+
+The next authentication token for zero-downtime rotation.
diff --git a/snippets/api-def-graphql.mdx b/snippets/api-def-graphql.mdx
new file mode 100644
index 0000000000..c5456e56bd
--- /dev/null
+++ b/snippets/api-def-graphql.mdx
@@ -0,0 +1,156 @@
+---
+---
+
+Tyk Classic is the home of Tyk GraphQL. All of the specific settings required to configure Tyk Gateway to proxy GraphQL services is gathered in a single `graphql` object in the API definition.
+
+An example is shown below that composes two different data sources:
+
+1. *countries* which is a `GraphQLDataSource`
+2. *people* which is a `HTTPJSONDataSource`
+
+```json
+{
+  "graphql": {
+    "enabled": true,
+    "execution_mode": "executionEngine",
+    "schema": "type Country {\n  code: String\n}\n\ntype People {\n  count: Int\n}\n\ntype Query {\n  countries: [Country]\n  people: People\n}\n",
+    "type_field_configurations": [
+      {
+        "type_name": "Query",
+        "field_name": "countries",
+        "mapping": {
+          "disabled": false,
+          "path": "countries"
+        },
+        "data_source": {
+          "kind": "GraphQLDataSource",
+          "data_source_config": {          
+            "url": "https://countries.trevorblades.com/",
+            "method": "POST"
+          }
+        }
+      },
+      {
+        "type_name": "Query",
+        "field_name": "people",
+        "mapping": {
+          "disabled": true,
+          "path": ""
+        },
+        "data_source": {
+          "kind": "HTTPJSONDataSource",
+          "data_source_config": {          
+            "url": "https://swapi.dev/api/people/",
+            "method": "GET",
+            "body": "",
+            "headers": [],
+            "default_type_name": "People",
+            "status_code_type_name_mappings": [
+              {
+                "status_code": 200,
+                "type_name": ""
+              }
+            ]
+          }
+        }
+      }
+    ],
+    "playground": {
+      "enabled": true,
+      "path": "/playground"
+    }
+  }
+}
+```
+
+<ParamField path="graphql">
+All the GraphQL configuration is gathered in the `graphql` object.
+</ParamField>
+
+<ParamField path="graphql.enabled">
+If set to `true`, this means the API definition describes a GraphQL API. Tyk GraphQL middleware will be enabled.
+</ParamField>
+    
+<ParamField path="graphql.execution_mode">
+The mode of a GraphQL API. There are two options:
+- `proxyOnly`: there is a single upstream which is a GraphQL API.
+- `executionEngine`: configure your own GraphQL API with multiple data sources; you will compose your own schema.
+</ParamField>
+
+<ParamField path="graphql.schema">
+The GraphQL schema of your API, stored in SDL format
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations`*">
+A list of configurations used when `execution_mode` is `executionEngine`. For your schema, you can set data sources for fields in your types.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.type_name">
+A type of the schema that a field of it will be data source configured.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.field_name">
+A field of the type that will be data source configured.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.mapping">
+- `mapping`: Mapping configurations of a field. It is used to map the field in the received data and a field in the schema. It is used to represent a field with a different name in the schema.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.mapping.disabled">
+If it is `false`, it means enabled.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.mapping.path">
+Original name of the field in the received data.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.data_source">
+Configuration of a specific data source.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.data_source.kind">
+Kind of the upstream. It can be one of `HTTPJSONDataSource` or `GraphQLDataSource`.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.data_source.data_source_config">
+The details of the `data_source`
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.data_source.data_source_config.url">
+URL of the upstream data source like `https://swapi.dev/api` or it can be another Tyk API which you can set like `tyk://<tyk-api-name>` or `tyk://<tyk-api-id>`. Also, you can pass parameters e.g. `"/my-path/{{ .arguments.id }}`, where `id` is passed as query variable in a GraphQL request. 
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.data_source.data_source_config.method">
+HTTP request method which the upstream server waits for the url e.g. `GET`, `POST`, `UPDATE`, `DELETE`.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.data_source.data_source_config.body">
+HTTP request body to send to upstream.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.data_source.data_source_config.headers">
+HTTP headers to send to upstream composed of `key` and `value` pairs.
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.data_source.data_source_config.default_type_name">
+The optional variable to define a default type name for the response object. It is useful in case the response might be a `Union` or `Interface` type which uses `status_code_type_name_mappings`. - only valid for `HTTPJSONDataSource`
+</ParamField>
+
+<ParamField path="graphql.type_field_configurations.data_source.data_source_config.status_code_type_name_mappings">
+A list of mappings from `http.StatusCode` to GraphQL `type_name`. It can be used when the `type_name` depends on the response code. - only valid for `HTTPJSONDataSource`
+- `status_code`: The HTTP response code to map to `type_name`.
+- `type_name`: Type name to be mapped to `status_code`.
+</ParamField>
+    
+<ParamField path="graphql.playground">
+Configuration of the playground which is exposed from the Gateway route.
+</ParamField>
+
+<ParamField path="graphql.playground.enabled">
+If it is `true`, it means the playground will be exposed.
+</ParamField>
+
+<ParamField path="graphql.playground.path">
+The path where playground will sit e.g. if it is `/playground` in your API with name `composed`, you can access to the playground by `https://tyk-gateway/composed/playground`.             
+</ParamField>
diff --git a/snippets/create-api-include.mdx b/snippets/create-api-include.mdx
new file mode 100644
index 0000000000..c70726c9bc
--- /dev/null
+++ b/snippets/create-api-include.mdx
@@ -0,0 +1,204 @@
+---
+---
+
+{/* START OMIT */}
+
+
+<Note>
+**Note: Integration with your OpenAPI documentation**
+
+In Tyk v4.1 we introduced support for APIs defined according to the [OpenAPI Specification v3.0.3](https://spec.openapis.org/oas/v3.0.3) (OAS).  
+This introduces a standard way to describe the vendor-agnostic elements of an API (the OpenAPI Definition, stored as an OpenAPI Document); we take this and add Tyk-specific configuration options to create the *Tyk OAS API Definition*. You can import your own OpenAPI document and Tyk will use this to generate the Tyk OAS API Definition.  
+For a detailed tutorial on using OAS with Tyk Gateway, check out our guide to [creating a Tyk OAS API Definition](/api-management/gateway-config-managing-oas#creating-an-api).
+</Note>
+
+
+**Prerequisites**
+
+In order to complete this tutorial, you need to have [Tyk Self Managed installed](/tyk-self-managed/install).
+
+<ButtonLeft href="https://tyk.io/sign-up/#self" color="green" content="Try it free" />
+
+#### Create an API with the Dashboard
+
+We have a video walkthrough for creating an API and testing an endpoint via Postman.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/qJOHn8BuMpw" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+We will use the Tyk Dashboard to create a very simple API that has no special elements set up.
+
+1. **Select "APIs" from the "System Management" section**
+
+    <img src="/img/2.10/apis_menu.png" alt="API Menu" />
+
+2. **Click "ADD NEW API"**
+
+    <img src="/img/2.10/add_api.png" alt="Add API button location" />
+
+3. **Set up the basic configuration of your API**
+
+    <img src="/img/dashboard/4.1-updates/create-api.png" alt="Create API" />
+
+    - In the **Overview** section, add a **Name** for your API and select the **Type** of API you wish to create. We will use HTTP for this tutorial. 
+    - In the **Details** section, add the **Upstream URL**. This is the Target URL that hosts the service to which you want to proxy incoming requests. You can configure Tyk to perform round-robin load balancing between multiple upstream servers (Target URLs) by selecting **Enable round-robin load balancing**; see [Load Balancing](/planning-for-production/ensure-high-availability/load-balancing) for more details. For this tutorial, we will use a single upstream target: [http://httpbin.org](http://httpbin.org).
+    - Click **Configure API** when you have finished.
+
+4. **Set up authentication for your API**
+
+    Take a look at the **Authentication** section:
+
+    <img src="/img/2.10/authentication.png" alt="Authentication" />
+
+    You have the following options:
+
+    - **Authentication mode**: This is the method that Tyk should use to authenticate requests to call your API. Tyk supports several different authentication modes - see [Client Authentication](/api-management/client-authentication) for more details on securing your API. For this tutorial, you should select `Open (Keyless)`. 
+    - **Strip Authorization Data**: Select this option to ensure that any security (authentication) tokens provided to authorize requests to your API on Tyk are not leaked to the upstream. You can leave this unchecked for this tutorial.
+    - **Auth Key Header Name**: The header parameter that will hold the authentication token (or key) for requests to this API; the default for this is `Authorization`.
+    - **Allow query parameter as well as header**: This option allows the authentication token to be set in the query parameter, not just in the Request Header. For this tutorial, leave this unchecked.
+    - **Use Cookie Value**: Tyk also supports the use of a cookie value as an alternative authentication token location. For this tutorial, leave this unchecked.
+    - **Enable client certificate**: Tyk supports the use of Mutual TLS to authenticate requests to your API; you would use this checkbox to enable this mode. See [Mutual TLS](/api-management/implement-tls#secure-hosted-apis-with-mtls) for details on implementing this feature. For this tutorial, leave this unchecked.
+
+5. **Save the API**
+
+    Click **SAVE**
+
+    <img src="/img/2.10/save.png" alt="Save button" />
+
+    Once saved, you will be taken back to the API list, where your new API will be displayed.
+
+    If you select the API from the list to open it again, the API URL will be displayed in the top of the editor. This is the URL that your consumers will need to call to invoke your API. 
+
+    <img src="/img/2.10/api_url.png" alt="API URL location" />
+
+#### Create an API with the Dashboard API
+
+It is easy to create APIs using Tyk Dashboard's own REST API.  
+You will need an API key for your organization (to authenticate with the Dashboard API) and issue a request using these credentials to create your new API and make it live.
+
+1. **Obtain your Tyk Dashboard API access credentials key & Dashboard URL**
+
+    - From the Tyk Dashboard, select "Users" in the "System Management" section.  
+    - Click **Edit** for your username, then scroll to the bottom of the page.  
+    - Your personal API key, granting you access to the Dashboard API, is labeled **Tyk Dashboard API Access Credentials** key
+
+    <img src="/img/2.10/user_api_id.png" alt="API key location" />
+
+    - Store your Dashboard Key, Dashboard URL & Gateway URL as environment variables so you don't need to keep typing them in
+
+    ```bash
+    export DASH_KEY=db8adec7615d40db6419a2e4688678e0
+
+    # Locally installed dashboard
+    export DASH_URL=http://localhost:3000/api
+
+    # Locally installed gateway
+    export GATEWAY_URL=http://localhost:8080
+
+
+    ### Step 2: Query the `/api/apis` endpoint to see what APIs are loaded on the Gateway
+
+    ```curl
+    curl -H "Authorization: ${DASH_KEY}" ${DASH_URL}/apis
+    {"apis":[],"pages":1}
+    ```
+
+    As you've got a fresh install, you will see that no APIs currently exist
+
+2. **Create your first API**
+
+    We've created a simple Tyk Classic API definition that configures the Tyk Gateway to reverse proxy to the [http://httpbin.org](http://httpbin.org)
+    request/response service. The API definition object is stored here: https://bit.ly/2PdEHuv.
+
+    To load the API definition to the Gateway via the Dashboard API you issue this command:
+
+    ```curl
+    curl -H "Authorization: ${DASH_KEY}" -H "Content-Type: application/json" ${DASH_URL}/apis \
+      -d "$(wget -qO- https://bit.ly/2PdEHuv)"
+    {"Status":"OK","Message":"API created","Meta":"5de83a40767e0271d024661a"}
+    ```
+
+    **Important** Take note of the API ID returned in the `Meta` field - you will need it later as this is the Tyk Gateway's internal identifier for the new API.
+
+    ```
+    export API_ID=5de83a40767e0271d024661a
+    ```
+
+3. **Test your new API**
+
+    You can now make a call to your new API as follows:
+
+    ```curl
+    curl ${GATEWAY_URL}/httpbin/get
+    {
+      "args": {},
+      "headers": {
+        "Accept": "*/*",
+        "Accept-Encoding": "gzip",
+        "Host": "httpbin.org",
+        "User-Agent": "curl/7.54.0"
+      },
+      "origin": "127.0.0.1, 188.220.131.154, 127.0.0.1",
+      "url": "https://httpbin.org/get"
+    }
+    ```
+
+    We sent a request to the gateway on the listen path `/httpbin`. Using this path-based-routing, the gateway was able to identify the API the client intended to target.
+
+    The gateway stripped the listen path and reverse proxied the request to http://httpbin.org/get
+
+4. **Protect your API**
+
+    Let's grab the API definition we created before and store the output to a file locally.
+
+    ```curl
+    curl -s -H "Authorization: ${DASH_KEY}" -H "Content-Type: application/json" ${DASH_URL}/apis/${API_ID} | python -mjson.tool > api.httpbin.json
+    ```
+
+    We can now edit the `api.httpbin.json` file we just created, and modify a couple of fields to enable authentication.
+
+    Change `use_keyless` from `true` to `false`.
+
+    Change `auth_configs.authToken.auth_header_name` to `apikey`.
+
+    **Note** Prior to ** Tyk v2.9.2** `auth_configs.authToken.auth_header_name` was called `auth.auth_header_name`
+
+    Then send a `PUT` request back to Tyk Dashboard to update its configuration.
+
+    ```curl
+    curl -H "Authorization: ${DASH_KEY}" -H "Content-Type: application/json" ${DASH_URL}/apis/${API_ID} -X PUT -d "@api.httpbin.json"
+    {"Status":"OK","Message":"Api updated","Meta":null}
+    ```
+
+5. **Test your protected API**
+
+    First try sending a request without any credentials, as before:
+
+    ```curl
+    curl -I ${GATEWAY_URL}/httpbin/get
+    HTTP/1.1 401 Unauthorized
+    Content-Type: application/json
+    X-Generator: tyk.io
+    Date: Wed, 04 Dec 2019 23:35:34 GMT
+    Content-Length: 46
+    ```
+
+    As you can see, you received an `HTTP 401 Unauthorized` response.
+
+    Now send a request with incorrect credentials:
+
+    ```curl
+    curl -I ${GATEWAY_URL}/httpbin/get -H 'apikey: somejunk'
+    HTTP/1.1 403 Forbidden
+    Content-Type: application/json
+    X-Generator: tyk.io
+    Date: Wed, 04 Dec 2019 23:36:16 GMT
+    Content-Length: 57
+    ```
+
+    As you can see, you received an `HTTP 403 Forbidden` response.
+
+    Try sending another request, this time with a valid API key.
+
+    Congratulations - You have just created your first keyless API, then protected it using Tyk!
+
+{/* END OMIT */}
diff --git a/snippets/create-api-key-include.mdx b/snippets/create-api-key-include.mdx
new file mode 100644
index 0000000000..ecc9523304
--- /dev/null
+++ b/snippets/create-api-key-include.mdx
@@ -0,0 +1,104 @@
+---
+---
+
+#### Create an API Key with the Dashboard
+
+The Tyk Dashboard is the simplest way to generate a new Key.
+
+We have a video walkthrough for creating an API Key.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/sydrO2qv88Y" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+
+1. **Select "Keys" from the "System Management" section**
+
+    <img src="/img/2.10/keys_menu.png" alt="Keys menu" />
+
+2. **Click CREATE**
+
+    <img src="/img/2.10/add_key.png" alt="Add key" />
+
+3. **Add a Policy or API to your Key**
+
+    You have the option to add your new key to either an existing Policy or an existing individual API. For this Tutorial we are going to use an API. 
+
+    **Add an API to your Key**
+
+    To select an API, you can either:
+
+    * Scroll through your API Name list
+    * Use the Search field
+    * You can also Group by Authentication Type to filter your APIs
+    * You can also Group by Category 
+
+    You can leave all other options at their default settings.
+
+4. **Add Configuration Details**
+
+    You use the Configuration section to set the following:
+
+    1. Enable Detailed Logging. This is disabled by default and isn't required for this tutorial
+    2. Give your Key an Alias. This makes your key easier 
+    3. Set an Expiry time after which the key will expire. Select a value from the drop-down list. This is a required setting. See [Key Expiry](/api-management/access-control/sessions-and-keys/session-lifecycle) for more details.
+    4. Add Tags to your policy. Any tags you add can be used when filtering Analytics Data. Tags are case sensitive.
+    5. Add Metadata to your policy. Adding metadata such as User IDs can be used by middleware components. See [Session Metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context) for more details.
+
+4. **Click CREATE**
+
+    <img src="/img/2.10/create_key.png" alt="Create button" />
+
+    A **Key successfully generated** pop-up will be displayed with the key shown. You **must** save this somewhere for future reference as it will not be displayed again. Click **Copy to clipboard** and paste into a text document.
+
+    <img src="/img/2.10/key_success.png" alt="Key success message location" />
+
+    That's it, you've created a key - now you can try and use it.
+
+#### Create an API Key with the API
+
+To create an API key, you will need the API ID that we wish to grant the key access to. Creating the token is then an API call to the endpoint.
+
+You will also need your own API Key, to get these values:
+
+1.  Select **Users** from the **System Management** section.
+2.  In the users list, click **Edit** for your user.
+3.  The API key is the **Tyk Dashboard API Access Credentials**, copy this somewhere you can reference it. <img src="/img/2.10/user_api_id.png" alt="API key location" />
+4.  Select **APIs** from the **System Management** section.
+5.  From the **Actions** menu for your API, select Copy API ID 
+
+    <img src="/img/2.10/api_id.png" alt="API ID location" />
+
+    Once you have these values, you can use them to access the Dashboard API, the below `curl` command will generate a key for one of your APIs:
+
+
+
+    <Note>
+    1. Replace the `authorization` header value with your Tyk Dashboard API Access Credentials
+      2. Replace the API ID (`ad5004d961a147d4649fd3216694ebe2`) with your API ID
+      3. It's recommended to validate the JSON using JSON validator to avoid any `malformed input` error
+    </Note>
+
+
+```{.copyWrapper}
+curl -X POST -H "authorization: 1238b7e0e2ff4c2957321724409ee2eb" \
+  -s \
+  -H "Content-Type: application/json" \
+  -X POST \
+  -d '{
+    "allowance": 1000,
+    "rate": 1000,
+    "per": 1,
+    "expires": -1,
+    "quota_max": -1,
+    "quota_renews": 1449051461,
+    "quota_remaining": -1,
+    "quota_renewal_rate": 60,
+    "access_rights": {
+      "ad5004d961a147d4649fd3216694ebe2": {
+        "api_id": "ad5004d961a147d4649fd3216694ebe2",
+        "api_name": "test-api",
+        "versions": ["Default"]
+      }
+    },
+    "meta_data": {}
+  }' https://admin.cloud.tyk.io/api/keys | python -mjson.tool
+```
diff --git a/snippets/create-portal-entry-include.mdx b/snippets/create-portal-entry-include.mdx
new file mode 100644
index 0000000000..3e8079656a
--- /dev/null
+++ b/snippets/create-portal-entry-include.mdx
@@ -0,0 +1,102 @@
+---
+---
+
+## Tutorial: Add an API and Swagger based Docs to a Portal Catalog
+
+You can use the Tyk Dashboard to create a portal that allows developers to access the APIs you create.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/cywF9Dvg6lI" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+
+### Prerequisites for a portal catalog entry:
+
+- An API configured and live on your Tyk Gateway
+- The API must be **Closed** (i.e. it must use either Auth Token or Basic Auth security mechanisms)
+- A security policy configured to grant access to the API
+
+
+
+
+    <Note>
+    If you intend to use the developer portal, you need to configure it with a different hostname to your dashboard. The developer portal cannot be accessed via an IP address.
+    </Note>
+
+
+
+<Warning>
+Without these prerequisites, you may get a 404 error when trying to access the portal.
+</Warning>
+
+
+
+### Step 1: Select "Catalog" from the "Portal Management" section
+
+<img src="/img/2.10/catalogue_menu.png" alt="Catalogue menu" />
+
+### Step 2: Click ADD NEW API
+
+This page displays all of the catalog entries you have defined, whether they have documentation attached and whether they are active on the portal or not. Click **ADD NEW API**.
+
+<img src="/img/2.10/add_catalogue_entry.png" alt="Add new API button" />
+
+## Add API Details
+
+### Step 3: Show the API
+
+By default your entry will be published automatically to your Portal Catalog. Deselect this option to not publish it.
+
+### Step 4: Set a Public API Name and associate a security policy
+
+When publishing an API with Tyk, you are not publishing a single API, but instead you are publishing access to a group of APIs. The reason for this is to ensure that it is possible to compose and bundle APIs that are managed into APIs that are published. Tyk treats these as separate, so the thing that is published on the portal is not the same as the actual API being managed by Tyk, one is a logical managed API and the other (the published catalog version) is a facade.
+
+Since API policies allow the bundling of access control lists of multiple APIs, it is actually this that you are granting access to. Any developer that signs up for this API, will be granted a bearer token that has this policy as a baseline template, or as a "plan".
+
+<img src="/img/2.10/public_name_catalogue.png" alt="Portal name and security policy" />
+
+Please note:
+
+1.  You will only see security policies for valid APIs in the **Public API Name** drop-down list for the policies
+2.  The **Available policies** selected must be "closed" (see Prerequisites)
+
+### Step 5: Add a description
+
+All catalog entries can have a description. You can use Markdown formatting in these fields:
+
+<img src="/img/2.10/catalogue_description.png" alt="Description" />
+
+You can also add an email address if you require notification that an API subscription has been submitted or granted. We'll leave that blank for this tutorial. The same goes for Custom Fields. See [Custom Portal](/tyk-developer-portal/tyk-portal-classic/customise/custom-developer-portal#updating-a-developer-example-adding-custom-fields) for an example of a Custom Field implementation.
+
+
+### Step 6: Attach Documentation
+
+You can add import documentation in the following formats:
+
+- From a Swagger JSON file (OpenAPI 2.0 and 3.0 are supported)
+- From a Swagger URL
+- From API Blueprint
+
+
+
+    <Note>
+    Support for API Blueprint is being deprecated. See [Importing APIs](/api-management/gateway-config-managing-classic#api-blueprint-is-being-deprecated) for more details.
+    </Note>
+
+
+You can add your documentation before or after saving your API.
+
+### Settings Options
+
+We are not going to do anything with these options for this tutorial. For more information:
+
+* See [OAuth Clients](/tyk-developer-portal/tyk-portal-classic/portal-oauth-clients) for details of using OAuth with your catalog entry.
+* See [Portal Customization](/tyk-developer-portal/customise)for details about redirection of key requests and developer signup customization.
+
+### Step 6: Save the API
+
+To save the API, click **SAVE**.
+
+### Step 7: Take a look
+
+You can now visit your portal to see the API catalog entry. Select **Open Your Portal** from the **Your Developer Portal** menu:
+
+<img src="/img/getting-started/portal_menu.png" alt="Portal nav menu location" />
diff --git a/snippets/create-security-policy-include.mdx b/snippets/create-security-policy-include.mdx
new file mode 100644
index 0000000000..3351ca24e6
--- /dev/null
+++ b/snippets/create-security-policy-include.mdx
@@ -0,0 +1,160 @@
+---
+---
+
+A [Policy](/api-management/policies) encapsulates several options that can be applied to a key. It acts as a template that can override individual sections of an API key (or identity) in Tyk.
+
+
+#### Create a Policy with the Dashboard
+
+We have a video walkthrough for creating a Policy with the Dashboard.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/y4xVUvUvFRE" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+
+To create a security policy with the Dashboard, follow these steps:
+
+1. **Select "Policies" from the "System Management" section**
+
+    <img src="/img/2.10/policies_menu.png" alt="Policies menu link location" />
+
+    Your current policies will be displayed
+
+    <img src="/img/2.10/policy_list.png" alt="Current Policies" />
+
+2. **Click ADD POLICY**
+
+    <img src="/img/2.10/add_policy.png" alt="Add policy button" />
+
+3. **Select an API to apply the policy Access Rights to**
+
+    <img src="/img/2.10/select_api_policy.png" alt="Policy name form" />
+
+    To select an API, you can either:
+
+    * Scroll through your API Name list
+    * Use the Search field
+    * You can also Group by Authentication Type to filter your APIs
+    * You can also Group by Category 
+
+    All policies require a descriptive name, this helps you to reference it later, and it will appear in drop-down options where you can attach policies to objects such as Keys or OAuth client IDs.
+
+4. **Setting Global Rate Limits and Quota**
+
+    <img src="/img/2.10/global_limits_policies.png" alt="Global Rates" />
+
+    These settings will be applied to all APIs that the policy is applied to. You can override these settings by turning **Set per API Rate Limits and Quota** on for the API you selected in Step 3. We will leave these settings at their default for this tutorial.
+
+    **Rate Limiting**
+
+    A rate limit is enforced on all keys, set the number of requests per second that a user of a key with this policy is allowed to use. See [Rate Limiting](/api-management/rate-limit#rate-limiting-layers) for more details. **Note: The Rate Limit set by a policy will override the limits applied to an individual key.**
+
+    **Throttling**
+
+    When hitting rate limits, you can set Tyk Gateway to automatically queue and auto-retry client requests. Throttling can be configured at a key or policy level. See [Request Throttling](/api-management/request-throttling) for more details.
+
+    **Usage Quotas**
+
+    Usage quotas limit the number of total requests a user is allowed to have over a longer period of time. So while a rate limit is a rolling window, a quota is an absolute maximum that a user is allowed to have over a week, a day or a month. See [Request Quotas](/api-management/request-quotas) for more details.
+
+    Usage quotas can only be a positive number, or -1 (unlimited). **Note: The Usage Quota set by a policy will override a quota applied to an individual key.**
+
+    **Policy Partitioning**
+
+    In some cases, the all-or-nothing approach of policies, where all the components of access control, quota and rate limit are set together isn’t ideal, and instead you may wish to have only one or two segments of a token managed at a policy level and other segments in another policy or on the key itself. We call this [Policy Partitioning](/api-management/access-control/policies/applying-policies#partitioned-policies).
+
+    ###### Path Based Permissions
+
+    You can also use a security policy to apply restrictions on a particular path and method. Granular path control allows you to define which methods and paths a key is allowed to access on a per API-version basis. See the [Granular Endpoint Access](/api-management/access-control/sessions-and-keys/access-rights#granular-endpoint-access) documentation for more details
+
+    <img src="/img/2.10/path_and_method.png" alt="Path and Method" />
+
+5. **Add Configuration Details**
+
+    You use the Configuration section to set the following:
+
+    1. Give your policy a name. This is a required setting
+    2. Set the policy state. You can set your policy to one of the following states:
+        * Active (the default)
+        * Draft
+        * Access Denied 
+    3. Set a time after which any Keys subscribed to your policy expire. Select a value from the drop-down list. This is a required setting. See [Session Lifecycle](/api-management/access-control/sessions-and-keys/session-lifecycle) for more details.
+    4. Add Tags to your policy. Any tags you add can be used when filtering Analytics Data. Tags are case sensitive.
+    5. Add Metadata to your policy. Adding metadata such as User IDs can be used by middleware components. See [Session Metadata](/api-management/access-control/sessions-and-keys/understanding-sessions#metadata-and-context) for more details.
+
+6. **Save the policy**
+
+    Click **CREATE** . Once the policy is saved, you will be able to use it when creating keys, OAuth clients and custom JWT tokens.
+
+#### Create a security policy with the API
+
+Security Policies can be created with a single call to the API. It is very similar to the token creation process. To generate a simple security policy using the Tyk Dashboard API you can use the following curl command:
+```{.copyWrapper}
+curl -X POST -H "authorization: {API-TOKEN}" \
+  -s \
+  -H "Content-Type: application/json" \
+  -X POST \
+  -d '{
+    "access_rights": {
+      "{API-ID}": {
+        "allowed_urls": [],
+        "api_id": "{API-ID}",
+        "api_name": "{API-NAME}",
+        "versions": [
+          "Default"
+        ]
+      }
+    },
+    "active": true,
+    "name": "POLICY NAME",
+    "rate": 100,
+    "per": 1,
+    "quota_max": 10000,
+    "quota_renewal_rate": 3600,
+    "state": "active",
+    "tags": ["Startup Users"]
+  }' https://admin.cloud.tyk.io/api/portal/policies | python -mjson.tool
+```
+
+You must replace:
+
+*   `{API-TOKEN}`: Your API Token for the Dashboard API.
+*   `{API-ID}`: The API ID you wish this policy to grant access to, there can be more than one of these entries.
+*   `{API-NAME}`: The name of the API that is being granted access to (this is not required, but helps when debugging or auditing).
+*   `POLICY NAME`: The name of this security policy.
+
+The important elements:
+
+*   `access_rights`: A list of objects representing which APIs that you have configured to grant access to.
+*   `rate` and `per`: The number of requests to allow per period.
+*   `quota_max`: The maximum number of allowed requests over a quota period.
+*   `quota_renewal_rate`: how often the quota resets, in seconds. In this case we have set it to renew every hour.
+*   `state`: New from **v3.0**, this can be used instead of `active` and `is_inactive`. You can use the following values:
+    *   `active` - all keys connected to the policy are active and new keys can be created
+    *   `draft` - all keys connected to the policy are active but new keys cannot be created
+    *   `deny` - all keys are deactivated and no keys can be created.
+
+
+
+    <Note>
+    Setting a `state` value will automatically override the `active` or `is_inactive` setting.
+    </Note>
+
+
+When you send this request, you should see the following reply with your Policy ID:
+```
+{
+  "Message": "577a8589428a6b0001000017",
+  "Meta": null,
+  "Status": "OK"
+}
+```
+
+You can then use this policy ID in the `apply_policy_id` field of an API token. Please see the relevant documentation on session objects for more information about how tokens are attached to policies.
+
+
+<Note>
+`apply_policy_id` is supported, but has now been deprecated. `apply_policies` is now used to list your policy IDs as an array. This supports the **Multiple Policy** feature introduced in the **v2.4/1.4** release.
+</Note>
+
+
+For more information on how Policies are constructed and applied to Sessions, please see the [Access Control](/api-management/access-control/overview) section.
diff --git a/snippets/dashboard-config.mdx b/snippets/dashboard-config.mdx
new file mode 100644
index 0000000000..6cc78f40c6
--- /dev/null
+++ b/snippets/dashboard-config.mdx
@@ -0,0 +1,1444 @@
+### listen_port
+ENV: <b>TYK_DB_LISTENPORT</b><br />
+Type: `int`<br />
+
+Setting this value will change the port that Tyk Dashboard listens on. Default: 3000.
+
+### tyk_api_config
+This section contains details for a Tyk Gateway node that the Tyk Dashboard can speak to. The Dashboard controls Tyk using the Gateway API and only requires visibility to one node, so long as all nodes are using the same API Definitions.
+
+<Note>
+
+If the Dashboard cannot see a Tyk node, key management functions will not work properly.
+</Note>
+In a sharded environment, the Gateway node specified in tyk_api_config must not be sharded.
+
+
+### tyk_api_config.Host
+ENV: <b>TYK_DB_TYKAPI_HOST</b><br />
+Type: `string`<br />
+
+This is the full URL of your Tyk node.
+
+### tyk_api_config.Port
+ENV: <b>TYK_DB_TYKAPI_PORT</b><br />
+Type: `string`<br />
+
+The port that Tyk is running on
+
+### tyk_api_config.Secret
+ENV: <b>TYK_DB_TYKAPI_SECRET</b><br />
+Type: `string`<br />
+
+The secret set in your tyk.conf file. This is the key that Tyk Dashboard will use to speak to the Tyk node’s Gateway API. Note that this value **has to match** the secret value in tyk.conf.
+
+### mongo_url
+ENV: <b>TYK_DB_MONGOURL</b><br />
+Type: `string`<br />
+
+The full URL to your MongoDB instance, this can be a clustered instance if necessary and should include the database and username / password data.
+
+### mongo_use_ssl
+ENV: <b>TYK_DB_MONGOUSESSL</b><br />
+Type: `bool`<br />
+
+Set to true to enable Mongo SSL connection
+
+### mongo_ssl_insecure_skip_verify
+ENV: <b>TYK_DB_MONGOSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Allows the use of self-signed certificates when connecting to an encrypted MongoDB database.
+
+### mongo_ssl_allow_invalid_hostnames
+ENV: <b>TYK_DB_MONGOSSLALLOWINVALIDHOSTNAMES</b><br />
+Type: `bool`<br />
+
+Ignore hostname check when it differs from the original (for example with SSH tunneling). The rest of the TLS verification will still be performed.
+
+### mongo_ssl_ca_file
+ENV: <b>TYK_DB_MONGOSSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file with trusted root certificates
+
+### mongo_ssl_pem_keyfile
+ENV: <b>TYK_DB_MONGOSSLPEMKEYFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file which contains both client certificate and private key. This is required for Mutual TLS.
+
+### mongo_session_consistency
+ENV: <b>TYK_DB_MONGOSESSIONCONSISTENCY</b><br />
+Type: `string`<br />
+
+Mongo session constency: “strong”, “eventual”, or “monotonic”. default is “strong”
+
+### mongo_batch_size
+ENV: <b>TYK_DB_MONGOBATCHSIZE</b><br />
+Type: `int`<br />
+
+Sets the batch size for mongo results. Defaults to 2000.
+Increasing this number can decrease dashboard performance. This value cannot be lower than 100 and will fallback to 100 if a lower value has been set.
+
+### mongo_driver
+ENV: <b>TYK_DB_MONGODRIVER</b><br />
+Type: `string`<br />
+
+Determines the MongoDB driver used. It could be `mongo-go` to use the official [mongo driver for go v1.12](https://www.mongodb.com/docs/drivers/go/v1.12/) or `mgo` to use [mgo driver](https://github.com/go-mgo/mgo). Since v5.3, the default value is `mongo-go`. It can be set at storage level as well if the database type is mongo. This config is available since dashboard v5.0.2.
+
+### mongo_direct_connection
+ENV: <b>TYK_DB_MONGODIRECTCONNECTION</b><br />
+Type: `bool`<br />
+
+MongoDirectConnection informs whether to establish connections only with the specified seed servers,
+or to obtain information for the whole cluster and establish connections with further servers too.
+If true, the client will only connect to the host provided in the ConnectionString
+and won't attempt to discover other hosts in the cluster. Useful when network restrictions
+prevent discovery, such as with SSH tunneling. Default is false.
+
+### page_size
+ENV: <b>TYK_DB_PAGESIZE</b><br />
+Type: `int`<br />
+
+The page size that the dashboard should use. Defaults to 10.
+
+### storage
+This option allows you to store different types of data in different databases. For example, logs can be stored in one database, analytics in another, and main resources in another.
+
+### storage.main
+Main database where the dashboard resources are stored (users, orgs, policies, etc)
+
+### storage.main.type
+ENV: <b>TYK_DB_STORAGE_MAIN_TYPE</b><br />
+Type: `DBType`<br />
+
+Type is the type of the database.
+Possible values are:
+  - "mongo": Use MongoDB.
+  - "postgres": Use PostgreSQL.
+  - "mysql": Use MySQL.
+
+### storage.main.connection_string
+ENV: <b>TYK_DB_STORAGE_MAIN_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+ConnectionString is the connection string for the database.
+Overrides ReadConnectionString and WriteConnectionString.
+
+### storage.main.read_connection_string
+ENV: <b>TYK_DB_STORAGE_MAIN_READCONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+ReadConnectionString is the connection string for read operations.
+Only used if ConnectionString is not set.
+
+### storage.main.write_connection_string
+ENV: <b>TYK_DB_STORAGE_MAIN_WRITECONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+WriteConnectionString is the connection string for write operations.
+Only used if ConnectionString is not set.
+
+### storage.main.mongo
+Connection setting for a mongo database
+
+### storage.main.mongo.driver
+ENV: <b>TYK_DB_STORAGE_MAIN_MONGO_DRIVER</b><br />
+Type: `string`<br />
+
+Driver to use when connected to a mongo database. It could be `mongo-go` to use the official [mongo driver for go v1.12](https://www.mongodb.com/docs/drivers/go/v1.12/) or `mgo` to use [mgo driver](https://github.com/go-mgo/mgo). Since v5.3, the default value is `mongo-go`. This config is available since dashboard v5.0.2
+
+### storage.main.postgres
+Connection settings for a Postgres database
+
+### storage.main.postgres.prefer_simple_protocol
+ENV: <b>TYK_DB_STORAGE_MAIN_POSTGRES_PREFERSIMPLEPROTOCOL</b><br />
+Type: `bool`<br />
+
+disables implicit prepared statement usage
+
+### storage.main.mysql
+Connection settings for a MySQL database
+
+### storage.main.mysql.default_string_size
+ENV: <b>TYK_DB_STORAGE_MAIN_MYSQL_DEFAULTSTRINGSIZE</b><br />
+Type: `uint`<br />
+
+default size for string fields. By default set to: 256
+
+### storage.main.mysql.disable_datetime_precision
+ENV: <b>TYK_DB_STORAGE_MAIN_MYSQL_DISABLEDATETIMEPRECISION</b><br />
+Type: `bool`<br />
+
+disable datetime precision, which not supported before MySQL 5.6
+
+### storage.main.mysql.dont_support_rename_index
+ENV: <b>TYK_DB_STORAGE_MAIN_MYSQL_DONTSUPPORTRENAMEINDEX</b><br />
+Type: `bool`<br />
+
+drop & create when rename index, rename index not supported before MySQL 5.7, MariaDB
+
+### storage.main.mysql.dont_support_rename_column
+ENV: <b>TYK_DB_STORAGE_MAIN_MYSQL_DONTSUPPORTRENAMECOLUMN</b><br />
+Type: `bool`<br />
+
+`change` when rename column, rename column not supported before MySQL 8, MariaDB
+
+### storage.main.mysql.skip_initialize_with_version
+ENV: <b>TYK_DB_STORAGE_MAIN_MYSQL_SKIPINITIALIZEWITHVERSION</b><br />
+Type: `bool`<br />
+
+auto configure based on currently MySQL version
+
+### storage.main.table_sharding
+ENV: <b>TYK_DB_STORAGE_MAIN_TABLESHARDING</b><br />
+Type: `bool`<br />
+
+Enable table sharding for the database
+
+### storage.analytics
+Where all the analytics related data is stored
+
+### storage.analytics.type
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_TYPE</b><br />
+Type: `DBType`<br />
+
+Type is the type of the database.
+Possible values are:
+  - "mongo": Use MongoDB.
+  - "postgres": Use PostgreSQL.
+  - "mysql": Use MySQL.
+
+### storage.analytics.connection_string
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+ConnectionString is the connection string for the database.
+Overrides ReadConnectionString and WriteConnectionString.
+
+### storage.analytics.read_connection_string
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_READCONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+ReadConnectionString is the connection string for read operations.
+Only used if ConnectionString is not set.
+
+### storage.analytics.write_connection_string
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_WRITECONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+WriteConnectionString is the connection string for write operations.
+Only used if ConnectionString is not set.
+
+### storage.analytics.mongo
+Connection setting for a mongo database
+
+### storage.analytics.mongo.driver
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_MONGO_DRIVER</b><br />
+Type: `string`<br />
+
+Driver to use when connected to a mongo database. It could be `mongo-go` to use the official [mongo driver for go v1.12](https://www.mongodb.com/docs/drivers/go/v1.12/) or `mgo` to use [mgo driver](https://github.com/go-mgo/mgo). Since v5.3, the default value is `mongo-go`. This config is available since dashboard v5.0.2
+
+### storage.analytics.postgres
+Connection settings for a Postgres database
+
+### storage.analytics.postgres.prefer_simple_protocol
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_POSTGRES_PREFERSIMPLEPROTOCOL</b><br />
+Type: `bool`<br />
+
+disables implicit prepared statement usage
+
+### storage.analytics.mysql
+Connection settings for a MySQL database
+
+### storage.analytics.mysql.default_string_size
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_MYSQL_DEFAULTSTRINGSIZE</b><br />
+Type: `uint`<br />
+
+default size for string fields. By default set to: 256
+
+### storage.analytics.mysql.disable_datetime_precision
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_MYSQL_DISABLEDATETIMEPRECISION</b><br />
+Type: `bool`<br />
+
+disable datetime precision, which not supported before MySQL 5.6
+
+### storage.analytics.mysql.dont_support_rename_index
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_MYSQL_DONTSUPPORTRENAMEINDEX</b><br />
+Type: `bool`<br />
+
+drop & create when rename index, rename index not supported before MySQL 5.7, MariaDB
+
+### storage.analytics.mysql.dont_support_rename_column
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_MYSQL_DONTSUPPORTRENAMECOLUMN</b><br />
+Type: `bool`<br />
+
+`change` when rename column, rename column not supported before MySQL 8, MariaDB
+
+### storage.analytics.mysql.skip_initialize_with_version
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_MYSQL_SKIPINITIALIZEWITHVERSION</b><br />
+Type: `bool`<br />
+
+auto configure based on currently MySQL version
+
+### storage.analytics.table_sharding
+ENV: <b>TYK_DB_STORAGE_ANALYTICS_TABLESHARDING</b><br />
+Type: `bool`<br />
+
+Enable table sharding for the database
+
+### storage.logs.type
+ENV: <b>TYK_DB_STORAGE_LOGS_TYPE</b><br />
+Type: `DBType`<br />
+
+Type is the type of the database.
+Possible values are:
+  - "mongo": Use MongoDB.
+  - "postgres": Use PostgreSQL.
+  - "mysql": Use MySQL.
+
+### storage.logs.connection_string
+ENV: <b>TYK_DB_STORAGE_LOGS_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+ConnectionString is the connection string for the database.
+Overrides ReadConnectionString and WriteConnectionString.
+
+### storage.logs.read_connection_string
+ENV: <b>TYK_DB_STORAGE_LOGS_READCONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+ReadConnectionString is the connection string for read operations.
+Only used if ConnectionString is not set.
+
+### storage.logs.write_connection_string
+ENV: <b>TYK_DB_STORAGE_LOGS_WRITECONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+WriteConnectionString is the connection string for write operations.
+Only used if ConnectionString is not set.
+
+### storage.logs.mongo
+Connection setting for a mongo database
+
+### storage.logs.mongo.driver
+ENV: <b>TYK_DB_STORAGE_LOGS_MONGO_DRIVER</b><br />
+Type: `string`<br />
+
+Driver to use when connected to a mongo database. It could be `mongo-go` to use the official [mongo driver for go v1.12](https://www.mongodb.com/docs/drivers/go/v1.12/) or `mgo` to use [mgo driver](https://github.com/go-mgo/mgo). Since v5.3, the default value is `mongo-go`. This config is available since dashboard v5.0.2
+
+### storage.logs.postgres
+Connection settings for a Postgres database
+
+### storage.logs.postgres.prefer_simple_protocol
+ENV: <b>TYK_DB_STORAGE_LOGS_POSTGRES_PREFERSIMPLEPROTOCOL</b><br />
+Type: `bool`<br />
+
+disables implicit prepared statement usage
+
+### storage.logs.mysql
+Connection settings for a MySQL database
+
+### storage.logs.mysql.default_string_size
+ENV: <b>TYK_DB_STORAGE_LOGS_MYSQL_DEFAULTSTRINGSIZE</b><br />
+Type: `uint`<br />
+
+default size for string fields. By default set to: 256
+
+### storage.logs.mysql.disable_datetime_precision
+ENV: <b>TYK_DB_STORAGE_LOGS_MYSQL_DISABLEDATETIMEPRECISION</b><br />
+Type: `bool`<br />
+
+disable datetime precision, which not supported before MySQL 5.6
+
+### storage.logs.mysql.dont_support_rename_index
+ENV: <b>TYK_DB_STORAGE_LOGS_MYSQL_DONTSUPPORTRENAMEINDEX</b><br />
+Type: `bool`<br />
+
+drop & create when rename index, rename index not supported before MySQL 5.7, MariaDB
+
+### storage.logs.mysql.dont_support_rename_column
+ENV: <b>TYK_DB_STORAGE_LOGS_MYSQL_DONTSUPPORTRENAMECOLUMN</b><br />
+Type: `bool`<br />
+
+`change` when rename column, rename column not supported before MySQL 8, MariaDB
+
+### storage.logs.mysql.skip_initialize_with_version
+ENV: <b>TYK_DB_STORAGE_LOGS_MYSQL_SKIPINITIALIZEWITHVERSION</b><br />
+Type: `bool`<br />
+
+auto configure based on currently MySQL version
+
+### storage.logs.table_sharding
+ENV: <b>TYK_DB_STORAGE_LOGS_TABLESHARDING</b><br />
+Type: `bool`<br />
+
+Enable table sharding for the database
+
+### storage.uptime
+Where all the uptime related data is stored
+
+### storage.uptime.type
+ENV: <b>TYK_DB_STORAGE_UPTIME_TYPE</b><br />
+Type: `DBType`<br />
+
+Type is the type of the database.
+Possible values are:
+  - "mongo": Use MongoDB.
+  - "postgres": Use PostgreSQL.
+  - "mysql": Use MySQL.
+
+### storage.uptime.connection_string
+ENV: <b>TYK_DB_STORAGE_UPTIME_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+ConnectionString is the connection string for the database.
+Overrides ReadConnectionString and WriteConnectionString.
+
+### storage.uptime.read_connection_string
+ENV: <b>TYK_DB_STORAGE_UPTIME_READCONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+ReadConnectionString is the connection string for read operations.
+Only used if ConnectionString is not set.
+
+### storage.uptime.write_connection_string
+ENV: <b>TYK_DB_STORAGE_UPTIME_WRITECONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+WriteConnectionString is the connection string for write operations.
+Only used if ConnectionString is not set.
+
+### storage.uptime.mongo
+Connection setting for a mongo database
+
+### storage.uptime.mongo.driver
+ENV: <b>TYK_DB_STORAGE_UPTIME_MONGO_DRIVER</b><br />
+Type: `string`<br />
+
+Driver to use when connected to a mongo database. It could be `mongo-go` to use the official [mongo driver for go v1.12](https://www.mongodb.com/docs/drivers/go/v1.12/) or `mgo` to use [mgo driver](https://github.com/go-mgo/mgo). Since v5.3, the default value is `mongo-go`. This config is available since dashboard v5.0.2
+
+### storage.uptime.postgres
+Connection settings for a Postgres database
+
+### storage.uptime.postgres.prefer_simple_protocol
+ENV: <b>TYK_DB_STORAGE_UPTIME_POSTGRES_PREFERSIMPLEPROTOCOL</b><br />
+Type: `bool`<br />
+
+disables implicit prepared statement usage
+
+### storage.uptime.mysql
+Connection settings for a MySQL database
+
+### storage.uptime.mysql.default_string_size
+ENV: <b>TYK_DB_STORAGE_UPTIME_MYSQL_DEFAULTSTRINGSIZE</b><br />
+Type: `uint`<br />
+
+default size for string fields. By default set to: 256
+
+### storage.uptime.mysql.disable_datetime_precision
+ENV: <b>TYK_DB_STORAGE_UPTIME_MYSQL_DISABLEDATETIMEPRECISION</b><br />
+Type: `bool`<br />
+
+disable datetime precision, which not supported before MySQL 5.6
+
+### storage.uptime.mysql.dont_support_rename_index
+ENV: <b>TYK_DB_STORAGE_UPTIME_MYSQL_DONTSUPPORTRENAMEINDEX</b><br />
+Type: `bool`<br />
+
+drop & create when rename index, rename index not supported before MySQL 5.7, MariaDB
+
+### storage.uptime.mysql.dont_support_rename_column
+ENV: <b>TYK_DB_STORAGE_UPTIME_MYSQL_DONTSUPPORTRENAMECOLUMN</b><br />
+Type: `bool`<br />
+
+`change` when rename column, rename column not supported before MySQL 8, MariaDB
+
+### storage.uptime.mysql.skip_initialize_with_version
+ENV: <b>TYK_DB_STORAGE_UPTIME_MYSQL_SKIPINITIALIZEWITHVERSION</b><br />
+Type: `bool`<br />
+
+auto configure based on currently MySQL version
+
+### storage.uptime.table_sharding
+ENV: <b>TYK_DB_STORAGE_UPTIME_TABLESHARDING</b><br />
+Type: `bool`<br />
+
+Enable table sharding for the database
+
+### admin_secret
+ENV: <b>TYK_DB_ADMINSECRET</b><br />
+Type: `string`<br />
+
+This secret is to be used by a special set of endpoints that we call “Admin APIs”. This API is part of the super-admin context and therefore has a separate endpoint prefix `/admin`. It also requires a special auth header called admin-auth. This purpose of these endpoints is to allow functionality that regular Dashboard users should not have, such as create new organizations, create super users etc. See the [Admin API](https://tyk.io/docs/dashboard-admin-api/) for more information on these endpoints.
+
+### shared_node_secret
+ENV: <b>TYK_DB_NODESECRET</b><br />
+Type: `string`<br />
+
+This value should match with the node_secret Gateway configuration option value.
+Each node communicates with the Dashboard via a shared secret (this setting) and a nonce to ensure that out-of-band requests cannot be made. Nodes will send a heartbeat every few seconds to notify the Dashboard that they are running.
+
+### redis_port
+ENV: <b>TYK_DB_REDISPORT</b><br />
+Type: `int`<br />
+
+The port that your Redis installation listens on.
+
+<Note>
+
+The Tyk Dashboard uses Redis to store its session data and to communicate with your Tyk Gateway nodes occasionally. The Redis details used by the dashboard must be the same as those set for your Tyk installation.
+</Note>
+
+### redis_host
+ENV: <b>TYK_DB_REDISHOST</b><br />
+Type: `string`<br />
+
+The hostname for the Redis collection and can be an IP address.
+
+### redis_addrs
+ENV: <b>TYK_DB_REDISADDRS</b><br />
+Type: `[]string`<br />
+
+Used for configuring Redis clusters. See [Redis Cluster and Tyk Dashboard](https://tyk.io/docs/tyk-open-source/#redis-cluster-and-tyk-dashboard) for more info. Example:
+```
+   "addrs": [
+     "server1:6379",
+     "server2:6380",
+     "server3:6381"
+   ],
+```
+
+### redis_hosts
+ENV: <b>TYK_DB_HOSTS</b><br />
+Type: `map[string]string`<br />
+
+**DEPRECATED**. Use `redis_addrs` instead. You can also specify multiple Redis hosts here. Tyk will use this array if it is not empty, or it will use the individual legacy parameters above. You can specify multiple host:port combinations here.
+
+### redis_username
+ENV: <b>TYK_DB_REDISUSERNAME</b><br />
+Type: `string`<br />
+
+If you are using Redis AUTH using its `requirepass` setting, enter your username here (recommended). If this is not used, the Dashboard will not attempt to login to Redis.
+
+### redis_password
+ENV: <b>TYK_DB_REDISPASSWORD</b><br />
+Type: `string`<br />
+
+The password for your Redis Auth username.
+
+### redis_master_name
+ENV: <b>TYK_DB_REDISMASTERNAME</b><br />
+Type: `string`<br />
+
+Redis Sentinel Master name
+
+### redis_sentinel_password
+ENV: <b>TYK_DB_REDISSENTINELPASSWORD</b><br />
+Type: `string`<br />
+
+Redis Sentinel password
+
+### redis_timeout
+ENV: <b>TYK_DB_REDISTIMEOUT</b><br />
+Type: `int`<br />
+
+Set a custom Redis network timeout. Default value is 5 seconds.
+
+### redis_database
+ENV: <b>TYK_DB_REDISDATABASE</b><br />
+Type: `int`<br />
+
+Set this to the index of your Redis database if you are using more than one.
+
+### enable_cluster
+ENV: <b>TYK_DB_ENABLECLUSTER</b><br />
+Type: `bool`<br />
+
+Set this to true if you are using a Redis cluster.
+
+### redis_use_ssl
+ENV: <b>TYK_DB_REDISUSESSL</b><br />
+Type: `bool`<br />
+
+Use Redis SSL connection
+
+### redis_ssl_insecure_skip_verify
+ENV: <b>TYK_DB_REDISSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Ignore TLS verification for Redis connections.
+
+### redis_ca_file
+ENV: <b>TYK_DB_REDISCAFILE</b><br />
+Type: `string`<br />
+
+Redis SSL CA File
+
+The SSL CA file is imported into an X509 certificate pool. It
+contains the set of root certificate authorities. When establishing
+a connection to redis, Tyk will use this to verify server certificates.
+
+If empty, Tyk will use the host's root CA set.
+
+### redis_cert_file
+ENV: <b>TYK_DB_REDISCERTFILE</b><br />
+Type: `string`<br />
+
+Redis SSL Cert file.
+
+The cert file and the key file combine to form an X509 certificate.
+The certificate is presented when establishing a connection to redis.
+
+For more information, see [crypto/tls#X509KeyPair](https://pkg.go.dev/crypto/tls#X509KeyPair).
+
+### redis_key_file
+ENV: <b>TYK_DB_REDISKEYFILE</b><br />
+Type: `string`<br />
+
+Redis SSL Key file.
+
+The cert file and the key file combine to form an X509 certificate.
+The certificate is presented when establishing a connection to redis.
+
+For more information, see [crypto/tls#X509KeyPair](https://pkg.go.dev/crypto/tls#X509KeyPair).
+
+### redis_tls_max_version
+ENV: <b>TYK_DB_REDISTLSMAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum TLS version that is supported.
+
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.3".
+
+### redis_tls_min_version
+ENV: <b>TYK_DB_REDISTLSMINVERSION</b><br />
+Type: `string`<br />
+
+Minimum TLS version that is supported.
+
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.2".
+
+### redis_max_active
+ENV: <b>TYK_DB_REDISMAXACTIVE</b><br />
+Type: `int`<br />
+
+Set the number of maximum connections in the Redis connection pool, which defaults to 500. Set to a higher value if you are expecting more traffic.
+
+### force_api_defaults
+ENV: <b>TYK_DB_FORCEAPIDEFAULTS</b><br />
+Type: `bool`<br />
+
+If set to true, this forces the [listenPath.strip](/api-management/gateway-config-tyk-oas#listenpath) setting to true for all APIs created or updated through the Tyk Dashboard API or UI.
+
+The default value is `false`
+
+### notify_on_change
+ENV: <b>TYK_DB_NOTIFYONCHANGE</b><br />
+Type: `bool`<br />
+
+Licensed users can use this setting to enable/disable whether the Tyk Dashboard will notify all Tyk Gateway nodes to hot-reload when an API definition is changed.
+
+### license_key
+ENV: <b>TYK_DB_LICENSEKEY</b><br />
+Type: `string`<br />
+
+Your Tyk Dashboard license key
+
+### hash_keys
+ENV: <b>TYK_DB_HASHKEYS</b><br />
+Type: `bool`<br />
+
+If your Tyk Gateway is using hashed keys, set this value to true so it matches. The Dashboard will now operate in a mode that is compatible with key hashing.
+
+### disable_key_actions_by_username
+ENV: <b>TYK_DB_DISABLEKEYACTIONSBYUSERNAME</b><br />
+Type: `bool`<br />
+
+DisableKeyActionsByUsername disables basic auth key operation by username.
+When this is set to `true` you are able to search for keys only by keyID or key hash (if `hash_keys` is also set to `true`)
+Note that if `hash_keys` is also set to `true` then the keyID will not be provided for APIs secured using basic auth. In this scenario the only search option would be to use key hash
+You must configure this setting with the same value in both Gateway and Dashboard
+
+### enable_delete_key_by_hash
+ENV: <b>TYK_DB_ENABLEDELETEKEYBYHASH</b><br />
+Type: `bool`<br />
+
+To delete a key by its hash, set this option to true
+
+### enable_update_key_by_hash
+ENV: <b>TYK_DB_ENABLEUPDATEKEYBYHASH</b><br />
+Type: `bool`<br />
+
+To update a key by its hash, set this option to true.
+
+### enable_hashed_keys_listing
+ENV: <b>TYK_DB_ENABLEHASHEDKEYSLISTING</b><br />
+Type: `bool`<br />
+
+To retrieve a list of all key hash listings, set this option to true.
+
+### email_backend
+Tyk supports an interface-based email back-end system. We support `mandrill`, `sendgrid`, `amazonses` and `mailgun`. See [Outbound Email Configuration](https://tyk.io/docs/configure/outbound-email-configuration/) for more details on configuring these different providers.
+
+### email_backend.enable_email_notifications
+ENV: <b>TYK_DB_EMAILBACKEND_ENABLEEMAILNOTIFICATIONS</b><br />
+Type: `bool`<br />
+
+Set to `true` to have Tyk send emails for things such as key approvals and portal sign ups.
+
+### email_backend.code
+ENV: <b>TYK_DB_EMAILBACKEND_CODE</b><br />
+Type: `string`<br />
+
+The code of the back-end to use, `mandrill`, `sendgrid`, `amazonses` and `mailgun` are supported.
+
+### email_backend.settings
+ENV: <b>TYK_DB_EMAILBACKEND_SETTINGS</b><br />
+Type: `map[string]string`<br />
+
+The custom settings sections for the back end system.
+
+### email_backend.default_from_email
+ENV: <b>TYK_DB_EMAILBACKEND_DEFAULTFROMEMAIL</b><br />
+Type: `string`<br />
+
+The address to send email from.
+
+### email_backend.default_from_name
+ENV: <b>TYK_DB_EMAILBACKEND_DEFAULTFROMNAME</b><br />
+Type: `string`<br />
+
+The name to use when sending emails.
+
+### email_backend.dashboard_hostname
+ENV: <b>TYK_DB_EMAILBACKEND_DASHBOARDHOSTNAME</b><br />
+Type: `string`<br />
+
+Your public dashboard hostname.
+
+### hide_listen_path
+ENV: <b>TYK_DB_HIDELISTENPATH</b><br />
+Type: `bool`<br />
+
+If you set this option to `true`, then the listen path will not be editable or visible in the Dashboard.
+
+### use_sentry
+ENV: <b>TYK_DB_USESENTRY</b><br />
+Type: `bool`<br />
+
+The Tyk Dashboard has Sentry integration to externalise logging. Set this to true to enable the logger.
+
+### sentry_code
+ENV: <b>TYK_DB_SENTRYCODE</b><br />
+Type: `string`<br />
+
+If you have a Sentry setup, or are using Getsentry, you can add the Sentry DSN here and Tyk will begin sending events.
+
+### sentry_js_code
+ENV: <b>TYK_DB_SENTRYJSCODE</b><br />
+Type: `string`<br />
+
+To have the Dashboard report Javascript errors to you, add a separate DSN here.
+
+### enable_master_keys
+ENV: <b>TYK_DB_ENABLEMASTERKEYS</b><br />
+Type: `bool`<br />
+
+If this is set to true, session objects (key definitions) that do not have explicit access rights set will be allowed by Tyk. This means that keys that are created have access to ALL APIs, which in many cases is unwanted behavior unless you are sure about what you are doing. To use this setting also requires the corresponding Gateway configuration setting `allow_master_keys` to be set to `true`.
+
+### enable_duplicate_slugs
+ENV: <b>TYK_DB_ENABLEDUPLICATESLUGS</b><br />
+Type: `bool`<br />
+
+Setting this option to `true` will cause the dashboard to not validate against other listen paths.
+
+### show_org_id
+ENV: <b>TYK_DB_SHOWORGID</b><br />
+Type: `bool`<br />
+
+Determines whether the Org ID will be shown in the Users -> Username detail page. This can be useful for quickly identifying your Org ID.
+
+### host_config
+Section to manage dashboard host names and domains
+
+### host_config.enable_host_names
+ENV: <b>TYK_DB_HOSTCONFIG_ENABLEHOSTNAMES</b><br />
+Type: `bool`<br />
+
+The Tyk Dashboard can bind the Dashboard application to a specific domain name. Enable this option to have the Dashboard only allow access on a specific domain and 404 on any other host access (not recommended).
+
+### host_config.disable_org_slug_prefix
+ENV: <b>TYK_DB_HOSTCONFIG_DISABLEORGSLUGPREFIX</b><br />
+Type: `bool`<br />
+
+By default, for developer portal, Tyk will add orgID prefix. Set to `true` if you have single tenant application or each portal on separate domain.
+
+### host_config.hostname
+ENV: <b>TYK_DB_HOSTCONFIG_HOSTNAME</b><br />
+Type: `string`<br />
+
+The hostname to bind the Dashboard to. This must be a proper hostname and not localhost.
+
+### host_config.override_hostname
+ENV: <b>TYK_DB_HOSTCONFIG_GATEWAYHOSTNAME</b><br />
+Type: `string`<br />
+
+Set this value to whatever hostname your **Tyk Gateway** is running on.
+
+### host_config.portal_domains
+ENV: <b>TYK_DB_HOSTCONFIG_PORTALDOMAINS</b><br />
+Type: `map[string]string`<br />
+
+It is possible to hard-code portal domains (these override settings set by the Dashboard for routing purposes).
+
+Example:
+```
+"portal_domains": {
+.  "portal.com": "<orgID>"
+}
+```
+
+### host_config.portal_root_path
+ENV: <b>TYK_DB_HOSTCONFIG_PORTALROOTPATH</b><br />
+Type: `string`<br />
+
+The root path for the portal.
+
+### host_config.generate_secure_paths
+ENV: <b>TYK_DB_HOSTCONFIG_GENERATEHTTPS</b><br />
+Type: `bool`<br />
+
+If you prefer to have your URLs start with https, set this option to true.
+
+### host_config.secure_cookies
+ENV: <b>TYK_DB_HOSTCONFIG_SECURECOOKIES</b><br />
+Type: `bool`<br />
+
+This enables HTTPS “secure” cookies.
+
+### http_server_options
+This section is reserved for settings relating to the HTTP server that powers the Dashboard.
+
+### http_server_options.use_ssl
+ENV: <b>TYK_DB_HTTPSERVEROPTIONS_USESSL</b><br />
+Type: `bool`<br />
+
+Enable to use SSL.
+
+### http_server_options.certificates
+ENV: <b>TYK_DB_HTTPSERVEROPTIONS_CERTIFICATES</b><br />
+Type: `CertsData`<br />
+
+Add a certificate block for each domain being covered by the application.
+
+For example:
+
+```
+{
+  "domain_name": "*.banana.com",
+  "cert_file": "new.cert.cert",
+  "key_file": "new.cert.key"
+}
+```
+
+### http_server_options.ssl_certificates
+ENV: <b>TYK_DB_HTTPSERVEROPTIONS_SSLCERTIFICATES</b><br />
+Type: `[]string`<br />
+
+SSL certificates used by your Gateway server. A list of certificate path to files.
+
+### http_server_options.min_version
+ENV: <b>TYK_DB_HTTPSERVEROPTIONS_MINVERSION</b><br />
+Type: `uint16`<br />
+
+Minimum TLS version is inherited from Go library, but can be overridden here.
+For details see: https://tyk.io/docs/api-management/implement-tls#controlling-tls-version-&-cipher-suites
+
+### http_server_options.ssl_ciphers
+ENV: <b>TYK_DB_HTTPSERVEROPTIONS_CIPHERSUITES</b><br />
+Type: `[]string`<br />
+
+Array of allowed cipher suites as defined at https://golang.org/pkg/crypto/tls/#pkg-constants
+
+### http_server_options.ssl_insecure_skip_verify
+ENV: <b>TYK_DB_HTTPSERVEROPTIONS_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Disable TLS verifiation
+
+### http_server_options.prefer_server_ciphers
+ENV: <b>TYK_DB_HTTPSERVEROPTIONS_PREFERSERVERCIPHERSUITES</b><br />
+Type: `bool`<br />
+
+PreferServerCipherSuites is a legacy field and has no effect.
+
+More info: https://github.com/golang/go/issues/45430.
+
+Deprecated: PreferServerCipherSuites is ignored.
+
+### security
+This section controls login limits for both the Dashboard and the Developer Portal. The path for you audit log is also set here.
+
+### security.allow_admin_reset_password
+ENV: <b>TYK_DB_SECURITY_ALLOWADMINRESETPASSWORD</b><br />
+Type: `bool`<br />
+
+This allows an admin user to reset the password of other users. The default is false.
+
+### security.login_failure_username_limit
+ENV: <b>TYK_DB_SECURITY_LOGINFAILUREUSERNAMELIMIT</b><br />
+Type: `int`<br />
+
+Controls how many time a user can attempt to log in before being denied access. The default is 0.
+
+### security.login_failure_ip_limit
+ENV: <b>TYK_DB_SECURITY_LOGINFAILUREIPLIMIT</b><br />
+Type: `int`<br />
+
+Controls how many times an IP Address can be used to attempt to log in before being denied access. The default is 0.
+
+### security.login_failure_expiration
+ENV: <b>TYK_DB_SECURITY_LOGINFAILUREEXPIRATION</b><br />
+Type: `int`<br />
+
+Controls how long before the failure limits are reset in seconds. The default is 900 seconds.
+
+### security.hide_login_failure_limit_error
+ENV: <b>TYK_DB_SECURITY_HIDELOGINFAILURELIMITERROR</b><br />
+Type: `bool`<br />
+
+By default it will show message like "Retry in N seconds.". In some secure environments it can be treated as leaking of secure context. This option makes failed login attempt to be shown as standard login failure.
+
+### security.login_disallow_forward_proxy
+ENV: <b>TYK_DB_SECURITY_LOGINDISALLOWFORWARDPROXY</b><br />
+Type: `bool`<br />
+
+Set to `true` to allow the Tyk Dashboard login to ignore the host from the `X-Forwarded-For` header when accessing the Dashboard via a proxy. This can be useful for limiting retry attempts.
+
+### security.audit_log_path
+ENV: <b>TYK_DB_SECURITY_AUDITLOGPATH</b><br />
+Type: `string`<br />
+
+This sets the path to your audit log and enables audit with default settings. It will log all user actions and response statuses to it. Security information such as passwords are not logged.
+
+### security.user_password_max_days
+ENV: <b>TYK_DB_SECURITY_USERPASSWORDMAXDAYS</b><br />
+Type: `int`<br />
+
+Set the maximum lifetime of a password for a user. They will be prompted to reset if password lifetime exceeds the configured expiry value. e.g. if value set to 30 any user password set over 30 days in past will be considered invalid and must be reset.
+
+### security.enforce_password_history
+ENV: <b>TYK_DB_SECURITY_ENFORCEPASSWORDHISTORY</b><br />
+Type: `int`<br />
+
+Set a maximum number of previous passwords used by a user that cannot be reused. For example, If set to 5 the user upon setting their password cannot reuse any of their 5 most recently used password for that Tyk user account.
+
+### security.force_first_login_pw_reset
+ENV: <b>TYK_DB_SECURITY_FORCEFIRSTLOGINPWRESET</b><br />
+Type: `bool`<br />
+
+A newly created user will be forced to reset their password upon first login. Defaults to false.
+
+### security.enable_content_security_policy
+ENV: <b>TYK_DB_SECURITY_ENABLECONTENTSECURITYPOLICY</b><br />
+Type: `bool`<br />
+
+Enable browser Content-Security-Policy, e.g. CSP. The default is false.
+
+### security.allowed_content_sources
+ENV: <b>TYK_DB_SECURITY_ALLOWEDCONTENTSOURCES</b><br />
+Type: `string`<br />
+
+If CSP enabled, specify space separated string, with list of allowed resources.
+
+### security.open_policy
+OpenPolicy configuration
+
+### security.open_policy.enabled
+ENV: <b>TYK_DB_SECURITY_OPENPOLICY_ENABLED</b><br />
+Type: `bool`<br />
+
+Enable OpenPolicy
+
+### security.open_policy.debug
+ENV: <b>TYK_DB_SECURITY_OPENPOLICY_DEBUG</b><br />
+Type: `bool`<br />
+
+Enable OpenPolicy debug mode
+
+### security.open_policy.enable_api
+ENV: <b>TYK_DB_SECURITY_OPENPOLICY_ENABLEAPI</b><br />
+Type: `bool`<br />
+
+Enable modify OpenPolicy rules via UI and API
+
+### security.additional_permissions
+ENV: <b>TYK_DB_SECURITY_ADDITIONALPERMISSIONS</b><br />
+Type: `map[ObjectGroup]string`<br />
+
+Through this options, you can provide a list of additional permissions, that can be applied for existing or newly created users or user groups. Example:
+
+```
+{
+  "api_developer": "API Developer",
+  "custom_permission": "Custom Permission"
+}
+```
+
+### security.private_certificate_encoding_secret
+ENV: <b>TYK_DB_SECURITY_PRIVATECERTIFICATEENCODINGSECRET</b><br />
+Type: `string`<br />
+
+When using SAML with embedded identity broker, is required to upload a certificate that is encoded by the gateway to store it safely, TIB needs the private key as well, hence it needs the same encoding secret so the information is decoded successfully. This value should match with the encoding secret set in the gateway config file, if not set then it will use by default tyk_api_config.secret to attempt to decode the certificate.
+
+### security.forbid_admin_view_access_token
+ENV: <b>TYK_DB_SECURITY_FORBIDADMINVIEWACCESSTOKEN</b><br />
+Type: `bool`<br />
+
+ForbidAdminViewAccessToken is a security feature that allows you to prevent user admins from viewing the Dashboard API access tokens of other users. The default is `false`, however we recommend setting this to `true` for enhanced security.
+
+### security.forbid_admin_reset_access_token
+ENV: <b>TYK_DB_SECURITY_FORBIDADMINRESETACCESSTOKEN</b><br />
+Type: `bool`<br />
+
+ForbidAdminResetAccessToken is a security feature that allows you to prevent user admins from resetting the Dashboard API access tokens of other users. The default is `false`, however we recommend setting this to `true` for enhanced security.
+
+### ui
+This section controls various settings for the look and feel of the Dashboard UI.
+
+### ui.languages
+ENV: <b>TYK_DB_UI_LANGUAGES</b><br />
+Type: `map[string]string`<br />
+
+This section lists the current languages the Dashboard UI supports
+
+### ui.trial
+Trial section defines the information about the cloud trial period.
+
+### ui.trial.end_date
+ENV: <b>TYK_DB_UI_TRIAL_ENDDATE</b><br />
+Type: `int64`<br />
+
+EndDate contains the timestamp of end date of the trial in unix UTC timestamp.
+
+### ui.trial.hubspot_form
+HubspotForm contains the hubspot form details.
+
+### ui.trial.hubspot_form.region
+ENV: <b>TYK_DB_UI_TRIAL_HUBSPOTFORM_REGION</b><br />
+Type: `string`<br />
+
+The region of the account where the form was created.
+
+### ui.trial.hubspot_form.portal_id
+ENV: <b>TYK_DB_UI_TRIAL_HUBSPOTFORM_PORTALID</b><br />
+Type: `string`<br />
+
+The ID of the HubSpot account that the form was created in.
+
+### ui.trial.hubspot_form.form_id
+ENV: <b>TYK_DB_UI_TRIAL_HUBSPOTFORM_FORMID</b><br />
+Type: `string`<br />
+
+The form's ID, which is used to retrieve the form definition.
+
+### ui.hide_help
+ENV: <b>TYK_DB_UI_HIDEHELP</b><br />
+Type: `bool`<br />
+
+Set to true to hide the help tips.
+
+### ui.default_lang
+ENV: <b>TYK_DB_UI_DEFAULTLANG</b><br />
+Type: `string`<br />
+
+This settings sets the default language for the UI. Default setting is `en`. Can be set to any of the other languages listed under `ui.languages`.
+
+### ui.dont_allow_license_management
+ENV: <b>TYK_DB_UI_DONTALLOWLICENSEMANAGEMENT</b><br />
+Type: `bool`<br />
+
+Do not allow license management screen
+
+### ui.onboarding
+Onboarding section controls the onboarding quick start wizard.
+
+### ui.onboarding.enabled
+ENV: <b>TYK_DB_UI_ONBOARDING_ENABLED</b><br />
+Type: `bool`<br />
+
+Enabled is a boolean flag that enables the onboarding quick start wizard.
+
+### ui.notifications
+Notifications configures the behavior of toast notifications displayed in the UI.
+
+### ui.notifications.duration
+Duration controls how long each class of toast notification is displayed.
+
+### ui.notifications.duration.success
+ENV: <b>TYK_DB_UI_NOTIFICATIONS_DURATION_SUCCESS</b><br />
+Type: `int`<br />
+
+Duration in milliseconds for success notifications.
+
+### ui.notifications.duration.warning
+ENV: <b>TYK_DB_UI_NOTIFICATIONS_DURATION_WARNING</b><br />
+Type: `int`<br />
+
+Duration in milliseconds for warning notifications.
+
+### ui.notifications.duration.error
+ENV: <b>TYK_DB_UI_NOTIFICATIONS_DURATION_ERROR</b><br />
+Type: `int`<br />
+
+Duration in milliseconds for error notifications.
+
+### home_dir
+ENV: <b>TYK_DB_HOMEDIR</b><br />
+Type: `string`<br />
+
+The path to the home directory of Tyk Dashboard, this must be set in order for Portal templates and other files to be loadable. By default this is `/opt/tyk-dashboard/`.
+
+### identity_broker
+Tyk Dashboard has some preset Tyk Identity Broker configurations set up, for this integration to work, the Dashboard must be able to see an Identity Broker instance. The settings in this section are to enable this integration.
+
+### identity_broker.enabled
+ENV: <b>TYK_DB_TIB_ENABLED</b><br />
+Type: `bool`<br />
+
+A boolean setting to enable the TIB integration (otherwise it will not appear in the UI).
+
+### identity_broker.host
+When using external TIB, this is the URL where it's reachable
+
+### identity_broker.host.connection_string
+ENV: <b>TYK_DB_TIB_HOST_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+The URL to the host. It must be in the form: `http://domain:port`.
+Set this value only if you need to use external Tyk Identity Broker
+
+### identity_broker.host.secret
+ENV: <b>TYK_DB_TIB_HOST_SECRET</b><br />
+Type: `string`<br />
+
+The shared secret between TIB and the Dashboard. This ensures all API requests between Dashboard and TIB are valid.
+
+### identity_broker.ssl_insecure_skip_verify
+ENV: <b>TYK_DB_TIB_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Skip the TLS verification in the transport layer of the HTTP client. Is intended to have it enable for POC and testing purposes, do not use in production. Defaults to false.
+
+### use_sharded_analytics
+ENV: <b>TYK_DB_USESHARDEDANLAYTICS</b><br />
+Type: `bool`<br />
+
+If using the `mongo-pump-selective` pump, where data is written to org-id-specific collections in MongoDB, then enabling this option will switch querying for analytics over to the independent collection entries.
+
+### enable_aggregate_lookups
+ENV: <b>TYK_DB_ENABLEAGGREGATELOOKUPS</b><br />
+Type: `bool`<br />
+
+If using the new Aggregate Pump, Tyk Analytics can make use of the newer, faster Analytics lookup, to ensure that this can be made backwards compatible. This option must be set to `true`, in conjunction with the `aggregate_lookup_cutoff` value.
+
+### aggregate_lookup_cutoff
+ENV: <b>TYK_DB_AGGREGATELOOKUPCUTOFF</b><br />
+Type: `string`<br />
+
+Set this to a date value of the form `DD/MM/YYYY`. Any analytics queries before this date will fall back to the raw base log data collection (slower). This is to ensure continuity of service and a smooth upgrade process with no loss of data.
+
+### maintenance_mode
+ENV: <b>TYK_DB_MAINTENANCEMODE</b><br />
+Type: `bool`<br />
+
+Set to true to enable special maintenance screen for portal and dashboard
+
+### allow_explicit_policy_id
+ENV: <b>TYK_DB_ALLOWEXPLICITPOLICYID</b><br />
+Type: `bool`<br />
+
+Set this value to `true` if you're planning to use Tyk Sync or Tyk Operator
+**DEPRECATED**
+
+### disable_parallel_sessions
+ENV: <b>TYK_DB_DISABLEPARALLELSESSIONS</b><br />
+Type: `bool`<br />
+
+If set to true, it restricts an account to a single session. When an account logs in, any other open sessions for that account are logged out.
+
+### dashboard_session_lifetime
+ENV: <b>TYK_DB_DASHBOARDSESSIONLIFETIME</b><br />
+Type: `int64`<br />
+
+Dashboard session lifetime
+
+### portal_session_lifetime
+ENV: <b>TYK_DB_PORTALSESSIONLIFETIME</b><br />
+Type: `int`<br />
+
+Portal session lifetime
+
+### alternative_dashboard_url
+ENV: <b>TYK_DB_ALTERNATIVEDASHBOARDURL</b><br />
+Type: `string`<br />
+
+Redirect all dashboard users to another URL
+
+### sso_permission_defaults
+ENV: <b>TYK_DB_SSOPERMISSIONDEFAULTS</b><br />
+Type: `map[ObjectGroup]string`<br />
+
+Specify permissions of the user who logged in using Admin SSO API (for example Tyk Identity Broker). See [Dashboard Admin SSO API](https://tyk.io/docs/api-management/dashboard-configuration#single-sign-on-api-1) for more details.
+
+### sso_default_group_id
+ENV: <b>TYK_DB_SSODEFAULTUSERGROUP</b><br />
+Type: `string`<br />
+
+Default User Group which will be assigned to SSO users.
+
+### sso_custom_login_url
+ENV: <b>TYK_DB_SSOCUSTOMLOGINURL</b><br />
+Type: `string`<br />
+
+Specify a custom dashboard login URL if you are using 3rd party authentication like TIB.
+
+### sso_custom_portal_login_url
+ENV: <b>TYK_DB_SSOCUSTOMPORTALLOGINURL</b><br />
+Type: `string`<br />
+
+Specify custom portal login URL if you are using 3rd party authentication like TIB.
+
+### sso_enable_user_lookup
+ENV: <b>TYK_DB_SSOENABLEUSERLOOKUP</b><br />
+Type: `bool`<br />
+
+When enabled, if dashboard already have user with given email found, it will be used for the login process
+
+### sso_custom_login_error_url
+ENV: <b>TYK_DB_SSOCUSTOMLOGINERRORURL</b><br />
+Type: `string`<br />
+
+SSOCustomLoginErrorURL is an URL to redirect the user in case that SSO fails. If empty the user will be redirected to the error page of dashboard
+
+### audit
+Enable dashboard audit. Example:
+
+```
+"audit": {
+  "enabled": true,
+  "format": "json",
+  "path": "/tmp/audit.log",
+  "detailed_recording": false
+ },
+```
+
+Audit records the following fields for json format:
+ * req_id - unique request ID
+ * org_id - organization ID
+ * date - date in RFC1123 format
+ * timestamp - unix timestamp
+ * ip - IP address the request originated from
+ * user - Dashboard user who performed the request
+ * action - description of the action performed (i.e. Update User`)
+ * method - HTTP-method of the request
+ * url - URL of the request
+ * status - HTTP response status of the request
+ * diff - provides a diff of changed fields (available only for PUT requests)
+ * request_dump - HTTP request copy (available if detailed_recording is set to true)
+ * response_dump - HTTP response copy (available if detailed_recording is set to true)
+
+### audit.enabled
+ENV: <b>TYK_DB_AUDIT_ENABLED</b><br />
+Type: `bool`<br />
+
+Enables audit logging, set to false by default.
+
+### audit.format
+ENV: <b>TYK_DB_AUDIT_FORMAT</b><br />
+Type: `string`<br />
+
+Format of audit log file. Possible values are `json` and `text` (text is default value)
+
+### audit.path
+ENV: <b>TYK_DB_AUDIT_PATH</b><br />
+Type: `string`<br />
+
+Path to the audit log
+
+### audit.detailed_recording
+ENV: <b>TYK_DB_AUDIT_DETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Enables detailed records in the audit log. Set to false by default. If set to `true` then audit log records will contain the http-request (without body) and full http-response including the body`
+
+### audit.store_type
+ENV: <b>TYK_DB_AUDIT_STORETYPE</b><br />
+Type: `string`<br />
+
+StoreType defines the method used to store audit logs.
+Possible values are:
+  - "db": Store logs in a database.
+  - "file": Store logs in a file.
+  - "no_op": Disable logging (no operation).
+
+This field allows you to configure how audit logs are persisted.
+The default value is "file".
+
+### enable_multi_org_users
+ENV: <b>TYK_DB_ENABLEMULTIORGUSERS</b><br />
+Type: `bool`<br />
+
+Enable support for users with the same email for multiple organizations
+
+### health_check_endpoint_name
+ENV: <b>TYK_DB_HEALTHCHECKENDPOINTNAME</b><br />
+Type: `string`<br />
+
+Health check endpoint name. Default: /health
+
+### edge_endpoints
+ENV: <b>TYK_DB_EDGEENDPOINTS</b><br />
+Type: `EdgeEndpoints`<br />
+
+List of Edge Gateways, that will be displayed in the Dashboard UI, so that you can select to which specific Gateway(s) you want to load an API into. Example:
+```
+ "edge_endpoints": [
+ {
+   "name": "Private Gateway",
+   "endpoint": "https://payable-matter-gw.aws-euw2.cloud-ara.tyk.io",
+   "tags": ["edge", "private-gw"]
+ },
+ {
+   "name": "Public Gateway",
+   "endpoint": "video-taped-gokart-gw.aws-usw2.cloud-ara.tyk.io",
+   "tags": ["edge", "public-gw"]
+ }
+ ]
+```
+
+For every `Edge Gateway` there needs to be defined, its name, the ingress URL and a list of tags that APIs will use for triggering Gateways to load its configuration.
+Note: For the Hybrid setup, users must fill in the Gateway URLs manually in the Tyk OAS API Definition servers section.
+
+
+### portal_session_secret
+ENV: <b>TYK_DB_PORTALSESSIONSECRET</b><br />
+Type: `string`<br />
+
+Portal session secret
+
+### dcr_ssl_insecure_skip_verify
+ENV: <b>TYK_DB_DCRSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Ignore TLS verification for DCR calls
+
+### private_key_path
+ENV: <b>TYK_DB_PRIVATEKEYPATH</b><br />
+Type: `string`<br />
+
+Private key path used to sign notifications coming to the gateways
+
+### oauth_redirect_uri_separator
+ENV: <b>TYK_DB_OAUTHREDIRECTURISEPARATOR</b><br />
+Type: `string`<br />
+
+oAuth redirect URI separator
+
+### statsd_connection_string
+ENV: <b>TYK_DB_STATSDCONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+Enable StatsD monitoring when set to non empty. StatsD connection string.
+
+### statsd_prefix
+ENV: <b>TYK_DB_STATSDPREFIX</b><br />
+Type: `string`<br />
+
+StatsD prefix
+
+### allow_unsafe_oas
+ENV: <b>TYK_DB_ALLOWUNSAFEOAS</b><br />
+Type: `bool`<br />
+
+Allow the modification of Tyk OAS APIs via the Tyk Classic API endpoints. Note that this is not recommended but is provided for early adopters and will be deprecated later
+
+### oas_config
+OAS holds the configuration for various OpenAPI-specific functionalities
+
+### oas_config.validate_examples
+ENV: <b>TYK_DB_OAS_VALIDATEEXAMPLES</b><br />
+Type: `bool`<br />
+
+ValidateExamples enables validation of values provided in `example` and `examples` fields against the declared schemas in the OpenAPI Document. Defaults to false.
+
+### oas_config.validate_schema_defaults
+ENV: <b>TYK_DB_OAS_VALIDATESCHEMADEFAULTS</b><br />
+Type: `bool`<br />
+
+ValidateSchemaDefaults enables validation of values provided in `default` fields against the declared schemas in the OpenAPI Document. Defaults to false.
+
+### streaming
+Streaming holds the configuration for Tyk Streaming functionalities
+
+### streaming.enabled
+ENV: <b>TYK_DB_STREAMING_ENABLED</b><br />
+Type: `bool`<br />
+
+This flag enables the Tyk Streaming feature.
+
+### streaming.enable_all_experimental
+ENV: <b>TYK_DB_STREAMING_ENABLEALLEXPERIMENTAL</b><br />
+Type: `bool`<br />
+
+EnableAllExperimental indicates whether all experimental features for streaming are enabled. This is useful for testing purposes.
+
+Warning:
+  This flag should not be enabled in production environments.
+
+### notifications.certificate_expiry_monitor
+The configuration for the Gateway's Certificate Expiry Monitor which generates events when expired or soon to expire TLS certificates are used in client or upstream authentication.
+
+### notifications.certificate_expiry_monitor.metadata_refresh_interval_minutes
+ENV: <b>TYK_DB_NOTIFICATIONS_CERTIFICATEEXPIRYMONITOR_METADATAREFRESHINTERVALMINUTES</b><br />
+Type: `int`<br />
+
+Specifies the interval (in minutes) for refreshing certificate metadata.
+
+### notifications.certificate_expiry_monitor.warning_threshold_days
+ENV: <b>TYK_DB_NOTIFICATIONS_CERTIFICATEEXPIRYMONITOR_WARNINGTHRESHOLDDAYS</b><br />
+Type: `int`<br />
+
+Specifies the number of days before certificate expiry that the Dashboard will start generating warnings when the certificate is used. This should match the equivalent Gateway configuration `TYK_GW_SECURITY_CERTIFICATEEXPIRYMONITOR_WARNINGTHRESHOLDDAYS`.
+
+### disable_telemetry
+ENV: <b>TYK_DB_DISABLETELEMETRY</b><br />
+Type: `bool`<br />
+
+Enable or disable sending telemetry data such as analytics, API configurations, etc.
+
+### escape_dots_in_oas_paths
+ENV: <b>TYK_DB_ESCAPEDOTSINOASPATHS</b><br />
+Type: `bool`<br />
+
+When enabled, dots in OAS field names will be escaped (to \\u002e ) and unescaped when required for compatibility with specific databases.
+
+Defaults to `false`.
+
+### log_format
+ENV: <b>TYK_DB_LOGFORMAT</b><br />
+Type: `string`<br />
+
+You can now configure the log format to be either the standard or json format
+If not set or left empty, it will default to `standard`.
+
+### allow_unsafe_policy_ids
+ENV: <b>TYK_DB_ALLOWUNSAFEPOLICYIDS</b><br />
+Type: `bool`<br />
+
+AllowUnsafePolicyIds allows the use of non-standard characters in policy identifiers (default: false). The standard characters are alphanumeric characters plus underscore (_), hyphen (-), dot (.) and tilde (~). The use of other characters in IDs can cause unpredictable behavior and is not recommended.
+
diff --git a/snippets/edge-gateway-config.mdx b/snippets/edge-gateway-config.mdx
new file mode 100644
index 0000000000..428c441787
--- /dev/null
+++ b/snippets/edge-gateway-config.mdx
@@ -0,0 +1,409 @@
+### PORT
+ENV: <b>PORT</b><br />
+Type: `integer`<br />
+Default: `8080`<br />
+
+The port for the server to listen on.
+
+### HOST
+ENV: <b>HOST</b><br />
+Type: `string`<br />
+Default: `0.0.0.0`<br />
+
+The host for the server to bind to.
+
+### TLS_ENABLED
+ENV: <b>TLS_ENABLED</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Enable TLS.
+
+### TLS_CERT_PATH
+ENV: <b>TLS_CERT_PATH</b><br />
+Type: `string`<br />
+
+The path to the TLS certificate file.
+
+### TLS_KEY_PATH
+ENV: <b>TLS_KEY_PATH</b><br />
+Type: `string`<br />
+
+The path to the TLS key file.
+
+### READ_TIMEOUT
+ENV: <b>READ_TIMEOUT</b><br />
+Type: `string`<br />
+Default: `300s`<br />
+
+The read timeout for the server.
+
+### WRITE_TIMEOUT
+ENV: <b>WRITE_TIMEOUT</b><br />
+Type: `string`<br />
+Default: `300s`<br />
+
+The write timeout for the server.
+
+### IDLE_TIMEOUT
+ENV: <b>IDLE_TIMEOUT</b><br />
+Type: `string`<br />
+Default: `120s`<br />
+
+The idle timeout for the server.
+
+### SHUTDOWN_TIMEOUT
+ENV: <b>SHUTDOWN_TIMEOUT</b><br />
+Type: `string`<br />
+Default: `30s`<br />
+
+The shutdown timeout for the server.
+
+### DATABASE_TYPE
+ENV: <b>DATABASE_TYPE</b><br />
+Type: `string`<br />
+Default: `sqlite`<br />
+
+The type of database to use (`sqlite` or `postgres`).
+
+### DATABASE_DSN
+ENV: <b>DATABASE_DSN</b><br />
+Type: `string`<br />
+Default: `file:./data/microgateway.db?cache=shared&mode=rwc`<br />
+
+The database connection string.
+
+### DB_MAX_OPEN_CONNS
+ENV: <b>DB_MAX_OPEN_CONNS</b><br />
+Type: `integer`<br />
+Default: `25`<br />
+
+The maximum number of open database connections.
+
+### DB_MAX_IDLE_CONNS
+ENV: <b>DB_MAX_IDLE_CONNS</b><br />
+Type: `integer`<br />
+Default: `25`<br />
+
+The maximum number of idle database connections.
+
+### DB_CONN_MAX_LIFETIME
+ENV: <b>DB_CONN_MAX_LIFETIME</b><br />
+Type: `string`<br />
+Default: `5m`<br />
+
+The maximum lifetime of a database connection.
+
+### DB_AUTO_MIGRATE
+ENV: <b>DB_AUTO_MIGRATE</b><br />
+Type: `boolean`<br />
+Default: `true`<br />
+
+Enable automatic database migrations.
+
+### DB_LOG_LEVEL
+ENV: <b>DB_LOG_LEVEL</b><br />
+Type: `string`<br />
+Default: `warn`<br />
+
+The log level for the database.
+
+### CACHE_ENABLED
+ENV: <b>CACHE_ENABLED</b><br />
+Type: `boolean`<br />
+Default: `true`<br />
+
+Enable caching.
+
+### CACHE_MAX_SIZE
+ENV: <b>CACHE_MAX_SIZE</b><br />
+Type: `integer`<br />
+Default: `1000`<br />
+
+The maximum size of the cache.
+
+### CACHE_TTL
+ENV: <b>CACHE_TTL</b><br />
+Type: `string`<br />
+Default: `1h`<br />
+
+The time-to-live for cache entries.
+
+### CACHE_CLEANUP_INTERVAL
+ENV: <b>CACHE_CLEANUP_INTERVAL</b><br />
+Type: `string`<br />
+Default: `10m`<br />
+
+The cleanup interval for the cache.
+
+### CACHE_PERSIST_TO_DB
+ENV: <b>CACHE_PERSIST_TO_DB</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Persist the cache to the database.
+
+### GATEWAY_TIMEOUT
+ENV: <b>GATEWAY_TIMEOUT</b><br />
+Type: `string`<br />
+Default: `30s`<br />
+
+The timeout for the gateway.
+
+### GATEWAY_MAX_REQUEST_SIZE
+ENV: <b>GATEWAY_MAX_REQUEST_SIZE</b><br />
+Type: `integer`<br />
+Default: `10485760`<br />
+
+The maximum request size for the gateway.
+
+### GATEWAY_MAX_RESPONSE_SIZE
+ENV: <b>GATEWAY_MAX_RESPONSE_SIZE</b><br />
+Type: `integer`<br />
+Default: `52428800`<br />
+
+The maximum response size for the gateway.
+
+### GATEWAY_DEFAULT_RATE_LIMIT
+ENV: <b>GATEWAY_DEFAULT_RATE_LIMIT</b><br />
+Type: `integer`<br />
+Default: `100`<br />
+
+The default rate limit for the gateway.
+
+### GATEWAY_ENABLE_FILTERS
+ENV: <b>GATEWAY_ENABLE_FILTERS</b><br />
+Type: `boolean`<br />
+Default: `true`<br />
+
+Enable filters in the gateway.
+
+### GATEWAY_ENABLE_ANALYTICS
+ENV: <b>GATEWAY_ENABLE_ANALYTICS</b><br />
+Type: `boolean`<br />
+Default: `true`<br />
+
+Enable analytics in the gateway.
+
+### ANALYTICS_ENABLED
+ENV: <b>ANALYTICS_ENABLED</b><br />
+Type: `boolean`<br />
+Default: `true`<br />
+
+Enable analytics.
+
+### ANALYTICS_BUFFER_SIZE
+ENV: <b>ANALYTICS_BUFFER_SIZE</b><br />
+Type: `integer`<br />
+Default: `1000`<br />
+
+The buffer size for analytics.
+
+### ANALYTICS_FLUSH_INTERVAL
+ENV: <b>ANALYTICS_FLUSH_INTERVAL</b><br />
+Type: `string`<br />
+Default: `10s`<br />
+
+The flush interval for analytics.
+
+### ANALYTICS_RETENTION_DAYS
+ENV: <b>ANALYTICS_RETENTION_DAYS</b><br />
+Type: `integer`<br />
+Default: `90`<br />
+
+The retention period for analytics in days.
+
+### ANALYTICS_REALTIME
+ENV: <b>ANALYTICS_REALTIME</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Enable real-time analytics.
+
+### JWT_SECRET
+ENV: <b>JWT_SECRET</b><br />
+Type: `string`<br />
+Default: `change-me-in-production`<br />
+
+The secret key for JWTs.
+
+### ENCRYPTION_KEY
+ENV: <b>ENCRYPTION_KEY</b><br />
+Type: `string`<br />
+Default: `change-me-in-production`<br />
+
+The encryption key.
+
+### BCRYPT_COST
+ENV: <b>BCRYPT_COST</b><br />
+Type: `integer`<br />
+Default: `10`<br />
+
+The cost factor for bcrypt.
+
+### TOKEN_LENGTH
+ENV: <b>TOKEN_LENGTH</b><br />
+Type: `integer`<br />
+Default: `32`<br />
+
+The length of generated tokens.
+
+### SESSION_TIMEOUT
+ENV: <b>SESSION_TIMEOUT</b><br />
+Type: `string`<br />
+Default: `24h`<br />
+
+The timeout for sessions.
+
+### ENABLE_RATE_LIMITING
+ENV: <b>ENABLE_RATE_LIMITING</b><br />
+Type: `boolean`<br />
+Default: `true`<br />
+
+Enable rate limiting.
+
+### ENABLE_IP_WHITELIST
+ENV: <b>ENABLE_IP_WHITELIST</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Enable IP whitelisting.
+
+### LOG_LEVEL
+ENV: <b>LOG_LEVEL</b><br />
+Type: `string`<br />
+Default: `info`<br />
+
+The log level.
+
+### LOG_FORMAT
+ENV: <b>LOG_FORMAT</b><br />
+Type: `string`<br />
+Default: `text`<br />
+
+The log format (`json` or `text`).
+
+### ENABLE_METRICS
+ENV: <b>ENABLE_METRICS</b><br />
+Type: `boolean`<br />
+Default: `true`<br />
+
+Enable metrics.
+
+### METRICS_PATH
+ENV: <b>METRICS_PATH</b><br />
+Type: `string`<br />
+Default: `/metrics`<br />
+
+The path for metrics.
+
+### ENABLE_TRACING
+ENV: <b>ENABLE_TRACING</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Enable tracing.
+
+### TRACING_ENDPOINT
+ENV: <b>TRACING_ENDPOINT</b><br />
+Type: `string`<br />
+
+The endpoint for tracing.
+
+### ENABLE_PROFILING
+ENV: <b>ENABLE_PROFILING</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Enable profiling.
+
+### GATEWAY_MODE
+ENV: <b>GATEWAY_MODE</b><br />
+Type: `string`<br />
+Default: `standalone`<br />
+
+The gateway mode (`standalone` or `edge`).
+
+### CONTROL_ENDPOINT
+ENV: <b>CONTROL_ENDPOINT</b><br />
+Type: `string`<br />
+
+The gRPC endpoint of the control plane.
+
+### EDGE_ID
+ENV: <b>EDGE_ID</b><br />
+Type: `string`<br />
+
+A unique ID for the edge gateway.
+
+### EDGE_NAMESPACE
+ENV: <b>EDGE_NAMESPACE</b><br />
+Type: `string`<br />
+
+The namespace for the edge gateway.
+
+### EDGE_RECONNECT_INTERVAL
+ENV: <b>EDGE_RECONNECT_INTERVAL</b><br />
+Type: `string`<br />
+Default: `5s`<br />
+
+The interval to wait before reconnecting to the control plane.
+
+### EDGE_HEARTBEAT_INTERVAL
+ENV: <b>EDGE_HEARTBEAT_INTERVAL</b><br />
+Type: `string`<br />
+Default: `30s`<br />
+
+The interval for sending heartbeats to the control plane.
+
+### EDGE_SYNC_TIMEOUT
+ENV: <b>EDGE_SYNC_TIMEOUT</b><br />
+Type: `string`<br />
+Default: `10s`<br />
+
+The timeout for syncing configuration from the control plane.
+
+### EDGE_AUTH_TOKEN
+ENV: <b>EDGE_AUTH_TOKEN</b><br />
+Type: `string`<br />
+
+The authentication token for connecting to the control plane.
+
+### EDGE_TLS_ENABLED
+ENV: <b>EDGE_TLS_ENABLED</b><br />
+Type: `boolean`<br />
+Default: `true`<br />
+
+Enable TLS for the connection to the control plane.
+
+### EDGE_TLS_CERT_PATH
+ENV: <b>EDGE_TLS_CERT_PATH</b><br />
+Type: `string`<br />
+
+The path to the client TLS certificate file.
+
+### EDGE_TLS_KEY_PATH
+ENV: <b>EDGE_TLS_KEY_PATH</b><br />
+Type: `string`<br />
+
+The path to the client TLS key file.
+
+### EDGE_TLS_CA_PATH
+ENV: <b>EDGE_TLS_CA_PATH</b><br />
+Type: `string`<br />
+
+The path to the CA certificate file for verifying the control plane's certificate.
+
+### EDGE_SKIP_TLS_VERIFY
+ENV: <b>EDGE_SKIP_TLS_VERIFY</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Skip TLS certificate verification.
+
+### EDGE_ALLOW_INSECURE
+ENV: <b>EDGE_ALLOW_INSECURE</b><br />
+Type: `boolean`<br />
+Default: `false`<br />
+
+Allow insecure connections to the control plane.
diff --git a/snippets/env-type-mapping.mdx b/snippets/env-type-mapping.mdx
new file mode 100644
index 0000000000..df0ad3c98d
--- /dev/null
+++ b/snippets/env-type-mapping.mdx
@@ -0,0 +1,16 @@
+### Environment Variable Type Mapping
+
+When configuring Tyk components using environment variables, it's important to understand how different data types are represented. The type of each variable is based on its definition in the Go source code. This section provides a guide on how to format values for common data types.
+
+| Go Type                 | Environment Variable Format        | Example                                                              |
+| ----------------------- | ---------------------------------- | -------------------------------------------------------------------- |
+| `string`                | A regular string of text.          | `TYK_GW_SECRET="mysecret"`                                           |
+| `int`, `int64`          | A whole number.                    | `TYK_GW_LISTENPORT=8080`                                               |
+| `bool`                  | `true` or `false`.                 | `TYK_GW_USEDBAPPCONFIG=true`                                         |
+| `[]string`              | A comma-separated list of strings. | `TYK_PMP_PUMPS_STDOUT_FILTERS_SKIPPEDAPIIDS="api1,api2,api3"`        |
+| `map[string]string`     | A comma-separated list of key:value pairs. | `TYK_GW_GLOBALHEADERS="X-Tyk-Test:true,X-Tyk-Version:1.0"`           |
+| `map[string]interface{}` | A JSON string representing the object. | `TYK_GW_POLICIES_POLICYSOURCE_CONFIG='{"connection_string": "..."}'` |
+
+<Note>
+For complex types like `map[string]interface{}`, the value should be a valid JSON string. For `[]string` and `map[string]string`, ensure there are no spaces around the commas unless they are part of the value itself.
+</Note>
diff --git a/snippets/gateway-config.mdx b/snippets/gateway-config.mdx
new file mode 100644
index 0000000000..196c8af9d4
--- /dev/null
+++ b/snippets/gateway-config.mdx
@@ -0,0 +1,2947 @@
+### hostname
+ENV: <b>TYK_GW_HOSTNAME</b><br />
+Type: `string`<br />
+
+Force your Gateway to work only on a specific domain name. Can be overridden by API custom domain.
+
+### listen_address
+ENV: <b>TYK_GW_LISTENADDRESS</b><br />
+Type: `string`<br />
+
+If your machine has multiple network devices or IPs you can force the Gateway to use the IP address you want.
+
+### listen_port
+ENV: <b>TYK_GW_LISTENPORT</b><br />
+Type: `int`<br />
+
+Setting this value will change the port that Tyk listens on. Default: 8080.
+
+### control_api_hostname
+ENV: <b>TYK_GW_CONTROLAPIHOSTNAME</b><br />
+Type: `string`<br />
+
+Custom hostname for the Control API
+
+### control_api_port
+ENV: <b>TYK_GW_CONTROLAPIPORT</b><br />
+Type: `int`<br />
+
+Set this to expose the Tyk Gateway API on a separate port. You can protect it behind a firewall if needed. Please make sure you follow this guide when setting the control port https://tyk.io/docs/tyk-self-managed/#change-your-control-port.
+
+### secret
+ENV: <b>TYK_GW_SECRET</b><br />
+Type: `string`<br />
+
+This should be changed as soon as Tyk is installed on your system.
+This value is used in every interaction with the Tyk Gateway API. It should be passed along as the X-Tyk-Authorization header in any requests made.
+Tyk assumes that you are sensible enough not to expose the management endpoints publicly and to keep this configuration value to yourself.
+
+### node_secret
+ENV: <b>TYK_GW_NODESECRET</b><br />
+Type: `string`<br />
+
+The shared secret between the Gateway and the Dashboard to ensure that API Definition downloads, heartbeat and Policy loads are from a valid source.
+
+### pid_file_location
+ENV: <b>TYK_GW_PIDFILELOCATION</b><br />
+Type: `string`<br />
+
+Linux PID file location. Do not change unless you know what you are doing. Default: /var/run/tyk/tyk-gateway.pid
+
+### allow_insecure_configs
+ENV: <b>TYK_GW_ALLOWINSECURECONFIGS</b><br />
+Type: `bool`<br />
+
+Can be set to disable Dashboard message signature verification. When set to `true`, `public_key_path` can be ignored.
+
+### public_key_path
+ENV: <b>TYK_GW_PUBLICKEYPATH</b><br />
+Type: `string`<br />
+
+While communicating with the Dashboard. By default, all messages are signed by a private/public key pair. Set path to public key.
+
+### allow_remote_config
+ENV: <b>TYK_GW_ALLOWREMOTECONFIG</b><br />
+Type: `bool`<br />
+
+Allow your Dashboard to remotely set Gateway configuration via the Nodes screen.
+
+### enable_config_inspection
+ENV: <b>TYK_GW_ENABLECONFIGINSPECTION</b><br />
+Type: `bool`<br />
+
+Set to true to enable the /config and /env endpoints for configuration inspection.
+Default: false
+
+### security
+Global Certificate configuration
+
+### security.private_certificate_encoding_secret
+ENV: <b>TYK_GW_SECURITY_PRIVATECERTIFICATEENCODINGSECRET</b><br />
+Type: `string`<br />
+
+Set the AES256 secret which is used to encode certificate private keys when they uploaded via certificate storage
+
+### security.control_api_use_mutual_tls
+ENV: <b>TYK_GW_SECURITY_CONTROLAPIUSEMUTUALTLS</b><br />
+Type: `bool`<br />
+
+Enable Gateway Control API to use Mutual TLS. Certificates can be set via `security.certificates.control_api` section
+
+### security.pinned_public_keys
+ENV: <b>TYK_GW_SECURITY_PINNEDPUBLICKEYS</b><br />
+Type: `map[string]string`<br />
+
+Specify public keys used for Certificate Pinning on global level.
+
+### security.allow_unsafe_dynamic_mtls_token
+ENV: <b>TYK_GW_SECURITY_ALLOWUNSAFEDYNAMICMTLSTOKEN</b><br />
+Type: `bool`<br />
+
+AllowUnsafeDynamicMTLSToken is provided for backward compatibility with clients that are authorized using just the
+token for APIs secured with legacy Dynamic mTLS. If set to false (default), the client certificate must be presented
+and the mTLS handshake will be enforced. This is the recommended setting.
+
+### security.certificates.upstream
+ENV: <b>TYK_GW_SECURITY_CERTIFICATES_UPSTREAM</b><br />
+Type: `map[string]string`<br />
+
+Upstream is used to specify the certificates to be used in mutual TLS connections to upstream services. These are set at gateway level as a map of domain -> certificate id or path.
+For example if you want Tyk to use the certificate `ab23ef123` for requests to the `example.com` upstream and `/certs/default.pem` for all other upstreams then:
+In `tyk.conf` you would configure `"security": {"certificates": {"upstream": {"*": "/certs/default.pem", "example.com": "ab23ef123"}}}`
+And if using environment variables you would set this to `*:/certs/default.pem,example.com:ab23ef123`.
+
+### security.certificates.control_api
+ENV: <b>TYK_GW_SECURITY_CERTIFICATES_CONTROLAPI</b><br />
+Type: `[]string`<br />
+
+Certificates used for Control API Mutual TLS
+
+### security.certificates.dashboard_api
+ENV: <b>TYK_GW_SECURITY_CERTIFICATES_DASHBOARD</b><br />
+Type: `[]string`<br />
+
+Used for communicating with the Dashboard if it is configured to use Mutual TLS
+
+### security.certificates.mdcb_api
+ENV: <b>TYK_GW_SECURITY_CERTIFICATES_MDCB</b><br />
+Type: `[]string`<br />
+
+Certificates used for MDCB Mutual TLS
+
+### security.certificate_expiry_monitor
+CertificateExpiryMonitor configures the certificate expiry monitoring and notification feature
+
+### security.certificate_expiry_monitor.warning_threshold_days
+ENV: <b>TYK_GW_SECURITY_CERTIFICATEEXPIRYMONITOR_WARNINGTHRESHOLDDAYS</b><br />
+Type: `int`<br />
+
+WarningThresholdDays specifies the number of days before certificate expiry that the Gateway will start generating CertificateExpiringSoon events when the certificate is used
+Default: DefaultWarningThresholdDays (30 days)
+
+### security.certificate_expiry_monitor.check_cooldown_seconds
+ENV: <b>TYK_GW_SECURITY_CERTIFICATEEXPIRYMONITOR_CHECKCOOLDOWNSECONDS</b><br />
+Type: `int`<br />
+
+CheckCooldownSeconds specifies the minimum time in seconds that the Gateway will leave between checking for the expiry of a certificate when it is used in an API request - if a certificate is used repeatedly this prevents unnecessary expiry checks
+Default: DefaultCheckCooldownSeconds (3600 seconds = 1 hour)
+
+### security.certificate_expiry_monitor.event_cooldown_seconds
+ENV: <b>TYK_GW_SECURITY_CERTIFICATEEXPIRYMONITOR_EVENTCOOLDOWNSECONDS</b><br />
+Type: `int`<br />
+
+EventCooldownSeconds specifies the minimum time in seconds between firing the same certificate expiry event - this prevents unnecessary events from being generated for an expiring or expired certificate being used repeatedly; note that the higher of the value configured here or the default (DefaultEventCooldownSeconds) will be applied
+Default: DefaultEventCooldownSeconds (86400 seconds = 24 hours)
+
+### external_services
+ENV: <b>TYK_GW_EXTERNALSERVICES</b><br />
+Type: `ExternalServiceConfig`<br />
+
+External service configuration for proxy and mTLS support
+
+### http_server_options
+Gateway HTTP server configuration
+
+### http_server_options.read_timeout
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_READTIMEOUT</b><br />
+Type: `int`<br />
+
+API Consumer -> Gateway network read timeout. Not setting this config, or setting this to 0, defaults to 120 seconds
+
+### http_server_options.write_timeout
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_WRITETIMEOUT</b><br />
+Type: `int`<br />
+
+API Consumer -> Gateway network write timeout. Not setting this config, or setting this to 0, defaults to 120 seconds
+
+<Note>
+
+If you set `proxy_default_timeout` to a value greater than 120 seconds, you must also increase [http_server_options.write_timeout](#http-server-options-write-timeout) to a value greater than `proxy_default_timeout`. The `write_timeout` setting defaults to 120 seconds and controls how long Tyk waits to write the response back to the client. If not adjusted, the client connection will be closed before the upstream response is received.
+This timeout does not apply to MCP (Model Context Protocol) SSE streams — the write deadline is cleared for MCP connections to allow long-lived streaming, similar to WebSocket connections.
+</Note>
+
+### http_server_options.use_ssl
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_USESSL</b><br />
+Type: `bool`<br />
+
+Set to true to enable SSL connections
+
+### http_server_options.enable_http2
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_ENABLEHTTP2</b><br />
+Type: `bool`<br />
+
+Enable HTTP2 protocol handling
+
+### http_server_options.enable_strict_routes
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_ENABLESTRICTROUTES</b><br />
+Type: `bool`<br />
+
+EnableStrictRoutes changes the routing to avoid nearest-neighbour requests on overlapping routes
+
+- if disabled, `/apple` will route to `/app`, the current default behavior,
+- if enabled, `/app` only responds to `/app`, `/app/` and `/app/*` but not `/apple`
+
+Regular expressions and parameterized routes will be left alone regardless of this setting.
+
+### http_server_options.enable_path_prefix_matching
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_ENABLEPATHPREFIXMATCHING</b><br />
+Type: `bool`<br />
+
+EnablePathPrefixMatching changes how the gateway matches incoming URL paths against routes (patterns) defined in the API definition.
+By default, the gateway uses wildcard matching. When EnablePathPrefixMatching is enabled, it switches to prefix matching. For example, a defined path such as `/json` will only match request URLs that begin with `/json`, rather than matching any URL containing `/json`.
+
+The gateway checks the request URL against several variations depending on whether path versioning is enabled:
+- Full path (listen path + version + endpoint): `/listen-path/v4/json`
+- Non-versioned full path (listen path + endpoint): `/listen-path/json`
+- Path without version (endpoint only): `/json`
+
+For patterns that start with `/`, the gateway prepends `^` before performing the check, ensuring a true prefix match.
+For patterns that start with `^`, the gateway will already perform prefix matching so EnablePathPrefixMatching will have no impact.
+This option allows for more specific and controlled routing of API requests, potentially reducing unintended matches. Note that you may need to adjust existing route definitions when enabling this option.
+
+Example:
+
+With wildcard matching, `/json` might match `/api/v1/data/json`.
+With prefix matching, `/json` would not match `/api/v1/data/json`, but would match `/json/data`.
+
+Combining EnablePathPrefixMatching with EnablePathSuffixMatching will result in exact URL matching, with `/json` being evaluated as `^/json$`.
+
+### http_server_options.enable_path_suffix_matching
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_ENABLEPATHSUFFIXMATCHING</b><br />
+Type: `bool`<br />
+
+EnablePathSuffixMatching changes how the gateway matches incoming URL paths against routes (patterns) defined in the API definition.
+By default, the gateway uses wildcard matching. When EnablePathSuffixMatching is enabled, it switches to suffix matching. For example, a defined path such as `/json` will only match request URLs that end with `/json`, rather than matching any URL containing `/json`.
+
+The gateway checks the request URL against several variations depending on whether path versioning is enabled:
+- Full path (listen path + version + endpoint): `/listen-path/v4/json`
+- Non-versioned full path (listen path + endpoint): `/listen-path/json`
+- Path without version (endpoint only): `/json`
+
+For patterns that already end with `$`, the gateway will already perform suffix matching so EnablePathSuffixMatching will have no impact. For all other patterns, the gateway appends `$` before performing the check, ensuring a true suffix match.
+This option allows for more specific and controlled routing of API requests, potentially reducing unintended matches. Note that you may need to adjust existing route definitions when enabling this option.
+
+Example:
+
+With wildcard matching, `/json` might match `/api/v1/json/data`.
+With suffix matching, `/json` would not match `/api/v1/json/data`, but would match `/api/v1/json`.
+
+Combining EnablePathSuffixMatching with EnablePathPrefixMatching will result in exact URL matching, with `/json` being evaluated as `^/json$`.
+
+### http_server_options.ssl_insecure_skip_verify
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Disable TLS verification. Required if you are using self-signed certificates.
+
+### http_server_options.enable_websockets
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_ENABLEWEBSOCKETS</b><br />
+Type: `bool`<br />
+
+Enabled WebSockets and server side events support
+
+### http_server_options.certificates
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_CERTIFICATES</b><br />
+Type: `CertsData`<br />
+
+Deprecated: Use `ssl_certificates`instead.
+
+### http_server_options.ssl_certificates
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_SSLCERTIFICATES</b><br />
+Type: `[]string`<br />
+
+Index of certificates available to the Gateway for use in client and upstream communication.
+The string value in the array can be two of the following options:
+1. The ID assigned to and used to identify a certificate in the Tyk Certificate Store
+2. The path to a file accessible to the Gateway. This PEM file must contain the private key and public certificate pair concatenated together.
+
+### http_server_options.server_name
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_SERVERNAME</b><br />
+Type: `string`<br />
+
+Start your Gateway HTTP server on specific server name
+
+### http_server_options.min_version
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_MINVERSION</b><br />
+Type: `uint16`<br />
+
+Minimum TLS version is inherited from Go library, but can be overridden here.
+For details see: https://tyk.io/docs/api-management/implement-tls#controlling-tls-version-&-cipher-suites
+
+### http_server_options.max_version
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_MAXVERSION</b><br />
+Type: `uint16`<br />
+
+Maximum TLS version is inherited from Go library, but can be overridden here.
+For details see: https://tyk.io/docs/api-management/implement-tls#controlling-tls-version-&-cipher-suites
+
+### http_server_options.skip_client_ca_announcement
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_SKIPCLIENTCAANNOUNCEMENT</b><br />
+Type: `bool`<br />
+
+When mTLS enabled, this option allows to skip client CA announcement in the TLS handshake.
+This option is useful when you have a lot of ClientCAs and you want to reduce the handshake overhead, as some clients can hit TLS handshake limits.
+This option does not give any hints to the client, on which certificate to pick (but this is very rare situation when it is required)
+
+### http_server_options.flush_interval
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_FLUSHINTERVAL</b><br />
+Type: `int`<br />
+
+Set this to the number of seconds that Tyk uses to flush content from the proxied upstream connection to the open downstream connection.
+This option needs to be set for streaming protocols like gRPC streaming.
+
+### http_server_options.skip_url_cleaning
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_SKIPURLCLEANING</b><br />
+Type: `bool`<br />
+
+Allow the use of a double slash in a URL path. This can be useful if you need to pass raw URLs to your API endpoints.
+For example: `http://myapi.com/get/http://example.com`.
+
+### http_server_options.skip_target_path_escaping
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_SKIPTARGETPATHESCAPING</b><br />
+Type: `bool`<br />
+
+Disable automatic character escaping, allowing to path original URL data to the upstream.
+
+### http_server_options.ssl_ciphers
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_CIPHERS</b><br />
+Type: `[]string`<br />
+
+Custom SSL ciphers applicable when using TLS version 1.2. See the list of ciphers here https://tyk.io/docs/api-management/certificates#supported-tls-cipher-suites
+
+### http_server_options.max_request_body_size
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_MAXREQUESTBODYSIZE</b><br />
+Type: `int64`<br />
+
+MaxRequestBodySize configures a maximum size limit for request body size (in bytes) for all APIs on the Gateway.
+
+Tyk Gateway will evaluate all API requests against this size limit and will respond with HTTP 413 status code if the body of the request is larger.
+
+Two methods are used to perform the comparison:
+ - If the API Request contains the `Content-Length` header, this is directly compared against `MaxRequestBodySize`.
+ - If the `Content-Length` header is not provided, the Request body is read in chunks to compare total size against `MaxRequestBodySize`.
+
+A value of zero (default) means that no maximum is set and API requests will not be tested.
+
+See more information about setting request size limits here:
+https://tyk.io/docs/api-management/traffic-transformation/#request-size-limits
+
+### http_server_options.xff_depth
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_XFFDEPTH</b><br />
+Type: `int`<br />
+
+XFFDepth controls which position in the X-Forwarded-For chain to use for determining client IP address.
+A value of 0 means using the first IP (default). this is way the Gateway has calculated the client IP historically,
+the most common case, and will be used when this config is not set.
+However, any non-zero value will use that position from the right in the X-Forwarded-For chain.
+This is a security feature to prevent against IP spoofing attacks, and is recommended to be set to a non-zero value.
+A value of 1 means using the last IP, 2 means second to last, and so on.
+
+### http_server_options.max_response_body_size
+ENV: <b>TYK_GW_HTTPSERVEROPTIONS_MAXRESPONSEBODYSIZE</b><br />
+Type: `int64`<br />
+
+MaxResponseBodySize sets an upper limit on the response body (payload) size in bytes. It defaults to 0, which means there is no restriction on the response body size.
+
+The Gateway will return `HTTP 500 Response Body Too Large` if the response payload exceeds MaxResponseBodySize+1 bytes.
+
+**Note:** The limit is applied only when the [Response Body Transform middleware](/api-management/traffic-transformation/response-body) is enabled.
+
+
+### version_header
+ENV: <b>TYK_GW_VERSIONHEADER</b><br />
+Type: `string`<br />
+
+Expose version header with a given name. Works only for versioned APIs.
+
+### suppress_redis_signal_reload
+ENV: <b>TYK_GW_SUPPRESSREDISSIGNALRELOAD</b><br />
+Type: `bool`<br />
+
+Disable dynamic API and Policy reloads, e.g. it will load new changes only on procecss start.
+
+### reload_interval
+ENV: <b>TYK_GW_RELOADINTERVAL</b><br />
+Type: `int64`<br />
+
+ReloadInterval defines a duration in seconds within which the gateway responds to a reload event.
+The value defaults to 1, values lower than 1 are ignored.
+
+### hash_keys
+ENV: <b>TYK_GW_HASHKEYS</b><br />
+Type: `bool`<br />
+
+Enable Key hashing
+
+### disable_key_actions_by_username
+ENV: <b>TYK_GW_DISABLEKEYACTIONSBYUSERNAME</b><br />
+Type: `bool`<br />
+
+DisableKeyActionsByUsername disables key search by username.
+When this is set to `true` you are able to search for keys only by keyID or key hash (if `hash_keys` is also set to `true`)
+Note that if `hash_keys` is also set to `true` then the keyID will not be provided for APIs secured using basic auth. In this scenario the only search option would be to use key hash
+If you are using the Tyk Dashboard, you must configure this setting with the same value in both Gateway and Dashboard
+
+### hash_key_function
+ENV: <b>TYK_GW_HASHKEYFUNCTION</b><br />
+Type: `string`<br />
+
+Specify the Key hashing algorithm. Possible values: murmur64, murmur128, sha256.
+
+### basic_auth_hash_key_function
+ENV: <b>TYK_GW_BASICAUTHHASHKEYFUNCTION</b><br />
+Type: `string`<br />
+
+Specify the Key hashing algorithm for "basic auth". Possible values: murmur64, murmur128, sha256, bcrypt.
+Will default to "bcrypt" if not set.
+
+### hash_key_function_fallback
+ENV: <b>TYK_GW_HASHKEYFUNCTIONFALLBACK</b><br />
+Type: `[]string`<br />
+
+Specify your previous key hashing algorithm if you migrated from one algorithm to another.
+
+### enable_hashed_keys_listing
+ENV: <b>TYK_GW_ENABLEHASHEDKEYSLISTING</b><br />
+Type: `bool`<br />
+
+Allows the listing of hashed API keys
+
+### min_token_length
+ENV: <b>TYK_GW_MINTOKENLENGTH</b><br />
+Type: `int`<br />
+
+Minimum API token length
+
+### template_path
+ENV: <b>TYK_GW_TEMPLATEPATH</b><br />
+Type: `string`<br />
+
+Path to error and webhook templates. Defaults to the current binary path.
+
+### policies
+The policies section allows you to define where Tyk can find its policy templates. Policy templates are similar to key definitions in that they allow you to set quotas, access rights and rate limits for keys.
+Policies are loaded when Tyk starts and if changed require a hot-reload so they are loaded into memory.
+A policy can be defined in a file (Open Source installations) or from the same database as the Dashboard.
+
+### policies.policy_source
+ENV: <b>TYK_GW_POLICIES_POLICYSOURCE</b><br />
+Type: `string`<br />
+
+Set this value to `file` to look in the file system for a definition file. Set to `service` to use the Dashboard service.
+
+### policies.policy_connection_string
+ENV: <b>TYK_GW_POLICIES_POLICYCONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+This option is required if `policies.policy_source` is set to `service`.
+Set this to the URL of your Tyk Dashboard installation. The URL needs to be formatted as: http://dashboard_host:port.
+
+### policies.policy_record_name
+ENV: <b>TYK_GW_POLICIES_POLICYRECORDNAME</b><br />
+Type: `string`<br />
+
+This option only applies in OSS deployment when the `policies.policy_source` is either set
+to `file` or an empty string. If `policies.policy_path` is not set, then Tyk will load policies
+from the JSON file specified by `policies.policy_record_name`.
+
+### policies.allow_explicit_policy_id
+ENV: <b>TYK_GW_POLICIES_ALLOWEXPLICITPOLICYID</b><br />
+Type: `bool`<br />
+
+In a Pro installation, Tyk will load Policy IDs and use the internal object-ID as the ID of the policy.
+This is not portable in cases where the data needs to be moved from installation to installation.
+
+If you set this value to `true`, then the id parameter in a stored policy (or imported policy using the Dashboard API), will be used instead of the internal ID.
+
+This option should only be used when moving an installation to a new database.
+
+Deprecated. Is not used in codebase.
+
+### policies.policy_path
+ENV: <b>TYK_GW_POLICIES_POLICYPATH</b><br />
+Type: `string`<br />
+
+This option only applies in OSS deployment when the `policies.policy_source` is either set
+to `file` or an empty string. If `policies.policy_path` is set, then Tyk will load policies
+from all the JSON files under the directory specified by the `policies.policy_path` option.
+In this configuration, Tyk Gateway will allow policy management through the Gateway API.
+
+### ports_whitelist
+ENV: <b>TYK_GW_PORTWHITELIST</b><br />
+Type: `PortsWhiteList`<br />
+
+Defines the ports that will be available for the API services to bind to in the format
+documented here https://tyk.io/docs/api-management/non-http-protocols/#allowing-specific-ports.
+Ports can be configured per protocol, e.g. https, tls etc.
+If configuring via environment variable `TYK_GW_PORTWHITELIST` then remember to escape
+JSON strings.
+
+### disable_ports_whitelist
+ENV: <b>TYK_GW_DISABLEPORTWHITELIST</b><br />
+Type: `bool`<br />
+
+Disable port whilisting, essentially allowing you to use any port for your API.
+
+### app_path
+ENV: <b>TYK_GW_APPPATH</b><br />
+Type: `string`<br />
+
+If Tyk is being used in its standard configuration (Open Source installations), then API definitions are stored in the apps folder (by default in /opt/tyk-gateway/apps).
+This location is scanned for .json files and re-scanned at startup or reload.
+See the API section of the Tyk Gateway API for more details.
+
+### use_db_app_configs
+ENV: <b>TYK_GW_USEDBAPPCONFIGS</b><br />
+Type: `bool`<br />
+
+If you are a Tyk Pro user, this option will enable polling the Dashboard service for API definitions.
+On startup Tyk will attempt to connect and download any relevant application configurations from from your Dashboard instance.
+The files are exactly the same as the JSON files on disk with the exception of a BSON ID supplied by the Dashboard service.
+
+### db_app_conf_options
+This section defines API loading and shard options. Enable these settings to selectively load API definitions on a node from your Dashboard service.
+
+### db_app_conf_options.connection_string
+ENV: <b>TYK_GW_DBAPPCONFOPTIONS_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+Set the URL to your Dashboard instance (or a load balanced instance). The URL needs to be formatted as: `http://dashboard_host:port`
+
+### db_app_conf_options.connection_timeout
+ENV: <b>TYK_GW_DBAPPCONFOPTIONS_CONNECTIONTIMEOUT</b><br />
+Type: `int`<br />
+
+Set a timeout value, in seconds, for your Dashboard connection. Default value is 30.
+
+### db_app_conf_options.node_is_segmented
+ENV: <b>TYK_GW_DBAPPCONFOPTIONS_NODEISSEGMENTED</b><br />
+Type: `bool`<br />
+
+Set to `true` to enable filtering (sharding) of APIs.
+
+### db_app_conf_options.tags
+ENV: <b>TYK_GW_DBAPPCONFOPTIONS_TAGS</b><br />
+Type: `[]string`<br />
+
+The tags to use when filtering (sharding) Tyk Gateway nodes. Tags are processed as `OR` operations.
+If you include a non-filter tag (e.g. an identifier such as `node-id-1`, this will become available to your Dashboard analytics).
+
+### storage
+This section defines your Redis configuration.
+
+### storage.type
+ENV: <b>TYK_GW_STORAGE_TYPE</b><br />
+Type: `string`<br />
+
+This should be set to `redis` (lowercase)
+
+### storage.host
+ENV: <b>TYK_GW_STORAGE_HOST</b><br />
+Type: `string`<br />
+
+The Redis host, by default this is set to `localhost`, but for production this should be set to a cluster.
+
+### storage.port
+ENV: <b>TYK_GW_STORAGE_PORT</b><br />
+Type: `int`<br />
+
+The Redis instance port.
+
+### storage.addrs
+ENV: <b>TYK_GW_STORAGE_ADDRS</b><br />
+Type: `[]string`<br />
+
+If you have multi-node setup, you should use this field instead. For example: ["host1:port1", "host2:port2"].
+
+### storage.master_name
+ENV: <b>TYK_GW_STORAGE_MASTERNAME</b><br />
+Type: `string`<br />
+
+Redis sentinel master name
+
+### storage.sentinel_password
+ENV: <b>TYK_GW_STORAGE_SENTINELPASSWORD</b><br />
+Type: `string`<br />
+
+Redis sentinel password
+
+### storage.username
+ENV: <b>TYK_GW_STORAGE_USERNAME</b><br />
+Type: `string`<br />
+
+Redis user name
+
+### storage.password
+ENV: <b>TYK_GW_STORAGE_PASSWORD</b><br />
+Type: `string`<br />
+
+If your Redis instance has a password set for access, you can set it here.
+
+### storage.database
+ENV: <b>TYK_GW_STORAGE_DATABASE</b><br />
+Type: `int`<br />
+
+Redis database
+
+### storage.optimisation_max_idle
+ENV: <b>TYK_GW_STORAGE_MAXIDLE</b><br />
+Type: `int`<br />
+
+Set the number of maximum idle connections in the Redis connection pool, which defaults to 100. Set to a higher value if you are expecting more traffic.
+
+### storage.optimisation_max_active
+ENV: <b>TYK_GW_STORAGE_MAXACTIVE</b><br />
+Type: `int`<br />
+
+Set the number of maximum connections in the Redis connection pool, which defaults to 500. Set to a higher value if you are expecting more traffic.
+
+### storage.timeout
+ENV: <b>TYK_GW_STORAGE_TIMEOUT</b><br />
+Type: `int`<br />
+
+Set a custom timeout for Redis network operations. Default value 5 seconds.
+
+### storage.enable_cluster
+ENV: <b>TYK_GW_STORAGE_ENABLECLUSTER</b><br />
+Type: `bool`<br />
+
+Enable Redis Cluster support
+
+### storage.use_ssl
+ENV: <b>TYK_GW_STORAGE_USESSL</b><br />
+Type: `bool`<br />
+
+Enable SSL/TLS connection between your Tyk Gateway & Redis.
+
+### storage.ssl_insecure_skip_verify
+ENV: <b>TYK_GW_STORAGE_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Disable TLS verification
+
+### storage.ca_file
+ENV: <b>TYK_GW_STORAGE_CAFILE</b><br />
+Type: `string`<br />
+
+Path to the CA file.
+
+### storage.cert_file
+ENV: <b>TYK_GW_STORAGE_CERTFILE</b><br />
+Type: `string`<br />
+
+Path to the cert file.
+
+### storage.key_file
+ENV: <b>TYK_GW_STORAGE_KEYFILE</b><br />
+Type: `string`<br />
+
+Path to the key file.
+
+### storage.tls_max_version
+ENV: <b>TYK_GW_STORAGE_TLSMAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.3".
+
+### storage.tls_min_version
+ENV: <b>TYK_GW_STORAGE_TLSMINVERSION</b><br />
+Type: `string`<br />
+
+Minimum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.2".
+
+### storage.compress_api_definitions
+ENV: <b>TYK_GW_STORAGE_COMPRESSAPIDEFINITIONS</b><br />
+Type: `bool`<br />
+
+When set to `true`, enables Zstd compression for API definitions stored in Redis RPC backups.
+This feature significantly reduces Redis memory usage in MDCB deployments where API definitions are cached locally on Data Plane Gateways.
+The Gateway can read both compressed and uncompressed formats for backward compatibility.
+
+You can safely enable this setting on existing deployments.
+The Gateway continues to load previously stored uncompressed backups and stores all new backups in compressed form.
+
+Note: The maximum decompressed size is controlled by `max_decompressed_size`.
+
+Defaults to `false`.
+
+
+### storage.compress_policies
+ENV: <b>TYK_GW_STORAGE_COMPRESSPOLICIES</b><br />
+Type: `bool`<br />
+
+When set to `true`, enables Zstd compression for policies stored in Redis RPC backups.
+This feature significantly reduces Redis memory usage in MDCB deployments where policies are cached locally on Data Plane Gateways.
+The Gateway can read both compressed and uncompressed formats for backward compatibility.
+
+You can safely enable this setting on existing deployments.
+The Gateway continues to load previously stored uncompressed backups and stores all new backups in compressed form.
+
+Note: The maximum decompressed size is controlled by `max_decompressed_size`.
+
+Defaults to `false`.
+
+
+### storage.max_decompressed_size
+ENV: <b>TYK_GW_STORAGE_MAXDECOMPRESSEDSIZE</b><br />
+Type: `int64`<br />
+
+Maximum decompressed size (in bytes) for API definitions and Policies when using compression.
+This limit prevents memory exhaustion during decompression.
+Defaults to 104857600 (100MB).
+
+### disable_dashboard_zeroconf
+ENV: <b>TYK_GW_DISABLEDASHBOARDZEROCONF</b><br />
+Type: `bool`<br />
+
+Disable the capability of the Gateway to `autodiscover` the Dashboard through heartbeat messages via Redis.
+The goal of zeroconf is auto-discovery, so you do not have to specify the Tyk Dashboard address in your Gateway`tyk.conf` file.
+In some specific cases, for example, when the Dashboard is bound to a public domain, not accessible inside an internal network, or similar, `disable_dashboard_zeroconf` can be set to `true`, in favor of directly specifying a Tyk Dashboard address.
+
+### slave_options
+The `slave_options` allow you to configure the RPC slave connection required for MDCB installations.
+These settings must be configured for every RPC slave/worker node.
+
+### slave_options.use_rpc
+ENV: <b>TYK_GW_SLAVEOPTIONS_USERPC</b><br />
+Type: `bool`<br />
+
+Set to `true` to connect a worker Gateway using RPC.
+
+### slave_options.use_ssl
+ENV: <b>TYK_GW_SLAVEOPTIONS_USESSL</b><br />
+Type: `bool`<br />
+
+Set this option to `true` to use an SSL RPC connection.
+
+### slave_options.ssl_insecure_skip_verify
+ENV: <b>TYK_GW_SLAVEOPTIONS_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Set this option to `true` to allow the certificate validation (certificate chain and hostname) to be skipped.
+This can be useful if you use a self-signed certificate.
+
+### slave_options.connection_string
+ENV: <b>TYK_GW_SLAVEOPTIONS_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+Use this setting to add the URL for your MDCB or load balancer host.
+
+### slave_options.rpc_key
+ENV: <b>TYK_GW_SLAVEOPTIONS_RPCKEY</b><br />
+Type: `string`<br />
+
+Your organization ID to connect to the MDCB installation.
+
+### slave_options.api_key
+ENV: <b>TYK_GW_SLAVEOPTIONS_APIKEY</b><br />
+Type: `string`<br />
+
+This the API key of a user used to authenticate and authorize the Gateway's access through MDCB.
+The user should be a standard Dashboard user with minimal privileges so as to reduce any risk if the user is compromised.
+The suggested security settings are read for Real-time notifications and the remaining options set to deny.
+
+### slave_options.enable_rpc_cache
+ENV: <b>TYK_GW_SLAVEOPTIONS_ENABLERPCCACHE</b><br />
+Type: `bool`<br />
+
+Set this option to `true` to enable RPC caching for keys.
+
+### slave_options.bind_to_slugs
+ENV: <b>TYK_GW_SLAVEOPTIONS_BINDTOSLUGSINSTEADOFLISTENPATHS</b><br />
+Type: `bool`<br />
+
+For an Self-Managed installation this can be left at `false` (the default setting). For Legacy Cloud Gateways it must be set to ‘true’.
+
+### slave_options.disable_keyspace_sync
+ENV: <b>TYK_GW_SLAVEOPTIONS_DISABLEKEYSPACESYNC</b><br />
+Type: `bool`<br />
+
+Set this option to `true` if you don’t want to monitor changes in the keys from a primary Gateway.
+
+### slave_options.group_id
+ENV: <b>TYK_GW_SLAVEOPTIONS_GROUPID</b><br />
+Type: `string`<br />
+
+This is the `zone` that this instance inhabits, e.g. the cluster/data-center the Gateway lives in.
+The group ID must be the same across all the Gateways of a data-center/cluster which are also sharing the same Redis instance.
+This ID should also be unique per cluster (otherwise another Gateway cluster can pick up your keyspace events and your cluster will get zero updates).
+
+### slave_options.call_timeout
+ENV: <b>TYK_GW_SLAVEOPTIONS_CALLTIMEOUT</b><br />
+Type: `int`<br />
+
+Call Timeout allows to specify a time in seconds for the maximum allowed duration of a RPC call.
+
+### slave_options.ping_timeout
+ENV: <b>TYK_GW_SLAVEOPTIONS_PINGTIMEOUT</b><br />
+Type: `int`<br />
+
+The maximum time in seconds that a RPC ping can last.
+
+### slave_options.rpc_pool_size
+ENV: <b>TYK_GW_SLAVEOPTIONS_RPCPOOLSIZE</b><br />
+Type: `int`<br />
+
+The number of RPC connections in the pool. Basically it creates a set of connections that you can re-use as needed. Defaults to 5.
+
+### slave_options.key_space_sync_interval
+ENV: <b>TYK_GW_SLAVEOPTIONS_KEYSPACESYNCINTERVAL</b><br />
+Type: `float32`<br />
+
+You can use this to set a period for which the Gateway will check if there are changes in keys that must be synchronized. If this value is not set then it will default to 10 seconds.
+
+### slave_options.rpc_cert_cache_expiration
+ENV: <b>TYK_GW_SLAVEOPTIONS_RPCCERTCACHEEXPIRATION</b><br />
+Type: `float32`<br />
+
+RPCCertCacheExpiration defines the expiration time of the rpc cache that stores the certificates, defined in seconds
+
+### slave_options.rpc_global_cache_expiration
+ENV: <b>TYK_GW_SLAVEOPTIONS_RPCGLOBALCACHEEXPIRATION</b><br />
+Type: `float32`<br />
+
+RPCKeysCacheExpiration defines the expiration time of the rpc cache that stores the keys, defined in seconds
+
+### slave_options.rpc_cert_fetch_max_elapsed_time
+ENV: <b>TYK_GW_SLAVEOPTIONS_RPCCERTFETCHMAXELAPSEDTIME</b><br />
+Type: `float32`<br />
+
+RPCCertFetchMaxElapsedTime sets the maximum time in seconds to retry certificate fetch from MDCB during startup (default: 30)
+
+### slave_options.rpc_cert_fetch_initial_interval
+ENV: <b>TYK_GW_SLAVEOPTIONS_RPCCERTFETCHINITIALINTERVAL</b><br />
+Type: `float32`<br />
+
+RPCCertFetchInitialInterval sets the initial retry interval in seconds for certificate fetch backoff (default: 0.1)
+
+### slave_options.rpc_cert_fetch_max_interval
+ENV: <b>TYK_GW_SLAVEOPTIONS_RPCCERTFETCHMAXINTERVAL</b><br />
+Type: `float32`<br />
+
+RPCCertFetchMaxInterval sets the maximum retry interval in seconds for certificate fetch backoff (default: 2)
+
+### slave_options.rpc_cert_fetch_retry_enabled
+ENV: <b>TYK_GW_SLAVEOPTIONS_RPCCERTFETCHRETRYENABLED</b><br />
+Type: `bool`<br />
+
+RPCCertFetchRetryEnabled enables exponential backoff retry for certificate fetch from MDCB during startup (default: true)
+
+### slave_options.rpc_cert_fetch_max_retries
+ENV: <b>TYK_GW_SLAVEOPTIONS_RPCCERTFETCHMAXRETRIES</b><br />
+Type: `int`<br />
+
+RPCCertFetchMaxRetries sets the maximum number of retry attempts for certificate fetch. 0 means unlimited (time-based only) (default: 3)
+
+### slave_options.synchroniser_enabled
+ENV: <b>TYK_GW_SLAVEOPTIONS_SYNCHRONISERENABLED</b><br />
+Type: `bool`<br />
+
+SynchroniserEnabled enable this config if MDCB has enabled the synchoniser. If disabled then it will ignore signals to synchonise recources
+
+### slave_options.dns_monitor
+DNSMonitor configures background DNS monitoring for proactive detection of MDCB DNS changes
+
+### slave_options.dns_monitor.enabled
+ENV: <b>TYK_GW_SLAVEOPTIONS_DNSMONITOR_ENABLED</b><br />
+Type: `bool`<br />
+
+Enable background DNS monitoring for proactive detection of MDCB DNS changes
+
+### slave_options.dns_monitor.check_interval
+ENV: <b>TYK_GW_SLAVEOPTIONS_DNSMONITOR_CHECKINTERVAL</b><br />
+Type: `int`<br />
+
+Check interval in seconds for DNS monitoring (default: 30)
+
+### slave_options.sync_used_certs_only
+ENV: <b>TYK_GW_SLAVEOPTIONS_SYNCUSEDCERTSONLY</b><br />
+Type: `bool`<br />
+
+Set to true to sync only certificates used by loaded APIs.
+Only applies when use_rpc is true.
+Prevents proactive sync of unused certificates from control plane.
+Certificates are fetched on-demand via RPC and cached locally.
+Note: Certificates accumulate over time as they are used; they are not removed when APIs are deleted.
+Reduces memory usage and log noise in segmented deployments.
+
+
+### management_node
+ENV: <b>TYK_GW_MANAGEMENTNODE</b><br />
+Type: `bool`<br />
+
+If set to `true`, distributed rate limiter will be disabled for this node, and it will be excluded from any rate limit calculation.
+
+<Note>
+
+If you set `db_app_conf_options.node_is_segmented` to `true` for multiple Gateway nodes, you should ensure that `management_node` is set to `false`.
+This is to ensure visibility for the management node across all APIs.
+</Note>
+For pro installations, `management_node` is not a valid configuration option.
+Always set `management_node` to `false` in pro environments.
+
+
+### auth_override
+This is used as part of the RPC / Hybrid back-end configuration in a Tyk Enterprise installation and isn’t used anywhere else.
+
+### enable_fixed_window_rate_limiter
+ENV: <b>TYK_GW_ENABLEFIXEDWINDOWRATELIMITER</b><br />
+Type: `bool`<br />
+
+EnableFixedWindow enables fixed window rate limiting.
+
+### enable_redis_rolling_limiter
+ENV: <b>TYK_GW_ENABLEREDISROLLINGLIMITER</b><br />
+Type: `bool`<br />
+
+Redis based rate limiter with sliding log. Provides 100% rate limiting accuracy, but require two additional Redis roundtrips for each request.
+
+### enable_sentinel_rate_limiter
+ENV: <b>TYK_GW_ENABLESENTINELRATELIMITER</b><br />
+Type: `bool`<br />
+
+To enable, set to `true`. The sentinel-based rate limiter delivers a smoother performance curve as rate-limit calculations happen off-thread, but a stricter time-out based cool-down for clients. For example, when a throttling action is triggered, they are required to cool-down for the period of the rate limit.
+Disabling the sentinel based rate limiter will make rate-limit calculations happen on-thread and therefore offers a staggered cool-down and a smoother rate-limit experience for the client.
+For example, you can slow your connection throughput to regain entry into your rate limit. This is more of a “throttle” than a “block”.
+The standard rate limiter offers similar performance as the sentinel-based limiter. This is disabled by default.
+
+### enable_rate_limit_smoothing
+ENV: <b>TYK_GW_ENABLERATELIMITSMOOTHING</b><br />
+Type: `bool`<br />
+
+EnableRateLimitSmoothing enables or disables rate limit smoothing. The rate smoothing is only supported on the
+Redis Rate Limiter, or the Sentinel Rate Limiter, as both algorithms implement a sliding log.
+
+### enable_non_transactional_rate_limiter
+ENV: <b>TYK_GW_ENABLENONTRANSACTIONALRATELIMITER</b><br />
+Type: `bool`<br />
+
+An enhancement for the Redis and Sentinel rate limiters, that offers a significant improvement in performance by not using transactions on Redis rate-limit buckets.
+
+### drl_notification_frequency
+ENV: <b>TYK_GW_DRLNOTIFICATIONFREQUENCY</b><br />
+Type: `int`<br />
+
+How frequently a distributed rate limiter synchronises information between the Gateway nodes. Default: 2 seconds.
+
+### drl_threshold
+ENV: <b>TYK_GW_DRLTHRESHOLD</b><br />
+Type: `float64`<br />
+
+A distributed rate limiter is inaccurate on small rate limits, and it will fallback to a Redis or Sentinel rate limiter on an individual user basis, if its rate limiter lower then threshold.
+A Rate limiter threshold calculated using the following formula: `rate_threshold = drl_threshold * number_of_gateways`.
+So you have 2 Gateways, and your threshold is set to 5, if a user rate limit is larger than 10, it will use the distributed rate limiter algorithm.
+Default: 5
+
+### drl_enable_sentinel_rate_limiter
+ENV: <b>TYK_GW_DRLENABLESENTINELRATELIMITER</b><br />
+Type: `bool`<br />
+
+Controls which algorthm to use as a fallback when your distributed rate limiter can't be used.
+
+### rate_limit_response_headers
+ENV: <b>TYK_GW_RATELIMITRESPONSEHEADERS</b><br />
+Type: `RateLimitSource`<br />
+
+RateLimitResponseHeaders specifies the data source for rate limit headers in HTTP responses.
+This controls whether rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, etc.)
+are populated from quota data or rate limit data. Valid values: "quotas", "rate_limits".
+
+### enforce_org_data_age
+ENV: <b>TYK_GW_ENFORCEORGDATAAGE</b><br />
+Type: `bool`<br />
+
+Allows you to dynamically configure analytics expiration on a per organization level
+
+### enforce_org_data_detail_logging
+ENV: <b>TYK_GW_ENFORCEORGDATADETAILLOGGING</b><br />
+Type: `bool`<br />
+
+Allows you to dynamically configure detailed logging on a per organization level
+
+### enforce_org_quotas
+ENV: <b>TYK_GW_ENFORCEORGQUOTAS</b><br />
+Type: `bool`<br />
+
+Allows you to dynamically configure organization quotas on a per organization level
+
+### monitor
+The monitor section is useful if you wish to enforce a global trigger limit on organization and user quotas.
+This feature will trigger a webhook event to fire when specific triggers are reached.
+Triggers can be global (set in the node), by organization (set in the organization session object) or by key (set in the key session object)
+
+While Organization-level and Key-level triggers can be tiered (e.g. trigger at 10%, trigger at 20%, trigger at 80%), in the node-level configuration only a global value can be set.
+If a global value and specific trigger level are the same the trigger will only fire once:
+
+```
+"monitor": {
+  "enable_trigger_monitors": true,
+  "configuration": {
+   "method": "POST",
+   "target_path": "http://domain.com/notify/quota-trigger",
+   "template_path": "templates/monitor_template.json",
+   "header_map": {
+     "some-secret": "89787855"
+   },
+   "event_timeout": 10
+ },
+ "global_trigger_limit": 80.0,
+ "monitor_user_keys": false,
+ "monitor_org_keys": true
+},
+```
+
+### monitor.enable_trigger_monitors
+ENV: <b>TYK_GW_MONITOR_ENABLETRIGGERMONITORS</b><br />
+Type: `bool`<br />
+
+Set this to `true` to have monitors enabled in your configuration for the node.
+
+### monitor.configuration.method
+ENV: <b>TYK_GW_MONITOR_CONFIG_METHOD</b><br />
+Type: `string`<br />
+
+The method to use for the webhook.
+
+### monitor.configuration.target_path
+ENV: <b>TYK_GW_MONITOR_CONFIG_TARGETPATH</b><br />
+Type: `string`<br />
+
+The target path on which to send the request.
+
+### monitor.configuration.template_path
+ENV: <b>TYK_GW_MONITOR_CONFIG_TEMPLATEPATH</b><br />
+Type: `string`<br />
+
+The template to load in order to format the request.
+
+### monitor.configuration.header_map
+ENV: <b>TYK_GW_MONITOR_CONFIG_HEADERLIST</b><br />
+Type: `map[string]string`<br />
+
+Headers to set when firing the webhook.
+
+### monitor.configuration.event_timeout
+ENV: <b>TYK_GW_MONITOR_CONFIG_EVENTTIMEOUT</b><br />
+Type: `int64`<br />
+
+The cool-down for the event so it does not trigger again (in seconds).
+
+### monitor.global_trigger_limit
+ENV: <b>TYK_GW_MONITOR_GLOBALTRIGGERLIMIT</b><br />
+Type: `float64`<br />
+
+The trigger limit, as a percentage of the quota that must be reached in order to trigger the event, any time the quota percentage is increased the event will trigger.
+
+### monitor.monitor_user_keys
+ENV: <b>TYK_GW_MONITOR_MONITORUSERKEYS</b><br />
+Type: `bool`<br />
+
+Apply the monitoring subsystem to user keys.
+
+### monitor.monitor_org_keys
+ENV: <b>TYK_GW_MONITOR_MONITORORGKEYS</b><br />
+Type: `bool`<br />
+
+Apply the monitoring subsystem to organization keys.
+
+### max_idle_connections
+ENV: <b>TYK_GW_MAXIDLECONNS</b><br />
+Type: `int`<br />
+
+Maximum idle connections, per API, between Tyk and Upstream. By default not limited.
+
+### max_idle_connections_per_host
+ENV: <b>TYK_GW_MAXIDLECONNSPERHOST</b><br />
+Type: `int`<br />
+
+Maximum idle connections, per API, per upstream, between Tyk and Upstream.
+A value of `0` will use the default from the Go standard library, which is 2 connections. Tyk recommends setting this value to `500` for production environments.
+
+### max_conn_time
+ENV: <b>TYK_GW_MAXCONNTIME</b><br />
+Type: `int64`<br />
+
+Maximum connection time. If set it will force gateway reconnect to the upstream.
+
+### close_connections
+ENV: <b>TYK_GW_CLOSECONNECTIONS</b><br />
+Type: `bool`<br />
+
+If set, disable keepalive between User and Tyk
+
+### enable_custom_domains
+ENV: <b>TYK_GW_ENABLECUSTOMDOMAINS</b><br />
+Type: `bool`<br />
+
+Allows you to use custom domains
+
+### allow_master_keys
+ENV: <b>TYK_GW_ALLOWMASTERKEYS</b><br />
+Type: `bool`<br />
+
+If AllowMasterKeys is set to true, session objects (key definitions) that do not have explicit access rights set
+will be allowed by Tyk. This means that keys that are created have access to ALL APIs, which in many cases is
+unwanted behavior unless you are sure about what you are doing.
+
+### service_discovery.default_cache_timeout
+ENV: <b>TYK_GW_SERVICEDISCOVERY_DEFAULTCACHETIMEOUT</b><br />
+Type: `int`<br />
+
+Service discovery cache timeout
+
+### proxy_ssl_insecure_skip_verify
+ENV: <b>TYK_GW_PROXYSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Globally ignore TLS verification between Tyk and your Upstream services
+
+### proxy_enable_http2
+ENV: <b>TYK_GW_PROXYENABLEHTTP2</b><br />
+Type: `bool`<br />
+
+Enable HTTP2 support between Tyk and your upstream service. Required for gRPC.
+
+### proxy_ssl_min_version
+ENV: <b>TYK_GW_PROXYSSLMINVERSION</b><br />
+Type: `uint16`<br />
+
+Minimum TLS version for connection between Tyk and your upstream service.
+
+### proxy_ssl_max_version
+ENV: <b>TYK_GW_PROXYSSLMAXVERSION</b><br />
+Type: `uint16`<br />
+
+Maximum TLS version for connection between Tyk and your upstream service.
+
+### proxy_ssl_ciphers
+ENV: <b>TYK_GW_PROXYSSLCIPHERSUITES</b><br />
+Type: `[]string`<br />
+
+Allow list of ciphers for connection between Tyk and your upstream service.
+
+### proxy_default_timeout
+ENV: <b>TYK_GW_PROXYDEFAULTTIMEOUT</b><br />
+Type: `float64`<br />
+
+This can specify a default timeout in seconds for upstream API requests.
+Default: 30 seconds
+
+<Note>
+
+If you set `proxy_default_timeout` to a value greater than 120 seconds, you must also increase [http_server_options.write_timeout](#http-server-options-write-timeout) to a value greater than `proxy_default_timeout`. The `write_timeout` setting defaults to 120 seconds and controls how long Tyk waits to write the response back to the client. If not adjusted, the client connection will be closed before the upstream response is received.
+</Note>
+
+### proxy_ssl_disable_renegotiation
+ENV: <b>TYK_GW_PROXYSSLDISABLERENEGOTIATION</b><br />
+Type: `bool`<br />
+
+Disable TLS renegotiation.
+
+### proxy_close_connections
+ENV: <b>TYK_GW_PROXYCLOSECONNECTIONS</b><br />
+Type: `bool`<br />
+
+Disable keepalives between Tyk and your upstream service.
+Set this value to `true` to force Tyk to close the connection with the server, otherwise the connections will remain open for as long as your OS keeps TCP connections open.
+This can cause a file-handler limit to be exceeded. Setting to false can have performance benefits as the connection can be reused.
+
+### uptime_tests
+Tyk nodes can provide uptime awareness, uptime testing and analytics for your underlying APIs uptime and availability.
+Tyk can also notify you when a service goes down.
+
+### uptime_tests.disable
+ENV: <b>TYK_GW_UPTIMETESTS_DISABLE</b><br />
+Type: `bool`<br />
+
+To disable uptime tests on this node, set this value to `true`.
+
+### uptime_tests.poller_group
+ENV: <b>TYK_GW_UPTIMETESTS_POLLERGROUP</b><br />
+Type: `string`<br />
+
+If you have multiple Gateway clusters connected to the same Redis instance, you need to set a unique poller group for each cluster.
+
+### uptime_tests.config.failure_trigger_sample_size
+ENV: <b>TYK_GW_UPTIMETESTS_CONFIG_FAILURETRIGGERSAMPLESIZE</b><br />
+Type: `int`<br />
+
+The sample size to trigger a `HostUp` or `HostDown` event. For example, a setting of 3 will require at least three failures to occur before the uptime test is triggered.
+
+### uptime_tests.config.time_wait
+ENV: <b>TYK_GW_UPTIMETESTS_CONFIG_TIMEWAIT</b><br />
+Type: `int`<br />
+
+The value in seconds between tests runs. All tests will run simultaneously. This value will set the time between those tests. So a value of 60 will run all uptime tests every 60 seconds.
+
+### uptime_tests.config.checker_pool_size
+ENV: <b>TYK_GW_UPTIMETESTS_CONFIG_CHECKERPOOLSIZE</b><br />
+Type: `int`<br />
+
+The goroutine pool size to keep idle for uptime tests. If you have many uptime tests running at a high time period, then increase this value.
+
+### uptime_tests.config.enable_uptime_analytics
+ENV: <b>TYK_GW_UPTIMETESTS_CONFIG_ENABLEUPTIMEANALYTICS</b><br />
+Type: `bool`<br />
+
+Set this value to `true` to have the node capture and record analytics data regarding the uptime tests.
+
+### health_check
+This section enables the configuration of the health-check API endpoint and the size of the sample data cache (in seconds).
+
+### health_check.enable_health_checks
+ENV: <b>TYK_GW_HEALTHCHECK_ENABLEHEALTHCHECKS</b><br />
+Type: `bool`<br />
+
+Setting this value to `true` will enable the health-check endpoint on /Tyk/health.
+
+### health_check.health_check_value_timeouts
+ENV: <b>TYK_GW_HEALTHCHECK_HEALTHCHECKVALUETIMEOUT</b><br />
+Type: `int64`<br />
+
+This setting defaults to 60 seconds. This is the time window that Tyk uses to sample health-check data.
+You can set a higher value for more accurate data (a larger sample period), or a lower value for less accurate data.
+The reason this value is configurable is because sample data takes up space in your Redis DB to store the data to calculate samples. On high-availability systems this may not be desirable and smaller values may be preferred.
+
+### health_check_endpoint_name
+ENV: <b>TYK_GW_HEALTHCHECKENDPOINTNAME</b><br />
+Type: `string`<br />
+
+HealthCheckEndpointName Enables you to change the liveness endpoint.
+Default is "/hello"
+
+### readiness_check_endpoint_name
+ENV: <b>TYK_GW_READINESSCHECKENDPOINTNAME</b><br />
+Type: `string`<br />
+
+ReadinessCheckEndpointName Enables you to change the readiness endpoint
+Default is "/ready"
+
+### graceful_shutdown_timeout_duration
+ENV: <b>TYK_GW_GRACEFULSHUTDOWNTIMEOUTDURATION</b><br />
+Type: `int`<br />
+
+GracefulShutdownTimeoutDuration sets how many seconds the gateway should wait for an existing connection
+to finish before shutting down the server. Defaults to 30 seconds.
+
+### oauth_refresh_token_expire
+ENV: <b>TYK_GW_OAUTHREFRESHEXPIRE</b><br />
+Type: `int64`<br />
+
+Change the expiry time of a refresh token. By default 14 days (in seconds).
+
+### oauth_token_expire
+ENV: <b>TYK_GW_OAUTHTOKENEXPIRE</b><br />
+Type: `int32`<br />
+
+Change the expiry time of OAuth tokens (in seconds).
+
+### oauth_token_expired_retain_period
+ENV: <b>TYK_GW_OAUTHTOKENEXPIREDRETAINPERIOD</b><br />
+Type: `int32`<br />
+
+Specifies how long expired tokens are stored in Redis. The value is in seconds and the default is 0. Using the default means expired tokens are never removed from Redis.
+
+### oauth_redirect_uri_separator
+ENV: <b>TYK_GW_OAUTHREDIRECTURISEPARATOR</b><br />
+Type: `string`<br />
+
+Character which should be used as a separator for OAuth redirect URI URLs. Default: ;.
+
+### oauth_error_status_code
+ENV: <b>TYK_GW_OAUTHERRORSTATUSCODE</b><br />
+Type: `int`<br />
+
+Configures the OAuth error status code returned. If not set, it defaults to a 403 error.
+
+### enable_key_logging
+ENV: <b>TYK_GW_ENABLEKEYLOGGING</b><br />
+Type: `bool`<br />
+
+By default all key IDs in logs are hidden. Set to `true` if you want to see them for debugging reasons.
+
+### ssl_force_common_name_check
+ENV: <b>TYK_GW_SSLFORCECOMMONNAMECHECK</b><br />
+Type: `bool`<br />
+
+Force the validation of the hostname against the common name, even if TLS verification is disabled.
+
+### enable_analytics
+ENV: <b>TYK_GW_ENABLEANALYTICS</b><br />
+Type: `bool`<br />
+
+Tyk is capable of recording every hit to your API to a database with various filtering parameters. Set this value to `true` and fill in the sub-section below to enable logging.
+
+<Note>
+
+For performance reasons, Tyk will store traffic data to Redis initially and then purge the data from Redis to MongoDB or other data stores on a regular basis as determined by the purge_delay setting in your Tyk Pump configuration.
+</Note>
+
+### analytics_config
+This section defines options on what analytics data to store.
+
+### analytics_config.type
+ENV: <b>TYK_GW_ANALYTICSCONFIG_TYPE</b><br />
+Type: `string`<br />
+
+Set empty for a Self-Managed installation or `rpc` for multi-cloud.
+
+### analytics_config.ignored_ips
+ENV: <b>TYK_GW_ANALYTICSCONFIG_IGNOREDIPS</b><br />
+Type: `[]string`<br />
+
+Adding IP addresses to this list will cause Tyk to ignore these IPs in the analytics data. These IP addresses will not produce an analytics log record.
+This is useful for health checks and other samplers that might skew usage data.
+The IP addresses must be provided as a JSON array, with the values being single IPs. CIDR values are not supported.
+
+### analytics_config.enable_detailed_recording
+ENV: <b>TYK_GW_ANALYTICSCONFIG_ENABLEDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Set this value to `true` to have Tyk store the inbound request and outbound response data in HTTP Wire format as part of the Analytics data.
+Please note, this will greatly increase your analytics DB size and can cause performance degradation on analytics processing by the Dashboard.
+This setting can be overridden with an organization flag, enabed at an API level, or on individual Key level.
+
+### analytics_config.enable_geo_ip
+ENV: <b>TYK_GW_ANALYTICSCONFIG_ENABLEGEOIP</b><br />
+Type: `bool`<br />
+
+Tyk can store GeoIP information based on MaxMind DB’s to enable GeoIP tracking on inbound request analytics. Set this value to `true` and assign a DB using the `geo_ip_db_path` setting.
+
+### analytics_config.geo_ip_db_path
+ENV: <b>TYK_GW_ANALYTICSCONFIG_GEOIPDBLOCATION</b><br />
+Type: `string`<br />
+
+Path to a MaxMind GeoIP database
+The analytics GeoIP DB can be replaced on disk. It will cleanly auto-reload every hour.
+
+### analytics_config.normalise_urls
+This section describes methods that enable you to normalise inbound URLs in your analytics to have more meaningful per-path data.
+
+### analytics_config.normalise_urls.enabled
+ENV: <b>TYK_GW_ANALYTICSCONFIG_NORMALISEURLS_ENABLED</b><br />
+Type: `bool`<br />
+
+Set this to `true` to enable normalisation.
+
+### analytics_config.normalise_urls.normalise_uuids
+ENV: <b>TYK_GW_ANALYTICSCONFIG_NORMALISEURLS_NORMALISEUUIDS</b><br />
+Type: `bool`<br />
+
+Each UUID will be replaced with a placeholder {uuid}
+
+### analytics_config.normalise_urls.normalise_ulids
+ENV: <b>TYK_GW_ANALYTICSCONFIG_NORMALISEURLS_NORMALISEULIDS</b><br />
+Type: `bool`<br />
+
+Each ULID will be replaced with a placeholder {ulid}
+
+### analytics_config.normalise_urls.normalise_numbers
+ENV: <b>TYK_GW_ANALYTICSCONFIG_NORMALISEURLS_NORMALISENUMBERS</b><br />
+Type: `bool`<br />
+
+Set this to true to have Tyk automatically match for numeric IDs, it will match with a preceding slash so as not to capture actual numbers:
+
+### analytics_config.normalise_urls.custom_patterns
+ENV: <b>TYK_GW_ANALYTICSCONFIG_NORMALISEURLS_CUSTOM</b><br />
+Type: `[]string`<br />
+
+This is a list of custom patterns you can add. These must be valid regex strings. Tyk will replace these values with a `{var}` placeholder.
+
+### analytics_config.pool_size
+ENV: <b>TYK_GW_ANALYTICSCONFIG_POOLSIZE</b><br />
+Type: `int`<br />
+
+Number of workers used to process analytics. Defaults to number of CPU cores.
+
+### analytics_config.records_buffer_size
+ENV: <b>TYK_GW_ANALYTICSCONFIG_RECORDSBUFFERSIZE</b><br />
+Type: `uint64`<br />
+
+Number of records in analytics queue, per worker. Default: 1000.
+
+### analytics_config.storage_expiration_time
+ENV: <b>TYK_GW_ANALYTICSCONFIG_STORAGEEXPIRATIONTIME</b><br />
+Type: `int`<br />
+
+You can set a time (in seconds) to configure how long analytics are kept if they are not processed. The default is 60 seconds.
+This is used to prevent the potential infinite growth of Redis analytics storage.
+
+### analytics_config.enable_multiple_analytics_keys
+ENV: <b>TYK_GW_ANALYTICSCONFIG_ENABLEMULTIPLEANALYTICSKEYS</b><br />
+Type: `bool`<br />
+
+Set this to `true` to have Tyk automatically divide the analytics records in multiple analytics keys.
+This is especially useful when `storage.enable_cluster` is set to `true` since it will distribute the analytic keys across all the cluster nodes.
+
+### analytics_config.purge_interval
+ENV: <b>TYK_GW_ANALYTICSCONFIG_PURGEINTERVAL</b><br />
+Type: `float32`<br />
+
+You can set the interval length on how often the tyk Gateway will purge analytics data. This value is in seconds and defaults to 10 seconds.
+
+### analytics_config.serializer_type
+ENV: <b>TYK_GW_ANALYTICSCONFIG_SERIALIZERTYPE</b><br />
+Type: `string`<br />
+
+Determines the serialization engine for analytics. Available options: msgpack, and protobuf. By default, msgpack.
+
+### enable_separate_analytics_store
+ENV: <b>TYK_GW_ENABLESEPERATEANALYTICSSTORE</b><br />
+Type: `bool`<br />
+
+Enable separate analytics storage. Used together with `analytics_storage`.
+
+### analytics_storage.type
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_TYPE</b><br />
+Type: `string`<br />
+
+This should be set to `redis` (lowercase)
+
+### analytics_storage.host
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_HOST</b><br />
+Type: `string`<br />
+
+The Redis host, by default this is set to `localhost`, but for production this should be set to a cluster.
+
+### analytics_storage.port
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_PORT</b><br />
+Type: `int`<br />
+
+The Redis instance port.
+
+### analytics_storage.addrs
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_ADDRS</b><br />
+Type: `[]string`<br />
+
+If you have multi-node setup, you should use this field instead. For example: ["host1:port1", "host2:port2"].
+
+### analytics_storage.master_name
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_MASTERNAME</b><br />
+Type: `string`<br />
+
+Redis sentinel master name
+
+### analytics_storage.sentinel_password
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_SENTINELPASSWORD</b><br />
+Type: `string`<br />
+
+Redis sentinel password
+
+### analytics_storage.username
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_USERNAME</b><br />
+Type: `string`<br />
+
+Redis user name
+
+### analytics_storage.password
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_PASSWORD</b><br />
+Type: `string`<br />
+
+If your Redis instance has a password set for access, you can set it here.
+
+### analytics_storage.database
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_DATABASE</b><br />
+Type: `int`<br />
+
+Redis database
+
+### analytics_storage.optimisation_max_idle
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_MAXIDLE</b><br />
+Type: `int`<br />
+
+Set the number of maximum idle connections in the Redis connection pool, which defaults to 100. Set to a higher value if you are expecting more traffic.
+
+### analytics_storage.optimisation_max_active
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_MAXACTIVE</b><br />
+Type: `int`<br />
+
+Set the number of maximum connections in the Redis connection pool, which defaults to 500. Set to a higher value if you are expecting more traffic.
+
+### analytics_storage.timeout
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_TIMEOUT</b><br />
+Type: `int`<br />
+
+Set a custom timeout for Redis network operations. Default value 5 seconds.
+
+### analytics_storage.enable_cluster
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_ENABLECLUSTER</b><br />
+Type: `bool`<br />
+
+Enable Redis Cluster support
+
+### analytics_storage.use_ssl
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_USESSL</b><br />
+Type: `bool`<br />
+
+Enable SSL/TLS connection between your Tyk Gateway & Redis.
+
+### analytics_storage.ssl_insecure_skip_verify
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Disable TLS verification
+
+### analytics_storage.ca_file
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_CAFILE</b><br />
+Type: `string`<br />
+
+Path to the CA file.
+
+### analytics_storage.cert_file
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_CERTFILE</b><br />
+Type: `string`<br />
+
+Path to the cert file.
+
+### analytics_storage.key_file
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_KEYFILE</b><br />
+Type: `string`<br />
+
+Path to the key file.
+
+### analytics_storage.tls_max_version
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_TLSMAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.3".
+
+### analytics_storage.tls_min_version
+ENV: <b>TYK_GW_ANALYTICSSTORAGE_TLSMINVERSION</b><br />
+Type: `string`<br />
+
+Minimum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.2".
+
+### liveness_check.check_duration
+ENV: <b>TYK_GW_LIVENESSCHECK_CHECKDURATION</b><br />
+Type: `time.Duration`<br />
+
+Frequencies of performing interval healthchecks for Redis, Dashboard, and RPC layer.
+Expressed in Nanoseconds. For example: 1000000000 -> 1s.
+Default: 10 seconds.
+
+### dns_cache
+This section enables the global configuration of the expireable DNS records caching for your Gateway API endpoints.
+By design caching affects only http(s), ws(s) protocols APIs and doesn’t affect any plugin/middleware DNS queries.
+
+```
+"dns_cache": {
+  "enabled": true, //Turned off by default
+  "ttl": 60, //Time in seconds before the record will be removed from cache
+  "multiple_ips_handle_strategy": "random" //A strategy, which will be used when dns query will reply with more than 1 ip address per single host.
+}
+```
+
+### dns_cache.enabled
+ENV: <b>TYK_GW_DNSCACHE_ENABLED</b><br />
+Type: `bool`<br />
+
+Setting this value to `true` will enable caching of DNS queries responses used for API endpoint’s host names. By default caching is disabled.
+
+### dns_cache.ttl
+ENV: <b>TYK_GW_DNSCACHE_TTL</b><br />
+Type: `int64`<br />
+
+This setting allows you to specify a duration in seconds before the record will be removed from cache after being added to it on the first DNS query resolution of API endpoints.
+Setting `ttl` to `-1` prevents record from being expired and removed from cache on next check interval.
+
+### dns_cache.multiple_ips_handle_strategy
+ENV: <b>TYK_GW_DNSCACHE_MULTIPLEIPSHANDLESTRATEGY</b><br />
+Type: `string`<br />
+
+A strategy which will be used when a DNS query will reply with more than 1 IP Address per single host.
+As a DNS query response IP Addresses can have a changing order depending on DNS server balancing strategy (eg: round robin, geographically dependent origin-ip ordering, etc) this option allows you to not to limit the connection to the first host in a cached response list or prevent response caching.
+
+* `pick_first` will instruct your Tyk Gateway to connect to the first IP in a returned IP list and cache the response.
+* `random` will instruct your Tyk Gateway to connect to a random IP in a returned IP list and cache the response.
+* `no_cache` will instruct your Tyk Gateway to connect to the first IP in a returned IP list and fetch each addresses list without caching on each API endpoint DNS query.
+
+### disable_regexp_cache
+ENV: <b>TYK_GW_DISABLEREGEXPCACHE</b><br />
+Type: `bool`<br />
+
+If set to `true` this allows you to disable the regular expression cache. The default setting is `false`.
+
+### regexp_cache_expire
+ENV: <b>TYK_GW_REGEXPCACHEEXPIRE</b><br />
+Type: `int32`<br />
+
+If you set `disable_regexp_cache` to `false`, you can use this setting to limit how long the regular expression cache is kept for in seconds.
+The default is 60 seconds. This must be a positive value. If you set to 0 this uses the default value.
+
+### local_session_cache
+Tyk can cache some data locally, this can speed up lookup times on a single node and lower the number of connections and operations being done on Redis. It will however introduce a slight delay when updating or modifying keys as the cache must expire.
+This does not affect rate limiting.
+
+### local_session_cache.disable_cached_session_state
+ENV: <b>TYK_GW_LOCALSESSIONCACHE_DISABLECACHESESSIONSTATE</b><br />
+Type: `bool`<br />
+
+By default sessions are set to cache. Set this to `true` to stop Tyk from caching keys locally on the node.
+
+### enable_separate_cache_store
+ENV: <b>TYK_GW_ENABLESEPERATECACHESTORE</b><br />
+Type: `bool`<br />
+
+Enable to use a separate Redis for cache storage
+
+### cache_storage.type
+ENV: <b>TYK_GW_CACHESTORAGE_TYPE</b><br />
+Type: `string`<br />
+
+This should be set to `redis` (lowercase)
+
+### cache_storage.host
+ENV: <b>TYK_GW_CACHESTORAGE_HOST</b><br />
+Type: `string`<br />
+
+The Redis host, by default this is set to `localhost`, but for production this should be set to a cluster.
+
+### cache_storage.port
+ENV: <b>TYK_GW_CACHESTORAGE_PORT</b><br />
+Type: `int`<br />
+
+The Redis instance port.
+
+### cache_storage.addrs
+ENV: <b>TYK_GW_CACHESTORAGE_ADDRS</b><br />
+Type: `[]string`<br />
+
+If you have multi-node setup, you should use this field instead. For example: ["host1:port1", "host2:port2"].
+
+### cache_storage.master_name
+ENV: <b>TYK_GW_CACHESTORAGE_MASTERNAME</b><br />
+Type: `string`<br />
+
+Redis sentinel master name
+
+### cache_storage.sentinel_password
+ENV: <b>TYK_GW_CACHESTORAGE_SENTINELPASSWORD</b><br />
+Type: `string`<br />
+
+Redis sentinel password
+
+### cache_storage.username
+ENV: <b>TYK_GW_CACHESTORAGE_USERNAME</b><br />
+Type: `string`<br />
+
+Redis user name
+
+### cache_storage.password
+ENV: <b>TYK_GW_CACHESTORAGE_PASSWORD</b><br />
+Type: `string`<br />
+
+If your Redis instance has a password set for access, you can set it here.
+
+### cache_storage.database
+ENV: <b>TYK_GW_CACHESTORAGE_DATABASE</b><br />
+Type: `int`<br />
+
+Redis database
+
+### cache_storage.optimisation_max_idle
+ENV: <b>TYK_GW_CACHESTORAGE_MAXIDLE</b><br />
+Type: `int`<br />
+
+Set the number of maximum idle connections in the Redis connection pool, which defaults to 100. Set to a higher value if you are expecting more traffic.
+
+### cache_storage.optimisation_max_active
+ENV: <b>TYK_GW_CACHESTORAGE_MAXACTIVE</b><br />
+Type: `int`<br />
+
+Set the number of maximum connections in the Redis connection pool, which defaults to 500. Set to a higher value if you are expecting more traffic.
+
+### cache_storage.timeout
+ENV: <b>TYK_GW_CACHESTORAGE_TIMEOUT</b><br />
+Type: `int`<br />
+
+Set a custom timeout for Redis network operations. Default value 5 seconds.
+
+### cache_storage.enable_cluster
+ENV: <b>TYK_GW_CACHESTORAGE_ENABLECLUSTER</b><br />
+Type: `bool`<br />
+
+Enable Redis Cluster support
+
+### cache_storage.use_ssl
+ENV: <b>TYK_GW_CACHESTORAGE_USESSL</b><br />
+Type: `bool`<br />
+
+Enable SSL/TLS connection between your Tyk Gateway & Redis.
+
+### cache_storage.ssl_insecure_skip_verify
+ENV: <b>TYK_GW_CACHESTORAGE_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Disable TLS verification
+
+### cache_storage.ca_file
+ENV: <b>TYK_GW_CACHESTORAGE_CAFILE</b><br />
+Type: `string`<br />
+
+Path to the CA file.
+
+### cache_storage.cert_file
+ENV: <b>TYK_GW_CACHESTORAGE_CERTFILE</b><br />
+Type: `string`<br />
+
+Path to the cert file.
+
+### cache_storage.key_file
+ENV: <b>TYK_GW_CACHESTORAGE_KEYFILE</b><br />
+Type: `string`<br />
+
+Path to the key file.
+
+### cache_storage.tls_max_version
+ENV: <b>TYK_GW_CACHESTORAGE_TLSMAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.3".
+
+### cache_storage.tls_min_version
+ENV: <b>TYK_GW_CACHESTORAGE_TLSMINVERSION</b><br />
+Type: `string`<br />
+
+Minimum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.2".
+
+### enable_bundle_downloader
+ENV: <b>TYK_GW_ENABLEBUNDLEDOWNLOADER</b><br />
+Type: `bool`<br />
+
+Enable downloading Plugin bundles
+Example:
+```
+"enable_bundle_downloader": true,
+"bundle_base_url": "http://my-bundle-server.com/bundles/",
+"public_key_path": "/path/to/my/pubkey",
+```
+
+### bundle_base_url
+ENV: <b>TYK_GW_BUNDLEBASEURL</b><br />
+Type: `string`<br />
+
+Is a base URL that will be used to download the bundle. In this example we have `bundle-latest.zip` specified in the API settings, Tyk will fetch the following URL: http://my-bundle-server.com/bundles/bundle-latest.zip (see the next section for details).
+
+### bundle_insecure_skip_verify
+ENV: <b>TYK_GW_BUNDLEINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Disable TLS validation for bundle URLs
+
+### skip_verify_existing_plugin_bundle
+ENV: <b>TYK_GW_SKIPVERIFYEXISTINGPLUGINBUNDLE</b><br />
+Type: `bool`<br />
+
+SkipVerifyExistingPluginBundle skips checksum verification for plugin bundles already on disk.
+
+Tyk always verifies the integrity of plugin bundles when downloading them for the first time to local disk. For security against corruption of the bundles after they have been loaded, it then re-verifies bundle checksum (for signed bundles) when loading each API that uses the plugins.
+
+In trusted environments, this reverification may be unnecessary and can be skipped using this option, reducing the API load time.
+
+### enable_jsvm
+ENV: <b>TYK_GW_ENABLEJSVM</b><br />
+Type: `bool`<br />
+
+Set to true if you are using JSVM custom middleware or virtual endpoints.
+
+### jsvm_timeout
+ENV: <b>TYK_GW_JSVMTIMEOUT</b><br />
+Type: `int`<br />
+
+Set the execution timeout for JSVM plugins and virtal endpoints
+
+### disable_virtual_path_blobs
+ENV: <b>TYK_GW_DISABLEVIRTUALPATHBLOBS</b><br />
+Type: `bool`<br />
+
+Disable virtual endpoints and the code will not be loaded into the VM when the API definition initialises.
+This is useful for systems where you want to avoid having third-party code run.
+
+### tyk_js_path
+ENV: <b>TYK_GW_TYKJSPATH</b><br />
+Type: `string`<br />
+
+Path to the JavaScript file which will be pre-loaded for any JSVM middleware or virtual endpoint. Useful for defining global shared functions.
+
+### middleware_path
+ENV: <b>TYK_GW_MIDDLEWAREPATH</b><br />
+Type: `string`<br />
+
+Path to the plugins dirrectory. By default is ``./middleware`.
+
+### coprocess_options
+Configuration options for Python and gRPC plugins.
+
+### coprocess_options.enable_coprocess
+ENV: <b>TYK_GW_COPROCESSOPTIONS_ENABLECOPROCESS</b><br />
+Type: `bool`<br />
+
+Enable gRPC and Python plugins
+
+### coprocess_options.coprocess_grpc_server
+ENV: <b>TYK_GW_COPROCESSOPTIONS_COPROCESSGRPCSERVER</b><br />
+Type: `string`<br />
+
+Address of gRPC user
+
+### coprocess_options.grpc_recv_max_size
+ENV: <b>TYK_GW_COPROCESSOPTIONS_GRPCRECVMAXSIZE</b><br />
+Type: `int`<br />
+
+Maximum message which can be received from a gRPC server
+
+### coprocess_options.grpc_send_max_size
+ENV: <b>TYK_GW_COPROCESSOPTIONS_GRPCSENDMAXSIZE</b><br />
+Type: `int`<br />
+
+Maximum message which can be sent to gRPC server
+
+### coprocess_options.grpc_authority
+ENV: <b>TYK_GW_COPROCESSOPTIONS_GRPCAUTHORITY</b><br />
+Type: `string`<br />
+
+Authority used in GRPC connection
+
+### coprocess_options.grpc_round_robin_load_balancing
+ENV: <b>TYK_GW_COPROCESSOPTIONS_GRPCROUNDROBINLOADBALANCING</b><br />
+Type: `bool`<br />
+
+GRPCRoundRobinLoadBalancing enables round robin load balancing for gRPC services; you must provide the address of the load balanced service using `dns:///` protocol in `coprocess_grpc_server`.
+
+### coprocess_options.python_path_prefix
+ENV: <b>TYK_GW_COPROCESSOPTIONS_PYTHONPATHPREFIX</b><br />
+Type: `string`<br />
+
+Sets the path to built-in Tyk modules. This will be part of the Python module lookup path. The value used here is the default one for most installations.
+
+### coprocess_options.python_version
+ENV: <b>TYK_GW_COPROCESSOPTIONS_PYTHONVERSION</b><br />
+Type: `string`<br />
+
+If you have multiple Python versions installed you can specify your version.
+
+### ignore_endpoint_case
+ENV: <b>TYK_GW_IGNOREENDPOINTCASE</b><br />
+Type: `bool`<br />
+
+Ignore the case of any endpoints for APIs managed by Tyk. Setting this to `true` will override any individual API and Ignore, Blacklist and Whitelist plugin endpoint settings.
+
+### ignore_canonical_mime_header_key
+ENV: <b>TYK_GW_IGNORECANONICALMIMEHEADERKEY</b><br />
+Type: `bool`<br />
+
+When enabled Tyk ignores the canonical format of the MIME header keys.
+
+For example when a request header with a “my-header” key is injected using “global_headers”, the upstream would typically get it as “My-Header”. When this flag is enabled it will be sent as “my-header” instead.
+
+Current support is limited to JavaScript plugins, global header injection, virtual endpoint and JQ transform header rewrites.
+This functionality doesn’t affect headers that are sent by the HTTP client and the default formatting will apply in this case.
+
+For technical details refer to the [CanonicalMIMEHeaderKey](https://golang.org/pkg/net/textproto/#CanonicalMIMEHeaderKey) functionality in the Go documentation.
+
+### log_level
+ENV: <b>TYK_GW_LOGLEVEL</b><br />
+Type: `string`<br />
+
+You can now set a logging level (log_level). The following levels can be set: debug, info, warn, error.
+If not set or left empty, it will default to `info`.
+
+### log_format
+ENV: <b>TYK_GW_LOGFORMAT</b><br />
+Type: `string`<br />
+
+You can now configure the log format to be either the standard or json format
+If not set or left empty, it will default to `standard`.
+
+### access_logs
+AccessLogs configures the output for access logs.
+If not configured, the access log is disabled.
+
+### access_logs.enabled
+ENV: <b>TYK_GW_ACCESSLOGS_ENABLED</b><br />
+Type: `bool`<br />
+
+Enabled controls the generation of access logs by the Gateway. Default: false.
+
+### access_logs.template
+ENV: <b>TYK_GW_ACCESSLOGS_TEMPLATE</b><br />
+Type: `[]string`<br />
+
+Template configures which fields to include in the access log.
+If no template is configured, all available fields will be logged.
+
+Example: ["client_ip", "path"].
+
+Template Options:
+
+- `api_key` will include the obfuscated or hashed key.
+- `circuit_breaker_state` will include the circuit breaker state when applicable.
+- `client_ip` will include the IP of the request.
+- `error_source` will include the source of an error (e.g., ReverseProxy).
+- `error_target` will include the target that caused an error.
+- `host` will include the host of the request.
+- `latency_gateway` will include the gateway processing latency.
+- `latency_total` will include the total latency of the request.
+- `method` will include the request method.
+- `org_id` will include the organization ID.
+- `path` will include the path of the request.
+- `protocol` will include the protocol of the request.
+- `remote_addr` will include the remote address of the request.
+- `response_code_details` will include detailed error description for 5XX responses.
+- `response_flag` will include the error classification flag (e.g., URT, UCF, TLE).
+- `status` will include the response status code.
+- `tls_cert_expiry` will include the TLS certificate expiry date when applicable.
+- `tls_cert_subject` will include the TLS certificate subject when applicable.
+- `trace_id` will include the OpenTelemetry trace ID when tracing is enabled.
+- `upstream_addr` will include the upstream address (scheme, host and path).
+- `upstream_latency` will include the upstream latency of the request.
+- `upstream_status` will include the upstream response status code for 5XX responses.
+- `user_agent` will include the user agent of the request.
+- `api_type` will include the API protocol type (classic, oas, graphql, mcp).
+- `mcp_method` will include the JSON-RPC method name (MCP APIs only).
+- `mcp_primitive_type` will include the MCP primitive type (MCP APIs only).
+- `mcp_primitive_name` will include the MCP primitive name (MCP APIs only).
+- `mcp_error_code` will include the JSON-RPC error code (MCP APIs only).
+
+### tracing
+Section for configuring OpenTracing support
+Deprecated: use OpenTelemetry instead.
+
+### tracing.name
+ENV: <b>TYK_GW_TRACER_NAME</b><br />
+Type: `string`<br />
+
+The name of the tracer to initialize. For instance appdash, to use appdash tracer
+
+### tracing.enabled
+ENV: <b>TYK_GW_TRACER_ENABLED</b><br />
+Type: `bool`<br />
+
+Enable tracing
+
+### tracing.options
+ENV: <b>TYK_GW_TRACER_OPTIONS</b><br />
+Type: `map[string]interface{}`<br />
+
+Tracing configuration. Refer to the Tracing Docs for the full list of options.
+
+### opentelemetry
+Section for configuring OpenTelemetry.
+
+### opentelemetry.enabled
+ENV: <b>TYK_GW_OPENTELEMETRY_ENABLED</b><br />
+Type: `bool`<br />
+
+Set this to `true` to enable OpenTelemetry tracing on the Gateway.
+When enabled, the Gateway exports spans to the configured OpenTelemetry
+collector. Defaults to false.
+
+### opentelemetry.exporter
+ENV: <b>TYK_GW_OPENTELEMETRY_EXPORTER</b><br />
+Type: `string`<br />
+
+Transport used to send telemetry data to the OpenTelemetry collector
+over OTLP. Must match the protocol the collector is configured to accept.
+Valid values are "grpc" or "http". Defaults to "grpc".
+
+### opentelemetry.endpoint
+ENV: <b>TYK_GW_OPENTELEMETRY_ENDPOINT</b><br />
+Type: `string`<br />
+
+OpenTelemetry collector endpoint to connect to.
+Defaults to "localhost:4317".
+
+### opentelemetry.headers
+ENV: <b>TYK_GW_OPENTELEMETRY_HEADERS</b><br />
+Type: `map[string]string`<br />
+
+A map of headers that will be sent with HTTP requests to the collector.
+
+### opentelemetry.connection_timeout
+ENV: <b>TYK_GW_OPENTELEMETRY_CONNECTIONTIMEOUT</b><br />
+Type: `int`<br />
+
+Timeout for establishing a connection to the collector.
+Defaults to 1 second.
+
+### opentelemetry.resource_name
+ENV: <b>TYK_GW_OPENTELEMETRY_RESOURCENAME</b><br />
+Type: `string`<br />
+
+The "Resource" or "Service" Name that will be assigned to the Gateway in
+traces and metrics. This is used to identify OpenTelemetry data generated
+by Tyk Gateway. It typically appears as `service.name` in backends
+such as Jaeger, Tempo or Prometheus.
+Defaults to "tyk".
+
+### opentelemetry.tls
+TLS configuration used by the exporter to authenticate the OpenTelemetry collector
+
+### opentelemetry.tls.enable
+ENV: <b>TYK_GW_OPENTELEMETRY_TLS_ENABLE</b><br />
+Type: `bool`<br />
+
+Set this to `true` to enable TLS for the connection to the OpenTelemetry
+collector. Defaults to false.
+
+### opentelemetry.tls.insecure_skip_verify
+ENV: <b>TYK_GW_OPENTELEMETRY_TLS_INSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Set to `true` to disable verification of the server’s certificate chain. Not recommended for production environments.
+Defaults to false.
+
+### opentelemetry.tls.ca_file
+ENV: <b>TYK_GW_OPENTELEMETRY_TLS_CAFILE</b><br />
+Type: `string`<br />
+
+Filesystem path to a PEM-encoded CA certificate used to verify the
+OpenTelemetry collector's TLS certificate. Only filesystem paths are
+accepted; certificate IDs from the Tyk Certificate Store are not
+supported.
+
+### opentelemetry.tls.cert_file
+ENV: <b>TYK_GW_OPENTELEMETRY_TLS_CERTFILE</b><br />
+Type: `string`<br />
+
+Path to the cert file.
+
+### opentelemetry.tls.key_file
+ENV: <b>TYK_GW_OPENTELEMETRY_TLS_KEYFILE</b><br />
+Type: `string`<br />
+
+Path to the key file.
+
+### opentelemetry.tls.max_version
+ENV: <b>TYK_GW_OPENTELEMETRY_TLS_MAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.3".
+
+### opentelemetry.tls.min_version
+ENV: <b>TYK_GW_OPENTELEMETRY_TLS_MINVERSION</b><br />
+Type: `string`<br />
+
+Minimum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.2".
+
+### opentelemetry.span_processor_type
+ENV: <b>TYK_GW_OPENTELEMETRY_SPANPROCESSORTYPE</b><br />
+Type: `string`<br />
+
+Type of the span processor to use. Valid values are "simple" or "batch".
+Defaults to "batch".
+
+### opentelemetry.span_batch_config
+Configuration for the batch span processor.
+Only applies when SpanProcessorType is "batch".
+
+### opentelemetry.span_batch_config.max_queue_size
+ENV: <b>TYK_GW_OPENTELEMETRY_SPANBATCHCONFIG_MAXQUEUESIZE</b><br />
+Type: `int`<br />
+
+MaxQueueSize is the maximum queue size to buffer spans for delayed processing.
+If the queue gets full it drops the spans.
+The default value is 2048.
+
+### opentelemetry.span_batch_config.max_export_batch_size
+ENV: <b>TYK_GW_OPENTELEMETRY_SPANBATCHCONFIG_MAXEXPORTBATCHSIZE</b><br />
+Type: `int`<br />
+
+MaxExportBatchSize is the maximum number of spans to process in a single batch.
+If there are more than one batch worth of spans then it processes multiple batches
+of spans one batch after the other without any delay.
+The default value is 512.
+
+### opentelemetry.span_batch_config.batch_timeout
+ENV: <b>TYK_GW_OPENTELEMETRY_SPANBATCHCONFIG_BATCHTIMEOUT</b><br />
+Type: `int`<br />
+
+BatchTimeout is the maximum duration for constructing a batch. Processor
+forcefully sends available spans when timeout is reached.
+The default value is 5 seconds.
+
+### opentelemetry.context_propagation
+ENV: <b>TYK_GW_OPENTELEMETRY_CONTEXTPROPAGATION</b><br />
+Type: `string`<br />
+
+Type of the context propagator to use. Valid values are:
+- "tracecontext": tracecontext is a propagator that supports the W3C
+Trace Context format (https://www.w3.org/TR/trace-context/).
+- "b3": b3 is a propagator serializes SpanContext to/from B3 multi Headers format.
+- "custom": custom propagator reads from and writes to a custom header only.
+- "composite": composite propagator reads from custom header (priority) or standard headers,
+  and writes to both custom and standard headers.
+Defaults to "tracecontext".
+
+### opentelemetry.custom_trace_header
+ENV: <b>TYK_GW_OPENTELEMETRY_CUSTOMTRACEHEADER</b><br />
+Type: `string`<br />
+
+Name of custom header to use for trace ID instead of standard "traceparent".
+When set with context_propagation="custom", the gateway will extract trace context
+from this header and propagate it using the same custom header.
+When set with context_propagation="tracecontext" or "b3", the gateway will extract
+trace context from this header (priority) or standard headers (fallback), and propagate
+using standard headers only.
+When set with context_propagation="composite", the gateway will extract trace context
+from this header (priority) or standard headers (fallback), and propagate using both
+custom and standard headers.
+Example: "X-Correlation-ID", "X-Request-ID", "X-Trace-ID"
+
+The header value should be a valid OpenTelemetry Trace ID: a 32-character (16-byte)
+lowercase hex string with at least one non-zero byte
+(e.g. "0102030405060708090a0b0c0d0e0f10"). UUIDs with dashes are also accepted
+(e.g. "550e8400-e29b-41d4-a716-446655440000") — dashes are removed automatically.
+See: https://opentelemetry.io/docs/specs/otel/trace/api/
+
+If the value contains non-hex characters, those characters will be stripped and the
+remaining hex characters will be zero-padded to 32 characters. This means arbitrary
+strings like "my-request-id" will NOT produce a predictable trace ID. To ensure
+trace ID consistency between the custom header and the reported trace, always send
+a valid OpenTelemetry Trace ID or UUID.
+
+### opentelemetry.sampling
+Defines the configurations to use in the sampler.
+
+### opentelemetry.sampling.type
+ENV: <b>TYK_GW_OPENTELEMETRY_SAMPLING_TYPE</b><br />
+Type: `string`<br />
+
+Refers to the policy used by OpenTelemetry to determine
+whether a particular trace should be sampled or not. It's determined at the
+start of a trace and the decision is propagated down the trace. Valid Values are:
+AlwaysOn, AlwaysOff and TraceIDRatioBased. It defaults to AlwaysOn.
+
+### opentelemetry.sampling.rate
+ENV: <b>TYK_GW_OPENTELEMETRY_SAMPLING_RATE</b><br />
+Type: `float64`<br />
+
+Parameter for the TraceIDRatioBased sampler type and represents the percentage
+of traces to be sampled. The value should fall between 0.0 (0%) and 1.0 (100%). For instance, if
+the sampling rate is set to 0.5, the sampler will aim to sample approximately 50% of the traces.
+By default, it's set to 0.5.
+
+### opentelemetry.sampling.parent_based
+ENV: <b>TYK_GW_OPENTELEMETRY_SAMPLING_PARENTBASED</b><br />
+Type: `bool`<br />
+
+Rule that ensures that if we decide to record data for a particular operation,
+we'll also record data for all the subsequent work that operation causes (its "child spans").
+This approach helps in keeping the entire story of a transaction together. Typically, ParentBased
+is used in conjunction with TraceIDRatioBased. Using it with AlwaysOn or AlwaysOff might not be as
+effective since, in those cases, you're either recording everything or nothing, and there are no
+intermediary decisions to consider. The default value for this option is false.
+
+### opentelemetry.traces
+Traces holds the OpenTelemetry traces configuration.
+When non-nil, takes precedence over root-level trace fields.
+
+### opentelemetry.traces.enabled
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_ENABLED</b><br />
+Type: `bool`<br />
+
+Set this to `true` to enable OpenTelemetry tracing on the Gateway.
+When enabled, the Gateway exports spans to the configured OpenTelemetry
+collector. Defaults to false.
+
+### opentelemetry.traces.exporter
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_EXPORTER</b><br />
+Type: `string`<br />
+
+Transport used to send telemetry data to the OpenTelemetry collector
+over OTLP. Must match the protocol the collector is configured to accept.
+Valid values are "grpc" or "http". Defaults to "grpc".
+
+### opentelemetry.traces.endpoint
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_ENDPOINT</b><br />
+Type: `string`<br />
+
+OpenTelemetry collector endpoint to connect to.
+Defaults to "localhost:4317".
+
+### opentelemetry.traces.headers
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_HEADERS</b><br />
+Type: `map[string]string`<br />
+
+A map of headers that will be sent with HTTP requests to the collector.
+
+### opentelemetry.traces.connection_timeout
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_CONNECTIONTIMEOUT</b><br />
+Type: `int`<br />
+
+Timeout for establishing a connection to the collector.
+Defaults to 1 second.
+
+### opentelemetry.traces.resource_name
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_RESOURCENAME</b><br />
+Type: `string`<br />
+
+The "Resource" or "Service" Name that will be assigned to the Gateway in
+traces and metrics. This is used to identify OpenTelemetry data generated
+by Tyk Gateway. It typically appears as `service.name` in backends
+such as Jaeger, Tempo or Prometheus.
+Defaults to "tyk".
+
+### opentelemetry.traces.tls
+TLS configuration used by the exporter to authenticate the OpenTelemetry collector
+
+### opentelemetry.traces.tls.enable
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_TLS_ENABLE</b><br />
+Type: `bool`<br />
+
+Set this to `true` to enable TLS for the connection to the OpenTelemetry
+collector. Defaults to false.
+
+### opentelemetry.traces.tls.insecure_skip_verify
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_TLS_INSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Set to `true` to disable verification of the server’s certificate chain. Not recommended for production environments.
+Defaults to false.
+
+### opentelemetry.traces.tls.ca_file
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_TLS_CAFILE</b><br />
+Type: `string`<br />
+
+Filesystem path to a PEM-encoded CA certificate used to verify the
+OpenTelemetry collector's TLS certificate. Only filesystem paths are
+accepted; certificate IDs from the Tyk Certificate Store are not
+supported.
+
+### opentelemetry.traces.tls.cert_file
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_TLS_CERTFILE</b><br />
+Type: `string`<br />
+
+Path to the cert file.
+
+### opentelemetry.traces.tls.key_file
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_TLS_KEYFILE</b><br />
+Type: `string`<br />
+
+Path to the key file.
+
+### opentelemetry.traces.tls.max_version
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_TLS_MAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.3".
+
+### opentelemetry.traces.tls.min_version
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_TLS_MINVERSION</b><br />
+Type: `string`<br />
+
+Minimum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.2".
+
+### opentelemetry.traces.span_processor_type
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_SPANPROCESSORTYPE</b><br />
+Type: `string`<br />
+
+Type of the span processor to use. Valid values are "simple" or "batch".
+Defaults to "batch".
+
+### opentelemetry.traces.span_batch_config
+Configuration for the batch span processor.
+Only applies when SpanProcessorType is "batch".
+
+### opentelemetry.traces.span_batch_config.max_queue_size
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_SPANBATCHCONFIG_MAXQUEUESIZE</b><br />
+Type: `int`<br />
+
+MaxQueueSize is the maximum queue size to buffer spans for delayed processing.
+If the queue gets full it drops the spans.
+The default value is 2048.
+
+### opentelemetry.traces.span_batch_config.max_export_batch_size
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_SPANBATCHCONFIG_MAXEXPORTBATCHSIZE</b><br />
+Type: `int`<br />
+
+MaxExportBatchSize is the maximum number of spans to process in a single batch.
+If there are more than one batch worth of spans then it processes multiple batches
+of spans one batch after the other without any delay.
+The default value is 512.
+
+### opentelemetry.traces.span_batch_config.batch_timeout
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_SPANBATCHCONFIG_BATCHTIMEOUT</b><br />
+Type: `int`<br />
+
+BatchTimeout is the maximum duration for constructing a batch. Processor
+forcefully sends available spans when timeout is reached.
+The default value is 5 seconds.
+
+### opentelemetry.traces.context_propagation
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_CONTEXTPROPAGATION</b><br />
+Type: `string`<br />
+
+Type of the context propagator to use. Valid values are:
+- "tracecontext": tracecontext is a propagator that supports the W3C
+Trace Context format (https://www.w3.org/TR/trace-context/).
+- "b3": b3 is a propagator serializes SpanContext to/from B3 multi Headers format.
+- "custom": custom propagator reads from and writes to a custom header only.
+- "composite": composite propagator reads from custom header (priority) or standard headers,
+  and writes to both custom and standard headers.
+Defaults to "tracecontext".
+
+### opentelemetry.traces.custom_trace_header
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_CUSTOMTRACEHEADER</b><br />
+Type: `string`<br />
+
+Name of custom header to use for trace ID instead of standard "traceparent".
+When set with context_propagation="custom", the gateway will extract trace context
+from this header and propagate it using the same custom header.
+When set with context_propagation="tracecontext" or "b3", the gateway will extract
+trace context from this header (priority) or standard headers (fallback), and propagate
+using standard headers only.
+When set with context_propagation="composite", the gateway will extract trace context
+from this header (priority) or standard headers (fallback), and propagate using both
+custom and standard headers.
+Example: "X-Correlation-ID", "X-Request-ID", "X-Trace-ID"
+
+The header value should be a valid OpenTelemetry Trace ID: a 32-character (16-byte)
+lowercase hex string with at least one non-zero byte
+(e.g. "0102030405060708090a0b0c0d0e0f10"). UUIDs with dashes are also accepted
+(e.g. "550e8400-e29b-41d4-a716-446655440000") — dashes are removed automatically.
+See: https://opentelemetry.io/docs/specs/otel/trace/api/
+
+If the value contains non-hex characters, those characters will be stripped and the
+remaining hex characters will be zero-padded to 32 characters. This means arbitrary
+strings like "my-request-id" will NOT produce a predictable trace ID. To ensure
+trace ID consistency between the custom header and the reported trace, always send
+a valid OpenTelemetry Trace ID or UUID.
+
+### opentelemetry.traces.sampling
+Defines the configurations to use in the sampler.
+
+### opentelemetry.traces.sampling.type
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_SAMPLING_TYPE</b><br />
+Type: `string`<br />
+
+Refers to the policy used by OpenTelemetry to determine
+whether a particular trace should be sampled or not. It's determined at the
+start of a trace and the decision is propagated down the trace. Valid Values are:
+AlwaysOn, AlwaysOff and TraceIDRatioBased. It defaults to AlwaysOn.
+
+### opentelemetry.traces.sampling.rate
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_SAMPLING_RATE</b><br />
+Type: `float64`<br />
+
+Parameter for the TraceIDRatioBased sampler type and represents the percentage
+of traces to be sampled. The value should fall between 0.0 (0%) and 1.0 (100%). For instance, if
+the sampling rate is set to 0.5, the sampler will aim to sample approximately 50% of the traces.
+By default, it's set to 0.5.
+
+### opentelemetry.traces.sampling.parent_based
+ENV: <b>TYK_GW_OPENTELEMETRY_TRACES_SAMPLING_PARENTBASED</b><br />
+Type: `bool`<br />
+
+Rule that ensures that if we decide to record data for a particular operation,
+we'll also record data for all the subsequent work that operation causes (its "child spans").
+This approach helps in keeping the entire story of a transaction together. Typically, ParentBased
+is used in conjunction with TraceIDRatioBased. Using it with AlwaysOn or AlwaysOff might not be as
+effective since, in those cases, you're either recording everything or nothing, and there are no
+intermediary decisions to consider. The default value for this option is false.
+
+### opentelemetry.metrics
+Metrics holds the OpenTelemetry metrics configuration.
+
+### opentelemetry.metrics.enabled
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_ENABLED</b><br />
+Type: `bool`<br />
+
+A flag that can be used to enable or disable metrics export.
+Must be explicitly set to true to enable metrics. If omitted (nil), metrics are disabled.
+
+### opentelemetry.metrics.exporter
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_EXPORTER</b><br />
+Type: `string`<br />
+
+Transport used to send telemetry data to the OpenTelemetry collector
+over OTLP. Must match the protocol the collector is configured to accept.
+Valid values are "grpc" or "http". Defaults to "grpc".
+
+### opentelemetry.metrics.endpoint
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_ENDPOINT</b><br />
+Type: `string`<br />
+
+OpenTelemetry collector endpoint to connect to.
+Defaults to "localhost:4317".
+
+### opentelemetry.metrics.headers
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_HEADERS</b><br />
+Type: `map[string]string`<br />
+
+A map of headers that will be sent with HTTP requests to the collector.
+
+### opentelemetry.metrics.connection_timeout
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_CONNECTIONTIMEOUT</b><br />
+Type: `int`<br />
+
+Timeout for establishing a connection to the collector.
+Defaults to 1 second.
+
+### opentelemetry.metrics.resource_name
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_RESOURCENAME</b><br />
+Type: `string`<br />
+
+The "Resource" or "Service" Name that will be assigned to the Gateway in
+traces and metrics. This is used to identify OpenTelemetry data generated
+by Tyk Gateway. It typically appears as `service.name` in backends
+such as Jaeger, Tempo or Prometheus.
+Defaults to "tyk".
+
+### opentelemetry.metrics.tls
+TLS configuration used by the exporter to authenticate the OpenTelemetry collector
+
+### opentelemetry.metrics.tls.enable
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_TLS_ENABLE</b><br />
+Type: `bool`<br />
+
+Set this to `true` to enable TLS for the connection to the OpenTelemetry
+collector. Defaults to false.
+
+### opentelemetry.metrics.tls.insecure_skip_verify
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_TLS_INSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Set to `true` to disable verification of the server’s certificate chain. Not recommended for production environments.
+Defaults to false.
+
+### opentelemetry.metrics.tls.ca_file
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_TLS_CAFILE</b><br />
+Type: `string`<br />
+
+Filesystem path to a PEM-encoded CA certificate used to verify the
+OpenTelemetry collector's TLS certificate. Only filesystem paths are
+accepted; certificate IDs from the Tyk Certificate Store are not
+supported.
+
+### opentelemetry.metrics.tls.cert_file
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_TLS_CERTFILE</b><br />
+Type: `string`<br />
+
+Path to the cert file.
+
+### opentelemetry.metrics.tls.key_file
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_TLS_KEYFILE</b><br />
+Type: `string`<br />
+
+Path to the key file.
+
+### opentelemetry.metrics.tls.max_version
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_TLS_MAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.3".
+
+### opentelemetry.metrics.tls.min_version
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_TLS_MINVERSION</b><br />
+Type: `string`<br />
+
+Minimum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.2".
+
+### opentelemetry.metrics.export_interval
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_EXPORTINTERVAL</b><br />
+Type: `int`<br />
+
+The interval in seconds at which metrics are exported.
+Defaults to 60 seconds.
+
+### opentelemetry.metrics.temporality
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_TEMPORALITY</b><br />
+Type: `string`<br />
+
+Temporality defines the aggregation temporality for metrics.
+Valid values are "cumulative" (default) or "delta".
+Cumulative is preferred for Prometheus-style backends.
+Delta is preferred for some cloud backends like AWS CloudWatch.
+
+### opentelemetry.metrics.shutdown_timeout
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_SHUTDOWNTIMEOUT</b><br />
+Type: `int`<br />
+
+ShutdownTimeout is the timeout in seconds for graceful shutdown of the exporter.
+Defaults to 30 seconds.
+
+### opentelemetry.metrics.retry
+Retry configuration for exporter failures.
+
+### opentelemetry.metrics.retry.enabled
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_RETRY_ENABLED</b><br />
+Type: `bool`<br />
+
+Enabled enables retry on export failures.
+Defaults to true.
+
+### opentelemetry.metrics.retry.initial_interval
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_RETRY_INITIALINTERVAL</b><br />
+Type: `int`<br />
+
+InitialInterval is the initial backoff interval in milliseconds.
+Defaults to 5000 (5 seconds).
+
+### opentelemetry.metrics.retry.max_interval
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_RETRY_MAXINTERVAL</b><br />
+Type: `int`<br />
+
+MaxInterval is the maximum backoff interval in milliseconds.
+Defaults to 30000 (30 seconds).
+
+### opentelemetry.metrics.retry.max_elapsed_time
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_RETRY_MAXELAPSEDTIME</b><br />
+Type: `int`<br />
+
+MaxElapsedTime is the maximum total time in milliseconds to keep retrying.
+After this duration, the export is abandoned.
+Defaults to 60000 (1 minute).
+
+### opentelemetry.metrics.cardinality_limit
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_CARDINALITYLIMIT</b><br />
+Type: `int`<br />
+
+CardinalityLimit sets the maximum number of unique attribute combinations
+(data points) allowed per metric instrument.
+Zero or negative means no limit. Defaults to 2000.
+
+### opentelemetry.metrics.runtime_metrics
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_RUNTIMEMETRICS</b><br />
+Type: `bool`<br />
+
+RuntimeMetrics enables Go runtime metrics collection (goroutines, memory, GC).
+Defaults to true when metrics are enabled.
+
+### opentelemetry.metrics.api_metrics
+ENV: <b>TYK_GW_OPENTELEMETRY_METRICS_APIMETRICS</b><br />
+Type: `apimetrics.APIMetricDefinitions`<br />
+
+APIMetrics defines the metric instruments created at startup.
+Each instrument has its own dimension scope — only declared dimensions are recorded.
+
+Slice semantics:
+  nil (field omitted)  → default RED instruments created
+  empty slice          → no API metrics (explicitly disabled)
+  populated slice      → only configured instruments
+
+### newrelic.app_name
+ENV: <b>TYK_GW_NEWRELIC_APPNAME</b><br />
+Type: `string`<br />
+
+New Relic Application name
+
+### newrelic.license_key
+ENV: <b>TYK_GW_NEWRELIC_LICENSEKEY</b><br />
+Type: `string`<br />
+
+New Relic License key
+
+### newrelic.enable_distributed_tracing
+ENV: <b>TYK_GW_NEWRELIC_ENABLEDISTRIBUTEDTRACING</b><br />
+Type: `bool`<br />
+
+Enable distributed tracing
+
+### enable_http_profiler
+ENV: <b>TYK_GW_HTTPPROFILE</b><br />
+Type: `bool`<br />
+
+Enable debugging of your Tyk Gateway by exposing profiling information through https://tyk.io/docs/api-management/troubleshooting-debugging
+
+### use_redis_log
+ENV: <b>TYK_GW_USEREDISLOG</b><br />
+Type: `bool`<br />
+
+Enables the real-time Gateway log view in the Dashboard.
+
+<Note>
+
+For logs to appear in the Tyk Dashboard, both the Gateway and the Dashboard must be configured to use the **same Redis instance**.
+In deployments where the Data Plane (Gateway) and Control Plane (Dashboard) use separate Redis instances,
+enabling this option on the Gateway will not make logs available in the Dashboard.
+</Note>
+
+### use_sentry
+ENV: <b>TYK_GW_USESENTRY</b><br />
+Type: `bool`<br />
+
+Enable Sentry logging
+
+### sentry_code
+ENV: <b>TYK_GW_SENTRYCODE</b><br />
+Type: `string`<br />
+
+Sentry API code
+
+### sentry_log_level
+ENV: <b>TYK_GW_SENTRYLOGLEVEL</b><br />
+Type: `string`<br />
+
+Log verbosity for Sentry logging
+
+### use_syslog
+ENV: <b>TYK_GW_USESYSLOG</b><br />
+Type: `bool`<br />
+
+Enable Syslog log output
+
+### syslog_transport
+ENV: <b>TYK_GW_SYSLOGTRANSPORT</b><br />
+Type: `string`<br />
+
+Syslong transport to use. Values: tcp or udp.
+
+### syslog_network_addr
+ENV: <b>TYK_GW_SYSLOGNETWORKADDR</b><br />
+Type: `string`<br />
+
+Graylog server address
+
+### use_graylog
+ENV: <b>TYK_GW_USEGRAYLOG</b><br />
+Type: `bool`<br />
+
+Use Graylog log output
+
+### graylog_network_addr
+ENV: <b>TYK_GW_GRAYLOGNETWORKADDR</b><br />
+Type: `string`<br />
+
+Graylog server address
+
+### use_logstash
+ENV: <b>TYK_GW_USELOGSTASH</b><br />
+Type: `bool`<br />
+
+Use logstash log output
+
+### logstash_transport
+ENV: <b>TYK_GW_LOGSTASHTRANSPORT</b><br />
+Type: `string`<br />
+
+Logstash network transport. Values: tcp or udp.
+
+### logstash_network_addr
+ENV: <b>TYK_GW_LOGSTASHNETWORKADDR</b><br />
+Type: `string`<br />
+
+Logstash server address
+
+### track_404_logs
+ENV: <b>TYK_GW_TRACK404LOGS</b><br />
+Type: `bool`<br />
+
+Show 404 HTTP errors in your Gateway application logs
+
+### statsd_connection_string
+ENV: <b>TYK_GW_STATSDCONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+Address of StatsD server. If set enable statsd monitoring.
+
+### statsd_prefix
+ENV: <b>TYK_GW_STATSDPREFIX</b><br />
+Type: `string`<br />
+
+StatsD prefix
+
+### event_handlers
+ENV: <b>TYK_GW_EVENTHANDLERS</b><br />
+Type: `apidef.EventHandlerMetaConfig`<br />
+
+Event System
+
+### hide_generator_header
+ENV: <b>TYK_GW_HIDEGENERATORHEADER</b><br />
+Type: `bool`<br />
+
+HideGeneratorHeader will mask the 'X-Generator' and 'X-Mascot-...' headers, if set to true.
+
+### force_global_session_lifetime
+ENV: <b>TYK_GW_FORCEGLOBALSESSIONLIFETIME</b><br />
+Type: `bool`<br />
+
+Enable global API token expiration. Can be needed if all your APIs using JWT or oAuth 2.0 auth methods with dynamically generated keys.
+
+### session_lifetime_respects_key_expiration
+ENV: <b>TYK_GW_SESSIONLIFETIMERESPECTSKEYEXPIRATION</b><br />
+Type: `bool`<br />
+
+SessionLifetimeRespectsKeyExpiration respects the key expiration time when the session lifetime is less than the key expiration. That is, Redis waits the key expiration for physical removal.
+
+### global_session_lifetime
+ENV: <b>TYK_GW_GLOBALSESSIONLIFETIME</b><br />
+Type: `int64`<br />
+
+global session lifetime, in seconds.
+
+### kv.KV
+ENV: <b>TYK_GW_KV_KV</b><br />
+Type: `struct`<br />
+
+See more details https://tyk.io/docs/tyk-self-managed/#store-configuration-with-key-value-store
+
+### kv.consul.address
+ENV: <b>TYK_GW_KV_CONSUL_ADDRESS</b><br />
+Type: `string`<br />
+
+Address is the address of the Consul server
+
+### kv.consul.scheme
+ENV: <b>TYK_GW_KV_CONSUL_SCHEME</b><br />
+Type: `string`<br />
+
+Scheme is the URI scheme for the Consul server
+
+### kv.consul.datacenter
+ENV: <b>TYK_GW_KV_CONSUL_DATACENTER</b><br />
+Type: `string`<br />
+
+The datacenter to use. If not provided, the default agent datacenter is used.
+
+### kv.consul.http_auth.username
+ENV: <b>TYK_GW_KV_CONSUL_HTTPAUTH_USERNAME</b><br />
+Type: `string`<br />
+
+Username to use for HTTP Basic Authentication
+
+### kv.consul.http_auth.password
+ENV: <b>TYK_GW_KV_CONSUL_HTTPAUTH_PASSWORD</b><br />
+Type: `string`<br />
+
+Password to use for HTTP Basic Authentication
+
+### kv.consul.tls_config.address
+ENV: <b>TYK_GW_KV_CONSUL_TLSCONFIG_ADDRESS</b><br />
+Type: `string`<br />
+
+Address
+
+### kv.consul.tls_config.ca_file
+ENV: <b>TYK_GW_KV_CONSUL_TLSCONFIG_CAFILE</b><br />
+Type: `string`<br />
+
+CA file
+
+### kv.consul.tls_config.ca_path
+ENV: <b>TYK_GW_KV_CONSUL_TLSCONFIG_CAPATH</b><br />
+Type: `string`<br />
+
+CA Path
+
+### kv.consul.tls_config.cert_file
+ENV: <b>TYK_GW_KV_CONSUL_TLSCONFIG_CERTFILE</b><br />
+Type: `string`<br />
+
+Cert file
+
+### kv.consul.tls_config.key_file
+ENV: <b>TYK_GW_KV_CONSUL_TLSCONFIG_KEYFILE</b><br />
+Type: `string`<br />
+
+Key file
+
+### kv.consul.tls_config.insecure_skip_verify
+ENV: <b>TYK_GW_KV_CONSUL_TLSCONFIG_INSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Disable TLS validation
+
+### kv.vault.token
+ENV: <b>TYK_GW_KV_VAULT_TOKEN</b><br />
+Type: `string`<br />
+
+Token is the vault root token
+
+### kv.vault.kv_version
+ENV: <b>TYK_GW_KV_VAULT_KVVERSION</b><br />
+Type: `int`<br />
+
+KVVersion is the version number of Vault. Usually defaults to 2
+
+### secrets
+ENV: <b>TYK_GW_SECRETS</b><br />
+Type: `map[string]string`<br />
+
+Secrets configures a list of key/value pairs for the gateway.
+When configuring it via environment variable, the expected value
+is a comma separated list of key-value pairs delimited with a colon.
+
+Example: `TYK_GW_SECRETS=key1:value1,key2:/value2`
+Produces: `{"key1": "value1", "key2": "/value2"}`
+
+The secret value may be used as `secrets://key1` from the API definition.
+In versions before gateway 5.3, only `listen_path` and `target_url` fields
+have had the secrets replaced.
+See more details https://tyk.io/docs/tyk-self-managed/#how-to-access-the-externally-stored-data
+
+### override_messages
+Override the default error code and or message returned by middleware.
+The following message IDs can be used to override the message and error codes:
+
+AuthToken message IDs
+* `auth.auth_field_missing`
+* `auth.key_not_found`
+
+OIDC message IDs
+* `oauth.auth_field_missing`
+* `oauth.auth_field_malformed`
+* `oauth.key_not_found`
+* `oauth.client_deleted`
+
+Sample Override Message Setting
+```
+"override_messages": {
+  "oauth.auth_field_missing" : {
+   "code": 401,
+   "message": "Token is not authorized"
+ }
+}
+```
+
+### error_overrides
+ENV: <b>TYK_GW_ERROROVERRIDES</b><br />
+Type: `apidef.ErrorOverridesMap`<br />
+
+ErrorOverrides allows you to customize the error responses that the Gateway will return to API clients.
+This configuration will be used to override both Gateway-generated errors (e.g. authentication failures, rate limits, validation errors)
+and errors returned by the upstream service (4xx/5xx responses from backend APIs).
+Rules are organized by HTTP status code and can include additional matching criteria.
+These rules will be superseded by any overrides configured in the API definition
+
+Sample Override Setting
+```
+"error_overrides": {
+  "500": [{
+    "response": {
+      "status_code": 503,
+      "body": "{\"error\": \"Service temporarily unavailable\"}"
+    }
+  }]
+}
+```
+
+### cloud
+ENV: <b>TYK_GW_CLOUD</b><br />
+Type: `bool`<br />
+
+Cloud flag shows the Gateway runs in Tyk Cloud.
+
+### jwt_ssl_insecure_skip_verify
+ENV: <b>TYK_GW_JWTSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Skip TLS verification for JWT JWKs url validation
+
+### resource_sync
+ResourceSync configures mitigation strategy in case sync fails.
+
+### resource_sync.retry_attempts
+ENV: <b>TYK_GW_RESOURCESYNC_RETRYATTEMPTS</b><br />
+Type: `int`<br />
+
+RetryAttempts defines the number of retries that the Gateway
+should perform during a resource sync (APIs or policies), defaulting
+to zero which means no retries are attempted.
+
+### resource_sync.interval
+ENV: <b>TYK_GW_RESOURCESYNC_INTERVAL</b><br />
+Type: `int`<br />
+
+Interval configures the interval in seconds between each retry on a resource sync error.
+
+### oas_config
+OAS holds the configuration for various OpenAPI-specific functionalities
+
+### oas_config.validate_examples
+ENV: <b>TYK_GW_OAS_VALIDATEEXAMPLES</b><br />
+Type: `bool`<br />
+
+ValidateExamples enables validation of values provided in `example` and `examples` fields against the declared schemas in the OpenAPI Document. Defaults to false.
+
+### oas_config.validate_schema_defaults
+ENV: <b>TYK_GW_OAS_VALIDATESCHEMADEFAULTS</b><br />
+Type: `bool`<br />
+
+ValidateSchemaDefaults enables validation of values provided in `default` fields against the declared schemas in the OpenAPI Document. Defaults to false.
+
+### streaming
+Streaming holds the configuration for Tyk Streaming functionalities
+
+### streaming.enabled
+ENV: <b>TYK_GW_STREAMING_ENABLED</b><br />
+Type: `bool`<br />
+
+This flag enables the Tyk Streaming feature.
+
+### streaming.allow_unsafe
+ENV: <b>TYK_GW_STREAMING_ALLOWUNSAFE</b><br />
+Type: `[]string`<br />
+
+AllowUnsafe specifies a list of potentially unsafe streaming components that should be allowed in the configuration.
+By default, components that could pose security risks (like file access, subprocess execution, socket operations, etc.)
+are filtered out. This field allows administrators to explicitly permit specific unsafe components when needed.
+Use with caution as enabling unsafe components may introduce security vulnerabilities.
+
+### jwks
+JWKS holds the configuration for Tyk JWKS functionalities
+
+### jwks.cache
+Cache holds configuration for JWKS caching
+
+### jwks.cache.timeout
+ENV: <b>TYK_GW_JWKS_CACHE_TIMEOUT</b><br />
+Type: `int64`<br />
+
+Timeout defines how long the JWKS will be kept in the cache before forcing a refresh from the JWKS endpoint.
+Default is 240 seconds (4 minutes). Set to 0 to use the default value.
+
+### allow_unsafe_policy_ids
+ENV: <b>TYK_GW_ALLOWUNSAFEPOLICYIDS</b><br />
+Type: `bool`<br />
+
+AllowUnsafePolicyIds allows the use of non-standard characters in policy identifiers (default: false).
+The standard characters are alphanumeric characters plus underscore (_), hyphen (-), dot (.) and tilde (~).
+The use of other characters in IDs can cause unpredictable behavior and is not recommended.
+
diff --git a/snippets/grpc-include.mdx b/snippets/grpc-include.mdx
new file mode 100644
index 0000000000..f854c5ce64
--- /dev/null
+++ b/snippets/grpc-include.mdx
@@ -0,0 +1,91 @@
+---
+---
+
+**Configure Tyk**
+
+You will need to modify the Tyk global configuration file `tyk.conf` to use gRPC plugins. The following block should be present in this file:
+
+```{.copyWrapper}
+"coprocess_options": {
+    "enable_coprocess": true,
+    "coprocess_grpc_server": "tcp://localhost:5555"
+},
+"enable_bundle_downloader": true,
+"bundle_base_url": "http://localhost/bundles/",
+"public_key_path": ""
+```
+
+
+**tyk.conf Options**
+
+* `enable_coprocess`: This enables the plugin.
+* `coprocess_grpc_server`: This is the URL of our gRPC server.
+* `enable_bundle_downloader`: This enables the bundle downloader.
+* `bundle_base_url`: This is a base URL that will be used to download the bundle. You should replace the bundle_base_url with the appropriate URL of the web server that's serving your plugin bundles. For now HTTP and HTTPS are supported but we plan to add more options in the future (like pulling directly from S3 buckets).
+* `public_key_path`: Modify `public_key_path` in case you want to enforce the cryptographic check of the plugin bundle signatures. If the `public_key_path` isn't set, the verification process will be skipped and unsigned plugin bundles will be loaded normally.
+
+
+**Configure an API Definition**
+
+There are two important parameters that we need to add or modify in the API definition.
+The first one is `custom_middleware_bundle` which must match the name of the plugin bundle file. If we keep this with the default name that the Tyk CLI tool uses, it will be `bundle.zip`:
+
+```{.copyWrapper}
+"custom_middleware_bundle": "bundle.zip"
+```
+
+Assuming the `bundle_base_url` is `http://localhost/bundles/`, Tyk will use the following URL to download our file:
+
+`http://localhost/bundles/bundle.zip`
+
+The second parameter is specific to this tutorial, and should be used in combination with `use_keyless` to allow an API to authenticate against our plugin:
+
+```{.copyWrapper}
+"use_keyless": false,
+"enable_coprocess_auth": true
+```
+
+
+`enable_coprocess_auth` will instruct the Tyk gateway to authenticate this API using the associated custom authentication function that's implemented by our plugin.
+
+**Configuration via the Tyk Dashboard**
+
+To attach the plugin to an API, from the **Advanced Options** tab in the **API Designer** enter `bundle.zip` in the **Plugin Bundle ID** field.
+
+<img src="/img/2.10/plugin_bundle_id.png" alt="Plugin Options" />
+
+We also need to modify the authentication mechanism that's used by the API.
+From the **Core Settings** tab in the **API Designer** select **Use Custom Authentication (Python, CoProcess, and JSVM plugins)** from the **Target Details - Authentication Mode** drop-down list. 
+
+<img src="/img/2.10/custom_auth_python.png" alt="Advanced Options" />
+
+**Testing the Plugin**
+
+
+At this point we have our test HTTP server ready to serve the plugin bundle and the configuration with all the required parameters.
+The final step is to start or restart the **Tyk Gateway** (this may vary depending on how you set up Tyk):
+
+```{.copyWrapper}
+service tyk-gateway start
+```
+
+
+A simple CURL request will be enough for testing our custom authentication middleware.
+
+This request will trigger an authentication error:
+
+```{.copyWrapper}
+curl http://localhost:8080/my-api/my-path -H 'Authorization: badtoken'
+```
+
+This will trigger a successful authentication. We're using the token that's specified in our server implementation (see line 57 in `Server.cs`):
+
+
+```{.copyWrapper}
+curl http://localhost:8080/my-api/my-path -H 'Authorization: abc123'
+```
+
+We also have a [GitHub repository](https://github.com/TykTechnologies/tyk-plugin-demo-java/tree/maven) that includes tests and authentication middleware.
+
+[3]: /img/dashboard/system-management/plugin_options_2.5.png
+[4]: /img/dashboard/system-management/plugin_auth_mode_2.5.png
\ No newline at end of file
diff --git a/snippets/import-api-include.mdx b/snippets/import-api-include.mdx
new file mode 100644
index 0000000000..dc7f2b7d6e
--- /dev/null
+++ b/snippets/import-api-include.mdx
@@ -0,0 +1,94 @@
+---
+---
+
+### Import API - Swagger
+
+| **Property** | **Description**           |
+| :------------ | :------------------------- |
+| Resource URL | `/api/import/swagger/`    |
+| Method       | POST                      |
+| Type         | None                      |
+| Body         | None                      |
+| Param        | None                      |
+
+#### Sample Request
+
+```{.json}
+POST /api/import/swagger/
+Host: localhost:3000
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+{
+  "swagger": "{swagger data...}",
+  "insert_into_api": false, 
+  "api_id": "internal API id",
+  "version_name": "yourversionname",
+  "upstream_url": "yourupstreamurl"
+}
+```
+
+Parameters:
+
+*   `insert_into_api`: If set to `true` the import will replace an existing API. Setting to `false` will import into a new API.
+*   `api_id`: The internal MongoDB object id for your API.
+*   `version_name`: Your versioning convention name for the imported API.
+*   `upstream_url`: The URL the API is served by.
+
+
+#### Sample Response
+
+```
+{
+  "Status": "OK",
+  "Message": "API Imported",
+  "Meta": "new_api_id"
+}
+
+```
+
+
+### Import API - Blueprint
+
+| **Property** | **Description**             |
+| :------------ | :--------------------------- |
+| Resource URL | `/api/import/blueprint/`    |
+| Method       | POST                        |
+| Type         | None                        |
+| Body         | None                        |
+| Param        | None                        |
+
+#### Sample Request
+
+```{.json}
+POST /api/import/blueprint/
+Host: localhost:3000
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+{
+  "blueprint": "{blueprint data...}",
+  "insert_into_api": false, 
+  "api_id": "internal API id",
+  "as_mock": false,
+  "version_name": "yourversionname",
+  "upstream_url": "yourupstreamurl"
+}
+```
+
+Parameters:
+
+*   `insert_into_api`: If set to `true` the import will replace an existing API. Setting to `false` will import into a new API.
+*   `api_id`: The internal MongoDB object id for your API.
+*   `as_mock`: If set to true, enables our mocking support for Blueprint imported API. See **Mocks** above for more details.
+*   `version_name`: Your versioning convention name for the imported API.
+*   `upstream_url`: The URL the API is served by.
+
+
+#### Sample Response
+
+```
+{
+  "Status": "OK",
+  "Message": "API Imported",
+  "Meta": "new_api_id"
+}
+
+```
+
diff --git a/snippets/index.mdx b/snippets/index.mdx
new file mode 100644
index 0000000000..2e638d31e0
--- /dev/null
+++ b/snippets/index.mdx
@@ -0,0 +1,5 @@
+---
+date: 2017-03-09T11:10:21Z
+Title: Shared resources
+headless: true
+---
\ No newline at end of file
diff --git a/snippets/legacy-classic-portal-api.mdx b/snippets/legacy-classic-portal-api.mdx
new file mode 100644
index 0000000000..f62162a89f
--- /dev/null
+++ b/snippets/legacy-classic-portal-api.mdx
@@ -0,0 +1,16 @@
+---
+---
+
+
+<Warning>
+**Legacy: Tyk Classic Portal**
+
+You're viewing documentation for the **Tyk Classic Portal**, which is no longer actively maintained.
+
+If you're looking for the latest API documentation for the **new Tyk Developer Portal**, please refer to the 
+[Postman collection](/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api) or visit the 
+[Tyk Developer Portal](/portal/overview/intro) section.
+
+The Classic Portal is in maintenance mode and will be deprecated soon. For questions or support, contact us at 
+[support@tyk.io](<mailto:support@tyk.io?subject=Tyk classic developer portal>).
+</Warning>
diff --git a/snippets/mdcb-config.mdx b/snippets/mdcb-config.mdx
new file mode 100644
index 0000000000..4c50ccb0a5
--- /dev/null
+++ b/snippets/mdcb-config.mdx
@@ -0,0 +1,735 @@
+### listen_port
+ENV: <b>TYK_MDCB_LISTENPORT</b><br />
+Type: `int`<br />
+
+The RPC port to which Data Plane Gateways will connect. You must open this port to accept connections via your firewall.<br />Default if not set: 9091.
+
+### healthcheck_port
+ENV: <b>TYK_MDCB_HEALTHCHECKPORT</b><br />
+Type: `int`<br />
+
+This port lets MDCB allow standard health checks.<br />Default if not set: 8181.
+Deprecated: Use `http_port` instead.
+
+### healthcheck
+Healthcheck settings
+
+### healthcheck.cache_renewal_period
+ENV: <b>TYK_MDCB_HEALTHCHECK_CACHERENEWALPERIOD</b><br />
+Type: `int`<br />
+
+Specifies the time interval (in seconds) at which the healthchecker refreshes its cached health status information (redis and DB).
+
+### http_port
+ENV: <b>TYK_MDCB_HTTPPORT</b><br />
+Type: `int`<br />
+
+The HTTP port exposes different endpoints for monitoring and debugging MDCB. The default value is 8181.
+Exposed endpoints include:
+* /health - Provides the health status of MDCB.
+* /dataplanes - Provides information about the dataplanes connected to MDCB (`security.enable_http_secure_endpoints` must be enabled).
+* /debug/pprof/* - Provides profiling information (`enable_http_profiler` must be enabled).
+
+### enable_http_profiler
+ENV: <b>TYK_MDCB_HTTPPROFILE</b><br />
+Type: `bool`<br />
+
+Enable debugging of your Tyk MDCB by exposing profiling information.
+
+### server_options
+MDCB gorpc server configuration
+
+### server_options.use_ssl
+ENV: <b>TYK_MDCB_SERVEROPTIONS_USESSL</b><br />
+Type: `bool`<br />
+
+If use_ssl is set to true, you need to enter the cert_file and key_file path names for certificate.
+
+### server_options.certificate
+cert data to expose the http server
+
+### server_options.certificate.cert_file
+ENV: <b>TYK_MDCB_SERVEROPTIONS_CERTIFICATE_CERTFILE</b><br />
+Type: `string`<br />
+
+Filesystem location for pem encoded certificate
+
+### server_options.certificate.key_file
+ENV: <b>TYK_MDCB_SERVEROPTIONS_CERTIFICATE_KEYFILE</b><br />
+Type: `string`<br />
+
+Filesystem location for pem encoded private key
+
+### server_options.min_version
+ENV: <b>TYK_MDCB_SERVEROPTIONS_MINVERSION</b><br />
+Type: `uint16`<br />
+
+The min_version setting should be the minimum TLS protocol version required from the client.<br /> For TLS 1.0 use 769<br />For TLS 1.1 use 770<br />For TLS 1.2 use 771<br />For TLS 1.3 use 772<br />See [Controlling TLS Version & Cipher Suites](https://tyk.io/docs/api-management/implement-tls#controlling-tls-version--cipher-suites) for more details.
+
+### server_options.ssl_ciphers
+ENV: <b>TYK_MDCB_SERVEROPTIONS_CIPHERS</b><br />
+Type: `[]string`<br />
+
+Is the list of names supported cipher suites (IANA) for TLS versions up to TLS 1.2. This defaults to a list of secure cipher suites.
+
+### server_options.ssl_certificates
+ENV: <b>TYK_MDCB_SERVEROPTIONS_SSLCERTIFICATES</b><br />
+Type: `[]string`<br />
+
+SSL certificates used by your MDCB server. A list of certificate IDs or path to files.
+
+### http_server_options
+HTTPServerOptions configures SSL/TLS for the HTTP server, affecting security settings.
+It applies to endpoints like /health for health checks, /dataplanes for node information
+and /debug/pprof/ for performance profiling.
+
+### http_server_options.use_ssl
+ENV: <b>TYK_MDCB_HTTPSERVEROPTIONS_USESSL</b><br />
+Type: `bool`<br />
+
+If use_ssl is set to true, you need to enter the cert_file and key_file path names for certificate.
+
+### http_server_options.certificate
+cert data to expose the http server
+
+### http_server_options.certificate.cert_file
+ENV: <b>TYK_MDCB_HTTPSERVEROPTIONS_CERTIFICATE_CERTFILE</b><br />
+Type: `string`<br />
+
+Filesystem location for pem encoded certificate
+
+### http_server_options.certificate.key_file
+ENV: <b>TYK_MDCB_HTTPSERVEROPTIONS_CERTIFICATE_KEYFILE</b><br />
+Type: `string`<br />
+
+Filesystem location for pem encoded private key
+
+### http_server_options.min_version
+ENV: <b>TYK_MDCB_HTTPSERVEROPTIONS_MINVERSION</b><br />
+Type: `uint16`<br />
+
+The min_version setting should be the minimum TLS protocol version required from the client.<br /> For TLS 1.0 use 769<br />For TLS 1.1 use 770<br />For TLS 1.2 use 771<br />For TLS 1.3 use 772<br />See [Controlling TLS Version & Cipher Suites](https://tyk.io/docs/api-management/implement-tls#controlling-tls-version--cipher-suites) for more details.
+
+### http_server_options.ssl_ciphers
+ENV: <b>TYK_MDCB_HTTPSERVEROPTIONS_CIPHERS</b><br />
+Type: `[]string`<br />
+
+Is the list of names supported cipher suites (IANA) for TLS versions up to TLS 1.2. This defaults to a list of secure cipher suites.
+
+### http_server_options.ssl_certificates
+ENV: <b>TYK_MDCB_HTTPSERVEROPTIONS_SSLCERTIFICATES</b><br />
+Type: `[]string`<br />
+
+SSL certificates used by your MDCB server. A list of certificate IDs or path to files.
+
+### security.private_certificate_encoding_secret
+ENV: <b>TYK_MDCB_SECURITY_PRIVATECERTIFICATEENCODINGSECRET</b><br />
+Type: `string`<br />
+
+If you are using encrypted private keys, this is the secret to use to decrypt them. This must match the secret used for Gateway and Dashboard as explained [here](/api-management/certificates#encryption-of-the-private-key).
+
+### storage
+This section describes your centralised Redis DB. This will act as your main key store for all of your clusters.
+
+### storage.type
+ENV: <b>TYK_MDCB_STORAGE_TYPE</b><br />
+Type: `string`<br />
+
+Currently, the only storage type supported is Redis.
+
+### storage.host
+ENV: <b>TYK_MDCB_STORAGE_HOST</b><br />
+Type: `string`<br />
+
+Hostname of your Redis server
+
+### storage.port
+ENV: <b>TYK_MDCB_STORAGE_PORT</b><br />
+Type: `int`<br />
+
+The port the Redis server is listening on.
+
+### storage.master_name
+ENV: <b>TYK_MDCB_STORAGE_MASTERNAME</b><br />
+Type: `string`<br />
+
+It defines the sentinel master name
+
+### storage.sentinel_password
+ENV: <b>TYK_MDCB_STORAGE_SENTINELPASSWORD</b><br />
+Type: `string`<br />
+
+If set, redis sentinel will authenticate using this password.
+
+### storage.username
+ENV: <b>TYK_MDCB_STORAGE_USERNAME</b><br />
+Type: `string`<br />
+
+If set, a redis connection will be established with this user. If not set then it will defaults to the default redis user
+
+### storage.password
+ENV: <b>TYK_MDCB_STORAGE_PASSWORD</b><br />
+Type: `string`<br />
+
+Optional auth password for Redis db
+
+### storage.database
+ENV: <b>TYK_MDCB_STORAGE_DATABASE</b><br />
+Type: `int`<br />
+
+By default, the database is 0. Setting the database is not supported with redis cluster. As such, if you have `storage.redis_cluster:true`, then this value should be omitted or explicitly set to 0.
+
+### storage.optimisation_max_idle
+ENV: <b>TYK_MDCB_STORAGE_MAXIDLE</b><br />
+Type: `int`<br />
+
+MDCB will open a pool of connections to Redis. This setting will configure how many connections are maintained in the pool when idle (no traffic). Set the `max_idle` value to something large, we usually leave it at around 2000 for HA deployments.
+
+### storage.optimisation_max_active
+ENV: <b>TYK_MDCB_STORAGE_MAXACTIVE</b><br />
+Type: `int`<br />
+
+In order to not over commit connections to the Redis server, we may limit the total number of active connections to Redis. We recommend for production use to set this to around 4000.
+
+### storage.enable_cluster
+ENV: <b>TYK_MDCB_STORAGE_ENABLECLUSTER</b><br />
+Type: `bool`<br />
+
+If you are using Redis cluster, enable it here to enable the slots mode.
+
+### storage.hosts
+ENV: <b>TYK_MDCB_STORAGE_HOSTS</b><br />
+Type: `map[string]string`<br />
+
+Add your Redis hosts here as a map of hostname:port. This field is required when storage.enable_cluster is set to true. example:<br />`{`<br />  `"server1": "6379",`<br />  `"server2": "6380",`<br />  `"server3": "6381"`<br />`}`
+
+### storage.addrs
+ENV: <b>TYK_MDCB_STORAGE_ADDRS</b><br />
+Type: `[]string`<br />
+
+It can be either a single address or a seed list of host:port addresses of cluster/sentinel nodes. It overrides the value of hosts.
+
+### storage.redis_use_ssl
+ENV: <b>TYK_MDCB_STORAGE_REDISUSESSL</b><br />
+Type: `bool`<br />
+
+If set, MDCB will assume the connection to Redis is encrypted. (use with Redis providers that support in-transit encryption).
+Deprecated. Use `use_ssl` instead.
+
+### storage.redis_ssl_insecure_skip_verify
+ENV: <b>TYK_MDCB_STORAGE_REDISSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Allows usage of self-signed certificates when connecting to an encrypted Redis database.
+Deprecated. Use `ssl_insecure_skip_verify` instead.
+
+### storage.timeout
+ENV: <b>TYK_MDCB_STORAGE_TIMEOUT</b><br />
+Type: `int`<br />
+
+Set a custom timeout for Redis network operations. Default value is 5 seconds.
+
+### storage.use_ssl
+ENV: <b>TYK_MDCB_STORAGE_USESSL</b><br />
+Type: `bool`<br />
+
+Enable SSL/TLS connection between Tyk MDCB & Redis.
+
+### storage.ssl_insecure_skip_verify
+ENV: <b>TYK_MDCB_STORAGE_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Disable TLS verification.
+
+### storage.ca_file
+ENV: <b>TYK_MDCB_STORAGE_CAFILE</b><br />
+Type: `string`<br />
+
+Path to the CA file.
+
+### storage.cert_file
+ENV: <b>TYK_MDCB_STORAGE_CERTFILE</b><br />
+Type: `string`<br />
+
+Path to the cert file.
+
+### storage.key_file
+ENV: <b>TYK_MDCB_STORAGE_KEYFILE</b><br />
+Type: `string`<br />
+
+Path to the key file.
+
+### storage.max_version
+ENV: <b>TYK_MDCB_STORAGE_MAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.3".
+
+### storage.min_version
+ENV: <b>TYK_MDCB_STORAGE_MINVERSION</b><br />
+Type: `string`<br />
+
+Minimum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.2".
+
+### analytics
+configuration of the store of analytics
+
+### analytics.type
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_TYPE</b><br />
+Type: `DBType`<br />
+
+Determines the storage type. It could be `mongo` or `postgres`. By default, the value is `mongo`.
+
+### analytics.connection_string
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+This is used to configure the conenction string for the storage.
+
+### analytics.table_sharding
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_TABLESHARDING</b><br />
+Type: `bool`<br />
+
+Enable table sharding for SQL Analytics
+
+### analytics.batch_size
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_BATCHSIZE</b><br />
+Type: `int`<br />
+
+Max Batch size for SQL Analytics
+
+### analytics.postgres.prefer_simple_protocol
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_POSTGRES_PREFERSIMPLEPROTOCOL</b><br />
+Type: `bool`<br />
+
+disables implicit prepared statement usage
+
+### analytics.mysql.default_string_size
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MYSQL_DEFAULTSTRINGSIZE</b><br />
+Type: `uint`<br />
+
+default size for string fields. By default set to: 256
+
+### analytics.mysql.disable_datetime_precision
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MYSQL_DISABLEDATETIMEPRECISION</b><br />
+Type: `bool`<br />
+
+disable datetime precision, which not supported before MySQL 5.6
+
+### analytics.mysql.dont_support_rename_index
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MYSQL_DONTSUPPORTRENAMEINDEX</b><br />
+Type: `bool`<br />
+
+drop & create when rename index, rename index not supported before MySQL 5.7, MariaDB
+
+### analytics.mysql.dont_support_rename_column
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MYSQL_DONTSUPPORTRENAMECOLUMN</b><br />
+Type: `bool`<br />
+
+`change` when rename column, rename column not supported before MySQL 8, MariaDB
+
+### analytics.mysql.skip_initialize_with_version
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MYSQL_SKIPINITIALIZEWITHVERSION</b><br />
+Type: `bool`<br />
+
+auto configure based on currently MySQL version
+
+### analytics.mongo_url
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOURL</b><br />
+Type: `string`<br />
+
+Connection string for MongoDB.
+
+### analytics.mongo_use_ssl
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOUSESSL</b><br />
+Type: `bool`<br />
+
+A Boolean setting for Mongo SSL support. Set to true to enable SSL.
+
+### analytics.mongo_ssl_insecure_skip_verify
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+This setting allows the use of self-signed certificates when connecting to an encrypted MongoDB database.
+
+### analytics.mongo_ssl_allow_invalid_hostnames
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOSSLALLOWINVALIDHOSTNAMES</b><br />
+Type: `bool`<br />
+
+Ignore hostname check when it differs from the original (for example with SSH tunneling). The rest of the TLS verification will still be performed
+
+### analytics.mongo_ssl_ca_file
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOSSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file with trusted root certificates
+
+### analytics.mongo_ssl_pem_keyfile
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOSSLPEMKEYFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file which contains both client certificate and private key. This is required for Mutual TLS.
+
+### analytics.mongo_session_consistency
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOSESSIONCONSISTENCY</b><br />
+Type: `string`<br />
+
+Set the consistency mode for the session, it defaults to `Strong`. The valid values are:
+* eventual
+monotonic
+
+### analytics.mongo_batch_size
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOBATCHSIZE</b><br />
+Type: `int`<br />
+
+Sets the batch size for mongo results.
+
+### analytics.driver
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_DRIVER</b><br />
+Type: `string`<br />
+
+Use `mongo-go` to use the official mongo driver. Alternatively, use `mgo` to use the old driver.
+Since v2.4.3, the default driver is `mongo-go`.
+
+### analytics.mongo_direct_connection
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGODIRECTCONNECTION</b><br />
+Type: `bool`<br />
+
+MongoDirectConnection informs whether to establish connections only with the specified seed servers,
+or to discover and establish connections with further servers within the cluster.
+If true, the client will only connect to the host provided in the ConnectionString
+and won't attempt to discover other servers within the cluster. Useful when network
+restrictions prevent discovery, such as with SSH tunneling. Default is false.
+
+### analytics.mongo_ignore_aggregations
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOIGNOREAGGREGATIONS</b><br />
+Type: `[]string`<br />
+
+List of aggregate types to exclude from storage. Aggregates in this list are dropped before being written to the collection. See [pumps.mongoaggregate.meta.ignore_aggregations](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#pumps-mongoaggregate-meta-ignore_aggregations) for detailed behavior.
+
+### analytics.mongo_enable_aggregate_self_healing
+ENV: <b>TYK_MDCB_ANALYTICSCONFIG_MONGOENABLEAGGREGATESELFHEALING</b><br />
+Type: `bool`<br />
+
+If set to true, enables self-healing for aggregate data. See [pumps.mongoaggregate.meta.enable_aggregate_self_healing](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#pumps-mongoaggregate-meta-enable_aggregate_self_healing) for detailed behavior.
+
+### hash_keys
+ENV: <b>TYK_MDCB_HASHKEYS</b><br />
+Type: `bool`<br />
+
+Set to true if you are using a hashed configuration installation of Tyk, otherwise set to false.
+
+### session_timeout
+ENV: <b>TYK_MDCB_SESSIONTIMEOUT</b><br />
+Type: `int64`<br />
+
+Number of seconds before the gateways are forced to re-login. Default is 86400 (24 hours).
+
+### invalid_key_cache_ttl
+ENV: <b>TYK_MDCB_INVALIDKEYCACHETTL</b><br />
+Type: `int`<br />
+
+Number of seconds to cache invalid session keys. When a gateway attempts to login with a non-existent or invalid key,
+it is cached to prevent repeated Redis lookups. Default is 180 seconds (3 minutes).
+Lower values (e.g., 30) allow faster recovery after Redis outages but increase Redis load from retries.
+Higher values better protect Redis from bad key hammering but delay recovery from temporary failures.
+
+### forward_analytics_to_pump
+ENV: <b>TYK_MDCB_FORWARDANALYTICSTOPUMP</b><br />
+Type: `bool`<br />
+
+Instead of sending analytics directly to MongoDB, MDCB can send analytics to Redis. This will allow [tyk-pump] (https://github.com/TykTechnologies/tyk-pump) to pull analytics from Redis and send to your own data sinks.
+
+### enable_multiple_analytics_keys
+ENV: <b>TYK_MDCB_ENABLEMULTIPLEANALYTICSKEYS</b><br />
+Type: `bool`<br />
+
+Instead of saving all the analytics in one key, this will enable to save the analytics in multiple keys. It's specially useful when you are using Redis cluster. This will work only if `forward_analytics_to_pump` is true and tyk-pump is v1.2.1+ .
+
+### dont_store_selective
+ENV: <b>TYK_MDCB_DONTSTORESELECTIVE</b><br />
+Type: `bool`<br />
+
+set to true if you don't want to store selective analytics
+
+### dont_store_aggregate
+ENV: <b>TYK_MDCB_DONTSTOREAGGREGATES</b><br />
+Type: `bool`<br />
+
+Set to true to don't store aggregate analytics
+
+### org_session_expiration
+ENV: <b>TYK_MDCB_ORGCACHEEXPIRATION</b><br />
+Type: `int`<br />
+
+Sets the organization cache expiration in minutes. By default, 60 minutes. This will only work with tyk-sink 1.9+
+
+### org_session_cleanup
+ENV: <b>TYK_MDCB_ORGCACHECLEANUP</b><br />
+Type: `int`<br />
+
+Sets the organization cache cleanup interval in minutes. By default, 60 minutes. This will only work with tyk-sink 1.9+.
+
+### license
+ENV: <b>TYK_MDCB_LICENSE</b><br />
+Type: `string`<br />
+
+Enter your license in this section so MDCB can start.
+
+### track_all_paths
+ENV: <b>TYK_MDCB_TRACKALLPATHS</b><br />
+Type: `bool`<br />
+
+Currently, analytics for an endpoint is stored only if Track Endpoint plugin is enabled on that endpoint. If `track_all_paths` is enabled, it will store analytics for all the endpoints, irrespective of Track Endpoint plugin.
+
+### store_analytics_per_minute
+ENV: <b>TYK_MDCB_STOREANALYTICSPERMINUTE</b><br />
+Type: `bool`<br />
+
+Enable to generate aggregated per minute. By default it will generate aggregate data per hour. If this option is enabled, aggregate data will be generated per minute.
+
+### ignore_tag_prefix_list
+ENV: <b>TYK_MDCB_IGNORETAGPREFIXLIST</b><br />
+Type: `[]string`<br />
+
+if set to true then it will not store analytics for tags having prefix specified in the list. **Note**: Prefix “key-” is added in the list by default. This tag is added by gateway for keys.
+
+### threshold_len_tag_list
+ENV: <b>TYK_MDCB_THRESHOLDLENTAGLIST</b><br />
+Type: `int`<br />
+
+ If number of tags in a document grows beyond `threshold_len_tag_list`, pump will throw a warning, it works for mongo aggregate pump. The warning will print top 5 common tag prefix. Default value is 1000. To disable alerts set it to -1.
+
+### omit_analytics_index_creation
+ENV: <b>TYK_MDCB_OMITANALYTICSINDEXCREATION</b><br />
+Type: `bool`<br />
+
+Set to true to disable the Mongo storages default index creation. More detailed behavior explained at https://tyk.io/docs/tyk-pump/tyk-pump-configuration/tyk-pump-dashboard-config/#omitting-indexes.
+
+### enable_separate_analytics_store
+ENV: <b>TYK_MDCB_ENABLESEPERATEANALYTICSSTORE</b><br />
+Type: `bool`<br />
+
+Set it to true if you are using a separated analytic storage in the Control Plane Gateway. If `forward_analytics_to_pump` is true, it will forward the analytics to the separated storage specified in `analytics_storage`.
+
+### analytics_storage
+This section describes your separated analytic Redis DB. It has the same fields as `storage`. It requires `enable_separate_analytics_store` set to true.
+
+### analytics_storage.type
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_TYPE</b><br />
+Type: `string`<br />
+
+Currently, the only storage type supported is Redis.
+
+### analytics_storage.host
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_HOST</b><br />
+Type: `string`<br />
+
+Hostname of your Redis server
+
+### analytics_storage.port
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_PORT</b><br />
+Type: `int`<br />
+
+The port the Redis server is listening on.
+
+### analytics_storage.master_name
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_MASTERNAME</b><br />
+Type: `string`<br />
+
+It defines the sentinel master name
+
+### analytics_storage.sentinel_password
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_SENTINELPASSWORD</b><br />
+Type: `string`<br />
+
+If set, redis sentinel will authenticate using this password.
+
+### analytics_storage.username
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_USERNAME</b><br />
+Type: `string`<br />
+
+If set, a redis connection will be established with this user. If not set then it will defaults to the default redis user
+
+### analytics_storage.password
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_PASSWORD</b><br />
+Type: `string`<br />
+
+Optional auth password for Redis db
+
+### analytics_storage.database
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_DATABASE</b><br />
+Type: `int`<br />
+
+By default, the database is 0. Setting the database is not supported with redis cluster. As such, if you have `storage.redis_cluster:true`, then this value should be omitted or explicitly set to 0.
+
+### analytics_storage.optimisation_max_idle
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_MAXIDLE</b><br />
+Type: `int`<br />
+
+MDCB will open a pool of connections to Redis. This setting will configure how many connections are maintained in the pool when idle (no traffic). Set the `max_idle` value to something large, we usually leave it at around 2000 for HA deployments.
+
+### analytics_storage.optimisation_max_active
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_MAXACTIVE</b><br />
+Type: `int`<br />
+
+In order to not over commit connections to the Redis server, we may limit the total number of active connections to Redis. We recommend for production use to set this to around 4000.
+
+### analytics_storage.enable_cluster
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_ENABLECLUSTER</b><br />
+Type: `bool`<br />
+
+If you are using Redis cluster, enable it here to enable the slots mode.
+
+### analytics_storage.hosts
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_HOSTS</b><br />
+Type: `map[string]string`<br />
+
+Add your Redis hosts here as a map of hostname:port. This field is required when storage.enable_cluster is set to true. example:<br />`{`<br />  `"server1": "6379",`<br />  `"server2": "6380",`<br />  `"server3": "6381"`<br />`}`
+
+### analytics_storage.addrs
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_ADDRS</b><br />
+Type: `[]string`<br />
+
+It can be either a single address or a seed list of host:port addresses of cluster/sentinel nodes. It overrides the value of hosts.
+
+### analytics_storage.redis_use_ssl
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_REDISUSESSL</b><br />
+Type: `bool`<br />
+
+If set, MDCB will assume the connection to Redis is encrypted. (use with Redis providers that support in-transit encryption).
+Deprecated. Use `use_ssl` instead.
+
+### analytics_storage.redis_ssl_insecure_skip_verify
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_REDISSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Allows usage of self-signed certificates when connecting to an encrypted Redis database.
+Deprecated. Use `ssl_insecure_skip_verify` instead.
+
+### analytics_storage.timeout
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_TIMEOUT</b><br />
+Type: `int`<br />
+
+Set a custom timeout for Redis network operations. Default value is 5 seconds.
+
+### analytics_storage.use_ssl
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_USESSL</b><br />
+Type: `bool`<br />
+
+Enable SSL/TLS connection between Tyk MDCB & Redis.
+
+### analytics_storage.ssl_insecure_skip_verify
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Disable TLS verification.
+
+### analytics_storage.ca_file
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_CAFILE</b><br />
+Type: `string`<br />
+
+Path to the CA file.
+
+### analytics_storage.cert_file
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_CERTFILE</b><br />
+Type: `string`<br />
+
+Path to the cert file.
+
+### analytics_storage.key_file
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_KEYFILE</b><br />
+Type: `string`<br />
+
+Path to the key file.
+
+### analytics_storage.max_version
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_MAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.3".
+
+### analytics_storage.min_version
+ENV: <b>TYK_MDCB_ANALYTICSSTORAGE_MINVERSION</b><br />
+Type: `string`<br />
+
+Minimum TLS version that is supported.
+Options: ["1.0", "1.1", "1.2", "1.3"].
+Defaults to "1.2".
+
+### log_level
+ENV: <b>TYK_MDCB_LOGLEVEL</b><br />
+Type: `string`<br />
+
+You can now set a logging level (log_level). The following levels can be set: debug, info, warn, error.
+If not set or left empty, it will default to `info`.
+
+### enable_key_logging
+ENV: <b>TYK_MDCB_ENABLEKEYLOGGING</b><br />
+Type: `bool`<br />
+
+EnableKeyLogging prints the unhashed keys without obfuscating them in the logs
+
+### sync_worker_config
+Configuration of the MDCB Synchroniser functionality introduced in MDCB v2.0.0
+
+### sync_worker_config.enabled
+ENV: <b>TYK_MDCB_SYNCWORKER_ENABLED</b><br />
+Type: `bool`<br />
+
+Enable the MDCB Synchroniser
+
+### sync_worker_config.hash_keys
+ENV: <b>TYK_MDCB_SYNCWORKER_HASHKEYS</b><br />
+Type: `bool`<br />
+
+Allows the worker to synchronize hashed API keys. Set this to true if `hash_keys` is true in dashboard and gateway configuration.
+
+### sync_worker_config.max_batch_size
+ENV: <b>TYK_MDCB_SYNCWORKER_MAXBATCHSIZE</b><br />
+Type: `int`<br />
+
+The maximum number of keys that we can fetch per batch. Default value: 1000 keys per batch.
+
+### sync_worker_config.time_between_batches
+ENV: <b>TYK_MDCB_SYNCWORKER_TIMEBETWEENBATCHES</b><br />
+Type: `int`<br />
+
+Specifies a cooldown time between batches in seconds. 0 / disabled by default.
+
+### sync_worker_config.max_workers
+ENV: <b>TYK_MDCB_SYNCWORKER_MAXWORKERS</b><br />
+Type: `int`<br />
+
+Specifies the maximum number of Groups (worker GW clusters) that can be synchronised by MDCB at the same time. Increasing this value can affect the operation of MDCB so it is recommended that you only modify this value if you need to synchronise a higher number of datacenters. Default value: 1000.
+
+### sync_worker_config.warmup_time
+ENV: <b>TYK_MDCB_SYNCWORKER_WARMUPTIME</b><br />
+Type: `int`<br />
+
+Specifies the time (in seconds) that MDCB should wait before starting to synchronise workers with the controller. This is to allow the worker nodes to load APIs and policies from local Redis before synchronising the other resources. Default value: 2 seconds.
+
+### sync_worker_config.group_key_ttl
+ENV: <b>TYK_MDCB_SYNCWORKER_GROUPKEYTTL</b><br />
+Type: `int`<br />
+
+Specifies the group key TTL in seconds. This key is used to prevent a group of gateways from re-syncing when is not required. On login (GroupLogin call), if the key doesn't exist then the sync process is triggered. If the key exists then the TTL just gets renewed. In case the cluster of gateways is down, the key will expire and get removed and if they connect again a sync process will be triggered. Default value: 180 seconds. Min value: 30 seconds.
+
+### enable_ownership
+ENV: <b>TYK_MDCB_ENABLEOWNERSHIP</b><br />
+Type: `bool`<br />
+
+Enables [API Ownership](/platform-management/api-ownership#enabling-api-ownership) in MDCB. If set, the Data Plane Gateways will load only APIs that are accessible by the user and user group associated with the Gateways' [slave_options.api_key](/tyk-oss-gateway/configuration#slave_options-api_key) used to connect to MDCB.
+
+### escape_dots_in_oas_paths
+ENV: <b>TYK_MDCB_ESCAPEDOTSINOASPATHS</b><br />
+Type: `bool`<br />
+
+When enabled, dots in OAS field names are escaped with double underscores to prevent MongoDB field name conflicts, and unescaped on read.
+
diff --git a/snippets/mongodb-versions-include.mdx b/snippets/mongodb-versions-include.mdx
new file mode 100644
index 0000000000..614bb348ad
--- /dev/null
+++ b/snippets/mongodb-versions-include.mdx
@@ -0,0 +1,12 @@
+---
+---
+
+| Tyk Version       | MongoDB Version  |
+| ----------------- | -----------------|
+| From 5.X onwards  | MongoDB 7.0.x    |
+| From 5.9 onwards  | MongoDB 8.0.x    |
+
+You can also use the following as a drop-in replacement for MongoDB:
+
+- [Amazon DocumentDB](https://aws.amazon.com/documentdb/) 3.6 and 4 engine
+- [Azure Cosmos DB for MongoDB](https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/introduction) 3.6 and 4 engine
\ No newline at end of file
diff --git a/snippets/opa-rules.mdx b/snippets/opa-rules.mdx
new file mode 100644
index 0000000000..e5bb364421
--- /dev/null
+++ b/snippets/opa-rules.mdx
@@ -0,0 +1,224 @@
+---
+title: Dashboard OPA rules
+---
+~~~rego
+# Default OPA rules
+
+package dashboard_users
+
+default request_intent = "write"
+
+request_intent = "read" { input.request.method == "GET" }
+request_intent = "read" { input.request.method == "HEAD" }
+request_intent = "delete" { input.request.method == "DELETE" }
+
+# Set of rules to define which permission is required for a given request intent.
+# read intent requires, at a minimum, the "read" permission
+
+intent_match("read", "read")
+intent_match("read", "write")
+intent_match("read", "admin")
+
+# write intent requires either the "write" or "admin" permission
+
+intent_match("write", "write")
+intent_match("write", "admin")
+
+# delete intent requires either the "write" or "admin permission
+
+intent_match("delete", "write")
+intent_match("delete", "admin")
+
+# Helper to check if the user has "admin" permissions
+
+default is_admin = false
+is_admin {
+	input.user.user_permissions["IsAdmin"] == "admin"
+}
+
+is_self_key_reset {
+	request_intent == "write"
+
+	# The path must match /users/:userId/actions/key/reset
+	path_parts := split(input.request.path, "/")
+	path_parts[2] == "users"
+	path_parts[4] == "actions"
+	path_parts[5] == "key"
+	path_parts[6] == "reset"
+
+	# The path's userId must match the currently logged-in user's id
+	path_parts[3] == input.user.id
+}
+
+is_me {
+	# The path must match GET /users/:userId
+	request_intent == "read"
+
+	path_parts := split(input.request.path, "/")
+	path_parts[2] == "users"
+
+	# The path's userId must match the currently logged-in user's id
+	path_parts[3] == input.user.id
+}
+
+# Check if the request path matches any of the known permissions.
+# input.permissions is an object passed from the Tyk Dashboard containing mapping between user permissions (“read”, “write” and “deny”) and the endpoint associated with the permission. 
+# (eg. If “deny” is the permission for Analytics, it means the user would be denied the ability to make a request to ‘/api/usage’.)
+#
+# Example object:
+#  "permissions": [
+#        {
+#            "permission": "analytics",
+#            "rx": "\\/api\\/usage"
+#        },
+#        {
+#            "permission": "analytics",
+#            "rx": "\\/api\\/uptime"
+#        }
+#        ....
+#  ]
+#
+# The input.permissions object can be extended with additional permissions (eg. you could create a permission called ‘Monitoring’ which gives “read” access to the analytics API ‘/analytics’). 
+# This is can be achieved inside this script using the array.concat function.
+request_permission[role] {
+	perm := input.permissions[_]
+	regex.match(perm.rx, input.request.path)
+	role := perm.permission
+}
+
+# --------- Start "deny" rules -----------
+
+# A deny object contains a detailed reason behind the denial.
+
+default allow = false
+allow { count(deny) == 0 }
+deny["User is not active"] {
+	not input.user.active
+}
+
+# If a request to an endpoint does not match any defined permissions, the request will be denied.
+deny[x] {
+	# Only deny if there are NO matching permissions
+	count(request_permission) == 0
+
+	# AND it's NOT a self-key-reset call
+	not is_self_key_reset
+	# AND it's NOT retrieving the user's own data
+	not is_me
+
+	# In that case, deny:
+	x := sprintf("This action is unknown. You do not have permission to access '%v'.", [input.request.path])
+}
+
+# Reset password permissions are restricted.
+deny[x] {
+	perm := request_permission[_]
+	perm != "ResetPassword"
+	# it's NOT admin
+	not is_admin
+	# AND it's NOT a self-key-reset call
+	not is_self_key_reset
+	# AND it's NOT retrieving the user's own data
+	not is_me
+	not input.user.user_permissions[perm]
+	x := sprintf("You do not have permission to access '%v'.", [input.request.path])
+}
+
+# Deny requests for non-admins if the intent does not match or does not exist.
+deny[x] {
+	# SKIP the check if it's self-key-reset
+	not is_self_key_reset
+	perm := request_permission[_]
+	not is_admin
+	not intent_match(request_intent, input.user.user_permissions[perm])
+	x := sprintf("You do not have permission to carry out '%v' operation.", [request_intent, input.request.path])
+}
+
+# If the "deny" rule is found, deny the operation for admins.
+deny[x] {
+	not is_self_key_reset
+	perm := request_permission[_]
+	is_admin
+	input.user.user_permissions[perm] == "deny"
+	x := sprintf("You do not have permission to carry out '%v' operation.", [request_intent, input.request.path])
+}
+
+# Do not allow users (excluding admin users) to reset the password of another user.
+deny[x] {
+	request_permission[_] = "ResetPassword"
+	not is_admin
+	user_id := split(input.request.path, "/")[3]
+	user_id != input.user.id
+	x := sprintf("You do not have permission to reset the password for other users.", [user_id])
+}
+
+# Do not allow admin users to reset passwords if it is not allowed in the global config
+deny[x] {
+	request_permission[_] == "ResetPassword"
+	is_admin
+	user_id := split(input.request.path, "/")[3]
+	user_id != input.user.id
+	not input.config.security.allow_admin_reset_password
+	not input.user.user_permissions["ResetPassword"]
+	x := "You do not have permission to reset the password for other users. As an admin user, this permission can be modified using OPA rules."
+}
+
+# --------- End "deny" rules ----------
+
+##################################################################################################################
+# Demo Section: Examples of rule capabilities.                                                                   #
+# The rules below are not executed until additional permissions have been assigned to the user or user group.    #
+##################################################################################################################
+# If you are testing using OPA playground, you can mock Tyk functions like this:
+#
+# TykAPIGet(path) = {}
+# TykDiff(o1,o2) = {}
+#
+# You can use this pre-built playground: https://play.openpolicyagent.org/p/T1Rcz5Ugnb
+# Example: Deny users the ability to change the API status with an additional permission.
+# Note: This rule will not be executed unless the additional permission is set.
+deny["You do not have permission to change the API status."] {
+	# Checks the additional user permission enabled with tyk_analytics config: `"additional_permissions":["test_disable_deploy"]`
+	input.user.user_permissions["test_disable_deploy"]
+	# Checks the request intent is to update the API
+	request_permission[_] == "apis"
+	request_intent == "write"
+	# Checks if the user is attempting to update the field for API status.
+	# TykAPIGet accepts API URL as an argument, e.g. to receive API object call: TykAPIGet("/api/apis/<api-id>")
+	api := TykAPIGet(input.request.path)
+	# TykDiff performs Object diff and returns JSON Merge Patch document https://tools.ietf.org/html/rfc7396
+	# eg. If only the state has changed, the diff may look like: {"active": true}
+	diff := TykDiff(api, input.request.body)
+	# Checks if API state has changed.
+	not is_null(diff.api_definition.active)
+}
+
+# Using the patch_request helper you can modify the content of the request
+# You should respond with JSON merge patch. 
+# See https://tools.ietf.org/html/rfc7396 for more details
+#
+# Example: Modify data under a certain condition by enforcing http proxy configuration for all APIs with the #external category. 
+patch_request[x] {
+	# Enforce only for users with ["test_patch_request"] permissions.
+	# Remove the ["test_patch_request"] permission to enforce the proxy configuration for all users instead of those with the permission.
+	input.user.user_permissions["test_patch_request"]
+	request_permission[_] == "apis"
+	request_intent == "write"
+	contains(input.request.body.api_definition.name, "#external")
+	isTykClassic()
+	x := {"api_definition": {"proxy": {"transport": {"proxy_url": "http://company-proxy:8080"}}}}
+}
+
+# You can create additional permissions for not only individual users, but also user groups in your rules.
+deny["Only '%v' group has permission to access this API"] {
+	# Checks for the additional user permission enabled with tyk_analytics config: '"additional_permissions":["test_admin_usergroup"]
+	input.user.user_permissions["test_admin_usergroup"]
+	# Checks that the request intent is to access the API.
+	request_permission[_] == "apis"
+	api := TykAPIGet(input.request.path)
+	# Checks that the API being accessed has the category #admin-teamA
+	contains(input.request.body.api_definition.name, "#admin-teamA")
+	# Checks for the user group name.
+	not input.user.group_name == "TeamA-Admin"
+}
+~~~
diff --git a/snippets/operator-crd-reference.mdx b/snippets/operator-crd-reference.mdx
new file mode 100644
index 0000000000..db28f1319d
--- /dev/null
+++ b/snippets/operator-crd-reference.mdx
@@ -0,0 +1,3197 @@
+{/* DO NOT EDIT. Auto-generated from the Tyk Operator CRD schemas (config/crd/bases) by the exp tyk-docs sync workflow. To change a field description, edit the Go doc-comments in tyk-operator-internal. */}
+
+## TykOasApiDefinition
+
+TykOasApiDefinitionSpec defines the desired state of TykOasApiDefinition
+
+### Top-Level Fields
+
+<ParamField body="categories[]" type="string">
+  Categories serve as identifiers for the API definitions, subsequently enabling the filtering of API listings based on these categories.
+</ParamField>
+
+### tykOAS
+
+<ParamField body="tykOAS" type="object" required>
+  TykOAS provides storage information about Tyk OAS
+</ParamField>
+
+<ParamField body="tykOAS.configmapRef" type="object" required>
+  ConfigmapRef provides information of configmap in which Tyk OAS is stored
+</ParamField>
+
+<ParamField body="tykOAS.configmapRef.keyName" type="string" required>
+  KeyName is the key of configmap in which Tyk OAS doc is stored
+</ParamField>
+
+<ParamField body="tykOAS.configmapRef.name" type="string" required>
+  Name is the name of configmap
+</ParamField>
+
+<ParamField body="tykOAS.configmapRef.namespace" type="string">
+  Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource.
+</ParamField>
+
+### certificatePinning
+
+<ParamField body="certificatePinning" type="object">
+  CertificatePinning contains the configuration related to certificate pinning. It is possible to set Kubernetes secrets containing certificates. It is used to set `upstream.certificatePinning` in Tyk OAS API Definition.
+</ParamField>
+
+<ParamField body="certificatePinning.enabled" type="boolean" required>
+  Enabled is a boolean flag, if set to `true`, it enables certificate pinning for the API. Tyk classic API definition: `certificate_pinning_disabled`
+</ParamField>
+
+<ParamField body="certificatePinning.domainToPublicKeysMapping[]" type="object">
+  DomainToPublicKeysMapping maintains the mapping of domain to pinned public keys. Tyk classic API definition: `pinned_public_keys`
+</ParamField>
+
+<ParamField body="certificatePinning.domainToPublicKeysMapping[].domain" type="string" required>
+  Domain contains the domain name.
+</ParamField>
+
+<ParamField body="certificatePinning.domainToPublicKeysMapping[].publicKeyRefs[]" type="string">
+  PublicKeyRefs holds a list of Kubernetes secret names that reside in the same namespace as current TykOasApiDefinition resource. The secret needs to be a type of TLS secret where the pinned public key is stored in `tls.crt` field. Each secret must contain a public key associated with the specified domain name. **NOTE** If you want to continue using secrets that are already created on Tyk Dashboard, specify their IDs in `publicKeys` field of TykOasApiDefinition CR. And then, Tyk Operator will merge this array which is specified through `publicKeys` field with new Tyk Secrets which will be created based on Kubernetes secrets defined in `publicKeyRefs`.
+</ParamField>
+
+<ParamField body="certificatePinning.domainToPublicKeysMapping[].publicKeys[]" type="string">
+  PublicKeys contains a list of the public keys IDs pinned to the domain name. It only accepts Tyk IDs of the public keys. If you have Kubernetes secrets containing public keys of the domain, please use `publicKeysRefs` field instead of this one. As this one only works with already existing public keys on Tyk Dashboard.
+</ParamField>
+
+### clientCertificate
+
+<ParamField body="clientCertificate" type="object">
+  ClientCertificate is used to configure client certificates settings needed for MTLS connection between Tyk and client. It is used to set `server.clientCertificate` field of Tyk OAS API
+</ParamField>
+
+<ParamField body="clientCertificate.allowlist[]" type="string">
+  Allowlist stores list of k8s secret names storing client certificates
+</ParamField>
+
+<ParamField body="clientCertificate.enabled" type="boolean">
+  Enabled activates mTLS for the API.
+</ParamField>
+
+### contextRef
+
+<ParamField body="contextRef" type="object">
+  Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
+</ParamField>
+
+<ParamField body="contextRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="contextRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+### customDomain
+
+<ParamField body="customDomain" type="object">
+  CustomDomain is the domain to bind this API to. This enforces domain matching for client requests. Tyk classic API definition: `domain`
+</ParamField>
+
+<ParamField body="customDomain.enabled" type="boolean" required>
+  Enabled allow/disallow the usage of the domain.
+</ParamField>
+
+<ParamField body="customDomain.name" type="string" required>
+  Name is the name of the domain.
+</ParamField>
+
+<ParamField body="customDomain.certificates[]" type="string">
+  Certificates defines a field for specifying certificate IDs that the Tyk can utilise to dynamically load certificates for your custom domain. Tyk classic API definition: `certificates`
+</ParamField>
+
+<ParamField body="customDomain.certificatesRef[]" type="string">
+  CertificatesRef defines a field for specifying certificates through Kubernetes secrets. Secrets need to be installed within the namespace of the TykOasApiDefinition resource.
+</ParamField>
+
+### jwtAuth
+
+<ParamField body="jwtAuth" type="object">
+  JwtAuth holds the configuration for the JWT middleware.
+</ParamField>
+
+<ParamField body="jwtAuth.defaultPoliciesRef[]" type="object">
+  DefaultPolicies is a list of policies specified using their name and namespace.
+</ParamField>
+
+<ParamField body="jwtAuth.defaultPoliciesRef[].name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="jwtAuth.defaultPoliciesRef[].namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+<ParamField body="jwtAuth.scopes" type="object">
+  Scopes holds the scope to policy mappings for a claim name.
+</ParamField>
+
+<ParamField body="jwtAuth.scopes.claimName" type="string">
+  ClaimName contains the claim name.
+</ParamField>
+
+<ParamField body="jwtAuth.scopes.scopeToPolicyMapping[]" type="object">
+  ScopeToPolicyMapping contains the mappings of scopes to policy IDs.
+</ParamField>
+
+<ParamField body="jwtAuth.scopes.scopeToPolicyMapping[].policyRef" type="object">
+  PolicyRef contains the referenced policy based on the name/namespace.
+</ParamField>
+
+<ParamField body="jwtAuth.scopes.scopeToPolicyMapping[].policyRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="jwtAuth.scopes.scopeToPolicyMapping[].policyRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+<ParamField body="jwtAuth.scopes.scopeToPolicyMapping[].scope" type="string">
+  Scope contains the scope name.
+</ParamField>
+
+### mutualTLS
+
+<ParamField body="mutualTLS" type="object">
+  MutualTLS represents the configuration for an Upstream mTLS.
+</ParamField>
+
+<ParamField body="mutualTLS.enabled" type="boolean" required>
+  Enabled indicates if MTLS should be enabled or not.
+</ParamField>
+
+<ParamField body="mutualTLS.domainToCertificateMapping[]" type="object">
+  DomainToCertificateMapping contains the configuration for an upstream server domain.
+</ParamField>
+
+<ParamField body="mutualTLS.domainToCertificateMapping[].domain" type="string" required>
+  Domain refers to the domain name of an upstream server.
+</ParamField>
+
+<ParamField body="mutualTLS.domainToCertificateMapping[].certificateID" type="string">
+  Certificate references to Tyk cert ID
+</ParamField>
+
+<ParamField body="mutualTLS.domainToCertificateMapping[].certificateRef" type="string">
+  CertificateRef references the secret containing the domain's SSL Certificate.
+</ParamField>
+
+### upstreamRequestSigning
+
+<ParamField body="upstreamRequestSigning" type="object">
+  UpstreamRequestSigning configures HMAC-based request signing for upstream requests. When enabled, it ensures requests are signed before being sent to the upstream service using hmac-sha256 algorithm.
+</ParamField>
+
+<ParamField body="upstreamRequestSigning.algorithm" type="string">
+  Algorithm for request signing. For Certificate, it can rsa-sha256. For Secret, it can be any of hmac-sha1, hmac-sha256, hmac-sha384, hmac-sha512. **Allowed values:** `hmac-sha1`, `hmac-sha256`, `hmac-sha384`, `hmac-sha512`, `rsa-sha256`.
+</ParamField>
+
+<ParamField body="upstreamRequestSigning.certificateRef" type="string">
+  CertificateRef references the secret containing SSL Certificate.
+</ParamField>
+
+<ParamField body="upstreamRequestSigning.keyId" type="string">
+  keyid is mandatory if algorithm is hmac type
+</ParamField>
+
+<ParamField body="upstreamRequestSigning.secretRef" type="object">
+  SecretRef references HMAC secret
+</ParamField>
+
+<ParamField body="upstreamRequestSigning.secretRef.keyName" type="string" required>
+  KeyName is the key of secret in which Tyk OAS doc is stored
+</ParamField>
+
+<ParamField body="upstreamRequestSigning.secretRef.name" type="string" required>
+  Name is the name of the secret
+</ParamField>
+
+<ParamField body="upstreamRequestSigning.secretRef.namespace" type="string">
+  Namespace is the namespace of secret. If Namespace is not provided, we assume that the secret is in the same namespace as TykOasApiDefinition resource.
+</ParamField>
+
+### versioning
+
+<ParamField body="versioning" type="object">
+  Versioning provides versioning information about this OAS API
+</ParamField>
+
+<ParamField body="versioning.enabled" type="boolean" required>
+  Enabled is a boolean flag, if set to true it will enable versioning of the API.
+</ParamField>
+
+<ParamField body="versioning.default" type="string">
+  Default contains the default version name if a request is issued without a version.
+</ParamField>
+
+<ParamField body="versioning.fallbackToDefault" type="boolean">
+  FallbackToDefault specifies that the default version of the OAS API should be used if the requested version does not exist."
+</ParamField>
+
+<ParamField body="versioning.key" type="string">
+  Key contains the name of the key to check for versioning information.
+</ParamField>
+
+<ParamField body="versioning.location" type="string">
+  Location contains versioning location information. It can be one of the following: header, url-param, url. **Allowed values:** `header`, `url-param`, `url`.
+</ParamField>
+
+<ParamField body="versioning.name" type="string">
+  Name contains the name of the version.
+</ParamField>
+
+<ParamField body="versioning.stripVersioningData" type="boolean">
+  StripVersioningData if enabled, specifies that the API responses will be stripped of versioning data.
+</ParamField>
+
+<ParamField body="versioning.urlVersioningPattern" type="string">
+  UrlVersioningPattern configure with a regex that matches the versioning identifier format in your URLs. This is essential when using stripVersioningData and fallbackToDefault with location=url."
+</ParamField>
+
+<ParamField body="versioning.versions[]" type="object">
+  Versions contains a list of versions that map to individual API IDs.
+</ParamField>
+
+<ParamField body="versioning.versions[].name" type="string" required>
+  Name contains the name of the referenced TykOasApiDefinition.
+</ParamField>
+
+<ParamField body="versioning.versions[].tykOasApiDefinitionRef" type="object" required>
+  TykOasApiDefinitionRef references a TykOasApiDefinition Name and Namespace.
+</ParamField>
+
+<ParamField body="versioning.versions[].tykOasApiDefinitionRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="versioning.versions[].tykOasApiDefinitionRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+## ApiDefinition
+
+APIDefinitionSpec represents the configuration for a single proxied API and it's versions.
+
+### Top-Level Fields
+
+<ParamField body="name" type="string" required />
+
+<ParamField body="protocol" type="string" required>
+  APIProtocol is the network transport protocol supported by the gateway **Allowed values:** ``, `h2c`, `tcp`, `tls`, `http`, `https`.
+</ParamField>
+
+<ParamField body="active" type="boolean">
+  Active specifies if the api is enabled or not
+</ParamField>
+
+<ParamField body="allowed_ips[]" type="string">
+  AllowedIPs is a list of IP address that are whitelisted.When this is provided all IP address that is not on this list will be blocked and a 403 http status will be returned. The IP address can be IPv4 or IPv6.IP in CIDR notation is also supported.
+</ParamField>
+
+<ParamField body="api_id" type="string">
+  Only set this field if you are referring to an existing API def. The Operator will use this APIID to link the CR with the API in Tyk Note: The values in the CR will become the new source of truth, overriding the existing API Definition
+</ParamField>
+
+<ParamField body="base_identity_provided_by" type="string">
+  BaseIdentityProvidedBy sets Base Identity Provider for situation when multiple authentication mechanisms are used **Allowed values:** `auth_token`, `hmac_key`, `basic_auth_user`, `jwt_claim`, `oidc_user`, `oauth_key`.
+</ParamField>
+
+<ParamField body="blacklisted_ips[]" type="string">
+  BlacklistedIPs is a list of IP address that will be blacklisted.This means if origin IP matches any IP in this list a 403 http status code will be returned. The IP address can be IPv4 or IPv6. IP in CIDR notation is also supported.
+</ParamField>
+
+<ParamField body="certificate_secret_names[]" type="string">
+  CertificateSecretNames represents the names of the secrets that the controller should look for in the current namespace which contain the certificates.
+</ParamField>
+
+<ParamField body="certificates[]" type="string">
+  Certificates is a list of Tyk Certificate IDs. e.g. orgid+fingerprint. Use CertificateSecretNames if using cert-manager
+</ParamField>
+
+<ParamField body="client_certificate_refs[]" type="string" />
+
+<ParamField body="client_certificates[]" type="string" />
+
+<ParamField body="config_data" type="object">
+  ConfigData can be used to pass custom attributes (a JSON object) into your middleware, such as a virtual endpoint or header transform. Free-form object with arbitrary keys.
+</ParamField>
+
+<ParamField body="custom_middleware_bundle" type="string" />
+
+<ParamField body="detailed_tracing" type="boolean" />
+
+<ParamField body="disable_quota" type="boolean">
+  DisableQuota allows you to disable quota middleware in a given API Definition.
+</ParamField>
+
+<ParamField body="disable_rate_limit" type="boolean">
+  DisableRateLimit allows you to disable rate limits in a given API Definition.
+</ParamField>
+
+<ParamField body="do_not_track" type="boolean">
+  DoNotTrack disables endpoint tracking for this API
+</ParamField>
+
+<ParamField body="domain" type="string">
+  Domain represents a custom host header that the gateway will listen on for this API
+</ParamField>
+
+<ParamField body="enable_context_vars" type="boolean">
+  EnableContextVars extracts request context variables from the start of the middleware chain. Set this to true to make them available to your transforms. Context Variables are available in the url rewriter, modify headers and body transforms.
+</ParamField>
+
+<ParamField body="enable_coprocess_auth" type="boolean" />
+
+<ParamField body="enable_detailed_recording" type="boolean">
+  EnableDetailedRecording instructs Tyk store the inbound request and outbound response data in HTTP Wire format as part of the Analytics data
+</ParamField>
+
+<ParamField body="enable_ip_blacklisting" type="boolean">
+  EnableIPBlacklisting activates the ip blacklisting middleware.
+</ParamField>
+
+<ParamField body="enable_ip_whitelisting" type="boolean">
+  EnableIPWhiteListing activates the ip whitelisting middleware.
+</ParamField>
+
+<ParamField body="enable_jwt" type="boolean">
+  EnableJWT set JWT as the access method for this API.
+</ParamField>
+
+<ParamField body="enable_proxy_protocol" type="boolean" />
+
+<ParamField body="id" type="string">
+  For server use only, do not use
+</ParamField>
+
+<ParamField body="internal" type="boolean">
+  Internal tells Tyk Gateway that this is a virtual API. It can only be routed to from other APIs.
+</ParamField>
+
+<ParamField body="jwt_client_base_field" type="string">
+  JWTClientIDBaseField is the name of the field on JWT claim to use for client id. This field is mutually exclusive to jwt_identity_base_field, meaning you can only set/use one and jwt_identity_base_field takes precedence when both are set.
+</ParamField>
+
+<ParamField body="jwt_default_policies[]" type="string">
+  JWTDefaultPolicies is a list of policies that will be used when base policy can't be extracted from the JWT token. When this list is provided the first element will be used as the base policy while the rest of elements will be applied.
+</ParamField>
+
+<ParamField body="jwt_expires_at_validation_skew" type="integer">
+  JWTExpiresAtValidationSkew adds validation for expired at JWT claim. Given now = current unix time skew = jwt_expires_at_validation_skew exp = expired at If exp &gt; (now - skew) then validation will fail with "token has expired"
+</ParamField>
+
+<ParamField body="jwt_identity_base_field" type="string">
+  JWTIdentityBaseField Identifies the user or identity to be used in the Claims of the JWT. This will fallback to sub if not found. This field forms the basis of a new “virtual” token that gets used after validation. It means policy attributes are carried forward through Tyk for attribution purposes.
+</ParamField>
+
+<ParamField body="jwt_issued_at_validation_skew" type="integer">
+  JWTIssuedAtValidationSkew adds validation for issued at JWT claim. Given now = current unix time skew = jwt_issued_at_validation_skew iat = the issued at jwt claim If iat &gt; (now + skew) then validation will fail with "token used before issued"
+</ParamField>
+
+<ParamField body="jwt_not_before_validation_skew" type="integer">
+  JWTNotBeforeValidationSkew adds validation for not before JWT claim. Given now = current unix time skew = jwt_not_before_validation_skew nbf = the not before jwt claim If nbf &gt; (now + skew) then validation will fail with "token is not valid yet"
+</ParamField>
+
+<ParamField body="jwt_policy_field_name" type="string">
+  JWTPolicyFieldName The policy ID to apply to the virtual token generated for a JWT
+</ParamField>
+
+<ParamField body="jwt_scope_claim_name" type="string">
+  JWTScopeClaimName overides the key used for scope values in the JWT claims. By default the value is "scope"
+</ParamField>
+
+<ParamField body="jwt_signing_method" type="string">
+  JWTSigningMethod algorithm used to sign jwt token **Allowed values:** ``, `rsa`, `hmac`, `ecdsa`.
+</ParamField>
+
+<ParamField body="jwt_skip_kid" type="boolean">
+  JWTSkipKid when true we ingore using kid as the identity for a JWT token and instead use jwt_identity_base_field if it was set or fallback to sub JWT claim.
+</ParamField>
+
+<ParamField body="jwt_source" type="string">
+  JWTSource Must either be a base64 encoded valid RSA/HMAC key or a url to a resource serving JWK, this key will then be used to validate inbound JWT and throttle them according to the centralised JWT options and fields set in the configuration.
+</ParamField>
+
+<ParamField body="listen_port" type="integer" />
+
+<ParamField body="org_id" type="string">
+  OrgID is overwritten - no point setting this
+</ParamField>
+
+<ParamField body="session_lifetime" type="integer">
+  SessionLifetime this is duration in seconds before the session key expires in redis. Example: If you want the session keys to be alive only 24 hours you can set this value to 86400 that we can break down to 60 * 60 * 24 = Total seconds in a day
+</ParamField>
+
+<ParamField body="strip_auth_data" type="boolean">
+  StripAuthData ensures that any security tokens used for accessing APIs are stripped and not leaked to the upstream
+</ParamField>
+
+<ParamField body="tag_headers[]" type="string" />
+
+<ParamField body="tags[]" type="string">
+  Tags are named gateway nodes which tell gateway clusters whether to load an API or not. for example, to load the API in an ARA gateway, you might want to include an `edge` tag.
+</ParamField>
+
+<ParamField body="use_basic_auth" type="boolean">
+  UseBasicAuth enables basic authentication
+</ParamField>
+
+<ParamField body="use_go_plugin_auth" type="boolean">
+  Enable Go Plugin Auth. Needs to be combined with "use_keyless:false"
+</ParamField>
+
+<ParamField body="use_keyless" type="boolean">
+  UseKeylessAccess will switch off all key checking. Some analytics will still be recorded, but rate-limiting, quotas and security policies will not be possible (there is no session to attach requests to).
+</ParamField>
+
+<ParamField body="use_mutual_tls_auth" type="boolean">
+  UseMutualTLSAuth enables mututal TLS authentication
+</ParamField>
+
+<ParamField body="use_oauth2" type="boolean">
+  UseOAuth2 enables oauth2 authorization
+</ParamField>
+
+<ParamField body="use_standard_auth" type="boolean">
+  UseStandardAuth enables simple bearer token authentication
+</ParamField>
+
+### proxy
+
+<ParamField body="proxy" type="object" required>
+  Proxy
+</ParamField>
+
+<ParamField body="proxy.target_url" type="string" required>
+  TargetURL defines the target URL that the request should be proxied to.
+</ParamField>
+
+<ParamField body="proxy.check_host_against_uptime_tests" type="boolean">
+  CheckHostAgainstUptimeTests will check the hostname of the outbound request against the downtime list generated by the uptime test host checker. If the host is found, then it is skipped or removed from the load balancer. This is only valid if uptime tests for the api are enabled.
+</ParamField>
+
+<ParamField body="proxy.disable_strip_slash" type="boolean">
+  DisableStripSlash disables the stripping of the slash suffix from a URL. when `true` a request to http://foo.bar/baz/ will be retained. when `false` a request to http://foo.bar/baz/ will be matched to http://foo.bar/baz
+</ParamField>
+
+<ParamField body="proxy.enable_load_balancing" type="boolean">
+  EnableLoadBalancing enables Tyk's round-robin loadbalancer. Tyk will ignore the TargetURL field, and rely on the hosts in the Targets list
+</ParamField>
+
+<ParamField body="proxy.listen_path" type="string">
+  ListenPath represents the path to listen on. e.g. `/api` or `/` or `/httpbin`. Any requests coming into the host, on the port that Tyk is configured to run on, that match this path will have the rules defined in the API Definition applied. Versioning assumes that different versions of an API will live on the same URL structure. If you are using URL-based versioning (e.g. /v1/function, /v2/function) then it is recommended to set up a separate non-versioned definition for each version as they are essentially separate APIs.
+</ParamField>
+
+<ParamField body="proxy.preserve_host_header" type="boolean">
+  If PreserveHostHeader is set to true then the host header in the outbound request is retained to be the inbound hostname of the proxy.
+</ParamField>
+
+<ParamField body="proxy.service_discovery" type="object">
+  ServiceDiscovery configures integration with an external service discovery system (for example Consul, etcd or Eureka) that the gateway queries to resolve the upstream target hosts at runtime.
+</ParamField>
+
+<ParamField body="proxy.service_discovery.cache_timeout" type="integer" required />
+
+<ParamField body="proxy.service_discovery.data_path" type="string" required />
+
+<ParamField body="proxy.service_discovery.endpoint_returns_list" type="boolean" required />
+
+<ParamField body="proxy.service_discovery.parent_data_path" type="string" required />
+
+<ParamField body="proxy.service_discovery.port_data_path" type="string" required />
+
+<ParamField body="proxy.service_discovery.query_endpoint" type="string" required />
+
+<ParamField body="proxy.service_discovery.target_path" type="string" required />
+
+<ParamField body="proxy.service_discovery.use_discovery_service" type="boolean" required />
+
+<ParamField body="proxy.service_discovery.use_nested_query" type="boolean" required />
+
+<ParamField body="proxy.service_discovery.use_target_list" type="boolean" required />
+
+<ParamField body="proxy.strip_listen_path" type="boolean">
+  StripListenPath removes the inbound listen path in the outgoing request. e.g. http://acme.com/httpbin/get where `httpbin` is the listen path. The `httpbin` listen path which is used to identify the API loaded in Tyk is removed, and the outbound request would be http://httpbin.org/get
+</ParamField>
+
+<ParamField body="proxy.target_internal" type="object" />
+
+<ParamField body="proxy.target_internal.path" type="string">
+  Path path on target , this does not include query parameters. example /myendpoint
+</ParamField>
+
+<ParamField body="proxy.target_internal.query" type="string">
+  Query url query string to add to target example check_limits=true
+</ParamField>
+
+<ParamField body="proxy.target_internal.target" type="object">
+  API a namespaced/name to the api definition resource that you are targetting
+</ParamField>
+
+<ParamField body="proxy.target_internal.target.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="proxy.target_internal.target.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+<ParamField body="proxy.target_list[]" type="string">
+  Targets defines a list of upstream host targets. Tyk will then round-robin load balance between these targets. EnableLoadBalancing must be set to true in order to take advantage of this feature.
+</ParamField>
+
+<ParamField body="proxy.transport" type="object">
+  Transport section exposes advanced transport level configurations such as minimum TLS version.
+</ParamField>
+
+<ParamField body="proxy.transport.proxy_url" type="string">
+  ProxyURL specifies custom forward proxy &amp; port. e.g. `http(s)://proxy.url:1234`
+</ParamField>
+
+<ParamField body="proxy.transport.ssl_ciphers[]" type="string">
+  SSLCipherSuites is an array of acceptable cipher suites. A list of allowed cipher suites can be found in the Go Crypto TLS package constants documentation https://golang.org/pkg/crypto/tls/#pkg-constants
+</ParamField>
+
+<ParamField body="proxy.transport.ssl_force_common_name_check" type="boolean">
+  SSLForceCommonNameCheck forces hostname validation against the certificate Common Name
+</ParamField>
+
+<ParamField body="proxy.transport.ssl_insecure_skip_verify" type="boolean">
+  SSLInsecureSkipVerify controls whether it is possible to use self-signed certificates when connecting to the upstream. This is applied to `TykMakeHttpRequest` &amp; `TykMakeBatchRequest` in virtual endpoint middleware.
+</ParamField>
+
+<ParamField body="proxy.transport.ssl_min_version" type="integer">
+  SSLMinVersion defines the minimum TLS version the gateway will use to establish a connection to the upstream. 1.0: 769; 1.1: 770; 1.2: 771; 1.3: 772. **Allowed values:** `769`, `770`, `771`, `772`.
+</ParamField>
+
+### analytics_plugin
+
+<ParamField body="analytics_plugin" type="object">
+  AnalyticsPlugin is used to configure analytics plugin which enables editing or removal of all parts of analytics records, raw `request` and responses recorded by Tyk at the gateway level
+</ParamField>
+
+<ParamField body="analytics_plugin.enable" type="boolean" required />
+
+<ParamField body="analytics_plugin.func_name" type="string" />
+
+<ParamField body="analytics_plugin.plugin_path" type="string" />
+
+### auth
+
+<ParamField body="auth" type="object" />
+
+<ParamField body="auth.auth_header_name" type="string" required />
+
+<ParamField body="auth.cookie_name" type="string" />
+
+<ParamField body="auth.param_name" type="string" />
+
+<ParamField body="auth.signature" type="object" />
+
+<ParamField body="auth.signature.algorithm" type="string" required />
+
+<ParamField body="auth.signature.allowed_clock_skew" type="integer" required />
+
+<ParamField body="auth.signature.error_code" type="integer" required />
+
+<ParamField body="auth.signature.error_message" type="string" required />
+
+<ParamField body="auth.signature.header" type="string" required />
+
+<ParamField body="auth.signature.secret" type="string" required />
+
+<ParamField body="auth.use_certificate" type="boolean" />
+
+<ParamField body="auth.use_cookie" type="boolean" />
+
+<ParamField body="auth.use_param" type="boolean" />
+
+<ParamField body="auth.validate_signature" type="boolean" />
+
+### auth_configs
+
+<ParamField body="auth_configs" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="auth_configs.{key}" type="object" />
+
+<ParamField body="auth_configs.{key}.auth_header_name" type="string" required />
+
+<ParamField body="auth_configs.{key}.cookie_name" type="string" />
+
+<ParamField body="auth_configs.{key}.param_name" type="string" />
+
+<ParamField body="auth_configs.{key}.signature" type="object" />
+
+<ParamField body="auth_configs.{key}.signature.algorithm" type="string" required />
+
+<ParamField body="auth_configs.{key}.signature.allowed_clock_skew" type="integer" required />
+
+<ParamField body="auth_configs.{key}.signature.error_code" type="integer" required />
+
+<ParamField body="auth_configs.{key}.signature.error_message" type="string" required />
+
+<ParamField body="auth_configs.{key}.signature.header" type="string" required />
+
+<ParamField body="auth_configs.{key}.signature.secret" type="string" required />
+
+<ParamField body="auth_configs.{key}.use_certificate" type="boolean" />
+
+<ParamField body="auth_configs.{key}.use_cookie" type="boolean" />
+
+<ParamField body="auth_configs.{key}.use_param" type="boolean" />
+
+<ParamField body="auth_configs.{key}.validate_signature" type="boolean" />
+
+### cache_options
+
+<ParamField body="cache_options" type="object" />
+
+<ParamField body="cache_options.cache_timeout" type="integer" required>
+  CacheTimeout is the TTL for a cached object in seconds
+</ParamField>
+
+<ParamField body="cache_options.cache_all_safe_requests" type="boolean">
+  CacheAllSafeRequests caches responses to (GET, HEAD, OPTIONS) requests overrides per-path cache settings in versions, applies across versions
+</ParamField>
+
+<ParamField body="cache_options.cache_by_headers[]" type="string">
+  CacheByHeaders allows header values to be used as part of the cache key
+</ParamField>
+
+<ParamField body="cache_options.cache_control_ttl_header" type="string">
+  CacheControlTTLHeader is the response header which tells Tyk how long it is safe to cache the response for
+</ParamField>
+
+<ParamField body="cache_options.cache_response_codes[]" type="integer">
+  CacheOnlyResponseCodes is an array of response codes which are safe to cache. e.g. 404
+</ParamField>
+
+<ParamField body="cache_options.enable_cache" type="boolean">
+  EnableCache turns global cache middleware on or off. It is still possible to enable caching on a per-path basis by explicitly setting the endpoint cache middleware. see `spec.version_data.versions.&#123;VERSION&#125;.extended_paths.cache[]`
+</ParamField>
+
+<ParamField body="cache_options.enable_upstream_cache_control" type="boolean">
+  EnableUpstreamCacheControl instructs Tyk Cache to respect upstream cache control headers
+</ParamField>
+
+### contextRef
+
+<ParamField body="contextRef" type="object">
+  Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
+</ParamField>
+
+<ParamField body="contextRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="contextRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+### CORS
+
+<ParamField body="CORS" type="object" />
+
+<ParamField body="CORS.allow_credentials" type="boolean">
+  AllowCredentials if true will allow cookies
+</ParamField>
+
+<ParamField body="CORS.allowed_headers[]" type="string">
+  AllowedHeaders are headers that are allowed within a request.
+</ParamField>
+
+<ParamField body="CORS.allowed_methods[]" type="string">
+  AllowedMethods is a list of methods to allow access via. **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="CORS.allowed_origins[]" type="string">
+  AllowedOrigins is a list of origin domains to allow access from.
+</ParamField>
+
+<ParamField body="CORS.debug" type="boolean">
+  Debug if true, this option produces log files for the CORS middleware
+</ParamField>
+
+<ParamField body="CORS.enable" type="boolean">
+  Enable when set to true it enables the cors middleware for the api
+</ParamField>
+
+<ParamField body="CORS.exposed_headers[]" type="string">
+  ExposedHeaders is a list of headers that are exposed back in the response.
+</ParamField>
+
+<ParamField body="CORS.max_age" type="integer">
+  MaxAge is the maximum age of credentials
+</ParamField>
+
+<ParamField body="CORS.options_passthrough" type="boolean">
+  OptionsPassthrough allow CORS OPTIONS preflight request to be proxied directly to upstream, without authentication and rest of checks. This means that pre-flight requests generated by web-clients such as SwaggerUI or the Tyk Portal documentation system will be able to test the API using trial keys. If your service handles CORS natively, then enable this option.
+</ParamField>
+
+### custom_middleware
+
+<ParamField body="custom_middleware" type="object" />
+
+<ParamField body="custom_middleware.driver" type="string" required />
+
+<ParamField body="custom_middleware.auth_check" type="object" />
+
+<ParamField body="custom_middleware.auth_check.name" type="string" required />
+
+<ParamField body="custom_middleware.auth_check.path" type="string" required />
+
+<ParamField body="custom_middleware.auth_check.raw_body_only" type="boolean" />
+
+<ParamField body="custom_middleware.auth_check.require_session" type="boolean" />
+
+<ParamField body="custom_middleware.id_extractor" type="object" />
+
+<ParamField body="custom_middleware.id_extractor.extract_from" type="string" required />
+
+<ParamField body="custom_middleware.id_extractor.extract_with" type="string" required />
+
+<ParamField body="custom_middleware.id_extractor.extractor_config" type="object" required />
+
+<ParamField body="custom_middleware.id_extractor.extractor_config.header_name" type="string" />
+
+<ParamField body="custom_middleware.id_extractor.extractor_config.param_name" type="string" />
+
+<ParamField body="custom_middleware.id_extractor.extractor_config.regex_expression" type="string" />
+
+<ParamField body="custom_middleware.id_extractor.extractor_config.regex_match_index" type="integer" />
+
+<ParamField body="custom_middleware.post[]" type="object" />
+
+<ParamField body="custom_middleware.post[].name" type="string" required />
+
+<ParamField body="custom_middleware.post[].path" type="string" required />
+
+<ParamField body="custom_middleware.post[].raw_body_only" type="boolean" />
+
+<ParamField body="custom_middleware.post[].require_session" type="boolean" />
+
+<ParamField body="custom_middleware.post_key_auth[]" type="object" />
+
+<ParamField body="custom_middleware.post_key_auth[].name" type="string" required />
+
+<ParamField body="custom_middleware.post_key_auth[].path" type="string" required />
+
+<ParamField body="custom_middleware.post_key_auth[].raw_body_only" type="boolean" />
+
+<ParamField body="custom_middleware.post_key_auth[].require_session" type="boolean" />
+
+<ParamField body="custom_middleware.pre[]" type="object" />
+
+<ParamField body="custom_middleware.pre[].name" type="string" required />
+
+<ParamField body="custom_middleware.pre[].path" type="string" required />
+
+<ParamField body="custom_middleware.pre[].raw_body_only" type="boolean" />
+
+<ParamField body="custom_middleware.pre[].require_session" type="boolean" />
+
+<ParamField body="custom_middleware.response[]" type="object" />
+
+<ParamField body="custom_middleware.response[].name" type="string" required />
+
+<ParamField body="custom_middleware.response[].path" type="string" required />
+
+<ParamField body="custom_middleware.response[].raw_body_only" type="boolean" />
+
+<ParamField body="custom_middleware.response[].require_session" type="boolean" />
+
+### definition
+
+<ParamField body="definition" type="object">
+  VersionDefinition is a struct that holds the version information for the API
+</ParamField>
+
+<ParamField body="definition.key" type="string" required />
+
+<ParamField body="definition.location" type="string" required />
+
+<ParamField body="definition.default" type="string" />
+
+<ParamField body="definition.enabled" type="boolean" />
+
+<ParamField body="definition.fallback_to_default" type="boolean" />
+
+<ParamField body="definition.name" type="string" />
+
+<ParamField body="definition.strip_path" type="boolean">
+  Deprecated: use StripVersioningData instead.
+</ParamField>
+
+<ParamField body="definition.strip_versioning_data" type="boolean" />
+
+<ParamField body="definition.url_versioning_pattern" type="string" />
+
+<ParamField body="definition.versions" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="definition.versions.{key}" type="string" />
+
+### event_handlers
+
+<ParamField body="event_handlers" type="object" />
+
+<ParamField body="event_handlers.events" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="event_handlers.events.{key}[]" type="object" />
+
+<ParamField body="event_handlers.events.{key}[].handler_meta" type="object" required>
+  MapStringInterfaceType represents a generic struct used as a map[string]interface&#123;&#125;. Since an arbitrary JSON fields defined as map[string]interface&#123;&#125; is not feasible to use as a Kubernetes CRD, unstructured.Unstructured type is used. Free-form object with arbitrary keys.
+</ParamField>
+
+<ParamField body="event_handlers.events.{key}[].handler_name" type="string" required />
+
+### global_rate_limit
+
+<ParamField body="global_rate_limit" type="object">
+  GlobalRateLimit is an API Level Global Rate Limit, which assesses all traffic coming into the API from all sources and ensures that the overall rate limit is not exceeded.
+</ParamField>
+
+<ParamField body="global_rate_limit.per" type="integer" required>
+  Per represents a time window in seconds
+</ParamField>
+
+<ParamField body="global_rate_limit.rate" type="integer" required>
+  Rate represents the number of requests allowed within a specified time window (Per)
+</ParamField>
+
+### graphql
+
+<ParamField body="graphql" type="object">
+  GraphQLConfig is the root config object for a GraphQL API.
+</ParamField>
+
+<ParamField body="graphql.enabled" type="boolean" required>
+  Enabled indicates if GraphQL proxy should be enabled.
+</ParamField>
+
+<ParamField body="graphql.execution_mode" type="string" required>
+  GraphQLExecutionMode is the mode to define how an api behaves. **Allowed values:** ``, `proxyOnly`, `executionEngine`, `supergraph`, `subgraph`.
+</ParamField>
+
+<ParamField body="graphql.engine" type="object">
+  Engine holds the configuration for engine v2 and upwards.
+</ParamField>
+
+<ParamField body="graphql.engine.data_sources[]" type="object" required />
+
+<ParamField body="graphql.engine.data_sources[].config" type="object" required>
+  MapStringInterfaceType represents a generic struct used as a map[string]interface&#123;&#125;. Since an arbitrary JSON fields defined as map[string]interface&#123;&#125; is not feasible to use as a Kubernetes CRD, unstructured.Unstructured type is used. Free-form object with arbitrary keys.
+</ParamField>
+
+<ParamField body="graphql.engine.data_sources[].internal" type="boolean" required />
+
+<ParamField body="graphql.engine.data_sources[].kind" type="string" required>
+  **Allowed values:** `REST`, `GraphQL`, `Kafka`.
+</ParamField>
+
+<ParamField body="graphql.engine.data_sources[].name" type="string" required />
+
+<ParamField body="graphql.engine.data_sources[].root_fields[]" type="object" required />
+
+<ParamField body="graphql.engine.data_sources[].root_fields[].fields[]" type="string" required />
+
+<ParamField body="graphql.engine.data_sources[].root_fields[].type" type="string" required />
+
+<ParamField body="graphql.engine.field_configs[]" type="object" required />
+
+<ParamField body="graphql.engine.field_configs[].disable_default_mapping" type="boolean" required />
+
+<ParamField body="graphql.engine.field_configs[].field_name" type="string" required />
+
+<ParamField body="graphql.engine.field_configs[].path[]" type="string" required />
+
+<ParamField body="graphql.engine.field_configs[].type_name" type="string" required />
+
+<ParamField body="graphql.engine.global_headers[]" type="object">
+  GlobalHeaders for managing headers for UDG and all associated data sources
+</ParamField>
+
+<ParamField body="graphql.engine.global_headers[].key" type="string" required>
+  Key is the name of the request header
+</ParamField>
+
+<ParamField body="graphql.engine.global_headers[].value" type="string" required>
+  Value holds the value of the request header
+</ParamField>
+
+<ParamField body="graphql.graph_ref" type="string" />
+
+<ParamField body="graphql.introspection" type="object">
+  Introspection holds the configuration for GraphQL Introspection
+</ParamField>
+
+<ParamField body="graphql.introspection.disabled" type="boolean" />
+
+<ParamField body="graphql.last_schema_update" type="string">
+  LastSchemaUpdate contains the date and time of the last triggered schema update to the upstream.
+</ParamField>
+
+<ParamField body="graphql.playground" type="object">
+  GraphQLPlayground is the Playground specific configuration.
+</ParamField>
+
+<ParamField body="graphql.playground.enabled" type="boolean" required>
+  Enabled indicates if the playground should be enabled.
+</ParamField>
+
+<ParamField body="graphql.playground.path" type="string" required>
+  Path sets the path on which the playground will be hosted if enabled.
+</ParamField>
+
+<ParamField body="graphql.proxy" type="object">
+  Proxy holds the configuration for a proxy only api.
+</ParamField>
+
+<ParamField body="graphql.proxy.auth_headers" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="graphql.proxy.auth_headers.{key}" type="string" />
+
+<ParamField body="graphql.proxy.features" type="object" />
+
+<ParamField body="graphql.proxy.features.use_immutable_headers" type="boolean" />
+
+<ParamField body="graphql.proxy.request_headers" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="graphql.proxy.request_headers.{key}" type="string" />
+
+<ParamField body="graphql.proxy.request_headers_rewrite" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="graphql.proxy.request_headers_rewrite.{key}" type="object" />
+
+<ParamField body="graphql.proxy.request_headers_rewrite.{key}.remove" type="boolean" required />
+
+<ParamField body="graphql.proxy.request_headers_rewrite.{key}.value" type="string" required />
+
+<ParamField body="graphql.proxy.subscription_type" type="string">
+  SubscriptionType is the subscription protocol to use for graphql subscriptions **Allowed values:** ``, `graphql-ws`, `graphql-transport-ws`, `sse`.
+</ParamField>
+
+<ParamField body="graphql.proxy.use_response_extensions" type="object" />
+
+<ParamField body="graphql.proxy.use_response_extensions.on_error_forwarding" type="boolean" required />
+
+<ParamField body="graphql.schema" type="string">
+  Schema is the GraphQL Schema exposed by the GraphQL API/Upstream/Engine.
+</ParamField>
+
+<ParamField body="graphql.subgraph" type="object">
+  Subgraph holds the configuration for a GraphQL federation subgraph.
+</ParamField>
+
+<ParamField body="graphql.subgraph.sdl" type="string" required />
+
+<ParamField body="graphql.supergraph" type="object">
+  Supergraph holds the configuration for a GraphQL federation supergraph.
+</ParamField>
+
+<ParamField body="graphql.supergraph.disable_query_batching" type="boolean" />
+
+<ParamField body="graphql.supergraph.global_headers" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="graphql.supergraph.global_headers.{key}" type="string" />
+
+<ParamField body="graphql.supergraph.merged_sdl" type="string" />
+
+<ParamField body="graphql.supergraph.subgraphs[]" type="object" />
+
+<ParamField body="graphql.supergraph.subgraphs[].api_id" type="string" required>
+  UUID v4 string (!not the same as _id of APIDefinition)
+</ParamField>
+
+<ParamField body="graphql.supergraph.subgraphs[].headers" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="graphql.supergraph.subgraphs[].headers.{key}" type="string" />
+
+<ParamField body="graphql.supergraph.subgraphs[].name" type="string" required />
+
+<ParamField body="graphql.supergraph.subgraphs[].sdl" type="string" required>
+  the schema definition language of the subgraph
+</ParamField>
+
+<ParamField body="graphql.supergraph.subgraphs[].url" type="string" required>
+  The internal URL of the subgraph
+</ParamField>
+
+<ParamField body="graphql.supergraph.updated_at" type="string">
+  UpdatedAt contains the date and time of the last update of a supergraph API.
+</ParamField>
+
+<ParamField body="graphql.type_field_configurations[]" type="object">
+  TypeFieldConfigurations is a rule set of data source and mapping of a schema field.
+</ParamField>
+
+<ParamField body="graphql.type_field_configurations[].data_source" type="object" required />
+
+<ParamField body="graphql.type_field_configurations[].data_source.kind" type="string" required>
+  Kind defines the unique identifier of the DataSource Kind needs to match to the Planner "DataSourceName" name **Allowed values:** `GraphQLDataSource`, `HTTPJSONDataSource`.
+</ParamField>
+
+<ParamField body="graphql.type_field_configurations[].data_source.data_source_config" type="object">
+  Config is the DataSource specific configuration object Each Planner needs to make sure to parse their Config Object correctly
+</ParamField>
+
+<ParamField body="graphql.type_field_configurations[].data_source.data_source_config.method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="graphql.type_field_configurations[].data_source.data_source_config.url" type="string" required />
+
+<ParamField body="graphql.type_field_configurations[].data_source.data_source_config.body" type="string" />
+
+<ParamField body="graphql.type_field_configurations[].data_source.data_source_config.default_type_name" type="string" />
+
+<ParamField body="graphql.type_field_configurations[].data_source.data_source_config.headers[]" type="string" />
+
+<ParamField body="graphql.type_field_configurations[].data_source.data_source_config.status_code_type_name_mappings[]" type="object" />
+
+<ParamField body="graphql.type_field_configurations[].data_source.data_source_config.status_code_type_name_mappings[].status_code" type="integer" required />
+
+<ParamField body="graphql.type_field_configurations[].data_source.data_source_config.status_code_type_name_mappings[].type_name" type="string" />
+
+<ParamField body="graphql.type_field_configurations[].field_name" type="string" required />
+
+<ParamField body="graphql.type_field_configurations[].mapping" type="object" required />
+
+<ParamField body="graphql.type_field_configurations[].mapping.disabled" type="boolean" required />
+
+<ParamField body="graphql.type_field_configurations[].mapping.path" type="string" required />
+
+<ParamField body="graphql.type_field_configurations[].type_name" type="string" required />
+
+<ParamField body="graphql.version" type="string">
+  Version defines the version of the GraphQL config and engine to be used. **Allowed values:** `1`, `2`.
+</ParamField>
+
+### jwt_scope_to_policy_mapping
+
+<ParamField body="jwt_scope_to_policy_mapping" type="object">
+  JWTScopeToPolicyMapping this is a mapping of scope value to policy id. If this is set then a scope value found in this map will make the mappend policy to be applied.
+</ParamField>
+
+<ParamField body="jwt_scope_to_policy_mapping.{key}" type="string" />
+
+### oauth_meta
+
+<ParamField body="oauth_meta" type="object" />
+
+<ParamField body="oauth_meta.allowed_access_types[]" type="string" required>
+  AllowedAccessTypes are an array of allowable access types. **Allowed values:** `authorization_code`, `refresh_token`, `password`, `client_credentials`.
+</ParamField>
+
+<ParamField body="oauth_meta.allowed_authorize_types[]" type="string" required>
+  AllowedAuthorizeTypes is an array of allowable `response_type` parameters `token` or authorization code `code`. Choose token for client_credentials or implicit grant types. **Allowed values:** `code`, `token`.
+</ParamField>
+
+<ParamField body="oauth_meta.auth_login_redirect" type="string">
+  Login form to handle user login.
+</ParamField>
+
+### pinned_public_keys
+
+<ParamField body="pinned_public_keys" type="object">
+  PinnedPublicKeys allows you to whitelist public keys used to generate certificates, so you will be protected in case an upstream certificate is compromised. Please use PinnedPublicKeysRefs if using cert-manager.
+</ParamField>
+
+<ParamField body="pinned_public_keys.{key}" type="string" />
+
+### pinned_public_keys_refs
+
+<ParamField body="pinned_public_keys_refs" type="object">
+  PinnedPublicKeysRefs allows you to specify public keys using k8s secret. It takes domain name as a key and secret name as a value.
+</ParamField>
+
+<ParamField body="pinned_public_keys_refs.{key}" type="string" />
+
+### response_processors
+
+<ParamField body="response_processors[]" type="object" />
+
+<ParamField body="response_processors[].name" type="string" required />
+
+### upstream_certificate_refs
+
+<ParamField body="upstream_certificate_refs" type="object">
+  UpstreamCertificateRefs is a map of domains and secret names that is used internally to obtain certificates from secrets in order to establish mTLS support for upstreams
+</ParamField>
+
+<ParamField body="upstream_certificate_refs.{key}" type="string" />
+
+### upstream_certificates
+
+<ParamField body="upstream_certificates" type="object">
+  UpstreamCertificates is a map of domains and certificate IDs that is used by the Tyk Gateway to provide mTLS support for upstreams
+</ParamField>
+
+<ParamField body="upstream_certificates.{key}" type="string" />
+
+### uptime_tests
+
+<ParamField body="uptime_tests" type="object">
+  UptimeTests is a struct that holds the uptime test information for the API
+</ParamField>
+
+<ParamField body="uptime_tests.check_list[]" type="object" />
+
+<ParamField body="uptime_tests.check_list[].url" type="string" required />
+
+<ParamField body="uptime_tests.check_list[].body" type="string" />
+
+<ParamField body="uptime_tests.check_list[].commands[]" type="object" />
+
+<ParamField body="uptime_tests.check_list[].commands[].message" type="string" required />
+
+<ParamField body="uptime_tests.check_list[].commands[].name" type="string" required />
+
+<ParamField body="uptime_tests.check_list[].enable_proxy_protocol" type="boolean" />
+
+<ParamField body="uptime_tests.check_list[].headers" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="uptime_tests.check_list[].headers.{key}" type="string" />
+
+<ParamField body="uptime_tests.check_list[].method" type="string">
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="uptime_tests.check_list[].protocol" type="string" />
+
+<ParamField body="uptime_tests.check_list[].timeout" type="integer">
+  A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.
+</ParamField>
+
+<ParamField body="uptime_tests.config" type="object" />
+
+<ParamField body="uptime_tests.config.expire_utime_after" type="integer">
+  must have an expireAt TTL index set (http://docs.mongodb.org/manual/tutorial/expire-data/)
+</ParamField>
+
+<ParamField body="uptime_tests.config.recheck_wait" type="integer" />
+
+<ParamField body="uptime_tests.config.service_discovery" type="object" />
+
+<ParamField body="uptime_tests.config.service_discovery.cache_timeout" type="integer" required />
+
+<ParamField body="uptime_tests.config.service_discovery.data_path" type="string" required />
+
+<ParamField body="uptime_tests.config.service_discovery.endpoint_returns_list" type="boolean" required />
+
+<ParamField body="uptime_tests.config.service_discovery.parent_data_path" type="string" required />
+
+<ParamField body="uptime_tests.config.service_discovery.port_data_path" type="string" required />
+
+<ParamField body="uptime_tests.config.service_discovery.query_endpoint" type="string" required />
+
+<ParamField body="uptime_tests.config.service_discovery.target_path" type="string" required />
+
+<ParamField body="uptime_tests.config.service_discovery.use_discovery_service" type="boolean" required />
+
+<ParamField body="uptime_tests.config.service_discovery.use_nested_query" type="boolean" required />
+
+<ParamField body="uptime_tests.config.service_discovery.use_target_list" type="boolean" required />
+
+### version_data
+
+<ParamField body="version_data" type="object" />
+
+<ParamField body="version_data.default_version" type="string" required />
+
+<ParamField body="version_data.not_versioned" type="boolean" required />
+
+<ParamField body="version_data.versions" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}" type="object" />
+
+<ParamField body="version_data.versions.{key}.name" type="string" required />
+
+<ParamField body="version_data.versions.{key}.expires" type="string" />
+
+<ParamField body="version_data.versions.{key}.extended_paths" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.advance_cache_config[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.advance_cache_config[].cache_key_regex" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.advance_cache_config[].cache_response_codes[]" type="integer" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.advance_cache_config[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.advance_cache_config[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.advance_cache_config[].timeout" type="integer" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[].ignore_case" type="boolean" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[].method_actions" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[].method_actions.{key}" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[].method_actions.{key}.action" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[].method_actions.{key}.code" type="integer" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[].method_actions.{key}.data" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[].method_actions.{key}.headers" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[].method_actions.{key}.headers.{key}" type="string" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.black_list[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.cache[]" type="string">
+  List of paths which cache middleware should be enabled on
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.circuit_breakers[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.circuit_breakers[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.circuit_breakers[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.circuit_breakers[].return_to_service_after" type="integer" required>
+  ReturnToServiceAfter represents the time in seconds to return back to the service
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.circuit_breakers[].samples" type="integer" required>
+  Samples defines the number of requests to base the ThresholdPercent on
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.circuit_breakers[].threshold_percent" type="string" required>
+  ThresholdPercent is the percentage of requests that fail before breaker is tripped
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.circuit_breakers[].disable_half_open_state" type="boolean" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.do_not_track_endpoints[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.do_not_track_endpoints[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.do_not_track_endpoints[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.hard_timeouts[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.hard_timeouts[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.hard_timeouts[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.hard_timeouts[].timeout" type="integer" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[].ignore_case" type="boolean" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[].method_actions" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[].method_actions.{key}" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[].method_actions.{key}.action" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[].method_actions.{key}.code" type="integer" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[].method_actions.{key}.data" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[].method_actions.{key}.headers" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[].method_actions.{key}.headers.{key}" type="string" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.ignored[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.internal[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.internal[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.internal[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.method_transforms[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.method_transforms[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.method_transforms[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.method_transforms[].to_method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.size_limits[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.size_limits[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.size_limits[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.size_limits[].size_limit" type="integer" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.track_endpoints[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.track_endpoints[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.track_endpoints[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform[].template_data" type="object" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform[].template_data.enable_session" type="boolean" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform[].template_data.input_type" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform[].template_data.template_mode" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform[].template_data.template_source" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_headers[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_headers[].act_on" type="boolean" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_headers[].add_headers" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_headers[].add_headers.{key}" type="string" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_headers[].delete_headers[]" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_headers[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_headers[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_jq[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_jq[].filter" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_jq[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_jq[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_jq_response[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_jq_response[].filter" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_jq_response[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_jq_response[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response[].template_data" type="object" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response[].template_data.enable_session" type="boolean" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response[].template_data.input_type" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response[].template_data.template_mode" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response[].template_data.template_source" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response_headers[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response_headers[].act_on" type="boolean" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response_headers[].add_headers" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response_headers[].add_headers.{key}" type="string" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response_headers[].delete_headers[]" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response_headers[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.transform_response_headers[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].match_pattern" type="string" required>
+  MatchPattern is a regular expression pattern to match the path
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].path" type="string" required>
+  Path represents the endpoint listen path
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].rewrite_to" type="string">
+  RewriteTo is the target path on the upstream, or target URL we wish to rewrite to
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].rewrite_to_internal" type="object">
+  RewriteToInternal serves as rewrite_to but used when rewriting to target internal api's When rewrite_to and rewrite_to_internal are both provided then rewrite_to will take rewrite_to_internal
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].rewrite_to_internal.path" type="string">
+  Path path on target , this does not include query parameters. example /myendpoint
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].rewrite_to_internal.query" type="string">
+  Query url query string to add to target example check_limits=true
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].rewrite_to_internal.target" type="object">
+  API a namespaced/name to the api definition resource that you are targetting
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].rewrite_to_internal.target.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].rewrite_to_internal.target.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].on" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options" type="object" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.header_matches" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.header_matches.{key}" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.header_matches.{key}.match_rx" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.header_matches.{key}.reverse" type="boolean" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.path_part_matches" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.path_part_matches.{key}" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.path_part_matches.{key}.match_rx" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.path_part_matches.{key}.reverse" type="boolean" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.payload_matches" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.payload_matches.match_rx" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.payload_matches.reverse" type="boolean" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.query_val_matches" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.query_val_matches.{key}" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.query_val_matches.{key}.match_rx" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.query_val_matches.{key}.reverse" type="boolean" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.request_context_matches" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.request_context_matches.{key}" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.request_context_matches.{key}.match_rx" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.request_context_matches.{key}.reverse" type="boolean" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.session_meta_matches" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.session_meta_matches.{key}" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.session_meta_matches.{key}.match_rx" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].options.session_meta_matches.{key}.reverse" type="boolean" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].rewrite_to" type="string" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].rewrite_to_internal" type="object">
+  RewriteToInternal defines options that constructs a url that refers to an api that is loaded into the gateway.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].rewrite_to_internal.path" type="string">
+  Path path on target , this does not include query parameters. example /myendpoint
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].rewrite_to_internal.query" type="string">
+  Query url query string to add to target example check_limits=true
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].rewrite_to_internal.target" type="object">
+  API a namespaced/name to the api definition resource that you are targetting
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].rewrite_to_internal.target.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.url_rewrites[].triggers[].rewrite_to_internal.target.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.validate_json[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.validate_json[].error_response_code" type="integer" required>
+  Allows override of default 422 Unprocessable Entity response code for validation errors.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.validate_json[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.validate_json[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.validate_json[].schema" type="object" required>
+  Schema represents schema field that verifies user requests against a specified JSON schema and check that the data sent to your API by a consumer is in the right format. Free-form object with arbitrary keys.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.validate_json[].disabled" type="boolean" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.virtual[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.virtual[].function_source_type" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.virtual[].function_source_uri" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.virtual[].method" type="string" required>
+  HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.virtual[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.virtual[].proxy_on_error" type="boolean" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.virtual[].response_function_name" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.virtual[].use_session" type="boolean" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[]" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[].ignore_case" type="boolean" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[].method_actions" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[].method_actions.{key}" type="object" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[].method_actions.{key}.action" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[].method_actions.{key}.code" type="integer" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[].method_actions.{key}.data" type="string" required />
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[].method_actions.{key}.headers" type="object" required>
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[].method_actions.{key}.headers.{key}" type="string" />
+
+<ParamField body="version_data.versions.{key}.extended_paths.white_list[].path" type="string" required />
+
+<ParamField body="version_data.versions.{key}.global_headers" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.global_headers.{key}" type="string" />
+
+<ParamField body="version_data.versions.{key}.global_headers_remove[]" type="string" />
+
+<ParamField body="version_data.versions.{key}.global_response_headers" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="version_data.versions.{key}.global_response_headers.{key}" type="string" />
+
+<ParamField body="version_data.versions.{key}.global_response_headers_remove[]" type="string" />
+
+<ParamField body="version_data.versions.{key}.global_size_limit" type="integer" />
+
+<ParamField body="version_data.versions.{key}.ignore_endpoint_case" type="boolean" />
+
+<ParamField body="version_data.versions.{key}.override_target" type="string" />
+
+<ParamField body="version_data.versions.{key}.paths" type="object" />
+
+<ParamField body="version_data.versions.{key}.paths.black_list[]" type="string" />
+
+<ParamField body="version_data.versions.{key}.paths.ignored[]" type="string" />
+
+<ParamField body="version_data.versions.{key}.paths.white_list[]" type="string" />
+
+<ParamField body="version_data.versions.{key}.use_extended_paths" type="boolean" />
+
+## TykStreamsApiDefinition
+
+TykStreamsApiDefinitionSpec defines the desired state of TykStreamsApiDefinition
+
+### tykStreams
+
+<ParamField body="tykStreams" type="object" required>
+  TykStreams provides storage information about Tyk Streams
+</ParamField>
+
+<ParamField body="tykStreams.configmapRef" type="object" required>
+  ConfigmapRef provides information of configmap in which Tyk Streams is stored
+</ParamField>
+
+<ParamField body="tykStreams.configmapRef.keyName" type="string" required>
+  KeyName is the key of configmap in which Tyk OAS doc is stored
+</ParamField>
+
+<ParamField body="tykStreams.configmapRef.name" type="string" required>
+  Name is the name of configmap
+</ParamField>
+
+<ParamField body="tykStreams.configmapRef.namespace" type="string">
+  Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource.
+</ParamField>
+
+### contextRef
+
+<ParamField body="contextRef" type="object">
+  Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
+</ParamField>
+
+<ParamField body="contextRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="contextRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+## TykMcpProxyDefinition
+
+TykMcpProxyDefinitionSpec defines the desired state of TykMcpProxyDefinition
+
+### tykMCP
+
+<ParamField body="tykMCP" type="object" required>
+  TykMCP provides storage information about MCP proxy configuration
+</ParamField>
+
+<ParamField body="tykMCP.configmapRef" type="object" required>
+  ConfigmapRef provides information of configmap in which MCP OAS document is stored
+</ParamField>
+
+<ParamField body="tykMCP.configmapRef.keyName" type="string" required>
+  KeyName is the key of configmap in which Tyk OAS doc is stored
+</ParamField>
+
+<ParamField body="tykMCP.configmapRef.name" type="string" required>
+  Name is the name of configmap
+</ParamField>
+
+<ParamField body="tykMCP.configmapRef.namespace" type="string">
+  Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource.
+</ParamField>
+
+### contextRef
+
+<ParamField body="contextRef" type="object">
+  Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
+</ParamField>
+
+<ParamField body="contextRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="contextRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+## SecurityPolicy
+
+SecurityPolicySpec defines the desired state of SecurityPolicy
+
+### Top-Level Fields
+
+<ParamField body="active" type="boolean" required>
+  Active must be set to `true` for Tyk to load the security policy into memory.
+</ParamField>
+
+<ParamField body="name" type="string" required>
+  Name represents the name of the security policy as displayed in the Dashboard
+</ParamField>
+
+<ParamField body="state" type="string" required>
+  State can be active, draft or deny active: All keys are active and new keys can be created. draft: All keys are active but no new keys can be created. deny: All keys are deactivated and no keys can be created. **Allowed values:** `active`, `draft`, `deny`.
+</ParamField>
+
+<ParamField body="_id" type="string">
+  MID ("_id") is generated by Tyk once the resource is created. Do NOT fill this in.
+</ParamField>
+
+<ParamField body="enable_http_signature_validation" type="boolean" />
+
+<ParamField body="hmac_enabled" type="boolean" />
+
+<ParamField body="id" type="string">
+  If you are linking an existing Policy ID to a new YAML CRD, then fill in this ID field with the "_id" field. See policies.md readme for more info
+</ParamField>
+
+<ParamField body="is_inactive" type="boolean">
+  IsInactive applies to the key itself. Allows enabling or disabling the policy without deleting it.
+</ParamField>
+
+<ParamField body="key_expires_in" type="integer">
+  KeyExpiresIn is the number of seconds till key expiry. For 1 hour is 3600. Default never expire or 0
+</ParamField>
+
+<ParamField body="max_query_depth" type="integer">
+  Max depth of a GraphQL query
+</ParamField>
+
+<ParamField body="org_id" type="string">
+  OrgID is overwritten - no point setting this
+</ParamField>
+
+<ParamField body="per" type="integer">
+  To be used in conjunction with "Rate". Per seconds. 1 minute=60. 1 hour=3600 omit or "-1" for unlimited
+</ParamField>
+
+<ParamField body="quota_max" type="integer">
+  Value of Quota allowed, omit or "-1" for unlimited
+</ParamField>
+
+<ParamField body="quota_renewal_rate" type="integer">
+  Value reset length, in seconds, omit or "-1" for unlimited
+</ParamField>
+
+<ParamField body="rate" type="integer">
+  Rate limit per X seconds (x="Per"), omit or "-1" for unlimited
+</ParamField>
+
+<ParamField body="tags[]" type="string">
+  Custom tags to apply to the key, get transfered to the analytics
+</ParamField>
+
+<ParamField body="throttle_interval" type="integer">
+  If rate limited, how many seconds to retry a request for. omit or "-1" for unlimited
+</ParamField>
+
+<ParamField body="throttle_retry_limit" type="integer">
+  Number of retries before returning error. omit or "-1" for unlimited
+</ParamField>
+
+### access_rights
+
+<ParamField body="access_rights" type="object">
+  Map of string keys to values.
+</ParamField>
+
+<ParamField body="access_rights.{key}" type="object">
+  AccessDefinition defines which versions of an API a key has access to
+</ParamField>
+
+<ParamField body="access_rights.{key}.name" type="string" required>
+  Name of the ApiDefinition resource to target
+</ParamField>
+
+<ParamField body="access_rights.{key}.namespace" type="string" required>
+  Namespace of the ApiDefinition resource to target
+</ParamField>
+
+<ParamField body="access_rights.{key}.allowance_scope" type="string" />
+
+<ParamField body="access_rights.{key}.allowed_types[]" type="object">
+  Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key.
+</ParamField>
+
+<ParamField body="access_rights.{key}.allowed_types[].fields[]" type="string" required />
+
+<ParamField body="access_rights.{key}.allowed_types[].name" type="string" required />
+
+<ParamField body="access_rights.{key}.allowed_urls[]" type="object">
+  AccessSpec defines what URLS a user has access to and what methods are enabled
+</ParamField>
+
+<ParamField body="access_rights.{key}.allowed_urls[].methods[]" type="string" required />
+
+<ParamField body="access_rights.{key}.allowed_urls[].url" type="string" required />
+
+<ParamField body="access_rights.{key}.api_id" type="string">
+  APIID is the ID of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually.
+</ParamField>
+
+<ParamField body="access_rights.{key}.api_name" type="string">
+  APIName is the name of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually.
+</ParamField>
+
+<ParamField body="access_rights.{key}.disable_introspection" type="boolean">
+  DisableIntrospection disables GraphQL introspection if it is set to True.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[]" type="object">
+  Endpoints is a collection of Endpoint.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[]" type="object">
+  EndpointMethods is a collection of EndpointMethod.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].limit" type="object">
+  RateLimit holds rate limit configuration.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].limit.per" type="string" required>
+  Per is the interval at which rate limit is enforced.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].limit.rate" type="string" required>
+  Rate is the allowed number of requests per interval.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].limit.smoothing" type="object">
+  Smoothing contains rate limit smoothing settings.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].limit.smoothing.enabled" type="boolean" required>
+  Enabled indicates if rate limit smoothing is active.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].limit.smoothing.delay" type="integer">
+  Delay is the minimum time between rate limit changes (in seconds).
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].limit.smoothing.step" type="integer">
+  Step is the increment/decrement for adjusting the rate limit.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].limit.smoothing.threshold" type="integer">
+  Threshold is the request rate above which smoothing is applied.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].limit.smoothing.trigger" type="string">
+  Trigger is the step factor determining when smoothing events trigger.
+</ParamField>
+
+<ParamField body="access_rights.{key}.endpoints[].methods[].name" type="string" />
+
+<ParamField body="access_rights.{key}.endpoints[].path" type="string" />
+
+<ParamField body="access_rights.{key}.field_access_rights[]" type="object">
+  FieldAccessRights is array of depth limit settings per GraphQL APIs.
+</ParamField>
+
+<ParamField body="access_rights.{key}.field_access_rights[].field_name" type="string">
+  FieldName represents the name of the Query or Mutation which the limit applies to.
+</ParamField>
+
+<ParamField body="access_rights.{key}.field_access_rights[].limits" type="object">
+  Limit specifies the numerical value of the limit.
+</ParamField>
+
+<ParamField body="access_rights.{key}.field_access_rights[].limits.max_query_depth" type="integer" required>
+  MaxQueryDepth represents the numerical value of the limit.
+</ParamField>
+
+<ParamField body="access_rights.{key}.field_access_rights[].type_name" type="string">
+  TypeName points to a type on which depth limit is set. It can be either Query (most common case) or Mutation
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[]" type="object">
+  JSONRPCMethods defines per-JSON-RPC-method rate limits.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].limit" type="object">
+  RateLimit holds rate limit configuration.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].limit.per" type="string" required>
+  Per is the interval at which rate limit is enforced.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].limit.rate" type="string" required>
+  Rate is the allowed number of requests per interval.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].limit.smoothing" type="object">
+  Smoothing contains rate limit smoothing settings.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].limit.smoothing.enabled" type="boolean" required>
+  Enabled indicates if rate limit smoothing is active.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].limit.smoothing.delay" type="integer">
+  Delay is the minimum time between rate limit changes (in seconds).
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].limit.smoothing.step" type="integer">
+  Step is the increment/decrement for adjusting the rate limit.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].limit.smoothing.threshold" type="integer">
+  Threshold is the request rate above which smoothing is applied.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].limit.smoothing.trigger" type="string">
+  Trigger is the step factor determining when smoothing events trigger.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods[].name" type="string">
+  Name is the JSON-RPC method name (e.g., "tools/call", "resources/read").
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods_access_rights" type="object">
+  JSONRPCMethodsAccessRights defines allow/block lists for JSON-RPC methods.
+</ParamField>
+
+<ParamField body="access_rights.{key}.json_rpc_methods_access_rights.allowed[]" type="string" />
+
+<ParamField body="access_rights.{key}.json_rpc_methods_access_rights.blocked[]" type="string" />
+
+<ParamField body="access_rights.{key}.kind" type="string" default="ApiDefinition">
+  Kind represents the kind of the linked API Definition resource. It can be either "ApiDefinition" or "TykOasApiDefinition" (case sensitive way). By default, Kind is set to "ApiDefinition". **Allowed values:** `ApiDefinition`, `TykOasApiDefinition`, `TykStreamsApiDefinition`, `TykMcpProxyDefinition`.
+</ParamField>
+
+<ParamField body="access_rights.{key}.limit" type="object">
+  APILimit stores quota and rate limit on ACL level (per API)
+</ParamField>
+
+<ParamField body="access_rights.{key}.limit.per" type="integer" required />
+
+<ParamField body="access_rights.{key}.limit.quota_max" type="integer" required />
+
+<ParamField body="access_rights.{key}.limit.quota_renewal_rate" type="integer" required />
+
+<ParamField body="access_rights.{key}.limit.rate" type="integer" required />
+
+<ParamField body="access_rights.{key}.limit.throttle_interval" type="integer" required />
+
+<ParamField body="access_rights.{key}.limit.throttle_retry_limit" type="integer" required />
+
+<ParamField body="access_rights.{key}.limit.max_query_depth" type="integer" />
+
+<ParamField body="access_rights.{key}.limit.smoothing" type="object">
+  Smoothing contains rate limit smoothing settings.
+</ParamField>
+
+<ParamField body="access_rights.{key}.limit.smoothing.enabled" type="boolean" required>
+  Enabled indicates if rate limit smoothing is active.
+</ParamField>
+
+<ParamField body="access_rights.{key}.limit.smoothing.delay" type="integer">
+  Delay is the minimum time between rate limit changes (in seconds).
+</ParamField>
+
+<ParamField body="access_rights.{key}.limit.smoothing.step" type="integer">
+  Step is the increment/decrement for adjusting the rate limit.
+</ParamField>
+
+<ParamField body="access_rights.{key}.limit.smoothing.threshold" type="integer">
+  Threshold is the request rate above which smoothing is applied.
+</ParamField>
+
+<ParamField body="access_rights.{key}.limit.smoothing.trigger" type="string">
+  Trigger is the step factor determining when smoothing events trigger.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_access_rights" type="object">
+  MCPAccessRights defines allow/block lists for MCP tools, resources, and prompts.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_access_rights.prompts" type="object">
+  AccessControlRules defines allow/block lists for access control.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_access_rights.prompts.allowed[]" type="string" />
+
+<ParamField body="access_rights.{key}.mcp_access_rights.prompts.blocked[]" type="string" />
+
+<ParamField body="access_rights.{key}.mcp_access_rights.resources" type="object">
+  AccessControlRules defines allow/block lists for access control.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_access_rights.resources.allowed[]" type="string" />
+
+<ParamField body="access_rights.{key}.mcp_access_rights.resources.blocked[]" type="string" />
+
+<ParamField body="access_rights.{key}.mcp_access_rights.tools" type="object">
+  AccessControlRules defines allow/block lists for access control.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_access_rights.tools.allowed[]" type="string" />
+
+<ParamField body="access_rights.{key}.mcp_access_rights.tools.blocked[]" type="string" />
+
+<ParamField body="access_rights.{key}.mcp_primitives[]" type="object">
+  MCPPrimitives defines per-primitive rate limits for MCP tools, resources, and prompts.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].limit" type="object">
+  RateLimit holds rate limit configuration.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].limit.per" type="string" required>
+  Per is the interval at which rate limit is enforced.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].limit.rate" type="string" required>
+  Rate is the allowed number of requests per interval.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].limit.smoothing" type="object">
+  Smoothing contains rate limit smoothing settings.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].limit.smoothing.enabled" type="boolean" required>
+  Enabled indicates if rate limit smoothing is active.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].limit.smoothing.delay" type="integer">
+  Delay is the minimum time between rate limit changes (in seconds).
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].limit.smoothing.step" type="integer">
+  Step is the increment/decrement for adjusting the rate limit.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].limit.smoothing.threshold" type="integer">
+  Threshold is the request rate above which smoothing is applied.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].limit.smoothing.trigger" type="string">
+  Trigger is the step factor determining when smoothing events trigger.
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].name" type="string">
+  Name is the primitive name (tool name, resource URI, or prompt name).
+</ParamField>
+
+<ParamField body="access_rights.{key}.mcp_primitives[].type" type="string">
+  Type is the MCP primitive type: "tool", "resource", or "prompt". **Allowed values:** `tool`, `resource`, `prompt`.
+</ParamField>
+
+<ParamField body="access_rights.{key}.restricted_types[]" type="object">
+  Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key.
+</ParamField>
+
+<ParamField body="access_rights.{key}.restricted_types[].fields[]" type="string" required />
+
+<ParamField body="access_rights.{key}.restricted_types[].name" type="string" required />
+
+<ParamField body="access_rights.{key}.versions[]" type="string" />
+
+### access_rights_array
+
+<ParamField body="access_rights_array[]" type="object">
+  AccessDefinition defines which versions of an API a key has access to
+</ParamField>
+
+<ParamField body="access_rights_array[].name" type="string" required>
+  Name of the ApiDefinition resource to target
+</ParamField>
+
+<ParamField body="access_rights_array[].namespace" type="string" required>
+  Namespace of the ApiDefinition resource to target
+</ParamField>
+
+<ParamField body="access_rights_array[].allowance_scope" type="string" />
+
+<ParamField body="access_rights_array[].allowed_types[]" type="object">
+  Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key.
+</ParamField>
+
+<ParamField body="access_rights_array[].allowed_types[].fields[]" type="string" required />
+
+<ParamField body="access_rights_array[].allowed_types[].name" type="string" required />
+
+<ParamField body="access_rights_array[].allowed_urls[]" type="object">
+  AccessSpec defines what URLS a user has access to and what methods are enabled
+</ParamField>
+
+<ParamField body="access_rights_array[].allowed_urls[].methods[]" type="string" required />
+
+<ParamField body="access_rights_array[].allowed_urls[].url" type="string" required />
+
+<ParamField body="access_rights_array[].api_id" type="string">
+  APIID is the ID of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually.
+</ParamField>
+
+<ParamField body="access_rights_array[].api_name" type="string">
+  APIName is the name of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually.
+</ParamField>
+
+<ParamField body="access_rights_array[].disable_introspection" type="boolean">
+  DisableIntrospection disables GraphQL introspection if it is set to True.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[]" type="object">
+  Endpoints is a collection of Endpoint.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[]" type="object">
+  EndpointMethods is a collection of EndpointMethod.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].limit" type="object">
+  RateLimit holds rate limit configuration.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].limit.per" type="string" required>
+  Per is the interval at which rate limit is enforced.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].limit.rate" type="string" required>
+  Rate is the allowed number of requests per interval.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].limit.smoothing" type="object">
+  Smoothing contains rate limit smoothing settings.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].limit.smoothing.enabled" type="boolean" required>
+  Enabled indicates if rate limit smoothing is active.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].limit.smoothing.delay" type="integer">
+  Delay is the minimum time between rate limit changes (in seconds).
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].limit.smoothing.step" type="integer">
+  Step is the increment/decrement for adjusting the rate limit.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].limit.smoothing.threshold" type="integer">
+  Threshold is the request rate above which smoothing is applied.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].limit.smoothing.trigger" type="string">
+  Trigger is the step factor determining when smoothing events trigger.
+</ParamField>
+
+<ParamField body="access_rights_array[].endpoints[].methods[].name" type="string" />
+
+<ParamField body="access_rights_array[].endpoints[].path" type="string" />
+
+<ParamField body="access_rights_array[].field_access_rights[]" type="object">
+  FieldAccessRights is array of depth limit settings per GraphQL APIs.
+</ParamField>
+
+<ParamField body="access_rights_array[].field_access_rights[].field_name" type="string">
+  FieldName represents the name of the Query or Mutation which the limit applies to.
+</ParamField>
+
+<ParamField body="access_rights_array[].field_access_rights[].limits" type="object">
+  Limit specifies the numerical value of the limit.
+</ParamField>
+
+<ParamField body="access_rights_array[].field_access_rights[].limits.max_query_depth" type="integer" required>
+  MaxQueryDepth represents the numerical value of the limit.
+</ParamField>
+
+<ParamField body="access_rights_array[].field_access_rights[].type_name" type="string">
+  TypeName points to a type on which depth limit is set. It can be either Query (most common case) or Mutation
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[]" type="object">
+  JSONRPCMethods defines per-JSON-RPC-method rate limits.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].limit" type="object">
+  RateLimit holds rate limit configuration.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].limit.per" type="string" required>
+  Per is the interval at which rate limit is enforced.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].limit.rate" type="string" required>
+  Rate is the allowed number of requests per interval.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].limit.smoothing" type="object">
+  Smoothing contains rate limit smoothing settings.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].limit.smoothing.enabled" type="boolean" required>
+  Enabled indicates if rate limit smoothing is active.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].limit.smoothing.delay" type="integer">
+  Delay is the minimum time between rate limit changes (in seconds).
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].limit.smoothing.step" type="integer">
+  Step is the increment/decrement for adjusting the rate limit.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].limit.smoothing.threshold" type="integer">
+  Threshold is the request rate above which smoothing is applied.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].limit.smoothing.trigger" type="string">
+  Trigger is the step factor determining when smoothing events trigger.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods[].name" type="string">
+  Name is the JSON-RPC method name (e.g., "tools/call", "resources/read").
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods_access_rights" type="object">
+  JSONRPCMethodsAccessRights defines allow/block lists for JSON-RPC methods.
+</ParamField>
+
+<ParamField body="access_rights_array[].json_rpc_methods_access_rights.allowed[]" type="string" />
+
+<ParamField body="access_rights_array[].json_rpc_methods_access_rights.blocked[]" type="string" />
+
+<ParamField body="access_rights_array[].kind" type="string" default="ApiDefinition">
+  Kind represents the kind of the linked API Definition resource. It can be either "ApiDefinition" or "TykOasApiDefinition" (case sensitive way). By default, Kind is set to "ApiDefinition". **Allowed values:** `ApiDefinition`, `TykOasApiDefinition`, `TykStreamsApiDefinition`, `TykMcpProxyDefinition`.
+</ParamField>
+
+<ParamField body="access_rights_array[].limit" type="object">
+  APILimit stores quota and rate limit on ACL level (per API)
+</ParamField>
+
+<ParamField body="access_rights_array[].limit.per" type="integer" required />
+
+<ParamField body="access_rights_array[].limit.quota_max" type="integer" required />
+
+<ParamField body="access_rights_array[].limit.quota_renewal_rate" type="integer" required />
+
+<ParamField body="access_rights_array[].limit.rate" type="integer" required />
+
+<ParamField body="access_rights_array[].limit.throttle_interval" type="integer" required />
+
+<ParamField body="access_rights_array[].limit.throttle_retry_limit" type="integer" required />
+
+<ParamField body="access_rights_array[].limit.max_query_depth" type="integer" />
+
+<ParamField body="access_rights_array[].limit.smoothing" type="object">
+  Smoothing contains rate limit smoothing settings.
+</ParamField>
+
+<ParamField body="access_rights_array[].limit.smoothing.enabled" type="boolean" required>
+  Enabled indicates if rate limit smoothing is active.
+</ParamField>
+
+<ParamField body="access_rights_array[].limit.smoothing.delay" type="integer">
+  Delay is the minimum time between rate limit changes (in seconds).
+</ParamField>
+
+<ParamField body="access_rights_array[].limit.smoothing.step" type="integer">
+  Step is the increment/decrement for adjusting the rate limit.
+</ParamField>
+
+<ParamField body="access_rights_array[].limit.smoothing.threshold" type="integer">
+  Threshold is the request rate above which smoothing is applied.
+</ParamField>
+
+<ParamField body="access_rights_array[].limit.smoothing.trigger" type="string">
+  Trigger is the step factor determining when smoothing events trigger.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_access_rights" type="object">
+  MCPAccessRights defines allow/block lists for MCP tools, resources, and prompts.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_access_rights.prompts" type="object">
+  AccessControlRules defines allow/block lists for access control.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_access_rights.prompts.allowed[]" type="string" />
+
+<ParamField body="access_rights_array[].mcp_access_rights.prompts.blocked[]" type="string" />
+
+<ParamField body="access_rights_array[].mcp_access_rights.resources" type="object">
+  AccessControlRules defines allow/block lists for access control.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_access_rights.resources.allowed[]" type="string" />
+
+<ParamField body="access_rights_array[].mcp_access_rights.resources.blocked[]" type="string" />
+
+<ParamField body="access_rights_array[].mcp_access_rights.tools" type="object">
+  AccessControlRules defines allow/block lists for access control.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_access_rights.tools.allowed[]" type="string" />
+
+<ParamField body="access_rights_array[].mcp_access_rights.tools.blocked[]" type="string" />
+
+<ParamField body="access_rights_array[].mcp_primitives[]" type="object">
+  MCPPrimitives defines per-primitive rate limits for MCP tools, resources, and prompts.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].limit" type="object">
+  RateLimit holds rate limit configuration.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].limit.per" type="string" required>
+  Per is the interval at which rate limit is enforced.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].limit.rate" type="string" required>
+  Rate is the allowed number of requests per interval.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].limit.smoothing" type="object">
+  Smoothing contains rate limit smoothing settings.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].limit.smoothing.enabled" type="boolean" required>
+  Enabled indicates if rate limit smoothing is active.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].limit.smoothing.delay" type="integer">
+  Delay is the minimum time between rate limit changes (in seconds).
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].limit.smoothing.step" type="integer">
+  Step is the increment/decrement for adjusting the rate limit.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].limit.smoothing.threshold" type="integer">
+  Threshold is the request rate above which smoothing is applied.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].limit.smoothing.trigger" type="string">
+  Trigger is the step factor determining when smoothing events trigger.
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].name" type="string">
+  Name is the primitive name (tool name, resource URI, or prompt name).
+</ParamField>
+
+<ParamField body="access_rights_array[].mcp_primitives[].type" type="string">
+  Type is the MCP primitive type: "tool", "resource", or "prompt". **Allowed values:** `tool`, `resource`, `prompt`.
+</ParamField>
+
+<ParamField body="access_rights_array[].restricted_types[]" type="object">
+  Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key.
+</ParamField>
+
+<ParamField body="access_rights_array[].restricted_types[].fields[]" type="string" required />
+
+<ParamField body="access_rights_array[].restricted_types[].name" type="string" required />
+
+<ParamField body="access_rights_array[].versions[]" type="string" />
+
+### contextRef
+
+<ParamField body="contextRef" type="object">
+  Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
+</ParamField>
+
+<ParamField body="contextRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="contextRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+### meta_data
+
+<ParamField body="meta_data" type="object">
+  LastUpdated string `json:"last_updated"`
+</ParamField>
+
+<ParamField body="meta_data.{key}" type="string" />
+
+### partitions
+
+<ParamField body="partitions" type="object" />
+
+<ParamField body="partitions.acl" type="boolean" />
+
+<ParamField body="partitions.complexity" type="boolean" />
+
+<ParamField body="partitions.per_api" type="boolean" />
+
+<ParamField body="partitions.quota" type="boolean" />
+
+<ParamField body="partitions.rate_limit" type="boolean" />
+
+## APIDescription
+
+APIDescriptionSpec defines the desired state of APIDescription
+
+### Top-Level Fields
+
+<ParamField body="auth_type" type="string">
+  AuthType displays as a badge next to the name of the API **Allowed values:** `keyless`, `jwt`, `oauth`, `authToken`.
+</ParamField>
+
+<ParamField body="documentation" type="string">
+  Do not set Documentation. Use `docs` instead.
+</ParamField>
+
+<ParamField body="is_keyless" type="boolean">
+  IsKeyless toggles visibility of the `Request an API Key button`. Use this when AuthType is keyless, jwt or oauth.
+</ParamField>
+
+<ParamField body="long_description" type="string">
+  LongDescription can be markdown. It allows you to describe the capabilities of the API and is displayed just below the name and AuthType in the catalogue listing page.
+</ParamField>
+
+<ParamField body="name" type="string">
+  Name is the title of the API that you wish to be published to the catalogue
+</ParamField>
+
+<ParamField body="policy_id" type="string">
+  PolicyID explicitly sets the policy_id to be published. We do not recommend that this value is set directly. Rather, use `policyRef` instead.
+</ParamField>
+
+<ParamField body="short_description" type="string">
+  ShortDescription is a brief summary of the API shown in the portal catalogue. Note that it may not be rendered by the default portal templates.
+</ParamField>
+
+<ParamField body="show" type="boolean">
+  Show toggles visibility of the API in the portal catalogue
+</ParamField>
+
+<ParamField body="version" type="string" default="v2">
+  Version should always be v2 **Allowed values:** `v2`.
+</ParamField>
+
+### config
+
+<ParamField body="config" type="object">
+  Config optionally overrides individual fields of the portal's PortalConfig for this catalogue.
+</ParamField>
+
+<ParamField body="config.catalogue_login_only" type="boolean">
+  CatalogueLoginOnly limits access to catalogues for login users only.
+</ParamField>
+
+<ParamField body="config.dcr_options" type="object">
+  DCROptions dynamic client registration options.
+</ParamField>
+
+<ParamField body="config.dcr_options.grant_types[]" type="string" required>
+  GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. **Allowed values:** `client_credentials`, `authorization_code`, `refresh_token`.
+</ParamField>
+
+<ParamField body="config.dcr_options.idp_host" type="string" required>
+  IDPHost is the fully qualified hostname of the Identity Provider. e.g. https://mysubdomain.eu.auth0.com
+</ParamField>
+
+<ParamField body="config.dcr_options.registration_endpoint" type="string" required>
+  RegistrationEndpoint is the registration_endpoint as presented in the /.well-known/openid-configuration document.
+</ParamField>
+
+<ParamField body="config.dcr_options.token_endpoint_auth_method" type="string" required>
+  TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. "none": The client is a public client and does not have a client secret. "client_secret_post": The client uses the HTTP POST parameters "client_secret_basic": The client uses HTTP Basic authentication **Allowed values:** `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `none`.
+</ParamField>
+
+<ParamField body="config.dcr_options.access_token" type="string">
+  AccessToken represents an optional bearer token to authenticate with against the registration endpoint
+</ParamField>
+
+<ParamField body="config.dcr_options.provider" type="string">
+  Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. **Allowed values:** `gluu`, `keycloak`, `okta`.
+</ParamField>
+
+<ParamField body="config.dcr_options.response_types[]" type="string">
+  ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. **Allowed values:** `code`, `token`.
+</ParamField>
+
+<ParamField body="config.disable_auto_login" type="boolean" />
+
+<ParamField body="config.disable_login" type="boolean">
+  DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method.
+</ParamField>
+
+<ParamField body="config.disable_signup" type="boolean">
+  DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API.
+</ParamField>
+
+<ParamField body="config.email" type="string" />
+
+<ParamField body="config.enable_dcr" type="boolean">
+  EnableDCR activates dynamic client registration.
+</ParamField>
+
+<ParamField body="config.enable_multi_selection" type="boolean">
+  EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type
+</ParamField>
+
+<ParamField body="config.id" type="string">
+  Set by the server. DO NOT set this field it is read only.
+</ParamField>
+
+<ParamField body="config.key_request_fields[]" type="string">
+  KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key
+</ParamField>
+
+<ParamField body="config.mail_options" type="object" />
+
+<ParamField body="config.mail_options.email_copy" type="object" required />
+
+<ParamField body="config.mail_options.email_copy.key_email" type="object" required />
+
+<ParamField body="config.mail_options.email_copy.key_email.body" type="string" required />
+
+<ParamField body="config.mail_options.email_copy.key_email.enabled" type="boolean" required />
+
+<ParamField body="config.mail_options.email_copy.key_email.hide_token_data" type="boolean" required />
+
+<ParamField body="config.mail_options.email_copy.key_email.sign_off" type="string" required />
+
+<ParamField body="config.mail_options.email_copy.key_email.subject" type="string" required />
+
+<ParamField body="config.mail_options.email_copy.reset_password_email" type="object" required />
+
+<ParamField body="config.mail_options.email_copy.reset_password_email.body" type="string" required />
+
+<ParamField body="config.mail_options.email_copy.reset_password_email.enabled" type="boolean" required />
+
+<ParamField body="config.mail_options.email_copy.reset_password_email.hide_token_data" type="boolean" required />
+
+<ParamField body="config.mail_options.email_copy.reset_password_email.sign_off" type="string" required />
+
+<ParamField body="config.mail_options.email_copy.reset_password_email.subject" type="string" required />
+
+<ParamField body="config.mail_options.email_copy.welcome_email" type="object" required />
+
+<ParamField body="config.mail_options.email_copy.welcome_email.body" type="string" required />
+
+<ParamField body="config.mail_options.email_copy.welcome_email.enabled" type="boolean" required />
+
+<ParamField body="config.mail_options.email_copy.welcome_email.hide_token_data" type="boolean" required />
+
+<ParamField body="config.mail_options.email_copy.welcome_email.sign_off" type="string" required />
+
+<ParamField body="config.mail_options.email_copy.welcome_email.subject" type="string" required />
+
+<ParamField body="config.mail_options.mail_from_email" type="string" required />
+
+<ParamField body="config.mail_options.mail_from_name" type="string" required />
+
+<ParamField body="config.oauth_usage_limit" type="integer">
+  OAuthUsageLimit is the maximum permitted number of OAuth clients
+</ParamField>
+
+<ParamField body="config.org_id" type="string">
+  OrgID is the organization ID
+</ParamField>
+
+<ParamField body="config.override" type="boolean">
+  Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue.
+</ParamField>
+
+<ParamField body="config.redirect_on_key_request" type="boolean">
+  RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field
+</ParamField>
+
+<ParamField body="config.redirect_to" type="string">
+  RedirectTo is a url used to redirect key requests
+</ParamField>
+
+<ParamField body="config.require_key_approval" type="boolean">
+  RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the 'Key requests' section of the dashboard.
+</ParamField>
+
+<ParamField body="config.secure_key_approval" type="boolean">
+  SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely
+</ParamField>
+
+<ParamField body="config.signup_fields[]" type="string">
+  SignUpFields is a slice of fields which are asked of the portal developer when they register for an account
+</ParamField>
+
+### contextRef
+
+<ParamField body="contextRef" type="object" />
+
+<ParamField body="contextRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="contextRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+### docs
+
+<ParamField body="docs" type="object" />
+
+<ParamField body="docs.doc_type" type="string" required>
+  **Allowed values:** `swagger`, `swagger_custom_url`, `graphql`.
+</ParamField>
+
+<ParamField body="docs.documentation" type="string" />
+
+### fields
+
+<ParamField body="fields" type="object">
+  Fields is a generic map of key:value pairs. You may wish to use this to tag a catalogue as type:internal or type:public Then apply logic at the template layer to dynamically display catalogue apis to different user types.
+</ParamField>
+
+<ParamField body="fields.{key}" type="string" />
+
+### policyRef
+
+<ParamField body="policyRef" type="object" />
+
+<ParamField body="policyRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="policyRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+## OperatorContext
+
+OperatorContextSpec defines the desired state of OperatorContext
+
+### env
+
+<ParamField body="env" type="object">
+  Env is the values of the admin api endpoint that the operator will use to reconcile resources
+</ParamField>
+
+<ParamField body="env.auth" type="string" />
+
+<ParamField body="env.ingress" type="object" />
+
+<ParamField body="env.ingress.httpPort" type="integer" />
+
+<ParamField body="env.ingress.httpsPort" type="integer" />
+
+<ParamField body="env.insecureSkipVerify" type="boolean" />
+
+<ParamField body="env.mode" type="string">
+  OperatorContextMode is the mode to which the admin api binding is done values are ce for community edition and pro for dashboard **Allowed values:** `ce`, `pro`.
+</ParamField>
+
+<ParamField body="env.org" type="string" />
+
+<ParamField body="env.url" type="string" />
+
+<ParamField body="env.user_group_owners[]" type="string" />
+
+<ParamField body="env.user_owners[]" type="string" />
+
+### secretRef
+
+<ParamField body="secretRef" type="object">
+  Reference to k8s secret resource that we load environment from.
+</ParamField>
+
+<ParamField body="secretRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="secretRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+## PortalAPICatalogue
+
+PortalAPICatalogueSpec defines the desired state of PortalAPICatalogue
+
+### Top-Level Fields
+
+<ParamField body="email" type="string">
+  Email is Catalogue owner email address.Catalogue owner will be notified at this email address when an API subscription request is submitted or granted
+</ParamField>
+
+<ParamField body="org_id" type="string">
+  OrgID is the organization ID
+</ParamField>
+
+### apis
+
+<ParamField body="apis[]" type="object">
+  APIDescriptionList is a list of PortalCatalogueDescription published on this PortalAPICatalogue
+</ParamField>
+
+<ParamField body="apis[].apiDescriptionRef" type="object" />
+
+<ParamField body="apis[].apiDescriptionRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="apis[].apiDescriptionRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+<ParamField body="apis[].auth_type" type="string">
+  AuthType displays as a badge next to the name of the API **Allowed values:** `keyless`, `jwt`, `oauth`, `authToken`.
+</ParamField>
+
+<ParamField body="apis[].config" type="object">
+  Config optionally overrides individual fields of the portal's PortalConfig for this catalogue.
+</ParamField>
+
+<ParamField body="apis[].config.catalogue_login_only" type="boolean">
+  CatalogueLoginOnly limits access to catalogues for login users only.
+</ParamField>
+
+<ParamField body="apis[].config.dcr_options" type="object">
+  DCROptions dynamic client registration options.
+</ParamField>
+
+<ParamField body="apis[].config.dcr_options.grant_types[]" type="string" required>
+  GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. **Allowed values:** `client_credentials`, `authorization_code`, `refresh_token`.
+</ParamField>
+
+<ParamField body="apis[].config.dcr_options.idp_host" type="string" required>
+  IDPHost is the fully qualified hostname of the Identity Provider. e.g. https://mysubdomain.eu.auth0.com
+</ParamField>
+
+<ParamField body="apis[].config.dcr_options.registration_endpoint" type="string" required>
+  RegistrationEndpoint is the registration_endpoint as presented in the /.well-known/openid-configuration document.
+</ParamField>
+
+<ParamField body="apis[].config.dcr_options.token_endpoint_auth_method" type="string" required>
+  TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. "none": The client is a public client and does not have a client secret. "client_secret_post": The client uses the HTTP POST parameters "client_secret_basic": The client uses HTTP Basic authentication **Allowed values:** `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `none`.
+</ParamField>
+
+<ParamField body="apis[].config.dcr_options.access_token" type="string">
+  AccessToken represents an optional bearer token to authenticate with against the registration endpoint
+</ParamField>
+
+<ParamField body="apis[].config.dcr_options.provider" type="string">
+  Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. **Allowed values:** `gluu`, `keycloak`, `okta`.
+</ParamField>
+
+<ParamField body="apis[].config.dcr_options.response_types[]" type="string">
+  ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. **Allowed values:** `code`, `token`.
+</ParamField>
+
+<ParamField body="apis[].config.disable_auto_login" type="boolean" />
+
+<ParamField body="apis[].config.disable_login" type="boolean">
+  DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method.
+</ParamField>
+
+<ParamField body="apis[].config.disable_signup" type="boolean">
+  DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API.
+</ParamField>
+
+<ParamField body="apis[].config.email" type="string" />
+
+<ParamField body="apis[].config.enable_dcr" type="boolean">
+  EnableDCR activates dynamic client registration.
+</ParamField>
+
+<ParamField body="apis[].config.enable_multi_selection" type="boolean">
+  EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type
+</ParamField>
+
+<ParamField body="apis[].config.id" type="string">
+  Set by the server. DO NOT set this field it is read only.
+</ParamField>
+
+<ParamField body="apis[].config.key_request_fields[]" type="string">
+  KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key
+</ParamField>
+
+<ParamField body="apis[].config.mail_options" type="object" />
+
+<ParamField body="apis[].config.mail_options.email_copy" type="object" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.key_email" type="object" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.key_email.body" type="string" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.key_email.enabled" type="boolean" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.key_email.hide_token_data" type="boolean" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.key_email.sign_off" type="string" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.key_email.subject" type="string" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.reset_password_email" type="object" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.reset_password_email.body" type="string" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.reset_password_email.enabled" type="boolean" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.reset_password_email.hide_token_data" type="boolean" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.reset_password_email.sign_off" type="string" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.reset_password_email.subject" type="string" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.welcome_email" type="object" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.welcome_email.body" type="string" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.welcome_email.enabled" type="boolean" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.welcome_email.hide_token_data" type="boolean" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.welcome_email.sign_off" type="string" required />
+
+<ParamField body="apis[].config.mail_options.email_copy.welcome_email.subject" type="string" required />
+
+<ParamField body="apis[].config.mail_options.mail_from_email" type="string" required />
+
+<ParamField body="apis[].config.mail_options.mail_from_name" type="string" required />
+
+<ParamField body="apis[].config.oauth_usage_limit" type="integer">
+  OAuthUsageLimit is the maximum permitted number of OAuth clients
+</ParamField>
+
+<ParamField body="apis[].config.org_id" type="string">
+  OrgID is the organization ID
+</ParamField>
+
+<ParamField body="apis[].config.override" type="boolean">
+  Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue.
+</ParamField>
+
+<ParamField body="apis[].config.redirect_on_key_request" type="boolean">
+  RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field
+</ParamField>
+
+<ParamField body="apis[].config.redirect_to" type="string">
+  RedirectTo is a url used to redirect key requests
+</ParamField>
+
+<ParamField body="apis[].config.require_key_approval" type="boolean">
+  RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the 'Key requests' section of the dashboard.
+</ParamField>
+
+<ParamField body="apis[].config.secure_key_approval" type="boolean">
+  SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely
+</ParamField>
+
+<ParamField body="apis[].config.signup_fields[]" type="string">
+  SignUpFields is a slice of fields which are asked of the portal developer when they register for an account
+</ParamField>
+
+<ParamField body="apis[].docs" type="object" />
+
+<ParamField body="apis[].docs.doc_type" type="string" required>
+  **Allowed values:** `swagger`, `swagger_custom_url`, `graphql`.
+</ParamField>
+
+<ParamField body="apis[].docs.documentation" type="string" />
+
+<ParamField body="apis[].documentation" type="string">
+  Do not set Documentation. Use `docs` instead.
+</ParamField>
+
+<ParamField body="apis[].fields" type="object">
+  Fields is a generic map of key:value pairs. You may wish to use this to tag a catalogue as type:internal or type:public Then apply logic at the template layer to dynamically display catalogue apis to different user types.
+</ParamField>
+
+<ParamField body="apis[].fields.{key}" type="string" />
+
+<ParamField body="apis[].is_keyless" type="boolean">
+  IsKeyless toggles visibility of the `Request an API Key button`. Use this when AuthType is keyless, jwt or oauth.
+</ParamField>
+
+<ParamField body="apis[].long_description" type="string">
+  LongDescription can be markdown. It allows you to describe the capabilities of the API and is displayed just below the name and AuthType in the catalogue listing page.
+</ParamField>
+
+<ParamField body="apis[].name" type="string">
+  Name is the title of the API that you wish to be published to the catalogue
+</ParamField>
+
+<ParamField body="apis[].policy_id" type="string">
+  PolicyID explicitly sets the policy_id to be published. We do not recommend that this value is set directly. Rather, use `policyRef` instead.
+</ParamField>
+
+<ParamField body="apis[].policyRef" type="object" />
+
+<ParamField body="apis[].policyRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="apis[].policyRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+<ParamField body="apis[].short_description" type="string">
+  ShortDescription is a brief summary of the API shown in the portal catalogue. Note that it may not be rendered by the default portal templates.
+</ParamField>
+
+<ParamField body="apis[].show" type="boolean">
+  Show toggles visibility of the API in the portal catalogue
+</ParamField>
+
+<ParamField body="apis[].version" type="string" default="v2">
+  Version should always be v2 **Allowed values:** `v2`.
+</ParamField>
+
+### contextRef
+
+<ParamField body="contextRef" type="object">
+  Context is reference to OperatorContext resource. Set this if you want to target a specific OperatorContext. When omitted default OperatorContext is used.
+</ParamField>
+
+<ParamField body="contextRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="contextRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+## PortalConfig
+
+PortalConfigSpec defines the desired state of PortalConfig
+
+### Top-Level Fields
+
+<ParamField body="catalogue_login_only" type="boolean">
+  CatalogueLoginOnly limits access to catalogues for login users only.
+</ParamField>
+
+<ParamField body="disable_auto_login" type="boolean" />
+
+<ParamField body="disable_login" type="boolean">
+  DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method.
+</ParamField>
+
+<ParamField body="disable_signup" type="boolean">
+  DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API.
+</ParamField>
+
+<ParamField body="email" type="string" />
+
+<ParamField body="enable_dcr" type="boolean">
+  EnableDCR activates dynamic client registration.
+</ParamField>
+
+<ParamField body="enable_multi_selection" type="boolean">
+  EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type
+</ParamField>
+
+<ParamField body="id" type="string">
+  Set by the server. DO NOT set this field it is read only.
+</ParamField>
+
+<ParamField body="key_request_fields[]" type="string">
+  KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key
+</ParamField>
+
+<ParamField body="oauth_usage_limit" type="integer">
+  OAuthUsageLimit is the maximum permitted number of OAuth clients
+</ParamField>
+
+<ParamField body="org_id" type="string">
+  OrgID is the organization ID
+</ParamField>
+
+<ParamField body="override" type="boolean">
+  Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue.
+</ParamField>
+
+<ParamField body="redirect_on_key_request" type="boolean">
+  RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field
+</ParamField>
+
+<ParamField body="redirect_to" type="string">
+  RedirectTo is a url used to redirect key requests
+</ParamField>
+
+<ParamField body="require_key_approval" type="boolean">
+  RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the 'Key requests' section of the dashboard.
+</ParamField>
+
+<ParamField body="secure_key_approval" type="boolean">
+  SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely
+</ParamField>
+
+<ParamField body="signup_fields[]" type="string">
+  SignUpFields is a slice of fields which are asked of the portal developer when they register for an account
+</ParamField>
+
+### contextRef
+
+<ParamField body="contextRef" type="object" />
+
+<ParamField body="contextRef.name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="contextRef.namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
+
+### dcr_options
+
+<ParamField body="dcr_options" type="object">
+  DCROptions dynamic client registration options.
+</ParamField>
+
+<ParamField body="dcr_options.grant_types[]" type="string" required>
+  GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. **Allowed values:** `client_credentials`, `authorization_code`, `refresh_token`.
+</ParamField>
+
+<ParamField body="dcr_options.idp_host" type="string" required>
+  IDPHost is the fully qualified hostname of the Identity Provider. e.g. https://mysubdomain.eu.auth0.com
+</ParamField>
+
+<ParamField body="dcr_options.registration_endpoint" type="string" required>
+  RegistrationEndpoint is the registration_endpoint as presented in the /.well-known/openid-configuration document.
+</ParamField>
+
+<ParamField body="dcr_options.token_endpoint_auth_method" type="string" required>
+  TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. "none": The client is a public client and does not have a client secret. "client_secret_post": The client uses the HTTP POST parameters "client_secret_basic": The client uses HTTP Basic authentication **Allowed values:** `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `none`.
+</ParamField>
+
+<ParamField body="dcr_options.access_token" type="string">
+  AccessToken represents an optional bearer token to authenticate with against the registration endpoint
+</ParamField>
+
+<ParamField body="dcr_options.provider" type="string">
+  Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. **Allowed values:** `gluu`, `keycloak`, `okta`.
+</ParamField>
+
+<ParamField body="dcr_options.response_types[]" type="string">
+  ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. **Allowed values:** `code`, `token`.
+</ParamField>
+
+### mail_options
+
+<ParamField body="mail_options" type="object" />
+
+<ParamField body="mail_options.email_copy" type="object" required />
+
+<ParamField body="mail_options.email_copy.key_email" type="object" required />
+
+<ParamField body="mail_options.email_copy.key_email.body" type="string" required />
+
+<ParamField body="mail_options.email_copy.key_email.enabled" type="boolean" required />
+
+<ParamField body="mail_options.email_copy.key_email.hide_token_data" type="boolean" required />
+
+<ParamField body="mail_options.email_copy.key_email.sign_off" type="string" required />
+
+<ParamField body="mail_options.email_copy.key_email.subject" type="string" required />
+
+<ParamField body="mail_options.email_copy.reset_password_email" type="object" required />
+
+<ParamField body="mail_options.email_copy.reset_password_email.body" type="string" required />
+
+<ParamField body="mail_options.email_copy.reset_password_email.enabled" type="boolean" required />
+
+<ParamField body="mail_options.email_copy.reset_password_email.hide_token_data" type="boolean" required />
+
+<ParamField body="mail_options.email_copy.reset_password_email.sign_off" type="string" required />
+
+<ParamField body="mail_options.email_copy.reset_password_email.subject" type="string" required />
+
+<ParamField body="mail_options.email_copy.welcome_email" type="object" required />
+
+<ParamField body="mail_options.email_copy.welcome_email.body" type="string" required />
+
+<ParamField body="mail_options.email_copy.welcome_email.enabled" type="boolean" required />
+
+<ParamField body="mail_options.email_copy.welcome_email.hide_token_data" type="boolean" required />
+
+<ParamField body="mail_options.email_copy.welcome_email.sign_off" type="string" required />
+
+<ParamField body="mail_options.email_copy.welcome_email.subject" type="string" required />
+
+<ParamField body="mail_options.mail_from_email" type="string" required />
+
+<ParamField body="mail_options.mail_from_name" type="string" required />
+
+## SubGraph
+
+SubGraphSpec defines the desired state of SubGraph
+
+### Top-Level Fields
+
+<ParamField body="schema" type="string" required />
+
+<ParamField body="sdl" type="string" required />
+
+## SuperGraph
+
+SuperGraphSpec defines the desired state of SuperGraph
+
+### Top-Level Fields
+
+<ParamField body="merged_sdl" type="string" />
+
+<ParamField body="schema" type="string" />
+
+### subgraph_refs
+
+<ParamField body="subgraph_refs[]" type="object" required />
+
+<ParamField body="subgraph_refs[].name" type="string" required>
+  k8s resource name
+</ParamField>
+
+<ParamField body="subgraph_refs[].namespace" type="string">
+  The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
+</ParamField>
diff --git a/snippets/oss-product-list-include.mdx b/snippets/oss-product-list-include.mdx
new file mode 100644
index 0000000000..b7fb52e516
--- /dev/null
+++ b/snippets/oss-product-list-include.mdx
@@ -0,0 +1,47 @@
+---
+---
+
+The Tyk Team has created and maintains the following components, which are fully Open Source and available under Mozilla Public License 2.0 (MPL). Star the Tyk components you use by clicking the appropriate button:
+
+export const linkStyle = {
+    fontWeight: 'normal',
+    textDecoration: 'none',
+    borderBottom: 'none',
+    color: 'rgb(var(--primary))',
+    transition: 'border-bottom 0.2s ease'
+};
+
+export const handleMouseEnter = (e) => {
+    e.target.style.borderBottom = '1px solid rgb(var(--primary))';
+};
+
+export const handleMouseLeave = (e) => {
+    e.target.style.borderBottom = 'none';
+};
+
+<Columns cols={2}>
+  <Card title="Tyk Gateway" href="https://github.com/TykTechnologies/tyk" cta="⭐️ Github" arrow={true}>
+    Fully fledged API Gateway.
+
+    <a href="/tyk-oss-gateway" style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>Learn more</a>
+  </Card>
+  <Card title="Tyk Pump" href="https://github.com/TykTechnologies/tyk-pump" cta="⭐️ Github" arrow={true}>
+    Send API analytics data to your chosen backend.
+
+    <a href="/api-management/tyk-pump" style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>Learn more</a>
+  </Card>
+  <Card title="Tyk Identity Broker" href="https://github.com/TykTechnologies/tyk-identity-broker" cta="⭐️ Github" arrow={true}>
+    Connect your third-party IdP systems.
+
+    <a href="/tyk-identity-broker/overview" style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>Learn more</a>
+  </Card>
+  <Card title="Tyk Helm Chart" href="https://github.com/TykTechnologies/tyk-charts" cta="⭐️ Github" arrow={true}>
+    Deploy Tyk in K8S.
+
+    <a href="/product-stack/tyk-charts/overview" style={linkStyle} onMouseEnter={handleMouseEnter} onMouseLeave={handleMouseLeave}>Learn more</a>
+  </Card>
+</Columns>
+
+MPL is a copyleft license that is easy to comply with. You must make the source code for any of your changes available under MPL, but you can combine the MPL software with proprietary code, as long as you keep the MPL code in separate files. Version 2.0 is, by default, compatible with LGPL and GPL version 2 or greater. You can distribute binaries under a proprietary license, as long as you make the source available under MPL. This is just a brief overview of MPL, you should refer to the MPL license in full and if you are in any doubt about how this license impacts you, please contact us to discuss.
+
+You can find additional FAQs regarding the MPL license [here](https://www.mozilla.org/en-US/MPL/2.0/FAQ/).
diff --git a/snippets/portal-developer-analytics.mdx b/snippets/portal-developer-analytics.mdx
new file mode 100644
index 0000000000..6cdfadca35
--- /dev/null
+++ b/snippets/portal-developer-analytics.mdx
@@ -0,0 +1,38 @@
+---
+---
+
+### Analytics
+
+You can get aggregate statistics for 1 key or all developer keys (need to specify a list of all keys). Also, you can group by day (hour or month), and by API (policy id).
+
+API Endpoint: `/api/activity/keys/aggregate/#{keys}/#{from}/#{to}?p=-1&res=day`
+
+*  `keys` should be specified separated by ',' delimiter.
+*  `from` and `to` values must be in // format.
+*  resolution specified `res` attribute: 'day', 'hour' or 'month'
+*  `api_id` - policy id associated with developer portal API. If ommited return stats for all APIs.
+
+#### Request
+
+```{.copyWrapper}
+curl "https://admin.cloud.tyk.io/api/activity/keys/aggregate/add2b342,5f1d9603,/5/8/2017/13/8/2017?api_id=8e4d983609c044984ecbb286b8d25cd9&api_version=Non+Versioned&p=-1&res=day" \
+-X GET \
+-H "authorization: $TYK_API_KEY"
+```
+
+#### Response
+
+```
+{ "data":[
+  {
+    "id":{"day":9,"month":8,"year":2017,"hour":0,"code":200},
+    "hits":13,
+    "success":10,
+    "error":3,
+    "last_hit":"2017-08-09T12:31:02Z"
+  },
+  ...
+],"pages":0}
+```
+
+In example above `add2b342,5f1d9603`, is 2 users keys. Note that this example shows [hashed key values as described here](/api-management/access-control/sessions-and-keys/key-hashing). Key hashing is turned on for the Cloud, but for Multi-Cloud and Self-Managed installations you can also turn it off. Hashed keys mean that the API administrator does not have access to real user keys, but they can still use the hashed values for showing analytics.
\ No newline at end of file
diff --git a/snippets/pump-config.mdx b/snippets/pump-config.mdx
new file mode 100644
index 0000000000..5c2e5d6289
--- /dev/null
+++ b/snippets/pump-config.mdx
@@ -0,0 +1,5201 @@
+### purge_chunk
+ENV: <b>TYK_PMP_PURGECHUNK</b><br />
+Type: `int64`<br />
+
+The maximum number of records to pull from Redis at a time. If it's unset or `0`, all the
+analytics records in Redis are pulled. If it's set, `storage_expiration_time` is used to
+reset the analytics record TTL.
+
+### storage_expiration_time
+ENV: <b>TYK_PMP_STORAGEEXPIRATIONTIME</b><br />
+Type: `int64`<br />
+
+The number of seconds for the analytics records TTL. It only works if `purge_chunk` is
+enabled. Defaults to `60` seconds.
+
+### uptime_pump_config
+Example Uptime Pump configuration:
+```{.json}
+"uptime_pump_config": {
+  "uptime_type": "mongo",
+  "mongo_url": "mongodb://localhost:27017",
+  "collection_name": "tyk_uptime_analytics"
+},
+
+### SQL Uptime Pump
+*Supported in Tyk Pump v1.5.0+*
+
+In `uptime_pump_config` you can configure a SQL uptime pump. To do that, you need to add the
+field `uptime_type` with `sql` value. You can also use different types of SQL Uptime pumps,
+like `postgres` using the `type` field.
+
+An example of a SQL Postgres uptime pump would be:
+```{.json}
+"uptime_pump_config": {
+    "uptime_type": "sql",
+    "type": "postgres",
+    "connection_string": "host=sql_host port=sql_port user=sql_usr dbname=dbname password=sql_pw",
+    "table_sharding": false
+},
+```
+
+Take into account that you can also set `log_level` field into the `uptime_pump_config` to `debug`,
+`info` or `warning`. By default, the SQL logger verbosity is `silent`.
+
+### uptime_pump_config.EnvPrefix
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_ENVPREFIX</b><br />
+Type: `string`<br />
+
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_SQL_META`
+
+### uptime_pump_config.mongo_url
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGOURL</b><br />
+Type: `string`<br />
+
+The full URL to your MongoDB instance, this can be a clustered instance if necessary and
+should include the database and username / password data.
+
+### uptime_pump_config.mongo_use_ssl
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGOUSESSL</b><br />
+Type: `bool`<br />
+
+Set to true to enable Mongo SSL connection.
+
+### uptime_pump_config.mongo_ssl_insecure_skip_verify
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGOSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Allows the use of self-signed certificates when connecting to an encrypted MongoDB database.
+
+### uptime_pump_config.mongo_ssl_allow_invalid_hostnames
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGOSSLALLOWINVALIDHOSTNAMES</b><br />
+Type: `bool`<br />
+
+Ignore hostname check when it differs from the original (for example with SSH tunneling).
+The rest of the TLS verification will still be performed.
+
+### uptime_pump_config.mongo_ssl_ca_file
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGOSSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file with trusted root certificates
+
+### uptime_pump_config.mongo_ssl_pem_keyfile
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGOSSLPEMKEYFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file which contains both client certificate and private key. This is
+required for Mutual TLS.
+
+### uptime_pump_config.mongo_db_type
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGODBTYPE</b><br />
+Type: `int`<br />
+
+Specify the target MongoDB compatible database:
+- set to `0` for MongoDB (default)
+- set to `1` for AWS Document DB
+- set to `2` for CosmosDB
+
+### uptime_pump_config.omit_index_creation
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_OMITINDEXCREATION</b><br />
+Type: `bool`<br />
+
+Set to true to disable the default tyk index creation.
+
+### uptime_pump_config.mongo_session_consistency
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGOSESSIONCONSISTENCY</b><br />
+Type: `string`<br />
+
+Set the consistency mode for the session, it defaults to `Strong`. The valid values are: strong, monotonic, eventual.
+
+### uptime_pump_config.driver
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGODRIVERTYPE</b><br />
+Type: `string`<br />
+
+MongoDriverType is the type of the driver (library) to use. The valid values are: “mongo-go” and “mgo”.
+Since v1.9, the default driver is "mongo-go". Check out this guide to [learn about MongoDB drivers supported by Tyk Pump](https://github.com/TykTechnologies/tyk-pump#driver-type).
+
+### uptime_pump_config.mongo_direct_connection
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MONGODIRECTCONNECTION</b><br />
+Type: `bool`<br />
+
+MongoDirectConnection informs whether to establish connections only with the specified seed servers,
+or to obtain information for the whole cluster and establish connections with further servers too.
+If true, the client will only connect to the host provided in the ConnectionString
+and won't attempt to discover other hosts in the cluster. Useful when network restrictions
+prevent discovery, such as with SSH tunneling. Default is false.
+
+### uptime_pump_config.collection_name
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_COLLECTIONNAME</b><br />
+Type: `string`<br />
+
+Specifies the mongo collection name.
+
+### uptime_pump_config.max_insert_batch_size_bytes
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MAXINSERTBATCHSIZEBYTES</b><br />
+Type: `int`<br />
+
+Maximum insert batch size for mongo selective pump. If the batch we are writing surpasses this value, it will be sent in multiple batches.
+Defaults to 10Mb.
+
+### uptime_pump_config.max_document_size_bytes
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MAXDOCUMENTSIZEBYTES</b><br />
+Type: `int`<br />
+
+Maximum document size. If the document exceed this value, it will be skipped.
+Defaults to 10Mb.
+
+### uptime_pump_config.collection_cap_max_size_bytes
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_COLLECTIONCAPMAXSIZEBYTES</b><br />
+Type: `int`<br />
+
+Amount of bytes of the capped collection in 64bits architectures.
+Defaults to 5GB.
+
+### uptime_pump_config.collection_cap_enable
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_COLLECTIONCAPENABLE</b><br />
+Type: `bool`<br />
+
+Enable collection capping. It's used to set a maximum size of the collection.
+
+### uptime_pump_config.type
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_TYPE</b><br />
+Type: `string`<br />
+
+The only supported and tested types are `postgres` and `mysql`.
+From v1.12.0, we no longer support `sqlite` as a storage type.
+
+### uptime_pump_config.connection_string
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+Specifies the connection string to the database.
+
+### uptime_pump_config.postgres
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_POSTGRES</b><br />
+Type: `PostgresConfig`<br />
+
+Postgres configurations.
+
+### uptime_pump_config.postgres.prefer_simple_protocol
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_POSTGRES_PREFERSIMPLEPROTOCOL</b><br />
+Type: `bool`<br />
+
+Disables implicit prepared statement usage.
+
+### uptime_pump_config.mysql
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MYSQL</b><br />
+Type: `MysqlConfig`<br />
+
+Mysql configurations.
+
+### uptime_pump_config.mysql.default_string_size
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MYSQL_DEFAULTSTRINGSIZE</b><br />
+Type: `uint`<br />
+
+Default size for string fields. Defaults to `256`.
+
+### uptime_pump_config.mysql.disable_datetime_precision
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MYSQL_DISABLEDATETIMEPRECISION</b><br />
+Type: `bool`<br />
+
+Disable datetime precision, which not supported before MySQL 5.6.
+
+### uptime_pump_config.mysql.dont_support_rename_index
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MYSQL_DONTSUPPORTRENAMEINDEX</b><br />
+Type: `bool`<br />
+
+Drop & create when rename index, rename index not supported before MySQL 5.7, MariaDB.
+
+### uptime_pump_config.mysql.dont_support_rename_column
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MYSQL_DONTSUPPORTRENAMECOLUMN</b><br />
+Type: `bool`<br />
+
+`change` when rename column, rename column not supported before MySQL 8, MariaDB.
+
+### uptime_pump_config.mysql.skip_initialize_with_version
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MYSQL_SKIPINITIALIZEWITHVERSION</b><br />
+Type: `bool`<br />
+
+Auto configure based on currently MySQL version.
+
+### uptime_pump_config.table_sharding
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_TABLESHARDING</b><br />
+Type: `bool`<br />
+
+Specifies if all the analytics records are going to be stored in one table or in multiple
+tables (one per day). By default, `false`. If `false`, all the records are going to be
+stored in `tyk_aggregated` table. Instead, if it's `true`, all the records of the day are
+going to be stored in `tyk_aggregated_YYYYMMDD` table, where `YYYYMMDD` is going to change
+depending on the date.
+
+### uptime_pump_config.log_level
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_LOGLEVEL</b><br />
+Type: `string`<br />
+
+Specifies the SQL log verbosity. The possible values are: `info`,`error` and `warning`. By
+default, the value is `silent`, which means that it won't log any SQL query.
+
+### uptime_pump_config.batch_size
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_BATCHSIZE</b><br />
+Type: `int`<br />
+
+Specifies the amount of records that are going to be written each batch. Type int. By
+default, it writes 1000 records max per batch.
+
+### uptime_pump_config.migrate_sharded_tables
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_MIGRATESHARDEDTABLES</b><br />
+Type: `bool`<br />
+
+Specifies whether to migrate all existing sharded tables to latest schema during Pump initialization (default: false).
+When true, on initialization Pump will scan and migrate all sharded tables to the latest schema.
+When false, existing tables will not be migrated and may miss columns included in the latest schema.
+If there are a large number of existing tables, or those tables are in use by other services, there may be a performance impact from the migration. We recommend testing carefully.
+
+### uptime_pump_config.uptime_type
+ENV: <b>TYK_PMP_UPTIMEPUMPCONFIG_UPTIMETYPE</b><br />
+Type: `string`<br />
+
+Determines the uptime type. Options are `mongo` and `sql`. Defaults to `mongo`.
+
+### pumps
+The default environment variable prefix for each pump follows this format:
+`TYK_PMP_PUMPS_{PUMP-NAME}_`, for example `TYK_PMP_PUMPS_KAFKA_`.
+
+You can also set custom names for each pump specifying the pump type. For example, if you
+want a Kafka pump which is called `PROD` you need to create `TYK_PMP_PUMPS_PROD_TYPE=kafka`
+and configure it using the `TYK_PMP_PUMPS_PROD_` prefix.
+
+### pumps.csv.name
+ENV: <b>TYK_PMP_PUMPS_CSV_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.csv.type
+ENV: <b>TYK_PMP_PUMPS_CSV_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.csv.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.csv.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_CSV_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.csv.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_CSV_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.csv.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_CSV_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.csv.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_CSV_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.csv.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_CSV_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.csv.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_CSV_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.csv.timeout
+ENV: <b>TYK_PMP_PUMPS_CSV_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.csv.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_CSV_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.csv.max_record_size
+ENV: <b>TYK_PMP_PUMPS_CSV_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.csv.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_CSV_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.csv.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_CSV_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_CSV_META`
+
+### pumps.csv.meta.csv_dir
+ENV: <b>TYK_PMP_PUMPS_CSV_META_CSVDIR</b><br />
+Type: `string`<br />
+
+The directory and the filename where the CSV data will be stored.
+
+### pumps.dogstatsd.name
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.dogstatsd.type
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.dogstatsd.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.dogstatsd.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.dogstatsd.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.dogstatsd.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.dogstatsd.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.dogstatsd.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.dogstatsd.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.dogstatsd.timeout
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.dogstatsd.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.dogstatsd.max_record_size
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.dogstatsd.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.dogstatsd.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_DOGSTATSD_META`
+
+### pumps.dogstatsd.meta.namespace
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_META_NAMESPACE</b><br />
+Type: `string`<br />
+
+Prefix for your metrics to datadog.
+
+### pumps.dogstatsd.meta.address
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_META_ADDRESS</b><br />
+Type: `string`<br />
+
+Address of the datadog agent including host & port.
+
+### pumps.dogstatsd.meta.sample_rate
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_META_SAMPLERATE</b><br />
+Type: `float64`<br />
+
+Defaults to `1` which equates to `100%` of requests. To sample at `50%`, set to `0.5`.
+
+### pumps.dogstatsd.meta.async_uds
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_META_ASYNCUDS</b><br />
+Type: `bool`<br />
+
+Enable async UDS over UDP https://github.com/Datadog/datadog-go#unix-domain-sockets-client.
+
+### pumps.dogstatsd.meta.async_uds_write_timeout_seconds
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_META_ASYNCUDSWRITETIMEOUT</b><br />
+Type: `int`<br />
+
+Integer write timeout in seconds if `async_uds: true`.
+
+### pumps.dogstatsd.meta.buffered
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_META_BUFFERED</b><br />
+Type: `bool`<br />
+
+Enable buffering of messages.
+
+### pumps.dogstatsd.meta.buffered_max_messages
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_META_BUFFEREDMAXMESSAGES</b><br />
+Type: `int`<br />
+
+Max messages in single datagram if `buffered: true`. Default 16.
+
+### pumps.dogstatsd.meta.tags
+ENV: <b>TYK_PMP_PUMPS_DOGSTATSD_META_TAGS</b><br />
+Type: `[]string`<br />
+
+List of tags to be added to the metric. The possible options are listed in the below example.
+
+If no tag is specified the fallback behavior is to use the below tags:
+- `path`
+- `method`
+- `response_code`
+- `api_version`
+- `api_name`
+- `api_id`
+- `org_id`
+- `tracked`
+- `oauth_id`
+
+Note that this configuration can generate significant charges due to the unbound nature of
+the `path` tag.
+
+```{.json}
+"dogstatsd": {
+  "type": "dogstatsd",
+  "meta": {
+    "address": "localhost:8125",
+    "namespace": "pump",
+    "async_uds": true,
+    "async_uds_write_timeout_seconds": 2,
+    "buffered": true,
+    "buffered_max_messages": 32,
+    "sample_rate": 0.5,
+    "tags": [
+      "method",
+      "response_code",
+      "api_version",
+      "api_name",
+      "api_id",
+      "org_id",
+      "tracked",
+      "path",
+      "oauth_id"
+    ]
+  }
+},
+```
+
+On startup, you should see the loaded configs when initializing the dogstatsd pump
+```
+[May 10 15:23:44]  INFO dogstatsd: initializing pump
+[May 10 15:23:44]  INFO dogstatsd: namespace: pump.
+[May 10 15:23:44]  INFO dogstatsd: sample_rate: 50%
+[May 10 15:23:44]  INFO dogstatsd: buffered: true, max_messages: 32
+[May 10 15:23:44]  INFO dogstatsd: async_uds: true, write_timeout: 2s
+```
+
+### pumps.elasticsearch.name
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.elasticsearch.type
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.elasticsearch.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.elasticsearch.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.elasticsearch.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.elasticsearch.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.elasticsearch.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.elasticsearch.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.elasticsearch.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.elasticsearch.timeout
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.elasticsearch.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.elasticsearch.max_record_size
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.elasticsearch.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.elasticsearch.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_ELASTICSEARCH_META`
+
+### pumps.elasticsearch.meta.index_name
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_INDEXNAME</b><br />
+Type: `string`<br />
+
+The name of the index that all the analytics data will be placed in. Defaults to
+"tyk_analytics".
+
+### pumps.elasticsearch.meta.elasticsearch_url
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_ELASTICSEARCHURL</b><br />
+Type: `string`<br />
+
+If sniffing is disabled, the URL that all data will be sent to. Defaults to
+"http://localhost:9200".
+
+### pumps.elasticsearch.meta.use_sniffing
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_ENABLESNIFFING</b><br />
+Type: `bool`<br />
+
+If sniffing is enabled, the "elasticsearch_url" will be used to make a request to get a
+list of all the nodes in the cluster, the returned addresses will then be used. Defaults to
+`false`.
+
+### pumps.elasticsearch.meta.document_type
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_DOCUMENTTYPE</b><br />
+Type: `string`<br />
+
+The type of the document that is created in ES. Defaults to "tyk_analytics".
+
+### pumps.elasticsearch.meta.rolling_index
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_ROLLINGINDEX</b><br />
+Type: `bool`<br />
+
+Appends the date to the end of the index name, so each days data is split into a different
+index name. E.g. tyk_analytics-2016.02.28. Defaults to `false`.
+
+### pumps.elasticsearch.meta.extended_stats
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_EXTENDEDSTATISTICS</b><br />
+Type: `bool`<br />
+
+If set to `true` will include the following additional fields: Raw Request, Raw Response and
+User Agent.
+
+### pumps.elasticsearch.meta.generate_id
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_GENERATEID</b><br />
+Type: `bool`<br />
+
+When enabled, generate _id for outgoing records. This prevents duplicate records when
+retrying ES.
+
+### pumps.elasticsearch.meta.decode_base64
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_DECODEBASE64</b><br />
+Type: `bool`<br />
+
+Allows for the base64 bits to be decode before being passed to ES.
+
+### pumps.elasticsearch.meta.version
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_VERSION</b><br />
+Type: `string`<br />
+
+Specifies the ES version. Use "3" for ES 3.X, "5" for ES 5.X, "6" for ES 6.X, "7" for ES
+7.X . Defaults to "3".
+
+### pumps.elasticsearch.meta.disable_bulk
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_DISABLEBULK</b><br />
+Type: `bool`<br />
+
+Disable batch writing. Defaults to false.
+
+### pumps.elasticsearch.meta.bulk_config
+Batch writing trigger configuration. Each option is an OR with eachother:
+
+### pumps.elasticsearch.meta.bulk_config.workers
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_BULKCONFIG_WORKERS</b><br />
+Type: `int`<br />
+
+Number of workers. Defaults to 1.
+
+### pumps.elasticsearch.meta.bulk_config.flush_interval
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_BULKCONFIG_FLUSHINTERVAL</b><br />
+Type: `int`<br />
+
+Specifies the time in seconds to flush the data and send it to ES. Default disabled.
+
+### pumps.elasticsearch.meta.bulk_config.bulk_actions
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_BULKCONFIG_BULKACTIONS</b><br />
+Type: `int`<br />
+
+Specifies the number of requests needed to flush the data and send it to ES. Defaults to
+1000 requests. If it is needed, can be disabled with -1.
+
+### pumps.elasticsearch.meta.bulk_config.bulk_size
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_BULKCONFIG_BULKSIZE</b><br />
+Type: `int`<br />
+
+Specifies the size (in bytes) needed to flush the data and send it to ES. Defaults to 5MB.
+If it is needed, can be disabled with -1.
+
+### pumps.elasticsearch.meta.auth_api_key_id
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_AUTHAPIKEYID</b><br />
+Type: `string`<br />
+
+API Key ID used for APIKey auth in ES. It's send to ES in the Authorization header as ApiKey base64(auth_api_key_id:auth_api_key)
+
+### pumps.elasticsearch.meta.auth_api_key
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_AUTHAPIKEY</b><br />
+Type: `string`<br />
+
+API Key used for APIKey auth in ES. It's send to ES in the Authorization header as ApiKey base64(auth_api_key_id:auth_api_key)
+
+### pumps.elasticsearch.meta.auth_basic_username
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_USERNAME</b><br />
+Type: `string`<br />
+
+Basic auth username. It's send to ES in the Authorization header as username:password encoded in base64.
+
+### pumps.elasticsearch.meta.auth_basic_password
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_PASSWORD</b><br />
+Type: `string`<br />
+
+Basic auth password. It's send to ES in the Authorization header as username:password encoded in base64.
+
+### pumps.elasticsearch.meta.use_ssl
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_USESSL</b><br />
+Type: `bool`<br />
+
+Enables SSL connection.
+
+### pumps.elasticsearch.meta.ssl_insecure_skip_verify
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Controls whether the pump client verifies the Elastic Search server's certificate chain and hostname.
+
+### pumps.elasticsearch.meta.ssl_cert_file
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_SSLCERTFILE</b><br />
+Type: `string`<br />
+
+Can be used to set custom certificate file for authentication with Elastic Search.
+
+### pumps.elasticsearch.meta.ssl_key_file
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_SSLKEYFILE</b><br />
+Type: `string`<br />
+
+Can be used to set custom key file for authentication with Elastic Search.
+
+### pumps.elasticsearch.meta.ssl_ca_file
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_SSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file with trusted CA certificates that will be used to verify the Elasticsearch server's certificate.
+
+### pumps.elasticsearch.meta.mcp_index_name
+ENV: <b>TYK_PMP_PUMPS_ELASTICSEARCH_META_MCPINDEXNAME</b><br />
+Type: `string`<br />
+
+When set, Model Context Protocol (MCP) records are written to this index instead of the default `IndexName`. Supports the same rolling-index date suffix as `IndexName` when `RollingIndex` is enabled. Defaults to `""` (empty string), meaning all records go to `IndexName`.
+
+### pumps.graylog.name
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.graylog.type
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.graylog.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.graylog.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.graylog.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.graylog.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.graylog.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.graylog.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.graylog.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.graylog.timeout
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.graylog.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.graylog.max_record_size
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.graylog.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.graylog.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_GRAYLOG_META`
+
+### pumps.graylog.meta.host
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_META_GRAYLOGHOST</b><br />
+Type: `string`<br />
+
+Graylog host.
+
+### pumps.graylog.meta.port
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_META_GRAYLOGPORT</b><br />
+Type: `int`<br />
+
+Graylog port.
+
+### pumps.graylog.meta.tags
+ENV: <b>TYK_PMP_PUMPS_GRAYLOG_META_TAGS</b><br />
+Type: `[]string`<br />
+
+List of tags to be added to the metric. The possible options are listed in the below example.
+
+If no tag is specified the fallback behaviour is to don't send anything.
+The possible values are:
+- `path`
+- `method`
+- `response_code`
+- `api_version`
+- `api_name`
+- `api_id`
+- `org_id`
+- `tracked`
+- `oauth_id`
+- `raw_request`
+- `raw_response`
+- `request_time`
+- `ip_address`
+
+### pumps.hybrid.name
+ENV: <b>TYK_PMP_PUMPS_HYBRID_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.hybrid.type
+ENV: <b>TYK_PMP_PUMPS_HYBRID_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.hybrid.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.hybrid.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_HYBRID_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.hybrid.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_HYBRID_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.hybrid.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_HYBRID_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.hybrid.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_HYBRID_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.hybrid.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_HYBRID_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.hybrid.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_HYBRID_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.hybrid.timeout
+ENV: <b>TYK_PMP_PUMPS_HYBRID_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.hybrid.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_HYBRID_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.hybrid.max_record_size
+ENV: <b>TYK_PMP_PUMPS_HYBRID_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.hybrid.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_HYBRID_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.hybrid.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_HYBRID_META`
+
+### pumps.hybrid.meta.ConnectionString
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+MDCB URL connection string
+
+### pumps.hybrid.meta.RPCKey
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_RPCKEY</b><br />
+Type: `string`<br />
+
+Your organization ID to connect to the MDCB installation.
+
+### pumps.hybrid.meta.APIKey
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_APIKEY</b><br />
+Type: `string`<br />
+
+This the API key of a user used to authenticate and authorize the Hybrid Pump access through MDCB.
+The user should be a standard Dashboard user with minimal privileges so as to reduce any risk if the user is compromised.
+
+### pumps.hybrid.meta.ignore_tag_prefix_list
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_IGNORETAGPREFIXLIST</b><br />
+Type: `[]string`<br />
+
+Specifies prefixes of tags that should be ignored if `aggregated` is set to `true`.
+
+### pumps.hybrid.meta.CallTimeout
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_CALLTIMEOUT</b><br />
+Type: `int`<br />
+
+Hybrid pump RPC calls timeout in seconds. Defaults to `10` seconds.
+
+### pumps.hybrid.meta.RPCPoolSize
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_RPCPOOLSIZE</b><br />
+Type: `int`<br />
+
+Hybrid pump connection pool size. Defaults to `5`.
+
+### pumps.hybrid.meta.aggregationTime
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_AGGREGATIONTIME</b><br />
+Type: `int`<br />
+
+aggregationTime is to specify the frequency of the aggregation in minutes if `aggregated` is set to `true`.
+
+### pumps.hybrid.meta.Aggregated
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_AGGREGATED</b><br />
+Type: `bool`<br />
+
+Send aggregated analytics data to Tyk MDCB
+
+### pumps.hybrid.meta.TrackAllPaths
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_TRACKALLPATHS</b><br />
+Type: `bool`<br />
+
+Specifies if it should store aggregated data for all the endpoints if `aggregated` is set to `true`. By default, `false`
+which means that only store aggregated data for `tracked endpoints`.
+
+### pumps.hybrid.meta.store_analytics_per_minute
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_STOREANALYTICSPERMINUTE</b><br />
+Type: `bool`<br />
+
+Determines if the aggregations should be made per minute (true) or per hour (false) if `aggregated` is set to `true`.
+
+### pumps.hybrid.meta.enable_mcp_aggregation
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_ENABLEMCPAGGREGATION</b><br />
+Type: `bool`<br />
+
+Controls whether MCP analytics are aggregated and sent to MDCB via a separate RPC call. If `pumps.hybrid.meta.aggregated` is set to true and `enable_mcp_aggregation` is set to false, MCP analytics are not aggregated and are completely dropped. If `pumps.hybrid.meta.aggregated` is false, this flag is ignored entirely and all analytics (including MCP) are sent as raw, unaggregated data.
+
+### pumps.hybrid.meta.UseSSL
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_USESSL</b><br />
+Type: `bool`<br />
+
+Use SSL to connect to Tyk MDCB
+
+### pumps.hybrid.meta.SSLInsecureSkipVerify
+ENV: <b>TYK_PMP_PUMPS_HYBRID_META_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Skip SSL verification
+
+### pumps.influx.name
+ENV: <b>TYK_PMP_PUMPS_INFLUX_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.influx.type
+ENV: <b>TYK_PMP_PUMPS_INFLUX_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.influx.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.influx.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_INFLUX_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.influx.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_INFLUX_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.influx.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_INFLUX_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.influx.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_INFLUX_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.influx.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_INFLUX_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.influx.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_INFLUX_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.influx.timeout
+ENV: <b>TYK_PMP_PUMPS_INFLUX_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.influx.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_INFLUX_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.influx.max_record_size
+ENV: <b>TYK_PMP_PUMPS_INFLUX_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.influx.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_INFLUX_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.influx.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_INFLUX_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_INFLUX_META`
+
+### pumps.influx.meta.database_name
+ENV: <b>TYK_PMP_PUMPS_INFLUX_META_DATABASENAME</b><br />
+Type: `string`<br />
+
+InfluxDB pump database name.
+
+### pumps.influx.meta.address
+ENV: <b>TYK_PMP_PUMPS_INFLUX_META_ADDR</b><br />
+Type: `string`<br />
+
+InfluxDB pump host.
+
+### pumps.influx.meta.username
+ENV: <b>TYK_PMP_PUMPS_INFLUX_META_USERNAME</b><br />
+Type: `string`<br />
+
+InfluxDB pump database username.
+
+### pumps.influx.meta.password
+ENV: <b>TYK_PMP_PUMPS_INFLUX_META_PASSWORD</b><br />
+Type: `string`<br />
+
+InfluxDB pump database password.
+
+### pumps.influx.meta.fields
+ENV: <b>TYK_PMP_PUMPS_INFLUX_META_FIELDS</b><br />
+Type: `[]string`<br />
+
+Define which Analytics fields should be sent to InfluxDB. Check the available
+fields in the example below. Default value is `["method",
+"path", "response_code", "api_key", "time_stamp", "api_version", "api_name", "api_id",
+"org_id", "oauth_id", "raw_request", "request_time", "raw_response", "ip_address"]`.
+
+### pumps.influx.meta.tags
+ENV: <b>TYK_PMP_PUMPS_INFLUX_META_TAGS</b><br />
+Type: `[]string`<br />
+
+List of tags to be added to the metric.
+
+### pumps.kafka.name
+ENV: <b>TYK_PMP_PUMPS_KAFKA_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.kafka.type
+ENV: <b>TYK_PMP_PUMPS_KAFKA_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.kafka.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.kafka.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_KAFKA_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.kafka.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_KAFKA_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.kafka.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_KAFKA_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.kafka.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_KAFKA_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.kafka.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_KAFKA_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.kafka.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_KAFKA_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.kafka.timeout
+ENV: <b>TYK_PMP_PUMPS_KAFKA_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.kafka.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_KAFKA_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.kafka.max_record_size
+ENV: <b>TYK_PMP_PUMPS_KAFKA_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.kafka.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_KAFKA_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.kafka.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_KAFKA_META`
+
+### pumps.kafka.meta.broker
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_BROKER</b><br />
+Type: `[]string`<br />
+
+The list of brokers used to discover the partitions available on the kafka cluster. E.g.
+"localhost:9092".
+
+### pumps.kafka.meta.client_id
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_CLIENTID</b><br />
+Type: `string`<br />
+
+Unique identifier for client connections established with Kafka.
+
+### pumps.kafka.meta.topic
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_TOPIC</b><br />
+Type: `string`<br />
+
+The topic that the writer will produce messages to.
+
+### pumps.kafka.meta.timeout
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_TIMEOUT</b><br />
+Type: `interface{}`<br />
+
+Timeout is the maximum amount of seconds to wait for a connect or write to complete.
+
+### pumps.kafka.meta.compressed
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_COMPRESSED</b><br />
+Type: `bool`<br />
+
+Enable "github.com/golang/snappy" codec to be used to compress Kafka messages. By default
+is `false`.
+
+### pumps.kafka.meta.meta_data
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_METADATA</b><br />
+Type: `map[string]string`<br />
+
+Can be used to set custom metadata inside the kafka message.
+
+### pumps.kafka.meta.use_ssl
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_USESSL</b><br />
+Type: `bool`<br />
+
+Enables SSL connection.
+
+### pumps.kafka.meta.ssl_insecure_skip_verify
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Controls whether the pump client verifies the kafka server's certificate chain and host
+name.
+
+### pumps.kafka.meta.ssl_cert_file
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_SSLCERTFILE</b><br />
+Type: `string`<br />
+
+Can be used to set custom certificate file for authentication with kafka.
+
+### pumps.kafka.meta.ssl_key_file
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_SSLKEYFILE</b><br />
+Type: `string`<br />
+
+Can be used to set custom key file for authentication with kafka.
+
+### pumps.kafka.meta.ssl_ca_file
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_SSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file with trusted CA certificates that will be used to verify the Kafka server's certificate.
+
+### pumps.kafka.meta.sasl_mechanism
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_SASLMECHANISM</b><br />
+Type: `string`<br />
+
+SASL mechanism configuration. Only "plain" and "scram" are supported.
+
+### pumps.kafka.meta.sasl_username
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_USERNAME</b><br />
+Type: `string`<br />
+
+SASL username.
+
+### pumps.kafka.meta.sasl_password
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_PASSWORD</b><br />
+Type: `string`<br />
+
+SASL password.
+
+### pumps.kafka.meta.sasl_algorithm
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_ALGORITHM</b><br />
+Type: `string`<br />
+
+SASL algorithm. It's the algorithm specified for scram mechanism. It could be sha-512 or sha-256.
+Defaults to "sha-256".
+
+### pumps.kafka.meta.batch_bytes
+ENV: <b>TYK_PMP_PUMPS_KAFKA_META_BATCHBYTES</b><br />
+Type: `int`<br />
+
+BatchBytes controls the maximum size of a request in bytes before it's sent to a partition.
+If the value is 0, the writer will use the default value from kafka-go library (1MB).
+
+### pumps.kinesis.name
+ENV: <b>TYK_PMP_PUMPS_KINESIS_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.kinesis.type
+ENV: <b>TYK_PMP_PUMPS_KINESIS_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.kinesis.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.kinesis.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_KINESIS_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.kinesis.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_KINESIS_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.kinesis.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_KINESIS_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.kinesis.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_KINESIS_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.kinesis.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_KINESIS_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.kinesis.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_KINESIS_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.kinesis.timeout
+ENV: <b>TYK_PMP_PUMPS_KINESIS_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.kinesis.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_KINESIS_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.kinesis.max_record_size
+ENV: <b>TYK_PMP_PUMPS_KINESIS_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.kinesis.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_KINESIS_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.kinesis.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_KINESIS_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_KINESIS_META`
+
+### pumps.kinesis.meta.StreamName
+ENV: <b>TYK_PMP_PUMPS_KINESIS_META_STREAMNAME</b><br />
+Type: `string`<br />
+
+A name to identify the stream. The stream name is scoped to the AWS account used by the application
+that creates the stream. It is also scoped by AWS Region.
+That is, two streams in two different AWS accounts can have the same name.
+Two streams in the same AWS account but in two different Regions can also have the same name.
+
+### pumps.kinesis.meta.Region
+ENV: <b>TYK_PMP_PUMPS_KINESIS_META_REGION</b><br />
+Type: `string`<br />
+
+AWS Region the Kinesis stream targets
+
+### pumps.kinesis.meta.BatchSize
+ENV: <b>TYK_PMP_PUMPS_KINESIS_META_BATCHSIZE</b><br />
+Type: `int`<br />
+
+Each PutRecords (the function used in this pump)request can support up to 500 records.
+Each record in the request can be as large as 1 MiB, up to a limit of 5 MiB for the entire request, including partition keys.
+Each shard can support writes up to 1,000 records per second, up to a maximum data write total of 1 MiB per second.
+
+### pumps.kinesis.meta.KMSKeyID
+ENV: <b>TYK_PMP_PUMPS_KINESIS_META_KMSKEYID</b><br />
+Type: `string`<br />
+
+The KMS Key ID used for server-side encryption of the Kinesis stream.
+Defaults to an empty string if not provided.
+
+### pumps.logzio.name
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.logzio.type
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.logzio.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.logzio.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.logzio.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.logzio.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.logzio.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.logzio.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.logzio.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.logzio.timeout
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.logzio.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.logzio.max_record_size
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.logzio.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.logzio.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_LOGZIO_META`
+
+### pumps.logzio.meta.check_disk_space
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_META_CHECKDISKSPACE</b><br />
+Type: `bool`<br />
+
+Set the sender to check if it crosses the maximum allowed disk usage. Default value is
+`true`.
+
+### pumps.logzio.meta.disk_threshold
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_META_DISKTHRESHOLD</b><br />
+Type: `int`<br />
+
+Set disk queue threshold, once the threshold is crossed the sender will not enqueue the
+received logs. Default value is `98` (percentage of disk).
+
+### pumps.logzio.meta.drain_duration
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_META_DRAINDURATION</b><br />
+Type: `string`<br />
+
+Set drain duration (flush logs on disk). Default value is `3s`.
+
+### pumps.logzio.meta.queue_dir
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_META_QUEUEDIR</b><br />
+Type: `string`<br />
+
+The directory for the queue.
+
+### pumps.logzio.meta.token
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_META_TOKEN</b><br />
+Type: `string`<br />
+
+Token for sending data to your logzio account.
+
+### pumps.logzio.meta.url
+ENV: <b>TYK_PMP_PUMPS_LOGZIO_META_URL</b><br />
+Type: `string`<br />
+
+If you do not want to use the default Logzio url i.e. when using a proxy. Default is
+`https://listener.logz.io:8071`.
+
+### pumps.moesif.name
+ENV: <b>TYK_PMP_PUMPS_MOESIF_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.moesif.type
+ENV: <b>TYK_PMP_PUMPS_MOESIF_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.moesif.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.moesif.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_MOESIF_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.moesif.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_MOESIF_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.moesif.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_MOESIF_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.moesif.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_MOESIF_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.moesif.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_MOESIF_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.moesif.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_MOESIF_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.moesif.timeout
+ENV: <b>TYK_PMP_PUMPS_MOESIF_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.moesif.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_MOESIF_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.moesif.max_record_size
+ENV: <b>TYK_PMP_PUMPS_MOESIF_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.moesif.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_MOESIF_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.moesif.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_MOESIF_META`
+
+### pumps.moesif.meta.application_id
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_APPLICATIONID</b><br />
+Type: `string`<br />
+
+Moesif Application Id. You can find your Moesif Application Id from
+[_Moesif Dashboard_](https://www.moesif.com/) -> _Top Right Menu_ -> _API Keys_ . Moesif
+recommends creating separate Application Ids for each environment such as Production,
+Staging, and Development to keep data isolated.
+
+### pumps.moesif.meta.request_header_masks
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_REQUESTHEADERMASKS</b><br />
+Type: `[]string`<br />
+
+An option to mask a specific request header field.
+
+### pumps.moesif.meta.response_header_masks
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_RESPONSEHEADERMASKS</b><br />
+Type: `[]string`<br />
+
+An option to mask a specific response header field.
+
+### pumps.moesif.meta.request_body_masks
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_REQUESTBODYMASKS</b><br />
+Type: `[]string`<br />
+
+An option to mask a specific - request body field.
+
+### pumps.moesif.meta.response_body_masks
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_RESPONSEBODYMASKS</b><br />
+Type: `[]string`<br />
+
+An option to mask a specific response body field.
+
+### pumps.moesif.meta.disable_capture_request_body
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_DISABLECAPTUREREQUESTBODY</b><br />
+Type: `bool`<br />
+
+An option to disable logging of request body. Default value is `false`.
+
+### pumps.moesif.meta.disable_capture_response_body
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_DISABLECAPTURERESPONSEBODY</b><br />
+Type: `bool`<br />
+
+An option to disable logging of response body. Default value is `false`.
+
+### pumps.moesif.meta.user_id_header
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_USERIDHEADER</b><br />
+Type: `string`<br />
+
+An optional field name to identify User from a request or response header.
+
+### pumps.moesif.meta.company_id_header
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_COMPANYIDHEADER</b><br />
+Type: `string`<br />
+
+An optional field name to identify Company (Account) from a request or response header.
+
+### pumps.moesif.meta.enable_bulk
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_ENABLEBULK</b><br />
+Type: `bool`<br />
+
+Set this to `true` to enable `bulk_config`.
+
+### pumps.moesif.meta.bulk_config
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_BULKCONFIG</b><br />
+Type: `map[string]interface{}`<br />
+
+Batch writing trigger configuration.
+  * `"event_queue_size"` - (optional) An optional field name which specify the maximum
+number of events to hold in queue before sending to Moesif. In case of network issues when
+not able to connect/send event to Moesif, skips adding new events to the queue to prevent
+memory overflow. Type: int. Default value is `10000`.
+  * `"batch_size"` - (optional) An optional field name which specify the maximum batch size
+when sending to Moesif. Type: int. Default value is `200`.
+  * `"timer_wake_up_seconds"` - (optional) An optional field which specifies a time (every n
+seconds) how often background thread runs to send events to moesif. Type: int. Default value
+is `2` seconds.
+
+### pumps.moesif.meta.authorization_header_name
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_AUTHORIZATIONHEADERNAME</b><br />
+Type: `string`<br />
+
+An optional request header field name to used to identify the User in Moesif. Default value
+is `authorization`.
+
+### pumps.moesif.meta.authorization_user_id_field
+ENV: <b>TYK_PMP_PUMPS_MOESIF_META_AUTHORIZATIONUSERIDFIELD</b><br />
+Type: `string`<br />
+
+An optional field name use to parse the User from authorization header in Moesif. Default
+value is `sub`.
+
+### pumps.mongo.name
+ENV: <b>TYK_PMP_PUMPS_MONGO_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.mongo.type
+ENV: <b>TYK_PMP_PUMPS_MONGO_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.mongo.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.mongo.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_MONGO_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.mongo.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_MONGO_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.mongo.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_MONGO_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.mongo.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_MONGO_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.mongo.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_MONGO_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.mongo.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_MONGO_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.mongo.timeout
+ENV: <b>TYK_PMP_PUMPS_MONGO_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.mongo.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_MONGO_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.mongo.max_record_size
+ENV: <b>TYK_PMP_PUMPS_MONGO_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.mongo.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_MONGO_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.mongo.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+Prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_MONGO_META` for Mongo Pump
+`TYK_PMP_PUMPS_UPTIME_META` for Uptime Pump
+`TYK_PMP_PUMPS_MONGOAGGREGATE_META` for Mongo Aggregate Pump
+`TYK_PMP_PUMPS_MONGOSELECTIVE_META` for Mongo Selective Pump
+`TYK_PMP_PUMPS_MONGOGRAPH_META` for Mongo Graph Pump.
+
+### pumps.mongo.meta.mongo_url
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MONGOURL</b><br />
+Type: `string`<br />
+
+The full URL to your MongoDB instance, this can be a clustered instance if necessary and
+should include the database and username / password data.
+
+### pumps.mongo.meta.mongo_use_ssl
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MONGOUSESSL</b><br />
+Type: `bool`<br />
+
+Set to true to enable Mongo SSL connection.
+
+### pumps.mongo.meta.mongo_ssl_insecure_skip_verify
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MONGOSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Allows the use of self-signed certificates when connecting to an encrypted MongoDB database.
+
+### pumps.mongo.meta.mongo_ssl_allow_invalid_hostnames
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MONGOSSLALLOWINVALIDHOSTNAMES</b><br />
+Type: `bool`<br />
+
+Ignore hostname check when it differs from the original (for example with SSH tunneling).
+The rest of the TLS verification will still be performed.
+
+### pumps.mongo.meta.mongo_ssl_ca_file
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MONGOSSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file with trusted root certificates
+
+### pumps.mongo.meta.mongo_ssl_pem_keyfile
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MONGOSSLPEMKEYFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file which contains both client certificate and private key. This is
+required for Mutual TLS.
+
+### pumps.mongo.meta.mongo_db_type
+Specify the target MongoDB compatible database:
+- set to `0` for MongoDB (default)
+- set to `1` for AWS Document DB
+- set to `2` for CosmosDB
+
+### pumps.mongo.meta.omit_index_creation
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_OMITINDEXCREATION</b><br />
+Type: `bool`<br />
+
+Set to true to disable the default tyk index creation.
+
+### pumps.mongo.meta.mongo_session_consistency
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MONGOSESSIONCONSISTENCY</b><br />
+Type: `string`<br />
+
+Set the consistency mode for the session, it defaults to `Strong`. The valid values are: strong, monotonic, eventual.
+
+### pumps.mongo.meta.driver
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MONGODRIVERTYPE</b><br />
+Type: `string`<br />
+
+MongoDriverType is the type of the driver (library) to use. The valid values are: “mongo-go” and “mgo”.
+Since v1.9, the default driver is "mongo-go". Check out this guide to [learn about MongoDB drivers supported by Tyk Pump](https://github.com/TykTechnologies/tyk-pump#driver-type).
+
+### pumps.mongo.meta.mongo_direct_connection
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MONGODIRECTCONNECTION</b><br />
+Type: `bool`<br />
+
+MongoDirectConnection informs whether to establish connections only with the specified seed servers,
+or to obtain information for the whole cluster and establish connections with further servers too.
+If true, the client will only connect to the host provided in the ConnectionString
+and won't attempt to discover other hosts in the cluster. Useful when network restrictions
+prevent discovery, such as with SSH tunneling. Default is false.
+
+### pumps.mongo.meta.collection_name
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_COLLECTIONNAME</b><br />
+Type: `string`<br />
+
+Specifies the mongo collection name.
+
+### pumps.mongo.meta.max_insert_batch_size_bytes
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MAXINSERTBATCHSIZEBYTES</b><br />
+Type: `int`<br />
+
+Maximum insert batch size for mongo selective pump. If the batch we are writing surpasses this value, it will be sent in multiple batches.
+Defaults to 10Mb.
+
+### pumps.mongo.meta.max_document_size_bytes
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_MAXDOCUMENTSIZEBYTES</b><br />
+Type: `int`<br />
+
+Maximum document size. If the document exceed this value, it will be skipped.
+Defaults to 10Mb.
+
+### pumps.mongo.meta.collection_cap_max_size_bytes
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_COLLECTIONCAPMAXSIZEBYTES</b><br />
+Type: `int`<br />
+
+Amount of bytes of the capped collection in 64bits architectures.
+Defaults to 5GB.
+
+### pumps.mongo.meta.collection_cap_enable
+ENV: <b>TYK_PMP_PUMPS_MONGO_META_COLLECTIONCAPENABLE</b><br />
+Type: `bool`<br />
+
+Enable collection capping. It's used to set a maximum size of the collection.
+
+### pumps.mongoaggregate.name
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.mongoaggregate.type
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.mongoaggregate.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.mongoaggregate.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.mongoaggregate.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.mongoaggregate.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.mongoaggregate.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.mongoaggregate.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.mongoaggregate.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.mongoaggregate.timeout
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.mongoaggregate.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.mongoaggregate.max_record_size
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.mongoaggregate.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.mongoaggregate.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+Prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_MONGO_META` for Mongo Pump
+`TYK_PMP_PUMPS_UPTIME_META` for Uptime Pump
+`TYK_PMP_PUMPS_MONGOAGGREGATE_META` for Mongo Aggregate Pump
+`TYK_PMP_PUMPS_MONGOSELECTIVE_META` for Mongo Selective Pump
+`TYK_PMP_PUMPS_MONGOGRAPH_META` for Mongo Graph Pump.
+
+### pumps.mongoaggregate.meta.mongo_url
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGOURL</b><br />
+Type: `string`<br />
+
+The full URL to your MongoDB instance, this can be a clustered instance if necessary and
+should include the database and username / password data.
+
+### pumps.mongoaggregate.meta.mongo_use_ssl
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGOUSESSL</b><br />
+Type: `bool`<br />
+
+Set to true to enable Mongo SSL connection.
+
+### pumps.mongoaggregate.meta.mongo_ssl_insecure_skip_verify
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGOSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Allows the use of self-signed certificates when connecting to an encrypted MongoDB database.
+
+### pumps.mongoaggregate.meta.mongo_ssl_allow_invalid_hostnames
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGOSSLALLOWINVALIDHOSTNAMES</b><br />
+Type: `bool`<br />
+
+Ignore hostname check when it differs from the original (for example with SSH tunneling).
+The rest of the TLS verification will still be performed.
+
+### pumps.mongoaggregate.meta.mongo_ssl_ca_file
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGOSSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file with trusted root certificates
+
+### pumps.mongoaggregate.meta.mongo_ssl_pem_keyfile
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGOSSLPEMKEYFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file which contains both client certificate and private key. This is
+required for Mutual TLS.
+
+### pumps.mongoaggregate.meta.mongo_db_type
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGODBTYPE</b><br />
+Type: `int`<br />
+
+Specify the target MongoDB compatible database:
+- set to `0` for MongoDB (default)
+- set to `1` for AWS Document DB
+- set to `2` for CosmosDB
+
+### pumps.mongoaggregate.meta.omit_index_creation
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_OMITINDEXCREATION</b><br />
+Type: `bool`<br />
+
+Set to true to disable the default tyk index creation.
+
+### pumps.mongoaggregate.meta.mongo_session_consistency
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGOSESSIONCONSISTENCY</b><br />
+Type: `string`<br />
+
+Set the consistency mode for the session, it defaults to `Strong`. The valid values are: strong, monotonic, eventual.
+
+### pumps.mongoaggregate.meta.driver
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGODRIVERTYPE</b><br />
+Type: `string`<br />
+
+MongoDriverType is the type of the driver (library) to use. The valid values are: “mongo-go” and “mgo”.
+Since v1.9, the default driver is "mongo-go". Check out this guide to [learn about MongoDB drivers supported by Tyk Pump](https://github.com/TykTechnologies/tyk-pump#driver-type).
+
+### pumps.mongoaggregate.meta.mongo_direct_connection
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_MONGODIRECTCONNECTION</b><br />
+Type: `bool`<br />
+
+MongoDirectConnection informs whether to establish connections only with the specified seed servers,
+or to obtain information for the whole cluster and establish connections with further servers too.
+If true, the client will only connect to the host provided in the ConnectionString
+and won't attempt to discover other hosts in the cluster. Useful when network restrictions
+prevent discovery, such as with SSH tunneling. Default is false.
+
+### pumps.mongoaggregate.meta.use_mixed_collection
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_USEMIXEDCOLLECTION</b><br />
+Type: `bool`<br />
+
+If set to `true` the Mongo Aggregate pump will send analytics to two collections:
+- `z_tyk_analyticz_aggregate_{ORG ID}`
+- `tyk_analytics_aggregates`
+When set to 'false' your pump will only store analytics to `z_tyk_analyticz_aggregate_{ORG ID}`.
+
+### pumps.mongoaggregate.meta.track_all_paths
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_TRACKALLPATHS</b><br />
+Type: `bool`<br />
+
+Specifies if it should store aggregated data for all the endpoints. By default, `false`
+which means that only store aggregated data for `tracked endpoints`.
+
+### pumps.mongoaggregate.meta.ignore_tag_prefix_list
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_IGNORETAGPREFIXLIST</b><br />
+Type: `[]string`<br />
+
+Specifies prefixes of tags that should be ignored.
+
+### pumps.mongoaggregate.meta.threshold_len_tag_list
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_THRESHOLDLENTAGLIST</b><br />
+Type: `int`<br />
+
+Determines the threshold of amount of tags of an aggregation. If the amount of tags is superior to the threshold,
+it will print an alert.
+Defaults to 1000.
+
+### pumps.mongoaggregate.meta.store_analytics_per_minute
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_STOREANALYTICSPERMINUTE</b><br />
+Type: `bool`<br />
+
+Determines if the aggregations should be made per minute (true) or per hour (false).
+
+### pumps.mongoaggregate.meta.aggregation_time
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_AGGREGATIONTIME</b><br />
+Type: `int`<br />
+
+Determines the amount of time the aggregations should be made (in minutes). It defaults to the max value is 60 and the minimum is 1.
+If StoreAnalyticsPerMinute is set to true, this field will be skipped.
+
+### pumps.mongoaggregate.meta.enable_aggregate_self_healing
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_ENABLEAGGREGATESELFHEALING</b><br />
+Type: `bool`<br />
+
+Determines if the self healing will be activated or not.
+Self Healing allows pump to handle Mongo document's max-size errors by creating a new document when the max-size is reached.
+It also divide by 2 the AggregationTime field to avoid the same error in the future.
+
+### pumps.mongoaggregate.meta.ignore_aggregations
+ENV: <b>TYK_PMP_PUMPS_MONGOAGGREGATE_META_IGNOREAGGREGATIONSLIST</b><br />
+Type: `[]string`<br />
+
+This list determines which aggregations are going to be dropped and not stored in the collection.
+Posible values are: "APIID","errors","versions","apikeys","oauthids","geo","tags","endpoints","keyendpoints",
+"oauthendpoints", and "apiendpoints".
+
+### pumps.mongoselective.name
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.mongoselective.type
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.mongoselective.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.mongoselective.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.mongoselective.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.mongoselective.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.mongoselective.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.mongoselective.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.mongoselective.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.mongoselective.timeout
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.mongoselective.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.mongoselective.max_record_size
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.mongoselective.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.mongoselective.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+Prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_MONGO_META` for Mongo Pump
+`TYK_PMP_PUMPS_UPTIME_META` for Uptime Pump
+`TYK_PMP_PUMPS_MONGOAGGREGATE_META` for Mongo Aggregate Pump
+`TYK_PMP_PUMPS_MONGOSELECTIVE_META` for Mongo Selective Pump
+`TYK_PMP_PUMPS_MONGOGRAPH_META` for Mongo Graph Pump.
+
+### pumps.mongoselective.meta.mongo_url
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGOURL</b><br />
+Type: `string`<br />
+
+The full URL to your MongoDB instance, this can be a clustered instance if necessary and
+should include the database and username / password data.
+
+### pumps.mongoselective.meta.mongo_use_ssl
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGOUSESSL</b><br />
+Type: `bool`<br />
+
+Set to true to enable Mongo SSL connection.
+
+### pumps.mongoselective.meta.mongo_ssl_insecure_skip_verify
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGOSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Allows the use of self-signed certificates when connecting to an encrypted MongoDB database.
+
+### pumps.mongoselective.meta.mongo_ssl_allow_invalid_hostnames
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGOSSLALLOWINVALIDHOSTNAMES</b><br />
+Type: `bool`<br />
+
+Ignore hostname check when it differs from the original (for example with SSH tunneling).
+The rest of the TLS verification will still be performed.
+
+### pumps.mongoselective.meta.mongo_ssl_ca_file
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGOSSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file with trusted root certificates
+
+### pumps.mongoselective.meta.mongo_ssl_pem_keyfile
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGOSSLPEMKEYFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file which contains both client certificate and private key. This is
+required for Mutual TLS.
+
+### pumps.mongoselective.meta.mongo_db_type
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGODBTYPE</b><br />
+Type: `int`<br />
+
+Specify the target MongoDB compatible database:
+- set to `0` for MongoDB (default)
+- set to `1` for AWS Document DB
+- set to `2` for CosmosDB
+
+### pumps.mongoselective.meta.omit_index_creation
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_OMITINDEXCREATION</b><br />
+Type: `bool`<br />
+
+Set to true to disable the default tyk index creation.
+
+### pumps.mongoselective.meta.mongo_session_consistency
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGOSESSIONCONSISTENCY</b><br />
+Type: `string`<br />
+
+Set the consistency mode for the session, it defaults to `Strong`. The valid values are: strong, monotonic, eventual.
+
+### pumps.mongoselective.meta.driver
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGODRIVERTYPE</b><br />
+Type: `string`<br />
+
+MongoDriverType is the type of the driver (library) to use. The valid values are: “mongo-go” and “mgo”.
+Since v1.9, the default driver is "mongo-go". Check out this guide to [learn about MongoDB drivers supported by Tyk Pump](https://github.com/TykTechnologies/tyk-pump#driver-type).
+
+### pumps.mongoselective.meta.mongo_direct_connection
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MONGODIRECTCONNECTION</b><br />
+Type: `bool`<br />
+
+MongoDirectConnection informs whether to establish connections only with the specified seed servers,
+or to obtain information for the whole cluster and establish connections with further servers too.
+If true, the client will only connect to the host provided in the ConnectionString
+and won't attempt to discover other hosts in the cluster. Useful when network restrictions
+prevent discovery, such as with SSH tunneling. Default is false.
+
+### pumps.mongoselective.meta.max_insert_batch_size_bytes
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MAXINSERTBATCHSIZEBYTES</b><br />
+Type: `int`<br />
+
+Maximum insert batch size for mongo selective pump. If the batch we are writing surpass this value, it will be send in multiple batchs.
+Defaults to 10Mb.
+
+### pumps.mongoselective.meta.max_document_size_bytes
+ENV: <b>TYK_PMP_PUMPS_MONGOSELECTIVE_META_MAXDOCUMENTSIZEBYTES</b><br />
+Type: `int`<br />
+
+Maximum document size. If the document exceed this value, it will be skipped.
+Defaults to 10Mb.
+
+### pumps.prometheus.name
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.prometheus.type
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.prometheus.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.prometheus.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.prometheus.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.prometheus.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.prometheus.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.prometheus.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.prometheus.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.prometheus.timeout
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.prometheus.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.prometheus.max_record_size
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.prometheus.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.prometheus.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+Prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_PROMETHEUS_META`
+
+### pumps.prometheus.meta.listen_address
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_META_ADDR</b><br />
+Type: `string`<br />
+
+The address and port on which Tyk Pump exposes the Prometheus metrics endpoint for Prometheus to scrape, in the form {HOST}:{PORT}. For example `localhost:9090`.
+
+### pumps.prometheus.meta.path
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_META_PATH</b><br />
+Type: `string`<br />
+
+The path to the Prometheus collection. For example `/metrics`.
+
+### pumps.prometheus.meta.aggregate_observations
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_META_AGGREGATEOBSERVATIONS</b><br />
+Type: `bool`<br />
+
+This will enable an experimental feature that will aggregate the histogram metrics request time values before exposing them to prometheus.
+Enabling this will reduce the CPU usage of your prometheus pump but you will loose histogram precision. Experimental.
+
+### pumps.prometheus.meta.disabled_metrics
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_META_DISABLEDMETRICS</b><br />
+Type: `[]string`<br />
+
+Metrics to exclude from exposition. Currently, excludes only the base metrics.
+
+### pumps.prometheus.meta.track_all_paths
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_META_TRACKALLPATHS</b><br />
+Type: `bool`<br />
+
+Specifies if it should expose aggregated metrics for all the endpoints. By default, `false`
+which means that all APIs endpoints will be counted as 'unknown' unless the API uses the track endpoint plugin.
+
+### pumps.prometheus.meta.custom_metrics
+ENV: <b>TYK_PMP_PUMPS_PROMETHEUS_META_CUSTOMMETRICS</b><br />
+Type: `CustomMetrics`<br />
+
+Custom Prometheus metrics.
+
+### pumps.splunk.name
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.splunk.type
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.splunk.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.splunk.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.splunk.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.splunk.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.splunk.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.splunk.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.splunk.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.splunk.timeout
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.splunk.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.splunk.max_record_size
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.splunk.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.splunk.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_SPLUNK_META`
+
+### pumps.splunk.meta.collector_token
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_COLLECTORTOKEN</b><br />
+Type: `string`<br />
+
+Address of the datadog agent including host & port.
+
+### pumps.splunk.meta.collector_url
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_COLLECTORURL</b><br />
+Type: `string`<br />
+
+Endpoint the Pump will send analytics too.  Should look something like:
+`https://splunk:8088/services/collector/event`.
+
+### pumps.splunk.meta.ssl_insecure_skip_verify
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Controls whether the pump client verifies the Splunk server's certificate chain and host name.
+
+### pumps.splunk.meta.ssl_cert_file
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_SSLCERTFILE</b><br />
+Type: `string`<br />
+
+SSL cert file location.
+
+### pumps.splunk.meta.ssl_key_file
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_SSLKEYFILE</b><br />
+Type: `string`<br />
+
+SSL cert key location.
+
+### pumps.splunk.meta.ssl_ca_file
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_SSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the PEM file with trusted CA certificates that will be used to verify the Splunk server's certificate.
+
+### pumps.splunk.meta.ssl_server_name
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_SSLSERVERNAME</b><br />
+Type: `string`<br />
+
+SSL Server name used in the TLS connection.
+
+### pumps.splunk.meta.obfuscate_api_keys
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_OBFUSCATEAPIKEYS</b><br />
+Type: `bool`<br />
+
+Controls whether the pump client should hide the API key. In case you still need substring
+of the value, check the next option. Default value is `false`.
+
+### pumps.splunk.meta.obfuscate_api_keys_length
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_OBFUSCATEAPIKEYSLENGTH</b><br />
+Type: `int`<br />
+
+Define the number of the characters from the end of the API key. The `obfuscate_api_keys`
+should be set to `true`. Default value is `0`.
+
+### pumps.splunk.meta.fields
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_FIELDS</b><br />
+Type: `[]string`<br />
+
+Define which Analytics fields should participate in the Splunk event. Check the available
+fields in the example below. Default value is `["method",
+"path", "response_code", "api_key", "time_stamp", "api_version", "api_name", "api_id",
+"org_id", "oauth_id", "raw_request", "request_time", "raw_response", "ip_address"]`.
+
+### pumps.splunk.meta.ignore_tag_prefix_list
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_IGNORETAGPREFIXLIST</b><br />
+Type: `[]string`<br />
+
+Choose which tags to be ignored by the Splunk Pump. Keep in mind that the tag name and value
+are hyphenated. Default value is `[]`.
+
+### pumps.splunk.meta.enable_batch
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_ENABLEBATCH</b><br />
+Type: `bool`<br />
+
+If this is set to `true`, pump is going to send the analytics records in batch to Splunk.
+Default value is `false`.
+
+### pumps.splunk.meta.batch_max_content_length
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_BATCHMAXCONTENTLENGTH</b><br />
+Type: `int`<br />
+
+Max content length in bytes to be sent in batch requests. It should match the
+`max_content_length` configured in Splunk. If the purged analytics records size don't reach
+the amount of bytes, they're send anyways in each `purge_loop`. Default value is 838860800
+(~ 800 MB), the same default value as Splunk config.
+
+### pumps.splunk.meta.max_retries
+ENV: <b>TYK_PMP_PUMPS_SPLUNK_META_MAXRETRIES</b><br />
+Type: `uint64`<br />
+
+MaxRetries represents the maximum amount of retries to attempt if failed to send requests to splunk HEC.
+Default value is `0`
+
+### pumps.sql.name
+ENV: <b>TYK_PMP_PUMPS_SQL_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.sql.type
+ENV: <b>TYK_PMP_PUMPS_SQL_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.sql.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.sql.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_SQL_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.sql.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_SQL_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.sql.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_SQL_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.sql.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_SQL_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.sql.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_SQL_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.sql.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_SQL_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.sql.timeout
+ENV: <b>TYK_PMP_PUMPS_SQL_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.sql.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_SQL_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.sql.max_record_size
+ENV: <b>TYK_PMP_PUMPS_SQL_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.sql.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_SQL_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.sql.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_SQL_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_SQL_META`
+
+### pumps.sql.meta.type
+ENV: <b>TYK_PMP_PUMPS_SQL_META_TYPE</b><br />
+Type: `string`<br />
+
+The only supported and tested types are `postgres` and `mysql`.
+From v1.12.0, we no longer support `sqlite` as a storage type.
+
+### pumps.sql.meta.connection_string
+ENV: <b>TYK_PMP_PUMPS_SQL_META_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+Specifies the connection string to the database.
+
+### pumps.sql.meta.postgres
+Postgres configurations.
+
+### pumps.sql.meta.postgres.prefer_simple_protocol
+ENV: <b>TYK_PMP_PUMPS_SQL_META_POSTGRES_PREFERSIMPLEPROTOCOL</b><br />
+Type: `bool`<br />
+
+Disables implicit prepared statement usage.
+
+### pumps.sql.meta.mysql
+Mysql configurations.
+
+### pumps.sql.meta.mysql.default_string_size
+ENV: <b>TYK_PMP_PUMPS_SQL_META_MYSQL_DEFAULTSTRINGSIZE</b><br />
+Type: `uint`<br />
+
+Default size for string fields. Defaults to `256`.
+
+### pumps.sql.meta.mysql.disable_datetime_precision
+ENV: <b>TYK_PMP_PUMPS_SQL_META_MYSQL_DISABLEDATETIMEPRECISION</b><br />
+Type: `bool`<br />
+
+Disable datetime precision, which not supported before MySQL 5.6.
+
+### pumps.sql.meta.mysql.dont_support_rename_index
+ENV: <b>TYK_PMP_PUMPS_SQL_META_MYSQL_DONTSUPPORTRENAMEINDEX</b><br />
+Type: `bool`<br />
+
+Drop & create when rename index, rename index not supported before MySQL 5.7, MariaDB.
+
+### pumps.sql.meta.mysql.dont_support_rename_column
+ENV: <b>TYK_PMP_PUMPS_SQL_META_MYSQL_DONTSUPPORTRENAMECOLUMN</b><br />
+Type: `bool`<br />
+
+`change` when rename column, rename column not supported before MySQL 8, MariaDB.
+
+### pumps.sql.meta.mysql.skip_initialize_with_version
+ENV: <b>TYK_PMP_PUMPS_SQL_META_MYSQL_SKIPINITIALIZEWITHVERSION</b><br />
+Type: `bool`<br />
+
+Auto configure based on currently MySQL version.
+
+### pumps.sql.meta.table_sharding
+ENV: <b>TYK_PMP_PUMPS_SQL_META_TABLESHARDING</b><br />
+Type: `bool`<br />
+
+Specifies if all the analytics records are going to be stored in one table or in multiple
+tables (one per day). By default, `false`. If `false`, all the records are going to be
+stored in `tyk_aggregated` table. Instead, if it's `true`, all the records of the day are
+going to be stored in `tyk_aggregated_YYYYMMDD` table, where `YYYYMMDD` is going to change
+depending on the date.
+
+### pumps.sql.meta.log_level
+ENV: <b>TYK_PMP_PUMPS_SQL_META_LOGLEVEL</b><br />
+Type: `string`<br />
+
+Specifies the SQL log verbosity. The possible values are: `info`,`error` and `warning`. By
+default, the value is `silent`, which means that it won't log any SQL query.
+
+### pumps.sql.meta.batch_size
+ENV: <b>TYK_PMP_PUMPS_SQL_META_BATCHSIZE</b><br />
+Type: `int`<br />
+
+Specifies the amount of records that are going to be written each batch. Type int. By
+default, it writes 1000 records max per batch.
+
+### pumps.sql.meta.migrate_sharded_tables
+ENV: <b>TYK_PMP_PUMPS_SQL_META_MIGRATESHARDEDTABLES</b><br />
+Type: `bool`<br />
+
+Specifies whether to migrate all existing sharded tables to latest schema during Pump initialization (default: false).
+When true, on initialization Pump will scan and migrate all sharded tables to the latest schema.
+When false, existing tables will not be migrated and may miss columns included in the latest schema.
+If there are a large number of existing tables, or those tables are in use by other services, there may be a performance impact from the migration. We recommend testing carefully.
+
+### pumps.sqlaggregate.name
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.sqlaggregate.type
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.sqlaggregate.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.sqlaggregate.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.sqlaggregate.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.sqlaggregate.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.sqlaggregate.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.sqlaggregate.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.sqlaggregate.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.sqlaggregate.timeout
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.sqlaggregate.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.sqlaggregate.max_record_size
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.sqlaggregate.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.sqlaggregate.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_SQLAGGREGATE_META`
+
+### pumps.sqlaggregate.meta.type
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_TYPE</b><br />
+Type: `string`<br />
+
+The only supported and tested types are `postgres` and `mysql`.
+From v1.12.0, we no longer support `sqlite` as a storage type.
+
+### pumps.sqlaggregate.meta.connection_string
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_CONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+Specifies the connection string to the database.
+
+### pumps.sqlaggregate.meta.postgres
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_POSTGRES</b><br />
+Type: `PostgresConfig`<br />
+
+Postgres configurations.
+
+### pumps.sqlaggregate.meta.postgres.prefer_simple_protocol
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_POSTGRES_PREFERSIMPLEPROTOCOL</b><br />
+Type: `bool`<br />
+
+Disables implicit prepared statement usage.
+
+### pumps.sqlaggregate.meta.mysql
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_MYSQL</b><br />
+Type: `MysqlConfig`<br />
+
+Mysql configurations.
+
+### pumps.sqlaggregate.meta.mysql.default_string_size
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_MYSQL_DEFAULTSTRINGSIZE</b><br />
+Type: `uint`<br />
+
+Default size for string fields. Defaults to `256`.
+
+### pumps.sqlaggregate.meta.mysql.disable_datetime_precision
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_MYSQL_DISABLEDATETIMEPRECISION</b><br />
+Type: `bool`<br />
+
+Disable datetime precision, which not supported before MySQL 5.6.
+
+### pumps.sqlaggregate.meta.mysql.dont_support_rename_index
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_MYSQL_DONTSUPPORTRENAMEINDEX</b><br />
+Type: `bool`<br />
+
+Drop & create when rename index, rename index not supported before MySQL 5.7, MariaDB.
+
+### pumps.sqlaggregate.meta.mysql.dont_support_rename_column
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_MYSQL_DONTSUPPORTRENAMECOLUMN</b><br />
+Type: `bool`<br />
+
+`change` when rename column, rename column not supported before MySQL 8, MariaDB.
+
+### pumps.sqlaggregate.meta.mysql.skip_initialize_with_version
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_MYSQL_SKIPINITIALIZEWITHVERSION</b><br />
+Type: `bool`<br />
+
+Auto configure based on currently MySQL version.
+
+### pumps.sqlaggregate.meta.table_sharding
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_TABLESHARDING</b><br />
+Type: `bool`<br />
+
+Specifies if all the analytics records are going to be stored in one table or in multiple
+tables (one per day). By default, `false`. If `false`, all the records are going to be
+stored in `tyk_aggregated` table. Instead, if it's `true`, all the records of the day are
+going to be stored in `tyk_aggregated_YYYYMMDD` table, where `YYYYMMDD` is going to change
+depending on the date.
+
+### pumps.sqlaggregate.meta.log_level
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_LOGLEVEL</b><br />
+Type: `string`<br />
+
+Specifies the SQL log verbosity. The possible values are: `info`,`error` and `warning`. By
+default, the value is `silent`, which means that it won't log any SQL query.
+
+### pumps.sqlaggregate.meta.batch_size
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_BATCHSIZE</b><br />
+Type: `int`<br />
+
+Specifies the amount of records that are going to be written each batch. Type int. By
+default, it writes 1000 records max per batch.
+
+### pumps.sqlaggregate.meta.migrate_sharded_tables
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_MIGRATESHARDEDTABLES</b><br />
+Type: `bool`<br />
+
+Specifies whether to migrate all existing sharded tables to latest schema during Pump initialization (default: false).
+When true, on initialization Pump will scan and migrate all sharded tables to the latest schema.
+When false, existing tables will not be migrated and may miss columns included in the latest schema.
+If there are a large number of existing tables, or those tables are in use by other services, there may be a performance impact from the migration. We recommend testing carefully.
+
+### pumps.sqlaggregate.meta.track_all_paths
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_TRACKALLPATHS</b><br />
+Type: `bool`<br />
+
+Specifies if it should store aggregated data for all the endpoints. By default, `false`
+which means that only store aggregated data for `tracked endpoints`.
+
+### pumps.sqlaggregate.meta.ignore_tag_prefix_list
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_IGNORETAGPREFIXLIST</b><br />
+Type: `[]string`<br />
+
+Specifies prefixes of tags that should be ignored.
+
+### pumps.sqlaggregate.meta.store_analytics_per_minute
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_STOREANALYTICSPERMINUTE</b><br />
+Type: `bool`<br />
+
+Determines if the aggregations should be made per minute instead of per hour.
+
+### pumps.sqlaggregate.meta.omit_index_creation
+ENV: <b>TYK_PMP_PUMPS_SQLAGGREGATE_META_OMITINDEXCREATION</b><br />
+Type: `bool`<br />
+
+Set to true to disable the default tyk index creation.
+
+### pumps.statsd.name
+ENV: <b>TYK_PMP_PUMPS_STATSD_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.statsd.type
+ENV: <b>TYK_PMP_PUMPS_STATSD_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.statsd.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.statsd.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_STATSD_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.statsd.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_STATSD_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.statsd.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_STATSD_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.statsd.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_STATSD_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.statsd.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_STATSD_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.statsd.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_STATSD_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.statsd.timeout
+ENV: <b>TYK_PMP_PUMPS_STATSD_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.statsd.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_STATSD_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.statsd.max_record_size
+ENV: <b>TYK_PMP_PUMPS_STATSD_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.statsd.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_STATSD_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.statsd.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_STATSD_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_STATSD_META`
+
+### pumps.statsd.meta.address
+ENV: <b>TYK_PMP_PUMPS_STATSD_META_ADDRESS</b><br />
+Type: `string`<br />
+
+Address of statsd including host & port.
+
+### pumps.statsd.meta.fields
+ENV: <b>TYK_PMP_PUMPS_STATSD_META_FIELDS</b><br />
+Type: `[]string`<br />
+
+Define which Analytics fields should have its own metric calculation.
+
+### pumps.statsd.meta.tags
+ENV: <b>TYK_PMP_PUMPS_STATSD_META_TAGS</b><br />
+Type: `[]string`<br />
+
+List of tags to be added to the metric.
+
+### pumps.statsd.meta.separated_method
+ENV: <b>TYK_PMP_PUMPS_STATSD_META_SEPARATEDMETHOD</b><br />
+Type: `bool`<br />
+
+Allows to have a separated method field instead of having it embedded in the path field.
+
+### pumps.stdout.name
+ENV: <b>TYK_PMP_PUMPS_STDOUT_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.stdout.type
+ENV: <b>TYK_PMP_PUMPS_STDOUT_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.stdout.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.stdout.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_STDOUT_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.stdout.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_STDOUT_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.stdout.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_STDOUT_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.stdout.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_STDOUT_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.stdout.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_STDOUT_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.stdout.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_STDOUT_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.stdout.timeout
+ENV: <b>TYK_PMP_PUMPS_STDOUT_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.stdout.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_STDOUT_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.stdout.max_record_size
+ENV: <b>TYK_PMP_PUMPS_STDOUT_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.stdout.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_STDOUT_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.stdout.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_STDOUT_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_STDOUT_META`
+
+### pumps.stdout.meta.format
+ENV: <b>TYK_PMP_PUMPS_STDOUT_META_FORMAT</b><br />
+Type: `string`<br />
+
+Format of the analytics logs. Default is `text` if `json` is not explicitly specified. When
+JSON logging is used all pump logs to stdout will be JSON.
+
+### pumps.stdout.meta.log_field_name
+ENV: <b>TYK_PMP_PUMPS_STDOUT_META_LOGFIELDNAME</b><br />
+Type: `string`<br />
+
+Root name of the JSON object the analytics record is nested in.
+
+### pumps.stdout.meta.use_legacy_payload_format
+ENV: <b>TYK_PMP_PUMPS_STDOUT_META_USELEGACYPAYLOADFORMAT</b><br />
+Type: `bool`<br />
+
+Use the legacy formatting of raw_request and raw_response as escaped strings rather than JSON formatting.
+
+### pumps.syslog.name
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.syslog.type
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.syslog.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.syslog.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.syslog.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.syslog.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.syslog.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.syslog.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.syslog.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.syslog.timeout
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.syslog.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.syslog.max_record_size
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.syslog.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.syslog.meta.meta_env_prefix
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_SYSLOG_META`
+
+### pumps.syslog.meta.transport
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_META_TRANSPORT</b><br />
+Type: `string`<br />
+
+Possible values are `udp, tcp, tls` in string form.
+
+### pumps.syslog.meta.network_addr
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_META_NETWORKADDR</b><br />
+Type: `string`<br />
+
+Host & Port combination of your syslog daemon ie: `"localhost:5140"`.
+
+### pumps.syslog.meta.log_level
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_META_LOGLEVEL</b><br />
+Type: `int`<br />
+
+The severity level, an integer from 0-7, based off the Standard:
+[Syslog Severity Levels](https://en.wikipedia.org/wiki/Syslog#Severity_level).
+
+### pumps.syslog.meta.tag
+ENV: <b>TYK_PMP_PUMPS_SYSLOG_META_TAG</b><br />
+Type: `string`<br />
+
+Prefix tag
+
+When working with FluentD, you should provide a
+[FluentD Parser](https://docs.fluentd.org/input/syslog) based on the OS you are using so
+that FluentD can correctly read the logs.
+
+```{.json}
+"syslog": {
+  "name": "syslog",
+  "meta": {
+    "transport": "udp",
+    "network_addr": "localhost:5140",
+    "log_level": 6,
+    "tag": "syslog-pump"
+  }
+```
+
+### pumps.timestream.name
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_NAME</b><br />
+Type: `string`<br />
+
+The name of the pump. This is used to identify the pump in the logs.
+Deprecated, use `type` instead.
+
+### pumps.timestream.type
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_TYPE</b><br />
+Type: `string`<br />
+
+Sets the pump type. This is needed when the pump key does not equal to the pump name type.
+Current valid types are: `mongo`, `mongo-pump-selective`, `mongo-pump-aggregate`, `csv`,
+`elasticsearch`, `influx`, `influx2`, `moesif`, `statsd`, `segment`, `graylog`, `splunk`, `hybrid`, `prometheus`,
+`logzio`, `dogstatsd`, `kafka`, `syslog`, `sql`, `sql_aggregate`, `stdout`, `timestream`, `mongo-graph`,
+`sql-graph`, `sql-graph-aggregate`, `resurfaceio`.
+
+### pumps.timestream.filters
+This feature adds a new configuration field in each pump called filters and its structure is
+the following:
+```{.json}
+"filters":{
+  "api_ids":[],
+  "org_ids":[],
+  "response_codes":[],
+  "skip_api_ids":[],
+  "skip_org_ids":[],
+  "skip_response_codes":[]
+}
+```
+The fields api_ids, org_ids and response_codes works as allow list (APIs and orgs where we
+want to send the analytics records) and the fields skip_api_ids, skip_org_ids and
+skip_response_codes works as block list.
+
+The priority is always block list configurations over allow list.
+
+An example of configuration would be:
+```{.json}
+"csv": {
+ "type": "csv",
+ "filters": {
+   "org_ids": ["org1","org2"]
+ },
+ "meta": {
+   "csv_dir": "./bar"
+ }
+}
+```
+
+### pumps.timestream.filters.org_ids
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_FILTERS_ORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of org_ids.
+
+### pumps.timestream.filters.api_ids
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_FILTERS_APIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by an allow list of api_ids.
+
+### pumps.timestream.filters.response_codes
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_FILTERS_RESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by an allow list of response_codes.
+
+### pumps.timestream.filters.skip_org_ids
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_FILTERS_SKIPPEDORGSIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of org_ids.
+
+### pumps.timestream.filters.skip_api_ids
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_FILTERS_SKIPPEDAPIIDS</b><br />
+Type: `[]string`<br />
+
+Filters pump data by a block list of api_ids.
+
+### pumps.timestream.filters.skip_response_codes
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_FILTERS_SKIPPEDRESPONSECODES</b><br />
+Type: `[]int`<br />
+
+Filters pump data by a block list of response_codes.
+
+### pumps.timestream.timeout
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_TIMEOUT</b><br />
+Type: `int`<br />
+
+By default, a pump will wait forever for each write operation to complete; you can configure an optional timeout by setting the configuration option `timeout`.
+If you have deployed multiple pumps, then you can configure each timeout independently. The timeout is in seconds and defaults to 0.
+
+The timeout is configured within the main pump config as shown here; note that this example would configure a 5 second timeout:
+```{.json}
+"pump_name": {
+  ...
+  "timeout":5,
+  "meta": {...}
+}
+```
+
+Tyk will inform you if the pump's write operation is taking longer than the purging loop (configured via `purge_delay`) as this will mean that data is purged before being written to the target data sink.
+
+If there is no timeout configured and pump's write operation is taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try to set a timeout for this pump.`
+
+If there is a timeout configured, but pump's write operation is still taking longer than the purging loop, the following warning log will be generated:
+`Pump {pump_name} is taking more time than the value configured of purge_delay. You should try lowering the timeout configured for this pump.`.
+
+### pumps.timestream.omit_detailed_recording
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to `false`.
+
+### pumps.timestream.max_record_size
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### pumps.timestream.ignore_fields
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_IGNOREFIELDS</b><br />
+Type: `[]string`<br />
+
+IgnoreFields defines a list of analytics fields that will be ignored when writing to the pump.
+This can be used to avoid writing sensitive information to the Database, or data that you don't really need to have.
+The field names must be the same as the JSON tags of the analytics record fields.
+For example: `["api_key", "api_version"]`.
+
+### pumps.timestream.meta.EnvPrefix
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_ENVPREFIX</b><br />
+Type: `string`<br />
+
+The prefix for the environment variables that will be used to override the configuration.
+Defaults to `TYK_PMP_PUMPS_TIMESTREAM_META`
+
+### pumps.timestream.meta.AWSRegion
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_AWSREGION</b><br />
+Type: `string`<br />
+
+The aws region that contains the timestream database
+
+### pumps.timestream.meta.TableName
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_TABLENAME</b><br />
+Type: `string`<br />
+
+The table name where the data is going to be written
+
+### pumps.timestream.meta.DatabaseName
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_DATABASENAME</b><br />
+Type: `string`<br />
+
+The timestream database name that contains the table being written to
+
+### pumps.timestream.meta.Dimensions
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_DIMENSIONS</b><br />
+Type: `[]string`<br />
+
+A filter of all the dimensions that will be written to the table. The possible options are
+["Method","Host","Path","RawPath","APIKey","APIVersion","APIName","APIID","OrgID","OauthID"]
+
+### pumps.timestream.meta.Measures
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_MEASURES</b><br />
+Type: `[]string`<br />
+
+A filter of all the measures that will be written to the table. The possible options are
+["ContentLength","ResponseCode","RequestTime","NetworkStats.OpenConnections",
+"NetworkStats.ClosedConnection","NetworkStats.BytesIn","NetworkStats.BytesOut",
+"Latency.Total","Latency.Upstream","GeoData.City.GeoNameID","IPAddress",
+"GeoData.Location.Latitude","GeoData.Location.Longitude","UserAgent","RawRequest","RawResponse",
+"RateLimit.Limit","Ratelimit.Remaining","Ratelimit.Reset",
+"GeoData.Country.ISOCode","GeoData.City.Names","GeoData.Location.TimeZone"]
+
+### pumps.timestream.meta.WriteRateLimit
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_WRITERATELIMIT</b><br />
+Type: `bool`<br />
+
+Set to true in order to save any of the `RateLimit` measures. Default value is `false`.
+
+### pumps.timestream.meta.ReadGeoFromRequest
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_READGEOFROMREQUEST</b><br />
+Type: `bool`<br />
+
+If set true, we will try to read geo information from the headers if
+values aren't found on the analytic record . Default value is `false`.
+
+### pumps.timestream.meta.WriteZeroValues
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_WRITEZEROVALUES</b><br />
+Type: `bool`<br />
+
+Set to true, in order to save numerical values with value zero. Default value is `false`.
+
+### pumps.timestream.meta.NameMappings
+ENV: <b>TYK_PMP_PUMPS_TIMESTREAM_META_NAMEMAPPINGS</b><br />
+Type: `map[string]string`<br />
+
+A name mapping for both Dimensions and Measures names. It's not required
+
+### analytics_storage_config
+Example Temporal storage configuration:
+```{.json}
+  "analytics_storage_config": {
+    "type": "redis",
+    "host": "localhost",
+    "port": 6379,
+    "hosts": null,
+    "username": "",
+    "password": "",
+    "database": 0,
+    "optimisation_max_idle": 100,
+    "optimisation_max_active": 0,
+    "enable_cluster": false,
+    "use_ssl": false,
+    "ssl_insecure_skip_verify": false
+  },
+```
+
+### analytics_storage_config.type
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_TYPE</b><br />
+Type: `string`<br />
+
+Deprecated.
+
+### analytics_storage_config.host
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_HOST</b><br />
+Type: `string`<br />
+
+Host value. For example: "localhost".
+
+### analytics_storage_config.port
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_PORT</b><br />
+Type: `int`<br />
+
+Port value. For example: 6379.
+
+### analytics_storage_config.hosts
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_HOSTS</b><br />
+Type: `map[string]string`<br />
+
+Deprecated: use Addrs instead.
+
+### analytics_storage_config.addrs
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_ADDRS</b><br />
+Type: `[]string`<br />
+
+Use instead of the host value if you're running a Redis cluster with multiple instances.
+
+### analytics_storage_config.master_name
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_MASTERNAME</b><br />
+Type: `string`<br />
+
+Sentinel master name.
+
+### analytics_storage_config.sentinel_password
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_SENTINELPASSWORD</b><br />
+Type: `string`<br />
+
+Sentinel password.
+
+### analytics_storage_config.username
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_USERNAME</b><br />
+Type: `string`<br />
+
+Database username.
+
+### analytics_storage_config.password
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_PASSWORD</b><br />
+Type: `string`<br />
+
+Database password.
+
+### analytics_storage_config.database
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_DATABASE</b><br />
+Type: `int`<br />
+
+Database name.
+
+### analytics_storage_config.timeout
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_TIMEOUT</b><br />
+Type: `int`<br />
+
+How long to allow for new connections to be established (in milliseconds). Defaults to 5sec.
+
+### analytics_storage_config.optimisation_max_idle
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_MAXIDLE</b><br />
+Type: `int`<br />
+
+Maximum number of idle connections in the pool.
+
+### analytics_storage_config.optimisation_max_active
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_MAXACTIVE</b><br />
+Type: `int`<br />
+
+Maximum number of connections allocated by the pool at a given time. When zero, there is no
+limit on the number of connections in the pool. Defaults to 500.
+
+### analytics_storage_config.enable_cluster
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_ENABLECLUSTER</b><br />
+Type: `bool`<br />
+
+Enable this option if you are using a cluster instance. Default is `false`.
+
+### analytics_storage_config.redis_key_prefix
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_REDISKEYPREFIX</b><br />
+Type: `string`<br />
+
+Prefix the key names. Defaults to "analytics-".
+Deprecated: use KeyPrefix instead.
+
+### analytics_storage_config.key_prefix
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_KEYPREFIX</b><br />
+Type: `string`<br />
+
+Prefix the key names. Defaults to "analytics-".
+
+### analytics_storage_config.use_ssl
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_USESSL</b><br />
+Type: `bool`<br />
+
+Setting this to true to use SSL when connecting to the DB.
+
+### analytics_storage_config.ssl_insecure_skip_verify
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Set this to `true` to tell Pump to ignore database's cert validation.
+
+### analytics_storage_config.ssl_ca_file
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_SSLCAFILE</b><br />
+Type: `string`<br />
+
+Path to the CA file.
+
+### analytics_storage_config.ssl_cert_file
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_SSLCERTFILE</b><br />
+Type: `string`<br />
+
+Path to the cert file.
+
+### analytics_storage_config.ssl_key_file
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_SSLKEYFILE</b><br />
+Type: `string`<br />
+
+Path to the key file.
+
+### analytics_storage_config.ssl_max_version
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_SSLMAXVERSION</b><br />
+Type: `string`<br />
+
+Maximum supported TLS version. Defaults to TLS 1.3, valid values are TLS 1.0, 1.1, 1.2, 1.3.
+
+### analytics_storage_config.ssl_min_version
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_SSLMINVERSION</b><br />
+Type: `string`<br />
+
+Minimum supported TLS version. Defaults to TLS 1.2, valid values are TLS 1.0, 1.1, 1.2, 1.3.
+
+### analytics_storage_config.redis_use_ssl
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_REDISUSESSL</b><br />
+Type: `bool`<br />
+
+Setting this to true to use SSL when connecting to the DB.
+Deprecated: use UseSSL instead.
+
+### analytics_storage_config.redis_ssl_insecure_skip_verify
+ENV: <b>TYK_PMP_ANALYTICSSTORAGECONFIG_REDISSSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Set this to `true` to tell Pump to ignore database's cert validation.
+Deprecated: use SSLInsecureSkipVerify instead.
+
+### analytics_storage_type
+ENV: <b>TYK_PMP_ANALYTICSSTORAGETYPE</b><br />
+Type: `string`<br />
+
+Sets the type of storage from which the Pump will fetch data.
+The supported value is `redis`, which covers both Redis and the Redis-compatible Valkey.
+Pump will default to assume Redis if no alternative is provided, so this configuration can be ignored at present.
+
+### statsd_connection_string
+ENV: <b>TYK_PMP_STATSDCONNECTIONSTRING</b><br />
+Type: `string`<br />
+
+Connection string for StatsD monitoring for information please see the
+[Instrumentation docs](/api-management/logs-metrics).
+
+### statsd_prefix
+ENV: <b>TYK_PMP_STATSDPREFIX</b><br />
+Type: `string`<br />
+
+Custom prefix value. For example separate settings for production and staging.
+
+### log_level
+ENV: <b>TYK_PMP_LOGLEVEL</b><br />
+Type: `string`<br />
+
+Set the logger details for tyk-pump. The posible values are: `info`,`debug`,`error` and
+`warn`. By default, the log level is `info`.
+
+### log_format
+ENV: <b>TYK_PMP_LOGFORMAT</b><br />
+Type: `string`<br />
+
+Configures the output format used for application logs.
+Allowed values are `text`, `json`, or `legacy`.
+If not set or left empty, it defaults to `text`.
+
+### Health Check
+From v2.9.4, we have introduced a `/health` endpoint to confirm the Pump is running. You
+need to configure the following settings. This returns a HTTP 200 OK response if the Pump is
+running.
+
+### health_check_endpoint_name
+ENV: <b>TYK_PMP_HEALTHCHECKENDPOINTNAME</b><br />
+Type: `string`<br />
+
+
+The default is "hello".
+
+### purge_delay
+ENV: <b>TYK_PMP_PURGEDELAY</b><br />
+Type: `int`<br />
+
+Controls the frequency at which Tyk Pump should perform regular collection and purge
+of traffic logs from the temporal storage (typically Redis). Set the time between purges (in seconds).
+Be careful to ensure that this is long enough for the transfer of records to the target data sink (e.g.
+persistent storage or external APM) to complete to avoid data loss, but short enough to optimise
+your temporal storage size.
+
+### health_check_endpoint_port
+ENV: <b>TYK_PMP_HEALTHCHECKENDPOINTPORT</b><br />
+Type: `int`<br />
+
+The default port is 8083.
+
+### max_record_size
+ENV: <b>TYK_PMP_MAXRECORDSIZE</b><br />
+Type: `int`<br />
+
+Defines maximum size (in bytes) for Raw Request and Raw Response logs, this value defaults
+to 0. If it is not set then tyk-pump will not trim any data and will store the full
+information. This can also be set at a pump level. For example:
+```{.json}
+"csv": {
+  "type": "csv",
+  "max_record_size":1000,
+  "meta": {
+    "csv_dir": "./"
+  }
+}
+```
+
+### dont_purge_uptime_data
+ENV: <b>TYK_PMP_DONTPURGEUPTIMEDATA</b><br />
+Type: `bool`<br />
+
+A default Uptime Pump will transfer uptime metrics which are used by Tyk Dashboard.
+If this is not required, you can disable that Pump by setting this option to `true`.
+
+### omit_detailed_recording
+ENV: <b>TYK_PMP_OMITDETAILEDRECORDING</b><br />
+Type: `bool`<br />
+
+Reduce the size of the traffic logs generated for each request by setting this to true. Tyk Pump will
+then not include the `raw_request` and `raw_response` in the logs. Defaults to false.
+
+### omit_config_file
+ENV: <b>TYK_PMP_OMITCONFIGFILE</b><br />
+Type: `bool`<br />
+
+Defines if tyk-pump should ignore all the values in configuration file. Specially useful when setting all configurations in environment variables.
+
+### enable_http_profiler
+ENV: <b>TYK_PMP_HTTPPROFILE</b><br />
+Type: `bool`<br />
+
+Expose profiling information to support debugging of Tyk Pump. This operates in the same way as for Tyk Gateway, as explained [here](/api-management/troubleshooting-debugging).
+
+### raw_request_decoded
+ENV: <b>TYK_PMP_DECODERAWREQUEST</b><br />
+Type: `bool`<br />
+
+This option was intended to decode raw request payloads from base64 for all Pumps. However, it was never implemented and therefore has no functional effect. It has now been deprecated.
+for all pumps. This is set to false by default.
+Deprecated: Use pump level raw_request_decoded configuration instead.
+
+### raw_response_decoded
+ENV: <b>TYK_PMP_DECODERAWRESPONSE</b><br />
+Type: `bool`<br />
+
+This option was intended to decode raw response payloads from base64 for all Pumps. However, it was never implemented and therefore has no functional effect. It has now been deprecated.
+Deprecated: Use pump level raw_response_decoded configuration instead.
+
diff --git a/snippets/redis-versions-include.mdx b/snippets/redis-versions-include.mdx
new file mode 100644
index 0000000000..ef6956c14a
--- /dev/null
+++ b/snippets/redis-versions-include.mdx
@@ -0,0 +1,12 @@
+---
+---
+
+**Tyk Gateway** requires Redis for its operations. Here is the list of supported versions:
+
+| Tyk Version | Redis Version |
+|---|---|
+| From 5.0.x to 5.8.x | 6.2.x, 7.x |
+| From 5.9.x to 5.11.x | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.2) |
+| From 5.12.x onwards | 6.2.x, 7.x, 7.4.x, 8.x (up to 8.4) |
+
+Visit the [Redis page](/planning-for-production/database-settings#redis) for more info.
diff --git a/snippets/self-managed-licensing-include.mdx b/snippets/self-managed-licensing-include.mdx
new file mode 100644
index 0000000000..6f21b284d1
--- /dev/null
+++ b/snippets/self-managed-licensing-include.mdx
@@ -0,0 +1,12 @@
+---
+---
+
+Tyk Self-Managed is the easiest way to install Tyk Full Lifecycle API Management solution in your infrastructure. There is no calling home, and there are no usage limits. You have complete control.
+
+You can quickly [get started](/getting-started/quick-start) with a self-managed trial license by completing the registration on our [website](https://tyk.io/self-managed-trial ). After registering, you’ll receive an email containing your license key.
+
+To continue using Tyk Self-Managed after your trial, please contact our [team](https://tyk.io/contact/) to discuss licensing options.
+
+<ButtonLeft href="https://tyk.io/contact/" color="green" content="Contact us" />
+
+If you'd rather have guided assistance, we recommend checking out our [Tyk Technical PoC Guide](https://tyk.io/customer-engineering/poc/technical-guide/).
\ No newline at end of file
diff --git a/snippets/sql-versions-include.mdx b/snippets/sql-versions-include.mdx
new file mode 100644
index 0000000000..bce5349e78
--- /dev/null
+++ b/snippets/sql-versions-include.mdx
@@ -0,0 +1,17 @@
+---
+---
+
+| Tyk Version | PostgreSQL Version |
+| ----------- | ---------------- |
+| From 5.X onwards   | PSQL 14.x, 15.x, 16.x, 17.x |
+
+You can also use the following as a drop in replacement for PostgreSQL:
+
+- [Amazon RDS](https://aws.amazon.com/rds/)
+- [Amazon Aurora PostgreSQL](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.AuroraPostgreSQL.html)
+- [Azure CosmosDB for PostgreSQL](https://learn.microsoft.com/en-us/azure/cosmos-db/postgresql/introduction)
+- [Sqlite](https://www.sqlite.org/index.html) (for development and testing only)
+
+<Note>
+SQLite support will be deprecated from Tyk 5.7.0. To avoid disruption, please transition to PostgreSQL, MongoDB or one of the listed compatible alternatives.
+</Note>
diff --git a/snippets/tyk-gateway-features-include.mdx b/snippets/tyk-gateway-features-include.mdx
new file mode 100644
index 0000000000..65d414587f
--- /dev/null
+++ b/snippets/tyk-gateway-features-include.mdx
@@ -0,0 +1,47 @@
+---
+---
+Tyk is an open source Enterprise API Gateway, supporting REST, GraphQL, TCP and gRPC protocols.
+
+Tyk Gateway is provided ‘Batteries-included’, with no feature lockout. Enabling your organization to control who accesses your APIs, when they access, and how they access it.
+
+Tyk Technologies uses the same API Gateway for all its applications. Protecting, securing, and processing APIs for thousands of organizations and businesses around the world. Ideal for Open Banking, building software in the clouds as well as exposing APIs to teams, partners & consumers.
+
+Built from the ground up to be the fastest API gateway on the planet. It does not depend on a legacy proxy underneath. It has no 3rd party dependencies aside from Redis for distributed rate-limiting and token storage. Tyk Gateway can also be deployed as part of a larger Full Lifecycle API Management platform Tyk Self-Managed which also includes Management Control Plane, Dashboard GUI and Developer Portal.
+
+<img src="/img/diagrams/gateway4.png" alt="Tyk Open Source Gateway features" />
+
+## Open Source API Gateway Features
+
+**Use any protocol:** REST, SOAP, GraphQL, gRPC, and TCP.
+
+**Industry Standard Authentication**: OIDC, JWT, bearer Tokens, Basic Auth, Client Certificates and more.
+
+**OpenAPI Standards**: Keep your OpenAPI 3.0 description as source of truth with [Tyk OAS APIs](/api-management/gateway-config-managing-oas#), import your Swagger and OAS2/3 documents to scaffold Tyk Classic APIs.
+
+**Ultra performant:** Low latency, and thousands of rps with just a single CPU, horizontally and vertically scalable.
+
+**Content mediation**: Transform all the things, from request or response headers to converting between SOAP and GraphQL. 
+
+**Extensible Plugin Architecture**: Customize Tyk’s middleware chain by writing plugins in your language of choice - from Javascript to Go, or any language which supports gRPC.
+
+**Rate Limiting & Quotas:** Protect your upstreams from becoming overloaded and/or apply limits for each consumer. 
+
+**API Versioning** - API Versions can be easily set and deprecated at a specific time and date.
+
+**Granular Access Control** - Grant access to one or more APIs on a per version and operation basis.
+
+**Blocklist/Allowlist/Ignored endpoint access** - Enforce strict security models on a version-by-version basis to your access points.
+
+**Analytics logging** - Record detailed usage data on who is using your API's (raw data only)
+
+**CORS** - Enable [CORS](/api-management/security-features#cross-origin-resource-sharing-cors) for certain APIs so users can make browser-based requests
+
+**Webhooks** - Trigger webhooks against events such as Quota Violations and Authentication failures
+
+**IP AllowListing** - Block access to non-trusted IP addresses for more secure interactions
+
+**Hitless reloads** - Tyk configurations can be altered dynamically and the service restarted without affecting any active request
+
+**Kubernetes native declarative API:** using [Tyk Operator](https://github.com/TykTechnologies/tyk-operator)
+
+_...and everything else you expect from a Cloud Native API Gateway_
\ No newline at end of file
diff --git a/snippets/x-tyk-gateway.mdx b/snippets/x-tyk-gateway.mdx
new file mode 100644
index 0000000000..28ba953992
--- /dev/null
+++ b/snippets/x-tyk-gateway.mdx
@@ -0,0 +1,3272 @@
+## Tyk vendor extension reference
+
+XTykAPIGateway contains custom Tyk API extensions for the OpenAPI definition.
+The values for the extensions are stored inside the OpenAPI document, under
+the key `x-tyk-api-gateway`.
+
+**Field: `info` ([Info](#info))**
+Info contains the main metadata for the API definition.
+
+**Field: `upstream` ([Upstream](#upstream))**
+Upstream contains the configurations related to the upstream.
+
+**Field: `server` ([Server](#server))**
+Server contains the configurations related to the server.
+
+**Field: `middleware` ([Middleware](#middleware))**
+Middleware contains the configurations related to the Tyk middleware.
+
+**Field: `errorOverrides` ([ErrorOverrides](#erroroverrides))**
+ErrorOverrides contains the configurations for error response customization.
+
+### **Info**
+
+Info contains the main metadata for the API definition.
+
+**Field: `id` (`string`)**
+ID is the unique identifier of the API within Tyk.
+
+Tyk classic API definition: `api_id`.
+
+**Field: `dbId` (`string`)**
+DBID is the unique identifier of the API within the Tyk database.
+
+Tyk classic API definition: `id`.
+
+**Field: `orgId` (`string`)**
+OrgID is the ID of the organisation which the API belongs to.
+
+Tyk classic API definition: `org_id`.
+
+**Field: `name` (`string`)**
+Name is the name of the API.
+
+Tyk classic API definition: `name`.
+
+**Field: `expiration` (`string`)**
+Expiration date.
+
+Tyk classic API definition: `expiration`.
+
+**Field: `state` ([State](#state))**
+State holds configuration for API definition states (active, internal).
+
+**Field: `versioning` ([Versioning](#versioning))**
+Versioning holds configuration for API versioning.
+
+### **Upstream**
+
+Upstream holds configuration for the upstream server to which Tyk should proxy requests.
+
+**Field: `url` (`string`)**
+URL defines the upstream address (or target URL) to which requests should be proxied.
+
+Tyk classic API definition: `proxy.target_url`.
+
+**Field: `serviceDiscovery` ([ServiceDiscovery](#servicediscovery))**
+ServiceDiscovery contains the configuration related to Service Discovery.
+
+Tyk classic API definition: `proxy.service_discovery`.
+
+**Field: `uptimeTests` ([UptimeTests](#uptimetests))**
+UptimeTests contains the configuration related to uptime tests.
+
+Tyk classic API definition: `uptime_tests` and `check_host_against_uptime_tests`.
+
+**Field: `mutualTLS` ([MutualTLS](#mutualtls))**
+MutualTLS contains the configuration for establishing a mutual TLS connection between Tyk and the upstream server.
+
+Tyk classic API definition: `upstream_certificates_disabled` and `upstream_certificates`.
+
+**Field: `certificatePinning` ([CertificatePinning](#certificatepinning))**
+CertificatePinning contains the configuration related to certificate pinning.
+
+Tyk classic API definition: `certificate_pinning_disabled` and `pinned_public_keys`.
+
+**Field: `rateLimit` ([RateLimit](#ratelimit))**
+RateLimit contains the configuration related to API level rate limit.
+
+Tyk classic API definition: `global_rate_limit`.
+
+**Field: `authentication` ([UpstreamAuth](#upstreamauth))**
+Authentication contains the configuration related to upstream authentication.
+
+Tyk classic API definition: `upstream_auth`.
+
+**Field: `loadBalancing` ([LoadBalancing](#loadbalancing))**
+LoadBalancing contains configuration for load balancing between multiple upstream targets.
+
+Tyk classic API definition: `proxy.enable_load_balancing` and `proxy.targets`.
+
+**Field: `preserveHostHeader` ([PreserveHostHeader](#preservehostheader))**
+PreserveHostHeader contains the configuration for preserving the host header.
+
+Tyk classic API definition: `proxy.preserve_host_header`.
+
+**Field: `preserveTrailingSlash` ([PreserveTrailingSlash](#preservetrailingslash))**
+PreserveTrailingSlash controls whether Tyk preserves trailing slashes in URLs when proxying
+requests to upstream services. When enabled, URLs like "/users/" will retain the trailing slash.
+
+Tyk classic API definition: `proxy.disable_strip_slash`.
+
+**Field: `tlsTransport` ([TLSTransport](#tlstransport))**
+TLSTransport contains the configuration for TLS transport settings.
+
+Tyk classic API definition: `proxy.transport`.
+
+**Field: `proxy` ([Proxy](#proxy))**
+Proxy contains the configuration for an internal proxy.
+
+Tyk classic API definition: `proxy.proxy_url`.
+
+### **Server**
+
+Server contains the configuration that sets Tyk up to receive requests from the client applications.
+
+**Field: `listenPath` ([ListenPath](#listenpath))**
+ListenPath is the base path on Tyk to which requests for this API should
+be sent. Tyk listens for any requests coming into the host at this
+path, on the port that Tyk is configured to run on and processes these
+accordingly.
+
+**Field: `authentication` ([Authentication](#authentication))**
+Authentication contains the configurations that manage how clients can authenticate with Tyk to access the API.
+
+**Field: `clientCertificates` ([ClientCertificates](#clientcertificates))**
+ClientCertificates contains the configurations related to establishing static mutual TLS between the client and Tyk.
+
+**Field: `gatewayTags` ([GatewayTags](#gatewaytags))**
+GatewayTags contain segment tags to indicate which Gateways your upstream service is connected to (and hence where to deploy the API).
+
+**Field: `customDomain` ([Domain](#domain))**
+CustomDomain is the domain to bind this API to. This enforces domain matching for client requests.
+
+
+Tyk classic API definition: `domain`.
+
+**Field: `detailedActivityLogs` ([DetailedActivityLogs](#detailedactivitylogs))**
+DetailedActivityLogs configures detailed analytics recording.
+
+**Field: `detailedTracing` ([DetailedTracing](#detailedtracing))**
+DetailedTracing enables OpenTelemetry's detailed tracing for this API.
+
+
+Tyk classic API definition: `detailed_tracing`.
+
+**Field: `eventHandlers` ([EventHandlers](#eventhandlers))**
+EventHandlers contains the configuration related to Tyk Events.
+
+
+Tyk classic API definition: `event_handlers`.
+
+**Field: `ipAccessControl` ([IPAccessControl](#ipaccesscontrol))**
+IPAccessControl configures IP access control for this API.
+
+
+Tyk classic API definition: `allowed_ips` and `blacklisted_ips`.
+
+**Field: `batchProcessing` ([BatchProcessing](#batchprocessing))**
+BatchProcessing contains configuration settings to enable or disable batch request support for the API.
+
+
+Tyk classic API definition: `enable_batch_request_support`.
+
+**Field: `protocol` (`string`)**
+Protocol configures the HTTP protocol used by the API.
+Possible values are:
+- "http": Standard HTTP/1.1 protocol
+- "http2": HTTP/2 protocol with TLS
+- "h2c": HTTP/2 protocol without TLS (cleartext).
+
+
+Tyk classic API definition: `protocol`.
+
+**Field: `port` (`int`)**
+Port Setting this value will change the port that Tyk listens on. Default: 8080.
+
+
+Tyk classic API definition: `listen_port`.
+
+### **Middleware**
+
+Middleware holds configuration for Tyk's native middleware.
+
+**Field: `global` ([Global](#global))**
+Global contains configuration for middleware that affects the whole API (all endpoints).
+
+**Field: `operations` ([Operations](#operations))**
+Operations contains configuration for middleware that can be applied to individual endpoints within the API (per-endpoint).
+
+**Field: `mcpTools` ([MCPPrimitives](#mcpprimitives))**
+McpTools contains configuration for middleware that can be applied to MCP tools.
+
+**Field: `mcpResources` ([MCPPrimitives](#mcpprimitives))**
+McpResources contains configuration for middleware that can be applied to MCP resources.
+
+**Field: `mcpPrompts` ([MCPPrimitives](#mcpprimitives))**
+McpPrompts contains configuration for middleware that can be applied to MCP prompts.
+
+### **ErrorOverrides**
+
+ErrorOverrides defines the configuration for error response overrides.
+
+**Field: `enabled` (`boolean`)**
+Enabled determines if error overrides are active for this API.
+Maps to Tyk classic API definition: `error_overrides_disabled`
+
+**Field: `value` ([ErrorOverridesMap](#erroroverridesmap))**
+Value contains the map of status codes to their override rules.
+
+### **State**
+
+State holds configuration for the status of the API within Tyk - if it is currently active and if it is exposed externally.
+
+**Field: `active` (`boolean`)**
+Active enables the API so that Tyk will listen for and process requests made to the listenPath.
+
+Tyk classic API definition: `active`.
+
+**Field: `internal` (`boolean`)**
+Internal controls the exposure of the API on the Gateway.
+When set to `true`, the API will not be made available for external access and will not be included in API listings returned by the Gateway's management APIs;
+it will be accessible only via [internal looping](/advanced-configuration/transform-traffic/looping) or as a [child API version](/api-management/api-versioning#base-and-child-apis).
+
+
+Tyk classic API definition: `internal`.
+
+### **Versioning**
+
+Versioning holds configuration for API versioning.
+
+Tyk classic API definition: `version_data`.
+
+**Field: `enabled` (`boolean`)**
+Enabled is a boolean flag, if set to `true` it will enable versioning of the API.
+
+**Field: `name` (`string`)**
+Name contains the name of the version as entered by the user ("v1" or similar).
+
+**Field: `default` (`string`)**
+Default contains the default version name if a request is issued without a version.
+
+**Field: `location` (`string`)**
+Location contains versioning location information. It can be one of the following:
+
+- `header`,
+- `url-param`,
+- `url`.
+
+**Field: `key` (`string`)**
+Key contains the name of the key to check for versioning information.
+
+**Field: `versions` ([[]VersionToID](#versiontoid))**
+Versions contains a list of versions that map to individual API IDs.
+
+**Field: `stripVersioningData` (`boolean`)**
+StripVersioningData is a boolean flag, if set to `true`, the API responses will be stripped of versioning data.
+
+**Field: `urlVersioningPattern` (`string`)**
+UrlVersioningPattern is a string that contains the pattern that if matched will remove the version from the URL.
+
+**Field: `fallbackToDefault` (`boolean`)**
+FallbackToDefault controls the behaviour of Tyk when a versioned API is called with a nonexistent version name.
+If set to `true` then the default API version will be invoked; if set to `false` Tyk will return an HTTP 404
+`This API version does not seem to exist` error in this scenario.
+
+### **ServiceDiscovery**
+
+ServiceDiscovery holds configuration required for service discovery.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates Service Discovery.
+
+
+Tyk classic API definition: `service_discovery.use_discovery_service`.
+
+**Field: `queryEndpoint` (`string`)**
+QueryEndpoint is the endpoint to call, this would usually be Consul, etcd or Eureka K/V store.
+
+Tyk classic API definition: `service_discovery.query_endpoint`.
+
+**Field: `dataPath` (`string`)**
+DataPath is the namespace of the data path - where exactly in your service response the namespace can be found.
+For example, if your service responds with:
+
+```
+{
+ "action": "get",
+ "node": {
+   "key": "/services/single",
+   "value": "http://httpbin.org:6000",
+   "modifiedIndex": 6,
+   "createdIndex": 6
+ }
+}
+```
+
+then your namespace would be `node.value`.
+
+
+Tyk classic API definition: `service_discovery.data_path`.
+
+**Field: `useNestedQuery` (`boolean`)**
+UseNestedQuery enables the use of a combination of `dataPath` and `parentDataPath`.
+It is necessary when the data lives within this string-encoded JSON object.
+
+```
+{
+ "action": "get",
+ "node": {
+   "key": "/services/single",
+   "value": "{"hostname": "http://httpbin.org", "port": "80"}",
+   "modifiedIndex": 6,
+   "createdIndex": 6
+ }
+}
+```
+
+
+Tyk classic API definition: `service_discovery.use_nested_query`.
+
+**Field: `parentDataPath` (`string`)**
+ParentDataPath is the namespace of the where to find the nested
+value if `useNestedQuery` is `true`. In the above example, it
+would be `node.value`. You would change the `dataPath` setting
+to be `hostname`, since this is where the host name data
+resides in the JSON string. Tyk automatically assumes that
+`dataPath` in this case is in a string-encoded JSON object and
+will try to deserialize it.
+
+
+Tyk classic API definition: `service_discovery.parent_data_path`.
+
+**Field: `portDataPath` (`string`)**
+PortDataPath is the port of the data path. In the above nested example, we can see that there is a separate `port` value
+for the service in the nested JSON. In this case, you can set the `portDataPath` value and Tyk will treat `dataPath` as
+the hostname and zip them together (this assumes that the hostname element does not end in a slash or resource identifier
+such as `/widgets/`). In the above example, the `portDataPath` would be `port`.
+
+
+Tyk classic API definition: `service_discovery.port_data_path`.
+
+**Field: `useTargetList` (`boolean`)**
+UseTargetList should be set to `true` if you are using load balancing. Tyk will treat the data path as a list and
+inject it into the target list of your API definition.
+
+
+Tyk classic API definition: `service_discovery.use_target_list`.
+
+**Field: `cacheTimeout` (`int64`)**
+CacheTimeout is the timeout of a cache value when a new data is loaded from a discovery service.
+Setting it too low will cause Tyk to call the SD service too often, setting it too high could mean that
+failures are not recovered from quickly enough.
+
+Deprecated: The field is deprecated. Use `service_discovery` to configure service discovery cache options.
+
+
+Tyk classic API definition: `service_discovery.cache_timeout`.
+
+**Field: `cache` ([ServiceDiscoveryCache](#servicediscoverycache))**
+Cache holds cache related flags.
+
+
+Tyk classic API definition:.
+- `service_discovery.cache_disabled`
+- `service_discovery.cache_timeout`
+
+**Field: `targetPath` (`string`)**
+TargetPath is used to set a target path that will be appended to the
+discovered endpoint, since many service discovery services only provide
+host and port data. It is important to be able to target a specific
+resource on that host. Setting this value will enable that.
+
+
+Tyk classic API definition: `service_discovery.target_path`.
+
+**Field: `endpointReturnsList` (`boolean`)**
+EndpointReturnsList is set `true` when the response type is a list instead of an object.
+
+
+Tyk classic API definition: `service_discovery.endpoint_returns_list`.
+
+### **UptimeTests**
+
+UptimeTests configures uptime tests.
+
+**Field: `enabled` (`boolean`)**
+Enabled specifies whether the uptime tests are active or not.
+
+Tyk classic API definition: `uptime_tests.disabled`.
+
+**Field: `serviceDiscovery` ([ServiceDiscovery](#servicediscovery))**
+ServiceDiscovery contains the configuration related to test Service Discovery.
+
+Tyk classic API definition: `proxy.service_discovery`.
+
+**Field: `tests` ([[]UptimeTest](#uptimetest))**
+Tests contains individual connectivity tests defined for checking if a service is online.
+
+**Field: `hostDownRetestPeriod` (`time.ReadableDuration`)**
+HostDownRetestPeriod is the time to wait until rechecking a failed test.
+If undefined, the default testing interval (10s) is in use.
+Setting this to a lower value would result in quicker recovery on failed checks.
+
+**Field: `logRetentionPeriod` (`time.ReadableDuration`)**
+LogRetentionPeriod holds a time to live for the uptime test results.
+If unset, a value of 100 years is the default.
+
+### **MutualTLS**
+
+MutualTLS contains the configuration for establishing a mutual TLS connection between Tyk and the upstream server.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates upstream mutual TLS for the API.
+
+Tyk classic API definition: `upstream_certificates_disabled`.
+
+**Field: `domainToCertificateMapping` ([[]DomainToCertificate](#domaintocertificate))**
+DomainToCertificates maintains the mapping of domain to certificate.
+
+Tyk classic API definition: `upstream_certificates`.
+
+### **CertificatePinning**
+
+CertificatePinning holds the configuration about mapping of domains to pinned public keys.
+
+**Field: `enabled` (`boolean`)**
+Enabled is a boolean flag, if set to `true`, it enables certificate pinning for the API.
+
+
+Tyk classic API definition: `certificate_pinning_disabled`.
+
+**Field: `domainToPublicKeysMapping` ([PinnedPublicKeys](#pinnedpublickeys))**
+DomainToPublicKeysMapping maintains the mapping of domain to pinned public keys.
+
+
+Tyk classic API definition: `pinned_public_keys`.
+
+### **RateLimit**
+
+RateLimit holds the configurations related to rate limit.
+The API-level rate limit applies a base-line limit on the frequency of requests to the upstream service for all endpoints. The frequency of requests is configured in two parts: the time interval and the number of requests that can be made during each interval.
+Tyk classic API definition: `global_rate_limit`.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates API level rate limiting for this API.
+
+
+Tyk classic API definition: `!disable_rate_limit`.
+
+**Field: `rate` (`int`)**
+Rate specifies the number of requests that can be passed to the upstream in each time interval (`per`).
+This field sets the limit on the frequency of requests to ensure controlled
+resource access or to prevent abuse. The rate is defined as an integer value.
+
+A higher value indicates a higher number of allowed requests in the given
+time frame. For instance, if `Per` is set to `1m` (one minute), a Rate of `100`
+means up to 100 requests can be made per minute.
+
+
+Tyk classic API definition: `global_rate_limit.rate`.
+
+**Field: `per` ([ReadableDuration](#readableduration))**
+Per defines the time interval for rate limiting using shorthand notation.
+The value of Per is a string that specifies the interval in a compact form,
+where hours, minutes and seconds are denoted by 'h', 'm' and 's' respectively.
+Multiple units can be combined to represent the duration.
+
+Examples of valid shorthand notations:
+- "1h"   : one hour
+- "20m"  : twenty minutes
+- "30s"  : thirty seconds
+- "1m29s": one minute and twenty-nine seconds
+- "1h30m" : one hour and thirty minutes
+
+An empty value is interpreted as "0s", implying no rate limiting interval, which disables the API-level rate limit.
+It's important to format the string correctly, as invalid formats will
+be considered as 0s/empty.
+
+
+Tyk classic API definition: `global_rate_limit.per`.
+
+### **UpstreamAuth**
+
+UpstreamAuth holds the configurations related to upstream API authentication.
+
+**Field: `enabled` (`boolean`)**
+Enabled enables upstream API authentication.
+
+**Field: `basicAuth` ([UpstreamBasicAuth](#upstreambasicauth))**
+BasicAuth holds the basic authentication configuration for upstream API authentication.
+
+**Field: `oauth` ([UpstreamOAuth](#upstreamoauth))**
+OAuth contains the configuration for OAuth2 Client Credentials flow.
+
+**Field: `requestSigning` ([UpstreamRequestSigning](#upstreamrequestsigning))**
+RequestSigning holds the configuration for generating signed requests to an upstream API.
+
+### **LoadBalancing**
+
+LoadBalancing represents the configuration for load balancing between multiple upstream targets.
+
+**Field: `enabled` (`boolean`)**
+Enabled determines if load balancing is active.
+
+**Field: `skipUnavailableHosts` (`boolean`)**
+SkipUnavailableHosts determines whether to skip unavailable hosts during load balancing based on uptime tests.
+Tyk classic field: `proxy.check_host_against_uptime_tests`
+
+**Field: `targets` ([[]LoadBalancingTarget](#loadbalancingtarget))**
+Targets defines the list of targets with their respective weights for load balancing.
+
+### **PreserveHostHeader**
+
+PreserveHostHeader holds the configuration for preserving the host header.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates preserving the host header.
+
+### **PreserveTrailingSlash**
+
+PreserveTrailingSlash holds the configuration for preserving the
+trailing slash when routed to upstream services.
+
+The default behaviour of Tyk is to strip any trailing slash (/) from
+the target URL when proxying the request upstream. In some use cases the
+upstream might expect the trailing slash - or might consider /users/ to
+be a different endpoint from /users (for example).
+
+**Field: `enabled` (`boolean`)**
+Enabled activates preserving the trailing slash when routing requests.
+
+### **TLSTransport**
+
+TLSTransport contains the configuration for TLS transport settings.
+This struct allows you to specify a custom proxy and set the minimum TLS versions and any SSL ciphers.
+
+Example:
+
+	```
+	{
+	  "proxy_url": "http(s)://proxy.url:1234",
+	  "minVersion": "1.0",
+	  "maxVersion": "1.0",
+	  "ciphers": [
+	    "TLS_RSA_WITH_AES_128_GCM_SHA256",
+	    "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
+	  ],
+	  "insecureSkipVerify": true,
+	  "forceCommonNameCheck": false
+	}
+	```
+
+Tyk classic API definition: `proxy.transport`
+
+**Field: `insecureSkipVerify` (`boolean`)**
+InsecureSkipVerify controls whether a client verifies the server's certificate chain and host name.
+If InsecureSkipVerify is true, crypto/tls accepts any certificate presented by the server and any host name in that certificate.
+In this mode, TLS is susceptible to machine-in-the-middle attacks unless custom verification is used.
+This should be used only for testing or in combination with VerifyConnection or VerifyPeerCertificate.
+
+
+Tyk classic API definition: `proxy.transport.ssl_insecure_skip_verify`.
+
+**Field: `ciphers` (`[]string`)**
+Ciphers is a list of SSL ciphers to be used. If unset, the default ciphers will be used.
+
+
+Tyk classic API definition: `proxy.transport.ssl_ciphers`.
+
+**Field: `minVersion` (`string`)**
+MinVersion is the minimum SSL/TLS version that is acceptable.
+
+Tyk classic API definition: `proxy.transport.ssl_min_version`.
+
+**Field: `maxVersion` (`string`)**
+MaxVersion is the maximum SSL/TLS version that is acceptable.
+
+**Field: `forceCommonNameCheck` (`boolean`)**
+ForceCommonNameCheck forces the validation of the hostname against the certificate Common Name.
+
+
+Tyk classic API definition: `proxy.transport.ssl_force_common_name_check`.
+
+### **Proxy**
+
+Proxy contains the configuration for an internal proxy.
+
+Tyk classic API definition: `proxy.proxy_url`
+
+**Field: `enabled` (`boolean`)**
+Enabled determines if the proxy is active.
+
+**Field: `url` (`string`)**
+URL specifies the URL of the internal proxy.
+
+### **ListenPath**
+
+ListenPath is the base path on Tyk to which requests for this API
+should be sent. Tyk listens out for any requests coming into the host at
+this path, on the port that Tyk is configured to run on and processes
+these accordingly.
+
+**Field: `value` (`string`)**
+Value is the value of the listen path e.g. `/api/` or `/` or `/httpbin/`.
+
+Tyk classic API definition: `proxy.listen_path`.
+
+**Field: `strip` (`boolean`)**
+Strip removes the inbound listen path (as accessed by the client) when generating the outbound request for the upstream service.
+
+For example, consider the scenario where the Tyk base address is `http://acme.com/`, the listen path is `example/` and the upstream URL is `http://httpbin.org/`:
+
+- If the client application sends a request to `http://acme.com/example/get` then the request will be proxied to `http://httpbin.org/example/get`
+- If stripListenPath is set to `true`, the `example` listen path is removed and the request would be proxied to `http://httpbin.org/get`.
+
+
+Tyk classic API definition: `proxy.strip_listen_path`.
+
+### **Authentication**
+
+Authentication contains configuration about the authentication methods and security policies applied to requests.
+
+**Field: `enabled` (`boolean`)**
+Enabled makes the API protected when one of the authentication modes is enabled.
+
+
+Tyk classic API definition: `!use_keyless`.
+
+**Field: `stripAuthorizationData` (`boolean`)**
+StripAuthorizationData ensures that any security tokens used for accessing APIs are stripped and not passed to the upstream.
+
+
+Tyk classic API definition: `strip_auth_data`.
+
+**Field: `baseIdentityProvider` (`string`)**
+BaseIdentityProvider enables the use of multiple authentication mechanisms.
+It provides the session object that determines access control, rate limits and usage quotas.
+
+It should be set to one of the following:
+
+- `auth_token`
+- `hmac_key`
+- `basic_auth_user`
+- `jwt_claim`
+- `oidc_user`
+- `oauth_key`
+- `custom_auth`
+
+
+Tyk classic API definition: `base_identity_provided_by`.
+
+**Field: `hmac` ([HMAC](#hmac))**
+HMAC contains the configurations related to HMAC authentication mode.
+
+
+Tyk classic API definition: `auth_configs["hmac"]`.
+
+**Field: `oidc` ([OIDC](#oidc))**
+OIDC contains the configurations related to OIDC authentication mode.
+
+
+Tyk classic API definition: `auth_configs["oidc"]`.
+
+**Field: `custom` ([CustomPluginAuthentication](#custompluginauthentication))**
+Custom contains the configurations related to Custom authentication mode.
+
+
+Tyk classic API definition: `auth_configs["coprocess"]`.
+
+**Field: `securitySchemes` ([SecuritySchemes](#securityschemes))**
+SecuritySchemes contains security schemes definitions.
+
+**Field: `customKeyLifetime` ([CustomKeyLifetime](#customkeylifetime))**
+CustomKeyLifetime contains configuration for the maximum retention period for access tokens.
+
+**Field: `securityProcessingMode` (`string`)**
+SecurityProcessingMode controls how Tyk will process the OpenAPI `security` field if multiple security requirement objects are declared.
+- "legacy" (default): Only the first security requirement object will be processed; uses BaseIdentityProvider to create the session object.
+- "compliant": All security requirement objects will be processed, request will be authorized if any of these are validated; the origin for the session object will be determined dynamically based on the validated security requirement.
+
+**Field: `security` (`[][]string`)**
+Security is an extension to the OpenAPI security field and is used when securityProcessingMode is set to "compliant".
+This can be used to combine any declared securitySchemes including Tyk proprietary auth methods.
+
+**Field: `protectedResourceMetadata` ([ProtectedResourceMetadata](#protectedresourcemetadata))**
+ProtectedResourceMetadata configures OAuth 2.0 Protected Resource Metadata (RFC 9728)
+for authorization server discovery. This is used by MCP clients to discover which
+authorization server to use for accessing the API.
+
+**Field: `certificateAuth` ([CertificateAuth](#certificateauth))**
+CertificateAuth represents certificate-based authentication configuration.
+
+### **ClientCertificates**
+
+ClientCertificates contains the configurations related to establishing static mutual TLS between the client and Tyk.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates static mTLS for the API.
+
+
+Tyk classic API definition: `use_mutual_tls_auth`.
+
+**Field: `allowlist` (`[]string`)**
+Allowlist is the list of client certificates which are allowed.
+
+
+Tyk classic API definition: `client_certificates`.
+
+### **GatewayTags**
+
+GatewayTags holds a list of segment tags that should apply for a gateway.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates use of segment tags.
+
+
+Tyk classic API definition: `tags_disabled` (negated).
+
+**Field: `tags` (`[]string`)**
+Tags contains a list of segment tags.
+
+
+Tyk classic API definition: `tags`.
+
+### **Domain**
+
+Domain holds the configuration of the domain name the server should listen on.
+
+**Field: `enabled` (`boolean`)**
+Enabled allow/disallow the usage of the domain.
+
+
+Tyk classic API definition: `domain_disabled` (negated).
+
+**Field: `name` (`string`)**
+Name is the name of the domain.
+
+
+Tyk classic API definition: `domain`.
+
+**Field: `certificates` (`[]string`)**
+Certificates defines a field for specifying certificate IDs or file paths
+that the Gateway can utilise to dynamically load certificates for your custom domain.
+
+
+Tyk classic API definition: `certificates`.
+
+### **DetailedActivityLogs**
+
+DetailedActivityLogs holds the configuration related to recording detailed analytics.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates detailed activity logs.
+
+
+Tyk classic API definition: `enable_detailed_recording`.
+
+### **DetailedTracing**
+
+DetailedTracing holds the configuration of the detailed tracing.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates detailed tracing.
+
+
+Tyk classic API definition: `detailed_tracing`.
+
+### **EventHandlers**
+
+EventHandlers holds the list of events to be processed for the API.
+
+Type defined as array of `EventHandler` values, see [EventHandler](#eventhandler) definition.
+
+### **IPAccessControl**
+
+IPAccessControl represents IP access control configuration.
+
+**Field: `enabled` (`boolean`)**
+Enabled indicates whether IP access control is enabled.
+
+
+Tyk classic API definition: `ip_access_control_disabled` (negated).
+
+**Field: `allow` (`[]string`)**
+Allow is a list of allowed IP addresses or CIDR blocks (e.g. "192.168.1.0/24").
+Note that if an IP address is present in both Allow and Block, the Block rule will take precedence.
+
+
+Tyk classic API definition: `allowed_ips`.
+
+**Field: `block` (`[]string`)**
+Block is a list of blocked IP addresses or CIDR blocks (e.g. "192.168.1.100/32").
+If an IP address is present in both Allow and Block, the Block rule will take precedence.
+
+
+Tyk classic API definition: `blacklisted_ips`.
+
+### **BatchProcessing**
+
+BatchProcessing represents the configuration for enabling or disabling batch request support for an API.
+
+**Field: `enabled` (`boolean`)**
+Enabled determines whether batch request support is enabled or disabled for the API.
+
+
+Tyk classic API definition: `enable_batch_request_support`.
+
+### **Global**
+
+Global contains configuration that affects the whole API (all endpoints).
+
+**Field: `pluginConfig` ([PluginConfig](#pluginconfig))**
+PluginConfig contains the common configuration for custom plugins.
+
+**Field: `cors` ([CORS](#cors))**
+CORS contains the configuration related to Cross Origin Resource Sharing.
+
+Tyk classic API definition: `CORS`.
+
+**Field: `prePlugin` ([PrePlugin](#preplugin))**
+PrePlugin contains configuration related to the custom plugin that is run before authentication.
+Deprecated: Use PrePlugins instead.
+
+**Field: `prePlugins` ([CustomPlugins](#customplugins))**
+PrePlugins contains configuration related to the custom plugin that is run before authentication.
+
+Tyk classic API definition: `custom_middleware.pre`.
+
+**Field: `postAuthenticationPlugin` ([PostAuthenticationPlugin](#postauthenticationplugin))**
+PostAuthenticationPlugin contains configuration related to the custom plugin that is run immediately after authentication.
+Deprecated: Use PostAuthenticationPlugins instead.
+
+**Field: `postAuthenticationPlugins` ([CustomPlugins](#customplugins))**
+PostAuthenticationPlugins contains configuration related to the custom plugin that is run immediately after authentication.
+
+Tyk classic API definition: `custom_middleware.post_key_auth`.
+
+**Field: `postPlugin` ([PostPlugin](#postplugin))**
+PostPlugin contains configuration related to the custom plugin that is run immediately prior to proxying the request to the upstream.
+Deprecated: Use PostPlugins instead.
+
+**Field: `postPlugins` ([CustomPlugins](#customplugins))**
+PostPlugins contains configuration related to the custom plugin that is run immediately prior to proxying the request to the upstream.
+
+Tyk classic API definition: `custom_middleware.post`.
+
+**Field: `responsePlugin` ([ResponsePlugin](#responseplugin))**
+ResponsePlugin contains configuration related to the custom plugin that is run during processing of the response from the upstream service.
+Deprecated: Use ResponsePlugins instead.
+
+**Field: `responsePlugins` ([CustomPlugins](#customplugins))**
+ResponsePlugins contains configuration related to the custom plugin that is run during processing of the response from the upstream service.
+
+
+Tyk classic API definition: `custom_middleware.response`.
+
+**Field: `cache` ([Cache](#cache))**
+Cache contains the configurations related to caching.
+
+Tyk classic API definition: `cache_options`.
+
+**Field: `transformRequestHeaders` ([TransformHeaders](#transformheaders))**
+TransformRequestHeaders contains the configurations related to API level request header transformation.
+
+Tyk classic API definition: `global_headers`/`global_headers_remove`.
+
+**Field: `transformResponseHeaders` ([TransformHeaders](#transformheaders))**
+TransformResponseHeaders contains the configurations related to API level response header transformation.
+
+Tyk classic API definition: `global_response_headers`/`global_response_headers_remove`.
+
+**Field: `contextVariables` ([ContextVariables](#contextvariables))**
+ContextVariables contains the configuration related to Tyk context variables.
+
+**Field: `trafficLogs` ([TrafficLogs](#trafficlogs))**
+TrafficLogs contains the configurations related to API level log analytics.
+
+**Field: `requestSizeLimit` ([GlobalRequestSizeLimit](#globalrequestsizelimit))**
+RequestSizeLimit contains the configuration related to limiting the global request size.
+
+**Field: `ignoreCase` ([IgnoreCase](#ignorecase))**
+IgnoreCase contains the configuration to treat routes as case-insensitive.
+
+**Field: `skipRateLimit` (`boolean`)**
+SkipRateLimit determines whether the rate-limiting middleware logic should be skipped.
+
+Tyk classic API definition: `disable_rate_limit`.
+
+**Field: `skipQuota` (`boolean`)**
+SkipQuota determines whether quota enforcement should be bypassed.
+
+Tyk classic API definition: `disable_quota`.
+
+**Field: `skipQuotaReset` (`boolean`)**
+SkipQuotaReset indicates if quota limits should not be reset when creating or updating quotas for the API.
+
+Tyk classic API definition: `dont_set_quota_on_create`.
+
+### **Operations**
+
+Operations holds Operation definitions. The string key in this object is the `operationID`, which is a unique identifier for each API operation.
+
+Type defined as object of `Operation` values, see [Operation](#operation) definition.
+
+### **MCPPrimitives**
+
+MCPPrimitives maps primitive names to their middleware configurations.
+For tools: key is tool name (e.g., "get-weather").
+For resources: key is resource URI pattern (e.g., "file:///repo/*").
+For prompts: key is prompt name (e.g., "code-review").
+
+Type defined as object of `MCPPrimitive` values, see [MCPPrimitive](#mcpprimitive) definition.
+
+### **ErrorOverridesMap**
+
+ErrorOverridesMap maps status codes to their override rules.
+
+### **VersionToID**
+
+VersionToID contains a single mapping from a version name into an API ID.
+Tyk classic API definition: Entry in `version_definition.versions` map.
+
+**Field: `name` (`string`)**
+Name contains the user chosen version name, e.g. `v1` or similar.
+
+**Field: `id` (`string`)**
+ID is the API ID for the version set in Name.
+
+### **ServiceDiscoveryCache**
+
+ServiceDiscoveryCache holds configuration for caching ServiceDiscovery data.
+
+**Field: `enabled` (`boolean`)**
+Enabled turns service discovery cache on or off.
+
+
+Tyk classic API definition: `service_discovery.cache_disabled`.
+
+**Field: `timeout` (`int64`)**
+Timeout is the TTL for a cached object in seconds.
+
+
+Tyk classic API definition: `service_discovery.cache_timeout`.
+
+### **UptimeTest**
+
+UptimeTest configures an uptime test check.
+
+**Field: `url` (`string`)**
+CheckURL is the URL for a request. If service discovery is in use,
+the hostname will be resolved to a service host.
+
+Examples:
+
+- `http://database1.company.local`
+- `https://webcluster.service/health`
+- `tcp://127.0.0.1:6379` (for TCP checks).
+
+**Field: `timeout` (`time.ReadableDuration`)**
+Timeout declares a timeout for the request. If the test exceeds
+this timeout, the check fails.
+
+**Field: `method` (`string`)**
+Method allows you to customize the HTTP method for the test (`GET`, `POST`,...).
+
+**Field: `headers` (`map[string]string`)**
+Headers contain any custom headers for the back end service.
+
+**Field: `body` (`string`)**
+Body is the body of the test request.
+
+**Field: `commands` ([[]UptimeTestCommand](#uptimetestcommand))**
+Commands are used for TCP checks.
+
+**Field: `enableProxyProtocol` (`boolean`)**
+EnableProxyProtocol enables proxy protocol support when making request.
+The back end service needs to support this.
+
+### **DomainToCertificate**
+
+DomainToCertificate holds a single mapping of domain name into a certificate.
+
+**Field: `domain` (`string`)**
+Domain contains the domain name.
+
+**Field: `certificate` (`string`)**
+Certificate contains the certificate mapped to the domain.
+
+### **PinnedPublicKeys**
+
+PinnedPublicKeys is a list of domains and pinned public keys for them.
+
+Type defined as array of `PinnedPublicKey` values, see [PinnedPublicKey](#pinnedpublickey) definition.
+
+### **ReadableDuration**
+
+ReadableDuration is an alias maintained to be used in imports.
+
+### **UpstreamBasicAuth**
+
+UpstreamBasicAuth holds upstream basic authentication configuration.
+
+**Field: `enabled` (`boolean`)**
+Enabled enables upstream basic authentication.
+
+**Field: `header` ([AuthSource](#authsource))**
+Header contains configurations for the header value.
+
+**Field: `username` (`string`)**
+Username is the username to be used for upstream basic authentication.
+
+**Field: `password` (`string`)**
+Password is the password to be used for upstream basic authentication.
+
+### **UpstreamOAuth**
+
+UpstreamOAuth holds the configuration for OAuth2 Client Credentials flow.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates upstream OAuth2 authentication.
+
+**Field: `allowedAuthorizeTypes` (`[]string`)**
+AllowedAuthorizeTypes specifies the allowed authorization types for upstream OAuth2 authentication.
+
+**Field: `clientCredentials` ([ClientCredentials](#clientcredentials))**
+ClientCredentials holds the configuration for OAuth2 Client Credentials flow.
+
+**Field: `password` ([PasswordAuthentication](#passwordauthentication))**
+PasswordAuthentication holds the configuration for upstream OAauth password authentication flow.
+
+### **UpstreamRequestSigning**
+
+UpstreamRequestSigning represents configuration for generating signed requests to an upstream API.
+Tyk classic API definition: `request_signing`.
+
+**Field: `enabled` (`boolean`)**
+Enabled determines if request signing is enabled or disabled.
+
+**Field: `signatureHeader` (`string`)**
+SignatureHeader specifies the HTTP header name for the signature.
+
+**Field: `algorithm` (`string`)**
+Algorithm represents the signing algorithm used (e.g., HMAC-SHA256).
+
+**Field: `keyId` (`string`)**
+KeyID identifies the key used for signing purposes.
+
+**Field: `headers` (`[]string`)**
+Headers contains a list of headers included in the signature calculation.
+
+**Field: `secret` (`string`)**
+Secret holds the secret used for signing when applicable.
+
+**Field: `certificateId` (`string`)**
+CertificateID specifies the certificate ID used in signing operations.
+
+### **LoadBalancingTarget**
+
+LoadBalancingTarget represents a single upstream target for load balancing with a URL and an associated weight.
+
+**Field: `url` (`string`)**
+URL specifies the upstream target URL for load balancing, represented as a string.
+
+**Field: `weight` (`int`)**
+Weight specifies the relative distribution factor for load balancing, determining the importance of this target.
+
+### **HMAC**
+
+HMAC holds the configuration for the HMAC authentication mode.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the HMAC authentication mode.
+
+
+Tyk classic API definition: `enable_signature_checking`.
+
+**Field: `allowedAlgorithms` (`[]string`)**
+AllowedAlgorithms is the array of HMAC algorithms which are allowed.
+
+Tyk supports the following HMAC algorithms:
+
+- `hmac-sha1`
+- `hmac-sha256`
+- `hmac-sha384`
+- `hmac-sha512`
+
+and reads the value from the algorithm header.
+
+
+Tyk classic API definition: `hmac_allowed_algorithms`.
+
+**Field: `allowedClockSkew` (`float64`)**
+AllowedClockSkew is the amount of milliseconds that will be tolerated for clock skew. It is used against replay attacks.
+The default value is `0`, which deactivates clock skew checks.
+
+
+Tyk classic API definition: `hmac_allowed_clock_skew`.
+
+### **OIDC**
+
+OIDC contains configuration for the OIDC authentication mode.
+OIDC support will be deprecated starting from 5.7.0.
+To avoid any disruptions, we recommend that you use JSON Web Token (JWT) instead,
+as explained in https://tyk.io/docs/basic-config-and-security/security/authentication-authorization/openid-connect/.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the OIDC authentication mode.
+
+
+Tyk classic API definition: `use_openid`.
+
+**Field: `segregateByClientId` (`boolean`)**
+SegregateByClientId is a boolean flag. If set to `true, the policies will be applied to a combination of Client ID and User ID.
+
+
+Tyk classic API definition: `openid_options.segregate_by_client`.
+
+**Field: `providers` ([[]Provider](#provider))**
+Providers contains a list of authorized providers, their Client IDs and matched policies.
+
+
+Tyk classic API definition: `openid_options.providers`.
+
+**Field: `scopes` ([Scopes](#scopes))**
+Scopes contains the defined scope claims.
+
+### **CustomPluginAuthentication**
+
+CustomPluginAuthentication holds configuration for custom plugins.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the CustomPluginAuthentication authentication mode.
+
+
+Tyk classic API definition: `enable_coprocess_auth`/`use_go_plugin_auth`.
+
+**Field: `config` ([AuthenticationPlugin](#authenticationplugin))**
+Config contains configuration related to custom authentication plugin.
+
+
+Tyk classic API definition: `custom_middleware.auth_check`.
+
+### **SecuritySchemes**
+
+SecuritySchemes holds security scheme values keyed by the scheme name declared in `components.securitySchemes`. Each value can be an `oauth2` scheme — see [OAuth2](#oauth2) for the full configuration contract.
+
+### **CustomKeyLifetime**
+
+CustomKeyLifetime contains configuration for custom key retention.
+
+**Field: `enabled` (`boolean`)**
+Enabled enables custom maximum retention for keys for the API.
+
+**Field: `value` ([ReadableDuration](#readableduration))**
+Value configures the expiry interval for a Key.
+The value is a string that specifies the interval in a compact form,
+where hours, minutes and seconds are denoted by 'h', 'm' and 's' respectively.
+Multiple units can be combined to represent the duration.
+
+Examples of valid shorthand notations:
+- "1h"   : one hour
+- "20m"  : twenty minutes
+- "30s"  : thirty seconds
+- "1m29s": one minute and twenty-nine seconds
+- "1h30m" : one hour and thirty minutes
+
+An empty value is interpreted as "0s"
+
+
+Tyk classic API definition: `session_lifetime`.
+
+**Field: `respectValidity` (`boolean`)**
+RespectValidity ensures that Tyk respects the expiry configured in the key when the API level configuration grants a shorter lifetime.
+That is, Redis waits until the key has expired before deleting it.
+
+
+Tyk classic API definition: `session_lifetime_respects_key_expiration`.
+
+### **ProtectedResourceMetadata**
+
+**Deprecated in Tyk 5.14.0.** Use `authentication.securitySchemes[name].oauth2.protectedResourceMetadata` ([OAuth2](#oauth2)) instead. Tyk Dashboard migrates existing configurations automatically on startup. This block remains for downgrade safety.
+
+ProtectedResourceMetadata holds the configuration for OAuth 2.0 Protected Resource Metadata (RFC 9728).
+It enables MCP clients to discover which authorization server protects this API resource.
+
+The serving mode is inferred from the configuration shape, not selected
+explicitly:
+  - When `Resource` or `AuthorizationServers` is set, Tyk runs in
+    **static** mode — the PRM doc is assembled from the fields below.
+  - When neither is set on an MCP API, Tyk runs in **mirror** mode —
+    the upstream's PRM doc is fetched, its `resource` field rewritten
+    to the gateway URL, and served. Used for transparent proxying of
+    OAuth-protected remote MCP servers.
+
+On non-MCP APIs only static is meaningful; mirror is a no-op.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the Protected Resource Metadata endpoint.
+
+**Field: `wellKnownPath` (`string`)**
+WellKnownPath is the path at which the metadata document is served.
+Defaults to ".well-known/oauth-protected-resource" if empty.
+
+**Field: `resource` (`string`)**
+Resource is the resource identifier (the API's resource URL).
+Required for static mode. Ignored in mirror mode (rewritten to the
+gateway URL at request time).
+
+**Field: `authorizationServers` (`[]string`)**
+AuthorizationServers is the list of authorization server URLs that can issue tokens for this resource.
+
+**Field: `scopesSupported` (`[]string`)**
+ScopesSupported is the list of OAuth 2.0 scopes supported by this resource.
+
+### **CertificateAuth**
+
+CertificateAuth represents certificate-based authentication configuration.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the certificate-based authentication mode.
+
+
+Tyk classic API definition: `auth_configs["authToken"].use_certificate`.
+
+### **EventHandler**
+
+EventHandler holds information about individual event to be configured on the API.
+
+**Field: `enabled` (`boolean`)**
+Enabled enables the event handler.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.disabled` (negated).
+
+**Field: `trigger` (`event.Event`)**
+Trigger specifies the TykEvent that should trigger the event handler.
+
+
+Tyk classic API definition: `event_handlers.events` key.
+
+**Field: `type` ([Kind](#kind))**
+Kind specifies the action to be taken on the event trigger.
+
+
+Tyk classic API definition: `event_handlers.events[].handler`.
+
+**Field: `id` (`string`)**
+ID is the ID of event handler in storage.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.id`.
+
+**Field: `name` (`string`)**
+Name is the name of event handler.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.name`.
+
+**Field: `` ([WebhookEvent](#webhookevent))**
+Webhook contains WebhookEvent configs. Encoding and decoding is handled by the custom marshaller.
+
+**Field: `` ([JSVMEvent](#jsvmevent))**
+JSVMEvent holds information about JavaScript VM events.
+
+**Field: `` ([LogEvent](#logevent))**
+LogEvent represents the configuration for logging events tied to an event handler.
+
+### **PluginConfig**
+
+PluginConfig holds configuration for custom plugins.
+
+**Field: `driver` (`string`)**
+Driver configures which custom plugin driver to use.
+The value should be set to one of the following:
+
+- `otto`,
+- `python`,
+- `lua`,
+- `grpc`,
+- `goplugin`.
+
+
+Tyk classic API definition: `custom_middleware.driver`.
+
+**Field: `bundle` ([PluginBundle](#pluginbundle))**
+Bundle configures custom plugin bundles.
+
+**Field: `data` ([PluginConfigData](#pluginconfigdata))**
+Data configures custom plugin data.
+
+### **CORS**
+
+CORS holds configuration for cross-origin resource sharing.
+
+**Field: `enabled` (`boolean`)**
+Enabled is a boolean flag, if set to `true`, this option enables CORS processing.
+
+
+Tyk classic API definition: `CORS.enable`.
+
+**Field: `maxAge` (`int`)**
+MaxAge indicates how long (in seconds) the results of a preflight request can be cached. The default is 0 which stands for no max age.
+
+
+Tyk classic API definition: `CORS.max_age`.
+
+**Field: `allowCredentials` (`boolean`)**
+AllowCredentials indicates if the request can include user credentials like cookies,
+HTTP authentication or client side SSL certificates.
+
+
+Tyk classic API definition: `CORS.allow_credentials`.
+
+**Field: `exposedHeaders` (`[]string`)**
+ExposedHeaders indicates which headers are safe to expose to the API of a CORS API specification.
+
+
+Tyk classic API definition: `CORS.exposed_headers`.
+
+**Field: `allowedHeaders` (`[]string`)**
+AllowedHeaders holds a list of non simple headers the client is allowed to use with cross-domain requests.
+
+
+Tyk classic API definition: `CORS.allowed_headers`.
+
+**Field: `optionsPassthrough` (`boolean`)**
+OptionsPassthrough is a boolean flag. If set to `true`, it will proxy the CORS OPTIONS pre-flight
+request directly to upstream, without authentication and any CORS checks. This means that pre-flight
+requests generated by web-clients such as SwaggerUI or the Tyk Portal documentation system
+will be able to test the API using trial keys.
+
+If your service handles CORS natively, then enable this option.
+
+
+Tyk classic API definition: `CORS.options_passthrough`.
+
+**Field: `debug` (`boolean`)**
+Debug is a boolean flag, If set to `true`, this option produces log files for the CORS middleware.
+
+
+Tyk classic API definition: `CORS.debug`.
+
+**Field: `allowedOrigins` (`[]string`)**
+AllowedOrigins holds a list of origin domains to allow access from. Wildcards are also supported, e.g. `http://*.foo.com`
+
+
+Tyk classic API definition: `CORS.allowed_origins`.
+
+**Field: `allowedMethods` (`[]string`)**
+AllowedMethods holds a list of methods to allow access via.
+
+
+Tyk classic API definition: `CORS.allowed_methods`.
+
+### **PrePlugin**
+
+PrePlugin configures pre-request plugins.
+
+Pre-request plugins are executed before the request is sent to the
+upstream target and before any authentication information is extracted
+from the header or parameter list of the request.
+
+**Field: `plugins` ([CustomPlugins](#customplugins))**
+Plugins configures custom plugins to be run on pre authentication stage.
+The plugins would be executed in the order of configuration in the list.
+
+### **CustomPlugins**
+
+CustomPlugins is a list of CustomPlugin objects.
+
+Type defined as array of `CustomPlugin` values, see [CustomPlugin](#customplugin) definition.
+
+### **PostAuthenticationPlugin**
+
+PostAuthenticationPlugin configures post authentication plugins.
+
+**Field: `plugins` ([CustomPlugins](#customplugins))**
+Plugins configures custom plugins to be run on pre authentication stage.
+The plugins would be executed in the order of configuration in the list.
+
+### **PostPlugin**
+
+PostPlugin configures post plugins.
+
+**Field: `plugins` ([CustomPlugins](#customplugins))**
+Plugins configures custom plugins to be run on post stage.
+The plugins would be executed in the order of configuration in the list.
+
+### **ResponsePlugin**
+
+ResponsePlugin configures response plugins.
+
+**Field: `plugins` ([CustomPlugins](#customplugins))**
+Plugins configures custom plugins to be run on post stage.
+The plugins would be executed in the order of configuration in the list.
+
+### **Cache**
+
+Cache holds configuration for caching the requests.
+
+**Field: `enabled` (`boolean`)**
+Enabled turns global cache middleware on or off. It is still possible to enable caching on a per-path basis
+by explicitly setting the endpoint cache middleware.
+
+
+Tyk classic API definition: `cache_options.enable_cache`.
+
+**Field: `timeout` (`int64`)**
+Timeout is the TTL for a cached object in seconds.
+
+
+Tyk classic API definition: `cache_options.cache_timeout`.
+
+**Field: `cacheAllSafeRequests` (`boolean`)**
+CacheAllSafeRequests caches responses to (`GET`, `HEAD`, `OPTIONS`) requests overrides per-path cache settings in versions,
+applies across versions.
+
+
+Tyk classic API definition: `cache_options.cache_all_safe_requests`.
+
+**Field: `cacheResponseCodes` (`[]int`)**
+CacheResponseCodes is an array of response codes which are safe to cache e.g. `404`.
+
+
+Tyk classic API definition: `cache_options.cache_response_codes`.
+
+**Field: `cacheByHeaders` (`[]string`)**
+CacheByHeaders allows header values to be used as part of the cache key.
+
+
+Tyk classic API definition: `cache_options.cache_by_headers`.
+
+**Field: `enableUpstreamCacheControl` (`boolean`)**
+EnableUpstreamCacheControl instructs Tyk Cache to respect upstream cache control headers.
+
+
+Tyk classic API definition: `cache_options.enable_upstream_cache_control`.
+
+**Field: `controlTTLHeaderName` (`string`)**
+ControlTTLHeaderName is the response header which tells Tyk how long it is safe to cache the response for.
+
+
+Tyk classic API definition: `cache_options.cache_control_ttl_header`.
+
+### **TransformHeaders**
+
+TransformHeaders holds configuration about request/response header transformations.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates Header Transform for the given path and method.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.transform_headers[].disabled` (negated).
+
+**Field: `remove` (`[]string`)**
+Remove specifies header names to be removed from the request/response.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.transform_headers[].delete_headers`.
+
+**Field: `add` ([Headers](#headers))**
+Add specifies headers to be added to the request/response.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.transform_headers[].add_headers`.
+
+### **ContextVariables**
+
+ContextVariables holds the configuration related to Tyk context variables.
+
+**Field: `enabled` (`boolean`)**
+Enabled provides access to context variables from specific Tyk middleware (URL rewrite, header and body transform).
+
+
+Tyk classic API definition: `enable_context_vars`.
+
+### **TrafficLogs**
+
+TrafficLogs holds configuration about API log analytics.
+
+**Field: `enabled` (`boolean`)**
+Enabled enables traffic log analytics for the API.
+
+Tyk classic API definition: `do_not_track`.
+
+**Field: `tagHeaders` (`[]string`)**
+TagHeaders is a string array of HTTP headers that can be extracted
+and transformed into analytics tags (statistics aggregated by tag, per hour).
+
+**Field: `customRetentionPeriod` ([ReadableDuration](#readableduration))**
+CustomRetentionPeriod configures a custom value for how long the analytics is retained for,
+defaults to 100 years.
+
+**Field: `plugins` ([CustomAnalyticsPlugins](#customanalyticsplugins))**
+Plugins configures custom plugins to allow for extensive modifications to analytics records
+The plugins would be executed in the order of configuration in the list.
+
+### **GlobalRequestSizeLimit**
+
+GlobalRequestSizeLimit holds configuration about the global limits for request sizes.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the Request Size Limit.
+
+
+Tyk classic API definition: `version_data.versions..global_size_limit_disabled` (negated).
+
+**Field: `value` (`int64`)**
+Value contains the value of the request size limit.
+
+
+Tyk classic API definition: `version_data.versions..global_size_limit`.
+
+### **IgnoreCase**
+
+IgnoreCase will make route matching be case insensitive.
+This accepts request to `/AAA` or `/aaa` if set to true.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates case insensitive route matching.
+
+
+Tyk classic API definition: `version_data.versions..ignore_endpoint_case`.
+
+### **UptimeTestCommand**
+
+UptimeTestCommand handles additional checks for tcp connections.
+
+**Field: `name` (`string`)**
+Name can be either `send` or `expect`, designating if the
+message should be sent, or read from the connection.
+
+**Field: `message` (`string`)**
+Message contains the payload to send or expect.
+
+### **PinnedPublicKey**
+
+PinnedPublicKey contains a mapping from the domain name into a list of public keys.
+
+**Field: `domain` (`string`)**
+Domain contains the domain name.
+
+**Field: `publicKeys` (`[]string`)**
+PublicKeys contains a list of the public keys pinned to the domain name.
+
+### **AuthSource**
+
+AuthSource defines an authentication source.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the auth source.
+
+
+Tyk classic API definition: `auth_configs[X].use_param/use_cookie`.
+
+**Field: `name` (`string`)**
+Name is the name of the auth source.
+
+
+Tyk classic API definition: `auth_configs[X].param_name/cookie_name`.
+
+### **ClientCredentials**
+
+ClientCredentials holds the configuration for OAuth2 Client Credentials flow.
+
+**Field: `header` ([AuthSource](#authsource))**
+Header holds the configuration for the custom header to be used for OAuth authentication.
+
+**Field: `tokenUrl` (`string`)**
+TokenURL is the resource server's token endpoint
+URL. This is a constant specific to each server.
+
+**Field: `scopes` (`[]string`)**
+Scopes specifies optional requested permissions.
+
+**Field: `extraMetadata` (`[]string`)**
+ExtraMetadata holds the keys that we want to extract from the token and pass to the upstream.
+
+### **PasswordAuthentication**
+
+PasswordAuthentication holds the configuration for upstream OAuth2 password authentication flow.
+
+**Field: `header` ([AuthSource](#authsource))**
+Header holds the configuration for the custom header to be used for OAuth authentication.
+
+**Field: `username` (`string`)**
+Username is the username to be used for upstream OAuth2 password authentication.
+
+**Field: `password` (`string`)**
+Password is the password to be used for upstream OAuth2 password authentication.
+
+**Field: `tokenUrl` (`string`)**
+TokenURL is the resource server's token endpoint
+URL. This is a constant specific to each server.
+
+**Field: `scopes` (`[]string`)**
+Scopes specifies optional requested permissions.
+
+**Field: `extraMetadata` (`[]string`)**
+ExtraMetadata holds the keys that we want to extract from the token and pass to the upstream.
+
+### **Provider**
+
+Provider defines an issuer to validate and the Client ID to Policy ID mappings.
+
+**Field: `issuer` (`string`)**
+Issuer contains a validation value for the issuer claim, usually a domain name e.g. `accounts.google.com` or similar.
+
+
+Tyk classic API definition: `openid_options.providers[].issuer`.
+
+**Field: `clientToPolicyMapping` ([[]ClientToPolicy](#clienttopolicy))**
+ClientToPolicyMapping contains mappings of Client IDs to Policy IDs.
+
+
+Tyk classic API definition: `openid_options.providers[].client_ids`.
+
+### **Scopes**
+
+Scopes holds the scope to policy mappings for a claim name.
+This struct is used for both JWT and OIDC authentication.
+
+**Field: `claimName` (`string`)**
+ClaimName contains the claim name.
+
+
+Tyk classic API definition:.
+- For OIDC: `scopes.oidc.scope_claim_name`
+- For JWT: `scopes.jwt.scope_claim_name`
+
+**Field: `claims` (`[]string`)**
+Claims specifies a list of claims that can be used to provide the scope-to-policy mapping.
+The first match from the list found in the token will be interrogated to retrieve the scopes that are then checked against the scopeToPolicyMapping.
+
+**Field: `scopeToPolicyMapping` ([[]ScopeToPolicy](#scopetopolicy))**
+ScopeToPolicyMapping contains the mappings of scopes to policy IDs.
+
+
+Tyk classic API definition:.
+- For OIDC: `scopes.oidc.scope_to_policy`
+- For JWT: `scopes.jwt.scope_to_policy`
+
+### **AuthenticationPlugin**
+
+AuthenticationPlugin holds the configuration for custom authentication plugin.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates custom authentication plugin.
+
+
+Tyk classic API definition: `custom_middleware.auth_check.disabled` (negated).
+
+**Field: `functionName` (`string`)**
+FunctionName is the name of authentication method.
+
+
+Tyk classic API definition: `custom_middleware.auth_check.name`.
+
+**Field: `path` (`string`)**
+Path is the path to shared object file in case of goplugin mode or path to JS code in case of otto auth plugin.
+
+
+Tyk classic API definition: `custom_middleware.auth_check.path`.
+
+**Field: `rawBodyOnly` (`boolean`)**
+RawBodyOnly if set to true, do not fill body in request or response object.
+
+
+Tyk classic API definition: `custom_middleware.auth_check.raw_body_only`.
+
+**Field: `requireSession` (`boolean`)**
+RequireSession passes down the session information for plugins after authentication.
+
+
+Tyk classic API definition: `custom_middleware.auth_check.require_session`.
+
+**Field: `idExtractor` ([IDExtractor](#idextractor))**
+IDExtractor configures ID extractor with coprocess custom authentication.
+
+
+Tyk classic API definition: `custom_middleware.id_extractor`.
+
+### **Kind**
+
+Kind is an alias maintained to be used in imports.
+
+### **WebhookEvent**
+
+WebhookEvent stores the core information about a webhook event.
+
+**Field: `url` (`string`)**
+URL is the target URL for the webhook.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.target_path`.
+
+**Field: `method` (`string`)**
+Method is the HTTP method for the webhook.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.method`.
+
+**Field: `cooldownPeriod` ([ReadableDuration](#readableduration))**
+CoolDownPeriod defines cool-down for the event, so it does not trigger again.
+It uses shorthand notation.
+The value of CoolDownPeriod is a string that specifies the interval in a compact form,
+where hours, minutes and seconds are denoted by 'h', 'm' and 's' respectively.
+Multiple units can be combined to represent the duration.
+
+Examples of valid shorthand notations:
+- "1h"   : one hour
+- "20m"  : twenty minutes
+- "30s"  : thirty seconds
+- "1m29s": one minute and twenty-nine seconds
+- "1h30m" : one hour and thirty minutes
+
+An empty value is interpreted as "0s", implying no cool-down.
+It's important to format the string correctly, as invalid formats will
+be considered as 0s/empty.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.event_timeout`.
+
+**Field: `bodyTemplate` (`string`)**
+BodyTemplate is the template to be used for request payload.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.template_path`.
+
+**Field: `headers` ([Headers](#headers))**
+Headers are the list of request headers to be used.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.header_map`.
+
+### **JSVMEvent**
+
+JSVMEvent represents a JavaScript VM event configuration for event handlers.
+
+**Field: `functionName` (`string`)**
+FunctionName specifies the JavaScript function name to be executed.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.method_name`.
+
+**Field: `path` (`string`)**
+Path specifies the path to the JavaScript file containing the function.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.path`.
+
+### **LogEvent**
+
+LogEvent represents the configuration for logging events within an event handler.
+
+**Field: `logPrefix` (`string`)**
+LogPrefix defines the prefix used for log messages in the logging event.
+
+
+Tyk classic API definition: `event_handlers.events[].handler_meta.prefix`.
+
+### **PluginBundle**
+
+PluginBundle holds configuration for custom plugins.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the custom plugin bundles.
+
+
+Tyk classic API definition: `custom_middleware_bundle_disabled`.
+
+**Field: `path` (`string`)**
+Path is the path suffix to construct the URL to fetch plugin bundle from.
+Path will be suffixed to `bundle_base_url` in gateway config.
+
+### **PluginConfigData**
+
+PluginConfigData configures config data for custom plugins.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates custom plugin config data.
+
+
+Tyk classic API definition: `config_data_disabled` (negated).
+
+**Field: `value` (`any`)**
+Value is the value of custom plugin config data.
+
+
+Tyk classic API definition: `config_data`.
+
+### **CustomPlugin**
+
+CustomPlugin configures custom plugin.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the custom plugin.
+
+
+Tyk classic API definition: `custom_middleware.pre[].disabled`, `custom_middleware.post_key_auth[].disabled`,.
+`custom_middleware.post[].disabled`, `custom_middleware.response[].disabled` (negated).
+
+**Field: `functionName` (`string`)**
+FunctionName is the name of authentication method.
+
+
+Tyk classic API definition: `custom_middleware.pre[].name`, `custom_middleware.post_key_auth[].name`,.
+`custom_middleware.post[].name`, `custom_middleware.response[].name`.
+
+**Field: `path` (`string`)**
+Path is the path to shared object file in case of goplugin mode or path to JS code in case of otto auth plugin.
+
+
+Tyk classic API definition: `custom_middleware.pre[].path`, `custom_middleware.post_key_auth[].path`,.
+`custom_middleware.post[].path`, `custom_middleware.response[].path`.
+
+**Field: `rawBodyOnly` (`boolean`)**
+RawBodyOnly if set to true, do not fill body in request or response object.
+
+
+Tyk classic API definition: `custom_middleware.pre[].raw_body_only`, `custom_middleware.post_key_auth[].raw_body_only`,.
+`custom_middleware.post[].raw_body_only`, `custom_middleware.response[].raw_body_only`.
+
+**Field: `requireSession` (`boolean`)**
+RequireSession if set to true passes down the session information for plugins after authentication.
+RequireSession is used only with JSVM custom middleware.
+
+
+Tyk classic API definition: `custom_middleware.pre[].require_session`, `custom_middleware.post_key_auth[].require_session`,.
+`custom_middleware.post[].require_session`, `custom_middleware.response[].require_session`.
+
+### **Headers**
+
+Headers is an array of Header.
+
+Type defined as array of `Header` values, see [Header](#header) definition.
+
+### **CustomAnalyticsPlugins**
+
+CustomAnalyticsPlugins is a list of CustomPlugin objects for analytics.
+
+Type defined as array of `CustomPlugin` values, see [CustomPlugin](#customplugin) definition.
+
+### **ClientToPolicy**
+
+ClientToPolicy contains a 1-1 mapping between Client ID and Policy ID.
+
+**Field: `clientId` (`string`)**
+ClientID contains a Client ID.
+
+
+Tyk classic API definition: Key in `openid_options.providers[].client_ids` map.
+
+**Field: `policyId` (`string`)**
+PolicyID contains a Policy ID.
+
+
+Tyk classic API definition: Value in `openid_options.providers[].client_ids` map.
+
+### **ScopeToPolicy**
+
+ScopeToPolicy contains a single scope to policy ID mapping.
+This struct is used for both JWT and OIDC authentication.
+
+**Field: `scope` (`string`)**
+Scope contains the scope name.
+
+
+Tyk classic API definition:.
+- For OIDC: Key in `scopes.oidc.scope_to_policy` map
+- For JWT: Key in `scopes.jwt.scope_to_policy` map.
+
+**Field: `policyId` (`string`)**
+PolicyID contains the Policy ID.
+
+
+Tyk classic API definition:.
+- For OIDC: Value in `scopes.oidc.scope_to_policy` map
+- For JWT: Value in `scopes.jwt.scope_to_policy` map.
+
+### **IDExtractor**
+
+IDExtractor configures ID Extractor.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates ID extractor with coprocess authentication.
+
+
+Tyk classic API definition: `custom_middleware.id_extractor.disabled` (negated).
+
+**Field: `source` (`string`)**
+Source is the source from which ID to be extracted from.
+Valid values are:
+- `header` - Extract ID from a header
+- `form` - Extract ID from a form parameter
+- `body` - Extract ID from the request body
+
+
+Tyk classic API definition: `custom_middleware.id_extractor.extract_from`.
+
+**Field: `with` (`string`)**
+With is the type of ID extractor to be used.
+Valid values are:
+- `value` - Extract ID from a value
+- `xpath` - Extract ID using an XPath expression
+- `regex` - Extract ID using a regular expression
+
+
+Tyk classic API definition: `custom_middleware.id_extractor.extract_with`.
+
+**Field: `config` ([IDExtractorConfig](#idextractorconfig))**
+Config holds the configuration specific to ID extractor type mentioned via With.
+
+
+Tyk classic API definition: `custom_middleware.id_extractor.extractor_config`.
+
+### **Header**
+
+Header holds a header name and value pair.
+
+**Field: `name` (`string`)**
+Name is the name of the header.
+
+**Field: `value` (`string`)**
+Value is the value of the header.
+
+### **IDExtractorConfig**
+
+IDExtractorConfig specifies the configuration for ID extractor.
+
+**Field: `headerName` (`string`)**
+HeaderName is the header name to extract ID from.
+Used when Source is set to "header" and With is set to "value".
+
+
+Tyk classic API definition: `custom_middleware.id_extractor.extractor_config.header_name`.
+
+**Field: `formParamName` (`string`)**
+FormParamName is the form parameter name to extract ID from.
+Used when Source is set to "form" and With is set to "value".
+
+
+Tyk classic API definition: `custom_middleware.id_extractor.extractor_config.form_param_name`.
+
+**Field: `regexp` (`string`)**
+Regexp is the regular expression to match ID.
+Used when With is set to "regex".
+
+
+Tyk classic API definition: `custom_middleware.id_extractor.extractor_config.regex_expression`.
+
+**Field: `regexpMatchIndex` (`int`)**
+RegexpMatchIndex is the index from which ID to be extracted after a match.
+Default value is 0, ie if regexpMatchIndex is not provided ID is matched from index 0.
+Used when With is set to "regex".
+
+
+Tyk classic API definition: `custom_middleware.id_extractor.extractor_config.regex_match_index`.
+
+**Field: `xPathExp` (`string`)**
+XPathExp is the xpath expression to match ID.
+Used when With is set to "xpath".
+
+
+Tyk classic API definition: `custom_middleware.id_extractor.extractor_config.xpath_expression`.
+
+### **Allowance**
+
+Allowance describes allowance actions and behaviour.
+
+**Field: `enabled` (`boolean`)**
+Enabled is a boolean flag, if set to `true`, then individual allowances (allow, block, ignore) will be enforced.
+
+**Field: `ignoreCase` (`boolean`)**
+IgnoreCase is a boolean flag, If set to `true`, checks for requests allowance will be case insensitive.
+
+### **AllowanceType**
+
+AllowanceType holds the valid allowance types values.
+
+### **AuthSources**
+
+AuthSources defines authentication source configuration: headers, cookies and query parameters.
+
+Tyk classic API definition: `auth_configs{}`.
+
+**Field: `header` ([AuthSource](#authsource))**
+Header contains configurations for the header value auth source, it is enabled by default.
+
+
+Tyk classic API definition: `auth_configs[x].header`.
+
+**Field: `cookie` ([AuthSource](#authsource))**
+Cookie contains configurations for the cookie value auth source.
+
+
+Tyk classic API definition: `auth_configs[x].cookie`.
+
+**Field: `query` ([AuthSource](#authsource))**
+Query contains configurations for the query parameters auth source.
+
+
+Tyk classic API definition: `auth_configs[x].query`.
+
+### **Basic**
+
+Basic type holds configuration values related to http basic authentication.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the basic authentication mode.
+
+Tyk classic API definition: `use_basic_auth`.
+
+**Field: `disableCaching` (`boolean`)**
+DisableCaching disables the caching of basic authentication key.
+
+Tyk classic API definition: `basic_auth.disable_caching`.
+
+**Field: `cacheTTL` (`int`)**
+CacheTTL is the TTL for a cached basic authentication key in seconds.
+
+Tyk classic API definition: `basic_auth.cache_ttl`.
+
+**Field: `extractCredentialsFromBody` ([ExtractCredentialsFromBody](#extractcredentialsfrombody))**
+ExtractCredentialsFromBody helps to extract username and password from body. In some cases, like dealing with SOAP,
+user credentials can be passed via request body.
+
+### **CachePlugin**
+
+CachePlugin holds the configuration for the cache plugins.
+
+**Field: `enabled` (`boolean`)**
+Enabled is a boolean flag. If set to `true`, the advanced caching plugin will be enabled.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.advance_cache_config[].disabled` (negated).
+
+**Field: `cacheByRegex` (`string`)**
+CacheByRegex defines a regular expression used against the request body to produce a cache key.
+
+Example value: `\"id\":[^,]*` (quoted json value).
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.advance_cache_config[].cache_key_regex`.
+
+**Field: `cacheResponseCodes` (`[]int`)**
+CacheResponseCodes contains a list of valid response codes for responses that are okay to add to the cache.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.advance_cache_config[].cache_response_codes`.
+
+**Field: `timeout` (`int64`)**
+Timeout is the TTL for the endpoint level caching in seconds. 0 means no caching.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.advance_cache_config[].timeout`.
+
+### **CircuitBreaker**
+
+CircuitBreaker holds configuration for the circuit breaker middleware.
+Tyk classic API definition: `version_data.versions..extended_paths.circuit_breakers[*]`.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the Circuit Breaker functionality.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.circuit_breakers[*].disabled` (negated).
+
+**Field: `threshold` (`float64`)**
+Threshold is the proportion from each `sampleSize` requests that must fail for the breaker to be tripped. This must be a value between 0.0 and 1.0. If `sampleSize` is 100 then a threshold of 0.4 means that the breaker will be tripped if 40 out of every 100 requests fails.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.circuit_breakers[*].threshold_percent`.
+
+**Field: `sampleSize` (`int`)**
+SampleSize is the size of the circuit breaker sampling window. Combining this with `threshold` gives the failure rate required to trip the circuit breaker.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.circuit_breakers[*].samples`.
+
+**Field: `coolDownPeriod` (`int`)**
+CoolDownPeriod is the period of time (in seconds) for which the circuit breaker will remain open before returning to service.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.circuit_breakers[*].return_to_service_after`.
+
+**Field: `halfOpenStateEnabled` (`boolean`)**
+HalfOpenStateEnabled , if enabled, allows some requests to pass through the circuit breaker during the cool down period. If Tyk detects that the path is now working, the circuit breaker will be automatically reset and traffic will be resumed to the upstream.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.circuit_breakers[*].disable_half_open_state` (negated).
+
+### **ClientAuthData**
+
+ClientAuthData holds the client ID and secret for OAuth2 authentication.
+
+**Field: `clientId` (`string`)**
+ClientID is the application's ID.
+
+**Field: `clientSecret` (`string`)**
+ClientSecret is the application's secret.
+
+### **CustomClaimValidationConfig**
+
+CustomClaimValidationConfig defines the validation configuration for a custom JWT claim.
+
+**Field: `type` ([CustomClaimValidationType](#customclaimvalidationtype))**
+Type specifies the type of validation to perform on the claim.
+Supported types:
+- required: validates that the claim exists and is non-null.
+- exact_match: validates that the claim in the JWT equals one of the allowed values (case-sensitive).
+- contains: validates that the claim in the JWT contains one of the allowed values.
+
+**Field: `allowedValues` (`[]string|int|boolean|array`)**
+AllowedValues contains the values that Tyk will use to validate the claim for "exact_match" and "contains" validation types.
+Not used for "required" validation type.
+Supports string, number, boolean, and array values.
+For arrays, validation succeeds if any array element matches any allowed value.
+
+**Field: `nonBlocking` (`boolean`)**
+NonBlocking determines if validation failure should log a warning (true) or reject the request (false).
+This enables gradual rollout of validation rules by monitoring before enforcing.
+Multiple rules can be mixed, some blocking and others non-blocking.
+
+### **CustomClaimValidationType**
+
+CustomClaimValidationType represents how a JWT claim should be validated.
+This determines the validation logic used to check the claim value.
+The validation behavior varies based on both the type selected and the claim's data type.
+
+### **EdgeEndpoint**
+
+EdgeEndpoint represents an edge gateway endpoint configuration.
+
+**Field: `Endpoint` (`string`)**
+Endpoint is the edge gateway URL (e.g., "http://edge1.example.com").
+
+**Field: `Tags` (`[]string`)**
+Tags are the tags associated with this edge gateway.
+
+### **EndpointPostPlugin**
+
+EndpointPostPlugin contains endpoint level post plugin configuration.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates post plugin.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.go_plugin.disabled`(negated).
+
+**Field: `name` (`string`)**
+Name is the name of plugin function to be executed.
+Deprecated: Use FunctionName instead.
+
+**Field: `functionName` (`string`)**
+FunctionName is the name of plugin function to be executed.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.go_plugin.symbol_name`(negated).
+
+**Field: `path` (`string`)**
+Path is the path to plugin.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.go_plugin.plugin_path`(negated).
+
+### **EndpointPostPlugins**
+
+EndpointPostPlugins is a list of EndpointPostPlugins. It's used where multiple plugins can be run.
+
+Type defined as array of `EndpointPostPlugin` values, see [EndpointPostPlugin](#endpointpostplugin) definition.
+
+### **EnforceTimeout**
+
+EnforceTimeout holds the configuration for enforcing request timeouts.
+
+**Field: `enabled` (`boolean`)**
+Enabled is a boolean flag. If set to `true`, requests will enforce a configured timeout.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.hard_timeouts[].disabled` (negated).
+
+**Field: `value` (`int`)**
+Value is the configured timeout in seconds.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.hard_timeouts[].timeout`.
+
+### **ErrorMatcher**
+
+ErrorMatcher defines additional matching criteria for error overrides.
+
+**Field: `flag` (`errors.ResponseFlag`)**
+Flag matches against the error classification flag from the request context.
+
+**Field: `messagePattern` (`string`)**
+MessagePattern is a regex pattern to match against the response body.
+
+**Field: `bodyField` (`string`)**
+BodyField is a JSON path (gjson syntax) to extract a value from the response body.
+
+**Field: `bodyValue` (`string`)**
+BodyValue is the expected value at BodyField for the match to succeed.
+
+### **ErrorOverride**
+
+ErrorOverride combines an optional matcher with its response.
+
+**Field: `match` ([ErrorMatcher](#errormatcher))**
+Match contains optional additional matching criteria.
+
+**Field: `response` ([ErrorResponse](#errorresponse))**
+Response defines the response to return when matched.
+
+### **ErrorResponse**
+
+ErrorResponse defines the override response for error overrides.
+
+**Field: `statusCode` (`int`)**
+StatusCode is the HTTP status code to return.
+
+**Field: `body` (`string`)**
+Body is the HTTP response body (literal or inline template).
+
+**Field: `message` (`string`)**
+Message is the semantic error message passed to templates as `{{.Message}}`.
+
+**Field: `template` (`string`)**
+Template references an error template file in the templates/ directory.
+
+**Field: `headers` (`map[string]string`)**
+Headers are HTTP headers to include in the response.
+
+### **ExternalOAuth**
+
+ExternalOAuth holds configuration for an external OAuth provider.
+Deprecated: ExternalOAuth support was deprecated in Tyk 5.7.0.
+To avoid any disruptions, we recommend that you use JSON Web Token (JWT) instead,
+as explained in https://tyk.io/docs/basic-config-and-security/security/authentication-authorization/ext-oauth-middleware/.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates external oauth functionality.
+
+
+Tyk classic API definition: `external_oauth.enabled`.
+
+**Field: `providers` ([[]OAuthProvider](#oauthprovider))**
+Providers is used to configure OAuth providers.
+
+
+Tyk classic API definition: `external_oauth.providers`.
+
+### **ExtractCredentialsFromBody**
+
+ExtractCredentialsFromBody configures extracting credentials from the request body.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates extracting credentials from body.
+
+Tyk classic API definition: `basic_auth.extract_from_body`.
+
+**Field: `userRegexp` (`string`)**
+UserRegexp is the regex for username e.g. `<User>(.*)</User>`.
+
+Tyk classic API definition: `basic_auth.userRegexp`.
+
+**Field: `passwordRegexp` (`string`)**
+PasswordRegexp is the regex for password e.g. `<Password>(.*)</Password>`.
+
+Tyk classic API definition: `basic_auth.passwordRegexp`.
+
+### **FromOASExamples**
+
+FromOASExamples configures mock responses that should be returned from OAS example responses.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates getting a mock response from OAS examples or schemas documented in OAS.
+
+**Field: `code` (`int`)**
+Code is the default HTTP response code that the gateway reads from the path responses documented in OAS.
+
+**Field: `contentType` (`string`)**
+ContentType is the default HTTP response body type that the gateway reads from the path responses documented in OAS.
+
+**Field: `exampleName` (`string`)**
+ExampleName is the default example name among multiple path response examples documented in OAS.
+
+### **Internal**
+
+Internal holds the endpoint configuration, configuring the endpoint for internal requests.
+Tyk classic API definition: `version_data.versions...extended_paths.internal[*]`.
+
+**Field: `enabled` (`boolean`)**
+Enabled if set to true makes the endpoint available only for internal requests.
+
+### **Introspection**
+
+Introspection holds configuration for OAuth token introspection.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates OAuth access token validation by introspection to a third party.
+
+
+Tyk classic API definition: `external_oauth.providers[].introspection.enabled`.
+
+**Field: `url` (`string`)**
+URL is the URL of the third party provider's introspection endpoint.
+
+
+Tyk classic API definition: `external_oauth.providers[].introspection.url`.
+
+**Field: `clientId` (`string`)**
+ClientID is the public identifier for the client, acquired from the third party.
+
+
+Tyk classic API definition: `external_oauth.providers[].introspection.client_id`.
+
+**Field: `clientSecret` (`string`)**
+ClientSecret is a secret known only to the client and the authorisation server, acquired from the third party.
+
+
+Tyk classic API definition: `external_oauth.providers[].introspection.client_secret`.
+
+**Field: `identityBaseField` (`string`)**
+IdentityBaseField is the key showing where to find the user id in the claims. If it is empty, the `sub` key is looked at.
+
+
+Tyk classic API definition: `external_oauth.providers[].introspection.identity_base_field`.
+
+**Field: `cache` ([IntrospectionCache](#introspectioncache))**
+Cache is the caching mechanism for introspection responses.
+
+
+Tyk classic API definition: `external_oauth.providers[].introspection.cache`.
+
+### **IntrospectionCache**
+
+IntrospectionCache holds configuration for caching introspection requests.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the caching mechanism for introspection responses.
+
+
+Tyk classic API definition: `external_oauth.providers[].introspection.cache.enabled`.
+
+**Field: `timeout` (`int64`)**
+Timeout is the duration in seconds of how long the cached value stays.
+For introspection caching, it is suggested to use a short interval.
+
+
+Tyk classic API definition: `external_oauth.providers[].introspection.cache.timeout`.
+
+### **JTIValidation**
+
+JTIValidation contains the configuration for the validation of the JWT ID.
+
+**Field: `enabled` (`boolean`)**
+Enabled indicates whether JWT ID claim is required.
+When true, tokens must include a 'jti' claim.
+
+### **JWK**
+
+JWK represents a JSON Web Key Set containing configuration for the JWKS endpoint and its cache timeout.
+
+**Field: `url` (`string`)**
+URL is the JWKS endpoint.
+
+**Field: `cacheTimeout` (`string`)**
+CacheTimeout defines how long the JWKS will be kept in the cache before forcing a refresh from the JWKS endpoint.
+
+### **JWT**
+
+JWT holds the configuration for the JWT middleware.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the basic authentication mode.
+
+
+Tyk classic API definition: `enable_jwt`.
+
+**Field: `source` (`string`)**
+Source contains the source for the JWT.
+
+
+Tyk classic API definition: `jwt_source`.
+
+**Field: `jwksURIs` ([[]JWK](#jwk))**
+JwksURIs contains a list of JSON Web Key Sets (JWKS) endpoints from which Tyk will retrieve JWKS to validate JSON Web Tokens (JWTs).
+
+**Field: `signingMethod` (`string`)**
+SigningMethod contains the signing method to use for the JWT.
+
+
+Tyk classic API definition: `jwt_signing_method`.
+
+**Field: `identityBaseField` (`string`)**
+IdentityBaseField specifies the claim name uniquely identifying the subject of the JWT.
+The identity fields that are checked in order are: `kid`, IdentityBaseField, `sub`.
+
+
+Tyk classic API definition: `jwt_identity_base_field`.
+
+**Field: `subjectClaims` (`[]string`)**
+SubjectClaims specifies a list of claims that can be used to identity the subject of the JWT.
+
+**Field: `skipKid` (`boolean`)**
+SkipKid controls skipping using the `kid` claim from a JWT (default behaviour).
+When this is true, the field configured in IdentityBaseField is checked first.
+
+
+Tyk classic API definition: `jwt_skip_kid`.
+
+**Field: `policyFieldName` (`string`)**
+PolicyFieldName is a configurable claim name from which a policy ID is extracted.
+The policy is applied to the session as a base policy.
+
+
+Tyk classic API definition: `jwt_policy_field_name`.
+
+**Field: `basePolicyClaims` (`[]string`)**
+BasePolicyClaims specifies a list of claims from which the base PolicyID is extracted.
+The policy is applied to the session as a base policy.
+
+**Field: `clientBaseField` (`string`)**
+ClientBaseField is used when PolicyFieldName is not provided. It will get
+a session key and use the policies from that. The field ensures that requests
+use the same session.
+
+
+Tyk classic API definition: `jwt_client_base_field`.
+
+**Field: `scopes` ([Scopes](#scopes))**
+Scopes holds the scope to policy mappings for a claim name.
+
+**Field: `defaultPolicies` (`[]string`)**
+DefaultPolicies is a list of policy IDs that apply to the session.
+
+
+Tyk classic API definition: `jwt_default_policies`.
+
+**Field: `issuedAtValidationSkew` (`uint64`)**
+IssuedAtValidationSkew contains the duration in seconds for which token issuance can predate the current time during the request.
+
+
+Tyk classic API definition: `jwt_issued_at_validation_skew`.
+
+**Field: `notBeforeValidationSkew` (`uint64`)**
+NotBeforeValidationSkew contains the duration in seconds for which token validity can predate the current time during the request.
+
+
+Tyk classic API definition: `jwt_not_before_validation_skew`.
+
+**Field: `expiresAtValidationSkew` (`uint64`)**
+ExpiresAtValidationSkew contains the duration in seconds for which the token can be expired before we consider it expired.
+
+
+Tyk classic API definition: `jwt_expires_at_validation_skew`.
+
+**Field: `allowedIssuers` (`[]string`)**
+AllowedIssuers contains a list of accepted issuers for JWT validation.
+When configured, the JWT's issuer claim must match one of these values.
+
+**Field: `allowedAudiences` (`[]string`)**
+AllowedAudiences contains a list of accepted audiences for JWT validation.
+When configured, the JWT's audience claim must match one of these values.
+
+**Field: `jtiValidation` ([JTIValidation](#jtivalidation))**
+JTIValidation contains the configuration for the validation of the JWT ID.
+
+**Field: `allowedSubjects` (`[]string`)**
+AllowedSubjects contains a list of accepted subjects for JWT validation.
+When configured, the subject from kid/identityBaseField/sub must match one of these values.
+
+**Field: `idpClientIdMappingDisabled` (`boolean`)**
+IDPClientIDMappingDisabled prevents Tyk from automatically detecting the use of certain IDPs based on standard claims
+that they include in the JWT: `client_id`, `cid`, `clientId`. Setting this flag to `true` disables the mapping and avoids
+accidentally misidentifying the use of one of these IDPs if one of their standard values is configured in your JWT.
+
+
+Tyk classic API definition: `idp_client_id_mapping_disabled`.
+
+**Field: `customClaimValidation` (`map[string]CustomClaimValidationConfig`)**
+CustomClaimValidation contains custom validation rules for JWT claims.
+It maps a claim name (including nested claims using dot notation) to its validation configuration.
+
+The validation can be one of three types:
+- "required": claim must exist in the token (null/empty values are considered invalid)
+- "exact_match": claim must exactly equal one of the specified values (case-sensitive)
+- "contains": for strings, must contain one of the values as substring; for arrays, must contain one of the values as element
+
+Examples:
+Basic validation: `{"role": {"type": "exact_match", "allowedValues": ["admin", "user"]}}`
+Nested claim: `{"user.metadata.level": {"type": "contains", "allowedValues": ["gold", "silver"]}}`
+Multiple rules: `{"permissions": {"type": "contains", "allowedValues": ["read", "write"], "nonBlocking": true}}`
+
+Claims can be of type string, number, boolean, or array. For arrays, the contains validation
+checks if any of the array elements exactly match any of the allowed values.
+
+### **JWTValidation**
+
+JWTValidation holds configuration for validating access tokens by inspecing them
+against a third party API, usually one provided by the IDP.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates OAuth access token validation.
+
+
+Tyk classic API definition: `external_oauth.providers[].jwt.enabled`.
+
+**Field: `signingMethod` (`string`)**
+SigningMethod to verify signing method used in jwt - allowed values HMAC/RSA/ECDSA.
+
+
+Tyk classic API definition: `external_oauth.providers[].jwt.signing_method`.
+
+**Field: `source` (`string`)**
+Source is the secret to verify signature. Valid values are:
+
+- a base64 encoded static secret,
+- a valid JWK URL in plain text,
+- a valid JWK URL in base64 encoded format.
+
+
+Tyk classic API definition: `external_oauth.providers[].jwt.source`.
+
+**Field: `identityBaseField` (`string`)**
+IdentityBaseField is the identity claim name.
+
+
+Tyk classic API definition: `external_oauth.providers[].jwt.identity_base_field`.
+
+**Field: `issuedAtValidationSkew` (`uint64`)**
+IssuedAtValidationSkew is the clock skew to be considered while validating the iat claim.
+
+
+Tyk classic API definition: `external_oauth.providers[].jwt.issued_at_validation_skew`.
+
+**Field: `notBeforeValidationSkew` (`uint64`)**
+NotBeforeValidationSkew is the clock skew to be considered while validating the nbf claim.
+
+
+Tyk classic API definition: `external_oauth.providers[].jwt.not_before_validation_skew`.
+
+**Field: `expiresAtValidationSkew` (`uint64`)**
+ExpiresAtValidationSkew is the clock skew to be considered while validating the exp claim.
+
+
+Tyk classic API definition: `external_oauth.providers[].jwt.expires_at_validation_skew`.
+
+### **MCPPrimitive**
+
+MCPPrimitive holds middleware configuration for MCP primitives (tools, resources, prompts).
+It embeds Operation to reuse all standard middleware (rate limiting, transforms, caching, etc.).
+
+**Field: `security` (`[]map[string][]string`)**
+Security mirrors the OAS `security:` array shape for this primitive. Used by scope enforcement when `scopeSource` is `"operation"` or `"union"`. Each entry is an OR branch; scopes within an entry are AND-required.
+
+**Field: `scopeCheck` ([ScopeCheck](#scopecheck))**
+ScopeCheck overrides the API-level OAuth 2.0 scope enforcement for this primitive. Set `enabled: false` to exempt the primitive from scope checks.
+
+**Field: `exchange` ([OAuth2Exchange](#oauth2exchange))**
+Exchange overrides the token exchange provider's default target for this primitive. Requires token exchange configured at the API level (Enterprise Edition only).
+
+### **MockResponse**
+
+MockResponse configures the mock responses.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the mock response middleware.
+
+**Field: `code` (`int`)**
+Code is the HTTP response code that will be returned.
+
+**Field: `body` (`string`)**
+Body is the HTTP response body that will be returned.
+
+**Field: `headers` ([Headers](#headers))**
+Headers are the HTTP response headers that will be returned.
+
+**Field: `fromOASExamples` ([FromOASExamples](#fromoasexamples))**
+FromOASExamples is the configuration to extract a mock response from OAS documentation.
+
+### **Notifications**
+
+Notifications holds configuration for updates to keys.
+
+**Field: `sharedSecret` (`string`)**
+SharedSecret is the shared secret used in the notification request.
+
+
+Tyk classic API definition: `notifications.shared_secret`.
+
+**Field: `onKeyChangeUrl` (`string`)**
+OnKeyChangeURL is the URL a request will be triggered against.
+
+
+Tyk classic API definition: `notifications.oauth_on_keychange_url`.
+
+### **OAuth**
+
+OAuth configures the OAuth middleware.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the OAuth middleware.
+
+
+Tyk classic API definition: `use_oauth2`.
+
+**Field: `allowedAuthorizeTypes` (`[]string`)**
+AllowedAuthorizeTypes is an array of OAuth authorization types.
+
+
+Tyk classic API definition: `oauth_meta.allowed_authorize_types`.
+
+**Field: `refreshToken` (`boolean`)**
+RefreshToken enables clients using a refresh token to get a new bearer access token.
+
+
+Tyk classic API definition: `oauth_meta.allowed_access_types` (contains REFRESH_TOKEN).
+
+**Field: `authLoginRedirect` (`string`)**
+AuthLoginRedirect configures a URL to redirect to after a successful login.
+
+
+Tyk classic API definition: `oauth_meta.auth_login_redirect`.
+
+**Field: `notifications` ([Notifications](#notifications))**
+Notifications configures a URL trigger on key changes.
+
+
+Tyk classic API definition: `notifications`.
+
+### **OAuthProvider**
+
+OAuthProvider holds the configuration for validation and introspection of OAuth tokens.
+
+**Field: `jwt` ([JWTValidation](#jwtvalidation))**
+JWT configures JWT validation.
+
+
+Tyk classic API definition: `external_oauth.providers[].jwt`.
+
+**Field: `introspection` ([Introspection](#introspection))**
+Introspection configures token introspection.
+
+
+Tyk classic API definition: `external_oauth.providers[].introspection`.
+
+### **OAuth2**
+
+OAuth2 is the container for the OAS-native OAuth 2.0 security scheme. Configured under `server.authentication.securitySchemes[name]`.
+
+**Field: `enabled` (`boolean`)**
+Enabled is the master switch for this scheme. When false the entire block is inert.
+
+**Field: `scopeCheck` ([OAuth2ScopeCheck](#oauth2scopecheck))**
+ScopeCheck enables OAS-native scope enforcement against the inbound token's claims.
+
+**Field: `protectedResourceMetadata` ([OAuth2ProtectedResourceMetadata](#oauth2protectedresourcemetadata))**
+ProtectedResourceMetadata configures the RFC 9728 PRM document served for this scheme. Supersedes the deprecated top-level `authentication.protectedResourceMetadata` block.
+
+**Field: `tokenExchange` ([OAuth2TokenExchange](#oauth2tokenexchange))**
+TokenExchange enables RFC 8693 token exchange. The inbound token is exchanged at the matched provider's IdP for a backend-scoped token before being forwarded upstream.
+
+---
+
+### **OAuth2ScopeCheck**
+
+OAuth2ScopeCheck holds scope enforcement configuration for an `oauth2` security scheme. The required scopes themselves are declared in the OAS `security:` array.
+
+**Field: `enabled` (`boolean`)**
+Enabled toggles scope enforcement for this scheme.
+
+**Field: `claimNames` (`[]string`)**
+ClaimNames is the ordered list of JWT claim names to read scopes from. Tyk reads all listed claims present on the token and merges the results. Defaults to `["scope", "scp"]` when empty.
+
+**Field: `separator` (`string`)**
+Separator splits string-valued scope claims into individual scopes. Defaults to `" "` (space, per RFC 6749 §3.3). Set to `","` for comma-separated IdPs.
+
+**Field: `scopeSource` (`string`)**
+ScopeSource selects which `security:` declarations drive enforcement: `"union"` (default — per-operation ∪ root), `"operation"` (per-operation only), or `"global"` (root only).
+
+---
+
+### **OAuth2ProtectedResourceMetadata**
+
+OAuth2ProtectedResourceMetadata configures the RFC 9728 Protected Resource Metadata document served for a per-scheme `oauth2` block. Replaces the deprecated top-level `authentication.protectedResourceMetadata`.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates PRM document publishing for this scheme.
+
+**Field: `wellKnownPath` (`string`)**
+WellKnownPath is the path at which the document is served, relative to the API listen path. Defaults to `.well-known/oauth-protected-resource`.
+
+**Field: `resource` (`string`)**
+Resource is the canonical identifier for this resource, surfaced as `resource` in the PRM document. Accepts Tyk context variables. Required for static mode.
+
+**Field: `authorizationServers` (`[]string`)**
+AuthorizationServers is the list of issuer URLs published in the PRM document.
+
+**Field: `autoDeriveScopes` (`boolean`)**
+AutoDeriveScopes unions `scopes_supported` with scopes from every `security:` array when `true` (default). Set to `false` to advertise only the `flows` scopes catalog.
+
+---
+
+### **OAuth2TokenExchange**
+
+OAuth2TokenExchange holds RFC 8693 token exchange configuration. Enterprise Edition only — OSS deployments can configure this block but exchange does not execute at runtime.
+
+**Field: `enabled` (`boolean`)**
+Enabled is the master switch for token exchange on this scheme.
+
+**Field: `providers` (`[]`[OAuth2ExchangeProvider](#oauth2exchangeprovider))**
+Providers is the list of IdP entries this scheme can exchange against. Provider selection is by inbound `iss` claim match against each provider's `issuers` list. Must not be empty when `enabled` is `true`.
+
+---
+
+### **OAuth2ExchangeProvider**
+
+OAuth2ExchangeProvider configures one IdP entry for token exchange. Provider names must be unique; issuer values must not overlap across providers.
+
+**Field: `name` (`string`)**
+Name is an operator-assigned identifier used in log output. Must be unique within `providers`.
+
+**Field: `issuers` (`[]string`)**
+Issuers is the set of inbound token `iss` values routed to this provider. Must not overlap with issuers on other providers.
+
+**Field: `tokenEndpoint` (`string`)**
+TokenEndpoint is the IdP token endpoint. Must accept `grant_type=urn:ietf:params:oauth:grant-type:token-exchange`.
+
+**Field: `clientAuth` ([OAuth2ClientAuth](#oauth2clientauth))**
+ClientAuth describes how Tyk authenticates to the token endpoint.
+
+**Field: `defaultTarget` ([OAuth2DefaultTarget](#oauth2defaulttarget))**
+DefaultTarget is the fallback audience and scopes used when the matched operation has no per-operation exchange override.
+
+**Field: `timeout` ([ReadableDuration](#readableduration))**
+Timeout caps each call to `tokenEndpoint`. Defaults to `"15s"`.
+
+**Field: `customParams` (`map[string]string`)**
+CustomParams are extra form parameters appended to the exchange request. Standard RFC 8693 keys are reserved and may not be overridden.
+
+**Field: `cache` ([OAuth2ExchangeCache](#oauth2exchangecache))**
+Cache controls Redis-backed caching of exchanged tokens for this provider.
+
+---
+
+### **OAuth2ClientAuth**
+
+OAuth2ClientAuth describes how Tyk authenticates to the IdP token endpoint.
+
+**Field: `method` (`string`)**
+Method selects the client-auth scheme: `"client_secret_basic"` (default — credentials in the `Authorization` header) or `"client_secret_post"` (credentials in the request body).
+
+**Field: `clientId` (`string`)**
+ClientID is the OAuth 2.0 client identifier Tyk presents to the IdP.
+
+**Field: `clientSecret` (`string`)**
+ClientSecret accepts `env://`, `secrets://`, `vault://`, `consul://` prefixes.
+
+---
+
+### **OAuth2DefaultTarget**
+
+OAuth2DefaultTarget is the fallback audience and scopes used when no per-operation exchange override is set.
+
+**Field: `audience` (`string`)**
+Audience is the default target audience requested for the exchanged token.
+
+**Field: `scopes` (`[]string`)**
+Scopes is the default set of scopes requested for the exchanged token.
+
+---
+
+### **OAuth2ExchangeCache**
+
+OAuth2ExchangeCache controls Redis-backed caching of exchanged tokens per provider.
+
+**Field: `enabled` (`boolean`)**
+Enabled turns on caching of exchanged tokens for this provider.
+
+**Field: `mode` (`string`)**
+Mode selects how the cache TTL is derived: `"derived"` (default — from the exchanged token's `exp` claim) or `"static"` (the fixed `timeout` value).
+
+**Field: `maxTimeout` ([ReadableDuration](#readableduration))**
+MaxTimeout caps the TTL in `"derived"` mode (for example, `"5m"`). Has no effect in `"static"` mode.
+
+**Field: `timeout` ([ReadableDuration](#readableduration))**
+Timeout is the fixed cache TTL in `"static"` mode (for example, `"2m"`).
+
+**Field: `safetyMargin` ([ReadableDuration](#readableduration))**
+SafetyMargin is subtracted from the computed TTL to avoid serving near-expired tokens. Defaults to `"30s"`.
+
+---
+
+### **OAuth2Exchange**
+
+OAuth2Exchange is the per-operation or per-MCP-primitive audience and scopes override for token exchange. Configured under `middleware.operations[id].exchange` or `middleware.mcpTools[name].exchange`.
+
+Scope resolution (most-specific wins):
+1. `enabled: true` with non-empty `scopes` — explicit per-operation list.
+2. `enabled: true` with empty `scopes` — scopes inferred from the operation's `security:` declaration (RFC 8693 §4.5.5).
+3. Provider `defaultTarget` — used when this block is absent or `enabled` is `false`.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates this per-operation override. When `false` or absent, the provider's `defaultTarget` is used.
+
+**Field: `audience` (`string`)**
+Audience is the target audience requested for this operation's exchanged token.
+
+**Field: `scopes` (`[]string`)**
+Scopes is the explicit scope list for this operation. When empty and `enabled` is `true`, scopes are inferred from the operation's `security:` declaration.
+
+---
+
+### **ScopeCheck**
+
+ScopeCheck is the per-operation or per-MCP-primitive toggle for OAuth 2.0 scope enforcement. Configured under `middleware.operations[id].scopeCheck` or `middleware.mcpTools[name].scopeCheck`.
+
+**Field: `enabled` (`boolean`)**
+Enabled enforces the operation's scope check when `true`. Set to `false` to exempt the operation from scope enforcement (for example, where scopes are enforced upstream).
+
+---
+
+### **Operation**
+
+Operation holds a request operation configuration, allowances, tranformations, caching, timeouts and validation.
+
+**Field: `allow` ([Allowance](#allowance))**
+Allow request by allowance.
+
+**Field: `block` ([Allowance](#allowance))**
+Block request by allowance.
+
+**Field: `ignoreAuthentication` ([Allowance](#allowance))**
+IgnoreAuthentication ignores authentication on request by allowance.
+
+
+Tyk classic API definition: version_data.versions..extended_paths.ignored[].
+
+**Field: `internal` ([Internal](#internal))**
+Internal makes the endpoint only respond to internal requests.
+
+**Field: `transformRequestMethod` ([TransformRequestMethod](#transformrequestmethod))**
+TransformRequestMethod allows you to transform the method of a request.
+
+**Field: `transformRequestBody` ([TransformBody](#transformbody))**
+TransformRequestBody allows you to transform request body.
+When both `path` and `body` are provided, body would take precedence.
+
+**Field: `transformResponseBody` ([TransformBody](#transformbody))**
+TransformResponseBody allows you to transform response body.
+When both `path` and `body` are provided, body would take precedence.
+
+**Field: `transformRequestHeaders` ([TransformHeaders](#transformheaders))**
+TransformRequestHeaders allows you to transform request headers.
+
+**Field: `transformResponseHeaders` ([TransformHeaders](#transformheaders))**
+TransformResponseHeaders allows you to transform response headers.
+
+**Field: `urlRewrite` ([URLRewrite](#urlrewrite))**
+URLRewrite contains the URL rewriting configuration.
+
+**Field: `cache` ([CachePlugin](#cacheplugin))**
+Cache contains the caching plugin configuration.
+
+**Field: `enforceTimeout` ([EnforceTimeout](#enforcetimeout))**
+EnforceTimeout contains the request timeout configuration.
+
+**Field: `validateRequest` ([ValidateRequest](#validaterequest))**
+ValidateRequest contains the request validation configuration.
+
+**Field: `mockResponse` ([MockResponse](#mockresponse))**
+MockResponse contains the mock response configuration.
+
+**Field: `virtualEndpoint` ([VirtualEndpoint](#virtualendpoint))**
+VirtualEndpoint contains virtual endpoint configuration.
+
+**Field: `postPlugins` ([EndpointPostPlugins](#endpointpostplugins))**
+PostPlugins contains endpoint level post plugins configuration.
+
+**Field: `circuitBreaker` ([CircuitBreaker](#circuitbreaker))**
+CircuitBreaker contains the configuration for the circuit breaker functionality.
+
+**Field: `trackEndpoint` ([TrackEndpoint](#trackendpoint))**
+TrackEndpoint contains the configuration for enabling analytics and logs.
+
+**Field: `doNotTrackEndpoint` ([TrackEndpoint](#trackendpoint))**
+DoNotTrackEndpoint contains the configuration for disabling analytics and logs.
+
+**Field: `requestSizeLimit` ([RequestSizeLimit](#requestsizelimit))**
+RequestSizeLimit limits the maximum allowed size of the request body in bytes.
+
+**Field: `rateLimit` ([RateLimitEndpoint](#ratelimitendpoint))**
+RateLimit contains endpoint level rate limit configuration.
+
+**Field: `scopeCheck` ([ScopeCheck](#scopecheck))**
+ScopeCheck overrides the API-level OAuth 2.0 scope enforcement for this operation. Set `enabled: false` to exempt the operation from scope checks.
+
+**Field: `exchange` ([OAuth2Exchange](#oauth2exchange))**
+Exchange overrides the token exchange provider's default target for this operation. Requires token exchange configured at the API level (Enterprise Edition only).
+
+### **Path**
+
+Path holds plugin configurations for HTTP method verbs.
+
+**Field: `DELETE` ([Plugins](#plugins))**
+Delete holds plugin configuration for DELETE requests.
+
+**Field: `GET` ([Plugins](#plugins))**
+Get holds plugin configuration for GET requests.
+
+**Field: `HEAD` ([Plugins](#plugins))**
+Head holds plugin configuration for HEAD requests.
+
+**Field: `OPTIONS` ([Plugins](#plugins))**
+Options holds plugin configuration for OPTIONS requests.
+
+**Field: `PATCH` ([Plugins](#plugins))**
+Patch holds plugin configuration for PATCH requests.
+
+**Field: `POST` ([Plugins](#plugins))**
+Post holds plugin configuration for POST requests.
+
+**Field: `PUT` ([Plugins](#plugins))**
+Put holds plugin configuration for PUT requests.
+
+**Field: `TRACE` ([Plugins](#plugins))**
+Trace holds plugin configuration for TRACE requests.
+
+**Field: `CONNECT` ([Plugins](#plugins))**
+Connect holds plugin configuration for CONNECT requests.
+
+### **Paths**
+
+Paths is a mapping of API endpoints to Path plugin configurations. This field is part of the [Middleware](#middleware) structure.
+The string keys in this object represent URL path patterns (e.g. `/users`, `/users/{id}`, `/api/*`) that match API endpoints.
+
+Type defined as object of `Path` values, see [Path](#path) definition.
+
+### **Plugins**
+
+Plugins configures common settings for each plugin, allowances, transforms, caching and timeouts.
+
+**Field: `allow` ([Allowance](#allowance))**
+Allow request by allowance.
+
+**Field: `block` ([Allowance](#allowance))**
+Block request by allowance.
+
+**Field: `ignoreAuthentication` ([Allowance](#allowance))**
+IgnoreAuthentication ignores authentication on request by allowance.
+
+
+Tyk classic API definition: version_data.versions..extended_paths.ignored[].
+
+**Field: `transformRequestMethod` ([TransformRequestMethod](#transformrequestmethod))**
+TransformRequestMethod allows you to transform the method of a request.
+
+**Field: `cache` ([CachePlugin](#cacheplugin))**
+Cache allows you to cache the server side response.
+
+**Field: `enforcedTimeout` ([EnforceTimeout](#enforcetimeout))**
+EnforceTimeout allows you to configure a request timeout.
+
+### **RateLimitEndpoint**
+
+RateLimitEndpoint carries same settings as RateLimit but for endpoints.
+
+Type defined as `RateLimit`, see [RateLimit](#ratelimit) definition.
+
+### **RequestSizeLimit**
+
+RequestSizeLimit limits the maximum allowed size of the request body in bytes.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the Request Size Limit functionality.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.size_limits[].disabled` (negated).
+
+**Field: `value` (`int64`)**
+Value is the maximum allowed size of the request body in bytes.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.size_limits[].size_limit`.
+
+### **SecurityScheme**
+
+SecurityScheme defines an Importer interface for security schemes.
+
+### **Signature**
+
+Signature holds the configuration for signature validation.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates signature validation.
+
+
+Tyk classic API definition: `auth_configs[X].validate_signature`.
+
+**Field: `algorithm` (`string`)**
+Algorithm is the signature method to use.
+
+
+Tyk classic API definition: `auth_configs[X].signature.algorithm`.
+
+**Field: `header` (`string`)**
+Header is the name of the header to consume.
+
+
+Tyk classic API definition: `auth_configs[X].signature.header`.
+
+**Field: `query` ([AuthSource](#authsource))**
+Query is the name of the query parameter to consume.
+
+
+Tyk classic API definition: `auth_configs[X].signature.use_param/param_name`.
+
+**Field: `secret` (`string`)**
+Secret is the signing secret used for signature validation.
+
+
+Tyk classic API definition: `auth_configs[X].signature.secret`.
+
+**Field: `allowedClockSkew` (`int64`)**
+AllowedClockSkew configures a grace period in seconds during which an expired token is still valid.
+
+
+Tyk classic API definition: `auth_configs[X].signature.allowed_clock_skew`.
+
+**Field: `errorCode` (`int`)**
+ErrorCode configures the HTTP response code for a validation failure.
+If unconfigured, a HTTP 401 Unauthorized status code will be emitted.
+
+
+Tyk classic API definition: `auth_configs[X].signature.error_code`.
+
+**Field: `errorMessage` (`string`)**
+ErrorMessage configures the error message that is emitted on validation failure.
+A default error message is emitted if unset.
+
+
+Tyk classic API definition: `auth_configs[X].signature.error_message`.
+
+### **Token**
+
+Token holds the values related to authentication tokens.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates the token based authentication mode.
+
+
+Tyk classic API definition: `auth_configs["authToken"].use_standard_auth`.
+
+**Field: `enableClientCertificate` (`boolean`)**
+EnableClientCertificate allows to create dynamic keys based on certificates.
+
+
+Tyk classic API definition: `auth_configs["authToken"].use_certificate`.
+
+**Field: `signatureValidation` ([Signature](#signature))**
+Signature holds the configuration for verifying the signature of the token.
+
+
+Tyk classic API definition: `auth_configs["authToken"].use_certificate`.
+
+### **TrackEndpoint**
+
+TrackEndpoint configures Track or DoNotTrack behaviour for an endpoint.
+Tyk classic API definition: `version_data.versions..extended_paths.track_endpoints`, `version_data.versions..extended_paths.do_not_track_endpoints`.
+
+**Field: `enabled` (`boolean`)**
+Enabled if set to true enables or disables tracking for an endpoint depending
+if it's used in `trackEndpoint` or `doNotTrackEndpoint`.
+
+### **TransformBody**
+
+TransformBody holds configuration about request/response body transformations.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates transform request/request body middleware.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.transform[].disabled` (negated).
+
+**Field: `format` (`string`)**
+Format of the request/response body, xml or json.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.transform[].template_data.input_type`.
+
+**Field: `path` (`string`)**
+Path file path for the template.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.transform[].template_data.template_source` when `template_data.template_mode` is `file`.
+
+**Field: `body` (`string`)**
+Body base64 encoded representation of the template.
+
+
+Tyk classic API definition: `version_data.versions..extended_paths.transform[].template_data.template_source` when `template_data.template_mode` is `blob`.
+
+### **TransformRequestMethod**
+
+TransformRequestMethod holds configuration for rewriting request methods.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates Method Transform for the given path and method.
+
+**Field: `toMethod` (`string`)**
+ToMethod is the http method value to which the method of an incoming request will be transformed.
+
+### **URLRewrite**
+
+URLRewrite configures URL rewriting.
+Tyk classic API definition: `version_data.versions..extended_paths.url_rewrite`.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates URL rewriting if set to true.
+
+**Field: `pattern` (`string`)**
+Pattern is the regular expression against which the request URL is compared for the primary rewrite check.
+If this matches the defined pattern, the primary URL rewrite is triggered.
+
+**Field: `rewriteTo` (`string`)**
+RewriteTo specifies the URL to which the request shall be rewritten if the primary URL rewrite is triggered.
+
+**Field: `triggers` ([[]*URLRewriteTrigger](#urlrewritetrigger))**
+Triggers contain advanced additional triggers for the URL rewrite.
+The triggers are processed only if the requested URL matches the pattern above.
+
+### **URLRewriteCondition**
+
+URLRewriteCondition defines the matching mode for an URL rewrite rules.
+Tyk classic API definition: Matching condition in `version_data.versions..extended_paths.url_rewrite[].triggers[].on`.
+
+- Value `any` means any of the defined trigger rules may match.
+- Value `all` means all the defined trigger rules must match.
+
+### **URLRewriteInput**
+
+URLRewriteInput defines the input for an URL rewrite rule.
+Tyk classic API definition: Input source for URL rewrite rules in `version_data.versions..extended_paths.url_rewrite[].triggers[].options`.
+
+The following values are valid:
+
+- `url`, match pattern against URL
+- `query`, match pattern against named query parameter value
+- `path`, match pattern against named path parameter value
+- `header`, match pattern against named header value
+- `sessionMetadata`, match pattern against session metadata
+- `requestBody`, match pattern against request body
+- `requestContext`, match pattern against request context
+
+The default `url` is used as the input source.
+
+### **URLRewriteRule**
+
+URLRewriteRule represents a rewrite matching rules.
+Tyk classic API definition: `version_data.versions..extended_paths.url_rewrite[].triggers[].options`.
+
+**Field: `in` ([URLRewriteInput](#urlrewriteinput))**
+In specifies one of the valid inputs for URL rewriting.
+
+**Field: `name` (`string`)**
+Name is the index in the value declared inside `in`.
+
+Example: for `in=query`, `name=q`, the parameter `q` would
+be read from the request query parameters.
+
+The value of name is unused when `in` is set to `requestBody`,
+as the request body is a single value and not a set of values.
+
+**Field: `pattern` (`string`)**
+Pattern is the regular expression against which the `in` values are compared for this rule check.
+If the value matches the defined `pattern`, the URL rewrite is triggered for this rule.
+
+**Field: `negate` (`boolean`)**
+Negate is a boolean negation operator. Setting it to true inverts the matching behaviour
+such that the rewrite will be triggered if the value does not match the `pattern` for this rule.
+
+### **URLRewriteTrigger**
+
+URLRewriteTrigger represents a set of matching rules for a rewrite.
+Tyk classic API definition: `version_data.versions..extended_paths.url_rewrite[].triggers`.
+
+**Field: `condition` ([URLRewriteCondition](#urlrewritecondition))**
+Condition indicates the logical combination that will be applied to the rules for an advanced trigger.
+
+**Field: `rules` ([[]*URLRewriteRule](#urlrewriterule))**
+Rules contain individual checks that are combined according to the
+`condition` to determine if the URL rewrite will be triggered.
+If empty, the trigger is ignored.
+
+**Field: `rewriteTo` (`string`)**
+RewriteTo specifies the URL to which the request shall be rewritten
+if indicated by the combination of `condition` and `rules`.
+
+### **ValidateRequest**
+
+ValidateRequest holds configuration required for validating requests.
+
+**Field: `enabled` (`boolean`)**
+Enabled is a boolean flag, if set to `true`, it enables request validation.
+
+**Field: `errorResponseCode` (`int`)**
+ErrorResponseCode is the error code emitted when the request fails validation.
+If unset or zero, the response will returned with http status 422 Unprocessable Entity.
+
+### **VirtualEndpoint**
+
+VirtualEndpoint contains virtual endpoint configuration.
+
+**Field: `enabled` (`boolean`)**
+Enabled activates virtual endpoint.
+
+
+Tyk classic API definition: `virtual.disabled` (negated).
+
+**Field: `name` (`string`)**
+Name is the name of plugin function to be executed.
+Deprecated: Use FunctionName instead.
+
+**Field: `functionName` (`string`)**
+FunctionName is the name of plugin function to be executed.
+
+
+Tyk classic API definition: `virtual.response_function_name`.
+
+**Field: `path` (`string`)**
+Path is the path to JS file.
+
+
+Tyk classic API definition: `virtual.function_source_uri` when `virtual.function_source_type` is `file`.
+
+**Field: `body` (`string`)**
+Body is the JS function to execute encoded in base64 format.
+
+
+Tyk classic API definition: `virtual.function_source_uri` when `virtual.function_source_type` is `blob`.
+
+**Field: `proxyOnError` (`boolean`)**
+ProxyOnError proxies if virtual endpoint errors out.
+
+
+Tyk classic API definition: `virtual.proxy_on_error`.
+
+**Field: `requireSession` (`boolean`)**
+RequireSession if enabled passes session to virtual endpoint.
+
+
+Tyk classic API definition: `virtual.use_session`.
+
+### **XTykStreaming**
+
+XTykStreaming represents the structure for Tyk streaming configurations.
+
+**Field: `streams` (`any`)**
+Streams contains the configurations related to Tyk Streams.
+
diff --git a/structured-data.js b/structured-data.js
new file mode 100644
index 0000000000..66eea29bbc
--- /dev/null
+++ b/structured-data.js
@@ -0,0 +1,113 @@
+(function() {
+  // Helper function to get meta content
+  function getMetaContent(name) {
+    const meta = document.querySelector(`meta[name="${name}"], meta[property="${name}"]`);
+    return meta ? meta.getAttribute('content') : '';
+  }
+
+  // Helper function to get page summary
+  function getPageSummary() {
+    const description = getMetaContent('description') || getMetaContent('og:description');
+    if (description) return description;
+    
+    // Fallback: get first paragraph text from content area
+    const firstP = document.querySelector('.mdx-content p, #content-area p, [id*="content"] p');
+    return firstP ? firstP.textContent.substring(0, 160) + '...' : '';
+  }
+
+  // Helper function to extract tags/keywords
+  function getKeywords() {
+    const keywords = getMetaContent('keywords');
+    if (keywords) {
+      return keywords.split(',').map(k => k.trim()).filter(k => k);
+    }
+    
+    // Try to extract from page title or content for basic keywords
+    const title = document.title.toLowerCase();
+    const basicKeywords = [];
+    
+    // Add some common Tyk-related keywords based on title
+    if (title.includes('api')) basicKeywords.push('API');
+    if (title.includes('gateway')) basicKeywords.push('API Gateway');
+    if (title.includes('dashboard')) basicKeywords.push('Dashboard');
+    if (title.includes('tyk')) basicKeywords.push('Tyk');
+    if (title.includes('documentation')) basicKeywords.push('Documentation');
+    
+    return basicKeywords;
+  }
+
+  // Helper function to get dates
+  function getPublishDate() {
+    const datePublished = getMetaContent('article:published_time');
+    if (datePublished) {
+      return new Date(datePublished).toISOString().split('T')[0];
+    }
+    // Default to a reasonable date for documentation
+    return '2024-01-01';
+  }
+
+  function getModifiedDate() {
+    const dateModified = getMetaContent('article:modified_time');
+    if (dateModified) {
+      return new Date(dateModified).toISOString().split('T')[0];
+    }
+    // Use current date as modified date
+    return new Date().toISOString().split('T')[0];
+  }
+
+  // Wait for DOM to be ready
+  function initStructuredData() {
+    // Build structured data object
+    const structuredData = {
+      "@context": "https://schema.org",
+      "@type": "WebPage",
+      "mainEntityOfPage": {
+        "@type": "WebPage",
+        "@id": window.location.origin
+      },
+      "name": document.title,
+      "headline": document.title,
+      "description": getPageSummary(),
+      "inLanguage": "en-US",
+      "author": {
+        "@type": "Organization",
+        "name": "Tyk"
+      },
+      "copyrightHolder": {
+        "@type": "Organization",
+        "name": "Tyk"
+      },
+      "url": window.location.href,
+      "keywords": getKeywords(),
+      "datePublished": getPublishDate(),
+      "dateModified": getModifiedDate()
+    };
+
+    // Remove empty keywords array if no keywords found
+    if (structuredData.keywords.length === 0) {
+      delete structuredData.keywords;
+    }
+
+    // Check if structured data already exists to avoid duplicates
+    const existingScript = document.querySelector('script[type="application/ld+json"]');
+    if (existingScript) {
+      return; // Don't add duplicate structured data
+    }
+
+    // Inject structured data into head
+    const script = document.createElement('script');
+    script.type = 'application/ld+json';
+    script.textContent = JSON.stringify(structuredData, null, 2);
+    document.head.appendChild(script);
+
+    // Debug log (remove in production)
+    console.log('Tyk Docs: Structured data added', structuredData);
+  }
+
+  // Initialize when DOM is ready
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', initStructuredData);
+  } else {
+    initStructuredData();
+  }
+})();
diff --git a/style.css b/style.css
new file mode 100644
index 0000000000..a01ea5944d
--- /dev/null
+++ b/style.css
@@ -0,0 +1,771 @@
+li[id="topbar-cta-button"]>a>div>span {
+    color: #000 !important;
+}
+
+li[id="topbar-cta-button"]>a>div>svg>path {
+    stroke: #000 !important;
+}
+
+.dark li[id="topbar-cta-button"]>a>div>span {
+    color: #000 !important;
+}
+
+/* Target the background span directly */
+#topbar-cta-button span[class*="bg-primary-dark"] {
+    background-color: #20EDBA !important;
+    /* Green */
+    border: 1.2px solid black !important;
+    /* Black border */
+}
+
+#topbar-cta-button:hover span[class*="bg-primary-dark"] {
+    background-color: #20EDBA !important;
+    /* Darker green on hover */
+    border: 1.2px solid black !important;
+    /* Black border on hover */
+}
+
+
+/* ---------- typography helpers with dark mode support ---------- */
+.home-section-heading {
+    color: #03031C;
+    /* $brand-black */
+    font-family: "Inter", sans-serif;
+    font-size: 20px;
+    font-weight: 700;
+    line-height: 28px;
+}
+
+.dark .home-section-heading {
+    color: #ffffff;
+    /* White text in dark mode */
+}
+
+.fs-18 {
+    font-size: 18px;
+}
+
+.fs-16 {
+    font-size: 16px;
+}
+
+.fs-xs {
+    font-size: 14px;
+}
+
+.font-400 {
+    font-weight: 400;
+}
+
+.text-sec {
+    color: var(--text-subdued, #515071);
+}
+
+.dark .text-sec {
+    color: #FFF;
+    /* Light gray text in dark mode */
+}
+
+/* ---------- layout helpers ---------- */
+.home-section {
+    margin-top: 40px;
+}
+
+/* keeps the “1 % inline padding” behaviour ≥ 992 px */
+@media (min-width: 992px) {
+    .section-padding {
+        padding-inline: 1%;
+    }
+}
+
+/* centres imgs exactly like .image-container in Bootstrap */
+.image-container {
+    display: flex;
+    justify-content: center;
+}
+
+.parent-container {
+    display: flex;
+    flex-direction: column;
+    justify-content: space-between;
+    height: 100%;
+}
+
+/* ---------- CTA button style with dark mode support ---------- */
+.sec-btn {
+    display: inline-block;
+    border-radius: 20px;
+    border: 1.2px solid #03031C;
+    background: #ffffff;
+    padding: 8px 24px;
+    color: #03031C;
+    font-size: 14px;
+    font-weight: 500;
+    line-height: 20px;
+    text-decoration: none;
+    transition: all 0.2s ease;
+}
+
+.sec-btn:hover {
+    background: #E5E5E8;
+}
+
+.dark .sec-btn {
+    background: transparent;
+    color: #ffffff;
+    border: 1.2px solid #ffffff;
+}
+
+.dark .sec-btn:hover {
+    background: rgba(107, 114, 128, 0.1);
+    border-color: #ffffff;
+}
+
+.stack-heading {
+    color: var(--action-primary-default, var(--primary-primary-50, #8438FA));
+    font-size: 14px;
+    font-style: normal;
+    font-weight: 600;
+    line-height: 20px;
+    /* 142.857% */
+}
+
+.fs-xs {
+    font-size: 14px;
+}
+
+.lh-20 {
+    line-height: 20px;
+}
+
+.banner {
+    background-size: auto;
+    background-repeat: no-repeat;
+    background-position: right;
+    margin-left: 36px;
+    margin-right: 36px;
+
+}
+
+.home-container {
+    padding-top: 10px;
+}
+
+.home-bottom {
+    margin-bottom: 70px;
+}
+
+.feature-grid {
+    display: grid;
+    grid-template-columns: 1fr;
+    gap: 16px;
+    margin-bottom: 2rem;
+}
+
+@media (min-width: 576px) {
+    .feature-grid {
+        grid-template-columns: repeat(2, 1fr);
+    }
+}
+
+@media (min-width: 992px) {
+    .feature-grid {
+        grid-template-columns: repeat(4, 1fr);
+    }
+}
+
+.feature-item {
+    background-color: #ffffff;
+    border-radius: 8px;
+    padding: 16px;
+    height: 100%;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    text-align: center;
+    box-shadow: 0 2px 12px rgba(0, 0, 0, 0.1);
+}
+
+.feature-icon {
+    font-size: 3.5rem;
+    margin-bottom: 16px;
+}
+
+.feature-title {
+    font-size: 1.4rem;
+    margin-bottom: 12px;
+    color: #333;
+}
+
+.feature-description {
+    color: #666;
+    flex-grow: 1;
+}
+
+.feature-button {
+    margin-top: 16px;
+}
+
+.feature-button a {
+    display: inline-block;
+    background-color: #00AEF0;
+    color: white;
+    padding: 8px 16px;
+    border-radius: 4px;
+    text-decoration: none;
+}
+
+/* Button styles from Hugo theme */
+.button {
+    display: inline-block;
+    padding: 12px 24px;
+    border: none;
+    border-radius: 6px;
+    text-decoration: none;
+    font-weight: 500;
+    font-size: 16px;
+    transition: background-color 0.3s ease;
+    cursor: pointer;
+}
+
+.button.center {
+    display: inline-block;
+}
+
+.button.button-green {
+    background-color: #20EDBA;
+    color: white;
+}
+
+.button.button-green:hover {
+    background-color: #20EDBA;
+}
+
+.button.button-red {
+    background-color: #dc3545;
+    color: white;
+}
+
+.button.button-red:hover {
+    background-color: #c82333;
+}
+
+.button.button-black {
+    background-color: #343a40;
+    color: white;
+}
+
+.button.button-black:hover {
+    background-color: #23272b;
+}
+
+/* Grid styles for Hugo grid shortcode */
+.grid-container {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
+    gap: 1.5rem;
+    margin: 2rem 0;
+}
+
+@media (min-width: 768px) {
+    .grid-container {
+        grid-template-columns: repeat(3, 1fr);
+    }
+}
+
+@media (max-width: 767px) {
+    .grid-container {
+        grid-template-columns: 1fr;
+    }
+}
+
+/* Badge styles - Card style badges for your BadgeCard component */
+.badge {
+    display: block;
+    background-color: #ffffff;
+    border-radius: 8px;
+    padding: 1rem;
+    text-decoration: none;
+    color: inherit;
+    box-shadow: 0 2px 12px rgba(0, 0, 0, 0.1);
+    transition: transform 0.2s ease, box-shadow 0.2s ease;
+    margin-bottom: 1rem;
+}
+
+.badge:hover {
+    transform: translateY(-2px);
+    box-shadow: 0 4px 20px rgba(0, 0, 0, 0.15);
+    text-decoration: none;
+    color: inherit;
+}
+
+.badge.with_image {
+    text-align: center;
+}
+
+.badge .nav {
+    font-size: 0.875rem;
+    margin-bottom: 0.5rem;
+}
+
+.badge .nav.read {
+    color: #666;
+    text-transform: uppercase;
+    font-weight: 500;
+    letter-spacing: 0.5px;
+}
+
+.badge .nav.title {
+    font-size: 1.25rem;
+    font-weight: 600;
+    color: #333;
+    margin-bottom: 1rem;
+}
+
+.badge p {
+    margin-bottom: 1rem;
+    color: #666;
+}
+
+.badge p img {
+    max-width: 100%;
+    height: auto;
+    border-radius: 4px;
+    margin-bottom: 0.5rem;
+}
+
+.badge .bottom {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-top: 1rem;
+    padding-top: 1rem;
+    border-top: 1px solid #e5e7eb;
+}
+
+.badge .bottom .read {
+    font-size: 0.875rem;
+    color: #666;
+    text-transform: uppercase;
+    font-weight: 500;
+    letter-spacing: 0.5px;
+}
+
+/* Simple badge styles for inline use */
+.simple-badge {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.25rem;
+    font-weight: 500;
+    text-decoration: none;
+    border-radius: 6px;
+    transition: all 0.2s ease;
+    white-space: nowrap;
+}
+
+.simple-badge-small {
+    padding: 0.25rem 0.5rem;
+    font-size: 0.75rem;
+}
+
+.simple-badge-medium {
+    padding: 0.375rem 0.75rem;
+    font-size: 0.875rem;
+}
+
+.simple-badge-large {
+    padding: 0.5rem 1rem;
+    font-size: 1rem;
+}
+
+.simple-badge-default {
+    background-color: #e5e7eb;
+    color: #374151;
+}
+
+.simple-badge-default:hover {
+    background-color: #d1d5db;
+}
+
+.simple-badge-primary {
+    background-color: #00AEF0;
+    color: white;
+}
+
+.simple-badge-primary:hover {
+    background-color: #0090c4;
+}
+
+.simple-badge-success {
+    background-color: #20EDBA;
+    color: white;
+}
+
+.simple-badge-success:hover {
+    background-color: #1bc7a1;
+}
+
+.badge-next {
+    background-color: #00AEF0;
+    color: white;
+    padding: 0.5rem 1rem;
+    margin-top: 1rem;
+    display: inline-flex;
+    align-items: center;
+    gap: 0.5rem;
+}
+
+.badge-next:hover {
+    background-color: #0090c4;
+    color: white;
+}
+
+.badge-icon {
+    display: inline-flex;
+    align-items: center;
+}
+
+.badge-icon img,
+.badge-icon object {
+    width: 16px;
+    height: 16px;
+    vertical-align: middle;
+}
+
+/* ResponsiveGrid component styles */
+.responsive-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+    gap: 1.5rem;
+    margin: 1rem 0;
+    max-width: 1200px;
+    column-gap: 1.5rem;
+    /* Keep horizontal spacing */
+    row-gap: 0.5rem;
+    justify-items: start;
+    /* Align items to the left when there's only one */
+}
+
+/* Responsive breakpoints for grid */
+@media (max-width: 768px) {
+    .responsive-grid {
+        grid-template-columns: 1fr;
+        gap: 0.5rem;
+    }
+}
+
+/* ONLY constrain cards INSIDE ResponsiveGrid - not global cards */
+.responsive-grid .card {
+    max-width: 300px !important;
+    min-width: 200px !important;
+    min-height: 160px !important;
+    width: 100% !important;
+    margin: 5px 0 !important;
+    /* Changed from auto to 0 to align left */
+}
+
+/* ONLY constrain images INSIDE ResponsiveGrid cards */
+.responsive-grid .card img {
+    max-height: 100px !important;
+    max-width: 100px !important;
+    object-fit: scale-down !important;
+    margin: 0 auto !important;
+    display: block !important;
+}
+
+/* Hover effects ONLY for ResponsiveGrid cards */
+.responsive-grid .card:hover {
+    transform: translateY(-2px);
+    box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
+    transition: all 0.2s ease;
+}
+
+/* ---------- Dark mode improvements for homepage cards ---------- */
+/* Override Tailwind's border-gray-300 in dark mode for better contrast */
+.dark .border-gray-300 {
+    border-color: #4c5a6b !important;
+    /* Strong blue-gray border */
+}
+
+/* Add subtle background to cards in dark mode for better definition */
+.dark .grid .border-gray-300 {
+    background-color: rgba(44, 52, 71, 0.4) !important;
+    /* Deep navy background */
+    border-color: #4c5a6b !important;
+    /* Strong blue-gray border for cards */
+    border-width: 1.5px !important;
+    /* Slightly thicker border */
+}
+
+/* Improve hover effects for cards in dark mode */
+.dark .grid .border-gray-300:hover {
+    background-color: rgba(54, 63, 85, 0.5) !important;
+    border-color: #5d6b7d !important;
+    transform: translateY(-2px);
+    transition: all 0.2s ease;
+}
+
+/* Ensure banner border looks good in dark mode */
+.dark .banner.border-gray-300 {
+    border-color: #4c5a6b !important;
+    background-color: rgba(44, 52, 71, 0.3) !important;
+}
+
+/* ---------- Dark mode improvements for stack boxes ---------- */
+/* Style the stack boxes in the "Explore by Tyk Stack" section */
+.dark .stack-box {
+    background-color: rgba(44, 52, 71, 0.4) !important;
+    border-color: #4c5a6b !important;
+    border-width: 1.5px !important;
+}
+
+.dark .stack-box:hover {
+    background-color: rgba(54, 63, 85, 0.5) !important;
+    border-color: #5d6b7d !important;
+}
+
+/* Ensure stack headings are properly styled in dark mode */
+.dark .stack-heading {
+    color: #ffffff !important;
+    /* White text instead of purple */
+}
+
+/* Style any other border-gray-300 elements that might be stack boxes */
+.dark .border.border-gray-300.rounded-md {
+    background-color: rgba(44, 52, 71, 0.4) !important;
+    border-color: #4c5a6b !important;
+    border-width: 1.5px !important;
+}
+
+.dark .border.border-gray-300.rounded-md:hover {
+    background-color: rgba(54, 63, 85, 0.5) !important;
+    border-color: #5d6b7d !important;
+}
+
+/* ---------- Dark mode link colors for "Most viewed" section only ---------- */
+/* Target only the text-primary links in the "Most viewed" section */
+.dark .text-primary.fs-xs {
+    color: #20EDBA !important;
+    /* Tyk green color */
+}
+
+.dark .text-primary.fs-xs:hover {
+    color: #1bc7a1 !important;
+    /* Slightly darker green on hover */
+    text-decoration: underline;
+}
+
+/* More specific targeting for all text-primary links in grid layouts */
+.dark .grid a.text-primary {
+    color: #20EDBA !important;
+}
+
+.dark .grid a.text-primary:hover {
+    color: #1bc7a1 !important;
+}
+
+/* ---------- Refined Professional Dark Mode for Tyk Stack Section ---------- */
+/* Enhanced styling to match the sophisticated reference design */
+
+.dark .grid-cols-2>div,
+.dark .grid>div[class*="border"],
+.dark .grid>div[class*="rounded"] {
+    background: #1e293b !important;
+    /* Deeper, more sophisticated dark background */
+    border: 1px solid #334155 !important;
+    /* Refined subtle border */
+    border-radius: 16px !important;
+    /* More generous rounded corners */
+    padding: 24px !important;
+    /* Increased padding for better spacing */
+    transition: all 0.3s cubic-bezier(0.4, 0, 0.2, 1) !important;
+    /* Smoother easing */
+    box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15), 0 2px 4px rgba(0, 0, 0, 0.1) !important;
+    /* Layered shadows */
+    position: relative !important;
+    overflow: hidden !important;
+}
+
+.dark .grid-cols-2>div:hover,
+.dark .grid>div[class*="border"]:hover,
+.dark .grid>div[class*="rounded"]:hover {
+    background: #334155 !important;
+    /* Refined hover background */
+    border-color: #475569 !important;
+    /* Subtle border color change */
+    transform: translateY(-4px) !important;
+    /* More pronounced lift effect */
+    box-shadow: 0 12px 24px rgba(0, 0, 0, 0.25), 0 4px 8px rgba(0, 0, 0, 0.15) !important;
+    /* Enhanced shadow */
+}
+
+/* Enhanced typography for better hierarchy and readability - matching reference design */
+.dark .grid-cols-2 h3,
+.dark .grid>div h3,
+.dark .grid-cols-2 .stack-heading,
+.dark .grid>div .stack-heading,
+.dark .grid-cols-2>div h3,
+.dark .grid>div[class*="border"] h3,
+.dark .grid>div[class*="rounded"] h3 {
+    color: #ffffff !important;
+    /* Pure white titles like reference */
+    font-weight: 600 !important;
+    /* Medium weight for clean look */
+    font-size: 16px !important;
+    /* Consistent with reference */
+    line-height: 1.3 !important;
+    /* Tight line height */
+    margin-bottom: 6px !important;
+    /* Compact spacing */
+    letter-spacing: 0 !important;
+    /* No letter spacing */
+}
+
+.dark .grid-cols-2 p,
+.dark .grid>div p,
+.dark .grid-cols-2 .text-sec,
+.dark .grid>div .text-sec,
+.dark .grid-cols-2>div p,
+.dark .grid>div[class*="border"] p,
+.dark .grid>div[class*="rounded"] p,
+.dark .grid-cols-2>div .text-sec,
+.dark .grid>div[class*="border"] .text-sec,
+.dark .grid>div[class*="rounded"] .text-sec {
+    color: #9ca3af !important;
+    /* Light gray descriptions matching reference */
+    font-size: 13px !important;
+    /* Slightly smaller for hierarchy */
+    line-height: 1.4 !important;
+    /* Readable line height */
+    margin-top: 2px !important;
+    /* Tight spacing */
+    font-weight: 400 !important;
+    /* Normal weight */
+}
+
+/* Additional specific targeting for all text elements in stack cards */
+.dark .grid-cols-2>div *,
+.dark .grid>div[class*="border"] *,
+.dark .grid>div[class*="rounded"] * {
+    color: inherit !important;
+    /* Inherit from parent */
+}
+
+/* Ensure titles are always white */
+.dark .grid-cols-2>div h1,
+.dark .grid-cols-2>div h2,
+.dark .grid-cols-2>div h3,
+.dark .grid-cols-2>div h4,
+.dark .grid-cols-2>div h5,
+.dark .grid-cols-2>div h6,
+.dark .grid>div[class*="border"] h1,
+.dark .grid>div[class*="border"] h2,
+.dark .grid>div[class*="border"] h3,
+.dark .grid>div[class*="border"] h4,
+.dark .grid>div[class*="border"] h5,
+.dark .grid>div[class*="border"] h6,
+.dark .grid>div[class*="rounded"] h1,
+.dark .grid>div[class*="rounded"] h2,
+.dark .grid>div[class*="rounded"] h3,
+.dark .grid>div[class*="rounded"] h4,
+.dark .grid>div[class*="rounded"] h5,
+.dark .grid>div[class*="rounded"] h6 {
+    color: #ffffff !important;
+    /* White titles */
+    font-weight: 600 !important;
+}
+
+/* Ensure descriptions are light gray */
+.dark .grid-cols-2>div span,
+.dark .grid-cols-2>div div:not([class*="flex"]):not([class*="grid"]),
+.dark .grid>div[class*="border"] span,
+.dark .grid>div[class*="border"] div:not([class*="flex"]):not([class*="grid"]),
+.dark .grid>div[class*="rounded"] span,
+.dark .grid>div[class*="rounded"] div:not([class*="flex"]):not([class*="grid"]) {
+    color: #9ca3af !important;
+    /* Light gray for descriptions */
+}
+
+/* Enhanced icon styling for better integration */
+.dark .grid-cols-2 img,
+.dark .grid>div img {
+    filter: brightness(1.2) contrast(1.1) !important;
+    /* Enhanced icon visibility */
+    width: 48px !important;
+    /* Consistent icon size */
+    height: 48px !important;
+    /* Consistent icon size */
+    margin-bottom: 16px !important;
+    /* Better spacing below icons */
+    border-radius: 8px !important;
+    /* Subtle rounding for icons */
+    transition: transform 0.2s ease !important;
+    /* Smooth icon transitions */
+}
+
+/* Add proper spacing between icon and text content in stack cards */
+.stack-text-container {
+    margin-left: 16px !important;
+    /* Add spacing between icon and text for both light and dark mode */
+}
+
+/* ---------- Dark mode styling for card headings in "Try it out" section ---------- */
+.dark .grid-cols-2>div:hover img,
+.dark .grid>div[class*="border"]:hover img,
+.dark .grid>div[class*="rounded"]:hover img {
+    transform: scale(1.05) !important;
+    /* Subtle icon scale on hover */
+}
+
+/* Improved grid layout and spacing */
+.dark .grid-cols-2,
+.dark .grid {
+    gap: 20px !important;
+    /* Refined gap between cards */
+    margin-top: 24px !important;
+    /* Better section spacing */
+}
+
+/* Enhanced responsive behavior */
+@media (max-width: 768px) {
+
+    .dark .grid-cols-2>div,
+    .dark .grid>div[class*="border"],
+    .dark .grid>div[class*="rounded"] {
+        padding: 20px !important;
+        /* Adjusted padding for mobile */
+        margin-bottom: 16px !important;
+        /* Better mobile spacing */
+    }
+
+    .dark .grid-cols-2 h3,
+    .dark .grid>div h3,
+    .dark .grid-cols-2 .stack-heading,
+    .dark .grid>div .stack-heading {
+        font-size: 16px !important;
+        /* Responsive font sizing */
+    }
+}
+
+/* Subtle background pattern for added sophistication */
+.dark .grid-cols-2>div::before,
+.dark .grid>div[class*="border"]::before,
+.dark .grid>div[class*="rounded"]::before {
+    content: '' !important;
+    position: absolute !important;
+    top: 0 !important;
+    left: 0 !important;
+    right: 0 !important;
+    bottom: 0 !important;
+    background: linear-gradient(135deg, rgba(255, 255, 255, 0.02) 0%, rgba(255, 255, 255, 0) 50%) !important;
+    pointer-events: none !important;
+    border-radius: inherit !important;
+}
+
+/* Enhanced focus states for accessibility */
+.dark .grid-cols-2>div:focus,
+.dark .grid>div[class*="border"]:focus,
+.dark .grid>div[class*="rounded"]:focus {
+    outline: 2px solid #3b82f6 !important;
+    outline-offset: 2px !important;
+}
\ No newline at end of file
diff --git a/swagger/ai-studio-swagger.yml b/swagger/ai-studio-swagger.yml
new file mode 100644
index 0000000000..f39f2a616a
--- /dev/null
+++ b/swagger/ai-studio-swagger.yml
@@ -0,0 +1,16666 @@
+openapi: 3.0.1
+info:
+  title: Midsommar API
+  description: This is the API for the Midsommar user and group management system.
+  termsOfService: http://swagger.io/terms/
+  contact:
+    name: API Support
+    url: http://www.swagger.io/support
+    email: support@swagger.io
+  license:
+    name: Apache 2.0
+    url: http://www.apache.org/licenses/LICENSE-2.0.html
+  version: "1.0"
+servers:
+- url: //localhost:8080/api/v1
+paths:
+  /.well-known/oauth-authorization-server:
+    get:
+      tags:
+      - oauth
+      summary: OAuth Authorization Server Metadata
+      description: Provides metadata about the OAuth authorization server.
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.OAuthServerMetadata'
+  /analytics/app-interactions-over-time:
+    get:
+      tags:
+      - Analytics
+      summary: Get app interactions over time
+      description: Get the number of LLM interactions for a specific app over time
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: app_id
+        in: query
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/budget-usage:
+    get:
+      tags:
+      - Analytics
+      summary: Get current monthly budget usage for apps and LLMs
+      description: "Returns usage of monthly budgets for apps and LLMs, with optional\
+        \ date range for total cost"
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD) for total cost calculation
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD) for total cost calculation
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/models.BudgetUsage'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/budget-usage-for-app:
+    get:
+      tags:
+      - Analytics
+      summary: Get budget usage for a specific app
+      description: Get the current budget usage for a specific app
+      parameters:
+      - name: app_id
+        in: query
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.AppBudgetUsageResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/chat-interactions-for-chat:
+    get:
+      tags:
+      - Analytics
+      summary: Get chat interactions for a specific chat
+      description: Get the number of interactions for a specific chat over time
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: chat_id
+        in: query
+        description: Chat ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/chat-records-per-day:
+    get:
+      tags:
+      - Analytics
+      summary: Get chat records per day
+      description: Get the total number of chat records per day for a given time period
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/chat-records-per-user:
+    get:
+      tags:
+      - Analytics
+      summary: Get chat records per user
+      description: Get the total number of chat records per user for a given time
+        period
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/cost-analysis:
+    get:
+      tags:
+      - Analytics
+      summary: Get cost analysis
+      description: Get the total cost per day for a given time period
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/model-usage:
+    get:
+      tags:
+      - Analytics
+      summary: Get usage statistics for a specific model
+      description: Get the usage statistics for a specific model over time
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: model_name
+        in: query
+        description: Model Name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/most-used-llm-models:
+    get:
+      tags:
+      - Analytics
+      summary: Get most used LLM models
+      description: Get the usage count for each LLM model
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/proxy-logs-for-app:
+    get:
+      tags:
+      - Analytics
+      summary: Get proxy logs for a specific app
+      description: Get paginated proxy logs for a specific app
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: app_id
+        in: query
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      - name: page
+        in: query
+        description: "Page number (default: 1)"
+        schema:
+          type: integer
+      - name: page_size
+        in: query
+        description: "Page size (default: 10)"
+        schema:
+          type: integer
+      - name: search
+        in: query
+        description: Search term for request/response body
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.PaginatedProxyLogs'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/proxy-logs-for-llm:
+    get:
+      tags:
+      - Analytics
+      summary: Get proxy logs for a specific LLM
+      description: Get paginated proxy logs for a specific LLM by joining with chat
+        records
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: llm_id
+        in: query
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      - name: page
+        in: query
+        description: "Page number (default: 1)"
+        schema:
+          type: integer
+      - name: page_size
+        in: query
+        description: "Page size (default: 10)"
+        schema:
+          type: integer
+      - name: search
+        in: query
+        description: Search term (searches request and response bodies)
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.PaginatedProxyLogs'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/token-usage-and-cost-for-app:
+    get:
+      tags:
+      - Analytics
+      summary: Get token usage and cost for a specific app
+      description: Get the token usage and total cost for a specific app over time
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: app_id
+        in: query
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.MultiAxisChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/token-usage-for-app:
+    get:
+      tags:
+      - Analytics
+      summary: Get token usage for a specific app
+      description: Get the token usage for a specific app over time
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: app_id
+        in: query
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/token-usage-per-app:
+    get:
+      tags:
+      - Analytics
+      summary: Get token usage per app
+      description: Get the total token usage for each app
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/token-usage-per-user:
+    get:
+      tags:
+      - Analytics
+      summary: Get token usage per user
+      description: Get the total token usage for each user
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/tool-calls-per-day:
+    get:
+      tags:
+      - Analytics
+      summary: Get tool calls per day
+      description: Get the total number of tool calls per day for a given time period
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/tool-operations-usage-over-time:
+    get:
+      tags:
+      - Analytics
+      summary: Get tool operations usage over time for a specific tool
+      description: Get the usage count for each operation of a specific tool over
+        time
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: tool_id
+        in: query
+        description: Tool ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.MultiAxisChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/tool-usage-statistics:
+    get:
+      tags:
+      - Analytics
+      summary: Get tool usage statistics
+      description: Get the usage count for each tool
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/total-cost-per-vendor-and-model:
+    get:
+      tags:
+      - Analytics
+      summary: Get total cost per vendor and model
+      description: "Get the total cost per vendor and model for a given time period,\
+        \ including currency"
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/models.VendorModelCost'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/unique-users-per-day:
+    get:
+      tags:
+      - Analytics
+      summary: Get unique users per day
+      description: Get the number of unique users per day
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/usage:
+    get:
+      tags:
+      - Analytics
+      summary: Get token usage and cost data with flexible filtering
+      description: "Get token usage and cost data filtered by vendor, LLM ID, app\
+        \ ID, and interaction type"
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: vendor
+        in: query
+        description: Vendor name to filter by
+        schema:
+          type: string
+      - name: llm_id
+        in: query
+        description: LLM ID to filter by
+        schema:
+          type: integer
+      - name: app_id
+        in: query
+        description: App ID to filter by
+        schema:
+          type: integer
+      - name: interaction_type
+        in: query
+        description: Interaction type to filter by (chat/proxy)
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.MultiAxisChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /analytics/vendor-usage:
+    get:
+      tags:
+      - Analytics
+      summary: Get usage statistics for a specific vendor
+      description: Get the usage statistics for a specific vendor over time
+      parameters:
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: vendor
+        in: query
+        description: Vendor Name
+        required: true
+        schema:
+          type: string
+      - name: llm_id
+        in: query
+        description: LLM ID to filter by
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /api/sso:
+    post:
+      tags:
+      - auth
+      summary: Create a nonce token for SSO authentication
+      description: Create a nonce token that can be used for SSO authentication
+      requestBody:
+        description: Nonce token request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/sso.NonceTokenRequest'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/sso.NonceTokenResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: request
+  /api/v1/branding/favicon:
+    get:
+      tags:
+      - branding
+      summary: Get custom favicon
+      description: Serve the custom favicon file (public endpoint)
+      responses:
+        "200":
+          description: OK
+          content:
+            image/x-icon:
+              schema:
+                type: string
+                format: binary
+            image/png:
+              schema:
+                type: string
+                format: binary
+        "404":
+          description: Not Found
+          content:
+            image/x-icon:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            image/png:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            image/x-icon:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            image/png:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    post:
+      tags:
+      - branding
+      summary: Upload favicon
+      description: "Upload a custom favicon (admin only, ICO/PNG, max 100KB)"
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              required:
+              - file
+              type: object
+              properties:
+                file:
+                  type: string
+                  description: Favicon file
+                  format: binary
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.BrandingSettingsResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/branding/logo:
+    get:
+      tags:
+      - branding
+      summary: Get custom logo
+      description: Serve the custom logo file (public endpoint)
+      responses:
+        "200":
+          description: OK
+          content:
+            image/png:
+              schema:
+                type: string
+                format: binary
+            image/jpeg:
+              schema:
+                type: string
+                format: binary
+            image/svg+xml:
+              schema:
+                type: string
+                format: binary
+        "404":
+          description: Not Found
+          content:
+            image/png:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            image/jpeg:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            image/svg+xml:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            image/png:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            image/jpeg:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            image/svg+xml:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    post:
+      tags:
+      - branding
+      summary: Upload logo
+      description: "Upload a custom logo (admin only, PNG/JPG/SVG, max 2MB)"
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              required:
+              - file
+              type: object
+              properties:
+                file:
+                  type: string
+                  description: Logo file
+                  format: binary
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.BrandingSettingsResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/branding/reset:
+    post:
+      tags:
+      - branding
+      summary: Reset branding to defaults
+      description: Reset all branding settings to default values (admin only)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.BrandingSettingsResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/branding/settings:
+    get:
+      tags:
+      - branding
+      summary: Get branding settings
+      description: Get current branding settings (public endpoint for frontend config)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.BrandingSettingsResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    put:
+      tags:
+      - branding
+      summary: Update branding settings
+      description: Update branding settings (admin only)
+      requestBody:
+        description: Branding settings
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.UpdateBrandingSettingsRequest'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.BrandingSettingsResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: settings
+  /api/v1/catalogues:
+    get:
+      tags:
+      - catalogues
+      summary: List catalogues
+      description: Get all LLM catalogues (Enterprise Edition only)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - catalogues
+      summary: Create a new catalogue (Community Edition)
+      description: Create a new LLM catalogue (Enterprise Edition only)
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/catalogues/{id}:
+    get:
+      tags:
+      - catalogues
+      summary: Get catalogue by ID
+      description: Get details of a specific LLM catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - catalogues
+      summary: Delete catalogue
+      description: Delete a specific LLM catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - catalogues
+      summary: Update catalogue
+      description: Update an existing LLM catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/catalogues/{id}/llms:
+    get:
+      tags:
+      - catalogues
+      summary: List catalogue LLMs
+      description: Get all LLMs in a specific catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - catalogues
+      summary: Add LLM to catalogue
+      description: Add an LLM to a specific catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/catalogues/{id}/llms/{llmId}:
+    delete:
+      tags:
+      - catalogues
+      summary: Remove LLM from catalogue
+      description: Remove an LLM from a specific catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: llmId
+        in: path
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/catalogues/search:
+    get:
+      tags:
+      - catalogues
+      summary: Search catalogues
+      description: Search LLM catalogues (Enterprise Edition only)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/catalogues/search-by-name:
+    get:
+      tags:
+      - catalogues
+      summary: Search catalogues by name (Community Edition)
+      description: Search LLM catalogues by name prefix (Enterprise Edition only)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/data-catalogues:
+    get:
+      tags:
+      - data-catalogues
+      summary: List data catalogues
+      description: Get all data catalogues (Enterprise Edition only)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - data-catalogues
+      summary: Create a new data catalogue (Community Edition)
+      description: Create a new data catalogue (Enterprise Edition only)
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/data-catalogues/{id}:
+    get:
+      tags:
+      - data-catalogues
+      summary: Get data catalogue by ID
+      description: Get details of a specific data catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - data-catalogues
+      summary: Delete data catalogue
+      description: Delete a specific data catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - data-catalogues
+      summary: Update data catalogue
+      description: Update an existing data catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/data-catalogues/{id}/datasources:
+    post:
+      tags:
+      - data-catalogues
+      summary: Add datasource to data catalogue
+      description: Add a datasource to a specific data catalogue (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/data-catalogues/{id}/datasources/{datasourceId}:
+    delete:
+      tags:
+      - data-catalogues
+      summary: Remove datasource from data catalogue
+      description: Remove a datasource from a specific data catalogue (Enterprise
+        Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: datasourceId
+        in: path
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/data-catalogues/{id}/tags:
+    post:
+      tags:
+      - data-catalogues
+      summary: Add tag to data catalogue
+      description: Add a tag to a specific data catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/data-catalogues/{id}/tags/{tagId}:
+    delete:
+      tags:
+      - data-catalogues
+      summary: Remove tag from data catalogue
+      description: Remove a tag from a specific data catalogue (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: tagId
+        in: path
+        description: Tag ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/data-catalogues/by-datasource/{datasourceId}:
+    get:
+      tags:
+      - data-catalogues
+      summary: Get data catalogues by datasource (Community Edition)
+      description: Get all data catalogues containing a specific datasource (Enterprise
+        Edition only)
+      parameters:
+      - name: datasourceId
+        in: path
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/data-catalogues/by-tag/{tagName}:
+    get:
+      tags:
+      - data-catalogues
+      summary: Get data catalogues by tag (Community Edition)
+      description: Get all data catalogues with a specific tag (Enterprise Edition
+        only)
+      parameters:
+      - name: tagName
+        in: path
+        description: Tag name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/data-catalogues/search:
+    get:
+      tags:
+      - data-catalogues
+      summary: Search data catalogues (Community Edition)
+      description: Search data catalogues (Enterprise Edition only)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/edges:
+    get:
+      tags:
+      - edges
+      summary: List edge instances
+      description: Get a list of registered edge instances with optional namespace
+        filtering
+      parameters:
+      - name: namespace
+        in: query
+        description: Filter by namespace
+        schema:
+          type: string
+      - name: status
+        in: query
+        description: "Filter by status (registered, connected, disconnected, unhealthy)"
+        schema:
+          type: string
+      - name: page
+        in: query
+        description: Page number
+        schema:
+          type: integer
+          default: 1
+      - name: limit
+        in: query
+        description: Items per page
+        schema:
+          type: integer
+          default: 20
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.EdgeListResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/edges/{edge_id}:
+    get:
+      tags:
+      - edges
+      summary: Get edge instance by ID
+      description: Get details of a specific edge instance
+      parameters:
+      - name: edge_id
+        in: path
+        description: Edge ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.EdgeResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - edges
+      summary: Delete edge instance
+      description: Remove an edge instance registration
+      parameters:
+      - name: edge_id
+        in: path
+        description: Edge ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/edges/{edge_id}/reload:
+    post:
+      tags:
+      - edges
+      summary: Trigger edge reload
+      description: Trigger a configuration reload on a specific edge instance
+      parameters:
+      - name: edge_id
+        in: path
+        description: Edge ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "202":
+          description: Accepted
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SuccessResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/edges/reload-all:
+    post:
+      tags:
+      - edges
+      summary: Reload all edge gateways
+      description: Trigger a configuration reload for all edge gateways across all
+        namespaces
+      responses:
+        "202":
+          description: Accepted
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/edges/reload-operations:
+    get:
+      tags:
+      - edges
+      summary: Get edge reload operations
+      description: Get list of active reload operations
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties: {}
+      security:
+      - BearerAuth: []
+  /api/v1/groups:
+    get:
+      tags:
+      - groups
+      summary: List groups
+      description: "Get all groups (CE: Returns Default group only)"
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - groups
+      summary: Create a new group (Community Edition)
+      description: Create a new group (Enterprise Edition only)
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/groups/{id}:
+    get:
+      tags:
+      - groups
+      summary: Get group by ID
+      description: "Get details of a specific group (CE: Returns Default group only)"
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - groups
+      summary: Delete group
+      description: Delete a specific group (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - groups
+      summary: Update group
+      description: Update an existing group (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/groups/{id}/catalogues:
+    get:
+      tags:
+      - groups
+      summary: List group LLM catalogues
+      description: Get all LLM catalogues for a specific group (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - groups
+      summary: Update group catalogues (Community Edition)
+      description: "Bulk update all catalogues (LLM, data, tool) for a group (Enterprise\
+        \ Edition only)"
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - groups
+      summary: Add LLM catalogue to group
+      description: Add an LLM catalogue to a specific group (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/groups/{id}/catalogues/{catalogueId}:
+    delete:
+      tags:
+      - groups
+      summary: Remove LLM catalogue from group
+      description: Remove an LLM catalogue from a specific group (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      - name: catalogueId
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/groups/{id}/data-catalogues:
+    get:
+      tags:
+      - groups
+      summary: List group data catalogues
+      description: Get all data catalogues for a specific group (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - groups
+      summary: Add data catalogue to group
+      description: Add a data catalogue to a specific group (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/groups/{id}/data-catalogues/{catalogueId}:
+    delete:
+      tags:
+      - groups
+      summary: Remove data catalogue from group
+      description: Remove a data catalogue from a specific group (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      - name: catalogueId
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/groups/{id}/tool-catalogues:
+    get:
+      tags:
+      - groups
+      summary: List group tool catalogues
+      description: Get all tool catalogues for a specific group (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - groups
+      summary: Add tool catalogue to group
+      description: Add a tool catalogue to a specific group (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/groups/{id}/tool-catalogues/{catalogueId}:
+    delete:
+      tags:
+      - groups
+      summary: Remove tool catalogue from group
+      description: Remove a tool catalogue from a specific group (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      - name: catalogueId
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/groups/{id}/users:
+    get:
+      tags:
+      - groups
+      summary: List group users
+      description: Get all users in a specific group (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - groups
+      summary: Update group users (Community Edition)
+      description: Bulk update users in a specific group (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - groups
+      summary: Add user to group
+      description: Add a user to a specific group (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/groups/{id}/users/{userId}:
+    delete:
+      tags:
+      - groups
+      summary: Remove user from group
+      description: Remove a user from a specific group (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      - name: userId
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/llms/{id}/plugins:
+    get:
+      tags:
+      - llms
+      summary: Get LLM plugins
+      description: Get plugins associated with an LLM
+      parameters:
+      - name: id
+        in: path
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.PluginResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - llms
+      summary: Update LLM plugins
+      description: Update plugin associations for an LLM
+      parameters:
+      - name: id
+        in: path
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Plugin IDs in execution order
+        content:
+          application/json:
+            schema:
+              type: object
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SuccessResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: plugin_ids
+  /api/v1/llms/{id}/plugins/{pluginId}/config:
+    get:
+      tags:
+      - llms
+      summary: Get LLM plugin configuration
+      description: Get the configuration override for a specific plugin-LLM association
+      parameters:
+      - name: id
+        in: path
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      - name: pluginId
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - llms
+      summary: Update LLM plugin configuration
+      description: Update the configuration override for a specific plugin-LLM association
+      parameters:
+      - name: id
+        in: path
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      - name: pluginId
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Configuration override object
+        content:
+          application/json:
+            schema:
+              type: object
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: config
+  /api/v1/me:
+    get:
+      tags:
+      - auth
+      summary: Get current user with entitlements
+      description: Get the details of the currently logged-in user including their
+        entitlements
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.UserWithEntitlementsResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/namespaces:
+    get:
+      tags:
+      - namespaces
+      summary: List namespaces
+      description: List all namespaces (Enterprise Edition only)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/namespaces/{namespace}/edges:
+    get:
+      tags:
+      - namespaces
+      summary: Get namespace edges
+      description: Get all edges in a namespace (Enterprise Edition only)
+      parameters:
+      - name: namespace
+        in: path
+        description: Namespace name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/namespaces/{namespace}/reload:
+    post:
+      tags:
+      - namespaces
+      summary: Reload namespace
+      description: Trigger reload for all edges in a namespace (Enterprise Edition
+        only)
+      parameters:
+      - name: namespace
+        in: path
+        description: Namespace name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins:
+    get:
+      tags:
+      - plugins
+      summary: List plugins
+      description: Get a list of plugins with optional filtering
+      parameters:
+      - name: hook_type
+        in: query
+        description: "Filter by hook type (pre_auth, auth, post_auth, on_response,\
+          \ data_collection)"
+        schema:
+          type: string
+      - name: is_active
+        in: query
+        description: Filter by active status
+        schema:
+          type: boolean
+      - name: namespace
+        in: query
+        description: Filter by namespace
+        schema:
+          type: string
+      - name: page
+        in: query
+        description: Page number
+        schema:
+          type: integer
+          default: 1
+      - name: limit
+        in: query
+        description: Items per page
+        schema:
+          type: integer
+          default: 20
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.PluginListResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - plugins
+      summary: Create plugin
+      description: Create a new plugin configuration
+      requestBody:
+        description: Plugin configuration
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/services.CreatePluginRequest'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.PluginResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "409":
+          description: Conflict
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: plugin
+  /api/v1/plugins/{id}:
+    get:
+      tags:
+      - plugins
+      summary: Get plugin
+      description: Get a specific plugin by ID
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.PluginResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - plugins
+      summary: Delete plugin
+      description: Delete a plugin configuration
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - plugins
+      summary: Update plugin
+      description: Update an existing plugin configuration
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated plugin configuration
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/services.UpdatePluginRequest'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.PluginResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: plugin
+  /api/v1/plugins/{id}/approve-scopes:
+    post:
+      tags:
+      - plugins
+      - workflow
+      summary: Approve or deny plugin service scopes
+      description: Admin endpoint to approve or deny service access scopes for AI
+        Studio plugins
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Approval decision
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ApprovalRequest'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: body
+  /api/v1/plugins/{id}/data:
+    delete:
+      tags:
+      - plugins
+      summary: Clear plugin data
+      description: Delete all key-value data stored by a plugin
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content - plugin data cleared successfully
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/{id}/manifest/parse:
+    post:
+      tags:
+      - plugins
+      summary: Parse plugin manifest
+      description: Parse and register a plugin's manifest
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/{id}/refresh:
+    post:
+      tags:
+      - plugins
+      summary: Refresh OCI plugin
+      description: Refresh an OCI plugin from the registry to get the latest version
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.PluginResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/{id}/reload:
+    post:
+      tags:
+      - plugins
+      summary: Reload AI Studio plugin
+      description: Reload an AI Studio plugin and auto-fetch its manifest
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/{id}/rpc/{method}:
+    post:
+      tags:
+      - plugins
+      summary: Call plugin RPC method
+      description: Execute RPC call on loaded AI Studio plugin
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      - name: method
+        in: path
+        description: RPC method name
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: RPC payload
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: true
+        required: false
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: payload
+  /api/v1/plugins/{id}/status:
+    get:
+      tags:
+      - plugins
+      summary: Get plugin status
+      description: "Get the runtime status of a plugin (loaded, healthy, etc.)"
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/{id}/test:
+    post:
+      tags:
+      - plugins
+      summary: Test plugin
+      description: Test a plugin configuration
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Test data for plugin
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: true
+        required: false
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: test_data
+  /api/v1/plugins/{id}/ui/load:
+    post:
+      tags:
+      - plugins
+      summary: Load plugin UI
+      description: Mark a plugin's UI as loaded
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/{id}/ui/unload:
+    post:
+      tags:
+      - plugins
+      summary: Unload plugin UI
+      description: Mark a plugin's UI as unloaded
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/{id}/validate-and-load:
+    post:
+      tags:
+      - plugins
+      - workflow
+      summary: Validate plugin command and load metadata
+      description: Validates a plugin command and loads both config schema and manifest
+        in a single operation
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Request body with command (for command changes)
+        content:
+          application/json:
+            schema:
+              type: object
+        required: false
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ValidateAndLoadResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: body
+  /api/v1/plugins/{id}/workflow-status:
+    get:
+      tags:
+      - plugins
+      - workflow
+      summary: Get plugin workflow status
+      description: Get the current workflow status and approval state for a plugin
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.WorkflowStatusResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/ai-studio/manifests:
+    get:
+      tags:
+      - plugins
+      summary: Get AI Studio plugins with manifests
+      description: Get AI Studio plugins that have UI extension manifests
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/cleanup-orphaned-registry:
+    post:
+      tags:
+      - plugins
+      - maintenance
+      summary: Cleanup orphaned UI registry entries
+      description: Remove UI registry entries for plugins that no longer exist
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/loaded:
+    get:
+      tags:
+      - plugins
+      summary: List loaded plugins
+      description: Get status of all loaded AI Studio plugins
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/oci:
+    post:
+      tags:
+      - plugins
+      summary: Create plugin from OCI artifact
+      description: Create a new AI Studio plugin from an OCI artifact reference
+      requestBody:
+        description: OCI Plugin
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/services.CreateOCIPluginRequest'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.PluginResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: plugin
+  /api/v1/plugins/oci/cached:
+    get:
+      tags:
+      - plugins
+      summary: List cached OCI plugins
+      description: Get a list of all cached OCI plugins from the local cache
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/sidebar-menu:
+    get:
+      tags:
+      - plugins
+      summary: Get sidebar menu items
+      description: Get sidebar menu items contributed by plugins
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/type/{type}:
+    get:
+      tags:
+      - plugins
+      summary: Get plugins by type
+      description: Get plugins filtered by plugin type (gateway or ai_studio)
+      parameters:
+      - name: type
+        in: path
+        description: Plugin type
+        required: true
+        schema:
+          type: string
+          enum:
+          - gateway
+          - ai_studio
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/plugins/ui-registry:
+    get:
+      tags:
+      - plugins
+      summary: Get UI registry
+      description: Get all registered UI components from plugins
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/reload-operations/{operation_id}/status:
+    get:
+      tags:
+      - namespaces
+      summary: Get reload operation status
+      description: Get status of a specific reload operation
+      parameters:
+      - name: operation_id
+        in: path
+        description: Operation ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/sso-profiles:
+    get:
+      tags:
+      - sso-profiles
+      summary: List all SSO profiles
+      description: Get a list of all SSO profiles with pagination
+      parameters:
+      - name: page_size
+        in: query
+        description: Page size
+        schema:
+          type: integer
+      - name: page
+        in: query
+        description: Page number
+        schema:
+          type: integer
+      - name: all
+        in: query
+        description: Return all profiles
+        schema:
+          type: boolean
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ProfilesResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - sso-profiles
+      summary: Create a new SSO profile
+      description: Create a new SSO profile with the provided information
+      requestBody:
+        description: Profile information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ProfileInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ProfileResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: profile
+  /api/v1/sso-profiles/{id}:
+    get:
+      tags:
+      - sso-profiles
+      summary: Get an SSO profile by ID
+      description: Get details of an SSO profile by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Profile ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ProfileResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - sso-profiles
+      summary: Update an SSO profile
+      description: Update an existing SSO profile's information
+      parameters:
+      - name: id
+        in: path
+        description: Profile ID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: Updated profile information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ProfileInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ProfileResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: profile
+    delete:
+      tags:
+      - sso-profiles
+      summary: Delete an SSO profile
+      description: Delete an SSO profile by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Profile ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/sso-profiles/{profile_id}/use-in-login-page:
+    post:
+      tags:
+      - sso-profiles
+      summary: Set profile use in login page
+      description: Set a profile to be used in the login page
+      parameters:
+      - name: profile_id
+        in: path
+        description: Profile ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/sync/audit:
+    get:
+      tags:
+      - sync
+      summary: Get sync audit log
+      description: Get sync audit log entries with filtering
+      parameters:
+      - name: namespace
+        in: query
+        description: Filter by namespace
+        schema:
+          type: string
+      - name: edge_id
+        in: query
+        description: Filter by edge ID
+        schema:
+          type: string
+      - name: event_type
+        in: query
+        description: Filter by event type
+        schema:
+          type: string
+      - name: limit
+        in: query
+        description: Limit results
+        schema:
+          type: integer
+          default: 50
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+      security:
+      - BearerAuth: []
+  /api/v1/sync/status:
+    get:
+      tags:
+      - sync
+      summary: Get sync status summary
+      description: Get synchronization status for all namespaces
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+      security:
+      - BearerAuth: []
+  /api/v1/sync/status/{namespace}:
+    get:
+      tags:
+      - sync
+      summary: Get sync status for namespace
+      description: Get detailed synchronization status for a specific namespace
+      parameters:
+      - name: namespace
+        in: path
+        description: Namespace
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues:
+    get:
+      tags:
+      - tool-catalogues
+      summary: List tool catalogues
+      description: Get all tool catalogues (Enterprise Edition only)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - tool-catalogues
+      summary: Create a new tool catalogue (Community Edition)
+      description: Create a new tool catalogue (Enterprise Edition only)
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues/{catalogueId}/tools/{toolId}/apps:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Get user apps for a tool
+      description: Get all user apps that use a specific tool (Enterprise Edition
+        only)
+      parameters:
+      - name: catalogueId
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: toolId
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues/{catalogueId}/tools/{toolId}/documentation:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Get tool documentation
+      description: Get documentation for a specific tool (Enterprise Edition only)
+      parameters:
+      - name: catalogueId
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: toolId
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues/{id}:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Get tool catalogue by ID
+      description: Get details of a specific tool catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - tool-catalogues
+      summary: Delete tool catalogue
+      description: Delete a specific tool catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - tool-catalogues
+      summary: Update tool catalogue
+      description: Update an existing tool catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues/{id}/tags:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Get tool catalogue tags
+      description: Get all tags for a specific tool catalogue (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - tool-catalogues
+      summary: Add tag to tool catalogue
+      description: Add a tag to a specific tool catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues/{id}/tags/{tagId}:
+    delete:
+      tags:
+      - tool-catalogues
+      summary: Remove tag from tool catalogue
+      description: Remove a tag from a specific tool catalogue (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: tagId
+        in: path
+        description: Tag ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues/{id}/tools:
+    get:
+      tags:
+      - tool-catalogues
+      summary: List tool catalogue tools
+      description: Get all tools in a specific tool catalogue (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - tool-catalogues
+      summary: Add tool to tool catalogue
+      description: Add a tool to a specific tool catalogue (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues/{id}/tools/{toolId}:
+    delete:
+      tags:
+      - tool-catalogues
+      summary: Remove tool from tool catalogue
+      description: Remove a tool from a specific tool catalogue (Enterprise Edition
+        only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: toolId
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues/{id}/tools/secure:
+    get:
+      tags:
+      - tool-catalogues
+      summary: List tool catalogue tools (secure)
+      description: Get all tools in a specific tool catalogue with redacted sensitive
+        data (Enterprise Edition only)
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/tool-catalogues/search:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Search tool catalogues (Community Edition)
+      description: Search tool catalogues (Enterprise Edition only)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Payment Required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /api/v1/users/{userId}/groups:
+    get:
+      tags:
+      - groups
+      summary: Get user's groups
+      description: "Get all groups for a specific user (CE: Returns Default group\
+        \ only)"
+      parameters:
+      - name: userId
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /apps:
+    get:
+      tags:
+      - apps
+      summary: List all apps
+      description: "Get a list of all apps, optionally filtered by search term"
+      parameters:
+      - name: page
+        in: query
+        description: Page number
+        schema:
+          type: integer
+      - name: page_size
+        in: query
+        description: Page size
+        schema:
+          type: integer
+      - name: search
+        in: query
+        description: "Search term (searches name, description, and user)"
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.AppResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - apps
+      summary: Create a new app
+      description: Create a new app with the provided information
+      requestBody:
+        description: App information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.AppInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AppResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: app
+  /apps/{id}:
+    get:
+      tags:
+      - apps
+      summary: Get an app by ID
+      description: Get details of an app by its ID
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AppResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - apps
+      summary: Delete an app
+      description: Delete an app by its ID
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - apps
+      summary: Update an app
+      description: Update an existing app's information
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated app information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.AppInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AppResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: app
+  /apps/{id}/activate-credential:
+    post:
+      tags:
+      - apps
+      summary: Activate app credential
+      description: Activate the credential associated with an app
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /apps/{id}/deactivate-credential:
+    post:
+      tags:
+      - apps
+      summary: Deactivate app credential
+      description: Deactivate the credential associated with an app
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /apps/{id}/reset-budget:
+    post:
+      tags:
+      - apps
+      summary: Reset app budget
+      description: Reset the budget period for an app by setting start date to today
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /apps/{id}/tools:
+    get:
+      tags:
+      - apps
+      summary: Get tools for an app
+      description: Retrieve all tools associated with a specific app
+      parameters:
+      - name: app_id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AppResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /apps/{id}/tools/{tool_id}:
+    post:
+      tags:
+      - apps
+      summary: Add a tool to an app
+      description: Associate a tool with an app
+      parameters:
+      - name: app_id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      - name: tool_id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AppResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - apps
+      summary: Remove a tool from an app
+      description: Disassociate a tool from an app
+      parameters:
+      - name: app_id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      - name: tool_id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /apps/by-name:
+    get:
+      tags:
+      - apps
+      summary: Get app by name
+      description: Get details of an app by its name
+      parameters:
+      - name: name
+        in: query
+        description: App name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AppResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /apps/count:
+    get:
+      tags:
+      - apps
+      summary: Count all apps
+      description: Get the total number of apps
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties:
+                  type: integer
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /apps/search:
+    get:
+      tags:
+      - apps
+      summary: Search apps
+      description: Search for apps based on a search term
+      parameters:
+      - name: search_term
+        in: query
+        description: Search term
+        required: true
+        schema:
+          type: string
+      - name: page
+        in: query
+        description: Page number
+        schema:
+          type: integer
+      - name: page_size
+        in: query
+        description: Page size
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.AppResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /auth/{id}/{provider}:
+    get:
+      tags:
+      - auth
+      summary: Handle TIB authentication
+      description: Handle authentication through a TIB profile
+      parameters:
+      - name: id
+        in: path
+        description: Identity provider ID
+        required: true
+        schema:
+          type: string
+      - name: provider
+        in: path
+        description: Provider name
+        required: true
+        schema:
+          type: string
+      responses:
+        "302":
+          description: Redirect to the provider's authentication page
+          content:
+            application/json:
+              schema:
+                type: string
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /auth/{id}/{provider}/callback:
+    get:
+      tags:
+      - auth
+      summary: Handle the callback from an identity provider
+      description: Handle the callback from an identity provider after authentication
+      parameters:
+      - name: id
+        in: path
+        description: Identity provider ID
+        required: true
+        schema:
+          type: string
+      - name: provider
+        in: path
+        description: Provider name
+        required: true
+        schema:
+          type: string
+      responses:
+        "302":
+          description: Redirect to the dashboard or portal
+          content:
+            application/json:
+              schema:
+                type: string
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /auth/{id}/saml/metadata:
+    get:
+      tags:
+      - auth
+      summary: Handle the SAML metadata request for an identity provider
+      description: Handle the SAML metadata request for an identity provider
+      parameters:
+      - name: id
+        in: path
+        description: Identity provider ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: string
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /auth/forgot-password:
+    post:
+      tags:
+      - auth
+      summary: Forgot password
+      description: Request a password reset
+      requestBody:
+        description: User's email
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ForgotPasswordInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ForgotPasswordResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: email
+  /auth/login:
+    post:
+      tags:
+      - auth
+      summary: Login user
+      description: Authenticate a user and return a session token
+      requestBody:
+        description: Login credentials
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.LoginInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.LoginResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: user
+  /auth/logout:
+    post:
+      tags:
+      - auth
+      summary: Logout user
+      description: Log out the current user
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.LogoutResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /auth/register:
+    post:
+      tags:
+      - auth
+      summary: Register user
+      description: Register a new user
+      requestBody:
+        description: User registration details
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.RegisterInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.RegisterResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: user
+  /auth/resend-verification:
+    post:
+      tags:
+      - auth
+      summary: Resend verification email
+      description: Resend the email verification link
+      requestBody:
+        description: User's email
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ResendVerificationInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ResendVerificationResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: email
+  /auth/reset-password:
+    post:
+      tags:
+      - auth
+      summary: Reset password
+      description: Reset user's password using a token
+      requestBody:
+        description: Password reset details
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ResetPasswordInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ResetPasswordResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: reset
+  /auth/validate-reset-token:
+    get:
+      tags:
+      - auth
+      summary: Validate reset token
+      description: Validate a password reset token without attempting to reset the
+        password. Use this endpoint
+      parameters:
+      - name: token
+        in: query
+        description: Reset token
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SuccessResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /auth/verify-email:
+    get:
+      tags:
+      - auth
+      summary: Verify email
+      description: Verify user's email using a token
+      parameters:
+      - name: token
+        in: query
+        description: Verification token
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.VerifyEmailResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /catalogues:
+    get:
+      tags:
+      - catalogues
+      summary: List all catalogues
+      description: Get a list of all catalogues with their associated LLM names
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.CatalogueResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - catalogues
+      summary: Create a new catalogue
+      description: Create a new catalogue with the provided information
+      requestBody:
+        description: Catalogue information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.CatalogueInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: catalogue
+  /catalogues/{id}:
+    get:
+      tags:
+      - catalogues
+      summary: Get a catalogue by ID
+      description: Get details of a catalogue by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - catalogues
+      summary: Delete a catalogue
+      description: Delete a catalogue by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - catalogues
+      summary: Update a catalogue
+      description: Update an existing catalogue's information
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated catalogue information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.CatalogueInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: catalogue
+  /catalogues/{id}/llms:
+    get:
+      tags:
+      - catalogues
+      summary: List LLMs in a catalogue
+      description: Get a list of all LLMs in a specific catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - catalogues
+      summary: Add an LLM to a catalogue
+      description: Add an LLM to a specific catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: LLM to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.CatalogueLLMInput'
+        required: true
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: llm
+  /catalogues/{id}/llms/{llmId}:
+    delete:
+      tags:
+      - catalogues
+      summary: Remove an LLM from a catalogue
+      description: Remove an LLM from a specific catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: llmId
+        in: path
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /catalogues/search:
+    get:
+      tags:
+      - catalogues
+      summary: Search catalogues by name
+      description: Search for catalogues using a name stub
+      parameters:
+      - name: name
+        in: query
+        description: Name stub to search for
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.CatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /catalogues/search-by-stub:
+    get:
+      tags:
+      - catalogues
+      summary: Search catalogues by name stub
+      description: Search for catalogues using a name stub
+      parameters:
+      - name: stub
+        in: query
+        description: Name stub to search for
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.CatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /chat-history-records:
+    get:
+      tags:
+      - chat-history
+      summary: List chat history records
+      description: List chat history records for a given user
+      parameters:
+      - name: user_id
+        in: query
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      - name: page
+        in: query
+        description: Page number
+        schema:
+          type: integer
+      - name: page_size
+        in: query
+        description: Page size
+        schema:
+          type: integer
+      - name: all
+        in: query
+        description: Retrieve all records
+        schema:
+          type: boolean
+      - name: search
+        in: query
+        description: Search term for conversation names
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ChatHistoryRecordListResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    post:
+      tags:
+      - chat-history
+      summary: Create a new chat history record
+      description: Create a new chat history record with the given input
+      requestBody:
+        description: Chat History Record Input
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ChatHistoryRecordInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ChatHistoryRecordResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: input
+  /chat-history-records/{id}:
+    get:
+      tags:
+      - chat-history
+      summary: Get a chat history record
+      description: Get a chat history record by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Chat History Record ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ChatHistoryRecordResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    delete:
+      tags:
+      - chat-history
+      summary: Delete a chat history record
+      description: Delete a chat history record by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Chat History Record ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/accessible-datasources:
+    get:
+      tags:
+      - common
+      summary: Get accessible data sources for the authenticated user
+      description: Get the list of data sources accessible to the authenticated user
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DatasourceResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/accessible-llms:
+    get:
+      tags:
+      - common
+      summary: Get accessible LLMs for the authenticated user
+      description: Get the list of LLMs accessible to the authenticated user
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/accessible-tools:
+    get:
+      tags:
+      - common
+      summary: Get accessible tools for the authenticated user
+      description: Get the list of tools accessible to the authenticated user based
+        on their group memberships
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ToolResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/apps:
+    get:
+      tags:
+      - common
+      summary: Get apps for the authenticated user
+      description: Get the list of apps created by the authenticated user
+      parameters:
+      - name: page
+        in: query
+        description: Page number
+        schema:
+          type: integer
+      - name: page_size
+        in: query
+        description: Page size
+        schema:
+          type: integer
+      - name: all
+        in: query
+        description: Fetch all records
+        schema:
+          type: boolean
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AppListResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    post:
+      tags:
+      - common
+      summary: Create a new app for the authenticated user
+      description: "Create a new app associated with the authenticated user, checking\
+        \ for catalogue access and privacy score compatibility"
+      requestBody:
+        description: App creation request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.CreateAppRequest'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AppResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: app
+  /common/apps/{id}:
+    get:
+      tags:
+      - common
+      summary: Get details of a specific app for the authenticated user
+      description: "Get the details of a specific app, including its credential, for\
+        \ the authenticated user"
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AppDetailResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    delete:
+      tags:
+      - common
+      summary: Delete an app owned by the authenticated user
+      description: Delete an app if it's owned by the authenticated user
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SuccessResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/apps/{id}/analytics/interactions:
+    get:
+      tags:
+      - portal-analytics
+      summary: Get app interactions analytics for portal user
+      description: Get interaction analytics for a user's app
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: string
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/analytics.ChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/apps/{id}/analytics/usage:
+    get:
+      tags:
+      - portal-analytics
+      summary: Get app usage analytics for portal user
+      description: Get token usage and cost analytics for a user's app
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: string
+      - name: start_date
+        in: query
+        description: Start date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: End date (YYYY-MM-DD)
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.MultiAxisChartData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/catalogues/{id}/llms:
+    get:
+      tags:
+      - common
+      summary: Get LLMs in a catalogue
+      description: "Get the list of LLMs in a catalogue by catalogue ID, excluding\
+        \ sensitive information"
+      parameters:
+      - name: id
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/chat-history-records/{session_id}/name:
+    put:
+      tags:
+      - chat-history
+      summary: Update the name of a chat history record
+      description: Update the name of a chat history record for the authenticated
+        user
+      parameters:
+      - name: session_id
+        in: path
+        description: Session ID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: New name for the chat history record
+        content:
+          application/json:
+            schema:
+              type: string
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SuccessResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: name
+  /common/chats/{id}/defaults:
+    get:
+      tags:
+      - common
+      summary: Get default tools and datasource for a specific chat
+      description: Get the default tools and datasource configured for a specific
+        chat with redacted sensitive information
+      parameters:
+      - name: id
+        in: path
+        description: Chat ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ChatDefaultsResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/data-catalogues/{id}/datasources:
+    get:
+      tags:
+      - common
+      summary: Get datasources in a data catalogue
+      description: "Get the list of datasources in a data catalogue by catalogue ID,\
+        \ excluding sensitive information"
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DatasourceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/sessions/{session_id}/messages:
+    get:
+      tags:
+      - common
+      summary: Get messages for a session
+      description: "Get paginated messages for a given session ID, ordered from oldest\
+        \ to newest"
+      parameters:
+      - name: session_id
+        in: path
+        description: Session ID
+        required: true
+        schema:
+          type: string
+      - name: page
+        in: query
+        description: Page number (default 1)
+        schema:
+          type: integer
+      - name: page_size
+        in: query
+        description: Page size (default 10)
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CMessageListResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/system:
+    get:
+      tags:
+      - system
+      summary: Get system feature set
+      description: Returns the current system feature set from licensing
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+  /common/tool-catalogues/{id}/tools:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Get tools in a tool catalogue (secure version for portal users)
+      description: Get all tools in a specified tool catalogue with sensitive fields
+        hidden
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /common/users/{user_id}/chat-history-records:
+    get:
+      tags:
+      - common
+      summary: Get chat history records for a user
+      description: Get the chat history records for a specific user
+      parameters:
+      - name: user_id
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ChatHistoryRecordResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /compliance/access-issues:
+    get:
+      tags:
+      - Compliance
+      summary: Get access issues
+      description: Get authentication and authorization failures
+      parameters:
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      - name: app_id
+        in: query
+        description: Filter by app ID
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/compliance.AccessIssuesData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /compliance/app/{id}/risk-profile:
+    get:
+      tags:
+      - Compliance
+      summary: Get app risk profile
+      description: Get detailed compliance profile for a single app
+      parameters:
+      - name: id
+        in: path
+        description: App ID
+        required: true
+        schema:
+          type: integer
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/compliance.AppRiskProfile'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /compliance/available:
+    get:
+      tags:
+      - Compliance
+      summary: Check if compliance features are available
+      description: Returns whether compliance monitoring is available (Enterprise
+        Edition)
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties:
+                  type: boolean
+  /compliance/budget-alerts:
+    get:
+      tags:
+      - Compliance
+      summary: Get budget alerts
+      description: Get apps/LLMs approaching or exceeding budget limits
+      parameters:
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/compliance.BudgetAlertsData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /compliance/errors:
+    get:
+      tags:
+      - Compliance
+      summary: Get compliance errors
+      description: Get error metrics by vendor
+      parameters:
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      - name: vendor
+        in: query
+        description: Filter by vendor
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/compliance.ErrorData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /compliance/events:
+    get:
+      tags:
+      - Compliance
+      summary: Get script-reported compliance events
+      description: "Get compliance events reported by filter scripts, with filtering\
+        \ and aggregation"
+      parameters:
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      - name: app_id
+        in: query
+        description: Filter by app ID
+        schema:
+          type: integer
+      - name: event_type
+        in: query
+        description: Filter by event type
+        schema:
+          type: string
+      - name: severity
+        in: query
+        description: "Filter by severity (info, warning, critical)"
+        schema:
+          type: string
+      - name: limit
+        in: query
+        description: "Maximum number of records, defaults to 100"
+        schema:
+          type: integer
+      - name: offset
+        in: query
+        description: "Pagination offset, defaults to 0"
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/compliance.ComplianceEventsData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /compliance/export:
+    get:
+      tags:
+      - Compliance
+      summary: Export compliance data
+      description: Export compliance data in CSV format
+      parameters:
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      - name: view
+        in: query
+        description: "View to export (summary, access, policy, budget, errors)"
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            text/csv:
+              schema:
+                type: string
+                format: binary
+        "400":
+          description: Bad Request
+          content:
+            text/csv:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            text/csv:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            text/csv:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /compliance/high-risk-apps:
+    get:
+      tags:
+      - Compliance
+      summary: Get high risk apps
+      description: Get apps ranked by compliance risk
+      parameters:
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      - name: limit
+        in: query
+        description: "Maximum number of apps to return, defaults to 10"
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/compliance.HighRiskApp'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /compliance/policy-violations:
+    get:
+      tags:
+      - Compliance
+      summary: Get policy violations
+      description: Get filter blocks and model access violations
+      parameters:
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      - name: app_id
+        in: query
+        description: Filter by app ID
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/compliance.PolicyViolationsData'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /compliance/summary:
+    get:
+      tags:
+      - Compliance
+      summary: Get compliance summary
+      description: Get high-level compliance metrics for the dashboard
+      parameters:
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/compliance.ComplianceSummary'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /compliance/violations:
+    get:
+      tags:
+      - Compliance
+      summary: Get individual violation records
+      description: Get individual violation records with full details for drill-down
+        view
+      parameters:
+      - name: start_date
+        in: query
+        description: "Start date (YYYY-MM-DD), defaults to 7 days ago"
+        schema:
+          type: string
+      - name: end_date
+        in: query
+        description: "End date (YYYY-MM-DD), defaults to today"
+        schema:
+          type: string
+      - name: app_id
+        in: query
+        description: Filter by app ID
+        schema:
+          type: integer
+      - name: limit
+        in: query
+        description: "Maximum number of records to return, defaults to 100"
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/compliance.ViolationRecord'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+  /credentials:
+    get:
+      tags:
+      - credentials
+      summary: List all credentials
+      description: Get a list of all credentials
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.CredentialResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - credentials
+      summary: Create a new credential
+      description: Create a new credential
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CredentialResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /credentials/{id}:
+    get:
+      tags:
+      - credentials
+      summary: Get a credential by ID
+      description: Get details of a credential by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Credential ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CredentialResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - credentials
+      summary: Delete a credential
+      description: Delete a credential by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Credential ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - credentials
+      summary: Update a credential
+      description: Update an existing credential's information
+      parameters:
+      - name: id
+        in: path
+        description: Credential ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated credential information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.CredentialInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CredentialResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: credential
+  /credentials/{id}/activate:
+    post:
+      tags:
+      - credentials
+      summary: Activate a credential
+      description: Activate a credential by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Credential ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CredentialResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /credentials/{id}/deactivate:
+    post:
+      tags:
+      - credentials
+      summary: Deactivate a credential
+      description: Deactivate a credential by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Credential ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CredentialResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /credentials/active:
+    get:
+      tags:
+      - credentials
+      summary: List active credentials
+      description: Get a list of all active credentials
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.CredentialResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /credentials/key/{keyId}:
+    get:
+      tags:
+      - credentials
+      summary: Get a credential by Key ID
+      description: Get details of a credential by its Key ID
+      parameters:
+      - name: keyId
+        in: path
+        description: Credential Key ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CredentialResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /data-catalogues:
+    get:
+      tags:
+      - data-catalogues
+      summary: List all data catalogues
+      description: Get a list of all data catalogues
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DataCatalogueResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - data-catalogues
+      summary: Create a new data catalogue
+      description: Create a new data catalogue with the provided information
+      requestBody:
+        description: Data Catalogue information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.DataCatalogueInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DataCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: dataCatalogue
+  /data-catalogues/{id}:
+    get:
+      tags:
+      - data-catalogues
+      summary: Get a data catalogue by ID
+      description: Get details of a data catalogue by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DataCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - data-catalogues
+      summary: Delete a data catalogue
+      description: Delete a data catalogue by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - data-catalogues
+      summary: Update a data catalogue
+      description: Update an existing data catalogue's information
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated data catalogue information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.DataCatalogueInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DataCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: dataCatalogue
+  /data-catalogues/{id}/datasources:
+    post:
+      tags:
+      - data-catalogues
+      summary: Add a datasource to a data catalogue
+      description: Add a datasource to a specific data catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Datasource to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.DataCatalogueDatasourceInput'
+        required: true
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: datasource
+  /data-catalogues/{id}/datasources/{datasourceId}:
+    delete:
+      tags:
+      - data-catalogues
+      summary: Remove a datasource from a data catalogue
+      description: Remove a datasource from a specific data catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: datasourceId
+        in: path
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /data-catalogues/{id}/tags:
+    post:
+      tags:
+      - data-catalogues
+      summary: Add a tag to a data catalogue
+      description: Add a tag to a specific data catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Tag to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.DataCatalogueTagInput'
+        required: true
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: tag
+  /data-catalogues/{id}/tags/{tagId}:
+    delete:
+      tags:
+      - data-catalogues
+      summary: Remove a tag from a data catalogue
+      description: Remove a tag from a specific data catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: tagId
+        in: path
+        description: Tag ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /data-catalogues/by-datasource:
+    get:
+      tags:
+      - data-catalogues
+      summary: Get data catalogues by datasource
+      description: Get a list of data catalogues associated with a specific datasource
+      parameters:
+      - name: datasourceId
+        in: query
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DataCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /data-catalogues/by-tag:
+    get:
+      tags:
+      - data-catalogues
+      summary: Get data catalogues by tag
+      description: Get a list of data catalogues associated with a specific tag
+      parameters:
+      - name: tagName
+        in: query
+        description: Tag name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DataCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /data-catalogues/search:
+    get:
+      tags:
+      - data-catalogues
+      summary: Search data catalogues
+      description: Search for data catalogues using a query string
+      parameters:
+      - name: query
+        in: query
+        description: Search query
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DataCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /datasources:
+    get:
+      tags:
+      - datasources
+      summary: List all datasources
+      description: Get a list of all datasources
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DatasourceResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - datasources
+      summary: Create a new datasource
+      description: Create a new datasource with the provided information
+      requestBody:
+        description: Datasource information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.DatasourceInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DatasourceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: datasource
+  /datasources/{id}:
+    get:
+      tags:
+      - datasources
+      summary: Get a datasource by ID
+      description: Get details of a datasource by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DatasourceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - datasources
+      summary: Delete a datasource
+      description: Delete a datasource by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - datasources
+      summary: Update a datasource
+      description: Update an existing datasource's information
+      parameters:
+      - name: id
+        in: path
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated datasource information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.DatasourceInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DatasourceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: datasource
+  /datasources/{id}/clone:
+    post:
+      tags:
+      - datasources
+      summary: Clone a datasource
+      description: Creates a copy of an existing datasource including all API keys
+        (server-side clone)
+      parameters:
+      - name: id
+        in: path
+        description: Source Datasource ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DatasourceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /datasources/{id}/filestores/{filestore_id}:
+    post:
+      tags:
+      - datasources
+      summary: Add FileStore to Datasource
+      description: Add a FileStore to a specific Datasource
+      parameters:
+      - name: id
+        in: path
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      - name: filestore_id
+        in: path
+        description: FileStore ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DatasourceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - datasources
+      summary: Remove FileStore from Datasource
+      description: Remove a FileStore from a specific Datasource
+      parameters:
+      - name: id
+        in: path
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      - name: filestore_id
+        in: path
+        description: FileStore ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DatasourceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /datasources/{id}/process-embeddings:
+    post:
+      tags:
+      - datasources
+      summary: Process file embeddings for a datasource
+      description: Process and create embeddings for all files in a datasource
+      parameters:
+      - name: id
+        in: path
+        description: Datasource ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "202":
+          description: Accepted
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SuccessResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /datasources/by-tag:
+    get:
+      tags:
+      - datasources
+      summary: Get datasources by tag
+      description: Get a list of datasources associated with a specific tag
+      parameters:
+      - name: tag
+        in: query
+        description: Tag name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DatasourceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /datasources/search:
+    get:
+      tags:
+      - datasources
+      summary: Search datasources
+      description: Search for datasources using a query string
+      parameters:
+      - name: query
+        in: query
+        description: Search query
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DatasourceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /exports:
+    post:
+      tags:
+      - Exports
+      summary: Start a proxy log export (Enterprise)
+      description: Initiates a background job to export proxy logs for an app or LLM
+      requestBody:
+        description: Export request parameters
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ExportRequest'
+        required: true
+      responses:
+        "202":
+          description: Accepted
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ProxyLogExportResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "402":
+          description: Enterprise feature required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: request
+  /exports/{id}:
+    get:
+      tags:
+      - Exports
+      summary: Get export status (Enterprise)
+      description: Retrieves the status of a proxy log export job
+      parameters:
+      - name: id
+        in: path
+        description: Export ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ProxyLogExportResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "402":
+          description: Enterprise feature required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /exports/{id}/download:
+    get:
+      tags:
+      - Exports
+      summary: Download export file (Enterprise)
+      description: Downloads the exported proxy logs JSON file
+      parameters:
+      - name: id
+        in: path
+        description: Export ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: JSON file containing proxy logs
+          content:
+            application/json:
+              schema:
+                type: string
+                format: binary
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "402":
+          description: Enterprise feature required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "403":
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "410":
+          description: Export expired
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/models.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /filestore:
+    get:
+      tags:
+      - filestore
+      summary: Get all filestore entries
+      description: Get a list of all filestore entries with pagination
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.FileStoreResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - filestore
+      summary: Create a new filestore entry
+      description: Create a new filestore entry with an uploaded file
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              required:
+              - file
+              type: object
+              properties:
+                file:
+                  type: string
+                  description: File to upload
+                  format: binary
+                description:
+                  type: string
+                  description: Description of the file
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.FileStoreResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /filestore/{id}:
+    get:
+      tags:
+      - filestore
+      summary: Get a filestore entry by ID
+      description: Get details of a filestore entry by its ID
+      parameters:
+      - name: id
+        in: path
+        description: FileStore ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.FileStoreResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - filestore
+      summary: Delete a filestore entry
+      description: Delete a filestore entry by its ID
+      parameters:
+      - name: id
+        in: path
+        description: FileStore ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - filestore
+      summary: Update a filestore entry
+      description: Update an existing filestore entry's information
+      parameters:
+      - name: id
+        in: path
+        description: FileStore ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated filestore information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.FileStoreInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.FileStoreResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: filestore
+  /filestore/search:
+    get:
+      tags:
+      - filestore
+      summary: Search filestore entries
+      description: Search for filestore entries by filename or description
+      parameters:
+      - name: query
+        in: query
+        description: Search Query
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.FileStoreResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /filters:
+    get:
+      tags:
+      - filters
+      summary: List all filters
+      description: Get a list of all filters
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.FilterResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    post:
+      tags:
+      - filters
+      summary: Create a new filter
+      description: Create a new filter with the given input data
+      requestBody:
+        description: Filter input
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.FilterInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.FilterResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: input
+  /filters/{id}:
+    get:
+      tags:
+      - filters
+      summary: Get a filter by ID
+      description: Get a filter's details by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Filter ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.FilterResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    delete:
+      tags:
+      - filters
+      summary: Delete a filter
+      description: Delete a filter by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Filter ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    patch:
+      tags:
+      - filters
+      summary: Update a filter
+      description: Update an existing filter's details
+      parameters:
+      - name: id
+        in: path
+        description: Filter ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated filter input
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.FilterInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.FilterResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: input
+  /filters/test:
+    post:
+      tags:
+      - filters
+      summary: Test a filter script
+      description: Execute a filter script with test input to validate behavior
+      requestBody:
+        description: Filter test input
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.FilterTestInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.FilterTestOutput'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: input
+  /groups:
+    get:
+      tags:
+      - groups
+      summary: List all groups
+      description: Get a list of all groups
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.GroupResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - groups
+      summary: Create a new group
+      description: Create a new group with the provided information
+      requestBody:
+        description: Group information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.GroupInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.GroupResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: group
+  /groups/{id}:
+    get:
+      tags:
+      - groups
+      summary: Get a group by ID
+      description: Get details of a group by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.GroupResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - groups
+      summary: Delete a group
+      description: Delete a group by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - groups
+      summary: Update a group
+      description: Update an existing group's information
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated group information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.GroupInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.GroupResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: group
+  /groups/{id}/catalogues:
+    get:
+      tags:
+      - groups
+      summary: List catalogues in a group
+      description: Get a list of all catalogues in a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.CatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - groups
+      summary: Update group catalogues
+      description: Update the catalogues in a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Catalogues to update
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.GroupCataloguesRequest'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: catalogues
+    post:
+      tags:
+      - groups
+      summary: Add a catalogue to a group
+      description: Add a catalogue to a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Catalogue to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.GroupCatalogueInput'
+        required: true
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: catalogue
+  /groups/{id}/catalogues/{catalogueId}:
+    delete:
+      tags:
+      - groups
+      summary: Remove a catalogue from a group
+      description: Remove a catalogue from a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      - name: catalogueId
+        in: path
+        description: Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /groups/{id}/data-catalogues:
+    get:
+      tags:
+      - groups
+      summary: List data catalogues in a group
+      description: Get a list of all data catalogues in a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.DataCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - groups
+      summary: Add a data catalogue to a group
+      description: Add a data catalogue to a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Data Catalogue to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.DataCatalogueInput'
+        required: true
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: dataCatalogue
+  /groups/{id}/data-catalogues/{dataCatalogueId}:
+    delete:
+      tags:
+      - groups
+      summary: Remove a data catalogue from a group
+      description: Remove a data catalogue from a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      - name: dataCatalogueId
+        in: path
+        description: Data Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /groups/{id}/tool-catalogues:
+    get:
+      tags:
+      - groups
+      summary: List tool catalogues in a group
+      description: Get a list of all tool catalogues in a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ToolCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - groups
+      summary: Add a tool catalogue to a group
+      description: Add a tool catalogue to a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Tool Catalogue to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.GroupToolCatalogueInput'
+        required: true
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: toolCatalogue
+  /groups/{id}/tool-catalogues/{toolCatalogueId}:
+    delete:
+      tags:
+      - groups
+      summary: Remove a tool catalogue from a group
+      description: Remove a tool catalogue from a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      - name: toolCatalogueId
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /groups/{id}/users:
+    get:
+      tags:
+      - groups
+      summary: List users in a group
+      description: Get a list of all users in a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.UserResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - groups
+      summary: Update group users
+      description: Update the users in a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Users to update
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.GroupUsersInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: users
+    post:
+      tags:
+      - groups
+      summary: Add a user to a group
+      description: Add a user to a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: User to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.UserGroupInput'
+        required: true
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: user
+  /groups/{id}/users/{userId}:
+    delete:
+      tags:
+      - groups
+      summary: Remove a user from a group
+      description: Remove a user from a specific group
+      parameters:
+      - name: id
+        in: path
+        description: Group ID
+        required: true
+        schema:
+          type: integer
+      - name: userId
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /llm-settings:
+    get:
+      tags:
+      - llm-settings
+      summary: List all LLM settings
+      description: Get a list of all LLM settings
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMSettingsResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - llm-settings
+      summary: Create new LLM settings
+      description: Create new LLM settings with the provided information
+      requestBody:
+        description: LLM settings information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.LLMSettingsInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.LLMSettingsResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: settings
+  /llm-settings/{id}:
+    get:
+      tags:
+      - llm-settings
+      summary: Get LLM settings by ID
+      description: Get details of LLM settings by its ID
+      parameters:
+      - name: id
+        in: path
+        description: LLM Settings ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.LLMSettingsResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - llm-settings
+      summary: Delete LLM settings
+      description: Delete LLM settings by its ID
+      parameters:
+      - name: id
+        in: path
+        description: LLM Settings ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - llm-settings
+      summary: Update LLM settings
+      description: Update existing LLM settings information
+      parameters:
+      - name: id
+        in: path
+        description: LLM Settings ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated LLM settings information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.LLMSettingsInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.LLMSettingsResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: settings
+  /llm-settings/search:
+    get:
+      tags:
+      - llm-settings
+      summary: Search LLM settings by model name
+      description: Search for LLM settings using a model name stub
+      parameters:
+      - name: model_name
+        in: query
+        description: Model name stub to search for
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMSettingsResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /llms:
+    get:
+      tags:
+      - llms
+      summary: List all LLMs
+      description: Get a list of all LLMs
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - llms
+      summary: Create a new LLM
+      description: Create a new LLM with the provided information
+      requestBody:
+        description: LLM information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.LLMInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.LLMResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: llm
+  /llms/{id}:
+    get:
+      tags:
+      - llms
+      summary: Get an LLM by ID
+      description: Get details of an LLM by its ID
+      parameters:
+      - name: id
+        in: path
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.LLMResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - llms
+      summary: Delete an LLM
+      description: Delete an LLM by its ID
+      parameters:
+      - name: id
+        in: path
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - llms
+      summary: Update an LLM
+      description: Update an existing LLM's information
+      parameters:
+      - name: id
+        in: path
+        description: LLM ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated LLM information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.LLMInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.LLMResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: llm
+  /llms/max-privacy-score:
+    get:
+      tags:
+      - llms
+      summary: Get LLMs by maximum privacy score
+      description: Get a list of LLMs with privacy score less than or equal to the
+        specified value
+      parameters:
+      - name: max_score
+        in: query
+        description: Maximum privacy score
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /llms/min-privacy-score:
+    get:
+      tags:
+      - llms
+      summary: Get LLMs by minimum privacy score
+      description: Get a list of LLMs with privacy score greater than or equal to
+        the specified value
+      parameters:
+      - name: min_score
+        in: query
+        description: Minimum privacy score
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /llms/privacy-score-range:
+    get:
+      tags:
+      - llms
+      summary: Get LLMs by privacy score range
+      description: Get a list of LLMs with privacy score within the specified range
+      parameters:
+      - name: min_score
+        in: query
+        description: Minimum privacy score
+        required: true
+        schema:
+          type: integer
+      - name: max_score
+        in: query
+        description: Maximum privacy score
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /llms/search:
+    get:
+      tags:
+      - llms
+      summary: Search LLMs by name
+      description: Search for LLMs using a name stub
+      parameters:
+      - name: name
+        in: query
+        description: Name stub to search for
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.LLMResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /login-sso-profile:
+    get:
+      tags:
+      - sso-profiles
+      summary: Get the profile used in the login page
+      description: "Get a sanitized view (name, provider type, login URL) of the profile\
+        \ that has UseInLoginPage set to true"
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.LoginPageProfileResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /model-prices:
+    get:
+      tags:
+      - model-prices
+      summary: Get all model prices
+      description: Get a list of all model prices
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ModelPriceResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - model-prices
+      summary: Create a new model price
+      description: Create a new model price with the provided information
+      requestBody:
+        description: Model Price information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ModelPriceInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ModelPriceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: modelPrice
+  /model-prices/{id}:
+    get:
+      tags:
+      - model-prices
+      summary: Get a model price by ID
+      description: Get details of a model price by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Model Price ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ModelPriceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - model-prices
+      summary: Delete a model price
+      description: Delete a model price by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Model Price ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - model-prices
+      summary: Update a model price
+      description: Update an existing model price's information without recalculating
+        historical costs
+      parameters:
+      - name: id
+        in: path
+        description: Model Price ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated model price information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ModelPriceInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ModelPriceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: modelPrice
+  /model-prices/{id}/recalculate:
+    patch:
+      tags:
+      - model-prices
+      summary: Update a model price and recalculate historical costs
+      description: Update an existing model price's information and recalculate all
+        historical chat record costs
+      parameters:
+      - name: id
+        in: path
+        description: Model Price ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated model price information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ModelPriceInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ModelPriceResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: modelPrice
+  /model-prices/by-name:
+    get:
+      tags:
+      - model-prices
+      summary: Get or create a model price by name
+      description: "Get a model price by its name, creating it with default values\
+        \ if it doesn't exist"
+      parameters:
+      - name: model_name
+        in: query
+        description: Model name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ModelPriceResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /model-prices/by-vendor:
+    get:
+      tags:
+      - model-prices
+      summary: Get model prices by vendor
+      description: Get a list of model prices for a specific vendor
+      parameters:
+      - name: vendor
+        in: query
+        description: Vendor name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ModelPriceResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /model-routers:
+    get:
+      tags:
+      - model-routers
+      summary: List all model routers
+      description: Get a paginated list of all model routers (Enterprise only)
+      parameters:
+      - name: page_size
+        in: query
+        description: Number of items per page
+        schema:
+          type: integer
+      - name: page_number
+        in: query
+        description: Page number
+        schema:
+          type: integer
+      - name: all
+        in: query
+        description: Return all items without pagination
+        schema:
+          type: boolean
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "402":
+          description: Enterprise feature required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - model-routers
+      summary: Create a new model router
+      description: "Create a new model router with pools, vendors, and mappings (Enterprise\
+        \ only)"
+      requestBody:
+        description: Model router information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ModelRouterInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "402":
+          description: Enterprise feature required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: router
+  /model-routers/{id}:
+    get:
+      tags:
+      - model-routers
+      summary: Get a model router by ID
+      description: Get details of a model router by its ID (Enterprise only)
+      parameters:
+      - name: id
+        in: path
+        description: Model Router ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "402":
+          description: Enterprise feature required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - model-routers
+      summary: Delete a model router
+      description: Delete a model router by ID (Enterprise only)
+      parameters:
+      - name: id
+        in: path
+        description: Model Router ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "402":
+          description: Enterprise feature required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - model-routers
+      summary: Update a model router
+      description: Update an existing model router's information (Enterprise only)
+      parameters:
+      - name: id
+        in: path
+        description: Model Router ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated model router information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ModelRouterInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "402":
+          description: Enterprise feature required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: router
+  /model-routers/{id}/toggle:
+    patch:
+      tags:
+      - model-routers
+      summary: Toggle model router active status
+      description: Enable or disable a model router (Enterprise only)
+      parameters:
+      - name: id
+        in: path
+        description: Model Router ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Active status
+        content:
+          application/json:
+            schema:
+              type: object
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "402":
+          description: Enterprise feature required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: active
+  /oauth/authorize:
+    get:
+      tags:
+      - oauth
+      summary: OAuth Authorization Endpoint
+      description: Handles user authorization requests for OAuth clients.
+      parameters:
+      - name: response_type
+        in: query
+        description: Must be 'code'
+        required: true
+        schema:
+          type: string
+      - name: client_id
+        in: query
+        description: Client ID
+        required: true
+        schema:
+          type: string
+      - name: redirect_uri
+        in: query
+        description: Client Redirect URI
+        required: true
+        schema:
+          type: string
+      - name: scope
+        in: query
+        description: Requested scopes (space-separated)
+        schema:
+          type: string
+      - name: state
+        in: query
+        description: Opaque value to be returned to client
+        schema:
+          type: string
+      - name: code_challenge
+        in: query
+        description: PKCE Code Challenge (S256)
+        required: true
+        schema:
+          type: string
+      - name: code_challenge_method
+        in: query
+        description: PKCE Code Challenge Method (must be 'S256')
+        required: true
+        schema:
+          type: string
+      responses:
+        "302":
+          description: Redirects to client's redirect_uri with code and state or to
+            consent page
+          content: {}
+        "400":
+          description: Invalid request parameters
+          content:
+            '*/*':
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: User not authenticated (redirects to login)
+          content: {}
+        "404":
+          description: Client not found
+          content:
+            '*/*':
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /oauth/consent_details:
+    get:
+      tags:
+      - oauth
+      summary: Get OAuth Consent Details
+      description: Retrieves details for an OAuth consent request. Requires user authentication.
+      parameters:
+      - name: auth_req_id
+        in: query
+        description: Authorization Request ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            '*/*':
+              schema:
+                $ref: '#/components/schemas/api.ConsentDetailsResponse'
+        "400":
+          description: Invalid or missing auth_req_id
+          content:
+            '*/*':
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: User not authenticated or mismatch
+          content:
+            '*/*':
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Request not found or expired
+          content:
+            '*/*':
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            '*/*':
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /oauth/register_client:
+    post:
+      tags:
+      - oauth
+      summary: Register OAuth Client
+      description: Register a new OAuth client application. Public endpoint (auth
+        will be added later).
+      requestBody:
+        description: OAuth Client Registration Details
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.RegisterOAuthClientInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.RegisterOAuthClientOutput'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: client_details
+  /oauth/submit_consent:
+    post:
+      tags:
+      - oauth
+      summary: Submit OAuth Consent
+      description: Submits user's consent decision (approve/deny) for an OAuth request.
+      requestBody:
+        description: Consent Submission Details
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.SubmitConsentInput'
+        required: true
+      responses:
+        "302":
+          description: Redirects to client's redirect_uri with code/state or error/state
+          content: {}
+        "400":
+          description: Invalid input
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "401":
+          description: User not authenticated or mismatch
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Request not found or expired
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: consent_submission
+  /oauth/token:
+    post:
+      tags:
+      - oauth
+      summary: OAuth Token Endpoint
+      description: Exchanges an authorization code for an access token.
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              required:
+              - client_id
+              - code
+              - code_verifier
+              - grant_type
+              - redirect_uri
+              type: object
+              properties:
+                grant_type:
+                  type: string
+                  description: Must be 'authorization_code'
+                code:
+                  type: string
+                  description: Authorization code
+                redirect_uri:
+                  type: string
+                  description: Redirect URI used in authorization request
+                client_id:
+                  type: string
+                  description: Client ID
+                client_secret:
+                  type: string
+                  description: Client Secret (for confidential clients using client_secret_post)
+                code_verifier:
+                  type: string
+                  description: PKCE Code Verifier
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.AccessTokenResponse'
+        "400":
+          description: "e.g., invalid_request, invalid_grant"
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.OAuthErrorResponse'
+        "401":
+          description: "e.g., invalid_client"
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.OAuthErrorResponse'
+  /plugins/assets/{id}/{filepath}:
+    get:
+      tags:
+      - plugins
+      summary: Serve plugin asset
+      description: "Serve static assets for plugins (JS, CSS, images, etc.)"
+      parameters:
+      - name: id
+        in: path
+        description: Plugin ID
+        required: true
+        schema:
+          type: integer
+      - name: filepath
+        in: path
+        description: Asset file path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/javascript:
+              schema:
+                type: string
+                format: binary
+            text/css:
+              schema:
+                type: string
+                format: binary
+            image/*:
+              schema:
+                type: string
+                format: binary
+        "400":
+          description: Bad Request
+          content:
+            application/javascript:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            text/css:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            image/*:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/javascript:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            text/css:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            image/*:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/javascript:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            text/css:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+            image/*:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /providers:
+    get:
+      tags:
+      - providers
+      summary: List available OpenAPI providers
+      description: Get a list of all registered OpenAPI specification providers
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/providers.ImportMethod'
+  /providers/{id}/configure:
+    post:
+      tags:
+      - providers
+      summary: Configure provider credentials
+      description: Set up credentials for a specific OpenAPI provider
+      parameters:
+      - name: id
+        in: path
+        description: Provider ID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: Provider configuration
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ConfigureProviderRequest'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SuccessResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: config
+  /providers/{id}/import-steps:
+    get:
+      tags:
+      - providers
+      summary: Get import steps
+      description: Get the steps required for importing an OpenAPI specification
+      parameters:
+      - name: id
+        in: path
+        description: Provider ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/providers.ImportStep'
+  /providers/{id}/specs:
+    get:
+      tags:
+      - providers
+      summary: Get API specifications from provider
+      description: Retrieve available API specifications from a specific provider
+      parameters:
+      - name: id
+        in: path
+        description: Provider ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/providers.APISpec'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /providers/direct/import:
+    post:
+      tags:
+      - providers
+      summary: Import OpenAPI spec
+      description: Import an OpenAPI specification using the specified method
+      requestBody:
+        description: Import request
+        content:
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/api.ImportRequest'
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ImportRequest'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SuccessResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: request
+  /secrets:
+    get:
+      tags:
+      - secrets
+      summary: List all secrets
+      description: Get a paginated list of all secrets
+      parameters:
+      - name: page_size
+        in: query
+        description: Number of items per page
+        schema:
+          type: integer
+      - name: page
+        in: query
+        description: Page number
+        schema:
+          type: integer
+      - name: all
+        in: query
+        description: Return all records without pagination
+        schema:
+          type: boolean
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SecretListResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "503":
+          description: When TYK_AI_SECRET_KEY is not set
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - secrets
+      summary: Create a new secret
+      description: Create a new secret with the provided information
+      requestBody:
+        description: Secret information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.SecretInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SecretResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "503":
+          description: When TYK_AI_SECRET_KEY is not set
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: secret
+  /secrets/{id}:
+    get:
+      tags:
+      - secrets
+      summary: Get a secret by ID
+      description: Get details of a secret by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Secret ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SecretResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "503":
+          description: When TYK_AI_SECRET_KEY is not set
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - secrets
+      summary: Delete a secret
+      description: Delete a secret by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Secret ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "503":
+          description: When TYK_AI_SECRET_KEY is not set
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - secrets
+      summary: Update a secret
+      description: Update an existing secret's information
+      parameters:
+      - name: id
+        in: path
+        description: Secret ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated secret information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.SecretInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SecretResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "503":
+          description: When TYK_AI_SECRET_KEY is not set
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: secret
+  /sso:
+    get:
+      tags:
+      - auth
+      summary: Handle SSO authentication with a nonce token
+      description: "Process SSO authentication using a nonce token, validate user,\
+        \ and establish a session"
+      parameters:
+      - name: nonce
+        in: query
+        description: Nonce token for authentication
+        required: true
+        schema:
+          type: string
+      responses:
+        "302":
+          description: Redirect to the dashboard or portal
+          content:
+            application/json:
+              schema:
+                type: string
+        "400":
+          description: Bad request or invalid token
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal server error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /tags:
+    get:
+      tags:
+      - tags
+      summary: List all tags
+      description: Get a list of all tags
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.TagResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - tags
+      summary: Create a new tag
+      description: Create a new tag with the provided information
+      requestBody:
+        description: Tag information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.TagInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.TagResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: tag
+  /tags/{id}:
+    get:
+      tags:
+      - tags
+      summary: Get a tag by ID
+      description: Get details of a tag by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Tag ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.TagResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - tags
+      summary: Delete a tag
+      description: Delete a tag by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Tag ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - tags
+      summary: Update a tag
+      description: Update an existing tag's information
+      parameters:
+      - name: id
+        in: path
+        description: Tag ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated tag information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.TagInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.TagResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: tag
+  /tags/search:
+    get:
+      tags:
+      - tags
+      summary: Search tags by name
+      description: Search for tags using a name stub
+      parameters:
+      - name: name
+        in: query
+        description: Name stub to search for
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.TagResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /tool-catalogues:
+    get:
+      tags:
+      - tool-catalogues
+      summary: List all tool catalogues
+      description: Get a list of all tool catalogues
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ToolCatalogueResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    post:
+      tags:
+      - tool-catalogues
+      summary: Create a new tool catalogue
+      description: Create a new tool catalogue with the provided information
+      requestBody:
+        description: Tool Catalogue information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ToolCatalogueInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: toolCatalogue
+  /tool-catalogues/{id}:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Get a tool catalogue by ID
+      description: Get details of a tool catalogue by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    delete:
+      tags:
+      - tool-catalogues
+      summary: Delete a tool catalogue
+      description: Delete a tool catalogue by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    patch:
+      tags:
+      - tool-catalogues
+      summary: Update a tool catalogue
+      description: Update an existing tool catalogue's information
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated Tool Catalogue information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ToolCatalogueInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: toolCatalogue
+  /tool-catalogues/{id}/tags:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Get tags in a tool catalogue
+      description: Get all tags in a specified tool catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.TagResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    post:
+      tags:
+      - tool-catalogues
+      summary: Add a tag to a tool catalogue
+      description: Add a tag to a specified tool catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Tag to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ToolCatalogueTagInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: tag
+  /tool-catalogues/{id}/tags/{tagId}:
+    delete:
+      tags:
+      - tool-catalogues
+      summary: Remove a tag from a tool catalogue
+      description: Remove a tag from a specified tool catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: tagId
+        in: path
+        description: Tag ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /tool-catalogues/{id}/tools:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Get tools in a tool catalogue
+      description: Get all tools in a specified tool catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+    post:
+      tags:
+      - tool-catalogues
+      summary: Add a tool to a tool catalogue
+      description: Add a tool to a specified tool catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Tool to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ToolCatalogueToolInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      x-codegen-request-body-name: tool
+  /tool-catalogues/{id}/tools/{toolId}:
+    delete:
+      tags:
+      - tool-catalogues
+      summary: Remove a tool from a tool catalogue
+      description: Remove a tool from a specified tool catalogue
+      parameters:
+      - name: id
+        in: path
+        description: Tool Catalogue ID
+        required: true
+        schema:
+          type: integer
+      - name: toolId
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /tool-catalogues/search:
+    get:
+      tags:
+      - tool-catalogues
+      summary: Search tool catalogues
+      description: Search for tool catalogues using a query string
+      parameters:
+      - name: query
+        in: query
+        description: Search query
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ToolCatalogueResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /tools:
+    get:
+      tags:
+      - tools
+      summary: Get all tools
+      description: Get a list of all tools
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ToolResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - tools
+      summary: Create a new tool
+      description: Create a new tool with the provided information
+      requestBody:
+        description: Tool information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ToolInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: tool
+  /tools/{id}:
+    get:
+      tags:
+      - tools
+      summary: Get a tool by ID
+      description: Get details of a tool by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - tools
+      summary: Delete a tool
+      description: Delete a tool by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - tools
+      summary: Update a tool
+      description: Update an existing tool's information
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated tool information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.ToolInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: tool
+  /tools/{id}/call-operation:
+    post:
+      tags:
+      - tools
+      summary: Call Tool Operation
+      description: Call an operation from the tool's OpenAPI specification
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Operation details
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.CallOperationInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: operation
+  /tools/{id}/dependencies:
+    get:
+      tags:
+      - tools
+      summary: Get tool dependencies
+      description: Get all dependencies associated with a specific tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.DependencyListResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - tools
+      summary: Set tool dependencies
+      description: Replace all dependencies for a specific tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Array of dependency IDs
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: integer
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: dependency_ids
+  /tools/{id}/dependencies/{dependency_id}:
+    post:
+      tags:
+      - tools
+      summary: Add dependency to tool
+      description: Add a dependency to a specific tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      - name: dependency_id
+        in: path
+        description: Dependency ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - tools
+      summary: Remove dependency from tool
+      description: Remove a dependency from a specific tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      - name: dependency_id
+        in: path
+        description: Dependency ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /tools/{id}/documentation:
+    get:
+      tags:
+      - tools
+      summary: Get tool documentation by ID
+      description: Get documentation for a specific tool by its ID
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /tools/{id}/filestores:
+    get:
+      tags:
+      - tools
+      summary: Get Tool FileStores
+      description: Get all FileStores associated with a specific Tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.FileStoreResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - tools
+      summary: Set Tool FileStores
+      description: Replace all FileStore associations for a specific Tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Array of FileStore IDs
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: integer
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: filestore_ids
+  /tools/{id}/filestores/{filestore_id}:
+    post:
+      tags:
+      - tools
+      summary: Add FileStore to Tool
+      description: Add a FileStore to a specific Tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      - name: filestore_id
+        in: path
+        description: FileStore ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - tools
+      summary: Remove FileStore from Tool
+      description: Remove a FileStore from a specific Tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      - name: filestore_id
+        in: path
+        description: FileStore ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /tools/{id}/filters:
+    get:
+      tags:
+      - tools
+      summary: Get Tool Filters
+      description: Get all Filters associated with a specific Tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.FilterResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    put:
+      tags:
+      - tools
+      summary: Set Tool Filters
+      description: Replace all Filter associations for a specific Tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Array of Filter IDs
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: integer
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: filter_ids
+  /tools/{id}/filters/{filter_id}:
+    post:
+      tags:
+      - tools
+      summary: Add Filter to Tool
+      description: Add a Filter to a specific Tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      - name: filter_id
+        in: path
+        description: Filter ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - tools
+      summary: Remove Filter from Tool
+      description: Remove a Filter from a specific Tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      - name: filter_id
+        in: path
+        description: Filter ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /tools/{id}/operations:
+    get:
+      tags:
+      - tools
+      summary: Get tool operations
+      description: Get all operations associated with a specific tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.OperationsResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - tools
+      summary: Add operation to tool
+      description: Add an operation to a specific tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Operation to add
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.OperationInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: operation
+    delete:
+      tags:
+      - tools
+      summary: Remove operation from tool
+      description: Remove an operation from a specific tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Operation to remove
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.OperationInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: operation
+  /tools/{id}/spec-operations:
+    get:
+      tags:
+      - tools
+      summary: List Tool Operations from OpenAPI Spec
+      description: List all operations available in the tool's OpenAPI specification
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.OperationsResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /tools/{id}/user-apps:
+    get:
+      tags:
+      - tools
+      summary: Get user apps that have access to a tool
+      description: Get list of user's apps that have been granted access to a specific
+        tool
+      parameters:
+      - name: id
+        in: path
+        description: Tool ID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+  /tools/by-type:
+    get:
+      tags:
+      - tools
+      summary: Get tools by type
+      description: Get a list of tools of a specific type
+      parameters:
+      - name: type
+        in: query
+        description: Tool Type
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /tools/search:
+    get:
+      tags:
+      - tools
+      summary: Search tools
+      description: Search for tools by name or description
+      parameters:
+      - name: query
+        in: query
+        description: Search Query
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.ToolResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /users:
+    get:
+      tags:
+      - users
+      summary: List all users with optional search filter
+      description: "Get a list of all users, optionally filtered by search term"
+      parameters:
+      - name: search
+        in: query
+        description: Search term for filtering users by email or name
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.UserResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    post:
+      tags:
+      - users
+      summary: Create a new user
+      description: Create a new user with the provided information
+      requestBody:
+        description: User information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.UserInput'
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.UserResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: user
+  /users/{id}:
+    get:
+      tags:
+      - users
+      summary: Get a user by ID
+      description: Get details of a user by their ID
+      parameters:
+      - name: id
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.UserResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    delete:
+      tags:
+      - users
+      summary: Delete a user
+      description: Delete a user by their ID
+      parameters:
+      - name: id
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "204":
+          description: No Content
+          content: {}
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+    patch:
+      tags:
+      - users
+      summary: Update a user
+      description: Update an existing user's information
+      parameters:
+      - name: id
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      requestBody:
+        description: Updated user information
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.UserInput'
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.UserResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+      x-codegen-request-body-name: user
+  /users/{id}/catalogues:
+    get:
+      tags:
+      - users
+      summary: Get user accessible catalogues
+      description: Get a list of all catalogues accessible to a user
+      parameters:
+      - name: id
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.UserAccessibleCataloguesResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /users/{id}/roll-api-key:
+    post:
+      tags:
+      - users
+      summary: Roll API Key
+      description: Generate a new API key for a user
+      parameters:
+      - name: id
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.UserResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "404":
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /users/{id}/skip-quick-start:
+    post:
+      tags:
+      - users
+      summary: Skip user quick start wizard
+      description: Set a user's skip_quick_start flag to true
+      parameters:
+      - name: id
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: string
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /users/{user_id}/apps:
+    get:
+      tags:
+      - apps
+      summary: Get apps by user ID
+      description: Get a list of apps for a specific user
+      parameters:
+      - name: userId
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.AppResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /users/{user_id}/apps/count:
+    get:
+      tags:
+      - apps
+      summary: Count apps by user ID
+      description: Get the total number of apps for a specific user
+      parameters:
+      - name: user_id
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties:
+                  type: integer
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /users/{userId}/groups:
+    get:
+      tags:
+      - groups
+      summary: Get groups for a user
+      description: Get a list of all groups a specific user belongs to
+      parameters:
+      - name: userId
+        in: path
+        description: User ID
+        required: true
+        schema:
+          type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/api.GroupResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /vendors/embedders:
+    get:
+      tags:
+      - vendors
+      summary: Get available embedders
+      description: Get a list of available embedders
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.VendorListResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /vendors/llm-drivers:
+    get:
+      tags:
+      - vendors
+      summary: Get available LLM drivers
+      description: Get a list of available LLM drivers
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.VendorListResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+  /vendors/vector-stores:
+    get:
+      tags:
+      - vendors
+      summary: Get available vector stores
+      description: Get a list of available vector stores
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.VendorListResponse'
+        "500":
+          description: Internal Server Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.ErrorResponse'
+      security:
+      - BearerAuth: []
+components:
+  schemas:
+    analytics.ChartData:
+      type: object
+      properties:
+        cost:
+          type: array
+          items:
+            type: number
+        data:
+          type: array
+          items:
+            type: number
+        labels:
+          type: array
+          items:
+            type: string
+    api.AccessTokenResponse:
+      type: object
+      properties:
+        access_token:
+          type: string
+        expires_in:
+          type: integer
+          description: In seconds
+        refresh_token:
+          type: string
+        scope:
+          type: string
+        token_type:
+          type: string
+    api.AppDetailResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            budget_start_date:
+              type: string
+            credential:
+              $ref: '#/components/schemas/api.CredentialDetail'
+            credential_id:
+              type: integer
+            datasource_ids:
+              type: array
+              items:
+                type: integer
+            description:
+              type: string
+            is_orphaned:
+              type: boolean
+            llm_ids:
+              type: array
+              items:
+                type: integer
+            monthly_budget:
+              type: number
+            name:
+              type: string
+            tool_ids:
+              type: array
+              items:
+                type: integer
+            user_id:
+              type: integer
+        id:
+          type: string
+        type:
+          type: string
+      description: App detail response model
+    api.AppInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                budget_start_date:
+                  type: string
+                datasource_ids:
+                  type: array
+                  items:
+                    type: integer
+                description:
+                  type: string
+                llm_ids:
+                  type: array
+                  items:
+                    type: integer
+                metadata:
+                  type: object
+                  additionalProperties: true
+                monthly_budget:
+                  type: number
+                name:
+                  type: string
+                namespace:
+                  type: string
+                plugin_resources:
+                  type: array
+                  items:
+                    $ref: '#/components/schemas/api.PluginResourceInput'
+                tool_ids:
+                  type: array
+                  items:
+                    type: integer
+                user_id:
+                  type: integer
+            type:
+              type: string
+      description: App input model
+    api.AppListResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.AppResponse'
+        meta:
+          type: object
+          properties:
+            page_number:
+              type: integer
+            page_size:
+              type: integer
+            total_count:
+              type: integer
+            total_pages:
+              type: integer
+      description: App list response model
+    api.AppResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            budget_start_date:
+              type: string
+            credential_id:
+              type: integer
+            datasource_ids:
+              type: array
+              items:
+                type: integer
+            description:
+              type: string
+            is_orphaned:
+              type: boolean
+            llm_ids:
+              type: array
+              items:
+                type: integer
+            metadata:
+              type: object
+              additionalProperties: true
+            monthly_budget:
+              type: number
+            name:
+              type: string
+            namespace:
+              type: string
+            plugin_resources:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.PluginResourceOutput'
+            tool_ids:
+              type: array
+              items:
+                type: integer
+            user_id:
+              type: integer
+        id:
+          type: string
+        type:
+          type: string
+      description: App response model
+    api.AppWithTools:
+      type: object
+      properties:
+        description:
+          type: string
+        id:
+          type: integer
+        name:
+          type: string
+        tools:
+          type: array
+          items:
+            type: string
+    api.ApprovalRequest:
+      required:
+      - approved
+      type: object
+      properties:
+        approved:
+          type: boolean
+    api.BrandingSettingsAttributes:
+      type: object
+      properties:
+        app_title:
+          type: string
+        background_color:
+          type: string
+        custom_css:
+          type: string
+        has_custom_favicon:
+          type: boolean
+        has_custom_logo:
+          type: boolean
+        primary_color:
+          type: string
+        secondary_color:
+          type: string
+    api.BrandingSettingsResponse:
+      type: object
+      properties:
+        attributes:
+          $ref: '#/components/schemas/api.BrandingSettingsAttributes'
+        id:
+          type: string
+        type:
+          type: string
+    api.CMessageListResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.CMessageResponse'
+    api.CMessageResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            chat_id:
+              type: integer
+            content:
+              type: object
+            created_at:
+              type: string
+            session:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+      description: CMessage response model
+    api.CallOperationInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                headers:
+                  type: object
+                  additionalProperties:
+                    type: array
+                    items:
+                      type: string
+                operation_id:
+                  type: string
+                parameters:
+                  type: object
+                  additionalProperties:
+                    type: array
+                    items:
+                      type: string
+                payload:
+                  type: object
+                  additionalProperties: true
+            type:
+              type: string
+    api.CatalogueInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                name:
+                  type: string
+            type:
+              type: string
+      description: Catalogue input model
+    api.CatalogueLLMInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            id:
+              type: string
+            type:
+              type: string
+      description: Catalogue-LLM relationship input model
+    api.CatalogueResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            llm_names:
+              type: array
+              items:
+                type: string
+            name:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+      description: Catalogue response model
+    api.ChatDefaultsResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            default_data_source:
+              $ref: '#/components/schemas/api.SimplifiedDataSourceResponse'
+            default_tools:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.SimplifiedToolResponse'
+            name:
+              type: string
+            rag_results_per_source:
+              type: integer
+            supports_tools:
+              type: boolean
+        id:
+          type: string
+        type:
+          type: string
+    api.ChatHistoryRecordInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                chat_id:
+                  type: integer
+                name:
+                  type: string
+                session_id:
+                  type: string
+                user_id:
+                  type: integer
+            type:
+              type: string
+      description: Chat History Record input model
+    api.ChatHistoryRecordListResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.ChatHistoryRecordResponse'
+      description: Chat History Record list response model
+    api.ChatHistoryRecordResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            chat_id:
+              type: integer
+            name:
+              type: string
+            session_id:
+              type: string
+            user_id:
+              type: integer
+        id:
+          type: string
+        type:
+          type: string
+      description: Chat History Record response model
+    api.ChatResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            default_data_source:
+              $ref: '#/components/schemas/api.DatasourceResponse'
+            default_data_source_id:
+              type: integer
+            default_tools:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.ToolResponse'
+            description:
+              type: string
+            extra_context:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.FileStoreResponse'
+            filters:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.FilterResponse'
+            groups:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.GroupResponse'
+            llm_id:
+              type: string
+            llm_settings_id:
+              type: string
+            name:
+              type: string
+            prompt_templates:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.PromptTemplateResponse'
+            rag_n:
+              type: integer
+            system_prompt:
+              type: string
+            tool_support:
+              type: boolean
+        id:
+          type: string
+        type:
+          type: string
+      description: Chat response model
+    api.ConfigureProviderRequest:
+      type: object
+      properties:
+        config:
+          $ref: '#/components/schemas/providers.ProviderConfig'
+    api.ConsentDetailsResponse:
+      type: object
+      properties:
+        auth_req_id:
+          type: string
+        available_apps:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.AppWithTools'
+        client_name:
+          type: string
+        no_apps_message:
+          type: string
+        scopes:
+          type: array
+          items:
+            type: string
+    api.CreateAppRequest:
+      required:
+      - data_source_ids
+      - description
+      - llm_ids
+      - name
+      - tool_ids
+      type: object
+      properties:
+        budget_start_date:
+          type: string
+        data_source_ids:
+          type: array
+          items:
+            type: integer
+        description:
+          type: string
+        llm_ids:
+          type: array
+          items:
+            type: integer
+        monthly_budget:
+          type: number
+        name:
+          type: string
+        plugin_resources:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.PluginResourceInput'
+        tool_ids:
+          type: array
+          items:
+            type: integer
+    api.CredentialDetail:
+      type: object
+      properties:
+        active:
+          type: boolean
+        key_id:
+          type: string
+        secret:
+          type: string
+      description: Credential detail model
+    api.CredentialInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                active:
+                  type: boolean
+                key_id:
+                  type: string
+                secret:
+                  type: string
+            type:
+              type: string
+      description: Credential input model
+    api.CredentialResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            active:
+              type: boolean
+            key_id:
+              type: string
+            secret:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+      description: Credential response model
+    api.DataCatalogueDatasourceInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            id:
+              type: string
+            type:
+              type: string
+      description: Data Catalogue-Datasource relationship input model
+    api.DataCatalogueInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                icon:
+                  type: string
+                long_description:
+                  type: string
+                name:
+                  type: string
+                short_description:
+                  type: string
+            type:
+              type: string
+      description: Data Catalogue input model
+    api.DataCatalogueResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            datasources:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.DatasourceResponse'
+            icon:
+              type: string
+            long_description:
+              type: string
+            name:
+              type: string
+            short_description:
+              type: string
+            tags:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.TagResponse'
+        id:
+          type: string
+        type:
+          type: string
+      description: Data Catalogue response model
+    api.DataCatalogueTagInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            id:
+              type: string
+            type:
+              type: string
+      description: Data Catalogue-Tag relationship input model
+    api.DatasourceInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                active:
+                  type: boolean
+                db_conn_api_key:
+                  type: string
+                db_conn_string:
+                  type: string
+                db_name:
+                  type: string
+                db_source_type:
+                  type: string
+                embed_api_key:
+                  type: string
+                embed_model:
+                  type: string
+                embed_url:
+                  type: string
+                embed_vendor:
+                  type: string
+                icon:
+                  type: string
+                long_description:
+                  type: string
+                name:
+                  type: string
+                namespace:
+                  type: string
+                privacy_score:
+                  type: integer
+                short_description:
+                  type: string
+                tags:
+                  type: array
+                  items:
+                    type: string
+                url:
+                  type: string
+                user_id:
+                  type: integer
+            type:
+              type: string
+      description: Datasource input model
+    api.DatasourceResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            active:
+              type: boolean
+            db_conn_api_key:
+              type: string
+            db_conn_string:
+              type: string
+            db_name:
+              type: string
+            db_source_type:
+              type: string
+            embed_api_key:
+              type: string
+            embed_model:
+              type: string
+            embed_url:
+              type: string
+            embed_vendor:
+              type: string
+            files:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.FileStoreResponse'
+            has_db_conn_api_key:
+              type: boolean
+            has_embed_api_key:
+              type: boolean
+            icon:
+              type: string
+            long_description:
+              type: string
+            name:
+              type: string
+            namespace:
+              type: string
+            privacy_score:
+              type: integer
+            short_description:
+              type: string
+            tags:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.TagResponse'
+            url:
+              type: string
+            user_id:
+              type: integer
+        id:
+          type: string
+        type:
+          type: string
+      description: Datasource response model
+    api.DependencyListResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.ToolResponse'
+      description: Dependency list response model
+    api.EdgeListResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.EdgeResponse'
+        meta:
+          type: object
+          properties:
+            page_number:
+              type: integer
+            page_size:
+              type: integer
+            total_count:
+              type: integer
+            total_pages:
+              type: integer
+    api.EdgeResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            build_hash:
+              type: string
+            created_at:
+              type: string
+            edge_id:
+              type: string
+            last_heartbeat:
+              type: string
+            last_sync_ack:
+              type: string
+            loaded_checksum:
+              type: string
+            loaded_version:
+              type: string
+            metadata:
+              type: object
+              additionalProperties: true
+            namespace:
+              type: string
+            session_id:
+              type: string
+            status:
+              type: string
+            sync_status:
+              type: string
+              description: Sync status fields for configuration sync tracking
+            updated_at:
+              type: string
+            version:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+    api.ErrorResponse:
+      type: object
+      properties:
+        errors:
+          type: array
+          items:
+            type: object
+            properties:
+              detail:
+                type: string
+              title:
+                type: string
+      description: Error response model
+    api.ExportRequest:
+      required:
+      - end_date
+      - source_id
+      - source_type
+      - start_date
+      type: object
+      properties:
+        end_date:
+          type: string
+        search:
+          type: string
+        source_id:
+          type: integer
+        source_type:
+          type: string
+          enum:
+          - app
+          - llm
+          - user
+        start_date:
+          type: string
+    api.FileStoreInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                content:
+                  type: string
+                description:
+                  type: string
+                file_name:
+                  type: string
+                length:
+                  type: integer
+            type:
+              type: string
+      description: FileStore input model
+    api.FileStoreResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            description:
+              type: string
+            file_name:
+              type: string
+            last_processed_on:
+              type: string
+            length:
+              type: integer
+        id:
+          type: string
+        type:
+          type: string
+      description: FileStore response model
+    api.FilterInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                description:
+                  type: string
+                name:
+                  type: string
+                namespace:
+                  type: string
+                response_filter:
+                  type: boolean
+                script:
+                  type: array
+                  items:
+                    type: integer
+            type:
+              type: string
+      description: Filter input model
+    api.FilterResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            description:
+              type: string
+            name:
+              type: string
+            namespace:
+              type: string
+            response_filter:
+              type: boolean
+            script:
+              type: array
+              items:
+                type: integer
+        id:
+          type: string
+        type:
+          type: string
+      description: Filter response model
+    api.FilterTestInput:
+      required:
+      - input
+      - script
+      type: object
+      properties:
+        input:
+          type: object
+          additionalProperties: true
+        script:
+          type: string
+      description: Filter test input model
+    api.FilterTestOutput:
+      type: object
+      properties:
+        error:
+          type: string
+        output:
+          type: object
+          additionalProperties: true
+        success:
+          type: boolean
+      description: Filter test output model
+    api.ForgotPasswordInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                email:
+                  type: string
+            type:
+              type: string
+      description: Forgot Password input model
+    api.ForgotPasswordResponse:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                message:
+                  type: string
+            type:
+              type: string
+      description: ForgotPassword response model
+    api.GroupCatalogueInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            id:
+              type: string
+            type:
+              type: string
+      description: Group-Catalogue relationship input model
+    api.GroupCataloguesRequest:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                catalogues:
+                  type: array
+                  items:
+                    type: integer
+                data_catalogues:
+                  type: array
+                  items:
+                    type: integer
+                tool_catalogues:
+                  type: array
+                  items:
+                    type: integer
+            type:
+              type: string
+    api.GroupInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                catalogues:
+                  type: array
+                  items:
+                    type: integer
+                data_catalogues:
+                  type: array
+                  items:
+                    type: integer
+                members:
+                  type: array
+                  items:
+                    type: integer
+                name:
+                  type: string
+                tool_catalogues:
+                  type: array
+                  items:
+                    type: integer
+            type:
+              type: string
+      description: Group input model
+    api.GroupResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            catalogues:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.CatalogueResponse'
+            data_catalogues:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.DataCatalogueResponse'
+            name:
+              type: string
+            tool_catalogues:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.ToolCatalogueResponse'
+            users:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.UserResponse'
+        id:
+          type: string
+        type:
+          type: string
+      description: Group response model
+    api.GroupToolCatalogueInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            id:
+              type: string
+            type:
+              type: string
+      description: Group-ToolCatalogue relationship input model
+    api.GroupUsersInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                members:
+                  type: array
+                  items:
+                    type: integer
+            type:
+              type: string
+    api.ImportRequest:
+      required:
+      - method
+      - name
+      type: object
+      properties:
+        method:
+          type: string
+          description: '"url" or "file"'
+        name:
+          type: string
+        url:
+          type: string
+          description: Required if method is "url"
+    api.LLMInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                active:
+                  type: boolean
+                allowed_models:
+                  type: array
+                  items:
+                    type: string
+                api_endpoint:
+                  type: string
+                api_key:
+                  type: string
+                budget_start_date:
+                  type: string
+                default_model:
+                  type: string
+                dont_log_bodies:
+                  type: boolean
+                filters:
+                  type: array
+                  items:
+                    type: integer
+                logo_url:
+                  type: string
+                long_description:
+                  type: string
+                metadata:
+                  type: object
+                  additionalProperties: true
+                monthly_budget:
+                  type: number
+                name:
+                  type: string
+                namespace:
+                  type: string
+                privacy_score:
+                  type: integer
+                short_description:
+                  type: string
+                vendor:
+                  type: string
+            type:
+              type: string
+      description: LLM input model
+    api.LLMResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            active:
+              type: boolean
+            allowed_models:
+              type: array
+              items:
+                type: string
+            api_endpoint:
+              type: string
+            api_key:
+              type: string
+            budget_start_date:
+              type: string
+            default_model:
+              type: string
+            dont_log_bodies:
+              type: boolean
+            filters:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.FilterResponse'
+            has_api_key:
+              type: boolean
+            logo_url:
+              type: string
+            long_description:
+              type: string
+            metadata:
+              type: object
+              additionalProperties: true
+            monthly_budget:
+              type: number
+            name:
+              type: string
+            namespace:
+              type: string
+            plugins:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.PluginResponse'
+            privacy_score:
+              type: integer
+            short_description:
+              type: string
+            vendor:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+      description: LLM response model
+    api.LLMSettingsInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                max_length:
+                  type: integer
+                max_tokens:
+                  type: integer
+                metadata:
+                  type: object
+                  additionalProperties: true
+                min_length:
+                  type: integer
+                model_name:
+                  type: string
+                repetition_penalty:
+                  type: number
+                seed:
+                  type: integer
+                stop_words:
+                  type: array
+                  items:
+                    type: string
+                system_prompt:
+                  type: string
+                temperature:
+                  type: number
+                top_k:
+                  type: integer
+                top_p:
+                  type: number
+            type:
+              type: string
+      description: LLM settings input model
+    api.LLMSettingsResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            max_length:
+              type: integer
+            max_tokens:
+              type: integer
+            metadata:
+              type: object
+              additionalProperties: true
+            min_length:
+              type: integer
+            model_name:
+              type: string
+            repetition_penalty:
+              type: number
+            seed:
+              type: integer
+            stop_words:
+              type: array
+              items:
+                type: string
+            system_prompt:
+              type: string
+            temperature:
+              type: number
+            top_k:
+              type: integer
+            top_p:
+              type: number
+        id:
+          type: string
+        type:
+          type: string
+      description: LLM settings response model
+    api.LoginInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                email:
+                  type: string
+                password:
+                  type: string
+            type:
+              type: string
+      description: Login input model
+    api.LoginPageProfileResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            login_url:
+              type: string
+            name:
+              type: string
+            profile_id:
+              type: string
+            selected_provider_type:
+              type: string
+            use_in_login_page:
+              type: boolean
+        id:
+          type: integer
+        type:
+          type: string
+      description: Sanitized login page SSO profile model
+    api.LoginResponse:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                message:
+                  type: string
+            type:
+              type: string
+      description: Login response model
+    api.LogoutResponse:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                message:
+                  type: string
+            type:
+              type: string
+      description: Logout response model
+    api.ModelMappingInput:
+      type: object
+      properties:
+        source_model:
+          type: string
+        target_model:
+          type: string
+    api.ModelPoolInput:
+      type: object
+      properties:
+        model_pattern:
+          type: string
+        name:
+          type: string
+        priority:
+          type: integer
+        selection_algorithm:
+          type: string
+        vendors:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.PoolVendorInput'
+    api.ModelPriceInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                cache_read_pt:
+                  type: number
+                cache_write_pt:
+                  type: number
+                cpit:
+                  type: number
+                cpt:
+                  type: number
+                currency:
+                  type: string
+                model_name:
+                  type: string
+                vendor:
+                  type: string
+            type:
+              type: string
+      description: Model Price input model
+    api.ModelPriceResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            cache_read_pt:
+              type: number
+            cache_write_pt:
+              type: number
+            cpit:
+              type: number
+            cpt:
+              type: number
+            currency:
+              type: string
+            model_name:
+              type: string
+            vendor:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+      description: Model Price response model
+    api.ModelRouterInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                active:
+                  type: boolean
+                api_compat:
+                  type: string
+                description:
+                  type: string
+                name:
+                  type: string
+                namespace:
+                  type: string
+                pools:
+                  type: array
+                  items:
+                    $ref: '#/components/schemas/api.ModelPoolInput'
+                slug:
+                  type: string
+            type:
+              type: string
+    api.NamespaceListResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.NamespaceResponse'
+    api.NamespaceResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            app_count:
+              type: integer
+            edge_count:
+              type: integer
+            llm_count:
+              type: integer
+            name:
+              type: string
+            token_count:
+              type: integer
+        id:
+          type: string
+        type:
+          type: string
+    api.OAuthErrorResponse:
+      type: object
+      properties:
+        error:
+          type: string
+        error_description:
+          type: string
+        error_uri:
+          type: string
+    api.OAuthServerMetadata:
+      type: object
+      properties:
+        authorization_endpoint:
+          type: string
+        code_challenge_methods_supported:
+          type: array
+          items:
+            type: string
+        device_authorization_endpoint:
+          type: string
+        grant_types_supported:
+          type: array
+          items:
+            type: string
+        introspection_endpoint:
+          type: string
+        issuer:
+          type: string
+        jwks_uri:
+          type: string
+        op_policy_uri:
+          type: string
+        op_tos_uri:
+          type: string
+        pushed_authorization_request_endpoint:
+          type: string
+        registration_endpoint:
+          type: string
+        request_parameter_supported:
+          type: boolean
+        request_uri_parameter_supported:
+          type: boolean
+        require_pushed_authorization_requests:
+          type: boolean
+        response_types_supported:
+          type: array
+          items:
+            type: string
+        revocation_endpoint:
+          type: string
+        scopes_supported:
+          type: array
+          items:
+            type: string
+        service_documentation:
+          type: string
+        tls_client_certificate_bound_access_tokens:
+          type: boolean
+        token_endpoint:
+          type: string
+        token_endpoint_auth_methods_supported:
+          type: array
+          items:
+            type: string
+        ui_locales_supported:
+          type: array
+          items:
+            type: string
+    api.OperationInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                operation:
+                  type: string
+            type:
+              type: string
+      description: Operation input model
+    api.OperationsResponse:
+      type: object
+      properties:
+        operations:
+          type: array
+          items:
+            type: string
+      description: Tool operations response model
+    api.PluginListResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.PluginResponse'
+        meta:
+          type: object
+          properties:
+            page_number:
+              type: integer
+            page_size:
+              type: integer
+            total_count:
+              type: integer
+            total_pages:
+              type: integer
+    api.PluginResourceInput:
+      type: object
+      properties:
+        instance_ids:
+          type: array
+          items:
+            type: string
+        plugin_id:
+          type: integer
+        resource_type_slug:
+          type: string
+    api.PluginResourceOutput:
+      type: object
+      properties:
+        instance_ids:
+          type: array
+          items:
+            type: string
+        plugin_id:
+          type: integer
+        resource_type_name:
+          type: string
+        resource_type_slug:
+          type: string
+    api.PluginResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            checksum:
+              type: string
+            command:
+              type: string
+            config:
+              type: object
+              additionalProperties: true
+            created_at:
+              type: string
+            description:
+              type: string
+            hook_type:
+              type: string
+            is_active:
+              type: boolean
+            manifest:
+              type: object
+              additionalProperties: true
+              description: Plugin manifest for UI extensions
+            name:
+              type: string
+            namespace:
+              type: string
+            oci_reference:
+              type: string
+              description: OCI artifact reference (for OCI plugins)
+            plugin_type:
+              type: string
+              description: '"gateway" or "ai_studio"'
+            updated_at:
+              type: string
+        id:
+          type: string
+        relationships:
+          type: object
+          properties:
+            llms:
+              type: object
+              properties:
+                data:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      attributes:
+                        type: object
+                        properties:
+                          active:
+                            type: boolean
+                          name:
+                            type: string
+                          vendor:
+                            type: string
+                      id:
+                        type: string
+                      type:
+                        type: string
+        type:
+          type: string
+    api.PoolVendorInput:
+      type: object
+      properties:
+        active:
+          type: boolean
+        llm_id:
+          type: integer
+        mappings:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.ModelMappingInput'
+        weight:
+          type: integer
+    api.ProfileInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                action_type:
+                  type: string
+                custom_email_field:
+                  type: string
+                custom_user_group_field:
+                  type: string
+                custom_user_id_field:
+                  type: string
+                default_user_group_id:
+                  type: string
+                identity_handler_config:
+                  type: object
+                  additionalProperties: true
+                matched_policy_id:
+                  type: string
+                name:
+                  type: string
+                org_id:
+                  type: string
+                profile_id:
+                  type: string
+                provider_config:
+                  type: object
+                  additionalProperties: true
+                provider_constraints_domain:
+                  type: string
+                provider_constraints_group:
+                  type: string
+                provider_name:
+                  type: string
+                return_url:
+                  type: string
+                sso_only_for_registered_users:
+                  type: boolean
+                type:
+                  type: string
+                user_group_mapping:
+                  type: object
+                  additionalProperties:
+                    type: string
+                user_group_separator:
+                  type: string
+            type:
+              type: string
+      description: Profile input model
+    api.ProfileListItem:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            name:
+              type: string
+            profile_id:
+              type: string
+            profile_type:
+              type: string
+            provider_type:
+              type: string
+            updated_at:
+              type: string
+            updated_by:
+              type: string
+            use_in_login_page:
+              type: boolean
+        id:
+          type: integer
+        type:
+          type: string
+      description: Profile list item model
+    api.ProfileResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            action_type:
+              type: string
+            callback_url:
+              type: string
+            custom_email_field:
+              type: string
+            custom_user_group_field:
+              type: string
+            custom_user_id_field:
+              type: string
+            default_user_group_id:
+              type: string
+            failure_redirect_url:
+              type: string
+            identity_handler_config:
+              type: object
+              additionalProperties: true
+            login_url:
+              type: string
+            matched_policy_id:
+              type: string
+            name:
+              type: string
+            org_id:
+              type: string
+            profile_id:
+              type: string
+            provider_config:
+              type: object
+              additionalProperties: true
+            provider_constraints_domain:
+              type: string
+            provider_constraints_group:
+              type: string
+            provider_name:
+              type: string
+            return_url:
+              type: string
+            selected_provider_type:
+              type: string
+            sso_only_for_registered_users:
+              type: boolean
+            type:
+              type: string
+            use_in_login_page:
+              type: boolean
+            user_group_mapping:
+              type: object
+              additionalProperties:
+                type: string
+            user_group_separator:
+              type: string
+        id:
+          type: integer
+        type:
+          type: string
+      description: Profile response model
+    api.ProfilesResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.ProfileListItem'
+        meta:
+          type: object
+          properties:
+            page_number:
+              type: integer
+            page_size:
+              type: integer
+            total_count:
+              type: integer
+            total_pages:
+              type: integer
+      description: Profiles list response model
+    api.PromptTemplateResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            chat_id:
+              type: integer
+            name:
+              type: string
+            prompt:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+      description: Prompt Template response model
+    api.RegisterInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                email:
+                  type: string
+                name:
+                  type: string
+                password:
+                  type: string
+                with_chat:
+                  type: boolean
+                with_portal:
+                  type: boolean
+            type:
+              type: string
+      description: Register input model
+    api.RegisterOAuthClientInput:
+      required:
+      - client_name
+      - redirect_uris
+      type: object
+      properties:
+        client_name:
+          type: string
+        grant_types:
+          type: array
+          items:
+            type: string
+        redirect_uris:
+          type: array
+          items:
+            type: string
+        response_types:
+          type: array
+          items:
+            type: string
+        scope:
+          type: string
+          description: Optional
+        token_endpoint_auth_method:
+          type: string
+    api.RegisterOAuthClientOutput:
+      type: object
+      properties:
+        client_id:
+          type: string
+        client_name:
+          type: string
+        client_secret:
+          type: string
+          description: Only shown once
+        client_secret_expires_at:
+          type: integer
+          description: "RFC7591: 0 means never expires"
+        grant_types:
+          type: array
+          items:
+            type: string
+        redirect_uris:
+          type: array
+          items:
+            type: string
+        response_types:
+          type: array
+          items:
+            type: string
+        scope:
+          type: string
+        token_endpoint_auth_method:
+          type: string
+    api.RegisterResponse:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                message:
+                  type: string
+            type:
+              type: string
+      description: Register response model
+    api.ReloadResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            message:
+              type: string
+            operation_id:
+              type: string
+            status:
+              type: string
+            target_namespace:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+    api.ResendVerificationInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                email:
+                  type: string
+            type:
+              type: string
+      description: Resend Verification input model
+    api.ResendVerificationResponse:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                message:
+                  type: string
+            type:
+              type: string
+      description: ResendVerification response model
+    api.ResetPasswordInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                password:
+                  type: string
+                token:
+                  type: string
+            type:
+              type: string
+      description: Reset Password input model
+    api.ResetPasswordResponse:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                message:
+                  type: string
+            type:
+              type: string
+      description: ResetPassword response model
+    api.SecretInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                value:
+                  type: string
+                var_name:
+                  type: string
+            type:
+              type: string
+      description: Secret input model
+    api.SecretListResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/api.SecretResponse'
+        meta:
+          type: object
+          properties:
+            page_number:
+              type: integer
+            page_size:
+              type: integer
+            total_count:
+              type: integer
+            total_pages:
+              type: integer
+      description: Secret list response model
+    api.SecretResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            value:
+              type: string
+            var_name:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+      description: Secret response model
+    api.SimplifiedDataSourceResponse:
+      type: object
+      properties:
+        id:
+          type: integer
+        name:
+          type: string
+    api.SimplifiedToolResponse:
+      type: object
+      properties:
+        id:
+          type: integer
+        name:
+          type: string
+    api.SubmitConsentInput:
+      required:
+      - auth_req_id
+      - decision
+      type: object
+      properties:
+        auth_req_id:
+          type: string
+        decision:
+          type: string
+        selected_app_id:
+          type: integer
+    api.SuccessResponse:
+      type: object
+      properties:
+        message:
+          type: string
+    api.TagInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                name:
+                  type: string
+            type:
+              type: string
+      description: Tag input model
+    api.TagResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            name:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+      description: Tag response model
+    api.ToolCatalogueInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                icon:
+                  type: string
+                long_description:
+                  type: string
+                name:
+                  type: string
+                short_description:
+                  type: string
+            type:
+              type: string
+      description: Tool Catalogue input model
+    api.ToolCatalogueResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            icon:
+              type: string
+            long_description:
+              type: string
+            name:
+              type: string
+            short_description:
+              type: string
+            tags:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.TagResponse'
+            tools:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.ToolResponse'
+        id:
+          type: string
+        type:
+          type: string
+      description: Tool Catalogue response model
+    api.ToolCatalogueTagInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            id:
+              type: string
+            type:
+              type: string
+      description: Tool Catalogue-Tag relationship input model
+    api.ToolCatalogueToolInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            id:
+              type: string
+            type:
+              type: string
+      description: Tool Catalogue-Tool relationship input model
+    api.ToolInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                auth_key:
+                  type: string
+                auth_schema_name:
+                  type: string
+                description:
+                  type: string
+                name:
+                  type: string
+                namespace:
+                  type: string
+                oas_spec:
+                  type: string
+                operations:
+                  type: array
+                  items:
+                    type: string
+                privacy_score:
+                  type: integer
+                tool_type:
+                  type: string
+            type:
+              type: string
+      description: Tool input model
+    api.ToolResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            active:
+              type: boolean
+            auth_key:
+              type: string
+            auth_schema_name:
+              type: string
+            dependencies:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.ToolResponse'
+            description:
+              type: string
+            file_stores:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.FileStoreResponse'
+            filters:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.FilterResponse'
+            has_auth_key:
+              type: boolean
+            name:
+              type: string
+            namespace:
+              type: string
+            oas_spec:
+              type: string
+            operations:
+              type: array
+              items:
+                type: string
+            privacy_score:
+              type: integer
+            tool_type:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+      description: Tool response model
+    api.UpdateBrandingSettingsRequest:
+      type: object
+      properties:
+        app_title:
+          type: string
+        background_color:
+          type: string
+        custom_css:
+          type: string
+        primary_color:
+          type: string
+        secondary_color:
+          type: string
+    api.UserAccessibleCataloguesResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            catalogues:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.CatalogueResponse'
+        id:
+          type: string
+        type:
+          type: string
+      description: User accessible catalogues response model
+    api.UserGroupInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            id:
+              type: string
+            type:
+              type: string
+      description: User-group relationship input model
+    api.UserInput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                access_to_sso_config:
+                  type: boolean
+                email:
+                  type: string
+                email_verified:
+                  type: boolean
+                groups:
+                  type: array
+                  items:
+                    type: integer
+                is_admin:
+                  type: boolean
+                name:
+                  type: string
+                notifications_enabled:
+                  type: boolean
+                password:
+                  type: string
+                show_chat:
+                  type: boolean
+                show_portal:
+                  type: boolean
+            type:
+              type: string
+      description: User input model
+    api.UserResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            access_to_sso_config:
+              type: boolean
+            api_key:
+              type: string
+            email:
+              type: string
+            email_verified:
+              type: boolean
+            groups:
+              type: array
+              items:
+                $ref: '#/components/schemas/api.GroupResponse'
+            is_admin:
+              type: boolean
+            name:
+              type: string
+            notifications_enabled:
+              type: boolean
+            role:
+              type: string
+            show_chat:
+              type: boolean
+            show_portal:
+              type: boolean
+        id:
+          type: string
+        type:
+          type: string
+      description: User response model
+    api.UserWithEntitlementsResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            email:
+              type: string
+            entitlements:
+              type: object
+              properties:
+                catalogues:
+                  type: array
+                  items:
+                    $ref: '#/components/schemas/api.CatalogueResponse'
+                chats:
+                  type: array
+                  items:
+                    $ref: '#/components/schemas/api.ChatResponse'
+                data_catalogues:
+                  type: array
+                  items:
+                    $ref: '#/components/schemas/api.DataCatalogueResponse'
+                tool_catalogues:
+                  type: array
+                  items:
+                    $ref: '#/components/schemas/api.ToolCatalogueResponse'
+            is_admin:
+              type: boolean
+            is_super_admin:
+              type: boolean
+            name:
+              type: string
+            ui_options:
+              type: object
+              properties:
+                show_chat:
+                  type: boolean
+                show_portal:
+                  type: boolean
+                show_sso_config:
+                  type: boolean
+                skip_quick_start:
+                  type: boolean
+        id:
+          type: string
+        type:
+          type: string
+      description: User with entitlements response model
+    api.ValidateAndLoadResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            command:
+              type: string
+            config_schema:
+              type: object
+              additionalProperties: true
+            hook_types:
+              type: array
+              items:
+                type: string
+            loaded_at:
+              type: string
+            manifest:
+              type: object
+              additionalProperties: true
+            primary_hook:
+              type: string
+            scopes:
+              type: array
+              items:
+                type: string
+            status:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+    api.VendorListResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            type: string
+      description: Vendor list response model
+    api.VerifyEmailResponse:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            attributes:
+              type: object
+              properties:
+                message:
+                  type: string
+            type:
+              type: string
+      description: VerifyEmail response model
+    api.WorkflowStatusResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            last_manifest_loaded_at:
+              type: string
+            requires_approval:
+              type: boolean
+            service_access_authorized:
+              type: boolean
+            service_scopes:
+              type: array
+              items:
+                type: string
+            status:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+    compliance.AccessIssue:
+      type: object
+      properties:
+        app_id:
+          type: integer
+        app_name:
+          type: string
+        count:
+          type: integer
+        last_occurred:
+          type: string
+        response_code:
+          type: integer
+    compliance.AccessIssuesData:
+      type: object
+      properties:
+        by_app:
+          type: array
+          description: Issues grouped by app
+          items:
+            $ref: '#/components/schemas/compliance.AccessIssue'
+        by_code:
+          type: object
+          additionalProperties:
+            type: integer
+          description: Count per response code
+        timeline:
+          type: array
+          description: Daily breakdown
+          items:
+            $ref: '#/components/schemas/compliance.TimelineData'
+        total_401:
+          type: integer
+        total_403:
+          type: integer
+        total_4xx:
+          type: integer
+    compliance.AppRiskProfile:
+      type: object
+      properties:
+        app_id:
+          type: integer
+        app_name:
+          type: string
+        budget_status:
+          $ref: '#/components/schemas/compliance.BudgetAlert'
+        owner_email:
+          type: string
+        owner_id:
+          type: integer
+        recent_violations:
+          type: array
+          items:
+            $ref: '#/components/schemas/compliance.ViolationEvent'
+        risk_level:
+          type: string
+        risk_score:
+          type: integer
+        summary:
+          $ref: '#/components/schemas/compliance.ComplianceSummary'
+    compliance.BudgetAlert:
+      type: object
+      properties:
+        alert_level:
+          type: string
+          description: "warning (>80%), critical (>95%)"
+        budget:
+          type: number
+        entity_id:
+          type: integer
+        entity_type:
+          type: string
+          description: App or LLM
+        name:
+          type: string
+        owner_email:
+          type: string
+        owner_id:
+          type: integer
+        percentage:
+          type: number
+        spent:
+          type: number
+        velocity:
+          type: number
+          description: Spending rate per day
+    compliance.BudgetAlertsData:
+      type: object
+      properties:
+        alerts:
+          type: array
+          items:
+            $ref: '#/components/schemas/compliance.BudgetAlert'
+        critical_count:
+          type: integer
+          description: '>95%'
+        timeline:
+          type: array
+          description: Daily spending
+          items:
+            $ref: '#/components/schemas/compliance.TimelineData'
+        warning_count:
+          type: integer
+          description: '>80%'
+    compliance.ComplianceEventRecord:
+      type: object
+      properties:
+        app_id:
+          type: integer
+        app_name:
+          type: string
+        description:
+          type: string
+        event_type:
+          type: string
+        filter_name:
+          type: string
+        filter_scope:
+          type: string
+        id:
+          type: integer
+        llm_id:
+          type: integer
+        metadata:
+          type: object
+          additionalProperties: true
+        model_name:
+          type: string
+        severity:
+          type: string
+        timestamp:
+          type: string
+        user_id:
+          type: integer
+        vendor:
+          type: string
+    compliance.ComplianceEventsData:
+      type: object
+      properties:
+        by_filter:
+          type: object
+          additionalProperties:
+            type: integer
+        by_severity:
+          type: object
+          additionalProperties:
+            type: integer
+        by_type:
+          type: object
+          additionalProperties:
+            type: integer
+        events:
+          type: array
+          items:
+            $ref: '#/components/schemas/compliance.ComplianceEventRecord'
+        timeline:
+          type: array
+          items:
+            $ref: '#/components/schemas/compliance.TimelineData'
+        total_count:
+          type: integer
+    compliance.ComplianceSummary:
+      type: object
+      properties:
+        auth_failures:
+          type: integer
+        auth_failures_trend:
+          type: number
+          description: '% change from previous period'
+        budget_alerts:
+          type: integer
+          description: Apps >80% budget
+        budget_trend:
+          type: number
+        compliance_events_critical:
+          type: integer
+        compliance_events_critical_trend:
+          type: number
+        compliance_events_warning:
+          type: integer
+          description: |-
+            Script-emitted compliance events (e.g. PII redacted, content rewritten).
+            Distinct from PolicyViolations, which only counts request-blocking 4xx responses.
+        compliance_events_warning_trend:
+          type: number
+        error_rate:
+          type: number
+          description: '% of 5xx errors'
+        error_trend:
+          type: number
+        policy_trend:
+          type: number
+        policy_violations:
+          type: integer
+        total_requests:
+          type: integer
+    compliance.ErrorData:
+      type: object
+      properties:
+        by_vendor:
+          type: object
+          additionalProperties:
+            type: integer
+        error_rate:
+          type: number
+        timeline:
+          type: array
+          items:
+            $ref: '#/components/schemas/compliance.TimelineData'
+        total_5xx:
+          type: integer
+    compliance.HighRiskApp:
+      type: object
+      properties:
+        app_id:
+          type: integer
+        app_name:
+          type: string
+        auth_failures:
+          type: integer
+          description: Breakdown of risk factors
+        budget_percent:
+          type: number
+        compliance_events_critical:
+          type: integer
+        compliance_events_warning:
+          type: integer
+        error_count:
+          type: integer
+        issues:
+          type: array
+          description: Human-readable issue summaries
+          items:
+            type: string
+        owner_email:
+          type: string
+        owner_id:
+          type: integer
+        policy_violations:
+          type: integer
+        risk_level:
+          type: string
+          description: "HIGH, MEDIUM, LOW"
+        risk_score:
+          type: integer
+    compliance.PolicyViolation:
+      type: object
+      properties:
+        app_id:
+          type: integer
+        app_name:
+          type: string
+        count:
+          type: integer
+        last_occurred:
+          type: string
+        violation_types:
+          type: array
+          description: "filter_block, model_access, budget_exceeded, auth_failure"
+          items:
+            type: string
+    compliance.PolicyViolationsData:
+      type: object
+      properties:
+        filter_blocks:
+          type: array
+          items:
+            $ref: '#/components/schemas/compliance.PolicyViolation'
+        model_violations:
+          type: array
+          items:
+            $ref: '#/components/schemas/compliance.PolicyViolation'
+        timeline:
+          type: array
+          items:
+            $ref: '#/components/schemas/compliance.TimelineData'
+        total_blocks:
+          type: integer
+          description: TotalBlocks counts requests that were actually blocked (4xx
+            in proxy_logs).
+        total_flagged:
+          type: integer
+          description: |-
+            TotalFlagged counts script-emitted compliance events (warning + critical)
+            where the request was allowed through but the filter raised a concern
+            (e.g. PII redaction, content rewrite).
+    compliance.TimelineData:
+      type: object
+      properties:
+        count:
+          type: integer
+        date:
+          type: string
+    compliance.ViolationEvent:
+      type: object
+      properties:
+        details:
+          type: string
+        event_type:
+          type: string
+        filter_name:
+          type: string
+        response_code:
+          type: integer
+        severity:
+          type: string
+          description: Populated when Type is "compliance_event" (script-emitted).
+        timestamp:
+          type: string
+        type:
+          type: string
+          description: "auth_failure, policy_violation, budget_exceeded, error, compliance_event"
+    compliance.ViolationRecord:
+      type: object
+      properties:
+        app_id:
+          type: integer
+        app_name:
+          type: string
+        error_detail:
+          type: string
+        filter_name:
+          type: string
+        id:
+          type: integer
+        response_code:
+          type: integer
+        timestamp:
+          type: string
+        vendor:
+          type: string
+        violation_type:
+          type: string
+          description: "filter_block, model_access, budget_exceeded, auth_failure"
+    models.AppBudgetUsageResponse:
+      type: object
+      properties:
+        current_usage:
+          type: number
+        monthly_budget:
+          type: number
+        percentage:
+          type: number
+        start_date:
+          type: string
+    models.BudgetUsage:
+      type: object
+      properties:
+        budget:
+          type: number
+        budget_start_date:
+          type: string
+        entity_id:
+          type: integer
+        entity_type:
+          type: string
+          description: '"LLM" or "App"'
+        name:
+          type: string
+        spent:
+          type: number
+        total_cost:
+          type: number
+          description: cost for the specified date range
+        total_tokens:
+          type: integer
+          description: total tokens for the specified date range
+        usage:
+          type: number
+          description: percentage
+        user_email:
+          type: string
+          description: Email of the user who owns the app (pointer to handle null
+            case)
+        user_id:
+          type: integer
+          description: ID of the user who owns the app
+    models.Dataset:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            type: number
+        label:
+          type: string
+        yAxisID:
+          type: string
+    models.ErrorResponse:
+      type: object
+      properties:
+        errors:
+          type: array
+          items:
+            type: object
+            properties:
+              detail:
+                type: string
+              title:
+                type: string
+    models.ExportSourceType:
+      type: string
+      enum:
+      - app
+      - llm
+      - user
+      x-enum-varnames:
+      - ExportSourceApp
+      - ExportSourceLLM
+      - ExportSourceUser
+    models.ExportStatus:
+      type: string
+      enum:
+      - pending
+      - processing
+      - completed
+      - failed
+      - expired
+      x-enum-varnames:
+      - ExportStatusPending
+      - ExportStatusProcessing
+      - ExportStatusCompleted
+      - ExportStatusFailed
+      - ExportStatusExpired
+    models.MultiAxisChartData:
+      type: object
+      properties:
+        datasets:
+          type: array
+          items:
+            $ref: '#/components/schemas/models.Dataset'
+        labels:
+          type: array
+          items:
+            type: string
+    models.PaginatedProxyLogs:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/models.ProxyLogResponse'
+        meta:
+          type: object
+          properties:
+            page_number:
+              type: integer
+            page_size:
+              type: integer
+            total_count:
+              type: integer
+            total_pages:
+              type: integer
+    models.ProxyLogExportAttributes:
+      type: object
+      properties:
+        completed_at:
+          type: string
+        end_date:
+          type: string
+        error_message:
+          type: string
+        expires_at:
+          type: string
+        export_id:
+          type: string
+        file_size:
+          type: integer
+        requested_at:
+          type: string
+        requested_by:
+          type: integer
+        search_filter:
+          type: string
+        source_id:
+          type: integer
+        source_type:
+          $ref: '#/components/schemas/models.ExportSourceType'
+        start_date:
+          type: string
+        status:
+          $ref: '#/components/schemas/models.ExportStatus'
+        total_records:
+          type: integer
+    models.ProxyLogExportResponse:
+      type: object
+      properties:
+        attributes:
+          $ref: '#/components/schemas/models.ProxyLogExportAttributes'
+        id:
+          type: string
+        type:
+          type: string
+    models.ProxyLogResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            app_id:
+              type: integer
+            request_body:
+              type: string
+            response_body:
+              type: string
+            response_code:
+              type: integer
+            time_stamp:
+              type: string
+            user_id:
+              type: integer
+            vendor:
+              type: string
+        id:
+          type: string
+        type:
+          type: string
+    models.VendorModelCost:
+      type: object
+      properties:
+        currency:
+          type: string
+        model:
+          type: string
+        totalCost:
+          type: number
+        vendor:
+          type: string
+    providers.APISpec:
+      type: object
+      properties:
+        description:
+          type: string
+        id:
+          type: string
+        name:
+          type: string
+        operations:
+          type: array
+          items:
+            type: string
+        security_details:
+          $ref: '#/components/schemas/providers.SecurityDetails'
+        source:
+          type: string
+        spec:
+          type: string
+    providers.ImportMethod:
+      type: object
+      properties:
+        description:
+          type: string
+          description: Description of the import method
+        name:
+          type: string
+          description: Display name for the method
+        needs_config:
+          type: boolean
+          description: Whether this method needs configuration
+        provider:
+          type: string
+          description: "Provider ID (\"tyk\", \"direct\", etc.)"
+        type:
+          type: string
+          description: "\"provider\", \"url\", or \"file\""
+    providers.ImportStep:
+      type: object
+      properties:
+        current_step:
+          type: integer
+          description: Current step number
+        methods:
+          type: array
+          description: Available import methods for this step
+          items:
+            $ref: '#/components/schemas/providers.ImportMethod'
+        provider:
+          type: string
+          description: Provider ID
+        total_steps:
+          type: integer
+          description: Total number of steps
+        type:
+          type: string
+          description: "\"config\", \"select_api\", \"import_method\""
+    providers.ProviderConfig:
+      type: object
+      properties:
+        selected_api_id:
+          type: string
+        token:
+          type: string
+        url:
+          type: string
+    providers.SecurityDetails:
+      type: object
+      properties:
+        in:
+          type: string
+        name:
+          type: string
+        type:
+          type: string
+    services.CreateOCIPluginRequest:
+      required:
+      - hook_type
+      - name
+      - oci_reference
+      type: object
+      properties:
+        config:
+          type: object
+          additionalProperties: true
+        description:
+          type: string
+        hook_type:
+          type: string
+        is_active:
+          type: boolean
+        name:
+          type: string
+        namespace:
+          type: string
+        oci_reference:
+          type: string
+    services.CreatePluginRequest:
+      required:
+      - command
+      - name
+      type: object
+      properties:
+        checksum:
+          type: string
+          description: Optional
+        command:
+          type: string
+        config:
+          type: object
+          additionalProperties: true
+        description:
+          type: string
+        hook_type:
+          type: string
+          description: Optional - will be populated from manifest
+        hook_types:
+          type: array
+          items:
+            type: string
+        hook_types_customized:
+          type: boolean
+        is_active:
+          type: boolean
+        load_immediately:
+          type: boolean
+          description: Auto-load AI Studio plugins
+        name:
+          type: string
+        namespace:
+          type: string
+        oci_reference:
+          type: string
+          description: OCI artifact reference
+    services.UpdatePluginRequest:
+      type: object
+      properties:
+        checksum:
+          type: string
+        command:
+          type: string
+        config:
+          type: object
+          additionalProperties: true
+        description:
+          type: string
+        hook_type:
+          type: string
+        hook_types:
+          type: array
+          items:
+            type: string
+        hook_types_customized:
+          type: boolean
+        is_active:
+          type: boolean
+        load_immediately:
+          type: boolean
+          description: Auto-load AI Studio plugins
+        name:
+          type: string
+        namespace:
+          type: string
+        oci_reference:
+          type: string
+    sso.NonceTokenRequest:
+      type: object
+      properties:
+        displayName:
+          type: string
+        emailAddress:
+          type: string
+        expiresAt:
+          type: string
+        forSection:
+          type: string
+        groupID:
+          type: string
+        groupsIDs:
+          type: array
+          items:
+            type: string
+        orgID:
+          type: string
+        ssoonlyForRegisteredUsers:
+          type: boolean
+    sso.NonceTokenResponse:
+      type: object
+      properties:
+        Message:
+          type: string
+        Meta:
+          type: string
+        Status:
+          type: string
+  securitySchemes:
+    BearerAuth:
+      type: apiKey
+      name: Authorization
+      in: header
+x-original-swagger-version: "2.0"
diff --git a/swagger/dashboard-admin-swagger.yml b/swagger/dashboard-admin-swagger.yml
new file mode 100644
index 0000000000..d57309b0f6
--- /dev/null
+++ b/swagger/dashboard-admin-swagger.yml
@@ -0,0 +1,4427 @@
+openapi: 3.0.3
+info:
+  contact:
+    email: support@tyk.io
+    name: Tyk Technologies
+    url: https://tyk.io/contact
+  description: |-
+    <img src="https://tyk.io/docs/img/dashboard_admin_swagger_image.png" width="963" height="250">
+   
+    For Tyk On-Premises installations only, the Dashboard Admin API has two endpoints and is used to set up and provision a Tyk Dashboard instance without the command line.
+
+    In order to use the Dashboard Admin API, you'll need to get the `admin_secret` value from your Tyk Dashboard configurations.
+
+    The secret you set should then be sent along as a header with each Dashboard Admin API Request in order for it to be successful:
+
+    ```
+    admin-auth: <your-secret>
+    ```
+  license:
+    name: Mozilla Public License Version 2.0
+    url: https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md
+  title: Tyk Dashboard Admin API
+  version: 5.13.0
+servers:
+- url: https://{tenant}
+  variables:
+    tenant:
+      default: localhost:3000
+      description: Your dashboard host
+security:
+- api_key: []
+tags:
+- description: The import API enables you to add Organisations, APIs and Policies
+    back into a Tyk installation while retaining their base IDs so that they work
+    together.
+  name: Import
+- description: To make Tyk installations more portable, the Export API enables you
+    to export key configuration objects required to back-up and re-deploy a basic
+    Tyk Pro installation.
+  name: Export
+- description: The admin portion of the users API gives you the ability to manage
+    password reset policies for your Dashboard users.
+  name: Users
+- description: Since the Dashboard can have multiple URLs associated with it. It is
+    possible to force a URL reload by calling an API endpoint of the Dashboard API.
+  name: Dashboard URL Reload
+- description: The organisations API gives the ability to manage your Tyk organisation(s).
+  name: Organisations
+- description: The Dashboard exposes the /admin/sso Dashboard API which allows you
+    to generate a temporary authentication token, valid for 60 seconds.
+  name: Single Sign On
+paths:
+  /admin/apis/import:
+    post:
+      description: The import APIs operates on lists of APIs.
+      operationId: importAPIs
+      requestBody:
+        content:
+          application/json:
+            example:
+              apis:
+              - api_definition:
+                  api_id: 5fa2db834e07444f760b7ceb314209fb
+                  name: API 2
+                hook_references: []
+                is_streams: false
+                sort_by: 0
+            schema:
+              $ref: '#/components/schemas/ApiDefinitions'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: APIs imported
+                Meta:
+                  5fa2db834e07444f760b7ceb314209fb: true
+                  7a6ddeca9244448a4233866938a0d6e2: true
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: OK
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Internal Server Error
+      summary: Import APIs
+      tags:
+      - Import
+  /admin/oauth/tokens:
+    delete:
+      description: Purge OAuth tokens.
+      operationId: deleteOAuthTokens
+      parameters:
+      - description: This is required
+        example: lapsed
+        in: query
+        name: scope
+        required: true
+        schema:
+          enum:
+          - lapsed
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: success
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Purge lapsed successfully
+        "400":
+          content:
+            application/json:
+              example:
+                Message: unknown scope
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: unknown scope
+        "422":
+          content:
+            application/json:
+              example:
+                Message: scope parameter is required
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Scope missing
+        "500":
+          content:
+            application/json:
+              example:
+                Message: purging lapsed oauth tokens failed
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: purging lapsed oauth
+      summary: Purge OAuth tokens.
+      tags:
+      - Oauth
+  /admin/org/keys:
+    get:
+      description: Lists keys that grant access to the API with the ID {apiID}.
+      operationId: getAllKeys
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                data:
+                  keys:
+                  - 5e9d9544a1dcd60001d0ed20a28c495beff140a4a6d8c272a1956b99
+                  - 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+                  - 5e9d9544a1dcd60001d0ed2060ff87c0deab4a508dd2ac18ccb8b664
+                pages: 1
+              schema:
+                $ref: '#/components/schemas/Keys'
+          description: Paginated key IDs.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve keys
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal keys data from Tyk API
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Internal Server Error
+      summary: List keys by API.
+      tags:
+      - keys
+    post:
+      description: Creates a key.
+      operationId: createOrgKey
+      requestBody:
+        content:
+          application/json:
+            example:
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 62a0ec9092faf50001395817
+              enable_detailed_recording: true
+              expires: 1.718439136e+09
+              hmac_enabled: false
+              is_inactive: false
+              meta_data:
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: -1
+              quota_remaining: 0
+              quota_renewal_rate: -1
+              quota_renews: 1.715847135e+09
+              rate: 1000
+              tags:
+              - edge-eu
+              - edge
+              throttle_interval: 0
+              throttle_retry_limit: 0
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: Key added successfully
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'Failed to save new session object to Tyk:'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: 'Failed to save new session object to Tyk:'
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Could not read request body
+      summary: Create a key.
+      tags:
+      - keys
+  /admin/org/keys/{keyId}:
+    delete:
+      description: Deleting a key will remove it permanently from the system.
+      operationId: deleteOrgKey
+      parameters:
+      - description: The ID of the key.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Key deleted successfully
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Key deleted
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not delete key
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Internal Server Error
+      summary: Delete key.
+      tags:
+      - keys
+    get:
+      description: Get the details of a key.
+      operationId: getOrgKey
+      parameters:
+      - description: The ID of the key.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: Key Data fetched.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not get Org key details
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal key data from Tyk API
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Failed to unmarshal key data from Tyk API
+      summary: Get key Details.
+      tags:
+      - keys
+    put:
+      description: Update a key with it's id.
+      operationId: updateOrgKey
+      parameters:
+      - description: The ID of the key.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 62a0ec9092faf50001395817
+              enable_detailed_recording: true
+              expires: 1.718439136e+09
+              hmac_enabled: false
+              is_inactive: false
+              meta_data:
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: -1
+              quota_remaining: 0
+              quota_renewal_rate: -1
+              quota_renews: 1.715847135e+09
+              rate: 1000
+              tags:
+              - edge-eu
+              - edge
+              throttle_interval: 0
+              throttle_retry_limit: 0
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Key updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Key updated
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Failed to update session object to Tyk
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Failed to update session object to Tyk
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Org key doesn't exist
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Org key doesn't exist
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Updating orgID of org key is not allowed
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: 'Invalid operation: Trying to update orgID of org key'
+      summary: Update key.
+      tags:
+      - keys
+  /admin/organisations:
+    get:
+      description: List all organisations
+      operationId: getOrgs
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                organisations:
+                - apis:
+                  - api_human_name: 'First API #Test'
+                    api_id: 5508bd9429434d5768c423a04db259ea
+                  cname: jive.ly
+                  cname_enabled: true
+                  developer_count: 0
+                  developer_quota: 0
+                  event_options: {}
+                  hybrid_enabled: false
+                  id: 5cc03283d07e7f00019404b3
+                  org_options_meta: {}
+                  owner_name: Jively
+                  owner_slug: testorg
+                  ui:
+                    cloud: false
+                    default_lang: ""
+                    designer: {}
+                    dont_allow_license_management: false
+                    dont_allow_license_management_view: false
+                    dont_show_admin_sockets: false
+                    hide_help: false
+                    languages: {}
+                    login_page: {}
+                    nav: {}
+                    portal_section: {}
+                    uptime: {}
+                - apis: []
+                  cname: second.ly
+                  cname_enabled: false
+                  developer_count: 5
+                  developer_quota: 10
+                  event_options: {}
+                  hybrid_enabled: true
+                  id: 5ccae84aa402ce00018b5435
+                  org_options_meta: {}
+                  owner_name: SecondOrg
+                  owner_slug: secondorg
+                  ui:
+                    cloud: false
+                    default_lang: ""
+                    designer: {}
+                    dont_allow_license_management: false
+                    dont_allow_license_management_view: false
+                    dont_show_admin_sockets: false
+                    hide_help: false
+                    languages: {}
+                    login_page: {}
+                    nav: {}
+                    portal_section: {}
+                    uptime: {}
+                pages: 0
+              schema:
+                $ref: '#/components/schemas/ApiRegister'
+          description: Organisations retrieved successfully
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve Organisations
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal orgs data from Tyk API
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Internal Server Error
+      summary: List all organisations
+      tags:
+      - Organisations
+    post:
+      description: Create an Organisation
+      operationId: createOrg
+      requestBody:
+        content:
+          application/json:
+            example:
+              cname: jive.ly
+              cname_enabled: true
+              owner_name: Jively
+            schema:
+              $ref: '#/components/schemas/OrganisationDocument'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Org created
+                Meta: 54b53d3aeba6db5c35000002
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Organisation created
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unmarshalling request body failed, malformed
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Could not read request body
+      summary: Create an Organisation
+      tags:
+      - Organisations
+  /admin/organisations/{orgID}:
+    delete:
+      description: Delete an organisation
+      operationId: deleteOrg
+      parameters:
+      - description: Organisation ID of the org to add, update, or delete.
+        example: 5e9f9b9b4d7b4a0020e3c4f5
+        in: path
+        name: orgID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Org deleted
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not delete the org
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve org detail
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Not Found
+      summary: Delete an organisation
+      tags:
+      - Organisations
+    get:
+      description: Retrieve a single organisation
+      operationId: getOrg
+      parameters:
+      - description: Organisation ID of the org to add, update, or delete.
+        example: 5e9f9b9b4d7b4a0020e3c4f5
+        in: path
+        required: true
+        name: orgID
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                apis:
+                - api_human_name: API 2
+                  api_id: 5fa2db834e07444f760b7ceb314209fb
+                - api_human_name: API 1
+                  api_id: 7a6ddeca9244448a4233866938a0d6e2
+                - api_human_name: API 3
+                  api_id: 109eacaa50b24b64651a1d4dce8ec385
+                cname: my.domain.com
+                cname_enabled: true
+                developer_count: 21
+                developer_quota: 123
+                event_options:
+                  key_event:
+                    email: ""
+                    redis: true
+                    webhook: ""
+                  key_request_event:
+                    email: ""
+                    redis: false
+                    webhook: ""
+                hybrid_enabled: false
+                id: 53ac07777cbb8c2d53000002
+                owner_name: Test
+                owner_slug: test
+                ui:
+                  default_lang: ""
+                  designer: {}
+                  dont_allow_license_management: false
+                  dont_allow_license_management_view: false
+                  dont_show_admin_sockets: false
+                  hide_help: false
+                  languages: {}
+                  login_page: {}
+                  nav: {}
+                  portal_section: {}
+                  uptime: {}
+              schema:
+                $ref: '#/components/schemas/OrganisationDocument'
+          description: Organisation retrieved
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve org detail
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Org not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal org data from DB
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Failed to marshal org data from DB
+      summary: Retrieve a single organisation
+      tags:
+      - Organisations
+    put:
+      description: Update Organisation details. This operation will replace the existing
+        Organisation details with those provided in the request payload. It is important
+        to provide the entire object - for example linked APIs - to avoid overwriting
+        existing data with empty values.
+      operationId: updateOrg
+      parameters:
+      - description: Organisation ID of the org to add, update, or delete.
+        example: 5e9f9b9b4d7b4a0020e3c4f5
+        in: path
+        name: orgID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              apis:
+              - api_human_name: 'First API #Test'
+                api_id: 5508bd9429434d5768c423a04db259ea
+              cname: jive.ly
+              cname_enabled: true
+              developer_count: 0
+              developer_quota: 0
+              event_options: {}
+              hybrid_enabled: false
+              id: 5cc03283d07e7f00019404b3
+              org_options_meta: {}
+              owner_name: Jively
+              owner_slug: testorg
+              ui:
+                cloud: false
+                default_lang: ""
+                designer: {}
+                dont_allow_license_management: false
+                dont_allow_license_management_view: false
+                dont_show_admin_sockets: false
+                hide_help: false
+                languages: {}
+                login_page: {}
+                nav: {}
+                portal_section: {}
+                uptime: {}
+            schema:
+              $ref: '#/components/schemas/OrganisationDocument'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Org updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Organisation updated successfully
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Failed to update Org object to DB
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read request body, body empty
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Internal Server Error
+      summary: Update organisation details
+      tags:
+      - Organisations
+  /admin/organisations/{orgID}/generate-portals:
+    post:
+      description: Generate Portals
+      operationId: generatePortalAPIsForOrg
+      parameters:
+      - description: Organisation ID
+        example: 5e9f9b9b4d7b4a0020e3c4f5
+        in: path
+        name: orgID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/FormDataCreateDomainRequest'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Org updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Org updated
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not generate APIs
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Could not generate APIs
+      summary: Generate Portals
+      tags:
+      - Organisations
+  /admin/organisations/import:
+    post:
+      description: The organisation object is the most fundamental object in a Tyk
+        setup, all other ownership properties hang off the relationship between an
+        organisation and it’s APIs, Policies and API Tokens.
+      operationId: importOrgs
+      requestBody:
+        content:
+          application/json:
+            example:
+              apis:
+              - api_human_name: API 2
+                api_id: 5fa2db834e07444f760b7ceb314209fb
+              - api_human_name: API 1
+                api_id: 7a6ddeca9244448a4233866938a0d6e2
+              - api_human_name: API 3
+                api_id: 109eacaa50b24b64651a1d4dce8ec385
+              cname: my.domain.com
+              cname_enabled: true
+              developer_count: 21
+              developer_quota: 123
+              event_options:
+                key_event:
+                  email: ""
+                  redis: true
+                  webhook: ""
+                key_request_event:
+                  email: ""
+                  redis: false
+                  webhook: ""
+              hybrid_enabled: false
+              id: 53ac07777cbb8c2d53000002
+              owner_name: Test
+              owner_slug: test
+              ui:
+                default_lang: ""
+                designer: {}
+                dont_allow_license_management: false
+                dont_allow_license_management_view: false
+                dont_show_admin_sockets: false
+                hide_help: false
+                languages: {}
+                login_page: {}
+                nav: {}
+                portal_section: {}
+                uptime: {}
+            schema:
+              $ref: '#/components/schemas/OrganisationDocument'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Org imported
+                Meta: 53ac07777cbb8c2d53000002
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Org imported successfully.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Failed to save new Org object to DB
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Back Request.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Failed to read response body, body empty
+      summary: Import organisations
+      tags:
+      - Import
+  /admin/policies/import:
+    post:
+      description: The import Policies operates on lists of Policies.
+      operationId: importPolicies
+      requestBody:
+        content:
+          application/json:
+            example:
+              Data:
+              - _id: ""
+                access_rights: null
+                active: true
+                date_created: "0001-01-01T00:00:00Z"
+                hmac_enabled: false
+                id: ""
+                is_inactive: false
+                key_expires_in: 0
+                last_updated: "1478791603"
+                max_query_depth: 0
+                meta_data: null
+                name: Default
+                org_id: 53ac07777cbb8c2d53000002
+                partitions:
+                  acl: false
+                  complexity: false
+                  per_api: false
+                  quota: false
+                  rate_limit: false
+                per: 60
+                quota_max: -1
+                quota_renewal_rate: 3600
+                rate: 1000
+                smoothing: null
+                tags: []
+                throttle_interval: 0
+                throttle_retry_limit: 0
+              Pages: 0
+            schema:
+              $ref: '#/components/schemas/ImportDataStruct'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Policies imported
+                Meta:
+                  61df10078f11dd00097cb55f: true
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: OK
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Internal Server Error
+      summary: Import Policies
+      tags:
+      - Import
+  /admin/sso:
+    post:
+      description: The Dashboard exposes the /admin/sso Dashboard API which allows
+        you to generate a temporary authentication token, valid for 60 seconds.
+      operationId: generateAuthToken
+      requestBody:
+        content:
+          application/json:
+            example:
+              DisplayName: ""
+              EmailAddress: name@somewhere.com
+              ForSection: dashboard
+              GroupID: ""
+              GroupsIDs: null
+              OrgID: 588b4f0bb275ff0001cc7471
+              SSOOnlyForRegisteredUsers: false
+              UserNotAllowed: false
+            schema:
+              $ref: '#/components/schemas/SSOAccessData'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: SSO Nonce created
+                Meta: YTNiOGUzZjctYWZkYi00OTNhLTYwODItZTAzMDI3MjM0OTEw
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Additional Permissions updated successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: 'Cannot create an SSO session for an invalid payload: [Error:
+                  Org id not found (''588b4f0bb275ff0001cc7471'').]'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Back Request.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Failed to save new SSO object to DB
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Failed to save new SSO object to DB
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Could not read request body
+      summary: Generate authentication token
+      tags:
+      - Single Sign On
+  /admin/system/reload:
+    get:
+      description: Reloads dashboard urls
+      operationId: reloadURLs
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ReloadResponse'
+          description: URLs reloaded successfully.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unauthorized
+      summary: Reloads dashboard urls
+      tags:
+      - Dashboard URL Reload
+  /admin/users:
+    post:
+      description: Add a user to the dashboard
+      operationId: createUser
+      requestBody:
+        content:
+          application/json:
+            example:
+              email_address: itachisasuke@gmail.com
+              first_name: itachi
+              last_name: sasuke
+            schema:
+              $ref: '#/components/schemas/User'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: c8251902f3f44dfa729e0267d0d62859
+                Meta:
+                  access_key: c8251902f3f44dfa729e0267d0d62859
+                  active: false
+                  api_model: {}
+                  created_at: "2025-03-10T11:10:52.988014+03:00"
+                  email_address: itachisasuke@gmail.com
+                  first_name: itachi
+                  group_id: ""
+                  id: "363739613032343635373135656364643530376437323733"
+                  last_login_date: "0001-01-01T00:00:00Z"
+                  last_name: sasuke
+                  org_id: ""
+                  password_max_days: 0
+                  password_updated: "0001-01-01T00:00:00Z"
+                  user_permissions:
+                    IsAdmin: admin
+                    ResetPassword: admin
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: User added successfully
+        "403":
+          content:
+            application/json:
+              example:
+                Message: User email already exists for this Org
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: User email already exists
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Could not read request body
+      summary: Create a user
+      tags:
+      - Users
+  /admin/users/{userId}:
+    get:
+      description: Get user summary with user id
+      operationId: getUserDetail
+      parameters:
+      - description: The Id of the user you want to get
+        example: 679a02465715ecdd507d7273
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                access_key: c8251902f3f44dfa729e0267d0d62859
+                active: false
+                email_address: itachisasuke@gmail.com
+                first_name: itachi
+                group_id: ""
+                id: 679a02465715ecdd507d7273
+                last_login_date: "0001-01-01T00:00:00Z"
+                last_name: sasuke
+                org_id: ""
+                password_max_days: 0
+                password_updated: "0001-01-01T00:00:00Z"
+                user_permissions:
+                  IsAdmin: admin
+                  ResetPassword: admin
+              schema:
+                $ref: '#/components/schemas/User'
+          description: user fetched successfully
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user detail
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: User not found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal user data from DB
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Failed to marshal user data from DB
+      summary: Get user details
+      tags:
+      - Users
+    put:
+      description: Update user details with the user ID
+      operationId: updateUser
+      parameters:
+      - description: The Id of the user you want to update
+        example: 679a02465715ecdd507d7273
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_key: c8251902f3f44dfa729e0267d0d62859
+              active: false
+              email_address: itachisasuke@gmail.com
+              first_name: itachi
+              id: 679a02465715ecdd507d7273
+              last_name: sasuke
+              org_id: ""
+            schema:
+              $ref: '#/components/schemas/User'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: c8251902f3f44dfa729e0267d0d62859
+                Meta:
+                  access_key: c8251902f3f44dfa729e0267d0d62859
+                  active: false
+                  api_model: {}
+                  created_at: "2025-03-10T11:10:52.986309+03:00"
+                  email_address: itachisasuke@gmail.com
+                  first_name: itachi
+                  group_id: ""
+                  id: "363739613032343635373135656364643530376437323733"
+                  last_login_date: "0001-01-01T00:00:00Z"
+                  last_name: sasuke
+                  org_id: ""
+                  password_max_days: 0
+                  password_updated: "0001-01-01T00:00:00Z"
+                  user_permissions:
+                    IsAdmin: admin
+                    ResetPassword: admin
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: User updated successfully
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Unmarshalling request body failed, malformed
+        "404":
+          content:
+            application/json:
+              example:
+                Message: User not found
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: User not found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Could not read request body
+      summary: Update user details
+      tags:
+      - Users
+  /admin/users/{userId}/actions/allow_reset_passwords:
+    put:
+      description: Allow password reset for a User.
+      operationId: allowResetPassword
+      parameters:
+      - description: User ID of the user whose password is being reset
+        example: 614215edb2d47190f98b3b79
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User updated
+                Meta:
+                  PWHistory: []
+                  access_key: 68b225c4376748207453c235ed8e2a82
+                  active: true
+                  created_at: "2021-09-15T15:49:01Z"
+                  email_address: john@test.com
+                  first_name: John
+                  group_id: ""
+                  id: 614215edb2d47190f98b3b79
+                  last_login_date: "2021-09-15T15:49:49.754Z"
+                  last_name: Doe
+                  org_id: 60ef3a1dcb83670001bf2df9
+                  password_max_days: 0
+                  password_updated: "2021-09-15T15:49:01.863Z"
+                  user_permissions:
+                    IsAdmin: admin
+                    ResetPassword: admin
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: OK
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Failed to update User object to DB
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user detail
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: User not found
+      summary: Allow password reset for a User
+      tags:
+      - Users
+  /admin/users/{userId}/actions/disallow_reset_passwords:
+    put:
+      description: Disallow password reset for a User.
+      operationId: disallowResetPassword
+      parameters:
+      - description: User ID of the user whose password is being reset
+        example: 614215edb2d47190f98b3b79
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User updated
+                Meta:
+                  PWHistory: []
+                  access_key: 68b225c4376748207453c235ed8e2a82
+                  active: true
+                  created_at: "2021-09-15T15:49:01Z"
+                  email_address: john@test.com
+                  first_name: John
+                  group_id: ""
+                  id: 614215edb2d47190f98b3b79
+                  last_login_date: "2021-09-15T15:49:49.754Z"
+                  last_name: Doe
+                  org_id: 60ef3a1dcb83670001bf2df9
+                  password_max_days: 0
+                  password_updated: "2021-09-15T15:49:01.863Z"
+                  user_permissions:
+                    IsAdmin: admin
+                    ResetPassword: admin
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: OK
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Failed to update User object to DB
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user detail
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiError'
+          description: User not found
+      summary: Disallow password reset for a User
+      tags:
+      - Users
+components:
+  schemas:
+    APIDefinition:
+      properties:
+        CORS:
+          $ref: '#/components/schemas/CORSConfig'
+        active:
+          type: boolean
+        allowed_ips:
+          items:
+            type: string
+          nullable: true
+          type: array
+        analytics_plugin:
+          $ref: '#/components/schemas/AnalyticsPluginConfig'
+        api_id:
+          type: string
+        auth:
+          $ref: '#/components/schemas/AuthConfig'
+        auth_configs:
+          additionalProperties:
+            $ref: '#/components/schemas/AuthConfig'
+          nullable: true
+          type: object
+        auth_provider:
+          $ref: '#/components/schemas/AuthProviderMeta'
+        base_identity_provided_by:
+          type: string
+        basic_auth:
+          properties:
+            body_password_regexp:
+              type: string
+            body_user_regexp:
+              type: string
+            cache_ttl:
+              type: integer
+            disable_caching:
+              type: boolean
+            extract_from_body:
+              type: boolean
+          type: object
+        blacklisted_ips:
+          items:
+            type: string
+          nullable: true
+          type: array
+        cache_options:
+          $ref: '#/components/schemas/CacheOptions'
+        certificate_pinning_disabled:
+          type: boolean
+        certificates:
+          items:
+            type: string
+          nullable: true
+          type: array
+        client_certificates:
+          items:
+            type: string
+          nullable: true
+          type: array
+        config_data:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        config_data_disabled:
+          type: boolean
+        custom_middleware:
+          $ref: '#/components/schemas/MiddlewareSection'
+        custom_middleware_bundle:
+          type: string
+        custom_middleware_bundle_disabled:
+          type: boolean
+        custom_plugin_auth_enabled:
+          type: boolean
+        definition:
+          $ref: '#/components/schemas/VersionDefinition'
+        detailed_tracing:
+          type: boolean
+        disable_quota:
+          type: boolean
+        disable_rate_limit:
+          type: boolean
+        do_not_track:
+          type: boolean
+        domain:
+          type: string
+        domain_disabled:
+          type: boolean
+        dont_set_quota_on_create:
+          type: boolean
+        enable_batch_request_support:
+          type: boolean
+        enable_context_vars:
+          type: boolean
+        enable_coprocess_auth:
+          type: boolean
+        enable_detailed_recording:
+          type: boolean
+        enable_ip_blacklisting:
+          type: boolean
+        enable_ip_whitelisting:
+          type: boolean
+        enable_jwt:
+          type: boolean
+        enable_proxy_protocol:
+          type: boolean
+        enable_signature_checking:
+          type: boolean
+        event_handlers:
+          $ref: '#/components/schemas/EventHandlerMetaConfig'
+        expiration:
+          type: string
+        expire_analytics_after:
+          format: int64
+          type: integer
+        external_oauth:
+          $ref: '#/components/schemas/ExternalOAuth'
+        global_rate_limit:
+          $ref: '#/components/schemas/GlobalRateLimit'
+        graphql:
+          $ref: '#/components/schemas/GraphQLConfig'
+        hmac_allowed_algorithms:
+          items:
+            type: string
+          nullable: true
+          type: array
+        hmac_allowed_clock_skew:
+          format: double
+          type: number
+        id:
+          type: string
+        idp_client_id_mapping_disabled:
+          type: boolean
+        internal:
+          type: boolean
+        ip_access_control_disabled:
+          type: boolean
+        is_oas:
+          type: boolean
+        jwt_client_base_field:
+          type: string
+        jwt_default_policies:
+          items:
+            type: string
+          nullable: true
+          type: array
+        jwt_expires_at_validation_skew:
+          minimum: 0
+          type: integer
+        jwt_identity_base_field:
+          type: string
+        jwt_issued_at_validation_skew:
+          minimum: 0
+          type: integer
+        jwt_not_before_validation_skew:
+          minimum: 0
+          type: integer
+        jwt_policy_field_name:
+          type: string
+        jwt_scope_claim_name:
+          type: string
+        jwt_scope_to_policy_mapping:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        jwt_signing_method:
+          type: string
+        jwt_skip_kid:
+          type: boolean
+        jwt_source:
+          type: string
+        listen_port:
+          type: integer
+        name:
+          type: string
+        notifications:
+          $ref: '#/components/schemas/NotificationsManager'
+        oauth_meta:
+          properties:
+            allowed_access_types:
+              items:
+                type: string
+              nullable: true
+              type: array
+            allowed_authorize_types:
+              items:
+                type: string
+              nullable: true
+              type: array
+            auth_login_redirect:
+              type: string
+          type: object
+        openid_options:
+          $ref: '#/components/schemas/OpenIDOptions'
+        org_id:
+          type: string
+        pinned_public_keys:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        protocol:
+          type: string
+        proxy:
+          $ref: '#/components/schemas/ProxyConfig'
+        request_signing:
+          $ref: '#/components/schemas/RequestSigningMeta'
+        response_processors:
+          items:
+            $ref: '#/components/schemas/ResponseProcessor'
+          nullable: true
+          type: array
+        scopes:
+          $ref: '#/components/schemas/Scopes'
+        session_lifetime:
+          format: int64
+          type: integer
+        session_lifetime_respects_key_expiration:
+          type: boolean
+        session_provider:
+          $ref: '#/components/schemas/SessionProviderMeta'
+        slug:
+          type: string
+        strip_auth_data:
+          type: boolean
+        tag_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        tags:
+          items:
+            type: string
+          nullable: true
+          type: array
+        tags_disabled:
+          type: boolean
+        upstream_auth:
+          $ref: '#/components/schemas/UpstreamAuth'
+        upstream_certificates:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        upstream_certificates_disabled:
+          type: boolean
+        uptime_tests:
+          $ref: '#/components/schemas/UptimeTests'
+        use_basic_auth:
+          type: boolean
+        use_go_plugin_auth:
+          type: boolean
+        use_keyless:
+          type: boolean
+        use_mutual_tls_auth:
+          type: boolean
+        use_oauth2:
+          type: boolean
+        use_openid:
+          type: boolean
+        use_standard_auth:
+          type: boolean
+        version_data:
+          $ref: '#/components/schemas/VersionData'
+      type: object
+    APILimit:
+      nullable: true
+      properties:
+        max_query_depth:
+          type: integer
+        per:
+          format: double
+          type: number
+        quota_max:
+          format: int64
+          type: integer
+        quota_remaining:
+          format: int64
+          type: integer
+        quota_renewal_rate:
+          format: int64
+          type: integer
+        quota_renews:
+          format: int64
+          type: integer
+        rate:
+          format: double
+          type: number
+        set_by_policy:
+          type: boolean
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+        throttle_interval:
+          format: double
+          type: number
+        throttle_retry_limit:
+          type: integer
+      type: object
+    AccessDefinition:
+      properties:
+        allowance_scope:
+          type: string
+        allowed_types:
+          items:
+            $ref: '#/components/schemas/GraphqlType'
+          nullable: true
+          type: array
+        allowed_urls:
+          items:
+            $ref: '#/components/schemas/AccessSpec'
+          nullable: true
+          type: array
+        api_id:
+          type: string
+        api_name:
+          type: string
+        disable_introspection:
+          type: boolean
+        endpoints:
+          items:
+            $ref: '#/components/schemas/SessionEndpoint'
+          type: array
+        field_access_rights:
+          items:
+            $ref: '#/components/schemas/FieldAccessDefinition'
+          nullable: true
+          type: array
+        limit:
+          $ref: '#/components/schemas/APILimit'
+        restricted_types:
+          items:
+            $ref: '#/components/schemas/GraphqlType'
+          nullable: true
+          type: array
+        versions:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    AccessSpec:
+      properties:
+        methods:
+          items:
+            type: string
+          nullable: true
+          type: array
+        url:
+          type: string
+      type: object
+    AllKeys:
+      properties:
+        keys:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    AnalyticsPluginConfig:
+      properties:
+        enable:
+          type: boolean
+        func_name:
+          type: string
+        plugin_path:
+          type: string
+      type: object
+    ApiDefinition:
+      properties:
+        api_definition:
+          $ref: '#/components/schemas/APIDefinition'
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        categories:
+          $ref: '#/components/schemas/Categories'
+        created_at:
+          format: date-time
+          nullable: true
+          type: string
+        hook_references:
+          items:
+            $ref: '#/components/schemas/HookReference'
+          nullable: true
+          type: array
+        is_site:
+          type: boolean
+        is_streams:
+          type: boolean
+        oas:
+          type: object
+          additionalProperties: {}
+          description: >
+            The OpenAPI 3.x specification object for this API definition.
+            For Tyk-specific OAS configuration, see https://tyk.io/docs/api-management/gateway-config-tyk-oas.
+        sort_by:
+          type: integer
+        updated_at:
+          format: date-time
+          nullable: true
+          type: string
+        user_group_owners:
+          items:
+            type: string
+          nullable: true
+          type: array
+        user_owners:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    ApiDefinitions:
+      properties:
+        apis:
+          items:
+            $ref: '#/components/schemas/ApiDefinition'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    ApiDocument:
+      properties:
+        api_human_name:
+          type: string
+        api_id:
+          type: string
+      type: object
+    ApiError:
+      properties:
+        ID:
+          type: string
+        Message:
+          type: string
+        Meta: {}
+        Status:
+          type: string
+      type: object
+    ApiModel:
+      type: object
+    ApiRegister:
+      properties:
+        organisations:
+          items:
+            $ref: '#/components/schemas/OrganisationDocument'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    AuthConfig:
+      properties:
+        auth_header_name:
+          type: string
+        cookie_name:
+          type: string
+        disable_header:
+          type: boolean
+        name:
+          type: string
+        param_name:
+          type: string
+        signature:
+          $ref: '#/components/schemas/SignatureConfig'
+        use_certificate:
+          type: boolean
+        use_cookie:
+          type: boolean
+        use_param:
+          type: boolean
+        validate_signature:
+          type: boolean
+      type: object
+    AuthProviderMeta:
+      properties:
+        meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        name:
+          type: string
+        storage_engine:
+          type: string
+      type: object
+    AuthSource:
+      properties:
+        enabled:
+          type: boolean
+        name:
+          type: string
+      type: object
+    CORSConfig:
+      properties:
+        allow_credentials:
+          type: boolean
+        allowed_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        allowed_methods:
+          items:
+            type: string
+          nullable: true
+          type: array
+        allowed_origins:
+          items:
+            type: string
+          nullable: true
+          type: array
+        debug:
+          type: boolean
+        enable:
+          type: boolean
+        exposed_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        max_age:
+          type: integer
+        options_passthrough:
+          type: boolean
+      type: object
+    CacheMeta:
+      properties:
+        cache_key_regex:
+          type: string
+        cache_response_codes:
+          items:
+            type: integer
+          nullable: true
+          type: array
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        timeout:
+          format: int64
+          type: integer
+      type: object
+    CacheOptions:
+      properties:
+        cache_all_safe_requests:
+          type: boolean
+        cache_by_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        cache_control_ttl_header:
+          type: string
+        cache_response_codes:
+          items:
+            type: integer
+          nullable: true
+          type: array
+        cache_timeout:
+          format: int64
+          type: integer
+        enable_cache:
+          type: boolean
+        enable_upstream_cache_control:
+          type: boolean
+      type: object
+    Categories:
+      items:
+        type: string
+      type: array
+    CheckCommand:
+      properties:
+        message:
+          type: string
+        name:
+          type: string
+      type: object
+    CircuitBreakerMeta:
+      properties:
+        disable_half_open_state:
+          type: boolean
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        return_to_service_after:
+          type: integer
+        samples:
+          format: int64
+          type: integer
+        threshold_percent:
+          format: double
+          type: number
+      type: object
+    ClientCredentials:
+      properties:
+        client_id:
+          type: string
+        client_secret:
+          type: string
+        extra_metadata:
+          items:
+            type: string
+          type: array
+        header:
+          $ref: '#/components/schemas/AuthSource'
+        scopes:
+          items:
+            type: string
+          type: array
+        token_url:
+          type: string
+      type: object
+    ConfigHubspotForm:
+      properties:
+        form_id:
+          type: string
+        portal_id:
+          type: string
+        region:
+          type: string
+      type: object
+    ConfigLabsConfig:
+      nullable: true
+      properties:
+        streaming:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+    ConfigOnboarding:
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    ConfigTrial:
+      properties:
+        end_date:
+          format: int64
+          type: integer
+        hubspot_form:
+          $ref: '#/components/schemas/ConfigHubspotForm'
+      type: object
+    ConfigUIOptions:
+      properties:
+        cloud:
+          type: boolean
+        cloudmenu:
+          type: boolean
+        default_lang:
+          type: string
+        designer:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        dev:
+          type: boolean
+        dont_allow_license_management:
+          type: boolean
+        dont_allow_license_management_view:
+          type: boolean
+        dont_show_admin_sockets:
+          type: boolean
+        hide_help:
+          type: boolean
+        labs:
+          $ref: '#/components/schemas/ConfigLabsConfig'
+        languages:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        login_page:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        nav:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        onboarding:
+          $ref: '#/components/schemas/ConfigOnboarding'
+        portal_section:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        trial:
+          $ref: '#/components/schemas/ConfigTrial'
+        uptime:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+    ConfigUserPermissionObject:
+      additionalProperties:
+        type: string
+      type: object
+    DBAccessDefinition:
+      properties:
+        allowed_types:
+          items:
+            $ref: '#/components/schemas/GraphqlType'
+          nullable: true
+          type: array
+        allowed_urls:
+          items:
+            $ref: '#/components/schemas/AccessSpec'
+          nullable: true
+          type: array
+        api_id:
+          type: string
+        api_name:
+          type: string
+        disable_introspection:
+          type: boolean
+        endpoints:
+          items:
+            $ref: '#/components/schemas/SessionEndpoint'
+          type: array
+        restricted_types:
+          items:
+            $ref: '#/components/schemas/GraphqlType'
+          nullable: true
+          type: array
+        versions:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    DBPolicy:
+      properties:
+        _id:
+          type: string
+        access_rights:
+          additionalProperties:
+            $ref: '#/components/schemas/DBAccessDefinition'
+          nullable: true
+          type: object
+        active:
+          type: boolean
+        date_created:
+          format: date-time
+          type: string
+        hmac_enabled:
+          type: boolean
+        id:
+          type: string
+        is_inactive:
+          type: boolean
+        key_expires_in:
+          format: int64
+          type: integer
+        last_updated:
+          type: string
+        max_query_depth:
+          type: integer
+        meta_data:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        name:
+          type: string
+        org_id:
+          type: string
+        partitions:
+          properties:
+            acl:
+              type: boolean
+            complexity:
+              type: boolean
+            per_api:
+              type: boolean
+            quota:
+              type: boolean
+            rate_limit:
+              type: boolean
+          type: object
+        per:
+          format: double
+          type: number
+        quota_max:
+          format: int64
+          type: integer
+        quota_renewal_rate:
+          format: int64
+          type: integer
+        rate:
+          format: double
+          type: number
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+        tags:
+          items:
+            type: string
+          nullable: true
+          type: array
+        throttle_interval:
+          format: double
+          type: number
+        throttle_retry_limit:
+          type: integer
+      type: object
+    DatasourceMappingConfiguration:
+      nullable: true
+      properties:
+        disabled:
+          type: boolean
+        path:
+          type: string
+      type: object
+    DatasourceSourceConfig:
+      properties:
+        data_source_config: {}
+        kind:
+          type: string
+      type: object
+    DatasourceTypeFieldConfiguration:
+      properties:
+        data_source:
+          $ref: '#/components/schemas/DatasourceSourceConfig'
+        field_name:
+          type: string
+        mapping:
+          $ref: '#/components/schemas/DatasourceMappingConfiguration'
+        type_name:
+          type: string
+      type: object
+    EndPointMeta:
+      properties:
+        disabled:
+          type: boolean
+        ignore_case:
+          type: boolean
+        method:
+          type: string
+        method_actions:
+          additionalProperties:
+            $ref: '#/components/schemas/EndpointMethodMeta'
+          type: object
+        path:
+          type: string
+      type: object
+    EndpointMethodMeta:
+      properties:
+        action:
+          type: string
+        code:
+          type: integer
+        data:
+          type: string
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+      type: object
+    EventConfig:
+      properties:
+        email:
+          type: string
+        redis:
+          type: boolean
+        webhook:
+          type: string
+      type: object
+    EventHandlerMetaConfig:
+      properties:
+        events:
+          additionalProperties:
+            items:
+              $ref: '#/components/schemas/EventHandlerTriggerConfig'
+            type: array
+          nullable: true
+          type: object
+      type: object
+    EventHandlerTriggerConfig:
+      properties:
+        handler_meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        handler_name:
+          type: string
+      type: object
+    ExtendedPathsSet:
+      properties:
+        advance_cache_config:
+          items:
+            $ref: '#/components/schemas/CacheMeta'
+          type: array
+        black_list:
+          items:
+            $ref: '#/components/schemas/EndPointMeta'
+          type: array
+        cache:
+          items:
+            type: string
+          type: array
+        circuit_breakers:
+          items:
+            $ref: '#/components/schemas/CircuitBreakerMeta'
+          type: array
+        do_not_track_endpoints:
+          items:
+            $ref: '#/components/schemas/TrackEndpointMeta'
+          type: array
+        go_plugin:
+          items:
+            $ref: '#/components/schemas/GoPluginMeta'
+          type: array
+        hard_timeouts:
+          items:
+            $ref: '#/components/schemas/HardTimeoutMeta'
+          type: array
+        ignored:
+          items:
+            $ref: '#/components/schemas/EndPointMeta'
+          type: array
+        internal:
+          items:
+            $ref: '#/components/schemas/InternalMeta'
+          type: array
+        method_transforms:
+          items:
+            $ref: '#/components/schemas/MethodTransformMeta'
+          type: array
+        mock_response:
+          items:
+            $ref: '#/components/schemas/MockResponseMeta'
+          type: array
+        persist_graphql:
+          items:
+            $ref: '#/components/schemas/PersistGraphQLMeta'
+          nullable: true
+          type: array
+        rate_limit:
+          items:
+            $ref: '#/components/schemas/RateLimitMeta'
+          nullable: true
+          type: array
+        size_limits:
+          items:
+            $ref: '#/components/schemas/RequestSizeMeta'
+          type: array
+        track_endpoints:
+          items:
+            $ref: '#/components/schemas/TrackEndpointMeta'
+          type: array
+        transform:
+          items:
+            $ref: '#/components/schemas/TemplateMeta'
+          type: array
+        transform_headers:
+          items:
+            $ref: '#/components/schemas/HeaderInjectionMeta'
+          type: array
+        transform_jq:
+          items:
+            $ref: '#/components/schemas/TransformJQMeta'
+          type: array
+        transform_jq_response:
+          items:
+            $ref: '#/components/schemas/TransformJQMeta'
+          type: array
+        transform_response:
+          items:
+            $ref: '#/components/schemas/TemplateMeta'
+          type: array
+        transform_response_headers:
+          items:
+            $ref: '#/components/schemas/HeaderInjectionMeta'
+          type: array
+        url_rewrites:
+          items:
+            $ref: '#/components/schemas/URLRewriteMeta'
+          type: array
+        validate_json:
+          items:
+            $ref: '#/components/schemas/ValidatePathMeta'
+          type: array
+        validate_request:
+          items:
+            $ref: '#/components/schemas/ValidateRequestMeta'
+          type: array
+        virtual:
+          items:
+            $ref: '#/components/schemas/VirtualMeta'
+          type: array
+        white_list:
+          items:
+            $ref: '#/components/schemas/EndPointMeta'
+          type: array
+      type: object
+    ExternalOAuth:
+      properties:
+        enabled:
+          type: boolean
+        providers:
+          items:
+            $ref: '#/components/schemas/Provider'
+          nullable: true
+          type: array
+      type: object
+    FieldAccessDefinition:
+      properties:
+        field_name:
+          type: string
+        limits:
+          $ref: '#/components/schemas/FieldLimits'
+        type_name:
+          type: string
+      type: object
+    FieldLimits:
+      properties:
+        max_query_depth:
+          type: integer
+      type: object
+    FormDataCreateDomainRequest:
+      properties:
+        domain:
+          description: Domain to register
+          example: tyk.io
+          type: string
+      type: object
+    GlobalRateLimit:
+      properties:
+        disabled:
+          type: boolean
+        per:
+          format: double
+          type: number
+        rate:
+          format: double
+          type: number
+      type: object
+    GoPluginMeta:
+      properties:
+        disabled:
+          type: boolean
+        func_name:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+        plugin_path:
+          type: string
+      type: object
+    GraphQLConfig:
+      properties:
+        enabled:
+          type: boolean
+        engine:
+          $ref: '#/components/schemas/GraphQLEngineConfig'
+        execution_mode:
+          type: string
+        introspection:
+          $ref: '#/components/schemas/GraphQLIntrospectionConfig'
+        last_schema_update:
+          format: date-time
+          nullable: true
+          type: string
+        playground:
+          $ref: '#/components/schemas/GraphQLPlayground'
+        proxy:
+          $ref: '#/components/schemas/GraphQLProxyConfig'
+        schema:
+          type: string
+        subgraph:
+          $ref: '#/components/schemas/GraphQLSubgraphConfig'
+        supergraph:
+          $ref: '#/components/schemas/GraphQLSupergraphConfig'
+        type_field_configurations:
+          items:
+            $ref: '#/components/schemas/DatasourceTypeFieldConfiguration'
+          nullable: true
+          type: array
+        version:
+          type: string
+      type: object
+    GraphQLEngineConfig:
+      properties:
+        data_sources:
+          items:
+            $ref: '#/components/schemas/GraphQLEngineDataSource'
+          nullable: true
+          type: array
+        field_configs:
+          items:
+            $ref: '#/components/schemas/GraphQLFieldConfig'
+          nullable: true
+          type: array
+        global_headers:
+          items:
+            $ref: '#/components/schemas/UDGGlobalHeader'
+          nullable: true
+          type: array
+      type: object
+    GraphQLEngineDataSource:
+      properties:
+        config: {}
+        internal:
+          type: boolean
+        kind:
+          type: string
+        name:
+          type: string
+        root_fields:
+          items:
+            $ref: '#/components/schemas/GraphQLTypeFields'
+          nullable: true
+          type: array
+      type: object
+    GraphQLFieldConfig:
+      properties:
+        disable_default_mapping:
+          type: boolean
+        field_name:
+          type: string
+        path:
+          items:
+            type: string
+          nullable: true
+          type: array
+        type_name:
+          type: string
+      type: object
+    GraphQLIntrospectionConfig:
+      properties:
+        disabled:
+          type: boolean
+      type: object
+    GraphQLPlayground:
+      properties:
+        enabled:
+          type: boolean
+        path:
+          type: string
+      type: object
+    GraphQLProxyConfig:
+      properties:
+        auth_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        features:
+          $ref: '#/components/schemas/GraphQLProxyFeaturesConfig'
+        request_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        request_headers_rewrite:
+          additionalProperties:
+            $ref: '#/components/schemas/RequestHeadersRewriteConfig'
+          nullable: true
+          type: object
+        subscription_type:
+          type: string
+        use_response_extensions:
+          $ref: '#/components/schemas/GraphQLResponseExtensions'
+      type: object
+    GraphQLProxyFeaturesConfig:
+      properties:
+        use_immutable_headers:
+          type: boolean
+      type: object
+    GraphQLResponseExtensions:
+      properties:
+        on_error_forwarding:
+          type: boolean
+      type: object
+    GraphQLSubgraphConfig:
+      properties:
+        sdl:
+          type: string
+      type: object
+    GraphQLSubgraphEntity:
+      properties:
+        api_id:
+          type: string
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        name:
+          type: string
+        sdl:
+          type: string
+        subscription_type:
+          type: string
+        url:
+          type: string
+      type: object
+    GraphQLSupergraphConfig:
+      properties:
+        disable_query_batching:
+          type: boolean
+        global_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        merged_sdl:
+          type: string
+        subgraphs:
+          items:
+            $ref: '#/components/schemas/GraphQLSubgraphEntity'
+          nullable: true
+          type: array
+        updated_at:
+          format: date-time
+          nullable: true
+          type: string
+      type: object
+    GraphQLTypeFields:
+      properties:
+        fields:
+          items:
+            type: string
+          nullable: true
+          type: array
+        type:
+          type: string
+      type: object
+    GraphqlType:
+      properties:
+        fields:
+          items:
+            type: string
+          nullable: true
+          type: array
+        name:
+          type: string
+      type: object
+    HardTimeoutMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        timeout:
+          type: integer
+      type: object
+    HeaderInjectionMeta:
+      properties:
+        act_on:
+          type: boolean
+        add_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        delete_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    HookReference:
+      properties:
+        event_name:
+          type: string
+        event_timeout:
+          format: int64
+          type: integer
+        hook:
+          $ref: '#/components/schemas/WebHookHandlerConf'
+      type: object
+    HostCheckObject:
+      properties:
+        body:
+          type: string
+        commands:
+          items:
+            $ref: '#/components/schemas/CheckCommand'
+          nullable: true
+          type: array
+        enable_proxy_protocol:
+          type: boolean
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        method:
+          type: string
+        protocol:
+          type: string
+        timeout:
+          $ref: '#/components/schemas/TimeDuration'
+        url:
+          type: string
+      type: object
+    ImportDataStruct:
+      properties:
+        Data:
+          items:
+            $ref: '#/components/schemas/DBPolicy'
+          nullable: true
+          type: array
+        Pages:
+          type: integer
+      type: object
+    InternalMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    Introspection:
+      properties:
+        cache:
+          $ref: '#/components/schemas/IntrospectionCache'
+        client_id:
+          type: string
+        client_secret:
+          type: string
+        enabled:
+          type: boolean
+        identity_base_field:
+          type: string
+        url:
+          type: string
+      type: object
+    IntrospectionCache:
+      properties:
+        enabled:
+          type: boolean
+        timeout:
+          format: int64
+          type: integer
+      type: object
+    JWTValidation:
+      properties:
+        enabled:
+          type: boolean
+        expires_at_validation_skew:
+          minimum: 0
+          type: integer
+        identity_base_field:
+          type: string
+        issued_at_validation_skew:
+          minimum: 0
+          type: integer
+        not_before_validation_skew:
+          minimum: 0
+          type: integer
+        signing_method:
+          type: string
+        source:
+          type: string
+      type: object
+    KeyData:
+      properties:
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        data:
+          $ref: '#/components/schemas/SessionState'
+        key_hash:
+          type: string
+        key_id:
+          type: string
+      type: object
+    Keys:
+      properties:
+        data:
+          $ref: '#/components/schemas/AllKeys'
+        pages:
+          type: integer
+      type: object
+    MethodTransformMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        to_method:
+          type: string
+      type: object
+    MiddlewareDefinition:
+      properties:
+        disabled:
+          type: boolean
+        name:
+          type: string
+        path:
+          type: string
+        raw_body_only:
+          type: boolean
+        require_session:
+          type: boolean
+      type: object
+    MiddlewareIdExtractor:
+      properties:
+        disabled:
+          type: boolean
+        extract_from:
+          type: string
+        extract_with:
+          type: string
+        extractor_config:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+    MiddlewareSection:
+      properties:
+        auth_check:
+          $ref: '#/components/schemas/MiddlewareDefinition'
+        driver:
+          type: string
+        id_extractor:
+          $ref: '#/components/schemas/MiddlewareIdExtractor'
+        post:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+        post_key_auth:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+        pre:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+        response:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+      type: object
+    MockResponseMeta:
+      properties:
+        body:
+          type: string
+        code:
+          type: integer
+        disabled:
+          type: boolean
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        ignore_case:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    NotificationsManager:
+      properties:
+        oauth_on_keychange_url:
+          type: string
+        shared_secret:
+          type: string
+      type: object
+    OAS:
+      nullable: true
+      properties:
+        components:
+          $ref: '#/components/schemas/Openapi3Components'
+        externalDocs:
+          $ref: '#/components/schemas/Openapi3ExternalDocs'
+        info:
+          $ref: '#/components/schemas/Openapi3Info'
+        openapi:
+          type: string
+        paths:
+          $ref: '#/components/schemas/Openapi3Paths'
+        security:
+          $ref: '#/components/schemas/Openapi3SecurityRequirements'
+        servers:
+          $ref: '#/components/schemas/Openapi3Servers'
+        tags:
+          $ref: '#/components/schemas/Openapi3Tags'
+      type: object
+    OIDProviderConfig:
+      properties:
+        client_ids:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        issuer:
+          type: string
+      type: object
+    OpenIDOptions:
+      properties:
+        providers:
+          items:
+            $ref: '#/components/schemas/OIDProviderConfig'
+          nullable: true
+          type: array
+        segregate_by_client:
+          type: boolean
+      type: object
+    OpenPolicyConf:
+      properties:
+        enabled:
+          type: boolean
+        rules:
+          type: string
+      type: object
+    Openapi3AdditionalProperties:
+      properties:
+        Has:
+          nullable: true
+          type: boolean
+        Schema:
+          $ref: '#/components/schemas/Openapi3SchemaRef'
+      type: object
+    Openapi3Callback:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3PathItem'
+      nullable: true
+      type: object
+    Openapi3CallbackRef:
+      properties:
+        Ref:
+          type: string
+        Value:
+          $ref: '#/components/schemas/Openapi3Callback'
+      type: object
+    Openapi3Callbacks:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3CallbackRef'
+      type: object
+    Openapi3Components:
+      nullable: true
+      properties:
+        callbacks:
+          $ref: '#/components/schemas/Openapi3Callbacks'
+        examples:
+          $ref: '#/components/schemas/Openapi3Examples'
+        headers:
+          $ref: '#/components/schemas/Openapi3Headers'
+        links:
+          $ref: '#/components/schemas/Openapi3Links'
+        parameters:
+          $ref: '#/components/schemas/Openapi3ParametersMap'
+        requestBodies:
+          $ref: '#/components/schemas/Openapi3RequestBodies'
+        responses:
+          $ref: '#/components/schemas/Openapi3Responses'
+        schemas:
+          $ref: '#/components/schemas/Openapi3Schemas'
+        securitySchemes:
+          $ref: '#/components/schemas/Openapi3SecuritySchemes'
+      type: object
+    Openapi3Contact:
+      nullable: true
+      properties:
+        email:
+          type: string
+        name:
+          type: string
+        url:
+          type: string
+      type: object
+    Openapi3Content:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3MediaType'
+      type: object
+    Openapi3Discriminator:
+      nullable: true
+      properties:
+        mapping:
+          additionalProperties:
+            type: string
+          type: object
+        propertyName:
+          type: string
+      type: object
+    Openapi3Encoding:
+      properties:
+        allowReserved:
+          type: boolean
+        contentType:
+          type: string
+        explode:
+          nullable: true
+          type: boolean
+        headers:
+          $ref: '#/components/schemas/Openapi3Headers'
+        style:
+          type: string
+      type: object
+    Openapi3Example:
+      nullable: true
+      properties:
+        description:
+          type: string
+        externalValue:
+          type: string
+        summary:
+          type: string
+        value: {}
+      type: object
+    Openapi3ExampleRef:
+      properties:
+        Ref:
+          type: string
+        Value:
+          $ref: '#/components/schemas/Openapi3Example'
+      type: object
+    Openapi3Examples:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3ExampleRef'
+      type: object
+    Openapi3ExternalDocs:
+      nullable: true
+      properties:
+        description:
+          type: string
+        url:
+          type: string
+      type: object
+    Openapi3Header:
+      nullable: true
+      properties:
+        allowEmptyValue:
+          type: boolean
+        allowReserved:
+          type: boolean
+        content:
+          $ref: '#/components/schemas/Openapi3Content'
+        deprecated:
+          type: boolean
+        description:
+          type: string
+        example: {}
+        examples:
+          $ref: '#/components/schemas/Openapi3Examples'
+        explode:
+          nullable: true
+          type: boolean
+        in:
+          type: string
+        name:
+          type: string
+        required:
+          type: boolean
+        schema:
+          $ref: '#/components/schemas/Openapi3SchemaRef'
+        style:
+          type: string
+      type: object
+    Openapi3HeaderRef:
+      properties:
+        Ref:
+          type: string
+        Value:
+          $ref: '#/components/schemas/Openapi3Header'
+      type: object
+    Openapi3Headers:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3HeaderRef'
+      type: object
+    Openapi3Info:
+      nullable: true
+      properties:
+        contact:
+          $ref: '#/components/schemas/Openapi3Contact'
+        description:
+          type: string
+        license:
+          $ref: '#/components/schemas/Openapi3License'
+        termsOfService:
+          type: string
+        title:
+          type: string
+        version:
+          type: string
+      type: object
+    Openapi3License:
+      nullable: true
+      properties:
+        name:
+          type: string
+        url:
+          type: string
+      type: object
+    Openapi3Link:
+      nullable: true
+      properties:
+        description:
+          type: string
+        operationId:
+          type: string
+        operationRef:
+          type: string
+        parameters:
+          additionalProperties: {}
+          type: object
+        requestBody: {}
+        server:
+          $ref: '#/components/schemas/Openapi3Server'
+      type: object
+    Openapi3LinkRef:
+      properties:
+        Ref:
+          type: string
+        Value:
+          $ref: '#/components/schemas/Openapi3Link'
+      type: object
+    Openapi3Links:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3LinkRef'
+      type: object
+    Openapi3MediaType:
+      properties:
+        encoding:
+          additionalProperties:
+            $ref: '#/components/schemas/Openapi3Encoding'
+          type: object
+        example: {}
+        examples:
+          $ref: '#/components/schemas/Openapi3Examples'
+        schema:
+          $ref: '#/components/schemas/Openapi3SchemaRef'
+      type: object
+    Openapi3OAuthFlow:
+      nullable: true
+      properties:
+        authorizationUrl:
+          type: string
+        refreshUrl:
+          type: string
+        scopes:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        tokenUrl:
+          type: string
+      type: object
+    Openapi3OAuthFlows:
+      nullable: true
+      properties:
+        authorizationCode:
+          $ref: '#/components/schemas/Openapi3OAuthFlow'
+        clientCredentials:
+          $ref: '#/components/schemas/Openapi3OAuthFlow'
+        implicit:
+          $ref: '#/components/schemas/Openapi3OAuthFlow'
+        password:
+          $ref: '#/components/schemas/Openapi3OAuthFlow'
+      type: object
+    Openapi3Operation:
+      nullable: true
+      properties:
+        callbacks:
+          $ref: '#/components/schemas/Openapi3Callbacks'
+        deprecated:
+          type: boolean
+        description:
+          type: string
+        externalDocs:
+          $ref: '#/components/schemas/Openapi3ExternalDocs'
+        operationId:
+          type: string
+        parameters:
+          $ref: '#/components/schemas/Openapi3Parameters'
+        requestBody:
+          $ref: '#/components/schemas/Openapi3RequestBodyRef'
+        responses:
+          $ref: '#/components/schemas/Openapi3Responses'
+        security:
+          $ref: '#/components/schemas/Openapi3SecurityRequirements'
+        servers:
+          $ref: '#/components/schemas/Openapi3Servers'
+        summary:
+          type: string
+        tags:
+          items:
+            type: string
+          type: array
+      type: object
+    Openapi3Parameter:
+      nullable: true
+      properties:
+        allowEmptyValue:
+          type: boolean
+        allowReserved:
+          type: boolean
+        content:
+          $ref: '#/components/schemas/Openapi3Content'
+        deprecated:
+          type: boolean
+        description:
+          type: string
+        example: {}
+        examples:
+          $ref: '#/components/schemas/Openapi3Examples'
+        explode:
+          nullable: true
+          type: boolean
+        in:
+          type: string
+        name:
+          type: string
+        required:
+          type: boolean
+        schema:
+          $ref: '#/components/schemas/Openapi3SchemaRef'
+        style:
+          type: string
+      type: object
+    Openapi3ParameterRef:
+      properties:
+        Ref:
+          type: string
+        Value:
+          $ref: '#/components/schemas/Openapi3Parameter'
+      type: object
+    Openapi3Parameters:
+      items:
+        $ref: '#/components/schemas/Openapi3ParameterRef'
+      type: array
+    Openapi3ParametersMap:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3ParameterRef'
+      type: object
+    Openapi3PathItem:
+      properties:
+        $ref:
+          type: string
+        connect:
+          $ref: '#/components/schemas/Openapi3Operation'
+        delete:
+          $ref: '#/components/schemas/Openapi3Operation'
+        description:
+          type: string
+        get:
+          $ref: '#/components/schemas/Openapi3Operation'
+        head:
+          $ref: '#/components/schemas/Openapi3Operation'
+        options:
+          $ref: '#/components/schemas/Openapi3Operation'
+        parameters:
+          $ref: '#/components/schemas/Openapi3Parameters'
+        patch:
+          $ref: '#/components/schemas/Openapi3Operation'
+        post:
+          $ref: '#/components/schemas/Openapi3Operation'
+        put:
+          $ref: '#/components/schemas/Openapi3Operation'
+        servers:
+          $ref: '#/components/schemas/Openapi3Servers'
+        summary:
+          type: string
+        trace:
+          $ref: '#/components/schemas/Openapi3Operation'
+      type: object
+    Openapi3Paths:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3PathItem'
+      type: object
+    Openapi3RequestBodies:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3RequestBodyRef'
+      type: object
+    Openapi3RequestBody:
+      nullable: true
+      properties:
+        content:
+          $ref: '#/components/schemas/Openapi3Content'
+        description:
+          type: string
+        required:
+          type: boolean
+      type: object
+    Openapi3RequestBodyRef:
+      properties:
+        Ref:
+          type: string
+        Value:
+          $ref: '#/components/schemas/Openapi3RequestBody'
+      type: object
+    Openapi3Response:
+      nullable: true
+      properties:
+        content:
+          $ref: '#/components/schemas/Openapi3Content'
+        description:
+          nullable: true
+          type: string
+        headers:
+          $ref: '#/components/schemas/Openapi3Headers'
+        links:
+          $ref: '#/components/schemas/Openapi3Links'
+      type: object
+    Openapi3ResponseRef:
+      properties:
+        Ref:
+          type: string
+        Value:
+          $ref: '#/components/schemas/Openapi3Response'
+      type: object
+    Openapi3Responses:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3ResponseRef'
+      type: object
+    Openapi3Schema:
+      nullable: true
+      properties:
+        additionalProperties:
+          $ref: '#/components/schemas/Openapi3AdditionalProperties'
+        allOf:
+          $ref: '#/components/schemas/Openapi3SchemaRefs'
+        allowEmptyValue:
+          type: boolean
+        anyOf:
+          $ref: '#/components/schemas/Openapi3SchemaRefs'
+        default: {}
+        deprecated:
+          type: boolean
+        description:
+          type: string
+        discriminator:
+          $ref: '#/components/schemas/Openapi3Discriminator'
+        enum:
+          items: {}
+          type: array
+        example: {}
+        exclusiveMaximum:
+          type: boolean
+        exclusiveMinimum:
+          type: boolean
+        externalDocs:
+          $ref: '#/components/schemas/Openapi3ExternalDocs'
+        format:
+          type: string
+        items:
+          $ref: '#/components/schemas/Openapi3SchemaRef'
+        maxItems:
+          minimum: 0
+          nullable: true
+          type: integer
+        maxLength:
+          minimum: 0
+          nullable: true
+          type: integer
+        maxProperties:
+          minimum: 0
+          nullable: true
+          type: integer
+        maximum:
+          nullable: true
+          type: number
+        minItems:
+          minimum: 0
+          type: integer
+        minLength:
+          minimum: 0
+          type: integer
+        minProperties:
+          minimum: 0
+          type: integer
+        minimum:
+          nullable: true
+          type: number
+        multipleOf:
+          nullable: true
+          type: number
+        not:
+          $ref: '#/components/schemas/Openapi3SchemaRef'
+        nullable:
+          type: boolean
+        oneOf:
+          $ref: '#/components/schemas/Openapi3SchemaRefs'
+        pattern:
+          type: string
+        properties:
+          $ref: '#/components/schemas/Openapi3Schemas'
+        readOnly:
+          type: boolean
+        required:
+          items:
+            type: string
+          type: array
+        title:
+          type: string
+        type:
+          type: string
+        uniqueItems:
+          type: boolean
+        writeOnly:
+          type: boolean
+        xml:
+          $ref: '#/components/schemas/Openapi3XML'
+      type: object
+    Openapi3SchemaRef:
+      properties:
+        Ref:
+          type: string
+        Value:
+          $ref: '#/components/schemas/Openapi3Schema'
+      type: object
+    Openapi3SchemaRefs:
+      items:
+        $ref: '#/components/schemas/Openapi3SchemaRef'
+      type: array
+    Openapi3Schemas:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3SchemaRef'
+      type: object
+    Openapi3SecurityRequirement:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    Openapi3SecurityRequirements:
+      items:
+        $ref: '#/components/schemas/Openapi3SecurityRequirement'
+      nullable: true
+      type: array
+    Openapi3SecurityScheme:
+      nullable: true
+      properties:
+        bearerFormat:
+          type: string
+        description:
+          type: string
+        flows:
+          $ref: '#/components/schemas/Openapi3OAuthFlows'
+        in:
+          type: string
+        name:
+          type: string
+        openIdConnectUrl:
+          type: string
+        scheme:
+          type: string
+        type:
+          type: string
+      type: object
+    Openapi3SecuritySchemeRef:
+      properties:
+        Ref:
+          type: string
+        Value:
+          $ref: '#/components/schemas/Openapi3SecurityScheme'
+      type: object
+    Openapi3SecuritySchemes:
+      additionalProperties:
+        $ref: '#/components/schemas/Openapi3SecuritySchemeRef'
+      type: object
+    Openapi3Server:
+      nullable: true
+      properties:
+        description:
+          type: string
+        url:
+          type: string
+        variables:
+          additionalProperties:
+            $ref: '#/components/schemas/Openapi3ServerVariable'
+          type: object
+      type: object
+    Openapi3ServerVariable:
+      properties:
+        default:
+          type: string
+        description:
+          type: string
+        enum:
+          items:
+            type: string
+          type: array
+      type: object
+    Openapi3Servers:
+      items:
+        $ref: '#/components/schemas/Openapi3Server'
+      nullable: true
+      type: array
+    Openapi3Tag:
+      properties:
+        description:
+          type: string
+        externalDocs:
+          $ref: '#/components/schemas/Openapi3ExternalDocs'
+        name:
+          type: string
+      type: object
+    Openapi3Tags:
+      items:
+        $ref: '#/components/schemas/Openapi3Tag'
+      type: array
+    Openapi3XML:
+      nullable: true
+      properties:
+        attribute:
+          type: boolean
+        name:
+          type: string
+        namespace:
+          type: string
+        prefix:
+          type: string
+        wrapped:
+          type: boolean
+      type: object
+    OrganisationDocument:
+      properties:
+        additional_permissions:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        apis:
+          items:
+            $ref: '#/components/schemas/ApiDocument'
+          nullable: true
+          type: array
+        cname:
+          type: string
+        cname_enabled:
+          type: boolean
+        developer_count:
+          type: integer
+        developer_quota:
+          type: integer
+        event_options:
+          additionalProperties:
+            $ref: '#/components/schemas/EventConfig'
+          nullable: true
+          type: object
+        hybrid_enabled:
+          type: boolean
+        id:
+          type: string
+        open_policy:
+          $ref: '#/components/schemas/OpenPolicyConf'
+        org_options_meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        owner_name:
+          type: string
+        owner_slug:
+          type: string
+        sso_enabled:
+          type: boolean
+        ui:
+          $ref: '#/components/schemas/ConfigUIOptions'
+      type: object
+    PasswordAuthentication:
+      properties:
+        client_id:
+          type: string
+        client_secret:
+          type: string
+        extra_metadata:
+          items:
+            type: string
+          type: array
+        header:
+          $ref: '#/components/schemas/AuthSource'
+        password:
+          type: string
+        scopes:
+          items:
+            type: string
+          type: array
+        token_url:
+          type: string
+        username:
+          type: string
+      type: object
+    PersistGraphQLMeta:
+      properties:
+        method:
+          type: string
+        operation:
+          type: string
+        path:
+          type: string
+        variables:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+    Provider:
+      properties:
+        introspection:
+          $ref: '#/components/schemas/Introspection'
+        jwt:
+          $ref: '#/components/schemas/JWTValidation'
+      type: object
+    ProxyConfig:
+      properties:
+        check_host_against_uptime_tests:
+          type: boolean
+        disable_strip_slash:
+          type: boolean
+        enable_load_balancing:
+          type: boolean
+        listen_path:
+          type: string
+        preserve_host_header:
+          type: boolean
+        service_discovery:
+          $ref: '#/components/schemas/ServiceDiscoveryConfiguration'
+        strip_listen_path:
+          type: boolean
+        target_list:
+          items:
+            type: string
+          nullable: true
+          type: array
+        target_url:
+          type: string
+        transport:
+          properties:
+            proxy_url:
+              type: string
+            ssl_ciphers:
+              items:
+                type: string
+              nullable: true
+              type: array
+            ssl_force_common_name_check:
+              type: boolean
+            ssl_insecure_skip_verify:
+              type: boolean
+            ssl_max_version:
+              minimum: 0
+              type: integer
+            ssl_min_version:
+              minimum: 0
+              type: integer
+          type: object
+      type: object
+    RateLimitMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        per:
+          format: double
+          type: number
+        rate:
+          format: double
+          type: number
+      type: object
+    RateLimitSmoothing:
+      nullable: true
+      properties:
+        delay:
+          format: int64
+          type: integer
+        enabled:
+          type: boolean
+        step:
+          format: int64
+          type: integer
+        threshold:
+          format: int64
+          type: integer
+        trigger:
+          format: double
+          type: number
+      type: object
+    ReloadResponse:
+      properties:
+        status:
+          type: string
+      type: object
+    RequestHeadersRewriteConfig:
+      properties:
+        remove:
+          type: boolean
+        value:
+          type: string
+      type: object
+    RequestSigningMeta:
+      properties:
+        algorithm:
+          type: string
+        certificate_id:
+          type: string
+        header_list:
+          items:
+            type: string
+          nullable: true
+          type: array
+        is_enabled:
+          type: boolean
+        key_id:
+          type: string
+        secret:
+          type: string
+        signature_header:
+          type: string
+      type: object
+    RequestSizeMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        size_limit:
+          format: int64
+          type: integer
+      type: object
+    ResponseProcessor:
+      properties:
+        name:
+          type: string
+        options: {}
+      type: object
+    RoutingTrigger:
+      properties:
+        "on":
+          type: string
+        options:
+          $ref: '#/components/schemas/RoutingTriggerOptions'
+        rewrite_to:
+          type: string
+      type: object
+    RoutingTriggerOptions:
+      properties:
+        header_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        path_part_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        payload_matches:
+          $ref: '#/components/schemas/StringRegexMap'
+        query_val_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        request_context_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        session_meta_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+      type: object
+    SSOAccessData:
+      properties:
+        DisplayName:
+          type: string
+        EmailAddress:
+          type: string
+        ForSection:
+          type: string
+        GroupID:
+          type: string
+        GroupsIDs:
+          items:
+            type: string
+          nullable: true
+          type: array
+        OrgID:
+          type: string
+        SSOOnlyForRegisteredUsers:
+          type: boolean
+        UserNotAllowed:
+          type: boolean
+      type: object
+    ScopeClaim:
+      properties:
+        scope_claim_name:
+          type: string
+        scope_to_policy:
+          additionalProperties:
+            type: string
+          type: object
+      type: object
+    Scopes:
+      properties:
+        jwt:
+          $ref: '#/components/schemas/ScopeClaim'
+        oidc:
+          $ref: '#/components/schemas/ScopeClaim'
+      type: object
+    ServiceDiscoveryConfiguration:
+      properties:
+        cache_disabled:
+          type: boolean
+        cache_timeout:
+          format: int64
+          type: integer
+        data_path:
+          type: string
+        endpoint_returns_list:
+          type: boolean
+        parent_data_path:
+          type: string
+        port_data_path:
+          type: string
+        query_endpoint:
+          type: string
+        target_path:
+          type: string
+        use_discovery_service:
+          type: boolean
+        use_nested_query:
+          type: boolean
+        use_target_list:
+          type: boolean
+      type: object
+    SessionEndpoint:
+      properties:
+        methods:
+          items:
+            $ref: '#/components/schemas/SessionEndpointMethod'
+          type: array
+        path:
+          type: string
+      type: object
+    SessionEndpointMethod:
+      properties:
+        limit:
+          $ref: '#/components/schemas/SessionEndpointRateLimit'
+        name:
+          type: string
+      type: object
+    SessionEndpointRateLimit:
+      properties:
+        per:
+          format: int64
+          type: integer
+        rate:
+          format: int64
+          type: integer
+      type: object
+    SessionProviderMeta:
+      properties:
+        meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        name:
+          type: string
+        storage_engine:
+          type: string
+      type: object
+    SessionState:
+      properties:
+        access_rights:
+          additionalProperties:
+            $ref: '#/components/schemas/AccessDefinition'
+          nullable: true
+          type: object
+        alias:
+          type: string
+        allowance:
+          format: double
+          type: number
+        apply_policies:
+          items:
+            type: string
+          nullable: true
+          type: array
+        apply_policy_id:
+          type: string
+        basic_auth_data:
+          properties:
+            hash_type:
+              type: string
+            password:
+              type: string
+            user:
+              type: string
+          type: object
+        certificate:
+          type: string
+        data_expires:
+          format: int64
+          type: integer
+        date_created:
+          format: date-time
+          type: string
+        enable_detailed_recording:
+          type: boolean
+        expires:
+          format: int64
+          type: integer
+        hmac_enabled:
+          type: boolean
+        hmac_string:
+          type: string
+        id_extractor_deadline:
+          format: int64
+          type: integer
+        is_inactive:
+          type: boolean
+        jwt_data:
+          properties:
+            secret:
+              type: string
+          type: object
+        key_id:
+          type: string
+        last_check:
+          format: int64
+          type: integer
+        last_updated:
+          type: string
+        max_query_depth:
+          type: integer
+        meta_data: {}
+        monitor:
+          properties:
+            trigger_limits:
+              items:
+                format: double
+                type: number
+              nullable: true
+              type: array
+          type: object
+        oauth_client_id:
+          type: string
+        oauth_keys:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        org_id:
+          type: string
+        per:
+          format: double
+          type: number
+        quota_max:
+          format: int64
+          type: integer
+        quota_remaining:
+          format: int64
+          type: integer
+        quota_renewal_rate:
+          format: int64
+          type: integer
+        quota_renews:
+          format: int64
+          type: integer
+        rate:
+          format: double
+          type: number
+        session_lifetime:
+          format: int64
+          type: integer
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+        tags:
+          items:
+            type: string
+          nullable: true
+          type: array
+        throttle_interval:
+          format: double
+          type: number
+        throttle_retry_limit:
+          type: integer
+      type: object
+    SignatureConfig:
+      properties:
+        algorithm:
+          type: string
+        allowed_clock_skew:
+          format: int64
+          type: integer
+        error_code:
+          type: integer
+        error_message:
+          type: string
+        header:
+          type: string
+        param_name:
+          type: string
+        secret:
+          type: string
+        use_param:
+          type: boolean
+      type: object
+    StringRegexMap:
+      properties:
+        match_rx:
+          type: string
+        reverse:
+          type: boolean
+      type: object
+    TemplateData:
+      properties:
+        enable_session:
+          type: boolean
+        input_type:
+          type: string
+        template_mode:
+          type: string
+        template_source:
+          type: string
+      type: object
+    TemplateMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        template_data:
+          $ref: '#/components/schemas/TemplateData'
+      type: object
+    TimeDuration:
+      format: int64
+      type: integer
+    TrackEndpointMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    TransformJQMeta:
+      properties:
+        filter:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    UDGGlobalHeader:
+      properties:
+        key:
+          type: string
+        value:
+          type: string
+      type: object
+    URLRewriteMeta:
+      properties:
+        disabled:
+          type: boolean
+        match_pattern:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+        rewrite_to:
+          type: string
+        triggers:
+          items:
+            $ref: '#/components/schemas/RoutingTrigger'
+          nullable: true
+          type: array
+      type: object
+    UpstreamAuth:
+      properties:
+        basic_auth:
+          $ref: '#/components/schemas/UpstreamBasicAuth'
+        enabled:
+          type: boolean
+        oauth:
+          $ref: '#/components/schemas/UpstreamOAuth'
+      type: object
+    UpstreamBasicAuth:
+      properties:
+        enabled:
+          type: boolean
+        header:
+          $ref: '#/components/schemas/AuthSource'
+        password:
+          type: string
+        username:
+          type: string
+      type: object
+    UpstreamOAuth:
+      properties:
+        allowed_authorize_types:
+          items:
+            type: string
+          nullable: true
+          type: array
+        client_credentials:
+          $ref: '#/components/schemas/ClientCredentials'
+        enabled:
+          type: boolean
+        password:
+          $ref: '#/components/schemas/PasswordAuthentication'
+      type: object
+    UptimeTests:
+      properties:
+        check_list:
+          items:
+            $ref: '#/components/schemas/HostCheckObject'
+          nullable: true
+          type: array
+        config:
+          $ref: '#/components/schemas/UptimeTestsConfig'
+      type: object
+    UptimeTestsConfig:
+      properties:
+        expire_utime_after:
+          format: int64
+          type: integer
+        recheck_wait:
+          type: integer
+        service_discovery:
+          $ref: '#/components/schemas/ServiceDiscoveryConfiguration'
+      type: object
+    User:
+      properties:
+        access_key:
+          type: string
+        active:
+          type: boolean
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        email_address:
+          type: string
+        first_name:
+          type: string
+        group_id:
+          type: string
+        id:
+          type: string
+        last_login_date:
+          format: date-time
+          type: string
+        last_name:
+          type: string
+        org_id:
+          type: string
+        password_max_days:
+          type: integer
+        password_updated:
+          format: date-time
+          type: string
+        user_permissions:
+          $ref: '#/components/schemas/ConfigUserPermissionObject'
+      type: object
+    ValidatePathMeta:
+      properties:
+        disabled:
+          type: boolean
+        error_response_code:
+          type: integer
+        method:
+          type: string
+        path:
+          type: string
+        schema:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        schema_b64:
+          type: string
+      type: object
+    ValidateRequestMeta:
+      properties:
+        enabled:
+          type: boolean
+        error_response_code:
+          type: integer
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    VersionData:
+      properties:
+        default_version:
+          type: string
+        not_versioned:
+          type: boolean
+        versions:
+          additionalProperties:
+            $ref: '#/components/schemas/VersionInfo'
+          nullable: true
+          type: object
+      type: object
+    VersionDefinition:
+      properties:
+        default:
+          type: string
+        enabled:
+          type: boolean
+        fallback_to_default:
+          type: boolean
+        key:
+          type: string
+        location:
+          type: string
+        name:
+          type: string
+        strip_path:
+          type: boolean
+        strip_versioning_data:
+          type: boolean
+        url_versioning_pattern:
+          type: string
+        versions:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+      type: object
+    VersionInfo:
+      properties:
+        expires:
+          type: string
+        extended_paths:
+          $ref: '#/components/schemas/ExtendedPathsSet'
+        global_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        global_headers_disabled:
+          type: boolean
+        global_headers_remove:
+          items:
+            type: string
+          nullable: true
+          type: array
+        global_response_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        global_response_headers_disabled:
+          type: boolean
+        global_response_headers_remove:
+          items:
+            type: string
+          nullable: true
+          type: array
+        global_size_limit:
+          format: int64
+          type: integer
+        global_size_limit_disabled:
+          type: boolean
+        ignore_endpoint_case:
+          type: boolean
+        name:
+          type: string
+        override_target:
+          type: string
+        paths:
+          properties:
+            black_list:
+              items:
+                type: string
+              nullable: true
+              type: array
+            ignored:
+              items:
+                type: string
+              nullable: true
+              type: array
+            white_list:
+              items:
+                type: string
+              nullable: true
+              type: array
+          type: object
+        use_extended_paths:
+          type: boolean
+      type: object
+    VirtualMeta:
+      properties:
+        disabled:
+          type: boolean
+        function_source_type:
+          type: string
+        function_source_uri:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+        proxy_on_error:
+          type: boolean
+        response_function_name:
+          type: string
+        use_session:
+          type: boolean
+      type: object
+    WebHookHandlerConf:
+      properties:
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        event_timeout:
+          format: int64
+          type: integer
+        header_map:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        id:
+          type: string
+        method:
+          type: string
+        name:
+          type: string
+        org_id:
+          type: string
+        target_path:
+          type: string
+        template_path:
+          type: string
+        webhook_id:
+          type: string
+      type: object
+  securitySchemes:
+    api_key:
+      description: Api key
+      in: header
+      name: Admin-Auth
+      type: apiKey
diff --git a/swagger/dashboard-swagger.yml b/swagger/dashboard-swagger.yml
new file mode 100644
index 0000000000..d97a0d2720
--- /dev/null
+++ b/swagger/dashboard-swagger.yml
@@ -0,0 +1,15213 @@
+openapi: 3.0.3
+info:
+  contact:
+    email: support@tyk.io
+    name: Tyk Technologies
+    url: https://tyk.io/contact
+  description: |2
+    <img src="https://tyk.io/docs/img/swagger_dashboard_image.png" width="963" height="250">
+    
+    ## <a name="introduction"></a> Introduction
+
+    The Tyk Dashboard API offers granular, programmatic access to a centralised database of resources that your Tyk nodes can pull from. This API has a dynamic user administrative structure which means the secret key that is used to communicate with your Tyk nodes can be kept secret and access to the wider management functions can be handled on a user-by-user and organisation-by-organisation basis.
+
+    A common question around using a database-backed configuration is how to programmatically add API definitions to your Tyk nodes, the Dashboard API allows much more fine-grained, secure and multi-user access to your Tyk cluster, and should be used to manage a database-backed Tyk node.
+
+    The Tyk Dashboard API works seamlessly with the Tyk Dashboard (and the two come bundled together).
+
+    ## <a name="security-hierarchy"></a> Security Hierarchy
+
+    The Dashboard API provides a more structured security layer to managing Tyk nodes.
+
+    ### Organisations, APIs and Users
+
+    With the Dashboard API and a database-backed Tyk setup, (and to an extent with file-based API setups - if diligence is used in naming and creating definitions), the following security model is applied to the management of Upstream APIs:
+
+    * **Organisations**: All APIs are *owned* by an organisation, this is designated by the 'OrgID' parameter in the API Definition.
+    * **Users**: All users created in the Dashboard belong to an organisation (unless an exception is made for super-administrative access).
+    * **APIs**: All APIs belong to an Organisation and only Users that belong to that organisation can see the analytics for those APIs and manage their configurations.
+    * **API Keys**: API Keys are designated by organisation, this means an API key that has full access rights will not be allowed to access the APIs of another organisation on the same system, but can have full access to all APIs within the organisation.
+    * **Access Rights**: Access rights are stored with the key, this enables a key to give access to multiple APIs, this is defined by the session object in the core Tyk API.
+
+    In order to use the Dashboard API, you'll need to get the 'Tyk Dashboard API Access Credentials' secret from your user profile on the Dashboard UI.
+
+    The secret you set should then be sent along as a header with each Dashboard API Request in order for it to be successful:
+
+
+    authorization: <your-secret>
+  license:
+    name: Mozilla Public License Version 2.0
+    url: https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md
+  title: Tyk Dashboard API
+  version: 5.13.0
+servers:
+- url: https://{tenant}
+  variables:
+    tenant:
+      default: localhost:3000
+      description: Your dashboard host
+security:
+- bearerAuth: []
+tags:
+- description: Use the endpoints under this tag to manage your certificates. You can
+    add, delete and list certificates using these endpoints.
+  name: Certificates
+- description: The Tyk Dashboard provides a full set of analytics functions and graphs
+    that you can use to segment and view your API traffic and activity.
+  externalDocs:
+    description: Traffic Analytics.
+    url: https://tyk.io/docs/tyk-dashboard-analytics/
+  name: Analytics
+- description: Use the endpoints in this tag to manage OAuth flow.
+  externalDocs:
+    description: OAuth Documentation
+    url: https://tyk.io/docs/basic-config-and-security/security/authentication-authorization/oauth-2-0/
+  name: Oauth
+- description: |
+    An API template is an asset managed by Tyk Dashboard that is used as the starting point - a blueprint - from which you can create a new Tyk OAS API definition. <br/>
+
+    Templates are used only during the creation of an API, they cannot be applied later.
+
+    [Read more about API template assets here](https://tyk.io/docs/product-stack/tyk-dashboard/advanced-configurations/templates/template-overview/)
+  externalDocs:
+    description: API Templates full documentation.
+    url: https://tyk.io/docs/product-stack/tyk-dashboard/advanced-configurations/templates/template-overview/
+  name: Assets
+- description: |
+    The Tyk Dashboard permission system can be extended by writing custom rules using an Open Policy Agent (OPA). The rules engine works on top of your Dashboard API, which means you can control not only access rules, but also behaviour of all Dashboard APIs (except your public developer portal)  <br/>
+
+    By default the Dashboard OPA engine is turned off, and you need to explicitly enable it via your Dashboard tyk_analytics.conf file. <br/>
+
+    You can use OPA rule to accomplish tasks like: <br/>
+
+    1. Prevent users from creating keyless APIs.
+    2. Assign specific categories to APIs created to certain user groups or users.
+    3. Control access for individual fields. For example, do not allow changing the API “active” status (e.g. deploy), unless you have a specific permission set.
+    4. And many more <br/>
+
+    [Read more about Tyk Open Policy Agent here](https://tyk.io/docs/tyk-dashboard/open-policy-agent/)
+  externalDocs:
+    description: Tyk Open Policy Agent Full Documentation.
+    url: https://tyk.io/docs/tyk-dashboard/open-policy-agent/
+  name: Open Policy Agent
+- description: |
+    These APIs helps you get,add and delete (CRUD) a list of additional (custom) permissions for your Dashboard users. You can use the created additional permissions with Open Policy Agent (OPA). <br/>
+
+     Once created, a custom permission will be added to standard list of user permissions. <br/>
+
+    You can also configure these custom permissions in the security.additional_permissions map in the Tyk Dashboard configuration file.
+
+    You can check the [full documentation here](https://tyk.io/docs/tyk-dashboard-api/org/permissions/).
+  externalDocs:
+    description: Additional Permissions full documentation.
+    url: https://tyk.io/docs/tyk-dashboard-api/org/permissions/
+  name: Additional Permissions
+- description: Get schemas.
+  name: Schemas
+- description: |
+    Manage MCP (Model Context Protocol) Proxies from Tyk Dashboard. MCP Proxies are
+    Tyk OAS definitions with MCP-specific configuration in the `x-tyk-api-gateway`
+    extension. Create/update requests are validated against the MCP JSON schema
+    and a limited set of middleware is supported — restricted middleware
+    (request/response transforms, URL rewrite, cache, mocks, request validation,
+    internal) are rejected.
+  name: MCP Proxies
+- description: |
+    Webhooks are a great way to let external applications know about the status of a user, an API or an event that has occurred in the Tyk gateway <br/>
+
+    You can create webhooks that you can then re-use in your API definitions and assign to different Tyk Events such as quota violations or rate-limiting violations.<br/>
+
+    Each webhook require a target_path (which is an absolute URL that should be targeted by the webhook e.g https://httpbin.org/expired-keys) and a method which can be any of GET, PUT, POST, PATCH or DELETE.<br/>
+
+    Request types that do not support an encoded body will not have the event metadata encoded as part of the request. We would advise using POST where possible.
+  name: Webhooks
+- description: Policies are a template that enable you to create access rules, usage
+    quota and rate limits that can be applied to multiple keys. They are a useful
+    way to manage large groups of users, and to enforce quota changes on a global
+    scale across any number of keys that are using a policy. When used in conjunction
+    with the portal, developers that enroll for API access will be given a key that
+    is attached to a specific policy. The policy settings are refreshed every time
+    a key attempts access, meaning that updating a policy will have an effect across
+    any keys that are attached to it.
+  externalDocs:
+    description: Security Policies Documentation.
+    url: https://tyk.io/docs/basic-config-and-security/security/security-policies/
+  name: Policies
+- description: When you have a large number of users and teams with different access
+    requirements, instead of setting permissions per user, you can create a user group
+    and configure the permissions for all users in the group. Note that a user can
+    only belong to one group.
+  externalDocs:
+    description: Manage Tyk Dashboard User Groups.
+    url: https://tyk.io/docs/basic-config-and-security/security/dashboard/create-user-groups/
+  name: UserGroup
+- description: 'Users have twofold access to the dashboard: they can access both the
+    Dashboard API and the Dashboard itself, it is possible to generate users that
+    have read-only access to certain sections of the dashboard and the underlying
+    API. Use the endpoints in this tag to manage users.'
+  externalDocs:
+    description: Manage Tyk Dashboard Users.
+    url: https://tyk.io/docs/basic-config-and-security/security/dashboard/create-users/
+  name: Users
+- description: All keys that are used to access services via Tyk correspond to a session
+    object that informs Tyk about the context of this particular token, like access
+    rules and rate/quota allowance.
+  externalDocs:
+    description: API Key Management.
+    url: https://tyk.io/docs/tyk-apis/tyk-dashboard-api/api-keys/
+  name: Keys
+- description: |-
+    An API request made using Basic Authentication will have an Authorization header that contains the API key. The value of the Authorization header will be in the form:</br>
+    `Basic base64Encode(username:password)`.
+  externalDocs:
+    description: Basic Authentication.
+    url: https://tyk.io/docs/basic-config-and-security/security/authentication-authorization/basic-auth/
+  name: Basic Authentication
+- description: Tyk allows you to work with APIs that you’ve designed with the OpenAPI
+    Specification version 3.0.x, making it even easier to get your API up and running.
+    Use the endpoints in this tag to create,delete,import and update OAS APIs.
+  externalDocs:
+    description: Tyk OAS Documentation.
+    url: https://tyk.io/docs/getting-started/key-concepts/high-level-concepts/
+  name: OAS APIs
+- description: Use the endpoints under this tags to update,add ,delete and fetch the
+    classic APIs.
+  name: APIs
+- description: The Dashboard SSO API allows you to implement custom authentication
+    schemes for the Dashboard and Portal. Our Tyk Identity Broker (TIB) internally
+    also uses this API. The Dashboard exposes the /api/sso Dashboard API which allows
+    you to generate a temporary authentication token, valid for 60 seconds.
+  externalDocs:
+    description: Dashboard API Single Sign On.
+    url: https://tyk.io/docs/tyk-apis/tyk-dashboard-api/sso/
+  name: Single Sign On
+- description: System API.
+  name: System
+- description: Notifications for an organisation
+  name: Organisation Notifications
+paths:
+  /api/activity/keys/{keyHash}/{startDay}/{startMonth}/{startYear}/{EndDay}/{EndMonth}/{EndYear}:
+    get:
+      description: It returns analytics of the endpoints of all APIs called a key
+        between start and end date.
+      operationId: getAnalyticsOfApiKey
+      parameters:
+      - description: Day to start querying the analytics from.
+        example: "15"
+        in: path
+        name: startDay
+        required: true
+        schema:
+          type: string
+      - description: Month to start querying the analytics from.
+        example: "1"
+        in: path
+        name: startMonth
+        required: true
+        schema:
+          type: string
+      - description: Year to start querying the analytics from.
+        example: "2024"
+        in: path
+        name: startYear
+        required: true
+        schema:
+          type: string
+      - description: End date of analytics to query.
+        example: "20"
+        in: path
+        name: EndDay
+        required: true
+        schema:
+          type: string
+      - description: End month of analytics to query.
+        example: "6"
+        in: path
+        name: EndMonth
+        required: true
+        schema:
+          type: string
+      - description: End year of analytics to query.
+        example: "2025"
+        in: path
+        name: EndYear
+        required: true
+        schema:
+          type: string
+      - description: Hash of your API key.
+        in: path
+        name: keyHash
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                aggregateAnalytics:
+                  $ref: '#/components/examples/aggregateAnalytics'
+              schema:
+                $ref: '#/components/schemas/AggregateAnalyticsData'
+          description: Returns analytics of all endpoints called using the given key
+            between the given time range.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Key could not be decoded.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: User does not have access to the API with ID.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to fetch analytics.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Analytics of API Key.
+      tags:
+      - Analytics
+  /api/activity/oauthid/{OAuthClientID}/{startDay}/{startMonth}/{startYear}/{EndDay}/{EndMonth}/{EndYear}:
+    get:
+      description: Returns activity of all endpoints which used the given OAuth client
+        between the given time range.
+      operationId: getAnalyticsOfOauthClientId
+      parameters:
+      - description: Day to start querying the analytics from.
+        example: "15"
+        in: path
+        name: startDay
+        required: true
+        schema:
+          type: string
+      - description: Month to start querying the analytics from.
+        example: "1"
+        in: path
+        name: startMonth
+        required: true
+        schema:
+          type: string
+      - description: Year to start querying the analytics from.
+        example: "2024"
+        in: path
+        name: startYear
+        required: true
+        schema:
+          type: string
+      - description: End date of analytics to query.
+        example: "20"
+        in: path
+        name: EndDay
+        required: true
+        schema:
+          type: string
+      - description: End month of analytics to query.
+        example: "6"
+        in: path
+        name: EndMonth
+        required: true
+        schema:
+          type: string
+      - description: End year of analytics to query.
+        example: "2025"
+        in: path
+        name: EndYear
+        required: true
+        schema:
+          type: string
+      - description: OAuthClientID
+        in: path
+        name: OAuthClientID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                aggregateAnalytics:
+                  $ref: '#/components/examples/aggregateAnalytics'
+              schema:
+                $ref: '#/components/schemas/AggregateAnalyticsData'
+          description: Fetched analytics successfully.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: User does not have access to the API with ID.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to fetch analytics.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Analytics of Oauth Client ID.
+      tags:
+      - Analytics
+  /api/usage/mcp/{startDay}/{startMonth}/{startYear}/{EndDay}/{EndMonth}/{EndYear}:
+    get:
+      description: |
+        Average usage per MCP Proxy definition over a date range. Results are grouped
+        by MCP Proxy definition ID and include standard aggregate metrics (hits,
+        successes, errors, latency). Use query parameters to filter by `api_id` or
+        `tags`, and pass `type=csv` to export CSV instead of JSON.
+      operationId: getAverageMCPUsage
+      parameters:
+      - { in: path, name: startDay,   required: true, schema: { type: string }, example: "1",    description: Start day of the date range (1-31). }
+      - { in: path, name: startMonth, required: true, schema: { type: string }, example: "1",    description: Start month of the date range (1-12). }
+      - { in: path, name: startYear,  required: true, schema: { type: string }, example: "2026", description: Start year of the date range. }
+      - { in: path, name: EndDay,     required: true, schema: { type: string }, example: "31",   description: End day of the date range (1-31). }
+      - { in: path, name: EndMonth,   required: true, schema: { type: string }, example: "1",    description: End month of the date range (1-12). }
+      - { in: path, name: EndYear,    required: true, schema: { type: string }, example: "2026", description: End year of the date range. }
+      - { in: query, name: api_id, required: false, schema: { type: string }, description: Filter results by API ID. }
+      - { in: query, name: tags,   required: false, schema: { type: string }, description: Filter results by comma-separated tags. }
+      - { in: query, name: type,   required: false, schema: { type: string, enum: [csv] }, description: "Response format; pass csv to export as CSV." }
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AggregateAnalyticsData'
+          description: Aggregate MCP usage data.
+        "400": { description: Bad Request,    content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "401": { description: Unauthorized,   content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "500": { description: Internal error, content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+      summary: Average MCP Proxy usage.
+      tags:
+      - Analytics
+  /api/activity/mcp/primitives/{startDay}/{startMonth}/{startYear}/{EndDay}/{EndMonth}/{EndYear}:
+    get:
+      description: |
+        Activity broken down by MCP primitive (tool / resource / prompt invocation).
+        Results are grouped when `group_by=mcp_primitive` is supplied; filter by
+        `mcp_method`, `mcp_primitive_type` and `mcp_primitive_name`.
+      operationId: getMCPPrimitiveActivity
+      parameters:
+      - { in: path, name: startDay,   required: true, schema: { type: string }, description: Start day of the date range (1-31). }
+      - { in: path, name: startMonth, required: true, schema: { type: string }, description: Start month of the date range (1-12). }
+      - { in: path, name: startYear,  required: true, schema: { type: string }, description: Start year of the date range. }
+      - { in: path, name: EndDay,     required: true, schema: { type: string }, description: End day of the date range (1-31). }
+      - { in: path, name: EndMonth,   required: true, schema: { type: string }, description: End month of the date range (1-12). }
+      - { in: path, name: EndYear,    required: true, schema: { type: string }, description: End year of the date range. }
+      - { in: query, name: api_id,              required: false, schema: { type: string }, description: Filter results by API ID. }
+      - { in: query, name: mcp_method,          required: false, schema: { type: string, example: tools/call }, description: Filter by MCP JSON-RPC method name. }
+      - { in: query, name: mcp_primitive_type,  required: false, schema: { type: string, enum: [tool, resource, prompt] }, description: "Filter by primitive type (tool, resource, or prompt)." }
+      - { in: query, name: mcp_primitive_name,  required: false, schema: { type: string }, description: Filter by primitive name. }
+      - { in: query, name: group_by,            required: false, schema: { type: string, enum: [mcp_primitive] }, description: Group results by the specified field. }
+      - { in: query, name: limit,               required: false, schema: { type: integer }, description: Maximum number of results to return. }
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AggregateAnalyticsData'
+          description: MCP primitive activity data.
+        "400": { description: Bad Request,    content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "401": { description: Unauthorized,   content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "500": { description: Internal error, content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+      summary: MCP primitive activity.
+      tags:
+      - Analytics
+  /api/activity/mcp/primitives/errors/{startDay}/{startMonth}/{startYear}/{EndDay}/{EndMonth}/{EndYear}:
+    get:
+      description: |
+        Error-only view of MCP primitive activity. Same filter/grouping parameters
+        as `/api/activity/mcp/primitives/...`, but the response only contains
+        datapoints where the MCP call resulted in an error.
+      operationId: getMCPPrimitiveErrors
+      parameters:
+      - { in: path, name: startDay,   required: true, schema: { type: string }, description: Start day of the date range (1-31). }
+      - { in: path, name: startMonth, required: true, schema: { type: string }, description: Start month of the date range (1-12). }
+      - { in: path, name: startYear,  required: true, schema: { type: string }, description: Start year of the date range. }
+      - { in: path, name: EndDay,     required: true, schema: { type: string }, description: End day of the date range (1-31). }
+      - { in: path, name: EndMonth,   required: true, schema: { type: string }, description: End month of the date range (1-12). }
+      - { in: path, name: EndYear,    required: true, schema: { type: string }, description: End year of the date range. }
+      - { in: query, name: api_id,             required: false, schema: { type: string }, description: Filter results by API ID. }
+      - { in: query, name: mcp_method,         required: false, schema: { type: string }, description: Filter by MCP JSON-RPC method name. }
+      - { in: query, name: mcp_primitive_type, required: false, schema: { type: string, enum: [tool, resource, prompt] }, description: "Filter by primitive type (tool, resource, or prompt)." }
+      - { in: query, name: mcp_primitive_name, required: false, schema: { type: string }, description: Filter by primitive name. }
+      - { in: query, name: group_by,           required: false, schema: { type: string, enum: [mcp_primitive] }, description: Group results by the specified field. }
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AggregateAnalyticsData'
+          description: MCP primitive error data.
+        "400": { description: Bad Request,    content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "401": { description: Unauthorized,   content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "500": { description: Internal error, content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+      summary: MCP primitive errors.
+      tags:
+      - Analytics
+  /api/activity/mcp/keys/{keyId}/{startDay}/{startMonth}/{startYear}/{EndDay}/{EndMonth}/{EndYear}:
+    get:
+      description: |
+        MCP activity produced by a single API key. Use this to investigate which MCP
+        tools/resources/prompts a given consumer called. Supports the same MCP
+        filter parameters as the other MCP activity endpoints.
+      operationId: getMCPActivityByKey
+      parameters:
+      - { in: path, name: keyId,      required: true, schema: { type: string }, description: API key hash. }
+      - { in: path, name: startDay,   required: true, schema: { type: string }, description: Start day of the date range (1-31). }
+      - { in: path, name: startMonth, required: true, schema: { type: string }, description: Start month of the date range (1-12). }
+      - { in: path, name: startYear,  required: true, schema: { type: string }, description: Start year of the date range. }
+      - { in: path, name: EndDay,     required: true, schema: { type: string }, description: End day of the date range (1-31). }
+      - { in: path, name: EndMonth,   required: true, schema: { type: string }, description: End month of the date range (1-12). }
+      - { in: path, name: EndYear,    required: true, schema: { type: string }, description: End year of the date range. }
+      - { in: query, name: mcp_method,         required: false, schema: { type: string }, description: Filter by MCP JSON-RPC method name. }
+      - { in: query, name: mcp_primitive_type, required: false, schema: { type: string, enum: [tool, resource, prompt] }, description: "Filter by primitive type (tool, resource, or prompt)." }
+      - { in: query, name: mcp_primitive_name, required: false, schema: { type: string }, description: Filter by primitive name. }
+      - { in: query, name: group_by,           required: false, schema: { type: string, enum: [mcp_primitive] }, description: Group results by the specified field. }
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AggregateAnalyticsData'
+          description: MCP activity data for the supplied key.
+        "400": { description: Bad Request,    content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "401": { description: Unauthorized,   content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "404": { description: Key not found,  content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "500": { description: Internal error, content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+      summary: MCP activity per API key.
+      tags:
+      - Analytics
+  /api/apis:
+    get:
+      description: Get List of APIs.By default the returned apis will be sorted by
+        created_at field in descending order but this can be changed via sort query
+        parameter.The apis returned are paginated
+      operationId: getApis
+      parameters:
+      - allowEmptyValue: true
+        deprecated: true
+        description: Return smaller API list payload.
+        example: "1"
+        in: query
+        name: compressed
+        required: false
+        schema:
+          enum:
+          - "1"
+          type: string
+      - description: API Type, internal or external.
+        example: rest
+        in: query
+        name: api_type
+        required: false
+        schema:
+          enum:
+          - tcp
+          - rest
+          - graphql
+          - udg
+          - subgraph
+          - supergraph
+          - internal
+          type: string
+      - description: Comma separated list of categories you want to filter Apis by.
+        in: query
+        name: category
+        required: false
+        schema:
+          type: string
+      - description: Comma separated list of authentication type you want to filter
+          apis by.
+        example: keyless,authToken
+        in: query
+        name: auth_type
+        required: false
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: For versioned APIs, return only the base versions.If any value
+          is sent in this query parameter only the base version will be returned
+        example: "1"
+        in: query
+        name: base_apis
+        required: false
+        schema:
+          type: string
+      - description: Query string for search/filtering.This will return all apis whose
+          names matches the given pattern
+        example: Rate Limit Path API 1
+        in: query
+        name: q
+        required: false
+        schema:
+          type: string
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      - description: |-
+          * 'name' - Sort by name in ascending order.
+          * '-name' - Sort by name in descending order.
+          * 'updated_at' - Sort by updated_at in ascending order.
+          * '-updated_at' - Sort by updated_at in descending order.
+          * 'created_at' - Sort by created_at in ascending order.
+          * '-created_at' - Sort by created_at in descending order.
+        example: name
+        in: query
+        name: sort
+        required: false
+        schema:
+          enum:
+          - name
+          - -name
+          - created_at
+          - -created_at
+          - updated_at
+          - -updated_at
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                paginatedApiExample:
+                  $ref: '#/components/examples/paginatedApiExample'
+              schema:
+                $ref: '#/components/schemas/ApiDefinitionsResponse'
+          description: List of API definitions.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve APIs.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data for APIs.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get List of APIs
+      tags:
+      - APIs
+    post:
+      description: |-
+        Create an API Definition in Tyk Classic API format.
+          Note that the response includes the newly created Tyk Classic API Definition containing the unique identifier for the APIs (`api_id`). You can provide a value for the `api_id` in the request body, otherwise Tyk will automatically generate a value for you.
+            The `ID` field within the Tyk Classic API Definition is a proprietary field used by Tyk to identify the API within the database and cannot be chosen or modified by the user.
+      operationId: postApis
+      parameters:
+      - description: The base API which the new version will be linked to.
+        example: 663a4ed9b6be920001b191ae
+        in: query
+        name: base_api_id
+        required: false
+        schema:
+          type: string
+      - description: The version name of the base API while creating the first version.
+          This doesn't have to be sent for the next versions but if it is set, it
+          will override base API version name.
+        example: Default
+        in: query
+        name: base_api_version_name
+        required: false
+        schema:
+          type: string
+      - description: The version name of the created version.
+        example: v2
+        in: query
+        name: new_version_name
+        required: false
+        schema:
+          type: string
+      - description: If true, the new version is set as default version.
+        example: true
+        in: query
+        name: set_default
+        required: false
+        schema:
+          type: boolean
+      requestBody:
+        content:
+          application/json:
+            example:
+              api_definition:
+                api_id: b84fe1a04e5648927971c0557971565c
+                auth:
+                  auth_header_name: authorization
+                definition:
+                  key: version
+                  location: header
+                name: Tyk Test API
+                org_id: 664a14650619d40001f1f00f
+                proxy:
+                  listen_path: /tyk-api-test-one/
+                  strip_listen_path: true
+                  target_url: https://httpbin.org
+                use_oauth2: true
+                version_data:
+                  not_versioned: true
+                  versions:
+                    Default:
+                      name: Default
+            schema:
+              $ref: '#/components/schemas/ApiDefinitionWrapper'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                ID: 284acad18f44f3d4e9a0832ccf5fd1
+                Message: API created
+                Meta: 663cd8615715ec1405aafbea
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API created
+        "400":
+          content:
+            application/json:
+              example:
+                Message: version name header should be set with base API ID
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "409":
+          content:
+            application/json:
+              example:
+                Message: Found API with the same ID
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: if API with given API ID  already exist
+      summary: Create API Definition
+      tags:
+      - APIs
+  /api/cache/jwks/{apiId}:
+    delete:
+      description: Invalidate JWKS cache for the given API.
+      operationId: invalidateJWKSCache
+      parameters:
+        - description: The API ID.
+          example: ae67bb862a3241a49117508e0f9ee839
+          in: path
+          name: apiId
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: success
+                status: OK
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Cache invalidated.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Update not allowed, API not owned by user
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Invalidate cache for given API ID.
+      tags:
+        - APIs
+  /api/apis/{apiID}/access:
+    get:
+      description: This will return APIAccessManagementPayload that has two lists
+        containing users and user groups that have access to an API.
+      operationId: getApiAccessRights
+      parameters:
+      - description: The API ID
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                userGroupIds:
+                - 663a4ed6b6be920001b191aa
+                - 663a4ed6b6be920001b191ab
+                userIds:
+                - 663b2a835715ecb6edef24e3
+                - 663a5bbf5715ec8040251f2a
+              schema:
+                $ref: '#/components/schemas/AccessManagementPayload'
+          description: APIAccessManagementPayload represents two lists containing
+            users and user groups that have access to an API
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiID}/access'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API not found
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API with this ID does not exist
+        "500":
+          content:
+            application/json:
+              example:
+                Message: failed to marshal ownership payload
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get API access rights (users and userGroups)
+      tags:
+      - APIs
+    put:
+      description: This will update the user group and users that have access to an
+        API.The userIds and userGroup sent will entirely replace the existing userIds
+        IDs and userGroup ids.
+      operationId: updateApiAccessRights
+      parameters:
+      - description: The API ID
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              userGroupIds:
+              - 663a4ed6b6be920001b191aa
+              - 663a4ed6b6be920001b191ab
+              userIds:
+              - 663a5bbf5715ec8040251f2a
+            schema:
+              $ref: '#/components/schemas/AccessManagementPayload'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API access updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API access updated
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiID}/access'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API not found
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API with ID not found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: failed to unmarshal categories payload
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update API access rights (users and userGroups)
+      tags:
+      - APIs
+  /api/apis/{apiID}/keys:
+    get:
+      description: Lists keys that grant access to the API with the ID {apiID}.
+      operationId: listApiKeys
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      - description: ID of the API.
+        example: 663a4ed9b6be920001b191ae
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                data:
+                  keys:
+                  - 5e9d9544a1dcd60001d0ed20a28c495beff140a4a6d8c272a1956b99
+                  - 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+                  - 5e9d9544a1dcd60001d0ed2060ff87c0deab4a508dd2ac18ccb8b664
+                pages: 1
+              schema:
+                $ref: '#/components/schemas/Keys'
+          description: Paginated key IDs.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiID}/keys'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve keys.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned when keys are hashed and hashed key listing is disabled.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal keys data from Tyk API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List keys by API.
+      tags:
+      - Keys
+  /api/apis/{apiID}/keys/{keyID}:
+    delete:
+      description: Deleting a key will remove it permanently from the system, however
+        analytics relating to that key will still be available.
+      operationId: deleteApiKeyDetail
+      parameters:
+      - description: If you are not sure if a key is hashed you can send this as true.
+        example: true
+        in: query
+        name: auto_guess
+        required: false
+        schema:
+          default: false
+          type: boolean
+      - description: Use the hash of the key as input instead of the full key. Any
+          none empty string will be interpreted as to say you want to use hash input.
+        example: "1"
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: string
+      - description: Set to true if the passed key is a username.
+        example: true
+        in: query
+        name: username
+        required: false
+        schema:
+          type: boolean
+      - description: ID of API the keys grant access to. Can either be the internal
+          or external API ID.
+        example: 546e885199c947147e7f39b7d6e8e984
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - description: The key ID
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Key deleted successfully.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Key deleted.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Attempted access to non-owned key.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Trying to access a key your org does not own.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiID}/keys/{keyID}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve key detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Key with ID not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not delete key.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Delete key with API ID and key ID.
+      tags:
+      - Keys
+    get:
+      description: Fetches the key that grant access to the API with the ID {apiID}
+        and key ID {keyID}.
+      operationId: getApiKeyDetail
+      parameters:
+      - description: If you are not sure if a key is hashed you can send this as true.
+        example: true
+        in: query
+        name: auto_guess
+        required: false
+        schema:
+          default: false
+          type: boolean
+      - description: Use the hash of the key as input instead of the full key.Any
+          none empty string will be interpreted as to say you want to use hash input.
+        example: "1"
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: string
+      - description: Set to true if the passed key ID is a username.
+        example: true
+        in: query
+        name: username
+        required: false
+        schema:
+          type: boolean
+      - description: ID of API the keys grant access to. Can either be the internal
+          or external API ID.
+        example: 546e885199c947147e7f39b7d6e8e984
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - description: The Key ID.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: Key data fetched.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Attempted access to non-owned key.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Trying to access a key your org does not own.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiID}/keys/{keyID}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve key detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Key with ID not found.
+      summary: Get key details with API ID and key ID.
+      tags:
+      - Keys
+    put:
+      description: You can also manually add keys to Tyk using your own key-generation
+        algorithm. It is recommended if using this approach to ensure that the OrgID
+        being used in the API Definition and the key data is blank so that Tyk does
+        not try to prepend or manage the key in any way.
+      operationId: updateApiKeyDetail
+      parameters:
+      - description: If you are not sure if a key is hashed you can send this as true.
+        example: true
+        in: query
+        name: auto_guess
+        required: false
+        schema:
+          default: false
+          type: boolean
+      - description: Use the hash of the key as input instead of the full key. Any
+          none empty string will be interpreted as to say you want to use hash input.
+        example: "1"
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: string
+      - description: Set to true if the passed key ID is a username.
+        example: true
+        in: query
+        name: username
+        required: false
+        schema:
+          type: boolean
+      - description: Adding the suppress_reset parameter and setting it to 1, will
+          cause Tyk not to reset the quota limit that is in the current live quota
+          manager. By default Tyk will reset the quota in the live quota manager (initialising
+          it) when adding a key. Adding the `suppress_reset` flag to the URL parameters
+          will avoid this behaviour.
+        example: "1"
+        in: query
+        name: suppress_reset
+        required: false
+        schema:
+          type: string
+      - description: ID of API the keys grant access to. Can either be the internal
+          or external API ID.
+        example: 546e885199c947147e7f39b7d6e8e984
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - description: The Key ID.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 62a0ec9092faf50001395817
+              enable_detailed_recording: true
+              expires: 1.718439136e+09
+              hmac_enabled: false
+              is_inactive: false
+              meta_data:
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: -1
+              quota_remaining: 0
+              quota_renewal_rate: -1
+              quota_renews: 1.715847135e+09
+              rate: 1000
+              tags:
+              - edge-eu
+              - edge
+              throttle_interval: 0
+              throttle_retry_limit: 0
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: Key updated
+        "400":
+          content:
+            application/json:
+              example:
+                Message: User/Key object validation failed, most likely malformed
+                  input.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed input.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unmarshalling request body failed, malformed.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve key detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Key with ID not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal Key data.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: With API ID and key ID.
+      tags:
+      - Keys
+  /api/apis/{apiId}:
+    delete:
+      description: Delete an API by ID
+      operationId: deleteApi
+      parameters:
+      - description: ID of API to delete. Can either be internal or public API ID.
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API deleted
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not delete the API
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Failed to delete
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve API detail
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API with given ID not found
+      summary: Delete a single API by ID
+      tags:
+      - APIs
+    get:
+      description: Get an API by ID
+      operationId: getApi
+      parameters:
+      - description: ID of API to get. Can either be internal or public API ID.
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                singleAPIDef:
+                  $ref: '#/components/examples/singleAPIDef'
+              schema:
+                $ref: '#/components/schemas/ApiDefinitionWrapper'
+          description: API definition
+          headers:
+            x-tyk-base-api-id:
+              description: ID of the base API if the requested API is a version.
+              schema:
+                type: string
+              style: simple
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve API detail
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data for API detail
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get a single API by ID
+      tags:
+      - APIs
+    put:
+      description: Update an API Definition. api_id can be updated for On-Premise
+        installations, but it cannot be updated when the Dashboard resides in Tyk
+        Cloud. Updates to api_id in Tyk Cloud will be ignored.
+      operationId: putApi
+      parameters:
+      - description: ID of API to get. Can either be internal or public API ID.
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              api_definition:
+                api_id: b84fe1a04e5648927971c0557971565c
+                auth:
+                  auth_header_name: authorization
+                definition:
+                  key: version
+                  location: header
+                name: Update API name
+                org_id: 664a14650619d40001f1f00f
+                proxy:
+                  listen_path: /updated-tyk-api-test/
+                  strip_listen_path: true
+                  target_url: https://httpbin.org
+                use_oauth2: true
+                version_data:
+                  not_versioned: true
+                  versions:
+                    Default:
+                      name: Default
+            schema:
+              $ref: '#/components/schemas/ApiDefinitionWrapper'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API updated
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Invalid `ID` value
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: the ID sent in the body is not same as the ID in the path parameter
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API definition does not exist
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API with given ID not found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Error while validating schema
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update API Definition
+      tags:
+      - APIs
+  /api/apis/{apiId}/keys/search:
+    get:
+      description: Lists keys that grant access to the API with the ID {apiID}. When
+        q query parameter is passed it will only return keys that contains the string
+        sent by q.
+      operationId: SearchKeys
+      parameters:
+      - description: Filter and return all keys that contain this text in there key
+          ID.
+        example: itachi
+        in: query
+        name: q
+        required: false
+        schema:
+          type: string
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      - description: ID of the API.
+        example: 663a4ed9b6be920001b191ae
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                data:
+                  keys:
+                  - 5e9d9544a1dcd60001d0ed20itachi
+                  - 5e9d9544a1dcd60001d0ed20ns-itachi
+                pages: 1
+              schema:
+                $ref: '#/components/schemas/Keys'
+          description: Paginated key IDs
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not search keys.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Could not search keys.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiId}/keys/search'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal user data.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Search keys by API.
+      tags:
+      - Keys
+  /api/apis/{apiId}/url:
+    get:
+      description: This will return your API BasePath(your API listen path) ,Host(your
+        API domain or gateway hostname ) and API URL (full url to your API upstream
+        which is a combination of the protocol the API uses (e.g http)+ host name(e.g
+        tyk.io) and the API listen_path )
+      operationId: getApiUrl
+      parameters:
+      - description: The API ID
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                ApiURL: http://localhost:8080/rate-limit-proxy-api/
+                BasePath: /rate-limit-proxy-api/
+                Host: localhost:8080
+              schema:
+                $ref: '#/components/schemas/URLVals'
+          description: Urls returned successfully
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve API detail
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/{apiId}/url'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+      summary: Get API URLs
+      tags:
+      - APIs
+  /api/proxy:
+    post:
+      summary: Proxy API request
+      operationId: proxyRequest
+      description: |
+        Forwards a request to a specified gateway endpoint. This endpoint allows you to send requests to other services through the Tyk gateway, which can be useful for testing or accessing protected resources.
+        
+        The proxy will forward your request to the specified URL, including any headers and body data you provide. It then returns the response from the target service, including status code, headers, and body.
+      tags:
+        - Proxy
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ProxyRequest'
+            example:
+              method: "GET"
+              url: "http://localhost:8181/test-oas/get"
+              headers:
+                test: "tyk"
+                Content-Type: "application/json"
+              body:
+                name: "New Resource"
+                description: "Description of the resource."
+      responses:
+        '200':
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ProxyResponse'
+              example:
+                status_code: 200
+                headers:
+                  Access-Control-Allow-Credentials: "true"
+                  Access-Control-Allow-Origin: "*"
+                  Content-Length: "364"
+                  Content-Type: "application/json"
+                  Date: "Thu, 19 Dec 2024 14:10:48 GMT"
+                  Server: "gunicorn/19.9.0"
+                  X-Ratelimit-Limit: "0"
+                  X-Ratelimit-Remaining: "0"
+                  X-Ratelimit-Reset: "0"
+                body:
+                  args: {}
+                  headers:
+                    Accept-Encoding: "gzip"
+                    Content-Length: "83"
+                    Content-Type: "application/json"
+                    Host: "httpbin.org"
+                    Test: "tyk"
+                    User-Agent: "Go-http-client/1.1"
+                    X-Amzn-Trace-Id: "Root=1-67642968-11206636527acf9a25d230c3"
+                  origin: "::1, 81.18.84.15"
+                  url: "http://httpbin.org/get"
+        '400':
+          description: Bad request - usually due to malformed request syntax
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+              example:
+                Status: "Error"
+                Message: "Invalid proxy request"
+                Meta: null
+        '403':
+          description: Forbidden - URL not recognized or not allowed
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+              example:
+                Status: "Error"
+                Message: "Provided URL is not a recognised gateway URL"
+                Meta: null
+        '500':
+          description: Internal server error - issue with proxy or target service
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+              example:
+                Status: "Error"
+                Message: "Failed to process proxy request"
+                Meta: null
+  /api/apis/categories:
+    get:
+      description: Get a list of all the defined API categories and the number(count)
+        of APIs that are in each category.
+      operationId: getAllApiCategories
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                categories:
+                - count: 3
+                  name: tag2
+                - count: 1
+                  name: tag2
+                - count: 1
+                  name: tag3
+              schema:
+                $ref: '#/components/schemas/AllCategoriesResponse'
+          description: API categories
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/categories'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve APIs
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get API Categories
+      tags:
+      - APIs
+  /api/apis/groups:
+    get:
+      description: This will return a map/hashmap with categories as keys and the
+        key values will be a list that contains all the APIIDs that belong to that
+        category.
+      operationId: getAPIGroups
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                '#tag2':
+                - d1dfc6a927a046c54c0ed470f19757cc
+                '#tag3':
+                - d1dfc6a927a046c54c0ed470f19757cc
+                httpbin:
+                - d1dfc6a927a046c54c0ed470f19757cc
+                tag1:
+                - d1dfc6a927a046c54c0ed470f19757cc
+                - 627efb71ebae49df7a853b9769b65fce
+                tag2:
+                - d1dfc6a927a046c54c0ed470f19757cc
+                - 627efb71ebae49df7a853b9769b65fce
+              schema:
+                additionalProperties:
+                  items:
+                    type: string
+                  type: array
+                type: object
+          description: A map of groups with APIs IDs in that group.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve APIs.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unable to get groups e.g because database is down
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/groups'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal API groups data
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get API Groups.
+      tags:
+      - APIs
+  /api/apis/keys:
+    get:
+      description: Return a paginated list of keys.
+      operationId: listKeys
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                data:
+                  keys:
+                  - 5e9d9544a1dcd60001d0ed20a28c495beff140a4a6d8c272a1956b99
+                  - 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+                  - 5e9d9544a1dcd60001d0ed2060ff87c0deab4a508dd2ac18ccb8b664
+                pages: 1
+              schema:
+                $ref: '#/components/schemas/Keys'
+          description: Paginated key IDs.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/keys'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal keys data from Tyk API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List All the keys.
+      tags:
+      - Keys
+  /api/apis/keys/basic/{username}:
+    post:
+      description: Create a Basic Auth user with the username specified in the path
+        {username}. Note you have to send password via(the basic_auth_data.password
+        field) in the request body.
+      operationId: createBasicAuthUser
+      parameters:
+      - description: ' Username of Basic Auth user to create or update.'
+        example: itachi
+        in: path
+        name: username
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 62a0ec9092faf50001395817
+              basic_auth_data:
+                password: test123
+              enable_detailed_recording: true
+              expires: 1.718439136e+09
+              hmac_enabled: false
+              is_inactive: false
+              meta_data:
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: -1
+              quota_remaining: 0
+              quota_renewal_rate: -1
+              quota_renews: 1.715847135e+09
+              rate: 1000
+              tags:
+              - edge-eu
+              - edge
+              throttle_interval: 0
+              throttle_retry_limit: 0
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: User created successfully.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unmarshalling request body failed, malformed.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal Key data.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Create a Basic Auth User.
+      tags:
+      - Basic Authentication
+  /api/apis/streams:
+    post:
+      description: |-
+        Create a Streams API Definition in Tyk OAS API format.
+         Note that the response includes the newly created Tyk Streams API Definition containing the unique identifier for the API (`ID`). You can provide a value for `ID` in the request body, otherwise Tyk will automatically generate a value.
+      operationId: createStreamsApi
+      parameters:
+        - name: "Content-Type"
+          in: header
+          required: true
+          description: "Content type for streams endpoints should be `application/vnd.tyk.streams.oas`"
+          schema:
+            type: string
+            enum: ["application/vnd.tyk.streams.oas"]
+      requestBody:
+        content:
+          application/vnd.tyk.streams.oas:
+            examples:
+              StreamsAPIExample:
+                $ref: "#/components/examples/streamsExample"
+            schema:
+              allOf:
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+                - $ref: '#/components/schemas/TykVendorExtension'
+                - $ref: '#/components/schemas/XTykStreaming'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                ID: 4c1c0d8fc885401053ddac4e39ef676b
+                Message: API created
+                Meta: 665597e0b646b300011acb69
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API created.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Couldn't read body.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed data.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Your license does not support adding/ modifying streams API configuration.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "409":
+          content:
+            application/json:
+              example:
+                Message: Found API with the same ID.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Conflict
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Error while creating API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Create Streams API.
+      tags:
+        - Streams APIs
+
+  /api/apis/streams/{apiId}:
+    delete:
+      description: Deleting a Streams API definition will remove the file from the file store.
+        The API definition will not be unloaded and a separate reload request will
+        need to be made to disable the API endpoint.
+      operationId: deleteStreamsApi
+      parameters:
+        - description: ID of the API you want to delete.
+          example: 4c1c0d8fc885401053ddac4e39ef676b
+          in: path
+          name: apiId
+          required: true
+          schema:
+            type: string
+        - name: "Content-Type"
+          in: header
+          required: true
+          description: "Content type for streams endpoints should be `application/vnd.tyk.streams.oas`"
+          schema:
+            type: string
+            enum: ["application/vnd.tyk.streams.oas"]
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API deleted.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Deleted successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not delete the API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/streams/{apiId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve API detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+      summary: Delete Streams API.
+      tags:
+        - Streams APIs
+    get:
+      description: Get a single Streams API definition.
+      operationId: getStreamsAPIDetails
+      parameters:
+        - description: ID of the API you want to fetch.
+          example: 4c1c0d8fc885401053ddac4e39ef676b
+          in: path
+          name: apiId
+          required: true
+          schema:
+            type: string
+        - name: "Accept"
+          in: header
+          required: true
+          description: "Accept type for streams endpoints should be `application/vnd.tyk.streams.oas`"
+          schema:
+            type: string
+            enum: ["application/vnd.tyk.streams.oas"]
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                streamsAPIExample:
+                  $ref: '#/components/examples/streamsExample'
+              schema:
+                allOf:
+                  - $ref: '#/components/schemas/OpenAPI3Schema'
+                  - $ref: '#/components/schemas/TykVendorExtension'
+                  - $ref: '#/components/schemas/XTykStreaming'
+          description: Fetched API.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve API detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad request or API not found.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/streams/{apiId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data for API detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get Streams API details.
+      tags:
+        - Streams APIs
+    patch:
+      description: Update a Tyk Streams API. You can use this endpoint to update the OAS
+        part of your Tyk Streams API definition. This endpoint allows you to configure
+        the Tyk OAS extension based on the query parameters provided (similar to import).
+      operationId: patchApiStreams
+      parameters:
+        - name: "Content-Type"
+          in: header
+          required: true
+          description: "Content type for streams endpoints should be `application/vnd.tyk.streams.oas`"
+          schema:
+            type: string
+            enum: [ "application/vnd.tyk.streams.oas" ]
+        - description: ID of the API you want to patch.
+          example: 4c1c0d8fc885401053ddac4e39ef676b
+          in: path
+          name: apiId
+          required: true
+          schema:
+            type: string
+        - $ref: '#/components/parameters/ListenPath'
+        - $ref: '#/components/parameters/CustomDomain'
+        - $ref: '#/components/parameters/AllowList'
+        - $ref: '#/components/parameters/ValidateRequest'
+        - $ref: '#/components/parameters/MockResponse'
+        - $ref: '#/components/parameters/Authentication'
+      requestBody:
+        content:
+          application/vnd.tyk.streams.oas:
+            examples:
+              PatchOASExample:
+                $ref: "#/components/examples/streamsExample"
+            schema:
+              oneOf:
+                - allOf:
+                    - $ref: '#/components/schemas/OpenAPI3Schema'
+                    - $ref: '#/components/schemas/TykVendorExtension'
+                    - $ref: '#/components/schemas/XTykStreaming'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/FormDataFile'
+        description: The content of the file should be the OpenAPI document in JSON
+          format.
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Patched API.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Invalid `ID` value
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Failed to update org object to DB.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+      summary: Patch a single Streams API by ID.
+      tags:
+        - Streams APIs
+    put:
+      description: Updating an API definition uses the same signature object as a
+        `POST`. It will first ensure that the API ID being updated is the same as
+        in the `PUT` object.<br/> Updating will completely replace the file descriptor
+        and will not change an API definition that has already been loaded. The hot-reload
+        endpoint will need to be called to push the new definition to live.
+      operationId: updateStreamsApi
+      parameters:
+        - name: "Content-Type"
+          in: header
+          required: true
+          description: "Content type for streams endpoints should be `application/vnd.tyk.streams.oas`"
+          schema:
+            type: string
+            enum: [ "application/vnd.tyk.streams.oas" ]
+        - description: ID of the API you want to update.
+          example: 4c1c0d8fc885401053ddac4e39ef676b
+          in: path
+          name: apiId
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/vnd.tyk.streams.oas:
+            examples:
+              StreamsAPIExample:
+                $ref: "#/components/examples/streamsExample"
+            schema:
+              allOf:
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+                - $ref: '#/components/schemas/TykVendorExtension'
+                - $ref: '#/components/schemas/XTykStreaming'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API updated.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Updated API.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: The payload should contain x-tyk-api-gateway and/or x-tyk-streaming.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed API data.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Found API with same url.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API definition does not exist
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Error while creating API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update Streams API.
+      tags:
+        - Streams APIs
+
+  /api/apis/oas:
+    post:
+      description: |-
+        Create an API Definition in Tyk OAS API format.
+         Note that the response includes the newly created Tyk OAS API Definition containing the unique identifier for the API (`ID`). You can provide a value for `ID` in the request body, otherwise Tyk will automatically generate a value.
+      operationId: createApiOAS
+      parameters:
+      - description: The base API which the new version will be linked to.
+        example: 663a4ed9b6be920001b191ae
+        in: query
+        name: base_api_id
+        required: false
+        schema:
+          type: string
+      - description: The version name of the base API while creating the first version.
+          This doesn't have to be sent for the next versions but if it is set, it
+          will override base API version name.
+        example: Default
+        in: query
+        name: base_api_version_name
+        required: false
+        schema:
+          type: string
+      - description: The version name of the created version.
+        example: v2
+        in: query
+        name: new_version_name
+        required: false
+        schema:
+          type: string
+      - description: If true, the new version is set as default version.
+        example: true
+        in: query
+        name: set_default
+        required: false
+        schema:
+          type: boolean
+      - $ref: '#/components/parameters/TemplateID'
+      requestBody:
+        content:
+          application/json:
+            example:
+              components:
+                securitySchemes:
+                  bearerAuth:
+                    description: The API Access Credentials
+                    scheme: bearer
+                    type: http
+              info:
+                description: This is a sample OpenAPI description.
+                title: Sample OpenAPI description
+                version: 1.0.0
+              openapi: 3.0.3
+              paths:
+                /api/sample/users:
+                  get:
+                    operationId: getUsersSample
+                    responses:
+                      "200":
+                        content:
+                          application/json:
+                            schema:
+                              items:
+                                properties:
+                                  name:
+                                    type: string
+                                type: object
+                              type: array
+                        description: fetched users
+                    summary: Get users
+                    tags:
+                    - users
+              security:
+              - bearerAuth: []
+              servers:
+              - url: https://localhost:8080
+              x-tyk-api-gateway:
+                info:
+                  name: user
+                  state:
+                    active: true
+                server:
+                  listenPath:
+                    strip: true
+                    value: /user-test-one/
+                upstream:
+                  url: https://localhost:8080
+            schema:
+              allOf:
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+              - $ref: '#/components/schemas/TykVendorExtension'
+          application/x-yaml:
+            examples:
+              oasExample:
+                $ref: '#/components/examples/oasExample'
+            schema:
+              allOf:
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+                - $ref: '#/components/schemas/TykVendorExtension'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                ID: 4c1c0d8fc885401053ddac4e39ef676b
+                Message: API created
+                Meta: 665597e0b646b300011acb69
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: OAS created.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Couldn't read body.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed data.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve detail of apiID 62a0ec9092faf50001395817
+                  in org 82a0ec9052faf50001395817.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "409":
+          content:
+            application/json:
+              example:
+                Message: Found API with the same ID.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Conflict
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Error while validating schema.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Create OAS API.
+      tags:
+      - OAS APIs
+  /api/apis/oas/{apiId}:
+    delete:
+      description: Deleting an API definition will remove the file from the file store.
+        The API definition will not be unloaded and a separate reload request will
+        need to be made to disable the API endpoint.
+      operationId: deleteOASApi
+      parameters:
+      - description: ID of the API you want to delete.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      - description: When set to true and the API is a base API with child versions, all child API versions will be deleted along with the base API. If false or not provided, child versions will remain as independent APIs.
+        example: true
+        in: query
+        name: purge
+        required: false
+        schema:
+          type: boolean
+          default: false
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API deleted.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Deleted successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not delete the API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/oas/{apiId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve API detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+      summary: Delete OAS API.
+      tags:
+      - OAS APIs
+    get:
+      description: Get a single API definition in OAS format.
+      operationId: getOASAPIDetails
+      parameters:
+      - description: ID of the API you want to fetch.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                oasExample:
+                  $ref: '#/components/examples/oasExample'
+              schema:
+                allOf:
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+                - $ref: '#/components/schemas/TykVendorExtension'
+            application/x-yaml:
+              examples:
+                oasExample:
+                  $ref: '#/components/examples/oasExample'
+              schema:
+                allOf:
+                  - $ref: '#/components/schemas/OpenAPI3Schema'
+                  - $ref: '#/components/schemas/TykVendorExtension'
+          description: Fetched API.
+          headers:
+            x-tyk-base-api-id:
+              description: ID of the base API if the requested API is a version.
+              schema:
+                type: string
+              style: simple
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve API detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad request or API not found.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/oas/{apiId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data for API detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get OAS API details.
+      tags:
+      - OAS APIs
+    patch:
+      description: Update a Tyk OAS API. You can use this endpoint to update the OAS
+        part of your Tyk OAS API definition. This endpoint allows you to configure
+        the Tyk OAS extension based on the query parameters provided (similar to import).
+      operationId: patchApiOAS
+      parameters:
+      - description: ID of the API you want to patch.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      - $ref: '#/components/parameters/UpstreamURL'
+      - $ref: '#/components/parameters/ListenPath'
+      - $ref: '#/components/parameters/CustomDomain'
+      - $ref: '#/components/parameters/AllowList'
+      - $ref: '#/components/parameters/ValidateRequest'
+      - $ref: '#/components/parameters/MockResponse'
+      - $ref: '#/components/parameters/Authentication'
+      requestBody:
+        content:
+          application/json:
+            examples:
+              PatchByUrl:
+                summary: Patch By Url
+                value:
+                  url: https://gist.githubusercontent.com/lghiur/385183f81d0878e5806fffab843d2ef2/raw/1da0aa8b08b496e6c8c84c4996fad6c4877218a0/Petstore%2520Tyk%2520OAS%2520API%2520Definition
+              PatchByOASExample:
+                $ref: '#/components/examples/PatchOASExample'
+            schema:
+              oneOf:
+              - $ref: '#/components/schemas/ApiImportByUrlPayload'
+              - allOf:
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+                - $ref: '#/components/schemas/TykVendorExtension'
+          application/x-yaml:
+            examples:
+              oasExample:
+                $ref: '#/components/examples/PatchOASExample'
+            schema:
+              allOf:
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+              - $ref: '#/components/schemas/TykVendorExtension'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/FormDataFile'
+        description: The content of the file should be the OpenAPI document in JSON or YAML
+          format.
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Patched API.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Invalid `ID` value
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Failed to update org object to DB.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+      summary: Patch a single OAS API by ID.
+      tags:
+      - OAS APIs
+    put:
+      description: Updating an API definition uses the same signature object as a
+        `POST`. It will first ensure that the API ID being updated is the same as
+        in the `PUT` object.<br/> Updating will completely replace the file descriptor
+        and will not change an API definition that has already been loaded. The hot-reload
+        endpoint will need to be called to push the new definition to live.
+      operationId: updateApiOAS
+      parameters:
+      - description: ID of the API you want to update.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              components:
+                securitySchemes:
+                  bearerAuth:
+                    description: The API Access Credentials
+                    scheme: bearer
+                    type: http
+              info:
+                description: This is a sample OpenAPI description.
+                title: Sample OpenAPI description
+                version: 1.0.0
+              openapi: 3.0.3
+              paths:
+                /api/sample/users:
+                  get:
+                    operationId: getUsersSample
+                    responses:
+                      "200":
+                        content:
+                          application/json:
+                            schema:
+                              items:
+                                properties:
+                                  name:
+                                    type: string
+                                type: object
+                              type: array
+                        description: fetched users
+                    summary: Get users
+                    tags:
+                    - users
+              security:
+              - bearerAuth: []
+              servers:
+              - url: https://localhost:8080
+              x-tyk-api-gateway:
+                info:
+                  name: user
+                  state:
+                    active: true
+                server:
+                  listenPath:
+                    strip: true
+                    value: /user-test-three/
+                upstream:
+                  url: https://localhost:8080
+            schema:
+              allOf:
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+              - $ref: '#/components/schemas/TykVendorExtension'
+          application/x-yaml:
+            examples:
+              oasExample:
+                $ref: '#/components/examples/oasExample'
+            schema:
+              allOf:
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+                - $ref: '#/components/schemas/TykVendorExtension'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API updated.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Updated API.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: The payload should contain x-tyk-api-gateway.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed API data.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Found API with same url.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API definition does not exist
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Error while validating schema.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update OAS API.
+      tags:
+      - OAS APIs
+  /api/apis/oas/{current-base-apiId}/rebase/{next-base-apiId}:
+    patch:
+      description: |
+        Convert a child API version into the new base API. This operation:
+        - Moves all versioning/routing configuration from the current base API to the new base API
+        - Converts the original base API into a child of the new base API
+        - Preserves all version identifiers and default version settings
+      operationId: convertToBaseAPI
+      parameters:
+      - description: ID of the current base API that will be converted to a child.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: current-base-apiId
+        required: true
+        schema:
+          type: string
+      - description: ID of the child API that will become the new base API.
+        example: 5d2e3f4a6b7c8d9e0f1a2b3c
+        in: path
+        name: next-base-apiId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API converted successfully
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Successfully converted.
+        "400":
+          content:
+            application/json:
+              examples:
+                notBaseAPI:
+                  summary: Current is not a base API
+                  value:
+                    Message: current-base-apiId must be a base API
+                    Meta: null
+                    Status: Error
+                notChildAPI:
+                  summary: Next is not a child API
+                  value:
+                    Message: next-base-apiId must be a child API
+                    Meta: null
+                    Status: Error
+                wrongParentChild:
+                  summary: Wrong parent-child relationship
+                  value:
+                    Message: next-base-apiId must be a child of current-base-apiId
+                    Meta: null
+                    Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request - validation failed.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access /api/apis/oas/{current-base-apiId}/{next-base-apiId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              examples:
+                currentNotFound:
+                  summary: Current base API not found
+                  value:
+                    Message: Could not retrieve current base API
+                    Meta: null
+                    Status: Error
+                nextNotFound:
+                  summary: Next base API not found
+                  value:
+                    Message: Could not retrieve next base API
+                    Meta: null
+                    Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to save new base API
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Convert child API to base API.
+      tags:
+      - OAS APIs
+  /api/apis/oas/{apiId}/urls:
+    get:
+      description: |
+        Get the Tyk generated server URLs for a Tyk OAS API. This endpoint returns structured URL information including decomposed components (protocol, domain, listen path, version path, query parameters, and headers) for all server URLs that Tyk generates for the API.
+      operationId: getOASServerURLs
+      parameters:
+      - description: ID of the API for which you want to retrieve server URLs.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nonVersionedAPI:
+                  summary: Non-versioned API
+                  description: Simple API without versioning returns a single server URL
+                  value:
+                    api_id: "4c1c0d8fc885401053ddac4e39ef676b"
+                    urls:
+                      - protocol: "http"
+                        domain: "localhost"
+                        port: 8080
+                        listen_path: "my-api"
+                        endpoint_path: ""
+                        query_parameters: []
+                        headers: []
+                        url: "http://localhost:8080/my-api"
+                versionedAPIUrlPath:
+                  summary: URL path versioning
+                  description: Base API with URL path versioning (location=url)
+                  value:
+                    api_id: "5d2e3f4a6b7c8d9e0f1a2b3c"
+                    urls:
+                      - protocol: "https"
+                        domain: "api.example.com"
+                        port: null
+                        listen_path: "users"
+                        endpoint_path: "v1"
+                        query_parameters: []
+                        headers: []
+                        url: "https://api.example.com/users/v1"
+                      - protocol: "https"
+                        domain: "api.example.com"
+                        port: null
+                        listen_path: "users"
+                        endpoint_path: ""
+                        query_parameters: []
+                        headers: []
+                        url: "https://api.example.com/users"
+                versionedAPIQueryParam:
+                  summary: Query parameter versioning
+                  description: Base API with query parameter versioning (location=url-param)
+                  value:
+                    api_id: "6e3f4g5h7i8j9k0l1m2n3o4p"
+                    urls:
+                      - protocol: "https"
+                        domain: "gateway.tyk.io"
+                        port: null
+                        listen_path: "products"
+                        endpoint_path: ""
+                        query_parameters:
+                          - name: "version"
+                            value: "v1"
+                        headers: []
+                        url: "https://gateway.tyk.io/products?version=v1"
+                versionedAPIHeader:
+                  summary: Header versioning
+                  description: Base API with header-based versioning (location=header)
+                  value:
+                    api_id: "7f4g5h6i8j9k0l1m2n3o4p5q"
+                    urls:
+                      - protocol: "https"
+                        domain: "api.company.com"
+                        port: null
+                        listen_path: "orders"
+                        endpoint_path: ""
+                        query_parameters: []
+                        headers:
+                          - name: "X-API-Version"
+                            value: "v1"
+                        url: "https://api.company.com/orders"
+                externalChildAPI:
+                  summary: External child API (v2)
+                  description: External child API exposes both versioned path and direct path
+                  value:
+                    api_id: "8g5h6i7j9k0l1m2n3o4p5q6r"
+                    urls:
+                      - protocol: "https"
+                        domain: "api.example.com"
+                        port: null
+                        listen_path: "users"
+                        endpoint_path: "v2"
+                        query_parameters: []
+                        headers: []
+                        url: "https://api.example.com/users/v2"
+                      - protocol: "https"
+                        domain: "api.example.com"
+                        port: null
+                        listen_path: "users-v2"
+                        endpoint_path: ""
+                        query_parameters: []
+                        headers: []
+                        url: "https://api.example.com/users-v2"
+                customDomain:
+                  summary: Custom domain configuration
+                  description: API with custom domain configured
+                  value:
+                    api_id: "9h6i7j8k0l1m2n3o4p5q6r7s"
+                    urls:
+                      - protocol: "https"
+                        domain: "custom.domain.com"
+                        port: null
+                        listen_path: "api"
+                        endpoint_path: ""
+                        query_parameters: []
+                        headers: []
+                        url: "https://custom.domain.com/api"
+              schema:
+                $ref: '#/components/schemas/OASServerURLsResponse'
+          description: Successfully retrieved server URLs.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: API ID is required
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad request. API ID is missing or invalid.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized. Invalid or missing authorization credentials.
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access /api/apis/oas/{apiId}/urls'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden. User does not have permission to access this API.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API not found
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found. The specified API ID does not exist.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to generate server URLs
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error. Failed to generate or parse server URLs.
+      summary: Get OAS API server URLs.
+      tags:
+      - OAS APIs
+  /api/apis/oas/{apiId}/categories:
+    get:
+      description: Get a list of the API categories associated with the specified
+        API.
+      operationId: getApiCategories
+      parameters:
+      - description: ID of the API.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                categories:
+                - developers
+                - devops
+                - research
+              schema:
+                $ref: '#/components/schemas/CategoriesPayload'
+          description: Category fetched.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/oas/{apiId}/categories'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API not found
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal categories payload.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get OAS API's Categories.
+      tags:
+      - OAS APIs
+    put:
+      description: Update the list of API categories associated with the specified
+        API.
+      operationId: updateApiCategories
+      parameters:
+      - description: ID of the API.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              categories:
+              - dev
+              - testers
+              - messages
+            schema:
+              $ref: '#/components/schemas/CategoriesPayload'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: API categories updated.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Categories updated.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Failed to update ApiDef object to DB.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request data.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/oas/{apiId}/categories'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: API not found
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to update ApiDef object to DB.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update OAS API categories.
+      tags:
+      - OAS APIs
+  /api/apis/oas/{apiId}/export:
+    get:
+      description: Download API definition in OAS format (only APIs saved in OAS format).
+        When you set the mode query parameter to public the OAS spec exported will
+        exclude the x-tyk-api-gateway part. When mode query parameter is empty or
+        is set to any other value apart from public then the exported OAS spec will
+        include the x-tyk-api-gateway part.
+      operationId: downloadApiOASPublic
+      parameters:
+      - description: ID of the API you want to export.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      - description: Mode of OAS export, by default mode could be empty which means
+          to export OAS spec including OAS Tyk extension. When mode=public, OAS spec
+          excluding Tyk extension is exported.
+        example: public
+        in: query
+        name: mode
+        required: false
+        schema:
+          enum:
+          - public
+          type: string
+      - name: Content-Type
+        in: header
+        required: false
+        description: Content type of the fetched data. The endpoint returns data in JSON format if Content-Type header is empty.
+        schema:
+          type: string
+          enum: [ "application/json", "application/x-yaml" ]
+      responses:
+        "200":
+          content:
+            application/octet-stream:
+              schema:
+                format: binary
+                type: string
+          description: Fetched successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve API detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/oas/{apiId}/export'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+      summary: Export OAS API.
+      tags:
+      - OAS APIs
+  /api/apis/oas/{apiId}/versions:
+    get:
+      description: List all the  versions of an OAS API.
+      operationId: listOASApiVersions
+      parameters:
+      - description: ID of the API you want to fetch.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      - $ref: '#/components/parameters/SearchText'
+      - $ref: '#/components/parameters/AccessType'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                apis:
+                - expirationDate: 2024-11-30 12:00
+                  id: 5b633de8673e40e44bc88b6b248f0937
+                  internal: false
+                  isDefaultVersion: true
+                  name: user
+                  versionName: Default
+                - expirationDate: 2024-11-30 12:00
+                  id: 0fec4eb890cf4b8c5cb6fc011456c315
+                  internal: false
+                  isDefaultVersion: false
+                  name: user
+                  versionName: v2
+                pages: 1
+              schema:
+                $ref: '#/components/schemas/VersionMetas'
+          description: Version fetched.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/oas/{apiId}/versions'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve API detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not found.
+        "422":
+          content:
+            application/json:
+              example:
+                Message: '{apiId} is not recognised'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: API not recognised.
+      summary: List OAS API versions.
+      tags:
+      - OAS APIs
+  /api/apis/oas/dry-run:
+    post:
+      description: |-
+        Generate a Tyk OAS API definition without saving it to the Dashboard database.
+        This endpoint is used to produce a Tyk OAS API definition without creating the API proxy itself. This provides a dry run functionality for Tyk OAS API creation, showing what would be created in the Dashboard given the set of inputs provided.
+      operationId: dryRunApiOAS
+      parameters:
+      - $ref: '#/components/parameters/TemplateID'
+      - description: The base API which the new version will be linked to.
+        example: 663a4ed9b6be920001b191ae
+        in: query
+        name: base_api_id
+        required: false
+        schema:
+          type: string
+      - description: The version name of the base API while creating the first version.
+          This doesn't have to be sent for the next versions but if it is set, it
+          will override base API version name.
+        example: Default
+        in: query
+        name: base_api_version_name
+        required: false
+        schema:
+          type: string
+      - description: The version name of the created version.
+        example: v2
+        in: query
+        name: new_version_name
+        required: false
+        schema:
+          type: string
+      - description: If true, the new version is set as default version.
+        example: true
+        in: query
+        name: set_default
+        required: false
+        schema:
+          type: boolean
+      - $ref: '#/components/parameters/UpstreamURL'
+      - $ref: '#/components/parameters/ListenPath'
+      - $ref: '#/components/parameters/CustomDomain'
+      - $ref: '#/components/parameters/AllowList'
+      - $ref: '#/components/parameters/ValidateRequest'
+      - $ref: '#/components/parameters/MockResponse'
+      - $ref: '#/components/parameters/Authentication'
+      requestBody:
+        content:
+          application/json:
+            example:
+              oas:
+                components:
+                  securitySchemes:
+                    bearerAuth:
+                      description: The API Access Credentials
+                      scheme: bearer
+                      type: http
+                info:
+                  description: This is a sample OpenAPI description.
+                  title: Sample OpenAPI description
+                  version: 1.0.0
+                openapi: 3.0.3
+                paths:
+                  /api/sample/users:
+                    get:
+                      operationId: getUsersOperation
+                      responses:
+                        "200":
+                          content:
+                            application/json:
+                              schema:
+                                items:
+                                  properties:
+                                    name:
+                                      type: string
+                                  type: object
+                                type: array
+                          description: fetched users
+                      summary: Get users
+                      tags:
+                      - users
+                security:
+                - bearerAuth: []
+                servers:
+                - url: https://localhost:8080
+              tyk_oas:
+                components:
+                  securitySchemes:
+                    bearerAuth:
+                      description: The API Access Credentials
+                      scheme: bearer
+                      type: http
+                info:
+                  description: This is a sample OpenAPI description.
+                  title: Sample OpenAPI description
+                  version: 1.0.0
+                openapi: 3.0.3
+                paths:
+                  /api/sample/users:
+                    get:
+                      operationId: getUsersSample
+                      responses:
+                        "200":
+                          content:
+                            application/json:
+                              schema:
+                                items:
+                                  properties:
+                                    name:
+                                      type: string
+                                  type: object
+                                type: array
+                          description: fetched users
+                      summary: Get users
+                      tags:
+                      - users
+                security:
+                - bearerAuth: []
+                servers:
+                - url: https://localhost:8080
+                x-tyk-api-gateway:
+                  info:
+                    name: user
+                    state:
+                      active: true
+                  server:
+                    listenPath:
+                      strip: true
+                      value: /user-test-four/
+                  upstream:
+                    url: https://localhost:8080
+            schema:
+              $ref: '#/components/schemas/DryRunRequest'
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                oasExample:
+                  $ref: '#/components/examples/oasExample'
+              schema:
+                allOf:
+                - $ref: '#/components/schemas/TykVendorExtension'
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+          description: Success.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Couldn't read body.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request body.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/oas/dry-run'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+      summary: Dry Run OAS.
+      tags:
+      - OAS APIs
+  /api/apis/oas/import:
+    post:
+      description: For use with an existing OpenAPI document that you want to expose
+        via your Tyk Gateway. <br/> Create a new Tyk OAS API from an OpenAPI document
+        in JSON or YAML format (without x-tyk-api-gateway extension). <br/>The payload can
+        contain either a fully fledged OpenAPI document or a URL pointing to an OpenAPI
+        document.
+      operationId: importOAS
+      parameters:
+      - $ref: '#/components/parameters/UpstreamURL'
+      - $ref: '#/components/parameters/ListenPath'
+      - $ref: '#/components/parameters/CustomDomain'
+      - $ref: '#/components/parameters/AllowList'
+      - $ref: '#/components/parameters/ValidateRequest'
+      - $ref: '#/components/parameters/MockResponse'
+      - $ref: '#/components/parameters/Authentication'
+      - $ref: '#/components/parameters/TemplateID'
+      - description: The base API which the new version will be linked to.
+        example: 663a4ed9b6be920001b191ae
+        in: query
+        name: base_api_id
+        required: false
+        schema:
+          type: string
+      - description: The version name of the base API while creating the first version.
+          This doesn't have to be sent for the next versions but if it is set, it
+          will override base API version name.
+        example: Default
+        in: query
+        name: base_api_version_name
+        required: false
+        schema:
+          type: string
+      - description: The version name of the created version.
+        example: v2
+        in: query
+        name: new_version_name
+        required: false
+        schema:
+          type: string
+      - description: If true, the new version is set as default version.
+        example: true
+        in: query
+        name: set_default
+        required: false
+        schema:
+          type: boolean
+      - name: Content-Type
+        in: header
+        required: false
+        description: Content type of the imported document. If Content-Type header is empty, it's assumed that Content-Type is application/json.
+        schema:
+          type: string
+          enum: [ "application/json", "application/x-yaml" ]
+      requestBody:
+        content:
+          application/json:
+            examples:
+              ImportByUrl:
+                summary: Import By Url
+                value:
+                  url: https://gist.githubusercontent.com/yurisasuke/e4f11baefb68f2ace5dd2297b7ccc3e0/raw/bb476fa4d4a48874b26d9df9bf62094d1a07f040/tykOas.json
+              ImportTykOAS:
+                summary: Import Tyk Oas Example
+                value:
+                  components:
+                    securitySchemes:
+                      bearerAuth:
+                        description: The API Access Credentials
+                        scheme: bearer
+                        type: http
+                  info:
+                    description: This is a sample OpenAPI description.
+                    title: Sample OpenAPI description
+                    version: 1.0.0
+                  openapi: 3.0.3
+                  paths:
+                    /api/sample/users:
+                      get:
+                        operationId: getUsersOperation
+                        responses:
+                          "200":
+                            content:
+                              application/json:
+                                schema:
+                                  items:
+                                    properties:
+                                      name:
+                                        type: string
+                                    type: object
+                                  type: array
+                            description: fetched users
+                        summary: Get users
+                        tags:
+                        - users
+                  security:
+                  - bearerAuth: []
+                  servers:
+                  - url: https://localhost:8080
+            schema:
+              oneOf:
+              - $ref: '#/components/schemas/ApiImportByUrlPayload'
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+          application/x-yaml:
+            examples:
+              oasExample:
+                $ref: '#/components/examples/oasExampleWithoutTykExtension'
+            schema:
+              $ref: '#/components/schemas/OpenAPI3Schema'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/FormDataFile'
+        description: The content of the file should be the OpenAPI document in JSON or YAML
+          format (without x-tyk-api-gateway extension).
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                ID: 78ade81be12349087e194c858f06f595
+                Message: API created
+                Meta: 6656cda15715ec8ddb0e7e7c
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: OAS imported.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: The import payload should not contain x-tyk-api-gateway.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed body.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: The user does not have the rights to apply templates.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden.
+        "409":
+          content:
+            application/json:
+              example:
+                Message: Found API with the same ID.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Conflict
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to save new org object to DB.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Import OAS.
+      tags:
+      - OAS APIs
+  /api/mcps:
+    get:
+      description: List MCP Proxy definitions owned by the caller's organisation.
+        Results are paginated and each entry is a Tyk OAS document marked as an
+        MCP Proxy definition via the `x-tyk-api-gateway` extension.
+      operationId: listMCPAPIs
+      parameters:
+      - { in: query, name: p,      required: false, schema: { type: integer }, description: Page number (0-indexed). }
+      - { in: query, name: q,      required: false, schema: { type: string  }, description: Free-text search on the MCP name. }
+      - { in: query, name: sort,   required: false, schema: { type: string  }, description: Sort field for the result list. }
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  mcps:
+                    type: array
+                    items:
+                      allOf:
+                      - $ref: '#/components/schemas/OpenAPI3Schema'
+                      - $ref: '#/components/schemas/TykVendorExtension'
+                  pages: { type: integer }
+          description: Paginated list of MCP Proxy definitions.
+        "401": { description: Unauthorized, content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+      summary: List MCP Proxy definitions.
+      tags:
+      - MCP Proxies
+    post:
+      description: |
+        Create an MCP Proxy definition. The request body is a Tyk OAS document that
+        **must** contain `x-tyk-api-gateway` with MCP configuration. The payload is
+        validated against the MCP JSON schema and rejected if it uses any restricted
+        middleware (transformRequestMethod, transformResponseBody, urlRewrite,
+        internal, cache, validateRequest, mockResponse).
+      operationId: addMCPAPI
+      requestBody:
+        required: true
+        content:
+          application/json:
+            example:
+              openapi: 3.0.3
+              info: { title: MCP Proxy Sample, version: 1.0.0 }
+              paths: {}
+              components: {}
+              servers: [{ url: /mcp-sample/ }]
+              x-tyk-api-gateway:
+                info:
+                  name: mcp-sample
+                  state: { active: true }
+                server:
+                  listenPath: { strip: true, value: /mcp-sample/ }
+                  authentication:
+                    enabled: true
+                    securitySchemes:
+                      authToken: { enabled: true }
+                upstream:
+                  url: http://localhost:7878/mcp
+                middleware:
+                  global:
+                    contextVariables: { enabled: true }
+                    trafficLogs: { enabled: true }
+                  mcpTools: {}
+                  operations: {}
+            schema:
+              allOf:
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+              - $ref: '#/components/schemas/TykVendorExtension'
+      responses:
+        "200":
+          content:
+            application/json:
+              example: { Status: OK, Message: MCP Proxy definition created, ID: e30bee13ad4248c3b529a4c58bb7be4e }
+              schema: { $ref: '#/components/schemas/ApiResponse' }
+          description: MCP Proxy definition created.
+        "400":
+          content:
+            application/json:
+              example: { Status: Error, Message: "the payload should contain x-tyk-api-gateway" }
+              schema: { $ref: '#/components/schemas/ApiResponse' }
+          description: Validation failed (invalid OAS, missing MCP extension, restricted middleware, or schema violation).
+        "401": { description: Unauthorized, content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+      summary: Create an MCP Proxy definition.
+      tags:
+      - MCP Proxies
+  /api/mcps/{apiId}:
+    parameters:
+    - { in: path, name: apiId, required: true, schema: { type: string }, description: MCP Proxy definition ID. }
+    get:
+      description: Retrieve a single MCP Proxy definition by its ID. Returns 400 if
+        the ID refers to a definition that is not an MCP Proxy definition.
+      operationId: getMCPAPI
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                allOf:
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+                - $ref: '#/components/schemas/TykVendorExtension'
+          description: The MCP Proxy definition.
+        "400": { description: Not an MCP Proxy definition, content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "404": { description: MCP Proxy definition not found, content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+      summary: Get an MCP Proxy definition.
+      tags:
+      - MCP Proxies
+    put:
+      description: Update an existing MCP Proxy definition. The same validation rules
+        as `POST /api/mcps` apply to the payload.
+      operationId: updateMCPAPI
+      requestBody:
+        required: true
+        content:
+          application/json:
+            example:
+              openapi: 3.0.3
+              info: { title: MCP Proxy Sample, version: 1.0.0 }
+              paths: {}
+              components: {}
+              servers: [{ url: /mcp-sample/ }]
+              x-tyk-api-gateway:
+                info:
+                  name: mcp-sample
+                  state: { active: true }
+                server:
+                  listenPath: { strip: true, value: /mcp-sample/ }
+                  authentication:
+                    enabled: true
+                    securitySchemes:
+                      authToken: { enabled: true }
+                upstream:
+                  url: http://localhost:7878/mcp
+                middleware:
+                  global:
+                    contextVariables: { enabled: true }
+                    trafficLogs: { enabled: true }
+                  mcpTools: {}
+                  operations: {}
+            schema:
+              allOf:
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+              - $ref: '#/components/schemas/TykVendorExtension'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ApiResponse' }
+          description: MCP Proxy definition updated.
+        "400": { description: Validation failed,                  content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "404": { description: MCP Proxy definition not found,     content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+      summary: Update an MCP Proxy definition.
+      tags:
+      - MCP Proxies
+    delete:
+      description: Delete an MCP Proxy definition.
+      operationId: deleteMCPAPI
+      responses:
+        "200":
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ApiResponse' }
+          description: MCP Proxy definition deleted.
+        "400": { description: Bad Request,                     content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "404": { description: MCP Proxy definition not found,  content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+      summary: Delete an MCP Proxy definition.
+      tags:
+      - MCP Proxies
+  /api/apis/oauth/{apiId}:
+    get:
+      description: Return all the auth 2 clients that have been registered with you
+        tyk instance
+      operationId: getOathClientsList
+      parameters:
+      - description: The API’s ID.
+        example: e95400eba23c4a2d4622a722be06fe95
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                apps:
+                - client_id: 2a06b398c17f46908de3dffcb71ef87d
+                  client_name: ""
+                  dcr_registration:
+                    access_token: ""
+                    client_uri: ""
+                    provider: ""
+                  description: google client
+                  meta_data:
+                    user_id: 362b3fb9a1d5e4f00017226f5
+                  policy_id: 665d51505715ec2d76022c87
+                  redirect_uri: https://httpbin.org/ip
+                  secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+                pages: 1
+              schema:
+                $ref: '#/components/schemas/OAuthApps'
+          description: Fetched successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: API Reference not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Not enough permissions or  API not found.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/oauth/{apiId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve apps list.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal key data from Tyk API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List OAuth clients.
+      tags:
+      - Oauth
+    post:
+      description: Client apps are created dynamically, the only parameter required
+        to create a new client app with Tyk is to specify the redirect URI, this is
+        used as part of the client authentication and cannot be edited later. Please
+        note that if you don't attach a policy to the OAuth client you will need to
+        provide dynamic key rules to client authorization endpoint.
+      operationId: createNewClientApp
+      parameters:
+      - description: The API’s ID.
+        example: e95400eba23c4a2d4622a722be06fe95
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              meta_data:
+                user_id: 362b3fb9a1d5e4f00017226f5
+              policy_id: 665d51505715ec2d76022c87
+              redirect_uri: https://httpbin.org/ip
+            schema:
+              $ref: '#/components/schemas/NewClientRequest'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                client_id: 2a06b398c17f46908de3dffcb71ef87d
+                client_name: ""
+                dcr_registration:
+                  access_token: ""
+                  client_uri: ""
+                  provider: ""
+                description: google client
+                meta_data:
+                  user_id: 362b3fb9a1d5e4f00017226f5
+                policy_id: 665d51505715ec2d76022c87
+                redirect_uri: https://httpbin.org/ip
+                secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+              schema:
+                $ref: '#/components/schemas/OAuthClient'
+          description: Client created.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: API reference not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Request body malformed.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve policy details.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Create a new OAuth2.0 client.
+      tags:
+      - Oauth
+  /api/apis/oauth/{apiId}/{clientId}:
+    delete:
+      description: You can delete an OAuth client using this endpoint. Please note
+        that tokens issued with the client ID will still be valid until they expire.
+      operationId: deleteOathClient
+      parameters:
+      - description: The API’s ID.
+        example: e95400eba23c4a2d4622a722be06fe95
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      - description: The client ID.
+        example: 2a06b398c17f46908de3dffcb71ef87
+        in: path
+        name: clientId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: OAuth client deleted successfully.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Deleted successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: API Reference not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: You don't have access to this.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: You have no access.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve app detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not remove app.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Delete OAuth client.
+      tags:
+      - Oauth
+    get:
+      description: Get single  OAuth client details with its client ID.
+      operationId: getOAuthClientDetail
+      parameters:
+      - description: The API’s ID.
+        example: e95400eba23c4a2d4622a722be06fe95
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      - description: The client ID.
+        example: 2a06b398c17f46908de3dffcb71ef87
+        in: path
+        name: clientId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                client_id: 2a06b398c17f46908de3dffcb71ef87d
+                client_name: ""
+                dcr_registration:
+                  access_token: ""
+                  client_uri: ""
+                  provider: ""
+                description: google client
+                meta_data:
+                  user_id: 362b3fb9a1d5e4f00017226f5
+                policy_id: 665d51505715ec2d76022c87
+                redirect_uri: https://httpbin.org/ip
+                secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+              schema:
+                $ref: '#/components/schemas/OAuthClient'
+          description: Details fetched successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: API reference not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: You don't have access to this.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: You have no access.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve app detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal app data from Tyk API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get single OAuth client details.
+      tags:
+      - Oauth
+  /api/apis/oauth/{apiId}/{clientId}/tokens:
+    get:
+      description: This endpoint allows you to retrieve a list of all current tokens
+        and their expiry date for a provided API ID and OAuth client ID.
+      operationId: getClientTokens
+      parameters:
+      - description: The API’s ID.
+        example: e95400eba23c4a2d4622a722be06fe95
+        in: path
+        name: apiId
+        required: true
+        schema:
+          type: string
+      - description: The client ID.
+        example: 2a06b398c17f46908de3dffcb71ef87
+        in: path
+        name: clientId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+              - code: 5a7d110be6355b0c071cc339327563cb45174ae387f52f87a80d2496
+                expires: 1.618158407e+09
+              - code: 5a7d110be6355b0c071cc33988884222b0cf436eba7979c6c51d6dbd
+                expires: 1.618158594e+09
+              schema:
+                $ref: '#/components/schemas/OAuthClientTokens'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                Message: API Reference not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/oauth/{apiId}/{clientId}/tokens'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve tokens.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal tokens data from Tyk API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List OAuth client tokens.
+      tags:
+      - Oauth
+  /api/apis/migrate:
+    post:
+      description: Migrate APIs from Tyk Classic to Tyk OAS format. The endpoint supports different migration modes including dry run, staging, promotion and direct migration.
+      operationId: migrateAPI
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MigrateAPIRequest'
+            example:
+              mode: "dryRun"
+              apiIDs: [ "api123", "api456" ]
+              abortOnFailure: true
+      responses:
+        "200":
+          description: Migration completed
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MigrateAPIResponse'
+        "400":
+          description: Bad request - validation failed
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+        "401":
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+      summary: Migrate APIs from Tyk Classic to Tyk OAS format.
+      tags:
+      - MigrateOAS
+
+  /api/apis/search:
+    get:
+      description: This will return a list of APIs whose names matches the provided
+        q query parameter.If q is not sent all APIs will be returned.The returned
+        results are paginated.
+      operationId: searchApis
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      - description: The name of the APIs you want to search
+        example: Rate Limit Path API 1
+        in: query
+        name: q
+        required: false
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                paginatedApiExample:
+                  $ref: '#/components/examples/paginatedApiExample'
+              schema:
+                $ref: '#/components/schemas/ApiDefinitionsResponse'
+          description: List of API definitions
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve APIs
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/apis/search'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal APIs data
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Search List of APIs
+      tags:
+      - APIs
+  /api/assets:
+    get:
+      description: Retrieves all types of assets with optional kind filter.
+      operationId: listAssets
+      parameters:
+      - description: Filter assets by kind (optional).
+        example: oas-template
+        in: query
+        name: kind
+        required: false
+        schema:
+          default: oas-template
+          enum:
+          - oas-template
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+              - _id: "363634636164353135373135656333663739386262636433"
+                data:
+                  info:
+                    title: Our Sample OAS
+                    version: 1.0.0
+                  openapi: 3.0.3
+                  paths:
+                    /anything:
+                      post:
+                        operationId: anythingpost
+                        responses:
+                          "200":
+                            description: Post created
+                  x-tyk-api-gateway:
+                    middleware:
+                      global:
+                        cache:
+                          cacheAllSafeRequests: true
+                          enabled: true
+                          timeout: 5
+                      operations:
+                        anythingpost:
+                          requestSizeLimit:
+                            enabled: true
+                            value: 100
+                description: My first template
+                id: my-unique-template-id
+                kind: oas-template
+                last_updated: "2024-05-21T17:18:57.294797+03:00"
+                name: my-template
+                org_id: 5e9d9544a1dcd60001d0ed20
+              schema:
+                items:
+                  $ref: '#/components/schemas/Asset'
+                type: array
+          description: templates fetched.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: 'unsupported asset kind: ''oas-temp'''
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: sending a type that is not supported in the kind query parameter.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/assets'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: error listing assets.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Retrieve list of assets.
+      tags:
+      - Assets
+    post:
+      description: Create an asset that you can use as a blueprint from which you
+        can create a new Tyk OAS API definition.
+      operationId: addAsset
+      requestBody:
+        content:
+          application/json:
+            example:
+              data:
+                info:
+                  title: Our Sample OAS
+                  version: 1.0.0
+                openapi: 3.0.3
+                paths:
+                  /anything:
+                    post:
+                      operationId: anythingpost
+                      responses:
+                        "200":
+                          description: post created
+                x-tyk-api-gateway:
+                  middleware:
+                    global:
+                      cache:
+                        cacheAllSafeRequests: true
+                        enabled: true
+                        timeout: 5
+              description: My first template
+              id: my-unique-template-id
+              kind: oas-template
+              name: my-template
+            schema:
+              properties:
+                data:
+                  $ref: '#/components/schemas/JSONRawMessage'
+                description:
+                  type: string
+                id:
+                  type: string
+                kind:
+                  type: string
+                name:
+                  type: string
+              type: object
+        description: Sample asset.
+      responses:
+        "201":
+          content:
+            application/json:
+              example:
+                ID: my-unique-template-id
+                Message: asset created
+                Meta: 664d86e35715ec0d370bbe11
+                Status: success
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: asset created
+        "400":
+          content:
+            application/json:
+              example:
+                Message: error reading json body.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: malformed request body.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/assets'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "409":
+          content:
+            application/json:
+              example:
+                Message: 'Asset ID already exists: ''my-unique-template-id''.'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: trying to add an asset with an ID that already exist.
+        "422":
+          content:
+            application/json:
+              example:
+                Message: 'unsupported asset kind: ''oas-templat''.'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: validation failed
+        "500":
+          content:
+            application/json:
+              example:
+                Message: error adding asset.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Create an asset
+      tags:
+      - Assets
+  /api/assets/{assetID}:
+    delete:
+      description: Remove an asset ID.
+      operationId: deleteAsset
+      parameters:
+      - description: ID of the asset to delete - this value can be the database ID
+          of the asset or the custom ID provided during creation/update.
+        examples:
+          customID:
+            summary: Custom template ID.
+            value: my-unique-template-id
+          dbID:
+            summary: A unique database identifier assigned by Tyk.
+            value: 664cad515715ec3f798bbcd3
+        in: path
+        name: assetID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Asset removed successfully
+                Meta: null
+                Status: success
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Asset deleted
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/assets/{assetID}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: asset not found
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Asset with ID does not exist.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Error removing asset
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Delete an asset by ID.
+      tags:
+      - Assets
+    get:
+      description: Retrieve an asset by ID.
+      operationId: getAsset
+      parameters:
+      - description: ID of the asset to retrieve - this value can be the database
+          ID of the asset or the custom ID provided during creation/update.
+        examples:
+          customID:
+            summary: Custom template ID.
+            value: my-unique-template-id
+          dbID:
+            summary: A unique database identifier assigned by Tyk.
+            value: 664cad515715ec3f798bbcd3
+        in: path
+        name: assetID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                _id: "363634636164353135373135656333663739386262636433"
+                data:
+                  info:
+                    title: Our Sample OAS
+                    version: 1.0.0
+                  openapi: 3.0.3
+                  paths:
+                    /anything:
+                      post:
+                        operationId: anythingpost
+                        responses:
+                          "200":
+                            description: Post created
+                  x-tyk-api-gateway:
+                    middleware:
+                      global:
+                        cache:
+                          cacheAllSafeRequests: true
+                          enabled: true
+                          timeout: 5
+                      operations:
+                        anythingpost:
+                          requestSizeLimit:
+                            enabled: true
+                            value: 100
+                description: My first template
+                id: my-unique-template-id
+                kind: oas-template
+                last_updated: "2024-05-21T17:18:57.294797+03:00"
+                name: my-template
+                org_id: 5e9d9544a1dcd60001d0ed20
+              schema:
+                $ref: '#/components/schemas/Asset'
+          description: Asset fetched.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/assets/{assetID}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Asset not found
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Asset with ID does not exist
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Error fetching asset.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Retrieve an asset.
+      tags:
+      - Assets
+    put:
+      description: Update an asset by ID.You cannot update _id (database ID assigned
+        by tyk)
+      operationId: updateAsset
+      parameters:
+      - description: ID of the asset to update - this value can be the database ID
+          of the asset or the custom ID provided during creation/update.
+        examples:
+          customID:
+            summary: Custom template ID.
+            value: my-unique-template-id
+          dbID:
+            summary: A unique database identifier assigned by Tyk.
+            value: 664cad515715ec3f798bbcd3
+        in: path
+        name: assetID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              data:
+                info:
+                  title: Our Sample OAS
+                  version: 1.0.0
+                openapi: 3.0.3
+                paths:
+                  /anything:
+                    post:
+                      operationId: anythingpost
+                      responses:
+                        "200":
+                          description: post created
+                x-tyk-api-gateway:
+                  middleware:
+                    global:
+                      cache:
+                        cacheAllSafeRequests: true
+                        enabled: true
+                        timeout: 5
+              description: My first template
+              id: my-unique-template-id
+              kind: oas-template
+              name: Update asset name example.
+            schema:
+              properties:
+                data:
+                  $ref: '#/components/schemas/JSONRawMessage'
+                description:
+                  type: string
+                id:
+                  type: string
+                kind:
+                  type: string
+                name:
+                  type: string
+              type: object
+        description: update name example.
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                ID: my-unique-template-id
+                Message: asset updated
+                Meta: 664d86e35715ec0d370bbe11
+                Status: success
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: asset updated
+        "400":
+          content:
+            application/json:
+              example:
+                Message: error reading json body.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: malformed  request body
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/assets/{assetID}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Asset not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Asset with ID does not exist.
+        "409":
+          content:
+            application/json:
+              example:
+                Message: 'Asset ID already exists: ''my-unique-template-id.''.'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Trying to update an asset ID with an ID that is used by another
+            asset.
+        "422":
+          content:
+            application/json:
+              example:
+                Message: 'unsupported asset kind: ''oas-templat''.'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: validation failed.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: error fetching asset.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update an asset by ID.
+      tags:
+      - Assets
+  /api/certs:
+    get:
+      description: Return list of certificates. If you send the mode query parameter
+        with the value `detailed` the certificates returned will have more information
+        (Will contains all certs basic details). To retrieve a list with complete
+        certificate details use [this endpoint](#operation/listDetailedCertificates).
+        If the mode query parameter is omitted or is empty this endpoint will only
+        return the certificates IDs. The list of certificates returned is paginated.
+      operationId: listCertificates
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      - description: Set to detailed to get certificates that are more with more details
+          (Will contains certs basic details). To retrieve a list of certificates
+          with all the certificate details use [this endpoint](#operation/listDetailedCertificates).
+        example: detailed
+        in: query
+        name: mode
+        required: false
+        schema:
+          enum:
+          - detailed
+          type: string
+      - description: |- 
+          Used to apply filtering to the list of certificates returned in the response. 
+          With this option you are able to filter by certificates that can be used when signing a request (i.e. they contain a private key),
+          or those used to validate a signature (i.e. they do not contain a private key, only the public key).
+          This query param works only in combination with detailed mode (mode=detailed). 
+          `omit` (default) – Returns all certificates.
+          with_pk – Returns only certificates that include a private key.
+          without_pk – Returns only certificates that do not include a private key.
+        name: filter
+        example: omit
+        required: false
+        in: query
+        schema:
+          type: string
+          default: omit
+          enum:
+            - omit
+            - with_pk
+            - without_pk
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                detailed_mode:
+                  summary: Returned when you send mode=detailed in query parameter.
+                  value:
+                    cert_basics:
+                    - dns_names:
+                      - .*itachi.io
+                      has_private: false
+                      id: 5e9d9544a1dcd60001d0ed208edce514c2d0a866063550c64d6c90be99d01561ac5aa7e82b8610b7e273d37d
+                      is_ca: false
+                      issuer_cn: tyk-gateway-2.localhost
+                      not_after: "2025-05-19T05:23:10Z"
+                      not_before: "2024-05-19T05:23:10Z"
+                      subject_cn: tyk-gateway-2.localhost
+                    - dns_names:
+                      - .*tyk.io
+                      has_private: false
+                      id: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+                      is_ca: false
+                      issuer_cn: tyk.io
+                      not_after: "2034-03-26T08:46:37Z"
+                      not_before: "2024-03-25T08:46:37Z"
+                      subject_cn: tyk.io
+                    pages: 1
+                empty_mode:
+                  summary: Returned if `mode` in query parameter is empty.
+                  value:
+                    certs:
+                    - 5e9d9544a1dcd60001d0ed208edce514c2d0a866063550c64d6c90be99d01561ac5aa7e82b8610b7e273d37d
+                    - 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+                    pages: 1
+              schema:
+                oneOf:
+                - $ref: '#/components/schemas/CertificateBasics'
+                - $ref: '#/components/schemas/CertificateList'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve certs.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unable to retrieve certificates.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/certs'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data for certificates basics list.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List Certificates.
+      tags:
+      - Certificates
+    post:
+      description: Upload new SSL certificate in PEM format (you should upload as
+        a file). If the certificate should have a private key, convert both the public
+        certificate and the associated private key to PEM format and concatenate them
+        to a single file. You can only upload one certificate at a time.
+      operationId: createCertificates
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/FormDataFile'
+        description: File containing the certs.
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                id: 5e9d9544a1dcd60001d0ed208edce514c2d0a866063550c64d6c90be99d01561ac5aa7e82b8610b7e273d37d
+                message: Certificate added.
+                status: ok
+              schema:
+                $ref: '#/components/schemas/APICertificateStatusMessage'
+          description: Certificates created.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/certs'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not create certificate.Certificate with 5e9d9... ID
+                  already exists.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: unable to create certs
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Sending data without the certs file.
+      summary: Create a certificate in Tyk org cert store.
+      tags:
+      - Certificates
+  /api/certs/{certId}/apis:
+    get:
+      description: Fetch APIs linked to a certificate
+      operationId: getAPIsByCertificate
+      parameters:
+        - description: ID of the certificate whose linked APIs you want to list.
+          example: 5e9d9544a1dcd60001d0ed208edce514c2d0a866063550c64d6c90be99d01561ac5aa7e82b8610b7e273d37d
+          in: path
+          name: certId
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                cert_id: "5e9d9544a1dcd60001d0ed208edce514c2d0a866063550c64d6c90be99d01561ac5aa7e82b8610b7e273d37d"
+                pages: 1
+                apis:
+                  - api_id: "663a4ed9b6be920001b191ae"
+                    name: "First API"
+                    usage_type:
+                      - client
+                      - upstream
+                    tyk_api_type: "Tyk OAS"
+                  - api_id: "663a5ed9b6be920001b191ae"
+                    name: "Second API"
+                    usage_type:
+                      - server
+                    tyk_api_type: "Tyk OAS"
+              schema:
+                $ref: '#/components/schemas/APIsUsingCertificate'
+          description: Linked APIs listed
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Certificate not found or access denied
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Failed to retrieve the APIs associated with the certificate.
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Not authorised - You do not have permission, please contact your administrator
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Not authorized to retrieve the APIs associated with the certificate.
+      summary: List APIs lined to a certificate
+      tags:
+        - Certificates
+  /api/certs/{certId}:
+    delete:
+      description: Delete certificate by their ID.
+      operationId: deleteCertificates
+      parameters:
+      - description: ID of the certificate you want to delete.
+        example: 5e9d9544a1dcd60001d0ed208edce514c2d0a866063550c64d6c90be99d01561ac5aa7e82b8610b7e273d37d
+        in: path
+        name: certId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: message
+                status: status
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Certs deleted.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Attempted access to non-owned certificate.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Trying to delete certs you don't own.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/certs/{certId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not delete certificate.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Failed to delete certs.
+      summary: Delete Certificate.
+      tags:
+      - Certificates
+    get:
+      description: Get a single certificate details with the certificate's ID.
+      operationId: getCertificate
+      parameters:
+      - description: ID of the certificate you want to fetch.
+        example: 5e9d9544a1dcd60001d0ed208edce514c2d0a866063550c64d6c90be99d01561ac5aa7e82b8610b7e273d37d
+        in: path
+        name: certId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                dns_names:
+                - .*tyk.io
+                fingerprint: 7c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+                has_private: false
+                id: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+                is_ca: false
+                issuer:
+                  CommonName: tyk.io
+                  Country:
+                  - 'Peachtree '
+                  ExtraNames:
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 6
+                    Value: 'Peachtree '
+                  Locality:
+                  - JN
+                  Names:
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 6
+                    Value: Peachtree
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 10
+                    Value: tyk
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 11
+                    Value: tyk
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 3
+                    Value: tyk.io
+                  - Type:
+                    - 1
+                    - 2
+                    - 840
+                    - 113549
+                    - 1
+                    - 9
+                    - 1
+                    Value: support@tyk.io
+                  Organization:
+                  - tyk
+                  OrganizationalUnit:
+                  - tyk
+                  PostalCode:
+                  - "00010"
+                  Province:
+                  - San Jore
+                  SerialNumber: ""
+                  StreetAddress:
+                  - River side drive
+                not_after: "2034-03-26T08:46:37Z"
+                not_before: "2024-03-25T08:46:37Z"
+                subject:
+                  CommonName: tyk.io
+                  Country:
+                  - 'Peachtree '
+                  ExtraNames:
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 6
+                    Value: 'Peachtree '
+                  Locality:
+                  - JN
+                  Names:
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 6
+                    Value: 'Peachtree '
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 10
+                    Value: tyk
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 11
+                    Value: tyk
+                  - Type:
+                    - 2
+                    - 5
+                    - 4
+                    - 3
+                    Value: tyk.io
+                  - Type:
+                    - 1
+                    - 2
+                    - 840
+                    - 113549
+                    - 1
+                    - 9
+                    - 1
+                    Value: support@tyk.io
+                  Organization:
+                  - tyk
+                  OrganizationalUnit:
+                  - tyk
+                  PostalCode:
+                  - "00010"
+                  Province:
+                  - San Jore
+                  SerialNumber: ""
+                  StreetAddress:
+                  - River side drive
+              schema:
+                $ref: '#/components/schemas/CertsCertificateMeta'
+          description: Certificates fetched.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Attempted access to non-owned certificate.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Trying to fetch certs you don't own.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/certs/{certId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve certificate details. Certificate with
+                  given SHA256 fingerprint not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Failed to fetch certs.
+      summary: Get single certificate with ID.
+      tags:
+      - Certificates
+  /api/certs/dependencies/{certId}:
+    delete:
+      description: This endpoint will remove the certificates from any APIs that contains
+        it as an upstream certificates or as a client certificate. It will also remove
+        any key that uses this certificate.
+      operationId: deleteCertificateDependencies
+      parameters:
+      - description: ID of the certificate you want to delete dependencies for.
+        example: 5e9d9544a1dcd60001d0ed208edce514c2d0a866063550c64d6c90be99d01561ac5aa7e82b8610b7e273d37d
+        in: path
+        name: certId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Certificate dependencies deletion successfully attempted.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Dependencies deleted.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/certs/dependencies/{certId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+      summary: Delete Certificate dependencies.
+      tags:
+      - Certificates
+    get:
+      description: This will return the API IDs and API names of all APIs that uses
+        this certificates as either upstream certificates or as client certificates.
+      operationId: getCertificateDependencies
+      parameters:
+      - description: ID of the certificate you want to fetch dependencies for.
+        example: 5e9d9544a1dcd60001d0ed208edce514c2d0a866063550c64d6c90be99d01561ac5aa7e82b8610b7e273d37d
+        in: path
+        name: certId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                certID: 5e9d9544a1dcd60001d0ed20a6ab77653d5da938f452bb8cc9b55b0630a6743dabd8dc92bfb025abb09ce035
+                client_cert_api_names:
+                - Ngrok Dashboard API
+                client_cert_apis:
+                - edc9b2bd3e7b4cc55c4ff0a7e1529b45
+                key_cert: 5e9d9544a1dcd60001d0ed205e9d9544a1dcd60001d0ed20a6ab77653d5da938f452bb8cc9b55b0630a6743dabd8dc92bfb025abb09ce035
+                upstream_cert_api_names:
+                - External HTTPbin
+                upstream_cert_apis:
+                - 627efb71ebae49df7a853b9769b65fce
+              schema:
+                $ref: '#/components/schemas/CertificateDependencies'
+          description: Dependencies fetched.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/certs/dependencies/{certId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+      summary: Get Certificate Dependencies.
+      tags:
+      - Certificates
+  /api/certs/details:
+    get:
+      description: Return a list that contains certificates and their full details.
+      operationId: listDetailedCertificates
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                certificates:
+                - dns_names:
+                  - .*tyk.io
+                  fingerprint: 7c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+                  has_private: false
+                  id: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+                  is_ca: false
+                  issuer:
+                    CommonName: tyk.io
+                    Country:
+                    - 'Peachtree '
+                    ExtraNames:
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 6
+                      Value: 'Peachtree '
+                    Locality:
+                    - JN
+                    Names:
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 6
+                      Value: Peachtree
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 10
+                      Value: tyk
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 11
+                      Value: tyk
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 3
+                      Value: tyk.io
+                    - Type:
+                      - 1
+                      - 2
+                      - 840
+                      - 113549
+                      - 1
+                      - 9
+                      - 1
+                      Value: support@tyk.io
+                    Organization:
+                    - tyk
+                    OrganizationalUnit:
+                    - tyk
+                    PostalCode:
+                    - "00010"
+                    Province:
+                    - San Jore
+                    SerialNumber: ""
+                    StreetAddress:
+                    - River side drive
+                  not_after: "2034-03-26T08:46:37Z"
+                  not_before: "2024-03-25T08:46:37Z"
+                  subject:
+                    CommonName: tyk.io
+                    Country:
+                    - 'Peachtree '
+                    ExtraNames:
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 6
+                      Value: 'Peachtree '
+                    Locality:
+                    - JN
+                    Names:
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 6
+                      Value: 'Peachtree '
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 10
+                      Value: tyk
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 11
+                      Value: tyk
+                    - Type:
+                      - 2
+                      - 5
+                      - 4
+                      - 3
+                      Value: tyk.io
+                    - Type:
+                      - 1
+                      - 2
+                      - 840
+                      - 113549
+                      - 1
+                      - 9
+                      - 1
+                      Value: support@tyk.io
+                    Organization:
+                    - tyk
+                    OrganizationalUnit:
+                    - tyk
+                    PostalCode:
+                    - "00010"
+                    Province:
+                    - San Jore
+                    SerialNumber: ""
+                    StreetAddress:
+                    - River side drive
+                pages: 1
+              schema:
+                $ref: '#/components/schemas/CertificateDetailedList'
+          description: Fetched certificates.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve certs details.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Could not connect to gateway.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/certs/details'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data for certificate list.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List all certificates details.
+      tags:
+      - Certificates
+  /api/examples:
+    get:
+      description: Returns a list of all example API definitions available in "repository.json"
+        file defined in "x-tyk-examples-index" header. If the header is not provided,
+        Tyk will use the default value of this header which is `tyk-examples` repo.
+      operationId: getAPIExamples
+      parameters:
+      - description: URL path to the repository.json in the repository defined in
+          `x-tyk-repo-url.
+        example: https://raw.githubusercontent.com/TykTechnologies/tyk-examples/main/repository.json
+        in: header
+        name: x-tyk-examples-index
+        schema:
+          default: https://raw.githubusercontent.com/TykTechnologies/tyk-examples/main/repository.json
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+              - location: udg/vat-checker
+                name: VAT number checker UDG
+                shortDescription: Simple REST API wrapped in GQL using Universal Data
+                  Graph that allows user to check validity of a VAT number and display
+                  some details about it.
+              - location: udg/geo-info
+                name: Geo information about the World
+                shortDescription: Countries GQL API extended with information from
+                  geocode.xyz
+              - location: udg/react-conferences
+                name: React conferences in Europe
+                shortDescription: Information about React conferences in Europe. This
+                  Data Graph stitches together two GQL APIs. The flag image is added
+                  by using Trevorblades API as a data source.
+              schema:
+                items:
+                  $ref: '#/components/schemas/ExampleAPIMetadata'
+                type: array
+          description: List of API examples response.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Invalid examples index file or root path.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/examples'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to fetch examples index file.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get a list of example API definitions.
+      tags:
+      - APIs
+  /api/examples/{location}:
+    get:
+      description: Get the details of a single API definition, details include full
+        name, location in the repository, description, features and min tyk version.
+      operationId: getAPIExample
+      parameters:
+      - description: URL that points to the index file (repository.json) or root of
+          a repository housing examples.
+        example: https://raw.githubusercontent.com/TykTechnologies/tyk-examples/main/repository.json
+        in: header
+        name: x-tyk-examples-index
+        schema:
+          default: https://raw.githubusercontent.com/TykTechnologies/tyk-examples/main/repository.json
+          type: string
+      - description: Repository URL to fetch example API definitions from.
+        example: https://github.com/TykTechnologies/tyk-examples.git
+        in: header
+        name: x-tyk-repo-url
+        schema:
+          default: https://github.com/TykTechnologies/tyk-examples.git
+          type: string
+      - description: Location of the tyk example in the repository defined in `x-tyk-repo-url`.
+        example: udg/vat-checker
+        in: path
+        name: location
+        required: true
+        schema:
+          type: string
+      - description: If set to true, the response will contain the content of the
+          Readme file for the specified example, the readme content will be present
+          as the `readme` field.
+        example: false
+        in: query
+        name: readme
+        required: false
+        schema:
+          default: "false"
+          type: boolean
+      - description: If set to true, the response will contain the APIDefinition of
+          the specified example, the definition will be present as the `apiDefinition`
+          field.
+        example: false
+        in: query
+        name: apiDef
+        required: false
+        schema:
+          default: false
+          type: boolean
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                description: Simple REST API wrapped in GQL using Universal Data Graph
+                  that allows user to check validity of a VAT number and display some
+                  details about it.
+                features:
+                - REST Datasource
+                location: udg/vat-checker
+                min_version: "5.0"
+                name: VAT number checker UDG
+              schema:
+                $ref: '#/components/schemas/DetailedExampleAPIMetadata'
+          description: Details on the fetched example API definition.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Invalid examples index file or root path.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Invalid parameters.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/examples/{location}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Example API definition not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Example API definition not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to fetch example API definitions.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get details of a single example API definition.
+      tags:
+      - APIs
+  /api/hooks:
+    get:
+      description: Return a paginated list of webhooks.
+      operationId: getWebhookList
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                hooks:
+                - api_model: {}
+                  event_timeout: 0
+                  header_map:
+                    secret: superscretkey
+                    x-auth: authvalue
+                  id: "363634393863643165326663643130303031383465636239"
+                  method: POST
+                  name: Expired Keys webhook
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  target_path: https://httpbin.org/expired-keys
+                  template_path: ""
+                  webhook_id: 1f78e319202b430e92286cff3ca759e3
+                - api_model: {}
+                  event_timeout: 0
+                  header_map:
+                    x-auth: keith
+                  id: "363634623338353335373135656334633936636265663364"
+                  method: POST
+                  name: Webhook Receiver Post
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  target_path: https://httpbin.org/receiver
+                  template_path: ""
+                  webhook_id: 9aef65505d694792a25fd0334dde2661
+                pages: 1
+              schema:
+                $ref: '#/components/schemas/WebHooks'
+          description: Webhook fetched.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve webhooks.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Failed to retrieve webhooks.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/hooks'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data for APIs.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List webhooks.
+      tags:
+      - Webhooks
+    post:
+      description: Create a webhook. The webhook method and target_path fields are
+        required. Method can either be DELETE,GET,PUT,POST or PATCH.
+      operationId: createWebhook
+      requestBody:
+        content:
+          application/json:
+            example:
+              header_map:
+                another-value: somevalue
+                secret: superscretkey
+              method: POST
+              name: Expired Keys webhook
+              target_path: https://httpbin.org/expired-keys
+            schema:
+              properties:
+                header_map:
+                  additionalProperties:
+                    type: string
+                  nullable: true
+                  type: object
+                method:
+                  type: string
+                name:
+                  type: string
+                target_path:
+                  type: string
+              type: object
+        description: Webhook data.
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Webhook created
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Webhook created.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Webhook object validation failed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: validation failed (required fields not sent in request body).
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request body.
+        "409":
+          content:
+            application/json:
+              example:
+                Message: Duplicate webhook_id.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Webhook with ID exist.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Empty request body.
+      summary: Create a webhook.
+      tags:
+      - Webhooks
+  /api/hooks/{hookId}:
+    delete:
+      description: Delete webhook with ID.
+      operationId: deleteWebhook
+      parameters:
+      - description: ID of the webhook to delete.
+        example: 66498cd1e2fcd1000184ecb9
+        in: path
+        name: hookId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Webhook deleted
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Deleted successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not delete the webhook.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Deletion failed.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/hooks/{hookId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve webhook detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Webhook with ID not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: You are not allowed in this org.
+      summary: Delete web hook.
+      tags:
+      - Webhooks
+    get:
+      description: Get a webhook details with its ID.
+      operationId: getWebhookDetail
+      parameters:
+      - description: ID of the webhook to fetch.
+        example: 66498cd1e2fcd1000184ecb9
+        in: path
+        name: hookId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                api_model: {}
+                event_timeout: 0
+                header_map:
+                  secret: superscretkey
+                  x-auth: authvalue
+                id: "363634393863643165326663643130303031383465636239"
+                method: POST
+                name: Expired Keys webhook
+                org_id: 5e9d9544a1dcd60001d0ed20
+                target_path: https://httpbin.org/expired-keys
+                template_path: ""
+                webhook_id: 1f78e319202b430e92286cff3ca759e3
+              schema:
+                $ref: '#/components/schemas/WebHookHandlerConf'
+          description: Webhook fetched.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve webhook detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Webhook not found.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/hooks/{hookId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data for webhook detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get single webhook.
+      tags:
+      - Webhooks
+    put:
+      description: Update a web hook using its ID. The webhook method and target_path
+        fields are required in the request body when updating. *Note the original
+        webhook data will be completely replaced with the new update request object(so
+        if for example you don't send the name or webhook_id fields in your request
+        body those fields will be updated to empty string even if they existed in
+        your original webhook object.)*
+      operationId: updateWebhook
+      parameters:
+      - description: ID of the webhook to update
+        example: 664b70285715ec4c96cbef3f
+        in: path
+        name: hookId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              header_map:
+                another-value: somevalue
+                secret: superscretkey
+              method: POST
+              name: Update WebHook Name
+              target_path: https://httpbin.org/v2/changed-expired-keys
+            schema:
+              properties:
+                header_map:
+                  additionalProperties:
+                    type: string
+                  nullable: true
+                  type: object
+                method:
+                  type: string
+                name:
+                  type: string
+                target_path:
+                  type: string
+              type: object
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Hook updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Webhook updated.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Webhook not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Webhook with ID not found.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request body.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Empty request body.
+      summary: Update Webhook
+      tags:
+      - Webhooks
+  /api/keys:
+    post:
+      description: |-
+        Tyk will generate the access token based on the OrgID specified in the API Definition and a random UUID. This ensures that keys can be owned by different API owners should segmentation be needed at an organisational level.
+          <br/><br/>
+         API keys without access_rights data will be written to all APIs on the system (this also means that they will be created across all SessionHandlers and StorageHandlers, it is recommended to always embed access_rights data in a key to ensure that only targeted APIs and their back-ends are written to.
+      operationId: addKey
+      parameters:
+      - description: Set this to true to create a basic user. Note you have to send
+          basic_auth_data(user and password) in the request body if this value is
+          set to true.
+        example: true
+        in: query
+        name: basic_auth
+        required: false
+        schema:
+          default: false
+          type: boolean
+      requestBody:
+        content:
+          application/json:
+            example:
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 62a0ec9092faf50001395817
+              enable_detailed_recording: true
+              expires: 1.718439136e+09
+              hmac_enabled: false
+              is_inactive: false
+              meta_data:
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: -1
+              quota_remaining: 0
+              quota_renewal_rate: -1
+              quota_renews: 1.715847135e+09
+              rate: 1000
+              tags:
+              - edge-eu
+              - edge
+              throttle_interval: 0
+              throttle_retry_limit: 0
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: New Key added.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unmarshalling request body failed, malformed.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal key data.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Create a key.
+      tags:
+      - Keys
+  /api/keys/{keyId}:
+    delete:
+      description: Deleting a key will remove it permanently from the system, however
+        analytics relating to that key will still be available.
+      operationId: deleteKey
+      parameters:
+      - description: If you are not sure if a key is hashed you can send this as true.
+        example: true
+        in: query
+        name: auto_guess
+        required: false
+        schema:
+          default: false
+          type: boolean
+      - description: Use the hash of the key as input instead of the full key.Any
+          none empty string will be interpreted as to say you want to use hash input.
+        example: "1"
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: string
+      - description: Set to true if the passed key is a username
+        example: true
+        in: query
+        name: username
+        required: false
+        schema:
+          type: boolean
+      - description: The ID of the key.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Key deleted successfully.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Key deleted.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Attempted access to non-owned key.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Trying to access a key your org does not own.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/keys/{keyId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve key detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Key with ID not found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not delete key.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Delete key.
+      tags:
+      - Keys
+    get:
+      description: Get the details of a key.
+      operationId: getKeyDetail
+      parameters:
+      - description: The ID of the key.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyId
+        required: true
+        schema:
+          type: string
+      - description: If you are not sure if a key is hashed you can send this as true.
+        example: true
+        in: query
+        name: auto_guess
+        required: false
+        schema:
+          default: false
+          type: boolean
+      - description: Use the hash of the key as input instead of the full key.Any
+          none empty string will be interpreted as to say you want to use hash input.
+        example: "1"
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: string
+      - description: Set to true if the passed key ID is a username.
+        example: true
+        in: query
+        name: username
+        required: false
+        schema:
+          type: boolean
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: Key Data fetched.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Attempted access to non-owned key.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Trying to access a key your org does not own.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/keys/{keyId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve key detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Key with ID not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal key data from Tyk API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get key Details.
+      tags:
+      - Keys
+    post:
+      description: Creates a key with a custom key ID.
+      operationId: createCustomKey
+      parameters:
+      - description: The ID to give the key.
+        example: my-custom-key
+        in: path
+        name: keyId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 62a0ec9092faf50001395817
+              enable_detailed_recording: true
+              expires: 1.718439136e+09
+              hmac_enabled: false
+              is_inactive: false
+              meta_data:
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: -1
+              quota_remaining: 0
+              quota_renewal_rate: -1
+              quota_renews: 1.715847135e+09
+              rate: 1000
+              tags:
+              - edge-eu
+              - edge
+              throttle_interval: 0
+              throttle_retry_limit: 0
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: Key created.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unmarshalling request body failed, malformed.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal Key data.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Create custom key.
+      tags:
+      - Keys
+    put:
+      description: You can also manually add keys to Tyk using your own key-generation
+        algorithm. It is recommended if using this approach to ensure that the OrgID
+        being used in the API definition and the key data is blank so that Tyk does
+        not try to prepend or manage the key in any way.
+      operationId: updateKeyDetail
+      parameters:
+      - description: The ID of the key.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyId
+        required: true
+        schema:
+          type: string
+      - description: Use the hash of the key as input instead of the full key. Any
+          none empty string will be interpreted as to say you want to use hash input.
+        example: "1"
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: string
+      - description: If you are not sure if a key is hashed you can send this as true.
+        example: true
+        in: query
+        name: auto_guess
+        required: false
+        schema:
+          default: false
+          type: boolean
+      - description: Set to true if the passed key ID is a username.
+        example: true
+        in: query
+        name: username
+        required: false
+        schema:
+          type: boolean
+      - description: Adding the suppress_reset parameter and setting it to 1, will
+          cause Tyk not to reset the quota limit that is in the current live quota
+          manager. By default Tyk will reset the quota in the live quota manager (initialising
+          it) when adding a key. Adding the `suppress_reset` flag to the URL parameters
+          will avoid this behaviour.
+        in: query
+        name: suppress_reset
+        required: false
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 62a0ec9092faf50001395817
+              enable_detailed_recording: true
+              expires: 1.718439136e+09
+              hmac_enabled: false
+              is_inactive: false
+              meta_data:
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: -1
+              quota_remaining: 0
+              quota_renewal_rate: -1
+              quota_renews: 1.715847135e+09
+              rate: 1000
+              tags:
+              - edge-eu
+              - edge
+              throttle_interval: 0
+              throttle_retry_limit: 0
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: Key updated
+        "400":
+          content:
+            application/json:
+              example:
+                Message: User/Key object validation failed, most likely malformed
+                  input.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: malformed input.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unmarshalling request body failed, malformed.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve key detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Key with ID not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal key data.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update key.
+      tags:
+      - Keys
+  /api/keys/detailed:
+    get:
+      description: List all the keys and all the keys details. If `q` query parameter
+        is passed it will only return keys whose key ID contain the passed text.
+      operationId: getKeysDetailed
+      parameters:
+      - description: Filter and return all keys that contain this text in there key
+          ID.
+        example: itachi
+        in: query
+        name: q
+        required: false
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeysDetailed'
+          description: Keys fetched.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/keys/detailed'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve keys.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unable to connect to the gateway.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal keys data from Tyk API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List All the Keys info.
+      tags:
+      - Keys
+  /api/keys/preview:
+    post:
+      description: This will check if the body of a key definition is valid. And return
+        a response with how the key would look like if you create it.
+      operationId: validateAKeyDefinition
+      requestBody:
+        content:
+          application/json:
+            example:
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 62a0ec9092faf50001395817
+              enable_detailed_recording: true
+              expires: 1.718439136e+09
+              hmac_enabled: false
+              is_inactive: false
+              meta_data:
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: -1
+              quota_remaining: 0
+              quota_renewal_rate: -1
+              quota_renews: 1.715847135e+09
+              rate: 1000
+              tags:
+              - edge-eu
+              - edge
+              throttle_interval: 0
+              throttle_retry_limit: 0
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KeyData'
+          description: Key definition is valid.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: User/Key object validation failed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed key data.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal User data.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: This will validate a key definition.
+      tags:
+      - Keys
+  /api/org/opa:
+    get:
+      description: List your organisation OPA rules.
+      operationId: getOPARules
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                open_policy:
+                  rules: |-
+                    package dashboard_users
+                    default request_intent = "read"
+                    request_intent = "write" { input.request.method == "POST" }
+                    request_intent = "write" { input.request.method == "PUT" }
+                    request_intent = "delete" { input.request.method == "DELETE" }
+                    deny["You cannot create a keyless API."] {
+                        request_intent == "write"
+                        contains(input.request.path, "api/apis")
+                        input.request.body.api_definition.use_keyless == true
+                    }
+              schema:
+                $ref: '#/components/schemas/NewOPARules'
+          description: OPA rules fetched.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Your license does not support Open Policy.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Upgrade licence.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to identify organisation.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List OPA rules.
+      tags:
+      - Open Policy Agent
+    put:
+      description: Modify your OPA rules.
+      operationId: updateOrgOPARules
+      requestBody:
+        content:
+          application/json:
+            example:
+              open_policy:
+                rules: |-
+                  package dashboard_users
+                  default request_intent = "read"
+                  request_intent = "write" { input.request.method == "POST" }
+                  request_intent = "write" { input.request.method == "PUT" }
+                  request_intent = "delete" { input.request.method == "DELETE" }
+                  deny["You cannot create a keyless API."] {
+                      request_intent == "write"
+                      contains(input.request.path, "api/apis")
+                      input.request.body.api_definition.use_keyless == true
+                  }
+            schema:
+              $ref: '#/components/schemas/NewOPARules'
+        description: Create rule to prevent creation of keyless APIs.
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: OPA rules has been updated on org level.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: OPA rules updated.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Invalid OPA rules.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Invalid OPA rules.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Your license does not support Open Policy.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Upgrade licence.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal response body.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: malformed request body.
+      summary: Update OPA rules.
+      tags:
+      - Open Policy Agent
+  /api/org/permissions:
+    get:
+      description: This API returns by default the initial set of additional permissions
+        defined in your Tyk Dashboard configuration, under `security.additional_permissions`.
+        Once you update the permissions via the API, they will be stored at organisation
+        level.
+      operationId: listAdditionalPermissions
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                additional_permissions:
+                  api_developer: API Developer
+                  api_manager: API Manager
+              schema:
+                $ref: '#/components/schemas/NewAdditionalPermissions'
+          description: Additional Permissions retrieved successfully.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/org/permissions'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal additional permissions.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List additional permissions.
+      tags:
+      - Additional Permissions
+    put:
+      description: 'Whenever you want to add/update/delete an additional permission,
+        just send back the updated list of permissions, through this PUT request to
+        the API. For example if you initially had two additional permissions e.g ```{additional_permissions:
+        {api_developer: API Developer, api_manager: API Manager}}``` to add a third
+        permission called `custom_permission` you would append it to the original
+        permission list and your request body would be: ```{additional_permissions:
+        {api_developer: API Developer, api_manager: API Manager, custom_permission:
+        Custom Permission}}```.'
+      operationId: updateAdditionalPermissions
+      requestBody:
+        content:
+          application/json:
+            example:
+              additional_permissions:
+                api_developer: API Developer
+                api_manager: API Manager
+                custom_permission: Custom Permission
+            schema:
+              $ref: '#/components/schemas/NewAdditionalPermissions'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Additional Permissions updated in org level.
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Additional Permissions updated successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Empty request body.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/org/permissions'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal response body.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Invalid request body or failed to save permission.
+      summary: Add/Delete/Update additional permission.
+      tags:
+      - Additional Permissions
+  /api/portal/policies:
+    get:
+      description: Get list of policies. The result returned are paginated. Use the
+        p query parameter to say which page you want returned. The default pagesize
+        of the results is 10 but this can be changed in the dashboard config.
+      operationId: getPolicies
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      - description: Send any value in this query parameter to return only the active
+          policies.
+        example: "true"
+        in: query
+        name: active
+        required: false
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                policiesExample:
+                  $ref: '#/components/examples/policiesExample'
+              schema:
+                $ref: '#/components/schemas/ReturnDataStruct'
+          description: List of all policies.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/portal/policies'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned if you do not have access to policies.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve object list.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get list portal policies.
+      tags:
+      - Policies
+    post:
+      description: Creating policy definitions is slightly different to the core API,
+        API definitions are wrapped inside an api_definition field and event handlers,
+        such as webhooks are not embedded in the main api_definition object (though
+        they can be), webhooks are instead appended as references into the hook_references
+        field, the API will embed the correct webhook data into the event handler
+        interface.
+      operationId: postPolicies
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                8ddd91f3cda9453442c477b06c4e2da4:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi API
+                  disable_introspection: false
+                  versions:
+                  - Default
+              active: true
+              hmac_enabled: false
+              is_inactive: false
+              key_expires_in: 2.592e+06
+              max_query_depth: -1
+              meta_data:
+                email: itachi@tyk.io
+                user_type: mobile_user
+              name: Sample policy
+              partitions:
+                acl: true
+                complexity: false
+                per_api: false
+                quota: true
+                rate_limit: true
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              rate: 1000
+              tags:
+              - security
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/Policy'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: 663b4bbd5715ec323b424dca
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Policy created.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: This policy name has already been used. Enter a unique policy
+                  name.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned when the policy body fails validation.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned when you send a malformed request body or when you
+            don't have permission to add this object.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failure creating data, please contact your administrator.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Create policy definition.
+      tags:
+      - Policies
+  /api/portal/policies/{id}:
+    delete:
+      description: Delete a Policy by ID.
+      operationId: deletePolicy
+      parameters:
+      - description: ID of policy to delete.
+        example: 66570989d98dd00001da17f1
+        in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Data deleted
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Deleted policy successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Invalid policy ID.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned when you send a policy ID that is invalid.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/portal/policies/{id}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned if you do not have access to policies.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve object for deletion
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned if policy with specified ID does not exist.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failure deleting data, please contact your administrator.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Delete a single policy by ID.
+      tags:
+      - Policies
+    get:
+      description: Get a policy by ID.
+      operationId: getPolicy
+      parameters:
+      - description: ID of policy to get.
+        example: 66570989d98dd00001da17f1
+        in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                access_rights:
+                  8ddd91f3cda9453442c477b06c4e2da4:
+                    allowed_urls:
+                    - methods:
+                      - GET
+                      url: /users
+                    api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                    api_name: Itachi API
+                    disable_introspection: false
+                    versions:
+                    - Default
+                active: true
+                hmac_enabled: false
+                is_inactive: false
+                key_expires_in: 2.592e+06
+                max_query_depth: -1
+                meta_data:
+                  email: itachi@tyk.io
+                  user_type: mobile_user
+                name: Sample policy
+                partitions:
+                  acl: true
+                  complexity: false
+                  per_api: false
+                  quota: true
+                  rate_limit: true
+                per: 60
+                quota_max: 10000
+                quota_renewal_rate: 3600
+                rate: 1000
+                tags:
+                - security
+                throttle_interval: 10
+                throttle_retry_limit: 10
+              schema:
+                $ref: '#/components/schemas/Policy'
+          description: Policy fetched.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Invalid policy ID.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned when you send a policy ID that is invalid.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/portal/policies/{id}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve portal object.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Policy with the given ID was not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failure creating data, please contact your administrator.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get a single policy by ID.
+      tags:
+      - Policies
+    put:
+      description: Update a policy definition.
+      operationId: putPolicies
+      parameters:
+      - description: ID of policy to update.
+        example: 66570989d98dd00001da17f1
+        in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                8ddd91f3cda9453442c477b06c4e2da4:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi API
+                  disable_introspection: false
+                  versions:
+                  - Default
+              active: true
+              hmac_enabled: false
+              is_inactive: false
+              key_expires_in: 2.592e+06
+              max_query_depth: -1
+              meta_data:
+                email: itachi@tyk.io
+                user_type: mobile_user
+              name: Sample policy
+              partitions:
+                acl: true
+                complexity: false
+                per_api: false
+                quota: true
+                rate_limit: true
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              rate: 1000
+              tags:
+              - security
+              - messages
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/Policy'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: Data updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Policy updated.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Invalid policy ID.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned when you send an invalid ID or when the policy body
+            fails validation.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned when you send a malformed request body or when you
+            don't have permission to update this object.
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve portal object.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned if policy with specified ID does not exist.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failure saving data, please contact your administrator.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update policy definition.
+      tags:
+      - Policies
+  /api/portal/policies/search:
+    get:
+      description: Search list of policies. If query parameter q is a policy ID it
+        will look for policies that have the given ID. However if q is not a policy
+        ID it will return policies with whose name matches the patten based via q
+        query parameter. If you send a policy ID in query parameter q and also send
+        query parameter policy_ids,only policy_ids will be used for searching.
+      operationId: searchPolicies
+      parameters:
+      - description: Search for policy using policy ID or name.
+        example: 5eb6349543f0440001373f5c
+        in: query
+        name: q
+        required: false
+        schema:
+          type: string
+      - description: A list of comma separated policy IDs that you want to search
+          for.
+        example: 5eb6349543f0440001373f5c,5ead7120575961000181867e
+        in: query
+        name: policy_ids
+        required: false
+        schema:
+          type: string
+      - description: Send any value in this query parameter to return only the active
+          policies.
+        example: "true"
+        in: query
+        name: active
+        required: false
+        schema:
+          type: string
+      - description: Return policies whose state field matches the sent value e.g
+          if you send state as deny policies returned are those whose state filed
+          value is set as deny.
+        example: deny
+        in: query
+        name: state
+        required: false
+        schema:
+          enum:
+          - deny
+          - active
+          - draft
+          type: string
+      - description: Field you want to use to sort the returned policies.
+        example: name
+        in: query
+        name: sort
+        required: false
+        schema:
+          enum:
+          - date_created
+          - name
+          - state
+          type: string
+      - description: Comma separate list of API IDs. Return only policy that that
+          have the given API IDs in their access_right.
+        example: 5963f8fdedee405143f5858ea17de422
+        in: query
+        name: api_id
+        required: false
+        schema:
+          type: string
+      - description: Return policy whose auth_type field has the given value.
+        example: authToken
+        in: query
+        name: auth_type
+        required: false
+        schema:
+          type: string
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                policiesExample:
+                  $ref: '#/components/examples/policiesExample'
+              schema:
+                $ref: '#/components/schemas/ReturnDataStruct'
+          description: List of policies.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Policy ID is not in hex format.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Returned when you send policy IDs that are not in hexadecimal
+            format.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/portal/policies/search'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve policies.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal data
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Search list of policies.
+      tags:
+      - Policies
+  /api/schema:
+    get:
+      deprecated: true
+      description: Get API definition OAS schema.  An alias to `/api/schemas/apidefs/oas`.
+      operationId: getSchema
+      parameters:
+      - description: The OAS version.
+        example: 3.0.3
+        in: query
+        name: oasVersion
+        required: false
+        schema:
+          type: string
+      - description: Pretty print the result.
+        example: 'true'
+        in: query
+        name: pretty
+        required: false
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OASSchemaResponse'
+          description: OAS schema response.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/schema'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve schema. schema not found for version.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get API definition OAS schema.
+      tags:
+      - Schemas
+  /api/schemas/apidefs:
+    get:
+      description: Get all API definition schemas.
+      operationId: getAllApidefsSchema
+      parameters:
+        - description: The OAS version.
+          example: 3.0.3
+          in: query
+          name: oasVersion
+          required: false
+          schema:
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AllApidefSchemasResponse'
+          description: All API definition schemas response.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/schemas/apidefs'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve schema. schema not found for version.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get all API definition schemas.
+      tags:
+      - Schemas
+  /api/schemas/apidefs/oas:
+    get:
+      description: Get API definition OAS schema.
+      operationId: getApidefOASSchema
+      parameters:
+        - description: The OAS version.
+          example: 3.0.3
+          in: query
+          name: oasVersion
+          required: false
+          schema:
+            type: string
+        - description: Pretty print the result.
+          example: 'true'
+          in: query
+          name: pretty
+          required: false
+          schema:
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OASSchemaResponse'
+          description: OAS schema response.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/schemas/apidefs/oas'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve schema. schema not found for version.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get API definition OAS schema.
+      tags:
+      - Schemas
+  /api/schemas/apidefs/streams-oas:
+    get:
+      description: Retrieve schema for Tyk Streams APIs, enabling developers and integrators to validate or generate stream-based API definitions programmatically. Optionally select the OAS version and pretty-print formatting.
+      operationId: getApidefStreamsOASSchema
+      parameters:
+        - description: The OAS version.
+          example: 3.0.3
+          in: query
+          name: oasVersion
+          required: false
+          schema:
+            type: string
+        - description: Pretty print the result.
+          example: 'true'
+          in: query
+          name: pretty
+          required: false
+          schema:
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OASSchemaResponse'
+          description: OAS schema response.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/schemas/apidefs/streams-oas'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve schema. schema not found for version.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get API definition Streams OAS schema.
+      tags:
+      - Schemas
+  /api/schemas/apidefs/mcp:
+    get:
+      description: Returns the JSON schema used to validate MCP Proxy definitions.
+        Use this to pre-validate payloads client-side before calling `POST /api/mcps`
+        or `PUT /api/mcps/{apiId}`.
+      operationId: getMCPApidefSchema
+      parameters:
+      - { in: query, name: mcpVersion, required: false, schema: { type: string }, description: MCP schema version; defaults to the latest. }
+      responses:
+        "200":
+          content:
+            application/json:
+              schema: { type: object, description: JSON Schema document. }
+          description: MCP JSON Schema.
+        "401": { description: Unauthorized, content: { application/json: { schema: { $ref: '#/components/schemas/ApiResponse' } } } }
+        "500":
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ApiResponse' }
+          description: Failed to load MCP schema.
+      summary: Get MCP Proxy definition schema.
+      tags:
+      - Schemas
+  /api/sso:
+    post:
+      description: The Dashboard exposes the /api/sso Dashboard API which allows you
+        to generate a temporary authentication token, valid for 60 seconds.
+      operationId: generateAuthToken
+      requestBody:
+        content:
+          application/json:
+            example:
+              DisplayName: ""
+              EmailAddress: name@somewhere.com
+              ForSection: dashboard
+              GroupID: ""
+              OrgID: 588b4f0bb275ff0001cc7471
+              SSOOnlyForRegisteredUsers: false
+              UserNotAllowed: false
+            schema:
+              $ref: '#/components/schemas/SSOAccessData'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: SSO Nonce created.
+                Meta: YTNiOGUzZjctYWZkYi00OTNhLTYwODItZTAzMDI3MjM0OTEw
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Created successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request body.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: SSO not enabled for org.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Generate authentication token.
+      tags:
+      - Single Sign On
+  /api/system/stats:
+    get:
+      description: Get system usage info with license entitlements for a specified
+        date range. Return history for current and previous year if no date query
+        parameters are provided.
+      operationId: getSystemStats
+      parameters:
+      - $ref: '#/components/parameters/startDate'
+      - $ref: '#/components/parameters/endDate'
+      - description: Resolve daily.
+        example: day
+        in: query
+        name: resolution
+        required: false
+        schema:
+          enum:
+          - day
+          type: string
+      - description: The entity for which stats should be retrieved.
+        example: apis
+        in: query
+        name: entity
+        required: false
+        schema:
+          default: apis
+          enum:
+          - apis
+          - dataplanes
+          - dataplanes.gateways
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SystemStatsResp'
+          description: System statistics details.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Request validation failed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Bad request.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/system/stats'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Stats not found.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Stats not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to system stats.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get system usage info.
+      tags:
+      - System
+  /api/usergroups:
+    get:
+      description: This will return a list of all the user groups. The returned user
+        groups are paginated.
+      operationId: listUserGroups
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                groups:
+                - active: true
+                  description: devs company
+                  id: "363634393938366435373135656334633936636265663262"
+                  name: devs
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  password_max_days: 0
+                  user_permissions:
+                    analytics: read
+                    api_assets: write
+                    apis: write
+                    certs: write
+                    hooks: write
+                    idm: write
+                    keys: write
+                    log: read
+                    oauth: write
+                    owned_analytics: deny
+                    policies: write
+                    portal: write
+                    system: write
+                    user_groups: write
+                    users: write
+                    websockets: read
+                - active: true
+                  description: Devops logs and analytics access
+                  id: "363634396664346235373135656334633936636265663338"
+                  name: Devops
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  password_max_days: 0
+                  user_permissions:
+                    analytics: read
+                    log: read
+                pages: 1
+              schema:
+                $ref: '#/components/schemas/UserGroups'
+          description: User groups fetched.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/usergroups'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user groups.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unable to fetch groups.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal keys data from Tyk API.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List user groups.
+      tags:
+      - UserGroup
+    post:
+      description: Instead of assigning permission to each individual users, per user,
+        you can create a user group and configure the permissions for all users in
+        the group. This endpoint allow you to create a user group and set permission
+        for the user group.
+      operationId: createUserGroup
+      requestBody:
+        content:
+          application/json:
+            example:
+              active: true
+              description: Devops logs and analytics access
+              name: Devops
+              org_id: 5e9d9544a1dcd60001d0ed20
+              user_permissions:
+                analytics: read
+                log: read
+            schema:
+              $ref: '#/components/schemas/UserGroup'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User group created
+                Meta: 6649fb3e5715ec4c96cbef36
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: User group created.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request data.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to read response body, body empty.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Create user group.
+      tags:
+      - UserGroup
+  /api/usergroups/{groupId}:
+    delete:
+      description: Delete user group using the group ID.
+      operationId: deleteUserGroup
+      parameters:
+      - description: ID of the group you want to delete.
+        example: 6649fd535715ec4c96cbef39
+        in: path
+        name: groupId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User group deleted
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not delete the user group.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Failed to delete user group.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/usergroups/{groupId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Group not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Delete user group.
+      tags:
+      - UserGroup
+    get:
+      description: Return a user group object with all the details of a specified
+        group.
+      operationId: getUserGroup
+      parameters:
+      - description: ID of the group you want to fetch.
+        example: 6649fd535715ec4c96cbef39
+        in: path
+        name: groupId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                active: true
+                description: Devops logs and analytics access
+                id: "363634396664346235373135656334633936636265663338"
+                name: Devops
+                org_id: 5e9d9544a1dcd60001d0ed20
+                password_max_days: 0
+                user_permissions:
+                  analytics: read
+                  log: read
+              schema:
+                $ref: '#/components/schemas/UserGroup'
+          description: User grouped fetched.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/usergroups/{groupId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user group detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Group not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get user group details.
+      tags:
+      - UserGroup
+    put:
+      description: Update the details of a user group. You must have either admin
+        or user groups permission to be able to modify user groups. Note you cannot
+        update the ResetPassword permission with this endpoint. For that you need
+        to use Admin API. When updating a user group you also need to specify at least
+        one permission in the user_permissions field.
+      operationId: updateUserGroup
+      parameters:
+      - description: ID of the group you want to update.
+        example: 6649fd535715ec4c96cbef39
+        in: path
+        name: groupId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              active: true
+              description: Devops logs and analytics access
+              name: Devops
+              org_id: 5e9d9544a1dcd60001d0ed20
+              user_permissions:
+                analytics: read
+                log: read
+            schema:
+              $ref: '#/components/schemas/UserGroup'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User group updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Group ID does not exist
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Group not found or malformed request body.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/usergroups/{groupId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update user group.
+      tags:
+      - UserGroup
+  /api/users:
+    get:
+      description: Lists dashboard users
+      operationId: getUsers
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                pages: 1
+                users:
+                - access_key: d7ebef749e4348cb67fec3cfc81f0a50
+                  active: true
+                  api_model: {}
+                  created_at: "2024-05-19T08:23:29.173+03:00"
+                  email_address: multi-org-user@example.org
+                  first_name: Multi org
+                  group_id: ""
+                  id: "363634393863643165326663643130303031383465636235"
+                  last_login_date: "2024-05-19T08:45:09.53319+03:00"
+                  last_name: User
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  password_max_days: 0
+                  password_updated: "2024-05-19T08:23:29.281+03:00"
+                  user_permissions:
+                    IsAdmin: admin
+                    ResetPassword: admin
+                - access_key: f4b94c64017043dc4d1918db7e3436dd
+                  active: true
+                  api_model: {}
+                  created_at: "2024-05-19T08:23:29.034+03:00"
+                  email_address: admin-user@example.org
+                  first_name: Admin
+                  group_id: ""
+                  id: "363634393863643165326663643130303031383465636234"
+                  last_login_date: "2024-05-19T08:42:22.659839+03:00"
+                  last_name: User
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  password_max_days: 0
+                  password_updated: "2024-05-19T08:23:29.146+03:00"
+                  user_permissions:
+                    IsAdmin: admin
+                    ResetPassword: admin
+                - access_key: d19fc75cd3aa497f6cb042f72e47ce8c
+                  active: true
+                  api_model: {}
+                  created_at: "2024-05-19T08:45:09.53319+03:00"
+                  email_address: itachi.w@tyk.io
+                  first_name: sasuke
+                  group_id: ""
+                  id: "363634393931653535373135656334633936636265663261"
+                  last_login_date: "2024-05-19T08:45:09.53319+03:00"
+                  last_name: itachi
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  password_max_days: 0
+                  password_updated: "2024-05-19T08:45:09.53319+03:00"
+                  user_permissions:
+                    IsAdmin: admin
+                - access_key: b26feb8ff86b48e15ae2513a2de6f8f7
+                  active: true
+                  api_model: {}
+                  created_at: "2024-05-19T09:14:13.461142+03:00"
+                  email_address: munene@gmail.com
+                  first_name: munene
+                  group_id: 6649986d5715ec4c96cbef2b
+                  id: "363634393938623535373135656334633936636265663263"
+                  last_login_date: "2024-05-19T08:45:09.53319+03:00"
+                  last_name: wachira
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  password_max_days: 0
+                  password_updated: "2024-05-19T09:14:13.461142+03:00"
+                  user_permissions:
+                    analytics: read
+                    api_assets: write
+                    apis: write
+                    certs: write
+                    hooks: write
+                    idm: write
+                    keys: write
+                    log: read
+                    oauth: write
+                    policies: write
+                    portal: write
+                    system: write
+                    user_groups: write
+                    users: write
+                    websockets: read
+              schema:
+                $ref: '#/components/schemas/Users'
+          description: Users retrieved successfully.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/users'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve users.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Error retrieving users from db.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to unmarshal keys data from Tyk API
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: List users
+      tags:
+      - Users
+    post:
+      description: 'Create a user. If you want to create an admin user, you need to
+        send {IsAdmin: admin} in the user_permissions field e.g ```{user_permissions:
+        {IsAdmin: admin},last_name: sasuke,email_address: itachi@gmail.com,first_name:
+        itachi}```. You can add a user to a given user-group by sending the group_id
+        in the request body. If you want to give a user access only to specific objects
+        e.g policies you can send the object and the permission granted to the user
+        (read or write permission in the  user_permissions field  (check the request
+        example given for more details)).'
+      operationId: addUser
+      requestBody:
+        content:
+          application/json:
+            example:
+              active: true
+              email_address: itachi@gmail.com
+              first_name: itachi
+              last_name: sasuke
+              user_permissions:
+                analytics: read
+                api_assets: write
+                apis: write
+                certs: write
+                hooks: write
+                idm: write
+                keys: write
+                log: read
+                oauth: write
+                policies: write
+                portal: write
+                system: write
+                user_groups: write
+                users: write
+                websockets: read
+            schema:
+              $ref: '#/components/schemas/User'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User and session have been created
+                Meta: 6649a9e85715ec4c96cbef2f
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: User added successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: User object validation failed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Failure to send all required fields.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: User email already exists for this org.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: User already exist.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Couldn't retrieve user session details.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Add user.
+      tags:
+      - Users
+  /api/users/{userId}:
+    delete:
+      description: Delete a user with user ID.
+      operationId: deleteUser
+      parameters:
+      - description: User ID of the user to delete.
+        example: 66498cd1e2fcd1000184ecb4
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User deleted
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not delete the user.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Failed to delete user.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/users/{userId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: User not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Delete a user.
+      tags:
+      - Users
+    get:
+      description: Return a user object with details of the user specified by user
+        ID in path.
+      operationId: getUser
+      parameters:
+      - description: User ID of the user to retrieve data for.
+        example: 66498cd1e2fcd1000184ecb4
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                access_key: f4b94c64017043dc4d1918db7e3436dd
+                active: true
+                api_model: {}
+                created_at: "2024-05-19T08:23:29.034+03:00"
+                email_address: admin-user@example.org
+                first_name: Admin
+                group_id: ""
+                id: "363634393863643165326663643130303031383465636234"
+                last_login_date: "2024-05-19T08:42:22.659839+03:00"
+                last_name: User
+                org_id: 5e9d9544a1dcd60001d0ed20
+                password_max_days: 0
+                password_updated: "2024-05-19T08:23:29.146+03:00"
+                user_permissions:
+                  IsAdmin: admin
+                  ResetPassword: admin
+              schema:
+                $ref: '#/components/schemas/User'
+          description: User retrieved successfully.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/users/{userId}'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: User not found.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get user details.
+      tags:
+      - Users
+    put:
+      description: Update a user with user ID. If you update the user as inactive
+        they will be logged out of all dashboard sessions. User password can only
+        be updated via admin API or the update password endpoint. ResetPassword is
+        also only available via the admin API.
+      operationId: updateUser
+      parameters:
+      - description: USER ID of the user to update
+        example: 66498cd1e2fcd1000184ecb4
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              active: true
+              email_address: itachi@gmail.com
+              first_name: itachi
+              last_name: sasuke
+              user_permissions:
+                IsAdmin: admin
+            schema:
+              properties:
+                active:
+                  type: boolean
+                email_address:
+                  type: string
+                first_name:
+                  type: string
+                last_name:
+                  type: string
+                user_permissions:
+                  $ref: '#/components/schemas/UserPermissionObject'
+              type: object
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Updated successfully.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: user does not exist.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: User not found or malformed request body.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: To create a user specify at least one permission, or make
+                  them an admin.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Empty user rights or invalid email format.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Update user.
+      tags:
+      - Users
+  /api/users/{userId}/actions/key/reset:
+    put:
+      description: Reset specified user's Dashboard API access credentials by generating
+        a new access key for the specified user.
+      operationId: resetUserKey
+      parameters:
+      - description: User ID of the user whose key you want to reset.
+        example: 66498cd1e2fcd1000184ecb4
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User session renewed
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: New access key generated.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Problem updating user with new key.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unable to update user details.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/users/{userId}/actions/key/reset'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: User not found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Reset user Dashboard API access credentials.
+      tags:
+      - Users
+  /api/users/{userId}/actions/reset:
+    post:
+      description: Set a user's password. The password need to be 6 character long.
+        If you are trying to update another users password you also need to have permission
+        to update they password or you need to be a super-admin. You cannot also reuse
+        a password.
+      operationId: setUserPassword
+      parameters:
+      - description: User ID of the user whose password is being reset.
+        example: 66498cd1e2fcd1000184ecb4
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              api_model: {}
+              current_password: minimum6charactersPassword
+              new_password: newMinimum6CharactersPassword
+            schema:
+              $ref: '#/components/schemas/UserPassword'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User password updated
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: OK
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: Request body malformed.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Malformed request body or you don't have permission to change
+            this users password.
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Set user password.
+      tags:
+      - Users
+  /api/users/{userId}/actions/revoke:
+    put:
+      description: This will set the use account as inactive. It will also disable
+        API Access and log out the user from all dashboards.
+      operationId: revokeUser
+      parameters:
+      - description: User ID of the user whose access you want to revoke.
+        example: 66498cd1e2fcd1000184ecb4
+        in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                Message: User revoked
+                Meta: null
+                Status: OK
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve user detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: User not found.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/users/{userId}/actions/revoke'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Attempted unauthorised access.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Revoke user.
+      tags:
+      - Users
+  /api/users/me:
+    get:
+      description: Return a user object with the details of the current user. This
+        request need to have a session cookie with the key authorisation.
+      operationId: currentUserDetail
+      parameters:
+      - description: authorisation session cookie
+        example: 1b7eecc5-6dt5-4df8-5472-0c7frc3ae4f2
+        in: cookie
+        name: authorisation
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                access_key: d7ebef749e4348cb67fec3cfc81f0a50
+                active: true
+                api_model: {}
+                created_at: "2024-05-19T08:23:29.173+03:00"
+                email_address: multi-org-user@example.org
+                first_name: Multi org
+                group_id: ""
+                id: "363634393863643165326663643130303031383465636235"
+                last_login_date: "2024-05-19T08:45:09.53319+03:00"
+                last_name: User
+                org_id: 5e9d9544a1dcd60001d0ed20
+                password_max_days: 0
+                password_updated: "2024-05-19T08:23:29.281+03:00"
+                user_permissions:
+                  IsAdmin: admin
+                  ResetPassword: admin
+              schema:
+                $ref: '#/components/schemas/User'
+          description: OK
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/users/me'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not retrieve current user detail.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: User not found
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to marshal current user data.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Get current user.
+      tags:
+      - Users
+  /api/users/search:
+    get:
+      deprecated: true
+      description: This endpoint allows you to search for users by providing their
+        email address as a query parameter.
+      operationId: searchUserGet
+      parameters:
+      - description: Query term used to search for users (email address).
+        example: itachi@tyk.io
+        in: query
+        name: q
+        required: true
+        schema:
+          type: string
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                pages: 1
+                users:
+                - access_key: d19fc75cd3aa497f6cb042f72e47ce8c
+                  active: true
+                  api_model: {}
+                  created_at: "2024-05-19T08:45:09.53319+03:00"
+                  email_address: itachi.w@tyk.io
+                  first_name: sasuke
+                  group_id: ""
+                  id: "363634393931653535373135656334633936636265663261"
+                  last_login_date: "2024-05-19T08:45:09.53319+03:00"
+                  last_name: itachi
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  password_max_days: 0
+                  password_updated: "2024-05-19T08:45:09.53319+03:00"
+                  user_permissions:
+                    IsAdmin: admin
+              schema:
+                $ref: '#/components/schemas/Users'
+          description: User searched.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/users/search'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not search users.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unable to search user.
+      summary: Search Users(Deprecated)
+      tags:
+      - Users
+    post:
+      description: This endpoint allows you to search for users with their email address
+        (e.g if you send the filter @gmail.com` in the request payload, all users
+        whole email contain the string @gmail.com will be returned).
+      operationId: searchUser
+      parameters:
+      - description: Use p query parameter to say which page you want returned. Send
+          number less than 0 to return all items.
+        example: 1
+        in: query
+        name: p
+        required: false
+        schema:
+          type: integer
+      requestBody:
+        content:
+          application/json:
+            example:
+              filters:
+                query: itachi@tyk.io
+            schema:
+              $ref: '#/components/schemas/UserSearchPayload'
+        description: User search criteria.
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                pages: 1
+                users:
+                - access_key: d19fc75cd3aa497f6cb042f72e47ce8c
+                  active: true
+                  api_model: {}
+                  created_at: "2024-05-19T08:45:09.53319+03:00"
+                  email_address: itachi.w@tyk.io
+                  first_name: sasuke
+                  group_id: ""
+                  id: "363634393931653535373135656334633936636265663261"
+                  last_login_date: "2024-05-19T08:45:09.53319+03:00"
+                  last_name: itachi
+                  org_id: 5e9d9544a1dcd60001d0ed20
+                  password_max_days: 0
+                  password_updated: "2024-05-19T08:45:09.53319+03:00"
+                  user_permissions:
+                    IsAdmin: admin
+              schema:
+                $ref: '#/components/schemas/Users'
+          description: User searched.
+        "400":
+          content:
+            application/json:
+              example:
+                Message: Could not extract search filter from request body.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unable to get filters.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/users/search'
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: Could not search users.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Unable to search user.
+      summary: Search user with email.
+      tags:
+      - Users
+  /api/audit-logs:
+    get:
+      description: Retrieve audit logs from database
+      operationId: getAuditLogs
+      parameters:
+        - description: Use p query parameter to say which page you want returned. The size of the page is determined by the configuration option page_size of dashboard.
+          example: 1
+          in: query
+          name: p
+          required: false
+          schema:
+            type: integer
+        - description: Filters audit logs to show only actions performed by the specified user. This parameter allows you to focus on the activity of a particular user across the system.
+          example: jhon@mail.com
+          in: query
+          name: user
+          required: false
+          schema:
+            type: string
+        - description: Filters audit logs based on the specific action performed by users. This parameter allows you to focus on particular types of activities within the system.
+          example: List APIs
+          in: query
+          name: action
+          required: false
+          schema:
+            type: string
+        - description: Filters audit logs based on the IP address from which the action originated. This parameter allows you to focus on activities from specific network locations or to investigate actions from particular IP addresses.
+          example: 127.0.0.1
+          in: query
+          name: ip
+          required: false
+          schema:
+            type: string
+        - description: Filters audit logs based on the HTTP method used in the API request. This parameter allows you to focus on specific types of operations performed on the API.
+          example: POST
+          in: query
+          name: method
+          required: false
+          schema:
+            type: string
+        - description: Filters audit logs based on the HTTP status code returned by the API in response to the request. This parameter allows you to focus on specific outcomes of API interactions.
+          example: 200
+          in: query
+          name: status
+          required: false
+          schema:
+            type: integer
+        - description: | 
+            This parameter filters audit logs based on partially matching the accessed API endpoint's URL path. It allows searching for actions performed on related resources or sections of the API by matching any portion of the URL. The match is case-sensitive and ignores additional path segments or query parameters beyond the matched portion.  
+            For example, if the database contains URLs like `/tib/create`, `/tib/get/1?schema=json`,  `/api/schema`, and `/schema1` searching with `url=schema` would return  `/api/schema` and `/schema1`.
+          example: /api/apis
+          in: query
+          name: url
+          required: false
+          schema:
+            type: string
+        - description: Specifies the start date for the audit log search. If not provided, the search will include records from the earliest available date. Format YYYY-MM-DD.
+          example: 1990-11-25
+          in: query
+          name: from_date
+          required: false
+          schema:
+            type: string
+        - description: Specifies the end date for the audit log search. If not provided, the search will include records up to the current date and time. Format YYYY-MM-DD.
+          example: 2030-12-18
+          in: query
+          name: to_date
+          required: false
+          schema:
+            type: string
+        - description: Determines whether the response should be a downloadable file containing the records. If set to `true`, the API returns a file instead of a JSON list of records. When enabled, pagination is not applied, and the file will include all records that match the search criteria.
+          example: true
+          in: query
+          name: download
+          required: false
+          schema:
+            type: boolean
+        - description: Specifies the format of the downloadable file. This parameter is only applied when `download` is set to `true`. If set to `csv`, the file content will be in CSV format; otherwise, JSON format will be used.
+          in: query
+          name: type
+          required: false
+          schema:
+            type: string
+            enum: [ csv, json ]
+          example: csv
+      responses:
+        "200":
+          content:
+            application/octet-stream:
+              schema:
+                type: string
+                format: binary
+                description: A file containing the audit logs in either JSON or CSV format, depending on the `type` query parameter.
+            application/json:
+              example:
+                pages: 1
+                audit_logs:
+                  - _id: 672a83e2b0418b224440ce29
+                    req_id: 0462e283-a55f-41ab-6482-60d2eeb1858c
+                    org_id: 66cf7f8db0418b1fbe91852b
+                    date: Tue, 05 Nov 2024 17:45:22 -03
+                    timestamp: 1730839522
+                    ip: 127.0.0.1
+                    user: jhon@mail.com
+                    action: ''
+                    method: GET
+                    url: "/api/audit-logs"
+                    status: 200
+                  - _id: 672a83e9b0418b224440ce2a
+                    req_id: 1276517a-a57e-4b20-5cf5-a6d830fc399d
+                    org_id: 66cf7f8db0418b1fbe91852b
+                    date: Tue, 05 Nov 2024 17:45:29 -03
+                    timestamp: 1730839529
+                    ip: 127.0.0.1
+                    user: jhon@mail.com
+                    action: ''
+                    method: GET
+                    url: "/api/audit-logs"
+                    status: 200
+                  - _id: 672a83ecb0418b224440ce2b
+                    req_id: 9c720384-2c93-4c38-7164-35b876fd56ef
+                    org_id: 66cf7f8db0418b1fbe91852b
+                    date: Tue, 05 Nov 2024 17:45:32 -03
+                    timestamp: 1730839532
+                    ip: 127.0.0.1
+                    user: jhon@mail.com
+                    action: ''
+                    method: GET
+                    url: "/api/audit-logs"
+                    status: 200
+              schema:
+                $ref: '#/components/schemas/AuditLogs'
+          description: Audit Logs retrieved successfully
+        "400":
+          content:
+            application/json:
+              example:
+                Message: could not retrieve audit records
+                Meta: null
+                Status: Error
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/audit-logs'
+                Meta: null
+                Status: Error
+          description: Forbidden
+      summary: List audit logs
+      tags:
+        - AuditLogs
+  /api/audit-logs/{audit-log-id}:
+    get:
+      description: Retrieve a single audit log from database by ID
+      operationId: getAuditLog
+      parameters:
+        - description: ID of the audit log record to fetch.
+          example: 1
+          in: path
+          name: audit-log-id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                _id: 672a83e2b0418b224440ce29
+                req_id: 0462e283-a55f-41ab-6482-60d2eeb1858c
+                org_id: 66cf7f8db0418b1fbe91852b
+                date: Tue, 05 Nov 2024 17:45:22 -03
+                timestamp: 1730839522
+                ip: 127.0.0.1
+                user: jhon@mail.com
+                action: ''
+                method: GET
+                url: "/api/audit-logs"
+                status: 200
+              schema:
+                $ref: '#/components/schemas/AuditLog'
+          description: Audit Log retrieved successfully
+        "400":
+          content:
+            application/json:
+              example:
+                Message: could not retrieve audit record
+                Meta: null
+                Status: Error
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/audit-log'
+                Meta: null
+                Status: Error
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                Message: could not retrieve audit record
+                Meta: null
+                Status: Error
+          description: NotFound
+        "500":
+          content:
+            application/json:
+              example:
+                Message: Failed to fetch audit record.
+                Meta: null
+                Status: Error
+              schema:
+                $ref: '#/components/schemas/ApiResponse'
+          description: Internal server error.
+      summary: Retrieve single audit log
+      tags:
+        - AuditLogs
+  /api/org/notifications:
+    get:
+      description: Retrieve all notifications that have been issued for a specific Tyk Organisation.
+      operationId: getAllOrganisationNotifications
+      parameters:
+        - description: Setting refresh to true will force the API to refresh the list of notifications.
+          example: 'true'
+          in: query
+          name: refresh
+          required: false
+          schema:
+            type: string
+      responses:
+        "200":
+          content:
+           application/json:
+              example:
+                - id: b52f491a-2946-408b-9330-2736db85705b
+                  created_at: 2025-08-13T11:16:12.194968+02:00
+                  org_id: 683d6e6a954737af2aa8e5c2
+                  hash: '17090217262863020087'
+                  kind: warning
+                  topic: certificate.expiry
+                  title: Certificate will expire soon
+                  message: Certificate with ID 683d6e6a954737af2aa8e5c20d545f3211d5a53684114dc8b3ebb2503edf6fabf2e5812425be2fa108f3fb4d will expire in less than 18 days
+                  data:
+                    cert_id: 683d6e6a954737af2aa8e5c20d545f3211d5a53684114dc8b3ebb2503edf6fabf2e5812425be2fa108f3fb4d
+                    expiry_date: 2025-08-31T08:41:53Z
+                    days_remaining: 17
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/OrganisationNotification'
+
+          description: Returns a list of notifications that have been issued for the specified Tyk Organisation.
+        "401":
+          content:
+            application/json:
+              example:
+                Message: Not authorised
+                Meta: null
+                Status: Error
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              example:
+                Message: 'access denied: You do not have permission to access  /api/org/notifications'
+                Meta: null
+                Status: Error
+          description: Forbidden
+      summary: Retrieve notifications
+      tags:
+        - Organisation Notifications
+components:
+  examples:
+    aggregateAnalytics:
+      value:
+        data:
+        - error: 4
+          hits: 31
+          id:
+            alias: ""
+            api_id: 41351a6a94094da05f75146a695a16f6
+            api_name: Keyless
+            code: 404
+            day: 0
+            hour: 0
+            iso_country: ""
+            key: ""
+            month: 0
+            path: /anything
+            url: ""
+            year: 0
+          last_hit: "2024-06-19T07:11:39Z"
+          latency: 0
+          max_latency: 0
+          max_upstream_latency: 0
+          min_latency: 0
+          min_upstream_latency: 0
+          request_time: 174.5
+          success: 27
+          upstream_latency: 0
+        pages: 1
+    oasExample:
+      value:
+        components:
+          securitySchemes:
+            bearerAuth:
+              description: The API Access Credentials
+              scheme: bearer
+              type: http
+        info:
+          description: This is a sample OpenAPI description.
+          title: Sample OpenAPI description
+          version: 1.0.0
+        openapi: 3.0.3
+        paths:
+          /api/sample/users:
+            get:
+              operationId: getUsersSample
+              responses:
+                "200":
+                  content:
+                    application/json:
+                      schema:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          type: object
+                        type: array
+                  description: fetched users
+              summary: Get users
+              tags:
+              - users
+        security:
+        - bearerAuth: []
+        servers:
+        - url: https://localhost:8080
+        x-tyk-api-gateway:
+          info:
+            name: user
+            state:
+              active: true
+          server:
+            listenPath:
+              strip: true
+              value: /user-test-five/
+          upstream:
+            url: https://localhost:8080
+    oasExampleWithoutTykExtension:
+      value:
+        components:
+          securitySchemes:
+            bearerAuth:
+              description: The API Access Credentials
+              scheme: bearer
+              type: http
+        info:
+          description: This is a sample OpenAPI description.
+          title: Sample OpenAPI description
+          version: 1.0.0
+        openapi: 3.0.3
+        paths:
+          /api/sample/users:
+            get:
+              operationId: getUsersSample
+              responses:
+                "200":
+                  content:
+                    application/json:
+                      schema:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          type: object
+                        type: array
+                  description: fetched users
+              summary: Get users
+              tags:
+                - users
+        security:
+          - bearerAuth: [ ]
+        servers:
+          - url: https://localhost:8080
+    PatchOASExample:
+      summary: Patch Tyk OAS Example
+      value:
+        components:
+          securitySchemes:
+            bearerAuth:
+              description: The API Access Credentials
+              scheme: bearer
+              type: http
+        info:
+          description: This is a sample OpenAPI description.
+          title: Sample OpenAPI description
+          version: 1.0.0
+        openapi: 3.0.3
+        paths:
+          /api/sample/users:
+            get:
+              operationId: getUsersSample
+              responses:
+                "200":
+                  content:
+                    application/json:
+                      schema:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          type: object
+                        type: array
+                  description: fetched users
+              summary: Get users
+              tags:
+                - users
+        security:
+          - bearerAuth: [ ]
+        servers:
+          - url: https://localhost:8080
+        x-tyk-api-gateway:
+          info:
+            name: user
+            state:
+              active: true
+          server:
+            listenPath:
+              strip: true
+              value: /user-test-two/
+          upstream:
+            url: https://localhost:8080
+    paginatedApiExample:
+      value:
+        apis:
+        - api_definition:
+            api_id: b84fe1a04e5648927971c0557971565c
+            auth:
+              auth_header_name: authorization
+            definition:
+              key: version
+              location: header
+            name: Tyk Test API
+            org_id: 664a14650619d40001f1f00f
+            proxy:
+              listen_path: /tyk-api-test/
+              strip_listen_path: true
+              target_url: https://httpbin.org
+            use_oauth2: true
+            version_data:
+              not_versioned: true
+              versions:
+                Default:
+                  name: Default
+        pages: 1
+    policiesExample:
+      value:
+        Data:
+        - _id: "363635373039383964393864643030303031646131376631"
+          access_rights:
+            8ddd91f3cda9453442c477b06c4e2da4:
+              allowance_scope: ""
+              allowed_types: []
+              allowed_urls:
+              - methods:
+                - GET
+                url: /users
+              api_id: 8ddd91f3cda9453442c477b06c4e2da4
+              api_name: Itachi API
+              disable_introspection: false
+              field_access_rights: []
+              limit:
+                max_query_depth: 0
+                per: 0
+                quota_max: 0
+                quota_remaining: 0
+                quota_renewal_rate: 0
+                quota_renews: 0
+                rate: 0
+                set_by_policy: false
+                smoothing:
+                  delay: 30
+                  enabled: false
+                  step: 100
+                  threshold: 500
+                  trigger: 0.8
+                throttle_interval: 0
+                throttle_retry_limit: 0
+              restricted_types: []
+              versions:
+              - Default
+          active: true
+          date_created: "2024-05-27T10:24:31.099Z"
+          hmac_enabled: false
+          id: ""
+          is_inactive: false
+          key_expires_in: 2.592e+06
+          last_updated: "1716980105"
+          max_query_depth: -1
+          meta_data:
+            user_type: mobile_user
+          name: Sample policy
+          org_id: 664a14650619d40001f1f00f
+          partitions:
+            acl: true
+            complexity: false
+            per_api: false
+            quota: true
+            rate_limit: true
+          per: 60
+          quota_max: 10000
+          quota_renewal_rate: 3600
+          rate: 1000
+          smoothing:
+            delay: 30
+            enabled: false
+            step: 100
+            threshold: 500
+            trigger: 0.8
+          tags:
+          - security
+          throttle_interval: 10
+          throttle_retry_limit: 10
+        Pages: 1
+    singleAPIDef:
+      value:
+        api_definition:
+          api_id: b84fe1a04e5648927971c0557971565c
+          auth:
+            auth_header_name: authorization
+          definition:
+            key: version
+            location: header
+          id: 66596520c7f5720001b22558
+          name: Tyk Test API
+          org_id: 664a14650619d40001f1f00f
+          proxy:
+            listen_path: /tyk-api-test/
+            strip_listen_path: true
+            target_url: https://httpbin.org
+          use_oauth2: true
+          version_data:
+            not_versioned: true
+            versions:
+              Default:
+                name: Default
+    streamsExample:
+      value:
+        components:
+          securitySchemes:
+            bearerAuth:
+              description: The API Access Credentials
+              scheme: bearer
+              type: http
+        info:
+          description: This is a sample Streams API.
+          title: Streams Sample
+          version: 1.0.0
+        openapi: 3.0.3
+        paths:
+          /api/sample/users:
+            get:
+              operationId: getUsersSample
+              responses:
+                "200":
+                  content:
+                    application/json:
+                      schema:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          type: object
+                        type: array
+                  description: fetched users
+              summary: Get users
+              tags:
+                - users
+        security:
+          - bearerAuth: [ ]
+        servers:
+          - url: https://localhost:8080
+        x-tyk-api-gateway:
+          info:
+            name: user
+            state:
+              active: true
+          server:
+            listenPath:
+              strip: true
+              value: /user-test-six/
+          upstream:
+            url: https://localhost:8080
+        x-tyk-streaming:
+          streams:
+            stream1:
+              input:
+                kafka:
+                  addresses:
+                    - localhost:9093
+                  auto_replay_nacks: true
+                  checkpoint_limit: 1024
+                  consumer_group: group1
+                  target_version: 3.3.0
+                  topics:
+                    - instrument.json.AMZN
+                    - instrument.json.GOOG
+              output:
+                broker:
+                  outputs:
+                    - stdout:
+                        codec: lines
+                    - http_server:
+                        allowed_verbs:
+                          - GET
+                        path: "/one"
+                        stream_path: "/sse"
+                        ws_path: "/ws"
+                  pattern: fan_out
+  parameters:
+    AccessType:
+      description: Filter for internal or external API versions.
+      example: internal
+      in: query
+      name: accessType
+      required: false
+      schema:
+        enum:
+        - internal
+        - external
+        type: string
+    AllowList:
+      description: Enable allowList middleware for all endpoints.
+      in: query
+      name: allowList
+      required: false
+      schema:
+        $ref: '#/components/schemas/BooleanQueryParam'
+    Authentication:
+      description: Enable/disable the authentication mechanism in your Tyk Gateway
+        for your OAS API.
+      in: query
+      name: authentication
+      schema:
+        $ref: '#/components/schemas/BooleanQueryParam'
+    CustomDomain:
+      description: Custom domain for the API.
+      example: tyk.io
+      in: query
+      name: customDomain
+      required: false
+      schema:
+        type: string
+    ListenPath:
+      description: Listen path for the API.
+      example: /user-test-seven/
+      in: query
+      name: listenPath
+      required: false
+      schema:
+        type: string
+    MockResponse:
+      description: Enable mockResponse middleware for all endpoints having responses
+        configured.
+      in: query
+      name: mockResponse
+      required: false
+      schema:
+        $ref: '#/components/schemas/BooleanQueryParam'
+    SearchText:
+      description: Search for API version name.
+      example: Sample oas
+      in: query
+      name: searchText
+      required: false
+      schema:
+        type: string
+    TemplateID:
+      description: The Asset ID of template applied while creating or importing an
+        OAS API.
+      example: my-unique-template-id
+      in: query
+      name: templateID
+      schema:
+        type: string
+    UpstreamURL:
+      description: Upstream URL for the API.
+      example: https://localhost:8080
+      in: query
+      name: upstreamURL
+      required: false
+      schema:
+        type: string
+    ValidateRequest:
+      description: Enable validateRequest middleware for all endpoints having a request
+        body with media type application/json.
+      in: query
+      name: validateRequest
+      required: false
+      schema:
+        $ref: '#/components/schemas/BooleanQueryParam'
+    endDate:
+      description: end date
+      example: ' 2023-07-31'
+      in: query
+      name: end_day
+      schema:
+        format: date
+        type: string
+    startDate:
+      description: start date
+      example: "2023-07-01"
+      in: query
+      name: start_day
+      schema:
+        format: date
+        type: string
+  schemas:
+    OpenAPI3Schema:
+      type: object
+      additionalProperties: true
+    ProxyRequest:
+      type: object
+      required:
+        - method
+        - url
+      properties:
+        method:
+          type: string
+          description: HTTP method for the proxy request (GET, POST, PUT, DELETE, etc.)
+        url:
+          type: string
+          description: Full URL for the proxy request (valid Gateway url), including scheme, host, and path
+        headers:
+          type: object
+          additionalProperties:
+            type: string
+          description: Headers to be sent with the proxy request
+        body:
+          type: object
+          description: Body of the proxy request, typically used for POST or PUT requests
+    ProxyResponse:
+      type: object
+      properties:
+        status_code:
+          type: integer
+          description: HTTP status code of the proxied response
+        headers:
+          type: object
+          additionalProperties:
+            type: string
+          description: Headers received from the proxied response
+        body:
+          type: object
+          description: Body of the proxied response, parsed as JSON if possible
+    ErrorResponse:
+      type: object
+      properties:
+        Status:
+          type: string
+          description: Error status, typically "Error"
+        Message:
+          type: string
+          description: Detailed error message explaining what went wrong
+        Meta:
+          type: object
+          nullable: true
+          description: Additional metadata about the error, if available
+    APICertificateStatusMessage:
+      properties:
+        id:
+          example: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+          type: string
+        message:
+          example: Certificate added
+          type: string
+        status:
+          example: ok
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/pkg/alias/gateway
+    APIDefinition:
+      properties:
+        CORS:
+          $ref: '#/components/schemas/CORSConfig'
+        active:
+          type: boolean
+        allowed_ips:
+          items:
+            type: string
+          nullable: true
+          type: array
+        analytics_plugin:
+          $ref: '#/components/schemas/AnalyticsPluginConfig'
+        api_id:
+          type: string
+        auth:
+          $ref: '#/components/schemas/AuthConfig'
+        auth_configs:
+          additionalProperties:
+            $ref: '#/components/schemas/AuthConfig'
+          nullable: true
+          type: object
+        auth_provider:
+          $ref: '#/components/schemas/AuthProviderMeta'
+        base_identity_provided_by:
+          type: string
+        basic_auth:
+          properties:
+            body_password_regexp:
+              type: string
+            body_user_regexp:
+              type: string
+            cache_ttl:
+              type: integer
+            disable_caching:
+              type: boolean
+            extract_from_body:
+              type: boolean
+          type: object
+        blacklisted_ips:
+          items:
+            type: string
+          nullable: true
+          type: array
+        cache_options:
+          $ref: '#/components/schemas/CacheOptions'
+        certificate_pinning_disabled:
+          type: boolean
+        certificates:
+          items:
+            type: string
+          nullable: true
+          type: array
+        client_certificates:
+          items:
+            type: string
+          nullable: true
+          type: array
+        config_data:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        config_data_disabled:
+          type: boolean
+        custom_middleware:
+          $ref: '#/components/schemas/MiddlewareSection'
+        custom_middleware_bundle:
+          type: string
+        custom_middleware_bundle_disabled:
+          type: boolean
+        custom_plugin_auth_enabled:
+          type: boolean
+        definition:
+          $ref: '#/components/schemas/VersionDefinition'
+        detailed_tracing:
+          type: boolean
+        disable_quota:
+          type: boolean
+        disable_rate_limit:
+          type: boolean
+        do_not_track:
+          type: boolean
+        domain:
+          type: string
+        domain_disabled:
+          type: boolean
+        dont_set_quota_on_create:
+          type: boolean
+        enable_batch_request_support:
+          type: boolean
+        enable_context_vars:
+          type: boolean
+        enable_coprocess_auth:
+          type: boolean
+        enable_detailed_recording:
+          type: boolean
+        enable_ip_blacklisting:
+          type: boolean
+        enable_ip_whitelisting:
+          type: boolean
+        enable_jwt:
+          type: boolean
+        enable_proxy_protocol:
+          type: boolean
+        enable_signature_checking:
+          type: boolean
+        event_handlers:
+          $ref: '#/components/schemas/EventHandlerMetaConfig'
+        expiration:
+          type: string
+        expire_analytics_after:
+          format: int64
+          type: integer
+        external_oauth:
+          $ref: '#/components/schemas/ExternalOAuth'
+        global_rate_limit:
+          $ref: '#/components/schemas/GlobalRateLimit'
+        graphql:
+          $ref: '#/components/schemas/GraphQLConfig'
+        hmac_allowed_algorithms:
+          items:
+            type: string
+          nullable: true
+          type: array
+        hmac_allowed_clock_skew:
+          format: double
+          type: number
+        id:
+          type: string
+        idp_client_id_mapping_disabled:
+          type: boolean
+        internal:
+          type: boolean
+        is_oas:
+          type: boolean
+        jwt_client_base_field:
+          type: string
+        jwt_default_policies:
+          items:
+            type: string
+          nullable: true
+          type: array
+        jwt_expires_at_validation_skew:
+          minimum: 0
+          type: integer
+        jwt_identity_base_field:
+          type: string
+        jwt_issued_at_validation_skew:
+          minimum: 0
+          type: integer
+        jwt_not_before_validation_skew:
+          minimum: 0
+          type: integer
+        jwt_policy_field_name:
+          type: string
+        jwt_scope_claim_name:
+          type: string
+        jwt_scope_to_policy_mapping:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        jwt_signing_method:
+          type: string
+        jwt_skip_kid:
+          type: boolean
+        jwt_source:
+          type: string
+        listen_port:
+          type: integer
+        name:
+          type: string
+        notifications:
+          $ref: '#/components/schemas/NotificationsManager'
+        oauth_meta:
+          properties:
+            allowed_access_types:
+              items:
+                type: string
+              nullable: true
+              type: array
+            allowed_authorize_types:
+              items:
+                type: string
+              nullable: true
+              type: array
+            auth_login_redirect:
+              type: string
+          type: object
+        openid_options:
+          $ref: '#/components/schemas/OpenIDOptions'
+        org_id:
+          type: string
+        pinned_public_keys:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        protocol:
+          type: string
+        proxy:
+          $ref: '#/components/schemas/ProxyConfig'
+        request_signing:
+          $ref: '#/components/schemas/RequestSigningMeta'
+        response_processors:
+          items:
+            $ref: '#/components/schemas/ResponseProcessor'
+          nullable: true
+          type: array
+        scopes:
+          $ref: '#/components/schemas/ScopesType2'
+        session_lifetime:
+          format: int64
+          type: integer
+        session_lifetime_respects_key_expiration:
+          type: boolean
+        session_provider:
+          $ref: '#/components/schemas/SessionProviderMeta'
+        slug:
+          type: string
+        strip_auth_data:
+          type: boolean
+        tag_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        tags:
+          items:
+            type: string
+          nullable: true
+          type: array
+        tags_disabled:
+          type: boolean
+        upstream_certificates:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        upstream_certificates_disabled:
+          type: boolean
+        uptime_tests:
+          $ref: '#/components/schemas/UptimeTests'
+        use_basic_auth:
+          type: boolean
+        use_go_plugin_auth:
+          type: boolean
+        use_keyless:
+          type: boolean
+        use_mutual_tls_auth:
+          type: boolean
+        use_oauth2:
+          type: boolean
+        use_openid:
+          type: boolean
+        use_standard_auth:
+          type: boolean
+        version_data:
+          $ref: '#/components/schemas/VersionData'
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    APILimit:
+      nullable: true
+      properties:
+        max_query_depth:
+          type: integer
+        per:
+          format: double
+          type: number
+        quota_max:
+          format: int64
+          type: integer
+        quota_remaining:
+          format: int64
+          type: integer
+        quota_renewal_rate:
+          format: int64
+          type: integer
+        quota_renews:
+          format: int64
+          type: integer
+        rate:
+          format: double
+          type: number
+        set_by_policy:
+          type: boolean
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+        throttle_interval:
+          format: double
+          type: number
+        throttle_retry_limit:
+          type: integer
+      type: object
+    AccessDefinition:
+      properties:
+        allowance_scope:
+          type: string
+        allowed_types:
+          items:
+            $ref: '#/components/schemas/GraphqlType'
+          nullable: true
+          type: array
+        allowed_urls:
+          items:
+            $ref: '#/components/schemas/AccessSpec'
+          nullable: true
+          type: array
+        api_id:
+          example: d1dfc6a927a046c54c0ed470f19757cc
+          type: string
+        api_name:
+          example: Rate Limit Proxy API
+          type: string
+        disable_introspection:
+          example: false
+          type: boolean
+        endpoints:
+          items:
+            $ref: '#/components/schemas/SessionEndpoint'
+          type: array
+        field_access_rights:
+          items:
+            $ref: '#/components/schemas/FieldAccessDefinition'
+          nullable: true
+          type: array
+        limit:
+          $ref: '#/components/schemas/APILimit'
+        restricted_types:
+          items:
+            $ref: '#/components/schemas/GraphqlType'
+          nullable: true
+          type: array
+        versions:
+          example:
+          - Default
+          - v2
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    AccessManagementPayload:
+      properties:
+        userGroupIds:
+          example:
+          - 663a4ed6b6be920001b191aa
+          - 663a4ed6b6be920001b191ab
+          items:
+            type: string
+          type: array
+        userIds:
+          example:
+          - 663b2a835715ecb6edef24e3
+          - 663a5bbf5715ec8040251f2a
+          items:
+            type: string
+          type: array
+      type: object
+    AccessSpec:
+      properties:
+        methods:
+          example:
+          - GET
+          - PATCH
+          - HEAD
+          - PUT
+          - DELETE
+          items:
+            type: string
+          nullable: true
+          type: array
+        url:
+          example: anything/rate-limit-1-per-5
+          type: string
+      type: object
+    AggregateAnalyticsData:
+      properties:
+        data:
+          items:
+            $ref: '#/components/schemas/ResultUnit'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    AllCategoriesResponse:
+      properties:
+        categories:
+          items:
+            $ref: '#/components/schemas/CategoryCount'
+          nullable: true
+          type: array
+      type: object
+    AllKeys:
+      properties:
+        keys:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    Allowance:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        ignoreCase:
+          type: boolean
+      type: object
+    AnalyticsPluginConfig:
+      properties:
+        enable:
+          type: boolean
+        func_name:
+          type: string
+        plugin_path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    ApiDefinitionWrapper:
+      properties:
+        api_definition:
+          $ref: '#/components/schemas/APIDefinition'
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        categories:
+          $ref: '#/components/schemas/Categories'
+        created_at:
+          format: date-time
+          nullable: true
+          type: string
+        hook_references:
+          items:
+            $ref: '#/components/schemas/HookReference'
+          nullable: true
+          type: array
+        is_site:
+          type: boolean
+        oas:
+          type: object
+          additionalProperties: {}
+          description: >
+            The OpenAPI 3.x specification object for this API definition.
+            For Tyk-specific OAS configuration, see https://tyk.io/docs/api-management/gateway-config-tyk-oas.
+        sort_by:
+          type: integer
+        updated_at:
+          format: date-time
+          nullable: true
+          type: string
+        user_group_owners:
+          items:
+            type: string
+          nullable: true
+          type: array
+        user_owners:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    ApiDefinitionsResponse:
+      properties:
+        apis:
+          items:
+            $ref: '#/components/schemas/ApiDefinitionWrapper'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    ApiImportByUrlPayload:
+      properties:
+        url:
+          type: string
+      type: object
+    ApiModel:
+      type: object
+    ApiResponse:
+      properties:
+        ID:
+          type: string
+        Message:
+          type: string
+        Meta: {}
+        Status:
+          type: string
+      type: object
+    APIsUsingCertificate:
+      type: object
+      properties:
+        cert_id:
+          type: string
+        apis:
+          type: array
+          items:
+            $ref: '#/components/schemas/APIUsageSummary'
+        pages:
+          type: integer
+    CertUsageType:
+      type: string
+      enum:
+        - client
+        - upstream
+        - server
+    TykApiType:
+      type: string
+      enum:
+        - Tyk Streams
+        - Tyk OAS
+        - Tyk UDG
+        - Subgraph
+        - Supergraph
+        - Tyk GraphQL
+        - TCP
+        - Tyk Classic
+    APIUsageSummary:
+      type: object
+      properties:
+        api_id:
+          type: string
+        name:
+          type: string
+        usage_type:
+          type: array
+          items:
+            $ref: '#/components/schemas/CertUsageType'
+        tyk_api_type:
+          $ref: '#/components/schemas/TykApiType'
+    ApiStatusMessage:
+      properties:
+        message:
+          type: string
+        status:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/pkg/alias/gateway
+    Asset:
+      properties:
+        _id:
+          description: database id of asset
+          example: 659b9613a1ed7ef7afdccb9d
+          readOnly: true
+          type: string
+        data:
+          $ref: '#/components/schemas/JSONRawMessage'
+        description:
+          type: string
+        id:
+          description: custom id of asset that can be provided while creation/updating.
+          example: my-unique-template-id
+          type: string
+        kind:
+          default: oas-template
+          description: the asset type, which is set to oas-template
+          enum:
+          - oas-template
+          example: oas-template
+          type: string
+        last_updated:
+          description: last updated time stamp
+          example: "2024-01-10T08:48:36.183Z"
+          format: date-time
+          readOnly: true
+          type: string
+        name:
+          description: human-readable name for the template
+          type: string
+        org_id:
+          type: string
+      type: object
+    AuditLog:
+      properties:
+        _id:
+          example: 672a83e2b0418b224440ce29
+          type: string
+        req_id:
+          example: 0462e283-a55f-41ab-6482-60d2eeb1858c
+          type: string
+        org_id:
+          example: 5e9d9544a1dcd60001d0ed20
+          type: string
+        date:
+          example: Tue, 05 Nov 2024 17:45:22 -03
+          type: string
+        timestamp:
+          example: 1730839522
+          type: integer
+        ip:
+          example: 127.0.0.1
+          type: string
+        user:
+          example: jhon@mail.com
+          type: string
+        action:
+          example: List APIS
+          type: string
+        method:
+          example: GET
+          type: string
+        url:
+          example: /api/apis
+          type: string
+        status:
+          example: 200
+          type: integer
+      type: object
+    AuditLogs:
+      properties:
+        pages:
+          type: integer
+        audit_logs:
+          items:
+            $ref: '#/components/schemas/AuditLog'
+          nullable: true
+          type: array
+      type: object
+    AuthConfig:
+      properties:
+        auth_header_name:
+          type: string
+        cookie_name:
+          type: string
+        disable_header:
+          type: boolean
+        name:
+          type: string
+        param_name:
+          type: string
+        signature:
+          $ref: '#/components/schemas/SignatureConfig'
+        use_certificate:
+          type: boolean
+        use_cookie:
+          type: boolean
+        use_param:
+          type: boolean
+        validate_signature:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    AuthProviderMeta:
+      properties:
+        meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        name:
+          type: string
+        storage_engine:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    AuthSource:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        name:
+          type: string
+      type: object
+    AuthSources:
+      properties:
+        cookie:
+          $ref: '#/components/schemas/AuthSource'
+        header:
+          $ref: '#/components/schemas/AuthSource'
+        query:
+          $ref: '#/components/schemas/AuthSource'
+      type: object
+    Authentication:
+      nullable: true
+      properties:
+        baseIdentityProvider:
+          type: string
+        custom:
+          $ref: '#/components/schemas/CustomPluginAuthentication'
+        enabled:
+          type: boolean
+        hmac:
+          $ref: '#/components/schemas/HMAC'
+        oidc:
+          $ref: '#/components/schemas/OIDC'
+        securitySchemes:
+          $ref: '#/components/schemas/SecuritySchemes'
+        stripAuthorizationData:
+          type: boolean
+      type: object
+    AuthenticationPlugin:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        functionName:
+          type: string
+        idExtractor:
+          $ref: '#/components/schemas/IDExtractor'
+        path:
+          type: string
+        rawBodyOnly:
+          type: boolean
+      type: object
+    BooleanQueryParam:
+      example: true
+      type: boolean
+    CORS:
+      nullable: true
+      properties:
+        allowCredentials:
+          type: boolean
+        allowedHeaders:
+          items:
+            type: string
+          type: array
+        allowedMethods:
+          items:
+            type: string
+          type: array
+        allowedOrigins:
+          items:
+            type: string
+          type: array
+        debug:
+          type: boolean
+        enabled:
+          type: boolean
+        exposedHeaders:
+          items:
+            type: string
+          type: array
+        maxAge:
+          type: integer
+        optionsPassthrough:
+          type: boolean
+      type: object
+    CORSConfig:
+      properties:
+        allow_credentials:
+          type: boolean
+        allowed_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        allowed_methods:
+          items:
+            type: string
+          nullable: true
+          type: array
+        allowed_origins:
+          items:
+            type: string
+          nullable: true
+          type: array
+        debug:
+          type: boolean
+        enable:
+          type: boolean
+        exposed_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        max_age:
+          type: integer
+        options_passthrough:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    Cache:
+      nullable: true
+      properties:
+        cacheAllSafeRequests:
+          type: boolean
+        cacheByHeaders:
+          items:
+            type: string
+          type: array
+        cacheResponseCodes:
+          items:
+            type: integer
+          type: array
+        controlTTLHeaderName:
+          type: string
+        enableUpstreamCacheControl:
+          type: boolean
+        enabled:
+          type: boolean
+        timeout:
+          format: int64
+          type: integer
+      type: object
+    CacheMeta:
+      properties:
+        cache_key_regex:
+          type: string
+        cache_response_codes:
+          items:
+            type: integer
+          nullable: true
+          type: array
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        timeout:
+          format: int64
+          type: integer
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    CacheOptions:
+      properties:
+        cache_all_safe_requests:
+          type: boolean
+        cache_by_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        cache_control_ttl_header:
+          type: string
+        cache_response_codes:
+          items:
+            type: integer
+          nullable: true
+          type: array
+        cache_timeout:
+          format: int64
+          type: integer
+        enable_cache:
+          type: boolean
+        enable_upstream_cache_control:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    CachePlugin:
+      nullable: true
+      properties:
+        cacheByRegex:
+          type: string
+        cacheResponseCodes:
+          items:
+            type: integer
+          type: array
+        enabled:
+          type: boolean
+        timeout:
+          format: int64
+          type: integer
+      type: object
+    CallbackRef:
+      type: object
+    Callbacks:
+      additionalProperties:
+        $ref: '#/components/schemas/CallbackRef'
+      type: object
+    Categories:
+      items:
+        type: string
+      type: array
+    CategoriesPayload:
+      properties:
+        categories:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    CategoryCount:
+      properties:
+        count:
+          example: 3
+          type: integer
+        name:
+          example: tag1
+          type: string
+      type: object
+    CertificateBasics:
+      properties:
+        cert_basics:
+          items:
+            $ref: '#/components/schemas/CertsCertificateBasics'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    CertificateDependencies:
+      properties:
+        certID:
+          example: 5e9d9544a1dcd60001d0ed20a6ab77653d5da938f452bb8cc9b55b0630a6743dabd8dc92bfb025abb09ce035
+          type: string
+        client_cert_api_names:
+          example:
+          - Ngrok Dashboard API
+          items:
+            type: string
+          nullable: true
+          type: array
+        client_cert_apis:
+          example:
+          - edc9b2bd3e7b4cc55c4ff0a7e1529b45
+          items:
+            type: string
+          nullable: true
+          type: array
+        key_cert:
+          example: 5e9d9544a1dcd60001d0ed205e9d9544a1dcd60001d0ed20a6ab77653d5da938f452bb8cc9b55b0630a6743dabd8dc92bfb025abb09ce035
+          type: string
+        upstream_cert_api_names:
+          example:
+          - External HTTPbin
+          items:
+            type: string
+          nullable: true
+          type: array
+        upstream_cert_apis:
+          example:
+          - 627efb71ebae49df7a853b9769b65fce
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    CertificateDetailedList:
+      properties:
+        certificates:
+          items:
+            $ref: '#/components/schemas/CertsCertificateMeta'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    CertificateExpiryData:
+      properties:
+        cert_id:
+          type: string
+        expiry_date:
+          type: string
+        days_remaining:
+          type: integer
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard/repository/notification
+    CertificateList:
+      properties:
+        certs:
+          items:
+            type: string
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    CertificatePinning:
+      nullable: true
+      properties:
+        domainToPublicKeysMapping:
+          $ref: '#/components/schemas/PinnedPublicKeys'
+        enabled:
+          type: boolean
+      type: object
+    CertsCertificateBasics:
+      properties:
+        dns_names:
+          items:
+            type: string
+          nullable: true
+          type: array
+        has_private:
+          type: boolean
+        id:
+          type: string
+        is_ca:
+          type: boolean
+        issuer_cn:
+          type: string
+        not_after:
+          format: date-time
+          type: string
+        not_before:
+          format: date-time
+          type: string
+        subject_cn:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/certs
+    CertsCertificateMeta:
+      properties:
+        dns_names:
+          items:
+            type: string
+          type: array
+        fingerprint:
+          type: string
+        has_private:
+          type: boolean
+        id:
+          type: string
+        is_ca:
+          type: boolean
+        issuer:
+          $ref: '#/components/schemas/PkixName'
+        not_after:
+          format: date-time
+          type: string
+        not_before:
+          format: date-time
+          type: string
+        subject:
+          $ref: '#/components/schemas/PkixName'
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/certs
+    CheckCommand:
+      properties:
+        message:
+          type: string
+        name:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    CircuitBreaker:
+      nullable: true
+      properties:
+        coolDownPeriod:
+          type: integer
+        enabled:
+          type: boolean
+        halfOpenStateEnabled:
+          type: boolean
+        sampleSize:
+          type: integer
+        threshold:
+          format: double
+          type: number
+      type: object
+    CircuitBreakerMeta:
+      properties:
+        disable_half_open_state:
+          type: boolean
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        return_to_service_after:
+          type: integer
+        samples:
+          format: int64
+          type: integer
+        threshold_percent:
+          format: double
+          type: number
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    ClientCertificates:
+      nullable: true
+      properties:
+        allowlist:
+          items:
+            type: string
+          nullable: true
+          type: array
+        enabled:
+          type: boolean
+      type: object
+    ClientToPolicy:
+      properties:
+        clientId:
+          type: string
+        policyId:
+          type: string
+      type: object
+    Components:
+      nullable: true
+      properties:
+        callbacks:
+          $ref: '#/components/schemas/Callbacks'
+        examples:
+          $ref: '#/components/schemas/Examples'
+        headers:
+          $ref: '#/components/schemas/HeadersType2'
+        links:
+          $ref: '#/components/schemas/Links'
+        parameters:
+          $ref: '#/components/schemas/ParametersMap'
+        requestBodies:
+          $ref: '#/components/schemas/RequestBodies'
+        responses:
+          $ref: '#/components/schemas/Responses'
+        schemas:
+          $ref: '#/components/schemas/Schemas'
+        securitySchemes:
+          $ref: '#/components/schemas/SecuritySchemesType2'
+      type: object
+    Contact:
+      nullable: true
+      properties:
+        email:
+          type: string
+        name:
+          type: string
+        url:
+          type: string
+      type: object
+    ContextVariables:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    CustomPlugin:
+      properties:
+        enabled:
+          type: boolean
+        functionName:
+          type: string
+        path:
+          type: string
+        rawBodyOnly:
+          type: boolean
+        requireSession:
+          type: boolean
+      type: object
+    CustomPluginAuthentication:
+      nullable: true
+      properties:
+        AuthSources:
+          $ref: '#/components/schemas/AuthSources'
+        config:
+          $ref: '#/components/schemas/AuthenticationPlugin'
+        enabled:
+          type: boolean
+      type: object
+    CustomPlugins:
+      items:
+        $ref: '#/components/schemas/CustomPlugin'
+      type: array
+    DatasourceMappingConfiguration:
+      nullable: true
+      properties:
+        disabled:
+          type: boolean
+        path:
+          type: string
+      type: object
+    DatasourceSourceConfig:
+      properties:
+        data_source_config: {}
+        kind:
+          type: string
+      type: object
+    DatasourceTypeFieldConfiguration:
+      properties:
+        data_source:
+          $ref: '#/components/schemas/DatasourceSourceConfig'
+        field_name:
+          type: string
+        mapping:
+          $ref: '#/components/schemas/DatasourceMappingConfiguration'
+        type_name:
+          type: string
+      type: object
+    DcrpRegistration:
+      properties:
+        access_token:
+          type: string
+        client_uri:
+          type: string
+        provider:
+          type: string
+      type: object
+    DetailedActivityLogs:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    DetailedExampleAPIMetadata:
+      properties:
+        api_definition:
+          $ref: '#/components/schemas/APIDefinition'
+        description:
+          type: string
+        features:
+          items:
+            type: string
+          nullable: true
+          type: array
+        location:
+          type: string
+        min_version:
+          type: string
+        name:
+          type: string
+        oas:
+          type: object
+          additionalProperties: {}
+          description: >
+            The OpenAPI 3.x specification object for this API definition.
+            For Tyk-specific OAS configuration, see https://tyk.io/docs/api-management/gateway-config-tyk-oas.
+        readme:
+          type: string
+      type: object
+    DetailedTracing:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    Domain:
+      nullable: true
+      properties:
+        certificates:
+          items:
+            type: string
+          type: array
+        enabled:
+          type: boolean
+        name:
+          type: string
+      type: object
+    DomainToCertificate:
+      properties:
+        certificate:
+          type: string
+        domain:
+          type: string
+      type: object
+    DryRunRequest:
+      properties:
+        oas:
+          $ref: '#/components/schemas/OpenAPI3Schema'
+        tyk_oas:
+          allOf:
+          - $ref: '#/components/schemas/OpenAPI3Schema'
+          - $ref: '#/components/schemas/TykVendorExtension'
+      type: object
+    EndPointMeta:
+      properties:
+        disabled:
+          type: boolean
+        ignore_case:
+          type: boolean
+        method:
+          type: string
+        method_actions:
+          additionalProperties:
+            $ref: '#/components/schemas/EndpointMethodMeta'
+          type: object
+        path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    EndpointMethodMeta:
+      properties:
+        action:
+          type: string
+        code:
+          type: integer
+        data:
+          type: string
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    EndpointPostPlugin:
+      properties:
+        enabled:
+          type: boolean
+        functionName:
+          type: string
+        name:
+          type: string
+        path:
+          type: string
+      type: object
+    EndpointPostPlugins:
+      items:
+        $ref: '#/components/schemas/EndpointPostPlugin'
+      type: array
+    EnforceTimeout:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        value:
+          type: integer
+      type: object
+    EntityStats:
+      nullable: true
+      properties:
+        apis:
+          items:
+            $ref: '#/components/schemas/IndividualStats'
+          nullable: true
+          type: array
+        dataplanes:
+          items:
+            $ref: '#/components/schemas/IndividualStats'
+          type: array
+        dataplanes_gateways:
+          items:
+            $ref: '#/components/schemas/IndividualStats'
+          type: array
+      type: object
+    EventHandler:
+      properties:
+        enabled:
+          type: boolean
+        id:
+          type: string
+        name:
+          type: string
+        trigger:
+          type: string
+        type:
+          type: string
+      type: object
+    EventHandlerMetaConfig:
+      properties:
+        events:
+          additionalProperties:
+            items:
+              $ref: '#/components/schemas/EventHandlerTriggerConfig'
+            type: array
+          nullable: true
+          type: object
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    EventHandlerTriggerConfig:
+      properties:
+        handler_meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        handler_name:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    EventHandlers:
+      items:
+        $ref: '#/components/schemas/EventHandler'
+      type: array
+    ExampleAPIMetadata:
+      properties:
+        location:
+          example: udg/vat-checker
+          type: string
+        name:
+          example: VAT number checker UDG
+          type: string
+        shortDescription:
+          example: Simple REST API wrapped in GQL using Universal Data Graph that
+            allows user to check validity of a VAT number and display some details
+            about it.
+          type: string
+      type: object
+    ExampleRef:
+      type: object
+    Examples:
+      additionalProperties:
+        $ref: '#/components/schemas/ExampleRef'
+      type: object
+    ExtendedPathsSet:
+      properties:
+        advance_cache_config:
+          items:
+            $ref: '#/components/schemas/CacheMeta'
+          type: array
+        black_list:
+          items:
+            $ref: '#/components/schemas/EndPointMeta'
+          type: array
+        cache:
+          items:
+            type: string
+          type: array
+        circuit_breakers:
+          items:
+            $ref: '#/components/schemas/CircuitBreakerMeta'
+          type: array
+        do_not_track_endpoints:
+          items:
+            $ref: '#/components/schemas/TrackEndpointMeta'
+          type: array
+        go_plugin:
+          items:
+            $ref: '#/components/schemas/GoPluginMeta'
+          type: array
+        hard_timeouts:
+          items:
+            $ref: '#/components/schemas/HardTimeoutMeta'
+          type: array
+        ignored:
+          items:
+            $ref: '#/components/schemas/EndPointMeta'
+          type: array
+        internal:
+          items:
+            $ref: '#/components/schemas/InternalMeta'
+          type: array
+        method_transforms:
+          items:
+            $ref: '#/components/schemas/MethodTransformMeta'
+          type: array
+        mock_response:
+          items:
+            $ref: '#/components/schemas/MockResponseMeta'
+          type: array
+        persist_graphql:
+          items:
+            $ref: '#/components/schemas/PersistGraphQLMeta'
+          nullable: true
+          type: array
+        rate_limit:
+          items:
+            $ref: '#/components/schemas/RateLimitMeta'
+          nullable: true
+          type: array
+        size_limits:
+          items:
+            $ref: '#/components/schemas/RequestSizeMeta'
+          type: array
+        track_endpoints:
+          items:
+            $ref: '#/components/schemas/TrackEndpointMeta'
+          type: array
+        transform:
+          items:
+            $ref: '#/components/schemas/TemplateMeta'
+          type: array
+        transform_headers:
+          items:
+            $ref: '#/components/schemas/HeaderInjectionMeta'
+          type: array
+        transform_jq:
+          items:
+            $ref: '#/components/schemas/TransformJQMeta'
+          type: array
+        transform_jq_response:
+          items:
+            $ref: '#/components/schemas/TransformJQMeta'
+          type: array
+        transform_response:
+          items:
+            $ref: '#/components/schemas/TemplateMeta'
+          type: array
+        transform_response_headers:
+          items:
+            $ref: '#/components/schemas/HeaderInjectionMeta'
+          type: array
+        url_rewrites:
+          items:
+            $ref: '#/components/schemas/URLRewriteMeta'
+          type: array
+        validate_json:
+          items:
+            $ref: '#/components/schemas/ValidatePathMeta'
+          type: array
+        validate_request:
+          items:
+            $ref: '#/components/schemas/ValidateRequestMeta'
+          type: array
+        virtual:
+          items:
+            $ref: '#/components/schemas/VirtualMeta'
+          type: array
+        white_list:
+          items:
+            $ref: '#/components/schemas/EndPointMeta'
+          type: array
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    ExternalDocs:
+      nullable: true
+      properties:
+        description:
+          type: string
+        url:
+          type: string
+      type: object
+    ExternalOAuth:
+      properties:
+        enabled:
+          type: boolean
+        providers:
+          items:
+            $ref: '#/components/schemas/ProviderType2'
+          nullable: true
+          type: array
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    FieldAccessDefinition:
+      properties:
+        field_name:
+          type: string
+        limits:
+          $ref: '#/components/schemas/FieldLimits'
+        type_name:
+          type: string
+      type: object
+    FieldLimits:
+      properties:
+        max_query_depth:
+          type: integer
+      type: object
+    FormDataFile:
+      properties:
+        file:
+          $ref: '#/components/schemas/MultipartFile'
+      required:
+      - file
+      type: object
+    FromOASExamples:
+      nullable: true
+      properties:
+        code:
+          type: integer
+        contentType:
+          type: string
+        enabled:
+          type: boolean
+        exampleName:
+          type: string
+      type: object
+    GatewayTags:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        tags:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    Global:
+      nullable: true
+      properties:
+        cache:
+          $ref: '#/components/schemas/Cache'
+        contextVariables:
+          $ref: '#/components/schemas/ContextVariables'
+        cors:
+          $ref: '#/components/schemas/CORS'
+        pluginConfig:
+          $ref: '#/components/schemas/PluginConfig'
+        postAuthenticationPlugin:
+          $ref: '#/components/schemas/PostAuthenticationPlugin'
+        postAuthenticationPlugins:
+          $ref: '#/components/schemas/CustomPlugins'
+        postPlugin:
+          $ref: '#/components/schemas/PostPlugin'
+        postPlugins:
+          $ref: '#/components/schemas/CustomPlugins'
+        prePlugin:
+          $ref: '#/components/schemas/PrePlugin'
+        prePlugins:
+          $ref: '#/components/schemas/CustomPlugins'
+        responsePlugin:
+          $ref: '#/components/schemas/ResponsePlugin'
+        responsePlugins:
+          $ref: '#/components/schemas/CustomPlugins'
+        trafficLogs:
+          $ref: '#/components/schemas/TrafficLogs'
+        transformRequestHeaders:
+          $ref: '#/components/schemas/TransformHeaders'
+        transformResponseHeaders:
+          $ref: '#/components/schemas/TransformHeaders'
+      type: object
+    GlobalRateLimit:
+      properties:
+        disabled:
+          type: boolean
+        per:
+          format: double
+          type: number
+        rate:
+          format: double
+          type: number
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GoPluginMeta:
+      properties:
+        disabled:
+          type: boolean
+        func_name:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+        plugin_path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLConfig:
+      properties:
+        enabled:
+          type: boolean
+        engine:
+          $ref: '#/components/schemas/GraphQLEngineConfig'
+        execution_mode:
+          type: string
+        introspection:
+          $ref: '#/components/schemas/GraphQLIntrospectionConfig'
+        last_schema_update:
+          format: date-time
+          nullable: true
+          type: string
+        playground:
+          $ref: '#/components/schemas/GraphQLPlayground'
+        proxy:
+          $ref: '#/components/schemas/GraphQLProxyConfig'
+        schema:
+          type: string
+        subgraph:
+          $ref: '#/components/schemas/GraphQLSubgraphConfig'
+        supergraph:
+          $ref: '#/components/schemas/GraphQLSupergraphConfig'
+        type_field_configurations:
+          items:
+            $ref: '#/components/schemas/DatasourceTypeFieldConfiguration'
+          nullable: true
+          type: array
+        version:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLEngineConfig:
+      properties:
+        data_sources:
+          items:
+            $ref: '#/components/schemas/GraphQLEngineDataSource'
+          nullable: true
+          type: array
+        field_configs:
+          items:
+            $ref: '#/components/schemas/GraphQLFieldConfig'
+          nullable: true
+          type: array
+        global_headers:
+          items:
+            $ref: '#/components/schemas/UDGGlobalHeader'
+          nullable: true
+          type: array
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLEngineDataSource:
+      properties:
+        config: {}
+        internal:
+          type: boolean
+        kind:
+          type: string
+        name:
+          type: string
+        root_fields:
+          items:
+            $ref: '#/components/schemas/GraphQLTypeFields'
+          nullable: true
+          type: array
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLFieldConfig:
+      properties:
+        disable_default_mapping:
+          type: boolean
+        field_name:
+          type: string
+        path:
+          items:
+            type: string
+          nullable: true
+          type: array
+        type_name:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLIntrospectionConfig:
+      properties:
+        disabled:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLPlayground:
+      properties:
+        enabled:
+          type: boolean
+        path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLProxyConfig:
+      properties:
+        auth_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        features:
+          $ref: '#/components/schemas/GraphQLProxyFeaturesConfig'
+        request_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        request_headers_rewrite:
+          additionalProperties:
+            $ref: '#/components/schemas/RequestHeadersRewriteConfig'
+          nullable: true
+          type: object
+        subscription_type:
+          type: string
+        use_response_extensions:
+          $ref: '#/components/schemas/GraphQLResponseExtensions'
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLProxyFeaturesConfig:
+      properties:
+        use_immutable_headers:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLResponseExtensions:
+      properties:
+        on_error_forwarding:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLSubgraphConfig:
+      properties:
+        sdl:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLSubgraphEntity:
+      properties:
+        api_id:
+          type: string
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        name:
+          type: string
+        sdl:
+          type: string
+        subscription_type:
+          type: string
+        url:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLSupergraphConfig:
+      properties:
+        disable_query_batching:
+          type: boolean
+        global_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        merged_sdl:
+          type: string
+        subgraphs:
+          items:
+            $ref: '#/components/schemas/GraphQLSubgraphEntity'
+          nullable: true
+          type: array
+        updated_at:
+          format: date-time
+          nullable: true
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphQLTypeFields:
+      properties:
+        fields:
+          items:
+            type: string
+          nullable: true
+          type: array
+        type:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    GraphqlType:
+      properties:
+        fields:
+          items:
+            type: string
+          nullable: true
+          type: array
+        name:
+          type: string
+      type: object
+    HMAC:
+      nullable: true
+      properties:
+        AuthSources:
+          $ref: '#/components/schemas/AuthSources'
+        allowedAlgorithms:
+          items:
+            type: string
+          type: array
+        allowedClockSkew:
+          format: double
+          type: number
+        enabled:
+          type: boolean
+      type: object
+    HardTimeoutMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        timeout:
+          type: integer
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    Header:
+      properties:
+        name:
+          type: string
+        value:
+          type: string
+      type: object
+    HeaderInjectionMeta:
+      properties:
+        act_on:
+          type: boolean
+        add_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        delete_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    HeaderRef:
+      type: object
+    Headers:
+      items:
+        $ref: '#/components/schemas/Header'
+      type: array
+    HeadersType2:
+      additionalProperties:
+        $ref: '#/components/schemas/HeaderRef'
+      type: object
+    HookReference:
+      properties:
+        event_name:
+          type: string
+        event_timeout:
+          format: int64
+          type: integer
+        hook:
+          $ref: '#/components/schemas/WebHookHandlerConf'
+      type: object
+    HostCheckObject:
+      properties:
+        body:
+          type: string
+        commands:
+          items:
+            $ref: '#/components/schemas/CheckCommand'
+          nullable: true
+          type: array
+        enable_proxy_protocol:
+          type: boolean
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        method:
+          type: string
+        protocol:
+          type: string
+        timeout:
+          $ref: '#/components/schemas/TimeDuration'
+        url:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    IDExtractor:
+      nullable: true
+      properties:
+        config:
+          $ref: '#/components/schemas/IDExtractorConfig'
+        enabled:
+          type: boolean
+        source:
+          type: string
+        with:
+          type: string
+      type: object
+    IDExtractorConfig:
+      nullable: true
+      properties:
+        formParamName:
+          type: string
+        headerName:
+          type: string
+        regexp:
+          type: string
+        regexpMatchIndex:
+          type: integer
+        xPathExp:
+          type: string
+      type: object
+    IndividualStats:
+      properties:
+        avg_active_usage:
+          example: 13
+          type: integer
+        avg_usage:
+          example: 15
+          type: integer
+        date:
+          example: "2023-07-01"
+          type: string
+        license_entitlement:
+          example: 25
+          type: integer
+        license_entitlement_active:
+          example: 20
+          type: integer
+        max_active_usage:
+          example: 18
+          type: integer
+        max_usage:
+          example: 20
+          type: integer
+        min_active_usage:
+          example: 8
+          type: integer
+        min_usage:
+          example: 10
+          type: integer
+      type: object
+    Info:
+      properties:
+        dbId:
+          type: string
+        expiration:
+          type: string
+        id:
+          type: string
+        name:
+          type: string
+        orgId:
+          type: string
+        state:
+          $ref: '#/components/schemas/State'
+        versioning:
+          $ref: '#/components/schemas/Versioning'
+      type: object
+    InfoType2:
+      nullable: true
+      properties:
+        contact:
+          $ref: '#/components/schemas/Contact'
+        description:
+          type: string
+        license:
+          $ref: '#/components/schemas/License'
+        termsOfService:
+          type: string
+        title:
+          type: string
+        version:
+          type: string
+      type: object
+    Internal:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    InternalMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    Introspection:
+      properties:
+        cache:
+          $ref: '#/components/schemas/IntrospectionCache'
+        client_id:
+          type: string
+        client_secret:
+          type: string
+        enabled:
+          type: boolean
+        identity_base_field:
+          type: string
+        url:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    IntrospectionCache:
+      properties:
+        enabled:
+          type: boolean
+        timeout:
+          format: int64
+          type: integer
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    JSONRawMessage:
+      example:
+        info:
+          title: Our Sample OAS
+          version: 1.0.0
+        openapi: 3.0.3
+        paths:
+          /anything:
+            post:
+              operationId: anythingpost
+              responses:
+                "200":
+                  description: Post created
+        x-tyk-api-gateway:
+          middleware:
+            global:
+              cache:
+                cacheAllSafeRequests: true
+                enabled: true
+                timeout: 5
+            operations:
+              anythingpost:
+                requestSizeLimit:
+                  enabled: true
+                  value: 100
+      type: object
+    JWTValidation:
+      properties:
+        enabled:
+          type: boolean
+        expires_at_validation_skew:
+          minimum: 0
+          type: integer
+        identity_base_field:
+          type: string
+        issued_at_validation_skew:
+          minimum: 0
+          type: integer
+        not_before_validation_skew:
+          minimum: 0
+          type: integer
+        signing_method:
+          type: string
+        source:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    KeyData:
+      properties:
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        data:
+          $ref: '#/components/schemas/SessionState'
+        key_hash:
+          example: 41c5cb1e
+          type: string
+        key_id:
+          example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+          type: string
+      type: object
+    Keys:
+      properties:
+        data:
+          $ref: '#/components/schemas/AllKeys'
+        pages:
+          type: integer
+      type: object
+    KeysDetailed:
+      properties:
+        keys:
+          items:
+            $ref: '#/components/schemas/KeyData'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    License:
+      nullable: true
+      properties:
+        name:
+          type: string
+        url:
+          type: string
+      type: object
+    LinkRef:
+      type: object
+    Links:
+      additionalProperties:
+        $ref: '#/components/schemas/LinkRef'
+      type: object
+    ListenPath:
+      properties:
+        strip:
+          type: boolean
+        value:
+          type: string
+      type: object
+    MethodTransformMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        to_method:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    Middleware:
+      nullable: true
+      properties:
+        global:
+          $ref: '#/components/schemas/Global'
+        operations:
+          $ref: '#/components/schemas/Operations'
+      type: object
+    MiddlewareDefinition:
+      properties:
+        disabled:
+          type: boolean
+        name:
+          type: string
+        path:
+          type: string
+        raw_body_only:
+          type: boolean
+        require_session:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    MiddlewareIdExtractor:
+      properties:
+        disabled:
+          type: boolean
+        extract_from:
+          type: string
+        extract_with:
+          type: string
+        extractor_config:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    MiddlewareSection:
+      properties:
+        auth_check:
+          $ref: '#/components/schemas/MiddlewareDefinition'
+        driver:
+          type: string
+        id_extractor:
+          $ref: '#/components/schemas/MiddlewareIdExtractor'
+        post:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+        post_key_auth:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+        pre:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+        response:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    MockResponse:
+      nullable: true
+      properties:
+        body:
+          type: string
+        code:
+          type: integer
+        enabled:
+          type: boolean
+        fromOASExamples:
+          $ref: '#/components/schemas/FromOASExamples'
+        headers:
+          $ref: '#/components/schemas/Headers'
+      type: object
+    MockResponseMeta:
+      properties:
+        body:
+          type: string
+        code:
+          type: integer
+        disabled:
+          type: boolean
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        ignore_case:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    MultipartFile:
+      format: binary
+      nullable: true
+      type: string
+    MutualTLS:
+      nullable: true
+      properties:
+        domainToCertificateMapping:
+          items:
+            $ref: '#/components/schemas/DomainToCertificate'
+          nullable: true
+          type: array
+        enabled:
+          type: boolean
+      type: object
+    NewAdditionalPermissions:
+      properties:
+        additional_permissions:
+          additionalProperties:
+            type: string
+          example:
+            api_developer: API Developer
+            api_manager: API Manager
+            custom_permission: Custom Permission
+          nullable: true
+          type: object
+      type: object
+    NewClientRequest:
+      properties:
+        api_id:
+          type: string
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        client_id:
+          type: string
+        client_name:
+          type: string
+        description:
+          type: string
+        meta_data: {}
+        policy_id:
+          type: string
+        redirect_uri:
+          type: string
+        secret:
+          type: string
+      type: object
+    NewOPARules:
+      properties:
+        open_policy:
+          properties:
+            rules:
+              type: string
+          type: object
+      type: object
+    NotificationsManager:
+      properties:
+        oauth_on_keychange_url:
+          type: string
+        shared_secret:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    OAS:
+      nullable: true
+      properties:
+        components:
+          $ref: '#/components/schemas/Components'
+        externalDocs:
+          $ref: '#/components/schemas/ExternalDocs'
+        info:
+          $ref: '#/components/schemas/InfoType2'
+        openapi:
+          type: string
+        paths:
+          $ref: '#/components/schemas/Paths'
+        security:
+          $ref: '#/components/schemas/SecurityRequirements'
+        servers:
+          $ref: '#/components/schemas/Servers'
+        tags:
+          $ref: '#/components/schemas/Tags'
+      type: object
+    OASSchemaResponse:
+      properties:
+        message:
+          type: string
+        schema: {}
+        status:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/pkg/alias/gateway
+    OASServerURLsResponse:
+      description: Response containing Tyk-generated server URLs for a Tyk OAS API
+      properties:
+        api_id:
+          description: The ID of the API
+          type: string
+          example: "4c1c0d8fc885401053ddac4e39ef676b"
+        urls:
+          description: Array of URL components for each Tyk-generated server URL
+          type: array
+          items:
+            $ref: '#/components/schemas/URLComponents'
+      required:
+        - api_id
+        - urls
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard
+    URLComponents:
+      description: Decomposed components of a server URL including protocol, domain, paths, and versioning information
+      properties:
+        protocol:
+          description: HTTP scheme (http or https)
+          type: string
+          example: "https"
+        domain:
+          description: Hostname (gateway domain or custom domain if configured)
+          type: string
+          example: "api.example.com"
+        port:
+          description: Port number (null for standard ports 80/443)
+          type: integer
+          nullable: true
+          example: 8080
+        listen_path:
+          description: Base path from API configuration
+          type: string
+          example: "my-api"
+        endpoint_path:
+          description: Version-specific path segment (e.g., "v1", "v2"), empty for non-versioned or header/query param versioned APIs
+          type: string
+          example: "v1"
+        query_parameters:
+          description: Query parameters required for version routing (populated for url-param versioning)
+          type: array
+          items:
+            $ref: '#/components/schemas/QueryParameter'
+        headers:
+          description: Headers required for version routing (populated for header versioning)
+          type: array
+          items:
+            $ref: '#/components/schemas/HeaderParameter'
+        url:
+          description: Complete reconstructed URL
+          type: string
+          example: "https://api.example.com/my-api/v1"
+      required:
+        - protocol
+        - domain
+        - listen_path
+        - url
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard
+    QueryParameter:
+      description: Query parameter name-value pair
+      properties:
+        name:
+          description: Query parameter name (e.g., "version")
+          type: string
+          example: "version"
+        value:
+          description: Query parameter value (e.g., "v1")
+          type: string
+          example: "v1"
+      required:
+        - name
+        - value
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard
+    HeaderParameter:
+      description: HTTP header name-value pair
+      properties:
+        name:
+          description: Header name (e.g., "X-API-Version")
+          type: string
+          example: "X-API-Version"
+        value:
+          description: Header value (e.g., "v1")
+          type: string
+          example: "v1"
+      required:
+        - name
+        - value
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard
+    AllApidefSchemasResponse:
+      properties:
+        message:
+          type: string
+        schemas:
+          properties:
+            oas: {}
+            streamsOAS: {}
+        status:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard
+    OAuthApps:
+      properties:
+        apps:
+          items:
+            $ref: '#/components/schemas/OAuthClient'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    OAuthClient:
+      properties:
+        client_id:
+          type: string
+        client_name:
+          type: string
+        dcr_registration:
+          $ref: '#/components/schemas/DcrpRegistration'
+        description:
+          type: string
+        meta_data:
+          additionalProperties:
+            type: string
+          type: object
+        policy_id:
+          type: string
+        redirect_uri:
+          type: string
+        secret:
+          type: string
+      type: object
+    OAuthClientToken:
+      properties:
+        code:
+          type: string
+        expires:
+          format: int64
+          type: integer
+      type: object
+    OAuthClientTokens:
+      items:
+        $ref: '#/components/schemas/OAuthClientToken'
+      nullable: true
+      type: array
+    OIDC:
+      nullable: true
+      properties:
+        AuthSources:
+          $ref: '#/components/schemas/AuthSources'
+        enabled:
+          type: boolean
+        providers:
+          items:
+            $ref: '#/components/schemas/Provider'
+          type: array
+        scopes:
+          $ref: '#/components/schemas/Scopes'
+        segregateByClientId:
+          type: boolean
+      type: object
+    OIDProviderConfig:
+      properties:
+        client_ids:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        issuer:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    OpenIDOptions:
+      properties:
+        providers:
+          items:
+            $ref: '#/components/schemas/OIDProviderConfig'
+          nullable: true
+          type: array
+        segregate_by_client:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    Operation:
+      properties:
+        allow:
+          $ref: '#/components/schemas/Allowance'
+        block:
+          $ref: '#/components/schemas/Allowance'
+        cache:
+          $ref: '#/components/schemas/CachePlugin'
+        circuitBreaker:
+          $ref: '#/components/schemas/CircuitBreaker'
+        doNotTrackEndpoint:
+          $ref: '#/components/schemas/TrackEndpoint'
+        enforceTimeout:
+          $ref: '#/components/schemas/EnforceTimeout'
+        ignoreAuthentication:
+          $ref: '#/components/schemas/Allowance'
+        internal:
+          $ref: '#/components/schemas/Internal'
+        mockResponse:
+          $ref: '#/components/schemas/MockResponse'
+        postPlugins:
+          $ref: '#/components/schemas/EndpointPostPlugins'
+        rateLimit:
+          $ref: '#/components/schemas/RateLimitEndpoint'
+        requestSizeLimit:
+          $ref: '#/components/schemas/RequestSizeLimit'
+        trackEndpoint:
+          $ref: '#/components/schemas/TrackEndpoint'
+        transformRequestBody:
+          $ref: '#/components/schemas/TransformBody'
+        transformRequestHeaders:
+          $ref: '#/components/schemas/TransformHeaders'
+        transformRequestMethod:
+          $ref: '#/components/schemas/TransformRequestMethod'
+        transformResponseBody:
+          $ref: '#/components/schemas/TransformBody'
+        transformResponseHeaders:
+          $ref: '#/components/schemas/TransformHeaders'
+        urlRewrite:
+          $ref: '#/components/schemas/URLRewrite'
+        validateRequest:
+          $ref: '#/components/schemas/ValidateRequest'
+        virtualEndpoint:
+          $ref: '#/components/schemas/VirtualEndpoint'
+      type: object
+    OperationType2:
+      nullable: true
+      properties:
+        callbacks:
+          $ref: '#/components/schemas/Callbacks'
+        deprecated:
+          type: boolean
+        description:
+          type: string
+        externalDocs:
+          $ref: '#/components/schemas/ExternalDocs'
+        operationId:
+          type: string
+        parameters:
+          $ref: '#/components/schemas/Parameters'
+        requestBody:
+          $ref: '#/components/schemas/RequestBodyRef'
+        responses:
+          $ref: '#/components/schemas/Responses'
+        security:
+          $ref: '#/components/schemas/SecurityRequirements'
+        servers:
+          $ref: '#/components/schemas/Servers'
+        summary:
+          type: string
+        tags:
+          items:
+            type: string
+          type: array
+      type: object
+    Operations:
+      additionalProperties:
+        $ref: '#/components/schemas/Operation'
+      type: object
+    ParameterRef:
+      type: object
+    Parameters:
+      items:
+        $ref: '#/components/schemas/ParameterRef'
+      type: array
+    ParametersMap:
+      additionalProperties:
+        $ref: '#/components/schemas/ParameterRef'
+      type: object
+    OrganisationNotification:
+      properties:
+        id:
+          type: string
+        created_at:
+          type: string
+        org_id:
+          type: string
+        hash:
+          type: string
+        kind:
+          type: string
+          enum: [ "critical", "warning" ]
+        topic:
+          type: string
+          enum: [ "certificate.expiry" ]
+        title:
+          type: string
+        message:
+          type: string
+        data:
+          oneOf:
+            - $ref: "#/components/schemas/CertificateExpiryData"
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard/model
+    PathItem:
+      properties:
+        $ref:
+          type: string
+        connect:
+          $ref: '#/components/schemas/OperationType2'
+        delete:
+          $ref: '#/components/schemas/OperationType2'
+        description:
+          type: string
+        get:
+          $ref: '#/components/schemas/OperationType2'
+        head:
+          $ref: '#/components/schemas/OperationType2'
+        options:
+          $ref: '#/components/schemas/OperationType2'
+        parameters:
+          $ref: '#/components/schemas/Parameters'
+        patch:
+          $ref: '#/components/schemas/OperationType2'
+        post:
+          $ref: '#/components/schemas/OperationType2'
+        put:
+          $ref: '#/components/schemas/OperationType2'
+        servers:
+          $ref: '#/components/schemas/Servers'
+        summary:
+          type: string
+        trace:
+          $ref: '#/components/schemas/OperationType2'
+      type: object
+    Paths:
+      additionalProperties:
+        $ref: '#/components/schemas/PathItem'
+      type: object
+    PersistGraphQLMeta:
+      properties:
+        method:
+          type: string
+        operation:
+          type: string
+        path:
+          type: string
+        variables:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    PinnedPublicKey:
+      properties:
+        domain:
+          type: string
+        publicKeys:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    PinnedPublicKeys:
+      items:
+        $ref: '#/components/schemas/PinnedPublicKey'
+      nullable: true
+      type: array
+    PkixName:
+      type: object
+    PluginBundle:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        path:
+          type: string
+      type: object
+    PluginConfig:
+      nullable: true
+      properties:
+        bundle:
+          $ref: '#/components/schemas/PluginBundle'
+        data:
+          $ref: '#/components/schemas/PluginConfigData'
+        driver:
+          type: string
+      type: object
+    PluginConfigData:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        value:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+    Policy:
+      properties:
+        _id:
+          type: string
+        access_rights:
+          additionalProperties:
+            $ref: '#/components/schemas/AccessDefinition'
+          nullable: true
+          type: object
+        active:
+          type: boolean
+        date_created:
+          format: date-time
+          type: string
+        hmac_enabled:
+          type: boolean
+        id:
+          type: string
+        is_inactive:
+          type: boolean
+        key_expires_in:
+          format: int64
+          type: integer
+        last_updated:
+          type: string
+        max_query_depth:
+          type: integer
+        meta_data:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        name:
+          type: string
+        org_id:
+          type: string
+        partitions:
+          properties:
+            acl:
+              type: boolean
+            complexity:
+              type: boolean
+            per_api:
+              type: boolean
+            quota:
+              type: boolean
+            rate_limit:
+              type: boolean
+          type: object
+        per:
+          format: double
+          type: number
+        quota_max:
+          format: int64
+          type: integer
+        quota_renewal_rate:
+          format: int64
+          type: integer
+        rate:
+          format: double
+          type: number
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+        tags:
+          items:
+            type: string
+          nullable: true
+          type: array
+        throttle_interval:
+          format: double
+          type: number
+        throttle_retry_limit:
+          type: integer
+      type: object
+    PolicyList:
+      items:
+        $ref: '#/components/schemas/Policy'
+      nullable: true
+      type: array
+    PostAuthenticationPlugin:
+      nullable: true
+      properties:
+        plugins:
+          $ref: '#/components/schemas/CustomPlugins'
+      type: object
+    PostPlugin:
+      nullable: true
+      properties:
+        plugins:
+          $ref: '#/components/schemas/CustomPlugins'
+      type: object
+    PrePlugin:
+      nullable: true
+      properties:
+        plugins:
+          $ref: '#/components/schemas/CustomPlugins'
+      type: object
+    Provider:
+      properties:
+        clientToPolicyMapping:
+          items:
+            $ref: '#/components/schemas/ClientToPolicy'
+          type: array
+        issuer:
+          type: string
+      type: object
+    ProviderType2:
+      properties:
+        introspection:
+          $ref: '#/components/schemas/Introspection'
+        jwt:
+          $ref: '#/components/schemas/JWTValidation'
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    ProxyConfig:
+      properties:
+        check_host_against_uptime_tests:
+          type: boolean
+        disable_strip_slash:
+          type: boolean
+        enable_load_balancing:
+          type: boolean
+        listen_path:
+          type: string
+        preserve_host_header:
+          type: boolean
+        service_discovery:
+          $ref: '#/components/schemas/ServiceDiscoveryConfiguration'
+        strip_listen_path:
+          type: boolean
+        target_list:
+          items:
+            type: string
+          nullable: true
+          type: array
+        target_url:
+          type: string
+        transport:
+          properties:
+            proxy_url:
+              type: string
+            ssl_ciphers:
+              items:
+                type: string
+              nullable: true
+              type: array
+            ssl_force_common_name_check:
+              type: boolean
+            ssl_insecure_skip_verify:
+              type: boolean
+            ssl_max_version:
+              minimum: 0
+              type: integer
+            ssl_min_version:
+              minimum: 0
+              type: integer
+          type: object
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    RateLimit:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        per:
+          $ref: '#/components/schemas/TimeReadableDuration'
+        rate:
+          type: integer
+      type: object
+    RateLimitEndpoint:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        per:
+          $ref: '#/components/schemas/TimeReadableDuration'
+        rate:
+          type: integer
+      type: object
+    RateLimitMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        per:
+          format: double
+          type: number
+        rate:
+          format: double
+          type: number
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    RateLimitSmoothing:
+      nullable: true
+      properties:
+        delay:
+          description: Delay is a hold-off between smoothing events and controls how
+            frequently the current allowance will step up or down (in seconds).
+          format: int64
+          minimum: 1
+          type: integer
+        enabled:
+          description: ' Enabled indicates if rate limit smoothing is active.'
+          type: boolean
+        step:
+          description: Step is the increment by which the current allowance will be
+            increased or decreased each time a smoothing event is emitted.
+          format: int64
+          minimum: 1
+          type: integer
+        threshold:
+          description: Threshold is the initial rate limit beyond which smoothing
+            will be applied. It is a count of requests during the per interval and
+            should be less than the maximum configured rate.
+          format: int64
+          minimum: 1
+          type: integer
+        trigger:
+          description: Trigger is a fraction (typically in the range 0.1-1.0) of the
+            step at which point a smoothing event will be emitted as the request rate
+            approaches the current allowance.
+          format: double
+          minimum: 0
+          multipleOf: 0.01
+          type: number
+      type: object
+    RequestBodies:
+      additionalProperties:
+        $ref: '#/components/schemas/RequestBodyRef'
+      type: object
+    RequestBodyRef:
+      type: object
+    RequestHeadersRewriteConfig:
+      properties:
+        remove:
+          type: boolean
+        value:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    RequestSigningMeta:
+      properties:
+        algorithm:
+          type: string
+        certificate_id:
+          type: string
+        header_list:
+          items:
+            type: string
+          nullable: true
+          type: array
+        is_enabled:
+          type: boolean
+        key_id:
+          type: string
+        secret:
+          type: string
+        signature_header:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    RequestSizeLimit:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        value:
+          format: int64
+          type: integer
+      type: object
+    RequestSizeMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        size_limit:
+          format: int64
+          type: integer
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    ResponsePlugin:
+      nullable: true
+      properties:
+        plugins:
+          $ref: '#/components/schemas/CustomPlugins'
+      type: object
+    ResponseProcessor:
+      properties:
+        name:
+          type: string
+        options: {}
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    ResponseRef:
+      type: object
+    Responses:
+      additionalProperties:
+        $ref: '#/components/schemas/ResponseRef'
+      type: object
+    ResultId:
+      properties:
+        alias:
+          type: string
+        api_id:
+          example: 7364617cc7d345d9755d182635dfd46d
+          type: string
+        api_name:
+          example: OAS http
+          type: string
+        code:
+          type: integer
+        day:
+          example: 12
+          type: integer
+        hour:
+          example: 0
+          type: integer
+        iso_country:
+          type: string
+        key:
+          type: string
+        month:
+          example: 6
+          type: integer
+        path:
+          type: string
+        queries:
+          additionalProperties:
+            type: integer
+          type: object
+        url:
+          type: string
+        year:
+          example: 2024
+          type: integer
+      type: object
+    ResultUnit:
+      properties:
+        error:
+          example: 4
+          type: integer
+        hits:
+          example: 26
+          type: integer
+        id:
+          $ref: '#/components/schemas/ResultId'
+        last_hit:
+          example: "2024-06-19T06:33:30Z"
+          format: date-time
+          type: string
+        latency:
+          example: 0
+          format: double
+          type: number
+        max_latency:
+          example: 0
+          format: int64
+          type: integer
+        max_upstream_latency:
+          example: 0
+          format: int64
+          type: integer
+        min_latency:
+          example: 0
+          format: int64
+          type: integer
+        min_upstream_latency:
+          example: 0
+          format: int64
+          type: integer
+        request_time:
+          example: 190.2
+          format: double
+          type: number
+        success:
+          example: 22
+          type: integer
+        upstream_latency:
+          example: 0
+          format: double
+          type: number
+      type: object
+    ReturnDataStruct:
+      properties:
+        Data:
+          $ref: '#/components/schemas/PolicyList'
+        Pages:
+          type: integer
+      type: object
+    RoutingTrigger:
+      properties:
+        "on":
+          type: string
+        options:
+          $ref: '#/components/schemas/RoutingTriggerOptions'
+        rewrite_to:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    RoutingTriggerOptions:
+      properties:
+        header_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        path_part_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        payload_matches:
+          $ref: '#/components/schemas/StringRegexMap'
+        query_val_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        request_context_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        session_meta_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    SSOAccessData:
+      properties:
+        DisplayName:
+          type: string
+        EmailAddress:
+          type: string
+        ForSection:
+          enum:
+          - dashboard
+          - portal
+          type: string
+        GroupID:
+          type: string
+        OrgID:
+          type: string
+        SSOOnlyForRegisteredUsers:
+          type: boolean
+        UserNotAllowed:
+          type: boolean
+      type: object
+    SchemaRef:
+      type: object
+    Schemas:
+      additionalProperties:
+        $ref: '#/components/schemas/SchemaRef'
+      type: object
+    ScopeClaim:
+      properties:
+        scope_claim_name:
+          type: string
+        scope_to_policy:
+          additionalProperties:
+            type: string
+          type: object
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    ScopeToPolicy:
+      properties:
+        policyId:
+          type: string
+        scope:
+          type: string
+      type: object
+    Scopes:
+      nullable: true
+      properties:
+        claimName:
+          type: string
+        scopeToPolicyMapping:
+          items:
+            $ref: '#/components/schemas/ScopeToPolicy'
+          type: array
+      type: object
+    ScopesType2:
+      properties:
+        jwt:
+          $ref: '#/components/schemas/ScopeClaim'
+        oidc:
+          $ref: '#/components/schemas/ScopeClaim'
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    SecurityRequirement:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    SecurityRequirements:
+      items:
+        $ref: '#/components/schemas/SecurityRequirement'
+      nullable: true
+      type: array
+    SecuritySchemeRef:
+      type: object
+    SecuritySchemes:
+      additionalProperties: {}
+      type: object
+    SecuritySchemesType2:
+      additionalProperties:
+        $ref: '#/components/schemas/SecuritySchemeRef'
+      type: object
+    Server:
+      properties:
+        authentication:
+          $ref: '#/components/schemas/Authentication'
+        clientCertificates:
+          $ref: '#/components/schemas/ClientCertificates'
+        customDomain:
+          $ref: '#/components/schemas/Domain'
+        detailedActivityLogs:
+          $ref: '#/components/schemas/DetailedActivityLogs'
+        detailedTracing:
+          $ref: '#/components/schemas/DetailedTracing'
+        eventHandlers:
+          $ref: '#/components/schemas/EventHandlers'
+        gatewayTags:
+          $ref: '#/components/schemas/GatewayTags'
+        listenPath:
+          $ref: '#/components/schemas/ListenPath'
+      type: object
+    ServerType2:
+      properties:
+        description:
+          type: string
+        url:
+          type: string
+        variables:
+          additionalProperties:
+            $ref: '#/components/schemas/ServerVariable'
+          type: object
+      type: object
+    ServerVariable:
+      properties:
+        default:
+          type: string
+        description:
+          type: string
+        enum:
+          items:
+            type: string
+          type: array
+      type: object
+    Servers:
+      items:
+        $ref: '#/components/schemas/ServerType2'
+      nullable: true
+      type: array
+    ServiceDiscovery:
+      nullable: true
+      properties:
+        cache:
+          $ref: '#/components/schemas/ServiceDiscoveryCache'
+        cacheTimeout:
+          format: int64
+          type: integer
+        dataPath:
+          type: string
+        enabled:
+          type: boolean
+        endpointReturnsList:
+          type: boolean
+        parentDataPath:
+          type: string
+        portDataPath:
+          type: string
+        queryEndpoint:
+          type: string
+        targetPath:
+          type: string
+        useNestedQuery:
+          type: boolean
+        useTargetList:
+          type: boolean
+      type: object
+    ServiceDiscoveryCache:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        timeout:
+          format: int64
+          type: integer
+      type: object
+    ServiceDiscoveryConfiguration:
+      properties:
+        cache_disabled:
+          type: boolean
+        cache_timeout:
+          format: int64
+          type: integer
+        data_path:
+          type: string
+        endpoint_returns_list:
+          type: boolean
+        parent_data_path:
+          type: string
+        port_data_path:
+          type: string
+        query_endpoint:
+          type: string
+        target_path:
+          type: string
+        use_discovery_service:
+          type: boolean
+        use_nested_query:
+          type: boolean
+        use_target_list:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    SessionEndpoint:
+      properties:
+        methods:
+          items:
+            $ref: '#/components/schemas/SessionEndpointMethod'
+          type: array
+        path:
+          type: string
+      type: object
+    SessionEndpointMethod:
+      properties:
+        limit:
+          $ref: '#/components/schemas/SessionEndpointRateLimit'
+        name:
+          type: string
+      type: object
+    SessionEndpointRateLimit:
+      properties:
+        per:
+          format: int64
+          type: integer
+        rate:
+          format: int64
+          type: integer
+      type: object
+    SessionProviderMeta:
+      properties:
+        meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        name:
+          type: string
+        storage_engine:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    SessionState:
+      properties:
+        access_rights:
+          additionalProperties:
+            $ref: '#/components/schemas/AccessDefinition'
+          nullable: true
+          type: object
+        alias:
+          example: portal-developer@example.org
+          type: string
+        allowance:
+          example: 1000
+          format: double
+          type: number
+        apply_policies:
+          example:
+          - 641c15dd0fffb800010197bf
+          - 615d2e528bf3980001c7c6c2
+          items:
+            type: string
+          nullable: true
+          type: array
+        apply_policy_id:
+          deprecated: true
+          description: deprecated use apply_policies going forward instead to send
+            a list of policies ids
+          example: 641c15dd0fffb800010197bf
+          type: string
+        basic_auth_data:
+          properties:
+            hash_type:
+              example: bcrypt
+              type: string
+            password:
+              example: testuse1
+              type: string
+            user:
+              example: admin-user@example.org
+              type: string
+          type: object
+        certificate:
+          type: string
+        mtls_static_certificate_bindings:
+          items:
+            type: string
+          nullable: true
+          type: array
+        data_expires:
+          example: 0
+          format: int64
+          type: integer
+        date_created:
+          example: "2024-05-14T13:15:46.560506+03:00"
+          format: date-time
+          type: string
+        enable_detailed_recording:
+          example: true
+          type: boolean
+        expires:
+          example: 1.716895221e+09
+          format: int64
+          type: integer
+        hmac_enabled:
+          example: false
+          type: boolean
+        hmac_string:
+          type: string
+        id_extractor_deadline:
+          example: 0
+          format: int64
+          type: integer
+        is_inactive:
+          type: boolean
+        jwt_data:
+          properties:
+            secret:
+              type: string
+          type: object
+        key_id:
+          type: string
+        last_check:
+          example: 0
+          format: int64
+          type: integer
+        last_updated:
+          example: "1715681746"
+          type: string
+        max_query_depth:
+          example: 5
+          type: integer
+        meta_data:
+          example:
+            tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+        monitor:
+          properties:
+            trigger_limits:
+              example:
+              - 80
+              - 60
+              - 50
+              items:
+                format: double
+                type: number
+              nullable: true
+              type: array
+          type: object
+        oauth_client_id:
+          type: string
+        oauth_keys:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        org_id:
+          example: 5e9d9544a1dcd60001d0ed20
+          type: string
+        per:
+          example: 60
+          format: double
+          type: number
+        quota_max:
+          example: 1.710302205e+09
+          format: int64
+          type: integer
+        quota_remaining:
+          example: 20000
+          format: int64
+          type: integer
+        quota_renewal_rate:
+          example: -1
+          format: int64
+          type: integer
+        quota_renews:
+          example: 1.715681745e+09
+          format: int64
+          type: integer
+        rate:
+          example: 1000
+          format: double
+          type: number
+        session_lifetime:
+          example: 0
+          format: int64
+          type: integer
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+        tags:
+          example:
+          - edge
+          - edge-eu
+          items:
+            type: string
+          nullable: true
+          type: array
+        throttle_interval:
+          example: 10
+          format: double
+          type: number
+        throttle_retry_limit:
+          example: -1
+          type: integer
+      type: object
+    SignatureConfig:
+      properties:
+        algorithm:
+          type: string
+        allowed_clock_skew:
+          format: int64
+          type: integer
+        error_code:
+          type: integer
+        error_message:
+          type: string
+        header:
+          type: string
+        param_name:
+          type: string
+        secret:
+          type: string
+        use_param:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    State:
+      properties:
+        active:
+          type: boolean
+        internal:
+          type: boolean
+      type: object
+    StringRegexMap:
+      properties:
+        match_rx:
+          type: string
+        reverse:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    SystemStatsResp:
+      properties:
+        message:
+          type: string
+        stats:
+          $ref: '#/components/schemas/EntityStats'
+        status:
+          example: Success
+          type: string
+      type: object
+    Tag:
+      properties:
+        description:
+          type: string
+        externalDocs:
+          $ref: '#/components/schemas/ExternalDocs'
+        name:
+          type: string
+      type: object
+    Tags:
+      items:
+        $ref: '#/components/schemas/Tag'
+      type: array
+    TemplateData:
+      properties:
+        enable_session:
+          type: boolean
+        input_type:
+          type: string
+        template_mode:
+          type: string
+        template_source:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    TemplateMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        template_data:
+          $ref: '#/components/schemas/TemplateData'
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    Test:
+      nullable: true
+      properties:
+        serviceDiscovery:
+          $ref: '#/components/schemas/ServiceDiscovery'
+      type: object
+    TimeDuration:
+      format: duration
+      type: string
+      example: "30s"
+    TimeReadableDuration:
+      format: duration
+      type: string
+      example: PT2H30M15S
+    TrackEndpoint:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    TrackEndpointMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    TrafficLogs:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    TransformBody:
+      nullable: true
+      properties:
+        body:
+          type: string
+        enabled:
+          type: boolean
+        format:
+          type: string
+        path:
+          type: string
+      type: object
+    TransformHeaders:
+      nullable: true
+      properties:
+        add:
+          $ref: '#/components/schemas/Headers'
+        enabled:
+          type: boolean
+        remove:
+          items:
+            type: string
+          type: array
+      type: object
+    TransformJQMeta:
+      properties:
+        filter:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    TransformRequestMethod:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        toMethod:
+          type: string
+      type: object
+    UDGGlobalHeader:
+      properties:
+        key:
+          type: string
+        value:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    URLRewrite:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        pattern:
+          type: string
+        rewriteTo:
+          type: string
+        triggers:
+          items:
+            $ref: '#/components/schemas/URLRewriteTrigger'
+          type: array
+      type: object
+    URLRewriteMeta:
+      properties:
+        disabled:
+          type: boolean
+        match_pattern:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+        rewrite_to:
+          type: string
+        triggers:
+          items:
+            $ref: '#/components/schemas/RoutingTrigger'
+          nullable: true
+          type: array
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    URLRewriteRule:
+      properties:
+        in:
+          type: string
+        name:
+          type: string
+        negate:
+          type: boolean
+        pattern:
+          type: string
+      type: object
+    URLRewriteTrigger:
+      properties:
+        condition:
+          type: string
+        rewriteTo:
+          type: string
+        rules:
+          items:
+            $ref: '#/components/schemas/URLRewriteRule'
+          type: array
+      type: object
+    URLVals:
+      properties:
+        ApiURL:
+          type: string
+        BasePath:
+          type: string
+        Host:
+          type: string
+      type: object
+    Upstream:
+      properties:
+        certificatePinning:
+          $ref: '#/components/schemas/CertificatePinning'
+        mutualTLS:
+          $ref: '#/components/schemas/MutualTLS'
+        rateLimit:
+          $ref: '#/components/schemas/RateLimit'
+        serviceDiscovery:
+          $ref: '#/components/schemas/ServiceDiscovery'
+        test:
+          $ref: '#/components/schemas/Test'
+        url:
+          type: string
+      type: object
+    UptimeTests:
+      properties:
+        check_list:
+          items:
+            $ref: '#/components/schemas/HostCheckObject'
+          nullable: true
+          type: array
+        config:
+          $ref: '#/components/schemas/UptimeTestsConfig'
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    UptimeTestsConfig:
+      properties:
+        expire_utime_after:
+          format: int64
+          type: integer
+        recheck_wait:
+          type: integer
+        service_discovery:
+          $ref: '#/components/schemas/ServiceDiscoveryConfiguration'
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    User:
+      properties:
+        access_key:
+          example: d7ebef749e4348cb67fec3cfc81f0a50
+          type: string
+        active:
+          example: true
+          type: boolean
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        created_at:
+          example: "2024-05-19T08:23:29.034+03:00"
+          format: date-time
+          type: string
+        email_address:
+          example: multi-org-user@example.org
+          type: string
+        first_name:
+          example: itachi
+          type: string
+        group_id:
+          example: 5e9d9544a1dcd60001d0ed20
+          type: string
+        id:
+          example: 66498cd1e2fcd1000184ecb5
+          type: string
+        last_login_date:
+          example: "2024-05-19T08:42:22.659839+03:00"
+          format: date-time
+          type: string
+        last_name:
+          example: sasuke
+          type: string
+        org_id:
+          example: 5e9d9544a1dcd60001d0ed20
+          type: string
+        password_max_days:
+          example: 0
+          type: integer
+        password_updated:
+          example: "2024-05-19T08:23:29.146+03:00"
+          format: date-time
+          type: string
+        user_permissions:
+          $ref: '#/components/schemas/UserPermissionObject'
+      required:
+      - first_name
+      - last_name
+      - email_address
+      - user_permissions
+      type: object
+    UserGroup:
+      properties:
+        active:
+          example: true
+          type: boolean
+        description:
+          example: Devops logs and analytics access
+          type: string
+        id:
+          example: 6649986d5715ec4c96cbef2b
+          type: string
+        name:
+          example: 66498cd1e2fcd1000184ecb8
+          type: string
+        org_id:
+          example: 5e9d9544a1dcd60001d0ed20
+          type: string
+        password_max_days:
+          example: 0
+          type: integer
+        user_permissions:
+          $ref: '#/components/schemas/UserPermissionObject'
+      type: object
+    UserGroups:
+      properties:
+        groups:
+          items:
+            $ref: '#/components/schemas/UserGroup'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    UserPassword:
+      properties:
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        current_password:
+          example: testuser1password
+          minLength: 6
+          type: string
+        new_password:
+          example: newtestuser1password
+          minLength: 6
+          type: string
+      type: object
+    UserPermissionObject:
+      additionalProperties:
+        type: string
+      type: object
+    UserSearchPayload:
+      properties:
+        filters:
+          properties:
+            query:
+              example: itachi@tyk.io
+              type: string
+          type: object
+      type: object
+    Users:
+      properties:
+        pages:
+          type: integer
+        users:
+          items:
+            $ref: '#/components/schemas/User'
+          nullable: true
+          type: array
+      type: object
+    ValidatePathMeta:
+      properties:
+        disabled:
+          type: boolean
+        error_response_code:
+          type: integer
+        method:
+          type: string
+        path:
+          type: string
+        schema:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        schema_b64:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    ValidateRequest:
+      nullable: true
+      properties:
+        enabled:
+          type: boolean
+        errorResponseCode:
+          type: integer
+      type: object
+    ValidateRequestMeta:
+      properties:
+        enabled:
+          type: boolean
+        error_response_code:
+          type: integer
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    VersionData:
+      properties:
+        default_version:
+          type: string
+        not_versioned:
+          type: boolean
+        versions:
+          additionalProperties:
+            $ref: '#/components/schemas/VersionInfo'
+          nullable: true
+          type: object
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    VersionDefinition:
+      properties:
+        default:
+          type: string
+        enabled:
+          type: boolean
+        fallback_to_default:
+          type: boolean
+        key:
+          type: string
+        location:
+          type: string
+        name:
+          type: string
+        strip_path:
+          type: boolean
+        strip_versioning_data:
+          type: boolean
+        url_versioning_pattern:
+          type: string
+        versions:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    VersionInfo:
+      properties:
+        expires:
+          type: string
+        extended_paths:
+          $ref: '#/components/schemas/ExtendedPathsSet'
+        global_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        global_headers_disabled:
+          type: boolean
+        global_headers_remove:
+          items:
+            type: string
+          nullable: true
+          type: array
+        global_response_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        global_response_headers_disabled:
+          type: boolean
+        global_response_headers_remove:
+          items:
+            type: string
+          nullable: true
+          type: array
+        global_size_limit:
+          format: int64
+          type: integer
+        ignore_endpoint_case:
+          type: boolean
+        name:
+          type: string
+        override_target:
+          type: string
+        paths:
+          properties:
+            black_list:
+              items:
+                type: string
+              nullable: true
+              type: array
+            ignored:
+              items:
+                type: string
+              nullable: true
+              type: array
+            white_list:
+              items:
+                type: string
+              nullable: true
+              type: array
+          type: object
+        use_extended_paths:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    VersionMeta:
+      properties:
+        expirationDate:
+          type: string
+        id:
+          type: string
+        internal:
+          type: boolean
+        isDefaultVersion:
+          type: boolean
+        name:
+          type: string
+        versionName:
+          type: string
+      type: object
+    VersionMetas:
+      properties:
+        apis:
+          items:
+            $ref: '#/components/schemas/VersionMeta'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    VersionToID:
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+      type: object
+    Versioning:
+      nullable: true
+      properties:
+        default:
+          type: string
+        enabled:
+          type: boolean
+        fallbackToDefault:
+          type: boolean
+        key:
+          type: string
+        location:
+          type: string
+        name:
+          type: string
+        stripVersioningData:
+          type: boolean
+        urlVersioningPattern:
+          type: string
+        versions:
+          items:
+            $ref: '#/components/schemas/VersionToID'
+          nullable: true
+          type: array
+      type: object
+    VirtualEndpoint:
+      nullable: true
+      properties:
+        body:
+          type: string
+        enabled:
+          type: boolean
+        functionName:
+          type: string
+        name:
+          type: string
+        path:
+          type: string
+        proxyOnError:
+          type: boolean
+        requireSession:
+          type: boolean
+      type: object
+    VirtualMeta:
+      properties:
+        disabled:
+          type: boolean
+        function_source_type:
+          type: string
+        function_source_uri:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+        proxy_on_error:
+          type: boolean
+        response_function_name:
+          type: string
+        use_session:
+          type: boolean
+      type: object
+      x-go-package: github.com/TykTechnologies/tyk/apidef
+    WebHookHandlerConf:
+      properties:
+        api_model:
+          $ref: '#/components/schemas/ApiModel'
+        event_timeout:
+          example: 0
+          format: int64
+          type: integer
+        header_map:
+          additionalProperties:
+            type: string
+          example:
+            secret: superscretkey
+            x-auth: authvalue
+          nullable: true
+          type: object
+        id:
+          example: 664b613f5715ec4c96cbef3e
+          type: string
+        method:
+          example: POST
+          type: string
+        name:
+          example: Expired Keys webhook
+          type: string
+        org_id:
+          example: 5e9d9544a1dcd60001d0ed20
+          type: string
+        target_path:
+          example: https://httpbin.org/expired-keys
+          type: string
+        template_path:
+          example: templates/default_webhook.json
+          type: string
+        webhook_id:
+          example: 1f78e319202b430e92286cff3ca759e3
+          type: string
+      required:
+      - method
+      - target_path
+      type: object
+    WebHooks:
+      properties:
+        hooks:
+          items:
+            $ref: '#/components/schemas/WebHookHandlerConf'
+          nullable: true
+          type: array
+        pages:
+          type: integer
+      type: object
+    XTykAPIGateway:
+      properties:
+        info:
+          $ref: '#/components/schemas/Info'
+        middleware:
+          $ref: '#/components/schemas/Middleware'
+        server:
+          $ref: '#/components/schemas/Server'
+        upstream:
+          $ref: '#/components/schemas/Upstream'
+      type: object
+    TykVendorExtension:
+      properties:
+        x-tyk-api-gateway:
+          $ref: '#/components/schemas/XTykAPIGateway'
+      type: object
+    XTykStreaming:
+      properties:
+        x-tyk-streaming:
+          type: object
+          properties:
+            streams:
+              type: object
+              additionalProperties: true
+            #to be added
+    MigrateAPIRequest:
+      type: object
+      required:
+        - mode
+      properties:
+        apiIDs:
+          type: array
+          items:
+            type: string
+          description: List of API IDs to migrate. Cannot be used together with 'all'
+        all:
+          type: boolean
+          description: Migrate all APIs. Cannot be used together with 'apiIDs'
+        abortOnFailure:
+          type: boolean
+          description: Stop migration process on first failure
+        mode:
+          type: string
+          enum:
+            - dryRun
+            - stage
+            - promote
+            - direct
+          description: Migration mode to use
+        overrideStaged:
+          type: boolean
+          description: When mode is staged and overrideStaged is set to true, migration process will overwrite already existing staged API with the same staged ID
+    MigrateAPIResponse:
+      description: migration API response object
+      type: object
+      properties:
+        success:
+          description: reports details of APIs migrated successfully
+          type: object
+          properties:
+            count:
+              description: count of APIs migrated successfully
+              type: integer
+            apiIDs:
+              description: list of API IDs migrated successfully
+              type: array
+              items:
+                type: string
+            stagedAPIs:
+              description: reports the details of APIs staged in stage mode
+              type: array
+              items:
+                type: object
+                properties:
+                  classicAPIID:
+                    type: string
+                  oasAPIID:
+                    type: string
+            definitions:
+              type: array
+              items:
+                type: object
+                properties:
+                  apiID:
+                    type: string
+                  baseAPI:
+                    description: contains the migrated base API in Tyk OAS format
+                    type: object
+                  versions:
+                    description: contains the versioned API definitions in Tyk OAS format
+                    type: array
+                    items:
+                      type: object
+        failure:
+          description: reports the details of failed API migrations
+          type: object
+          properties:
+            count:
+              description: count of APIs failed migration
+              type: integer
+            errors:
+              description: details of errors occurred during migration
+              type: array
+              items:
+                type: object
+                properties:
+                  apiID:
+                    type: string
+                  message:
+                    type: array
+                    items:
+                      type: string
+        skipped:
+          description: reports the details of skipped APIs
+          type: object
+          properties:
+            count:
+              type: integer
+            apis:
+              type: array
+              items:
+                type: object
+                properties:
+                  apiID:
+                    type: string
+                  message:
+                    type: string
+                  key:
+                    type: string
+                    nullable: true
+                    enum:
+                      - already_migrated
+                      - already_staged
+                      - is_tcp
+                      - is_streams
+                      - is_graphql
+                      - is_websocket
+                      - not_staged
+
+        abortedOnFailure:
+          description: reports whether migration process aborted on first failure
+          type: boolean
+  securitySchemes:
+    bearerAuth:
+      description: The Tyk Dashboard API Access Credentials
+      scheme: bearer
+      type: http
diff --git a/swagger/enterprise-developer-portal-swagger.yaml b/swagger/enterprise-developer-portal-swagger.yaml
new file mode 100644
index 0000000000..8bfe884d9a
--- /dev/null
+++ b/swagger/enterprise-developer-portal-swagger.yaml
@@ -0,0 +1,9295 @@
+openapi: 3.1.0
+info:
+  title: Tyk Developer Portal
+  description: >-
+    
+    <img src="https://tyk.io/docs/img/developer_portal_swagger_image.png" width="963" height="250">
+    
+    ## <a name="introduction"></a> Introduction
+
+    The Tyk Enterprise Developer Portal Management API offers programmatic
+    access to all portal resources that your instance of the portal manages.
+    This API repeats functionality of the user interface and enables APIs
+    consumers integrating their portal instances with their other IT systems
+    such as billings, CRMs, ITSM systems and other software.
+
+
+    ## Authentication
+
+    This API requires an admin authorisation token that is available for admin
+    users of the portal in the profile page.
+  version: 1.14.0
+servers:
+  - url: http://localhost:3001/portal-api
+tags:
+  - name: Providers
+    description: API Providers connected to this portal instance
+  - name: Users
+    description: Portal admins and API consumers
+  - name: Organisations
+    description: Organisation of API consumers and the portal admins
+  - name: Teams
+    description: Teams of API consumers and the portal admins
+  - name: Products
+    description: >-
+      Marketing description and visibility of the API Products surfaced in this
+      portal instance
+  - name: Tutorials for API Products
+    description: Tutorials that are defined for the API products
+  - name: API documentation for API Products
+    description: OpenAPI specs for APIs included into the API Prodcuts
+  - name: Plans
+    description: >-
+      Marketing description and visibility settings of usage plans defined in
+      this portal instance
+  - name: Catalogues
+    description: Catalogues of API Products listed on this portal instance
+  - name: Catalogue audiences
+    description: Audience management
+  - name: Access requests
+    description: Access requests to API Products
+  - name: Applications and credentials
+    description: Developer applications and API credential for developers
+  - name: Portal configuration
+    description: Show the current portal configuration
+  - name: Pages and content
+    description: Pages and content on the pages
+  - name: Themes
+    description: Management of the portal's visual themes
+  - name: Custom Attributes
+    description: Extend already existing models (User) by adding custom attributes
+  - name: OAuth2.0 providers
+    description: OAuth2.0 providers registered in the portal
+  - name: Webhooks
+    description: Webhooks management
+  - name: Posts
+    description: Posts management
+  - name: SSO Profiles
+    description: SSO Profiles management
+  - name: Tags
+    description: "Tags management: link API Products to blog posts and control their display."
+paths:
+  /access_requests:
+    get:
+      description: List all access requests that exist in the portal
+      operationId: list-access-requests
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessRequest-basic-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all access requests
+      tags:
+        - Access requests
+  /access_requests/{access_request_id}:
+    delete:
+      description: >-
+        This endpoint deletes an access request. If an access request is
+        approved, its credentials will be revoked and removed from a gateway or
+        an identity provider
+      operationId: delete-access-request
+      parameters:
+        - description: UID of this access request
+          in: path
+          name: access_request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete an access request
+      tags:
+        - Access requests
+    get:
+      description: Get an access request's data
+      operationId: get-access-request
+      parameters:
+        - description: UID of this access request
+          in: path
+          name: access_request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessRequest-index-elem"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get an access request's data
+      tags:
+        - Access requests
+  /access_requests/{access_request_id}/approve:
+    put:
+      description: >-
+        This endpoint triggers approval of an access request. A call to this API
+        will trigger creation of credentials in a gateway or an Identity
+        Provider
+      operationId: approve-access-request
+      parameters:
+        - description: UID of this access request
+          in: path
+          name: access_request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithMessage"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithMessage"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Approve an access request
+      tags:
+        - Access requests
+  /access_requests/{access_request_id}/reject:
+    put:
+      description: Reject an access request
+      operationId: reject-access-request
+      parameters:
+        - description: UID of this access request
+          in: path
+          name: access_request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithMessage"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithMessage"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Reject an access request
+      tags:
+        - Access requests
+  /apps:
+    get:
+      description: List all developer applications
+      operationId: list-apps
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Client-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all developer application that exist in the portal
+      tags:
+        - Applications and credentials
+    post:
+      description: Create a new developer application
+      operationId: create-app
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Client-basic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Client-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Create a new developer application
+      tags:
+        - Applications and credentials
+  /apps/{app_id}:
+    delete:
+      description: >-
+        Delete an application. The application, all its access requests and
+        credentials will be removed. Also, it will trigger removal of all
+        credentials that belong to this application from a gateway and/or
+        Identity Provider
+      operationId: delete-app
+      parameters:
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete an application
+      tags:
+        - Applications and credentials
+    get:
+      description: Get an application's data
+      operationId: get-app
+      parameters:
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Client-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get an application's data
+      tags:
+        - Applications and credentials
+    put:
+      description: >-
+        This endpoint updates an application's data such as its name,
+        description, redirect URI and the user to whom this application belongs
+      operationId: update-app
+      parameters:
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Client-basic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Client-show"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request or not found
+      security:
+        - AdminAPIToken: []
+      summary: Update an application
+      tags:
+        - Applications and credentials
+  /apps/{app_id}/access-requests:
+    get:
+      description: List all access requests for this application
+      operationId: list-access-requests-from-app
+      parameters:
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessRequest-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all access requests for this application
+      tags:
+        - Applications and credentials
+  /apps/{app_id}/access-requests/{access-request_id}:
+    delete:
+      description: >-
+        This endpoint deletes an access request. If this access request was
+        approved and has any credenitals attached to it then all of them will be
+        removed and revoked in a gateway on an identity provider
+      operationId: delete-access-request-from-app
+      parameters:
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this access request
+          in: path
+          name: access-request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Delete an access request
+      tags:
+        - Applications and credentials
+    get:
+      description: Get an access request's data
+      operationId: get-access-request-from-app
+      parameters:
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this access request
+          in: path
+          name: access-request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessRequest-show"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessRequest-show"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get an access request's data
+      tags:
+        - Applications and credentials
+  /apps/{app_id}/access-requests/{access-request_id}/credentials:
+    get:
+      description: List credentials from a specific access request for this app
+      operationId: list-credentials
+      parameters:
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this access request
+          in: path
+          name: access-request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Credential-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List credentials for an access request
+      tags:
+        - Applications and credentials
+  /apps/{app_id}/access-requests/{access-request_id}/credentials/{credential_id}:
+    delete:
+      description: >-
+        This endpoint deletes credentials for an access request and removes an
+        API key from the gateway or an OAuth2.0 client from the Identity
+        Provider
+      operationId: delete-credentials
+      parameters:
+        - description: UID of this credential
+          in: path
+          name: credential_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this access request
+          in: path
+          name: access-request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Delete a credential from an access request
+      tags:
+        - Applications and credentials
+    get:
+      description: Get a credential by its ID
+      operationId: get-credentials
+      parameters:
+        - description: UID of this credential
+          in: path
+          name: credential_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this access request
+          in: path
+          name: access-request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Credential-index-elem"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get a credential by its ID
+      tags:
+        - Applications and credentials
+  /apps/{app_id}/access-requests/{access-request_id}/credentials/{credential_id}/rotate:
+    put:
+      description: >-
+        Rotate the credentials that belong to an access request for a specific application.
+        The new credentials will replace the existing ones.
+      operationId: rotate-credentials
+      parameters:
+        - description: UID of this credential
+          in: path
+          name: credential_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this access request
+          in: path
+          name: access-request_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithMessage"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithErrors"
+          description: Not found or issues were encountered rotating credentials
+      security:
+        - AdminAPIToken: []
+      summary: Rotate credentials
+      tags:
+        - Applications and credentials
+  /apps/{app_id}/provision:
+    put:
+      description: Create a new access request for this application
+      operationId: provision-application
+      parameters:
+        - description: UID of this application
+          in: path
+          name: app_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithMessage"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithErrors"
+          description: Not found or Bad request
+      security:
+        - AdminAPIToken: []
+      summary: Create a new access request for this application
+      tags:
+        - Applications and credentials
+  /catalogues:
+    get:
+      description: List all catalogues that exist in the portal
+      operationId: list-catalogues
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Catalogue-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all catalogues
+      tags:
+        - Catalogues
+    post:
+      description: Create a new catalogue
+      operationId: /catalogues-POST
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Catalogue-create"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Catalogue-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Create a new catalogue
+      tags:
+        - Catalogues
+  /catalogues/{catalogue_id}:
+    delete:
+      description: >-
+        This endpoint deletes a catalogue. When a catalog is deleted, all of its
+        audiences are also deleted
+      operationId: delete-catalogue
+      parameters:
+        - description: UID of a catalogue
+          in: path
+          name: catalogue_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a catalogue
+      tags:
+        - Catalogues
+    get:
+      description: Get a catalogue
+      operationId: get-catalogue
+      parameters:
+        - description: UID of a catalogue
+          in: path
+          name: catalogue_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Catalogue-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get a catalogue
+      tags:
+        - Catalogues
+    put:
+      description: Update a catalogue's data such as name and visibility settings
+      operationId: update-catalogue
+      parameters:
+        - description: UID of a catalogue
+          in: path
+          name: catalogue_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Catalogue-update"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Catalogue-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Update a catalogue
+      tags:
+        - Catalogues
+  /catalogues/{catalogue_id}/audiences:
+    get:
+      description: >-
+        List audiences that have access to this catalogue. Each audience is a
+        team that belongs to a specific organisation
+      operationId: list-audiences
+      parameters:
+        - description: UID of a catalogue
+          in: path
+          name: catalogue_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OrganisationCatalogue-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List audiences for this catalogue
+      tags:
+        - Catalogue audiences
+    post:
+      description: >-
+        Add a new audience to this catalogue. Please note that if the catalog's
+        visibility is set to 'public', the audiences will be ignored
+      operationId: create-audience
+      parameters:
+        - description: UID of a catalogue
+          in: path
+          name: catalogue_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OrganisationCatalogue-create"
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OrganisationCatalogue-show"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found or bad request
+      security:
+        - AdminAPIToken: []
+      summary: Add a new audience to this catalogue
+      tags:
+        - Catalogue audiences
+  /catalogues/{catalogue_id}/audiences/{audience_id}:
+    delete:
+      description: >-
+        Remove an audience from this catalog. Please note that if the catalog's
+        visibility is set to 'public', the audiences will be ignored
+      operationId: delete-audience
+      parameters:
+        - description: UID of an audience
+          in: path
+          name: audience_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of a catalogue
+          in: path
+          name: catalogue_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Remove an audience from a catalog
+      tags:
+        - Catalogue audiences
+    get:
+      description: List all audiences for this catalogue
+      operationId: get-audience
+      parameters:
+        - description: UID of an audience
+          in: path
+          name: audience_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of a catalogue
+          in: path
+          name: catalogue_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OrganisationCatalogue-show"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OrganisationCatalogue-show"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: List all audiences for this catalogue
+      tags:
+        - Catalogue audiences
+  /configs:
+    get:
+      description: View the current configuration of the portal
+      operationId: get-configs
+      parameters: []
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Settings-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get the portal config
+      tags:
+        - Portal configuration
+  /organisations:
+    get:
+      description: List all developer organisations
+      operationId: list-organisations
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Organisation-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all developer organisations
+      tags:
+        - Organisations
+    post:
+      description: Create a new developer organisation
+      operationId: create-organisation
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Organisation-create"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Organisation-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Create a new developer organisation
+      tags:
+        - Organisations
+  /organisations/{organisation_id}:
+    delete:
+      description: >-
+        Please note that this endpoint deletes an organisation but not its
+        developers. When an organisation is deleted, all users are moved to the
+        Default Organisation. To completely erase an organisation and all its
+        users, delete the users first
+      operationId: delete-organisation
+      parameters:
+        - description: UID of an organisation
+          in: path
+          name: organisation_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete an organisation
+      tags:
+        - Organisations
+    get:
+      description: Get an organisation
+      operationId: get-organisation
+      parameters:
+        - description: UID of an organisation
+          in: path
+          name: organisation_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Organisation-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get an organisation
+      tags:
+        - Organisations
+    put:
+      description: >-
+        Update an organisation's data. At this point, you can change only the
+        name of an organisation
+      operationId: update-organisation
+      parameters:
+        - description: UID of an organisation
+          in: path
+          name: organisation_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Organisation-create"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Organisation-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Update an organisation
+      tags:
+        - Organisations
+  /organisations/{organisation_id}/teams:
+    get:
+      description: List all teams for an organisation
+      operationId: list-teams
+      parameters:
+        - description: UID of an organisation
+          in: path
+          name: organisation_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Team-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all teams for an organisation
+      tags:
+        - Teams
+    post:
+      description: Create a new team for an organisation
+      operationId: create-team
+      parameters:
+        - description: UID of an organisation
+          in: path
+          name: organisation_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Team-create"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Team-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Create a new team for an organisation
+      tags:
+        - Teams
+  /organisations/{organisation_id}/teams/{team_id}:
+    delete:
+      description: >-
+        This endpoint deletes a team from an organisation. Please note that
+        developers that belong to that team won't be removed. Instead, they will
+        be moved to the default team of that organisation
+      operationId: delete-team
+      parameters:
+        - description: UID of a team
+          in: path
+          name: team_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+        - description: UID of an organisation
+          in: path
+          name: organisation_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a team from an organisation
+      tags:
+        - Teams
+    get:
+      description: Get teams for an organisation
+      operationId: get-team
+      parameters:
+        - description: UID of a team
+          in: path
+          name: team_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+        - description: UID of an organisation
+          in: path
+          name: organisation_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Team-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get teams for an organisation
+      tags:
+        - Teams
+    put:
+      description: >-
+        Update a team for an organisation by adding or removing users, or
+        changing the name of the team
+      operationId: update-team
+      parameters:
+        - description: UID of a team
+          in: path
+          name: team_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+        - description: UID of an organisation
+          in: path
+          name: organisation_id
+          required: true
+          schema:
+            type: integer
+            example: 2
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Team-update"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Team-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Update a team for an organisation
+      tags:
+        - Teams
+  /pages:
+    get:
+      description: List all content pages. This doesn't include blog posts and API Products
+      operationId: list-pages
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Page-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all content pages
+      tags:
+        - Pages and content
+    post:
+      description: Create a new content page
+      operationId: create-page
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Page-basic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Page-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Create a new content page
+      tags:
+        - Pages and content
+  /pages/{page_id}:
+    delete:
+      description: Delete a page
+      operationId: delete-page
+      parameters:
+        - description: UID of the page
+          in: path
+          name: page_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a page
+      tags:
+        - Pages and content
+    get:
+      description: Get a page
+      operationId: get-page
+      parameters:
+        - description: UID of the page
+          in: path
+          name: page_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Page-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get a page
+      tags:
+        - Pages and content
+    put:
+      description: Update a page including title, path, and status
+      operationId: update-page
+      parameters:
+        - description: UID of the page
+          in: path
+          name: page_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Page-basic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Page-show"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Page-show"
+          description: Validation error
+      security:
+        - AdminAPIToken: []
+      summary: Update a page
+      tags:
+        - Pages and content
+  /pages/{page_id}/content-blocks:
+    get:
+      description: List all content blocks which are displayed on this page
+      operationId: list-content-blocks
+      parameters:
+        - description: UID of the page
+          in: path
+          name: page_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ContentBlock-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all content blocks which are displayed on this page
+      tags:
+        - Pages and content
+    post:
+      description: Create a new content block for a page
+      operationId: create-content-block
+      parameters:
+        - description: UID of the page
+          in: path
+          name: page_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ContentBlock-basic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ContentBlock-show"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found or Bad request
+      security:
+        - AdminAPIToken: []
+      summary: Create a new content block for a page
+      tags:
+        - Pages and content
+  /pages/{page_id}/content-blocks/{content-block_id}:
+    delete:
+      description: Delete content blocks from this page
+      operationId: delete-content-block
+      parameters:
+        - description: UID of the content block
+          in: path
+          name: content-block_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the page
+          in: path
+          name: page_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete content blocks from this page
+      tags:
+        - Pages and content
+    get:
+      description: Get a content block
+      operationId: get-content-block
+      parameters:
+        - description: UID of the content block
+          in: path
+          name: content-block_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the page
+          in: path
+          name: page_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ContentBlock-show"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ContentBlock-show"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get a content block
+      tags:
+        - Pages and content
+    put:
+      description: Update a content block including the content and name
+      operationId: update-content-block
+      parameters:
+        - description: UID of the content block
+          in: path
+          name: content-block_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the page
+          in: path
+          name: page_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ContentBlock-basic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ContentBlock-show"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request or Not found
+      security:
+        - AdminAPIToken: []
+      summary: Update a content block
+      tags:
+        - Pages and content
+  /plans:
+    get:
+      description: List all plans that exist in the portal
+      operationId: list-plans
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Plan-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all plans
+      tags:
+        - Plans
+    post:
+      description: Create a new plan
+      operationId: create-plan
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PlanRequest"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Plan"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Validation error
+      security:
+        - AdminAPIToken: []
+      summary: Create a new plan
+      tags:
+        - Plans
+  /plans/{plan_id}:
+    get:
+      description: Get a plan's details
+      operationId: get-plan
+      parameters:
+        - description: ID of the plan
+          in: path
+          name: plan_id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Plan"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get a plan
+      tags:
+        - Plans
+    delete:
+      description: Delete a plan
+      operationId: delete-plan
+      parameters:
+        - description: ID of the plan
+          in: path
+          name: plan_id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a plan
+      tags:
+        - Plans
+    put:
+      description: Update a plan
+      operationId: update-plan
+      parameters:
+        - description: ID of the plan
+          in: path
+          name: plan_id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PlanRequest"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Plan"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Validation error
+      security:
+        - AdminAPIToken: []
+      summary: Update a plan
+      tags:
+        - Plans
+  /products:
+    get:
+      description: List all products available in the portal
+      operationId: list-products
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Product-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all products
+      tags:
+        - Products
+    post:
+      description: Create a new product (regular API product or documentation-only product)
+      operationId: create-product
+      requestBody:
+        required: true
+        content:
+          application/json:
+            examples:
+              regular-product:
+                summary: Regular API Product
+                value:
+                  APIDetails:
+                    - APIID: "3108a5fc970946ef66c1835cf73ba7a5"
+                      Description: "This API provides payment endpoints"
+                      OASUrl: "https://petstore.swagger.io/v2/swagger.json"
+                  Catalogues: [1]
+                  CID: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+                  Content: "<p>Description goes here</p>"
+                  DCREnabled: true
+                  Description: "Description goes here"
+                  DisplayName: "ACME Payment API"
+                  Feature: true
+                  IsDocumentationOnly: false
+                  Name: "payment_api"
+                  ProviderID: 1
+                  Scopes: "payments,clients"
+                  Tags: [1]
+                  Templates: [1]
+              documentation-product:
+                summary: Documentation only Product
+                value:
+                  SpecDetails:
+                    - SpecAlias: "payment_api"
+                      OASUrl: "https://petstore.swagger.io/v2/swagger.json"
+                  Catalogues: [1]
+                  CID: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+                  Content: "<p>Description goes here</p>"
+                  DCREnabled: true
+                  Description: "Description goes here"
+                  DisplayName: "Doc only Product"
+                  Feature: true
+                  IsDocumentationOnly: true
+                  Name: "doc_only"
+                  Tags: [1]
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Product-show"
+          description: Created
+        "422":
+          description: Validation Error
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+      security:
+        - AdminAPIToken: []
+      summary: Create a new product
+      tags:
+        - Products
+  /products/{product_id}:
+    get:
+      description: Get a product
+      operationId: get-product
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Product-show"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Product-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get a product
+      tags:
+        - Products
+    put:
+      description: Update a product (regular API product or documentation-only product)
+      operationId: update-product
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            examples:
+              regular-product:
+                summary: Regular API Product Update
+                value:
+                  Name: "payment_api"
+                  ProviderID: 1
+                  IsDocumentationOnly: false
+                  APIDetails:
+                    - APIID: "3108a5fc970946ef66c1835cf73ba7a5"
+                      Description: "This API provides payment endpoints"
+                      OASUrl: "https://petstore.swagger.io/v2/swagger.json"
+                  Catalogues: [1]
+                  CID: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+                  Content: "<p>Description goes here</p>"
+                  DCREnabled: true
+                  Description: "Description goes here"
+                  DisplayName: "ACME Payment API"
+                  Feature: true
+                  Scopes: "payments,clients"
+                  Tags: [1]
+                  Templates: [1]
+              documentation-product:
+                summary: Documentation-only Product Update
+                value:
+                  Name: "doc_only"
+                  IsDocumentationOnly: true
+                  SpecDetails:
+                    - SpecAlias: "payment_api"
+                      OASUrl: "https://petstore.swagger.io/v2/swagger.json"
+                  Catalogues: [1]
+                  CID: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+                  Content: "<p>Description goes here</p>"
+                  DCREnabled: true
+                  Description: "Description goes here"
+                  DisplayName: "Doc only Product"
+                  Feature: true
+                  Tags: [1]
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Product-show"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found or Bad request
+      security:
+        - AdminAPIToken: []
+      summary: Update a product
+      tags:
+        - Products
+    delete:
+      description: Delete a product
+      operationId: delete-product
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a product
+      tags:
+        - Products
+  /products/{product_id}/api-details:
+    get:
+      description: List all APIs included in this API Product
+      operationId: list-api-details
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIDetail-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all APIs included in this API Product
+      tags:
+        - API documentation for API Products
+  /products/{product_id}/spec-details:
+    get:
+      description: List all Specification details included in this Documentation Product
+      operationId: list-spec-details
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SpecDetail-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all Specification details included in this Documentation Product
+      tags:
+        - API documentation for API Products
+    post:
+      description: Add a new specification to this Documentation Product
+      operationId: create-spec-details
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SpecDetail-create"
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SpecDetail-index-elem"
+          description: Created
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad Request
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Validation Error
+      security:
+        - AdminAPIToken: []
+      summary: Add a new specification to this Documentation Product
+      tags:
+        - API documentation for API Products
+  /products/{product_id}/api-details/{api-id}:
+    get:
+      description: Get description of an API
+      operationId: get-api-details
+      parameters:
+        - description: UID of an API as it comes from the API Provider
+          in: path
+          name: api-id
+          required: true
+          schema:
+            type: string
+            example: a0ce49d559ce49d64fe608ea3728082a
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIDetail-show"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIDetail-show"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get description of an API
+      tags:
+        - API documentation for API Products
+    put:
+      description: Update description of an API including name, OAS URL and description
+      operationId: update-api-details
+      parameters:
+        - description: UID of an API as it comes from the API Provider
+          in: path
+          name: api-id
+          required: true
+          schema:
+            type: string
+            example: a0ce49d559ce49d64fe608ea3728082a
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/APIDetail-update"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIDetail"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Update description of an API
+      tags:
+        - API documentation for API Products
+  /products/{product_id}/docs:
+    get:
+      description: List all tutorials for this API Product
+      operationId: list-docs
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Post-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all tutorials for this API Product
+      tags:
+        - Tutorials for API Products
+    post:
+      description: Create a new tutorial page for this API Product
+      operationId: create-docs
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Post-create"
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Post-create"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Create a new tutorial page for this API Product
+      tags:
+        - Tutorials for API Products
+  /products/{product_id}/docs/{doc_id}:
+    delete:
+      description: Delete a tutorial page from this API Product
+      operationId: delete-docs
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of a tutorial page
+          in: path
+          name: doc_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a tutorial page from this API Product
+      tags:
+        - Tutorials for API Products
+    get:
+      description: Get a tutorial page
+      operationId: get-docs
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of a tutorial page
+          in: path
+          name: doc_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Post-index-elem"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Post-index-elem"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get a tutorial page
+      tags:
+        - Tutorials for API Products
+    put:
+      description: Update a tutorial page including its metadata and content
+      operationId: update-docs
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of a tutorial page
+          in: path
+          name: doc_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Post-update"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Post-index-elem"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found or bad request
+      security:
+        - AdminAPIToken: []
+      summary: Update a tutorial page
+      tags:
+        - Tutorials for API Products
+  /products/{product_id}/docs/reorder:
+    post:
+      description: Change order of tutorial pages in an API Product
+      operationId: reorder-docs
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Post-reorder"
+        description: >-
+          An array containing the UIDs of tutorial pages represents the new
+          order of tutorial pages for this API Product. The tutorial page whose
+          UID appears first in this array will be positioned first in the API
+          Product's Get Started tab, and so on.
+      responses:
+        "200":
+          description: OK
+        "400":
+          description: Bad request or API Product is not found
+      security:
+        - AdminAPIToken: []
+      summary: Change order of tutorial pages
+      tags:
+        - Tutorials for API Products
+  /products/{product_id}/api-details/{api_id}/oas:
+    get:
+      description: Download an OAS spec as a file for a specific API in a Product
+      operationId: get-oas
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: api_id
+          in: path
+          schema:
+            type: string
+            example: a0ce49d559ce49d64fe608ea3728082a
+          required: true
+          description: UID of an API as it comes from the API Provider
+      responses:
+        "200":
+          content:
+            application/x-yaml:
+              schema:
+                type: string
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                type: string
+                example: no oas specified
+          description: Not found or Bad Request
+      security:
+        - AdminAPIToken: []
+      summary: Download OAS file of an API
+      tags:
+        - API documentation for API Products
+    post:
+      description: Update an OAS file for an API inside an API Product
+      operationId: update-oas
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: api_id
+          in: path
+          schema:
+            type: string
+            example: a0ce49d559ce49d64fe608ea3728082a
+          required: true
+          description: UID of an API as it comes from the API Provider
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+                  description: oas spec file
+      responses:
+        "200":
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Update OAS file of an API
+      tags:
+        - API documentation for API Products
+    delete:
+      description: Remove OAS file from an API
+      operationId: delete-oas
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: api_id
+          in: path
+          schema:
+            type: string
+            example: a0ce49d559ce49d64fe608ea3728082a
+          required: true
+          description: UID of an API as it comes from the API Provider
+      responses:
+        "200":
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Delete OAS file of an API
+      tags:
+        - API documentation for API Products
+  /products/{product_id}/tags:
+    get:
+      description: List all tags attached to this API Product
+      operationId: list-product-tags
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProductTagIndex"
+          description: Product tags retrieved successfully
+      security:
+        - AdminAPIToken: []
+      summary: List all tags for this API Product
+      tags:
+        - Products
+    post:
+      description: Attach a tag to this API Product
+      operationId: create-product-tag
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Product-Tag"
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Product-Tag"
+          description: The tag is successfully attached to the API Product
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Attach a tag to this API Product
+      tags:
+        - Products
+  /products/{product_id}/tags/{tag_name}:
+    delete:
+      description: Delete a tag from this API Product
+      operationId: delete-product-tag
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: Name of the tag to delete
+          in: path
+          name: tag_name
+          required: true
+          schema:
+            type: string
+            example: foo
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: Tag successfully deleted from the API Product
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: The tag requested for deletion was not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a tag from this API Product
+      tags:
+        - Products
+    get:
+      description: Get a tag for this API Product
+      operationId: get-product-tag
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: Name of the tag
+          in: path
+          name: tag_name
+          required: true
+          schema:
+            type: string
+            example: monetization
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Product-Tag"
+          description: Product tag was successfully retrieved
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: Product tag is wot found
+      security:
+        - AdminAPIToken: []
+      summary: Get a tag from this API Product
+      tags:
+        - Products
+  /products/{product_id}/client_types:
+    get:
+      description: List all client types attached to this API Product
+      operationId: list-product-client-types
+      parameters:
+        - description: UID of a Client Type
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProductClientTypeList"
+          description: List of client types successfully retrieved
+      security:
+        - AdminAPIToken: []
+      summary: List all client types for this API Product
+      tags:
+        - Products
+    post:
+      description: Attach a client type to this API Product
+      operationId: create-product-client-type
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ProductClientTypeAttach"
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProductClientTypeResponse"
+          description: Client type is successfully attached to the product
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: >-
+            Invalid payload encountered when creating client type. Request could
+            not be processed
+      security:
+        - AdminAPIToken: []
+      summary: Attach a client type to this API Product
+      tags:
+        - Products
+  /products/{product_id}/client_types/{client_type_id}:
+    delete:
+      description: Delete a client type from this API Product
+      operationId: delete-product-client-type
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of a client type
+          in: path
+          name: client_type_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: Client type is deleted successfully
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Client type is not found
+      security:
+        - AdminAPIToken: []
+      summary: Detach a client type from this API Product
+      tags:
+        - Products
+    get:
+      description: Get a client type attached to this API Product
+      operationId: get-product-client-type
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of a Client Type
+          in: path
+          name: client_type_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProductClientTypeResponse"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: Client type is wot found
+      security:
+        - AdminAPIToken: []
+      summary: Get a client type attached to this API Product
+      tags:
+        - Products
+  /products/{product_id}/logo:
+    post:
+      description: Upload a logo/product page image for this API Product
+      operationId: upload-product-logo
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+                  description: image file to upload
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "400":
+          content:
+            text/plain:
+              schema:
+                type: string
+          description: Bad Request
+      summary: Upload a logo/product page image for this API Product
+      tags:
+        - Products
+    get:
+      description: Get the logo/product page image for this API Product
+      operationId: get-product-logo
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            image/jpeg:
+              schema:
+                type: string
+                format: binary
+                description: image file
+          description: OK
+        "400":
+          content:
+            text/plain:
+              schema:
+                type: string
+          description: Bad Request
+      summary: Get the logo/product page image for this API Product
+      tags:
+        - Products
+    delete:
+      description: Delete the logo/product page image for this API Product
+      operationId: delete-product-logo
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "400":
+          content:
+            text/plain:
+              schema:
+                type: string
+          description: Bad Request
+      summary: Delete the logo/product page image for this API Product
+      tags:
+        - Products
+  /products/{product_id}/preview:
+    post:
+      description: Upload a preview/catalogue page image for this API Product
+      operationId: upload-product-preview
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+                  description: image file to upload
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "400":
+          content:
+            text/plain:
+              schema:
+                type: string
+          description: Bad Request
+      summary: Upload a preview/catalogue page image for this API Product
+      tags:
+        - Products
+    get:
+      description: Get the preview/catalogue page image for this API Product
+      operationId: get-product-preview
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            image/jpeg:
+              schema:
+                type: string
+                format: binary
+                description: image file
+          description: OK
+        "400":
+          content:
+            text/plain:
+              schema:
+                type: string
+          description: Bad Request
+      summary: Get the preview/catalogue page image for this API Product
+      tags:
+        - Products
+    delete:
+      description: Delete the preview/catalogue page image for this API Product
+      operationId: delete-product-preview
+      parameters:
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "400":
+          content:
+            text/plain:
+              schema:
+                type: string
+          description: Bad Request
+      summary: Delete the preview/catalogue page image for this API Product
+      tags:
+        - Products
+  /tags:
+    get:
+      description: List all tags
+      operationId: list-tags
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Tag-index-tags"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all tags
+      tags:
+        - Tags
+    post:
+      description: Create a new tag
+      operationId: /tags-POST
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Product-Tag"
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Tag-show-tags"
+          description: OK
+        "422":
+          description: Not found or bad request
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/TagErrors"
+      security:
+        - AdminAPIToken: []
+      summary: Create a new tag
+      tags:
+        - Tags
+  /tags/{tag_id}:
+    get:
+      description: Get a tag
+      operationId: get-tag
+      parameters:
+        - description: UID of a tag
+          in: path
+          name: tag_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Tag-show-tags"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get a tag
+      tags:
+        - Tags
+    put:
+      description: Update a tag
+      operationId: update-tag
+      parameters:
+        - description: UID of a tag
+          in: path
+          name: tag_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Product-Tag"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Tag-show-tags"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/TagErrors"
+          description: Not found or bad request
+      security:
+        - AdminAPIToken: []
+      summary: Update a tag
+      tags:
+        - Tags
+    delete:
+      description: Delete a tag
+      operationId: delete-tag
+      parameters:
+        - description: UID of a tag
+          in: path
+          name: tag_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Delete a tag
+      tags:
+        - Tags
+  /providers:
+    get:
+      description: List all API Providers connected to this portal instance
+      operationId: list-providers
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Provider-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all API Providers
+      tags:
+        - Providers
+    post:
+      description: >-
+        Create a new API Provider. The new API Provider will have the 'Unknown'
+        synchronization status until the first synchronization attempt
+      operationId: create-provider
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Provider-create"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Provider-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Create a new API Provider
+      tags:
+        - Providers
+  /providers/{provider_id}:
+    delete:
+      description: >-
+        This endpoint deletes an API Provider provider and removes all assets
+        related to it such as API Products and Plans
+      operationId: delete-provider
+      parameters:
+        - description: UID of an API provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Delete an API Provider
+      tags:
+        - Providers
+    get:
+      description: Get an API Provider configuration
+      operationId: get-provider
+      parameters:
+        - description: UID of an API provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Provider-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get an API Provider configuration
+      tags:
+        - Providers
+    put:
+      description: Update Provider
+      operationId: update-provider
+      parameters:
+        - description: UID of an API provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Provider-update"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Provider-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Update Provider
+      tags:
+        - Providers
+  /providers/{provider_id}/synchronize:
+    put:
+      description: Synchronize API Products and plans with an API Provider
+      operationId: synchronize-provider
+      parameters:
+        - description: UID of an API provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithMessage"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithErrors"
+          description: Error
+      security:
+        - AdminAPIToken: []
+      summary: Synchronize API Products and plans with an API Provider
+      tags:
+        - Providers
+  /themes:
+    get:
+      description: List all themes
+      operationId: list-themes
+      parameters: []
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Theme-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all themes
+      tags:
+        - Themes
+  /themes/{theme_id}:
+    get:
+      description: Get metadata for a theme such as name, author, version and status
+      operationId: get-theme
+      parameters:
+        - description: "`name` of the theme from the theme.json file"
+          in: path
+          name: theme_id
+          required: true
+          schema:
+            type: string
+            example: default
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Theme-basic"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Theme not found
+      security:
+        - AdminAPIToken: []
+      summary: Get a theme
+      tags:
+        - Themes
+    delete:
+      description: Soft delete a theme by its ID
+      operationId: delete-theme
+      parameters:
+        - description: "ID of the theme to delete"
+          in: path
+          name: theme_id
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Theme successfully deleted
+        "404":
+          description: Theme not found
+        "422":
+          description: Cannot delete active theme
+      security:
+        - AdminAPIToken: []
+      summary: Soft delete a theme
+      tags:
+        - Themes
+  /themes/{theme_id}/activate:
+    put:
+      description: >-
+        Activate a theme. When a new theme is activated, it becomes the current
+        theme for the live portal and is displayed to all developers visiting
+        the portal
+      operationId: activate-theme
+      parameters:
+        - description: "`name` of the theme from the theme.json file"
+          in: path
+          name: theme_id
+          required: true
+          schema:
+            type: string
+            example: default
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithMessage"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusWithErrors"
+          description: Not found or issues were encountered activating the theme
+      security:
+        - AdminAPIToken: []
+      summary: Activate a theme
+      tags:
+        - Themes
+  /themes/{theme_id}/download:
+    get:
+      description: Download a theme as a zip archive
+      operationId: download-theme
+      parameters:
+        - description: "`name` of the theme from the theme.json file"
+          in: path
+          name: theme_id
+          required: true
+          schema:
+            type: string
+            example: default
+      responses:
+        "200":
+          content:
+            application/zip:
+              schema:
+                type: string
+                format: binary
+                description: zip archive contaning the theme
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Download a theme
+      tags:
+        - Themes
+  /themes/upload:
+    post:
+      description: >-
+        This endpoint uploads a theme that is archived as a zip file to the
+        portal.
+
+
+        If a theme with this name already exists in the portal, the uploaded
+        theme will replace the existing one. Otherwise, a new theme will be
+        created.
+
+
+        The name of a theme is stored in the `name` field of `theme.json`.
+      operationId: upload-theme
+      parameters: []
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              $ref: "#/components/schemas/Theme-upload"
+      responses:
+        "200":
+          content:
+            text/plain:
+              schema:
+                $ref: "#/components/schemas/Theme-upload-response"
+          description: OK
+        "400":
+          content:
+            text/plain:
+              schema:
+                $ref: "#/components/schemas/Theme-upload-response"
+          description: Bad request
+      security:
+        - AdminAPIToken: []
+      summary: Upload a theme
+      tags:
+        - Themes
+  /users:
+    get:
+      description: List all admin users and developers
+      operationId: list-users
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/User-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all users
+      tags:
+        - Users
+    post:
+      description: Create a new admin user or developer
+      operationId: create-user
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/User-create"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/User-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Create a new user
+      tags:
+        - Users
+  /users/{user_id}:
+    delete:
+      description: >-
+        Delete a user and all their applications. All credentials that are
+        issued for those applications will be revoked and deleted as well
+      operationId: delete-user
+      parameters:
+        - description: UID of a user
+          in: path
+          name: user_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: >-
+            If set to true, will force user deletion on errors caused by
+            interaction with external providers
+          in: query
+          name: force
+          required: false
+          schema:
+            type: boolean
+            example: true
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a user
+      tags:
+        - Users
+    get:
+      description: Get a user
+      operationId: get-user
+      parameters:
+        - description: UID of a user
+          in: path
+          name: user_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/User-show"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/User-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get a user
+      tags:
+        - Users
+    put:
+      description: >-
+        Update a user data such as email, name, identity provider and
+        organisation
+      operationId: update-user
+      parameters:
+        - description: UID of a user
+          in: path
+          name: user_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/User-update"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/User-show"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found or Bad request
+      security:
+        - AdminAPIToken: []
+      summary: Update a user
+      tags:
+        - Users
+  /users/{user_id}/custom-attributes:
+    get:
+      description: Get extended custom attributes for user
+      operationId: list-user-custom-attributes
+      parameters:
+        - description: UID of user
+          in: path
+          name: user_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Custom-attribute-user-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get extended custom attributes for user
+      tags:
+        - Users
+  /users/{user_id}/custom-attributes/{custom-attribute_id}:
+    get:
+      description: Get a user custom attribute
+      operationId: get-user-custom-attribute
+      parameters:
+        - description: UID of user
+          in: path
+          name: user_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the custom attribute
+          in: path
+          name: custom-attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Custom-attribute-user-element"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Custom-attribute-user-element"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get a user custom attribute
+      tags:
+        - Users
+    put:
+      description: Update a user custom attribute value if write once set false
+      operationId: update-user-custom-attribute
+      parameters:
+        - description: UID of user
+          in: path
+          name: user_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the custom attribute
+          in: path
+          name: custom-attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Custom-attribute-user-basic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Custom-attribute-user-element"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request or Not found
+      security:
+        - AdminAPIToken: []
+      summary: Update a user custom attribute
+      tags:
+        - Users
+    delete:
+      description: Delete a user custom attribute
+      operationId: delete-user-custom-attribute
+      parameters:
+        - description: UID of user
+          in: path
+          name: user_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the custom attribute
+          in: path
+          name: custom-attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a custom attribute
+      tags:
+        - Users
+  /extended_attributes:
+    get:
+      description: List all extended models for custom attributes
+      operationId: list-extended-attributes
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Extended-attributes"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all extended models
+      tags:
+        - Custom Attributes
+  /extended_attributes/{extended_attribute_id}:
+    get:
+      description: Get an extended attribute detail
+      operationId: get-extended-attribute
+      parameters:
+        - description: UID of extended attribute
+          in: path
+          name: extended_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Extended-attributes-show"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Extended-attributes-show"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Get an extended model detail
+      tags:
+        - Custom Attributes
+  /extended_attributes/{extended_attribute_id}/custom-attributes:
+    get:
+      description: Get a list of custom attributes for an extended model
+      operationId: list-custom-attributes
+      parameters:
+        - description: UID of extended attribute
+          in: path
+          name: extended_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Custom-attribute-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all custom attributes for a particular extended model
+      tags:
+        - Custom Attributes
+    post:
+      description: Create a new custom attribute for the extended model
+      operationId: create-custom-attribute
+      parameters:
+        - description: UID of extended attribute
+          in: path
+          name: extended_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Custom-attribute-create"
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Custom-attribute-element"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Create a new custom attribute
+      tags:
+        - Custom Attributes
+  /extended_attributes/{extended_attribute_id}/custom-attributes/{custom_attribute_id}:
+    delete:
+      description: Delete a custom attribute from this extended model
+      operationId: delete-custom-attribute
+      parameters:
+        - description: UID of the extended attribute
+          in: path
+          name: extended_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the custom attribute
+          in: path
+          name: custom_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a custom attribute
+      tags:
+        - Custom Attributes
+    get:
+      description: Get a custom attribute for a particular extended model
+      operationId: get-custom-attribute
+      parameters:
+        - description: UID of the extended attribute
+          in: path
+          name: extended_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the custom attribute
+          in: path
+          name: custom_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Custom-attribute-element"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Custom-attribute-element"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get a custom attribute
+      tags:
+        - Custom Attributes
+    put:
+      description: Update a custom attribute for a particular extended model
+      operationId: update-custom-attribute
+      parameters:
+        - description: UID of the extended attribute
+          in: path
+          name: extended_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the custom attribute
+          in: path
+          name: custom_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Custom-attribute-basic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Custom-attribute-element"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request or Not found
+      security:
+        - AdminAPIToken: []
+      summary: Update a custom attribute
+      tags:
+        - Custom Attributes
+  /extended_attributes/{extended_attribute_id}/default-attributes:
+    get:
+      description: Get attributes added to this extended model by default
+      operationId: list-default-attributes
+      parameters:
+        - description: UID of extended attribute
+          in: path
+          name: extended_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Default-attribute-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all default attributes for a particular extended model
+      tags:
+        - Custom Attributes
+  /extended_attributes/{extended_attribute_id}/default-attributes/{default_attribute_id}:
+    get:
+      description: Get a default attribute for a particular extended model
+      operationId: get-default-attribute
+      parameters:
+        - description: UID of the extended attribute
+          in: path
+          name: extended_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the default attribute
+          in: path
+          name: default_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Default-attribute-element"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Default-attribute-element"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get a default attribute
+      tags:
+        - Custom Attributes
+    put:
+      description: >-
+        Update a default attribute for a particular extended model to include it
+        in the credential metadata
+      operationId: update-default-attribute
+      parameters:
+        - description: UID of the extended attribute
+          in: path
+          name: extended_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of the default attribute
+          in: path
+          name: default_attribute_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Default-attribute-basic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Default-attribute-element"
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request or Not found
+      security:
+        - AdminAPIToken: []
+      summary: Update default attribute
+      tags:
+        - Custom Attributes
+  /oauth-providers:
+    get:
+      description: List all OAuth2.0 providers
+      operationId: list-oauth-providers
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthProviderIndex"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all OAuth2.0 Identity providers that are registered in the portal
+      tags:
+        - OAuth2.0 providers
+    post:
+      description: Create a new OAuth2.0 provider
+      operationId: create-oauth-provider
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OAuthProviderCreate"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthProviderElem"
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+      security:
+        - AdminAPIToken: []
+      summary: Register a new OAuth2.0 Identity Provider in the portal
+      tags:
+        - OAuth2.0 providers
+  /oauth-providers/{provider_id}:
+    delete:
+      description: >
+        Delete an OAuth2.0 provider. The OAuth2.0 provider and all related
+        client types will be removed. If the provider is used in any API
+        Products, the endpoint will return 400 error.
+
+
+        To force remove the provider, specify `?force=true`. In in this case,the
+        portal will remove the provider, all its clients, de-associate it from
+        any API Products where it is used and reject any access requests with
+        such API Products.
+      operationId: delete-oauth-provider
+      parameters:
+        - description: UID of this OAuth2.0 provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: >-
+            Enforce removal of the provider if it is used in any API Products.
+            If set to `true`, the portal will remove the provider, all its
+            clients, de-associate it from any API Products where it is used and
+            reject any access requests with such API Products. Considered
+            `false`, when not specified.
+          in: query
+          name: force
+          required: false
+          schema:
+            type: boolean
+            example: false
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Identity Provider is used in API Products
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Identity Provider Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete an OAuth2.0 Identity Provider
+      tags:
+        - OAuth2.0 providers
+    get:
+      description: Get an OAuth2.0 provider's data
+      operationId: get-oauth-provider
+      parameters:
+        - description: UID of this OAuth2.0 provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthProviderShow"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Identity Provider Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get an Identity Provider's data
+      tags:
+        - OAuth2.0 providers
+    put:
+      description: >-
+        Update the OAuth2.0 provider configuration such its name, type,
+        well-known endpoint URL, and the initial access token. Any existing
+        credentials with this provider won't be updated, new and pending access
+        requests with this provider will assume the new settings.
+      operationId: update-oauth-provider
+      parameters:
+        - description: UID of this OAuth2.0 provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OAuthProviderCreate"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthProviderShow"
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Identity Provider Not found
+      security:
+        - AdminAPIToken: []
+      summary: Update an OAuth2.0 Identity Provider
+      tags:
+        - OAuth2.0 providers
+  /oauth-providers/{provider_id}/client-types:
+    get:
+      description: List all client types for an OAuth2.0 provider
+      operationId: list-oauth-provider-client-type
+      parameters:
+        - description: UID of this OAuth2.0 provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthClientTypeIndex"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Identity Provider Not found
+      security:
+        - AdminAPIToken: []
+      summary: List all client types for an OAuth2.0 Identity Provider
+      tags:
+        - OAuth2.0 providers
+    post:
+      description: Create a new client type of an OAuth2.0 Identity Provider
+      operationId: create-oauth-provider-client-type
+      parameters:
+        - description: UID of this OAuth2.0 provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OAuthClientTypeBasic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthClientTypeElem"
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Identity Provider Not found
+      security:
+        - AdminAPIToken: []
+      summary: Create a new client type of an OAuth2.0 Identity Provider
+      tags:
+        - OAuth2.0 providers
+  /oauth-providers/{provider_id}/client-types/{client_type_id}:
+    delete:
+      description: >
+        Delete a client type for an OAuth2.0 Identity Provider. If the client
+        type is used in any API Products, the endpoint will return 400 error.
+
+
+        To force remove the client, specify `?force=true`. In in this case,the
+        portal will remove the client type, de-associate it from any API
+        Products where it is used and reject any access requests with such API
+        Products.
+      operationId: delete-oauth-provider-client-type
+      parameters:
+        - description: UID of this OAuth2.0 provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this client type
+          in: path
+          name: client_type_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: >-
+            Enforce removal of the client type if it is used in any API
+            Products. If set to `true`, the portal will remove the client type,
+            de-associate it from any API Products where it is used and reject
+            any access requests with such API Products. Considered `false`, when
+            not specified.
+          in: query
+          name: force
+          required: false
+          schema:
+            type: boolean
+            example: false
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Client type is used in API Products
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Identity Provider or Client Type Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a client type for an OAuth2.0 Identity Provider
+      tags:
+        - OAuth2.0 providers
+    get:
+      description: Get a client type's data
+      operationId: get-oauth-provider-client-type
+      parameters:
+        - description: UID of this OAuth2.0 provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this client type
+          in: path
+          name: client_type_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthClientTypeElem"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Identity Provider or Client Type Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get a client type's data
+      tags:
+        - OAuth2.0 providers
+    put:
+      description: >-
+        Update a client type configuration such as its name, allowed grant
+        types, allowed response types, and so on. Any existing credentials with
+        this client type won't be updated, new and pending access requests with
+        this client type will assume the new settings.
+      operationId: update-oauth-provider-client-type
+      parameters:
+        - description: UID of this OAuth2.0 provider
+          in: path
+          name: provider_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of this client type
+          in: path
+          name: client_type_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OAuthClientTypeBasic"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthClientTypeElem"
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Identity Provider Not found
+      security:
+        - AdminAPIToken: []
+      summary: Update a client type for an Identity Provider
+      tags:
+        - OAuth2.0 providers
+  /webhooks:
+    get:
+      summary: List all webhooks
+      description: Retrieves all configured webhooks.
+      operationId: list-webhooks
+      tags:
+        - Webhooks
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          description: A list of webhooks.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Webhook-index"
+    post:
+      summary: Create a new webhook
+      description: Creates a new webhook configuration.
+      operationId: create-webhook
+      tags:
+        - Webhooks
+      requestBody:
+        description: Webhook object that needs to be added
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Webhook-create"
+      responses:
+        "201":
+          description: Webhook created successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Webhook-show"
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+  /webhooks/{webhook_id}:
+    get:
+      summary: Get a webhook by ID
+      description: Retrieves a webhook using its unique identifier.
+      operationId: get-webhook
+      tags:
+        - Webhooks
+      parameters:
+        - name: webhook_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Webhook retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Webhook-show"
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+    put:
+      summary: Update a webhook by ID
+      description: Updates an existing webhook's configuration using its unique identifier.
+      operationId: update-webhook
+      tags:
+        - Webhooks
+      parameters:
+        - name: webhook_id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: Webhook object that needs to be updated
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Webhook-update"
+      responses:
+        "200":
+          description: Webhook updated successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Webhook-show"
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+    delete:
+      summary: Delete a webhook by ID
+      description: Removes a webhook using its unique identifier.
+      operationId: delete-webhook
+      tags:
+        - Webhooks
+      parameters:
+        - name: webhook_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+  /webhooks/{webhook_id}/headers:
+    get:
+      summary: List all headers for a webhook
+      description: Retrieves all headers for a specific webhook.
+      operationId: list-webhook-headers
+      tags:
+        - Webhooks
+      parameters:
+        - name: webhook_id
+          in: path
+          required: true
+          schema:
+            type: string
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          description: A list of headers for the specified webhook.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/WebhookHeader-index"
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+    post:
+      summary: Add a new header to a webhook
+      description: Adds a new header to an existing webhook.
+      operationId: create-webhook-header
+      tags:
+        - Webhooks
+      parameters:
+        - name: webhook_id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: Header object that needs to be added
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/WebhookHeader-create"
+      responses:
+        "201":
+          description: Header added successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/WebhookHeader-show"
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Validation error
+  /webhooks/{webhook_id}/headers/{header_id}:
+    get:
+      summary: Get a header by ID for a specific webhook
+      description: >-
+        Retrieves the details of a specific header associated with a given webhook. 
+        Useful for inspecting custom headers configured for webhook delivery.
+      operationId: get-webhook-header
+      tags:
+        - Webhooks
+      parameters:
+        - name: webhook_id
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: header_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Header retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/WebhookHeader-show"
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+    put:
+      summary: Update a header by ID for a specific webhook
+      description: Updates an existing header in a webhook.
+      operationId: update-webhook-header
+      tags:
+        - Webhooks
+      parameters:
+        - name: webhook_id
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: header_id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: Header object that needs to be updated
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/WebhookHeader-update"
+      responses:
+        "200":
+          description: Header updated successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/WebhookHeader-update"
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+        "422":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Validation error
+    delete:
+      summary: Delete a header by ID for a specific webhook
+      description: Removes a header from a webhook.
+      operationId: delete-webhook-header
+      tags:
+        - Webhooks
+      parameters:
+        - name: webhook_id
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: header_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Validation error
+  /posts:
+    get:
+      description: List all posts in the portal.
+      operationId: list-posts
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Post-index"
+      security:
+        - AdminAPIToken: []
+      summary: List all posts
+      tags:
+        - Posts
+    post:
+      description: Create a new post.
+      operationId: /posts-POST
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Post-create"
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Post-show"
+      security:
+        - AdminAPIToken: []
+      summary: Create a new post
+      tags:
+        - Posts
+  /posts/{post_id}:
+    get:
+      description: Get a specific post by its ID.
+      operationId: get-post
+      parameters:
+        - name: post_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a post
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Post-show"
+      security:
+        - AdminAPIToken: []
+      summary: Get a post by ID
+      tags:
+        - Posts
+    put:
+      description: Update a post's data such as title, content, status, and more.
+      operationId: update-post
+      parameters:
+        - name: post_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a post
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Post-update"
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Post-show"
+      security:
+        - AdminAPIToken: []
+      summary: Update a post
+      tags:
+        - Posts
+    delete:
+      description: Delete a specific post by its ID.
+      operationId: delete-post
+      parameters:
+        - name: post_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a post
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+        "404":
+          description: Not found
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+      security:
+        - AdminAPIToken: []
+      summary: Delete a post
+      tags:
+        - Posts
+  /posts/{post_id}/categories:
+    get:
+      description: List all categories associated with a specific post.
+      operationId: list-post-categories
+      parameters:
+        - name: post_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a post
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Category-index"
+      security:
+        - AdminAPIToken: []
+      summary: List categories for a post
+      tags:
+        - Posts
+    post:
+      description: Attach a category to a specific post.
+      operationId: create-post-category
+      parameters:
+        - name: post_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a post
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Category-attach"
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Category-show"
+        "422":
+          description: Not found or bad request
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+      security:
+        - AdminAPIToken: []
+      summary: Attach a category to a post
+      tags:
+        - Posts
+  /posts/{post_id}/categories/{category_id}:
+    delete:
+      description: Detach a category from a specific post.
+      operationId: delete-post-category
+      parameters:
+        - name: post_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a post
+        - name: category_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a category
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+        "404":
+          description: Not found
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+      security:
+        - AdminAPIToken: []
+      summary: Detach a category from a post
+      tags:
+        - Posts
+  /posts/{post_id}/tags:
+    get:
+      description: List all tags associated with a specific post.
+      operationId: list-post-tags
+      parameters:
+        - name: post_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a post
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Tag-index"
+      security:
+        - AdminAPIToken: []
+      summary: List tags for a post
+      tags:
+        - Posts
+    post:
+      description: Attach a tag to a specific post.
+      operationId: create-post-tag
+      parameters:
+        - name: post_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a post
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Tag-attach"
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Tag-show"
+        "422":
+          description: Not found or bad request
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+      security:
+        - AdminAPIToken: []
+      summary: Attach a tag to a post
+      tags:
+        - Posts
+  /posts/{post_id}/tags/{tag_id}:
+    delete:
+      description: Detach a tag from a specific post.
+      operationId: delete-post-tag
+      parameters:
+        - name: post_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a post
+        - name: tag_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            example: 1
+          description: UID of a tag
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+        "404":
+          description: Not found
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+      security:
+        - AdminAPIToken: []
+      summary: Detach a tag from a post
+      tags:
+        - Posts
+
+  /apps/{app_id}/custom_credentials:
+    get:
+      summary: List Custom Credentials
+      operationId: list-custom-credentials
+      description: Retrieve a list of custom credentials for a specific application.
+      tags:
+        - Applications and credentials
+      parameters:
+        - name: app_id
+          in: path
+          required: true
+          description: The ID of the application.
+          schema:
+            type: string
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        '200':
+          description: A list of custom credentials
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomCredential-index'
+      security:
+        - AdminAPIToken: []
+
+    post:
+      summary: Create a Custom Credential
+      description: Create a new custom credential for a specific application.
+      tags:
+        - Applications and credentials
+      parameters:
+        - name: app_id
+          in: path
+          required: true
+          description: The ID of the application.
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CustomCredential-create'
+      responses:
+        '201':
+          description: Custom credential created successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomCredential-show'
+        "422":
+          description: Validator error
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+
+      security:
+        - AdminAPIToken: []
+
+  /apps/{app_id}/custom_credentials/{credential_id}:
+    get:
+      summary: Get a Custom Credential
+      description: Retrieve a specific custom credential by its ID.
+      tags:
+        - Applications and credentials
+      parameters:
+        - name: app_id
+          in: path
+          required: true
+          description: The ID of the application.
+          schema:
+            type: string
+        - name: credential_id
+          in: path
+          required: true
+          description: The ID of the custom credential.
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Custom credential details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomCredential-show'
+      security:
+        - AdminAPIToken: []
+
+    put:
+      summary: Update a Custom Credential
+      description: Update an existing custom credential for a specific application.
+      tags:
+        - Applications and credentials
+      parameters:
+        - name: app_id
+          in: path
+          required: true
+          description: The ID of the application.
+          schema:
+            type: string
+        - name: credential_id
+          in: path
+          required: true
+          description: The ID of the custom credential.
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CustomCredential-update'
+      responses:
+        '200':
+          description: Custom credential updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomCredential-show'
+        "422":
+          description: Validator error
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+
+      security:
+        - AdminAPIToken: []
+
+    delete:
+      summary: Delete a Custom Credential
+      description: Delete a specific custom credential for a specific application.
+      tags:
+        - Applications and credentials
+      parameters:
+        - name: app_id
+          in: path
+          required: true
+          description: The ID of the application.
+          schema:
+            type: string
+        - name: credential_id
+          in: path
+          required: true
+          description: The ID of the custom credential.
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Custom credential deleted successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/StatusWithMessage'  # Updated to return StatusWithMessage
+      security:
+        - AdminAPIToken: []
+  /sso_profiles:
+    get:
+      description: List all SSO profiles
+      operationId: list-sso-profiles
+      parameters:
+        - $ref: "#/components/parameters/PaginationLimitParam"
+        - $ref: "#/components/parameters/PaginationPerPageParam"
+        - $ref: "#/components/parameters/PaginationPageParam"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/SSOProfile-index"
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: List all SSO profiles
+      tags:
+        - SSO Profiles
+    post:
+      description: Create a new SSO profile
+      operationId: create-sso-profile
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SSOProfile-response"
+        required: true
+      responses:
+        "201":
+          description: Created
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Bad request
+      security:
+        - AdminAPIToken: []
+      summary: Create a new SSO profile
+      tags:
+        - SSO Profiles
+  /sso_profiles/{profile_id}:
+    get:
+      description: Get an SSO profile by ID
+      operationId: get-sso-profile
+      parameters:
+        - description: ID of the SSO profile
+          in: path
+          name: profile_id
+          required: true
+          schema:
+            type: string
+            example: ldap_dev
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SSOProfile-response"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Profile not found
+      security:
+        - AdminAPIToken: []
+      summary: Get an SSO profile
+      tags:
+        - SSO Profiles
+    put:
+      description: Update an existing SSO profile
+      operationId: update-sso-profile
+      parameters:
+        - description: ID of the SSO profile
+          in: path
+          name: profile_id
+          required: true
+          schema:
+            type: string
+            example: ldap_dev
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SSOProfile-response"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SSOProfile-response"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Profile not found
+      security:
+        - AdminAPIToken: []
+      summary: Update an SSO profile
+      tags:
+        - SSO Profiles
+    delete:
+      description: Delete an SSO profile
+      operationId: delete-sso-profile
+      parameters:
+        - description: ID of the SSO profile
+          in: path
+          name: profile_id
+          required: true
+          schema:
+            type: string
+            example: ldap_dev
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Profile not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete an SSO profile
+      tags:
+        - SSO Profiles
+  /products/{product_id}/spec-details/{spec-id}:
+    get:
+      description: Get description of a Specification
+      operationId: get-spec-details
+      parameters:
+        - description: ID of the Specification
+          in: path
+          name: spec-id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SpecDetail-index-elem"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Get description of a Specification
+      tags:
+        - API documentation for API Products
+    put:
+      description: Update description of a Specification including name, OAS URL and alias
+      operationId: update-spec-details
+      parameters:
+        - description: ID of the Specification
+          in: path
+          name: spec-id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                SpecAlias:
+                  type: string
+                  example: "payment_api"
+                OASUrl:
+                  type: string
+                  format: uri
+                  example: "https://petstore.swagger.io/v2/swagger.json"
+                Name:
+                  type: string
+                  example: "Payment API Documentation"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SpecDetail-index-elem"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Update description of a Specification
+      tags:
+        - API documentation for API Products
+    delete:
+      description: Delete a specification from this Documentation Product
+      operationId: delete-spec-details
+      parameters:
+        - description: ID of the Specification
+          in: path
+          name: spec-id
+          required: true
+          schema:
+            type: integer
+            example: 1
+        - description: UID of an API Product
+          in: path
+          name: product_id
+          required: true
+          schema:
+            type: integer
+            example: 1
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+          description: OK
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OnlyErrors"
+          description: Not found
+      security:
+        - AdminAPIToken: []
+      summary: Delete a specification
+      tags:
+        - API documentation for API Products
+  /products/{product_id}/spec-details/{spec-id}/oas:
+    get:
+      description: Download an OAS spec as a file for a specific Specification in a Documentation Product
+      operationId: get-spec-oas
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: spec-id
+          in: path
+          schema:
+            type: integer
+            example: 1
+          required: true
+          description: ID of the Specification
+      responses:
+        "200":
+          content:
+            application/x-yaml:
+              schema:
+                type: string
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                type: string
+                example: no oas specified
+          description: Not found or Bad Request
+      security:
+        - AdminAPIToken: []
+      summary: Download OAS file of a Specification
+      tags:
+        - API documentation for API Products
+    post:
+      description: Upload an OAS file for a Specification inside a Documentation Product
+      operationId: upload-spec-oas
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: spec-id
+          in: path
+          schema:
+            type: integer
+            example: 1
+          required: true
+          description: ID of the Specification
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+                  description: oas spec file
+      responses:
+        "200":
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Upload OAS file of a Specification
+      tags:
+        - API documentation for API Products
+    delete:
+      description: Remove OAS file from a Specification
+      operationId: delete-spec-oas
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: spec-id
+          in: path
+          schema:
+            type: integer
+            example: 1
+          required: true
+          description: ID of the Specification
+      responses:
+        "200":
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Delete OAS file of a Specification
+      tags:
+        - API documentation for API Products
+  /products/{product_id}/api-details/{api_id}/graphql/schema:
+    get:
+      description: Download a GraphQL schema file for a specific API in a Product
+      operationId: get-graphql-schema
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: api_id
+          in: path
+          schema:
+            type: string
+            example: a0ce49d559ce49d64fe608ea3728082a
+          required: true
+          description: UID of an API as it comes from the API Provider
+      responses:
+        "200":
+          content:
+            application/graphql:
+              schema:
+                type: string
+            application/json:
+              schema:
+                type: string
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                type: string
+                example: no graphql schema specified
+          description: Not found or Bad Request
+      security:
+        - AdminAPIToken: []
+      summary: Download GraphQL schema file of an API
+      tags:
+        - API documentation for API Products
+    post:
+      description: Upload a GraphQL schema file for an API inside an API Product
+      operationId: upload-graphql-schema
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: api_id
+          in: path
+          schema:
+            type: string
+            example: a0ce49d559ce49d64fe608ea3728082a
+          required: true
+          description: UID of an API as it comes from the API Provider
+        - name: dry_run
+          in: query
+          schema:
+            type: boolean
+            default: false
+          required: false
+          description: If true, only validates the file without saving it
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+                  description: GraphQL schema file (.graphql, .gql, or .json) - only 1 file at a time
+      responses:
+        "200":
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                type: string
+                example: invalid file format, multiple files uploaded, or validation failed
+          description: Bad Request - Invalid file format, multiple files uploaded, or validation failed
+      security:
+        - AdminAPIToken: []
+      summary: Upload GraphQL schema file of an API
+      tags:
+        - API documentation for API Products
+    delete:
+      description: Remove GraphQL schema file from an API
+      operationId: delete-graphql-schema
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: api_id
+          in: path
+          schema:
+            type: string
+            example: a0ce49d559ce49d64fe608ea3728082a
+          required: true
+          description: UID of an API as it comes from the API Provider
+      responses:
+        "200":
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Delete GraphQL schema file of an API
+      tags:
+        - API documentation for API Products
+  /products/{product_id}/spec-details/{spec-id}/graphql/schema:
+    get:
+      description: Download a GraphQL schema file for a specific Specification in a Documentation Product
+      operationId: get-spec-graphql-schema
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: spec-id
+          in: path
+          schema:
+            type: integer
+            example: 1
+          required: true
+          description: ID of the Specification
+      responses:
+        "200":
+          content:
+            application/graphql:
+              schema:
+                type: string
+            application/json:
+              schema:
+                type: string
+          description: OK
+        "422":
+          content:
+            application/json:
+              schema:
+                type: string
+                example: no graphql schema specified
+          description: Not found or Bad Request
+      security:
+        - AdminAPIToken: []
+      summary: Download GraphQL schema file of a Specification
+      tags:
+        - API documentation for API Products
+    put:
+      description: Upload a GraphQL schema file for a Specification inside a Documentation Product
+      operationId: upload-spec-graphql-schema
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: spec-id
+          in: path
+          schema:
+            type: integer
+            example: 1
+          required: true
+          description: ID of the Specification
+        - name: dry_run
+          in: query
+          schema:
+            type: boolean
+            default: false
+          required: false
+          description: If true, only validates the file without saving it
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+                  description: GraphQL schema file (.graphql, .gql, or .json) - only 1 file at a time
+      responses:
+        "200":
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                type: string
+                example: invalid file format, multiple files uploaded, or validation failed
+          description: Bad Request - Invalid file format, multiple files uploaded, or validation failed
+      security:
+        - AdminAPIToken: []
+      summary: Upload GraphQL schema file of a Specification
+      tags:
+        - API documentation for API Products
+    delete:
+      description: Delete a Specification that contains a GraphQL schema. This removes the entire SpecDetails object.
+      operationId: delete-spec-graphql-schema
+      parameters:
+        - name: product_id
+          in: path
+          schema:
+            type: integer
+          required: true
+          description: UID of an API Product
+        - name: spec-id
+          in: path
+          schema:
+            type: integer
+            example: 1
+          required: true
+          description: ID of the Specification
+      responses:
+        "200":
+          description: OK
+      security:
+        - AdminAPIToken: []
+      summary: Delete Specification with GraphQL schema
+      tags:
+        - API documentation for API Products
+  /products/{product_id}/spec-details/graphql/schema:
+    post:
+      summary: "Upload GraphQL SDL for Documentation Product"
+      description: >
+        Upload and link a GraphQL SDL file to a documentation-only product. The uploaded file must be a valid GraphQL schema (with extension `.graphql`, `.gql`, or `.json`) and is stored as the latest schema for the product.
+        Only works for documentation-only products.
+      operationId: upload-product-graphql-schema
+      parameters:
+        - name: product_id
+          in: path
+          required: true
+          schema:
+            type: integer
+          description: UID of a documentation-only product
+        - name: dry_run
+          in: query
+          schema:
+            type: boolean
+            default: false
+          required: false
+          description: If true, only validates the file without saving it
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+                  description: GraphQL SDL file to upload (.graphql, .gql, or .json) - only 1 file at a time
+      responses:
+        '200':
+          description: GraphQL schema uploaded and spec created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SpecDetail-create'
+        '400':
+          description: Invalid file, multiple files uploaded, or non-documentation product
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OnlyErrors'
+        '404':
+          description: Product not found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OnlyErrors'
+        '413':
+          description: Uploaded file too large
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OnlyErrors'
+        '422':
+          description: Invalid GraphQL SDL (syntax/semantics)
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OnlyErrors'
+      tags:
+        - API documentation for API Products
+components:
+  parameters:
+    PaginationLimitParam:
+      name: limit
+      in: query
+      required: false
+      description: Maximum number of records to return for this request. Overrides the row count only, not the page offset (which is always based on per_page), so use per_page for pagination rather than combining limit with page. Defaults to the per_page value.
+      schema:
+        type: integer
+    PaginationPerPageParam:
+      name: per_page
+      in: query
+      required: false
+      description: Items per page. Defaults to the resource-specific page count if configured, otherwise 20
+      schema:
+        type: integer
+        default: 20
+    PaginationPageParam:
+      name: page
+      in: query
+      required: false
+      description: Page number. Defaults to 1 when omitted
+      schema:
+        type: integer
+        default: 1
+  schemas:
+    Product-APIDetail-index:
+      properties:
+        APIID:
+          type: string
+          description: API ID from the Tyk Gateway
+          example: a0ce49d559ce49d64fe608ea3728082a
+        Name:
+          type: string
+          description: Name of an API as it is defined in the gateway
+          example: Payment API
+        Status:
+          type: boolean
+          description: >-
+            Status of this API: `true` means the API is up and `false`
+            identifies that it is down
+          example: true
+      type: object
+    Product-APIDetail-edit:
+      properties:
+        Description:
+          type: string
+          description: Human-readable description of an API added by the portal admins
+          example: This API provides payment endpoints
+        OASUrl:
+          type: string
+          description: >-
+            URL of OpenAPI Specification for this API. The document must be a
+            valid OAS document
+          example: https://petstore.swagger.io/v2/swagger.json
+      type: object
+    Product-APIDetail:
+      properties:
+        APIID:
+          type: string
+          description: API ID from the Tyk Gateway
+          example: a0ce49d559ce49d64fe608ea3728082a
+        APIType:
+          type: string
+          description: Authentication type of an API
+          example: authToken
+        Description:
+          type: string
+          description: Human-readable description of an API added by the portal admins
+          example: This API provides payment endpoints
+        ListenPath:
+          type: string
+          description: Listen path which is defined for this API in the gateway
+          example: /payments/
+        Name:
+          type: string
+          description: Name of an API as it is defined in the gateway
+          example: Payment API
+        OASUrl:
+          type: string
+          description: >-
+            URL of OpenAPI Specification for this API. The document must be a
+            valid OAS document
+          example: https://petstore.swagger.io/v2/swagger.json
+        Status:
+          type: boolean
+          description: >-
+            Status of this API: `true` means the API is up and `false`
+            identifies that it is down
+          example: true
+        TargetURL:
+          type: string
+          description: Upstream URL of this API
+          example: http://httpbin.org/
+      type: object
+    APIDetail:
+      properties:
+        APIType:
+          type: string
+          description: Authentication type of an API
+          example: authToken
+        Description:
+          type: string
+          description: Human-readable description of an API added by the portal admins
+          example: This API provides payment endpoints
+        ListenPath:
+          type: string
+          description: Listen path which is defined for this API in the gateway
+          example: /payments/
+        Name:
+          type: string
+          description: Name of an API as it is defined in the gateway
+          example: Payment API
+        OASUrl:
+          type: string
+          description: >-
+            URL of OpenAPI Specification for this API. The document must be a
+            valid OAS document
+          example: https://petstore.swagger.io/v2/swagger.json
+        Status:
+          type: boolean
+          description: >-
+            Status of this API: `true` means the API is up and `false`
+            identifies that it is down
+          example: true
+        TargetURL:
+          type: string
+          description: Upstream URL of this API
+          example: http://httpbin.org/
+      type: object
+    APIDetail-create:
+      properties:
+        APIID:
+          type: string
+          description: API ID from the Tyk Gateway
+          example: a0ce49d559ce49d64fe608ea3728082a
+        APIType:
+          type: string
+          description: Authentication type of an API
+          example: authToken
+        Description:
+          type: string
+          description: Human-readable description of an API added by the portal admins
+          example: This API provides payment endpoints
+        ListenPath:
+          type: string
+          description: Listen path which is defined for this API in the gateway
+          example: /payments/
+        Name:
+          type: string
+          description: Name of an API as it is defined in the gateway
+          example: Payment API
+        OASUrl:
+          type: string
+          description: >-
+            URL of OpenAPI Specification for this API. The document must be a
+            valid OAS document
+          example: https://petstore.swagger.io/v2/swagger.json
+        Status:
+          type: boolean
+          description: >-
+            Status of this API: `true` means the API is up and `false`
+            identifies that it is down
+          example: true
+        TargetURL:
+          type: string
+          description: Upstream URL of this API
+          example: http://httpbin.org/
+      type: object
+    APIDetail-index:
+      items:
+        $ref: "#/components/schemas/APIDetail-index-elem"
+      type: array
+    APIDetail-index-elem:
+      properties:
+        APIID:
+          type: string
+          description: API ID from the Tyk Gateway
+          example: a0ce49d559ce49d64fe608ea3728082a
+        APIType:
+          type: string
+          description: Authentication type of an API
+          example: authToken
+        ListenPath:
+          type: string
+          description: Listen path which is defined for this API in the gateway
+          example: /payments/
+        Name:
+          type: string
+          description: Name of an API as it is defined in the gateway
+          example: Payment API
+        OASUrl:
+          type: string
+          description: >-
+            URL of OpenAPI Specification for this API. The document must be a
+            valid OAS document
+          example: https://petstore.swagger.io/v2/swagger.json
+        Status:
+          type: boolean
+          description: >-
+            Status of this API: `true` means the API is up and `false`
+            identifies that it is down
+          example: true
+        TargetURL:
+          type: string
+          description: Upstream URL of this API
+          example: http://httpbin.org/
+      type: object
+    APIDetail-show:
+      properties:
+        APIID:
+          type: string
+          description: API ID from the Tyk Gateway
+          example: a0ce49d559ce49d64fe608ea3728082a
+        APIType:
+          type: string
+          description: Authentication type of an API
+          example: authToken
+        Description:
+          type: string
+          description: Human-readable description of an API added by the portal admins
+          example: This API provides payment endpoints
+        ListenPath:
+          type: string
+          description: Listen path which is defined for this API in the gateway
+          example: /payments/
+        Name:
+          type: string
+          description: Name of an API as it is defined in the gateway
+          example: Payment API
+        OASUrl:
+          type: string
+          description: >-
+            URL of OpenAPI Specification for this API. The document must be a
+            valid OAS document
+          example: https://petstore.swagger.io/v2/swagger.json
+        Status:
+          type: boolean
+          description: >-
+            Status of this API: `true` means the API is up and `false`
+            identifies that it is down
+          example: true
+        TargetURL:
+          type: string
+          description: Upstream URL of this API
+          example: http://httpbin.org/
+      type: object
+    APIDetail-update:
+      properties:
+        Description:
+          type: string
+          description: Human-readable description of an API added by the portal admins
+          example: This API provides payment endpoints
+        Name:
+          type: string
+          description: Name of an API as it is defined in the gateway
+          example: Payment API
+        OASUrl:
+          type: string
+          description: >-
+            URL of OpenAPI Specification for this API. The document must be a
+            valid OAS document
+          example: https://petstore.swagger.io/v2/swagger.json
+        Status:
+          type: boolean
+          description: >-
+            Status of this API: `true` means the API is up and `false`
+            identifies that it is down
+          example: true
+      type: object
+    AccessRequest-basic-elem:
+      allOf:
+        - $ref: "#/components/schemas/AccessRequest-basic"
+        - type: object
+          properties:
+            Products:
+              type: string
+              description: Names of products included in this access request
+              example: Payment API
+    AccessRequest-basic-index:
+      items:
+        $ref: "#/components/schemas/AccessRequest-basic-elem"
+      type: array
+    AccessRequest-index-elem:
+      allOf:
+        - $ref: "#/components/schemas/AccessRequest-basic"
+        - type: object
+          properties:
+            Products:
+              type: string
+              description: Names of products included in this access request
+              example: Payment API
+            Credentials:
+              items:
+                $ref: "#/components/schemas/Credential"
+              type: array
+      type: object
+    AccessRequest-internal:
+      properties:
+        Catalogue:
+          type: string
+          description: Catalogue of API Products included in this access request
+          example: Public Catalogue
+        Client:
+          type: string
+          description: Name of the developer app
+          example: Payment application
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this access request was created
+          example: 2023-06-25 13:37
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this access request was updated the last time
+          example: 2023-06-25 13:37
+        DeletedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this access request was removed
+          example: 2023-06-25 13:37
+        Plan:
+          type: string
+          description: Name of a plan included in this access request
+          example: Free plan
+        User:
+          type: string
+          description: Descriptor of a user to whom this access request belongs
+          example: User#1
+      type: object
+    AccessRequest-show:
+      allOf:
+        - $ref: "#/components/schemas/AccessRequest-internal"
+        - type: object
+          properties:
+            Products:
+              type: string
+              description: Names of products included in this access request
+              example: Payment API
+            Credentials:
+              items:
+                $ref: "#/components/schemas/Credential"
+              type: array
+    AccessRequest-basic:
+      allOf:
+        - $ref: "#/components/schemas/AccessRequest-internal"
+        - type: object
+          properties:
+            AuthType:
+              type: string
+              description: >-
+                Authentication type of APIs that are included in this API
+                Product
+              example: authToken
+            DCREnabled:
+              type: boolean
+              description: >-
+                Identifies if this access request was created using Dynamic
+                client registration
+              example: false
+            ID:
+              type: integer
+              description: UID of access request
+              example: 1
+            ProvisionImmediately:
+              type: boolean
+              description: Identifies if this access request was approved automatically
+              example: true
+            Status:
+              enum:
+                - approved
+                - rejected
+                - pending
+              description: Approval status of this access request
+    AccessRequest-index:
+      type: array
+      items:
+        $ref: "#/components/schemas/AccessRequest-index-elem"
+    Client-AccessRequest-index:
+      type: array
+      items:
+        $ref: "#/components/schemas/Client-AccessRequest-elem"
+    Client-AccessRequest-elem:
+      allOf:
+        - $ref: "#/components/schemas/AccessRequest-basic"
+        - type: object
+          properties:
+            Products:
+              type: array
+              items:
+                type: string
+                description: Name of a product that is included in this access request
+                example: Payment API
+              description: Names of products that are included in this access request
+            Credentials:
+              items:
+                $ref: "#/components/schemas/Credential"
+              type: array
+              description: Credentials that are issued with access request
+      type: object
+    Base:
+      properties:
+        Crop:
+          type: boolean
+        CropOptions:
+          type: object
+        Delete:
+          type: boolean
+        FileHeader: {}
+        FileName:
+          type: string
+        Options:
+          type: object
+        Reader: {}
+        Url:
+          type: string
+      type: object
+    Basic:
+      properties:
+        ConfirmedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+        EncryptedPassword:
+          type: string
+        Provider:
+          type: string
+        UID:
+          type: string
+        UserID:
+          type: string
+      type: object
+    BlogSetting:
+      properties:
+        AllowFormSubmission:
+          type: boolean
+        Enable:
+          type: boolean
+      type: object
+    Catalogue-create:
+      properties:
+        Name:
+          type: string
+          description: Name of this catalogue
+          example: Private catalogue
+        NameWithSlug:
+          type: string
+          description: URL slug of this catalogue page
+          example: private-catalogue
+        Plans:
+          items:
+            type: integer
+            description: UID of a plan which should be included into this catalogue
+            example: 1
+          type: array
+          description: Array of plans' UIDs which should be included into this catalogue
+        Products:
+          items:
+            type: integer
+            description: UID of a product which should be included into this catalogue
+            example: 1
+          type: array
+          description: Array of products' UIDs which should be included into this catalogue
+        VisibilityStatus:
+          enum:
+            - Private
+            - Public
+          description: >-
+            Visibility of this catalogue. Could be either Private or Public. The
+            `Private` status means this catalogue is visible only to a limited
+            audience while `Public` catalogue is available to all developers
+          example: Private
+        OrgCatalogues:
+          items:
+            $ref: "#/components/schemas/OrganisationCatalogue-create"
+          type: array
+      type: object
+    Catalogue-index:
+      items:
+        $ref: "#/components/schemas/Catalogue-index-elem"
+      type: array
+    Catalogue-index-elem:
+      properties:
+        ID:
+          type: integer
+          description: UID of this catalogue
+          example: 1
+        Name:
+          type: string
+          description: Name of this catalogue
+          example: Private Catalogue
+        NameWithSlug:
+          type: string
+          description: URL slug of this catalogue page
+          example: private-catalogue
+        VisibilityStatus:
+          enum:
+            - Private
+            - Public
+          description: >-
+            Visibility of this catalogue. Could be either Private or Public. The
+            `Private` status means this catalogue is visible only to a limited
+            audience while `Public` catalogue is available to all developers
+          example: Private
+      type: object
+    Catalogue-show:
+      properties:
+        ID:
+          type: integer
+          description: UID of a catalogue
+          example: 1
+        Name:
+          type: string
+          description: Name this catalogue
+          example: Private Catalogue
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this catalogue was created
+          example: 2023-06-25 13:37
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this catalogue was updated the last time
+          example: 2023-06-25 13:37
+        OrgCatalogues:
+          items:
+            $ref: "#/components/schemas/OrganisationCatalogue"
+          type: array
+        Plans:
+          items:
+            type: string
+            description: Name of a plan
+            example: Free plan
+          type: array
+          description: Plans that are included into this catalogue
+        Products:
+          items:
+            type: string
+            description: Name of a product
+            example: ACME Payment API
+          type: array
+          description: Products that are included into this catalogue
+        VisibilityStatus:
+          enum:
+            - Private
+            - Public
+          description: >-
+            Visibility of this catalogue. Could be either Private or Public. The
+            `Private` status means this catalogue is visible only to a limited
+            audience while `Public` catalogue is available to all developers
+          example: Private
+      type: object
+    Catalogue-update:
+      properties:
+        Name:
+          type: string
+          description: Name of this catalogue
+          example: Private catalogue
+        NameWithSlug:
+          type: string
+          description: URL slug of this catalogue page
+          example: private-catalogue
+        Plans:
+          items:
+            type: integer
+            description: UID of a plan which should be included into this catalogue
+            example: 1
+          type: array
+          description: >-
+            Array of plans' UIDs which should be included into this catalogue.
+            To remove all plans from a catalogue use `null` value for this
+            property
+        Products:
+          items:
+            type: integer
+            description: UID of a product which should be included into this catalogue
+            example: 1
+          type: array
+          description: >-
+            Array of products' UIDs which should be included into this
+            catalogue. To remove all product from a catalogue use `null` value
+            for this property
+        VisibilityStatus:
+          enum:
+            - Private
+            - Public
+          description: >-
+            Visibility of this catalogue. Could be either Private or Public. The
+            `Private` status means this catalogue is visible only to a limited
+            audience while `Public` catalogue is available to all developers
+          example: Private
+      type: object
+    Certificate:
+      properties:
+        CertFile:
+          type: string
+          example: portal.crt
+        KeyFile:
+          type: string
+          example: portal.key
+        Name:
+          type: string
+          example: localhost
+      type: object
+    Client-basic:
+      properties:
+        Name:
+          type: string
+          description: Name of this application
+          example: Payment App
+        Description:
+          type: string
+          description: Human-readable description of this application
+          example: This is my payment application
+        RedirectURLs:
+          type: string
+          description: Redirect URL for OAuth2.0 authorization_code and PKCE grant types
+          example: https://app-host/auth
+        UserID:
+          type: integer
+          description: UID of a user to whom this application will belong
+          example: 1
+        Visibility:
+          type: string
+          description: >-
+            Controls who can access this application. Options are:
+            `personal` (visible only to you), `team` (shared with your team),
+            and `organisation` (accessible to all members of your organisation).
+          enum:
+            - personal
+            - team
+            - organisation
+          example: personal
+          default: organisation
+      type: object
+    Client-ID-attributes:
+      properties:
+        ID:
+          type: integer
+          description: UID of this app
+          example: 1
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this application was created
+          example: 2023-06-25 13:37
+      type: object
+    Client-index:
+      items:
+        $ref: "#/components/schemas/Client-index-elem"
+      type: array
+    Client-index-elem:
+      allOf:
+        - $ref: "#/components/schemas/Client-basic"
+        - $ref: "#/components/schemas/Client-ID-attributes"
+    Client-show:
+      allOf:
+        - $ref: "#/components/schemas/Client-basic"
+        - $ref: "#/components/schemas/Client-ID-attributes"
+        - type: object
+          properties:
+            AccessRequests:
+              items:
+                $ref: "#/components/schemas/Client-AccessRequest-index"
+              type: array
+    Theme-upload:
+      type: object
+      properties:
+        file:
+          type: string
+          format: binary
+          description: zip archive containing theme
+    Theme-upload-response:
+      type: string
+      description: Upload status
+      example: File uploaded successfully
+    Theme-index:
+      items:
+        $ref: "#/components/schemas/Theme-basic"
+      type: array
+    Theme-basic:
+      properties:
+        Author:
+          type: string
+          description: "`author` field from the `theme.json` file of the theme"
+          example: Tyk Technologies Ltd. <hello@tyk.io>
+        ID:
+          type: string
+          description: UID of the theme
+          example: default
+        Name:
+          type: string
+          description: "`name` field from the `theme.json` file of the theme"
+          example: Tyk Technologies Ltd. <hello@tyk.io>
+        Path:
+          type: string
+          description: Path to the theme folder
+          example: /opt/portal/themes/default
+        Status:
+          type: string
+          enum:
+            - Current
+            - Not in use
+          description: The current status of the theme
+        Version:
+          type: string
+          description: "`version` field from the `theme.json` file of the theme"
+          example: 0.0.1
+      type: object
+    ContentBlock-basic:
+      properties:
+        Content:
+          type: string
+          description: Content of this content block
+          example: "<p>Everything would be better connected, but the internet is messy, imperfect and unpredictable.</p>\n\t\t\t\t<p>Our engineers are dedicated to making it simple, fast and affordable to connect every system in the world.</p>\n\t\t\t\t<p>We ensure you can trust our systems to look after yours.</p>"
+        Name:
+          type: string
+          description: >-
+            Name of the content block. In order to succeesfully render this
+            page, `name` should with a reference in the template for this page.
+            For instance, HeaderDescription will be rendered in {{safe
+            .blocks.HeaderDescription.Content}} section of the template
+          example: HeaderDescription
+      type: object
+    ContentBlock-create:
+      properties:
+        Content:
+          type: string
+          description: Content of this content block
+          example: "<p>Everything would be better connected, but the internet is messy, imperfect and unpredictable.</p>\n\t\t\t\t<p>Our engineers are dedicated to making it simple, fast and affordable to connect every system in the world.</p>\n\t\t\t\t<p>We ensure you can trust our systems to look after yours.</p>"
+        Name:
+          type: string
+          description: >-
+            Name of the content block. In order to succeesfully render this
+            page, `name` should with a reference in the template for this page.
+            For instance, HeaderDescription will be rendered in {{safe
+            .blocks.HeaderDescription.Content}} section of the template
+          example: HeaderDescription
+      type: object
+    ContentBlock-index:
+      items:
+        $ref: "#/components/schemas/ContentBlock-index-elem"
+      type: array
+    ContentBlock-index-elem:
+      allOf:
+        - $ref: "#/components/schemas/ContentBlock-basic"
+        - type: object
+          properties:
+            ID:
+              description: UID of the content block
+              type: integer
+              example: 1
+            PageID:
+              type: integer
+              description: UID of a page where the content block belong
+              example: 1
+    ContentBlock-show:
+      properties:
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this catalogue was created
+          example: 2023-06-25 13:37
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this catalogue was updated the last time
+          example: 2023-06-25 13:37
+        ID:
+          description: UID of the content block
+          type: integer
+          example: 1
+      type: object
+    Credential:
+      properties:
+        AccessRequest:
+          type: string
+          description: Access request description
+          example: AccessRequest#2
+        Credential:
+          type: string
+          description: >-
+            Auth token from the Tyk API Gateway. For OAuth2.0 credentials it's
+            an empty string
+          example: >-
+            eyJvcmciOiI1ZTlkOTU0NGExZGNkNjAwMDFkMGVkMjAiLCJpZCI6IjY4MjZjZGViMmVlMzQ3ZGQ5ZjQ1ZWZmMjEyMTlhOWU1IiwiaCI6Im11cm11cjY0In0=
+        CredentialHash:
+          type: string
+          description: >-
+            Hash of an auth token from the Tyk API Gateway. For OAuth2.0
+            credentials it's an empty string
+          example: e1212449778b7ba4
+        DCRRegistrationAccessToken:
+          type: string
+          description: >-
+            Access token for Dynamic client registration that is associated with
+            credentials. Has non-empty value only for OAuth2.0 credentials
+          example: >-
+            eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmZjIyNmYyZi0yMDA0LTRlOWItOTFmOC1iOGYzOTA2ZDJmYTQifQ.eyJleHAiOjAsImlhdCI6MTY4NzczNzM5MCwianRpIjoiNjc3OTgwYjktZjgwMS00MmQ2LWI4OTItZDdkNDk1MmFhMjU5IiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo5OTk5L3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJodHRwOi8vbG9jYWxob3N0Ojk5OTkvcmVhbG1zL21hc3RlciIsInR5cCI6IlJlZ2lzdHJhdGlvbkFjY2Vzc1Rva2VuIiwicmVnaXN0cmF0aW9uX2F1dGgiOiJhdXRoZW50aWNhdGVkIn0.wyE93vktqlCywgtyJ8HBTjRPG9NvZEDR3zpSMncdwno
+        DCRRegistrationClientURI:
+          type: string
+          description: >-
+            DCR client registration URI that is associated with credentials. Has
+            non-empty value only for OAuth2.0 credentials
+          example: >-
+            http://idp-host/realms/master/clients-registrations/openid-connect/cf4ab76c-c437-4ba2-8e94-1323269b5090
+        DCRResponse:
+          type: string
+          description: >-
+            Cached client registration response from the Identity Provider. Has
+            non-empty value only for OAuth2.0 credentials
+          example: >-
+            {"redirect_uris":["http://app-host/auth"],"token_endpoint_auth_method":"client_secret_basic","grant_types":["implicit","client_credentials"],"response_types":["id_token","id_token
+            token"],"client_id":"cf4ab76c-c437-4ba2-8e94-1323269b5090","client_secret":"iDe9fkFNBDbVS5JOtYNUDIO8w8N6dWzf","client_name":"OAuth2.0
+            client","scope":"address phone offline_access
+            microprofile-jwt","subject_type":"public","request_uris":[],"tls_client_certificate_bound_access_tokens":false,"client_id_issued_at":1687737390,"client_secret_expires_at":0,"registration_client_uri":"http://idp-host/realms/master/clients-registrations/openid-connect/cf4ab76c-c437-4ba2-8e94-1323269b5090","registration_access_token":"eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmZjIyNmYyZi0yMDA0LTRlOWItOTFmOC1iOGYzOTA2ZDJmYTQifQ.eyJleHAiOjAsImlhdCI6MTY4NzczNzM5MCwianRpIjoiNjc3OTgwYjktZjgwMS00MmQ2LWI4OTItZDdkNDk1MmFhMjU5IiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo5OTk5L3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJodHRwOi8vbG9jYWxob3N0Ojk5OTkvcmVhbG1zL21hc3RlciIsInR5cCI6IlJlZ2lzdHJhdGlvbkFjY2Vzc1Rva2VuIiwicmVnaXN0cmF0aW9uX2F1dGgiOiJhdXRoZW50aWNhdGVkIn0.wyE93vktqlCywgtyJ8HBTjRPG9NvZEDR3zpSMncdwno","backchannel_logout_session_required":false,"require_pushed_authorization_requests":false,"frontchannel_logout_session_required":false}
+        Expires:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          example: 1969-12-31 19:00
+          description: Date-time when this credential expires
+        OAuthClientID:
+          type: string
+          description: >-
+            OAuth2.0 client ID. Has non-empty value only for OAuth2.0
+            credentials
+          example: cf4ab76c-c437-4ba2-8e94-1323269b5090
+        OAuthClientSecret:
+          type: string
+          description: >-
+            OAuth2.0 client secret. Has non-empty value only for OAuth2.0
+            credentials
+          example: iDe9fkFNBDbVS5JOtYNUDIO8w8N6dWzf
+        RedirectURI:
+          type: string
+          description: Redirect URI for OAuth2.0 authorization_code and PKCE grant types
+          example: https://app-host/auth
+        ResponseType:
+          type: string
+          description: >-
+            Response types supported by this credential. Has non-empty value
+            only for OAuth2.0 credentials
+          example: id_token token
+        Scope:
+          type: string
+          description: >-
+            OAuth2.0 scope available to this credential. Has non-empty value
+            only for OAuth2.0 credentials
+          example: payment client
+        TokenEndpoints:
+          type: string
+          description: >-
+            OAuth2.0 `token_endpoint_auth_method` that this credential uses. Has
+            non-empty value only for OAuth2.0 credentials
+          example: payment client
+      type: object
+    Credential-index:
+      items:
+        $ref: "#/components/schemas/Credential-index-elem"
+      type: array
+    Credential-index-elem:
+      allOf:
+        - $ref: "#/components/schemas/Credential"
+        - type: object
+          properties:
+            GrantType:
+              type: string
+              description: >-
+                OAuth2.0 Grant types which is associated with this credential.
+                Has non-empty value only for OAuth2.0 credentials
+              example: client_credetials
+            ID:
+              type: integer
+              example: 1
+              description: UID of this credential
+    DatabaseSetting:
+      properties:
+        ConnectionString:
+          type: string
+          example: por....db
+          description: >-
+            Connection string to the portal's database. May hold secure secrets,
+            therefore it's masked
+        Dialect:
+          type: string
+          enum:
+            - "`sqlite3`"
+            - "`mysql`"
+            - "`postgres`"
+          description: Database dialect of the portal's database
+        EnableLogs:
+          type: boolean
+          description: Defines if the portal should write connection logs to the database
+        MaxRetries:
+          type: integer
+          description: Max retries when establishing connection to the database
+          example: 3
+          default: 3
+        RetryDelay:
+          type: integer
+          description: >-
+            Delay between connection retries when establishing connection to the
+            database. Measured in milliseconds
+          example: 5000
+          default: 5000
+      type: object
+    Organisation-create:
+      properties:
+        Name:
+          type: string
+          description: Name of an organisation
+          example: Default Organisation
+      type: object
+    Organisation-index:
+      items:
+        $ref: "#/components/schemas/Organisation-index-elem"
+      type: array
+    Organisation-index-elem:
+      properties:
+        ID:
+          type: integer
+          description: UID of an organisation
+          example: 1
+        Name:
+          type: string
+          description: Name of an organisation
+          example: Default Organisation
+      type: object
+    Organisation-show:
+      properties:
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          description: Date-time when a user is created
+          example: 2023-06-23 21:02
+          type: string
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          description: Date-time when a user is updated the last time
+          example: 2023-06-23 21:02
+          type: string
+        ID:
+          type: integer
+          description: UID of an organisation
+          example: 1
+        Name:
+          type: string
+          description: Name of an organisation
+          example: Default Organisation
+        Teams:
+          items:
+            $ref: "#/components/schemas/Team-index-elem"
+          type: array
+          description: Teams included in this organisation
+        Users:
+          type: array
+          description: >-
+            Users that are included in this organisation. For newly created
+            organisation this field will be an empty array
+          items:
+            $ref: "#/components/schemas/User-index-elem"
+      type: object
+    OrganisationCatalogue:
+      properties:
+        Catalogue:
+          type: string
+          description: Name of a catalogue
+          example: Private catalogue
+        ID:
+          type: integer
+          description: UID of this audience
+          example: 1
+        Name:
+          type: string
+          description: Optional name of this audience
+        Organisation:
+          type: string
+          description: Name of an organisation
+          example: Default organisation
+      type: object
+    OrganisationCatalogue-create:
+      properties:
+        OrganisationID:
+          type: integer
+          description: UID of an organisation
+          example: 1
+        TeamID:
+          type: integer
+          description: UID of a team
+          example: 1
+      type: object
+    OrganisationCatalogue-index:
+      items:
+        $ref: "#/components/schemas/OrganisationCatalogue-index-elem"
+      type: array
+    OrganisationCatalogue-index-elem:
+      properties:
+        ID:
+          type: integer
+          description: UID of this audience
+          example: 1
+        OrganisationID:
+          type: integer
+          description: UID of an organisation
+          example: 1
+        TeamID:
+          type: integer
+          description: UID of an team
+          example: 1
+      type: object
+    OrganisationCatalogue-show:
+      properties:
+        ID:
+          type: integer
+          description: UID of this audience
+          example: 1
+        OrganisationID:
+          type: integer
+          description: UID of this audience
+          example: 1
+        TeamID:
+          type: integer
+          description: UID of this audience
+          example: 1
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          description: Date-time when this audience is created
+          example: 2023-06-23 21:02
+          type: string
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          description: Date-time when this audience is updated the last time
+          example: 2023-06-23 21:02
+          type: string
+      type: object
+    Page-index:
+      items:
+        $ref: "#/components/schemas/Page-index-elem"
+      type: array
+    Page-basic:
+      properties:
+        AllowFormSubmission:
+          type: boolean
+          description: dsf
+          example: false
+        PageTypeID:
+          type: integer
+        Path:
+          type: string
+          description: Path to this page
+          example: /about-us
+        Status:
+          type: string
+          description: Path to this page
+          example: /about-us
+        Template:
+          type: string
+          description: >-
+            Name of templates that is used by this page. Value of this property
+            must match one of template names in `theme.json`
+          example: home
+        Title:
+          type: string
+          description: Title of the page
+          example: About Tyk Portal
+      type: object
+    Page-index-elem:
+      allOf:
+        - $ref: "#/components/schemas/Page-basic"
+        - type: object
+          properties:
+            ID:
+              type: integer
+              description: UID of this page
+              example: 1
+    Page-show:
+      allOf:
+        - $ref: "#/components/schemas/Page-basic"
+        - type: object
+          properties:
+            ID:
+              type: integer
+              description: UID of this page
+              example: 1
+            CreatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this access request was created
+              example: 2023-06-25 13:37
+            UpdatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this access request was updated the last time
+              example: 2023-06-25 13:37
+    Plan-index:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: "#/components/schemas/PlanSummary"
+    Plan:
+      allOf:
+        - $ref: "#/components/schemas/PlanRequest"
+        - type: object
+          properties:
+            ID:
+              type: integer
+              description: Unique identifier of the plan
+              example: 1
+            ReferenceID:
+              type: string
+              description: Reference ID of the plan in the provider system
+              example: "6490fd451ba6a6000108864e"
+    PlanRequest:
+      type: object
+      properties:
+        CID:
+          type: string
+          description: Client ID for the plan
+          example: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+        AutoApproveAccessRequests:
+          type: boolean
+          description: Whether access requests are automatically approved
+          example: true
+        Catalogues:
+          type: array
+          description: List of catalogue IDs this plan belongs to
+          items:
+            type: integer
+          example: [1]
+        DisplayName:
+          type: string
+          description: Display name of the plan
+          example: "Free plan"
+        Description:
+          type: string
+          description: Description of the plan
+          example: "Free plan offers only basic functionality"
+        JWTScope:
+          type: string
+          description: JWT scope for the plan
+          example: "free-plan"
+        KeyExpiresIn:
+          type: integer
+          description: Key expiration time in seconds
+          example: 3600
+        MetaData:
+          type: object
+          description: Additional metadata for the plan
+          example:
+            data1: "1"
+            data2: "2"
+          additionalProperties: true
+        Name:
+          type: string
+          description: Name of the plan
+          example: "free_plan_2"
+        Per:
+          type: number
+          description: Time period for rate limiting in seconds
+          example: 10
+        PlanQuota:
+          type: integer
+          description: Plan quota value
+          example: 2
+        PlanQuotaRenewalRate:
+          type: integer
+          description: Plan quota renewal rate in seconds
+          example: 3600
+        Quota:
+          type: integer
+          description: Quota value
+          example: 0
+        QuotaRenewalRate:
+          type: integer
+          description: Quota renewal rate in seconds
+          example: -1
+        RateLimit:
+          type: number
+          description: Rate limit for the plan
+          example: 5
+        UnlimitedQuota:
+          type: boolean
+          description: Whether the plan has unlimited quota
+          example: true
+        UnlimitedRateLimit:
+          type: boolean
+          description: Whether the plan has unlimited rate limit
+          example: false
+        ProviderID:
+          type: integer
+          description: ID of the provider
+          example: 1
+      required:
+        - Name
+        - ProviderID
+    PlanSummary:
+      type: object
+      properties:
+        ID:
+          type: integer
+          description: Unique identifier of the plan
+          example: 1
+        Name:
+          type: string
+          description: Name of the plan
+          example: "free_plan_2"
+        DisplayName:
+          type: string
+          description: Display name of the plan
+          example: "Free plan"
+        AutoApproveAccessRequests:
+          type: boolean
+          description: Whether access requests are automatically approved
+          example: true
+        RateLimit:
+          type: number
+          description: Rate limit for the plan
+          example: 5
+        Quota:
+          type: integer
+          description: Quota for the plan
+          example: 0
+    Plan-show:
+      properties:
+        AuthType:
+          type: string
+        Catalogues:
+          type: array
+          items:
+            type: string
+            example: Public Catalogue
+            description: Name of a catalogue
+          description: Array of names of catalogues in which this API Product is published
+        AutoApproveAccessRequests:
+          type: boolean
+          description: Defines if access requests with this plan are approved automatically
+          example: true
+        DisplayName:
+          type: string
+          description: Name of this plan that is displayed to API Consumers
+          example: Free plan
+        Name:
+          type: string
+          description: Name of this plan how it comes from the API Provider
+          example: Free plan
+        Description:
+          type: string
+          description: Human-readable description of this plan
+          example: Free plan offers only basic functionality
+        ReferenceID:
+          type: string
+          description: ID of this plan how it comes from the API Provider
+          example: 6490fd451ba6a6000108864e
+        Quota:
+          type: string
+          description: >-
+            Quota of API calls available to customers using this plan as it is
+            defined in the API Provider
+          example: unlimited
+        RateLimit:
+          type: string
+          description: Ratelimit as it is defined in the API Provider
+          example: 1000 calls / 1 minute(s)
+        ID:
+          type: integer
+          description: UID of this plan
+          example: 1
+        JWTScope:
+          type: string
+          description: >-
+            OAuth2.0 scopes that will be assigned to OAuth2.0 clients that use
+            this plan. Should be comma-separated string
+          example: free-plan
+      type: object
+    Post-create:
+      required:
+        - Content
+        - Path
+        - Title
+        - Status
+      properties:
+        Content:
+          type: string
+          description: Full content of the post
+          example: "# Title\r\n## Subtitle\r\nContent goes here"
+        MarkdownEnabled:
+          type: boolean
+          description: Whether Markdown is enabled for this post
+          example: true
+        Status:
+          enum:
+            - published
+            - draft
+            - review
+          description: Status of the post (e.g., draft, published)
+          example: published
+          type: string
+        Title:
+          type: string
+          description: Title of the post
+          example: Get started this API Product
+        Lede:
+          type: string
+          description: Short summary or lead paragraph of the post
+        Path:
+          type: string
+          description: URL path for the post
+        Categories:
+          type: array
+          description: IDs of existing categories to associate with the post
+          items:
+            type: integer
+            example: 1
+        Tags:
+          type: array
+          description: IDs of existing tags to associate with the post
+          items:
+            type: integer
+            example: 1
+        MarkdownContent:
+          type: string
+          description: Content of the post in Markdown format, if Markdown is enabled
+        PreviewContent:
+          type: string
+          description: Preview content of the post
+      type: object
+    Post-index:
+      items:
+        $ref: "#/components/schemas/Post-index-elem"
+      type: array
+    Post-index-elem:
+      properties:
+        ID:
+          type: integer
+          description: Unique identifier for the post
+          example: 1
+        Content:
+          type: string
+          description: >-
+            Content of this tutorial page. If `MarkdownEnabled` is true then
+            content of this tutorial page is treated as Markdown text and as
+            HTML otherwise
+          example: "# Title\r\n## Subtitle\r\nContent goes here"
+        MarkdownEnabled:
+          type: boolean
+          description: Switches content between Markdown and HTML versions
+          example: true
+        Status:
+          enum:
+            - published
+            - draft
+            - review
+          description: Status of the post (e.g., draft, published)
+          example: published
+          type: string
+        Title:
+          type: string
+          description: Title of the post
+          example: Get started this API Product
+        Lede:
+          type: string
+          description: Short summary or lead paragraph of the post
+        Type:
+          type: string
+          description: Type of the post (e.g., article, news)
+        Path:
+          type: string
+          description: URL path for the post
+        Categories:
+          type: array
+          description: List of categories associated with the post
+          items:
+            type: string
+        Tags:
+          type: array
+          description: List of tags associated with the post
+          items:
+            type: string
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this post was created
+          example: 2023-06-25 13:37
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this post was last updated
+          example: 2023-06-25 13:37
+      type: object
+    Post-reorder:
+      type: array
+      items:
+        type: integer
+        example: 1
+        description: UID of a doc page
+    Product-index:
+      items:
+        $ref: "#/components/schemas/Product-index-elem"
+      type: array
+    Product-index-elem:
+      properties:
+        ID:
+          type: integer
+          description: UID of this API Product
+          example: 2
+        CID:
+          type: string
+          description: Client ID for this API Product
+          example: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+        APIDetails:
+          items:
+            $ref: "#/components/schemas/Product-APIDetail-index"
+          type: array
+        AuthType:
+          type: string
+        AuthTypes:
+          type: array
+          items:
+            type: string
+          description: An array of strings specifying the authentication methods supported by the APIs within this Product (e.g., key, oauth2). When subscribing to a plan, a developer can choose one of these methods to generate credentials
+          example: ["key", "oauth2"]
+        DCREnabled:
+          type: boolean
+        DisplayName:
+          type: string
+        Feature:
+          type: boolean
+        IsDocumentationOnly:
+          type: boolean
+          default: false
+          description: Must be false for regular API products
+        Name:
+          type: string
+        Path:
+          type: string
+        Preview:
+          type: string
+          description: An image for the product's card view in the developer portal catalogue. This image is shown on the main API listing page. If not provided, the portal will fall back to using the product's Logo
+          example: /system/products/2/preview/preview.png
+        ReferenceID:
+          type: string
+        Scopes:
+          type: string
+          description: >-
+            OAuth2.0 scopes that will be assigned to OAuth2.0 clients that use
+            this API Product. Should be comma-separated string
+          example: payments,clients
+        SpecDetails:
+          type: array
+          description: Specification details for documentation-only products
+          items:
+            type: object
+          nullable: true
+      type: object
+    Product-show:
+      type: object
+      properties:
+        ID:
+          type: integer
+          description: UID of this API Product
+          example: 2
+        APIDetails:
+          items:
+            $ref: "#/components/schemas/Product-APIDetail"
+          type: array
+          description: APIs included in this API Product
+        AuthType:
+          type: string
+          description: Authentication type of APIs that are included in this API Product
+          example: authToken
+        AuthTypes:
+          type: array
+          items:
+            type: string
+          description: An array of strings specifying the authentication methods supported by the APIs within this Product (e.g., key, oauth2). When subscribing to a plan, a developer can choose one of these methods to generate credentials
+          example: ["key", "oauth2"]
+        Catalogues:
+          type: array
+          description: Catalogues in which this API Product is listed
+          items:
+            type: string
+            description: Catalogue name
+            example: Public Catalogue
+        CID:
+          type: string
+          description: Client ID for this API Product
+          example: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+        Content:
+          type: string
+          description: >-
+            Marketing description of an API Product formated as HTML text
+            fragment
+          example: <p>Description goes here</p>
+        DCREnabled:
+          type: boolean
+          description: >-
+            Defines if Dynamic Client Registration is enabled for this API
+            Product
+          example: true
+        Description:
+          type: string
+          description: >-
+            Short description of this API Product which is displayed in the
+            Catalogue page
+          example: Description goes here
+        DisplayName:
+          type: string
+          description: >-
+            Name of an API Product that is displayed in the API Product Details
+            and Catalogue pages
+          example: ACME Payment API
+        Feature:
+          type: boolean
+          description: >-
+            Defines if this product should be featured on the home page of the
+            portal
+          example: true
+        IsDocumentationOnly:
+          type: boolean
+          default: false
+          description: Must be false for regular API products
+        Logo:
+          type: string
+          description: Path to the logo image for this API Product
+          example: /system/products/2/logo/logo.png
+        Name:
+          type: string
+          description: name of this API Product as it comes from the API Provider
+          example: Payment API
+        Path:
+          type: string
+          description: >-
+            URI fragment that is specific for this product. `Path` is added to
+            the catalogue path to form URI to this product:
+            /portal/catalogue-products/`Path`
+          example: acme-payment-api
+        ReferenceID:
+          type: string
+          description: UID of this API Product in the API Provider
+          example: 6490fd2a1ba6a6000108864d
+        Scopes:
+          type: string
+          description: >-
+            OAuth2.0 scopes that will be assigned to OAuth2.0 clients that use
+            this API Product. Should be comma-separated string
+          example: payments,clients
+        SpecDetails:
+          type: array
+          description: Specification details for documentation-only products
+          items:
+            type: object
+          nullable: true
+        Tags:
+          items:
+            type: string
+            example: payment
+            description: Name of a tag
+          type: array
+          description: Tags assigned to this API Product
+        Templates:
+          items:
+            type: string
+            description: Name of an OAuth2.0 template
+            example: Web application
+          type: array
+          description: OAuth2.0 templates that are assigned to this API Product
+        ProviderID:
+          type: integer
+          description: The foreign key linking the Product to its Provider
+        Preview:
+          type: string
+          description: An image for the product's card view in the developer portal catalogue. This image is shown on the main API listing page. If not provided, the portal will fall back to using the product's Logo
+          example: /system/products/2/preview/preview.png
+    Product-update:
+      properties:
+        APIDetails:
+          items:
+            $ref: "#/components/schemas/Product-APIDetail-edit"
+          type: array
+        AuthType:
+          type: string
+        Catalogues:
+          items:
+            type: integer
+            description: UID of an API Product
+            example: 1
+          type: array
+          description: Catalogues in which this API Product is listed
+        Content:
+          type: string
+          description: >-
+            Marketing description of an API Product formated as HTML text
+            fragment
+          example: <p>Description goes here</p>
+        DCREnabled:
+          type: boolean
+          default: false
+          description: Must be false for regular API products
+        Description:
+          type: string
+          description: >-
+            Short description of this API Product which is displayed in the
+            Catalogue page
+          example: Description goes here
+        DisplayName:
+          type: string
+          description: >-
+            Name of an API Product that is displayed in the API Product Details
+            and Catalogue pages
+          example: ACME Payment API
+        Feature:
+          type: boolean
+          default: false
+          description: Must be false for regular API products
+        Name:
+          type: string
+          description: name of this API Product as it comes from the API Provider
+          example: Payment API
+        Path:
+          type: string
+          description: >-
+            URI fragment that is specific for this product. `Path` is added to
+            the catalogue path to form URI to this product:
+            /portal/catalogue-products/`Path`
+          example: acme-payment-api
+        Scopes:
+          type: string
+          description: >-
+            OAuth2.0 scopes that will be assigned to OAuth2.0 clients that use
+            this API Product. Should be comma-separated string
+          example: payments,clients
+        Tags:
+          items:
+            type: integer
+            example: 1
+            description: Name of a tag
+          type: array
+          description: Tags assigned to this API Product
+        Templates:
+          items:
+            type: integer
+            description: Name of an OAuth2.0 template
+            example: 1
+          type: array
+          description: OAuth2.0 templates that are assigned to this API Product
+      type: object
+    Provider-create:
+      properties:
+        Configuration:
+          $ref: "#/components/schemas/ProviderConfig-create"
+        Name:
+          type: string
+          description: Name of this API Provider
+          example: Tyk Dashboard
+        Type:
+          type: string
+          description: Type of API gateway used by this API Provider e.g. Tyk or AWS
+          example: tyk-pro
+      type: object
+    Provider-index:
+      items:
+        $ref: "#/components/schemas/Provider-index-elem"
+      type: array
+    Provider-index-elem:
+      properties:
+        LastSyncedAt:
+          type: string
+          description: The last time this provider was synchronized with the portal
+          example: 7 minutes 5 seconds ago
+        ID:
+          type: integer
+          description: UUID of this API provider in the portal's database
+          example: 1
+        Name:
+          type: string
+          description: Name of this API Provider
+          example: Tyk Dashboard
+        Status:
+          type: string
+          description: Identifies if this API Provider is Up and ready for synchronization
+          example: Up
+        Type:
+          type: string
+          description: Type of API gateway used by this API Provider e.g. Tyk or AWS
+          example: tyk-pro
+      type: object
+    Provider-show:
+      allOf:
+        - $ref: "#/components/schemas/Provider-index-elem"
+        - type: object
+          properties:
+            Configuration:
+              $ref: "#/components/schemas/ProviderConfig"
+            UpdatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: When this API Provider was updated the last time
+              example: 2023-06-23 19:13
+            CreatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: When this API Provider was created
+              example: 2023-06-23 19:13
+    Provider-update:
+      properties:
+        Configuration:
+          $ref: "#/components/schemas/ProviderConfig"
+        Name:
+          type: string
+      type: object
+    ProviderConfig:
+      properties:
+        MetaData:
+          type: string
+          description: Connection settings for this API Provider
+          example: >-
+            {"URL":"http://localhost:3002","Secret":"04d31017802f482f76414a372db30fc2","OrgID":"5e9d9544a1dcd60001d0ed20","Gateway":"","PoliciesTags":[],"InsecureSkipVerify":false}
+        ID:
+          type: integer
+          description: UID of an API provider's metadata
+          example: 1
+      type: object
+    ProviderConfig-create:
+      properties:
+        MetaData:
+          type: string
+          description: Connection settings for this API Provider
+          example: >-
+            {"URL":"http://localhost:3002","Secret":"04d31017802f482f76414a372db30fc2","OrgID":"5e9d9544a1dcd60001d0ed20","Gateway":"","PoliciesTags":[],"InsecureSkipVerify":false}
+      type: object
+    Status:
+      properties:
+        status:
+          type: string
+          description: Status of the operation
+          example: ok
+      type: object
+    StatusWithMessage:
+      properties:
+        status:
+          type: string
+          description: Status of the operation
+          example: ok
+        message:
+          type: string
+          description: Human-readable description of the status
+          example: "Action Synchronize: Executed successfully"
+      type: object
+    StatusWithErrors:
+      properties:
+        status:
+          type: string
+          description: Status of the operation
+          example: error
+        errors:
+          type: array
+          description: Human-readable description of the errors
+          items:
+            type: string
+            example: >-
+              Failed to sync provider Tyk Dashboard (Edit Me): TykPro.Sync.
+              getting available products: fetching policies: Get
+              "http://localhost:30023/api/portal/policies/?p=-2": dial tcp
+              [::1]:30023: connect: connection refused
+      type: object
+    OnlyErrors:
+      properties:
+        errors:
+          type: array
+          description: Human-readable description of the errors
+          items:
+            type: string
+      type: object
+    TagErrors:
+      properties:
+        errors:
+          type: array
+          description: Human-readable description of the errors
+          items:
+            type: string
+            example: tag with that name already exists
+      type: object
+    SiteSetting:
+      properties:
+        Enable:
+          type: boolean
+          description: Identifies if the live portal is enabled
+          example: true
+      type: object
+    FormsSetting:
+      properties:
+        Enable:
+          type: boolean
+          description: Identifies if the forms are enabled. By default their are disabled
+          example: false
+          default: false
+      type: object
+    S3Setting:
+      properties:
+        ACL:
+          type: string
+          description: ACL rules for the S3 bucket
+        AccessKey:
+          type: string
+        Bucket:
+          type: string
+        Endpoint:
+          type: string
+        PresignURLs:
+          type: boolean
+        Region:
+          type: string
+        SecretKey:
+          type: string
+      type: object
+    Settings-index:
+      items:
+        $ref: "#/components/schemas/Settings-index-elem"
+      type: array
+    Settings-index-elem:
+      properties:
+        Blog:
+          $ref: "#/components/schemas/BlogSetting"
+        Database:
+          $ref: "#/components/schemas/DatabaseSetting"
+        Forms:
+          $ref: "#/components/schemas/FormsSetting"
+        HostPort:
+          type: integer
+          description: Port on which the portal serves HTTP traffic
+          example: 3001
+        JwtSigningKey:
+          type: string
+        LicenseKey:
+          type: string
+          description: License key for the portal. Provided by the Tyk's account managers
+          example: XXX
+        LogFormat:
+          type: string
+          enum:
+            - dev
+            - prod
+          example: prod
+          description: >-
+            Log output format. The `dev` format is more human-friendly but takes
+            more space, `prod` is a json-like format that fits in production use
+            cases but is difficult to read
+        LogLevel:
+          type: string
+          enum:
+            - debug
+            - info
+            - warn
+            - error
+            - dpanic
+            - panic
+            - fatal
+          description: The portal's log level. The default value is `info`
+          example: info
+          default: info
+        PortalAPISecret:
+          type: string
+          description: >-
+            API secret that must be set by the admin team to use the SSO flow.
+            [SSO
+            instructions](https://tyk.io/docs/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso/)
+          example: portal123
+        ProductDocRenderer:
+          type: string
+          enum:
+            - stoplight
+            - redoc
+          description: >-
+            Identifies which OpenAPI specification render engine the portal uses
+            on the API Product Page
+          default: stoplight
+          example: stoplight
+        RefreshInterval:
+          type: integer
+          description: >-
+            Defines how often the portal synchronizes data with the connected
+            API Providers. Measured in seconds
+          example: 10
+          default: 10
+        S3:
+          $ref: "#/components/schemas/S3Setting"
+        Site:
+          $ref: "#/components/schemas/SiteSetting"
+        Storage:
+          type: string
+          enum:
+            - "`fs`"
+            - "`db`"
+            - "`s3`"
+          description: >-
+            Defines which type of storage the portal uses for its CMS assets.
+            [More about storing the portal's assets in the
+            documentation](https://tyk.io/docs/tyk-stack/tyk-developer-portal/enterprise-developer-portal/install-tyk-enterprise-portal/configuration/#storage-settings)
+          example: "`db`"
+        StoreSessionName:
+          type: string
+          description: Defines name of the cookie where the portal stores its session
+          example: portal-store-session-name
+          default: portal-store-session-name
+        TLSConfig:
+          $ref: "#/components/schemas/TLSSetting"
+        Theming:
+          $ref: "#/components/schemas/ThemeSetting"
+      type: object
+    ThemeSetting:
+      properties:
+        Path:
+          type: string
+          example: ./themes
+        Theme:
+          type: string
+          example: default
+      type: object
+    TLSSetting:
+      properties:
+        Certificates:
+          items:
+            $ref: "#/components/schemas/Certificate"
+          type: array
+        Enable:
+          type: boolean
+          description: Defines if SSL is enabled in the portal
+        InsecureSkipVerify:
+          type: boolean
+          description: Defines if the portal accepts self-signed certificates
+        MinVersion:
+          type: integer
+        MaxVersion:
+          type: integer
+        PreferServerCipherSuites:
+          type: boolean
+          description: >-
+            If true, the server will prefer the server ciphers over the client
+            ciphers
+        CipherSuites:
+          items:
+            type: string
+            description: Cipher suite name
+            example: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+          type: array
+      type: object
+    Team-index:
+      items:
+        $ref: "#/components/schemas/Team-index-elem"
+      type: array
+    Team-index-elem:
+      properties:
+        Default:
+          type: boolean
+          description: >-
+            Identifies if this team is a default team for this organisation. All
+            new users are created in the default team unless otherwise
+            specified.
+          example: true
+        ID:
+          type: integer
+          description: UID of this team
+          example: 1
+        Name:
+          type: string
+          description: Name of this team
+          example: Default Organisation All users
+      type: object
+    Team-create:
+      properties:
+        Name:
+          type: string
+          description: Name of a team
+          example: Partner Team A
+      type: object
+    Team-show:
+      properties:
+        Name:
+          type: string
+          description: Name of this team
+          example: Default Organisation All users
+        ID:
+          type: integer
+          description: UID of this team
+          example: 11
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          description: Date-time when a team is created
+          example: 2023-06-23 21:02
+          type: string
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          description: Date-time when a team was updated the last time
+          example: 2023-06-23 21:02
+          type: string
+        Users:
+          items:
+            type: string
+            example: User#6
+            description: User ID
+          type: array
+          description: >-
+            Users included in this organisation. For newly created organisation
+            will an empty array
+      type: object
+    Team-update:
+      properties:
+        Name:
+          type: string
+          description: Name of this team
+          example: Default Organisation All users
+        Users:
+          items:
+            type: integer
+            description: UID of a user
+            example: 1
+          type: array
+          description: UID of users included into this team
+      type: object
+    User-index:
+      items:
+        $ref: "#/components/schemas/User-index-elem"
+      type: array
+    User-basis:
+      type: object
+      properties:
+        Active:
+          description: Defines if this user is active and can login to the portal
+          type: boolean
+          example: true
+        Email:
+          description: Email of a user
+          type: string
+          example: admin@acme.com
+        First:
+          type: string
+          description: First name of a user
+          example: John
+        Last:
+          type: string
+          description: Last name of a user
+          example: Doe
+        OrganisationID:
+          type: integer
+          description: >-
+            ID of an organisation where this user belongs to. For admin users it
+            is always equal to 0
+          example: 1
+        Role:
+          type: string
+          description: Role of a user in their organisation
+          example: consumer-team-member
+        Provider:
+          type: string
+          description: Type of identity provider for this user, e.g. password, github, etc.
+          example: password
+    User-index-elem:
+      allOf:
+        - $ref: "#/components/schemas/User-basis"
+        - type: object
+          properties:
+            ID:
+              description: UID of a user
+              type: integer
+              example: 1
+    User-create:
+      allOf:
+        - $ref: "#/components/schemas/User-basis"
+        - type: object
+          properties:
+            ResetPassword:
+              type: boolean
+              description: >-
+                Determines if a user must change their password at the next
+                login
+              example: false
+    User-show:
+      allOf:
+        - $ref: "#/components/schemas/User-basis"
+        - type: object
+          properties:
+            JWTToken:
+              type: string
+              description: >-
+                API access credentials to the admin APIs that are described in
+                this spectification
+              example: >-
+                eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJQcm92aWRlciI6Im5vbmUiLCJVc2VySUQiOiIkMmEkMTAkMFhRUEtCSC9nenFWMVhnRkRzUWViLk90bmdzVVlsQk9VSE14T045bWZveEs3ek9zSzVKLnkifQ.SHZtWNA-sYHUwSLEkWFo1r049WBWcQJVco_WH21jXHs
+            APITokenCreatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2}$
+              description: Date-time when the `JWTToken` is created
+              example: "2023-06-23"
+              type: string
+            Organisation:
+              type: string
+              description: Name of an rganisation where this user belongs to
+              example: Default Organisation
+            ResetPassword:
+              type: boolean
+              description: >-
+                Determines if a user must change their password at the next
+                login
+              example: false
+            Teams:
+              items:
+                $ref: "#/components/schemas/Team-show"
+              type: array
+              description: Teams that this user belongs to
+            ID:
+              type: integer
+              description: UID of a user
+              example: 1
+            CreatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              description: Date-time when a user is created
+              example: 2023-06-23 21:02
+              type: string
+            UpdatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              description: Date-time when a user is updated the last time
+              example: 2023-06-23 21:02
+              type: string
+    User-update:
+      allOf:
+        - $ref: "#/components/schemas/User-basis"
+        - type: object
+          properties:
+            Teams:
+              type: array
+              description: Array of team IDs that this user belongs to
+              items:
+                type: string
+              example: ["team-id-1", "team-id-2"]
+            ResetPassword:
+              type: boolean
+              description: >-
+                Determines if a user must change their password at the next
+                login
+              example: false
+    Extended-attributes:
+      items:
+        $ref: "#/components/schemas/Extended-attributes-elem"
+      type: array
+    Extended-attributes-elem:
+      properties:
+        ID:
+          type: integer
+          description: UID of this extended attribute
+          example: 1
+        ModelName:
+          type: string
+          description: Name of the model for which the custom attributes are extended
+          example: User
+        LastUpdatedBy:
+          type: string
+          description: >-
+            User that made the last update of one of the custom attributes for
+            the extended model
+          example: John Smith - john@tyk.io
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of the last update
+          example: 2023-06-25 13:37
+      type: object
+    Custom-attribute-basic:
+      properties:
+        Name:
+          type: string
+          description: Label for custom attribute
+          example: Terms of use
+        Identifier:
+          type: string
+          description: Unique string identifier for custom attribute
+          example: terms-of-use
+        Description:
+          type: string
+          description: Description for custom attribute
+          example: I have read and agreed with...
+        Behaviour:
+          type: integer
+          enum:
+            - 1
+            - 2
+            - 3
+          description: >-
+            custom attribute behaviour: 1 -> Developers can view and edit the
+            attribute, 2 -> Developers can only view the attribute, 3 ->
+            Developers cannot see the attribute
+          example: 3
+        DropdownValues:
+          type: string
+          description: Values to display in dropdown options if the attribute type is 2
+          example: Fleet_management,Cities,EV_management
+        ValidationRegExp:
+          type: string
+          description: Validation to be applied for string type attributes (type 1)
+          example: www\.[a-zA-Z0-9]+\.[a-zA-Z0-9]+
+        AddToKeyMetadata:
+          type: boolean
+          description: >-
+            Defines if the value of this custom attribute should be injected
+            into the credential's metadata
+          example: true
+        Required:
+          type: boolean
+          description: >-
+            Defines if the value of this custom attribute is required to create
+            a new object
+          example: true
+        ShowOnSignUp:
+          type: boolean
+          description: >-
+            Defines if this custom attribute should be displayed in the sign up
+            form
+          example: true
+        WriteOnceReadMany:
+          type: boolean
+          description: If set to true the value is set only once for the first time
+          example: true
+      type: object
+    Custom-attribute-create:
+      allOf:
+        - $ref: "#/components/schemas/Custom-attribute-basic"
+        - type: object
+          properties:
+            Type:
+              type: integer
+              enum:
+                - 1
+                - 2
+                - 3
+                - 4
+              description: >-
+                custom attribute type: 1 -> String, 2 -> Dropdown, 3 -> Boolean,
+                4 -> Number
+              example: 2
+    Custom-attribute-element:
+      allOf:
+        - $ref: "#/components/schemas/Custom-attribute-basic"
+        - type: object
+          properties:
+            ID:
+              type: integer
+              description: UID of this custom attribute
+              example: 1
+            Type:
+              type: integer
+              enum:
+                - 1
+                - 2
+                - 3
+                - 4
+              description: >-
+                custom attribute type: 1 -> String, 2 -> Dropdown, 3 -> Boolean,
+                4 -> Number
+              example: 2
+    Extended-attributes-show:
+      allOf:
+        - $ref: "#/components/schemas/Extended-attributes-elem"
+        - type: object
+          properties:
+            CustomAttributes:
+              type: array
+              description: custom attributes extended for this model
+              items:
+                $ref: "#/components/schemas/Custom-attribute-element"
+            DefaultAttributes:
+              type: array
+              description: default attributes included for this model
+              items:
+                $ref: "#/components/schemas/Default-attribute-element"
+    Custom-attribute-index:
+      items:
+        $ref: "#/components/schemas/Custom-attribute-element"
+      type: array
+    Default-attribute-basic:
+      properties:
+        AddToKeyMetadata:
+          type: boolean
+          description: >-
+            If set to true the value for this default attribute will be injected
+            in the credential metadata
+          example: true
+      type: object
+    Default-attribute-element:
+      allOf:
+        - $ref: "#/components/schemas/Default-attribute-basic"
+        - type: object
+          properties:
+            ID:
+              type: integer
+              description: UID of this default attribute
+              example: 1
+            Label:
+              type: string
+              description: Name of default attribute field
+              example: First Name
+    Default-attribute-index:
+      items:
+        $ref: "#/components/schemas/Default-attribute-element"
+      type: array
+    Custom-attribute-user-basic:
+      properties:
+        Value:
+          type: string
+          description: custom attribute value
+          example: "true"
+      type: object
+    Custom-attribute-user-detail:
+      properties:
+        Name:
+          type: string
+          description: Label for custom attribute
+          example: Terms of use
+        Identifier:
+          type: string
+          description: Unique string identifier for custom attribute
+          example: terms-of-use
+        Type:
+          type: string
+          description: >-
+            custom attribute type: 1 -> String, 2 -> Dropdown, 3 -> Boolean, 4
+            -> Number
+          example: Boolean
+        Behaviour:
+          type: string
+          description: >-
+            custom attribute behaviour: 1 -> Developers can view and edit the
+            attribute, 2 -> Developers can only view the attribute, 3 ->
+            Developers cannot see the attribute
+          example: Edit and view
+        AddToKeyMetadata:
+          type: boolean
+          description: >-
+            Defines if value of this custom attribute should be injected in the
+            credentials metadata
+          example: true
+        Required:
+          type: boolean
+          description: Indicates if this custom attribute value is required
+          example: true
+        ShowOnSignUp:
+          type: boolean
+          description: >-
+            Indicates if this custom attribute should be displayed in the sign
+            up form
+          example: true
+        WriteOnceReadMany:
+          type: boolean
+          description: If set to true the value is set only once for the first time
+          example: true
+      type: object
+    Custom-attribute-user-element:
+      allOf:
+        - $ref: "#/components/schemas/Custom-attribute-user-basic"
+        - type: object
+          properties:
+            ID:
+              type: integer
+              description: UID of this user custom attribute
+              example: 1
+            CustomAttribute:
+              $ref: "#/components/schemas/Custom-attribute-user-detail"
+    Custom-attribute-user-index:
+      items:
+        $ref: "#/components/schemas/Custom-attribute-user-element"
+      type: array
+    ProductTagIndex:
+      items:
+        $ref: "#/components/schemas/Product-Tag"
+      type: array
+    Product-Tag:
+      properties:
+        Name:
+          type: string
+          description: Name of this tag
+          example: monetization
+      type: object
+    ProductClientTypeList:
+      items:
+        $ref: "#/components/schemas/ProductClientTypeListItem"
+      type: array
+    ProductClientTypeListItem:
+      properties:
+        ID:
+          type: integer
+          description: UID of this client type
+          example: 1
+        Name:
+          type: string
+          description: Name of this client type
+          example: foo
+      type: object
+    ProductClientTypeResponse:
+      properties:
+        Name:
+          type: string
+          description: Name of this client type
+          example: foo
+        ID:
+          type: integer
+          description: UID of this client type
+          example: 11
+        Description:
+          type: string
+          description: description on the client type
+          example: Web application
+        GrantType:
+          type: string
+          enum:
+            - authorization_code
+            - client_credentials
+            - device_code
+            - pkce
+            - password
+            - implicit
+            - refresh_token
+          description: OAuth2.0 grant types that are allowed for this client type
+          example: authorization_code
+        OktaAppType:
+          type: string
+          enum:
+            - browser
+            - native
+            - web
+            - service
+          description: The type of client application for Okta
+          example: web
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          description: Date-time when a client type is created
+          example: 2023-06-23 21:02
+          type: string
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          description: Date-time when a client type was updated the last time
+          example: 2023-06-23 21:02
+          type: string
+      type: object
+    ProductClientTypeAttach:
+      properties:
+        ID:
+          type: integer
+          description: UID of this client type
+          example: 11
+      type: object
+    OAuthProviderBasic:
+      type: object
+      required:
+        - Name
+        - Type
+        - WellKnownURL
+      properties:
+        Name:
+          type: string
+          description: Name of this Identity Provider
+          examples:
+            - My Keycloak instance
+        Type:
+          type: string
+          description: >-
+            Type of the identity provider. At the moment we support `Keycloak`,
+            `Gluu`, and `Okta`. If your provider is not in the list but it is
+            compliant with the Dynamic Client Registration protocol, select
+            `Other`.
+          enum:
+            - Keycloak
+            - Gluu
+            - Okta
+            - Other
+          examples:
+            - Keycloak
+            - Gluu
+            - Okta
+            - Other
+        WellKnownURL:
+          type: string
+          description: >-
+            The well-known endpoint provides metadata about the OpenID Connect
+            Identity Provider, facilitating dynamic client registration by
+            allowing clients to discover configuration details such as
+            registration endpoints automatically. Check documentation of your
+            Identity provider for more information.
+          examples:
+            - >-
+              http://localhost:8080/auth/realms/DCR/clients-registrations/openid-connect
+        SSLInsecureSkipVerify:
+          type: boolean
+          description: >-
+            If enabled, the portal will ignore failed SSL checks when connecting
+            to the Identity provider
+          examples:
+            - false
+    OAuthProviderCreate:
+      allOf:
+        - $ref: "#/components/schemas/OAuthProviderBasic"
+        - type: object
+          properties:
+            RegistrationAccessToken:
+              type: string
+              description: >-
+                This token is used solely for registering a specific instance of
+                the application.
+              examples:
+                - >-
+                  eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI5MGVmNWRmYy1hNTViLTQ0N2MtODg4ZS1lNjNkNjEwMDc1ZTMifQ.eyJleHAiOjE3OTYyMjQ4MTUsImlhdCI6MTcwOTgyNDgxNSwianRpIjoiMGNiZjMyYmYtZTdmYi00M2U2LTkwNzEtZmNjMGE3YWMzZGNiIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2F1dGgvcmVhbG1zL0RDUiIsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9hdXRoL3JlYWxtcy9EQ1IiLCJ0eXAiOiJJbml0aWFsQWNjZXNzVG9rZW4ifQ.KHx7faY5-DTgUVOKj8aK9RSmM_xRcXf7LJfgHOmPGzc
+    OAuthProviderIndex:
+      items:
+        $ref: "#/components/schemas/OAuthProviderElem"
+      type: array
+    OAuthProviderElem:
+      allOf:
+        - $ref: "#/components/schemas/OAuthProviderBasic"
+        - type: object
+          properties:
+            ID:
+              type: integer
+              description: UID of this Identity Provider
+              examples:
+                - 1
+            CreatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this Identity provider was created
+              examples:
+                - 2023-06-25 13:37
+            UpdatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this Identity provider was created
+              examples:
+                - 2023-06-25 13:37
+    OAuthProviderShow:
+      allOf:
+        - $ref: "#/components/schemas/OAuthProviderElem"
+        - type: object
+          required:
+            - ClientTypes
+          properties:
+            ClientTypes:
+              type: array
+              description: OAuth2.0 client types associated with this Identity Provider
+              items:
+                $ref: "#/components/schemas/OAuthClientTypeElem"
+    OAuthClientTypeBasic:
+      type: object
+      required:
+        - Name
+        - ResponseTypes
+        - GrantType
+      properties:
+        Name:
+          type: string
+          description: Name of this Client type
+          examples:
+            - Server-side application
+        Description:
+          type: string
+          description: Description of this Client type
+          examples:
+            - >-
+              Use this client configuration to create server-side applications
+              that don't act on behalf of end-users
+        ResponseTypes:
+          type: string
+          description: >-
+            The OAuth 2.0 response type(s) the client is permitted to use,
+            determining how it receives authorization responses from the
+            Identity Provider. Format as CSV and Specify at least one.
+          enum:
+            - code
+            - token
+            - it_token
+            - none
+          examples:
+            - code,token
+        GrantType:
+          type: string
+          description: >-
+            The OAuth 2.0 grant types the client is permitted to use,
+            determining how it obtains access tokens from the authorization
+            server. Format as CSV and Specify at least one.
+          enum:
+            - authorization_code
+            - pkce
+            - client_credentials
+            - device_code
+            - refresh_token
+            - password
+            - implicit
+          examples:
+            - authorization_code,refresh_token,password
+        TokenEndpointAuthMethod:
+          type: string
+          description: >-
+            The authentication method a client can use at the token endpoint,
+            ensuring secure communication with the authorization server during
+            the OAuth 2.0 authentication.
+          enum:
+            - client_secret_basic
+            - client_secret_post
+          examples:
+            - client_secret_basic
+            - client_secret_post
+        OktaAppType:
+          type: string
+          description: >-
+            Dictates how an application will authenticate and interact with
+            Okta's authorization servers, including whether it operates as a
+            web, native, single-page, or service application. This setting is
+            required to register Okta Identity Providers and not required for
+            other Identity Provider. Please note that Okta overwrites values of
+            the `TokenEndpointAuthMethod`, `GrantType`, and `ResponseTypes`
+            properties and fills them based on the value of the `OktaAppType`
+            property.
+          enum:
+            - web
+            - native
+            - browser
+            - service
+          examples:
+            - web
+            - native
+            - browser
+            - service
+    OAuthClientTypeElem:
+      allOf:
+        - $ref: "#/components/schemas/OAuthClientTypeBasic"
+        - type: object
+          properties:
+            ID:
+              type: integer
+              description: UID of this client type
+              examples:
+                - 1
+            CreatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this client type was created
+              examples:
+                - 2023-06-25 13:37
+            UpdatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this client type was created
+              examples:
+                - 2023-06-25 13:37
+    OAuthClientTypeIndex:
+      type: array
+      items:
+        $ref: "#/components/schemas/OAuthClientTypeElem"
+    Webhook-update:
+      type: object
+      properties:
+        Name:
+          type: string
+          description: Name of the webhook
+        URL:
+          type: string
+          description: URL to which the webhook will send requests
+        Method:
+          type: string
+          description: HTTP method used by the webhook (e.g., GET, POST)
+        Timeout:
+          type: integer
+          description: Timeout in seconds for the webhook request
+        Events:
+          type: array
+          description: List of event types that trigger the webhook
+          items:
+            type: string
+            enum:
+              - AccessRequestApproved
+              - AccessRequestRejected
+              - AccessRequestCreated
+              - OrganisationRequestCreated
+              - UserRegistered
+              - OrganisationRequestApproved
+              - OrganisationRequestRejected
+              - PasswordReset
+              - RegisterInvite
+              - UserAccountActivated
+              - UserAccountDeactivated
+              - ApplicationRegistered
+              - CredentialRegistered
+              - OrganisationRegistered
+    Webhook-create:
+      type: object
+      properties:
+        Name:
+          type: string
+          description: Name of the webhook
+        URL:
+          type: string
+          description: URL to which the webhook will send requests
+        Method:
+          type: string
+          description: HTTP method used by the webhook (e.g., GET, POST)
+        Timeout:
+          type: integer
+          description: Timeout in seconds for the webhook request
+        Events:
+          type: array
+          description: List of event types that trigger the webhook
+          items:
+            type: string
+            enum:
+              - AccessRequestApproved
+              - AccessRequestRejected
+              - AccessRequestCreated
+              - OrganisationRequestCreated
+              - UserRegistered
+              - OrganisationRequestApproved
+              - OrganisationRequestRejected
+              - PasswordReset
+              - RegisterInvite
+              - UserAccountActivated
+              - UserAccountDeactivated
+              - ApplicationRegistered
+              - CredentialRegistered
+              - OrganisationRegistered
+    Webhook-index:
+      type: array
+      items:
+        $ref: "#/components/schemas/Webhook-index-elem"
+    Webhook-index-elem:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier for the webhook
+        Name:
+          type: string
+          description: Name of the webhook
+        URL:
+          type: string
+          description: URL to which the webhook will send requests
+        Method:
+          type: string
+          description: HTTP method used by the webhook (e.g., GET, POST)
+        Timeout:
+          type: integer
+          description: Timeout in seconds for the webhook request
+        Headers:
+          type: array
+          description: List of custom headers included in the webhook request
+          items:
+            $ref: "#/components/schemas/WebhookHeader"
+        Events:
+          type: array
+          description: List of event types that trigger the webhook
+          items:
+            type: string
+            enum:
+              - AccessRequestApproved
+              - AccessRequestRejected
+              - AccessRequestCreated
+              - OrganisationRequestCreated
+              - UserRegistered
+              - OrganisationRequestApproved
+              - OrganisationRequestRejected
+              - PasswordReset
+              - RegisterInvite
+              - UserAccountActivated
+              - UserAccountDeactivated
+              - ApplicationRegistered
+              - CredentialRegistered
+              - OrganisationRegistered
+    Webhook:
+      type: object
+      properties:
+        Name:
+          type: string
+          description: Name of the webhook
+        URL:
+          type: string
+          description: URL to which the webhook will send requests
+        Method:
+          type: string
+          description: HTTP method used by the webhook (e.g., GET, POST)
+        Timeout:
+          type: integer
+          description: Timeout in seconds for the webhook request
+        Headers:
+          type: array
+          description: List of custom headers included in the webhook request
+          items:
+            $ref: "#/components/schemas/WebhookHeader"
+        Events:
+          type: array
+          description: List of event types that trigger the webhook
+          items:
+            type: string
+            enum:
+              - AccessRequestApproved
+              - AccessRequestRejected
+              - AccessRequestCreated
+              - OrganisationRequestCreated
+              - UserRegistered
+              - OrganisationRequestApproved
+              - OrganisationRequestRejected
+              - PasswordReset
+              - RegisterInvite
+              - UserAccountActivated
+              - UserAccountDeactivated
+              - ApplicationRegistered
+              - CredentialRegistered
+              - OrganisationRegistered
+    Webhook-show:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier for the webhook
+        Name:
+          type: string
+          description: Name of the webhook
+        URL:
+          type: string
+          description: URL to which the webhook will send requests
+        Method:
+          type: string
+          description: HTTP method used by the webhook (e.g., GET, POST)
+        Timeout:
+          type: integer
+          description: Timeout in seconds for the webhook request
+        Headers:
+          type: array
+          description: List of custom headers included in the webhook request
+          items:
+            $ref: "#/components/schemas/WebhookHeader"
+        Events:
+          type: array
+          description: List of event types that trigger the webhook
+          items:
+            type: string
+            enum:
+              - AccessRequestApproved
+              - AccessRequestRejected
+              - AccessRequestCreated
+              - OrganisationRequestCreated
+              - UserRegistered
+              - OrganisationRequestApproved
+              - OrganisationRequestRejected
+              - PasswordReset
+              - RegisterInvite
+              - UserAccountActivated
+              - UserAccountDeactivated
+              - ApplicationRegistered
+              - CredentialRegistered
+              - OrganisationRegistered
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this webhook was created
+          example: 2023-06-25 13:37
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this webhook was updated the last time
+          example: 2023-06-25 13:37
+    WebhookHeader-index:
+      type: array
+      items:
+        $ref: "#/components/schemas/WebhookHeader-index-elem"
+    WebhookHeader-index-elem:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier for the header
+        Name:
+          type: string
+          description: Name of the header
+        Value:
+          type: string
+          description: Value of the header
+    WebhookHeader:
+      type: object
+      description: Details of a webhook header
+      properties:
+        ID:
+          type: string
+          description: Unique identifier for the header
+        Name:
+          type: string
+          description: Name of the header
+        Value:
+          type: string
+          description: Value of the header
+    WebhookHeader-create:
+      type: object
+      description: Details of a webhook header
+      properties:
+        Name:
+          type: string
+          description: Name of the header
+        Value:
+          type: string
+          description: Value of the header
+    WebhookHeader-update:
+      type: object
+      description: Details of a webhook header
+      properties:
+        Name:
+          type: string
+          description: Name of the header
+        Value:
+          type: string
+          description: Value of the header
+    WebhookHeader-show:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier for the header
+        Name:
+          type: string
+          description: Name of the header
+        Value:
+          type: string
+          description: Value of the header
+        WebhookID:
+          type: string
+          description: Unique identifier of the associated webhook
+    Post-show:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier for the post
+        Title:
+          type: string
+          description: Title of the post
+        Lede:
+          type: string
+          description: Short summary or lead paragraph of the post
+        Content:
+          type: string
+          description: Full content of the post
+        Status:
+          type: string
+          description: Status of the post (e.g., draft, published)
+        Path:
+          type: string
+          description: URL path for the post
+        Categories:
+          type: array
+          description: List of categories associated with the post
+          items:
+            $ref: "#/components/schemas/Category-show"
+        Tags:
+          type: array
+          description: List of tags associated with the post
+          items:
+            $ref: "#/components/schemas/Tag-show"
+        MarkdownEnabled:
+          type: boolean
+          description: Whether Markdown is enabled for this post
+        MarkdownContent:
+          type: string
+          description: Content of the post in Markdown format, if Markdown is enabled
+        PreviewContent:
+          type: string
+          description: Preview content of the post
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this post was created
+          example: 2023-06-25 13:37
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this post was last updated
+          example: 2023-06-25 13:37
+    Post-update:
+      type: object
+      required:
+        - Title
+        - Status
+      properties:
+        Title:
+          type: string
+          description: Title of the post
+        Lede:
+          type: string
+          description: Short summary or lead paragraph of the post
+        Content:
+          type: string
+          description: Full content of the post
+        Status:
+          type: string
+          description: Status of the post (e.g., draft, published)
+        Path:
+          type: string
+          description: URL path for the post
+        Categories:
+          type: array
+          description: IDs of existing categories to associate with the post
+          items:
+            type: integer
+            example: 1
+        Tags:
+          type: array
+          description: IDs of existing tags to associate with the post
+          items:
+            type: integer
+            example: 1
+        MarkdownEnabled:
+          type: boolean
+          description: Whether Markdown is enabled for this post
+        MarkdownContent:
+          type: string
+          description: Content of the post in Markdown format, if Markdown is enabled
+        PreviewContent:
+          type: string
+          description: Preview content of the post
+    Category-index:
+      type: array
+      items:
+        $ref: "#/components/schemas/Category-index-elem"
+    Category-index-elem:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier for the category
+        Name:
+          type: string
+          description: Name of the category
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this category was created
+          example: 2023-06-25 13:37
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this category was last updated
+          example: 2023-06-25 13:37
+    Category-attach:
+      type: object
+      properties:
+        ID:
+          type: integer
+          description: Unique identifier for the category
+    Category-show:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier for the category
+        Name:
+          type: string
+          description: Name of the category
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this category was created
+          example: 2023-06-25 13:37
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this category was last updated
+          example: 2023-06-25 13:37
+    Tag-index:
+      type: array
+      items:
+        $ref: "#/components/schemas/Tag-index-elem-blog"
+    Tag-index-tags:
+      type: array
+      items:
+        $ref: "#/components/schemas/Tag-index-elem"
+    Tag-index-elem:
+      type: object
+      properties:
+        ID:
+          type: integer
+          description: Unique identifier for the tag
+          example: 1
+        Name:
+          type: string
+          description: Name of the tag
+          example: "monetization"
+    Tag-index-elem-blog:
+      allOf:
+        - $ref: "#/components/schemas/Tag-index-elem"
+        - type: object
+          properties:
+            CreatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this tag was created
+              example: 2023-06-25 13:37
+            UpdatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this tag was last updated
+              example: 2023-06-25 13:37
+    Tag-attach:
+      type: object
+      properties:
+        ID:
+          type: integer
+          description: Unique identifier for the tag
+    Tag-show:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier for the tag
+        Name:
+          type: string
+          description: Name of the tag
+        CreatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this tag was created
+          example: 2023-06-25 13:37
+        UpdatedAt:
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          type: string
+          description: Timestamp of when this tag was last updated
+          example: 2023-06-25 13:37
+    Tag-show-tags:
+      type: object
+      properties:
+        ID:
+          type: integer
+          description: Unique identifier for the tag
+          example: 1
+        Name:
+          type: string
+          description: Name of the tag
+          example: "monetization"
+        Posts:
+          type: array
+          description: List of posts associated with this tag
+          items:
+            type: object
+            properties:
+              ID:
+                type: integer
+                description: Unique identifier for the post
+                example: 1
+              Title:
+                type: string
+                description: Title of the post
+                example: "How to write a blog post"
+              Lede:
+                type: string
+                description: Short summary or lead paragraph of the post
+              Status:
+                type: string
+                description: Status of the post (e.g., draft, published)
+                example: "published"
+              Path:
+                type: string
+                description: URL path for the post
+                example: "ten-tips-for-gaining-advantage"
+              AuthorID:
+                type: integer
+                description: Unique identifier of the post's author
+                example: 1
+        Products:
+          type: array
+          description: List of products associated with this tag
+          items:
+            type: object
+            properties:
+              ID:
+                type: integer
+                description: Unique identifier for the product
+                example: 1
+              Name:
+                type: string
+                description: Name of the product
+                example: "public_product"
+              DisplayName:
+                type: string
+                description: Display name of the product
+              Path:
+                type: string
+                description: URL path for the product
+                example: "public_product-1"
+              ReferenceID:
+                type: string
+                description: Reference ID of the product
+                example: "61a89e5b5146370001de74d4"
+              Feature:
+                type: boolean
+                description: Indicates if the product is featured
+                example: false
+              DCREnabled:
+                type: boolean
+                description: Indicates if Dynamic Client Registration is enabled for this product
+                example: false
+              ProviderID:
+                type: integer
+                description: Unique identifier of the product's provider
+                example: 1
+  
+    CustomCredential:
+      type: object
+      properties:
+        ID:
+          type: integer
+          description: Unique identifier for the custom credential
+        Alias:
+          type: string
+          description: Alias for the custom credential
+        Type:
+          type: string
+          enum:
+            - CREDENTIAL_TYPE_TYK_MANAGED
+            - CREDENTIAL_TYPE_CUSTOM
+          description: Type of the custom credential
+        PlanID:
+          type: string
+          description: Plan ID associated with the custom credential
+        AuthenticationMethod:
+          type: string
+          description: Authentication method used for the custom credential
+        ProductIDs:
+          type: array
+          items:
+            type: integer
+          description: List of product IDs associated with the custom credential
+        AuthTokenType:
+          type: string
+          enum:
+            - AUTH_TOKEN_TYPE_CUSTOM
+            - AUTH_TOKEN_STANDARD
+          description: Type of authentication token used
+        KeyID:
+          type: string
+          description: Key ID for the custom credential
+        ProviderID:
+          type: integer
+          description: ID for OAuth2.0 provider
+        ClientTypeID:
+          type: integer
+          description: ID for OAuth2.0 client type
+
+    CustomCredential-create:
+      type: object
+      properties:
+        Alias:
+          type: string
+          description: Alias for the custom credential
+        Type:
+          type: string
+          enum:
+            - CREDENTIAL_TYPE_TYK_MANAGED
+            - CREDENTIAL_TYPE_CUSTOM
+          description: Type of the custom credential
+        PlanID:
+          type: integer
+          description: Plan ID associated with the custom credential
+        AuthenticationMethod:
+          type: string
+          description: Authentication method used for the custom credential
+        ProductIDs:
+          type: array
+          items:
+            type: integer
+          description: List of product IDs associated with the custom credential
+        AuthTokenType:
+          type: string
+          enum:
+            - AUTH_TOKEN_TYPE_CUSTOM
+            - AUTH_TOKEN_STANDARD
+          description: Type of authentication token used
+        KeyID:
+          type: string
+          description: Key ID for the custom credential
+        CredentialKey:
+          type: string
+          description: Key for the custom credential
+        CredentialSecret:
+          type: string
+          description: Secret for the custom credential
+        ProviderID:
+          type: integer
+          description: ID for OAuth2.0 provider
+        ClientTypeID:
+          type: integer
+          description: ID for OAuth2.0 client type
+
+    CustomCredential-update:
+      type: object
+      properties:
+        Alias:
+          type: string
+          description: Alias for the custom credential
+
+    CustomCredential-index:
+      type: array
+      items:
+        $ref: '#/components/schemas/CustomCredential'
+
+    CustomCredential-show:
+      allOf:
+        - $ref: '#/components/schemas/CustomCredential'
+        - type: object
+          properties:
+            CreatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this webhook was created
+              example: 2023-06-25 13:37
+            UpdatedAt:
+              pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+              type: string
+              description: Timestamp of when this webhook was updated the last time
+              example: 2023-06-25 13:37
+
+    SSOProfile-index:
+      type: array
+      items:
+        $ref: "#/components/schemas/SSOProfile-index-elem"
+
+    SSOProfile-index-elem:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier/key for the SSO profile
+          example: ldap_dev
+        Name:
+          type: string
+          description: Name of the SSO profile
+          example: Developers@LocalAD
+        ActionType:
+          type: string
+          description: Type of action to perform
+          example: GenerateOrLoginDeveloperProfile
+        LoginURL:
+          type: string
+          description: URL for SSO login
+          example: http://localhost:3001/tib/auth/ldap_dev/ldap
+        RedirectURL:
+          type: string
+          description: Callback URL for SSO authentication
+          example: http://localhost:3001/tib/auth/ldap_dev/ldap/callback
+        SelectedProviderType:
+          type: string
+          description: Type of the selected provider
+          example: ldap
+        UpdatedAt:
+          type: string
+          description: Timestamp of when this profile was last updated
+          pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$
+          example: "2024-11-14 12:36"
+        UpdatedBy:
+          type: string
+          description: Email of the user who last updated this profile
+          example: auto_test@tyk.io
+
+    SSOProfile-response:
+      type: object
+      properties:
+        ID:
+          type: string
+          description: Unique identifier/key for the SSO profile
+          example: ldap_dev
+        Name:
+          type: string
+          description: Name of the SSO profile
+          example: Developers@LocalAD
+        OrgID:
+          type: string
+          description: Organization ID
+          example: "1"
+        ActionType:
+          type: string
+          description: Type of action to perform
+          example: GenerateOrLoginDeveloperProfile
+        MatchedPolicyID:
+          type: string
+          description: ID of the matched policy
+        Type:
+          type: string
+          description: Type of SSO profile
+          example: redirect
+        ProviderName:
+          type: string
+          description: Name of the provider
+          example: ADProvider
+        CustomEmailField:
+          type: string
+          description: Custom field for email mapping
+        CustomUserIDField:
+          type: string
+          description: Custom field for user ID mapping
+        ProviderConfig:
+          type: object
+          description: JSON configuration for the provider
+          additionalProperties: true
+        IdentityHandlerConfig:
+          type: object
+          description: JSON configuration for identity handling
+          additionalProperties: true
+        ProviderConstraintsDomain:
+          type: string
+          description: Domain constraints for the provider
+        ProviderConstraintsGroup:
+          type: string
+          description: Group constraints for the provider
+        ReturnURL:
+          type: string
+          description: URL to return to after SSO
+          example: http://localhost:3001/sso
+        DefaultUserGroupID:
+          type: string
+          description: Default group ID for new users
+        CustomUserGroupField:
+          type: string
+          description: Custom field for user group mapping
+          example: cn
+        UserGroupMapping:
+          type: object
+          description: JSON mapping of user groups
+          additionalProperties: true
+          example:
+            TeamA: "9"
+            TeamB: "11"
+        UserGroupSeparator:
+          type: string
+          description: Separator used in user group strings
+        SSOOnlyForRegisteredUsers:
+          type: boolean
+          description: "Whether SSO is restricted to registered users only"
+          default: false
+    Product-create:
+      type: object
+      required:
+        - Name
+        - ProviderID
+        - IsDocumentationOnly
+      properties:
+        APIDetails:
+          type: array
+          items:
+            type: object
+            properties:
+              APIID:
+                type: string
+                example: "3108a5fc970946ef66c1835cf73ba7a5"
+              Description:
+                type: string
+                example: "This API provides payment endpoints"
+              OASUrl:
+                type: string
+                format: uri
+                example: "https://petstore.swagger.io/v2/swagger.json"
+        Catalogues:
+          type: array
+          items:
+            type: integer
+            example: 1
+        CID:
+          type: string
+          example: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+        Content:
+          type: string
+          example: "<p>Description goes here</p>"
+        DCREnabled:
+          type: boolean
+          default: false
+          example: true
+        Description:
+          type: string
+          example: "Description goes here"
+        DisplayName:
+          type: string
+          example: "ACME Payment API"
+        Feature:
+          type: boolean
+          default: false
+          example: true
+        IsDocumentationOnly:
+          type: boolean
+          default: false
+          description: Must be false for regular API products
+        Name:
+          type: string
+          example: "payment_api"
+        ProviderID:
+          type: integer
+          example: 1
+        Scopes:
+          type: string
+          example: "payments,clients"
+        Tags:
+          type: array
+          items:
+            type: integer
+            example: 1
+        Templates:
+          type: array
+          items:
+            type: integer
+            example: 1
+    DocumentationProduct-create:
+      type: object
+      required:
+        - Name
+        - IsDocumentationOnly
+      properties:
+        SpecDetails:
+          type: array
+          items:
+            type: object
+            required:
+              - SpecAlias
+            properties:
+              SpecAlias:
+                type: string
+                example: "payment_api"
+              OASUrl:
+                type: string
+                format: uri
+                example: "https://petstore.swagger.io/v2/swagger.json"
+        Catalogues:
+          type: array
+          items:
+            type: integer
+            example: 1
+        CID:
+          type: string
+          example: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+        Content:
+          type: string
+          example: "<p>Description goes here</p>"
+        DCREnabled:
+          type: boolean
+          default: false
+          example: true
+        Description:
+          type: string
+          example: "Description goes here"
+        DisplayName:
+          type: string
+          example: "Doc only Product"
+        Feature:
+          type: boolean
+          default: false
+          example: true
+        IsDocumentationOnly:
+          type: boolean
+          default: true
+          description: Must be true for documentation only products
+        Name:
+          type: string
+          example: "doc_only"
+        Tags:
+          type: array
+          items:
+            type: integer
+            example: 1
+    SpecDetail-index:
+      items:
+        $ref: "#/components/schemas/SpecDetail-index-elem"
+      type: array
+    SpecDetail-index-elem:
+      type: object
+      allOf:
+        - $ref: "#/components/schemas/SpecDetail-create"
+        - type: object
+          properties:
+            ID:
+              type: integer
+              description: Unique identifier of the Specification
+              example: 1
+
+    SpecDetail-create:
+      type: object
+      required:
+        - SpecAlias
+      properties:
+        CID:
+          type: string
+          description: Client ID associated with this Specification
+          example: "2r7p8aUnkzby17hCJk8w2XvK3K6"
+        SpecAlias:
+          type: string
+          description: Alias/identifier for this Specification
+          example: "payment_api"
+        OASUrl:
+          type: string
+          description: URL of OpenAPI Specification. The document must be a valid OAS document
+          example: "https://petstore.swagger.io/v2/swagger.json"
+        Name:
+          type: string
+          description: Name of the Specification
+          example: "Payment API Documentation"
+
+  securitySchemes:
+    AdminAPIToken:
+      type: apiKey
+      in: header
+      name: Authorization
\ No newline at end of file
diff --git a/swagger/gateway-swagger.yml b/swagger/gateway-swagger.yml
new file mode 100644
index 0000000000..c69a7d6c23
--- /dev/null
+++ b/swagger/gateway-swagger.yml
@@ -0,0 +1,8533 @@
+openapi: 3.0.3
+info:
+  contact:
+    email: support@tyk.io
+    name: Tyk Technologies
+    url: https://tyk.io/contact
+  description: |+
+    <img src="https://tyk.io/docs/img/swagger_gateway_image.png" width="963" height="250">
+    <img src="https://tyk.io/docs/img/swagger_gateway_direction_image.png" width="946" height="392">
+    
+    The Tyk Gateway API is the primary means for integrating your application with the Tyk API Gateway system. This API is very small, and has no granular permissions system. It is intended to be used purely for internal automation and integration.
+
+    **Warning: Under no circumstances should outside parties be granted access to this API.**
+
+    The Tyk Gateway API is capable of:
+
+    * Managing session objects (key generation).
+    * Managing and listing policies.
+    * Managing and listing API Definitions (only when not using the Tyk Dashboard).
+    * Hot reloads / reloading a cluster configuration.
+    * OAuth client creation (only when not using the Tyk Dashboard).
+
+    In order to use the Gateway API, you'll need to set the **secret** parameter in your tyk.conf file.
+
+    The shared secret you set should then be sent along as a header with each Gateway API Request in order for it to be successful:
+
+    **x-tyk-authorization: <your-secret>***
+    <br/>
+
+    <b>The Tyk Gateway API is subsumed by the Tyk Dashboard API in Pro installations.</b>
+
+  license:
+    name: Mozilla Public License Version 2.0
+    url: https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md
+  title: Tyk Gateway API
+  version: 5.13.0
+servers:
+- url: https://{tenant}
+  variables:
+    tenant:
+      default: localhost:8080
+      description: Your gateway host
+security:
+- api_key: []
+tags:
+- description: |
+    **Note: Applies only to Tyk Gateway Community Edition** <br/>
+
+    API management is very simple using the Tyk Rest API: each update only affects the underlying file, and this endpoint will only work with disk based installations, not database-backed ones.<br/>
+
+    APIs that are added this way are flushed to to disk into the app_path folder using the format: *{api-id}.json*. Updating existing APIs that use a different naming convention will cause those APIs to be added, which could subsequently lead to a loading error and crash if they use the same listen_path. <br/>
+
+    These methods only work on a single API node. If updating a cluster, it is important to ensure that all nodes are updated before initiating a reload.<br/>
+  name: APIs
+- description: |+
+    **Note: Applies only to Tyk Gateway Community Edition** <br/>
+
+  name: Tyk OAS APIs
+- description: |
+    Manage MCP (Model Context Protocol) Proxies on Tyk Gateway. MCP Proxies are
+    defined as Tyk OAS documents that include MCP-specific configuration in the
+    Tyk Vendor Extension (`x-tyk-api-gateway`). All create/update requests are validated against
+    the MCP JSON schema; a Gateway reload is required for changes to take effect.
+  name: MCP Proxies
+- description: |
+    All keys that are used to access services via Tyk correspond to a session object that informs Tyk about the context of this particular token, like access rules and rate/quota allowance.
+  name: Keys
+- description: |
+    It is possible to force API quota and rate limit across all keys that belong to a specific organisation ID. Rate limiting at an organisation level is useful for creating tiered access levels and trial accounts.<br />
+
+    The Organisation rate limiting middleware works with both Quotas and Rate Limiters. In order to manage this functionality, a simple API has been put in place to manage these sessions. <br />
+
+    Although the Organisation session-limiter uses the same session object, all other security keys are optional as they are not used. <br />
+
+    <h3>Managing active status</h3> <br />
+
+    To disallow access to an entire group of keys without rate limiting the organisation, create a session object with the "is_inactive" key set to true. This will block access before any other middleware is executed. It is useful when managing subscriptions for an organisation group and access needs to be blocked because of non-payment. <br />
+  name: Organisation Quotas
+- description: |
+    Sometimes a cache might contain stale data, or it may just need to be cleared because of an invalid configuration. This call will purge all keys associated with a cache on an API-by-API basis.
+  name: Cache Invalidation
+- description: Use the endpoints under this tag to manage your certificates. You can
+    add, delete and list certificates using these endpoints.
+  name: Certs
+- description: |
+    Force restart of the Gateway or whole cluster.
+  name: Hot Reload
+- description: |
+    Check health status of the Tyk Gateway and loaded APIs.
+  name: Health Checking
+- description: |
+    A Tyk security policy incorporates several security options that can be applied to an API key. It acts as a template that can override individual sections of an API key (or identity) in Tyk.
+  name: Policies
+- description: |
+    Manage OAuth clients, and manage their tokens
+  name: OAuth
+- description: |
+    Tyk supports batch requests, so a client makes a single request to the API but gets a compound response object back.
+    
+    This is especially handy if clients have complex requests that have multiple synchronous dependencies and do not wish to have the entire request / response cycle running for each event.
+    
+    To enable batch request support, set the `enable_batch_request_support` value to `true`
+    
+    Batch requests that come into Tyk are *run through the whole Tyk machinery* and *use a relative path to prevent spamming*. This means that a batch request to Tyk for three resources with the same API key will have three requests applied to their session quota and request limiting could become active if they are being throttled.
+    
+    Tyk reconstructs the API request based on the data in the batch request. This is to ensure that Tyk is not being used to proxy requests to other hosts outside of the upstream API being accessed.
+    
+    Batch requests are created by POSTING to the `/{listen_path}/tyk/batch/` endpoint. These requests **do not require a valid key**, but their request list does.
+    
+    <h3>Sample Request</h3>
+    
+        ```{json}
+        {
+          "requests": [
+            {
+              "method": "GET",
+              "headers": {
+                "x-tyk-test": "1",
+                "x-tyk-version": "1.2",
+                "authorization": "1dbc83b9c431649d7698faa9797e2900f"
+              },
+              "body": "",
+              "relative_url": "get"
+          },
+          {
+            "method": "GET",
+            "headers": {
+              "x-tyk-test": "2",
+              "x-tyk-version": "1.2",
+              "authorization": "1dbc83b9c431649d7698faa9797e2900f"
+            },
+            "body": "",
+            "relative_url": "get"
+            }
+          ],
+          "suppress_parallel_execution": false
+        }
+        ```
+    
+    The response will be a structured reply that encapsulates the responses for each of the outbound requests. If `suppress_parallel_execution` is set to `true`, requests will be made synchronously. If set to `false` then they will run in parallel and the response order is not guaranteed.
+    
+    <h3>Sample Response</h3>
+    
+      ```
+      [
+        {
+          "relative_url": "get",
+          "code": 200,
+          "headers": {
+            "Access-Control-Allow-Credentials": [
+              "true"
+            ],
+            "Access-Control-Allow-Origin": [
+              "*"
+            ],
+            "Content-Length": [
+              "497"
+            ],
+            "Content-Type": [
+              "application/json"
+            ],
+            "Date": [
+              "Wed, 12 Nov 2014 15:32:43 GMT"
+            ],
+            "Server": [
+              "gunicorn/18.0"
+            ],
+            "Via": [
+              "1.1 vegur"
+            ]
+          },
+          "body": "{
+        "args": {},
+        "headers": {
+          "Accept-Encoding": "gzip",
+          "Authorization": "1dbc83b9c431649d7698faa9797e2900f",
+          "Connect-Time": "2",
+          "Connection": "close",
+          "Host": "httpbin.org",
+          "Total-Route-Time": "0",
+          "User-Agent": "Go 1.1 package http",
+          "Via": "1.1 vegur",
+          "X-Request-Id": "6a22499a-2776-4aa1-80c0-686581a8be4d",
+          "X-Tyk-Test": "2",
+          "X-Tyk-Version": "1.2"
+        },
+        "origin": "127.0.0.1, 62.232.114.250",
+        "url": "http://httpbin.org/get"
+      }"
+          },
+          {
+            "relative_url": "get",
+            "code": 200,
+            "headers": {
+              "Access-Control-Allow-Credentials": [
+                "true"
+              ],
+              "Access-Control-Allow-Origin": [
+                "*"
+              ],
+              "Content-Length": [
+                "497"
+              ],
+              "Content-Type": [
+                "application/json"
+              ],
+              "Date": [
+                "Wed, 12 Nov 2014 15:32:43 GMT"
+              ],
+              "Server": [
+                "gunicorn/18.0"
+              ],
+              "Via": [
+                "1.1 vegur"
+              ]
+            },
+            "body": "{
+        "args": {},
+        "headers": {
+          "Accept-Encoding": "gzip",
+          "Authorization": "1dbc83b9c431649d7698faa9797e2900f",
+          "Connect-Time": "7",
+          "Connection": "close",
+          "Host": "httpbin.org",
+          "Total-Route-Time": "0",
+          "User-Agent": "Go 1.1 package http",
+          "Via": "1.1 vegur",
+          "X-Request-Id": "1ab61f50-51ff-4828-a7e2-17240385a6d2",
+          "X-Tyk-Test": "1",
+          "X-Tyk-Version": "1.2"
+        },
+        "origin": "127.0.0.1, 62.232.114.250",
+        "url": "http://httpbin.org/get"
+      }"
+          }
+      ]
+      ```
+    With the body for each request string encoded in the `body` field.
+    
+    * `expire_analytics_after`: If you are running a busy API, you may want to ensure that your MongoDB database does not overflow with old data. Set the `expire_analytics_after` value to the number of seconds you would like the data to last for. Setting this flag to anything above `0` will set an `expireAt` field for each record that is written to the database.
+    
+    **Important:** Tyk will not create the expiry index for you. In order to implement data expiry for your analytics data, ensure that the index is created This is easily achieved using the [MongoDB command line interface](https://docs.mongodb.com/getting-started/shell/client/).
+    
+    * `dont_set_quota_on_create`: This setting defaults to `false`, but if set to `true`, when the API is used to edit, create or add keys, the quota cache in Redis will not be re-set. By default, all updates or creates to Keys that have Quotas set will re-set the quota (This has been the default behaviour since 1.0).
+    
+      This behaviour can be bypassed on a case-by-case basis by using the `suppress_reset` parameter when making a REST API request. This is the advised mode of operation as it allows for manual, granular control over key quotas and reset timings.
+    
+    * `cache_options`: This section enables you to configure the caching behaviour of Tyk and to enable or disable the caching middleware for your API.
+    
+    * `cache_options.enable_cache`: Set this value to `true` if the cache should be enabled for this endpoint, setting it to false will stop all caching behaviour.
+    
+    * `cache_options.cache_timeout`: The amount of time, in seconds, to keep cached objects, defaults to `60` seconds.
+    
+    * `cache_options.cache_all_safe_requests`: Set this to `true` if you want all *safe* requests (GET, HEAD, OPTIONS) to be cached. This is a blanket setting for APIs where caching is required but you don't want to set individual paths up in the definition.
+    
+    * `cache_options.enable_upstream_cache_control`: Set this to `true` if you want your application to control the cache options for Tyk (TTL and whether to cache or not). See [Caching](/docs/basic-config-and-security/reduce-latency/caching/) for more details.
+    
+    * `response_processors`: Response processors need to be specifically defined so they are loaded on API creation, otherwise the middleware will not fire. In order to have the two main response middleware components fire, the following configuration object should be supplied.
+    
+    ```{json}
+      "response_processors": [
+        {
+            "name": "header_injector",
+            "options": {
+                "add_headers": {"name": "value"},
+                "remove_headers": ["name"]
+            }
+        },
+        {
+          "name": "response_body_transform",
+          "options": {}
+        }
+      ]
+    ```
+    
+    The options for the `header_injector` are global, and will apply to all outbound requests.
+  name: "Batch requests"
+paths:
+  /hello:
+    get:
+      description: From v2.7.5 you can now rename the `/hello`  endpoint by using
+        the `health_check_endpoint_name` option.
+      operationId: hello
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                description: Tyk GW
+                details:
+                  redis:
+                    componentType: datastore
+                    status: pass
+                    time: "2020-05-19T03:42:55+01:00"
+                status: pass
+                version: v5.5.0-dev
+              schema:
+                $ref: '#/components/schemas/HealthCheckResponse'
+          description: Success.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "405":
+          content:
+            application/json:
+              example:
+                message: Method Not Allowed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Method Not Allowed
+      summary: Check the health of the Tyk Gateway.
+      tags:
+      - Health Checking
+  /tyk/apis:
+    get:
+      description: List APIs from Tyk Gateway
+      operationId: listApis
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+              - api_id: b84fe1a04e5648927971c0557971565c
+                auth:
+                  auth_header_name: authorization
+                definition:
+                  key: version
+                  location: header
+                name: Tyk Test API
+                org_id: 664a14650619d40001f1f00f
+                proxy:
+                  listen_path: /tyk-api-test/
+                  strip_listen_path: true
+                  target_url: https://httpbin.org
+                use_oauth2: true
+                version_data:
+                  not_versioned: true
+                  versions:
+                    Default:
+                      name: Default
+              schema:
+                items:
+                  $ref: '#/components/schemas/APIDefinition'
+                type: array
+          description: List of API definitions.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Get list of apis
+      tags:
+      - APIs
+    post:
+      description: Create API. A single Tyk node can have its API Definitions queried,
+        deleted and updated remotely. This functionality enables you to remotely update
+        your Tyk definitions without having to manage the files manually.
+      operationId: createApi
+      parameters:
+      - description: The base API which the new version will be linked to.
+        example: 663a4ed9b6be920001b191ae
+        in: query
+        name: base_api_id
+        required: false
+        schema:
+          type: string
+      - description: The version name of the base API while creating the first version.
+          This doesn't have to be sent for the next versions but if it is set, it
+          will override base API version name.
+        example: Default
+        in: query
+        name: base_api_version_name
+        required: false
+        schema:
+          type: string
+      - description: The version name of the created version.
+        example: v2
+        in: query
+        name: new_version_name
+        required: false
+        schema:
+          type: string
+      - description: If true, the new version is set as default version.
+        example: true
+        in: query
+        name: set_default
+        required: false
+        schema:
+          type: boolean
+      requestBody:
+        content:
+          application/json:
+            example:
+              api_id: b84fe1a04e5648927971c0557971565c
+              auth:
+                auth_header_name: authorization
+              definition:
+                key: version
+                location: header
+              name: Tyk Test API
+              org_id: 664a14650619d40001f1f00f
+              proxy:
+                listen_path: /tyk-api-test/
+                strip_listen_path: true
+                target_url: https://httpbin.org
+              use_oauth2: true
+              version_data:
+                not_versioned: true
+                versions:
+                  Default:
+                    name: Default
+            schema:
+              $ref: '#/components/schemas/APIDefinition'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: added
+                key: b84fe1a04e5648927971c0557971565c
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: API created.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: file object creation failed, write error
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Create an API
+      tags:
+      - APIs
+  /tyk/apis/{apiID}:
+    delete:
+      description: Deleting an API definition will remove the file from the file store,
+        the API definition will NOT be unloaded, a separate reload request will need
+        to be made to disable the API endpoint.
+      operationId: deleteApi
+      parameters:
+      - description: The API ID.
+        example: 1bd5c61b0e694082902cf15ddcc9e6a7
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: deleted
+                key: 1bd5c61b0e694082902cf15ddcc9e6a7
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: API deleted.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: API not found.
+        "500":
+          content:
+            application/json:
+              example:
+                message: Delete failed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Deleting an API definition with ID.
+      tags:
+      - APIs
+    get:
+      description: Get API definition from Tyk Gateway.
+      operationId: getApi
+      parameters:
+      - description: The API ID.
+        example: keyless
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                api_id: b84fe1a04e5648927971c0557971565c
+                auth:
+                  auth_header_name: authorization
+                definition:
+                  key: version
+                  location: header
+                name: Tyk Test API
+                org_id: 664a14650619d40001f1f00f
+                proxy:
+                  listen_path: /tyk-api-test/
+                  strip_listen_path: true
+                  target_url: https://httpbin.org
+                use_oauth2: true
+                version_data:
+                  not_versioned: true
+                  versions:
+                    Default:
+                      name: Default
+              schema:
+                $ref: '#/components/schemas/APIDefinition'
+          description: API definition.
+          headers:
+            x-tyk-base-api-id:
+              description: ID of the base API if the requested API is a version.
+              schema:
+                type: string
+              style: simple
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: API not found.
+      summary: Get API definition with it's ID.
+      tags:
+      - APIs
+    put:
+      description: |-
+        Updating an API definition uses the same signature and object as a `POST`, however it will first ensure that the API ID that is being updated is the same as the one in the object being `PUT`.
+
+        Updating will completely replace the file descriptor and will not change an API Definition that has already been loaded, the hot-reload endpoint will need to be called to push the new definition to live.
+      operationId: updateApi
+      parameters:
+      - description: The API ID.
+        example: 1bd5c61b0e694082902cf15ddcc9e6a7
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              api_id: b84fe1a04e5648927971c0557971565c
+              auth:
+                auth_header_name: authorization
+              definition:
+                key: version
+                location: header
+              name: Update the API name sample
+              org_id: 664a14650619d40001f1f00f
+              proxy:
+                listen_path: /update-listen-path
+                strip_listen_path: true
+                target_url: https://tyk.io/api
+              use_oauth2: true
+              version_data:
+                not_versioned: true
+                versions:
+                  Default:
+                    name: Default
+            schema:
+              $ref: '#/components/schemas/APIDefinition'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: modified
+                key: 1bd5c61b0e694082902cf15ddcc9e6a7
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: API updated.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: API not found.
+        "500":
+          content:
+            application/json:
+              example:
+                message: File object creation failed, write error.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Updating an API definition with its ID.
+      tags:
+      - APIs
+  /tyk/apis/{apiID}/versions:
+    get:
+      description: Listing versions of an API.
+      operationId: listApiVersions
+      parameters:
+      - description: The API ID.
+        example: keyless
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - $ref: '#/components/parameters/SearchText'
+      - $ref: '#/components/parameters/AccessType'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                apis:
+                - expirationDate: ""
+                  id: keyless
+                  internal: false
+                  isDefaultVersion: false
+                  name: Tyk Test Keyless API
+                  versionName: ""
+                - expirationDate: ""
+                  id: 1f20d5d2731d47ac9c79fddf826eda00
+                  internal: false
+                  isDefaultVersion: true
+                  name: Version three Api
+                  versionName: v2
+                status: success
+              schema:
+                $ref: '#/components/schemas/VersionMetas'
+          description: API version metas.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: API not found.
+      summary: Listing versions of an API.
+      tags:
+      - APIs
+  /tyk/apis/oas:
+    get:
+      description: List all APIs in Tyk OAS API format, from Tyk Gateway.
+      operationId: listApisOAS
+      parameters:
+      - description: "By default mode is empty which means it will return the Tyk
+          API OAS spec including the x-tyk-api-gateway part. \n When mode=public,
+          the Tyk OAS API spec will exclude the x-tyk-api-gateway part in the response."
+        example: public
+        in: query
+        name: mode
+        required: false
+        schema:
+          enum:
+          - public
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                oasExampleList:
+                  $ref: '#/components/examples/oasExampleList'
+              schema:
+                items:
+                  allOf:
+                  - $ref: '#/components/schemas/OpenAPI3Schema'
+                  - $ref: '#/components/schemas/TykVendorExtension'
+                type: array
+          description: List of API definitions in Tyk OAS format.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: List all APIs in Tyk OAS API format.
+      tags:
+      - Tyk OAS APIs
+    post:
+      description: Create an API with Tyk OAS API format on the Tyk Gateway.
+      operationId: createApiOAS
+      parameters:
+      - description: The base API which the new version will be linked to.
+        example: 663a4ed9b6be920001b191ae
+        in: query
+        name: base_api_id
+        required: false
+        schema:
+          type: string
+      - description: The version name of the base API while creating the first version.
+          This doesn't have to be sent for the next versions but if it is set, it
+          will override base API version name.
+        example: Default
+        in: query
+        name: base_api_version_name
+        required: false
+        schema:
+          type: string
+      - description: The version name of the created version.
+        example: v2
+        in: query
+        name: new_version_name
+        required: false
+        schema:
+          type: string
+      - description: If true, the new version is set as default version.
+        example: true
+        in: query
+        name: set_default
+        required: false
+        schema:
+          type: boolean
+      requestBody:
+        content:
+          application/json:
+            example:
+              components:
+                securitySchemes:
+                  bearerAuth:
+                    description: The API Access Credentials
+                    scheme: bearer
+                    type: http
+              info:
+                description: This is a sample OAS.
+                title: OAS Sample
+                version: 1.0.0
+              openapi: 3.0.3
+              paths:
+                /api/sample/users:
+                  get:
+                    operationId: getUsers
+                    responses:
+                      "200":
+                        content:
+                          application/json:
+                            schema:
+                              items:
+                                properties:
+                                  name:
+                                    type: string
+                                type: object
+                              type: array
+                        description: fetched users
+                    summary: Get users
+                    tags:
+                    - users
+              security:
+              - bearerAuth: []
+              servers:
+              - url: https://localhost:8080
+              x-tyk-api-gateway:
+                info:
+                  name: user
+                  state:
+                    active: true
+                server:
+                  listenPath:
+                    strip: true
+                    value: /user-test/
+                upstream:
+                  url: https://localhost:8080
+            schema:
+              allOf:
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+              - $ref: '#/components/schemas/TykVendorExtension'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: added
+                key: e30bee13ad4248c3b529a4c58bb7be4e
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: API created.
+        "400":
+          content:
+            application/json:
+              example:
+                message: the payload should contain x-tyk-api-gateway
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: file object creation failed, write error
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Create an API with Tyk OAS format.
+      tags:
+      - Tyk OAS APIs
+  /tyk/apis/oas/{apiID}:
+    delete:
+      description: Deleting an API definition will remove the file from the file store,
+        the API definition will not be unloaded, a separate reload request will need
+        to be made to disable the API endpoint.
+      operationId: deleteOASApi
+      parameters:
+      - description: The API ID.
+        example: 1bd5c61b0e694082902cf15ddcc9e6a7
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: deleted
+                key: 1bd5c61b0e694082902cf15ddcc9e6a7
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: API deleted
+        "400":
+          content:
+            application/json:
+              example:
+                message: Must specify an apiID to delete
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: API not found.
+        "500":
+          content:
+            application/json:
+              example:
+                message: Delete failed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Deleting a Tyk OAS API.
+      tags:
+      - Tyk OAS APIs
+    get:
+      description: Get Tyk OAS API definition using an API ID.
+      operationId: getOASApi
+      parameters:
+      - description: "By default mode is empty which means it will return the Tyk
+          API OAS spec including the x-tyk-api-gateway part. \n When mode=public,
+          the Tyk OAS API spec will exclude the x-tyk-api-gateway part in the response."
+        example: public
+        in: query
+        name: mode
+        required: false
+        schema:
+          enum:
+          - public
+          type: string
+      - description: ID of the API you want to fetch
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                oasExample:
+                  $ref: '#/components/examples/oasExample'
+              schema:
+                allOf:
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+                - $ref: '#/components/schemas/TykVendorExtension'
+          description: OK
+          headers:
+            x-tyk-base-api-id:
+              description: ID of the base API if the requested API is a version.
+              schema:
+                type: string
+              style: simple
+        "400":
+          content:
+            application/json:
+              example:
+                message: the requested API definition is in Tyk classic format, please
+                  use old API endpoint
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: API not found.
+      summary: Get a Tyk OAS API definition.
+      tags:
+      - Tyk OAS APIs
+    patch:
+      description: |-
+        You can use this endpoint to update Tyk OAS part of the Tyk API definition.
+        This endpoint allows you to configure Tyk OAS extension based on query params provided(similar to import).
+      operationId: patchApiOAS
+      parameters:
+      - description: ID of the API you want to fetch.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - $ref: '#/components/parameters/UpstreamURL'
+      - $ref: '#/components/parameters/ListenPath'
+      - $ref: '#/components/parameters/CustomDomain'
+      - $ref: '#/components/parameters/AllowList'
+      - $ref: '#/components/parameters/ValidateRequest'
+      - $ref: '#/components/parameters/MockResponse'
+      - $ref: '#/components/parameters/Authentication'
+      requestBody:
+        content:
+          application/json:
+            example:
+              components:
+                securitySchemes:
+                  bearerAuth:
+                    description: The API Access Credentials
+                    scheme: bearer
+                    type: http
+              info:
+                description: This is a sample OAS.
+                title: OAS Sample
+                version: 1.0.0
+              openapi: 3.0.3
+              paths:
+                /api/sample/users:
+                  get:
+                    operationId: getUsers
+                    responses:
+                      "200":
+                        content:
+                          application/json:
+                            schema:
+                              items:
+                                properties:
+                                  name:
+                                    type: string
+                                type: object
+                              type: array
+                        description: fetched users
+                    summary: Get users
+                    tags:
+                    - users
+              security:
+              - bearerAuth: []
+              servers:
+              - url: https://localhost:8080
+              x-tyk-api-gateway:
+                info:
+                  name: user
+                  state:
+                    active: true
+                server:
+                  listenPath:
+                    strip: true
+                    value: /user-test/
+                upstream:
+                  url: https://localhost:8080
+            schema:
+              $ref: '#/components/schemas/OpenAPI3Schema'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: API patched.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Must specify an apiID to patch
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: API not found.
+        "500":
+          content:
+            application/json:
+              example:
+                message: file object creation failed, write error
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Patch API in Tyk OAS format.
+      tags:
+      - Tyk OAS APIs
+    put:
+      description: |-
+        Updating an API definition uses the same signature an object as a `POST`, however it will first ensure that the API ID that is being updated is the same as the one in the object being `PUT`.
+
+
+              Updating will completely replace the file descriptor and will not change an API Definition that has already been loaded, the hot-reload endpoint will need to be called to push the new definition to live.
+      operationId: updateApiOAS
+      parameters:
+      - description: ID of the API you want to fetch
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              components:
+                securitySchemes:
+                  bearerAuth:
+                    description: The API Access Credentials
+                    scheme: bearer
+                    type: http
+              info:
+                description: This is a sample OAS.
+                title: OAS Sample
+                version: 1.0.0
+              openapi: 3.0.3
+              paths:
+                /api/sample/users:
+                  get:
+                    operationId: getUsers
+                    responses:
+                      "200":
+                        content:
+                          application/json:
+                            schema:
+                              items:
+                                properties:
+                                  name:
+                                    type: string
+                                type: object
+                              type: array
+                        description: fetched users
+                    summary: Get users
+                    tags:
+                    - users
+              security:
+              - bearerAuth: []
+              servers:
+              - url: https://localhost:8080
+              x-tyk-api-gateway:
+                info:
+                  name: user
+                  state:
+                    active: true
+                server:
+                  listenPath:
+                    strip: true
+                    value: /user-test/
+                upstream:
+                  url: https://localhost:8080
+            schema:
+              allOf:
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+              - $ref: '#/components/schemas/TykVendorExtension'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: modified
+                key: e30bee13ad4248c3b529a4c58bb7be4e
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: API updated
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request APIID does not match that in Definition! For Update
+                  operations these must match.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: API not found
+        "500":
+          content:
+            application/json:
+              example:
+                message: file object creation failed, write error
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Update a Tyk OAS API definition.
+      tags:
+      - Tyk OAS APIs
+  /tyk/apis/oas/{apiID}/export:
+    get:
+      description: Use the mode query parameter to specify if you want the x-tyk-api-gateway
+        stripped out.
+      operationId: downloadApiOASPublic
+      parameters:
+      - description: ID of the API you want to fetch.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - description: "By default mode is empty which means it will return the Tyk
+          API OAS spec including the x-tyk-api-gateway part. \n When mode=public,
+          the Tyk OAS API spec will exclude the x-tyk-api-gateway part in the response."
+        example: public
+        in: query
+        name: mode
+        required: false
+        schema:
+          enum:
+          - public
+          type: string
+      responses:
+        "200":
+          content:
+            application/octet-stream:
+              schema:
+                format: binary
+                type: string
+          description: Exported API definition file
+        "400":
+          content:
+            application/json:
+              example:
+                message: requesting API definition that is in Tyk classic format
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                message: Unexpected error
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Download a Tyk OAS format API.
+      tags:
+      - Tyk OAS APIs
+  /tyk/apis/oas/{apiID}/versions:
+    get:
+      description: Listing versions of a Tyk OAS API.
+      operationId: listOASApiVersions
+      parameters:
+      - description: ID of the API you want to fetch.
+        example: 4c1c0d8fc885401053ddac4e39ef676b
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - $ref: '#/components/parameters/SearchText'
+      - $ref: '#/components/parameters/AccessType'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                apis:
+                - expirationDate: ""
+                  id: keyless
+                  internal: false
+                  isDefaultVersion: false
+                  name: Tyk Test Keyless API
+                  versionName: ""
+                - expirationDate: ""
+                  id: 1f20d5d2731d47ac9c79fddf826eda00
+                  internal: false
+                  isDefaultVersion: true
+                  name: Version three Api
+                  versionName: v2
+                status: success
+              schema:
+                $ref: '#/components/schemas/VersionMetas'
+          description: API version metas.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API not found.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: API not found
+      summary: Listing versions of a Tyk OAS API.
+      tags:
+      - Tyk OAS APIs
+  /tyk/apis/oas/export:
+    get:
+      description: Download all Tyk OAS format APIs, from the Gateway.
+      operationId: downloadApisOASPublic
+      parameters:
+      - description: "By default mode is empty which means it will return the Tyk
+          API OAS spec including the x-tyk-api-gateway part. \n When mode=public,
+          the Tyk OAS API spec will exclude the x-tyk-api-gateway part in the response."
+        example: public
+        in: query
+        name: mode
+        required: false
+        schema:
+          enum:
+          - public
+          type: string
+      responses:
+        "200":
+          content:
+            application/octet-stream:
+              schema:
+                format: binary
+                type: string
+          description: Get a list of Tyk OAS APIs definitions.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Unexpected error
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Download all Tyk OAS format APIs.
+      tags:
+      - Tyk OAS APIs
+  /tyk/apis/oas/import:
+    post:
+      description: |-
+        Import an Tyk OAS format API without x-tyk-gateway.
+         For use with an existing Tyk OAS API that you want to expose via your Tyk Gateway.
+      operationId: importOAS
+      parameters:
+      - $ref: '#/components/parameters/UpstreamURL'
+      - $ref: '#/components/parameters/ListenPath'
+      - $ref: '#/components/parameters/CustomDomain'
+      - $ref: '#/components/parameters/AllowList'
+      - $ref: '#/components/parameters/ValidateRequest'
+      - $ref: '#/components/parameters/MockResponse'
+      - $ref: '#/components/parameters/Authentication'
+      - description: The base API which the new version will be linked to.
+        example: 663a4ed9b6be920001b191ae
+        in: query
+        name: base_api_id
+        required: false
+        schema:
+          type: string
+      - description: The version name of the base API while creating the first version.
+          This doesn't have to be sent for the next versions but if it is set, it
+          will override base API version name.
+        example: Default
+        in: query
+        name: base_api_version_name
+        required: false
+        schema:
+          type: string
+      - description: The version name of the created version.
+        example: v2
+        in: query
+        name: new_version_name
+        required: false
+        schema:
+          type: string
+      - description: If true, the new version is set as default version.
+        example: true
+        in: query
+        name: set_default
+        required: false
+        schema:
+          type: boolean
+      requestBody:
+        content:
+          application/json:
+            example:
+              components:
+                securitySchemes:
+                  bearerAuth:
+                    description: The API Access Credentials
+                    scheme: bearer
+                    type: http
+              info:
+                description: This is a sample OAS.
+                title: OAS Sample
+                version: 1.0.0
+              openapi: 3.0.3
+              paths:
+                /api/sample/users:
+                  get:
+                    operationId: getUsers
+                    responses:
+                      "200":
+                        content:
+                          application/json:
+                            schema:
+                              items:
+                                properties:
+                                  name:
+                                    type: string
+                                type: object
+                              type: array
+                        description: fetched users
+                    summary: Get users
+                    tags:
+                    - users
+              security:
+              - bearerAuth: []
+              servers:
+              - url: https://localhost:8080
+            schema:
+              $ref: '#/components/schemas/OpenAPI3Schema'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: added
+                key: e30bee13ad4248c3b529a4c58bb7be4e
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: API imported.
+        "400":
+          content:
+            application/json:
+              example:
+                message: the import payload should not contain x-tyk-api-gateway
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: file object creation failed, write error
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Import an API in Tyk OAS format.
+      tags:
+      - Tyk OAS APIs
+  /tyk/mcps:
+    get:
+      description: List all MCP Proxy definitions on this Tyk Gateway. Each entry
+        is a Tyk OAS document whose Tyk Vendor Extension extension marks it as an
+        MCP Proxy definition.
+      operationId: listMCPs
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                items:
+                  allOf:
+                  - $ref: '#/components/schemas/OpenAPI3Schema'
+                  - $ref: '#/components/schemas/TykVendorExtension'
+                type: array
+          description: List of MCP Proxy definitions.
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: List MCP Proxy definitions.
+      tags:
+      - MCP Proxies
+    post:
+      description: |
+        Create an MCP Proxy definition from a Tyk OAS document. The payload must
+        contain the Tyk Vendor Extension (`x-tyk-api-gateway`) extension with MCP configuration and is
+        validated against the MCP JSON schema (`/tyk/schema?type=mcp`) before being
+        stored. The Gateway must be reloaded (`POST /tyk/reload`) for the new MCP
+        Proxy definition to take effect.
+      operationId: createMCP
+      requestBody:
+        content:
+          application/json:
+            example:
+              openapi: 3.0.3
+              info: { title: MCP Proxy Sample, version: 1.0.0 }
+              paths: {}
+              components: {}
+              servers: [{ url: /mcp-sample/ }]
+              x-tyk-api-gateway:
+                info:
+                  name: mcp-sample
+                  state: { active: true }
+                server:
+                  listenPath: { strip: true, value: /mcp-sample/ }
+                  authentication:
+                    enabled: true
+                    securitySchemes:
+                      authToken: { enabled: true }
+                upstream:
+                  url: http://localhost:7878/mcp
+                middleware:
+                  global:
+                    contextVariables: { enabled: true }
+                    trafficLogs: { enabled: true }
+                  mcpTools: {}
+                  operations: {}
+            schema:
+              allOf:
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+              - $ref: '#/components/schemas/TykVendorExtension'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: added
+                key: e30bee13ad4248c3b529a4c58bb7be4e
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: MCP Proxy definition created.
+        "400":
+          content:
+            application/json:
+              example:
+                message: the payload should contain x-tyk-api-gateway
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Validation failed (invalid OAS, missing `x-tyk-api-gateway`, or schema violation).
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Create an MCP Proxy definition.
+      tags:
+      - MCP Proxies
+  /tyk/mcps/{apiID}:
+    parameters:
+    - description: The MCP Proxy definition ID.
+      in: path
+      name: apiID
+      required: true
+      schema:
+        type: string
+    get:
+      description: Retrieve a single MCP Proxy definition by its ID.
+      operationId: getMCP
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                allOf:
+                - $ref: '#/components/schemas/OpenAPI3Schema'
+                - $ref: '#/components/schemas/TykVendorExtension'
+          description: The MCP Proxy definition.
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: MCP Proxy definition not found.
+      summary: Get an MCP Proxy definition.
+      tags:
+      - MCP Proxies
+    put:
+      description: Update an existing MCP Proxy definition. Body is validated against
+        the MCP JSON schema. A Gateway reload is required for changes to take effect.
+      operationId: updateMCP
+      requestBody:
+        content:
+          application/json:
+            example:
+              openapi: 3.0.3
+              info: { title: MCP Proxy Sample, version: 1.0.0 }
+              paths: {}
+              components: {}
+              servers: [{ url: /mcp-sample/ }]
+              x-tyk-api-gateway:
+                info:
+                  name: mcp-sample
+                  state: { active: true }
+                server:
+                  listenPath: { strip: true, value: /mcp-sample/ }
+                  authentication:
+                    enabled: true
+                    securitySchemes:
+                      authToken: { enabled: true }
+                upstream:
+                  url: http://localhost:7878/mcp
+                middleware:
+                  global:
+                    contextVariables: { enabled: true }
+                    trafficLogs: { enabled: true }
+                  mcpTools: {}
+                  operations: {}
+            schema:
+              allOf:
+              - $ref: '#/components/schemas/OpenAPI3Schema'
+              - $ref: '#/components/schemas/TykVendorExtension'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: modified
+                key: e30bee13ad4248c3b529a4c58bb7be4e
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: MCP Proxy definition updated.
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Validation failed.
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: MCP Proxy definition not found.
+      summary: Update an MCP Proxy definition.
+      tags:
+      - MCP Proxies
+    delete:
+      description: Delete an MCP Proxy definition. A Gateway reload is required to
+        unload the proxy from the running Gateway.
+      operationId: deleteMCP
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: deleted
+                key: e30bee13ad4248c3b529a4c58bb7be4e
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: MCP Proxy definition deleted.
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: MCP Proxy definition not found.
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Delete failed.
+      summary: Delete an MCP Proxy definition.
+      tags:
+      - MCP Proxies
+  /tyk/cache/{apiID}:
+    delete:
+      description: Invalidate cache for the given API.
+      operationId: invalidateCache
+      parameters:
+      - description: The API ID.
+        example: ae67bb862a3241a49117508e0f9ee839
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: cache invalidated
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Cache invalidated.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Cache invalidation failed.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Invalidate cache.
+      tags:
+      - Cache Invalidation
+  /tyk/cache/jwks/{apiID}:
+    delete:
+      description: Invalidate JWK cache for the given API.
+      operationId: invalidateJWKCache
+      parameters:
+        - description: The API ID.
+          example: ae67bb862a3241a49117508e0f9ee839
+          in: path
+          name: apiID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: cache invalidated
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Cache invalidated.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Invalidate cache for given API ID.
+      tags:
+        - JWK cache invalidation
+  /tyk/cache/jwks:
+    delete:
+      description: Invalidate JWK cache for all APIs.
+      operationId: invalidateJWKCacheForAllAPIs
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: cache invalidated
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Cache invalidated.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Invalidate JWK cache for all APIs
+      tags:
+        - JWK cache invalidation
+  /tyk/certs:
+    get:
+      description: List all certificates in the Tyk Gateway.
+      operationId: listCerts
+      parameters:
+      - description: Organisation ID to list the certificates.
+        example: 5e9d9544a1dcd60001d0ed20
+        in: query
+        name: org_id
+        required: false
+        schema:
+          type: string
+      - description: Mode to list the certificate details.
+        example: detailed
+        in: query
+        name: mode
+        required: false
+        schema:
+          enum:
+          - detailed
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                certIdList:
+                  $ref: '#/components/examples/certIdList'
+                certificateBasicList:
+                  $ref: '#/components/examples/certificateBasicList'
+              schema:
+                oneOf:
+                - $ref: '#/components/schemas/APIAllCertificateBasics'
+                - $ref: '#/components/schemas/APIAllCertificates'
+          description: OK
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: List certificates.
+      tags:
+      - Certs
+    post:
+      description: Add a certificate to the Tyk Gateway.
+      operationId: addCert
+      parameters:
+      - description: Organisation ID to add the certificate to.
+        example: 5e9d9544a1dcd60001d0ed20
+        in: query
+        name: org_id
+        required: false
+        schema:
+          type: string
+      requestBody:
+        content:
+          text/plain:
+            schema:
+              type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                id: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+                message: Certificate added
+                status: ok
+              schema:
+                $ref: '#/components/schemas/APICertificateStatusMessage'
+          description: New certificate added.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Certificate with  ID already exists.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: When certificates you send already exist in the gateway.
+        "405":
+          content:
+            application/json:
+              example:
+                message: Malformed request body
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Malformed request body.
+      summary: Add a certificate.
+      tags:
+      - Certs
+  /tyk/certs/{certID}:
+    delete:
+      description: Delete certificate by ID.
+      operationId: deleteCerts
+      parameters:
+      - description: Certificate ID to be deleted.
+        example: 5e9d9544a1dcd60001d0ed20a6ab77653d5da938f452bb8cc9b55b0630a6743dabd8dc92bfb025abb09ce035
+        in: path
+        name: certID
+        required: true
+        schema:
+          type: string
+      - description: Organisation ID to delete the certificates from.
+        example: 5e9d9544a1dcd60001d0ed20
+        in: query
+        name: org_id
+        required: false
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: removed
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Deleted certificate.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Delete certificate.
+      tags:
+      - Certs
+    get:
+      description: |-
+        Note that the certID path parameter can take a list of certIDs separated with commas (e.g /tyk/certs/certIDOne,certIDTwo).
+         If you send a single certID it will return a single CertificateMeta object otherwise if you send more than two certIDs is will return an array of certificateMeta objects.
+      operationId: listCertsWithIDs
+      parameters:
+      - description: Comma separated list of certificates to list.
+        example: e6ce2b49-3e31-44de-95a7-12f054724283,5e9d9544a1dcd60001d0ed20a6ab77653d5da938f452bb8cc9b55b0630a6743dabd8dc92bfb025abb09ce035
+        in: path
+        name: certID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                certificateMetaExample:
+                  $ref: '#/components/examples/certificateMetaExample'
+                certificateMetaListExample:
+                  $ref: '#/components/examples/certificateMetaListExample'
+              schema:
+                oneOf:
+                - $ref: '#/components/schemas/CertsCertificateMeta'
+                - items:
+                    $ref: '#/components/schemas/CertsCertificateMeta'
+                  nullable: true
+                  type: array
+          description: OK
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: Certificate with given SHA256 fingerprint not found.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Not Found
+      summary: Return one certificate or list multiple certificates in the Tyk Gateway
+        given a comma separated list of cert IDs.
+      tags:
+      - Certs
+  /tyk/debug:
+    post:
+      description: Used to test API definition by sending sample request and analysing
+        output of both response and logs.
+      operationId: debugApiDefinition
+      requestBody:
+        content:
+          application/json:
+            examples:
+              apiDefinition:
+                summary: Calling debug endpoint with classic API definition.
+                value:
+                  request:
+                    method: GET
+                    path: /update-listen-path
+                  spec:
+                    api_id: b84fe1a04e5648927971c0557971565c
+                    auth:
+                      auth_header_name: authorization
+                    definition:
+                      key: version
+                      location: header
+                    name: Tyk Test API
+                    org_id: 664a14650619d40001f1f00f
+                    proxy:
+                      listen_path: /tyk-api-test/
+                      strip_listen_path: true
+                      target_url: https://httpbin.org
+                    use_oauth2: true
+                    version_data:
+                      not_versioned: true
+                      versions:
+                        Default:
+                          name: Default
+              oasApiDefinition:
+                summary: Calling debug endpoint with Tyk OAS API definition.
+                value:
+                  request:
+                    method: GET
+                    path: /get
+                  oas:
+                      info:
+                        title: testdebug
+                        version: 1.0.0
+                      openapi: 3.0.3
+                      servers:
+                      - url: http://localhost:8181/testdebug/
+                      security: []
+                      paths: {}
+                      components:
+                        securitySchemes: {}
+                      x-tyk-api-gateway:
+                        info:
+                          dbId: 67a25ff65b60081c8731464f
+                          id: d37ea0e360c245cf406d640f1dbf788d
+                          orgId: 645b3db586341f751f4258aa
+                          name: testdebug
+                          state:
+                            active: true
+                            internal: false
+                        middleware:
+                          global:
+                            contextVariables:
+                              enabled: true
+                            trafficLogs:
+                              enabled: true
+                        server:
+                          listenPath:
+                            strip: true
+                            value: "/testdebug/"
+                        upstream:
+                          url: http://httpbin.org/
+                
+            schema:
+              $ref: '#/components/schemas/TraceRequest'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                logs: '{"level":"warning","msg":"Legacy path detected! Upgrade to
+                  extended....'
+                message: ok
+                response: "====== Request ======\nGET / HTTP/1.1\r\nHost: httpbin.org\r\n\r\n\n======
+                  Response..."
+              schema:
+                $ref: '#/components/schemas/TraceResponse'
+          description: Success tracing request.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: 'Unexpected failure:'
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Test a Tyk Classic or Tyk OAS API definition.
+      tags:
+      - Debug
+  /tyk/keys:
+    get:
+      description: List all the API keys.
+      operationId: listKeys
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiAllKeys'
+          description: List of all API keys.
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Disabled hashed key listing.
+      summary: List keys.
+      tags:
+      - Keys
+    post:
+      description: |-
+        Tyk will generate the access token based on the OrgID specified in the API Definition and a random UUID. This ensures that keys can be owned by different API Owners should segmentation be needed at an organisational level.
+         <br/><br/>
+          API keys without access_rights data will be written to all APIs on the system (this also means that they will be created across all SessionHandlers and StorageHandlers, it is recommended to always embed access_rights data in a key to ensure that only targeted APIs and their back-ends are written to.
+      operationId: addKey
+      parameters:
+      - description: When set to true the key_hash returned will be similar to the
+          un-hashed key name.
+        example: true
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: boolean
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                itachi-api:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi api
+                  limit:
+                    per: 60
+                    quota_max: 10000
+                    quota_remaining: 10000
+                    quota_renewal_rate: 3600
+                    rate: 1000
+                    throttle_interval: 10
+                    throttle_retry_limit: 10
+                  versions:
+                  - Default
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 5ead7120575961000181867e
+              date_created: "2024-08-09T14:40:34.87614+03:00"
+              enable_detailed_recording: true
+              last_updated: "1723203634"
+              meta_data:
+                new-update-key-sample: update-key-sample
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                update: sample policy update
+                user_type: mobile_user
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              quota_renews: 1.723207234e+09
+              rate: 1000
+              tags:
+              - security
+              - edge
+              - edge-eu
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: added
+                key: 5e9d9544a1dcd60001d0ed20a2290376f89846b798b7e5197584ef6d
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: New key added.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Failed to create key, ensure security settings are correct.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Create a key.
+      tags:
+      - Keys
+  /tyk/keys/{keyID}:
+    delete:
+      description: Deleting a key will remove it permanently from the system, however
+        analytics relating to that key will still be available.
+      operationId: deleteKey
+      parameters:
+      - description: Use the hash of the key as input instead of the full key.
+        example: false
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: boolean
+      - description: The key ID.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: deleted
+                key: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: Key deleted.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Failed to remove the key
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: There is no such key found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Key not found.
+      summary: Delete a key.
+      tags:
+      - Keys
+    get:
+      description: Get session info about the specified key. Should return up to date
+        rate limit and quota usage numbers.
+      operationId: getKey
+      parameters:
+      - description: Use the hash of the key as input instead of the full key.
+        example: true
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: boolean
+      - description: The key ID.
+        example: 5e9d9544a1dcd60001d0ed20e7f75f9e03534825b7aef9df749582e5
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                access_rights:
+                  itachi-api:
+                    allowed_urls:
+                    - methods:
+                      - GET
+                      url: /users
+                    api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                    api_name: Itachi api
+                    limit:
+                      per: 60
+                      quota_max: 10000
+                      quota_remaining: 10000
+                      quota_renewal_rate: 3600
+                      rate: 1000
+                      throttle_interval: 10
+                      throttle_retry_limit: 10
+                    versions:
+                    - Default
+                alias: portal-key
+                allowance: 1000
+                apply_policies:
+                - 5ead7120575961000181867e
+                date_created: "2024-08-09T14:40:34.87614+03:00"
+                enable_detailed_recording: true
+                last_updated: "1723203634"
+                meta_data:
+                  new-update-key-sample: update-key-sample
+                  tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                  update: sample policy update
+                  user_type: mobile_user
+                org_id: 5e9d9544a1dcd60001d0ed20
+                per: 60
+                quota_max: 10000
+                quota_renewal_rate: 3600
+                quota_renews: 1.723207234e+09
+                rate: 1000
+                tags:
+                - security
+                - edge
+                - edge-eu
+                throttle_interval: 10
+                throttle_retry_limit: 10
+              schema:
+                $ref: '#/components/schemas/SessionState'
+          description: Key fetched.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Key requested by hash but key hashing is not enabled.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: Key not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Key not found.
+      summary: Get a key with ID.
+      tags:
+      - Keys
+    post:
+      description: You can use this endpoint to import existing keys into Tyk or to
+        create a new custom key.
+      operationId: createCustomKey
+      parameters:
+      - description: Adding the suppress_reset parameter and setting it to 1, will
+          cause Tyk not to reset the quota limit that is in the current live quota
+          manager. By default Tyk will reset the quota in the live quota manager (initialising
+          it) when adding a key. Adding the `suppress_reset` flag to the URL parameters
+          will avoid this behaviour.
+        example: "1"
+        in: query
+        name: suppress_reset
+        required: false
+        schema:
+          enum:
+          - "1"
+          type: string
+      - description: When set to true the key_hash returned will be similar to the
+          un-hashed key name.
+        example: true
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: boolean
+      - description: Name to give the custom key.
+        example: customKey
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                itachi-api:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi api
+                  limit:
+                    per: 60
+                    quota_max: 10000
+                    quota_remaining: 10000
+                    quota_renewal_rate: 3600
+                    rate: 1000
+                    throttle_interval: 10
+                    throttle_retry_limit: 10
+                  versions:
+                  - Default
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 5ead7120575961000181867e
+              date_created: "2024-08-09T14:40:34.87614+03:00"
+              enable_detailed_recording: true
+              last_updated: "1723203634"
+              meta_data:
+                new-update-key-sample: update-key-sample
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                update: sample policy update
+                user_type: mobile_user
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              quota_renews: 1.723207234e+09
+              rate: 1000
+              tags:
+              - security
+              - edge
+              - edge-eu
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: added
+                key: 5e9d9544a1dcd60001d0ed20customKey
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: New custom key added.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Failed to create key, ensure security settings are correct.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Create custom key / Import key
+      tags:
+      - Keys
+    put:
+      description: ' You can also manually add keys to Tyk using your own key-generation
+        algorithm. It is recommended that when using this approach to ensure that
+        the OrgID being used in the API Definition and the key data is blank so that
+        Tyk does not try to prepend or manage the key in any way.'
+      operationId: updateKey
+      parameters:
+      - description: Adding the suppress_reset parameter and setting it to 1 will
+          cause Tyk not to reset the quota limit that is in the current live quota
+          manager. By default Tyk will reset the quota in the live quota manager (initialising
+          it) when adding a key. Adding the `suppress_reset` flag to the URL parameters
+          will avoid this behaviour.
+        example: "1"
+        in: query
+        name: suppress_reset
+        required: false
+        schema:
+          enum:
+          - "1"
+          type: string
+      - description: When set to true the key_hash returned will be similar to the
+          un-hashed key name.
+        example: true
+        in: query
+        name: hashed
+        required: false
+        schema:
+          type: boolean
+      - description: ID of the key you want to update.
+        example: 5e9d9544a1dcd60001d0ed20766d9a6ec6b4403b93a554feefef4708
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                itachi-api:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi api
+                  limit:
+                    per: 60
+                    quota_max: 10000
+                    quota_remaining: 10000
+                    quota_renewal_rate: 3600
+                    rate: 1000
+                    throttle_interval: 10
+                    throttle_retry_limit: 10
+                  versions:
+                  - Default
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 5ead7120575961000181867e
+              date_created: "2024-08-09T14:40:34.87614+03:00"
+              enable_detailed_recording: true
+              last_updated: "1723203634"
+              meta_data:
+                new-update-key-sample: update-key-sample
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                update: sample policy update
+                user_type: mobile_user
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              quota_renews: 1.723207234e+09
+              rate: 1000
+              tags:
+              - security
+              - edge
+              - edge-eu
+              - update-sample-tag
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: modified
+                key: 5e9d9544a1dcd60001d0ed20766d9a6ec6b4403b93a554feefef4708
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: Key updated.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: Key is not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Key not found.
+        "500":
+          content:
+            application/json:
+              example:
+                message: Failed to create key, ensure security settings are correct.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Update key.
+      tags:
+      - Keys
+  /tyk/keys/create:
+    post:
+      description: Create a key.
+      operationId: createKey
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                itachi-api:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi api
+                  limit:
+                    per: 60
+                    quota_max: 10000
+                    quota_remaining: 10000
+                    quota_renewal_rate: 3600
+                    rate: 1000
+                    throttle_interval: 10
+                    throttle_retry_limit: 10
+                  versions:
+                  - Default
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 5ead7120575961000181867e
+              date_created: "2024-08-09T14:40:34.87614+03:00"
+              enable_detailed_recording: true
+              last_updated: "1723203634"
+              meta_data:
+                new-update-key-sample: update-key-sample
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                update: sample policy update
+                user_type: mobile_user
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              quota_renews: 1.723207234e+09
+              rate: 1000
+              tags:
+              - security
+              - edge
+              - edge-eu
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: added
+                key: 5e9d9544a1dcd60001d0ed207eb558517c3c48fb826c62cc6f6161eb
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: Key created.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Failed to create key, keys must have at least one Access
+                  Rights record set.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: No access right.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Unmarshalling failed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Malformed body.
+      summary: Create a key.
+      tags:
+      - Keys
+  /tyk/keys/policy/{keyID}:
+    post:
+      description: This will set policies to a hashed key.
+      operationId: setPoliciesToHashedKey
+      parameters:
+      - description: Name to give the custom key.
+        example: 5e9d9544a1dcd60001d0ed207eb558517c3c48fb826c62cc6f6161eb
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              apply_policies:
+              - 5ead7120575961000181867e
+              policy: ""
+            schema:
+              $ref: '#/components/schemas/PolicyUpdateObj'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: updated
+                key: 5e9d9544a1dcd60001d0ed207eb558517c3c48fb826c62cc6f6161eb
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: Updated hashed key.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Couldn't decode instruction
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Malformed request body.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: Key not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Key not found.
+        "500":
+          content:
+            application/json:
+              example:
+                message: Could not write key data.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Set policies for a hashed key.
+      tags:
+      - Keys
+  /tyk/keys/preview:
+    post:
+      description: This will check if the body of a key definition is valid. And return
+        a response with how the key would look like if you were to create it.
+      operationId: validateAKeyDefinition
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                itachi-api:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi api
+                  limit:
+                    per: 60
+                    quota_max: 10000
+                    quota_remaining: 10000
+                    quota_renewal_rate: 3600
+                    rate: 1000
+                    throttle_interval: 10
+                    throttle_retry_limit: 10
+                  versions:
+                  - Default
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 5ead7120575961000181867e
+              date_created: "2024-08-09T14:40:34.87614+03:00"
+              enable_detailed_recording: true
+              last_updated: "1723203634"
+              meta_data:
+                new-update-key-sample: update-key-sample
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                update: sample policy update
+                user_type: mobile_user
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              quota_renews: 1.723207234e+09
+              rate: 1000
+              tags:
+              - security
+              - edge
+              - edge-eu
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                access_rights:
+                  itachi-api:
+                    allowed_urls:
+                    - methods:
+                      - GET
+                      url: /users
+                    api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                    api_name: Itachi api
+                    limit:
+                      per: 60
+                      quota_max: 10000
+                      quota_remaining: 10000
+                      quota_renewal_rate: 3600
+                      rate: 1000
+                      throttle_interval: 10
+                      throttle_retry_limit: 10
+                    versions:
+                    - Default
+                alias: portal-key
+                allowance: 1000
+                apply_policies:
+                - 5ead7120575961000181867e
+                date_created: "2024-08-09T14:40:34.87614+03:00"
+                enable_detailed_recording: true
+                last_updated: "1723203634"
+                meta_data:
+                  new-update-key-sample: update-key-sample
+                  tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                  update: sample policy update
+                  user_type: mobile_user
+                org_id: 5e9d9544a1dcd60001d0ed20
+                per: 60
+                quota_max: 10000
+                quota_renewal_rate: 3600
+                quota_renews: 1.723207234e+09
+                rate: 1000
+                tags:
+                - security
+                - edge
+                - edge-eu
+                throttle_interval: 10
+                throttle_retry_limit: 10
+              schema:
+                $ref: '#/components/schemas/SessionState'
+          description: Key definition is valid.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Unmarshalling failed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: This will validate a key definition.
+      tags:
+      - Keys
+  /tyk/oauth/clients/{apiID}:
+    get:
+      description: OAuth Clients are organised by API ID, and therefore are queried
+        as such.
+      operationId: listOAuthClients
+      parameters:
+      - description: The API ID
+        example: 1bd5c61b0e694082902cf15ddcc9e6a7
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+              - api_id: b84fe1a04e5648927971c0557971565c
+                client_id: 2a06b398c17f46908de3dffcb71ef87df
+                description: google client
+                meta_data:
+                  user_id: 362b3fb9a1d5e4f00017226f5
+                redirect_uri: https://httpbin.org/ip
+                secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+              schema:
+                items:
+                  $ref: '#/components/schemas/NewClientRequest'
+                type: array
+          description: Get OAuth client details or a list of OAuth clients
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          description: Api no found
+      summary: List oAuth clients
+      tags:
+      - OAuth
+  /tyk/oauth/clients/{apiID}/{keyName}:
+    delete:
+      description: Please note that tokens issued with the client ID will still be
+        valid until they expire.
+      operationId: deleteOAuthClient
+      parameters:
+      - description: The API id
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - description: The Client ID
+        example: 2a06b398c17f46908de3dffcb71ef87df
+        in: path
+        name: keyName
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: deleted
+                key: 2a06b398c17f46908de3dffcb71ef87df
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: OAuth client deleted
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: OAuth Client ID not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Not found
+        "500":
+          content:
+            application/json:
+              example:
+                message: Delete failed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Delete OAuth client
+      tags:
+      - OAuth
+    get:
+      description: Get OAuth client details tied to an api
+      operationId: getOAuthClient
+      parameters:
+      - description: The API id
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - description: The Client ID
+        example: 2a06b398c17f46908de3dffcb71ef87df
+        in: path
+        name: keyName
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                client_id: 2a06b398c17f46908de3dffcb71ef87df
+                description: changed description sample
+                meta_data:
+                  user_id: 362b3fb9a1d5e4f00017226f5
+                redirect_uri: https://httpbin.org/ip
+                secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+              schema:
+                $ref: '#/components/schemas/NewClientRequest'
+          description: OAuth client details
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: OAuth Client ID not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: OAuth Client not found
+      summary: Get OAuth client
+      tags:
+      - OAuth
+    put:
+      description: Allows you to update the metadata,redirecturi,description and Policy
+        ID for an OAuth client.
+      operationId: updateOAuthClient
+      parameters:
+      - description: The API id
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - description: The Client ID
+        example: 2a06b398c17f46908de3dffcb71ef87df
+        in: path
+        name: keyName
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              api_id: b84fe1a04e5648927971c0557971565c
+              client_id: 2a06b398c17f46908de3dffcb71ef87df
+              description: changed description sample
+              meta_data:
+                user_id: 362b3fb9a1d5e4f00017226f5
+              redirect_uri: https://httpbin.org/ip
+              secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+            schema:
+              $ref: '#/components/schemas/NewClientRequest'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                client_id: 2a06b398c17f46908de3dffcb71ef87df
+                description: changed description sample
+                meta_data:
+                  user_id: 362b3fb9a1d5e4f00017226f5
+                redirect_uri: https://httpbin.org/ip
+                secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+              schema:
+                $ref: '#/components/schemas/NewClientRequest'
+          description: OAuth client updated
+        "400":
+          content:
+            application/json:
+              example:
+                message: Policy access rights doesn't contain API this OAuth client
+                  belongs to
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API doesn't exist
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                message: Unmarshalling failed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: malformed request body
+      summary: Update OAuth metadata,redirecturi,description and Policy ID
+      tags:
+      - OAuth
+  /tyk/oauth/clients/{apiID}/{keyName}/rotate:
+    put:
+      description: Generate a new secret
+      operationId: rotateOauthClient
+      parameters:
+      - description: The API id
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - description: The Client ID
+        example: 2a06b398c17f46908de3dffcb71ef87df
+        in: path
+        name: keyName
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                client_id: 2a06b398c17f46908de3dffcb71ef87df
+                description: google client
+                meta_data:
+                  user_id: 362b3fb9a1d5e4f00017226f5
+                redirect_uri: https://httpbin.org/ip
+                secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+              schema:
+                $ref: '#/components/schemas/NewClientRequest'
+          description: New secret has been created
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API doesn't exist
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                message: Failure in storing client data
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Rotate the oath client secret
+      tags:
+      - OAuth
+  /tyk/oauth/clients/{apiID}/{keyName}/tokens:
+    get:
+      description: |-
+        This endpoint allows you to retrieve a list of all current tokens and their expiry date for a provided API ID and OAuth-client ID .If page query parameter is sent the tokens will be paginated. This endpoint will work only for newly created tokens.
+                <br/>
+                <br/>
+                You can control how long you want to store expired tokens in this list using `oauth_token_expired_retain_period` gateway option, which specifies retain period for expired tokens stored in Redis. By default expired token not get removed. See <a href="https://tyk.io/docs/configure/tyk-gateway-configuration-options/#a-name-oauth-token-expired-retain-period-a-oauth-token-expired-retain-period" target="_blank">here</a> for more details.
+      operationId: getOAuthClientTokens
+      parameters:
+      - description: The API id
+        example: b84fe1a04e5648927971c0557971565c
+        in: path
+        name: apiID
+        required: true
+        schema:
+          type: string
+      - description: The Client ID
+        example: 2a06b398c17f46908de3dffcb71ef87df
+        in: path
+        name: keyName
+        required: true
+        schema:
+          type: string
+      - description: Use page query parameter to say which page number you want returned.
+        example: 1
+        in: query
+        name: page
+        required: false
+        schema:
+          default: 1
+          type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                paginatedTokenExample:
+                  $ref: '#/components/examples/paginatedTokenExample'
+                tokenListExample:
+                  $ref: '#/components/examples/tokenListExample'
+              schema:
+                oneOf:
+                - $ref: '#/components/schemas/PaginatedOAuthClientTokens'
+                - items:
+                    $ref: '#/components/schemas/OAuthClientToken'
+                  nullable: true
+                  type: array
+          description: Tokens returned successfully.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: OAuth Client ID not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: OAuth Client ID not found
+        "500":
+          content:
+            application/json:
+              example:
+                message: Get client tokens failed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: List tokens for a provided API ID and OAuth-client ID
+      tags:
+      - OAuth
+  /tyk/oauth/clients/apis/{appID}:
+    get:
+      description: Get all API IDs for APIs that have use_oauth2 enabled and use the
+        client_id (appID) specified in the path parameter for OAuth2. You can use
+        the org_id query parameter to specify from which organization you want the
+        API IDs to be returned. To return APIs from all organizations, send org_id
+        as an empty string.
+      operationId: getApisForOauthApp
+      parameters:
+      - description: The Client ID
+        example: 2a06b398c17f46908de3dffcb71ef87df
+        in: path
+        name: appID
+        required: true
+        schema:
+          type: string
+      - description: The Org Id
+        in: query
+        name: orgID
+        required: false
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+              - b84fe1a04e5648927971c0557971565c
+              schema:
+                items:
+                  type: string
+                type: array
+          description: Return an array of apis ids
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Get API IDs for APIS that use the specified client_id(appID) for OAuth
+      tags:
+      - OAuth
+  /tyk/oauth/clients/create:
+    post:
+      description: |
+        Any OAuth keys must be generated with the help of a client ID. These need to be pre-registered with Tyk before they can be used (in a similar vein to how you would register your app with Twitter before attempting to ask user permissions using their API).
+                <br/><br/>
+                <h3>Creating OAuth clients with Access to Multiple APIs</h3>
+                New from Tyk Gateway 2.6.0 is the ability to create OAuth clients with access to more than one API. If you provide the api_id it works the same as in previous releases. If you don't provide the api_id the request uses policy access rights and enumerates APIs from their setting in the newly created OAuth-client.
+      operationId: createOAuthClient
+      requestBody:
+        content:
+          application/json:
+            example:
+              api_id: b84fe1a04e5648927971c0557971565c
+              client_id: 2a06b398c17f46908de3dffcb71ef87df
+              description: google client
+              meta_data:
+                user_id: 362b3fb9a1d5e4f00017226f5
+              redirect_uri: https://httpbin.org/ip
+              secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+            schema:
+              $ref: '#/components/schemas/NewClientRequest'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                client_id: 2a06b398c17f46908de3dffcb71ef87df
+                description: google client
+                meta_data:
+                  user_id: 362b3fb9a1d5e4f00017226f5
+                redirect_uri: https://httpbin.org/ip
+                secret: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+              schema:
+                $ref: '#/components/schemas/NewClientRequest'
+          description: Client created
+        "400":
+          content:
+            application/json:
+              example:
+                message: API doesn't exist
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Api Not found
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Unmarshalling failed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Unmarshalling failed
+      summary: Create new OAuth client
+      tags:
+      - OAuth
+  /tyk/oauth/refresh/{keyName}:
+    delete:
+      description: It is possible to invalidate refresh tokens in order to manage
+        OAuth client access more robustly.
+      operationId: invalidateOAuthRefresh
+      parameters:
+      - description: The Client ID
+        example: 2a06b398c17f46908de3dffcb71ef87df
+        in: path
+        name: keyName
+        required: true
+        schema:
+          type: string
+      - description: The API id
+        example: b84fe1a04e5648927971c0557971565c
+        in: query
+        name: api_id
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: deleted
+                key: 2a06b398c17f46908de3dffcb71ef87df
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: Deleted
+        "400":
+          content:
+            application/json:
+              example:
+                message: Missing parameter api_id
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: missing api_Id query parameter
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: API for this refresh token not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                message: Failed to invalidate refresh token
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Invalidate OAuth refresh token
+      tags:
+      - OAuth
+  /tyk/oauth/revoke:
+    post:
+      description: revoke a single token
+      operationId: revokeSingleToken
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              properties:
+                client_id:
+                  description: id of oauth client
+                  example: 2a06b398c17f46908de3dffcb71ef87df
+                  type: string
+                org_id:
+                  example: 6492f66e6ebbc56c6a6bf022
+                  type: string
+                token:
+                  description: token to be revoked
+                  example: eyJvcmciOiI1ZTIwOTFjNGQ0YWVmY2U2MGMwNGZiOTIiLCJpZCI6IjIyODQ1NmFjNmJlMjRiMzI5MTIyOTdlODQ5NTc4NjJhIiwiaCI6Im11cm11cjY0In0=
+                  type: string
+                token_type_hint:
+                  description: type of token to be revoked, if sent then the accepted
+                    values are access_token and refresh_token. String value and optional,
+                    of not provided then it will attempt to remove access and refresh
+                    tokens that matches
+                  example: access_token
+                  type: string
+              required:
+              - token
+              - client_id
+              type: object
+        description: token revoked successfully
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: token revoked successfully
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: token revoked
+        "400":
+          content:
+            application/json:
+              example:
+                message: cannot parse form. Form malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: malformed form data
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: revoke token
+      tags:
+      - OAuth
+  /tyk/oauth/revoke_all:
+    post:
+      description: Revoke all the tokens for a given oauth client
+      operationId: revokeAllTokens
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              properties:
+                client_id:
+                  description: id of oauth client
+                  example: 2a06b398c17f46908de3dffcb71ef87df
+                  type: string
+                client_secret:
+                  description: OAuth client secret to ensure that its a valid operation
+                  example: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+                  type: string
+                org_id:
+                  example: 6492f66e6ebbc56c6a6bf022
+                  type: string
+              required:
+              - client_secret
+              - client_id
+              type: object
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: tokens revoked successfully
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: tokens revoked
+        "400":
+          content:
+            application/json:
+              example:
+                message: cannot parse form. Form malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              example:
+                message: client_id is required
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: missing client id
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: oauth client doesn't exist
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: not found
+      summary: Revoke all client's tokens
+      tags:
+      - OAuth
+  /tyk/oauth/tokens:
+    delete:
+      description: Purge all lapsed OAuth token
+      operationId: purgeLapsedOAuthTokens
+      parameters:
+      - description: purge lapsed tokens
+        example: lapsed
+        in: query
+        name: scope
+        required: true
+        schema:
+          enum:
+          - lapsed
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: lapsed tokens purged
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: lapsed tokens purged successfully
+        "400":
+          content:
+            application/json:
+              example:
+                message: unknown scope
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Sending a value other than lapsed in scope query
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "422":
+          content:
+            application/json:
+              example:
+                message: scope parameter is required
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Missing lapsed query parameter
+        "500":
+          content:
+            application/json:
+              example:
+                message: error purging lapsed tokens
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Purge lapsed OAuth tokens
+      tags:
+      - OAuth
+  /tyk/org/keys:
+    get:
+      description: You can now set rate limits at the organisation level by using
+        the following fields - allowance and rate. These are the number of allowed
+        requests for the specified per value, and need to be set to the same value.
+        If you don't want to have organisation level rate limiting, set 'rate' or
+        'per' to zero, or don't add them to your request.
+      operationId: listOrgKeys
+      parameters:
+      - description: Retrieves all keys starting with the specified filter(filter
+          is a prefix - e.g. default* or default will return all keys starting with
+          default  like defaultbd,defaulttwo etc).We don't use filter for hashed keys
+        example: default*
+        in: query
+        name: filter
+        required: false
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                keys:
+                - 5e9d9544a1dcd60001d0ed2008500e44fa644f939b640a4b8b4ea58c
+              schema:
+                $ref: '#/components/schemas/ApiAllKeys'
+          description: List of all org keys
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: ORG not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: ORG not found
+      summary: List Organisation Keys
+      tags:
+      - Organisation Quotas
+  /tyk/org/keys/{keyID}:
+    delete:
+      description: Deleting a key will remove all limits from organisation. It does
+        not affects regular keys created within organisation.
+      operationId: deleteOrgKey
+      parameters:
+      - description: The Key ID
+        example: e389ae00a2b145feaf28d6cc11f0f86d
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: deleted
+                key: e389ae00a2b145feaf28d6cc11f0f86d
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                message: Failed to remove the key
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: Org not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Org not found
+      summary: Delete Key
+      tags:
+      - Organisation Quotas
+    get:
+      description: Get session info about specified organisation key. Should return
+        up to date rate limit and quota usage numbers.
+      operationId: getOrgKey
+      parameters:
+      - description: The Org ID
+        example: 664a14650619d40001f1f00f
+        in: query
+        name: orgID
+        required: false
+        schema:
+          type: string
+      - description: The Key ID
+        example: e389ae00a2b145feaf28d6cc11f0f86d
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                access_rights:
+                  itachi-api:
+                    allowed_urls:
+                    - methods:
+                      - GET
+                      url: /users
+                    api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                    api_name: Itachi api
+                    limit:
+                      per: 60
+                      quota_max: 10000
+                      quota_remaining: 10000
+                      quota_renewal_rate: 3600
+                      rate: 1000
+                      throttle_interval: 10
+                      throttle_retry_limit: 10
+                    versions:
+                    - Default
+                alias: portal-key
+                allowance: 1000
+                apply_policies:
+                - 5ead7120575961000181867e
+                date_created: "2024-08-09T14:40:34.87614+03:00"
+                enable_detailed_recording: true
+                last_updated: "1723203634"
+                meta_data:
+                  new-update-key-sample: update-key-sample
+                  tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                  update: sample policy update
+                  user_type: mobile_user
+                org_id: 5e9d9544a1dcd60001d0ed20
+                per: 60
+                quota_max: 10000
+                quota_renewal_rate: 3600
+                quota_renews: 1.723207234e+09
+                rate: 1000
+                tags:
+                - security
+                - edge
+                - edge-eu
+                throttle_interval: 10
+                throttle_retry_limit: 10
+              schema:
+                properties:
+                  access_rights:
+                    additionalProperties:
+                      properties:
+                        allowed_urls:
+                          items:
+                            properties:
+                              methods:
+                                items:
+                                  type: string
+                                nullable: true
+                                type: array
+                              url:
+                                type: string
+                            type: object
+                          nullable: true
+                          type: array
+                        api_id:
+                          type: string
+                        api_name:
+                          type: string
+                        limit:
+                          properties:
+                            per:
+                              type: integer
+                            quota_max:
+                              type: integer
+                            quota_remaining:
+                              type: integer
+                            quota_renewal_rate:
+                              type: integer
+                            rate:
+                              type: integer
+                            throttle_interval:
+                              type: integer
+                            throttle_retry_limit:
+                              type: integer
+                          type: object
+                        versions:
+                          items:
+                            type: string
+                          nullable: true
+                          type: array
+                      type: object
+                    nullable: true
+                    type: object
+                  alias:
+                    type: string
+                  allowance:
+                    type: integer
+                  apply_policies:
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  date_created:
+                    format: date-time
+                    type: string
+                  enable_detailed_recording:
+                    type: boolean
+                  last_updated:
+                    type: string
+                  meta_data:
+                    additionalProperties:
+                      type: string
+                    nullable: true
+                    type: object
+                  org_id:
+                    type: string
+                  per:
+                    type: integer
+                  quota_max:
+                    type: integer
+                  quota_renewal_rate:
+                    type: integer
+                  quota_renews:
+                    type: integer
+                  rate:
+                    type: integer
+                  tags:
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  throttle_interval:
+                    type: integer
+                  throttle_retry_limit:
+                    type: integer
+                type: object
+          description: OK
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: Org not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Org not found
+      summary: Get an Organisation Key
+      tags:
+      - Organisation Quotas
+    post:
+      description: This work similar to Keys API except that Key ID is always equals
+        Organisation ID
+      operationId: addOrgKey
+      parameters:
+      - description: The Key ID
+        example: e389ae00a2b145feaf28d6cc11f0f86d
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      - description: Adding the reset_quota parameter and setting it to 1, will cause
+          Tyk reset the organisations quota in the live quota manager, it is recommended
+          to use this mechanism to reset organisation-level access if a monthly subscription
+          is in place.
+        example: "1"
+        in: query
+        name: reset_quota
+        required: false
+        schema:
+          enum:
+          - "1"
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                itachi-api:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi api
+                  limit:
+                    per: 60
+                    quota_max: 10000
+                    quota_remaining: 10000
+                    quota_renewal_rate: 3600
+                    rate: 1000
+                    throttle_interval: 10
+                    throttle_retry_limit: 10
+                  versions:
+                  - Default
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 5ead7120575961000181867e
+              date_created: "2024-08-09T14:40:34.87614+03:00"
+              enable_detailed_recording: true
+              last_updated: "1723203634"
+              meta_data:
+                new-update-key-sample: update-key-sample
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                update: sample policy update
+                user_type: mobile_user
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              quota_renews: 1.723207234e+09
+              rate: 1000
+              tags:
+              - security
+              - edge
+              - edge-eu
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: added
+                key: e389ae00a2b145feaf28d6cc11f0f86d
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: No such organisation found in Active API list
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                message: 'Error writing to key store '
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Create an organisation key
+      tags:
+      - Organisation Quotas
+    put:
+      description: |-
+        This work similar to Keys API except that Key ID is always equals Organisation ID
+
+        For Gateway v2.6.0 onwards, you can now set rate limits at the organisation level by using the following fields - allowance and rate. These are the number of allowed requests for the specified per value, and need to be set to the same value. If you don't want to have organisation level rate limiting, set `rate` or `per` to zero, or don't add them to your request.
+      operationId: updateOrgKey
+      parameters:
+      - description: Adding the reset_quota parameter and setting it to 1, will cause
+          Tyk reset the organisations quota in the live quota manager, it is recommended
+          to use this mechanism to reset organisation-level access if a monthly subscription
+          is in place.
+        example: "1"
+        in: query
+        name: reset_quota
+        required: false
+        schema:
+          enum:
+          - "1"
+          type: string
+      - description: The Key ID
+        example: e389ae00a2b145feaf28d6cc11f0f86d
+        in: path
+        name: keyID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                itachi-api:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi api
+                  limit:
+                    per: 60
+                    quota_max: 10000
+                    quota_remaining: 10000
+                    quota_renewal_rate: 3600
+                    rate: 1000
+                    throttle_interval: 10
+                    throttle_retry_limit: 10
+                  versions:
+                  - Default
+              alias: portal-key
+              allowance: 1000
+              apply_policies:
+              - 5ead7120575961000181867e
+              date_created: "2024-08-09T14:40:34.87614+03:00"
+              enable_detailed_recording: true
+              last_updated: "1723203634"
+              meta_data:
+                new-update-key-sample: update-key-sample
+                tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+                update: sample policy update
+                user_type: mobile_user
+              org_id: 5e9d9544a1dcd60001d0ed20
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              quota_renews: 1.723207234e+09
+              rate: 1000
+              tags:
+              - security
+              - edge
+              - edge-eu
+              - update-sample-tag
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/SessionState'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: OK
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: No such organisation found in Active API list
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              example:
+                message: 'Error writing to key store '
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Update Organisation Key
+      tags:
+      - Organisation Quotas
+  /tyk/policies:
+    get:
+      description: Retrieve all the policies in your Tyk instance. Returns an array
+        policies.
+      operationId: listPolicies
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                policiesExample:
+                  $ref: '#/components/examples/policiesExample'
+              schema:
+                items:
+                  $ref: '#/components/schemas/Policy'
+                type: array
+          description: List of all policies.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: List policies.
+      tags:
+      - Policies
+    post:
+      description: Create a policy in your Tyk Instance.
+      operationId: addPolicy
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                8ddd91f3cda9453442c477b06c4e2da4:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi api
+                  disable_introspection: false
+                  versions:
+                  - Default
+              active: true
+              hmac_enabled: false
+              id: 5ead7120575961000181867e
+              is_inactive: false
+              key_expires_in: 2.592e+06
+              max_query_depth: -1
+              meta_data:
+                update: sample policy update
+                user_type: mobile_user
+              name: Sample policy
+              partitions:
+                acl: true
+                complexity: false
+                per_api: false
+                quota: true
+                rate_limit: true
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              rate: 1000
+              tags:
+              - security
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/Policy'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: added
+                key: 5ead7120575961000181867e
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: Policy created.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Malformed request.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Due to enabled service policy source, please use the Dashboard
+                  API.
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Create a policy.
+      tags:
+      - Policies
+  /tyk/policies/{polID}:
+    delete:
+      description: Delete a policy by ID in your Tyk instance.
+      operationId: deletePolicy
+      parameters:
+      - description: You can retrieve details of a single policy by ID in your Tyk
+          instance.
+        example: 5ead7120575961000181867e
+        in: path
+        name: polID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: deleted
+                key: 5ead7120575961000181867e
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: Deleted policy by ID
+        "400":
+          content:
+            application/json:
+              example:
+                message: Must specify an apiID to update
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Policy Id not provided
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Delete failed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Delete a policy.
+      tags:
+      - Policies
+    get:
+      description: You can retrieve details of a single policy by ID in your Tyk instance.
+      operationId: getPolicy
+      parameters:
+      - description: You can retrieve details of a single policy by ID in your Tyk
+          instance.
+        example: 5ead7120575961000181867e
+        in: path
+        name: polID
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                access_rights:
+                  8ddd91f3cda9453442c477b06c4e2da4:
+                    allowed_urls:
+                    - methods:
+                      - GET
+                      url: /users
+                    api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                    api_name: Itachi api
+                    disable_introspection: false
+                    versions:
+                    - Default
+                active: true
+                hmac_enabled: false
+                id: 5ead7120575961000181867e
+                is_inactive: false
+                key_expires_in: 2.592e+06
+                max_query_depth: -1
+                meta_data:
+                  update: sample policy update
+                  user_type: mobile_user
+                name: Sample policy
+                partitions:
+                  acl: true
+                  complexity: false
+                  per_api: false
+                  quota: true
+                  rate_limit: true
+                per: 60
+                quota_max: 10000
+                quota_renewal_rate: 3600
+                rate: 1000
+                tags:
+                - security
+                throttle_interval: 10
+                throttle_retry_limit: 10
+              schema:
+                $ref: '#/components/schemas/Policy'
+          description: Get details of a single policy.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: Policy not found
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Policy not found
+      summary: Get a policy.
+      tags:
+      - Policies
+    put:
+      description: You can update a Policy in your Tyk Instance by ID.
+      operationId: updatePolicy
+      parameters:
+      - description: You can retrieve details of a single policy by ID in your Tyk
+          instance.
+        example: 5ead7120575961000181867e
+        in: path
+        name: polID
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              access_rights:
+                8ddd91f3cda9453442c477b06c4e2da4:
+                  allowed_urls:
+                  - methods:
+                    - GET
+                    url: /users
+                  api_id: 8ddd91f3cda9453442c477b06c4e2da4
+                  api_name: Itachi api
+                  disable_introspection: false
+                  versions:
+                  - Default
+              active: true
+              hmac_enabled: false
+              id: 5ead7120575961000181867e
+              is_inactive: false
+              key_expires_in: 2.592e+06
+              max_query_depth: -1
+              meta_data:
+                update: sample policy update
+                user_type: mobile_user
+              name: update policy sample
+              partitions:
+                acl: true
+                complexity: false
+                per_api: false
+                quota: true
+                rate_limit: true
+              per: 60
+              quota_max: 10000
+              quota_renewal_rate: 3600
+              rate: 1000
+              tags:
+              - security
+              throttle_interval: 10
+              throttle_retry_limit: 10
+            schema:
+              $ref: '#/components/schemas/Policy'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                action: modified
+                key: 5ead7120575961000181867e
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiModifyKeySuccess'
+          description: Policy updated
+        "400":
+          content:
+            application/json:
+              example:
+                message: Request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: malformed request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              example:
+                message: Failed to create file!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Internal server error.
+      summary: Update a policy.
+      tags:
+      - Policies
+  /tyk/reload:
+    get:
+      description: Tyk is capable of reloading configurations without having to stop
+        serving requests. This means that API configurations can be added at runtime,
+        or even modified at runtime and those rules applied immediately without any
+        downtime.
+      operationId: hotReload
+      parameters:
+      - description: Block a response until the reload is performed. This can be useful
+          in scripting environments like CI/CD workflows.
+        example: false
+        in: query
+        name: block
+        required: false
+        schema:
+          type: boolean
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: ""
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Reload gateway.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Hot-reload a single node.
+      tags:
+      - Hot Reload
+  /tyk/reload/group:
+    get:
+      description: To reload a whole group of Tyk nodes (without using the Dashboard
+        or host manager). You can send an API request to a single node, this node
+        will then send a notification through the pub/sub infrastructure to all other
+        listening nodes (including the host manager if it is being used to manage
+        Nginx) which will then trigger a global reload.
+      operationId: hotReloadGroup
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: ""
+                status: ok
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Reload the Tyk Gateway.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Hot-reload a group of Tyk nodes.
+      tags:
+      - Hot Reload
+  /{listen_path}/tyk/batch:
+    post:
+      description: Endpoint to run batch request.
+      operationId: batch
+      parameters:
+        - description: API listen path
+          example: get
+          in: path
+          name: listen_path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            example:
+              requests:
+                - body: ""
+                  headers:
+                    authorization: 1dbc83b9c431649d7698faa9797e2900f
+                    x-tyk-test: "1"
+                    x-tyk-version: "1.2"
+                  method: GET
+                  relative_url: get
+                - body: ""
+                  headers:
+                    authorization: 1dbc83b9c431649d7698faa9797e2900f
+                    x-tyk-test: "2"
+                    x-tyk-version: "1.2"
+                  method: GET
+                  relative_url: get
+              suppress_parallel_execution: false
+            schema:
+              $ref: '#/components/schemas/BatchRequestStructure'
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                - body: '{"message": "success"}'
+                  code: 200
+                  headers:
+                    Access-Control-Allow-Credentials:
+                      - "true"
+                    Content-Type:
+                      - application/json
+                  relative_url: get
+              schema:
+                items:
+                  $ref: '#/components/schemas/BatchReplyUnit'
+                type: array
+          description: Success.
+        "400":
+          content:
+            application/json:
+              example:
+                message: Batch request malformed
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+      summary: Run batch request.
+      tags:
+        - Batch requests
+  /tyk/schema:
+    get:
+      description: Get OAS schema definition using a version.
+      operationId: getSchema
+      parameters:
+      - description: The OAS version to fetch.
+        example: 3.0.3
+        in: query
+        name: oasVersion
+        required: false
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              example:
+                message: ""
+                status: Success
+              schema:
+                $ref: '#/components/schemas/OASSchemaResponse'
+          description: OAS schema response.
+        "403":
+          content:
+            application/json:
+              example:
+                message: Attempted administrative access with invalid or missing key!
+                status: error
+              schema:
+                $ref: '#/components/schemas/ApiStatusMessage'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              example:
+                message: Schema not found for version "4"
+                status: Failed
+              schema:
+                $ref: '#/components/schemas/OASSchemaResponse'
+          description: Version not found
+      summary: Get OAS schema.
+      tags:
+      - Schema
+components:
+  examples:
+    certIdList:
+      value:
+        certs:
+        - 5e9d9544a1dcd60001d0ed20a6ab77653d5da938f452bb8cc9b55b0630a6743dabd8dc92bfb025abb09ce035
+        - 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+    certificateBasicList:
+      value:
+        certs:
+        - dns_names:
+          - example.com
+          - www.example.com
+          has_private: true
+          id: 5e9d9544a1dcd60001d0ed20a6ab77653d5da938f452bb8cc9b55b0630a6743dabd8dc92bfb025abb09ce035
+          is_ca: false
+          issuer_cn: Issuer 1
+          not_after: "2024-01-01T00:00:00Z"
+          not_before: "2023-01-01T00:00:00Z"
+          subject_cn: Subject 1
+        - dns_names:
+          - example.org
+          - www.example.org
+          has_private: false
+          id: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+          is_ca: true
+          issuer_cn: Issuer 2
+          not_after: "2024-02-01T00:00:00Z"
+          not_before: "2023-02-01T00:00:00Z"
+          subject_cn: Subject 2
+    certificateMetaExample:
+      value:
+        dns_names:
+        - .*tyk.io
+        fingerprint: 7c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+        has_private: false
+        id: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+        is_ca: false
+        issuer:
+          CommonName: tyk.io
+          Country:
+          - Peachtree
+          ExtraNames: null
+          Locality: null
+          Names:
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 6
+            Value: Peachtree
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 10
+            Value: tyk
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 11
+            Value: tyk
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 3
+            Value: tyk.io
+          - Type:
+            - 1
+            - 2
+            - 840
+            - 113549
+            - 1
+            - 9
+            - 1
+            Value: support@tyk.io
+          Organization:
+          - tyk
+          OrganizationalUnit:
+          - tyk
+          PostalCode: null
+          Province: null
+          SerialNumber: ""
+          StreetAddress: null
+        not_after: "2034-03-26T08:46:37Z"
+        not_before: "2024-03-25T08:46:37Z"
+        subject:
+          CommonName: tyk.io
+          Country:
+          - Peachtree
+          ExtraNames: null
+          Locality: null
+          Names:
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 6
+            Value: Peachtree
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 10
+            Value: tyk
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 11
+            Value: tyk
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 3
+            Value: tyk.io
+          - Type:
+            - 1
+            - 2
+            - 840
+            - 113549
+            - 1
+            - 9
+            - 1
+            Value: support@tyk.io
+          Organization:
+          - tyk
+          OrganizationalUnit:
+          - tyk
+          PostalCode: null
+          Province: null
+          SerialNumber: ""
+          StreetAddress: null
+    certificateMetaListExample:
+      value:
+      - dns_names:
+        - .*tyk.io
+        fingerprint: 7c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+        has_private: false
+        id: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+        is_ca: false
+        issuer:
+          CommonName: tyk.io
+          Country:
+          - Peachtree
+          ExtraNames: null
+          Locality: null
+          Names:
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 6
+            Value: Peachtree
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 10
+            Value: tyk
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 11
+            Value: tyk
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 3
+            Value: tyk.io
+          - Type:
+            - 1
+            - 2
+            - 840
+            - 113549
+            - 1
+            - 9
+            - 1
+            Value: support@tyk.io
+          Organization:
+          - tyk
+          OrganizationalUnit:
+          - tyk
+          PostalCode: null
+          Province: null
+          SerialNumber: ""
+          StreetAddress: null
+        not_after: "2034-03-26T08:46:37Z"
+        not_before: "2024-03-25T08:46:37Z"
+        subject:
+          CommonName: tyk.io
+          Country:
+          - Peachtree
+          ExtraNames: null
+          Locality: null
+          Names:
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 6
+            Value: Peachtree
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 10
+            Value: tyk
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 11
+            Value: tyk
+          - Type:
+            - 2
+            - 5
+            - 4
+            - 3
+            Value: tyk.io
+          - Type:
+            - 1
+            - 2
+            - 840
+            - 113549
+            - 1
+            - 9
+            - 1
+            Value: support@tyk.io
+          Organization:
+          - tyk
+          OrganizationalUnit:
+          - tyk
+          PostalCode: null
+          Province: null
+          SerialNumber: ""
+          StreetAddress: null
+    oasExample:
+      value:
+        components:
+          securitySchemes:
+            bearerAuth:
+              description: The API Access Credentials
+              scheme: bearer
+              type: http
+        info:
+          description: This is a sample OAS.
+          title: OAS Sample
+          version: 1.0.0
+        openapi: 3.0.3
+        paths:
+          /api/sample/users:
+            get:
+              operationId: getUsers
+              responses:
+                "200":
+                  content:
+                    application/json:
+                      schema:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          type: object
+                        type: array
+                  description: fetched users
+              summary: Get users
+              tags:
+              - users
+        security:
+        - bearerAuth: []
+        servers:
+        - url: https://localhost:8080
+        x-tyk-api-gateway:
+          info:
+            name: user
+            state:
+              active: true
+          server:
+            listenPath:
+              strip: true
+              value: /user-test/
+          upstream:
+            url: https://localhost:8080
+    oasExampleList:
+      value:
+      - components:
+          securitySchemes:
+            bearerAuth:
+              description: The API Access Credentials
+              scheme: bearer
+              type: http
+        info:
+          description: This is a sample OAS.
+          title: OAS Sample
+          version: 1.0.0
+        openapi: 3.0.3
+        paths:
+          /api/sample/users:
+            get:
+              operationId: getUsers
+              responses:
+                "200":
+                  content:
+                    application/json:
+                      schema:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                          type: object
+                        type: array
+                  description: fetched users
+              summary: Get users
+              tags:
+              - users
+        security:
+        - bearerAuth: []
+        servers:
+        - url: https://localhost:8080
+        x-tyk-api-gateway:
+          info:
+            name: user
+            state:
+              active: true
+          server:
+            listenPath:
+              strip: true
+              value: /user-test/
+          upstream:
+            url: https://localhost:8080
+    paginatedTokenExample:
+      value:
+        Pagination:
+          page_num: 1
+          page_size: 100
+          page_total: 0
+        Tokens:
+        - code: 5a7d110be6355b0c071cc339327563cb45174ae387f52f87a80d2496
+          expires: 1.518158407e+09
+        - code: 5a7d110be6355b0c071cc33988884222b0cf436eba7979c6c51d6dbd
+          expires: 1.518158594e+09
+        - code: 5a7d110be6355b0c071cc33990bac8b5261041c5a7d585bff291fec4
+          expires: 1.518158638e+09
+        - code: 5a7d110be6355b0c071cc339a66afe75521f49388065a106ef45af54
+          expires: 1.518159792e+09
+    policiesExample:
+      value:
+      - _id: ""
+        access_rights:
+          8ddd91f3cda9453442c477b06c4e2da4:
+            allowance_scope: ""
+            allowed_types: []
+            allowed_urls:
+            - methods:
+              - GET
+              url: /users
+            api_id: 8ddd91f3cda9453442c477b06c4e2da4
+            api_name: Itachi api
+            disable_introspection: false
+            field_access_rights: []
+            limit:
+              max_query_depth: 0
+              per: 0
+              quota_max: 0
+              quota_remaining: 0
+              quota_renewal_rate: 0
+              quota_renews: 0
+              rate: 0
+              smoothing:
+                delay: 30
+                enabled: false
+                step: 100
+                threshold: 500
+                trigger: 0.8
+              throttle_interval: 0
+              throttle_retry_limit: 0
+            restricted_types: []
+            versions:
+            - Default
+        active: true
+        enable_http_signature_validation: false
+        graphql_access_rights: null
+        hmac_enabled: false
+        id: 5ead7120575961000181867e
+        is_inactive: false
+        key_expires_in: 2.592e+06
+        last_updated: "1716980105"
+        max_query_depth: -1
+        meta_data:
+          user_type: mobile_user
+        name: Sample policy
+        org_id: 664a14650619d40001f1f00f
+        partitions:
+          acl: true
+          complexity: false
+          per_api: false
+          quota: true
+          rate_limit: true
+        per: 60
+        quota_max: 10000
+        quota_renewal_rate: 3600
+        rate: 1000
+        smoothing:
+          delay: 30
+          enabled: false
+          step: 100
+          threshold: 500
+          trigger: 0.8
+        tags:
+        - security
+        throttle_interval: 10
+        throttle_retry_limit: 10
+    tokenListExample:
+      value:
+      - code: 5a7d110be6355b0c071cc339327563cb45174ae387f52f87a80d2496
+        expires: 1.518158407e+09
+      - code: 5a7d110be6355b0c071cc33988884222b0cf436eba7979c6c51d6dbd
+        expires: 1.518158594e+09
+      - code: 5a7d110be6355b0c071cc33990bac8b5261041c5a7d585bff291fec4
+        expires: 1.518158638e+09
+      - code: 5a7d110be6355b0c071cc339a66afe75521f49388065a106ef45af54
+        expires: 1.518159792e+09
+  parameters:
+    AccessType:
+      description: Filter for internal or external API versions
+      example: internal
+      in: query
+      name: accessType
+      required: false
+      schema:
+        enum:
+        - internal
+        - external
+        type: string
+    AllowList:
+      description: Enable allowList middleware for all endpoints
+      in: query
+      name: allowList
+      required: false
+      schema:
+        $ref: '#/components/schemas/BooleanQueryParam'
+    Authentication:
+      description: Enable/disable the authentication mechanism in your Tyk Gateway
+        for your OAS API
+      in: query
+      name: authentication
+      schema:
+        $ref: '#/components/schemas/BooleanQueryParam'
+    CustomDomain:
+      description: Custom domain for the API
+      example: tyk.io
+      in: query
+      name: customDomain
+      required: false
+      schema:
+        type: string
+    ListenPath:
+      description: Listen path for the API
+      example: /user-test/
+      in: query
+      name: listenPath
+      required: false
+      schema:
+        type: string
+    MockResponse:
+      description: Enable mockResponse middleware for all endpoints having responses
+        configured.
+      in: query
+      name: mockResponse
+      required: false
+      schema:
+        $ref: '#/components/schemas/BooleanQueryParam'
+    SearchText:
+      description: Search for API version name
+      example: Sample oas
+      in: query
+      name: searchText
+      required: false
+      schema:
+        type: string
+    UpstreamURL:
+      description: Upstream URL for the API
+      example: https://localhost:8080
+      in: query
+      name: upstreamURL
+      required: false
+      schema:
+        type: string
+    ValidateRequest:
+      description: Enable validateRequest middleware for all endpoints having a request
+        body with media type application/json
+      in: query
+      name: validateRequest
+      required: false
+      schema:
+        $ref: '#/components/schemas/BooleanQueryParam'
+  schemas:
+    OpenAPI3Schema:
+      type: object
+      additionalProperties: true
+    APIAllCertificateBasics:
+      properties:
+        certs:
+          items:
+            $ref: '#/components/schemas/CertsCertificateBasics'
+          nullable: true
+          type: array
+      type: object
+    APIAllCertificates:
+      properties:
+        certs:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    APICertificateStatusMessage:
+      properties:
+        id:
+          example: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+          type: string
+        message:
+          example: Certificate added
+          type: string
+        status:
+          example: ok
+          type: string
+      type: object
+    APIDefinition:
+      properties:
+        CORS:
+          $ref: '#/components/schemas/CORSConfig'
+        active:
+          type: boolean
+        allowed_ips:
+          items:
+            type: string
+          nullable: true
+          type: array
+        analytics_plugin:
+          $ref: '#/components/schemas/AnalyticsPluginConfig'
+        api_id:
+          type: string
+        auth:
+          $ref: '#/components/schemas/AuthConfig'
+        auth_configs:
+          additionalProperties:
+            $ref: '#/components/schemas/AuthConfig'
+          nullable: true
+          type: object
+        auth_provider:
+          $ref: '#/components/schemas/AuthProviderMeta'
+        base_identity_provided_by:
+          type: string
+        basic_auth:
+          properties:
+            body_password_regexp:
+              type: string
+            body_user_regexp:
+              type: string
+            cache_ttl:
+              type: integer
+            disable_caching:
+              type: boolean
+            extract_from_body:
+              type: boolean
+          type: object
+        blacklisted_ips:
+          items:
+            type: string
+          nullable: true
+          type: array
+        cache_options:
+          $ref: '#/components/schemas/CacheOptions'
+        certificate_pinning_disabled:
+          type: boolean
+        certificates:
+          items:
+            type: string
+          nullable: true
+          type: array
+        client_certificates:
+          items:
+            type: string
+          nullable: true
+          type: array
+        config_data:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        config_data_disabled:
+          type: boolean
+        custom_middleware:
+          $ref: '#/components/schemas/MiddlewareSection'
+        custom_middleware_bundle:
+          type: string
+        custom_middleware_bundle_disabled:
+          type: boolean
+        custom_plugin_auth_enabled:
+          type: boolean
+        definition:
+          $ref: '#/components/schemas/VersionDefinition'
+        detailed_tracing:
+          type: boolean
+        disable_quota:
+          type: boolean
+        disable_rate_limit:
+          type: boolean
+        do_not_track:
+          type: boolean
+        domain:
+          type: string
+        domain_disabled:
+          type: boolean
+        dont_set_quota_on_create:
+          type: boolean
+        enable_batch_request_support:
+          type: boolean
+        enable_context_vars:
+          type: boolean
+        enable_coprocess_auth:
+          type: boolean
+        enable_detailed_recording:
+          type: boolean
+        enable_ip_blacklisting:
+          type: boolean
+        enable_ip_whitelisting:
+          type: boolean
+        enable_jwt:
+          type: boolean
+        enable_proxy_protocol:
+          type: boolean
+        enable_signature_checking:
+          type: boolean
+        event_handlers:
+          $ref: '#/components/schemas/EventHandlerMetaConfig'
+        expiration:
+          type: string
+        expire_analytics_after:
+          type: integer
+        external_oauth:
+          $ref: '#/components/schemas/ExternalOAuth'
+        global_rate_limit:
+          $ref: '#/components/schemas/GlobalRateLimit'
+        graphql:
+          $ref: '#/components/schemas/GraphQLConfig'
+        hmac_allowed_algorithms:
+          items:
+            type: string
+          nullable: true
+          type: array
+        hmac_allowed_clock_skew:
+          type: number
+        id:
+          type: string
+        idp_client_id_mapping_disabled:
+          type: boolean
+        internal:
+          type: boolean
+        is_oas:
+          type: boolean
+        jwt_client_base_field:
+          type: string
+        jwt_default_policies:
+          items:
+            type: string
+          nullable: true
+          type: array
+        jwt_expires_at_validation_skew:
+          minimum: 0
+          type: integer
+        jwt_identity_base_field:
+          type: string
+        jwt_issued_at_validation_skew:
+          minimum: 0
+          type: integer
+        jwt_not_before_validation_skew:
+          minimum: 0
+          type: integer
+        jwt_policy_field_name:
+          type: string
+        jwt_scope_claim_name:
+          type: string
+        jwt_scope_to_policy_mapping:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        jwt_signing_method:
+          type: string
+        jwt_skip_kid:
+          type: boolean
+        jwt_source:
+          type: string
+        listen_port:
+          type: integer
+        name:
+          type: string
+        notifications:
+          $ref: '#/components/schemas/NotificationsManager'
+        oauth_meta:
+          properties:
+            allowed_access_types:
+              items:
+                type: string
+              nullable: true
+              type: array
+            allowed_authorize_types:
+              items:
+                type: string
+              nullable: true
+              type: array
+            auth_login_redirect:
+              type: string
+          type: object
+        openid_options:
+          $ref: '#/components/schemas/OpenIDOptions'
+        org_id:
+          type: string
+        pinned_public_keys:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        protocol:
+          type: string
+        proxy:
+          $ref: '#/components/schemas/ProxyConfig'
+        request_signing:
+          $ref: '#/components/schemas/RequestSigningMeta'
+        response_processors:
+          items:
+            $ref: '#/components/schemas/ResponseProcessor'
+          nullable: true
+          type: array
+        scopes:
+          $ref: '#/components/schemas/Scopes'
+        session_lifetime:
+          type: integer
+        session_lifetime_respects_key_expiration:
+          type: boolean
+        session_provider:
+          $ref: '#/components/schemas/SessionProviderMeta'
+        slug:
+          type: string
+        strip_auth_data:
+          type: boolean
+        tag_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        tags:
+          example:
+          - Default
+          - v1
+          items:
+            type: string
+          nullable: true
+          type: array
+        tags_disabled:
+          type: boolean
+        upstream_certificates:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        upstream_certificates_disabled:
+          type: boolean
+        uptime_tests:
+          $ref: '#/components/schemas/UptimeTests'
+        use_basic_auth:
+          type: boolean
+        use_go_plugin_auth:
+          type: boolean
+        use_keyless:
+          type: boolean
+        use_mutual_tls_auth:
+          type: boolean
+        use_oauth2:
+          type: boolean
+        use_openid:
+          type: boolean
+        use_standard_auth:
+          type: boolean
+        version_data:
+          $ref: "#/components/schemas/VersionData"
+        error_overrides:
+          additionalProperties:
+            items:
+              $ref: "#/components/schemas/ErrorOverride"
+            type: array
+          nullable: true
+          type: object
+        error_overrides_disabled:
+          type: boolean
+      type: object
+    APILimit:
+      properties:
+        max_query_depth:
+          type: integer
+        per:
+          type: number
+        quota_max:
+          type: integer
+        quota_remaining:
+          type: integer
+        quota_renewal_rate:
+          type: integer
+        quota_renews:
+          type: integer
+        rate:
+          type: number
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+        throttle_interval:
+          type: number
+        throttle_retry_limit:
+          type: integer
+      type: object
+    AccessDefinition:
+      properties:
+        allowance_scope:
+          example: d371b83b249845a2497ab9a947fd6210
+          type: string
+        allowed_types:
+          items:
+            $ref: '#/components/schemas/GraphqlType'
+          nullable: true
+          type: array
+        allowed_urls:
+          items:
+            $ref: '#/components/schemas/AccessSpec'
+          nullable: true
+          type: array
+        api_id:
+          example: d1dfc6a927a046c54c0ed470f19757cc
+          type: string
+        api_name:
+          example: Rate Limit Proxy API
+          type: string
+        disable_introspection:
+          example: false
+          type: boolean
+        endpoints:
+          $ref: '#/components/schemas/Endpoints'
+        field_access_rights:
+          items:
+            $ref: '#/components/schemas/FieldAccessDefinition'
+          nullable: true
+          type: array
+        limit:
+          $ref: '#/components/schemas/APILimit'
+        restricted_types:
+          items:
+            $ref: '#/components/schemas/GraphqlType'
+          nullable: true
+          type: array
+        versions:
+          example:
+          - Default
+          - v2
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    AccessSpec:
+      properties:
+        methods:
+          example:
+          - GET
+          - POST
+          - DELETE
+          - PUT
+          items:
+            type: string
+          nullable: true
+          type: array
+        url:
+          example: anything/rate-limit-1-per-5
+          type: string
+      type: object
+    Allowance:
+      properties:
+        enabled:
+          type: boolean
+        ignoreCase:
+          type: boolean
+      type: object
+    AnalyticsPluginConfig:
+      properties:
+        enable:
+          type: boolean
+        func_name:
+          type: string
+        plugin_path:
+          type: string
+      type: object
+    ApiAllKeys:
+      properties:
+        keys:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    ApiModifyKeySuccess:
+      properties:
+        action:
+          example: modified
+          type: string
+        key:
+          example: b13d928b9972bd18
+          type: string
+        key_hash:
+          type: string
+        status:
+          example: ok
+          type: string
+      type: object
+    ApiStatusMessage:
+      properties:
+        message:
+          type: string
+        status:
+          type: string
+      type: object
+    AuthConfig:
+      properties:
+        auth_header_name:
+          example: Authorization
+          type: string
+        cookie_name:
+          type: string
+        disable_header:
+          type: boolean
+        name:
+          type: string
+        param_name:
+          type: string
+        signature:
+          $ref: '#/components/schemas/SignatureConfig'
+        use_certificate:
+          type: boolean
+        use_cookie:
+          type: boolean
+        use_param:
+          type: boolean
+        validate_signature:
+          type: boolean
+      type: object
+    AuthProviderMeta:
+      properties:
+        meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        name:
+          type: string
+        storage_engine:
+          type: string
+      type: object
+    AuthSource:
+      properties:
+        enabled:
+          type: boolean
+        name:
+          type: string
+      type: object
+    AuthSources:
+      properties:
+        cookie:
+          $ref: '#/components/schemas/AuthSource'
+        header:
+          $ref: '#/components/schemas/AuthSource'
+        query:
+          $ref: '#/components/schemas/AuthSource'
+      type: object
+    Authentication:
+      properties:
+        baseIdentityProvider:
+          type: string
+        custom:
+          $ref: '#/components/schemas/CustomPluginAuthentication'
+        enabled:
+          type: boolean
+        hmac:
+          $ref: '#/components/schemas/HMAC'
+        oidc:
+          $ref: '#/components/schemas/OIDC'
+        securitySchemes:
+          $ref: '#/components/schemas/SecuritySchemes'
+        stripAuthorizationData:
+          type: boolean
+      type: object
+    AuthenticationPlugin:
+      properties:
+        enabled:
+          type: boolean
+        functionName:
+          type: string
+        idExtractor:
+          $ref: '#/components/schemas/IDExtractor'
+        path:
+          type: string
+        rawBodyOnly:
+          type: boolean
+      type: object
+    BasicAuthData:
+      properties:
+        hash_type:
+          type: string
+        password:
+          type: string
+      type: object
+    BatchReplyUnit:
+      properties:
+        body:
+          type: string
+        code:
+          type: integer
+        headers:
+          $ref: '#/components/schemas/HttpHeader'
+        relative_url:
+          type: string
+      type: object
+    BatchRequestStructure:
+      properties:
+        requests:
+          items:
+            $ref: '#/components/schemas/RequestDefinition'
+          nullable: true
+          type: array
+        suppress_parallel_execution:
+          type: boolean
+      type: object
+    RequestDefinition:
+      properties:
+        body:
+          type: string
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        method:
+          type: string
+        relative_url:
+          type: string
+      type: object
+    BooleanQueryParam:
+      example: true
+      type: boolean
+    CORS:
+      properties:
+        allowCredentials:
+          type: boolean
+        allowedHeaders:
+          items:
+            type: string
+          type: array
+        allowedMethods:
+          items:
+            type: string
+          type: array
+        allowedOrigins:
+          items:
+            type: string
+          type: array
+        debug:
+          type: boolean
+        enabled:
+          type: boolean
+        exposedHeaders:
+          items:
+            type: string
+          type: array
+        maxAge:
+          type: integer
+        optionsPassthrough:
+          type: boolean
+      type: object
+    CORSConfig:
+      properties:
+        allow_credentials:
+          example: false
+          type: boolean
+        allowed_headers:
+          example:
+          - Origin
+          - Accept
+          - Content-Type
+          - Authorization
+          items:
+            type: string
+          nullable: true
+          type: array
+        allowed_methods:
+          example:
+          - GET
+          - HEAD
+          - POST
+          items:
+            type: string
+          nullable: true
+          type: array
+        allowed_origins:
+          example:
+          - https://*.foo.com
+          items:
+            type: string
+          nullable: true
+          type: array
+        debug:
+          example: true
+          type: boolean
+        enable:
+          example: false
+          type: boolean
+        exposed_headers:
+          example:
+          - Accept
+          - Content-Type
+          items:
+            type: string
+          nullable: true
+          type: array
+        max_age:
+          example: 24
+          type: integer
+        options_passthrough:
+          example: false
+          type: boolean
+      type: object
+    Cache:
+      properties:
+        cacheAllSafeRequests:
+          type: boolean
+        cacheByHeaders:
+          items:
+            type: string
+          type: array
+        cacheResponseCodes:
+          items:
+            type: integer
+          type: array
+        controlTTLHeaderName:
+          type: string
+        enableUpstreamCacheControl:
+          type: boolean
+        enabled:
+          type: boolean
+        timeout:
+          type: integer
+      type: object
+    CacheMeta:
+      properties:
+        cache_key_regex:
+          type: string
+        cache_response_codes:
+          items:
+            type: integer
+          nullable: true
+          type: array
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        timeout:
+          format: int64
+          type: integer
+      type: object
+    CacheOptions:
+      properties:
+        cache_all_safe_requests:
+          example: false
+          type: boolean
+        cache_by_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        cache_control_ttl_header:
+          type: string
+        cache_response_codes:
+          items:
+            type: integer
+          nullable: true
+          type: array
+        cache_timeout:
+          example: 60
+          format: int64
+          type: integer
+        enable_cache:
+          example: true
+          type: boolean
+        enable_upstream_cache_control:
+          example: false
+          type: boolean
+      type: object
+    CachePlugin:
+      properties:
+        cacheByRegex:
+          type: string
+        cacheResponseCodes:
+          items:
+            type: integer
+          type: array
+        enabled:
+          type: boolean
+        timeout:
+          type: integer
+      type: object
+    CertificatePinning:
+      properties:
+        domainToPublicKeysMapping:
+          $ref: '#/components/schemas/PinnedPublicKeys'
+        enabled:
+          type: boolean
+      type: object
+    CertsCertificateBasics:
+      properties:
+        dns_names:
+          items:
+            type: string
+          nullable: true
+          type: array
+        has_private:
+          type: boolean
+        id:
+          type: string
+        is_ca:
+          type: boolean
+        issuer_cn:
+          type: string
+        not_after:
+          format: date-time
+          type: string
+        not_before:
+          format: date-time
+          type: string
+        subject_cn:
+          type: string
+      type: object
+    CertsCertificateMeta:
+      properties:
+        dns_names:
+          example:
+          - .*tyk.io
+          items:
+            type: string
+          type: array
+        fingerprint:
+          example: 7c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+          type: string
+        has_private:
+          example: false
+          type: boolean
+        id:
+          example: 5e9d9544a1dcd60001d0ed207c440d66ebb0a4629d21329808dce9091acf5f2fde328067a6e60e5347271d90
+          type: string
+        is_ca:
+          type: boolean
+        issuer:
+          $ref: '#/components/schemas/PkixName'
+        not_after:
+          example: "2034-03-26T08:46:37Z"
+          format: date-time
+          type: string
+        not_before:
+          example: "2024-03-25T08:46:37Z"
+          format: date-time
+          type: string
+        subject:
+          $ref: '#/components/schemas/PkixName'
+      type: object
+    CheckCommand:
+      properties:
+        message:
+          type: string
+        name:
+          type: string
+      type: object
+    CircuitBreaker:
+      properties:
+        coolDownPeriod:
+          type: integer
+        enabled:
+          type: boolean
+        halfOpenStateEnabled:
+          type: boolean
+        sampleSize:
+          type: integer
+        threshold:
+          type: number
+      type: object
+    CircuitBreakerMeta:
+      properties:
+        disable_half_open_state:
+          type: boolean
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        return_to_service_after:
+          type: integer
+        samples:
+          format: int64
+          type: integer
+        threshold_percent:
+          type: number
+      type: object
+    ClientCertificates:
+      properties:
+        allowlist:
+          items:
+            type: string
+          nullable: true
+          type: array
+        enabled:
+          type: boolean
+      type: object
+    ClientToPolicy:
+      properties:
+        clientId:
+          type: string
+        policyId:
+          type: string
+      type: object
+    ContextVariables:
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    CustomPlugin:
+      properties:
+        enabled:
+          type: boolean
+        functionName:
+          type: string
+        path:
+          type: string
+        rawBodyOnly:
+          type: boolean
+        requireSession:
+          type: boolean
+      type: object
+    CustomPluginAuthentication:
+      properties:
+        AuthSources:
+          $ref: '#/components/schemas/AuthSources'
+        config:
+          $ref: '#/components/schemas/AuthenticationPlugin'
+        enabled:
+          type: boolean
+      type: object
+    CustomPlugins:
+      items:
+        $ref: '#/components/schemas/CustomPlugin'
+      type: array
+    DatasourceMappingConfiguration:
+      properties:
+        disabled:
+          type: boolean
+        path:
+          type: string
+      type: object
+    DatasourceSourceConfig:
+      properties:
+        data_source_config: {}
+        kind:
+          type: string
+      type: object
+    DatasourceTypeFieldConfiguration:
+      properties:
+        data_source:
+          $ref: '#/components/schemas/DatasourceSourceConfig'
+        field_name:
+          type: string
+        mapping:
+          $ref: '#/components/schemas/DatasourceMappingConfiguration'
+        type_name:
+          type: string
+      type: object
+    DetailedActivityLogs:
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    DetailedTracing:
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    Domain:
+      properties:
+        certificates:
+          items:
+            type: string
+          type: array
+        enabled:
+          type: boolean
+        name:
+          type: string
+      type: object
+    DomainToCertificate:
+      properties:
+        certificate:
+          type: string
+        domain:
+          type: string
+      type: object
+    ErrorMatcher:
+      properties:
+        body_field:
+          type: string
+        body_value:
+          type: string
+        flag:
+          type: string
+        message_pattern:
+          type: string
+      type: object
+    ErrorOverride:
+      properties:
+        match:
+          $ref: '#/components/schemas/ErrorMatcher'
+        response:
+          $ref: '#/components/schemas/ErrorResponse'
+      type: object
+    ErrorResponse:
+      properties:
+        body:
+          type: string
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        message:
+          type: string
+        status_code:
+          type: integer
+        template:
+          type: string
+      type: object
+    EndPointMeta:
+      properties:
+        disabled:
+          type: boolean
+        ignore_case:
+          type: boolean
+        method:
+          type: string
+        method_actions:
+          additionalProperties:
+            $ref: '#/components/schemas/EndpointMethodMeta'
+          type: object
+        path:
+          type: string
+      type: object
+    Endpoint:
+      properties:
+        methods:
+          $ref: '#/components/schemas/EndpointMethods'
+        path:
+          type: string
+      type: object
+    EndpointMethod:
+      properties:
+        limit:
+          $ref: '#/components/schemas/RateLimitType2'
+        name:
+          type: string
+      type: object
+    EndpointMethodMeta:
+      properties:
+        action:
+          enum:
+          - no_action
+          - reply
+          type: string
+        code:
+          type: integer
+        data:
+          type: string
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+      type: object
+    EndpointMethods:
+      items:
+        $ref: '#/components/schemas/EndpointMethod'
+      type: array
+    EndpointPostPlugin:
+      properties:
+        enabled:
+          type: boolean
+        functionName:
+          type: string
+        name:
+          type: string
+        path:
+          type: string
+      type: object
+    EndpointPostPlugins:
+      items:
+        $ref: '#/components/schemas/EndpointPostPlugin'
+      type: array
+    Endpoints:
+      items:
+        $ref: '#/components/schemas/Endpoint'
+      type: array
+    EnforceTimeout:
+      properties:
+        enabled:
+          type: boolean
+        value:
+          type: integer
+      type: object
+    EventHandler:
+      properties:
+        enabled:
+          type: boolean
+        id:
+          type: string
+        name:
+          type: string
+        trigger:
+          type: string
+        type:
+          type: string
+      type: object
+    EventHandlerMetaConfig:
+      properties:
+        events:
+          additionalProperties:
+            items:
+              $ref: '#/components/schemas/EventHandlerTriggerConfig'
+            type: array
+          nullable: true
+          type: object
+      type: object
+    EventHandlerTriggerConfig:
+      properties:
+        handler_meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        handler_name:
+          type: string
+      type: object
+    EventHandlers:
+      items:
+        $ref: '#/components/schemas/EventHandler'
+      type: array
+    ExtendedPathsSet:
+      properties:
+        advance_cache_config:
+          items:
+            $ref: '#/components/schemas/CacheMeta'
+          type: array
+        black_list:
+          items:
+            $ref: '#/components/schemas/EndPointMeta'
+          type: array
+        cache:
+          items:
+            type: string
+          type: array
+        circuit_breakers:
+          items:
+            $ref: '#/components/schemas/CircuitBreakerMeta'
+          type: array
+        do_not_track_endpoints:
+          items:
+            $ref: '#/components/schemas/TrackEndpointMeta'
+          type: array
+        go_plugin:
+          items:
+            $ref: '#/components/schemas/GoPluginMeta'
+          type: array
+        hard_timeouts:
+          items:
+            $ref: '#/components/schemas/HardTimeoutMeta'
+          type: array
+        ignored:
+          items:
+            $ref: '#/components/schemas/EndPointMeta'
+          type: array
+        internal:
+          items:
+            $ref: '#/components/schemas/InternalMeta'
+          type: array
+        method_transforms:
+          items:
+            $ref: '#/components/schemas/MethodTransformMeta'
+          type: array
+        mock_response:
+          items:
+            $ref: '#/components/schemas/MockResponseMeta'
+          type: array
+        persist_graphql:
+          items:
+            $ref: '#/components/schemas/PersistGraphQLMeta'
+          nullable: true
+          type: array
+        rate_limit:
+          items:
+            $ref: '#/components/schemas/RateLimitMeta'
+          nullable: true
+          type: array
+        size_limits:
+          items:
+            $ref: '#/components/schemas/RequestSizeMeta'
+          type: array
+        track_endpoints:
+          items:
+            $ref: '#/components/schemas/TrackEndpointMeta'
+          type: array
+        transform:
+          items:
+            $ref: '#/components/schemas/TemplateMeta'
+          type: array
+        transform_headers:
+          items:
+            $ref: '#/components/schemas/HeaderInjectionMeta'
+          type: array
+        transform_jq:
+          items:
+            $ref: '#/components/schemas/TransformJQMeta'
+          type: array
+        transform_jq_response:
+          items:
+            $ref: '#/components/schemas/TransformJQMeta'
+          type: array
+        transform_response:
+          items:
+            $ref: '#/components/schemas/TemplateMeta'
+          type: array
+        transform_response_headers:
+          items:
+            $ref: '#/components/schemas/HeaderInjectionMeta'
+          type: array
+        url_rewrites:
+          items:
+            $ref: '#/components/schemas/URLRewriteMeta'
+          type: array
+        validate_json:
+          items:
+            $ref: '#/components/schemas/ValidatePathMeta'
+          type: array
+        validate_request:
+          items:
+            $ref: '#/components/schemas/ValidateRequestMeta'
+          type: array
+        virtual:
+          items:
+            $ref: '#/components/schemas/VirtualMeta'
+          type: array
+        white_list:
+          items:
+            $ref: '#/components/schemas/EndPointMeta'
+          type: array
+      type: object
+    ExternalOAuth:
+      properties:
+        enabled:
+          type: boolean
+        providers:
+          items:
+            $ref: '#/components/schemas/Provider'
+          nullable: true
+          type: array
+      type: object
+    FieldAccessDefinition:
+      properties:
+        field_name:
+          type: string
+        limits:
+          $ref: '#/components/schemas/FieldLimits'
+        type_name:
+          type: string
+      type: object
+    FieldLimits:
+      properties:
+        max_query_depth:
+          type: integer
+      type: object
+    FromOASExamples:
+      properties:
+        code:
+          type: integer
+        contentType:
+          type: string
+        enabled:
+          type: boolean
+        exampleName:
+          type: string
+      type: object
+    GatewayTags:
+      properties:
+        enabled:
+          type: boolean
+        tags:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    Global:
+      properties:
+        cache:
+          $ref: '#/components/schemas/Cache'
+        contextVariables:
+          $ref: '#/components/schemas/ContextVariables'
+        cors:
+          $ref: '#/components/schemas/CORS'
+        pluginConfig:
+          $ref: '#/components/schemas/PluginConfig'
+        postAuthenticationPlugin:
+          $ref: '#/components/schemas/PostAuthenticationPlugin'
+        postAuthenticationPlugins:
+          $ref: '#/components/schemas/CustomPlugins'
+        postPlugin:
+          $ref: '#/components/schemas/PostPlugin'
+        postPlugins:
+          $ref: '#/components/schemas/CustomPlugins'
+        prePlugin:
+          $ref: '#/components/schemas/PrePlugin'
+        prePlugins:
+          $ref: '#/components/schemas/CustomPlugins'
+        responsePlugin:
+          $ref: '#/components/schemas/ResponsePlugin'
+        responsePlugins:
+          $ref: '#/components/schemas/CustomPlugins'
+        trafficLogs:
+          $ref: '#/components/schemas/TrafficLogs'
+        transformRequestHeaders:
+          $ref: '#/components/schemas/TransformHeaders'
+        transformResponseHeaders:
+          $ref: '#/components/schemas/TransformHeaders'
+      type: object
+    GlobalRateLimit:
+      properties:
+        disabled:
+          type: boolean
+        per:
+          type: number
+        rate:
+          type: number
+      type: object
+    GoPluginMeta:
+      properties:
+        disabled:
+          type: boolean
+        func_name:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+        plugin_path:
+          type: string
+      type: object
+    GraphAccessDefinition:
+      type: object
+    GraphQLConfig:
+      properties:
+        enabled:
+          type: boolean
+        engine:
+          $ref: '#/components/schemas/GraphQLEngineConfig'
+        execution_mode:
+          enum:
+          - proxyOnly
+          - executionEngine
+          - subgraph
+          - supergraph
+          - ""  # Allow empty string
+          type: string
+        introspection:
+          $ref: '#/components/schemas/GraphQLIntrospectionConfig'
+        last_schema_update:
+          format: date-time
+          nullable: true
+          type: string
+        playground:
+          $ref: '#/components/schemas/GraphQLPlayground'
+        proxy:
+          $ref: '#/components/schemas/GraphQLProxyConfig'
+        schema:
+          type: string
+        subgraph:
+          $ref: '#/components/schemas/GraphQLSubgraphConfig'
+        supergraph:
+          $ref: '#/components/schemas/GraphQLSupergraphConfig'
+        type_field_configurations:
+          items:
+            $ref: '#/components/schemas/DatasourceTypeFieldConfiguration'
+          nullable: true
+          type: array
+        version:
+          enum:
+          - "1"
+          - "2"
+          - ""  # Allow empty string
+          type: string
+      type: object
+    GraphQLEngineConfig:
+      properties:
+        data_sources:
+          items:
+            $ref: '#/components/schemas/GraphQLEngineDataSource'
+          nullable: true
+          type: array
+        field_configs:
+          items:
+            $ref: '#/components/schemas/GraphQLFieldConfig'
+          nullable: true
+          type: array
+        global_headers:
+          items:
+            $ref: '#/components/schemas/UDGGlobalHeader'
+          nullable: true
+          type: array
+      type: object
+    GraphQLEngineDataSource:
+      properties:
+        config: {}
+        internal:
+          type: boolean
+        kind:
+          type: string
+        name:
+          type: string
+        root_fields:
+          items:
+            $ref: '#/components/schemas/GraphQLTypeFields'
+          nullable: true
+          type: array
+      type: object
+    GraphQLFieldConfig:
+      properties:
+        disable_default_mapping:
+          type: boolean
+        field_name:
+          type: string
+        path:
+          items:
+            type: string
+          nullable: true
+          type: array
+        type_name:
+          type: string
+      type: object
+    GraphQLIntrospectionConfig:
+      properties:
+        disabled:
+          type: boolean
+      type: object
+    GraphQLPlayground:
+      properties:
+        enabled:
+          type: boolean
+        path:
+          type: string
+      type: object
+    GraphQLProxyConfig:
+      properties:
+        auth_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        features:
+          $ref: '#/components/schemas/GraphQLProxyFeaturesConfig'
+        request_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        request_headers_rewrite:
+          additionalProperties:
+            $ref: '#/components/schemas/RequestHeadersRewriteConfig'
+          nullable: true
+          type: object
+        subscription_type:
+          type: string
+        use_response_extensions:
+          $ref: '#/components/schemas/GraphQLResponseExtensions'
+      type: object
+    GraphQLProxyFeaturesConfig:
+      properties:
+        use_immutable_headers:
+          type: boolean
+      type: object
+    GraphQLResponseExtensions:
+      properties:
+        on_error_forwarding:
+          type: boolean
+      type: object
+    GraphQLSubgraphConfig:
+      properties:
+        sdl:
+          type: string
+      type: object
+    GraphQLSubgraphEntity:
+      properties:
+        api_id:
+          type: string
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        name:
+          type: string
+        sdl:
+          type: string
+        subscription_type:
+          type: string
+        url:
+          type: string
+      type: object
+    GraphQLSupergraphConfig:
+      properties:
+        disable_query_batching:
+          type: boolean
+        global_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        merged_sdl:
+          type: string
+        subgraphs:
+          items:
+            $ref: '#/components/schemas/GraphQLSubgraphEntity'
+          nullable: true
+          type: array
+        updated_at:
+          format: date-time
+          nullable: true
+          type: string
+      type: object
+    GraphQLTypeFields:
+      properties:
+        fields:
+          items:
+            type: string
+          nullable: true
+          type: array
+        type:
+          type: string
+      type: object
+    GraphqlType:
+      properties:
+        fields:
+          items:
+            type: string
+          nullable: true
+          type: array
+        name:
+          type: string
+      type: object
+    HMAC:
+      properties:
+        AuthSources:
+          $ref: '#/components/schemas/AuthSources'
+        allowedAlgorithms:
+          items:
+            type: string
+          type: array
+        allowedClockSkew:
+          type: number
+        enabled:
+          type: boolean
+      type: object
+    HardTimeoutMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        timeout:
+          type: integer
+      type: object
+    Header:
+      properties:
+        name:
+          type: string
+        value:
+          type: string
+      type: object
+    HeaderInjectionMeta:
+      properties:
+        act_on:
+          type: boolean
+        add_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        delete_headers:
+          items:
+            type: string
+          nullable: true
+          type: array
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    Headers:
+      items:
+        $ref: '#/components/schemas/Header'
+      type: array
+    HealthCheckItem:
+      properties:
+        componentId:
+          type: string
+        componentType:
+          type: string
+        output:
+          type: string
+        status:
+          enum:
+          - pass
+          - fail
+          - warn
+          type: string
+        time:
+          type: string
+      type: object
+    HealthCheckResponse:
+      properties:
+        description:
+          type: string
+        details:
+          additionalProperties:
+            $ref: '#/components/schemas/HealthCheckItem'
+          type: object
+        output:
+          type: string
+        status:
+          enum:
+          - pass
+          - fail
+          - warn
+          type: string
+        version:
+          type: string
+      type: object
+    HostCheckObject:
+      properties:
+        body:
+          type: string
+        commands:
+          items:
+            $ref: '#/components/schemas/CheckCommand'
+          nullable: true
+          type: array
+        enable_proxy_protocol:
+          type: boolean
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        method:
+          type: string
+        protocol:
+          type: string
+        timeout:
+          type: integer
+        url:
+          type: string
+      type: object
+    HttpHeader:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    IDExtractor:
+      properties:
+        config:
+          $ref: '#/components/schemas/IDExtractorConfig'
+        enabled:
+          type: boolean
+        source:
+          type: string
+        with:
+          type: string
+      type: object
+    IDExtractorConfig:
+      properties:
+        formParamName:
+          type: string
+        headerName:
+          type: string
+        regexp:
+          type: string
+        regexpMatchIndex:
+          type: integer
+        xPathExp:
+          type: string
+      type: object
+    Info:
+      properties:
+        dbId:
+          type: string
+        expiration:
+          type: string
+        id:
+          type: string
+        name:
+          type: string
+        orgId:
+          type: string
+        state:
+          $ref: '#/components/schemas/State'
+        versioning:
+          $ref: '#/components/schemas/Versioning'
+      type: object
+    Internal:
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    InternalMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    Introspection:
+      properties:
+        cache:
+          $ref: '#/components/schemas/IntrospectionCache'
+        client_id:
+          type: string
+        client_secret:
+          type: string
+        enabled:
+          type: boolean
+        identity_base_field:
+          type: string
+        url:
+          type: string
+      type: object
+    IntrospectionCache:
+      properties:
+        enabled:
+          type: boolean
+        timeout:
+          format: int64
+          type: integer
+      type: object
+    JWTData:
+      properties:
+        secret:
+          type: string
+      type: object
+    JWTValidation:
+      properties:
+        enabled:
+          type: boolean
+        expires_at_validation_skew:
+          minimum: 0
+          type: integer
+        identity_base_field:
+          type: string
+        issued_at_validation_skew:
+          minimum: 0
+          type: integer
+        not_before_validation_skew:
+          minimum: 0
+          type: integer
+        signing_method:
+          type: string
+        source:
+          type: string
+      type: object
+    ListenPath:
+      properties:
+        strip:
+          type: boolean
+        value:
+          type: string
+      type: object
+    MethodTransformMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        to_method:
+          type: string
+      type: object
+    Middleware:
+      properties:
+        global:
+          $ref: '#/components/schemas/Global'
+        operations:
+          $ref: '#/components/schemas/Operations'
+      type: object
+    MiddlewareDefinition:
+      properties:
+        disabled:
+          type: boolean
+        name:
+          example: PreMiddlewareFunction
+          type: string
+        path:
+          type: string
+        raw_body_only:
+          example: false
+          type: boolean
+        require_session:
+          example: false
+          type: boolean
+      type: object
+    MiddlewareIdExtractor:
+      properties:
+        disabled:
+          type: boolean
+        extract_from:
+          type: string
+        extract_with:
+          type: string
+        extractor_config:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+    MiddlewareSection:
+      properties:
+        auth_check:
+          $ref: '#/components/schemas/MiddlewareDefinition'
+        driver:
+          type: string
+        id_extractor:
+          $ref: '#/components/schemas/MiddlewareIdExtractor'
+        post:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+        post_key_auth:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+        pre:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+        response:
+          items:
+            $ref: '#/components/schemas/MiddlewareDefinition'
+          nullable: true
+          type: array
+      type: object
+    MockResponse:
+      properties:
+        body:
+          type: string
+        code:
+          type: integer
+        enabled:
+          type: boolean
+        fromOASExamples:
+          $ref: '#/components/schemas/FromOASExamples'
+        headers:
+          $ref: '#/components/schemas/Headers'
+      type: object
+    MockResponseMeta:
+      properties:
+        body:
+          type: string
+        code:
+          type: integer
+        disabled:
+          type: boolean
+        headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        ignore_case:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    Monitor:
+      properties:
+        trigger_limits:
+          example:
+          - 80
+          - 60
+          - 50
+          items:
+            type: number
+          nullable: true
+          type: array
+      type: object
+    MutualTLS:
+      properties:
+        domainToCertificateMapping:
+          items:
+            $ref: '#/components/schemas/DomainToCertificate'
+          nullable: true
+          type: array
+        enabled:
+          type: boolean
+      type: object
+    NewClientRequest:
+      properties:
+        api_id:
+          example: keyless
+          type: string
+        client_id:
+          example: 2a06b398c17f46908de3dffcb71ef87b
+          type: string
+        description:
+          example: google client login
+          type: string
+        meta_data:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        policy_id:
+          type: string
+        redirect_uri:
+          example: https://httpbin.org/ip
+          type: string
+        secret:
+          example: MmQwNTI5NGQtYjU0YS00NjMyLWIwZjktNTZjY2M1ZjhjYWY0
+          type: string
+      type: object
+    NotificationsManager:
+      properties:
+        oauth_on_keychange_url:
+          type: string
+        shared_secret:
+          type: string
+      type: object
+    OASSchemaResponse:
+      properties:
+        message:
+          type: string
+        schema: {}
+        status:
+          type: string
+      type: object
+    OAuthClientToken:
+      properties:
+        code:
+          type: string
+        expires:
+          type: integer
+      type: object
+    OIDC:
+      properties:
+        AuthSources:
+          $ref: '#/components/schemas/AuthSources'
+        enabled:
+          type: boolean
+        providers:
+          items:
+            $ref: '#/components/schemas/ProviderType2'
+          type: array
+        scopes:
+          $ref: '#/components/schemas/ScopesType2'
+        segregateByClientId:
+          type: boolean
+      type: object
+    OIDProviderConfig:
+      properties:
+        client_ids:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        issuer:
+          type: string
+      type: object
+    OpenIDOptions:
+      properties:
+        providers:
+          items:
+            $ref: '#/components/schemas/OIDProviderConfig'
+          nullable: true
+          type: array
+        segregate_by_client:
+          type: boolean
+      type: object
+    Operation:
+      properties:
+        allow:
+          $ref: '#/components/schemas/Allowance'
+        block:
+          $ref: '#/components/schemas/Allowance'
+        cache:
+          $ref: '#/components/schemas/CachePlugin'
+        circuitBreaker:
+          $ref: '#/components/schemas/CircuitBreaker'
+        doNotTrackEndpoint:
+          $ref: '#/components/schemas/TrackEndpoint'
+        enforceTimeout:
+          $ref: '#/components/schemas/EnforceTimeout'
+        ignoreAuthentication:
+          $ref: '#/components/schemas/Allowance'
+        internal:
+          $ref: '#/components/schemas/Internal'
+        mockResponse:
+          $ref: '#/components/schemas/MockResponse'
+        postPlugins:
+          $ref: '#/components/schemas/EndpointPostPlugins'
+        rateLimit:
+          $ref: '#/components/schemas/RateLimitEndpoint'
+        requestSizeLimit:
+          $ref: '#/components/schemas/RequestSizeLimit'
+        trackEndpoint:
+          $ref: '#/components/schemas/TrackEndpoint'
+        transformRequestBody:
+          $ref: '#/components/schemas/TransformBody'
+        transformRequestHeaders:
+          $ref: '#/components/schemas/TransformHeaders'
+        transformRequestMethod:
+          $ref: '#/components/schemas/TransformRequestMethod'
+        transformResponseBody:
+          $ref: '#/components/schemas/TransformBody'
+        transformResponseHeaders:
+          $ref: '#/components/schemas/TransformHeaders'
+        urlRewrite:
+          $ref: '#/components/schemas/URLRewrite'
+        validateRequest:
+          $ref: '#/components/schemas/ValidateRequest'
+        virtualEndpoint:
+          $ref: '#/components/schemas/VirtualEndpoint'
+      type: object
+    Operations:
+      additionalProperties:
+        $ref: '#/components/schemas/Operation'
+      type: object
+    PaginatedOAuthClientTokens:
+      properties:
+        Pagination:
+          $ref: '#/components/schemas/PaginationStatus'
+        Tokens:
+          items:
+            $ref: '#/components/schemas/OAuthClientToken'
+          nullable: true
+          type: array
+      type: object
+    PaginationStatus:
+      properties:
+        page_num:
+          type: integer
+        page_size:
+          type: integer
+        page_total:
+          type: integer
+      type: object
+    PersistGraphQLMeta:
+      properties:
+        method:
+          type: string
+        operation:
+          type: string
+        path:
+          type: string
+        variables:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+    PinnedPublicKey:
+      properties:
+        domain:
+          type: string
+        publicKeys:
+          items:
+            type: string
+          nullable: true
+          type: array
+      type: object
+    PinnedPublicKeys:
+      items:
+        $ref: '#/components/schemas/PinnedPublicKey'
+      nullable: true
+      type: array
+    PkixName:
+      type: object
+    PluginBundle:
+      properties:
+        enabled:
+          type: boolean
+        path:
+          type: string
+      type: object
+    PluginConfig:
+      properties:
+        bundle:
+          $ref: '#/components/schemas/PluginBundle'
+        data:
+          $ref: '#/components/schemas/PluginConfigData'
+        driver:
+          type: string
+      type: object
+    PluginConfigData:
+      properties:
+        enabled:
+          type: boolean
+        value:
+          additionalProperties: {}
+          nullable: true
+          type: object
+      type: object
+    Policy:
+      properties:
+        _id:
+          example: 5ead7120575961000181867e
+          type: string
+        access_rights:
+          additionalProperties:
+            $ref: '#/components/schemas/AccessDefinition'
+          nullable: true
+          type: object
+        active:
+          example: true
+          type: boolean
+        enable_http_signature_validation:
+          example: false
+          type: boolean
+        graphql_access_rights:
+          additionalProperties:
+            $ref: '#/components/schemas/GraphAccessDefinition'
+          nullable: true
+          type: object
+        hmac_enabled:
+          example: false
+          type: boolean
+        id:
+          example: 5ead7120575961000181867e
+          type: string
+        is_inactive:
+          example: false
+          type: boolean
+        key_expires_in:
+          example: 0
+          format: int64
+          type: integer
+        last_updated:
+          example: "1655965189"
+          type: string
+        max_query_depth:
+          example: -1
+          type: integer
+        meta_data:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        name:
+          example: Swagger Petstore Policy
+          type: string
+        org_id:
+          example: 5e9d9544a1dcd60001d0ed20
+          type: string
+        partitions:
+          $ref: '#/components/schemas/PolicyPartitions'
+        per:
+          example: 60
+          format: double
+          type: number
+        post_expiry_action:
+          description: Defines the action to take on a Session in Redis after it expires. Valid values are "retain" and "delete".
+          example: delete
+          type: string
+          enum:
+            - retain
+            - delete
+        post_expiry_grace_period:
+          description: Duration in seconds to retain a Session in Redis after it expires. Used with post_expiry_action "retain". Set to -1 to retain indefinitely.
+          example: 0
+          format: int64
+          type: integer
+        quota_max:
+          example: -1
+          format: int64
+          type: integer
+        quota_renewal_rate:
+          example: 3600
+          format: int64
+          type: integer
+        rate:
+          example: 1000
+          format: double
+          type: number
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+        tags:
+          items:
+            type: string
+          nullable: true
+          type: array
+        throttle_interval:
+          example: -1
+          format: double
+          type: number
+        throttle_retry_limit:
+          example: -1
+          type: integer
+      type: object
+    PolicyPartitions:
+      properties:
+        acl:
+          example: true
+          type: boolean
+        complexity:
+          example: false
+          type: boolean
+        per_api:
+          example: false
+          type: boolean
+        quota:
+          example: true
+          type: boolean
+        rate_limit:
+          example: true
+          type: boolean
+      type: object
+    PolicyUpdateObj:
+      properties:
+        apply_policies:
+          items:
+            type: string
+          nullable: true
+          type: array
+        policy:
+          type: string
+      type: object
+    PostAuthenticationPlugin:
+      properties:
+        plugins:
+          $ref: '#/components/schemas/CustomPlugins'
+      type: object
+    PostPlugin:
+      properties:
+        plugins:
+          $ref: '#/components/schemas/CustomPlugins'
+      type: object
+    PrePlugin:
+      properties:
+        plugins:
+          $ref: '#/components/schemas/CustomPlugins'
+      type: object
+    Provider:
+      properties:
+        introspection:
+          $ref: '#/components/schemas/Introspection'
+        jwt:
+          $ref: '#/components/schemas/JWTValidation'
+      type: object
+    ProviderType2:
+      properties:
+        clientToPolicyMapping:
+          items:
+            $ref: '#/components/schemas/ClientToPolicy'
+          type: array
+        issuer:
+          type: string
+      type: object
+    ProxyConfig:
+      properties:
+        check_host_against_uptime_tests:
+          type: boolean
+        disable_strip_slash:
+          type: boolean
+        enable_load_balancing:
+          type: boolean
+        listen_path:
+          example: /relative-path-examples/
+          type: string
+        preserve_host_header:
+          type: boolean
+        service_discovery:
+          $ref: '#/components/schemas/ServiceDiscoveryConfiguration'
+        strip_listen_path:
+          example: true
+          type: boolean
+        target_list:
+          items:
+            type: string
+          nullable: true
+          type: array
+        target_url:
+          example: https://httpbin.org/
+          type: string
+        transport:
+          properties:
+            proxy_url:
+              type: string
+            ssl_ciphers:
+              items:
+                type: string
+              nullable: true
+              type: array
+            ssl_force_common_name_check:
+              type: boolean
+            ssl_insecure_skip_verify:
+              type: boolean
+            ssl_max_version:
+              minimum: 0
+              type: integer
+            ssl_min_version:
+              minimum: 0
+              type: integer
+          type: object
+      type: object
+    RateLimit:
+      properties:
+        enabled:
+          type: boolean
+        per:
+          type: integer
+        rate:
+          type: integer
+      type: object
+    RateLimitEndpoint:
+      properties:
+        enabled:
+          type: boolean
+        per:
+          type: integer
+        rate:
+          type: integer
+      type: object
+    RateLimitMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        per:
+          type: number
+        rate:
+          type: number
+      type: object
+    RateLimitSmoothing:
+      properties:
+        delay:
+          type: integer
+        enabled:
+          type: boolean
+        step:
+          type: integer
+        threshold:
+          type: integer
+        trigger:
+          type: number
+      type: object
+      nullable: true
+    RateLimitType2:
+      properties:
+        per:
+          type: number
+        rate:
+          type: number
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+      type: object
+    RequestHeadersRewriteConfig:
+      properties:
+        remove:
+          type: boolean
+        value:
+          type: string
+      type: object
+    RequestSigningMeta:
+      properties:
+        algorithm:
+          type: string
+        certificate_id:
+          type: string
+        header_list:
+          items:
+            type: string
+          nullable: true
+          type: array
+        is_enabled:
+          type: boolean
+        key_id:
+          type: string
+        secret:
+          type: string
+        signature_header:
+          type: string
+      type: object
+    RequestSizeLimit:
+      properties:
+        enabled:
+          type: boolean
+        value:
+          type: integer
+      type: object
+    RequestSizeMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        size_limit:
+          format: int64
+          type: integer
+      type: object
+    ResponsePlugin:
+      properties:
+        plugins:
+          $ref: '#/components/schemas/CustomPlugins'
+      type: object
+    ResponseProcessor:
+      properties:
+        name:
+          type: string
+        options: {}
+      type: object
+    RoutingTrigger:
+      properties:
+        "on":
+          enum:
+          - all
+          - any
+          type: string
+        options:
+          $ref: '#/components/schemas/RoutingTriggerOptions'
+        rewrite_to:
+          type: string
+      type: object
+    RoutingTriggerOptions:
+      properties:
+        header_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        path_part_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        payload_matches:
+          $ref: '#/components/schemas/StringRegexMap'
+        query_val_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        request_context_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+        session_meta_matches:
+          additionalProperties:
+            $ref: '#/components/schemas/StringRegexMap'
+          nullable: true
+          type: object
+      type: object
+    ScopeClaim:
+      properties:
+        scope_claim_name:
+          type: string
+        scope_to_policy:
+          additionalProperties:
+            type: string
+          type: object
+      type: object
+    ScopeToPolicy:
+      properties:
+        policyId:
+          type: string
+        scope:
+          type: string
+      type: object
+    Scopes:
+      properties:
+        jwt:
+          $ref: '#/components/schemas/ScopeClaim'
+        oidc:
+          $ref: '#/components/schemas/ScopeClaim'
+      type: object
+    ScopesType2:
+      properties:
+        claimName:
+          type: string
+        scopeToPolicyMapping:
+          items:
+            $ref: '#/components/schemas/ScopeToPolicy'
+          type: array
+      type: object
+    SecuritySchemes:
+      additionalProperties: {}
+      type: object
+    Server:
+      properties:
+        authentication:
+          $ref: '#/components/schemas/Authentication'
+        clientCertificates:
+          $ref: '#/components/schemas/ClientCertificates'
+        customDomain:
+          $ref: '#/components/schemas/Domain'
+        detailedActivityLogs:
+          $ref: '#/components/schemas/DetailedActivityLogs'
+        detailedTracing:
+          $ref: '#/components/schemas/DetailedTracing'
+        eventHandlers:
+          $ref: '#/components/schemas/EventHandlers'
+        gatewayTags:
+          $ref: '#/components/schemas/GatewayTags'
+        listenPath:
+          $ref: '#/components/schemas/ListenPath'
+      type: object
+    ServiceDiscovery:
+      properties:
+        cache:
+          $ref: '#/components/schemas/ServiceDiscoveryCache'
+        cacheTimeout:
+          type: integer
+        dataPath:
+          type: string
+        enabled:
+          type: boolean
+        endpointReturnsList:
+          type: boolean
+        parentDataPath:
+          type: string
+        portDataPath:
+          type: string
+        queryEndpoint:
+          type: string
+        targetPath:
+          type: string
+        useNestedQuery:
+          type: boolean
+        useTargetList:
+          type: boolean
+      type: object
+    ServiceDiscoveryCache:
+      properties:
+        enabled:
+          type: boolean
+        timeout:
+          type: integer
+      type: object
+    ServiceDiscoveryConfiguration:
+      properties:
+        cache_disabled:
+          type: boolean
+        cache_timeout:
+          type: integer
+        data_path:
+          type: string
+        endpoint_returns_list:
+          type: boolean
+        parent_data_path:
+          type: string
+        port_data_path:
+          type: string
+        query_endpoint:
+          type: string
+        target_path:
+          type: string
+        use_discovery_service:
+          type: boolean
+        use_nested_query:
+          type: boolean
+        use_target_list:
+          type: boolean
+      type: object
+    SessionProviderMeta:
+      properties:
+        meta:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        name:
+          type: string
+        storage_engine:
+          type: string
+      type: object
+    SessionState:
+      properties:
+        access_rights:
+          additionalProperties:
+            $ref: '#/components/schemas/AccessDefinition'
+          nullable: true
+          type: object
+        alias:
+          example: portal-developer@example.org
+          type: string
+        allowance:
+          example: 1000
+          format: double
+          type: number
+        apply_policies:
+          example:
+          - 641c15dd0fffb800010197bf
+          items:
+            type: string
+          nullable: true
+          type: array
+        apply_policy_id:
+          deprecated: true
+          description: deprecated use apply_policies going forward instead to send
+            a list of policies ids
+          example: 641c15dd0fffb800010197bf
+          type: string
+        basic_auth_data:
+          $ref: '#/components/schemas/BasicAuthData'
+        certificate:
+          type: string
+        data_expires:
+          example: 0
+          format: int64
+          type: integer
+        date_created:
+          example: "2024-03-13T03:56:46.568042549Z"
+          format: date-time
+          type: string
+        enable_detail_recording:
+          deprecated: true
+          description: deprecated use enable_detailed_recording going forward instead
+          example: false
+          type: boolean
+        enable_detailed_recording:
+          example: true
+          type: boolean
+        enable_http_signature_validation:
+          example: false
+          type: boolean
+        expires:
+          example: 1.712895619e+09
+          format: int64
+          type: integer
+        hmac_enabled:
+          example: false
+          type: boolean
+        hmac_string:
+          type: string
+        id_extractor_deadline:
+          format: int64
+          type: integer
+        is_inactive:
+          example: false
+          type: boolean
+        jwt_data:
+          $ref: '#/components/schemas/JWTData'
+        last_check:
+          example: 0
+          format: int64
+          type: integer
+        last_updated:
+          example: "1710302206"
+          type: string
+        max_query_depth:
+          example: -1
+          type: integer
+        meta_data:
+          additionalProperties: {}
+          example:
+            tyk_developer_id: 62b3fb9a1d5e4f00017226f5
+          nullable: true
+          type: object
+        monitor:
+          $ref: '#/components/schemas/Monitor'
+        oauth_client_id:
+          type: string
+        oauth_keys:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        org_id:
+          example: 5e9d9544a1dcd60001d0ed20
+          type: string
+        per:
+          example: 5
+          format: double
+          type: number
+        post_expiry_action:
+          description: Defines the action to take on a Session in Redis after it expires. Valid values are "retain" and "delete".
+          example: delete
+          type: string
+          enum:
+            - retain
+            - delete
+        post_expiry_grace_period:
+          description: Duration in seconds to retain a Session in Redis after it expires. Used with post_expiry_action "retain". Set to -1 to retain indefinitely.
+          example: 0
+          format: int64
+          type: integer
+        quota_max:
+          example: 20000
+          format: int64
+          type: integer
+        quota_remaining:
+          example: 20000
+          format: int64
+          type: integer
+        quota_renewal_rate:
+          example: 3.1556952e+07
+          format: int64
+          type: integer
+        quota_renews:
+          example: 1.710302205e+09
+          format: int64
+          type: integer
+        rate:
+          example: 1
+          format: double
+          type: number
+        rsa_certificate_id:
+          type: string
+        session_lifetime:
+          example: 0
+          format: int64
+          type: integer
+        smoothing:
+          $ref: '#/components/schemas/RateLimitSmoothing'
+        tags:
+          example:
+          - edge
+          - edge-eu
+          items:
+            type: string
+          nullable: true
+          type: array
+        throttle_interval:
+          example: 10
+          format: double
+          type: number
+        throttle_retry_limit:
+          example: 1000
+          type: integer
+      type: object
+    SignatureConfig:
+      properties:
+        algorithm:
+          type: string
+        allowed_clock_skew:
+          type: integer
+        error_code:
+          type: integer
+        error_message:
+          type: string
+        header:
+          type: string
+        param_name:
+          type: string
+        secret:
+          type: string
+        use_param:
+          type: boolean
+      type: object
+    State:
+      properties:
+        active:
+          type: boolean
+        internal:
+          type: boolean
+      type: object
+    StringRegexMap:
+      properties:
+        match_rx:
+          type: string
+        reverse:
+          type: boolean
+      type: object
+    TemplateData:
+      properties:
+        enable_session:
+          type: boolean
+        input_type:
+          enum:
+          - json
+          - xml
+          type: string
+        template_mode:
+          enum:
+          - blob
+          - file
+          type: string
+        template_source:
+          type: string
+      type: object
+    TemplateMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+        template_data:
+          $ref: '#/components/schemas/TemplateData'
+      type: object
+    Test:
+      properties:
+        serviceDiscovery:
+          $ref: '#/components/schemas/ServiceDiscovery'
+      type: object
+    TraceHttpRequest:
+      properties:
+        body:
+          type: string
+        headers:
+          $ref: '#/components/schemas/HttpHeader'
+        method:
+          example: GET
+          type: string
+        path:
+          example: /keyless-test/
+          type: string
+      type: object
+    TraceRequest:
+      type: object
+      properties:
+        request:
+          $ref: '#/components/schemas/TraceHttpRequest'
+        spec:
+          $ref: '#/components/schemas/APIDefinition'
+        oas:
+          oneOf:
+            - $ref: '#/components/schemas/OpenAPI3Schema'
+            - $ref: '#/components/schemas/TykVendorExtension'
+      oneOf:
+        - required: [oas]
+        - required: [spec]
+    TraceResponse:
+      properties:
+        logs:
+          example: '{"level":"warning","msg":"Legacy path detected! Upgrade to extended....'
+          type: string
+        message:
+          example: ok
+          type: string
+        response:
+          example: "====== Request ======\nGET / HTTP/1.1\r\nHost: httpbin.org\r\n\r\n\n======
+            Response..."
+          type: string
+      type: object
+    TrackEndpoint:
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    TrackEndpointMeta:
+      properties:
+        disabled:
+          type: boolean
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    TrafficLogs:
+      properties:
+        enabled:
+          type: boolean
+      type: object
+    TransformBody:
+      properties:
+        body:
+          type: string
+        enabled:
+          type: boolean
+        format:
+          type: string
+        path:
+          type: string
+      type: object
+    TransformHeaders:
+      properties:
+        add:
+          $ref: '#/components/schemas/Headers'
+        enabled:
+          type: boolean
+        remove:
+          items:
+            type: string
+          type: array
+      type: object
+    TransformJQMeta:
+      properties:
+        filter:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    TransformRequestMethod:
+      properties:
+        enabled:
+          type: boolean
+        toMethod:
+          type: string
+      type: object
+    UDGGlobalHeader:
+      properties:
+        key:
+          type: string
+        value:
+          type: string
+      type: object
+    URLRewrite:
+      properties:
+        enabled:
+          type: boolean
+        pattern:
+          type: string
+        rewriteTo:
+          type: string
+        triggers:
+          items:
+            $ref: '#/components/schemas/URLRewriteTrigger'
+          type: array
+      type: object
+    URLRewriteMeta:
+      properties:
+        disabled:
+          type: boolean
+        match_pattern:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+        rewrite_to:
+          type: string
+        triggers:
+          items:
+            $ref: '#/components/schemas/RoutingTrigger'
+          nullable: true
+          type: array
+      type: object
+    URLRewriteRule:
+      properties:
+        in:
+          type: string
+        name:
+          type: string
+        negate:
+          type: boolean
+        pattern:
+          type: string
+      type: object
+    URLRewriteTrigger:
+      properties:
+        condition:
+          type: string
+        rewriteTo:
+          type: string
+        rules:
+          items:
+            $ref: '#/components/schemas/URLRewriteRule'
+          type: array
+      type: object
+    Upstream:
+      properties:
+        certificatePinning:
+          $ref: '#/components/schemas/CertificatePinning'
+        mutualTLS:
+          $ref: '#/components/schemas/MutualTLS'
+        rateLimit:
+          $ref: '#/components/schemas/RateLimit'
+        serviceDiscovery:
+          $ref: '#/components/schemas/ServiceDiscovery'
+        test:
+          $ref: '#/components/schemas/Test'
+        url:
+          type: string
+      type: object
+    UptimeTests:
+      properties:
+        check_list:
+          items:
+            $ref: '#/components/schemas/HostCheckObject'
+          nullable: true
+          type: array
+        config:
+          $ref: '#/components/schemas/UptimeTestsConfig'
+      type: object
+    UptimeTestsConfig:
+      properties:
+        expire_utime_after:
+          type: integer
+        recheck_wait:
+          type: integer
+        service_discovery:
+          $ref: '#/components/schemas/ServiceDiscoveryConfiguration'
+      type: object
+    ValidatePathMeta:
+      properties:
+        disabled:
+          type: boolean
+        error_response_code:
+          type: integer
+        method:
+          type: string
+        path:
+          type: string
+        schema:
+          additionalProperties: {}
+          nullable: true
+          type: object
+        schema_b64:
+          type: string
+      type: object
+    ValidateRequest:
+      properties:
+        enabled:
+          type: boolean
+        errorResponseCode:
+          type: integer
+      type: object
+    ValidateRequestMeta:
+      properties:
+        enabled:
+          type: boolean
+        error_response_code:
+          type: integer
+        method:
+          type: string
+        path:
+          type: string
+      type: object
+    VersionData:
+      properties:
+        default_version:
+          type: string
+        not_versioned:
+          type: boolean
+        versions:
+          additionalProperties:
+            $ref: '#/components/schemas/VersionInfo'
+          nullable: true
+          type: object
+      type: object
+    VersionDefinition:
+      properties:
+        default:
+          type: string
+        enabled:
+          type: boolean
+        fallback_to_default:
+          type: boolean
+        key:
+          example: x-api-version
+          type: string
+        location:
+          example: header
+          type: string
+        name:
+          type: string
+        strip_path:
+          type: boolean
+        strip_versioning_data:
+          type: boolean
+        url_versioning_pattern:
+          type: string
+        versions:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+      type: object
+    VersionInfo:
+      properties:
+        expires:
+          type: string
+        extended_paths:
+          $ref: '#/components/schemas/ExtendedPathsSet'
+        global_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        global_headers_disabled:
+          type: boolean
+        global_headers_remove:
+          items:
+            type: string
+          nullable: true
+          type: array
+        global_response_headers:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        global_response_headers_disabled:
+          type: boolean
+        global_response_headers_remove:
+          items:
+            type: string
+          nullable: true
+          type: array
+        global_size_limit:
+          format: int64
+          type: integer
+        ignore_endpoint_case:
+          type: boolean
+        name:
+          type: string
+        override_target:
+          type: string
+        paths:
+          properties:
+            black_list:
+              items:
+                type: string
+              nullable: true
+              type: array
+            ignored:
+              items:
+                type: string
+              nullable: true
+              type: array
+            white_list:
+              items:
+                type: string
+              nullable: true
+              type: array
+          type: object
+        use_extended_paths:
+          example: true
+          type: boolean
+      type: object
+    VersionMeta:
+      properties:
+        expirationDate:
+          example: 2026-03-26 09:00
+          type: string
+        id:
+          example: keyless
+          type: string
+        internal:
+          example: false
+          type: boolean
+        isDefaultVersion:
+          example: true
+          type: boolean
+        name:
+          example: Tyk Test Keyless API
+          type: string
+        versionName:
+          example: v2
+          type: string
+      type: object
+    VersionMetas:
+      properties:
+        apis:
+          items:
+            $ref: '#/components/schemas/VersionMeta'
+          nullable: true
+          type: array
+        status:
+          example: success
+          type: string
+      type: object
+    VersionToID:
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+      type: object
+    Versioning:
+      properties:
+        default:
+          type: string
+        enabled:
+          type: boolean
+        fallbackToDefault:
+          type: boolean
+        key:
+          type: string
+        location:
+          type: string
+        name:
+          type: string
+        stripVersioningData:
+          type: boolean
+        urlVersioningPattern:
+          type: string
+        versions:
+          items:
+            $ref: '#/components/schemas/VersionToID'
+          nullable: true
+          type: array
+      type: object
+    VirtualEndpoint:
+      properties:
+        body:
+          type: string
+        enabled:
+          type: boolean
+        functionName:
+          type: string
+        name:
+          type: string
+        path:
+          type: string
+        proxyOnError:
+          type: boolean
+        requireSession:
+          type: boolean
+      type: object
+    VirtualMeta:
+      properties:
+        disabled:
+          type: boolean
+        function_source_type:
+          enum:
+          - blob
+          - file
+          type: string
+        function_source_uri:
+          type: string
+        method:
+          type: string
+        path:
+          type: string
+        proxy_on_error:
+          type: boolean
+        response_function_name:
+          type: string
+        use_session:
+          type: boolean
+      type: object
+    XTykAPIGateway:
+      properties:
+        info:
+          $ref: '#/components/schemas/Info'
+        middleware:
+          $ref: '#/components/schemas/Middleware'
+        server:
+          $ref: '#/components/schemas/Server'
+        upstream:
+          $ref: '#/components/schemas/Upstream'
+      type: object
+    TykVendorExtension:
+      properties:
+        x-tyk-api-gateway:
+          $ref: '#/components/schemas/XTykAPIGateway'
+      type: object
+  securitySchemes:
+    api_key:
+      description: Api key
+      in: header
+      name: X-Tyk-Authorization
+      type: apiKey
diff --git a/swagger/identity-broker-swagger.yml b/swagger/identity-broker-swagger.yml
new file mode 100644
index 0000000000..3ab39b80d5
--- /dev/null
+++ b/swagger/identity-broker-swagger.yml
@@ -0,0 +1,872 @@
+openapi: "3.0.3"
+
+info:
+  title: Tyk Identity Broker (TIB) API
+  description: |
+    The Tyk Identity Broker (TIB) acts as a delegated authentication gateway between
+    external identity providers (OAuth/Social, SAML, LDAP, Reverse Proxy) and the
+    Tyk ecosystem.
+
+    ## Authentication
+
+    Profile management endpoints (`/api/*`) require an `Authorization` header whose
+    value must exactly match the `Secret` field in `tib.conf`.
+
+    Auth flow endpoints (`/auth/*`) are public — they are the entry points for
+    end-user authentication and are called by browsers or API clients, not by
+    back-end services.
+  version: "v1.7.2"
+  contact:
+    email: support@tyk.io
+    name: Tyk Technologies
+    url: https://tyk.io/contact
+
+servers:
+  - url: http://localhost:3010
+    description: Default local TIB instance
+
+tags:
+  - name: Auth
+    description: Entry points for identity-provider authentication flows (public)
+  - name: Profiles
+    description: CRUD management of TIB profiles (requires Authorization header)
+  - name: Health
+    description: Health check
+
+# ---------------------------------------------------------------------------
+# Reusable components
+# ---------------------------------------------------------------------------
+components:
+
+  schemas:
+
+    # --- Enums ---------------------------------------------------------------
+
+    Action:
+      type: string
+      description: |
+        Determines what TIB does with the confirmed identity.
+        - `GenerateOrLoginDeveloperProfile` – create/log in a Tyk Developer Portal API Consumer
+        - `GenerateOrLoginUserProfile` – create/log in a Tyk Dashboard user or Tyk Developer Portal API Owner
+        - `GenerateOAuthTokenForClient` – generate an OAuth token for an API client (also used for the OAuth password flow)
+        - `GenerateTemporaryAuthToken` – generate a short-lived Tyk access token
+      enum:
+        - GenerateOrLoginDeveloperProfile
+        - GenerateOrLoginUserProfile
+        - GenerateOAuthTokenForClient
+        - GenerateTemporaryAuthToken
+
+    ProviderType:
+      type: string
+      description: |
+        - `redirect` – the user is redirected to an external IdP (OAuth, SAML)
+        - `passthrough` – credentials are validated inline without a redirect (LDAP, Proxy)
+      enum:
+        - redirect
+        - passthrough
+
+    ProviderName:
+      type: string
+      description: Identifier for the concrete provider implementation.
+      enum:
+        - SocialProvider
+        - ADProvider
+        - SAMLProvider
+        - ProxyProvider
+
+    # --- Nested objects ------------------------------------------------------
+
+    ProfileConstraint:
+      type: object
+      description: |
+        Optional constraints that restrict which users may authenticate via this profile.
+      properties:
+        Domain:
+          type: string
+          description: |
+            Restrict logins to email addresses on this domain (e.g. `tyk.io`).
+            Empty string means no domain restriction.
+          example: "tyk.io"
+        Group:
+          type: string
+          description: |
+            Restrict logins to members of this group (provider-specific semantics).
+          example: "engineering"
+
+    # --- Provider-specific config objects (polymorphic via ProviderConfig) ---
+
+    GothConfig:
+      type: object
+      description: |
+        ProviderConfig for `SocialProvider` (OAuth/OIDC).
+        Also supports an optional `JWE` object for encrypted token handling (omitted here — see TIB documentation for JWE configuration).
+      properties:
+        CallbackBaseURL:
+          type: string
+          description: Base URL used to build the OAuth callback URL.
+          example: "https://tib.example.com"
+        FailureRedirect:
+          type: string
+          description: URL to redirect to when authentication or constraint checks fail.
+          example: "https://app.example.com/login?error=1"
+        UseProviders:
+          type: array
+          description: List of OAuth provider configurations to enable.
+          items:
+            type: object
+            properties:
+              Name:
+                type: string
+                description: Goth provider name (e.g. `linkedin`, `github`, `openid-connect`).
+                example: "openid-connect"
+              Key:
+                type: string
+                description: OAuth client ID / application key.
+                example: "my-client-id"
+              Secret:
+                type: string
+                description: OAuth client secret.
+                example: "my-client-secret"
+              DiscoverURL:
+                type: string
+                description: OIDC discovery URL (required for `openid-connect` provider).
+                example: "https://accounts.identity-provider.com/.well-known/openid-configuration"
+              DisableAuthHeaderProviderDomain:
+                type: string
+                description: Disable the auth header for a specific provider domain.
+                example: ""
+              Scopes:
+                type: array
+                items:
+                  type: string
+                description: Additional OAuth scopes to request.
+                example: ["email", "profile"]
+              SkipUserInfoRequest:
+                type: boolean
+                description: Skip the userinfo endpoint request after token exchange.
+                example: false
+
+    ADConfig:
+      type: object
+      description: ProviderConfig for `ADProvider` (LDAP / Active Directory).
+      properties:
+        LDAPServer:
+          type: string
+          example: "ldap.example.com"
+        LDAPPort:
+          type: string
+          description: LDAP server port as a string.
+          example: "389"
+        LDAPUserDN:
+          type: string
+          description: DN template for the authenticating user. Use `{username}` as a placeholder.
+          example: "uid={username},ou=users,dc=example,dc=com"
+        LDAPBaseDN:
+          type: string
+          example: "dc=example,dc=com"
+        LDAPFilter:
+          type: string
+          description: LDAP search filter applied when looking up users.
+          example: "(objectClass=person)"
+        LDAPAttributes:
+          type: array
+          items:
+            type: string
+          description: LDAP attributes to retrieve for the user.
+          example: ["mail", "givenName", "sn"]
+        LDAPEmailAttribute:
+          type: string
+          example: "mail"
+        LDAPFirstNameAttribute:
+          type: string
+          example: "givenName"
+        LDAPLastNameAttribute:
+          type: string
+          example: "sn"
+        LDAPUseSSL:
+          type: boolean
+          example: false
+        LDAPAdminUser:
+          type: string
+          description: DN of an admin user for performing user-lookup searches.
+          example: "cn=admin,dc=example,dc=com"
+        LDAPAdminPassword:
+          type: string
+          example: "s3cr3t"
+        LDAPSearchScope:
+          type: integer
+          description: LDAP search scope (0=Base, 1=SingleLevel, 2=WholeSubtree).
+          example: 2
+        DefaultDomain:
+          type: string
+          description: Default domain to append to usernames that have no domain component.
+          example: "example.com"
+        GetAuthFromBAHeader:
+          type: boolean
+          description: Extract username and password from the HTTP Basic Auth header.
+          example: true
+        SlugifyUserName:
+          type: boolean
+          description: Normalise the username to a URL-safe slug before use.
+          example: false
+        FailureRedirect:
+          type: string
+          example: "https://app.example.com/login?error=1"
+
+    SAMLConfig:
+      type: object
+      description: ProviderConfig for `SAMLProvider`.
+      properties:
+        IDPMetadataURL:
+          type: string
+          description: URL to the IdP's SAML metadata XML.
+          example: "https://idp.example.com/metadata"
+        CertLocation:
+          type: string
+          description: Filesystem path to the SP certificate file (PEM).
+          example: "/etc/tib/certs/sp.crt"
+        SAMLBaseURL:
+          type: string
+          description: Base URL of TIB, used to build SAML ACS and metadata URLs.
+          example: "https://tib.example.com"
+        ForceAuthentication:
+          type: boolean
+          description: Force the IdP to re-authenticate the user on every request.
+          example: false
+        SAMLBinding:
+          type: string
+          description: SAML binding type (e.g. `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST`).
+          example: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+        SAMLEmailClaim:
+          type: string
+          description: SAML assertion attribute name containing the user's email.
+          example: "urn:oid:0.9.2342.19200300.100.1.3"
+        SAMLForenameClaim:
+          type: string
+          example: "urn:oid:2.5.4.42"
+        SAMLSurnameClaim:
+          type: string
+          example: "urn:oid:2.5.4.4"
+        FailureRedirect:
+          type: string
+          description: URL to redirect to on authentication failure.
+          example: "https://app.example.com/login?error=1"
+        EntityId:
+          type: string
+          description: SAML SP entity ID (defaults to SAMLBaseURL if empty).
+          example: "https://tib.example.com/saml/metadata"
+
+    ProxyConfig:
+      type: object
+      description: ProviderConfig for `ProxyProvider` (delegates auth to an external HTTP endpoint).
+      properties:
+        TargetHost:
+          type: string
+          description: The URL of the upstream service that validates credentials.
+          example: "https://auth.example.com/validate"
+        OKCode:
+          type: integer
+          description: HTTP status code that signals a successful authentication.
+          example: 200
+        OKRegex:
+          type: string
+          description: Optional regex that must match the response body for auth to succeed.
+          example: ""
+        OKResponse:
+          type: string
+          description: Optional literal string that must appear in the response body.
+          example: ""
+        ResponseIsJson:
+          type: boolean
+          description: Set to true if the upstream response body is JSON.
+          example: true
+        AccessTokenField:
+          type: string
+          description: JSON field name in the upstream response that contains an access token.
+          example: "access_token"
+        UsernameField:
+          type: string
+          description: JSON field name in the upstream response that contains the username.
+          example: "username"
+        ExrtactUserNameFromBasicAuthHeader:
+          type: boolean
+          description: |
+            Extract the username from the HTTP Basic Auth header instead of the
+            upstream response. Note: field name contains a typo (`Exrtact`) which
+            matches the Go struct exactly.
+          example: false
+
+    # --- Core Profile --------------------------------------------------------
+
+    Profile:
+      type: object
+      required:
+        - ID
+        - ActionType
+        - ProviderName
+        - Type
+      properties:
+        ID:
+          type: string
+          description: |
+            Unique identifier for this profile. Must match the `{id}` path parameter
+            when creating or updating.
+          example: "github-sso-dashboard"
+        Name:
+          type: string
+          description: Human-readable display name for this profile.
+          example: "GitHub SSO - Dashboard Login"
+        OrgID:
+          type: string
+          description: Tyk organisation ID this profile belongs to.
+          example: "5e9d9544a1dcd60001d0ed20"
+        ActionType:
+          $ref: "#/components/schemas/Action"
+        MatchedPolicyID:
+          type: string
+          description: |
+            Tyk policy ID to attach to tokens or sessions generated by this profile.
+          example: "5f8f9e3c1b5e4a0001b3c4d5"
+        Type:
+          $ref: "#/components/schemas/ProviderType"
+        ProviderName:
+          $ref: "#/components/schemas/ProviderName"
+        CustomEmailField:
+          type: string
+          description: |
+            Override the claim/attribute used to extract the user's email address.
+            Leave empty to use the provider default.
+          example: "email"
+        CustomUserIDField:
+          type: string
+          description: |
+            Override the claim/attribute used to extract the user's unique identifier.
+          example: "sub"
+        ProviderConfig:
+          type: object
+          description: |
+            Provider-specific configuration object. The shape depends on `ProviderName`:
+            - `SocialProvider` → see `GothConfig` schema
+            - `ADProvider` → see `ADConfig` schema
+            - `SAMLProvider` → see `SAMLConfig` schema
+            - `ProxyProvider` → see `ProxyConfig` schema
+          additionalProperties: true
+        IdentityHandlerConfig:
+          type: object
+          description: |
+            Additional key/value settings passed to the identity handler
+            (e.g. OAuth client credentials, token TTL).
+          additionalProperties: true
+          example:
+            oauth-client-id: "tyk-portal-client"
+            oauth-client-secret: "s3cr3t"
+            oauth-client-base-url: "http://gateway:8080"
+        ProviderConstraints:
+          $ref: "#/components/schemas/ProfileConstraint"
+        ReturnURL:
+          type: string
+          description: URL the user is redirected to after successful authentication.
+          example: "https://dashboard.example.com/tap"
+        DefaultUserGroupID:
+          type: string
+          description: |
+            Tyk user-group ID assigned to users that do not match any entry in
+            `UserGroupMapping`.
+          example: "5f8f9e3c1b5e4a0001b3c4d6"
+        CustomUserGroupField:
+          type: string
+          description: Claim/attribute name that carries the user's group membership.
+          example: "groups"
+        UserGroupMapping:
+          type: object
+          description: |
+            Maps IdP group names to Tyk user-group IDs.
+          additionalProperties:
+            type: string
+          example:
+            admins: "5f8f9e3c1b5e4a0001b3c4d7"
+            developers: "5f8f9e3c1b5e4a0001b3c4d8"
+        UserGroupSeparator:
+          type: string
+          description: |
+            Separator used when a single claim contains multiple group values
+            (e.g. `","` or `" "`).
+          example: ","
+        SSOOnlyForRegisteredUsers:
+          type: boolean
+          description: |
+            When `true`, only pre-existing Tyk users may log in via SSO.
+            New users will be rejected rather than auto-created.
+          example: false
+
+    # --- API response wrappers -----------------------------------------------
+
+    APIOKMessage:
+      type: object
+      properties:
+        Status:
+          type: string
+          enum: [ok]
+          example: "ok"
+        ID:
+          type: string
+          description: The profile ID the operation was performed on.
+          example: "github-sso-dashboard"
+        Data:
+          description: Payload — a single Profile object, a list of Profiles, or an empty object.
+          oneOf:
+            - $ref: "#/components/schemas/Profile"
+            - type: array
+              items:
+                $ref: "#/components/schemas/Profile"
+            - type: object
+
+    APIErrorMessage:
+      type: object
+      properties:
+        Status:
+          type: string
+          enum: [error]
+          example: "error"
+        Error:
+          type: string
+          description: Human-readable error message.
+          example: "Profile not found"
+
+  parameters:
+    profileId:
+      name: id
+      in: path
+      required: true
+      description: The unique identifier of the authentication profile.
+      schema:
+        type: string
+      example: "github-sso-dashboard"
+
+    providerName:
+      name: provider
+      in: path
+      required: true
+      description: |
+        The provider sub-path. For Social/OIDC providers this is the Goth provider
+        name (e.g. `github`, `linkedin`, `openid-connect`). For SAML it is `saml`.
+        For LDAP/Proxy it matches the configured provider identifier.
+      schema:
+        type: string
+      example: "github"
+
+  responses:
+    Unauthorized:
+      description: Missing or incorrect `Authorization` header.
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/APIErrorMessage"
+          example:
+            Status: "error"
+            Error: "Authorization failed"
+
+    NotFound:
+      description: The requested profile does not exist.
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/APIErrorMessage"
+          example:
+            Status: "error"
+            Error: "Profile not found"
+
+    BadRequest:
+      description: The request body is malformed or the ID fields do not match.
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/APIErrorMessage"
+          example:
+            Status: "error"
+            Error: "Object ID and URI resource ID do not match"
+
+  securitySchemes:
+    ApiSecret:
+      type: apiKey
+      in: header
+      name: Authorization
+      description: |
+        Must equal the `Secret` value in `tib.conf`.
+        Example: `Authorization: your-tib-secret`
+
+# ---------------------------------------------------------------------------
+# Security applied globally to /api/* paths
+# ---------------------------------------------------------------------------
+security: []   # default: no security — overridden per-operation below
+
+# ---------------------------------------------------------------------------
+# Paths
+# ---------------------------------------------------------------------------
+paths:
+
+  # --------------------------------------------------------------------------
+  # Health check
+  # --------------------------------------------------------------------------
+  /health:
+    get:
+      tags: [Health]
+      summary: Health check
+      description: Returns HTTP 200 when TIB is running and ready to serve requests.
+      operationId: healthCheck
+      responses:
+        "200":
+          description: Service is healthy.
+
+  # --------------------------------------------------------------------------
+  # Auth flows (public — no Authorization header required)
+  # --------------------------------------------------------------------------
+  /auth/{id}/{provider}:
+    get:
+      tags: [Auth]
+      summary: Initiate authentication
+      description: |
+        Entry point for an authentication flow. For **redirect** providers (Social, SAML)
+        this responds with an HTTP redirect to the external IdP. For **passthrough**
+        providers (LDAP, Proxy) this validates credentials inline.
+
+        The `{provider}` segment must match one of the Goth provider names configured
+        in the profile's `ProviderConfig.UseProviders` list (e.g. `github`, `linkedin`,
+        `openid-connect`) or `saml`, `ldap`, `proxy` for the respective provider types.
+      operationId: initiateAuth
+      parameters:
+        - $ref: "#/components/parameters/profileId"
+        - $ref: "#/components/parameters/providerName"
+      responses:
+        "302":
+          description: |
+            Redirect to the external identity provider (redirect providers only).
+        "200":
+          description: |
+            Authentication completed inline (passthrough providers).
+            The response body and any redirect depend on the configured `ActionType`.
+        "400":
+          description: Missing or invalid profile ID.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIErrorMessage"
+
+    post:
+      tags: [Auth]
+      summary: Initiate authentication (POST)
+      description: |
+        Identical to the GET variant. Provided for passthrough providers that receive
+        credentials as a form POST or via a Basic Auth header.
+      operationId: initiateAuthPost
+      parameters:
+        - $ref: "#/components/parameters/profileId"
+        - $ref: "#/components/parameters/providerName"
+      requestBody:
+        description: |
+          Optional form body or JSON body carrying credentials (provider-dependent).
+          LDAP and Proxy providers typically read a `Basic` `Authorization` header
+          rather than a request body.
+        required: false
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              additionalProperties: true
+      responses:
+        "302":
+          description: Redirect to the external identity provider.
+        "200":
+          description: Authentication completed inline.
+        "400":
+          description: Missing or invalid profile ID.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIErrorMessage"
+
+  /auth/{id}/{provider}/callback:
+    get:
+      tags: [Auth]
+      summary: OAuth / SAML callback
+      description: |
+        The redirect URI registered with the external OAuth/OIDC provider or the SAML
+        Assertion Consumer Service (ACS) endpoint. TIB uses this to exchange the
+        authorization code (or process the SAML response) and complete the login action.
+
+        After a successful callback, TIB executes the profile's `ActionType` and
+        redirects the user to `ReturnURL`.
+      operationId: handleAuthCallback
+      parameters:
+        - $ref: "#/components/parameters/profileId"
+        - $ref: "#/components/parameters/providerName"
+        - name: code
+          in: query
+          description: OAuth 2.0 authorization code (OAuth flows only).
+          schema:
+            type: string
+        - name: state
+          in: query
+          description: OAuth 2.0 state parameter for CSRF protection.
+          schema:
+            type: string
+      responses:
+        "302":
+          description: Redirect to `ReturnURL` after successful authentication and action.
+        "400":
+          description: Missing profile ID or callback processing error.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIErrorMessage"
+        "500":
+          description: Internal error completing the identity action.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIErrorMessage"
+
+    post:
+      tags: [Auth]
+      summary: OAuth / SAML callback (POST)
+      description: |
+        Same as the GET callback but accepts a POST body — required for SAML HTTP-POST
+        binding where the IdP POSTs the `SAMLResponse` form field to the ACS URL.
+      operationId: handleAuthCallbackPost
+      parameters:
+        - $ref: "#/components/parameters/profileId"
+        - $ref: "#/components/parameters/providerName"
+      requestBody:
+        required: false
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                SAMLResponse:
+                  type: string
+                  description: Base64-encoded SAML assertion (SAML POST binding).
+                RelayState:
+                  type: string
+                  description: SAML relay state value.
+              additionalProperties: true
+      responses:
+        "302":
+          description: Redirect to `ReturnURL` after successful authentication.
+        "400":
+          description: Bad request.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIErrorMessage"
+
+  /auth/{id}/saml/metadata:
+    get:
+      tags: [Auth]
+      summary: SAML SP metadata
+      description: |
+        Returns the SAML Service Provider (SP) metadata XML for the specified profile.
+        Register this URL as the SP metadata endpoint in your SAML IdP configuration.
+      operationId: samlMetadata
+      parameters:
+        - $ref: "#/components/parameters/profileId"
+      responses:
+        "200":
+          description: SAML SP metadata XML.
+          content:
+            application/xml:
+              schema:
+                type: string
+        "400":
+          description: Missing or invalid profile ID.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIErrorMessage"
+
+  # --------------------------------------------------------------------------
+  # Profile management (all require Authorization header)
+  # --------------------------------------------------------------------------
+  /api/profiles:
+    get:
+      tags: [Profiles]
+      summary: List all profiles
+      description: Returns every authentication profile stored in the active backend.
+      operationId: listProfiles
+      security:
+        - ApiSecret: []
+      responses:
+        "200":
+          description: Array of profiles (may be empty).
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - $ref: "#/components/schemas/APIOKMessage"
+                  - type: object
+                    properties:
+                      Data:
+                        type: array
+                        items:
+                          $ref: "#/components/schemas/Profile"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+
+  /api/profiles/{id}:
+    get:
+      tags: [Profiles]
+      summary: Get a profile
+      description: Retrieves a single authentication profile by its ID.
+      operationId: getProfile
+      security:
+        - ApiSecret: []
+      parameters:
+        - $ref: "#/components/parameters/profileId"
+      responses:
+        "200":
+          description: The requested profile.
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - $ref: "#/components/schemas/APIOKMessage"
+                  - type: object
+                    properties:
+                      Data:
+                        $ref: "#/components/schemas/Profile"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+
+    post:
+      tags: [Profiles]
+      summary: Create a profile
+      description: |
+        Creates a new authentication profile. The `ID` field in the request body must
+        match the `{id}` path parameter, otherwise a 400 is returned.
+      operationId: createProfile
+      security:
+        - ApiSecret: []
+      parameters:
+        - $ref: "#/components/parameters/profileId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Profile"
+            examples:
+              GitHubSSODashboard:
+                summary: GitHub OAuth → Dashboard login
+                value:
+                  ID: "github-sso-dashboard"
+                  Name: "GitHub SSO - Dashboard"
+                  OrgID: "5e9d9544a1dcd60001d0ed20"
+                  ActionType: "GenerateOrLoginUserProfile"
+                  Type: "redirect"
+                  ProviderName: "SocialProvider"
+                  ReturnURL: "https://dashboard.example.com/tap"
+                  ProviderConstraints:
+                    Domain: ""
+                    Group: ""
+                  ProviderConfig:
+                    CallbackBaseURL: "https://tib.example.com"
+                    FailureRedirect: "https://dashboard.example.com/login?error=1"
+                    UseProviders:
+                      - Name: "github"
+                        Key: "my-github-client-id"
+                        Secret: "my-github-client-secret"
+              LDAPDashboard:
+                summary: LDAP / Active Directory → Dashboard login
+                value:
+                  ID: "ldap-dashboard"
+                  Name: "LDAP – Dashboard"
+                  OrgID: "5e9d9544a1dcd60001d0ed20"
+                  ActionType: "GenerateOrLoginUserProfile"
+                  Type: "passthrough"
+                  ProviderName: "ADProvider"
+                  ReturnURL: "https://dashboard.example.com/tap"
+                  ProviderConfig:
+                    LDAPServer: "ldap.example.com"
+                    LDAPPort: "389"
+                    LDAPUserDN: "uid={username},ou=users,dc=example,dc=com"
+                    LDAPBaseDN: "dc=example,dc=com"
+                    LDAPFilter: "(objectClass=person)"
+                    LDAPEmailAttribute: "mail"
+                    LDAPUseSSL: false
+                    GetAuthFromBAHeader: true
+      responses:
+        "201":
+          description: Profile created successfully.
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - $ref: "#/components/schemas/APIOKMessage"
+                  - type: object
+                    properties:
+                      Data:
+                        $ref: "#/components/schemas/Profile"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+
+    put:
+      tags: [Profiles]
+      summary: Update a profile
+      description: |
+        Replaces an existing authentication profile. The entire profile object is
+        overwritten with the request body.
+      operationId: updateProfile
+      security:
+        - ApiSecret: []
+      parameters:
+        - $ref: "#/components/parameters/profileId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Profile"
+      responses:
+        "200":
+          description: Profile updated successfully.
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - $ref: "#/components/schemas/APIOKMessage"
+                  - type: object
+                    properties:
+                      Data:
+                        $ref: "#/components/schemas/Profile"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+
+    delete:
+      tags: [Profiles]
+      summary: Delete a profile
+      description: Permanently removes the specified authentication profile.
+      operationId: deleteProfile
+      security:
+        - ApiSecret: []
+      parameters:
+        - $ref: "#/components/parameters/profileId"
+      responses:
+        "200":
+          description: Profile deleted successfully. `Data` will be an empty object.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIOKMessage"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+
diff --git a/swagger/mdcb-swagger.yml b/swagger/mdcb-swagger.yml
new file mode 100644
index 0000000000..00d712d234
--- /dev/null
+++ b/swagger/mdcb-swagger.yml
@@ -0,0 +1,968 @@
+openapi: 3.0.0
+info:
+  contact:
+    email: support@tyk.io
+    name: Tyk Technologies
+    url: https://tyk.io/contact
+  version: 1.0.0
+  title: MDCB Data Planes and Diagnostics API
+  description: >
+    This API provides operations for monitoring Data Planes connected to MDCB and accessing diagnostic data. 
+    It includes endpoints for retrieving connected data plane details, performing health checks, 
+    and accessing Go's built-in pprof diagnostics for advanced performance profiling.
+tags:
+  - name: Data Planes
+    description: Operations related to data plane management and information
+  - name: Health
+    description: Endpoints for checking system health and status
+  - name: Debug
+    description: Diagnostic and profiling endpoints
+  - name: Configuration
+    description: Configuration and environment variable management
+servers:
+  - url: https://{tenant}
+    variables:
+      tenant:
+        default: localhost:8181
+        description: Your MDCB host
+security:
+  - api_key: []
+paths:
+  /dataplanes:
+    get:
+      tags:
+        - Data Planes
+      summary: Retrieve information of all the connected data plane nodes.
+      description: Provides a list of all the data plane nodes connected to MDCB. Data plane nodes are Tyk Gateways that make your APIs available to your consumers. MDCB offers centralised management of your data plane nodes. This endpoint offers metadata and status for all connected data plane nodes, allowing for monitoring and troubleshooting.
+      operationId: dataplanesGet
+      responses:
+        "200":
+          description: Successful retrieval of the connected data planes.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties:
+                  type: array
+                  items:
+                    $ref: "#/components/schemas/Node"
+        "401":
+          description: Forbidden access due to invalid or missing administrative key.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+  /health:
+    get:
+      tags:
+        - Health
+      summary: Health Check
+      description: Returns OK if the service is up and running.
+      operationId: healthGet
+      responses:
+        "200":
+          description: Service is up and running.
+          content:
+            text/plain:
+              schema:
+                type: string
+                example: "OK"
+  /readiness:
+    get:
+      tags:
+        - Health
+      summary: Check system readiness status
+      description: >
+        Assesses the readiness of the system and its critical components.
+        This endpoint determines if the system is prepared to handle requests
+        by evaluating the status of essential services and dependencies.
+      operationId: readinessGet
+      responses:
+        "200":
+          description: >
+            System is ready. All critical components are operational and 
+            the system is capable of handling requests.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ReadinessStatus"
+        "503":
+          description: >
+            System is not ready. One or more critical components are 
+            non-operational, preventing the system from handling requests properly.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ReadinessFailure"
+  /liveness:
+    get:
+      tags:
+        - Health
+      summary: Check liveness status
+      description: Provides the liveness status of the service.
+      operationId: livenessGet
+      responses:
+        "200":
+          description: MDCB is alive.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/LivenessStatus"
+  /debug/pprof/profile:
+    get:
+      tags:
+        - Debug
+      summary: CPU Profiling data
+      description: Returns CPU profiling data. Available only when HTTPProfile is enabled in sink.conf.
+      operationId: debugPprofProfileGet
+      responses:
+        "200":
+          description: CPU profiling data.
+          content:
+            application/octet-stream:
+              schema:
+                type: string
+                format: binary
+  /debug/pprof/{profileType}:
+    get:
+      tags:
+        - Debug
+      summary: pprof data
+      description: >
+        Serves various pprof data like heap, goroutine, threadcreate, block, and so on. The `{profileType}` path parameter can accept various profiling types as well as more complex patterns. Available only when HTTPProfile is enabled in sink.conf.
+      operationId: debugPprofProfileTypeGet
+      parameters:
+        - in: path
+          name: profileType
+          required: true
+          description: The specific pprof data to retrieve (heap, goroutine, threadcreate, block, etc.), or a pattern matching multiple types.
+          schema:
+            type: string
+            example: heap
+      responses:
+        "200":
+          description: pprof data.
+          content:
+            application/octet-stream:
+              schema:
+                type: string
+                format: binary
+  /config:
+    get:
+      tags:
+        - Configuration
+      summary: Retrieve current configuration status
+      description: |
+        Returns the current configuration status of the system. You can optionally filter for a specific configuration field.
+
+        **Example curl commands:**
+
+        Get full configuration:
+        ```bash
+        curl -X GET \
+        http://localhost:8181/config \
+        -H 'X-Tyk-Authorization: your-secret-key'
+        ```
+
+        Get specific configuration field:
+        ```bash
+        curl -X GET \
+        'http://localhost:8181/config?field=storage.host' \
+        -H 'X-Tyk-Authorization: your-secret-key'
+        ```
+      operationId: configGet
+      parameters:
+        - in: query
+          name: field
+          description: Optional configuration field name to filter by
+          required: false
+          schema:
+            type: string
+          example: "storage.host"
+      responses:
+        "200":
+          description: Successful retrieval of the current configuration.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  type:
+                    type: string
+                    enum: ["full", "single"]
+                discriminator:
+                  propertyName: type
+                allOf:
+                  - $ref: "#/components/schemas/ConfigStatus"
+                  - $ref: "#/components/schemas/EnvVariable"
+              examples:
+                full_config:
+                  summary: Full configuration
+                  value:
+                    type: "full"
+                    listen_port: 9090
+                    healthcheck_port: 8180
+                    http_port: 8180
+                    enable_http_profiler: false
+                    server_options:
+                      use_ssl: false
+                      certificate:
+                        cert_file: "./server.crt"
+                        key_file: "./server.key"
+                      min_version: 0
+                      ssl_ciphers: null
+                      ssl_certificates: null
+                    http_server_options:
+                      use_ssl: false
+                      certificate:
+                        cert_file: ""
+                        key_file: ""
+                      min_version: 0
+                      ssl_ciphers: null
+                      ssl_certificates: null
+                    security:
+                      private_certificate_encoding_secret: ""
+                      enable_http_secure_endpoints: true
+                      secret: ""
+                    storage:
+                      type: "redis"
+                      host: "localhost"
+                      port: 6379
+                      master_name: ""
+                      sentinel_password: ""
+                      username: ""
+                      password: ""
+                      database: 0
+                      optimisation_max_idle: 0
+                      optimisation_max_active: 0
+                      enable_cluster: false
+                      hosts: null
+                      addrs: null
+                      redis_use_ssl: false
+                      redis_ssl_insecure_skip_verify: false
+                      debug: false
+                      timeout: 0
+                      use_ssl: false
+                      ssl_insecure_skip_verify: false
+                      ca_file: ""
+                      cert_file: ""
+                      key_file: ""
+                      max_version: ""
+                      min_version: ""
+                    analytics:
+                      type: "mongo"
+                      connection_string: ""
+                      table_sharding: false
+                      batch_size: 0
+                      postgres:
+                        prefer_simple_protocol: false
+                      mysql:
+                        default_string_size: 0
+                        disable_datetime_precision: false
+                        dont_support_rename_index: false
+                        dont_support_rename_column: false
+                        skip_initialize_with_version: false
+                      mongo_url: ""
+                      mongo_use_ssl: false
+                      mongo_ssl_insecure_skip_verify: false
+                      mongo_ssl_allow_invalid_hostnames: false
+                      mongo_ssl_ca_file: ""
+                      mongo_ssl_pem_keyfile: ""
+                      mongo_session_consistency: ""
+                      mongo_batch_size: 0
+                      driver: "mongo-go"
+                      mongo_direct_connection: false
+                      mongo_ignore_aggregations: null
+                      mongo_enable_aggregate_self_healing: false
+                    hash_keys: true
+                    session_timeout: 0
+                    forward_analytics_to_pump: false
+                    enable_multiple_analytics_keys: false
+                    dont_store_selective: false
+                    dont_store_aggregate: false
+                    org_session_expiration: 60
+                    org_session_cleanup: 60
+                    license: ""
+                    aggregates_ignore_tags: null
+                    track_all_paths: false
+                    store_analytics_per_minute: false
+                    ignore_tag_prefix_list: null
+                    threshold_len_tag_list: 1000
+                    omit_analytics_index_creation: false
+                    enable_separate_analytics_store: false
+                    analytics_storage:
+                      type: ""
+                      host: ""
+                      port: 0
+                      master_name: ""
+                      sentinel_password: ""
+                      username: ""
+                      password: ""
+                      database: 0
+                      optimisation_max_idle: 0
+                      optimisation_max_active: 0
+                      enable_cluster: false
+                      hosts: null
+                      addrs: null
+                      redis_use_ssl: false
+                      redis_ssl_insecure_skip_verify: false
+                      debug: false
+                      timeout: 0
+                      use_ssl: false
+                      ssl_insecure_skip_verify: false
+                      ca_file: ""
+                      cert_file: ""
+                      key_file: ""
+                      max_version: ""
+                      min_version: ""
+                    log_level: "info"
+                    enable_key_logging: false
+                    sync_worker_config:
+                      enabled: true
+                      hash_keys: true
+                      max_batch_size: 1000
+                      time_between_batches: 3
+                      max_workers: 1000
+                      warmup_time: 0
+                      group_key_ttl: 30
+                    enable_ownership: false
+                single_field:
+                  summary: Single configuration field (filtered by query parameter)
+                  value:
+                    type: "single"
+                    config_field: "sync_worker_config.warmup_time"
+                    env: "TYK_MDCB_SYNCWORKERCONFIG_WARMUPTIME"
+                    value: "0"
+                    obfuscated: false
+        "400":
+          description: Field not found in configuration.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                    example: "field not found"
+        "401":
+          description: Forbidden access due to invalid or missing administrative key.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+  /env:
+    get:
+      tags:
+        - Configuration
+      summary: Retrieve environment variables
+      description: |
+        Returns environment variables of the system. You can optionally filter for a specific configuration field.
+
+        **Example curl commands:**
+
+        Get all environment variables:
+        ```bash
+        curl -X GET \ 
+        http://localhost:8181/env \
+        -H 'X-Tyk-Authorization: your-secret-key'
+        ```
+
+        Get specific environment variable:
+        ```bash
+        curl -X GET \
+        'http://localhost:8181/env?env=TYK_MDCB_SYNCWORKERCONFIG_WARMUPTIME' \
+        -H 'X-Tyk-Authorization: your-secret-key'
+        ```
+      operationId: envGet
+      parameters:
+        - in: query
+          name: env
+          description: Optional environment variable name to filter by
+          required: false
+          schema:
+            type: string
+          example: "TYK_MDCB_SYNCWORKERCONFIG_WARMUPTIME"
+      responses:
+        "200":
+          description: Successful retrieval of environment variables.
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: array
+                    items:
+                      type: string
+                  - $ref: "#/components/schemas/EnvVariable"
+              examples:
+                array_response:
+                  summary: All environment variables
+                  value:
+                    - "TYK_MDCB_ANALYTICSSTORAGE_SSLINSECURESKIPVERIFY=false"
+                    - "TYK_MDCB_STORAGE_HOST=localhost"
+                    - "TYK_MDCB_LISTENPORT=9090"
+                single_variable:
+                  summary: Single environment variable (filtered by query parameter)
+                  value:
+                    config_field: "sync_worker_config.warmup_time"
+                    env: "TYK_MDCB_SYNCWORKERCONFIG_WARMUPTIME"
+                    value: "0"
+                    obfuscated: false
+        "400":
+          description: Environment variable not found.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                    example: "environment variable not found"
+        "401":
+          description: Forbidden access due to invalid or missing administrative key.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+
+components:
+  schemas:
+    Node:
+      type: object
+      properties:
+        node_id:
+          type: string
+          example: "solo-uid"
+        api_key:
+          type: string
+          example: "c5e9b9ed8dee42fb668f81cef7f905bb"
+        group_id:
+          type: string
+          example: "Redis Cluster Slave 1"
+        node_version:
+          type: string
+          example: "v5.3.0-dev"
+        ttl:
+          type: integer
+          example: 10
+        tags:
+          type: array
+          items:
+            type: string
+          example: ["tag1", "tag2"]
+        health:
+          $ref: "#/components/schemas/Health"
+        stats:
+          $ref: "#/components/schemas/Stats"
+        host_details:
+          $ref: "#/components/schemas/HostDetails"
+    Health:
+      type: object
+      properties:
+        redis:
+          $ref: "#/components/schemas/ComponentStatus"
+        rpc:
+          $ref: "#/components/schemas/ComponentStatus"
+    ComponentStatus:
+      type: object
+      properties:
+        status:
+          type: string
+          example: "pass"
+        componentType:
+          type: string
+          example: "datastore"
+        time:
+          type: string
+          format: date-time
+          example: "2024-02-23T08:51:23-03:00"
+    Stats:
+      type: object
+      properties:
+        apis_count:
+          type: integer
+          example: 1
+        policies_count:
+          type: integer
+          example: 0
+    HostDetails:
+      type: object
+      properties:
+        Hostname:
+          type: string
+          example: "Peter-MacBook-Pro.local"
+        PID:
+          type: integer
+          example: 62663
+        Address:
+          type: string
+          example: "203.0.113.0"
+    ReadinessStatus:
+      type: object
+      properties:
+        status:
+          type: string
+          example: "pass"
+        status_code:
+          type: integer
+          example: 200
+        components:
+          type: array
+          items:
+            $ref: "#/components/schemas/ComponentReadiness"
+    ReadinessFailure:
+      type: object
+      properties:
+        status:
+          type: string
+          example: "fail"
+        status_code:
+          type: integer
+          example: 503
+        components:
+          type: array
+          items:
+            $ref: "#/components/schemas/ComponentReadinessFailure"
+    ComponentReadiness:
+      type: object
+      properties:
+        name:
+          type: string
+          example: "postgres"
+        status:
+          type: string
+          example: "pass"
+        observation_ts:
+          type: string
+          format: date-time
+          example: "2024-07-29T13:58:56.699052-04:00"
+    ComponentReadinessFailure:
+      type: object
+      properties:
+        name:
+          type: string
+          example: "postgres"
+        status:
+          type: string
+          example: "fail"
+        observation_ts:
+          type: string
+          format: date-time
+          example: "2024-07-29T13:58:56.699052-04:00"
+    LivenessStatus:
+      type: object
+      properties:
+        status:
+          type: string
+          example: "pass"
+        status_code:
+          type: integer
+          example: 200
+    Error:
+      type: object
+      properties:
+        error:
+          type: string
+          example: "Attempted administrative access with invalid or missing key!"
+    ConfigStatus:
+      type: object
+      properties:
+        listen_port:
+          type: integer
+          example: 9090
+        healthcheck_port:
+          type: integer
+          example: 8180
+        http_port:
+          type: integer
+          example: 8180
+        enable_http_profiler:
+          type: boolean
+          example: false
+        server_options:
+          type: object
+          properties:
+            use_ssl:
+              type: boolean
+              example: false
+            certificate:
+              type: object
+              properties:
+                cert_file:
+                  type: string
+                  example: "./server.crt"
+                key_file:
+                  type: string
+                  example: "./server.key"
+            min_version:
+              type: integer
+              example: 0
+            ssl_ciphers:
+              type: string
+              nullable: true
+            ssl_certificates:
+              type: string
+              nullable: true
+        http_server_options:
+          type: object
+          properties:
+            use_ssl:
+              type: boolean
+              example: false
+            certificate:
+              type: object
+              properties:
+                cert_file:
+                  type: string
+                  example: ""
+                key_file:
+                  type: string
+                  example: ""
+            min_version:
+              type: integer
+              example: 0
+            ssl_ciphers:
+              type: string
+              nullable: true
+            ssl_certificates:
+              type: string
+              nullable: true
+        security:
+          type: object
+          properties:
+            private_certificate_encoding_secret:
+              type: string
+              example: ""
+            enable_http_secure_endpoints:
+              type: boolean
+              example: true
+            secret:
+              type: string
+              example: ""
+        storage:
+          type: object
+          properties:
+            type:
+              type: string
+              example: "redis"
+            host:
+              type: string
+              example: "localhost"
+            port:
+              type: integer
+              example: 6379
+            master_name:
+              type: string
+              example: ""
+            sentinel_password:
+              type: string
+              example: ""
+            username:
+              type: string
+              example: ""
+            password:
+              type: string
+              example: ""
+            database:
+              type: integer
+              example: 0
+            optimisation_max_idle:
+              type: integer
+              example: 0
+            optimisation_max_active:
+              type: integer
+              example: 0
+            enable_cluster:
+              type: boolean
+              example: false
+            hosts:
+              type: string
+              nullable: true
+            addrs:
+              type: string
+              nullable: true
+            redis_use_ssl:
+              type: boolean
+              example: false
+            redis_ssl_insecure_skip_verify:
+              type: boolean
+              example: false
+            debug:
+              type: boolean
+              example: false
+            timeout:
+              type: integer
+              example: 0
+            use_ssl:
+              type: boolean
+              example: false
+            ssl_insecure_skip_verify:
+              type: boolean
+              example: false
+            ca_file:
+              type: string
+              example: ""
+            cert_file:
+              type: string
+              example: ""
+            key_file:
+              type: string
+              example: ""
+            max_version:
+              type: string
+              example: ""
+            min_version:
+              type: string
+              example: ""
+        analytics:
+          type: object
+          properties:
+            type:
+              type: string
+              example: "mongo"
+            connection_string:
+              type: string
+              example: ""
+            table_sharding:
+              type: boolean
+              example: false
+            batch_size:
+              type: integer
+              example: 0
+            postgres:
+              type: object
+              properties:
+                prefer_simple_protocol:
+                  type: boolean
+                  example: false
+            mysql:
+              type: object
+              properties:
+                default_string_size:
+                  type: integer
+                  example: 0
+                disable_datetime_precision:
+                  type: boolean
+                  example: false
+                dont_support_rename_index:
+                  type: boolean
+                  example: false
+                dont_support_rename_column:
+                  type: boolean
+                  example: false
+                skip_initialize_with_version:
+                  type: boolean
+                  example: false
+            mongo_url:
+              type: string
+              example: ""
+            mongo_use_ssl:
+              type: boolean
+              example: false
+            mongo_ssl_insecure_skip_verify:
+              type: boolean
+              example: false
+            mongo_ssl_allow_invalid_hostnames:
+              type: boolean
+              example: false
+            mongo_ssl_ca_file:
+              type: string
+              example: ""
+            mongo_ssl_pem_keyfile:
+              type: string
+              example: ""
+            mongo_session_consistency:
+              type: string
+              example: ""
+            mongo_batch_size:
+              type: integer
+              example: 0
+            driver:
+              type: string
+              example: "mongo-go"
+            mongo_direct_connection:
+              type: boolean
+              example: false
+            mongo_ignore_aggregations:
+              type: array
+              items:
+                type: string
+              nullable: true
+            mongo_enable_aggregate_self_healing:
+              type: boolean
+              example: false
+        hash_keys:
+          type: boolean
+          example: true
+        session_timeout:
+          type: integer
+          example: 0
+        forward_analytics_to_pump:
+          type: boolean
+          example: false
+        enable_multiple_analytics_keys:
+          type: boolean
+          example: false
+        dont_store_selective:
+          type: boolean
+          example: false
+        dont_store_aggregate:
+          type: boolean
+          example: false
+        org_session_expiration:
+          type: integer
+          example: 60
+        org_session_cleanup:
+          type: integer
+          example: 60
+        license:
+          type: string
+          example: ""
+        aggregates_ignore_tags:
+          type: string
+          nullable: true
+        track_all_paths:
+          type: boolean
+          example: false
+        store_analytics_per_minute:
+          type: boolean
+          example: false
+        ignore_tag_prefix_list:
+          type: string
+          nullable: true
+        threshold_len_tag_list:
+          type: integer
+          example: 1000
+        omit_analytics_index_creation:
+          type: boolean
+          example: false
+        enable_separate_analytics_store:
+          type: boolean
+          example: false
+        analytics_storage:
+          type: object
+          properties:
+            type:
+              type: string
+              example: ""
+            host:
+              type: string
+              example: ""
+            port:
+              type: integer
+              example: 0
+            master_name:
+              type: string
+              example: ""
+            sentinel_password:
+              type: string
+              example: ""
+            username:
+              type: string
+              example: ""
+            password:
+              type: string
+              example: ""
+            database:
+              type: integer
+              example: 0
+            optimisation_max_idle:
+              type: integer
+              example: 0
+            optimisation_max_active:
+              type: integer
+              example: 0
+            enable_cluster:
+              type: boolean
+              example: false
+            hosts:
+              type: string
+              nullable: true
+            addrs:
+              type: string
+              nullable: true
+            redis_use_ssl:
+              type: boolean
+              example: false
+            redis_ssl_insecure_skip_verify:
+              type: boolean
+              example: false
+            debug:
+              type: boolean
+              example: false
+            timeout:
+              type: integer
+              example: 0
+            use_ssl:
+              type: boolean
+              example: false
+            ssl_insecure_skip_verify:
+              type: boolean
+              example: false
+            ca_file:
+              type: string
+              example: ""
+            cert_file:
+              type: string
+              example: ""
+            key_file:
+              type: string
+              example: ""
+            max_version:
+              type: string
+              example: ""
+            min_version:
+              type: string
+              example: ""
+        log_level:
+          type: string
+          example: "info"
+        enable_key_logging:
+          type: boolean
+          example: false
+        sync_worker_config:
+          type: object
+          properties:
+            enabled:
+              type: boolean
+              example: true
+            hash_keys:
+              type: boolean
+              example: true
+            max_batch_size:
+              type: integer
+              example: 1000
+            time_between_batches:
+              type: integer
+              example: 3
+            max_workers:
+              type: integer
+              example: 1000
+            warmup_time:
+              type: integer
+              example: 0
+            group_key_ttl:
+              type: integer
+              example: 30
+        enable_ownership:
+          type: boolean
+          example: false
+    EnvVariable:
+      type: object
+      properties:
+        config_field:
+          type: string
+          example: "sync_worker_config.warmup_time"
+        env:
+          type: string
+          example: "TYK_MDCB_SYNCWORKERCONFIG_WARMUPTIME"
+        value:
+          type: string
+          example: "0"
+        obfuscated:
+          type: boolean
+          example: false
+  securitySchemes:
+    api_key:
+      in: header
+      name: X-Tyk-Authorization
+      type: apiKey
diff --git a/toc.css b/toc.css
new file mode 100644
index 0000000000..59c35a0bea
--- /dev/null
+++ b/toc.css
@@ -0,0 +1,56 @@
+/* General TOC container */
+#table-of-contents-content {
+    padding-left: 0;
+}
+
+/* Each TOC item */
+#table-of-contents-content .toc-item {
+    list-style: none;
+    padding: 2px 0;
+}
+
+/* Flex container for anchor and toggle */
+#table-of-contents-content .toc-row {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    width: 100%;
+}
+
+/* Anchor link styling */
+#table-of-contents-content .toc-row a {
+    flex-grow: 1; /* Allow anchor to take available space */
+    text-decoration: none;
+    color: inherit;
+    word-wrap: break-word;
+    white-space: normal;
+}
+
+/* Toggle button styling */
+.toc-toggle {
+    background: transparent;
+    border: none;
+    cursor: pointer;
+    color: inherit;
+    padding: 0 0.5rem;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    flex-shrink: 0; /* Prevent toggle from shrinking */
+}
+
+.toc-toggle:focus {
+    outline: none;
+    box-shadow: 0 0 0 2px rgba(59, 130, 246, 0.4);
+    border-radius: 4px;
+}
+
+/* Chevron icon transition */
+.toc-toggle svg {
+    transition: transform 150ms ease-in-out;
+}
+
+/* Rotated state for chevron when collapsed */
+.toc-toggle.rotated svg {
+    transform: rotate(-90deg);
+}
\ No newline at end of file
diff --git a/toc.js b/toc.js
new file mode 100644
index 0000000000..7d6a16bb19
--- /dev/null
+++ b/toc.js
@@ -0,0 +1,135 @@
+// This script enhances the Table of Contents (TOC) / right side navigation of Mintliffy by adding collapsible/expandable sections based on header depth.
+// It also fixes issues with incorrect depth values for custom anchor tags and ensures proper indentation and visibility of TOC items.
+// But custom anchor tags are not used anymore in our repository. So that part is not needed anymore.
+
+// toc-fix-v2.js
+(function () {
+    let observer;
+
+    function run() {
+        const toc = document.getElementById('table-of-contents-content');
+        if (!toc || toc.dataset.enhanced === 'true') {
+            return;
+        }
+        toc.dataset.enhanced = 'true';
+
+        // Disconnect the observer while we modify the DOM to prevent infinite loops
+        if (observer) observer.disconnect();
+
+        const items = Array.from(toc.querySelectorAll('.toc-item'));
+
+        // Normalize depths, fix NaN, and set initial styles
+        items.forEach(li => {
+            let depthNum = Number(li.getAttribute('data-depth'));
+            if (!Number.isFinite(depthNum)) {
+                depthNum = 2; // Fix for h4 headers producing NaN
+            }
+            li.dataset.depth = String(depthNum);
+            li.style.display = 'list-item'; // Ensure all items are visible initially
+
+            const a = li.querySelector('a');
+            if (a) {
+                const indentStep = 1; // rem per depth level
+                a.style.marginLeft = `${depthNum * indentStep}rem`;
+            }
+        });
+
+        // Add toggle buttons and functionality
+        items.forEach((li, idx) => {
+            const depth = Number(li.dataset.depth);
+
+            // Detect if this item has children
+            const hasChild = idx + 1 < items.length && Number(items[idx + 1].dataset.depth) > depth;
+            if (!hasChild) return;
+
+            // Prevent adding duplicate toggles if script re-runs
+            if (li.querySelector('.toc-toggle')) return;
+
+            const toggle = document.createElement('button');
+            toggle.type = 'button';
+            toggle.className = 'toc-toggle';
+            toggle.setAttribute('aria-expanded', 'true');
+            toggle.innerHTML = `
+                <svg viewBox="0 0 24 24" width="14" height="14" aria-hidden="true" focusable="false">
+                  <path d="M8.5 10.5 L12 14 L15.5 10.5" stroke="currentColor" stroke-width="1.6" fill="none"
+                        stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+              `;
+
+            const anchor = li.querySelector('a');
+            if (anchor) {
+                const wrapper = document.createElement('div');
+                wrapper.className = 'toc-row';
+                // Insert wrapper before the anchor, then move anchor and toggle into it
+                anchor.parentNode.insertBefore(wrapper, anchor);
+                wrapper.appendChild(anchor);
+                wrapper.appendChild(toggle);
+            } else {
+                li.appendChild(toggle);
+            }
+
+            li.dataset.collapsed = 'false';
+
+            toggle.addEventListener('click', e => {
+                e.preventDefault();
+                const isCollapsed = li.dataset.collapsed === 'true';
+                
+                // Toggle the state
+                li.dataset.collapsed = String(!isCollapsed);
+                toggle.setAttribute('aria-expanded', String(!isCollapsed));
+                toggle.classList.toggle('rotated', !isCollapsed);
+
+                // Update visibility of all descendant items
+                for (let k = idx + 1; k < items.length; k++) {
+                    const childItem = items[k];
+                    const childDepth = Number(childItem.dataset.depth);
+
+                    if (childDepth <= depth) {
+                        break; // Exited the subtree of the clicked item
+                    }
+
+                    if (!isCollapsed) {
+                        // If we are COLLAPSING, hide all descendants
+                        childItem.style.display = 'none';
+                    } else {
+                        // If we are EXPANDING, only reveal direct children
+                        // Deeper children remain hidden if their own parent is collapsed
+                        if (childDepth === depth + 1) {
+                            childItem.style.display = 'list-item';
+                        }
+                    }
+                }
+            });
+        });
+
+        // Reconnect the observer after DOM modifications are complete
+        if (observer) {
+            observer.observe(document.body, { childList: true, subtree: true });
+        }
+    }
+
+    function init() {
+        run(); // Run on initial load
+
+        // Set up an observer to re-run the script on SPA navigation
+        observer = new MutationObserver((mutations) => {
+            for (const mutation of mutations) {
+                if (mutation.addedNodes.length > 0) {
+                    const toc = document.getElementById('table-of-contents-content');
+                    // If a TOC exists and it hasn't been enhanced yet, run the script
+                    if (toc && !toc.dataset.enhanced) {
+                        run();
+                        break; // Found and processed a new TOC, no need to check other mutations
+                    }
+                }
+            }
+        });
+        observer.observe(document.body, { childList: true, subtree: true });
+    }
+
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', init);
+    } else {
+        init();
+    }
+})();
diff --git a/transform-traffic/url-rewriting.mdx b/transform-traffic/url-rewriting.mdx
new file mode 100644
index 0000000000..ff413c0ad0
--- /dev/null
+++ b/transform-traffic/url-rewriting.mdx
@@ -0,0 +1,317 @@
+---
+title: "Path Modification"
+description: "Learn how to configure URL rewriting in Tyk Gateway to modify request paths before forwarding to upstream services, including triggers, rules, dynamic rewrite targets, and internal routing"
+keywords: "URL rewriting, path rewriting, path modification, content-based routing, triggers, rules, internal routing, rewrite target, capture groups"
+sidebarTitle: "Path Modification"
+---
+
+Before forwarding a matched request, Tyk Gateway can rewrite the request path. This handles two common situations: where the path a client uses differs from the path the upstream service expects, and where the destination should be determined by the content of the request rather than the incoming URL.
+
+Path modification is applied by the **URL rewrite** middleware, which is configured at the endpoint level in the API definition.
+
+## How It Works
+
+The URL rewrite middleware uses **triggers** to determine when and how to rewrite the request path. Each trigger combines one or more matching conditions with a rewrite target.
+
+### The Basic Trigger
+
+The basic trigger tests the request path against a regular expression. It serves as a control switch for the middleware: if the path does not match, no rewriting takes place, regardless of any advanced triggers configured.
+
+When the regex includes capturing groups - subexpressions wrapped in parentheses - each matched group is assigned an index: `$1` for the first, `$2` for the second, and so on. These captured values can appear anywhere in the [rewrite target](#the-rewrite-target).
+
+For example, the pattern `/(\\w+)/(\\w+)` applied to `/fiction/9780` captures `fiction` as `$1` and `9780` as `$2`. A rewrite target of `category/$1?id=$2` would resolve to `category/fiction?id=9780`.
+
+<Note>
+When testing the request path, Tyk handles percent-encoded characters in two passes. If the pattern does not match the raw URL, Tyk decodes percent-encoded characters (for example, `%2D` to `-`) and tries again. Only the raw and fully decoded forms are checked.
+</Note>
+
+### Advanced Triggers
+
+Advanced triggers are optional and are only evaluated after the basic trigger fires. Each advanced trigger tests one or more elements of the request against a regular expression. The testable elements are:
+
+| Element | Description |
+| :--- | :--- |
+| Query parameter | A named URL query string value |
+| Request header | An HTTP request header; use the normalized form, for example `X-Preview` not `x-preview` |
+| Path parameter | An individual segment of the request path, matched by splitting the path on `/` |
+| Request body | The full request body; no element name required |
+| Session metadata | A named field in the metadata attached to the current session |
+| Request context | A named context variable such as client IP address or JWT claim |
+
+An advanced trigger can test multiple elements, combined with `any` (at least one must match) or `all` (every element must match). Any individual test can be negated, so the condition passes when the element does not match the pattern.
+
+Advanced triggers are evaluated in the order they are defined. The first to fire is applied and the rest are skipped. If none fire, the basic trigger's rewrite target is used.
+
+When an advanced trigger fires, the value of each request element that was tested is stored and made available in the rewrite target.
+
+{/*
+  Diagram: URL Rewrite Trigger Evaluation Flow
+
+  Purpose: Show how the middleware evaluates triggers in sequence and determines which rewrite target to apply. The key insight to convey is that the basic trigger is a control switch (not just a fallback), and that capture groups from the basic trigger are available to all subsequent rewrite targets.
+
+  Structure: Vertical flowchart, top to bottom, with three terminal outcomes on the right.
+
+  Nodes and flow:
+  1. "Incoming request" (rounded rectangle, entry point)
+  2. Diamond: "Does path match basic trigger pattern?"
+     - NO arrow (left or straight down) → terminal: "No rewriting — request forwarded unchanged" (grey)
+     - YES arrow (right or down) → action box: "Capture $1, $2, … from pattern"
+  3. From capture box, dashed annotation: "$1, $2 available to all rewrite targets below"
+  4. Diamond: "Advanced trigger 1: do conditions pass?" (the dashed line flows into this and all subsequent trigger diamonds)
+     - YES arrow → terminal: "Rewrite to trigger 1 target" (blue)
+     - NO arrow → next diamond
+  5. Diamond: "Advanced trigger 2: do conditions pass?"
+     - YES → terminal: "Rewrite to trigger 2 target" (blue)
+     - NO → (ellipsis node to indicate N triggers, then…)
+  6. Terminal: "No advanced trigger fired — rewrite to basic trigger target" (green)
+
+  Key visual elements:
+  - The dashed annotation showing $1/$2 flowing downward past all trigger diamonds is the most important design element — it must be visually prominent
+  - All three terminal outcomes should be at the same vertical level on the right, making it easy to see the three possible results
+  - The "NO" exit from the basic trigger diamond should be visually distinct from the chain of advanced trigger evaluations — use a different arrow style or colour to reinforce that this is an early exit, not part of the trigger chain
+  - Label the basic trigger diamond clearly as the "control switch"
+
+  Design notes:
+  - Keep it simple — the diagram should not show rule detail (key locations, patterns, conditions), only the evaluation flow
+  - Colour scheme suggestion: grey for no-rewrite exit, blue for advanced trigger rewrites, green for basic trigger fallback rewrite
+  - The ellipsis node between trigger 2 and the fallback terminal should make it clear that there can be any number of advanced triggers
+*/}
+
+## The Rewrite Target
+
+Each trigger specifies a rewrite target: a static path or a dynamically constructed string. The following sources of dynamic values are available:
+
+**Captured path segments from the basic trigger** - the `$1`, `$2`, ... groups extracted by the basic trigger regex. These are available in any trigger's rewrite target, not just the basic trigger's own. This is how path segment values are made available when an advanced trigger fires.
+
+**Request element values from advanced triggers** - when an advanced trigger fires, each element value it tested is available as `$tyk_context.trigger-{n}-{name}-{i}`, where:
+- `n` is the trigger's position in the list, zero-based.
+- `name` is the element name (for example, `region` for a query parameter named `region`).
+- `i` is the index within the element, used when an element can return multiple values (such as a repeated header).
+
+For example, in the configuration shown in the [Worked Example](#worked-example) below, advanced trigger 1 (the first in the list, so `n=0`) tests the `region` query parameter. When it fires on a request with `?region=us`, the value `us` is available as:
+
+```
+$tyk_context.trigger-0-region-0
+                     ↑  ↑      ↑
+                     n  name   i
+```
+
+The `i` index is `0` because `region` has a single value. For elements that can carry multiple values - for example a header sent twice in the same request - successive values are indexed from `0`: `$tyk_context.trigger-0-X-Tag-0`, `$tyk_context.trigger-0-X-Tag-1`, and so on.
+
+If the pattern for an advanced trigger rule contains capturing groups, those captured substrings are also stored and are accessible with an additional index `j` appended: `$tyk_context.trigger-{n}-{name}-{i}-{j}`, where `j` is zero-based and corresponds to the first, second, and so on capturing group in the pattern. For example, a pattern `(\\w+)-(\\w+)` applied to a header value `eu-west` would store `eu` as `$tyk_context.trigger-0-X-Region-0-0` and `west` as `$tyk_context.trigger-0-X-Region-0-1`.
+
+**Session metadata** - using the `$tyk_meta.` namespace.
+
+**Key-value storage** - using the [appropriate KV reference notation](/tyk-configuration-reference/kv-store#transformation-middleware).
+
+<Note>
+Consul and Vault KV references must appear at the end of the rewrite target. Tyk's token-matching pattern treats `/` as a valid key character, so a reference placed mid-path - for example `upstream/$secret_consul.myKey/suffix` - will match `$secret_consul.myKey/suffix` as the token and attempt to look up the key `myKey/suffix` rather than `myKey`. This limitation does not apply to environment variables or Gateway `secrets`.
+</Note>
+
+The target can be a path on the same upstream, a fully qualified URL on a different host, or a `tyk://` internal address to route the request to another API on the same Tyk Gateway instance. See [Internal Routing](/advanced-configuration/transform-traffic/looping).
+
+## Matching Behaviour
+
+The URL rewrite middleware applies its own regular expression matching to the request path. It does not use the endpoint matching mode (wildcard, prefix, suffix, or exact) configured at the Gateway level, and is not affected by changes to those settings. See [Request Matching](/getting-started/key-concepts/url-matching) for details on endpoint matching modes.
+
+## Configuration
+
+### Tyk OAS
+
+The middleware is configured in the `operations` section of the Tyk Vendor Extension (`x-tyk-api-gateway`), under the `operationId` for the endpoint.
+
+#### Basic Trigger
+
+Enable the middleware and set `pattern` and `rewriteTo`:
+
+```json
+"urlRewrite": {
+  "enabled": true,
+  "pattern": "/(\\w+)/(\\w+)",
+  "rewriteTo": "books-service/$1/$2"
+}
+```
+
+In this example, a request to `GET /fiction/9780` matches the pattern, capturing `fiction` as `$1` and `9780` as `$2`. The path is rewritten to `books-service/fiction/9780`.
+
+#### Advanced Triggers
+
+Add a `triggers` array to the `urlRewrite` object. Each entry specifies `condition` (`any` or `all`), `rules`, and `rewriteTo`. Rules use the following fields:
+
+| Field | Description |
+| :--- | :--- |
+| `in` | Key location: `path`, `query`, `header`, `sessionMetadata`, `requestBody`, `requestContext` |
+| `name` | Key name (not required when `in` is `requestBody`) |
+| `pattern` | Regular expression to test against the key value |
+| `negate` | `true` to pass the rule when the pattern does not match |
+
+```json
+"urlRewrite": {
+  "enabled": true,
+  "pattern": "/(\\w+)/(\\w+)",
+  "rewriteTo": "books-service/$1/$2",
+  "triggers": [
+    {
+      "condition": "all",
+      "rewriteTo": "regional-books-service/$tyk_context.trigger-0-region-0/$1/$2",
+      "rules": [
+        { "in": "query",  "name": "region",    "pattern": "\\w+", "negate": false },
+        { "in": "header", "name": "X-Preview", "pattern": "true", "negate": true }
+      ]
+    },
+    {
+      "condition": "any",
+      "rewriteTo": "preview-books-service/$1/$2",
+      "rules": [
+        { "in": "header", "name": "X-Preview", "pattern": "true", "negate": false }
+      ]
+    }
+  ]
+}
+```
+
+The first advanced trigger fires when a `region` query parameter is present AND `X-Preview` is not `true`. The second fires when `X-Preview` is `true`. If neither fires, the basic trigger routes to `books-service`.
+
+#### API Designer
+
+1. **Add an endpoint** - From the API Designer, add an endpoint for the path and method to modify.
+2. **Select the URL Rewrite middleware** - Select **ADD MIDDLEWARE** and choose **URL Rewrite**.
+3. **Configure the basic trigger** - Enter the match pattern and the rewrite target.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-url-rewrite-basic.png" alt="Configuring the basic trigger" />
+
+4. **Optionally configure advanced triggers** - Select **ADD TRIGGER** for each additional trigger. Use **ADD RULE** to add rules to each trigger.
+
+    <img src="/img/dashboard/api-designer/tyk-oas-url-rewrite-advanced.png" alt="Configuring advanced trigger rules" />
+
+5. **Save the API** - Select **ADD MIDDLEWARE**, then **SAVE API**.
+
+### Tyk Classic
+
+If using Tyk Classic, add a `url_rewrites` object to the `extended_paths` section of the API definition. To reference context variables in `rewrite_to`, [enable context variables](/api-management/traffic-transformation/request-context-variables#enabling-context-variables-for-use-with-tyk-classic-apis) for the API.
+
+#### Basic Trigger
+
+```json
+"url_rewrites": [
+  {
+    "path": "/{category}/{id}",
+    "method": "GET",
+    "match_pattern": "/(\\w+)/(\\w+)",
+    "rewrite_to": "books-service/$1/$2"
+  }
+]
+```
+
+#### Advanced Triggers
+
+Add a `triggers` array to the `url_rewrites` entry. Each trigger specifies `on` (`any` or `all`), `options` (the rules, nested by key location), and `rewrite_to`. The key location fields are:
+
+| Field | Location |
+| :--- | :--- |
+| `header_matches` | Request header |
+| `query_val_matches` | Query parameter |
+| `path_part_matches` | Path parameter |
+| `session_meta_matches` | Session metadata |
+| `payload_matches` | Request body |
+| `request_context_matches` | Request context variable |
+
+Each rule specifies `match_rx` (the pattern) and `reverse` (`true` to pass when the pattern does not match).
+
+```json
+"triggers": [
+  {
+    "on": "all",
+    "options": {
+      "query_val_matches": {
+        "region": { "match_rx": "\\w+", "reverse": false }
+      },
+      "header_matches": {
+        "X-Preview": { "match_rx": "true", "reverse": true }
+      }
+    },
+    "rewrite_to": "regional-books-service/$tyk_context.trigger-0-region-0/$1/$2"
+  },
+  {
+    "on": "any",
+    "options": {
+      "header_matches": {
+        "X-Preview": { "match_rx": "true", "reverse": false }
+      }
+    },
+    "rewrite_to": "preview-books-service/$1/$2"
+  }
+]
+```
+
+The first trigger fires when a `region` query parameter is present AND `X-Preview` is not `true`. The second fires when `X-Preview` is `true`.
+
+#### API Designer
+
+1. **Add an endpoint** - From the Endpoint Designer, add an endpoint and select the **URL Rewrite** plugin.
+2. **Configure the basic trigger** - Add the match pattern and the rewrite target.
+
+    <img src="/img/2.10/url_rewrite_settings.png" alt="URL rewrite basic trigger configuration" />
+
+3. **Optionally configure advanced triggers** - Select **Create Advanced Trigger**. Triggers can be edited or removed in the **Advanced URL Rewrite** section.
+
+    <img src="/img/2.10/url_rewrite-advanced-edit.png" alt="Advanced trigger list" />
+
+4. **Save the API** - Select **Save** or **Create**.
+
+### Tyk Operator
+
+Tyk Operator supports both Tyk OAS and Tyk Classic API definitions. The URL rewrite middleware is configured in the same way as described above for each format - in the `operations` section of the Tyk Vendor Extension for Tyk OAS, or in `extended_paths.url_rewrites` for Tyk Classic.
+
+See [Tyk Operator](/api-management/automations/operator) for details on creating and managing API definitions with Tyk Operator.
+
+## Worked Example
+
+This example shows basic and advanced triggers working together on an endpoint `GET /{category}/{id}` that routes book catalog requests to different upstream services depending on the region and whether the request is a preview.
+
+**Configuration:**
+
+- **Basic trigger** - pattern `/(\\w+)/(\\w+)` matches the path, capturing the category as `$1` and the book ID as `$2`. Rewrite target: `books-service/$1/$2`.
+- **Advanced trigger 1** (`all`) - fires when the `region` query parameter is present AND the `X-Preview` header is not `true` (negated). Rewrite target: `regional-books-service/$tyk_context.trigger-0-region-0/$1/$2`.
+- **Advanced trigger 2** (`any`) - fires when the `X-Preview` header is `true`. Rewrite target: `preview-books-service/$1/$2`.
+
+**Outcomes:**
+
+| Request | Path rewritten to |
+| :--- | :--- |
+| `GET /fiction/9780?region=us` | `regional-books-service/us/fiction/9780` |
+| `GET /fiction/9780` with `X-Preview: true` | `preview-books-service/fiction/9780` |
+| `GET /fiction/9780` | `books-service/fiction/9780` |
+
+For the first request, advanced trigger 1 fires: `region=us` satisfies condition 1, and `X-Preview` is absent so the negated condition 2 passes. The rewrite target combines the captured region (`$tyk_context.trigger-0-region-0`) with `$1` and `$2` from the basic trigger.
+
+For the second request, the `region` parameter is absent so trigger 1 does not fire. Trigger 2 fires on the `X-Preview` header.
+
+For the third request, neither advanced trigger fires and the basic trigger's target is used.
+
+**Tyk OAS configuration:**
+
+```json
+"urlRewrite": {
+  "enabled": true,
+  "pattern": "/(\\w+)/(\\w+)",
+  "rewriteTo": "books-service/$1/$2",
+  "triggers": [
+    {
+      "condition": "all",
+      "rewriteTo": "regional-books-service/$tyk_context.trigger-0-region-0/$1/$2",
+      "rules": [
+        { "in": "query",  "name": "region",    "pattern": "\\w+", "negate": false },
+        { "in": "header", "name": "X-Preview", "pattern": "true", "negate": true }
+      ]
+    },
+    {
+      "condition": "any",
+      "rewriteTo": "preview-books-service/$1/$2",
+      "rules": [
+        { "in": "header", "name": "X-Preview", "pattern": "true", "negate": false }
+      ]
+    }
+  ]
+}
+```
diff --git a/troubleshooting/tyk-dashboard/api-catalogue-not-found-error-developer-portal.mdx b/troubleshooting/tyk-dashboard/api-catalogue-not-found-error-developer-portal.mdx
new file mode 100644
index 0000000000..4e0e05cfea
--- /dev/null
+++ b/troubleshooting/tyk-dashboard/api-catalogue-not-found-error-developer-portal.mdx
@@ -0,0 +1,22 @@
+---
+title: "“API catalog not found“ error in the Developer Portal"
+order: 5
+robots: "noindex, nofollow"
+sidebarTitle: "“API catalogue not found“ error in the Developer Portal"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+### Description
+
+Users receive an "API catalog not found" error message when they visit the Developer Portal.
+
+### Cause
+
+The catalog hasn't been initialised yet.
+
+### Solution
+
+We have [tutorials](/getting-started/tutorials/publish-api) on how to publish to a developer portal using API catalogs. It may also be worth checking that the key generated by the policy hasn't expired.
\ No newline at end of file
diff --git a/troubleshooting/tyk-dashboard/cors-issues-on-developer-portal.mdx b/troubleshooting/tyk-dashboard/cors-issues-on-developer-portal.mdx
new file mode 100644
index 0000000000..c2410dd4ab
--- /dev/null
+++ b/troubleshooting/tyk-dashboard/cors-issues-on-developer-portal.mdx
@@ -0,0 +1,37 @@
+---
+title: "CORS issues on developer portal"
+order: 6
+robots: "noindex, nofollow"
+sidebarTitle: "CORS issues on developer portal"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+### Description
+
+You get following errors in the browser console:
+```
+Access to fetch at 'https://<Your Gateway URL>/<Your API>/' from origin 'https://<Your Dashboard URL>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
+```
+```
+POST https://<Your Gateway URL>/<Your API>/ net::ERR_FAILED
+```
+
+### Cause
+
+The CORS middleware in the Gateway is blocking this request. This can happen when the CORS settings of the API are not enabled or misconfigured for the developer portal.
+
+### Solution
+
+Make sure that your CORS in the `Advanced Options` of the API is enabled and the settings are correct. This means:
+ - `Allowed Origins` should allow the developer portal domain
+ - `Allowed Methods` should allow all methods needed for API documentation (at least `GET` and `POST`)
+ - `Allowed Headers` should allow at least `Origin`, `Content-Type` and for authenticated requests the authorization header (e.g. `Authorization`)
+
+ > **Note:** When creating a new API with Dashboard v3.1 and higher the CORS settings will be prefilled with some default values (but **disabled** by default).
+
+ You can learn more about CORS on this pages:
+ - [CORS in API Definition](/api-management/gateway-config-tyk-classic#cross-origin-resource-sharing-cors)
+ - [How to setup CORS](/api-management/troubleshooting-debugging#how-to-setup-cors) 
diff --git a/troubleshooting/tyk-dashboard/not-found-error-developer-portal.mdx b/troubleshooting/tyk-dashboard/not-found-error-developer-portal.mdx
new file mode 100644
index 0000000000..d6ca1282bc
--- /dev/null
+++ b/troubleshooting/tyk-dashboard/not-found-error-developer-portal.mdx
@@ -0,0 +1,24 @@
+---
+title: "“Not Found” error in the Developer Portal"
+order: 5
+robots: "noindex, nofollow"
+sidebarTitle: "“Not Found“ error in the Developer Portal"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+### Description
+
+When you attempt to access the Developer Portal (`https://xxxxxx:3000/portal`), you receive a `Not Found` error message
+
+### Cause
+
+The portal may not have been configured or may have been set up with the wrong domain name.
+
+### Solution
+
+You should make sure that your portal has been configured to use the correct domain name in your `tyk_analytics.conf`. Once this change has been made you may need to restart the Dashboard process so as to avoid having to reconfigure the Gateway as well.
+
+You should also look at the [portal tutorial](/getting-started/tutorials/publish-api) for creating an API and publishing it to your Portal.
diff --git a/troubleshooting/tyk-dashboard/receive-csrf-error-developer-portal.mdx b/troubleshooting/tyk-dashboard/receive-csrf-error-developer-portal.mdx
new file mode 100644
index 0000000000..ecc98f4d93
--- /dev/null
+++ b/troubleshooting/tyk-dashboard/receive-csrf-error-developer-portal.mdx
@@ -0,0 +1,27 @@
+---
+title: "Receive a CSRF error in the Developer Portal"
+order: 5
+robots: "noindex, nofollow"
+sidebarTitle: "Receive a CSRF error in the Developer Portal"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+### Description
+
+When the user attempts to log into the Developer Portal a CSRF error (or some variant of this error such as `Forbidden - CSRF token invalid`) is displayed on the page.
+
+### Cause
+
+Most probably the portal has yet to be activated. Common reasons for this are:
+
+1.  The `CNAME` was not set in the dashboard. Without a `CNAME`, the system won't react to a new domain name.
+2.  There were no active APIs set up under the account which means that the account was not active for a portal either and essentially incapable of proxying traffic.
+
+The use of an incorrect signup form can also cause this issue.
+
+### Solution
+
+Users must make sure that they add a `CNAME` and an active API to the Dashboard. If the form will require TLS, the user will need to set this up for their custom load balancer. To add this to a cloud instance, a copy of the TLS certificate and the private key file will need to be sent to Tyk Support.
\ No newline at end of file
diff --git a/tyk-apis.mdx b/tyk-apis.mdx
new file mode 100644
index 0000000000..79a8b0e7be
--- /dev/null
+++ b/tyk-apis.mdx
@@ -0,0 +1,80 @@
+---
+title: "Tyk APIs Hub"
+description: "The Tyk API Hub. In this section you will find OpenAPI docs for the APIs for Tyk Gateway, Tyk Dashboard and other Tyk products"
+keywords: "swagger, REST, Tyk APIs, Tyk OpenAPI Specs APIs, OPenAPI, OAS"
+sidebarTitle: "Overview"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+
+All Tyk components are designed with an API that allows you to configure and control the product. On this page you will find documentation for all of these APIs, designed to help you to integrate Tyk into your software stack and then manage your API ecosystem efficiently.
+
+## Tyk Postman Collections
+
+Explore our official Tyk Postman collections for a hands-on, practical approach to using our APIs.
+These provide an interactive way to explore and test Tyk components' APIs. They are designed to help you quickly get
+started and understand the capabilities of our products.
+
+
+<ResponsiveGrid>
+
+
+<Card title="Postman" href="https://www.postman.com/tyk-technologies/workspace/379673ec-4cc5-4b8e-bef5-8a6a988071cb/overview" img="/img/logos/Postman-logo-vertical-orange-2021.svg">
+Tyk Public Workspace
+</Card>
+
+
+</ResponsiveGrid>
+
+## Tyk Enterprise
+
+Here you can access detailed documentation enabling you to unlock the full capabilities of Tyk's enterprise products. This API documentation provides all the
+information you need to integrate Tyk's products seamlessly into your projects.
+
+<ResponsiveGrid>
+
+
+<Card title="OpenAPI" href="/tyk-dashboard-api" img="/img/logos/tyk-logo-selfmanaged.svg">
+Manage the Tyk platform
+</Card>
+
+
+</ResponsiveGrid>
+
+<ResponsiveGrid>
+
+
+<Card title="OpenAPI" href="/dashboard-admin-api">
+Dashboard Admin API
+<br /><br />
+*Provision & administrate Tyk Dashboard*
+</Card>
+
+<Card title="OpenAPI" href="/tyk-mdcb-api">
+MDCB API
+<br /><br />
+*Monitor & diagnose Tyk data planes*
+</Card>
+
+<Card title="OpenAPI" href="/product-stack/tyk-enterprise-developer-portal/api-documentation/tyk-edp-api">
+Enterprise Portal API
+<br />
+<br />
+*Configure & control Tyk Enterprise Developer Portal*
+</Card>
+
+
+</ResponsiveGrid>
+
+
+## Tyk Open Source
+
+<ResponsiveGrid>
+
+
+<Card title="OpenAPI" href="/tyk-gateway-api" img="/img/logos/tyk-logo-opensource.svg">
+Configure & control Tyk GW
+</Card>
+
+
+</ResponsiveGrid>
\ No newline at end of file
diff --git a/tyk-apis/tyk-dashboard-api/manage-key-requests.mdx b/tyk-apis/tyk-dashboard-api/manage-key-requests.mdx
new file mode 100644
index 0000000000..928f0df51f
--- /dev/null
+++ b/tyk-apis/tyk-dashboard-api/manage-key-requests.mdx
@@ -0,0 +1,246 @@
+---
+title: "Manage Key Requests"
+order: 9
+robots: "noindex, nofollow"
+sidebarTitle: "Portal Key Requests"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+### List key requests
+
+| **Property** | **Description**                                      |
+| :------------ | :---------------------------------------------------- |
+| Resource URL | `/api/portal/requests`                               |
+| Method       | GET                                                  |
+| Type         | None                                                 |
+| Body         | None                                                 |
+| Param        | `p={page-num}` (optional, set to `-1` for no paging) |
+| Param        | `approved={true or false}` (optional, returns `false` for Pending Key Requests, or `true` for Approved Key Requests) |
+
+
+
+### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/requests?p=0 HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "Data": [{
+    "id": "5ad097c87af3f40001b27f40",
+    "org_id": "xxxxxxxxxxxxxxxxxxxxx",
+    "for_plan": "5a9847db3602190001f44427", // deprecated
+    "apply_policies": ["5a9847db3602190001f44427"],
+    "by_user": "5a9ea3a019efc400011107ae",
+    "fields": {},
+    "approved": false,
+    "date_created": "2018-04-13T11:43:04.698Z",
+    "version": "v2",
+    "jwt_secret": "",
+    "portal_developer": {
+        "id": "5a9ea3a019efc400011107ae",
+        "email": "xxx@zzz.io",
+        "date_created": "2018-03-06T14:20:16.876Z",
+        "inactive": false,
+        "org_id": "57ecd735f467ac0001000003",
+        "keys": {
+            "<key-id>": ["<policy-id>"],
+        },
+        "subscriptions": {
+            "<policy-id>": "<key-id>",
+        },
+        "fields": {},
+        "nonce": "",
+        "sso_key": ""
+    },
+    "catalogue_entry": {
+        "name": "New catalogue",
+        "short_description": "",
+        "long_description": "",
+        "show": true,
+        "api_id": "",
+        "policy_id": "5a9847db3602190001f44427",
+        "documentation": "5acd2f1b4242d10001ab2cbc",
+        "version": "v2",
+        "config": {
+          "id": "",
+          "org_id": "",
+          "signup_fields": [],
+          "key_request_fields": [],
+          "require_key_approval": false,
+          "redirect_on_key_request": false,
+          "redirect_to": "",
+          "disable_login": false,
+          "disable_signup": false,
+          "disable_auto_login": false,
+          "catalogue_login_only": false,
+          "mail_options": {
+            "mail_from_name": "",
+            "mail_from_email": "",
+            "email_copy": {
+              "welcome_email": {
+                "enabled": false,
+                "subject": "",
+                "body": "",
+                "sign_off": "",
+                "hide_token_data": false
+              },
+              "key_email": {
+                "enabled": false,
+                "subject": "",
+                "body": "",
+                "sign_off": "",
+                "hide_token_data": false
+              }
+            }
+          },
+          "override": false
+      }
+    }
+
+  }],
+  "Pages": 0
+}
+```
+
+### Get a specific key request
+
+| **Property** | **Description**             |
+| :------------ | :--------------------------- |
+| Resource URL | `/api/portal/requests/{id}` |
+| Method       | GET                         |
+| Type         | None                        |
+| Body         | None                        |
+| Param        | None                        |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/requests/554c789030c55e4ca0000002 HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "id": "554c789030c55e4ca0000002",
+  "org_id": "53ac07777cbb8c2d53000002",
+  "by_user": "554c733a30c55e4b16000002",
+  "fields": {},
+  "approved": true,
+  "date_created": "2015-05-08T04:49:20.992-04:00",
+  "version": "v2",
+  "for_plan": "554c789030c55e4ca0101002", // deprecated
+  "apply_policies": ["554c789030c55e4ca0101002"]
+}
+```
+
+### Approve a key request
+
+| **Property** | **Description**                     |
+| :------------ | :----------------------------------- |
+| Resource URL | `/api/portal/requests/approve/{id}` |
+| Method       | PUT                                 |
+| Type         | None                                |
+| Body         | None                                |
+| Param        | None                                |
+
+#### Sample Request
+
+```{.copyWrapper}
+PUT /api/portal/requests/approve/554c789030c55e4ca0000002 HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response:
+
+```
+{
+  "RawKey":"53ac07777cbb8c2d5300000215811f02c21540dd5257eb68d3d73f35"
+}
+```
+
+### Create a key request
+
+Key requests are an easy way to associate developer accounts with new policies, they do not need to be linked to API Catalog entries, they represent an instruction to Tyk to combine a generate a token with a specific policy ID, and to associate the token and policy with a specific developer account.
+
+**It is now required to pass a version parameter of `v2` and `for_plan` if you wish to associate a key request with a policy ID** legacy key requests will continue to work, but could cause issues as this version is deprecated in future releases.
+
+By default, all key requests created for new catalog entries will be version 2.
+
+| **Property** | **Description**        |
+| :------------ | :---------------------- |
+| Resource URL | `/api/portal/requests` |
+| Method       | POST                   |
+| Type         | None                   |
+| Body         | None                   |
+| Param        | None                   |
+
+#### Sample Request
+
+```{.copyWrapper}
+POST /api/portal/requests HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+
+{
+  "by_user": "554c733a30c55e4b16000002",
+  "date_created": "2015-05-08T04:49:20.992-04:00",
+  "fields": {
+    "custom1": "sdf",
+    "custom2": "sdf"
+  },
+  "for_plan": "554c789030c55e4ca0101002", // deprecated
+  "apply_policies": ["554c789030c55e4ca0101002"],
+  "version": "v2"
+}
+```
+
+#### Sample Response
+
+```
+{
+  "Status":"OK",
+  "Message":"554c789030c55e4ca0000002",
+  "Meta":""
+}
+```
+
+### Delete a specific key request
+
+| **Property** | **Description**             |
+| :------------ | :--------------------------- |
+| Resource URL | `/api/portal/requests/{id}` |
+| Method       | DELETE                      |
+| Type         | None                        |
+| Body         | None                        |
+| Param        | None                        |
+
+#### Sample Request
+
+```{.copyWrapper}
+DELETE /api/portal/requests/554c789030c55e4ca0000002 HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "Status":"OK",
+  "Message":"Data deleted",
+  "Meta":""
+}
+```
diff --git a/tyk-apis/tyk-dashboard-api/portal-policies.mdx b/tyk-apis/tyk-dashboard-api/portal-policies.mdx
new file mode 100644
index 0000000000..7789af6d27
--- /dev/null
+++ b/tyk-apis/tyk-dashboard-api/portal-policies.mdx
@@ -0,0 +1,315 @@
+---
+title: "Portal Policies"
+order: 2
+robots: "noindex, nofollow"
+sidebarTitle: "Portal Policies"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+### Get List of Policies
+
+| **Property** | **Description**         |
+| :------------ | :----------------------- |
+| Resource URL | `/api/portal/policies/` |
+| Method       | GET                     |
+| Type         | None                    |
+| Body         | None                    |
+| Param        | None                    |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/policies/ HTTP/1.1
+Host: localhost:3000
+authorization: 7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "Data": [
+    {
+      "_id": "56b9fed54e86e40001000002",
+      "access_rights": {
+        "35447b1469df4e846894b1e87372f6d7": {
+          "allowed_urls": [
+            {
+              "methods": [
+                "GET"
+              ],
+              "url": "/some_resources"
+            },
+            {
+              "methods": [
+                "POST"
+              ],
+              "url": "/some_resource/(.*)"
+            }
+          ],
+          "apiid": "35447b1269df4e846894b7e87312f6d7",
+          "apiname": "My API",
+          "versions": [
+            "Default"
+          ]
+        }
+      },
+      "active": true,
+      "date_created": "0001-01-01T00:00:00Z",
+      "hmac_enabled": false,
+      "is_inactive": false,
+      "key_expires_in": 0,
+      "name": "My Policy",
+      "org_id": "5629ca78eebd180001000001",
+      "per": 1,
+      "quota_max": -1,
+      "quota_renewal_rate": 60,
+      "rate": 1000,
+      "tags": []
+    }
+  ],
+  "Pages": 0
+}
+```
+
+Notice that the `apiid` field is different than the rest of the policy definitions! (See [GitHub issue 192][1])
+
+### Search list of Policies
+
+| **Property** | **Description**         |
+| :------------ | :----------------------- |
+| Resource URL | `/api/portal/policies/search` |
+| Method       | GET                     |
+| Type         | None                    |
+| Body         | None                    |
+| Param        | None                    |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/policies/search?q=Policy+name HTTP/1.1
+Host: localhost:3000
+authorization: 7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+Similar to Policies list endpoint
+
+### Retrieve a single policy by ID
+
+| **Property** | **Description**             |
+| :------------ | :--------------------------- |
+| Resource URL | `/api/portal/policies/{id}` |
+| Method       | GET                         |
+| Type         | None                        |
+| Body         | None                        |
+| Param        | None                        |
+
+#### Sample request
+
+```{.copyWrapper}
+GET /api/portal/policies/56b9fed54e86e40001000002 HTTP/1.1
+Host: localhost
+authorization: 7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "_id": "56b9fed54e86e40001000002",
+  "access_rights": {
+    "35447b1469df4e846894b1e87372f6d7": {
+      "allowed_urls": [
+        {
+          "methods": [
+            "GET",
+          ],
+          "url": "/some_resources"
+        },
+        {
+          "methods": [
+            "POST"
+          ],
+          "url": "/some_resource/(.*)"
+        },
+      ],
+      "apiid": "35447b1269df4e846894b7e87312f6d7",
+      "apiname": "My API",
+      "versions": [
+        "Default"
+      ]
+    }
+  },
+  "active": true,
+  "date_created": "0001-01-01T00:00:00Z",
+  "hmac_enabled": false,
+  "is_inactive": false,
+  "key_expires_in": 0,
+  "name": "My Policy",
+  "org_id": "5629ca78eebd180001000001",
+  "per": 1,
+  "quota_max": -1,
+  "quota_renewal_rate": 60,
+  "rate": 1000,
+  "tags": []
+}
+```
+
+### Create Policy Definition
+
+Creating policy definitions is slightly different to the core API, API definitions are wrapped inside an `api_definition` field and event handlers, such as webhooks are not embedded in the main `api_defintion` object (though they can be), webhooks are instead appended as references into the `hook_references` field, the API will embed the correct webhook data into the event handler interface.
+
+| **Property** | **Description**            |
+| :------------ | :-------------------------- |
+| Resource URL | `/api/portal/policies/`    |
+| Method       | POST                       |
+| Type         | None                       |
+| Body         | Advanced Policy Definition |
+| Param        | None                       |
+
+#### Sample Request
+
+```{.copyWrapper}
+POST /api/portal/policies/ HTTP/1.1
+Host: localhost:3000
+Connection: keep-alive
+Content-Type: application/json
+Content-Length: <body length>
+authorization: 7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+
+{
+  "last_updated": "0001-01-01T00:00:00Z",
+  "rate": 1000,
+  "per": 60,
+  "quota_max": -1,
+  "quota_renews": 1481546970,
+  "quota_remaining": 0,
+  "quota_renewal_rate": 60,
+  "access_rights": {
+    "35447b1469df4e846894b1e87372f6d7": {
+      "apiid": "35447b1469df4e846894b1e87372f6d7",
+      "api_name": "My API",
+      "versions": ["Default"]
+    }
+  },
+  "name": "My Policy",
+  "active": true
+}    
+```
+
+#### Sample Response
+
+```
+{
+  "Status": "OK",
+  "Message": "56b9fed54e86e40001000002",
+  "Meta": "null"
+}
+```
+
+### Update Policy Definition
+
+| **Property** | **Description**             |
+| :------------ | :--------------------------- |
+| Resource URL | `/api/portal/policies/{id}` |
+| Method       | PUT                         |
+| Type         | None                        |
+| Body         | Advanced Policy Definition  |
+| Param        | None                        |
+
+#### Sample Request
+
+```{.copyWrapper}
+PUT /api/portal/policies/56b9fed54e86e40001000002 HTTP/1.1
+Host: localhost:3000
+Connection: keep-alive
+Content-Type: application/json
+Content-Length: <body length>
+authorization: 7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+
+{
+  "_id": "56b9fed54e86e40001000002",
+  "id": "",
+  "org_id": "589b4be9dbd34702ee2ed8c5",
+  "rate": 1000,
+  "per": 60,
+  "quota_max": -1,
+  "quota_renewal_rate": 60,
+  "access_rights": {
+    "35447b1469df4e846894b1e87372f6d7": {
+      "apiid": "35447b1469df4e846894b1e87372f6d7",
+      "api_name": "My API",
+      "versions": ["Default"],
+      "allowed_urls": []
+    }
+  },
+  "hmac_enabled": false,
+  "active": true,
+  "name": "My Updated Policy",
+  "is_inactive": false,
+  "date_created": "0001-01-01T00:00:00Z",
+  "tags": [],
+  "key_expires_in": 0,
+  "partitions": {
+    "quota": false,
+    "rate_limit": false,
+    "acl": false
+  },
+  "last_updated": "0001-01-01T00:00:00Z"
+}
+```
+
+#### Sample Response
+
+```
+{
+  "Status": "OK",
+  "Message": "Data updated",
+  "Meta": ""
+}
+```
+
+### Delete Policy Definition
+
+| **Property** | **Description**             |
+| :------------ | :--------------------------- |
+| Resource URL | `/api/portal/policies/{id}` |
+| Method       | DELETE                      |
+| Type         | None                        |
+| Body         | None                        |
+| Param        | None                        |
+
+#### Sample Request
+
+```{.copyWrapper}
+DELETE /api/portal/policies/56b9fed54e86e40001000002 HTTP/1.1
+Host: localhost:3000
+authorization: 7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "Status": "OK",
+  "Message": "Data deleted",
+  "Meta": null
+}
+```
+
+### Graphql API
+
+Presently, the Tyk Dashboard uses the GraphQL API for policies.
+
+| **Method** | **URL**  | **Description**             |
+| :---------- | :------------- | :--------------------------- |
+| POST       | `/graphql`    | GraphQL query endpoint      |
+| GET        | `/playground` | Dashboard Graphql Playground - where you could see docs and run queries |
+
+
+ [1]: https://github.com/TykTechnologies/tyk/issues/192
\ No newline at end of file
diff --git a/tyk-apis/tyk-portal-api/portal-configuration.mdx b/tyk-apis/tyk-portal-api/portal-configuration.mdx
new file mode 100644
index 0000000000..1b35abb695
--- /dev/null
+++ b/tyk-apis/tyk-portal-api/portal-configuration.mdx
@@ -0,0 +1,595 @@
+---
+title: "Portal Configuration"
+robots: "noindex, nofollow"
+sidebarTitle: "Configuration"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+This section will cover the following endpoints:
+* [Configuration](#configuration)
+* [Menus](#menus)
+* [Pages](#pages)
+
+
+## Configuration
+
+### List Portal Configuration
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/configuration` |
+| Method       | GET                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/configuration HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "id":"5cc03284d07e7f00019404b6",
+  "org_id":"5cc03283d07e7f00019404b3",
+  "signup_fields":[
+
+  ],
+  "key_request_fields":[
+
+  ],
+  "require_key_approval":false,
+  "redirect_on_key_request":false,
+  "redirect_to":"",
+  "enable_multi_selection":false,
+  "disable_login":false,
+  "disable_signup":false,
+  "disable_auto_login":false,
+  "catalogue_login_only":false,
+  "oauth_usage_limit":0,
+  "email":"",
+  "mail_options":{
+    "mail_from_name":"",
+    "mail_from_email":"",
+    "email_copy":{
+      "welcome_email":{
+        "enabled":false,
+        "subject":"",
+        "body":"",
+        "sign_off":"",
+        "hide_token_data":false
+      },
+      "key_email":{
+        "enabled":false,
+        "subject":"",
+        "body":"",
+        "sign_off":"",
+        "hide_token_data":false
+      },
+      "reset_password_email":{
+        "enabled":false,
+        "subject":"",
+        "body":"",
+        "sign_off":"",
+        "hide_token_data":false
+      }
+    }
+  },
+  "override":false,
+  "HashKeys":false
+}
+```
+
+### Create Portal Configuration
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/configuration` |
+| Method       | POST                     |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+POST /api/portal/configuration HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  Response here
+}
+```
+
+### Update Portal Configuration
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/configuration` |
+| Method       | PUT                     |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+PUT/api/portal/configuration HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  Response here
+}
+```
+
+## Menus
+
+### List Portal Menus
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/menus`      |
+| Method       | GET                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/menus HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "id": "5d12262e0313b300010eb5bb",
+  "menus": {},
+  "is_active": true,
+  "org_id": "5cc03283d07e7f00019404b3"
+}
+```
+
+### Create Portal Menus
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/menus`      |
+| Method       | POST                     |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+POST /api/portal/menus HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  Response here
+}
+```
+
+### Update Portal Menus
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/menus`      |
+| Method       | PUT                     |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+PUT /api/portal/menus HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  Response here
+}
+```
+
+
+
+## Pages
+
+### List Portal Pages
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/pages`      |
+| Method       | GET                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/pages HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "Data":[
+    {
+      "id":"5cc03284d07e7f00019404b5",
+      "title":"Tyk Developer Portal",
+      "slug":"home",
+      "template_name":"",
+      "fields":{
+        "JumboCTALink":"#cta",
+        "JumboCTALinkTitle":"Your awesome APIs, hosted with Tyk!",
+        "JumboCTATitle":"Tyk Developer Portal",
+        "PanelOneContent":"Panel 1 content.",
+        "PanelOneLink":"#panel1",
+        "PanelOneLinkTitle":"Panel 1 Button",
+        "PanelOneTitle":"Panel 1 Title",
+        "PanelThereeContent":"",
+        "PanelThreeContent":"Panel 3 content.",
+        "PanelThreeLink":"#panel3",
+        "PanelThreeLinkTitle":"Panel 3 Button",
+        "PanelThreeTitle":"Panel 3 Title",
+        "PanelTwoContent":"Panel 2 content.",
+        "PanelTwoLink":"#panel2",
+        "PanelTwoLinkTitle":"Panel 2 Button",
+        "PanelTwoTitle":"Panel 2 Title",
+        "SubHeading":"Sub Header"
+      },
+      "org_id":"5cc03283d07e7f00019404b3",
+      "is_homepage":true,
+      "page_settings":{
+
+      }
+    }
+  ],
+  "Pages":1
+}
+```
+
+### Create Portal Pages
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/pages`      |
+| Method       | POST                     |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+POST /api/portal/pages HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  Response here
+}
+```
+
+### Get a Portal Page
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/pages/{id}`      |
+| Method       | GET                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/pages/{id} HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "id":"5cc03284d07e7f00019404b5",
+  "title":"Tyk Developer Portal",
+  "slug":"home",
+  "template_name":"",
+  "fields":{
+    "JumboCTALink":"#cta",
+    "JumboCTALinkTitle":"Your awesome APIs, hosted with Tyk!",
+    "JumboCTATitle":"Tyk Developer Portal",
+    "PanelOneContent":"Panel 1 content.",
+    "PanelOneLink":"#panel1",
+    "PanelOneLinkTitle":"Panel 1 Button",
+    "PanelOneTitle":"Panel 1 Title",
+    "PanelThereeContent":"",
+    "PanelThreeContent":"Panel 3 content.",
+    "PanelThreeLink":"#panel3",
+    "PanelThreeLinkTitle":"Panel 3 Button",
+    "PanelThreeTitle":"Panel 3 Title",
+    "PanelTwoContent":"Panel 2 content.",
+    "PanelTwoLink":"#panel2",
+    "PanelTwoLinkTitle":"Panel 2 Button",
+    "PanelTwoTitle":"Panel 2 Title",
+    "SubHeading":"Sub Header"
+  },
+  "org_id":"5cc03283d07e7f00019404b3",
+  "is_homepage":true,
+  "page_settings":{
+
+  }
+}
+```
+
+### Update a Portal Page
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/pages/{id}` |
+| Method       | PUT                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+PUT /api/portal/pages/{id} HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  Response here
+}
+```
+
+### Delete a Portal Page
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/pages/{id}` |
+| Method       | DELETE                   |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+DELETE /api/portal/pages/{id} HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  Response here
+}
+```
+## CSS
+
+### List Portal CSS
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/css`        |
+| Method       | GET                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/css HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "id": "5ce3b8ffe84526000117899a",
+  "org_id": "5cc03283d07e7f00019404b3",
+  "page_css": "",
+  "email_css": ""
+}
+```
+
+### Create Portal CSS
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/css`      |
+| Method       | POST                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+POST /api/portal/css HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  Response here
+}
+```
+
+### Update Portal CSS
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/css`      |
+| Method       | PUT                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+PUT /api/portal/css HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  Response here
+}
+```
+
+## JavaScript
+
+### List Portal JavaScript
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/js`        |
+| Method       | GET                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/js HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "id": "5ce3b8ffe84526000117899a",
+  "org_id": "5cc03283d07e7f00019404b3",
+  "page_js": ""
+}
+```
+
+### Create Portal JavaScript
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/js`      |
+| Method       | POST                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+POST /api/portal/js HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+
+{
+  "page_js": "console.log(1)"
+}
+```
+
+#### Sample Response
+
+```
+{
+    "Status": "OK",
+    "Message": "5ce3b8ffe84526000117899a",
+    "Meta": null
+}
+```
+
+### Update Portal CSS
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/js`      |
+| Method       | PUT                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+PUT /api/portal/js HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+
+{
+  "id": "5ce3b8ffe84526000117899a",
+  "page_js": "console.log(1)"
+}
+```
+
+#### Sample Response
+
+```
+{
+    "Status": "OK",
+    "Message": "Data updated",
+    "Meta": null
+}
+```
+
diff --git a/tyk-apis/tyk-portal-api/portal-developers.mdx b/tyk-apis/tyk-portal-api/portal-developers.mdx
new file mode 100644
index 0000000000..8b6160880c
--- /dev/null
+++ b/tyk-apis/tyk-portal-api/portal-developers.mdx
@@ -0,0 +1,520 @@
+---
+title: "Portal Developers"
+order: 3
+robots: "noindex, nofollow"
+sidebarTitle: "Developers"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+import PortalDeveloperAnalytics from '/snippets/portal-developer-analytics.mdx';
+
+<LegacyClassicPortalApi/>
+
+### List Developers
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/developers` |
+| Method       | GET                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/developers HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "Data": [
+    {
+      "_id": "554c733a30c55e4b16000002",
+      "keys": {
+        "<key-id>": ["<policy-id>"]
+      },
+      "date_created": "2015-05-08T04:26:34.287-04:00",
+      "email": "test@test.com",
+      "fields": {
+        "Name": "Mondgo Brtian",
+        "custom1": "Test",
+        "custom2": "Test"
+      },
+      "inactive": false,
+      "org_id": "53ac07777cbb8c2d53000002"
+    },
+    {
+      "_id": "5555ec63a8b6b60001000001",
+      "keys": {},
+      "date_created": "2015-05-15T08:53:54.873-04:00",
+      "email": "foo@bar.com",
+      "fields": {
+        "Name": "Tes",
+        "custom1": "",
+        "custom2": ""
+      },
+      "inactive": false,
+      "org_id": "53ac07777cbb8c2d53000002"
+    },
+    ...
+  ],
+  "Pages": 1
+}
+```
+
+### Retrieve a developer object by ID
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/api/portal/developers/{id}` |
+| Method       | GET                           |
+| Type         | None                          |
+| Body         | Developer Object              |
+| Param        | None                          |
+
+#### Sample Request
+
+```{.copyWrapper}
+GET /api/portal/developers/5e397e714ea461ef1d474efa HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "id": "5e397e714ea461ef1d474efa",
+  "email": "blip@blop.com",
+  "date_created": "2020-02-04T16:23:44.936+02:00",
+  "inactive": false,
+  "org_id": "5a79019d4ea461cdd0c77480",
+  "keys": {},
+  "subscriptions": {},
+  "fields": {},
+  "nonce": "",
+  "sso_key": "",
+  "oauth_clients": {
+    "5e397e804ea461ef1d474efb": [
+      {
+        "client_id": "bf27562a806d4ee1976c11b69e154a88",
+        "secret": "NzNiY2M0NWYtNmIwMi00ZjE4LWJhODMtNTc3YzlhMmQyY2I3",
+        "redirect_uri": "http://my_redirect_url",
+        "app_description": "My App",
+        "use_case": "My use case",
+        "date_created": "2020-02-04T16:24:21.939+02:00"
+      }
+    ]
+  },
+  "password_max_days": 0,
+  "password_updated": "2020-02-04T16:23:45.014+02:00",
+  "PWHistory": [],
+  "last_login_date": "2020-02-04T16:23:00Z"
+}
+```
+
+### Add a Developer Record
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/api/portal/developers` |
+| Method       | POST                           |
+| Type         | None                          |
+| Body         | Developer Object              |
+| Param        | None                          |
+
+#### Sample Request
+
+```{.copyWrapper}
+POST /api/portal/developers HTTP/1.1
+Host: localhost
+Authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+    
+{
+  "email": "blip@blop.com",
+  "password": "$2a$10$hlG1ujAHWUpnM37k.l1RhO6RrxkCpXki2yrGhufnDs1IBiUo4Kzqy",
+  "date_created": "2015-05-15T08:56:13.257-04:00",
+  "inactive": false,
+  "org_id": "53ac07777cbb8c2d53000002",
+  "keys": {
+    "<api-key>": ["<policy-id>"]
+  },
+  "fields": {
+    "Name": "",
+    "custom1": "",
+    "custom2": ""
+  }
+}
+```
+
+#### Sample Response
+
+```
+{
+  "Status":"OK",
+  "Message":"<developer-id>",
+  "Meta":""
+}
+```
+
+
+
+### Update a Developer Record
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/api/portal/developers/{id}` |
+| Method       | PUT                           |
+| Type         | None                          |
+| Body         | Developer Object              |
+| Param        | None                          |
+
+#### Sample Request
+
+```{.copyWrapper}
+PUT /api/portal/developers/5555eceda8b6b60001000004 HTTP/1.1
+Host: localhost
+Authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+    
+{
+  "id": "5555eceda8b6b60001000004",
+  "email": "blip@blop.com",
+  "password": "$2a$10$hlG1ujAHWUpnM37k.l1RhO6RrxkCpXki2yrGhufnDs1IBiUo4Kzqy",
+  "date_created": "2015-05-15T08:56:13.257-04:00",
+  "inactive": false,
+  "org_id": "53ac07777cbb8c2d53000002",
+  "keys": {
+    "<key-id>": ["<policy-id>"]
+  },
+  "fields": {
+    "Name": "",
+    "custom1": "",
+    "custom2": ""
+  }
+}
+```
+
+#### Sample Response
+
+```
+{
+  "Status":"OK",
+  "Message":"Data updated",
+  "Meta":""
+}
+```
+
+### Delete a Developer
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/api/portal/developers/{id}` |
+| Method       | DELETE                        |
+| Type         | None                          |
+| Body         | None                          |
+| Param        | None                          |
+
+#### Sample Request
+
+```{.copyWrapper}
+DELETE /api/portal/developers/554c733a30c55e4b16000002 HTTP/1.1
+Host: localhost
+Authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "Status":"OK",
+  "Message":"Data deleted",
+  "Meta":""
+}
+```
+
+### Verify Developer Credentials
+
+> **NOTE**: This functionality is available from v2.3.8 onwards
+
+| **Property** | **Description**                             |
+| :------------ | :------------------------------------------- |
+| Resource URL | `/api/portal/developers/verify_credentials` |
+| Method       | POST                                        |
+| Type         | None                                        |
+| Body         | None                                        |
+| Param        | None                                        |
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api/portal/developers/verify_credentials \
+  -X POST \
+  -H "authorization: $TYK_API_KEY" \
+  -d \
+  '{
+     "username": "<developer-email>",
+     "password": "<developer-password>"
+   }'
+```
+
+If the user credentials are verified, the HTTP response code will be 200 (OK), otherwise credentials do match and a 401 error (Unauthorized) will be returned.
+
+### Reset Developer Password
+
+> **NOTE**: This functionality is available from v2.3.8 onwards
+
+| **Property** | **Description**                             |
+| :------------ | :------------------------------------------- |
+| Resource URL | `/api/portal/developers/password/:Id`      |
+| Method       | POST                                        |
+| Type         | None                                        |
+| Body         | None                                        |
+| Param        | None                                        |
+
+#### Sample Request
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api/portal/developers/password/:Id \
+-X POST \
+-H "authorization: $TYK_API_KEY" \
+-d \
+'{
+  "password": ""
+}'
+```
+
+#### Sample Response - Password Changed
+
+```
+{
+  "Message":"Password changed"
+}
+```
+
+#### Sample Response - Incorrect Developer ID
+
+```
+{
+  "Status": "Error", "Message":"Developer password validation failed."
+}
+```
+
+<PortalDeveloperAnalytics/>
+
+### Add Key To Developer
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/:Id/subscriptions` |
+| Method       | POST                           |
+| Type         | None                          |
+| Body         | Subscription Object           |
+| Param        | None                          |
+
+
+#### Sample Request
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api/portal/developers/:Id/keys \
+-X POST \
+-H "authorization: $TYK_API_KEY" \
+-d \
+'{
+  "apply_policies": ["<pol-id>"],
+  "fields": {
+      "foo": "bar"
+  },
+  "oauth_info": {
+    "redirect_uri": "..."
+  }
+}'
+```
+
+### Change Developer Key Policy
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/:developerId/keys/:keyId` |
+| Method       | PUT                           |
+| Type         | None                          |
+| Body         | Policy change Object          |
+| Param        | None                          |
+
+
+#### Sample Request
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api/portal/developers/:developerId/keys/:keyId \
+-X PUT \
+-H "authorization: $TYK_API_KEY" \
+-d \
+'{
+  "apply_policies": ["<pol-id>"]
+}'
+```
+
+### Revoke Developer Key
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/:developerId/keys/:keyID` |
+| Method       | DELETE                        |
+| Type         | None                          |
+| Body         | None                          |
+| Param        | None                          |
+
+### Reset Developer Key Quota
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/:developerId/keys/:keyID/reset_quota` |
+| Method       | POST                          |
+| Type         | None                          |
+| Body         | None                          |
+| Param        | None                          |
+
+### Delete OAuth app
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/oauth/:appId` |
+| Method       | DELETE                        |
+| Type         | None                          |
+| Body         | None                          |
+| Param        | None                          |
+
+
+### Revoke a Single OAuth Client Token
+
+| **Property** | **Description**                                |
+| :------------ | :---------------------------------------------- |
+| Resource URL | `/oauth-clients/{oauthClientId}/revoke`       |
+| Method       | POST                                           |
+| Type         | JSON                                           |
+| Body         | Client Object                                  |
+| Param        | None                                           |
+
+#### Sample Request
+
+```{.json}
+POST /oauth-clients/411f0800957c4a3e81fe181141dbc22a/revoke
+Host: tyk-portal:3000
+Authorization: CSRF token
+Body: {
+  "token":"eyJvcmciOiI1ZTIwOTFjNGQ0YWVmY2U2MGMwNGZiOTIiLCJpZCI6ImZiMGFmNWQ4ZGY1MzQ3MjY4YmYxNTE5MmJjN2YzN2QyIiwiaCI6Im11cm11cjY0In0=",
+  "token_type_hint":"access_token"
+}
+```
+#### Sample Response
+
+```{.json}
+{
+  "Status": "OK",
+  "Message": "token revoked successfully",
+  "Meta": null
+}
+```
+
+### Revoke all OAuth Client Tokens
+
+| **Property** | **Description**                                |
+| :------------ | :---------------------------------------------- |
+| Resource URL | `/oauth-clients/{oauthClientId}/revoke_all`    |
+| Method       | POST                                           |
+| Type         | JSON                                           |
+| Body         | Client Object                                  |
+| Param        | None                                           |
+
+#### Sample Request
+
+```{.json}
+POST /oauth-clients/411f0800957c4a3e81fe181141dbc22a/revoke_all
+Host: tyk-portal:3000
+Authorization: CSRF token
+Body: {
+  "client_secret":"MzUyNDliNzItMDhlNy00MzM3LTk1NWUtMWQyODMyMjkwZTc0"
+  }
+```
+#### Sample Response
+
+```{.json}
+{
+  "Status": "OK",
+  "Message": "tokens revoked successfully",
+  "Meta": null
+}
+```
+
+## Deprecated APIS
+
+### Add Subscription To Developer
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/:Id/subscriptions` |
+| Method       | POST                           |
+| Type         | None                          |
+| Body         | Subscription Object           |
+| Param        | None                          |
+
+
+#### Sample Request
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api//portal/developers/:Id/subscriptions \
+-X POST \
+-H "authorization: $TYK_API_KEY" \
+-d \
+'{
+  "policy_id": "<pol-id>",
+  "fields": {
+      "foo": "bar"
+  },
+  "oauth_info": {
+    "redirect_uri": "..."
+  }
+}'
+```
+
+### Change Developer Key Policy
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/:developerId/:keyId/:policyId` |
+| Method       | GET                           |
+| Type         | None                          |
+| Body         | None                          |
+| Param        | None                          |
+
+### Revoke Developer Key
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/key/:apiID/:keyID/:Id` |
+| Method       | DELETE                        |
+| Type         | None                          |
+| Body         | None                          |
+| Param        | None                          |
+
+### Reset Developer Key Quota
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/key/:apiID/:keyID/:Id/reset_quota` |
+| Method       | POST                          |
+| Type         | None                          |
+| Body         | None                          |
+| Param        | None                          |
+
+### Delete OAuth app
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/portal/developers/oauth/:apiId/:appId` |
+| Method       | DELETE                        |
+| Type         | None                          |
+| Body         | None                          |
+| Param        | None                          |
diff --git a/tyk-apis/tyk-portal-api/portal-documentation.mdx b/tyk-apis/tyk-portal-api/portal-documentation.mdx
new file mode 100644
index 0000000000..7fd773d23f
--- /dev/null
+++ b/tyk-apis/tyk-portal-api/portal-documentation.mdx
@@ -0,0 +1,313 @@
+---
+title: "API Publishing Endpoints"
+description: "This page details the API endpoint used for publishing APIs to Tyk classic Dev Portal. API platform teams and API owners can use this endpoint to integrate their APIs, making them visible and accessible to developers."
+keywords: "Tyk Classic Portal API Publishing Endpoints, Classic Portal API"
+robots: "noindex, nofollow"
+sidebarTitle: "API Publishing"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+This page describes the endpoints to create [catalog](#catalog) and [Swagger documentation](#documentation) for your API.
+
+<br />
+
+
+<Note>
+**Important Note on Spelling:**
+
+While our documentation now uses American English, the product itself, including UI, configuration fields, environment
+variables, and APIs endpoints, retain British English spellings. When interacting with the product, please continue
+using the British English spellings as they appear in the interface and API. (This means that for existing users nothing
+has changed).
+<br />
+**Example:** The API endpoint `/api/portal/catalogue` as shown throughout this page uses British spelling. In all other
+instances, such as when describing or referring to this object in the documentation, we will use the
+American spelling "catalog".
+</Note>
+
+
+## Documentation
+
+### Create Documentation
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/documentation` |
+| Method       | POST                     |
+| Type         | None                     |
+| Body         | Documentation Object     |
+| Param        | None                     |
+
+The Swagger or Blueprint should be base64 encoded and included in the `documentation` field of the Request Body, as per the example below.
+
+
+<Note>
+Support for API Blueprint is being deprecated. See [Importing APIs](/api-management/gateway-config-managing-classic#api-blueprint-is-being-deprecated) for more details.
+</Note>
+
+
+#### Sample Request
+
+```{.copyWrapper}
+POST /api/portal/documentation HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+
+{
+  "api_id": "",
+  "doc_type": "swagger",
+  "documentation": "<base64-encoded-swagger>"
+}
+```
+
+#### Sample Response
+
+```
+{
+  "Status": "OK",
+  "Message": "5ea6b2bd971eed0001009ddc",
+  "Meta": null
+}
+```
+
+### Delete Documentation
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/documentation/{id}` |
+| Method       | DELETE                   |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```{.copyWrapper}
+DELETE/api/portal/documentation HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```
+{
+  "Status": "OK",
+  "Message": "Data deleted",
+  "Meta": null
+}
+```
+
+## Catalog
+
+### List Catalog
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/catalogue`  |
+| Method       | GET                    |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```http
+GET /api/portal/catalogue HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```json
+{
+  "id":"5cc03284d07e7f00019404b4",
+  "org_id":"5cc03283d07e7f00019404b3",
+  "apis":[
+    {
+      "name":"Portal OAuth API",
+      "short_description":"",
+      "long_description":"",
+      "show":true,
+      "api_id":"",
+      "policy_id":"5ce4086ce845260001c1e1f5",
+      "documentation":"",
+      "version":"v2",
+      "is_keyless":false,
+      "config":{
+        "id":"",
+        "org_id":"",
+        "signup_fields":[
+
+        ],
+        "key_request_fields":[
+
+        ],
+        "require_key_approval":false,
+        "redirect_on_key_request":false,
+        "redirect_to":"",
+        "enable_multi_selection":false,
+        "disable_login":false,
+        "disable_signup":false,
+        "disable_auto_login":false,
+        "catalogue_login_only":false,
+        "oauth_usage_limit":-1,
+        "email":"",
+        "mail_options":{
+          "mail_from_name":"",
+          "mail_from_email":"",
+          "email_copy":{
+            "welcome_email":{
+              "enabled":false,
+              "subject":"",
+              "body":"",
+              "sign_off":"",
+              "hide_token_data":false
+            },
+            "key_email":{
+              "enabled":false,
+              "subject":"",
+              "body":"",
+              "sign_off":"",
+              "hide_token_data":false
+            },
+            "reset_password_email":{
+              "enabled":false,
+              "subject":"",
+              "body":"",
+              "sign_off":"",
+              "hide_token_data":false
+            }
+          }
+        },
+        "override":false,
+        "HashKeys":false
+      },
+      "fields":{
+
+      },
+      "auth_type":"oauth"
+    },
+    {
+      "name":"Test API",
+      "short_description":"",
+      "long_description":"",
+      "show":true,
+      "api_id":"",
+      "policy_id":"5ce51721e845260001d0a550",
+      "documentation":"5cf0d65d0313b300010b89ab",
+      "version":"v2",
+      "is_keyless":false,
+      "config":{
+        "id":"",
+        "org_id":"",
+        "signup_fields":[
+
+        ],
+        "key_request_fields":[
+
+        ],
+        "require_key_approval":false,
+        "redirect_on_key_request":false,
+        "redirect_to":"",
+        "enable_multi_selection":false,
+        "disable_login":false,
+        "disable_signup":false,
+        "disable_auto_login":false,
+        "catalogue_login_only":false,
+        "oauth_usage_limit":-1,
+        "email":"",
+        "mail_options":{
+          "mail_from_name":"",
+          "mail_from_email":"",
+          "email_copy":{
+            "welcome_email":{
+              "enabled":false,
+              "subject":"",
+              "body":"",
+              "sign_off":"",
+              "hide_token_data":false
+            },
+            "key_email":{
+              "enabled":false,
+              "subject":"",
+              "body":"",
+              "sign_off":"",
+              "hide_token_data":false
+            },
+            "reset_password_email":{
+              "enabled":false,
+              "subject":"",
+              "body":"",
+              "sign_off":"",
+              "hide_token_data":false
+            }
+          }
+        },
+        "override":false,
+        "HashKeys":false
+      },
+      "fields":{
+
+      },
+      "auth_type":"authToken"
+    }
+  ],
+  "email":""
+}
+```
+
+### Create Catalog
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/catalogue`  |
+| Method       | POST                   |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```http
+POST /api/portal/catalogue HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```yaml
+{
+  Response here
+}
+```
+
+### Update Catalog
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/catalogue`  |
+| Method       | PUT                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```http
+PUT /api/portal/catalogue HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```yaml
+{
+  Response here
+}
+```
diff --git a/tyk-apis/tyk-portal-api/portal-keys.mdx b/tyk-apis/tyk-portal-api/portal-keys.mdx
new file mode 100644
index 0000000000..47923f9a36
--- /dev/null
+++ b/tyk-apis/tyk-portal-api/portal-keys.mdx
@@ -0,0 +1,1633 @@
+---
+title: "Portal Keys"
+order: 1
+robots: "noindex, nofollow"
+sidebarTitle: "Key Requests"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+### List All Key Requests
+
+| **Property** | **Description**          |
+| :------------ | :------------------------ |
+| Resource URL | `/api/portal/requests`   |
+| Method       | GET                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```http
+GET /api/portal/requests HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```json
+{
+  "Data":[
+    {
+      "id":"5cf61bff0313b300010b89ac",
+      "org_id":"5cc03283d07e7f00019404b3",
+      "for_api":"",
+      "for_plan":"5ce4086ce845260001c1e1f5",
+      "apply_policies":[
+        "5ce4086ce845260001c1e1f5"
+      ],
+      "by_user":"5ce4090ee845260001c1e1f6",
+      "fields":{
+        "oauth_app_description":"Application details",
+        "oauth_use_case":""
+      },
+      "approved":true,
+      "date_created":"2019-06-04T07:21:35.97Z",
+      "version":"v2",
+      "jwt_secret":"",
+      "certificate":"",
+      "oauth_info":{
+        "redirect_uri":"http://localhost"
+      },
+      "portal_developer":{
+        "id":"5ce4090ee845260001c1e1f6",
+        "email":"mark+5@tyk.io",
+        "date_created":"2019-05-21T14:19:57.99Z",
+        "inactive":false,
+        "org_id":"5cc03283d07e7f00019404b3",
+        "keys":{
+          "55b1ba47":[
+            "5ce4086ce845260001c1e1f5"
+          ]
+        },
+        "subscriptions":{
+          "5ce4086ce845260001c1e1f5":"55b1ba47"
+        },
+        "fields":{
+
+        },
+        "nonce":"",
+        "sso_key":"",
+        "oauth_clients":{
+          "5ce4086ce845260001c1e1f5":[
+            {
+              "client_id":"00a3d6916da6448381ea6c254937eda9",
+              "secret":"ZGU4OWRlZjUtMzA0NS00Njk0LTljYTYtNDJmODY0ZWI1NWUz",
+              "redirect_uri":"http://localhost",
+              "app_description":"Application details",
+              "use_case":"",
+              "date_created":"2019-06-04T07:21:35.97Z"
+            }
+          ]
+        },
+        "password_max_days":0,
+        "password_updated":"2019-10-23T10:01:56.25Z",
+        "PWHistory":[
+
+        ],
+        "last_login_date":"2019-10-23T10:02:14.117Z"
+      },
+      "catalogue_entry":{
+        "name":"Portal OAuth API",
+        "short_description":"",
+        "long_description":"",
+        "show":true,
+        "api_id":"",
+        "policy_id":"5ce4086ce845260001c1e1f5",
+        "documentation":"",
+        "version":"v2",
+        "is_keyless":false,
+        "config":{
+          "id":"",
+          "org_id":"",
+          "signup_fields":[
+
+          ],
+          "key_request_fields":[
+
+          ],
+          "require_key_approval":false,
+          "redirect_on_key_request":false,
+          "redirect_to":"",
+          "enable_multi_selection":false,
+          "disable_login":false,
+          "disable_signup":false,
+          "disable_auto_login":false,
+          "catalogue_login_only":false,
+          "oauth_usage_limit":-1,
+          "email":"",
+          "mail_options":{
+            "mail_from_name":"",
+            "mail_from_email":"",
+            "email_copy":{
+              "welcome_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "key_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "reset_password_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              }
+            }
+          },
+          "override":false,
+          "HashKeys":false
+        },
+        "fields":{
+
+        },
+        "auth_type":"oauth"
+      },
+      "catalogues":[
+        {
+          "name":"Portal OAuth API",
+          "short_description":"",
+          "long_description":"",
+          "show":true,
+          "api_id":"",
+          "policy_id":"5ce4086ce845260001c1e1f5",
+          "documentation":"",
+          "version":"v2",
+          "is_keyless":false,
+          "config":{
+            "id":"",
+            "org_id":"",
+            "signup_fields":[
+
+            ],
+            "key_request_fields":[
+
+            ],
+            "require_key_approval":false,
+            "redirect_on_key_request":false,
+            "redirect_to":"",
+            "enable_multi_selection":false,
+            "disable_login":false,
+            "disable_signup":false,
+            "disable_auto_login":false,
+            "catalogue_login_only":false,
+            "oauth_usage_limit":-1,
+            "email":"",
+            "mail_options":{
+              "mail_from_name":"",
+              "mail_from_email":"",
+              "email_copy":{
+                "welcome_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "key_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "reset_password_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                }
+              }
+            },
+            "override":false,
+            "HashKeys":false
+          },
+          "fields":{
+
+          },
+          "auth_type":"oauth"
+        }
+      ]
+    },
+    {
+      "id":"5ce51790e845260001d0a551",
+      "org_id":"5cc03283d07e7f00019404b3",
+      "for_api":"",
+      "for_plan":"5ce4086ce845260001c1e1f5",
+      "apply_policies":[
+        "5ce4086ce845260001c1e1f5"
+      ],
+      "by_user":"5ce4090ee845260001c1e1f6",
+      "fields":{
+        "oauth_app_description":"",
+        "oauth_use_case":""
+      },
+      "approved":true,
+      "date_created":"2019-05-22T09:34:08.211Z",
+      "version":"v2",
+      "jwt_secret":"",
+      "certificate":"",
+      "oauth_info":{
+        "redirect_uri":"localhost"
+      },
+      "portal_developer":{
+        "id":"5ce4090ee845260001c1e1f6",
+        "email":"mark+5@tyk.io",
+        "date_created":"2019-05-21T14:19:57.99Z",
+        "inactive":false,
+        "org_id":"5cc03283d07e7f00019404b3",
+        "keys":{
+          "55b1ba47":[
+            "5ce4086ce845260001c1e1f5"
+          ]
+        },
+        "subscriptions":{
+          "5ce4086ce845260001c1e1f5":"55b1ba47"
+        },
+        "fields":{
+
+        },
+        "nonce":"",
+        "sso_key":"",
+        "oauth_clients":{
+          "5ce4086ce845260001c1e1f5":[
+            {
+              "client_id":"00a3d6916da6448381ea6c254937eda9",
+              "secret":"ZGU4OWRlZjUtMzA0NS00Njk0LTljYTYtNDJmODY0ZWI1NWUz",
+              "redirect_uri":"http://localhost",
+              "app_description":"Application details",
+              "use_case":"",
+              "date_created":"2019-06-04T07:21:35.97Z"
+            }
+          ]
+        },
+        "password_max_days":0,
+        "password_updated":"2019-10-23T10:01:56.25Z",
+        "PWHistory":[
+
+        ],
+        "last_login_date":"2019-10-23T10:02:14.117Z"
+      },
+      "catalogue_entry":{
+        "name":"Portal OAuth API",
+        "short_description":"",
+        "long_description":"",
+        "show":true,
+        "api_id":"",
+        "policy_id":"5ce4086ce845260001c1e1f5",
+        "documentation":"",
+        "version":"v2",
+        "is_keyless":false,
+        "config":{
+          "id":"",
+          "org_id":"",
+          "signup_fields":[
+
+          ],
+          "key_request_fields":[
+
+          ],
+          "require_key_approval":false,
+          "redirect_on_key_request":false,
+          "redirect_to":"",
+          "enable_multi_selection":false,
+          "disable_login":false,
+          "disable_signup":false,
+          "disable_auto_login":false,
+          "catalogue_login_only":false,
+          "oauth_usage_limit":-1,
+          "email":"",
+          "mail_options":{
+            "mail_from_name":"",
+            "mail_from_email":"",
+            "email_copy":{
+              "welcome_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "key_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "reset_password_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              }
+            }
+          },
+          "override":false,
+          "HashKeys":false
+        },
+        "fields":{
+
+        },
+        "auth_type":"oauth"
+      },
+      "catalogues":[
+        {
+          "name":"Portal OAuth API",
+          "short_description":"",
+          "long_description":"",
+          "show":true,
+          "api_id":"",
+          "policy_id":"5ce4086ce845260001c1e1f5",
+          "documentation":"",
+          "version":"v2",
+          "is_keyless":false,
+          "config":{
+            "id":"",
+            "org_id":"",
+            "signup_fields":[
+
+            ],
+            "key_request_fields":[
+
+            ],
+            "require_key_approval":false,
+            "redirect_on_key_request":false,
+            "redirect_to":"",
+            "enable_multi_selection":false,
+            "disable_login":false,
+            "disable_signup":false,
+            "disable_auto_login":false,
+            "catalogue_login_only":false,
+            "oauth_usage_limit":-1,
+            "email":"",
+            "mail_options":{
+              "mail_from_name":"",
+              "mail_from_email":"",
+              "email_copy":{
+                "welcome_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "key_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "reset_password_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                }
+              }
+            },
+            "override":false,
+            "HashKeys":false
+          },
+          "fields":{
+
+          },
+          "auth_type":"oauth"
+        }
+      ]
+    },
+    {
+      "id":"5ce40db1e845260001c1e1f9",
+      "org_id":"5cc03283d07e7f00019404b3",
+      "for_api":"",
+      "for_plan":"5ce4086ce845260001c1e1f5",
+      "apply_policies":[
+        "5ce4086ce845260001c1e1f5"
+      ],
+      "by_user":"5ce4090ee845260001c1e1f6",
+      "fields":{
+        "oauth_app_description":"First OAuth Client",
+        "oauth_use_case":""
+      },
+      "approved":true,
+      "date_created":"2019-05-21T14:39:45.139Z",
+      "version":"v2",
+      "jwt_secret":"",
+      "certificate":"",
+      "oauth_info":{
+        "redirect_uri":"http://httpbin.org;"
+      },
+      "portal_developer":{
+        "id":"5ce4090ee845260001c1e1f6",
+        "email":"mark+5@tyk.io",
+        "date_created":"2019-05-21T14:19:57.99Z",
+        "inactive":false,
+        "org_id":"5cc03283d07e7f00019404b3",
+        "keys":{
+          "55b1ba47":[
+            "5ce4086ce845260001c1e1f5"
+          ]
+        },
+        "subscriptions":{
+          "5ce4086ce845260001c1e1f5":"55b1ba47"
+        },
+        "fields":{
+
+        },
+        "nonce":"",
+        "sso_key":"",
+        "oauth_clients":{
+          "5ce4086ce845260001c1e1f5":[
+            {
+              "client_id":"00a3d6916da6448381ea6c254937eda9",
+              "secret":"ZGU4OWRlZjUtMzA0NS00Njk0LTljYTYtNDJmODY0ZWI1NWUz",
+              "redirect_uri":"http://localhost",
+              "app_description":"Application details",
+              "use_case":"",
+              "date_created":"2019-06-04T07:21:35.97Z"
+            }
+          ]
+        },
+        "password_max_days":0,
+        "password_updated":"2019-10-23T10:01:56.25Z",
+        "PWHistory":[
+
+        ],
+        "last_login_date":"2019-10-23T10:02:14.117Z"
+      },
+      "catalogue_entry":{
+        "name":"Portal OAuth API",
+        "short_description":"",
+        "long_description":"",
+        "show":true,
+        "api_id":"",
+        "policy_id":"5ce4086ce845260001c1e1f5",
+        "documentation":"",
+        "version":"v2",
+        "is_keyless":false,
+        "config":{
+          "id":"",
+          "org_id":"",
+          "signup_fields":[
+
+          ],
+          "key_request_fields":[
+
+          ],
+          "require_key_approval":false,
+          "redirect_on_key_request":false,
+          "redirect_to":"",
+          "enable_multi_selection":false,
+          "disable_login":false,
+          "disable_signup":false,
+          "disable_auto_login":false,
+          "catalogue_login_only":false,
+          "oauth_usage_limit":-1,
+          "email":"",
+          "mail_options":{
+            "mail_from_name":"",
+            "mail_from_email":"",
+            "email_copy":{
+              "welcome_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "key_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "reset_password_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              }
+            }
+          },
+          "override":false,
+          "HashKeys":false
+        },
+        "fields":{
+
+        },
+        "auth_type":"oauth"
+      },
+      "catalogues":[
+        {
+          "name":"Portal OAuth API",
+          "short_description":"",
+          "long_description":"",
+          "show":true,
+          "api_id":"",
+          "policy_id":"5ce4086ce845260001c1e1f5",
+          "documentation":"",
+          "version":"v2",
+          "is_keyless":false,
+          "config":{
+            "id":"",
+            "org_id":"",
+            "signup_fields":[
+
+            ],
+            "key_request_fields":[
+
+            ],
+            "require_key_approval":false,
+            "redirect_on_key_request":false,
+            "redirect_to":"",
+            "enable_multi_selection":false,
+            "disable_login":false,
+            "disable_signup":false,
+            "disable_auto_login":false,
+            "catalogue_login_only":false,
+            "oauth_usage_limit":-1,
+            "email":"",
+            "mail_options":{
+              "mail_from_name":"",
+              "mail_from_email":"",
+              "email_copy":{
+                "welcome_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "key_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "reset_password_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                }
+              }
+            },
+            "override":false,
+            "HashKeys":false
+          },
+          "fields":{
+
+          },
+          "auth_type":"oauth"
+        }
+      ]
+    },
+    {
+      "id":"5ce40a67e845260001c1e1f8",
+      "org_id":"5cc03283d07e7f00019404b3",
+      "for_api":"",
+      "for_plan":"5ce4086ce845260001c1e1f5",
+      "apply_policies":[
+        "5ce4086ce845260001c1e1f5"
+      ],
+      "by_user":"5ce4090ee845260001c1e1f6",
+      "fields":{
+
+      },
+      "approved":true,
+      "date_created":"2019-05-21T14:25:43.934Z",
+      "version":"v2",
+      "jwt_secret":"",
+      "certificate":"",
+      "portal_developer":{
+        "id":"5ce4090ee845260001c1e1f6",
+        "email":"mark+5@tyk.io",
+        "date_created":"2019-05-21T14:19:57.99Z",
+        "inactive":false,
+        "org_id":"5cc03283d07e7f00019404b3",
+        "keys":{
+          "55b1ba47":[
+            "5ce4086ce845260001c1e1f5"
+          ]
+        },
+        "subscriptions":{
+          "5ce4086ce845260001c1e1f5":"55b1ba47"
+        },
+        "fields":{
+
+        },
+        "nonce":"",
+        "sso_key":"",
+        "oauth_clients":{
+          "5ce4086ce845260001c1e1f5":[
+            {
+              "client_id":"00a3d6916da6448381ea6c254937eda9",
+              "secret":"ZGU4OWRlZjUtMzA0NS00Njk0LTljYTYtNDJmODY0ZWI1NWUz",
+              "redirect_uri":"http://localhost",
+              "app_description":"Application details",
+              "use_case":"",
+              "date_created":"2019-06-04T07:21:35.97Z"
+            }
+          ]
+        },
+        "password_max_days":0,
+        "password_updated":"2019-10-23T10:01:56.25Z",
+        "PWHistory":[
+
+        ],
+        "last_login_date":"2019-10-23T10:02:14.117Z"
+      },
+      "catalogue_entry":{
+        "name":"Portal OAuth API",
+        "short_description":"",
+        "long_description":"",
+        "show":true,
+        "api_id":"",
+        "policy_id":"5ce4086ce845260001c1e1f5",
+        "documentation":"",
+        "version":"v2",
+        "is_keyless":false,
+        "config":{
+          "id":"",
+          "org_id":"",
+          "signup_fields":[
+
+          ],
+          "key_request_fields":[
+
+          ],
+          "require_key_approval":false,
+          "redirect_on_key_request":false,
+          "redirect_to":"",
+          "enable_multi_selection":false,
+          "disable_login":false,
+          "disable_signup":false,
+          "disable_auto_login":false,
+          "catalogue_login_only":false,
+          "oauth_usage_limit":-1,
+          "email":"",
+          "mail_options":{
+            "mail_from_name":"",
+            "mail_from_email":"",
+            "email_copy":{
+              "welcome_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "key_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "reset_password_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              }
+            }
+          },
+          "override":false,
+          "HashKeys":false
+        },
+        "fields":{
+
+        },
+        "auth_type":"oauth"
+      },
+      "catalogues":[
+        {
+          "name":"Portal OAuth API",
+          "short_description":"",
+          "long_description":"",
+          "show":true,
+          "api_id":"",
+          "policy_id":"5ce4086ce845260001c1e1f5",
+          "documentation":"",
+          "version":"v2",
+          "is_keyless":false,
+          "config":{
+            "id":"",
+            "org_id":"",
+            "signup_fields":[
+
+            ],
+            "key_request_fields":[
+
+            ],
+            "require_key_approval":false,
+            "redirect_on_key_request":false,
+            "redirect_to":"",
+            "enable_multi_selection":false,
+            "disable_login":false,
+            "disable_signup":false,
+            "disable_auto_login":false,
+            "catalogue_login_only":false,
+            "oauth_usage_limit":-1,
+            "email":"",
+            "mail_options":{
+              "mail_from_name":"",
+              "mail_from_email":"",
+              "email_copy":{
+                "welcome_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "key_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "reset_password_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                }
+              }
+            },
+            "override":false,
+            "HashKeys":false
+          },
+          "fields":{
+
+          },
+          "auth_type":"oauth"
+        }
+      ]
+    },
+    {
+      "id":"5ce40a12e845260001c1e1f7",
+      "org_id":"5cc03283d07e7f00019404b3",
+      "for_api":"",
+      "for_plan":"5ce4086ce845260001c1e1f5",
+      "apply_policies":[
+        "5ce4086ce845260001c1e1f5"
+      ],
+      "by_user":"5ce4090ee845260001c1e1f6",
+      "fields":{
+        "oauth_app_description":"First OAuth client",
+        "oauth_use_case":""
+      },
+      "approved":true,
+      "date_created":"2019-05-21T14:24:18.631Z",
+      "version":"v2",
+      "jwt_secret":"",
+      "certificate":"",
+      "oauth_info":{
+        "redirect_uri":"http://httpbin.org;"
+      },
+      "portal_developer":{
+        "id":"5ce4090ee845260001c1e1f6",
+        "email":"mark+5@tyk.io",
+        "date_created":"2019-05-21T14:19:57.99Z",
+        "inactive":false,
+        "org_id":"5cc03283d07e7f00019404b3",
+        "keys":{
+          "55b1ba47":[
+            "5ce4086ce845260001c1e1f5"
+          ]
+        },
+        "subscriptions":{
+          "5ce4086ce845260001c1e1f5":"55b1ba47"
+        },
+        "fields":{
+
+        },
+        "nonce":"",
+        "sso_key":"",
+        "oauth_clients":{
+          "5ce4086ce845260001c1e1f5":[
+            {
+              "client_id":"00a3d6916da6448381ea6c254937eda9",
+              "secret":"ZGU4OWRlZjUtMzA0NS00Njk0LTljYTYtNDJmODY0ZWI1NWUz",
+              "redirect_uri":"http://localhost",
+              "app_description":"Application details",
+              "use_case":"",
+              "date_created":"2019-06-04T07:21:35.97Z"
+            }
+          ]
+        },
+        "password_max_days":0,
+        "password_updated":"2019-10-23T10:01:56.25Z",
+        "PWHistory":[
+
+        ],
+        "last_login_date":"2019-10-23T10:02:14.117Z"
+      },
+      "catalogue_entry":{
+        "name":"Portal OAuth API",
+        "short_description":"",
+        "long_description":"",
+        "show":true,
+        "api_id":"",
+        "policy_id":"5ce4086ce845260001c1e1f5",
+        "documentation":"",
+        "version":"v2",
+        "is_keyless":false,
+        "config":{
+          "id":"",
+          "org_id":"",
+          "signup_fields":[
+
+          ],
+          "key_request_fields":[
+
+          ],
+          "require_key_approval":false,
+          "redirect_on_key_request":false,
+          "redirect_to":"",
+          "enable_multi_selection":false,
+          "disable_login":false,
+          "disable_signup":false,
+          "disable_auto_login":false,
+          "catalogue_login_only":false,
+          "oauth_usage_limit":-1,
+          "email":"",
+          "mail_options":{
+            "mail_from_name":"",
+            "mail_from_email":"",
+            "email_copy":{
+              "welcome_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "key_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              },
+              "reset_password_email":{
+                "enabled":false,
+                "subject":"",
+                "body":"",
+                "sign_off":"",
+                "hide_token_data":false
+              }
+            }
+          },
+          "override":false,
+          "HashKeys":false
+        },
+        "fields":{
+
+        },
+        "auth_type":"oauth"
+      },
+      "catalogues":[
+        {
+          "name":"Portal OAuth API",
+          "short_description":"",
+          "long_description":"",
+          "show":true,
+          "api_id":"",
+          "policy_id":"5ce4086ce845260001c1e1f5",
+          "documentation":"",
+          "version":"v2",
+          "is_keyless":false,
+          "config":{
+            "id":"",
+            "org_id":"",
+            "signup_fields":[
+
+            ],
+            "key_request_fields":[
+
+            ],
+            "require_key_approval":false,
+            "redirect_on_key_request":false,
+            "redirect_to":"",
+            "enable_multi_selection":false,
+            "disable_login":false,
+            "disable_signup":false,
+            "disable_auto_login":false,
+            "catalogue_login_only":false,
+            "oauth_usage_limit":-1,
+            "email":"",
+            "mail_options":{
+              "mail_from_name":"",
+              "mail_from_email":"",
+              "email_copy":{
+                "welcome_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "key_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                },
+                "reset_password_email":{
+                  "enabled":false,
+                  "subject":"",
+                  "body":"",
+                  "sign_off":"",
+                  "hide_token_data":false
+                }
+              }
+            },
+            "override":false,
+            "HashKeys":false
+          },
+          "fields":{
+
+          },
+          "auth_type":"oauth"
+        }
+      ]
+    }
+  ],
+  "Pages":1
+}
+```
+
+### List a Single Key Request
+
+| **Property** | **Description**            |
+| :------------ | :-------------------------- |
+| Resource URL | `/api/portal/requests/{id}`|
+| Method       | GET                      |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```http
+GET /api/portal/requests/KEYID HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```json
+{
+  "id":"5cf61bff0313b300010b89ac",
+  "org_id":"5cc03283d07e7f00019404b3",
+  "for_api":"",
+  "for_plan":"5ce4086ce845260001c1e1f5",
+  "apply_policies":[
+    "5ce4086ce845260001c1e1f5"
+  ],
+  "by_user":"5ce4090ee845260001c1e1f6",
+  "fields":{
+    "oauth_app_description":"Application details",
+    "oauth_use_case":""
+  },
+  "approved":true,
+  "date_created":"2019-06-04T07:21:35.97Z",
+  "version":"v2",
+  "jwt_secret":"",
+  "certificate":"",
+  "oauth_info":{
+    "redirect_uri":"http://localhost"
+  },
+  "portal_developer":{
+    "id":"5ce4090ee845260001c1e1f6",
+    "email":"mark+5@tyk.io",
+    "date_created":"2019-05-21T14:19:57.99Z",
+    "inactive":false,
+    "org_id":"5cc03283d07e7f00019404b3",
+    "keys":{
+      "55b1ba47":[
+        "5ce4086ce845260001c1e1f5"
+      ]
+    },
+    "subscriptions":{
+      "5ce4086ce845260001c1e1f5":"55b1ba47"
+    },
+    "fields":{
+
+    },
+    "nonce":"",
+    "sso_key":"",
+    "oauth_clients":{
+      "5ce4086ce845260001c1e1f5":[
+        {
+          "client_id":"00a3d6916da6448381ea6c254937eda9",
+          "secret":"ZGU4OWRlZjUtMzA0NS00Njk0LTljYTYtNDJmODY0ZWI1NWUz",
+          "redirect_uri":"http://localhost",
+          "app_description":"Application details",
+          "use_case":"",
+          "date_created":"2019-06-04T07:21:35.97Z"
+        }
+      ]
+    },
+    "password_max_days":0,
+    "password_updated":"2019-10-23T10:01:56.25Z",
+    "PWHistory":[
+
+    ],
+    "last_login_date":"2019-10-23T10:02:14.117Z"
+  },
+  "catalogue_entry":{
+    "name":"Portal OAuth API",
+    "short_description":"",
+    "long_description":"",
+    "show":true,
+    "api_id":"",
+    "policy_id":"5ce4086ce845260001c1e1f5",
+    "documentation":"",
+    "version":"v2",
+    "is_keyless":false,
+    "config":{
+      "id":"",
+      "org_id":"",
+      "signup_fields":[
+
+      ],
+      "key_request_fields":[
+
+      ],
+      "require_key_approval":false,
+      "redirect_on_key_request":false,
+      "redirect_to":"",
+      "enable_multi_selection":false,
+      "disable_login":false,
+      "disable_signup":false,
+      "disable_auto_login":false,
+      "catalogue_login_only":false,
+      "oauth_usage_limit":-1,
+      "email":"",
+      "mail_options":{
+        "mail_from_name":"",
+        "mail_from_email":"",
+        "email_copy":{
+          "welcome_email":{
+            "enabled":false,
+            "subject":"",
+            "body":"",
+            "sign_off":"",
+            "hide_token_data":false
+          },
+          "key_email":{
+            "enabled":false,
+            "subject":"",
+            "body":"",
+            "sign_off":"",
+            "hide_token_data":false
+          },
+          "reset_password_email":{
+            "enabled":false,
+            "subject":"",
+            "body":"",
+            "sign_off":"",
+            "hide_token_data":false
+          }
+        }
+      },
+      "override":false,
+      "HashKeys":false
+    },
+    "fields":{
+
+    },
+    "auth_type":"oauth"
+  },
+  "catalogues":[
+    {
+      "name":"Portal OAuth API",
+      "short_description":"",
+      "long_description":"",
+      "show":true,
+      "api_id":"",
+      "policy_id":"5ce4086ce845260001c1e1f5",
+      "documentation":"",
+      "version":"v2",
+      "is_keyless":false,
+      "config":{
+        "id":"",
+        "org_id":"",
+        "signup_fields":[
+
+        ],
+        "key_request_fields":[
+
+        ],
+        "require_key_approval":false,
+        "redirect_on_key_request":false,
+        "redirect_to":"",
+        "enable_multi_selection":false,
+        "disable_login":false,
+        "disable_signup":false,
+        "disable_auto_login":false,
+        "catalogue_login_only":false,
+        "oauth_usage_limit":-1,
+        "email":"",
+        "mail_options":{
+          "mail_from_name":"",
+          "mail_from_email":"",
+          "email_copy":{
+            "welcome_email":{
+              "enabled":false,
+              "subject":"",
+              "body":"",
+              "sign_off":"",
+              "hide_token_data":false
+            },
+            "key_email":{
+              "enabled":false,
+              "subject":"",
+              "body":"",
+              "sign_off":"",
+              "hide_token_data":false
+            },
+            "reset_password_email":{
+              "enabled":false,
+              "subject":"",
+              "body":"",
+              "sign_off":"",
+              "hide_token_data":false
+            }
+          }
+        },
+        "override":false,
+        "HashKeys":false
+      },
+      "fields":{
+
+      },
+      "auth_type":"oauth"
+    }
+  ]
+}
+```
+
+### Create a Key Request
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/api/portal/requests`        |
+| Method       | POST                          |
+| Type         | None                          |
+| Body         | Developer Object              |
+| Param        | None                          |
+
+#### Sample Request
+
+```http
+POST /api/portal/requests HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+
+{
+  "key": "",
+  "org_id": "5e9d9544a1dcd60001d0ed20",
+  "for_api": "",
+  "for_plan": "5ead7120575961000181867e",
+  "apply_policies": [
+    "5ead7120575961000181867e"
+  ],
+  "remove_policies": [],
+  "by_user": "5efdbdb749960c000137f589",
+  "fields": {},
+  "approved": true,
+  "date_created": "2020-07-02T12:47:35.953Z",
+  "version": "v2",
+  "jwt_secret": "",
+  "certificate": "",
+  "portal_developer": {
+    "id": "5efdbdb749960c000137f589",
+    "email": "portal-developer@example.org",
+    "date_created": "2020-07-02T10:57:59.878Z",
+    "inactive": false,
+    "org_id": "5e9d9544a1dcd60001d0ed20",
+    "keys": {
+      "2ac7b253c36e210d": [
+        "5ead7120575961000181867e"
+      ]
+    },
+    "subscriptions": {
+      "5ead7120575961000181867e": "2ac7b253c36e210d"
+    },
+    "fields": {},
+    "nonce": "",
+    "sso_key": "",
+    "password_max_days": 0,
+    "password_updated": "2020-07-02T10:57:59.951Z",
+    "PWHistory": [],
+    "last_login_date": "2020-07-02T12:47:31.837Z"
+  },
+  "catalogue_entry": {
+    "name": "Swagger Petstore",
+    "short_description": "",
+    "long_description": "",
+    "show": true,
+    "api_id": "",
+    "policy_id": "5ead7120575961000181867e",
+    "documentation": "5efdbdb849960c000137f58a",
+    "version": "v2",
+    "is_keyless": false,
+    "config": {
+      "id": "",
+      "org_id": "",
+      "signup_fields": [],
+      "key_request_fields": [],
+      "require_key_approval": false,
+      "redirect_on_key_request": false,
+      "redirect_to": "",
+      "enable_multi_selection": false,
+      "disable_login": false,
+      "disable_signup": false,
+      "disable_auto_login": false,
+      "catalogue_login_only": false,
+      "oauth_usage_limit": -1,
+      "email": "",
+      "mail_options": {
+        "mail_from_name": "",
+        "mail_from_email": "",
+        "email_copy": {
+          "welcome_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          },
+          "key_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          },
+          "reset_password_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          }
+        }
+      },
+      "override": false,
+      "HashKeys": false
+    },
+    "fields": {},
+    "auth_type": "authToken"
+  },
+  "catalogues": [{
+    "name": "Swagger Petstore",
+    "short_description": "",
+    "long_description": "",
+    "show": true,
+    "api_id": "",
+    "policy_id": "5ead7120575961000181867e",
+    "documentation": "5efdbdb849960c000137f58a",
+    "version": "v2",
+    "is_keyless": false,
+    "config": {
+      "id": "",
+      "org_id": "",
+      "signup_fields": [],
+      "key_request_fields": [],
+      "require_key_approval": false,
+      "redirect_on_key_request": false,
+      "redirect_to": "",
+      "enable_multi_selection": false,
+      "disable_login": false,
+      "disable_signup": false,
+      "disable_auto_login": false,
+      "catalogue_login_only": false,
+      "oauth_usage_limit": -1,
+      "email": "",
+      "mail_options": {
+        "mail_from_name": "",
+        "mail_from_email": "",
+        "email_copy": {
+          "welcome_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          },
+          "key_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          },
+          "reset_password_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          }
+        }
+      },
+      "override": false,
+      "HashKeys": false
+    },
+    "fields": {},
+    "auth_type": "authToken"
+  }]
+}
+```
+
+#### Sample Response
+
+```json
+{
+  "Status": "OK",
+  "Message": "5efde61749960c000137f590",
+  "Meta": null
+}
+```
+
+### Update a Key Request
+
+| **Property** | **Description**            |
+| :------------ | :-------------------------- |
+| Resource URL | `/api/portal/requests/{id}`|
+| Method       | UPDATE                     |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```http
+UPDATE /api/portal/requests/5efde61749960c000137f590 HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+
+{
+  "key": "",
+  "org_id": "5e9d9544a1dcd60001d0ed20",
+  "for_api": "",
+  "for_plan": "5ead7120575961000181867e",
+  "apply_policies": [
+    "5ead7120575961000181867e"
+  ],
+  "remove_policies": [],
+  "by_user": "5efdbdb749960c000137f589",
+  "fields": {},
+  "approved": true,
+  "date_created": "2020-07-02T12:47:35.953Z",
+  "version": "v2",
+  "jwt_secret": "",
+  "certificate": "",
+  "portal_developer": {
+    "id": "5efdbdb749960c000137f589",
+    "email": "portal-developer@example.org",
+    "date_created": "2020-07-02T10:57:59.878Z",
+    "inactive": false,
+    "org_id": "5e9d9544a1dcd60001d0ed20",
+    "keys": {
+      "2ac7b253c36e210d": [
+        "5ead7120575961000181867e"
+      ]
+    },
+    "subscriptions": {
+      "5ead7120575961000181867e": "2ac7b253c36e210d"
+    },
+    "fields": {},
+    "nonce": "",
+    "sso_key": "",
+    "password_max_days": 0,
+    "password_updated": "2020-07-02T10:57:59.951Z",
+    "PWHistory": [],
+    "last_login_date": "2020-07-02T12:47:31.837Z"
+  },
+  "catalogue_entry": {
+    "name": "Swagger Petstore",
+    "short_description": "",
+    "long_description": "",
+    "show": true,
+    "api_id": "",
+    "policy_id": "5ead7120575961000181867e",
+    "documentation": "5efdbdb849960c000137f58a",
+    "version": "v2",
+    "is_keyless": false,
+    "config": {
+      "id": "",
+      "org_id": "",
+      "signup_fields": [],
+      "key_request_fields": [],
+      "require_key_approval": false,
+      "redirect_on_key_request": false,
+      "redirect_to": "",
+      "enable_multi_selection": false,
+      "disable_login": false,
+      "disable_signup": false,
+      "disable_auto_login": false,
+      "catalogue_login_only": false,
+      "oauth_usage_limit": -1,
+      "email": "",
+      "mail_options": {
+        "mail_from_name": "",
+        "mail_from_email": "",
+        "email_copy": {
+          "welcome_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          },
+          "key_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          },
+          "reset_password_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          }
+        }
+      },
+      "override": false,
+      "HashKeys": false
+    },
+    "fields": {},
+    "auth_type": "authToken"
+  },
+  "catalogues": [{
+    "name": "Swagger Petstore",
+    "short_description": "",
+    "long_description": "",
+    "show": true,
+    "api_id": "",
+    "policy_id": "5ead7120575961000181867e",
+    "documentation": "5efdbdb849960c000137f58a",
+    "version": "v2",
+    "is_keyless": false,
+    "config": {
+      "id": "",
+      "org_id": "",
+      "signup_fields": [],
+      "key_request_fields": [],
+      "require_key_approval": false,
+      "redirect_on_key_request": false,
+      "redirect_to": "",
+      "enable_multi_selection": false,
+      "disable_login": false,
+      "disable_signup": false,
+      "disable_auto_login": false,
+      "catalogue_login_only": false,
+      "oauth_usage_limit": -1,
+      "email": "",
+      "mail_options": {
+        "mail_from_name": "",
+        "mail_from_email": "",
+        "email_copy": {
+          "welcome_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          },
+          "key_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          },
+          "reset_password_email": {
+            "enabled": false,
+            "subject": "",
+            "body": "",
+            "sign_off": "",
+            "hide_token_data": false
+          }
+        }
+      },
+      "override": false,
+      "HashKeys": false
+    },
+    "fields": {},
+    "auth_type": "authToken"
+  }]
+}
+```
+
+#### Sample Response
+
+```json
+{
+  "Status": "OK",
+  "Message": "5efde61749960c000137f590",
+  "Meta": null
+}
+```
+
+### Delete a Key Request
+
+| **Property** | **Description**            |
+| :------------ | :-------------------------- |
+| Resource URL | `/api/portal/requests/{id}`|
+| Method       | DELETE                     |
+| Type         | None                     |
+| Body         | None                     |
+| Param        | None                     |
+
+#### Sample Request
+
+```http
+DELETE /api/portal/requests/5efde61749960c000137f590 HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response
+
+```json
+{
+  "Status": "OK",
+  "Message": "Data deleted",
+  "Meta": null
+}
+```
+
+### Approve Key Requests
+
+| **Property** | **Description**               |
+| :------------ | :----------------------------- |
+| Resource URL | `/api/portal/requests/approve/{id}`|
+| Method       | PUT                           |
+| Type         | None                          |
+| Body         | Developer Object              |
+| Param        | None                          |
+
+#### Sample Request
+
+```http
+PUT /api/portal/requests HTTP/1.1
+Host: localhost
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+#### Sample Response - Authentication Token
+
+```json
+{
+    "RawKey": "eyJvcmciOiI1ZTlkOTU0NGExZGNkNjAwMDFkMGVkMjAiLCJpZCI6ImQ0NzIzOWUxMjg3NTRjMGM5MTQ4MzYzMjg2YjhlZDQ2IiwiaCI6Im11cm11cjY0In0=",
+    "Password": ""
+}
+```
+
+**Note:** If you're using *Authentication Token* as your *authentication mode*, the `RawKey` value is the actual API Key used to send authenticated requests.
+
+#### Sample Response - Basic Authentication
+
+```json
+{
+    "RawKey": "ffeLySpZR5",
+    "Password": "XJSm3gZIeDdk"
+}
+```
+
+**Note:** If you're using Basic *Basic Authentication* as your *authentication mode*, the `RawKey` value is the username used to send authenticated requests.
\ No newline at end of file
diff --git a/tyk-cloud.mdx b/tyk-cloud.mdx
new file mode 100644
index 0000000000..776067e068
--- /dev/null
+++ b/tyk-cloud.mdx
@@ -0,0 +1,511 @@
+---
+title: "Tyk Cloud"
+description: "An overview of Tyk Cloud, a fully managed API management platform"
+keywords: "Tyk Cloud, Migration"
+sidebarTitle: "Tyk Cloud"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+## What is Tyk Cloud
+
+Tyk cloud is a fully managed service that makes it easy for API teams to create, secure, publish and maintain APIs at any scale, anywhere in the world. Tyk Cloud includes everything you need to manage your global API ecosystem: [Tyk Gateways](/tyk-oss-gateway), [Tyk Dashboard](/api-management/dashboard-configuration), [Tyk Developer Portal](/portal/overview/intro) and [Universal Data Graph](/api-management/data-graph#overview).
+
+- **No need to wrestle with infrastructure:** You can be up and running within a few clicks. No need for complex deployments or large infrastructure teams.
+- **Flexible deployment options:** Whether you're a startup or a large enterprise, Tyk Cloud has deployment options to suit your needs. You can scale and manage your API ecosystem easily and efficiently. The control plane is hosted by Tyk in the cloud, in one of the 5 regions available. Meanwhile, the data planes, composed of Tyk Gateways and Redis for temporary storage, can be either hosted by Tyk or managed by you on your infrastructure.
+- **Geographical freedom:** Tyk Cloud allows you to select your preferred AWS location as your home region, ensuring your data and Tyk Gateways are live and secured in the region that suits you best.
+- **Designed for platform teams:** With Tyk Cloud, you can use [role-based access control (RBAC)](https://tyk.io/blog/how-to-manage-multiple-teams-with-tyk-cloud/) to manage your team structure, as well as [multiple environments and multiple organizations](https://tyk.io/blog/how-to-manage-multiple-teams-with-tyk-cloud/). 
+
+
+Start using Tyk on our servers. Nothing to install:
+
+<ButtonLeft href="https://tyk.io/sign-up/" color="green" content="Tyk Cloud Free trial" />
+
+
+### Why Tyk Cloud?
+
+#### Next Level SaaS
+
+Tyk is cloud native and has always been a true multi-cloud product and now we’re taking it to the next level with our next level SaaS platform, Tyk Cloud.
+
+Now you don’t need to worry about vendor lock-in, or complex deployments, you can benefit from being able to optimize your platforms across and between a myriad of providers such as AWS, Google Cloud etc.
+
+#### Quick deployments Wherever you need them
+
+Want to handle Govt API traffic in Singapore? With just a few clicks your data and Tyk Gateways are live and secured in the AWS Gov cloud. Want to add local Gateways in Australia to improve performance and resilience? It’s just a click away. Want to deploy your management layer to your own hosted servers rather than a cloud provider? We make it simple.
+
+The new Tyk Cloud platform allows you to quickly setup the full Tyk Enterprise API Management platform, simply choosing the regions where you wish to locate your gateways and where you wish your data to reside, resulting in immediate and secure data sovereignty.
+
+Seamlessly wire your environments between cloud providers, and your own infrastructure, anywhere in the world at the click of a button, not only eliminating lock-in but making it possible to expand your platform to cater for the changing needs of your clients.
+
+#### Designed for Enterprises
+
+Tyk Cloud is designed for Enterprises who may have multi-organizations and multi-teams, so you can combine or isolate your platform and the underlying providers, the choice is completely yours!
+
+To make it even simpler, Tyk Cloud is pre-configured so you can be up and running within a few clicks, no laborious tasks for your internal teams and best practice configuration and security is delivered out of the box.
+
+### Where is Tyk Cloud hosted?
+
+Tyk Cloud is currently available to auto-deploy on AWS.
+Paid plans and Enterprise trials allow users to select one of 6 AWS locations as their home region as well as the locations of their Cloud Data Planes. The 6 AWS regions to choose from are:
+- aws-ap-southeast-1, Singapore
+- aws-eu-central-1, Frankfurt, Germany
+- aws-eu-west-2, London, UK
+- aws-us-east-1, N. Virginia, USA
+- aws-us-west-2, Oregon, USA
+- aws-ap-southeast-2, Australia
+
+### Checking the Tyk Cloud status
+
+If you want to check if there are issues with the environments and any upcoming down times, you can go to the [Tyk Status](https://status.tyk.io/) page.
+
+## Quick Start Tyk Cloud
+
+
+<Note>
+The Tyk Cloud trial is limited to 48 hours. After this period, your data will be deleted.
+The Tyk Cloud trial does not include access to [Hybrid deployments](/tyk-cloud/environments-deployments/hybrid-gateways) or the [Developer Portal](/portal/overview/intro).
+To try out these capabilities, please get in touch for a [guided evaluation](https://tyk.io/guided-evaluation/) with our team.
+</Note>
+
+
+Welcome to the [Tyk Cloud Platform](/tyk-cloud)!
+This guide will lead you through the following steps:
+1. Signing up with [Tyk Cloud ](/tyk-cloud).
+2. Creating your first [API](/api-management/gateway-config-introduction) using the [Tyk Dashboard](/api-management/dashboard-configuration).
+3. Setting up a [Policy](/api-management/access-control/overview) and generating a Key to secure your APIs.
+
+No installation required!
+
+### Steps for Setting up Tyk Cloud
+
+1. **Create Tyk Cloud Account**
+
+To create Tyk Cloud account follow this [guide](/getting-started/create-account).
+
+2. **Get started with your first API with Tyk Dashboard**
+
+To create your API using Tyk Dashboard follow this [guide](/getting-started/configure-first-api).
+
+## Comprehensive Tyk Cloud Setup
+
+This section walks you through how to start using Tyk Cloud, creating organization, environment and users before creating an API. If you are in a hurry, try the [Quick Start guide](#quick-start-tyk-cloud) for a 5 min version of this tutorial. 
+
+* Creating your Tyk Cloud account
+* Your first Organization
+* Creating your first Team and Environment
+* Configuring and deploying your Control Plane and creating your Cloud Data Plane
+* Adding and testing your first API
+
+
+
+    <Note>
+    `Comprehensive Tyk Cloud Setup` requires access to `Tyk Cloud Console` (management UI). Please note that free trial users do not have access to the `Tyk Cloud Console`. To obtain the required access, contact [support](https://tyk.io/contact/).
+    </Note>
+
+
+At the end of this process you will have a simple API set up via a Tyk Dashboard and you'll see analytics for this API on the Tyk Activity Dashboard.
+
+Depending on your initial requirements in terms of Environments, Teams and Users, the setup process should take between 15 to 30 minutes.
+
+### Prerequisites
+
+The following information would be useful so you can set up Tyk Cloud as quickly as possible:
+
+* Team member information including their email address and the role you plan to assign to them.
+* We have some specific terminology used within Tyk Cloud. It would be useful to checkout our [Glossary](#glossary) so you understand what we are referring to.
+
+### Hierarchy
+
+This diagram shows how _Organization, Teams, Environments, Control Planes and Cloud Data Planes_ fit in with each other and which object contains which:
+
+<img src="/img/cloud/Onboarding_Diagram_2-1_Ara.png" alt="Hierarchy of Organization, Teams, Environments, Control Planes and Cloud Data Planes" />
+
+### Complete Cloud Setup Tasks
+
+#### Create an Account
+
+You can use Tyk Cloud to manage your APIs effectively and with minimal effort. This page explains how to create an account, in order to start doing so.
+
+##### What happens when you create your Tyk Cloud account?
+
+When you create your Tyk Cloud account, we do the following for you:
+
+* Assign the account creator as a [Billing admin](#user-roles-in-tyk-cloud) for the Organization. This user role allows you to manage the billing and plans for your org. You can also add other billing admins as required.
+* Assign the new account to our [48 hours free trial plan](https://tyk.io/sign-up/#cloud)
+
+##### Creating your first account
+
+[Start here](https://tyk.io/sign-up/#cloud).
+
+* To create your account, you will have to fill in first-level details like your first name, last name and email.
+* Then, set up a password for your Tyk Cloud account.
+* Following that check the box at the bottom of the page to confirm that you have read and accepted our [Terms and Conditions](https://tyk.io/software-as-a-service-agreement/).
+* Finally, click **Create new account**
+* After completing the Account Creation form, click **Start Organization Setup**.
+
+
+#### Set Up Your Organisation
+
+Now that you have created the new Tyk Cloud account with your basic details, it is time to set up your organization. This page will tell you how to set up your organization and also about the two ways of setting it up.
+
+##### What is an organization?
+
+* An organization is the main entity for all your data (Environments, APIs, Users, etc)
+* An Organization is connected to a single region and once connected, cannot be changed.
+  
+##### Steps to set up your organization  
+
+* **Step 1 - Name your Organization:** Give your organization a name. This is up to you, but most users use their company name.
+
+* **Step 2 - Select a Home Region:** Select a region from the drop-down list where your [Control Plane](#glossary) will be deployed and your data stored. The number of regions available will depend on your license. Further regions can be added as an upgrade option.
+
+
+
+    <Note>
+    Tyk Cloud can currently be deployed across 2 AWS regions in the USA plus UK, Germany and Singapore. If you have any concerns about Brexit impacting the way you store data you should read [AWS regularly updated Brexit statement](https://aws.amazon.com/compliance/gdpr-center/brexit/).
+    </Note>
+
+
+##### Types of Setups
+
+You can now select how to configure your deployment.
+
+**Option 1: Demo Setup**
+
+Our demo setup will quickly configure your first deployment setup automatically, creating your first team, Cloud Control Plane and Cloud Data Plane.
+
+**Option 2: Manual Setup**
+
+This setup option gives you full control on creating the following:
+
+* Teams
+* Environments
+* Configuration and deployment of Control Planes and Cloud Data Planes
+
+For a manual setup you'll get started by [setting up your first team](#create-your-first-team).
+
+#### Create Your First Team
+
+Following organization setup, you will have to set up your team(s) on Tyk Cloud. This page will tell you all about the process.
+
+##### What is a team?
+
+* A team is a sub-grouping inside an organization. 
+* Inside a team, you can define users(team members) and roles(permissions that can be applied to a user or a team of users).
+
+##### Steps to set up your team
+
+After creating your Organization you'll land on the success screen. Click **Get Started**.
+
+* **Step 1 - Name your Team:** Give your [Team](#glossary) a name. You may find it useful to reflect the names used within your organization.
+
+* **Step Two - Invite your Users:** Invite your [users](#glossary) to your team. You'll only need their email address and which of the available [roles](#glossary) you want to assign to them. This step is optional and can be completed within the dashboard later.
+
+##### User Roles in Tyk Cloud
+
+Out of the box, the following roles are setup:
+
+* **Team member:** They can manage deployment activity for the team they are added to.
+* **Team admin:** They can manage deployment activity and users for the team they are added to.
+* **Organization admin:** They can manage deployment activity and users for a single organization.
+
+Next you'll create an [Environment](#configure-environment-and-deployments).
+
+#### Configure Environment and Deployments
+
+An Environment allows you to group deployments together. In this step we will create an Environment and configure our first Control Plane and Cloud Data Plane deployments.
+
+##### What is an environment?
+
+An environment is a grouping of ‘deployments’ that can have multiple Control Planes and Cloud Data Planes.
+
+##### Steps to set up your environment
+
+* **Step 1 - Name your Environment:** Give your [Environment](#glossary) a name. You may find it useful to reflect the names used within your organization such as Development, Production etc.
+  
+* **Step 2 - Name your Control Plane:** Give your [Control Plane](#glossary) a name. Again, this is up to you and you may already have an infrastructure you want to re-create in Tyk Cloud.
+  
+* **Step 3 - Configure your first Cloud Data Plane:** Select the region you want to locate your [Cloud Data Plane](#glossary) in from the drop-down list. Your Cloud Data Plane is not confined to the same region as your Organization and Control Plane but the amount of regions you have to choose from can be limited depending on your subscription plan. Give your Cloud Data Plane a name. 
+
+
+
+    <Note>
+    You need to have at least one Cloud Data Plane with a *Deployed* status connected to your Control Plane.
+    </Note>
+
+
+* **Step 4 - Deployment:**
+
+1. Click [Deploy Control Plane and Create a Cloud Data Plane](#glossary). You can watch your Control Plane being deployed and your Cloud Data Plane being created. You will then be taken to the Control Plane overview screen within the Tyk Cloud dashboard.
+2. From your Control Plane overview you will see the Cloud Data Plane is in a **Not Deployed** state. Click on your Cloud Data Plane to open its overview.
+3. In the top right of your Cloud Data Plane overview, click **Not Deployed** and choose **Deploy** from the drop-down.
+4. With your Cloud Data Plane successfully deployed, make a note of the tags assigned to your Cloud Data Plane. One tag is "edge" and the other is the location of your Cloud Data Plane. You'll add a tag when creating your API.
+
+Here's a video on how to set up your Tyk Cloud Environment.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/DxoLm0vgsP8" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+Next you'll [set up your first API](#deploy-and-add-your-first-api) from the Tyk Dashboard.
+
+#### Deploy and Add Your First API
+
+Your onboarding is now complete! The next step will be to setup a very basic API to demonstrate how APIs are managed within Tyk Cloud.
+
+
+<Warning>
+Warning
+
+In Tyk Gateway release 5.3.0, Tyk OAS APIs gained feature maturity. Tyk Dashboard will automatically migrate any pre-5.3.0 Tyk OAS APIs to the feature mature standard when you upgrade to 5.3.0 or later. Feature mature Tyk OAS APIs may not work with pre-5.3.0 versions of Tyk Gateway.
+
+It is not possible to rollback to previous versions of Tyk components with Tyk OAS APIs created in 5.3.0.
+
+For further details, please refer to the [release notes](/developer-support/release-notes/gateway#5-3-0-release-notes) for Tyk Gateway v5.3.0.
+</Warning>
+
+
+##### Steps to add an API in Tyk Cloud
+
+* **Step 1 - Access the Dashboard:** Go to the Control Plane overview and click the dashboard link in the Ingress list. You'll be redirected to the Tyk Dashboard for your [Control Plane](#glossary).
+* **Step 2 - Add a New API:** Click the APIs menu item and then click **Add New API**.
+* **Step 3 - Core Settings:**
+
+  1. Give Your API a name - We'll use "my app" for the rest of this Getting Started journey.
+  2. Scroll down to the **Target URL** setting and use the URL https://httpbin.org/
+  3. Then scroll down to the Authentication section and select **Open(Keyless)** to keep things simple for this demo.
+
+
+
+    <Warning>
+    Ensure you configure a valid API Listen path.  Root ("/") listen paths are **not** supported on Tyk Cloud deployments prior to version v3.2.0.
+    </Warning>
+
+
+* **Step 4 - Advanced Options:**
+
+  1. Click the **Advanced Options** tab of the API Designer.
+  2. Scroll to the **Segment Tags (Node Segmentation)** setting and add the cloud data plane tag (edge) you saw when creating the Cloud Data Plane.
+
+<img src="/img/cloud/edge_segment_tags.png" alt="Segment Tags" />
+
+
+<Note>
+**Note:**
+
+**How Segment Tags work in Tyk Cloud?**
+
+When a Cloud Data Plane is deployed, the tag 'edge' and a location tag are automatically generated for the Cloud Data Plane. You use these tags to connect your API to the appropriate Cloud Data Plane. It works as follows:
+
+1. Add the **edge** tag to your API to connect it to all Cloud Data Planes within the Control Plane.
+2. Add the location tag to your API to connect it to only Cloud Data Planes with that location within the Control Plane.
+</Note>
+
+
+
+<Warning>
+All APIs must be connected to a Cloud Data Plane by adding the appropriate tag in the *Segment Tags (Node Segmentation)* in the API Designer.
+</Warning>
+
+
+* **Step 5 - Save Your API:** Click **Save** from the API Designer. Your API will now be added to the APIs list and as the next step you'll access your API from the Gateway Ingress.
+
+Watch our video on Adding an API to your Tyk Cloud Dashboard.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/OtQMNKwfXwo" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+Want to learn more from one of our team?
+
+<ButtonLeft href="https://tyk.io/book-a-demo/" color="green" content="Book a demo" />
+
+
+#### Test Your API
+
+Your first API has been added. What's next? Testing it! This page shows how you can test an API that you have added to Tyk Cloud, to ensure that it’s functioning correctly. You'll now access the API you setup in [Task 5](#deploy-and-add-your-first-api) from the Cloud Data Plane within Tyk Cloud.
+
+##### Steps to test your API
+
+* **Step 1 - Access the Gateway Ingress:** From the Cloud Data Plane overview, copy the Ingress link and open it in a browser tab. You will get a 404 error.
+  
+* **Step 2 - Append the URL with your API:** You created a API named **my app** in [Task 5](#deploy-and-add-your-first-api). Add `/my-app/` to the end of the URL. You should be taken to [https://httpbin.org/](https://httpbin.org/), which you added as the **Target URL** for the API in [Task 5](#steps-to-add-an-api-in-tyk-cloud). 
+
+
+Next you'll [view the analytics](#view-analytics) for your API in the Dashboard.
+
+#### View Analytics
+
+We have now created and tested our API. How do we know that they are performing well? This page walks you through how to then view your API analytics so that you can ensure your APIs are performing perfectly. 
+
+##### Steps to check your API analytics
+
+* **Step 1 - Access the Dashboard:** You'll now look at the analytics for the API you created in [Task 5](#deploy-and-add-your-first-api).If you're not still in the Tyk Dashboard for your Control Plane, click the dashboard link in the Control Plane Ingress list. Click the Gateway Dashboard menu item and you can see the successful calls made to your API from the Cloud Data Plane you created.
+  
+* **Step 2 - Create an Error:** From the Cloud Data Plane, make a call that will throw an error. For example, use `me-app` instead of `my-app`. You should see the error displayed in the Analytics.
+
+
+#### Review Your Setup
+
+This summary page explains the steps required to implement Tyk Cloud, which enables you to manage your APIs seamlessly. 
+
+We've covered the following to get you started with the Tyk Cloud way of managing Tyk deployments:
+
+* We've created a new Organization
+* We've added a Team
+* We've added an Environment, including a Control Plane and an associated Cloud Data Plane and deployed them
+* We've added a very simple API to the Control Plane Dashboard and tested it via the first Cloud Data Plane
+* We've seen the data from the Gateways displayed in the Analytics section of the Control Plane Dashboard
+
+We have actually only scratched the surface of what is possible with Tyk Cloud.
+
+What to go through next:
+
+* Managing your Deployments
+* Adding [Plugins and Middleware](/tyk-cloud/using-plugins) to your Control Plane
+
+
+## Glossary
+
+**Account**
+
+The highest level container for one or more Organizations.
+
+**Organization**
+
+The main entity for all your data (Environments, APIs, Users, etc). An Organization is connected to a single region and once connected, cannot be changed.
+
+**Team** 
+
+A sub-grouping within an Organization.
+
+**User**
+
+A person who is a member of a Team with a set of permissions.
+
+**Role**
+
+A set of data and access permissions that can be applied to a user or team of users. See [User Roles](#user-roles-in-tyk-cloud) for more details.
+
+**Profile**
+
+The place that holds personal information for a user.
+
+**Subscription**
+
+A set of allowances assigned to an Organization (made up of plan+addons+settings).
+
+**Plan**
+
+A portion of allowances (without add-ons) that feed into the main subscription.
+
+**Operations**
+
+The place to manage all deployments for an Organization or Team. 
+
+**Environment**
+
+A grouping of 'deployments' that can have multiple Control Planes and Cloud Data Planes.
+
+**Stack**
+
+The high level name for the set of configurations making up different types of deployments.
+
+**Control Plane**
+
+A deployment type: A single management layer for data in one region (where all the data lives).
+
+**Cloud Data Plane**
+
+A deployment type: Additional workers with varying functionality that are linked to the main control plane and can be deployed in a different region from the Control Plane.
+
+**Instance**
+
+Used to control traffic and scale in a Tyk Gateway.
+
+**Dashboard**
+
+The Tyk Analytics Dashboard to manage APIs and services.
+
+**Retirement**
+
+Where an Organization has expired due to either a subscription failure or cancelation and is now within a "retirement" period of 30 days, during which an [Billing Admin](/tyk-cloud/teams-users#assign-user-roles) can reinstate full functionality by updating or creating a new subscription.
+
+**Deploy**
+
+Deploy a not yet deployed state (a first time deployment).
+
+**Undeploy**
+
+Temporarily remove a deployed status but keep all data and configuration.
+
+**Redeploy**
+
+Redeploy from a deployed state. Used for troubleshooting.
+
+**Destroy**
+
+Permenantly remove a deployment and all associated data and configurations.
+
+**Create**
+
+Date and time of time a deployment was initially created.
+
+**Add**
+
+Add a new 'user' or 'team' etc.
+
+**Remove**
+
+Remove things that have been added e.g. users and teams.
+
+**Update**
+
+Saving a change to a configuration.
+
+**Edit**
+
+Changing configuration or information on any of the deployments or other resources such as users or teams.
+
+**Deployed**
+
+A deployment that is currently deployed.
+
+**Undeployed**
+
+A deployment that was deployed but has been undeployed.
+
+**Not Deployed**
+
+A deployment that has never been deployed.
+
+**Destroyed**
+
+A deployment that has been permenantly deleted and will not be visible in the operations console.
+
+**Unsuccessful**
+
+When there has been an error in the deployment process.
+
+**Deploying**
+
+When a deployment is being deployed.
+
+**Undeploying**
+
+When a deployment is being undeployed.
+
+See [User Roles](#user-roles-in-tyk-cloud) for more details
+
+**Super Administrator**
+
+Can do everything across all organizations
+
+**Organization Admin**
+
+Can do everything within the scope of the one organization they have access to.
+
+**Team Admin**
+
+Can do everything within the scope of the one team they have access to.
+
+**Team Member**
+
+Can only view and manage the overview, environments and deployments.
\ No newline at end of file
diff --git a/tyk-cloud/account-billing.mdx b/tyk-cloud/account-billing.mdx
new file mode 100644
index 0000000000..47c480e3fb
--- /dev/null
+++ b/tyk-cloud/account-billing.mdx
@@ -0,0 +1,153 @@
+---
+title: "Manage Accounts and Billing in Tyk Cloud"
+description: "Learn how to manage your Tyk Cloud account, including payment plans, billing methods, and account retirement."
+keywords: "Accounts, Billing, Tyk Cloud, Control Plane"
+sidebarTitle: "Accounts and Billing"
+---
+
+## Introduction
+
+This section covers the following:
+
+* The available [Tyk Cloud Plans](/tyk-cloud/account-billing#select-a-payment-plan)
+* Adding [Payment Methods](#add-payment-methods)
+* How to [upgrade from the free trial plan](#upgrade-your-free-trial)
+* [Managing Billing Admins](#managing-billing-admin) on your account
+* What to do if your account goes into [retirement](#retire-your-account)
+
+## Select a Payment Plan
+
+Our plans cover every use case scenario, from a free trial, to a global enterprise ready plan. You can also purchase addons to increase your functionality. For details on our available plans and pricing go to [Tyk Cloud Pricing](https://tyk.io/price-comparison/).
+
+### Changing plans
+
+You can upgrade or downgrade your current plan at any point in your billing cycle and your payment will be pro-rata'd to reflect the new payment.
+
+### Downgrading plan requirements
+
+If you downgrade your plan, the new plan may have less entitlements than your current plan. You will need to restructure your organization to comply with the new plan entitlements before the downgraded billing starts.
+
+## Add Payment Methods
+
+This section provides a step-by-step guide on how to add a payment method to your Tyk Cloud account, ensuring uninterrupted access to your API management services.
+
+**Adding a payment method to your account**
+
+**Note:** You must have *Billing Admin* user rights to add a payment method. 
+
+Follow these steps:
+
+1. Ensure you are logged in to *Tyk Cloud UI* as a Billing Admin user.
+2. Navigate to <a href="https://account.cloud-ara.tyk.io/payment-method" className="external-links" target="_blank" rel="noopener">ACCOUNT & BILLING --> Payment Method</a>. If you lack the necessary user rights, you will be directed to the main [OPERATIONS](https://dashboard.cloud-ara.tyk.io/) screen (the main login page).
+3. Enter your card details and click *Save*.
+4. You'll see a confirmation that the payment method was successfully added.
+
+
+
+    <Note>
+    **Note about card payments**
+
+    Currently, *Tyk Cloud* exclusively supports card payments. For alternative payment methods, please [contact us](https://tyk.io/contact/).
+    </Note>
+
+
+**Payment Method Maintenance**
+
+As a *Billing Admin* user, you have the ability to edit or delete an existing payment method. Deleting a payment method without adding a new one will result in your plan going into [retirement](#retire-your-account) at the end of your current billing cycle.
+
+## Upgrade Your Free Trial
+
+This section explains how you can upgrade your free trial of Tyk Cloud to a full account, to continue enjoying the benefits of Tyk Cloud.
+
+**My free trial is coming to an end. What are my options?**
+
+Every new Tyk Cloud account is assigned to a 48 hour free trial. You have the following options:
+
+* Upgrade to a paid plan at any stage of the free trial period.
+* Use the free trial period and upgrade after it expires
+
+**What happens if my free trial expires?**
+
+If your free trial ends without you upgrading, your account enters what we call [retirement](/tyk-cloud#glossary).
+
+**What does upgrading a free trial account involve?**
+
+To upgrade your free trial, you (as a Billing Admin) need to:
+* Add a [payment method](#add-payment-methods) to your organization
+* Select a new [plan](/tyk-cloud/account-billing#select-a-payment-plan) from our list
+
+**I've trialled more than what my desired paid plan allows.**
+
+During the free trial we give you the same access as our Enterprise Global plan. When you come to the end of your free trial, you may want to subscribe to a plan such as 'Proof of Concept' which only allows 1 Environment, Cloud Control Plane and Cloud Data Plane. If you had an excess of these set up during your free trial, you would need to remove the appropriate amount of Environments etc from your Organization in order to start the paid plan. But don't worry, we'll let you know what you need to remove when you go to purchase a plan. 
+
+
+## Managing Billing Admin
+
+This page explains what a Tyk Cloud billing admin can do as part of your API management process, giving you complete control over your API management.
+
+As a Billing Admin you can perform the following:
+
+* Add, edit and delete [payment methods](#add-payment-methods)
+* Add further users as Billing Admins
+* Upgrade or downgrade plans
+
+### Adding a new Billing Admin
+
+
+<Note>
+To be added as a Billing Admin, a user cannot have an existing Tyk Cloud account.
+</Note>
+
+
+**Prerequisites**
+
+To add a new Billing Admin team member requires you to have one of the following roles:
+
+* Be an existing Billing Admin
+* Be the account creator Organization Admin (this user also has the Billing Admin role assigned to them)
+
+1. Select **Account & Billing** from the Admin menu (if you only have Billing Admin permissions you will automatically be logged into the Account and Billing area).
+
+<img src="/img/admin/tyk-cloud-account-billing-menu.png" alt="Account & Billing menu" />
+
+2. Select **Billing Admins** from the Accounts & Billing menu
+
+<img src="/img/admin/billing-admins.png" alt="Billing Admins menu" />
+
+3. Click **Invite Billing Admin**
+
+<img src="/img/admin/invite-billing-admin.png" alt="Invite Billing Admin" />
+
+4. Complete the Billing Admin form and click **Send Invite**
+
+### Removing Billing Admin Access
+
+For this release, removing a billing Admin is not allowed. We can remove a Billing Admin manually, so contact your Account Manager if you need to remove a Billing Admin user.
+
+## Retire Your Account
+
+This section explains what it means when your Tyk Cloud account goes into retirement and what your options are when it does, from account reinstatement to closure.
+
+Your plan will go into [retirement](/tyk-cloud#glossary) in the following scenarios:
+
+* Your subscription is manually canceled by a Billing Admin.
+* Your periodic subscription payment fails.
+* You are on a Free Trial (5 weeks) and have not signed up to a plan before the expiration of the Free Trial.
+
+**What does retirement mean?**
+
+When a plan goes into retirement, it means your Organization, Teams and any Environmenmts and APIs you manage are suspended for a grace period of up to 30 days and you won't be able to add or edit, only remove.
+
+**How can I end retirement?**
+
+Your Billing Admin needs to do one of the following:
+
+* Renew a subscription that was manually canceled.
+* Update your payment details and any outstanding payments are cleared.
+* Update a Free Trial to a paid plan, and payment is successful.
+
+**What happens at the end of the 30 day retirement period?**
+
+At the end of the 30 day retirement period if you have not restored or created a relevant subscription, all your data will be deleted.
+
+
diff --git a/tyk-cloud/environments-deployments/hybrid-gateways.mdx b/tyk-cloud/environments-deployments/hybrid-gateways.mdx
new file mode 100644
index 0000000000..bb2dae6ac1
--- /dev/null
+++ b/tyk-cloud/environments-deployments/hybrid-gateways.mdx
@@ -0,0 +1,404 @@
+---
+title: "Deploy Hybrid Gateways with Tyk Cloud"
+description: "Learn how to deploy and manage hybrid gateways in Tyk Cloud, connecting your self-managed data planes to the Tyk Cloud control plane."
+keywords: "Hybrid Gateways, Tyk Cloud, Control Plane, Deployment"
+sidebarTitle: "Hybrid Gateways"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+## Introduction
+
+[Tyk Cloud](https://tyk.io/cloud/) hosts and manages the control planes for you. You can deploy the data planes across multiple locations:
+
+- as [Cloud Gateways](/tyk-cloud/environments-deployments/managing-gateways): Deployed and managed in *Tyk Cloud*, in any of our available regions. These are SaaS gateways, so there are no deployment or operational concerns.
+- as Hybrid Gateways: This is a self-managed data plane, deployed in your infrastructure and managed by yourself. Your infrastructure can be a public or private cloud, or even your own data center.
+
+This page describes the deployment of hybrid data planes and how to connect them to Tyk Cloud, in both Kubernetes and Docker environments.
+
+## Prerequisites
+
+* Tyk Cloud Account, register here if you don't have one yet: <ButtonLeft href="https://tyk.io/sign-up/#cloud" color="green" content="free trial" />
+* A Redis instance for each data plane, used as ephemeral storage for distributed rate limiting, token storage and analytics. You will find instructions for a simple Redis installation in the steps below.
+* No incoming firewall rules are needed, as the connection between Tyk Hybrid Gateways and Tyk Cloud is always initiated from the Gateways, not from Tyk Cloud.
+
+## Tyk Hybrid Gateway configuration
+
+The hybrid gateways in the data plane connect to the control plane in Tyk Cloud using the *Tyk Dashboard* API Access Credentials. Follow the guides below to create the configuration that we will be used in later sections to create a deployment:
+
+Login to your Tyk Cloud account deployments section and click on `ADD HYBRID DATA PLANE`
+
+  <img src="/img/hybrid-gateway/tyk-cloud-hybrid-configuration-home.png" alt="Tyk Cloud hybrid configuration home" />
+
+Fill in the details and then click _SAVE DATA PLANE CONFIG_
+
+  <img src="/img/hybrid-gateway/tyk-cloud-save-hybrid-configuration.png" alt="Save Tyk Cloud hybrid configuration home" />
+
+This will open up a page with the data plane configuration details that we need.
+
+  <img src="/img/hybrid-gateway/tyk-cloud-hybrid-masked-details.png" alt="Save Tyk Cloud hybrid configuration masked details" />
+
+Those details are:
+|                                      | Docker            | Helm                   |
+| :-------------------------------------- | :------------------- | :------------------------ |
+| key                                  | api_key           | gateway.rpc.apiKey     |
+| org_id                               | rpc_key           | gateway.rpc.rpcKey     |
+| data_planes_connection_string (mdcb) | connection_string | gateway.rpc.connString |
+
+You can also click on _OPEN DETAILS_
+
+  <img src="/img/hybrid-gateway/tyk-cloud-hybrid-open-details.png" alt="Tyk Cloud hybrid open for details" />
+
+This will reveal instructions that you can use to connect your hybrid data plane to Tyk Cloud.
+
+<img src="/img/hybrid-gateway/tyk-cloud-hybrid-revealed-instructions.png" alt="Tyk Cloud hybrid detailed instructions" />
+
+
+## Deploy with Docker
+
+### Step 1: Clone and configure
+
+1. Clone the [tyk-install](https://github.com/TykTechnologies/tyk-install) repository and navigate to the hybrid directory:
+
+    ```bash
+    git clone https://github.com/TykTechnologies/tyk-install.git
+    cd tyk-install/docker/hybrid
+    ```
+
+### Step 2: Configure the Gateway connection to the control plane
+
+Edit `confs/tyk.env` and set your MDCB credentials:
+
+```bash
+TYK_GW_SLAVEOPTIONS_CONNECTIONSTRING=your-mdcb.cloud-ara.tyk.io:443
+TYK_GW_SLAVEOPTIONS_RPCKEY=your-org-id
+TYK_GW_SLAVEOPTIONS_APIKEY=your-dashboard-api-key
+TYK_GW_SLAVEOPTIONS_GROUPID=your-group-id
+```
+
+| Variable | Description |
+| -------- | ----------- |
+| `TYK_GW_SLAVEOPTIONS_CONNECTIONSTRING` | MDCB endpoint from the control plane |
+| `TYK_GW_SLAVEOPTIONS_RPCKEY` | Organization ID |
+| `TYK_GW_SLAVEOPTIONS_APIKEY` | Dashboard User API Key |
+| `TYK_GW_SLAVEOPTIONS_GROUPID` | Data plane cluster identifier (used when running multiple data planes) |
+
+To enable API sharding (optional), add to `confs/tyk.env`:
+
+```bash
+TYK_GW_DBAPPCONFOPTIONS_NODEISSEGMENTED=true
+TYK_GW_DBAPPCONFOPTIONS_TAGS=qa,uat
+```
+
+### Step 3: Configure the Pump connection to the control plane
+
+Edit `confs/pump.env` with the same MDCB credentials:
+
+```bash
+TYK_PMP_PUMPS_HYBRID_META_CONNECTIONSTRING=your-mdcb.cloud-ara.tyk.io:443
+TYK_PMP_PUMPS_HYBRID_META_APIKEY=your-dashboard-api-key
+```
+
+### Step 4: Start services
+
+```bash
+docker compose up -d
+```
+
+Wait for all health checks to pass (~30 seconds), then verify the containers are running:
+
+```bash
+docker compose ps
+```
+
+Expected containers:
+
+| Container | Port | Status |
+| --------- | ---- | ------ |
+| `tyk-gateway` | 8080 | Running |
+| `tyk-pump` | N/A | Running |
+| `tyk-redis` | 6379 | Running |
+
+### Step 5: Verify the connection
+
+```bash
+curl http://localhost:8080/hello
+```
+
+Expected response:
+
+```json
+{"status":"pass","version":"5.x.x","description":"Tyk GW"}
+```
+
+Then verify in your control plane:
+
+Navigate to **Deployments** > your Control Plane. Your hybrid data plane should appear under **Hybrid data planes**.
+
+  <img src="/img/cloud/hybrid-data-plane-added.png" alt="Hybrid Data Plane Added" />
+
+## Deploy in Kubernetes with Helm Chart
+
+**Prerequisites**
+
+* [Kubernetes 1.19+](https://kubernetes.io/docs/setup/)
+* [Helm 3+](https://helm.sh/docs/intro/install/)
+* Connection details to remote control plane from the above [section](/tyk-cloud/environments-deployments/hybrid-gateways).
+
+The following quick start guide explains how to use the [Tyk Data Plane Helm chart](/product-stack/tyk-charts/tyk-data-plane-chart) to configure Tyk Gateway that includes:
+- Redis for key storage
+- Tyk Pump to send analytics to Tyk Cloud and Prometheus
+
+At the end of this quickstart Tyk Gateway should be accessible through service `gateway-svc-hybrid-dp-tyk-gateway` at port `8080`. Pump is also configured with Hybrid Pump which sends aggregated analytics to Tyk Cloud, and Prometheus Pump which expose metrics locally at `:9090/metrics`.
+
+**1. Set connection details**
+
+Set the below environment variables and replace values with connection details to your Tyk Cloud remote control plane. See the above [section](/tyk-cloud/environments-deployments/hybrid-gateways) on how to get the connection details.
+
+```bash
+MDCB_UserKey=9d20907430e440655f15b851e4112345
+MDCB_OrgId=64cadf60173be90001712345
+MDCB_ConnString=mere-xxxxxxx-hyb.aws-euw2.cloud-ara.tyk.io:443
+MDCB_GroupId=your-group-id
+```
+
+**2. Then use Helm to install Redis and Tyk**
+
+```bash
+NAMESPACE=tyk
+APISecret=foo
+REDIS_BITNAMI_CHART_VERSION=19.0.2
+
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --create-namespace --install --version $REDIS_BITNAMI_CHART_VERSION --set image.repository=bitnamilegacy/redis
+
+helm upgrade hybrid-dp tyk-helm/tyk-data-plane -n $NAMESPACE --create-namespace \
+  --install \
+  --set global.remoteControlPlane.userApiKey=$MDCB_UserKey \
+  --set global.remoteControlPlane.orgId=$MDCB_OrgId \
+  --set global.remoteControlPlane.connectionString=$MDCB_ConnString \
+  --set global.remoteControlPlane.groupID=$MDCB_GroupId \
+  --set global.secrets.APISecret="$APISecret" \
+  --set global.redis.addrs="{tyk-redis-master.$NAMESPACE.svc.cluster.local:6379}" \
+  --set global.redis.passSecret.name=tyk-redis \
+  --set global.redis.passSecret.keyName=redis-password
+```
+
+**3. Done!**
+
+Now Tyk Gateway should be accessible through service `gateway-svc-hybrid-dp-tyk-gateway` at port `8080`. Pump is also configured with Hybrid Pump which sends aggregated analytics to Tyk Cloud, and Prometheus Pump which expose metrics locally at `:9090/metrics`.
+
+For the complete installation guide and configuration options, please see [Tyk Data Plane Chart](/product-stack/tyk-charts/tyk-data-plane-chart).
+
+
+## Remove hybrid data plane configuration
+
+
+<Warning>
+Please note the action of removing a hybrid data plane configuration cannot be undone.
+
+To remove the hybrid data plane configuration, navigate to the page of the hybrid data plane you want to remove and click _OPEN DETAILS_
+</Warning>
+
+
+
+  <img src="/img/hybrid-gateway/tyk-cloud-hybrid-open-details.png" alt="Tyk Cloud hybrid open for details" />
+
+Then click on _REMOVE DATA PLANE CONFIGS_
+
+  <img src="/img/hybrid-gateway/tyk-cloud-hybrid-remove-configs.png" alt="Tyk Cloud hybrid remove configs" />
+
+Confirm the removal by clicking _DELETE HYBRID DATA PLANE_
+
+  <img src="/img/hybrid-gateway/tyk-cloud-hybrid-confirm-config-removal.png" alt="Tyk Cloud hybrid confirm removal of configs" />
+
+## Tyk Cloud MDCB Supported versions
+
+This section lists the supported MDCB version for hybrid setup
+
+| Dashboard | Gateway | MDCB   |
+| :--------- | :------- | :------ |
+| v5.2.0    | v5.2.0  | v2.4.0 |
+| v5.1.2    | v5.1.2  | v2.3.0 |
+| v5.1.1    | v5.1.1  | v2.3.0 |
+| v5.1.0    | v5.1.0  | v2.3.0 |
+| v5.0.5    | v5.0.5  | v2.2.0 |
+| v5.0.4    | v5.0.4  | v2.2.0 |
+| v5.0.3    | v5.0.3  | v2.2.0 |
+| v5.0.2    | v5.0.2  | v2.2.0 |
+| v5.0.1    | v5.0.1  | v2.1.1 |
+| v5.0.0    | v5.0.0  | v2.1.1 |
+| v4.3.3    | v4.3.3  | v2.1.0 |
+| v4.3.2    | v4.3.2  | v2.0.4 |
+| v4.3.1    | v4.3.1  | v2.0.4 |
+| v4.3.0    | v4.3.0  | v2.0.4 |
+| v4.2.4    | v4.2.4  | v2.0.3 |
+| v4.2.3    | v4.2.3  | v2.0.3 |
+| v4.0.10    | v4.0.10  | v2.0.4 |
+| v4.0.9    | v4.0.9  | v2.0.3 |
+| v4.0.8    | v4.0.8  | v2.0.3 |
+| v3.2.3    | v3.2.3  | v1.8.1 |
+| v3.0.9    | v3.0.9  | v1.7.11 |
+
+
+## Deploy Legacy Hybrid Gateways
+
+
+<Warning>
+`tyk-hybrid` chart is deprecated. Please use our [Tyk Data Plane helm chart](/product-stack/tyk-charts/tyk-data-plane-chart) instead. 
+
+We recommend that all users to migrate to the `tyk-data-plane` Chart. Please review the [Configuration](/product-stack/tyk-charts/tyk-data-plane-chart#configuration) section of the new helm chart and cross-check with your existing configurations while planning for migration.
+</Warning>
+
+
+1. **Add the Tyk official Helm repo `tyk-helm` to your local Helm repository**
+
+```bash
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+```
+
+The helm charts are also available on [ArtifactHub](https://artifacthub.io/packages/helm/tyk-helm/tyk-hybrid).
+
+2. **Then create a new namespace that will be hosting the Tyk Gateways**
+
+```bash
+kubectl create namespace tyk
+```
+
+3. **Get the default values.yaml for configuration**
+
+Before proceeding with installation of the chart we need to set some custom values. First save the full original values.yaml to a local copy:
+
+```bash
+helm show values tyk-helm/tyk-hybrid > values.yaml
+```
+
+4. **Configure Tyk Gateway and its connection to Tyk Cloud**
+
+You need to modify the following values in your custom `values.yaml` file:
+
+* `gateway.rpc.apiKey` - Tyk Dashboard API Access Credentials of the user created earlier
+* `gateway.rpc.rpcKey` - Organization ID
+* `gateway.rpc.connString` - MDCB connection string
+* `gateway.rpc.group_id`*(optional)*  - if you have multiple data plane (e.g. in different regions), specify the data plane group (string) to which the gateway you are deploying belong. The data planes in the same group share one Redis instance.
+* `gateway.sharding.enabled` and `gateway.sharding.tags`*(optional)*  - you can enable sharding to selectively load APIs to specific gateways, using tags. By default, sharding is disabled and the gateway will load all APIs.
+
+5. **Configure the connection to Redis**
+
+You can connect the gateway to any Redis instance already deployed (as DBaaS or hosted in your private infrastructure).
+
+In case you don't have a Redis instance yet, here's how to deploy Redis in Kubernetes using Bitnami Helm charts.
+
+```bash
+helm install tyk-redis bitnami/redis -n tyk --version 19.0.2 --set image.repository=bitnamilegacy/redis
+```
+
+
+<Note>
+Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#redis).
+</Note>
+
+
+Follow the notes from the installation output to get connection details and password.
+
+```bash
+  Redis(TM) can be accessed on the following DNS names from within your cluster:
+
+    tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
+    tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)
+
+  export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)
+```
+
+You need to modify the following values in your custom `values.yaml` file:
+
+* `redis.addrs`: the name of the Redis instance including the port as set by Bitnami `tyk-redis-master.tyk.svc.cluster.local:6379`
+* `redis.pass`: password set in redis (`$REDIS_PASSWORD`). Alternatively, you can use --set flag to set it during helm installation. For example `--set redis.pass=$REDIS_PASSWORD`.
+
+
+6. **Install Hybrid data plane**
+
+Install the chart using the configured custom values file:
+
+```bash
+helm install tyk-hybrid tyk-helm/tyk-hybrid -f values.yaml -n tyk
+```
+
+You should see the prompt:
+
+```bash
+At this point, Tyk Hybrid is fully installed and should be accessible.
+```
+
+
+7. **Check that the installation was successful**
+
+The hybrid data planes are not yet visible in Tyk Cloud (coming soon!). Here is how you can check that the deployment was successful.
+
+Run this command in your terminal to check that all pods in the `tyk` namespace are running:
+
+```bash
+kubectl get pods -n tyk
+````
+
+**Expected result:**
+
+```bash
+NAME                                  READY   STATUS    RESTARTS   AGE
+gateway-tyk-hybrid-54b6c498f6-2xjvx   1/1     Running   0          4m27s
+tyk-redis-master-0                    1/1     Running   0          47m
+tyk-redis-replicas-0                  1/1     Running   0          47m
+tyk-redis-replicas-1                  1/1     Running   0          46m
+tyk-redis-replicas-2                  1/1     Running   0          46m
+```
+
+Note: if you are using a Redis instance hosted somewhere else, then no Redis pods will appear here.
+
+Run this command in your terminal to check that the services were correctly created:
+
+```bash
+kubectl get service -n tyk
+````
+
+**Expected result:**
+
+```bash
+NAME                     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
+gateway-svc-tyk-hybrid   NodePort    10.96.232.123    <none>        443:32668/TCP   44m
+tyk-redis-headless       ClusterIP   None             <none>        6379/TCP        47m
+tyk-redis-master         ClusterIP   10.109.203.244   <none>        6379/TCP        47m
+tyk-redis-replicas       ClusterIP   10.98.206.202    <none>        6379/TCP        47m
+```
+
+Note: IP adresses might differ on your system.
+
+
+Finally, from your terminal, send an HTTP call to the /hello endpoint of the gateway `gateway-svc-tyk-hybrid`:
+
+Note: you may need to port forward if you're testing on a local machine, e.g. `kubectl port-forward service/gateway-svc-tyk-hybrid -n tyk 8080:443`
+
+```bash
+curl http://hostname:8080/hello -i
+```
+
+**Expected result:**
+
+```bash
+HTTP/1.1 200 OK
+Content-Type: application/json
+Date: Fri, 17 Mar 2023 10:35:35 GMT
+Content-Length: 234
+
+{
+  "status":"pass",
+  "version":"4.3.3",
+  "description":"Tyk GW",
+  "details":{
+    "redis": {"status":"pass","componentType":"datastore","time":"2023-03-15T11:39:10Z"},
+    "rpc": {"status":"pass","componentType":"system","time":"2023-03-15T11:39:10Z"}}
+}
+```
+
diff --git a/tyk-cloud/environments-deployments/managing-control-planes.mdx b/tyk-cloud/environments-deployments/managing-control-planes.mdx
new file mode 100644
index 0000000000..bbe08f207c
--- /dev/null
+++ b/tyk-cloud/environments-deployments/managing-control-planes.mdx
@@ -0,0 +1,126 @@
+---
+title: "Managing Control Planes in Tyk Cloud"
+description: "Learn how to manage Control Planes in Tyk Cloud"
+keywords: "Control Planes, Tyk Cloud, Control Plane, Cloud Data Plane, Auto Upgrade"
+sidebarTitle: "Control Plane"
+---
+
+## Introduction
+
+Control Planes are situated in your Organization's home region and provide links to an instance of the [Tyk Dashboard](/api-management/dashboard-configuration) and the [Developer Portal](/portal/overview/intro). The Dashboard is where you perform all your API tasks. The developer portal allows your 3rd party developers access to your APIs. Cloud Data Planes are then connected to your Control Planes.
+
+## Prerequisites
+
+All [user roles](/tyk-cloud/teams-users#assign-user-roles) can edit, deploy, undeploy, restart, redeploy all deployments within a team. Only the Organization Admin and the Team Admin can create or delete deployments.
+
+## Adding a new Control Plane
+
+Watch our video on setting up a Control Plane and a Cloud Data Plane.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/JqXXEDplrr8" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+
+<Note>
+The number of Control Planes you can add is dependent on your [plan](/tyk-cloud/account-billing#select-a-payment-plan)
+</Note>
+
+
+1. From the Deployments screen click **Add Deployment** (you can also add a Deployment from within an Environment overview)
+2. Enter a name for the new Control Plane
+3. Select Control Plane from the Type drop-down list
+4. Select the Bundle Channel and Version
+5. (Optional) Enter a [custom domain](/tyk-cloud/using-custom-domains) if required
+6. (Optional) Enable [plugins](/tyk-cloud/using-plugins) if required
+
+## Edit Control Planes
+
+You can edit the following Control Plane settings:
+* Change the Control Plane name
+* Add a [custom domain](/tyk-cloud/using-custom-domains)
+* Change the Bundle Channel and Bundle Version
+* Enable [plugins](/tyk-cloud/using-plugins)
+
+
+
+    <Note>
+    The use of custom domains is dependent on your [plan](/tyk-cloud/account-billing#select-a-payment-plan)
+    </Note>
+
+
+To edit an existing Control Plane:
+
+1. From the Deployments screen, click the **Control Plane Name** from the list
+2. Select **Edit** from the Deployed drop-down list
+
+<img src="/img/admin/cp-edit.png" alt="Edit drop-down" />
+
+## Upgrade Cloud Control Planes
+
+There are two ways to upgrade a Control Plane.
+
+### Manual Upgrade
+
+To upgrade an existing Control Plane:
+
+1. Go to the **Control Plane settings** using the _Edit Control Planes_ instructions and scroll down to the **Version** section.
+2. Select a **Bundle Channel**.
+
+<img src="/img/admin/cp-edge-upgrade-channel.png" alt="Bundle channel drop-down" />
+
+3. Next, select a **Bundle Version**.
+
+<img src="/img/admin/cp-edge-upgrade-version.png" alt="Bundle version drop-down" />
+
+4. To apply your changes, click the **"Save and Re-Deploy"** button located at the top right. After a few seconds, you will be redirected to the overview page of the Control Plane and a **"Deploying"** indicator button will appear. 
+
+<img src="/img/admin/cp-edge-upgrade-deploying.png" alt="Deploying notification" />
+
+5. A **"Deployed"** button indicates a successful upgrade.
+
+<img src="/img/admin/cp-edge-upgrade-deployed.png" alt="Deployed notification" />
+
+### Auto Upgrade
+
+The Auto Upgrade feature enables users to automatically upgrade their deployments to the latest version based on their selected bundle channel (E.g., Latest, LTS) without requiring manual intervention. This feature helps users stay on the latest features and security enhancements by automating the upgrade process according to a scheduled maintenance window.
+
+#### Availability
+
+Auto Upgrade is available for:
+- Control Plane deployments
+- When enabled on a Control Plane, it will automatically upgrade the corresponding data planes related to this control plane
+
+#### How to Enable Auto Upgrade
+
+You can enable Auto Upgrade when creating a new Control Plane or editing an existing Control Plane.
+
+#### New Control Plane Deployments
+
+1. Navigate to the "Add Deployment" page
+2. Fill in the required deployment details
+3. In the "Version" section, select your preferred Bundle Channel (Latest or LTS)
+4. Select the desired Bundle Version
+4. Toggle on the "Auto-upgrade" option
+5. Schedule the maintenance window by selecting:
+   - **Day**: Choose a day of the week (Monday-Sunday)
+   - **Time**: Select an hour (0-23, in UTC timezone)
+
+    <img src="/img/cloud/tyk-cloud-auto-upgrade.png" alt="Tyk Cloud Control Plane Auto Upgrade" />
+
+6. Complete the deployment creation process
+
+#### Existing Control Plane Deployments
+
+1. Navigate to the deployment dashboard
+2. Click "Edit" in the top-right corner
+3. In the "Version" section, toggle on "Auto-upgrade"
+4. Schedule the maintenance window by selecting the day and time
+5. Click "Save and re-deploy"
+
+#### Limitations and Considerations
+
+- **Control Plane Only**: Auto Upgrade can only be enabled on Control Plane deployments
+- **Plugin Compatibility**: Auto Upgrade cannot be enabled when plugins are enabled
+- **Production Caution**: Not recommended for production environments without prior testing in lower environments
+- **UTC Timezone**: All scheduled times are in UTC
+- **Bundle Channel**: Upgrades will always follow the selected bundle channel (Latest or LTS)
+- **Email Notifications**: Organization and team admins will receive email notifications when auto-upgrades occur
diff --git a/tyk-cloud/environments-deployments/managing-environments.mdx b/tyk-cloud/environments-deployments/managing-environments.mdx
new file mode 100644
index 0000000000..be6e72926e
--- /dev/null
+++ b/tyk-cloud/environments-deployments/managing-environments.mdx
@@ -0,0 +1,58 @@
+---
+title: "Managing Environments in Tyk Cloud"
+description: "Learn how to manage Environments in Tyk Cloud"
+keywords: "Environments, Tyk Cloud, Control Plane, Cloud Data Plane"
+sidebarTitle: "Environments"
+---
+
+## Introduction
+
+Environments are used to group your [Control Plane](/tyk-cloud#glossary) and [Cloud Data Planes](/tyk-cloud#glossary) into logical groups. For example you may want to create environments that reflect different departments of your organization.
+
+
+<Note>
+The number of Environments you can create is determined by your [plan](/tyk-cloud/account-billing#select-a-payment-plan)
+</Note>
+
+
+## Prerequisites
+
+The following [user roles](/tyk-cloud/teams-users#assign-user-roles) can perform Environment Admin tasks:
+
+- Org Admin
+- Team Admin
+
+You should also have created a team to assign to any new environment.
+
+## Adding a New Environment
+
+1. From the Environments screen, click **Add Environment**
+2. Select the team you want to assign to the Environment
+3. Give your new Environment a name
+4. Click **Create**
+
+## Editing an Existing Environment
+
+An Org Admin can perform the following:
+
+- Rename an Environment
+- Delete an Environment
+
+1. Click the environment Name from your list
+
+<img src="/img/admin/tyk-cloud-edit-env.png" alt="Edit Environment Name" />
+
+2. Click Edit
+
+<img src="/img/admin/tyk-cloud-env-screen.png" alt="Env Edit Screen" />
+
+3. You can now rename the environment, or delete it from your organization
+
+<img src="/img/admin/tyk-cloud-rename-delete.png" alt="Delete or Rename Env" />
+
+
+<Warning>
+Deleting an environment will also delete all the Control Planes and Cloud Data Planes associated with it
+</Warning>
+
+
diff --git a/tyk-cloud/environments-deployments/managing-gateways.mdx b/tyk-cloud/environments-deployments/managing-gateways.mdx
new file mode 100644
index 0000000000..75d0585a47
--- /dev/null
+++ b/tyk-cloud/environments-deployments/managing-gateways.mdx
@@ -0,0 +1,84 @@
+---
+title: "Managing Data Planes in Tyk Cloud"
+description: "Learn how to manage Data Planes in Tyk Cloud"
+keywords: "Data Planes, Tyk Cloud, Control Plane, Cloud Data Plane"
+sidebarTitle: "Data Plane"
+---
+
+## Introduction
+
+Cloud Data Planes do all the heavy lifting of actually managing your requests: traffic proxying, access control, data transformation, logging and more.
+
+## Prerequisites
+
+All [user roles](/tyk-cloud/teams-users#assign-user-roles) can edit, deploy, undeploy, restart, redeploy all deployments within a team. Only the Organization Admin and the Team Admin can create or delete deployments.
+
+## Adding a new Cloud Data Plane
+
+Watch our video on setting up a Control Plane and a Cloud Data Plane.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/JqXXEDplrr8" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+
+<Note>
+The number of Cloud Data Planes you can add is dependent on your [plan](/tyk-cloud/account-billing#select-a-payment-plan)
+</Note>
+
+
+1. From the Deployments screen click **Add Deployment**
+2. Enter a name for the new Gateway
+3. Select Cloud Data Plane from the Type drop-down list
+4. Select the Bundle Channel and Version
+5. (Optional) Enter a [custom domain](/tyk-cloud/using-custom-domains) if required
+6. (Optional) Enable [plugins](/tyk-cloud/using-plugins) if required
+
+## Edit Cloud Data Planes
+
+You can edit the following Control Plane settings:
+* Change the Gateway name
+* Add a [custom domain](/tyk-cloud/using-custom-domains)
+* Change the Bundle Channel and Bundle Version
+* Enable [plugins](/tyk-cloud/using-plugins)
+
+
+
+    <Note>
+    The use of custom domains is dependent on your [plan](/tyk-cloud/account-billing#select-a-payment-plan)
+    </Note>
+
+
+To edit an existing Cloud Data Plane:
+
+1. On the Deployments screen, expand the Control Plane and click on the Cloud Data Plane to access the Cloud Data Plane overview screen.
+2. Select **Edit** from the Deployed drop-down list
+
+<img src="/img/admin/cp-edit.png" alt="Cloud Data Plane drop-down" />
+
+## Upgrade Cloud Data Planes
+
+There are two ways to upgrade a Control Plane.
+
+### Manual Upgrade
+
+To upgrade an existing Cloud Data Plane:
+
+1. Go to the **Cloud Data Plane settings** using the _Edit Cloud Data Planes_ instructions and scroll down to the **Version** section.
+2. Select a **Bundle Channel**.
+
+<img src="/img/admin/cp-edge-upgrade-channel.png" alt="Bundle channel drop-down" />
+
+3. Next, select a **Bundle Version**.
+
+<img src="/img/admin/cp-edge-upgrade-version.png" alt="Bundle version drop-down" />
+
+4. To apply your changes, click the **"Save and Re-Deploy"** button located at the top right. After a few seconds, you will be redirected to the overview page of the Control Plane and a **"Deploying"** indicator button will appear. 
+
+<img src="/img/admin/cp-edge-upgrade-deploying.png" alt="Deploying notification" />
+
+5. A **"Deployed"** button indicates a successful upgrade.
+
+<img src="/img/admin/cp-edge-upgrade-deployed.png" alt="Deployed notification" />
+
+### Auto Upgrade
+
+The Auto Upgrade feature is only available for Control Plane deployments. When enabled on a Control Plane, it will automatically upgrade the corresponding data planes related to this control plane. For more information, see the [Tyk Cloud Control Plane Auto Upgrade Documentation](/tyk-cloud/environments-deployments/managing-control-planes).
diff --git a/tyk-cloud/environments-deployments/managing-organisations.mdx b/tyk-cloud/environments-deployments/managing-organisations.mdx
new file mode 100644
index 0000000000..f966b04d56
--- /dev/null
+++ b/tyk-cloud/environments-deployments/managing-organisations.mdx
@@ -0,0 +1,45 @@
+---
+title: "Managing Organizations in Tyk Cloud"
+description: "Learn how to manage organizations in Tyk Cloud, including organization, teams, deployments, and environments."
+keywords: "Organizations, Tyk Cloud, Control Plane, Cloud Data Plane"
+sidebarTitle: "Organizations"
+---
+
+## Overview
+
+Your Organization is your "container" for all your Environments, Control Planes and Cloud Data Planes. When you setup your Organization when [creating your account](/getting-started/create-account), you assign it to a Home Region where all your data is stored. You cannot change this home region after creating your organization.
+
+## Organization Overview Screen
+
+If you are an Organization Admin, when you log in you will see the Overview screen for the Organization you are connected to. If you are a team admin or team member you will see the Team Overview Screen. The Organization Overview screen displays the following info:
+
+* Quick Stats
+* All Teams
+* All Deployments
+* All Environments
+
+
+## Quick Stats
+
+<img src="/img/admin/tyk-cloud-org-overview.png" alt="Quick Stats" />
+
+This section gives you an "at a glance" overview of your organization. This section is designed to show what your plan entitles your organization to and how much of your entitlement is currently used in relation to Teams, Control Planes, Cloud Data Plane Deployments and the distribution of those deployments across the available entitlement regions.
+
+## Teams
+
+<img src="/img/admin/tyk-cloud-org-teams.png" alt="Teams" />
+
+This section shows the number of teams created within the organization, the number of environments the team is assigned to, and the Control Plane and Deployed Cloud Data Planes within those environments.
+
+## Deployments
+
+The default view for this section is Group by Control Plane and shows all deployments across all teams.
+
+<img src="/img/admin/tyk-cloud-org-deployments.png" alt="Deployments Grouped by Control Plane" />
+
+## Environments
+
+The Environments section shows the environments created within your organization, the team they belong to and active deployments within each environment.
+
+<img src="/img/admin/org_admin_environments.png" alt="Environments" />
+
diff --git a/tyk-cloud/environments-deployments/monitoring-how-it-works.mdx b/tyk-cloud/environments-deployments/monitoring-how-it-works.mdx
new file mode 100644
index 0000000000..5f16693672
--- /dev/null
+++ b/tyk-cloud/environments-deployments/monitoring-how-it-works.mdx
@@ -0,0 +1,57 @@
+---
+title: "How monitoring works in Tyk Cloud"
+description: "Learn how Tyk Cloud monitors throughput and storage metrics for your deployments."
+keywords: "Monitoring, Tyk Cloud, Control Plane, Data Plane"
+sidebarTitle: "Monitor Metrics"
+---
+
+### Tyk Cloud Monitor Metrics
+
+This section explains the various metrics that are monitored by Tyk Cloud.
+
+#### Tyk Cloud Throughput
+Tyk Cloud counts the total request/response sizes for traffic transferred through a deployment. Throughput metrics are displayed for the current day. These are calculated as the difference between the throughput usage at the current time and the throughput at last midnight.
+
+External traffic is subject to billing, while internal traffic is exempt. The monitoring service aggregates traffic between different services:
+
+<img src="/img/cloud/tyk-cloud-monitoring-priced-traffic.png" alt="Monitoring Traffic Pricing" />
+
+**Billed traffic**
+ - Traffic between user → Control Plane
+ - Traffic between user → Cloud Data Plane
+ - Traffic between user → Enterprise Developer Portal
+ - Traffic between user → Mserv (plugin upload)
+ - Traffic between Control Plane → Cloud Data Plane cross region
+ - Traffic between Cloud Data Plane → Mserv cross region
+ - Traffic between Control Plane → Portal cross region
+
+**Unbilled traffic**
+ - Hybrid traffic is currently not counted
+ - Traffic between Control Plane → Cloud Data Plane in the same region
+ - Traffic between Cloud Data Plane → Mserv in the same region
+ - Traffic between Control Plane → Portal in the same region
+
+#### Tyk Cloud Storage
+When a client makes a request to a Tyk Gateway deployment, the details of the request and response are captured and [stored in Redis](/api-management/dashboard-analytics#traffic-analytics). Tyk Pump processes the records from Redis and forwards them to MongoDB. Finally, Tyk Cloud reads that data from MongoDB and displays its size(bytes) in the _Storage_ section of _Monitoring_. 
+
+
+
+### Track Usage
+
+##### How to check metrics
+Login to Tyk Cloud and click on *Monitoring* within the *Operations* menu. Enable *Throughput* to display throughput metrics.
+
+<img src="/img/cloud/tyk-cloud-monitoring-throughput.png" alt="Monitoring Throughput" />
+
+Enable *Storage* to display storage metrics.
+
+<img src="/img/cloud/tyk-cloud-monitoring-storage.png" alt="Monitoring Storage" />
+
+You can also optionally filter for metrics by date.
+
+<img src="/img/cloud/tyk-cloud-monitoring-filtering-by-date.png" alt="Monitoring Metric Filtering" />
+
+Here you can see the metrics broken down per environment and a list of the top 5 control and cloud data planes.
+
+<img src="/img/cloud/tyk-cloud-monitoring-break-down.png" alt="Monitoring Metric break down" />
+
diff --git a/tyk-cloud/initial-portal-config.mdx b/tyk-cloud/initial-portal-config.mdx
new file mode 100644
index 0000000000..986ce78a4b
--- /dev/null
+++ b/tyk-cloud/initial-portal-config.mdx
@@ -0,0 +1,35 @@
+---
+title: "Configure Developer Portal in Tyk Cloud"
+description: "Learn how to set up and configure the Developer Portal in Tyk Cloud Control Plane deployments."
+keywords: "Developer Portal, Tyk Cloud, Control Plane, Configuration"
+sidebarTitle: "Developer Portal"
+---
+
+After deploying your Control Plane, you need to perform some initial configuration for the Developer Portal to prevent seeing any `Page Not Found` errors when trying to access the portal. You need to set up a Home page from the Control Plane Dashboard.
+
+Watch our video on configuring your Tyk Cloud Developer Portal.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/8_SPUake84w" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+1. From the Control Plane Dashboard, select **Pages** from the **Portal Management** menu
+2. Click **Add Page**
+
+<img src="/img/getting-started/create-account-portal-pages.png" alt="Add Portal Page" />
+
+3. In the Settings, give your page a name and slug. Below we've called it Home
+4. Select **Check to make this page the Home page**
+5. Select **Default Home page template** from the Page type drop-down list
+6. You can leave the Registered Fields sections for now
+
+<img src="/img/getting-started/portal-home-page-settings.png" alt="Portal Home page settings" />
+
+7. Click **Save**.
+
+You should now be able to access your Portal from **Open Your Portal** from the **Your Developer Portal** menu.
+
+<img src="/img/getting-started/portal_menu.png" alt="Portal Menu" />
+
+#### Further Portal Configuration
+
+Our Developer Portal is completely customizable. See [Portal Customization](/tyk-developer-portal/customise) for more details.
+
diff --git a/tyk-cloud/securing-your-apis.mdx b/tyk-cloud/securing-your-apis.mdx
new file mode 100644
index 0000000000..f6583e9c25
--- /dev/null
+++ b/tyk-cloud/securing-your-apis.mdx
@@ -0,0 +1,59 @@
+---
+title: "Managing and Securing your APIs Tyk Cloud"
+description: "Learn how to manage and secure your APIs in Tyk Cloud Control Plane deployments."
+keywords: "API Management, Tyk Cloud, Control Plane, Security"
+sidebarTitle: "Managing APIs"
+---
+
+## Manage APIs
+
+You can manage your APIs in *Tyk Dashboard* UI. To access it, click on your desired Control Plane name in the [Deployments](https://dashboard.cloud-ara.tyk.io/deployments) screen and then on the *MANAGE APIS* button
+
+From there you have access to the full scope of Tyk API management functionality, including:
+
+* [Adding APIs](/api-management/gateway-config-managing-classic#create-an-api) to Tyk, including REST and GraphQL APIs
+* Applying Quotas and Rate limits via [Security Policies](/api-management/gateway-config-managing-classic#secure-an-api) and [Keys](/api-management/gateway-config-managing-classic#access-an-api)
+* [Securing](/api-management/security-best-practices#securing-apis-with-tyk) your APIs
+* Viewing granular [Analytics](/api-management/dashboard-analytics#traffic-analytics) for your Tyk managed APIs
+* [Transform traffic](/api-management/traffic-transformation) with the Tyk API Designer
+* Add integration options such as [SSO](/tyk-identity-broker/dashboard-sso) and [3rd Party Identity Providers](/tyk-identity-broker/overview)
+* [Adding Segment Tags](/tyk-cloud/troubleshooting-support)
+
+
+## Secure Your APIs
+
+If you decide to use Tyk Cloud to protect your APIs, you need to make APIs accessible to your Tyk Cloud Data Planes so that Tyk can connect your clients to them. A common question that arises is, “how do I secure my APIs (backend services)?”.
+
+Here are the most popular ways to secure your APIs.
+
+**1. Mutual TLS or Client authorization**
+
+- This is the most secure method to protect your APIs. With Client  authorization, you need to add your Tyk Gateway certificates to an allow-list in all your backends and they will then accept access requests only from clients that present these pre authorized certificates. There are a few limitations with this approach:
+  
+    a. Depending on your setup, you might need to add it to every backend service. If you have a Load Balancer (LB), then it can be set at the LB level.
+    
+    b. Sometimes the LBs (like Application Load Balancers) do not support mTLS and then you need to find other solutions, like Request Signing (below).  Another option that might be possible, is to front your services or your LB with an L7 API Gateway (Like Tyk!) to do mTLS with the Tyk Cloud Data Planes on Tyk Cloud.
+
+- You need to be able to update the list in case certificates expire or get revoked.
+
+**2. Request Signing**
+
+Tyk can [sign the request with HMAC or RSA](/developer-support/release-notes/archived#hmac-request-signing), before sending it to the API target. This is an implementation of an [RFC Signing HTTP Messages(draft 10)](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-10). This RFC was designed to provide authenticity of the digital signature of the client. In our flow, the Tyk Cloud Data Planes, as the client, using a certificate private key, will add a header signature to the request. The API, using a pre-agreed public key (based on a meaningful keyId identifier) will verify the authenticity of the request coming from your Tyk Cloud Data Plane.
+ A limitation is that the APIs or LB need to implement this signature verification and be able to update the certificates as mentioned in Mutual TLS or Client authorization (above).
+
+**3. IP Whitelisting**
+
+ Each Tyk Cloud organization is dedicated to an IP range which is unique to them. This allows you to restrict access to your APIs to only API requests coming from your Tyk Cloud organization.  
+
+IP Whitelisting is susceptible to IP Spoofing, and it is recommended to be combined with an API Key in secure environments.
+
+In order to find your organization’s IP range, please open a support ticket with our support team, which is available to all paying customers.
+
+**4. Post plugin with OAuth flow**
+
+The custom plugin approach is mentioned last because it involves writing a bit of code. However, if your appetite allows for it, custom plugins offer the most flexibility of all these solutions.  You can use Tyk’s custom plugins to execute an OAuth flow, for example, between Tyk (as the client) and your authorization server, and inject a Bearer token into the request. The backend service will need to validate the bearer as usual. You can write [custom plugins](/tyk-cloud/using-plugins) in a variety of languages.
+
+**Where to Authenticate?**
+
+No matter which option or combination of options you choose, it is best to keep this authentication layer outside your application logic. This glue code should be placed in your ingress, whatever that might be. By keeping this logic outside your application, you keep a separation between the business logic and the boilerplate code.  You can even use the Tyk Open Source API Gateway as an ingress to protect your APIs, and it is compatible with all the methods mentioned above.
+
diff --git a/tyk-cloud/teams-users.mdx b/tyk-cloud/teams-users.mdx
new file mode 100644
index 0000000000..bb224fd27f
--- /dev/null
+++ b/tyk-cloud/teams-users.mdx
@@ -0,0 +1,160 @@
+---
+title: "Manage Teams and Users in Tyk Cloud"
+description: "Learn how to manage teams and users in Tyk Cloud, including user roles, team management, and single sign-on (SSO) configuration."
+keywords: "Teams, Users, Tyk Cloud, User Management, User Roles"
+sidebarTitle: "Teams and Users"
+---
+
+## Introduction
+
+This section covers the following:
+
+- [Managing Teams](#managing-teams)
+- [Managing Users](/tyk-cloud/teams-users)
+- Available Tyk Cloud [User Roles](/tyk-cloud/teams-users#user-roles-within-tyk-cloud)
+- [Tyk Cloud Single Sign-On (SSO)](/tyk-cloud/teams-users/single-sign-on)
+
+## Managing Teams 
+
+The following [user roles](/tyk-cloud/teams-users#user-roles-within-tyk-cloud) can perform existing Team Admin tasks:
+
+* Organization Admin - Can manage all teams in the organization they are a member of.
+* Team Admin - Can only manage the team they are a member of.
+
+For an existing team, you can:
+
+* Change the team name
+* Create or delete a team (Organization Admin only)
+* Invite and manage users in a team
+  
+### Change the Team Name
+
+1. From the Teams screen, select the team name.
+2. Click **Edit**.
+3. Change the existing name for the team.
+4. Click **Save**.
+
+### Create a New Team
+
+You need to be a [Organization Admin](/tyk-cloud/teams-users#assign-user-roles) to create a new team.
+
+1. From the Admin > Teams screen, click **Add Team**.
+2. Enter a name for the new team that will be added to the organization.
+3. Click **Create**.
+
+### Delete a Team
+
+You need to be a [Organization Admin](/tyk-cloud/teams-users#assign-user-roles) to delete a team.
+
+1. From the Teams screen, select the team name.
+2. Click **Edit**.
+3. Click **Delete Team**.
+4. You'll be asked to confirm the deletion. Click **Delete Team** from the dialog box to confirm, or click **Cancel**.
+
+You can now invite users to your new team. See [Managing Users](/tyk-cloud/teams-users) for more details.
+
+
+## Managing Users
+
+The following [user roles](/tyk-cloud/teams-users#user-roles-within-tyk-cloud) can perform existing User Admin tasks:
+
+* [Organization Admin](/tyk-cloud/teams-users#assign-user-roles) - Can manage all users in the organization they are a member of.
+* [Team Admin](/tyk-cloud/teams-users#assign-user-roles) - Can only manage the users of the team they are a member of.
+
+
+
+    <Note>
+    Organization Admins, Team Admins and Team Members are responsible for managing the Tyk Cloud organization hierarchy and deploying/managing stacks, as well as having access to the Tyk Dashboard to manage APIs. Users of Tyk Cloud are usually DevOps, Architects and sometimes Engineers or Managers.
+
+    You can also [add users to the Tyk Dashboard](/platform-management/dashboard-users#manage-tyk-dashboard-users) itself instead of inviting them as Tyk Cloud users. These users would likely be your API Developers and Engineers who manage the APIs.
+    </Note>
+
+
+### Invite a new user to your team
+
+1. From the Teams screen, select the team name.
+2. Click **Invite User**.
+3. Complete the form for the new user.
+
+### Editing Existing Users
+
+1. Select the team with the user you want to edit.
+2. Click the user name from the team user list.
+3. You can change the following details
+   * Change the team they are a member of.
+   * Change the user role assigned to them.
+4. Click Save to update the user info.
+
+### Delete a User
+
+1. Select the team with the user you want to edit.
+2. Click the user name from the team user list.
+3. Click **Delete**
+4. You'll be asked to confirm the deletion. Click **Delete User** from the pop-up box to confirm, or click **Cancel**.
+
+
+## Assign User Roles
+
+This section defines the different user roles within Tyk Cloud, so that you can see at a glance what each role does and manage your account accordingly.
+
+### User Roles within Tyk Cloud
+
+We have the following user roles defined in Tyk Cloud for your team members
+
+* Billing Admin
+* Organization Admin
+* Team Admin
+* Team Member
+
+Billing Admins are responsible for the billing management of the Tyk Cloud account. Organization Admins, Team Admins and Team Members are responsible for managing the Tyk Cloud organization hierarchy and deploying/managing stacks, as well as having access to the Tyk Dashboard to manage APIs. Users of Tyk Cloud are usually DevOps, Architects and sometimes Engineers or Managers.
+
+You can [add users to the Tyk Dashboard](/platform-management/dashboard-users#manage-tyk-dashboard-users) itself instead of inviting them as Tyk Cloud users. These users would likely be your API Developers and Engineers who manage the APIs.   
+
+### Use Case Matrix
+
+The following table shows the scope for each user role.
+
+
+| Use Case                                          | Billing Admin | Org Admin | Team Admin | Team Members |
+| :--------------------------------------------------- | :--------------- | :----------- | :------------ | :-------------- |
+| Create a new account                              | X             |           |            |              |
+| Create a new organization                         | X             |           |            |              |
+| Managing a new account                            | X             |           |            |              |
+| Managing an organization entitlement              | X             |           |            |              |
+| Ability to create other billing admins            | X             |           |            |              |
+| Editing organization name                         | X             | X         |            |              |
+| Create team / delete                              |               | X         |            |              |
+| Future - Edit team entitlements                   |               | X         |            |              |
+| Invite, delete, edit org admins and team admins   |               | X         |            |              |
+| Invite, delete, edit team members                 |               | X         | X          |              |
+| Create new environments                           |               | X         | X          |              |
+| Delete / change environments                      |               | X         | X          |              |
+| View environments                                 |               | X         | X          | X            |
+| Create and delete cloud data planes               |               | X         | X          |              |
+| Create and delete control planes                  |               | X         | X          |              |
+| View deployments                                  |               | X         | X          | X            |
+| Deploy, undeploy, redeploy, restart a deployment. |               | X         | X          | X            |
+| Create and manage basic SSO                       |               | X         | X          |              |
+| Upload plugins to the File Server                 |               | X         | X          | X            |
+| Delete plugins from File Server                   |               | X         | X          | X            |
+| Viewing Analytics                                 |               | X         | X          | X            |
+
+### Initial Tyk Cloud Account Roles
+
+The user who signs up for the initial Tyk Cloud account is uniquely assigned to two roles:
+
+1. Org admin of the organization
+2. Billing admin of the account
+
+This is the only occasion where a user can be assigned to 2 roles. So, for example, if you invite a user to be a Team Admin, that is the only role (and team) they can belong to. For a user to be invited as a Billing admin, they can't have an existing Tyk Cloud account.
+
+
+<Note>
+This functionality may change in subsequent releases.
+</Note>
+
+
+**Tyk System Integration User (do not delete)**
+
+When you click your Control Plane Dashboard link from your Tyk Cloud Deployments Overview screen, you are automatically logged in to your Dashboard. This is due to a default Tyk Integration user that is created as part of the Control Plane deployment process. This user has a first name of `Tyk System Integration` and a last name of `User (do not delete)`. As the last name infers, you should not delete this user or your access to the Dashboard will be broken from your Tyk Cloud Installation.
+
diff --git a/tyk-cloud/teams-users/single-sign-on.mdx b/tyk-cloud/teams-users/single-sign-on.mdx
new file mode 100644
index 0000000000..7f2b2ede91
--- /dev/null
+++ b/tyk-cloud/teams-users/single-sign-on.mdx
@@ -0,0 +1,80 @@
+---
+title: "Configure Single Sign-On (SSO) in Tyk Cloud"
+description: "Learn how to set up and manage Single Sign-On (SSO) in Tyk Cloud Control Plane deployments."
+keywords: "Single Sign-On, SSO, Tyk Cloud, Control Plane, Configuration"
+sidebarTitle: "Single Sign On (SSO)"
+---
+
+## What is SSO?
+
+Single Sign-On (SSO) is an authentication process that empowers users to access various services and applications using a single set of credentials. This streamlines the login experience by eliminating the need to remember multiple usernames and passwords for different platforms.
+
+These credentials are securely stored with an Identity Provider(IdP). An Identity Provider (IdP) is a service that stores and manages digital identities. Companies can use these services to allow their employees or users to connect with the resources they need. 
+
+## Pre-requisites
+
+
+<Note>
+To be able to configure Single Sign-On authentication, an SSO entitlement needs to be enabled in the subscription plan. 
+If you are interested in getting access, contact your account manager or reach out to our [support@tyk.io](<mailto:support@tyk.io?subject=Tyk Cloud Single sign on>)
+</Note>
+
+
+## Add new SSO profile
+To add a new SSO profile, login to Tyk Cloud, navigate to the _Profile_ list and click on the _ADD PROFILE_ button.
+
+  <img src="/img/cloud/cloud-sso-profile-list.png" alt="Tyk Cloud SSO profile list" />
+
+Populate the form with all the mandatory fields and click the _ADD PROFILE_ button.
+
+  <img src="/img/cloud/cloud-sso-add-profile-form.png" alt="Tyk Cloud SSO add profile form" />
+
+The table below explains the fields that should be completed:
+| Field name             | Explanation                                                                                                                     |
+| :---------------------- | :--------------------------------------------------------------------------------------------------------------------------------- |
+| Provider name          | Used to distinguish between different SSO providers.                                                                      |
+| Client ID              | Used for client authentication with the IdP provider. The value can be found in your chosen IdP provider's configuration. |
+| Client Secret          | Used for client authentication with the IdP provider. The value can be found in your chosen IdP provider's configuration.     |
+| Discovery URL          | Used to read your IdP's openid configuration. This URL can be found in your chosen IdP provider's configuration.  |
+| Default User Group ID  | The ID of the user group that new users are allocated to by default upon registration.                                                                       |
+| Only registered users  | A check-box that defines which users are allowed to use SSO. If checked, only users who are already registered in Tyk Cloud are allowed to login with SSO. If un-checked, new users will be added to Tyk Cloud in the _Default_ user group upon successful registration. |
+
+
+As illustrated below an authentication and callback URL will be generated, once the new profile has been added. You need to add these URLs to the configuration of your chosen IdP provider.
+The Auth URL is your custom URL that can be used to start the SSO login flow whereas Callback URL is the URL that the SSO provider will callback to confirm successful authentication.
+
+  <img src="/img/cloud/cloud-sso-add-config-details.png" alt="Tyk Cloud SSO example of filled form" />
+
+## Edit SSO profile
+
+To update/re-configure SSO profile, login to Tyk Cloud, navigate to _Profile_ list and click on the profile that you would like to update.
+  
+  <img src="/img/cloud/cloud-sso-edit-select.png" alt="Tyk Cloud SSO edit selection" />
+
+Edit the fields you would like to change and then click on the _SAVE PROFILE_ button.
+
+  <img src="/img/cloud/cloud-sso-save-edit.png" alt="Tyk Cloud SSO save edit selection" />
+
+## Delete SSO profile
+
+
+<Warning>
+Please note the action of deleting an SSO profile cannot be undone.
+
+To delete an SSO profile, login to Tyk Cloud, navigate to _Profile_ list and click on the profile you would like to remove.
+</Warning>
+
+
+  <img src="/img/cloud/cloud-sso-delete-select.png" alt="Tyk Cloud SSO delete selection" />
+
+On the profile page, click on the _DELETE PROFILE_ button.
+
+  <img src="/img/cloud/cloud-sso-delete-click.png" alt="Tyk Cloud SSO delete accept" />
+
+On the confirmation window, confirm by clicking the _DELETE PROFILE_ button.
+
+  <img src="/img/cloud/cloud-sso-delete-confirm.png" alt="Tyk Cloud SSO delete confirm" />
+
+After profile deletion, the authentication URL will not be available anymore. 
+
+
diff --git a/tyk-cloud/telemetry.mdx b/tyk-cloud/telemetry.mdx
new file mode 100644
index 0000000000..de226fd86d
--- /dev/null
+++ b/tyk-cloud/telemetry.mdx
@@ -0,0 +1,191 @@
+---
+title: "Configure Telemetry in Tyk Cloud"
+description: "Learn how to set up and manage telemetry in Tyk Cloud for distributed tracing, application logs, and gateway metrics export."
+keywords: "Telemetry, Tyk Cloud, Control Plane, Data Plane, Distributed Tracing, OpenTelemetry, Metrics, Logs, Observability"
+sidebarTitle: "Configure Telemetry"
+---
+
+Tyk Cloud supports three types of observability data:
+
+- **Distributed Traces**: Track request flow, identify bottlenecks, and troubleshoot issues.
+- **Gateway Metrics**: Export RED (Rate, Error, Duration) metrics to monitor API performance.
+- **Application Logs**: Stream application logs in real time to your configured provider.
+
+Traces and metrics are available for Cloud Data Plane deployments. Logs can be enabled for both Control Plane and Cloud Data Plane deployments.
+
+This feature is built on Tyk Gateway's OpenTelemetry integration. See the [OpenTelemetry documentation](/api-management/traces) for configuration options and sampling strategies.
+
+<Note>
+Telemetry is an add-on feature in Tyk Cloud. Contact our [support team](https://support.tyk.io/) to enable it for your account.
+</Note>
+
+## Available Telemetry Providers
+
+Tyk Cloud integrates with:
+
+- [Datadog](#configure-providers)
+- [Dynatrace](#configure-providers)
+- [New Relic](#configure-providers)
+- [Elastic](#configure-providers)
+- [Custom](#configure-providers)
+
+## Instructions
+
+Configuring telemetry is a two-step process:
+
+1. Configure a provider at the organization level.
+2. Enable telemetry export on a Cloud Data Plane.
+
+### Step 1: Configure a telemetry provider
+
+1. In the Tyk Cloud Console, select **Telemetry**. A grid shows all supported providers.
+
+    <Note>
+    Only one provider can be configured at a time.
+    </Note>
+
+    <img src="/img/cloud/telemetry-exports.png" alt="Tyk Cloud Telemetry providers" />
+
+2. Click your preferred provider to open its configuration form.
+
+3. Configure the following settings shared by all providers:
+
+    - **Connection Toggle**: Activates or deactivates telemetry export. When enabled, Tyk sends monitoring data to your chosen platform.
+    - **Sampling Rate**: Percentage of API traffic to send (default: 10%, meaning one in every ten API calls).
+
+4. Optionally configure:
+
+    - **Tags to Add to the Traces**: Custom labels that make telemetry data easier to filter and analyze. For example:
+
+        ```yaml
+        environment: production
+        region: europe
+        team: api-gateway
+        ```
+
+    - **Fields to Filter**: Fields to exclude from telemetry, useful for preventing sensitive data from reaching your monitoring platform.
+
+5. Configure the provider-specific connection settings:
+
+    <a id="configure-providers"></a>
+
+    <Tabs>
+
+    <Tab title="Datadog">
+
+    - **Provider Site**: Your Datadog URL (for example, `us5.datadoghq.com`). See [Datadog site documentation](https://docs.datadoghq.com/getting_started/site/#access-the-datadog-site).
+    - **API Key**: Your Datadog API key. See [Datadog API key documentation](https://docs.datadoghq.com/account_management/api-app-keys/#add-an-api-key-or-client-token).
+
+        ```text
+        Provider Site: us5.datadoghq.com
+        API Key: your-datadog-api-key
+        ```
+
+        <img src="/img/cloud/telemetry-datadog.png" alt="Tyk Cloud Telemetry Datadog" />
+
+    </Tab>
+
+    <Tab title="Dynatrace">
+
+    - **Provider Endpoint**: Your Dynatrace environment URL. See [Dynatrace environment documentation](https://docs.dynatrace.com/docs/discover-dynatrace/get-started/monitoring-environment#environment-id).
+    - **API Token**: Your Dynatrace access token. See [Dynatrace access token documentation](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/access-tokens#create-api-token).
+
+        ```text
+        Provider Endpoint: https://<YOUR-ENVIRONMENT-STRING>.live.dynatrace.com/api/v2/otlp
+        API Token: your-dynatrace-token
+        ```
+
+        <img src="/img/cloud/telemetry-dynatrace.png" alt="Tyk Cloud Telemetry Dynatrace" />
+
+    </Tab>
+
+    <Tab title="New Relic">
+
+    - **Provider Endpoint**: Your New Relic HTTP endpoint. See [New Relic endpoint documentation](https://docs.newrelic.com/docs/opentelemetry/best-practices/opentelemetry-otlp/#configure-endpoint-port-protocol).
+    - **API Token**: Your New Relic license key. See [New Relic API key documentation](https://docs.newrelic.com/docs/apis/intro-apis/new-relic-api-keys/).
+
+        ```text
+        Provider Endpoint: https://security-api.newrelic.com/security/v1
+        API Token: your-newrelic-api-key
+        ```
+
+        <img src="/img/cloud/telemetry-newrelic.png" alt="Tyk Cloud Telemetry NewRelic" />
+
+    </Tab>
+
+    <Tab title="Elastic">
+
+    - **Provider Endpoint**: Your Elastic APM server address.
+    - **Secret Token**: Your Elastic APM authentication token. See [Elastic secret token documentation](https://www.elastic.co/guide/en/observability/current/apm-secret-token.html#apm-create-secret-token).
+
+        ```text
+        Provider Endpoint: https://your-elastic-cluster:8200
+        Secret Token: your-elastic-secret-token
+        ```
+
+        <img src="/img/cloud/telemetry-elastic.png" alt="Tyk Cloud Telemetry Elastic" />
+
+    </Tab>
+
+    <Tab title="Custom">
+
+    - **Exporter**: Choose gRPC or HTTP.
+    - **Provider Endpoint**: Your monitoring system URL.
+    - **Authorization**: Configure authentication for your monitoring system.
+
+        ```text
+        Exporter: gRPC
+        Provider Endpoint: grpc://your-collector:4317
+        Authorization Header Name: Authorization
+        Authorization Header Value: Bearer your-token
+        ```
+
+        <img src="/img/cloud/telemetry-custom.png" alt="Tyk Cloud Telemetry Custom" />
+
+    </Tab>
+
+    </Tabs>
+
+### Step 2: Enable telemetry export on a Cloud Data Plane
+
+Changes to telemetry settings require a Cloud Data Plane redeployment to take effect.
+
+1. Navigate to your Cloud Data Plane deployment (create new or edit existing).
+
+2. In the telemetry export section, enable the types you want:
+
+    <img src="/img/cloud/telemetry-enable.png" alt="Tyk Cloud Telemetry Enable" />
+
+    - **Enable Traces**: Enable distributed tracing.
+    - **Enable Metrics**: Enable gateway metrics export (requires Gateway v5.13.0 or later). See [Default Metrics Exported](#default-metrics-exported) for what is included.
+    - **Enable Logs**: Enable real-time application log streaming.
+
+3. If traces are enabled, optionally set a **Sampling Rate Override** to control what percentage of trace data to export (default: 10%). This setting applies to traces only — not metrics or logs.
+
+    <Note>
+    The sampling rate can be set at the organization level and overridden per Cloud Data Plane. The Cloud Data Plane setting takes precedence.
+    </Note>
+
+4. Save and redeploy the Cloud Data Plane.
+
+5. In the deployment overview, confirm that **Telemetry Export** shows as enabled:
+
+    <img src="/img/cloud/tyk-cloud-data-plane-enable-telemetry.png" alt="Tyk Cloud Data Plane Telemetry Enabled" />
+
+## Default Metrics Exported
+
+When metrics are enabled, Tyk exports the following RED (Rate, Error, Duration) metrics by default:
+
+| Metric | Description | Example Values |
+|--------|-------------|----------------|
+| **HTTP Method** | HTTP method used in the request | `GET`, `POST`, `PUT`, `DELETE` |
+| **API ID** | Unique identifier of the API | `api-12345` |
+| **HTTP Response Code** | HTTP status code returned | `200`, `404`, `500` |
+
+Metrics are exported using OpenTelemetry's cumulative temporality model, which tracks the total count of events over time.
+
+<Note>
+Metric customization (additional dimensions, filtering) is not self-service. Submit a support request at [support.tyk.io](https://support.tyk.io/) to configure custom dimensions.
+
+Custom metric dimensions can significantly increase cardinality, which affects gateway memory usage and your observability platform's storage costs.
+</Note>
diff --git a/tyk-cloud/troubleshooting-support.mdx b/tyk-cloud/troubleshooting-support.mdx
new file mode 100644
index 0000000000..d3b587bf6f
--- /dev/null
+++ b/tyk-cloud/troubleshooting-support.mdx
@@ -0,0 +1,63 @@
+---
+title: "Troubleshooting Tyk Cloud"
+description: "Learn how to troubleshoot common issues in Tyk Cloud, including FAQs and support resources."
+keywords: "Troubleshooting, Tyk Cloud, FAQs, Support"
+sidebarTitle: "Troubleshooting"
+---
+
+## FAQs
+
+**Q1: Is a Cloud Data Plane Deployment considered highly available? Do I need to deploy multiple Cloud Data Planes to a single Data Center?**
+
+A: On a Production plan and higher there are at least two Gateway instances at all times, usually in different
+availability zones within a single region (in cloud provider terms).
+
+**Q2: What are the performance benchmarks of a single Cloud Data Plane?**
+
+A: In Phase 2 we plan to allow users to choose from a pool of "runtimes" that provide different performance targets, so
+they'll be able to have a Tyk Cloud environment with Cloud Data Planes that can sustain more load and then another environment
+(e.g. for testing) that sustains less.
+
+**Q3: How can I geo-load balance across multiple Cloud Data Planes? Why should I want to?**
+
+A: The use case to deploy multiple Cloud Data Planes is either segregating regional traffic and/or segregating APIs.
+This doesn't necessarily concern High Availability.
+
+The number of actual Gateway instances within a single Cloud Data Plane deployment varies, auto-scales and load balances depending
+on the plan.
+
+If you deploy several Cloud Data Planes and want to use it to e.g. geo-load balance it's currently your responsibility to put such
+a system into place, but we have plans to help with this in later phases.
+
+**Q4: What instance sizes/VMs does a Gateway run on?**
+
+A: You won't need to worry. We abstract all the resources and only provide performance "targets". See Q2.
+
+**Q5: Can I connect my own Hybrid Gateways?**
+
+A: Yes. The MDCB Ingress URL is given in the Control Plane details page, which allows for connecting a Hybrid Gateway.
+
+**Q6: Can we use SSO in the Dashboard and/or Portal?**
+
+A: Yes, as of v3.0.0, TIB is integrated into Tyk Dashboard, meaning that once a Control Plane is deployed, a user can
+go into the Identity Management section of Tyk Dashboard and setup SSO with their IdP for both the Dashboard and
+Developer Portal.
+
+**Q7: How do I view Gateway/Dashboard logs for troubleshooting?**
+
+A: This will be exposed in later phases per deployment.
+
+**Q8: How do Segment tags work with Tyk Cloud?**
+
+A: When a Cloud Data Plane is deployed, the tag 'edge' and a location tag are automatically generated for the Cloud Data Plane. You use these tags to connect your API to the appropriate Cloud Data Plane. It works as follows:
+
+* Add the **edge** tag to your API to connect it to all Cloud Data Planes within the Control Plane.
+* Add the location tag to your API to connect it to only Cloud Data Planes with that location within the Control Plane.
+
+To add either of the tags, see [Adding an API](/tyk-cloud#steps-to-add-an-api-in-tyk-cloud) in the Getting Started section.
+
+
+<Warning>
+You must add one of the above tags to any API you add to your Control Plane Dashboard.
+</Warning>
+
diff --git a/tyk-cloud/using-custom-domains.mdx b/tyk-cloud/using-custom-domains.mdx
new file mode 100644
index 0000000000..eda309646c
--- /dev/null
+++ b/tyk-cloud/using-custom-domains.mdx
@@ -0,0 +1,51 @@
+---
+title: "Configure Custom Domains in Tyk Cloud"
+description: "Learn how to set up custom domains for Tyk Cloud Control Planes and Cloud Data Planes."
+keywords: "Custom Domains, Tyk Cloud, Cloud Data Plane, Control Plane"
+sidebarTitle: "Custom Domains"
+---
+
+## Introduction
+
+You can set up Tyk Cloud to use a custom domain. Using custom domains is available on our free trial and all our paid [plans](https://tyk.io/price-comparison/). You can use a custom domain for both your **Control Planes** and **Cloud Data Planes**.
+
+
+<Note>
+**note**
+
+Wild cards are not supported by Tyk Cloud in custom domain certificates
+</Note>
+
+
+## Custom Domains with Control Planes
+
+* Currently, you can only use **one custom domain** per Control Plane deployment.
+* The custom domain in this case ties to a **Tyk Developer Portal**. Please set up a **CNAME DNS** record such that it points to the "Portal" ingress as displayed on your Control Plane deployment page.
+  
+## Custom Domains with Cloud Data Planes
+
+You can set multiple custom domains on a Cloud Data Plane. In this instance please set up your CNAME DNS records such that they point to the only ingress displayed on your Cloud Data Plane deployment page.
+
+Note: While you can set multiple custom domains for a Cloud Data Plane, a single custom domain cannot be used for multiple Cloud Data Planes.
+
+## How to set up a Custom Domain
+
+In this example we are going to set up a custom domain called `Cloud Data Plane.corp.com` for a Cloud Data Plane deployment.
+
+1. Create a CNAME DNS record `edge.corp.com` that points to your Cloud Data Plane ingress (e.g. `something-something.aws-euw2.cloud-ara.tyk.io`).
+2. From your Cloud Data Plane deployment, select **Edit** from the Status drop-down.
+
+<img src="/img/2.10/edge-dropdown.png" alt="Cloud Data Plane drop-down" />
+
+3. Enter `edge.corp.com` in the Custom Domains field.
+
+<img src="/img/2.10/edge_custom_domain.png" alt="Cloud Data Plane Custom Domain" />
+
+4. Click **Save and Re-deploy**.
+
+<img src="/img/2.10/save_redeploy.png" alt="Save and Re-Deploy" />
+
+## How our Custom Domain functionality works
+
+When you point your custom domain to your deployment, we use Let's Encrypt's **HTTP01 ACME** challenge type, which verifies ownership by accessing your custom CNAME on your Control Plane or Cloud Data Plane deployment. For example - `something-something.aws-euw2.cloud-ara.tyk.io` above.
+
diff --git a/tyk-cloud/using-plugins.mdx b/tyk-cloud/using-plugins.mdx
new file mode 100644
index 0000000000..f55360f626
--- /dev/null
+++ b/tyk-cloud/using-plugins.mdx
@@ -0,0 +1,416 @@
+---
+title: "Configure Custom Plugins in Tyk Cloud"
+description: "Learn how to set up and manage custom plugins in Tyk Cloud Control Plane deployments."
+keywords: "Plugins, Tyk Cloud, Control Plane, Data Plane"
+sidebarTitle: "Custom Plugins"
+---
+
+## Introduction
+
+Tyk Cloud allows you to take advantage of Tyk's plugin architecture to write custom middleware that can be used to extend the functionality of your APIs.
+
+Tyk Cloud supports the use of [Python](/api-management/plugins/rich-plugins#overview), [JavaScript Middleware](/api-management/plugins/javascript) and [Golang](/tyk-cloud/using-plugins) based plugins.
+
+This page explains how to set up a Tyk Cloud Control Plane to use a Python Authentication Plugin.
+
+<Note>
+The S3 bucket method described on this page distributes plugin bundles to **Cloud Data Planes** only. Tyk hosts and manages Cloud Data Planes for you.
+
+If you use a **Hybrid Data Plane** (a self-managed gateway that you deploy and connect to your Tyk Cloud Control Plane), use the Gateway's built-in [plugin bundle downloader](/api-management/plugins/overview#plugin-bundles) instead. You can either host your own bundle on your own web server or S3 bucket, or point the Hybrid Gateway directly at your Tyk Cloud Control Plane's File Server. See [Serving Plugin Bundles To Hybrid Gateways](#serving-plugin-bundles-to-hybrid-gateways) for the File Server option.
+</Note>
+
+## Setup Control Plane
+
+<img src="/img/plugins/plugins_enable.png" alt="Plugins Settings" />
+
+1. You need to enable Plugins on a Control Plane and on a Cloud Data Plane.
+2. You need to enter Provider details to enable you to store and access your plugins. For this version of Tyk Cloud, we are supporting Amazon AWS S3. If you haven't got an AWS S3 account, go to [https://aws.amazon.com/s3/](https://aws.amazon.com/s3/) and set one up. You will need the following details to configure SW3 within your Control Plane:
+   * Your AWS Key ID
+   * Your AWS Secret
+   * Your AWS Region
+
+    <Note>
+    For this release of Tyk Cloud, you need to enter your AWS Region manually. You also need to consider that uploading a custom plugin bundle to Tyk Cloud results in a new bucket being created for each bundle uploaded.  It also requires that Tyk Cloud has permissions in the form of an AWS IAM policy to have create rights on AWS.
+    </Note>
+
+3. Create an AWS IAM policy that grants Tyk Cloud the permissions it needs to create and manage the S3 bucket, for example:
+
+    ```json expandable
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "VisualEditor0",
+                "Effect": "Allow",
+                "Action": [
+                    "s3:CreateBucket",
+                    "s3:ListBucket",
+                    "s3:GetBucketLocation",
+                    "s3:DeleteBucket"
+                ],
+                "Resource": "arn:aws:s3:::mserv-plugin-*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": "s3:ListAllMyBuckets",
+                "Resource": "*"
+            },
+            {
+                "Sid": "VisualEditor1",
+                "Effect": "Allow",
+                "Action": [
+                    "s3:PutObject",
+                    "s3:GetObject",
+                    "s3:DeleteObject"
+                ],
+                "Resource": "arn:aws:s3:::mserv-plugin-*/*"
+            }
+        ]
+    }
+    ```
+
+    See the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) for more information on creating IAM policies.
+
+Next you'll [set up your plugin development environment](#set-up-your-plugin-development-environment).
+
+## Set Up Your Plugin Development Environment
+
+Before you can build a Python plugin bundle, you need a local environment to write and package it in.
+
+**What do I need to build a plugin bundle?**
+
+1. A local Tyk Gateway installation to create your Python plugin bundle. We recommend [installing our Self-Managed version on Ubuntu Bionic 18.04](/tyk-self-managed/install/linux#install-tyk-on-debian-or-ubuntu).
+2. A currently stable [Python 3.x version](https://www.python.org/downloads/) installed.
+3. The build tools, installed with `apt-get install -y build-essential`.
+4. Our required modules, installed with:
+
+```{.copyWrapper}
+apt install python3 python3-dev python3-pip
+pip3 install protobuf grpcio
+```
+
+Next you'll [create a Python code bundle](#create-a-python-code-bundle).
+
+## Create a Python Code Bundle
+
+This section demonstrates how to create a Python code bundle as part of the custom authentication process for Tyk Cloud, so that you can ensure your API management solution is as effective as possible.
+
+
+**What do I need to do to create my Plugin?**
+
+* You need to create the Python code bundle on your locally installed Gateway (not an Tyk Cloud Cloud Data Plane stack).
+* You will create 2 files, a manifest file (`manifest.json`) and the python file (`middleware.py`)
+* You then create a zipped bundle via our Tyk CLI tool that is built in to your local Gateway instance.
+  
+**Creating the Plugin bundle**
+
+**Step 1: Create your working directory**
+
+The first step is to create a directory for your plugin bundle files:
+
+```.copyWrapper
+mkdir ~/my-tyk-plugin
+cd ~/my-tyk-plugin
+```
+
+**Step 2: Creating the Manifest File**
+
+The manifest file contains information about your plugin file structure and how we expect it to interact with the API that will load it. This file should be named `manifest.json` and needs to have the following contents:
+
+```.json
+{
+  "custom_middleware": {
+    "auth_check": {
+      "name": "MyAuthMiddleware"
+    },
+    "pre": [
+      {
+        "name": "MyAuthMiddleware"
+      }
+    ],
+    "driver": "python"
+  },
+  "file_list": [
+    "middleware.py"
+  ]
+}
+```
+**File description**
+
+| File              | Description                                                                                                                                                                                                                                                                                       |
+| :------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| custom_middleware | contains the middleware settings like the plugin driver you want to use (driver) and the hooks that your plugin will expose. We use the   **auth_check** for this tutorial. For other hooks see [here](/api-management/plugins/rich-plugins#coprocess-dispatcher-hooks). |
+| file_list         | contains the list of files to be included in the bundle. The CLI tool expects to find these files in the current working directory.                                                                                                                                                               |
+| name              | references the name of the function that you implement in your plugin code: **MyAuthMiddleware**                                                                                                                                                                                                  |
+| middleware.py     | an additional file that contains the main implementation of our middleware.                                                                                                                                                                                                                       |
+
+**Step 3: Creating the middleware.py file**
+
+* You import decorators from the Tyk module that gives us the Hook decorator, and we import [Tyk Python API helpers](/api-management/plugins/rich-plugins#tyk-python-api-methods)
+
+* You implement a middleware function and register it as a hook. The input includes the request object, the session object, the API meta data and its specification. The hook checks the authorization header for a specified value. In this tutorial we have called it `Authorization`.
+
+```.python
+from tyk.decorators import *
+from gateway import TykGateway as tyk
+
+@Hook
+def MyAuthMiddleware(request, session, metadata, spec):
+    auth = request.get_header('Authorization')
+    if not auth:
+        auth = request.object.params.get('authorization', None)
+
+    if auth == '47a0c79c427728b3df4af62b9228c8ae':
+        session.rate = 1000.0
+        session.per = 1.0
+        metadata["token"] = auth
+    return request, session, metadata
+
+@Hook
+def MyPostMiddleware(request, session, spec):
+    tyk.log("This is my post middleware", "info")
+    request.object.set_headers["x-tyk-request"] = "something"
+    return request, session
+  ```
+
+**File description**
+
+| File                      | Description                                                                    |
+| :--------------------------- | :-------------------------------------------------------------------------------- |
+| `MyAuthMiddleware`  @hook | checks for a value. If it is found it is treated as your authentication token. |
+| `MyPostMiddleware`  @hook | adds a header to the request. In this tutorial  `something`                    |                                                                             |
+
+**Step 4: Create the Plugin Bundle**
+
+* You create a bundle to cater for a number of plugins connected to the one API, and using a bundle makes this more manageable.
+
+* To bundle your plugin we run the following command in your working directory where your manifest.json and plugin code is.
+
+```.bash
+docker run \
+  --rm \
+  -v $(pwd):/cloudplugin \
+  --entrypoint "/bin/sh" -it \
+  -w "/cloudplugin" \
+  tykio/tyk-gateway:v3.1.2 \
+  -c '/opt/tyk-gateway/tyk bundle build -y'
+```
+
+* A plugin bundle is a packaged version of the plugin, it may also contain a cryptographic signature of its contents. The -y flag tells the Tyk CLI tool to skip the signing process in order to simplify this tutorial. For more information on the Tyk CLI tool, see [here](/api-management/plugins/overview#how-plugin-bundles-work).
+* You should now have a `bundle.zip` file in the plugin working directory.
+* Next you will configure [uploading your plugin bundle file](#uploading-your-bundle) to your Amazon S3 bucket.
+
+## Uploading your Bundle
+
+This section walks you through uploading your bundle as part of the process of Python custom authentication on Tyk Cloud, so that you can ensure your API management solution is as effective as possible.
+
+**How do I upload my bundle file to my Amazon S3 bucket?**
+
+We are going to use a Tyk CLI tool called **mservctl**. This acts as a file server for our plugins. You use it to push your plugin bundle to your S3 bucket. Your Tyk Cloud Tyk Gateway will use **MServ** to retrieve your bundle, instead of connecting directly into S3.
+
+**Prerequisites**
+
+1. You need to install the mserv binary according to your local environment from the following repo - https://github.com/TykTechnologies/mserv/releases. Linux and MacOS are supported.
+
+2. From your Control Plane you need the following settings.
+
+<img src="/img/plugins/fileserver_settings.png" alt="File Server Settings" />
+
+   * Your Tyk Cloud Control Plane Ingress File Server Endpoint (1)
+   * Your File Server API Key (2)
+
+**How does mservctl work?**
+
+You create a config file (in YAML) that contains your Control Plane settings that connects to your S3 bucket. You then use a `push` command to upload your `bundle.zip` file to your bucket.
+
+**mservctl settings - Mac**
+
+To run `mservctl` from your local machine, from the binary directory, run:
+
+```.bash
+./mservctl.macos.amd64
+```
+**mservctl settings - Linux**
+
+To run `mservctl` from your local machine, from the binary directory, run:
+
+```.bash
+./mservctl.linux.amd64
+```
+
+The help for mservctl will be displayed. We will be using the config file options for this tutorial.
+
+```.bash
+$ mservctl help
+mservctl is a CLI application that enables listing and operating middleware in an Mserv instance.
+Use a config file (by default at $HOME/.mservctl.yaml) in order to configure the Mserv to use with the CLI.
+Alternatively pass the values with command line arguments, e.g.:
+$ mservctl list -e https://remote.mserv:8989
+Set TYK_MSERV_LOGLEVEL="debug" environment variable to see raw API requests and responses.
+Usage:
+  mservctl [command]
+Available Commands:
+  delete      Deletes a middleware from mserv
+  fetch       Fetches a middleware record from mserv
+  help        Help about any command
+  list        List middleware in mserv
+  push        Pushes a middleware to mserv
+Flags:
+      --config string     config file (default is $HOME/.mservctl.yaml)
+  -e, --endpoint string   mserv endpoint
+  -h, --help              help for mservctl
+  -t, --token string      mserv security token
+Use "mservctl [command] --help" for more information about a command.
+```
+
+
+<Note>
+You may have to change the CHMOD settings on the binary to make it executable. (`chmod +x <filename>`). On MacOS you may also need to change your security settings to allow the binary to run.
+</Note>
+
+
+**Creating the mserv config file**
+
+1. Create a file (we'll call it `python-demo.mservctl.yaml`)
+2. Copy your Control Plane File Server endpoint URL and use it for your `endpoint` flag. Remember to prepend it with `https://`.
+3. Copy your File Server API Key and use it for your `token` flag
+
+Your `python-demo.mservctl.yaml` config file should now look like this:
+
+```.yaml
+endpoint: https://agreeable-native-mgw.usw2.ara-staging.tyk.technology/mserv
+token: eyJvcmciOiI1ZWIyOGUwY2M3ZDc4YzAwMDFlZGQ4ZmYiLCJpZCI6ImVmMTZiNGM3Y2QwMDQ3Y2JhMTAxNWIyOTUzZGRkOWRmIiwiaCI6Im11cm11cjEyOCJ9
+```
+
+**Uploading To Your S3 Bucket**
+
+1. We are going to use the MacOS binary here, just substitute the binary name for the Linx version if using that OS. Note we have our YAML config file in the same directory as our bundle.zip file. Run the following mserv `push` command:
+
+```.bash
+./mservctl.macos.amd64 --config ~/my-tyk-plugin/python-demo.mservctl.yaml push ~/my-tyk-plugin/bundle.zip
+```
+2. You should get confirmation that your middleware has been uploaded to your S3 bucket.
+
+```.bash
+INFO[0000] Using config file:/Users/marksouthee/my-tyk-plugin/python-demo.mservctl.yaml  app=mservctl
+Middleware uploaded successfully, ID: 9c9ecec1-8f98-4c3f-88cd-ca3c27599e6b
+```
+3. You will notice that the middleware uploaded has been given an ID. We are going to use that ID with an API that allows you to specify specific middlware. You can also check the contents of the middleware you have just uploaded using the mservctl `list` command. Run:
+
+```.bash
+./mservctl.macos.amd64 --config ~/my-tyk-plugin/python-demo.mservctl.yaml list
+```
+
+4. You will see the list of middleware you have pushed to your S3 Bucket
+
+```.bash
+INFO[0000] Using config file:/Users/marksouthee/my-tyk-plugin/python-demo.mservctl.yaml  app=mservctl
+  ID                                    ACTIVE  SERVE ONLY  LAST UPDATE
+
+  9c9ecec1-8f98-4c3f-88cd-ca3c27599e6b  true    false       2020-05-20T15:06:55.901Z
+  ```
+5. If you use the -f flag with the list command, you will see the functions within your middleware listed:
+
+```.bash
+./mservctl.macos.amd64 --config ~/my-tyk-plugin/python-demo.mservctl.yaml list -f
+```
+6. As you can see, the 2 middleware hooks specified within your `manifest.json` are returned:
+
+```.bash
+INFO[0000] Using config file:/Users/marksouthee/my-tyk-plugin/python-demo.mservctl.yaml  app=mservctl
+  ID                                    ACTIVE  SERVE ONLY  LAST UPDATE               FUNCTION          TYPE
+
+  9c9ecec1-8f98-4c3f-88cd-ca3c27599e6b  true    false       2020-05-20T15:06:55.901Z
+  MyPostMiddleware  Post
+  MyAuthMiddleware  CustomKeyCheck
+```
+
+Next you will [create an API](#test-middleware) from our Control Plane and see our middleware in action.
+
+## Test Middleware
+
+This section explains how to test out your Python custom authentication on Tyk Cloud, to ensure that it’s working properly. 
+
+**Testing our middleware with an API**
+
+You now have your middleware uploaded to your S3 bucket. We are now going to create an API from our Control Plane Dashboard and test it via Postman
+
+**Prerequisites**
+
+* A Postman API Client from https://www.postman.com/product/api-client/
+* Your mserv middleware ID
+* The `auth` value token from your `middleware.py` code
+
+**Create your API**
+
+1. From your Control Plane in Tyk Cloud, click the *Ingress > Dashboard link*
+
+<img src="/img/plugins/control_plane_dashboard_link.png" alt="Dashboard Link" />
+
+2. From the Dashboard screen, click **APIs** from the System Management menu
+
+<img src="/img/plugins/apis_menu.png" alt="APIs Menu" />
+
+3. Click **Add New API**
+4. From the API Designer, enter the following in the **Core Settings** tab:
+   * From the API Settings section, give your API a name. We'll name this example "test"
+   * Scroll down to the Authentication section and select **Custom authentication (Python, CoProcess and JSVM plugins)** from the drop-down menu
+   * Select the **Allow query parameter as well as header** option
+5. From the Advanced Settings tab enter the following:
+   * In the Plugin Options, enter the **Plugin Bundle ID** as returned by mservctl. In our example `9c9ecec1-8f98-4c3f-88cd-ca3c27599e6b`
+   * To propagate your API to all your Cloud Data Plane Tyk Gateways connected to your Control Plane, you need to add the tag **edge** in the **API Segment Tags section**
+6. Click **Save**.
+
+You now have an API called "test" which has as its target the httpbin test site.
+
+**Testing Your API**
+
+You now need to test your API to show how the Python Authorization middleware works. We are going to use the Postman client for our testing.
+
+1. First, a quick test. Copy the URL of your Cloud Data Plane (Note the "edge" tag in the tags column) and paste it in a browser tab. You should get a **404 page not found error**.
+2. Then add the "test" endpoint to the URL in your browser tab, so in our example `uptight-paddle-gw.usw2.ara.app/test/`. You should now see a **403 "error: "forbidden"**. This is because your API has Authentication enabled and you haven't provided the credentials yet.
+3. Open up your Postman client:
+   * Paste your Gateway URL with the API appended to the request - (`uptight-paddle-gw.usw2.ara.app/test/`)
+   * Click **Send**. You'll see the **403 "error: "forbidden response"** again
+   * In the Headers section in Postman, select **Authorization** from the Key column. Add some random text in the Value field and click **Send**. You should again see the **403 error**.
+   * Now replace the random text with the `auth` value from your Python code. In our example `47a0c79c427728b3df4af62b9228c8ae` and click **Send** again.
+   * You should now see the **HTTPB** in test page
+
+<img src="/img/plugins/postman_success.png" alt="Postman Success" />
+
+4. As a further test of your plugin, you can add `get` to your API request in Postman. So in our example `uptight-paddle-gw.usw2.ara.app/test/get`. Click **Send**. This will return all the get requests, including headers. You should see the `x-tyk-request: "something"` which is the post middleware hook you set up in the Python code.
+
+<img src="/img/plugins/postman_all_get_requests.png" alt="Postman All Get Requests" />
+
+## Serving Plugin Bundles To Hybrid Gateways
+
+If you have already configured custom plugins for your Tyk Cloud Control Plane, you can also configure your Hybrid or self-managed Data Planes to load the same plugin bundles from the Tyk Cloud File Server, instead of hosting a separate web server or S3 bucket for them.
+
+Plugins must be enabled on your Tyk Cloud Control Plane, as described in [Setup Control Plane](#setup-control-plane). Tyk Cloud only deploys the File Server, and exposes its API, once plugins are enabled on the Control Plane.
+
+To enable this, add the following to the Hybrid Gateway's `tyk.conf`:
+
+```json
+"enable_bundle_downloader": true,
+"bundle_base_url": "your-control-plane-file-server-url/mserv/api/mw/bundle?api_key=your_fileserver_api_key"
+```
+
+`bundle_base_url` must point at your Tyk Cloud Control Plane's File Server endpoint, with the `/mserv/api/mw/bundle` path and your File Server API key passed as the `api_key` query parameter. You can find both values on your Control Plane, as described in [Uploading your Bundle](#uploading-your-bundle).
+
+<Note>
+Treat this URL as a secret. Because the API key is passed as a query parameter rather than a header, it can end up in Gateway startup logs or any proxy/load balancer logs sitting in front of the File Server. Restrict access to those logs, and rotate the key if it may have been exposed.
+</Note>
+
+If your plugin bundle includes rich plugins (Python, Lua, or gRPC), also set `"enable_coprocess": true` in the Hybrid Gateway's `tyk.conf`, as described in [Gateway configuration](/api-management/plugins/overview#gateway-configuration).
+
+For example:
+
+```json
+"bundle_base_url": "https://solid-month-mgw.aws-use1.cloud-ara.tyk.io/mserv/api/mw/bundle?api_key=abcd1234"
+```
+
+<Note>
+- File server traffic from Hybrid Gateways is billable and counts toward your monthly traffic quota.
+- If you rotate the File Server API key, update it in every Hybrid Gateway configuration that references it.
+- On startup, Tyk Gateway downloads plugin bundles from the File Server before the affected APIs become available. Depending on the Hybrid Gateway's location and its latency to the File Server, this can increase the time taken for APIs to become ready.
+</Note>
diff --git a/tyk-components.mdx b/tyk-components.mdx
new file mode 100644
index 0000000000..30db49e332
--- /dev/null
+++ b/tyk-components.mdx
@@ -0,0 +1,242 @@
+---
+title: "Tyk Components"
+description: "An overview of the core components that make up the Tyk API Management platform"
+keywords: "Tyk API Management, Getting Started, Tutorials"
+order: 5
+sidebarTitle: "Tyk Components"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+
+## Understanding Tyk’s API Management Components
+
+Tyk offers a full ecosystem of API management tools, supporting every stage of the API lifecycle—from development and deployment to monitoring and scaling. With Tyk’s components, teams can seamlessly integrate, secure, and scale APIs across different environments, facilitating robust and reliable API operations.
+
+---
+
+## Tyk’s API Management Components Overview
+
+Below is a detailed introduction to each of Tyk’s components and their individual roles within an API management strategy. For more information, follow the links provided to explore specific documentation on each component.
+
+
+<ResponsiveGrid>
+
+
+<Card title="Tyk Gateway" href="/tyk-components#tyk-gateway">
+The open-source core of Tyk that handles request routing, rate-limiting, and caching.
+</Card>
+
+<Card title="Tyk Dashboard" href="/tyk-components#tyk-dashboard">
+A powerful interface for managing and monitoring APIs, users, and permissions.
+</Card>
+
+<Card title="Tyk Enterprise Developer Portal" href="/tyk-components#tyk-enterprise-developer-portal">
+A customizable portal for enabling API discovery and user self-service.
+</Card>
+
+<Card title="Tyk Multi Data Centre Bridge" href="/tyk-components#tyk-multi-data-centre-bridge-mdcb">
+Enables centralized API management across distributed data centers for global reach and compliance.
+</Card>
+
+<Card title="Tyk Pump" href="/tyk-components#tyk-pump">
+Aggregates and exports API analytics from Gateway to enable insights and advanced monitoring.
+</Card>
+
+<Card title="Tyk Operator" href="/tyk-components#tyk-operator">
+Integrates with Kubernetes for seamless API management within containerized environments.
+</Card>
+
+<Card title="Tyk Streams" href="/tyk-components#tyk-streams">
+Enables real-time event streaming for APIs, ideal for push notifications and live data.
+</Card>
+
+<Card title="Tyk Sync" href="/tyk-components#tyk-sync">
+Synchronizes API configurations across environments for consistency and streamlined deployments.
+</Card>
+
+<Card title="Tyk Identity Broker" href="/tyk-components#tyk-identity-broker">
+Facilitates single sign-on (SSO) and integrates external identity providers with APIs.
+</Card>
+
+<Card title="Tyk Helm Charts" href="/tyk-components#tyk-helm-charts">
+Provides templated configurations to simplify deploying Tyk in Kubernetes.
+</Card>
+
+<Card title="Universal Data Graph" href="/tyk-components#universal-data-graph-udg">
+Combines multiple data sources into a unified API, supporting GraphQL and REST.
+</Card>
+
+
+</ResponsiveGrid>
+
+---
+
+### Tyk Gateway
+
+The **[Tyk Gateway](/tyk-oss-gateway)** is the core of Tyk’s API management platform. This open-source, high-performance API gateway handles crucial API tasks:
+
+- **Traffic Management**: Routes requests to backend services, balancing loads and ensuring high availability.
+- **Security and Authentication**: Supports OAuth2, JWT, OpenID Connect, and other protocols to secure APIs.
+- **Rate Limiting and Quotas**: Controls traffic volume to prevent abuse and ensure fair usage.
+- **Analytics**: Tracks API usage patterns and provides insights into performance and engagement.
+
+The Gateway is the primary component managing and securing all API interactions, making it an essential part of any API management strategy.
+
+---
+
+### Tyk Dashboard
+
+The **[Tyk Dashboard](/api-management/dashboard-configuration)** is a GUI interface for managing, monitoring, and configuring APIs. It integrates with the Tyk Gateway and offers centralized control for all API operations:
+
+- **Design APIs**: Set up endpoints, security policies, and access controls.
+- **Monitor API Usage**: View real-time analytics to track API performance and identify trends.
+- **User and Team Management**: Configure multi-tenancy and manage team-based access control.
+
+The Tyk Dashboard simplifies API management, enabling teams to effectively administer API policies and monitor activity.
+
+---
+
+### Tyk Enterprise Developer Portal
+
+The **[Tyk Developer Portal](/portal/overview/intro)** provides a self-service interface for developers to access and interact with APIs. Key functionalities include:
+
+- **API Documentation**: Supplies developers with detailed API documentation, making integration easier.
+- **Self-Service Access**: Developers can register, request API keys, and manage subscriptions independently.
+- **Community Engagement**: Features like FAQs and forums foster a collaborative developer community.
+
+The Developer Portal streamlines API adoption by offering developers a comprehensive platform for API discovery and self-service.
+
+---
+
+### Tyk Multi Data Centre Bridge (MDCB)
+
+The **[Tyk Multi Data Centre Bridge (MDCB)](/api-management/mdcb)** enables centralized control over API configurations across distributed regions or data centers. It’s ideal for global API infrastructure, offering:
+
+- **Centralized Management**: Controls API configurations across different regions from a single interface.
+- **Data Isolation**: Supports regulatory compliance by keeping data within specified regions.
+- **Enhanced Resilience**: Ensures high availability for distributed API deployments.
+
+MDCB is designed for organizations with extensive geographic reach, supporting both global distribution and local compliance.
+
+---
+
+### Tyk Pump
+
+**[Tyk Pump](/api-management/tyk-pump)** is a lightweight tool that aggregates API analytics from the Tyk Gateway and exports them to various storage systems for analysis:
+
+- **Data Collection**: Continuously gathers real-time API analytics.
+- **Data Export**: Integrates with multiple backends like Splunk, Prometheus, ElasticSearch, and others.
+- **Actionable Insights**: Enables advanced monitoring and analysis for data-driven decision-making.
+
+With Tyk Pump, you can leverage powerful insights into API usage, helping teams optimize API performance and improve user experience.
+
+---
+
+### Tyk Operator
+
+The **[Tyk Operator](/api-management/automations/operator#what-is-tyk-operator)** is a Kubernetes-native API management solution, allowing teams to deploy and manage APIs as Kubernetes resources:
+
+- **Kubernetes Integration**: Simplifies API management within Kubernetes environments.
+- **Declarative Configuration**: Supports automated, scalable, and resilient API deployments.
+- **CI/CD Integration**: Ideal for development teams with continuous integration and deployment workflows.
+
+For teams operating within Kubernetes, Tyk Operator integrates seamlessly, providing a consistent way to manage API resources.
+
+---
+
+### Tyk Streams
+
+**[Tyk Streams](/api-management/event-driven-apis#)** is Tyk’s real-time data streaming tool for APIs, enabling applications to receive data as events happen:
+
+- **Real-Time Data**: Pushes live data to clients in real time.
+- **Event-Driven Architecture**: Triggers immediate responses to data changes.
+- **Scalability**: Manages high-frequency data flows, scaling to meet demand.
+
+Tyk Streams is ideal for use cases like financial services, IoT, and live applications requiring rapid data updates.
+
+---
+
+### Tyk Sync
+
+**[Tyk Sync](/api-management/automations/sync)** facilitates configuration synchronization, helping teams manage API configurations across different environments:
+
+- **Configuration Consistency**: Synchronizes API settings across development, staging, and production.
+- **DevOps Compatibility**: Integrates with CI/CD pipelines for seamless deployment.
+- **Backup and Restore**: Maintains backups of API configurations to prevent data loss.
+
+Tyk Sync ensures that API configurations are consistent and reliable across environments, supporting streamlined operations and effective change management.
+
+---
+
+### Tyk Identity Broker
+
+The **[Tyk Identity Broker](/tyk-identity-broker/overview)** simplifies authentication by connecting APIs with external identity providers (IDPs), supporting single sign-on (SSO) capabilities:
+
+- **Authentication Integration**: Works with IDPs like Google, Microsoft, and LDAP.
+- **Secure Access Control**: Manages API access for verified users.
+- **Token-Based Access**: Issues tokens for authenticated users, enabling controlled API access.
+
+The Identity Broker centralizes identity and access management, making it easier to secure APIs and manage user authentication across multiple systems.
+
+---
+
+### Tyk Helm Charts
+
+**[Tyk Helm Charts](/product-stack/tyk-charts/overview)** provide templated configurations for deploying Tyk components in Kubernetes, enabling efficient setup and management:
+
+- **Efficient Deployment**: Simplifies installation and configuration within Kubernetes clusters.
+- **Version Control**: Manages versioning and consistency across deployments.
+- **Standardization**: Ensures uniform setups across environments, improving reliability.
+
+Tyk Helm Charts are particularly useful for teams deploying Tyk in Kubernetes, streamlining installation and ensuring consistent configurations.
+
+---
+
+### Universal Data Graph (UDG)
+
+The **[Universal Data Graph (UDG)](/api-management/data-graph#overview)** provides a single API endpoint for accessing data from multiple sources using GraphQL, offering:
+
+- **Data Aggregation**: Combines data from disparate sources into a unified API.
+- **Customizable Data Access**: Clients can query only the data they need.
+- **Secure Data Management**: Implements access controls to manage data permissions.
+
+The UDG simplifies complex data interactions, enabling developers to work with a unified GraphQL endpoint for various backend services.
+
+---
+
+## How Tyk’s Components Work Together
+
+Tyk’s components create a unified API management ecosystem, covering all aspects of API lifecycle management:
+
+- **Traffic and Security**: The Tyk Gateway acts as the first line of defense, handling traffic and enforcing security protocols.
+- **Configuration and Deployment**: Tyk Dashboard, Tyk Operator, and Tyk Sync provide tools for managing, deploying, and scaling APIs.
+- **Developer Experience**: The Tyk Developer Portal and Identity Broker enhances the developer experience, promoting API discovery and user engagement.
+- **Global Reach and Resilience**: MDCB ensures consistent API configurations and high availability across regions.
+- **Data and Insights**: Tyk Gateway's native support for OpenTelemetry, combined with Tyk Pump, enables real-time monitoring and analytics.
+- **Unified Access**: UDG and Tyk Streams unify API Management by enabling seamless, multi-protocol data integration and delivery.
+- **Kubernetes Deployment**: Tyk Helm Charts simplifies deployment of Tyk on Kubernetes.
+
+## Conclusion
+
+Now that you’ve been introduced to the Tyk suite, you have a strong foundation in understanding how each component fits into a complete API management ecosystem. Whether you’re ready to start deploying APIs, securing them, or scaling across multiple environments, Tyk provides the tools and flexibility to bring your API projects to life.
+
+## Where to Go Next
+
+1. **[Getting Started with Tyk Gateway](/tyk-oss-gateway)**  
+   Start by setting up the Tyk Gateway, where you’ll configure your first API and explore the foundational capabilities of traffic management, security, and monitoring.
+
+2. **[Set Up and Configure the Tyk Dashboard](/api-management/dashboard-configuration)**  
+   Dive into the Tyk Dashboard to manage your API lifecycle from a user-friendly interface, allowing you to monitor, configure, and scale your APIs with ease.
+
+3. **[Explore API Security](/api-management/client-authentication)**  
+   Secure your APIs with Tyk’s robust authentication options like OAuth2, JWT, and HMAC, and learn how to apply rate limiting and quota policies to protect your resources.
+
+4. **[Implement Multi-Region Deployments with MDCB](/api-management/mdcb)**  
+   If your infrastructure requires high availability and global reach, explore Tyk’s Multi Data Centre Bridge to deploy and manage APIs across different regions.
+
+5. **[Use Tyk Sync for Consistent Configuration Management](/api-management/automations/sync)**  
+   For development teams working across environments, Tyk Sync offers a way to manage API configurations consistently, supporting CI/CD workflows and minimizing deployment errors.
+
+6. **[Explore Tyk Developer Portal for Enhanced Developer Experience](/portal/overview/intro)**  
+   Provide external and internal developers with easy access to your APIs by setting up the Developer Portal, where they can find documentation, request access, and get started quickly.
+
diff --git a/tyk-configuration-reference/kv-store.mdx b/tyk-configuration-reference/kv-store.mdx
new file mode 100644
index 0000000000..6803dd7209
--- /dev/null
+++ b/tyk-configuration-reference/kv-store.mdx
@@ -0,0 +1,529 @@
+---
+title: "Using external Key Value storage with Tyk"
+description: "Learn how to use external Key-Value storage with Tyk Gateway, including Consul and Vault, to manage configuration data and secrets."
+sidebarTitle: "Key Value Store"
+---
+
+## Introduction
+
+With Tyk Gateway you can store configuration data (typically authentication secrets or upstream server locations) in Key-Value (KV) systems such as [Vault](#vault), [Consul](#consul), and [local files](#local-files) and then reference these values during configuration of the Tyk Gateway or APIs deployed on the Gateway.
+
+## When to use external Key-Value storage
+
+### Simplify migration of APIs between environments
+
+Easily manage and update secrets and other configuration across multiple environments (e.g., development, staging, production) without modifying the configuration files.
+
+### Ensure separation of concerns
+
+Securely store sensitive information such as API keys, passwords, and certificates in a centralized location. Not everybody needs access to these secrets: authorized people can maintain them and just pass along the reference used to access them from the KV store.
+
+### Support per-machine variables
+
+Storing local settings within the Tyk Gateway's configuration file allows you to have per instance variables, such as a machine ID, and inject these into API requests and responses using [transformation middleware](/api-management/traffic-transformation).
+
+## How external Key-Value storage works
+
+There are two parts to external Key-Value storage - the KV store and the Tyk configuration object (API definition or Tyk Gateway config file).
+
+1. The key-value data that you wish to reference should be added to the storage
+2. References should be included within the Tyk configuration object that identify the location (KV store) and Key
+3. When Tyk Gateway initialises it will resolve any external KV references in its configuration, retrieving and applying the values from those references
+4. When Tyk Gateway loads (or reloads) APIs it will resolve any external KV references in the API definitions, retrieving and applying the values from those references
+
+KV references in API definitions are retrieved when the API is loaded or reloaded. Changes to the externally stored value are picked up on the next gateway hot-reload.
+
+KV references in the Tyk Gateway configuration file (`tyk.conf`) are retrieved at gateway startup only. A full gateway restart is required to pick up changes to those values. The exception is `external_services.oauth.mtls.cert_file`, `external_services.oauth.mtls.key_file`, and `external_services.oauth.mtls.ca_file`, which are resolved again on each hot-reload.
+
+The exception to both of the above is for specific [transformation middleware](#transformation-middleware) where the value will be retrieved for each call to the API, during the processing of the API request or response.
+
+
+<Note>
+If a KV reference cannot be resolved at load time (for example, because the KV store is unreachable or the file cannot be read), Tyk Gateway logs an error and continues to load. The unresolved reference string (such as `consul://mykey` or `file://path/to/file`) remains in place as the literal value of the field.
+
+For [transformation middleware](#transformation-middleware), if a `$secret_*` reference cannot be resolved at request time, Tyk Gateway replaces it with an empty string and continues to process the request.
+</Note>
+
+
+## Supported storage options
+
+Tyk Gateway supports the following locations for storage of key-value data, providing flexibility to choose the most suitable approach for your deployment and the data you are storing:
+
+### Consul
+
+HashiCorp [Consul](https://www.consul.io) is a service networking solution that is used to connect and configure applications across dynamic, distributed infrastructure. Consul KV is a simple Key-Value store provided as a core feature of Consul that can be used to store and retrieve Tyk Gateway configuration across multiple data centers.
+- to retrieve the value assigned to a `KEY` in Consul you will use `consul://KEY` or `$secret_consul.KEY` notation depending on the [location](#how-to-access-the-externally-stored-data) of the reference.
+
+### Vault
+
+[Vault](https://vaultproject.io) from Hashicorp is a tool for securely accessing secrets. It provides a unified interface to any secret while providing tight access control and recording a detailed audit log. Tyk Gateway can use Vault to manage and retrieve sensitive secrets such as API keys and passwords.
+- to retrieve the value assigned to a `KEY` in Vault you will use `vault://KEY` or `$secret_vault.KEY` notation depending on the [location](#how-to-access-the-externally-stored-data) of the reference.
+
+### Tyk Gateway Config File
+
+The [`secrets`](/tyk-oss-gateway/configuration#secrets) section in the Tyk Gateway configuration file allows you to store settings that are specific to a single Tyk Gateway instance. This is useful for storing instance-specific configuration to be injected into API middleware or if you prefer using configuration files.
+- to retrieve the value assigned to a `KEY` in the `secrets` config you will use `secrets://KEY` or `$secret_conf.KEY` notation depending on the [location](/tyk-oss-gateway/configuration#secrets) of the reference.
+
+### Environment Variables
+
+Tyk Gateway can access data declared in environment variables. This is a simple and straightforward way to manage secrets, especially in containerized environments such as Docker or Kubernetes.
+- if you want to set the local "secrets" section (equivalent to the `secrets` section in the [Gateway config file](#how-to-access-the-externally-stored-data)) using environment variables, you should use the following notation: `TYK_GW_SECRETS=key:value,key2:value2`.
+- if you’re using a different key value secret store not explicitly supported by Tyk but can map it to `TYK_GW_SECRETS`, this will allow you to access those KV data.
+- to retrieve the value assigned to an environment variable `VAR_NAME` you will use `env://VAR_NAME` or `$secret_env.VAR_NAME` notation depending on the [location](#how-to-access-the-externally-stored-data) of the reference.
+
+### Local Files
+
+From **Tyk Gateway 5.14.0**, KV values can be read directly from files on the local filesystem. This is particularly useful in Kubernetes deployments where secrets are mounted as files on the data plane pod (for example, via a [Kubernetes secret volume](https://kubernetes.io/docs/concepts/configuration/secret/)). The Control Plane never needs to store or transmit the secret material.
+
+- to retrieve the contents of a file at relative path `PATH` you will use `file://PATH` or `$secret_file.PATH` notation depending on the [location](#how-to-access-the-externally-stored-data) of the reference.
+- all file paths are relative to `kv.file.base_path` configured in `tyk.conf`; absolute paths in references are not permitted.
+
+## How to access the externally stored data
+
+You can configure Tyk Gateway to retrieve values from KV stores in the following places:
+- Tyk Gateway configuration file (`tyk.conf`)
+- API definitions
+
+
+
+    <Note>
+    You can use keys from different KV stores (e.g. Consul and environment variables) in the same configuration object (Gateway config or API definition).
+    </Note>
+
+
+### From the Tyk Gateway configuration file
+
+In Tyk Gateway's configuration file (`tyk.conf`), you can retrieve values from KV stores for the following [fields](/tyk-oss-gateway/configuration):
+- `secret`
+- `node_secret`
+- `storage.password`
+- `cache_storage.password`
+- `security.private_certificate_encoding_secret`
+- `db_app_conf_options.connection_string`
+- `policies.policy_connection_string`
+- `slave_options.api_key`
+
+From Tyk 5.13.0 the following fields can also contain KV references. Unlike other Tyk Gateway config fields, these are resolved again on each hot-reload.
+- `external_services.oauth.mtls.cert_file`
+- `external_services.oauth.mtls.key_file`
+- `external_services.oauth.mtls.ca_file`
+
+To reference the *Value* assigned to a *Key* in one of the KV stores from the Gateway configuration file use the following notation:
+- Consul: `consul://path/to/key`
+- Vault: `vault://path/to/secret.key`
+- `tyk.conf` secrets: `secrets://key`
+- Environment variables: `env://key`
+- Local files: `file://relative/path/to/file`
+
+For example, if you create a Key-Value pair in [Vault](#vault) with the *key* `shared-secret` in *secret* `gateway-dashboard` within directory `tyk-secrets/` then you could use the *Value* as the `node_secret` in your Gateway config by including the following in your `tyk.conf` file:
+``` .json
+{
+  "node_secret":"vault://tyk-secrets/gateway-dashboard.shared-secret"
+}
+```
+When the Gateway starts, Tyk will read the *Value* from Vault and use this as the `node_secret`, which is used to [secure connection to the Tyk Dashboard](/tyk-oss-gateway/configuration#node_secret).
+
+Note that all of these references are read (and replaced with the values read from the KV location) on Gateway start when loading the `tyk.conf` file.
+
+### From API Definitions
+
+From Tyk Gateway v5.3.0 onwards, you can store [any string field](#other-string-fields) from the API definition in any of the supported KV storage options; for earlier versions of Tyk Gateway only the [Target URL and Listen Path](#target-url-and-listen-path) fields and [certain transformation middleware](#transformation-middleware) configurations were supported. 
+
+#### Target URL and Listen Path
+
+To reference the *Value* assigned to a *Key* in one of the KV stores for **Target URL** or **Listen Path** use the following notation:
+- Consul: `consul://path/to/key`
+- Vault: `vault://path/to/secret.key`
+- Tyk config secrets: `secrets://key`
+- Environment variables: `env://key`
+- Local files: `file://relative/path/to/file`
+
+These references are read (and replaced with the values read from the KV location) when the API is loaded to the Gateway (either when Gateway restarts or when there is a hot-reload).
+
+For example, if you define an environment variable (*Key*) `UPSTREAM_SERVER_URL` with the *Value* `http://httpbin.org/` then within your API definition you could use the *Value* for the Target URL for your Tyk OAS API as follows:
+```json
+{
+  "x-tyk-api-gateway": {
+    "upstream": {
+      "url": "env://UPSTREAM_SERVER_URL"
+    }
+  }
+}
+```
+
+When the Gateway starts, Tyk will read the *Value* from the environment variable and use this as the [Target URL](/api-management/gateway-config-tyk-oas#upstream).
+
+
+<Note>
+Prior to Tyk Gateway v5.3.0, **environment variables** used for the Target URL or Listen Path had to be named `TYK_SECRET_{KEY_NAME}`. They were referred to in the API definition using `env://{KEY_NAME}` excluding the `TYK_SECRET_` prefix.
+<br /><br />
+From v5.3.0 onward, environment variables can have any `KEY_NAME`, and the full name should be provided in the API definition reference. The pre-v5.3.0 naming convention is still supported for backward compatibility, but only for these two fields.
+</Note>
+
+
+#### Transformation Middleware
+
+Key-value references can be included in the following middleware, with the values retrieved dynamically when the middleware is called (during processing of an API request or response):
+- [request body transform](/api-management/traffic-transformation/request-body)
+- [request header transform](/api-management/traffic-transformation/request-headers)
+- [URL rewrite](/transform-traffic/url-rewriting)
+- [response body transform](/api-management/traffic-transformation/response-body)
+- [response header transform](/api-management/traffic-transformation/response-headers)
+
+To reference the *Value* assigned to a *Key* in one of the KV stores from these middleware use the following notation:
+- Consul: `$secret_consul.key`
+- Vault: `$secret_vault.key`
+- Tyk config secrets: `$secret_conf.key`
+- Environment variables: `$secret_env.key` or `env://key` (see [here](#using-environment-variables-with-transformation-middleware))
+- Local files: `$secret_file.relative/path/to/file`
+
+This notation is used to avoid ambiguity in the middleware parsing (for example where a KV secret is used in a URL rewrite path).
+
+For example, if you create a Key-Value pair in Consul with the *Key* `user_id` then you could use the *Value* in the `rewriteTo` upstream address in the URL rewrite middleware for your Tyk OAS API by including the following in your API definition:
+```json
+{
+  "x-tyk-api-gateway": {
+      "middleware": {
+          "operations": {
+              "anythingget": {
+                  "urlRewrite": {
+                      "enabled": true,
+                      "pattern": ".*",
+                      "rewriteTo": "/api/v1/users/$secret_consul.user_id",
+                  }
+              }
+          }
+      }
+  }
+}
+```
+
+When a call is made to `GET /anything`, Tyk will retrieve the *Value* assigned to the `user_id` *Key* in Consul and rewrite the Target URL for the request to `/api/v1/users/{user_id}`.
+
+These references are read (and replaced with the values read from the KV location) during the processing of the API request or response.
+
+##### Using Environment Variables with Transformation Middleware
+
+There are some subtleties with the use of environment variables as KV storage for the transformation middleware.
+
+- **Request and Response Body Transforms** support only the `$secret_env.{KEY_NAME}` format.
+- **Request and Response Header Transforms** support both `env://{KEY_NAME}` and `$secret_env.{KEY_NAME}` formats.
+- **URL Rewrite** supports the `env://{KEY_NAME}` format for both the `pattern` and `rewriteTo` fields. The `rewriteTo` field also supports `$secret_env.{KEY_NAME}` format.
+
+
+
+    <Note>
+    **Notes**  
+
+    Due to the way that Tyk Gateway processes the API definition, when you use transformation middleware with the `$secret_env` format, it expects the environment variable to be named `TYK_SECRET_{KEY_NAME}` and to be referenced from the API definition using `$secret_env.{KEY_NAME}`.
+    <br /><br />
+    For example, if you create a Gateway environment variable `TYK_SECRET_NEW_UPSTREAM=http://new.upstream.com`, then in a request body transform middleware, you would reference it as follows:
+
+    ```json
+    {
+      "custom_url": "$secret_env.NEW_UPSTREAM"
+    }
+    ```
+
+    To configure the URL rewrite `rewriteTo` field using this variable you could use either:
+
+    ````json
+    {
+      "rewriteTo": "env://TYK_SECRET_NEW_UPSTREAM"
+    }
+    ````
+    or
+    ````json
+    {
+      "rewriteTo": "$secret_env.NEW_UPSTREAM"
+    }
+    ````
+    </Note>
+
+
+#### Other `string` fields
+
+To reference the *Value* assigned to a *Key* in one of the KV stores from the API Definition use the following notation:
+- Consul: `consul://key`
+- Vault: `vault://secret.key`
+- Tyk config secrets: `secrets://key`
+- Environment variables: `env://key`
+- Local files: `file://relative/path/to/file`
+
+These references are read (and replaced with the values read from the KV location) when the API is loaded to the Gateway (either when Gateway restarts or when there is a hot-reload).
+
+
+<Note>
+**Notes**  
+
+When accessing KV references from the `/tyk-apis` directory on Consul or Vault, you should not provide the `path/to/` the key except for Target URL and Listen Path (as described [above](#target-url-and-listen-path)).
+</Note>
+
+
+For example, if you create a Key-Value pair in the `secrets` section of the `tyk.conf` file with the *Key* `auth_header_name`:
+```json
+{
+  "secrets": {
+    "auth_header_name": "Authorization"
+  }
+}
+```
+
+Then within your API definition you could use the *Value* for the authentication header name as follows:
+```json
+{
+  "x-tyk-api-gateway": {
+    "components": {
+      "securitySchemes": {
+        "authToken": {
+          "type": "apiKey",
+          "in": "header",
+          "name": "secrets://auth_header_name"
+        }
+      }
+    }
+  }
+}
+```
+
+When the Gateway starts, Tyk will read the *Value* from the `secrets` section in the Gateway config file and use this to identify the header where Tyk Gateway should look for the [Authentication](/api-management/gateway-config-tyk-oas#authentication) token in requests to your Tyk OAS API.
+
+## Using Consul as a KV store
+
+HashiCorp [Consul](https://www.consul.io) is a service networking solution that is used to connect and configure applications across dynamic, distributed infrastructure. Consul KV is a simple Key-Value (KV) store provided as a core feature of Consul that can be used to store and retrieve Tyk Gateway configuration across multiple data centers.
+
+### How to Configure Tyk to Access Consul
+
+Configuring Tyk Gateway to read values from Consul is straightforward - you simply configure the connection in your Tyk Gateway config file (`tyk.conf`) by adding the `kv` section as follows:
+
+```json
+{
+    "kv": {
+        "consul": {
+            "address": "localhost:8025",
+            "scheme": "http",
+            "datacenter": "dc-1",
+            "http_auth": {
+                "username": "",
+                "password": ""
+            },
+            "wait_time": 10,
+            "token": "",
+            "tls_config": {
+                "address": "",
+                "ca_path": "",
+                "ca_file": "",
+                "cert_file": "",
+                "key_file": "",
+                "insecure_skip_verify": false
+            }
+        }
+    }
+}
+```
+
+| Key        | Description                                                                                                 |
+| :------------ | :------------------------------------------------------------------------------------------------------------- |
+| address    | The location of the Consul server                                                                           |
+| scheme     | The URI scheme for the Consul server, e.g. `http`                                                          |
+| datacenter | Consul datacenter (agent) identifier                                                                       |
+| http_auth  | Username and password for Tyk to log into Consul using HTTP Basic Auth (if required by your Consul service) |
+| wait_time  | Limits how long a [watch will block](https://developer.hashicorp.com/consul/api-docs/features/blocking) in milliseconds (if enabled in your Consul service) |
+| token      | Used to provide a per-request access token to Consul (if required by your Consul service)                   |
+| tls_config | Configuration for TLS connection to Consul (if enabled in your Consul service)                              |
+
+Alternatively, you can configure it using the equivalent [environment variables](/tyk-oss-gateway/configuration#kv-consul-address).
+
+### Where to Store Data in Consul
+
+When you want to reference KV data from Tyk Gateway config or transform middleware, you can store your KV pairs wherever you like within the Consul KV store. You can provide the Consul path to the key in the reference using the notation appropriate to the calling [location](#consul).
+
+From Tyk Gateway 5.3.0, you can reference KV data from any `string` field in the API definition. For these you should create a folder named `tyk-apis` in the root of your Consul KV store and store all keys in a flat structure there (sub-directories not currently supported). You should not include the `tyk-apis` path in the reference so, for example, given a key-value pair `"foo":"bar"` stored in `tyk-apis` in Consul, you would reference this from the API definition using `consul://foo`.
+
+### How to Access Data Stored in Consul
+
+The notation used to refer to a KV pair stored in Consul depends upon the location of the reference as follows.
+
+**Tyk Gateway configuration file**
+
+As described [here](#from-the-tyk-gateway-configuration-file), from Tyk Gateway's configuration file (`tyk.conf`) you can retrieve values from Consul using the following notation:
+- `consul://path/to/KEY`
+
+**API definition**
+
+The **Target URL** and **Listen Path** key-value pairs can be stored in any directory in the Consul KV store as they are accessed using a different mechanism than other fields in the API definition. If storing these in a sub-directory, you can retrieve the values from Consul by providing the directory path within Consul KV using the following notation:
+- `consul://path/to/KEY`
+
+For [certain transformation middleware](#transformation-middleware) because the secret resolution happens during the request context, a different notation is used to retrieve values from Consul:
+- `$secret_consul.KEY`
+
+From Tyk Gateway v5.3.0 onwards, you can store KV pairs to be used in **any `string` field** in the API definition in the Consul KV store. You can retrieve these values from Consul, noting that you do not provide the directory path (`/tyk-apis`) when accessing data for *these* fields, using the following notation:
+- `consul://KEY`
+
+
+## Using Vault as a KV store
+
+
+[Vault](https://vaultproject.io) from Hashicorp is a tool for securely accessing secrets. It provides a unified interface to any secret while providing tight access control and recording a detailed audit log. Tyk Gateway can use Vault to manage and retrieve sensitive secrets such as API keys and passwords.
+
+### How to Configure Tyk to Access Vault
+
+Configuring Tyk Gateway to read values from Vault is straightforward - you simply configure the connection in your Tyk Gateway config file (`tyk.conf`) by adding the `kv` section as follows:
+
+```json
+{
+    "kv": {
+        "vault": {
+            "address": "http://localhost:1023",
+            "agent_address": "",
+            "max_retries": 3,
+            "timeout": 30,
+            "token": "",
+            "kv_version": 2
+        }
+    }
+}
+```
+
+| Key          | Description                                                                                            |
+| :-------------- | :-------------------------------------------------------------------------------------------------------- |
+| address      | The address of the Vault server, which must be a complete URL such as `http://www.vault.example.com`   |
+| agent_address | The address of the local Vault agent, if different from the Vault server, must be a complete URL       |
+| max_retries  | The maximum number of attempts Tyk will make to retrieve the value if Vault returns an error           |
+| timeout      | The maximum time that Tyk will wait for a response from Vault (in nanoseconds, if set to 0 (default) will be interpreted as 60 seconds)                                         |
+| token        | The Vault root access token                                                                            |
+| kv_version   | The version number of Vault, usually defaults to 2                                                     |
+
+Alternatively, you can configure it using the equivalent [environment variables](/tyk-oss-gateway/configuration#kv-vault-token).
+
+### How Key-Value Data Is Stored in Vault
+
+In traditional systems secrets are typically stored individually, each with their own unique key. Vault, however, allows for a more flexible approach where multiple *keys* can be grouped together and stored under a single *secret*. This grouping allows for better organization and management of related secrets, making it easier to retrieve and manage them collectively.
+
+When retrieving data from Vault, you use the dot notation (`secret.key`) to access the *value* from a specific *key* within a *secret*.
+
+**Example of storing key value data in Vault**
+
+If you want to store a *secret* named `tyk` with a *key* `gw` and *value* `123` in Vault then, from the command line, you would:
+1. Enable the `kv` secrets engine in Vault under the path `my-secret` using:  
+   `vault secrets enable -version=2 -path=my-secret kv`  
+2. Create a secret `tyk` with the key `gw` and value `123` in Vault:  
+   `vault kv put my-secret/tyk gw=123` 
+
+To retrieve the secret from Vault using the command line you would use the following command (there is no need to append `/data` to the secret path):
+```curl
+curl \
+  --header "X-Vault-Token: <your_vault_token>" \
+  --request GET \
+  https://vault-server.example.com/v1/my-secret/tyk?lease=true
+```
+
+This would return a response along these lines, note that the response contains all the keys stored in the secret (here there are also keys called `excited` and `foo`):
+```yaml
+{
+   "request_id": "0c7e44e1-b71d-2102-5349-b5c60c13fb02",
+   "lease_id": "",
+   "lease_duration": 0,
+   "renewable": false,
+   "data": {
+      "gw": "123",
+      "excited": "yes",
+      "foo": "world",
+   },
+   "metadata":{
+      "created_time": "2019-08-28T14:18:44.477126Z",
+      "deletion_time": "",
+      "destroyed": false,
+      "version": 1
+   },
+   "auth": ...
+}
+```
+
+As explained [below](#vault), you could retrieve this value from within your Tyk Gateway config file using: 
+   `TYK_GW_SECRET=vault://my-secret/tyk.gw`
+
+### Where to Store Data in Vault
+
+When you want to reference KV data from Tyk Gateway config or transform middleware, you can store your Vault *secrets* wherever you like within the KV store. You can provide the Vault path to the key in the reference using the notation appropriate to the calling [location](#vault).
+
+From Tyk Gateway 5.3.0, you can reference KV data from any `string` field in the API definition. For these you should create a folder named `tyk-apis` in the root of your Vault KV store and store all *secrets* in a flat structure there (sub-directories not currently supported). You should not include the `tyk-apis` path in the reference so, for example, given a key-value pair `"foo":"bar"` stored in a secret named `my-secret` in `/tyk-apis` in Vault, you would reference this from the API definition using `vault://my-secret.foo`.
+
+### How to Access Data Stored in Vault
+
+The notation used to refer to a key-value pair stored in Vault depends upon the location of the reference as follows.
+
+**Tyk Gateway configuration file**
+
+As described [here](#from-the-tyk-gateway-configuration-file), from Tyk Gateway's configuration file (`tyk.conf`) you can retrieve values from Vault using the following notation:
+- `vault://path/to/secret.KEY`
+
+**API definition**
+
+The **Target URL** and **Listen Path** key-value pairs can be stored in any directory in the Vault KV store as they are accessed using a different mechanism than other fields in the API definition. If storing these in a sub-directory, you can retrieve the values from Vault by providing the directory path within Consul KV using the following notation:
+- `vault://path/to/secret.KEY`
+
+For [certain transformation middleware](#transformation-middleware) because the secret resolution happens during the request context, a different notation is used to retrieve values from Vault:
+- `$secret_vault.KEY`
+
+From Tyk Gateway v5.3.0 onwards, you can store KV pairs to be used in **any `string` field** in the API definition in the Vault KV store. You can retrieve these values from Vault, noting that you do not provide the directory path (`/tyk-apis`) when accessing data for *these* fields, using the following notation:
+- `vault://KEY`
+
+## Using Local Files as a KV Store
+
+From Tyk Gateway 5.14.0, Tyk Gateway can resolve KV references to the contents of files on the local filesystem. This is designed for Kubernetes deployments where secrets (such as TLS certificates or API keys) are mounted as files on the data plane pod via a Kubernetes secret volume. The Control Plane never needs to store or transmit the secret material.
+
+### How to Configure Tyk to Access Local Files
+
+You must configure a `base_path` in the `kv.file` section of your Tyk Gateway config file (`tyk.conf`):
+
+```json
+{
+    "kv": {
+        "file": {
+            "base_path": "/etc/tyk/secrets"
+        }
+    }
+}
+```
+
+| Key         | Description |
+| :---------- | :---------- |
+| `base_path` | The absolute path to the directory from which file references are resolved. This field is required to enable file-based KV references; if not set, all `file://` and `$secret_file.` references are rejected. |
+
+`base_path` must be an absolute path. File references are resolved relative to this directory. Tyk Gateway enforces the following security constraints:
+
+- Absolute paths in references are rejected.
+- Path traversal using `..` is rejected.
+- Symlinks are followed, but only if the resolved path remains within `base_path`. This allows Kubernetes AtomicWriter symlinks (such as `..data`) to work correctly while preventing symlink escape attacks.
+
+### How to Access Data Stored in Local Files
+
+The notation used to refer to a file depends on the location of the reference.
+
+**Tyk Gateway configuration file**
+
+From Tyk Gateway's configuration file (`tyk.conf`) you can retrieve the contents of a file using the following notation:
+- `file://relative/path/to/file`
+
+**API definition**
+
+For **Target URL**, **Listen Path**, and any other `string` field in the API definition:
+- `file://relative/path/to/file`
+
+For [transformation middleware](#transformation-middleware), where resolution happens at request time:
+- `$secret_file.relative/path/to/file`
+
+All paths are relative to `kv.file.base_path`.
+
+### Content Handling
+
+Trailing newlines are stripped from file contents. This matches the behavior of Kubernetes secret mounts and avoids injecting unexpected whitespace into configuration values. Files containing multi-line content such as PEM certificates are returned intact except for the trailing newline.
+
+### Kubernetes Secret Mounts
+
+When Kubernetes mounts a secret as a volume, it uses an AtomicWriter pattern that creates a `..data` symlink pointing to a timestamped directory. Tyk Gateway resolves these symlinks before reading the file, so secret rotations are picked up on the next gateway hot-reload without a restart.
+
+<Note>
+A common use case for file-based KV references is storing TLS certificates in Kubernetes secrets and referencing them directly in API definitions. From Tyk Gateway 5.14.0, certificate fields in API definitions accept inline PEM content, which means a `file://` reference can supply a certificate mounted from a Kubernetes secret without the Control Plane ever storing the private key. See [Certificate Management](/api-management/certificates#certificate-management) for details.
+</Note>
diff --git a/tyk-configuration-reference/redis-cluster-sentinel.mdx b/tyk-configuration-reference/redis-cluster-sentinel.mdx
new file mode 100644
index 0000000000..907a64e06a
--- /dev/null
+++ b/tyk-configuration-reference/redis-cluster-sentinel.mdx
@@ -0,0 +1,349 @@
+---
+title: "Configure Redis"
+description: "Learn how to configure Redis for use with Tyk Gateway, Tyk Dashboard and Tyk Pump, including single-node, Redis Cluster, Redis Sentinel, TLS, and connection pool tuning."
+keywords: "configuration, redis, cluster, sentinel, tyk-gateway, tyk-dashboard, tyk-pump"
+sidebarTitle: "Configure Redis"
+---
+
+import RedisVersionsInclude from '/snippets/redis-versions-include.mdx';
+
+Tyk Gateway, Tyk Dashboard and Tyk Pump all connect to Redis. The configuration approach depends on how your Redis infrastructure is deployed:
+
+| Deployment mode | When to use |
+|---|---|
+| [Single node](#single-node-configuration) | Development, small deployments, or where Redis is managed externally as a single endpoint |
+| [Redis Cluster](#configure-redis-cluster) | High throughput or large datasets; data is automatically sharded across multiple nodes |
+| [Redis Sentinel](#configure-redis-sentinel) | High availability with automatic failover; a primary and replicas, with Sentinel nodes managing promotion |
+
+All three modes share the same set of configuration fields. The sections below explain those fields, then show how to apply them for each mode.
+
+<Warning>
+All Tyk components that connect to the same Redis instance must use identical Redis configuration. In a standard deployment, this means Tyk Gateway, Tyk Dashboard and Tyk Pump must all be configured consistently. In a distributed deployment, the Control Plane and each Data Plane have separate Redis instances, so their configurations are independent, but within each plane, all components must still match.
+</Warning>
+
+## Supported Versions
+
+<RedisVersionsInclude />
+
+## Configuration Reference
+
+Tyk Gateway and Tyk Pump configure Redis inside a named object (`storage` for Tyk Gateway, `analytics_storage_config` for Tyk Pump). Tyk Dashboard uses top-level fields prefixed with `redis_`. The underlying options are equivalent.
+
+The table below covers all common configuration fields. TLS-specific fields are covered separately in [TLS Encryption](#tls-encryption).
+
+| Purpose | Tyk Gateway / Tyk Pump field | Tyk Dashboard field |
+|---|---|---|
+| Single host address | `host` | `redis_host` |
+| Port | `port` | `redis_port` |
+| Multiple hosts (Cluster or Sentinel) | `addrs` | `redis_addrs` |
+| Username | `username` | `redis_username` |
+| Password | `password` | `redis_password` |
+| Database index | `database` | `redis_database` |
+| Enable Cluster mode | `enable_cluster` | `enable_cluster` |
+| Sentinel primary name | `master_name` | `redis_master_name` |
+| [Sentinel password](https://redis.io/docs/latest/operate/oss_and_stack/management/sentinel/#sentinel-password-only-authentication) | `sentinel_password` | `redis_sentinel_password` |
+| [Max active connections](#connection-pool) | `optimisation_max_active` | `redis_max_active` |
+| Connection timeout (seconds) | `timeout` | `redis_timeout` |
+
+### Address Configuration
+- For a single-node connection, use `host` and `port`.
+- For Redis Cluster, use `addrs` with the addresses of all cluster nodes (both primary and replica).
+- For Redis Sentinel, use `addrs` with the addresses of your Sentinel nodes, not the Redis data nodes directly.
+- When `addrs` is set, `host` and `port` are ignored.
+
+### Connection Pool
+
+Each Tyk component maintains a pool of connections to Redis. Two settings control this pool: the maximum number of active connections (`optimisation_max_active`) and the connection timeout (`timeout`), after which an attempt to connect to Redis is abandoned.
+
+The defaults (`optimisation_max_active: 500`, `timeout: 5` seconds) are suitable for most deployments. If you are running Tyk under high load and see connection pool timeouts, raise `optimisation_max_active` (or `redis_max_active` for Tyk Dashboard) incrementally until the timeouts stop. Avoid setting it excessively high, as opening too many connections can place unnecessary load on Redis. Keep `timeout` low so that failures are detected quickly rather than queuing behind slow connections.
+
+## Single Node Configuration
+
+Use these settings when connecting to a standalone Redis instance. This is the simplest configuration and is appropriate for development or where your Redis provider exposes a single endpoint.
+
+### Tyk Gateway
+
+In `tyk.conf` (or via environment variables), Redis is configured inside the `storage` block:
+
+```json
+"storage": {
+  "type": "redis",
+  "host": "redis-server",
+  "port": 6379,
+  "username": "",
+  "password": "",
+  "database": 0,
+  "optimisation_max_active": 500
+}
+```
+
+### Tyk Dashboard
+
+In `tyk_analytics.conf` (or via environment variables), Redis settings are top-level fields:
+
+```json
+"redis_host": "redis-server",
+"redis_port": 6379,
+"redis_username": "",
+"redis_password": "",
+"redis_database": 0,
+"redis_max_active": 500
+```
+
+### Tyk Pump
+
+In `pump.conf` (or via environment variables), Redis is configured inside the `analytics_storage_config` block:
+
+```json
+"analytics_storage_config": {
+  "type": "redis",
+  "host": "redis-server",
+  "port": 6379,
+  "username": "",
+  "password": "",
+  "database": 0,
+  "optimisation_max_active": 500
+}
+```
+
+## Configure Redis Cluster
+
+[Redis Cluster](https://redis.io/technology/redis-enterprise-cluster-architecture/) automatically shards data across multiple nodes, providing horizontal scalability. It is suited to high-throughput deployments or where the dataset is too large for a single node.
+
+Redis Cluster is not the same as a primary/replica setup. In a primary/replica setup, all nodes hold the full dataset and replicas serve as failover targets. In Redis Cluster, the dataset is split across shards, and each shard has its own primary and optional replicas.
+
+We recommend reviewing [this tutorial](https://redis.io/tutorials/operate/redis-at-scale/scalability/) to learn more about Redis Cluster.
+
+The key differences from a single-node configuration are:
+
+- Set `enable_cluster` to `true`.
+- Replace `host`/`port` with `addrs`, listing **all** cluster node addresses. Tyk needs visibility of the full cluster to route correctly. Do not list only the primary nodes.
+
+<Note>
+When connecting to Amazon ElastiCache in cluster mode, you can use the [configuration endpoint](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Endpoints.html) in `addrs` instead of listing individual nodes. The configuration endpoint handles routing automatically and supports both read and write operations.
+</Note>
+
+### Tyk Gateway
+
+In `tyk.conf` (or via environment variables), Redis is configured inside the `storage` block. Set `enable_cluster` to `true` and list all cluster nodes under `addrs`:
+
+```json
+"storage": {
+  "type": "redis",
+  "enable_cluster": true,
+  "addrs": [
+    "server1:6379",
+    "server2:6380",
+    "server3:6381"
+  ],
+  "username": "",
+  "password": "",
+  "database": 0,
+  "optimisation_max_active": 4000
+}
+```
+
+### Tyk Dashboard
+
+In `tyk_analytics.conf` (or via environment variables), Redis settings are top-level fields. Set `enable_cluster` to `true` and list all cluster nodes under `redis_addrs`:
+
+```json
+"redis_addrs": [
+  "server1:6379",
+  "server2:6380",
+  "server3:6381"
+],
+"enable_cluster": true,
+"redis_username": "",
+"redis_password": "",
+"redis_database": 0,
+"redis_max_active": 4000
+```
+
+<Note>
+The `enable_cluster` field does not have the `redis_` prefix.
+</Note>
+
+### Tyk Pump
+
+In `pump.conf` (or via environment variables), Redis is configured inside the `analytics_storage_config` block. Set `enable_cluster` to `true` and list all cluster nodes under `addrs`:
+
+```json
+"analytics_storage_config": {
+  "type": "redis",
+  "enable_cluster": true,
+  "addrs": [
+    "server1:6379",
+    "server2:6380",
+    "server3:6381"
+  ],
+  "username": "",
+  "password": "",
+  "database": 0,
+  "optimisation_max_active": 4000
+}
+```
+
+## Configure Redis Sentinel
+
+[Redis Sentinel](https://redis.io/docs/latest/operate/oss_and_stack/management/sentinel/) provides high availability for a primary/replica Redis setup. Sentinel nodes monitor the primary, and if it becomes unavailable they coordinate promotion of a replica to primary. No change to Tyk's configuration is required when a failover occurs.
+
+Sentinel is the right choice when you need automatic failover but do not need the horizontal sharding that Redis Cluster provides.
+
+We recommend reviewing [this tutorial](https://redis.io/tutorials/operate/redis-at-scale/high-availability/) to learn more about Redis Sentinel.
+
+The key differences from a single-node configuration are:
+
+- List your Sentinel node addresses under `addrs` (not the Redis data nodes directly).
+- Set `master_name` to the name of the monitored primary, as configured in your Sentinel setup.
+
+<Note>
+Do not set `enable_cluster`: Sentinel and Cluster are mutually exclusive modes.
+</Note>
+
+<Warning>
+When using Bitnami charts to install Redis Sentinel in Kubernetes, a Redis *service* is exposed rather than the Sentinel nodes directly. In this case, use a standard [single-node configuration](/tyk-configuration-reference/redis-cluster-sentinel#single-node-configuration) pointing at that service address, and do not set `master_name`.
+</Warning>
+
+### Tyk Gateway
+
+In `tyk.conf` (or via environment variables), Redis is configured inside the `storage` block. Point `addrs` at your Sentinel nodes and set `master_name` to the name of the monitored primary:
+
+```json
+"storage": {
+  "type": "redis",
+  "addrs": [
+    "sentinel1:26379",
+    "sentinel2:26379",
+    "sentinel3:26379"
+  ],
+  "master_name": "mymaster",
+  "username": "",
+  "password": "",
+  "database": 0,
+  "optimisation_max_active": 4000,
+  "sentinel_password": ""
+}
+```
+
+- If your Sentinel nodes require a password, set `sentinel_password`.
+
+### Tyk Dashboard
+
+In `tyk_analytics.conf` (or via environment variables), Redis settings are top-level fields. Point `redis_addrs` at your Sentinel nodes and set `redis_master_name` to the name of the monitored primary:
+
+```json
+"redis_addrs": [
+  "sentinel1:26379",
+  "sentinel2:26379",
+  "sentinel3:26379"
+],
+"redis_master_name": "mymaster",
+"redis_username": "",
+"redis_password": "",
+"redis_database": 0,
+"redis_max_active": 4000,
+"redis_sentinel_password": ""
+```
+
+- If your Sentinel nodes require a password, set `redis_sentinel_password`.
+
+### Tyk Pump
+
+In `pump.conf` (or via environment variables), Redis is configured inside the `analytics_storage_config` block. Point `addrs` at your Sentinel nodes and set `master_name` to the name of the monitored primary:
+
+```json
+"analytics_storage_config": {
+  "type": "redis",
+  "addrs": [
+    "sentinel1:26379",
+    "sentinel2:26379",
+    "sentinel3:26379"
+  ],
+  "master_name": "mymaster",
+  "username": "",
+  "password": "",
+  "database": 0,
+  "optimisation_max_active": 4000,
+  "sentinel_password": ""
+}
+```
+
+- If your Sentinel nodes require a password, set `sentinel_password`.
+
+## TLS Encryption
+
+Redis supports TLS encryption from version 6. TLS configuration uses the same fields regardless of whether you are using single-node, Cluster, or Sentinel mode.
+
+### Configuration Fields
+
+TLS fields are configured inside the `storage` block for Tyk Gateway, the `analytics_storage_config` block for Tyk Pump, and as top-level fields prefixed with `redis_` for Tyk Dashboard. Note that Tyk Pump uses different field names from Tyk Gateway for most TLS settings.
+
+| Purpose | Tyk Gateway field | Tyk Pump field | Tyk Dashboard field |
+|---|---|---|---|
+| Enable TLS | `use_ssl` | `use_ssl` | `redis_use_ssl` |
+| Skip server certificate verification | `ssl_insecure_skip_verify` | `ssl_insecure_skip_verify` | `redis_ssl_insecure_skip_verify` |
+| Certificate Authority file | `ca_file` | `ssl_ca_file` | `redis_ca_file` |
+| Client certificate file (mTLS) | `cert_file` | `ssl_cert_file` | `redis_cert_file` |
+| Client private key file (mTLS) | `key_file` | `ssl_key_file` | `redis_key_file` |
+| Minimum TLS version | `tls_min_version` | `ssl_min_version` | `redis_tls_min_version` |
+| Maximum TLS version | `tls_max_version` | `ssl_max_version` | `redis_tls_max_version` |
+
+- Valid values for min/max version: `"1.0"`, `"1.1"`, `"1.2"`, `"1.3"`. Defaults: minimum `"1.2"`, maximum `"1.3"`.
+- Setting `ssl_insecure_skip_verify` to `true` is not recommended for production.
+
+### Example: Mutual TLS
+
+The following example configures Tyk Gateway to use mutual TLS (mTLS) when connecting to Redis:
+
+```json
+"storage": {
+  "use_ssl": true,
+  "ca_file": "/path/to/ca.crt",
+  "cert_file": "/path/to/client.crt",
+  "key_file": "/path/to/client.key"
+}
+```
+
+- TLS is enabled with `use_ssl`.
+- The Redis server's certificate is verified against the provided CA with `ca_file`.
+- Tyk Gateway's client certificate (`cert_file`) and private key (`key_file`) are used to satisfy Redis's client authentication requirement.
+
+For Tyk Dashboard, the equivalent fields are prefixed with `redis_` (for example, `redis_use_ssl`, `redis_ca_file`). For Tyk Pump, these fields sit inside the `analytics_storage_config` block, but use different field names: for example, `ssl_ca_file` instead of `ca_file`. See the table above for the full field mapping.
+
+For background on TLS and mTLS concepts, see [TLS and Certificate Management](/api-management/certificates).
+
+
+## Troubleshooting
+
+Before adjusting Tyk configuration, verify that Redis itself is healthy. The commands below help diagnose problems across all deployment modes.
+
+**Check Redis Is Reachable**
+
+```bash
+redis-cli -h <host> -p <port> PING
+```
+
+A healthy Redis instance responds with `PONG`. If this fails, the connection problem is at the network or Redis level, not in Tyk configuration.
+
+**Monitor Key Redis Metrics**
+
+```bash
+redis-cli -h <host> -p <port> INFO
+```
+
+Watch the following metrics:
+
+| Metric | Section | What to look for |
+|---|---|---|
+| `connected_clients` | `clients` | Approaching the `maxclients` limit |
+| `blocked_clients` | `clients` | Non-zero values indicate connection pool pressure |
+| `rejected_connections` | `stats` | Any value above 0 means clients were refused. Set up alerting on this metric. |
+| `instantaneous_ops_per_sec` | `stats` | Sudden drops may indicate a problem with the Redis instance |
+| `used_memory_rss` | `memory` | Growing unboundedly suggests a key eviction or retention issue |
+
+For further troubleshooting guidance, see the Redis documentation:
+
+- [Troubleshooting Redis](https://redis.io/docs/latest/operate/oss_and_stack/management/troubleshooting/): general Redis problems including latency and memory
+- [Redis Sentinel](https://redis.io/docs/latest/operate/oss_and_stack/management/sentinel/): inspecting primary and replica state, quorum, and failover
+- [Redis Cluster](https://redis.io/docs/latest/operate/oss_and_stack/management/scaling/): checking cluster state, node reachability, and slot distribution
diff --git a/tyk-configuration-reference/tyk-identity-broker-configuration.mdx b/tyk-configuration-reference/tyk-identity-broker-configuration.mdx
new file mode 100644
index 0000000000..cb6546e7e4
--- /dev/null
+++ b/tyk-configuration-reference/tyk-identity-broker-configuration.mdx
@@ -0,0 +1,283 @@
+---
+title: "Tyk Identity Broker Configuration Options"
+description: "Configuration options for Tyk Identity Broker (TIB), including settings for profiles, backends, and Tyk API integration."
+order: 3
+sidebarTitle: "Tyk Identity Broker"
+---
+
+import EnvTypeMapping from '/snippets/env-type-mapping.mdx';
+
+The Tyk Identity Broker (TIB) is configured through two files: The configuration file `tib.conf` and the profiles file `profiles.json`. TIB can also be managed via the [TIB REST API](/tyk-identity-broker/tib-rest-api) for automated configurations.
+
+### The `tib.conf` file
+
+```{.copyWrapper}
+{
+ "Secret": "test-secret",
+ "ProfileDir": "path-to-backup-directory",
+ "HttpServerOptions": {
+   "UseSSL": true,
+   "CertFile": "./certs/server.pem",
+   "KeyFile": "./certs/server.key"
+ },
+ "BackEnd": {
+   "Name": "in_memory",
+   "IdentityBackendSettings": {
+     "Hosts" : {
+         "localhost": "6379"
+     },
+     "Username": "",
+     "Password": "",
+     "Database": 0,
+     "EnableCluster": false,
+     "MaxIdle": 1000,
+     "MaxActive": 2000,
+ "UseSSL": false,
+ "SSLInsecureSkipVerify": false
+   }
+ },
+ "TykAPISettings": {
+   "GatewayConfig": {
+     "Endpoint": "http://{GATEWAY-DOMAIN}",
+     "Port": "8080",
+     "AdminSecret": "352d20ee67be67f6340b4c0605b044b7"
+   },
+     "DashboardConfig": {
+       "Endpoint": "http://{DASHBOARD-DOMAIN}",
+       "Port": "3000",
+       "AdminSecret": "12345"
+   }
+ }
+}
+```
+
+### Omitting the configuration file
+
+From TIB v1.3.1, the environment variable `TYK_IB_OMITCONFIGFILE` is provided to allow the configuration file to be omitted (ignored) when configuring TIB.
+
+If set to TRUE, then TIB will ignore any provided configuration file and set its parameters according to environment variables. TIB will fall back to the default value for any parameters not set in an environment variable.
+This is particularly useful when using Docker, as this option will ensure that TIB will load the configuration via env vars and not expect a configuration file.
+
+<EnvTypeMapping/>
+
+The various options for `tib.conf` file are:
+
+### Secret
+ENV: <b>TYK_IB_SECRET</b><br />
+Type: `string`<br />
+
+The REST API secret to configure the Tyk Identity Broker remotely.
+
+### ProfileDir
+ENV: <b>TYK_IB_PROFILEDIR</b><br />
+Type: `string`<br />
+
+Directory where the backup files will be stored. Backups files are created each time that a create, update or delete action is performed over any profile (and profiles are being read from a file not from mongo, in which case it will create a new document in the `profiles_backup` collection).
+
+### HttpServerOptions.UseSSL
+ENV: <b>TYK_IB_HTTPSERVEROPTIONS_USESSL</b><br />
+Type: `bool`<br />
+
+Set this to `true` to turn on SSL for the server, this is **highly recommended**.
+
+### HttpServerOptions.KeyFile
+ENV: <b>TYK_IB_HTTPSERVEROPTIONS_KEYFILE</b><br />
+Type: `string`<br />
+
+The path to the key file for this server, required for SSL.
+
+### HttpServerOptions.CertFile
+ENV: <b>TYK_IB_HTTPSERVEROPTIONS_CERTFILE</b><br />
+Type: `string`<br />
+
+The path to the certificate file for this server, required for SSL.
+
+### BackEnd
+
+TIB is quite modular and different back-ends can be generated quite easily. By default, TIB will store profile configurations in memory, which does not require any new configuration.
+
+For Identity Handlers that provide token-based access, it is possible to enforce a "One token per provider, per user" policy, which keeps a cache of tokens assigned to identities in Redis, this is so that the broker can be scaled and share the cache across instances.
+
+Since profiles are unlikely to change often, profiles are kept in-memory, but can be added, removed and modified using an API for automated setups if required.
+
+### BackEnd.IdentityBackendSettings.Database
+ENV: <b>TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_DATABASE</b><br />
+Type: `int`<br />
+
+If you are using multiple databases (not supported in Redis cluster), let TIB know which DB to use for Identity caching.
+
+### BackEnd.IdentityBackendSettings.Username
+ENV: <b>TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_USERNAME</b><br />
+Type: `string`<br />
+
+The username for Redis AUTH, if used (recommended).
+
+### BackEnd.IdentityBackendSettings.Password
+ENV: <b>TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_PASSWORD</b><br />
+Type: `string`<br />
+
+The password for your Redis AUTH Username.
+
+### BackEnd.IdentityBackendSettings.Hosts
+ENV: <b>TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_HOSTS</b><br />
+Type: `map[string]string`<br />
+
+Add your Redis hosts here as a map of hostname:port. Since TIB uses the same cluster driver as Tyk, it is possible to have TIB interact with your existing Redis cluster if you enable it.
+
+
+<Note>
+To set this value via env var you must follow the declaration syntax `export TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_HOSTS="host1:port,host2:port"`
+</Note>
+
+
+### BackEnd.IdentityBackendSettings.MaxIdle
+ENV: <b>TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_MAXIDLE</b><br />
+Type: `int`<br />
+
+Max idle connections to Redis.
+
+### BackEnd.IdentityBackendSettings.MaxActive
+ENV: <b>TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_MAXACTIVE</b><br />
+Type: `int`<br />
+
+Max active Redis connections.
+
+### BackEnd.IdentityBackendSettings.EnableCluster
+ENV: <b>TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_ENABLECLUSTER</b><br />
+Type: `bool`<br />
+
+If you are using Redis cluster, enable it here to enable the slots mode.
+
+### BackEnd.IdentityBackendSettings.UseSSL
+ENV: <b>TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_USESSL</b><br />
+Type: `bool`<br />
+
+If you are using a TLS protected Redis enable to connect.
+
+
+<Note>
+This option is available from TIB v0.4.0
+</Note>
+
+
+### BackEnd.IdentityBackendSettings.SSLInsecureSkipVerify
+ENV: <b>TYK_IB_BACKEND_IDENTITYBACKENDSETTINGS_SSLINSECURESKIPVERIFY</b><br />
+Type: `bool`<br />
+
+Allows usage of self-signed certificates when connecting to an encrypted Redis database.
+
+
+<Note>
+This option is available from TIB v0.4.0
+</Note>
+
+
+### Storage
+
+### Storage.storage_type
+ENV: <b>TYK_IB_STORAGE_STORAGE_TYPE</b><br />
+Type: `string`<br />
+
+Configures the storage backend for TIB profiles. By default, profiles are loaded from the file specified by the `-p` flag. Set `storage_type` to `mongo` to load profiles from MongoDB instead.
+
+```json
+{
+  "Storage": {
+    "storage_type": "mongo",
+    "mongo": {
+      "mongo_url": "mongodb://localhost:27017",
+      "db_name": "tib"
+    }
+  }
+}
+```
+
+### Storage.mongo.mongo_url
+ENV: <b>TYK_IB_STORAGE_MONGO_MONGO_URL</b><br />
+Type: `string`<br />
+
+The MongoDB connection string.
+
+### Storage.mongo.db_name
+ENV: <b>TYK_IB_STORAGE_MONGO_DB_NAME</b><br />
+Type: `string`<br />
+
+The MongoDB database name to use for profile storage.
+
+### Storage.mongo.mongo_use_ssl
+ENV: <b>TYK_IB_STORAGE_MONGO_MONGO_USE_SSL</b><br />
+Type: `bool`<br />
+
+Set to `true` to enable TLS for the MongoDB connection. TIB will verify the server certificate against system CAs.
+
+### Storage.mongo.mongo_ssl_insecure_skip_verify
+ENV: <b>TYK_IB_STORAGE_MONGO_MONGO_SSL_INSECURE_SKIP_VERIFY</b><br />
+Type: `bool`<br />
+
+Set to `true` to skip TLS certificate verification. Not recommended for production.
+
+### Storage.mongo.driver
+ENV: <b>TYK_IB_STORAGE_MONGO_DRIVER</b><br />
+Type: `string`<br />
+
+The MongoDB driver to use. Valid values: `mongo-go` (default) or `mgo`.
+
+### Storage.mongo.session_consistency
+ENV: <b>TYK_IB_STORAGE_MONGO_SESSION_CONSISTENCY</b><br />
+Type: `string`<br />
+
+The MongoDB session consistency level.
+
+### Storage.mongo.direct_connection
+ENV: <b>TYK_IB_STORAGE_MONGO_DIRECT_CONNECTION</b><br />
+Type: `bool`<br />
+
+Set to `true` to connect directly to a single MongoDB host, bypassing replica set discovery.
+
+### TykAPISettings
+
+This section enables you to configure the API credentials for the various Tyk Components TIB is interacting with.
+
+### TykAPISettings.GatewayConfig.Endpoint
+ENV: <b>TYK_IB_TYKAPISETTINGS_GATEWAYCONFIG_ENDPOINT</b><br />
+Type: `string`<br />
+
+The hostname of the Tyk Gateway (this is for token generation purposes).
+
+### TykAPISettings.GatewayConfig.Port
+ENV: <b>TYK_IB_TYKAPISETTINGS_GATEWAYCONFIG_PORT</b><br />
+Type: `string`<br />
+
+The port to use on the Tyk Gateway host.
+
+
+<Note>
+For HTTP or HTTPS endpoints, you do not need to specify the default ports (80 and 443) for this setting. These two ports are handled automatically.
+</Note>
+
+
+
+### TykAPISettings.GatewayConfig.AdminSecret
+ENV: <b>TYK_IB_TYKAPISETTINGS_GATEWAYCONFIG_ADMINSECRET</b><br />
+Type: `string`<br />
+
+The API secret for the Tyk Gateway REST API.
+
+### TykAPISettings.DashboardConfig.Endpoint
+ENV: <b>TYK_IB_TYKAPISETTINGS_DASHBOARDCONFIG_ENDPOINT</b><br />
+Type: `string`<br />
+
+The hostname of your Dashboard (Advanced API).
+
+### TykAPISettings.DashboardConfig.Port
+ENV: <b>TYK_IB_TYKAPISETTINGS_DASHBOARDCONFIG_PORT</b><br />
+Type: `string`<br />
+
+The port of your Advanced API.
+
+### TykAPISettings.DashboardConfig.AdminSecret
+ENV: <b>TYK_IB_TYKAPISETTINGS_DASHBOARDCONFIG_ADMINSECRET</b><br />
+Type: `string`<br />
+
+The high-level secret for the Advanced API. This is required because of the SSO-nature of some of the actions provided by TIB, it requires the capability to access a special SSO endpoint in the Advanced API to create one-time tokens for access.
+
diff --git a/tyk-dashboard-api.mdx b/tyk-dashboard-api.mdx
new file mode 100644
index 0000000000..219c47a80a
--- /dev/null
+++ b/tyk-dashboard-api.mdx
@@ -0,0 +1,100 @@
+---
+title: "Tyk Dashboard API"
+description: "Tyk Dashboard API documentation. This page provides details on how to use the Tyk Dashboard API for managing organisations, users, API definitions, and more."
+order: 3
+sidebarTitle: "Overview"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+<img src="https://tyk.io/docs/img/swagger_dashboard_image.png" width="963" height="250" alt="Tyk Dashboard API"/>
+
+<ButtonLeft href="https://raw.githubusercontent.com/TykTechnologies/tyk-docs/refs/heads/production/swagger/nightly/dashboard-swagger.yml" color="green" content="Download Swagger" />
+
+## <a name="introduction"></a> Introduction
+
+The Tyk Dashboard API offers granular, programmatic access to a centralised database of resources that your Tyk nodes can pull from. This API has a dynamic user administrative structure which means the secret key that is used to communicate with your Tyk nodes can be kept secret and access to the wider management functions can be handled on a user-by-user and organisation-by-organisation basis.
+
+A common question around using a database-backed configuration is how to programmatically add API definitions to your Tyk nodes, the Dashboard API allows much more fine-grained, secure and multi-user access to your Tyk cluster, and should be used to manage a database-backed Tyk node.
+
+The Tyk Dashboard API works seamlessly with the Tyk Dashboard (and the two come bundled together).
+
+## <a name="security-hierarchy"></a> Security Hierarchy
+
+The Dashboard API provides a more structured security layer to managing Tyk nodes.
+
+### Organisations, APIs and Users
+
+With the Dashboard API and a database-backed Tyk setup, (and to an extent with file-based API setups - if diligence is used in naming and creating definitions), the following security model is applied to the management of Upstream APIs:
+
+* **Organisations**: All APIs are *owned* by an organisation, this is designated by the 'OrgID' parameter in the API Definition.
+* **Users**: All users created in the Dashboard belong to an organisation (unless an exception is made for super-administrative access).
+* **APIs**: All APIs belong to an Organisation and only Users that belong to that organisation can see the analytics for those APIs and manage their configurations.
+* **API Keys**: API Keys are designated by organisation, this means an API key that has full access rights will not be allowed to access the APIs of another organisation on the same system, but can have full access to all APIs within the organisation.
+* **Access Rights**: Access rights are stored with the key, this enables a key to give access to multiple APIs, this is defined by the session object in the core Tyk API.
+
+In order to use the Dashboard API, you'll need to get the 'Tyk Dashboard API Access Credentials' secret from your user profile on the Dashboard UI.
+
+The secret you set should then be sent along as a header with each Dashboard API Request in order for it to be successful:
+
+`authorization: <your-secret>`
+
+## Role Based Access Control
+
+The [Tyk Dashboard API](/tyk-dashboard-api) is a superset of the Tyk Gateway API, enabling (almost) all of the core features and adding many more. The Dashboard API is also more granular and supports [Role Based Access Control](/platform-management/user-permissions) (RBAC) on both a multi-tenant, and user basis.
+
+Using the Dashboard API it is possible to set Read / Write / ReadWrite / Deny access to sections of the API on a user by user basis, and also segregate User / Key / API Ownership by organization.
+
+The availability of RBAC varies depending on the license or subscription. For further information, please check our [price comparison](https://tyk.io/price-comparison/) or consult our sales and expert engineers <ButtonLeft href="https://tyk.io/contact/" color="green" content="Contact us" />
+
+
+<Note>
+For optimal results, it is advisable to exclusively employ the Tyk Dashboard API (avoiding direct calls to the Tyk Gateway API) within a Self-Managed setup, enabling the Dashboard to manage the Tyk API gateways cluster.
+</Note>
+
+
+
+<img src="/img/diagrams/diagram_docs_dashboard-API-security-and-concepts@2x.png" alt="Tyk Dashboard API security" />
+
+
+## Pagination
+
+
+Selected Dashboard APIs can be paginated.
+
+You can select the number of result pages to return by adding a parameter `p` which starts at `1`. At the default page size, this returns items 1-10. Setting `p` to `2` returns items 11-20 and so on. Alternatively, passing `0` or lower as a parameter will return all items.
+
+The default page size is 10. You can overwrite the default page size in your `tyk_analytics.conf` using the `page_size` key. It's suggested you do not modify it as it will affect the performance of the Dashboard.
+
+**Sample Request:**
+
+```http
+GET /api/apis/?p=1 HTTP/1.1
+Host: localhost:3000
+authorization:7a7b140f-2480-4d5a-4e78-24049e3ba7f8
+```
+
+**Sample Response:**
+
+```yaml
+{
+  "apis": [
+    { ... },
+    { ... },
+    { ... }
+  ],
+  "pages": 1
+}
+```
+
+
+## GraphQL API
+
+Presently, the Tyk Dashboard uses the GraphQL API for keys.
+
+| **Method** | **URL**  | **Description**             |
+| :---------- | :------------- | :--------------------------- |
+| POST       | `/graphql`    | GraphQL query endpoint      |
+| GET        | `/playground` | Dashboard Graphql Playground - where you could see docs and run queries |
+
+
diff --git a/tyk-dashboard/configuration.mdx b/tyk-dashboard/configuration.mdx
new file mode 100644
index 0000000000..7035216b27
--- /dev/null
+++ b/tyk-dashboard/configuration.mdx
@@ -0,0 +1,215 @@
+---
+title: "Tyk Dashboard Configuration Options"
+description: "Configuration options and environment variables for Tyk Dashboard."
+order: 2
+sidebarTitle: "Environment Variables and Config"
+---
+
+import DashboardConfig from '/snippets/dashboard-config.mdx';
+import EnvTypeMapping from '/snippets/env-type-mapping.mdx';
+
+You can use environment variables to override the config file for the Tyk Dashboard. The Dashboard configuration file can be found in the `tyk-dashboard` folder and by default is called `tyk_analytics.conf`, though it can be renamed and specified using the `--conf` flag. Environment variables are created from the dot notation versions of the JSON objects contained with the config files.
+To understand how the environment variables notation works, see [Environment Variables](/tyk-oss-gateway/configuration).
+
+The Tyk Dashboard has a separate configuration file, it is small and comes packaged with the tarball. It uses a separate configuration file as it may be installed on a different host to your Tyk Gateway nodes.
+
+The Dashboard configuration file can be found in the `tyk-dashboard` folder and by default is called `tyk_analytics.conf`, though it can be renamed and specified using the `--conf` flag.
+
+Please consult the [data storage configuration](/api-management/dashboard-configuration#data-storage-solutions) guide for further information relating to how to configure Tyk's data storage across different database engines.
+
+### Environment Variables
+
+All the Dashboard environment variables have the prefix `TYK_DB_`. The environment variables will take precedence over the values in the configuration file.
+
+<EnvTypeMapping/>
+
+Environment variables (env var) can be used to override the settings defined in the configuration file. Where an environment variable is specified, its value will take precedence over the value in the configuration file.
+
+The file will look like the sample below, the various fields are explained in the following sections:
+
+```json
+{
+  "listen_port": 3000,
+  "log_level": "info",
+  "tyk_api_config": {
+    "Host": "http://tyk-gateway",
+    "Port": "8080",
+    "Secret": "352d20ee67be67f6340b4c0605b044b7"
+  },
+  "enable_aggregate_lookups": true,
+  "storage": {
+    "main": {
+      "type": "postgres",
+      "connection_string": "user=laurentiughiur password=test123 database='tyk-test' host=127.0.0.1 port=5432",
+      "table_sharding": true
+    },
+    "analytics": {
+      "type": "postgres",
+      "connection_string": "user=laurentiughiur password=test123 database='tyk-test' host=127.0.0.1 port=5432",
+      "table_sharding": true
+    },
+    "logs": {
+      "type": "postgres",
+      "connection_string": "user=laurentiughiur password=test123 database='tyk-test' host=127.0.0.1 port=5432",
+      "table_sharding": true
+    },
+    "uptime": {
+      "type": "postgres",
+      "connection_string": "user=laurentiughiur password=test123 database='tyk-test' host=127.0.0.1 port=5432",
+      "table_sharding": true
+    }
+  },
+  "enable_ownership": false,
+  "mongo_url": "mongodb://tyk-mongo:27017/tyk_analytics",
+  "mongo_use_ssl": false,
+  "mongo_ssl_insecure_skip_verify": false,
+  "mongo_session_consistency": "",
+  "mongo_batch_size": 2000,
+  "page_size": 10,
+  "admin_secret": "12345",
+  "shared_node_secret": "352d20ee67be67f6340b4c0605b044b7",
+  "redis_port": 6379,
+  "redis_host": "tyk-redis",
+  "redis_username": "",
+  "redis_password": "",
+  "redis_master_name": "",
+  "redis_timeout": 0,
+  "redis_database": 0,
+  "enable_cluster": false,
+  "redis_use_ssl": false,
+  "redis_ssl_insecure_skip_verify": false,
+  "force_api_defaults": false,
+  "notify_on_change": true,
+  "license_key": "",
+  "redis_hosts": null,
+  "redis_addrs": null,
+  "hash_keys": true,
+    "enable_hashed_keys_listing": false,
+  "email_backend": {
+    "enable_email_notifications": false,
+    "code": "sendgrid",
+    "settings": {
+      "ClientKey": ""
+      },
+    "default_from_email": "you@somewhere.com",
+    "default_from_name": "Some Person",
+    "dashboard_hostname": ""
+  },
+  "hide_listen_path": false,
+  "sentry_code": "",
+  "sentry_js_code": "",
+  "use_sentry": false,
+  "enable_master_keys": false,
+  "enable_duplicate_slugs": true,
+  "show_org_id": true,
+  "host_config": {
+    "enable_host_names": true,
+    "disable_org_slug_prefix": true,
+    "hostname": "www.tyk-test.com",
+    "override_hostname": "www.tyk-test.com:8080",
+    "portal_domains": {},
+    "portal_root_path": "/portal",
+    "generate_secure_paths": false,
+    "secure_cookies": false,
+    "use_strict_hostmatch": false
+  },
+  "http_server_options": {
+    "use_ssl": false,
+    "certificates": [],
+    "min_version": 0,
+    "ssl_ciphers": null,
+    "ssl_insecure_skip_verify": false
+  },
+  "basic-config-and-security/security": {
+    "allow_admin_reset_password": false,
+    "login_failure_username_limit": 0,
+    "login_failure_ip_limit": 0,
+    "login_failure_expiration": 0,
+    "login_disallow_forward_proxy": false,
+    "audit_log_path": "",
+    "user_password_max_days": 0,
+    "enforce_password_history": 0,
+    "force_first_login_pw_reset": false,
+    "enable_content_security_policy": false,
+    "allowed_content_sources": "",
+    "private_certificate_encoding_secret": "some-secret",
+    "open_policy":{
+      "enabled": true,
+      "debug": true,
+      "enable_api": true
+      },
+    "additional_permissions": {
+      "api_manager": "API Manager"
+      }
+  },
+  "ui": {
+    "languages": {
+      "Chinese": "cn",
+      "English": "en",
+      "Korean": "ko"
+    },
+    "hide_help": true,
+    "default_lang": "en",
+    "login_page": {},
+    "nav": {
+      "dont_show_admin_sockets": false,
+      "hide_activity_by_api_section": false,
+      "hide_geo": false,
+      "hide_licenses_section": false,
+      "hide_logs": false,
+      "hide_tib_section": false
+    },
+    "uptime": {},
+    "portal_section": null,
+    "designer": {},
+    "dont_show_admin_sockets": false,
+    "dont_allow_license_management": false,
+    "dont_allow_license_management_view": false,
+    "cloud": false
+  },
+  "home_dir": "/opt/tyk-dashboard",
+  "identity_broker": {
+    "enabled": false,
+    "host": {
+      "connection_string": "",
+      "secret": ""
+    }
+  },
+  "tagging_options": {
+    "tag_all_apis_by_org": false
+  },
+  "use_sharded_analytics": true,
+  "enable_aggregate_lookups": true,
+  "aggregate_lookup_cutoff": "26/05/2016",
+  "maintenance_mode": false,
+  "allow_explicit_policy_id": true,
+  "private_key_path": "",
+  "node_schema_path": "",
+  "oauth_redirect_uri_separator": ";",
+  "statsd_connection_string": "",
+  "statsd_prefix": "",
+  "disable_parallel_sessions": false,
+  "dashboard_session_lifetime": 0,
+  "alternative_dashboard_url": "",
+  "sso_permission_defaults": null,
+  "sso_default_group_id": "",
+  "sso_custom_login_url": "",
+  "sso_custom_portal_login_url": "",
+  "sso_enable_user_lookup": false,
+  "notifications_listen_port": 5000,
+  "portal_session_lifetime": 0,
+  "enable_delete_key_by_hash": false,
+  "enable_update_key_by_hash": false,
+  "audit": {
+    "enabled": false,
+    "format": "",
+    "path": "",
+    "detailed_recording": false
+  },
+  "enable_multi_org_users": false,
+  "version_check_url": "",
+  "health_check_endpoint_name": ""
+}
+```
+
+<DashboardConfig/>
diff --git a/tyk-developer-portal/customise.mdx b/tyk-developer-portal/customise.mdx
new file mode 100644
index 0000000000..7755335aee
--- /dev/null
+++ b/tyk-developer-portal/customise.mdx
@@ -0,0 +1,25 @@
+---
+title: "Portal Customization Overview"
+order: 12
+robots: "noindex, nofollow"
+sidebarTitle: "Overview"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+### Customize look and feel
+
+There are two primary ways to customize the developer portal. The first is to use the built-in CSS editor to inject new CSS into the existing portal templates. This is primarily useful for Cloud and Multi-Cloud users.
+
+The second method is to edit the Portal templates directly. The Tyk Dashboard ships with all the templates that make up the portal, these templates are based on Twitter Bootstrap and can be easily changed to suit your branding.
+
+All templates in Tyk Portal use the Golang Templating engine and have the capability to display Markdown.
+
+### Customize content
+
+The Tyk Portal comes with a basic CMS which can push content into Tyk Templates as markdown. That means a certain amount of customization around content can be done from within a live installation without needing to modify CSS or templates.
+
+The CMS and Menu Editor allows you to generate pages and menu structures that can be displayed in your Portal so that you can embellish the portal with additional content around your company, brand and bio.
+
diff --git a/tyk-developer-portal/customise/customize-api-visibility.mdx b/tyk-developer-portal/customise/customize-api-visibility.mdx
new file mode 100644
index 0000000000..9b6dbd8905
--- /dev/null
+++ b/tyk-developer-portal/customise/customize-api-visibility.mdx
@@ -0,0 +1,416 @@
+---
+title: "Customizing API Visibility"
+description: "A walk through how you can use custom Page Templates to control the visibility of your APIs so it can only be seen by specific group of developers."
+keywords: "customizing EDP, EDP, customizing APIs EDP"
+robots: "noindex, nofollow"
+sidebarTitle: "Customising API Visibility"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+By default, any user who accesses your developer Portal will be able to view all of the published APIs in the catalog. This behavior may not be desired and you may want to have more control of what APIs developers see in the catalog when accessing the portal. A common use case for this is if you have internal APIs that you want to publish only to your internal developers, and restrict view to others.
+
+We'll walk through how you can use custom Page Templates to control the visibility of your APIs so it can only be seen by specific group of developers.
+In a nutshell, we are going to assign a group field to an API catalog profile, to a developer profile, and check if their group matched. 
+
+*Please note that this does not support multiple groups for a single API catalog entry, nor for a single developer profile.* 
+
+## Prerequisites
+1. You have an API created in your Dashboard. See [Create an API](/api-management/gateway-config-managing-classic#create-an-api) for more details.
+2. You have a Policy created in your Dashboard that has access rights to this API
+3. You have a Portal Catalog entry for this API. Here we will call it "Internal API"
+4. You have a developer account that can access your Developer Portal. 
+
+## Add a group field to the API Catalog profile
+
+For this example, we'll add a custom field to the Portal catalog "Group". This group is set to "internal" which indicates that only developers in `internal` group shoud have access to the Catalog.
+
+Go to Portal Management > Catalog -> Your API screen
+
+<img src="/img/dashboard/portal-management/portal_catalogue_field_group.png" alt="portal_catalogue_fied_group" />
+
+
+## Add a custom field to the developer profile
+
+For this example, we'll add a custom field to the developer profile also called "Group". This group is set set to "internal" it means that developer should have access to the catalogs with the same Group restriction. 
+
+Go to Portal Management > Developers screen
+<img src="/img/dashboard/portal-management/deveoper_field_group.png" alt="developer_field_group.png" />
+
+
+This flag can also be [set programatically](/tyk-developer-portal/tyk-portal-classic/customise/custom-developer-portal#updating-a-developer-example-adding-custom-fields).
+
+
+## Modify the Portal Catalog Template to add Show/Hide Logic
+
+The developer portal is fully customizable via templates. We'll add custom logic to the portal catalog template (catalogue.html) to show/hide the "Internal API" catalog based on the value of the "Group" field for the developer.  
+
+The main difference from the default template is two changes:
+1. Get user data state at the start of template: `{{$profile := .UserData }}`
+2. Before rendering api catalog element, which renders list of APIs, we insert the following section:
+
+```html
+{{ $show := true }}
+
+{{ range $field, $value := $apiDetail.Fields }}
+	{{ $group_match := true }}
+	{{ if (eq $field "Group") }}
+		{{ $group_match = false }}
+		{{ range $dfield, $dvalue := $profile.Fields }}
+			{{ if eq $dfield "Group" }}
+				{{ if eq $dvalue $value }}
+					{{ $group_match = true }}
+				{{ end }}
+			{{ end }}
+		{{ end }}
+	{{ end }}
+
+	{{ if not $group_match }}
+		{{ $show = false }}
+	{{ end }}
+{{ end }}
+
+{{if $show}}
+{{/* Render catalog */}}
+{{end}}
+```
+
+<Expandable title='Click to expand and see the customized catalog template'>
+```html
+{{ define "cataloguePage" }} {{ $org_id := .OrgId}} {{ template "header" .}}
+{{ $page := .}}
+{{$profile := .UserData }}
+<body>
+  {{ template "navigation" . }}
+  <div>
+    {{/* Main content here */}}
+    <div class="container" style="margin-top:80px;">
+      <div class="row">
+        <h1>API Catalog</h1>
+      </div>
+      {{ if .Error }}
+      <div class="row">
+        <div class="col-md-7 center">
+          <div class="alert alert-danger text-center col-lg-8 col-lg-offset-2 success-page error">Error while loading data</div>
+        </div>
+      </div>
+      {{ end }}
+      <div class="row catalogues-list">
+        {{$internal := index .UserData.Fields "internal"}}
+
+        {{ if .Data.APIS }} {{ range $index, $apiDetail := .Data.APIS}} {{ if $apiDetail.Show }}
+
+        {{ $show := true }}
+
+        {{ range $field, $value := $apiDetail.Fields }}
+          {{ $group_match := true }}
+          {{ if (eq $field "Group") }}
+            {{ $group_match = false }}
+            {{ range $dfield, $dvalue := $profile.Fields }}
+              {{ if eq $dfield "Group" }}
+                {{ if eq $dvalue $value }}
+                  {{ $group_match = true }}
+                {{ end }}
+              {{ end }}
+            {{ end }}
+          {{ end }}
+
+          {{ if not $group_match }}
+            {{ $show = false }}
+          {{ end }}
+        {{ end }}
+
+        {{if $show}}
+        <div class="col-md-4">
+          <h2>
+            <span>{{$apiDetail.Name}}</span>
+            <span class="badge badge-primary">{{$apiDetail.AuthType}}</span>
+          </h2>
+          <p>{{$apiDetail.LongDescription | markDown}}</p>
+          {{ if $apiDetail.Documentation }}
+          <a href="{{ $page.PortalRoot }}apis/{{$apiDetail.Documentation}}/documentation/" class="btn btn-info catalogue">
+          <span class="glyphicon glyphicon-book" aria-hidden></span>  View documentation
+          </a>
+          <br/>
+          {{ end }}
+          {{if eq $apiDetail.Version "" }}
+          {{if eq $apiDetail.IsKeyless false}}
+          <a href="{{if $page.PortalConfig.EnableMultiSelection}}{{ $page.PortalRoot }}member/apis/request?policy_id={{$apiDetail.APIID}}{{else}}{{ $page.PortalRoot }}member/apis/{{$apiDetail.APIID}}/request{{end}}" class="btn btn-success catalogue">
+          <span class="glyphicon glyphicon-ok-sign" aria-hidden></span>  Request an API key
+          </a>
+          {{ end }}
+          {{ else }}
+          {{if eq $apiDetail.IsKeyless false}}
+          <a href="{{if $page.PortalConfig.EnableMultiSelection}}{{ $page.PortalRoot }}member/policies/request?policy_id={{$apiDetail.PolicyID}}{{else}}{{ $page.PortalRoot }}member/policies/{{$apiDetail.PolicyID}}/request{{end}}" class="btn btn-success catalogue">
+          <span class="glyphicon glyphicon-ok-sign" aria-hidden></span>  Request an API key
+          </a>
+          {{ end }}
+          {{ end }}
+        </div>
+        {{ end }}
+        {{ end }} {{ end }}
+      </div>
+      {{ else }}
+      <div class="row">
+        <p>
+          <em>It looks like there are no APIs in the Catalog.</em>
+        </p>
+      </div>
+      {{ end }}
+    </div>
+  </div>
+  {{ template "footer" .}}
+  </div>
+  {{/* /container */}}
+  {{ template "scripts" .}}
+</body>
+</html>
+{{ end }}
+
+
+```
+</Expandable>
+
+We're now going to overwrite the default catalogue.html template in the 'portal/templates' directory on the Tyk Dashboard instance with the custom one above.
+
+**NOTE**: After replacing or updating a template, the Dashboard must be restarted to apply the changes.
+
+Now the visibility of the "Internal API" is driven by the value of the "Group" field on the developer profile.
+
+### Multiple API subscriptions
+If you have enabled "Enable multiple API subscriptions" option in the portal settings, you also need to modify `request_multi_key.html` template. 
+The main difference from the default template is two changes:
+1. Get user data state at the start of template: `{{$profile := .UserData }}`
+2. Before rendering `<li>` element, which renders list of APIs, we insert the following section:
+```html
+{{ range $field, $value := $apiDetail.Fields }}
+	{{ $group_match := true }}
+	{{ if (eq $field "Group") }}
+		{{ $group_match = false }}
+		{{ range $dfield, $dvalue := $profile.Fields }}
+			{{ if eq $dfield "Group" }}
+				{{ if eq $dvalue $value }}
+					{{ $group_match = true }}
+				{{ end }}
+			{{ end }}
+		{{ end }}
+	{{ end }}
+
+	{{ if not $group_match }}
+		{{ $match = true }}
+	{{ end }}
+{{ end }}
+```
+
+<Expandable title='Click to expand and see the full template'>
+```html
+{{ define "requestMultiKey" }} {{ template "header" .}}
+{{$catalogue := .Catalogue}}
+{{$catalogues := .Catalogues}}
+{{$key := .Key}}
+{{$modifyKey := false}}
+{{$addKey := true}}
+{{if .Key}}{{$modifyKey = true}}{{$addKey = false}}{{end}}
+{{$profile := .UserData }}
+<body>
+  <div>
+    <div class="page-header">
+      <div class="page-header-container">
+        <div class="title text-center">
+          {{ if .Key }}
+          <h1>Modify API Key</h1>
+          {{ else }}
+          <h1>Request API Key</h1>
+          {{ end }}
+        </div>
+      </div>
+    </div>
+    <div
+      class="container content-wrapper key-request-flow-wrapper"
+      data-fixed-api="{{$catalogue}}"
+      data-key-req-fields-length="{{len .PortalConfig.KeyRequestFields}}"
+    >
+      <div class="row text-center">
+        <div class="col-lg-12 text-center">
+          {{ if .Error }}
+          <div class="alert alert-danger">
+            {{.Error}}
+          </div>
+          {{ end }}
+          {{ if not .DenyRequest }}
+          <ol class="breadcrumb">
+            <li class="cogs active "><a href="#choose-api" data-toggle="tab" aria-controls="choose-api" role="tab" title="Select API">Select API</a></li>
+            <li class="info disabled"><a href="#details" data-toggle="tab" aria-controls="details" role="tab" title="Enter details">Enter details</a></li>
+            <li class="check "><a href="#complete" data-toggle="tab" aria-controls="complete" role="tab" title="Complete">Final step</a></li>
+          </ol>
+          {{ end }}
+        </div>
+      </div>
+      {{ if not .DenyRequest }}
+      <form action="" method="POST" enctype="multipart/form-data">
+        <div class="alert alert-danger no-items-error" style="display: none">
+          You need to select at least an API for a key.
+        </div>
+        <div class="choose-api-wrapper auth-apis text-center">
+          <div class="selectable-list-component">
+            <h3 class="selected-items-title text-left">Selected APIs</h3>
+            {{if .Key}}
+            <p class="text-left"> List of APIs the key access</p>
+            {{else}}
+            <p class="text-left"> List of APIs the key will be generated for </p>
+            {{end}}
+            <div class="alert alert-info no-selected-api-msg">No selected APIs</div>
+            <ol class="selected-items items-list list-group">
+              {{range $index, $cat := $catalogues}}
+              <li
+                class="list-group-item item active clickable-item"
+                data-auth-type="{{$cat.AuthType}}"
+                data-use-certificate="{{$cat.UseCertificate}}"
+              >
+                <div class="details-container">
+                  <input type="checkbox" name="apply_policies[]" checked value="{{$cat.PolicyID}}" />
+                  <button type="button" class="btn btn-success add-item-btn"><span class="fa fa-check"></span>
+                  <br />Select API</button>
+                  <button type="button" class="btn btn-danger remove-item-btn"><span class="fa fa-times"></span>
+                  <br />Remove API</button>
+                  <span class="item-title">{{$cat.Name}}</span>
+                  <span class="badge badge-primary">{{$cat.AuthType}}</span>
+                </div>
+              </li>
+              {{end}}
+            </ol>
+            <h3 class="text-left">Available APIs to connect</h3>
+            <p class="text-left">List of APIs availble for key request. Once an API is selected the entire list is filtered by the selected APIs authentication type.</p>
+            <div class="alert alert-info no-available-apis-msg">No APIs available for selection</div>
+            <ol class="selectable-list items-list list-group">
+              {{$authType := $catalogue.AuthType}}
+              {{ range $index, $apiDetail := .APIS}}
+              {{ if $apiDetail.Show }}
+              {{ if ne $apiDetail.AuthType "oauth"}}
+
+              {{ $match := false }}
+              {{ range $cid, $cat := $catalogues }}
+                {{if eq $apiDetail.PolicyID $cat.PolicyID}}
+                  {{ $match = true }}
+                {{end}}
+              {{end}}
+
+              {{ range $field, $value := $apiDetail.Fields }}
+                {{ $group_match := true }}
+                {{ if (eq $field "Group") }}
+                  {{ $group_match = false }}
+                  {{ range $dfield, $dvalue := $profile.Fields }}
+                    {{ if eq $dfield "Group" }}
+                      {{ if eq $dvalue $value }}
+                        {{ $group_match = true }}
+                      {{ end }}
+                    {{ end }}
+                  {{ end }}
+                {{ end }}
+
+                {{ if not $group_match }}
+                  {{ $match = true }}
+                {{ end }}
+              {{ end }}
+
+              {{ if and (ne $match true) (or $addKey (eq $apiDetail.AuthType $authType)) }}
+                <li
+                  class="list-group-item item clickable-item"
+                  data-id="{{$apiDetail.PolicyID}}"
+                  data-auth-type="{{$apiDetail.AuthType}}"
+                  data-use-certificate="{{$apiDetail.UseCertificate}}"
+                  style="{{if ne $apiDetail.AuthType $authType }}display:none{{end}}"
+                >
+                <div class="details-container">
+                  <input type="checkbox" name="apply_policies[]" value="{{$apiDetail.PolicyID}}" />
+                  <button type="button" class="btn btn-success add-item-btn"><span class="fa fa-check"></span>
+                  <br />Select API</button>
+                  <button type="button" class="btn btn-danger remove-item-btn"><span class="fa fa-times"></span>
+                  <br />Remove API</button>
+                  <span class="item-title">{{$apiDetail.Name}}</span>
+                  <span class="badge badge-primary">{{$apiDetail.AuthType}}</span>
+                </div>
+              </li>
+              {{end}}
+              {{end}}
+              {{end}}
+              {{end}}
+            </ol>
+          </div>
+          <ul class="list-inline">
+            <li class="pull-left">
+              <a href="{{ .PortalRoot }}apis/" class="btn btn-success outline">Back to Api Catalogue</a>
+            </li>
+            <li class="pull-right">
+              <button type="button" class="btn btn-success next-auth-step" style="display: none">Save and continue</button>
+              <button type="submit" class="btn btn-success request-key-btn req-key-btn-first-step" style="display: none">Request key</button>
+            </li>
+          </ul>
+        </div>
+        <div class="request-key-form">
+          <input type="hidden" name="csrf_token" value="{{ .Token }}">
+          {{if gt (len .PortalConfig.KeyRequestFields) 0 }}
+          <h3 class="text-left">Key request form</h3>
+          {{ range $fieldname := .PortalConfig.KeyRequestFields }}
+          <div class="form-group">
+            <label for="{{$fieldname}}">{{$fieldname}}</label>
+            <input type="text" class="form-control" id="{{$fieldname}}" name="{{$fieldname}}" placeholder="">
+          </div>
+          {{ end }}
+          {{ end }}
+          {{ if $catalogue }}
+          <div class="jwt-form" style="display: none">
+            <h3 class="text-left">JWT secret</h3>
+            <div class="form-group">
+              <p>
+                This API is configured to validate against JSON Web Tokens, in order for this to work, we will need to know your HMAC Secret OR a valid RSA public key, please enter this below as part of your key request.
+              </p>
+              <label>Signature validation key:</label>
+              <textarea rows="10" class="form-control" id="jwt_secret" name="jwt_secret" placeholder="" value="" style="font-family: monospace;"></textarea>
+            </div>
+          </div>
+          <div class="use-certificate-form" style="display: none">
+            <h3 class="text-left">Certificate</h3>
+            <div class="form-group">
+          	  <label>Upload your public client certificate in PEM format:</label>
+          	  <textarea rows="10" class="form-control" id="certificate_upload" name="certificate" placeholder="" value="" style="font-family: monospace;"></textarea>
+        	  </div>
+          </div>
+          {{ end }}
+          <ul class="list-inline">
+            <li class="pull-left">
+              <button type="button" class="btn btn-success prev-auth-step outline">Back to Apis list</button>
+            </li>
+            <li class="pull-right">
+              {{if $addKey}}
+              <button type="submit" class="btn btn-success request-key-btn">Request key</button>
+              {{else}}
+              <button type="submit" class="btn btn-success request-key-btn">Request key changes</button>
+              {{end}}
+            </li>
+          </ul>
+        </div>
+      </form>
+      {{ end }}
+    </div>
+  </div>
+  {{ template "navigation" . }}
+  {{ template "footer" .}}
+  {{/* /container */}}
+  {{ template "scripts" .}}
+</body>
+</html>
+{{ end }}
+```
+</Expandable>
+
+#### Developer Logged In, Group field set to internal (Internal API is visible)
+<img src="/img/dashboard/portal-management/dev_logged_in_internal.jpg" alt="dev_logged_in_internal" width="700" />
+
+#### Developer Logged In, Group field not set or set so group other than internal (Internal API not visible)
+<img src="/img/dashboard/portal-management/dev_logged_in_external.jpg" alt="dev_logged_in_external" width="700" />
+
+#### No User Logged In (Internal API not visible)
+<img src="/img/dashboard/portal-management/no_user_logged_in.jpg" alt="no_user_logged_in" width="700" />
diff --git a/tyk-developer-portal/direct-access-flow.mdx b/tyk-developer-portal/direct-access-flow.mdx
new file mode 100644
index 0000000000..2d7e6a3256
--- /dev/null
+++ b/tyk-developer-portal/direct-access-flow.mdx
@@ -0,0 +1,112 @@
+---
+title: "How to Request Access to API Products Using Direct Access Flow"
+description: "This guide explains how to use the Direct Access Flow in the Tyk Developer Portal to request access to API products without the shopping cart, including creating applications, attaching credentials, changing plans, and admin configuration."
+keywords: "Tyk Developer Portal, Direct Access Flow, API Products, API Plans, Shopping Cart, Credentials"
+sidebarTitle: "Direct Access Flow"
+---
+
+## Availability
+
+| Component   | Version              | Editions                |
+| :------------- | :---------------------- | :------------------------- |
+| Developer Portal | Available since [v1.16.0](/developer-support/release-notes/portal#1-16-0-release-notes) | Enterprise |
+
+## Prerequisites
+
+1. **Dashboard License**: [Contact our team](https://tyk.io/contact/) to obtain a license or get self-managed trial license by completing the registration on our [website](https://tyk.io/self-managed-trial/).
+2. **Working Tyk Environment:** You need access to a running Tyk instance. For setup instructions using Docker, please refer to the [Tyk Getting Started Guide](/getting-started/quick-start).
+3. Developer Portal Setup with
+    1. Admin access to the Tyk Developer Portal.
+    2. The end user (developer accounts) must exist in the portal.
+    3. Tyk Developer Portal v1.16.0 or later.
+    4. [API Products](/portal/api-products), [Plans](/portal/api-plans) and [Catalogue](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues) already created and published in the portal.
+
+## What we will do
+
+1. Enable the Direct Access flow in the Admin Portal settings.
+2. Request access to an [API Product](/portal/api-products) as a developer and create a new [application](/portal/developer-app).
+3. Configure and manage access as an admin on behalf of developers.
+
+## Instructions
+
+Follow these steps to configure and use the Direct Access flow in the Tyk Developer Portal:
+
+### 1. Enable Direct Access Flow (Admin)
+
+1. Log in to the **Admin Portal** as an administrator.
+2. In the main navigation, go to **Settings**.
+3. Select **General** from the settings menu.
+4. Locate the **API product access flow** setting.
+    - By default, this is set to **Cart-based flow**.
+5. Switch the option from **Cart-based flow** to **Direct access flow**.
+6. Click **Save** to apply the changes.
+
+    <img src="/img/developer-portal/configure-direct-access-flow.png" alt="configure direct access flow in portal" />
+
+<Note>
+Once enabled, all API consumers will experience the Direct Access flow when requesting access to API products from the Live Portal.
+</Note>
+
+### 2. Request Access to an API Product (Developer)
+
+When the Direct Access flow is enabled, developers can request access to an API product without going through a shopping cart:
+
+1. Log in to the **Developer Portal** as an API Consumer.
+2. In the main navigation, go to **Catalogues**.
+3. Browse the API Catalog and click on an API product you want to access.
+4. Review the available plans and their rate limits/quotas.
+5. Select the **Plan** you want to use.
+6. Click **Access with this plan**.
+    - Notice there is no shopping cart step - you go directly to the access request page.
+7. In the access request form:
+    - Enter an **Application name** (e.g., `My Weather App`).
+    - Optionally add a **Description** for the application.
+8. Click **Submit request**.
+
+<Note>
+If the plan is configured for auto-approval, credentials will be issued immediately. Otherwise, an API Owner will review and approve your request.
+</Note>
+
+#### View Your Credentials
+
+**After approval:**
+
+1. Click on your profile icon in the top-right corner and select **My Dashboard** from the dropdown.
+2. Go to **My Apps** in the left navigation.
+3. Click on your application.
+4. In the **Credential Management** section, you will see your access credentials.
+    - Click **Show** to reveal the API key.
+    - Copy the credentials for use in your API requests.
+
+    <img src="/img/developer-portal/credential-approved-direct-access-flow.png" alt="direct access flow credentials approved" />
+
+## Configure Access as an Admin
+
+Portal administrators can perform similar operations on behalf of developers from the Admin Portal:
+
+### Create Applications for Developers
+
+1. Log in to the **Admin Portal** as an administrator.
+2. Navigate to **API Consumers > Applications**.
+3. Click **Add new application**.
+4. Enter the application details:
+    - **Application name**
+    - **Description**
+    - Select the **Developer (API Consumer)** who will own the application.
+    - Configure **Visibility settings**.
+5. Click **Save**.
+
+### Add Credentials and Products
+
+1. Navigate to the application details page.
+2. Click **Add credential**.
+3. Choose the **API Product** and **Plan** to associate with the credential.
+
+    <img src="/img/developer-portal/admin-adding-multiple-api-products.png" alt="admin adding multiple api products to a single plan" />
+
+4. Click on **Save Changes**
+5. The credential will be generated and associated with the selected product/plan.
+6. Additional products on the same plan can be added to this credential.
+
+    <img src="/img/developer-portal/admin-created-app-multiple-creds.png" alt="single credentials for multiple api products" />
+
diff --git a/tyk-developer-portal/enable-audit-logs-portal.mdx b/tyk-developer-portal/enable-audit-logs-portal.mdx
new file mode 100644
index 0000000000..cb663c3e9c
--- /dev/null
+++ b/tyk-developer-portal/enable-audit-logs-portal.mdx
@@ -0,0 +1,140 @@
+---
+title: "Enable and View Audit Logs in Tyk Developer Portal"
+description: "Learn how to enable audit logging in Tyk Developer Portal and access the audit log file to track admin actions."
+keywords: "Audit Logs, Developer Portal, compliance, security, admin actions"
+sidebarTitle: "Enable Audit Logs"
+---
+
+## Availability
+
+| Component | Version | Edition |
+| :-------- | :------ | :------- |
+| Tyk Enterprise Developer Portal | Available since [v1.7.0](/developer-support/release-notes/portal#1-7-0-release-notes) | Enterprise |
+
+## Prerequisites
+
+1. **License**: [Contact our team](https://tyk.io/contact/) to obtain a license or get a self-managed trial license by completing the registration on our [website](https://tyk.io/self-managed-trial/).
+2. **Working Tyk Environment**: You need access to a running Tyk instance. For quick setup instructions using Docker, please refer to the [Tyk Getting Started Guide](/getting-started/quick-start).
+3. **Admin Access**: You need admin permissions to configure audit logging in the Portal.
+
+## What We Will Do
+
+In this guide, we will:
+1. Enable audit logs in the Tyk Developer Portal using the file storage option
+2. Configure the log file path and format
+3. View the audit logs from the log file
+
+<Note>
+The Developer Portal uses file-based audit logging. Unlike the Tyk Dashboard, the Portal does not currently support database storage for audit logs or viewing them through the Portal UI.
+</Note>
+
+## Instructions
+
+### 1. Configure Audit Logging
+
+To enable audit logging in the Developer Portal, you need to configure the audit log settings.
+
+<Tabs>
+<Tab title="Environment Variables">
+
+Set the following environment variables:
+
+```bash
+PORTAL_AUDIT_LOG_ENABLE=true
+PORTAL_AUDIT_LOG_PATH=/var/log/portal
+```
+
+</Tab>
+<Tab title="Configuration File">
+
+Add the following to your Portal configuration file:
+
+```json
+{
+  "AuditLog": {
+    "Enable": true,
+    "Path": "/var/log/portal"
+  }
+}
+```
+
+</Tab>
+</Tabs>
+
+<Warning>
+Ensure the directory specified in `PORTAL_AUDIT_LOG_PATH` exists and is writable by the Portal process. If using containers, mount a volume to persist logs.
+</Warning>
+
+For more information on configuration options, refer to the [Portal Configuration Reference](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#audit-log-settings).
+
+### 2. Restart the Developer Portal
+
+After updating the configuration, restart your Developer Portal for the changes to take effect:
+
+```bash
+# For Docker
+docker restart tyk-portal
+
+# For Docker Compose
+docker compose restart tyk-portal
+
+# For Kubernetes
+kubectl rollout restart deployment tyk-portal -n tyk
+```
+
+### 3. View Audit Logs
+
+Once audit logging is enabled, admin actions are recorded in the `portal.log` file located in the directory specified by `PORTAL_AUDIT_LOG_PATH`.
+
+#### Access the Log File
+
+```bash
+# View the audit log file
+cat /var/log/portal/portal.log
+
+# Follow the log file in real-time
+tail -f /var/log/portal/portal.log
+
+# Search for specific actions
+grep "admin@example.com" /var/log/portal/portal.log
+```
+
+<img src="/img/developer-portal/portal-audit-logs.png" alt="Portal Audit Logs" />
+
+#### For Docker Containers
+
+```bash
+# Access logs from a running container
+docker exec -it tyk-portal cat /var/log/portal/portal.log
+```
+
+#### For Kubernetes
+
+```bash
+# Access logs from a running pod
+kubectl exec -it deployment/tyk-portal -n tyk -- cat /var/log/portal/portal.log
+```
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title='Permission Denied When Accessing Audit Logs'>
+
+1. **Check if audit logging is enabled**: Verify `PORTAL_AUDIT_LOG_ENABLE` is set to `true`
+2. **Verify directory exists**: Ensure the directory specified in `PORTAL_AUDIT_LOG_PATH` exists
+3. **Check permissions**: Confirm the Portal process has write permissions to the log directory
+4. **Check Portal logs**: Review Portal startup logs for any configuration errors
+
+```bash
+# Check if the directory exists
+ls -la /var/log/portal/
+
+# Check Portal container logs
+docker logs tyk-portal 2>&1 | grep -i audit
+```
+
+</Accordion>
+
+</AccordionGroup>
+
diff --git a/tyk-developer-portal/graphql-playground.mdx b/tyk-developer-portal/graphql-playground.mdx
new file mode 100644
index 0000000000..2e33684e7c
--- /dev/null
+++ b/tyk-developer-portal/graphql-playground.mdx
@@ -0,0 +1,183 @@
+---
+title: "Set Up GraphQL Documentation for API Products"
+description: "How to add GraphQL SDL documentation and enable the interactive Playground for an API Product in the Tyk Developer Portal."
+sidebarTitle: "GraphQL Playground"
+keywords: "Developer Portal, GraphQL, SDL, GraphQL Playground, Universal Data Graph, UDG, API Product documentation, GraphQL schema"
+---
+
+## Availability
+
+| Component | Version | Editions |
+| :--- | :--- | :--- |
+| Developer Portal | v1.15.0 | Enterprise |
+
+<Note>
+[GraphQL Server URL auto-population](#graphql-server-url-and-baseline-url) and [Universal Data Graph (UDG)](#universal-data-graph-apis) support require v1.16.0 or later.
+</Note>
+
+## Overview
+
+You can add a GraphQL Schema Definition Language (SDL) file to an API Product to enable the interactive GraphQL Playground in the Live Portal. Consumers with approved access can write and execute queries directly from the Portal, with their credentials automatically pre-populated in the Playground headers.
+
+## Prerequisites
+
+- Developer Portal v1.15.0 or later
+- A [working Tyk environment](/getting-started/quick-start) with Tyk Gateway and Tyk Dashboard
+- A GraphQL SDL schema file in `.graphql`, `.graphqls`, `.gql`, or `.json` format
+
+
+## Add GraphQL Documentation to an API Product
+
+1. **Create a test GraphQL API**
+
+   If you don't have an existing GraphQL API, use the built-in Star Wars example from the Tyk Dashboard:
+   - Navigate to **APIs > Add New API**, click **Try example**, select **Star Wars GQL API**, and click **Use Example**
+   - Copy the **Key ID** from the confirmation pop-up and save it; you will use this as the auth header when testing in the Playground
+   - Go to the **Schema** tab of the newly created API and download the schema file; you will upload this as the SDL file in step 5
+
+   <img src="/img/graphql-api-star-wars-schema.png" alt="GraphQL API Schema Tab" />
+
+2. Navigate to **Developer Portal > API Products** and [create a new API Product](/portal/api-products#creating-a-new-api-product).
+
+3. On the **APIs** tab, select your GraphQL API:
+   - **Choose a Provider**: select the Tyk Dashboard Provider
+   - **Choose authentication method**: match the authentication configured on your GraphQL API
+   - **Select APIs**: check your GraphQL API from the list
+
+   <img src="/img/dashboard/portal-management/enterprise-portal/portal-product-details.png" alt="Configure API Product details" />
+
+4. Go to the **Documentation** tab and click **Add API specification**.
+
+5. Set the specification type to **GraphQL SDL**, then upload your schema file.
+
+   Accepted formats are `.graphql`, `.graphqls`, `.gql`, and `.json`.
+
+   <img src="/img/graphql-docs-tab-playground-setup.png" alt="Documentation tab with GraphQL SDL upload and Server URL field" />
+
+6. Set the **GraphQL Server URL** to the live endpoint of your GraphQL API on the Tyk Gateway (for example, `http://gateway.example.com/my-graphql-api/`). From v1.16.0, this is [auto-populated](#graphql-server-url-and-baseline-url) from the Provider's Gateway Base URL and the API's listen path; you can always edit the value manually.
+
+   <Note>
+   The URL must end with a trailing slash. A missing trailing slash causes a 404 error in the Playground.
+   </Note>
+
+7. Click **Save Changes**.
+
+8. Open your **Live Portal**, go to [**Product Catalogues**](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues), locate the product, and click **Docs**.
+
+   <img src="/img/graphql-docs-live-portal.png" alt="GraphQL API Docs Live Portal" />
+
+9. You should now see the **GraphQL Playground**, ready for interactive query testing.
+
+   <Note>
+   To test authenticated APIs, set the required headers in the Playground. The Star Wars GQL API uses [Auth Token](/api-management/authentication/bearer-token) authentication.
+   
+   Add the `Authorization` header using the Key ID you saved in step 1:
+
+   ```json
+   {
+       "Authorization": "YOUR_KEY_ID"
+   }
+   ```
+
+   The `Bearer ` prefix is optional, Tyk Gateway strips it automatically if present. The exact header name depends on your API's authentication configuration.
+   </Note>
+
+   <img src="/img/graphql-playground-portal.png" alt="GraphQL API Playground" />
+
+## GraphQL Server URL and Baseline URL
+
+The **GraphQL Server URL** is the endpoint the Playground sends queries to. It must point to your GraphQL API on the Tyk Gateway.
+
+From v1.16.0, the Developer Portal automatically constructs this URL from two values:
+
+```
+{Gateway Base URL}/{API listen path}
+```
+
+The **Gateway Base URL** is the public-facing base URL of your Tyk Gateway (for example, `https://gateway.example.com`). Set it in **Admin Portal > Providers > [your provider] > Baseline URL**.
+
+If the Gateway Base URL is not configured, the server URL field displays `<<gateway url>>`. Enter the full URL manually before saving.
+
+## SDL and Introspection Behavior
+
+GraphQL introspection is a built-in feature that allows clients to query an API's schema to discover its available types and operations. The Playground uses introspection to display the schema when no SDL file has been uploaded.
+
+The Playground loads its schema in the following order:
+
+| SDL file status | Playground behavior |
+| :--- | :--- |
+| SDL file uploaded | Schema is loaded from the uploaded file. Introspection is not needed, so the Playground works even on authenticated or network-restricted APIs. |
+| No SDL file | Playground attempts live introspection against the GraphQL Server URL. |
+| No SDL file, introspection fails | Playground enters read-only mode with a warning banner. Queries cannot be executed. |
+
+For APIs that require authentication, uploading an SDL file is strongly recommended. Introspection is blocked on protected endpoints, and without an SDL file the Playground will fall back to read-only mode.
+
+## Universal Data Graph APIs
+
+From v1.16.0, [Universal Data Graph (UDG)](/api-management/data-graph) APIs appear alongside standard GraphQL APIs in the API selection list. Configure the Documentation tab for a UDG API the same way: upload the SDL file and set the GraphQL Server URL.
+
+**Limitation:** REST data sources in a UDG API do not support GraphQL subscriptions. Subscription operations will not be available in the Playground for those data sources.
+
+## Credential Injection in the Playground
+
+When an API Consumer's [Developer App](/portal/developer-app) has been approved to access a Product, their credentials are automatically pre-populated in the Playground's HTTP headers. No additional configuration is required.
+
+The header format matches the authentication scheme of the APIs in the Product. For example, for an [Auth Token](/api-management/authentication/bearer-token) API:
+
+```json
+{
+  "Authorization": "<consumer-token>"
+}
+```
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title="404 GraphQL API Not Found error in the Playground">
+
+The Playground cannot locate your GraphQL API endpoint.
+
+Ensure the GraphQL Server URL ends with a trailing slash. For example, use `http://localhost:8080/my-graphql-api/` not `http://localhost:8080/my-graphql-api`.
+
+You can find the correct endpoint URL in the **Core Settings** tab of your GraphQL API in Tyk Dashboard.
+
+</Accordion>
+
+<Accordion title='"Failed to fetch" error in the Playground'>
+
+This error is caused by CORS (Cross-Origin Resource Sharing) restrictions on the API. The browser blocks requests from the Live Portal origin to the Gateway.
+
+Add the following CORS configuration to your GraphQL API definition, replacing the `allowed_origins` value with the URL of your Live Portal:
+
+```json expandable
+{
+  "CORS": {
+    "enable": true,
+    "max_age": 24,
+    "allow_credentials": true,
+    "exposed_headers": ["*"],
+    "allowed_headers": ["*"],
+    "options_passthrough": true,
+    "debug": false,
+    "allowed_origins": ["http://<DEVELOPER_PORTAL>:<PORT>"],
+    "allowed_methods": []
+  }
+}
+```
+
+</Accordion>
+
+<Accordion title="Playground is in read-only mode">
+
+The Playground enters read-only mode when no SDL file has been uploaded and live introspection of the endpoint fails.
+
+To resolve this, try one of the following:
+
+- Upload a GraphQL SDL file on the **Documentation** tab of the API Product.
+- Verify the **GraphQL Server URL** is correct and reachable from the Portal server.
+- If the API requires authentication, upload an SDL file; introspection is blocked on authenticated endpoints.
+
+</Accordion>
+
+</AccordionGroup>
diff --git a/tyk-developer-portal/import-custom-credentials.mdx b/tyk-developer-portal/import-custom-credentials.mdx
new file mode 100644
index 0000000000..2d309825d6
--- /dev/null
+++ b/tyk-developer-portal/import-custom-credentials.mdx
@@ -0,0 +1,144 @@
+---
+title: "How to Associate API Products with Tyk Managed Custom Credentials"
+description: "This guide explains how an admin of the Tyk Developer Portal can associate API Products with Tyk Managed Custom Credentials. It covers the manual UI steps, how to verify on the developer portal, and guidance for bulk imports via the Developer Portal APIs."
+keywords: "Tyk Developer Portal, Custom Credentials, API Products, API Plans, API Documentation"
+sidebarTitle: "Import Custom Credentials"
+---
+
+## Availability 
+
+| Component   | Version              | Editions                |
+| :------------- | :---------------------- | :------------------------- |
+| Developer Portal | Available since [v1.12.0](/developer-support/release-notes/portal#1-12-0-release-notes) | Enterprise |
+
+## Prerequisites
+
+1. **Dashboard License**: [Contact our team](https://tyk.io/contact/) to obtain a license or get self-managed trial license by completing the registration on our [website](https://tyk.io/self-managed-trial/).
+2. **Working Tyk Environment:** You need access to a running Tyk instance. For setup instructions using Docker, please refer to the [Tyk Getting Started Guide](/getting-started/quick-start).
+3. Developer Portal Setup with
+    1. Admin access to the Tyk Developer Portal.
+    2. The end user (developer accounts) must exist in the portal.
+    3. Tyk Developer Portal v1.12.0 or later
+    4. [API Products](/portal/api-products), [Plans](/portal/api-plans) and [Catalogue](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues) already created and published in the portal.
+4. The custom token or credential value you want to import.
+
+## What we will do
+
+1. Create an [application](/portal/developer-app) in the Developer Portal for the user.
+2. Add a custom credential to that app.
+4. Select one or more [API Product](/portal/api-products) and the [Plan](/portal/api-plans) to associate with that credential.
+5. Save, confirm visibility on the user’s developer portal dashboard, and verify API access.
+
+<Note>
+**Watch the video demo on YouTube** — a short walkthrough that shows the entire flow (creating an app, importing a custom token, attaching products & plans, and verifying access).
+
+<iframe
+  className="w-full aspect-video rounded-xl"
+  src="https://www.youtube.com/embed/ml983AfLP5k"
+  title="How to Import Custom API Tokens into the Tyk Developer Portal (Step-by-Step)"
+  allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
+  allowFullScreen
+></iframe>
+</Note>
+
+## Instructions
+
+Follow these steps to associate products and plans with custom credentials in the Tyk Developer Portal:
+
+### 1. Create Application and Import Custom Credential
+
+1. Log in to the Developer Portal as an **Administrator**.
+2. In the left-hand navigation, go to **Apps** 
+3. Click **Add New App**
+    - Enter a **Name** for the application (e.g., `Demo App`).
+    - Select the **App Owner** that this application belongs to (the developer/customer account).
+4. Next, click on the **Add Credential** button.
+
+    <img src="/img/developer-portal/add-custom-credential.png" alt="Add Custom Credential Button" />
+
+    - **Credential alias**: descriptive name for the credential (e.g., `Custom API Token`).
+    - **Type of Credential**: choose **Tyk Managed** (so the portal can manage the credential metadata).
+    - **Authentication method**: select **Auth Token**.
+    - **Tyk authentication token type**: choose **Custom** (so you can paste your existing token value).
+    - **Key ID**: paste the actual token value you are importing.
+6. Next, in the **Access rights** section:
+   * In the same dialog, choose the **Plan** you want to attach to this credential.
+   * Select the API **Products** (one or more) that this credential should provide access to.
+7. Click **Save** to create the application.
+
+<Note>
+When you add a Tyk Managed Custom Credential, the Developer Portal automatically creates a corresponding API key in the Tyk Dashboard for that credential. You can find this key in the Dashboard, which allows you to manage and monitor its usage alongside other credentials.
+
+<img src="/img/developer-portal/custom-credentials-dashboard.png" alt="Custom Credentials Dashboard" />
+</Note>
+
+### 2. Verify in Live Portal
+
+1. Log in to the **developer portal** as the end user.
+2. Go to **My Apps**, by clicking on your profile icon in the top-right corner and select **My Dashboard** from the dropdown.
+
+    <img src="/img/developer-portal/view-apps.png" alt="View My Apps" />
+
+
+3. Open the created **Application** (Demo App), now the user can view:
+    1. The imported custom token.
+    2. **Products** associated with the credential and click into them to view OpenAPI specs, Graph explorer, or other product details.
+    3. The Plan details (rate limits, quotas) should be visible as part of the application/product view so the user understands limits that apply to their token.
+
+    <img src="/img/developer-portal/view-credentials.png" alt="View My Credentials" />
+
+### 3. Verify API access
+
+The exact header and method depend on how your gateway expects the token (Authorization header, X-API-Key, etc.).
+
+Example (replace `CUSTOM_KEY` and `https://api.example.com/endpoint` with your values):
+
+```bash
+curl -v -H "Authorization: Bearer CUSTOM_KEY" https://api.example.com/endpoint
+```
+
+If everything is set up correctly, you should receive a successful response from the API, confirming that the custom credential is working and has access to the associated products.
+
+## Import Custom Credentials via API
+
+If you have a large number of users and tokens to import, you can replicate the workflow above programmatically using the Tyk Developer Portal APIs.
+
+1. Use the [Create Application API](https://tyk.io/docs/api-reference/applications-and-credentials/create-a-new-developer-application) to create the application for the user.
+
+    ```bash
+    curl --request POST \
+        --url http://localhost:3001/portal-api/apps \
+        --header 'Authorization: <api-key>' \
+        --header 'Content-Type: application/json' \
+        --data '{
+            "Name": "Payment App",
+            "Description": "This is my payment application",
+            "RedirectURLs": "https://app-host/auth",
+            "UserID": 1,
+            "Visibility": "personal"
+        }'
+    ```
+
+2. Use the [Add Credential to Application API](https://tyk.io/docs/api-reference/applications-and-credentials/create-a-custom-credential) to add the custom credential, specifying the token value, and associating the desired products and plan.
+
+    ```bash
+    curl --request POST \
+        --url http://localhost:3001/portal-api/apps/{app_id}/custom_credentials \
+        --header 'Authorization: <api-key>' \
+        --header 'Content-Type: application/json' \
+        --data '{
+            "Alias": "<string>",
+            "Type": "CREDENTIAL_TYPE_TYK_MANAGED",
+            "PlanID": 123,
+            "AuthenticationMethod": "<string>",
+            "ProductIDs": [
+                123
+            ],
+            "AuthTokenType": "AUTH_TOKEN_CUSTOM",
+            "KeyID": "<string>",
+            "CredentialKey": "<string>",
+            "CredentialSecret": "<string>",
+            "ProviderID": 123,
+            "ClientTypeID": 123
+        }'
+    ```
\ No newline at end of file
diff --git a/tyk-developer-portal/single-credentials-multiple-api-products.mdx b/tyk-developer-portal/single-credentials-multiple-api-products.mdx
new file mode 100644
index 0000000000..cffb140d0b
--- /dev/null
+++ b/tyk-developer-portal/single-credentials-multiple-api-products.mdx
@@ -0,0 +1,108 @@
+---
+title: "How to use Existing Credentials with Multiple API Products"
+description: "This guide explains how to use existing credentials with multiple API Products in the Tyk Developer Portal"
+keywords: "Tyk Developer Portal, Single Credential, API Products, API Plans,, Credentials"
+sidebarTitle: "Existing Credentials with Multiple API Products"
+---
+
+## Availability
+
+| Component   | Version              | Editions                |
+| :------------- | :---------------------- | :------------------------- |
+| Developer Portal | Available since [v1.16.0](/developer-support/release-notes/portal#1-16-0-release-notes) | Enterprise |
+
+## Prerequisites
+
+1. **Dashboard License**: [Contact our team](https://tyk.io/contact/) to obtain a license or get self-managed trial license by completing the registration on our [website](https://tyk.io/self-managed-trial/).
+2. **Working Tyk Environment:** You need access to a running Tyk instance. For setup instructions using Docker, please refer to the [Tyk Getting Started Guide](/getting-started/quick-start).
+3. Developer Portal Setup with
+    1. Admin access to the Tyk Developer Portal.
+    2. The end user (developer accounts) must exist in the portal.
+    3. Tyk Developer Portal v1.16.0 or later.
+    4. [API Products](/portal/api-products), [Plans](/portal/api-plans) and [Catalogue](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues) already created and published in the portal.
+    5. Approved access request to an API Product as a developer and an application already created. please refer to the [guide](/tyk-developer-portal/direct-access-flow#instructions).
+
+## What we will do
+
+1. Request access to an [API Product](/portal/api-products) as a developer and create a new [application](/portal/developer-app).
+2. Add more products to an existing application by reusing credentials.
+3. Change the [Plan](/portal/api-plans) for an existing credential.
+4. Handle scenarios where different plans require separate credentials within the same app.
+
+## Instructions
+
+Follow these steps to configure and use the Direct Access flow in the Tyk Developer Portal:
+
+### 1. Add More Products Using an Existing Credential
+
+Once you have an application with approved access to at least one API product, you can add access to additional products using your existing credential:
+
+1. Log in to the **Developer Portal** as an API Consumer.
+2. Navigate to **Catalogues** and select another API product.
+3. Select the **same plan** that your existing credential uses (e.g., if your existing credential uses "Gold", select "Gold" for the new product).
+4. Click **Access with this plan**.
+6. On the access request page, select your existing **Application** from the dropdown. You will see the option to **use an existing credential**.
+7. Choose the existing **Credential** that uses the matching plan.
+8. Click **Submit request**.
+
+    <img src="/img/developer-portal/api-product-select-exisiting-credential.png" alt="Select Existing Credentials for the API Product" />
+
+<Note>
+**Key benefit**: Your existing credential will now provide access to both API products. You don't need to manage multiple API keys when using the same plan across multiple products.
+</Note>
+
+#### View Your Credentials
+
+**After approval:**
+
+1. Click on your profile icon in the top-right corner and select **My Dashboard** from the dropdown.
+2. Go to **My Apps** in the left navigation.
+3. Click on your application.
+4. In the **Credential Management** section, you will see your access credentials.
+    - Click **Show** to reveal the API key.
+    - Copy the credentials for use in your API requests.
+
+    <img src="/img/developer-portal/single-credential-multiple-products.png" alt="single credentials multiple api products" />
+
+### 2. Change the Plan for an Existing Credential
+
+Developers can upgrade or downgrade their plan for existing product access:
+
+1. Log in to the **Developer Portal** and navigate to **My Dashboard**.
+2. Go to **My Apps** and click on the relevant application.
+3. Find the credential you want to modify.
+4. Click **Change plan**
+5. Choose your new plan from the available options (e.g., upgrade from Gold to Platinum).
+6. Submit the plan change request.
+
+<Warning>
+**Important behavior for plan changes:**
+- A plan change creates a new access request that requires approval (unless the new plan is configured for auto-approval).
+- Your current access remains active on the existing plan until the new plan is approved.
+- If your credential provides access to multiple API products, changing the plan will affect access to **all products** on that credential.
+</Warning>
+
+### 3. Handle Different Plans Within the Same Application
+
+When you want to add an API product using a **different plan** than your existing credentials:
+
+1. Log in to the **Developer Portal** and navigate to **Catalogues**.
+2. Select an API product.
+3. Select a **different plan** than your existing credentials use (e.g., if your existing credential uses "Gold" but you want "Bronze" for this product).
+4. Click **Request access**.
+5. On the access request page, you will **not** see the option to reuse your existing credential.
+6. The system will require you to **create a new credential** for this plan:
+    - Enter a **Name** for the new credential.
+    - Complete the access request form.
+7. Click **Submit request**.
+
+<Note>
+**Why a new credential is required**: A single credential can only be associated with ONE API plan. This ensures consistent rate limiting and quota enforcement across all products accessed through that credential.
+</Note>
+
+#### Credential Compatibility Reference
+
+| Scenario | Can Reuse Existing Credential? | Action Required |
+|----------|-------------------------------|-----------------|
+| Same plan as existing credential | Yes | Select existing credential |
+| Different plan than existing credential | No | Create new credential |
diff --git a/tyk-developer-portal/tyk-enterprise-developer-portal/api-consumer-portal/reset-password.mdx b/tyk-developer-portal/tyk-enterprise-developer-portal/api-consumer-portal/reset-password.mdx
new file mode 100644
index 0000000000..9bacadbb0e
--- /dev/null
+++ b/tyk-developer-portal/tyk-enterprise-developer-portal/api-consumer-portal/reset-password.mdx
@@ -0,0 +1,38 @@
+---
+title: "Forgotten Password"
+description: "How to reset your password when using Tyk Developer Portal"
+keywords: "Developer Portal, Tyk, Password, Reset Password, Forgotten Password"
+sidebarTitle: "Forgotten Password"
+---
+
+If you've forgotten your password, you can easily reset it through the Developer Portal. This process works for both API Owners and API Consumers.
+
+1. Navigate to the Developer Portal and select the **Login** button.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/login-portal-forgot.png" alt="Portal login screen showing the login form with username and password fields" />
+
+2. On the login screen, select the **Forgot Password?** link located below the login form.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/forgot-password.png" alt="Password reset form requesting email address" />
+
+3. Enter the email address associated with your account and select **Reset**.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/forgot-password-email.png" alt="Confirmation screen showing that a password reset email has been sent" />
+
+4. Check your email inbox for a message from the Tyk Developer Portal. The email will contain a password reset link in this format: `https://<your-portal-domain>/auth/reset/code?token=<token-id>`
+
+5. Click the reset link in the email. This will take you to a password reset page in the Developer Portal.
+6. Enter your new password in both fields and click **Reset**.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/reset-password-request.png" alt="Password reset form with fields to enter and confirm a new password" />
+
+7. After successfully resetting your password, click **Login again** to return to the login screen with your new credentials.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/reset-done.png" alt="Success screen confirming the password has been reset" />
+
+## Important Notes
+
+- Password reset links are valid for a limited time only
+- If your reset link expires, simply restart the process
+- Ensure your new password meets the system's security requirements
+- For security reasons, you'll be required to log in immediately after resetting your password
diff --git a/tyk-developer-portal/tyk-portal-classic.mdx b/tyk-developer-portal/tyk-portal-classic.mdx
new file mode 100644
index 0000000000..d8c7ffaeb4
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic.mdx
@@ -0,0 +1,38 @@
+---
+title: "Tyk Classic Developer Portal"
+keywords: ""
+order: 1
+robots: "noindex, nofollow"
+sidebarTitle: "Overview"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+The Tyk Classic Developer Portal is a small CMS-like system that enables you to expose a facade of your APIs and then allow third-party developers to register and use your APIs.
+
+The Tyk Classic Developer Portal enables you to:
+
+*   Host pages written in Markdown to describe your API and product.
+*   Use Bootstrap based templates to completely customize the look and feel.
+*   Host your API documentation in Swagger/OpenAPI or API Blueprint for developers to use. In the case of Swagger/OpenAPI, you can either paste your Swagger content (JSON or YAML) into the code editor, or via a link to a public Swagger hosted URL, which can then be rendered by using [Swagger UI](https://swagger.io/tools/swagger-ui/).
+*   Unlike other platforms, Tyk will not auto-publish your APIs to the Portal, instead they are presented as a facade, you choose what APIs and what Policies to expose to the Portal.
+*   Fully control the flow of the developer sign-up and enrollment.
+
+The Tyk Classic Developer Portal is suitable for primary use cases, however if you want a more feature-rich experience then you should consider the [Tyk Enterprise Developer Portal](/portal/overview/intro). This provides audience management, full UI customization including custom JS insertion and custom page templates, forums and blog features, grouping APIs into API Products, and other enterprise-grade features.
+
+
+<Note>
+Support for API Blueprint is being deprecated. See [Importing APIs](/api-management/gateway-config-managing-classic#api-blueprint-is-being-deprecated) for more details.
+</Note>
+
+
+The Tyk Classic Developer Portal is available to Tyk Self-Managed and Tyk Cloud users.
+
+For examples of how clients have used our portal, visit:
+
+- [https://developer.hotelbeds.com/](https://developer.hotelbeds.com/)
+- [https://developer.ft.com/portal](https://developer.ft.com/portal)
+- [https://developer.geops.io/](https://developer.geops.io/)
+- [https://opentransportdata.swiss/en/](https://opentransportdata.swiss/en/)
diff --git a/tyk-developer-portal/tyk-portal-classic/curity-dcr.mdx b/tyk-developer-portal/tyk-portal-classic/curity-dcr.mdx
new file mode 100644
index 0000000000..6b54d05fe6
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/curity-dcr.mdx
@@ -0,0 +1,329 @@
+---
+title: "Step by step guide using Curity"
+order: 4
+robots: "noindex, nofollow"
+sidebarTitle: "Step by step guide using Curity"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+This guide describes how to integrate [The Curity Identity Server](https://curity.io/) with the Tyk Developer Portal using [OpenID Connect Dynamic Client Registration protocol](https://tools.ietf.org/html/rfc7591).
+
+Use case outline:
+
+1. A developer registers an account with the Tyk Developer Portal and uses the portal to create a new client.
+
+2. Tyk sends a <Tooltip tip="Dynamic Client Registration">DCR</Tooltip> request to the <Tooltip tip="Identity Provider">IDP</Tooltip>, in this case The Curity Identity Server. The IDP replies with the Client ID and Secret.
+
+3. Using the provided Client ID and Secret, the developer (or an application) can initiate an Authorization flow to obtain an Access Token from The Curity Identity Server.
+
+4. The developer (or the application) can then use the Access Token when calling an API exposed by Tyk. In the case when a JWT is used to protect the API, Tyk validates the token using the <Tooltip tip="JSON Web Key Sets">JWKS</Tooltip> provided by The Curity Identity Server. The API can also be protected using the [Split Token Approach](https://github.com/sedkis/split-token-tyk).
+
+### Requirements
+
+- An installation of The Curity Identity Server. Follow the [Getting Started Guide](https://curity.io/resources/getting-started/) if an installation is not already available.
+- A [Tyk Self-Managed installation](/tyk-self-managed/install) (Gateway + Dashboard).
+
+### Enable DCR in The Curity Identity Server
+
+By default, DCR is not enabled in The Curity Identity Server. In the Admin UI, go to **Profiles** &rarr; **Token Service** &rarr; **General** &rarr; **Dynamic Registration**. Set both **Enable DCR** and **Non-templatized** to enabled and set the **Authentication Method** to `no-authentication`.
+
+<img src="/img/dcr/curity/1-curity-admin-ui-dcr.png" alt="Enable DCR" />
+
+Navigate to **Profiles** &rarr; **Token Service** &rarr; **Endpoints** and locate the path of the DCR endpoint. The path is needed later when configuring DCR in Tyk.
+
+<img src="/img/dcr/curity/2-curity-dcr-endpoint.png" alt="DCR Endpoint" />
+
+
+<Note>
+**Commit the changes**
+
+Remember to **Commit** the changes by going to **Changes** &rarr; **Commit**.
+</Note>
+
+
+### Setting up Tyk
+
+First check `tyk_analytics.conf` and make sure that a proper `oauth_redirect_uri_separator` parameter is set. This sets the character that separates multiple redirect uri's to `;`.
+
+```json
+    "oauth_redirect_uri_separator": ";",
+```
+
+If a change is needed in `tyk_analytics.conf`, remember to restart the service to apply the change.
+
+#### Create DCR proxy API
+
+The Curity Identity Server requires a token with a `dcr` scope in order to authenticate the DCR endpoint. A workaround is to configure the DCR endpoint to use no-authentication. A proxy API can be configured in such a way that Tyk will proxy the DCR request to the Curity Identity Server and a static token used to authenticate the DCR proxy API.
+
+
+<Warning>
+**Use in secure environments only**
+
+Make sure that the communication between Tyk and the Curity Identity Server is appropriately secured. The DCR endpoint on the Curity Identity Server if set to `no-authentication` should only be accessible by Tyk.
+</Warning>
+
+
+In the Tyk Dashboard, navigate to **System Management** &rarr; **APIs**. Create a new API and give it the name, `dcr`. Make sure the **API Listen Path** is set to `/dcr/`.
+Set the Target URL to the DCR endpoint of the Curity Identity Server (Ex. https://idsvr.example.com/token-service/oauth-registration).
+
+In the **Authentication** section, set **Authentication Mode** to `Authentication Token`.
+
+#### Create an example API
+
+In the Tyk Dashboard, navigate to **System Management** &rarr; **APIs**. Create a new API and give it the name, ex. `curity-api`:
+
+<img src="/img/dcr/curity/3-curity-create-api.png" alt="Create API" />
+
+Click **Configure API** and scroll down to the **Authentication** section. Two options to protect an API are outlined below. Choose the options that best fits your needs.
+
+1. **Split Token Approach** - This would be the preferred option and is fully detailed in the [split-token-tyk](https://github.com/sedkis/split-token-tyk) GitHub repository with examples. The basics of this approach is that Tyk proxies the IDP's token endpoint and splits the token to only return the signature of the JWT instead of the complete JWT. The client calling the API will use the signature as an opaque token in the Authorize header. Tyk will then look up the complete JWT using the signature as the key and then add the complete JWT to the Authorization header in the request to the upstream API.
+
+2. **JWT Approach** - This approach means that the IDP issues a JWT to the client (using the dynamically registered client) and the complete JWT is sent in the Authorization header in the API request to Tyk. Although this is absolutely a viable approach there are some potential risks with issuing JWTs to public clients since they could contain Personal Identifiable Information (PII). 
+
+<Tabs>
+<Tab title="Split Token Approach">
+
+The configuration of the Split Token Approach is outlined in the readme in the [GitHub repository](https://github.com/sedkis/split-token-tyk). Make sure to follow the instructions to configure Tyk to handle the Split Token Approach before continuing.
+
+For the Split Token Approach, configure the Authentication as outlined in the below screenshot for an example API.
+
+<img src="/img/dcr/curity/4-split-curity-configure-api.png" alt="Configure Split Token API" />
+
+#### Create a facade API
+
+The Tyk Gateway needs to make use of a facade API in order for the API to be published to the Developer Portal when protected with the Split Token Approach.
+
+In the Tyk Dashboard, navigate to **System Management** &rarr; **APIs**. Create a new API and give it the name `facade-oauth-registration`.
+Set the Target URL to `http://httpbin.org`.
+
+
+<Warning>
+**NOTE**
+
+The `path` and `Target URL` for this API doesn't matter and will never be used.
+</Warning>
+
+
+In the **Authentication** section, set **Authentication Mode** to `JSON Web Token (JWT)`.
+<img src="/img/dcr/curity/5-split-facade-curity-configure-api.png.png" alt="Configure Facade API" />
+
+
+<Note>
+**Obtaining the JWKS URI**  
+
+The JWKS URI can be obtained via the `.well-known/openid-configuration` endpoint as it's a required value. The below cURL command can get the `"jwks_uri"` value directly. 
+
+```shell
+curl -sS https://idsvr.example.com/oauth/v2/oauth-anonymous/.well-known/openid-configuration | grep -o '"jwks_uri":"[^"]*' | cut -d'"' -f4
+```
+</Note>
+
+
+#### Create and assign a policy
+
+The Facade API needs a policy in order to be published to the Developer Portal.
+
+Switch to **System Management** &rarr; **Policies**. Click **Add Policy** and select the Facade API created previously (`facade-oauth-registration`) from the list. Then switch to the **Configurations** tab. Name the policy `facade-policy`. Select an expiry and click `Create Policy`.
+
+Navigate back to **System Management** &rarr; **APIs**, click `facade-oauth-registration`, scroll down to the **Authentication** section and select the newly created policy in the **Default Policy** setting. Click `Update` to save the changes.
+
+#### Create a Key for the DCR proxy
+
+Navigate to **System Management** &rarr; **Keys**, click `Add Key`. Switch to the `Choose API` tab. Select the previously created `DCR` API. Under `2. Configurations` give the key an alias and set an expiry. Then click `Create Key`.
+
+<img src="/img/dcr/curity/6-split-dcr-key-curity.png" alt="DCR API Key" />
+
+
+<Warning>
+**Important**
+
+Take note of the `Key Hash` and `Key ID` as they will be needed later.
+</Warning>
+
+
+#### Publish the API to the Developer Portal
+
+The API and the Facade API are now configured and can used to publish the API to the Tyk Developer Portal. Navigate to **Portal Management** &rarr; **Catalog**, then click **Add New API**. Give it a public name, ex. `OAuth Facade API` and select the `facade-policy`. 
+
+<img src="/img/dcr/curity/7-split-curity-publish-api.png" alt="Publish API" />
+
+Navigate to the **Settings** tab and check the box `Override global settings`. Then scroll down to the **Dynamic Client Registration for portal APIs** section and toggle the switch to enable. Configure as pictured below:
+
+<img src="/img/dcr/curity/8-split-curity-configure-dcr.png" alt="Configure DCR" />
+
+Config parameter                  | Description                         | Value
+----------------------------------|-------------------------------------|-----
+Providers                         | The IDP vendor                      | `Other`                           
+Grant Types                       | What grant types the DCR client will support | `Client Credentials` and/or `Authorization Code`
+Token Endpoint Auth Method        | How the client authenticates against the IDPs token endpoint | `Client Secret - Post`
+Response Types                    | OAuth 2.0 response types that will be used by the client. | `Token` and/or `Authorization Code`
+Identity Provider Host            | The Base URL of the IDP            | Ex. `https://idsvr.example.com`
+Client Registration Endpoint      | The proxy DCR endpoint created previously | Ex. `https://tyk-gateway/dcr/`
+Initial Registration Access Token | Token to authenticate the DCR endpoint | Add the DCR `Key ID` created in previous step
+
+### Testing the flow
+
+Tyk and The Curity Identity Server should now be configured and the flow to register an OAuth client using the Tyk Developer Portal can be tested.
+
+#### Create an OAuth Client
+Start by registering a developer by navigating to **Portal Management** &rarr; **Developers** and add a developer. Then open the Tyk Developer Portal (ex. `http://<host>:3000/portal`) and open the **OAuth clients** page. Start the wizard by clicking **Create first Oauth Client**.
+
+<img src="/img/dcr/curity/9-split-curity-create-oauth-client-wizard.png" alt="Create OAuth client wizard" />
+
+Select the API previously published named **OAuth Facade API** and then click **Save and continue**.
+
+Enter a Client name and add at least one redirect URL(separate with `;`), then click **Create**.
+
+<img src="/img/dcr/curity/10-split-curity-application-details.png" alt="Application details" />
+
+
+<Note>
+**OAuth.Tools**
+
+If using [OAuth.tools](https://oauth.tools/) to obtain a token, make sure to add the appropriate redirect URL. Ex:
+
+```
+http://localhost:7777;https://oauth.tools/callback/code;app://oauth.tools/callback/code
+```
+
+The web-based version of [OAuth.tools](https://oauth.tools/) using the Code Flow would require `https://oauth.tools/callback/code` and the [App version of OAuth.tools](https://developer.curity.io/oauth-tools) requires `app://oauth.tools/callback/code`.
+</Note>
+
+
+Tyk will make a call to the DCR proxy endpoint that will in turn call The Curity Identity Server and its DCR endpoint to register a dynamic client. The details of the dynamically registered client will be displayed.
+
+<img src="/img/dcr/curity/11-split-curity-dcr-client-details.png" alt="DCR client details" />
+
+#### Obtain a token using DCR client
+
+[OAuth.tools](https://oauth.tools/) can be used to obtain an access token from The Curity Identity Server using the DCR information. This call needs to be made to the token endpoint configured on Tyk to handle the [Split Token Approach](https://github.com/sedkis/split-token-tyk).
+
+Start an External API Flow. Copy the **Client ID** and the **Client Secret** to the appropriate fields in [OAuth.tools](https://oauth.tools/). Run the flow to obtain a token.
+
+<img src="/img/dcr/curity/12-split-curity-oauth-tools.png" alt="OAuth.tools" />
+
+
+<Note>
+**Split Token**
+
+Note that the token returned is the signature of a JWT as this is executing the Split Token Approach.
+</Note>
+
+
+#### Use token in request to API
+The token can now be used in an **External API** flow in [OAuth.tools](https://oauth.tools/) to call the API that Tyk is proxying. Tyk will use the signature passed in the Authorization header and lookup the complete JWT in its cache. The complete JWT is then added to the upstream Authorization header as shown in the echo response from Httpbin.org in the below example.
+
+<img src="/img/dcr/curity/13-split-curity-external-api-flow.png" alt="Call API" />
+
+</Tab>
+<Tab title="JWT Approach">
+
+For the JWT Approach, configure the Authentication as outlined in the below screenshot.
+<img src="/img/dcr/curity/4-jwt-curity-configure-api.png" alt="Configure API" />
+
+
+<Note>
+**Obtaining the JWKS URI**  
+
+The JWKS URI can be obtained via the `.well-known/openid-configuration` endpoint as it's a required value. The below cURL command can get the `"jwks_uri"` value directly. 
+
+```shell
+curl -sS https://idsvr.example.com/oauth/v2/oauth-anonymous/.well-known/openid-configuration | grep -o '"jwks_uri":"[^"]*' | cut -d'"' -f4
+```
+</Note>
+
+
+Click **Save** to save the API.
+
+#### Create and assign a policy
+
+Switch to **System Management** &rarr; **Policies**. Click **Add Policy** and select the API created previously (`curity-api`) from the list. Then switch to the **Configurations** tab. Name the policy `Curity Policy`. Select an expiry and click `Create Policy`.
+
+Navigate to **System Management** &rarr; **APIs**, click `curity-api`, scroll down to the **Authentication** section and select the newly created policy in the **Default Policy** setting.
+
+<img src="/img/dcr/curity/5-jwt-curity-configure-policy.png" alt="Configure policy" />
+
+#### Create a Key for the DCR proxy
+Navigate to **System Management** &rarr; **Keys**, click `Add Key`. Switch to the `Choose API` tab. Select the previously created `DCR` API. Under `2. Configurations` give the key an alias and set an expiry. Then click `Create Key`.
+
+<img src="/img/dcr/curity/6-jwt-dcr-key-curity.png" alt="DCR API Key" />
+
+
+<Warning>
+**Important**
+
+Take note of the `Key Hash` and `Key ID` as they will be needed later.
+</Warning>
+
+
+#### Publish the API to the Developer Portal
+
+The API is now configured and can be published to the Tyk Developer Portal. Navigate to **Portal Management** &rarr; **Catalog**, then click **Add New API**. Give it a public name, ex. `Curity Demo API` and select the `Curity Policy`. 
+
+<img src="/img/dcr/curity/7-jwt-curity-publish-api.png" alt="Publish API" />
+
+Navigate to the **Settings** tab and check the box `Override global settings`. Then scroll down to the **Dynamic Client Registration for portal APIs** section and toggle the switch to enable. Configure as pictured below:
+
+<img src="/img/dcr/curity/8-jwt-curity-configure-dcr.png" alt="Configure DCR" />
+
+Config parameter                  | Description                         | Value
+----------------------------------|-------------------------------------|-----
+Providers                         | The IDP vendor                      | `Other`                           
+Grant Types                       | What grant types the DCR client will support | `Client Credentials` and/or `Authorization Code`
+Token Endpoint Auth Method        | How the client authenticates against the IDPs token endpoint | `Client Secret - Post`
+Response Types                    | OAuth 2.0 response types that will be used by the client. | `Token` and/or `Authorization Code`
+Identity Provider Host            | The Base URL of the IDP            | Ex. `https://idsvr.example.com`
+Client Registration Endpoint      | The DCR endpoint created previously | Ex. `https://tyk-gateway/dcr/`
+Initial Registration Access Token | Token to authenticate the DCR endpoint | Add the key created in previous step
+
+### Testing the flow
+
+Tyk and The Curity Identity Server should now be configured and the flow to register an OAuth client using the Tyk Developer Portal can be tested.
+
+#### Create an OAuth Client
+Start by registering a developer by navigating to **Portal Management** &rarr; **Developers** and add a developer. Then open the Tyk Developer Portal (ex. `http://<host>:3000/portal`) and open the **OAuth clients** page. Start the wizard by clicking **Create first Oauth Client**.
+
+<img src="/img/dcr/curity/9-jwt-curity-create-oauth-client-wizard.png" alt="Create OAuth client wizard" />
+
+Select the API previously published named **Curity API** and then click **Save and continue**.
+
+Enter a Client name and add at least one redirect URL, then click **Create**.
+
+<img src="/img/dcr/curity/10-jwt-curity-application-details.png" alt="Application details" />
+
+
+<Note>
+**OAuth.Tools**
+
+If using [OAuth.tools](https://oauth.tools/) to obtain a token, make sure to add the appropriate redirect URL. Ex:
+
+```
+http://localhost:7777;https://oauth.tools/callback/code;app://oauth.tools/callback/code
+```
+
+The web-based version of [OAuth.tools](https://oauth.tools/) using the Code Flow would require `https://oauth.tools/callback/code` and the [App version of OAuth.tools](https://developer.curity.io/oauth-tools) requires `app://oauth.tools/callback/code`.
+</Note>
+
+
+Tyk will make a call to The Curity Identity Server and the DCR endpoint to register a dynamic client. The details of the dynamically registered client will be displayed.
+
+<img src="/img/dcr/curity/11-jwt-curity-dcr-client-details.png" alt="DCR client details" />
+
+#### Obtain a token using DCR client
+
+[OAuth.tools](https://oauth.tools/) can be used to obtain an access token from The Curity Identity Server using the DCR information. 
+
+Start a Code or Client Credentials Flow. Copy the **Client ID** and the **Client Secret** to the appropriate fields in [OAuth.tools](https://oauth.tools/). Run the flow to obtain a token (JWT).
+
+<img src="/img/dcr/curity/12-jwt-curity-oauth-tools.png" alt="OAuth.tools" />
+
+#### Use access token in request to API
+The token can now be used in an **External API** flow in [OAuth.tools](https://oauth.tools/) to call the API that Tyk is proxying. Tyk will validate the JWT and allow the call to the upstream API (httpbin.org in this example). The response from the API is displayed in the right panel in [OAuth.tools](https://oauth.tools/). Httpbin.org echoes back what it receives in the request from Tyk. Note that the complete JWT is forwarded.
+
+<img src="/img/dcr/curity/13-jwt-curity-external-api-flow.png" alt="Call API" />
+
+</Tab>
+</Tabs>
diff --git a/tyk-developer-portal/tyk-portal-classic/customise/changing-the-navigation.mdx b/tyk-developer-portal/tyk-portal-classic/customise/changing-the-navigation.mdx
new file mode 100644
index 0000000000..0092d61c7c
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/customise/changing-the-navigation.mdx
@@ -0,0 +1,55 @@
+---
+title: "Customize the Portal Menus"
+order: 1
+robots: "noindex, nofollow"
+sidebarTitle: "Customise the Portal Menus"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+The Portal supports a data structure to hold rudimentary menus, all pages have access to all menus, and can be accessed using the `.Menus.MenuName` field tag. They are arrays that consist of slugs and names, an implementation example would be:
+
+```{.copyWrapper}
+<ul class="nav navbar-nav">
+  {{ range $index, $menuItem := .Menus.Main}}
+  <li><a href="/portal/{{$menuItem.URL}}">{{$menuItem.Title}}</a></li>
+  {{ end }}
+  <li><a href="/portal/apis/">API Catalog</a></li>
+  {{ if not .PortalConfig.DisableSignup }}
+    {{ if not .UserData }}
+    <li><a href="/portal/register/">Register</a></li>
+    {{ end }}
+  {{ end }}
+  {{ if not .PortalConfig.DisableLogin }}
+    {{ if not .UserData }}
+    <li><a href="/portal/login/">Log in</a></li>
+    {{ end }}
+  {{ end }}
+</ul>
+```
+
+In the snippet above we can also see a set of settings fields, in order to react to the configuration of the Portal, the core Portal config object is exposed to the template and can be used to change how the template is rendered.
+
+### Customizing the menu with the Dashboard
+
+The Dashboard has a simple menu editor, you can create the above data structures from the **Portal Management > Menus** option
+
+<img src="/img/dashboard/portal-management/portal_nav_menus_2.5.png" alt="Menus nav" />
+
+The Portal will come with two menus built in, "Main" and "Secondary", the "Main" menu will appear in the primary navigation (top nav) of the templates supplied with the Portal, while the secondary will show on the right hand side of the Default Page Templates.
+
+To add a new menu item to the Dashboard main navigation, select the "Main" Menu from the drop down:
+
+<img src="/img/dashboard/portal-management/portal_menus_2.5.png" alt="Manage portal menu" />
+
+Click **ADD**:
+
+<img src="/img/dashboard/portal-management/add_portal_menu_2.5.png" alt="Manage portal menu" />
+
+Once added, you can select it from the drop down and add the title and URL fields that will control where the menu item will direct the user.
+
+<img src="/img/dashboard/portal-management/portal_menu_dropdown_2.5.png" alt="Edit portal menu" />
+
+The menu item, once saved, will appear in your Portal navigation instantly.
diff --git a/tyk-developer-portal/tyk-portal-classic/customise/custom-developer-portal.mdx b/tyk-developer-portal/tyk-portal-classic/customise/custom-developer-portal.mdx
new file mode 100644
index 0000000000..7773e6ec74
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/customise/custom-developer-portal.mdx
@@ -0,0 +1,255 @@
+---
+title: "Creating a Custom Developer Portal"
+order: 5
+robots: "noindex, nofollow"
+sidebarTitle: "Creating a Custom Developer Portal"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+import PortalDeveloperAnalytics from '/snippets/portal-developer-analytics.mdx';
+
+<LegacyClassicPortalApi/>
+
+
+<Note>
+This functionality is available from v2.3.8
+</Note>
+
+
+
+## Why Build a Custom Developer Portal?
+
+The Tyk Dashboard includes portal functionality by default, but in some cases it is required to use custom logic or, for example, embed the portal into an existing platform. Thankfully Tyk is flexible enough to provide an easy way of integrating the portal to any platform and language using a few API calls.
+
+The source code is available from the following GitHub repo - [https://github.com/TykTechnologies/tyk-custom-portal](https://github.com/TykTechnologies/tyk-custom-portal) 
+
+A video covering the process of building a custom portal is available to view here:
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/elrAEp1EZ_s" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+## Building Blocks
+
+Before starting work on implementing a custom developer portal, let's understand the basic building blocks.
+
+### Obtaining a Dashboard API Key
+
+To run queries against the Tyk Dashboard API you need to obtain credentials from the **Users** screen.
+
+1.  Select **Users** from the **System Management** section.
+2.  In the **Users** list, click **Edit** for your user.
+3.  The API key is the **Tyk Dashboard API Access Credentials**, copy this somewhere you can refer to it.
+
+### API Key Location
+Let's save it to the environment variable to simplify code examples in this guide. All the commands should be run in your terminal.
+
+
+<Note>
+Don't forget to replace TYK_API_KEY=1efdefd6c93046bc4102f7bf77f17f4e with your own value
+</Note>
+
+
+
+### Creating a Developer
+
+#### Request
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api/portal/developers \
+  -X POST \
+  -H "authorization: $TYK_API_KEY" \
+  -d \
+'{
+  "email": "apidev@example.com",
+  "password": "supersecret",
+  "fields": {
+      "Name": "John Snow"
+  }
+}'
+```
+
+#### Response
+
+```
+{"Status":"OK","Message":"598d4a33ac42130001c1257c","Meta":null}
+```
+
+Where `Message` contains the developer internal ID., You do not have to remember it, since you can find a developer by his email, using the API.
+
+### Developer by Email
+
+#### Request
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api/portal/developers/email/apidev%40example.com \
+  -X GET \
+  -H "authorization: $TYK_API_KEY"
+```
+
+#### Response
+
+```
+{"id":"598d4a33ac42130001c1257c","email":"apidev@example.com","date_created":"2017-08-11T06:09:55.654Z","inactive":false,"org_id":"59368a6b5eeba30001786baf","api_keys":{},"subscriptions":{},"fields":{"Name":"John Snow","source":"google search"},"nonce":"","sso_key":""}
+```
+
+### Developer Validation
+
+By default, the Tyk Developer portal automatically accepts all developer registrations, if they are not completely disabled in the portal configuration.
+
+
+<Note>
+Do not confuse developer registration with key access, if they are registered to the portal, it does not mean they automatically have access to your APIs.
+</Note>
+
+
+If you want to allow developer registration but add an additional layer of verification, you can use the developer `inactive` attribute to handle it. By default, it is `false`, and you can set it to `true` if additional verification is needed. To make this work, you need to add additional logic to your custom portal code.
+
+### Updating a Developer. Example: Adding Custom Fields
+
+Let's say we want to add new custom "field" to the developer, to store some internal meta information. Tyk so far does not support PATCH semantics, e.g. you cannot update only single field, you need to provide the full modified record.
+
+Lets created an updated developer record, based on the example response provided in Developer by Email section. Let's add new "traffic_source" custom field.
+
+#### Request
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api/portal/developers/598d4a33ac42130001c1257c \
+  -X PUT \
+  -H "authorization: $TYK_API_KEY" \
+  -d \
+  '{
+    "id":"598d4a33ac42130001c1257c",
+    "email":"apidev@example.com",
+    "date_created":"2017-08-11T06:09:55.654Z",
+    "inactive":false,
+    "org_id":"59368a6b5eeba30001786baf",
+    "api_keys":{},
+    "subscriptions":{},
+    "fields":{
+      "Name":"John Snow",
+      "traffic_source":"google search"
+    }
+  }'
+```
+
+#### Response
+
+```
+{"Status":"OK","Message":"Data updated","Meta":null}
+```
+
+Note that all non-empty custom fields are shown in the Tyk Dashboard Developer view. All the keys created for this developer inherit his custom fields, if they are specified in the Portal settings **Signup fields** list.
+
+
+### Login Workflow: Checking User Credentials
+
+If you need to implement own login workflow, you need be able to validate user password.
+
+#### Request
+
+```{.copyWrapper}
+    curl https://admin.cloud.tyk.io/api/portal/developers/verify_credentials \
+    -X POST \
+    -H "authorization: $TYK_API_KEY" \
+    -d \
+    '{
+        "username": "<developer-email>",
+        "password": "<developer-password>"
+    }'
+```
+
+If the user credentials are verified, the HTTP response code will be 200, otherwise credentials do match and a 401 error will be returned.
+
+### Listing Available APIs
+
+Inside the admin dashboard in the portal menu, you can define **catalogs** with the list of APIs available to developers. Each defined API is identified by its policy id field.
+
+#### Request
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api/portal/catalogue \
+-X GET \
+-H "authorization: $TYK_API_KEY"
+```
+
+#### Response
+
+```
+{
+ "id":"5940e3d29ba5330001647b21",
+ "org_id":"59368a6b5eeba30001786baf",
+ "apis":[
+  {
+   "name":"asdasd",
+   "short_description":"",
+   "long_description":"",
+   "show":true,
+   "api_id":"",
+   "policy_id":"59527b8c375f1e000146556b",
+   "documentation":"",
+   "version":"v2"
+  },
+  {
+   "name":"asdaszczxczx",
+   "short_description":"",
+   "long_description":"",
+   "show":true,
+   "api_id":"",
+   "policy_id":"5944267f8b8e5500013082a5",
+   "documentation":"",
+   "version":"v2"
+  }
+ ]
+}
+```
+
+### Issuing Keys
+
+To generate a key for the developer, first he should send a request to the administrator of the API, and if needed provide details of the key usage. By default, all keys requests are approved automatically, and the user immediately receives his API key, but you can turn on the  **Review all key requests before approving them** option in the portal settings, to add additional verification step, and approve all keys manually. Once a key is issued, the user receives an email with the key details.
+
+#### Request
+
+```{.copyWrapper}
+curl https://admin.cloud.tyk.io/api/portal/requests \
+-X POST \
+-H "authorization: $TYK_API_KEY" \
+-d \
+'{
+  "by_user":"<developer-id>",
+  "for_plan": "<api-policy-id>"
+  "version": "v2",
+  "fields":{
+      "custom_field":"value",
+  }
+}'
+```
+
+#### Response
+
+```
+    {"Status":"OK","Message":"Data updated","Meta":null}
+```
+
+### Checking User Subscriptions and Keys
+
+The Developer object contains the `subscriptions` field with information about user API keys, and associtated API's (policies). For Example:
+
+#### Request
+
+```{.copyWrapper}
+"subscriptions":{"<policy-id-1>": "<api-key-1>", "<policy-id-2>": "<api-key-2>"},
+```
+
+<PortalDeveloperAnalytics/>
+
+
+## <a name="building-portal"></a> Building a Portal
+
+This guide includes the implementation of a full featured developer portal written in Ruby in just 250 lines of code. This portal implementation does not utilize any database and uses our Tyk Dashboard API to store and fetch all the data.
+
+To run it, you need to have Ruby 2.3+ (latest version). Older versions may work but have not been tested.
+
+First, you need to install dependencies by running `gem install sinatra excon --no-ri` in your terminal.
+
+Then run it like this: `TYK_PORTAL_PORT=8080 TYK_API_KEY=<your-api-key-here> ruby portal.rb`
+
+You can also specify the `TYK_DASHBOARD_URL` if you are trying this portal with an Self-Managed installation. By default, it is configured to work with Cloud or Multi-Cloud.
diff --git a/tyk-developer-portal/tyk-portal-classic/customise/customise-documentation.mdx b/tyk-developer-portal/tyk-portal-classic/customise/customise-documentation.mdx
new file mode 100644
index 0000000000..7d0dda16fc
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/customise/customise-documentation.mdx
@@ -0,0 +1,66 @@
+---
+title: "Swap out Swagger UI for ReDoc"
+order: 6
+robots: "noindex, nofollow"
+sidebarTitle: "Swap out Swagger UI for ReDoc"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+This short guide will show you how easy it is to swap out out the default https://swagger.io/tools/swagger-ui/ library for Portal Catalog API documentation for another tool like [ReDoc](https://redocly.github.io/redoc/) 
+
+* Open up the default `/opt/tyk-dashboard/portal/templates/swagger.html`
+
+```
+  {{ define "swaggerPage" }}
+  {{ template "header" .}}
+  <link href='/portal-assets/css/swagger.min.css' media='screen' rel='stylesheet' type='text/css'/>
+  {/* <link href='/portal-assets/css/swagger-ui.css' media='screen' rel='stylesheet' type='text/css'/> */}
+  <body>
+    {{ template "navigation" . }}
+    <div>
+      <div class="container" style="margin-top: 80px;">
+        <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" style="position:absolute;width:0;height:0">
+...
+        </svg>
+        <div id="swagger-ui"></div>
+      </div>
+    </div>
+    {{ template "footer" .}}
+    {{ template "scripts" .}}
+    <script src="/portal-assets/js/vendors.min.js"> </script>
+    <script src="/portal-assets/js/swagger.min.js"> </script>
+    <script type="text/javascript">
+...
+    </script>
+  </body>
+</html>
+{{ end }}
+```
+
+* Replace the content of `swagger.html` with the following:
+
+```
+  {{ define "swaggerPage" }}
+  {{ template "header" .}}
+  <body>
+    {{ template "navigation" . }}
+    <div>
+      <div class="container" style="margin-top: 80px;">
+        <redoc spec-url="{{.SwaggerURL}}"></redoc>
+      </div>
+    </div>
+    {{ template "footer" .}}
+    <script src="https://cdn.jsdelivr.net/npm/redoc@next/bundles/redoc.standalone.js"></script>
+  </body>
+</html>
+{{ end }}
+```
+
+* Restart your dashboard service
+
+* Browse your portal documentation
+
+<img src="/img/dashboard/portal-management/redoc-petstore-tyk.png" alt="Tyk Portal Catalogue API Documentation with ReDoc" />
diff --git a/tyk-developer-portal/tyk-portal-classic/customise/customising-using-dashboard.mdx b/tyk-developer-portal/tyk-portal-classic/customise/customising-using-dashboard.mdx
new file mode 100644
index 0000000000..6340a1d0cf
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/customise/customising-using-dashboard.mdx
@@ -0,0 +1,123 @@
+---
+title: "Customize Pages with CSS and JavaScript"
+order: 3
+robots: "noindex, nofollow"
+sidebarTitle: "Customise Pages with CSS and JavaScript"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+The main customization that can be done with the Tyk Dashboard is via the CSS Editor.
+
+JS customization is also available in a programmatic way.
+
+#### Step 1: Open CSS Editor
+
+Click **CSS** from the **Portal Management** menu.
+
+<img src="/img/dashboard/portal-management/cssNav.png" alt="Portal management menu" />
+
+#### Step 2: Make CSS Amendments
+
+In the CSS Editor, add the classes that you would like to override in the home page. For Tyk Cloud and Multi-Cloud users, this will already be filled in with some initial overrides for you:
+
+<img src="/img/dashboard/portal-management/cssEditor.png" alt="Portal CSS editor" />
+
+#### Step 3: Make Email CSS Amendments
+
+<img src="/img/dashboard/portal-management/portal_email_css.png" alt="Email CSS editor" />
+
+If you wish to customize how emails are displayed to end-users, then you can also add new classes to the Email CSS editor, these classes will be added in-line to the email that is sent out.
+
+Once you have finished making your changes, click **Update** and the new CSS will be available on your site.
+
+### Updating CSS via API
+Alternatively, as always, you can perform the above actions with an API call instead of through the Dashboard UI.
+
+First, we'll need to get the block ID of the CSS component in order to update it.  This is stored in Mongo by the Dashboard.
+To get the block ID, we have to make a REST call to the Dashboard API.  
+
+To do so, run this `curl` command:
+
+```{.copyWrapper}
+curl www.tyk-test.com:3000/api/portal/css \
+-H "Authorization:{DASHBOARD_API_KEY}"
+```
+Response:
+```{.copyWrapper}
+{
+    "email_css": "",
+    "id": "{CSS_BLOCK_ID},
+    "org_id": "{ORG_ID}",
+    "page_css": ".btn-success {background-color: magenta1}"
+}
+```
+Now we can use the `id` and the `org_id` to update the CSS.
+The below `curl` command will update the CSS for a specific organization.
+
+```{.copyWrapper}
+curl -X PUT http://tyk-dashboard.com/api/portal/css \
+  -H "authorization:{DASHBOARD_API_KEY}" \
+  -d '{
+    "email_css": "",
+    "id": "{CSS_BLOCK_ID},
+    "org_id": "{ORG_ID}",
+    "page_css": ".btn-success {background-color: magenta}"
+  }' 
+```
+
+ [1]: /img/dashboard/portal-management/portal_man_css.png
+ [2]: /img/dashboard/portal-management/portal_site_css.png
+
+ ### Updating JavaScript via API
+
+ In order to initialize the portal JS object in the database use the following request where `console.log(1)` should be replaced by your JS snippet:
+
+ ```{.copyWrapper}
+curl -X POST www.tyk-test.com:3000/api/portal/js \
+-H "Authorization:{DASHBOARD_API_KEY}" \
+-d '{"page_js": "console.log(1)"}'
+```
+
+Request:
+```{.copyWrapper}
+{
+    "page_js": "console.log(1)"
+}
+```
+
+Response:
+```{.copyWrapper}
+{
+    "Status": "OK",
+    "Message": "609b71df21c9371dd5906ec1",
+    "Meta": null
+}
+```
+
+The endpoint will return the ID of the portal JS object, this can be used to update it.
+
+ ```{.copyWrapper}
+curl www.tyk-test.com:3000/api/portal/js \
+-H "Authorization:{DASHBOARD_API_KEY}" \
+--data '{"page_js": "console.log(2)", "id": "609b71df21c9371dd5906ec1"}'
+```
+
+Request:
+```{.copyWrapper}
+{
+    "page_js": "console.log(2)",
+    "id": "609b71df21c9371dd5906ec1"
+}
+```
+
+Response:
+```{.copyWrapper}
+{
+    "page_js": "console.log(1)"
+}
+```
+
+The JavaScript snippet that's added through this endpoint is injected at the bottom of the portal page using a `<script>` tag.
diff --git a/tyk-developer-portal/tyk-portal-classic/customise/customize-with-jquery.mdx b/tyk-developer-portal/tyk-portal-classic/customise/customize-with-jquery.mdx
new file mode 100644
index 0000000000..4b344ea809
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/customise/customize-with-jquery.mdx
@@ -0,0 +1,113 @@
+---
+title: "Customizing using jQuery"
+robots: "noindex, nofollow"
+sidebarTitle: "Customising using jQuery"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+Tyk Portal comes prepackaged with jQuery.  This opens up a whole world of customization, by extending our Portal using JavaScript and HTML to create dynamic content.
+
+
+## Dynamic Content Rendering & Filtering
+
+Let's walk through an example where you use jQuery to fetch data from a REST endpoint, then display it in a table where we can filter our results.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/njRgYUpL5vs" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+
+**First of all, create a custom page in the portal.**
+
+
+<img src="/img/dashboard/portal-management/new_custom_page.png" alt="custom_page_setup" />
+
+In the MainBody, you can paste the code below (click the text to display):
+
+<Expandable title='Click to display the code'>
+```.html
+
+<h2> Filterable Table </h2>
+
+<script>
+window.onload = function() {
+
+    $.ajax({  
+            type: "GET",
+            url: "https://www.mocky.io/v2/5eb1a7c53200005c8f28f8b5",  
+            beforeSend: function() 
+            {
+                $('html, body').animate({scrollTop: 0
+                }, 'slow');
+                $("#response").html('<img src="loading.gif" align="absmiddle" alt="Loading..."> Loading...<br /><br />');
+            },  
+            success: function(response)
+            {
+                var htmlResponse = '<table id=results>\
+                <thead>\
+                <tr>\
+                  <th>Name</th>\
+                  <th>Location</th>\
+                  <th>Age</th>\
+                </tr>\
+                </thead>\
+                <tbody id="myTable">'
+
+                response.forEach( item => {
+                    htmlResponse += '  <tr>\
+                    <td>' + item.name + '</td>\
+                    <td>' + item.location + '</td>\
+                    <td>' + item.Age + '</td>\
+                  </tr>'
+                });
+                htmlResponse += "</tbody></table>"
+
+                $('#results')[0].innerHTML = htmlResponse;
+            }
+        });
+
+    $("#myInput").on("keyup", function() {
+        var value = $(this).val().toLowerCase();
+        $("#myTable tr").filter(function() {
+          $(this).toggle($(this).text().toLowerCase().indexOf(value) > -1)
+        });
+      });
+    }
+</script>
+
+
+<style>
+table {
+  font-family: arial, sans-serif;
+  border-collapse: collapse;
+  width: 100%;
+}
+
+td, th {
+  border: 1px solid #dddddd;
+  text-align: left;
+  padding: 8px;
+}
+
+tr:nth-child(even) {
+  background-color: #dddddd;
+}
+</style>
+
+<p>Type something in the input field to search the table for first names, last names or emails:</p>  
+<input id="myInput" type="text" placeholder="Search..">
+<br /><br />
+
+<div id=results>
+</results>
+```
+</Expandable>
+
+And save.
+
+Now visit the portal at "http://dashboard-host:3000/portal/custom"
+
+<img src="/img/dashboard/portal-management/custom_page_dynamic.png" alt="custom_page_display" />
+
+You now have a searchable Input box that will dynamically filter the results of the table.
diff --git a/tyk-developer-portal/tyk-portal-classic/customise/developer-meta-data.mdx b/tyk-developer-portal/tyk-portal-classic/customise/developer-meta-data.mdx
new file mode 100644
index 0000000000..d6df79c6a1
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/customise/developer-meta-data.mdx
@@ -0,0 +1,20 @@
+---
+title: "Customize the Developer Signup Form"
+order: 4
+robots: "noindex, nofollow"
+sidebarTitle: "Customise the Developer Signup Form"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+When a developer signs up to your developer Portal, you might wish to capture more information about the developer than is supplied by the default form. To enable new fields in this form (they are automatically added to the form as you add them), go to the **Portal Management > Settings** screen, and edit the **Sign up form customization** section:
+
+<img src="/img/dashboard/portal-management/dev_cusomise_2.5.png" alt="Tyk developer portal sign up form customization" />
+
+### Developer metadata and keys
+
+All developer metadata is automatically added to the key metadata when a token is generated, this can be useful if you need to add more information to your upstream requests.
+
+A developer username will also automatically be made the alias for an API token so that it is easy to identify in the analytics.
diff --git a/tyk-developer-portal/tyk-portal-classic/developer-profiles.mdx b/tyk-developer-portal/tyk-portal-classic/developer-profiles.mdx
new file mode 100644
index 0000000000..88bad67fd1
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/developer-profiles.mdx
@@ -0,0 +1,160 @@
+---
+title: "Developer Profiles"
+order: 2
+robots: "noindex, nofollow"
+sidebarTitle: "Developer Profiles"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+Users that are signed up to your portal are called "Developers", these users have access to a Dashboard page which show them their API usage over the past 7 days as well as the policy and quota limits on their relevant keys.
+
+Developers can sign up to multiple APIs using the API catalog.
+
+Developer accounts belong to an organization ID, so accounts cannot be shared across organizations in a Tyk Dashboard setup.
+
+### Navigate to the Portal Developers Section
+
+<img src="/img/2.10/developers_menu.png" alt="Developer Menu" />
+
+#### Select Add Developer
+
+<img src="/img/2.10/add_developer.png" alt="Developer Profile add" />
+
+### Add Basic Details
+
+<img src="/img/2.10/add_developer_details.png" alt="Developer Profile Create Details" />
+
+### Developer Profile Overview
+
+The first panel in a developer profile will show you an avatar (if they have a Gravatar-enabled email address), as well as the basic fields of their signup:
+
+<img src="/img/2.10/developer_details.png" alt="Developer profile detail" />
+
+### Developer Usage
+
+The next panel will show you their apI usage as an aggregate for all the tokens that they have generated with their developer access:
+
+<img src="/img/2.10/developer_graph.png" alt="Developer usage graph" />
+
+### Developer Keys
+
+In this panel, you will be able to see the various Keys the developer has access to, and the policies that are connected to the individual Key.
+
+
+<Note>
+From version 1.9, you can now apply multiple policies to an individual Key.
+</Note>
+
+
+To drill down into the specific usage patterns for each Key, click **ANALYTICS** for the Key.
+
+<img src="/img/2.10/developer_keys.png" alt="Developer Keys" />
+
+### Add a New Key
+
+To subscribe a developer to a new Key, from the Edit Developer screen, click **New Key**. From the pop-up screen, select one or more policies from the drop-down list and click **Request Key**.
+
+ <img src="/img/2.10/developer_new_key.png" alt="New Key Request" />
+
+### Changing Developer Policy Keys
+
+#### Step 1: View the Developer Profile
+
+Browse to the developers list view and select the developer that you wish to manage.
+
+<img src="/img/2.10/developer_details.png" alt="Developer profile detail" />
+
+#### Step 2: View Keys List
+
+This sections shows you the Keys and the policies connected to them. This view will always try to match the access level to a catalog entry, if the policy assigned to a developer is not in the catalog, the entry will read "(No Catalog Entry)". We recommend that all policy levels are in your catalog, even if they are not all live.
+
+#### Step 3: Click Options
+
+From the Options drop-down for the Key, select **Change Policy**.
+
+<img src="/img/2.10/developer_keys.png" alt="Keys Sections" />
+
+#### Step 4: Select the New Policy
+
+Select a new policy to add to your Key from the **Policies** drop-down list. You can also remove existing policies connected to the Key.
+
+<img src="/img/2.10/developer_new_key.png" alt="Change policy drop down list" />
+
+#### Step 5: Save the Change
+
+Click **CHANGE KEY POLICY** to save the changes.
+
+### Developer OAuth Clients
+
+
+### Edit the Developer Profile
+
+All fields in the profile are editable. In this section you can select a field and modify that data for the developer. This will not affect any tokens they may have, but it will affect how it appears in their Developer Dashboard in your Portal.
+
+<img src="/img/2.10/edit_developer_details.png" alt="Developer edit form" />
+
+Developers can edit this data themselves in their accounts section.
+
+### Search for a Developer
+
+You can search for a developer (by email address) by entering their address in the Search field.
+
+This option is only available from Dashboard v1.3.1.2 and onwards.
+
+<img src="/img/2.10/search_developers.png" alt="Developer Profile Search" />
+
+### Developer Edit Profile
+
+Once logged in, a developer can edit their profile. Select **Edit profile** from the **Account** menu drop-down list.
+
+<img src="/img/dashboard/portal-management/developer_manage_profile.png" alt="Manage Profile" />
+
+A developer can change the following:
+* Email
+* Change Password
+* Name
+* Telephone
+* Country Location
+
+### Reset Developer Password
+
+If a developer has forgotten their password, they can request a password reset email from the Login screen.
+
+<img src="/img/dashboard/portal-management/login_screen.png" alt="Login Screen" />
+
+1. Click **Request password reset**
+2. Enter your email address and click **Send Password reset email**
+
+<img src="/img/dashboard/portal-management/email_password_request.png" alt="Email Reset" />
+
+You will be sent an email with a link to reset your Developer password. Enter your new password and click **Update**. You can then login with your new details.
+
+
+<Note>
+Your password must be a minimum of 6 characters.
+</Note>
+
+
+<img src="/img/dashboard/portal-management/password_confirmation.png" alt="Confirm password" />
+
+
+
+
+
+ [1]: /img/dashboard/portal-management/developer_menu_2.5.png
+ [2]: /img/dashboard/portal-management/add_developer_2.5.png
+ [3]: /img/dashboard/portal-management/developer_details_2.5.png
+ [4]: /img/dashboard/portal-management/developer_overview_2.5.png
+ [5]: /img/dashboard/portal-management/developer_usage_2.5.png
+ [6]: /img/dashboard/portal-management/developer_subs_2.5.png
+ [7]: /img/dashboard/portal-management/developer_edit_2.5.png
+ [8]: /img/dashboard/portal-management/developer_search_2.5.png
+ [13]: /img/dashboard/portal-management/developer_edit_2.5.png
+ [14]: /img/dashboard/portal-management/keys_dev_profile.png
+ [15]: /img/dashboard/portal-management/change_key_policy.png
+ [16]: /img/dashboard/portal-management/new_key_request.png 
+
+
diff --git a/tyk-developer-portal/tyk-portal-classic/dynamic-client-registration.mdx b/tyk-developer-portal/tyk-portal-classic/dynamic-client-registration.mdx
new file mode 100644
index 0000000000..13cb5abba3
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/dynamic-client-registration.mdx
@@ -0,0 +1,43 @@
+---
+title: "Classic Portal - Dynamic Client Registration"
+order: 3
+robots: "noindex, nofollow"
+sidebarTitle: "Overview"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+## OAuth 2.0 Dynamic Client Registration Protocol (DCR)
+
+Available from version 3.2.0 onwards.
+
+## What is Dynamic Client Registration? 
+
+DCR is a protocol of the Internet Engineering Task Force put in place to set standards in the dynamic registration of clients with authorization servers. 
+We will go into the specifics of how it works in the context of Tyk, but if you are interested in reading the full RFC, go to: https://tools.ietf.org/html/rfc7591
+
+## Why should I use it? 
+
+DCR is a way for you to integrate your developer portal with an external identity provider such as Keycloak, Gluu, Auth0, Okta etc... 
+The portal developer won't notice a difference. However when they create the app via Tyk Developer portal, Tyk will dynamically register that client on your authorization server. This means that it is the Authorization Server who will issue issue the Client ID and Client Secret for the app.
+Some of our users leverage external Identity Providers because they provide a variety of features to support organizations in managing identity in one place across all their stack. 
+
+This feature is optional and you can still have a great level of security only using Tyk as your authorization server. 
+
+## Enabling Dynamic Client Registration
+
+We provide guides for the following identity providers:
+
+- [Gluu](/tyk-developer-portal/tyk-portal-classic/gluu-dcr). Official docs are available [here](https://gluu.org/docs/gluu-server/4.0/admin-guide/openid-connect/#dynamic-client-registration).
+- [Curity](/tyk-developer-portal/tyk-portal-classic/curity-dcr). Official docs are available [here](https://curity.io/docs/idsvr/latest/token-service-admin-guide/dcr.html).
+- [Keycloak](/tyk-developer-portal/tyk-portal-classic/keycloak-dcr). Official docs are available [here](https://www.keycloak.org/securing-apps/client-registration).
+- [OKTA](/tyk-developer-portal/tyk-portal-classic/okta-dcr). Official docs are available [here](https://developer.okta.com/docs/reference/api/oauth-clients/).
+
+
+In case your provider isn't on the list, use the "Other" provider option in the DCR settings. This mode would keep the interaction with your IDP as standard possible. Note that not all IDPs fully implement the standard.
+
+## Troubleshooting
+
+The DCR functionality abstracts most of the errors to the end user (in this case, the developer). In order to diagnose issues between Tyk and your IDP, please refer to the Tyk Dashboard logs.
diff --git a/tyk-developer-portal/tyk-portal-classic/gluu-dcr.mdx b/tyk-developer-portal/tyk-portal-classic/gluu-dcr.mdx
new file mode 100644
index 0000000000..6184bab1c4
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/gluu-dcr.mdx
@@ -0,0 +1,147 @@
+---
+title: "Step by step guide using Gluu"
+order: 3
+robots: "noindex, nofollow"
+sidebarTitle: "Step by step guide using Gluu"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+We are going walk you through a basic integration of Tyk with [Gluu](https://gluu.org/) using the [OpenID Connect Dynamic Client Registration protocol](https://tools.ietf.org/html/rfc7591). Our current implementation provides support for the client credentials flow with support for <Tooltip tip="JSON Web Tokens">JWT</Tooltip>. 
+
+The user journey is as follow:
+
+1. A developer signs up and creates a Dynamic Client Registration provider using your Developer Portal.
+
+2. Tyk sends the Dynamic Client Registration call to your <Tooltip tip="Identity Provider">IDP</Tooltip>. The IDP replies with the client ID and secret.
+
+3. Using that information, the developer (or the application) triggers a call to the token endpoint of the IDP.
+
+4. Your developer (or the application) then triggers a call to Tyk, using the token that was generated by the IDP. Tyk validates this token using the <Tooltip tip="JSON Web Key Sets">JWKS</Tooltip> provided by the IDP.
+
+### Requirements
+
+- A Gluu installation, more details [here](https://gluu.org/).
+- A [Tyk Self Managed installation](/tyk-self-managed/install) (Gateway + Dashboard).
+
+### Getting started with Gluu
+
+In order to get started with Dynamic Client Registration you’ll need to get the OpenID Connect registration endpoint. Open your Gluu dashboard and select the "Configuration" section. Select "JSON Configuration" and toggle the "OxAuth Configuration" tab.
+
+<img src="/img/dcr/gluu/step_1.png" alt="Step 1" />
+
+In this view you will find the registration endpoint:
+
+<img src="/img/dcr/gluu/step_2.png" alt="Step 2" />
+
+Another endpoint that will be relevant for your setup is the Well-Known configuration endpoint. Keep both URLs handy as you’ll use them for our next steps. This endpoint typically looks as follows: https://gluu-server/.well-known/openid-configuration
+
+Because of known issues with Tyk’s JWT driver, you’ll set specific algorithms for the JWKS endpoint. In the same "OxAuth Configuration" tab, scroll down to "jwksAlgorithmsSupported" and select the following options:
+
+<img src="/img/dcr/gluu/step_3.png" alt="Step 3" />
+
+Click "Save OxAuth Configuration" afterwards.
+
+For more information on this particular issue, refer to the Gluu documentation.
+
+### Setting up Tyk
+
+Now you're ready to set up Tyk. For compatibility reasons, check your `tyk_analytics.conf` and make sure that a proper `oauth_redirect_uri_separator` parameter is set. You can use the following value:
+
+```json
+    "oauth_redirect_uri_separator": ";",
+```
+
+Remember to restart the service after applying the above change.
+
+Now open the Tyk Dashboard and click **APIs** under **System Management**. Create a new API called "Gluu API":
+
+<img src="/img/dcr/gluu/step_4.png" alt="Step 4" />
+
+After the first part of the API creation form was filled, click on "Configure API" and set the authentication settings as follows:
+
+<img src="/img/dcr/gluu/step_5.png" alt="Step 5" />
+
+
+<Note>
+Where do I get the proper JWKS URI for my Gluu environment?
+
+The JWKS URI is a required field in the `.well-known/openid-configuration` endpoint of your OpenID Connect Provider metadata. Typically found as `"jwks_uri"`. Please see the spec https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse for further information.
+</Note>
+
+
+For the **Identity Source** field use `"client_id"` and for **Policy Field Name** use `"pol"`.
+
+Click "Save" and switch to the "Policies" button under "System Management". Once in this section, click on "Create a Policy" and call it "Gluu Policy". Use the default values for this one. Remember to select the previously created "Gluu API" in the access rights section. You will also need to set an expiration setting for the keys.
+
+After the policy is ready, switch back to the API settings and make sure that the API is using the appropriate policy:
+
+<img src="/img/dcr/gluu/step_6.png" alt="Step 6" />
+
+Now you’re ready to add this API to the developer portal. Switch to the "Catalog" section under "Portal Management" on the navigation menu. Click on "Add New API", set a name for it and select the newly created policy. For this example use "Gluu Policy":
+
+<img src="/img/dcr/gluu/step_7.png" alt="Step 7" />
+
+Hit "Save" and click on the recently created item again, switch to the "Settings" tab that’s next to "API Details". In "API Details" toggle the "Override global settings" option.
+
+
+<Note>
+Tyk lets you set global portal settings that apply to **all portal-listed APIs**, in this guide we assume you’re enabling and setting up DCR for a single API. In case you want to enable DCR for all the APIs, you should go to the **Settings** section under **Portal Management**, and in the **API Access** tab you can enter your DCR settings there.
+</Note>
+
+
+Once the "Override global settings" option is toggled, scroll down to the DCR section in the bottom and enter the following settings:
+
+<img src="/img/dcr/gluu/step_8.png" alt="Step 8" />
+
+**Providers:** Different providers might implement the standard in slightly different ways. Tyk provides a specific driver for each one. For IDPs that aren’t on the list use the "Other" option. For this guide, pick "Gluu".
+
+**Grant Types:** The [OAuth 2.0 grant types](/api-management/authentication/oauth-2) types that will be used by the client, see the [specification](https://openid.net/specs/openid-connect-registration-1_0.html#rfc.section.2) for more details. Set "Client Credentials".
+
+**Token Endpoint Auth Method:** defines the way the client will authenticate against the token endpoint. Use "Client Secret - Post".
+
+**Response Types:** OAuth 2.0 response types that will be used by the client. Set **Token**.
+
+**Identity Provider Host:** Base IDP URL, e.g. `https://gluu-server/`
+
+**Client Registration Endpoint:** OpenID Connect client registration endpoint. The value we use is `https://gluu-server/oxauth/restv1/register`
+
+This value is found in your well-known discovery document as `registration_endpoint`. The well-known location URL is typically `https://gluu-server/.well-known/openid-configuration` (replace "gluu-server" with your hostname).
+
+**Initial Registration Access Token:** the token that’s used to register new clients, this was generated in the early steps of the guide.
+
+### Testing the flow
+
+Now that both Tyk and Gluu are ready you can try the complete flow. Click "Developers" under "Portal Management", then click "Add developer" and enter some basic information here to create a developer user.
+
+After the developer is created, open the portal, click on the "OAuth Clients" navigation bar button and follow the wizard:
+
+<img src="/img/dcr/gluu/step_9.png" alt="Step 9" />
+
+After clicking "Create first OAuth Client" you’ll see your previously created "Gluu API". Select it and click "Save and continue". The following screen will require you to enter a client name. It’s possible to set redirect URLs if you also plan to use this client for other flow types. This setting can be left blank for the purposes of this example.
+
+<img src="/img/dcr/gluu/step_10.png" alt="Step 10" />
+
+Once you click "Create", Tyk will trigger a registration on your IDP and the details of your client will show up:
+
+<img src="/img/dcr/gluu/step_11.png" alt="Step 11" />
+
+If you check the Gluu dashboard you will see new client (named "GluuClient"):
+
+<img src="/img/dcr/gluu/step_12.png" alt="Step 12" />
+
+The next step is to generate a token and use it for accessing your "Gluu API". you can use Postman for this. You will need the token URL which it’s also present in the Well-Known URI of your organization. The field is named `"token_endpoint"`.
+For this example use the following: https://gluu-server/oxauth/restv1/token
+
+Your Postman request should contain the following body, where `"client_id"` and `"client_secret"` are the values you got from the developer portal:
+
+<img src="/img/dcr/gluu/step_13.png" alt="Step 13" />
+
+Note that you aren’t using any additional headers for this request, the client credentials are enough.
+
+Once you get a response from the IDP, you can copy the `"access_token"` and use it to access your "Gluu API", this request will be proxied by Tyk:
+
+<img src="/img/dcr/gluu/step_14.png" alt="Step 14" />
+
diff --git a/tyk-developer-portal/tyk-portal-classic/graphql.mdx b/tyk-developer-portal/tyk-portal-classic/graphql.mdx
new file mode 100644
index 0000000000..012e0178ea
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/graphql.mdx
@@ -0,0 +1,51 @@
+---
+title: "Developer Portal GraphQL"
+description: "How to publish GraphQL APIs to your Tyk Developer Portal"
+keywords: "GraphQL, Playground, CORS, UDG"
+order: 7
+robots: "noindex, nofollow"
+sidebarTitle: "GraphQL with Classic Portal"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+As of Tyk v3.0.0, you can now publish GraphQL APIs, including [Universal Data Graph](/api-management/data-graph#overview) APIs(UDG) to the Tyk Developer Portal.
+
+When you do that, your API consumers can navigate through a GraphQL Playground, with an IDE complete with Intellisense.
+
+<img src="/img/portal/portal-graphql.png" alt="Portal GraphQL Playground" />
+
+## Video Walkthrough
+
+We have a YouTube walkthrough of how to publish a GraphQL API to your Developer Portal:
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/A2Hn9ub2mNg" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+## How To Set Up
+
+Simply create a GraphQL or Universal Data Graph API, create a Policy which protects it, and then publish it to the Developer Portal Catalog.
+
+In the "Create a Catalog" section, at the bottom, make sure you enable the "Display Playground" 
+
+
+<img src="/img/portal/portal-graphql-setup.png" alt="Portal GraphQL Playground Setup" />
+
+And then, when your API consumers are on the Developer Portal Catalog and click on View Documentation, they will be taken to the GraphQL Playground.
+
+<img src="/img/portal/portal-graphql-playground-viewdocs.png" alt="Portal GraphQL Playground View Docs" />
+
+
+## Protected GraphQL Catalog
+
+If you have a protected API, your users won't be able to inspect the GraphQL schema or make API calls until they add their API Key to the Headers section:
+
+<img src="/img/portal/portal-graphql-header-injection.png" alt="Portal GraphQL Playground Header Injection" />
+
+## CORS
+
+You may have to enable the following CORS settings in the "Advanced Options" of the API Designer to allow your consumers to access the GraphQL Playground:
+
+
+<img src="/img/portal/portal-graphql-cors.png" alt="Portal GraphQL Playground CORS" />
diff --git a/tyk-developer-portal/tyk-portal-classic/key-requests.mdx b/tyk-developer-portal/tyk-portal-classic/key-requests.mdx
new file mode 100644
index 0000000000..3aead7b16a
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/key-requests.mdx
@@ -0,0 +1,47 @@
+---
+title: "Key Requests"
+robots: "noindex, nofollow"
+sidebarTitle: "Key Requests"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+## Key Requests
+
+A key request is a record that is generated when a developer requests an access token for an API published in the API Catalog. The Key request encompasses the following information:
+
+- The policy of which access is being requested
+- The developer doing the requesting
+- The catalog entry in question
+- The reasoning of why the developer should have access (these are dynamic fields and can be configured)
+
+When a developer requests access to an API Catalog entry, this key request represents that request for access. The key request can then be acted on, either by the portal itself, or by an administrator. The key request does not grant a token yet, it simply marks the fact that a token has been requested and why.
+
+Tyk enables you to manage this flow in a few ways:
+
+- Auto-approve the key request.
+- Have an admin approve the key-request.
+- Hand off to a third-party system to manage the key-request (e.g. for billing or additional user validation).  This is done via WebHooks or via the "Redirect Key Request" Portal Setting.
+
+## Key Approval
+Once a key request is created, one of two things can be done to it:
+
+- It can be approved: Covered below
+- It can be declined: In which case the request is deleted.
+
+A key request can be created using the Dashboard API too, in fact, the Key Request mechanism is a great way to create a mapping between an identity (a developer) and a token, and managing that process.
+
+### Secure Key Approval
+
+By default, the Key Approval flow is straight forward.  Once a Key Request is approved, the Developer will be notified via an email which contains the API Key.
+
+As of Dashboard version `3.1.0`, it is now possible to turn on a more secure key approval flow.  Once the "Request Key Approval" setting is enabled, we see an additional setting:
+<img src="/img/dashboard/portal-management/secure_key_approval_setting.png" alt="secure_key_approval_setting" />
+
+With this feature turn on, we prevent the API key from being sent in plain text via email.  Instead, the once a key request is approved, the Developer will be sent a confirmation link in an email that directs them to the Portal:
+<img src="/img/dashboard/portal-management/secure_key_approval_email.png" alt="secure_key_approval_email" />
+
+After clicking the `Generate Key` link and logging into the Portal, the key becomes available to the user:
+<img src="/img/dashboard/portal-management/secure_key_approval_generate.png" alt="secure_key_approval_generate" />
\ No newline at end of file
diff --git a/tyk-developer-portal/tyk-portal-classic/keycloak-dcr.mdx b/tyk-developer-portal/tyk-portal-classic/keycloak-dcr.mdx
new file mode 100644
index 0000000000..a268ca98a5
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/keycloak-dcr.mdx
@@ -0,0 +1,159 @@
+---
+title: "Step by step guide using Keycloak"
+order: 1
+robots: "noindex, nofollow"
+sidebarTitle: "Step by step guide using Keycloak"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+We are going walk you through a basic integration of Tyk with Keycloak using the [OpenID Connect Dynamic Client Registration protocol](https://tools.ietf.org/html/rfc7591). Our current implementation provides support for the client credentials flow with support for <Tooltip tip="JSON Web Tokens">JWT</Tooltip>. To the developer it works like this:
+
+1. An API with its corresponding security policy is created in Tyk. It is then added to the Developer Portal Catalog.
+
+2. A developer signs up and creates a Dynamic Client Registration provider using the Developer Portal.
+Tyk sends the Dynamic Client Registration call to your <Tooltip tip="Identity Provider">IDP</Tooltip>. The IDP replies with the client ID and secret.
+
+3. Using the previous information, the developer (or your application) triggers a call to the token endpoint of the IDP.
+The developer (or your application) then triggers a call to Tyk, using the token that was generated by the IDP. Tyk validates this token using the <Tooltip tip="JSON Web Key Sets">JWKS</Tooltip> provided by the IDP.
+
+### Requirements
+
+- A [Keycloak](https://www.keycloak.org/) instance.
+- A [Tyk Self Managed installation](/tyk-self-managed/install) (Gateway + Dashboard).
+
+### Getting started with Keycloak
+
+To get started with Dynamic Client Registration in Keycloak you'll need to generate an [initial access token](https://openid.net/specs/openid-connect-registration-1_0.html#Terminology) using the Keycloak Administration Console. After logging in, click **Realm settings**  under **Configure** and select the **Client Registration** tab:
+
+<img src="/img/dcr/keycloak/step_1.png" alt="Step 1" />
+
+To generate an initial access token, click **Create** and set the expiration time and maximum number of clients to be created using this token:
+
+<img src="/img/dcr/keycloak/step_2.png" alt="Step 2" />
+
+Click **Save** and the token will be created. Keep it safe as you'll use this token to configure Tyk.
+
+### Setting up Tyk
+
+Now you're ready to set up Tyk. For compatibility reasons, check your `tyk_analytics.conf` and make sure that a proper `oauth_redirect_uri_separator` parameter is set. You may use the following value:
+
+```json
+    "oauth_redirect_uri_separator": ";",
+```
+
+**Note:** If you're using a self-signed certificate on your Keycloak instance, you will need to set additional flags on both gateway and dashboard. For skipping DCR endpoint SSL verification, add the following flag to `tyk_analytics.conf`:
+
+```json
+    "dcr_ssl_insecure_skip_verify": true
+```
+
+Also add the following flag to `tyk.conf`, this will instruct the gateway to skip SSL verification when the JWT middleware is in use, particularly when JWKS are retrieved from your IDP:
+
+```json
+    "jwt_ssl_insecure_skip_verify": true
+```
+
+Remember to restart the services after applying the above changes.
+
+Open the Tyk Dashboard and click **APIs** under **System Management**. Create a new API called "Keycloak API":
+
+<img src="/img/dcr/keycloak/step_3.png" alt="Step 3" />
+
+Complete first part of the API creation form, then click **Configure API** and set the Authentication mode as in the image below:
+
+<img src="/img/dcr/keycloak/step_4.png" alt="Step 4" />
+
+
+<Note>
+Where do I get the proper JWKS URI for my Keycloak environment?
+
+The JWKS URI is a required field in the `.well-known/openid-configuration` endpoint of your OpenID Connect Provider metadata. Please see the [OpenID spec](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse) for further information.
+</Note>
+
+
+
+
+For the **Identity Source** field use `"sub"` and for **Policy Field Name** use `"pol"`.
+
+1. Click **Save** 
+2. Select **Policies** under **System Management**
+3. Click **Create a Policy** and call it **Keycloak Policy**. Use the default values for this policy.
+4. In the **Access rights** section, select your previously created **Keycloak API**. You will also need to enter an expiration setting for your keys.
+
+After the policy is created, switch back to the API settings and make sure that the API is using your **Keycloak API** policy:
+
+<img src="/img/dcr/keycloak/step_5.png" alt="Step 5" />
+
+Now you're ready to add this API to the Developer Portal. 
+1. Click **Catalog** under **Portal Management** on the navigation menu. 
+2. Click **Add New API**, enter a name for it and select the newly created policy. Again, you will use **Keycloak Policy**:
+
+<img src="/img/dcr/keycloak/step_6.png" alt="Step 6" />
+
+1. Click **Save** then open the API added again
+2. Open the **Settings** tab. 
+3. In **API Details** select the **Override global settings** option.
+
+
+
+    <Note>
+    Tyk lets you set global portal settings that apply to **all portal-listed APIs**, in this guide we assume you’re enabling and setting up DCR for a single API. In case you want to enable DCR for all the APIs, you should go to the **Settings** section under **Portal Management**, and in the **API Access** tab you can enter your DCR settings there.
+    </Note>
+
+
+4. Scroll down to the DCR section and enter the following settings:
+
+<img src="/img/dcr/keycloak/step_7.png" alt="Step 7" />
+
+**Providers:** Different providers might implement the standard in slightly different ways, Tyk provides a specific driver for each one. For IDPs that aren’t on the list use the **Other** option.
+
+**Grant Types:** The [OAuth 2.0 grant types](/api-management/authentication/oauth-2) that will be used by the client, see the [specification](https://openid.net/specs/openid-connect-registration-1_0.html#rfc.section.2) for more details.
+
+**Token Endpoint Auth Method:** defines the way the client will authenticate against the token endpoint.
+
+**Response Types:** OAuth 2.0 response types that will be used by the client.
+
+**Identity Provider Host:** Base IDP URL, e.g. `https://keycloak:8443/`
+
+**Client Registration Endpoint:** OpenID Connect client registration endpoint. This value is found in your well-known discovery document as `registration_endpoint`. The well-known location URL is typically `https://keycloak:8443/.well-known/openid-configuration`
+
+**Initial Registration Access Token:** the token that’s used to register new clients, this was generated in the early steps of the guide.
+
+### Testing the flow
+
+Now that both Tyk and Keycloak are ready we can test the complete flow. 
+
+1. Click **Developers** under **Portal Management**
+2. Click on **Add developer** and create a developer user.
+
+After the developer is created, open your Developer Portal, click on the **OAuth Clients** navigation bar button and follow the wizard:
+
+<img src="/img/dcr/keycloak/step_8.png" alt="Step 8" />
+
+Click **Create first OAuth Client**. You’ll see your previously created **Keycloak API**, select it and click **Save and continue**. The following screen will require you to enter a client name. It’s also possible to set redirect URLs if you also plan to use this client for other flow types. This setting can be left blank for the purposes of this guide.
+
+<img src="/img/dcr/keycloak/step_9.png" alt="Step 9" />
+
+Once you click **Create**, Tyk will trigger a registration on your IDP and the details of your client will be displayed:
+
+<img src="/img/dcr/keycloak/step_10.png" alt="Step 10" />
+
+If you check the Keycloak dashboard you will see this client too:
+
+<img src="/img/dcr/keycloak/step_11.png" alt="Step 11" />
+
+The next step is to generate a token and use it for accessing your **Keycloak API**. We'll use Postman for this. You will need your token URL which is also the well-known URL for your organization.
+For this guide we use `https://keycloak:8443/auth/realms/master/protocol/openid-connect/token`
+
+Your Postman request should contain the following body, where `"client_id"` and `"client_secret"` are the credentials you got from the developer portal:
+
+<img src="/img/dcr/keycloak/step_12.png" alt="Step 12" />
+
+Note that we aren’t using any additional headers for this request, the client credentials are enough.
+
+Once we get a response from the IDP, we can copy the `"access_token"` and use it to access our **Keycloak API**, this request will be proxied by Tyk:
+
+<img src="/img/dcr/keycloak/step_13.png" alt="Step 13" />
diff --git a/tyk-developer-portal/tyk-portal-classic/monetise.mdx b/tyk-developer-portal/tyk-portal-classic/monetise.mdx
new file mode 100644
index 0000000000..37ee15daae
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/monetise.mdx
@@ -0,0 +1,35 @@
+---
+title: "Monetize"
+order: 11
+robots: "noindex, nofollow"
+sidebarTitle: "Monetising your APIs"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+Out of the box, the Tyk Developer Portal does not have a billing component, however, this does not mean that it is not possible to enable monetization within a Portal developer access flow.
+
+### The Developer Key Request Flow
+
+When a developer enrolls for API access with a Tyk portal system, they will:
+
+1.  Sign up
+2.  Select a catalog entry to participate in
+3.  Submit a key request form
+4.  Receive their token
+
+With Tyk, it is possible to prevent step 4, which auto-enables the key, and instead have the developer redirected to a third party app. This app can then handle any transactional process such as taking a credit card number or pre-validating the developer, before returning the developer to the Portal.
+
+When Tyk hands off to the redirected app, it will also add the key request ID to the request, so the application that handles the transaction can then use the Tyk Dashboard REST API to approve the key request (triggering the email that notifies the developer of their token, as well as notifying the calling application of the raw token), closing the loop.
+
+To enable the developer hand-off in a Tyk Portal, from the **Portal Settings**  enable the redirect option:
+
+<img src="/img/dashboard/portal-management/portal_redirect_2.5.png" alt="Redirect key requests form" />
+
+## Example Using Stripe
+
+In this video, we walk you through setting up Stripe to take payments via your Tyk Developer Portal.
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/k5b3FURaULk" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
\ No newline at end of file
diff --git a/tyk-developer-portal/tyk-portal-classic/okta-dcr.mdx b/tyk-developer-portal/tyk-portal-classic/okta-dcr.mdx
new file mode 100644
index 0000000000..8ef5693ee4
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/okta-dcr.mdx
@@ -0,0 +1,172 @@
+---
+title: "Step by step guide using Okta"
+order: 2
+robots: "noindex, nofollow"
+sidebarTitle: "Step by step guide using Okta"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+## Introduction
+
+We are going walk you through a basic integration of Tyk with Okta using the [OpenID Connect Dynamic Client Registration protocol](https://tools.ietf.org/html/rfc7591). Our current implementation provides support for the client credentials flow with support for <Tooltip tip="JSON Web Tokens">JWT</Tooltip>. 
+
+The user journey is as follow:
+
+1. A developer signs up and creates a Dynamic Client Registration provider using the Developer Portal.
+
+2. Tyk sends the Dynamic Client Registration call to your <Tooltip tip="Identity Provider">IDP</Tooltip>. The IDP replies with the client ID and secret.
+
+3. Using that information, the developer (or the application) triggers a call to the token endpoint of the IDP.
+
+4. The developer (or the application) then triggers a call to Tyk, using the token that was generated by the IDP. Tyk validates this token using the <Tooltip tip="JSON Web Key Sets">JWKS</Tooltip> provided by the IDP.
+
+### Requirements
+
+- An OKTA account (a [trial account](https://www.okta.com/free-trial/) should be enough).
+- A [Tyk Self Managed installation](/tyk-self-managed/install) (Gateway + Dashboard).
+
+### Getting started with OKTA
+
+First signup to OKTA, the initial screen looks like:
+
+<img src="/img/dcr/okta/step_1.png" alt="Step 1" />
+
+The first thing you’ll need for our integration is an API token from OKTA, the OpenID specification also calls this an [Initial Access Token](https://openid.net/specs/openid-connect-registration-1_0.html#Terminology) to differentiate it from other tokens that are used with this protocol. To create this token, click  **API** option from the **Security** menu on the navigation bar:
+
+<img src="/img/dcr/okta/step_2.png" alt="Step 2" />
+
+From the API section, select the **Tokens** tab and click **Create Token** and enter a name for the token. For this guide we’re calling it "Tyk Integration":
+
+<img src="/img/dcr/okta/step_3.png" alt="Step 3" />
+
+Click **Create Token**. Keep it safe as you'll use this token to configure Tyk.
+
+Next you need to create a scope, from the **Authorization servers** tab in the API section, click **Add Scope**. You need to select the **Set as default scope** option:
+
+<img src="/img/dcr/okta/step_4.png" alt="Step 4" />
+
+### Setting up Tyk
+
+Now you're ready to set up Tyk. For compatibility reasons, check your `tyk_analytics.conf` and make sure that a proper `oauth_redirect_uri_separator` parameter is set. You may use the following value:
+
+```json
+    "oauth_redirect_uri_separator": ";",
+```
+
+Remember to restart the service after applying the above change.
+
+Now open the Tyk Dashboard and click **APIs** under **System Management**. Create a new API called "OKTA API":
+
+<img src="/img/dcr/okta/step_5.png" alt="Step 5" />
+
+Complete first part of the API creation form, then click **Configure API** and set the Authentication mode as in the image below:
+
+<img src="/img/dcr/okta/step_6.png" alt="Step 6" />
+
+
+<Note>
+Where do I get the proper JWKS URI for my Keycloak environment?
+
+From the OKTA Dashboard, open the **API** section under **Security**, take the base URL from the default Authorization Server and append the `/v1/keys` suffix, e.g. `https://tyk-testing.okta.com/oauth2/default/v1/keys`.
+</Note>
+
+
+For the **Identity Source** field use `"sub"` and for **Policy Field Name** use `"pol"`.
+
+1. Click **Save** 
+2. Select **Policies** under **System Management**
+3. Click **Create a Policy** and call it **OKTA Policy**. Use the default values for this policy.
+4. In the **Access rights** section, select your previously created **OKTA API**. You will also need to enter an expiration setting for your keys.
+
+After the policy is created, switch back to the API settings and make sure that the API is using your **OKTA Policy** policy:
+
+<img src="/img/dcr/okta/step_7.png" alt="Step 7" />
+
+Now you're ready to add this API to the Developer Portal. 
+1. Click **Catalog** under **Portal Management** on the navigation menu. 
+2. Click **Add New API**, enter a name for it and select the newly created policy. Again, you will use **OKTA API**:
+
+<img src="/img/dcr/okta/step_8.png" alt="Step 8" />
+
+1. Click **Save** then open the API added again
+2. Open the **Settings** tab. 
+3. In **API Details** select the **Override global settings** option.
+
+
+
+    <Note>
+    Tyk lets you set global portal settings that apply to **all portal-listed APIs**, in this guide we assume you’re enabling and setting up DCR for a single API. In case you want to enable DCR for all the APIs, you should go to the **Settings** section under **Portal Management**, and in the **API Access** tab you can enter your DCR settings there.
+    </Note>
+
+
+4. Scroll down to the DCR section and enter the following settings:
+
+
+<img src="/img/dashboard/portal-management/dcr-okta-grant-types.png" alt="Okta Grant Types" />
+
+
+**Providers:** Different providers might implement the standard in slightly different ways, Tyk provides a specific driver for each one. For IDPs that aren’t on the list use the "Other" option. For this guide, pick "OKTA".
+
+**Grant Types:** The grant types that will be used by the client. See the [specification](https://openid.net/specs/openid-connect-registration-1_0.html#rfc.section.2) for more details. You need to enter the following grant types:
+ * Client Credentials
+ * Implicit
+ * Authorization Code
+
+**Token Endpoint Auth Method:** defines the way the client will authenticate against the token endpoint. Use "Client Secret - Post".
+
+**Response Types:** OAuth 2.0 response types that will be used by the client. Set **Token**.
+
+**Identity Provider Host:** Base IDP URL, e.g. `https://tyk-testing.okta.com/`
+
+**Client Registration Endpoint:** OpenID Connect client registration endpoint. The value we use is `https://tyk-testing.okta.com/oauth2/v1/clients`
+
+This value is found in your well-known discovery document as `registration_endpoint`. The well-known location URL is typically `https://tyk-testing.okta.com/.well-known/openid-configuration` (replace "tyk-testing" with your org.).
+
+**Initial Registration Access Token:** the token that’s used to register new clients, this was generated in the early steps of the guide.
+
+
+<Note>
+A note on grant types and response types in OKTA
+
+It’s important to note that OKTA’s DCR endpoint supports a parameter called `"application_type"`, the application types aren’t standard across all IDPs, while the initial specification mentions `"native"` or `"web"` types, some IDPs implement their own. In the current implementation Tyk supports the usage of the `"web"` application type which is necessary in supporting the client credentials flow that’s described in this guide, as well as others, this is set automatically when OKTA is set as the provider. Currently, the ability to change the application type is available with the Enterprise Developer Portal.
+</Note>
+
+
+### Testing the flow
+
+Now that both Tyk and OKTA are ready we can test the complete flow.
+
+1. Click **Developers** under **Portal Management**
+2. Click on **Add developer** and create a developer user.
+
+After the developer is created, open your Developer Portal, click on the **OAuth Clients** navigation bar button and follow the wizard:
+
+<img src="/img/dcr/okta/step_10.png" alt="Step 10" />
+
+Click **Create first OAuth Client**. You’ll see your previously created **OKTA API**, select it and click **Save and continue**. The following screen will require you to enter a client name. It’s also possible to set redirect URLs if you also plan to use this client for other flow types. This setting can be left blank for the purposes of this guide.
+
+<img src="/img/dcr/okta/step_11.png" alt="Step 11" />
+
+Once you click **Create**, Tyk will trigger a registration on your IDP and the details of your client will be displayed:
+
+<img src="/img/dcr/okta/step_12.png" alt="Step 12" />
+
+If you check the OKTA dashboard you will see this client too:
+
+<img src="/img/dcr/okta/step_13.png" alt="Step 13" />
+
+The next step is to generate a token and use it for accessing our **OKTA API**. We'll use Postman for this. You will need your token URL which is also the well-known URL for your organization.
+For this guide you'll use `https://[org].okta.com/oauth2/default/v1/token`
+
+Your Postman request should contain the following body, where `"client_id"` and `"client_secret"` are the credentials you got from the developer portal:
+
+<img src="/img/dcr/okta/step_14.png" alt="Step 14" />
+
+Note that we aren’t using any additional header for this request, the client credentials are enough. We’re also passing our previously created `"tyk"` scope as value.
+
+Once we get a response from the IDP, we can copy the `"access_token"` and use it to access our **OKTA API**, this request will be proxied by Tyk:
+
+<img src="/img/dcr/okta/step_15.png" alt="Step 15" />
diff --git a/tyk-developer-portal/tyk-portal-classic/portal-concepts.mdx b/tyk-developer-portal/tyk-portal-classic/portal-concepts.mdx
new file mode 100644
index 0000000000..2b5e97f0f1
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/portal-concepts.mdx
@@ -0,0 +1,94 @@
+---
+title: "Portal Concepts"
+order: 1
+robots: "noindex, nofollow"
+sidebarTitle: "Portal Concepts"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+## API Catalog
+
+The API Catalog is a list of APIs that you have published to your portal.
+
+The API Catalog entry is not a one-to-one map between an API you manage in Tyk, since you might want to compose multiple managed services into a single public-facing API Facade, a catalog entry is actually an entry that maps against a security policy.
+
+From the API Catalog, a user can either:
+
+- View the documentation for the API
+- Request for a token to the API
+
+When a developer requests a token, a new Auth token is generated on the linked policy, instead of the actual API, since you may wish to publish multi-tier access to the same API (E.g. Bronze / Silver / Gold).
+
+## Key Requests
+
+A key request is a record that is generated when a developer requests an access token for an API published in the API Catalog. The Key request encompasses the following information:
+
+Read more about them in the [Key Request section](/tyk-developer-portal/tyk-portal-classic/key-requests)
+
+### Multiple APIs for a single Key Request
+
+New for v1.9, a developer can now request access to multiple APIs with a single key request. The APIs you group together via a single key should all be of the same authentication type.
+
+<img src="/img/dashboard/portal-management/multi-api-per-request.png" alt="Multiple APIs per Key Request" />
+
+To enable this functionality, select **Enable subscribing to multiple APIs with a single key** from the Portal Management Settings.
+
+<img src="/img/dashboard/portal-management/multi-api-setting.png" alt="Multiple APIs" />
+
+### Edit APIs associated with a single Key Request
+
+New for v1.9.4, if you have **Enable subscribing to multiple APIs with a single key** selected you can edit the APIs associated with the Key. You can perform the following:
+
+* Remove access to existing APIs
+* Subscribe to new APIs (of the same authentication type as the existing ones).
+
+ <img src="/img/dashboard/system-management/modify_key_approval.png" alt="Edit APIs" /> 
+
+
+If a new API requires key approval, the new key request will be generated, and access to this API will be granted after your admin approves it.
+
+
+## Policies
+
+In the context of the developer portal, a security policy is the main "element" being exposed to public access. The policy is the same as a standard policy, and the policy forms the baseline template that gets used when the portal generates a token for the developer.
+
+Security policies are used instead of a one-to-one mapping because they encapsulate all the information needed for a public API program:
+
+1.  Rate limits
+2.  Quota
+3.  Access Lists (What APIs and which versions are permitted)
+4.  Granular access (Which methods and paths are allowed, e.g. you may want to only expose read-only access to the portal, so only GET requests are allowed)
+5.  Multi-policy-management (With a Key, you can assign more than one policy to an APIs and each policy will have it's own counter).
+
+Within the developer portal admin area, under a developer record, you will see their subscriptions. Those subscriptions represent the tokens they have and their policy level access. It is possible to then "upgrade" or "downgrade" a developers access without actually managing their token, but just assigning a new policy to that token.
+
+## Documentation
+
+Within the portal, documentation is what a developer can use to learn how to access and use your APIs.
+
+The developer portal supports two types of documentation, and will render them differently:
+
+1.  API Blueprint - this is rendered to HTML templates using Jade and Aglio.
+2.  Swagger/OpenAPI (OpenAPI 2.0 and 3.0 are supported) - either by pasting your Swagger JSON or YAML content into the code editor, or by linking to any public facing Swagger URL. The URL version can be rendered using [Swagger UI](https://swagger.io/tools/swagger-ui/) which offers a sandbox environment where developers can interact with your API from the browser.
+
+
+
+    <Note>
+    Support for API Blueprint is being deprecated. See [Importing APIs](/api-management/gateway-config-managing-classic#api-blueprint-is-being-deprecated) for more details.
+    </Note>
+
+
+Within an API Catalog entry, documentation must be attached to the catalog entry for it to be published.
+
+## Developers
+
+Within the developer portal, a developer is an end-user that has access to the developer portal section of the portal website. This user is completely separate from Tyk Dashboard users and they do not ever intersect (they are also stored separately).
+
+A developer record consists of some basic sign-up information and a set of admin-definable fields that get attached to the developer as metadata.
+
+Within the developer view of the Tyk Dashboard, it is possible to manage all access of a developer, including the access levels of their tokens.
+
+
diff --git a/tyk-developer-portal/tyk-portal-classic/portal-events-notifications.mdx b/tyk-developer-portal/tyk-portal-classic/portal-events-notifications.mdx
new file mode 100644
index 0000000000..4992c36a1e
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/portal-events-notifications.mdx
@@ -0,0 +1,111 @@
+---
+title: "Portal events and notifications"
+order: 9
+robots: "noindex, nofollow"
+sidebarTitle: "Events and Notifications"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+Tyk enables you to actively monitor both user and organization quotas. These active notifications are managed in the same way as webhooks and provides an easy way to notify your stakeholders, your own organization or the API end user when certain thresholds have been reached for their token.
+
+### Tyk Cloud Users
+
+Monitors are disabled by default in Tyk Cloud. Portal events are enabled and can be defined by raising a support ticket.
+
+### How to Enable Monitors
+
+See [Monitors](/api-management/gateway-events#monitoring-quota-consumption) for details of how to configure quota consumption monitors.
+
+### Portal Events
+
+The Tyk Dashboard and the Portal now support email notifications powered by Mandrill, Sendgrid, Mailgun and Amazon SES.
+
+#### How Email Notifications Work
+
+If you have enabled email notifications, the Portal will attempt to send notifications regarding a user's sign-up status or key request status to their username email address. These templates can be found in the `portal/email_templates` folder.
+
+The templates are available as text based or HTML. See the standard included ones to see the various template fields that can be customized.
+
+### Extra Dashboard And Portal Events
+
+The Dashboard and Portal also support a certain level of events that you can use to notify your system of various things that have happened in the Portal.
+
+To configure them, add an `event_options` section to an Organization when you are creating them. See [Creating an Organization via the Dashboard Admin API](https://tyk.io/docs/api-reference/organisations/create-an-organisation) for more details.
+
+Within this object, you can then register webhooks or/and an email address to notify when an event occurs:
+
+```{.copyWrapper}
+event_options: {
+  api_event: {
+    webhook: "http://posttestserver.com/post.php?dir=tyk-events",
+    email: "test@test.com"
+  },
+  key_event: {
+    webhook: "http://posttestserver.com/post.php?dir=tyk-key-events",
+    email: "test@test.com"
+  },
+  key_request_event: {
+    webhook: "http://posttestserver.com/post.php?dir=tyk-key-events",
+    email: "test@test.com"
+  }
+}
+```
+
+The following events are supported:
+
+*   `api_event`: When an API is created, updated or deleted.
+
+*   `key_event`: When a key is created, updated or deleted.
+
+*   `key_request_event`: When a Portal key request is created or updated.
+
+Sample **Webhook** Payload for a **Key Request** Event:
+```{.json}
+{
+    "event": "key_request_event.submitted",
+    "data": {
+        "id": "5e543dd0f56e1a4affdd7acd",
+        "org_id": "5e2743567c1f8800018bdf35",
+        "for_plan": "5e2744897c1f8800018bdf3b",
+        "apply_policies": [
+            "5e2744897c1f8800018bdf3b"
+        ],
+        "by_user": "5e430ef68131890001b83d2e",
+        "approved": false,
+        "date_created": "2020-02-24T16:19:12.175113-05:00",
+        "portal_developer": {
+            "id": "5e430ef68131890001b83d2e",
+            "email": "dev@dev.ca",
+            "date_created": "2020-02-11T15:30:46.003-05:00",
+            "inactive": false,
+            "org_id": "5e2743567c1f8800018bdf35",
+            "keys": {
+                "6dc2dfc0": [
+                    "5e431f938131890001b83d30"
+                ]
+            },
+            "subscriptions": {
+                "5e431f938131890001b83d30": "6dc2dfc0"
+            },
+            "last_login_date": "2020-02-11T16:43:39.858-05:00"
+        },
+        "catalogue_entry": {
+            "name":"frontend APIs",
+            "short_description":"",
+            "long_description":"",
+            "show":true,
+            "api_id":"",
+            "policy_id":"5e2744897c1f8800018bdf3b",
+            "documentation":"5e3b477a7c1f8800013603c6",
+            "version":"v2",
+            "is_keyless":false,
+            "config":{
+                
+            }
+        }
+    }
+}
+```
\ No newline at end of file
diff --git a/tyk-developer-portal/tyk-portal-classic/portal-oauth-clients.mdx b/tyk-developer-portal/tyk-portal-classic/portal-oauth-clients.mdx
new file mode 100644
index 0000000000..4eaa301954
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/portal-oauth-clients.mdx
@@ -0,0 +1,54 @@
+---
+title: "Portal OAuth Clients"
+order: 10
+robots: "noindex, nofollow"
+sidebarTitle: "Portal OAuth Clients"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+From Tyk Dashboard v1.8, you can now create and manage OAuth clients from the Developer Portal.
+
+## Prerequisites
+
+1. An API created in your Dashboard using Tyk's ability to act as a OAuth provider. You need to have [OAuth 2.0](/api-management/authentication/oauth-2) selected as the Authentication mode. See [Create an API](/api-management/gateway-config-managing-classic#create-an-api) for more details. 
+2. A Policy created in your Dashboard with the API created above selected in the **Access Rights > Add access rule** drop-down. See [Create a Security Policy](/api-management/gateway-config-managing-classic#secure-an-api) for more details.
+3. A Portal Catalog entry for the API created above with the Policy you created selected from the **Available policies** drop-down. See [Create a Portal Entry](/getting-started/tutorials/publish-api) for more details.
+4. A developer account created in your Developer Portal.
+
+## Create the OAuth Client from the Portal
+
+1. Login to your Portal:
+    
+<img src="/img/dashboard/portal-management/dev_portal_homev1.8.png" alt="Developer Portal Home Screen" />
+
+2. Select **OAuth Clients** from the top menu
+3. If this is the first OAuth Client you are creating, the screen will be as below:
+
+<img src="/img/dashboard/portal-management/portal_first-oauth_client.png" alt="Developer OAuth Home Screen" />
+
+4. Click **Create first OAuth Client**
+5. Hover over the API you added to the Catalog with OAuth Authentication mode from the drop-down list:
+
+<img src="/img/dashboard/portal-management/portal_oauth_select_api2.png" alt="Select API Screen" />
+
+6. Click **Select API**
+7. Then click **Save and continue**:
+
+<img src="/img/dashboard/portal-management/portal_oauth_connected_api2.png" alt="Save" />
+
+8. You can now add details about your application, and set the redirect URL to the application. If you want to use this client for more than one application, you can add other redirect URLs as necessary.
+9. Click **Create**
+
+<img src="/img/dashboard/portal-management/create_portal_oauth_client.png" alt="Create" />
+
+10. You need to copy and save the displayed Client Secret, as you will not be able to view it from the Portal again. The secret is stored on the Dashboard and are listed for each developer under the **Portal Management > Developers** menu.
+
+<img src="/img/dashboard/portal-management/oauth_client_secrets.png" alt="secret" />
+
+
+## Revoke OAuth Client Tokens
+
+See [Revoke OAuth Tokens](/api-management/authentication/oauth-2#revoking-access-tokens) for more details.
\ No newline at end of file
diff --git a/tyk-developer-portal/tyk-portal-classic/tyk-portal-classic/customise/customise-with-templates.mdx b/tyk-developer-portal/tyk-portal-classic/tyk-portal-classic/customise/customise-with-templates.mdx
new file mode 100644
index 0000000000..4e7478de3f
--- /dev/null
+++ b/tyk-developer-portal/tyk-portal-classic/tyk-portal-classic/customise/customise-with-templates.mdx
@@ -0,0 +1,106 @@
+---
+title: "Customize Page Templates"
+order: 2
+robots: "noindex, nofollow"
+sidebarTitle: "Customise Page Templates"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+The Tyk Developer Portal can be fully customized using templates. The templates for the Portal are only available to Self-Managed users currently. These templates are located in the `/opt/tyk-dashboard/portal` folder of your Tyk installation.
+
+All templates are based on Twitter Bootstrap and are standard HTML with some Golang Template snippets to handle dynamic content rendering.
+
+
+<Note>
+The Portal process (`tyk-analytics`) must be restarted for template changes to take effect. This is because the application caches templates on startup.
+</Note>
+
+
+
+### Adding new templates
+
+The Tyk content editor enables you to specify a template name to use when rendering templates. two are provided by default:
+
+*   Default Home Page Template
+*   Default Page Template
+
+The third option is "Custom" and this allows you to enter a template name into the field editor that will set the template name to use on render.
+
+To set a new template name up in your Tyk installation, you will need to add the file to the `portal` folder and ensure it starts and ends with the templates directive:
+
+```
+{{ define "customPage" }}
+<!--- HTML IN HERE --/>
+{{ end }}
+```
+
+In the above snippet, we've created the `customPage` template, this can then be used as the template name in the CMS form when generating for the page type.
+
+### Content fields
+
+You'll notice that in existing templates, certain fields are mapped out as content:
+
+```
+{{.Page.Fields.PanelThreeContent | markDown }}
+```
+
+When you generate your own templates, you can use your own field names so that you can manage the content from inside the CMS:
+
+<img src="/img/dashboard/portal-management/page_settings_2.5.png" alt="Custom templates section" />
+
+In the above example, you would be able to read the `MyContent` field by requesting it from the page data in the template like so:
+
+```
+{{.Page.Fields.MyContent| markDown }}
+```
+
+You do not need to pipe the content through the Markdown filter, but it is advised as it gives you a lot more freedom with regards to how to style content blocks.
+
+In existing page types, these content fields are already set out.
+
+### Dynamic Customization
+
+Portal templates now have access to the Developer object, its subscriptions and issued keys meta-data, providing the ability to conditionally show or hide content inside the Portal, based on the attributes described below.
+
+The current logged in Developer can be accessed using `.UserData` variable with the following fields:
+
+*   Id - Internal developer ID
+*   Email - Developer email
+*   OrgID - Tyk Organization ID
+*   Subscriptions  - Map containing subscriptions where key is a policy ID and value is an API key
+*   Fields - Map containing custom developer fields
+*   OauthClients - Map containing list of registered oAuth clients, where Key is the policy ID.
+
+The current logged in Developer detailed subscription object can be accessed using the `.APIS` variable, containing map, where the key is PolicyID and value of the following format:
+ 
+*   APIDescription - API definition
+      * ID - Internal API id
+      * Name - API name
+      * More fields: https://github.com/TykTechnologies/tyk/blob/master/apidef/api_definitions.go#L320
+*   APIKey - API key
+*   PolicyData - Policy object
+      * ID - Internal Policy ID
+      * Name - Policy Name
+      * More fields: https://github.com/TykTechnologies/tyk/blob/master/user/policy.go#L5
+*   KeyMetaData - Key metadata of map type
+
+## Example
+You have different teams of developers, and for each team we want to show them a different list of APIs. In this case, for each developer, we need to set a custom  `team` field, and assert it in a template like this:
+
+```
+{{if .UserData.Fields.Team == `internal`}}
+… Display internal APIs …
+{{end}}
+{{if .UserData.Fields.Team == `public`}}
+… Display public set of APIs …
+{{end}}
+```
+
+### Add Files for Downloading
+
+If you want to have files available for download from your portal you can add them to your `/tyk-dashboard/portal/portal-assets` directory. 
+
+You can then refer to them by using a `/opt/tyk-dashboard/...` link.
diff --git a/tyk-gateway-api.mdx b/tyk-gateway-api.mdx
new file mode 100644
index 0000000000..f8872d92c6
--- /dev/null
+++ b/tyk-gateway-api.mdx
@@ -0,0 +1,35 @@
+---
+title: "Tyk Gateway API"
+description: "Tyk Gateway API documentation. This page provides details on how to use the Tyk Gateway API for managing session objects, policies, API definitions, and more."
+keywords: "OpenAPI Spec, OpenAPI Specification, OAS, REST, Tyk Gateway OpenAPI Spec, Tyk Gateway OAS, API Gateway OAS, API Gateway REST"
+order: 3
+sidebarTitle: "Overview"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+<img src="https://tyk.io/docs/img/swagger_gateway_image.png" width="963" height="250" alt="Tyk Gateway API"/>
+<img src="https://tyk.io/docs/img/swagger_gateway_direction_image.png" width="946" height="392" alt="Diagram showing traffic flow between Tyk Admin (using Curl, Postman, or httpie clients), Tyk Gateway backed by Redis, and the upstream API Server"/>
+
+<ButtonLeft href="https://raw.githubusercontent.com/TykTechnologies/tyk-docs/refs/heads/production/swagger/nightly/gateway-swagger.yml" color="green" content="Download Swagger" />
+
+The Tyk Gateway API is the primary means for integrating your application with the Tyk API Gateway system. This API is very small, and has no granular permissions system. It is intended to be used purely for internal automation and integration.
+
+**Warning: Under no circumstances should outside parties be granted access to this API.**
+
+The Tyk Gateway API is capable of:
+
+* Managing session objects (key generation).
+* Managing and listing policies.
+* Managing and listing API Definitions (only when not using the Tyk Dashboard).
+* Hot reloads / reloading a cluster configuration.
+* OAuth client creation (only when not using the Tyk Dashboard).
+
+In order to use the Gateway API, you'll need to set the **secret** parameter in your tyk.conf file.
+
+The shared secret you set should then be sent along as a header with each Gateway API Request in order for it to be successful:
+
+`x-tyk-authorization: <your-secret>`
+<br/>
+
+<b>The Tyk Gateway API is subsumed by the Tyk Dashboard API in Pro installations.</b>
diff --git a/tyk-governance/agent-management.mdx b/tyk-governance/agent-management.mdx
new file mode 100644
index 0000000000..77c540859d
--- /dev/null
+++ b/tyk-governance/agent-management.mdx
@@ -0,0 +1,651 @@
+---
+title: "Agent and API Provider Management"
+description: "Deploy, configure, and monitor Tyk Governance agents that discover and synchronize APIs from various providers to create a federated API inventory."
+keywords: "Tyk Governance, Agent Management, API Provider, API Discovery, API Synchronization"
+sidebarTitle: "Agent and API Provider Management"
+---
+
+
+<Note>
+**Note for Tyk Cloud Users**
+
+This documentation is for users who run their self-managed agents. If you're using Tyk Cloud, agents are automatically managed for your Tyk Dashboard, and you don't need to worry about installation, access tokens, or configuration. You can use the "Agents" and "API Provider" pages in the Tyk Cloud dashboard to check connection health between the agents and Governance Hub.
+</Note>
+
+
+## Availability
+
+- Version: Available since v0.2
+
+## Overview
+
+Agent and API Provider Management enables you to deploy, configure, and monitor the Tyk Governance agents that discover and synchronize APIs from various providers.
+
+### Understanding Agents and API Providers
+
+**Agents** are lightweight services that act as secure bridges between your API providers and the Tyk Governance Hub. They:
+
+- Run in your environment (on-premises, cloud, or hybrid)
+- Connect to one or more API providers to discover APIs
+- Securely transmit API data to the Governance Hub
+- Support high availability deployments
+- Can be monitored through the "Agents" section in the UI
+
+**API Providers** are the systems where your APIs are defined and managed, such as:
+
+- Tyk Dashboard
+- AWS API Gateway
+
+Each provider is configured within an agent and can be monitored through the "API Providers" section in the UI, where you can see:
+
+- How many APIs are discovered from each provider
+- The connection status of each provider
+- The last synchronization time
+- Provider-specific details
+
+### Key Benefits
+
+- **Centralized Agent Visibility**: Monitor all agents from a single dashboard
+- **Scheduled Synchronization**: Configure automatic API discovery at regular intervals
+- **High Availability Deployment**: Deploy multiple agent replicas with automatic leader election
+- **Detailed Status Monitoring**: Track agent health, connection status, and synchronization history
+- **Secure Communication**: All agent-to-hub communication is encrypted and authenticated
+
+### Dependencies
+
+- Requires Tyk Governance and agents v0.2 or higher
+- Agents support Kubernetes-based high availability, which requires Kubernetes cluster access
+
+## Quick Start
+
+In this tutorial, we'll set up a new agent, configure it to connect to an API provider, and monitor its status.
+
+### Prerequisites
+
+- Access to Tyk Governance Hub
+- Access to an API provider (Tyk Dashboard or AWS API Gateway)
+- A server or container environment to run the agent
+
+### Step-by-Step
+
+1. **Create a New Agent**
+
+    - From the Agents page, click the **New agent** button in the top-right corner.
+
+        <img src="/img/governance/agents-list.png" alt="" />
+
+    - In the New agent form, enter:
+       - **Name**: A descriptive name for the agent (required)
+       - **Description**: Details about the agent's purpose or location (required)
+
+        <img src="/img/governance/agents-new-1.png" alt="" />
+
+    - Click **Create agent** to save the new agent.
+
+        <img src="/img/governance/agents-new-2.png" alt="" />
+
+    - Alternatively, use the API to create a new agent:
+
+        ```sh
+        # Replace with your actual Governance URL and API key
+        GOVERNANCE_URL="https://your-governance-instance.tyk.io"
+        API_KEY="your-access-key"
+        AGENT_NAME="My API Provider Agent"
+
+        # Create agent
+        curl -s -X POST "${GOVERNANCE_URL}/api/agents/" \
+            -H "X-API-Key: ${API_KEY}" \
+            -H "Content-Type: application/json" \
+            -d '{
+                "name": "'"${AGENT_NAME}"'"
+            }'
+        ```
+
+        Note the agent ID returned in the response:
+
+        ```json
+        {"id":"a51d9bd0-bafe-4749-8285-e18641b151f2","name":"My API Provider Agent","last_heartbeat":"0001-01-01T00:00:00Z","status":"INACTIVE","providers":null}
+        ```
+
+2. **Generate an Agent Token**
+
+   - In the Agent information section, find the Access token field.
+
+   - If no token exists, click **Generate new access token**.
+
+   - For existing tokens:
+        - Click the eye icon to show/hide the token
+        - Use the copy icon to copy the token to your clipboard
+        - Use this token in your agent configuration file
+
+        <img src="/img/governance/agents-new-3.png" alt="" />
+
+        <img src="/img/governance/agents-new-4.png" alt="" />
+
+    - Alternatively, generate an authentication token for the agent using the API:
+
+        ```sh
+        # Replace with the agent ID from the previous step
+        AGENT_ID="a51d9bd0-bafe-4749-8285-e18641b151f2"
+
+        # Generate token
+        curl -X POST "${GOVERNANCE_URL}/api/auth/token/" \
+            -H "X-API-Key: ${API_KEY}" \
+            -H "Content-Type: application/json" \
+            -d '{
+                "agent_id": "'"${AGENT_ID}"'"
+            }'
+        ```
+
+        Save the token from the response:
+
+        ```json
+        {
+            "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+        }
+        ```
+
+3. **Create Agent Configuration File**
+
+    Create a file named `agent-config.yaml` with the following content:
+
+    ```yaml
+    # Tyk Governance Agent Configuration
+    governanceDashboard:
+        server:
+            # The gRPC endpoint URL of the Tyk Governance service
+            url: "your-governance-instance.tyk.io:50051"
+        
+        auth:
+            # Authentication token for this agent
+            token: "your-agent-token"
+
+    # API Provider Configurations
+    instances:
+        # Example Tyk Provider Configuration
+        - name: "tyk-provider"
+        type: "tyk"
+        config:
+            host: "http://your-tyk-dashboard:3000"
+            auth: "your-tyk-dashboard-api-key"
+        
+        # Example AWS API Gateway Configuration
+        - name: "aws-provider"
+        type: "aws"
+        config:
+            accessKeyId: "your-aws-access-key-id"
+            accessKeySecret: "your-aws-access-key-secret"
+            region: "us-east-1"
+    ```
+
+4. **Deploy the Agent**
+
+    Run the agent using Docker or as a Kubernetes Deployment. See [Installation](/tyk-governance/installation#deploy-the-agent) for details.
+
+5. **Monitor Agent Status**
+
+    - Check the agent status in the Governance Hub. A healthy agent will appear as "Healthy":
+
+        <img src="/img/governance/agents-list-2.png" alt="" />
+
+    - Check the agent status in the Governance Hub using API:
+
+        ```sh
+        curl "${GOVERNANCE_URL}/api/agents/${AGENT_ID}" \
+            -H "X-API-Key: ${API_KEY}"
+        ```
+
+        A healthy agent will show:
+
+        ```json
+        {
+            "id": "a51d9bd0-bafe-4749-8285-e18641b151f2",
+            "name": "My API Provider Agent",
+            "last_heartbeat": "2025-07-16T12:34:56Z",
+            "status": "ACTIVE",
+            "providers": [
+                {
+                    "name": "tyk-provider",
+                    "type": "tyk"
+                },
+                {
+                    "name": "aws-provider",
+                    "type": "aws"
+                }
+            ]
+        }
+        ```
+
+6. **Trigger Initial Synchronization**
+
+    Trigger a [synchronization](#synchronization-process) to verify the agent is working correctly.
+
+### Validation
+
+- The agent should appear as "Healthy" or have status as "ACTIVE" in the agent list
+- The agent's last heartbeat timestamp should be recent
+- After synchronization, APIs from your providers should appear in the API Repository
+
+## How It Works
+
+Agent Management works through a distributed architecture where agents deployed in your environments connect to the central Governance Hub using secure gRPC streams.
+
+### Agent Architecture
+
+```mermaid
+flowchart LR
+    subgraph "User Environment"
+        Agent[Governance Agent] --> Provider1[Tyk Dashboard]
+        Agent --> Provider2[AWS API Gateway]
+        Agent --> Provider3[Other Providers]
+    end
+    
+    subgraph "Governance Hub"
+        Hub[Governance Service] --- APIRepo[API Repository]
+    end
+    
+    Agent <-->|gRPC Streams| Hub
+```
+
+The agent establishes two persistent gRPC streams with the Governance Hub:
+
+1. **Health Stream**: Sends regular heartbeats to indicate the agent is alive and functioning
+2. **Sync Stream**: Used for API synchronization operations
+
+When multiple agent replicas are deployed with leader election enabled, they use Kubernetes leader election to ensure only one instance actively performs synchronization, while others stand by as hot backups.
+
+### Synchronization Process
+
+Synchronization can be triggered in three ways:
+
+1. **Manual Trigger**: Through the Governance Hub UI or API
+
+    <img src="/img/governance/sync-repository.png" alt="" />
+
+2. **Scheduled Sync**: At regular intervals configured in the agent. See [Understanding Scheduled Synchronization](#understanding-scheduled-synchronization).
+   
+3. **Initial Connection**: When an agent first connects to the Governance Hub
+
+#### Understanding Scheduled Synchronization
+
+You can configure scheduled synchronization for each API provider using the **Governance Hub API (Hub-side scheduling)**.
+
+Use the `/api/agents/{id}/sync-jobs` endpoint to configure provider-specific schedules:
+
+```sh
+# Schedule sync for a specific provider
+curl -X POST "${GOVERNANCE_URL}/api/agents/${AGENT_ID}/sync-jobs" \
+   -H "X-API-Key: ${API_KEY}" \
+   -H "Content-Type: application/json" \
+   -d '{
+        "repeat_every": "12h",
+        "provider": "tyk-provider",
+        "start_from": "2023-06-01T12:00:00Z"
+   }'
+```
+
+With this approach:
+- The Governance Hub's scheduler component manages the schedule
+- The Hub initiates synchronization by sending requests to the agent
+- It's a "push" model where the Hub tells the agent when to sync
+- You can set different schedules for different providers
+- Supports Go duration format (e.g., "1h", "12h", "7d")
+
+During synchronization:
+
+1. The agent receives a sync request from the hub (or initiates it based on its schedule)
+2. The agent queries each configured API provider for APIs
+3. The agent processes and normalizes the API definitions
+4. The agent streams the API definitions to the hub
+5. The hub processes and stores the API definitions
+6. The hub reconciles the API inventory, marking missing APIs as deleted
+
+### Deployment Scenarios
+
+#### Multi-Provider API Discovery
+
+Deploy agents to connect to different API providers across your organization, creating a comprehensive API inventory that spans platforms.
+
+```yaml
+# Agent configuration with multiple providers
+instances:
+  - name: "tyk-dashboard"
+    type: "tyk"
+    config:
+      host: "http://tyk-dashboard:3000"
+      auth: "your-tyk-api-key"
+  
+  - name: "aws-us-east"
+    type: "aws"
+    config:
+      accessKeyId: "your-aws-access-key"
+      accessKeySecret: "your-aws-secret-key"
+      region: "us-east-1"
+  
+  - name: "aws-eu-west"
+    type: "aws"
+    config:
+      accessKeyId: "your-aws-access-key"
+      accessKeySecret: "your-aws-secret-key"
+      region: "eu-west-1"
+```
+
+#### High Availability Agent Deployment
+
+Deploy multiple agent replicas in Kubernetes to ensure continuous API discovery even if some instances fail.
+
+```yaml
+# Kubernetes deployment with leader election
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: governance-agent
+spec:
+  replicas: 3  # Multiple replicas for redundancy
+  template:
+    spec:
+      containers:
+      - name: agent
+        env:
+        - name: POD_NAME # When leader election is enabled, POD_NAME environment variables must be set
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE # When leader election is enabled, POD_NAMESPACE environment variables must be set
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: TYK_AGENT_LEADERELECTION_ENABLED
+          value: "true"
+```
+
+## Configuration Options
+
+### Agent Configuration File
+
+The agent is configured using a YAML configuration file with the following sections:
+
+#### Core Configuration
+
+```yaml
+# Governance Dashboard Connection
+governanceDashboard:
+  server:
+    url: "your-governance-instance.tyk.io:50051"
+  auth:
+    token: "your-agent-token"
+
+# Log level (debug, info, warn, error)
+logLevel: info
+
+# Health probe configuration
+healthProbe:
+  server:
+    port: 5959
+```
+
+#### API Provider Configuration
+
+```yaml
+# API Provider Configurations
+instances:
+  # Tyk Provider
+  - name: "tyk-provider"
+    type: "tyk"
+    config:
+      host: "http://dashboard:3000"
+      auth: "your-tyk-api-key"
+  
+  # AWS API Gateway Provider
+  - name: "aws-provider"
+    type: "aws"
+    config:
+      accessKeyId: "your-aws-access-key-id"
+      accessKeySecret: "your-aws-access-key-secret"
+      region: "us-east-1"
+      # Optional session token for temporary credentials
+      sessionToken: "your-aws-session-token"
+```
+
+#### gRPC Connection (New in v0.2)
+
+```yaml
+rpc:
+  # Keepalive configures the keepalive settings for the gRPC connection.
+  keepalive:
+    # Enabled controls whether keepalive is enabled.
+    enabled: true
+    # Time is the duration after which if there are no activities, ping will be sent.
+    time: 30s
+    # Timeout is the duration the client waits for a response to a keepalive ping.
+    timeout: 20s
+    # PermitWithoutStream if true allows sending pings even without active streams.
+    permitWithoutStream: true
+```
+
+#### High Availability Configuration (New in v0.2)
+
+```yaml
+leaderElection:
+  # Enable or disable leader election
+  enabled: true
+  # Name of the Kubernetes lease object used for leader election
+  leaseName: "governance-agent-lock"
+  # Namespace where the lease object will be created
+  # If not specified, the agent's namespace will be used
+  leaseNamespace: ""
+  # Duration that non-leader candidates will wait before attempting to acquire leadership
+  leaseDuration: "15s"
+  # Duration that the acting leader will retry refreshing leadership before giving up
+  renewDeadline: "10s"
+  # Duration the leader elector clients should wait between leadership acquisition attempts
+  retryPeriod: "2s"
+```
+
+### Environment Variables
+
+The agent supports configuration through environment variables:
+
+| Environment Variable | Description | Default Value |
+| :--------------------- | :------------- | :--------------- |
+| `TYK_AGENT_LICENSEKEY` | Your Tyk Governance license key | - |
+| `TYK_AGENT_LOGLEVEL` | Log level (debug, info, warn, error) | `info` |
+| `TYK_AGENT_GOVERNANCEDASHBOARD_SERVER_URL` | The gRPC endpoint URL of the Tyk Governance service | - |
+| `TYK_AGENT_GOVERNANCEDASHBOARD_SERVER_TLS_ENABLED` | Enable TLS for gRPC connections | `false` |
+| `TYK_AGENT_GOVERNANCEDASHBOARD_SERVER_TLS_CACERTPATH` | Path to CA certificate | - |
+| `TYK_AGENT_GOVERNANCEDASHBOARD_SERVER_TLS_CLIENTCERTPATH` | Path to client certificate (for mTLS) | - |
+| `TYK_AGENT_GOVERNANCEDASHBOARD_SERVER_TLS_CLIENTKEYPATH` | Path to client key (for mTLS) | - |
+| `TYK_AGENT_GOVERNANCEDASHBOARD_SERVER_TLS_INSECURESKIPVERIFY` | Skip verification of server certificate | `false` |
+| `TYK_AGENT_GOVERNANCEDASHBOARD_AUTH_TOKEN` | Authentication token for the agent | - |
+| `TYK_AGENT_HEALTHPROBE_SERVER_PORT` | Port for health probe server | `5959` |
+
+### gRPC Connection Variables (New in v0.2)
+
+| Environment Variable | Description | Default Value |
+| :--------------------- | :------------- | :--------------- |
+|`TYK_AGENT_RPC_KEEPALIVE_ENABLED`|Enables/disables keepalive|`true`|
+|`TYK_AGENT_RPC_KEEPALIVE_TIME`|Duration after which ping is sent|`30s`|
+|`TYK_AGENT_RPC_KEEPALIVE_TIMEOUT`|Duration client waits for ping response from the server|`20s`|
+|`TYK_AGENT_RPC_KEEPALIVE_PERMITWITHOUTSTREAM`|Allows sending pings without active streams|`true`|
+
+### Leader Election Variables (New in v0.2)
+
+| Environment Variable | Description | Default Value |
+| :--------------------- | :------------- | :--------------- |
+|`TYK_AGENT_LEADERELECTION_ENABLED`|Enable Kubernetes leader election|`false`|
+|`TYK_AGENT_LEADERELECTION_LEASENAME`|Name of the lease object|`governance-agent-lock`|
+|`TYK_AGENT_LEADERELECTION_LEASENAMESPACE`|Namespace for the lease object|Agent's namespace|
+|`TYK_AGENT_LEADERELECTION_LEASEDURATION`|Duration for lease|`15s`|
+|`TYK_AGENT_LEADERELECTION_RENEWDEADLINE`|Deadline for renewing leadership|`10s`|
+|`TYK_AGENT_LEADERELECTION_RETRYPERIOD`|Period between retry attempts|`2s`|
+
+#### Required Environment Variables for Leader Election
+
+When leader election is enabled, the following environment variables must also be set:
+
+- `POD_NAME`: The name of the pod (used as the identity for leader election)
+- `POD_NAMESPACE`: The namespace of the pod (used for creating the lease object)
+
+These are typically set automatically when deploying with Kubernetes using the downward API:
+
+```yaml
+env:
+  - name: POD_NAME
+    valueFrom:
+      fieldRef:
+        fieldPath: metadata.name
+  - name: POD_NAMESPACE
+    valueFrom:
+      fieldRef:
+        fieldPath: metadata.namespace
+```
+
+## Use Cases
+
+### Multi-Region API Discovery
+
+For organizations with APIs deployed across multiple geographic regions, deploy region-specific agents to efficiently discover and monitor APIs while respecting network boundaries.
+
+**Implementation:**
+
+1. Deploy agents in each region where APIs are hosted
+2. Configure each agent with the appropriate regional API providers
+3. Use descriptive names to identify regional agents
+4. Monitor all agents from the central Governance Hub
+
+**Benefits:**
+
+- Reduced latency for API discovery operations
+- Respect for network boundaries and security zones
+- Improved reliability with region-specific agents
+- Clear organization of APIs by region
+
+### Secure Environment Bridging
+
+For organizations with strict network segmentation, use agents to securely bridge between isolated environments without compromising security boundaries.
+
+**Implementation:**
+
+1. Deploy agents in each network segment
+2. Configure outbound-only connections from agents to the Governance Hub
+3. Use separate agents for production and non-production environments
+4. Implement appropriate network security controls around agent traffic
+
+**Benefits:**
+
+- Maintain network isolation while enabling governance
+- No inbound connections required to sensitive environments
+- Granular control over which APIs are discovered
+- Separation of concerns between environments
+
+### Automated API Lifecycle Tracking
+
+Use scheduled synchronization to automatically track the lifecycle of APIs, including when they're created, updated, or deleted from source providers.
+
+**Implementation:**
+
+1. Configure agents with scheduled synchronization
+2. Set appropriate sync intervals based on change frequency
+3. Use the API Repository to monitor API status
+4. Create reports showing API lifecycle events
+
+**Benefits:**
+
+- Automatic detection of API changes
+- Historical record of API lifecycle events
+- Reduced manual tracking effort
+- Improved visibility into API landscape evolution
+
+## Best Practices and Recommendations
+
+- **Use descriptive agent names** that indicate their purpose and scope
+- **Deploy agents close to API providers** to minimize latency and network issues
+- **Configure appropriate sync intervals** based on how frequently your APIs change
+- **Use leader election for high availability** when deploying multiple agent replicas
+- **Monitor agent health regularly** to ensure continuous API discovery
+- **Rotate API provider credentials periodically** for better security
+- **Use the principle of least privilege** when configuring API provider credentials
+- **Start with manual syncs** before enabling scheduled synchronization
+- **Implement network security controls** around agent traffic
+- **Maintain agent versions** to ensure compatibility with the Governance Hub
+
+## FAQs
+
+<AccordionGroup>
+<Accordion title='How many agents do I need?'>
+The number of agents depends on your API landscape. Generally, you should consider deploying separate agents for:
+
+- Different network segments or security zones
+- Different geographic regions
+- Different environments (production vs. non-production)
+- Different API provider types with many APIs
+
+A single agent can connect to multiple API providers of different types, so you don't necessarily need one agent per provider.
+</Accordion>
+
+<Accordion title='What happens if an agent goes offline?'>
+If an agent goes offline, it will be marked as "INACTIVE" in the Governance Hub after missing several heartbeats. APIs discovered by that agent will remain in the repository but won't be updated until the agent reconnects or another agent is configured to find out the same APIs.
+
+When using high availability with leader election, if the leader agent goes offline, another replica will automatically take over the leadership role and continue synchronization operations.
+</Accordion>
+
+<Accordion title='How secure is the agent-to-hub communication?'>
+All communication between agents and the Governance Hub is secured using:
+
+- TLS encryption for all traffic
+- JWT token-based authentication
+- Regular token validation
+- Bidirectional stream validation
+
+The agent only requires outbound connectivity to the Governance Hub, with no inbound connections required.
+</Accordion>
+
+<Accordion title='What permissions do agents need for API providers?'>
+Agents require read-only access to API configurations:
+
+- For Tyk Dashboard: An API key with read access to APIs and policies
+- For AWS API Gateway: IAM credentials with permissions to list and get API Gateway resources
+- For other providers: Similar read-only access to API configurations
+
+The agent never requires write access to API providers.
+</Accordion>
+</AccordionGroup>
+
+## Troubleshooting
+
+<AccordionGroup>
+<Accordion title='Agent shows as "INACTIVE"'>
+- Check if the agent process is running
+- Verify network connectivity to the Governance Hub
+- Ensure the agent token is valid and not expired
+- Check agent logs for connection errors
+- Verify the Governance Hub URL is correct
+- Ensure the agent has outbound access to the hub's gRPC port. It is usually 50051 for self-managed instances. For Tyk Cloud managed instance, it is proxied through port 443.
+</Accordion>
+
+<Accordion title='Agent connects but no APIs are discovered'>
+- Verify API provider credentials are correct
+- Check agent logs for provider connection errors
+- Ensure the provider has APIs configured
+- Try triggering a manual sync operation
+- Check agent configuration for correct provider URLs
+- Verify the agent has network access to the API providers
+</Accordion>
+
+<Accordion title='Multiple agents running when using leader election'>
+- Verify leader election is properly configured
+- Check if agents are in the same Kubernetes namespace
+- Ensure agents are using the same lock name
+- Check Kubernetes permissions for leader election
+- Verify Kubernetes API access from agent pods
+- Check agent logs for leader election messages
+</Accordion>
+
+<Accordion title='Scheduled sync not working'>
+- Ensure the agent has been running long enough for a scheduled sync
+- Check agent logs for scheduled sync messages
+- Try restarting the agent to reset the schedule
+- Verify the agent is the leader if using leader election
+</Accordion>
+</AccordionGroup>
+
diff --git a/tyk-governance/api-evaluation.mdx b/tyk-governance/api-evaluation.mdx
new file mode 100644
index 0000000000..8b4c8ec136
--- /dev/null
+++ b/tyk-governance/api-evaluation.mdx
@@ -0,0 +1,343 @@
+---
+title: "API Evaluation"
+description: "Validate API specifications against governance policies before deployment to catch compliance issues early in the development lifecycle and reduce rework."
+keywords: "Tyk Governance, API Evaluation, Rulesets, API Validation, Shift-Left Governance"
+sidebarTitle: "API Evaluation"
+---
+
+## Availability
+
+- Version: Available since v0.2
+
+## Overview
+
+API Evaluation enables you to validate API specifications against governance policies before deployment, without requiring the API to be published or stored in your API Repository. This feature helps you catch compliance issues early in the development lifecycle, reducing rework and accelerating the delivery of high-quality APIs.
+
+### Key Benefits
+
+- **Shift-Left Governance**: Catch compliance issues during design and development, not after deployment
+- **Reduce Development Cycles**: Identify and fix issues before they reach code review or testing phases
+- **Seamless Integration**: Easily incorporate governance checks into CI/CD pipelines and development workflows
+- **Detailed Feedback**: Receive precise information about violations with line numbers and remediation guidance
+- **No Storage Required**: Validate API specifications without storing them in your API Repository
+
+### Dependencies
+
+- Requires Tyk Governance v0.2 or higher
+- Requires at least one governance ruleset to be defined
+
+## Quick Start
+
+In this tutorial, we'll validate an API specification against a governance ruleset before deployment.
+
+### Prerequisites
+
+- Access to Tyk Governance Hub
+- A governance ruleset ID
+- An API specification to validate (in OpenAPI format)
+
+### Step-by-Step
+
+1. **Identify Your Ruleset**
+
+    Navigate to the Rulesets section in your Tyk Governance dashboard and note the ID of the ruleset you want to use for validation.
+
+2. **Prepare Your API Specification**
+
+    Ensure your API specification is in a valid OpenAPI format (JSON or YAML).
+
+3. **Make an API Request**
+
+    Use the API Evaluation endpoint to validate your specification:
+
+    ```sh
+    curl -X POST https://your-governance-instance.tyk.io/api/rulesets/evaluate-spec \
+    -H "Content-Type: application/json" \
+    -H "X-API-Key: YOUR_API_KEY" \
+    -d '{
+        "rulesetId": "$RULESET_ID",
+        "apiSpec": {
+          "name": "My Test API",
+          "content": {
+            "openapi": "3.0.0",
+            "info": {
+              "title": "Test API",
+              "version": "1.0.0"
+            },
+            "paths": {
+              "/example": {
+                "get": {
+                  "responses": {
+                    "200": {
+                      "description": "OK"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+    }'
+    ```
+
+4. **Review the Results**
+
+    The response will include any violations found, with details about each issue:
+
+    ```json
+    {
+        "status": "Success",
+        "message": "Rule violation found",
+        "errors": [
+            {
+                "code": "info-contact",
+                "path": ["info"],
+                "message": "API must have contact information",
+                "severity": "error",
+                "range": {
+                    "start": { "line": 3, "character": 2 },
+                    "end": { "line": 6, "character": 3 }
+                },
+                "howToFix": "Add contact information to the info section"
+            }
+        ]
+    }
+    ```
+
+    If there are no violations found:
+
+    ```json
+    {
+      "status" : "Success",
+      "message" : "No rule violation found",
+      "errors":[]
+    }
+    ```
+
+### Validation
+
+- A successful request with no violations will return an empty errors array
+- If violations are found, each will include:
+    - The rule code that was violated
+    - The path in the API specification where the violation occurred
+    - A message explaining the issue
+    - The severity level (error, warning, info, hint)
+    - The exact location in the file (line and character)
+    - Guidance on how to fix the issue (if available)
+
+## How It Works
+
+API Evaluation works by sending your API specification to the Tyk Governance Hub, where it's validated against a specified ruleset without being stored in your API Repository. The system applies each rule in the ruleset to your specification and returns detailed results.
+
+### Integration into Development Workflow
+
+#### Integrating with CI/CD Pipelines
+
+API Evaluation can be integrated into your CI/CD pipeline to validate API specifications before they're deployed automatically. This ensures that only compliant APIs make it to production.
+
+```yaml
+# Example GitHub Actions workflow
+name: API Governance Check
+
+on:
+  pull_request:
+    paths:
+      - 'api-specs/**'
+
+jobs:
+  validate-api:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      
+      - name: Validate API Specification
+        run: |
+          SPEC_CONTENT=$(cat api-specs/my-api.yaml | awk '{printf "%s\\n", $0}')
+          curl -X POST https://your-governance-instance.tyk.io/api/rulesets/evaluate-spec \
+            -H "Content-Type: application/json" \
+            -H "X-API-Key: ${{ secrets.GOVERNANCE_API_KEY }}" \
+            -d "{
+              \"rulesetId\": \"your-ruleset-id\",
+              \"apiSpec\": {
+                \"name\": \"My API\",
+                \"content\": \"$SPEC_CONTENT\"
+              }
+            }" > validation-results.json
+            
+          # Fail if any errors are found
+          ERROR_COUNT=$(jq '.errors | length' validation-results.json)
+          if [ $ERROR_COUNT -gt 0 ]; then
+            echo "API validation failed with $ERROR_COUNT issues:"
+            jq '.errors' validation-results.json
+            exit 1
+          fi
+
+```
+
+#### Pre-commit Validation
+
+Developers can validate their API specifications before committing changes, ensuring they meet governance standards from the start.
+
+```bash
+#!/bin/bash
+# pre-commit hook for API validation
+
+# Get the API specification file
+SPEC_FILE=$(git diff --cached --name-only | grep -E '\.json$|\.yaml$|\.yml$' | head -1)
+
+if [ -n "$SPEC_FILE" ]; then
+  echo "Validating API specification: $SPEC_FILE"
+  
+  # Convert the file content to JSON
+  if [[ $SPEC_FILE == *.yaml || $SPEC_FILE == *.yml ]]; then
+    SPEC_CONTENT=$(yq eval -o=json $SPEC_FILE)
+  else
+    SPEC_CONTENT=$(cat $SPEC_FILE)
+  fi
+  
+  # Validate the specification
+  RESPONSE=$(curl -s -X POST https://your-governance-instance.tyk.io/api/rulesets/evaluate-spec \
+    -H "Content-Type: application/json" \
+    -H "X-API-Key: YOUR_API_KEY" \
+    -d "{
+      \"rulesetId\": \"your-ruleset-id\",
+      \"apiSpec\": {
+        \"name\": \"$(basename $SPEC_FILE)\",
+        \"content\": $SPEC_CONTENT
+      }
+    }")
+  
+  # Check for errors
+  ERROR_COUNT=$(echo $RESPONSE | jq '.errors | length')
+  if [ $ERROR_COUNT -gt 0 ]; then
+    echo "API validation failed with $ERROR_COUNT issues:"
+    echo $RESPONSE | jq '.errors'
+    exit 1
+  fi
+  
+  echo "API specification is valid!"
+fi
+
+exit 0
+```
+
+## Use Cases
+
+### Validating APIs During Design Phase
+
+Integrate API Evaluation with design tools to validate specifications during the design phase, before any code is written.
+
+**Benefits**:
+
+- Catch issues at the earliest possible stage
+- Reduce rework and development cycles
+- Ensure designs align with governance standards from the start
+
+**Implementation**:
+
+1. Design an API in your preferred tool
+2. Export the OpenAPI specification
+3. Validate using the API Evaluation endpoint
+4. Review and address any issues
+5. Repeat until the specification passes validation
+
+### Automated Testing in Development Workflows
+
+Incorporate API Evaluation into automated testing workflows to ensure continuous compliance during development.
+
+**Benefits**:
+
+- Maintain compliance throughout the development process
+- Prevent regression of governance standards
+- Provide immediate feedback to developers
+
+**Implementation**:
+
+1. Add API validation as a step in your testing pipeline
+2. Run validation after any changes to the API specification
+3. Fail the build if critical violations are found
+4. Generate reports of issues for developers to address
+
+### Pre-release Validation Gate
+
+Use API Evaluation as a final check before releasing APIs to production or external consumers.
+
+**Benefits**:
+
+- Ensure only compliant APIs are released
+- Maintain consistent quality standards
+- Reduce security and compliance risks
+
+**Implementation**:
+
+1. Add a validation step in your release pipeline
+2. Block releases with critical violations
+3. Generate compliance reports for audit purposes
+4. Track compliance metrics over time
+
+## Best Practices and Recommendations
+
+- **Integrate early in development**: Validate specifications before coding begins to avoid costly rework
+- **Use appropriate rulesets**: Select rulesets that match the API's purpose and criticality
+- **Automate validation**: Incorporate validation into CI/CD pipelines and development workflows
+- **Review results carefully**: Understand the context of each violation before fixing
+- **Prioritize by severity**: Address errors first, then warnings, then informational issues
+- **Track compliance trends**: Monitor how compliance improves over time
+- **Update specifications incrementally**: Fix critical issues first, then address less severe ones
+- **Document exceptions**: When a rule violation is intentional, document the reason
+- **Provide feedback on rules**: Help improve governance rules that generate false positives
+- **Use with other governance tools**: Combine with API Repository and Ruleset Management for comprehensive governance
+
+## FAQs
+
+<AccordionGroup>
+<Accordion title='Can I validate multiple API specifications at once?'>
+The `/rulesets/evaluate-spec` endpoint is designed for validating a single API specification. For batch validation of multiple specifications, you can make multiple requests or use the `/rulesets/evaluate` endpoint if the APIs are already in your API Repository.
+</Accordion>
+
+<Accordion title='What API specification formats are supported?'>
+Currently, the API Evaluation feature supports OpenAPI 3.x specifications in both JSON and YAML formats. Support for additional formats is planned for future releases.
+</Accordion>
+
+<Accordion title='Is there a size limit for API specifications?'>
+Yes, there's a 10MB limit on the size of API specifications that can be evaluated. For very large specifications, we recommend breaking them into smaller, more manageable components.
+</Accordion>
+
+<Accordion title='Are evaluated specifications stored in Tyk Governance?'>
+No, specifications submitted through the API Evaluation endpoint are not stored in your API Repository. They are processed in memory and then discarded, making this feature suitable for validating sensitive or in-development APIs.
+</Accordion>
+</AccordionGroup>
+
+## Troubleshooting
+
+<AccordionGroup>
+<Accordion title='Receiving "Invalid request format" error'>
+- Ensure your request body follows the correct JSON format
+- Verify that the `content` field contains a valid OpenAPI specification
+
+- Check for JSON syntax errors in your request
+- Make sure the  `rulesetId` is valid and exists in your Governance Hub
+</Accordion>
+
+<Accordion title='Evaluation taking too long or timing out'>
+- Reduce the size and complexity of your API specification
+- Ensure your ruleset doesn't contain overly complex rules
+- Break large specifications into smaller components
+- Check network connectivity between your client and the Governance Hub
+</Accordion>
+
+<Accordion title='Results show unexpected violations'>
+- Review the ruleset being used for evaluation
+- Check the specific rule that's generating the violation
+- Verify your API specification against the OpenAPI specification
+- Consider if the rule needs adjustment for your specific use case
+</Accordion>
+
+<Accordion title='Authentication failures'>
+- Verify your API key is valid and has not expired
+- Ensure you're including the API key in the correct header ( `X-API-Key` )
+- Check that your user account has permission to access the API Evaluation feature
+- Verify you're using the correct Governance Hub URL
+</Accordion>
+</AccordionGroup>
+
diff --git a/tyk-governance/api-labeling.mdx b/tyk-governance/api-labeling.mdx
new file mode 100644
index 0000000000..f53c816d85
--- /dev/null
+++ b/tyk-governance/api-labeling.mdx
@@ -0,0 +1,178 @@
+---
+title: "API Labeling and Categorization"
+description: "Organize, classify, and filter your APIs using customizable metadata tags to create a structured taxonomy for your API landscape."
+keywords: "Tyk Governance, API Labeling, API Categorization, API Metadata, API Organization"
+sidebarTitle: "API Labeling and Categorization"
+---
+
+## Availability
+
+- Version: Available since v0.1
+
+## Overview
+
+API Labeling and Categorization enables you to organize, classify, and filter your APIs using customizable metadata tags. This feature allows you to create a structured taxonomy for your API landscape, making it easier to search, filter, and apply governance policies based on business context, technical characteristics, or organizational ownership.
+
+### Key Benefits
+
+- Enables structured organization of APIs by business domain, criticality, and other dimensions
+- Facilitates efficient search and filtering of APIs in large inventories
+- Provides consistent metadata across APIs from different sources
+- Supports governance policy application based on API characteristics (Governance Policy feature is coming soon)
+- Enables reporting and analytics based on business context (Reporting feature is coming soon)
+
+## Quick Start
+
+In this tutorial, we'll explore how to use API labeling to categorize and filter APIs in your organization's API Repository.
+
+### Prerequisites
+
+- Access to the Tyk Governance Hub
+- Governance Admin access for creating new label definitions (Note: only admin access is available at the moment)
+
+### Step-by-Step
+
+1. **Access the API Repository**
+
+    Navigate to the API Repository section in your Tyk Governance dashboard.
+
+2. **Explore Default Labels**
+
+    Tyk Governance comes with pre-configured default labels such as "Business Domain" and "API Criticality".
+
+3. **Apply Labels to APIs**
+
+    Select an API and click "Edit" to apply or modify labels:
+
+    - Set "Business Domain" to an appropriate value (e.g., "Finance", "Customer", "Product")
+    - Assign "API Criticality" based on the API's importance (Tier 1 for mission-critical, Tier 2 for important, Tier 3 for non-critical)
+    - Add any custom labels that your Governance Admin has defined
+
+4. **Filter APIs Using Labels**
+
+    Use the search and filter functionality to find APIs based on their labels:
+
+    - Filter to show only Tier 1 APIs
+    - Search for APIs in a specific business domain
+    - Combine multiple label filters for precise results
+
+5. **Create a Custom Label (Admin only)**
+
+    Governance Admin users can create custom labels programmatically using the API:
+
+    Example using cURL:
+
+    ```bash
+    curl -X POST https://your-governance-instance.tyk.io/api/labels/ \
+    -H "Content-Type: application/json" \
+    -H "X-API-Key: YOUR_ADMIN_TOKEN" \
+    -d '{
+        "name": "compliance",
+        "values": ["PCI-DSS", "GDPR", "HIPAA"]
+    }'
+    ```
+
+    A successful request will return a 200 OK status code and the newly created label object:
+
+    ```json
+    {
+    "id": "64a1b2c3d4e5f6a7b8c9d0e1",
+    "name": "compliance",
+    "values": ["PCI-DSS", "GDPR", "HIPAA"]
+    }
+    ```
+
+    **Notes**:
+    - The name field is required and must be unique
+    - The values field is optional. If provided, it defines the allowed values for this label
+    - If values is empty, the label will accept any value (free text)
+    - Only users with admin privileges can create labels
+    - Once created, labels can be applied to APIs using the `/api/{api-id}/labels` endpoint
+    - After creating a custom label, it will be available for selection when labeling APIs, either through the UI or via the API labeling endpoints
+
+### Validation
+
+- Labeled APIs will display their labels in the API details view
+- Filtering by labels will show only matching APIs
+- New custom labels will be available for application to APIs
+
+## How It Works
+
+API Labeling and Categorization works through a flexible key-value metadata system that allows both structured and free-form classification of APIs.
+
+### Labeling System Architecture
+
+1. **Bootstrap Default Labels**: During initial setup, Tyk Governance creates default label definitions such as "Business Domain" and "API Criticality"
+2. **Label Definition**: Each label has:
+    - A unique key (e.g., "business_domain")
+    - A display name (e.g., "Business Domain")
+    - A value type (free text or predefined values)
+    - Optional predefined values (e.g., "Finance", "HR", "Operations")
+
+3. **Label Application**: Labels are applied to APIs as key-value pairs:
+    - Key: The label identifier (e.g., "business_domain")
+    - Value: The specific value for this API (e.g., "Finance")
+
+4. **Label Storage**: Labels are stored as metadata with each API in the repository database
+5. **Search and Filter**: Tyk Governance indexes labels to enable efficient filtering and searching
+
+## Use Cases
+
+### Governance Policy Application
+
+Apply different governance rules based on API criticality tiers. For example, Tier 1 (mission-critical) APIs might require stricter security controls, more thorough documentation, and formal change management processes.
+
+### Compliance Management
+
+Tag APIs with relevant compliance requirements (PCI-DSS, GDPR, HIPAA) to ensure appropriate controls are applied and to facilitate compliance reporting and audits.
+
+### Team Ownership and Responsibility
+
+Label APIs by owning team or department to clarify responsibility for maintenance, support, and governance compliance.
+
+### API Lifecycle Management
+
+Use labels to indicate lifecycle stage (Development, Testing, Production, Deprecated) to manage API transitions and communicate status to consumers.
+
+## Best Practices and Recommendations
+
+- **Establish a clear labeling taxonomy** before implementing across your organization
+- **Keep predefined value lists manageable** – too many options create confusion and inconsistency
+- **Use hierarchical naming for related labels** (e.g., security.authentication.method, security.data.classification)
+- **Document the meaning and intended use** of each label for consistent application
+- **Assign label management responsibility** to a specific role or team to maintain consistency
+- **Review and update labels periodically** to ensure they remain relevant as your API landscape evolves
+- **Include label application in API onboarding workflows** to ensure consistent metadata from the start
+- **Use consistent labeling conventions** across all APIs to facilitate effective filtering and governance
+- **Combine multiple labels in filters** for more precise API discovery
+- **Use criticality and domain labels** as the foundation of your governance strategy
+
+## FAQs
+
+<AccordionGroup>
+<Accordion title='Can I create custom labels with my predefined values?'>
+Yes, Governance Administrators can create custom labels with either free text values or a predefined list of acceptable values.
+</Accordion>
+
+<Accordion title='How do labels differ from tags?'>
+Labels are structured key-value pairs that can be validated and used for governance, while tags are typically simpler, unstructured text values mainly used for search.
+</Accordion>
+
+<Accordion title='Are labels from source systems preserved during discovery?'>
+Yes, the discovery process attempts to map source system metadata to corresponding labels in the governance hub where possible.
+</Accordion>
+</AccordionGroup> 
+
+## Troubleshooting
+
+<Expandable title='Labels not appearing in filter options'>
+- Ensure a Governance Admin has properly defined the label  
+- Check that at least one API has been tagged with this label  
+- Refresh the browser cache if the label was recently added
+</Expandable> 
+
+<Expandable title='Cannot add a specific label value'>
+- For predefined value labels, check that the value you're trying to add is in the allowed list  
+- Verify you have sufficient permissions to modify the API's labels  
+- Ensure the label hasn't been deprecated or replaced
+</Expandable> 
diff --git a/tyk-governance/api-repository.mdx b/tyk-governance/api-repository.mdx
new file mode 100644
index 0000000000..77bcf3be91
--- /dev/null
+++ b/tyk-governance/api-repository.mdx
@@ -0,0 +1,130 @@
+---
+title: "API Repository"
+description: "Learn how Tyk Governance automatically discovers and catalogs APIs across multiple sources to create a comprehensive inventory of all APIs in your organization."
+keywords: "Tyk Governance, API Repository, API Discovery, API Inventory"
+sidebarTitle: "Federated API Repository"
+---
+
+## Availability
+
+- Version: Available since v0.1
+
+## Overview
+
+API Repository automatically discovers and catalogs APIs across multiple sources (Tyk, AWS API Gateway, etc) to create a comprehensive inventory of all APIs in your organization. This feature addresses API sprawl, identifies shadow APIs, and provides complete visibility into your API landscape.
+
+### Key Benefits
+
+- Creates a single source of truth for all APIs across the organization
+- Identifies security risks from undocumented or unmanaged APIs
+- Enables better resource management and prevents duplication
+- Provides visibility into API ownership and usage patterns
+
+### Dependencies
+
+- Requires the governance agent for API discovery from non-Tyk Cloud-managed control planes and non-Tyk platforms.
+
+## Quick Start
+
+In this tutorial, we'll explore how to use the API Repository to view and manage discovered APIs in your organization.
+
+### Prerequisites
+
+- Access to the Tyk Governance Hub
+- Governance agent deployed and connected to your API providers (non Tyk Cloud sources only)
+
+For detailed installation and configuration instructions, please refer to the [Installation and Setup](/tyk-governance/installation) page.
+
+### Step-by-Step
+
+1. **Access the API Repository**
+
+     Navigate to the API Repository section in your Tyk Governance Hub to view discovered APIs.
+
+2. **Explore the API inventory**
+
+     The dashboard provides a comprehensive view of all discovered APIs across your organization, with filtering and search capabilities.
+
+     <img src="/img/governance/api-list.png" alt="" />
+
+3. **Examine API details**
+
+     Click on any API to view detailed information, including specifications, ownership, authentication methods, and governance status.
+
+     <img src="/img/governance/api-details.png" alt="" />
+
+## How It Works
+
+The API Repository works by deploying agents that connect to various API sources, extract metadata, and synchronize this information with the central governance hub. Think of it as an automated API census that continuously updates your API inventory.
+
+### Discovery Process
+
+1. **Agent Deployment**: Agents are deployed to connect with various API sources.
+2. **API Source Connection**: Agents authenticate and connect to configured API sources.
+3. **Metadata Extraction**: Agents extract API metadata including routes, authentication methods, and specifications.
+4. **Synchronization**: Extracted data is sent to the governance hub through secure gRPC streams.
+5. **Inventory Creation**: APIs are cataloged in a centralized repository with relevant metadata.
+6. **Classification**: APIs can be tagged and categorized based on extracted and custom metadata.
+7. **Continuous Updates**: Regular scans maintain an up-to-date inventory and identify changes.
+
+## Use Cases
+
+### Centralizing API Inventory Across Multiple Gateways
+
+When your organization uses multiple API gateways (Tyk, AWS, etc.), maintaining a single view of all APIs becomes challenging. API Discovery automatically aggregates APIs from all sources into a unified inventory, providing a complete picture of your API landscape without manual tracking.
+
+### Identifying and Managing Shadow APIs
+
+Shadow APIs—those created outside official processes—pose security and governance risks. The discovery feature continuously scans your infrastructure to identify undocumented APIs, allowing you to bring them under governance or decommission them as appropriate.
+
+### Streamlining API Onboarding with Automated Discovery
+
+For organizations with numerous APIs, manual registration is time-consuming and prone to errors. Automated discovery accelerates the onboarding process by automatically detecting new APIs and pre-populating their metadata, thereby reducing the time required to bring APIs under governance.
+
+### Tracking API Changes for Compliance and Audit
+
+When APIs change without proper documentation, it creates compliance risks. The continuous discovery process detects changes to existing APIs, maintaining an accurate, up-to-date inventory that serves as an audit trail for compliance purposes.
+
+### Enabling API Reuse Through Comprehensive Cataloging
+
+Developers often recreate APIs because they're unaware of existing ones. A complete API inventory with rich metadata enables developers to discover and reuse existing APIs, reducing duplication and development costs.
+
+## Best Practices and Recommendations
+
+- **Configure all relevant API sources** to ensure complete coverage of your API landscape
+- **Implement a review process** for newly discovered APIs to ensure proper classification and ownership assignment
+- **Integrate discovery with your CI/CD pipeline** to synchronize new APIs as they're deployed automatically
+- **Establish clear ownership** for each API to ensure accountability for governance and maintenance
+
+## FAQs
+
+<Expandable title='How secure is the API discovery process?'>
+The discovery process uses secure authentication methods for each provider and transmits data via encrypted channels. The agent requires minimal permissions—just enough to read API configurations.
+</Expandable> 
+
+<Expandable title='Will discovery impact the performance of my API gateways?'>
+The discovery process is designed to be lightweight and non-intrusive, primarily reading configuration data rather than analyzing traffic, thereby minimizing any performance impact.
+</Expandable>
+
+## Troubleshooting
+
+<AccordionGroup>
+<Accordion title="APIs from a specific source aren't being discovered">
+- Check the agent logs for authentication errors  
+- Verify the provider configuration in the governance agent config  
+- Ensure the agent has network access to the API source
+</Accordion>
+
+<Accordion title='Discovered APIs are missing metadata'>
+- Some API sources may not expose all metadata  
+- Check if the API definition in the source is complete  
+- Consider enhancing the API definition at the source
+</Accordion>
+
+<Accordion title='Agent fails to connect to the governance hub'>
+- Verify the governance URL and token in the agent configuration  
+- Check network connectivity between the agent and governance hub  
+- Examine the agent logs for specific connection errors
+</Accordion>
+</AccordionGroup>
+
diff --git a/tyk-governance/core-concepts.mdx b/tyk-governance/core-concepts.mdx
new file mode 100644
index 0000000000..5a961d2cc1
--- /dev/null
+++ b/tyk-governance/core-concepts.mdx
@@ -0,0 +1,278 @@
+---
+title: "Core Concepts"
+description: "Detailed explanation of key technical concepts that form the foundation of Tyk Governance, including federated API management, governance rulesets, and the technical architecture."
+keywords: "Tyk Governance, API Governance, Federated API Management, Governance Concepts"
+sidebarTitle: "Core Concepts"
+---
+
+This section provides a detailed explanation of the key technical concepts that form the foundation of Tyk Governance.
+
+## What is Tyk Governance?
+
+Tyk Governance is a comprehensive API Governance Hub designed to provide centralized visibility, control, and policy enforcement across distributed API ecosystems. It enables organizations to establish and maintain consistent standards, security practices, and compliance requirements across multiple API gateways and management platforms.
+
+At its core, Tyk Governance is a federated control plane that sits above your existing API infrastructure, regardless of whether you're using Tyk exclusively or a mix of different API management solutions. It collects, analyzes, and governs API definitions from various sources, ensuring they adhere to your organization's standards and best practices.
+
+<img src="/img/governance/architecture.png" alt="Tyk API Governance Architecture" />
+
+## Federated API Management
+
+Federated API management refers to the practice of managing APIs across multiple, distributed platforms while maintaining consistent governance, visibility, and control.
+
+Organizations struggle with API sprawl, with many lacking visibility into their total number of APIs. Multiple gateways across teams create security vulnerabilities, governance gaps, and inefficiency. This "API debt" results in inconsistent security protocols, missed reuse opportunities, and increased risk from shadow APIs. Large enterprises need a solution that balances centralized governance with team autonomy—enabling visibility across different gateways while allowing teams to use their preferred tools. The ideal approach provides unified oversight without forcing consolidation, ensuring compliance while preserving innovation and operational independence.
+
+### Tyk Governance Solutions
+
+Tyk Governance addresses these challenges through:
+
+1. **Unified API Repository**: A central inventory of all APIs across different providers.
+2. **Cross-Platform Policy Enforcement**: Consistent application of governance policies regardless of the underlying API provider.
+3. **Automated Compliance Checking**: Continuous validation of APIs against organizational standards and regulatory requirements.
+4. **Maturity Assessment**: Evaluation and scoring of APIs based on design, security, documentation, and performance criteria.
+5. **Centralized Reporting**: Comprehensive visibility into API compliance and governance status.
+
+## Governance Rulesets
+
+A governance ruleset in Tyk Governance is a set of rules and standards that APIs must adhere to. These rulesets define the requirements for API design, security, documentation, and operational characteristics.
+
+### Ruleset Components
+
+1. **Rules**: Individual checks that validate specific aspects of an API definition.
+2. **Severity Levels**: Categorization of rules by importance (error, warning, info).
+3. **Validation Functions**: The specific logic used to evaluate API definitions against rules.
+4. **Remediation Guidance**: Instructions on how to fix issues when rules are violated.
+
+### Spectral Ruleset Compatibility
+
+Tyk Governance rulesets are compatible with the [Spectral ruleset](https://meta.stoplight.io/docs/spectral/01baf06bdd05a-rulesets) format, a widely adopted API linting and governance standard. This compatibility offers several advantages:
+
+1. **Familiar Format**: Teams already using Spectral can easily migrate their existing rulesets.
+2. **Ecosystem Integration**: Leverage the broader ecosystem of pre-built Spectral rules.
+3. **Extensibility**: Create custom rules using the same format and functions as Spectral.
+4. **IDE Integration**: Use existing Spectral plugins for popular code editors.
+
+The Spectral-compatible format allows for declarative rule definitions with given/then patterns, custom functions, and detailed error messaging.
+
+### Basic Ruleset Examples
+
+```yaml
+# Security ruleset requiring HTTPS
+owasp-security-hosts-https-oas3:
+  description: All server interactions MUST use the https protocol
+  severity: error
+  then:
+    function: owaspHostsHttps
+
+# Rate limiting ruleset
+rate-limit-exists:
+  description: Ensure rateLimit exists under upstream
+  severity: error
+  given: "$['x-tyk-api-gateway'].upstream"
+  then:
+    - field: rateLimit
+      function: truthy
+```
+
+Rulesets can be customized to meet organizational needs and evolve as API best practices and security requirements change.
+
+## Supported API Providers
+
+Tyk Governance is designed to work with a wide range of API management platforms, allowing organizations to maintain governance regardless of their existing API infrastructure.
+
+### API Provider Compatibility
+
+| API Provider        | Tested Version | Supported API Types | Supported Features                      |
+| :--------------- | :-------------- | :------------- | :------------------------------------------------- |
+| Tyk Dashboard   | 5.3+           | Tyk OAS       | Complete integration with all governance features |
+| AWS API Gateway | All            | Rest APIs     | API definition export, OAS schema export          |
+| Azure | -            | -     | Coming Soon          |
+| Kong  | -            | -     | Coming Soon          |
+| WSO2  | -            | -     | Coming Soon          |
+
+### Integration Capabilities
+
+Tyk Governance integrates with these providers through specialized agents that:
+
+1. Connect to the platform's management APIs
+2. Extract API definitions and configurations
+3. Convert proprietary formats to OpenAPI Specification (OAS)
+4. Apply Tyk-specific extensions where applicable
+5. Synchronize definitions with the central governance repository
+
+### Future API Provider Support
+
+The Tyk Governance roadmap includes plans to expand support to additional platforms and API Types.
+
+## How It Works
+
+Tyk Governance operates through a distributed architecture that combines a centralized cloud-hosted governance service with distributed agents that run in your environments.
+
+<img src="/img/governance/automated-governance.png" alt="How Tyk API Governance Works" />
+
+### Technical Architecture
+
+```mermaid
+flowchart LR
+    subgraph "Tyk Cloud"
+        GS["Governance Service"] --- DB[(Database)]
+        GS --- RE["Rule Engine"]
+        GS <--> A4["Agent 4"] --- P4["Cloud Control Plane"]
+    end
+    
+    subgraph "Customer Environment"
+        A1["Agent 1"] --- P1["Tyk Dashboard (Self-Managed)"]
+        A2["Agent 2"] --- P2["AWS API Gateway"]
+    end
+    
+    A1 <-->|"TLS + Auth"| GS
+    A2 <-->|"TLS + Auth"| GS
+```
+
+### Hosted Service Model
+
+The Governance Core is a Tyk Cloud hosted and managed service, providing several benefits:
+
+1. **Zero Infrastructure Overhead**: No need to deploy and maintain governance infrastructure.
+2. **Automatic Updates**: Always access the latest features and security patches.
+3. **Scalable Performance**: Handles growing API ecosystems without additional configuration.
+4. **High Availability**: Built-in redundancy and failover capabilities.
+
+### Customer-Hosted Agents
+
+While the core service is cloud-hosted, customers can host their own agents within their environments:
+
+1. **Credential Isolation**: Tyk Governance never directly accesses your API providers; all credentials remain within your environment.
+2. **Network Security**: The agent requires accepting inbound traffic from the cloud-based governance dashboard. All communication between agents and the dashboard is secured via TLS encryption.
+3. **Deployment Flexibility**: Deploy agents in any environment where they can access your API platforms.
+4. **Lightweight Footprint**: Agents have minimal resource requirements and can run in containers or VMs.
+
+### Process Sequence
+
+```mermaid
+sequenceDiagram
+    participant Agent
+    participant Governance
+    participant RuleEngine
+    
+    Agent->>Governance: Register with governance hub
+    Governance->>Agent: Issue authentication token
+    Governance->>Agent: Send sync request
+    Agent->>Agent: Get APIs from API providers
+    Agent->>Governance: Stream API definitions
+    Governance->>Governance: Store in repository
+    Governance->>RuleEngine: Validate against rules
+    RuleEngine->>Governance: Return validation results
+    Governance->>Governance: Generate reports
+```
+
+### Synchronization Mechanisms
+
+Tyk Governance uses a secure bidirectional streaming protocol for efficient synchronization:
+
+1. **Registration**: Agents register with the Governance Hub and establish a secure connection.
+2. **Heartbeat**: Agents maintain a health check stream to indicate their status.
+3. **Sync Request**: The Governance Hub can trigger a sync operation on demand or on schedule.
+4. **Streaming Response**: Agents stream API definitions back to the governance hub as they are extracted.
+5. **Incremental Updates**: Only changed APIs are synchronized to minimize network traffic.
+
+### Security Measures
+
+The synchronization between agents and the Governance service includes multiple security layers:
+
+1. **TLS Encryption**: All communications are encrypted using TLS 1.2+ to prevent eavesdropping.
+2. **Authentication Tokens**: Agents authenticate using secure tokens that can be rotated and revoked.
+3. **Minimal Privilege**: Agents use read-only access to API platforms whenever possible.
+4. **Data Minimization**: Only API definitions and metadata are transmitted, not actual API traffic or payloads.
+5. **Audit Logging**: All synchronization activities are logged for security monitoring.
+
+### Data Exchange
+
+The information exchanged between agents and the Governance service includes:
+
+1. **From Agent to Governance**:
+	- API definitions in OpenAPI format
+	- API metadata (name, version, endpoints, security schemes)
+	- Provider-specific configuration converted to standard formats
+	- Agent status and capability information
+	- Sync operation status and results
+
+2. **From Governance to Agent**:
+	- Sync requests and configuration
+	- Authentication tokens and renewal information
+
+Notably, the following are NOT transmitted:
+
+- API keys or credentials for accessing APIs
+- Actual API request/response payloads
+- Customer data processed by APIs
+- Internal network information beyond what's in API definitions
+
+## Glossary of Terms
+
+### Agent
+
+A component that connects to API Providers (Tyk, AWS API Gateway, etc.) to extract and sync API definitions.
+
+### API Maturity
+
+A measure of how well an API adheres to best practices in design, security, documentation, and performance.
+
+### API Provider
+
+A system or platform where APIs are hosted or managed, which Tyk Governance can discover and monitor. Examples include Tyk Dashboard and AWS API Gateway.
+
+### API Repository
+
+A federated catalog that aggregates APIs from multiple API providers, providing a centralized view of all APIs within an organization.
+
+### Federated API Management
+
+An approach to managing APIs across multiple platforms and environments while maintaining centralized governance.
+
+### Label
+
+A key-value pair assigned to APIs or API providers for categorization and governance purposes. Examples include `domain:storefront`, `environment:production`, or `pii:true`.
+
+### Ruleset
+
+A collection of governance rules that can be applied to APIs to enforce best practices and compliance requirements.
+
+### Rule
+
+A specific condition that can be evaluated against APIs to ensure they meet governance standards. Rules include severity levels, messages, and descriptions.
+
+### Ruleset Template
+
+A predefined ruleset containing common governance rules that can be applied as a starting point for governance policies.
+
+### Governance Report
+
+A summary of API compliance with governance rules, identifying violations and suggesting remediations.
+
+### Violation
+
+An instance where an API fails to meet defined governance standards, categorized by severity level.
+
+### Compliance
+
+The degree to which an API adheres to defined governance policies and standards.
+
+### Remediation
+
+The structured process of addressing and resolving API governance violations.
+
+### Remediation Priority
+
+Indicates how urgently an API issue should be addressed based on its risk level and potential impact. This priority helps teams focus their efforts on the most critical issues first.
+
+### Risk Level
+
+A summary metric that reflects API governance compliance across multiple APIs, considering their adherence to selected governance rulesets.
+
+### Sync
+
+The process of extracting API definitions from management platforms and updating the governance repository.
+
+### Tyk-OAS Governance Extensions
+
+Tyk-specific extensions to the OpenAPI Specification that enable advanced governance features.
\ No newline at end of file
diff --git a/tyk-governance/governance-rulesets.mdx b/tyk-governance/governance-rulesets.mdx
new file mode 100644
index 0000000000..e507bf9659
--- /dev/null
+++ b/tyk-governance/governance-rulesets.mdx
@@ -0,0 +1,404 @@
+---
+title: "Governance Rulesets"
+description: "Define, manage, and enforce API standards across your organization through customizable rules that act as executable policies for API governance requirements."
+keywords: "Tyk Governance, Rulesets, API Standards, Governance Policies, API Compliance"
+sidebarTitle: "Governance Rulesets"
+---
+
+## Availability
+
+- Version: Available since v0.2
+
+## Overview
+
+Governance Rulesets enable you to define, manage, and enforce API standards across your organization through customizable rules. These rulesets act as executable policies that define your organization's API governance requirements, helping you establish consistent standards for security, design, and documentation.
+
+### Key Benefits
+
+- **Standardize API Development**: Define consistent patterns and practices for all APIs
+- **Centralize Governance Policies**: Maintain standards in a single location accessible to all teams
+- **Customize to Your Needs**: Create organization-specific rules or use pre-built templates
+- **Evolve Standards Gradually**: Adjust rule severity and scope as your governance program matures
+- **Share Knowledge**: Embed best practices and remediation guidance directly in rules
+
+### Dependencies
+
+- Requires Tyk Governance v0.2 or higher
+
+## Quick Start
+
+In this tutorial, we'll create a simple governance ruleset that can be used to validate APIs.
+
+### Prerequisites
+
+- Access to Tyk Governance Hub
+
+### Step-by-Step
+
+1. **Access the Rulesets Section**
+
+    Navigate to the Rulesets section in your Tyk Governance dashboard.
+
+2. **Create a New Ruleset**
+
+    Click the "Create new ruleset" button to create a new ruleset.
+
+    <img src="/img/governance/ruleset-list-2.png" alt="" />
+     
+3. **Choose a Template**
+
+    Select "Start from Template" and choose the "vacuum-owasp" template.
+
+    <img src="/img/governance/ruleset-template-1.png" alt="" />
+
+4. **Customize Your Ruleset**
+
+    Review the pre-configured rules. You can enable/disable specific rules or adjust their severity levels.
+
+    <img src="/img/governance/ruleset-template-2.png" alt="" />
+
+    Then, provide a name and description for your ruleset.
+
+    <img src="/img/governance/ruleset-template-3.png" alt="" />
+
+5. **Save Your Ruleset**
+
+    Click **Finish** to create your new ruleset.
+
+6. **View Your Ruleset**
+
+    Your new ruleset will appear in the rulesets list. Click on it to view details and manage individual rules.
+
+### Validation
+
+- Successful ruleset creation will be confirmed with a success message
+- The ruleset will appear in your rulesets list
+- You can now use this ruleset to [evaluate APIs](/tyk-governance/api-evaluation)
+
+## How It Works
+
+Governance Rulesets use a powerful rule engine based on the Spectral format to define standards for API specifications. Each rule consists of a selector that identifies parts of the API specification to evaluate, a function that performs the evaluation, and metadata that provides context and remediation guidance.
+
+### Rule Structure
+
+A typical rule in a ruleset includes:
+
+- **Given**: A JSONPath expression that selects parts of the API specification
+- **Then**: Functions to apply to the selected parts
+- **Severity**: The importance level (error, warn, info, hint)
+- **Message**: A description of what the rule checks
+- **HowToFix**: Guidance on resolving any violations
+
+When you create a ruleset, you're defining a collection of these rules that work together to enforce your governance standards.
+
+### Example Rulesets
+
+#### Security Standards Ruleset
+
+Create rulesets that define security requirements for APIs, such as authentication requirements, secure endpoints, and protection against common vulnerabilities.
+
+```yaml
+security-auth-required:
+  description: APIs must require authentication
+  severity: error
+  given: $.paths.*.*
+  then:
+    field: security
+    function: truthy
+  howToFix: "Add a security requirement to this operation"
+```
+
+#### API Design Standards Ruleset
+
+Define rules that enforce naming conventions, URL patterns, and response structures to maintain consistency across your API portfolio.
+
+```yaml
+path-case-convention:
+  description: Path segments must use kebab-case
+  severity: warn
+  given: $.paths
+  then:
+    field: "@key"
+    function: pattern
+    functionOptions:
+      match: "^\/([a-z0-9-]+|{[a-zA-Z0-9_]+})(\/{[a-zA-Z0-9_]+}|\/[a-z0-9-]+)*$"
+  howToFix: "Rename path segments to use kebab-case (lowercase with hyphens)"
+```
+
+#### Documentation Standards Ruleset
+
+Create rules that check for complete and accurate documentation, including descriptions, examples, and response schemas.
+
+```yaml
+operation-description:
+  description: All operations must have descriptions
+  severity: warn
+  given: $.paths.*.*
+  then:
+    field: description
+    function: truthy
+  howToFix: "Add a meaningful description to this operation"
+```
+
+## Manage Rulesets
+
+### Creating Rulesets
+
+Rulesets define governance standards and ensure API compliance with security, performance, and reliability requirements. You can create rulesets through the Governance UI or programmatically via the API.
+
+#### Using the UI
+
+The Governance UI provides a user-friendly interface for creating rulesets:
+
+1. Navigate to the Rulesets section
+2. Click **Create new ruleset**
+3. Choose how to create your ruleset (import from file, paste definition, or start from template)
+4. Provide basic information (name, description)
+5. Save your ruleset
+
+#### Using the API
+
+You can also create rulesets programmatically using the API.
+
+**Creating a Ruleset with JSON Payload**
+
+```sh
+curl -X POST https://your-governance-instance.tyk.io/api/rulesets \
+  -H "Content-Type: application/json" \
+  -H "X-API-Key: YOUR_API_KEY" \
+  -d '{
+    "metadata": {
+      "name": "Security Standards",
+      "description": "Security rules for all APIs",
+      "active": true
+    },
+    "ruleset": {
+      "rules": {
+        "security-auth-required": {
+          "description": "APIs must require authentication",
+          "severity": "error",
+          "given": "$.paths.*.*",
+          "then": {
+            "field": "security",
+            "function": "truthy"
+          },
+          "howToFix": "Add a security requirement to this operation"
+        }
+      }
+    }
+  }'
+```
+
+**Creating Rulesets from Files**
+
+For more complex rulesets or when you maintain your rulesets as files in your development environment, you can create rulesets directly from files using a multipart form request.
+
+To create a ruleset from a file, you need to send a multipart form request with two key components:
+
+1. `metadata`: JSON object containing ruleset metadata (name, description, etc.)
+2. `ruleset`: The ruleset definition file content (in YAML or JSON format)
+
+Here's how to create a ruleset from a YAML file using curl:
+
+```sh
+curl -X POST https://your-governance-instance.tyk.io/api/rulesets \
+  -H "X-API-Key: YOUR_API_KEY" \
+  -F "metadata={\"name\":\"API Security Ruleset\",\"description\":\"Enforces API security best practices\",\"active\":true}" \
+  -F "ruleset=@/path/to/your/ruleset.yaml"
+```
+
+### Managing Rulesets
+
+Once created, rulesets can be managed through the UI or API:
+
+#### Viewing Rulesets
+
+- Navigate to the Rulesets section to see all rulesets
+- Click on a ruleset to view its details and rules
+- Use search to find specific rulesets
+
+#### Editing Rulesets
+
+- From the ruleset details page, click **Configure ruleset**
+- Modify ruleset metadata or individual rules
+- Save your changes
+
+{/* #### Deleting Rulesets
+
+- From the ruleset details page, click "Delete"
+- Confirm the deletion */}
+
+#### Using Templates
+
+- When creating a new ruleset, select **Start from Template**
+- Choose from pre-built templates for common standards
+- Customize the template to meet your specific needs
+
+### Testing Rulesets Against APIs
+
+After creating your ruleset, you'll want to test it against your APIs to ensure it correctly identifies compliance issues. You can test a ruleset through the Governance UI:
+
+1. Navigate to the Ruleset Details Page
+
+    - Go to the **Rulesets** section and select the ruleset you want to test
+
+2. Run an Evaluation
+
+    - In the ruleset details page, locate the "**Test ruleset**" section
+    - Select an API from the dropdown menu
+    - Click the "**Run ruleset**" button
+
+      <img src="/img/governance/ruleset-test-1.png" alt="" />
+
+3. Review Results
+
+     - The evaluation results will display any rule violations found in the API
+     - Results are categorized by severity (High, Medium, Low)
+     - Click "View issue info" on any violation to see detailed information, including:
+       - The specific rule that was violated
+       - The affected area in the API specification
+       - Guidance on how to fix the issue
+
+     <img src="/img/governance/ruleset-test-2.png" alt="" />
+
+     <img src="/img/governance/ruleset-test-3.png" alt="" />
+
+## Understanding Remediation Priority
+
+In Tyk Governance, "Remediation Priority" indicates the urgency with which an API issue should be addressed, based on its risk level and potential impact. This priority helps teams focus their efforts on the most critical issues first.
+
+### Severity Mapping
+
+Remediation priority is directly derived from the severity level defined in the rule. When a rule violation is detected during evaluation, its severity level is mapped to a corresponding remediation priority:
+
+| Severity Level | Remediation Priority | Visual Indicator |
+| :---------------- | :---------------------- | :------------------ |
+| error          | High                 | Red pill            |
+| warn           | Medium               | Yellow/orange pill  |
+| info           | Low                  | Green pill          |
+
+## Use Cases
+
+### Establishing Tiered Governance Standards
+
+Create different rulesets for different API tiers based on criticality, allowing for appropriate governance without over-restricting less critical APIs.
+
+**Implementation:**
+
+1. Create a "Tier 1" ruleset with strict security, design, and documentation rules for mission-critical APIs
+2. Create a "Tier 2" ruleset with moderate requirements for important but less critical APIs
+3. Create a "Tier 3" ruleset with basic requirements for internal or non-critical APIs
+4. Apply these rulesets selectively based on API classification
+
+**Benefits:**
+
+- Appropriate governance based on API importance
+- More efficient use of development resources
+- Clear expectations for different types of APIs
+
+### Implementing Industry-Specific Standards
+
+Create rulesets that enforce industry-specific regulations and best practices for APIs in regulated sectors.
+
+**Implementation:**
+
+1. Identify relevant industry standards (e.g., FAPI for financial services, HIPAA for healthcare)
+2. Create rulesets that codify these standards as executable rules
+3. Include detailed remediation guidance specific to the industry context
+4. Apply these rulesets to APIs in the relevant domains
+
+**Benefits:**
+
+- Ensure compliance with industry regulations
+- Reduce audit preparation time
+- Standardize compliance approaches across teams
+
+### Evolving Governance Standards Over Time
+
+Use rulesets to gradually implement and evolve governance standards as your organization's API program matures.
+
+**Implementation:**
+
+1. Start with a basic ruleset focusing on critical security and fundamental design principles
+2. Gradually add more rules as teams become familiar with the standards
+3. Adjust severity levels over time (e.g., start as warnings, later promote to errors)
+4. Incorporate feedback from development teams to refine rules
+
+**Benefits:**
+
+- Avoid overwhelming teams with too many rules at once
+- Build governance maturity incrementally
+- Gain buy-in through collaborative evolution
+
+## Best Practices and Recommendations
+
+- **Start with templates** for common standards like OWASP or OpenAPI best practices
+- **Customize gradually** by adding organization-specific rules over time
+- **Use appropriate severity levels** - reserve "error" for critical issues that must be fixed
+- **Include clear remediation guidance** in the "howToFix" field for each rule
+- **Group related rules** into focused rulesets (security, design, documentation)
+- **Review and update rulesets regularly** as standards evolve
+- **Collect feedback from developers** on rule clarity and usefulness
+- **Document the purpose** of each ruleset for better organizational understanding
+- **Maintain version control** for rulesets as they evolve
+- **Assign ownership** to specific individuals or teams for each ruleset
+
+## FAQs
+
+<AccordionGroup>
+<Accordion title='What rule formats are supported?'>
+Tyk Governance supports Spectral-compatible rulesets in both YAML and JSON formats. This makes it compatible with existing Spectral rulesets and allows for easy migration from other tools.
+</Accordion>
+
+<Accordion title='Can I create custom functions for rules?'>
+Currently, Tyk Governance supports the standard functions provided by the Spectral/Vacuum engine. Custom functions are planned for future releases.
+</Accordion>
+
+<Accordion title='How many rules can I have in a ruleset?'>
+There's no hard limit on the number of rules in a ruleset, but performance may degrade with very large rulesets (100+ rules). We recommend organizing related rules into separate rulesets for better manageability and performance.
+</Accordion>
+
+<Accordion title='Can I import existing Spectral rulesets?'>
+Yes, you can import existing Spectral rulesets in YAML or JSON format. This allows you to leverage your existing governance rules in Tyk Governance.
+</Accordion>
+
+<Accordion title='How do I use these rulesets to validate APIs?'>
+Once you've created rulesets, you can use them to validate APIs through the [API Evaluation](/tyk-governance/api-evaluation) feature, which allows you to check API specifications against your governance standards.
+</Accordion>
+</AccordionGroup>
+
+## Troubleshooting
+
+<AccordionGroup>
+<Accordion title='Error when creating or importing a ruleset'>
+- Verify the ruleset is in valid YAML or JSON format
+- Check that all required fields are present (given, then, severity)
+- Ensure JSONPath expressions are valid
+- Look for syntax errors in function options
+- Try importing a smaller portion of the ruleset to identify problematic rules
+</Accordion>
+
+<Accordion title='Rule not appearing in ruleset'>
+- Check that the rule definition follows the correct format
+- Verify that the rule wasn't disabled during import
+- Ensure the rule has a unique name within the ruleset
+- Try adding the rule manually if it was part of an import
+</Accordion>
+
+<Accordion title='JSONPath expression not working as expected'>
+- Test your JSONPath expression with a sample API specification
+- Verify the syntax follows JSONPath standards
+- Check for typos or missing elements in the path
+- Consider simplifying complex expressions
+- Use online JSONPath evaluators to debug expressions
+</Accordion>
+
+<Accordion title='Changes to ruleset not saving'>
+- Ensure you have the necessary permissions
+- Check for validation errors in the ruleset definition
+- Verify you're clicking the final save button after making changes
+- Try refreshing the page and making changes again
+- Check browser console for any JavaScript errors
+</Accordion>
+</AccordionGroup>
+
diff --git a/tyk-governance/installation.mdx b/tyk-governance/installation.mdx
new file mode 100644
index 0000000000..97ac1ea4ef
--- /dev/null
+++ b/tyk-governance/installation.mdx
@@ -0,0 +1,538 @@
+---
+title: "Installation and Setup"
+description: "Step-by-step instructions for installing and configuring Tyk Governance, including cloud-hosted options and deploying agents in your environment."
+keywords: "Tyk Governance, Installation, Configuration, Agent Setup, Deployment"
+sidebarTitle: "Installation"
+---
+
+This section moves from concepts to hands-on implementation, providing the practical steps needed to start with Tyk Governance.
+
+## Prerequisites
+
+Before beginning the installation and setup process for Tyk Governance, ensure your environment meets the following requirements:
+
+### License Requirements
+- Valid Tyk license with Governance feature enabled
+
+### System Requirements
+
+**For Tyk Governance Hub:**
+- No local system requirements as Tyk Governance is fully hosted and managed by Tyk in the cloud
+
+**For Tyk Governance Agent:**
+- Minimum 1 CPU core
+- 512MB RAM
+- 1GB available disk space
+- Linux-based operating system (Ubuntu 18.04+, CentOS 7+, or equivalent)
+- Docker (if using containerized deployment)
+- Kubernetes (optional, for orchestrated deployments)
+
+### Permission Requirements
+
+**For Agent Installation:**
+- Read access to your API providers (Tyk, AWS API Gateway, etc.)
+- Ability to create and manage containers or services in your environment
+- Network configuration permissions to establish outbound connections
+- Permission to create and manage secrets for storing API credentials
+
+### Network Requirements
+
+**For Tyk Governance Agent:**
+- Inbound access from the Tyk Governance Hub (default 50051 for gRPC)
+- Outbound access to your API providers
+- Outbound HTTPS (port 443) access to the Tyk Governance Hub
+- If API Provider gateways run on different networks, network routes must allow the agent to communicate with those networks
+
+<Note>
+Running on Podman, containerd, or another container runtime? See [Container Runtimes](/deployment-and-operations/container-runtimes).
+</Note>
+
+## System Architecture
+
+Tyk Governance follows a cloud-hosted service model with customer-deployed agents, creating a secure and flexible architecture that respects your network boundaries while providing centralized governance.
+
+### High-Level Architecture
+
+```mermaid
+flowchart LR
+    subgraph "Tyk Cloud"
+        GS["Governance Service"] --- DB[(Database)]
+        GS --- RE["Rule Engine"]
+        GS <--> A4["Agent 3"] --- P3["Cloud Control Plane"]
+    end
+    
+    subgraph "Customer Environment"
+        A1["Agent 1"] --- P1["Tyk Dashboard (Self-Managed)"]
+        A2["Agent 2"] --- P2["AWS API Gateway"]
+    end
+    
+    A1 <-->|"TLS + Auth"| GS
+    A2 <-->|"TLS + Auth"| GS
+```
+
+### Deployment Models
+
+#### Tyk Cloud with Automatic Agent
+
+```mermaid
+flowchart LR
+    subgraph "Tyk Cloud"
+        GS["Governance Service"]
+        CP["Cloud Control Plane"]
+        AG["Auto-deployed Agent"]
+        
+        GS --- AG
+        AG --- CP
+    end
+    
+    User["User"] --> GS
+```
+
+**When to use this model:**
+- You exclusively use Tyk Cloud for API management
+- You want the simplest possible setup with minimal configuration
+- You don't have any APIs on other platforms that need governance
+
+#### Tyk Cloud with Customer-Deployed Agents
+
+```mermaid
+flowchart LR
+    subgraph "Tyk Cloud"
+        GS["Governance Service"]
+    end
+    
+    subgraph "Customer Environment"
+        A1["Agent"] --- TG["Tyk Dashboard (Self-Managed)"]
+        A2["Agent"] --- AWS["AWS API Gateway"]
+    end
+    
+    A1 <--> GS
+    A2 <--> GS
+    
+    User["User"] --> GS
+```
+
+**When to use this model:**
+- You use self-managed Tyk deployments (not Tyk Cloud)
+- You use AWS API Gateway or other supported providers
+- You need to govern APIs across providers that aren't in Tyk Cloud
+
+#### Hybrid Deployment
+
+```mermaid
+flowchart LR
+    subgraph "Tyk Cloud"
+        GS["Governance Service"]
+        CP["Cloud Control Plane"]
+        AG["Auto-deployed Agent"]
+        
+        GS --- AG
+        AG --- CP
+    end
+    
+    subgraph "Customer Environment"
+        A2["Agent"] --- AWS["AWS API Gateway"]
+    end
+    
+    A2 <--> GS
+    
+    User["User"] --> GS
+```
+
+**When to use this model:**
+- You use a combination of Tyk Cloud and other API platforms
+- You have a mix of cloud and on-premises API deployments
+- You need comprehensive governance across your entire API ecosystem
+
+## Installation
+
+The installation process for Tyk Governance varies depending on whether you're an existing Tyk Cloud customer and which deployment model you use.
+
+### Requesting Access to Tyk Governance
+
+1. **Contact Tyk for Access**
+    - Reach out to your Tyk Account Manager or visit [tyk.io/contact-book-a-demo](https://tyk.io/contact-book-a-demo/)
+    - Specify that you're interested in access to Tyk Governance
+    - Provide information about your current API management environment
+
+2. **Receive Access Credentials**
+    - After your request is processed, you'll receive an email with:
+        - URL to access the Tyk Governance Hub
+        - Admin credentials for initial login
+        - Instructions for next steps
+
+3. **Initial Login**
+    - Navigate to the provided Governance Hub URL
+    - Enter the admin credentials from the email
+    - You'll be prompted to change your password on first login
+
+### Enabling Governance Feature for Cloud Control Planes
+
+For existing Tyk Cloud managed control planes, enabling governance is straightforward:
+
+1. **Log in to Tyk Cloud Dashboard**
+	- Navigate to your Tyk Cloud dashboard
+	- Ensure you have administrative privileges
+
+2. **Access Control Plane Settings**
+	- Select the Control Plane you want to enable governance for
+	- Click on "Edit Details" button
+
+3. **Enable Governance Feature**
+	- Locate the "Governance Agent" toggle
+	- Enable the feature
+	- Save your changes
+
+4. **Verification**
+	- An agent will be automatically deployed for your Tyk Control Plane
+	- You can now access the Governance dashboard via "Governance" in the Cloud UI sidebar
+
+### Installing a Local Agent
+
+For environments where you need to install agents manually (non-Tyk platforms or on-premises deployments), follow these steps:
+
+**Prerequisites for Agent Installation:**
+- Access to the Governance Hub to generate agent tokens
+- Network connectivity between the agent and both the Governance Hub and your API provider
+- Docker or Kubernetes for container-based deployment (recommended)
+
+#### Generate Agent Token from Governance Hub UI
+
+1. From the Agents page, click the **New agent** button in the top-right corner.
+
+  <img src="/img/governance/agents-list.png" alt="" />
+
+2. In the New agent form, enter:
+
+   - **Name**: A descriptive name for the agent (required)
+   - **Description**: Details about the agent's purpose or location (required)
+
+   Click **Create agent** to save the new agent.
+
+    <img src="/img/governance/agents-new-1.png" alt="" />
+
+3. Click "Generate new access token"
+   
+    <img src="/img/governance/agents-new-2.png" alt="" />
+
+4. Use the copy icon to copy the token to your clipboard
+
+    <img src="/img/governance/agents-new-3.png" alt="" />
+
+    <img src="/img/governance/agents-new-4.png" alt="" />
+
+#### Generate Agent Token using API
+
+You can also use API to create a token. After receiving your Governance Hub credentials, follow these steps:
+
+1. **Obtain an API Key**:
+	 - Log in to the Governance Hub using the credentials provided in your welcome email
+	 - Check your Access key under the "Settings > User Profile" section
+
+     <img src="/img/governance/user-profile.png" alt="" />
+
+2. **Create an Agent using the API**:
+
+    ```bash
+    # Replace these values with your actual information
+    GOVERNANCE_URL="https://your-governance-instance.tyk.io"
+    API_KEY="your-access-key"
+    AGENT_NAME="My AWS Agent (US)"
+
+    # Create agent first
+    curl -s -X POST --location "${GOVERNANCE_URL}/api/agents/" \
+      -H "X-API-Key: ${API_KEY}" \
+      -H "Content-Type: application/json" \
+      -d '{
+        "name": "'"${AGENT_NAME}"'"
+      }'
+    ```
+
+    Example response that shows an agent is created in INACTIVE state:
+
+    ```json
+    {
+      "id": "a51d9bd0-bafe-4749-8285-e18641b151f2",
+      "name": "My AWS agent (US)",
+      "description": "",
+      "last_heartbeat": "0001-01-01T00:00:00Z",
+      "status": "inactive",
+      "providers": null,
+      "token": "",
+      "version": ""
+    }
+    ```
+
+    ```bash
+    # Extract agent ID from response
+    AGENT_ID="a51d9bd0-bafe-4749-8285-e18641b151f2"
+    ```
+
+3. **Generate an Agent Token using the API**:
+
+    Now you can generate an access token for the agent.
+
+    ```bash
+    # API call to create an agent token
+    curl -X POST "${GOVERNANCE_URL}/api/auth/token/" \
+      -H "X-API-Key: ${API_KEY}" \
+      -H "Content-Type: application/json" \
+      -d '{
+        "agent_id": "'"${AGENT_ID}"'"
+      }'
+    ```
+
+    Example response:
+
+    ```json
+    {
+      "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
+    }
+    ```
+
+4. **Save the token securely**:
+
+	 - Copy the `token` value from the response
+	 - Store it securely, as you'll need it for agent configuration
+	 - Note: This token cannot be retrieved later, so make sure to save it
+
+#### Prepare Configuration
+
+Create a configuration file named `agent-config.yaml` with the following structure:
+
+```yaml
+#==============================================================================
+# Tyk Governance Agent Configuration
+#==============================================================================
+
+# Your Tyk Governance license key - required for agent authentication
+# This is provided by Tyk when you subscribe to the Governance service
+licenseKey: "your-tyk-governance-license-key"
+
+# Configuration for connecting to the Tyk Governance dashboard/service
+governanceDashboard:
+  server:
+    # The gRPC endpoint URL of the Tyk Governance service
+    # Format: hostname:port (without protocol)
+    # This is in the format of prefixing "grpc-" to your Governance Hub URL.
+    url: "grpc-your-governance-instance.tyk.io:443"
+  
+  auth:
+    # Authentication token for this agent
+    # Generated via API call to /auth/token endpoint
+    # This token identifies and authorizes this specific agent
+    token: "my-agent-token"
+
+#==============================================================================
+# API Provider Configurations
+#==============================================================================
+# List of API providers this agent will connect to
+# Each agent can connect to multiple providers of different types
+instances:
+  #--------------------------------------------------------------------------
+  # Tyk Provider Configuration
+  #--------------------------------------------------------------------------
+  - name: "tyk-provider"  # Descriptive name for this provider instance
+    type: "tyk"           # Provider type: must be "tyk" for Tyk Dashboard
+    config:
+      # The URL of your Tyk Dashboard
+      # For Kubernetes deployments, this might be an internal service URL
+      host: "http://dashboard-svc-tyk-stack-tyk-dashboard.tyk.svc.cluster.local:3000"
+      
+      # API key with read access to the Tyk Dashboard
+      # Can be obtained in Tyk Dashboard under "User" > "User Details": "Tyk Dashboard API Access Credentials"
+      # Requires read permissions for APIs and policies
+      auth: "your-auth-key"
+  
+  #--------------------------------------------------------------------------
+  # AWS API Gateway Provider Configuration
+  #--------------------------------------------------------------------------
+  - name: "aws-provider"  # Descriptive name for this AWS API Gateway instance
+    type: "aws"           # Provider type: must be "aws" for AWS API Gateway
+    config:
+      # AWS IAM credentials with permissions to list and get API Gateway resources
+      # Recommended: Use an IAM role with minimal required permissions
+      accessKeyId: "your-aws-access-key-id"
+      accessKeySecret: "your-aws-access-key-secret"
+      
+      # AWS region where your API Gateway APIs are deployed
+      # Example: us-east-1, eu-west-1, ap-southeast-2, etc.
+      region: "us-east-1"
+      
+      # Optional: Temporary session token if using temporary credentials
+      # Required only when using AWS STS temporary credentials
+      sessionToken: "your-aws-session-token"
+
+#==============================================================================
+# Agent Settings
+#==============================================================================
+
+# Log level controls verbosity of agent logs
+# Options: debug, info, warn, error
+# Recommended: info for production, debug for troubleshooting
+logLevel: debug
+
+# Health probe configuration for monitoring agent health
+# Used by container orchestration systems like Kubernetes
+healthProbe:
+  server:
+    # Port on which the health probe server will listen
+    # Ensure this port is not used by other services
+    port: 5959
+```
+
+#### Deploy the Agent
+
+**Docker Deployment:**
+
+```bash
+# Replace it with your Tyk Governance license key
+LICENSE_KEY="tyk-governance-license-key"
+
+# Replace with an available version tag
+VERSION="latest"
+
+docker run -d --name tyk-governance-agent \
+  -v $(pwd)/agent-config.yaml:/app/config.yaml \
+  -e TYK_AGENT_LICENSEKEY="$LICENSE_KEY" \
+  tykio/governance-agent:$VERSION
+```
+
+**Kubernetes Deployment:**
+
+1. Create a Kubernetes secret for the configuration:
+
+```bash
+kubectl create secret generic agent-config \
+  --from-file=config.yaml=./agent-config.yaml \
+  -n your-namespace
+```
+
+2. Apply the following manifest:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: governance-agent
+  namespace: your-namespace # Replace with your namespace
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tyk-governance-agent
+  template:
+    metadata:
+      labels:
+        app: tyk-governance-agent
+    spec:
+      containers:
+      - name: agent
+        image: tykio/governance-agent:latest # Replace with an available version tag
+        env:
+        - name: TYK_AGENT_LICENSEKEY
+          value: your-governance-license #Replace with your license key
+        ports:
+        - name: health
+          containerPort: 5959
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: health
+        readinessProbe:
+          httpGet:
+            path: /live
+            port: health
+        volumeMounts:
+        - mountPath: /app/config.yaml
+          name: agent-config
+          subPath: config.yaml
+      volumes:
+      - name: agent-config
+        secret:
+          secretName: agent-config
+          items:
+          - key: config.yaml
+            path: config.yaml
+```
+
+Apply with:
+
+```bash
+kubectl apply -f agent-deployment.yaml
+```
+
+#### Verify Agent Connection
+
+1. Check if the agent is running properly:
+
+    ```bash
+    # For Docker
+    docker logs tyk-governance-agent
+
+    # For Kubernetes
+    kubectl logs -l app=tyk-governance-agent -n your-namespace
+    ```
+
+ 2. Look for log messages indicating a successful connection:
+
+    ```
+    Starting license validation... 
+    License validated successfully. Valid till: ...
+    starting agent
+    agent started successfully
+    waiting agent to establish health check
+    starting health probes HTTP server","addr":":5959
+    authenticated and established health stream
+    health check established, waiting for sync stream
+    agent registered successfully and established sync stream with governance dashboard
+    waiting for sync requests from the dashboard
+    ```
+
+#### Trigger Initial Sync
+
+1. In the Governance Hub, navigate to "API Repository"
+2. Click the "ReSync" button to initiate synchronisation
+
+<img src="/img/governance/sync-repository.png" alt="" />
+
+3. Monitor the sync progress in the UI or refresh the page manually.
+
+## Examples
+
+The following examples demonstrate common deployment scenarios and configurations for Tyk Governance.
+
+### Example 1: Tyk Cloud with Automatic Agent
+
+This is the simplest deployment model for existing Tyk Cloud customers.
+
+**Configuration Steps:**
+
+1. Requesting Access to Tyk Governance
+2. Enable the Governance feature in Tyk Cloud Control Plane as described in [Enabling Governance Feature for Cloud Control Planes](#enabling-governance-feature-for-cloud-control-planes)
+3. Wait for automatic agent deployment
+4. Access the Governance Hub from the Cloud UI sidebar
+5. Navigate to "API Repository" to view your automatically discovered APIs
+6. Trigger "ReSync" to pull updates from the control planes
+
+**Expected Outcome:**
+- All APIs from your Tyk Control Plane will be automatically discovered and displayed in the API Repository
+
+### Example 2: Multi-Platform Governance with Custom Agents
+
+This example demonstrates how to set up governance across multiple API providers.
+
+**Configuration Steps:**
+
+1. Requesting Access to Tyk Governance
+2. Generate agent tokens for each provider as described in [Installing a Local Agent](#installing-a-local-agent)
+3. Create configuration files for each agent
+4. Deploy each agent using Docker or Kubernetes as described in [Installing a Local Agent](#installing-a-local-agent)
+5. Verify agent connections
+6. Access the Governance Hub with the provided URL
+7. Navigate to "API Repository" to view your automatically discovered APIs
+8. Trigger "ReSync" to pull updates from all agents
+
+**Expected Outcome:**
+- APIs from all providers will be discovered and displayed in a unified repository
diff --git a/tyk-governance/overview.mdx b/tyk-governance/overview.mdx
new file mode 100644
index 0000000000..deaf0032ea
--- /dev/null
+++ b/tyk-governance/overview.mdx
@@ -0,0 +1,66 @@
+---
+title: "Tyk Governance Overview"
+description: "Introduction to Tyk Governance, a universal API governance hub that enables organizations to establish, enforce, and monitor governance policies across multiple API platforms and gateways."
+keywords: "Tyk Governance, API Governance, API Management"
+sidebarTitle: "Overview"
+---
+
+## Overview
+
+Tyk Governance is a universal API governance hub that enables organizations to establish, enforce, and monitor governance policies across multiple API platforms and gateways. It solves the challenge of fragmented API management by providing a centralized approach to governance, regardless of where your APIs are hosted or which technologies they use.
+
+In today's complex API ecosystems, organizations struggle with inconsistent standards, security vulnerabilities, and compliance gaps across different API platforms. Tyk Governance bridges these gaps by creating a unified governance layer that works seamlessly with Tyk and extends to third-party API platforms, such as AWS API Gateway.
+
+<img src="/img/governance/governance-overview.png" alt="Tyk Governance provides centralized visibility and organizations across different API platforms" />
+
+## Key Benefits
+
+* **Universal Governance** - Define and enforce consistent policies across multiple API platforms and styles (REST, GraphQL, event-driven) from a single control plane
+* **Reduced Duplication** - Identify redundant or shadow APIs across different departments, reducing maintenance costs and security risks
+* **Shift-Left Governance** - Catch governance violations during design and development, not after deployment, reducing rework by up to 60%
+* **Collaborative Improvement** - Enable teams to work together with shared visibility and clear ownership of APIs across the organization
+* **Measurable API Maturity** - Track and improve API quality with quantifiable metrics across technical excellence, business impact, and developer experience
+
+## Who Should Use Tyk Governance
+
+Tyk Governance transforms API governance from a fragmented, post-deployment concern into a proactive, continuous, and scalable process across your entire API ecosystem.
+
+```mermaid
+flowchart LR
+    A[Enterprise Architects and Security Leads] -->|Define Policies| B[Tyk Governance]
+    C[Platform Engineers] -->|Integrate Tools| B
+    B -->|Provide Feedback| D[API Developers]
+    D -->|Create Compliant APIs| B
+    B -->|Compliance Reporting| A[Enterprise Architects and Security Leads]
+```
+
+### Enterprise Architects & Security Leads
+
+Enterprise architects and security leads use Tyk Governance to establish organization-wide standards and ensure strategic alignment of the API program. They benefit from:
+
+* Centralized visibility across all API platforms
+* Comprehensive compliance reporting
+* The ability to define tiered governance policies based on API criticality
+* Pre-built governance templates aligned with industry standards
+
+**Example:** An enterprise architect at a financial services company uses Tyk Governance to ensure all customer-facing APIs comply with security and regulatory requirements, while allowing internal APIs to follow a lighter governance model.
+
+### Platform Engineers
+
+Platform engineers leverage Tyk Governance to build and maintain internal developer platforms that streamline API development. They value:
+
+* Seamless integration of governance into CI/CD pipelines
+* Self-service tools that empower developers
+* Automated API discovery with scheduled synchronization
+
+**Example:** A platform engineer integrates Tyk Governance into Tyk Dashboard and other API platforms, providing API templates that automatically incorporate security best practices and compliance requirements.
+
+### API Developers
+
+API developers rely on Tyk Governance to design and implement APIs that meet organizational standards from day one. They appreciate:
+
+* Clear guidance on governance requirements
+* Real-time feedback during development
+* Reduced rework and faster release cycles
+
+**Example:** An API developer receives immediate feedback that their new payment API is missing required rate-limiting policies, allowing them to fix the issue before submitting for review.
\ No newline at end of file
diff --git a/tyk-identity-broker/dashboard-sso.mdx b/tyk-identity-broker/dashboard-sso.mdx
new file mode 100644
index 0000000000..961f994eb2
--- /dev/null
+++ b/tyk-identity-broker/dashboard-sso.mdx
@@ -0,0 +1,327 @@
+---
+title: "Tyk Dashboard Single-Sign On"
+description: "Learn how to configure Single Sign-On (SSO) for Tyk Dashboard, allowing users to log in with their existing identity provider credentials."
+keywords: "Tyk Dashboard, SSO, Single Sign-On, Tyk Identity Broker, TIB, Authentication, Identity Provider"
+sidebarTitle: "Dashboard SSO"
+---
+
+Tyk Identity Broker (TIB) enables Single Sign-On (SSO) for Tyk Dashboard, allowing users to log in using their existing identity provider (IdP) credentials rather than with a Tyk Dashboard user account and password.
+
+<Note>
+We recommend that you read the [Tyk Identity Broker overview](/tyk-identity-broker/overview) before configuring SSO for Dashboard.
+</Note>
+
+## How It Works
+
+When a user logs in via SSO, TIB authenticates them against the configured IdP and then calls the Tyk Dashboard API to obtain a one-time nonce. TIB then redirects the user's browser to the Dashboard's `/tap` endpoint with the nonce appended. Tyk Dashboard validates the nonce and creates a session automatically. No further action is required from the user.
+
+```mermaid
+sequenceDiagram
+    actor User
+    participant IDP as Identity Provider (IdP)
+    participant TIB as Tyk Identity Broker
+    participant Dashboard as Tyk Dashboard
+
+    User->>TIB: Log in
+    TIB->>IDP: Verify identity
+    IDP->>TIB: Identity confirmed
+    TIB->>Dashboard: Request SSO nonce
+    Dashboard->>TIB: One-time nonce (valid 60 seconds)
+    TIB-->>User: Browser redirected to /tap?nonce=...
+    Note over User,Dashboard: Browser follows redirect automatically
+    Dashboard->>User: Session created, logged in
+```
+
+Tyk Dashboard identifies SSO users by their email address.
+
+What happens after authentication is controlled by two settings:
+
+| Setting | Configured in | Purpose |
+|---|---|---|
+| [`sso_enable_user_lookup`](/tyk-dashboard/configuration#sso_enable_user_lookup) | Tyk Dashboard configuration | Whether to match the user's email address against existing Tyk Dashboard accounts. |
+| `SSOOnlyForRegisteredUsers` | TIB profile | Whether to deny login if no matching account is found. |
+
+```mermaid
+flowchart LR
+    A[User authenticates via TIB] --> B{Look up existing account?}
+    B -- No --> C[Unregistered User Login]
+    B -- Yes --> D{Matching account found by email?}
+    D -- Yes --> E[Registered User Login]
+    D -- No --> F{Registered users only?}
+    F -- Yes --> G[Login Denied]
+    F -- No --> C
+```
+### TIB Service Account
+
+TIB requires valid credentials to [generate the one-time nonce](https://tyk.io/docs/api-reference/single-sign-on/generate-authentication-token) from the Tyk Dashboard API.
+
+Typically you would create a dedicated **TIB service account** on the Dashboard and set its **Tyk Dashboard API Access Credentials** key (available from **System Management > Users** in the Dashboard UI) in the TIB profile. The service account does not need any special permissions, any active account is sufficient.
+
+### TIB Profile Management
+
+Dashboard users who need to create and manage TIB profiles require the **Identity Management (TIB)** [permission](/platform-management/user-permissions).
+
+## Profile Configuration
+
+Dashboard SSO uses the `GenerateOrLoginUserProfile` [action](/tyk-identity-broker/overview#actions) in the TIB profile. The following profile fields are required for all Dashboard SSO configurations:
+
+| Field | Value |
+|---|---|
+| `ActionType` | `GenerateOrLoginUserProfile` |
+| `ReturnURL` | `http://{dashboard-host}/tap` |
+| `IdentityHandlerConfig.DashboardCredential` | API key for the dedicated [TIB service account](#tib-service-account) |
+
+The `ProviderName`, `ProviderConfig`, and `Type` fields depend on your identity provider and are covered in the [IdP-specific guides](#set-up-sso-with-your-identity-provider).
+
+The user permission-related fields (`SSOOnlyForRegisteredUsers`, `UserGroupMapping`, `DefaultUserGroupID`, and `CustomUserGroupField`) are optional and used for [unregistered users](#unregistered-user-login).
+
+Two additional optional fields allow you to override which claims TIB reads from the IdP response:
+
+| Field | Description |
+|---|---|
+| `CustomEmailField` | The name of the IdP claim to use as the user's email address. If not set, TIB uses the standard email claim returned by the IdP. |
+| `CustomUserIDField` | The name of the IdP claim to use as the user's unique identifier. If not set, TIB uses the standard subject or user ID claim. |
+
+These are useful when your IdP returns email or user ID under a non-standard claim name.
+
+<Note>
+The `GenerateOrLoginUserProfile` action type is also used to log admin users into Tyk Developer Portal. See [SSO into Tyk Developer Portal](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) for full details.
+</Note>
+
+## Registered User Login
+
+You can track the activity of users and assign them individual permissions by enabling the Dashboard's **user lookup** system.
+
+1. Enable `sso_enable_user_lookup: true` in the Tyk Dashboard configuration:
+
+    ```json
+    {
+      "sso_enable_user_lookup": true
+    }
+    ```
+
+2. Create accounts for the users in Tyk Dashboard and set their permissions. 
+
+When a user logs in via SSO, Tyk Dashboard looks for an account with a matching email address. If found, a session is created using that account's permissions. The account persists between logins, the user appears in the Dashboard user list, and their last login is recorded. If no matching account is found, the user is treated as an [Unregistered User Login](#unregistered-user-login).
+
+## Unregistered User Login
+
+By default, any user authenticated by the IdP is granted access:
+
+- Tyk Dashboard constructs a temporary in-memory user from the IdP data.
+- No account is created in the user database.
+- The user will not appear in the Dashboard user list and their last login is not recorded.
+
+There are three ways to configure permissions for unregistered users, which can be used individually or combined:
+
+| Option | Configured in | Purpose |
+|---|---|---|
+| [IdP Permission Claims](#idp-permission-claims) | TIB profile | Maps IdP group claims to Tyk Dashboard user groups, applying different permissions based on the user's IdP group membership. |
+| [Default User Group](#default-user-group) | Tyk Dashboard configuration | Assigns a fallback [Tyk Dashboard user group](/platform-management/user-groups) when no group mapping applies. |
+| [Default User](#default-user) | Tyk Dashboard configuration | Sets a baseline set of permissions for all unregistered SSO users. |
+
+When combined, the Default User Permissions provide the baseline and group permissions are merged on top. Where there is a conflict, the higher permission level wins. If the user is an [admin](/platform-management/user-permissions#admin-users), group permissions are skipped to preserve admin rights.
+
+### IdP Permission Claims
+
+When a user authenticates, the IdP returns a set of attributes about them, such as their name, email address, and group membership. TIB receives these attributes as a key-value map.
+
+The following TIB profile fields control how these attributes are mapped to Tyk Dashboard user groups:
+
+| Profile Field | Description |
+|---|---|
+| `CustomUserGroupField` | The key in the IdP attributes map that contains the user's group membership. |
+| `UserGroupMapping` | Maps IdP group values to Tyk Dashboard user group IDs. |
+| `DefaultUserGroupID` | The Tyk Dashboard user group to use when no mapping matches. |
+| `UserGroupSeparator` | The separator character when a single IdP group claim contains multiple group values. |
+
+**Example: single group**
+
+The IdP returns the following attributes for the authenticated user:
+
+```json
+{
+  "email": "alice@example.com",
+  "groups": "developers"
+}
+```
+
+The TIB profile is configured as follows:
+
+```json
+{
+  "CustomUserGroupField": "groups",
+  "UserGroupMapping": {
+    "developers": "{tyk-developer-group-id}",
+    "analytics": "{tyk-analytics-group-id}"
+  },
+  "DefaultUserGroupID": "{tyk-default-group-id}"
+}
+```
+
+TIB reads the `groups` claim, finds `"developers"` in `UserGroupMapping`, and the Dashboard applies the permissions of the `{tyk-developer-group-id}` user group to Alice's session.
+
+**Example: multiple groups**
+
+The IdP returns a comma-separated list of groups:
+
+```json
+{
+  "email": "alice@example.com",
+  "groups": "developers,analytics"
+}
+```
+
+The TIB profile is configured as follows:
+
+```json
+{
+  "CustomUserGroupField": "groups",
+  "UserGroupMapping": {
+    "developers": "{tyk-developer-group-id}",
+    "analytics": "{tyk-analytics-group-id}"
+  },
+  "DefaultUserGroupID": "{tyk-default-group-id}",
+  "UserGroupSeparator": ","
+}
+```
+
+With `UserGroupSeparator` set to `","`, TIB splits the value in `groups` and checks for both values in the `UserGroupMapping`. The permissions from `{tyk-developer-group-id}` and `{tyk-analytics-group-id}` are merged, with the higher permission level winning any conflicts.
+
+
+**Example: no matching group claims**
+
+The IdP returns the following attributes for the authenticated user:
+
+```json
+{
+  "email": "alice@example.com",
+  "groups": "sysadmin"
+}
+```
+
+The TIB profile is configured as follows:
+
+```json
+{
+  "CustomUserGroupField": "groups",
+  "UserGroupMapping": {
+    "developers": "{tyk-developer-group-id}",
+    "analytics": "{tyk-analytics-group-id}"
+  },
+  "DefaultUserGroupID": "{tyk-default-group-id}"
+}
+```
+
+Alice's group claim (`sysadmin`) does not match any entry in the `UserGroupMapping` so she is assigned the permissions from `{tyk-default-group-id}`.
+
+
+### Default User Group
+
+<Warning>
+If TIB sends no group information to the Dashboard and no `sso_default_group_id` is configured, Tyk Dashboard treats the user as an [admin](/platform-management/user-permissions#admin-users). This applies when neither IdP permission claims nor a default group is configured.
+</Warning>
+
+Setting [`sso_default_group_id`](/tyk-dashboard/configuration#sso_default_group_id) in the Tyk Dashboard config assigns all SSO users that TIB has not assigned to a group to a specific [user group](/platform-management/user-groups), from which they will inherit permissions.
+
+<Note>
+`sso_default_group_id` must reference a valid, existing user group. If the group ID does not exist, the user will authenticate successfully but will have no permissions. The admin fallback is still prevented (because a group ID is set), but the user will be unable to perform any actions in Tyk Dashboard.
+</Note>
+
+```json
+{
+  "sso_default_group_id": "{user-group-id}"
+}
+```
+
+These permissions will be merged with any configured for the [default user](#default-user).
+
+### Default User
+
+In addition to the [default user group](#default-user-group) mechanism, setting [`sso_permission_defaults`](/tyk-dashboard/configuration#sso_permission_defaults) in the Tyk Dashboard config assigns SSO users that have not been assigned to a user group by TIB to a specific set of permissions, for example:
+
+```json
+{
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  }
+}
+```
+
+These permissions will be merged with any configured for the [default user group](#default-user-group).
+
+
+## Login Denied
+
+To restrict SSO login to registered users only, set both:
+
+- `sso_enable_user_lookup: true` in the Tyk Dashboard configuration
+- `SSOOnlyForRegisteredUsers: true` in the TIB profile
+
+If no matching Dashboard account is found, login is denied.
+
+<Note>
+Both flags must be set - if only one is set, the restriction has no effect.
+</Note>
+
+## Create a TIB Profile using Dashboard UI
+
+TIB profiles are managed from the **Identity Management Profiles** page in **User Management > User Settings**.
+
+1. Select **Create Profile**
+    <img src="/img/tib/profiles/create-tib-profile1.png" alt="Creating a new TIB profile" />
+2. Provide a **Name** for the profile - this will be stored as the profile `id` so must contain only alphanumeric characters and hyphens
+3. Provide URLs to which users should be redirected on success and failure
+4. Click **Next**
+5. Choose the **Provider Type** (method) and click **Next**
+    <img src="/img/tib/profiles/create-tib-profile2.png" alt="Choose the TIB method (provider type)" />
+6. Complete the configuration, which will depend upon the method chosen
+    <img src="/img/tib/profiles/create-tib-profile3.png" alt="Complete the TIB profile configuration" />
+7. Click **Create Profile**
+
+You can view and edit the profile JSON directly from the **Raw Editor** view.
+
+    <img src="/img/tib/profiles/create-tib-profile4.png" alt="TIB profile editor view" />
+
+
+## Using Standalone TIB
+
+By default, Tyk Dashboard uses its embedded TIB for SSO from v3.0 onwards. If you need to use a standalone TIB instance instead, configure the `identity_broker` block in `tyk_analytics.conf`:
+
+```json
+{
+  "identity_broker": {
+    "enabled": false,               //default: true
+    "host": {
+      "connection_string": "http://{tib-host}:{tib-port}",
+      "secret": "{tib-api-secret}"
+    },
+    "ssl_insecure_skip_verify": false
+  }
+}
+```
+
+| Setting | Description |
+|---|---|
+| `enabled` | Enables or disables the embedded TIB. Defaults to `true`. Set to `false` to use external TIB (or to disable SSO entirely). |
+| `host.connection_string` | URL of the standalone TIB instance. When set, Tyk Dashboard proxies TIB API calls to this URL instead of using the embedded TIB. |
+| `host.secret` | [Shared secret](/tyk-identity-broker/standalone-tib#management-api-secret) between Tyk Dashboard and the standalone TIB instance. Must match the `Secret` field in `tib.conf`. |
+| `ssl_insecure_skip_verify` | Skip TLS verification when connecting to the standalone TIB instance. Not recommended for production. |
+
+For installation and configuration of standalone TIB, see [Install Standalone TIB](/tyk-identity-broker/standalone-tib).
+
+## Set Up SSO with Your Identity Provider
+
+Select your identity provider to get started:
+
+| Identity Provider | Guide |
+|---|---|
+| Microsoft Entra ID (OIDC or SAML), ADFS | [SSO with Microsoft Entra ID](/tyk-identity-broker/sso-entra-id) |
+| Okta (OIDC or SAML) | [SSO with Okta](/tyk-identity-broker/sso-okta) |
+| Auth0 | [SSO with Auth0](/tyk-identity-broker/sso-auth0) |
+| Keycloak | [SSO with Keycloak](/tyk-identity-broker/sso-keycloak) |
+| Active Directory, OpenLDAP | [SSO with LDAP](/api-management/single-sign-on-ldap) |
+| Google, GitHub, LinkedIn, and other OAuth providers | [SSO with Social Providers](/api-management/single-sign-on-social-idp) |
+| Custom or legacy authentication endpoints | [SSO with Proxy Provider](/api-management/custom-auth-with-proxy-identity-provider) |
diff --git a/tyk-identity-broker/overview.mdx b/tyk-identity-broker/overview.mdx
new file mode 100644
index 0000000000..630ba0fe98
--- /dev/null
+++ b/tyk-identity-broker/overview.mdx
@@ -0,0 +1,232 @@
+---
+title: "Tyk Identity Broker"
+description: "Learn how to use Tyk Identity Broker to connect external identity providers to Tyk Dashboard, Tyk Developer Portal, and Tyk Gateway."
+keywords: "Tyk Identity Broker, TIB, SSO, Single Sign-On, Identity Provider, LDAP, OIDC, SAML, Authentication"
+sidebarTitle: "Overview"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+
+## What is Tyk Identity Broker?
+
+Tyk Identity Broker (TIB) is a service that connects external identity providers (IdPs) to your Tyk installation. It handles the interaction with the IdP on your behalf, then on successful authentication instructs Tyk to take a specific action, such as logging a user into Tyk Dashboard or issuing an API access token.
+
+```mermaid
+graph LR
+    User(["User"])
+
+    subgraph TIB["Tyk Identity Broker"]
+        Profile["Profile
+        ───────────
+        Method
+        Action"]
+    end
+
+    subgraph IDP["Identity Provider (IdP)"]
+        direction TB
+        Google["Google / GitHub"]
+        OIDC["OpenID Connect"]
+        SAML["SAML"]
+        LDAP["LDAP"]
+    end
+
+    subgraph Tyk["Tyk"]
+        Dashboard["Tyk Dashboard"]
+        Portal["Tyk Developer Portal"]
+        Gateway["Tyk Gateway"]
+    end
+
+    User -->|"Authentication request"| TIB
+    TIB <-->|"Validate identity"| IDP
+    TIB -->|"Execute action"| Tyk
+```
+
+## Use Cases
+
+TIB supports two distinct use cases, each with a different outcome.
+
+### Single Sign-On
+
+A human user wants to log in to Tyk Dashboard or Tyk Developer Portal using their existing IdP credentials. TIB handles the interaction with the IdP and creates a user session on the Tyk platform.
+
+```mermaid
+sequenceDiagram
+    actor User
+    participant IDP as Identity Provider (IdP)
+    participant TIB as Tyk Identity Broker
+    participant Tyk as Tyk Dashboard / Portal
+
+    User->>TIB: Log in
+    TIB->>IDP: Verify identity
+    IDP->>TIB: Identity confirmed
+    TIB->>Tyk: Create SSO user session
+    Tyk->>User: Logged in
+```
+
+### API Token Generation
+
+An API proxy deployed on Tyk Gateway is secured using [Auth Token](/api-management/authentication/bearer-token) or [OAuth 2.0](/api-management/authentication/oauth-2). A client application authenticates its users via an external IdP, receiving a dynamically generated access token that grants access to the API proxy. There is no need for an administrator to generate the access token.
+
+```mermaid
+sequenceDiagram
+    actor User
+    participant IDP as Identity Provider (IdP)
+    participant TIB as Tyk Identity Broker
+    participant GW as Tyk Gateway / Dashboard
+
+    User->>TIB: Authenticate
+    TIB->>IDP: Verify identity
+    IDP->>TIB: Identity confirmed
+    TIB->>GW: Generate token
+    GW->>User: API access token
+```
+
+## How TIB Works
+
+Every authentication flow in TIB is driven by three core concepts: a Profile that defines the flow, a Method that determines how TIB interacts with the IdP, and an Action that determines what happens on success.
+
+### Profile
+
+A *profile* is a configuration object stored in TIB that defines a complete authentication flow. It specifies how TIB should connect to the IdP, which [method](#method) to use and therefore what protocol to follow, which [action](#actions) to take on success, and where to send the user afterwards.
+
+Profiles are managed via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or, when using embedded TIB, through the Tyk Dashboard or Portal UI.
+
+Each profile has a unique ID, which forms part of the TIB authentication URL:
+
+```
+/auth/{id}/{provider}
+```
+
+`{id}` is the unique ID of the profile. `{provider}` identifies the IdP to authenticate against - its value depends on the [authentication method](#method) configured in the profile.
+
+When a user or application makes a request to that URL, TIB loads the corresponding profile based on the provided `{id}`.
+
+Once the profile has been loaded, TIB initiates authentication with the IdP using the configured [method](#method).
+
+### Method
+
+The method defines how TIB communicates with the IdP. TIB supports two flow types and four authentication methods, one per supported protocol.
+
+**Redirect flow** - TIB redirects the user's browser to the IdP login page. The IdP authenticates the user and redirects back to TIB with the result. TIB maintains state across the redirect using a signed session cookie. See [Session Cookie](#redirect-session-cookie) for configuration details.
+
+**Passthrough flow** - TIB validates the user's credentials directly against the IdP without a browser redirect. Credentials are submitted to TIB, which proxies the validation inline.
+
+| Method | `ProviderName` | Flow |
+|---|---|---|
+| Social | `SocialProvider` | Redirect |
+| SAML | `SAMLProvider` | Redirect |
+| LDAP | `ADProvider` | Passthrough |
+| Proxy | `ProxyProvider` | Passthrough |
+
+#### Social (`SocialProvider`)
+
+Supports [OAuth 2.0](https://oauth.net/2/) and [OpenID Connect](https://openid.net/connect/)-compatible IdPs. Supports enterprise IdPs such as Auth0, Keycloak, Okta, and Microsoft Entra ID, as well as social logins such as Google, GitHub, and LinkedIn. `SocialProvider` also supports [JSON Web Encryption (JWE)](/api-management/single-sign-on-social-idp#json-web-encryption-jwe) for IdPs that encrypt their ID tokens.
+
+#### SAML (`SAMLProvider`)
+
+TIB acts as a [SAML 2.0](https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html) Service Provider. The user is redirected to the IdP, which posts a signed assertion back to TIB. Commonly used with enterprise IdPs such as Microsoft Entra ID and ADFS.
+
+#### LDAP (`ADProvider`)
+
+TIB validates the user's credentials directly against an [LDAP](https://datatracker.ietf.org/doc/html/rfc4511) server such as Active Directory or OpenLDAP. No browser redirect is involved; credentials are submitted directly to TIB.
+
+#### Proxy (`ProxyProvider`)
+
+TIB forwards the authentication request to an external HTTP endpoint and treats the response as the authentication result. Useful for integrating with custom or legacy authentication systems.
+
+### Provider Configuration
+
+Each method requires IdP-specific connection settings in the `ProviderConfig` block of the profile. This is where you configure the details TIB needs to communicate with your IdP, for example the callback URL, the client credentials, and the discovery endpoint.
+
+The structure of `ProviderConfig` depends entirely on the method:
+
+| Method | Key `ProviderConfig` fields |
+|---|---|
+| `SocialProvider` | `CallbackBaseURL`, `FailureRedirect`, `UseProviders` (array containing `Name`, `Key`, `Secret`, and optionally `DiscoverURL` for OIDC) |
+| `SAMLProvider` | `SAMLBaseURL`, `IDPMetadataURL`, `CertLocation`, `FailureRedirect` |
+| `ADProvider` | `LDAPServer`, `LDAPPort`, `LDAPUserDN`, `FailureRedirect` |
+| `ProxyProvider` | `TargetHost`, `OKCode`, `OKResponse`, `OKRegex` |
+
+For the full set of fields for each method, see the [Identity Provider guides](#what-would-you-like-to-do).
+
+### Actions
+
+The *action* defines what TIB should do after the IdP has confirmed the user's identity and is configured using the `ActionType` field in the profile.
+
+There are four actions, grouped by [use case](#use-cases):
+
+**Single Sign-On**
+
+| `ActionType` | Target | Behavior |
+|---|---|---|
+| `GenerateOrLoginUserProfile` | Tyk Dashboard or Tyk Developer Portal (admin users) | Logs a user into [Tyk Dashboard](/tyk-identity-broker/dashboard-sso) or the Developer Portal's [Admin Portal](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso). |
+| `GenerateOrLoginDeveloperProfile` | Tyk Developer Portal (API consumer users) | Logs a user into the Developer Portal's [Live Portal](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso). |
+
+For full details of the SSO use case, see:
+- [Single Sign-On for Tyk Dashboard](/tyk-identity-broker/dashboard-sso)
+- [Single Sign-On for Tyk Developer Portal](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso)
+
+**API Token Generation**
+
+| `ActionType` | Token type | Behavior |
+|---|---|---|
+| `GenerateTemporaryAuthToken` | Auth Token | Tyk generates a [Session](/api-management/access-control/sessions-and-keys/understanding-sessions) and returns the Key (auth token) to the client application. |
+| `GenerateOAuthTokenForClient` | OAuth 2.0 token | Uses the configured OAuth client to obtain an OAuth 2.0 token from Tyk Gateway's built-in authorization server on behalf of the authenticated user, and returns it to the client application via a redirect. |
+
+For full details of the API Token use case, see [Issuing Tokens using TIB](/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib).
+
+## Embedded vs Standalone TIB
+
+TIB is embedded in Tyk Dashboard (from v3.0) and Tyk Developer Portal (from v1.12.0). For most use cases you do not need to install or run TIB separately.
+
+Standalone TIB is required only in the following situations:
+
+- You are using TIB to issue API access tokens via an external IdP, which involves TIB communicating directly with Tyk Gateway.
+- You are running a version of Tyk Dashboard or Tyk Developer Portal that pre-dates the embedded TIB integration.
+- You have a specific infrastructure requirement that prevents use of the embedded TIB.
+
+If you need to run standalone TIB, see [Install Standalone TIB](/tyk-identity-broker/standalone-tib).
+
+## Redirect Session Cookie
+
+When using a [method](#method) that uses the redirect flow (`SocialProvider` or `SAMLProvider`), TIB needs to maintain state across the browser round-trip to the IdP and back, for example which profile is being used. It does this by storing a session cookie in the user's browser.
+
+The cookie is signed using HMAC-SHA256 with a secret key, which prevents it from being tampered with. The content of the cookie is base64-encoded but not encrypted, so it should not contain sensitive data. The signing key is configured via the `TYK_IB_SESSION_SECRET` environment variable.
+
+When using redirect flow with:
+
+- Embedded TIB in Tyk Dashboard, if `TYK_IB_SESSION_SECRET` is not explicitly set, Tyk Dashboard automatically falls back to its own [`admin_secret`](/tyk-dashboard/configuration#admin_secret).
+- Embedded TIB in Tyk Developer Portal, no fallback is applied and `TYK_IB_SESSION_SECRET` must be set.
+- Standalone TIB, `TYK_IB_SESSION_SECRET` must always be set.
+
+Setting `TYK_IB_SESSION_SECRET` explicitly is recommended in all production deployments.
+
+## What Would You Like to Do?
+
+<ResponsiveGrid>
+
+<Card title="SSO into Tyk Dashboard" href="/tyk-identity-broker/dashboard-sso">
+Log users into Tyk Dashboard using an external identity provider.
+</Card>
+
+<Card title="SSO into Tyk Developer Portal" href="/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso">
+Log users into Tyk Developer Portal using an external identity provider.
+</Card>
+
+<Card title="Issue API Access Tokens" href="/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib">
+Use TIB to authenticate users against an external IdP and issue auth tokens or OAuth tokens on their behalf.
+</Card>
+
+<Card title="Install Standalone" href="/tyk-identity-broker/standalone-tib">
+Install TIB when you don't want to or can't use it embedded in Tyk Dashboard or Tyk Developer Portal.
+</Card>
+
+<Card title="API Reference" href="/tyk-identity-broker/tib-rest-api">
+Manage TIB programmatically using the Tyk Identity Broker API.
+</Card>
+
+<Card title="TIB Configuration Reference" href="/tyk-configuration-reference/tyk-identity-broker-configuration">
+Full reference for the TIB configuration file (tib.conf) and environment variables.
+</Card>
+
+</ResponsiveGrid>
diff --git a/tyk-identity-broker/sso-auth0.mdx b/tyk-identity-broker/sso-auth0.mdx
new file mode 100644
index 0000000000..a99a2f9845
--- /dev/null
+++ b/tyk-identity-broker/sso-auth0.mdx
@@ -0,0 +1,251 @@
+---
+title: "SSO with Auth0"
+description: "Learn how to configure Single Sign-On (SSO) for Tyk Dashboard or Tyk Developer Portal using Auth0 via OpenID Connect (OIDC), with worked examples for Dashboard and Portal."
+keywords: "Tyk Identity Broker, TIB, SSO, Single Sign-On, Auth0, OIDC, OpenID Connect, Authentication"
+sidebarTitle: "Auth0"
+---
+
+## Introduction
+
+[Auth0](https://auth0.com/) is an OIDC-compatible identity provider. TIB connects to Auth0 using `SocialProvider` with the `openid-connect` provider type.
+
+Before configuring your IdP and TIB profile, read [Dashboard SSO](/tyk-identity-broker/dashboard-sso) or [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case.
+
+This page covers the Auth0-specific configuration only.
+
+## Configure Auth0
+
+1. Log in to the [Auth0 Dashboard](https://manage.auth0.com/) and navigate to **Applications > Applications**.
+2. Click **Create Application**, give it a name, select **Regular Web Application**, and click **Create**.
+    <img src="/img/sso-auth0/auth0-app-type.png" alt="Auth0 Application information" />
+3. From the application's **Settings** tab, note the **Domain**, **Client ID**, and **Client Secret**. You will need all three for the TIB profile.
+    <img src="/img/sso-auth0/auth0-app-basic-info.png" alt="Auth0 Application Basic information" />
+4. In the **Allowed Callback URLs** field, add the TIB callback URL:
+   ```
+   http://{tib-host}/auth/{profile-id}/openid-connect/callback
+   ```
+   Replace `{tib-host}` with the hostname of your TIB instance and `{profile-id}` with the ID you will assign to the TIB profile.
+5. Click **Save Changes**.
+
+The Auth0 OIDC discovery URL for your tenant is:
+```
+https://{auth0-domain}/.well-known/openid-configuration
+```
+
+Where `{auth0-domain}` is the **Domain** value from your Auth0 application settings (for example, `your-tenant.auth0.com`).
+
+## TIB Profile
+
+The Auth0-specific configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `SocialProvider` and `Type` to `redirect`.
+
+```json expandable
+{
+  "ProviderName": "SocialProvider",
+  "Type": "redirect",
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://{tib-host}",
+    "FailureRedirect": "http://{failure-redirect-url}",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{auth0-client-id}",
+        "Secret": "{auth0-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://{auth0-domain}/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+The Auth0-specific `ProviderConfig` fields are:
+
+| Field | Description |
+|---|---|
+| `CallbackBaseURL` | The base URL of your TIB instance. TIB appends the callback path automatically. |
+| `FailureRedirect` | URL to redirect the user to on authentication failure. |
+| `UseProviders.Name` | Must be `openid-connect`. This value routes TIB to the OpenID Connect provider implementation. |
+| `UseProviders.Key` | The Auth0 Client ID. |
+| `UseProviders.Secret` | The Auth0 Client Secret. |
+| `UseProviders.Scopes` | OAuth scopes to request. `openid` and `email` are required. |
+| `UseProviders.DiscoverURL` | The Auth0 OIDC discovery URL for your tenant. |
+
+### JSON Web Encryption (JWE)
+
+If Auth0 is configured to encrypt ID tokens, TIB can decrypt them using JWE. Add a `JWE` block to `ProviderConfig` to enable this:
+
+```json
+{
+  "ProviderConfig": {
+    "UseProviders": [...],
+    "JWE": {
+      "Enabled": true,
+      "PrivateKeyLocation": "{certificate-id-or-path}"
+    }
+  }
+}
+```
+
+For embedded TIB in Tyk Dashboard, set `PrivateKeyLocation` to the certificate ID from the Tyk Dashboard certificate manager. For standalone TIB, set it to the file path of a PEM file containing the private key. The key must correspond to the public key registered with Auth0 for token encryption.
+
+Requires Tyk Identity Broker v1.6.1+ and Tyk Dashboard v5.7.0+.
+
+## Worked Examples
+
+These examples use embedded TIB, so the `CallbackBaseURL` is the same as the Dashboard or Portal respectively; TIB handles requests on the same host and port.
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for full details.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "auth0-dashboard-oidc",
+  "Name": "Auth0 Dashboard SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://dashboard.example.com:3000",
+    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{auth0-client-id}",
+        "Secret": "{auth0-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://{auth0-domain}/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `Key` to the Auth0 **Client ID**
+- set `Secret` to the Auth0 **Client Secret**
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+
+**Auth0 callback URL**
+
+Ensure the following URL is listed in **Allowed Callback URLs** in your Auth0 application settings. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://dashboard.example.com:3000/auth/auth0-dashboard-oidc/openid-connect/callback
+```
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://dashboard.example.com:3000/auth/auth0-dashboard-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Auth0" button or link on a custom login page, rather than expecting users to navigate to it directly.
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "auth0-portal-oidc",
+  "Name": "Auth0 Portal SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://portal.example.com:3001",
+    "FailureRedirect": "http://portal.example.com:3001/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{auth0-client-id}",
+        "Secret": "{auth0-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://{auth0-domain}/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `Key` to the Auth0 **Client ID**
+- set `Secret` to the Auth0 **Client Secret**
+- set `DashboardCredential` to the [PORTAL_API_SECRET](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+
+**Auth0 callback URL**
+
+Ensure the following URL is listed in **Allowed Callback URLs** in your Auth0 application settings. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://portal.example.com:3001/auth/auth0-portal-oidc/openid-connect/callback
+```
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://portal.example.com:3001/auth/auth0-portal-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Auth0" button or link on the Portal login page.
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
diff --git a/tyk-identity-broker/sso-entra-id.mdx b/tyk-identity-broker/sso-entra-id.mdx
new file mode 100644
index 0000000000..781626eac3
--- /dev/null
+++ b/tyk-identity-broker/sso-entra-id.mdx
@@ -0,0 +1,493 @@
+---
+title: "SSO with Microsoft Entra ID"
+description: "Learn how to configure Single Sign-On (SSO) for Tyk Dashboard or Tyk Developer Portal using Microsoft Entra ID, via OpenID Connect or SAML."
+keywords: "Tyk Identity Broker, TIB, SSO, Single Sign-On, Microsoft Entra ID, Azure AD, OIDC, SAML, Authentication"
+sidebarTitle: "Microsoft Entra ID"
+---
+
+## Introduction
+
+[Microsoft Entra ID](https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id) (formerly Azure AD) supports both [OpenID Connect (OIDC)](#sso-with-openid-connect) and [SAML 2.0](#sso-with-saml).
+
+- For most new deployments, OIDC is recommended as it is simpler to configure and is Microsoft's preferred modern authentication protocol.
+- Use SAML if your organization requires it for policy or compatibility reasons.
+
+Before configuring your IdP and TIB profile, read [Dashboard SSO](/tyk-identity-broker/dashboard-sso) or [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case.
+
+This page covers the Entra ID-specific configuration only.
+
+## SSO with OpenID Connect
+
+### Configure Entra ID
+
+1. In the Azure Portal, navigate to **Microsoft Entra ID** and select **App registrations**.
+2. Select **New registration**. Give the application a name and register it.
+3. From the app's **Overview** page, note the **Application (client) ID** and **Directory (tenant) ID**. You will need both for the TIB profile.
+4. Navigate to **Certificates and secrets** and create a new **Client secret**. Copy the secret **Value** (not the Secret ID) immediately as it will not be shown again.
+    <img src="/img/azureAD/overview-1.png" alt="Entra ID app registration Overview page showing Application (client) ID and Directory (tenant) ID" />
+5. Navigate to **Authentication** and add a **Redirect URI** of type **Web**. Set it to:
+   ```
+   http://{tib-host}/auth/{profile-id}/openid-connect/callback
+   ```
+   Replace `{tib-host}` with the hostname of your TIB instance and `{profile-id}` with the ID you will assign to the TIB profile.
+
+    <img src="/img/azureAD/redirect-URL-1.png" alt="Redirect URL" />
+
+The Entra ID OIDC discovery URL for your tenant is:
+```
+https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration
+```
+
+### TIB Profile
+
+The Entra ID-specific configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `SocialProvider` and `Type` to `redirect`.
+
+```json expandable
+{
+  "ProviderName": "SocialProvider",
+  "Type": "redirect",
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://{tib-host}",
+    "FailureRedirect": "http://{failure-redirect-url}",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{entra-client-id}",
+        "Secret": "{entra-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+The Entra ID-specific `ProviderConfig` fields are:
+
+| Field | Description |
+|---|---|
+| `CallbackBaseURL` | The base URL of your TIB instance. TIB appends the callback path automatically. |
+| `FailureRedirect` | URL to redirect the user to on authentication failure. |
+| `UseProviders.Name` | Must be `openid-connect`. This value routes TIB to the OpenID Connect provider implementation. |
+| `UseProviders.Key` | The Entra ID Application (client) ID. |
+| `UseProviders.Secret` | The Entra ID client secret value. |
+| `UseProviders.Scopes` | OAuth scopes to request. `openid` and `email` are required. |
+| `UseProviders.DiscoverURL` | The Entra ID OIDC discovery URL for your tenant. |
+
+#### Custom Email Claim
+
+Tyk Dashboard identifies SSO users by their email address. If your Entra ID configuration does not return the user's email address in the standard `email` claim, you must specify the correct claim name using the `CustomEmailField` property at the root of the TIB profile.
+
+This is often required for Entra ID when the email address is returned in the `preferred_username` or `upn` claims instead of `email`.
+
+```json
+{
+  "CustomEmailField": "preferred_username",
+  "ProviderName": "SocialProvider",
+  "Type": "redirect",
+  "ProviderConfig": {
+    // ...
+  }
+}
+```
+
+For more details on profile configuration, see the [Dashboard SSO](/tyk-identity-broker/dashboard-sso#profile-configuration) documentation.
+
+#### JSON Web Encryption (JWE)
+
+If Entra ID is configured to encrypt ID tokens, TIB can decrypt them using JWE. Add a `JWE` block to `ProviderConfig` to enable this:
+
+```json
+{
+  "ProviderConfig": {
+    "UseProviders": [...],
+    "JWE": {
+      "Enabled": true,
+      "PrivateKeyLocation": "{certificate-id-or-path}"
+    }
+  }
+}
+```
+
+For embedded TIB in Tyk Dashboard, set `PrivateKeyLocation` to the certificate ID from the Tyk Dashboard certificate manager. For standalone TIB, set it to the file path of a PEM file containing the private key. The key must correspond to the public key registered with Entra ID for token encryption.
+
+Requires Tyk Identity Broker v1.6.1+ and Tyk Dashboard v5.7.0+.
+
+### Worked Examples (OIDC)
+
+These examples use embedded TIB, so the `CallbackBaseURL` is the same as the Dashboard or Portal respectively; TIB handles requests on the same host and port.
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for full details.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "entra-dashboard-oidc",
+  "Name": "Entra ID Dashboard SSO (OIDC)",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://dashboard.example.com:3000",
+    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{entra-client-id}",
+        "Secret": "{entra-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `Key` to the Entra ID **Application (client) ID**
+- set `Secret` to the Entra ID client secret **Value**
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+
+**Entra ID redirect URI**
+
+Ensure the following URL is listed in your Entra ID app registration under **Authentication > Redirect URIs**. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://dashboard.example.com:3000/auth/entra-dashboard-oidc/openid-connect/callback
+```
+
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://dashboard.example.com:3000/auth/entra-dashboard-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Entra ID" button or link on a custom login page, rather than expecting users to navigate to it directly.
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "entra-portal-oidc",
+  "Name": "Entra ID Portal SSO (OIDC)",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://portal.example.com:3001",
+    "FailureRedirect": "http://portal.example.com:3001/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{entra-client-id}",
+        "Secret": "{entra-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `Key` to the Entra ID **Application (client) ID**
+- set `Secret` to the Entra ID client secret **Value**
+- set `DashboardCredential` to the [PORTAL_API_SECRET](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+
+**Entra ID redirect URI**
+
+Ensure the following URL is listed in your Entra ID app registration under **Authentication > Redirect URIs**. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://portal.example.com:3001/auth/entra-portal-oidc/openid-connect/callback
+```
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://portal.example.com:3001/auth/entra-portal-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Entra ID" button or link on the Portal login page.
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
+
+## SSO with SAML
+
+### Configure Entra ID
+
+1. In the Azure Portal, navigate to **Microsoft Entra ID** and select **Enterprise applications**.
+2. Select **New application** and then **Create your own application**. Give it a name and select **Integrate any other application you don't find in the gallery**.
+3. Navigate to **Single sign-on** and select **SAML**.
+4. TIB exposes a SAML Service Provider (SP) metadata endpoint for each profile. For embedded TIB, this is on the same host as the Tyk Dashboard (or Developer Portal), for example:
+   ```
+   http://dashboard.example.com:3000/auth/{profile-id}/saml/metadata
+   ```
+   You can use this URL to configure Entra ID automatically, or manually set the **Entity ID** and **Reply URL (ACS URL)**. The ACS URL is:
+   ```
+   http://dashboard.example.com:3000/auth/{profile-id}/saml/callback
+   ```
+5. From the **SAML Certificates** section, copy the **App Federation Metadata URL**. You will need this for the TIB profile `IDPMetadataURL` field.
+6. Under **Attributes and Claims**, ensure the email claim is mapped. By default Entra ID maps email to `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`.
+
+### TIB Profile
+
+The Entra ID-specific configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `SAMLProvider` and `Type` to `redirect`.
+
+```json expandable
+{
+  "ProviderName": "SAMLProvider",
+  "Type": "redirect",
+  "ProviderConfig": {
+    "SAMLBaseURL": "http://{tib-host}",
+    "IDPMetadataURL": "https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml",
+    "CertLocation": "/path/to/sp-cert-and-key.pem",
+    "FailureRedirect": "http://{failure-redirect-url}",
+    "SAMLEmailClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
+    "SAMLForenameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
+    "SAMLSurnameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
+    "ForceAuthentication": false
+  }
+}
+```
+
+The Entra ID-specific `ProviderConfig` fields are:
+
+| Field | Description |
+|---|---|
+| `SAMLBaseURL` | The base URL of your TIB instance. Used to construct the SP metadata and ACS URLs. |
+| `IDPMetadataURL` | The Entra ID federation metadata URL for your tenant. |
+| `CertLocation` | Path to a PEM file containing the SP certificate and private key concatenated. When using Tyk Dashboard with embedded TIB, this can be a certificate ID from the Tyk Certificate Store. |
+| `SAMLEmailClaim` | The SAML claim name for the user's email address. |
+| `SAMLForenameClaim` | The SAML claim name for the user's first name. |
+| `SAMLSurnameClaim` | The SAML claim name for the user's last name. |
+| `ForceAuthentication` | Set to `true` to force Entra ID to re-authenticate the user on every request, ignoring any existing session. |
+
+### Worked Examples (SAML)
+
+These examples use embedded TIB, so `SAMLBaseURL` is the same as the Dashboard or Portal respectively. TIB handles requests on the same host and port.
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for full details.
+
+**Certificate**
+
+Upload the Service Provider certificate pair that will be used to sign SAML requests to the Tyk Certificate Store (**API Security > TLS/SSL Certificates**), noting the assigned certificate ID to be used in the TIB profile.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "entra-dashboard-saml",
+  "Name": "Entra ID Dashboard SSO (SAML)",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "redirect",
+  "ProviderName": "SAMLProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "SAMLBaseURL": "http://dashboard.example.com:3000",
+    "IDPMetadataURL": "https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml",
+    "CertLocation": "{certificate-id-from-dashboard}",
+    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
+    "SAMLEmailClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
+    "SAMLForenameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
+    "SAMLSurnameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
+    "ForceAuthentication": false
+  }
+}
+```
+
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+- set `CertLocation` to the certificate ID for the SAML SP certificate
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://dashboard.example.com:3000/auth/entra-dashboard-saml/saml
+```
+
+In production, present this as a "Log in with Entra ID" button or link on a custom login page, rather than expecting users to navigate to it directly.
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**Certificate**
+
+Unlike the Dashboard, the Portal's embedded TIB loads certificates from the filesystem rather than from a certificate store. Set `CertLocation` to the file path of a PEM file containing the SP certificate and private key concatenated, accessible on the server running the Portal.
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "entra-portal-saml",
+  "Name": "Entra ID Portal SSO (SAML)",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "redirect",
+  "ProviderName": "SAMLProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "SAMLBaseURL": "http://portal.example.com:3001",
+    "IDPMetadataURL": "https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml",
+    "CertLocation": "/path/to/sp-cert-and-key.pem",
+    "FailureRedirect": "http://portal.example.com:3001/?fail=true",
+    "SAMLEmailClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
+    "SAMLForenameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
+    "SAMLSurnameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
+    "ForceAuthentication": false
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `CertLocation` to the file path of the SP certificate PEM file on the Portal server
+- set `DashboardCredential` to the [PORTAL_API_SECRET](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://portal.example.com:3001/auth/entra-portal-saml/saml
+```
+
+In production, present this as a "Log in with Entra ID" button or link on the Portal login page.
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
+
+## Active Directory Federation Services (ADFS)
+
+Active Directory Federation Services (ADFS) is Microsoft's on-premises federation service. It uses the same SAML 2.0 protocol as Entra ID. Follow the [SSO with SAML](#sso-with-saml) instructions above, with the following differences:
+
+**Configure ADFS (replaces "Configure Entra ID")**
+
+Instead of configuring an Enterprise Application in the Azure Portal, configure a Relying Party Trust in the ADFS management console. Provide the TIB SP metadata URL to configure the trust automatically:
+
+```
+http://{tib-host}/auth/{profile-id}/saml/metadata
+```
+
+**TIB profile differences**
+
+- `IDPMetadataURL` - use the ADFS federation metadata endpoint instead:
+  ```
+  https://{adfs-host}/FederationMetadata/2007-06/FederationMetadata.xml
+  ```
+- `SAMLEmailClaim`, `SAMLForenameClaim`, `SAMLSurnameClaim` - ADFS claim URIs depend on your claim issuance policy and may differ from the Entra ID defaults. Check the claims configured in your ADFS Relying Party Trust and update these values accordingly.
+
+All other profile fields, worked examples, and login URL patterns are identical to the SAML section above.
diff --git a/tyk-identity-broker/sso-keycloak.mdx b/tyk-identity-broker/sso-keycloak.mdx
new file mode 100644
index 0000000000..2b5e46a743
--- /dev/null
+++ b/tyk-identity-broker/sso-keycloak.mdx
@@ -0,0 +1,259 @@
+---
+title: "SSO with Keycloak"
+description: "Learn how to configure Single Sign-On (SSO) for Tyk Dashboard or Tyk Developer Portal using Keycloak via OpenID Connect (OIDC), with worked examples for Dashboard and Portal."
+keywords: "Tyk Identity Broker, TIB, SSO, Single Sign-On, Keycloak, OIDC, OpenID Connect, Authentication"
+sidebarTitle: "Keycloak"
+---
+
+## Introduction
+
+[Keycloak](https://www.keycloak.org/) is an open-source identity provider that supports OpenID Connect. TIB connects to Keycloak using `SocialProvider` with the `openid-connect` provider type.
+
+Before configuring your IdP and TIB profile, read [Dashboard SSO](/tyk-identity-broker/dashboard-sso) or [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case.
+
+This page covers the Keycloak-specific configuration only.
+
+## Configure Keycloak
+
+1. In your Keycloak Admin Console, navigate to the realm you want to use and select **Clients**.
+   <img src="/img/keycloak-sso/create-client.png" alt="Create Client" />
+
+2. Click **Create client**, set the **Client type** to **OpenID Connect**, enter a **Client ID**, and click **Next**.
+   <img src="/img/keycloak-sso/create-client2.png" alt="Set Client Type and ID" />
+
+3. Enable **Client authentication** and click **Next**, then **Save**.
+   <img src="/img/keycloak-sso/enable-client-auth.png" alt="Enable Client Auth" />
+
+4. From the client's **Credentials** tab, copy the **Client Secret**.
+   <img src="/img/keycloak-sso/retrieve-client-secret.png" alt="Retrieve Client Secret" />
+
+5. From the client's **Settings** tab, add the TIB callback URL to **Valid redirect URIs**:
+   ```
+   http://{tib-host}/auth/{profile-id}/openid-connect/callback
+   ```
+   Replace `{tib-host}` with the hostname of your TIB instance and `{profile-id}` with the ID you will assign to the TIB profile.
+6. Click **Save**.
+
+The Keycloak OIDC discovery URL for your realm is accessible from **Realm Settings > General > OpenID Endpoint Configuration**:
+```
+https://{keycloak-host}/realms/{realm-name}/.well-known/openid-configuration
+```
+
+   <img src="/img/keycloak-sso/realm-discovery-endpoint.png" alt="Keycloak discovery endpoint" />
+
+
+## TIB Profile
+
+The Keycloak-specific configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `SocialProvider` and `Type` to `redirect`.
+
+```json expandable
+{
+  "ProviderName": "SocialProvider",
+  "Type": "redirect",
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://{tib-host}",
+    "FailureRedirect": "http://{failure-redirect-url}",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{keycloak-client-id}",
+        "Secret": "{keycloak-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://{keycloak-host}/realms/{realm-name}/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+The Keycloak-specific `ProviderConfig` fields are:
+
+| Field | Description |
+|---|---|
+| `CallbackBaseURL` | The base URL of your TIB instance. TIB appends the callback path automatically. |
+| `FailureRedirect` | URL to redirect the user to on authentication failure. |
+| `UseProviders.Name` | Must be `openid-connect`. This value routes TIB to the OpenID Connect provider implementation. |
+| `UseProviders.Key` | The Keycloak Client ID. |
+| `UseProviders.Secret` | The Keycloak Client Secret. |
+| `UseProviders.Scopes` | OAuth scopes to request. `openid` and `email` are required. |
+| `UseProviders.DiscoverURL` | The Keycloak OIDC discovery URL for your realm. |
+
+### JSON Web Encryption (JWE)
+
+If Keycloak is configured to encrypt ID tokens, TIB can decrypt them using JWE. Add a `JWE` block to `ProviderConfig` to enable this:
+
+```json
+{
+  "ProviderConfig": {
+    "UseProviders": [...],
+    "JWE": {
+      "Enabled": true,
+      "PrivateKeyLocation": "{certificate-id-or-path}"
+    }
+  }
+}
+```
+
+For embedded TIB in Tyk Dashboard, set `PrivateKeyLocation` to the certificate ID from the Tyk Dashboard certificate manager. For standalone TIB, set it to the file path of a PEM file containing the private key. The key must correspond to the public key registered with Keycloak for token encryption.
+
+Requires Tyk Identity Broker v1.6.1+ and Tyk Dashboard v5.7.0+.
+
+## Worked Examples
+
+These examples use embedded TIB, so the `CallbackBaseURL` is the same as the Dashboard or Portal respectively; TIB handles requests on the same host and port.
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for full details.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "keycloak-dashboard-oidc",
+  "Name": "Keycloak Dashboard SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://dashboard.example.com:3000",
+    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{keycloak-client-id}",
+        "Secret": "{keycloak-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://{keycloak-host}/realms/{realm-name}/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `Key` to the Keycloak **Client ID**
+- set `Secret` to the Keycloak **Client Secret**
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+
+**Keycloak redirect URI**
+
+Ensure the following URL is listed in **Valid redirect URIs** in your Keycloak client settings. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://dashboard.example.com:3000/auth/keycloak-dashboard-oidc/openid-connect/callback
+```
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://dashboard.example.com:3000/auth/keycloak-dashboard-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Keycloak" button or link on a custom login page, rather than expecting users to navigate to it directly.
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "keycloak-portal-oidc",
+  "Name": "Keycloak Portal SSO",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://portal.example.com:3001",
+    "FailureRedirect": "http://portal.example.com:3001/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{keycloak-client-id}",
+        "Secret": "{keycloak-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://{keycloak-host}/realms/{realm-name}/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `Key` to the Keycloak **Client ID**
+- set `Secret` to the Keycloak **Client Secret**
+- set `DashboardCredential` to the [PORTAL_API_SECRET](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+
+**Keycloak redirect URI**
+
+Ensure the following URL is listed in **Valid redirect URIs** in your Keycloak client settings. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://portal.example.com:3001/auth/keycloak-portal-oidc/openid-connect/callback
+```
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://portal.example.com:3001/auth/keycloak-portal-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Keycloak" button or link on the Portal login page.
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
diff --git a/tyk-identity-broker/sso-okta.mdx b/tyk-identity-broker/sso-okta.mdx
new file mode 100644
index 0000000000..0e6da3e915
--- /dev/null
+++ b/tyk-identity-broker/sso-okta.mdx
@@ -0,0 +1,448 @@
+---
+title: "SSO with Okta"
+description: "Learn how to configure Single Sign-On (SSO) for Tyk Dashboard or Tyk Developer Portal using Okta, via OpenID Connect or SAML."
+keywords: "Tyk Identity Broker, TIB, SSO, Single Sign-On, Okta, OIDC, SAML, Authentication"
+sidebarTitle: "Okta"
+---
+
+## Introduction
+
+[Okta](https://www.okta.com/) supports both [OpenID Connect (OIDC)](#sso-with-openid-connect) and [SAML 2.0](#sso-with-saml).
+
+- For most new deployments, OIDC is recommended as it is simpler to configure.
+- Use SAML if your organization requires it for policy or compatibility reasons.
+
+Before configuring your IdP and TIB profile, read [Dashboard SSO](/tyk-identity-broker/dashboard-sso) or [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case.
+
+This page covers the Okta-specific configuration only.
+
+## SSO with OpenID Connect
+
+### Configure Okta
+
+1. Log in to your Okta Admin Console and navigate to **Applications > Applications**.
+2. Click **Create App Integration**, select **OIDC - OpenID Connect** as the sign-in method and **Web Application** as the application type, then click **Next**.
+3. Give the application a name.
+4. Under **Sign-in redirect URIs**, add the TIB callback URL:
+   ```
+   http://{tib-host}/auth/{profile-id}/openid-connect/callback
+   ```
+   Replace `{tib-host}` with the hostname of your TIB instance and `{profile-id}` with the ID you will assign to the TIB profile.
+5. Under **Assignments**, configure which users or groups can access the application.
+6. Click **Save**.
+7. From the application's **General** tab, note the **Client ID** and **Client Secret**.
+
+The Okta OIDC discovery URL for your org is:
+```
+https://{okta-domain}/.well-known/openid-configuration
+```
+
+Where `{okta-domain}` is your Okta org domain (for example, `your-org.okta.com`). If you are using a custom Authorization Server, the discovery URL is:
+```
+https://{okta-domain}/oauth2/{auth-server-id}/.well-known/openid-configuration
+```
+
+### TIB Profile
+
+The Okta-specific configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `SocialProvider` and `Type` to `redirect`.
+
+```json expandable
+{
+  "ProviderName": "SocialProvider",
+  "Type": "redirect",
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://{tib-host}",
+    "FailureRedirect": "http://{failure-redirect-url}",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{okta-client-id}",
+        "Secret": "{okta-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://{okta-domain}/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+The Okta-specific `ProviderConfig` fields are:
+
+| Field | Description |
+|---|---|
+| `CallbackBaseURL` | The base URL of your TIB instance. TIB appends the callback path automatically. |
+| `FailureRedirect` | URL to redirect the user to on authentication failure. |
+| `UseProviders.Name` | Must be `openid-connect`. This value routes TIB to the OpenID Connect provider implementation. |
+| `UseProviders.Key` | The Okta Client ID. |
+| `UseProviders.Secret` | The Okta Client Secret. |
+| `UseProviders.Scopes` | OAuth scopes to request. `openid` and `email` are required. |
+| `UseProviders.DiscoverURL` | The Okta OIDC discovery URL for your org or Authorization Server. |
+
+#### JSON Web Encryption (JWE)
+
+If Okta is configured to encrypt ID tokens, TIB can decrypt them using JWE. Add a `JWE` block to `ProviderConfig` to enable this:
+
+```json
+{
+  "ProviderConfig": {
+    "UseProviders": [...],
+    "JWE": {
+      "Enabled": true,
+      "PrivateKeyLocation": "{certificate-id-or-path}"
+    }
+  }
+}
+```
+
+For embedded TIB in Tyk Dashboard, set `PrivateKeyLocation` to the certificate ID from the Tyk Dashboard certificate manager. For standalone TIB, set it to the file path of a PEM file containing the private key. The key must correspond to the public key registered with Okta for token encryption.
+
+Requires Tyk Identity Broker v1.6.1+ and Tyk Dashboard v5.7.0+.
+
+### Worked Examples (OIDC)
+
+These examples use embedded TIB, so the `CallbackBaseURL` is the same as the Dashboard or Portal respectively; TIB handles requests on the same host and port.
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for full details.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "okta-dashboard-oidc",
+  "Name": "Okta Dashboard SSO (OIDC)",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://dashboard.example.com:3000",
+    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{okta-client-id}",
+        "Secret": "{okta-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://{okta-domain}/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `Key` to the Okta **Client ID**
+- set `Secret` to the Okta **Client Secret**
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+
+**Okta redirect URI**
+
+Ensure the following URL is listed in **Sign-in redirect URIs** in your Okta application settings. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://dashboard.example.com:3000/auth/okta-dashboard-oidc/openid-connect/callback
+```
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://dashboard.example.com:3000/auth/okta-dashboard-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Okta" button or link on a custom login page, rather than expecting users to navigate to it directly.
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "okta-portal-oidc",
+  "Name": "Okta Portal SSO (OIDC)",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "redirect",
+  "ProviderName": "SocialProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "CallbackBaseURL": "http://portal.example.com:3001",
+    "FailureRedirect": "http://portal.example.com:3001/?fail=true",
+    "UseProviders": [
+      {
+        "Name": "openid-connect",
+        "Key": "{okta-client-id}",
+        "Secret": "{okta-client-secret}",
+        "Scopes": ["openid", "email", "profile"],
+        "DiscoverURL": "https://{okta-domain}/.well-known/openid-configuration"
+      }
+    ]
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `Key` to the Okta **Client ID**
+- set `Secret` to the Okta **Client Secret**
+- set `DashboardCredential` to the [PORTAL_API_SECRET](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+
+**Okta redirect URI**
+
+Ensure the following URL is listed in **Sign-in redirect URIs** in your Okta application settings. The `ID` in the registered URL must exactly match the `ID` in your TIB profile; a mismatch will result in a `400 Bad Request` error:
+
+```
+http://portal.example.com:3001/auth/okta-portal-oidc/openid-connect/callback
+```
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://portal.example.com:3001/auth/okta-portal-oidc/openid-connect
+```
+
+In production, present this as a "Log in with Okta" button or link on the Portal login page.
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
+
+## SSO with SAML
+
+### Configure Okta
+
+1. In the Okta Admin Console, navigate to **Applications > Applications** and click **Create App Integration**.
+2. Select **SAML 2.0** as the sign-in method and click **Next**.
+3. Give the application a name and click **Next**.
+4. In the **SAML Settings** section, set the following. For embedded TIB, the values are based on your Dashboard or Portal host:
+   - **Single sign-on URL** (ACS URL): `http://{tib-host}/auth/{profile-id}/saml/callback`
+   - **Audience URI (SP Entity ID)**: `http://{tib-host}/auth/{profile-id}/saml/metadata`
+5. Under **Attribute Statements**, map the email attribute. Add a statement with name `email` and value `user.email`.
+6. Click **Next**, complete the feedback form, and click **Finish**.
+7. From the application's **Sign On** tab, copy the **Metadata URL**. You will need this for `IDPMetadataURL` in the TIB profile.
+
+### TIB Profile
+
+The Okta-specific configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `SAMLProvider` and `Type` to `redirect`.
+
+```json expandable
+{
+  "ProviderName": "SAMLProvider",
+  "Type": "redirect",
+  "ProviderConfig": {
+    "SAMLBaseURL": "http://{tib-host}",
+    "IDPMetadataURL": "https://{okta-domain}/app/{app-id}/sso/saml/metadata",
+    "CertLocation": "/path/to/sp-cert-and-key.pem",
+    "FailureRedirect": "http://{failure-redirect-url}",
+    "SAMLEmailClaim": "email",
+    "SAMLForenameClaim": "firstName",
+    "SAMLSurnameClaim": "lastName",
+    "ForceAuthentication": false
+  }
+}
+```
+
+| Field | Description |
+|---|---|
+| `SAMLBaseURL` | The base URL of your TIB instance. Used to construct the SP metadata and ACS URLs. |
+| `IDPMetadataURL` | The Okta application SAML metadata URL from step 7. |
+| `CertLocation` | Path to a PEM file containing the SP certificate and private key concatenated. When using Tyk Dashboard with embedded TIB, this can be a certificate ID from the Tyk Certificate Store. |
+| `SAMLEmailClaim` | The SAML attribute name for the user's email address, as configured in Okta's Attribute Statements. |
+| `SAMLForenameClaim` | The SAML attribute name for the user's first name. |
+| `SAMLSurnameClaim` | The SAML attribute name for the user's last name. |
+| `ForceAuthentication` | Set to `true` to force Okta to re-authenticate the user on every request. |
+
+### Worked Examples (SAML)
+
+These examples use embedded TIB, so `SAMLBaseURL` is the same as the Dashboard or Portal respectively; TIB handles requests on the same host and port.
+
+<Tabs>
+<Tab title="Dashboard SSO">
+
+In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own.
+
+**Tyk Dashboard configuration**
+
+```json
+{
+  "sso_enable_user_lookup": true,
+  "sso_permission_defaults": {
+    "apis": "write",
+    "keys": "write",
+    "policies": "write"
+  },
+  "sso_default_group_id": "{tyk-user-group-id}"
+}
+```
+
+With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for full details.
+
+**Certificate**
+
+Upload the Service Provider certificate pair to the Tyk Certificate Store (**API Security > TLS/SSL Certificates**), noting the assigned certificate ID to be used in the TIB profile.
+
+**TIB profile**
+
+The TIB profile is created via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) or the [Tyk Dashboard UI](/tyk-identity-broker/dashboard-sso#create-a-tib-profile-using-dashboard-ui).
+
+```json expandable
+{
+  "ID": "okta-dashboard-saml",
+  "Name": "Okta Dashboard SSO (SAML)",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginUserProfile",
+  "Type": "redirect",
+  "ProviderName": "SAMLProvider",
+  "ReturnURL": "http://dashboard.example.com:3000/tap",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{tib-service-user-api-key}"
+  },
+  "ProviderConfig": {
+    "SAMLBaseURL": "http://dashboard.example.com:3000",
+    "IDPMetadataURL": "https://{okta-domain}/app/{app-id}/sso/saml/metadata",
+    "CertLocation": "{certificate-id-from-dashboard}",
+    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
+    "SAMLEmailClaim": "email",
+    "SAMLForenameClaim": "firstName",
+    "SAMLSurnameClaim": "lastName",
+    "ForceAuthentication": false
+  }
+}
+```
+
+- set `DashboardCredential` to the [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard credentials
+- set `CertLocation` to the certificate ID from the Tyk Certificate Store
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://dashboard.example.com:3000/auth/okta-dashboard-saml/saml
+```
+
+In production, present this as a "Log in with Okta" button or link on a custom login page, rather than expecting users to navigate to it directly.
+
+See [Dashboard SSO](/tyk-identity-broker/dashboard-sso) for details on session behavior, permissions, and user group mapping.
+
+</Tab>
+<Tab title="Portal SSO">
+
+In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own.
+
+**Tyk Developer Portal configuration**
+
+Enable embedded TIB in the Portal configuration:
+
+```json
+{
+  "TIB": {
+    "Enable": true
+  }
+}
+```
+
+**Certificate**
+
+Unlike the Dashboard, the Portal's embedded TIB loads certificates from the filesystem. Set `CertLocation` to the file path of a PEM file containing the SP certificate and private key concatenated, accessible on the server running the Portal.
+
+**TIB profile**
+
+The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**.
+
+```json expandable
+{
+  "ID": "okta-portal-saml",
+  "Name": "Okta Portal SSO (SAML)",
+  "OrgID": "{tyk-org-id}",
+  "ActionType": "GenerateOrLoginDeveloperProfile",
+  "Type": "redirect",
+  "ProviderName": "SAMLProvider",
+  "ReturnURL": "http://portal.example.com:3001/sso",
+  "IdentityHandlerConfig": {
+    "DashboardCredential": "{portal-api-secret}"
+  },
+  "ProviderConfig": {
+    "SAMLBaseURL": "http://portal.example.com:3001",
+    "IDPMetadataURL": "https://{okta-domain}/app/{app-id}/sso/saml/metadata",
+    "CertLocation": "/path/to/sp-cert-and-key.pem",
+    "FailureRedirect": "http://portal.example.com:3001/?fail=true",
+    "SAMLEmailClaim": "email",
+    "SAMLForenameClaim": "firstName",
+    "SAMLSurnameClaim": "lastName",
+    "ForceAuthentication": false
+  }
+}
+```
+
+- set `ActionType` and `OrgID` based on the audience:
+    - Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"`
+    - Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required
+- set `CertLocation` to the file path of the SP certificate PEM file on the Portal server
+- set `DashboardCredential` to the [PORTAL_API_SECRET](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API
+
+**Login URL**
+
+This URL initiates the SSO login flow:
+
+```
+http://portal.example.com:3001/auth/okta-portal-saml/saml
+```
+
+In production, present this as a "Log in with Okta" button or link on the Portal login page.
+
+For details on user group mapping and admin vs developer profiles, see [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso).
+
+</Tab>
+</Tabs>
diff --git a/tyk-identity-broker/standalone-tib.mdx b/tyk-identity-broker/standalone-tib.mdx
new file mode 100644
index 0000000000..3fd7ebc9de
--- /dev/null
+++ b/tyk-identity-broker/standalone-tib.mdx
@@ -0,0 +1,246 @@
+---
+title: "Standalone Tyk Identity Broker"
+description: "Learn how to install and configure Tyk Identity Broker (TIB) as a standalone service using Docker, Linux packages, or Kubernetes, including Redis and profile storage setup."
+keywords: "Tyk Identity Broker, TIB, installation, standalone, Docker, Helm, Kubernetes, packages"
+sidebarTitle: "Standalone TIB"
+---
+
+This guide covers the installation of Tyk Identity Broker (TIB) as a standalone service, which is required for the [OAuth token generation](/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib#issuing-oauth-tokens) use case where TIB communicates directly with Tyk Gateway on behalf of authenticated users.
+
+<Note>
+If you are setting up Single Sign-On for Tyk Dashboard or Tyk Developer Portal, TIB is already embedded in those products and you do not need to follow this guide. See [SSO into Tyk Dashboard](/tyk-identity-broker/dashboard-sso) or [SSO into Tyk Developer Portal](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) instead.
+</Note>
+
+## Prerequisites
+
+- Redis
+- And either:
+  - Tyk Gateway v1.9.1+ (for the `GenerateOAuthTokenForClient` action)
+  - Tyk Dashboard v0.9.7.1+ (for the `GenerateTemporaryAuthToken` action)
+
+## Installation
+
+### Docker
+
+Pull and run the TIB image from [Docker Hub](https://hub.docker.com/r/tykio/tyk-identity-broker/), which includes full run instructions and a reference for passing configuration via environment variables.
+
+### Linux Packages
+
+Install via [deb or rpm packages](https://packagecloud.io/tyk/tyk-identity-broker/install#bash-deb) on packagecloud.
+
+### Kubernetes
+
+The Tyk Helm charts do not include a standalone TIB deployment. If you need to run standalone TIB in Kubernetes, deploy it using the [Docker image](https://hub.docker.com/r/tykio/tyk-identity-broker/) and provide your own Kubernetes manifests. When deploying in Kubernetes, you must pass configuration via [environment variables](/tyk-configuration-reference/tyk-identity-broker-configuration).
+
+To manage TIB profiles in Kubernetes, mount `profiles.json` from a ConfigMap:
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tib-profiles
+data:
+  profiles.json: |
+    [ ]
+```
+
+Mount the ConfigMap into the TIB pod and pass the path via the `-p` flag:
+
+```yaml expandable
+containers:
+  - name: tib
+    image: tykio/tyk-identity-broker:{version}  # replace with a specific version tag
+    args: ["-c", "/etc/tib/tib.conf", "-p", "/etc/tib/profiles.json"]
+    volumeMounts:
+      - name: tib-profiles
+        mountPath: /etc/tib/profiles.json
+        subPath: profiles.json
+volumes:
+  - name: tib-profiles
+    configMap:
+      name: tib-profiles
+```
+
+For profile content, see [SSO into Tyk Dashboard](/tyk-identity-broker/dashboard-sso), [SSO into Tyk Developer Portal](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso), or [Issuing Tokens via TIB](/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib).
+
+<Note>
+When profiles are loaded from a file, changes made via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) are written back to the mounted file. However, changes made directly to the ConfigMap will not take effect until the pod is restarted.
+</Note>
+
+## Starting TIB
+
+TIB is started from the command line with two configurable options:
+
+- **Configuration**: via `tib.conf` (pass the path with `-c`, defaults to `tib.conf` in the current directory) or [environment variables](/tyk-configuration-reference/tyk-identity-broker-configuration). See [Configuration](#configuration).
+- **Profile location**: from a file (pass the path with `-p`, defaults to `profiles.json` in the current directory) or from MongoDB. See [Profile Storage](#profile-storage).
+
+For file-based profile storage:
+
+```bash
+./tyk-identity-broker -c /path/to/tib.conf -p /path/to/profiles.json
+```
+
+For MongoDB profile storage, the `-p` flag is not required:
+
+```bash
+./tyk-identity-broker -c /path/to/tib.conf
+```
+
+## Configuration
+
+TIB is configured via the `tib.conf` configuration file. All settings can alternatively be provided as environment variables. One exception: the [Session Cookie Secret](#session-cookie-secret) must always be set as an environment variable and cannot be configured in `tib.conf`.
+
+<Note>
+Environment variables are always applied and take precedence over values in `tib.conf`. Set [`TYK_IB_OMITCONFIGFILE=true`](/tyk-configuration-reference/tyk-identity-broker-configuration#omitting-the-configuration-file) if you want to ensure no values from a config file are used at all - useful in containerized deployments where configuration is managed entirely via environment variables.
+</Note>
+
+### Management API Secret
+
+The `Secret` field sets the secret used to authenticate requests to the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api). This is required.
+
+```json
+{
+  "Secret": "{tib-api-secret}"
+}
+```
+
+### TLS
+
+The `HttpServerOptions` section controls how TIB listens for incoming requests. SSL (TLS) is strongly recommended for production deployments.
+
+```json
+{
+  "HttpServerOptions": {
+    "UseSSL": true,
+    "CertFile": "./certs/server.pem",
+    "KeyFile": "./certs/server.key"
+  }
+}
+```
+
+### Profile Storage
+
+Tyk Identity Broker can load [profiles](/tyk-identity-broker/overview#profile) from either a local file or from a MongoDB instance. After being loaded, profiles are held in memory at runtime regardless of the storage type. After every create, update, or delete operation via the Tyk Identity Broker API, TIB writes the updated profile set back to the source.
+
+**Local Storage**
+
+The default behavior is to load profiles from the file specified by the `-p` flag on startup.
+
+Any updates to the profiles are written back to the same file.
+
+<Note>
+Configure [`ProfileDir`](/tyk-configuration-reference/tyk-identity-broker-configuration#profiledir) with a directory path where timestamped backups of the previous `profiles.json` will be created before the file is overwritten. This prevents data loss if a write fails or profiles need to be rolled back.
+</Note>
+
+Changes made via the [Tyk Identity Broker API](/tyk-identity-broker/tib-rest-api) take effect immediately; TIB updates its in-memory store and writes the change back to `profiles.json` without requiring a restart. If you edit `profiles.json` directly on disk, TIB must be restarted to pick up the changes.
+
+**MongoDB Storage**
+
+To load profiles from MongoDB instead, add a [`Storage`](/tyk-configuration-reference/tyk-identity-broker-configuration#storage) block to the TIB config. Only `mongo_url` and `db_name` are required:
+
+```json
+{
+  "Storage": {
+    "storage_type": "mongo",
+    "mongo": {
+      "mongo_url": "mongodb://localhost:27017",
+      "db_name": "tib"
+    }
+  }
+}
+```
+
+The following optional settings are also available:
+
+| Field | Description |
+|---|---|
+| `mongo_use_ssl` | Set to `true` to enable TLS for the MongoDB connection. TIB will verify the server certificate against system CAs. |
+| `mongo_ssl_insecure_skip_verify` | Skip TLS certificate verification. Not recommended for production. |
+| `session_consistency` | MongoDB session consistency level. |
+| `driver` | MongoDB driver to use: `mongo-go` (default) or `mgo`. |
+| `direct_connection` | Set to `true` to connect directly to a single MongoDB host, bypassing replica set discovery. |
+
+Any updates to the profiles are written back to the MongoDB collection.
+
+### Identity Cache
+
+TIB uses Redis to cache the one-token-per-user mapping for API token generation. The connection is configured via the `BackEnd.IdentityBackendSettings` block and is required regardless of how profiles are stored.
+
+For a single Redis server, only `Host` and `Port` are required:
+
+```json
+{
+  "BackEnd": {
+    "IdentityBackendSettings": {
+      "Host": "localhost",
+      "Port": 6379
+    }
+  }
+}
+```
+
+The following optional settings are also available:
+
+| Field | Description |
+|---|---|
+| `Password` | Redis authentication password. |
+| `Username` | Redis 6+ ACL username. |
+| `Database` | Redis database index. Defaults to `0`. |
+| `MaxActive` | Maximum number of connections in the pool per node. Defaults to 500. |
+| `Timeout` | Timeout in seconds applied to dial, read, and write operations. Defaults to 5 seconds. |
+| `Addrs` | List of `host:port` addresses. Use instead of `Host`/`Port` for Redis Cluster or Sentinel. |
+| `EnableCluster` | Set to `true` to enable Redis Cluster mode. |
+| `MasterName` | Redis Sentinel master name. |
+| `SentinelPassword` | Redis Sentinel authentication password. |
+| `UseSSL` | Set to `true` to enable TLS. Server certificate is verified against system CAs by default. |
+| `CAFile` | Path to a custom CA certificate file. Use when the Redis server uses a self-signed or private CA certificate. |
+| `CertFile` | Path to the client certificate file. Set together with `KeyFile` to enable mutual TLS (mTLS). |
+| `KeyFile` | Path to the client key file. Set together with `CertFile` to enable mutual TLS (mTLS). |
+| `SSLInsecureSkipVerify` | Skip TLS certificate verification. Not recommended for production. |
+| `MinVersion` | Minimum TLS version. Defaults to `1.2`. Valid values: `1.0`, `1.1`, `1.2`, `1.3`. |
+| `MaxVersion` | Maximum TLS version. Defaults to `1.3`. Valid values: `1.0`, `1.1`, `1.2`, `1.3`. |
+
+### Tyk Dashboard Connection
+
+Required for the [`GenerateTemporaryAuthToken`](/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib) action, which calls the Tyk Dashboard API to generate auth keys. Configure the `DashboardConfig` block within `TykAPISettings`:
+
+```json
+{
+  "TykAPISettings": {
+    "DashboardConfig": {
+      "Endpoint": "http://{dashboard-host}",
+      "Port": "3000",
+      "AdminSecret": "{dashboard-admin-secret}"
+    }
+  }
+}
+```
+
+### Tyk Gateway Connection
+
+Required for the [`GenerateOAuthTokenForClient`](/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib) action, which calls the Tyk Gateway OAuth endpoint directly to issue OAuth 2.0 tokens. Configure the `GatewayConfig` block within `TykAPISettings`:
+
+```json
+{
+  "TykAPISettings": {
+    "GatewayConfig": {
+      "Endpoint": "http://{gateway-host}",
+      "Port": "8080",
+      "AdminSecret": "{gateway-admin-secret}"
+    }
+  }
+}
+```
+
+For the full configuration reference including all fields and their environment variable equivalents, see [Tyk Identity Broker Configuration](/tyk-configuration-reference/tyk-identity-broker-configuration).
+
+### Session Cookie Secret
+
+When using redirect-based methods (`SocialProvider` or `SAMLProvider`), TIB [signs the session cookie](/tyk-identity-broker/overview#redirect-session-cookie) using a secret set via the `TYK_IB_SESSION_SECRET` environment variable:
+
+```bash
+export TYK_IB_SESSION_SECRET='your-session-secret'
+```
+
+Use a randomly generated string of 32 or 64 bytes. This should always be set explicitly for standalone deployments.
+
diff --git a/tyk-identity-broker/tib-rest-api.mdx b/tyk-identity-broker/tib-rest-api.mdx
new file mode 100644
index 0000000000..03cc4d73bd
--- /dev/null
+++ b/tyk-identity-broker/tib-rest-api.mdx
@@ -0,0 +1,20 @@
+---
+title: "Tyk Identity Broker API"
+description: "Reference documentation for the Tyk Identity Broker (TIB) REST API, covering endpoints to create, update, delete, and list TIB profiles."
+keywords: "Tyk Identity Broker, TIB, REST API, profile management, API reference"
+sidebarTitle: "Overview"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+<ButtonLeft href="https://raw.githubusercontent.com/TykTechnologies/tyk-docs/refs/heads/main/swagger/identity-broker-swagger.yml" color="green" content="Download Swagger" />
+
+The Tyk Identity Broker API allows TIB profiles to be created, updated, deleted, and listed programmatically. All requests require an `Authorization` header whose value matches the `Secret` field in `tib.conf`.
+
+The interactive endpoint documentation is available in the sidebar below.
+
+## Embedded TIB
+
+**Tyk Dashboard (from v3.0):** Profile management endpoints are available via the Tyk Dashboard API on the `/api/tib/` prefix. For example, the standalone TIB endpoint `/api/profiles/{id}` maps to `/api/tib/profiles/{id}` on the Tyk Dashboard API. See the [Tyk Dashboard API reference](/tyk-dashboard-api) for the full Dashboard API documentation.
+
+**Tyk Developer Portal (from v1.12.0):** Profile management is available through the Portal UI under **Settings > SSO Profiles**. The Portal does not expose TIB profile management via a separate API endpoint.
diff --git a/tyk-mdcb-api.mdx b/tyk-mdcb-api.mdx
new file mode 100644
index 0000000000..b52e12fbdc
--- /dev/null
+++ b/tyk-mdcb-api.mdx
@@ -0,0 +1,15 @@
+---
+title: "Tyk MDCB API"
+description: "Tyk MDCB API documentation. This page provides details on how to use the Tyk Multi Data Center Bridge (MDCB) API for monitoring connected Data Planes and accessing diagnostic data."
+keywords: "OpenAPI Spec, OpenAPI Specification, OAS, REST, Tyk MDCB OpenAPI Spec, Tyk MDCB OAS, MDCB API REST"
+order: 3
+sidebarTitle: "Overview"
+---
+
+import { ButtonLeft } from '/snippets/ButtonLeft.mdx';
+
+<ButtonLeft href="https://raw.githubusercontent.com/TykTechnologies/tyk-docs/refs/heads/production/swagger/nightly/mdcb-swagger.yml" color="green" content="Download Swagger" />
+
+This API provides operations for monitoring Data Planes connected to MDCB and accessing diagnostic data. 
+It includes endpoints for retrieving connected data plane details, performing health checks, 
+and accessing Go's built-in pprof diagnostics for advanced performance profiling.
\ No newline at end of file
diff --git a/tyk-multi-data-centre/mdcb-configuration-options.mdx b/tyk-multi-data-centre/mdcb-configuration-options.mdx
new file mode 100644
index 0000000000..3879876075
--- /dev/null
+++ b/tyk-multi-data-centre/mdcb-configuration-options.mdx
@@ -0,0 +1,39 @@
+---
+title: "MDCB Configuration options"
+description: "Each of the config options that are available when deploying MDCB."
+keywords: "MDCB, configuration options, MDCB configuration options"
+order: 3
+sidebarTitle: "Multi Data Center Bridge"
+---
+
+import MdcbConfig from '/snippets/mdcb-config.mdx';
+import EnvTypeMapping from '/snippets/env-type-mapping.mdx';
+
+## Tyk MDCB Configuration
+
+The Tyk MDCB server is configured primarily via the `tyk_sink.conf` file, this file resides in `/opt/tyk-sink` on most systems, but can also live anywhere and be directly targeted with the `-c` flag.
+
+### Environment Variables
+
+Environment variables (env var) can be used to override the settings defined in the configuration file. Where an environment variable is specified, its value will take precedence over the value in the configuration file.
+
+<EnvTypeMapping/>
+
+### Default Ports
+
+| Application             | Port           |
+| :------------------------- | :---------------- |
+|MongoDB                  |      27017     |
+|Redis                    |      6379      |
+|**Tyk Dashboard**        |                |
+|Developer Portal         |      3000      |
+|Admin Dashboard          |      3000      |
+|Admin Dashboard API      |      3000      |
+|**Tyk Gateway**          |                |
+|Management API           |      8080      |
+|**MDCB**                 |                |
+|RPC services             |      9090      |
+|HTTP endpoints           |      8181      |
+
+
+<MdcbConfig/>
diff --git a/tyk-open-source.mdx b/tyk-open-source.mdx
new file mode 100644
index 0000000000..3aa22f0fc2
--- /dev/null
+++ b/tyk-open-source.mdx
@@ -0,0 +1,28 @@
+---
+title: "Tyk Open Source"
+description: "This page serves as a comprehensive guide to Tyk Open Source"
+keywords: "installation, migration, open source"
+sidebarTitle: "Overview"
+---
+
+## What is Tyk Open Source
+
+Open source is at the heart of what we do. Anything that is API Gateway-related lives in the Gateway, or is critical for the Gateway to work is open and freely available via our [Github](https://github.com/TykTechnologies/tyk).
+
+The Tyk Gateway is fully open-source.  It's all the same Gateway that's used by you (the community!), by our enterprise products, as well as our SaaS.
+
+Our commitment to open source also delivers a host of benefits for our users: sign up for free with Tyk, receive securely packaged open source packages, get started guides, access to our community and all of the latest open source information.
+
+
+<Note>
+Tyk OSS, Tyk Open Source, Tyk Gateway, Tyk CE
+</Note>
+
+
+<img src="/img/diagrams/oss-flow.png" alt="OSS-Guide" />
+
+## What Does Tyk Open Source Include?
+
+import OssProductListInclude from '/snippets/oss-product-list-include.mdx';
+
+<OssProductListInclude/>
diff --git a/tyk-oss-gateway.mdx b/tyk-oss-gateway.mdx
new file mode 100644
index 0000000000..addcbdcc91
--- /dev/null
+++ b/tyk-oss-gateway.mdx
@@ -0,0 +1,16 @@
+---
+title: "Tyk Gateway Open Source (OSS)"
+description: "Overview of Tyk Gateway features and deployment options."
+order: 1
+sidebarTitle: "Tyk Gateway"
+---
+
+import TykGatewayFeaturesInclude from '/snippets/tyk-gateway-features-include.mdx';
+
+## What is the Tyk Gateway?
+
+<TykGatewayFeaturesInclude/>
+
+## Deployment Options
+
+Refer the [deployment options](/apim) page.
\ No newline at end of file
diff --git a/tyk-oss-gateway/configuration.mdx b/tyk-oss-gateway/configuration.mdx
new file mode 100644
index 0000000000..5417ec0ccb
--- /dev/null
+++ b/tyk-oss-gateway/configuration.mdx
@@ -0,0 +1,29 @@
+---
+title: "Tyk Gateway Configuration Options"
+description: "Configuration options and environment variables for Tyk Gateway."
+order: 1
+sidebarTitle: "Gateway"
+---
+
+import GatewayConfig from '/snippets/gateway-config.mdx';
+import EnvTypeMapping from '/snippets/env-type-mapping.mdx';
+
+You can use environment variables to override the config file for the Tyk Gateway. The Gateway configuration file can be found in the `tyk-gateway` folder and by default is called `tyk.conf`, though it can be renamed and specified using the `--conf` flag. Environment variables are created from the dot notation versions of the JSON objects contained with the config files.
+To understand how the environment variables notation works, see [Environment Variables](/tyk-oss-gateway/configuration).
+
+All the Gateway environment variables have the prefix `TYK_GW_`. The environment variables will take precedence over the values in the configuration file.
+
+<EnvTypeMapping/>
+
+### tyk lint
+
+In **v2.4** we have added a new `tyk lint` command which will validate your `tyk.conf` file and validate it for syntax correctness, misspelled attribute names or format of values. The Syntax can be:
+
+`tyk lint` or `tyk --conf=path lint`
+
+If `--conf` is not used, the first of the following paths to exist is used:
+
+`./tyk.conf`
+`/etc/tyk/tyk.conf`
+
+<GatewayConfig/>
diff --git a/tyk-overview.mdx b/tyk-overview.mdx
new file mode 100644
index 0000000000..c82e304cd6
--- /dev/null
+++ b/tyk-overview.mdx
@@ -0,0 +1,65 @@
+---
+title: "Tyk Overview"
+description: "A high-level overview of Tyk and its capabilities"
+keywords: "Tyk API Management, Getting Started, Tutorials"
+order: 5
+sidebarTitle: "Tyk Overview"
+---
+
+APIs are are central to enabling software integration, data exchange, and automation. However, as organizations scale their API ecosystems, they face mounting challenges around security, reliability, and performance. Tyk exists to simplify and strengthen this process. With a focus on efficient, secure, and scalable API management, Tyk provides a powerful solution for companies looking to streamline API operations, enforce robust security standards, and gain deep visibility into their API usage.
+
+## Why Tyk Exists: The Need for API Management
+The demand for APIs has exploded over the last decade, with companies using them to enable everything from mobile apps and IoT devices to microservices architectures and third-party integrations. But with this growth come significant challenges:
+
+- **Security Risks**: Exposing services through APIs introduces new security vulnerabilities that need constant management and monitoring.
+- **Scalability**: As usage grows, APIs need to be resilient, able to handle high traffic, and scalable across global regions.
+- **Complexity in Integration**: Integrating various backend services, identity providers, and front-end applications can become an overwhelming task.
+- **Monitoring and Performance**: API performance monitoring, traffic management, and analytics are crucial to optimize API usage and provide reliable service.
+
+Tyk exists to address these challenges by providing an API management platform that’s secure, scalable, flexible, and easy to use. With Tyk, organizations can confidently manage the entire lifecycle of their APIs, from initial design to deployment and ongoing monitoring.
+
+## What Problem Does Tyk Solve?
+
+Tyk is designed to solve several critical issues that organizations face with APIs:
+
+1. **Unified API Management**  
+   Tyk centralizes all aspects of API management, offering tools for routing, load balancing, security, and performance. This unified approach helps teams streamline API operations and reduce operational overhead.
+
+2. **Enhanced Security and Compliance**  
+   APIs are vulnerable to numerous security threats. Tyk addresses these concerns by supporting a wide array of security protocols, including OAuth2.0, JWT, HMAC, and OpenID Connect. Additionally, Tyk enables organizations to enforce fine-grained access control policies, rate limiting, and quotas to safeguard API access.
+
+3. **Scalability for High-Volume Traffic**  
+   Tyk provides a high-performance API gateway that can handle substantial traffic loads while maintaining low latency, ensuring that APIs can scale as demand increases. Tyk’s Multi Data Centre Bridge (MDCB) further enhances scalability by distributing traffic across multiple regions, providing high availability and low latency globally.
+
+4. **Seamless Integration and Flexibility**  
+   Tyk’s open-source architecture and compatibility with Kubernetes, Docker, and cloud platforms make it easy to integrate within existing infrastructures. With Tyk, teams can operate in hybrid or multi-cloud environments, deploy APIs as Kubernetes-native resources, and leverage CI/CD pipelines for seamless updates.
+
+5. **Developer and Consumer Enablement**  
+   Through the Tyk Developer Portal, developers can discover and access APIs easily, enabling faster adoption and integration. With detailed documentation, developer self-service features, and API analytics, Tyk empowers both API providers and consumers to make the most of their API ecosystem.
+
+## How Tyk’s Components Work Together
+
+Tyk offers a comprehensive suite of components designed to address every aspect of the API lifecycle:
+
+- **[Tyk Gateway](/tyk-oss-gateway)**: The core of Tyk’s platform, providing high-performance API routing, traffic management, and security.
+- **[Tyk Dashboard](/api-management/dashboard-configuration)**: A graphical control panel that simplifies API management, configuration, and monitoring.
+- **[Tyk Developer Portal](/portal/overview/intro)**: A self-service portal that enables developers to access, understand, and integrate with APIs.
+- **[Tyk Multi Data Centre Bridge (MDCB)](/api-management/mdcb)**: Allows centralized control over APIs distributed across multiple data centers or cloud regions.
+- **[Tyk Pump](/api-management/tyk-pump)**: Collects and streams analytics from the Tyk Gateway to various storage backends for performance monitoring and reporting.
+- **[Tyk Operator](/api-management/automations/operator#what-is-tyk-operator)**: Kubernetes-native API management that allows teams to manage APIs as Kubernetes resources.
+- **[Tyk Streams](/api-management/event-driven-apis#)**: Enables real-time data streaming and push-based communication for applications requiring live data.
+- **[Tyk Sync](/api-management/automations/sync)**: Synchronizes API configurations across environments, supporting DevOps practices and CI/CD workflows.
+- **[Tyk Identity Broker](/tyk-identity-broker/overview)**: Integrates with external identity providers for single sign-on (SSO) and centralized identity management.
+- **[Tyk Helm Charts](/product-stack/tyk-charts/overview)**: Simplifies the deployment of Tyk components within Kubernetes environments.
+- **[Universal Data Graph](/api-management/data-graph#overview)**: Provides a single GraphQL endpoint that aggregates data from multiple sources, simplifying access to complex data.
+
+Each component plays a specific role in managing the API lifecycle, from initial deployment and configuration to real-time data streaming and developer access. Together, they create a cohesive API management ecosystem that can handle the unique challenges of production environments.
+
+You can learn more about the components that make up Tyk, [here](/tyk-components).
+
+## Why Use Tyk?
+
+In summary, Tyk offers a complete API management solution designed for modern, production-grade API operations. With its open-source core, robust security options, high performance, and flexible deployment models, Tyk provides everything an organization needs to manage, scale, and secure their APIs. 
+
+Whether you’re a startup looking to build a simple API or a global enterprise deploying complex, multi-region architectures, Tyk has the tools to support your growth at every stage. If you face problems with scaling your solutions, learn more about how Tyk can support you by [getting started with Tyk Cloud](/getting-started/create-account).
+
diff --git a/tyk-portal-api.mdx b/tyk-portal-api.mdx
new file mode 100644
index 0000000000..abcde82dd6
--- /dev/null
+++ b/tyk-portal-api.mdx
@@ -0,0 +1,20 @@
+---
+title: "Classic Portal API"
+description: "Landing page for the Tyk Classic Portal API documentation"
+keywords: "Tyk Classic Portal API, Classic Portal API"
+robots: "noindex, nofollow"
+sidebarTitle: "Overview"
+---
+
+import LegacyClassicPortalApi from '/snippets/legacy-classic-portal-api.mdx';
+
+<LegacyClassicPortalApi/>
+
+
+This section describes the Tyk Classic Portal API endpoints. It includes the following:
+
+* [Portal Keys](/tyk-apis/tyk-portal-api/portal-keys)
+* [Portal Policies](/tyk-apis/tyk-dashboard-api/portal-policies)
+* [Portal Developers](/tyk-apis/tyk-portal-api/portal-developers)
+* [Portal Configuration](/tyk-apis/tyk-portal-api/portal-configuration)
+* [Portal Documentation](/tyk-apis/tyk-portal-api/portal-documentation)
\ No newline at end of file
diff --git a/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables.mdx b/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables.mdx
new file mode 100644
index 0000000000..428202d948
--- /dev/null
+++ b/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables.mdx
@@ -0,0 +1,19 @@
+---
+title: "Tyk Pump Environment Variables"
+description: "Using Environment Variables to configure your Tyk Pump"
+keywords: "Tyk Pump, Envoronment Variables, Configuration"
+order: 6
+sidebarTitle: "Pump"
+---
+
+import PumpConfig from '/snippets/pump-config.mdx';
+import EnvTypeMapping from '/snippets/env-type-mapping.mdx';
+
+You can use environment variables to override the config file for the Tyk Pump. Environment variables are created from the dot notation versions of the JSON objects contained with the config files.
+To understand how the environment variables notation works, see [Environment Variables](/tyk-oss-gateway/configuration). 
+
+All the Pump environment variables have the prefix `TYK_PMP_`. The environment variables will take precedence over the values in the configuration file.
+
+<EnvTypeMapping/>
+
+<PumpConfig/>
diff --git a/tyk-self-managed.mdx b/tyk-self-managed.mdx
new file mode 100644
index 0000000000..2b8c9b0b30
--- /dev/null
+++ b/tyk-self-managed.mdx
@@ -0,0 +1,26 @@
+---
+title: "Tyk Self Managed"
+description: "An overview of Tyk Self-Managed, allowing you to install our Full Lifecycle API Management solution in your own infrastructure"
+keywords: "installation, migration, self managed"
+sidebarTitle: "Overview"
+---
+
+## What is Tyk Self-Managed
+
+Tyk Self-Managed allows you to easily install our Full Lifecycle API Management solution in your own infrastructure. There is no calling home, and there are no usage limits.  You have full control.
+
+## What Does Tyk Self-Managed Include?
+The full Tyk Self-Managed system consists of:
+
+* [Tyk Gateway](/tyk-oss-gateway):  Tyk Gateway is provided ‘Batteries-included’, with no feature lockout. It is an open source enterprise API Gateway, supporting REST, GraphQL, TCP and gRPC protocols, that protects, secures and processes your APIs.
+* [Tyk Dashboard](/api-management/dashboard-configuration): The management Dashboard and integration API manage a cluster of Tyk Gateways and also show analytics and features of the [Developer portal](/portal/overview/intro). The Dashboard also provides the API Developer Portal, a customizable developer portal for your API documentation, developer auto-enrollment and usage tracking.
+* [Developer Portal](/portal/overview/intro): A customizable API portal to securely publish and manage API access for your consumers.
+* [Tyk Pump](/api-management/tyk-pump): Tyk Pump handles moving analytics data between your gateways and your Dashboard (amongst other data sinks). The Tyk Pump is an open source analytics purger that moves the data generated by your Tyk nodes to any back-end.
+* [Tyk Identity Broker](/tyk-identity-broker/overview) (Optional): Tyk Identity Broker handles integrations with third-party IdPs. It (TIB) is a component providing a bridge between various Identity Management Systems such as LDAP, Social OAuth (e.g. GPlus, Twitter, GitHub) or Basic Authentication providers, to your Tyk installation.
+* [Tyk Multi-Data Center Bridge](/api-management/mdcb) (Optional, add-on): Tyk Multi-Data Center Bridge allows for the configuration of a Tyk ecosystem that spans many data centers and clouds. It also (MDCB) acts as a broker between Tyk Gateway Instances that are isolated from one another and typically have their own Redis DB.
+
+<img src="/img/diagrams/tyk-selfmanaged-architecture.png" alt="Tyk Self-Managed Architecture" />
+
+## Getting Started
+
+To get started with Tyk Self-Managed, you can follow the [Getting Start Guide](/getting-started/quick-start) which provides a step-by-step walkthrough of setting up Tyk in your environment.
diff --git a/tyk-self-managed/install.mdx b/tyk-self-managed/install.mdx
new file mode 100644
index 0000000000..4b4025e791
--- /dev/null
+++ b/tyk-self-managed/install.mdx
@@ -0,0 +1,105 @@
+---
+title: "Installation Options for Tyk Self-Managed"
+description: "Explore the various installation options for Tyk Self-Managed, including Docker, Kubernetes, Linux packages, Ansible, and more."
+sidebarTitle: "Overview"
+---
+
+import { ResponsiveGrid } from '/snippets/ResponsiveGrid.mdx';
+import MongodbVersionsInclude from '/snippets/mongodb-versions-include.mdx';
+import SqlVersionsInclude from '/snippets/sql-versions-include.mdx';
+import RedisVersionsInclude from '/snippets/redis-versions-include.mdx';
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| Enterprise | Self-Managed, Hybrid |
+
+<Note>
+
+This page is for installing **Tyk Self-Managed**. If you are looking to use Tyk as part of **Tyk Cloud**, please refer to [the Tyk Cloud documentation](/getting-started/create-account).
+
+</Note>
+
+## Architecture
+
+<img src="/img/diagrams/tyk-selfmanaged-architecture.png" alt="Tyk Self-Managed Architecture" />
+
+## Requirements
+
+
+**Tyk Dashboard** requires a persistent datastore for its operations. By default MongoDB is used. From Tyk v4.0, we also support PostgreSQL.
+
+### PostgreSQL
+
+<SqlVersionsInclude/>
+
+Please check [here](/planning-for-production/database-settings#postgresql) for production configuration.
+
+### MongoDB
+
+<MongodbVersionsInclude/>
+
+Please check [here](/planning-for-production/database-settings#mongodb) for MongoDB driver and production configuration.
+
+### Redis
+
+<RedisVersionsInclude />
+
+## Recommended Installation: Docker
+
+For development, testing, and proof of concept purposes, we recommend using our Docker installation, which allows you to quickly spin up a full Tyk stack on your local machine.
+
+<ResponsiveGrid>
+
+<Card href="/tyk-self-managed/install/docker" img="/img/docker.png">
+
+Install with Docker
+</Card>
+
+</ResponsiveGrid>
+
+## Alternative Installation Methods
+
+<ResponsiveGrid>
+
+<Card href="/tyk-self-managed/install/kubernetes" img="/img/k8s.png">
+
+Install on K8s
+</Card>
+
+<Card href="/tyk-self-managed/install/methods#install-with-ansible" img="/img/ansible.png">
+
+Install with Ansible
+</Card>
+
+<Card href="/tyk-self-managed/install/linux#install-tyk-on-redhat-rhel-centos" img="/img/redhat-logo2.png">
+
+Install on Red Hat
+</Card>
+
+<Card href="/tyk-self-managed/install/linux#install-tyk-on-debian-or-ubuntu" img="/img/debian-nd-753.png">
+
+Install on Ubuntu
+</Card>
+
+<Card href="/tyk-self-managed/install/methods#install-on-aws-marketplace" img="/img/aws.png">
+
+Install on Amazon AWS
+</Card>
+
+<Card href="/tyk-self-managed/install/methods#install-on-heroku" img="/img/heroku-logo.png">
+
+Install Tyk on Heroku
+</Card>
+
+<Card href="/tyk-self-managed/install/methods#install-on-microsoft-azure" img="/img/azure-2.png">
+
+Install on Microsoft Azure
+</Card>
+
+</ResponsiveGrid>
+
+## Air Gapped Installation
+
+For environments with restricted network access, we provide guidance on how to deploy Tyk using private container registries and local package mirrors. 
+
+Refer to our [Air-Gapped Deployment guide](/api-management/air-gapped-deployment) for detailed instructions on how to set up Tyk in air-gapped or network-restricted environments.
\ No newline at end of file
diff --git a/tyk-self-managed/install/docker.mdx b/tyk-self-managed/install/docker.mdx
new file mode 100644
index 0000000000..550a28bab7
--- /dev/null
+++ b/tyk-self-managed/install/docker.mdx
@@ -0,0 +1,199 @@
+---
+title: "Install Tyk Self-Managed on Docker"
+description: "Install the full Tyk Self-Managed stack (Gateway, Dashboard, Portal, Pump, Redis, and PostgreSQL) using Docker Compose."
+sidebarTitle: "Docker"
+---
+
+| Edition | Deployment Type |
+| :------ | :-------------- |
+| Enterprise | Self-Managed, Hybrid |
+
+<Note>
+Running on Podman, containerd, or another container runtime? See [Container Runtimes](/deployment-and-operations/container-runtimes).
+</Note>
+
+<Note>
+From v5.5.0 onwards, Docker images are based on [distroless](https://github.com/GoogleContainerTools/distroless). You cannot obtain a shell with `docker run --rm -it tykio/tyk-gateway:v5.5.0 sh`. Use [dive](https://github.com/wagoodman/dive) or [Docker Desktop](https://www.docker.com/products/docker-desktop/) to inspect images.
+</Note>
+
+## Prerequisites
+
+- [Docker Engine](https://docs.docker.com/engine/install/) 24.0 or later
+- [Docker Compose](https://docs.docker.com/compose/install/) v2.20 or later
+- Tyk license keys — Dashboard license and Portal license (optional). Get a free trial at [tyk.io/self-managed-trial](https://tyk.io/self-managed-trial/).
+- 4GB RAM or more available
+
+## Instructions
+
+### Step 1: Clone and configure
+
+1. Clone the [tyk-install](https://github.com/TykTechnologies/tyk-install) repository and navigate to the Docker self-managed directory:
+
+    ```bash
+    git clone https://github.com/TykTechnologies/tyk-install
+    cd tyk-install/docker/self-managed
+    ```
+
+2. Copy the example environment file and add your license keys:
+
+    ```bash
+    cp .env.example .env
+    ```
+
+3. Open `.env` and set your license keys:
+
+    ```bash
+    TYK_LICENSE_KEY=<your-dashboard-license>
+    TYK_PORTAL_LICENSE=<your-portal-license>
+    ```
+
+    <Warning>
+    Ensure there are **no spaces** around the `=` sign. Spaces will cause the configuration to fail silently.
+
+    ```bash
+    # Correct
+    TYK_LICENSE_KEY=eyJhbGciOiJSUzI1NiIsInR5cCI6...
+
+    # Wrong — will fail
+    TYK_LICENSE_KEY = eyJhbGciOiJSUzI1NiIsInR5cCI6...
+    ```
+    </Warning>
+
+### Step 2: Start services
+
+```bash
+docker compose up -d
+```
+
+Wait for all health checks to pass (approximately 30–60 seconds), then verify all containers are running:
+
+```bash
+docker compose ps
+```
+
+Expected containers:
+
+| Container | Port | Status |
+| --------- | ---- | ------ |
+| `tyk-dashboard` | 3000 | Running |
+| `tyk-gateway` | 8080 | Running |
+| `tyk-pump` | N/A | Running |
+| `tyk-portal` | 3001 | Running |
+| `tyk-redis` | 6379 | Running |
+| `tyk-postgres` | 5432 | Running |
+
+If any container is not running, check the logs:
+
+```bash
+docker compose logs -f
+```
+
+### Step 3: Bootstrap the stack
+
+Choose one of the following options to complete the initial setup.
+
+#### Option A: Automated bootstrap (recommended)
+
+Use the Bootstrap Utility from the repository to automatically create an organization, admin user, test API, policy, API key, and Portal configuration.
+
+1. Navigate to the bootstrap utility directory and create an `.env` file with your license key:
+
+    ```bash
+    cd tyk-install/utils/bootstrap
+    echo "TYK_LICENSE_KEY=<your-dashboard-license>" > .env
+    ```
+
+2. Run the bootstrap:
+
+    ```bash
+    docker compose --profile tools run --rm tyk-bootstrap
+    ```
+
+Credentials are printed to the terminal on completion.
+
+#### Option B: Manual bootstrap
+
+1. Open `http://localhost:3000` in your browser.
+
+2. Fill in the bootstrap form:
+    - Organization Name
+    - Admin Email
+    - Admin Password
+
+    <Note>
+    Use a combination of alphanumeric characters with both upper and lower case letters for your password.
+    </Note>
+
+3. Click **Bootstrap** to save.
+
+4. Log in to the Tyk Dashboard at `http://localhost:3000` with the credentials you just created.
+
+5. Bootstrap the Developer Portal by calling its API:
+
+    ```bash
+    curl "http://localhost:3001/portal-api/bootstrap" \
+      -H 'Content-Type: application/json' \
+      -d '{
+        "username": "portal-admin@example.com",
+        "password": "portalpass123",
+        "first_name": "Portal",
+        "last_name": "Admin"
+      }'
+    ```
+
+    Save the `api_token` from the response — you will need it to configure the Portal provider.
+
+### Step 4: Verify the installation
+
+Test that all components are responding:
+
+```bash
+# Gateway
+curl http://localhost:8080/hello
+
+# Dashboard
+curl http://localhost:3000/hello
+
+# Portal
+curl http://localhost:3001/ready
+```
+
+## Access URLs
+
+| Service | URL | Description |
+| ------- | --- | ----------- |
+| Dashboard | `http://localhost:3000` | Admin UI |
+| Gateway | `http://localhost:8080` | API Gateway |
+| Developer Portal | `http://localhost:3001` | Developer Portal |
+| Redis | `localhost:6379` | Cache and session storage |
+| PostgreSQL | `localhost:5432` | Analytics and config database |
+
+## Configuration
+
+The following environment files control each component's settings:
+
+| File | Purpose |
+| ---- | ------- |
+| `.env` | License keys and component versions |
+| `confs/tyk.env` | Gateway configuration |
+| `confs/tyk_analytics.env` | Dashboard configuration |
+| `confs/pump.env` | Pump configuration |
+| `confs/portal.env` | Developer Portal configuration |
+
+For production deployments, review the [Planning for Production](/planning-for-production) guide and apply the recommendations noted in the config file comments.
+
+## Cleanup
+
+Stop all services and remove volumes:
+
+```bash
+docker compose down -v
+```
+
+To also remove orphaned networks:
+
+```bash
+docker compose down -v --remove-orphans
+docker network prune -f
+```
+
diff --git a/tyk-self-managed/install/kubernetes.mdx b/tyk-self-managed/install/kubernetes.mdx
new file mode 100644
index 0000000000..14de59d46d
--- /dev/null
+++ b/tyk-self-managed/install/kubernetes.mdx
@@ -0,0 +1,663 @@
+---
+title: "Install Tyk Self-Managed on Kubernetes"
+description: "Install the full Tyk Self-Managed stack (Gateway, Dashboard, Portal, Pump, Operator, Redis, and PostgreSQL) on Kubernetes using Helm."
+sidebarTitle: "Kubernetes"
+---
+
+| Edition | Deployment Type |
+| :------ | :-------------- |
+| Enterprise | Self-Managed, Hybrid |
+
+<Note>
+Running on Podman, containerd, or another container runtime? See [Container Runtimes](/deployment-and-operations/container-runtimes).
+</Note>
+
+## Compatible Kubernetes Versions
+
+1.33.x, 1.34.x, 1.35.x
+
+## Prerequisites
+
+- A running Kubernetes cluster. This can be local (minikube, kind, or Docker Desktop) or a managed cloud cluster (EKS, GKE, or AKS).
+- [kubectl](https://kubernetes.io/docs/tasks/tools/) installed and connected to your cluster.
+- [Helm](https://helm.sh/docs/intro/install/) 3.12 or later.
+- Tyk license keys. The Dashboard license is required; the Operator and Portal licenses are optional. Get a free trial at [tyk.io/self-managed-trial](https://tyk.io/self-managed-trial/).
+- 4GB RAM or more available to the cluster.
+
+## Instructions
+
+This guide deploys the full Tyk stack with the opinionated, trial-ready configuration from the [tyk-install](https://github.com/TykTechnologies/tyk-install) repository. The bundled `values.yaml` enables Pump analytics to PostgreSQL, audit logging, hashed-key listing, OPA, and Dashboard security defaults out of the box.
+
+### Step 1: Clone and Configure
+
+1. Clone the [tyk-install](https://github.com/TykTechnologies/tyk-install) repository and navigate to the Kubernetes self-managed directory:
+
+    ```bash
+    git clone https://github.com/TykTechnologies/tyk-install
+    cd tyk-install/kubernetes/helm-self-managed
+    ```
+
+2. Copy the example environment file and add your license keys:
+
+    ```bash
+    cp .env.example .env
+    ```
+
+3. Open `.env` and set your license key:
+
+    ```bash
+    TYK_LICENSE_KEY=<your-dashboard-license>
+    TYK_OPERATOR_LICENSE=<your-operator-license>
+    TYK_PORTAL_LICENSE=<your-portal-license>
+    ```
+
+4. Load the environment variables into your shell:
+
+    ```bash
+    source .env
+    ```
+
+### Step 2: Create the Namespace and Secrets
+
+The secrets store your licenses, the shared API secret, database connection strings, and the bootstrap admin user. The values come from the `.env` file you loaded in Step 1.
+
+```bash
+# Create the namespace
+kubectl create namespace tyk
+
+# Create the main Tyk secret
+kubectl create secret generic tyk-conf \
+  --namespace tyk \
+  --from-literal=APISecret=$TYK_API_SECRET \
+  --from-literal=AdminSecret=$TYK_ADMIN_SECRET \
+  --from-literal=DashLicense=$TYK_LICENSE_KEY \
+  --from-literal=OperatorLicense=$TYK_OPERATOR_LICENSE \
+  --from-literal=DevPortalLicense=$TYK_PORTAL_LICENSE \
+  --from-literal=adminUserFirstName=$ADMIN_FIRST_NAME \
+  --from-literal=adminUserLastName=$ADMIN_LAST_NAME \
+  --from-literal=adminUserEmail=$ADMIN_EMAIL \
+  --from-literal=adminUserPassword=$ADMIN_PASSWORD \
+  --from-literal=DashDatabaseConnectionString="$DashDatabaseConnectionString" \
+  --from-literal=DevPortalDatabaseConnectionString="$DevPortalDatabaseConnectionString"
+
+# Create the Developer Portal secret
+kubectl create secret generic secrets-tyk-tyk-dev-portal \
+  --namespace tyk \
+  --from-literal=adminUserPassword=$ADMIN_PASSWORD \
+  --from-literal=adminUserEmail=$ADMIN_EMAIL
+```
+
+### Step 3: Install Dependencies
+
+Install PostgreSQL and Redis from Bitnami, wait for them to become ready, then install cert-manager (required by the Tyk Operator).
+
+```bash
+# Add the Bitnami repository
+helm repo add bitnami https://charts.bitnami.com/bitnami
+helm repo update
+
+# Install PostgreSQL (also creates the portal database)
+helm install tyk-postgres bitnami/postgresql \
+  --namespace tyk \
+  --set image.repository=bitnamilegacy/postgresql \
+  --set auth.username=$POSTGRES_USER \
+  --set auth.password=$POSTGRES_PASSWORD \
+  --set auth.database=$POSTGRES_DB \
+  --set primary.initdb.scripts."init\.sql"="CREATE DATABASE portal;" \
+  --set primary.persistence.size=20Gi \
+  --version 12.12.10
+
+# Install Redis
+helm install tyk-redis oci://registry-1.docker.io/bitnamicharts/redis \
+  --namespace tyk \
+  --set image.repository=bitnamilegacy/redis \
+  --set auth.enabled=false \
+  --version 19.0.2
+
+# Wait for the databases to be ready (about 2 minutes)
+kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=postgresql -n tyk
+kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=redis -n tyk
+
+# Install cert-manager (required for the Tyk Operator)
+helm install cert-manager oci://quay.io/jetstack/charts/cert-manager \
+  --namespace cert-manager \
+  --create-namespace \
+  --version v1.17.4 \
+  --set crds.enabled=true
+```
+
+<Note>
+Waiting for PostgreSQL and Redis to report ready before installing Tyk prevents the Gateway, Dashboard, and Pump pods from entering `CrashLoopBackOff` while they wait for a database connection.
+</Note>
+
+### Step 4: Install the Tyk Stack
+
+```bash
+# Add the Tyk Helm repository
+helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+helm repo update
+
+# Install Tyk with the bundled values file
+helm install tyk tyk-helm/tyk-stack \
+  --namespace tyk \
+  --values values.yaml
+
+# Watch the pods come up (press Ctrl+C once all are Running or Completed)
+kubectl get pods -n tyk -w
+```
+
+Expected pods:
+
+| Pod | Status |
+| --- | ------ |
+| `gateway-xxx` | Running |
+| `dashboard-xxx` | Running |
+| `tyk-pump-xxx` | Running |
+| `tyk-portal-xxx` | Running |
+| `tyk-postgres-xxx` | Running |
+| `tyk-redis-xxx` | Running |
+| `tyk-tyk-operator-xxx` | Running |
+
+### Step 5: Access the Services
+
+The bundled `values.yaml` sets the Gateway, Dashboard, and Portal services to `LoadBalancer`. Choose the access method that matches your environment.
+
+**Local cluster (port-forward):** the quickest way to reach the services on a local cluster. Run each command in a separate terminal:
+
+```bash
+kubectl port-forward -n tyk svc/dashboard-svc-tyk-tyk-dashboard 3000:3000
+kubectl port-forward -n tyk svc/gateway-svc-tyk-tyk-gateway 8080:8080
+kubectl port-forward -n tyk svc/dev-portal-svc-tyk-tyk-dev-portal 3001:3001
+```
+
+**Cloud cluster (LoadBalancer):** EKS, GKE, and AKS provision an external address for each service. List them and wait for `EXTERNAL-IP` to be assigned:
+
+```bash
+kubectl get svc -n tyk
+```
+
+For production setups with custom domains and TLS, configure Ingress (AWS ALB, GKE GCE, AKS Application Gateway, or NGINX). See the [helm-self-managed README](https://github.com/TykTechnologies/tyk-install/tree/main/kubernetes/helm-self-managed) for per-provider Ingress configuration.
+
+### Step 6: Get Admin Credentials
+
+The chart bootstraps the admin user from the `tyk-conf` secret. Retrieve the credentials to log in to the Tyk Dashboard:
+
+```bash
+# Admin email
+kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.adminUserEmail}' | base64 -d && echo
+
+# Admin password
+kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.adminUserPassword}' | base64 -d && echo
+```
+
+### Step 7: Verify the Installation
+
+Test that all components are responding (adjust the host if you are not using port-forward):
+
+```bash
+# Gateway
+curl http://localhost:8080/hello
+
+# Dashboard
+curl http://localhost:3000/hello
+
+# Portal
+curl http://localhost:3001/ready
+```
+
+You are now ready to [create an API](/api-management/gateway-config-managing-classic#create-an-api), or manage APIs declaratively with [Tyk Operator](/api-management/automations/operator), which is installed as part of this stack.
+
+## Configuration
+
+Two files control the deployment:
+
+| File | Purpose |
+| ---- | ------- |
+| `.env` | License keys, the shared API secret, database credentials, and the bootstrap admin user. |
+| `values.yaml` | Tyk stack configuration for the Gateway, Dashboard, Pump, Developer Portal, and Operator. |
+
+The bundled `values.yaml` is tuned for trials and evaluation, with Pump analytics to PostgreSQL, audit logging, hashed-key listing, OPA, and Dashboard security settings enabled. Inline comments mark the options to change for production and performance. For production deployments, also review the [Planning for Production](/planning-for-production) guide and the [helm-self-managed README](https://github.com/TykTechnologies/tyk-install/tree/main/kubernetes/helm-self-managed) for Ingress, TLS, autoscaling, and troubleshooting.
+
+### Hybrid Control Plane and Data Plane
+
+The installation above deploys a single, self-contained Tyk stack. To distribute API traffic across multiple data centers or regions, you can instead run a hybrid topology: a central Control Plane that hosts the management components and one or more remote Data Planes whose Gateways serve traffic locally and sync configuration from the Control Plane over [Tyk MDCB](/api-management/mdcb).
+
+To set up a hybrid deployment with Helm:
+
+- Install the [Control Plane](/api-management/mdcb#installing-in-a-kubernetes-cluster-with-our-helm-chart) first to provision the Dashboard, MDCB, and supporting services.
+- Install each [Data Plane](/api-management/mdcb#installing-in-a-kubernetes-cluster-with-our-helm-chart-1) using the connection details produced by the Control Plane installation.
+
+
+## Cleanup
+
+```bash
+# Remove the Tyk stack
+helm uninstall tyk -n tyk
+
+# Remove the databases (this deletes all data)
+helm uninstall tyk-postgres -n tyk
+helm uninstall tyk-redis -n tyk
+
+# Remove secrets and persistent volume claims
+kubectl delete secrets -n tyk --all
+kubectl delete pvc -n tyk --all
+
+# Delete the namespace
+kubectl delete namespace tyk
+```
+
+To remove cert-manager (only if you installed it specifically for Tyk):
+
+```bash
+kubectl delete namespace cert-manager
+```
+
+## Troubleshooting
+
+<AccordionGroup>
+
+<Accordion title='Pods Not Starting'>
+
+Pods fail to initialize or remain in a pending state.
+
+```bash
+# Check pod details
+kubectl describe pod -n tyk <pod-name>
+
+# Check recent events
+kubectl get events -n tyk --sort-by='.lastTimestamp' | tail -20
+
+# Check pod logs
+kubectl logs -n tyk <pod-name>
+```
+
+</Accordion>
+
+<Accordion title='Secret Issues'>
+
+Missing or incorrectly configured Kubernetes secrets prevent proper authentication and configuration.
+
+```bash
+# Verify the secret exists and has all required keys
+kubectl get secret tyk-conf -n tyk -oyaml
+
+# Decode and verify specific values
+kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.APISecret}' | base64 -d && echo
+kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.DashLicense}' | base64 -d && echo
+
+# If the secret is missing or incorrect, recreate it
+kubectl delete secret tyk-conf -n tyk
+# Re-export the environment variables and run Step 3 again
+source .env
+```
+
+</Accordion>
+
+<Accordion title='Portal Login Returns "Bad Request"'>
+
+Developer Portal authentication fails with a bad request error.
+
+Set `PORTAL_DISABLECSRFCHECK=true` in `values.yaml` under `tyk-dev-portal.extraEnvs`. This is needed when accessing the Developer Portal via HTTP or a LoadBalancer IP. Set it to `false` when using a proper domain with TLS and Ingress.
+
+</Accordion>
+
+<Accordion title='Database Connection Issues'>
+
+The Developer Portal or Tyk Dashboard cannot connect to the PostgreSQL database.
+
+```bash
+# Check PostgreSQL is running
+kubectl get pods -n tyk -l app.kubernetes.io/name=postgresql
+
+# Test database connectivity from a pod
+kubectl exec -it -n tyk deployment/dashboard-tyk-tyk-dashboard -- /bin/sh
+# Inside the pod:
+env | grep DATABASE
+
+# Verify the connection string format in the secret
+kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.DashDatabaseConnectionString}' | base64 -d && echo
+# Expected format: postgresql://user:password@host:5432/database
+
+# Check PostgreSQL logs
+kubectl logs -n tyk -l app.kubernetes.io/name=postgresql
+```
+
+</Accordion>
+
+<Accordion title='License Key Issues'>
+
+The Tyk Dashboard or other components fail due to a missing or invalid license key.
+
+```bash
+# Verify the license key is set
+kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.DashLicense}' | base64 -d && echo
+
+# Check Dashboard logs for license errors
+kubectl logs -n tyk -l app=dashboard-tyk-tyk-dashboard --tail=100 | grep -i license
+
+# Check license expiration in the Tyk Dashboard:
+# Settings > License
+```
+
+</Accordion>
+
+<Accordion title='Gateway Not Loading APIs'>
+
+Tyk Gateway fails to retrieve or display API definitions from the Tyk Dashboard.
+
+```bash
+# Check the Gateway is connected to the Dashboard
+kubectl logs -n tyk -l app=gateway-tyk-tyk-gateway --tail=100
+
+# Force a Gateway reload (using APISecret for auth)
+API_SECRET=$(kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.APISecret}' | base64 -d)
+curl -X GET http://localhost:8080/tyk/reload \
+  -H "X-Tyk-Authorization: $API_SECRET"
+
+# Confirm the APIs are published in the Dashboard:
+# APIs > check the "Published" status
+```
+
+</Accordion>
+
+<Accordion title='Dashboard Not Accessible'>
+
+The Tyk Dashboard web interface is unavailable or unreachable.
+
+```bash
+# Check Dashboard pod status
+kubectl get pods -n tyk -l app=dashboard-tyk-tyk-dashboard
+
+# Check the Dashboard service
+kubectl get svc -n tyk | grep dashboard
+
+# Check Dashboard logs
+kubectl logs -n tyk -l app=dashboard-tyk-tyk-dashboard --tail=100
+
+# If using a LoadBalancer, verify an external IP is assigned
+kubectl get svc -n tyk dashboard-svc-tyk-tyk-dashboard
+
+# If using Ingress, verify the ingress is created
+kubectl get ingress -n tyk
+kubectl describe ingress -n tyk <dashboard-ingress-name>
+```
+
+</Accordion>
+
+<Accordion title='Operator Issues'>
+
+Tyk Operator fails to start or manage custom resources.
+
+```bash
+# Check the operator pod is running
+kubectl get pods -n tyk -l control-plane=tyk-operator-controller-manager
+
+# Check operator logs
+kubectl logs -n tyk -l control-plane=tyk-operator-controller-manager --tail=100
+
+# Verify the operator secret exists
+kubectl get secret tyk-operator-conf -n tyk
+
+# Check the CRDs are installed
+kubectl get crds | grep tyk
+```
+
+</Accordion>
+
+<Accordion title='Ingress Not Working'>
+
+Ingress routes fail to direct traffic to the services.
+
+```bash
+# Verify the ingress controller is installed
+kubectl get pods -n kube-system | grep ingress  # For NGINX
+kubectl get pods -n kube-system | grep aws-load-balancer  # For AWS LB Controller
+
+# Check the ingress resource
+kubectl get ingress -n tyk
+kubectl describe ingress -n tyk <ingress-name>
+
+# For AWS ALB, check the AWS console for ALB creation
+# For GKE, check the Google Cloud console for the Load Balancer
+
+# Verify DNS is pointing to the ingress address
+nslookup gateway.yourdomain.com
+```
+
+</Accordion>
+
+</AccordionGroup>
+
+## Legacy Helm Chart
+
+<Warning>
+`tyk-pro` chart is deprecated. Please use our [Tyk Stack helm chart](/product-stack/tyk-charts/tyk-stack-chart) instead. 
+
+We recommend all users migrate to the `tyk-stack` Chart. Please review the [Configuration](/product-stack/tyk-charts/tyk-stack-chart) section of the new helm chart and cross-check with your existing configurations while planning for migration.
+</Warning>
+
+Tyk Helm chart is the preferred (and easiest) way to install **Tyk Self-Managed** on Kubernetes.
+The helm chart `tyk-helm/tyk-pro` will install full Tyk platform with **Tyk Manager**, **Tyk Gateways** and **Tyk Pump** into your Kubernetes cluster. You can also choose to enable the installation of **Tyk Operator** (to manage your APIs in a declarative way).
+
+### Prerequisites
+
+1. **Tyk License**
+
+    If you are evaluating Tyk on Kubernetes, [contact us](https://tyk.io/about/contact/) to obtain a temporary license.
+
+2. **Data stores**
+
+    The following are required for a Tyk Self-Managed installation:
+    - Redis   - Should be installed in the cluster or reachable from inside the cluster (for SaaS option).
+                You can find instructions for a simple Redis installation bellow.
+    - MongoDB or SQL - Should be installed in the cluster or be reachable by the **Tyk Manager** (for SaaS option).
+
+    You can find supported MongoDB and SQL versions [here](/planning-for-production/database-settings).
+
+    Installation instructions for Redis and MongoDB/SQL are detailed below.
+
+3. **Helm**
+
+    Installed [Helm 3](https://helm.sh/)
+    Tyk Helm Chart is using Helm v3 version (i.e. not Helm v2).
+
+### Installing the data stores
+
+For Redis, MongoDB or SQL you can use these rather excellent charts provided by Bitnami
+
+<Tabs>
+<Tab title="Redis">
+<br />
+
+```bash
+helm install tyk-redis bitnami/redis -n tyk --version 19.0.2
+```
+
+<Note>
+Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/planning-for-production/database-settings#redis).
+</Note>
+
+Follow the notes from the installation output to get connection details and password.
+
+```console
+  Redis(TM) can be accessed on the following DNS names from within your cluster:
+
+    tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
+    tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)
+
+  export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)
+```
+
+The DNS name of your Redis as set by Bitnami is `tyk-redis-master.tyk.svc.cluster.local:6379` (Tyk needs the name including the port)
+You can update them in your local `values.yaml` file under `redis.addrs` and `redis.pass`
+Alternatively, you can use `--set` flag to set it in Tyk installation. For example  `--set redis.pass=$REDIS_PASSWORD`
+</Tab>
+<Tab title="MongoDB">
+<br />
+
+```bash
+helm install tyk-mongo bitnami/mongodb --set "replicaSet.enabled=true" -n tyk --version 15.1.3
+```
+
+<Note>
+Bitnami MongoDB images is not supported on darwin/arm64 architecture.
+</Note>
+
+Follow the notes from the installation output to get connection details and password. The DNS name of your MongoDB as set with Bitnami is `tyk-mongo-mongodb.tyk.svc.cluster.local` and you also need to set the `authSource` parameter to `admin`. The full `mongoURL` should be similar to `mongoURL: mongodb://root:pass@tyk-mongo-mongodb.tyk.svc.cluster.local:27017/tyk_analytics?authSource=admin`. You can update them in your local `values.yaml` file under `mongo.mongoURL` Alternatively, you can use `--set` flag to set it in your Tyk installation.
+
+<Note>
+**Important Note regarding MongoDB**
+
+This Helm chart enables the *PodDisruptionBudget* for MongoDB with an arbiter replica-count of 1. If you intend to perform
+system maintenance on the node where the MongoDB pod is running and this maintenance requires for the node to be drained,
+this action will be prevented due the replica count being 1. Increase the replica count in the helm chart deployment to
+a minimum of 2 to remedy this issue.
+</Note>
+
+</Tab>
+<Tab title="SQL">
+<br />
+
+```bash
+helm install tyk-postgres bitnami/postgresql --set "auth.database=tyk_analytics" -n tyk --version 12.12.10
+```
+
+<Note>
+Please make sure you are installing PostgreSQL versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/tyk-self-managed/install#requirements).
+</Note>
+
+Follow the notes from the installation output to get connection details and password. The DNS name of your Postgres service as set by Bitnami is `tyk-postgres-postgresql.tyk.svc.cluster.local`.
+You can update connection details in `values.yaml` file under `postgres`.
+</Tab>
+</Tabs>
+
+---
+
+**Quick Redis and MongoDB PoC installation**
+
+<Warning>
+Another option for Redis and MongoDB, to get started quickly, is to use our **simple-redis** and **simple-mongodb** charts.
+Please note that these provided charts must not ever be used in production and for anything
+but a quick start evaluation only. Use external redis or Official Redis Helm chart in any other case.
+We provide this chart, so you can quickly get up and running, however it is not meant for long term storage of data for example.
+
+```bash
+helm install redis tyk-helm/simple-redis -n tyk
+helm install mongo tyk-helm/simple-mongodb -n tyk
+```
+</Warning>
+
+### Instructions
+
+As well as our official Helm repo, you can also find it in [ArtifactHub](https://artifacthub.io/packages/helm/tyk-helm/tyk-pro).
+[Open in ArtifactHub](https://artifacthub.io/packages/helm/tyk-helm/tyk-pro)
+
+If you are interested in contributing to our charts, suggesting changes, creating PRs or any other way,
+please use [GitHub Tyk-helm-chart repo](https://github.com/TykTechnologies/tyk-helm-chart/tree/master/tyk-pro)
+or contact us in [Tyk Community forum](https://community.tyk.io/) or through our sales team.
+
+
+1. **Add Tyk official Helm repo to your local Helm repository**
+
+    ```bash
+    helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+    helm repo update
+    ```
+
+2. **Create namespace for your Tyk deployment**
+
+    ```bash
+    kubectl create namespace tyk
+    ```
+
+3. **Getting the values.yaml of the chart**
+
+    Before we proceed with installation of the chart you need to set some custom values.
+    To see what options are configurable on a chart and save that options to a custom values.yaml file run:
+
+    ```bash
+    helm show values tyk-helm/tyk-pro > values.yaml
+    ```
+
+4. **License setting**
+
+    For the **Tyk Self-Managed** chart we need to set the license key in your custom `values.yaml` file under `dash.license` field
+    or use `--set dash.license={YOUR-LICENSE_KEY}` with the `helm install` command.
+
+
+    Tyk Self-Managed licensing allow for different numbers of Gateway nodes to connect to a single Dashboard instance.
+    To ensure that your Gateway pods will not scale beyond your license allowance, please ensure that the Gateway's resource kind is `Deployment`
+    and the replica count to your license node limit. By default, the chart is configured to work with a single node license: `gateway.kind=Deployment` and `gateway.replicaCount=1`.
+
+
+    <Note>
+    **Please Note**
+
+    There may be intermittent issues on the new pods during the rolling update process, when the total number of online
+    gateway pods is more than the license limit with lower amounts of Licensed nodes.
+    </Note>
+
+
+5. **Installing Tyk Self managed**
+
+    Now we can install the chart using our custom values:
+
+    ```bash
+    helm install tyk-pro tyk-helm/tyk-pro -f ./values.yaml -n tyk --wait
+    ```
+
+
+    <Note>
+    **Important Note regarding MongoDB**
+
+    The `--wait` argument is important to successfully complete the bootstrap of your **Tyk Manager**.
+    </Note>
+
+### Pump Installation
+
+By default pump installation is disabled. You can enable it by setting `pump.enabled` to `true` in `values.yaml` file.
+Alternatively, you can use `--set pump.enabled=true` while doing helm install.
+
+**Quick Pump configuration(Supported from tyk helm v0.10.0)**
+
+1. **Mongo Pump**
+
+    To configure mongo pump, do following changings in `values.yaml` file:
+
+    1. Set `backend` to `mongo`.
+    2. Set connection string in `mongo.mongoURL`.
+
+2. **Postgres Pump**
+
+    To configure postgres pump, do following changings in `values.yaml` file:
+
+    1. Set `backend` to `postgres`.
+    2. Set connection string parameters in `postgres` section.
+
+### Tyk Developer Portal
+
+You can disable the bootstrapping of the Developer Portal by the `portal.bootstrap: false` in your local `values.yaml` file.
+
+### Using TLS
+
+You can turn on the TLS option under the gateway section in your local `values.yaml` file which will make your Gateway
+listen on port 443 and load up a dummy certificate. You can set your own default certificate by replacing the file in the `certs/` folder.
+
+### Mounting Files
+
+To mount files to any of the Tyk stack components, add the following to the mounts array in the section of that component.
+For example:
+ ```bash
+ - name: aws-mongo-ssl-cert
+  filename: rds-combined-ca-bundle.pem
+  mountPath: /etc/certs
+```
+
+### Sharding APIs
+
+Sharding is the ability for you to decide which of your APIs are loaded on which of your Tyk Gateways. This option is
+turned off by default, however, you can turn it on by updating the `gateway.sharding.enabled` option. Once you do that you
+will also need to set the `gateway.sharding.tags` field with the tags that you want that particular Gateway to load. (ex. tags: "external,ingress".)
+You can then add those tags to your APIs in the API Designer, under the **Advanced Options** tab, and
+the **Segment Tags (Node Segmentation)** section in your Tyk Dashboard.
+Check [Tyk Gateway Sharding](/api-management/api-sharding#what-is-api-sharding-) for more details.
diff --git a/tyk-self-managed/install/linux.mdx b/tyk-self-managed/install/linux.mdx
new file mode 100644
index 0000000000..b4e5905401
--- /dev/null
+++ b/tyk-self-managed/install/linux.mdx
@@ -0,0 +1,1002 @@
+---
+title: "Install Tyk Self-Managed on Linux"
+description: "Installation guide for the Tyk Self-Managed on on Linux distributions using Ubuntu, Debian, Red Hat, and CentOS"
+sidebarTitle: "Linux"
+---
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| Enterprise | Self-Managed, Hybrid |
+
+## Compatible Operating Systems
+
+| Operating System | Version |
+|-----------------|---------|
+| Ubuntu | 20.04 (focal), 22.04 (jammy), 24.04 (noble) |
+| Red Hat Enterprise Linux | 7.9, 8.9, 9.3  |
+| CentOS Stream | Stream 9, Stream 10 |
+| Debian | 11 (Bullseye), 12 (Bookworm) |
+| Amazon Linux | 2023.7 |
+
+### Binaries
+
+Installation packages for supported Linux distributions are available on [packagecloud.io](https://packagecloud.io/tyk).
+
+## Prerequisites
+
+- [Enterprise Edition License](/apim#licensing)
+
+## Red Hat (RHEL / CentOS)
+<a id="install-tyk-on-redhat-rhel-centos"></a>
+
+There are 4 components which needs to be installed.
+
+### Install Database
+
+#### Redis
+
+Tyk Gateway has a [dependency](/planning-for-production/database-settings#redis) on Redis. Follow the steps provided by Red Hat to make the installation of Redis, conducting a [search](https://access.redhat.com/search/?q=redis) for the correct version and distribution.
+
+#### Storage Database
+
+Tyk Dashboard has a dependency on a storage database that can be [PostgreSQL](/planning-for-production/database-settings#postgresql) or [MongoDB](/planning-for-production/database-settings#mongodb-sizing-guidelines).
+
+<Tabs>
+
+<Tab title="PostgreSQL">
+
+Check the PostgreSQL supported [versions](/planning-for-production/database-settings#postgresql). Follow the steps provided by [PostgreSQL](https://www.postgresql.org/download/linux/redhat/) to install it.
+
+Configure PostgreSQL
+
+Create a new role/user
+```console
+sudo -u postgres createuser --interactive
+```
+The name of the role can be "tyk" and say yes to make it a superuser
+
+Create a matching DB with the same name. Postgres authentication system assumes by default that for any role used to log in, that role will have a database with the same name which it can access.
+```console
+sudo -u postgres createdb tyk
+```
+Add another user to be used to log into your operating system
+
+```console
+sudo adduser tyk
+```
+Log in to your Database
+```console
+sudo -u tyk psql
+```
+Update the user “tyk” to have a password
+```console
+ALTER ROLE tyk with PASSWORD '123456';
+```
+Create a DB (my example is tyk_analytics)
+```console
+sudo -u tyk createdb tyk_analytics
+```
+
+</Tab>
+
+<Tab title="MongoDB">
+
+Check the MongoDB supported [versions](/planning-for-production/database-settings#mongodb-sizing-guidelines). Follow the steps provided by [MongoDB](https://www.mongodb.com/docs/manual/tutorial/install-mongodb-on-red-hat/) to install it.
+
+Optionally initialize the database and enable automatic start:
+```console
+# Optionally ensure that MongoDB will start following a system reboot
+sudo systemctl enable mongod
+# start MongoDB server
+sudo systemctl start mongod
+```
+
+</Tab>
+
+</Tabs>
+
+### Install Dashboard
+
+Tyk has its own signed RPMs in a YUM repository hosted by the kind folks at [packagecloud.io](https://packagecloud.io/tyk/tyk-dashboard/install#manual-rpm), which makes it easy, safe and secure to install a trusted distribution of the Tyk Gateway stack.
+
+This configuration should also work (with some tweaks) for CentOS.
+
+**Prerequisites**
+
+*   Ensure port `3000` is open: This is used by the Dashboard to provide the GUI and the Classic Developer Portal.
+*   Follow the steps provided in this link [Getting started on Red Hat (RHEL / CentOS)](#install-tyk-on-redhat-rhel-centos) to install and configure Tyk dependencies.
+
+1. **Set up YUM Repositories**
+
+    First, install two package management utilities `yum-utils` and a file downloading tool `wget`:
+    ```bash
+    sudo yum install yum-utils wget
+    ```
+    Then install Python:
+    ```bash
+    sudo yum install python3
+    ```
+
+2. **Configure and Install the Tyk Dashboard**
+
+    Create a file named `/etc/yum.repos.d/tyk_tyk-dashboard.repo` that contains the repository configuration settings for YUM repositories `tyk_tyk-dashboard` and `tyk_tyk-dashboard-source` used to download packages from the specified URLs, including GPG key verification and SSL settings, on a Linux system.
+
+    Make sure to replace `el` and `8` in the config below with your Linux distribution and version:
+    ```bash
+    [tyk_tyk-dashboard]
+    name=tyk_tyk-dashboard
+    baseurl=https://packagecloud.io/tyk/tyk-dashboard/el/8/$basearch
+    repo_gpgcheck=1
+    gpgcheck=0
+    enabled=1
+    gpgkey=https://packagecloud.io/tyk/tyk-dashboard/gpgkey
+    sslverify=1
+    sslcacert=/etc/pki/tls/certs/ca-bundle.crt
+    metadata_expire=300
+
+    [tyk_tyk-dashboard-source]
+    name=tyk_tyk-dashboard-source
+    baseurl=https://packagecloud.io/tyk/tyk-dashboard/el/8/SRPMS
+    repo_gpgcheck=1
+    gpgcheck=0
+    enabled=1
+    gpgkey=https://packagecloud.io/tyk/tyk-dashboard/gpgkey
+    sslverify=1
+    sslcacert=/etc/pki/tls/certs/ca-bundle.crt
+    metadata_expire=300
+    ```
+
+    We'll need to update the YUM package manager's local cache, enabling only the `tyk_tyk-dashboard` repository while disabling all other repositories `--disablerepo='*' --enablerepo='tyk_tyk-dashboard'`, and confirm all prompts `-y`.
+    ```bash
+    sudo yum -q makecache -y --disablerepo='*' --enablerepo='tyk_tyk-dashboard'
+    ```
+
+    Install Tyk dashboard:
+    ```bash
+    sudo yum install -y tyk-dashboard
+    ```
+
+3. **Confirm Redis and MongoDB or PostgreSQL are running**
+
+    Start Redis since it is always required by the Dashboard.
+    ```bash
+    sudo service redis start
+    ```
+    Then start either MongoDB or PostgreSQL depending on which one you are using.
+    ```bash
+    sudo systemctl start mongod
+    ```
+    ```bash
+    sudo systemctl start postgresql-13
+    ```
+
+4. **Configure Tyk Dashboard**
+
+We can set the Dashboard up with a similar setup command, the script below will get the Dashboard set up for the local instance.
+Make sure to use the actual DNS hostname or the public IP of your instance as the last parameter.
+
+<Tabs>
+<Tab title="MongoDB">
+
+```bash
+sudo /opt/tyk-dashboard/install/setup.sh --listenport=3000 --redishost=<Redis Hostname> --redisport=6379 --mongo=mongodb://<Mongo IP Address>:<Mongo Port>/tyk_analytics --tyk_api_hostname=$HOSTNAME --tyk_node_hostname=http://localhost --tyk_node_port=8080 --portal_root=/portal --domain="XXX.XXX.XXX.XXX"
+```
+
+Replace `<Redis Hostname>`, `<Mongo IP Address>` and `<Mongo Port>` with your own values to run this script.
+
+</Tab>
+<Tab title="SQL">
+
+```bash
+sudo /opt/tyk-dashboard/install/setup.sh --listenport=3000 --redishost=<Redis Hostname> --redisport=6379 --storage=postgres --connection_string=postgresql://<User>:<Password>@<PostgreSQL Hostname>:<PostgreSQL Port>/<PostgreSQL DB> --tyk_api_hostname=$HOSTNAME --tyk_node_hostname=http://localhost --tyk_node_port=8080 --portal_root=/portal --domain="XXX.XXX.XXX.XXX"
+```
+
+Replace `<Redis Hostname>`,`<PostgreSQL Hostname>`,`<PostgreSQL Port>`, `<PostgreSQL User>`, `<PostgreSQL Password>` and `<PostgreSQL DB>` with your own values to run the script.
+
+</Tab>
+</Tabs>
+
+With these values your are configuring the following:
+
+*   `--listenport=3000`: Tyk Dashboard (and Portal) to listen on port `3000`.
+*   `--redishost=<hostname>`: Tyk Dashboard should use the local Redis instance.
+*   `--redisport=6379`: The Tyk Dashboard should use the default port.
+*   `--domain="XXX.XXX.XXX.XXX"`: Bind the Dashboard to the IP or DNS hostname of this instance (required).
+*   `--mongo=mongodb://<Mongo IP Address>:<Mongo Port>/tyk_analytics`: Use the local MongoDB (should always be the same as the Gateway).
+*   `--storage=postgres`: In case, your preferred storage Database is PostgreSQL, use storage type "postgres" and specify connection string.
+*   `--connection_string=postgresql://<User>:<Password>@<PostgreSQL Host Name>:<PostgreSQL Port>/<PostgreSQL DB>`: Use the PostgreSQL instance provided in the connection string (should always be the same as the gateway).
+*   `--tyk_api_hostname=$HOSTNAME`: The Tyk Dashboard has no idea what hostname has been given to Tyk, so we need to tell it, in this instance we are just using the local HOSTNAME env variable, but you could set this to the public-hostname/IP of the instance.
+*   `--tyk_node_hostname=http://localhost`: The Tyk Dashboard needs to see a Tyk node in order to create new tokens, so we need to tell it where we can find one, in this case, use the one installed locally.
+*   `--tyk_node_port=8080`: Tell the Dashboard that the Tyk node it should communicate with is on port 8080.
+*   `--portal_root=/portal`: We want the Portal to be shown on /portal of whichever domain we set for the Portal.
+
+5. **Start Tyk Dashboard**
+
+    ```bash
+    sudo service tyk-dashboard start
+    ```
+    
+
+    <Note>
+    To check the logs from the deployment run:
+    ```bash
+    sudo journalctl -u tyk-dashboard 
+    ```
+    </Note>
+
+
+    Notice how we haven't actually started the gateway yet, because this is a Dashboard install, we need to enter a license first.
+
+    
+<Note>
+When using PostgreSQL you may receive the error: `"failed SASL auth (FATAL: password authentication failed for user...)"`, follow these steps to address the issue:
+1. Open the terminal or command prompt on your PostgreSQL server.
+2. Navigate to the location of the `pg_hba.conf` file. This file is typically located at `/var/lib/pgsql/13/data/pg_hba.conf`.
+3. Open the `pg_hba.conf` file using a text manipulation tool.
+4. In the  `pg_hba.conf` file, locate the entry corresponding to the user encountering the authentication error. This entry might resemble the following:
+```bash
+host    all    all    <IP_address>/<netmask>    scram-sha-256
+```
+5. In the entry, find the METHOD column. It currently has the value scram-sha-256.
+6. Replace scram-sha-256 with md5, so the modified entry looks like this:
+```bash
+host    all    all    <IP_address>/<netmask>    md5
+```
+7. Save the changes you made to the `pg_hba.conf` file.
+8. Restart the PostgreSQL service to apply the modifications:
+```bash
+sudo systemctl restart postgresql-13
+```
+</Note>
+
+
+6. **Enter Dashboard license**
+
+    Add your license in `/var/opt/tyk-dashboard/tyk_analytics.conf` in the `license` field.
+
+    If all is going well, you will be taken to a Dashboard setup screen - we'll get to that soon.
+
+7. **Restart the Dashboard process**
+
+    Because we've just entered a license via the UI, we need to make sure that these changes get picked up, so to make sure things run smoothly, we restart the Dashboard process (you only need to do this once) and (if you have it installed) then start the gateway:
+    ```bash
+    sudo service tyk-dashboard restart 
+    ```
+
+8. **Go to the Tyk Dashboard URL**
+
+    Go to the following URL to access to the Tyk Dashboard:
+
+    ```bash
+    127.0.0.1:3000
+    ```
+
+    You should get to the Tyk Dashboard Setup screen:
+
+    <img src="/img/dashboard/system-management/bootstrap_screen.png" alt="Tyk Dashboard Bootstrap Screen" />
+
+9. **Create your Organization and Default User**
+
+    You need to enter the following:
+
+    * Your **Organization Name**
+    * Your **Organization Slug**
+    * Your User **Email Address**
+    * Your User **First and Last Name**
+    * A **Password** for your User
+    * **Re-enter** your user **Password**
+
+
+    
+
+    <Note>
+    For a password, we recommend a combination of alphanumeric characters, with both upper and lower case letters.
+    </Note>
+
+
+
+    Click **Bootstrap** to save the details.
+
+10. **Login to the Dashboard**
+
+    You can now log in to the Tyk Dashboard from `127.0.0.1:3000`, using the username and password created in the Dashboard Setup screen.
+
+    **Configure your Developer Portal**
+
+    To set up your [Developer Portal](/portal/overview/intro) follow our Self-Managed [tutorial on publishing an API to the Portal Catalog](/getting-started/tutorials/publish-api).
+
+### Install Pump
+
+
+Tyk has it's own signed RPMs in a YUM repository hosted by the kind folks at [packagecloud.io](https://packagecloud.io), which makes it easy, safe and secure to install a trusted distribution of the Tyk Gateway stack.
+
+This tutorial will run on an [Amazon AWS](http://aws.amazon.com) *Red Hat Enterprise Linux 7.1* instance. We will install Tyk Pump with all dependencies stored locally.
+
+We're installing on a `t2.micro` because this is a tutorial, you'll need more RAM and more cores for better performance.
+
+This configuration should also work (with some tweaks) for CentOS.
+
+**Prerequisites**
+
+We are assuming that Redis and either MongoDB or SQL are installed (these are installed as part of the Tyk Gateway and Dashboard installation guides)
+
+**Step 1: Set up YUM Repositories**
+
+First, we need to install some software that allows us to use signed packages:
+```bash
+sudo yum install pygpgme yum-utils wget
+```
+
+Next, we need to set up the various repository configurations for Tyk and MongoDB:
+
+Create a file named `/etc/yum.repos.d/tyk_tyk-pump.repo` that contains the repository configuration below: 
+
+Make sure to replace `el` and `7` in the config below with your Linux distribution and version:
+```bash
+[tyk_tyk-pump]
+name=tyk_tyk-pump
+baseurl=https://packagecloud.io/tyk/tyk-pump/el/7/$basearch
+repo_gpgcheck=1
+gpgcheck=1
+enabled=1
+gpgkey=https://keyserver.tyk.io/tyk.io.rpm.signing.key.2020
+       https://packagecloud.io/tyk/tyk-pump/gpgkey
+sslverify=1
+sslcacert=/etc/pki/tls/certs/ca-bundle.crt
+metadata_expire=300
+```
+
+Finally we'll need to update our local cache, so run:
+```bash
+sudo yum -q makecache -y --disablerepo='*' --enablerepo='tyk_tyk-pump'
+```
+
+**Step 2: Install Packages**
+
+We're ready to go, you can now install the relevant packages using yum:
+```bash
+sudo yum install -y tyk-pump
+```
+
+**(You may be asked to accept the GPG key for our repos and when the package installs, hit yes to continue.)**
+<br />
+
+**Step 3: Configure Tyk Pump**
+
+If you don't complete this step, you won't see any analytics in your Dashboard, so to enable the analytics service, we need to ensure Tyk Pump is running and configured properly.
+
+
+**Configure Tyk Pump for MongoDB**
+<br />
+
+<Note>
+You need to replace `<hostname>` for `--redishost=<hostname>`, and `<Mongo IP Address>`, `<Mongo Port>`  for `--mongo=mongodb://<Mongo IP Address>:<Mongo Port>/` with your own values to run this script.
+</Note>
+
+
+```bash
+sudo /opt/tyk-pump/install/setup.sh --redishost=<hostname> --redisport=6379 --mongo=mongodb://<IP Address>:<Mongo Port>/tyk_analytics
+```
+**Configure Tyk Pump for SQL**
+<br />
+
+<Note>
+You need to replace `<hostname>` for `--redishost=<hostname>`, and `<Postgres Host Name>`,`<Port>`, `<User>`, `<Password>`, `<DB>` for `--postgres="host=<Postgres Host Name> port=<Port> user=<User> password=<Password> dbname=<DB>"` with your own values to run this script.
+</Note>
+
+```bash
+sudo /opt/tyk-pump/install/setup.sh --redishost=<hostname> --redisport=6379 --postgres="host=<Postgres Host Name> port=<Port> user=<User> password=<Password> dbname=<DB>"
+```
+
+
+**Step 4: Start Tyk Pump**
+
+```bash
+sudo service tyk-pump start
+```
+
+That's it, the Pump should now be up and running.
+
+You can verify if Tyk Pump is running and working by accessing the logs:
+```bash
+sudo journalctl -u tyk-pump
+```
+### Install Gateway
+
+
+Tyk has it's own signed RPMs in a YUM repository hosted by the kind folks at [packagecloud.io](https://packagecloud.io/tyk/tyk-dashboard/install#manual-rpm), which makes it easy, safe and secure to install a trusted distribution of the Tyk Gateway stack.
+
+This tutorial will run on an [Amazon AWS](http://aws.amazon.com) *Red Hat Enterprise Linux 7.1* instance. We will install Tyk Gateway with all dependencies stored locally.
+
+We're installing on a `t2.micro` because this is a tutorial, you'll need more RAM and more cores for better performance.
+
+This configuration should also work (with some tweaks) for CentOS.
+
+**Prerequisites**
+
+*   Ensure port `8080` is open: this is used in this guide for Gateway traffic (API traffic to be proxied)
+*   EPEL (Extra Packages for Enterprise Linux) is a free, community based repository project from Fedora which provides high quality add-on software packages for Linux distribution including RHEL, CentOS, and Scientific Linux. EPEL isn’t a part of RHEL/CentOS but it is designed for major Linux distributions. In our case we need it for Redis. Install EPEL using the instructions here.
+
+**Step 1: Set up YUM Repositories**
+
+First, we need to install some software that allows us to use signed packages:
+```bash
+sudo yum install pygpgme yum-utils wget
+```
+
+Next, we need to set up the various repository configurations for Tyk and MongoDB:
+
+**Step 2: Create Tyk Gateway Repository Configuration**
+
+Create a file named `/etc/yum.repos.d/tyk_tyk-gateway.repo` that contains the repository configuration below https://packagecloud.io/tyk/tyk-gateway/install#manual-rpm:
+```bash
+[tyk_tyk-gateway]
+name=tyk_tyk-gateway
+baseurl=https://packagecloud.io/tyk/tyk-gateway/el/7/$basearch
+repo_gpgcheck=1
+gpgcheck=1
+enabled=1
+gpgkey=https://keyserver.tyk.io/tyk.io.rpm.signing.key.2020
+       https://packagecloud.io/tyk/tyk-gateway/gpgkey
+sslverify=1
+sslcacert=/etc/pki/tls/certs/ca-bundle.crt
+metadata_expire=300
+```
+
+**Step 3: Install Packages**
+
+We're ready to go, you can now install the relevant packages using yum:
+```bash
+sudo yum install -y redis tyk-gateway
+```
+
+*(you may be asked to accept the GPG key for our two repos and when the package installs, hit yes to continue)*
+
+**Step 4: Start Redis**
+
+In many cases Redis will not be running, so let's start those:
+```bash
+sudo service redis start
+```
+
+When Tyk is finished installing, it will have installed some init scripts, but it will not be running yet. The next step will be to setup the Gateway – thankfully this can be done with three very simple commands.
+
+## Install Tyk on Debian or Ubuntu
+
+### Install Database
+
+
+**Requirements**
+
+Before installing the Tyk components in the order below, you need to first install Redis and MongoDB/SQL.
+
+**Getting Started**
+
+<Tabs>
+<Tab title="MongoDB">
+**Install MongoDB 4.0**
+
+You should follow the [online tutorial for installing MongoDb](https://docs.mongodb.com/v4.0/tutorial/install-mongodb-on-ubuntu/). We will be using version 4.0. As part of the Mongo installation you need to perform the following:
+
+1. Import the public key
+2. Create a list file
+3. Reload the package database
+4. Install the MongoDB packages
+5. Start MongoDB
+6. Check the `mongod` service is running
+
+</Tab>
+<Tab title="SQL">
+
+**Install SQL**
+
+You should follow the [online tutorial for installing PostgreSQL](https://www.postgresql.org/download/linux/ubuntu/). We will be using version 13. As part of the PostgreSQL installation you need to perform the following:
+
+1. Create the file repository configuration
+2. Import the repository signing key
+3. Update the package lists
+4. Install the PostgreSQL packages
+5. Start PostgreSQL
+6. Check the `postgresql` service is running
+
+See [SQL configuration](/planning-for-production/database-settings#postgresql) for details on installing SQL in a production environment.
+</Tab>
+</Tabs>
+
+**Install Redis**
+
+```console
+$ sudo apt-get install -y redis-server
+```
+
+<Note>
+For a production environment, we recommend that the Gateway, Dashboard and Pump are installed on separate machines. If installing multiple Gateways, you should install each on a separate machine. See [Planning for Production](/planning-for-production) For more details.
+</Note>
+
+### Install Dashboard
+<a id="Debian-Ubuntu-install-dashboard"></a>
+
+
+Tyk has its own APT repositories hosted by the kind folks at [packagecloud.io](https://packagecloud.io/tyk), which makes it easy, safe and secure to install a trusted distribution of the Tyk Gateway stack.
+
+This tutorial has been tested on Ubuntu 16.04 & 18.04 with few if any modifications. We will install the Tyk Dashboard with all dependencies locally.
+
+**Prerequisites**
+- Have MongoDB/SQL and Redis installed - follow the guide for [installing databases on Debian/Ubuntu](#install-tyk-on-debian-or-ubuntu).
+- Ensure port `3000` is available. This is used by the Tyk Dashboard to provide the GUI and the Developer Portal.
+
+**Step 1: Set up our APT Repositories**
+
+First, add our GPG key which signs our binaries:
+
+```bash
+curl -L https://packagecloud.io/tyk/tyk-dashboard/gpgkey | sudo apt-key add -
+```
+
+Run update:
+
+```bash
+sudo apt-get update
+```
+
+Since our repositories are installed via HTTPS, you will need to make sure APT supports this:
+
+```bash
+sudo apt-get install -y apt-transport-https
+```
+
+Now lets add the required repos and update again (notice the `-a` flag in the second Tyk commands - this is important!):
+
+```bash
+echo "deb https://packagecloud.io/tyk/tyk-dashboard/ubuntu/ bionic main" | sudo tee /etc/apt/sources.list.d/tyk_tyk-dashboard.list
+
+echo "deb-src https://packagecloud.io/tyk/tyk-dashboard/ubuntu/ bionic main" | sudo tee -a /etc/apt/sources.list.d/tyk_tyk-dashboard.list
+
+sudo apt-get update
+```
+
+
+<Note>
+`bionic` is the code name for Ubuntu 18.04. Please substitute it with your particular [ubuntu release](https://releases.ubuntu.com/), e.g. `focal`.
+</Note>
+
+
+**What we've done here is:**
+
+- Added the Tyk Dashboard repository
+- Updated our package list
+
+**Step 2: Install the Tyk Dashboard**
+
+We're now ready to install the Tyk Dashboard. To install run:
+
+```bash
+sudo apt-get install -y tyk-dashboard
+```
+
+What we've done here is instructed `apt-get` to install the Tyk Dashboard without prompting. Wait for the downloads to complete.
+
+When the Tyk Dashboard has finished installing, it will have installed some `init` scripts, but it will not be running yet. The next step will be to setup each application - thankfully this can be done with three very simple commands.
+
+**Verify the origin key (optional)**
+
+Debian packages are signed with the repository keys. These keys are verified at the time of fetching the package and is taken care of by the `apt` infrastructure. These keys are controlled by PackageCloud, our repository provider. For an additional guarantee, it is possible to verify that the package was indeed created by Tyk by verifying the `origin` certificate that is attached to the package.
+
+First, you have to fetch Tyk's signing key and import it.
+
+```bash
+wget https://keyserver.tyk.io/tyk.io.deb.signing.key
+gpg --import tyk.io.deb.signing.key
+```
+
+Then, you have to either,
+- sign the key with your ultimately trusted key
+- trust this key ultimately
+
+The downloaded package will be available in `/var/cache/apt/archives`. Assuming you found the file `tyk-gateway-2.9.4_amd64.deb` there, you can verify the origin signature.
+
+```bash
+gpg --verify d.deb
+gpg: Signature made Wed 04 Mar 2020 03:05:00 IST
+gpg:                using RSA key F3781522A858A2C43D3BC997CA041CD1466FA2F8
+gpg: Good signature from "Team Tyk (package signing) <team@tyk.io>" [ultimate]
+```
+
+##### **Configure Tyk Dashboard**
+
+**Prerequisites for MongoDB**
+
+You need to ensure the MongoDB and Redis services are running before proceeding.
+
+
+<Note>
+You need to replace `<hostname>` for `--redishost=<hostname>`, and `<IP Address>` for `--mongo=mongodb://<IP Address>/` with your own values to run this script.
+</Note>
+
+
+
+You can set your Tyk Dashboard up with a helper setup command script. This will get the Dashboard set up for the local instance:
+
+```bash
+sudo /opt/tyk-dashboard/install/setup.sh --listenport=3000 --redishost=<hostname> --redisport=6379 --mongo=mongodb://<IP Address>/tyk_analytics --tyk_api_hostname=$HOSTNAME --tyk_node_hostname=http://localhost --tyk_node_port=8080 --portal_root=/portal --domain="XXX.XXX.XXX.XXX"
+```
+
+
+<Note>
+Make sure to use the actual DNS hostname or the public IP of your instance as the last parameter.
+</Note>
+
+
+
+What we have done here is:
+
+- `--listenport=3000`: Told the Tyk Dashboard (and Portal) to listen on port 3000.
+- `--redishost=<hostname>`: The Tyk Dashboard should use the local Redis instance.
+- `--redisport=6379`: The Tyk Dashboard should use the default port.
+- `--domain="XXX.XXX.XXX.XXX"`: Bind the Tyk Dashboard to the IP or DNS hostname of this instance (required).
+- `--mongo=mongodb://<IP Address>/tyk_analytics`: Use the local MongoDB (should always be the same as the gateway).
+- `--tyk_api_hostname=$HOSTNAME`: The Tyk Dashboard has no idea what hostname has been given to Tyk, so we need to tell it, in this instance we are just using the local HOSTNAME env variable, but you could set this to the public-hostname/IP of the instance.
+- `--tyk_node_hostname=http://localhost`: The Tyk Dashboard needs to see a Tyk node in order to create new tokens, so we need to tell it where we can find one, in this case, use the one installed locally.
+- `--tyk_node_port=8080`: Tell the Tyk Dashboard that the Tyk node it should communicate with is on port 8080.
+- `--portal_root=/portal`: We want the portal to be shown on `/portal` of whichever domain we set for the portal.
+
+**Prerequisites for SQL**
+
+You need to ensure the PostgreSQL and Redis services are running before proceeding.
+
+
+<Note>
+You need to replace `<hostname>` for `--redishost=<hostname>`, and `<Postgres Host Name>`, `<Port>`, `<User>`, `<Password>`, `<DB>` for `--connection_string="host=<Postgres Host Name> port=<Port> user=<User> password=<Password> dbname=<DB>"` with your own values to run this script.
+</Note>
+
+
+
+You can set the Tyk Dashboard up with a helper setup command script. This will get the Dashboard set up for the local instance:
+
+```bash
+sudo /opt/tyk-dashboard/install/setup.sh --listenport=3000 --redishost=<hostname> --redisport=6379 --storage=postgres --connection_string="host=<Postgres Host Name> port=<Port> user=<User> password=<Password> dbname=<DB>" --tyk_api_hostname=$HOSTNAME --tyk_node_hostname=http://localhost --tyk_node_port=8080 --portal_root=/portal --domain="XXX.XXX.XXX.XXX"
+```
+
+
+<Note>
+Make sure to use the actual DNS hostname or the public IP of your instance as the last parameter.
+</Note>
+
+
+
+What we have done here is:
+
+- `--listenport=3000`: Told the Tyk Dashboard (and Portal) to listen on port 3000.
+- `--redishost=<hostname>`: The Tyk Dashboard should use the local Redis instance.
+- `--redisport=6379`: The Tyk Dashboard should use the default port.
+- `--domain="XXX.XXX.XXX.XXX"`: Bind the dashboard to the IP or DNS hostname of this instance (required).
+- `--storage=postgres`: Use storage type postgres.
+- `--connection_string="host=<Postgres Host Name> port=<Port> user=<User> password=<Password> dbname=<DB>"`: Use the postgres instance provided in the connection string(should always be the same as the gateway).
+- `--tyk_api_hostname=$HOSTNAME`: The Tyk Dashboard has no idea what hostname has been given to Tyk, so we need to tell it, in this instance we are just using the local HOSTNAME env variable, but you could set this to the public-hostname/IP of the instance.
+- `--tyk_node_hostname=http://localhost`: The Tyk Dashboard needs to see a Tyk node in order to create new tokens, so we need to tell it where we can find one, in this case, use the one installed locally.
+- `--tyk_node_port=8080`: Tell the dashboard that the Tyk node it should communicate with is on port 8080.
+- `--portal_root=/portal`: We want the portal to be shown on `/portal` of whichever domain we set for the portal.
+
+
+**Step 1: Enter your Tyk Dashboard License**
+
+Add your license in `/opt/tyk-dashboard/tyk_analytics.conf` in the `license` field.
+
+**Step 2: Start the Tyk Dashboard**
+
+Start the dashboard service, and ensure it will start automatically on system boot.
+
+```bash
+sudo systemctl start tyk-dashboard
+sudo systemctl enable tyk-dashboard
+```
+
+**Step 3: Install your Tyk Gateway**
+
+Follow the [Gateway installation instructions](#using-shell-7) to connect to your Dashboard instance before you continue on to step 4.
+
+**Step 4: Bootstrap the Tyk Dashboard with an initial User and Organization**
+
+Go to:
+
+```bash
+127.0.0.1:3000
+```
+
+You should get to the Tyk Dashboard Setup screen:
+
+<img src="/img/dashboard/system-management/bootstrap_screen.png" alt="Tyk Dashboard Bootstrap Screen" />
+
+**Step 5 - Create your Organization and Default User**
+
+You need to enter the following:
+
+- Your **Organization Name**
+- Your **Organization Slug**
+- Your User **Email Address**
+- Your User **First and Last Name**
+- A **Password** for your User
+- **Re-enter** your user **Password**
+
+
+
+    <Note>
+    For a password, we recommend a combination of alphanumeric characters, with both upper and lower case
+    letters.
+    </Note>
+
+
+Click **Bootstrap** to save the details.
+
+**Step 6 - Login to the Tyk Dashboard**
+
+You can now log in to the Tyk Dashboard from `127.0.0.1:3000`, using the username and password created in the Dashboard Setup screen.
+
+##### **Configure your Developer Portal**
+
+To set up your [Developer Portal](/portal/overview/intro) follow our Self-Managed [tutorial on publishing an API to the Portal Catalog](/getting-started/tutorials/publish-api).
+
+### Install Pump
+<a id="Debian-Ubuntu-install-pump"></a>
+
+
+This tutorial has been tested Ubuntu 16.04 & 18.04 with few if any modifications.
+
+**Prerequisites**
+
+- You have installed Redis and either MongoDB or SQL.
+- You have installed the Tyk Dashboard.
+
+**Step 1: Set up our APT repositories**
+
+First, add our GPG key which signs our binaries:
+
+```bash
+curl -L https://packagecloud.io/tyk/tyk-pump/gpgkey | sudo apt-key add -
+```
+
+Run update:
+
+```bash
+sudo apt-get update
+```
+
+Since our repositories are installed via HTTPS, you will need to make sure APT supports this:
+
+```bash
+sudo apt-get install -y apt-transport-https
+```
+
+Now lets add the required repos and update again (notice the `-a` flag in the second Tyk commands - this is important!):
+
+```bash
+echo "deb https://packagecloud.io/tyk/tyk-pump/ubuntu/ bionic main" | sudo tee /etc/apt/sources.list.d/tyk_tyk-pump.list
+
+echo "deb-src https://packagecloud.io/tyk/tyk-pump/ubuntu/ bionic main" | sudo tee -a /etc/apt/sources.list.d/tyk_tyk-pump.list
+
+sudo apt-get update
+```
+
+
+<Note>
+`bionic` is the code name for Ubuntu 18.04. Please substitute it with your particular [ubuntu release](https://releases.ubuntu.com/), e.g. `focal`.
+</Note>
+
+
+**What you've done here is:**
+
+- Added the Tyk Pump repository
+- Updated our package list
+
+**Step 2: Install the Tyk Pump**
+
+You're now ready to install the Tyk Pump. To install it, run:
+
+```bash
+sudo apt-get install -y tyk-pump
+```
+
+What you've done here is instructed `apt-get` to install Tyk Pump without prompting. Wait for the downloads to complete.
+
+When Tyk Pump has finished installing, it will have installed some `init` scripts, but it will not be running yet. The next step will be to setup each application using three very simple commands.
+
+**Verify the origin key (optional)**
+
+Debian packages are signed with the repository keys. These keys are verified at the time of fetching the package and is taken care of by the `apt` infrastructure. These keys are controlled by PackageCloud, our repository provider. For an additional guarantee, it is possible to verify that the package was indeed created by Tyk by verifying the `origin` certificate that is attached to the package.
+
+First, you have to fetch Tyk's signing key and import it.
+
+```bash
+wget https://keyserver.tyk.io/tyk.io.deb.signing.key
+gpg --import tyk.io.deb.signing.key
+```
+
+Then, you have to either,
+- sign the key with your ultimately trusted key
+- trust this key ultimately
+
+The downloaded package will be available in `/var/cache/apt/archives`. Assuming you found the file `tyk-gateway-2.9.3_amd64.deb` there, you can verify the origin signature.
+
+```bash
+gpg --verify d.deb
+gpg: Signature made Wed 04 Mar 2020 03:05:00 IST
+gpg:                using RSA key F3781522A858A2C43D3BC997CA041CD1466FA2F8
+gpg: Good signature from "Team Tyk (package signing) <team@tyk.io>" [ultimate]
+```
+
+**Step 3: Configure Tyk Pump**
+
+If you don't complete this step, you won't see any analytics in your Dashboard, so to enable the analytics service, we need to ensure Tyk Pump is running and configured properly.
+
+**Option 1: Configure Tyk Pump for MongoDB**
+<br />
+
+<Note>
+You need to replace `<hostname>` for `--redishost=<hostname>`, and `<IP Address>` for `--mongo=mongodb://<IP Address>/` with your own values to run this script.
+</Note>
+
+
+```bash
+sudo /opt/tyk-pump/install/setup.sh --redishost=<hostname> --redisport=6379 --mongo=mongodb://<IP Address>/tyk_analytics
+```
+
+**Option 2: Configure Tyk Pump for SQL**
+<br />
+
+<Note>
+You need to replace `<hostname>` for `--redishost=<hostname>`, and `<Postgres Host Name>`,`<Port>`, `<User>`, `<Password>`, `<DB>` for `--postgres="host=<Postgres Host Name> port=<Port> user=<User> password=<Password> dbname=<DB>"` with your own values to run this script.
+</Note>
+
+
+```bash
+sudo /opt/tyk-pump/install/setup.sh --redishost=<hostname> --redisport=6379 --postgres="host=<Postgres Host Name> port=<Port> user=<User> password=<Password> dbname=<DB>"
+```
+
+**Step 4: Start Tyk Pump**
+
+```bash
+sudo service tyk-pump start
+sudo service tyk-pump enable
+```
+
+You can verify if Tyk Pump is running and working by tailing the log file:
+
+```bash
+sudo tail -f /var/log/upstart/tyk-pump.log
+```
+### Install Gateway
+<a id="debian-ubuntu-install-gateway"></a>
+
+
+Tyk has it's own APT repositories hosted by the kind folks at [packagecloud.io][1], which makes it easy, safe and secure to install a trusted distribution of the Tyk Gateway stack.
+
+This tutorial has been tested on Ubuntu 16.04 & 18.04 with few if any modifications.
+
+Please note however, that should you wish to write your own plugins in Python, we currently have a Python version dependency of 3.4. Python-3.4 ships with Ubuntu 14.04, however you may need to explicitly install it on newer Ubuntu Operating System releases.
+
+**Prerequisites**
+
+*   Ensure port `8080` is available. This is used in this guide for Gateway traffic (API traffic to be proxied).
+*   You have MongoDB and Redis installed.
+*   You have installed firstly the Tyk Dashboard, then the Tyk Pump.
+
+**Step 1: Set up our APT Repositories**
+
+First, add our GPG key which signs our binaries:
+
+```bash
+curl -L https://packagecloud.io/tyk/tyk-gateway/gpgkey | sudo apt-key add -
+```
+
+Run update:
+```bash
+sudo apt-get update
+```
+
+Since our repositories are installed via HTTPS, you will need to make sure APT supports this:
+```bash
+sudo apt-get install -y apt-transport-https 
+```
+
+Create a file `/etc/apt/sources.list.d/tyk_tyk-gateway.list` with the following contents:
+```bash
+deb https://packagecloud.io/tyk/tyk-gateway/ubuntu/ bionic main
+deb-src https://packagecloud.io/tyk/tyk-gateway/ubuntu/ bionic main
+```
+
+<Note>
+`bionic` is the code name for Ubuntu 18.04. Please substitute it with your particular [ubuntu release](https://releases.ubuntu.com/), e.g. `focal`.
+</Note>
+
+
+Now you can refresh the list of packages with:
+```bash
+sudo apt-get update
+```
+
+**What we've done here is:**
+
+*   Added the Tyk Gateway repository
+*   Updated our package list
+
+**Step 2: Install the Tyk Gateway**
+
+We're now ready to install the Tyk Gateway. To install it, run:
+
+```bash
+sudo apt-get install -y tyk-gateway
+```
+What we've done here is instructed apt-get to install the Tyk Gateway without prompting, wait for the downloads to complete.
+
+When Tyk has finished installing, it will have installed some init scripts, but will not be running yet. The next step will be to set up the Gateway - thankfully this can be done with three very simple commands, however it does depend on whether you are configuring Tyk Gateway for use with the Dashboard or without (the Community Edition).
+
+**Verify the origin key (optional)**
+
+Debian packages are signed with the repository keys. These keys are verified at the time of fetching the package and is taken care of by the `apt` infrastructure. These keys are controlled by PackageCloud, our repository provider. For an additional guarantee, it is possible to verify that the package was indeed created by Tyk by verifying the `origin` certificate that is attached to the package.
+
+First, you have to fetch Tyk's signing key and import it.
+
+```bash
+wget https://keyserver.tyk.io/tyk.io.deb.signing.key
+gpg --import tyk.io.deb.signing.key
+```
+
+Then, you have to either,
+- sign the key with your ultimately trusted key
+- trust this key ultimately
+
+The downloaded package will be available in `/var/cache/apt/archives`. Assuming you found the file `tyk-gateway-2.9.4_amd64.deb` there, you can verify the origin signature.
+
+```bash
+gpg --verify d.deb
+gpg: Signature made Wed 04 Mar 2020 03:05:00 IST
+gpg:                using RSA key F3781522A858A2C43D3BC997CA041CD1466FA2F8
+gpg: Good signature from "Team Tyk (package signing) <team@tyk.io>" [ultimate]
+```
+
+**Configure Tyk Gateway with Dashboard**
+
+**Prerequisites**
+
+This configuration assumes that you have already installed the Tyk Dashboard, and have decided on the domain names for your Dashboard and your Portal. **They must be different**. For testing purposes, it is easiest to add hosts entries to your (and your servers) `/etc/hosts` file.
+
+**Set up Tyk**
+
+You can set up the core settings for Tyk Gateway with a single setup script, however for more involved deployments, you will want to provide your own configuration file.
+
+
+<Note>
+You need to replace `<hostname>` for `--redishost=<hostname>`with your own value to run this script.
+</Note>
+
+
+
+```bash
+sudo /opt/tyk-gateway/install/setup.sh --dashboard=1 --listenport=8080 --redishost=<hostname> --redisport=6379
+```
+
+What we've done here is told the setup script that:
+
+*   `--dashboard=1`: We want to use the Dashboard, since Tyk Gateway gets all it's API Definitions from the Dashboard service, as of v2.3 Tyk will auto-detect the location of the dashboard, we only need to specify that we should use this mode.
+*   `--listenport=8080`: Tyk should listen on port 8080 for API traffic.
+*   `--redishost=<hostname>`: Use Redis on your hostname.
+*   `--redisport=6379`: Use the default Redis port.
+
+**Starting Tyk**
+
+The Tyk Gateway can be started now that it is configured. Use this command to start the Tyk Gateway:
+```bash
+sudo service tyk-gateway start
+sudo service tyk-gateway enable
+```
+
+**Pro Tip: Domains with Tyk Gateway**
+
+Tyk Gateway has full domain support built-in, you can:
+
+*   Set Tyk to listen only on a specific domain for all API traffic.
+*   Set an API to listen on a specific domain (e.g. api1.com, api2.com).
+*   Split APIs over a domain using a path (e.g. api.com/api1, api.com/api2, moreapis.com/api1, moreapis.com/api2 etc).
+*   If you have set a hostname for the Gateway, then all non-domain-bound APIs will be on this hostname + the `listen_path`.
+
+[1]: https://packagecloud.io/tyk
\ No newline at end of file
diff --git a/tyk-self-managed/install/methods.mdx b/tyk-self-managed/install/methods.mdx
new file mode 100644
index 0000000000..66e56e45f3
--- /dev/null
+++ b/tyk-self-managed/install/methods.mdx
@@ -0,0 +1,638 @@
+---
+title: "Install Tyk Self-Managed on Ansible, AWS, GCP, Heroku, and more"
+description: "Explore the various installation options for Tyk Self-Managed, including AWS Marketplace, Ansible, Heroku, Google Cloud, Azure, and more."
+sidebarTitle: "Alternative Methods"
+---
+
+| Edition   | Deployment Type |
+| :------------- | :---------------------- |
+| Enterprise | Self-Managed, Hybrid |
+
+## Install on AWS Marketplace
+
+Tyk offers a flexible and powerful API management solution through **Tyk Cloud** on the [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-pboluroscnqro). Tyk Cloud is an end-to-end managed API platform where both the control plane and gateways are installed on AWS for a seamless, fully cloud-hosted experience.
+
+For those who need more deployment flexibility, Tyk Cloud also supports a [Hybrid Gateway](/tyk-cloud/environments-deployments/hybrid-gateways) option. In this setup, the control plane remains hosted and managed by Tyk on AWS, while the gateways can be deployed on your preferred cloud provider or on-premises environment—allowing you to meet data locality and compliance needs without sacrificing control.
+
+### Available AWS Deployment Regions
+
+You can deploy Tyk Cloud in the following AWS regions:
+
+- **Singapore**: `aws-ap-southeast-1`
+- **Frankfurt, Germany**: `aws-eu-central-1`
+- **London, UK**: `aws-eu-west-2`
+- **N. Virginia, USA**: `aws-us-east-1`
+- **Oregon, USA**: `aws-us-west-2`
+- **Australia**: `aws-ap-southeast-2`
+
+Getting started with Tyk Cloud via the AWS Marketplace is quick and easy. Sign up today to access Tyk’s comprehensive API management tools designed to scale with your needs.
+
+### Install Tyk on AWS EC2
+  
+
+1. Spin up an [EC2 instance](https://aws.amazon.com/ec2/instance-types/), AWS Linux2 preferably, T2.Medium is fine
+   - add a public IP
+   - open up SG access to: 
+     - 3000 for the Tyk Dashboard
+     - 8080 for the Tyk Gateway
+     - 22 TCP for SSH
+
+2. SSH into the instance
+
+    `ssh -i mykey.pem ec2-user@public-ec2-ip`
+
+3. Install Git, Docker, & Docker Compose
+
+    Feel free to copy paste these
+    ```.sh
+    sudo yum update -y
+    sudo yum install git -y
+    sudo yum install -y docker
+    sudo service docker start
+    sudo usermod -aG docker ec2-user
+    sudo su
+    sudo curl -L "https://github.com/docker/compose/releases/download/1.25.5/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+    sudo chmod +x /usr/local/bin/docker-compose
+    sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
+    docker ps
+    ```
+
+4. Now follow our Docker installation [guide](/tyk-self-managed/install/docker) 
+
+5. Visit
+
+    ```
+    http://<public-ec2-ip>:3000
+    ```
+    and fill out the Bootstrap form!
+    **If you see any page besides the Bootstrap page, you have pasted the license key incorrectly**
+
+#### Enable SSL for the Gateway & Dashboard
+
+1. Add the following to `confs/tyk.env`
+
+```env
+TYK_GW_POLICIES_POLICYCONNECTIONSTRING=https://tyk-dashboard:3000
+TYK_GW_DBAPPCONFOPTIONS_CONNECTIONSTRING=https://tyk-dashboard:3000
+TYK_GW_HTTPSERVEROPTIONS_USESSL=true
+TYK_GW_HTTPSERVEROPTIONS_CERTIFICATES=[{"domain_name":"*.yoursite.com","cert_file":"/opt/tyk-gateway/certs/new.cert.cert","key_file":"/opt/tyk-gateway/certs/new.cert.key"}]
+TYK_GW_HTTPSERVEROPTIONS_SSLINSECURESKIPVERIFY=true
+```
+
+2. Add the following to `confs/tyk_analytics.env`
+
+```env
+TYK_DB_TYKAPI_HOST=https://tyk-gateway
+TYK_DB_HTTPSERVEROPTIONS_USESSL=true
+TYK_DB_HTTPSERVEROPTIONS_CERTIFICATES=[{"domain_name":"*.yoursite.com","cert_file":"/opt/tyk-dashboard/certs/new.cert.cert","key_file":"/opt/tyk-dashboard/certs/new.cert.key"}]
+```
+
+3. Generate self-signed Certs: (Or bring your own CA signed)
+
+```
+openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
+```
+
+4. Mount your certs to containers through `docker-compose.yml`
+
+```.yaml
+  tyk-dashboard:
+    ...
+    volumes: 
+      - ./cert.pem:/opt/tyk-dashboard/certs/new.cert.cert
+      - ./key.pem:/opt/tyk-dashboard/certs/new.cert.key
+  tyk-gateway:
+    ...
+    volumes: 
+      - ./cert.pem:/opt/tyk-gateway/certs/new.cert.cert
+      - ./key.pem:/opt/tyk-gateway/certs/new.cert.key
+```
+
+5. Restart your containers with the mounted files
+
+```
+docker compose up -d tyk-dashboard tyk-gateway
+```
+
+6. Download the bootstrap script onto EC2 machine
+
+```
+wget https://raw.githubusercontent.com/sedkis/tyk/master/scripts/bootstrap-ssl.sh
+```
+
+7. Apply execute permissions to file:
+
+```chmod +x bootstrap.sh```
+
+8. Run the bootstrap script
+
+```./bootstrap.sh localhost```
+
+9. Done! use the generated user and password to log into The Tyk Dashboard
+
+
+## Install with Ansible
+
+<Note>
+**Requirements**
+
+[Ansible](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html) is required to run the following commands.
+</Note>
+
+For a list of compatible operating systems and versions, please refer to the [Linux documentation](/tyk-self-managed/install/linux#compatible-operating-systems).
+
+### Instructions
+
+1. clone the [tyk-ansible](https://github.com/TykTechnologies/tyk-ansible) repositry
+
+    ```bash
+    $ git clone https://github.com/TykTechnologies/tyk-ansible
+    ```
+
+2. `cd` into the directory
+
+    ```.bash
+    $ cd tyk-ansible
+    ```
+
+3. Run initialisation script to initialise environment
+
+    ```bash
+    $ sh scripts/init.sh
+    ```
+
+4. Modify `hosts.yml` file to update ssh variables to your server(s). You can learn more about the hosts file [here](https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html)
+
+5. Run ansible-playbook to install the following:
+
+    - Redis
+    - MongoDB or PostgreSQL
+    - Tyk Dashboard
+    - Tyk Gateway
+    - Tyk Pump
+
+    ```bash
+    $ ansible-playbook playbook.yaml -t tyk-pro -t redis -t `mongodb` or `pgsql`
+    ```
+
+    You can choose to not install Redis, MongoDB or PostgreSQL by removing the `-t redis` or `-t mongodb` or `-t pgsql` However Redis and MongoDB or PostgreSQL are a requirement and need to be installed for the Tyk Pro installation to run.
+
+
+
+    <Note>
+    For a production environment, we recommend that the Gateway, Dashboard and Pump are installed on separate machines. If installing multiple Gateways, you should install each on a separate machine. See [Planning for Production](/planning-for-production) For more details.
+    </Note>
+
+For a list available ansible variables and their descriptions, please refer to the [ansible documentation](https://github.com/TykTechnologies/tyk-ansible/tree/main/vars)
+
+## Install on Heroku
+  
+A full Tyk Self-Managed installation can be deployed to Heroku dynos and workers using [Heroku Container Registry and Runtime](https://devcenter.heroku.com/articles/) functionality. This guide will utilize [Tyk Docker images](https://hub.docker.com/u/tykio/) with a small amount of customization as well as an external MongoDB service.
+
+### Prerequisites
+
+1. Docker daemon installed and running locally
+2. [Heroku account](https://www.heroku.com/), the free plan is sufficient for a basic PoC but not recommended for production usage
+3. [Heroku CLI](https://devcenter.heroku.com/articles/heroku-cli) installed
+4. MongoDB service (such as [Atlas](https://www.mongodb.com/cloud/atlas), [mLab](https://elements.heroku.com/addons/mongolab), or your own deployment), this guide is based on MongoDB Atlas but others should work as well
+5. [Tyk License](https://tyk.io/pricing/on-premise/) (note that in case of running multiple gateway dynos, license type must match)
+6. Checkout the [Tyk quickstart repository](https://github.com/TykTechnologies/tyk-pro-heroku) from GitHub
+7. Python 2 or 3 in order to execute the bootstrap script
+
+### Creating Heroku Apps
+
+We will create two Heroku apps, one for the Tyk Gateway (with [Redis add-on](https://devcenter.heroku.com/articles/heroku-redis) attached to it) and another for the Dashboard and Pump.
+
+Given Heroku CLI is installed and your Heroku account is available, log into it:
+```bash
+heroku login
+```
+
+Now create the Gateway app and note down its name:
+```bash
+heroku create
+```
+```
+Creating app... done, ⬢ infinite-plains-14949
+https://infinite-plains-14949.herokuapp.com/ | https://git.heroku.com/infinite-plains-14949.git
+```
+
+<Note>
+`--space` flag must be added to the command if the app is being created in a private space, see more details in the section on Heroku private spaces (below).
+</Note>
+
+
+Provision a Redis add-on (we'll use a `hobby-dev` plan for demonstration purposes but that's not suitable for production), replacing the app name with your own:
+```bash
+heroku addons:create heroku-redis:hobby-dev -a infinite-plains-14949
+```
+```
+Creating heroku-redis:hobby-dev on ⬢ infinite-plains-14949... free
+Your add-on should be available in a few minutes.
+! WARNING: Data stored in hobby plans on Heroku Redis are not persisted.
+redis-infinite-35445 is being created in the background. The app will restart when complete...
+Use heroku addons:info redis-infinite-35445 to check creation progress
+Use heroku addons:docs heroku-redis to view documentation
+```
+
+Once add-on provisioning is done, the info command (replacing the add-on name with your own) will show the following output:
+```bash
+heroku addons:info redis-infinite-35445
+```
+```
+=== redis-infinite-35445
+Attachments:  infinite-plains-14949::REDIS
+Installed at: Sun May 18 2018 14:23:21 GMT+0300 (EEST)
+Owning app:   infinite-plains-14949
+Plan:         heroku-redis:hobby-dev
+Price:        free
+State:        created
+```
+
+Time to create the Dashboard app and note down its name as well:
+```bash
+heroku create
+```
+```
+Creating app... done, ⬢ evening-beach-40625
+https://evening-beach-40625.herokuapp.com/ | https://git.heroku.com/evening-beach-40625.git
+```
+
+Since the Dashboard and Pump need access to the same Redis instance as the gateway, we'll need to share the Gateway app's add-on with this new app:
+```bash
+heroku addons:attach infinite-plains-14949::REDIS -a evening-beach-40625
+```
+```
+Attaching redis-infinite-35445 to ⬢ evening-beach-40625... done
+Setting REDIS config vars and restarting ⬢ evening-beach-40625... done, v3
+```
+
+To check that both apps have access to the same Redis add-on, we can utilize the `heroku config` command and check for the Redis endpoint:
+```bash
+heroku config -a infinite-plains-14949 | grep REDIS_URL
+heroku config -a evening-beach-40625 | grep REDIS_URL
+```
+
+Their outputs should match.
+
+### Deploy the Dashboard
+
+It's recommended to start with the Dashboard so in your Heroku quickstart clone run:
+```bash
+cd analytics
+ls dashboard
+```
+```
+bootstrap.sh  Dockerfile.web  entrypoint.sh  tyk_analytics.conf
+```
+
+You will find it contains a `Dockerfile.web` for the web dyno, a config file for the Dashboard, entrypoint script for the Docker container and a bootstrap script for seeding the dashboard instance with sample data. All these files are editable for your purposes but have sane defaults for a PoC.
+
+
+<Note>
+You can use the `FROM` statement in `Dockerfile.web` to use specific dashboard version and upgrade when needed instead of relying on the `latest` tag.
+</Note>
+
+The [Dashboard configuration](/tyk-dashboard/configuration) can be changed by either editing the `tyk_analytics.conf` file or injecting them as [environment variables](/tyk-oss-gateway/configuration) via `heroku config`. In this guide we'll use the latter for simplicity of demonstration but there is merit to both methods.
+
+First let's set the license key:
+```bash
+heroku config:set TYK_DB_LICENSEKEY="your license key here" -a evening-beach-40625
+```
+```
+Setting TYK_DB_LICENSEKEY and restarting ⬢ evening-beach-40625... done, v4
+TYK_DB_LICENSEKEY: should show your license key here
+```
+
+Now the MongoDB endpoint (replacing with your actual endpoint):
+```bash
+heroku config:set TYK_DB_MONGOURL="mongodb://user:pass@mongoprimary.net:27017,mongosecondary.net:27017,mongotertiary.net:27017" -a evening-beach-40625
+```
+```
+Setting TYK_DB_MONGOURL and restarting ⬢ evening-beach-40625... done, v5
+TYK_DB_MONGOURL: mongodb://user:pass@mongoprimary.net:27017,mongosecondary.net:27017,mongotertiary.net:27017
+```
+
+And enable SSL for it if your service supports/requires this:
+```bash
+heroku config:set TYK_DB_MONGOUSESSL="true" -a evening-beach-40625
+```
+```
+Setting TYK_DB_MONGOUSESSL and restarting ⬢ evening-beach-40625... done, v6
+TYK_DB_MONGOUSESSL: true
+```
+
+Since the Tyk Dashboard needs to access gateways sometimes, we'll need to specify the Gateway endpoint too, which is the Gateway app's URL:
+```bash
+heroku config:set TYK_DB_TYKAPI_HOST="https://infinite-plains-14949.herokuapp.com" -a evening-beach-40625
+heroku config:set TYK_DB_TYKAPI_PORT="443" -a evening-beach-40625
+```
+```
+Setting TYK_DB_TYKAPI_HOST and restarting ⬢ evening-beach-40625... done, v7
+TYK_DB_TYKAPI_HOST: https://infinite-plains-14949.herokuapp.com
+Setting TYK_DB_TYKAPI_PORT and restarting ⬢ evening-beach-40625... done, v8
+TYK_DB_TYKAPI_PORT: 443
+```
+
+This is enough for a basic Dashboard setup but we recommend also changing at least node and admin secrets with strong random values, as well as exploring other config options.
+
+Since the Tyk Pump is also a part of this application (as a worker process), we'll need to configure it too.
+
+```bash
+ls pump
+```
+```
+Dockerfile.pump  entrypoint.sh  pump.conf
+```
+
+Same principles apply here as well. Here we'll need to configure MongoDB endpoints for all the Pumps (this can also be done in the `pump.conf` file):
+```bash
+heroku config:set PMP_MONGO_MONGOURL="mongodb://user:pass@mongoprimary.net:27017,mongosecondary.net:27017,mongotertiary.net:27017" -a evening-beach-40625
+heroku config:set PMP_MONGO_MONGOUSESSL="true"
+
+heroku config:set PMP_MONGOAGG_MONGOURL="mongodb://user:pass@mongoprimary.net:27017,mongosecondary.net:27017,mongotertiary.net:27017" -a evening-beach-40625
+heroku config:set PMP_MONGOAGG_MONGOUSESSL="true"
+```
+
+With the configuration in place it's finally time to deploy our app to Heroku.
+
+First, make sure CLI is logged in to Heroku containers registry:
+```bash
+heroku container:login
+```
+```
+Login Succeeded
+```
+
+Provided you're currently in `analytics` directory of the quickstart repo:
+```bash
+heroku container:push --recursive -a evening-beach-40625
+```
+```
+=== Building web (/tyk-heroku-docker/analytics/dashboard/Dockerfile.web)
+Sending build context to Docker daemon  8.192kB
+Step 1/5 : FROM tykio/tyk-dashboard:v1.6.1
+ ---> fdbc67b43139
+Step 2/5 : COPY tyk_analytics.conf /opt/tyk-dashboard/tyk_analytics.conf
+ ---> 89be9913798b
+Step 3/5 : COPY entrypoint.sh /opt/tyk-dashboard/entrypoint.sh
+ ---> c256152bff29
+Step 4/5 : ENTRYPOINT ["/bin/sh", "-c"]
+ ---> Running in bc9fe7a569c0
+Removing intermediate container bc9fe7a569c0
+ ---> f40e6b259230
+Step 5/5 : CMD ["/opt/tyk-dashboard/entrypoint.sh"]
+ ---> Running in 705273810eea
+Removing intermediate container 705273810eea
+ ---> abe9f10e8b21
+Successfully built abe9f10e8b21
+Successfully tagged registry.heroku.com/evening-beach-40625/web:latest
+=== Building pump (/tyk-heroku-docker/analytics/pump/Dockerfile.pump)
+Sending build context to Docker daemon   5.12kB
+Step 1/5 : FROM tykio/tyk-pump-docker-pub:v0.5.2
+ ---> 247c6b5795a9
+Step 2/5 : COPY pump.conf /opt/tyk-pump/pump.conf
+ ---> 1befeab8f092
+Step 3/5 : COPY entrypoint.sh /opt/tyk-pump/entrypoint.sh
+ ---> f8ad0681aa70
+Step 4/5 : ENTRYPOINT ["/bin/sh", "-c"]
+ ---> Running in 0c30d35b9e2b
+Removing intermediate container 0c30d35b9e2b
+ ---> b17bd6a8ed44
+Step 5/5 : CMD ["/opt/tyk-pump/entrypoint.sh"]
+ ---> Running in a16acb453b62
+Removing intermediate container a16acb453b62
+ ---> 47ac9f221d8d
+Successfully built 47ac9f221d8d
+Successfully tagged registry.heroku.com/evening-beach-40625/pump:latest
+=== Pushing web (/tyk-heroku-docker/analytics/dashboard/Dockerfile.web)
+The push refers to repository [registry.heroku.com/evening-beach-40625/web]
+c60cf00e6e9b: Pushed 
+11d074829795: Pushed 
+8b72aa2b2acc: Pushed 
+ca2feecf234c: Pushed 
+803aafd71223: Pushed 
+43efe85a991c: Pushed 
+latest: digest: sha256:b857afaa69154597558afb2462896275ab667b729072fac224487f140427fa73 size: 1574
+=== Pushing pump (/tyk-heroku-docker/analytics/pump/Dockerfile.pump)
+The push refers to repository [registry.heroku.com/evening-beach-40625/pump]
+eeddc94b8282: Pushed 
+37f3b3ce56ab: Pushed 
+4b61531ec7dc: Pushed 
+eca9efd615d9: Pushed 
+0f700064c5a1: Pushed 
+43efe85a991c: Mounted from evening-beach-40625/web 
+latest: digest: sha256:f45acaefa3b47a126dd784a888c89e420814ad3031d3d4d4885e340a59aec31c size: 1573
+```
+
+This has built Docker images for both dashboard and pump, as well as pushed them to Heroku registry and automatically deployed to the application.
+
+Provided everything went well (and if not, inspect the application logs), you should be seeing the Dashboard login page at your app URL (e.g "https://evening-beach-40625.herokuapp.com/").
+
+However, it doesn't yet have any accounts. It order to populate it please run the `dashboard/bootstrap.sh` script:
+```bash
+dashboard/bootstrap.sh evening-beach-40625.herokuapp.com
+```
+```
+Creating Organization
+ORGID: 5b016ca530867500050b9e90
+Adding new user
+USER AUTH: a0f7c1e878634a60599dc037489a880f
+NEW ID: 5b016ca6dcd0056d702dc40e
+Setting password
+
+DONE
+====
+Login at https://evening-beach-40625.herokuapp.com/
+User: c7ze82m8k3@default.com
+Pass: test123
+```
+
+It will generate a default organization with random admin username and a specified password. The bootstrap script can be edited to suit your needs as well as just editing the user info in the dashboard.
+
+If this was successful, you should be able to log into your dashboard now.
+
+The last step in this app is to start the Pump worker dyno since by default only the web dyno is enabled:
+```bash
+heroku dyno:scale pump=1 -a evening-beach-40625
+```
+```
+Scaling dynos... done, now running pump at 1:Free
+```
+
+At that point the dyno formation should look like this:
+```bash
+heroku dyno:scale -a evening-beach-40625
+```
+```
+pump=1:Free web=1:Free
+```
+
+### Deploy the Gateway
+
+The process is very similar for the Tyk Gateway, except it doesn't have a worker process and doesn't need access to MongoDB.
+
+```bash
+cd ../gateway
+ls
+```
+```
+Dockerfile.web  entrypoint.sh  tyk.conf
+```
+
+All these files serve the same purpose as with the Dasboard and the Pump. [Configuration](/tyk-oss-gateway/configuration) can either be edited in `tyk.conf` or [injected](/tyk-oss-gateway/configuration) with `heroku config`.
+
+To get things going we'll need to set following options for the Dashboard endpoint (substituting the actual endpoint and the app name, now for the gateway app):
+```bash
+heroku config:set TYK_GW_DBAPPCONFOPTIONS_CONNECTIONSTRING="https://evening-beach-40625.herokuapp.com" -a infinite-plains-14949
+heroku config:set TYK_GW_POLICIES_POLICYCONNECTIONSTRING="https://evening-beach-40625.herokuapp.com" -a infinite-plains-14949
+```
+```
+Setting TYK_GW_DBAPPCONFOPTIONS_CONNECTIONSTRING and restarting ⬢ infinite-plains-14949... done, v4
+TYK_GW_DBAPPCONFOPTIONS_CONNECTIONSTRING: https://evening-beach-40625.herokuapp.com
+Setting TYK_GW_POLICIES_POLICYCONNECTIONSTRING and restarting ⬢ infinite-plains-14949... done, v5
+TYK_GW_POLICIES_POLICYCONNECTIONSTRING: https://evening-beach-40625.herokuapp.com
+```
+
+Since the Redis configuration will be automatically discovered (it's already injected by Heroku), we're ready to deploy:
+```bash
+heroku container:push --recursive -a infinite-plains-14949
+```
+```
+=== Building web (/tyk-heroku-docker/gateway/Dockerfile.web)
+Sending build context to Docker daemon  6.144kB
+Step 1/5 : FROM tykio/tyk-gateway:v2.6.1
+ ---> f1201002e0b7
+Step 2/5 : COPY tyk.conf /opt/tyk-gateway/tyk.conf
+ ---> b118611dc36b
+Step 3/5 : COPY entrypoint.sh /opt/tyk-gateway/entrypoint.sh
+ ---> 68ad364030cd
+Step 4/5 : ENTRYPOINT ["/bin/sh", "-c"]
+ ---> Running in 859f4c15a0d2
+Removing intermediate container 859f4c15a0d2
+ ---> 5f8c0d1b378a
+Step 5/5 : CMD ["/opt/tyk-gateway/entrypoint.sh"]
+ ---> Running in 44c5e4c87708
+Removing intermediate container 44c5e4c87708
+ ---> 86a9eb509968
+Successfully built 86a9eb509968
+Successfully tagged registry.heroku.com/infinite-plains-14949/web:latest
+=== Pushing web (/tyk-heroku-docker/gateway/Dockerfile.web)
+The push refers to repository [registry.heroku.com/infinite-plains-14949/web]
+b8a4c3e3f93c: Pushed 
+0b7bae5497cd: Pushed 
+e8964f363bf4: Pushed 
+379aae48d347: Pushed 
+ab2b28b92877: Pushed 
+021ee50b0983: Pushed 
+43efe85a991c: Mounted from evening-beach-40625/pump 
+latest: digest: sha256:d67b8f55d729bb56e06fe38e17c2016a36f2edcd4f01760c0e62a13bb3c9ed38 size: 1781
+```
+
+Inspect the logs (`heroku logs -a infinite-plains-14949`) to check that deployment was successful, also the node should be registered by the Dashboard in "System Management" -> "Nodes and Licenses" section.
+
+You're ready to follow the guide on [creating and managing your APIs](/api-management/gateway-config-managing-classic#create-an-api) with this Heroku deployment.
+
+<Note>
+To use the [geographic log distribution](/api-management/dashboard-analytics#activity-by-location) feature in the Dashboard please supply the GeoLite2 DB in the `gateway` directory, uncomment the marked line in `Dockerfile.web` and set the `analytics_config.enable_geo_ip` setting (or `TYK_GW_ANALYTICSCONFIG_ENABLEGEOIP` env var) to `true`.
+</Note>
+
+### Heroku Private Spaces
+
+Most instructions are valid for [Heroku Private Spaces runtime](https://devcenter.heroku.com/articles/private-spaces). However there are several differences to keep in mind.
+
+Heroku app creation commands must include the private space name in the `--space` flag, e.g.:
+```bash
+heroku create --space test-space-virginia
+```
+
+When deploying to the app, the container must be released manually after pushing the image to the app:
+```bash
+heroku container:push --recursive -a analytics-app-name
+heroku container:release web -a analytics-app-name
+heroku container:release pump -a analytics-app-name
+```
+
+Similarly, the Gateway:
+```bash
+heroku container:push --recursive -a gateway-app-name
+heroku container:release web -a gateway-app-name
+```
+
+Please allow several minutes for the first deployment to start as additional infrastructure is being created for it. Next deployments are faster.
+
+Private spaces maintain stable set of IPs that can be used for allowing fixed set of IPs on your upstream side (e.g. on an external database service). Find them using the following command:
+```bash
+heroku spaces:info --space test-space-virginia
+```
+
+Alternatively VPC peering can be used with the private spaces if external service supports it. This way exposure to external network can be avoided. For instance, see [MongoDB Atlas guide](https://www.mongodb.com/blog/post/integrating-mongodb-atlas-with-heroku-private-spaces) for setting this up.
+
+The minimal Heroku Redis add-on plan that installs into your private space is currently `private-7`. Please refer to [Heroku's Redis with private spaces guide](https://devcenter.heroku.com/articles/heroku-redis-and-private-spaces) for more information.
+
+Apps in private spaces don't enable SSL/TLS by default. It needs to be configured in the app settings along with the domain name for it. If it's not enabled, please make sure that configs that refer to corresponding hosts are using HTTP instead of HTTPS and related ports (80 for HTTP).
+
+### Gateway Plugins
+
+In order to enable [rich plugins](/api-management/plugins/rich-plugins#) for the Gateway, please set the following Heroku config option to either `python` or `lua` depending on the type of plugins used:
+```bash
+heroku config:set TYK_PLUGINS="python" -a infinite-plains-14949
+```
+```
+Setting TYK_PLUGINS and restarting ⬢ infinite-plains-14949... done, v9
+TYK_PLUGINS: python
+```
+
+After re-starting the Gateway, the logs should be showing something similar to this:
+```
+2018-05-18T13:13:50.272511+00:00 app[web.1]: Tyk will be using python plugins
+2018-05-18T13:13:50.311510+00:00 app[web.1]: time="May 18 13:13:50" level=info msg="Setting PYTHONPATH to 'coprocess/python:middleware/python:event_handlers:coprocess/python/proto'"
+2018-05-18T13:13:50.311544+00:00 app[web.1]: time="May 18 13:13:50" level=info msg="Initializing interpreter, Py_Initialize()"
+2018-05-18T13:13:50.497815+00:00 app[web.1]: time="May 18 13:13:50" level=info msg="Initializing dispatcher"
+```
+
+Set this variable back to an empty value in order to revert back to the default behavior.
+
+### Upgrading or Customizing Tyk
+
+Since this deployment is based on Docker images and containers, upgrading or making changes to the deployment is as easy as building a new image and pushing it to the registry.
+
+Specifically, upgrading version of any Tyk components is done by editing the corresponding `Dockerfile` and replacing the base image version tag. E.g. changing `FROM tykio/tyk-gateway:v2.5.4` to `FROM tykio/tyk-gateway:v2.6.1` will pull the Tyk gateway 2.6.1. We highly recommend specifying concrete version tags instead of `latest` for better house keeping.
+
+Once these changes have been made just run `heroku container:push --recursive -a app_name` on the corresponding directory as shown previously in this guide. This will do all the building and pushing as well as gracefully deploying on your Heroku app.
+
+Please refer to [Heroku documentation on containers and registry](https://devcenter.heroku.com/articles/container-registry-and-runtime) for more information.
+
+## Install on Microsoft Azure
+
+Azure allows you to install Tyk in the following ways:
+
+**On-Premises**
+
+1. Via our [Ubuntu Setup](/tyk-self-managed/install/linux#install-tyk-on-debian-or-ubuntu) on an installed Ubuntu Server on Azure.
+2. Via our [Docker Installation](/tyk-self-managed/install/docker) using Azure's Docker support.
+
+See our video for installing Tyk on Ubuntu via Azure:
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/-Q9Lox-DyTU" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+We also have a [blog post](https://tyk.io/blog/getting-started-with-tyk-on-microsoft-azure-and-ubuntu/) that walks you through installing Tyk on Azure.
+
+
+## Install to Google Cloud
+
+Google Cloud allows you to install Tyk in the following ways:
+
+**On-Premises**
+
+1. Via our [Ubuntu Setup](/tyk-self-managed/install/linux#install-tyk-on-debian-or-ubuntu) on an installed Ubuntu Server within Google Cloud.
+2. Via our [Docker Installation](/tyk-self-managed/install/docker) using Google Cloud's Docker support.
+
+**Tyk Pump on GCP**
+
+When running Tyk Pump in GCP using [Cloud Run](https://cloud.google.com/run/docs/overview/what-is-cloud-run) it is available 24/7. However, since it is serverless you also need to ensure that the _CPU always allocated_ option is configured to ensure availability of the analytics. Otherwise, for each request there will be a lag between the Tyk Pump container starting up and having the CPU allocated. Subsequently, the analytics would only be available during this time.
+
+1. Configure Cloud Run to have the [CPU always allocated](https://cloud.google.com/run/docs/configuring/cpu-allocation#setting) option enabled. Otherwise, the Tyk Pump container needs to warm up, which takes approximately 1 min. Subsequently, by this time the stats are removed from Redis.
+
+2. Update the Tyk Gateway [configuration](/tyk-oss-gateway/configuration#analytics_config-storage_expiration_time) to keep the stats for 3 mins to allow Tyk Pump to process them. This value should be greater than the Pump [purge delay](/tyk-pump/tyk-pump-configuration/tyk-pump-environment-variables#purge_delay) to ensure the analytics data exists long enough in Redis to be processed by the Pump. 
+
diff --git a/tyk-stack.mdx b/tyk-stack.mdx
new file mode 100644
index 0000000000..b69cc862b3
--- /dev/null
+++ b/tyk-stack.mdx
@@ -0,0 +1,25 @@
+---
+title: "Tyk Stack"
+description: "Overview of Tyk Stack components, both open-source and closed-source."
+order: 7
+sidebarTitle: "Tyk Stack"
+---
+
+import OssProductListInclude from '/snippets/oss-product-list-include.mdx';
+
+## Tyk Open Source 
+
+<OssProductListInclude/>
+
+## Closed Source
+
+The following Tyk components, created and maintained by the Tyk Team, are proprietary and closed-source:
+
+* [Tyk Dashboard](/api-management/dashboard-configuration)
+* [Tyk Developer Portal](/portal/overview/intro)
+* [Tyk Multi Data Center Bridge](/api-management/mdcb#managing-geographically-distributed-gateways-to-minimize-latency-and-protect-data-sovereignty)
+* [Universal Data Graph](/api-management/data-graph#overview)
+* [Tyk Operator](/api-management/automations/operator#what-is-tyk-operator)
+* [Tyk Sync](/api-management/automations/sync)
+
+If you plan to deploy and use the above components On-premise, license keys are required.
diff --git a/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/approve-requests.mdx b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/approve-requests.mdx
new file mode 100644
index 0000000000..67a38553bc
--- /dev/null
+++ b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/approve-requests.mdx
@@ -0,0 +1,145 @@
+---
+title: "Managing API Access Requests"
+description: "How to provision API Access Requests in Tyk Developer Portal"
+keywords: "Developer Portal, Tyk, Dynamic Client Registration"
+sidebarTitle: "Manage Access Requests"
+---
+
+## Introduction
+
+API Access Requests are formal requests from API Consumers to access specific API Products and Plans through the Developer Portal. These requests initiate the workflow for granting, or provisioning, API access to users.
+
+### Understanding the Provisioning Request Workflow
+
+When API Consumers discover APIs in your Catalog that they need access to, they initiate a API Access Request through the Live Portal. This request:
+
+- Identifies the specific API Product and subscriptionPlan they want to access
+- Specifies which Developer App should receive the access credentials
+- Creates an auditable record of the access request
+
+Depending on your configuration, these requests can be processed [automatically]() or require [manual approval](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/approve-requests#manual-approval-workflow).
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-provisioning-flow.png" alt="" />
+
+
+## Requesting Access to an API Product
+
+API Consumers can request access to API Products through the Live Portal using one of two configured flows.
+To learn how to configure this flow visit [Access Flow Types](https://tyk.io/docs/portal/overview/concepts#Access-Flow-Types)
+
+### Initial Steps (Both Flows):
+1. From the **Catalogues** page, choose the API Product of interest and select **More info**
+2. On the API Product detail page, decide which of the available Plans to subscribe to and select **Access with this Plan**
+3. **The next steps depend on your portal's configured access flow**:
+
+#### Direct Access Flow
+When Direct Access Flow is enabled, you can request access to API Products immediately without using a shopping cart.
+
+**Steps:**
+- You'll be taken directly to the access request page with your selected product and plan pre-populated
+- Select or create a Developer App to store your credentials
+- Configure credentials (new or extend existing compatible credentials)
+- Select **Continue** to submit your request
+
+**Credential Compatibility Rules**
+
+For existing credentials to be compatible, they must:
+- Have the same Plan as the selected product
+- Not already include the selected product
+- Have a matching authentication type with the product
+
+For more information, refer to this [guide](/tyk-developer-portal/direct-access-flow)
+
+#### Cart-Based Flow
+When Cart-Based Flow is enabled, you can add multiple API Products to a shopping cart before submitting a single access request.
+
+**Steps:**
+- The API Product and Plan combination will be added to your cart
+- Repeat steps 1-2 for additional API Products you want to access
+- Go to the **Cart** using the icon in the top right of the screen
+- Review your selections and select a Developer App
+- Select **Submit request**
+
+### After Submission
+- Your access request will be submitted for approval (if required)
+- Track request status in **My Apps**
+- Once approved, credentials will be available in your selected Developer App
+
+## Manual Approval Workflow
+
+The manual approval workflow provides API Owners with oversight of all API access. When an API Consumer completes an [access request](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/approve-requests#requesting-access-to-an-api-product), API Owners receive notification of pending request via [email](/product-stack/tyk-enterprise-developer-portal/getting-started/setup-email-notifications) and should then:
+
+1. Navigate to the **API Consumers > Access Requests** page in the Admin Portal
+2. Review the request
+    - User name
+    - Developer App
+    - Requested API Products
+    - Selected subscription Plan
+3. Approve or reject the request from the three dot menu
+    - If approved, access is provisioned with credentials issued to the specified Developer App
+    - If rejected, access will not be granted
+    - API Consumer receives notification of the decision via email
+
+
+## Automatic Approval Workflow
+
+For trusted users or specific API Products, you can enable automatic approval in the [subscription Plan](/portal/api-plans#auto-approve-provisioning-requests).
+
+To configure automatic approval, the API Owner should:
+
+1. Navigate to the **Plans** page in the Admin Portal
+2. Select or create the API Plan that should be automatically approved
+3. Set the **Auto approve access request** checkbox
+    <img src="/img/dashboard/portal-management/enterprise-portal/auto-approve-requests.png" alt="Auto Approve API provisioning requests" />
+4. Select **Save changes**
+
+When an API Consumer requests access using this plan, the request will be approved immediately and access credentials provisioned to the Developer App.
+
+
+<Note>
+Despite automatic approval, a record of the request is maintained in the **API Consumers > Access requests** page in the Admin Portal.
+</Note>
+
+
+
+## Notification of Decision
+
+The Dev Portal sends notification to the API Consumer when their request is approved or rejected.
+
+If the [email service](/product-stack/tyk-enterprise-developer-portal/getting-started/setup-email-notifications) is configured, then:
+
+- When a request is approved:
+    - The system sends an approval notification email to the user
+    - The email uses the template "approve" with a configurable subject
+    - The notification includes details about the approved access
+- When a request is rejected:
+    - The system sends a rejection notification email to the user
+    - The email uses the template "reject" with a configurable subject
+
+## Update Products and Plans of an Access Request
+
+Starting from v1.16.0, the Tyk Developer Portal enables users to efficiently manage their access requests by adding or removing API Products and modifying subscription plans for existing credentials. This eliminates credential sprawl and provides a streamlined experience.
+
+The following features can be accessed via "App" page, under each access credential.
+
+#### Adding Products to Existing Access Request
+Users can extend their existing credentials with additional API Products when compatibility requirements are met, avoiding the need to creating new credentials for additional API products.
+
+**Compatibility Requirements**
+Products can be added to existing credentials when they share:
+- Same authentication method
+- Same subscription plan
+- Products not already included in the credential
+
+When requesting access to an API Product, developers can choose to create a new credential or use one of the compatible existing credential.
+
+For more information, refer to this [guide](/tyk-developer-portal/single-credentials-multiple-api-products)
+#### Removing Products from Access Requests
+Users can remove individual API Products from credentials that contain multiple products, maintaining access to remaining products while revoking access to unwanted ones. This provides granular control over application permissions without affecting the entire credential.
+
+#### Plan Management
+Users can update subscription plans for existing access requests without generating new credentials. Plan modifications maintain existing product associations where compatibility allows.
+
+Currently, Plan management is available to OAuth 2.0 access requests only.
+
+
diff --git a/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/configuring-custom-rate-limit-keys.mdx b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/configuring-custom-rate-limit-keys.mdx
new file mode 100644
index 0000000000..6f0e4a9e29
--- /dev/null
+++ b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/configuring-custom-rate-limit-keys.mdx
@@ -0,0 +1,55 @@
+---
+title: "Configuring Custom Rate Limit Keys in Developer Portal"
+description: "How to configure custom rate limit keys in Tyk Developer Portal"
+keywords: "Developer Portal, Tyk, Rate Limit"
+sidebarTitle: "Advanced Rate Limits"
+---
+
+## Introduction
+
+The Tyk Enterprise Developer Portal supports custom rate limiting patterns that allow you to apply rate limits based on entities other than just credentials, such as per application, per developer, or per organization. This is particularly useful for B2B scenarios where API quotas need to be shared across multiple developers and applications within an organization.
+
+For detailed information about custom rate limiting concepts and configuration, see the [Custom Rate Limiting](/api-management/rate-limit#custom-rate-limiting) section in the main Rate Limiting documentation.
+
+**Prerequisites**
+
+This capability works with [Tyk 5.3.0](/developer-support/release-notes/dashboard#5-3-0-release-notes) or higher.
+
+## Configuring Custom Rate Limit Keys in the Portal
+
+
+<Note>
+If you are using Tyk Developer Portal version 1.13.0 or later, you can configure the custom rate limit keys directly from the Developer Portal in the Advanced settings (optional) collapsible section of the Plan's view (by Credentials metadata).
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-plan-advanced-settings.png" alt="Add Plan Advanced Settings" />
+</Note>
+
+
+For general configuration of custom rate limit keys in policies, refer to the [Custom Rate Limiting](/api-management/rate-limit#custom-rate-limiting) documentation.
+
+## Using Custom Rate Limit Keys with the Portal
+
+The Tyk Enterprise Developer Portal facilitates the configuration of various rate limiting options based on a business model for API Products published in the portal.
+
+To achieve this, the portal, by default, populates the following attributes in the credential metadata, which can be used as part of a custom rate limit key:
+- **ApplicationID**: The ID of the application to which the credential belongs.
+- **DeveloperID**: The ID of the developer who created the credential.
+- **OrganisationID**: The ID of the organization to which the developer belongs.
+
+Additionally, it's possible to attach [custom attribute values](/portal/customization/user-model#add-custom-attributes-to-the-user-model) defined in a developer profile as metadata fields to credentials.
+
+When a credential is provisioned by the portal, all the fields described above are added as metadata values to the credential, making them valid options for configuring the rate limit key:
+
+<img src="/img/dashboard/portal-management/enterprise-portal/credential-metadata.png" alt="Credential's metadata" />
+
+This approach allows the portal to seamlessly apply rate limits based on any combination of the aforementioned fields and other custom metadata objects defined in policies used for plans or products. This is in addition to credentials.
+
+---
+
+
+<Note>
+**Tyk Enterprise Developer Portal**
+
+If you are interested in getting access contact us at [support@tyk.io](<mailto:support@tyk.io?subject=Tyk Enterprise Portal Beta>)
+</Note>
+
+
diff --git a/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration.mdx b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration.mdx
new file mode 100644
index 0000000000..56105081c3
--- /dev/null
+++ b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/api-access/dynamic-client-registration.mdx
@@ -0,0 +1,370 @@
+---
+title: "Dynamic Client Registration"
+description: "Learn how to use Dynamic Client Registration to grant access to API Products"
+keywords: "Developer Portal, Tyk, Dynamic Client Registration"
+sidebarTitle: "OAuth 2.0 Dynamic Client Registration"
+---
+
+## Introduction
+
+Dynamic Client Registration (DCR) is an [IETF protocol](https://datatracker.ietf.org/doc/html/rfc7591) that automates the registration of OAuth 2.0 clients with an authorization server. The Tyk Developer Portal uses DCR so that when an API Consumer is approved for access to an API Product, they receive OAuth 2.0 credentials automatically. The API Consumer has no direct interaction with the IdP during this process; the Portal handles client registration on their behalf.
+
+DCR requires an Identity Provider (IdP) that acts as an OAuth 2.0 authorization server, supports the DCR protocol, and exposes an OIDC well-known configuration endpoint. [OpenID Connect (OIDC)](https://openid.net/connect/) is an identity layer built on top of OAuth 2.0 that standardizes the discovery endpoint used by the Portal to locate the IdP's DCR and token endpoints.
+
+This page covers JWT-based flows, where the IdP issues access tokens as JSON Web Tokens (JWTs). When an API Consumer's access request is approved, the Portal registers a new client with the IdP and writes the resulting IdP configuration into Tyk.
+
+At runtime, the API Consumer uses their credentials to obtain a JWT from the IdP, then presents it to Tyk Gateway when calling an API. The Gateway [validates the token's signature](/api-management/authentication/jwt-signature-validation) using the public keys published by the IdP at its JWKS endpoint, and maps the token's [scopes](#oauth-2-0-scopes) to Tyk policies to enforce access control.
+
+```mermaid
+sequenceDiagram
+    participant Dev as Developer / App
+    participant Portal as Tyk Developer Portal
+    participant IdP as Identity Provider (IdP)
+    participant GW as Tyk Gateway
+
+    rect rgb(235, 245, 255)
+        Note over Dev,GW: Setup: one time, on access request approval
+        Dev->>Portal: Submit access request
+        Portal->>IdP: Register OAuth 2.0 client (DCR)
+        IdP-->>Portal: Client credentials
+        Portal->>GW: Write JWKS URI + scope mappings
+        Note over Portal,GW: via Identity Provider Registry or API definition
+        Portal-->>Dev: Approval notification + credentials
+    end
+
+    rect rgb(240, 255, 240)
+        Note over Dev,GW: Runtime: every API request
+        Dev->>IdP: Request JWT (client credentials)
+        IdP-->>Dev: JWT (signed access token)
+        Dev->>GW: API call with JWT
+        GW-->>IdP: Fetch JWKS (cached)
+        GW->>GW: Validate signature + map scopes to policies
+        GW-->>Dev: API response
+    end
+```
+
+### Developer Apps and OAuth Clients
+
+A Developer App in the Portal corresponds 1:1 to an OAuth 2.0 client registered in the IdP. When a DCR access request is approved, the Portal registers an OAuth client in the IdP on the API Consumer's behalf and stores the resulting credentials against the Developer App. The API Consumer uses these credentials to request access tokens from the IdP.
+
+A single Developer App can hold access to multiple API Products and Plans. Each subsequent approval adds the new scopes to the same OAuth client in the IdP rather than creating a new one. The API Consumer's credentials remain unchanged; their scope set grows.
+
+### OAuth 2.0 Scopes
+
+OAuth 2.0 scopes are central to how Tyk enforces access control in the DCR flow. Understanding their role makes the configuration steps that follow easier to understand.
+
+In Tyk's DCR flow, scopes serve as the link between the IdP, the API Consumer's access token, and Tyk's access control policies. Each API Product and each Plan has a unique scope name assigned to it. That scope name is what gets embedded in the access token by the IdP, and it is what Tyk Gateway uses to look up which policy to apply.
+
+Tyk's scope-to-policy mapping resolves one scope name to exactly one Tyk policy. No two API Products or Plans may share a scope; a duplicate would cause both to resolve to the same policy. Tyk Gateway combines the policies resolved from all scopes present in the token to authorize the request.
+
+The full sequence is:
+
+1. When an access request is approved, the Portal sends the scope names for the approved Product and Plan to the IdP as part of registering the OAuth 2.0 client. The IdP associates those scopes with that client, constraining what it can request.
+2. When the API Consumer requests an access token, they must explicitly include those scope names. The IdP will only return scopes that are both registered with the client and present in the token request.
+3. Tyk Gateway reads the scopes in the incoming JWT and maps each one to its corresponding Tyk policy, enforcing the access control and rate limits defined for that Product and Plan.
+
+Every API Product and Plan used with DCR must therefore have a unique scope assigned, and that scope must exist in the IdP before the Product or Plan is published. Publishing makes it available for access requests; if a scope is missing when a request is approved, the Portal's attempt to register the OAuth client will fail. Scope names must exactly match between the IdP and the Portal.
+
+## How Portal Manages Identity Providers
+
+Identity Providers are configured in the Portal under the **OAuth 2.0 Providers** menu. This is the Portal's term for an IdP. The two are the same concept: an OAuth 2.0 Provider in the Portal represents an external IdP that the Portal will register DCR clients with.
+
+There are two approaches to how the Portal stores IdP configuration in Tyk.
+
+| Approach | Available From | Where Scope Mappings Are Written |
+|:---------|:---------------|:---------------------------------|
+| Identity Provider Registry (recommended) | Portal 1.18.0, Tyk 5.14.0 | Identity Provider Registry |
+| API Definition | All versions | API definitions |
+
+The **Identity Provider Registry** approach is recommended for all new deployments. It stores IdP configuration centrally in the Tyk Dashboard, decoupled from API definitions, eliminating write conflicts between the Portal and Tyk Dashboard and ensuring that IdP configuration is kept up to date as API Products change and as OAuth 2.0 Providers are created, updated, or deleted. Refer to the [Identity Provider Registry](/api-management/client-idp-registry) page for more detail.
+
+The **API definition** approach is available for installations running Tyk prior to 5.14.0, or for deployments where the Registry cannot be used. The Portal writes the JWKS URI and scope-to-policy mappings directly into the relevant API definitions when an access request is approved.
+
+<Note>
+Refer to [Migrating to the Identity Provider Registry](#migrating-to-the-identity-provider-registry) if you have an existing installation using DCR and wish to use the IdP Registry.
+</Note>
+
+## Configure Your Identity Provider
+
+Before configuring Tyk Developer Portal, you need to prepare the IdP in two ways: authorize the Portal to register OAuth 2.0 clients on behalf of API Consumers, and define the OAuth 2.0 scopes that will be included in access tokens.
+
+These steps are required regardless of which approach you use.
+
+### Authorize the Portal
+
+Most IdPs use an [initial access token](https://openid.net/specs/openid-connect-registration-1_0.html#Terminology) to authorize a trusted client to register new OAuth 2.0 clients via the DCR protocol. The Portal presents this token when registering a client for an API Consumer, proving it has permission to do so.
+
+Some IdPs use a different authorization mechanism and do not require an initial access token, for example:
+
+- Gluu uses a `dynamicRegistrationEnabled` flag on each scope instead.
+- Auth0 uses a separate authorization model and does not issue initial access tokens.
+
+### Define OAuth 2.0 Scopes
+
+Create scopes in the IdP for each API Product and Plan you intend to use with DCR, following the naming and uniqueness requirements in the [OAuth 2.0 Scopes](#oauth-2-0-scopes) section above. Scopes must exist before the Product or Plan is published; see that section for details.
+
+The provider-specific tabs below show how to create scopes in each supported IdP.
+
+### Provider-Specific Instructions
+
+<Tabs>
+<Tab title="Keycloak">
+
+Follow the [Keycloak client registration guide](https://www.keycloak.org/securing-apps/client-registration) to obtain the initial access token.
+
+Create scopes for each API Product and Plan from the **Client scopes** menu item. Set the scope type to **Optional**. Default scopes are applied automatically to all clients, but optional scopes can be requested on a case-by-case basis. The Portal requests specific scopes during client registration; using optional scopes ensures those scopes are included only when explicitly requested.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/step-1-navigate-to-the-client-scopes-menu.png" alt="Navigate to the Client scopes menu item" />
+
+<img src="/img/dashboard/portal-management/enterprise-portal/old-keycloak-version-client-scope.png" alt="Client Scope Assigned Type" />
+
+</Tab>
+
+<Tab title="Okta">
+
+To obtain a Registration Access Token for Okta, go to **Okta Admin Console > Security > API > Tokens** and click **Create New Token**. Copy the token value; you will need it when configuring the OAuth 2.0 Provider in the Portal. For more details, refer to the [Okta Dynamic Client Registration guide](https://developer.okta.com/docs/reference/api/oauth-clients/).
+
+Create scopes for each API Product and Plan from the **Scopes** tab on the **Security > API** screen. All scopes must be associated with an authorization server. If you do not have a custom authorization server, use the **Default** one. Note the authorization server's issuer URL; you will need it when setting the OIDC well-known configuration URL in the Portal. The URL takes the form `https://{your-domain}/oauth2/default/.well-known/openid-configuration`.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/okta-api-page.png" alt="Add or Edit OAuth servers in Okta" />
+
+</Tab>
+
+<Tab title="Auth0">
+
+Auth0 does not require an initial access token. Follow the [Auth0 Dynamic Client Registration guide](https://auth0.com/docs/get-started/applications/dynamic-client-registration) to configure DCR.
+
+Create scopes for each API Product and Plan by navigating to **Dashboard > Applications > APIs**, selecting your API, and opening the **Permissions** tab. Enter the permission name and description for each scope, then click **Add**.
+
+</Tab>
+
+<Tab title="Curity">
+
+When using [Curity](https://curity.io) as the Identity Provider, you must configure the DCR endpoint to use `no-authentication`. By default, Curity requires a nonce token with a `dcr` scope to authenticate the DCR endpoint, but nonce tokens are one-time-use and cannot be stored as a reusable credential in the Portal. Setting the authentication method to `no-authentication` allows the Portal to register clients without presenting a token.
+
+Ensure that network access to the Curity DCR endpoint is restricted to Tyk only, since it will be unauthenticated.
+
+To configure this: go to **Profiles > Token Service > Dynamic Registration**, scroll to the **Non-templatized** section, and set **Authentication Method** to `no-authentication`.
+
+Create scopes for each API Product and Plan from **Profiles > Token Service > Scopes**.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/curity-add-scope.jpg" alt="Navigate to the Scopes menu" />
+
+For more information, see the [Curity DCR documentation](https://curity.io/docs/identity-server/profiles/token-profile/clients/dcr).
+
+</Tab>
+
+<Tab title="Gluu">
+
+[Gluu](https://gluu.org/) does not use an initial access token for DCR. Instead, DCR is authorized per-scope via the **Dynamic Registration** toggle.
+
+Create scopes for each API Product and Plan by navigating to **Configuration > OpenID Connect > Scopes** and clicking **Add Scope**. For each scope, enable the **Dynamic Registration** toggle so that it can be included in DCR client registration requests.
+
+For more information, see the [Gluu Server documentation](https://docs.gluu.org).
+
+</Tab>
+
+</Tabs>
+
+## Configure Tyk Developer Portal
+
+### Enable the Identity Provider Registry (Recommended)
+
+The Identity Provider Registry is available from Tyk Developer Portal 1.18.0 when using Tyk Dashboard 5.14.0 or later.
+
+It must be explicitly enabled in Tyk Developer Portal by setting [`TYK_PORTAL_ENABLEIDPREGISTRY=true`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#tyk_portal_enableidpregistry) (or `EnableIDPRegistry = true` in the config file) and restarting the Portal.
+
+Ensure that Tyk Gateway and Tyk Dashboard are running on version 5.14.0 or later before starting Tyk Developer Portal with this flag enabled.
+
+<Note>
+If you are running Tyk Dashboard prior to 5.14.0, skip this step as the IdP Registry is not available.
+</Note>
+
+### Configure OAuth 2.0 Providers
+
+In the Admin Portal, navigate to **OAuth 2.0 Providers** (the Developer Portal's name for Identity Providers) and create an entry for each IdP you want to use with DCR.
+
+#### Connection Settings
+
+<img src="/img/dashboard/portal-management/enterprise-portal/curity-oauth-provider.jpg" alt="Configuring the connection to the IdP in OAuth 2.0 Providers" />
+
+| Field | Description |
+|:------|:------------|
+| **Name** | A label to identify this OAuth 2.0 Provider in the Portal UI. This is also stored as the name of the corresponding entry in the Identity Provider Registry. |
+| **Identity provider type** | Select your IdP from the dropdown. If it is not listed, select **Other** to use a standard RFC 7591-compliant client registration flow. |
+| **OIDC well-known configuration URL** (required) | The OIDC discovery endpoint for your IdP. |
+| **Scope claim name** (optional) | The JWT claim that contains the token's scopes. Different IdPs use different claim names: `scope` is the most common, but some use `scp` or another custom claim. Defaults to `scope`. Used by Tyk Gateway when [mapping token scopes to policies](/api-management/authentication/jwt-authorization#scope-policies). |
+| **Registration access token** (optional) | The token obtained in the [Authorize the Portal](#authorize-the-portal) section. |
+| **SSL insecure skip verify** (optional) | Enable only if your IdP uses a self-signed or privately issued certificate that Tyk cannot verify. This disables TLS certificate verification for connections to the IdP and should not be used in production. |
+
+#### Client Profiles
+
+When the Portal registers an OAuth 2.0 client in the IdP on behalf of an API Consumer, it must specify certain parameters that describe how access tokens will be obtained. These include the OAuth [grant type](https://datatracker.ietf.org/doc/html/rfc6749#section-1.3) and the authentication method used by the token endpoint. A **Client Profile** is a named template for these parameters (referred to as a **client type** in the Portal UI).
+
+You can define multiple Client Profiles to support different use cases. For example, you might define one Client Profile using the client credentials grant for server-to-server integrations and another using the authorization code grant for user-facing applications.
+
+When requesting access to an API Product in the Portal, API Consumers select from the list of Client Profiles defined for the IdP. The Portal uses that template when registering the OAuth 2.0 client that the IdP will use to issue tokens to that API Consumer.
+
+To add a Client Profile, scroll to **Client Types** and click **Add client type**.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/curity-client-type.jpg" alt="Configuring a Client Profile for OAuth 2.0 client creation" />
+
+| Field | Description |
+|:------|:------------|
+| **Client type display name** | The name shown to API Consumers at checkout. Keep it short and descriptive, for example "Server-to-server" or "Web application". |
+| **Description** | Additional context to help API Consumers choose the right Client Profile. Not shown by default but configurable via templates. |
+| **Allowed response types** | Controls what the IdP returns to the API Consumer's application after authorization. Note: when using Okta with the client credentials grant, set this to `token`. <ul><li>`code`: authorization code to exchange for tokens</li><li>`token`: access token returned directly</li><li>`id_token`: identity token (OIDC)</li></ul>See the [OIDC specification](https://openid.net/specs/openid-connect-core-1_0.html#Authentication) for details. |
+| **Allowed grant types** | The OAuth 2.0 grant flow the API Consumer's application will use to obtain tokens. <ul><li>`client_credentials`: server-to-server, no user involved</li><li>`authorization_code`: user-facing applications</li><li>`refresh_token`: obtain new access tokens without re-authenticating</li></ul>See the [OAuth 2.0 specification](https://datatracker.ietf.org/doc/html/rfc6749#section-1.3) for details. |
+| **Token endpoint auth methods** | How the API Consumer's application authenticates to the IdP's token endpoint. <ul><li>`client_secret_basic`: credentials as a Base64-encoded Authorization header</li><li>`client_secret_post`: credentials in the request body</li></ul>See the [OIDC specification](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication) for details. |
+| **Okta application type** (Okta only) | The Okta application type to create: `web` for server-side apps, `native` for mobile or desktop, `browser` for single-page apps, `service` for machine-to-machine. |
+
+<Note>
+Your IdP may override some of these settings based on its own configuration.
+</Note>
+
+When you have finished, click **Save Changes**.
+
+<Note>
+When an OAuth 2.0 Provider is created, updated, or deleted in Portal, the corresponding entry in the Identity Provider Registry is updated immediately on every connected Tyk Dashboard. No approval is required to propagate the change.
+</Note>
+
+### API Products and Plans
+
+Each API Product and each Plan used with DCR must have a unique OAuth 2.0 scope assigned, matching a scope you created in the IdP. See the [OAuth 2.0 Scopes](#oauth-2-0-scopes) section for the full requirements.
+
+See [API Products](/portal/api-products#dynamic-client-registration) and [API Plans](/portal/api-plans#dynamic-client-registration) for configuration instructions.
+
+<Note>
+When APIs are added to or removed from a DCR-enabled API Product, or when its DCR scopes are changed, the scope-to-policy mappings in the Identity Provider Registry are updated immediately. Existing tokens gain or lose access without requiring a new approval.
+
+This applies only when at least one access request for the API Product has already been approved. If no approval has ever been made, the Registry has no entry for that Product yet and there is nothing to update; the first approval will write the full mapping.
+</Note>
+
+## End-to-End DCR Flow
+
+This section walks through the complete DCR flow from the perspective of each actor: an API Consumer requesting access, an API Owner approving it, and the API Consumer using their credentials to call an API. It covers what happens at each stage and what to expect as output.
+
+Before proceeding, confirm that the following are in place:
+
+- At least one [OAuth 2.0 Provider](#configure-your-identity-provider) is configured in the Portal, with at least one [Client Profile](#client-profiles) defined.
+- At least one API in Tyk Dashboard has JWT authentication enabled.
+- An API Product includes that API and has DCR enabled, with a scope assigned.
+- A Plan has a scope assigned.
+- Both scopes [exist in the IdP](#oauth-2-0-scopes).
+
+### Request Access to the API Product
+
+The API Consumer discovers the DCR-enabled API Product in the catalog and submits an access request. As part of checkout, they select how their application will obtain tokens.
+
+As an API Consumer, log in and navigate to the catalog page. Select the DCR-enabled API Product, proceed to checkout, and complete the following:
+
+- Select a Plan.
+- Select an existing Developer App or create a new one.
+- Select a Client Profile (**client type** in the Portal UI).
+- If your Client Profile uses the authorization code grant, enter your application's redirect URI in the **Redirect URLs** field. This is the URL the IdP will redirect the user to after authentication, carrying the authorization code your application exchanges for a token. Separate multiple URIs with commas.
+- Click **Submit request**.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/request-access-to-the-dcr-enabled-product.png" alt="Request access to the DCR-enabled product" width="600" />
+
+### Approve the Access Request
+
+An API Owner reviews and approves the request.
+
+The Portal then registers a new OAuth 2.0 client with the IdP on the API Consumer's behalf, using the selected Client Profile to determine the grant type and token endpoint authentication method. The scopes from the API Product and Plan are associated with that client in the IdP.
+
+As part of the same process, the Portal retrieves the JWKS URI from the IdP and writes it, together with the scope-to-policy mappings, into Tyk. With `EnableIDPRegistry = true`, these are written to the Identity Provider Registry. Otherwise, they are written into the API definition.
+
+As an API Owner, navigate to **Access Requests**, select the request, and click **Approve**.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/approve-dcr-access-request.png" alt="Approve DCR access request" />
+
+### Obtain an Access Token
+
+Once the request is approved, the API Consumer can retrieve their OAuth 2.0 credentials from **My Dashboard**. Navigate to the Developer App and copy the **client ID** and **secret**.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/copy-oauth-credentials.png" alt="Copy the OAuth 2.0 credentials" />
+
+Use these credentials to request an access token from the IdP's token endpoint. You must include the scopes for the API Product and Plan in the request. Tyk Gateway uses these to identify which policies to apply, and will reject requests where the token does not contain the expected scopes.
+
+The example below uses the `client_credentials` grant with the `client_secret_basic` authentication method, where credentials are passed as a Base64-encoded `{client_id}:{client_secret}` string in the `Authorization` header.
+
+```bash
+curl --location --request POST '<your-idp-token-endpoint>' \
+--header 'Authorization: Basic N2M2NGM2ZTQtM2I0Ny00NTMyLWFlMWEtODM1ZTMyMWY2ZjlkOjNwZGlJSXVxd004Ykp0M0toV0tLZHFIRkZMWkN3THQ0' \
+--header 'Content-Type: application/x-www-form-urlencoded' \
+--data-urlencode 'scope=product_payments free_plan' \
+--data-urlencode 'grant_type=client_credentials'
+```
+
+A successful response includes a JWT access token. Decode it to confirm it contains the expected scopes before making an API call.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/jwt.png" alt="An example of a JWT" width="600" />
+
+### Make an API Call
+
+With a valid JWT access token, the API Consumer can call the API. Tyk Gateway validates the token signature and maps the scopes to policies before forwarding the request.
+
+Use the access token to call the API:
+
+```bash
+curl --location --request GET '<your-gateway-url>/payment-api/get' \
+--header 'Authorization: Bearer <your-access-token>'
+```
+
+## Migrating to the Identity Provider Registry
+
+DCR support in Tyk Developer Portal has evolved across three eras. The table below summarizes each to help you identify your current state before migrating.
+
+| Era | Portal Version | How IdP Config Is Stored | Limitations |
+|:----|:--------------|:------------------------|:------------|
+| Legacy | Before 1.13.0 | Manually in each API definition | No Portal management of IdP configuration; scope mappings require manual setup per API in Tyk Dashboard |
+| API Definition | 1.13.0 to 1.17.x | Portal writes to API definitions at approval | Write conflicts possible between Portal and Tyk Dashboard; configuration not updated automatically when API Products change |
+| Identity Provider Registry | 1.18.0+ | Centralized Registry in Tyk Dashboard | Recommended for all deployments |
+
+### Legacy Setup (Before Portal 1.13.0)
+
+Before Portal 1.13.0, DCR required fully manual configuration of scope-to-policy mappings in each Tyk Dashboard API definition. The Portal did not write anything into API definitions when an access request was approved. For each JWT-authenticated API, this involved:
+
+- Creating Tyk policies for the API Product and Plan
+- Creating a No Operation API and policy to satisfy the default policy requirement without granting real access. On Gateway versions prior to 5.11.0, Tyk required a default policy on APIs using scope-to-policy mapping; the No Operation API satisfied this without overriding the Product and Plan policies. From Gateway 5.11.0 onwards this workaround is no longer needed.
+- Manually enabling scope-to-policy mapping on each API definition and configuring the JWKS URI, scope-to-policy mappings, and default policy directly
+
+To migrate to the Identity Provider Registry, first upgrade to Portal 1.18.0, then follow the [Migration Steps](#migration-steps) below. Note that the automatic backfill does not cover manually configured API definitions. You will need to create OAuth 2.0 Providers in the Portal for each IdP, then populate the Registry manually via `POST /api/clientidps`.
+
+### API Definition Era (Portal 1.13.0 to 1.17.x)
+
+From Portal 1.13.0, the Portal began managing IdP configuration directly. OAuth 2.0 Providers and Client Profiles are configured in the Portal, and when an access request is approved, the Portal automatically writes the JWKS URI and scope-to-policy mappings into the relevant API definitions.
+
+For each JWT-authenticated API, the setup required leaving the **Public key** and **default policy** fields blank. The Portal populated these when an access request was approved. On Gateway versions prior to 5.11.0, a No Operation API and policy were also required to satisfy the default policy requirement; from Gateway 5.11.0 this is no longer needed.
+
+The limitation of this approach is that API definition configuration takes precedence over any changes made in Tyk Dashboard, and write conflicts can occur if the Portal and Tyk Dashboard both manage the same API definition. Configuration is also not updated automatically when API Products change outside of an approval event.
+
+To migrate to the Identity Provider Registry, first upgrade to Portal 1.18.0, then follow the [Migration Steps](#migration-steps) below.
+
+### Migration Steps
+
+1. Set [`TYK_PORTAL_ENABLEIDPREGISTRY=true`](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#tyk_portal_enableidpregistry) (or `EnableIDPRegistry = true` in the config file) and restart the Portal.
+
+    On startup, the Portal runs a backfill that creates Registry entries in Tyk Dashboard for any existing OAuth 2.0 Providers. Any new, or changes to existing, OAuth 2.0 Providers and API Products will be stored in the Registry going forward.
+
+    If moving from a [legacy version](#legacy-setup-before-portal-1-13-0) there will be nothing for the backfill to process.
+
+2. **Audit your API definitions.**
+
+    Call `GET /api/clientidps` against the Tyk Dashboard API to inspect the Registry entries created by the backfill.
+    
+    For each JWT-authenticated API, compare the JWKS URI and scope-to-policy mappings in the API definition against what the Registry now contains.
+
+    Pay particular attention to any IdP configuration that was added directly in Tyk Dashboard rather than through the Portal. The backfill only covers OAuth 2.0 Providers managed by the Portal; configuration added manually outside the Portal will not appear in the Registry after the backfill. Any such configuration must be added to the Registry manually via `POST /api/clientidps` before proceeding to the next step.
+
+    <Note>
+    There is no Tyk Dashboard UI for the Identity Provider Registry. All inspection and manual management must be done via the [Tyk Dashboard API](/tyk-dashboard-api).
+    </Note>
+
+3. **Remove IdP configuration from API definitions.**
+
+    Once the Registry is verified as complete and correct, you can remove the JWKS URIs and scope-to-policy mappings from each API definition. The configuration in the API definition [takes precedence over the Registry](/api-management/client-idp-registry#what-is-the-identity-provider-registry)) so if an issuer and scope match is found in the API definition, this will be used rather than the configuration in the Registry.
+
+    <Warning>
+    Do not remove configuration from an API definition until you have confirmed that the corresponding Registry entry exists and is correct. Removing configuration that has no Registry counterpart will break JWT validation for that API.
+    </Warning>
diff --git a/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso.mdx b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso.mdx
new file mode 100644
index 0000000000..ca55a11c64
--- /dev/null
+++ b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso.mdx
@@ -0,0 +1,353 @@
+---
+title: "Single Sign-On"
+description: "Learn how to configure Single Sign-On (SSO) for Tyk Developer Portal, allowing API Owners and API Consumers to log in with their existing identity provider credentials."
+keywords: "Tyk Developer Portal, SSO, Single Sign-On, Tyk Identity Broker, TIB, Authentication, Identity Provider"
+sidebarTitle: "Single Sign On"
+---
+
+Tyk Identity Broker (TIB) enables Single Sign-On (SSO) for Tyk Developer Portal, allowing users to log in using their existing identity provider (IdP) credentials.
+
+The Tyk Developer Portal has two distinct audiences, each requiring a different TIB configuration:
+
+- **API Owners** - Portal administrators who manage APIs, plans, and developer access from the Admin Portal.
+- **API Consumers** - External developers who browse the Live Portal and request API access.
+
+<Note>
+We recommend that you read the [Tyk Identity Broker overview](/tyk-identity-broker/overview) before configuring SSO for Developer Portal.
+</Note>
+
+## How It Works
+
+When a user logs in via SSO, TIB authenticates them against the configured IdP and then calls the Tyk Developer Portal API to obtain a one-time nonce. TIB redirects the user's browser to the Portal API's `/sso` endpoint with the nonce appended. Tyk Developer Portal validates the nonce and creates a session automatically.
+
+```mermaid
+sequenceDiagram
+    actor User
+    participant IDP as Identity Provider (IdP)
+    participant TIB as Tyk Identity Broker
+    participant Portal as Tyk Developer Portal
+
+    User->>TIB: Log in
+    TIB->>IDP: Verify identity
+    IDP->>TIB: Identity confirmed
+    TIB->>Portal: Request SSO nonce
+    Portal->>TIB: One-time nonce
+    TIB-->>User: Browser redirected to /sso?nonce=...
+    Note over User,Portal: Browser follows redirect automatically
+    Portal->>User: Session created, logged in
+```
+
+The outcome of a login depends entirely on which [TIB profile](/tyk-identity-broker/overview#profile) is used.
+
+- You will typically configure two separate TIB profiles - one for each audience - and publish their respective login URLs to the appropriate users.
+- The login URL contains the profile ID:
+
+```
+        http://{portal-host}/tib/auth/{profile-id}/{provider}
+```
+
+- The `ActionType` configured in that profile determines the result:
+
+        | `ActionType` | Audience | Portal Access |
+        |---|---|---|
+        | `GenerateOrLoginUserProfile` | API Owners | Admin Portal |
+        | `GenerateOrLoginDeveloperProfile` | API Consumers | Live Portal |
+
+
+
+## Enabling Single Sign-On
+
+To enable Single Sign-On with Portal you must set the following configuration:
+
+- set `PORTAL_TIB_ENABLED=true` in [the portal configuration](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#sample-env-file)
+- set the `TYK_IB_SESSION_SECRET` environment variable with a secret that will be used to sign the [redirect session cookie](/tyk-identity-broker/overview#redirect-session-cookie) if you are using an IdP that implements the redirect flow, such as those using OpenID Connect.
+
+<Note>
+From Portal v1.12.0, TIB is embedded in the portal and no separate TIB installation is required. If you are running an earlier version, or have a specific infrastructure requirement, see [Using Standalone TIB](#using-standalone-tib).
+</Note>
+
+
+## API Owner Login
+
+Tyk Developer Portal maintains user accounts for all API Owners, identified by email address.
+
+When a user is authenticated by the IdP and is directed to a TIB profile configured for action `GenerateOrLoginUserProfile`, the following decision tree is followed:
+
+```mermaid
+flowchart TD
+    A[API Owner authenticates via TIB] --> B{Account found with matching email address?}
+    B -- Yes --> C{Account active?}
+    B -- No --> D{Is AdminRegistrationAllow set to true?}
+    C -- Yes --> E[Logged in]
+    C -- No --> F[Login refused]
+    D -- Yes --> G[New account created with Provider Admin role]
+    G --> E
+    D -- No --> F
+```
+
+<Note>
+By default, Tyk will automatically create a new account for any successful login where there is no existing admin account for the user's email address. Set `AdminRegistrationAllow` to `false` in the [Portal configuration](/product-stack/tyk-enterprise-developer-portal/deploy/configuration) to require that an admin account must already exist before SSO login is permitted.
+</Note>
+
+### API Owner Profile Configuration
+
+The following [TIB profile](/tyk-identity-broker/overview#profile) fields are required for API Owner SSO:
+
+| Field | Value |
+|---|---|
+| `ID` | Unique identifier for this profile. Forms part of the TIB authentication URL. |
+| `ActionType` | `GenerateOrLoginUserProfile` |
+| `OrgID` | Must be `"0"` |
+| `ReturnURL` | `http://{portal-host}/sso` |
+| `IdentityHandlerConfig.DashboardCredential` | Must match `PORTAL_API_SECRET` in the Portal configuration |
+| `ProviderName` | Authentication method. See [IdP-specific guides](#set-up-sso-with-your-identity-provider). |
+| `ProviderConfig` | IdP-specific connection settings. See [IdP-specific guides](#set-up-sso-with-your-identity-provider). |
+| `Type` | `redirect` for OIDC/Social; `passthrough` for LDAP/Proxy. |
+
+The following optional fields are also available:
+
+| Field | Description |
+|---|---|
+| `CustomEmailField` | The IdP claim to use as the user's email address. If not set, TIB uses the standard email claim. |
+| `CustomUserIDField` | The IdP claim to use as the user's unique identifier. If not set, TIB uses the standard subject claim. |
+
+## API Consumer Login
+
+When a user authenticates, the IdP returns a set of attributes about them, such as their name, email address, and group membership. TIB receives these attributes as a key-value map.
+
+When configured with an API Consumer SSO profile, TIB derives an **SSO key** from the user's IdP identity. The SSO key is a combination of the user's unique IdP user ID and the provider name (for example, `abc123@okta`). It is stored on the Portal developer account and used to recognize the same user on subsequent logins, independently of their email address.
+
+### Login Flow
+
+TIB uses the SSO key to determine whether to create or update a Portal developer account:
+
+```mermaid
+flowchart TD
+    A[User authenticates with IdP] --> B[TIB: look up account by SSO key]
+    B --> C{SSO key matches existing account?}
+    C -- Yes --> D{Account has existing Team allocation?}
+    C -- No --> E{Email matches existing account?}
+    D -- Yes --> F[Logged in]
+    D -- No --> G[Assign to Team based on TIB profile and IdP claim]
+    G --> F
+    E -- Yes --> H[Link SSO key to account]
+    H --> F
+    E -- No --> I[Create new account with API Consumer Admin role]
+    I --> G
+```
+
+<Note>
+There is no configuration option to restrict API Consumer SSO login to pre-existing accounts only. A new user who successfully authenticates via SSO will always have a new [API Consumer Admin](/portal/api-consumer#api-consumer-admin) account created for them.
+</Note>
+
+### Team Assignment
+
+When a user logs into an account which is not assigned to any Teams - either because it is newly created, or because all Teams were removed after the first login (as shown in the diagram above) - Team assignment takes place based on the TIB profile and claims in the attributes returned by the IdP.
+
+This assignment involves two stages: TIB resolves the user's IdP group claim to a Portal Team ID, then the Portal looks up that Team and assigns the user.
+
+**Stage 1: TIB resolves the Team ID**
+
+```mermaid
+flowchart TD
+    A[TIB reads IdP attributes] --> B{Is CustomUserGroupField claim found?}
+    B -- Yes --> C{Is the Value from CustomUserGroupField found in UserGroupMapping?}
+    B -- No --> E{Is DefaultUserGroupID configured?}
+    C -- Yes --> D[Use mapped Portal Team ID]
+    C -- No --> E
+    E -- Yes --> F[Use DefaultUserGroupID]
+    E -- No --> G[No Team ID sent]
+```
+
+**Stage 2: Portal assigns the Team and Organisation**
+
+```mermaid
+flowchart TD
+    A[Portal receives Team ID from TIB] --> B{Team ID provided?}
+    B -- Yes --> C{Valid Team ID?}
+    B -- No --> D[Account has no Team or Organisation]
+    C -- Yes --> E[Assign Team, set Organisation from Team]
+    C -- No --> F[Error: login fails]
+```
+
+<Warning>
+If `DefaultUserGroupID` is set to a Team ID that does not exist in the Portal, login will fail. Always ensure `DefaultUserGroupID` refers to a valid, existing Team.
+</Warning>
+
+<Note>
+Once a user has been assigned to a Team - whether via SSO on first login or manually by an admin - subsequent SSO logins will never change their Team or Organisation. Any manual changes made in the Portal are preserved.
+</Note>
+
+### User Group Mapping Configuration
+
+The following TIB profile fields control how IdP group claims are resolved to Portal Team IDs (Stage 1 above):
+
+| Profile Field | Description |
+|---|---|
+| `CustomUserGroupField` | The key in the IdP attributes map that contains the user's group membership. |
+| `UserGroupMapping` | Maps IdP group values to Portal Team IDs. If multiple values match, the first match is used. |
+| `DefaultUserGroupID` | The Portal Team ID to use when no mapping matches. |
+
+<img src="/img/dashboard/portal-management/enterprise-portal/user-group-mapping.png" alt="User group mapping" width="600" />
+
+### API Consumer Profile Configuration
+
+The following [TIB profile](/tyk-identity-broker/overview#profile) fields are required for API Consumer SSO:
+
+| Field | Value |
+|---|---|
+| `ID` | Unique identifier for this profile. Forms part of the TIB authentication URL. |
+| `ActionType` | `GenerateOrLoginDeveloperProfile` |
+| `OrgID` | Must be `"0"` |
+| `ReturnURL` | `http://{portal-host}/sso` |
+| `IdentityHandlerConfig.DashboardCredential` | Must match `PORTAL_API_SECRET` in the Portal configuration |
+| `ProviderName` | Authentication method. See [IdP-specific guides](#set-up-sso-with-your-identity-provider). |
+| `ProviderConfig` | IdP-specific connection settings. See [IdP-specific guides](#set-up-sso-with-your-identity-provider). |
+| `Type` | `redirect` for OIDC/Social; `passthrough` for LDAP/Proxy. |
+
+The following optional fields are also available:
+
+| Field | Description |
+|---|---|
+| `CustomUserGroupField` | The IdP claim that contains the user's group membership. Required for [User Group Mapping](#user-group-mapping-configuration). |
+| `UserGroupMapping` | Maps IdP group values to Portal Team IDs. See [User Group Mapping](#user-group-mapping-configuration). |
+| `DefaultUserGroupID` | The Portal Team ID to use when no group mapping matches. See [User Group Mapping](#user-group-mapping-configuration). |
+| `CustomEmailField` | The IdP claim to use as the user's email address. If not set, TIB uses the standard email claim. |
+| `CustomUserIDField` | The IdP claim to use as the user's unique identifier. If not set, TIB uses the standard subject claim. |
+
+
+## Creating a TIB Profile
+
+TIB profiles are managed in the Portal UI under **Settings > SSO Profiles**.
+
+1. Select **Add new SSO Profile**.
+2. Complete the **Profile action** step. Choose a **Name** (this becomes the profile `ID`), select the **Profile type** - **Profile for admin users** for API Owner login or **Profile for developers** for API Consumer login - and set the failure redirect URL.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-admin-1.png" alt="SSO Profiles Wizard - Profile action step" />
+
+3. Select the **Provider type** for your IdP.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-provider.png" alt="SSO Profiles Wizard - Provider type selection" />
+
+4. Complete the **Profile configuration** step with your IdP connection details.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-profile-config.png" alt="SSO Profiles Wizard - Profile configuration" />
+
+5. For developer profiles, configure the **Group mapping**. Set **Custom user group claim name** to the IdP claim that contains the user's group membership. For admin profiles, skip this step.
+
+    <img src="/img/dashboard/portal-management/enterprise-portal/portal-sso-wizard-dev-4.png" alt="SSO Profiles Wizard - Group mapping" />
+
+6. Click **Continue** to create the profile.
+
+You can view and edit the profile JSON directly from the **Raw editor** view.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-sso-raw-editor.png" alt="SSO Profiles Raw Editor" />
+
+<Note>
+The SSO profile wizard supports OIDC, LDAP, and Social provider types. SAML is not available as a selectable option so you would need to create the TIB profile in the **Raw editor** view.
+</Note>
+
+## Initiating SSO Login
+
+The TIB authentication URL for each profile is shown in the profile's **Provider configuration** section in **Settings > SSO Profiles**.
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-sso-login.png" alt="SSO Profile Details - Login URL" />
+
+How users initiate login depends on the flow type used by their IdP.
+
+### Redirect Flow (OIDC, Social)
+
+For redirect-based IdPs, the IdP hosts the login page. Users need to be directed to the TIB authentication URL, which then redirects them to the IdP.
+
+From Portal v1.16.0, you can configure `PORTAL_SSO_CUSTOM_LOGIN_URL` to automatically redirect users from the Portal login page to your IdP's login flow. When set, all login requests - including the Portal's **Log in** button - are redirected to the specified URL instead of displaying the built-in login form.
+
+Set it to the TIB authentication URL for the profile:
+
+<Tabs>
+<Tab title="Environment variable">
+```ini
+PORTAL_SSO_CUSTOM_LOGIN_URL=http://{portal-host}:{portal-port}/tib/auth/{profile-id}/openid-connect
+```
+</Tab>
+<Tab title="Config file">
+```json
+{
+  "SSOCustomLoginURL": "http://{portal-host}:{portal-port}/tib/auth/{profile-id}/openid-connect"
+}
+```
+</Tab>
+</Tabs>
+
+For the full reference, see [PORTAL_SSO_CUSTOM_LOGIN_URL](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_sso_custom_login_url) in the Portal configuration reference.
+
+<Note>
+This setting only redirects the login entry point. User registration and password reset pages are not affected.
+</Note>
+
+For earlier Portal versions, share the TIB authentication URL directly with users.
+
+### Passthrough Flow (LDAP, Proxy)
+
+For passthrough-based IdPs, there is no IdP-hosted login page. Users submit their credentials directly to TIB via a form `POST`. You must provide a custom HTML login page, for example:
+
+```html expandable
+<html>
+  <head>
+    <title>Developer Portal Login</title>
+  </head>
+  <body>
+    <b>Login to the Developer Portal</b>
+    <form method="post" action="http://{portal-host}:{portal-port}/tib/auth/{profile-id}/ldap">
+      Username: <input type="text" name="username" /><br/>
+      Password: <input type="password" name="password" /><br/>
+      <button type="submit">Login</button>
+    </form>
+  </body>
+</html>
+```
+
+Replace `{portal-host}`, `{portal-port}`, and `{profile-id}` with the values for your installation.
+
+## Using Standalone TIB
+
+By default, Tyk Developer Portal uses its embedded TIB for SSO from v1.12.0 onwards. If you need to use a standalone TIB instance instead - for example, if you are running an earlier Portal version - install and configure TIB separately and point it at the Portal.
+
+The TIB configuration for standalone Portal SSO requires the `TykAPISettings.DashboardConfig` block to reference the Portal host and `PortalAPISecret`:
+
+```json
+{
+  "TykAPISettings": {
+    "DashboardConfig": {
+      "Endpoint": "http://{portal-host}",
+      "Port": "{portal-port}",
+      "AdminSecret": "{portal-api-secret}"
+    }
+  }
+}
+```
+
+| Setting | Description |
+|---|---|
+| `Endpoint` | URL of the Tyk Developer Portal. |
+| `Port` | Port on which the Portal is running. |
+| `AdminSecret` | Must match `PORTAL_API_SECRET` in the Portal configuration. |
+
+For full installation and configuration instructions, see [Install Standalone TIB](/tyk-identity-broker/standalone-tib).
+
+<Note>
+TIB uses the same `DashboardConfig` block to connect to both Tyk Dashboard and Tyk Developer Portal - a single standalone TIB instance can only point at one. If you need standalone TIB for both Dashboard SSO and Portal SSO in the same deployment, you must run a separate TIB instance for each.
+</Note>
+
+## Set Up SSO with Your Identity Provider
+
+Select your identity provider to get started:
+
+| Identity Provider | Guide |
+|---|---|
+| Microsoft Entra ID (OIDC), ADFS | [SSO with Microsoft Entra ID](/tyk-identity-broker/sso-entra-id) |
+| Okta (OIDC) | [SSO with Okta](/tyk-identity-broker/sso-okta) |
+| Auth0 | [SSO with Auth0](/tyk-identity-broker/sso-auth0) |
+| Keycloak | [SSO with Keycloak](/tyk-identity-broker/sso-keycloak) |
+| Active Directory, OpenLDAP | [SSO with LDAP](/api-management/single-sign-on-ldap) |
+| Google, GitHub, LinkedIn, and other OAuth providers | [SSO with Social Providers](/api-management/single-sign-on-social-idp) |
+| Custom or legacy authentication endpoints | [SSO with Proxy Provider](/api-management/custom-auth-with-proxy-identity-provider) |
diff --git a/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations.mdx b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations.mdx
new file mode 100644
index 0000000000..2e35a69a26
--- /dev/null
+++ b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations.mdx
@@ -0,0 +1,334 @@
+---
+title: "Organisations and Teams"
+description: "How to manage Organisations in Tyk Developer Portal"
+keywords: "Developer Portal, Tyk, API Consumer, Organisation, Organization, Team"
+sidebarTitle: "Organisations and Teams"
+---
+
+## Introduction
+
+The Tyk Developer Portal uses Organisations and Teams to provide flexible, hierarchical access control for your API ecosystem. This structure allows you to manage API Consumers at both the organizational level and in smaller functional groups, reflecting real-world business relationships and access requirements.
+
+Unlike individual developer accounts, Organisations represent entire companies or business entities with sophisticated requirements:
+
+- **Team-based access:** Companies typically have multiple developers who need access to your APIs. Tyk Developer Portal's Organisation and Team structure ensures communication and access don't depend on a single individual who might leave the company.
+- **Secure credential sharing**: Organizations need secure ways to share API credentials within their teams. Without proper tooling, developers resort to sharing credentials through insecure channels, creating security risks.
+- **Hierarchical permissions**: Within organizations, some users need administrative capabilities while others require more limited access. The Tyk Developer Portal supports this through API Consumer Admin and Team Member roles.
+- **Self-service team management**: Organizations can maintain their own teams by inviting new members or removing departed ones, reducing administrative overhead for API providers.
+
+This organizational approach allows you to manage API Consumers at both the company level and in smaller functional groups, supporting complex business relationships while maintaining security and governance.
+
+<br />
+
+<Note>
+**A note on spelling**  
+
+Throughout this documentation, we use specific spelling conventions to help distinguish between product features and general concepts:
+- Organisation (with an 's') refers specifically to the entity within the Tyk Developer Portal (sometimes abbreviated to Org)
+- organization (with a 'z') refers to real-world businesses or the general concept of organizing
+
+This British/American English distinction helps clarify when we're discussing the Tyk Developer Portal feature versus general organizational concepts.
+</Note>
+
+
+### Understanding the Organizational Hierarchy
+
+Organisations and Teams create a two-level hierarchy that provides granular control over API access. This allows API Owners to manage access at multiple levels, supporting complex business relationships while maintaining security and governance. Note that users can belong to multiple Teams within an Organisation, allowing for flexible resource allocation based on project needs or job responsibilities.
+
+For example, consider a Partner (Acme Bank) that wishes to consume your APIs. They have an *Accounts* team that requires access to a specific set of APIs and a *Development* team that requires access to those plus additional APIs.
+
+- You create an Organisation for the client (Acme Bank)
+- You create separate Teams for their *Accounts* and *Development* users
+- You construct two [Catalogs](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues) of [API Products](/portal/api-products) and [Plans](/portal/api-plans)
+    - Catalog 1 contains the Accounts APIs and subscription Plans
+    - Catalog 2 contains the Developer APIs and subscription Plans
+- You configure Catalog visibility as follows:
+    - Catalog 1 is made visible to both Teams
+    - Catalog 2 is made visible only to the Developer Team
+- You create an [API Consumer Admin](/portal/api-consumer#api-consumer-admin) user for each Team
+    - these users can invite colleagues into their Team as [API Consumer Team Member](/portal/api-consumer#team-member) users
+
+<img src="/img/dashboard/portal-management/enterprise-portal/portal-catalogue-sample-set-up.png" alt="Diagram showing an Organisation with two Teams of API Consumers" />
+
+With this configuration, the Admin and Team Members in each team are unaware of the other Team or its members. The members of the Accounts team have access to discover and consume the API Products in Catalog 1, whilst the members of the Development team have access to both Catalogs.
+
+### Default Organisation
+
+The system automatically creates a pre-configured "Default Organisation" during the [bootstrap](/portal/install#bootstrapping-developer-portal) process that serves as the initial home for:
+
+- Self-registered users without an [invite code](/portal/api-consumer#invite-codes)
+- API Consumer users created by API Owners without a specific Organisation assignment
+- API Consumer users whose Organisation has been [deleted](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#deleting-organisations)
+
+While the Default Organisation cannot be deleted, you can:
+
+- [Rename](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#editing-organisation-details) it to better reflect your business needs
+- Move users from it to other Organisations as needed
+- Use it as a holding area for users awaiting proper Organisation assignment
+
+#### Developer App visibility
+
+[Team and Organisation level app visibility](/portal/developer-app#visibility) is not applied within the Default Organisation. This behavior has been implemented to prevent accidental exposure of Developer Apps if a user is removed from a custom Organisation and automatically reverts to the Default Org.
+
+<br />
+
+<Note>
+We do not recommend using the Default Org for publication of API Products and Plans.
+</Note>
+
+
+## Managing Organisations
+
+Organisations represent companies or business units that consume your APIs.
+
+- **Purpose**: Group related teams and developers under a single entity
+- **Hierarchy**: Each API Consumer belongs to exactly one Organisation
+- **Default Organisation**: A system-provided Organisation where users are placed if not assigned elsewhere
+- **Creation**: Organisations can only be created by API Owners (or by self-registered developers if [Organisation requests](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#requesting-a-new-organisation) are enabled)
+- **Management**:
+  - API Owners can create, modify, and delete any Organisation
+  - API Consumer Admins can manage users within their Organisation
+
+### Creating Organisations
+
+As an API Owner, you can create new Organisations to represent partner companies or business units:
+
+1. Navigate to **API Consumers > Organisations** in the Admin Portal
+2. Select **Add new Organisation**
+    <img src="/img/dashboard/portal-management/enterprise-portal/add-org2.png" alt="Click on Add to create a new Organisation" />
+3. Provide a **Name** for the new Organisation
+    <img src="/img/dashboard/portal-management/enterprise-portal/add-orgs.png" alt="Giving the new Organisation a name" />
+4. Select **Save changes** to create the Organisation
+
+Once created, you can begin adding Teams and users to the Organisation. Note that a [default Team](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#default-team) is automatically created with the Organisation.
+
+### Editing Organisation Details
+
+As an API Owner, you can change the name of an Organisations to represent changes in partner companies or business units:
+
+1. Navigate to **API Consumers > Organisations** in the Admin Portal
+2. Select the Organisation you want to rename
+3. Update the **Name**
+4. Select **Save changes**
+
+### Deleting Organisations
+
+As an API Owner, you can delete an Organisation to represent changes in partner companies or business units:
+
+1. Navigate to **API Consumers > Organisations** in the Admin Portal
+2. Select the three dot menu next to the Organisation you want to delete
+3. Select **Delete**
+4. Confirm the deletion
+
+The Organisation and any Teams created within it will be deleted immediately.
+
+All users (both API Consumer Admins and Team Members) will be moved to the [default Team](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#default-team) in the [default Organisation](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#default-organisation) where any Developer Apps they own will have their visibility set to [Personal](/portal/developer-app#visibility)
+
+### Best Practices for Organisation Management
+
+- **Naming conventions**: Establish a consistent naming pattern for Organisations
+- **Regular audits**: Periodically review Organisation membership and activity
+- **Documentation**: Maintain records of which real-world entities each Organisation represents
+- **Onboarding process**: Create a standardized workflow for adding new Organisations
+
+## Working With Teams
+
+Teams are groups of developers who collaborate on related projects.
+
+- **Purpose**: Enable collaboration and shared access to API resources
+- **Hierarchy**:
+  - Teams exist within a specific Organisation
+  - API Consumers can belong to multiple Teams within their Organisation
+- **Default Team**: Each Organisation has a default Team where users are placed if not assigned to any other team
+- **Creation**: Teams can only be created by API Owners
+- **Management**:
+  - **API Owners** can create, modify, and delete any Team
+  - **API Consumer Admins** can manage team membership within their Organisation
+
+### Creating Teams
+
+Teams allow you to organize API Consumers into functional groups with specific API access:
+
+1. As an API Owner, navigate to **API Consumers > Teams** in the Admin Portal
+2. Select **Add new Team**
+3. Complete the team details:
+    - **Name**: A descriptive name for the team (required)
+    - **Organisation**: Select the Organisation this team belongs to
+4. Select **Save changes**
+
+Teams can represent departments, project groups, or any logical grouping that helps organize API access within an Organisation.
+
+### Managing Team Membership
+
+Once a team is created, an API Owner can add members from the Organisation containing the Team:
+
+1. Navigate to **API Consumers > Users** in the Admin Portal
+2. Find and select the user you wish to add or remove
+3. If they are not in the Organisation containing the Team, change their **Organisation**
+3. Modify their Team membership in the **Teams** section
+4. Select **Save changes**
+
+An API Consumer Admin can configure the Team membership of other API Consumer users that share any Teams with the Admin as described [here](/portal/api-consumer#managing-api-consumer-users-in-the-live-portal). This self-service capability allows Organisations to manage their own structure while API Owners maintain control over API access.
+
+Remember that users can belong to multiple teams, gaining access to all API Catalogs assigned to any of their teams.
+
+### Default Team
+
+Each Organisation has a system-generated Default Team that serves several important purposes:
+
+- Provides an initial home for new users in the Organisation
+- Provides a home for API Consumer users who have been [removed](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#deleting-organisations) from all other Teams in the Org
+- Can be used for Organisation-wide API access
+
+The Default Team cannot be deleted, however you can:
+
+- Rename it to better reflect your business needs
+- Move users from it to other Teams as needed
+- Use it as a holding area for users awaiting proper Team assignment
+
+#### Developer App visibility
+
+[Team level app visibility](/portal/developer-app#visibility) is not applied within the Default Team. This behavior has been implemented to prevent accidental exposure of Developer Apps if a user is removed from a team and automatically reverts to the Default Team.
+
+<br />
+
+<Note>
+We do not recommend using the Default Team for consumption of API Products and Plans except for Organisation-wide API access.
+</Note>
+
+
+### Best Practices for Team Management
+
+- **Logical grouping**: Create teams based on project needs or functional areas
+- **Minimal access**: Assign only the APIs each team needs to function
+- **Regular audits**: Periodically review team membership and API access
+- **Descriptive naming**: Use clear, consistent naming conventions for teams
+- **Documentation**: Maintain records of each team's purpose and required access
+
+
+## Requesting a New Organisation
+
+The Developer Portal allows potential API Consumers to request the creation of a new Organisation during self-registration. This powerful feature balances self-service convenience with administrative control, addressing several key business needs:
+
+- When running an open API program that welcomes new business partners
+- When scaling your API ecosystem to reach more companies without proportionally increasing administrative work
+- When you want to capture interest from potential partners outside normal business hours
+- When you need clear differentiation between individual developers and those representing companies
+
+The Organisation request feature adds value with:
+
+- Accelerated Onboarding: Reduces the time from initial interest to active API usage by eliminating manual Organisation creation steps
+- Business Intelligence: Provides visibility into which companies are interested in your APIs, creating potential partnership opportunities
+- Improved User Experience: Allows users to properly identify themselves as representing a company from the start
+- Proper Governance: Maintains security through approval workflows while enabling self-service
+
+This self-service approach reduces administrative overhead while ensuring proper governance of your API ecosystem. It's particularly valuable for open API programs or when expanding your API consumer base.
+
+### Requesting a new Organisation
+
+1. Visit the Developer Portal and [register] without an Invite Code
+2. Log in to the Developer Portal (this can be done without the account having been approved)
+3. Select **Create an Organisation**
+    <img src="/img/dashboard/portal-management/enterprise-portal/become_an_organisation_navbar.png" alt="Request a new Organisation" />
+4. Provide the requested Org with a **Name**
+    <img src="/img/dashboard/portal-management/enterprise-portal/specify_name_of_an_organisation.png" alt="Specify name of the Organisation" />
+5. Select **Create Organisation**
+6. The user receives confirmation that their request is pending review
+    <img src="/img/dashboard/portal-management/enterprise-portal/org_registration_is_pending.png" alt="Organisation registration is pending" />
+7. Note that if the Developer Portal settings are configured for [automatic approval](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#configuring-organisation-request-settings) of Organisation Requests without API Owner [review](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#reviewing-organisation-requests) then the Organisation will be created immediately and the requestor approved and converted to an API Consumer Admin within the new Org.
+    <img src="/img/dashboard/portal-management/enterprise-portal/org_registration_is_approved.png" alt="Organisation registration is approved" />
+
+### Reviewing Organisation Requests
+
+1. If [automatic approval](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-api-consumer-organisations#configuring-organisation-request-settings) of Organisation Requests is not set, the API Owner users will be notified of Organisation request via email.
+    <img src="/img/dashboard/portal-management/enterprise-portal/new_org_request_email.png" alt="New Organisation registration request notification" />
+2. Navigate to **API Consumers > Organisations** in the Admin Portal
+2. The requested Organisation appears as *pending* in the list
+3. Select the pending Organisation to see which user made the request
+4. After reviewing the request, an API Owner can use the options in the three dot menu to:
+    - Approve the request, activating the new Organisation with the requestor automatically becoming an API Consumer Admin
+    - Reject the request, with the requestor remaining a Team Member
+    <img src="/img/dashboard/portal-management/enterprise-portal/pending_org_registration_admin.png" alt="New Organisation registration request view" />
+5. The requestor will receive an email notifying them of the approval or rejection of the request.
+
+**Note**: The API Owner can modify the name of the new Org during the review, if required.
+
+The content of the emails sent to API Owners and API Consumers can be [customized](/portal/customization/email-notifications) to meet your business needs.
+
+### Configuring Organisation Request Settings
+
+Control whether and how users can request new Organisations by configuring the Developer Portal settings:
+
+1. Navigate to **Settings > General > API Consumer access** in the Admin Portal
+    <img src="/img/dashboard/portal-management/enterprise-portal/api_consumer_org_registration_settings.png" alt="Organisation registration settings" />
+2. Check or clear the options:
+    - **Enable API consumers to register Organisations**
+    - **Auto-approve API consumers registering organisation**
+4. Select **Save changes**
+
+Note that enabling auto-approval will mean there is no opportunity to review Org requests, so should only be used in carefully controlled business environments.
+
+
+## Use Cases and Implementation Strategies
+
+The Organisation and Team structure in Tyk Developer Portal can be adapted to support various business models and API programs. Here are strategic approaches for common scenarios:
+
+### Enterprise Partner Ecosystem
+
+**Scenario**: Managing APIs for a network of business partners with different access needs
+
+**Implementation**:
+    - Create an Organisation for each partner company
+    - Structure teams based on partner's functional departments (e.g., Development, QA, Analytics)
+    - Assign graduated API access tiers based on partnership level
+    - Designate partner technical leads as API Consumer Admins
+
+**Benefits**:
+    - Clear separation between different partner companies
+    - Partners can self-manage their internal team structure
+    - Access revocation is simplified when partnerships change
+    - Usage analytics can be tracked at the partner company level
+
+### Internal Developer Program
+
+**Scenario**: Providing API access across departments within your own company
+
+**Implementation**:
+- Create Organisations representing major business units or subsidiaries
+- Form teams based on projects, product lines, or functional groups
+- Use the Default Organisation for central IT or platform teams
+- Implement consistent naming conventions that align with internal structure
+
+**Benefits**:
+- Mirrors existing company hierarchy for easier governance
+- Supports chargeback models for internal API consumption
+- Enables department-specific policies and quotas
+- Provides visibility into cross-departmental API usage
+
+### Public API Marketplace
+
+**Scenario**: Offering APIs to external developers with tiered access models
+
+**Implementation**:
+- Enable Organisation self-registration requests
+- Create template teams for common access patterns (Basic, Professional, Enterprise)
+- Implement automated workflows for upgrading access tiers
+- Use Default Teams for individual developers without complex needs
+
+**Benefits**:
+- Scales efficiently as your developer community grows
+- Supports freemium to premium conversion paths
+- Allows companies to start small and expand access as needed
+- Provides clear separation between individual developers and companies
+
+### Implementation Checklist
+
+Regardless of your use case, consider these factors when designing your Organisation and Team structure:
+- **Scalability**: Will the structure accommodate growth in users and APIs?
+- **Governance**: Does it support your compliance and security requirements?
+- **Administration**: Is the overhead manageable for your API team?
+- **User Experience**: Does it make sense from the API Consumer perspective?
+- **Analytics**: Will you get the usage insights needed for your business?
+- **Flexibility**: Can it adapt as your API program evolves?
+
+By thoughtfully designing your Organisation and Team structure to match your specific business needs, you can create an API program that balances security, usability, and administrative efficiency.
diff --git a/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues.mdx b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues.mdx
new file mode 100644
index 0000000000..9097d541c9
--- /dev/null
+++ b/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues.mdx
@@ -0,0 +1,122 @@
+---
+title: "API Catalogs"
+description: "Working with API Catalogs"
+keywords: "Developer Portal, Tyk, Managing Access, Catalogs"
+sidebarTitle: "API Catalogs"
+---
+
+## Introduction
+
+API Catalogs are curated collections of API Products and Plans that enable you to organize and present your API offerings to different developer audiences. Catalogs serve as the primary navigation and discovery mechanism in the Tyk Developer Portal, allowing you to create tailored API marketplaces for different consumer segments.
+
+Unlike traditional API documentation sites that present all APIs to everyone, Catalogs give you fine-grained control over who sees what. This enables you to create personalized experiences for different developer audiences - from public APIs available to anyone, to specialized offerings for specific partners or internal teams.
+
+Catalogs transform your API portfolio management by:
+
+- Segmenting API Products for different developer audiences
+- Creating customized discovery experiences for different use cases
+- Controlling visibility of API offerings based on business relationships
+- Enabling consistent organization of related API Products
+
+In the Tyk Developer Portal, Catalogs act as the bridge between your API Products and your developer community, ensuring that each developer sees exactly the APIs they need.
+
+## Key Concepts
+
+### Catalog Types
+
+The Tyk Developer Portal supports two visibility modes for Catalogs:
+
+- Public Catalogs: Visible to anyone visiting your Developer Portal, even without logging in. Ideal for openly available APIs and developer recruitment.
+- Private Catalogs: Visible only to authenticated users who have logged into your Developer Portal. They can be further restricted only to members of specific [teams](/portal/api-consumer). Perfect for partner-specific APIs, internal teams, or premium offerings.
+
+### Catalog Structure
+
+Each Catalog contains:
+
+- [API Products](/portal/api-products): The functional API offerings available in this Catalog
+- [Plans](/portal/api-plans): The subscription options available for Products in this Catalog
+- Visibility Settings: Controls which developers can see this Catalog
+- Presentation Elements: Name, description, and other display properties
+
+### Catalog Relationships
+
+Understanding how Catalogs relate to other elements in the Developer Portal:
+
+- Products and Plans: A Product or Plan can appear in multiple Catalogs
+- Teams and Organisations: Can be granted access to specific Custom Catalogs
+- Developer Experience: Developers only see Catalogs they have access to
+
+## API Catalog Reference Guide
+
+This comprehensive reference guide details all the configurable options and features of API Catalogs in the Tyk Developer Portal.
+
+### Core Features
+
+#### Catalog Name
+
+The primary identifier for your Catalog within the Admin Portal, this is not exposed in the Live Portal
+
+- **Location**: *Catalogues > Add/Edit Catalogues > Name*
+- **Purpose**: Identifies the Catalog within the Developer Portal
+- **Best Practice**: Choose a clear, descriptive name that reflects the Catalog's purpose or audience
+
+#### Path URL
+
+This configuration is not currently in use and can be ignored.
+
+#### Sync URL with Name
+
+- **Location**: *Catalogues > Add/Edit Catalogues > Sync URL with Name*
+- **Note**: This configuration must be checked (selected).
+
+### Catalog Visibility
+
+#### Visibility Options
+
+Controls which API Consumers can see and access this Catalog.
+
+- **Location**: *Catalogues > Add/Edit Catalogues > Visibility options*
+- **Options**:
+    - Public: Visible to all visitors, even without logging in
+    - Private: Visible only to authenticated users in the teams select in the [Audience](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/manage-catalogues#audience)
+- **Default**: Private
+- **Best Practice**: Use the most restrictive visibility that meets your business needs
+
+#### Audience
+
+Specifies which teams can access a Private Catalog.
+
+- **Location**: *Catalogues > Add/Edit Catalogues > Team*
+- **Selection**: Select **Add Team** then choose from any Teams created on the Developer Portal; you can add multiple teams by repeating this action
+- **Behavior**: Only members of the selected teams will see this Catalog
+- **Note**: Teams must be created before they can be added to the audience; any combination of Teams can be added to a Catalog's audience across any number of Organisations
+
+### Catalog Content
+
+#### Products
+
+Determines which API Products appear in this Catalog.
+
+- **Location**: *Catalogues > Add/Edit Catalogues > Products*
+- **Selection**: Select one or more Products from the dropdown
+- **Removal**: Click on the `x` next to the name of the Product you want to delete from the Catalog
+- **Relationship**: A Product can be assigned to multiple Catalogs
+- **Best Practice**: Ensure that Products and their relevant Plans are assigned to the same Catalogs
+
+#### Plans
+
+Determines which API Plans appear in this Catalog.
+
+- **Location**: *Catalogues > Add/Edit Catalogues > Plans*
+- **Selection**: Select one or more Plans from the dropdown
+- **Removal**: Click on the `x` next to the name of the Plan you want to delete from the Catalog
+- **Relationship**: A Plan can be assigned to multiple Catalogs
+- **Best Practice**: Ensure that Products and their relevant Plans are assigned to the same Catalogs
+
+## Best Practices for API Catalogs
+
+- Create purpose-driven Catalogs: Design each Catalog with a specific audience and purpose in mind
+- Use clear naming conventions: Make Catalog names intuitive and descriptive
+- Maintain consistent organization: Apply similar structures across Catalogs for a predictable developer experience
+- Limit the number of Catalogs: Too many Catalogs can create confusion; aim for a manageable number
+- Review access regularly: Periodically audit Custom Catalog access to ensure it remains appropriate
diff --git a/tyk-stack/tyk-gateway/important-prerequisites.mdx b/tyk-stack/tyk-gateway/important-prerequisites.mdx
new file mode 100644
index 0000000000..352438ceea
--- /dev/null
+++ b/tyk-stack/tyk-gateway/important-prerequisites.mdx
@@ -0,0 +1,55 @@
+---
+title: "Useful Configurations when Getting started"
+description: "Important prerequisites and configurations needed before proceeding with Tyk tutorials."
+sidebarTitle: "Useful Configurations"
+---
+
+These are some common settings that you need before proceeding with other parts of our tutorials.
+
+## Tyk Config
+
+### Path to Tyk API Definitions configurations directory
+
+You may need to explicitly define the path in your Tyk config to the directory where you will add
+the API definitions for Tyk to serve.
+
+```yaml
+...
+"app_path": "/opt/tyk-gateway/apps",
+...
+```
+
+### Path to Policies file
+
+You need to explicitly set the path to your Policies JSON file in your Tyk config.
+
+```yaml
+...
+  "policies": {
+    "policy_source": "file",
+    "policy_record_name": "policies/policies.json"
+  },
+...
+```
+
+### Remove Tyk Dashboard related config options
+
+Some config options for the Community Edition are not compatible with the Dashboard
+version, which requires a license. So, **remove** any section in your Tyk config which
+starts with:
+
+```yaml
+...
+"db_app_conf_options" {
+  ...
+},
+...
+```
+
+## Hot reload is critical in Tyk CE
+
+Each time you add an API definition in Tyk CE, you need to make a hot reload API call as follows:
+
+```curl
+curl -H "x-tyk-authorization: {your-secret}" -s https://{your-tyk-host}:{port}/tyk/reload/group | python -mjson.tool
+```
diff --git a/tyk-stack/tyk-operator/create-an-api.mdx b/tyk-stack/tyk-operator/create-an-api.mdx
new file mode 100644
index 0000000000..3015333e14
--- /dev/null
+++ b/tyk-stack/tyk-operator/create-an-api.mdx
@@ -0,0 +1,2048 @@
+---
+title: "Create and Secure an API with Tyk Operator"
+description: "Learn how to create an API using Tyk Operator in Kubernetes"
+keywords: "Tyk Operator, Kubernetes, API Management"
+sidebarTitle: "Create an API"
+---
+
+## Introduction
+
+Tyk Operator allows you to manage your Tyk APIs, policies, and other configurations using Kubernetes Custom Resource Definitions (CRDs). This page will help you create an API using Tyk Operator.
+
+## Set Up Tyk OAS API
+Setting up OpenAPI Specification (OAS) APIs with Tyk involves preparing an OAS-compliant API definition and configuring it within your Kubernetes cluster using Tyk Operator. This process allows you to streamline API management by storing the OAS definition in a Kubernetes ConfigMap and linking it to Tyk Gateway through a TykOasApiDefinition resource. 
+
+### Create your Tyk OAS API
+#### Prepare the Tyk OAS API Definition
+First, you need to have a complete Tyk OAS API definition file ready. This file will contain all the necessary configuration details for your API in OpenAPI Specification (OAS) format.
+
+Here is an example of what the Tyk OAS API definition might look like. Note that Tyk extension `x-tyk-api-gateway` section should be present.
+
+```json {hl_lines=["9-25"],linenos=true}
+{
+  "info": {
+    "title": "Petstore",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "components": {},
+  "paths": {},
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "Petstore",
+      "state": {
+        "active": true
+      }
+    },
+    "upstream": {
+      "url": "https://petstore.swagger.io/v2"
+    },
+    "server": {
+      "listenPath": {
+        "value": "/petstore/",
+        "strip": true
+      }
+    }
+  }
+}
+```
+
+Save this API definition file (e.g., `oas-api-definition.json`) locally.
+
+
+<Note>
+**Tips**  
+
+You can create and configure your API easily using Tyk Dashboard in a developer environment, and then obtain the Tyk OAS API definition following these instructions:
+
+1. Open the Tyk Dashboard
+2. Navigate to the API you want to manage with the Tyk Operator
+3. Click on the "Actions" menu button and select "View API Definition."
+4. This will display the raw Tyk OAS API definition of your API, which you can then copy and save locally.
+</Note>
+
+
+#### Create a ConfigMap for the Tyk OAS API Definition
+
+You need to create a [ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/#configmap-object) in Kubernetes to store your Tyk OAS API definition. The Tyk Operator will reference this ConfigMap to retrieve the API configuration.
+
+To create the ConfigMap, run the following command:
+
+```sh
+kubectl create configmap tyk-oas-api-config --from-file=oas-api-definition.json -n tyk
+```
+
+This command creates a ConfigMap named `tyk-oas-api-config` in the `tyk` namespace (replace `tyk` with your actual namespace if different).
+
+
+<Note>
+**Notes**
+
+There is inherent size limit to a ConfigMap. The data stored in a ConfigMap cannot exceed 1 MiB. In case your OpenAPI document exceeds this size limit, it is recommended to split your API into smaller sub-APIs for easy management. For details, please consult [Best Practices for Describing Large APIs](https://learn.openapis.org/best-practices.html#describing-large-apis) from the OpenAPI initiative.
+</Note>
+
+
+
+<Note>
+**Notes**
+
+If you prefer to create ConfigMap with a manifest using `kubectl apply` command, you may get an error that the annotation metadata cannot exceed 256KB. It is because by using `kubectl apply`, `kubectl` automatically saves the whole configuration in the annotation [kubectl.kubernetes.io/last-applied-configuration](https://kubernetes.io/docs/reference/labels-annotations-taints/#kubectl-kubernetes-io-last-applied-configuration) for tracking changes. Your Tyk OAS API Definition may easily exceed the size limit of annotations (256KB). Therefore, `kubectl create` is used here to get around the problem.
+</Note>
+
+
+#### Create a TykOasApiDefinition Custom Resource
+
+Now, create a `TykOasApiDefinition` resource to tell the Tyk Operator to use the Tyk OAS API definition stored in the ConfigMap.
+
+Create a manifest file named `tyk-oas-api-definition.yaml` with the following content:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: petstore
+spec:
+  tykOAS:
+    configmapRef:
+      name: tyk-oas-api-config   # Metadata name of the ConfigMap resource that stores the Tyk OAS API Definition
+      namespace: tyk             # Metadata namespace of the ConfigMap resource
+      keyName: oas-api-definition.json # Key for retrieving Tyk OAS API Definition from the ConfigMap
+```
+
+#### Apply the TykOasApiDefinition Manifest
+
+Use `kubectl` to apply the `TykOasApiDefinition` manifest to your cluster:
+
+```sh
+kubectl apply -f tyk-oas-api-definition.yaml
+```
+
+This command creates a new `TykOasApiDefinition` resource in your cluster. The Tyk Operator will watch for this resource and configures Tyk Gateway or Tyk Dashboard with a new API using the provided Tyk OAS API definition.
+
+#### Verify the Tyk OAS API Creation
+
+To verify that the API has been successfully created, check the status of the TykOasApiDefinition resource:
+
+```sh
+kubectl get tykoasapidefinition petstore
+```
+
+You should see the status of the resource, which will indicate if the API creation was successful.
+
+```bash
+NAME       DOMAIN   LISTENPATH   PROXY.TARGETURL                  ENABLED   SYNCSTATUS   INGRESSTEMPLATE
+petstore            /petstore/   https://petstore.swagger.io/v2   true      Successful
+```
+
+#### Test the Tyk OAS API
+After the Tyk OAS API has been successfully created, you can test it by sending a request to the API endpoint defined in your OAS file.
+
+For example, if your API endpoint is `/store/inventory"`, you can use `curl` or any API client to test it:
+
+```sh
+curl "TYK_GATEWAY_URL/petstore/store/inventory"
+```
+
+Replace TYK_GATEWAY_URL with a URL of Tyk Gateway.
+
+#### Manage and Update the Tyk OAS API
+To make any changes to your API configuration, update the OAS file in your ConfigMap and then re-apply the ConfigMap using `kubectl replace`:
+
+```sh
+kubectl create configmap tyk-oas-api-config --from-file=oas-api-definition.json -n tyk --dry-run=client -o yaml | kubectl replace -f -
+```
+
+The Tyk Operator will automatically detect the change and update the API in the Tyk Gateway.
+
+
+<Note>
+**Notes**
+
+`kubectl replace` without `--save-config` option is used here instead of `kubectl apply` because we do not want to save the Tyk OAS API definition in its annotation. If you want to enable `--save-config` option or use `kubectl apply`, the Tyk OAS API definition size would be further limited to at most 262144 bytes.
+</Note>
+
+
+#### Tyk OAS API Example
+This example shows the minimum resources and fields required to define a Tyk OAS API using Tyk Operator. 
+
+```yaml{hl_lines=["7-7", "41-44"],linenos=true}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm
+  namespace: default
+data:
+  test_oas.json: |-
+    {
+        "info": {
+          "title": "Petstore",
+          "version": "1.0.0"
+        },
+        "openapi": "3.0.3",
+        "components": {},
+        "paths": {},
+        "x-tyk-api-gateway": {
+          "info": {
+            "name": "Petstore",
+            "state": {
+              "active": true
+            }
+          },
+          "upstream": {
+            "url": "https://petstore.swagger.io/v2"
+          },
+          "server": {
+            "listenPath": {
+              "value": "/petstore/",
+              "strip": true
+            }
+          }
+        }
+      }
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: petstore
+spec:
+  tykOAS:
+    configmapRef:
+      name: cm
+      namespace: default
+      keyName: test_oas.json
+```
+
+Here, a `ConfigMap` is created that contains the Tyk OAS API Definition with the `data` field with key `test_oas.json`. This is linked to from a `TykOasApiDefinition` resource via `spec.tykOAS.configmapRef`.
+
+To apply it, simply save the manifest into a file (e.g., `tyk-oas-api.yaml`) and use `kubectl apply -f tyk-oas-api.yaml` to create the required resources in your Kubernetes cluster. This command will create the necessary ConfigMap and TykOasApiDefinition resources in the `default` namespace.
+
+
+
+### Secure your Tyk OAS API
+#### Update your Tyk OAS API Definition
+
+First, you'll modify your existing Tyk OAS API Definition to include the API key authentication configuration.
+
+When creating the Tyk OAS API, you stored your OAS definition in a file named `oas-api-definition.json` and created a ConfigMap named `tyk-oas-api-config` in the `tyk` namespace.
+
+Modify your Tyk OAS API Definition `oas-api-definition.json` as follow. 
+
+```json {hl_lines=["8-14","16-20","33-40"],linenos=true}
+{
+  "info": {
+    "title": "Petstore protected",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "components": {
+    "securitySchemes": {
+      "petstore_auth": {
+        "type": "apiKey",
+        "name": "Authorization",
+        "in": "header"
+      }
+    }
+  },
+  "security": [
+    {
+      "petstore_auth": []
+    }
+  ],
+  "paths": {},
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "Petstore",
+      "state": {
+        "active": true
+      }
+    },
+    "upstream": {
+      "url": "https://petstore.swagger.io/v2"
+    },
+    "server": {
+      "authentication": {
+        "enabled": true,
+        "securitySchemes": {
+          "petstore_auth": {
+            "enabled": true
+          }
+        }
+      },
+      "listenPath": {
+        "value": "/petstore/",
+        "strip": true
+      }
+    }
+  }
+}
+```
+
+In this example, we added the following sections to configure key authentication for this API. 
+
+- `components.securitySchemes` defines the authentication method (in this case, `apiKey` in the header).
+- `security`: Applies the authentication globally to all endpoints.
+- `x-tyk-api-gateway.server.authentication`: Tyk-specific extension to enable the authentication scheme.
+
+You can configure your API for any Tyk supported authentication method by following the [Client Authentication](/api-management/client-authentication) documentation.
+
+Save your updated API definition in the same file, `oas-api-definition.json`.
+
+#### Update the ConfigMap with the new Tyk OAS API Definition
+
+Update the existing ConfigMap that contains your Tyk OAS API Definition with the following command:
+
+```sh
+kubectl create configmap tyk-oas-api-config --from-file=oas-api-definition.json -n tyk --dry-run=client -o yaml | kubectl replace -f -
+```
+
+This command updates the existing ConfigMap named `tyk-oas-api-config` in the `tyk` namespace (replace `tyk` with your actual namespace if different) with the new Tyk OAS API Definition stored in `oas-api-definition.json`.
+
+Since a `TykOasApiDefinition` resource has been created with reference to this ConfigMap in the previous tutorial:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykOasApiDefinition
+metadata:
+  name: petstore
+spec:
+  tykOAS:
+    configmapRef:
+      name: tyk-oas-api-config   # Metadata name of the ConfigMap resource that stores the Tyk OAS API Definition
+      namespace: tyk             # Metadata namespace of the ConfigMap resource
+      keyName: oas-api-definition.json # Key for retrieving Tyk OAS API Definition from the ConfigMap
+```
+
+Any changes in the ConfigMap would be detected by Tyk Operator. Tyk Operator will then automatically reconcile the changes and update the API configuration at Tyk.
+
+#### Verify the changes
+
+Verify that the `TykOasApiDefinition` has been updated successfully:
+
+```sh
+kubectl get tykoasapidefinition petstore -o yaml
+```
+
+Look for the `latestTransaction` field in `status`:
+
+```yaml
+status:
+  latestTransaction:
+    status: Successful
+    time: "2024-09-16T11:48:20Z"
+```
+
+The **Successful** status shows that Tyk Operator has reconciled the API with Tyk successfully. The last update time is shown in the `time` field.
+
+#### Test the API Endpoint
+Now, test your API endpoint to confirm that it requires an API key.
+
+For example, if your API endpoint is `/store/inventory"`, you can use `curl` or any API client to test it:
+
+```sh
+curl -v "TYK_GATEWAY_URL/petstore/store/inventory"
+```
+
+Replace TYK_GATEWAY_URL with a URL of Tyk Gateway.
+
+Request should fail with a `401 Unauthorized` response now as an API key is required for access. Your API has been secured by Tyk Gateway.
+
+## Set Up Tyk Classic API
+
+### Create a Tyk Classic API
+First, specify the details of your API using the [ApiDefinition CRD](/api-management/automations/operator#apidefinition-crd), then deploy it to create the corresponding Kubernetes resource. Tyk Operator will take control of the CRD and create the actual API in the Tyk data plane.
+
+#### Create an ApiDefinition resource in YAML format
+Create a file called `httpbin.yaml`, then add the following:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+ name: httpbin
+spec:
+ name: httpbin
+ use_keyless: true
+ protocol: http
+ active: true
+ proxy:
+   target_url: http://httpbin.org
+   listen_path: /httpbin
+   strip_listen_path: true
+```
+
+You can also use other sample files from the following pages:
+
+- [HTTP Proxy example](/tyk-stack/tyk-operator/create-an-api#set-up-manifest-for-http)
+- [TCP Proxy example](#set-up-manifest-for-tcp)
+- [GraphQL Proxy example](#set-up-manifest-for-graphql)
+- [UDG example](#set-up-manifest-for-udg)
+
+#### Deploy the ApiDefinition resource
+We are going to create an ApiDefinition from the httpbin.yaml file, by running the  following command:
+
+```console
+$ kubectl apply -f httpbin.yaml
+```
+
+Or, if you don’t have the manifest with you, you can run the following command:
+
+```yaml
+cat <<EOF | kubectl apply -f -
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+    name: httpbin
+spec:
+    name: httpbin
+    use_keyless: true
+    protocol: http
+    active: true
+    proxy:
+        target_url: http://httpbin.org
+        listen_path: /httpbin
+        strip_listen_path: true
+EOF
+```
+
+The ApiDefinition resource is created. You can verify by the following command:
+
+```console
+$ kubectl get tykapis
+NAME      DOMAIN   LISTENPATH   PROXY.TARGETURL      ENABLED
+httpbin            /httpbin     http://httpbin.org   true
+```
+
+You can make a request to verify that your API is working:
+
+```bash
+$ curl -i localhost:8080/httpbin/get
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Accept-Encoding": "gzip",
+    "Host": "httpbin.org",
+    "User-Agent": "curl/7.77.0",
+    "X-Amzn-Trace-Id": "Root=1-62161e8c-2a1ece436633f2e42129be2a"
+  },
+  "origin": "127.0.0.1, 176.88.45.17",
+  "url": "http://httpbin.org/get"
+}
+```
+
+#### Understanding the ApiDefinition CRD
+
+We have an ApiDefinition called `httpbin`, as specified in `spec.name` field, which listens to path `/httpbin` and proxies requests to [http://httpbin.org](http://httpbin.org), as specified under `spec.proxy` field. Now, any requests coming to the `/httpbin` endpoint will be proxied to the target URL that we defined in `spec.proxy.target_url`, which is [http://httpbin.org](http://httpbin.org) in our example.
+
+You can visit the [ApiDefinition CRD](/api-management/automations/operator#apidefinition-crd) page to see all the latest API Definitions fields and features we support.
+
+#### Configure Kubernetes service as an upstream target
+
+Tyk Gateway deployed in your Kubernetes cluster can easily access other Kubernetes services as an upstream proxy target.
+In the ApiDefinition manifest, set the `proxy.target_url` as a Kubernetes Service following [DNS for Services and Pods guideline](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/), so that the requests will be proxied to your service.
+In general, Kubernetes Services have a `<service-name>.<namespace-name>`.svc.cluster.local DNS entry once they are created.
+For example, if you have a service called `httpbin` in `default` namespace, you can contact `httpbin` service with `httpbin.default.svc` DNS record in the cluster, instead of IP addresses.
+Please visit the official [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/) for more details.
+Suppose you want to create a Deployment of [httpbin](https://hub.docker.com/r/kennethreitz/httpbin/) service using [ci/upstreams/httpbin.yaml](https://github.com/TykTechnologies/tyk-operator/blob/master/ci/upstreams/httpbin.yaml) file. You are going to expose the application through port `8000` as described under the Service [specification](https://github.com/TykTechnologies/tyk-operator/blob/master/ci/upstreams/httpbin.yaml#L10).
+You can create Service and Deployment by either applying the manifest defined in our repository:
+
+```console
+$ kubectl apply -f ci/upstreams/httpbin.yaml
+```
+
+Or, if you don’t have the manifest with you, you can run the following command:
+
+```yaml
+cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: Service
+metadata:
+  name: httpbin
+  labels:
+    app: httpbin
+spec:
+  ports:
+    - name: http
+      port: 8000
+      targetPort: 80
+  selector:
+    app: httpbin
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: httpbin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: httpbin
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: httpbin
+        version: v1
+    spec:
+      containers:
+        - image: docker.io/kennethreitz/httpbin
+          imagePullPolicy: IfNotPresent
+          name: httpbin
+          ports:
+            - containerPort: 80
+EOF
+```
+
+You need to wait until all pods reach READY `1/1` and STATUS `Running` state.
+Once the pod is ready, you can update your `httpbin` API's `target_url` field to proxy your requests to the Service that you created above.
+You can check all services in the `<ns>` namespace as follows:
+
+```console
+$ kubectl get service -n <ns>
+```
+
+You can update your `httpbin` as follows:
+
+```yaml
+cat <<EOF | kubectl apply -f -
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.default.svc:8000
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+Pay attention to the value of the `spec.proxy.target_url` field.
+It is set to `http://httpbin.default.svc:8000` by following the convention described above (`<service_name>.<namespace>.svc:<service_port>`).
+Now, if you send your request to the `/httpbin` endpoint of the Tyk Gateway, the request will be proxied to the `httpbin Service`:
+
+```curl
+curl -sS http://localhost:8080/httpbin/headers
+{
+  "headers": {
+    "Accept": "*/*", 
+    "Accept-Encoding": "gzip", 
+    "Host": "httpbin.default.svc:8000", 
+    "User-Agent": "curl/7.68.0"
+  }
+}
+```
+
+As you can see from the response, the host that your request should be proxied to is `httpbin.default.svc:8000`.
+
+### Secure your Classic API
+#### Update your API to Require a Key
+
+You might already have realized that our `httpbin` API is keyless. If you check the APIDefinition's specification, the `use_keyless` field is set to `true`.
+Tyk keyless access represents completely open access for your API and causes Tyk to bypass any session-based middleware (middleware that requires access to token-related metadata). Keyless access will enable all requests through.
+You can disable keyless access by setting `use_keyless` to false. 
+
+1. Update your `httpbin.yaml` file
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: false
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+2. Apply the changes
+
+```bash
+kubectl apply -f httpbin.yaml
+```
+
+Or, if you don’t have the manifest with you, you can run the following command:
+
+```yaml
+cat <<EOF | kubectl apply -f -
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+    name: httpbin
+spec:
+    name: httpbin
+    use_keyless: false
+    protocol: http
+    active: true
+    proxy:
+        target_url: http://httpbin.org
+        listen_path: /httpbin
+        strip_listen_path: true
+EOF
+```
+
+If you have set `use_keyless` to false, the default authentication mode is Authentication token.
+
+Now, to access `httpbin` API, you need to include a key to the header. Otherwise, you will get a `HTTP 401 Unauthorized` response.
+
+
+```curl
+curl -i localhost:8080/httpbin/get
+HTTP/1.1 401 Unauthorized
+Content-Type: application/json
+X-Generator: tyk.io
+Date: Thu, 03 Mar 2022 15:47:30 GMT
+Content-Length: 46
+
+{
+    "error": "Authorization field missing"
+}
+```
+
+
+<Note>
+Tyk Operator supported authentication types are listed in the [API Definition features](/api-management/automations/operator#apidefinition-crd) section.
+</Note>
+
+
+#### Create an API key
+
+You need to generate a key to access the `httpbin` API now. Follow [this guide](/getting-started/configure-first-api#create-an-api-key) to see how to create an API key for your installation. 
+
+You can obtain the API name and API ID of our example `httpbin` API by following command:
+
+```yaml
+kubectl describe tykapis httpbin
+Name:         httpbin
+Namespace:    default
+Labels:       <none>
+Annotations:  <none>
+API Version:  tyk.tyk.io/v1alpha1
+Kind:         ApiDefinition
+Metadata:
+  ...
+Spec:
+  ...
+  Name: httpbin
+  ...
+Status:
+  api_id:  ZGVmYXVsdC9odHRwYmlu
+Events:    <none>
+```
+
+You can obtain the API name and API ID from `name` and `status.api_id` field.
+
+In our example, it is as follows:
+
+- API-NAME: httpbin
+- API-ID: ZGVmYXVsdC9odHRwYmlu
+
+When you have successfully created a key, you can use it to access the `httpbin` API.
+
+```curl
+curl -H "Authorization: Bearer {Key ID}" localhost:8080/httpbin/get
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Accept-Encoding": "gzip",
+    "Authorization": "Bearer {Key ID}",
+    "Host": "httpbin.org",
+    "User-Agent": "curl/7.77.0",
+    "X-Amzn-Trace-Id": "Root=1-6221de2a-01aa10dd56f6f13f420ba313"
+  },
+  "origin": "127.0.0.1, 176.42.143.200",
+  "url": "http://httpbin.org/get"
+}
+```
+Since you have provided a valid key along with your request, you do not get a `HTTP 401 Unauthorized` response.
+
+
+### Set Up Tyk Classic API Authentication
+Client to Gateway Authentication in Tyk ensures secure communication between clients and the Tyk Gateway. Tyk supports various authentication methods to authenticate and authorize clients before they can access your APIs. These methods include API keys, Static Bearer Tokens, JWT, mTLS, Basic Authentication, and more. This document provides example manifests for each authentication method supported by Tyk.
+
+#### Keyless (Open)
+
+This configuration allows [keyless (open)](/basic-config-and-security/security/authentication-authorization/open-keyless) access to the API without any authentication.
+
+```yaml {hl_lines=["7-7"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-keyless
+spec:
+  name: httpbin-keyless
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+#### Auth Token
+
+This setup requires an [auth token](/api-management/authentication/bearer-token) for access.
+
+In the below example, the authentication token is set by default to the `Authorization` header of the request. You can customize this behavior by configuring the following fields:
+
+- `use_cookie`: Set to true to use a cookie value for the token.
+- `cookie_name`: Specify the name of the cookie if use_cookie is enabled.
+- `use_param`: Set to true to allow the token to be passed as a query parameter.
+- `param_name`: Specify the parameter name if use_param is enabled.
+- `use_certificate`: Enable client certificate. This allows you to create dynamic keys based on certificates.
+- `validate_signature`: Enable [signature validation](/api-management/authentication/bearer-token#auth-token-with-signature).
+
+```yaml {hl_lines=["13-35"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-auth-token
+spec:
+  name: httpbin-auth-token
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+  use_standard_auth: true
+  auth_configs:
+    authToken:
+      # Auth Key Header Name
+      auth_header_name: Authorization
+      # Use cookie value
+      use_cookie: false
+      # Cookie name
+      cookie_name: ""
+      # Allow query parameter as well as header
+      use_param: false
+      # Parameter name
+      param_name: ""
+      # Enable client certificate
+      use_certificate: false
+      # Enable Signature validation
+      validate_signature: false
+      signature:
+        algorithm: ""
+        header: ""
+        secret: ""
+        allowed_clock_skew: 0
+        error_code: 0
+```
+
+#### JWT
+
+This configuration uses [JWT tokens](/basic-config-and-security/security/authentication-authorization/json-web-tokens) for authentication.
+
+Users can configure JWT authentication by defining the following fields:
+
+- `jwt_signing_method`: Specify the method used to sign the JWT. Refer to the documentation on [JWT Signatures](/basic-config-and-security/security/authentication-authorization/json-web-tokens) for supported methods.
+- `jwt_source`: Specify the public key used for verifying the JWT.
+- `jwt_identity_base_field`: Define the identity source, typically set to `sub` (subject), which uniquely identifies the user or entity.
+- `jwt_policy_field_name`: Specify the claim within the JWT payload that indicates the policy ID to apply.
+- `jwt_default_policies` (Optional): Define default policies to apply if no policy claim is found in the JWT payload.
+
+The following example configures an API to use JWT authentication. It specifies the ECDSA signing method and public key, sets the `sub` claim as the identity source, uses the `pol` claim for policy ID, and assigns a default policy (`jwt-policy` SecurityPolicy in `default` namespace) if no policy is specified in the token.
+
+```yaml {hl_lines=["13-22"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-jwt1
+spec:
+  name: httpbin-jwt1
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin-jwt1
+    strip_listen_path: true
+  enable_jwt: true
+  strip_auth_data: true
+  jwt_signing_method: ecdsa
+  # ecdsa pvt: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ2V2WnpMMWdkQUZyODhoYjIKT0YvMk54QXBKQ3pHQ0VEZGZTcDZWUU8zMGh5aFJBTkNBQVFSV3oram42NUJ0T012ZHlIS2N2akJlQlNEWkgycgoxUlR3am1ZU2k5Ui96cEJudVE0RWlNbkNxZk1QV2lacUI0UWRiQWQwRTdvSDUwVnB1WjFQMDg3RwotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
+  # ecdsa pub: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFRVZzL281K3VRYlRqTDNjaHluTDR3WGdVZzJSOQpxOVVVOEk1bUVvdlVmODZRWjdrT0JJakp3cW56RDFvbWFnZUVIV3dIZEJPNkIrZEZhYm1kVDlQT3hnPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0t
+  jwt_source: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFRVZzL281K3VRYlRqTDNjaHluTDR3WGdVZzJSOQpxOVVVOEk1bUVvdlVmODZRWjdrT0JJakp3cW56RDFvbWFnZUVIV3dIZEJPNkIrZEZhYm1kVDlQT3hnPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0t
+  jwt_identity_base_field: sub
+  jwt_policy_field_name: pol
+  jwt_default_policies:
+    - default/jwt-policy
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: jwt-policy
+spec:
+  access_rights_array:
+    - name: httpbin-jwt1
+      namespace: default
+      versions:
+        - Default
+  active: true
+  name: jwt-policy
+  state: active
+```
+
+You can verify the API is properly authenticated with following command:
+
+1. JWT with default policy
+```bash
+curl http://localhost:8080/httpbin-jwt1/get -H 'Authorization: Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0IiwiaWF0IjoxNTE2MjM5MDIyfQ.rgPyrCJYs2im7zG6im5XUqsf_oAf_Kqk-F6IlLb3yzZCSZvrQObhBnkLKgfmVTbhQ5El7Q6KskXPal5-eZFuTQ'
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Accept-Encoding": "gzip",
+    "Host": "httpbin.org",
+    "Traceparent": "00-d2b93d763ca27f29181c8e508b5ac0c9-a446afa3bd053617-01",
+    "User-Agent": "curl/8.6.0",
+    "X-Amzn-Trace-Id": "Root=1-6696f0bf-1d9e532c6a2eb3a709e7086b"
+  },
+  "origin": "127.0.0.1, 178.128.43.98",
+  "url": "http://httpbin.org/get"
+}
+```
+
+2. JWT with explicit policy
+```bash
+curl http://localhost:8080/httpbin-jwt1/get -H 'Authorization: Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0IiwiaWF0IjoxNTE2MjM5MDIyLCJwb2wiOiJaR1ZtWVhWc2RDOXFkM1F0Y0c5c2FXTjUifQ.7nY9TvYgsAZqIHLhJdUPqZtzqU_5T-dcNtCt4zt8YPyUj893Z_NopL6Q8PlF8TlMdxUq1Ff8rt4-p8gVboIqlA'
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Accept-Encoding": "gzip",
+    "Host": "httpbin.org",
+    "Traceparent": "00-002adf6632ec20377cb7ccf6c3037e78-3c4cb97c70d790cb-01",
+    "User-Agent": "curl/8.6.0",
+    "X-Amzn-Trace-Id": "Root=1-6696f1dd-7f9de5f947c8c73279f7cca6"
+  },
+  "origin": "127.0.0.1, 178.128.43.98",
+  "url": "http://httpbin.org/get"
+}
+```
+
+#### Basic Authentication
+
+This configuration uses [Basic Authentication](/api-management/authentication/basic-authentication), requiring a username and password for access.
+
+```yaml {hl_lines=["13-13"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-basic-auth
+spec:
+  name: Httpbin Basic Authentication
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+  use_basic_auth: true
+```
+
+#### Custom Plugin Auth (go)
+
+This configuration uses a [Golang plugin](/api-management/plugins/golang#) for custom authentication. The following example shows how to create an API definition with a Golang custom plugin for `httpbin-go-auth`.
+
+For an example of Golang authentication middleware, see [Performing custom authentication with a Golang plugin](/api-management/plugins/golang#performing-custom-authentication-with-a-golang-plugin).
+
+```yaml {hl_lines=["7-7", "14-21"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-go-auth
+spec:
+  name: httpbin-go-auth
+  use_go_plugin_auth: true # Turn on GO auth
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+  custom_middleware:
+    driver: goplugin
+    pre:
+      - name: "AddFooBarHeader"
+        path: "/mnt/tyk-gateway/example-go-plugin.so"
+    auth_check:
+        name: "MyPluginCustomAuthCheck"
+        path: "/mnt/tyk-gateway/example-go-plugin.so"
+```
+
+#### Custom Plugin Auth (gRPC)
+
+This configuration uses a [gRPC plugin](/api-management/plugins/golang#) for custom authentication. The following example shows how to create an API definition with a gRPC custom plugin for `httpbin-grpc-auth`.
+
+For a detailed walkthrough on setting up Tyk with gRPC authentication plugins, refer to [Extending Tyk with gRPC Authentication Plugins](https://tyk.io/blog/how-to-setup-custom-authentication-middleware-using-grpc-and-java/).
+
+```yaml {hl_lines=["9-9", "14-26"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-grpc-auth
+spec:
+  name: httpbin-grpc-auth
+  protocol: http
+  active: true
+  enable_coprocess_auth: true
+  proxy:
+    target_url: http://httpbin.default.svc:8000
+    listen_path: /httpbin-grpc-auth
+    strip_listen_path: true
+  custom_middleware:
+    driver: grpc
+    post_key_auth:
+      - name: "HelloFromPostKeyAuth"
+        path: ""
+    auth_check:
+      name: foo
+      path: ""
+    id_extractor:
+      extract_from: header
+      extract_with: value
+      extractor_config:
+        header_name: Authorization
+```
+
+#### Multiple (Chained) Auth
+
+This setup allows for [multiple authentication](/basic-config-and-security/security/authentication-authorization/multiple-auth) methods to be chained together, requiring clients to pass through each specified authentication provider.
+
+To enable multiple (chained) auth, you should set `base_identity_provided_by` field to one of the supported chained enums. Consult the [Multi (Chained) Authentication](/basic-config-and-security/security/authentication-authorization/multiple-auth) section for the supported auths.
+
+In this example, we are creating an API definition with basic authentication and mTLS with basic authentication as base identity for `httpbin-multiple-authentications`.
+
+```yaml {hl_lines=["19-21"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-multiple-authentications
+spec:
+  name: Httpbin Multiple Authentications
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+  base_identity_provided_by: basic_auth_user
+  use_basic_auth: true
+  use_mutual_tls_auth: true
+```
+
+#### IP Allowlist
+
+To enable [IP Allowlist](/api-management/gateway-config-tyk-classic#ip-access-control), set the following fields:
+
+* `enable_ip_whitelisting`: Enables IPs allowlist. When set to `true`, only requests coming from the explicit list of IP addresses defined in (`allowed_ips`) are allowed through.
+* `allowed_ips`: A list of strings that defines the IP addresses (in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation) notation) that are allowed access via Tyk.
+
+In this example, only requests coming from 127.0.0.2 is allowed.
+
+```yaml {hl_lines=["10-12"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  enable_ip_whitelisting: true
+  allowed_ips:
+    - 127.0.0.2
+  proxy:
+    target_url: http://httpbin.default.svc:8000
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+#### IP Blocklist
+
+To enable [IP Blocklist](/api-management/gateway-config-tyk-classic#ip-access-control), set the following fields:
+
+* `enable_ip_blacklisting`: Enables IPs blocklist. If set to `true`, requests coming from the explicit list of IP addresses (blacklisted_ips) are not allowed through.
+* `blacklisted_ips`: A list of strings that defines the IP addresses (in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation) notation) that are blocked access via Tyk. This list is explicit and wildcards are currently not supported. 
+
+In this example, requests coming from 127.0.0.2 will be forbidden (`403`).
+
+```yaml {hl_lines=["10-12"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  enable_ip_blacklisting: true
+  blacklisted_ips:
+    - 127.0.0.2
+  proxy:
+    target_url: http://httpbin.default.svc:8000
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+
+### Set Up Manifest for GraphQL
+In the example below we can see that the configuration is contained within the `graphql` configuration object. A GraphQL schema is specified within the `schema` field and the execution mode is set to `proxyOnly`. The [GraphQL public playground](/api-management/graphql#enabling-public-graphql-playground) is enabled with the path set to `/playground`.
+
+```yaml {hl_lines=["15-17", "18-92"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: trevorblades
+spec:
+  name: trevorblades
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: https://countries.trevorblades.com
+    listen_path: /trevorblades
+    strip_listen_path: true
+  graphql:
+    enabled: true
+    version: "2"
+    execution_mode: proxyOnly
+    schema: |
+      directive @cacheControl(maxAge: Int, scope: CacheControlScope) on FIELD_DEFINITION | OBJECT | INTERFACE
+
+      enum CacheControlScope {
+        PUBLIC
+        PRIVATE
+      }
+
+      type Continent {
+        code: ID!
+        name: String!
+        countries: [Country!]!
+      }
+
+      input ContinentFilterInput {
+        code: StringQueryOperatorInput
+      }
+
+      type Country {
+        code: ID!
+        name: String!
+        native: String!
+        phone: String!
+        continent: Continent!
+        capital: String
+        currency: String
+        languages: [Language!]!
+        emoji: String!
+        emojiU: String!
+        states: [State!]!
+      }
+
+      input CountryFilterInput {
+        code: StringQueryOperatorInput
+        currency: StringQueryOperatorInput
+        continent: StringQueryOperatorInput
+      }
+
+      type Language {
+        code: ID!
+        name: String
+        native: String
+        rtl: Boolean!
+      }
+
+      input LanguageFilterInput {
+        code: StringQueryOperatorInput
+      }
+
+      type Query {
+        continents(filter: ContinentFilterInput): [Continent!]!
+        continent(code: ID!): Continent
+        countries(filter: CountryFilterInput): [Country!]!
+        country(code: ID!): Country
+        languages(filter: LanguageFilterInput): [Language!]!
+        language(code: ID!): Language
+      }
+
+      type State {
+        code: String
+        name: String!
+        country: Country!
+      }
+
+      input StringQueryOperatorInput {
+        eq: String
+        ne: String
+        in: [String]
+        nin: [String]
+        regex: String
+        glob: String
+      }
+
+      """The `Upload` scalar type represents a file upload."""
+      scalar Upload
+    playground:
+      enabled: true
+      path: /playground
+```
+
+### Set Up Manifest for HTTP
+#### HTTP Proxy
+
+This example creates a basic API definition that routes requests to listen path `/httpbin` to target URL `http://httpbin.org`.
+
+Traffic routing can be configured under `spec.proxy`:
+- `target_url` defines the upstream address (or target URL) to which requests should be proxied.
+- `listen_path` is the base path on Tyk to which requests for this API should be sent. Tyk listens out for any requests coming into the host at this path, on the port that Tyk is configured to run on and processes these accordingly. For example, `/api/` or `/` or `/httpbin/`.
+- `strip_listen_path` removes the inbound listen path (as accessed by the client) when generating the outbound request for the upstream service. For example, consider the scenario where the Tyk base address is `http://acme.com/`, the listen path is `example/` and the upstream URL is `http://httpbin.org/`: If the client application sends a request to `http://acme.com/example/get` then the request will be proxied to `http://httpbin.org/example/get`
+
+```yaml {hl_lines=["10-13"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+#### HTTP Host-based Proxy
+
+`spec.domain` is the domain to bind this API to. This enforces domain matching for client requests.
+
+In this example, requests to `httpbin.tyk.io` will be proxied to upstream URL `http://httpbin.org`
+
+```yaml {hl_lines=["10-10"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  protocol: http
+  active: true
+  domain: httpbin.tyk.io
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /
+    strip_listen_path: true
+```
+
+#### HTTPS Proxy
+
+This example creates a API definition that routes requests to a http://httpbin.org via port 8443.
+
+```yaml {hl_lines=["35-38"],linenos=false}
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: selfsigned-issuer
+spec:
+  selfSigned: { }
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: my-test-cert
+spec:
+  secretName: my-test-tls
+  dnsNames:
+    - foo.com
+    - bar.com
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: selfsigned-issuer
+    # We can reference ClusterIssuers by changing the kind here.
+    # The default value is Issuer (i.e. a locally namespaced Issuer)
+    kind: Issuer
+    # This is optional since cert-manager will default to this value however
+    # if you are using an external issuer, change this to that issuer group.
+    group: cert-manager.io
+---
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin
+spec:
+  name: httpbin
+  use_keyless: true
+  protocol: https
+  listen_port: 8443
+  certificate_secret_names:
+    - my-test-tls
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+#### Load Balancing
+
+Tyk Operator supports round-robin load balancing via the `ApiDefinition` CRD. Enable it with `proxy.enable_load_balancing` and list the upstream targets in `proxy.target_list`.
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: httpbin-load-balanced
+spec:
+  name: httpbin-load-balanced
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    enable_load_balancing: true
+    target_list:
+      - "http://10.0.0.1"
+      - "http://10.0.0.2"
+      - "http://10.0.0.3"
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+### Set Up Manifest for TCP
+
+This example creates a API definition that proxies request from TCP port `6380` to `tcp://localhost:6379`.
+
+```yaml {hl_lines=["8-11"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: redis-tcp
+spec:
+  name: redis-tcp
+  active: true
+  protocol: tcp
+  listen_port: 6380
+  proxy:
+    target_url: tcp://localhost:6379
+```
+
+### Set Up Manifest for UDG
+#### UDG v2 (Tyk 3.2 and above)
+
+If you are on Tyk 3.2 and above, you can use the following manifest to create an UDG API. This example configures a Universal Data Graph from a [GraphQL datasource](/api-management/data-graph#graphql) and a [REST Datasource](/api-management/data-graph#rest).
+
+```yaml {hl_lines=["20-39", "46-80"],linenos=false}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: udg
+spec:
+  name: Universal Data Graph v2a
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: ""
+    listen_path: /udg
+    strip_listen_path: true
+  version_data:
+    default_version: Default
+    not_versioned: true
+    versions:
+      Default:
+        name: Default
+  graphql:
+    enabled: true
+    execution_mode: executionEngine
+    schema: |
+      type Country {
+        name: String
+        code: String
+        restCountry: RestCountry
+      }
+
+      type Query {
+        countries: [Country]
+      }
+
+      type RestCountry {
+        altSpellings: [String]
+        subregion: String
+        population: Int
+      }
+    version: "2"
+    last_schema_update: "2022-10-12T14:27:55.511+03:00"
+    type_field_configurations: []
+    playground:
+      enabled: true
+      path: /playground
+    engine:
+      field_configs:
+        - disable_default_mapping: false
+          field_name: countries
+          path:
+            - "countries"
+          type_name: Query
+        - disable_default_mapping: true #very important for rest APIs
+          field_name: restCountry
+          path: []
+          type_name: Country
+      data_sources:
+        - kind: "GraphQL"
+          name: "countries"
+          internal: false
+          root_fields:
+            - type: Query
+              fields:
+                - "countries"
+          config:
+            url: "https://countries.trevorblades.com/"
+            method: "POST"
+            headers: {}
+            body: ""
+        - kind: "REST"
+          internal: false
+          name: "restCountries"
+          root_fields:
+            - type: "Country"
+              fields:
+                - "restCountry"
+          config:
+            url: "https://restcountries.com/v2/alpha/{{ .object.code }}"
+            method: "GET"
+            body: ""
+            headers: {}
+```
+
+#### UDG v1 (Tyk 3.1 or before)
+
+If you are on Tyk 3.1, you can use the following manifest to create an UDG API. This example creates a Universal Data Graph with GraphQL datasource and HTTP JSON datasource.
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: udg
+spec:
+  name: Universal Data Graph Example
+  use_keyless: true
+  protocol: http
+  active: true
+  proxy:
+    target_url: ""
+    listen_path: /udg
+    strip_listen_path: true
+  graphql:
+    enabled: true
+    execution_mode: executionEngine
+    schema: |
+      type Country {
+        name: String
+        code: String
+        restCountry: RestCountry
+      }
+
+      type Query {
+        countries: [Country]
+      }
+
+      type RestCountry {
+        altSpellings: [String]
+        subregion: String
+        population: String
+      }
+    type_field_configurations:
+      - type_name: Query
+        field_name: countries
+        mapping:
+          disabled: false
+          path: countries
+        data_source:
+          kind: GraphQLDataSource
+          data_source_config:
+            url: "https://countries.trevorblades.com"
+            method: POST
+            status_code_type_name_mappings: []
+      - type_name: Country
+        field_name: restCountry
+        mapping:
+          disabled: true
+          path: ""
+        data_source:
+          kind: HTTPJSONDataSource
+          data_source_config:
+            url: "https://restcountries.com/v2/alpha/{{ .object.code }}"
+            method: GET
+            default_type_name: RestCountry
+            status_code_type_name_mappings:
+              - status_code: 200
+    playground:
+      enabled: true
+      path: /playground
+```
+
+## Set Up Tyk Streams API
+Tyk Streams integrates natively with Tyk OpenAPI Specification (OAS), allowing you to manage APIs as code and automate processes in Kubernetes using Tyk Operator. Setting up Tyk Streams API is similar to configuring a standard Tyk OAS API. You can store the Tyk Streams OAS definition in a Kubernetes ConfigMap and connect it to Tyk Gateway through a `TykStreamsApiDefinition` resource.
+
+### Create your Tyk Streams API
+#### Prepare the Tyk Streams API Definition
+To create a Tyk Streams API, start by preparing a complete Tyk Streams API definition in the OpenAPI Specification (OAS) format. This file must include:
+
+- The `x-tyk-api-gateway` extension for Tyk-specific settings.
+- The `x-tyk-streaming` extension for Tyk Streams configuration.
+
+Here’s an example of a Tyk Streams API definition:
+
+```json {hl_lines=["17-54"],linenos=true}
+{
+  "info": {
+    "title": "Simple streaming demo",
+    "version": "1.0.0"
+  },
+  "openapi": "3.0.3",
+  "servers": [
+    {
+      "url": "http://tyk-gw.local/streams/"
+    }
+  ],
+  "security": [],
+  "paths": {},
+  "components": {
+    "securitySchemes": {}
+  },
+  "x-tyk-streaming": {
+    "streams": {
+      "example-publisher": {
+        "input": {
+          "http_server": {
+            "allowed_verbs": [
+              "POST"
+            ],
+            "path": "/pub",
+            "timeout": "1s"
+          }
+        },
+        "output": {
+          "http_server": {
+            "ws_path": "/ws"
+          }
+        }
+      }
+    }
+  },
+  "x-tyk-api-gateway": {
+    "info": {
+      "name": "Simple streaming demo",
+      "state": {
+        "active": true,
+        "internal": false
+      }
+    },
+    "server": {
+      "listenPath": {
+        "strip": true,
+        "value": "/streams/"
+      }
+    },
+    "upstream": {
+      "url": "https://not-needed"
+    }
+  }
+}
+```
+
+#### Create a TykStreamsApiDefinition Custom Resource
+Once your Tyk Streams API definition is ready, use a Kubernetes ConfigMap to store the definition and link it to a `TykStreamsApiDefinition` custom resource.
+
+Example manifest:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: TykStreamsApiDefinition
+metadata:
+  name: simple-stream
+spec:
+  tykStreams:
+    configmapRef:
+      name: simple-stream-cm            #k8s resource name of configmap
+      namespace: default                #The k8s namespace of the resource being targeted. If Namespace is not provided,
+                                        #we assume that the ConfigMap is in the same namespace as TykStreamsApiDefinition resource.
+      keyName: test_stream.json
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: simple-stream-cm
+data:
+  test_stream.json: |-
+    {
+      "components": {},
+      "info": {
+        "title": "Simple streaming demo",
+        "version": "1.0.0"
+      },
+      "openapi": "3.0.3",
+      "paths": {},
+      "x-tyk-api-gateway": {
+        "info": {
+          "name": "Simple streaming demo",
+          "state": {
+            "active": true
+          }
+        },
+        "server": {
+          "detailedTracing": {
+            "enabled": true
+          },
+          "listenPath": {
+            "strip": true,
+            "value": "/streams/"
+          }
+        },
+        "upstream": {
+          "url": "https://not-needed"
+        }
+      },
+      "x-tyk-streaming": {
+        "streams": {
+          "example-publisher": {
+            "input": {
+              "http_server": {
+                "path": "/pub",
+                "allowed_verbs": ["POST"],
+                "timeout": "1s"
+              }
+            },
+            "output": {
+              "http_server": {
+                "ws_path": "/ws"
+              }
+            }
+          }
+        }
+      }
+    }
+```
+
+#### Apply the TykStreamsApiDefinition Manifest
+
+Use the `kubectl` command to apply the `TykStreamsApiDefinition` manifest to your Kubernetes cluster:
+
+```sh
+kubectl apply -f tyk-streams-api-definition.yaml
+```
+
+This will create a new `TykStreamsApiDefinition` resource. The Tyk Operator watches this resource and configures the Tyk Gateway or Tyk Dashboard with the new API.
+
+#### Verify the Tyk Streams API Creation
+
+Check the status of the `TykStreamsApiDefinition` resource to ensure that the API has been successfully created:
+
+```sh
+kubectl get tykstreamsapidefinitions simple-stream
+```
+
+You should see output similar to this:
+
+```bash
+NAME            DOMAIN   LISTENPATH   ENABLED   SYNCSTATUS
+simple-stream            /streams/    true      Successful
+```
+
+#### Manage and Update the Tyk Streams API
+To update your API configuration, modify the linked `ConfigMap`. The Tyk Operator will automatically detect changes and update the API in the Tyk Gateway.
+
+### Secure your Tyk Streams API
+To secure your Tyk Streams API, configure security fields in the OAS definition just as you would for a standard Tyk OAS API. For more details, refer to the [Secure your Tyk OAS API](#secure-your-tyk-oas-api) guide.
+
+## Add a Security Policy to your API
+To further protect access to your APIs, you will want to add a security policy. 
+Below, we take you through how to define the security policy but you can also find [Security Policy Example](/tyk-stack/tyk-operator/create-an-api#security-policy-example) below.
+
+### Define the Security Policy manifest
+
+To create a security policy, you must define a Kubernetes manifest using the `SecurityPolicy` CRD. The following example illustrates how to configure a default policy for trial users for a Tyk Classic API named `httpbin`, a Tyk OAS API named `petstore`, and a Tyk Streams API named `http-to-kafka`.
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: trial-policy                    # Unique Kubernetes name
+spec:
+  name: Default policy for trial users  # Descriptive name for the policy
+  state: active
+  active: true
+  access_rights_array:
+    - name: httpbin                     # Kubernetes name of referenced API
+      namespace: default                # Kubernetes namespace of referenced API
+      kind: ApiDefinition               # Omit this field or use `ApiDefinition` if you are referencing Tyk Classic API
+      versions:
+        - Default                       # The default version of Tyk Classic API is "Default"
+    - name: petstore
+      namespace: default
+      kind: TykOasApiDefinition         # Use `TykOasApiDefinition` if you are referencing Tyk OAS API
+      versions:
+        - ""                            # The default version of Tyk OAS API is ""
+    - name: http-to-kafka
+      namespace: default
+      kind: TykStreamsApiDefinition         # Use `TykStreamsApiDefinition` if you are referencing Tyk Streams API
+      versions:
+        - ""                            # The default version of Tyk Streams API is ""
+  quota_max: 1000
+  quota_renewal_rate: 3600
+  rate: 120
+  per: 60
+  throttle_interval: -1
+  throttle_retry_limit: -1
+```
+
+Save the manifest locally in a file, e.g. `trial-policy.yaml`
+
+In this example, we have defined a security policy as described below:
+
+**Define Security Policy status and metadata**
+
+  - **`name`**: A descriptive name for the security policy.
+  - **`active`**: Marks the policy as active (true or false).
+  - **`state`**: The current state of the policy. It can have one of three values:
+    - **`active`**: Keys connected to this policy are enabled and new keys can be created.
+    - **`draft`**: Keys connected to this policy are disabled; no new keys can be created.
+    - **`deny`**: Policy is not published to Gateway; no keys can be created.
+  - **`tags`**: A list of tags to categorize or label the security policy, e.g.
+
+    ```yaml
+    tags:
+      - Hello
+      - World
+    ```
+
+  - **`meta_data`**: Key-value pairs for additional metadata related to the policy, e.g.
+
+    ```yaml
+    meta_data:
+      key: value
+      hello: world
+    ```
+
+**Define Access Lists for APIs**
+
+  - **`access_rights_array`**: Defines the list of APIs that the security policy applies to and the versions of those APIs.
+    - **`name`**: The Kubernetes metadata name of the API resource to which the policy grants access.
+    - **`namespace`**: The Kubernetes namespace where the API resource is deployed.
+    - **`kind`**: Tyk OAS APIs (`TykOasApiDefinition`), Tyk Streams (`TykStreamsApiDefinition`) and Tyk Classic APIs (`ApiDefinition`) can be referenced here. The API format can be specified by `kind` field. If omitted, `ApiDefinition` is assumed.
+    - **`versions`**: Specifies the API versions the policy will cover. If the API is not versioned, include the default version here. The default version of a Classic API is "Default". The default version of a Tyk OAS API is "".
+
+In this example, the security policy will apply to an `ApiDefinition` resource named `httpbin` in the `default` namespace, a `TykOasApiDefinition` resource named `petstore` in the `default` namespace, and a `TykStreamsApiDefinition` resource named `http-to-kafka` in the `default` namespace. Note that you do not need to specify the API ID; Tyk Operator will automatically retrieve the API ID of referenced API Definition resources for you.
+
+**Define Rate Limits, Usage Quota, and Throttling**
+
+- **`rate`**: The maximum number of requests allowed per time period (Set to `-1` to disable).
+- **`per`**: The time period (in seconds) for the rate limit (Set to `-1` to disable).
+- **`throttle_interval`**: The interval (in seconds) between each request retry  (Set to `-1` to disable).
+- **`throttle_retry_limit`**: The maximum number of retry attempts allowed  (Set to `-1` to disable).
+- **`quota_max`**: The maximum number of requests allowed over a quota period (Set to `-1` to disable).
+- **`quota_renewal_rate`**: The time, in seconds, after which the quota is renewed.
+
+In this example, trial users under this security policy can gain access to the `httpbin` API at a rate limit of maximum 120 times per 60 seconds (`"rate": 120, "per": 60`), with a usage quota of 1000 every hour (`"quota_max": 1000, "quota_renewal_rate": 3600`), without any request throttling (`throttle_interval: -1, throttle_retry_limit: -1`).
+
+### Apply the Security Policy manifest
+Once you have defined your security policy manifest, apply it to your Kubernetes cluster using the `kubectl apply` command:
+
+```bash
+kubectl apply -f trial-policy.yaml
+```
+
+### Verify the Security Policy
+
+After applying the manifest, you can verify that the security policy has been created successfully by running:
+
+```bash
+kubectl describe securitypolicy trial-policy
+
+...
+Status:
+  Latest CRD Spec Hash:  901732141095659136
+  Latest Tyk Spec Hash:  5475428707334545086
+  linked_apis:
+    Kind:       ApiDefinition
+    Name:       httpbin
+    Namespace:  default
+    Kind:       TykOasApiDefinition
+    Name:       petstore
+    Namespace:  default
+    Kind:       TykStreamsApiDefinition
+    Name:       http-to-kafka
+    Namespace:  default
+  pol_id:       66e9a27bfdd3040001af6246
+Events:         <none>
+```
+
+From the `status` field, you can see that this security policy has been linked to `httpbin`, `petstore`, and `http-to-kafka` APIs.
+
+
+### Security policy example
+<a id="security-policy-example"></a>
+
+#### Key-level per-API rate limits and quota
+
+By configuring per-API limits, you can set specific rate limits, quotas, and throttling rules for each API in the access rights array. When these per-API settings are enabled, the API inherits the global limit settings unless specific limits and quotas are set in the `limit` field for that API.
+
+The following manifest defines a security policy with per-API rate limits and quotas for two APIs: `httpbin` and `petstore`.
+
+```yaml {hl_lines=["15-21", "27-33", "40-41"],linenos=true}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: policy-per-api-limits
+spec:
+  name: Policy with Per API Limits
+  state: active
+  active: true
+  access_rights_array:
+    - name: httpbin                     # Kubernetes name of referenced API
+      namespace: default                # Kubernetes namespace of referenced API
+      kind: ApiDefinition               # `ApiDefinition` (Default), `TykOasApiDefinition` or `TykStreamsApiDefinition`
+      versions:
+        - Default                       # The default version of Tyk Classic API is "Default"
+      limit:                            # APILimit stores quota and rate limit on ACL level
+        rate: 10                        # Max 10 requests per 60 seconds
+        per: 60                         # Time period for rate limit
+        quota_max: 100                  # Max 100 requests allowed over the quota period
+        quota_renewal_rate: 3600        # Quota renewal period in seconds (1 hour)
+        throttle_interval: -1           # No throttling between retries
+        throttle_retry_limit: -1        # No limit on request retries
+    - name: petstore
+      namespace: default
+      kind: TykOasApiDefinition         # Use `TykOasApiDefinition` for Tyk OAS API
+      versions:
+        - ""                            # The default version of Tyk OAS API is ""
+      limit:
+        rate: 5                         # Max 5 requests per 60 seconds
+        per: 60                         # Time period for rate limit
+        quota_max: 100                  # Max 100 requests allowed over the quota period
+        quota_renewal_rate: 3600        # Quota renewal period in seconds (1 hour)
+        throttle_interval: -1           # No throttling between retries
+        throttle_retry_limit: -1        # No limit on request retries
+  rate: -1                              # Disable global rate limit
+  per: -1                               # Disable global rate limit period
+  throttle_interval: -1                 # Disable global throttling
+  throttle_retry_limit: -1              # Disable global retry limit
+  quota_max: -1                         # Disable global quota
+  quota_renewal_rate: 60                # Quota renewal rate in seconds (1 minute)
+```
+
+With this security policy applied:
+
+For the `httpbin` API:
+- The rate limit allows a maximum of 10 requests per 60 seconds.
+- The quota allows a maximum of 100 requests per hour (3600 seconds).
+- There is no throttling or retry limit (throttle_interval and throttle_retry_limit are set to -1).
+
+For the `petstore` API:
+- The rate limit allows a maximum of 5 requests per 60 seconds.
+- The quota allows a maximum of 100 requests per hour (3600 seconds).
+- There is no throttling or retry limit (throttle_interval and throttle_retry_limit are set to -1).
+
+Global Rate Limits and Quota:
+- All global limits (rate, quota, and throttling) are disabled (-1), so they do not apply.
+
+By setting per-API rate limits and quotas, you gain granular control over how each API is accessed and used, allowing you to apply different limits for different APIs as needed. This configuration is particularly useful when you want to ensure that critical APIs have stricter controls while allowing more flexibility for others. Use this example as a guideline to tailor your security policies to your specific requirements.
+
+#### Key-level per-endpoint rate limits
+
+By configuring key-level per-endpoint limits, you can restrict the request rate for specific API clients to a specific endpoint of an API.
+
+The following manifest defines a security policy with per-endpoint rate limits for two APIs: `httpbin` and `petstore`.
+
+```yaml {hl_lines=["15-29", "35-49"],linenos=true}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: policy-per-api-limits
+spec:
+  name: Policy with Per API Limits
+  state: active
+  active: true
+  access_rights_array:
+    - name: httpbin                     # Kubernetes name of referenced API
+      namespace: default                # Kubernetes namespace of referenced API
+      kind: ApiDefinition               # `ApiDefinition` (Default), `TykOasApiDefinition` or `TykStreamsApiDefinition`
+      versions:
+        - Default                       # The default version of Tyk Classic API is "Default"
+      endpoints:                        # Per-endpoint rate limits
+        - path: /anything
+          methods:
+            - name: POST
+              limit:
+                rate: 5
+                per: 60
+            - name: PUT
+              limit:
+                rate: 5
+                per: 60
+            - name: GET
+              limit:
+                rate: 10
+                per: 60
+    - name: petstore
+      namespace: default
+      kind: TykOasApiDefinition         # Use `TykOasApiDefinition` for Tyk OAS API
+      versions:
+        - ""                            # The default version of Tyk OAS API is ""
+      endpoints:                        # Per-endpoint rate limits
+        - path: /pet
+          methods:
+            - name: POST
+              limit:
+                rate: 5
+                per: 60
+            - name: PUT
+              limit:
+                rate: 5
+                per: 60
+            - name: GET
+              limit:
+                rate: 10
+                per: 60
+  rate: -1                              # Disable global rate limit
+  per: -1                               # Disable global rate limit period
+  throttle_interval: -1                 # Disable global throttling
+  throttle_retry_limit: -1              # Disable global retry limit
+  quota_max: -1                         # Disable global quota
+  quota_renewal_rate: 60                # Quota renewal rate in seconds (1 minute)
+```
+
+#### Path based permissions
+<a id="path-based-permissions"></a>
+
+You can secure your APIs by specifying [allowed URLs](/api-management/access-control/sessions-and-keys/access-rights#granular-endpoint-access) (methods and paths) for each API within a security policy. This is done using the `allowed_urls` field under `access_rights_array`.
+
+The following manifest defines a security policy that allows access only to specific URLs and HTTP methods for two APIs: `httpbin`(a Tyk Classic API) and `petstore` (a Tyk OAS API).
+
+```yaml {hl_lines=["15-18", "24-28"],linenos=true}
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: policy-with-allowed-urls
+spec:
+  name: Policy with allowed URLs
+  state: active
+  active: true
+  access_rights_array:
+    - name: httpbin                     # Kubernetes name of referenced API
+      namespace: default                # Kubernetes namespace of referenced API
+      kind: ApiDefinition               # `ApiDefinition` (Default), `TykOasApiDefinition` or `TykStreamsApiDefinition`
+      versions:
+        - Default                       # The default version of Tyk Classic API is "Default"
+      allowed_urls:                     # Define allowed paths and methods
+        - url: /get                     # Only allow access to the "/get" path
+          methods:
+            - GET                       # Only allow the GET method
+    - name: petstore
+      namespace: default
+      kind: TykOasApiDefinition         # Use `TykOasApiDefinition` for Tyk OAS API
+      versions:
+        - ""                            # The default version of Tyk OAS API is ""
+      allowed_urls:                     # Define allowed paths and methods
+        - url: "/pet/(.*)"              # Allow access to any path starting with "/pet/"
+          methods:
+            - GET                       # Allow GET method
+            - POST                      # Allow POST method
+```
+
+With this security policy applied:
+
+- Allowed access:
+    - `curl -H "Authorization: Bearer $KEY_AUTH" http://tyk-gw.org/petstore/pet/10` returns a `200 OK` response.
+    - `curl -H "Authorization: Bearer $KEY_AUTH" http://tyk-gw.org/httpbin/get` returns a `200 OK` response.
+
+- Restricted access:
+    - `curl -H "Authorization: Bearer $KEY_AUTH" http://tyk-gw.org/petstore/pet` returns a `403 Forbidden` response with the message:
+        
+    ```json
+        { "error": "Access to this resource has been disallowed" }
+    ```
+
+    - `curl -H "Authorization: Bearer $KEY_AUTH" http://tyk-gw.org/httpbin/anything` returns a `403 Forbidden` response with the message:
+
+    ```json
+        { "error": "Access to this resource has been disallowed" }
+    ```
+
+#### Partitioned policies
+<a id="partitioned-policies"></a>
+
+[Partitioned policies](/api-management/access-control/policies/applying-policies#partitioned-policies) allow you to selectively enforce different segments of a security policy, such as quota, rate limiting, access control lists (ACL), and GraphQL complexity rules. This provides flexibility in applying different security controls as needed.
+
+To configure a partitioned policy, set the segments you want to enable in the `partitions` field:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: partitioned-policy-example
+spec:
+  name: Partitioned Policy Example
+  state: active
+  active: true
+  access_rights_array:
+    - name: httpbin                     # Kubernetes name of referenced API
+      namespace: default                # Kubernetes namespace of referenced API
+      kind: ApiDefinition               # `ApiDefinition` (Default), `TykOasApiDefinition` or `TykStreamsApiDefinition`
+      versions:
+        - Default                       # The default version of Tyk Classic API is "Default"
+    - name: petstore
+      namespace: default
+      kind: TykOasApiDefinition         # Use `TykOasApiDefinition` if you are referencing Tyk OAS API
+      versions:
+        - ""                            # The default version of Tyk OAS API is ""
+  partitions:
+    quota: false                        # Do not enforce quota rules
+    rate_limit: false                   # Do not enforce rate limiting rules
+    acl: true                           # Enforce access control rules
+    complexity: false                   # Do not enforce GraphQL complexity rules
+```
+
+- **`quota`**: Set to true to enforce quota rules (limits the number of requests allowed over a period).
+- **`rate_limit`**: Set to true to enforce rate limiting rules (limits the number of requests per second or minute).
+- **`acl`**: Set to true to enforce access control rules (controls which APIs or paths can be accessed).
+- **`complexity`**: Set to true to enforce GraphQL complexity rules (limits the complexity of GraphQL queries to prevent resource exhaustion).
+
+
+
+## Migrate Existing APIs to Tyk Operator 
+
+If you have existing APIs and Policies running on your Tyk platform, and you want to start using Tyk Operator to manage them, you probably would not want to re-create the APIs and Policies on the platform using Operator CRDs. It is because you will lose keys, policies, and analytics linked to the APIs. You can instead link existing APIs and Policies to a CRD by specifying the API ID or Policy ID in the CRD spec. This way, Operator will update the existing API or Policy according to the CRD spec. Any keys, policies and analytics linked to the API will continue to operate the same. This is great for idempotency.
+
+### Export existing configurations to CRDs
+
+Instead of creating the API and Policy CRDs from scratch, you can try exporting them from Dashboard using a snapshot tool. You can find the detail usage guide [here](https://github.com/TykTechnologies/tyk-operator/blob/master/pkg/snapshot/README.md). This is great if you want to have a quick start. However, this is still a PoC feature so we recommend you to double check the output files before applying them to your cluster.
+
+### Migration of existing API
+
+If there are existing APIs that you want to link to a CRD, it's very easy to do so. You need to simply add the `api_id` from your API Definition to the YAML of your `ApiDefinition` type. Then, the Operator will take care of the rest.
+
+Example:
+
+1. From the existing API Definition, grab the following field:
+
+```json
+"api_id": "5e0fac4845bb46c77543be28300fd9d7"
+```
+
+2. Simply add this value to your YAML, in the `spec.api_id`field:
+
+```yaml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: ApiDefinition
+metadata:
+  name: my-existing-api
+spec:
+  api_id: 5e0fac4845bb46c77543be28300fd9d7
+  name: existing API
+  protocol: http
+  active: true
+  proxy:
+    target_url: http://httpbin.org
+    listen_path: /httpbin
+    strip_listen_path: true
+```
+
+3. Then apply your changes:
+
+```console
+$ kubectl apply -f config/samples/httpbin_protected.yaml
+apidefinition.tyk.tyk.io/my-existing-api created
+```
+
+
+<Note>
+The source of truth for the API definition is now the CRD, meaning it will override any differences in your existing API definition.
+</Note>
+
+
+### Migration of existing Policy
+If you have existing pre-Operator policies, you can easily link them to a CRD, which will allow you to modify them through the YAML moving forward.
+Simply set the id field in the SecurityPolicy YAML to the _id field in the existing Policy's JSON. This will allow the Operator to make the link.
+Note that the YAML becomes the source of truth and will overwrite any changes between it and the existing Policy.
+
+**Example**:
+1. Find out your existing Policy ID, e.g. `5f8f3933f56e1a5ffe2cd58c`
+
+2. Stick the policy ID `5f8f3933f56e1a5ffe2cd58c` into the YAML's `spec.id` field like below
+
+```yaml
+my-security-policy.yaml:
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: new-httpbin-policy
+spec:
+  id: 5f8f3933f56e1a5ffe2cd58c
+  name: My New HttpBin Policy
+  state: active
+  active: true
+  access_rights_array:
+    - name: new-httpbin-api # name of your ApiDefinition object.
+      namespace: default    # namespace of your ApiDefinition object.
+      versions:
+        - Default
+```
+
+The `spec.access_rights_array` field of the YAML must refer to the ApiDefinition object that the policy identified by the id will affect.
+
+To find available ApiDefinition objects:
+
+```console
+$ kubectl get tykapis -A
+NAMESPACE   NAME               DOMAIN   LISTENPATH   PROXY.TARGETURL      ENABLED
+default     new-httpbin-api             /httpbin     http://httpbin.org   true
+```
+
+3. And then apply this file:
+
+```console
+$ kubectl apply -f my-security-policy.yaml
+securitypolicy.tyk.tyk.io/new-httpbin-policy created
+```
+
+Now the changes in the YAML were applied to the existing Policy. You can now manage this policy through the CRD moving forward.
+Note, if this resource is unintentionally deleted, the Operator will recreate it with the same `id` field as above, allowing keys to continue to work as before the delete event.
+
+### Idempotency
+
+Because of the ability to declaratively define the `api_id`, this gives us the ability to preserve Keys that are tied to APIs or policies which are tied to APIs.
+Imagine any use case where you have keys tied to policies, and policies tied to APIs.
+Now imagine that these resources are unintentionally destroyed. Our database goes down, or our cluster, or something else.
+Well, using the Tyk Operator, we can easily re-generate all our resources in a non-destructive fashion. That's because the operator intelligently constructs the unique ID using the unique namespaced name of our CRD resources. For that reason.
+Alternatively, if you don't explicitly state it, it will be hard-coded for you by Base64 encoding the namespaced name of the CRD.
+
+For example:
+
+1. we have keys tied to policies tied to APIs in production.
+2. Our production DB gets destroyed, all our Policies and APIs are wiped
+3. The Tyk Operator can resync all the changes from our CRDs into a new environment, by explicitly defining the Policy IDs and API IDs as before.
+4. This allows keys to continue to work normally as Tyk resources are generated idempotently through the Operator.
+
+
diff --git a/tyk-stack/tyk-operator/installing-tyk-operator.mdx b/tyk-stack/tyk-operator/installing-tyk-operator.mdx
new file mode 100644
index 0000000000..bdfa80a57b
--- /dev/null
+++ b/tyk-stack/tyk-operator/installing-tyk-operator.mdx
@@ -0,0 +1,319 @@
+---
+title: "Install Tyk Operator"
+description: "Learn how to install Tyk Operator on Kubernetes to manage your Tyk API configurations"
+keywords: "Tyk Operator, Kubernetes, API Management"
+sidebarTitle: "Installation"
+---
+
+## Introduction
+
+We assume you have already installed Tyk. If you don’t have it, check out [Tyk
+Cloud](/tyk-cloud#quick-start-tyk-cloud) or [Tyk Self
+Managed](/tyk-self-managed) page. [Tyk Helm
+Chart](/product-stack/tyk-charts/overview) is the preferred (and easiest) way to install Tyk on Kubernetes.
+
+In order for policy ID matching to work correctly, Dashboard must have `allow_explicit_policy_id` and
+`enable_duplicate_slugs` set to `true` and Gateway must have `policies.allow_explicit_policy_id` set to `true`.
+
+Tyk Operator needs a [user credential](/api-management/automations/operator#operator-user) to connect with
+Tyk Dashboard. The Operator user should have write access to the resources it is going to manage, e.g. APIs, Certificates,
+Policies, and Portal. It is the recommended practice to turn off write access for other users for the above resources. See
+[Using Tyk Operator to enable GitOps with Tyk](/api-management/automations) about
+maintaining a single source of truth for your API configurations.
+
+## Install cert-manager
+
+Tyk Operator uses cert-manager to provision certificates for the webhook server. If you don't have cert-manager
+installed, you can follow this command to install it:
+
+Alternatively, you have the option to manually handle TLS certificates by disabling the `cert-manager` requirement. For more details, please refer to this [configuration](#webhook-configuration).
+
+```console
+$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.8.0/cert-manager.yaml
+```
+
+Since Tyk Operator supports Kubernetes v1.19+, the minimum cert-manager version you can use is v1.8. If you run into the
+cert-manager related errors, please ensure that the desired version of Kubernetes version works with the chosen version
+of cert-manager by checking [supported releases page](https://cert-manager.io/docs/installation/supported-releases/) and
+[cert-manager documentation](https://cert-manager.io/docs/installation/supported-releases/).
+
+Please wait for the cert-manager to become available before continuing with the next step.
+
+## Option 1: Install Tyk Operator via Tyk's Umbrella Helm Charts
+
+If you are using [Tyk Stack](/product-stack/tyk-charts/tyk-stack-chart), [Tyk Control
+Plane](/product-stack/tyk-charts/tyk-control-plane-chart), or [Tyk Open
+Source Chart](/product-stack/tyk-charts/tyk-oss-chart), you can install Tyk Operator alongside other Tyk
+components by setting value `global.components.operator` to `true`.
+
+Starting from Tyk Operator v1.0, a license key is required to use the Tyk Operator. You can provide it while installing
+Tyk Stack, Tyk Control Plane or Tyk OSS helm chart by setting `global.license.operator` field. You can also set license
+key via a Kubernetes secret using `global.secrets.useSecretName` field. The secret should contain a key called
+`OperatorLicense`
+
+Note: If you are using `global.secrets.useSecretName`, you must configure the operator license in the referenced Kubernetes secret. `global.license.operator` will not be used in this case.
+
+## Option 2: Install Tyk Operator via stand-alone Helm Chart
+
+If you prefer to install Tyk Operator separately, follow this section to install Tyk Operator using Helm.
+
+### Configure Tyk Operator via environment variable or tyk-operator-conf secret
+
+Tyk Operator configurations can be set using `envVars` field of helm chart. See the table below for a list of expected
+environment variable names and example values.
+
+```yaml
+envVars:
+  - name: TYK_OPERATOR_LICENSEKEY
+    value: "{YOUR_LICENSE_KEY}"
+  - name: TYK_MODE
+    value: "pro"
+  - name: TYK_URL
+    value: "http://dashboard-svc-tyk-tyk-dashboard.tyk.svc:3000"
+  - name: TYK_AUTH
+    value: "2d095c2155774fe36d77e5cbe3ac963b"
+  - name: TYK_ORG
+    value: "5e9d9544a1dcd60001d0ed20"
+```
+
+It can also be set via a Kubernetes secret. The default K8s secret name is `tyk-operator-conf`. If you want to use
+another name, configure it through Helm Chart [envFrom](#install-tyk-operator-and-custom-resource-definitions-crds) value.
+
+The Kubernetes secret or envVars field should set the following keys:
+
+<Tabs>
+
+<Tab title="Licensed mode (Self-managed or Tyk Cloud)">
+
+| Key                          | Mandatory | Example Value                                       | Description                                                                                                                  |
+| :--------------------------- | :-------- | :-------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------- |
+| TYK_OPERATOR_LICENSEKEY      | Yes       | `<JWT_ENCODED_LICENSE_KEY>`                           | Tyk Operator license key                                                                                                     |
+| TYK_MODE                     | Yes       | pro                                                 | “ce” for Tyk Open Source mode, “pro” for Tyk licensed mode.                                                                  |
+| TYK_URL                      | Yes       | http://dashboard-svc-tyk-tyk-dashboard.tyk.svc:3000 | Management URL of Tyk Gateway (Open Source) or Tyk Dashboard                                                                 |
+| TYK_AUTH                     | Yes       | 2d095c2155774fe36d77e5cbe3ac963b                    | Operator user API key.                                                                                                       |
+| TYK_ORG                      | Yes       | 5e9d9544a1dcd60001d0ed20                            | Operator user ORG ID.                                                                                                        |
+| TYK_TLS_INSECURE_SKIP_VERIFY | No        | true                                                | Set to `“true”` if the Tyk URL is HTTPS and has a self-signed certificate. If it isn't set, the default value is `false`.    |
+| WATCH_NAMESPACE              | No        | foo,bar                                             | Comma separated list of namespaces for Operator to operate on. The default is to operate on all namespaces if not specified. |
+| WATCH_INGRESS_CLASS          | No        | customclass                                         | Define the ingress class Tyk Operator should watch. Default is `tyk`                                                         |
+| TYK_HTTPS_INGRESS_PORT       | No        | 8443                                                | Define the ListenPort for HTTPS ingress. Default is `8443`.                                                                  |
+| TYK_HTTP_INGRESS_PORT        | No        | 8080                                                | Define the ListenPort for HTTP ingress. Default is `8080`.                                                                   |
+
+</Tab>
+
+<Tab title="Open Source">
+
+**Note**: From Tyk Operator v1.0, although Tyk Operator is compatible with the Open Source Tyk Gateway, a valid license
+key is required for running Tyk Operator.
+
+| Key                          | Mandatory | Example Value                                      | Description                                                                                                                  |
+| :--------------------------- | :-------- | :------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------- |
+| TYK_OPERATOR_LICENSEKEY      | Yes       | `<JWT_ENCODED_LICENSE_KEY>`                          | Tyk Operator license key                                                                                                     |
+| TYK_MODE                     | Yes       | ce                                                 | “ce” for Tyk Open Source mode, “pro” for Tyk licensed mode.                                                                  |
+| TYK_URL                      | Yes       | http://gateway-svc-tyk-ce-tyk-gateway.tyk.svc:8080 | Management URL of Tyk Gateway (Open Source) or Tyk Dashboard                                                                 |
+| TYK_AUTH                     | Yes       | myapisecret                                        | Operator user API key.                                                                                                       |
+| TYK_ORG                      | Yes       | myorgid                                            | Operator user ORG ID.                                                                                                        |
+| TYK_TLS_INSECURE_SKIP_VERIFY | No        | true                                               | Set to `“true”` if the Tyk URL is HTTPS and has a self-signed certificate. If it isn't set, the default value is `false`.    |
+| WATCH_NAMESPACE              | No        | foo,bar                                            | Comma separated list of namespaces for Operator to operate on. The default is to operate on all namespaces if not specified. |
+| WATCH_INGRESS_CLASS          | No        | customclass                                        | Define the ingress class Tyk Operator should watch. Default is `tyk`                                                         |
+| TYK_HTTPS_INGRESS_PORT       | No        | 8443                                               | Define the ListenPort for HTTPS ingress. Default is `8443`.                                                                  |
+| TYK_HTTP_INGRESS_PORT        | No        | 8080                                               | Define the ListenPort for HTTP ingress. Default is `8080`.                                                                   |
+
+</Tab>
+
+</Tabs>
+
+**Connect to Tyk Gateway or Dashboard**
+
+If you install Tyk using Helm Chart, `tyk-operator-conf` will have been created with the following keys:
+`TYK_OPERATOR_LICENSEKEY, TYK_AUTH, TYK_MODE, TYK_ORG`, and `TYK_URL` by default. If you didn't use Helm Chart for
+installation, please prepare `tyk-operator-conf` secret yourself using the commands below:
+
+```console
+$ kubectl create namespace tyk-operator-system
+
+$ kubectl create secret -n tyk-operator-system generic tyk-operator-conf \
+  --from-literal "TYK_OPERATOR_LICENSEKEY=${TYK_OPERATOR_LICENSEKEY}" \
+  --from-literal "TYK_AUTH=${TYK_AUTH}" \
+  --from-literal "TYK_ORG=${TYK_ORG}" \
+  --from-literal "TYK_MODE=${TYK_MODE}" \
+  --from-literal "TYK_URL=${TYK_URL}"
+```
+
+
+<Note>
+User API key and Organization ID can be found under "Add / Edit User" page within Tyk Dashboard. `TYK_AUTH` corresponds
+to <b>Tyk Dashboard API Access Credentials</b>. `TYK_ORG` corresponds to <b>Organization ID</b>.
+</Note>
+
+
+
+<Note>
+If the credentials embedded in the `tyk-operator-conf` are ever changed or updated, the tyk-operator-controller-manager
+pod must be restarted to pick up these changes.
+</Note>
+
+
+**Watch Namespaces**
+
+Tyk Operator is installed with cluster permissions. However, you can optionally control which namespaces it watches by
+setting the `WATCH_NAMESPACE` through `tyk-operator-conf` secret or the environment variable to a comma separated list
+of k8s namespaces. For example:
+
+- `WATCH_NAMESPACE=""` will watch for resources across the entire cluster.
+- `WATCH_NAMESPACE="foo"` will watch for resources in the `foo` namespace.
+- `WATCH_NAMESPACE="foo,bar"` will watch for resources in the `foo` and `bar` namespace.
+
+**Watch custom ingress class**
+
+You can configure [Tyk Operator as Ingress Controller](/product-stack/tyk-operator/tyk-ingress-controller) so
+that [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) resources can be managed by Tyk as
+APIs. By default, Tyk Operator looks for the value `tyk` in Ingress resources `kubernetes.io/ingress.class` annotation
+and will ignore all other ingress classes. If you want to override this default behavior, you may do so by setting
+[WATCH_INGRESS_CLASS](#configure-tyk-operator-via-environment-variable-or-tyk-operator-conf-secret) through `tyk-operator-conf` or the environment variable.
+
+### Install Tyk Operator and Custom Resource Definitions (CRDs)
+
+You can install CRDs and Tyk Operator using the stand-alone Helm Chart by running the following command:
+
+```console
+$ helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
+$ helm repo update
+
+$ helm install tyk-operator tyk-helm/tyk-operator -n tyk-operator-system
+```
+
+This process will deploy Tyk Operator and its required Custom Resource Definitions (CRDs) into your Kubernetes cluster
+in `tyk-operator-system` namespace.
+
+**Helm configurations**
+
+
+<Note>
+Starting from Tyk Operator v1.2.0, `webhookPort` is deprecated in favor of `webhooks.port`.
+</Note>
+
+
+| Key                                         | Type   | Default                                |
+| :------------------------------------------- | :------ | :-------------------------------------- |
+| envFrom[0].secretRef.name                   | string | `"tyk-operator-conf"`                  |
+| envVars[0].name                             | string | `"TYK_OPERATOR_LICENSEKEY"`            |
+| envVars[0].value                            | string | `"{OPERATOR_LICENSEKEY}"`              |
+| envVars[1].name                             | string | `"TYK_HTTPS_INGRESS_PORT"`             |
+| envVars[1].value                            | string | `"8443"`                               |
+| envVars[2].name                             | string | `"TYK_HTTP_INGRESS_PORT"`              |
+| envVars[2].value                            | string | `"8080"`                               |
+| extraVolumeMounts                           | list   | `[]`                                   |
+| extraVolumes                                | list   | `[]`                                   |
+| fullnameOverride                            | string | `""`                                   |
+| healthProbePort                             | int    | `8081`                                 |
+| hostNetwork                                 | bool   | `false`                                |
+| image.pullPolicy                            | string | `"IfNotPresent"`                       |
+| image.repository                            | string | `"tykio/tyk-operator"`                 |
+| image.tag                                   | string | `"v1.0.0"`                             |
+| imagePullSecrets                            | list   | `[]`                                   |
+| metricsPort                                 | int    | `8080`                                 |
+| nameOverride                                | string | `""`                                   |
+| nodeSelector                                | object | `{}`                                   |
+| podAnnotations                              | object | `{}`                                   |
+| podSecurityContext.allowPrivilegeEscalation | bool   | `false`                                |
+| rbac.port                                   | int    | `8443`                                 |
+| rbac.resources                              | object | `{}`                                   |
+| replicaCount                                | int    | `1`                                    |
+| resources                                   | object | `{}`                                   |
+| serviceMonitor                              | bool   | `false`                                |
+| webhookPort                                 | int    | `9443`                                 |
+| webhooks.enabled                        | bool   | `true`                                 |
+| webhooks.port                           | int    | `9443`                                 |
+| webhooks.annotations                    | object | `{}`                                   |
+| webhooks.tls.useCertManager             | bool   | `true`                                 |
+| webhooks.tls.secretName                 | string | `webhook-server-cert`                  |
+| webhooks.tls.certificatesMountPath      | string | `/tmp/k8s-webhook-server/serving-certs`|
+
+## Production Deployment Guidelines
+
+For high availability and large-scale environments (e.g., 1000 to 2000+ APIs), we recommend the following best practices for deploying Tyk Operator:
+
+### Recommended Replicas
+We advise running exactly **2 replicas** of the Tyk Operator for High Availability. Tyk Operator uses an active-passive model with Kubernetes leader election, meaning only one pod (the leader) actively reconciles CRDs at any given time, while the other remains on standby. Scaling beyond 2 replicas does not increase throughput or distribute the workload; it only provides redundancy.
+
+### Scaling Strategy
+Because of the active-passive model, Horizontal Pod Autoscaling (HPA) will not improve reconciliation performance. For large environments, you must scale the Operator **vertically**. Monitor the leader pod's resource consumption during mass deployments and increase the CPU and Memory `requests` and `limits` as needed. The Operator caches resources in memory, so its memory footprint will increase as the number of CRDs grows.
+
+### Connection Management
+During bulk deployments of thousands of CRDs, the leader Operator pod can open a large number of TCP connections to the Tyk Dashboard. To prevent ephemeral port exhaustion on the node, we recommend deploying large batches of CRDs incrementally rather than all at once.
+
+## Upgrading Tyk Operator
+
+### Upgrading from v0.x to v1.0+
+
+Starting from Tyk Operator v1.0, a valid license key is required for the Tyk Operator to function. If Tyk Operator is
+upgraded from v0.x versions to one of v1.0+ versions, Tyk Operator needs a valid license key that needs to be provided
+during upgrade process. This section describes how to set Tyk Operator license key to make sure Tyk Operator continues
+functioning.
+
+To provide the license key for Tyk Operator, Kubernetes secret used to configure Tyk Operator (typically named
+tyk-operator-conf as described above) requires an additional field called `TYK_OPERATOR_LICENSEKEY`. Populate this field
+with your Tyk Operator license key.
+
+To configure the license key:
+
+1. Locate the Kubernetes Secret used to configure Tyk Operator (typically named `tyk-operator-conf`).
+2. Add a new field called `TYK_OPERATOR_LICENSEKEY` to this Secret.
+3. Set the value of `TYK_OPERATOR_LICENSEKEY` to your Tyk Operator license key.
+
+After updating the Kubernetes secret with this field, proceed with the standard upgrade process outlined below.
+
+### Upgrading Tyk Operator and CRDs
+
+You can upgrade Tyk Operator through Helm Chart by running the following command:
+
+```console
+$ helm upgrade -n tyk-operator-system tyk-operator tyk-helm/tyk-operator --wait
+```
+
+[Helm does not upgrade or delete CRDs](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#some-caveats-and-explanations)
+when performing an upgrade. Because of this restriction, an additional step is required when upgrading Tyk Operator with
+Helm.
+
+```console
+$ kubectl apply -f https://raw.githubusercontent.com/TykTechnologies/tyk-charts/refs/heads/main/tyk-operator-crds/crd-$TYK_OPERATOR_VERSION.yaml
+```
+
+
+<Note>
+Replace $TYK_OPERATOR_VERSION with the image tag corresponding to the Tyk Operator version to which
+the Custom Resource Definitions (CRDs) belong. For example, to install CRDs compatible with Tyk Operator v1.0.0, set $TYK_OPERATOR_VERSION to v1.0.0.
+</Note>
+
+
+
+## Uninstalling Tyk Operator
+
+To uninstall Tyk Operator, you need to run the following command:
+
+```console
+$ helm delete tyk-operator -n tyk-operator-system
+```
+
+## Webhook Configuration
+
+Starting from Operator v1.2.0 release, [Kubernetes Webhooks](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers) can now be configured using the Helm chart by specifying the necessary settings in the values.yaml file of the operator.
+Since webhooks are enabled by default, there will be no impact to existing users.
+
+```
+webhooks:
+  enabled: true
+  port: 9443
+  annotations: {}
+  tls:
+    useCertManager: true
+    secretName: webhook-server-cert
+    certificatesMountPath: "/tmp/k8s-webhook-server/serving-certs"
+```
+- `enabled`: Enables or disables webhooks.
+- `port`: Specifies the port for webhook communication.
+- `annotations`: Allows adding custom annotations.
+- `tls.useCertManager`: If true, Cert-Manager will handle TLS certificates.
+- `tls.secretName`: The name of the Kubernetes Secret storing the TLS certificate.
+- `tls.certificatesMountPath`: Path where the webhook server mounts its certificates.
+
diff --git a/tyk-stack/tyk-operator/publish-an-api.mdx b/tyk-stack/tyk-operator/publish-an-api.mdx
new file mode 100644
index 0000000000..e89e49876e
--- /dev/null
+++ b/tyk-stack/tyk-operator/publish-an-api.mdx
@@ -0,0 +1,141 @@
+---
+title: "Publish an API to Developer Portal with Tyk Operator"
+description: "Learn how to publish an API to the Tyk Developer Portal using Tyk Operator in Kubernetes, enabling third-party developers to access your APIs."
+keywords: "Tyk Operator, Developer Portal, API Management, Kubernetes"
+sidebarTitle: "Publish an API"
+---
+
+## Introduction
+
+For Tyk Self Managed or Tyk Cloud, you can set up a Developer Portal to expose a facade of your APIs and then allow third-party developers to register and use your APIs.
+You can make use of Tyk Operator CRDs to publish the APIs as part of your CI/CD workflow. If you have followed this Getting Started guide to create the httpbin example API, you can publish it to your Tyk Classic Developer Portal in a few steps.
+
+
+<Note>
+Currently Operator only supports publishing Tyk Classic API to the Tyk Classic Portal.
+</Note>
+
+
+## Publish an API with Tyk Operator
+
+### 1. Creating a security policy
+
+When you publish an API to the Portal, Tyk actually publishes a way for developers to enroll in a policy, not into the API directly. Therefore, you should first set up a security policy for the developers, before proceeding with the publishing.
+
+To do that, you can use the following command:
+
+```yml
+cat <<EOF | kubectl apply -f -
+apiVersion: tyk.tyk.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+ name: standard-pol
+spec:
+ name: standard-pol
+ active: true
+ state: active
+ access_rights_array:
+ - name: httpbin
+   namespace: default
+   versions:
+     - Default
+EOF
+```
+
+The above command will create a basic security policy and attribute it to the `httpbin` API that was previously created.
+
+### 2. Creating an API description
+
+The Tyk Classic Developer Portal enables you to host your API documentation in Swagger/OpenAPI or API Blueprint for developers to use. In the case of Swagger/OpenAPI, you can either paste your Swagger content (JSON or YAML) in the CRD, or via a link to a public Swagger hosted URL, which can then be rendered by using Swagger UI.
+
+Create a file called `apidesc.yaml`, then add the following;
+
+```yml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: APIDescription
+metadata:
+ name: standard-desc
+spec:
+ name: HTTPBIN API
+ policyRef:
+  name: standard-pol
+  namespace: default
+ docs:
+  doc_type: swagger_custom_url
+  documentation: "https://httpbin.org/spec.json"
+ show: true
+ version: v2
+```
+
+### 3. Apply the changes
+
+```console
+kubectl apply -f apidesc.yaml
+```
+Or, if you don’t have the manifest with you, you can run the following command:
+
+```yml
+cat <<EOF | kubectl apply -f -
+apiVersion: tyk.tyk.io/v1alpha1
+kind: APIDescription
+metadata:
+ name: standard-desc
+spec:
+ name: HTTPBIN API
+ policyRef:
+  name: standard-pol
+  namespace: default
+ docs:
+  doc_type: swagger_custom_url
+  documentation: "https://httpbin.org/spec.json"
+ show: true
+ version: v2
+EOF
+```
+
+### 4. Creating a PortalAPICatalog resource
+
+Unlike other platforms, Tyk will not auto-publish your APIs to the Portal, instead they are presented as a facade, you choose what APIs and what Policies to expose to the Portal. You can configure what APIs and what Policies to expose to the Portal via Tyk Operator by creating a PortalAPICatalog resource.
+
+Create a file called `api_portal.yaml`, then add the following:
+
+```yml
+apiVersion: tyk.tyk.io/v1alpha1
+kind: PortalAPICatalogue
+metadata:
+ name: test-httpbin-api
+spec:
+ apis:
+ - apiDescriptionRef:
+    name: standard-desc
+    namespace: default
+```
+
+You have added your API Descriptions under `apis`.
+
+### 5. Apply the changes
+
+```console
+kubectl apply -f api_portal.yaml
+```
+
+Now your new API and its documentation is loaded to the Developer Portal.
+
+**APIDescription CRD**
+
+Different types of documents are supported:
+
+Swagger Documents:
+
+- `doc_type: swagger`
+- `documentation`: Base64 encoded swagger doc
+
+Swagger Hosted URL:
+
+- `doc_type: swagger_custom_url`
+- `documentation`: The URL to the swagger documentation, for example *"https://httpbin.org/spec.json"*
+
+GraphQL:
+
+- `doc_type: graphql`
+
diff --git a/use-cases/open-banking.mdx b/use-cases/open-banking.mdx
new file mode 100644
index 0000000000..8d8e30f8e8
--- /dev/null
+++ b/use-cases/open-banking.mdx
@@ -0,0 +1,339 @@
+---
+title: "Tyk FAPI Accelerator for Open Banking"
+description: "Learn how Tyk API Gateway enables financial institutions to implement secure, standards-compliant Open Banking APIs with advanced features like DPoP authentication, event notifications, and idempotency support."
+keywords: "open banking, financial services, FAPI, OAuth 2.0, DPoP, event notifications, idempotency, JWS, security"
+sidebarTitle: "Open Banking"
+---
+
+## Introduction
+
+Open Banking is a financial services framework that enables secure data sharing between banks and third-party providers (TPPs) through standardized APIs. It fosters innovation, enhances customer experiences, and ensures compliance with regulatory requirements such as:
+- **Payment Services Directive 2 (PSD2)** ([PSD2](https://www.ecb.europa.eu/press/intro/mip-online/2018/html/1803_revisedpsd.en.html)) in the European Union, mandating secure access to account information and payment services.
+- **UK Open Banking** ([UK Open Banking](https://www.openbanking.org.uk/)), a UK initiative for standardized financial APIs.
+- **Consumer Data Right (CDR)** ([CDR](https://www.cdr.gov.au/)) in Australia, enabling consumer data sharing.
+- **Financial Data Exchange (FDX)** ([FDX](https://financialdataexchange.org/)) in the United States, an industry-led standard for data sharing.
+
+Open Banking is enabling the banking industry to move from closed ecosystems to open standards and collaborative platforms where customer data can be securely shared with authorized third parties. However, financial institutions face challenges implementing secure, compliant, Open Banking APIs. This document explores how [Tyk API Gateway](/tyk-oss-gateway), through its [FAPI Accelerator](https://github.com/TykTechnologies/tyk-fapi), enables financial institutions to implement robust Open Banking APIs.
+
+## Challenges in Financial Services API Implementation
+
+Implementing Open Banking APIs presents several challenges:
+
+1. **Stringent Security Requirements**:
+   - Compliance with **Financial-grade API (FAPI)** standards, such as FAPI 2.0, which ensure high-security API interactions.
+   - Ensuring data integrity, authenticity, and non-repudiation for sensitive financial transactions.
+
+2. **Complex Authentication**:
+   - Implementing **OAuth 2.0** with features like **Pushed Authorization Requests (PAR)** ([PAR](https://datatracker.ietf.org/doc/html/rfc9126)) and **Demonstrating Proof of Possession (DPoP)** ([DPoP](https://datatracker.ietf.org/doc/html/rfc9449)).
+   - Managing secure user consent and authorization flows.
+
+3. **Event Notifications**:
+   - Enabling TPPs to subscribe to real-time updates about account and payment events.
+   - Signing notifications with cryptographic signatures for security.
+
+4. **Idempotency**:
+   - Ensuring that duplicate requests (especially for payments) don't result in duplicate transactions.
+
+5. **Developer Experience**:
+   - Providing a seamless experience for TPP developers while maintaining high-security standards.
+
+## What is Tyk FAPI Accelerator?
+
+The **[Tyk FAPI Accelerator](https://github.com/TykTechnologies/tyk-fapi)** is a reference implementation provided by Tyk Technologies to help financial institutions build secure, standards-compliant Open Banking APIs. Built on the [Tyk API Gateway](/tyk-oss-gateway).
+
+### Architecture Overview
+
+The diagram below shows the Tyk FAPI Accelerator system in its environment, including users, external systems, and key actors.
+
+```mermaid
+flowchart TB
+    %% People/Actors
+    psu(["PSU (Payment Services User)
+    A customer of the bank who accesses their accounts and initiates payments through third-party providers"])
+    tpp(["TPP (Third Party Provider)
+    Companies providing financial services like account aggregators, credit checkers, and savings apps that integrate with banks"])
+    aspsp(["ASPSP (Account Servicing Payment Service Provider)
+    Banks and financial institutions that provide account and payment APIs to authorized third parties"])
+    
+    %% Systems
+    subgraph tykFAPI ["Tyk FAPI Accelerator"]
+        tykFAPISystem["Provides FAPI-compliant APIs for account information and payment initiation"]
+    end
+    
+    %% Relationships
+    psu -->|"Views accounts,
+    initiates payments"| tykFAPI
+    tpp -->|"Integrates with,
+    consumes APIs from"| tykFAPI
+    aspsp -->|"Configures, monitors,
+    provides services through"| tykFAPI
+    
+    %% Styling
+    classDef person fill:#335FFD,color:#F7F7FF,stroke:#9393AA
+    classDef system fill:#00A3A0,color:#F7F7FF,stroke:#03031C
+    class psu,tpp,aspsp person
+    class tykFAPISystem system
+```
+
+### Tyk FAPI Accelerator
+
+The diagram below shows all major components of the Tyk FAPI Accelerator and their interactions.
+
+```mermaid
+flowchart TB
+    %% People/Actors
+    psu(["PSU (Payment Services User)
+    A customer of the bank who accesses their accounts and initiates payments through third-party providers"])
+    tpp(["TPP (Third Party Provider)
+    Companies providing financial services like account aggregators, credit checkers, and savings apps that integrate with banks"])
+    
+    %% Tyk FAPI Accelerator System with Containers
+    subgraph tykFAPI ["Tyk FAPI Accelerator"]
+        tppApp["TPP Application
+        (NextJS)
+        Demonstrates how a TPP would interact with a bank's API"]
+        apiGateway["API Gateway
+        (Tyk Gateway)
+        Secures and routes API requests, enforces FAPI compliance, and handles event notifications"]
+        authServer["Authorization Server
+        (Keycloak)
+        Handles authentication and authorization"]
+        tykBank["Tyk Bank
+        (Node.js)
+        Mock bank implementation providing backend services"]
+        database[(Database)]
+        databaseLabel["PostgreSQL
+        Stores account information, payment data, and event subscriptions"]
+        kafka[(Message Broker)]
+        kafkaLabel["Kafka
+        Handles event notifications"]
+    end
+    
+    %% Connect labels to database and kafka
+    database --- databaseLabel
+    kafka --- kafkaLabel
+    
+    %% Relationships
+    psu -->|"Uses
+    (HTTPS)"| tppApp
+    tpp -->|"Develops
+    (IDE)"| tppApp
+    tppApp -->|"Makes API calls to
+    (HTTPS)"| apiGateway
+    tppApp -->|"Authenticates with
+    (OAuth 2.0/OIDC)"| authServer
+    apiGateway -->|"Routes requests to
+    (HTTPS)"| tykBank
+    authServer -->|"Verifies consents with
+    (HTTPS)"| tykBank
+    tykBank -->|"Reads from and writes to
+    (SQL)"| database
+    tykBank -->|"Publishes events to
+    (Kafka Protocol)"| kafka
+    
+    %% Event notification flow
+    kafka -->|"Subscribes to events"| apiGateway
+    apiGateway -->|"Sends signed notifications
+    (JWS/HTTPS Webhooks)"| tppApp
+    
+    %% Styling
+    classDef person fill:#335FFD,color:#F7F7FF,stroke:#9393AA
+    classDef tppStyle fill:#335FFD,color:#F7F7FF,stroke:#9393AA
+    classDef component fill:#00A3A0,color:#F7F7FF,stroke:#03031C
+    classDef authStyle fill:#00A3A0,color:#F7F7FF,stroke:#03031C
+    classDef bankStyle fill:#C01FB8,color:#F7F7FF,stroke:#03031C
+    classDef kafkaStyle fill:#E09D00,color:#F7F7FF,stroke:#03031C
+    classDef database fill:#5900CB,color:#F7F7FF,stroke:#03031C
+    classDef label fill:none,stroke:none
+    
+    class psu,tpp person
+    class tppApp tppStyle
+    class apiGateway component
+    class authServer authStyle
+    class tykBank bankStyle
+    class database database
+    class kafka kafkaStyle
+    class databaseLabel,kafkaLabel label
+```
+
+### Key Components
+
+1. **API Gateway (Tyk Gateway)**:
+   - Routes API requests to appropriate backend services
+   - Implements DPoP authentication via gRPC plugin
+   - Handles idempotency for payment requests
+   - Signs and delivers event notifications to TPPs
+
+2. **Authorization Server (Keycloak)**:
+   - Provides FAPI 2.0 compliant OAuth 2.0 and OpenID Connect
+   - Supports Pushed Authorization Requests (PAR)
+   - Manages user authentication and consent
+
+3. **Mock Bank Implementation**:
+   - Implements UK Open Banking Account Information API
+   - Implements UK Open Banking Payment Initiation API
+   - Implements UK Open Banking Event Subscriptions API
+   - Provides realistic testing environment
+
+4. **TPP Application**:
+   - Demonstrates how third parties integrate with the bank's APIs
+   - Implements FAPI 2.0 security profile
+   - Shows account information retrieval and payment initiation flows
+
+### Security Features
+
+The Tyk FAPI Accelerator implements several security features required for financial-grade APIs:
+
+1. **DPoP (Demonstrating Proof of Possession)**:
+   - Ensures the client possesses the private key corresponding to the public key in the token
+   - Prevents token theft and replay attacks
+   - Implemented as a gRPC plugin for Tyk Gateway
+
+2. **JWS Signing for Event Notifications**:
+   - Signs webhook notifications with JSON Web Signatures (JWS)
+   - Ensures authenticity and integrity of notifications
+   - Allows TPPs to verify the source of notifications
+
+3. **Idempotency Support**:
+   - Prevents duplicate transactions from repeated API calls
+   - Caches responses for idempotent requests
+   - Includes automatic garbage collection of expired entries
+
+4. **OAuth 2.0 with PAR**:
+   - Implements Pushed Authorization Requests for enhanced security
+   - Supports both automatic and manual authorization flows
+   - Complies with FAPI 2.0 security profile
+
+
+## Getting Started
+
+For detailed setup instructions, code examples, and deployment guides, please refer to the [Tyk FAPI Accelerator GitHub repository](https://github.com/TykTechnologies/tyk-fapi/tree/main?tab=readme-ov-file#getting-started).
+
+
+## Implementation Examples
+
+### Payment Flow Example
+
+The following sequence diagram illustrates a typical payment flow in the Tyk FAPI Accelerator:
+
+```mermaid
+sequenceDiagram
+    actor User as End User
+    participant TPP as TPP Application
+    participant Gateway as API Gateway
+    participant Auth as Authorization Server
+    participant Bank as Tyk Bank
+    participant DB as Database
+    participant Kafka as Message Broker
+    
+    %% Payment Initiation
+    User->>TPP: 1. Initiate payment (amount, recipient)
+    
+    %% Payment Consent Creation
+    TPP->>Gateway: 2. Create payment consent
+    Gateway->>Bank: 3. Forward consent request
+    Bank->>DB: 4. Store consent
+    DB-->>Bank: 5. Return consent ID
+    Bank-->>Gateway: 6. Consent response with ConsentId
+    Gateway-->>TPP: 7. Return ConsentId
+    
+    %% Pushed Authorization Request (PAR)
+    TPP->>Auth: 8. Push Authorization Request (PAR)
+    Note right of TPP: Direct connection to Auth Server
+    Auth-->>TPP: 9. Return request_uri
+    
+    %% Authorization Options
+    TPP->>User: 10. Display authorization options
+    
+    %% Two possible authorization flows
+    alt Automatic Authorization
+        User->>TPP: 11a. Select automatic authorization
+        TPP->>Bank: 12a. Direct authorize consent request
+        Note right of TPP: Server-side authorization
+        Bank->>DB: 13a. Update consent status
+        DB-->>Bank: 14a. Confirm update
+        Bank-->>TPP: 15a. Authorization confirmation
+    else Manual Authorization
+        User->>TPP: 11b. Select manual authorization
+        TPP->>User: 12b. Redirect to authorization URL
+        User->>Auth: 13b. Authorization request with request_uri
+        Auth->>Bank: 14b. Verify consent
+        Bank->>DB: 15b. Get consent details
+        DB-->>Bank: 16b. Return consent details
+        Bank-->>Auth: 17b. Consent details
+        Auth->>User: 18b. Display authorization UI
+        User->>Auth: 19b. Approve authorization
+        Auth->>DB: 20b. Update consent status
+        DB-->>Auth: 21b. Confirm update
+        Auth->>User: 22b. Redirect to callback URL with code
+        User->>TPP: 23b. Callback with authorization code
+    end
+    
+    %% Payment Creation
+    TPP->>Gateway: 24. Create payment with authorized consent
+    Gateway->>Bank: 25. Forward payment request
+    Bank->>DB: 26. Store payment
+    DB-->>Bank: 27. Return payment ID
+    Bank-->>Gateway: 28. Payment response with PaymentId
+    Gateway-->>TPP: 29. Return PaymentId
+    
+    %% Payment Confirmation
+    TPP->>User: 30. Display payment confirmation
+    
+    %% Event Notification
+    Bank->>Kafka: 31. Publish payment event
+    Kafka->>Bank: 32. Stream processor consumes event
+    Bank->>DB: 33. Query subscriptions
+    DB-->>Bank: 34. Return matching subscriptions
+    Bank->>TPP: 35. Send payment notification
+    TPP-->>Bank: 36. Acknowledge notification
+```
+
+### Event Notification Example
+
+The event notification system allows TPPs to receive updates about payment status changes:
+
+```mermaid
+sequenceDiagram
+    actor TPP as TPP Application
+    participant Gateway as API Gateway
+    participant EventAPI as Event Subscriptions API
+    participant PaymentAPI as Payment Initiation API
+    participant DB as Database
+    participant Kafka as Message Broker
+    
+    %% Subscription Registration
+    TPP->>Gateway: 1. Register callback URL
+    Gateway->>EventAPI: 2. Forward registration request
+    EventAPI->>DB: 3. Store subscription
+    DB-->>EventAPI: 4. Return subscription ID
+    EventAPI-->>Gateway: 5. Registration response with SubscriptionId
+    Gateway-->>TPP: 6. Return SubscriptionId
+    
+    %% Event Generation
+    Note over PaymentAPI: Payment status change or other event occurs
+    PaymentAPI->>Kafka: 7. Publish event
+    Note right of PaymentAPI: Event includes type, subject, timestamp
+    
+    %% Event Processing
+    Kafka-->>Gateway: 8. Consume event
+    Gateway->>DB: 9. Query subscriptions for event type
+    DB-->>Gateway: 10. Return matching subscriptions
+    Gateway->>Gateway: 11. Determine target TPPs and sign with JWS
+    
+    %% Notification Delivery
+    Gateway->>TPP: 12. Send signed notification
+    Note right of Gateway: Notification includes event details, links, and JWS signature
+    TPP->>TPP: 13. Verify JWS signature
+    TPP-->>Gateway: 14. Acknowledge (HTTP 200 OK)
+    
+    %% Error Handling (Alternative Flow)
+    alt Delivery Failure
+        Gateway->>TPP: 12. Send signed notification
+        TPP--xGateway: 13. Failed delivery (timeout/error)
+        Gateway->>Gateway: 14. Retry with exponential backoff
+        Gateway->>TPP: 15. Retry notification
+        TPP->>TPP: 16. Verify JWS signature
+        TPP-->>Gateway: 17. Acknowledge (HTTP 200 OK)
+    end
+```